diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 000000000..2408084cf
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"
diff --git a/.config/nextest.toml b/.config/nextest.toml
new file mode 100644
index 000000000..2a4cd2cb9
--- /dev/null
+++ b/.config/nextest.toml
@@ -0,0 +1,3 @@
+# Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
+# installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
+nextest-version = "0.9.150"
diff --git a/.github/workflows/ci-macos.yml b/.github/workflows/ci-macos.yml
new file mode 100644
index 000000000..3ef98173a
--- /dev/null
+++ b/.github/workflows/ci-macos.yml
@@ -0,0 +1,28 @@
+name: CI (macOS)
+
+# The macOS leg of the gate: `cargo xtask ci` on Apple silicon, through the suite's shared gate
+# workflow. The Linux gate (ci.yml) has no real GPU and runs on x86, so GPU tests on Metal and
+# results that depend on the platform's math library first ran on a contributor's Mac.
+#
+# On pushes to main, not on every pull request: macOS runners are scarce. A newer push cancels the
+# older run, so main is checked at its latest commit. Pull requests that change this file run it.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths: [.github/workflows/ci-macos.yml]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-macos-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      os: '["macos-15"]'
+      timeout-minutes: 120
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..2095acad7
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,27 @@
+name: CI
+
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+        libgl1-mesa-dev libasound2-dev
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index f8ac8a300..8967f9431 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -2,12 +2,10 @@
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
 name: FreeBSD
 
-# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every push
-# or dependency change: a drifted dependency still shows up within a day, and always before a
-# release ships. PRs that change the FreeBSD packaging itself still run it.
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
-  schedule:
-    - cron: "47 2 * * *"
   push:
     branches: [release]
   pull_request:
@@ -15,6 +13,8 @@ on:
       - .github/workflows/freebsd.yml
       - packaging/freebsd/**
       - packaging/env.sh
+  schedule:
+    - cron: "47 2 * * *"
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/house-rules.yml b/.github/workflows/house-rules.yml
new file mode 100644
index 000000000..de64ad3ee
--- /dev/null
+++ b/.github/workflows/house-rules.yml
@@ -0,0 +1,28 @@
+name: House rules
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  pull_request:
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: house-rules-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  house-rules:
+    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
+    with:
+      rust: true
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index 1353830f8..b903f82ea 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -22,3 +22,27 @@ jobs:
   lint:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
+
+  windows-install-policy:
+    timeout-minutes: 10
+    name: Windows installation policy (no app build)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install the pinned packaging toolchain
+        shell: pwsh
+        run: |
+          $tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'
+          dotnet tool install --tool-path $tools wix --version 5.0.2
+          if ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }
+          $tools >> $env:GITHUB_PATH
+          $policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json
+          foreach ($extension in @($policy.extensions)) {
+            & (Join-Path $tools 'wix.exe') extension add -g "WixToolset.$extension.wixext/5.0.2"
+            if ($LASTEXITCODE -ne 0) { throw "WiX extension $extension installation failed." }
+          }
+      - name: Build and check non-executable installer fixtures
+        shell: pwsh
+        run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 808e1628d..354fbd268 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,21 +10,29 @@ on:
         type: string
         default: ""
 
-permissions:
-  contents: write
-
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  # Regenerates contributors/contributors.json for the release commit; every build bundles it.
+  credits:
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
   release:
+    needs: credits
+    permissions:
+      contents: write
+      packages: write
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
       app-name: effectcraft
       app-title: EffectCraft
       version: ${{ inputs.version }}
+      contributors-artifact: ${{ needs.credits.outputs.artifact-name }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -40,3 +48,4 @@ jobs:
       AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
       AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
       AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
new file mode 100644
index 000000000..8f1aa5ad5
--- /dev/null
+++ b/.github/workflows/sonarcloud.yml
@@ -0,0 +1,24 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  sonarcloud:
+    # Track shared CI improvements on main.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    with:
+      timeout-minutes: 120
+      fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+    secrets: inherit
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index a074e6dbe..2cedc1a57 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -33,3 +33,5 @@ jobs:
     with:
       app-name: effectcraft
       app-dir: EffectCraft
+      install-relative-path: Programs/ArtCraft/EffectCraft
+      install-scope: perUser
diff --git a/.gitignore b/.gitignore
index 4a79323c8..ff6ad2397 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,7 @@ target/
 /log
 .DS_Store
 .claude/worktrees/
+__pycache__/
+
+# After Effects test corpus fetched by `cargo xtask aep-corpus`
+/corpus/
diff --git a/AGENTS.md b/AGENTS.md
index aad29c94a..ba48c1a97 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,3 +1,56 @@
+<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
+## House rules
+
+These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
+
+1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
+2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
+3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
+4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
+5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
+6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
+7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
+8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
+9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
+10. **Keep secrets and personal details out** of the repository, logs and requests.
+11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
+12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
+13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
+14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
+15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
+<!-- craft-house-rules:end -->
+<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
+## Rust Craft repositories
+
+These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
+
+1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
+2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
+3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
+4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
+5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
+6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
+
+## Licence allowlist
+
+Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
+
+- `ISC`
+- `MIT`
+- `BSD-2-Clause`
+- `BSD-3-Clause`
+- `Apache-2.0`
+- `OFL-1.1`
+- `Ubuntu-font-1.0`
+- `Bitstream-Vera`
+- `CC0-1.0`
+- `CC-BY-4.0`
+- `CC-BY-SA-4.0`
+- `LicenseRef-Public-Domain`
+
+`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
+<!-- craft-house-rules:end -->
+
 # EffectCraft — rules for agents and contributors
 
 These rules apply to every human and AI contributor. `CLAUDE.md` holds the working instructions; this
@@ -9,7 +62,7 @@ People trust EffectCraft with hours of work. A malformed project, PSD, SVG, Lott
 expression or script, a broken plug-in, a bad control-channel or MCP argument, a corrupt preferences file
 or a full disk must produce an error the user (or agent) can act on, never a crash and never lost work.
 **This rule outranks feature work:** don't ship a feature by adding a panic path, and fix a crash before
-building on top of it. Full standard: [craftrules `standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+building on top of it.
 
 - **Fail with `Result<T, E>`** through the crate's error type and propagate with `?`; add context
   (`map_err`, an error variant) rather than discarding it. Lenient readers fall back and record the repair.
@@ -102,12 +155,23 @@ reproduce an image (for example, point lists traced from someone else's icon).
 
 ## 3. Engineering rules
 
-See `CLAUDE.md`: pure Rust, dependency layering (`cargo xtask layers`), exact `Tick` time, everything is
-a command, everything is agent-drivable, and the quality gates (`cargo xtask ci`) before every commit.
+- **Layering** (`cargo xtask layers`): nothing below L5 depends on egui/eframe/winit/rfd/cpal; L0–L4 build for wasm32.
+- **Exact time:** `effectcraft_time::Tick` (254 016 000 000/s). Keyframe times are layer time.
+- **Property tree:** everything animatable is a `Property` in the layer's `PropGroup` tree, addressed by paths (`transform/position`, `effects/#1/blurriness`, `@uid`).
+- **Everything is a command** (`crates/engine`): id, label, menu path, shortcut, params, enabled(), run(). UI, CLI, control channel and MCP dispatch by id.
+- **Everything is agent-drivable:** every interactive widget registers an automation id; UI state is serde.
+- **Community links** (Help menu, About, header Discord button): https://discord.gg/artcraft, https://getartcraft.com, https://getartcraft.com/apps/effectcraft, https://github.com/storytold/effectcraft.
+- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, layers, assets, wasm).
+- New workspace crates include `[lints] workspace = true` in `Cargo.toml`. Production crate roots declare the crate-level lint attributes before modules; crate-level `//!` documentation may precede them.
+- **Commits:** one task id per commit (`M6.3: trim paths`). Only green states.
+- `cargo run -p effectcraft -- --control 9877` opens the desktop app with the JSON-lines control server (`docs/control-protocol.md`). For UI work, look at the result, including the headless `snapshot` example.
+- `plan/` is an optional gitignored notebook (`plan/aftereffects/` may hold reference notes and captures). Do not ask for it, do not stop when it is absent, and never commit those captures.
+- Read [`docs/gaps.md`](docs/gaps.md) and [`docs/target-app-parity.md`](docs/target-app-parity.md) before choosing work. Fidelity, reliability and stability (G1–G3) come before new features.
+- Some workflow files still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task.
+
 
 Shared real-file test corpora (Photoshop-authored PSDs, etc.) live in
-[`storytold/photocraft-corpus`](https://github.com/storytold/photocraft-corpus), explained in
-[craftrules `standards/test-corpora.md`](https://github.com/storytold/craftrules/blob/main/standards/test-corpora.md).
+[`storytold/photocraft-corpus`](https://github.com/storytold/photocraft-corpus).
 Never commit large binary fixtures to this repo; fetch them pinned by commit and sha256-verified,
 as PhotoCraft does with `cargo xtask corpus`.
 
@@ -116,7 +180,7 @@ as PhotoCraft does with `cargo xtask corpus`.
 
 - [ROADMAP.md](ROADMAP.md): stage, headline numbers and what's next
 - [docs/gaps.md](docs/gaps.md): every known shortfall against After Effects, ranked, and the prioritised workstreams (G1–G9); read it before choosing work
-- [docs/target-app-parity.md](docs/target-app-parity.md): the parity numbers and how they were measured, with the per-area docs it links (UI, file formats, hardware, localization, effects, scripting); progress docs follow [craftrules `standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md)
+- [docs/target-app-parity.md](docs/target-app-parity.md): the parity numbers and how they were measured, with the per-area docs it links (UI, file formats, hardware, localization, effects, scripting)
 - [CONTRIBUTING.md](CONTRIBUTING.md): setup, gates, commits, how to add things
 - [docs/architecture.md](docs/architecture.md): layers, data model, commands, pipeline
 - [docs/testing.md](docs/testing.md): oracle tests, criteria, benchmarks
@@ -134,11 +198,13 @@ as PhotoCraft does with `cargo xtask corpus`.
   username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
   whether they want to be credited by more than their username: a real name, a display name, and/or
   their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file, or run
-  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  (copy the template at the top of the file)
   and include it in their PR, committed as them. If no, change nothing: they are credited as
   `@username` anyway.
 - Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
   GitHub profiles). Never hand-edit `contributors.json`.
-- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
-  re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index be99cdce1..5bff5cdb0 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -1,9 +1,28 @@
 # Attribution
 
-Every non-code asset in EffectCraft, with its author, source and licence. Each file listed here also has
+Every non-code asset in EffectCraft, with its author, source and licence. Each repository file listed here also has
 a `<file>.attribution` sidecar with full details. The rules are in [AGENTS.md](AGENTS.md) §1: no Adobe
 iconography, images or other Adobe assets; open licences only; every asset attributed.
 `cargo xtask assets` checks that this index and the sidecars cover every asset in the repository.
+The complete licence texts and copyright notices for the bundled fonts, including the fonts embedded
+by the pinned egui dependency, are reproduced in [`NOTICE`](NOTICE), which every package ships; the
+`assets/fonts/OFL-*.txt` files are the upstream copies kept beside the fonts.
+
+## Bundled dependency fonts
+
+These fonts are embedded by the pinned egui dependency (epaint_default_fonts 0.37 at
+`6d518fc799681571963842f95b55a6b68431b15a`); no font file is added to this repository.
+egui-icons is always embedded, `default_fonts` adds Ubuntu Light and Hack, and
+`monochrome_emoji_fonts` adds Noto Emoji and emoji-icon-font. The complete copyright notices
+and licence texts are in [`NOTICE`](NOTICE).
+
+| Asset | Author | Source | Licence |
+|---|---|---|---|
+| `epaint_default_fonts/fonts/egui-icons.ttf` | John Slegers (emoji-icon-font) | https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/egui-icons.txt; original https://github.com/jslegers/emoji-icon-font | MIT (complete copyright and permission text in `NOTICE`) |
+| `epaint_default_fonts/fonts/emoji-icon-font.ttf` | John Slegers | https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt; original https://github.com/jslegers/emoji-icon-font | MIT (complete copyright and permission text in `NOTICE`) |
+| `epaint_default_fonts/fonts/NotoEmoji-Regular.ttf` | Google Inc. (The Noto Project Authors) | https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/OFL.txt | OFL-1.1 (complete text in `NOTICE`) |
+| `epaint_default_fonts/fonts/Ubuntu-Light.ttf` | Canonical Ltd. and Dalton Maag | https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/UFL.txt | Ubuntu Font Licence 1.0 (complete text in `NOTICE`) |
+| `epaint_default_fonts/fonts/Hack-Regular.ttf` | Source Foundry Authors; Bitstream Inc. | https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/Hack-Regular.txt; original https://github.com/source-foundry/Hack | MIT AND Bitstream-Vera (complete texts in `NOTICE`) |
 
 ## Asset files
 
@@ -15,6 +34,7 @@ iconography, images or other Adobe assets; open licences only; every asset attri
 | `assets/fonts/Inter-Bold.ttf` | The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) |
 | `assets/fonts/Inter-Italic.ttf` | The Inter Project Authors | https://github.com/rsms/inter | OFL-1.1 (`assets/fonts/OFL-Inter.txt`) |
 | `assets/fonts/NotoSerif-Regular.ttf` | The Noto Project Authors | https://github.com/notofonts/latin-greek-cyrillic | OFL-1.1 (`assets/fonts/OFL-NotoSerif.txt`) |
+| `assets/fonts/NotoSansSymbols2-Regular.ttf` | The Noto Project Authors | https://github.com/notofonts/symbols | OFL-1.1 (`assets/fonts/OFL-NotoSansSymbols2.txt`) |
 | `assets/fonts/JetBrainsMono-Regular.ttf` | The JetBrains Mono Project Authors | https://github.com/JetBrains/JetBrainsMono | OFL-1.1 (`assets/fonts/OFL-JetBrainsMono.txt`) |
 | `apps/effectcraft-web/web/favicon.svg` | EffectCraft contributors | Original work: web app icon, a copy of `assets/app-icon/effectcraft-small.svg` (the unicorn app icon) | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) |
 | `packaging/macos/dmg/background.svg` | @XusBadia | Original work: macOS DMG Finder window background, derived from the EffectCraft app icon (`assets/app-icon/effectcraft.svg`); rendered to a TIFF by `packaging/macos/package.sh` at package time | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`) |
@@ -44,6 +64,8 @@ iconography, images or other Adobe assets; open licences only; every asset attri
 | `crates/model/tests/fixtures/cube.obj` | EffectCraft contributors | Original work: Wavefront OBJ test fixture (unit cube, two materials) | MIT OR Apache-2.0 |
 | `crates/model/tests/fixtures/cube.mtl` | EffectCraft contributors | Original work: MTL test fixture (materials of cube.obj) | MIT OR Apache-2.0 |
 
+Two small After Effects test projects of `crates/aep` are in this repository: `crates/aep/tests/fixtures/synthetic.aep` (original work, made with After Effects 2026 from own data, working space None, the embedded colour profile removed; MIT OR Apache-2.0, with its `.attribution` sidecar) and `crates/aep/tests/fixtures/ai-mask-3099.aep` (original work, made with After Effects 2026 from four hand-written one-page PDFs named `.ai`, footage paths and host name neutralised, the embedded colour profiles replaced by stubs made with `crates/aep/examples/stubicc.rs`; MIT OR Apache-2.0, with its `.attribution` sidecar). The other After Effects test projects of `crates/aep` are not in this repository. They are original work of an EffectCraft contributor, generated with After Effects 2026 as own test data (MIT OR Apache-2.0, each file with its `.attribution` sidecar); they are in [storytold/effectcraft-corpus](https://github.com/storytold/effectcraft-corpus) with their sidecars, fetched by `cargo xtask aep-corpus` (commit-pinned, SHA-256-verified), and the tests read them only from the folder named by `EFFECTCRAFT_AEP_FIXTURES` (opt-in). Their embedded colour profiles are replaced by stubs made with `crates/aep/examples/stubicc.rs` (a header and a description, no colour data), so no vendor profile data is in them.
+
 ## Screenshots
 
 Screenshots of EffectCraft itself, rendered headlessly, showing only procedurally generated demo content.
@@ -69,13 +91,15 @@ Screenshots of EffectCraft itself, rendered headlessly, showing only procedurall
   `crates/engine/presets/transitions.json` (sidecar `.attribution`).
 - Backgrounds animation presets (23: drifting gradients, fog, cloud and smoke, plasma and magma, cells and crystals, scrolling grids
   and checks, pulse rings, bokeh, light sweep): `crates/engine/presets/backgrounds.json` (sidecar `.attribution`).
+- Behaviors animation presets (22: wiggle, shake, float, orbit, bounce, drift, pendulum, spin, pulse, heartbeat, blink, strobe, flicker):
+  `crates/engine/presets/behaviors.json` (sidecar `.attribution`).
 - Sample scripts (File ▸ Scripts) and ScriptUI panel: `crates/engine/scripts/Rename Layers.jsx`,
   `crates/engine/scripts/Sort Layers by In Point.jsx`, `crates/engine/scripts/Create Null at Selected Layers.jsx`,
   `crates/engine/scripts/Render Queue Batch.jsx`, `crates/engine/scripts/ScriptUI Panels/Layer Tools.jsx`
   (sidecars `.attribution`).
 - Bundled extension (ScriptUI panel) with its twelve built-in ease presets:
   `extensions/scriptui-panels/Ease Presets.jsx` (sidecar `.attribution`).
-- Example effect plug-in: `examples/plugins/posterize-bands` (plug-in API v1, WebAssembly).
+- Example effect plug-in: `examples/plugins/posterize-bands` (WebAssembly ABI 1).
 
 ## Trained models (optional downloads, not bundled)
 
diff --git a/CLAUDE.md b/CLAUDE.md
index a7c47fe3f..43c994c2d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,30 +1 @@
-# EffectCraft — instructions for agents
-
-EffectCraft is a clean-room, open-source, pure-Rust motion graphics and visual effects compositor targeting Adobe After Effects parity (and beyond). Native on macOS, Windows, Linux; web via WASM. Sibling of `../photocraft` (Photoshop), `../pdfcraft` (Acrobat), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom) and `../designcraft` (InDesign), with the same conventions.
-
-## Start every session here
-`plan/` is maintainer-local (gitignored). Public equivalents: [`ROADMAP.md`](ROADMAP.md), [`docs/`](docs/).
-1. Read `plan/STATUS.md` (current milestone, next task, running agents, blockers).
-2. Read the task in `plan/execution-plan.md` §3, the relevant section of `plan/architecture.md`, and the crate README/docs you touch. Feature ids: `plan/aftereffects/feature-catalog.md`; effects: `plan/aftereffects/effects-list.md`; UI reference: `plan/aftereffects/README.md`.
-3. Read [`docs/gaps.md`](docs/gaps.md): every known shortfall, ranked, and the prioritised workstreams; the numbers are in [`docs/target-app-parity.md`](docs/target-app-parity.md). Fidelity, reliability and stability (G1–G3) come before new features.
-4. Follow the autonomous operation protocol (`plan/execution-plan.md` §7). Don't stop to ask.
-
-## Non-negotiables
-**Read [`AGENTS.md`](AGENTS.md) first; its rules override everything here.** No Adobe assets, every asset licensed + attributed (`cargo xtask assets`).
-- **Never crash** (AGENTS.md "Never crash"; outranks feature work: a crash loses people's work). Non-test code has no `unwrap()`/`expect()`/`panic!`/`unreachable!`/`todo!`/`unimplemented!` and no `unsafe`: return `Result` and use `?`, `ok_or`, `let … else`. Input-derived indices, slices and arithmetic use `get()` and checked/saturating math; recursion is depth-limited; locks handle poisoning. The app's last-resort guard turns an escaped panic into an error and keeps the document. Every crash fix gets a regression test. Standard: [craftrules `standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
-- **Clean-room.** Behaviour and public docs only. No GPL/LGPL/AGPL code. ffmpeg only as an external test oracle.
-- **Pure Rust.** Media codecs come from FilmCraft crates (git deps behind `crates/media`, see `plan/adr/0001`).
-- **Layering** (`cargo xtask layers`): nothing below L5 depends on egui/eframe/winit/rfd/cpal; L0–L4 build for wasm32.
-- **Exact time:** `effectcraft_time::Tick` (254 016 000 000/s). Keyframe times are **layer time**.
-- **Property tree:** everything animatable is a `Property` in the layer's `PropGroup` tree, addressed by paths (`transform/position`, `effects/#1/blurriness`, `@uid`).
-- **Everything is a command** (`crates/engine`): id, label, menu path, shortcut, params, enabled(), run(). UI, CLI, control channel and MCP dispatch by id.
-- **Everything is agent-drivable:** every interactive widget registers an automation id; UI state is serde.
-- **Community links** (Help menu, About, header Discord button): https://discord.gg/artcraft, https://getartcraft.com, https://getartcraft.com/apps/effectcraft, https://github.com/storytold/effectcraft.
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, layers, assets, wasm).
-- **Commits:** one task id per commit (`M6.3: trim paths`). Only green states.
-
-## Running and looking at the app
-- `cargo run -p effectcraft -- --control 9877` opens the desktop app with the JSON-lines control server (`docs/control-protocol.md`).
-- For UI work, **look at the result**. Headless (no window, works while the user is busy on the machine): `cargo run -p effectcraft-ui-egui --example snapshot -- --out ui.png --step '{"method":"engine.execute","params":{"command":"layer.select","params":{"layers":["#2"]}}}'` (steps are control-channel requests; `--script steps.jsonl`; `{"method":"snap","params":{"path":…}}` for intermediate shots). Or drive the live app via the control channel and take `ui.screenshot` (needs the window visible on screen).
-- After Effects reference: drive AE via ExtendScript (`osascript -e 'tell application "Adobe After Effects 2026" to DoScriptFile "x.jsx"'`) and capture only AE's window (`screencapture -l <windowid>`); keep captures in `plan/aftereffects/ref/` (gitignored), never commit them, never capture the Home screen.
-- Parallel agents: separate git worktrees and `CARGO_TARGET_DIR=target/agent-<name>`; keep every `Cargo.toml` valid (the `crates/*` glob).
+@AGENTS.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dfa28c9f0..29521ad73 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -7,12 +7,75 @@ work apply to everyone, people and AI agents alike, and they are not negotiable.
 
 You need [Rust](https://rustup.rs/) 1.95 or newer.
 
+On Linux the desktop app plays preview sound through `cpal`, so the build needs a usable ALSA
+pkg-config package: an `alsa.pc` that pkg-config can find, naming the linkable ALSA runtime
+library (usually `libasound.so.2`). `alsa-sys` runs pkg-config at build time; it does not compile
+ALSA's headers. Without a usable package the build fails at link time with an unrelated-looking
+error; `cargo xtask ci` probes pkg-config up front and names the package:
+
+```sh
+sudo dnf install alsa-lib-devel        # Fedora
+sudo apt install libasound2-dev        # Debian / Ubuntu
+sudo pacman -S alsa-lib                # Arch
+```
+
+If you cannot install the package, point `PKG_CONFIG_PATH` at a directory holding an `alsa.pc`
+whose `Libs` line names your system's `libasound` (usually `libasound.so.2`); every CI run needs
+that variable set.
+
 ```sh
 cargo run -p effectcraft -- --demo       # the desktop app, with the demo project
 cargo test --workspace
 cargo xtask ci                           # what every commit must pass
 ```
 
+The default `dev` profile keeps debug info to line tables: builds are fast and panics/backtraces
+still name the file and line, but a debugger cannot show local variables. For an interactive
+debugger session use the `dev-full` profile, which is the same build with full debug info:
+
+```sh
+cargo run --profile dev-full -p effectcraft -- --demo
+```
+
+### Windows
+
+The MSVC toolchain, rustup's default on Windows, is what the releases use: with the Visual Studio
+C++ build tools installed, the commands above work as they are.
+
+The GNU toolchain (`x86_64-pc-windows-gnu`) needs a current mingw-w64 GCC and binutils first on
+`PATH`. They provide the linker and the Windows import libraries, such as `libshlwapi.a` for
+opening links from the app. With MSYS2:
+
+```powershell
+C:\msys64\usr\bin\pacman.exe -S --needed mingw-w64-x86_64-gcc
+$env:PATH = "C:\msys64\mingw64\bin;$env:PATH"
+cargo +stable-x86_64-pc-windows-gnu run -p effectcraft -- --demo
+```
+
+An older MinGW earlier on `PATH` can break the build: CodeBlocks' GCC 8.1 fails to link
+`boa_engine` ([#1882](https://github.com/storytold/effectcraft/issues/1882)).
+
+Rust's bundled LLD and self-contained libraries don't include every import library EffectCraft
+needs, so on their own they stop with `unable to find library` for `-lshlwapi`, `-lktmw32`,
+`-lpropsys` and `-lversion` ([#1886](https://github.com/storytold/effectcraft/issues/1886)). To
+link that way, copy those four from mingw-w64 into a folder of its own and add that folder to the
+search path in your own Cargo config (`%USERPROFILE%\.cargo\config.toml`). Don't add all of
+mingw-w64's `lib` folder: its C runtime clashes with Rust's bundled one
+(`undefined symbol: DllEntryPoint`).
+
+```powershell
+New-Item -ItemType Directory -Force C:\gnu-import-libs
+foreach ($lib in "shlwapi", "ktmw32", "propsys", "version") {
+    Copy-Item "C:\msys64\mingw64\lib\lib$lib.a" C:\gnu-import-libs\
+}
+```
+
+```toml
+[target.x86_64-pc-windows-gnu]
+linker = "rust-lld"
+rustflags = ["-C", "link-self-contained=yes", "-L", "native=C:/gnu-import-libs"]
+```
+
 ## Ground rules
 
 - **Clean room.** Work from After Effects' public documentation and its observable behaviour only.
diff --git a/Cargo.lock b/Cargo.lock
index 412fb6672..f45bf8414 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,66 +4,60 @@ version = 4
 
 [[package]]
 name = "accesskit"
-version = "0.24.1"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+checksum = "ad442f58ee04714aaa0ba0a2768c1ea1935b29507bb22ddece8cbbc76db02932"
 dependencies = [
  "uuid",
 ]
 
 [[package]]
 name = "accesskit_atspi_common"
-version = "0.18.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
+checksum = "52c182f9c282ac9c5638d876d551d15e5f7d397ec263349a0c6a2b61595dd5e4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.36.0",
+ "accesskit_consumer",
  "atspi-common",
- "phf 0.13.1",
+ "phf",
  "serde",
  "zvariant",
 ]
 
 [[package]]
 name = "accesskit_consumer"
-version = "0.35.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
+checksum = "8a45e2bb300bea6d5f33a82c3e051c3ddc6f41c209750f68a0acbe991a284344"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
-name = "accesskit_consumer"
-version = "0.36.0"
+name = "accesskit_ios"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
+checksum = "28e539d64b27fd4c14de8f78ada8f7c944c092f52f7e49fb63316507a57f6937"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit 0.2.2",
 ]
 
 [[package]]
 name = "accesskit_macos"
-version = "0.26.3"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
+checksum = "5701624bf6a11efb6d4c8e922bf44126ed96250e5faa9a7a0468c979635839a4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.38.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "objc2 0.5.2",
  "objc2-app-kit 0.2.2",
  "objc2-foundation 0.2.2",
@@ -71,9 +65,9 @@ dependencies = [
 
 [[package]]
 name = "accesskit_unix"
-version = "0.21.1"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
+checksum = "202f24df034a7476d07b7f74284de84f6d62aabd858dbe7ee9cad3b7ad6f8f9d"
 dependencies = [
  "accesskit",
  "accesskit_atspi_common",
@@ -89,13 +83,13 @@ dependencies = [
 
 [[package]]
 name = "accesskit_windows"
-version = "0.32.1"
+version = "0.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
+checksum = "ce63f35d6bdcf59f26b76b3379063f738e6412cef46999cc772d46aa3de35adb"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "static_assertions",
  "windows 0.62.2",
  "windows-core 0.62.2",
@@ -103,11 +97,12 @@ dependencies = [
 
 [[package]]
 name = "accesskit_winit"
-version = "0.32.2"
+version = "0.34.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
+checksum = "ee96dd150375c05912d8a473f98c2fb155fb3234fac88292d396548a2460fa77"
 dependencies = [
  "accesskit",
+ "accesskit_ios",
  "accesskit_macos",
  "accesskit_unix",
  "accesskit_windows",
@@ -214,14 +209,15 @@ dependencies = [
  "clipboard-win",
  "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -436,13 +432,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
-name = "bit-set"
-version = "0.8.0"
+name = "base64"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
 [[package]]
 name = "bit-set"
@@ -454,10 +447,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "bit-vec"
-version = "0.8.0"
+name = "bit-set"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c"
+dependencies = [
+ "bit-vec 0.10.1",
+]
 
 [[package]]
 name = "bit-vec"
@@ -465,6 +461,16 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 
+[[package]]
+name = "bit-vec"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269"
+dependencies = [
+ "borsh",
+ "serde",
+]
+
 [[package]]
 name = "bit_field"
 version = "0.10.3"
@@ -483,6 +489,15 @@ version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.5.1"
@@ -498,7 +513,7 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -607,7 +622,7 @@ dependencies = [
  "hashbrown 0.17.1",
  "indexmap",
  "once_cell",
- "phf 0.14.0",
+ "phf",
  "rustc-hash 2.1.3",
  "static_assertions",
 ]
@@ -658,6 +673,30 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -684,6 +723,12 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
@@ -747,6 +792,45 @@ dependencies = [
  "wayland-client",
 ]
 
+[[package]]
+name = "candle-core"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c15b675b80d994b2eadb20a4bbe434eabeb454eac3ee5e2b4cf6f147ee9be091"
+dependencies = [
+ "byteorder",
+ "float8",
+ "gemm",
+ "half",
+ "libm",
+ "memmap2",
+ "num-traits",
+ "num_cpus",
+ "rand 0.9.5",
+ "rand_distr",
+ "rayon",
+ "safetensors",
+ "thiserror 2.0.21",
+ "yoke",
+ "zip 7.4.0",
+]
+
+[[package]]
+name = "candle-nn"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3045fa9e7aef8567d209a27d56b692f60b96f4d0569f4c3011f8ca6715c65e03"
+dependencies = [
+ "candle-core",
+ "half",
+ "libc",
+ "num-traits",
+ "rayon",
+ "safetensors",
+ "serde",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "cast"
 version = "0.3.0"
@@ -799,10 +883,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.3.1",
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -812,6 +905,15 @@ dependencies = [
  "error-code",
 ]
 
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -867,6 +969,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -880,7 +992,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
 dependencies = [
  "bitflags 1.3.2",
- "core-foundation",
+ "core-foundation 0.9.4",
  "core-graphics-types",
  "foreign-types",
  "libc",
@@ -893,7 +1005,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
 dependencies = [
  "bitflags 1.3.2",
- "core-foundation",
+ "core-foundation 0.9.4",
  "libc",
 ]
 
@@ -959,6 +1071,15 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.1"
@@ -971,24 +1092,119 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-ecproj-format"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=ca1b5e2edb8568335c6c14f390307bd5beae8238#ca1b5e2edb8568335c6c14f390307bd5beae8238"
+dependencies = [
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-i18n"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
+ "log",
+ "objc2-foundation 0.3.2",
+ "sys-locale",
+ "unicode-bidi",
+ "windows-registry",
+ "writeable",
+]
+
+[[package]]
+name = "craft-media"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=f0ad6c1e1d297908915f4be315b0fcfc9be7b5d4#f0ad6c1e1d297908915f4be315b0fcfc9be7b5d4"
+dependencies = [
+ "thiserror 2.0.21",
+]
 
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d#ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "hayro-syntax",
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "craft-quit"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "dispatch2",
+ "egui",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+]
+
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=5c874d51eeb3de70e735c8ce87a59a7dedd47675#5c874d51eeb3de70e735c8ce87a59a7dedd47675"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
  "egui",
+ "epaint",
+ "js-sys",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "serde",
+ "skrifa",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "craft-update"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
+dependencies = [
+ "chrono",
+ "dunce",
+ "egui",
+ "flate2",
+ "getrandom 0.3.4",
+ "image",
+ "log",
+ "plist",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tar",
+ "tempfile",
+ "ureq",
+ "verifysign",
+ "winreg",
+ "winsafe",
+ "zip 9.1.3",
 ]
 
 [[package]]
@@ -1040,6 +1256,16 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "cursor-icon"
 version = "1.2.0"
@@ -1072,6 +1298,16 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
 [[package]]
 name = "dispatch"
 version = "0.2.0"
@@ -1087,7 +1323,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -1131,6 +1367,28 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-stack"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c4713e43e2886ba72b8271aa66c93d722116acf7a75555cce11dcde84388fe8"
+dependencies = [
+ "bytemuck",
+ "dyn-stack-macros",
+]
+
+[[package]]
+name = "dyn-stack-macros"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d926b4d407d372f141f93bb444696142c29d32962ccbd3531117cf3aa0bfa9"
+
 [[package]]
 name = "dynify"
 version = "0.1.2"
@@ -1153,9 +1411,8 @@ dependencies = [
 
 [[package]]
 name = "ecolor"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "emath",
@@ -1163,9 +1420,10 @@ dependencies = [
 
 [[package]]
 name = "effectcraft"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "cpal",
+ "craft-update",
  "effectcraft-engine",
  "effectcraft-host",
  "effectcraft-ui-egui",
@@ -1174,10 +1432,10 @@ dependencies = [
  "fmv-macos-events",
  "log",
  "muda",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "rfd",
  "serde",
  "serde_json",
@@ -1187,27 +1445,43 @@ dependencies = [
 ]
 
 [[package]]
-name = "effectcraft-automation"
-version = "0.12.0"
+name = "effectcraft-aep"
+version = "0.21.0"
 dependencies = [
- "effectcraft-engine",
- "effectcraft-host",
- "effectcraft-script",
- "image",
+ "effectcraft-color",
+ "effectcraft-effects",
+ "effectcraft-keyframe",
+ "effectcraft-project",
+ "effectcraft-time",
+ "serde",
  "serde_json",
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "effectcraft-automation"
+version = "0.21.0"
+dependencies = [
+ "effectcraft-engine",
+ "effectcraft-host",
+ "effectcraft-model",
+ "effectcraft-script",
+ "image",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "effectcraft-av1enc"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "filmcraft-av1",
 ]
 
 [[package]]
 name = "effectcraft-cli"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "cpu-time",
  "effectcraft-automation",
@@ -1215,7 +1489,10 @@ dependencies = [
  "effectcraft-gpu",
  "effectcraft-host",
  "effectcraft-render",
+ "effectcraft-sam2",
+ "effectcraft-segment",
  "effectcraft-time",
+ "effectcraft-track",
  "effectcraft-ui-egui",
  "image",
  "serde_json",
@@ -1223,7 +1500,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-color"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1231,8 +1508,9 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-effects"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
+ "chrono",
  "effectcraft-color",
  "effectcraft-geom",
  "effectcraft-keyframe",
@@ -1248,9 +1526,11 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-engine"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
+ "chrono",
  "craft-docpath",
+ "effectcraft-aep",
  "effectcraft-color",
  "effectcraft-effects",
  "effectcraft-geom",
@@ -1264,6 +1544,7 @@ dependencies = [
  "effectcraft-psd",
  "effectcraft-raster",
  "effectcraft-render",
+ "effectcraft-sam2",
  "effectcraft-segment",
  "effectcraft-svg",
  "effectcraft-text",
@@ -1274,15 +1555,17 @@ dependencies = [
  "kurbo",
  "log",
  "rayon",
+ "same-file",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.21",
  "web-time",
 ]
 
 [[package]]
 name = "effectcraft-export"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-av1enc",
  "effectcraft-color",
@@ -1296,6 +1579,7 @@ dependencies = [
  "effectcraft-render",
  "effectcraft-time",
  "effectcraft-vp9enc",
+ "exr",
  "filmcraft-aac",
  "filmcraft-h264enc",
  "filmcraft-isobmff",
@@ -1312,7 +1596,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-expr"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "boa_engine",
  "effectcraft-color",
@@ -1329,7 +1613,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-geom"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1337,7 +1621,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-gpu"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "bytemuck",
  "effectcraft-color",
@@ -1351,26 +1635,39 @@ dependencies = [
  "effectcraft-time",
  "js-sys",
  "log",
- "pollster 0.4.0",
+ "pollster 1.0.1",
+ "rayon",
  "wasm-bindgen",
  "web-time",
  "wgpu",
 ]
 
+[[package]]
+name = "effectcraft-helper-host"
+version = "0.21.0"
+dependencies = [
+ "bytemuck",
+ "effectcraft-effects",
+ "log",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "effectcraft-hevcenc"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "filmcraft-hevc",
 ]
 
 [[package]]
 name = "effectcraft-host"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-engine",
  "effectcraft-export",
  "effectcraft-expr",
+ "effectcraft-helper-host",
  "effectcraft-interchange",
  "effectcraft-media",
  "effectcraft-pdf",
@@ -1387,11 +1684,12 @@ dependencies = [
  "log",
  "rayon",
  "serde_json",
+ "tempfile",
 ]
 
 [[package]]
 name = "effectcraft-interchange"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-keyframe",
@@ -1410,7 +1708,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-keyframe"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-geom",
@@ -1422,7 +1720,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-lottie"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "craft-docpath",
  "effectcraft-color",
@@ -1440,9 +1738,11 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-media"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "craft-docpath",
+ "effectcraft-color",
+ "effectcraft-effects",
  "effectcraft-model",
  "effectcraft-pdf",
  "effectcraft-project",
@@ -1452,28 +1752,31 @@ dependencies = [
  "effectcraft-svg",
  "effectcraft-time",
  "exr",
+ "filmcraft-aac",
  "filmcraft-codecs",
  "filmcraft-color",
  "filmcraft-frame",
  "filmcraft-isobmff",
+ "filmcraft-matroska",
  "filmcraft-media",
+ "filmcraft-mpegts",
  "filmcraft-time",
  "gif",
  "image",
  "log",
  "rayon",
  "serde_json",
- "symphonia",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "effectcraft-model"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-geom",
  "image",
- "miniz_oxide 0.8.9",
+ "log",
+ "miniz_oxide 0.9.1",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
@@ -1481,26 +1784,26 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-opusenc"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "filmcraft-opus",
 ]
 
 [[package]]
 name = "effectcraft-path"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-geom",
  "effectcraft-keyframe",
  "effectcraft-raster",
  "kurbo",
  "linesweeper",
- "tiny-skia",
+ "tiny-skia 0.12.0",
 ]
 
 [[package]]
 name = "effectcraft-pdf"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "craft-pdf",
  "effectcraft-raster",
@@ -1508,7 +1811,7 @@ dependencies = [
  "effectcraft-text",
  "image",
  "kurbo",
- "miniz_oxide 0.8.9",
+ "miniz_oxide 0.9.1",
  "skrifa",
  "wasm-bindgen-test",
  "zune-jpeg",
@@ -1516,7 +1819,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-plugin"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-effects",
  "effectcraft-keyframe",
@@ -1528,8 +1831,9 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-project"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
+ "craft-ecproj-format",
  "effectcraft-color",
  "effectcraft-geom",
  "effectcraft-keyframe",
@@ -1541,23 +1845,24 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-psd"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
- "miniz_oxide 0.8.9",
+ "miniz_oxide 0.9.1",
 ]
 
 [[package]]
 name = "effectcraft-raster"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-geom",
  "rayon",
+ "tempfile",
 ]
 
 [[package]]
 name = "effectcraft-render"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-color",
  "effectcraft-effects",
@@ -1574,12 +1879,28 @@ dependencies = [
  "lz4_flex",
  "rayon",
  "serde",
+ "tempfile",
  "web-time",
 ]
 
+[[package]]
+name = "effectcraft-sam2"
+version = "0.21.0"
+dependencies = [
+ "bytemuck",
+ "candle-core",
+ "candle-nn",
+ "effectcraft-segment",
+ "half",
+ "log",
+ "pollster 1.0.1",
+ "rayon",
+ "wgpu",
+]
+
 [[package]]
 name = "effectcraft-script"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "boa_engine",
  "effectcraft-engine",
@@ -1591,21 +1912,22 @@ dependencies = [
  "effectcraft-render",
  "effectcraft-time",
  "serde_json",
+ "socket2",
  "web-time",
 ]
 
 [[package]]
 name = "effectcraft-segment"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
- "miniz_oxide 0.8.9",
+ "miniz_oxide 0.9.1",
  "ndarray",
  "rayon",
 ]
 
 [[package]]
 name = "effectcraft-svg"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-geom",
  "effectcraft-path",
@@ -1617,7 +1939,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-text"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-keyframe",
  "harfrust",
@@ -1629,7 +1951,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-time"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "proptest",
  "serde",
@@ -1637,7 +1959,7 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-track"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-raster",
  "effectcraft-segment",
@@ -1649,43 +1971,52 @@ dependencies = [
 
 [[package]]
 name = "effectcraft-ui-egui"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
+ "bytemuck",
+ "chrono",
+ "craft-quit",
  "craft-ui",
+ "craft-update",
  "effectcraft-color",
  "effectcraft-engine",
  "effectcraft-geom",
  "effectcraft-gpu",
  "effectcraft-host",
  "effectcraft-keyframe",
+ "effectcraft-media",
  "effectcraft-path",
  "effectcraft-project",
  "effectcraft-render",
+ "effectcraft-segment",
  "effectcraft-text",
  "effectcraft-time",
  "eframe",
  "egui",
+ "egui_extras",
  "egui_kittest",
  "exr",
+ "half",
  "image",
  "kurbo",
  "log",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "rayon",
  "serde",
  "serde_json",
  "sys-locale",
+ "tempfile",
  "toml",
  "web-time",
 ]
 
 [[package]]
 name = "effectcraft-vp9enc"
-version = "0.12.0"
+version = "0.21.0"
 
 [[package]]
 name = "effectcraft-web"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
  "effectcraft-engine",
  "effectcraft-export",
@@ -1708,9 +2039,8 @@ dependencies = [
 
 [[package]]
 name = "eframe"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1724,7 +2054,7 @@ dependencies = [
  "image",
  "js-sys",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "parking_lot",
@@ -1732,6 +2062,7 @@ dependencies = [
  "pollster 1.0.1",
  "profiling",
  "raw-window-handle",
+ "send_wrapper",
  "static_assertions",
  "wasm-bindgen",
  "web-sys",
@@ -1743,9 +2074,8 @@ dependencies = [
 
 [[package]]
 name = "egui"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit",
  "ahash",
@@ -1763,9 +2093,8 @@ dependencies = [
 
 [[package]]
 name = "egui-wgpu"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1783,31 +2112,47 @@ dependencies = [
 
 [[package]]
 name = "egui-winit"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit_winit",
  "arboard",
+ "block2 0.6.2",
  "bytemuck",
  "egui",
+ "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "objc2-ui-kit 0.3.2",
+ "parking_lot",
  "profiling",
  "raw-window-handle",
  "smithay-clipboard",
  "web-time",
  "webbrowser",
+ "windows-sys 0.61.2",
  "winit",
 ]
 
+[[package]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+dependencies = [
+ "ahash",
+ "egui",
+ "enum-map",
+ "itertools",
+ "log",
+ "profiling",
+]
+
 [[package]]
 name = "egui_glow"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "egui",
@@ -1819,9 +2164,8 @@ dependencies = [
 
 [[package]]
 name = "egui_kittest"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb3f3effb2726fee23449293e67acbf6cc6ce35525b1722bd5743bb348114d5"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "eframe",
  "egui",
@@ -1843,9 +2187,8 @@ checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "emath"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
 ]
@@ -1870,6 +2213,38 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "enum-map"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
+dependencies = [
+ "enum-map-derive",
+]
+
+[[package]]
+name = "enum-map-derive"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1893,9 +2268,8 @@ dependencies = [
 
 [[package]]
 name = "epaint"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1911,16 +2285,17 @@ dependencies = [
  "self_cell",
  "skrifa",
  "smallvec",
+ "unicode-bidi",
  "unicode-general-category",
+ "unicode-properties",
  "unicode-segmentation",
  "vello_cpu",
 ]
 
 [[package]]
 name = "epaint_default_fonts"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
 [[package]]
 name = "equator"
@@ -2049,10 +2424,20 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "filmcraft-aac"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "thiserror 2.0.21",
@@ -2060,40 +2445,60 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-ac3"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "thiserror 2.0.21",
 ]
 
 [[package]]
-name = "filmcraft-av1"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+name = "filmcraft-apv"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "filmcraft-av1"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "filmcraft-bitstream",
+ "rayon",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "filmcraft-avi"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+
 [[package]]
 name = "filmcraft-bitstream"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "craft-media",
+]
 
 [[package]]
 name = "filmcraft-cfb"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 
 [[package]]
 name = "filmcraft-codecs"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-aac",
  "filmcraft-ac3",
+ "filmcraft-apv",
  "filmcraft-av1",
+ "filmcraft-avi",
  "filmcraft-bitstream",
  "filmcraft-color",
  "filmcraft-dnx",
@@ -2103,6 +2508,7 @@ dependencies = [
  "filmcraft-isobmff",
  "filmcraft-matroska",
  "filmcraft-media",
+ "filmcraft-mpa",
  "filmcraft-mpeg2v",
  "filmcraft-mpegts",
  "filmcraft-mxf",
@@ -2110,9 +2516,11 @@ dependencies = [
  "filmcraft-opus",
  "filmcraft-prores",
  "filmcraft-time",
+ "filmcraft-vp8",
  "filmcraft-vp9",
  "image",
  "log",
+ "rayon",
  "symphonia",
  "thiserror 2.0.21",
  "web-time",
@@ -2120,16 +2528,25 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-color"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "filmcraft-dng"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "rayon",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "filmcraft-dnx"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
@@ -2138,8 +2555,8 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-frame"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-color",
  "filmcraft-time",
@@ -2149,16 +2566,16 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-geom"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "filmcraft-h264"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
@@ -2167,8 +2584,8 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-h264enc"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
@@ -2177,8 +2594,8 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-hevc"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
@@ -2187,8 +2604,8 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-interchange"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-cfb",
  "filmcraft-color",
@@ -2204,24 +2621,27 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-isobmff"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
- "filmcraft-bitstream",
- "thiserror 2.0.21",
+ "craft-media",
 ]
 
 [[package]]
 name = "filmcraft-matroska"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "craft-media",
+]
 
 [[package]]
 name = "filmcraft-media"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-color",
+ "filmcraft-dng",
  "filmcraft-frame",
  "filmcraft-time",
  "image",
@@ -2230,10 +2650,19 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "filmcraft-mpa"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "filmcraft-bitstream",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "filmcraft-mpeg2v"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "rayon",
  "thiserror 2.0.21",
@@ -2241,31 +2670,34 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-mpegts"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "filmcraft-mxf"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "chrono",
+]
 
 [[package]]
 name = "filmcraft-ogg"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 
 [[package]]
 name = "filmcraft-opus"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 
 [[package]]
 name = "filmcraft-project"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-color",
  "filmcraft-geom",
@@ -2278,8 +2710,8 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-prores"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
@@ -2288,16 +2720,24 @@ dependencies = [
 
 [[package]]
 name = "filmcraft-time"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "filmcraft-vp8"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "filmcraft-vp9"
-version = "0.1.1"
-source = "git+https://github.com/storytold/filmcraft?rev=2c5ba7a72619935f0481f99d59409e0d1844b234#2c5ba7a72619935f0481f99d59409e0d1844b234"
+version = "0.12.0"
+source = "git+https://github.com/storytold/filmcraft?rev=d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5#d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5"
 dependencies = [
  "filmcraft-bitstream",
  "rayon",
@@ -2310,6 +2750,17 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -2327,13 +2778,25 @@ dependencies = [
  "zlib-rs",
 ]
 
+[[package]]
+name = "float8"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719a903cc23e4a89e87962c2a80fdb45cdaad0983a89bd150bb57b4c8571a7d5"
+dependencies = [
+ "half",
+ "num-traits",
+ "rand 0.9.5",
+ "rand_distr",
+]
+
 [[package]]
 name = "fmv-macos-events"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90642cf66dde7f205dc8b42dfe57b47d0f3a29f571b832742883ef512e23fe55"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
 ]
@@ -2469,6 +2932,135 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "gemm"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa0673db364b12263d103b68337a68fbecc541d6f6b61ba72fe438654709eacb"
+dependencies = [
+ "dyn-stack",
+ "gemm-c32",
+ "gemm-c64",
+ "gemm-common",
+ "gemm-f16",
+ "gemm-f32",
+ "gemm-f64",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "raw-cpuid",
+ "seq-macro",
+]
+
+[[package]]
+name = "gemm-c32"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "086936dbdcb99e37aad81d320f98f670e53c1e55a98bee70573e83f95beb128c"
+dependencies = [
+ "dyn-stack",
+ "gemm-common",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "raw-cpuid",
+ "seq-macro",
+]
+
+[[package]]
+name = "gemm-c64"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20c8aeeeec425959bda4d9827664029ba1501a90a0d1e6228e48bef741db3a3f"
+dependencies = [
+ "dyn-stack",
+ "gemm-common",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "raw-cpuid",
+ "seq-macro",
+]
+
+[[package]]
+name = "gemm-common"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88027625910cc9b1085aaaa1c4bc46bb3a36aad323452b33c25b5e4e7c8e2a3e"
+dependencies = [
+ "bytemuck",
+ "dyn-stack",
+ "half",
+ "libm",
+ "num-complex",
+ "num-traits",
+ "once_cell",
+ "paste",
+ "pulp",
+ "raw-cpuid",
+ "rayon",
+ "seq-macro",
+ "sysctl",
+]
+
+[[package]]
+name = "gemm-f16"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3df7a55202e6cd6739d82ae3399c8e0c7e1402859b30e4cb780e61525d9486e"
+dependencies = [
+ "dyn-stack",
+ "gemm-common",
+ "gemm-f32",
+ "half",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "raw-cpuid",
+ "rayon",
+ "seq-macro",
+]
+
+[[package]]
+name = "gemm-f32"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02e0b8c9da1fbec6e3e3ab2ce6bc259ef18eb5f6f0d3e4edf54b75f9fd41a81c"
+dependencies = [
+ "dyn-stack",
+ "gemm-common",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "raw-cpuid",
+ "seq-macro",
+]
+
+[[package]]
+name = "gemm-f64"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "056131e8f2a521bfab322f804ccd652520c79700d81209e9d9275bbdecaadc6a"
+dependencies = [
+ "dyn-stack",
+ "gemm-common",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "raw-cpuid",
+ "seq-macro",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "gethostname"
 version = "1.1.0"
@@ -2479,6 +3071,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.3.4"
@@ -2528,9 +3131,9 @@ dependencies = [
 
 [[package]]
 name = "glifo"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
+checksum = "282a26c1e23de04bdab3e34a21b6f877a479b96737792516b9b8b8f69b6661be"
 dependencies = [
  "bytemuck",
  "foldhash 0.2.0",
@@ -2568,7 +3171,7 @@ dependencies = [
  "glutin_glx_sys",
  "glutin_wgl_sys",
  "libloading",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -2649,9 +3252,12 @@ version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
 dependencies = [
+ "bytemuck",
  "cfg-if",
  "crunchy",
  "num-traits",
+ "rand 0.9.5",
+ "rand_distr",
  "zerocopy",
 ]
 
@@ -2691,6 +3297,8 @@ dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash 0.2.0",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2713,8 +3321,7 @@ checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
 [[package]]
 name = "hayro-jbig2"
 version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69374b3668dd45aeb3d3145cda68f2c7b4f223aaa2511e67d076f1c7d741388d"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "hayro-ccitt",
 ]
@@ -2728,7 +3335,7 @@ checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
 [[package]]
 name = "hayro-syntax"
 version = "0.7.2"
-source = "git+https://github.com/storytold/craft-libs?rev=ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d#ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "hayro-jbig2",
  "hayro-jpeg2000",
@@ -2756,6 +3363,22 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -2770,6 +3393,23 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_locale_core"
 version = "2.3.0"
@@ -2778,11 +3418,32 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
+ "serde",
  "tinystr",
  "writeable",
  "zerovec",
 ]
 
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -2795,6 +3456,7 @@ dependencies = [
  "icu_provider",
  "smallvec",
  "utf16_iter",
+ "utf8_iter",
  "write16",
  "zerovec",
 ]
@@ -2805,6 +3467,32 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
+[[package]]
+name = "icu_pattern"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b3db611446bd92c246b03e4aa0bafa71ddb194af431ddbb42b9d70e4bfce1a0"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_properties"
 version = "2.3.0"
@@ -2834,6 +3522,9 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2841,6 +3532,30 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -3047,12 +3762,12 @@ checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
 [[package]]
 name = "kittest"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ceaa75eb0036a32b6b9833962eb18137449e9817e2e586006471925b727fd5"
+checksum = "0bb81a721ba76aa095b7f45deb180504f786904e56ca4b8e141f66eb89a78b75"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
+ "accesskit_consumer",
 ]
 
 [[package]]
@@ -3128,9 +3843,9 @@ checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
 
 [[package]]
 name = "linesweeper"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c19728333c060c6569a53c9a0e56c4be0df52cb4e6e07a8fbe16084cecce769"
+checksum = "a25df1b0c5432893f41bba817150e323703ee5f6d974f3a6808ac7fd7f046d18"
 dependencies = [
  "arrayvec",
  "kurbo",
@@ -3156,6 +3871,9 @@ name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "litrs"
@@ -3180,9 +3898,9 @@ checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "lz4_flex"
-version = "0.11.6"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
+checksum = "ecbdfe44b1bd960b68170b417450a628c43f7cf56bb3c5317e61cb230ee7f226"
 
 [[package]]
 name = "mach2"
@@ -3216,6 +3934,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
+ "stable_deref_trait",
 ]
 
 [[package]]
@@ -3269,18 +3988,17 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
 dependencies = [
  "crossbeam-channel",
  "dpi",
  "keyboard-types",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
  "png",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
@@ -3375,12 +4093,33 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -3447,6 +4186,16 @@ dependencies = [
  "libm",
 ]
 
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
 [[package]]
 name = "num_enum"
 version = "0.7.6"
@@ -3496,9 +4245,9 @@ dependencies = [
 
 [[package]]
 name = "objc2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
 dependencies = [
  "objc2-encode",
 ]
@@ -3527,7 +4276,7 @@ checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -3541,7 +4290,7 @@ checksum = "6948501a91121d6399b79abaa33a8aa4ea7857fe019f341b8c23ad6e81b79b08"
 dependencies = [
  "bitflags 2.13.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio",
  "objc2-core-audio-types",
  "objc2-core-foundation",
@@ -3579,7 +4328,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1eebcea8b0dbff5f7c8504f3107c68fc061a3eb44932051c8cf8a68d969c3b2"
 dependencies = [
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio-types",
  "objc2-core-foundation",
 ]
@@ -3591,7 +4340,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a89f2ec274a0cf4a32642b2991e8b351a404d290da87bb6a9a9d8632490bd1c"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -3614,7 +4363,7 @@ checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
  "bitflags 2.13.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -3625,7 +4374,7 @@ checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
  "bitflags 2.13.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-io-surface",
 ]
@@ -3681,7 +4430,7 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -3692,7 +4441,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -3728,7 +4477,7 @@ checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -3752,7 +4501,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -3797,7 +4546,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
 ]
@@ -3844,6 +4593,12 @@ version = "11.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
 [[package]]
 name = "orbclient"
 version = "0.3.55"
@@ -3873,6 +4628,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3934,14 +4699,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
-name = "phf"
-version = "0.13.1"
+name = "petgraph"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
- "phf_macros 0.13.1",
- "phf_shared 0.13.1",
- "serde",
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
 ]
 
 [[package]]
@@ -3950,18 +4715,9 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
 dependencies = [
- "phf_macros 0.14.0",
- "phf_shared 0.14.0",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
-dependencies = [
- "fastrand",
- "phf_shared 0.13.1",
+ "phf_macros",
+ "phf_shared",
+ "serde",
 ]
 
 [[package]]
@@ -3971,20 +4727,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
 dependencies = [
  "fastrand",
- "phf_shared 0.14.0",
-]
-
-[[package]]
-name = "phf_macros"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
-dependencies = [
- "phf_generator 0.13.1",
- "phf_shared 0.13.1",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "phf_shared",
 ]
 
 [[package]]
@@ -3993,22 +4736,13 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
 dependencies = [
- "phf_generator 0.14.0",
- "phf_shared 0.14.0",
+ "phf_generator",
+ "phf_shared",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "phf_shared"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
-dependencies = [
- "siphasher",
-]
-
 [[package]]
 name = "phf_shared"
 version = "0.14.0"
@@ -4067,6 +4801,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "plist"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327a4cb2ad49dc48adfdc9da89e22c64d488b508c67a044d71ba729e4521a285"
+dependencies = [
+ "base64",
+ "indexmap",
+ "quick-xml 0.42.0",
+ "serde",
+ "time",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -4130,12 +4877,24 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
  "zerovec",
 ]
 
@@ -4186,16 +4945,17 @@ checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
 
 [[package]]
 name = "proptest"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
 dependencies = [
- "bit-set 0.8.0",
- "bit-vec 0.8.0",
+ "bit-set 0.11.1",
+ "bit-vec 0.10.1",
  "bitflags 2.13.2",
+ "chacha20",
+ "core_detect",
  "num-traits",
- "rand 0.9.5",
- "rand_chacha",
+ "rand 0.10.3",
  "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
@@ -4253,6 +5013,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -4321,12 +5090,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
-name = "rand_xorshift"
-version = "0.4.0"
+name = "rand_distr"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
 dependencies = [
- "rand_core 0.9.5",
+ "num-traits",
+ "rand 0.9.5",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
+dependencies = [
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -4356,7 +5135,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40d213455a5f1dc59214213c7330e074ddf8114c9a42411eb890c767357ce135"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
  "objc2-quartz-core 0.3.2",
@@ -4464,7 +5243,7 @@ dependencies = [
  "js-sys",
  "libc",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -4481,10 +5260,24 @@ dependencies = [
 ]
 
 [[package]]
-name = "roxmltree"
-version = "0.21.1"
+name = "ring"
+version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1964b10c76125c36f8afe190065a4bf9a87bf324842c05701330bba9f1cacbb"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "roxmltree"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9da7f59328b09405b181fee1018925fad50f157afb43c0c0f5c522c256dd5907"
 dependencies = [
  "memchr",
 ]
@@ -4536,6 +5329,80 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni 0.22.4",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -4560,6 +5427,17 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04d056b875a9d2e6cb9a61d127afee9ac5999b9f87bcb32079d1318e505be714"
 
+[[package]]
+name = "safetensors"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "675656c1eabb620b921efea4f9199f97fc86e36dd6ffd1fbbe48d0f59a4987f5"
+dependencies = [
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -4569,6 +5447,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scoped-tls"
 version = "1.0.1"
@@ -4581,6 +5468,40 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sctk-adwaita"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec"
+dependencies = [
+ "log",
+ "smithay-client-toolkit 0.19.2",
+ "tiny-skia 0.11.4",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "self_cell"
 version = "1.3.0"
@@ -4592,6 +5513,22 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
+
+[[package]]
+name = "seq-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
@@ -4625,9 +5562,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -4656,6 +5593,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -4815,6 +5763,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.9"
@@ -4890,6 +5848,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "symphonia"
 version = "0.5.5"
@@ -5087,7 +6051,24 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eab9a99a024a169fe8a903cf9d4a3b3601109bcc13bd9e3c6fff259138626c4"
 dependencies = [
+ "js-sys",
  "libc",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "sysctl"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc"
+dependencies = [
+ "bitflags 2.13.2",
+ "byteorder",
+ "enum-as-inner",
+ "libc",
+ "thiserror 1.0.69",
+ "walkdir",
 ]
 
 [[package]]
@@ -5102,6 +6083,16 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -5217,6 +6208,20 @@ dependencies = [
  "time-core",
 ]
 
+[[package]]
+name = "tiny-skia"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "tiny-skia-path 0.11.4",
+]
+
 [[package]]
 name = "tiny-skia"
 version = "0.12.0"
@@ -5228,7 +6233,18 @@ dependencies = [
  "bytemuck",
  "cfg-if",
  "log",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
+]
+
+[[package]]
+name = "tiny-skia-path"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+dependencies = [
+ "arrayref",
+ "bytemuck",
+ "strict-num",
 ]
 
 [[package]]
@@ -5249,6 +6265,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
+ "serde_core",
  "zerovec",
 ]
 
@@ -5350,6 +6367,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -5359,6 +6387,24 @@ dependencies = [
  "rustc-hash 2.1.3",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54ec2755506471f54baf5e4bb5499d8e510cc1caf271270e778a736bd2d7336c"
+
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
 [[package]]
 name = "uds_windows"
 version = "1.2.1"
@@ -5427,6 +6473,41 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
+dependencies = [
+ "base64",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "ureq-proto",
+ "utf8-zero",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -5445,6 +6526,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
 
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -5464,9 +6551,9 @@ dependencies = [
 
 [[package]]
 name = "vello_common"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
+checksum = "bbb2141a2bca6e6d598e471fd4d1d7eed8e020aad6a28187edda07f091a325dd"
 dependencies = [
  "bytemuck",
  "fearless_simd",
@@ -5479,9 +6566,9 @@ dependencies = [
 
 [[package]]
 name = "vello_cpu"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
+checksum = "ace506ca414548966fcf3c283be94eb1cad8254de488791ee698bf438b0890a9"
 dependencies = [
  "bytemuck",
  "glifo",
@@ -5489,6 +6576,16 @@ dependencies = [
  "vello_common",
 ]
 
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -5514,6 +6611,12 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
 [[package]]
 name = "wasip2"
 version = "1.0.4+wasi-0.2.12"
@@ -5830,7 +6933,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -5875,13 +6978,22 @@ dependencies = [
  "jni 0.22.4",
  "log",
  "ndk-context",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "url",
  "web-sys",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -6016,7 +7128,7 @@ dependencies = [
  "naga",
  "naga-types",
  "ndk-sys",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -6205,6 +7317,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result 0.4.1",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.1.2"
@@ -6259,15 +7382,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -6301,30 +7415,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
@@ -6346,12 +7443,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -6364,12 +7455,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -6382,24 +7467,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -6412,12 +7485,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -6430,12 +7497,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -6448,12 +7509,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -6466,17 +7521,10 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+source = "git+https://github.com/storytold/winit.git?rev=a517b3846ee8457d84ee4975110bfda6797c44dc#a517b3846ee8457d84ee4975110bfda6797c44dc"
 dependencies = [
  "ahash",
  "android-activity",
@@ -6487,7 +7535,7 @@ dependencies = [
  "calloop 0.13.0",
  "cfg_aliases",
  "concurrent-queue",
- "core-foundation",
+ "core-foundation 0.9.4",
  "core-graphics",
  "cursor-icon",
  "dpi",
@@ -6505,6 +7553,7 @@ dependencies = [
  "raw-window-handle",
  "redox_syscall 0.4.1",
  "rustix 0.38.44",
+ "sctk-adwaita",
  "smithay-client-toolkit 0.19.2",
  "smol_str",
  "tracing",
@@ -6533,21 +7582,55 @@ dependencies = [
 ]
 
 [[package]]
-name = "winresource"
-version = "0.1.31"
+name = "winreg"
+version = "0.55.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winresource"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml",
  "version_check",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "write16"
 version = "1.0.0"
@@ -6559,6 +7642,9 @@ name = "writeable"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "x11-dl"
@@ -6625,9 +7711,13 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.12.0"
+version = "0.21.0"
 dependencies = [
+ "chrono",
+ "pkg-config",
  "serde_json",
+ "sha2",
+ "tempfile",
 ]
 
 [[package]]
@@ -6800,6 +7890,12 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.5"
@@ -6807,8 +7903,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
+ "litemap",
+ "serde_core",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
@@ -6817,6 +7916,7 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
+ "serde",
  "yoke",
  "zerofrom",
  "zerovec-derive",
@@ -6833,6 +7933,34 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "zip"
+version = "7.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc12baa6db2b15a140161ce53d72209dacea594230798c24774139b54ecaa980"
+dependencies = [
+ "crc32fast",
+ "indexmap",
+ "memchr",
+ "typed-path 0.12.4",
+]
+
+[[package]]
+name = "zip"
+version = "9.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "getrandom 0.4.3",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path 0.13.0",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
@@ -6909,3 +8037,18 @@ dependencies = [
  "syn 3.0.6",
  "winnow",
 ]
+
+[[patch.unused]]
+name = "egui_demo_lib"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_inspection"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_system_font_provider"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
diff --git a/Cargo.toml b/Cargo.toml
index 7af58f009..b85c3c6b8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,15 +4,19 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/*"]
 
 [workspace.package]
-version = "0.12.0"
+version = "0.21.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
 repository = "https://github.com/storytold/effectcraft"
 
 [workspace.dependencies]
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d", version = "=0.1.0", default-features = false, features = ["read"] }
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0", default-features = false, features = ["read"] }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-quit = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-ecproj-format = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "ca1b5e2edb8568335c6c14f390307bd5beae8238" }
+# craft-update: app-specific pretend versions apply to startup and manual checks.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "1b34eba41e62138fc2438d2734523b302840b45d", features = ["egui"] }
 # internal
 effectcraft-time = { path = "crates/time" }
 effectcraft-geom = { path = "crates/geom" }
@@ -25,6 +29,7 @@ effectcraft-text = { path = "crates/text" }
 effectcraft-effects = { path = "crates/effects" }
 effectcraft-track = { path = "crates/track" }
 effectcraft-segment = { path = "crates/segment" }
+effectcraft-sam2 = { path = "crates/sam2" }
 effectcraft-model = { path = "crates/model" }
 effectcraft-render = { path = "crates/render" }
 effectcraft-gpu = { path = "crates/gpu" }
@@ -35,6 +40,7 @@ effectcraft-lottie = { path = "crates/lottie" }
 effectcraft-interchange = { path = "crates/interchange" }
 effectcraft-pdf = { path = "crates/pdf" }
 effectcraft-psd = { path = "crates/psd" }
+effectcraft-aep = { path = "crates/aep" }
 effectcraft-vp9enc = { path = "crates/vp9enc" }
 effectcraft-svg = { path = "crates/svg" }
 effectcraft-engine = { path = "crates/engine" }
@@ -46,12 +52,15 @@ effectcraft-script = { path = "crates/script" }
 effectcraft-hevcenc = { path = "crates/hevcenc" }
 effectcraft-av1enc = { path = "crates/av1enc" }
 effectcraft-plugin = { path = "crates/plugin" }
+effectcraft-helper-host = { path = "crates/helper-host" }
 
 # foundation
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
+# All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 rayon = "1"
 # std::time::Instant/SystemTime on native; the browser clock on wasm32 (std's panic there).
 web-time = "1"
@@ -70,44 +79,52 @@ skrifa = { version = "0.44", default-features = false, features = ["std"] }
 harfrust = { version = "0.12", default-features = false, features = ["std"] }
 exr = "1.74"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
+same-file = "1.0"
+tempfile = "3.27"
 
 # media codecs + containers: FilmCraft's pure-Rust crates, pinned to a revision (plan/adr/0001).
 # Only `crates/media`, `crates/export` and `crates/interchange` may depend on these.
-filmcraft-codecs = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-media = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-frame = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-color = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-time = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
+filmcraft-codecs = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-media = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-frame = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-color = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-time = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
 # encoders + muxer (crates/export)
-filmcraft-h264enc = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-prores = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-aac = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-isobmff = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
+filmcraft-h264enc = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-prores = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-aac = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-isobmff = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+# container headers read for AAC channel layouts (crates/media)
+filmcraft-matroska = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-mpegts = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
 # decoder used as the round-trip oracle of effectcraft-opusenc (crates/export dev-dependency)
-filmcraft-opus = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-vp9 = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
+filmcraft-opus = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-vp9 = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
 # decoders used as the round-trip oracles of effectcraft-hevcenc / effectcraft-av1enc (dev-dependencies only)
-filmcraft-hevc = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-av1 = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
+filmcraft-hevc = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-av1 = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
 # timeline interchange (EDL, FCP7 XML, FCPXML, OTIO) for Premiere Pro interop (crates/interchange only)
-filmcraft-interchange = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-project = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-filmcraft-geom = { git = "https://github.com/storytold/filmcraft", rev = "2c5ba7a72619935f0481f99d59409e0d1844b234" }
-# The symphonia filmcraft-codecs already builds, named only to turn on its AIFF reader: the pinned
-# rev enables wav alone (FilmCraft main enables aiff too). Drop it when the pin moves past that.
-symphonia = { version = "0.5.5", default-features = false, features = ["aiff"] }
+filmcraft-interchange = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-project = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
+filmcraft-geom = { git = "https://github.com/storytold/filmcraft", rev = "d5ead4ba1ee2f1cd13cb86a4239aee2730a3d9f5" }
 
 # gpu (the same wgpu eframe / egui-wgpu use)
 wgpu = { version = "30.0.1", features = ["fragile-send-sync-non-atomic-wasm"] }
 bytemuck = "1"
-pollster = "0.4"
+pollster = "1"
+half = "2.7"
 
 # ui
 # Shared frontend components; keep this dependency above the engine boundary.
-craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
-egui = "0.36"
-eframe = { version = "0.36", default-features = false }
-egui_kittest = "0.36"
+# Shared UI and the complete egui family select reviewed immutable commits below.
+craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["serde"] }
+# `default_fonts` and `monochrome_emoji_fonts` are explicit: the app's `FontDefinitions::default()`
+# and its `✔`/`▣` chrome glyphs need both, and kittest's own dev-dependencies do not propagate.
+egui = { version = "0.37", default-features = false, features = ["default_fonts", "monochrome_emoji_fonts"] }
+eframe = { version = "0.37", default-features = false }
+# Resizable table columns (About ▸ Contributors / Models); no image loaders.
+egui_extras = { version = "0.37", default-features = false }
+egui_kittest = "0.37"
 rfd = "0.17"
 cpal = "0.16"
 # The operating system's interface language (MIT/Apache-2.0, no dependencies on desktop).
@@ -124,22 +141,36 @@ sys-locale = "0.3"
 # filmcraft-prores = { path = "../filmcraft/crates/prores" }
 # filmcraft-aac = { path = "../filmcraft/crates/aac" }
 # filmcraft-isobmff = { path = "../filmcraft/crates/isobmff" }
+# filmcraft-matroska = { path = "../filmcraft/crates/matroska" }
+# filmcraft-mpegts = { path = "../filmcraft/crates/mpegts" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
 
 [workspace.lints.clippy]
+cognitive_complexity = "deny"
+too_many_arguments = "deny"
+wildcard_imports = "deny"
 dbg_macro = "warn"
 todo = "warn"
-too_many_arguments = "allow"
 needless_range_loop = "allow"
 type_complexity = "allow"
 
 [profile.dev.package."*"]
 opt-level = 2
+debug = false
 
 [profile.dev]
 opt-level = 1
+# Panics and backtraces keep file and line; full debug info only made the many test binaries large.
+debug = "line-tables-only"
+
+# Same settings as `dev`, but with full debug info for interactive debugger sessions: local
+# variables, parameters and column breakpoints work. Use `--profile dev-full` when debugging;
+# everything else stays on the fast default. See CONTRIBUTING.md, "Setup".
+[profile.dev-full]
+inherits = "dev"
+debug = true
 
 # Pixel hot loops: keep debug builds interactive.
 [profile.dev.package.effectcraft-raster]
@@ -211,4 +242,20 @@ lto = "thin"
 codegen-units = 1
 
 [patch.crates-io]
-hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d", version = "=0.7.2" }
+hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.7.2" }
+hayro-jbig2 = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.3.0" }
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }
diff --git a/NOTICE b/NOTICE
index 43bd2e2a9..4a79e69fd 100644
--- a/NOTICE
+++ b/NOTICE
@@ -12,11 +12,311 @@ Third-party material
 This product bundles third-party material under its own licenses, listed below. The per-file
 list (author, source, license) is in ATTRIBUTION.md.
 
-Inter (assets/fonts/Inter-*.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-Inter.txt.
-Noto Serif (assets/fonts/NotoSerif-Regular.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-NotoSerif.txt.
-JetBrains Mono (assets/fonts/JetBrainsMono-Regular.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-JetBrainsMono.txt.
+Bundled fonts
+
+EffectCraft embeds Inter, Noto Serif, JetBrains Mono and Noto Sans Symbols 2 from
+assets/fonts/. The pinned egui dependency (epaint_default_fonts, revision
+6d518fc799681571963842f95b55a6b68431b15a) additionally embeds Ubuntu Light, Hack,
+Noto Emoji, egui-icons and emoji-icon-font through EffectCraft's enabled `default_fonts`
+and `monochrome_emoji_fonts` features; no font file from that dependency is added to
+this repository. The complete copyright notices and licence texts required for all of
+these fonts follow.
 
 The optional PDF document reader uses craft-pdf and Hayro-syntax 0.7.2, MIT OR Apache-2.0.
 The shared patched syntax source is centralized in storytold/craft-libs, transferred from
 PdfCraft revision 9ed3abe4907a127d36b12fbfeee71d7e26248da1. This parser-only use embeds no
 Hayro fonts, CMaps or image codecs; EffectCraft keeps its existing fonts and drawing filters.
+
+Linux Wayland window decorations
+-------------------------------
+sctk-adwaita 0.10.1 (https://github.com/PolyMeilex/sctk-adwaita,
+commit d5f343c45c04d4a026db57f76760819b7325db00) is used by winit on Linux
+for vector window controls. Its title-font features are disabled: no Cantarell
+font is embedded by this dependency and no font file is added to this repo.
+
+sctk-adwaita's MIT licence:
+
+MIT License
+
+Copyright (c) 2022 Bartłomiej Maryńczak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+SIL Open Font License 1.1
+
+Applies to Inter (assets/fonts/Inter-*.ttf), Noto Serif (assets/fonts/NotoSerif-Regular.ttf),
+JetBrains Mono (assets/fonts/JetBrainsMono-Regular.ttf), Noto Sans Symbols 2
+(assets/fonts/NotoSansSymbols2-Regular.ttf) and Noto Emoji (NotoEmoji-Regular.ttf).
+Copyright notices:
+
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-greek-cyrillic)
+Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/symbols)
+Copyright 2013 Google Inc. All Rights Reserved.
+
+The fonts in assets/fonts/ also keep their upstream licence files at
+assets/fonts/OFL-<family>.txt. The complete licence text follows.
+
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Ubuntu Font Licence 1.0
+
+Applies to Ubuntu Light (Ubuntu-Light.ttf). Copyright notice:
+
+Copyright 2011 Canonical Ltd.  Licensed under the Ubuntu Font Licence 1.0
+
+-------------------------------
+UBUNTU FONT LICENCE Version 1.0
+-------------------------------
+
+PREAMBLE
+This licence allows the licensed fonts to be used, studied, modified and
+redistributed freely. The fonts, including any derivative works, can be
+bundled, embedded, and redistributed provided the terms of this licence
+are met. The fonts and derivatives, however, cannot be released under
+any other licence. The requirement for fonts to remain under this
+licence does not require any document created using the fonts or their
+derivatives to be published under this licence, as long as the primary
+purpose of the document is not to be a vehicle for the distribution of
+the fonts.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this licence and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Original Version" refers to the collection of Font Software components
+as received under this licence.
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to
+a new environment.
+
+"Copyright Holder(s)" refers to all individuals and companies who have a
+copyright ownership of the Font Software.
+
+"Substantially Changed" refers to Modified Versions which can be easily
+identified as dissimilar to the Font Software by users of the Font
+Software comparing the Original Version with the Modified Version.
+
+To "Propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification and with or without charging
+a redistribution fee), making available to the public, and in some
+countries other activities as well.
+
+PERMISSION & CONDITIONS
+This licence does not grant any rights under trademark law and all such
+rights are reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of the Font Software, to propagate the Font Software, subject to
+the below conditions:
+
+1) Each copy of the Font Software must contain the above copyright
+notice and this licence. These can be included either as stand-alone
+text files, human-readable headers or in the appropriate machine-
+readable metadata fields within text or binary files as long as those
+fields can be easily viewed by the user.
+
+2) The font name complies with the following:
+(a) The Original Version must retain its name, unmodified.
+(b) Modified Versions which are Substantially Changed must be renamed to
+avoid use of the name of the Original Version or similar names entirely.
+(c) Modified Versions which are not Substantially Changed must be
+renamed to both (i) retain the name of the Original Version and (ii) add
+additional naming elements to distinguish the Modified Version from the
+Original Version. The name of such Modified Versions must be the name of
+the Original Version, with "derivative X" where X represents the name of
+the new work, appended to that name.
+
+3) The name(s) of the Copyright Holder(s) and any contributor to the
+Font Software shall not be used to promote, endorse or advertise any
+Modified Version, except (i) as required by this licence, (ii) to
+acknowledge the contribution(s) of the Copyright Holder(s) or (iii) with
+their explicit written permission.
+
+4) The Font Software, modified or unmodified, in part or in whole, must
+be distributed entirely under this licence, and must not be distributed
+under any other licence. The requirement for fonts to remain under this
+licence does not affect any document created using the Font Software,
+except any version of the Font Software extracted from a document
+created using the Font Software may only be distributed under this
+licence.
+
+TERMINATION
+This licence becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+DEALINGS IN THE FONT SOFTWARE.
+
+Hack: MIT License and Bitstream Vera License
+
+Applies to Hack (Hack-Regular.ttf). Upstream notice and both licence texts:
+
+The work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT License
+
+The work in the DejaVu project was committed to the public domain.
+
+Bitstream Vera Sans Mono Copyright 2003 Bitstream Inc. and licensed under the Bitstream Vera License with Reserved Font Names "Bitstream" and "Vera"
+MIT License
+
+Copyright (c) 2018 Source Foundry Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+BITSTREAM VERA LICENSE
+
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the fonts accompanying this license ("Fonts") and associated documentation files (the "Font Software"), to reproduce and distribute the Font Software, including without limitation the rights to use, copy, merge, publish, distribute, and/or sell copies of the Font Software, and to permit persons to whom the Font Software is furnished to do so, subject to the following conditions:
+
+The above copyright and trademark notices and this permission notice shall be included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular the designs of glyphs or characters in the Fonts may be modified and additional glyphs or characters may be added to the Fonts, only if the fonts are renamed to names not containing either the words "Bitstream" or the word "Vera".
+
+This License becomes null and void to the extent applicable to Fonts or Font Software that has been modified and is distributed under the "Bitstream Vera" names.
+
+The Font Software may be sold as part of a larger software package but no copy of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Except as contained in this notice, the names of Gnome, the Gnome Foundation, and Bitstream Inc., shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Font Software without prior written authorization from the Gnome Foundation or Bitstream Inc., respectively. For further information, contact: fonts at gnome dot org.
+
+MIT License (egui-icons and emoji-icon-font)
+
+Applies to egui-icons.ttf, a five-glyph subset of emoji-icon-font, and the parent
+emoji-icon-font.ttf, both by John Slegers, https://github.com/jslegers/emoji-icon-font.
+
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/README.md b/README.md
index 914a40907..913f8aa06 100644
--- a/README.md
+++ b/README.md
@@ -8,15 +8,19 @@
 </p>
 
 
+<p align="center">
+  <img src="assets/app-icon/hicolor/256x256/apps/ai.storyteller.effectcraft.png" width="128" height="128" alt="EffectCraft icon: an engraved unicorn on a pink tile">
+</p>
+
 <h1 align="center">EffectCraft</h1>
 
 <p align="center">
-  <b>Motion graphics and visual effects; an open-source, clean-room reimplementation of Adobe After Effects, rebuilt in pure Rust.</b>
+  <b>Motion graphics and visual effects; an open-source, professional motion graphics and visual effects studio, built in pure Rust.</b>
 </p>
 
 <p align="center">
-  A free, open-source compositor in the spirit of After Effects: compositions, layers,
-  keyframes, 306 effects, layer styles, expressions, 3D cameras and lights, and a render queue, native on macOS,
+  A free, open-source compositor: compositions, layers,
+  keyframes, 308 effects, layer styles, expressions, 3D cameras and lights, and a render queue, native on macOS,
   Windows and Linux, and in the browser. Young, moving fast, and already usable.
 </p>
 
@@ -24,6 +28,9 @@
   <img alt="Status: young and moving fast" src="https://img.shields.io/badge/status-young%20and%20moving%20fast-e0368f?style=flat-square">
   <img alt="Written in Rust" src="https://img.shields.io/badge/rust-1.95%2B-b0206c?style=flat-square&logo=rust&logoColor=white">
   <img alt="License: MIT OR Apache-2.0" src="https://img.shields.io/badge/license-MIT%20%2F%20Apache--2.0-555?style=flat-square">
+  <br>
+  <a href="https://sonarcloud.io/project/overview?id=storytold_effectcraft"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
+  <a href="https://coderabbit.ai"><img alt="Reviewed by CodeRabbit" src="https://img.shields.io/coderabbit/prs/github/storytold/effectcraft?style=flat-square&label=Reviewed%20by%20CodeRabbit&logo=coderabbit"></a>
 </p>
 
 <p align="center">
@@ -64,27 +71,29 @@
 ## What EffectCraft is
 
 EffectCraft is for animated titles, motion graphics and compositing work: the kind of thing
-people reach for After Effects to do. You build a composition out of layers (solids, shapes,
+motion designers and VFX artists need. You build a composition out of layers (solids, shapes,
 text, footage, other compositions), animate their properties with keyframes, stack effects on
 them and render the result.
 
-The aim is to feel familiar to anyone who has used After Effects, with the same panels (Project,
-Composition, Timeline, Effect Controls, Effects & Presets) and the same keyframe behaviour, and
-then to go further in a few places where it matters to us:
+The interface feels natural and responsive, with dedicated panels (Project, Composition, Timeline,
+Layer, Footage, Effect Controls, Tools, Preview, Effects & Presets, Audio, Info, Paragraph,
+Character, Align, Progress, Render Queue) and standard motion graphics shortcuts, going further in
+a few places where it matters to us:
 
 - **Lottie import and export built in**, so animations can go straight to the web and apps
   without a plugin.
 - **A project file you can read.** Projects are versioned JSON (`.ecproj`), so they diff cleanly
   in version control.
-- **Everything is scriptable.** Every menu item, timeline drag and property edit goes through one
-  command registry, so the same actions are reachable from a command line, a JSON control
-  channel and an MCP server for agents.
+- **Everything is scriptable.** Menu actions, timeline edits and property changes are exposed as
+  commands. Engine commands are available through the CLI, JSON control channel and MCP;
+  UI-only commands use the frontend dispatcher and can be invoked through the control channel
+  or an attached MCP bridge.
 - **No FFmpeg.** Video and audio decoding and encoding are pure Rust: FilmCraft's codecs and
   EffectCraft's own VP9, AV1, HEVC and Opus encoders.
 
 ## Animate
 
-The panels, menus and shortcuts follow After Effects, so your muscle memory carries over:
+The panels, menus and shortcuts follow standard motion design conventions:
 Project, Composition, Timeline, Effect Controls, Properties, Effects & Presets, Character,
 Paragraph, Align, Info, Preview, Audio and the Render Queue, docked the way you expect. Drag
 footage, comps and effects between them: onto the comp viewer, where they land under the pointer,
@@ -102,7 +111,7 @@ or into the Timeline, between layers and at the time you point to.
   feather, expansion and vertex editing in the viewer.
 - **Text:** point and paragraph text with real shaping in any font installed on your machine, the
   Character and Paragraph panels, and text animators with range selectors.
-- **Expressions:** JavaScript with the After Effects object model (`wiggle`, `loopOut`,
+- **Expressions:** JavaScript with the standard motion expressions model (`wiggle`, `loopOut`,
   `thisComp.layer("…")`, vector maths on arrays), an inline editor and the pick-whip.
 - **Timeline like you know it:** twirl layers open to Transform, masks, effects and the rest; drag
   rows to reorder layers; rename with Enter or a double-click; the property shortcuts (A, P, S,
@@ -118,23 +127,19 @@ or into the Timeline, between layers and at the time you point to.
 
 ## Effects
 
-306 effects (every one of After Effects' 298, and more) across its categories, each with its parameter names, order and
-defaults: blur and sharpen, channel, color correction (Curves, Levels, Hue/Saturation, Lumetri
-Color…), distort (Warp, Bulge, Turbulent Displace, CC Power Pin…), generate (Fractal Noise,
+308 built-in effects across its categories, each with its parameter names, order and
+defaults: blur and sharpen, channel, color correction (Curves, Levels, Hue/Saturation, a full
+color-grading panel…), distort (Warp, Bulge, Turbulent Displace, Perspective Pin…), generate (Fractal Noise,
 Gradient Ramp, Stroke, Write-on, Audio Spectrum…), keying, matte, noise and grain, perspective,
-**simulation** (CC Particle World, CC Rainfall, Shatter, Card Dance, Caustics, Wave World…),
-stylize (Glow, CC Glass…), **time** (Echo, Posterize Time, Timewarp, Time Displacement…),
+**simulation** (Particle Emitter 3D, Rainfall, Shatter, Card Dance, Caustics, Wave World…),
+stylize (Glow, Glass Relief…), **time** (Echo, Posterize Time, Timewarp, Time Displacement…),
 **audio** (Reverb, Parametric EQ, Delay, Stereo Mixer…), text, transitions, utility and expression
 controls. All nine **Layer Styles** (Drop Shadow, Inner/Outer Glow, Bevel and Emboss, Satin,
 overlays, Stroke) with Global Light. Preview plays audio in sync, with meters and waveforms.
 
-<p align="center">
-  <img src="docs/images/effectcraft-effects.png" alt="A CC Particle World burst with Glow, and the Effect Controls panel listing the particle system's parameters" width="100%">
-</p>
-
 ## 3D
 
-Classic 3D the way After Effects does it: 3D layers with orientation and material options,
+Classic 3D compositing: 3D layers with orientation and material options,
 one- and two-node **cameras** with depth of field, **lights** (parallel, spot, point, ambient)
 with soft ray-traced shadows, layers that intersect correctly, orbit, pan and dolly camera
 tools, and Front, Top, Left and Custom views.
@@ -145,9 +150,9 @@ tools, and Front, Top, Left and Custom views.
 
 ## Export
 
-A Render Queue like After Effects', with Render Settings and Output Modules: **H.264** MP4 and
+A dedicated Render Queue, with Render Settings and Output Modules: **H.264** MP4 and
 **ProRes** MOV (Proxy to 4444 XQ with alpha) with audio, **HEVC** (Main / Main 10) and **AV1**
-MP4, **WebM** (VP9 with inter frames and alpha, or AV1; Opus audio), PNG, JPEG, TIFF and 32-bit EXR sequences, animated GIF and WAV/AIFF. Field
+MP4, **WebM** (VP9 with inter frames and alpha, or AV1; Opus audio), PNG, JPEG, TIFF, Targa and 32-bit EXR sequences, animated GIF and WAV/AIFF. Field
 rendering with 3:2 pulldown, effect/solo/guide/depth overrides, crop, region of interest and
 resize, Render Settings and Output Module templates with defaults, post-render actions, storage
 overflow and render logs. The same queue runs from the command line. Every encoder is pure
@@ -165,8 +170,10 @@ cannot express; File ▸ Import ▸ Lottie… opens one as a new composition.
 
 ## Built for agents
 
-Everything you can do from a menu is a command with an id, and agents can reach every one of
-them:
+Engine commands are available through the CLI, JSON control channel and MCP. UI-only commands
+need the running app's frontend dispatcher: complete menu access requires the app's control
+channel or an attached MCP bridge. Headless MCP sessions expose supported engine commands,
+but not UI-only commands or bridge-only `ui_*` tools.
 
 - **MCP server:** `effectcraft-cli mcp` speaks the Model Context Protocol over stdio, headless
   or bridged to the running app (`--bridge 9877`). Tools cover commands, the project and property
@@ -219,25 +226,26 @@ tests, layering, asset attribution and the WebAssembly build). See [CONTRIBUTING
 
 ## Where it stands
 
-EffectCraft is young: its first commit was on 1 October 2026. Nearly every After Effects feature
-exists, including all of its effects, but existing is not the same as behaving exactly like After
-Effects, and we haven't measured that yet. Today it's a good place to try things and to tell us
-what breaks. It isn't yet a replacement for After Effects on client work. In particular:
+EffectCraft is young: its first commit was on 1 October 2026. A comprehensive feature set
+exists, including 308 effects, but breadth is not the same as full maturity across every edge
+case. Today it's a good place to try things and to tell us what breaks. It isn't yet recommended
+for production client work. In particular:
 
-- **After Effects projects can't be opened.** Projects are saved as `.ecproj`, readable versioned
-  JSON, but EffectCraft can't open `.aep` / `.aepx` files, and After Effects plug-ins don't run.
-- **Behaviour still differs from After Effects in places.** Nothing yet compares our renders with
-  After Effects automatically, so please report differences.
+- **Native project format.** Projects are saved as `.ecproj`, readable versioned JSON. Proprietary
+  project formats and After Effects SDK plug-ins are not supported.
+- **Fidelity is still being refined.** Automated rendering tests currently focus on small
+  compositions, so please report visual discrepancies or unexpected behaviour.
 - **macOS is the most tested platform.** Linux and Windows users have hit basic interaction
   bugs, which we're fixing first.
 - **The trained models are new.** Roto Brush can use MobileSAM (an optional 40 MB download in
   Settings ▸ Roto Brush) and face tracking can use Google's MediaPipe Face Landmarker (an optional
-  3.8 MB download in Settings ▸ Face Tracking). Neither is compared with After Effects yet.
+  3.8 MB download in Settings ▸ Face Tracking). Both are actively undergoing evaluation and tuning.
 
-EffectCraft is in **alpha**: about 91% of After Effects' features exist, and we estimate it is
-about 45% of the way to replacing After Effects for professional work. The [ROADMAP](ROADMAP.md)
-has the plan, [docs/target-app-parity.md](docs/target-app-parity.md) the measurement and
-[docs/gaps.md](docs/gaps.md) every known shortfall. The web build ([docs/web.md](docs/web.md)) runs the full app in the browser.
+EffectCraft is in **alpha**: about 91% of the features tracked in
+[docs/target-app-parity.md](docs/target-app-parity.md) exist, and we estimate it is about 45% of the
+way to being ready for full professional production work. The [ROADMAP](ROADMAP.md) has the plan,
+[docs/target-app-parity.md](docs/target-app-parity.md) the measurement and [docs/gaps.md](docs/gaps.md)
+every known shortfall. The web build ([docs/web.md](docs/web.md)) runs the full app in the browser.
 [Bug reports](https://github.com/storytold/effectcraft/issues) are the most useful thing you can
 send us right now.
 
@@ -245,8 +253,8 @@ send us right now.
 
 - **Engine first.** A stack of small crates with strict layering. The interface (egui) sits on
   top and nothing underneath depends on it.
-- **Clean room.** We work from After Effects' public documentation and how it behaves, never
-  from Adobe's files, icons, presets or code. No code is copied from GPL projects. The full rules
+- **Clean room.** We work from public documentation and observable behavior, never
+  from proprietary files, icons, presets or code. No code is copied from GPL projects. The full rules
   are in [AGENTS.md](AGENTS.md).
 - **Private by default.** No telemetry, and no network access unless you ask for it.
 - **One family.** EffectCraft shares its time model and text engine design with FilmCraft, and
@@ -266,9 +274,13 @@ send us right now.
 | arm64 (Snapdragon and other ARM PCs) | `effectcraft-<ver>-windows-arm64.msi` | `effectcraft-<ver>-windows-arm64-portable.zip` |
 | x86 (32-bit) | `effectcraft-<ver>-windows-x86.msi` | `effectcraft-<ver>-windows-x86-portable.zip` |
 
-Installers and executables are code-signed. The installer asks where to install EffectCraft
-(Program Files by default), and later versions install into the same folder. To install silently
+Installers and executables are code-signed. The installer asks who to install EffectCraft for and where. By default it installs for your
+account only, into `%LOCALAPPDATA%\Programs\ArtCraft\EffectCraft`, without an administrator prompt;
+"Everyone on this computer" installs into `C:\Program Files\ArtCraft\EffectCraft` (`Program Files (x86)` for the 32-bit build). Later versions
+install into the same folder. To install silently
 into a folder of your choice: `msiexec /i effectcraft-<ver>-windows-x64.msi /qn INSTALLFOLDER="D:\Apps\EffectCraft"`.
+A silent install is per-user by default. `INSTALLFOLDER` chooses the folder, not who it is installed for;
+add `ALLUSERS=1`, from an elevated terminal or deployment tool, for an all-users install.
 
 ### macOS
 
@@ -328,8 +340,17 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/filmcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.filmcraft.png" alt="" width="32" height="32"> | **FilmCraft** | Video editing, color and sound | [GitHub](https://github.com/storytold/filmcraft) | [Website](https://getartcraft.com/apps/filmcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/lightcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.lightcraft.png" alt="" width="32" height="32"> | **LightCraft** | Photo library and raw development | [GitHub](https://github.com/storytold/lightcraft) | [Website](https://getartcraft.com/apps/lightcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | **Motion graphics and visual effects · you are here** | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/figcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.figcraft.png" alt="" width="32" height="32"> | **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/soundcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.soundcraft.png" alt="" width="32" height="32"> | **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/deckcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.deckcraft.png" alt="" width="32" height="32"> | **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.cadcraft.png" alt="" width="32" height="32"> | **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/gridcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.gridcraft.png" alt="" width="32" height="32"> | **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/texturecraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.texturecraft.png" alt="" width="32" height="32"> | **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
+| <img src="https://raw.githubusercontent.com/storytold/craft-anything/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.craft-anything.png" alt="" width="32" height="32"> | **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
+| <img src="https://raw.githubusercontent.com/tangency-labs/solidcraft/main/assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png" alt="" width="32" height="32"> | **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |
 
 And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.
 
@@ -368,8 +389,6 @@ ArtCraft Team and are not covered by this license. They may be used only unmodif
 part of this repository and EffectCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
 Forks and modified versions must remove them.
 
-<sub>Adobe, Photoshop, Illustrator, Premiere Pro, Lightroom, Acrobat, After Effects and InDesign are trademarks or registered trademarks of Adobe Inc. in the United States and/or other countries. EffectCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Adobe Inc.; these names are used only to describe the workflows it is compatible with.</sub>
-
 <p align="center">
   <a href="https://getartcraft.com/"><img alt="ArtCraft" src="docs/brand/artcraft-mark.svg" width="28"></a><br>
   <sub>Made by the <a href="https://getartcraft.com/">ArtCraft</a> team and community.</sub>
diff --git a/ROADMAP.md b/ROADMAP.md
index 1887d7b82..e41cbe2f1 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~30 points of "ready for real work" and ~350–620 h away
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (open-issue count, crash list and localization share re-audited against `upstream/main` 470ea7a3) · **Target:** Adobe After Effects 2026 (26.5.0.89)
+> **Last reviewed:** 2026-10-22 · **Last updated:** 2026-11-05 · **Change:** minor (ProRes alpha final-run conformance; previously: features of 30 October in the progress log: text Line Join, Timeline drag-reorder and multi-select of effects, viewer edge pan, ScriptUI drag capture and dock size; previously: localization recount after #1774) · **Target:** Adobe After Effects 2026 (26.5.0.89)
 
 EffectCraft aims to do what After Effects does, with the same panels, menus and behaviour, written
 from scratch in Rust. This page is the one-page summary; the evidence is in
@@ -51,7 +51,7 @@ Linux/Windows reliability (30–50 h) and depth in animation, masks, effects and
 | UI/UX fidelity | 65% | 60–120 | [ui-parity.md](docs/ui-parity.md) |
 | File formats | 50% | 130–230 | [file-format-parity.md](docs/file-format-parity.md) |
 | Hardware | 40% | 60–120 | [hardware-parity.md](docs/hardware-parity.md) |
-| Localization | 18% | 60–110 + review | [localization-parity.md](docs/localization-parity.md) |
+| Localization | 24% | 60–110 + review | [localization-parity.md](docs/localization-parity.md) |
 | Performance | 35% | 50–100 | [gaps.md](docs/gaps.md#g5-performance-at-real-world-scale) |
 | Stability | 45% | 40–80 | [gaps.md](docs/gaps.md#g3-stability-and-a-green-main) |
 | Platforms | 65% | 30–60 | [gaps.md](docs/gaps.md#g2-real-user-reliability-on-every-platform) |
@@ -80,24 +80,24 @@ Weights and evidence per row: [target-app-parity.md](docs/target-app-parity.md#b
 
 ## Languages
 
-UI strings translated out of ≈ 3,900 (detail: [localization-parity.md](docs/localization-parity.md)).
+UI strings translated out of ≈ 4,200 (detail: [localization-parity.md](docs/localization-parity.md)).
 
 | Language | Status | % |
 |---|---|---:|
 | English | full | 100% |
-| Simplified Chinese | partial (menus, part of the panels) | 29% |
-| Spanish | menus only | 16% |
+| Simplified Chinese | partial (menus, most of the panels) | 46% |
+| Spanish | menus only | 29% |
 | Hindi | none | 0% |
 | Arabic | none | 0% |
 | French | menus only | 16% |
-| Portuguese (Brazil) | partial (menus, part of the panels) | 26% |
+| Portuguese (Brazil) | partial (menus, part of the panels) | 34% |
 | Indonesian | none | 0% |
-| Japanese | partial (menus, part of the panels) | 27% |
+| Japanese | partial (menus, most of the panels) | 46% |
 | German | menus only | 16% |
 | Korean | none | 0% |
 | Vietnamese | none | 0% |
 
-Also shipped: Traditional Chinese (partial, 29%), Ukrainian (partial, 29%), Czech (partial, 29%) and Russian (menus only, 16%). No language has had
+Also shipped: Traditional Chinese (partial, 38%), Ukrainian (partial, 29%), Czech (partial, 29%), Polish (partial, 34%), Georgian (partial, 39%; native-speaker reviewed), Russian (menus only, 15%) and Swedish (menus, panels and effect names; not yet measured). No other language has had
 native-speaker review.
 
 ## Upcoming
@@ -117,10 +117,37 @@ Come tell us what matters most to you on [Discord](https://discord.gg/artcraft).
 
 ## Progress log
 
+- 2026-11-05: ProRes 4444 and XQ exports write the required run after the final alpha
+  difference. The FilmCraft encoder pin fixes alpha movies rejected by native macOS
+  decoding; an export regression checks the stored bytes for both profiles, alpha modes,
+  and motion-blur settings (#293). Resolve itself still needs confirmation.
+- 2026-10-30: Text strokes take a Line Join (Miter, Round or Bevel) in the Character panel,
+  Miter for new text as in After Effects (#2077). In the Timeline, effects, masks and shape items
+  drag to a new place in their stack (#2210) and Shift-click adds them to the selection, so one
+  animation preset can hold several (#2552). The Composition panel pans while a mask vertex is
+  held at its edge (#999). Effect buffers that pad a small layer stay within a memory budget
+  (#2261); an MP4 lasts as long as its edit list shows (#2592); the Render Queue's times tick
+  between frames (#2593). ScriptUI drags keep their control past the window edge with
+  `MouseEvent.buttons` (#2584), and docked panels get their dock's size and `onResize` (#2585).
+- 2026-10-28: A shape layer's Rectangle and Ellipse Size get the Constrain Proportions chain
+  that Scale has, so a circle stays a circle while its size is typed, scrubbed or keyed; it
+  starts off, so existing shapes behave as before (#2489).
+- 2026-10-24: Shape layers have the Wiggle Transform path operation (Contents ▸ Add, or
+  `layer.addShapeItem {kind: "wiggler"}`): it wiggles the anchor point, position, scale and
+  rotation of the paths above it by random amounts that change over time, up to the Transform
+  values it holds. The copies of a Repeater above it wiggle independently as far as its
+  Correlation allows; with the Repeater below it, they wiggle together.
+- 2026-10-22: Localization: the panel/dialog catalogs gain 303 rows in Japanese, Simplified
+  Chinese and Traditional Chinese — panel tabs, form and dialog labels, panel context menus,
+  tracker/graph/text-panel controls, File-panel footers and credits. Recounted after #1774:
+  Japanese is 1,923 of ≈ 4,200 interface strings (46%, with 297 effect names); the Chinese
+  panel catalogs hold 998 (Simplified) and 951 (Traditional) rows, and Simplified Chinese is
+  46% with its 307 effect names; the overall share is ≈ 24%.
 - 2026-10-16: Convert To Bezier Path turns a shape layer's Rectangle, Ellipse or Polystar
   path into an editable Path 1 with the same geometry, as After Effects does; it used to
   apply to mask RotoBezier only, so a parametric shape path could not be converted at all
   and its vertices could not be edited or animated (#932).
+- 2026-10-14: Georgian (`ka`): every menu row, every panel-catalog row the Chinese catalogs have plus 195 Georgian-only ones, and the effect names and categories; Match System for `ka` / `ka-GE` / `ka_GE.UTF-8` locales. Reviewed by a native speaker.
 - 2026-10-12: Roto Brush span edits report strokes outside a trimmed layer without panicking;
   strokes and undo history are preserved so restoring the timing allows the span edit again.
 - 2026-10-11: Ukrainian panels caught up with the Chinese catalogs. The 95 rows the panel
@@ -132,7 +159,7 @@ Come tell us what matters most to you on [Discord](https://discord.gg/artcraft).
   design — alongside its 618/618 menus.
 - 2026-10-10: Full parity re-measure against After Effects 2026 26.5 (installed bundle, 26.2–26.5
   release notes, repository counts): breadth ≈ 91%, ready ≈ 45%, stage alpha. Progress docs
-  follow the shared standard: `docs/parity.md` became `docs/target-app-parity.md`; new
+  restructured: `docs/parity.md` became `docs/target-app-parity.md`; new
   `docs/roadmap.md`, `localization-parity.md`, `file-format-parity.md`, `hardware-parity.md`,
   `ui-parity.md`, `effects-parity.md` and `scripting-parity.md`.
 - 2026-10-10: Spanish (#460) and Brazilian Portuguese (#217) menu translations.
@@ -154,11 +181,13 @@ Come tell us what matters most to you on [Discord](https://discord.gg/artcraft).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | minor | Progress log: text Line Join, Timeline drag-reorder and Shift multi-select of effects, viewer edge pan, effect padding budget, MP4 edit-list duration, Render Queue clock, ScriptUI drag capture and docked-panel size |
+| 2026-10-22 | minor | Localization: 300 more panel/dialog rows in Japanese and the Chinese catalogs, plus the review's three missing rows (Basic, Advanced, Play/Stop) — panel tabs, form and dialog labels, context menus, tracker/graph/text-panel controls, File-panel footers, credits; language shares recounted after #1774 (Japanese 27% → 46% with 297 effect names, Simplified Chinese 29% → 46% with 307 effect names, Traditional Chinese 29% → 38%, overall 18% → 24%) |
 | 2026-10-12 | minor | Open-issue count (134 to 216), crash list and localization share (12% to 18%) updated to match docs/gaps.md |
 | 2026-10-12 | patch | Roto Brush span validation after trimming; command regressions for both layer edges |
+| 2026-10-12 | minor | Shared PDF object/xref parsing with bounded app-owned conversion and preserved stream budgets; drawing, EPS and image/font policy remain unchanged |
 | 2026-10-10 | minor | Hours to ≈ 95% for each audience |
 | 2026-10-10 | minor | Headline adds mainstream practitioner (≈ 47%) and essentials user (≈ 52%) |
-| 2026-10-12 | minor | Shared PDF object/xref parsing with bounded app-owned conversion and preserved stream budgets; drawing, EPS and image/font policy remain unchanged |
+| 2026-10-10 | major | Progress docs restructured: stage, two numbers, dimensions, features, languages, upcoming, progress log; milestones moved to docs/roadmap.md |
 | 2026-10-10 | minor | Stage checked against the new core-workflow gate (all six pass; still alpha) |
-| 2026-10-10 | major | Rewritten to the shared progress-docs standard: stage, two numbers, dimensions, features, languages, upcoming, progress log; milestones moved to docs/roadmap.md |
 | 2026-10-05 | major | Two numbers (breadth vs real use) and workstreams G1–G9 |
diff --git a/apps/effectcraft-cli/Cargo.toml b/apps/effectcraft-cli/Cargo.toml
index b5784f4eb..abfc014eb 100644
--- a/apps/effectcraft-cli/Cargo.toml
+++ b/apps/effectcraft-cli/Cargo.toml
@@ -20,6 +20,9 @@ effectcraft-ui-egui = { workspace = true }
 effectcraft-render = { workspace = true }
 effectcraft-gpu = { workspace = true }
 effectcraft-time = { workspace = true }
+effectcraft-track = { workspace = true }
+effectcraft-segment = { workspace = true }
+effectcraft-sam2 = { workspace = true }
 serde_json = { workspace = true }
 image = { workspace = true }
 cpu-time = "1"
diff --git a/apps/effectcraft-cli/src/main.rs b/apps/effectcraft-cli/src/main.rs
index c7a012c76..b8634178e 100644
--- a/apps/effectcraft-cli/src/main.rs
+++ b/apps/effectcraft-cli/src/main.rs
@@ -6,15 +6,18 @@
 //! effectcraft-cli exec <command-id> [--params JSON]           run one command
 //! effectcraft-cli exec --list [--filter TEXT] [--schemas]     list engine commands (as `commands`)
 //! effectcraft-cli run <id> <json> [<id> <json> …]             run several commands in order
+//! effectcraft-cli run --args-file F                           the same, one argument per line of F
+//! effectcraft-cli run --commands FILE|-                         steps {"command", "params"} from FILE or stdin
 //! effectcraft-cli props <comp> <layer> [--flat] [--time S]    a layer's property tree (with paths)
 //! effectcraft-cli get <comp> <layer> <path> [--time S]        read a property
 //! effectcraft-cli set <comp> <layer> <path> <value> [--time S] [--expression E]
 //! effectcraft-cli render-frame [--comp C] [--time S|--frame N] [--max-side PX|--scale K] [--out F.png] [--transparent]
-//! effectcraft-cli render [--comp C] --out FILE [--format h264|hevc|av1|prores|webm|png|jpeg|tiff|exr|gif|wav|aiff] [--start S] [--end S]
+//! effectcraft-cli render [--comp C] --out FILE [--format h264|hevc|av1|prores|webm|png|jpeg|tiff|exr|tga|gif|wav|aiff] [--start S] [--end S]
 //!     [--work-area] [--fps N] [--resolution full|half|third|quarter|K] [--quality best|draft] [--channels rgb|rgba]
 //!     [--jpeg-quality N] [--bitrate KBPS] [--prores proxy|lt|standard|hq|4444|4444xq] [--audio auto|on|off]
 //!     [--profile main|main10] [--level auto|4.1] [--rate-control bitrate|quality] [--video-quality 1-100]
 //!     [--keyint FRAMES] [--webm-codec vp9|av1] [--audio-bitrate KBPS] [--opus-app audio|voice]
+//!     [--exr-compression none|rle|zips|zip|piz|pxr24|b44|b44a|dwaa|dwab] [--exr-depth half|float]
 //!     (a relative --out is relative to the working directory; --queue outputs follow the project's own settings)
 //!     [--progress]  report progress on stderr when it is not a terminal, up to four lines a second:
 //!     `progress <frames done> <frames total> <seconds elapsed> <seconds left, or - when unknown>`
@@ -25,13 +28,15 @@
 //!     (--gpu: CPU vs GPU ms/frame for every comp at Full and Half)
 //! effectcraft-cli bench --ops [--small] [--layers N] [--comps N] [--footage N]   everyday-operation timings
 //!     on a large generated project (open, save, auto-save, undo/redo, timeline, Project panel)
+//! effectcraft-cli bench --roto [--frames N] [--sam2 model.safetensors] [--mobilesam mobile_sam.pt] [--fixes] [--clip FRAMES --truth MASKS] [--json]   Roto Brush trackers on synthetic clips with known mattes
+//!     (classical engine, MobileSAM and SAM 2.1 (any installed size) when installed; IoU, flicker, re-appearance, seconds per frame)
 //! effectcraft-cli script FILE.jsx [F.ecproj] | --eval CODE    run an After Effects-style script
 //! effectcraft-cli mcp [--autosave | --bridge PORT]            MCP server on stdio
 //!
 //! Project:  --project F.ecproj (or a positional *.ecproj) | --demo | --empty   (default: demo; mcp: empty)
 //! Saving:   --save (back to --project) | --save-as F.ecproj
-//! GPU:      --gpu renders on the GPU compositor (Mercury GPU Acceleration) when an adapter exists;
-//!           the default is the CPU (Mercury Software Only)
+//! GPU:      --gpu renders on the GPU compositor (GPU Acceleration) when an adapter exists;
+//!           the default is the CPU (Software Rendering)
 //! Bridge:   --bridge PORT drives a running `effectcraft --control PORT` instead of a headless session
 //! Output:   --json for one compact JSON document on stdout (errors: {"error": …}, exit 1)
 //! ```
@@ -43,6 +48,7 @@
 
 use std::io::Write;
 
+mod project_lock;
 mod template;
 
 use effectcraft_automation::tools::{self, Reply};
@@ -96,6 +102,11 @@ const USAGE: &str = "usage: effectcraft-cli <info|commands|exec|run|props|get|se
   commands [--filter TEXT] [--enabled]     list engine commands
   exec <command-id> [--params JSON]        run one engine command (exec --list: list them, as `commands`)
   run <id> <json> [<id> <json> ...]        run several commands in order
+  run --args-file F                        the same, one argument per line of F (no command-line length limit)
+  run --commands FILE|-                    steps from FILE, or standard input for -: a JSON array of
+                                           {\"command\": ID, \"params\": {...}} (or \"id\" for \"command\"), or one
+                                           such object per line (JSON Lines); at most 64 MiB and 100000 steps.
+                                           Repeatable; run after the <id> <json> pairs and --args-file
   props <comp> <layer> [--flat] [--time S] a layer's property tree with paths
   get <comp> <layer> <path> [--time S]     read a property
   set <comp> <layer> <path> <value> [--time S] [--expression E]
@@ -104,9 +115,13 @@ const USAGE: &str = "usage: effectcraft-cli <info|commands|exec|run|props|get|se
          [--resolution full|half|third|quarter|K] [--quality best|draft] [--channels rgb|rgba]
          [--jpeg-quality N] [--bitrate KBPS] [--prores PROFILE] [--audio auto|on|off]
          [--profile main|main10] [--level auto|4.1] [--rate-control bitrate|quality] [--video-quality N]
-         [--keyint FRAMES] [--webm-codec vp9|av1] [--audio-bitrate KBPS] [--opus-app audio|voice] | --queue
-                                           (formats h264|hevc|av1|prores|webm|png|jpeg|tiff|exr|gif|wav|aiff;
-                                           --profile..--keyint: HEVC / AV1, --audio-bitrate/--opus-app: WebM Opus)
+         [--keyint FRAMES] [--webm-codec vp9|av1] [--audio-bitrate KBPS] [--opus-app audio|voice]
+         [--exr-compression C] [--exr-depth half|float] | --queue
+                                           (formats h264|hevc|av1|prores|webm|png|jpeg|tiff|exr|tga|gif|wav|aiff;
+                                           --profile..--keyint: HEVC / AV1, --audio-bitrate/--opus-app: WebM Opus;
+                                           --exr-compression none|rle|zips|zip|piz|pxr24|b44|b44a|dwaa|dwab
+                                           (default zip; pxr24 on float, b44/b44a on half and dwaa/dwab are lossy),
+                                           --exr-depth (default float): OpenEXR)
                                            a relative --out is relative to the working directory
                                            --progress: progress lines on stderr when it is not a terminal
                                            (progress <frames done> <total> <seconds elapsed> <seconds left|->)
@@ -117,6 +132,9 @@ const USAGE: &str = "usage: effectcraft-cli <info|commands|exec|run|props|get|se
   bench --ops [--small] [--layers N] [--comps N] [--footage N]
                                            everyday operations on a large generated project: startup, open,
                                            save, auto-save, edits + undo/redo, timeline, Project panel
+  bench --roto [--frames N] [--sam2 FILE] [--mobilesam FILE] [--fixes] [--clip FRAMES_DIR --truth MASKS_DIR] [--json]
+                                           Roto Brush trackers on synthetic clips with known mattes: movement,
+                                           lighting change, occlusion, leaving and re-entering the frame
   script FILE.jsx [F.ecproj] | --eval CODE run JavaScript with the After Effects-style object model
                                            (app.project, comps, layers, properties…); prints writeLn
                                            output and the result; errors exit 1 with file:line:col
@@ -130,6 +148,11 @@ options: --project F.ecproj | --demo | --empty   --save | --save-as F   --bridge
 /// Options that take a value.
 const VALUED: &[&str] = &[
     "--n",
+    "--clip",
+    "--truth",
+    "--frames",
+    "--sam2",
+    "--mobilesam",
     "--play",
     "--layers",
     "--comps",
@@ -148,6 +171,8 @@ const VALUED: &[&str] = &[
     "--expression",
     "--depth",
     "--eval",
+    "--args-file",
+    "--commands",
     // render
     "--template",
     "--values",
@@ -170,6 +195,8 @@ const VALUED: &[&str] = &[
     "--webm-codec",
     "--audio-bitrate",
     "--opus-app",
+    "--exr-compression",
+    "--exr-depth",
     // mcp
     "--automation-read-root",
     "--automation-write-root",
@@ -178,6 +205,7 @@ const VALUED: &[&str] = &[
 /// Options without a value. Any other `--option` is a usage error.
 const FLAGS: &[&str] = &[
     "--json",
+    "--fixes",
     "--save",
     "--demo",
     "--empty",
@@ -190,6 +218,7 @@ const FLAGS: &[&str] = &[
     "--work-area",
     "--queue",
     "--ops",
+    "--roto",
     "--small",
     "--adv3d",
     "--autosave",
@@ -276,6 +305,9 @@ fn utf8_args(raw: impl IntoIterator<Item = std::ffi::OsString>) -> Result<Vec<St
 }
 
 fn main() {
+    // Warnings and errors to standard error (`RUST_LOG` overrides), so a GPU that declines
+    // frames or runs out of memory says so instead of silently rendering on the CPU.
+    effectcraft_engine::logging::install_with("warn");
     let raw = match utf8_args(std::env::args_os().skip(1)) {
         Ok(raw) => raw,
         Err(e) => fail_usage(&e),
@@ -331,6 +363,87 @@ impl From<String> for Failure {
     }
 }
 
+/// Most bytes `run --commands` reads from a file or standard input: the steps are untrusted input.
+const MAX_COMMANDS_BYTES: u64 = 64 * 1024 * 1024;
+/// Most steps one `run --commands` takes.
+const MAX_COMMANDS_STEPS: usize = 100_000;
+
+/// The text of `--commands source`: the file `source`, or standard input for `-`, refused past
+/// [`MAX_COMMANDS_BYTES`]. This reader, [`parse_commands`] and [`command_step`] are ported from
+/// vectorcraft-cli's (storytold/vectorcraft#3630), with a tuple in place of its `Step` enum.
+fn read_commands(source: &str) -> Result<String, String> {
+    use std::io::Read;
+    let mut bytes = vec![];
+    let read = if source == "-" {
+        std::io::stdin().lock().take(MAX_COMMANDS_BYTES + 1).read_to_end(&mut bytes)
+    } else {
+        std::fs::File::open(source).and_then(|f| f.take(MAX_COMMANDS_BYTES + 1).read_to_end(&mut bytes))
+    };
+    read.map_err(|e| format!("--commands {source}: {e}"))?;
+    if bytes.len() as u64 > MAX_COMMANDS_BYTES {
+        return Err(format!("--commands {source}: more than {} MiB of steps", MAX_COMMANDS_BYTES / (1024 * 1024)));
+    }
+    String::from_utf8(bytes).map_err(|_| format!("--commands {source}: not UTF-8 text"))
+}
+
+/// The steps of `--commands source` from its `text`: a JSON array of `{"command": ID, "params":
+/// {…}}` objects (`"id"` may stand for `"command"`), or one such object per line (JSON Lines, blank
+/// lines skipped). `first` is the run's index of the first of them, which an error names with the
+/// entry's place in the text.
+fn parse_commands(source: &str, text: &str, first: usize) -> Result<Vec<(String, Value)>, String> {
+    // Notepad on Windows starts UTF-8 files with a byte order mark.
+    let text = text.strip_prefix('\u{feff}').unwrap_or(text);
+    let too_many = || format!("--commands {source}: more than {MAX_COMMANDS_STEPS} steps");
+    // Each entry with where it is in the text: its line for JSON Lines.
+    let mut entries: Vec<(Option<usize>, Value)> = vec![];
+    if text.trim_start().starts_with('[') {
+        let v: Value = serde_json::from_str(text).map_err(|e| format!("--commands {source}: {e}"))?;
+        let Value::Array(items) = v else { return Err(format!("--commands {source}: not a JSON array")) };
+        if items.len() > MAX_COMMANDS_STEPS {
+            return Err(too_many());
+        }
+        entries.extend(items.into_iter().map(|v| (None, v)));
+    } else {
+        for (n, line) in text.lines().enumerate().filter(|(_, l)| !l.trim().is_empty()) {
+            if entries.len() == MAX_COMMANDS_STEPS {
+                return Err(too_many());
+            }
+            let v = serde_json::from_str(line).map_err(|e| format!("--commands {source}: step {} (line {}): {e}", first + entries.len(), n + 1))?;
+            entries.push((Some(n + 1), v));
+        }
+    }
+    entries
+        .into_iter()
+        .enumerate()
+        .map(|(k, (line, v))| {
+            command_step(v).map_err(|e| {
+                let place = line.map_or_else(|| format!("entry {}", k + 1), |l| format!("line {l}"));
+                format!("--commands {source}: step {} ({place}): {e}", first + k)
+            })
+        })
+        .collect()
+}
+
+/// The command id and params of one `--commands` entry, `{"command": ID, "params": {…}}`.
+fn command_step(v: Value) -> Result<(String, Value), String> {
+    let Value::Object(mut o) = v else { return Err("a step must be an object such as {\"command\": \"comp.new\", \"params\": {}}".into()) };
+    let id = match (o.remove("command"), o.remove("id")) {
+        (Some(Value::String(id)), None) | (None, Some(Value::String(id))) => id,
+        (Some(_), Some(_)) => return Err("give `command` or `id`, not both".into()),
+        (None, None) => return Err("no `command`".into()),
+        _ => return Err("`command` must be a string, a command id".into()),
+    };
+    let params = match o.remove("params") {
+        None | Some(Value::Null) => json!({}),
+        Some(p @ Value::Object(_)) => p,
+        Some(_) => return Err(format!("`params` of {id} must be a JSON object")),
+    };
+    if let Some(key) = o.keys().next() {
+        return Err(format!("unknown key `{key}`: a step has `command` (or `id`) and `params`"));
+    }
+    Ok((id, params))
+}
+
 fn usage_err<T>(m: &str) -> Result<T, Failure> {
     Err(Failure::Usage(m.to_string()))
 }
@@ -353,7 +466,7 @@ fn backend(args: &Args, default_demo: bool) -> Result<Backend, Failure> {
 }
 
 /// A wired session; `--gpu` attaches the GPU compositor (renders then follow the project's
-/// renderer setting, Mercury GPU Acceleration by default).
+/// renderer setting, GPU Acceleration by default).
 fn session(args: &Args) -> Result<effectcraft_engine::Session, Failure> {
     let mut s = effectcraft_host::session();
     if args.flag("--autosave") {
@@ -403,6 +516,7 @@ fn script_cmd(args: &Args, json_out: bool) -> Result<(), Failure> {
         (None, Some(f)) => (std::fs::read_to_string(f).map_err(|e| Failure::Error(format!("cannot read {f}: {e}")))?, f.clone()),
         (None, None) => return usage_err("script needs a .jsx/.js file or --eval CODE"),
     };
+    let _lock = project_lock::for_save(args)?;
     let mut b = backend(args, false)?;
     let r = b.exec("script.run", json!({"code": code, "name": name}))?;
     let saved = maybe_save(&mut b, args)?;
@@ -506,6 +620,7 @@ fn run(cmd: &str, args: &Args, json_out: bool) -> Result<(), Failure> {
                 (Some(p), _) | (None, Some(p)) => serde_json::from_str(p).map_err(|e| Failure::Usage(format!("params are not valid JSON: {e}")))?,
                 (None, None) => json!({}),
             };
+            let _lock = project_lock::for_save(args)?;
             let mut b = backend(args, true)?;
             let r = b.exec(&id, params)?;
             if let Some(e) = failed_render(&id, &r) {
@@ -515,15 +630,20 @@ fn run(cmd: &str, args: &Args, json_out: bool) -> Result<(), Failure> {
             emit(&with_saved(r, saved), json_out);
         }
         "run" => {
-            if args.pos.is_empty() {
-                return usage_err("run needs <command-id> [<json>] pairs");
+            let mut pairs = args.pos.clone();
+            // Windows caps a command line at 32 767 characters: long batches come from a file.
+            if let Some(f) = args.opt("--args-file") {
+                let text = std::fs::read_to_string(f).map_err(|e| Failure::Usage(format!("--args-file {f}: {e}")))?;
+                pairs.extend(text.lines().map(str::trim).filter(|l| !l.is_empty()).map(String::from));
             }
-            let pairs = args.pos.clone();
-            let mut b = backend(args, true)?;
-            let mut results = vec![];
+            let sources = args.opts("--commands");
+            if pairs.is_empty() && sources.is_empty() {
+                return usage_err("run needs <command-id> [<json>] pairs or --commands FILE|-");
+            }
+            let mut steps = vec![];
             let mut i = 0;
             while i < pairs.len() {
-                let id = &pairs[i];
+                let id = pairs[i].clone();
                 let params = match pairs.get(i + 1).filter(|p| p.trim_start().starts_with('{')) {
                     Some(p) => {
                         i += 1;
@@ -532,9 +652,27 @@ fn run(cmd: &str, args: &Args, json_out: bool) -> Result<(), Failure> {
                     None => json!({}),
                 };
                 i += 1;
-                let r = b.exec(id, params).map_err(|e| Failure::Error(format!("{id}: {e}")))?;
-                if let Some(e) = failed_render(id, &r) {
-                    return Err(Failure::Error(format!("{id}: {e}")));
+                steps.push((id, params));
+            }
+            if sources.iter().filter(|s| **s == "-").count() > 1 {
+                return usage_err("--commands - is given twice: standard input is read once");
+            }
+            for &source in &sources {
+                let text = read_commands(source).map_err(Failure::Usage)?;
+                steps.extend(parse_commands(source, &text, steps.len()).map_err(Failure::Usage)?);
+            }
+            if steps.is_empty() {
+                return Err(Failure::Usage(format!("--commands {}: no commands", sources.join(", "))));
+            }
+            let _lock = project_lock::for_save(args)?;
+            let mut b = backend(args, true)?;
+            let mut results = vec![];
+            // The step's index closes the message: a generated list repeats ids, and callers match
+            // the leading `<id>: `.
+            for (n, (id, params)) in steps.into_iter().enumerate() {
+                let r = b.exec(&id, params).map_err(|e| Failure::Error(format!("{id}: {e} (step {n})")))?;
+                if let Some(e) = failed_render(&id, &r) {
+                    return Err(Failure::Error(format!("{id}: {e} (step {n})")));
                 }
                 if !json_out {
                     emit(&r, false);
@@ -563,7 +701,7 @@ fn run(cmd: &str, args: &Args, json_out: bool) -> Result<(), Failure> {
                     if let Some(e) = p.get("expression").and_then(Value::as_str) {
                         extra += &format!("  expr: {e}");
                     }
-                    say!("  {:<44} {:<8} {}{extra}", p["path"].as_str().unwrap_or(""), p["type"].as_str().unwrap_or(""), p["value"]);
+                    say!("  {:<44} {:<8} {}{extra}", p["path"].as_str().unwrap_or(""), p["type"].as_str().unwrap_or(""), value_text(p));
                 }
             }
         }
@@ -581,6 +719,7 @@ fn run(cmd: &str, args: &Args, json_out: bool) -> Result<(), Failure> {
             }
             let (comp, layer, path) = (args.pos[0].clone(), args.pos[1].clone(), args.pos[2].clone());
             let value = args.pos.get(3).map(|v| value_arg(v));
+            let _lock = project_lock::for_save(args)?;
             let mut b = backend(args, true)?;
             let a =
                 json!({"comp": reference(&comp), "layer": reference(&layer), "path": path, "value": value, "time": args.num("--time")?, "expression": expr});
@@ -612,9 +751,8 @@ fn run(cmd: &str, args: &Args, json_out: bool) -> Result<(), Failure> {
             }
             let out = args.opt("--out").unwrap_or("frame.png").to_string();
             let t0 = std::time::Instant::now();
-            let f = b.render_with(comp.as_ref(), time, max_side, args.flag("--transparent"))?;
+            let f = b.render_to_file(comp.as_ref(), time, max_side, args.flag("--transparent"), &out)?;
             let ms = t0.elapsed().as_secs_f64() * 1000.0;
-            std::fs::write(&out, &f.png).map_err(|e| format!("cannot write {out}: {e}"))?;
             let info = json!({"path": out, "comp": f.comp, "time": f.time, "width": f.width, "height": f.height, "ms": (ms * 10.0).round() / 10.0});
             if json_out {
                 emit(&info, true);
@@ -750,6 +888,8 @@ fn render(args: &Args, json_out: bool) -> Result<(), Failure> {
             ("--rate-control", "rateControl"),
             ("--webm-codec", "webmCodec"),
             ("--opus-app", "opusApplication"),
+            ("--exr-compression", "exrCompression"),
+            ("--exr-depth", "exrBitDepth"),
         ] {
             if let Some(v) = args.opt(flag) {
                 p[key] = json!(v);
@@ -775,6 +915,7 @@ fn render(args: &Args, json_out: bool) -> Result<(), Failure> {
             r["outputModuleSummary"].as_str().unwrap_or("")
         );
     }
+    let attempted: std::collections::HashSet<u64> = s.project.render_queue.iter().filter(|i| i.is_queued()).map(|i| i.id).collect();
     s.execute("renderQueue.render", json!({"wait": false})).map_err(err)?;
     let tty = std::io::IsTerminal::is_terminal(&std::io::stderr());
     // `--progress`: one line per update for a program reading stderr (a terminal gets the live line).
@@ -813,7 +954,7 @@ fn render(args: &Args, json_out: bool) -> Result<(), Failure> {
     }
     let mut results = vec![];
     let mut failed = vec![];
-    for it in s.project.render_queue.iter().filter(|i| i.render && i.started.is_some()) {
+    for it in s.project.render_queue.iter().filter(|i| attempted.contains(&i.id)) {
         let name = s.project.item(it.comp).map(|i| i.name.clone()).unwrap_or_else(|| "?".into());
         match &it.status {
             RenderStatus::Done => {
@@ -860,6 +1001,9 @@ fn bench_cmd(args: &Args) -> Result<(), Failure> {
     if args.flag("--ops") {
         return bench_ops(args);
     }
+    if args.flag("--roto") {
+        return bench_roto(args);
+    }
     let mut s = effectcraft_host::session();
     match &args.project {
         Some(p) => s.execute("file.open", json!({"path": p})),
@@ -882,6 +1026,117 @@ fn bench_cmd(args: &Args) -> Result<(), Failure> {
     Ok(())
 }
 
+/// The model a bench option asks for: the file named on the command line, where failing to read or
+/// build it is an error saying why (not "not installed"); else the installed file, where a file that
+/// cannot be used just leaves the model out.
+fn bench_weights<T>(
+    flag: &str,
+    named: Option<&str>,
+    installed: Option<std::path::PathBuf>,
+    build: impl Fn(&[u8]) -> Result<T, String>,
+) -> Result<Option<T>, Failure> {
+    match named {
+        Some(path) => {
+            let bytes = std::fs::read(path).map_err(|e| Failure::Error(format!("{flag} {path}: {e}")))?;
+            build(&bytes).map(Some).map_err(|e| Failure::Error(format!("{flag} {path}: {e}")))
+        }
+        None => Ok(installed.and_then(|p| std::fs::read(p).ok()).and_then(|bytes| build(&bytes).ok())),
+    }
+}
+
+/// `bench --roto`: the Roto Brush's trackers on synthetic clips whose true mattes are known.
+fn bench_roto(args: &Args) -> Result<(), Failure> {
+    use effectcraft_segment::{Loaded, MOBILE_SAM, MaskModel};
+    use effectcraft_track::roto::bench;
+    let frames = args.num("--frames")?.unwrap_or(24.0).clamp(1.0, 240.0) as usize;
+    let session = effectcraft_host::session();
+    // `--mobilesam FILE` uses the weights at FILE (a file that cannot be used is an error);
+    // otherwise the installed ones.
+    let mobilesam: Option<std::sync::Arc<dyn MaskModel>> = bench_weights("--mobilesam", args.opt("--mobilesam"), session.model_path(&MOBILE_SAM), |bytes| {
+        match effectcraft_segment::load(MOBILE_SAM.id, bytes)? {
+            Loaded::Mask(m) => Ok(m),
+            _ => Err("not a mask model".to_string()),
+        }
+    })?;
+    if mobilesam.is_none() {
+        note!("bench --roto: MobileSAM is not installed; comparing the classical engine only");
+    }
+    // `--sam2 FILE` uses the weights at FILE (a file that cannot be used is an error); otherwise
+    // the installed ones.
+    let installed_sam2 = effectcraft_sam2::mask::SIZES.iter().find_map(|m| session.model_path(m));
+    let sam2: Option<std::sync::Arc<dyn MaskModel>> =
+        bench_weights("--sam2", args.opt("--sam2"), installed_sam2, |bytes| effectcraft_sam2::mask::load(bytes).map(|m| m as std::sync::Arc<dyn MaskModel>))?;
+    if sam2.is_none() {
+        note!("bench --roto: no SAM 2.1 size is installed; no SAM 2 column");
+    }
+    // `--fixes`: count correction rounds before every frame reaches IoU 0.9 (up to 6 rounds, each up to two strokes).
+    let fixes = args.flag("--fixes");
+    let measure = |sc: &bench::Scenario, run: &dyn Fn(&bench::Scenario) -> Option<bench::Run>| if fixes { bench::with_fixes(sc, 0.9, 6, run) } else { run(sc) };
+    let mut runs = vec![];
+    // User clips pair unique filename stems, allowing JPEG frames with PNG truth masks.
+    let scenarios = if let Some(dir) = args.opt("--clip") {
+        let truth = args.opt("--truth").ok_or_else(|| Failure::Error("--clip needs --truth MASKS_DIR".into()))?;
+        let name = std::path::Path::new(dir).file_name().map_or_else(|| "clip".to_string(), |n| n.to_string_lossy().chars().take(10).collect());
+        vec![load_bench_clip(&name, dir, truth, frames).map_err(Failure::Error)?]
+    } else {
+        bench::scenarios(frames)
+    };
+    for sc in scenarios {
+        runs.extend(measure(&sc, &|s| Some(bench::run_flow(s, "classical", None))));
+        if let Some(m) = &mobilesam {
+            runs.extend(measure(&sc, &|s| Some(bench::run_flow(s, "mobilesam", Some(m.as_ref())))));
+        }
+        if let Some(m) = &sam2 {
+            let label = m.info().id.replacen("sam2.1-hiera-", "sam2-", 1);
+            runs.extend(measure(&sc, &|s| bench::run_tracker(s, &label, m.as_ref())));
+        }
+    }
+    if args.flag("--json") {
+        say!("{}", serde_json::to_string_pretty(&runs).map_err(|e| Failure::Error(e.to_string()))?);
+    } else {
+        say!("{}", bench::table(&runs));
+    }
+    Ok(())
+}
+
+/// The image files of `dir` (png, jpg, jpeg), ordered by stem then full file name.
+fn image_files(dir: &str) -> Result<Vec<std::path::PathBuf>, String> {
+    let mut files: Vec<std::path::PathBuf> = std::fs::read_dir(dir)
+        .map_err(|e| format!("cannot read {dir}: {e}"))?
+        .filter_map(|e| e.ok().map(|e| e.path()))
+        .filter(|p| p.extension().and_then(|e| e.to_str()).is_some_and(|e| ["png", "jpg", "jpeg"].contains(&e.to_ascii_lowercase().as_str())))
+        .collect();
+    files.sort_by(|a, b| a.file_stem().cmp(&b.file_stem()).then_with(|| a.file_name().cmp(&b.file_name())));
+    Ok(files)
+}
+
+/// A benchmark scenario from the user's frames and truth masks (at most `limit` frames, frames at most 480 px
+/// wide; a mask pixel above 127 is the object). Nothing is copied or kept.
+fn load_bench_clip(name: &str, frames_dir: &str, truth_dir: &str, limit: usize) -> Result<effectcraft_track::roto::bench::Scenario, String> {
+    let (frames, masks) = (image_files(frames_dir)?, image_files(truth_dir)?);
+    if frames.is_empty() || frames.len() != masks.len() {
+        return Err(format!("{} frames in {frames_dir} but {} masks in {truth_dir}: they must match one to one", frames.len(), masks.len()));
+    }
+    if frames.iter().map(|p| p.file_stem()).ne(masks.iter().map(|p| p.file_stem()))
+        || frames.windows(2).chain(masks.windows(2)).any(|pair| pair.first().and_then(|p| p.file_stem()) == pair.get(1).and_then(|p| p.file_stem()))
+    {
+        return Err("frame and truth file names must match one to one, with unique stems (extensions may differ)".into());
+    }
+    let n = frames.len().min(limit.clamp(1, 240));
+    let (mut imgs, mut truth) = (vec![], vec![]);
+    for (f, m) in frames.iter().zip(&masks).take(n) {
+        let rgba = image::open(f).map_err(|e| format!("{}: {e}", f.display()))?.to_rgba8();
+        let scale = (480.0 / f64::from(rgba.width().max(1))).min(1.0);
+        let (w, h) = (((f64::from(rgba.width()) * scale).round() as u32).max(1), ((f64::from(rgba.height()) * scale).round() as u32).max(1));
+        let rgba = if (w, h) == rgba.dimensions() { rgba } else { image::imageops::resize(&rgba, w, h, image::imageops::FilterType::Triangle) };
+        let mask = image::open(m).map_err(|e| format!("{}: {e}", m.display()))?.to_luma8();
+        let mask = image::imageops::resize(&mask, w, h, image::imageops::FilterType::Nearest);
+        imgs.push(effectcraft_render::Image::from_rgba8(w, h, rgba.as_raw()));
+        truth.push(mask.as_raw().iter().map(|v| u8::from(*v > 127)).collect());
+    }
+    effectcraft_track::roto::bench::scenario_from(name, imgs, truth)
+}
+
 /// `bench --ops`: everyday operations on a large generated project (200 comps, 5,000 layers in
 /// the main comp, 300 footage items, 20-deep precomp nesting, expressions): startup to first
 /// frame, open, save, auto-save, small and large edits with undo/redo, first frame, timeline
@@ -1181,14 +1436,14 @@ fn adv3d_bench_comp(p: &mut effectcraft_engine::project::Project) -> Option<Item
         set(l, "cameraOptions/highlightGain", Value::Scalar(20.0));
         set(l, "cameraOptions/highlightThreshold", Value::Scalar(200.0));
     });
-    comp.layers = layers;
+    comp.layers = layers.into();
     Some(p.add_item("Advanced 3D (bench)", effectcraft_engine::color::Label::None, None, ItemKind::Comp(comp.into())))
 }
 
 /// `bench --gpu`: CPU vs GPU ms/frame for every comp (or `--comp`) at Full and Half. "cold"
 /// renders everything (no layer cache); "warm" reuses the layer cache (playback / scrubbing of
 /// unchanged layers: compositing cost); "viewer" is the GPU display path without readback;
-/// "auto" is Backend::Auto (Mercury GPU Acceleration) choosing per comp from measured times,
+/// "auto" is Backend::Auto (GPU Acceleration) choosing per comp from measured times,
 /// warm; "up/dn MB" are the GPU's uploads / readbacks per warm GPU frame.
 fn bench_gpu(s: &Session, args: &Args) -> Result<(), Failure> {
     use effectcraft_render::Backend;
@@ -1298,6 +1553,16 @@ fn bench_gpu(s: &Session, args: &Args) -> Result<(), Failure> {
     Ok(())
 }
 
+/// A flat property's value for the text listing: an enum's number with the label `options` gives it
+/// (#2928), since the numbers are 0-based where After Effects scripting counts from 1.
+fn value_text(p: &Value) -> String {
+    let label = p["options"].as_array().and_then(|o| o.iter().find(|o| o["value"] == p["value"])).and_then(|o| o["label"].as_str());
+    match label {
+        Some(l) => format!("{} ({l})", p["value"]),
+        None => p["value"].to_string(),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/apps/effectcraft-cli/src/project_lock.rs b/apps/effectcraft-cli/src/project_lock.rs
new file mode 100644
index 000000000..234bbfd33
--- /dev/null
+++ b/apps/effectcraft-cli/src/project_lock.rs
@@ -0,0 +1,150 @@
+//! One saving run at a time per project file.
+//!
+//! A `--save` run reads the project, edits it and writes the whole file back, so two at once would
+//! silently drop the edits of whichever saved first (#2851). Each run holds an OS lock from before
+//! its read until it exits; the next one waits, then reads what the first one saved. This is how
+//! filmcraft-cli does it (storytold/filmcraft#3926).
+//!
+//! The lock is on a file next to the project, not on the project: a save replaces the project's
+//! inode, and on Windows a locked file can't be read by other processes. The OS drops the lock when
+//! the process ends, however it ends, so a crash leaves nothing stale. The file itself stays, since
+//! removing it would let one run wait on the old file while another locks a new one.
+
+use crate::{Args, Failure};
+use std::fs::{File, TryLockError};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+/// Most bytes of the project's file name kept in the lock's name; the rest of the 255-byte limit
+/// is left for the leading dot and `.lock`.
+const MAX_NAME_BYTES: usize = 200;
+
+fn lock_path(project: &Path) -> PathBuf {
+    let name = project.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+    project.with_file_name(format!(".{}.lock", &name[..name.floor_char_boundary(MAX_NAME_BYTES)]))
+}
+
+/// Do two paths name one existing file?
+fn same_file(a: &str, b: &str) -> bool {
+    a == b || matches!((std::fs::canonicalize(a), std::fs::canonicalize(b)), (Ok(a), Ok(b)) if a == b)
+}
+
+/// The path this run saves over, when that is the file it opens. `--save-as` somewhere else replaces
+/// that file whatever it held, so there is no edit of its to lose.
+///
+/// The lock goes by this path as written, not by where a symlink points: runs that name the
+/// project the same way share one lock.
+///
+/// A missing project is an error here, before anything else, the same one opening it would give.
+/// If the run went on, another one could create the project before it is read, and this run would
+/// edit and save it with no lock. Checking first also means the paths compared below exist, so
+/// `canonicalize` tells exactly whether they are one file, however they are spelt. A project that
+/// exists but isn't a file gets no lock file beside it, and opening it reports why.
+fn saved_in_place(a: &Args) -> Result<Option<&Path>, String> {
+    // `--bridge` with a project is a usage error, which `backend` reports
+    let Some(project) = a.project.as_deref().filter(|_| a.opt("--bridge").is_none()) else { return Ok(None) };
+    match Path::new(project).metadata() {
+        Ok(meta) if meta.is_file() => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Err(format!("cannot read {project}: {e}")),
+        _ => return Ok(None),
+    }
+    match a.opt("--save-as") {
+        Some(target) if same_file(target, project) => Ok(Some(Path::new(target))),
+        None if a.flag("--save") => Ok(Some(Path::new(project))),
+        _ => Ok(None),
+    }
+}
+
+/// Lock `project`, calling `waiting` first if another run holds the lock.
+fn lock(project: &Path, waiting: impl FnOnce()) -> std::io::Result<File> {
+    let file = File::options().create(true).truncate(false).read(true).write(true).open(lock_path(project))?;
+    match file.try_lock() {
+        Ok(()) => {}
+        Err(TryLockError::WouldBlock) => {
+            waiting();
+            file.lock()?;
+        }
+        Err(TryLockError::Error(e)) => return Err(e),
+    }
+    Ok(file)
+}
+
+/// Take the project's lock if this run saves over the file it opens, or fail if the project is
+/// missing. Call it before opening the project and keep the result until the save is done. Blocks
+/// while another run holds the lock, which is fine here: nothing else is running yet. A lock that
+/// can't be had (a read-only folder, a file system without locks) is a warning and not an error, so
+/// that saving works where it did.
+pub(crate) fn for_save(a: &Args) -> Result<Option<File>, Failure> {
+    let Some(project) = saved_in_place(a).map_err(Failure::Error)? else { return Ok(None) };
+    let shown = project.display();
+    let waiting = || {
+        let _ = writeln!(std::io::stderr(), "effectcraft-cli: waiting for another run saving {shown}");
+    };
+    match lock(project, waiting) {
+        Ok(file) => Ok(Some(file)),
+        Err(e) => {
+            let _ = writeln!(std::io::stderr(), "effectcraft-cli: warning: can't lock {shown} ({e}); another run saving it now could overwrite these edits");
+            Ok(None)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn args(list: &[&str]) -> Args {
+        Args::parse(list.iter().map(|s| s.to_string()).collect()).unwrap()
+    }
+
+    #[test]
+    fn the_lock_sits_next_to_the_project() {
+        assert_eq!(lock_path(Path::new("/a/b/p.ecproj")), Path::new("/a/b/.p.ecproj.lock"));
+        assert_eq!(lock_path(Path::new("p.ecproj")), Path::new(".p.ecproj.lock"));
+    }
+
+    #[test]
+    fn a_long_project_name_still_gets_a_lock_name_the_file_system_takes() {
+        for name in ["a".repeat(255), "é".repeat(127)] {
+            let lock = lock_path(Path::new(&name));
+            let lock = lock.to_str().unwrap();
+            assert!(lock.len() <= 255, "{} bytes", lock.len());
+            assert!(lock.ends_with(".lock"));
+        }
+    }
+
+    /// The moment between this check and opening the project can't be hit on demand, so this pins
+    /// the decision that closes it: a run never goes on to open a project that wasn't there, however
+    /// its paths are spelt and whatever it saves.
+    #[test]
+    fn a_missing_project_stops_the_run_before_anything_opens_it() {
+        let name = format!("ec-cli-gone-{}.ecproj", std::process::id());
+        let gone = std::env::temp_dir().join(&name);
+        let gone = gone.to_str().unwrap();
+        let alias = std::env::temp_dir().join(".").join(&name);
+        let alias = alias.to_str().unwrap();
+        let dotted = format!("./{name}");
+        // in a folder that doesn't exist either, so no part of either spelling can be resolved
+        let new_dir = std::env::temp_dir().join(format!("ec-cli-new-dir-{}", std::process::id()));
+        let in_new_dir = new_dir.join("p.ecproj");
+        let in_new_dir = in_new_dir.to_str().unwrap();
+        let in_new_dir_alias = new_dir.join(".").join("p.ecproj");
+        let in_new_dir_alias = in_new_dir_alias.to_str().unwrap();
+        for (project, list) in [
+            (gone, &["exec", "--project", gone, "--save"][..]),
+            (gone, &["exec", gone, "--save"]),
+            (gone, &["exec", "--project", gone, "--save-as", gone]),
+            (gone, &["exec", "--project", gone, "--save-as", alias]),
+            (name.as_str(), &["exec", "--project", &name, "--save-as", &dotted]),
+            (in_new_dir, &["exec", "--project", in_new_dir, "--save-as", in_new_dir_alias]),
+            (gone, &["exec", "--project", gone, "--save-as", "other.ecproj"]),
+            (gone, &["exec", "--project", gone]),
+        ] {
+            let error = saved_in_place(&args(list)).unwrap_err();
+            assert_eq!(error.split_once(": ").map(|(head, _)| head), Some(format!("cannot read {project}").as_str()), "{list:?}: {error}");
+        }
+        // a project with --bridge is a usage error, which `backend` reports; no project, no lock
+        assert_eq!(saved_in_place(&args(&["exec", "--bridge", "9877", "--project", gone, "--save"])), Ok(None));
+        assert_eq!(saved_in_place(&args(&["exec", "--demo", "--save-as", gone])), Ok(None));
+    }
+}
diff --git a/apps/effectcraft-cli/src/template.rs b/apps/effectcraft-cli/src/template.rs
index 844c978b2..8cf5c124f 100644
--- a/apps/effectcraft-cli/src/template.rs
+++ b/apps/effectcraft-cli/src/template.rs
@@ -150,8 +150,11 @@ fn instantiate(s: &mut Session, source: u64, values: &Map<String, Value>, import
     }
     let added = execute(s, "layer.addItem", json!({"comp": parent, "item": source, "time": 0}))?;
     let instance = added.get("layer").and_then(Value::as_u64).ok_or_else(|| Failure::Error("cannot create template instance".into()))?;
-    // Keep a partial final frame: layer.addItem snaps its default end to the frame grid.
+    // Keep a partial final frame: layer.addItem snaps its default end to the frame grid. Give the
+    // wrapper the source's exact name, not Duplicate's numbered one, for `[compName]` outputs.
     s.edit("Template Duration", None, |project, _| {
+        let name = project.item(ItemId(source)).ok_or_else(|| EngineError::Other("template composition is missing".into()))?.name.clone();
+        project.item_mut(ItemId(parent)).ok_or_else(|| EngineError::Other("template render composition is missing".into()))?.name = name;
         let comp = project.comp_mut(ItemId(parent)).ok_or(EngineError::NoComp)?;
         let duration = comp.duration;
         let layer = comp.layer_mut(LayerId(instance)).ok_or_else(|| EngineError::Other("template instance is missing".into()))?;
diff --git a/apps/effectcraft-cli/tests/cli.rs b/apps/effectcraft-cli/tests/it/cli.rs
similarity index 55%
rename from apps/effectcraft-cli/tests/cli.rs
rename to apps/effectcraft-cli/tests/it/cli.rs
index 1111db403..363eb8e52 100644
--- a/apps/effectcraft-cli/tests/cli.rs
+++ b/apps/effectcraft-cli/tests/it/cli.rs
@@ -7,7 +7,7 @@ use std::process::{Command, Stdio};
 use serde_json::{Value, json};
 
 fn bin() -> Command {
-    Command::new(env!("CARGO_BIN_EXE_effectcraft-cli"))
+    Command::new(crate::binary())
 }
 
 /// Run with `--json`; returns (exit code, parsed stdout).
@@ -110,6 +110,299 @@ fn exec_set_get_with_saved_project() {
     assert_eq!(v[1]["result"]["time"], v[0]["result"]["time"], "{v}");
 }
 
+/// #2928: the text listing gives an enum's label next to its number (0-based, unlike After
+/// Effects scripting), the way `props --json` lists its `options`.
+#[test]
+fn props_lists_enum_labels() {
+    let proj = tmp("enum-labels.ecproj");
+    let p = proj.to_str().unwrap();
+    let anim = r#"{"layer":"t","properties":["opacity"]}"#;
+    ok_json(&[
+        "run",
+        "comp.new",
+        r#"{"name":"T","width":64,"height":36}"#,
+        "layer.newText",
+        r#"{"text":"AB","name":"t"}"#,
+        "layer.addTextAnimator",
+        anim,
+        "--empty",
+        "--save-as",
+        p,
+    ]);
+    ok_json(&["set", "T", "t", "text/animators/animator/selectors/rangeSelector/advanced/shape", "1", p, "--save"]);
+    let out = bin().args(["props", "T", "t", p]).output().unwrap();
+    let text = String::from_utf8_lossy(&out.stdout);
+    let shape = text.lines().find(|l| l.contains("advanced/shape")).unwrap_or_else(|| panic!("no shape line in:\n{text}"));
+    assert!(shape.trim_end().ends_with("enum     1 (Ramp Up)"), "{shape}");
+    let units = text.lines().find(|l| l.contains("advanced/units")).unwrap_or_default();
+    assert!(units.trim_end().ends_with("0 (Percentage)"), "{units}");
+    let size = text.lines().find(|l| l.contains("transform/opacity")).unwrap_or_default();
+    assert!(size.trim_end().ends_with("100.0"), "a number without options stays bare: {size}");
+}
+
+/// A project in a new folder of its own, for the save lock tests (#2851).
+fn lock_test_project(tag: &str) -> (PathBuf, String) {
+    let dir = tmp(&format!("lock-{tag}"));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let proj = dir.join("p.ecproj").to_str().unwrap().to_string();
+    ok_json(&["exec", "project.newFolder", r#"{"name":"start"}"#, "--empty", "--save-as", &proj]);
+    (dir, proj)
+}
+
+/// The lock of the project file `name`, held by this process.
+fn hold_lock(dir: &std::path::Path, name: &str) -> std::fs::File {
+    let lock = std::fs::File::options().create(true).truncate(false).read(true).write(true).open(dir.join(format!(".{name}.lock"))).unwrap();
+    lock.lock().unwrap();
+    lock
+}
+
+/// Start a run that has to wait for a lock this process holds; returns once it says it is waiting.
+fn start_waiting_run(args: &[&str]) -> std::process::Child {
+    let mut child = bin().args(args).stdout(Stdio::null()).stderr(Stdio::piped()).spawn().unwrap();
+    let mut stderr = BufReader::new(child.stderr.take().unwrap());
+    let mut line = String::new();
+    while !line.contains("waiting for another run saving") {
+        line.clear();
+        assert_ne!(stderr.read_line(&mut line).unwrap(), 0, "{args:?} ended without waiting");
+    }
+    assert!(child.try_wait().unwrap().is_none(), "{args:?} did not wait");
+    child
+}
+
+/// Folder names in a saved project.
+fn has_folder(proj: &str, name: &str) -> bool {
+    std::fs::read_to_string(proj).unwrap().contains(&format!("\"{name}\""))
+}
+
+#[test]
+fn parallel_saves_keep_every_edit() {
+    let (dir, proj) = lock_test_project("parallel");
+    let names = |writer: usize| (0..300).map(move |i| format!("edit-{writer}-{i}"));
+    let mut writers: Vec<_> = (0..4)
+        .map(|_| {
+            bin()
+                .args(["run", "--project", &proj, "--commands", "-", "--save"])
+                .stdin(Stdio::piped())
+                .stdout(Stdio::null())
+                .stderr(Stdio::null())
+                .spawn()
+                .unwrap()
+        })
+        .collect();
+    // Each writer reads its whole script before it opens the project, so closing the stdins together
+    // starts all the edits at once, and long scripts keep each read-to-save span over the others.
+    for (n, writer) in writers.iter_mut().enumerate() {
+        let script: String = names(n).map(|name| format!("{}\n", json!({"command": "project.newFolder", "params": {"name": name}}))).collect();
+        writer.stdin.take().unwrap().write_all(script.as_bytes()).unwrap();
+    }
+    for mut writer in writers {
+        assert!(writer.wait().unwrap().success());
+    }
+    let lost: Vec<String> = (0..4).flat_map(names).filter(|name| !has_folder(&proj, name)).collect();
+    assert!(lost.is_empty(), "lost {} edits: {lost:?}", lost.len());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_save_in_place_waits_for_the_lock_then_edits_the_latest_project() {
+    let (dir, proj) = lock_test_project("wait");
+    for save in [&["--save"][..], &["--save-as", proj.as_str()]] {
+        let held = hold_lock(&dir, "p.ecproj");
+        let before = std::fs::read(&proj).unwrap();
+        let params = json!({"name": format!("waited-{}", save.len())}).to_string();
+        let args = [&["exec", "project.newFolder", &params, "--project", &proj][..], save].concat();
+        let mut child = start_waiting_run(&args);
+        assert_eq!(std::fs::read(&proj).unwrap(), before, "{save:?} wrote while another run held the lock");
+        // an edit made meanwhile by the holder must survive: the waiter reads only after the lock is free
+        let held_params = json!({"name": format!("held-{}", save.len())}).to_string();
+        ok_json(&["exec", "project.newFolder", &held_params, "--project", &proj, "--save-as", &format!("{proj}.tmp")]);
+        std::fs::rename(format!("{proj}.tmp"), &proj).unwrap();
+        drop(held);
+        assert!(child.wait().unwrap().success(), "{save:?}");
+        for want in [format!("waited-{}", save.len()), format!("held-{}", save.len())] {
+            assert!(has_folder(&proj, &want), "{save:?} lost {want}");
+        }
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Runs through a symlink take the same lock before and after a save, or a run still waiting on
+/// the old one could overwrite a later run's save.
+#[cfg(unix)]
+#[test]
+fn a_symlinked_project_keeps_its_lock_after_a_save() {
+    let (dir, proj) = lock_test_project("symlink");
+    let link = dir.join("link.ecproj");
+    std::os::unix::fs::symlink(&proj, &link).unwrap();
+    for name in [r#"{"name":"first"}"#, r#"{"name":"second"}"#] {
+        let held = hold_lock(&dir, "link.ecproj");
+        let mut child = start_waiting_run(&["exec", "project.newFolder", name, "--project", link.to_str().unwrap(), "--save"]);
+        drop(held);
+        assert!(child.wait().unwrap().success(), "{name}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn runs_that_do_not_save_in_place_ignore_the_lock() {
+    let (dir, proj) = lock_test_project("ignore");
+    let other = dir.join("other.ecproj").to_str().unwrap().to_string();
+    let _held = hold_lock(&dir, "p.ecproj");
+    let params = r#"{"name":"copy-only"}"#;
+    let cases: [&[&str]; 3] = [
+        &["info", "--project", &proj],
+        &["exec", "project.newFolder", params, "--project", &proj],
+        &["exec", "project.newFolder", params, "--project", &proj, "--save-as", &other],
+    ];
+    for args in cases {
+        let mut child = bin().args(args).stdout(Stdio::null()).stderr(Stdio::null()).spawn().unwrap();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+        let status = loop {
+            if let Some(status) = child.try_wait().unwrap() {
+                break status;
+            }
+            if std::time::Instant::now() > deadline {
+                let _ = child.kill();
+                panic!("{args:?} is waiting for a lock it doesn't need");
+            }
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        };
+        assert!(status.success(), "{args:?}");
+    }
+    assert!(!has_folder(&proj, "copy-only"));
+    assert!(has_folder(&other, "copy-only"));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_missing_project_gets_no_lock_file_and_keeps_its_error() {
+    let (dir, _) = lock_test_project("missing");
+    let gone = dir.join("gone.ecproj").to_str().unwrap().to_string();
+    let other = dir.join("other.ecproj").to_str().unwrap().to_string();
+    // what opening it says, after the `effectcraft-cli <subcommand>: ` prefix
+    let error = |args: &[&str]| {
+        let out = bin().args(args).output().unwrap();
+        assert_eq!(out.status.code(), Some(1), "{args:?}");
+        let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+        stderr.split_once(": ").map(|(_, e)| e.to_string()).unwrap_or(stderr)
+    };
+    let plain = error(&["info", "--project", &gone]);
+    assert!(plain.contains("gone.ecproj"), "{plain}");
+    // saving in place, saving elsewhere, or not saving: the error is the one opening gives
+    for save in [&["--save"][..], &["--save-as", gone.as_str()], &["--save-as", other.as_str()], &[]] {
+        let args = [&["exec", "project.newFolder", r#"{"name":"copy-only"}"#, "--project", &gone][..], save].concat();
+        assert_eq!(error(&args), plain, "{save:?}");
+    }
+    assert!(!dir.join(".gone.ecproj.lock").exists());
+    assert!(!dir.join("other.ecproj").exists());
+    // a project with --bridge stays a usage error
+    assert_eq!(bin().args(["exec", "project.newFolder", "--bridge", "9877", "--project", &gone, "--save"]).output().unwrap().status.code(), Some(2));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// `run --args-file` reads its command / params pairs from a file, one per line: a batch longer
+/// than a Windows command line (32 767 characters, os error 206) still runs.
+#[test]
+fn run_reads_arguments_from_a_file() {
+    let proj = tmp("args-file.ecproj");
+    let p = proj.to_str().unwrap();
+    let mut lines = vec!["comp.new".to_string(), json!({"name": "A", "width": 64, "height": 64}).to_string()];
+    for i in 0..400 {
+        lines.push("layer.newSolid".into());
+        lines.push(json!({"width": 8, "height": 8, "name": format!("Solid with a long name to pass the limit {i:04}")}).to_string());
+        lines.push(String::new());
+    }
+    let text = lines.join("\n");
+    assert!(text.len() > 32_767);
+    let file = tmp("args-file.txt");
+    std::fs::write(&file, text).unwrap();
+    let v = ok_json(&["run", "--args-file", file.to_str().unwrap(), "--empty", "--save-as", p]);
+    assert_eq!(v["result"].as_array().map(Vec::len), Some(401), "{v}");
+    let out = bin().args(["run", "--args-file", "no/such/file.txt", "--empty"]).output().unwrap();
+    assert_eq!(out.status.code(), Some(2));
+    assert!(String::from_utf8_lossy(&out.stderr).contains("--args-file no/such/file.txt"));
+}
+
+/// Run with `stdin` piped in; returns (exit code, stdout, stderr).
+fn run_with_stdin(args: &[&str], stdin: &str) -> (i32, String, String) {
+    let mut child = bin().args(args).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    // The child may exit before it has read all of standard input (the usage-error cases below
+    // exit with code 2 without draining stdin), so a broken pipe while writing is that early
+    // exit, not a failure of this helper; the assertions on the returned output still hold.
+    let mut stdin_pipe = child.stdin.take().unwrap();
+    if let Err(err) = stdin_pipe.write_all(stdin.as_bytes()) {
+        assert_eq!(err.kind(), std::io::ErrorKind::BrokenPipe, "writing the child's standard input: {err}");
+    }
+    drop(stdin_pipe);
+    let out = child.wait_with_output().unwrap();
+    (out.status.code().unwrap_or(-1), String::from_utf8_lossy(&out.stdout).into_owned(), String::from_utf8_lossy(&out.stderr).into_owned())
+}
+
+/// `run --commands FILE|-` (#2251) reads `{"command", "params"}` steps from a JSON array or JSON
+/// Lines, from a file or standard input, and runs them as the same positional pairs would: after
+/// the pairs, so a generated list can follow a hand-written prefix. One command whose params are
+/// over Linux's 128 KiB per-argument limit goes through.
+#[test]
+fn run_reads_commands_from_a_file_or_stdin() {
+    let steps = [
+        ("comp.new", json!({"name": "A", "width": 64, "height": 64})),
+        ("layer.newSolid", json!({"width": 8, "height": 8, "name": "One"})),
+        ("layer.newSolid", json!({"width": 8, "height": 8, "name": "Two"})),
+        ("project.summary", json!({})),
+    ];
+    let pairs: Vec<String> = steps.iter().flat_map(|(id, p)| [id.to_string(), p.to_string()]).collect();
+    let pairs: Vec<&str> = pairs.iter().map(String::as_str).collect();
+    let expected = ok_json(&[&["run", "--empty"][..], &pairs[..]].concat());
+    let layers = |v: &Value| v[3]["result"]["items"][0]["layers"].as_u64();
+    assert_eq!(layers(&expected), Some(2), "{expected}");
+
+    let objects: Vec<Value> = steps.iter().map(|(id, p)| json!({"command": id, "params": p})).collect();
+    let array = tmp("commands.json");
+    std::fs::write(&array, serde_json::to_string_pretty(&objects).unwrap()).unwrap();
+    assert_eq!(ok_json(&["run", "--commands", array.to_str().unwrap(), "--empty"]), expected);
+
+    let lines: String = objects.iter().map(|o| format!("{o}\n\n")).collect();
+    let (code, out, err) = run_with_stdin(&["run", "--commands", "-", "--empty", "--json"], &lines);
+    assert_eq!(code, 0, "{err}");
+    assert_eq!(serde_json::from_str::<Value>(&out).unwrap(), expected);
+
+    // Positional pairs first, then the file.
+    let rest = tmp("commands-rest.jsonl");
+    std::fs::write(&rest, objects[1..].iter().map(|o| format!("{o}\n")).collect::<String>()).unwrap();
+    assert_eq!(ok_json(&[&["run", "--empty", "--commands", rest.to_str().unwrap()][..], &pairs[..2]].concat()), expected);
+
+    let name = "n".repeat(140 * 1024);
+    let big = tmp("commands-big.jsonl");
+    std::fs::write(&big, format!("{}\n{}\n", json!({"command": "comp.new", "params": {"name": name}}), json!({"command": "project.summary"}))).unwrap();
+    let v = ok_json(&["run", "--commands", big.to_str().unwrap(), "--empty"]);
+    assert_eq!(v[1]["result"]["items"][0]["name"].as_str().map(str::len), Some(name.len()));
+
+    for (input, args, error) in [
+        ("", &["run", "--commands", "-", "--empty"][..], "--commands -: no commands"),
+        (
+            "{\"command\":\"project.summary\"}\n{\"command\":\"x\",\"param\":{}}\n",
+            &["run", "project.summary", "{}", "--commands", "-", "--empty"],
+            "step 2 (line 2): unknown key `param`",
+        ),
+        ("[{\"command\":\"project.summary\"}, {\"params\":{}}]", &["run", "--commands", "-", "--empty"], "step 1 (entry 2): no `command`"),
+        ("{}", &["run", "--commands", "-", "--commands", "-", "--empty"], "standard input is read once"),
+    ] {
+        let (code, out, err) = run_with_stdin(args, input);
+        assert_eq!(code, 2, "{input:?}: {err}");
+        assert!(err.contains(error), "{input:?}: {err}");
+        assert!(out.is_empty(), "{input:?}: nothing ran");
+    }
+    // An empty list after positional pairs is no error: there is still something to run.
+    let (code, _, err) = run_with_stdin(&["run", "project.summary", "--commands", "-", "--empty"], "");
+    assert_eq!(code, 0, "{err}");
+    // A step that fails when it runs is named by its index too.
+    let (code, out, err) = run_with_stdin(&["run", "--commands", "-", "--empty", "--json"], "{\"command\":\"project.summary\"}\n{\"command\":\"no.such\"}\n");
+    assert_eq!(code, 1, "{err}");
+    let e = serde_json::from_str::<Value>(&out).unwrap()["error"].as_str().map(String::from).unwrap_or_default();
+    assert!(e.starts_with("no.such: ") && e.ends_with(" (step 1)"), "{e}");
+}
+
 #[test]
 fn render_frame_writes_png() {
     let out = tmp("f.png");
@@ -324,6 +617,67 @@ fn render_out_is_relative_to_the_working_directory() {
     let _ = std::fs::remove_dir_all(&root);
 }
 
+/// #1743: `render-frame --out` writes a PNG to the path it is given, and never over footage or
+/// the project file.
+#[test]
+fn render_frame_never_writes_over_footage_or_the_project() {
+    let root = tmp("render-frame-overwrite");
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    let (clip, project) = (root.join("clip.png"), root.join("p.ecproj"));
+    let (c, p) = (clip.to_str().unwrap(), project.to_str().unwrap());
+    // A real PNG to import: a frame of the demo project.
+    ok_json(&["render-frame", "--max-side", "64", "--out", c]);
+    let imported = json!({"paths": [c]}).to_string();
+    ok_json(&["run", "file.import", &imported, "comp.new", r#"{"name":"T","width":64,"height":36,"duration":1}"#, "--empty", "--save-as", p]);
+    let (footage, saved) = (std::fs::read(&clip).unwrap(), std::fs::read(&project).unwrap());
+    for (out, what) in [(c, "footage"), (p, "project")] {
+        let (code, v) = run_json(&["render-frame", "--project", p, "--out", out]);
+        assert_eq!(code, 1, "{what}: {v}");
+        let error = v["error"].as_str().unwrap();
+        assert!(error.contains(out) && error.contains(what), "{what}: {v}");
+    }
+    assert_eq!(std::fs::read(&clip).unwrap(), footage, "the footage is as it was");
+    assert_eq!(std::fs::read(&project).unwrap(), saved, "the project file is as it was");
+    // Anywhere else it writes.
+    let free = root.join("frame.png");
+    ok_json(&["render-frame", "--project", p, "--out", free.to_str().unwrap()]);
+    assert_eq!(&std::fs::read(&free).unwrap()[..8], b"\x89PNG\r\n\x1a\n");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// Two queue items on one file are refused by the render before anything is written, with the
+/// file as it was.
+#[test]
+fn render_refuses_two_items_on_one_file() {
+    let root = tmp("render-clash");
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    let out = root.join("clash.mp4");
+    std::fs::write(&out, b"EARLIER").unwrap();
+    let project = root.join("p.ecproj");
+    let p = project.to_str().unwrap();
+    let add = json!({"output": out.to_str().unwrap()}).to_string();
+    ok_json(&[
+        "run",
+        "comp.new",
+        r#"{"name":"T","width":64,"height":36,"duration":1}"#,
+        "renderQueue.add",
+        &add,
+        "renderQueue.add",
+        &add,
+        "--empty",
+        "--save-as",
+        p,
+    ]);
+    let (code, v) = run_json(&["render", "--queue", "--project", p]);
+    assert_eq!(code, 1, "{v}");
+    let error = v["error"].as_str().unwrap();
+    assert!(error.contains("#1") && error.contains("#2") && error.contains("clash.mp4"), "{v}");
+    assert_eq!(std::fs::read(&out).unwrap(), b"EARLIER");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
 /// A real stdio client: each edit's reply is read before disconnecting or killing the server.
 struct McpChild {
     child: std::process::Child,
@@ -510,6 +864,49 @@ fn a_failed_render_under_run_and_exec_exits_1() {
     assert!(v["error"].as_str().is_some_and(|e| e.starts_with("T: ")), "{v}");
 }
 
+/// A source refusal happens before encoding and has no started timestamp. It must still
+/// fail the CLI, while the valid queue item finishes and the imported frame stays intact.
+#[test]
+fn a_partly_protected_queue_exits_1_under_render_run_and_exec() {
+    let root = tmp("protected-mixed-queue");
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    let source = root.join("source_00000.png");
+    image::RgbaImage::from_pixel(4, 4, image::Rgba([40, 80, 120, 255])).save(&source).unwrap();
+    let original = std::fs::read(&source).unwrap();
+    let project = root.join("q.ecproj");
+    let good = root.join("good.gif");
+    let import = json!({"paths": [source]}).to_string();
+    let blocked = json!({"format": "png", "output": root.join("source_[#####].png")}).to_string();
+    let valid = json!({"format": "gif", "output": good}).to_string();
+    ok_json(&[
+        "run",
+        "--empty",
+        "--save-as",
+        project.to_str().unwrap(),
+        "comp.new",
+        r#"{"name":"Main","width":16,"height":16,"frameRate":10,"duration":0.1}"#,
+        "layer.newSolid",
+        "{}",
+        "file.import",
+        &import,
+        "renderQueue.add",
+        &blocked,
+        "renderQueue.add",
+        &valid,
+    ]);
+    let p = project.to_str().unwrap();
+    for args in [vec!["render", "--queue", "--project", p], vec!["run", p, "renderQueue.render", "{}"], vec!["exec", "renderQueue.render", "--project", p]] {
+        std::fs::write(&good, b"previous output").unwrap();
+        let (code, result) = run_json(&args);
+        assert_eq!(code, 1, "{args:?}: {result}");
+        assert!(result["error"].as_str().is_some_and(|e| e.contains("footage") && e.contains("source_00000.png")), "{result}");
+        assert_eq!(std::fs::read(&source).unwrap(), original);
+        assert!(std::fs::read(&good).unwrap().starts_with(b"GIF8"), "the valid item still rendered");
+    }
+    std::fs::remove_dir_all(root).unwrap();
+}
+
 /// `render --bitrate` (#440) targets the bitrate in VP9 WebM.
 #[test]
 fn render_bitrate_applies_to_vp9_webm() {
@@ -540,6 +937,113 @@ fn render_bitrate_applies_to_vp9_webm() {
     let _ = std::fs::remove_dir_all(&root);
 }
 
+/// `bench --roto --clip FRAMES --truth MASKS` runs the trackers on the user's own image sequences: here a bright disc
+/// drifting over a dark textured frame, with its true masks. Mismatched sequences are refused with a message.
+#[test]
+fn bench_roto_runs_on_a_users_clip() {
+    let (frames, masks) = (tmp("clip-frames"), tmp("clip-masks"));
+    let config = frames.join("config");
+    for d in [&frames, &masks] {
+        let _ = std::fs::remove_dir_all(d);
+        std::fs::create_dir_all(d).unwrap();
+    }
+    let (w, h) = (96u32, 72u32);
+    for f in 0..14u32 {
+        let (cx, cy) = (30.0 + 4.0 * f as f32, 36.0f32);
+        let (mut img, mut mask) = (image::RgbImage::new(w, h), image::GrayImage::new(w, h));
+        for y in 0..h {
+            for x in 0..w {
+                let inside = ((x as f32 - cx).powi(2) + (y as f32 - cy).powi(2)).sqrt() < 14.0;
+                let tex = 40 + ((x * 7 + y * 13) % 30) as u8;
+                img.put_pixel(x, y, if inside { image::Rgb([230, 120, 40 + (x % 20) as u8]) } else { image::Rgb([tex / 2, tex, tex + 20]) });
+                mask.put_pixel(x, y, image::Luma([if inside { 255 } else { 0 }]));
+            }
+        }
+        let extension = if f == 0 { "jpg" } else { "png" };
+        let stem = match f {
+            0 => "a".into(),
+            1 => "a.jpg".into(),
+            _ => format!("f{f:03}"),
+        };
+        img.save(frames.join(format!("{stem}.{extension}"))).unwrap();
+        mask.save(masks.join(format!("{stem}.png"))).unwrap();
+    }
+    let (f, m) = (frames.to_str().unwrap(), masks.to_str().unwrap());
+    let out = bin().env("EFFECTCRAFT_CONFIG_DIR", &config).args(["bench", "--roto", "--clip", f, "--truth", m, "--frames", "6", "--json"]).output().unwrap();
+    let text = String::from_utf8_lossy(&out.stdout).to_string();
+    assert!(out.status.success(), "{text}\n{}", String::from_utf8_lossy(&out.stderr));
+    let rows: Value = serde_json::from_str(&text).unwrap();
+    let row = rows.as_array().unwrap().iter().find(|row| row["tracker"] == "classical").unwrap();
+    assert_eq!(row["per_frame"].as_array().unwrap().len(), 6, "a user clip respects the requested frame limit");
+    let mean = row["mean_iou"].as_f64().unwrap();
+    assert!(mean > 0.8, "classical mean IoU on the user's clip: {mean}\n{text}");
+    // one mask short: refused
+    std::fs::remove_file(masks.join("f005.png")).unwrap();
+    let out = bin().env("EFFECTCRAFT_CONFIG_DIR", &config).args(["bench", "--roto", "--clip", f, "--truth", m]).output().unwrap();
+    assert!(!out.status.success());
+    assert!(String::from_utf8_lossy(&out.stderr).contains("must match"), "{}", String::from_utf8_lossy(&out.stderr));
+    // --clip without --truth
+    let out = bin().env("EFFECTCRAFT_CONFIG_DIR", &config).args(["bench", "--roto", "--clip", f]).output().unwrap();
+    assert!(!out.status.success());
+}
+
+#[test]
+fn bench_roto_rejects_mismatched_names_before_loading_images() {
+    let root = tmp("bench-clip-names");
+    let (frames, masks) = (root.join("frames"), root.join("masks"));
+    let _ = std::fs::remove_dir_all(&root);
+    for dir in [&frames, &masks] {
+        std::fs::create_dir_all(dir).unwrap();
+        std::fs::write(dir.join("f000.png"), []).unwrap();
+    }
+    std::fs::write(frames.join("f001.png"), []).unwrap();
+    std::fs::write(masks.join("f002.png"), []).unwrap();
+    let out = bin()
+        .env("EFFECTCRAFT_CONFIG_DIR", root.join("config"))
+        .args(["bench", "--roto", "--frames", "1", "--clip"])
+        .arg(&frames)
+        .arg("--truth")
+        .arg(&masks)
+        .output()
+        .unwrap();
+    let error = String::from_utf8_lossy(&out.stderr);
+    assert!(!out.status.success());
+    assert!(error.contains("names must match"), "validate the entire name set before decoding: {error}");
+    std::fs::remove_file(frames.join("f001.png")).unwrap();
+    std::fs::remove_file(masks.join("f002.png")).unwrap();
+    for dir in [&frames, &masks] {
+        std::fs::write(dir.join("f000.jpg"), []).unwrap();
+    }
+    let out =
+        bin().env("EFFECTCRAFT_CONFIG_DIR", root.join("config")).args(["bench", "--roto", "--clip"]).arg(&frames).arg("--truth").arg(&masks).output().unwrap();
+    assert!(!out.status.success());
+    assert!(String::from_utf8_lossy(&out.stderr).contains("unique stems"));
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+/// `bench --roto --sam2 FILE` / `--mobilesam FILE` say why a file named on the command line cannot be
+/// used (a missing file, one that is not the published weights), instead of "not installed".
+#[test]
+fn bench_roto_reports_why_a_named_model_file_failed() {
+    let dir = tmp("bench-weights");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let bogus = dir.join("bogus.bin");
+    std::fs::write(&bogus, b"not the weights").unwrap();
+    for flag in ["--sam2", "--mobilesam"] {
+        let missing = dir.join("missing.bin");
+        let out = bin().env("EFFECTCRAFT_CONFIG_DIR", dir.join("config")).args(["bench", "--roto", flag, missing.to_str().unwrap()]).output().unwrap();
+        let err = String::from_utf8_lossy(&out.stderr).to_string();
+        assert!(!out.status.success(), "{flag}: {err}");
+        assert!(err.contains(flag) && err.contains("missing.bin"), "{flag} names the file that could not be read: {err}");
+        let out = bin().env("EFFECTCRAFT_CONFIG_DIR", dir.join("config")).args(["bench", "--roto", flag, bogus.to_str().unwrap()]).output().unwrap();
+        let err = String::from_utf8_lossy(&out.stderr).to_string();
+        assert!(!out.status.success(), "{flag}: {err}");
+        assert!(err.contains("does not match"), "{flag} says the file is not the published weights: {err}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// Render uses the same empty/project/demo selection as the other CLI commands.
 #[test]
 fn render_empty_does_not_load_the_demo() {
@@ -667,3 +1171,55 @@ fn render_without_progress_writes_no_progress_lines() {
     let stderr = render_demo_stderr("no-progress.gif", &[]);
     assert!(!stderr.lines().any(|l| l.starts_with("progress")), "{stderr}");
 }
+
+/// `render --exr-compression C --exr-depth half` writes OpenEXR frames with that compression and
+/// half-float channels (#2911); an unknown value is an error naming the parameter.
+#[test]
+fn render_exr_compression_and_depth() {
+    let root = tmp("render-exr-options");
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    let project = root.join("x.ecproj");
+    let p = project.to_str().unwrap();
+    ok_json(&[
+        "run",
+        "comp.new",
+        r#"{"name":"T","width":64,"height":36,"duration":1}"#,
+        "layer.newSolid",
+        r#"{"width":64,"height":36}"#,
+        "--empty",
+        "--save-as",
+        p,
+    ]);
+    let out = root.join("f_[#####].exr");
+    let reply = ok_json(&[
+        "render",
+        "--project",
+        p,
+        "--start",
+        "0",
+        "--end",
+        "0.01",
+        "--exr-compression",
+        "piz",
+        "--exr-depth",
+        "half",
+        "--out",
+        out.to_str().unwrap(),
+    ]);
+    assert_eq!(reply["rendered"].as_array().unwrap().len(), 1, "{reply}");
+    let bytes = std::fs::read(root.join("f_00000.exr")).unwrap();
+    // The `compression` attribute: name, type name, a 1-byte size, then PIZ (4).
+    let attr = b"compression\0compression\0\x01\0\0\0";
+    let at = bytes.windows(attr.len()).position(|w| w == attr).expect("compression attribute");
+    assert_eq!(bytes[at + attr.len()], 4, "PIZ");
+    // Each channel in `chlist`: its name, then the pixel type (1 = half).
+    for name in [&b"R\0"[..], b"G\0", b"B\0", b"A\0"] {
+        let half = [name, &[1, 0, 0, 0]].concat();
+        assert!(bytes.windows(half.len()).any(|w| w == half.as_slice()), "{:?} is half float", std::str::from_utf8(name));
+    }
+    let (code, reply) = run_json(&["render", "--project", p, "--exr-depth", "8", "--out", out.to_str().unwrap()]);
+    assert_eq!(code, 1, "{reply}");
+    assert!(reply["error"].as_str().unwrap().contains("exrBitDepth: half|float"), "{reply}");
+    let _ = std::fs::remove_dir_all(&root);
+}
diff --git a/apps/effectcraft-cli/tests/it/main.rs b/apps/effectcraft-cli/tests/it/main.rs
new file mode 100644
index 000000000..bca36ec78
--- /dev/null
+++ b/apps/effectcraft-cli/tests/it/main.rs
@@ -0,0 +1,9 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod cli;
+mod qa_template;
+
+/// Nextest archives relocate binaries; plain Cargo keeps the compile-time path valid.
+fn binary() -> std::ffi::OsString {
+    std::env::var_os("NEXTEST_BIN_EXE_effectcraft_cli").unwrap_or_else(|| env!("CARGO_BIN_EXE_effectcraft-cli").into())
+}
diff --git a/apps/effectcraft-cli/tests/qa_template.rs b/apps/effectcraft-cli/tests/it/qa_template.rs
similarity index 90%
rename from apps/effectcraft-cli/tests/qa_template.rs
rename to apps/effectcraft-cli/tests/it/qa_template.rs
index 8b877755b..ffbdb94e9 100644
--- a/apps/effectcraft-cli/tests/qa_template.rs
+++ b/apps/effectcraft-cli/tests/it/qa_template.rs
@@ -9,7 +9,7 @@ use std::process::Command;
 use serde_json::Value;
 
 fn cli(dir: &PathBuf, args: &[&str]) -> (i32, Value) {
-    let out = Command::new(env!("CARGO_BIN_EXE_effectcraft-cli")).current_dir(dir).args(args).arg("--json").output().unwrap();
+    let out = Command::new(crate::binary()).current_dir(dir).args(args).arg("--json").output().unwrap();
     let stdout = String::from_utf8_lossy(&out.stdout).to_string();
     let v = serde_json::from_str(stdout.trim()).unwrap_or_else(|e| panic!("{args:?}: {e}: {stdout} {}", String::from_utf8_lossy(&out.stderr)));
     (out.status.code().unwrap_or(-1), v)
@@ -152,6 +152,13 @@ fn essential_graphics_template_via_script_and_commands() {
     assert_eq!(image::open(&frames[0]).unwrap().to_rgba8(), edit);
     assert_eq!(std::fs::read(dir.join("lt.ectemplate")).unwrap(), original_template);
 
+    invalid_template_values_fail_cleanly(&dir);
+    template_usage_errors(&dir);
+    rational_template_keeps_exact_rate(&dir, &original_template);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+fn invalid_template_values_fail_cleanly(dir: &PathBuf) {
     // Invalid values fail before the queue creates an output directory, or frame rendering
     // overwrites an existing output. A JSON object and existing control names are required.
     for (name, values, expected) in [
@@ -164,25 +171,27 @@ fn essential_graphics_template_via_script_and_commands() {
         std::fs::write(dir.join(&values_file), values).unwrap();
         let output_dir = dir.join(format!("failed-{name}"));
         let out = output_dir.join("frame_[#####].png");
-        let (code, error) = cli(&dir, &["render", "--template", "lt.ectemplate", "--values", &values_file, "--out", out.to_str().unwrap()]);
+        let (code, error) = cli(dir, &["render", "--template", "lt.ectemplate", "--values", &values_file, "--out", out.to_str().unwrap()]);
         assert_eq!(code, 1, "{name}: {error}");
         assert!(error["error"].as_str().unwrap().contains(expected), "{name}: {error}");
         assert!(!output_dir.exists(), "{name}: invalid input created render output");
         std::fs::write(dir.join("untouched.png"), b"existing output").unwrap();
-        let (code, error) = cli(&dir, &["render-frame", "--template", "lt.ectemplate", "--values", &values_file, "--out", "untouched.png"]);
+        let (code, error) = cli(dir, &["render-frame", "--template", "lt.ectemplate", "--values", &values_file, "--out", "untouched.png"]);
         assert_eq!(code, 1, "{name}: {error}");
         assert_eq!(std::fs::read(dir.join("untouched.png")).unwrap(), b"existing output");
     }
-    let (code, error) = cli(&dir, &["render-frame", "--template", "lt.ectemplate", "--values", "missing-values.json", "--out", "missing.png"]);
+    let (code, error) = cli(dir, &["render-frame", "--template", "lt.ectemplate", "--values", "missing-values.json", "--out", "missing.png"]);
     assert_eq!(code, 1, "{error}");
     assert!(error["error"].as_str().unwrap().contains("cannot read values"), "{error}");
     assert!(!dir.join("missing.png").exists());
     std::fs::write(dir.join("large-values.json"), vec![b' '; 1024 * 1024 + 1]).unwrap();
-    let (code, error) = cli(&dir, &["render-frame", "--template", "lt.ectemplate", "--values", "large-values.json", "--out", "large.png"]);
+    let (code, error) = cli(dir, &["render-frame", "--template", "lt.ectemplate", "--values", "large-values.json", "--out", "large.png"]);
     assert_eq!(code, 1, "{error}");
     assert!(error["error"].as_str().unwrap().contains("exceeds 1 MiB"), "{error}");
     assert!(!dir.join("large.png").exists());
+}
 
+fn template_usage_errors(dir: &PathBuf) {
     for args in [
         vec!["render-frame", "--values", "values.json"],
         vec!["info", "--template", "lt.ectemplate"],
@@ -191,10 +200,12 @@ fn essential_graphics_template_via_script_and_commands() {
         vec!["render", "--template", "lt.ectemplate", "--queue"],
         vec!["render-frame", "--template", "lt.ectemplate", "--bridge", "1"],
     ] {
-        let output = Command::new(env!("CARGO_BIN_EXE_effectcraft-cli")).current_dir(&dir).args(&args).output().unwrap();
+        let output = Command::new(crate::binary()).current_dir(dir).args(&args).output().unwrap();
         assert_eq!(output.status.code(), Some(2), "{args:?}: {}", String::from_utf8_lossy(&output.stderr));
     }
+}
 
+fn rational_template_keeps_exact_rate(dir: &PathBuf, original_template: &[u8]) {
     // File-loaded templates can use exact rational rates that comp.new's float parser rounds.
     // Preserve that rate, Tick duration, work area, background and locked source layers.
     let mut project = effectcraft_engine::project::Project::from_json(&std::fs::read_to_string(dir.join("t.ecproj")).unwrap()).unwrap();
@@ -207,13 +218,13 @@ fn essential_graphics_template_via_script_and_commands() {
     comp.background = [0.08, 0.16, 0.24];
     comp.layers.first_mut().unwrap().switches.locked = true;
     std::fs::write(dir.join("rational.ecproj"), project.to_json()).unwrap();
-    ok(&dir, &["exec", "essential.exportTemplate", r#"{"comp":"Lower Third","path":"rational.ectemplate"}"#, "rational.ecproj"]);
+    ok(dir, &["exec", "essential.exportTemplate", r#"{"comp":"Lower Third","path":"rational.ectemplate"}"#, "rational.ecproj"]);
     let rational_template = std::fs::read(dir.join("rational.ectemplate")).unwrap();
-    let rational = ok(&dir, &["render-frame", "--template", "rational.ectemplate", "--frame", "5", "--out", "rational.png"]);
+    let rational = ok(dir, &["render-frame", "--template", "rational.ectemplate", "--frame", "5", "--out", "rational.png"]);
     assert!((rational["time"].as_f64().unwrap() - 5.0 / rate.as_f64()).abs() < 1e-9, "{rational}");
     assert_eq!((rational["width"].as_u64().unwrap(), rational["height"].as_u64().unwrap()), (320, 90));
     let output = dir.join("rational-work-area/frame_[#####].png");
-    ok(&dir, &["render", "--template", "rational.ectemplate", "--work-area", "--out", output.to_str().unwrap(), "--format", "png", "--resolution", "0.05"]);
+    ok(dir, &["render", "--template", "rational.ectemplate", "--work-area", "--out", output.to_str().unwrap(), "--format", "png", "--resolution", "0.05"]);
     let count = std::fs::read_dir(dir.join("rational-work-area"))
         .unwrap()
         .filter_map(Result::ok)
@@ -222,8 +233,8 @@ fn essential_graphics_template_via_script_and_commands() {
     assert_eq!(count, 4, "the template's exact work area contains frames 3 through 6");
     assert_eq!(std::fs::read(dir.join("rational.ectemplate")).unwrap(), rational_template);
     assert_eq!(std::fs::read(dir.join("lt.ectemplate")).unwrap(), original_template);
-    let _ = std::fs::remove_dir_all(&dir);
 }
+
 fn template_output_alias_fixture(case: &str) -> PathBuf {
     let dir = std::env::temp_dir().join(format!("ec-qa-template-output-{case}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
@@ -251,7 +262,7 @@ fn assert_template_output_preserves_inputs(dir: &PathBuf, out: &str) -> Value {
     let template_before = std::fs::read(dir.join("lt.ectemplate")).unwrap();
     let values_before = std::fs::read(dir.join("values.json")).unwrap();
     // Read the inputs before interpreting the subprocess status or error text.
-    let result = Command::new(env!("CARGO_BIN_EXE_effectcraft-cli"))
+    let result = Command::new(crate::binary())
         .current_dir(dir)
         .args(["render-frame", "--template", "lt.ectemplate", "--values", "values.json", "--time", "1", "--out", out, "--json"])
         .output()
@@ -527,7 +538,7 @@ fn template_unknown_control_does_not_replace_extracted_media() {
     let invalid_values_before = std::fs::read(dir.join("bad-values.json")).unwrap();
 
     // Capture every file before interpreting status/JSON, so a failed command cannot hide a write.
-    let result = Command::new(env!("CARGO_BIN_EXE_effectcraft-cli"))
+    let result = Command::new(crate::binary())
         .current_dir(&dir)
         .args(["render-frame", "--template", "lt.ectemplate", "--values", "bad-values.json", "--time", "1", "--out", "failed.png", "--json"])
         .output()
@@ -623,11 +634,8 @@ fn template_missing_output_does_not_replace_extracted_media() {
     assert_ne!(sentinel_before, source_before);
 
     // Observe writes before interpreting the actual CLI usage exit.
-    let result = Command::new(env!("CARGO_BIN_EXE_effectcraft-cli"))
-        .current_dir(&dir)
-        .args(["render", "--template", "lt.ectemplate", "--values", "values.json", "--json"])
-        .output()
-        .unwrap();
+    let result =
+        Command::new(crate::binary()).current_dir(&dir).args(["render", "--template", "lt.ectemplate", "--values", "values.json", "--json"]).output().unwrap();
     let template_after = std::fs::read(dir.join("lt.ectemplate")).unwrap();
     let values_after = std::fs::read(dir.join("values.json")).unwrap();
     let source_after = std::fs::read(dir.join("source.png")).unwrap();
@@ -767,3 +775,45 @@ fn template_media_control_reports_a_path_that_cannot_be_imported() {
     assert!(!dir.join("missing-out.png").exists(), "{reply}");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// Renders with `--template` name their outputs after the template's composition (#1937), not
+/// the numbered name a duplicate would get. The name ends in a number and differs from the
+/// archive's file name; an expression that looks the composition up by that name still finds it.
+#[test]
+fn template_render_outputs_keep_the_template_composition_name() {
+    let dir = std::env::temp_dir().join(format!("ec-qa-template-comp-name-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let build = BUILD.replace(r#"addComp("Lower Third""#, r#"addComp("Title Card 2""#).replace(
+        "var fill =",
+        "bar.property(\"ADBE Transform Group\").property(\"ADBE Position\").expression = '[comp(\"Title Card 2\").numLayers * 80, 65]';\nvar fill =",
+    );
+    std::fs::write(dir.join("build.jsx"), build).unwrap();
+    let built = ok(&dir, &["script", "build.jsx", "--save-as", "t.ecproj"]);
+    assert_eq!(built["output"], "controls: 3", "{built}");
+    ok(&dir, &["exec", "essential.exportTemplate", r#"{"comp":"Title Card 2","path":"card.ectemplate"}"#, "t.ecproj"]);
+    let template_before = std::fs::read(dir.join("card.ectemplate")).unwrap();
+    std::fs::write(dir.join("values.json"), r#"{"Title":"John Smith"}"#).unwrap();
+
+    for (case, values) in [("defaults", None), ("values", Some("values.json"))] {
+        let out = dir.join(case).join("[compName]_[#####].png");
+        let mut args =
+            vec!["render", "--template", "card.ectemplate", "--out", out.to_str().unwrap(), "--format", "png", "--start", "1", "--end", "1.0833333333333333"];
+        if let Some(values) = values {
+            args.extend(["--values", values]);
+        }
+        let rendered = ok(&dir, &args);
+        let rendered = rendered["rendered"].as_array().unwrap();
+        assert_eq!(rendered.len(), 1, "{case}: {rendered:?}");
+        assert_eq!(rendered[0]["comp"], "Title Card 2", "{case}: {rendered:?}");
+        let frames: Vec<_> = std::fs::read_dir(dir.join(case)).unwrap().map(|entry| entry.unwrap().file_name().to_string_lossy().into_owned()).collect();
+        assert_eq!(frames.len(), 1, "{case}: {frames:?}");
+        assert!(frames[0].starts_with("Title Card 2_") && frames[0].ends_with(".png"), "{case}: {frames:?}");
+        // The template's own two layers place the bar; the one-layer wrapper would move it left.
+        let frame = image::open(dir.join(case).join(&frames[0])).unwrap().to_rgba8();
+        let bar = frame.get_pixel(300, 75).0;
+        assert!(bar[0] > 240 && bar[1] < 15, "{case}: comp(\"Title Card 2\") is the template's composition: {bar:?}");
+    }
+    assert_eq!(std::fs::read(dir.join("card.ectemplate")).unwrap(), template_before);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/apps/effectcraft-web/Cargo.toml b/apps/effectcraft-web/Cargo.toml
index 6c30f9a56..7743347af 100644
--- a/apps/effectcraft-web/Cargo.toml
+++ b/apps/effectcraft-web/Cargo.toml
@@ -37,6 +37,8 @@ js-sys = "0.3"
 web-sys = { version = "0.3", features = [
     "Blob",
     "BlobPropertyBag",
+    "AbortController",
+    "AbortSignal",
     "CssStyleDeclaration",
     "Document",
     "Element",
@@ -50,6 +52,13 @@ web-sys = { version = "0.3", features = [
     "HtmlElement",
     "HtmlInputElement",
     "Location",
+    "Navigator",
+    "ReadableStream",
+    "ReadableStreamDefaultReader",
+    "Request",
+    "RequestCache",
+    "RequestInit",
+    "Response",
     "Url",
     "UrlSearchParams",
     "Window",
diff --git a/apps/effectcraft-web/js/host.js b/apps/effectcraft-web/js/host.js
index 5c438550e..c8e91a260 100644
--- a/apps/effectcraft-web/js/host.js
+++ b/apps/effectcraft-web/js/host.js
@@ -7,6 +7,23 @@
 //
 // Plain functions only: the Rust side owns the logic.
 
+// ------------------------------------------------------------------ shortcuts
+
+/// Keep Duplicate on the app canvas instead of also opening the browser's bookmarks.
+/// The physical D key counts on layouts where it types no ASCII letter (e.g. Cyrillic), because
+/// eframe falls back to the key code there; it does not on Dvorak, where it types E.
+/// eframe still receives the key; other chords and HTML inputs keep their browser behavior.
+export function installCanvasShortcuts(canvas) {
+  canvas.addEventListener("keydown", (event) => {
+    if (event.target === canvas && (event.ctrlKey || event.metaKey)
+      && !event.shiftKey && !event.altKey && !event.isComposing
+      && (event.key.toLowerCase() === "d"
+        || (event.code === "KeyD" && !/^[a-z]$/i.test(event.key)))) {
+      event.preventDefault();
+    }
+  }, { capture: true });
+}
+
 // ------------------------------------------------------------------ storage
 
 const DIR = "effectcraft";
@@ -19,7 +36,7 @@ const enc = (k) => encodeURIComponent(k);
 const dec = (n) => decodeURIComponent(n);
 
 async function opfs() {
-  if (!navigator.storage || !navigator.storage.getDirectory) throw new Error("no OPFS");
+  if (!navigator.storage?.getDirectory) throw new Error("no OPFS");
   const root = await navigator.storage.getDirectory();
   const dir = await root.getDirectoryHandle(DIR, { create: true });
   // Probe a write: some browsers expose OPFS but only write it from workers.
@@ -116,7 +133,7 @@ export async function storeOpen(prefer) {
     try { backend = await make(); break; } catch (e) { console.info(`storage: ${make.name}: ${e.message ?? e}`); }
   }
   // Ask the browser not to evict the store under storage pressure (granted for installed apps).
-  try { if (navigator.storage && navigator.storage.persist) await navigator.storage.persist(); } catch {}
+  try { if (navigator.storage?.persist) await navigator.storage.persist(); } catch {}
   return backend.name;
 }
 
@@ -128,7 +145,7 @@ export async function storeDelete(key) { return backend.del(key); }
 /// Ask the browser to keep the origin's storage under pressure; resolves with whether it is.
 export async function storePersist() {
   try {
-    if (navigator.storage && navigator.storage.persist) return await navigator.storage.persist();
+    if (navigator.storage?.persist) return await navigator.storage.persist();
   } catch {}
   return false;
 }
@@ -227,7 +244,7 @@ export async function audioStart(workletUrl) {
       }
       if (gen !== generation) return;
       node = new AudioWorkletNode(c, "effectcraft-output", { numberOfInputs: 0, outputChannelCount: [2] });
-      node.port.onmessage = (e) => { if (e.data && e.data.underrun) underruns += e.data.underrun; };
+      node.port.onmessage = (e) => { if (e.data?.underrun) underruns += e.data.underrun; };
       kind = "worklet";
     } catch (e) {
       console.warn("audio: AudioWorklet unavailable, using ScriptProcessorNode", e);
@@ -318,11 +335,11 @@ function spawn(base) {
   const w = { worker, files: new Map(), ready: null, gpu: null };
   w.ready = new Promise((res, rej) => {
     worker.onmessage = (e) => {
-      if (e.data && e.data.type === "gpu") {
+      if (e.data?.type === "gpu") {
         w.gpu = e.data.gpu ? { adapter: e.data.gpu } : { cpu: e.data.error || "no GPU" };
         jobGpu = w.gpu;
       }
-      if (e.data && e.data.type === "ready") res();
+      if (e.data?.type === "ready") res();
     };
     worker.onerror = (e) => rej(new Error(e.message || "worker failed to start"));
   });
@@ -341,7 +358,7 @@ export function workerRun(id, json, files, base, onMessage) {
   } catch (e) {
     // `new Worker` throws at once when the page's origin is opaque (a sandboxed iframe): the job
     // fails like one whose worker didn't start.
-    setTimeout(() => onMessage("error", String((e && e.message) || e), null, null));
+    setTimeout(() => onMessage("error", String(e?.message || e), null, null));
     return;
   }
   running.set(id, w);
@@ -416,12 +433,12 @@ export function frameWorkerStart(base, onMessage, gpu) {
     // slot stays, and the failure is reported like a worker that died, after the caller has
     // recorded the index: frames then render on the page's thread (as with `?noworkers`).
     frameWorkers.push(null);
-    setTimeout(() => onMessage(index, undefined, undefined, String((e && e.message) || e || "frame worker failed")));
+    setTimeout(() => onMessage(index, undefined, undefined, String(e?.message || e || "frame worker failed")));
     return index;
   }
   worker.onmessage = (e) => {
     const m = e.data;
-    if (m && m.type === "frameReply") onMessage(index, m.json, m.bytes ? new Uint8Array(m.bytes) : null, undefined);
+    if (m?.type === "frameReply") onMessage(index, m.json, m.bytes ? new Uint8Array(m.bytes) : null, undefined);
   };
   worker.onerror = (e) => {
     onMessage(index, undefined, undefined, String(e.message || "frame worker failed"));
@@ -447,7 +464,7 @@ const cacheDirHandles = {};
 
 async function cacheDir(kind = "frames") {
   if (cacheDirHandles[kind]) return cacheDirHandles[kind];
-  if (!navigator.storage || !navigator.storage.getDirectory) throw new Error("no Origin Private File System");
+  if (!navigator.storage?.getDirectory) throw new Error("no Origin Private File System");
   let d = await navigator.storage.getDirectory();
   for (const n of [CACHE_ROOT, "v1", kind]) d = await d.getDirectoryHandle(n, { create: true });
   cacheDirHandles[kind] = d;
@@ -494,8 +511,12 @@ export async function cacheRead(name) {
 /// resolves with its size.
 export async function cacheWrite(fullName, bytes) {
   const [dir, name] = await entryDir(fullName);
-  const canMove = typeof FileSystemHandle !== "undefined" && "move" in FileSystemHandle.prototype;
-  const tmp = canMove ? `${name}.tmp.${Math.random().toString(36).slice(2)}` : name;
+  const canMove =
+    typeof FileSystemHandle !== "undefined" &&
+    "move" in FileSystemHandle.prototype &&
+    typeof crypto !== "undefined" &&
+    typeof crypto.randomUUID === "function";
+  const tmp = canMove ? `${name}.tmp.${crypto.randomUUID()}` : name;
   const fh = await dir.getFileHandle(tmp, { create: true });
   if (fh.createSyncAccessHandle) {
     const h = await fh.createSyncAccessHandle();
@@ -540,7 +561,7 @@ export async function cacheClear() {
 
 /// Whether this thread has WebGPU (`navigator.gpu`).
 export function hasWebGpu() {
-  return !!(self.navigator && self.navigator.gpu);
+  return !!self.navigator?.gpu;
 }
 
 /// Post a message ({type: "frame", json} or {type: "file", path, bytes}) to frame worker `index`.
@@ -648,7 +669,7 @@ export async function browseForget(name) {
 export async function browseRead(path) {
   const rel = path.replace(/^\/Folders\//, "");
   const folder = folders.get(rel.split("/")[0]);
-  const h = folder && folder.files.get(rel);
+  const h = folder?.files.get(rel);
   if (!h) throw new Error(`${path}: its folder is not open (reconnect it)`);
   return new Uint8Array(await (await h.getFile()).arrayBuffer());
 }
@@ -702,7 +723,7 @@ export function showDeviceLost(message, kept) {
     self.effectcraft
       .execute("file.save", {})
       .catch(() => self.effectcraft.execute("file.saveAs", { path: "/Untitled Project.ecproj" }))
-      .catch((e) => (text.textContent = `Saving failed: ${(e && e.message) || e}`));
+      .catch((e) => (text.textContent = `Saving failed: ${e?.message || e}`));
   const reload = document.createElement("button");
   reload.textContent = "Reload";
   reload.onclick = async () => {
@@ -710,7 +731,7 @@ export function showDeviceLost(message, kept) {
     try {
       await self.effectcraft.flush();
     } catch (e) {
-      text.textContent = `Writing to browser storage failed (${(e && e.message) || e}). Save the project, or reload anyway and lose the changes.`;
+      text.textContent = `Writing to browser storage failed (${e?.message || e}). Save the project, or reload anyway and lose the changes.`;
       reload.textContent = "Reload Anyway";
       reload.disabled = false;
       reload.onclick = () => location.reload();
diff --git a/apps/effectcraft-web/src/app.rs b/apps/effectcraft-web/src/app.rs
index 1a6952408..99e71117f 100644
--- a/apps/effectcraft-web/src/app.rs
+++ b/apps/effectcraft-web/src/app.rs
@@ -6,7 +6,8 @@ use std::sync::atomic::{AtomicBool, Ordering};
 
 use effectcraft_engine::Session;
 
-use crate::{api, audio, browse, diskcache, files, frames, persist, storage, worker};
+use crate::startup::Startup;
+use crate::{api, audio, browse, config_file, diskcache, files, frames, persist, storage, worker};
 use effectcraft_ui_egui::EffectcraftApp;
 use serde_json::json;
 use wasm_bindgen::prelude::*;
@@ -15,6 +16,8 @@ use wasm_bindgen::prelude::*;
 extern "C" {
     #[wasm_bindgen(js_name = showDeviceLost)]
     fn show_device_lost(message: &str, kept: bool);
+    #[wasm_bindgen(js_name = installCanvasShortcuts)]
+    fn install_canvas_shortcuts(canvas: &web_sys::HtmlCanvasElement);
 }
 
 /// Work for the UI thread with access to the app (posted by async tasks: picked files…).
@@ -81,32 +84,60 @@ pub(crate) fn open_or_import(app: &mut EffectcraftApp, paths: Vec<String>) {
 /// The eframe app: the shared EffectCraft UI plus the browser host's per-frame duties.
 pub struct WebApp {
     pub app: EffectcraftApp,
-    /// Keep the session snapshot (off with `?empty`).
+    /// Keep the session snapshot (off with `?empty`; off with an explicit `"demo"` startup until
+    /// the user's own work begins, see `demo_start`).
     pub persist: bool,
+    /// Started on the demo by the config: the snapshot stays off, so the demo never replaces the
+    /// last visit's project, until the user opens a project from a file or edits the demo.
+    pub demo_start: bool,
+    /// The last title written to `document.title`.
+    pub document_title: String,
 }
 
 impl eframe::App for WebApp {
+    /// Take dropped files out of `raw_input` before eframe can replay them on a hidden tab, read them asynchronously
+    /// through `open_or_import`, then run the shared app's input hook.
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
+        // Files dropped on the page are input: read them here, where the browser's drop event is
+        // still the current pass's, not from a later (possibly logic-only) tick.
+        //
+        // The list is *taken* out of the raw input: a hidden tab runs `logic` and eframe appends
+        // the same prepared raw input back for the next pass, so leaving the files there would
+        // import them again on every hidden logic tick.
+        let dropped_files = std::mem::take(&mut raw_input.dropped_files);
+        let dropped: Vec<web_sys::File> = dropped_files.iter().filter_map(|f| f.web_file().cloned()).collect();
+        if !dropped.is_empty() {
+            files::read_files(dropped, |paths| post(move |app| open_or_import(app, paths)));
+        }
         self.app.raw_input_hook(ctx, raw_input);
     }
 
+    /// The browser host's logic tick: run queued UI actions, tick the shared app, poll API replies, flush Render
+    /// Queue downloads, persist the session snapshot when enabled, publish GPU/frame-worker/disk-cache info and close
+    /// the IME pass.
     fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
         let actions = ACTIONS.with(|a| std::mem::take(&mut *a.borrow_mut()));
         for f in actions {
             f(&mut self.app);
         }
-        // Files dropped on the page: read them, then open/import.
-        let dropped: Vec<web_sys::File> = ctx.input(|i| i.raw.dropped_files.iter().filter_map(|f| f.web_file().cloned()).collect());
-        if !dropped.is_empty() {
-            files::read_files(dropped, |paths| post(move |app| open_or_import(app, paths)));
+        self.app.tick(ctx, frame);
+        // eframe on the web ignores `ViewportCommand::Title`: the tab title follows the open document here.
+        if self.app.window_title() != self.document_title {
+            self.document_title = self.app.window_title().to_owned();
+            set_document_title(&self.document_title);
         }
-        self.app.logic(ctx, frame);
         api::poll_replies();
         // Render Queue outputs written this frame (here or by a worker) → downloads.
         files::flush_downloads();
+        // The user's own work after a demo start is worth keeping too: turn the snapshot on.
+        if self.demo_start && (self.app.session.path.is_some() || self.app.session.is_dirty()) {
+            self.demo_start = false;
+            self.persist = true;
+        }
         // What a reload comes back to.
         if self.persist {
-            persist::snapshot(&self.app.session, ctx.input(|i| i.time), 1.0);
+            // The app's monotonic clock: `ctx.input(|i| i.time)` is stale in a logic-only tick.
+            persist::snapshot(&self.app.session, self.app.now(), 1.0);
         }
         api::set_info("gpu", json!({"compositor": self.app.gpu_adapter(), "viewerOnGpu": self.app.viewer_on_gpu()}));
         api::set_info("frameWorkers", frames::stats());
@@ -114,6 +145,7 @@ impl eframe::App for WebApp {
         let d = &self.app.session.prefs.disk;
         diskcache::configure(d.disk_cache_enabled, d.disk_cache_max_gb, storage::quota());
         api::set_info("diskCache", diskcache::stats());
+        self.app.finish_ime_logic(ctx);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
@@ -121,6 +153,13 @@ impl eframe::App for WebApp {
     }
 }
 
+/// The browser tab's title.
+fn set_document_title(title: &str) {
+    if let Some(doc) = web_sys::window().and_then(|w| w.document()) {
+        doc.set_title(title);
+    }
+}
+
 fn query() -> Option<web_sys::UrlSearchParams> {
     web_sys::window().and_then(|w| w.location().search().ok()).and_then(|s| web_sys::UrlSearchParams::new_with_str(&s).ok())
 }
@@ -174,8 +213,24 @@ fn install_hooks(app: &mut EffectcraftApp) {
         }
         None
     }));
-    // Saving downloads the file: the chosen name is all a "save dialog" needs.
-    app.hooks.pick_save = Some(Box::new(|name: &str| Some(files::path_for(if name.is_empty() { "Untitled Project.ecproj" } else { name }))));
+    // Saving downloads the file: the chosen name is all a "save dialog" needs. A project (Save As,
+    // Save a Copy) asks for the name, starting from the open project's (#2788): without asking,
+    // Save As would replace the open project's file; Cancel cancels. A name that is already in
+    // browser storage asks before replacing it, as the desktop's save dialogs do.
+    app.hooks.pick_save = Some(Box::new(|name: &str| {
+        let name = if name.is_empty() { "Untitled Project.ecproj" } else { name };
+        if !std::path::Path::new(name).extension().is_some_and(|e| e.eq_ignore_ascii_case("ecproj") || e.eq_ignore_ascii_case("ecprojx")) {
+            return Some(files::path_for(name));
+        }
+        let window = web_sys::window()?;
+        let typed = window.prompt_with_message_and_default("Save project as:", name).ok().flatten();
+        let typed = crate::store::typed_save_name(name, typed)?;
+        let path = files::path_for(&typed);
+        if files::get(&path).is_some() && !window.confirm_with_message(&format!("{typed} already exists. Replace it?")).unwrap_or(false) {
+            return None;
+        }
+        Some(path)
+    }));
     app.hooks.audio_device = Some(Box::new(audio::open));
     app.hooks.audio_devices = Some(Box::new(|| vec!["Browser default output".into()]));
 }
@@ -184,13 +239,21 @@ fn install_hooks(app: &mut EffectcraftApp) {
 #[wasm_bindgen]
 pub async fn start(canvas_id: String) -> Result<(), JsValue> {
     eframe::WebLogger::init(log::LevelFilter::Info).ok();
+    // Match System follows `?lang=` in the address, then the browser's languages; a language
+    // chosen in Settings still wins.
+    let navigator = web_sys::window().map(|w| w.navigator());
+    let browser = navigator.iter().flat_map(|n| n.languages().iter().filter_map(|v| v.as_string()).collect::<Vec<_>>());
+    effectcraft_ui_egui::i18n::set_system_locales(query_value("lang"), browser.collect());
     let doc = web_sys::window().and_then(|w| w.document()).ok_or("no document")?;
     let canvas: web_sys::HtmlCanvasElement = doc.get_element_by_id(&canvas_id).ok_or("no canvas")?.dyn_into()?;
+    install_canvas_shortcuts(&canvas);
     let empty = query_flag("empty");
     let home = query_flag("home");
     // Browser storage: settings, recent projects, imported media, saved projects, auto-saves and
     // the last session come back.
-    let t0 = js_sys::Date::now();
+    // Monotonic (performance.now) rather than the wall clock: a system-time jump must not turn
+    // the storage-load report negative or huge.
+    let t0 = web_time::Instant::now();
     let stored = match persist::load(&query_value("storage").unwrap_or_default()).await {
         Ok(n) => n,
         Err(e) => {
@@ -198,8 +261,13 @@ pub async fn start(canvas_id: String) -> Result<(), JsValue> {
             0
         }
     };
-    api::set_info("storage", json!({"backend": persist::backend(), "entries": stored, "loadMs": js_sys::Date::now() - t0}));
+    api::set_info("storage", json!({"backend": persist::backend(), "entries": stored, "loadMs": t0.elapsed().as_secs_f64() * 1000.0}));
     audio::install_unlock();
+    // `./effectcraft-config.json`: what to open on load.
+    // `?empty` and `?demo` decide by themselves, so they skip the request.
+    let startup = if empty || query_flag("demo") { Startup::default() } else { config_file::startup().await };
+    // An explicit `"demo"` start leaves the saved session alone until the user opens or edits something.
+    let keep_session = !empty && startup.keeps_session();
     browse::restore();
     diskcache::init();
     storage::refresh();
@@ -209,6 +277,7 @@ pub async fn start(canvas_id: String) -> Result<(), JsValue> {
             canvas,
             eframe::WebOptions::default(),
             Box::new(move |cc| {
+                EffectcraftApp::install_ime_reset_hooks(&cc.egui_ctx);
                 CTX.with(|c| *c.borrow_mut() = Some(cc.egui_ctx.clone()));
                 // The page owns this shared presentation device; worker devices retain their
                 // separate owned-device handlers. No browser error-scope future is blocked on.
@@ -224,7 +293,7 @@ pub async fn start(canvas_id: String) -> Result<(), JsValue> {
                     // The canvas can't present any more (#225): the page says so over it and
                     // offers a reload, which brings the session back when browser storage keeps it.
                     let lost = gpu_failures.clone();
-                    let kept = !empty && persist::backend() != "memory";
+                    let kept = keep_session && persist::backend() != "memory";
                     rs.device.set_device_lost_callback(move |reason, message| {
                         let message = format!("GPU device lost ({reason:?}): {message}");
                         lost.report(&message, true);
@@ -233,11 +302,14 @@ pub async fn start(canvas_id: String) -> Result<(), JsValue> {
                 }
                 let mut session = session();
                 session.load_settings();
+                // Scripts in Scripts/Startup run before a project opens.
+                let _ = session.execute("file.runStartupScripts", json!({}));
                 let recovery = session.begin_recovery();
-                // `?empty`: a blank project; `?demo`: the demo project; otherwise the last visit's
-                // project (the demo on a first visit).
-                let restored = !empty && !query_flag("demo") && persist::restore(&mut session);
-                if !restored && !empty {
+                // `?empty`: a blank project; `?demo`: the demo project; otherwise what the config's
+                // `startup` says (default: the last visit's project, the demo on a first visit).
+                let demo = query_flag("demo");
+                let restored = !empty && !demo && startup.restores() && persist::restore(&mut session);
+                if !restored && !empty && (demo || startup.demo_when_nothing_restored()) {
                     let _ = session.execute("file.openDemoProject", json!({}));
                 }
                 api::set_info("restored", json!(restored));
@@ -257,12 +329,13 @@ pub async fn start(canvas_id: String) -> Result<(), JsValue> {
                 if n > 0 {
                     app.frames.set_remote(Some(Arc::new(frames::WebFrames::start(n, !query_flag("nogpuworkers")))));
                 }
+                app.frames.set_virtual_id(Arc::new(|path| files::STORE.file_identity(path)));
                 let (tx, rx) = std::sync::mpsc::channel();
                 api::set_sender(tx);
                 app = app.with_control(rx);
                 let backend = cc.wgpu_render_state.as_ref().map(|rs| format!("{:?}", rs.adapter.get_info().backend));
                 api::set_info("backend", json!(backend));
-                Ok(Box::new(WebApp { app, persist: !empty }))
+                Ok(Box::new(WebApp { app, persist: keep_session, demo_start: !empty && !keep_session, document_title: String::new() }))
             }),
         )
         .await?;
diff --git a/apps/effectcraft-web/src/browse.rs b/apps/effectcraft-web/src/browse.rs
index ad7500fea..2fd680dcb 100644
--- a/apps/effectcraft-web/src/browse.rs
+++ b/apps/effectcraft-web/src/browse.rs
@@ -52,7 +52,7 @@ struct State {
 static STATE: LazyLock<Mutex<State>> = LazyLock::new(Mutex::default);
 
 fn state() -> std::sync::MutexGuard<'static, State> {
-    STATE.lock().unwrap_or_else(|e| e.into_inner())
+    STATE.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }
 
 /// The web app's Media Browser.
diff --git a/apps/effectcraft-web/src/config_file.rs b/apps/effectcraft-web/src/config_file.rs
new file mode 100644
index 000000000..614d7d4cb
--- /dev/null
+++ b/apps/effectcraft-web/src/config_file.rs
@@ -0,0 +1,73 @@
+//! `./effectcraft-config.json`, fetched once per page load and shared by whoever reads a key.
+
+use std::cell::RefCell;
+
+use wasm_bindgen::{JsCast, closure::Closure};
+use wasm_bindgen_futures::JsFuture;
+
+use crate::startup::{self, Startup};
+
+/// Longest the request and the body read may take (ms); a stalled server must not hold up start-up.
+const TIMEOUT_MS: i32 = 5_000;
+
+thread_local! {
+    /// `None`: not fetched yet; `Some(None)`: no usable file.
+    static FILE: RefCell<Option<Option<Vec<u8>>>> = const { RefCell::new(None) };
+}
+
+/// The config file's bytes, or `None` when it is missing, too large, unreadable or the request
+/// takes longer than [`TIMEOUT_MS`] (the timer aborts the request and covers the body read).
+async fn fetch() -> Option<Vec<u8>> {
+    let win = web_sys::window()?;
+    let ctl = web_sys::AbortController::new().ok()?;
+    let init = web_sys::RequestInit::new();
+    // Always ask the server: the file is the operator's switch, never a cached copy.
+    init.set_cache(web_sys::RequestCache::NoCache);
+    init.set_signal(Some(&ctl.signal()));
+    let on_timeout = Closure::once(move || ctl.abort());
+    let timer = win.set_timeout_with_callback_and_timeout_and_arguments_0(on_timeout.as_ref().unchecked_ref(), TIMEOUT_MS).ok()?;
+    let out = read(&win, &init).await;
+    win.clear_timeout_with_handle(timer);
+    out
+}
+
+/// Fetch the file and read its body chunk by chunk, giving up as soon as it passes `CONFIG_MAX`.
+async fn read(win: &web_sys::Window, init: &web_sys::RequestInit) -> Option<Vec<u8>> {
+    let req = web_sys::Request::new_with_str_and_init("effectcraft-config.json", init).ok()?;
+    let resp: web_sys::Response = JsFuture::from(win.fetch_with_request(&req)).await.ok()?.dyn_into().ok()?;
+    if resp.status() != 200 {
+        return None;
+    }
+    let reader: web_sys::ReadableStreamDefaultReader = resp.body()?.get_reader().unchecked_into();
+    let mut out = Vec::new();
+    loop {
+        let chunk = JsFuture::from(reader.read()).await.ok()?;
+        if js_sys::Reflect::get(&chunk, &"done".into()).ok()?.as_bool() == Some(true) {
+            return Some(out);
+        }
+        let bytes: js_sys::Uint8Array = js_sys::Reflect::get(&chunk, &"value".into()).ok()?.dyn_into().ok()?;
+        if out.len().saturating_add(bytes.length() as usize) > startup::CONFIG_MAX {
+            // Stop the download: the limit is enforced while reading, not after the whole body arrived.
+            let _ = reader.cancel();
+            return None;
+        }
+        out.extend_from_slice(&bytes.to_vec());
+    }
+}
+
+/// The config file's bytes (`None` when there is none), fetched on the first call.
+pub async fn bytes() -> Option<Vec<u8>> {
+    if let Some(done) = FILE.with(|f| f.borrow().clone()) {
+        return done;
+    }
+    let got = fetch().await;
+    FILE.with(|f| *f.borrow_mut() = Some(got.clone()));
+    got
+}
+
+/// The configured startup behaviour.
+pub async fn startup() -> Startup {
+    let s = bytes().await.map(|b| startup::parse(&b)).unwrap_or_default();
+    log::info!("startup: {s:?}");
+    s
+}
diff --git a/apps/effectcraft-web/src/diskcache.rs b/apps/effectcraft-web/src/diskcache.rs
index ef9d46f8c..72e9a9e11 100644
--- a/apps/effectcraft-web/src/diskcache.rs
+++ b/apps/effectcraft-web/src/diskcache.rs
@@ -4,23 +4,28 @@
 //!
 //! - **Writes** happen in the frame workers: a render request carries the frame's disk-cache key
 //!   (`effectcraft_engine::remote::FrameMsg::Render`), the worker posts the frame, then writes
-//!   the sealed entry (`disk_cache::frame_entry`: LZ4, checksum) with a synchronous access
-//!   handle into a temporary file moved into place (`js/host.js` `cacheWrite`), and reports
-//!   `FrameReply::Stored`.
+//!   the sealed entry (`disk_cache::frame_entry`: the source files the frame read, LZ4,
+//!   checksum) with a synchronous access handle into a temporary file moved into place
+//!   (`js/host.js` `cacheWrite`), and reports `FrameReply::Stored`. A frame whose files can't
+//!   all be named is not stored.
 //! - **The index** lives here, on the page ([`DiskIndex`], shared with the desktop's cache):
 //!   rebuilt at startup from the folder listing (oldest files first), updated by the workers'
 //!   `Stored` replies and by reads; eviction deletes the least recently used files.
 //! - **Reads** are asynchronous: a frame whose key is indexed is read and decoded here instead
-//!   of rendering it (`crate::frames`); a damaged or missing file is a miss and is forgotten.
+//!   of rendering it (`crate::frames`), if the files its entry lists still have the size and
+//!   content hash it was made of (the file table's identities); a damaged or missing entry, or
+//!   one whose files changed, is a miss and is deleted.
 //!
 //! - **Layer buffers** too (`layers/<32 hex>.ecc`): a layer lookup happens in the middle of a
 //!   synchronous render, where the browser's file system can't be read, so the frame workers
 //!   back their layer caches with a `PrefetchStore`. They report each frame's layer-cache
 //!   misses; before the next request the page names the recent misses that are on disk
 //!   ([`layer_prefetch`], `disk_cache::LayerPrefetch`), and the worker reads those entries
-//!   into memory before rendering, so the lookups find them. Slow buffers are written by the
-//!   worker after its frame and indexed here like frames (one least-recently-used order for
-//!   both kinds).
+//!   into memory before rendering, so the lookups find them; an entry is used only while the
+//!   files it lists (the file table's size and content hash) are unchanged, and a buffer whose
+//!   files can't all be named is not written (#3184). Slow buffers are written by the worker
+//!   after its frame and indexed here like frames (one least-recently-used order for both
+//!   kinds).
 
 use std::cell::RefCell;
 
@@ -187,11 +192,12 @@ pub fn note_miss() {
 }
 
 /// Read and decode a cached frame; `None` (forgotten and deleted) when the file is missing or
-/// damaged.
+/// damaged, or the source files it was made of changed since.
 pub async fn read(key: u128) -> Option<disk_cache::Frame8> {
     let name = disk_cache::entry_name(key);
     let bytes = JsFuture::from(cache_read(&name)).await.ok().and_then(|b| b.dyn_into::<js_sys::Uint8Array>().ok()).map(|b| b.to_vec());
-    let frame = bytes.as_deref().and_then(disk_cache::read_frame_entry);
+    let identity = |path: &str| crate::files::STORE.file_identity(path);
+    let frame = bytes.as_deref().and_then(|b| disk_cache::read_frame_entry(b, Some(&identity)));
     ST.with(|s| {
         let mut s = s.borrow_mut();
         if frame.is_some() {
diff --git a/apps/effectcraft-web/src/files.rs b/apps/effectcraft-web/src/files.rs
index 3f3f3a99f..f6aac5aa4 100644
--- a/apps/effectcraft-web/src/files.rs
+++ b/apps/effectcraft-web/src/files.rs
@@ -48,14 +48,14 @@ pub fn list() -> Vec<(String, usize)> {
 
 /// The next write of `path` goes to browser storage only (no download).
 pub fn save_quietly(path: &str) {
-    QUIET.lock().unwrap_or_else(|e| e.into_inner()).push(path.to_string());
+    QUIET.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(path.to_string());
 }
 
 /// A rendered file (from the page's exporter or a worker): kept in the table unpersisted and
 /// downloaded at the next [`flush_downloads`].
 pub fn add_output(path: &str, data: Arc<[u8]>) {
     STORE.put_file(path, data, false);
-    OUTPUTS.lock().unwrap_or_else(|e| e.into_inner()).push(path.to_string());
+    OUTPUTS.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(path.to_string());
 }
 
 /// The table path for a picked/dropped file name.
@@ -120,7 +120,7 @@ impl Services for WebServices {
     fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
         put(path, data.into());
         let quiet = {
-            let mut q = QUIET.lock().unwrap_or_else(|e| e.into_inner());
+            let mut q = QUIET.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             let n = q.len();
             q.retain(|p| p != path);
             q.len() != n
@@ -151,6 +151,10 @@ impl Services for WebServices {
     fn is_dir(&self, _path: &str) -> bool {
         false
     }
+    /// The table's keys are the paths themselves.
+    fn full_path(&self, path: &str) -> Option<String> {
+        Some(path.to_string())
+    }
 }
 
 /// Media import from the table (the bytes are also handed to the media pool, which decodes them).
@@ -184,7 +188,7 @@ pub fn export_sink() -> Arc<effectcraft_export::Sink> {
 
 /// Download the render outputs written since the last call.
 pub fn flush_downloads() {
-    let paths = std::mem::take(&mut *OUTPUTS.lock().unwrap_or_else(|e| e.into_inner()));
+    let paths = std::mem::take(&mut *OUTPUTS.lock().unwrap_or_else(std::sync::PoisonError::into_inner));
     let mut out: Vec<(String, Arc<[u8]>)> = paths.into_iter().filter_map(|p| get(&p).map(|d| (file_name(&p).to_string(), d))).collect();
     out.sort_by(|a, b| a.0.cmp(&b.0));
     out.dedup_by(|a, b| a.0 == b.0);
diff --git a/apps/effectcraft-web/src/frames.rs b/apps/effectcraft-web/src/frames.rs
index 523fd03c8..0159fe23b 100644
--- a/apps/effectcraft-web/src/frames.rs
+++ b/apps/effectcraft-web/src/frames.rs
@@ -311,10 +311,11 @@ pub fn stats() -> Value {
     })
 }
 
+type PendingFrameCheck = (js_sys::Function, js_sys::Function, (u32, u32, Vec<u8>), f64);
+
 thread_local! {
     /// `workerFrameCheck` promises waiting for their frame: id → (resolve, reject, local frame).
-    #[allow(clippy::type_complexity)]
-    static CHECKS: RefCell<std::collections::HashMap<u64, (js_sys::Function, js_sys::Function, (u32, u32, Vec<u8>), f64)>> = RefCell::new(Default::default());
+    static CHECKS: RefCell<std::collections::HashMap<u64, PendingFrameCheck>> = RefCell::new(Default::default());
 }
 
 /// `effectcraft.workerFrameCheck({time?, scale?, backend?})`: render the active comp's frame in
@@ -416,6 +417,7 @@ fn post_reply(r: &FrameReply, px: Option<&[u8]>) {
 fn new_server() -> FrameServer {
     let mut s = FrameServer::new(crate::worker::pool(), Some(Arc::new(effectcraft_expr::Expressions)));
     s.set_layer_store(Some(Arc::new(effectcraft_engine::render::PrefetchStore::default())));
+    s.set_virtual_id(Some(Arc::new(|path| crate::files::STORE.file_identity(path))));
     s
 }
 
@@ -471,10 +473,13 @@ pub async fn worker_frame(json: String) {
         g.settled().await;
         replies = SERVER.with(|c| c.borrow_mut().as_mut().map(|s| s.resume()).unwrap_or_default());
     }
+    // The source files the frame read, kept with its entry (checked by the page before use); a
+    // frame whose files can't all be named is not stored (#3184).
+    let (files, virtual_id) = SERVER.with(|c| c.borrow_mut().as_mut().map(|s| (s.take_files(), s.virtual_id().cloned())).unwrap_or_default());
     for (r, px) in replies {
         post_reply(&r, px.as_deref());
-        if let (FrameReply::Frame { width, height, .. }, Some(px), Some(key)) = (&r, &px, &disk) {
-            let entry = effectcraft_engine::render::disk_cache::frame_entry(*width, *height, px);
+        if let (FrameReply::Frame { width, height, .. }, Some(px), Some(key), Some(files)) = (&r, &px, &disk, &files) {
+            let Some(entry) = effectcraft_engine::render::disk_cache::frame_entry(*width, *height, px, files, virtual_id.as_deref()) else { continue };
             let name = format!("{key}.ecc");
             match JsFuture::from(crate::diskcache::cache_write(&name, js_sys::Uint8Array::from(&entry[..]))).await {
                 Ok(n) => post_reply(&FrameReply::Stored { key: key.clone(), bytes: n.as_f64().unwrap_or(entry.len() as f64) as u64, layer: false }, None),
diff --git a/apps/effectcraft-web/src/lib.rs b/apps/effectcraft-web/src/lib.rs
index 0d59906f2..e1bf85894 100644
--- a/apps/effectcraft-web/src/lib.rs
+++ b/apps/effectcraft-web/src/lib.rs
@@ -6,22 +6,23 @@
 //!
 //! | Desktop | Web |
 //! |---|---|
-//! | file system (`FsServices`, media reads, export writes) | a virtual file table ([`files`]) persisted to the Origin Private File System / IndexedDB ([`persist`], [`store`]) |
+//! | file system (`FsServices`, media reads, export writes) | a virtual file table (`files`) persisted to the Origin Private File System / IndexedDB (`persist`, [`store`]) |
 //! | config directory (settings, shortcuts, recent projects, auto-saves) | the same store ([`store::WebConfig`]) |
 //! | rfd file dialogs | `<input type=file>` pickers; drop files on the page |
-//! | Media Browser on the file system | browser storage and folders opened with the File System Access API ([`browse`]) |
+//! | Media Browser on the file system | browser storage and folders opened with the File System Access API (`browse`) |
 //! | written files (Save, Render Queue) | browser downloads (several render files as one `.zip`) |
-//! | frame render threads | frame workers, each with a project replica fed by diffs and its own WebGPU device ([`frames`]); `Frames::pump` on the UI thread without workers |
-//! | disk cache folder | frames in the Origin Private File System, written by the frame workers ([`diskcache`]) |
-//! | (none) | the storage manager: usage, quota, persistence, clearing ([`storage`]) |
-//! | Render Queue / analysis threads | Web Workers running their own engine instance ([`worker`]) |
-//! | cpal audio output | Web Audio: an AudioWorklet fed from the preview mixdown ([`audio`]) |
-//! | TCP control channel / MCP | `window.effectcraft` JavaScript API ([`api`]) |
+//! | frame render threads | frame workers, each with a project replica fed by diffs and its own WebGPU device (`frames`); `Frames::pump` on the UI thread without workers |
+//! | disk cache folder | frames in the Origin Private File System, written by the frame workers (`diskcache`) |
+//! | (none) | the storage manager: usage, quota, persistence, clearing (`storage`) |
+//! | Render Queue / analysis threads | Web Workers running their own engine instance (`worker`) |
+//! | cpal audio output | Web Audio: an AudioWorklet fed from the preview mixdown (`audio`) |
+//! | TCP control channel / MCP | `window.effectcraft` JavaScript API (`api`) |
 //!
-//! [`store`] is portable (unit-tested natively); everything else is `wasm32`-only.
+//! [`store`] and [`startup`] are portable (unit-tested natively); everything else is `wasm32`-only.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+pub mod startup;
 pub mod store;
 
 #[cfg(target_arch = "wasm32")]
@@ -33,6 +34,8 @@ pub mod audio;
 #[cfg(target_arch = "wasm32")]
 pub mod browse;
 #[cfg(target_arch = "wasm32")]
+pub mod config_file;
+#[cfg(target_arch = "wasm32")]
 pub mod diskcache;
 #[cfg(target_arch = "wasm32")]
 pub mod files;
diff --git a/apps/effectcraft-web/src/startup.rs b/apps/effectcraft-web/src/startup.rs
new file mode 100644
index 000000000..4759096f3
--- /dev/null
+++ b/apps/effectcraft-web/src/startup.rs
@@ -0,0 +1,55 @@
+//! The `startup` key of `./effectcraft-config.json`: which project the page opens on load.
+//!
+//! | Value | On load |
+//! |---|---|
+//! | `"last"` (and absent) | the last visit's project; the demo project on a first visit |
+//! | `"empty"` | the last visit's project; a blank project on a first visit, never the demo |
+//! | `"demo"` | the demo project, whatever the last visit left |
+//!
+//! The `?empty` and `?demo` URL flags still win. Anything else (a missing key, another type, an
+//! unknown value, a config that is not JSON) is the default, `"last"`.
+
+use serde_json::Value;
+
+/// What the page opens on load.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Startup {
+    #[default]
+    Last,
+    Empty,
+    Demo,
+}
+
+/// The largest config file read (bytes).
+pub const CONFIG_MAX: usize = 64 * 1024;
+
+/// The `startup` key of a config file's bytes.
+pub fn parse(bytes: &[u8]) -> Startup {
+    if bytes.len() > CONFIG_MAX {
+        return Startup::default();
+    }
+    let Ok(v) = serde_json::from_slice::<Value>(bytes) else { return Startup::default() };
+    match v.get("startup").and_then(Value::as_str) {
+        Some("empty") => Startup::Empty,
+        Some("demo") => Startup::Demo,
+        _ => Startup::Last,
+    }
+}
+
+impl Startup {
+    /// Whether the last visit's project is restored (off for the demo).
+    pub fn restores(self) -> bool {
+        self != Startup::Demo
+    }
+
+    /// Whether the session snapshot keeps being saved (off for the demo, so it never replaces the
+    /// project the last visit left).
+    pub fn keeps_session(self) -> bool {
+        self != Startup::Demo
+    }
+
+    /// Whether the demo project opens when nothing was restored (off for a blank start).
+    pub fn demo_when_nothing_restored(self) -> bool {
+        self != Startup::Empty
+    }
+}
diff --git a/apps/effectcraft-web/src/store.rs b/apps/effectcraft-web/src/store.rs
index b3a858def..a4947600b 100644
--- a/apps/effectcraft-web/src/store.rs
+++ b/apps/effectcraft-web/src/store.rs
@@ -45,6 +45,8 @@ pub struct Entry {
     /// Which write this is: new with every write of the key, so a file replaced by another of
     /// the same size still reads as changed (workers are sent it again, #218).
     pub version: u64,
+    /// FNV-1a of `data`, filled the first time a disk-cache key asks for it.
+    hash: Option<u64>,
 }
 
 /// A queued write for the browser storage: `data` = `None` deletes the key.
@@ -69,13 +71,13 @@ impl Mirror {
     /// An entry read from the browser's storage at startup (nothing to flush).
     pub fn load(&mut self, key: &str, data: Arc<[u8]>, modified: f64) {
         let version = self.next_version();
-        self.entries.insert(key.to_string(), Entry { data, modified, persist: true, version });
+        self.entries.insert(key.to_string(), Entry { data, modified, persist: true, version, hash: None });
     }
 
     pub fn put(&mut self, key: &str, data: Arc<[u8]>, modified: f64, persist: bool) {
         let was_persisted = self.entries.get(key).is_some_and(|e| e.persist);
         let version = self.next_version();
-        self.entries.insert(key.to_string(), Entry { data, modified, persist, version });
+        self.entries.insert(key.to_string(), Entry { data, modified, persist, version, hash: None });
         if persist || was_persisted {
             self.touch(key);
         }
@@ -149,8 +151,35 @@ pub fn key_path(key: &str) -> Option<&str> {
     key.strip_prefix(FILES).filter(|p| p.starts_with('/'))
 }
 
+/// The project file name typed in the web's Save As prompt (#2788): `None` when it was cancelled or
+/// left empty; folders are dropped (the file table is flat) and a name without the default's
+/// extension gets it (`Intro copy` → `Intro copy.ecproj`, `Intro.v2` → `Intro.v2.ecproj`), so the
+/// browser still opens and keeps it as a project.
+pub fn typed_save_name(default: &str, typed: Option<String>) -> Option<String> {
+    let typed = typed?;
+    let name = typed.trim().rsplit(['/', '\\']).next().unwrap_or("").trim();
+    if name.is_empty() {
+        return None;
+    }
+    let ext = Path::new(default).extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
+    if ext.is_empty() || Path::new(name).extension().is_some_and(|e| e.eq_ignore_ascii_case(&ext)) {
+        Some(name.to_string())
+    } else {
+        Some(format!("{name}.{ext}"))
+    }
+}
+
+/// FNV-1a 64. Computed when a disk-cache key first needs the file, not on every write.
+fn content_hash(data: &[u8]) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for &b in data {
+        h ^= u64::from(b);
+        h = h.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    h
+}
+
 /// The persistent store: a [`Mirror`] and a hook that wakes the flusher after changes.
-#[derive(Default)]
 pub struct Store {
     pub mirror: Mutex<Mirror>,
     /// Called after every change that needs flushing (the web host schedules a flush).
@@ -159,9 +188,16 @@ pub struct Store {
     pub clock: OnceLock<fn() -> f64>,
 }
 
+impl Default for Store {
+    /// An empty store with no mirror contents, change callback or clock.
+    fn default() -> Self {
+        Self { mirror: Mutex::default(), on_change: OnceLock::new(), clock: OnceLock::new() }
+    }
+}
+
 impl Store {
     pub fn lock(&self) -> std::sync::MutexGuard<'_, Mirror> {
-        self.mirror.lock().unwrap_or_else(|e| e.into_inner())
+        self.mirror.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
     }
 
     fn now(&self) -> f64 {
@@ -179,12 +215,30 @@ impl Store {
     /// Store a file under `path` (persisted unless `persist` is false: render outputs).
     pub fn put_file(&self, path: &str, data: Arc<[u8]>, persist: bool) {
         let now = self.now();
-        self.lock().put(&file_key(path), data, now, persist);
+        let key = file_key(path);
+        self.lock().put(&key, data, now, persist);
         if persist {
             self.changed();
         }
     }
 
+    /// Size and content hash of the file under `path`. The hash is stored on the entry so a
+    /// later key does not walk the bytes again.
+    pub fn file_identity(&self, path: &str) -> Option<(u64, u64)> {
+        let key = file_key(path);
+        let mut mirror = self.lock();
+        let entry = mirror.entries.get(&key)?;
+        if let Some(hash) = entry.hash {
+            return Some((entry.data.len() as u64, hash));
+        }
+        let hash = content_hash(&entry.data);
+        let len = entry.data.len() as u64;
+        if let Some(entry) = mirror.entries.get_mut(&key) {
+            entry.hash = Some(hash);
+        }
+        Some((len, hash))
+    }
+
     pub fn file(&self, path: &str) -> Option<Arc<[u8]>> {
         self.lock().get(&file_key(path)).map(|e| e.data.clone())
     }
@@ -318,6 +372,21 @@ impl ConfigStore for WebConfig {
         v.sort();
         v
     }
+    /// The first name part of the keys under `dir/`.
+    fn list_dirs(&self, dir: &str) -> Vec<String> {
+        let pre = format!("{CONFIG}{}/", dir.trim_end_matches('/'));
+        let mut v: Vec<String> = self
+            .store
+            .lock()
+            .list(&pre)
+            .into_iter()
+            .filter_map(|(k, ..)| k.strip_prefix(&pre)?.split_once('/').map(|(d, _)| d.to_string()))
+            .filter(|d| !d.is_empty())
+            .collect();
+        v.sort();
+        v.dedup();
+        v
+    }
     fn dir(&self) -> Option<PathBuf> {
         Some(PathBuf::from("/"))
     }
@@ -373,6 +442,20 @@ pub struct SnapshotMeta {
 mod tests {
     use super::*;
 
+    #[test]
+    fn typed_save_names() {
+        let t = |s: &str| Some(s.to_string());
+        assert_eq!(typed_save_name("Intro.ecproj", t("Intro copy")).as_deref(), Some("Intro copy.ecproj"));
+        assert_eq!(typed_save_name("Intro.ecproj", t("  Other.ecproj ")).as_deref(), Some("Other.ecproj"));
+        assert_eq!(typed_save_name("Intro.ecproj", t("a/b\\Shot.ecproj")).as_deref(), Some("Shot.ecproj"));
+        assert_eq!(typed_save_name("Intro.ecproj", t("Intro.v2")).as_deref(), Some("Intro.v2.ecproj"));
+        assert_eq!(typed_save_name("Intro.ecproj", t("Intro.ECPROJ")).as_deref(), Some("Intro.ECPROJ"));
+        assert_eq!(typed_save_name("Intro.ecprojx", t("Intro")).as_deref(), Some("Intro.ecprojx"));
+        assert_eq!(typed_save_name("Intro.ecproj", t("   ")), None);
+        assert_eq!(typed_save_name("Intro.ecproj", t("folder/")), None);
+        assert_eq!(typed_save_name("Intro.ecproj", None), None);
+    }
+
     fn store() -> Arc<Store> {
         let s = Arc::new(Store::default());
         let _ = s.clock.set(|| 1_000.0);
@@ -446,6 +529,9 @@ mod tests {
         assert_ne!(a, b);
         assert_eq!(&data[..], b"blue");
         assert_eq!(s.file_versioned("/collision.png").map(|f| f.1), Some(b), "reading doesn't change it");
+        let id = s.file_identity("/collision.png").expect("identity");
+        assert_eq!(id, (4, content_hash(b"blue")));
+        assert_eq!(s.file_identity("/collision.png"), Some(id), "the hash is kept on the entry");
     }
 
     /// A write that failed is flushed again with the key's latest state (#215).
@@ -480,6 +566,22 @@ mod tests {
         assert_eq!(s.file("/clip.mp4").as_deref(), Some(&b"abc"[..]));
     }
 
+    /// Scripts in a subfolder of the Scripts folder (`Tools/Hello.jsx`) are listed, as on the desktop.
+    #[test]
+    fn config_store_lists_folders() {
+        let c = WebConfig::new(store());
+        for name in ["Scripts/Top.jsx", "Scripts/Tools/Hello.jsx", "Scripts/Tools/More.jsx", "Scripts/ScriptUI Panels/Kit/A.jsx"] {
+            c.write(name, "x").unwrap();
+        }
+        assert_eq!(c.list("Scripts"), ["Top.jsx"]);
+        assert_eq!(c.list_dirs("Scripts"), ["ScriptUI Panels", "Tools"]);
+        assert_eq!(c.list_dirs("Scripts/ScriptUI Panels"), ["Kit"]);
+        let mut s = effectcraft_engine::Session { config: Some(Arc::new(c)), ..Default::default() };
+        let list = s.execute("file.scripts.list", serde_json::json!({})).unwrap();
+        let installed: Vec<&str> = list.as_array().unwrap().iter().filter(|e| e["source"] == "installed").filter_map(|e| e["name"].as_str()).collect();
+        assert_eq!(installed, ["Tools/Hello.jsx", "Tools/More.jsx", "Top.jsx", "Kit/A.jsx"]);
+    }
+
     #[test]
     fn config_store_and_file_ops() {
         let s = store();
diff --git a/apps/effectcraft-web/tests/it/main.rs b/apps/effectcraft-web/tests/it/main.rs
new file mode 100644
index 000000000..a4d242ba5
--- /dev/null
+++ b/apps/effectcraft-web/tests/it/main.rs
@@ -0,0 +1 @@
+mod startup_tests;
diff --git a/apps/effectcraft-web/tests/it/startup_tests.rs b/apps/effectcraft-web/tests/it/startup_tests.rs
new file mode 100644
index 000000000..3ce90569c
--- /dev/null
+++ b/apps/effectcraft-web/tests/it/startup_tests.rs
@@ -0,0 +1,52 @@
+//! The `startup` key of the config file.
+
+use effectcraft_web::startup::{CONFIG_MAX, Startup, parse};
+
+/// The three accepted values parse.
+#[test]
+fn the_three_values() {
+    assert_eq!(parse(br#"{"startup":"empty"}"#), Startup::Empty);
+    assert_eq!(parse(br#"{"startup":"demo"}"#), Startup::Demo);
+    assert_eq!(parse(br#"{"startup":"last"}"#), Startup::Last);
+}
+
+/// A missing key, a wrong type, an unknown value or a non-object file gives `Last`.
+#[test]
+fn absent_or_invalid_is_the_default() {
+    for bytes in
+        [&b"{}"[..], b"", b"not json", b"[]", b"null", br#"{"startup":1}"#, br#"{"startup":"Empty"}"#, br#"{"startup":null}"#, br#"{"startup":["empty"]}"#]
+    {
+        assert_eq!(parse(bytes), Startup::Last, "{:?}", String::from_utf8_lossy(bytes));
+    }
+}
+
+/// Other keys do not hide `startup`.
+#[test]
+fn a_config_with_other_keys_still_has_its_startup() {
+    assert_eq!(parse(br#"{"remote":{"mounts":[]},"startup":"empty"}"#), Startup::Empty);
+    assert_eq!(parse(br#"{"startup":"demo","unknown":{"a":1}}"#), Startup::Demo);
+}
+
+/// A file over `CONFIG_MAX` is ignored.
+#[test]
+fn an_oversized_file_is_the_default() {
+    let mut big = br#"{"startup":"empty","pad":""#.to_vec();
+    big.extend(std::iter::repeat_n(b'x', CONFIG_MAX));
+    big.extend_from_slice(br#""}"#);
+    assert_eq!(parse(&big), Startup::Last);
+}
+
+/// Which project each value restores or opens.
+#[test]
+fn what_each_value_does_on_load() {
+    assert!(Startup::Last.restores() && Startup::Last.demo_when_nothing_restored());
+    assert!(Startup::Empty.restores() && !Startup::Empty.demo_when_nothing_restored());
+    assert!(!Startup::Demo.restores() && Startup::Demo.demo_when_nothing_restored());
+}
+
+/// Only the explicit demo start stops saving the session.
+#[test]
+fn only_the_demo_start_leaves_the_saved_session_alone() {
+    assert!(Startup::Last.keeps_session() && Startup::Empty.keeps_session());
+    assert!(!Startup::Demo.keeps_session());
+}
diff --git a/apps/effectcraft-web/tests/page.mjs b/apps/effectcraft-web/tests/page.mjs
index 063015236..3728e59e2 100644
--- a/apps/effectcraft-web/tests/page.mjs
+++ b/apps/effectcraft-web/tests/page.mjs
@@ -8,6 +8,8 @@
 // - A lost WebGPU device: the page says so over the canvas and offers Save Project and Reload;
 //   the reload writes pending changes to browser storage first, and a failed write is reported
 //   instead of reloading (#225).
+// - Duplicate cancels the browser's bookmark action on the app canvas, while still delivering
+//   the key to the app; other chords and HTML inputs keep their browser behavior (#2495).
 // Exits non-zero on failure.
 import assert from "node:assert/strict";
 import { dirname, join } from "node:path";
@@ -58,6 +60,30 @@ globalThis.location = { reload: () => reloads++ };
 
 const host = await import(pathToFileURL(join(here, "../js/host.js")));
 
+// #2495: prevent the browser default without swallowing the app's Duplicate key.
+const canvas = new EventTarget();
+const input = new EventTarget();
+host.installCanvasShortcuts(canvas);
+let delivered = 0;
+canvas.addEventListener("keydown", () => delivered++);
+const key = (target, properties) => {
+  const event = new Event("keydown", { cancelable: true });
+  Object.assign(event, { key: "d", ...properties });
+  target.dispatchEvent(event);
+  return event.defaultPrevented;
+};
+assert.equal(key(canvas, { ctrlKey: true }), true);
+assert.equal(key(canvas, { metaKey: true, key: "D" }), true);
+for (const properties of [{}, { ctrlKey: true, shiftKey: true }, { ctrlKey: true, altKey: true }, { ctrlKey: true, isComposing: true }, { ctrlKey: true, key: "r" }]) {
+  assert.equal(key(canvas, properties), false);
+}
+// Non-Latin layouts: the physical D key types "в", and eframe still reads it as D.
+assert.equal(key(canvas, { ctrlKey: true, key: "в", code: "KeyD" }), true);
+// Dvorak: the physical D key types "e", which is not Duplicate.
+assert.equal(key(canvas, { ctrlKey: true, key: "e", code: "KeyD" }), false);
+assert.equal(delivered, 9, "all keys still reach the app");
+assert.equal(key(input, { ctrlKey: true }), false, "an external HTML input keeps its shortcut");
+
 // #226: one readable and one unreadable file.
 const file = (name, read) => ({ name, webkitRelativePath: "", arrayBuffer: read });
 const picked = host.browsePickFiles(false);
diff --git a/apps/effectcraft-web/tests/smoke.mjs b/apps/effectcraft-web/tests/smoke.mjs
index 3a6c1337c..83091a72a 100644
--- a/apps/effectcraft-web/tests/smoke.mjs
+++ b/apps/effectcraft-web/tests/smoke.mjs
@@ -162,7 +162,7 @@ try {
   const info = await js("effectcraft.info()");
   report.steps.gpu = { webgpu: info.webgpu, backend: info.backend, ...info.gpu };
   if (info.webgpu && info.backend === "BrowserWebGpu") {
-    check(info.gpu && info.gpu.compositor, "GPU compositor on WebGPU");
+    check(info.gpu?.compositor, "GPU compositor on WebGPU");
     check(info.gpu.viewerOnGpu, "viewer frames on the GPU");
   }
 
@@ -250,7 +250,7 @@ try {
   const st = await js(`(async () => { await new Promise((r) => setTimeout(r, 1200)); return effectcraft.execute("storage.info", {}); })()`);
   report.steps.storage = st;
   check(st.available && st.quota > 0 && st.usage > 0, `storage.info: ${JSON.stringify(st)}`);
-  check(st.diskCache && st.diskCache.enabled && st.diskCache.writes > 0, `disk cache in OPFS: ${JSON.stringify(st.diskCache)}`);
+  check(st.diskCache?.enabled && st.diskCache.writes > 0, `disk cache in OPFS: ${JSON.stringify(st.diskCache)}`);
   await js(`effectcraft.execute("prefs.open", {page: "disk"})`);
   await sleep(800);
   report.steps.storage.screenshot = await shot("01c-storage-manager");
@@ -378,14 +378,14 @@ try {
     const jobs = gj.workers.jobs || [];
     const rj = jobs.filter((j) => j.kind === "Render").pop();
     const wj = jobs.filter((j) => j.kind === "Warp").pop();
-    check(gj.workers.gpu && gj.workers.gpu.adapter, `job workers have a GPU: ${JSON.stringify(gj.workers)}`);
+    check(gj.workers.gpu?.adapter, `job workers have a GPU: ${JSON.stringify(gj.workers)}`);
     check(gj.status.every((st) => st === "Done"), `GPU job render: ${JSON.stringify(gj.status)}`);
-    check(rj && rj.gpu && rj.readbacks >= 3 && rj.passes >= 6, `Render Queue frames on the job worker's GPU, in passes: ${JSON.stringify(rj)}`);
+    check(rj?.gpu && rj.readbacks >= 3 && rj.passes >= 6, `Render Queue frames on the job worker's GPU, in passes: ${JSON.stringify(rj)}`);
     check(gj.warp.analyzed, `Warp Stabilizer analysed in a job worker: ${JSON.stringify(gj.warp)}`);
-    check(wj && wj.gpu && wj.readbacks > 0, `Warp Stabilizer input frames on the job worker's GPU: ${JSON.stringify(wj)}`);
+    check(wj?.gpu && wj.readbacks > 0, `Warp Stabilizer input frames on the job worker's GPU: ${JSON.stringify(wj)}`);
     const fj = jobs.filter((j) => j.kind === "ContentFill").pop();
     check(!gj.fill.error && gj.fillLayers.length > 0, `Content-Aware Fill in a job worker: ${JSON.stringify(gj.fill)} ${JSON.stringify(gj.fillLayers)}`);
-    check(fj && fj.gpu && fj.readbacks > 0, `Content-Aware Fill frames on the job worker's GPU: ${JSON.stringify(fj)}`);
+    check(fj?.gpu && fj.readbacks > 0, `Content-Aware Fill frames on the job worker's GPU: ${JSON.stringify(fj)}`);
     check(gj.maxGapMs < 400, `event loop blocked ${gj.maxGapMs} ms during the GPU jobs: ${JSON.stringify(gj.gaps)}`);
     check(gj.gaps.prepareFill < 50, `event loop blocked ${gj.gaps.prepareFill} ms while editing after the analysis (pre-compose, mask): ${JSON.stringify(gj.gaps)}`);
   } else {
@@ -418,7 +418,7 @@ try {
   check(mb.path === "/Browser Storage" && mb.entries.some((e) => e.name === "tone.wav" && e.kind === "audio"), `Media Browser: ${JSON.stringify(report.steps.mediaBrowser)}`);
   check(mb.actions.some((a) => a.id === "addFiles"), "Media Browser: Add Files…");
   const mbImport = await js(`effectcraft.execute("mediaBrowser.import", {paths: [${JSON.stringify(mb.entries.find((e) => e.name === "tone.wav")?.path ?? "/tone.wav")}]})`);
-  check(!mbImport.pending && mbImport.items && mbImport.items.length === 1, `Media Browser import: ${JSON.stringify(mbImport)}`);
+  check(!mbImport.pending && mbImport.items?.length === 1, `Media Browser import: ${JSON.stringify(mbImport)}`);
   await js(`effectcraft.request("ui.playback", {action: "stop"})`);
   await js(`effectcraft.execute("time.set", {time: 0})`);
   await js(`effectcraft.request("ui.playback", {action: "play"})`);
@@ -579,7 +579,7 @@ try {
   report.steps.final2 = { screenshot: await shot("03-offline") };
 } catch (e) {
   failed = true;
-  report.error = String(e && e.stack || e);
+  report.error = String(e?.stack || e);
   try { report.errorShot = await shot("error"); } catch {}
 }
 report.console = logs.slice(-40);
diff --git a/apps/effectcraft-web/web/sw.js b/apps/effectcraft-web/web/sw.js
index 8c7efc2e5..8f48a93bc 100644
--- a/apps/effectcraft-web/web/sw.js
+++ b/apps/effectcraft-web/web/sw.js
@@ -3,7 +3,8 @@
 // `cargo xtask web` fills in the build's file list and version. Every file is precached into a
 // cache named after the version, served cache-first (responses keep the server's headers, so
 // the page stays cross-origin isolated: COOP/COEP), and old versions are dropped once the new
-// one activates. Anything else same-origin is fetched from the network and cached for next time.
+// one activates. Anything else same-origin is fetched from the network and cached for next time,
+// except the config file, which must stay live.
 const VERSION = "__EC_VERSION__";
 const FILES = __EC_FILES__;
 const CACHE = `effectcraft-${VERSION}`;
@@ -30,15 +31,18 @@ self.addEventListener("fetch", (event) => {
   const req = event.request;
   const url = new URL(req.url);
   if (req.method !== "GET" || url.origin !== self.location.origin) return;
+  if (url.pathname.endsWith("/effectcraft-config.json")) return;
   event.respondWith(
     (async () => {
-      const cache = await caches.open(CACHE);
-      // The page itself regardless of its query (?empty, ?demo…).
-      const key = req.mode === "navigate" ? new URL("./", self.registration.scope).href : req;
-      const hit = await cache.match(key, { ignoreSearch: req.mode === "navigate" });
-      if (hit) return hit;
+      const cache = await caches.open(CACHE).catch(() => null);
+      if (cache) {
+        // The page itself regardless of its query (?empty, ?demo…).
+        const key = req.mode === "navigate" ? new URL("./", self.registration.scope).href : req;
+        const hit = await cache.match(key, { ignoreSearch: req.mode === "navigate" }).catch(() => null);
+        if (hit) return hit;
+      }
       const res = await fetch(req);
-      if (res.ok && res.type === "basic") cache.put(req, res.clone());
+      if (cache && res.ok && res.type === "basic") void cache.put(req, res.clone()).catch(() => {});
       return res;
     })(),
   );
diff --git a/apps/effectcraft/Cargo.toml b/apps/effectcraft/Cargo.toml
index 5ad6c80d1..3030ee96d 100644
--- a/apps/effectcraft/Cargo.toml
+++ b/apps/effectcraft/Cargo.toml
@@ -15,7 +15,7 @@ effectcraft-host = { workspace = true }
 effectcraft-ui-egui = { workspace = true }
 egui = { workspace = true }
 # `links`: links (Help menu, Discord, Settings) open in the system browser.
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "links", "wayland", "x11"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard", "links", "wayland", "x11"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 # The window's monitors, size and position (src/window.rs), and macOS event-loop options (no app
@@ -27,6 +27,9 @@ cpal = { workspace = true }
 log = { workspace = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
+# Native GNOME/Wayland controls without a bundled title font.
+winit = { version = "0.30", default-features = false, features = ["wayland-csd-adwaita-notitle"] }
+
 # Settings ▸ Appearance ▸ Sync with System: the XDG desktop portal's colour scheme. Already in
 # Cargo.lock (accesskit, through eframe), so it adds no new crates.
 zbus = "5.19"
@@ -48,3 +51,6 @@ objc2-app-kit = { version = "0.3", default-features = false, features = ["std",
 # PhotoCraft and PdfCraft) registers the handler (Objective-C interop needs unsafe, which our
 # workspace forbids) behind a safe API. Pinned exactly: review the diff before bumping.
 fmv-macos-events = "=0.1.0"
+
+[target.'cfg(windows)'.dependencies]
+craft-update = { workspace = true }
diff --git a/apps/effectcraft/src/main.rs b/apps/effectcraft/src/main.rs
index a1fb6e4a5..5350addbe 100644
--- a/apps/effectcraft/src/main.rs
+++ b/apps/effectcraft/src/main.rs
@@ -8,9 +8,11 @@
 //! `--demo` opens the demo project instead (also Help ▸ Open Demo Project).
 //!
 //! `--control <port>` (or `EFFECTCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server;
-//! see `effectcraft_ui_egui::control` for the methods.
-#![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
+//! see `effectcraft_ui_egui::control` for the methods. An app started for an agent opens without
+//! taking keyboard focus and skips crash recovery, the Home screen (unless `--home`) and the
+//! startup update check.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 
 // Built everywhere so its tests run on every platform; only Linux AppImages use it.
 mod appearance;
@@ -50,7 +52,7 @@ fn app_icon() -> egui::IconData {
 fn is_project_file(path: &str) -> bool {
     std::path::Path::new(path)
         .extension()
-        .and_then(|ext| ext.to_str())
+        .and_then(std::ffi::OsStr::to_str)
         .is_some_and(|ext| ext.eq_ignore_ascii_case("ecproj") || ext.eq_ignore_ascii_case("ecprojx"))
 }
 
@@ -112,6 +114,13 @@ fn parse_args(args: impl IntoIterator<Item = String>, env_port: Result<String, s
     Ok(Some(out))
 }
 
+/// Whether the app looks for a newer release when it starts. Not when started for an agent
+/// (`--control`): the "update available" prompt is modal and would block the run until a person
+/// dismisses it. Help ▸ Check for Updates still works.
+fn startup_update_check(control_port: Option<u16>) -> bool {
+    control_port.is_none()
+}
+
 /// A control-channel port from 1 to 65535 (0 would listen on a port nobody is told); `name` is
 /// the flag or variable it came from.
 fn control_port(name: &str, value: Option<&str>) -> Result<u16, String> {
@@ -128,17 +137,54 @@ fn control_port(name: &str, value: Option<&str>) -> Result<u16, String> {
 /// answer without pumping events, so the window stops answering the compositor and the desktop
 /// offers to force-quit it while the Open dialog is up (#1275). Windows' blocking dialog pumps
 /// its own messages, so it keeps [`effectcraft_ui_egui::Hooks::pick_files`] and friends.
-fn install_file_dialogs(app: &mut EffectcraftApp, ctx: &egui::Context) {
+/// The dialogs asked for in a frame show at its end ([`sheet_dialogs::show_asked`]), where the
+/// main window's handle is at hand.
+fn install_file_dialogs(app: &mut EffectcraftApp) -> Option<std::sync::mpsc::Receiver<sheet_dialogs::Asked>> {
     #[cfg(any(target_os = "macos", target_os = "linux"))]
     {
-        let ctx = ctx.clone();
-        app.hooks.file_dialog_async = Some(Box::new(move |dialog, done| sheet_dialogs::show(dialog, done, ctx.clone())));
+        let (tx, rx) = std::sync::mpsc::channel::<sheet_dialogs::Asked>();
+        app.hooks.file_dialog_async = Some(Box::new(move |dialog, done| {
+            if tx.send((dialog, done)).is_err() {
+                log::error!("file dialog: the window is gone");
+            }
+        }));
+        Some(rx)
     }
     #[cfg(not(any(target_os = "macos", target_os = "linux")))]
-    let _ = (app, ctx);
+    {
+        let _ = app;
+        None
+    }
 }
 
+/// External effect helpers are native programs, so they start at launch only when the user opts
+/// in with `EFFECTCRAFT_HELPERS=1`: an environment variable, outside the settings folder, so
+/// writing there alone can't run code at launch. Otherwise Effect ▸ Scan for Effect Helpers
+/// starts them.
+fn start_helpers_if_opted_in(session: &mut effectcraft_engine::Session) {
+    if session.helpers.is_none() || std::env::var_os("EFFECTCRAFT_HELPERS").is_none_or(|v| v != "1") {
+        return;
+    }
+    match session.execute("effect.helpers.scan", json!({})) {
+        Ok(r) => {
+            for e in r["errors"].as_array().into_iter().flatten() {
+                log::warn!("effect helpers: {}", e.as_str().unwrap_or("error"));
+            }
+        }
+        Err(e) => log::warn!("effect helpers: {e}"),
+    }
+}
+
+/// Run a normal desktop launch: install logging and the panic hook, parse arguments (`--version` exits before the
+/// session log is attached), scan fonts, honor the launch guard's backend choice and open the eframe window.
+/// Builds the session, loads settings, plugins, the requested project/media and the optional control server, then
+/// reports startup failure through `startup_failed`. Returns the event loop's result.
 fn main() -> eframe::Result {
+    // Windows: the update helper is a copy of this program started with `--finish-update`.
+    #[cfg(windows)]
+    if let Some(result) = craft_update::self_update::finish(&effectcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+        std::process::exit(i32::from(result.is_err()));
+    }
     // First, so the panic hook and every start-up warning are recorded. Records go to stderr
     // and the session log; Help ▸ Enable Logging writes through this logger too, and warnings
     // feed the compatibility report.
@@ -203,6 +249,7 @@ fn main() -> eframe::Result {
         "EffectCraft",
         options,
         Box::new(move |cc| {
+            EffectcraftApp::install_ime_reset_hooks(&cc.egui_ctx);
             match &cc.wgpu_render_state {
                 Some(rs) => log::info!("graphics: {:?}", rs.adapter.get_info()),
                 None => log::info!("graphics: no wgpu device"),
@@ -233,16 +280,25 @@ fn main() -> eframe::Result {
             // config directory. Agent-driven runs (`--control`) skip crash recovery.
             if let Some(dir) = effectcraft_host::config_dir() {
                 // WebAssembly effect plug-ins in <config>/Plug-ins load before the menus are built.
-                let plugins = dir.join("Plug-ins");
+                let plugins = dir.join(effectcraft_engine::commands::PLUGINS_DIR);
                 if plugins.is_dir() {
                     let _ = session.execute("effect.plugins.load", json!({"folder": plugins.to_string_lossy()}));
+                    // Packages installed from the Plug-in Library (<config>/Plug-ins/Library).
+                    // Each package that fails to load is logged by the library itself.
+                    if let Err(e) = session.execute("library.loadInstalled", json!({})) {
+                        log::warn!("plug-in library: {e}");
+                    }
                 }
+                start_helpers_if_opted_in(&mut session);
                 session.config = Some(std::sync::Arc::new(effectcraft_engine::config::DirConfig::new(dir)));
             }
             session.load_settings();
             // Fit the window to its monitor, or put it back where it was (still hidden).
             let saved_window = session.config.as_deref().and_then(window::load);
             let opened = cc.winit_window().map(|w| window::restore(w, saved_window));
+            // Scripts in Scripts/Startup run before a project opens (a failing one is reported in
+            // a toast).
+            let _ = session.execute("file.runStartupScripts", json!({}));
             let recovery = if control_port.is_none() { session.begin_recovery() } else { None };
             let project = files.iter().find(|f| is_project_file(f)).cloned();
             if let Some(p) = project {
@@ -263,6 +319,7 @@ fn main() -> eframe::Result {
             // reported in a toast and forgotten).
             let _ = session.execute("window.restoreScriptPanels", json!({}));
             let mut app = EffectcraftApp::new(session);
+            app.set_startup_update_check(startup_update_check(control_port));
             app.set_gpu_failure_bridge(gpu_failures);
             app.ui.start_screen = show_home;
             if let Some(n) = notice {
@@ -319,7 +376,7 @@ fn main() -> eframe::Result {
             }));
             // The commands' file dialogs don't block the frame where the platform's backend
             // would (#511, #1275); see [`install_file_dialogs`].
-            install_file_dialogs(&mut app, &cc.egui_ctx);
+            let file_dialogs = install_file_dialogs(&mut app);
             #[cfg(target_os = "macos")]
             {
                 app.hooks.app_action = Some(Box::new(native_menu::app_action));
@@ -337,20 +394,18 @@ fn main() -> eframe::Result {
                 #[cfg(target_os = "macos")]
                 apple_events: apple_events.connect(&cc.egui_ctx),
                 app,
+                file_dialogs,
                 window: window::Tracker::new(opened, saved_window, control_port.is_none()),
                 launch,
                 drawn: false,
             }))
         }),
     );
-    match &result {
-        Ok(()) => log::info!("the window closed"),
-        Err(e) => {
-            if on_gl {
-                launch_guard::opengl_failed(effectcraft_host::config_dir().as_deref());
-            }
-            startup_failed(e, !on_gl && cfg!(not(target_os = "macos")));
+    if let Err(e) = &result {
+        if on_gl {
+            launch_guard::opengl_failed(effectcraft_host::config_dir().as_deref());
         }
+        startup_failed(e, !on_gl && cfg!(not(target_os = "macos")));
     }
     result
 }
@@ -359,9 +414,15 @@ fn main() -> eframe::Result {
 /// instead of eframe's fixed set: an older GPU that can't meet those (Intel HD Graphics 5500,
 /// #198) still opens the app, and the compositor then checks what it needs and falls back to
 /// the CPU when the device can't run it. `backends`: Window Graphics' choice, when it makes one.
+///
+/// The surface is eframe's own default, [`eframe::SurfaceConfig::LOW_LATENCY`]: vsync with one
+/// frame in flight, so a drag or a scrub shows one frame sooner. The bare
+/// `WgpuConfiguration::default()` is `HIGH_THROUGHPUT` instead (two frames in flight, three
+/// drawables on Metal): one more frame of pointer-to-screen lag on every interaction, about 8 ms
+/// at 120 Hz and 17 ms at 60 Hz, and a third 15 MB drawable held for the window.
 fn wgpu_options(backends: Option<eframe::wgpu::Backends>) -> eframe::WgpuConfiguration {
     use eframe::egui_wgpu::WgpuSetup;
-    let mut config = eframe::WgpuConfiguration::default();
+    let mut config = eframe::WgpuConfiguration::default().with_surface_config(eframe::SurfaceConfig::LOW_LATENCY);
     if let WgpuSetup::CreateNew(setup) = &mut config.wgpu_setup {
         if let Some(b) = backends {
             setup.instance_descriptor.backends = b;
@@ -371,15 +432,22 @@ fn wgpu_options(backends: Option<eframe::wgpu::Backends>) -> eframe::WgpuConfigu
         // Iris Pro: the device is lost and the window never opens.
         // `WGPU_VALIDATION_INDIRECT_CALL=1` turns the check back on.
         setup.instance_descriptor.flags = setup.instance_descriptor.flags.difference(eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL).with_env();
-        setup.device_descriptor = std::sync::Arc::new(|adapter| eframe::wgpu::DeviceDescriptor {
-            label: Some("EffectCraft device"),
-            required_limits: device_limits(adapter.limits()),
-            ..Default::default()
-        });
+        setup.device_descriptor = std::sync::Arc::new(|adapter| device_descriptor(adapter.limits()));
     }
     config
 }
 
+/// The window device's descriptor: the adapter's limits ([`device_limits`]) and `MemoryUsage`,
+/// so memory the compositor frees on the shared device goes back to the driver.
+fn device_descriptor(adapter: eframe::wgpu::Limits) -> eframe::wgpu::DeviceDescriptor<'static> {
+    eframe::wgpu::DeviceDescriptor {
+        label: Some("EffectCraft device"),
+        required_limits: device_limits(adapter),
+        memory_hints: eframe::wgpu::MemoryHints::MemoryUsage,
+        ..Default::default()
+    }
+}
+
 /// The limits to request from an adapter that offers `adapter`: all of them, with textures
 /// capped at 16384 px like the headless renderer's device.
 fn device_limits(adapter: eframe::wgpu::Limits) -> eframe::wgpu::Limits {
@@ -411,6 +479,8 @@ fn startup_failed(e: &eframe::Error, gl_next: bool) {
 /// The desktop app: the egui app plus, on macOS, the system menu bar.
 struct Desktop {
     app: EffectcraftApp,
+    /// The commands' file dialogs, shown at the end of the frame that asked for them.
+    file_dialogs: Option<std::sync::mpsc::Receiver<sheet_dialogs::Asked>>,
     #[cfg(target_os = "macos")]
     menu: native_menu::NativeBar,
     /// Documents opened from Finder, the Dock or `open` (macOS).
@@ -424,14 +494,24 @@ struct Desktop {
 }
 
 impl eframe::App for Desktop {
+    /// The desktop host's logic tick: update the macOS menu bar, run the shared app tick, close the IME pass, show the
+    /// file dialogs asked for and, last, hand a close to the platform quit.
     fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
         #[cfg(target_os = "macos")]
         self.menu.update(&mut self.app, ctx);
-        self.app.logic(ctx, frame);
+        self.app.tick(ctx, frame);
+        self.app.finish_ime_logic(ctx);
+        if let Some(asked) = &self.file_dialogs {
+            sheet_dialogs::show_asked(asked, frame, ctx);
+        }
+        effectcraft_ui_egui::panels::unsaved::quit_on_close(ctx);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
         self.app.ui(ui, frame);
+        if let Some(asked) = &self.file_dialogs {
+            sheet_dialogs::show_asked(asked, frame, ui.ctx());
+        }
         self.window.frame(ui.ctx(), self.app.session.config.as_deref());
         if !self.drawn {
             self.drawn = true;
@@ -445,9 +525,15 @@ impl eframe::App for Desktop {
     }
 
     fn on_exit(&mut self) {
+        // On macOS the app quits through `-[NSApplication terminate:]`, and the process ends
+        // before `eframe::run_native` returns (#341).
+        log::info!("the window is closing");
         self.launch.exited();
         self.window.save(self.app.session.config.as_deref());
         self.app.on_exit();
+        effectcraft_host::stop_helpers();
+        // Scripts in Scripts/Shutdown run with the project closed.
+        let _ = self.app.session.execute("file.runShutdownScripts", json!({}));
     }
 
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
@@ -526,6 +612,19 @@ mod tests {
         assert!(!setup.instance_descriptor.flags.contains(eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL));
     }
 
+    /// The window's surface keeps one frame in flight, like eframe's own default, not the two
+    /// of the bare `WgpuConfiguration::default()` (one extra frame of lag on every drag).
+    #[test]
+    fn the_window_surface_is_low_latency() {
+        for backends in [None, Some(eframe::wgpu::Backends::METAL), Some(eframe::wgpu::Backends::GL)] {
+            let surface = super::wgpu_options(backends).surface;
+            assert_eq!(surface, eframe::SurfaceConfig::LOW_LATENCY, "{backends:?}");
+            assert_eq!(surface.desired_maximum_frame_latency, Some(1));
+            assert_eq!(surface.present_mode, eframe::wgpu::PresentMode::AutoVsync);
+        }
+        assert_eq!(super::wgpu_options(None).surface, eframe::NativeOptions::default().wgpu_options.surface, "eframe's default surface");
+    }
+
     /// The window's device never asks for more than the adapter offers (#198).
     #[test]
     fn device_limits_fit_the_adapter() {
@@ -539,6 +638,17 @@ mod tests {
         assert_eq!(super::device_limits(big).max_texture_dimension_2d, 16384);
     }
 
+    /// The window device asks for `MemoryUsage`: the adapter's limits, unchanged.
+    #[test]
+    fn the_window_device_favours_memory_usage() {
+        use eframe::wgpu::Limits;
+        let big = Limits { max_texture_dimension_2d: 32768, ..Limits::default() };
+        let d = super::device_descriptor(big);
+        assert!(matches!(d.memory_hints, eframe::wgpu::MemoryHints::MemoryUsage));
+        assert_eq!(d.required_limits.max_texture_dimension_2d, 16384);
+        assert_eq!(d.label, Some("EffectCraft device"));
+    }
+
     /// A positional .ecprojx is a project file, not an unsupported media import (#528).
     #[test]
     fn launch_classifies_xml_and_json_projects_as_projects() {
@@ -565,6 +675,18 @@ mod tests {
         assert_eq!(parse_env(&[], Ok("9000".into())).unwrap().map(|a| a.control_port), Some(Some(9000)));
     }
 
+    /// An app started for an agent (`--control` or `EFFECTCRAFT_CONTROL_PORT`) doesn't check for
+    /// updates at start, so no modal update prompt blocks the run; a normal launch still does.
+    #[test]
+    fn agent_runs_skip_the_startup_update_check() {
+        let port = |args: &[&str], env| parse_env(args, env).unwrap().unwrap_or_default().control_port;
+        assert!(super::startup_update_check(port(&[], Err(VarError::NotPresent))));
+        assert!(super::startup_update_check(port(&[], Ok(String::new()))));
+        assert!(!super::startup_update_check(port(&["--control", "9877"], Err(VarError::NotPresent))));
+        assert!(!super::startup_update_check(port(&["--control=9877"], Err(VarError::NotPresent))));
+        assert!(!super::startup_update_check(port(&[], Ok("9877".into()))));
+    }
+
     /// A missing, non-numeric or zero `--control` value stops the launch instead of starting
     /// without a control server, and the argument after `--control` isn't reinterpreted (#997).
     #[test]
@@ -620,10 +742,10 @@ mod tests {
     #[test]
     fn commands_file_dialogs_do_not_block_the_frame() {
         let mut app = effectcraft_ui_egui::EffectcraftApp::new(effectcraft_engine::Session::default());
-        super::install_file_dialogs(&mut app, &egui::Context::default());
+        let asked = super::install_file_dialogs(&mut app);
         #[cfg(any(target_os = "macos", target_os = "linux"))]
-        assert!(app.hooks.file_dialog_async.is_some(), "the commands' file dialogs must not block the frame");
+        assert!(app.hooks.file_dialog_async.is_some() && asked.is_some(), "the commands' file dialogs must not block the frame");
         #[cfg(not(any(target_os = "macos", target_os = "linux")))]
-        assert!(app.hooks.file_dialog_async.is_none(), "the blocking dialog pumps its own messages here");
+        assert!(app.hooks.file_dialog_async.is_none() && asked.is_none(), "the blocking dialog pumps its own messages here");
     }
 }
diff --git a/apps/effectcraft/src/native_menu.rs b/apps/effectcraft/src/native_menu.rs
index 9db2ffe76..c3b142c5f 100644
--- a/apps/effectcraft/src/native_menu.rs
+++ b/apps/effectcraft/src/native_menu.rs
@@ -2,10 +2,10 @@
 //! [`effectcraft_ui_egui::native_menu`]'s spec of the engine's After Effects menu tree.
 //!
 //! Each frame [`NativeBar::update`] runs menu activations (the same command ids as the in-window
-//! bar), and when [`native_menu::state_key`] changed it rebuilds the spec and pushes labels,
-//! enabled and check state into the existing items; a structural change (Open Recent, a new
-//! shortcut preset) rebuilds the menu. Settings ▸ Appearance ▸ Use In-Window Menu Bar on macOS
-//! swaps back to the in-window bar.
+//! bar), and when [`native_menu::state_key`] or whether a text field has the keyboard changed it
+//! rebuilds the spec and pushes labels, enabled and check state into the existing items; a
+//! structural change (Open Recent, a new shortcut preset) rebuilds the menu. Settings ▸
+//! Appearance ▸ Use In-Window Menu Bar on macOS swaps back to the in-window bar.
 
 use std::collections::HashMap;
 use std::sync::mpsc::{Receiver, channel};
@@ -24,7 +24,7 @@ pub struct NativeBar {
     items: HashMap<String, CheckMenuItem>,
     spec: NativeMenu,
     structure: u64,
-    state: Option<u64>,
+    state: Option<(u64, bool)>,
     events: Receiver<MenuEvent>,
     /// The in-window-bar setting last applied (None: not yet).
     in_window: Option<bool>,
@@ -67,12 +67,13 @@ impl NativeBar {
         if in_window {
             return;
         }
-        let key = native_menu::state_key(app);
+        // While a text field has the keyboard, the Edit items it takes stay enabled.
+        let key = (native_menu::state_key(app), native_menu::text_field_window(ctx).is_some());
         if self.state == Some(key) && self.menu.is_some() {
             return;
         }
         self.state = Some(key);
-        let spec = native_menu::build(app);
+        let spec = native_menu::build_now(app, ctx);
         let structure = spec.structure();
         if self.menu.is_none() || structure != self.structure {
             self.install(&spec);
diff --git a/apps/effectcraft/src/sheet_dialogs.rs b/apps/effectcraft/src/sheet_dialogs.rs
index 7a75ef2a7..911870190 100644
--- a/apps/effectcraft/src/sheet_dialogs.rs
+++ b/apps/effectcraft/src/sheet_dialogs.rs
@@ -17,10 +17,24 @@ use std::pin::Pin;
 
 type Answer = Pin<Box<dyn Future<Output = Vec<String>> + Send>>;
 
-/// Show `dialog` (on the main thread: the sheet opens here) and hand its paths to `done` once it
-/// closes, then wake the UI.
-pub fn show(dialog: FileDialog, done: DialogDone, ctx: egui::Context) {
-    let answer = open(dialog);
+/// A command's dialog waiting for [`show_asked`].
+pub type Asked = (FileDialog, DialogDone);
+
+/// Show the dialogs the commands asked for in this frame (on the main thread: a sheet opens
+/// here) and hand each one's paths to its `done` once it closes, then wake the UI.
+///
+/// On macOS the sheet goes on the main window (`frame`'s). Without a parent rfd puts it on
+/// AppKit's main window, which is a floating panel's OS window after a click in one; that
+/// window hides while the app has no focused window, and a sheet whose window goes away ends
+/// without answering, with later sheets queued behind it on the same window.
+pub fn show_asked(asked: &std::sync::mpsc::Receiver<Asked>, frame: &eframe::Frame, ctx: &egui::Context) {
+    while let Ok((dialog, done)) = asked.try_recv() {
+        show(dialog, done, frame, ctx.clone());
+    }
+}
+
+fn show(dialog: FileDialog, done: DialogDone, frame: &eframe::Frame, ctx: egui::Context) {
+    let answer = open(dialog, frame);
     let spawned = std::thread::Builder::new().name("ec-file-dialog".into()).spawn(move || {
         done(pollster::block_on(answer));
         ctx.request_repaint();
@@ -30,6 +44,13 @@ pub fn show(dialog: FileDialog, done: DialogDone, ctx: egui::Context) {
     }
 }
 
+/// A dialog on the main window. Linux keeps the portal's dialog unparented: rfd exports the
+/// window for the portal from the dialog's worker thread there.
+fn parented(frame: &eframe::Frame) -> AsyncFileDialog {
+    let d = AsyncFileDialog::new();
+    if cfg!(target_os = "macos") { d.set_parent(frame) } else { d }
+}
+
 fn paths(files: Option<Vec<FileHandle>>) -> Vec<String> {
     files.unwrap_or_default().into_iter().map(|f| f.path().to_string_lossy().to_string()).collect()
 }
@@ -39,10 +60,10 @@ fn path(file: Option<FileHandle>) -> Vec<String> {
 }
 
 /// The dialog, as the blocking hooks in `main.rs` show it.
-fn open(dialog: FileDialog) -> Answer {
+fn open(dialog: FileDialog, frame: &eframe::Frame) -> Answer {
     match dialog {
         FileDialog::Open { exts, many } => {
-            let d = AsyncFileDialog::new().add_filter("Media", &exts);
+            let d = parented(frame).add_filter("Media", &exts);
             if many {
                 let f = d.pick_files();
                 Box::pin(async move { paths(f.await) })
@@ -52,22 +73,22 @@ fn open(dialog: FileDialog) -> Answer {
             }
         }
         FileDialog::OpenProject => {
-            let f = AsyncFileDialog::new().add_filter("EffectCraft Project", &["ecproj", "ecprojx"]).pick_file();
+            let f = parented(frame).add_filter("EffectCraft Project", &["ecproj", "ecprojx"]).pick_file();
             Box::pin(async move { path(f.await) })
         }
         FileDialog::Folder => {
-            let f = AsyncFileDialog::new().pick_folder();
+            let f = parented(frame).pick_folder();
             Box::pin(async move { path(f.await) })
         }
         FileDialog::Save { default, ext, project } => {
             let at = std::path::Path::new(&default);
             let name = at.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
             let mut d = if project {
-                AsyncFileDialog::new().add_filter("EffectCraft Project", &["ecproj"])
+                parented(frame).add_filter("EffectCraft Project", &["ecproj"])
             } else if ext.is_empty() {
-                AsyncFileDialog::new()
+                parented(frame)
             } else {
-                AsyncFileDialog::new().add_filter(&ext, &[ext.as_str()])
+                parented(frame).add_filter(&ext, &[ext.as_str()])
             };
             // A default with a folder that exists opens the dialog there.
             if let Some(dir) = at.parent().filter(|d| d.is_dir()) {
diff --git a/apps/effectcraft/tests/args.rs b/apps/effectcraft/tests/args.rs
index 8367d2a99..62c591b45 100644
--- a/apps/effectcraft/tests/args.rs
+++ b/apps/effectcraft/tests/args.rs
@@ -1,11 +1,14 @@
 //! The desktop binary rejects a bad command line before it starts anything (#997).
-// Integration tests: unwrapping and panicking on failure is fine here.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 use std::path::PathBuf;
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
+/// Nextest archives relocate binaries; plain Cargo keeps the compile-time path valid.
+fn binary() -> std::ffi::OsString {
+    std::env::var_os("NEXTEST_BIN_EXE_effectcraft").unwrap_or_else(|| env!("CARGO_BIN_EXE_effectcraft").into())
+}
+
 /// A settings folder of its own, so a launch that got past the arguments would show up as
 /// preferences (Recent Footage) written there instead of in the user's settings.
 fn config_dir(name: &str) -> PathBuf {
@@ -19,7 +22,7 @@ fn config_dir(name: &str) -> PathBuf {
 /// regression fails instead of leaving a window open: the process is killed after 5 s.
 fn rejects(name: &str, args: &[&str], env: &[(&str, &str)], message: &str) {
     let config = config_dir(name);
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_effectcraft"));
+    let mut cmd = Command::new(binary());
     cmd.args(args).env_remove("EFFECTCRAFT_CONTROL_PORT").env_remove("RUST_LOG").env("EFFECTCRAFT_CONFIG_DIR", &config);
     for (k, v) in env {
         cmd.env(k, v);
@@ -67,7 +70,7 @@ fn a_bad_control_port_stops_the_launch() {
 
 #[test]
 fn version_still_prints_with_a_bad_port_variable() {
-    let out = Command::new(env!("CARGO_BIN_EXE_effectcraft")).arg("--version").env("EFFECTCRAFT_CONTROL_PORT", "abc").output().unwrap();
+    let out = Command::new(binary()).arg("--version").env("EFFECTCRAFT_CONTROL_PORT", "abc").output().unwrap();
     assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
     assert_eq!(String::from_utf8(out.stdout).unwrap(), format!("effectcraft {}\n", env!("CARGO_PKG_VERSION")));
 }
diff --git a/assets/app-icon/README.md b/assets/app-icon/README.md
index 814ad601a..f0265ce9e 100644
--- a/assets/app-icon/README.md
+++ b/assets/app-icon/README.md
@@ -15,9 +15,8 @@ full-bleed colour field, tight head-and-shoulders crop, the body running off the
 | Paper | `#efe9dc` | the figure |
 | Ink | `#0b0b0c` | line work and contour |
 
-**Provenance:** the project owner drew it in ArtCraft (a 2880 px engraving-style image, kept in
-craftrules at `assets/app-icons/effectcraft/source.png`). It was vectorised with craftrules
-`assets/logo-options/_tools/vectorize_tile.py`, which keys out the field and traces the ink with potrace.
+**Provenance:** the project owner drew it in ArtCraft (a 2880 px engraving-style image). It was
+vectorised with potrace, which keys out the field and traces the ink.
 Licence: see [LICENSE.txt](LICENSE.txt) (MIT OR Apache-2.0, like the repo).
 
 ## Files
@@ -37,6 +36,5 @@ App ID: `ai.storyteller.effectcraft` (Wayland app ID, `packaging/linux/ai.storyt
 
 ## Regenerate
 
-Copy a new `icon-master.svg` / `icon.svg` from craftrules `assets/app-icons/effectcraft/` over
-`effectcraft.svg` / `effectcraft-small.svg`, then run `packaging/icons.sh` (needs `resvg`; `iconutil`
+After replacing `effectcraft.svg` / `effectcraft-small.svg`, run `packaging/icons.sh` (needs `resvg`; `iconutil`
 on macOS for the `.icns`). Copy `effectcraft-small.svg` to `apps/effectcraft-web/web/favicon.svg` too.
diff --git a/assets/app-icon/effectcraft-small.svg.attribution b/assets/app-icon/effectcraft-small.svg.attribution
index 6dbaab168..88fd92379 100644
--- a/assets/app-icon/effectcraft-small.svg.attribution
+++ b/assets/app-icon/effectcraft-small.svg.attribution
@@ -5,4 +5,4 @@ source:       original work
 license:      MIT OR Apache-2.0
 license-file: assets/app-icon/LICENSE.txt
 added:        2026-10-02 by EffectCraft contributors (Claude agent, app icon)
-notes:        The same drawing vectorised at 1024 px with craftrules vectorize_tile.py, about 350 KB, for places where size matters.
+notes:        The same drawing vectorised at 1024 px, about 350 KB, for places where size matters.
diff --git a/assets/app-icon/effectcraft.svg.attribution b/assets/app-icon/effectcraft.svg.attribution
index 219606236..19bf871bd 100644
--- a/assets/app-icon/effectcraft.svg.attribution
+++ b/assets/app-icon/effectcraft.svg.attribution
@@ -5,4 +5,4 @@ source:       original work
 license:      MIT OR Apache-2.0
 license-file: assets/app-icon/LICENSE.txt
 added:        2026-10-02 by EffectCraft contributors (Claude agent, app icon)
-notes:        The owner's ArtCraft drawing of an engraved unicorn bust, vectorised at 2048 px with craftrules assets/logo-options/_tools/vectorize_tile.py (potrace; three colours). Canonical artwork; the other icon files derive from it.
+notes:        The owner's ArtCraft drawing of an engraved unicorn bust, vectorised at 2048 px (potrace; three colours). Canonical artwork; the other icon files derive from it.
diff --git a/assets/fonts/NotoSansSymbols2-Regular.ttf b/assets/fonts/NotoSansSymbols2-Regular.ttf
new file mode 100644
index 000000000..caf89dd0e
Binary files /dev/null and b/assets/fonts/NotoSansSymbols2-Regular.ttf differ
diff --git a/assets/fonts/NotoSansSymbols2-Regular.ttf.attribution b/assets/fonts/NotoSansSymbols2-Regular.ttf.attribution
new file mode 100644
index 000000000..4d6d416be
--- /dev/null
+++ b/assets/fonts/NotoSansSymbols2-Regular.ttf.attribution
@@ -0,0 +1,8 @@
+asset:        NotoSansSymbols2-Regular.ttf
+title:        Noto Sans Symbols 2 Regular (chrome symbols such as ✔ and ▣)
+author:       The Noto Project Authors
+source:       https://github.com/notofonts/symbols (Google Fonts commit 47d54ca1ebb14fd864695f1d39dc734f39017c33, file ofl/notosanssymbols2/NotoSansSymbols2-Regular.ttf)
+license:      OFL-1.1
+license-file: assets/fonts/OFL-NotoSansSymbols2.txt
+added:        2026-10-24 by @skylartaylor
+notes:        Unmodified font file, sha256 7d5fb73b7ca67a6798101741f5d280a3d016a56a197afcd4199dbb57b4b82a21. Embedded with include_bytes! in crates/ui-egui/src/theme.rs as the last UI fallback so every family can draw the chrome symbols (U+2714 ✔, U+25A3 ▣) that Inter, Inter Medium, Inter SemiBold and JetBrains Mono lack.
diff --git a/assets/fonts/OFL-NotoSansSymbols2.txt b/assets/fonts/OFL-NotoSansSymbols2.txt
new file mode 100644
index 000000000..7c95767f5
--- /dev/null
+++ b/assets/fonts/OFL-NotoSansSymbols2.txt
@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/symbols)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/clippy.toml b/clippy.toml
index 4b6c79f55..3522a15b6 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -2,3 +2,7 @@ allow-unwrap-in-tests = true
 allow-expect-in-tests = true
 allow-panic-in-tests = true
 allow-indexing-slicing-in-tests = true
+disallowed-types = [
+    { path = "egui::ComboBox", reason = "use craft_ui::ComboBox: egui's combo box menu can't grow back while open (egui#5225)" },
+]
+cognitive-complexity-threshold = 30
diff --git a/contributors/people.toml b/contributors/people.toml
index 625fcdb73..e9144f9ea 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -1,13 +1,10 @@
-# Contributor names for the About window (craftrules standards/contributors.md).
+# Contributor names for the About window.
 #
 # Everyone who contributes is credited by GitHub username automatically. Anything more is up to
 # you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
 # maintainer may add a person only when that person asked, recording where in consent_source.
 #
-# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
-#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
-#
-# Or copy this block, replacing your-github-username (every field is optional):
+# Copy this block, replacing your-github-username (every field is optional):
 #
 #   [people.your-github-username]
 #   real_name = "Your Name"        # shown when the viewer picks "Real name"
@@ -17,11 +14,19 @@
 # To remove your names, delete your entry (or set fields empty) in a PR. The next
 # contributors.py run, and the next build, drop them.
 
+[people.Krueels]
+sync_github_name = true
+
 [people.echelon]
 real_name = "Brandon Thomas"
 display_name = "Brandon Thomas"
 sync_github_name = false
 
+[people.lewandowskit]
+real_name = "Tomasz Lewandowski"
+display_name = "Tomasz Lewandowski"
+sync_github_name = false
+
 [people.switch87]
 real_name = "Gert Pellin"
 display_name = "Gert Pellin"
@@ -57,7 +62,8 @@ sync_github_name = false
 
 [people.vangel76]
 real_name = "Valentin Klein"
-display_name = "Valentin Klein"
+display_name = "vangel76"
+sync_github_name = false
 
 [people.Losminek]
 sync_github_name = true
@@ -95,3 +101,37 @@ sync_github_name = true
 [people.Silvertree2010]
 display_name = "Netter"
 sync_github_name = false
+
+[people.ki2pixel]
+display_name = "ki2pixel"
+
+[people.iseemhlyfta]
+display_name = "iseemhlyfta"
+sync_github_name = false
+
+[people.becauseno7]
+real_name = "Shuvra Basak"
+display_name = "Shuvra Basak"
+sync_github_name = false
+
+[people.ashokram-si]
+real_name = "Ashok Ram"
+
+[people.dylanmtaylor]
+sync_github_name = true
+
+[people.adikshan11]
+real_name = "Adithya Shankaran"
+sync_github_name = true
+
+[people.marshiyar]
+real_name = "Arshiya Rahgozar"
+display_name = "Arshiya"
+sync_github_name = false
+
+[people.JonRC]
+real_name = "Jonathan Cardoso"
+display_name = "Jonathan Cardoso"
+
+[people.nazar-gavrylyk]
+sync_github_name = true
diff --git a/crates/aep/Cargo.toml b/crates/aep/Cargo.toml
new file mode 100644
index 000000000..b1bf3f9fe
--- /dev/null
+++ b/crates/aep/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "effectcraft-aep"
+description = "After Effects projects: the .aep (RIFX 'Egg!') / .aepx container as a lossless chunk tree with a typed view, import into an EffectCraft project and export back to .aep with every chunk built in code; each reports everything it does not carry over"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+effectcraft-time = { workspace = true }
+effectcraft-color = { workspace = true }
+effectcraft-keyframe = { workspace = true }
+effectcraft-project = { workspace = true }
+effectcraft-effects = { workspace = true }
+serde = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+serde_json = { workspace = true }
+
+# The tool's own tests run with the crate's (examples are only built by default).
+[[example]]
+name = "stubicc"
+test = true
diff --git a/crates/aep/README.md b/crates/aep/README.md
new file mode 100644
index 000000000..5e8035d8f
--- /dev/null
+++ b/crates/aep/README.md
@@ -0,0 +1,99 @@
+# effectcraft-aep
+
+After Effects projects (`.aep`, `.aepx`) in one crate, the way `effectcraft-lottie` handles Lottie:
+
+- `container`: reads and writes the container as a lossless chunk tree, with a typed, read-only
+  view (below; its API is re-exported at the crate root);
+- `import`: maps the typed view into an EffectCraft project and reports everything it does not
+  import ([`docs/aep-import.md`](../../docs/aep-import.md));
+- `export`: writes an EffectCraft project as an `.aep` with every chunk built in code, and reports everything it does not export
+  ([`docs/aep-export.md`](../../docs/aep-export.md)).
+
+No file access: callers pass bytes, so the crate builds for wasm32.
+
+## Container
+
+An `.aep` is a `RIFX` container (big-endian RIFF) with form type `Egg!`: chunks of a 4-byte id, a
+big-endian `u32` size and a body padded to an even length; `LIST` chunks start with a 4-byte list
+type followed by chunks. `parse` builds the tree, `write` serialises it, and for every input that
+parses, `write(parse(x)) == x` byte for byte (container and chunk sizes are recomputed from the
+tree; pad bytes, odd bodies and the bytes after the container, an XMP packet, are kept).
+
+The XML form of a project (`.aepx`) is read into the same tree by `read_aepx` (a small bounded
+XML tokenizer, no dependency); `parse_any` picks the reader by content, so the typed view and the
+importer take either form. The mapping is in `docs/aep-format.md`, section 1.
+
+Bodies that look like lists but are not chunk sequences (for example `LIST btdk`, raw text) stay
+opaque rather than failing the parse. Input is untrusted: sizes are checked against the remaining
+input, nesting and chunk count are bounded (`Limits`), nothing is allocated from a declared size,
+and truncated or damaged files return `Err` (or, inside the container, an opaque body).
+
+The container layer decodes no chunk body. On top of it, a typed view (`Project`, `Item`, `Comp`, `Layer`,
+`Property`, ...) reads the fields whose layout was verified against the values the test files were made
+with: layer and composition headers (switches, exact times and time stretch, size, frame rate, work area, shutter phase, display start, renderer),
+static transform values in After Effects' units with the "absent = default" rule, keyframe records
+(interpolation sides, ease per component, plain and spatial templates), Time Remapping, expressions with their enable switch, effect
+instances and parameter values, masks and bezier paths with tangents, shape layer groups, text documents
+(paragraph and style runs, box, justification, tracking, faux styles, caps, leading), markers with
+duration, strings and cue data, cameras and lights with their options, footage (stills, audio, image
+sequences), solids and precomp links. Every accessor returns `Option`/an empty list on damaged data and never
+panics. Which fields are verified, which are not decoded, and how it was found is in
+[`docs/aep-format.md`](../../docs/aep-format.md).
+
+## Specifications
+
+Public specifications used for parts the format embeds:
+
+- ICC.1:2010: the profile description of a working-space profile (a v2 `desc` or a v4 `mluc`
+  tag), from which the working space's name is read (`container/settings.rs`).
+- RFC 4648 (base64): the profile data in the project's colour settings JSON (read, and written
+  by the exporter).
+- The exporter's own colour profiles (`export/icc.rs`): ICC.1:2010 version 4.3 display profiles
+  with ITU-R BT.709 primaries, D65 white, a D50 PCS and a Bradford adaptation, the IEC 61966-2-1
+  sRGB curve or a 2.4 power curve; the profile ID is the MD5 of RFC 1321.
+
+## Clean room
+
+Everything here comes from our own observations: project files that we generated ourselves with
+After Effects, one change per file, compared byte by byte. No source code or format
+documentation of another `.aep` reader or writer was used, and no Adobe asset is used. The test fixtures are such generated files
+(own test data): a few combined projects, one composition per case (`tests/fixtures/CASES.md`;
+the generator is in `tests/fixtures/tools/`). They are not in this repository but in
+[storytold/effectcraft-corpus](https://github.com/storytold/effectcraft-corpus), with their
+attribution, the generation notes and the inspection of their embedded content.
+`cargo xtask aep-corpus` fetches them at the commit pinned in `tests/fixtures/corpus.lock`, checks
+every file against the SHA-256 listed there and only then installs them in `corpus/aep` (ignored by
+git). The tests read them from the folder named by the `EFFECTCRAFT_AEP_FIXTURES` environment
+variable (opt-in; set `EFFECTCRAFT_AEP_FIXTURES_REQUIRED=1` too, so that a missing project fails). The
+tests reach them only through `tests/it/common/mod.rs`, which hands a test its case as a project
+of its own cut from the combined file; a test whose fixture is missing (or with the variable not
+set) prints `SKIPPED: fixture <name> missing` and passes.
+
+`tests/fixtures/synthetic.aep` (115 KB) is one of the two projects in the repository: made in After Effects 2026
+with the working space set to None (one composition, an image sequence of three 8x8 PNGs, a
+solid, a folder, a Levels and a Glow effect with expressions). Every After Effects project embeds
+the working space's ICC profile (HP sRGB IEC61966-2.1 for the default) in a JSON settings chunk;
+the one `Utf8` chunk of this file that held a profile was replaced by `{}`, and nothing else was
+changed. The tests in `tests/it/import/synthetic.rs` damage copies of it and need no other file.
+
+`tests/fixtures/ai-mask-3099.aep` (131 KB, #3099) is the second: four hand-written one-page PDFs
+named `.ai` with distinct page boxes, placed in a composition, one of them with two masks under a
+Null parented to a Null (generated by `tests/fixtures/tools/ai-mask-3099.py` and
+`ai-mask-3099.jsx`, scrubbed with `scrub.py` and `stubicc`). `tests/it/import/ai_mask.rs` checks
+the import against After Effects' read-back, and the host's `vector_import` tests render it.
+
+## Tools
+
+- `tests/fixtures/tools/`: the generator of the test projects (regenerates the corpus with After
+  Effects; its README says how).
+- `examples/aepdump.rs`: prints the chunk tree of a file (ids, sizes, short data, match names):
+  `cargo run -p effectcraft-aep --example aepdump -- file.aep`.
+- `examples/stubicc.rs`: replaces every embedded ICC profile of a saved project by a stub that keeps
+  only the profile's description: the JSON `colorProfileData` of the working space (any white space
+  around the colon, `\/` escapes, quotes as `&quot;`) in an `.aep` chunk or the `.aepx` text, and a raw
+  profile of an imported image (an `.aep` chunk, or the `bdata` hex of an `.aepx`):
+  `cargo run -p effectcraft-aep --example stubicc -- in.aep out.aep`. A profile it cannot replace
+  stops it before anything is written. The importer reads the working space's name from the
+  description only, so the project imports the same; no vendor colour data stays in the test
+  project. Check the result independently, not by the tool's count (the corpus repository has
+  `tools/aep/inspect-embedded.py`, which scans the raw bytes, base64 and hex).
diff --git a/crates/aep/examples/aepdump.rs b/crates/aep/examples/aepdump.rs
new file mode 100644
index 000000000..2fe492696
--- /dev/null
+++ b/crates/aep/examples/aepdump.rs
@@ -0,0 +1,75 @@
+//! Developer tool: prints the chunk tree of an .aep (ids, sizes, short data), match names inline.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+use effectcraft_aep::{Body, Chunk};
+
+/// Ends this developer tool with a message instead of a panic.
+trait OrExit<T> {
+    fn or_exit(self, what: &str) -> T;
+}
+
+impl<T> OrExit<T> for Option<T> {
+    fn or_exit(self, what: &str) -> T {
+        match self {
+            Some(v) => v,
+            None => exit(what),
+        }
+    }
+}
+
+impl<T, E: std::fmt::Debug> OrExit<T> for Result<T, E> {
+    fn or_exit(self, what: &str) -> T {
+        match self {
+            Ok(v) => v,
+            Err(e) => exit(&format!("{what}: {e:?}")),
+        }
+    }
+}
+
+fn exit(msg: &str) -> ! {
+    eprintln!("{msg}");
+    std::process::exit(1)
+}
+
+fn show(c: &Chunk<'_>, depth: usize, max: usize, hex: usize) {
+    let ind = "  ".repeat(depth);
+    let id = String::from_utf8_lossy(&c.id).to_string();
+    match &c.body {
+        Body::Data(d) if &c.id == b"tdmn" => {
+            let n: String = d.iter().take_while(|b| **b != 0).map(|b| *b as char).collect();
+            println!("{ind}tdmn {n}");
+        }
+        Body::Data(d) => {
+            let h: String = d.iter().take(hex).map(|b| format!("{b:02x}")).collect();
+            let a: String = d.iter().take(hex).map(|b| if (32..127).contains(b) { *b as char } else { '.' }).collect();
+            println!("{ind}{id} [{}] {h} |{a}|", d.len());
+        }
+        Body::Chunks(k) => {
+            println!("{ind}{id} (nested)");
+            if depth < max {
+                for x in k {
+                    show(x, depth + 1, max, hex);
+                }
+            }
+        }
+        Body::List { list_type, children } => {
+            println!("{ind}LIST {} ({} children)", String::from_utf8_lossy(list_type), children.len());
+            if depth < max {
+                for x in children {
+                    show(x, depth + 1, max, hex);
+                }
+            }
+        }
+        Body::OpaqueList { list_type, data } => println!("{ind}LIST {} opaque [{}]", String::from_utf8_lossy(list_type), data.len()),
+    }
+}
+fn main() {
+    let a: Vec<String> = std::env::args().collect();
+    let bytes = std::fs::read(a.get(1).or_exit("usage: see the comment at the top of this file")).or_exit("read");
+    let max: usize = a.get(2).and_then(|s| s.parse().ok()).unwrap_or(4);
+    let hex: usize = a.get(3).and_then(|s| s.parse().ok()).unwrap_or(32);
+    let f = effectcraft_aep::parse(&bytes).or_exit("parse");
+    for c in &f.chunks {
+        show(c, 0, max, hex);
+    }
+    println!("trailer {} bytes", f.trailer.len());
+}
diff --git a/crates/aep/examples/stubicc.rs b/crates/aep/examples/stubicc.rs
new file mode 100644
index 000000000..9438da06d
--- /dev/null
+++ b/crates/aep/examples/stubicc.rs
@@ -0,0 +1,359 @@
+//! Developer tool: replaces every embedded ICC profile of an .aep / .aepx by a stub that keeps only the
+//! profile's description. Fixture hygiene: a saved project carries the vendor's working-space profile
+//! (a few KB of colour data); the importer reads only the profile's name, the `desc` tag, so the stub
+//! (a 128-byte header, one `desc` tag, no colour data, made here) imports identically.
+//!
+//! `cargo run -p effectcraft-aep --example stubicc -- in.aep out.aep`
+//!
+//! It handles:
+//! - the JSON value `"colorProfileData": "<base64>"` in any chunk of an .aep and anywhere in the text
+//!   of an .aepx (white space around the colon, `\/` escapes and quotes written as `&quot;` allowed);
+//! - a raw ICC profile stored as a chunk of its own (the profile of an imported image), in an .aep
+//!   as the chunk's bytes and in an .aepx as its `bdata="<hex>"` attribute.
+//!
+//! A profile it cannot replace (no readable description, data that does not decode) stops the tool
+//! before anything is written. Check the result independently (the corpus has
+//! `tools/aep/inspect-embedded.py`), not by this tool's own count.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+use effectcraft_aep::{Body, Chunk};
+
+const B64: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+/// Ends this developer tool with a message instead of a panic.
+trait OrExit<T> {
+    fn or_exit(self, what: &str) -> T;
+}
+
+impl<T> OrExit<T> for Option<T> {
+    fn or_exit(self, what: &str) -> T {
+        match self {
+            Some(v) => v,
+            None => exit(what),
+        }
+    }
+}
+
+impl<T, E: std::fmt::Debug> OrExit<T> for Result<T, E> {
+    fn or_exit(self, what: &str) -> T {
+        match self {
+            Ok(v) => v,
+            Err(e) => exit(&format!("{what}: {e:?}")),
+        }
+    }
+}
+
+fn exit(msg: &str) -> ! {
+    eprintln!("{msg}");
+    std::process::exit(1)
+}
+
+fn b64_decode(text: &[u8]) -> Option<Vec<u8>> {
+    let (mut out, mut acc, mut bits) = (Vec::new(), 0u32, 0u32);
+    for &c in text.iter().filter(|c| **c != b'=') {
+        let v = u32::try_from(B64.iter().position(|b| *b == c)?).ok()?;
+        acc = (acc << 6 | v) & 0x00ff_ffff;
+        bits += 6;
+        if bits >= 8 {
+            bits -= 8;
+            out.push(((acc >> bits) & 0xff) as u8);
+        }
+    }
+    Some(out)
+}
+
+fn b64_encode(data: &[u8]) -> Vec<u8> {
+    let mut out = Vec::new();
+    for ch in data.chunks(3) {
+        let at = |i: usize| u32::from(ch.get(i).copied().unwrap_or(0));
+        let n = (at(0) << 16) | (at(1) << 8) | at(2);
+        for i in 0..4usize {
+            if i <= ch.len() {
+                out.push(B64.get(((n >> (18 - 6 * i)) & 63) as usize).copied().unwrap_or(b'A'));
+            } else {
+                out.push(b'=');
+            }
+        }
+    }
+    out
+}
+
+fn be32(d: &[u8], at: usize) -> Option<usize> {
+    let b: [u8; 4] = d.get(at..at.checked_add(4)?)?.try_into().ok()?;
+    usize::try_from(u32::from_be_bytes(b)).ok()
+}
+
+/// The profile description (ICC.1 `desc`: v2 ASCII or v4 `mluc`, first record).
+fn description(icc: &[u8]) -> Option<String> {
+    let count = be32(icc, 128)?;
+    let tag = (0..count.min(1024)).find_map(|i| {
+        let at = 132usize.checked_add(i.checked_mul(12)?)?;
+        (icc.get(at..at.checked_add(4)?)? == b"desc").then_some(at)
+    })?;
+    let off = be32(icc, tag.checked_add(4)?)?;
+    let body = icc.get(off..off.checked_add(be32(icc, tag.checked_add(8)?)?)?)?;
+    let text = match body.get(..4)? {
+        b"desc" => {
+            let n = be32(body, 8)?;
+            String::from_utf8_lossy(body.get(12..12usize.checked_add(n)?)?.split(|b| *b == 0).next()?).into_owned()
+        }
+        b"mluc" => {
+            let (n, at) = (be32(body, 20)?, be32(body, 24)?);
+            let units: Vec<u16> = body.get(at..at.checked_add(n)?)?.chunks(2).filter_map(|p| Some(u16::from_be_bytes([*p.first()?, *p.get(1)?]))).collect();
+            String::from_utf16_lossy(&units)
+        }
+        _ => return None,
+    };
+    Some(text.trim_end_matches('\0').trim().to_owned())
+}
+
+/// A profile with a header, one `desc` tag and no colour data.
+fn stub(desc: &str) -> Option<Vec<u8>> {
+    let mut body = b"desc\0\0\0\0".to_vec();
+    body.extend_from_slice(&u32::try_from(desc.len().checked_add(1)?).ok()?.to_be_bytes());
+    body.extend_from_slice(desc.as_bytes());
+    body.push(0);
+    body.extend_from_slice(&[0; 4 + 4 + 2 + 1 + 67]);
+    let mut p = vec![0u8; 128];
+    for (at, v) in [(8, &0x0240_0000u32.to_be_bytes()[..]), (12, b"mntr"), (16, b"RGB "), (20, b"XYZ "), (36, b"acsp")] {
+        p.get_mut(at..at + v.len())?.copy_from_slice(v);
+    }
+    p.extend_from_slice(&1u32.to_be_bytes());
+    p.extend_from_slice(b"desc");
+    p.extend_from_slice(&144u32.to_be_bytes());
+    p.extend_from_slice(&u32::try_from(body.len()).ok()?.to_be_bytes());
+    p.extend_from_slice(&body);
+    let size = u32::try_from(p.len()).ok()?.to_be_bytes();
+    p.get_mut(..4)?.copy_from_slice(&size);
+    Some(p)
+}
+
+/// The JSON key, without its quotes.
+const KEY: &[u8] = b"colorProfileData";
+/// How a JSON quote is written: as is (a `Utf8` chunk, the `<string>` text of an .aepx) and as an
+/// XML entity (JSON inside an attribute of an .aepx).
+const QUOTES: [&[u8]; 2] = [b"\"", b"&quot;"];
+
+/// What the tool did, counted.
+#[derive(Default)]
+struct Tally {
+    stubbed: usize,
+    /// Values too short to be a profile (no ICC header), kept as they are.
+    kept_short: usize,
+    /// Profiles that could not be replaced (no readable description, undecodable data): the tool
+    /// fails, so no profile is ever left behind silently.
+    failed: Vec<String>,
+}
+
+fn is_profile(d: &[u8]) -> bool {
+    d.len() > 132 && d.get(36..40) == Some(b"acsp")
+}
+
+/// The stub for the bytes `d` of a value, or `None` (counted) when it holds no profile or the
+/// profile has no readable description.
+fn stub_of(d: &[u8], at: usize, tally: &mut Tally) -> Option<Vec<u8>> {
+    if !is_profile(d) {
+        tally.kept_short += 1;
+        return None;
+    }
+    let s = description(d).and_then(|t| stub(&t));
+    if s.is_none() {
+        tally.failed.push(format!("profile at byte {at}: no readable description"));
+    }
+    s
+}
+
+/// At the start of `t`: the key in quotes, optional white space, a colon, optional white space and
+/// the opening quote of the value. Returns the length up to and including that quote, and the quote.
+fn value_start(t: &[u8]) -> Option<(usize, &'static [u8])> {
+    let ws = |mut i: usize| {
+        while t.get(i).is_some_and(u8::is_ascii_whitespace) {
+            i += 1;
+        }
+        i
+    };
+    QUOTES.into_iter().find_map(|q| {
+        let key_end = q.len().checked_mul(2)?.checked_add(KEY.len())?;
+        let quoted = t.get(..key_end)?;
+        if !(quoted.starts_with(q) && quoted.get(q.len()..q.len() + KEY.len())? == KEY && quoted.ends_with(q)) {
+            return None;
+        }
+        let colon = ws(key_end);
+        if t.get(colon) != Some(&b':') {
+            return None;
+        }
+        let open = ws(colon + 1);
+        t.get(open..)?.starts_with(q).then_some((open + q.len(), q))
+    })
+}
+
+fn hex_decode(h: &[u8]) -> Option<Vec<u8>> {
+    if !h.len().is_multiple_of(2) {
+        return None;
+    }
+    h.chunks(2).map(|p| u8::from_str_radix(std::str::from_utf8(p).ok()?, 16).ok()).collect()
+}
+
+fn hex_encode(d: &[u8], upper: bool) -> Vec<u8> {
+    d.iter().flat_map(|b| if upper { format!("{b:02X}") } else { format!("{b:02x}") }.into_bytes()).collect()
+}
+
+/// Replaces, in `text`, every `colorProfileData` JSON value (base64; `\/` escapes, white space
+/// around the colon and quotes written as `&quot;` allowed) and every .aepx `bdata="<hex>"`
+/// attribute that holds a raw profile.
+fn stub_text(text: &[u8], tally: &mut Tally) -> Vec<u8> {
+    const BDATA: &[u8] = b"bdata=\"";
+    let (mut out, mut i) = (Vec::with_capacity(text.len()), 0);
+    while let Some(&b) = text.get(i) {
+        let rest = text.get(i..).unwrap_or_default();
+        if let Some((open, q)) = value_start(rest)
+            && let Some(len) = rest.get(open..).and_then(|v| v.windows(q.len()).position(|w| w == q))
+        {
+            let raw = rest.get(open..open + len).unwrap_or_default();
+            let unescaped: Vec<u8> = raw.iter().copied().filter(|c| *c != b'\\').collect();
+            let replaced = match b64_decode(&unescaped) {
+                Some(d) => stub_of(&d, i, tally).map(|s| b64_encode(&s)),
+                None => {
+                    tally.failed.push(format!("colorProfileData at byte {i}: not base64"));
+                    None
+                }
+            };
+            out.extend_from_slice(rest.get(..open).unwrap_or_default());
+            match replaced {
+                Some(enc) => {
+                    out.extend_from_slice(&enc);
+                    tally.stubbed += 1;
+                }
+                None => out.extend_from_slice(raw),
+            }
+            i += open + len;
+            continue;
+        }
+        if rest.starts_with(BDATA)
+            && let Some(len) = rest.get(BDATA.len()..).and_then(|v| v.iter().position(|c| *c == b'"'))
+        {
+            let hex = rest.get(BDATA.len()..BDATA.len() + len).unwrap_or_default();
+            let replaced = hex_decode(hex).filter(|d| is_profile(d)).and_then(|d| stub_of(&d, i, tally));
+            out.extend_from_slice(BDATA);
+            match replaced {
+                Some(s) => {
+                    out.extend_from_slice(&hex_encode(&s, hex.iter().any(u8::is_ascii_uppercase)));
+                    tally.stubbed += 1;
+                }
+                None => out.extend_from_slice(hex),
+            }
+            i += BDATA.len() + len;
+            continue;
+        }
+        out.push(b);
+        i += 1;
+    }
+    out
+}
+
+fn walk(chunks: &mut [Chunk<'_>], tally: &mut Tally) {
+    for c in chunks.iter_mut() {
+        // Only a data chunk is rewritten as one: an opaque `LIST` also has bytes, but replacing it by
+        // a data chunk would drop its list type.
+        let data = if let Body::Data(d) = &c.body { Some(d.to_vec()) } else { None };
+        match data {
+            Some(d) if d.windows(KEY.len()).any(|w| w == KEY) => {
+                let new = stub_text(&d, tally);
+                *c = Chunk::data(c.id, new);
+            }
+            Some(d) if is_profile(&d) => {
+                if let Some(s) = stub_of(&d, 0, tally) {
+                    *c = Chunk::data(c.id, s);
+                    tally.stubbed += 1;
+                }
+            }
+            _ => {
+                if let Body::List { children, .. } | Body::Chunks(children) = &mut c.body {
+                    walk(children, tally);
+                }
+            }
+        }
+    }
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let (Some(input), Some(output)) = (args.get(1), args.get(2)) else { exit("usage: stubicc <in.aep|in.aepx> <out>") };
+    let bytes = std::fs::read(input).or_exit("read the input");
+    let mut tally = Tally::default();
+    let out = if input.ends_with(".aepx") {
+        stub_text(&bytes, &mut tally)
+    } else {
+        let mut file = effectcraft_aep::parse(&bytes).or_exit("parse the input");
+        walk(&mut file.chunks, &mut tally);
+        effectcraft_aep::write(&file).or_exit("write the output")
+    };
+    if !tally.failed.is_empty() {
+        exit(&format!("nothing written: {} profile(s) could not be replaced:\n{}", tally.failed.len(), tally.failed.join("\n")));
+    }
+    std::fs::write(output, out).or_exit("write the output");
+    println!("stubbed {} profile(s); kept {} short value(s) that hold no profile", tally.stubbed, tally.kept_short);
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn profile(desc: &str) -> Vec<u8> {
+        // A profile with colour data after the description (like a real one): the stub of `desc`
+        // plus 3000 bytes, its size field updated.
+        let mut p = stub(desc).unwrap();
+        p.extend(std::iter::repeat_n(0x5a, 3000));
+        let size = u32::try_from(p.len()).unwrap().to_be_bytes();
+        p[..4].copy_from_slice(&size);
+        p
+    }
+
+    fn stubbed(text: &[u8]) -> (Vec<u8>, Tally) {
+        let mut tally = Tally::default();
+        (stub_text(text, &mut tally), tally)
+    }
+
+    #[test]
+    fn json_values_in_every_spelling_are_replaced() {
+        let b64 = String::from_utf8(b64_encode(&profile("sRGB IEC61966-2.1"))).unwrap();
+        let want = String::from_utf8(b64_encode(&stub("sRGB IEC61966-2.1").unwrap())).unwrap();
+        for (before, after) in [
+            (format!("{{\"colorProfileData\":\"{b64}\"}}"), format!("{{\"colorProfileData\":\"{want}\"}}")),
+            (format!("{{\"colorProfileData\" : \n\t\"{b64}\"}}"), format!("{{\"colorProfileData\" : \n\t\"{want}\"}}")),
+            (format!("{{\"colorProfileData\":\"{}\"}}", b64.replace('/', "\\/")), format!("{{\"colorProfileData\":\"{want}\"}}")),
+            (format!("{{&quot;colorProfileData&quot;: &quot;{b64}&quot;}}"), format!("{{&quot;colorProfileData&quot;: &quot;{want}&quot;}}")),
+        ] {
+            let (out, tally) = stubbed(before.as_bytes());
+            assert_eq!(String::from_utf8(out).unwrap(), after);
+            assert_eq!((tally.stubbed, tally.failed.len()), (1, 0));
+        }
+    }
+
+    #[test]
+    fn a_raw_profile_in_aepx_hex_is_replaced_and_other_hex_kept() {
+        let hex = String::from_utf8(hex_encode(&profile("Rec.709 Gamma 2.4"), false)).unwrap();
+        let want = String::from_utf8(hex_encode(&stub("Rec.709 Gamma 2.4").unwrap(), false)).unwrap();
+        let text = format!("<icc bdata=\"{hex}\"/><PwCs bdata=\"01\"/><cdta bdata=\"{}\"/>", "ab".repeat(200));
+        let (out, tally) = stubbed(text.as_bytes());
+        assert_eq!(String::from_utf8(out).unwrap(), format!("<icc bdata=\"{want}\"/><PwCs bdata=\"01\"/><cdta bdata=\"{}\"/>", "ab".repeat(200)));
+        assert_eq!((tally.stubbed, tally.failed.len()), (1, 0));
+        // Upper-case hex stays upper case.
+        let (out, _) = stubbed(format!("bdata=\"{}\"", hex.to_uppercase()).as_bytes());
+        assert_eq!(String::from_utf8(out).unwrap(), format!("bdata=\"{}\"", want.to_uppercase()));
+    }
+
+    #[test]
+    fn a_profile_that_cannot_be_replaced_is_a_failure_not_a_silent_copy() {
+        // An ICC header whose tag table has no `desc`.
+        let mut p = profile("x");
+        p[132..136].copy_from_slice(b"wtpt");
+        let (_, tally) = stubbed(format!("\"colorProfileData\":\"{}\"", String::from_utf8(b64_encode(&p)).unwrap()).as_bytes());
+        assert_eq!((tally.stubbed, tally.failed.len()), (0, 1));
+        let (_, tally) = stubbed(b"\"colorProfileData\":\"not*base64\"");
+        assert_eq!(tally.failed.len(), 1);
+        // A short value holds no profile: kept and counted, not a failure.
+        let (out, tally) = stubbed(b"\"colorProfileData\":\"AAAA\"");
+        assert_eq!((out.as_slice(), tally.kept_short, tally.failed.len()), (&b"\"colorProfileData\":\"AAAA\""[..], 1, 0));
+    }
+}
diff --git a/crates/aep/src/container.rs b/crates/aep/src/container.rs
new file mode 100644
index 000000000..531d74843
--- /dev/null
+++ b/crates/aep/src/container.rs
@@ -0,0 +1,61 @@
+//! After Effects project (`.aep`) container reader and writer.
+//!
+//! An `.aep` is a `RIFX` container (big-endian RIFF) with form type `Egg!`. This crate reads it
+//! into a lossless chunk tree ([`AepFile`]) and writes it back byte for byte. The XML form of a
+//! project (`.aepx`) is read into the same tree by [`read_aepx`]; [`parse_any`] picks the reader
+//! by content. See
+//! `docs/aep-format.md` for the observed format and how it was established (clean room: only
+//! files we generated ourselves, one change per file).
+//!
+//! [`Project::new`] opens a typed, read-only view over the tree: items, compositions
+//! ([`CompHeader`]), layers ([`LayerHeader`], [`Transform`], effects, masks, text documents,
+//! markers), properties, keyframes and footage. Only fields whose layout was verified against the
+//! values the test files were made with are decoded; every accessor returns `None` (or an empty
+//! list) on damaged data instead of failing.
+
+mod aepx;
+mod arbitrary;
+mod bytes;
+mod camera;
+mod chunk;
+pub mod effect_map;
+mod effects;
+mod error;
+mod footage;
+mod header;
+mod keys;
+mod masks;
+mod matte;
+mod read;
+mod settings;
+mod shapes;
+pub mod style_map;
+mod textdoc;
+mod typed;
+mod values;
+mod version;
+mod write;
+
+pub use aepx::{is_aepx, parse_any, read_aepx, read_aepx_with_limits};
+pub use arbitrary::{
+    CURVE_IDENTITY, CryptomatteData, CurvesData, ExtractorChannels, HueSaturationData, LevelsData, MeshData, curve_lut, identifier_channel_type,
+};
+pub use camera::{CameraPosition, DEFAULT_CAMERA_ZOOM};
+pub use chunk::{AepFile, Body, Chunk, LIST, NESTED_IDS, Walk};
+pub use effects::{DefinitionSource, Effect, EffectDefinitions, EffectParam, LayerRef, ParamKind, ParamValue};
+pub use error::AepError;
+pub use footage::{Footage, SequenceInfo};
+pub use header::{BlendMode, CompHeader, LayerHeader, LayerType, LightType, Quality, Rational, Renderer};
+pub use keys::{ExpressionFlags, Interpolation, KeyEase, KeyframeKind, SpatialKey};
+pub use masks::{Mask, MaskAtom, MaskMode, PathVertex, ShapePath};
+pub use matte::{MatteMode, TrackMatte};
+pub use read::{Limits, parse, parse_with_limits};
+pub use settings::{ProjectSettings, TimeDisplay, WorkingSpace};
+pub use shapes::{GradientType, PolystarType, ShapeDetail, ShapeGroup, ShapeItem, Stroke, StrokeCap, StrokeJoin};
+pub use textdoc::{
+    AutoKern, Caps, CueType, FontBaseline, Justification, KernRun, Marker, ParagraphRun, StyleRun, TextBox, TextDocument, TextValue, parse_text_dict,
+};
+pub use typed::{Comp, Item, ItemKind, KeyLayout, KeyList, Keyframe, Layer, ListHeader, Project, PropEntry, PropGroup, PropNode, Property, TimeBase};
+pub use values::{Orientation, OrientationKey, TimeRemap, TimeRemapKey, Tracked, Transform, ValueSource};
+pub use version::AeVersion;
+pub use write::{write, write_to};
diff --git a/crates/aep/src/container/aepx.rs b/crates/aep/src/container/aepx.rs
new file mode 100644
index 000000000..a45cbae1d
--- /dev/null
+++ b/crates/aep/src/container/aepx.rs
@@ -0,0 +1,640 @@
+//! Reading the XML form of a project (`.aepx`) into the same chunk tree as an `.aep`.
+//!
+//! An `.aepx` is the `RIFX` chunk tree written as XML: one element per chunk, named by the chunk
+//! id (or the list type of a `LIST`), with the body as hex in a `bdata` attribute. A few chunks
+//! are written as text instead (`Utf8` as `<string>`, the numbers `numS` and `ppSn`, the footage
+//! alias `alas` as `<fileReference>`), and the XMP packet that follows the container of an `.aep`
+//! is the element `<ProjectXMPMetadata>`. The mapping, with the cases it was found on, is in
+//! `docs/aep-format.md` (section 1.1).
+//!
+//! The reader is a small XML tokenizer for exactly that subset: elements, attributes, text, the
+//! five predefined entities and character references, CDATA, comments and processing
+//! instructions. A document type declaration is refused (no entity expansion). It runs without
+//! recursion; the nesting depth and the element count are bounded by [`Limits`], and everything
+//! it allocates is bounded by the size of the input.
+
+use std::borrow::Cow;
+
+use crate::container::chunk::{AepFile, Body, Chunk, LIST, NESTED_IDS};
+use crate::container::error::AepError;
+use crate::container::read::{Limits, parse};
+
+/// The root element of an `.aepx`.
+const ROOT: &[u8] = b"AfterEffectsProject";
+/// The element that holds the XMP packet (the trailer of an `.aep`).
+const XMP: &[u8] = b"ProjectXMPMetadata";
+/// The element of a `Utf8` chunk.
+const STRING: &[u8] = b"string";
+/// The element of an `alas` chunk (footage alias), written as attributes instead of JSON.
+const FILE_REFERENCE: &[u8] = b"fileReference";
+
+/// List types whose body is not a chunk sequence: the `.aepx` writes them like data chunks (with
+/// `bdata`), the `.aep` as an opaque `LIST`.
+const OPAQUE_LIST_TYPES: [[u8; 4]; 1] = [*b"btdk"];
+
+/// True when `data` looks like an `.aepx`: optional UTF-8 byte order mark and white space, then
+/// an XML declaration or the `AfterEffectsProject` root element.
+pub fn is_aepx(data: &[u8]) -> bool {
+    let rest = data.strip_prefix(&[0xef, 0xbb, 0xbf][..]).unwrap_or(data);
+    let start = rest.iter().position(|b| !b.is_ascii_whitespace()).unwrap_or(rest.len());
+    let rest = rest.get(start..).unwrap_or(&[]);
+    rest.starts_with(b"<?xml") || rest.starts_with(b"<AfterEffectsProject")
+}
+
+/// Reads an `.aep` or an `.aepx`, chosen by content: a `RIFX` file goes to [`parse`], an XML file
+/// (see [`is_aepx`]) to [`read_aepx`].
+///
+/// # Errors
+/// The errors of [`parse`] or [`read_aepx`].
+pub fn parse_any(data: &[u8]) -> Result<AepFile<'_>, AepError> {
+    if is_aepx(data) { read_aepx(data) } else { parse(data) }
+}
+
+/// Reads an `.aepx` with the default [`Limits`] into the chunk tree an `.aep` of the same project
+/// gives.
+///
+/// # Errors
+/// [`AepError::Xml`] for input that is not well-formed XML of the `.aepx` subset (bad UTF-8, an
+/// unknown entity, an unclosed or mismatched tag, invalid or odd-length hex, a number that does
+/// not parse, a document type declaration, a root element other than `AfterEffectsProject`);
+/// [`AepError::TooDeep`] / [`AepError::TooManyChunks`] beyond the limits.
+pub fn read_aepx(data: &[u8]) -> Result<AepFile<'static>, AepError> {
+    read_aepx_with_limits(data, Limits::default())
+}
+
+/// Like [`read_aepx`] with explicit [`Limits`]: `max_depth` bounds the element nesting (the root
+/// element's children are depth 1), `max_chunks` the number of elements.
+///
+/// # Errors
+/// See [`read_aepx`].
+pub fn read_aepx_with_limits(data: &[u8], limits: Limits) -> Result<AepFile<'static>, AepError> {
+    let text = match std::str::from_utf8(data) {
+        Ok(t) => t.as_bytes(),
+        Err(e) => return Err(xml(e.valid_up_to(), "the file is not valid UTF-8")),
+    };
+    Reader { data: text, pos: 0, limits, count: 0, stack: Vec::new(), top: None, trailer: None }.run()
+}
+
+fn xml(offset: usize, what: &'static str) -> AepError {
+    AepError::Xml { offset, what }
+}
+
+/// What an open element becomes when it closes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Kind {
+    /// The root element: its children are the top-level chunks.
+    Root,
+    /// A chunk with this id (or a `LIST` with this list type).
+    Chunk([u8; 4]),
+    /// A `Utf8` chunk.
+    Utf8,
+    /// An `alas` chunk built from the attributes.
+    Alias,
+    /// The XMP packet (only directly below the root).
+    Xmp,
+    /// An element without a chunk counterpart (a name that is no chunk id); skipped with its content.
+    Skip,
+}
+
+struct Frame {
+    kind: Kind,
+    /// Offset of the start tag (for errors).
+    at: usize,
+    /// The name as written, to match the end tag.
+    name: (usize, usize),
+    /// The decoded `bdata` attribute.
+    bdata: Option<Vec<u8>>,
+    /// The attributes of a `fileReference`, in document order.
+    attrs: Vec<(String, String)>,
+    /// Collected text (only for `string` and the XMP packet).
+    text: Vec<u8>,
+    children: Vec<Chunk<'static>>,
+}
+
+struct Reader<'d> {
+    data: &'d [u8],
+    pos: usize,
+    limits: Limits,
+    count: usize,
+    stack: Vec<Frame>,
+    /// The top-level chunks once the root element has closed.
+    top: Option<Vec<Chunk<'static>>>,
+    trailer: Option<Vec<u8>>,
+}
+
+impl Reader<'_> {
+    fn run(mut self) -> Result<AepFile<'static>, AepError> {
+        if self.data.starts_with(&[0xef, 0xbb, 0xbf]) {
+            self.pos = 3;
+        }
+        while self.pos < self.data.len() {
+            if self.rest().starts_with(b"<") {
+                self.markup()?;
+            } else {
+                self.text()?;
+            }
+        }
+        if let Some(open) = self.stack.last() {
+            return Err(xml(open.at, "an element is not closed before the end of the file"));
+        }
+        let chunks = self.top.ok_or_else(|| xml(self.data.len(), "no AfterEffectsProject root element"))?;
+        Ok(AepFile { chunks, trailer: Cow::Owned(self.trailer.unwrap_or_default()) })
+    }
+
+    fn rest(&self) -> &[u8] {
+        self.data.get(self.pos..).unwrap_or(&[])
+    }
+
+    /// The offset of `needle` at or after `from`.
+    fn find(&self, from: usize, needle: &[u8]) -> Option<usize> {
+        let hay = self.data.get(from..)?;
+        if needle.is_empty() || hay.len() < needle.len() {
+            return None;
+        }
+        let first = *needle.first()?;
+        let mut i = 0;
+        while let Some(p) = hay.get(i..)?.iter().position(|b| *b == first) {
+            let at = i.checked_add(p)?;
+            if hay.get(at..)?.starts_with(needle) {
+                return from.checked_add(at);
+            }
+            i = at.checked_add(1)?;
+        }
+        None
+    }
+
+    /// Skips to just after `close`, which must follow.
+    fn skip_past(&mut self, close: &[u8], what: &'static str) -> Result<usize, AepError> {
+        let at = self.find(self.pos, close).ok_or(xml(self.pos, what))?;
+        self.pos = at.saturating_add(close.len());
+        Ok(at)
+    }
+
+    fn markup(&mut self) -> Result<(), AepError> {
+        let rest = self.rest();
+        if rest.starts_with(b"<?") {
+            self.skip_past(b"?>", "a processing instruction is not closed")?;
+        } else if rest.starts_with(b"<!--") {
+            self.skip_past(b"-->", "a comment is not closed")?;
+        } else if rest.starts_with(b"<![CDATA[") {
+            let start = self.pos.saturating_add(9);
+            self.pos = start;
+            let end = self.skip_past(b"]]>", "a CDATA section is not closed")?;
+            let content = self.data.get(start..end).unwrap_or(&[]);
+            let at = start;
+            match self.stack.last_mut() {
+                Some(frame) => {
+                    if matches!(frame.kind, Kind::Utf8 | Kind::Xmp) {
+                        frame.text.extend_from_slice(content);
+                    }
+                }
+                None => return Err(xml(at, "CDATA outside the root element")),
+            }
+        } else if rest.starts_with(b"<!") {
+            return Err(xml(self.pos, "document type declarations are not supported"));
+        } else if rest.starts_with(b"</") {
+            self.end_tag()?;
+        } else {
+            self.start_tag()?;
+        }
+        Ok(())
+    }
+
+    fn is_name_byte(b: u8) -> bool {
+        !(b.is_ascii_whitespace() || matches!(b, b'<' | b'>' | b'/' | b'=' | b'"' | b'\'' | b'&'))
+    }
+
+    fn name(&mut self) -> Result<(usize, usize), AepError> {
+        let start = self.pos;
+        let len = self.rest().iter().position(|b| !Self::is_name_byte(*b)).unwrap_or(self.rest().len());
+        if len == 0 {
+            return Err(xml(start, "a tag or attribute has no name"));
+        }
+        self.pos = start.saturating_add(len);
+        Ok((start, self.pos))
+    }
+
+    fn skip_ws(&mut self) {
+        let n = self.rest().iter().position(|b| !b.is_ascii_whitespace()).unwrap_or(self.rest().len());
+        self.pos = self.pos.saturating_add(n);
+    }
+
+    fn slice(&self, (a, b): (usize, usize)) -> &[u8] {
+        self.data.get(a..b).unwrap_or(&[])
+    }
+
+    fn start_tag(&mut self) -> Result<(), AepError> {
+        let at = self.pos;
+        self.pos = self.pos.saturating_add(1);
+        let name = self.name()?;
+        let mut attrs: Vec<((usize, usize), Vec<u8>)> = Vec::new();
+        let self_closing = loop {
+            self.skip_ws();
+            let rest = self.rest();
+            if rest.starts_with(b"/>") {
+                self.pos = self.pos.saturating_add(2);
+                break true;
+            }
+            if rest.starts_with(b">") {
+                self.pos = self.pos.saturating_add(1);
+                break false;
+            }
+            if rest.is_empty() {
+                return Err(xml(at, "a start tag is not closed"));
+            }
+            let key = self.name()?;
+            self.skip_ws();
+            if !self.rest().starts_with(b"=") {
+                return Err(xml(self.pos, "an attribute has no value"));
+            }
+            self.pos = self.pos.saturating_add(1);
+            self.skip_ws();
+            let quote = *self.rest().first().ok_or(xml(self.pos, "a start tag is not closed"))?;
+            if quote != b'"' && quote != b'\'' {
+                return Err(xml(self.pos, "an attribute value is not quoted"));
+            }
+            let vstart = self.pos.saturating_add(1);
+            let vend = self.find(vstart, &[quote]).ok_or(xml(vstart, "an attribute value is not closed"))?;
+            let raw = self.data.get(vstart..vend).unwrap_or(&[]);
+            if raw.contains(&b'<') {
+                return Err(xml(vstart, "`<` inside an attribute value"));
+            }
+            let mut value = Vec::new();
+            decode_entities(raw, vstart, &mut value)?;
+            self.pos = vend.saturating_add(1);
+            attrs.push((key, value));
+        };
+        let kind = self.kind_of(name, at)?;
+        if kind != Kind::Root {
+            self.count = self.count.saturating_add(1);
+            if self.count > self.limits.max_chunks {
+                return Err(AepError::TooManyChunks);
+            }
+            // The root's children are depth 1, like the top-level chunks of an `.aep`.
+            if self.stack.len() > self.limits.max_depth {
+                return Err(AepError::TooDeep);
+            }
+        }
+        let mut frame = Frame { kind, at, name, bdata: None, attrs: Vec::new(), text: Vec::new(), children: Vec::new() };
+        if matches!(kind, Kind::Chunk(_)) {
+            if let Some((key, value)) = attrs.iter().find(|(k, _)| self.slice(*k) == b"bdata") {
+                frame.bdata = Some(decode_hex(value, key.1)?);
+            }
+        } else if kind == Kind::Alias {
+            frame.attrs = attrs.iter().map(|(k, v)| (String::from_utf8_lossy(self.slice(*k)).into_owned(), String::from_utf8_lossy(v).into_owned())).collect();
+        }
+        self.stack.push(frame);
+        if self_closing {
+            self.close()?;
+        }
+        Ok(())
+    }
+
+    /// Classifies an element by its name and where it is.
+    fn kind_of(&self, name: (usize, usize), at: usize) -> Result<Kind, AepError> {
+        let n = self.slice(name);
+        let parent = match self.stack.last() {
+            None => {
+                if self.top.is_some() {
+                    return Err(xml(at, "a second root element"));
+                }
+                if n != ROOT {
+                    return Err(xml(at, "the root element is not AfterEffectsProject"));
+                }
+                return Ok(Kind::Root);
+            }
+            Some(p) => p.kind,
+        };
+        Ok(match parent {
+            Kind::Skip | Kind::Utf8 | Kind::Xmp | Kind::Alias => Kind::Skip,
+            Kind::Root | Kind::Chunk(_) => {
+                if n == STRING {
+                    Kind::Utf8
+                } else if n == FILE_REFERENCE {
+                    Kind::Alias
+                } else if n == XMP && parent == Kind::Root {
+                    Kind::Xmp
+                } else if let Some(id) = chunk_id(n) {
+                    Kind::Chunk(id)
+                } else {
+                    Kind::Skip
+                }
+            }
+        })
+    }
+
+    fn end_tag(&mut self) -> Result<(), AepError> {
+        let at = self.pos;
+        self.pos = self.pos.saturating_add(2);
+        let name = self.name()?;
+        self.skip_ws();
+        if !self.rest().starts_with(b">") {
+            return Err(xml(at, "an end tag is not closed"));
+        }
+        self.pos = self.pos.saturating_add(1);
+        let open = self.stack.last().ok_or(xml(at, "an end tag without a start tag"))?;
+        if self.slice(open.name) != self.slice(name) {
+            return Err(xml(at, "an end tag does not match its start tag"));
+        }
+        self.close()
+    }
+
+    /// Closes the innermost element and hands its chunk to the parent.
+    fn close(&mut self) -> Result<(), AepError> {
+        let frame = self.stack.pop().ok_or(xml(self.pos, "an end tag without a start tag"))?;
+        let chunk = match frame.kind {
+            Kind::Root => {
+                self.top = Some(frame.children);
+                return Ok(());
+            }
+            Kind::Skip => return Ok(()),
+            Kind::Xmp => {
+                if self.trailer.is_none() {
+                    self.trailer = Some(frame.text);
+                }
+                return Ok(());
+            }
+            Kind::Utf8 => Chunk::data(*b"Utf8", frame.text),
+            Kind::Alias => Chunk::data(*b"alas", alias_json(&frame.attrs).into_bytes()),
+            Kind::Chunk(id) => chunk_of(id, frame)?,
+        };
+        if let Some(parent) = self.stack.last_mut() {
+            parent.children.push(chunk);
+        }
+        Ok(())
+    }
+
+    fn text(&mut self) -> Result<(), AepError> {
+        let start = self.pos;
+        let len = self.rest().iter().position(|b| *b == b'<').unwrap_or(self.rest().len());
+        let end = start.saturating_add(len);
+        self.pos = end;
+        let raw = self.data.get(start..end).unwrap_or(&[]);
+        match self.stack.last_mut() {
+            Some(frame) if matches!(frame.kind, Kind::Utf8 | Kind::Xmp) => decode_entities(raw, start, &mut frame.text),
+            Some(_) => Ok(()),
+            None if raw.iter().all(u8::is_ascii_whitespace) => Ok(()),
+            None => Err(xml(start, "text outside the root element")),
+        }
+    }
+}
+
+/// The chunk id of an element name: 1 to 4 printable ASCII bytes, padded with spaces (`Pin` is
+/// the list type `Pin `).
+fn chunk_id(name: &[u8]) -> Option<[u8; 4]> {
+    if name.is_empty() || name.len() > 4 || !name.iter().all(|b| b.is_ascii_graphic()) {
+        return None;
+    }
+    let mut id = [b' '; 4];
+    for (d, s) in id.iter_mut().zip(name) {
+        *d = *s;
+    }
+    Some(id)
+}
+
+/// The chunk of a closed element named by a chunk id.
+fn chunk_of(id: [u8; 4], frame: Frame) -> Result<Chunk<'static>, AepError> {
+    if let Some(bytes) = frame.bdata {
+        if OPAQUE_LIST_TYPES.contains(&id) {
+            let pad = if bytes.len() % 2 == 1 { Some(0) } else { None };
+            return Ok(Chunk { id: LIST, body: Body::OpaqueList { list_type: id, data: Cow::Owned(bytes) }, pad });
+        }
+        return Ok(Chunk::data(id, bytes));
+    }
+    // Numbers written as text: `<numS><string>0</string></numS>` and `<ppSn><string>150.000000000</string></ppSn>`.
+    if &id == b"numS" || &id == b"ppSn" {
+        let text = match frame.children.as_slice() {
+            [only] if only.is(b"Utf8") => only.bytes().unwrap_or(&[]),
+            _ => return Err(xml(frame.at, "a numS or ppSn element without its number")),
+        };
+        let text = std::str::from_utf8(text).map_err(|_| xml(frame.at, "a number is not text"))?.trim();
+        let body = if &id == b"numS" {
+            // Only `0` is sampled, so whether the field is signed is open: accept both readings of 4 bytes.
+            let n = text.parse::<i64>().ok().filter(|n| (i64::from(i32::MIN)..=i64::from(u32::MAX)).contains(n));
+            let n = n.ok_or(xml(frame.at, "numS is not a 32-bit integer"))?;
+            (n as u32).to_be_bytes().to_vec()
+        } else {
+            text.parse::<f64>().map_err(|_| xml(frame.at, "ppSn is not a number"))?.to_be_bytes().to_vec()
+        };
+        return Ok(Chunk::data(id, body));
+    }
+    if NESTED_IDS.contains(&id) {
+        if frame.children.is_empty() {
+            return Ok(Chunk::data(id, Vec::new()));
+        }
+        return Ok(Chunk { id, body: Body::Chunks(frame.children), pad: None });
+    }
+    Ok(Chunk::list(id, frame.children))
+}
+
+/// Appends `raw` with the predefined entities and character references decoded.
+fn decode_entities(raw: &[u8], offset: usize, out: &mut Vec<u8>) -> Result<(), AepError> {
+    let mut i = 0;
+    while let Some(rest) = raw.get(i..) {
+        let Some(amp) = rest.iter().position(|b| *b == b'&') else {
+            out.extend_from_slice(rest);
+            break;
+        };
+        out.extend_from_slice(rest.get(..amp).unwrap_or(&[]));
+        let at = offset.saturating_add(i).saturating_add(amp);
+        let after = rest.get(amp.saturating_add(1)..).unwrap_or(&[]);
+        let semi = after.iter().take(12).position(|b| *b == b';').ok_or(xml(at, "an entity is not terminated"))?;
+        let name = after.get(..semi).unwrap_or(&[]);
+        let ch = match name {
+            b"amp" => '&',
+            b"lt" => '<',
+            b"gt" => '>',
+            b"quot" => '"',
+            b"apos" => '\'',
+            _ => {
+                let code = if let Some(hex) = name.strip_prefix(b"#x").or_else(|| name.strip_prefix(b"#X")) {
+                    std::str::from_utf8(hex).ok().and_then(|h| u32::from_str_radix(h, 16).ok())
+                } else if let Some(dec) = name.strip_prefix(b"#") {
+                    std::str::from_utf8(dec).ok().and_then(|d| d.parse::<u32>().ok())
+                } else {
+                    return Err(xml(at, "an unknown entity"));
+                };
+                code.filter(|c| *c != 0).and_then(char::from_u32).ok_or(xml(at, "an invalid character reference"))?
+            }
+        };
+        let mut buf = [0u8; 4];
+        out.extend_from_slice(ch.encode_utf8(&mut buf).as_bytes());
+        i = i.saturating_add(amp).saturating_add(semi).saturating_add(2);
+    }
+    Ok(())
+}
+
+/// Decodes a `bdata` value (hex digits, two per byte).
+fn decode_hex(text: &[u8], offset: usize) -> Result<Vec<u8>, AepError> {
+    if text.len() % 2 == 1 {
+        return Err(xml(offset, "bdata has an odd number of hex digits"));
+    }
+    let digit = |b: u8| match b {
+        b'0'..=b'9' => Some(b - b'0'),
+        b'a'..=b'f' => Some(b - b'a' + 10),
+        b'A'..=b'F' => Some(b - b'A' + 10),
+        _ => None,
+    };
+    let (pairs, _) = text.as_chunks::<2>();
+    pairs
+        .iter()
+        .map(|[hi, lo]| digit(*hi).zip(digit(*lo)).map(|(h, l)| (h << 4) | l))
+        .collect::<Option<Vec<u8>>>()
+        .ok_or(xml(offset, "bdata holds a character that is not a hex digit"))
+}
+
+/// The JSON body of an `alas` chunk from the attributes of a `fileReference`, keys in document
+/// order (alphabetical in every sample, as in the `.aep`): the two `ascendcount_*` values as
+/// numbers, `platform` `Win` as `1`, `target_is_folder` `0` / `1` as `false` / `true`, everything
+/// else as a string.
+fn alias_json(attrs: &[(String, String)]) -> String {
+    let mut out = String::from("{");
+    for (i, (key, value)) in attrs.iter().enumerate() {
+        if i > 0 {
+            out.push(',');
+        }
+        json_str(&mut out, key);
+        out.push(':');
+        let number = value.parse::<i64>().ok();
+        match (key.as_str(), value.as_str()) {
+            ("ascendcount_base" | "ascendcount_target", _) if number.is_some() => out.push_str(value),
+            ("platform", "Win") => out.push('1'),
+            ("platform", _) if number.is_some() => out.push_str(value),
+            ("target_is_folder", "0" | "false") => out.push_str("false"),
+            ("target_is_folder", "1" | "true") => out.push_str("true"),
+            _ => json_str(&mut out, value),
+        }
+    }
+    out.push('}');
+    out
+}
+
+fn json_str(out: &mut String, s: &str) {
+    out.push('"');
+    for c in s.chars() {
+        match c {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if u32::from(c) < 0x20 => out.push_str(&format!("\\u{:04x}", u32::from(c))),
+            c => out.push(c),
+        }
+    }
+    out.push('"');
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn doc(body: &str) -> String {
+        format!("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<AfterEffectsProject xmlns=\"x\">{body}</AfterEffectsProject>\n")
+    }
+
+    #[test]
+    fn maps_elements_to_chunks() {
+        let x = doc(concat!(
+            "<head bdata=\"00ff\"/><Pin><sspc bdata=\"01\"/></Pin><Pefl>\n</Pefl>",
+            "<tdsn><string>A &amp; B&#x41;</string></tdsn><numS><string>-3</string></numS>",
+            "<ppSn><string>150.000000000</string></ppSn><btdk bdata=\"414243\"/><Comment>x<a bdata=\"00\"/></Comment>",
+            "<ProjectXMPMetadata><![CDATA[<?xpacket begin?>]]></ProjectXMPMetadata>"
+        ));
+        let f = read_aepx(x.as_bytes()).unwrap();
+        assert_eq!(f.trailer.as_ref(), b"<?xpacket begin?>");
+        let ids: Vec<_> = f.chunks.iter().map(|c| (c.id, c.list_type())).collect();
+        assert_eq!(
+            ids,
+            vec![
+                (*b"head", None),
+                (LIST, Some(*b"Pin ")),
+                (LIST, Some(*b"Pefl")),
+                (*b"tdsn", None),
+                (*b"numS", None),
+                (*b"ppSn", None),
+                (LIST, Some(*b"btdk"))
+            ]
+        );
+        assert_eq!(f.chunks[1].children()[0].bytes(), Some(&[1u8][..]));
+        assert_eq!(f.chunks[1].children()[0].pad, Some(0));
+        assert_eq!(f.chunks[3].children()[0].bytes(), Some(&b"A & BA"[..]));
+        assert_eq!(f.chunks[4].bytes(), Some(&(-3i32).to_be_bytes()[..]));
+        assert_eq!(f.chunks[5].bytes(), Some(&150f64.to_be_bytes()[..]));
+        assert_eq!(f.chunks[6].bytes(), Some(&b"ABC"[..]));
+        // The tree writes as a valid `.aep` that parses back to itself.
+        let bin = crate::container::write(&f).unwrap();
+        assert_eq!(parse(&bin).unwrap(), f);
+    }
+
+    #[test]
+    fn file_reference_becomes_alias_json() {
+        let x = doc(concat!(
+            "<Als2><fileReference ascendcount_base=\"1\" ascendcount_target=\"1\" fullpath=\"C:\\a\\&quot;b.png\" ",
+            "platform=\"Win\" server_name=\"N\" server_volume_name=\"V\" target_is_folder=\"0\"/></Als2>"
+        ));
+        let f = read_aepx(x.as_bytes()).unwrap();
+        let alas = f.chunks[0].children()[0].bytes().unwrap();
+        assert_eq!(
+            std::str::from_utf8(alas).unwrap(),
+            r#"{"ascendcount_base":1,"ascendcount_target":1,"fullpath":"C:\\a\\\"b.png","platform":1,"server_name":"N","server_volume_name":"V","target_is_folder":false}"#
+        );
+    }
+
+    #[test]
+    fn nums_takes_signed_and_unsigned_32_bit_values() {
+        for (text, bytes) in [("-2147483648", [0x80, 0, 0, 0]), ("4294967295", [0xff; 4]), (" 7 ", [0, 0, 0, 7])] {
+            let f = read_aepx(doc(&format!("<numS><string>{text}</string></numS>")).as_bytes()).unwrap();
+            assert_eq!(f.chunks[0].bytes(), Some(&bytes[..]), "{text}");
+        }
+        for text in ["-2147483649", "4294967296", "1.5"] {
+            assert!(read_aepx(doc(&format!("<numS><string>{text}</string></numS>")).as_bytes()).is_err(), "{text}");
+        }
+    }
+
+    #[test]
+    fn detection() {
+        assert!(is_aepx(b"\xef\xbb\xbf  <?xml version=\"1.0\"?>"));
+        assert!(is_aepx(b"<AfterEffectsProject>"));
+        assert!(!is_aepx(b"RIFX\0\0\0\x04Egg!"));
+        assert!(parse_any(b"RIFX\0\0\0\x04Egg!").is_ok());
+        assert!(parse_any(doc("").as_bytes()).is_ok());
+    }
+
+    #[test]
+    fn bad_input_is_an_error() {
+        let bad = [
+            doc("<a bdata=\"0\"/>"),
+            doc("<a bdata=\"zz\"/>"),
+            doc("<string>&nbsp;</string>"),
+            doc("<string>&#0;</string>"),
+            doc("<string>&amp</string>"),
+            doc("<a>"),
+            doc("<a></b>"),
+            doc("<numS><string>x</string></numS>"),
+            doc("<numS></numS>"),
+            doc("<a b></a>"),
+            doc("<a b=c></a>"),
+            "<?xml version=\"1.0\"?><!DOCTYPE x [<!ENTITY a \"b\">]><AfterEffectsProject/>".into(),
+            "<?xml version=\"1.0\"?><Other/>".into(),
+            "<?xml version=\"1.0\"?>".into(),
+            "<AfterEffectsProject/><AfterEffectsProject/>".into(),
+            "<AfterEffectsProject/>junk".into(),
+            "<AfterEffectsProject><!-- x".into(),
+        ];
+        for b in &bad {
+            assert!(matches!(read_aepx(b.as_bytes()), Err(AepError::Xml { .. })), "{b}");
+        }
+        assert!(matches!(read_aepx(b"<AfterEffectsProject>\xff</AfterEffectsProject>"), Err(AepError::Xml { .. })));
+    }
+
+    #[test]
+    fn limits_hold() {
+        let deep = format!("<AfterEffectsProject>{}{}</AfterEffectsProject>", "<a>".repeat(100_000), "</a>".repeat(100_000));
+        assert_eq!(read_aepx(deep.as_bytes()), Err(AepError::TooDeep));
+        let ok = format!("<AfterEffectsProject>{}{}</AfterEffectsProject>", "<a>".repeat(64), "</a>".repeat(64));
+        assert!(read_aepx(ok.as_bytes()).is_ok());
+        let many = format!("<AfterEffectsProject>{}</AfterEffectsProject>", "<a/>".repeat(10));
+        assert_eq!(read_aepx_with_limits(many.as_bytes(), Limits { max_depth: 64, max_chunks: 9 }), Err(AepError::TooManyChunks));
+    }
+}
diff --git a/crates/aep/src/container/arbitrary.rs b/crates/aep/src/container/arbitrary.rs
new file mode 100644
index 000000000..e4916cfe8
--- /dev/null
+++ b/crates/aep/src/container/arbitrary.rs
@@ -0,0 +1,555 @@
+//! Arbitrary-data effect parameters (type 11): the values of Hue/Saturation and Levels that are not
+//! ordinary parameters.
+//!
+//! In the effect's value group (`sspc/tdgp`) the parameter's `tdbs` (`tdsb` 1, a 4-byte `cdat`) is
+//! followed by a `LIST aRbs` holding one `aRbp`: the data. The `aRbp` in `parT` right after the
+//! parameter's `pard` holds the default (443, 511). Setting Master Hue, Saturation or Lightness of
+//! Hue/Saturation (444-446) or a Levels value (512-516) changes only bytes of this `aRbp` (and stale
+//! UI bytes of `pard`); the visible parameters of the same names keep no record.
+
+use crate::container::Chunk;
+use crate::container::bytes::{be_f32, be_i32, be_u16, be_u32};
+use crate::container::effects::Effect;
+
+impl<'f, 'a> Effect<'f, 'a> {
+    /// The arbitrary data stored for the parameter with this match name (`<effect>-NNNN`): the
+    /// `aRbp` of the `LIST aRbs` that follows the parameter's value record. `None` when there is
+    /// none.
+    pub fn arbitrary_data(&self, match_name: &str) -> Option<&'f [u8]> {
+        let values = self.chunk().child_list(b"tdgp")?;
+        let kids = values.children();
+        let at = kids.iter().position(|c| c.is(b"tdmn") && c.bytes().is_some_and(|b| name_is(b, match_name)))?;
+        // The value record, then the data list (no match name of its own).
+        let rest = kids.get(at.checked_add(1)?..)?;
+        let mut it = rest.iter().take(3);
+        let _record = it.next().filter(|c| c.is_list(b"tdbs"))?;
+        it.find(|c| c.is_list(b"aRbs")).and_then(|l| l.child(b"aRbp")).and_then(Chunk::bytes)
+    }
+}
+
+fn name_is(body: &[u8], name: &str) -> bool {
+    let end = body.iter().position(|c| *c == 0).unwrap_or(body.len());
+    body.get(..end) == Some(name.as_bytes())
+}
+
+/// Hue/Saturation's data (180 bytes, `ADBE HUE SATURATION-0003`): the master hue, saturation and
+/// lightness as `i32` at bytes 0, 4 and 8 (444: hue 90 is `0x5a`; 445: saturation 50; 446:
+/// lightness -30), then six colour ranges (Reds, Yellows, Greens, Cyans, Blues, Magentas) of 28
+/// bytes each: four `i32` range points in degrees (Reds 315, 345, 15, 45 by default) and the
+/// range's hue, saturation and lightness. Only the master values are sampled; the ranges' layout is
+/// read from the default data.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct HueSaturationData {
+    /// Master hue (degrees), saturation and lightness (-100..100).
+    pub master: [i32; 3],
+    /// Per colour range: the four range points (degrees) and its hue, saturation and lightness.
+    pub ranges: [([i32; 4], [i32; 3]); 6],
+}
+
+impl HueSaturationData {
+    /// The default data (443): master 0, 0, 0 and every range at its default points.
+    pub const DEFAULT_RANGES: [[i32; 4]; 6] =
+        [[315, 345, 15, 45], [15, 45, 75, 105], [75, 105, 135, 165], [135, 165, 195, 225], [195, 225, 255, 285], [255, 285, 315, 345]];
+
+    /// Decodes the data; `None` when it is not 180 bytes.
+    pub fn parse(data: &[u8]) -> Option<Self> {
+        if data.len() != 180 {
+            return None;
+        }
+        let i = |at: usize| be_i32(data, at);
+        let master = [i(0)?, i(4)?, i(8)?];
+        let mut ranges = [([0; 4], [0; 3]); 6];
+        for (k, r) in ranges.iter_mut().enumerate() {
+            let base = 12usize.checked_add(k.checked_mul(28)?)?;
+            r.0 = [i(base)?, i(base + 4)?, i(base + 8)?, i(base + 12)?];
+            r.1 = [i(base + 16)?, i(base + 20)?, i(base + 24)?];
+        }
+        Some(Self { master, ranges })
+    }
+
+    /// Whether every colour range is at its default (points as in 443, no adjustment).
+    pub fn ranges_are_default(&self) -> bool {
+        self.ranges.iter().zip(Self::DEFAULT_RANGES).all(|((points, hsl), d)| *points == d && *hsl == [0, 0, 0])
+    }
+}
+
+/// Levels' data (108 bytes, `ADBE Easy Levels2-0002`): a `u32` 0x000f10a7 and a `u32` 1 (511, in
+/// every sample), then five channels (RGB, Red, Green, Blue, Alpha) of five `f32`: input black,
+/// input white, gamma, output black, output white. The RGB values are sampled (512 input black
+/// 0.1, 513 input white 0.8, 514 gamma 2, 515 output black 0.2, 516 output white 0.9); the other
+/// channels' layout is read from the default data (0, 1, 1, 0, 1).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct LevelsData {
+    pub header: [u32; 2],
+    /// RGB, Red, Green, Blue, Alpha: input black, input white, gamma, output black, output white.
+    pub channels: [[f32; 5]; 5],
+}
+
+impl LevelsData {
+    /// The values of a channel at its default.
+    pub const DEFAULT_CHANNEL: [f32; 5] = [0.0, 1.0, 1.0, 0.0, 1.0];
+
+    /// Decodes the data; `None` when it is not 108 bytes.
+    pub fn parse(data: &[u8]) -> Option<Self> {
+        if data.len() != 108 {
+            return None;
+        }
+        let header = [be_u32(data, 0)?, be_u32(data, 4)?];
+        let mut channels = [[0.0; 5]; 5];
+        for (k, c) in channels.iter_mut().enumerate() {
+            let base = 8usize.checked_add(k.checked_mul(20)?)?;
+            for (j, v) in c.iter_mut().enumerate() {
+                *v = be_f32(data, base.checked_add(j.checked_mul(4)?)?)?;
+            }
+        }
+        Some(Self { header, channels })
+    }
+}
+
+/// Curves' data (1644 bytes, `ADBE CurvesCustom-0001`; FORMAT S.1, 961-964): `u16` 1, `u16` 1,
+/// five 256-byte lookup tables (RGB, Red, Green, Blue, Alpha: output 0..255 per input 0..255),
+/// then five 72-byte point records: 16 slots of (`u16` input, `u16` output), both 0..255, the
+/// number of points as `u32` at 64 and an `i32` at 68 (-1 at the default; the point count - 2 in
+/// every edited sample, H: the active point). Every stored table is the natural cubic spline
+/// through its points ([`curve_lut`]).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CurvesData {
+    /// RGB, Red, Green, Blue, Alpha: the points (input, output), as stored.
+    pub curves: [Vec<(u8, u8)>; 5],
+}
+
+/// The points of an untouched curve.
+pub const CURVE_IDENTITY: [(u8, u8); 2] = [(0, 0), (255, 255)];
+
+impl CurvesData {
+    pub const SIZE: usize = 1644;
+    const POINTS: usize = 1284;
+
+    /// Decodes the data; `None` when it is not 1644 bytes or a point count is beyond 16.
+    pub fn parse(data: &[u8]) -> Option<Self> {
+        if data.len() != Self::SIZE {
+            return None;
+        }
+        let mut curves: [Vec<(u8, u8)>; 5] = Default::default();
+        for (c, pts) in curves.iter_mut().enumerate() {
+            let base = Self::POINTS.checked_add(c.checked_mul(72)?)?;
+            let n = usize::try_from(be_u32(data, base.checked_add(64)?)?).ok()?;
+            if n > 16 {
+                return None;
+            }
+            for k in 0..n {
+                let at = base.checked_add(k.checked_mul(4)?)?;
+                let x = u8::try_from(be_u16(data, at)?).ok()?;
+                let y = u8::try_from(be_u16(data, at.checked_add(2)?)?).ok()?;
+                pts.push((x, y));
+            }
+        }
+        Some(Self { curves })
+    }
+
+    /// Whether every curve is the identity.
+    pub fn is_default(&self) -> bool {
+        self.curves.iter().all(|c| c.as_slice() == CURVE_IDENTITY)
+    }
+
+    /// The data After Effects stores for these curves: the tables rebuilt from the points.
+    /// `None` when a curve has fewer than 2 or more than 16 points or inputs that do not rise.
+    pub fn to_bytes(&self) -> Option<Vec<u8>> {
+        let mut out = vec![0u8; Self::SIZE];
+        out.get_mut(0..4)?.copy_from_slice(&[0, 1, 0, 1]);
+        for (c, pts) in self.curves.iter().enumerate() {
+            if pts.len() > 16 {
+                return None;
+            }
+            let lut = curve_lut(pts)?;
+            out.get_mut(4 + 256 * c..4 + 256 * (c + 1))?.copy_from_slice(&lut);
+            let base = Self::POINTS + 72 * c;
+            for (k, (x, y)) in pts.iter().enumerate() {
+                out.get_mut(base + 4 * k..base + 4 * k + 4)?.copy_from_slice(&[0, *x, 0, *y]);
+            }
+            let n = u32::try_from(pts.len()).ok()?;
+            out.get_mut(base + 64..base + 68)?.copy_from_slice(&n.to_be_bytes());
+            let active: i32 = if pts.as_slice() == CURVE_IDENTITY { -1 } else { i32::try_from(pts.len()).ok()? - 2 };
+            out.get_mut(base + 68..base + 72)?.copy_from_slice(&active.to_be_bytes());
+        }
+        Some(out)
+    }
+}
+
+fn rising(points: &[(u8, u8)]) -> bool {
+    points.windows(2).all(|w| matches!(w, [a, b] if a.0 < b.0))
+}
+
+/// The lookup table After Effects stores for a curve: the natural cubic spline (second derivative
+/// 0 at both ends) through the points, at the integers 0..255, rounded to the nearest integer and
+/// clamped to 0..255; flat outside the first and last point (961-964: 0 of 1280 entries differ).
+/// `None` for fewer than 2 points or inputs that do not rise.
+pub fn curve_lut(points: &[(u8, u8)]) -> Option<[u8; 256]> {
+    let n = points.len();
+    if n < 2 || !rising(points) {
+        return None;
+    }
+    let xs: Vec<f64> = points.iter().map(|p| f64::from(p.0)).collect();
+    let ys: Vec<f64> = points.iter().map(|p| f64::from(p.1)).collect();
+    let x = |i: usize| xs.get(i).copied().unwrap_or(0.0);
+    let y = |i: usize| ys.get(i).copied().unwrap_or(0.0);
+    let h = |i: usize| (x(i + 1) - x(i)).max(1.0);
+    let slope = |i: usize| (y(i + 1) - y(i)) / h(i);
+    // Second derivatives: the tridiagonal system of the natural spline (Thomas algorithm).
+    let mut m = vec![0.0f64; n];
+    let k = n - 2;
+    if k > 0 {
+        let mut diag: Vec<f64> = (0..k).map(|i| 2.0 * (h(i) + h(i + 1))).collect();
+        let upper: Vec<f64> = (0..k).map(|i| h(i + 1)).collect();
+        let mut rhs: Vec<f64> = (0..k).map(|i| 6.0 * (slope(i + 1) - slope(i))).collect();
+        for i in 1..k {
+            let (Some(&dp), Some(&up), Some(&rp)) = (diag.get(i - 1), upper.get(i - 1), rhs.get(i - 1)) else { return None };
+            let w = h(i) / dp;
+            if let (Some(d), Some(r)) = (diag.get_mut(i), rhs.get_mut(i)) {
+                *d -= w * up;
+                *r -= w * rp;
+            }
+        }
+        for i in (0..k).rev() {
+            let next = m.get(i + 2).copied().unwrap_or(0.0);
+            let (Some(&r), Some(&u), Some(&d)) = (rhs.get(i), upper.get(i), diag.get(i)) else { return None };
+            if let Some(slot) = m.get_mut(i + 1) {
+                *slot = (r - u * next) / d;
+            }
+        }
+    }
+    let mut lut = [0u8; 256];
+    for (xi, slot) in lut.iter_mut().enumerate() {
+        let xf = xi as f64;
+        let v = if xf <= x(0) {
+            y(0)
+        } else if xf >= x(n - 1) {
+            y(n - 1)
+        } else {
+            let i = (0..n - 1).find(|&i| xf >= x(i) && xf <= x(i + 1)).unwrap_or(0);
+            let hh = h(i);
+            let (a, b) = ((x(i + 1) - xf) / hh, (xf - x(i)) / hh);
+            let (mi, mj) = (m.get(i).copied().unwrap_or(0.0), m.get(i + 1).copied().unwrap_or(0.0));
+            a * y(i) + b * y(i + 1) + ((a * a * a - a) * mi + (b * b * b - b) * mj) * hh * hh / 6.0
+        };
+        *slot = (v + 0.5).floor().clamp(0.0, 255.0) as u8;
+    }
+    Some(lut)
+}
+
+/// Mesh Warp's data (`ADBE MESH WARP-0004`; FORMAT S.2, 965, 985): `u32` rows plus one, `u32`
+/// columns plus one (a 1 x 2-cell read-back test renders as made only in this order, `export-tests\mesh`;
+/// the vertices run row-major, columns plus one per row), 12 more bytes (zero, then
+/// `0d 0d`),
+/// then per vertex, row-major, ten `f32`: the position and the handles top, right, bottom and
+/// left, all as fractions 0..1 of the layer; a handle pointing out of the mesh is stored (0, 0).
+#[derive(Debug, Clone, PartialEq)]
+pub struct MeshData {
+    pub columns: u32,
+    pub rows: u32,
+    /// Bytes 8..20 as stored.
+    pub tail: [u8; 12],
+    /// Per vertex: position, top, right, bottom, left.
+    pub vertices: Vec<[[f32; 2]; 5]>,
+}
+
+impl MeshData {
+    /// Decodes the data; `None` when the size does not fit the grid or the grid is beyond 31 x 31
+    /// cells.
+    pub fn parse(data: &[u8]) -> Option<Self> {
+        let (r1, c1) = (be_u32(data, 0)?, be_u32(data, 4)?);
+        if !(2..=32).contains(&c1) || !(2..=32).contains(&r1) {
+            return None;
+        }
+        let count = usize::try_from(c1.checked_mul(r1)?).ok()?;
+        if data.len() != 20usize.checked_add(count.checked_mul(40)?)? {
+            return None;
+        }
+        let mut tail = [0u8; 12];
+        tail.copy_from_slice(data.get(8..20)?);
+        let mut vertices = Vec::with_capacity(count);
+        for v in 0..count {
+            let base = 20 + 40 * v;
+            let mut rec = [[0.0f32; 2]; 5];
+            for (j, p) in rec.iter_mut().enumerate() {
+                *p = [be_f32(data, base + 8 * j)?, be_f32(data, base + 8 * j + 4)?];
+            }
+            vertices.push(rec);
+        }
+        Some(Self { columns: c1 - 1, rows: r1 - 1, tail, vertices })
+    }
+
+    /// The vertex at column `i`, row `j` of an undistorted mesh with its default handles (one
+    /// third of a cell along the grid lines; those pointing out of the mesh are (0, 0)).
+    pub fn default_vertex(columns: u32, rows: u32, i: u32, j: u32) -> [[f32; 2]; 5] {
+        let (cw, rh) = (1.0 / f64::from(columns.max(1)), 1.0 / f64::from(rows.max(1)));
+        let (x, y) = (f64::from(i) * cw, f64::from(j) * rh);
+        let p = |dx: f64, dy: f64, out: bool| if out { [0.0, 0.0] } else { [(x + dx) as f32, (y + dy) as f32] };
+        [[x as f32, y as f32], p(0.0, -rh / 3.0, j == 0), p(cw / 3.0, 0.0, i == columns), p(0.0, rh / 3.0, j == rows), p(-cw / 3.0, 0.0, i == 0)]
+    }
+
+    /// The bytes After Effects stores for this mesh.
+    pub fn to_bytes(&self) -> Option<Vec<u8>> {
+        let count = usize::try_from(self.columns.checked_add(1)?.checked_mul(self.rows.checked_add(1)?)?).ok()?;
+        if self.vertices.len() != count {
+            return None;
+        }
+        let mut out = Vec::with_capacity(20 + 40 * count);
+        out.extend((self.rows + 1).to_be_bytes());
+        out.extend((self.columns + 1).to_be_bytes());
+        out.extend(self.tail);
+        for v in &self.vertices {
+            for p in v {
+                out.extend(p[0].to_be_bytes());
+                out.extend(p[1].to_be_bytes());
+            }
+        }
+        Some(out)
+    }
+}
+
+/// EXtractoR's Channel Info data (`EXtractoR-0013`, 688 bytes, the plug-in's own little-endian
+/// layout; read from the instances of the importer block of 2026-11-05: the defaults and a preset
+/// of our own that reads `Z` into Red, Green and Blue): a `u32` 1 and 28 bytes, then four records
+/// of 164 bytes (Red, Green, Blue, Alpha), each a kind in byte 0 (1 a channel of the footage by
+/// name, 2 the input's own channel: `(copy)`; bytes 1..4 are not always zero, `0x32` at 3 in one
+/// definition's default, so only byte 0 is read) and the channel name from byte 35,
+/// NUL-terminated. The other bytes are not read (they differ between instances with the same
+/// channels; the `u32` at 4 of a chosen channel looks like its position in the footage's sorted
+/// channel list, 13 of 14 for `Z`, where the defaults hold 0). Only the name is read.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExtractorChannels {
+    /// Per output channel (red, green, blue, alpha): the kind and the name.
+    pub channels: [(u32, String); 4],
+}
+
+impl ExtractorChannels {
+    /// The data's length.
+    pub const LEN: usize = 688;
+    const RECORD: usize = 164;
+
+    /// `None` when the data does not have this layout.
+    pub fn parse(data: &[u8]) -> Option<Self> {
+        if data.len() != Self::LEN || data.get(..4)? != 1u32.to_le_bytes() {
+            return None;
+        }
+        let mut channels: [(u32, String); 4] = Default::default();
+        for (k, slot) in channels.iter_mut().enumerate() {
+            let at = 32usize.checked_add(k.checked_mul(Self::RECORD)?)?;
+            let rec = data.get(at..at.checked_add(Self::RECORD)?)?;
+            let kind = u32::from(*rec.first()?);
+            let name = rec.get(35..)?;
+            let end = name.iter().position(|b| *b == 0)?;
+            let name = std::str::from_utf8(name.get(..end)?).ok()?;
+            *slot = (kind, name.to_string());
+        }
+        Some(Self { channels })
+    }
+
+    /// The channels of a fresh EXtractoR: Red, Green and Blue from the channels of those names,
+    /// Alpha copied from the input.
+    pub fn is_default(&self) -> bool {
+        let want = [(1, "R"), (1, "G"), (1, "B"), (2, "(copy)")];
+        self.channels.iter().zip(want).all(|((k, n), (wk, wn))| *k == wk && n == wn)
+    }
+
+    /// Per output channel (red, green, blue, alpha) the channel it reads, `Err` with the
+    /// position of the first record of another kind or without a name: a named channel by its
+    /// name, `(copy)` as EffectCraft's [`EXTRACTOR_COPY`](effectcraft_effects::EXTRACTOR_COPY),
+    /// the effect input's own channel of the same position. It is not `R`, `G`, `B` or `A`:
+    /// EffectCraft's EXtractoR reads those from an OpenEXR footage's channels of that name, the
+    /// file's own, which loses what an earlier effect did to the channel.
+    pub fn sources(&self) -> Result<[String; 4], usize> {
+        let mut out: [String; 4] = Default::default();
+        for (k, ((kind, name), slot)) in self.channels.iter().zip(out.iter_mut()).enumerate() {
+            *slot = match (kind, name.trim()) {
+                (1, n) if !n.is_empty() => n.to_string(),
+                (2, _) => effectcraft_effects::EXTRACTOR_COPY.to_string(),
+                _ => return Err(k),
+            };
+        }
+        Ok(out)
+    }
+}
+
+/// IDentifier's Channel Info data (`IDentifier-0005`, 148 bytes): the chosen channel's name,
+/// NUL-terminated from byte 19, or `Object ID` when none is chosen (importer blocks 1300 and 1310
+/// of 2026-11-05: `objectId` in a preset of our own that chose that UINT channel, `Object ID` in
+/// every other instance). The bytes around it differ between instances with the same settings
+/// and are not read (a chosen channel has 15 at byte 4, which looks like its position in the
+/// EXR's sorted channel list, as for EXtractoR).
+pub fn identifier_channel_type(data: &[u8]) -> Option<&str> {
+    let s = data.get(19..)?;
+    let end = s.iter().position(|b| *b == 0)?;
+    std::str::from_utf8(s.get(..end)?).ok()
+}
+
+/// The Cryptomatte plug-in's Settings data (`Cryptomatte-0001`, the plug-in's own layout,
+/// little-endian; read from 88 instances of one project and from our own sample 1400, fresh
+/// instances and two presets that pick a layer and an object, docs/aep-format.md 3.7): the magic
+/// `cry1`; bytes 4..32 are not read (they differ between instances holding the same settings);
+/// the Cryptomatte layer's name at 32, NUL-padded to 64 bytes (`CryptoObject`); at 96 a `u32` 1
+/// and a `u32` (neither read); at 104 the `u32` length of the selection text including its NUL,
+/// the `u32` MurmurHash3 (x86, 32-bit, seed 0) of that text with its NUL (not read) and a zero
+/// byte; the selection text from byte 113 (`<11a97486>, <deadbeef>`, the matte list as ID hashes,
+/// the hashes of the picked names). Bytes after it are left-overs of a longer earlier text. A
+/// fresh effect stores no layer and an empty text (length 1, its NUL); the `u32`s at 100 and 108
+/// are then both `0x514e28b7`, the hash of one NUL byte: the one at 100 looks like the hash of a
+/// first text that is empty in every sample, the zero byte at 112 like that text.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct CryptomatteData {
+    /// The Cryptomatte layer's name (`CryptoMaterial`: the EXR layer's name, which is also its
+    /// channel prefix in every sample); empty when none is chosen.
+    pub layer: String,
+    /// The selection (matte list) as the plug-in stores it.
+    pub selection: String,
+}
+
+impl CryptomatteData {
+    /// Decodes the data; `None` when it is not this layout (no `cry1`, too short, a length past
+    /// the end, no zero byte at 112, a text without its NUL, text that is not UTF-8).
+    pub fn parse(data: &[u8]) -> Option<Self> {
+        if data.get(..4)? != b"cry1" {
+            return None;
+        }
+        let text = |b: &[u8]| -> Option<String> {
+            let end = b.iter().position(|c| *c == 0).unwrap_or(b.len());
+            String::from_utf8(b.get(..end)?.to_vec()).ok()
+        };
+        let layer = text(data.get(32..96)?)?;
+        let len = usize::try_from(u32::from_le_bytes(data.get(104..108)?.try_into().ok()?)).ok()?;
+        if *data.get(112)? != 0 {
+            return None;
+        }
+        let selection = if len == 0 {
+            String::new()
+        } else {
+            // The length counts the text's NUL as its last byte: a text without it, or with an early
+            // NUL before more bytes (which `text` would silently cut short), is not this layout.
+            let b = data.get(113..113usize.checked_add(len)?)?;
+            let (last, text_bytes) = b.split_last()?;
+            if *last != 0 || text_bytes.contains(&0) {
+                return None;
+            }
+            text(b)?
+        };
+        Some(Self { layer, selection })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::CryptomatteData;
+
+    /// Settings data in the layout [`CryptomatteData::parse`] reads, with `noise` in the bytes it
+    /// does not read.
+    fn crypto(layer: &str, selection: &str, noise: u8) -> Vec<u8> {
+        let mut d = b"cry1".to_vec();
+        d.resize(32, noise);
+        d.extend(layer.as_bytes());
+        d.resize(96, 0);
+        d.extend(1u32.to_le_bytes());
+        d.extend([noise; 4]);
+        let len = if selection.is_empty() { 0 } else { selection.len() + 1 };
+        d.extend(u32::try_from(len).unwrap_or(0).to_le_bytes());
+        d.extend([noise; 4]);
+        d.push(0);
+        d.extend(selection.as_bytes());
+        d.push(0);
+        // Left-overs of an earlier, longer text.
+        d.extend(b" <de");
+        d
+    }
+
+    #[test]
+    fn cryptomatte_settings_are_read() {
+        for noise in [0, 0x5a] {
+            let d = CryptomatteData::parse(&crypto("Layer_A", "<0000002a>, <deadbeef>", noise));
+            assert_eq!(d, Some(CryptomatteData { layer: "Layer_A".into(), selection: "<0000002a>, <deadbeef>".into() }), "noise {noise}");
+        }
+    }
+
+    #[test]
+    fn a_selection_whose_nul_is_not_its_last_byte_is_refused() {
+        // An early NUL followed by more declared bytes would shorten the selection silently.
+        let mut d = crypto("Layer_A", "<0000002a>, <deadbeef>", 0);
+        d[113 + 4] = 0;
+        assert_eq!(CryptomatteData::parse(&d), None);
+        // No NUL at the end of the declared length.
+        let mut d = crypto("Layer_A", "<0000002a>", 0);
+        d[113 + 10] = b'x';
+        assert_eq!(CryptomatteData::parse(&d), None);
+    }
+
+    #[test]
+    fn the_default_cryptomatte_settings_are_empty() {
+        let mut d = b"cry1".to_vec();
+        d.resize(116, 0);
+        assert_eq!(CryptomatteData::parse(&d), Some(CryptomatteData::default()));
+        // What After Effects 2026 wrote for a fresh effect (plug-in 2.6.6, sample 1400
+        // `crypto-00-defaults`, the `pard` default and the instance's record alike): an empty text
+        // of length 1 and its hash, twice.
+        let mut fresh = b"cry1".to_vec();
+        fresh.resize(96, 0);
+        for _ in 0..2 {
+            fresh.extend(1u32.to_le_bytes());
+            fresh.extend(0x514e_28b7u32.to_le_bytes());
+        }
+        fresh.extend([0; 4]);
+        assert_eq!(fresh.len(), 116);
+        assert_eq!(CryptomatteData::parse(&fresh), Some(CryptomatteData::default()));
+    }
+
+    /// The Settings data After Effects 2026 wrote for the two presets of sample 1400 (plug-in
+    /// 2.6.6, `crypto-06-preset-object-box` and `crypto-07-preset-material-paint`: a layer chosen
+    /// and one object or material picked in the plug-in's UI), byte for byte: 127 bytes, the `u32`
+    /// at 108 the MurmurHash3 of the text with its NUL, three zero bytes after the text.
+    #[test]
+    fn the_presets_of_our_sample_are_read() {
+        for (layer, selection, hash) in [("CryptoObject", "<11a97486>", 0x2788_0767u32), ("CryptoMaterial", "<a5deeb9e>", 0xf737_4a5b)] {
+            let mut d = b"cry1".to_vec();
+            d.resize(32, 0);
+            d.extend(layer.as_bytes());
+            d.resize(96, 0);
+            for v in [1, 0x514e_28b7, 11, hash] {
+                d.extend(u32::to_le_bytes(v));
+            }
+            d.push(0);
+            d.extend(selection.as_bytes());
+            d.extend([0; 4]);
+            assert_eq!(d.len(), 127);
+            assert_eq!(CryptomatteData::parse(&d), Some(CryptomatteData { layer: layer.into(), selection: selection.into() }), "{layer}");
+        }
+    }
+
+    #[test]
+    fn damaged_cryptomatte_settings_are_not_read() {
+        let good = crypto("L", "<00000001>", 0);
+        let mut bad_magic = good.clone();
+        bad_magic[0] = b'x';
+        let mut past_end = good.clone();
+        past_end[104..108].copy_from_slice(&u32::MAX.to_le_bytes());
+        let mut no_zero = good.clone();
+        no_zero[112] = b'<';
+        let mut not_utf8 = good.clone();
+        not_utf8[32] = 0xff;
+        // The length covers the text without its NUL (`<00000001>` is 10 bytes, its NUL the 11th).
+        let mut no_nul = good.clone();
+        no_nul[104..108].copy_from_slice(&10u32.to_le_bytes());
+        // No zero byte at 112 with an empty text.
+        let mut empty_no_zero = crypto("L", "", 0);
+        empty_no_zero[112] = b'<';
+        for (what, d) in [
+            ("magic", bad_magic),
+            ("length", past_end),
+            ("zero byte", no_zero),
+            ("utf-8", not_utf8),
+            ("no NUL", no_nul),
+            ("empty text, zero byte", empty_no_zero),
+            ("short", good[..100].to_vec()),
+            ("empty", Vec::new()),
+        ] {
+            assert_eq!(CryptomatteData::parse(&d), None, "{what}");
+        }
+    }
+}
diff --git a/crates/aep/src/container/bytes.rs b/crates/aep/src/container/bytes.rs
new file mode 100644
index 000000000..77f5f2199
--- /dev/null
+++ b/crates/aep/src/container/bytes.rs
@@ -0,0 +1,50 @@
+//! Bounds-checked big-endian readers shared by the typed views. Every read returns `None` when the
+//! bytes are not there; nothing here indexes a slice directly.
+
+pub(crate) fn text(b: &[u8]) -> String {
+    String::from_utf8_lossy(b).into_owned()
+}
+
+/// The bytes up to the first NUL (all of them when there is none).
+pub(crate) fn until_nul(b: &[u8]) -> &[u8] {
+    let end = b.iter().position(|c| *c == 0).unwrap_or(b.len());
+    b.get(..end).unwrap_or(&[])
+}
+
+/// A NUL-terminated ASCII (or Latin-1) string at `at`, at most `max` bytes long.
+pub(crate) fn cstr(b: &[u8], at: usize, max: usize) -> Option<String> {
+    let end = at.checked_add(max)?.min(b.len());
+    let field = b.get(at..end)?;
+    Some(until_nul(field).iter().map(|c| char::from(*c)).collect())
+}
+
+pub(crate) fn array<const N: usize>(b: &[u8], at: usize) -> Option<[u8; N]> {
+    let s = b.get(at..at.checked_add(N)?)?;
+    let mut a = [0u8; N];
+    a.copy_from_slice(s);
+    Some(a)
+}
+
+pub(crate) fn be_u16(b: &[u8], at: usize) -> Option<u16> {
+    array::<2>(b, at).map(u16::from_be_bytes)
+}
+
+pub(crate) fn be_u32(b: &[u8], at: usize) -> Option<u32> {
+    array::<4>(b, at).map(u32::from_be_bytes)
+}
+
+pub(crate) fn be_i32(b: &[u8], at: usize) -> Option<i32> {
+    array::<4>(b, at).map(i32::from_be_bytes)
+}
+
+pub(crate) fn le_u32(b: &[u8], at: usize) -> Option<u32> {
+    array::<4>(b, at).map(u32::from_le_bytes)
+}
+
+pub(crate) fn be_f32(b: &[u8], at: usize) -> Option<f32> {
+    array::<4>(b, at).map(f32::from_be_bytes)
+}
+
+pub(crate) fn be_f64(b: &[u8], at: usize) -> Option<f64> {
+    array::<8>(b, at).map(f64::from_be_bytes)
+}
diff --git a/crates/aep/src/container/camera.rs b/crates/aep/src/container/camera.rs
new file mode 100644
index 000000000..15623fd2c
--- /dev/null
+++ b/crates/aep/src/container/camera.rs
@@ -0,0 +1,135 @@
+//! Cameras and lights.
+//!
+//! Both are layers without a source (`ldta` byte 40 is 0 for a camera and `0xffff_ffff` for a light)
+//! whose type is 2 (camera) or 1 (light). Their `ldta` carries the auto-orient bit (byte 38, `0x40`)
+//! and, for a light, the light type (see [`LayerHeader::light_type`](crate::container::LayerHeader)). The
+//! properties sit in the same Transform group as on other layers but follow other conventions:
+//!
+//! * **Position** is stored as given once the user has set it. While it is at its computed default
+//!   the record is an "auto state" (`tdb4` bytes 76 and 77 are 1 although there is no expression)
+//!   that holds `[0, 0, -zoom]`. After Effects reports and renders the stored value, also for a
+//!   two-node camera (256 read back `[0, 0, -2666.67]` in session S16; 537 renders from there). An
+//!   earlier batch-3 note had a two-node camera report the composition centre; that was not
+//!   reproduced.
+//! * **Anchor Point** of a camera is its point of interest, in pixels (not a fraction).
+//! * A light's **Intensity** (`ADBE Light Options Group/ADBE Light Intensity`, percent) is stored
+//!   only when it is not the default 100.
+
+use crate::container::typed::{Layer, PropNode};
+use crate::container::values::{Tracked, ValueSource, read, read_opt};
+
+/// The Position of a camera or light layer as stored.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct CameraPosition {
+    /// `[x, y, z]` in pixels as stored: the absolute position once set by the user, `[0, 0, -zoom]`
+    /// in the auto state (camera) or `[0, 0, -1333.33]` (default light).
+    pub stored: [f64; 3],
+    /// True while the position is derived (`tdb4` bytes 76 and 77 are 1 without an expression).
+    pub auto_state: bool,
+}
+
+impl CameraPosition {
+    /// The position as the batch-3 notes had After Effects report it: in the auto state of a
+    /// two-node camera (`two_node`) x and y are the composition centre; otherwise the stored
+    /// value. **Contradicted by 256 and 537 (session S16): After Effects reports and renders the
+    /// stored value**; use `stored` for what After Effects shows.
+    pub fn reported(&self, comp_width: u32, comp_height: u32, two_node: bool) -> [f64; 3] {
+        if self.auto_state && two_node { [f64::from(comp_width) / 2.0, f64::from(comp_height) / 2.0, self.stored[2]] } else { self.stored }
+    }
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The Position record of a camera or light layer.
+    pub fn camera_position(&self) -> Option<CameraPosition> {
+        let Some(PropNode::Group(transform)) = self.properties()?.get("ADBE Transform Group") else { return None };
+        let Some(PropNode::Property(position)) = transform.get("ADBE Position") else { return None };
+        let v = position.static_value()?;
+        let stored = *v.as_slice().first_chunk::<3>()?;
+        let h = position.header()?;
+        let derived = h.get(76) == Some(&1) && h.get(77) == Some(&1) && position.expression().is_none();
+        Some(CameraPosition { stored, auto_state: derived })
+    }
+
+    /// The point of interest of a camera in pixels (its Anchor Point record); `None` when absent.
+    pub fn camera_point_of_interest(&self) -> Option<[f64; 3]> {
+        let Some(PropNode::Group(transform)) = self.properties()?.get("ADBE Transform Group") else { return None };
+        let tracked = read(&transform, "ADBE Anchor Point", [0.0; 3], 1.0);
+        matches!(tracked.source, ValueSource::Stored | ValueSource::Keyframed).then_some(tracked.value)
+    }
+
+    /// A light's intensity in percent; the default 100 when the property is absent.
+    pub fn light_intensity(&self) -> Option<Tracked<f64>> {
+        let root = self.properties()?;
+        let Some(PropNode::Group(options)) = root.get("ADBE Light Options Group") else { return None };
+        let t = read(&options, "ADBE Light Intensity", [100.0], 1.0);
+        Some(Tracked { value: t.value[0], source: t.source })
+    }
+}
+
+/// The camera zoom After Effects uses when `ADBE Camera Zoom` is absent: 2666.67 px for the 50 mm
+/// default camera in the 1920 px wide corpus composition. Whether it follows other composition
+/// widths was not sampled.
+pub const DEFAULT_CAMERA_ZOOM: f64 = 2_666.666_666_666_666_5;
+
+impl<'f, 'a> Layer<'f, 'a> {
+    fn camera_options(&self) -> Option<crate::container::typed::PropGroup<'f, 'a>> {
+        match self.properties()?.get("ADBE Camera Options Group") {
+            Some(PropNode::Group(g)) => Some(g),
+            _ => None,
+        }
+    }
+
+    fn light_options(&self) -> Option<crate::container::typed::PropGroup<'f, 'a>> {
+        match self.properties()?.get("ADBE Light Options Group") {
+            Some(PropNode::Group(g)) => Some(g),
+            _ => None,
+        }
+    }
+
+    /// A camera's zoom in pixels (`ADBE Camera Options Group/ADBE Camera Zoom`); absent = the
+    /// default, [`DEFAULT_CAMERA_ZOOM`] (341: 2000 is stored). The auto Position keeps `-2666.67` and
+    /// is not recomputed from the zoom.
+    pub fn camera_zoom(&self) -> Option<Tracked<f64>> {
+        let t = read(&self.camera_options()?, "ADBE Camera Zoom", [DEFAULT_CAMERA_ZOOM], 1.0);
+        Some(Tracked { value: t.value[0], source: t.source })
+    }
+
+    /// The depth of field switch (`ADBE Camera Depth of Field`, a checkbox; off by default, 342).
+    pub fn camera_depth_of_field(&self) -> Option<Tracked<bool>> {
+        let t = read(&self.camera_options()?, "ADBE Camera Depth of Field", [0.0], 1.0);
+        Some(Tracked { value: t.value[0] != 0.0, source: t.source })
+    }
+
+    /// A camera's focus distance in pixels (`ADBE Camera Focus Distance`); `None` while absent (its
+    /// default is not known).
+    pub fn camera_focus_distance(&self) -> Option<Tracked<f64>> {
+        let t = read_opt::<1>(&self.camera_options()?, "ADBE Camera Focus Distance", 1.0)?;
+        Some(Tracked { value: t.value[0], source: t.source })
+    }
+
+    /// A camera's aperture (`ADBE Camera Aperture`); `None` while absent (its default is not known).
+    pub fn camera_aperture(&self) -> Option<Tracked<f64>> {
+        let t = read_opt::<1>(&self.camera_options()?, "ADBE Camera Aperture", 1.0)?;
+        Some(Tracked { value: t.value[0], source: t.source })
+    }
+
+    /// A light's colour as `[A, R, G, B]` fractions (`ADBE Light Options Group/ADBE Light Color`,
+    /// stored as doubles 0..255); white when absent (343 stores red).
+    pub fn light_color(&self) -> Option<Tracked<[f64; 4]>> {
+        Some(read(&self.light_options()?, "ADBE Light Color", [1.0; 4], 1.0 / 255.0))
+    }
+
+    /// A spot light's cone angle in degrees (`ADBE Light Cone Angle`); 90 when absent (344 stores 60).
+    /// A point light stores 90 with `tdsb` 3.
+    pub fn light_cone_angle(&self) -> Option<Tracked<f64>> {
+        let t = read(&self.light_options()?, "ADBE Light Cone Angle", [90.0], 1.0);
+        Some(Tracked { value: t.value[0], source: t.source })
+    }
+
+    /// A spot light's cone feather in percent (`ADBE Light Cone Feather 2`); 50 when absent (345
+    /// stores 30).
+    pub fn light_cone_feather(&self) -> Option<Tracked<f64>> {
+        let t = read(&self.light_options()?, "ADBE Light Cone Feather 2", [50.0], 1.0);
+        Some(Tracked { value: t.value[0], source: t.source })
+    }
+}
diff --git a/crates/aep/src/container/chunk.rs b/crates/aep/src/container/chunk.rs
new file mode 100644
index 000000000..5fcc9af50
--- /dev/null
+++ b/crates/aep/src/container/chunk.rs
@@ -0,0 +1,213 @@
+//! The lossless chunk tree.
+
+use std::borrow::Cow;
+
+/// The id of a list chunk.
+pub const LIST: [u8; 4] = *b"LIST";
+
+/// Non-`LIST` chunk ids whose body is itself a sequence of chunks (observed: each holds one `Utf8`
+/// chunk). They are parsed as [`Body::Chunks`] when the body is a well-formed chunk sequence and
+/// kept as [`Body::Data`] otherwise.
+pub const NESTED_IDS: [[u8; 4]; 3] = [*b"tdsn", *b"pdnm", *b"fnam"];
+
+/// One chunk: a 4-byte id, a body and an optional pad byte.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Chunk<'a> {
+    /// The 4-byte id, as stored (case matters; some ids end in a space, e.g. `seq `).
+    pub id: [u8; 4],
+    /// The body.
+    pub body: Body<'a>,
+    /// The pad byte that followed an odd-sized body (normally `0`). `None` when the body is even,
+    /// or when an odd body is the last thing of its parent and the file has no pad byte there.
+    /// On writing, an odd body that is not the last sibling always gets a pad byte (`0` if this is
+    /// `None`); the last sibling gets one only if this is `Some`.
+    pub pad: Option<u8>,
+}
+
+/// The body of a [`Chunk`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Body<'a> {
+    /// Opaque bytes (the content of nearly all chunks).
+    Data(Cow<'a, [u8]>),
+    /// A body that is a sequence of chunks although the id is not `LIST` (see [`NESTED_IDS`]).
+    Chunks(Vec<Chunk<'a>>),
+    /// A `LIST`: a 4-byte list type followed by chunks.
+    List { list_type: [u8; 4], children: Vec<Chunk<'a>> },
+    /// A `LIST` whose content is not a well-formed chunk sequence (or is nested deeper than the
+    /// limit), kept as bytes after the list type (observed: `LIST btdk` holds raw text).
+    OpaqueList { list_type: [u8; 4], data: Cow<'a, [u8]> },
+}
+
+impl<'a> Chunk<'a> {
+    /// A data chunk with the pad byte its length needs.
+    pub fn data(id: [u8; 4], data: impl Into<Cow<'a, [u8]>>) -> Self {
+        let data = data.into();
+        let pad = if data.len() % 2 == 1 { Some(0) } else { None };
+        Self { id, body: Body::Data(data), pad }
+    }
+
+    /// A `LIST` chunk.
+    pub fn list(list_type: [u8; 4], children: Vec<Chunk<'a>>) -> Self {
+        Self { id: LIST, body: Body::List { list_type, children }, pad: None }
+    }
+
+    /// The raw bytes of a [`Body::Data`] chunk, or the bytes after the list type of an opaque list.
+    pub fn bytes(&self) -> Option<&[u8]> {
+        match &self.body {
+            Body::Data(d) => Some(d),
+            Body::OpaqueList { data, .. } => Some(data),
+            Body::Chunks(_) | Body::List { .. } => None,
+        }
+    }
+
+    /// The child chunks of a list or nested chunk; empty for data.
+    pub fn children(&self) -> &[Chunk<'a>] {
+        match &self.body {
+            Body::Chunks(c) | Body::List { children: c, .. } => c,
+            Body::Data(_) | Body::OpaqueList { .. } => &[],
+        }
+    }
+
+    /// Mutable child chunks; empty for data.
+    pub fn children_mut(&mut self) -> &mut [Chunk<'a>] {
+        match &mut self.body {
+            Body::Chunks(c) | Body::List { children: c, .. } => c,
+            Body::Data(_) | Body::OpaqueList { .. } => &mut [],
+        }
+    }
+
+    /// The list type when this is a `LIST` (parsed or opaque).
+    pub fn list_type(&self) -> Option<[u8; 4]> {
+        match &self.body {
+            Body::List { list_type, .. } | Body::OpaqueList { list_type, .. } => Some(*list_type),
+            Body::Data(_) | Body::Chunks(_) => None,
+        }
+    }
+
+    /// True when this is a `LIST` of the given type.
+    pub fn is_list(&self, list_type: &[u8; 4]) -> bool {
+        self.id == LIST && self.list_type().is_some_and(|t| &t == list_type)
+    }
+
+    /// True when this is a `LIST` whose content could not be read as chunks (see
+    /// [`Body::OpaqueList`]): damaged, or nested deeper than the limit.
+    pub fn is_opaque_list(&self) -> bool {
+        matches!(self.body, Body::OpaqueList { .. })
+    }
+
+    /// True when this is a chunk (not a `LIST`) with the given id.
+    pub fn is(&self, id: &[u8; 4]) -> bool {
+        &self.id == id
+    }
+
+    /// The first child (non-list) chunk with this id.
+    pub fn child(&self, id: &[u8; 4]) -> Option<&Chunk<'a>> {
+        self.children().iter().find(|c| c.is(id))
+    }
+
+    /// The first child `LIST` of this type.
+    pub fn child_list(&self, list_type: &[u8; 4]) -> Option<&Chunk<'a>> {
+        self.children().iter().find(|c| c.is_list(list_type))
+    }
+
+    /// Visits every chunk below this one depth-first (children before later siblings), without
+    /// recursion; the depth counts from 1 for the children of this chunk.
+    pub fn descendants(&self) -> Walk<'_, 'a> {
+        Walk { stack: vec![(self.children().iter(), 1)] }
+    }
+
+    /// The first descendant `LIST` of this type, searching depth-first.
+    pub fn find_list(&self, list_type: &[u8; 4]) -> Option<&Chunk<'a>> {
+        self.descendants().map(|(_, c)| c).find(|c| c.is_list(list_type))
+    }
+
+    /// Copies all borrowed bytes so the tree no longer borrows the input.
+    pub fn into_owned(self) -> Chunk<'static> {
+        let body = match self.body {
+            Body::Data(d) => Body::Data(Cow::Owned(d.into_owned())),
+            Body::Chunks(c) => Body::Chunks(c.into_iter().map(Chunk::into_owned).collect()),
+            Body::List { list_type, children } => Body::List { list_type, children: children.into_iter().map(Chunk::into_owned).collect() },
+            Body::OpaqueList { list_type, data } => Body::OpaqueList { list_type, data: Cow::Owned(data.into_owned()) },
+        };
+        Chunk { id: self.id, body, pad: self.pad }
+    }
+}
+
+/// A parsed `.aep`: the `RIFX` container's chunks and the bytes after its declared end.
+///
+/// Writing it back with [`crate::container::write`] reproduces the input byte for byte (the container size
+/// and every list size are recomputed from the tree and equal what the file declared).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AepFile<'a> {
+    /// The top-level chunks (after the `Egg!` form type).
+    pub chunks: Vec<Chunk<'a>>,
+    /// The bytes after the container's declared end. After Effects puts an XMP packet there.
+    pub trailer: Cow<'a, [u8]>,
+}
+
+impl<'a> AepFile<'a> {
+    /// The first top-level chunk with this id.
+    pub fn chunk(&self, id: &[u8; 4]) -> Option<&Chunk<'a>> {
+        self.chunks.iter().find(|c| c.is(id))
+    }
+
+    /// The first top-level `LIST` of this type.
+    pub fn list(&self, list_type: &[u8; 4]) -> Option<&Chunk<'a>> {
+        self.chunks.iter().find(|c| c.is_list(list_type))
+    }
+
+    /// The XMP packet in the trailer (from `<?xpacket begin` to the end of `<?xpacket end ...?>`).
+    pub fn xmp(&self) -> Option<&[u8]> {
+        let start = find(&self.trailer, b"<?xpacket begin")?;
+        let rest = self.trailer.get(start..)?;
+        let end_marker = find(rest, b"<?xpacket end")?;
+        let tail = rest.get(end_marker..)?;
+        let close = find(tail, b"?>")?;
+        rest.get(..end_marker.checked_add(close)?.checked_add(2)?)
+    }
+
+    /// Visits every chunk depth-first with its nesting depth (the top level is 1), without recursion.
+    pub fn walk(&self) -> Walk<'_, 'a> {
+        Walk { stack: vec![(self.chunks.iter(), 1)] }
+    }
+
+    /// Copies all borrowed bytes so the file no longer borrows the input.
+    pub fn into_owned(self) -> AepFile<'static> {
+        AepFile { chunks: self.chunks.into_iter().map(Chunk::into_owned).collect(), trailer: Cow::Owned(self.trailer.into_owned()) }
+    }
+}
+
+fn find(hay: &[u8], needle: &[u8]) -> Option<usize> {
+    if needle.is_empty() {
+        return Some(0);
+    }
+    hay.windows(needle.len()).position(|w| w == needle)
+}
+
+/// Depth-first iterator over all chunks, see [`AepFile::walk`].
+pub struct Walk<'f, 'a> {
+    stack: Vec<(std::slice::Iter<'f, Chunk<'a>>, usize)>,
+}
+
+impl<'f, 'a> Iterator for Walk<'f, 'a> {
+    type Item = (usize, &'f Chunk<'a>);
+
+    fn next(&mut self) -> Option<Self::Item> {
+        loop {
+            let (iter, depth) = self.stack.last_mut()?;
+            let depth = *depth;
+            match iter.next() {
+                Some(chunk) => {
+                    let kids = chunk.children();
+                    if !kids.is_empty() {
+                        self.stack.push((kids.iter(), depth.saturating_add(1)));
+                    }
+                    return Some((depth, chunk));
+                }
+                None => {
+                    self.stack.pop();
+                }
+            }
+        }
+    }
+}
diff --git a/crates/aep/src/container/effect_map.rs b/crates/aep/src/container/effect_map.rs
new file mode 100644
index 000000000..aea320395
--- /dev/null
+++ b/crates/aep/src/container/effect_map.rs
@@ -0,0 +1,1166 @@
+//! The effect table shared by the importer (`crate::import`) and the exporter
+//! (`crate::export`): an After Effects effect (its match name) and its parameters (by
+//! their index in `parT`) map to an EffectCraft effect, a parameter id and a unit conversion.
+//! Plain data; the evidence for each row is in `docs/aep-format.md` 3.7 and the case numbers in
+//! the comments. The importer reads a file through it, the exporter writes the inverse.
+
+use crate::container::effects::ParamKind;
+use ParamKind as K;
+
+/// How a stored parameter value becomes an EffectCraft value.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Conv {
+    /// A colour (ARGB 0..255 or the reader's ARGB fractions) to opaque RGBA 0..1.
+    Color,
+    /// A point (fraction of the layer size) to layer pixels.
+    Point,
+    /// A slider shown as a percent here: the stored value is a fraction of `valid_max`.
+    Percent { valid_max: f64 },
+    /// A slider whose stored number is used as it is (`valid_max` checks the scale).
+    Plain { valid_max: f64 },
+    /// A slider whose stored number times `factor` is the value here (`valid_max` checks the
+    /// scale).
+    Factor { valid_max: f64, factor: f64 },
+    /// An angle in degrees.
+    Angle,
+    /// A popup, mapped by item name; `default` is After Effects' default (1-based) for a fresh
+    /// effect, used when the file's default slot cannot be trusted. `items` are After Effects'
+    /// items as the corpus stores them (`pdnm`): used when a file has no `pdnm` for the popup
+    /// and its item count (`pard` 60) matches.
+    Popup { default: u32, items: &'static [&'static str] },
+    /// A checkbox (stored 1.0 when on).
+    Checkbox,
+    /// A layer (the `tdpi` id of a layer of the same composition, 0 = None; 904 E22-E24, 220,
+    /// 320, 321). `own` says what the owning layer itself becomes: itself (Layer Control) or
+    /// EffectCraft's unset layer (effects whose unset layer means "this layer").
+    LayerRef { own: bool },
+    /// A parameter that holds no value to import (Levels (Individual Controls)' histogram).
+    Skip,
+}
+
+// After Effects' popup items as the corpus stores them (`pdnm`).
+/// 368.
+pub const RAMP_SHAPE: &[&str] = &["Linear Ramp", "Radial Ramp"];
+/// 389.
+pub const EXPOSURE_CHANNELS: &[&str] = &["Master", "Individual Channels"];
+/// 409.
+pub const INVERT_CHANNEL: &[&str] = &[
+    "RGB",
+    "Red",
+    "Green",
+    "Blue",
+    "(-",
+    "HLS",
+    "Hue",
+    "Lightness",
+    "Saturation",
+    "(-",
+    "YIQ",
+    "Luminance",
+    "In Phase Chrominance",
+    "Quadrature Chrominance",
+    "(-",
+    "Alpha",
+];
+/// 412, 417, 427.
+pub const BLUR_DIMENSIONS: &[&str] = &["Horizontal and Vertical", "Horizontal", "Vertical"];
+/// 529.
+pub const TIMEWARP_METHOD: &[&str] = &["Whole Frames", "Frame Mix", "Pixel Motion"];
+/// 529.
+pub const TIMEWARP_ADJUST: &[&str] = &["Speed", "Source Frame"];
+/// 427.
+pub const GLOW_BASED_ON: &[&str] = &["Alpha Channel", "Color Channels"];
+/// 427.
+pub const GLOW_COMPOSITE: &[&str] = &["On Top", "Behind", "None"];
+/// 427.
+pub const GLOW_OPERATION: &[&str] = &[
+    "None",
+    "Normal",
+    "Add",
+    "Multiply",
+    "Dissolve",
+    "Screen",
+    "Overlay",
+    "Soft Light",
+    "Hard Light",
+    "Darken",
+    "Lighten",
+    "Difference",
+    "Hue",
+    "Saturation",
+    "Color",
+    "Luminosity",
+    "Color Dodge",
+    "Color Burn",
+    "Exclusion",
+    "Stencil Alpha",
+    "Stencil Luma",
+    "Silhouette Alpha",
+    "Silhouette Luma",
+    "Luminescent Premultiply",
+    "Alpha Add",
+];
+/// 427.
+pub const GLOW_COLORS: &[&str] = &["Original Colors", "A & B Colors", "Arbitrary Map"];
+/// 427.
+pub const GLOW_LOOPING: &[&str] = &["Sawtooth A>B", "Sawtooth B>A", "Triangle A>B>A", "Triangle B>A>B"];
+/// 443.
+pub const HUE_SAT_CHANNEL: &[&str] = &["Master", "Reds", "Yellows", "Greens", "Cyans", "Blues", "Magentas"];
+/// 511.
+pub const LEVELS_CHANNEL: &[&str] = &["RGB", "Red", "Green", "Blue", "Alpha"];
+/// 511.
+pub const LEVELS_CLIP: &[&str] = &["On", "Off", "Off for 32 bpc Color"];
+/// The Cryptomatte plug-in's Output (`Cryptomatte-0002`).
+pub const CRYPTOMATTE_OUTPUT: &[&str] = &["Colors", "Matted Colors", "Matted RGBA", "Matte Only"];
+
+/// One mapped parameter.
+#[derive(Clone, Copy, Debug)]
+pub struct ParamMap {
+    /// The index in `parT` (0 is the input layer).
+    pub index: usize,
+    /// The parameter type the file must declare.
+    pub kind: ParamKind,
+    /// The EffectCraft parameter id.
+    pub target: &'static str,
+    pub conv: Conv,
+    /// The range EffectCraft's effect works in when it is narrower than the range After Effects
+    /// accepts (the effect limits the value there): a stored value or key outside it is imported
+    /// as it is and reported. `None`: no narrower range.
+    pub limit: Option<(f64, f64)>,
+}
+
+/// Values of an effect that are not ordinary parameters.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Extra {
+    None,
+    /// Hue/Saturation's master values in the Channel Range data (444-446).
+    HueSaturation,
+    /// Levels' values in the Histogram data (512-516).
+    Levels,
+    /// Curves' five curves (961-964, `CurvesData`).
+    Curves,
+    /// Mesh Warp's Distortion Mesh (965, 985, `MeshData`).
+    MeshWarp,
+    /// Lumetri Color: every parameter goes through its own table, keyed by match name
+    /// (`import/lumetri.rs`, 1200).
+    Lumetri,
+    /// EXtractoR's Channel Info (`ExtractorChannels`): the channels by name.
+    Extractor,
+    /// IDentifier's Channel Info (`identifier_channel_type`): the chosen channel by name.
+    Identifier,
+    /// The Cryptomatte plug-in: the layer and selection in its Settings data
+    /// (`CryptomatteData`), Output split over EffectCraft's Display and Matte Only; every
+    /// parameter is handled by the importer's Cryptomatte step, none by the table.
+    Cryptomatte,
+}
+
+/// One mapped effect.
+#[derive(Clone, Copy, Debug)]
+pub struct EffectMap {
+    pub match_name: &'static str,
+    /// The EffectCraft effect id.
+    pub effect: &'static str,
+    pub params: &'static [ParamMap],
+    pub extra: Extra,
+}
+
+const fn pm(index: usize, kind: ParamKind, target: &'static str, conv: Conv) -> ParamMap {
+    ParamMap { index, kind, target, conv, limit: None }
+}
+
+/// [`pm`] for a parameter EffectCraft's effect limits to `lo..=hi` (see [`ParamMap::limit`]).
+const fn pm_limited(index: usize, kind: ParamKind, target: &'static str, conv: Conv, lo: f64, hi: f64) -> ParamMap {
+    ParamMap { index, kind, target, conv, limit: Some((lo, hi)) }
+}
+
+const fn fx(match_name: &'static str, effect: &'static str, params: &'static [ParamMap]) -> EffectMap {
+    EffectMap { match_name, effect, params, extra: Extra::None }
+}
+
+/// 712.
+pub const RADIAL_TYPE: &[&str] = &["Spin", "Zoom"];
+/// 712.
+pub const RADIAL_AA: &[&str] = &["Low", "High"];
+/// 712 (the fresh default is item 6, Scratch).
+pub const CC_RADIAL_TYPE: &[&str] = &["Straight Zoom", "Fading Zoom", "Centered Zoom", "(-", "Rotate", "Scratch", "Rotate Fading"];
+/// 712.
+pub const LUMA_KEY_TYPE: &[&str] = &["Key Out Brighter", "Key Out Darker", "Key Out Similar", "Key Out Dissimilar"];
+/// 712.
+pub const CHOKER_VIEW: &[&str] = &["Final Output", "Matte"];
+/// 712.
+pub const SAMPLING: &[&str] = &["Bilinear", "Bicubic"];
+
+// After Effects' popup items of the batch-6 effects as 903 stores them (`pdnm`).
+/// 903.
+pub const TURB_DISPLACEMENT: &[&str] = &[
+    "Turbulent",
+    "Bulge",
+    "Twist",
+    "(-",
+    "Turbulent Smoother",
+    "Bulge Smoother",
+    "Twist Smoother",
+    "(-",
+    "Vertical Displacement",
+    "Horizontal Displacement",
+    "Cross Displacement",
+];
+/// 903.
+pub const TURB_PINNING: &[&str] = &[
+    "None",
+    "(-",
+    "Pin All",
+    "Pin Horizontal",
+    "Pin Vertical",
+    "Pin Left",
+    "Pin Right",
+    "Pin Top",
+    "Pin Bottom",
+    "(-",
+    "Pin All Locked",
+    "Pin Horizontal Locked",
+    "Pin Vertical Locked",
+    "Pin Left Locked",
+    "Pin Right Locked",
+    "Pin Top Locked",
+    "Pin Bottom Locked",
+];
+/// 903.
+pub const FRACTAL_TYPE: &[&str] = &[
+    "Basic",
+    "(-",
+    "Turbulent Smooth",
+    "Turbulent Basic",
+    "Turbulent Sharp",
+    "(-",
+    "Dynamic",
+    "Dynamic Progressive",
+    "Dynamic Twist",
+    "(-",
+    "Max",
+    "Smeary",
+    "Swirly",
+    "Rocky",
+    "Cloudy",
+    "Terrain",
+    "Subscale",
+    "Small Bumps",
+    "Strings",
+    "Threads",
+];
+/// 903.
+pub const NOISE_TYPE: &[&str] = &["Block", "Linear", "Soft Linear", "Spline"];
+/// 903.
+pub const OVERFLOW: &[&str] = &["Clip", "Soft Clamp", "Wrap Back", "Allow HDR Results"];
+/// 903 (Fractal Noise).
+pub const FRACTAL_BLEND: &[&str] = &[
+    "None",
+    "Normal",
+    "(-",
+    "Add",
+    "Multiply",
+    "Screen",
+    "Overlay",
+    "Soft Light",
+    "Hard Light",
+    "(-",
+    "Color Dodge",
+    "Color Burn",
+    "(-",
+    "Darken",
+    "Lighten",
+    "Difference",
+    "Exclusion",
+    "(-",
+    "Hue",
+    "Saturation",
+    "Luminosity",
+];
+/// 903 (4-Color Gradient).
+pub const FOUR_COLOR_BLEND: &[&str] = &[
+    "None",
+    "Normal",
+    "(-",
+    "Add",
+    "Multiply",
+    "Screen",
+    "Overlay",
+    "Soft Light",
+    "Hard Light",
+    "(-",
+    "Color Dodge",
+    "Color Burn",
+    "(-",
+    "Darken",
+    "Lighten",
+    "Difference",
+    "Exclusion",
+    "(-",
+    "Hue",
+    "Saturation",
+    "Color",
+    "Luminosity",
+];
+/// 903 (Grid).
+pub const GRID_BLEND: &[&str] = &[
+    "None",
+    "Normal",
+    "Stencil Alpha",
+    "(-",
+    "Add",
+    "Multiply",
+    "Screen",
+    "Overlay",
+    "Soft Light",
+    "Hard Light",
+    "(-",
+    "Color Dodge",
+    "Color Burn",
+    "(-",
+    "Darken",
+    "Lighten",
+    "Difference",
+    "Exclusion",
+    "(-",
+    "Hue",
+    "Saturation",
+    "Color",
+    "Luminosity",
+];
+/// 903.
+pub const FAST_ZOOM: &[&str] = &["Standard", "Brightest", "Darkest"];
+/// 903.
+pub const GRID_SIZE_FROM: &[&str] = &["Corner Point", "Width Slider", "Width & Height Sliders"];
+/// 903.
+pub const KEY_VIEW: &[&str] = &["Final Output", "Source Only", "Matte Only"];
+/// 903.
+pub const MATCH_COLORS: &[&str] = &["Using RGB", "Using Hue", "Using Chroma"];
+/// 903.
+pub const KEY_OPERATION: &[&str] = &["Key Colors", "Keep Colors"];
+/// 903.
+pub const WIPE: &[&str] = &["Clockwise", "Counterclockwise", "Both"];
+/// 903.
+pub const BEND_PRESTART: &[&str] = &["None", "Static", "Bend", "Mirror"];
+/// 903.
+pub const CHANGE_VIEW: &[&str] = &["Corrected Layer", "Color Correction Mask"];
+/// 903.
+pub const EXTRACT_CHANNEL: &[&str] = &["Luminance", "Red", "Green", "Blue", "Alpha"];
+/// 903.
+pub const NOISE_HLS: &[&str] = &["Uniform", "Squared", "Grain"];
+/// 903.
+pub const SCATTER_GRAIN: &[&str] = &["Both", "Horizontal", "Vertical"];
+/// 903.
+pub const SWEEP_SHAPE: &[&str] = &["Linear", "Smooth", "Sharp"];
+/// 903.
+pub const SWEEP_RECEPTION: &[&str] = &["Add", "Composite", "Cutout"];
+/// 903.
+pub const DISPLACE_USE: &[&str] = &["Red", "Green", "Blue", "Alpha", "Luminance", "Hue", "Lightness", "Saturation", "Full", "Half", "Off"];
+/// 903.
+pub const DISPLACE_BEHAVIOR: &[&str] = &["Center Map", "Stretch Map to Fit", "Tile Map"];
+/// 903.
+pub const MATTE_USE: &[&str] = &["Red Channel", "Green Channel", "Blue Channel", "Alpha Channel", "Luminance", "Hue", "Lightness", "Saturation", "Full", "Off"];
+/// 903.
+pub const SHUTTER_CONTROL: &[&str] = &["Manual", "Automatic"];
+
+// After Effects' popup items of the #3110 effects as the 2026-11-05 importer block stores them
+// (`pdnm`; the `echo-*` and `colstab-*` compositions).
+/// Echo's Echo Operator (`echo-05` ... `echo-10`).
+pub const ECHO_OPERATOR: &[&str] = &["Add", "Maximum", "Minimum", "Screen", "Composite In Back", "Composite In Front", "Blend"];
+/// Color Stabilizer's Stabilize (`colstab-02`, `colstab-03`; the fresh default is Levels).
+pub const STABILIZE: &[&str] = &["Brightness", "Levels", "Curves"];
+/// IDentifier's Display (`identifier-04` ... `identifier-06`, `1300-thirdparty.aep`).
+pub const IDENTIFIER_DISPLAY: &[&str] = &["Colors", "Luma Matte", "Alpha Matte", "Raw"];
+
+/// The effects the importer converts.
+pub const EFFECTS: &[EffectMap] = &[
+    // Tint (356-364): Map Black To, Map White To, Amount to Tint; 4 = Swap Colors (a button).
+    fx(
+        "ADBE Tint",
+        "ec.color.tint",
+        &[pm(1, K::Color, "black", Conv::Color), pm(2, K::Color, "white", Conv::Color), pm(3, K::FixedSlider, "amount", Conv::Percent { valid_max: 100.0 })],
+    ),
+    // Gradient Ramp (368-383): 8 = Swap Colors (a button).
+    fx(
+        "ADBE Ramp",
+        "ec.generate.gradientramp",
+        &[
+            pm(1, K::Point, "start", Conv::Point),
+            pm(2, K::Color, "startColor", Conv::Color),
+            pm(3, K::Point, "end", Conv::Point),
+            pm(4, K::Color, "endColor", Conv::Color),
+            pm(5, K::Popup, "shape", Conv::Popup { default: 1, items: RAMP_SHAPE }),
+            pm(6, K::FixedSlider, "scatter", Conv::Plain { valid_max: 512.0 }),
+            pm(7, K::FixedSlider, "blend", Conv::Percent { valid_max: 1.0 }),
+        ],
+    ),
+    // Exposure (389-397): 1 Channels; Master 2-6, Red 7-11, Green 12-16, Blue 17-21, each
+    // [group start, Exposure, Offset, Gamma Correction, group end]; 22 Bypass Linear Light
+    // Conversion. Valid maxima: Exposure 100 (stops), Offset 2, Gamma Correction 10.
+    fx(
+        "ADBE Exposure2",
+        "ec.color.exposure",
+        &[
+            pm(1, K::Popup, "channels", Conv::Popup { default: 1, items: EXPOSURE_CHANNELS }),
+            pm(3, K::FloatSlider, "master/exposure", EXPOSURE),
+            pm(4, K::FloatSlider, "master/offset", OFFSET),
+            pm(5, K::FloatSlider, "master/gamma", GAMMA),
+            pm(8, K::FloatSlider, "red/redExposure", EXPOSURE),
+            pm(9, K::FloatSlider, "red/redOffset", OFFSET),
+            pm(10, K::FloatSlider, "red/redGamma", GAMMA),
+            pm(13, K::FloatSlider, "green/greenExposure", EXPOSURE),
+            pm(14, K::FloatSlider, "green/greenOffset", OFFSET),
+            pm(15, K::FloatSlider, "green/greenGamma", GAMMA),
+            pm(18, K::FloatSlider, "blue/blueExposure", EXPOSURE),
+            pm(19, K::FloatSlider, "blue/blueOffset", OFFSET),
+            pm(20, K::FloatSlider, "blue/blueGamma", GAMMA),
+            pm(22, K::Checkbox, "bypassLinearLight", Conv::Checkbox),
+        ],
+    ),
+    // Invert (409-411): Channel (16 items with separators), Blend With Original (percent).
+    fx(
+        "ADBE Invert",
+        "ec.channel.invert",
+        &[pm(1, K::Popup, "channel", Conv::Popup { default: 1, items: INVERT_CHANNEL }), pm(2, K::FixedSlider, "blend", Conv::Plain { valid_max: 100.0 })],
+    ),
+    // Fast Box Blur (412-416).
+    fx(
+        "ADBE Box Blur2",
+        "ec.blur.fastbox",
+        &[
+            pm(1, K::FixedSlider, "radius", Conv::Plain { valid_max: 30000.0 }),
+            pm(2, K::IntSlider, "iterations", Conv::Plain { valid_max: 50.0 }),
+            pm(3, K::Popup, "dimensions", Conv::Popup { default: 1, items: BLUR_DIMENSIONS }),
+            pm(4, K::Checkbox, "repeatEdge", Conv::Checkbox),
+        ],
+    ),
+    // Gaussian Blur (214, 216, 300, 301, 417-419).
+    fx(
+        "ADBE Gaussian Blur 2",
+        "ec.blur.gaussian",
+        &[
+            pm(1, K::FloatSlider, "blurriness", Conv::Plain { valid_max: 30000.0 }),
+            pm(2, K::Popup, "dimensions", Conv::Popup { default: 1, items: BLUR_DIMENSIONS }),
+            pm(3, K::Checkbox, "repeatEdge", Conv::Checkbox),
+        ],
+    ),
+    // Drop Shadow (080, 420-426).
+    fx(
+        "ADBE Drop Shadow",
+        "ec.perspective.dropshadow",
+        &[
+            pm(1, K::Color, "color", Conv::Color),
+            pm(2, K::FixedSlider, "opacity", Conv::Percent { valid_max: 255.0 }),
+            pm(3, K::Angle, "direction", Conv::Angle),
+            pm(4, K::FixedSlider, "distance", Conv::Plain { valid_max: 4000.0 }),
+            pm(5, K::FixedSlider, "softness", Conv::Plain { valid_max: 30000.0 }),
+            pm(6, K::Checkbox, "shadowOnly", Conv::Checkbox),
+        ],
+    ),
+    // Timewarp (529-533): Speed and Source Frame are plain numbers (valid max 5 000); the
+    // tuning, motion blur, matte and crop parameters are not mapped (reported when stored).
+    fx(
+        "ADBE Timewarp",
+        "ec.time.timewarp",
+        &[
+            pm(1, K::Popup, "method", Conv::Popup { default: 3, items: TIMEWARP_METHOD }),
+            pm(2, K::Popup, "adjustTimeBy", Conv::Popup { default: 1, items: TIMEWARP_ADJUST }),
+            pm(3, K::FixedSlider, "speed", Conv::Plain { valid_max: 5000.0 }),
+            pm(4, K::FixedSlider, "sourceFrame", Conv::Plain { valid_max: 5000.0 }),
+        ],
+    ),
+    // Glow (427-441).
+    fx(
+        "ADBE Glo2",
+        "ec.stylize.glow",
+        &[
+            pm(1, K::Popup, "based", Conv::Popup { default: 2, items: GLOW_BASED_ON }),
+            pm(2, K::FixedSlider, "threshold", Conv::Percent { valid_max: 255.0 }),
+            pm(3, K::FixedSlider, "radius", Conv::Plain { valid_max: 1000.0 }),
+            pm(4, K::FixedSlider, "intensity", Conv::Plain { valid_max: 255.0 }),
+            pm(5, K::Popup, "operation", Conv::Popup { default: 2, items: GLOW_COMPOSITE }),
+            pm(6, K::Popup, "glowOperation", Conv::Popup { default: 3, items: GLOW_OPERATION }),
+            pm(7, K::Popup, "colors", Conv::Popup { default: 1, items: GLOW_COLORS }),
+            pm(8, K::Popup, "colorLooping", Conv::Popup { default: 3, items: GLOW_LOOPING }),
+            pm(9, K::FixedSlider, "colorLoops", Conv::Plain { valid_max: 127.0 }),
+            pm(10, K::Angle, "colorPhase", Conv::Angle),
+            pm(11, K::FixedSlider, "abMidpoint", Conv::Factor { valid_max: GLOW_MIDPOINT_MAX, factor: 100.0 }),
+            pm(12, K::Color, "colorA", Conv::Color),
+            pm(13, K::Color, "colorB", Conv::Color),
+            pm(14, K::Popup, "glowDimensions", Conv::Popup { default: 1, items: BLUR_DIMENSIONS }),
+        ],
+    ),
+    // Fill (079, 210, 215, 302, 303, 307): 1 Fill Mask (a path reference, reported when set).
+    fx(
+        "ADBE Fill",
+        "ec.generate.fill",
+        &[
+            pm(2, K::Checkbox, "allMasks", Conv::Checkbox),
+            pm(3, K::Color, "color", Conv::Color),
+            pm(4, K::Checkbox, "invert", Conv::Checkbox),
+            pm(5, K::FixedSlider, "horizontalFeather", Conv::Plain { valid_max: 999.0 }),
+            pm(6, K::FixedSlider, "verticalFeather", Conv::Plain { valid_max: 999.0 }),
+            pm(7, K::FixedSlider, "opacity", Conv::Percent { valid_max: 1.0 }),
+        ],
+    ),
+    // Hue/Saturation (443-450): the master values are arbitrary data (parameter 2).
+    EffectMap {
+        match_name: "ADBE HUE SATURATION",
+        effect: "ec.color.huesaturation",
+        params: &[
+            pm(1, K::Popup, "channelControl", Conv::Popup { default: 1, items: HUE_SAT_CHANNEL }),
+            pm(6, K::Checkbox, "colorize", Conv::Checkbox),
+            pm(7, K::Angle, "colorizeHue", Conv::Angle),
+            pm(8, K::FixedSlider, "colorizeSaturation", Conv::Plain { valid_max: 100.0 }),
+            pm(9, K::FixedSlider, "colorizeLightness", Conv::Plain { valid_max: 100.0 }),
+        ],
+        extra: Extra::HueSaturation,
+    },
+    // Levels (511-516): the values are arbitrary data (parameter 2).
+    EffectMap {
+        match_name: "ADBE Easy Levels2",
+        effect: "ec.color.levels",
+        params: &[
+            pm(1, K::Popup, "channel", Conv::Popup { default: 1, items: LEVELS_CHANNEL }),
+            pm(8, K::Popup, "clipToOutputBlack", Conv::Popup { default: 3, items: LEVELS_CLIP }),
+            pm(9, K::Popup, "clipToOutputWhite", Conv::Popup { default: 3, items: LEVELS_CLIP }),
+        ],
+        extra: Extra::Levels,
+    },
+    // Curves (961-964, FORMAT S.1): 1 Channel only picks the curve shown (UI), 2 the curves
+    // themselves (arbitrary data, always stored).
+    EffectMap { match_name: "ADBE CurvesCustom", effect: "ec.color.curves", params: &[pm(1, K::Popup, "", Conv::Skip)], extra: Extra::Curves },
+    // Mesh Warp (965, 985, FORMAT S.2): Rows, Columns, Quality are integer sliders (records only
+    // when not at the default), 4 the Distortion Mesh (arbitrary data, always stored).
+    EffectMap {
+        match_name: "ADBE MESH WARP",
+        effect: "ec.distort.meshwarp",
+        params: &[
+            pm(1, K::IntSlider, "rows", Conv::Plain { valid_max: 31.0 }),
+            pm(2, K::IntSlider, "columns", Conv::Plain { valid_max: 31.0 }),
+            pm(3, K::IntSlider, "quality", Conv::Plain { valid_max: 10.0 }),
+        ],
+        extra: Extra::MeshWarp,
+    },
+    // Lumetri Color (1200): the parameters are mapped by match name, not by `parT` index
+    // (`import/lumetri.rs`).
+    EffectMap { match_name: "ADBE Lumetri", effect: "ec.color.lumetri", params: &[], extra: Extra::Lumetri },
+    // The Cryptomatte plug-in (docs/aep-format.md 3.7): 1 Settings data, 2 Output, 3 Selection
+    // Mode, imported by the Cryptomatte step (`Extra::Cryptomatte`).
+    EffectMap { match_name: "Cryptomatte", effect: "ec.3d.cryptomatte", params: &[], extra: Extra::Cryptomatte },
+    // Expression controls (070-077, 217-221, 310).
+    // Directional Blur (711): Direction in degrees, Blur Length in pixels (valid max 1 000).
+    fx(
+        "ADBE Motion Blur",
+        "ec.blur.directional",
+        &[pm(1, K::Angle, "direction", Conv::Angle), pm(2, K::FixedSlider, "length", Conv::Plain { valid_max: 1000.0 })],
+    ),
+    // Radial Blur (712, 713): 1 is a hidden entry without data; 6 Random Seed has no EffectCraft
+    // parameter (reported when stored).
+    fx(
+        "ADBE Radial Blur",
+        "ec.blur.radial",
+        &[
+            pm(2, K::FixedSlider, "amount", Conv::Plain { valid_max: 1000.0 }),
+            pm(3, K::Point, "center", Conv::Point),
+            pm(4, K::Popup, "type", Conv::Popup { default: 1, items: RADIAL_TYPE }),
+            pm(5, K::Popup, "antialiasing", Conv::Popup { default: 1, items: RADIAL_AA }),
+        ],
+    ),
+    // CC Radial Blur (712, 714).
+    fx(
+        "CC Radial Blur",
+        "ec.blur.ccradial",
+        &[
+            pm(1, K::Popup, "type", Conv::Popup { default: 6, items: CC_RADIAL_TYPE }),
+            pm(2, K::FixedSlider, "amount", Conv::Plain { valid_max: 250.0 }),
+            pm(3, K::FixedSlider, "quality", Conv::Plain { valid_max: 100.0 }),
+            pm(4, K::Point, "center", Conv::Point),
+        ],
+    ),
+    // Venetian Blinds (712, 715).
+    fx(
+        "ADBE Venetian Blinds",
+        "ec.transition.venetian",
+        &[
+            pm(1, K::FixedSlider, "completion", Conv::Plain { valid_max: 100.0 }),
+            pm(2, K::Angle, "direction", Conv::Angle),
+            pm(3, K::FixedSlider, "width", Conv::Plain { valid_max: 32000.0 }),
+            pm(4, K::FixedSlider, "feather", Conv::Plain { valid_max: 32000.0 }),
+        ],
+    ),
+    // Channel Blur (712, 716): 5 Edge Behavior is the Repeat Edge Pixels checkbox (on by default).
+    fx(
+        "ADBE Channel Blur",
+        "ec.blur.channel",
+        &[
+            pm(1, K::FixedSlider, "redBlurriness", Conv::Plain { valid_max: 32767.0 }),
+            pm(2, K::FixedSlider, "greenBlurriness", Conv::Plain { valid_max: 32767.0 }),
+            pm(3, K::FixedSlider, "blueBlurriness", Conv::Plain { valid_max: 32767.0 }),
+            pm(4, K::FixedSlider, "alphaBlurriness", Conv::Plain { valid_max: 32767.0 }),
+            pm(5, K::Checkbox, "repeatEdge", Conv::Checkbox),
+            pm(6, K::Popup, "dimensions", Conv::Popup { default: 1, items: BLUR_DIMENSIONS }),
+        ],
+    ),
+    // Black & White (712, 717): six float sliders (valid -200..300), Tint, Tint Color.
+    fx(
+        "ADBE Black&White",
+        "ec.color.blackwhite",
+        &[
+            pm(1, K::FloatSlider, "reds", Conv::Plain { valid_max: 300.0 }),
+            pm(2, K::FloatSlider, "yellows", Conv::Plain { valid_max: 300.0 }),
+            pm(3, K::FloatSlider, "greens", Conv::Plain { valid_max: 300.0 }),
+            pm(4, K::FloatSlider, "cyans", Conv::Plain { valid_max: 300.0 }),
+            pm(5, K::FloatSlider, "blues", Conv::Plain { valid_max: 300.0 }),
+            pm(6, K::FloatSlider, "magentas", Conv::Plain { valid_max: 300.0 }),
+            pm(7, K::Checkbox, "tint", Conv::Checkbox),
+            pm(8, K::Color, "tintColor", Conv::Color),
+        ],
+    ),
+    // Tritone (712, 718).
+    fx(
+        "ADBE Tritone",
+        "ec.color.tritone",
+        &[
+            pm(1, K::Color, "highlights", Conv::Color),
+            pm(2, K::Color, "midtones", Conv::Color),
+            pm(3, K::Color, "shadows", Conv::Color),
+            pm(4, K::FloatSlider, "blend", Conv::Plain { valid_max: 100.0 }),
+        ],
+    ),
+    // Luma Key (712, 719): threshold and tolerance 0..255, Edge Thin an integer to 5.
+    fx(
+        "ADBE Luma Key",
+        "ec.key.luma",
+        &[
+            pm(1, K::Popup, "keyType", Conv::Popup { default: 2, items: LUMA_KEY_TYPE }),
+            pm(2, K::IntSlider, "threshold", Conv::Plain { valid_max: 255.0 }),
+            pm(3, K::IntSlider, "tolerance", Conv::Plain { valid_max: 255.0 }),
+            pm(4, K::IntSlider, "edgeThin", Conv::Plain { valid_max: 5.0 }),
+            pm(5, K::FixedSlider, "edgeFeather", Conv::Plain { valid_max: 100.0 }),
+        ],
+    ),
+    // Simple Choker (712, 720, 721).
+    fx(
+        "ADBE Simple Choker",
+        "ec.matte.simplechoker",
+        &[pm(1, K::Popup, "view", Conv::Popup { default: 1, items: CHOKER_VIEW }), pm(2, K::FixedSlider, "chokeMatte", Conv::Plain { valid_max: 100.0 })],
+    ),
+    // Matte Choker (712, 722): the gray level softnesses are fractions (valid max 1, default 0.1
+    // and 1), percentages here.
+    fx(
+        "ADBE Matte Choker",
+        "ec.matte.mattechoker",
+        &[
+            pm(1, K::FixedSlider, "geometricSoftness1", Conv::Plain { valid_max: 100.0 }),
+            pm(2, K::IntSlider, "choke1", Conv::Plain { valid_max: 127.0 }),
+            pm(3, K::FixedSlider, "grayLevelSoftness1", Conv::Percent { valid_max: 1.0 }),
+            pm(4, K::FixedSlider, "geometricSoftness2", Conv::Plain { valid_max: 100.0 }),
+            pm(5, K::IntSlider, "choke2", Conv::Plain { valid_max: 127.0 }),
+            pm(6, K::FixedSlider, "grayLevelSoftness2", Conv::Percent { valid_max: 1.0 }),
+            pm(7, K::IntSlider, "iterations", Conv::Plain { valid_max: 100.0 }),
+        ],
+    ),
+    // Transform (712, 723).
+    fx(
+        "ADBE Geometry2",
+        "ec.distort.transform",
+        &[
+            pm(1, K::Point, "anchor", Conv::Point),
+            pm(2, K::Point, "position", Conv::Point),
+            pm(3, K::Checkbox, "uniform", Conv::Checkbox),
+            pm(4, K::FixedSlider, "scaleHeight", Conv::Plain { valid_max: 30000.0 }),
+            pm(5, K::FixedSlider, "scaleWidth", Conv::Plain { valid_max: 30000.0 }),
+            pm(6, K::FixedSlider, "skew", Conv::Plain { valid_max: 70.0 }),
+            pm(7, K::Angle, "skewAxis", Conv::Angle),
+            pm(8, K::Angle, "rotation", Conv::Angle),
+            pm(9, K::FixedSlider, "opacity", Conv::Plain { valid_max: 100.0 }),
+            pm(10, K::Checkbox, "useCompositionShutterAngle", Conv::Checkbox),
+            pm(11, K::FixedSlider, "shutterAngle", Conv::Plain { valid_max: 360.0 }),
+            pm(12, K::Popup, "sampling", Conv::Popup { default: 1, items: SAMPLING }),
+        ],
+    ),
+    // Brightness & Contrast (903, 904 E01).
+    fx(
+        "ADBE Brightness & Contrast 2",
+        "ec.color.brightnesscontrast",
+        &[
+            pm(1, K::FixedSlider, "brightness", Conv::Plain { valid_max: 150.0 }),
+            pm(2, K::FixedSlider, "contrast", Conv::Plain { valid_max: 100.0 }),
+            pm(3, K::Checkbox, "useLegacy", Conv::Checkbox),
+        ],
+    ),
+    // Turbulent Displace (903, 904 E02); 14 Antialiasing for Best Quality has no counterpart.
+    fx(
+        "ADBE Turbulent Displace",
+        "ec.distort.turbulentdisplace",
+        &[
+            pm(1, K::Popup, "displacement", Conv::Popup { default: 1, items: TURB_DISPLACEMENT }),
+            pm(2, K::FixedSlider, "amount", Conv::Plain { valid_max: 10000.0 }),
+            pm(3, K::FixedSlider, "size", Conv::Plain { valid_max: 1000.0 }),
+            pm(4, K::Point, "offset", Conv::Point),
+            pm(5, K::FixedSlider, "complexity", Conv::Plain { valid_max: 10.0 }),
+            pm(6, K::Angle, "evolution", Conv::Angle),
+            pm(8, K::Checkbox, "evolutionOptions/cycleEvolution", Conv::Checkbox),
+            pm(9, K::IntSlider, "evolutionOptions/cycle", Conv::Plain { valid_max: 88.0 }),
+            pm(10, K::IntSlider, "evolutionOptions/randomSeed", Conv::Plain { valid_max: 100000.0 }),
+            pm(12, K::Popup, "pinning", Conv::Popup { default: 3, items: TURB_PINNING }),
+            pm(13, K::Checkbox, "resizeLayer", Conv::Checkbox),
+        ],
+    ),
+    // Fractal Noise (903, 904 E03).
+    fx(
+        "ADBE Fractal Noise",
+        "ec.noise.fractal",
+        &[
+            pm(1, K::Popup, "fractalType", Conv::Popup { default: 1, items: FRACTAL_TYPE }),
+            pm(2, K::Popup, "noiseType", Conv::Popup { default: 3, items: NOISE_TYPE }),
+            pm(3, K::Checkbox, "invert", Conv::Checkbox),
+            pm(4, K::FixedSlider, "contrast", Conv::Plain { valid_max: 10000.0 }),
+            pm(5, K::FixedSlider, "brightness", Conv::Plain { valid_max: 10000.0 }),
+            pm(6, K::Popup, "overflow", Conv::Popup { default: 4, items: OVERFLOW }),
+            pm(8, K::Angle, "transform/rotation", Conv::Angle),
+            pm(9, K::Checkbox, "transform/uniformScaling", Conv::Checkbox),
+            pm(10, K::FixedSlider, "transform/scale", Conv::Plain { valid_max: 10000.0 }),
+            pm(11, K::FixedSlider, "transform/scaleWidth", Conv::Plain { valid_max: 10000.0 }),
+            pm(12, K::FixedSlider, "transform/scaleHeight", Conv::Plain { valid_max: 10000.0 }),
+            pm(13, K::Point, "transform/offset", Conv::Point),
+            pm(14, K::Checkbox, "transform/perspectiveOffset", Conv::Checkbox),
+            pm(16, K::FixedSlider, "complexity", Conv::Plain { valid_max: 20.0 }),
+            pm(18, K::FixedSlider, "subSettings/subInfluence", Conv::Plain { valid_max: 10000.0 }),
+            pm(19, K::FixedSlider, "subSettings/subScaling", Conv::Plain { valid_max: 10000.0 }),
+            pm(20, K::Angle, "subSettings/subRotation", Conv::Angle),
+            pm(21, K::Point, "subSettings/subOffset", Conv::Point),
+            pm(22, K::Checkbox, "subSettings/centerSubscale", Conv::Checkbox),
+            pm(24, K::Angle, "evolution", Conv::Angle),
+            pm(26, K::Checkbox, "evolutionOptions/cycleEvolution", Conv::Checkbox),
+            pm(27, K::IntSlider, "evolutionOptions/cycle", Conv::Plain { valid_max: 88.0 }),
+            pm(28, K::IntSlider, "evolutionOptions/seed", Conv::Plain { valid_max: 100000.0 }),
+            pm(30, K::FixedSlider, "opacity", Conv::Plain { valid_max: 100.0 }),
+            pm(31, K::Popup, "blendingMode", Conv::Popup { default: 2, items: FRACTAL_BLEND }),
+        ],
+    ),
+    // Beam (903, 904 E04): Length, Time and Softness are 0..1 fractions, percentages here.
+    fx(
+        "ADBE Laser",
+        "ec.generate.beam",
+        &[
+            pm(1, K::Point, "startPoint", Conv::Point),
+            pm(2, K::Point, "endPoint", Conv::Point),
+            pm(3, K::FixedSlider, "length", Conv::Percent { valid_max: 1.0 }),
+            pm(4, K::FixedSlider, "time", Conv::Percent { valid_max: 1.0 }),
+            pm(5, K::FixedSlider, "startThickness", Conv::Plain { valid_max: 4000.0 }),
+            pm(6, K::FixedSlider, "endThickness", Conv::Plain { valid_max: 4000.0 }),
+            pm(7, K::FixedSlider, "softness", Conv::Percent { valid_max: 1.0 }),
+            pm(8, K::Color, "insideColor", Conv::Color),
+            pm(9, K::Color, "outsideColor", Conv::Color),
+            pm(10, K::Checkbox, "perspective3d", Conv::Checkbox),
+            pm(11, K::Checkbox, "compositeOnOriginal", Conv::Checkbox),
+        ],
+    ),
+    // CC Radial Fast Blur (903, 904 E05).
+    fx(
+        "CC Radial Fast Blur",
+        "ec.blur.ccradialfast",
+        &[
+            pm(1, K::Point, "center", Conv::Point),
+            pm(2, K::FixedSlider, "amount", Conv::Plain { valid_max: 100.0 }),
+            pm(3, K::Popup, "zoom", Conv::Popup { default: 1, items: FAST_ZOOM }),
+        ],
+    ),
+    // Noise (903, 904 E06).
+    fx(
+        "ADBE Noise2",
+        "ec.noise.noise",
+        &[
+            pm(1, K::FixedSlider, "amount", Conv::Plain { valid_max: 100.0 }),
+            pm(2, K::Checkbox, "color", Conv::Checkbox),
+            pm(3, K::Checkbox, "clip", Conv::Checkbox),
+        ],
+    ),
+    // Levels (Individual Controls) (903, 904 E07): 1 Channel only picks the histogram shown, 2 the histogram itself (no value).
+    fx(
+        "ADBE Pro Levels2",
+        "ec.color.levelsic",
+        &[
+            pm(2, K::ArbitraryData, "", Conv::Skip),
+            pm(4, K::FloatSlider, "rgb/rgbInBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(5, K::FloatSlider, "rgb/rgbInWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(6, K::FloatSlider, "rgb/rgbGamma", Conv::Plain { valid_max: 5.0 }),
+            pm(7, K::FloatSlider, "rgb/rgbOutBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(8, K::FloatSlider, "rgb/rgbOutWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(11, K::FloatSlider, "red/redInBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(12, K::FloatSlider, "red/redInWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(13, K::FloatSlider, "red/redGamma", Conv::Plain { valid_max: 5.0 }),
+            pm(14, K::FloatSlider, "red/redOutBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(15, K::FloatSlider, "red/redOutWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(18, K::FloatSlider, "green/greenInBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(19, K::FloatSlider, "green/greenInWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(20, K::FloatSlider, "green/greenGamma", Conv::Plain { valid_max: 5.0 }),
+            pm(21, K::FloatSlider, "green/greenOutBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(22, K::FloatSlider, "green/greenOutWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(25, K::FloatSlider, "blue/blueInBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(26, K::FloatSlider, "blue/blueInWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(27, K::FloatSlider, "blue/blueGamma", Conv::Plain { valid_max: 5.0 }),
+            pm(28, K::FloatSlider, "blue/blueOutBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(29, K::FloatSlider, "blue/blueOutWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(32, K::FloatSlider, "alpha/alphaInBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(33, K::FloatSlider, "alpha/alphaInWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(34, K::FloatSlider, "alpha/alphaGamma", Conv::Plain { valid_max: 5.0 }),
+            pm(35, K::FloatSlider, "alpha/alphaOutBlack", Conv::Plain { valid_max: 10000.0 }),
+            pm(36, K::FloatSlider, "alpha/alphaOutWhite", Conv::Plain { valid_max: 10000.0 }),
+            pm(38, K::Popup, "clipToOutputBlack", Conv::Popup { default: 3, items: LEVELS_CLIP }),
+            pm(39, K::Popup, "clipToOutputWhite", Conv::Popup { default: 3, items: LEVELS_CLIP }),
+        ],
+    ),
+    // Corner Pin (903, 904 E08).
+    fx(
+        "ADBE Corner Pin",
+        "ec.distort.cornerpin",
+        &[pm(1, K::Point, "ul", Conv::Point), pm(2, K::Point, "ur", Conv::Point), pm(3, K::Point, "ll", Conv::Point), pm(4, K::Point, "lr", Conv::Point)],
+    ),
+    // Grid (903, 904 E09).
+    fx(
+        "ADBE Grid",
+        "ec.generate.grid",
+        &[
+            pm(1, K::Point, "anchor", Conv::Point),
+            pm(2, K::Popup, "sizeFrom", Conv::Popup { default: 1, items: GRID_SIZE_FROM }),
+            pm(3, K::Point, "corner", Conv::Point),
+            pm(4, K::FixedSlider, "width", Conv::Plain { valid_max: 4000.0 }),
+            pm(5, K::FixedSlider, "height", Conv::Plain { valid_max: 4000.0 }),
+            pm(6, K::FixedSlider, "border", Conv::Plain { valid_max: 2000.0 }),
+            pm(8, K::FixedSlider, "feather/featherWidth", Conv::Plain { valid_max: 400.0 }),
+            pm(9, K::FixedSlider, "feather/featherHeight", Conv::Plain { valid_max: 400.0 }),
+            pm(11, K::Checkbox, "invertGrid", Conv::Checkbox),
+            pm(12, K::Color, "color", Conv::Color),
+            pm(13, K::FixedSlider, "opacity", Conv::Plain { valid_max: 100.0 }),
+            pm(14, K::Popup, "blendingMode", Conv::Popup { default: 1, items: GRID_BLEND }),
+        ],
+    ),
+    // Sharpen (903, 904 E10).
+    fx("ADBE Sharpen", "ec.blur.sharpen", &[pm(1, K::IntSlider, "amount", Conv::Plain { valid_max: 4000.0 })]),
+    // Linear Color Key (903, 904 E11); 1 Preview has no data.
+    fx(
+        "ADBE Linear Color Key2",
+        "ec.key.linearcolor",
+        &[
+            pm(2, K::Popup, "view", Conv::Popup { default: 1, items: KEY_VIEW }),
+            pm(3, K::Color, "keyColor", Conv::Color),
+            pm(4, K::Popup, "matchColors", Conv::Popup { default: 1, items: MATCH_COLORS }),
+            pm(5, K::FixedSlider, "tolerance", Conv::Plain { valid_max: 100.0 }),
+            pm(6, K::FixedSlider, "softness", Conv::Plain { valid_max: 100.0 }),
+            pm(7, K::Popup, "keyOperation", Conv::Popup { default: 1, items: KEY_OPERATION }),
+        ],
+    ),
+    // Radial Wipe (903, 904 E12).
+    fx(
+        "ADBE Radial Wipe",
+        "ec.transition.radialwipe",
+        &[
+            pm(1, K::FixedSlider, "completion", Conv::Plain { valid_max: 100.0 }),
+            pm(2, K::Angle, "startAngle", Conv::Angle),
+            pm(3, K::Point, "center", Conv::Point),
+            pm(4, K::Popup, "wipe", Conv::Popup { default: 1, items: WIPE }),
+            pm(5, K::FixedSlider, "feather", Conv::Plain { valid_max: 32000.0 }),
+        ],
+    ),
+    // Remove Color Matting (903, 904 E13).
+    fx(
+        "ADBE Remove Color Matting",
+        "ec.channel.removecolormatting",
+        &[pm(1, K::Color, "backgroundColor", Conv::Color), pm(2, K::Checkbox, "clipHdr", Conv::Checkbox)],
+    ),
+    // CC Bend It (903, 904 E14): Bend is a slider (valid max 250) in After Effects; 5 Distort has no counterpart.
+    fx(
+        "CC Bend It",
+        "ec.distort.ccbendit",
+        &[
+            pm(1, K::FixedSlider, "bend", Conv::Plain { valid_max: 250.0 }),
+            pm(2, K::Point, "start", Conv::Point),
+            pm(3, K::Point, "end", Conv::Point),
+            pm(4, K::Popup, "renderPrestart", Conv::Popup { default: 3, items: BEND_PRESTART }),
+        ],
+    ),
+    // CC Power Pin (903, 904 E15): Perspective is a 0..1 fraction.
+    fx(
+        "CC Power Pin",
+        "ec.distort.ccpowerpin",
+        &[
+            pm(1, K::Point, "topLeft", Conv::Point),
+            pm(2, K::Point, "topRight", Conv::Point),
+            pm(3, K::Point, "bottomLeft", Conv::Point),
+            pm(4, K::Point, "bottomRight", Conv::Point),
+            pm(5, K::FixedSlider, "perspective", Conv::Percent { valid_max: 1.0 }),
+            pm(6, K::Checkbox, "unstretch", Conv::Checkbox),
+            pm(8, K::FixedSlider, "expandTop", Conv::Plain { valid_max: 200.0 }),
+            pm(9, K::FixedSlider, "expandLeft", Conv::Plain { valid_max: 200.0 }),
+            pm(10, K::FixedSlider, "expandRight", Conv::Plain { valid_max: 200.0 }),
+            pm(11, K::FixedSlider, "expandBottom", Conv::Plain { valid_max: 200.0 }),
+        ],
+    ),
+    // 4-Color Gradient (903, 904 E16).
+    fx(
+        "ADBE 4ColorGradient",
+        "ec.generate.fourcolor",
+        &[
+            pm(2, K::Point, "positionsColors/point1", Conv::Point),
+            pm(3, K::Color, "positionsColors/color1", Conv::Color),
+            pm(4, K::Point, "positionsColors/point2", Conv::Point),
+            pm(5, K::Color, "positionsColors/color2", Conv::Color),
+            pm(6, K::Point, "positionsColors/point3", Conv::Point),
+            pm(7, K::Color, "positionsColors/color3", Conv::Color),
+            pm(8, K::Point, "positionsColors/point4", Conv::Point),
+            pm(9, K::Color, "positionsColors/color4", Conv::Color),
+            pm(11, K::FixedSlider, "blend", Conv::Plain { valid_max: 10000.0 }),
+            pm(12, K::FixedSlider, "jitter", Conv::Plain { valid_max: 500.0 }),
+            pm(13, K::FixedSlider, "opacity", Conv::Plain { valid_max: 100.0 }),
+            pm(14, K::Popup, "blendingMode", Conv::Popup { default: 1, items: FOUR_COLOR_BLEND }),
+        ],
+    ),
+    // Change Color (903, 904 E17).
+    fx(
+        "ADBE Change Color",
+        "ec.color.changecolor",
+        &[
+            pm(1, K::Popup, "view", Conv::Popup { default: 1, items: CHANGE_VIEW }),
+            pm(2, K::FixedSlider, "hueTransform", Conv::Plain { valid_max: 1800.0 }),
+            pm(3, K::FixedSlider, "lightnessTransform", Conv::Plain { valid_max: 100.0 }),
+            pm(4, K::FixedSlider, "saturationTransform", Conv::Plain { valid_max: 100.0 }),
+            pm(5, K::Color, "colorToChange", Conv::Color),
+            pm(6, K::FixedSlider, "matchingTolerance", Conv::Plain { valid_max: 100.0 }),
+            pm(7, K::FixedSlider, "matchingSoftness", Conv::Plain { valid_max: 100.0 }),
+            pm(8, K::Popup, "matchColors", Conv::Popup { default: 1, items: MATCH_COLORS }),
+            pm(9, K::Checkbox, "invertColorCorrectionMask", Conv::Checkbox),
+        ],
+    ),
+    // Extract (903, 904 E18); 1 Histogram has no data.
+    fx(
+        "ADBE Extract",
+        "ec.key.extract",
+        &[
+            pm(2, K::Popup, "channel", Conv::Popup { default: 1, items: EXTRACT_CHANNEL }),
+            pm(3, K::IntSlider, "blackPoint", Conv::Plain { valid_max: 255.0 }),
+            pm(4, K::IntSlider, "whitePoint", Conv::Plain { valid_max: 255.0 }),
+            pm(5, K::IntSlider, "blackSoftness", Conv::Plain { valid_max: 255.0 }),
+            pm(6, K::IntSlider, "whiteSoftness", Conv::Plain { valid_max: 255.0 }),
+            pm(7, K::Checkbox, "invert", Conv::Checkbox),
+        ],
+    ),
+    // Noise HLS (903, 904 E19).
+    fx(
+        "ADBE Noise HLS2",
+        "ec.noise.noisehls",
+        &[
+            pm(1, K::Popup, "noise", Conv::Popup { default: 1, items: NOISE_HLS }),
+            pm(2, K::FloatSlider, "hue", Conv::Plain { valid_max: 1000.0 }),
+            pm(3, K::FloatSlider, "lightness", Conv::Plain { valid_max: 1000.0 }),
+            pm(4, K::FloatSlider, "saturation", Conv::Plain { valid_max: 1000.0 }),
+            pm(5, K::FixedSlider, "grainSize", Conv::Plain { valid_max: 10.0 }),
+            pm(6, K::Angle, "noisePhase", Conv::Angle),
+        ],
+    ),
+    // Scatter (903, 904 E20).
+    fx(
+        "ADBE Scatter",
+        "ec.stylize.scatter",
+        &[
+            pm(1, K::FixedSlider, "amount", Conv::Plain { valid_max: 1000.0 }),
+            pm(2, K::Popup, "grain", Conv::Popup { default: 1, items: SCATTER_GRAIN }),
+            pm(3, K::Checkbox, "randomizeEveryFrame", Conv::Checkbox),
+        ],
+    ),
+    // CC Light Sweep (903, 904 E21).
+    fx(
+        "CC Light Sweep",
+        "ec.generate.cclightsweep",
+        &[
+            pm(1, K::Point, "center", Conv::Point),
+            pm(2, K::Angle, "direction", Conv::Angle),
+            pm(3, K::Popup, "shape", Conv::Popup { default: 3, items: SWEEP_SHAPE }),
+            pm(4, K::FixedSlider, "width", Conv::Plain { valid_max: 4000.0 }),
+            pm(5, K::FixedSlider, "sweepIntensity", Conv::Plain { valid_max: 500.0 }),
+            pm(6, K::FixedSlider, "edgeIntensity", Conv::Plain { valid_max: 500.0 }),
+            pm(7, K::FixedSlider, "edgeThickness", Conv::Plain { valid_max: 20.0 }),
+            pm(8, K::Color, "lightColor", Conv::Color),
+            pm(9, K::Popup, "lightReceptionMode", Conv::Popup { default: 1, items: SWEEP_RECEPTION }),
+        ],
+    ),
+    // Compound Blur (903, 904 E22): an unset Blur Layer is the layer itself in both programs.
+    fx(
+        "ADBE Compound Blur",
+        "ec.blur.compound",
+        &[
+            pm(1, K::Layer, "blurLayer", Conv::LayerRef { own: false }),
+            pm(2, K::FixedSlider, "maximumBlur", Conv::Plain { valid_max: 4000.0 }),
+            pm(3, K::Checkbox, "stretchMapToFit", Conv::Checkbox),
+            pm(4, K::Checkbox, "invertBlur", Conv::Checkbox),
+        ],
+    ),
+    // Displacement Map (903, 904 E23).
+    fx(
+        "ADBE Displacement Map",
+        "ec.distort.displacementmap",
+        &[
+            pm(1, K::Layer, "displacementMapLayer", Conv::LayerRef { own: false }),
+            pm(2, K::Popup, "useForHorizontal", Conv::Popup { default: 1, items: DISPLACE_USE }),
+            pm(3, K::FixedSlider, "maxHorizontal", Conv::Plain { valid_max: 32000.0 }),
+            pm(4, K::Popup, "useForVertical", Conv::Popup { default: 2, items: DISPLACE_USE }),
+            pm(5, K::FixedSlider, "maxVertical", Conv::Plain { valid_max: 32000.0 }),
+            pm(6, K::Popup, "displacementMapBehavior", Conv::Popup { default: 1, items: DISPLACE_BEHAVIOR }),
+            pm(7, K::Checkbox, "wrapPixelsAround", Conv::Checkbox),
+            pm(8, K::Checkbox, "expandOutput", Conv::Checkbox),
+        ],
+    ),
+    // Set Matte (903, 904 E24): an unset Take Matte From Layer is the layer itself.
+    fx(
+        "ADBE Set Matte3",
+        "ec.channel.setmatte",
+        &[
+            pm(1, K::Layer, "takeMatteFromLayer", Conv::LayerRef { own: false }),
+            pm(2, K::Popup, "takeMatteFrom", Conv::Popup { default: 4, items: MATTE_USE }),
+            pm(3, K::Checkbox, "invertMatte", Conv::Checkbox),
+            pm(4, K::Checkbox, "stretchMatteToFit", Conv::Checkbox),
+            pm(5, K::Checkbox, "compositeMatteWithOriginal", Conv::Checkbox),
+            pm(6, K::Checkbox, "premultiplyMatteLayer", Conv::Checkbox),
+        ],
+    ),
+    // Gaussian Blur (Legacy) (903).
+    fx(
+        "ADBE Gaussian Blur",
+        "ec.obsolete.gaussianlegacy",
+        &[
+            pm(1, K::FixedSlider, "blurriness", Conv::Plain { valid_max: 30000.0 }),
+            pm(2, K::Popup, "blurDimensions", Conv::Popup { default: 1, items: BLUR_DIMENSIONS }),
+        ],
+    ),
+    // Pixel Motion Blur (903).
+    fx(
+        "ADBE OFMotionBlur",
+        "ec.time.pixelmotionblur",
+        &[
+            pm(1, K::Popup, "shutterControl", Conv::Popup { default: 1, items: SHUTTER_CONTROL }),
+            pm(2, K::FloatSlider, "shutterAngle", Conv::Plain { valid_max: 5000.0 }),
+            pm(3, K::IntSlider, "shutterSamples", Conv::Plain { valid_max: 256.0 }),
+            pm(4, K::FloatSlider, "vectorDetail", Conv::Plain { valid_max: 100.0 }),
+        ],
+    ),
+    // HDR Highlight Compression (importer block 2026-11-05, `hdr-*`): Amount a float slider in
+    // percent (valid 0..100, default 100).
+    fx("ADBE HDR ToneMap", "ec.utility.hdrcompression", &[pm(1, K::FloatSlider, "amount", Conv::Plain { valid_max: 100.0 })]),
+    // Echo (`echo-*`): Echo Time in seconds (valid -30 000..30 000), Number Of Echoes an integer
+    // (valid 0..30 000), Starting Intensity 0..1, Decay (valid 0..100, slider 0..1), Echo
+    // Operator. EffectCraft's Echo uses at most 255 echoes and a Decay up to 1.
+    fx(
+        "ADBE Echo",
+        "ec.time.echo",
+        &[
+            pm(1, K::FloatSlider, "echoTime", Conv::Plain { valid_max: 30000.0 }),
+            pm_limited(2, K::IntSlider, "numberOfEchoes", Conv::Plain { valid_max: 30000.0 }, 0.0, 255.0),
+            pm(3, K::FloatSlider, "startingIntensity", Conv::Plain { valid_max: 1.0 }),
+            pm_limited(4, K::FloatSlider, "decay", Conv::Plain { valid_max: 100.0 }, 0.0, 1.0),
+            pm(5, K::Popup, "echoOperator", Conv::Popup { default: 1, items: ECHO_OPERATOR }),
+        ],
+    ),
+    // Linear Wipe (`linwipe-*`): Transition Completion and Feather fixed sliders (valid 100 and
+    // 32 000), Wipe Angle in degrees.
+    fx(
+        "ADBE Linear Wipe",
+        "ec.transition.linearwipe",
+        &[
+            pm(1, K::FixedSlider, "completion", Conv::Plain { valid_max: 100.0 }),
+            pm(2, K::Angle, "angle", Conv::Angle),
+            pm(3, K::FixedSlider, "feather", Conv::Plain { valid_max: 32000.0 }),
+        ],
+    ),
+    // Offset (`offset-*`): Blend With Original is a 0..1 fraction, a percentage here.
+    fx("ADBE Offset", "ec.distort.offset", &[pm(1, K::Point, "shift", Conv::Point), pm(2, K::FixedSlider, "blend", Conv::Percent { valid_max: 1.0 })]),
+    // Color Stabilizer (`colstab-*`): Stabilize (fresh default Levels), the three sample points,
+    // Sample Size a fixed slider (valid 50, default 3). The reference frame (Set Frame) is not a
+    // parameter in the file and is not imported.
+    fx(
+        "ADBE Deflicker",
+        "ec.color.colorstabilizer",
+        &[
+            pm(1, K::Popup, "stabilize", Conv::Popup { default: 2, items: STABILIZE }),
+            pm(2, K::Point, "blackPoint", Conv::Point),
+            pm(3, K::Point, "midPoint", Conv::Point),
+            pm(4, K::Point, "whitePoint", Conv::Point),
+            pm(5, K::FixedSlider, "sampleSize", Conv::Plain { valid_max: 50.0 }),
+        ],
+    ),
+    // CC Color Neutralizer (importer block 2026-11-05, `ccneutral-*`): Pinning and Blend w.
+    // Original are float sliders in percent (valid 0..100). After Effects' correction is the Red /
+    // Green / Blue slider of each range (3-5, 9-11, 15-17; the Unbalance colours are pickers that
+    // set them and keep no record), then View (22) and Black / White Point (23, 24):
+    // EffectCraft's CC Color Neutralizer has none of them, so they are reported when stored.
+    fx(
+        "CS Color Neutralizer",
+        "ec.color.cccolorneutralizer",
+        &[pm(19, K::FloatSlider, "pinning", Conv::Plain { valid_max: 100.0 }), pm(20, K::FloatSlider, "blendWOriginal", Conv::Plain { valid_max: 100.0 })],
+    ),
+    // EXtractoR (`extractor-*`): 1 Channel Info (arbitrary data, `Extra::Extractor`), 2 / 6 the
+    // Process group, Black and White Point float sliders (valid ±3.4e38, the float32 range),
+    // UnMult. EffectCraft's Clip has no counterpart and stays off.
+    EffectMap {
+        match_name: "EXtractoR",
+        effect: "ec.3d.extractor",
+        params: &[
+            pm(3, K::FloatSlider, "blackPoint", Conv::Plain { valid_max: F32_MAX }),
+            pm(4, K::FloatSlider, "whitePoint", Conv::Plain { valid_max: F32_MAX }),
+            pm(5, K::Checkbox, "unMult", Conv::Checkbox),
+        ],
+        extra: Extra::Extractor,
+    },
+    // IDentifier (`identifier-*`): 1 Channel Info (arbitrary data, `Extra::Identifier`), 2 Display,
+    // 3 ID an integer slider (valid 0..2 147 483 647).
+    EffectMap {
+        match_name: "IDentifier",
+        effect: "ec.3d.identifier",
+        params: &[
+            pm(2, K::Popup, "display", Conv::Popup { default: 1, items: IDENTIFIER_DISPLAY }),
+            pm(3, K::IntSlider, "id", Conv::Plain { valid_max: 2_147_483_647.0 }),
+        ],
+        extra: Extra::Identifier,
+    },
+    // Layer Control (076, 220, 320, 321): the default is the owning layer, None is unset.
+    fx("ADBE Layer Control", "ec.control.layer", &[pm(1, K::Layer, "layer", Conv::LayerRef { own: true })]),
+    fx("ADBE Slider Control", "ec.control.slider", &[pm(1, K::FloatSlider, "slider", Conv::Plain { valid_max: 1_000_000.0 })]),
+    fx("ADBE Angle Control", "ec.control.angle", &[pm(1, K::Angle, "angle", Conv::Angle)]),
+    fx("ADBE Checkbox Control", "ec.control.checkbox", &[pm(1, K::Checkbox, "checkbox", Conv::Checkbox)]),
+    fx("ADBE Color Control", "ec.control.color", &[pm(1, K::Color, "color", Conv::Color)]),
+    fx("ADBE Point Control", "ec.control.point", &[pm(1, K::Point, "point", Conv::Point)]),
+];
+
+/// Exposure's three sliders, by their valid maximum in the file (389).
+pub const EXPOSURE: Conv = Conv::Plain { valid_max: 100.0 };
+pub const OFFSET: Conv = Conv::Plain { valid_max: 2.0 };
+pub const GAMMA: Conv = Conv::Plain { valid_max: 10.0 };
+/// The largest float32, the valid maximum of EXtractoR's Black and White Point.
+pub const F32_MAX: f64 = f32::MAX as f64;
+/// The valid maximum of Glow's A & B Midpoint (16.16 of 0.99, 427).
+pub const GLOW_MIDPOINT_MAX: f64 = 0.990_005_493_164_062_5;
+
+/// The key a popup item is matched by between the two programs: trimmed, lower case, and
+/// Set Matte's "Red Channel" ... "Alpha Channel" are EffectCraft's "Red" ... "Alpha" (904 E24).
+pub fn popup_key(item: &str) -> String {
+    let s = item.trim().to_ascii_lowercase();
+    s.strip_suffix(" channel").map(str::to_string).unwrap_or(s)
+}
+
+/// The table row of an After Effects match name.
+pub fn by_match_name(match_name: &str) -> Option<&'static EffectMap> {
+    EFFECTS.iter().find(|m| m.match_name == match_name)
+}
+
+/// The table row of an EffectCraft effect id.
+pub fn by_effect(effect: &str) -> Option<&'static EffectMap> {
+    EFFECTS.iter().find(|m| m.effect == effect)
+}
+
+/// The EffectCraft parameters Hue/Saturation's master values (`Extra::HueSaturation`) go to,
+/// in the order of the data (hue, saturation, lightness: 444-446).
+pub const HUE_SATURATION_MASTER: [&str; 3] = ["hue", "saturation", "lightness"];
+
+/// The EffectCraft parameters Levels' RGB channel values (`Extra::Levels`) go to, in the order of
+/// the data (input black, input white, gamma, output black, output white: 512-516).
+pub const LEVELS_RGB: [&str; 5] = ["inBlack", "inWhite", "gamma", "outBlack", "outWhite"];
diff --git a/crates/aep/src/container/effects.rs b/crates/aep/src/container/effects.rs
new file mode 100644
index 000000000..2fa77d017
--- /dev/null
+++ b/crates/aep/src/container/effects.rs
@@ -0,0 +1,727 @@
+//! Effect instances: match name, instance name, the parameter list from `parT`/`pard` and the
+//! values stored with the instance.
+//!
+//! An effect on a layer is a `LIST sspc` under `ADBE Effect Parade`. It holds `fnam` (the
+//! instance name), `LIST parT` (the parameter definitions: `parn`, then a `tdmn` and a 148-byte
+//! `pard` per parameter, a `pdnm` after a popup), `LIST tdgp` (the values) and `pgui`. Only
+//! parameters that differ from their `pard` default have a value record in the `tdgp` (the Layer
+//! Control and button records are the exceptions: they always exist).
+//!
+//! When several layers carry an effect of the same type, only one instance has a full `parT`; the
+//! others have an empty `LIST parT` (case 383). Their parameter definitions are the ones in the
+//! project-level `LIST EfdG` (one `EfDf` per effect type: a `tdmn` with the match name, then a copy
+//! of one instance's `sspc`), see [`Project::effect_params`]. That copy also carries the values of
+//! the instance it was copied from, so values are only ever read from the instance's own `tdgp`.
+//!
+//! Some files have no `EfdG` at all (seen in 17 projects, all from inside After Effects-made
+//! Motion Graphics templates). In those, one instance per effect type kept its full `parT` (which
+//! one is not known) and it is the only place the definitions are written, so the other instances
+//! of that type borrow them from it (#3170).
+
+use std::collections::{HashMap, HashSet};
+
+use crate::container::Chunk;
+use crate::container::bytes::{array, be_f32, be_f64, be_i32, be_u16, be_u32, cstr, text, until_nul};
+use crate::container::typed::{KeyList, Layer, Project, PropGroup, PropNode, Property};
+
+/// The parameter type, the `u32` at byte 12 of `pard`. The numbering matches the plug-in
+/// parameter types of the After Effects effect interface.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ParamKind {
+    /// `0`: a layer reference (also the implicit first parameter, the input layer).
+    Layer,
+    /// `1`: an integer slider (Fast Box Blur's Iterations, 412-414): the default is an `i32` at
+    /// `pard` byte 56 (3), the valid maximum an `i32` at byte 128 (50), the value record a plain
+    /// `f64` (1.0).
+    IntSlider,
+    /// `2`: a fixed-point (16.16) slider.
+    FixedSlider,
+    /// `3`: an angle (16.16 degrees).
+    Angle,
+    /// `4`
+    Checkbox,
+    /// `5`
+    Color,
+    /// `6`
+    Point,
+    /// `7`: a popup menu (the items are in the `pdnm` chunk).
+    Popup,
+    /// `9`: no data (the group-end entry `ADBE Effect Built In Params`).
+    NoData,
+    /// `10`: a floating-point slider.
+    FloatSlider,
+    /// `11`: arbitrary data (Hue/Saturation's Channel Range, Levels' Histogram, 443, 511): the
+    /// value record is a 4-byte `cdat`, the data itself the `aRbp` of the `LIST aRbs` after it,
+    /// see [`Effect::arbitrary_data`].
+    ArbitraryData,
+    /// `12`: a path / mask reference.
+    Path,
+    /// `13`: the start of a twirl-down group (Exposure's Master, Red, Green and Blue, 389). It
+    /// holds no value; its value record always exists with `cdat` 0.
+    GroupStart,
+    /// `14`: the end of a twirl-down group (its name repeats the group's name, 389). It holds no
+    /// value; its value record always exists with `cdat` 0.
+    GroupEnd,
+    /// `15`: a button (Tint's and Gradient Ramp's Swap Colors). It holds no value; its value
+    /// record always exists with `cdat` 0 (356, 368).
+    Button,
+    /// Any other value.
+    Other(u32),
+}
+
+impl ParamKind {
+    fn from_u32(v: u32) -> Self {
+        match v {
+            0 => Self::Layer,
+            1 => Self::IntSlider,
+            2 => Self::FixedSlider,
+            3 => Self::Angle,
+            4 => Self::Checkbox,
+            5 => Self::Color,
+            6 => Self::Point,
+            7 => Self::Popup,
+            9 => Self::NoData,
+            10 => Self::FloatSlider,
+            11 => Self::ArbitraryData,
+            12 => Self::Path,
+            13 => Self::GroupStart,
+            14 => Self::GroupEnd,
+            15 => Self::Button,
+            other => Self::Other(other),
+        }
+    }
+}
+
+/// A decoded parameter value.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum ParamValue {
+    /// A slider or angle value as stored: float sliders, fixed sliders and angles keep a plain
+    /// `f64` in their value record (an angle in degrees; a fixed slider in its own scale, see
+    /// [`EffectParam::valid_max`]); defaults read from `pard` are 16.16 decoded for fixed sliders
+    /// and angles.
+    Number(f64),
+    /// A checkbox: stored as 1.0 when on; an absent record means off.
+    Bool(bool),
+    /// A point control as stored: a fraction of the layer size (`[111, 222]` px on a 1920x1080
+    /// layer is `[111/1920, 222/1080]`).
+    Point([f64; 2]),
+    /// A layer control: the id of the chosen layer (the `tdpi` chunk next to the value record).
+    /// In the implicit first parameter it is the id of the layer that owns the effect.
+    Layer(u32),
+    /// A colour as ARGB fractions 0..1 (stored as doubles 0..255 in the order alpha, red, green,
+    /// blue: a colour `[0.2, 0.6, 1]` is `[255, 51, 153, 255]`, with float rounding).
+    Argb([f64; 4]),
+    /// A popup's item index, 1-based (Gradient Ramp's Radial Ramp is 2, 377): the default in
+    /// `pard`, or the stored selection.
+    Index(u32),
+}
+
+/// What a Layer Control points at, given the id of the layer that owns the effect.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LayerRef {
+    /// The layer itself (the default, "Layer 1" on the first layer): the stored `tdpi` equals the
+    /// owning layer's id.
+    This,
+    /// None: the stored `tdpi` is 0.
+    Nothing,
+    /// Another layer, by id.
+    Layer(u32),
+}
+
+/// An effect instance on a layer.
+#[derive(Debug, Clone)]
+pub struct Effect<'f, 'a> {
+    match_name: String,
+    chunk: &'f Chunk<'a>,
+}
+
+/// Where the parameter definitions of an effect instance come from.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DefinitionSource {
+    /// The instance's own `parT`.
+    Instance,
+    /// The project-level `EfdG/EfDf` copy for the effect's match name (the instance's own `parT`
+    /// is empty, 383).
+    Project,
+    /// The own `parT` of another instance of the same match name in the file: the instance's
+    /// own `parT` is empty and the file has no project-level copy of the type (a project without
+    /// `EfdG`, #3170).
+    OtherInstance,
+    /// None of these has any: the effect has no readable parameter definitions.
+    Missing,
+}
+
+/// One parameter of an effect.
+#[derive(Debug, Clone)]
+pub struct EffectParam<'f, 'a> {
+    /// The position in `parT` (0 is the implicit input layer).
+    pub index: usize,
+    /// The `tdmn` match name (`<effect match name>-NNNN`, the last one is
+    /// `ADBE Effect Built In Params`).
+    pub match_name: String,
+    pub kind: ParamKind,
+    /// The parameter name (`Blurriness`, `Slider`, ...; empty for the implicit parameters).
+    pub name: String,
+    /// The popup items (`pdnm`, split at `|`; for a button its label, e.g. `Swap Colors`).
+    pub items: Option<Vec<String>>,
+    /// True when the definition is borrowed: the project-level copy ([`DefinitionSource::Project`])
+    /// or another instance's ([`DefinitionSource::OtherInstance`]).
+    pub borrowed_definition: bool,
+    pard: &'f [u8],
+    stored: Option<Property<'f, 'a>>,
+}
+
+impl<'f, 'a> Effect<'f, 'a> {
+    /// The effect's match name (`ADBE Slider Control`, `ADBE Gaussian Blur 2`, ...).
+    pub fn match_name(&self) -> &str {
+        &self.match_name
+    }
+
+    /// The underlying `LIST sspc` chunk.
+    pub fn chunk(&self) -> &'f Chunk<'a> {
+        self.chunk
+    }
+
+    /// The instance name shown in the effect controls (`fnam`).
+    pub fn name(&self) -> Option<String> {
+        self.chunk.child(b"fnam")?.children().iter().find(|c| c.is(b"Utf8"))?.bytes().map(text)
+    }
+
+    /// The name the user gave the instance: the `tdsn` of the instance's value group when it is
+    /// not the placeholder `-_0_/-` (610: `My Tint`; `fnam` keeps the effect's own name `Tint`).
+    /// `None` while the instance shows the effect's name.
+    pub fn user_name(&self) -> Option<String> {
+        let values = self.chunk.child_list(b"tdgp")?;
+        let name = values.child(b"tdsn")?.children().iter().find(|c| c.is(b"Utf8"))?.bytes().map(text)?;
+        (name != "-_0_/-" && !name.is_empty()).then_some(name)
+    }
+
+    /// The instance's fx switch: the `tdsb` of its value group is 1 when on and 0 when switched
+    /// off (`fx-switch` cases: one instance on, one off, both in one save). `None` for another
+    /// value or a missing group.
+    pub fn enabled(&self) -> Option<bool> {
+        match be_u32(self.chunk.child_list(b"tdgp")?.child(b"tdsb")?.bytes()?, 0)? {
+            1 => Some(true),
+            0 => Some(false),
+            _ => None,
+        }
+    }
+
+    /// The name After Effects shows for the instance: [`Effect::user_name`], else [`Effect::name`].
+    pub fn display_name(&self) -> Option<String> {
+        self.user_name().or_else(|| self.name())
+    }
+
+    /// The number of parameters declared by `parn` (the implicit input layer and the built-in
+    /// entry included).
+    pub fn declared_param_count(&self) -> Option<u32> {
+        be_u32(self.chunk.child_list(b"parT")?.child(b"parn")?.bytes()?, 0)
+    }
+
+    /// True when the instance's own `parT` holds parameter definitions (a `pard`). A second
+    /// instance of an effect type has an empty `parT` (383).
+    pub fn has_own_definitions(&self) -> bool {
+        self.chunk.child_list(b"parT").is_some_and(has_pard)
+    }
+
+    /// The match names of the value records in the instance's own `tdgp` (properties only, not
+    /// groups), in file order, each once.
+    pub fn value_record_names(&self) -> Vec<String> {
+        let mut seen: HashSet<String> = HashSet::new();
+        self.chunk
+            .child_list(b"tdgp")
+            .and_then(PropGroup::from_chunk)
+            .map(|g| g.entries())
+            .unwrap_or_default()
+            .into_iter()
+            .filter(|e| matches!(e.node, PropNode::Property(_)))
+            .map(|e| e.match_name)
+            .filter(|n| seen.insert(n.clone()))
+            .collect()
+    }
+
+    /// The parameters in the order of the instance's own `parT`. Empty for an instance whose
+    /// `parT` is empty; [`Project::effect_params`] falls back to the project's definitions.
+    pub fn params(&self) -> Vec<EffectParam<'f, 'a>> {
+        match self.chunk.child_list(b"parT") {
+            Some(part) => self.params_from(part, false),
+            None => Vec::new(),
+        }
+    }
+
+    /// The parameters described by `part` (a `LIST parT`) with the values of this instance.
+    fn params_from(&self, part: &'f Chunk<'a>, borrowed: bool) -> Vec<EffectParam<'f, 'a>> {
+        let mut out: Vec<EffectParam<'f, 'a>> = Vec::new();
+        // The stored values by match name: the first entry of a name, as `PropGroup::get` finds it
+        // (a group of that name means no stored value). Indexed once: a lookup per parameter
+        // would scan the whole group for each of them.
+        let mut values: HashMap<String, Option<Property<'f, 'a>>> = HashMap::new();
+        for e in self.chunk.child_list(b"tdgp").and_then(PropGroup::from_chunk).map(|g| g.entries()).unwrap_or_default() {
+            let stored = if let PropNode::Property(p) = e.node { Some(p) } else { None };
+            values.entry(e.match_name).or_insert(stored);
+        }
+        let mut pending: Option<String> = None;
+        for c in part.children() {
+            if c.is(b"tdmn") {
+                pending = c.bytes().map(|b| text(until_nul(b)));
+            } else if c.is(b"pard") {
+                let Some(pard) = c.bytes() else { continue };
+                let match_name = pending.take().unwrap_or_default();
+                let stored = values.get(&match_name).copied().flatten();
+                out.push(EffectParam {
+                    index: out.len(),
+                    match_name,
+                    kind: ParamKind::from_u32(be_u32(pard, 12).unwrap_or(u32::MAX)),
+                    name: cstr(pard, 16, 32).unwrap_or_default(),
+                    items: None,
+                    borrowed_definition: borrowed,
+                    pard,
+                    stored,
+                });
+            } else if c.is(b"pdnm")
+                && let Some(last) = out.last_mut()
+                && let Some(u) = c.children().iter().find(|u| u.is(b"Utf8"))
+                && let Some(b) = u.bytes()
+                // An empty `pdnm` names nothing (EffectCraft's exports write one: the effect
+                // supplies its items).
+                && !b.is_empty()
+            {
+                last.items = Some(text(b).split('|').map(str::to_string).collect());
+            }
+        }
+        out
+    }
+}
+
+fn has_pard(part: &Chunk<'_>) -> bool {
+    part.children().iter().any(|c| c.is(b"pard"))
+}
+
+impl<'f, 'a> Project<'f, 'a> {
+    /// The project-level effect definitions (`LIST EfdG`): one entry per effect type, the match
+    /// name and the `LIST parT` of the copied instance, in file order (the stack order of the
+    /// types, 365/366). The `EfDC` count before them is little-endian and is not needed to read
+    /// them. A type whose copy has no definitions is left out.
+    pub fn effect_definitions(&self) -> Vec<(String, &'f Chunk<'a>)> {
+        let mut out: Vec<(String, &'f Chunk<'a>)> = Vec::new();
+        let Some(defs) = self.effect_defs else { return out };
+        let mut seen: HashSet<String> = HashSet::new();
+        for df in defs.children().iter().filter(|c| c.is_list(b"EfDf")) {
+            let mut name: Option<String> = None;
+            for c in df.children() {
+                if c.is(b"tdmn") {
+                    name = c.bytes().map(|b| text(until_nul(b)));
+                } else if c.is_list(b"sspc")
+                    && let Some(n) = name.take()
+                    && let Some(part) = c.child_list(b"parT").filter(|p| has_pard(p))
+                    && seen.insert(n.clone())
+                {
+                    out.push((n, part));
+                }
+            }
+        }
+        out
+    }
+
+    /// [`Self::effect_definitions`] indexed by match name, for looking up many effects: build it
+    /// once per file, not once per effect (a file can hold many definitions and many instances).
+    /// For a type without a project-level copy it also keeps the own `parT` of the first instance
+    /// in the file (items, layers and effects in file order) that has one.
+    pub fn effect_definition_index(&self) -> EffectDefinitions<'f, 'a> {
+        let by_name: HashMap<String, &'f Chunk<'a>> = self.effect_definitions().into_iter().collect();
+        let mut instances: HashMap<String, &'f Chunk<'a>> = HashMap::new();
+        for item in self.all_items() {
+            let Some(comp) = item.comp() else { continue };
+            for layer in comp.layers() {
+                for fx in layer.effects() {
+                    if by_name.contains_key(&fx.match_name) || instances.contains_key(&fx.match_name) {
+                        continue;
+                    }
+                    if let Some(part) = fx.chunk.child_list(b"parT").filter(|p| has_pard(p)) {
+                        instances.insert(fx.match_name, part);
+                    }
+                }
+            }
+        }
+        EffectDefinitions { by_name, instances }
+    }
+
+    /// Where the parameter definitions of `effect` come from. Builds the index each call: use
+    /// [`Self::effect_definition_index`] for more than one effect.
+    pub fn definition_source(&self, effect: &Effect<'f, 'a>) -> DefinitionSource {
+        self.effect_definition_index().source(effect)
+    }
+
+    /// The parameters of `effect` ([`EffectDefinitions::params`]). Builds the index each call:
+    /// use [`Self::effect_definition_index`] for more than one effect.
+    pub fn effect_params(&self, effect: &Effect<'f, 'a>) -> Vec<EffectParam<'f, 'a>> {
+        self.effect_definition_index().params(effect)
+    }
+}
+
+/// The borrowable effect definitions by match name ([`Project::effect_definition_index`]).
+#[derive(Debug, Clone, Default)]
+pub struct EffectDefinitions<'f, 'a> {
+    /// The project-level copies (`EfdG`).
+    by_name: HashMap<String, &'f Chunk<'a>>,
+    /// For a type without a project-level copy: the own `parT` of the first instance that has one.
+    instances: HashMap<String, &'f Chunk<'a>>,
+}
+
+impl<'f, 'a> EffectDefinitions<'f, 'a> {
+    /// Where the parameter definitions of `effect` come from.
+    pub fn source(&self, effect: &Effect<'f, 'a>) -> DefinitionSource {
+        if effect.has_own_definitions() {
+            DefinitionSource::Instance
+        } else if self.by_name.contains_key(effect.match_name()) {
+            DefinitionSource::Project
+        } else if self.instances.contains_key(effect.match_name()) {
+            DefinitionSource::OtherInstance
+        } else {
+            DefinitionSource::Missing
+        }
+    }
+
+    /// The parameters of `effect`: from its own `parT`, or, when that is empty, from the
+    /// project-level definition of its match name, else from another instance of it that has
+    /// its own ([`EffectParam::borrowed_definition`]). Values always come from the instance's own
+    /// records (absent = the `pard` default); the values next to borrowed definitions belong to
+    /// another instance and are never read.
+    pub fn params(&self, effect: &Effect<'f, 'a>) -> Vec<EffectParam<'f, 'a>> {
+        if effect.has_own_definitions() {
+            return effect.params();
+        }
+        match self.by_name.get(effect.match_name()).or_else(|| self.instances.get(effect.match_name())) {
+            Some(part) => effect.params_from(part, true),
+            None => Vec::new(),
+        }
+    }
+}
+
+impl<'f, 'a> EffectParam<'f, 'a> {
+    /// The raw 148-byte `pard` record (it contains stale memory after the name).
+    pub fn pard(&self) -> &'f [u8] {
+        self.pard
+    }
+
+    /// The value record stored with the instance (`<match>-NNNN` in the instance's `tdgp`), which
+    /// exists only for parameters that differ from the default.
+    pub fn stored(&self) -> Option<Property<'f, 'a>> {
+        self.stored
+    }
+
+    /// True when the parameter's value record has keyframes ([`EffectParam::keys`]); then
+    /// [`EffectParam::stored_value`] is `None` and [`EffectParam::value`] is not the value.
+    pub fn is_animated(&self) -> bool {
+        self.stored.is_some_and(|p| p.is_animated())
+    }
+
+    /// The keyframes of an animated parameter: plain 48-byte records for sliders (363), 152-byte
+    /// colour records (364) and 104-byte spatial records for points (382), with the values in the
+    /// stored units of [`EffectParam::stored_value`].
+    pub fn keys(&self) -> Option<KeyList<'f>> {
+        self.stored?.keys()
+    }
+
+    /// The value in the value record: float and fixed sliders, angles, checkboxes, points,
+    /// colours, popups and layer controls. A record counts when its `tdsb` is 1 and it has no
+    /// keyframes; a layer control reads the `tdpi` chunk; a button has no value.
+    pub fn stored_value(&self) -> Option<ParamValue> {
+        let p = self.stored?;
+        if self.kind != ParamKind::Layer && p.flags() != Some(1) {
+            return None;
+        }
+        self.recorded_value()
+    }
+
+    /// The value in the value record when the record is written (`tdsb` 1) or in the default
+    /// state (`tdsb` 3): what [`EffectParam::stored_value`] reads, also from a default-state
+    /// record. Lumetri Color writes the values of its hidden parameters so (High Dynamic Range,
+    /// HDR Specular, Look: 1200 `lumetri-01-set-all`, `-02-sec-top`, `-06-sec-light`; After
+    /// Effects reads back the recorded values). `None` with keyframes, without a record or for a
+    /// record in any other state (no sample has one; the importer reports it as damaged).
+    pub fn recorded_value(&self) -> Option<ParamValue> {
+        let p = self.stored?;
+        if self.kind == ParamKind::Layer {
+            return be_u32(p.chunk().child(b"tdpi")?.bytes()?, 0).map(ParamValue::Layer);
+        }
+        if !matches!(p.flags(), Some(1 | 3)) || p.is_animated() {
+            return None;
+        }
+        let v = p.static_value()?;
+        match self.kind {
+            ParamKind::FloatSlider | ParamKind::FixedSlider | ParamKind::Angle | ParamKind::IntSlider => v.first().copied().map(ParamValue::Number),
+            ParamKind::Checkbox => v.first().map(|x| ParamValue::Bool(*x != 0.0)),
+            ParamKind::Point => {
+                let [x, y] = *v.as_slice().first_chunk::<2>()?;
+                Some(ParamValue::Point([x, y]))
+            }
+            ParamKind::Popup => {
+                let index = v.first().copied()?;
+                (0.0..=f64::from(u32::MAX)).contains(&index).then(|| ParamValue::Index(index.round() as u32))
+            }
+            ParamKind::Color => {
+                let [a, r, g, b] = *v.as_slice().first_chunk::<4>()?;
+                Some(ParamValue::Argb([a / 255.0, r / 255.0, g / 255.0, b / 255.0]))
+            }
+            _ => None,
+        }
+    }
+
+    /// The default stored in `pard` at byte 56: a float slider's `f64`, a fixed slider's or angle's
+    /// 16.16 value, a colour's ARGB bytes, a popup's item index, a point's two 16.16 fractions of
+    /// the layer size (Point Control 0.5, 0.5: the layer centre, also on a 100x100 layer;
+    /// Gradient Ramp Start 0.5, 0 and End 0.5, 1), an integer slider's `i32` (Iterations 3, 412),
+    /// a checkbox's `u32` (1 = on: Repeat Edge Pixels of Fast Box Blur and Gaussian Blur, read back
+    /// on, 412, 417; 0 = off: Shadow Only 420, Bypass Linear Light Conversion 389); other types:
+    /// `None`.
+    ///
+    /// It is the default and not the current value: Gaussian Blur with Blurriness 40 still has 25
+    /// here and a value record with 40 (After Effects itself reads a fresh Gaussian Blur back as 25).
+    /// Exception: selecting a popup item also writes the selection to this slot. So a popup whose
+    /// definition was borrowed from the project copy ([`EffectParam::borrowed_definition`]) has no
+    /// reliable default here (the slot holds the copied instance's selection): `None`.
+    pub fn pard_default(&self) -> Option<ParamValue> {
+        match self.kind {
+            ParamKind::Popup if self.borrowed_definition => None,
+            ParamKind::FloatSlider => be_f64(self.pard, 56).map(ParamValue::Number),
+            ParamKind::FixedSlider | ParamKind::Angle => be_i32(self.pard, 56).map(|v| ParamValue::Number(f64::from(v) / 65536.0)),
+            ParamKind::IntSlider => be_i32(self.pard, 56).map(|v| ParamValue::Number(f64::from(v))),
+            ParamKind::Checkbox => be_u32(self.pard, 56).map(|v| ParamValue::Bool(v != 0)),
+            ParamKind::Popup => be_u32(self.pard, 56).map(ParamValue::Index),
+            ParamKind::Point => {
+                let p = [f64::from(be_i32(self.pard, 56)?) / 65536.0, f64::from(be_i32(self.pard, 60)?) / 65536.0];
+                // A fresh instance stores fractions of the layer (0.5, 0.5); After Effects' save of
+                // a project it opened stores percent (50, 50: the re-saves of read-back tests e1 and
+                // e2, where Gradient Ramp's Start and End and every other point default came back
+                // as 50 / 0 and 50 / 100). Point
+                // defaults lie inside the layer, so a component beyond 1 tells percent.
+                let percent = p.iter().any(|c| c.abs() > 1.0 + 1e-9);
+                Some(ParamValue::Point(if percent { p.map(|c| c / 100.0) } else { p }))
+            }
+            ParamKind::Color => {
+                let [a, r, g, b] = array::<4>(self.pard, 56)?.map(|c| f64::from(c) / 255.0);
+                Some(ParamValue::Argb([a, r, g, b]))
+            }
+            _ => None,
+        }
+    }
+
+    /// True when the parameter is at its default: it has no value record (a record exists exactly
+    /// when the value differs from the `pard` default; setting a value back to the default removes
+    /// the record again), or the record equals the default. A record in the default state (`tdsb`
+    /// 3) counts with its value ([`EffectParam::recorded_value`]). `None` when that cannot be
+    /// decided (unknown parameter type, keyframes).
+    pub fn is_default(&self) -> Option<bool> {
+        match (self.stored, self.kind) {
+            // A Layer Control always has its record, and a popup selection overwrites the default
+            // in `pard`. Buttons and group markers hold no value at all.
+            (_, ParamKind::Layer | ParamKind::Button | ParamKind::GroupStart | ParamKind::GroupEnd) => None,
+            (None, _) => Some(true),
+            (Some(_), ParamKind::Popup) => Some(false),
+            (Some(_), _) => {
+                let stored = self.recorded_value()?;
+                // A checkbox's default is in `pard` too (on for Repeat Edge Pixels, 412).
+                Some(self.pard_default().is_some_and(|d| d == stored))
+            }
+        }
+    }
+
+    /// A point control in pixels of a layer of this size (the stored point is a fraction of the
+    /// layer size; the default is the layer centre). `None` for other parameter types.
+    pub fn point_px(&self, layer_width: f64, layer_height: f64) -> Option<[f64; 2]> {
+        match self.value()? {
+            ParamValue::Point([x, y]) if self.kind == ParamKind::Point => Some([x * layer_width, y * layer_height]),
+            _ => None,
+        }
+    }
+
+    /// For a Layer Control: what the stored layer id means for the layer that owns the effect.
+    /// `None` for other types and for the implicit first parameter of an effect.
+    pub fn layer_ref(&self, owner_layer_id: u32) -> Option<LayerRef> {
+        if self.kind != ParamKind::Layer || self.index == 0 {
+            return None;
+        }
+        match self.stored_value()? {
+            ParamValue::Layer(0) => Some(LayerRef::Nothing),
+            ParamValue::Layer(id) if id == owner_layer_id => Some(LayerRef::This),
+            ParamValue::Layer(id) => Some(LayerRef::Layer(id)),
+            _ => None,
+        }
+    }
+
+    /// The largest valid value of a slider, from `pard`: a fixed slider's 16.16 at byte 128 (Tint
+    /// Amount to Tint 100, Gradient Ramp Ramp Scatter 512 and Blend With Original 1.0, Drop Shadow
+    /// Opacity 255), a float slider's `f32` at byte 108 (Blurriness 30000, Exposure 100, Exposure's
+    /// Gamma Correction 10). The stored scale of a
+    /// slider differs per parameter (Amount 37.5 % is stored 37.5, Blend 25 % is stored 0.25), so
+    /// this is what tells a reader the scale. `None` for other types.
+    pub fn valid_max(&self) -> Option<f64> {
+        match self.kind {
+            ParamKind::FixedSlider => be_i32(self.pard, 128).map(|v| f64::from(v) / 65536.0),
+            ParamKind::FloatSlider => be_f32(self.pard, 108).map(f64::from),
+            ParamKind::IntSlider => be_i32(self.pard, 128).map(f64::from),
+            _ => None,
+        }
+    }
+
+    /// The smallest valid value of a float slider, the `f32` at byte 104 of `pard` (Exposure
+    /// -100, Offset -2, Gamma Correction 0.1: 389). `None` for other types (a fixed slider's
+    /// minimum is not decoded).
+    pub fn valid_min(&self) -> Option<f64> {
+        match self.kind {
+            ParamKind::FloatSlider => be_f32(self.pard, 104).map(f64::from),
+            _ => None,
+        }
+    }
+
+    /// The range of a float slider's slider (what the control's drag covers, inside the valid
+    /// range): the `f32` pair at bytes 112 and 116 of `pard` (Exposure -4..4, Offset -0.5..0.5,
+    /// Gamma Correction 0.1..10: 389). Each value record repeats it as `tdum` / `tduM`. `None`
+    /// for other types.
+    pub fn slider_range(&self) -> Option<(f64, f64)> {
+        match self.kind {
+            ParamKind::FloatSlider => Some((f64::from(be_f32(self.pard, 112)?), f64::from(be_f32(self.pard, 116)?))),
+            _ => None,
+        }
+    }
+
+    /// For a popup: the number of items (`u16` at byte 60 of `pard`).
+    pub fn popup_item_count(&self) -> Option<u16> {
+        if self.kind != ParamKind::Popup {
+            return None;
+        }
+        be_u16(self.pard, 60)
+    }
+
+    /// For a popup: the selected item index (1-based): the stored selection, else the default.
+    pub fn popup_selected_index(&self) -> Option<u32> {
+        match self.value()? {
+            ParamValue::Index(i) if self.kind == ParamKind::Popup => Some(i),
+            _ => None,
+        }
+    }
+
+    /// For a popup: the text of the selected item.
+    pub fn popup_selected_item(&self) -> Option<&str> {
+        let index = usize::try_from(self.popup_selected_index()?).ok()?.checked_sub(1)?;
+        self.items.as_ref()?.get(index).map(String::as_str)
+    }
+
+    /// The effective value: the value in the record when there is one, also in a record in the
+    /// default state (`tdsb` 3, [`EffectParam::recorded_value`]), else the `pard` default (absent =
+    /// default); a checkbox without a record is off.
+    pub fn value(&self) -> Option<ParamValue> {
+        self.recorded_value().or_else(|| self.pard_default()).or(match self.kind {
+            ParamKind::Checkbox if self.stored.is_none() => Some(ParamValue::Bool(false)),
+            _ => None,
+        })
+    }
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The effects on the layer, in stack order (`ADBE Effect Parade`).
+    pub fn effects(&self) -> Vec<Effect<'f, 'a>> {
+        let Some(root) = self.properties() else { return Vec::new() };
+        let Some(PropNode::Group(parade)) = root.get("ADBE Effect Parade") else { return Vec::new() };
+        parade
+            .entries()
+            .into_iter()
+            .filter_map(|e| match e.node {
+                PropNode::Other(chunk) if chunk.is_list(b"sspc") => Some(Effect { match_name: e.match_name, chunk }),
+                _ => None,
+            })
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tdmn(name: &str) -> Chunk<'static> {
+        let mut b = name.as_bytes().to_vec();
+        b.resize(40, 0);
+        Chunk::data(*b"tdmn", b)
+    }
+
+    fn pard() -> Chunk<'static> {
+        Chunk::data(*b"pard", vec![0u8; 48])
+    }
+
+    fn tdbs() -> Chunk<'static> {
+        Chunk::list(*b"tdbs", Vec::new())
+    }
+
+    /// An effect instance whose `parT` names `defs` and whose `tdgp` stores `stored` (in order).
+    fn instance(defs: &[String], stored: &[(String, Chunk<'static>)]) -> Chunk<'static> {
+        let part = defs.iter().flat_map(|n| [tdmn(n), pard()]).collect();
+        let values = stored.iter().flat_map(|(n, c)| [tdmn(n), c.clone()]).collect();
+        Chunk::list(*b"sspc", vec![Chunk::list(*b"parT", part), Chunk::list(*b"tdgp", values)])
+    }
+
+    #[test]
+    fn a_parameter_takes_the_first_stored_entry_of_its_name() {
+        let names: Vec<String> = ["A", "B", "C"].map(String::from).to_vec();
+        // `A` is stored twice (the first wins), `B` names a group (no stored value), `C` is absent.
+        let stored = vec![
+            ("A".to_string(), tdbs()),
+            ("B".to_string(), Chunk::list(*b"tdgp", Vec::new())),
+            ("A".to_string(), Chunk::list(*b"tdbs", vec![Chunk::data(*b"cdat", vec![0u8; 8])])),
+        ];
+        let chunk = instance(&names, &stored);
+        let fx = Effect { match_name: "X".into(), chunk: &chunk };
+        let params = fx.params();
+        assert_eq!(params.iter().map(|p| p.match_name.as_str()).collect::<Vec<_>>(), ["A", "B", "C"]);
+        let first = params.first().and_then(|p| p.stored).expect("A stored");
+        assert!(first.chunk.children().is_empty(), "the first A (the second has a cdat)");
+        assert!(params.get(1).is_some_and(|p| p.stored.is_none()), "a group of that name is no stored value");
+        assert!(params.get(2).is_some_and(|p| p.stored.is_none()));
+    }
+
+    #[test]
+    fn many_parameters_are_read_in_linear_time() {
+        // 100 000 parameters with 100 000 stored values: a lookup per parameter that scans the
+        // group (as before) is 1e10 entry builds; one index is instant.
+        let n = 100_000;
+        let names: Vec<String> = (0..n).map(|i| format!("P{i}")).collect();
+        let stored: Vec<(String, Chunk<'static>)> = names.iter().map(|m| (m.clone(), tdbs())).collect();
+        let chunk = instance(&names, &stored);
+        let fx = Effect { match_name: "X".into(), chunk: &chunk };
+        let params = fx.params();
+        assert_eq!(params.len(), n);
+        assert!(params.iter().all(|p| p.stored.is_some()));
+    }
+
+    #[test]
+    fn many_project_definitions_are_indexed_once() {
+        // 50 000 definitions, each twice (the first copy wins), then 1000 instances without
+        // their own definitions looked up through one index.
+        let n = 50_000;
+        let mut defs = Vec::new();
+        for round in 0..2 {
+            for i in 0..n {
+                let part = Chunk::list(*b"parT", vec![tdmn(&format!("R{round}")), pard()]);
+                defs.push(Chunk::list(*b"EfDf", vec![tdmn(&format!("FX{i}")), Chunk::list(*b"sspc", vec![part])]));
+            }
+        }
+        let efdg = Chunk::list(*b"EfdG", defs);
+        let fold = Chunk::list(*b"Fold", Vec::new());
+        let project = Project { fold: &fold, effect_defs: Some(&efdg) };
+        let all = project.effect_definitions();
+        assert_eq!(all.len(), n);
+        let index = project.effect_definition_index();
+        let bare = Chunk::list(*b"sspc", vec![Chunk::list(*b"parT", Vec::new())]);
+        for i in (0..n).step_by(50) {
+            let fx = Effect { match_name: format!("FX{i}"), chunk: &bare };
+            assert_eq!(index.source(&fx), DefinitionSource::Project);
+            let params = index.params(&fx);
+            assert_eq!(params.iter().map(|p| p.match_name.as_str()).collect::<Vec<_>>(), ["R0"], "the first copy's definitions");
+            assert!(params.iter().all(|p| p.borrowed_definition));
+        }
+        let unknown = Effect { match_name: "nope".into(), chunk: &bare };
+        assert_eq!(index.source(&unknown), DefinitionSource::Missing);
+        assert!(index.params(&unknown).is_empty());
+        assert_eq!(project.definition_source(&unknown), DefinitionSource::Missing);
+    }
+}
diff --git a/crates/aep/src/container/error.rs b/crates/aep/src/container/error.rs
new file mode 100644
index 000000000..fefc05b24
--- /dev/null
+++ b/crates/aep/src/container/error.rs
@@ -0,0 +1,57 @@
+//! Errors of the container reader and writer.
+
+use std::fmt;
+
+/// Why a file could not be read or written.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AepError {
+    /// The input is shorter than the 12-byte `RIFX` header, or does not start with `RIFX`.
+    NotRifx,
+    /// The form type after the declared size is not `Egg!`.
+    BadFormType([u8; 4]),
+    /// The declared container size runs past the end of the input.
+    Truncated { declared: u64, available: u64 },
+    /// A chunk declares more body bytes than remain in its parent (`offset` is the chunk header).
+    ChunkTooLarge { offset: usize, size: u64, available: u64 },
+    /// The chunk structure is not well formed at `offset` (what is wrong is in `what`).
+    Malformed { offset: usize, what: &'static str },
+    /// Nesting is deeper than the allowed maximum.
+    TooDeep,
+    /// More chunks than the allowed maximum.
+    TooManyChunks,
+    /// A chunk or the whole file would not fit the 32-bit size fields when writing.
+    TooLarge,
+    /// An `.aepx` is not well-formed XML of the subset After Effects writes, at byte `offset`
+    /// (what is wrong is in `what`).
+    Xml { offset: usize, what: &'static str },
+}
+
+impl AepError {
+    /// Structural problems of the input that a lenient caller may repair by keeping a body opaque;
+    /// limits (`TooDeep`, `TooManyChunks`) are never repaired.
+    pub(crate) fn is_structural(&self) -> bool {
+        matches!(self, Self::ChunkTooLarge { .. } | Self::Malformed { .. } | Self::Truncated { .. })
+    }
+}
+
+impl fmt::Display for AepError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::NotRifx => write!(f, "not an After Effects project: no RIFX header"),
+            Self::BadFormType(t) => write!(f, "RIFX form type {:?} is not \"Egg!\"", String::from_utf8_lossy(t)),
+            Self::Truncated { declared, available } => {
+                write!(f, "truncated file: the container declares {declared} bytes, {available} are available")
+            }
+            Self::ChunkTooLarge { offset, size, available } => {
+                write!(f, "chunk at offset {offset} declares {size} bytes, only {available} remain")
+            }
+            Self::Malformed { offset, what } => write!(f, "malformed chunk structure at offset {offset}: {what}"),
+            Self::TooDeep => write!(f, "chunks are nested too deeply"),
+            Self::TooManyChunks => write!(f, "too many chunks"),
+            Self::TooLarge => write!(f, "chunk too large for the 32-bit size field"),
+            Self::Xml { offset, what } => write!(f, "not a readable After Effects XML project (.aepx): {what} at byte {offset}"),
+        }
+    }
+}
+
+impl std::error::Error for AepError {}
diff --git a/crates/aep/src/container/footage.rs b/crates/aep/src/container/footage.rs
new file mode 100644
index 000000000..da0369d64
--- /dev/null
+++ b/crates/aep/src/container/footage.rs
@@ -0,0 +1,409 @@
+//! Item ids and labels, footage items (solids and files), precomp linkage, and the name and size
+//! of a layer's source.
+
+use crate::container::bytes::{be_f32, be_f64, be_u32, cstr, le_u32, text};
+use crate::container::chunk::Chunk;
+use crate::container::header::Rational;
+use crate::container::typed::{Item, ItemKind, Layer, Project};
+
+/// The footage data of an item (`LIST Pin ` with `sspc`, `opti` and, for files, `Als2/alas`).
+#[derive(Debug, Clone, PartialEq)]
+pub struct Footage {
+    /// The 4-character file type tag at byte 22 of `sspc` (`Soli` for a solid, `png!` for a png).
+    pub file_type: String,
+    /// The width in pixels (`u32` at byte 30 of `sspc`).
+    pub width: u32,
+    /// The height in pixels (`u32` at byte 34 of `sspc`).
+    pub height: u32,
+    /// The display name stored in `opti` (the item's own `Utf8` name is empty for footage): at byte
+    /// 26 for a solid and at byte 58 for a file.
+    pub name: Option<String>,
+    /// True for a solid (tag `Soli` at the start of `opti`).
+    pub is_solid: bool,
+    /// The colour of a solid as ARGB floats 0..1 (`opti` bytes 10, 14, 18, 22); a red solid is
+    /// `[1, 1, 0, 0]`.
+    pub solid_argb: Option<[f32; 4]>,
+    /// The file path from the alias JSON (`Als2/alas`, key `fullpath`); none for solids. For an
+    /// image sequence it is the sequence **folder**.
+    pub path: Option<String>,
+    /// The duration in seconds as stored (`sspc` `u32` at byte 38 over `u32` at byte 42; unreduced):
+    /// 0/1 for stills, 48000/48000 for the 1 s WAV (the sample rate is the denominator), 3/30 for
+    /// the three-frame image sequence (the frame rate is the denominator).
+    pub duration: Option<Rational>,
+    /// The native frame rate (`sspc` `u32` at byte 56): 30 for the image sequence, 0 for stills,
+    /// audio and solids (also 0 when the byte is missing).
+    pub native_frame_rate: u32,
+    /// The bits per pixel (`sspc` `u32` at byte 60): 32 for an RGBA still, 24 for an RGB sequence,
+    /// 0 for solids and audio.
+    pub bits_per_pixel: u32,
+    /// The size in bytes of the source file(s) (`sspc` `u32` at byte 208): 149 for the png, 96044
+    /// for the WAV (44 + 48000 x 2), 504 for three 168-byte png files.
+    pub file_size: u32,
+    /// The audio sample rate (`sspc` `f64` at byte 160, 48000.0 for the WAV and for an mp4 with
+    /// 48 kHz sound); `None` for footage without audio.
+    pub audio_sample_rate: Option<f64>,
+    /// True when the alias points at a folder (`"target_is_folder":true`): an image sequence is ONE
+    /// item whose alias is its folder and whose `opti` holds the first file name.
+    pub is_sequence: bool,
+}
+
+impl Footage {
+    /// The number of frames of an image sequence (`duration * native_frame_rate`: 3/30 s at 30 fps is
+    /// 3); `None` for anything else.
+    pub fn sequence_frame_count(&self) -> Option<u32> {
+        if !self.is_sequence {
+            return None;
+        }
+        let d = self.duration?;
+        let frames = i128::from(d.num).checked_mul(i128::from(self.native_frame_rate))?;
+        let den = i128::from(d.den);
+        if den <= 0 || frames % den != 0 {
+            return None;
+        }
+        u32::try_from(frames / den).ok()
+    }
+
+    /// The solid's colour as fractions R, G, B.
+    pub fn solid_rgb(&self) -> Option<[f32; 3]> {
+        let [_, r, g, b] = self.solid_argb?;
+        Some([r, g, b])
+    }
+}
+
+/// The boolean value of `"key"` in a flat JSON object (`true` / `false`); `None` when missing.
+pub(crate) fn json_bool(json: &[u8], key: &str) -> Option<bool> {
+    let needle = format!("\"{key}\":");
+    let needle = needle.as_bytes();
+    let at = json.windows(needle.len()).position(|w| w == needle)?;
+    let rest = json.get(at.checked_add(needle.len())?..)?;
+    if rest.starts_with(b"true") {
+        Some(true)
+    } else if rest.starts_with(b"false") {
+        Some(false)
+    } else {
+        None
+    }
+}
+
+/// The string value of `"key"` in a flat JSON object, with the standard escapes decoded.
+/// Returns `None` when the key is missing or the value is not a string. The key is the first
+/// occurrence of `"key"` that is followed by `:` (the same text as a value is skipped).
+pub(crate) fn json_string(json: &[u8], key: &str) -> Option<String> {
+    let needle = format!("\"{key}\"");
+    let needle = needle.as_bytes();
+    let mut from = 0usize;
+    loop {
+        let at = from.checked_add(json.get(from..)?.windows(needle.len()).position(|w| w == needle)?)?;
+        let after = at.checked_add(needle.len())?;
+        if let Some(v) = json_string_at(json, after) {
+            return Some(v);
+        }
+        from = at.checked_add(1)?;
+    }
+}
+
+/// The string value right after a key ending at `i` (`: "…"`), or `None` when none follows.
+fn json_string_at(json: &[u8], mut i: usize) -> Option<String> {
+    let skip_ws = |i: &mut usize| {
+        while json.get(*i).is_some_and(|c| c.is_ascii_whitespace()) {
+            *i = i.saturating_add(1);
+        }
+    };
+    skip_ws(&mut i);
+    if json.get(i) != Some(&b':') {
+        return None;
+    }
+    i = i.saturating_add(1);
+    skip_ws(&mut i);
+    if json.get(i) != Some(&b'"') {
+        return None;
+    }
+    i = i.saturating_add(1);
+    let mut out: Vec<u8> = Vec::new();
+    loop {
+        let c = *json.get(i)?;
+        i = i.saturating_add(1);
+        match c {
+            b'"' => return Some(text(&out)),
+            b'\\' => {
+                let e = *json.get(i)?;
+                i = i.saturating_add(1);
+                match e {
+                    b'n' => out.push(b'\n'),
+                    b't' => out.push(b'\t'),
+                    b'r' => out.push(b'\r'),
+                    b'b' => out.push(8),
+                    b'f' => out.push(12),
+                    b'u' => {
+                        let hex4 = |at: usize| {
+                            json.get(at..at.checked_add(4)?).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u32::from_str_radix(h, 16).ok())
+                        };
+                        let mut code = hex4(i)?;
+                        i = i.saturating_add(4);
+                        // A character outside the BMP is a high surrogate and a `\u` low surrogate.
+                        if (0xd800..0xdc00).contains(&code)
+                            && json.get(i..i.saturating_add(2)) == Some(b"\\u")
+                            && let Some(lo) = hex4(i.saturating_add(2)).filter(|lo| (0xdc00..0xe000).contains(lo))
+                        {
+                            code = 0x10000 + ((code - 0xd800) << 10) + (lo - 0xdc00);
+                            i = i.saturating_add(6);
+                        }
+                        let ch = char::from_u32(code).unwrap_or('\u{fffd}');
+                        let mut buf = [0u8; 4];
+                        out.extend_from_slice(ch.encode_utf8(&mut buf).as_bytes());
+                    }
+                    other => out.push(other),
+                }
+            }
+            other => out.push(other),
+        }
+    }
+}
+
+/// The numbering of an image sequence item (353, 603), or its file list when it was imported with
+/// Force alphabetical order.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SequenceInfo {
+    /// The file name before the frame number (`seq_`, `shot_`): the first `Utf8` after the alias.
+    /// An empty prefix is not stored (`0001.png`): the one `Utf8` is then the suffix.
+    pub prefix: String,
+    /// The file name after the frame number (`.png`, `.exr`): the second `Utf8` after the alias.
+    pub suffix: String,
+    /// The first and last frame number (`sspc` `u32` at 172 and 176: 1 and 3 in 353, 101 and 103
+    /// in 603; both `0xFFFFFFFF` for a sequence with a file list).
+    pub start: u32,
+    pub end: u32,
+    /// The digits of the frame number (`sspc` `u32` at 180: 3 for `seq_001`, 4 for `shot_0101`).
+    pub digits: u32,
+    /// The file names in order for a sequence imported with Force alphabetical order (`LIST StVc`
+    /// after the alias: `StVS` with the count as a little-endian `u32`, then one `Utf8` per file);
+    /// empty for a numbered sequence. When set, it replaces the numbering.
+    pub files: Vec<String>,
+}
+
+impl SequenceInfo {
+    /// The file name of frame `n` (`shot_0101.exr`).
+    pub fn file_name(&self, n: u32) -> String {
+        let width = usize::try_from(self.digits.min(16)).unwrap_or(0);
+        format!("{}{n:0width$}{}", self.prefix, self.suffix)
+    }
+
+    /// The number of files: the listed files, or the frame numbers from start to end (0 when the
+    /// end lies before the start).
+    pub fn frame_count(&self) -> u32 {
+        if self.files.is_empty() {
+            self.end.checked_sub(self.start).map_or(0, |d| d.saturating_add(1))
+        } else {
+            u32::try_from(self.files.len()).unwrap_or(u32::MAX)
+        }
+    }
+
+    /// The name of the `i`-th file (from 0): from the file list, or numbered from `start`; `None`
+    /// past the last file.
+    pub fn nth_file_name(&self, i: u32) -> Option<String> {
+        if self.files.is_empty() {
+            let n = self.start.checked_add(i).filter(|n| *n <= self.end)?;
+            Some(self.file_name(n))
+        } else {
+            self.files.get(usize::try_from(i).ok()?).cloned()
+        }
+    }
+}
+
+/// The file names of a `LIST StVc` (Force alphabetical order): the `Utf8` children in order, at most
+/// as many as the count in `StVS` (little-endian `u32`) says. Empty names count toward that number
+/// and are then skipped. Without a readable count (no `StVS`, or one shorter than 4 bytes) the list
+/// is unreadable (empty). A name that is not a plain file name (holding `/`, `\`, `:` or a control
+/// character such as NUL, or being `.` or `..`) makes the whole list unreadable (empty): the names
+/// are joined to the folder.
+fn sequence_file_list(list: &Chunk<'_>) -> Vec<String> {
+    // After Effects writes the count first (the one sample); a list without a readable count is
+    // not read rather than guessed.
+    let Some(count) = list.child(b"StVS").and_then(|c| c.bytes()).and_then(|b| le_u32(b, 0)).and_then(|n| usize::try_from(n).ok()) else {
+        return Vec::new();
+    };
+    let names: Vec<String> =
+        list.children().iter().filter(|c| c.is(b"Utf8")).filter_map(|c| c.bytes()).take(count).map(text).filter(|n| !n.is_empty()).collect();
+    if names.iter().any(|n| n.contains(|c: char| matches!(c, '/' | '\\' | ':') || c.is_control()) || n == "." || n == "..") {
+        return Vec::new();
+    }
+    names
+}
+
+/// The prefix and suffix of a sequence whose naming holds one `Utf8` (`part`): After Effects leaves
+/// out an empty prefix (`0001.png` stores only `.png`). The stored first file name (`opti`) decides:
+/// a name starting with `part` has it as the prefix, one ending with it as the suffix. Without that
+/// evidence, a `part` starting with `.` is the suffix (an extension); anything else is not read.
+fn single_name_part(part: &str, first_file: Option<&str>) -> Option<(String, String)> {
+    if let Some(first) = first_file.filter(|_| !part.is_empty()) {
+        match (first.starts_with(part), first.ends_with(part)) {
+            (true, false) => return Some((part.to_string(), String::new())),
+            (false, true) => return Some((String::new(), part.to_string())),
+            _ => {}
+        }
+    }
+    part.starts_with('.').then(|| (String::new(), part.to_string()))
+}
+
+impl<'f, 'a> Item<'f, 'a> {
+    /// The numbering of an image sequence (an item whose alias is a folder); `None` for anything
+    /// else.
+    pub fn sequence_info(&self) -> Option<SequenceInfo> {
+        let f = self.footage()?;
+        if !f.is_sequence {
+            return None;
+        }
+        let pin = self.chunk.child_list(b"Pin ")?;
+        let sspc = pin.child(b"sspc")?.bytes()?;
+        let kids = pin.children();
+        let after = kids.iter().position(|c| c.is_list(b"Als2"))?;
+        let naming = || kids.iter().skip(after.saturating_add(1)).take_while(|c| !c.is(b"opti"));
+        let (start, end, digits) = (be_u32(sspc, 172)?, be_u32(sspc, 176)?, be_u32(sspc, 180)?);
+        // Force alphabetical order: the file list replaces the numbering.
+        if let Some(list) = naming().find(|c| c.is_list(b"StVc")) {
+            let files = sequence_file_list(list);
+            if files.is_empty() {
+                return None;
+            }
+            return Some(SequenceInfo { prefix: String::new(), suffix: String::new(), start, end, digits, files });
+        }
+        let names: Vec<String> = naming().filter(|c| c.is(b"Utf8")).filter_map(|c| c.bytes()).map(text).take(2).collect();
+        let (prefix, suffix) = match names.as_slice() {
+            [prefix, suffix] => (prefix.clone(), suffix.clone()),
+            // An empty prefix is not stored (`0001.png` has only `.png`).
+            [one] => single_name_part(one, f.name.as_deref())?,
+            _ => return None,
+        };
+        Some(SequenceInfo { prefix, suffix, start, end, digits, files: Vec::new() })
+    }
+
+    /// The rate a clip is conformed to (Interpret Footage ▸ Conform to frame rate; `sspc` `u32` at
+    /// byte 146): 30 for the 25 fps mp4 conformed to 30 (645), `None` when not conformed (0 in 644,
+    /// 606) or for an item without footage data. The effective rate is then also at byte 150 while
+    /// the stored duration (bytes 38 / 42) and byte 56 stay native. A conformed image sequence
+    /// stores the new rate in bytes 42, 56 and 150 instead and keeps 0 here (615).
+    pub fn conform_frame_rate(&self) -> Option<u32> {
+        let sspc = self.chunk.child_list(b"Pin ")?.child(b"sspc")?.bytes()?;
+        be_u32(sspc, 146).filter(|r| *r > 0)
+    }
+
+    /// The item id: the big-endian `u32` at byte 16 of `idta` (what a layer's source id refers to).
+    pub fn id(&self) -> Option<u32> {
+        be_u32(self.chunk.child(b"idta")?.bytes()?, 16)
+    }
+
+    /// The label colour index, byte 58 of `idta` (15 for a composition made by precomposing).
+    pub fn label(&self) -> Option<u8> {
+        self.chunk.child(b"idta")?.bytes()?.get(58).copied()
+    }
+
+    /// The ids of the compositions this item uses as precomp layers: the little-endian `u32` of
+    /// each `idpi` chunk.
+    pub fn used_item_ids(&self) -> Vec<u32> {
+        self.chunk.children().iter().filter(|c| c.is(b"idpi")).filter_map(|c| le_u32(c.bytes()?, 0)).collect()
+    }
+
+    /// The footage data of a footage item.
+    pub fn footage(&self) -> Option<Footage> {
+        if self.kind()? != ItemKind::Footage {
+            return None;
+        }
+        let pin = self.chunk.child_list(b"Pin ")?;
+        let sspc = pin.child(b"sspc")?.bytes()?;
+        let opti = pin.child(b"opti")?.bytes()?;
+        let is_solid = opti.get(..4) == Some(&b"Soli"[..]);
+        let alias = pin.child_list(b"Als2").and_then(|als| als.child(b"alas")).and_then(|alas| alas.bytes());
+        let path = alias.and_then(|json| json_string(json, "fullpath"));
+        let is_sequence = alias.and_then(|json| json_bool(json, "target_is_folder")).unwrap_or(false);
+        let solid_argb = if is_solid { Some([be_f32(opti, 10)?, be_f32(opti, 14)?, be_f32(opti, 18)?, be_f32(opti, 22)?]) } else { None };
+        Some(Footage {
+            file_type: cstr(sspc, 22, 4)?,
+            width: be_u32(sspc, 30)?,
+            height: be_u32(sspc, 34)?,
+            name: cstr(opti, if is_solid { 26 } else { 58 }, 256).filter(|n| !n.is_empty()),
+            is_solid,
+            solid_argb,
+            path,
+            duration: be_u32(sspc, 38).zip(be_u32(sspc, 42)).map(|(num, den)| Rational { num: i64::from(num), den: i64::from(den) }),
+            native_frame_rate: be_u32(sspc, 56).unwrap_or(0),
+            bits_per_pixel: be_u32(sspc, 60).unwrap_or(0),
+            file_size: be_u32(sspc, 208).unwrap_or(0),
+            audio_sample_rate: be_f64(sspc, 160).filter(|r| r.is_finite() && *r > 0.0),
+            is_sequence,
+        })
+    }
+
+    /// The name this item shows in the project: the item name, or for footage the name stored in
+    /// `opti`.
+    pub fn display_name(&self) -> Option<String> {
+        self.name().or_else(|| self.footage().and_then(|f| f.name))
+    }
+}
+
+impl<'f, 'a> Project<'f, 'a> {
+    /// The item with this id (`idta` byte 16), searching every item including those in folders.
+    pub fn item_by_id(&self, id: u32) -> Option<Item<'f, 'a>> {
+        self.all_items().into_iter().find(|i| i.id() == Some(id))
+    }
+
+    /// The item a layer is made from (its source id), e.g. the solid, the footage or the precomp.
+    pub fn layer_source(&self, layer: &Layer<'f, 'a>) -> Option<Item<'f, 'a>> {
+        self.item_by_id(layer.header()?.source_id?)
+    }
+
+    /// The name a layer shows: its own name, or its source's name when it has none.
+    pub fn layer_display_name(&self, layer: &Layer<'f, 'a>) -> Option<String> {
+        layer.name().or_else(|| self.layer_source(layer)?.display_name())
+    }
+
+    /// The pixel size of a layer's source: a footage item's width and height, or a precomp's
+    /// composition size.
+    pub fn layer_source_size(&self, layer: &Layer<'f, 'a>) -> Option<(u32, u32)> {
+        let source = self.layer_source(layer)?;
+        match source.kind()? {
+            ItemKind::Footage => source.footage().map(|f| (f.width, f.height)),
+            ItemKind::Composition => source.comp()?.header().map(|h| (u32::from(h.width), u32::from(h.height))),
+            ItemKind::Folder | ItemKind::Other(_) => None,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::json_string;
+
+    #[test]
+    fn reads_a_string_with_escapes() {
+        let json = br#"{"a":1,"fullpath":"C:\\dir\\f\u00e9.png","b":"x"}"#;
+        assert_eq!(json_string(json, "fullpath").as_deref(), Some(r"C:\dir\fé.png"));
+        assert_eq!(json_string(json, "b").as_deref(), Some("x"));
+        assert_eq!(json_string(json, "missing"), None);
+        assert_eq!(json_string(br#"{"a" : "spaced"}"#, "a").as_deref(), Some("spaced"));
+        // The key's text as an earlier value is not the key.
+        assert_eq!(json_string(br#"{"a":"fullpath","fullpath":"x"}"#, "fullpath").as_deref(), Some("x"));
+        // A surrogate pair is one character; a lone half stays U+FFFD.
+        assert_eq!(json_string(br#"{"a":"x\ud83d\ude00y"}"#, "a").as_deref(), Some("x😀y"));
+        assert_eq!(json_string(br#"{"a":"\ud83dz"}"#, "a").as_deref(), Some("\u{fffd}z"));
+        assert_eq!(json_string(br#"{"a":"\ude00"}"#, "a").as_deref(), Some("\u{fffd}"));
+    }
+
+    #[test]
+    fn damaged_json_never_panics() {
+        for json in [
+            &br#"{"fullpath":"#[..],
+            br#"{"fullpath":"abc"#,
+            br#"{"fullpath":"ab\"#,
+            br#"{"fullpath":"\u12"}"#,
+            br#"{"fullpath":"\uzzzz"}"#,
+            br#"{"fullpath":5}"#,
+            br#"{"fullpath"}"#,
+            b"\"fullpath\"",
+            b"",
+            b"\"",
+            br#"{"fullpath":"\ud800"}"#,
+        ] {
+            let _ = json_string(json, "fullpath");
+        }
+        assert_eq!(json_string(br#"{"fullpath":"\ud800"}"#, "fullpath").as_deref(), Some("\u{fffd}"));
+    }
+}
diff --git a/crates/aep/src/container/header.rs b/crates/aep/src/container/header.rs
new file mode 100644
index 000000000..508353eb2
--- /dev/null
+++ b/crates/aep/src/container/header.rs
@@ -0,0 +1,549 @@
+//! The layer header (`ldta`) and the composition header (`cdta`, `PRin`).
+//!
+//! Every field here has a verified layout: the decoded value equals the value the generated corpus
+//! was made with (see `docs/aep-format.md`, sections 4 and 5, for the evidence per field). Fields that
+//! the corpus does not decide are not decoded; the raw bytes stay reachable through the chunk.
+
+use crate::container::bytes::{array, be_i32, be_u16, be_u32, cstr, text, until_nul};
+use crate::container::typed::{Comp, Item, Layer, TimeBase, utf8_child};
+
+/// An exact fraction. Used for times (`seconds = num / den`) and for the pixel aspect ratio. The
+/// fields hold the stored values unreduced; [`Rational::reduced`] normalises.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Rational {
+    pub num: i64,
+    pub den: i64,
+}
+
+impl Rational {
+    /// A fraction with a positive denominator, reduced; `None` for a zero denominator.
+    pub fn new(num: i64, den: i64) -> Option<Self> {
+        Self { num, den }.reduced()
+    }
+
+    /// The value as `f64`, `None` for a zero denominator.
+    pub fn to_f64(&self) -> Option<f64> {
+        (self.den != 0).then(|| self.num as f64 / self.den as f64)
+    }
+
+    /// The same value in lowest terms with a positive denominator, `None` for a zero denominator.
+    pub fn reduced(&self) -> Option<Self> {
+        if self.den == 0 {
+            return None;
+        }
+        let (mut a, mut b) = (i128::from(self.num).unsigned_abs(), i128::from(self.den).unsigned_abs());
+        let (mut x, mut y) = (a, b);
+        while y != 0 {
+            (x, y) = (y, x % y);
+        }
+        if x == 0 {
+            x = 1;
+        }
+        a /= x;
+        b /= x;
+        let negative = (self.num < 0) != (self.den < 0);
+        let num = i64::try_from(a).ok()?;
+        let den = i64::try_from(b).ok()?;
+        Some(Self { num: if negative { num.checked_neg()? } else { num }, den })
+    }
+
+    /// `self + other * factor`, exact, `None` on a zero denominator or overflow.
+    fn plus_scaled(&self, other: &Rational, factor: &Rational) -> Option<Rational> {
+        if self.den == 0 || other.den == 0 || factor.den == 0 {
+            return None;
+        }
+        // other * factor = (other.num * factor.num) / (other.den * factor.den)
+        let scaled_num = i128::from(other.num).checked_mul(i128::from(factor.num))?;
+        let scaled_den = i128::from(other.den).checked_mul(i128::from(factor.den))?;
+        let den = i128::from(self.den).checked_mul(scaled_den)?;
+        let num = i128::from(self.num).checked_mul(scaled_den)?.checked_add(scaled_num.checked_mul(i128::from(self.den))?)?;
+        Rational { num: i64::try_from(num).ok()?, den: i64::try_from(den).ok()? }.reduced()
+    }
+}
+
+/// The layer quality switch, `ldta` byte 5.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Quality {
+    /// `1`
+    Draft,
+    /// `2`
+    Best,
+    /// Any other value (`0` on cameras and lights; wireframe was not sampled).
+    Other(u8),
+}
+
+/// The blend mode, `ldta` byte 99. Six modes were sampled; any other mode is kept as its raw code.
+/// The codes 2, 4, 5, 6 and 7 coincide with the numbers of the After Effects plug-in transfer
+/// modes; Difference is 26.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BlendMode {
+    /// `2`
+    Normal,
+    /// `4`
+    Add,
+    /// `5`
+    Multiply,
+    /// `6`
+    Screen,
+    /// `7`
+    Overlay,
+    /// `26`
+    Difference,
+    /// Any other value (not sampled; `0` on cameras and lights).
+    Other(u8),
+}
+
+impl BlendMode {
+    /// The mode for a code.
+    pub fn from_code(code: u8) -> Self {
+        match code {
+            2 => Self::Normal,
+            4 => Self::Add,
+            5 => Self::Multiply,
+            6 => Self::Screen,
+            7 => Self::Overlay,
+            26 => Self::Difference,
+            other => Self::Other(other),
+        }
+    }
+
+    /// The code as stored.
+    pub fn code(&self) -> u8 {
+        match self {
+            Self::Normal => 2,
+            Self::Add => 4,
+            Self::Multiply => 5,
+            Self::Screen => 6,
+            Self::Overlay => 7,
+            Self::Difference => 26,
+            Self::Other(code) => *code,
+        }
+    }
+}
+
+/// The light type, `ldta` `u32` at byte 136 of a light layer (0 on every other layer).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LightType {
+    /// `0` (701)
+    Parallel,
+    /// `1`
+    Spot,
+    /// `2`
+    Point,
+    /// `3` (702; a light created as an environment light by script without the Advanced 3D
+    /// renderer is stored as an ambient light too, 704)
+    Ambient,
+    /// Any other value (an environment light was not sampled).
+    Other(u32),
+}
+
+/// The layer type, `ldta` `u32` at byte 128.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LayerType {
+    /// `0`: solid, footage, precomp or null object (an AV layer).
+    Av,
+    /// `1`
+    Light,
+    /// `2`
+    Camera,
+    /// `3`
+    Text,
+    /// `4`
+    Shape,
+    /// Any other value.
+    Other(u32),
+}
+
+/// The decoded fields of a layer's `ldta` chunk (164 bytes; the fields below need the first 140).
+///
+/// Times are stored as a numerator and a denominator (the denominator is the composition's
+/// timescale, 1 in a precomp layer). The in and out points are stored **relative to the start**:
+/// the absolute in point is `start + in * stretch`, see [`LayerHeader::in_point`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LayerHeader {
+    /// The layer id (unique in the project); parent links use it.
+    pub id: u32,
+    pub quality: Quality,
+    /// The numerator of the time stretch (signed `i32` at byte 8). The stretch is the exact ratio
+    /// `stretch / stretch_den`: `1/1` = 100 %, `2/1` = 200 %, `1/2` = 50 %, `3/2` = 150 %, `-1/1` =
+    /// -100 % (a time-reversed layer, 981), `-1/2` = -50 % (983), see
+    /// [`LayerHeader::stretch_ratio`].
+    pub stretch: i32,
+    /// The denominator of the time stretch (`u32` at byte 108; 1 in every file before 50 % was
+    /// sampled).
+    pub stretch_den: u32,
+    /// The layer start time, as stored.
+    pub start: Rational,
+    /// The in point relative to the start, as stored.
+    pub in_relative: Rational,
+    /// The out point relative to the start, as stored.
+    pub out_relative: Rational,
+    /// Bytes 37, 38 and 39 of `ldta`: the switch bits (see the `is_*` methods).
+    pub flag_bytes: [u8; 3],
+    /// The id of the source item (`ldta` byte 40), `None` for the values `0` (shape, text, camera)
+    /// and `0xffff_ffff` (light).
+    pub source_id: Option<u32>,
+    /// The label colour index (`ldta` byte 61: 1 red, 5, 8 blue, ...).
+    pub label: u8,
+    /// The copy of the layer name at byte 64 (31 characters at most; the layer's `Utf8` child holds
+    /// the full name).
+    pub name_copy: String,
+    pub blend_mode: BlendMode,
+    pub layer_type: LayerType,
+    /// The id of the parent layer, `None` when there is none.
+    pub parent_id: Option<u32>,
+    /// The `u32` at byte 136 (the light type of a light layer, 0 elsewhere), see
+    /// [`LayerHeader::light_type`].
+    pub light_type_code: u32,
+}
+
+impl LayerHeader {
+    /// Decodes an `ldta` body; `None` when it is shorter than 140 bytes.
+    pub fn parse(ldta: &[u8]) -> Option<Self> {
+        let time = |at: usize| Some(Rational { num: i64::from(be_i32(ldta, at)?), den: i64::from(be_u32(ldta, at.checked_add(4)?)?) });
+        let source = be_u32(ldta, 40)?;
+        let parent = be_u32(ldta, 132)?;
+        Some(Self {
+            id: be_u32(ldta, 0)?,
+            quality: match *ldta.get(5)? {
+                1 => Quality::Draft,
+                2 => Quality::Best,
+                other => Quality::Other(other),
+            },
+            stretch: be_i32(ldta, 8)?,
+            stretch_den: be_u32(ldta, 108)?,
+            start: time(12)?,
+            in_relative: time(20)?,
+            out_relative: time(28)?,
+            flag_bytes: array::<3>(ldta, 37)?,
+            source_id: (source != 0 && source != u32::MAX).then_some(source),
+            label: *ldta.get(61)?,
+            name_copy: text(until_nul(ldta.get(64..96)?)),
+            blend_mode: BlendMode::from_code(*ldta.get(99)?),
+            layer_type: match be_u32(ldta, 128)? {
+                0 => LayerType::Av,
+                1 => LayerType::Light,
+                2 => LayerType::Camera,
+                3 => LayerType::Text,
+                4 => LayerType::Shape,
+                other => LayerType::Other(other),
+            },
+            parent_id: (parent != 0).then_some(parent),
+            light_type_code: be_u32(ldta, 136)?,
+        })
+    }
+
+    fn flag(&self, byte: usize, mask: u8) -> bool {
+        self.flag_bytes.get(byte).is_some_and(|b| b & mask != 0)
+    }
+
+    /// Byte 37 bit `0x01`: the layer has a name set by the user (clear on a default-named camera or
+    /// light and on a precomp layer, whose name is the source's).
+    pub fn name_is_user_set(&self) -> bool {
+        self.flag(0, 0x01)
+    }
+
+    /// Byte 37 bit `0x02`: guide layer.
+    pub fn is_guide(&self) -> bool {
+        self.flag(0, 0x02)
+    }
+
+    /// Byte 38 bit `0x02`: adjustment layer.
+    pub fn is_adjustment(&self) -> bool {
+        self.flag(1, 0x02)
+    }
+
+    /// Byte 38 bit `0x04`: the 3D layer switch.
+    pub fn is_three_d(&self) -> bool {
+        self.flag(1, 0x04)
+    }
+
+    /// Byte 38 bit `0x40`: the layer orients itself towards its point of interest. Set on two-node
+    /// cameras (byte 38 is `0x44`) and on all lights, clear on a one-node camera (`0x04`).
+    pub fn is_auto_oriented(&self) -> bool {
+        self.flag(1, 0x40)
+    }
+
+    /// Byte 38 bit `0x08`: solo.
+    pub fn is_solo(&self) -> bool {
+        self.flag(1, 0x08)
+    }
+
+    /// Byte 38 bit `0x80`: the layer was created as a null object.
+    pub fn is_null_object(&self) -> bool {
+        self.flag(1, 0x80)
+    }
+
+    /// Byte 39 bit `0x01`: the video switch (the layer's eye icon; `enabled` in the scripting API).
+    pub fn is_video_enabled(&self) -> bool {
+        self.flag(2, 0x01)
+    }
+
+    /// The same as [`LayerHeader::is_video_enabled`].
+    pub fn is_enabled(&self) -> bool {
+        self.is_video_enabled()
+    }
+
+    /// Byte 39 bit `0x02`: the audio switch (`audioEnabled`).
+    pub fn is_audio_enabled(&self) -> bool {
+        self.flag(2, 0x02)
+    }
+
+    /// Byte 39 bit `0x04`: the effects switch (`effectsActive`).
+    pub fn is_effects_enabled(&self) -> bool {
+        self.flag(2, 0x04)
+    }
+
+    /// Byte 39 bit `0x08`: the motion blur switch.
+    pub fn is_motion_blur(&self) -> bool {
+        self.flag(2, 0x08)
+    }
+
+    /// Byte 39 bit `0x20`: locked.
+    pub fn is_locked(&self) -> bool {
+        self.flag(2, 0x20)
+    }
+
+    /// Byte 39 bit `0x40`: shy.
+    pub fn is_shy(&self) -> bool {
+        self.flag(2, 0x40)
+    }
+
+    /// Byte 39 bit `0x80`: collapse transformations / continuously rasterize. Shape and text
+    /// layers have it set from creation.
+    pub fn collapses_transformations(&self) -> bool {
+        self.flag(2, 0x80)
+    }
+
+    /// The light type of a light layer: parallel 0, spot 1, point 2, ambient 3 (`None` for any
+    /// other layer type).
+    pub fn light_type(&self) -> Option<LightType> {
+        (self.layer_type == LayerType::Light).then_some(match self.light_type_code {
+            0 => LightType::Parallel,
+            1 => LightType::Spot,
+            2 => LightType::Point,
+            3 => LightType::Ambient,
+            other => LightType::Other(other),
+        })
+    }
+
+    /// The time stretch as an exact reduced ratio (`stretch / stretch_den`: 50 % is `1/2`, 150 %
+    /// is `3/2`); `None` for a zero denominator.
+    pub fn stretch_ratio(&self) -> Option<Rational> {
+        Rational::new(i64::from(self.stretch), i64::from(self.stretch_den))
+    }
+
+    /// The time stretch in percent (`stretch / stretch_den * 100`); a zero denominator reads as 1.
+    pub fn stretch_percent(&self) -> f64 {
+        let den = if self.stretch_den == 0 { 1.0 } else { f64::from(self.stretch_den) };
+        f64::from(self.stretch) / den * 100.0
+    }
+
+    /// The start time in seconds, `None` for a zero denominator.
+    pub fn start_seconds(&self) -> Option<f64> {
+        self.start.to_f64()
+    }
+
+    /// The absolute in point, `start + in * stretch`, exact and reduced.
+    pub fn in_point(&self) -> Option<Rational> {
+        self.start.plus_scaled(&self.in_relative, &self.stretch_ratio()?)
+    }
+
+    /// The absolute out point, `start + out * stretch`, exact and reduced. For a footage layer the
+    /// stored denominator is the footage time base (the sample rate of an audio layer, the frame
+    /// rate of an image sequence), not the composition timescale.
+    pub fn out_point(&self) -> Option<Rational> {
+        self.start.plus_scaled(&self.out_relative, &self.stretch_ratio()?)
+    }
+
+    /// The absolute in point in seconds.
+    pub fn in_point_seconds(&self) -> Option<f64> {
+        self.in_point()?.to_f64()
+    }
+
+    /// The absolute out point in seconds.
+    pub fn out_point_seconds(&self) -> Option<f64> {
+        self.out_point()?.to_f64()
+    }
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The layer id (`ldta` byte 0).
+    pub fn id(&self) -> Option<u32> {
+        be_u32(self.chunk.child(b"ldta")?.bytes()?, 0)
+    }
+
+    /// The decoded `ldta`, see [`LayerHeader`].
+    pub fn header(&self) -> Option<LayerHeader> {
+        LayerHeader::parse(self.chunk.child(b"ldta")?.bytes()?)
+    }
+
+    /// The video switch (byte 39 bit `0x01`), `enabled` in the scripting API.
+    pub fn is_enabled(&self) -> Option<bool> {
+        self.header().map(|h| h.is_video_enabled())
+    }
+
+    /// The audio switch (byte 39 bit `0x02`), `audioEnabled`.
+    pub fn is_audio_enabled(&self) -> Option<bool> {
+        self.header().map(|h| h.is_audio_enabled())
+    }
+
+    /// The effects switch (byte 39 bit `0x04`), `effectsActive`.
+    pub fn is_effects_enabled(&self) -> Option<bool> {
+        self.header().map(|h| h.is_effects_enabled())
+    }
+}
+
+/// The renderer of a composition (`LIST PRin` / `prin`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Renderer {
+    /// The match name (`ADBE Escher` for the Classic 3D renderer in the base project,
+    /// `ADBE Calder` for Advanced 3D).
+    pub match_name: String,
+    /// The display name (`Classic 3D`, `Advanced 3D`).
+    pub display_name: String,
+}
+
+/// The decoded fields of a composition's `cdta` chunk (204 bytes; the fields below need 176).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CompHeader {
+    /// Frame duration (`u32` at byte 4) and timescale (`u32` at byte 8).
+    pub time_base: TimeBase,
+    /// The frame rate as 16.16 fixed point (`u32` at byte 156).
+    pub frame_rate_fixed: u32,
+    /// The composition duration in time units.
+    pub duration_units: u32,
+    /// The work area start in time units.
+    pub work_area_start_units: u32,
+    /// The work area end (start + duration) in time units; `None` when it is the whole
+    /// composition (stored as `0xffff_ffff`).
+    pub work_area_end_units: Option<u32>,
+    /// The background colour as R, G, B (bytes 52 to 54), 8 bits per channel: 0.5 is stored as 128
+    /// and reads back as 128/255.
+    pub background: [u8; 3],
+    /// The shutter angle in degrees.
+    pub shutter_angle: u32,
+    pub width: u16,
+    pub height: u16,
+    /// The pixel aspect ratio as stored: numerator and denominator.
+    pub pixel_aspect: Rational,
+    /// The composition's motion blur switch.
+    pub motion_blur: bool,
+    /// The shutter phase in degrees (`i32` at byte 180, 0 by default, -90 in the sample); `None`
+    /// when the chunk ends before byte 184.
+    pub shutter_phase: Option<i32>,
+    /// The display start time (the comp start timecode) as `num / den` seconds: `u32` at byte 164
+    /// over `u32` at byte 168 (0/1 by default; display start frame 100 at 25 fps is 102400/25600).
+    /// `None` when the chunk ends before byte 172.
+    pub display_start: Option<Rational>,
+}
+
+impl CompHeader {
+    /// Decodes a `cdta` body; `None` when it is shorter than 176 bytes.
+    pub fn parse(cdta: &[u8]) -> Option<Self> {
+        let work_end = be_u32(cdta, 36)?;
+        Some(Self {
+            time_base: TimeBase { frame_duration: be_u32(cdta, 4)?, timescale: be_u32(cdta, 8)? },
+            frame_rate_fixed: be_u32(cdta, 156)?,
+            duration_units: be_u32(cdta, 44)?,
+            work_area_start_units: be_u32(cdta, 28)?,
+            work_area_end_units: (work_end != u32::MAX).then_some(work_end),
+            background: array::<3>(cdta, 52)?,
+            shutter_angle: be_u32(cdta, 172)?,
+            width: be_u16(cdta, 140)?,
+            height: be_u16(cdta, 142)?,
+            pixel_aspect: Rational { num: i64::from(be_u32(cdta, 144)?), den: i64::from(be_u32(cdta, 148)?) },
+            motion_blur: cdta.get(139)? & 0x08 != 0,
+            shutter_phase: be_i32(cdta, 180),
+            display_start: be_u32(cdta, 164).zip(be_u32(cdta, 168)).map(|(num, den)| Rational { num: i64::from(num), den: i64::from(den) }),
+        })
+    }
+
+    /// Frames per second from the time base (`timescale / frame_duration`).
+    pub fn frame_rate(&self) -> Option<f64> {
+        self.time_base.frame_rate()
+    }
+
+    /// The frame rate from the 16.16 fixed-point field (25 is `0x0019_0000`).
+    pub fn frame_rate_from_fixed(&self) -> f64 {
+        f64::from(self.frame_rate_fixed) / 65536.0
+    }
+
+    /// The duration in seconds.
+    pub fn duration_seconds(&self) -> Option<f64> {
+        self.time_base.seconds(i32::try_from(self.duration_units).ok()?)
+    }
+
+    /// The work area start in seconds.
+    pub fn work_area_start_seconds(&self) -> Option<f64> {
+        self.time_base.seconds(i32::try_from(self.work_area_start_units).ok()?)
+    }
+
+    /// The work area end in seconds; the composition duration when the work area is the whole
+    /// composition.
+    pub fn work_area_end_seconds(&self) -> Option<f64> {
+        match self.work_area_end_units {
+            Some(end) => self.time_base.seconds(i32::try_from(end).ok()?),
+            None => self.duration_seconds(),
+        }
+    }
+
+    /// The background colour as fractions 0..1 (`byte / 255`).
+    pub fn background_rgb(&self) -> [f64; 3] {
+        self.background.map(|c| f64::from(c) / 255.0)
+    }
+
+    /// The pixel aspect ratio as a number.
+    pub fn pixel_aspect_ratio(&self) -> Option<f64> {
+        self.pixel_aspect.to_f64()
+    }
+
+    /// The display start time in seconds (the start timecode), `None` when absent or the
+    /// denominator is zero.
+    pub fn display_start_seconds(&self) -> Option<f64> {
+        self.display_start?.to_f64()
+    }
+
+    /// The display start as a frame number (`display start * frame rate`, rounded); 100 at 25 fps
+    /// for a display start of 4 s.
+    pub fn display_start_frame(&self) -> Option<i64> {
+        let rate = self.frame_rate()?;
+        Some((self.display_start_seconds()? * rate).round() as i64)
+    }
+
+    /// The frame rate as an exact fraction `timescale / frame_duration`, as typed: 29.97 fps is
+    /// `23976 / 800` (not `30000 / 1001`), 23.976 fps is `23976 / 1000`.
+    pub fn frame_rate_exact(&self) -> Option<Rational> {
+        Rational::new(i64::from(self.time_base.timescale), i64::from(self.time_base.frame_duration))
+    }
+
+    /// The duration in whole frames (`duration / frame_duration`). After Effects snaps a duration
+    /// to a whole number of frames: 5 s at 29.97 fps becomes 150 frames (5.005 s).
+    pub fn duration_frames(&self) -> Option<u32> {
+        self.duration_units.checked_div(self.time_base.frame_duration)
+    }
+}
+
+impl<'f, 'a> Comp<'f, 'a> {
+    /// The decoded `cdta`, see [`CompHeader`].
+    pub fn header(&self) -> Option<CompHeader> {
+        CompHeader::parse(self.item.child(b"cdta")?.bytes()?)
+    }
+
+    /// The composition name (the item's `Utf8` child).
+    pub fn name(&self) -> Option<String> {
+        utf8_child(self.item).filter(|n| !n.is_empty())
+    }
+
+    /// The item this composition data belongs to.
+    pub fn item(&self) -> Item<'f, 'a> {
+        Item { chunk: self.item }
+    }
+
+    /// The renderer (`LIST PRin` / `prin`: match name at byte 4, display name at byte 52, 32
+    /// bytes each).
+    pub fn renderer(&self) -> Option<Renderer> {
+        let prin = self.item.child_list(b"PRin")?.child(b"prin")?.bytes()?;
+        Some(Renderer { match_name: cstr(prin, 4, 32)?, display_name: cstr(prin, 52, 32)? })
+    }
+}
diff --git a/crates/aep/src/container/keys.rs b/crates/aep/src/container/keys.rs
new file mode 100644
index 000000000..d78bc6693
--- /dev/null
+++ b/crates/aep/src/container/keys.rs
@@ -0,0 +1,361 @@
+//! Keyframe records, property flags and expressions.
+//!
+//! Keyframe times are **layer time**, in units of the property's own time scale
+//! ([`Property::time_scale`], equal to the composition's timescale in every sample).
+//!
+//! Every record starts with an 8-byte header: `i32` time, `u8` at byte 4 = the interpolation of the
+//! **incoming** side, `u8` at byte 5 = the **outgoing** side (1 linear, 2 bezier, 3 hold), and a
+//! `u16` of flags (label, roving). The rest depends on the property header (`tdb4`), which selects
+//! one of two templates for `n` value components:
+//!
+//! * **plain** (`tdb4` byte 7 = 0; Opacity, Rotation, Scale, 2-D properties, sliders): the value
+//!   (`n` x `f64`) at byte 8, then four `f64` per component of ease, type-major (`[in speed x n]
+//!   [in influence x n][out speed x n][out influence x n]`). Size `8 + 40 n`.
+//! * **spatial** (`tdb4` byte 7 != 0; Position with `n` = 3, colours with `n` = 4): a `u32` at 8, the
+//!   arc length (`f64`) at 16, the four ease slots at 24 to 55, the value (`n` x `f64`) at 56, then
+//!   the spatial in tangent and out tangent (`n` x `f64` each). Size `56 + 24 n`.
+
+use crate::container::bytes::{be_f64, be_u16, be_u32, text};
+use crate::container::typed::{Keyframe, Property};
+
+/// A keyframe interpolation type (a byte of the record header).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Interpolation {
+    /// `1`
+    Linear,
+    /// `2`
+    Bezier,
+    /// `3`
+    Hold,
+    /// Any other value.
+    Other(u8),
+}
+
+impl Interpolation {
+    fn from_byte(b: u8) -> Self {
+        match b {
+            1 => Self::Linear,
+            2 => Self::Bezier,
+            3 => Self::Hold,
+            other => Self::Other(other),
+        }
+    }
+}
+
+/// What a keyframe record is, judged by the property header (when the list belongs to a property)
+/// and the record size.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum KeyframeKind {
+    /// The plain template: `8 + 40 n` bytes, 48 for one component (Opacity, Rotation, Slider), 88 for
+    /// two (Mask Feather, Rectangle Size), 128 for three (Scale).
+    Plain { components: usize },
+    /// The spatial template: `56 + 24 n` bytes, 128 for Position (3 components), 152 for a colour (4).
+    Spatial { components: usize },
+    /// 64 bytes: a mask path key; the path itself is in the matching `shap` chunk. The ease sits at
+    /// byte 24 as in the spatial template (599, 700: speed 0, influences 0.75 / 0.20 / 0.50); the
+    /// `f64` at byte 16 is 1 or 2 on a first key and 0 on a last one (093, 599, 700; meaning not
+    /// decoded).
+    MaskPath,
+    /// 16 bytes: a marker (time and two hold bytes).
+    Marker,
+    /// Any other size.
+    Other(usize),
+}
+
+/// The ease of a key: speed and influence of the incoming and outgoing side. Speed is in stored
+/// value units per second (for Opacity a fraction, so 100 times smaller than the percent shown in
+/// the UI; for Position pixels per second); influence is a fraction (20 % is `0.2`). After Effects
+/// reports the first key's incoming speed and the last key's outgoing speed as 0, but the file
+/// keeps the requested values, so these two slots are not meaningful.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct KeyEase {
+    pub in_speed: f64,
+    pub in_influence: f64,
+    pub out_speed: f64,
+    pub out_influence: f64,
+}
+
+/// The fields of a spatial keyframe record.
+#[derive(Debug, Clone, PartialEq)]
+pub struct SpatialKey {
+    /// The `u32` at byte 8: `1` normally, `0` after the spatial interpolation was changed to
+    /// non-auto-bezier / non-continuous (the two switches were changed together).
+    pub auto_bezier_flag: u32,
+    /// The `f64` at byte 16: the arc length of the segment to the next key, updated lazily by
+    /// After Effects (0 right after creation). Safe to ignore.
+    pub segment_length: f64,
+    /// The four `f64` at bytes 24, 32, 40 and 48 as stored: in speed, in influence, out speed, out
+    /// influence (see [`KeyEase`]).
+    pub ease: [f64; 4],
+    /// The value (x, y, z in pixels for Position; ARGB 0..255 for a colour), from byte 56.
+    pub value: Vec<f64>,
+    /// The spatial in tangent as an offset from the value.
+    pub in_tangent: Vec<f64>,
+    /// The spatial out tangent as an offset from the value.
+    pub out_tangent: Vec<f64>,
+}
+
+fn doubles(b: &[u8], at: usize, n: usize) -> Option<Vec<f64>> {
+    (0..n).map(|i| be_f64(b, at.checked_add(i.checked_mul(8)?)?)).collect()
+}
+
+fn ease_at(b: &[u8], at: usize) -> Option<KeyEase> {
+    Some(KeyEase {
+        in_speed: be_f64(b, at)?,
+        in_influence: be_f64(b, at.checked_add(8)?)?,
+        out_speed: be_f64(b, at.checked_add(16)?)?,
+        out_influence: be_f64(b, at.checked_add(24)?)?,
+    })
+}
+
+impl<'f> Keyframe<'f> {
+    /// The record kind. For a list that belongs to a property, the header's component count and
+    /// template flag decide; without a property, 48 bytes is read as plain with one component and
+    /// 128 bytes as spatial with three.
+    pub fn kind(&self) -> KeyframeKind {
+        let len = self.record.len();
+        if let Some(layout) = self.layout {
+            let n = usize::from(layout.components);
+            if n > 0 {
+                if layout.spatial && Some(len) == n.checked_mul(24).and_then(|v| v.checked_add(56)) {
+                    return KeyframeKind::Spatial { components: n };
+                }
+                if !layout.spatial && Some(len) == n.checked_mul(40).and_then(|v| v.checked_add(8)) {
+                    return KeyframeKind::Plain { components: n };
+                }
+            }
+        }
+        match (len, self.layout) {
+            (64, _) => KeyframeKind::MaskPath,
+            (16, _) => KeyframeKind::Marker,
+            (48, None) => KeyframeKind::Plain { components: 1 },
+            (128, None) => KeyframeKind::Spatial { components: 3 },
+            (other, _) => KeyframeKind::Other(other),
+        }
+    }
+
+    /// The time in seconds given the property's time scale (units per second).
+    pub fn seconds(&self, time_scale: u32) -> Option<f64> {
+        if time_scale == 0 {
+            return None;
+        }
+        Some(f64::from(self.time_units()?) / f64::from(time_scale))
+    }
+
+    /// The interpolation of the incoming side: the byte at offset 4.
+    pub fn interpolation_in(&self) -> Option<Interpolation> {
+        self.record.get(4).copied().map(Interpolation::from_byte)
+    }
+
+    /// The interpolation of the outgoing side: the byte at offset 5.
+    pub fn interpolation_out(&self) -> Option<Interpolation> {
+        self.record.get(5).copied().map(Interpolation::from_byte)
+    }
+
+    /// The flags word at byte 6.
+    pub fn flags(&self) -> Option<u16> {
+        be_u16(self.record, 6)
+    }
+
+    /// The keyframe label: bits 6 to 9 of the flags (label 9 gives `0x0247` on a spatial key).
+    pub fn label(&self) -> Option<u8> {
+        u8::try_from((self.flags()? >> 6) & 0x0f).ok()
+    }
+
+    /// True when the key is roving: bit `0x20` of the flags.
+    pub fn is_roving(&self) -> Option<bool> {
+        Some(self.flags()? & 0x0020 != 0)
+    }
+
+    /// The number of value components of a plain or spatial record.
+    pub fn components(&self) -> Option<usize> {
+        match self.kind() {
+            KeyframeKind::Plain { components } | KeyframeKind::Spatial { components } => Some(components),
+            KeyframeKind::MaskPath | KeyframeKind::Marker | KeyframeKind::Other(_) => None,
+        }
+    }
+
+    /// The stored value of a plain (from byte 8) or spatial (from byte 56) record, in the units of
+    /// the property's static value (fractions for Opacity and Scale, ARGB 0..255 for colours).
+    pub fn value(&self) -> Option<Vec<f64>> {
+        match self.kind() {
+            KeyframeKind::Plain { components } => doubles(self.record, 8, components),
+            KeyframeKind::Spatial { components } => doubles(self.record, 56, components),
+            KeyframeKind::MaskPath | KeyframeKind::Marker | KeyframeKind::Other(_) => None,
+        }
+    }
+
+    /// The value of a record with one component (Opacity, Rotation, a slider).
+    pub fn scalar_value(&self) -> Option<f64> {
+        match self.kind() {
+            KeyframeKind::Plain { components: 1 } => be_f64(self.record, 8),
+            _ => None,
+        }
+    }
+
+    /// The value of a 3-component spatial keyframe (Position), x, y and z in pixels.
+    pub fn spatial_value(&self) -> Option<[f64; 3]> {
+        let v = self.value()?;
+        if !matches!(self.kind(), KeyframeKind::Spatial { components: 3 }) {
+            return None;
+        }
+        Some([*v.first()?, *v.get(1)?, *v.get(2)?])
+    }
+
+    /// The ease of the key: the four slots at byte 16 of a one-component plain record or at byte 24
+    /// of a spatial record or a mask path record. For linear and hold keys all four are 0 (a bezier key stores what
+    /// `setTemporalEase` was given). Plain records with several components keep four slots per
+    /// component, see [`Keyframe::ease_component`] and [`Keyframe::plain_ease_slots`].
+    pub fn ease(&self) -> Option<KeyEase> {
+        match self.kind() {
+            KeyframeKind::Plain { components: 1 } => ease_at(self.record, 16),
+            KeyframeKind::Spatial { .. } | KeyframeKind::MaskPath => ease_at(self.record, 24),
+            _ => None,
+        }
+    }
+
+    /// The `4 n` ease `f64` of a plain record as stored (from byte `8 + 8 n`). With one component
+    /// they are [`Keyframe::ease`]; with several they are type-major, see
+    /// [`Keyframe::ease_component`].
+    pub fn plain_ease_slots(&self) -> Option<Vec<f64>> {
+        match self.kind() {
+            KeyframeKind::Plain { components } => doubles(self.record, components.checked_mul(8)?.checked_add(8)?, components.checked_mul(4)?),
+            _ => None,
+        }
+    }
+
+    /// The ease of one value component. A plain record with `n` components stores the `4 n` ease
+    /// doubles **type-major**: `[in speed x n][in influence x n][out speed x n][out influence x n]`
+    /// starting at byte `8 + 8 n`, and component `i` uses slot `i` of each block (verified for the
+    /// block layout with Scale `n = 3` and Mask Feather `n = 2` keys whose ease was the same in
+    /// every dimension; that different values sit in the slots of their dimension is inferred).
+    /// A spatial record (Position, colours) has one ease entry for all components, so only
+    /// `component == 0` returns it. For one component this is [`Keyframe::ease`].
+    pub fn ease_component(&self, component: usize) -> Option<KeyEase> {
+        match self.kind() {
+            KeyframeKind::Plain { components } if component < components => {
+                let block = components.checked_mul(8)?;
+                let first = block.checked_add(8)?;
+                let at = |k: usize| first.checked_add(block.checked_mul(k)?)?.checked_add(component.checked_mul(8)?);
+                Some(KeyEase {
+                    in_speed: be_f64(self.record, at(0)?)?,
+                    in_influence: be_f64(self.record, at(1)?)?,
+                    out_speed: be_f64(self.record, at(2)?)?,
+                    out_influence: be_f64(self.record, at(3)?)?,
+                })
+            }
+            KeyframeKind::Spatial { .. } if component == 0 => ease_at(self.record, 24),
+            _ => None,
+        }
+    }
+
+    /// The ease of every value component of a plain record, see [`Keyframe::ease_component`]
+    /// (one entry for a spatial record).
+    pub fn ease_components(&self) -> Option<Vec<KeyEase>> {
+        let n = match self.kind() {
+            KeyframeKind::Plain { components } => components,
+            KeyframeKind::Spatial { .. } => 1,
+            KeyframeKind::MaskPath | KeyframeKind::Marker | KeyframeKind::Other(_) => return None,
+        };
+        (0..n).map(|i| self.ease_component(i)).collect()
+    }
+
+    /// The Euclidean ARGB distance to the next key that After Effects writes at byte 16 of a colour
+    /// (4-component spatial) record whose interpolation is not linear: 255 sqrt(2) = 360.6245 for
+    /// red to blue; 0 on the last key and on linear keys. `None` for other records.
+    pub fn color_distance(&self) -> Option<f64> {
+        match self.kind() {
+            KeyframeKind::Spatial { components: 4 } => be_f64(self.record, 16),
+            _ => None,
+        }
+    }
+
+    /// The decoded spatial record (Position: 128 bytes, colour: 152 bytes).
+    pub fn spatial(&self) -> Option<SpatialKey> {
+        let KeyframeKind::Spatial { components: n } = self.kind() else { return None };
+        let r = self.record;
+        let span = n.checked_mul(8)?;
+        let ease = ease_at(r, 24)?;
+        Some(SpatialKey {
+            auto_bezier_flag: be_u32(r, 8)?,
+            segment_length: be_f64(r, 16)?,
+            ease: [ease.in_speed, ease.in_influence, ease.out_speed, ease.out_influence],
+            value: doubles(r, 56, n)?,
+            in_tangent: doubles(r, 56usize.checked_add(span)?, n)?,
+            out_tangent: doubles(r, 56usize.checked_add(span.checked_mul(2)?)?, n)?,
+        })
+    }
+}
+
+/// The bytes of a property header that mark an expression: bytes 76, 77 and 120 of `tdb4` are all 1
+/// when the property has an expression (76 and 77 are also 1 on a camera's auto-computed Position,
+/// which has none). Byte 119 is 1 when the expression is disabled.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ExpressionFlags {
+    pub byte_76: u8,
+    pub byte_77: u8,
+    /// 1 when the expression is disabled (`expression.disable_all`); the text stays in the file.
+    pub byte_119: u8,
+    pub byte_120: u8,
+}
+
+impl ExpressionFlags {
+    /// True when bytes 76, 77 and 120 are all 1.
+    pub fn all_set(&self) -> bool {
+        self.byte_76 == 1 && self.byte_77 == 1 && self.byte_120 == 1
+    }
+
+    /// True when byte 119 is 1.
+    pub fn disabled(&self) -> bool {
+        self.byte_119 == 1
+    }
+}
+
+impl<'f, 'a> Property<'f, 'a> {
+    /// The time scale (units per second) of this property's keyframe times: the `u32` at byte 12
+    /// of `tdb4` (25600 at 25 fps, 30720 at 30 fps, 23976 at 29.97 and 23.976 fps).
+    pub fn time_scale(&self) -> Option<u32> {
+        be_u32(self.header()?, 12)
+    }
+
+    /// The property's `tdsb` flags: `1` for a property that was written (non-default), `3` for
+    /// the default state.
+    pub fn flags(&self) -> Option<u32> {
+        be_u32(self.chunk.child(b"tdsb")?.bytes()?, 0)
+    }
+
+    /// True when `tdb4` byte 5 has bit 0 set: the property is static, it has no keyframes.
+    pub fn is_static_flag_set(&self) -> Option<bool> {
+        Some(self.header()?.get(5)? & 1 != 0)
+    }
+
+    /// The expression source: the raw UTF-8 text of the `Utf8` child that follows the value in the
+    /// property (no length prefix, no engine tag; the engine is project-wide).
+    pub fn expression(&self) -> Option<String> {
+        self.chunk.child(b"Utf8").and_then(|c| c.bytes()).map(text)
+    }
+
+    /// The expression flag bytes of `tdb4`.
+    pub fn expression_flags(&self) -> Option<ExpressionFlags> {
+        let h = self.header()?;
+        Some(ExpressionFlags { byte_76: *h.get(76)?, byte_77: *h.get(77)?, byte_119: *h.get(119)?, byte_120: *h.get(120)? })
+    }
+
+    /// Whether the expression is enabled: `None` when the property has no expression (byte 120 is
+    /// not 1 or there is no `Utf8` text), else `Some(false)` when byte 119 marks it disabled. Byte
+    /// 119 also changes by itself on built-in view layers after a save, so it only counts together
+    /// with an expression.
+    pub fn expression_enabled(&self) -> Option<bool> {
+        let flags = self.expression_flags()?;
+        if flags.byte_120 != 1 || self.expression().is_none() {
+            return None;
+        }
+        Some(!flags.disabled())
+    }
+
+    /// The value of the first keyframe (plain or spatial record), for reading an animated property
+    /// at its first key.
+    pub fn first_key_value(&self) -> Option<Vec<f64>> {
+        self.keys()?.keyframes().next()?.value()
+    }
+}
diff --git a/crates/aep/src/container/masks.rs b/crates/aep/src/container/masks.rs
new file mode 100644
index 000000000..7e77c69e9
--- /dev/null
+++ b/crates/aep/src/container/masks.rs
@@ -0,0 +1,258 @@
+//! Masks and bezier paths.
+//!
+//! A layer's masks are in `tdgp[ADBE Mask Parade]`: one `mkif` chunk (mode and invert switch) next
+//! to one `tdgp[ADBE Mask Atom]` per mask. The atom holds the optional properties feather, opacity
+//! and expansion (stored only when not at their defaults) and `om-s[ADBE Mask Shape]`: the path
+//! property (`tdbs`, with a key list when animated) and `omks` with one `LIST shap` per keyframe (a
+//! single one when the path is static).
+
+use crate::container::Chunk;
+use crate::container::bytes::{be_f32, be_u32, until_nul};
+use crate::container::typed::{KeyList, Layer, Project, PropGroup, PropNode, Property};
+use crate::container::values::{Tracked, read};
+
+/// The mask mode (`mkif` `u32` at byte 4).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MaskMode {
+    /// `0` (329)
+    None,
+    /// `1`
+    Add,
+    /// `2`
+    Subtract,
+    /// `3`
+    Intersect,
+    /// `4`
+    Lighten,
+    /// `5`
+    Darken,
+    /// `6`
+    Difference,
+    /// Any other value (not sampled).
+    Other(u32),
+}
+
+impl MaskMode {
+    /// The mode for a stored id.
+    pub fn from_id(id: u32) -> Self {
+        match id {
+            0 => Self::None,
+            1 => Self::Add,
+            2 => Self::Subtract,
+            3 => Self::Intersect,
+            4 => Self::Lighten,
+            5 => Self::Darken,
+            6 => Self::Difference,
+            other => Self::Other(other),
+        }
+    }
+}
+
+/// A vertex of a bezier path with its two control points as absolute positions.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct PathVertex {
+    pub position: [f64; 2],
+    /// The control point of the incoming segment.
+    pub in_handle: [f64; 2],
+    /// The control point of the outgoing segment.
+    pub out_handle: [f64; 2],
+}
+
+impl PathVertex {
+    /// The in tangent: the in handle minus the vertex (what the scripting API calls `inTangents`).
+    pub fn in_tangent(&self) -> [f64; 2] {
+        [self.in_handle[0] - self.position[0], self.in_handle[1] - self.position[1]]
+    }
+
+    /// The out tangent: the out handle minus the vertex (`outTangents`).
+    pub fn out_tangent(&self) -> [f64; 2] {
+        [self.out_handle[0] - self.position[0], self.out_handle[1] - self.position[1]]
+    }
+}
+
+/// One path shape (`LIST shap`): a bounding box and the control points normalised inside it.
+///
+/// The `shph` chunk holds a magic word whose last byte carries the flags (`0x01` closed, `0x09` open:
+/// bit `0x08`), the box (left, top, right, bottom) as four `f32`, and the byte at offset 20 (`1` in
+/// every sample). The box is the box of the vertices **and** their handles. The `list` holds three
+/// points per vertex, each as two `f32` in [0, 1] of the box, in the order `[vertex i, out handle i,
+/// in handle i + 1]`; the last record is the in handle of vertex 0. For masks the box is normalised
+/// to the **layer** size (the size of the layer's source, not the composition's: on a 100x100 solid
+/// a 60x40 mask rectangle at the centre has the box `0.2, 0.3, 0.8, 0.7`, 309); for the paths of shape layers it is in pixels. Handles equal their vertex when a
+/// vertex has no tangents; a tangent is the handle minus the vertex, without a sign change.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ShapePath {
+    /// Left, top, right, bottom.
+    pub bbox: [f32; 4],
+    /// The byte at offset 20 of `shph` (`1` in every sample, also for the open path).
+    pub closed_flag: u8,
+    /// True for an open path: bit `0x08` of the last byte of the first `shph` word.
+    pub open: bool,
+    /// The normalised points as stored, three per vertex.
+    pub points: Vec<[f32; 2]>,
+}
+
+impl ShapePath {
+    /// Decodes a `LIST shap`; `None` when `shph` or the point list is malformed.
+    pub fn from_chunk(shap: &Chunk<'_>) -> Option<Self> {
+        let shph = shap.child(b"shph")?.bytes()?;
+        let bbox = [be_f32(shph, 4)?, be_f32(shph, 8)?, be_f32(shph, 12)?, be_f32(shph, 16)?];
+        let closed_flag = *shph.get(20)?;
+        let open = shph.get(3)? & 0x08 != 0;
+        let list = KeyList::from_chunk(shap.child_list(b"list")?)?;
+        if list.header.record_size != 8 {
+            return None;
+        }
+        let points = list.records().map(|r| Some([be_f32(r, 0)?, be_f32(r, 4)?])).collect::<Option<Vec<_>>>()?;
+        Some(Self { bbox, closed_flag, open, points })
+    }
+
+    /// The number of vertices (`points / 3`).
+    pub fn vertex_count(&self) -> usize {
+        self.points.len() / 3
+    }
+
+    /// The vertices with absolute control points: `box.left + u * (box.right - box.left)` (and the
+    /// same for y), multiplied by `scale` (the layer size in pixels for a mask, `(1, 1)` for a
+    /// shape layer path).
+    pub fn vertices(&self, scale: (f64, f64)) -> Vec<PathVertex> {
+        let [left, top, right, bottom] = self.bbox.map(f64::from);
+        let abs = |p: Option<&[f32; 2]>| -> [f64; 2] {
+            let [u, v] = p.copied().unwrap_or([0.0, 0.0]).map(f64::from);
+            [(left + u * (right - left)) * scale.0, (top + v * (bottom - top)) * scale.1]
+        };
+        let n = self.vertex_count();
+        let total = n.saturating_mul(3);
+        (0..n)
+            .map(|i| {
+                let base = i.saturating_mul(3);
+                PathVertex {
+                    position: abs(self.points.get(base)),
+                    out_handle: abs(self.points.get(base.saturating_add(1))),
+                    // The in handle of vertex i is the record before vertex i (the last one for vertex 0).
+                    in_handle: abs(self.points.get(base.saturating_add(total).saturating_sub(1) % total.max(1))),
+                }
+            })
+            .collect()
+    }
+}
+
+/// One mask of a layer.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Mask {
+    /// The mask name (`Mask 1`).
+    pub name: Option<String>,
+    /// The mode, from this mask's `mkif` (there is one `mkif` per mask, directly before its atom).
+    pub mode: Option<MaskMode>,
+    /// The invert switch (`mkif` byte 0).
+    pub inverted: Option<bool>,
+    /// The running mask id counter of the layer (`mkif` `u32` at byte 8): 1 for the first mask
+    /// created on a layer, +1 per mask created later on the same layer (undo does not reset it).
+    /// A session counter, not a stable id.
+    pub counter: Option<u32>,
+    /// Feather in pixels `[x, y]`; absent = `[0, 0]`.
+    pub feather: Tracked<[f64; 2]>,
+    /// Opacity in percent (stored as a fraction); absent = 100.
+    pub opacity_percent: Tracked<f64>,
+    /// Expansion in pixels; absent = 0.
+    pub expansion: Tracked<f64>,
+    /// True when the path has keyframes.
+    pub path_animated: bool,
+    /// The path keyframe times in seconds (empty for a static path).
+    pub path_key_seconds: Vec<f64>,
+    /// The path shapes: one for a static path, one per keyframe otherwise.
+    pub shapes: Vec<ShapePath>,
+}
+
+fn mask_from_atom(atom: &PropGroup<'_, '_>, mkif: Option<&[u8]>) -> Mask {
+    let opacity = read(atom, "ADBE Mask Opacity", [100.0], 100.0);
+    let expansion = read(atom, "ADBE Mask Offset", [0.0], 1.0);
+    let mut mask = Mask {
+        name: atom.user_name(),
+        mode: mkif.and_then(|m| be_u32(m, 4)).map(MaskMode::from_id),
+        inverted: mkif.and_then(|m| m.first()).map(|b| *b != 0),
+        counter: mkif.and_then(|m| be_u32(m, 8)),
+        feather: read(atom, "ADBE Mask Feather", [0.0, 0.0], 1.0),
+        opacity_percent: Tracked { value: opacity.value[0], source: opacity.source },
+        expansion: Tracked { value: expansion.value[0], source: expansion.source },
+        path_animated: false,
+        path_key_seconds: Vec::new(),
+        shapes: Vec::new(),
+    };
+    if let Some(PropNode::Other(oms)) = atom.get("ADBE Mask Shape") {
+        if let Some(prop) = oms.child_list(b"tdbs").and_then(Property::from_chunk) {
+            mask.path_animated = prop.is_animated();
+            if let (Some(keys), Some(scale)) = (prop.keys(), prop.time_scale()) {
+                mask.path_key_seconds = keys.keyframes().filter_map(|k| k.seconds(scale)).collect();
+            }
+        }
+        if let Some(omks) = oms.child_list(b"omks") {
+            mask.shapes = omks.children().iter().filter(|c| c.is_list(b"shap")).filter_map(ShapePath::from_chunk).collect();
+        }
+    }
+    mask
+}
+
+impl<'f, 'a> Project<'f, 'a> {
+    /// The vertices of every path shape of a mask in pixels of the layer: mask boxes are normalised
+    /// to the **layer** size (the size of its source), not the composition's. `None` when the layer
+    /// has no source with a size.
+    pub fn mask_vertices_px(&self, layer: &Layer<'f, 'a>, mask: &Mask) -> Option<Vec<Vec<PathVertex>>> {
+        let (width, height) = self.layer_source_size(layer)?;
+        Some(mask.shapes.iter().map(|s| s.vertices((f64::from(width), f64::from(height)))).collect())
+    }
+}
+
+/// One mask with the views of its records, for readers that need more than [`Mask`]: the
+/// keyframes and expressions of the mask properties (in [`MaskAtom::atom`]: `ADBE Mask Feather`,
+/// `ADBE Mask Opacity`, `ADBE Mask Offset`) and the path keyframes paired with their shapes.
+#[derive(Debug, Clone)]
+pub struct MaskAtom<'f, 'a> {
+    /// The decoded mask (as [`Layer::masks`] returns it).
+    pub mask: Mask,
+    /// The atom group (`tdgp[ADBE Mask Atom]`).
+    pub atom: PropGroup<'f, 'a>,
+    /// The path property (`om-s[ADBE Mask Shape]/tdbs`): its key list holds one 64-byte record
+    /// per path keyframe (time, interpolation, label and roving flags; 093).
+    pub path: Option<Property<'f, 'a>>,
+    /// Every `LIST shap` of `omks` in file order, `None` where one is malformed, so that index `i`
+    /// stays the shape of path keyframe `i` (one entry for a static path).
+    pub path_shapes: Vec<Option<ShapePath>>,
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The layer's masks, in stack order.
+    pub fn masks(&self) -> Vec<Mask> {
+        self.mask_atoms().into_iter().map(|m| m.mask).collect()
+    }
+
+    /// The layer's masks with the views of their records, in stack order.
+    pub fn mask_atoms(&self) -> Vec<MaskAtom<'f, 'a>> {
+        let Some(root) = self.properties() else { return Vec::new() };
+        let Some(PropNode::Group(parade)) = root.get("ADBE Mask Parade") else { return Vec::new() };
+        // Per mask: `tdmn` (Mask Atom), `mkif`, then the atom's `tdgp`.
+        let mut masks = Vec::new();
+        let (mut name, mut mkif): (Option<&[u8]>, Option<&[u8]>) = (None, None);
+        for c in parade.chunk().children() {
+            if c.is(b"tdmn") {
+                name = c.bytes();
+            } else if c.is(b"mkif") {
+                mkif = c.bytes();
+            } else if c.is_list(b"tdgp") {
+                let is_atom = name.take().is_some_and(|n| until_nul(n) == b"ADBE Mask Atom");
+                if is_atom && let Some(atom) = PropGroup::from_chunk(c) {
+                    let mask = mask_from_atom(&atom, mkif.take());
+                    let (mut path, mut path_shapes) = (None, Vec::new());
+                    if let Some(PropNode::Other(oms)) = atom.get("ADBE Mask Shape") {
+                        path = oms.child_list(b"tdbs").and_then(Property::from_chunk);
+                        if let Some(omks) = oms.child_list(b"omks") {
+                            path_shapes = omks.children().iter().filter(|c| c.is_list(b"shap")).map(ShapePath::from_chunk).collect();
+                        }
+                    }
+                    masks.push(MaskAtom { mask, atom, path, path_shapes });
+                }
+            }
+        }
+        masks
+    }
+}
diff --git a/crates/aep/src/container/matte.rs b/crates/aep/src/container/matte.rs
new file mode 100644
index 000000000..09cb76b69
--- /dev/null
+++ b/crates/aep/src/container/matte.rs
@@ -0,0 +1,68 @@
+//! Track mattes: the matte mode and the matte layer, two fields of the layer header `ldta`.
+//!
+//! Cases 402-408 (a 960x540 grey solid `M` above the red solid `L`): setting a track matte on a
+//! layer changes exactly two fields of that layer's `ldta` (and the video switch of the matte
+//! layer, which After Effects turns off by itself):
+//!
+//! * byte 107 (`u8`; bytes 104..106 are 0 in every file of the corpus): the matte mode, 1 alpha
+//!   (403), 2 alpha inverted (404), 3 luma (405), 4 luma inverted (406), 0 no matte (every other
+//!   case);
+//! * the `u32` at byte 160: the id of the matte layer (`ldta` byte 0 of that layer), `0x1d` = `M`
+//!   in 403-406 and 408, `0x1b` = `L` in 407, where the matte layer is BELOW the layer it mattes.
+//!   0 in every file without a matte.
+//!
+//! A matte mode with a matte layer id of 0 (or an `ldta` too short to hold the id) has no case in
+//! the corpus: After Effects 2026 writes the id. Before After Effects 23.0 a track matte always
+//! used the layer directly above (the documented behaviour of those versions), so such a matte is
+//! returned with [`TrackMatte::layer`] `None` and the caller decides.
+
+use crate::container::Layer;
+use crate::container::bytes::be_u32;
+
+/// The matte mode (`ldta` byte 107).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MatteMode {
+    /// `1` (403)
+    Alpha,
+    /// `2` (404)
+    AlphaInverted,
+    /// `3` (405)
+    Luma,
+    /// `4` (406)
+    LumaInverted,
+    /// Any other non-zero value (not sampled).
+    Other(u8),
+}
+
+impl MatteMode {
+    /// The mode for a stored code; `None` for 0 (no matte).
+    pub fn from_code(code: u8) -> Option<Self> {
+        Some(match code {
+            0 => return None,
+            1 => Self::Alpha,
+            2 => Self::AlphaInverted,
+            3 => Self::Luma,
+            4 => Self::LumaInverted,
+            other => Self::Other(other),
+        })
+    }
+}
+
+/// The track matte of a layer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TrackMatte {
+    pub mode: MatteMode,
+    /// The id of the matte layer (`u32` at `ldta` byte 160); `None` when it is 0 or the header is
+    /// too short to hold it (the older "layer above" form, see the module documentation).
+    pub layer: Option<u32>,
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The track matte of the layer, `None` when it has none (or the header is unreadable).
+    pub fn track_matte(&self) -> Option<TrackMatte> {
+        let ldta = self.chunk().child(b"ldta")?.bytes()?;
+        let mode = MatteMode::from_code(*ldta.get(107)?)?;
+        let layer = be_u32(ldta, 160).filter(|id| *id != 0);
+        Some(TrackMatte { mode, layer })
+    }
+}
diff --git a/crates/aep/src/container/read.rs b/crates/aep/src/container/read.rs
new file mode 100644
index 000000000..abae015ba
--- /dev/null
+++ b/crates/aep/src/container/read.rs
@@ -0,0 +1,142 @@
+//! Parsing the `RIFX` container into an [`AepFile`].
+
+use std::borrow::Cow;
+
+use crate::container::chunk::{AepFile, Body, Chunk, LIST, NESTED_IDS};
+use crate::container::error::AepError;
+
+/// Bounds for hostile input.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Limits {
+    /// Deepest list nesting that is parsed (the top level is depth 1). A list or nested chunk
+    /// whose children would be deeper is kept opaque instead.
+    pub max_depth: usize,
+    /// Most chunks a file may contain (counted across all parse attempts) before parsing fails.
+    pub max_chunks: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self { max_depth: 64, max_chunks: 10_000_000 }
+    }
+}
+
+/// Parses an `.aep` with the default [`Limits`].
+///
+/// # Errors
+/// Returns an error when the input is not a well-formed `RIFX`/`Egg!` container at the top level.
+/// Odd bodies *inside* the container (a `LIST` whose content is not a chunk sequence) do not
+/// fail the parse: they are kept opaque.
+pub fn parse(data: &[u8]) -> Result<AepFile<'_>, AepError> {
+    parse_with_limits(data, Limits::default())
+}
+
+/// Parses an `.aep` with explicit [`Limits`].
+///
+/// # Errors
+/// See [`parse`]; also fails with [`AepError::TooManyChunks`].
+pub fn parse_with_limits(data: &[u8], limits: Limits) -> Result<AepFile<'_>, AepError> {
+    if id4(data, 0) != Some(*b"RIFX") {
+        return Err(AepError::NotRifx);
+    }
+    let declared = u64::from(be32(data, 4).ok_or(AepError::NotRifx)?);
+    let form = id4(data, 8).ok_or(AepError::NotRifx)?;
+    if &form != b"Egg!" {
+        return Err(AepError::BadFormType(form));
+    }
+    let available = (data.len() as u64).saturating_sub(8);
+    if declared < 4 || declared > available {
+        return Err(AepError::Truncated { declared, available });
+    }
+    // `declared <= available < data.len()`, so the end is inside the input.
+    let end = usize::try_from(declared).map_err(|_| AepError::TooLarge)?.checked_add(8).ok_or(AepError::TooLarge)?;
+    let mut parser = Parser { data, limits, count: 0 };
+    let chunks = parser.sequence(12, end, 1)?;
+    let trailer = data.get(end..).unwrap_or(&[]);
+    Ok(AepFile { chunks, trailer: Cow::Borrowed(trailer) })
+}
+
+fn be32(data: &[u8], at: usize) -> Option<u32> {
+    id4(data, at).map(u32::from_be_bytes)
+}
+
+fn id4(data: &[u8], at: usize) -> Option<[u8; 4]> {
+    let b = data.get(at..at.checked_add(4)?)?;
+    Some([*b.first()?, *b.get(1)?, *b.get(2)?, *b.get(3)?])
+}
+
+struct Parser<'a> {
+    data: &'a [u8],
+    limits: Limits,
+    count: usize,
+}
+
+impl<'a> Parser<'a> {
+    /// Parses the sibling chunks that exactly fill `start..end`.
+    fn sequence(&mut self, start: usize, end: usize, depth: usize) -> Result<Vec<Chunk<'a>>, AepError> {
+        let mut out = Vec::new();
+        let mut pos = start;
+        while pos < end {
+            let short = AepError::Malformed { offset: pos, what: "bytes left over that are too short for a chunk header" };
+            let body_start = pos.checked_add(8).filter(|b| *b <= end).ok_or(short)?;
+            let id = id4(self.data, pos).ok_or(AepError::Malformed { offset: pos, what: "short read" })?;
+            let size = be32(self.data, pos + 4).ok_or(AepError::Malformed { offset: pos, what: "short read" })? as usize;
+            let avail = end - body_start;
+            if size > avail {
+                return Err(AepError::ChunkTooLarge { offset: pos, size: size as u64, available: avail as u64 });
+            }
+            self.count = self.count.saturating_add(1);
+            if self.count > self.limits.max_chunks {
+                return Err(AepError::TooManyChunks);
+            }
+            let body_end = body_start + size;
+            let body = self.body(id, body_start, body_end, depth)?;
+            let mut next = body_end;
+            let mut pad = None;
+            if size % 2 == 1 && next < end {
+                pad = Some(self.data.get(next).copied().ok_or(AepError::Malformed { offset: next, what: "missing pad byte" })?);
+                next += 1;
+            }
+            out.push(Chunk { id, body, pad });
+            pos = next;
+        }
+        Ok(out)
+    }
+
+    /// Like [`Self::sequence`] but a structural problem yields `None` (the caller keeps bytes).
+    fn tentative(&mut self, start: usize, end: usize, depth: usize) -> Result<Option<Vec<Chunk<'a>>>, AepError> {
+        match self.sequence(start, end, depth) {
+            Ok(v) => Ok(Some(v)),
+            Err(e) if e.is_structural() => Ok(None),
+            Err(e) => Err(e),
+        }
+    }
+
+    fn slice(&self, start: usize, end: usize) -> &'a [u8] {
+        self.data.get(start..end).unwrap_or(&[])
+    }
+
+    fn body(&mut self, id: [u8; 4], start: usize, end: usize, depth: usize) -> Result<Body<'a>, AepError> {
+        let len = end - start;
+        if id == LIST && len >= 4 {
+            let list_type = id4(self.data, start).ok_or(AepError::Malformed { offset: start, what: "short read" })?;
+            let opaque = |p: &Self| Body::OpaqueList { list_type, data: Cow::Borrowed(p.slice(start + 4, end)) };
+            if depth >= self.limits.max_depth {
+                return Ok(opaque(self));
+            }
+            return Ok(match self.tentative(start + 4, end, depth + 1)? {
+                Some(children) => Body::List { list_type, children },
+                None => opaque(self),
+            });
+        }
+        if NESTED_IDS.contains(&id)
+            && len >= 8
+            && depth < self.limits.max_depth
+            && let Some(children) = self.tentative(start, end, depth + 1)?
+            && !children.is_empty()
+        {
+            return Ok(Body::Chunks(children));
+        }
+        Ok(Body::Data(Cow::Borrowed(self.slice(start, end))))
+    }
+}
diff --git a/crates/aep/src/container/settings.rs b/crates/aep/src/container/settings.rs
new file mode 100644
index 000000000..b44588232
--- /dev/null
+++ b/crates/aep/src/container/settings.rs
@@ -0,0 +1,224 @@
+//! Project settings (File ▸ Project Settings): colour depth, working space, working gamma, the two
+//! linear-light switches, the time display and the frame count start. Cases 620-634: one change
+//! each against the base project 620; every field below is the only byte (or chunk) that changes.
+
+use crate::container::chunk::AepFile;
+use crate::container::footage::json_string;
+
+/// The time display style (`nhed` byte 8, feet + frames byte 11, film type byte 13).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TimeDisplay {
+    /// Timecode (the base, 620): byte 8 = 0.
+    Timecode,
+    /// Frames (629): byte 8 = 1.
+    Frames,
+    /// Feet + frames (633, 634): byte 8 = 1 and byte 11 = 1; byte 13 is the frames per foot,
+    /// 16 for 35 mm (633) and 40 for 16 mm (634).
+    FeetFrames { frames_per_foot: u8 },
+}
+
+/// The working colour space (`cpid` and the JSON `Utf8` after `PwCs`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum WorkingSpace {
+    /// No colour management (623): `cpid` is 16 bytes of `0xff` and the JSON is `{}`.
+    None,
+    /// A colour profile, named as After Effects lists it (`baseColorProfile/colorProfileName`):
+    /// `sRGB IEC61966-2.1` in the base (620), `Rec.709 Gamma 2.4` in 624. The profile data next to
+    /// the name is kept as stored.
+    Profile(String),
+}
+
+/// The project settings that are decoded.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProjectSettings {
+    /// Bits per channel: 8, 16 or 32 (`nhed` byte 15 = 0 / 1 / 2: 621, 622, 620; the same byte
+    /// is `nnhd` byte 24). `None` for another value.
+    pub bits_per_channel: Option<u8>,
+    /// The working space; `None` when the chunks are missing or unreadable.
+    pub working_space: Option<WorkingSpace>,
+    /// Working gamma 2.4 (`dwga` `u32` @0 = 1, 625) or 2.2 (0, 620).
+    pub working_gamma_24: Option<bool>,
+    /// Linearize Working Space: a 1-byte `lnrp` chunk holding 1 exists (626, 632).
+    pub linearize: bool,
+    /// Blend Colors Using 1.0 Gamma: a 1-byte `lnrb` chunk holding 1 exists (627, 632).
+    pub blend_linear: bool,
+    /// Compensate for Scene-referred Profiles (`acer` = 1 in the base, 0 in 628).
+    pub scene_compensation: Option<bool>,
+    /// The time display style.
+    pub time_display: Option<TimeDisplay>,
+    /// Frame count start: `nhed` byte 14 holds 2 for a count from 0 (620) and 1 for a count from
+    /// 1 (630); this maps 2 to 0 and 1 to 1, anything else to `None`.
+    pub frame_start: Option<u8>,
+}
+
+impl ProjectSettings {
+    /// Reads the settings from the top-level chunks.
+    pub fn read(file: &AepFile<'_>) -> ProjectSettings {
+        let nhed = file.chunk(b"nhed").and_then(|c| c.bytes());
+        let byte = |i: usize| nhed.and_then(|b| b.get(i).copied());
+        let bits_per_channel = byte(15).and_then(|v| match v {
+            0 => Some(8),
+            1 => Some(16),
+            2 => Some(32),
+            _ => None,
+        });
+        let time_display = match (byte(8), byte(11), byte(13)) {
+            (Some(0), _, _) => Some(TimeDisplay::Timecode),
+            (Some(1), Some(0), _) => Some(TimeDisplay::Frames),
+            (Some(1), Some(1), Some(fpf)) => Some(TimeDisplay::FeetFrames { frames_per_foot: fpf }),
+            _ => None,
+        };
+        let frame_start = byte(14).and_then(|v| match v {
+            2 => Some(0),
+            1 => Some(1),
+            _ => None,
+        });
+        let flag = |id: &[u8; 4]| file.chunk(id).and_then(|c| c.bytes()).and_then(|b| b.first().copied()) == Some(1);
+        let working_gamma_24 = file.chunk(b"dwga").and_then(|c| c.bytes()).and_then(|b| b.get(..4)).map(|b| b != [0, 0, 0, 0]);
+        let scene_compensation = file.chunk(b"acer").and_then(|c| c.bytes()).and_then(|b| b.first().copied()).map(|v| v != 0);
+        ProjectSettings {
+            bits_per_channel,
+            working_space: working_space(file),
+            working_gamma_24,
+            linearize: flag(b"lnrp"),
+            blend_linear: flag(b"lnrb"),
+            scene_compensation,
+            time_display,
+            frame_start,
+        }
+    }
+}
+
+/// The working space: the `Utf8` right after `PwCs`.
+fn working_space(file: &AepFile<'_>) -> Option<WorkingSpace> {
+    let at = file.chunks.iter().position(|c| c.is(b"PwCs"))?;
+    let json = file.chunks.get(at.checked_add(1)?).filter(|c| c.is(b"Utf8"))?.bytes()?;
+    let trimmed: Vec<u8> = json.iter().copied().filter(|b| !b.is_ascii_whitespace() && *b != 0).collect();
+    if trimmed == b"{}" {
+        return Some(WorkingSpace::None);
+    }
+    // After Effects 26.2.1 saves the profile data without the name (settings-c, 902): the name is
+    // then the profile's own description (ICC.1 `desc`).
+    json_string(json, "colorProfileName")
+        .or_else(|| json_string(json, "colorProfileData").and_then(|b| base64_decode(&b)).and_then(|icc| icc_description(&icc)))
+        .map(WorkingSpace::Profile)
+}
+
+/// Standard base64 (RFC 4648) with or without padding; `None` for any other character.
+fn base64_decode(text: &str) -> Option<Vec<u8>> {
+    let mut out = Vec::with_capacity(text.len() / 4 * 3);
+    let (mut acc, mut bits) = (0u32, 0u32);
+    for c in text.bytes().filter(|c| *c != b'=') {
+        let v = match c {
+            b'A'..=b'Z' => c - b'A',
+            b'a'..=b'z' => c - b'a' + 26,
+            b'0'..=b'9' => c - b'0' + 52,
+            b'+' => 62,
+            b'/' => 63,
+            _ => return None,
+        };
+        acc = (acc << 6 | u32::from(v)) & 0x00ff_ffff;
+        bits += 6;
+        if bits >= 8 {
+            bits -= 8;
+            out.push(((acc >> bits) & 0xff) as u8);
+        }
+    }
+    Some(out)
+}
+
+/// The profile description (ICC.1 tag `desc`): a v2 `desc` (ASCII) or a v4 `mluc` (its first
+/// record, UTF-16BE). `None` when the profile or the tag is cut short.
+fn icc_description(icc: &[u8]) -> Option<String> {
+    let be32 = |at: usize| icc.get(at..at.checked_add(4)?).and_then(|b| b.try_into().ok()).map(u32::from_be_bytes);
+    let count = be32(128)?;
+    let tag = (0..count.min(1024)).find_map(|i| {
+        let at = 132usize.checked_add(usize::try_from(i).ok()?.checked_mul(12)?)?;
+        (icc.get(at..at.checked_add(4)?)? == b"desc").then_some(at)
+    })?;
+    let off = usize::try_from(be32(tag.checked_add(4)?)?).ok()?;
+    let len = usize::try_from(be32(tag.checked_add(8)?)?).ok()?;
+    let body = icc.get(off..off.checked_add(len)?)?;
+    let text = match body.get(..4)? {
+        b"desc" => {
+            let n = usize::try_from(u32::from_be_bytes(body.get(8..12)?.try_into().ok()?)).ok()?;
+            let ascii = body.get(12..12usize.checked_add(n)?)?;
+            String::from_utf8_lossy(ascii.split(|b| *b == 0).next().unwrap_or_default()).into_owned()
+        }
+        b"mluc" => {
+            let n = usize::try_from(u32::from_be_bytes(body.get(20..24)?.try_into().ok()?)).ok()?;
+            let at = usize::try_from(u32::from_be_bytes(body.get(24..28)?.try_into().ok()?)).ok()?;
+            let units: Vec<u16> = body.get(at..at.checked_add(n)?)?.as_chunks::<2>().0.iter().map(|p| u16::from_be_bytes(*p)).collect();
+            String::from_utf16_lossy(&units)
+        }
+        _ => return None,
+    };
+    let text = text.trim_end_matches('\0').trim().to_owned();
+    (!text.is_empty()).then_some(text)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn base64_decodes_with_and_without_padding() {
+        assert_eq!(base64_decode("Zm9vYmFy").as_deref(), Some(&b"foobar"[..]));
+        assert_eq!(base64_decode("Zm9vYmE=").as_deref(), Some(&b"fooba"[..]));
+        assert_eq!(base64_decode("Zm9vYg").as_deref(), Some(&b"foob"[..]));
+        assert_eq!(base64_decode("Zm9v*"), None);
+    }
+
+    /// A profile with one tag, `desc`, holding `body`.
+    fn profile(body: &[u8]) -> Vec<u8> {
+        let mut icc = vec![0u8; 128];
+        icc.extend_from_slice(&1u32.to_be_bytes());
+        icc.extend_from_slice(b"desc");
+        icc.extend_from_slice(&144u32.to_be_bytes());
+        icc.extend_from_slice(&u32::try_from(body.len()).unwrap().to_be_bytes());
+        icc.extend_from_slice(body);
+        icc
+    }
+
+    /// A version 2 `desc` body.
+    fn desc(text: &str) -> Vec<u8> {
+        let mut b = b"desc\0\0\0\0".to_vec();
+        b.extend_from_slice(&u32::try_from(text.len() + 1).unwrap().to_be_bytes());
+        b.extend_from_slice(text.as_bytes());
+        b.push(0);
+        b
+    }
+
+    /// A version 4 `mluc` body with one record.
+    fn mluc(text: &str) -> Vec<u8> {
+        let units: Vec<u8> = text.encode_utf16().flat_map(u16::to_be_bytes).collect();
+        let mut b = b"mluc\0\0\0\0".to_vec();
+        b.extend_from_slice(&1u32.to_be_bytes());
+        b.extend_from_slice(&12u32.to_be_bytes());
+        b.extend_from_slice(b"enUS");
+        b.extend_from_slice(&u32::try_from(units.len()).unwrap().to_be_bytes());
+        b.extend_from_slice(&28u32.to_be_bytes());
+        b.extend_from_slice(&units);
+        b
+    }
+
+    #[test]
+    fn the_description_of_a_profile_is_read() {
+        assert_eq!(icc_description(&profile(&desc("Rec.709 Gamma 2.4"))).as_deref(), Some("Rec.709 Gamma 2.4"));
+        assert_eq!(icc_description(&profile(&mluc("sRGB IEC61966-2.1"))).as_deref(), Some("sRGB IEC61966-2.1"));
+        assert_eq!(icc_description(&profile(&desc(""))), None);
+    }
+
+    #[test]
+    fn a_cut_or_damaged_profile_gives_no_description() {
+        let icc = profile(&mluc("Rec.709 Gamma 2.4"));
+        for n in 0..icc.len() {
+            let mut cut = icc.get(..n).unwrap_or_default().to_vec();
+            let _ = icc_description(&cut);
+            cut.iter_mut().for_each(|b| *b = 0xff);
+            let _ = icc_description(&cut);
+        }
+        assert_eq!(icc_description(&icc[..150]), None);
+        assert_eq!(icc_description(&[]), None);
+    }
+}
diff --git a/crates/aep/src/container/shapes.rs b/crates/aep/src/container/shapes.rs
new file mode 100644
index 000000000..ea89155a1
--- /dev/null
+++ b/crates/aep/src/container/shapes.rs
@@ -0,0 +1,273 @@
+//! Shape layers: the groups under `ADBE Root Vectors Group` and the items in them.
+//!
+//! A shape layer (layer type 4) holds `tdgp[ADBE Root Vectors Group]` with one `ADBE Vector Group`
+//! per shape group; the group holds `ADBE Vectors Group` (the contents, in z-order) and
+//! `ADBE Vector Transform Group` (the group transform, only the properties that differ from the
+//! default). Only the items and properties whose layout was verified are decoded; anything else is
+//! listed as [`ShapeItem::Other`] with its match name.
+//!
+//! Colours are stored as ARGB doubles 0..255 and returned as fractions. Sizes, positions and path
+//! points are in pixels relative to the layer origin.
+
+use crate::container::masks::ShapePath;
+use crate::container::typed::{Layer, PropGroup, PropNode, Property};
+use crate::container::values::{Tracked, read, read_opt};
+
+/// The stroke line cap (`ADBE Vector Stroke Line Cap`, stored as a double; butt is the default and
+/// is not stored).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StrokeCap {
+    /// `1`
+    Butt,
+    /// `2`
+    Round,
+    /// Any other value (projecting square was not sampled).
+    Other(i64),
+}
+
+/// The stroke line join (`ADBE Vector Stroke Line Join`; miter is the default and is not stored).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StrokeJoin {
+    /// `1`
+    Miter,
+    /// `2`
+    Round,
+    /// Any other value (bevel was not sampled).
+    Other(i64),
+}
+
+/// A stroke item.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Stroke {
+    /// The color as `[A, R, G, B]` fractions; `None` while the property is absent (its default is
+    /// not verified).
+    pub color: Option<Tracked<[f64; 4]>>,
+    /// The width in pixels; `None` while absent.
+    pub width: Option<Tracked<f64>>,
+    pub cap: Tracked<StrokeCap>,
+    pub join: Tracked<StrokeJoin>,
+    /// The miter limit; after the join was touched it is stored in its default state (4).
+    pub miter_limit: Option<Tracked<f64>>,
+}
+
+/// An item of a shape group's contents.
+#[derive(Debug, Clone, PartialEq)]
+pub enum ShapeItem {
+    /// `ADBE Vector Shape - Rect`: the rectangle path.
+    Rect { name: Option<String>, size: Option<Tracked<[f64; 2]>> },
+    /// `ADBE Vector Shape - Group`: a bezier path (one shape per keyframe), points in pixels.
+    Path { name: Option<String>, paths: Vec<ShapePath> },
+    /// `ADBE Vector Graphic - Fill`: the color as `[A, R, G, B]` fractions.
+    Fill { name: Option<String>, color: Option<Tracked<[f64; 4]>> },
+    /// `ADBE Vector Graphic - Stroke`
+    Stroke { name: Option<String>, stroke: Stroke },
+    /// `ADBE Vector Graphic - G-Fill`: the start and end point of the gradient in pixels (the
+    /// gradient type and the colour stops are not stored while they are at After Effects' default
+    /// and their encoding is not known).
+    GradientFill { name: Option<String>, start: Option<Tracked<[f64; 2]>>, end: Option<Tracked<[f64; 2]>> },
+    /// `ADBE Vector Filter - RC`: rounded corners, the radius in pixels.
+    RoundCorners { name: Option<String>, radius: Option<Tracked<f64>> },
+    /// Any other item (ellipse, polystar, trim, repeater, ...: not ported).
+    Other { match_name: String, name: Option<String> },
+}
+
+/// The polystar type (`ADBE Vector Star Type`; star is the default and is not stored).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PolystarType {
+    /// `1`
+    Star,
+    /// `2`
+    Polygon,
+    /// Any other value.
+    Other(i64),
+}
+
+/// The gradient type (`ADBE Vector Grad Type`; linear is the default and is not stored).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum GradientType {
+    /// `1`
+    Linear,
+    /// `2`
+    Radial,
+    /// Any other value.
+    Other(i64),
+}
+
+/// Fields of shape items that [`ShapeItem`] does not carry, in the order of the group's items.
+/// `item_index` is the index into [`ShapeGroup::items`].
+#[derive(Debug, Clone, PartialEq)]
+pub enum ShapeDetail {
+    /// `ADBE Vector Shape - Star` (listed as [`ShapeItem::Other`]). The defaults After Effects
+    /// applies when a property is absent are star, outer radius 100, inner radius 50, so a default
+    /// star has no property at all (330); a polygon stores the type and writes the inner radius and
+    /// the inner roundness (`ADBE Vector Star Inner Roundess`, After Effects' own spelling) in their
+    /// default state (331).
+    Polystar {
+        item_index: usize,
+        star_type: Tracked<PolystarType>,
+        outer_radius: Tracked<f64>,
+        inner_radius: Tracked<f64>,
+        /// `None` unless the roundness is stored.
+        inner_roundness: Option<Tracked<f64>>,
+    },
+    /// `ADBE Vector Graphic - G-Fill`: the gradient type and, for a radial gradient, the highlight
+    /// length and angle (written as stored records with value 0 when the type is radial, 332).
+    Gradient { item_index: usize, gradient_type: Tracked<GradientType>, highlight_length: Option<Tracked<f64>>, highlight_angle: Option<Tracked<f64>> },
+    /// The `ADBE Vector Rect Position` of a rectangle path (absent = `[0, 0]`), in pixels (333).
+    RectPosition { item_index: usize, position: Tracked<[f64; 2]> },
+}
+
+/// A shape group (`ADBE Vector Group`).
+#[derive(Debug, Clone, PartialEq)]
+pub struct ShapeGroup {
+    /// The group's name (`Group 1`).
+    pub name: Option<String>,
+    /// The group transform's Position in pixels; absent = `[0, 0]`.
+    pub position: Tracked<[f64; 2]>,
+    /// The contents in z-order (top first, as in the file). Two siblings with the same match name
+    /// (two rectangles) are two items.
+    pub items: Vec<ShapeItem>,
+    /// More fields of the items (polystar, gradient type, rectangle position), see [`ShapeDetail`].
+    pub details: Vec<ShapeDetail>,
+}
+
+const COLOR_SCALE: f64 = 1.0 / 255.0;
+
+fn number(group: &PropGroup<'_, '_>, name: &str) -> Option<Tracked<f64>> {
+    read_opt::<1>(group, name, 1.0).map(|t| Tracked { value: t.value[0], source: t.source })
+}
+
+fn paths_of(group: &PropGroup<'_, '_>) -> Vec<ShapePath> {
+    let Some(PropNode::Other(oms)) = group.get("ADBE Vector Shape") else { return Vec::new() };
+    let Some(omks) = oms.child_list(b"omks") else { return Vec::new() };
+    omks.children().iter().filter(|c| c.is_list(b"shap")).filter_map(ShapePath::from_chunk).collect()
+}
+
+fn item(match_name: String, group: &PropGroup<'_, '_>) -> ShapeItem {
+    let name = group.user_name();
+    match match_name.as_str() {
+        "ADBE Vector Shape - Rect" => ShapeItem::Rect { name, size: read_opt::<2>(group, "ADBE Vector Rect Size", 1.0) },
+        "ADBE Vector Shape - Group" => ShapeItem::Path { name, paths: paths_of(group) },
+        "ADBE Vector Graphic - Fill" => ShapeItem::Fill { name, color: read_opt::<4>(group, "ADBE Vector Fill Color", COLOR_SCALE) },
+        "ADBE Vector Graphic - Stroke" => {
+            let cap = read(group, "ADBE Vector Stroke Line Cap", [1.0], 1.0);
+            let join = read(group, "ADBE Vector Stroke Line Join", [1.0], 1.0);
+            let stroke = Stroke {
+                color: read_opt::<4>(group, "ADBE Vector Stroke Color", COLOR_SCALE),
+                width: number(group, "ADBE Vector Stroke Width"),
+                cap: Tracked {
+                    value: match cap.value[0].round() as i64 {
+                        1 => StrokeCap::Butt,
+                        2 => StrokeCap::Round,
+                        other => StrokeCap::Other(other),
+                    },
+                    source: cap.source,
+                },
+                join: Tracked {
+                    value: match join.value[0].round() as i64 {
+                        1 => StrokeJoin::Miter,
+                        2 => StrokeJoin::Round,
+                        other => StrokeJoin::Other(other),
+                    },
+                    source: join.source,
+                },
+                miter_limit: number(group, "ADBE Vector Stroke Miter Limit"),
+            };
+            ShapeItem::Stroke { name, stroke }
+        }
+        "ADBE Vector Graphic - G-Fill" => ShapeItem::GradientFill {
+            name,
+            start: read_opt::<2>(group, "ADBE Vector Grad Start Pt", 1.0),
+            end: read_opt::<2>(group, "ADBE Vector Grad End Pt", 1.0),
+        },
+        "ADBE Vector Filter - RC" => ShapeItem::RoundCorners { name, radius: number(group, "ADBE Vector RoundCorner Radius") },
+        _ => ShapeItem::Other { match_name, name },
+    }
+}
+
+fn detail(match_name: &str, group: &PropGroup<'_, '_>, item_index: usize) -> Option<ShapeDetail> {
+    let tracked = |name: &str, default: f64| {
+        let t = read(group, name, [default], 1.0);
+        Tracked { value: t.value[0], source: t.source }
+    };
+    match match_name {
+        "ADBE Vector Shape - Star" => {
+            let star_type = tracked("ADBE Vector Star Type", 1.0);
+            Some(ShapeDetail::Polystar {
+                item_index,
+                star_type: Tracked {
+                    value: match star_type.value.round() as i64 {
+                        1 => PolystarType::Star,
+                        2 => PolystarType::Polygon,
+                        other => PolystarType::Other(other),
+                    },
+                    source: star_type.source,
+                },
+                outer_radius: tracked("ADBE Vector Star Outer Radius", 100.0),
+                inner_radius: tracked("ADBE Vector Star Inner Radius", 50.0),
+                inner_roundness: number(group, "ADBE Vector Star Inner Roundess"),
+            })
+        }
+        "ADBE Vector Graphic - G-Fill" => {
+            let gradient_type = tracked("ADBE Vector Grad Type", 1.0);
+            Some(ShapeDetail::Gradient {
+                item_index,
+                gradient_type: Tracked {
+                    value: match gradient_type.value.round() as i64 {
+                        1 => GradientType::Linear,
+                        2 => GradientType::Radial,
+                        other => GradientType::Other(other),
+                    },
+                    source: gradient_type.source,
+                },
+                highlight_length: number(group, "ADBE Vector Grad HiLite Length"),
+                highlight_angle: number(group, "ADBE Vector Grad HiLite Angle"),
+            })
+        }
+        "ADBE Vector Shape - Rect" => Some(ShapeDetail::RectPosition { item_index, position: read(group, "ADBE Vector Rect Position", [0.0, 0.0], 1.0) }),
+        _ => None,
+    }
+}
+
+fn group_of(group: &PropGroup<'_, '_>) -> ShapeGroup {
+    let (mut items, mut details) = (Vec::new(), Vec::new());
+    if let Some(PropNode::Group(contents)) = group.get("ADBE Vectors Group") {
+        for e in contents.entries() {
+            if let PropNode::Group(g) = e.node {
+                details.extend(detail(&e.match_name, &g, items.len()));
+                items.push(item(e.match_name, &g));
+            }
+        }
+    }
+    let position = match group.get("ADBE Vector Transform Group") {
+        Some(PropNode::Group(t)) => read(&t, "ADBE Vector Position", [0.0, 0.0], 1.0),
+        _ => Tracked { value: [0.0, 0.0], source: crate::container::values::ValueSource::Default },
+    };
+    ShapeGroup { name: group.user_name(), position, items, details }
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The shape groups of a shape layer (`ADBE Root Vectors Group`), top group first.
+    pub fn shape_groups(&self) -> Vec<ShapeGroup> {
+        let Some(root) = self.properties() else { return Vec::new() };
+        let Some(PropNode::Group(vectors)) = root.get("ADBE Root Vectors Group") else { return Vec::new() };
+        vectors
+            .entries()
+            .into_iter()
+            .filter(|e| e.match_name == "ADBE Vector Group")
+            .filter_map(|e| match e.node {
+                PropNode::Group(g) => Some(group_of(&g)),
+                PropNode::Property(_) | PropNode::Other(_) => None,
+            })
+            .collect()
+    }
+}
+
+impl<'f, 'a> Property<'f, 'a> {
+    /// The ARGB fractions of a static colour property (4 components stored as doubles 0..255).
+    pub fn color_argb(&self) -> Option<[f64; 4]> {
+        let v = self.static_value()?;
+        let [a, r, g, b] = *v.as_slice().first_chunk::<4>()?;
+        Some([a / 255.0, r / 255.0, g / 255.0, b / 255.0])
+    }
+}
diff --git a/crates/aep/src/container/style_map.rs b/crates/aep/src/container/style_map.rs
new file mode 100644
index 000000000..fdb28c875
--- /dev/null
+++ b/crates/aep/src/container/style_map.rs
@@ -0,0 +1,378 @@
+//! The layer-style table shared by the importer (`crate::import`) and the exporter
+//! (`crate::export`): the After Effects layer styles (`ADBE Layer Styles`, docs
+//! `aep-format.md` 3.14) and their parameters, the EffectCraft style and parameter each maps to,
+//! the unit conversion and After Effects' default as it would be stored.
+//!
+//! Layout (950-980): every layer's root group holds `ADBE Layer Styles`; under it `ADBE Blend
+//! Options Group` and one switch group per style (`dropShadow/enabled`, ...), whose `tdsb` is 1
+//! while the style is applied and 2 while it is not. A parameter has a record only when it
+//! differs from its default, in the order of [`StyleMap::params`] (After Effects' property
+//! order). Scalars are stored in the units shown (opacity in percent, pixels, degrees), colours
+//! as ARGB 0..255, popups 1-based, checkboxes 1.0 when on.
+
+/// The match name of the layer-styles group in a layer's root group.
+pub const GROUP: &str = "ADBE Layer Styles";
+/// The Blending Options group.
+pub const BLEND_OPTIONS: &str = "ADBE Blend Options Group";
+/// The Advanced Blending group inside Blending Options.
+pub const ADV_BLEND: &str = "ADBE Adv Blend Group";
+/// Global Light Angle in Blending Options (degrees; 977).
+pub const GLOBAL_ANGLE: &str = "ADBE Global Angle2";
+/// Global Light Altitude in Blending Options (degrees; 977).
+pub const GLOBAL_ALTITUDE: &str = "ADBE Global Altitude2";
+/// The group `tdsb` of an applied style (and of Layer Styles and Blending Options once a style is
+/// applied, 951-960).
+pub const FLAGS_ON: u32 = 1;
+/// The group `tdsb` of a style that is applied but switched off (its eye; 988: not drawn). Bit 0
+/// is the switch, as on shape items (986, 987).
+pub const FLAGS_OFF: u32 = 0;
+/// The group `tdsb` of a style that is not applied (950).
+pub const FLAGS_UNUSED: u32 = 2;
+/// The `tdsb` of Layer Styles and Blending Options while no style is applied (950).
+pub const FLAGS_GROUP_UNUSED: u32 = 3;
+/// The switch group of Pattern Overlay, which has no EffectCraft counterpart (and no menu
+/// command in After Effects 2026).
+pub const PATTERN_OVERLAY: &str = "patternFill";
+
+/// How a stored style value becomes an EffectCraft value.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum StyleConv {
+    /// A number used as stored (percent, pixels, degrees; 966-974, 977).
+    Number,
+    /// A colour: ARGB 0..255 (967, 970, 977).
+    Color,
+    /// A style blend mode: After Effects' 1-based item of [`STYLE_MODES`] (978).
+    Mode,
+    /// Another popup: `map[stored - 1]` is the EffectCraft item (0-based).
+    Popup(&'static [u32]),
+    /// A checkbox, stored 1.0 when on (977).
+    Checkbox,
+    /// A two-component value used as stored (Gradient Overlay Offset; 977).
+    Vec2,
+    /// A gradient (`GCst`), not decoded: reported on import, never written.
+    Gradient,
+}
+
+/// One parameter: its match name without the style prefix, the EffectCraft parameter id, the
+/// conversion and After Effects' default as stored (MANIFEST 951 read-back).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct StyleParam {
+    pub ae: &'static str,
+    pub ec: &'static str,
+    pub conv: StyleConv,
+    pub default: &'static [f64],
+}
+
+/// One style: its switch-group prefix, the EffectCraft style id and the parameters in After
+/// Effects' property order (the order records are written in, 970).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct StyleMap {
+    pub ae: &'static str,
+    pub ec: &'static str,
+    pub params: &'static [StyleParam],
+}
+
+impl StyleMap {
+    /// The switch group's match name (`dropShadow/enabled`).
+    pub fn switch_name(&self) -> String {
+        format!("{}/enabled", self.ae)
+    }
+    /// A parameter's full match name (`dropShadow/opacity`).
+    pub fn param_name(&self, p: &StyleParam) -> String {
+        format!("{}/{}", self.ae, p.ae)
+    }
+}
+
+/// The style blend modes by their stored value (1-based): EffectCraft's mode name, `None` for a
+/// separator of the menu (renders Normal). Sweep 978 (16 bpc, each value rendered over a known
+/// colour): Normal and Dissolve (at 100 % opacity) render alike, as do Lighter Color and Normal
+/// for that colour pair (E); the others matched one formula within 1/255.
+pub const STYLE_MODES: &[Option<&str>] = &[
+    Some("Normal"),
+    Some("Dissolve"),
+    None,
+    Some("Darken"),
+    Some("Multiply"),
+    Some("Color Burn"),
+    Some("Linear Burn"),
+    Some("Darker Color"),
+    None,
+    Some("Lighten"),
+    Some("Screen"),
+    Some("Color Dodge"),
+    Some("Linear Dodge (Add)"),
+    Some("Lighter Color"),
+    None,
+    Some("Overlay"),
+    Some("Soft Light"),
+    Some("Hard Light"),
+    Some("Vivid Light"),
+    Some("Linear Light"),
+    Some("Pin Light"),
+    Some("Hard Mix"),
+    None,
+    Some("Difference"),
+    Some("Exclusion"),
+    None,
+    Some("Hue"),
+    Some("Saturation"),
+    Some("Color"),
+    Some("Luminosity"),
+    None,
+    Some("Subtract"),
+    Some("Divide"),
+];
+
+/// The stored value (1-based) of a style blend mode by EffectCraft's name.
+pub fn mode_code(name: &str) -> Option<u32> {
+    STYLE_MODES.iter().position(|m| *m == Some(name)).and_then(|i| u32::try_from(i + 1).ok())
+}
+
+/// EffectCraft's name of a stored style blend mode; `None` for a separator or out of range.
+pub fn mode_name(code: f64) -> Option<&'static str> {
+    if !code.is_finite() || code < 1.0 {
+        return None;
+    }
+    let i = code.round() as usize;
+    *STYLE_MODES.get(i.checked_sub(1)?)?
+}
+
+/// A popup's stored value for an EffectCraft item (the inverse of `map`).
+pub fn popup_code(map: &[u32], item: u32) -> Option<u32> {
+    map.iter().position(|m| *m == item).and_then(|i| u32::try_from(i + 1).ok())
+}
+
+/// The EffectCraft item of a stored popup value.
+pub fn popup_item(map: &[u32], code: f64) -> Option<u32> {
+    if !code.is_finite() || code < 1.0 {
+        return None;
+    }
+    map.get((code.round() as usize).checked_sub(1)?).copied()
+}
+
+use StyleConv as C;
+
+const fn p(ae: &'static str, ec: &'static str, conv: StyleConv, default: &'static [f64]) -> StyleParam {
+    StyleParam { ae, ec, conv, default }
+}
+
+/// Popups whose items are in the same order in both programs (1-based there, 0-based here).
+const SAME2: &[u32] = &[0, 1];
+const SAME3: &[u32] = &[0, 1, 2];
+const SAME5: &[u32] = &[0, 1, 2, 3, 4];
+/// Inner Glow Source: After Effects stores Edge as 1 and Center as 2 (955, 979); EffectCraft
+/// lists Center, Edge.
+const GLOW_SOURCE: &[u32] = &[1, 0];
+
+const BLACK: &[f64] = &[255.0, 0.0, 0.0, 0.0];
+const WHITE: &[f64] = &[255.0, 255.0, 255.0, 255.0];
+const RED: &[f64] = &[255.0, 255.0, 0.0, 0.0];
+const GLOW: &[f64] = &[255.0, 255.0, 255.0, 190.0];
+
+/// The nine styles with a counterpart, in menu order. Defaults: the read-back of 951 (MANIFEST);
+/// popup items: 977-980 and the read-back (E where only the stored number is known: Technique
+/// Precise, Bevel Technique and Direction, Gradient Style beyond Linear).
+pub const STYLES: &[StyleMap] = &[
+    StyleMap {
+        ae: "dropShadow",
+        ec: "dropShadow",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[5.0]),
+            p("color", "color", C::Color, BLACK),
+            p("opacity", "opacity", C::Number, &[75.0]),
+            p("useGlobalAngle", "useGlobalLight", C::Checkbox, &[0.0]),
+            p("localLightingAngle", "angle", C::Number, &[120.0]),
+            p("distance", "distance", C::Number, &[5.0]),
+            p("chokeMatte", "spread", C::Number, &[0.0]),
+            p("blur", "size", C::Number, &[5.0]),
+            p("noise", "noise", C::Number, &[0.0]),
+            p("layerConceals", "knocksOut", C::Checkbox, &[1.0]),
+        ],
+    },
+    StyleMap {
+        ae: "innerShadow",
+        ec: "innerShadow",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[5.0]),
+            p("color", "color", C::Color, BLACK),
+            p("opacity", "opacity", C::Number, &[75.0]),
+            p("useGlobalAngle", "useGlobalLight", C::Checkbox, &[0.0]),
+            p("localLightingAngle", "angle", C::Number, &[120.0]),
+            p("distance", "distance", C::Number, &[5.0]),
+            p("chokeMatte", "choke", C::Number, &[0.0]),
+            p("blur", "size", C::Number, &[5.0]),
+            p("noise", "noise", C::Number, &[0.0]),
+        ],
+    },
+    StyleMap {
+        ae: "outerGlow",
+        ec: "outerGlow",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[11.0]),
+            p("opacity", "opacity", C::Number, &[75.0]),
+            p("noise", "noise", C::Number, &[0.0]),
+            p("AEColorChoice", "colorType", C::Popup(SAME2), &[1.0]),
+            p("color", "color", C::Color, GLOW),
+            p("gradient", "colors", C::Gradient, &[]),
+            p("gradientSmoothness", "gradientSmoothness", C::Number, &[100.0]),
+            p("glowTechnique", "technique", C::Popup(SAME2), &[1.0]),
+            p("chokeMatte", "spread", C::Number, &[0.0]),
+            p("blur", "size", C::Number, &[5.0]),
+            p("inputRange", "range", C::Number, &[50.0]),
+            p("shadingNoise", "jitter", C::Number, &[0.0]),
+        ],
+    },
+    StyleMap {
+        ae: "innerGlow",
+        ec: "innerGlow",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[11.0]),
+            p("opacity", "opacity", C::Number, &[75.0]),
+            p("noise", "noise", C::Number, &[0.0]),
+            p("AEColorChoice", "colorType", C::Popup(SAME2), &[1.0]),
+            p("color", "color", C::Color, GLOW),
+            p("gradient", "colors", C::Gradient, &[]),
+            p("gradientSmoothness", "gradientSmoothness", C::Number, &[100.0]),
+            p("glowTechnique", "technique", C::Popup(SAME2), &[1.0]),
+            p("innerGlowSource", "source", C::Popup(GLOW_SOURCE), &[1.0]),
+            p("chokeMatte", "choke", C::Number, &[0.0]),
+            p("blur", "size", C::Number, &[5.0]),
+            p("inputRange", "range", C::Number, &[50.0]),
+            p("shadingNoise", "jitter", C::Number, &[0.0]),
+        ],
+    },
+    StyleMap {
+        ae: "bevelEmboss",
+        ec: "bevelEmboss",
+        params: &[
+            p("bevelStyle", "style", C::Popup(SAME5), &[2.0]),
+            p("bevelTechnique", "technique", C::Popup(SAME3), &[1.0]),
+            p("strengthRatio", "depth", C::Number, &[100.0]),
+            p("bevelDirection", "direction", C::Popup(SAME2), &[1.0]),
+            p("blur", "size", C::Number, &[5.0]),
+            p("softness", "soften", C::Number, &[0.0]),
+            p("useGlobalAngle", "useGlobalLight", C::Checkbox, &[0.0]),
+            p("localLightingAngle", "angle", C::Number, &[120.0]),
+            p("localLightingAltitude", "altitude", C::Number, &[30.0]),
+            p("highlightMode", "highlightMode", C::Mode, &[11.0]),
+            p("highlightColor", "highlightColor", C::Color, WHITE),
+            p("highlightOpacity", "highlightOpacity", C::Number, &[75.0]),
+            p("shadowMode", "shadowMode", C::Mode, &[5.0]),
+            p("shadowColor", "shadowColor", C::Color, BLACK),
+            p("shadowOpacity", "shadowOpacity", C::Number, &[75.0]),
+        ],
+    },
+    StyleMap {
+        ae: "chromeFX",
+        ec: "satin",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[5.0]),
+            p("color", "color", C::Color, BLACK),
+            p("opacity", "opacity", C::Number, &[50.0]),
+            p("localLightingAngle", "angle", C::Number, &[19.0]),
+            p("distance", "distance", C::Number, &[11.0]),
+            p("blur", "size", C::Number, &[14.0]),
+            p("invert", "invert", C::Checkbox, &[1.0]),
+        ],
+    },
+    StyleMap {
+        ae: "solidFill",
+        ec: "colorOverlay",
+        params: &[p("mode2", "blendMode", C::Mode, &[1.0]), p("color", "color", C::Color, RED), p("opacity", "opacity", C::Number, &[100.0])],
+    },
+    StyleMap {
+        ae: "gradientFill",
+        ec: "gradientOverlay",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[1.0]),
+            p("opacity", "opacity", C::Number, &[100.0]),
+            p("gradient", "colors", C::Gradient, &[]),
+            p("gradientSmoothness", "gradientSmoothness", C::Number, &[100.0]),
+            p("angle", "angle", C::Number, &[90.0]),
+            p("type", "style", C::Popup(SAME5), &[1.0]),
+            p("reverse", "reverse", C::Checkbox, &[0.0]),
+            p("align", "alignWithLayer", C::Checkbox, &[1.0]),
+            p("scale", "scale", C::Number, &[100.0]),
+            p("offset", "offset", C::Vec2, &[0.0, 0.0]),
+        ],
+    },
+    StyleMap {
+        ae: "frameFX",
+        ec: "stroke",
+        params: &[
+            p("mode2", "blendMode", C::Mode, &[1.0]),
+            p("color", "color", C::Color, RED),
+            p("size", "size", C::Number, &[3.0]),
+            p("opacity", "opacity", C::Number, &[100.0]),
+            p("style", "position", C::Popup(SAME3), &[1.0]),
+        ],
+    },
+];
+
+/// Advanced Blending (in Blending Options): full match name, EffectCraft id in
+/// `blendingOptions/advancedBlending`, conversion and default (977; Fill Opacity 975). After
+/// Effects has no Knockout.
+pub const ADVANCED_BLENDING: &[StyleParam] = &[
+    p("ADBE Layer Fill Opacity2", "fillOpacity", C::Number, &[100.0]),
+    p("ADBE R Channel Blend", "red", C::Checkbox, &[1.0]),
+    p("ADBE G Channel Blend", "green", C::Checkbox, &[1.0]),
+    p("ADBE B Channel Blend", "blue", C::Checkbox, &[1.0]),
+    p("ADBE Blend Interior", "blendInteriorAsGroup", C::Checkbox, &[0.0]),
+    p("ADBE Blend Ranges", "useBlendRanges", C::Checkbox, &[1.0]),
+];
+
+/// The style with this switch-group prefix.
+pub fn by_ae(prefix: &str) -> Option<&'static StyleMap> {
+    STYLES.iter().find(|s| s.ae == prefix)
+}
+
+/// The style with this EffectCraft id.
+pub fn by_ec(id: &str) -> Option<&'static StyleMap> {
+    STYLES.iter().find(|s| s.ec == id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn modes_round_trip_and_defaults_are_the_photoshop_ones() {
+        assert_eq!(mode_name(5.0), Some("Multiply"));
+        assert_eq!(mode_name(11.0), Some("Screen"));
+        assert_eq!(mode_name(1.0), Some("Normal"));
+        assert_eq!(mode_name(3.0), None);
+        assert_eq!(mode_name(34.0), None);
+        assert_eq!(mode_name(0.0), None);
+        assert_eq!(mode_name(f64::NAN), None);
+        for (i, m) in STYLE_MODES.iter().enumerate() {
+            if let Some(m) = m {
+                assert_eq!(mode_code(m), Some(i as u32 + 1));
+            }
+        }
+        assert_eq!(STYLE_MODES.iter().flatten().count(), 27);
+    }
+
+    #[test]
+    fn popups_invert() {
+        assert_eq!(popup_item(GLOW_SOURCE, 1.0), Some(1));
+        assert_eq!(popup_item(GLOW_SOURCE, 2.0), Some(0));
+        assert_eq!(popup_code(GLOW_SOURCE, 0), Some(2));
+        assert_eq!(popup_item(SAME3, 4.0), None);
+        assert_eq!(popup_item(SAME3, -1.0), None);
+    }
+
+    #[test]
+    fn every_param_has_a_default_of_its_size() {
+        for s in STYLES {
+            for prm in s.params {
+                let n = match prm.conv {
+                    C::Color => 4,
+                    C::Vec2 => 2,
+                    C::Gradient => 0,
+                    _ => 1,
+                };
+                assert_eq!(prm.default.len(), n, "{}/{}", s.ae, prm.ae);
+            }
+        }
+    }
+}
diff --git a/crates/aep/src/container/textdoc.rs b/crates/aep/src/container/textdoc.rs
new file mode 100644
index 000000000..566a48534
--- /dev/null
+++ b/crates/aep/src/container/textdoc.rs
@@ -0,0 +1,1031 @@
+//! Text documents (`LIST btdk`) and layer / composition markers.
+//!
+//! The body of a `btdk` list is not a chunk sequence but a PostScript-like dictionary: `/key
+//! value` pairs, `<< >>` dictionaries, `[ ]` arrays, numbers, `true` / `false`, `/names`, and strings
+//! as `(` + BOM `fe ff` + UTF-16BE + `)` with `\` escapes. [`parse_text_dict`] reads it (depth
+//! limited, never panics) and [`Layer::text_document`] pulls out the verified fields.
+
+use crate::container::Chunk;
+use crate::container::bytes::{be_u32, text};
+use crate::container::typed::{Comp, Layer, Property};
+
+/// How deep dictionaries and arrays may nest before the parser gives up.
+const MAX_DEPTH: usize = 64;
+
+/// A value of the text dictionary.
+#[derive(Debug, Clone, PartialEq)]
+pub enum TextValue {
+    /// `<< ... >>`: keys in file order (a key is the name, string or number written before the value).
+    Dict(Vec<(String, TextValue)>),
+    /// `[ ... ]`
+    Array(Vec<TextValue>),
+    /// A string that starts with the UTF-16BE byte order mark, decoded.
+    Str(String),
+    /// A string without the byte order mark.
+    Bytes(Vec<u8>),
+    /// `/name`
+    Name(String),
+    Int(i64),
+    Float(f64),
+    Bool(bool),
+    /// Any other bare word.
+    Token(String),
+}
+
+impl TextValue {
+    /// The value of a dictionary key (the last one when a key repeats).
+    pub fn get(&self, key: &str) -> Option<&TextValue> {
+        match self {
+            Self::Dict(pairs) => pairs.iter().rev().find(|(k, _)| k == key).map(|(_, v)| v),
+            _ => None,
+        }
+    }
+
+    /// An array element.
+    pub fn at(&self, index: usize) -> Option<&TextValue> {
+        match self {
+            Self::Array(items) => items.get(index),
+            _ => None,
+        }
+    }
+
+    /// The text of a string value.
+    pub fn as_str(&self) -> Option<&str> {
+        match self {
+            Self::Str(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    /// An integer or float as `f64`.
+    pub fn as_f64(&self) -> Option<f64> {
+        match self {
+            Self::Int(i) => Some(*i as f64),
+            Self::Float(f) => Some(*f),
+            _ => None,
+        }
+    }
+
+    /// An integer value.
+    pub fn as_i64(&self) -> Option<i64> {
+        match self {
+            Self::Int(i) => Some(*i),
+            _ => None,
+        }
+    }
+
+    fn key_text(&self) -> String {
+        match self {
+            Self::Name(s) | Self::Str(s) | Self::Token(s) => s.clone(),
+            Self::Int(i) => i.to_string(),
+            Self::Float(f) => f.to_string(),
+            Self::Bool(b) => b.to_string(),
+            Self::Bytes(b) => text(b),
+            Self::Dict(_) | Self::Array(_) => String::new(),
+        }
+    }
+}
+
+struct Parser<'b> {
+    b: &'b [u8],
+    i: usize,
+}
+
+fn is_ws(c: u8) -> bool {
+    matches!(c, b' ' | b'\t' | b'\r' | b'\n')
+}
+
+fn is_delimiter(c: u8) -> bool {
+    is_ws(c) || matches!(c, b'/' | b'[' | b']' | b'<' | b'>' | b'(' | b')')
+}
+
+impl Parser<'_> {
+    fn peek(&self) -> Option<u8> {
+        self.b.get(self.i).copied()
+    }
+
+    fn skip_ws(&mut self) {
+        while self.peek().is_some_and(is_ws) {
+            self.i = self.i.saturating_add(1);
+        }
+    }
+
+    fn starts_with(&self, s: &[u8]) -> bool {
+        self.b.get(self.i..).is_some_and(|rest| rest.starts_with(s))
+    }
+
+    fn word(&mut self) -> &[u8] {
+        let start = self.i;
+        while self.peek().is_some_and(|c| !is_delimiter(c)) {
+            self.i = self.i.saturating_add(1);
+        }
+        self.b.get(start..self.i).unwrap_or(&[])
+    }
+
+    fn parse(&mut self, depth: usize) -> Option<TextValue> {
+        self.skip_ws();
+        if depth > MAX_DEPTH {
+            return None;
+        }
+        if self.starts_with(b"<<") {
+            self.i = self.i.saturating_add(2);
+            let mut pairs = Vec::new();
+            loop {
+                self.skip_ws();
+                if self.starts_with(b">>") {
+                    self.i = self.i.saturating_add(2);
+                    return Some(TextValue::Dict(pairs));
+                }
+                let key = self.parse(depth.saturating_add(1))?;
+                let value = self.parse(depth.saturating_add(1))?;
+                pairs.push((key.key_text(), value));
+            }
+        }
+        match self.peek()? {
+            b'[' => {
+                self.i = self.i.saturating_add(1);
+                let mut items = Vec::new();
+                loop {
+                    self.skip_ws();
+                    if self.peek()? == b']' {
+                        self.i = self.i.saturating_add(1);
+                        return Some(TextValue::Array(items));
+                    }
+                    items.push(self.parse(depth.saturating_add(1))?);
+                }
+            }
+            b'(' => {
+                self.i = self.i.saturating_add(1);
+                let mut out = Vec::new();
+                loop {
+                    let c = self.peek()?;
+                    if c == b'\\' {
+                        out.push(*self.b.get(self.i.saturating_add(1))?);
+                        self.i = self.i.saturating_add(2);
+                    } else if c == b')' {
+                        self.i = self.i.saturating_add(1);
+                        break;
+                    } else {
+                        out.push(c);
+                        self.i = self.i.saturating_add(1);
+                    }
+                }
+                Some(match out.strip_prefix(&[0xfe, 0xff]) {
+                    Some(utf16) => TextValue::Str(decode_utf16be(utf16)),
+                    None => TextValue::Bytes(out),
+                })
+            }
+            b'/' => {
+                self.i = self.i.saturating_add(1);
+                Some(TextValue::Name(text(self.word())))
+            }
+            _ => {
+                let word = self.word();
+                if word.is_empty() {
+                    return None;
+                }
+                let w = text(word);
+                Some(match w.as_str() {
+                    "true" => TextValue::Bool(true),
+                    "false" => TextValue::Bool(false),
+                    _ => match w.parse::<i64>() {
+                        Ok(i) => TextValue::Int(i),
+                        // `parse` also takes `nan`, `inf` and overflowing exponents; those are not
+                        // numbers a text document holds, so they stay tokens and read as missing.
+                        Err(_) => match w.parse::<f64>() {
+                            Ok(f) if f.is_finite() => TextValue::Float(f),
+                            _ => TextValue::Token(w),
+                        },
+                    },
+                })
+            }
+        }
+    }
+}
+
+fn decode_utf16be(bytes: &[u8]) -> String {
+    let (pairs, rest) = bytes.as_chunks::<2>();
+    let units = pairs.iter().map(|p| u16::from_be_bytes(*p));
+    let mut s: String = char::decode_utf16(units).map(|r| r.unwrap_or(char::REPLACEMENT_CHARACTER)).collect();
+    if !rest.is_empty() {
+        s.push(char::REPLACEMENT_CHARACTER);
+    }
+    s
+}
+
+/// Parses the body of a `btdk` list into its top-level `key value` pairs (as a [`TextValue::Dict`]).
+/// Parsing stops silently at the first syntax error or at nesting deeper than 64 levels; what was
+/// read before is returned.
+pub fn parse_text_dict(body: &[u8]) -> TextValue {
+    let mut parser = Parser { b: body, i: 0 };
+    let mut pairs = Vec::new();
+    loop {
+        parser.skip_ws();
+        if parser.i >= body.len() {
+            break;
+        }
+        let Some(key) = parser.parse(0) else { break };
+        let Some(value) = parser.parse(0) else { break };
+        pairs.push((key.key_text(), value));
+    }
+    TextValue::Dict(pairs)
+}
+
+/// The run style slots (`RUN/6/0[n]/0/0/6/<slot>`) that are decoded; every other slot is compared
+/// with its default (`style_defaults`) and listed in
+/// [`TextDocument::undecoded_style_fields`] when it differs.
+pub const DECODED_STYLE_SLOTS: &[&str] =
+    &["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "11", "12", "13", "18", "35", "36", "52", "53", "54", "56", "57", "58", "62", "63", "70"];
+
+/// The paragraph slots (`RUN/5/0[n]/0/0/5/<slot>`) that are decoded (see [`ParagraphRun`]).
+pub const DECODED_PARAGRAPH_SLOTS: &[&str] = &["0", "1", "2", "3", "4", "5", "8", "9", "21", "29", "33"];
+
+/// A number slot.
+fn val(v: f64) -> TextValue {
+    TextValue::Float(v)
+}
+
+fn dict(pairs: Vec<(&str, TextValue)>) -> TextValue {
+    TextValue::Dict(pairs.into_iter().map(|(k, v)| (k.to_string(), v)).collect())
+}
+
+fn numbers(v: &[f64]) -> TextValue {
+    TextValue::Array(v.iter().map(|x| val(*x)).collect())
+}
+
+/// The default of every run style slot that is not decoded and not neutral (zero, `false`,
+/// empty, `/nil`): the value an untouched point text holds in every sample (110, 243-245). A slot
+/// with a neutral default is left out; [`undecoded_fields`] treats a missing default as neutral.
+fn style_defaults() -> TextValue {
+    let paint = |a: f64| dict(vec![("99", TextValue::Name("SimplePaint".into())), ("0", dict(vec![("0", val(1.0)), ("1", numbers(&[1.0, 1.0, 1.0, a]))]))]);
+    let class = |name: &str| dict(vec![("99", TextValue::Name(name.into()))]);
+    dict(vec![
+        ("37", val(2.0)),
+        ("41", val(2.0)),
+        ("43", dict(vec![("0", val(0.5))])),
+        ("44", val(2.0)),
+        ("45", val(2.0)),
+        ("46", val(7.0)),
+        ("49", val(-1.0)),
+        ("50", val(-1.0)),
+        ("55", class("SimpleBlender")),
+        ("64", val(4.0)),
+        ("71", val(4.0)),
+        ("77", TextValue::Bool(true)),
+        ("78", TextValue::Bool(true)),
+        ("79", paint(0.0)),
+        ("82", val(3.0)),
+        ("83", val(3.0)),
+        ("86", class("SimpleCustomFeature")),
+        ("87", val(100.0)),
+        ("88", TextValue::Bool(true)),
+        ("95", dict(vec![("0", val(0.0)), ("1", val(0.0))])),
+        ("96", TextValue::Bool(true)),
+    ])
+}
+
+/// The same for the paragraph slots (110, 243-245).
+fn paragraph_defaults() -> TextValue {
+    dict(vec![
+        ("6", val(1.0)),
+        ("7", val(1.2)),
+        ("10", val(6.0)),
+        ("11", val(2.0)),
+        ("12", val(2.0)),
+        ("14", val(36.0)),
+        ("15", TextValue::Bool(true)),
+        ("16", val(0.5)),
+        ("17", numbers(&[0.8, 1.0, 1.33])),
+        ("18", numbers(&[0.0, 0.0, 0.0])),
+        ("19", numbers(&[1.0, 1.0, 1.0])),
+        ("20", val(6.0)),
+        ("22", val(1.0)),
+        ("23", TextValue::Bool(true)),
+        ("24", val(1.0)),
+        ("26", TextValue::Bool(true)),
+        ("31", val(36.0)),
+        ("35", val(1.0)),
+        ("40", val(2.0)),
+    ])
+}
+
+/// Equal values; numbers compare by value (`0` equals `0.0`).
+fn same(a: &TextValue, b: &TextValue) -> bool {
+    match (a, b) {
+        (TextValue::Dict(x), TextValue::Dict(y)) => x.len() == y.len() && x.iter().all(|(k, v)| y.iter().any(|(k2, v2)| k == k2 && same(v, v2))),
+        (TextValue::Array(x), TextValue::Array(y)) => x.len() == y.len() && x.iter().zip(y).all(|(p, q)| same(p, q)),
+        _ => match (a.as_f64(), b.as_f64()) {
+            (Some(p), Some(q)) => p == q,
+            _ => a == b,
+        },
+    }
+}
+
+/// A zero, `false`, empty or `/nil` value: a slot that the sampled documents do not have is only
+/// listed when it holds something else (a neutral value carries nothing that could be lost).
+/// `/nil` is how an untouched document stores a slot without a value (244: paragraph `/27`, `/28`,
+/// `/36`).
+fn is_neutral(v: &TextValue) -> bool {
+    match v {
+        TextValue::Name(n) => n == "nil",
+        TextValue::Bool(b) => !b,
+        TextValue::Array(a) => a.is_empty(),
+        TextValue::Dict(d) => d.is_empty(),
+        other => other.as_f64() == Some(0.0),
+    }
+}
+
+/// Paragraph slots whose meaning is not known but whose listed values lay text out alike, so they
+/// carry nothing to lose: `/34` is 0 in a scripted text and 7 after Reset Paragraph (727 changes
+/// only this slot), and a justified 600 px box text composes the same lines, baselines and bounds
+/// with both (S18). `/24` and `/35` are 1 in a scripted text; the wrapping box text 517 with `/24`
+/// or `/35` edited to 0 (732, 733) opens without a dialog, keeps the value on a re-save and lays
+/// out with the same four lines, baselines and bounds (S21).
+pub const NEUTRAL_PARAGRAPH_VALUES: &[(&str, &[i64])] = &[("24", &[0, 1]), ("34", &[0, 7]), ("35", &[0, 1])];
+
+/// Style slots of unknown meaning whose listed values lay text out alike: `/68` is 0 in a scripted
+/// text; 517 with `/68` edited to 1 (734) keeps it on a re-save and lays out and renders the same
+/// (S21).
+pub const NEUTRAL_STYLE_VALUES: &[(&str, &[i64])] = &[("68", &[0, 1])];
+
+/// The most undecoded slots recorded per text document (style and paragraph each). They are listed
+/// in one report line; a crafted dictionary with many thousands of distinct keys must neither make
+/// the duplicate check quadratic nor the line unbounded.
+pub const MAX_UNDECODED_FIELDS: usize = 64;
+
+/// Adds to `out` the slots of `actual` that are not decoded and differ from `sampled`, each once
+/// and at most [`MAX_UNDECODED_FIELDS`] in all.
+fn undecoded_fields(actual: &TextValue, sampled: Option<&TextValue>, decoded: &[&str], neutral: &[(&str, &[i64])], out: &mut Vec<String>) {
+    let TextValue::Dict(pairs) = actual else { return };
+    for (key, value) in pairs {
+        if out.len() >= MAX_UNDECODED_FIELDS {
+            return;
+        }
+        if decoded.contains(&key.as_str()) || out.contains(key) {
+            continue;
+        }
+        if neutral.iter().any(|(slot, values)| slot == key && value.as_i64().is_some_and(|v| values.contains(&v))) {
+            continue;
+        }
+        let differs = match sampled.and_then(|s| s.get(key)) {
+            Some(default) => !same(value, default),
+            None => !is_neutral(value),
+        };
+        if differs {
+            out.push(key.clone());
+        }
+    }
+}
+
+/// The verified fields of a layer's text document.
+#[derive(Debug, Clone, PartialEq)]
+pub struct TextDocument {
+    /// The text without the trailing paragraph terminators (`\r`).
+    pub text: String,
+    /// The text as stored (a trailing `\r` ends the paragraph).
+    pub raw_text: String,
+    /// The font size of the first style run (100 is the default).
+    pub font_size: f64,
+    /// The fill colour of the first style run as `[A, R, G, B]` floats 0..1.
+    pub fill_argb: [f64; 4],
+    /// The index of the first style run's font in the document's font list.
+    pub font_index: usize,
+    /// The font (PostScript name) of the first style run.
+    pub font: Option<String>,
+    /// The document's font list, in stored order (an entry whose name is unreadable is empty, so
+    /// the indices of the style runs stay valid). It always holds entries no run uses
+    /// (`Myriad-Roman`, `MyriadPro-Regular`, `AdobeInvisFont` in every sample).
+    pub fonts: Vec<String>,
+    /// The paragraph runs: one per paragraph, with its length in characters (including the
+    /// terminating `\r`) and its justification.
+    pub paragraphs: Vec<ParagraphRun>,
+    /// The style runs: consecutive characters with one style (a range style splits `Hello` into
+    /// runs of 1, 2 and 3 characters).
+    pub style_runs: Vec<StyleRun>,
+    /// The text box of paragraph (box) text; `None` for point text.
+    pub text_box: Option<TextBox>,
+    /// Style and paragraph runs that were damaged: a run without a readable length is left out, a
+    /// run with a missing size, fill or font index takes them from the run before it (the first
+    /// run from the sampled defaults).
+    pub incomplete_runs: usize,
+    /// Style slots that are not decoded and differ from the sampled default (`"68"`, ...), each
+    /// once and at most [`MAX_UNDECODED_FIELDS`]; empty for every synthetic sample.
+    pub undecoded_style_fields: Vec<String>,
+    /// Paragraph slots that are not decoded and differ from the sampled default.
+    pub undecoded_paragraph_fields: Vec<String>,
+    /// Manual kerning (`RUN/8/0`, 554): runs of characters with their kerning amount in 1/1000 em;
+    /// a run without an amount has none. Empty when no character is kerned by hand.
+    pub kerning: Vec<KernRun>,
+    /// The line orientation (`/0/8/0[0]/0/2/1`): absent for horizontal text (538), 2 for vertical
+    /// right to left (575).
+    pub line_orientation: Option<i64>,
+}
+
+/// Characters with one manual kerning amount.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct KernRun {
+    /// The number of characters.
+    pub length: usize,
+    /// The amount in 1/1000 em, `None` when the run is not kerned.
+    pub amount: Option<f64>,
+}
+
+/// The manual kerning list of a text run dictionary (`RUN/8/0`): entries `<< /0 << /0 amount >> /1
+/// length >>` (554 kerns each of `HHHH` by 50; the closing `\r` has an entry without an amount).
+fn kern_runs(run: &TextValue) -> Vec<KernRun> {
+    let Some(TextValue::Array(items)) = run.get("8").and_then(|v| v.get("0")) else { return Vec::new() };
+    let runs: Vec<KernRun> = items
+        .iter()
+        .filter_map(|e| {
+            let length = e.get("1").and_then(usize_of)?;
+            let amount = e.get("0").and_then(|v| v.get("0")).and_then(TextValue::as_f64).filter(|v| v.is_finite());
+            Some(KernRun { length, amount })
+        })
+        .collect();
+    if runs.iter().any(|r| r.amount.is_some_and(|a| a != 0.0)) { runs } else { Vec::new() }
+}
+
+/// The paragraph justification (`RUN/5/0[n]/0/0/5/0`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Justification {
+    /// `0`
+    Left,
+    /// `1` (334; the scripting enum value 7414 is not what is stored)
+    Right,
+    /// `2`
+    Center,
+    /// `3`: justified, last line left (565)
+    FullLeft,
+    /// `4`: justified, last line right (567)
+    FullRight,
+    /// `5`: justified, last line centred (566)
+    FullCenter,
+    /// `6`: justified, every line (568)
+    FullAll,
+    /// Any other value.
+    Other(i64),
+}
+
+/// A paragraph run. Besides the justification it carries the paragraph settings found with one
+/// change each against 538 (`RUN/5/0[n]/0/0/5/<slot>`); a missing slot gives the value of 538.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct ParagraphRun {
+    /// The number of characters including the `\r` that ends the paragraph.
+    pub length: usize,
+    pub justification: Justification,
+    /// First-line indent in pixels (`/1`, 560: 20).
+    pub first_line_indent: f64,
+    /// Start (left) indent in pixels (`/2`, 561: 30).
+    pub start_indent: f64,
+    /// End (right) indent in pixels (`/3`, 562: 40).
+    pub end_indent: f64,
+    /// Space before in pixels (`/4`, 563: 10).
+    pub space_before: f64,
+    /// Space after in pixels (`/5`, 564: 12).
+    pub space_after: f64,
+    /// The leading model (`/8`): 0 Roman, 1 Japanese (572).
+    pub leading_type: i64,
+    /// Automatic hyphenation (`/9`, on by default; 556 switches it off).
+    pub auto_hyphenate: bool,
+    /// Roman hanging punctuation (`/21`, 558).
+    pub hanging_roman: bool,
+    /// Every-line composer (`/29`: off by default, the single-line composer; 559 switches it on).
+    pub every_line_composer: bool,
+    /// The paragraph direction (`/33`): 0 left to right, 1 right to left (569).
+    pub direction: i64,
+}
+
+/// The capitalisation of a style run (`RUN/6/0[n]/0/0/6/12`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Caps {
+    /// `0`
+    Normal,
+    /// `1`
+    Small,
+    /// `2`
+    All,
+    /// Any other value.
+    Other(i64),
+}
+
+/// Superscript / subscript of a style run (`RUN/6/0[n]/0/0/6/13`; 526-528: 1 superscript, 0
+/// normal, 2 subscript). After Effects draws superscript and subscript at 58.3 % of the size, 33.3 %
+/// of the size above or below the baseline (`text.measure` and the layer bounds of 526-528).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FontBaseline {
+    /// `0`
+    Normal,
+    /// `1`
+    Superscript,
+    /// `2`
+    Subscript,
+    /// Any other value.
+    Other(i64),
+}
+
+/// Automatic kerning of a style run (`RUN/6/0[n]/0/0/6/11`; 542, 543). Manual kerning also stores
+/// `0` and keeps the amounts in [`TextDocument::kerning`] (554).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AutoKern {
+    /// `0`
+    None,
+    /// `1`, the default
+    Metrics,
+    /// `2`
+    Optical,
+    /// Any other value.
+    Other(i64),
+}
+
+/// A style run.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct StyleRun {
+    /// The number of characters in the run.
+    pub length: usize,
+    pub font_size: f64,
+    /// The fill colour as `[A, R, G, B]` floats 0..1.
+    pub fill_argb: [f64; 4],
+    /// The stroke colour as `[A, R, G, B]` (slot `/6/54`, same layout as the fill; white in every
+    /// sample). Whether the stroke is drawn and its width are not decoded.
+    pub stroke_argb: Option<[f64; 4]>,
+    /// The tracking (`RUN/6/0[n]/0/0/6/8`, 0 by default; 100 in the sample).
+    pub tracking: f64,
+    /// Faux bold (slot `/6/2`). Setting it also prepends a font-list entry and moves the style's
+    /// font index to 1 (335).
+    pub faux_bold: bool,
+    /// Faux italic (slot `/6/3`, 336).
+    pub faux_italic: bool,
+    /// All caps / small caps (slot `/6/12`; 337, 338).
+    pub caps: Caps,
+    /// Automatic leading (slot `/6/4`, 400): when it is set, lines advance by 1.2 x the size and
+    /// the stored [`StyleRun::leading`] is not used (400 stores 0.01 there).
+    pub auto_leading: bool,
+    /// The leading as stored (slot `/6/5`): the baseline-to-baseline distance in pixels when
+    /// [`StyleRun::auto_leading`] is off (243: the second line sits 98 px below the first; 339:
+    /// 60). `None` when the slot is missing.
+    pub leading: Option<f64>,
+    /// The index of the run's font in the document's font list (slot `/6/0`).
+    pub font_index: usize,
+    /// Superscript / subscript (slot `/6/13`); normal when the slot is missing.
+    pub baseline: FontBaseline,
+    /// Horizontal scale as a factor (slot `/6/6`, 1.0 by default; 539: 0.9).
+    pub horizontal_scale: f64,
+    /// Vertical scale as a factor (slot `/6/7`; 540: 1.5).
+    pub vertical_scale: f64,
+    /// Baseline shift in pixels (slot `/6/9`; 541: 41).
+    pub baseline_shift: f64,
+    /// Automatic kerning (slot `/6/11`).
+    pub auto_kern: AutoKern,
+    /// Standard ligatures (slot `/6/18`, off by default; 555).
+    pub ligatures: bool,
+    /// The baseline direction of vertical text (slot `/6/35`): 1 with the stream (default), 2
+    /// rotated (573), 3 across the stream, tate-chu-yoko (576).
+    pub baseline_direction: i64,
+    /// Tsume as a fraction (slot `/6/36`; 553: 0.5).
+    pub tsume: f64,
+    /// No break (slot `/6/52`; 552).
+    pub no_break: bool,
+    /// Whether the fill is drawn (slot `/6/56`, on by default; 546).
+    pub apply_fill: bool,
+    /// Whether the stroke is drawn (slot `/6/57`, off by default; 544).
+    pub apply_stroke: bool,
+    /// Stroke over fill (slot `/6/58`, on by default; 550 switches it off).
+    pub stroke_over_fill: bool,
+    /// The stroke line join (slot `/6/62`): 0 miter (default), 1 round (548).
+    pub line_join: i64,
+    /// The stroke width in pixels (slot `/6/63`, 1.0 by default; 545: 5).
+    pub stroke_width: f64,
+    /// The digit set (slot `/6/70`): 0 default, 1 Arabic (571), 2 Hindi (578).
+    pub digit_set: i64,
+}
+
+impl StyleRun {
+    /// The style of the sampled untouched document (244), used for a damaged first run.
+    pub(crate) const SAMPLED: StyleRun = StyleRun {
+        length: 0,
+        font_size: 100.0,
+        fill_argb: [1.0; 4],
+        stroke_argb: None,
+        tracking: 0.0,
+        faux_bold: false,
+        faux_italic: false,
+        caps: Caps::Normal,
+        auto_leading: false,
+        leading: Some(98.0),
+        font_index: 0,
+        // 244 itself is superscript (the character state the corpus was made in, 526); a damaged
+        // run falls back to the normal baseline.
+        baseline: FontBaseline::Normal,
+        horizontal_scale: 1.0,
+        vertical_scale: 1.0,
+        baseline_shift: 0.0,
+        auto_kern: AutoKern::Metrics,
+        ligatures: false,
+        baseline_direction: 1,
+        tsume: 0.0,
+        no_break: false,
+        apply_fill: true,
+        apply_stroke: false,
+        stroke_over_fill: true,
+        line_join: 0,
+        stroke_width: 1.0,
+        digit_set: 0,
+    };
+}
+
+/// The frame of paragraph (box) text: the box in layer space, as traced by the 16 points of the
+/// frame path.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct TextBox {
+    /// The top-left corner.
+    pub x: f64,
+    pub y: f64,
+    pub width: f64,
+    pub height: f64,
+}
+
+fn colour_of(style: &TextValue, slot: &str) -> Option<[f64; 4]> {
+    let c = style.get(slot)?.get("0")?.get("1")?;
+    Some([c.at(0)?.as_f64()?, c.at(1)?.as_f64()?, c.at(2)?.as_f64()?, c.at(3)?.as_f64()?])
+}
+
+fn usize_of(v: &TextValue) -> Option<usize> {
+    usize::try_from(v.as_i64()?).ok()
+}
+
+/// A finite number slot of a style, `default` when it is missing or not a finite number.
+fn num(style: &TextValue, slot: &str, default: f64) -> f64 {
+    style.get(slot).and_then(TextValue::as_f64).filter(|v| v.is_finite()).unwrap_or(default)
+}
+
+/// A boolean slot of a style, `default` when it is missing or not a boolean.
+fn flag(style: &TextValue, slot: &str, default: bool) -> bool {
+    match style.get(slot) {
+        Some(TextValue::Bool(b)) => *b,
+        _ => default,
+    }
+}
+
+/// What the run lists of one document collect besides the runs.
+#[derive(Default)]
+struct RunNotes {
+    incomplete: usize,
+    style_fields: Vec<String>,
+    paragraph_fields: Vec<String>,
+}
+
+/// The paragraph runs of a text run dictionary (`RUN/5/0`).
+fn paragraph_runs(run: &TextValue, notes: &mut RunNotes) -> Vec<ParagraphRun> {
+    let Some(TextValue::Array(items)) = run.get("5").and_then(|v| v.get("0")) else { return Vec::new() };
+    let sampled = Some(paragraph_defaults());
+    let mut out: Vec<ParagraphRun> = Vec::with_capacity(items.len());
+    for e in items {
+        let Some(length) = e.get("1").and_then(usize_of) else {
+            notes.incomplete = notes.incomplete.saturating_add(1);
+            continue;
+        };
+        let para = e.get("0").and_then(|v| v.get("0")).and_then(|v| v.get("5"));
+        let justification = match para.and_then(|p| p.get("0")).and_then(TextValue::as_i64) {
+            Some(0) => Justification::Left,
+            Some(1) => Justification::Right,
+            Some(2) => Justification::Center,
+            Some(3) => Justification::FullLeft,
+            Some(4) => Justification::FullRight,
+            Some(5) => Justification::FullCenter,
+            Some(6) => Justification::FullAll,
+            Some(other) => Justification::Other(other),
+            None => {
+                notes.incomplete = notes.incomplete.saturating_add(1);
+                out.last().map_or(Justification::Left, |p| p.justification)
+            }
+        };
+        if let Some(p) = para {
+            undecoded_fields(p, sampled.as_ref(), DECODED_PARAGRAPH_SLOTS, NEUTRAL_PARAGRAPH_VALUES, &mut notes.paragraph_fields);
+        }
+        let num = |slot: &str| para.and_then(|p| p.get(slot)).and_then(TextValue::as_f64).filter(|v| v.is_finite()).unwrap_or(0.0);
+        let int = |slot: &str, default: i64| para.and_then(|p| p.get(slot)).and_then(TextValue::as_i64).unwrap_or(default);
+        let flag = |slot: &str, default: bool| match para.and_then(|p| p.get(slot)) {
+            Some(TextValue::Bool(b)) => *b,
+            _ => default,
+        };
+        out.push(ParagraphRun {
+            length,
+            justification,
+            first_line_indent: num("1"),
+            start_indent: num("2"),
+            end_indent: num("3"),
+            space_before: num("4"),
+            space_after: num("5"),
+            leading_type: int("8", 0),
+            auto_hyphenate: flag("9", true),
+            hanging_roman: flag("21", false),
+            every_line_composer: flag("29", false),
+            direction: int("33", 0),
+        });
+    }
+    out
+}
+
+/// The style runs of a text run dictionary (`RUN/6/0`).
+fn style_runs(run: &TextValue, notes: &mut RunNotes) -> Vec<StyleRun> {
+    let Some(TextValue::Array(items)) = run.get("6").and_then(|v| v.get("0")) else { return Vec::new() };
+    let sampled = Some(style_defaults());
+    let mut out: Vec<StyleRun> = Vec::with_capacity(items.len());
+    for e in items {
+        let Some(length) = e.get("1").and_then(usize_of) else {
+            notes.incomplete = notes.incomplete.saturating_add(1);
+            continue;
+        };
+        let prev = out.last().copied().unwrap_or(StyleRun::SAMPLED);
+        let Some(style) = e.get("0").and_then(|v| v.get("0")).and_then(|v| v.get("6")) else {
+            notes.incomplete = notes.incomplete.saturating_add(1);
+            out.push(StyleRun { length, ..prev });
+            continue;
+        };
+        let font_size = style.get("1").and_then(TextValue::as_f64);
+        let fill_argb = colour_of(style, "53");
+        let font_index = style.get("0").and_then(usize_of);
+        if font_size.is_none() || fill_argb.is_none() || font_index.is_none() {
+            notes.incomplete = notes.incomplete.saturating_add(1);
+        }
+        undecoded_fields(style, sampled.as_ref(), DECODED_STYLE_SLOTS, NEUTRAL_STYLE_VALUES, &mut notes.style_fields);
+        out.push(StyleRun {
+            length,
+            font_size: font_size.unwrap_or(prev.font_size),
+            fill_argb: fill_argb.unwrap_or(prev.fill_argb),
+            stroke_argb: colour_of(style, "54"),
+            tracking: style.get("8").and_then(TextValue::as_f64).unwrap_or(0.0),
+            faux_bold: matches!(style.get("2"), Some(TextValue::Bool(true))),
+            faux_italic: matches!(style.get("3"), Some(TextValue::Bool(true))),
+            caps: match style.get("12").and_then(TextValue::as_i64) {
+                None | Some(0) => Caps::Normal,
+                Some(1) => Caps::Small,
+                Some(2) => Caps::All,
+                Some(other) => Caps::Other(other),
+            },
+            auto_leading: matches!(style.get("4"), Some(TextValue::Bool(true))),
+            leading: style.get("5").and_then(TextValue::as_f64),
+            font_index: font_index.unwrap_or(prev.font_index),
+            baseline: match style.get("13").and_then(TextValue::as_i64) {
+                None | Some(0) => FontBaseline::Normal,
+                Some(1) => FontBaseline::Superscript,
+                Some(2) => FontBaseline::Subscript,
+                Some(other) => FontBaseline::Other(other),
+            },
+            horizontal_scale: num(style, "6", 1.0),
+            vertical_scale: num(style, "7", 1.0),
+            baseline_shift: num(style, "9", 0.0),
+            auto_kern: match style.get("11").and_then(TextValue::as_i64) {
+                Some(0) => AutoKern::None,
+                None | Some(1) => AutoKern::Metrics,
+                Some(2) => AutoKern::Optical,
+                Some(other) => AutoKern::Other(other),
+            },
+            ligatures: flag(style, "18", false),
+            baseline_direction: style.get("35").and_then(TextValue::as_i64).unwrap_or(1),
+            tsume: num(style, "36", 0.0),
+            no_break: flag(style, "52", false),
+            apply_fill: flag(style, "56", true),
+            apply_stroke: flag(style, "57", false),
+            stroke_over_fill: flag(style, "58", true),
+            line_join: style.get("62").and_then(TextValue::as_i64).unwrap_or(0),
+            stroke_width: num(style, "63", 1.0),
+            digit_set: style.get("70").and_then(TextValue::as_i64).unwrap_or(0),
+        });
+    }
+    out
+}
+
+/// The box of paragraph text from the frame dictionary `/0/8/0[0]/0`: key `/1/0` holds 16 x, y pairs
+/// that trace the rectangle, and `/2/0` is 1; both keys are absent for point text.
+fn text_box(top: &TextValue) -> Option<TextBox> {
+    let frame = top.get("0")?.get("8")?.get("0")?.at(0)?.get("0")?;
+    if frame.get("2")?.get("0")?.as_i64()? != 1 {
+        return None;
+    }
+    let TextValue::Array(coords) = frame.get("1")?.get("0")? else { return None };
+    let numbers: Vec<f64> = coords.iter().map(TextValue::as_f64).collect::<Option<_>>()?;
+    let (pairs, _) = numbers.as_chunks::<2>();
+    if pairs.is_empty() {
+        return None;
+    }
+    let min = |f: fn(&[f64; 2]) -> f64| pairs.iter().map(f).fold(f64::INFINITY, f64::min);
+    let max = |f: fn(&[f64; 2]) -> f64| pairs.iter().map(f).fold(f64::NEG_INFINITY, f64::max);
+    let (x, y) = (min(|p| p[0]), min(|p| p[1]));
+    Some(TextBox { x, y, width: max(|p| p[0]) - x, height: max(|p| p[1]) - y })
+}
+
+impl TextDocument {
+    /// Decodes the body of a `btdk` list.
+    pub fn parse(body: &[u8]) -> Option<Self> {
+        let top = parse_text_dict(body);
+        let run = top.get("1")?.get("1")?.at(0)?.get("0")?;
+        let raw_text = run.get("0")?.as_str()?.to_string();
+        let style = run.get("6")?.get("0")?.at(0)?.get("0")?.get("0")?.get("6")?;
+        let fill_argb = colour_of(style, "53")?;
+        let font_index = usize::try_from(style.get("0")?.as_i64()?).ok()?;
+        let mut fonts = Vec::new();
+        if let Some(TextValue::Array(list)) = top.get("0").and_then(|v| v.get("1")).and_then(|v| v.get("0")) {
+            fonts = list
+                .iter()
+                .map(|f| f.get("0").and_then(|v| v.get("0")).and_then(|v| v.get("0")).and_then(TextValue::as_str).unwrap_or_default().to_string())
+                .collect();
+        }
+        let mut notes = RunNotes::default();
+        let paragraphs = paragraph_runs(run, &mut notes);
+        let style_runs = style_runs(run, &mut notes);
+        Some(Self {
+            text: raw_text.trim_end_matches('\r').to_string(),
+            raw_text,
+            font_size: style.get("1")?.as_f64()?,
+            fill_argb,
+            font_index,
+            font: fonts.get(font_index).filter(|f| !f.is_empty()).cloned(),
+            fonts,
+            paragraphs,
+            style_runs,
+            text_box: text_box(&top),
+            incomplete_runs: notes.incomplete,
+            undecoded_style_fields: notes.style_fields,
+            undecoded_paragraph_fields: notes.paragraph_fields,
+            kerning: kern_runs(run),
+            line_orientation: top
+                .get("0")
+                .and_then(|v| v.get("8"))
+                .and_then(|v| v.get("0"))
+                .and_then(|v| v.at(0))
+                .and_then(|v| v.get("0"))
+                .and_then(|v| v.get("2"))
+                .and_then(|v| v.get("1"))
+                .and_then(TextValue::as_i64),
+        })
+    }
+
+    /// The paragraphs: the stored text split at `\r`, each without its terminator. `A\rB` is stored
+    /// as `A\rB\r` and gives `["A", "B"]`.
+    pub fn paragraph_texts(&self) -> Vec<&str> {
+        self.raw_text.strip_suffix('\r').unwrap_or(&self.raw_text).split('\r').collect()
+    }
+
+    /// The fill colour as `[R, G, B]`.
+    pub fn fill_rgb(&self) -> [f64; 3] {
+        let [_, r, g, b] = self.fill_argb;
+        [r, g, b]
+    }
+
+    /// The font (PostScript name) of a style run; `None` when its index is outside the font list or
+    /// the entry's name is unreadable.
+    pub fn font_of(&self, run: &StyleRun) -> Option<&str> {
+        self.fonts.get(run.font_index).map(String::as_str).filter(|f| !f.is_empty())
+    }
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The text document of a text layer (`LIST btdk` below `ADBE Text Properties`).
+    pub fn text_document(&self) -> Option<TextDocument> {
+        TextDocument::parse(self.chunk.find_list(b"btdk")?.bytes()?)
+    }
+
+    /// The Source Text property record: the `tdbs` in `btds[ADBE Text Document]` (a placeholder
+    /// in every sample: no keys, no expression). Source Text keyframes and expressions were not
+    /// sampled; a `list` (keys) or an expression in it marks them.
+    pub fn source_text_property(&self) -> Option<Property<'f, 'a>> {
+        let btds = self.chunk.descendants().map(|(_, c)| c).find(|c| c.is_list(b"btds"))?;
+        Property::from_chunk(btds.child_list(b"tdbs")?)
+    }
+
+    /// The number of text documents (`LIST btdk`) of the layer: 1 in every sample; more would be
+    /// one per Source Text keyframe (not sampled).
+    pub fn text_document_count(&self) -> usize {
+        self.chunk.descendants().filter(|(_, c)| c.is_list(b"btdk")).count()
+    }
+}
+
+/// A marker with its comment.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct Marker {
+    /// The time in the property's time units (layer time for layer markers).
+    pub time_units: i32,
+    /// The time in seconds.
+    pub seconds: Option<f64>,
+    /// The comment (the first of the marker's `Utf8` strings).
+    pub comment: String,
+    /// The duration in seconds (`NmHd`: the `u32` at byte 8 counts 1/600 s, the `u32` at byte 12
+    /// is that 600); 0 for a marker without duration.
+    pub duration_seconds: Option<f64>,
+    /// The chapter (second string).
+    pub chapter: String,
+    /// The URL (third string).
+    pub url: String,
+    /// The frame target (fourth string).
+    pub frame_target: String,
+    /// The cue point name (fifth string).
+    pub cue_point_name: String,
+    /// The label colour index (`NmHd` byte 16; 3 in 347, 0 by default). It is not in the keyframe
+    /// flags.
+    pub label: Option<u8>,
+    /// The cue type (`NmHd` `u32` at byte 0).
+    pub cue_type: Option<CueType>,
+    /// The cue point parameters: key and value strings that follow the five fixed strings (the
+    /// count is the `u32` at byte 4 of `NmHd`).
+    pub cue_params: Vec<(String, String)>,
+}
+
+/// The cue point type of a marker (`NmHd` `u32` at byte 0).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CueType {
+    /// `4`: an event cue (also for markers without a cue point name).
+    Event,
+    /// `5`: a navigation cue.
+    Navigation,
+    /// Any other value.
+    Other(u32),
+}
+
+/// Reads the markers below `holder` (a layer or the composition's `SecL` list): the `mrst` list has a
+/// property whose 16-byte records give the times and one `Nmrd` list per marker with the strings.
+fn markers_in(holder: &Chunk<'_>) -> Vec<Marker> {
+    let Some(mrst) = holder.find_list(b"mrst") else { return Vec::new() };
+    let Some(prop) = mrst.child_list(b"tdbs").and_then(Property::from_chunk) else { return Vec::new() };
+    let Some(keys) = prop.keys() else { return Vec::new() };
+    let scale = prop.time_scale().unwrap_or(0);
+    let details = mrst.descendants().map(|(_, c)| c).filter(|c| c.is_list(b"Nmrd"));
+    keys.keyframes()
+        .zip(details)
+        .filter_map(|(k, nmrd)| {
+            let time_units = k.time_units()?;
+            // The five strings, in the order comment, chapter, URL, frame target, cue point name.
+            let mut strings = nmrd.children().iter().filter(|c| c.is(b"Utf8")).map(|c| c.bytes().map(text).unwrap_or_default());
+            let mut next = || strings.next().unwrap_or_default();
+            let (comment, chapter, url, frame_target, cue_point_name) = (next(), next(), next(), next(), next());
+            let extras: Vec<String> = strings.collect();
+            let header = nmrd.child(b"NmHd").and_then(Chunk::bytes);
+            let duration_seconds = header.and_then(|h| {
+                let (duration, per_second) = (be_u32(h, 8)?, be_u32(h, 12)?);
+                (per_second != 0).then(|| f64::from(duration) / f64::from(per_second))
+            });
+            let pairs = header.and_then(|h| be_u32(h, 4)).and_then(|n| usize::try_from(n).ok()).unwrap_or(0);
+            let cue_params = extras.as_chunks::<2>().0.iter().take(pairs).map(|[k, v]| (k.clone(), v.clone())).collect();
+            let cue_type = header.and_then(|h| be_u32(h, 0)).map(|t| match t {
+                4 => CueType::Event,
+                5 => CueType::Navigation,
+                other => CueType::Other(other),
+            });
+            Some(Marker {
+                time_units,
+                seconds: k.seconds(scale),
+                comment,
+                duration_seconds,
+                chapter,
+                url,
+                frame_target,
+                cue_point_name,
+                label: header.and_then(|h| h.get(16).copied()),
+                cue_type,
+                cue_params,
+            })
+        })
+        .collect()
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The layer's markers (`mrst`), in time order.
+    pub fn markers(&self) -> Vec<Marker> {
+        markers_in(self.chunk)
+    }
+}
+
+impl<'f, 'a> Comp<'f, 'a> {
+    /// The composition's markers: they live in the `SecL` list named "Markers".
+    pub fn markers(&self) -> Vec<Marker> {
+        self.item.child_list(b"SecL").map(markers_in).unwrap_or_default()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn non_finite_numbers_are_not_numbers() {
+        let TextValue::Dict(pairs) = parse_text_dict(b"/1 inf /2 nan /3 1e999 /4 -inf /5 2.5 /6 7") else { panic!("a dict") };
+        let numbers: Vec<Option<f64>> = pairs.iter().map(|(_, v)| v.as_f64()).collect();
+        assert_eq!(numbers, [None, None, None, None, Some(2.5), Some(7.0)]);
+    }
+
+    #[test]
+    fn undecoded_fields_are_capped_and_linear() {
+        // 300 000 distinct undecoded slots that differ from a sampled default: before, each was
+        // checked against every slot recorded so far (4.5e10 compares) and all were listed.
+        let actual = TextValue::Dict((0..300_000).map(|i| (format!("{}", 9000 + i), TextValue::Int(1))).collect());
+        let mut out = Vec::new();
+        undecoded_fields(&actual, None, &["0"], &[], &mut out);
+        assert_eq!(out.len(), MAX_UNDECODED_FIELDS);
+        assert_eq!(out.first().map(String::as_str), Some("9000"));
+        // A slot listed once is not listed again.
+        let again = TextValue::Dict(vec![("9000".into(), TextValue::Int(1))]);
+        let mut short = vec!["9000".to_string()];
+        undecoded_fields(&again, None, &[], &[], &mut short);
+        assert_eq!(short, ["9000"]);
+    }
+}
diff --git a/crates/aep/src/container/typed.rs b/crates/aep/src/container/typed.rs
new file mode 100644
index 000000000..a61c69090
--- /dev/null
+++ b/crates/aep/src/container/typed.rs
@@ -0,0 +1,539 @@
+//! A small typed view over the chunk tree: project items, compositions, layers, the property
+//! tree and keyframe lists. The field decoders for headers, values, keyframes, effects, masks, text,
+//! markers and footage are in the sibling modules and extend these types.
+//!
+//! Only facts that were established from our own one-change-per-file corpus and are checked by
+//! tests against it are decoded (see `docs/aep-format.md` for the evidence). Everything else
+//! stays reachable through the raw [`Chunk`] tree. Views borrow the file and never fail loudly:
+//! a chunk that does not have the expected shape yields `None` or is skipped.
+
+use crate::container::bytes::{be_f64, be_u16, be_u32, text, until_nul};
+use crate::container::chunk::{AepFile, Chunk};
+
+/// The name a user gave a property or group: the `Utf8` inside its `tdsn` chunk. `None` for the
+/// sentinel `-_0_/-` ("no custom name") and for empty names.
+pub(crate) fn user_name(chunk: &Chunk<'_>) -> Option<String> {
+    let name = chunk.child(b"tdsn")?.children().iter().find(|c| c.is(b"Utf8"))?.bytes().map(text)?;
+    (!name.is_empty() && name != "-_0_/-").then_some(name)
+}
+
+/// The content of a `Utf8` child as text (not trimmed).
+pub(crate) fn utf8_child(chunk: &Chunk<'_>) -> Option<String> {
+    chunk.child(b"Utf8").and_then(Chunk::bytes).map(text)
+}
+
+/// The project: the top-level `LIST Fold`, which holds the project items.
+#[derive(Debug, Clone, Copy)]
+pub struct Project<'f, 'a> {
+    pub(crate) fold: &'f Chunk<'a>,
+    /// The top-level `LIST EfdG` (project-level effect definitions), when there is one.
+    pub(crate) effect_defs: Option<&'f Chunk<'a>>,
+}
+
+impl<'f, 'a> Project<'f, 'a> {
+    /// The project view of a file, or `None` when it has no `LIST Fold`.
+    pub fn new(file: &'f AepFile<'a>) -> Option<Self> {
+        file.list(b"Fold").map(|fold| Self { fold, effect_defs: file.list(b"EfdG") })
+    }
+
+    /// The top-level items (the project panel's root; folders hold their children, see
+    /// [`Item::children`]).
+    pub fn items(&self) -> impl Iterator<Item = Item<'f, 'a>> + 'f {
+        self.fold.children().iter().filter(|c| c.is_list(b"Item")).map(|chunk| Item { chunk })
+    }
+
+    /// True when the `LIST Fold` could not be read as chunks (damaged): its items cannot be seen.
+    pub fn items_unreadable(&self) -> bool {
+        self.fold.is_opaque_list()
+    }
+
+    /// Every item including those inside folders, depth-first, without recursion.
+    pub fn all_items(&self) -> Vec<Item<'f, 'a>> {
+        let mut out = Vec::new();
+        let mut stack: Vec<Item<'f, 'a>> = self.items().collect();
+        stack.reverse();
+        while let Some(item) = stack.pop() {
+            let mut kids: Vec<Item<'f, 'a>> = item.children().collect();
+            kids.reverse();
+            out.push(item);
+            stack.extend(kids);
+        }
+        out
+    }
+}
+
+/// What a project item is (the first 16-bit word of its `idta` chunk).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ItemKind {
+    /// `1`
+    Folder,
+    /// `4`
+    Composition,
+    /// `7`
+    Footage,
+    /// Any other value.
+    Other(u16),
+}
+
+/// A project item (`LIST Item`).
+#[derive(Debug, Clone, Copy)]
+pub struct Item<'f, 'a> {
+    pub(crate) chunk: &'f Chunk<'a>,
+}
+
+impl<'f, 'a> Item<'f, 'a> {
+    /// The underlying chunk.
+    pub fn chunk(&self) -> &'f Chunk<'a> {
+        self.chunk
+    }
+
+    /// The item kind, from `idta`.
+    pub fn kind(&self) -> Option<ItemKind> {
+        let idta = self.chunk.child(b"idta")?.bytes()?;
+        Some(match be_u16(idta, 0)? {
+            1 => ItemKind::Folder,
+            4 => ItemKind::Composition,
+            7 => ItemKind::Footage,
+            other => ItemKind::Other(other),
+        })
+    }
+
+    /// The item name (the `Utf8` child). `None` when absent or empty: a solid's footage item
+    /// stores no name there.
+    pub fn name(&self) -> Option<String> {
+        utf8_child(self.chunk).filter(|n| !n.is_empty())
+    }
+
+    /// The items inside a folder (`LIST Sfdr`).
+    pub fn children(&self) -> impl Iterator<Item = Item<'f, 'a>> + 'f {
+        self.chunk.child_list(b"Sfdr").into_iter().flat_map(|sfdr| sfdr.children().iter()).filter(|c| c.is_list(b"Item")).map(|chunk| Item { chunk })
+    }
+
+    /// Whether the item has the `LIST Sfdr` of a folder's contents (After Effects writes an empty
+    /// one for an empty folder).
+    pub fn has_folder_contents(&self) -> bool {
+        self.chunk.child_list(b"Sfdr").is_some()
+    }
+
+    /// True when the folder's `LIST Sfdr` is there but could not be read as chunks (damaged).
+    pub fn folder_contents_unreadable(&self) -> bool {
+        self.chunk.child_list(b"Sfdr").is_some_and(Chunk::is_opaque_list)
+    }
+
+    /// The composition view when this item has composition data (`cdta`).
+    pub fn comp(&self) -> Option<Comp<'f, 'a>> {
+        self.chunk.child(b"cdta").map(|_| Comp { item: self.chunk })
+    }
+}
+
+/// The time base of a composition: one frame lasts `frame_duration` units and a second has
+/// `timescale` units. Keyframe times are counted in these units.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TimeBase {
+    pub frame_duration: u32,
+    pub timescale: u32,
+}
+
+impl TimeBase {
+    /// Frames per second (`timescale / frame_duration`), `None` for a zero duration.
+    pub fn frame_rate(&self) -> Option<f64> {
+        (self.frame_duration != 0).then(|| f64::from(self.timescale) / f64::from(self.frame_duration))
+    }
+
+    /// Converts time units to seconds, `None` for a zero timescale.
+    pub fn seconds(&self, units: i32) -> Option<f64> {
+        (self.timescale != 0).then(|| f64::from(units) / f64::from(self.timescale))
+    }
+}
+
+/// A composition item (an [`Item`] with `cdta`).
+#[derive(Debug, Clone, Copy)]
+pub struct Comp<'f, 'a> {
+    pub(crate) item: &'f Chunk<'a>,
+}
+
+impl<'f, 'a> Comp<'f, 'a> {
+    /// The time base from `cdta` (`u32` at byte 4 is the frame duration, `u32` at byte 8 the
+    /// timescale).
+    pub fn time_base(&self) -> Option<TimeBase> {
+        let cdta = self.item.child(b"cdta")?.bytes()?;
+        Some(TimeBase { frame_duration: be_u32(cdta, 4)?, timescale: be_u32(cdta, 8)? })
+    }
+
+    /// The layers, top layer first (`LIST Layr`; the `DLay`/`SLay`/`CLay`/`SecL` lists next to
+    /// them are not layers).
+    pub fn layers(&self) -> impl Iterator<Item = Layer<'f, 'a>> + 'f {
+        self.item.children().iter().filter(|c| c.is_list(b"Layr")).map(|chunk| Layer { chunk })
+    }
+}
+
+/// A layer (`LIST Layr`).
+#[derive(Debug, Clone, Copy)]
+pub struct Layer<'f, 'a> {
+    pub(crate) chunk: &'f Chunk<'a>,
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The underlying chunk.
+    pub fn chunk(&self) -> &'f Chunk<'a> {
+        self.chunk
+    }
+
+    /// The layer name when it was set (the `Utf8` child); `None` when empty, in which case the
+    /// layer shows its source's name.
+    pub fn name(&self) -> Option<String> {
+        utf8_child(self.chunk).filter(|n| !n.is_empty())
+    }
+
+    /// The 3D layer switch: bit `0x04` of byte 38 of `ldta`.
+    pub fn is_three_d(&self) -> Option<bool> {
+        let ldta = self.chunk.child(b"ldta")?.bytes()?;
+        Some(ldta.get(38)? & 0x04 != 0)
+    }
+
+    /// The root of the layer's property tree.
+    pub fn properties(&self) -> Option<PropGroup<'f, 'a>> {
+        self.chunk.child_list(b"tdgp").map(|chunk| PropGroup { chunk })
+    }
+}
+
+/// A node of the property tree.
+#[derive(Debug, Clone, Copy)]
+pub enum PropNode<'f, 'a> {
+    /// A property group (`LIST tdgp`).
+    Group(PropGroup<'f, 'a>),
+    /// A property (`LIST tdbs`).
+    Property(Property<'f, 'a>),
+    /// Any other list that follows a match name (observed: `otst`, the effect instance `sspc`).
+    Other(&'f Chunk<'a>),
+}
+
+impl<'f, 'a> PropNode<'f, 'a> {
+    /// The node a `LIST` after a match name is.
+    fn of(c: &'f Chunk<'a>) -> Self {
+        if c.is_list(b"tdgp") {
+            PropNode::Group(PropGroup { chunk: c })
+        } else if c.is_list(b"tdbs") {
+            PropNode::Property(Property { chunk: c })
+        } else {
+            PropNode::Other(c)
+        }
+    }
+}
+
+/// A match name with the node it names.
+#[derive(Debug, Clone)]
+pub struct PropEntry<'f, 'a> {
+    pub match_name: String,
+    pub node: PropNode<'f, 'a>,
+}
+
+/// A property group (`LIST tdgp`): after its `tdsb` and `tdsn` chunks come pairs of a `tdmn`
+/// (the 40-byte NUL-padded ASCII match name) and the list it names; a `tdmn` named
+/// `ADBE Group End` closes the group and names nothing.
+#[derive(Debug, Clone, Copy)]
+pub struct PropGroup<'f, 'a> {
+    pub(crate) chunk: &'f Chunk<'a>,
+}
+
+impl<'f, 'a> PropGroup<'f, 'a> {
+    /// A group view of a `LIST tdgp` chunk.
+    pub fn from_chunk(chunk: &'f Chunk<'a>) -> Option<Self> {
+        chunk.is_list(b"tdgp").then_some(Self { chunk })
+    }
+
+    /// The underlying chunk.
+    pub fn chunk(&self) -> &'f Chunk<'a> {
+        self.chunk
+    }
+
+    /// The name the user gave the group (e.g. `Mask 1`, `Group 1`); `None` when it has none.
+    pub fn user_name(&self) -> Option<String> {
+        user_name(self.chunk)
+    }
+
+    /// The group's flags (`tdsb`, a `u32`).
+    pub fn flags(&self) -> Option<u32> {
+        be_u32(self.chunk.child(b"tdsb")?.bytes()?, 0)
+    }
+
+    /// The entries in file order.
+    pub fn entries(&self) -> Vec<PropEntry<'f, 'a>> {
+        let mut out = Vec::new();
+        let mut pending: Option<String> = None;
+        for c in self.chunk.children() {
+            if c.is(b"tdmn") {
+                pending = c.bytes().map(match_name);
+            } else if c.id == crate::container::chunk::LIST
+                && let Some(name) = pending.take()
+            {
+                out.push(PropEntry { match_name: name, node: PropNode::of(c) });
+            }
+        }
+        out
+    }
+
+    /// The match names of the entries, in file order.
+    pub fn names(&self) -> Vec<String> {
+        self.entries().into_iter().map(|e| e.match_name).collect()
+    }
+
+    /// The first entry with this match name. One pass that stops at it, without collecting the
+    /// group's entries (callers look names up in loops).
+    pub fn get(&self, name: &str) -> Option<PropNode<'f, 'a>> {
+        let mut pending: Option<&[u8]> = None;
+        for c in self.chunk.children() {
+            if c.is(b"tdmn") {
+                pending = c.bytes();
+            } else if c.id == crate::container::chunk::LIST
+                && let Some(body) = pending.take()
+                && match_name(body) == name
+            {
+                return Some(PropNode::of(c));
+            }
+        }
+        None
+    }
+
+    /// Follows a path of match names through nested groups.
+    pub fn find(&self, path: &[&str]) -> Option<PropNode<'f, 'a>> {
+        let (first, rest) = path.split_first()?;
+        let node = self.get(first)?;
+        if rest.is_empty() {
+            return Some(node);
+        }
+        match node {
+            PropNode::Group(g) => g.find(rest),
+            PropNode::Property(_) | PropNode::Other(_) => None,
+        }
+    }
+}
+
+/// The match name in a `tdmn` body: ASCII up to the first NUL.
+fn match_name(body: &[u8]) -> String {
+    text(until_nul(body))
+}
+
+/// A property (`LIST tdbs`): `tdsb`, `tdsn`, the 124-byte header `tdb4`, then either the static
+/// value `cdat` or a keyframe `LIST list`.
+#[derive(Debug, Clone, Copy)]
+pub struct Property<'f, 'a> {
+    pub(crate) chunk: &'f Chunk<'a>,
+}
+
+impl<'f, 'a> Property<'f, 'a> {
+    /// A property view of a `LIST tdbs` chunk.
+    pub fn from_chunk(chunk: &'f Chunk<'a>) -> Option<Self> {
+        chunk.is_list(b"tdbs").then_some(Self { chunk })
+    }
+
+    /// The underlying chunk.
+    pub fn chunk(&self) -> &'f Chunk<'a> {
+        self.chunk
+    }
+
+    /// The name the user gave the property; `None` when it has none.
+    pub fn user_name(&self) -> Option<String> {
+        user_name(self.chunk)
+    }
+
+    /// The raw 124-byte `tdb4` header.
+    pub fn header(&self) -> Option<&'f [u8]> {
+        self.chunk.child(b"tdb4")?.bytes()
+    }
+
+    /// The number of value components: byte 3 of `tdb4`.
+    pub fn dims(&self) -> Option<u8> {
+        self.header()?.get(3).copied()
+    }
+
+    /// True when the property has keyframes, i.e. its value is a `LIST list` instead of `cdat`.
+    /// `tdb4` byte 68 is 1 in exactly these properties.
+    pub fn is_animated(&self) -> bool {
+        self.chunk.child_list(b"list").is_some()
+    }
+
+    /// The static value: the first `dims` big-endian `f64` of `cdat`. `None` for animated
+    /// properties and for values that are not `f64` arrays.
+    pub fn static_value(&self) -> Option<Vec<f64>> {
+        let dims = usize::from(self.dims()?);
+        let cdat = self.chunk.child(b"cdat")?.bytes()?;
+        (0..dims).map(|i| be_f64(cdat, i.checked_mul(8)?)).collect()
+    }
+
+    /// The keyframe list of an animated property, with the record layout the property header
+    /// selects (`tdb4` byte 3 = components, byte 7 non-zero = spatial template, unless the record
+    /// size tells).
+    pub fn keys(&self) -> Option<KeyList<'f>> {
+        let list = KeyList::from_chunk(self.chunk.child_list(b"list")?)?;
+        let header = self.header();
+        // The record size decides where the two templates differ in size: a shape colour's keys
+        // are spatial (152 bytes for 4 components) although its `tdb4` byte 7 is 0 (854). For 3
+        // components both templates are 128 bytes; byte 7 decides.
+        let size = list.header.record_size;
+        let layout = header.and_then(|h| {
+            let components = *h.get(3)?;
+            let n = u32::from(components);
+            let (spatial_size, plain_size) = (56 + 24 * n, 8 + 40 * n);
+            let spatial = if size == spatial_size && size != plain_size {
+                true
+            } else if size == plain_size && size != spatial_size {
+                false
+            } else {
+                *h.get(7)? != 0
+            };
+            Some(KeyLayout { components, spatial })
+        });
+        Some(KeyList { layout, ..list })
+    }
+}
+
+/// The header `lhd3` of a `LIST list`: 13 big-endian `u32`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ListHeader {
+    /// Word 0, `0x00d00bee` in every list.
+    pub magic: u32,
+    /// Word 2: the number of records.
+    pub count: u32,
+    /// Word 4: the size of one record in bytes.
+    pub record_size: u32,
+    /// All 13 words.
+    pub words: [u32; 13],
+}
+
+impl ListHeader {
+    /// Parses a 52-byte `lhd3` body.
+    pub fn parse(body: &[u8]) -> Option<Self> {
+        if body.len() != 52 {
+            return None;
+        }
+        let mut words = [0u32; 13];
+        for (i, w) in words.iter_mut().enumerate() {
+            *w = be_u32(body, i * 4)?;
+        }
+        Some(Self { magic: words[0], count: words[2], record_size: words[4], words })
+    }
+}
+
+/// A `LIST list`: `lhd3` and `ldat`, where `len(ldat) == count * record_size`.
+#[derive(Debug, Clone, Copy)]
+pub struct KeyList<'f> {
+    pub header: ListHeader,
+    ldat: &'f [u8],
+    layout: Option<KeyLayout>,
+}
+
+/// What the property header says about its keyframe records: how many value components each
+/// record holds and which of the two record templates applies (see [`KeyframeKind`]).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct KeyLayout {
+    /// `tdb4` byte 3.
+    pub components: u8,
+    /// `tdb4` byte 7 is non-zero: the spatial template (Position, colours) instead of the plain one.
+    pub spatial: bool,
+}
+
+impl<'f> KeyList<'f> {
+    /// A view of a `LIST list` chunk. `None` when `lhd3` is not 52 bytes or `ldat` is not exactly
+    /// `count * record_size` bytes (a list without `ldat` must have no records).
+    pub fn from_chunk<'a>(chunk: &'f Chunk<'a>) -> Option<Self> {
+        if !chunk.is_list(b"list") {
+            return None;
+        }
+        let header = ListHeader::parse(chunk.child(b"lhd3")?.bytes()?)?;
+        let ldat: &[u8] = chunk.child(b"ldat").and_then(Chunk::bytes).unwrap_or(&[]);
+        let expected = usize::try_from(header.count).ok()?.checked_mul(usize::try_from(header.record_size).ok()?)?;
+        (ldat.len() == expected).then_some(Self { header, ldat, layout: None })
+    }
+
+    /// The number of records actually present (what [`Self::records`] yields). Not the declared
+    /// count: a list with record size 0 and no data passes [`Self::from_chunk`] whatever count it
+    /// declares, and a caller sizing an allocation by that count would abort.
+    pub fn len(&self) -> usize {
+        self.records().count()
+    }
+
+    /// True when there are no records.
+    pub fn is_empty(&self) -> bool {
+        self.ldat.is_empty()
+    }
+
+    /// The records as byte slices.
+    pub fn records(&self) -> impl Iterator<Item = &'f [u8]> {
+        let size = usize::try_from(self.header.record_size).unwrap_or(0);
+        self.ldat.chunks_exact(size.max(1))
+    }
+
+    /// The record layout from the property header, `None` for a list that does not belong to a
+    /// property (the point list of a path).
+    pub fn layout(&self) -> Option<KeyLayout> {
+        self.layout
+    }
+
+    /// The records of a keyframe list as [`Keyframe`]s.
+    pub fn keyframes(&self) -> impl Iterator<Item = Keyframe<'f>> {
+        let layout = self.layout;
+        self.records().map(move |record| Keyframe { record, layout })
+    }
+}
+
+/// One keyframe record: the time is the `i32` at byte 0, in the composition's time units
+/// ([`TimeBase`]).
+#[derive(Debug, Clone, Copy)]
+pub struct Keyframe<'f> {
+    pub(crate) record: &'f [u8],
+    pub(crate) layout: Option<KeyLayout>,
+}
+
+impl<'f> Keyframe<'f> {
+    /// The whole record.
+    pub fn raw(&self) -> &'f [u8] {
+        self.record
+    }
+
+    /// The keyframe time in time units (layer time).
+    pub fn time_units(&self) -> Option<i32> {
+        be_u32(self.record, 0).map(|u| i32::from_be_bytes(u.to_be_bytes()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn key_list(count: u32, record_size: u32, ldat: &[u8]) -> Chunk<'static> {
+        let mut lhd3 = vec![0u8; 52];
+        lhd3[8..12].copy_from_slice(&count.to_be_bytes());
+        lhd3[16..20].copy_from_slice(&record_size.to_be_bytes());
+        Chunk::list(*b"list", vec![Chunk::data(*b"lhd3", lhd3), Chunk::data(*b"ldat", ldat.to_vec())])
+    }
+
+    #[test]
+    fn a_key_list_counts_the_records_it_holds() {
+        let two = key_list(2, 4, &[0; 8]);
+        assert_eq!(KeyList::from_chunk(&two).map(|l| l.len()), Some(2));
+        // Record size 0 with no data passes the size check whatever count is declared; the length
+        // is what is there, so no caller sizes an allocation by 4 billion records.
+        let hostile = key_list(u32::MAX, 0, &[]);
+        let list = KeyList::from_chunk(&hostile).expect("a well-formed empty list");
+        assert_eq!((list.len(), list.is_empty(), list.records().count()), (0, true, 0));
+    }
+
+    #[test]
+    fn get_finds_the_first_entry_of_a_name() {
+        let tdmn = |n: &str| {
+            let mut b = n.as_bytes().to_vec();
+            b.resize(40, 0);
+            Chunk::data(*b"tdmn", b)
+        };
+        let group = Chunk::list(
+            *b"tdgp",
+            vec![tdmn("A"), Chunk::list(*b"tdgp", Vec::new()), tdmn("B"), Chunk::list(*b"tdbs", Vec::new()), tdmn("A"), Chunk::list(*b"tdbs", Vec::new())],
+        );
+        let g = PropGroup::from_chunk(&group).expect("group");
+        assert!(matches!(g.get("A"), Some(PropNode::Group(_))), "the first A is the group");
+        assert!(matches!(g.get("B"), Some(PropNode::Property(_))));
+        assert!(g.get("C").is_none());
+        assert_eq!(g.names(), ["A", "B", "A"]);
+    }
+}
diff --git a/crates/aep/src/container/values.rs b/crates/aep/src/container/values.rs
new file mode 100644
index 000000000..a690751a2
--- /dev/null
+++ b/crates/aep/src/container/values.rs
@@ -0,0 +1,263 @@
+//! Static transform values with their units, and the "absent = default" rule.
+//!
+//! After Effects stores a property only when it differs from the default it computes for the layer
+//! and composition (sparse storage), so a reader has to supply the defaults: Position defaults to
+//! the composition centre `[width / 2, height / 2, 0]` (verified: after the composition is resized
+//! without moving the layer, the old centre appears as a stored value), Anchor Point to the layer
+//! centre (`0.5, 0.5` of the layer **source** size), Scale to 100 %, Rotation to 0 and Opacity to
+//! 100 %. These defaults are verified for AV layers (solids); cameras and lights use other
+//! conventions (see the `camera` module).
+
+use crate::container::typed::{Layer, Project, PropGroup, PropNode};
+
+/// Where a [`Tracked`] value came from.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ValueSource {
+    /// The property is absent from the file: the value is the computed default.
+    Default,
+    /// The property stores a static value.
+    Stored,
+    /// The property has keyframes: the value is that of the first keyframe.
+    Keyframed,
+    /// The property is present but its value could not be read: the value is the default.
+    Unreadable,
+}
+
+/// A value and where it came from.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Tracked<T> {
+    pub value: T,
+    pub source: ValueSource,
+}
+
+/// The five basic transform properties of an AV layer, in the units After Effects shows.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Transform {
+    /// Pixels `[x, y, z]`.
+    pub position: Tracked<[f64; 3]>,
+    /// Stored as a fraction of the layer's **source** size for x and y (`10, 20` px on a 100x100
+    /// solid in a 1920x1080 composition is `0.1, 0.2`; on a 400x300 solid `100, 50` is `0.25, 1/6`)
+    /// and in pixels for z; see [`Transform::anchor_px`] and [`Project::layer_anchor_px`].
+    pub anchor_fraction: Tracked<[f64; 3]>,
+    /// Percent `[x, y, z]` (stored as fractions: 50 % is `0.5`).
+    pub scale_percent: Tracked<[f64; 3]>,
+    /// Degrees (Rotation, the Z rotation).
+    pub rotation_degrees: Tracked<f64>,
+    /// Percent (stored as a fraction: 25 % is `0.25`).
+    pub opacity_percent: Tracked<f64>,
+}
+
+impl Transform {
+    /// The anchor point in pixels for a layer whose source has this size.
+    pub fn anchor_px(&self, width: f64, height: f64) -> [f64; 3] {
+        let [x, y, z] = self.anchor_fraction.value;
+        [x * width, y * height, z]
+    }
+
+    /// The anchor point of a **text** layer in layer pixels. A text layer has no source, so the
+    /// stored value is not a fraction: it is pixels as stored (385: Anchor Point `10, 20` is stored
+    /// `10, 20`), and an
+    /// absent anchor is the text origin `[0, 0, 0]` (After Effects' default for new text, absent in
+    /// every other text sample 110-114, 243-248, 334-340, 386).
+    pub fn text_anchor_px(&self) -> [f64; 3] {
+        match self.anchor_fraction.source {
+            ValueSource::Stored | ValueSource::Keyframed => self.anchor_fraction.value,
+            ValueSource::Default | ValueSource::Unreadable => [0.0; 3],
+        }
+    }
+}
+
+/// Reads `N` components from the property `name` of `group` and multiplies them by `scale` (stored
+/// fractions to percent); `default` is in the output units and used when the property is absent.
+pub(crate) fn read<const N: usize>(group: &PropGroup<'_, '_>, name: &str, default: [f64; N], scale: f64) -> Tracked<[f64; N]> {
+    let unreadable = Tracked { value: default, source: ValueSource::Unreadable };
+    let property = match group.get(name) {
+        None => return Tracked { value: default, source: ValueSource::Default },
+        Some(PropNode::Property(p)) => p,
+        Some(PropNode::Group(_) | PropNode::Other(_)) => return unreadable,
+    };
+    let (values, source) =
+        if property.is_animated() { (property.first_key_value(), ValueSource::Keyframed) } else { (property.static_value(), ValueSource::Stored) };
+    let Some(values) = values else { return unreadable };
+    if values.len() < N {
+        return unreadable;
+    }
+    let mut out = default;
+    for (slot, v) in out.iter_mut().zip(&values) {
+        *slot = *v * scale;
+    }
+    Tracked { value: out, source }
+}
+
+/// Like [`read`] but `None` when the property is absent or unreadable (for properties whose default
+/// is not known), keeping the value's source.
+pub(crate) fn read_opt<const N: usize>(group: &PropGroup<'_, '_>, name: &str, scale: f64) -> Option<Tracked<[f64; N]>> {
+    let tracked = read(group, name, [0.0; N], scale);
+    matches!(tracked.source, ValueSource::Stored | ValueSource::Keyframed).then_some(tracked)
+}
+
+impl<'f, 'a> Project<'f, 'a> {
+    /// The anchor point of an AV layer in pixels: the stored fraction times the size of the layer's
+    /// source (a solid or footage item, or a precomp's composition), z unchanged. `None` when the
+    /// layer has no source (shape, text, camera, light) or no Transform group.
+    pub fn layer_anchor_px(&self, layer: &Layer<'f, 'a>) -> Option<Tracked<[f64; 3]>> {
+        let (width, height) = self.layer_source_size(layer)?;
+        let Some(PropNode::Group(group)) = layer.properties()?.get("ADBE Transform Group") else { return None };
+        let fraction = read(&group, "ADBE Anchor Point", [0.5, 0.5, 0.0], 1.0);
+        let [x, y, z] = fraction.value;
+        Some(Tracked { value: [x * f64::from(width), y * f64::from(height), z], source: fraction.source })
+    }
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The transform of an AV layer in a composition of this size (pixels), with absent
+    /// properties replaced by their defaults. `None` when the layer has no Transform group.
+    pub fn transform(&self, comp_width: u32, comp_height: u32) -> Option<Transform> {
+        let Some(PropNode::Group(group)) = self.properties()?.get("ADBE Transform Group") else { return None };
+        let centre = [f64::from(comp_width) / 2.0, f64::from(comp_height) / 2.0, 0.0];
+        let rotation = read(&group, "ADBE Rotate Z", [0.0], 1.0);
+        let opacity = read(&group, "ADBE Opacity", [100.0], 100.0);
+        Some(Transform {
+            position: read(&group, "ADBE Position", centre, 1.0),
+            anchor_fraction: read(&group, "ADBE Anchor Point", [0.5, 0.5, 0.0], 1.0),
+            scale_percent: read(&group, "ADBE Scale", [100.0, 100.0, 100.0], 100.0),
+            rotation_degrees: Tracked { value: rotation.value[0], source: rotation.source },
+            opacity_percent: Tracked { value: opacity.value[0], source: opacity.source },
+        })
+    }
+}
+
+/// One key of a layer's Time Remapping property: the layer time of the key and the source time it
+/// maps to, both in seconds.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct TimeRemapKey {
+    /// The key time in the property's time units.
+    pub time_units: i32,
+    /// The key time in seconds (layer time).
+    pub time_seconds: Option<f64>,
+    /// The value in seconds (the plain record's value at byte 8).
+    pub value_seconds: f64,
+}
+
+/// The state of a layer's `ADBE Time Remapping` property. Every layer has the property; while the
+/// remap is off it is an inert record (`tdsb` 3, static value 0, no keys). Enabling the remap turns
+/// it into a keyed property (`tdsb` 1, `tdb4` byte 68 = 1, no `cdat`) with two keys: the layer's in
+/// and out time mapped to the source time (319: 0 s and 5 s; 354: 0 s and 0.1 s).
+#[derive(Debug, Clone, PartialEq)]
+pub struct TimeRemap {
+    /// True when the property has keys.
+    pub enabled: bool,
+    pub keys: Vec<TimeRemapKey>,
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The Time Remapping state; `None` when the layer has no such property.
+    pub fn time_remap(&self) -> Option<TimeRemap> {
+        let Some(PropNode::Property(p)) = self.properties()?.get("ADBE Time Remapping") else { return None };
+        let scale = p.time_scale().unwrap_or(0);
+        let keys = match p.keys() {
+            Some(list) => list
+                .keyframes()
+                .filter_map(|k| Some(TimeRemapKey { time_units: k.time_units()?, time_seconds: k.seconds(scale), value_seconds: k.scalar_value()? }))
+                .collect(),
+            None => Vec::new(),
+        };
+        Some(TimeRemap { enabled: p.is_animated(), keys })
+    }
+}
+
+/// The Orientation of a 3D layer (`ADBE Orientation`, 488): a `LIST otst` holding a `tdbs` and a
+/// `LIST otky` whose `otda` is three big-endian `f64` degrees `[x, y, z]`; absent at `[0, 0, 0]`
+/// (485-487).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Orientation {
+    /// Degrees `[x, y, z]`: the static value (for a keyed Orientation the first `otda`, whose
+    /// meaning is not sampled).
+    pub degrees: [f64; 3],
+    /// The `tdbs` of the `otst` has keys (see [`Layer::orientation_keys`]).
+    pub animated: bool,
+    /// The `tdbs` of the `otst` has an expression.
+    pub has_expression: bool,
+}
+
+impl<'f, 'a> Layer<'f, 'a> {
+    /// The Orientation; `None` when it is absent (the default `[0, 0, 0]`) or unreadable.
+    pub fn orientation(&self) -> Option<Orientation> {
+        let Some(PropNode::Group(group)) = self.properties()?.get("ADBE Transform Group") else { return None };
+        let Some(PropNode::Other(otst)) = group.get("ADBE Orientation") else { return None };
+        if !otst.is_list(b"otst") {
+            return None;
+        }
+        let property = otst.child_list(b"tdbs").and_then(crate::container::typed::Property::from_chunk);
+        let otda = otst.child_list(b"otky")?.child(b"otda")?.bytes()?;
+        let mut degrees = [0.0; 3];
+        for (i, slot) in degrees.iter_mut().enumerate() {
+            let b = otda.get(i * 8..i * 8 + 8)?;
+            *slot = f64::from_be_bytes(b.try_into().ok()?);
+        }
+        Some(Orientation {
+            degrees,
+            animated: property.as_ref().is_some_and(|p| p.is_animated()),
+            has_expression: property.as_ref().is_some_and(|p| p.expression().is_some()),
+        })
+    }
+
+    /// The time scale of the Orientation's key times (`tdb4` bytes 12..15), which follows the
+    /// layer's stretch like every property of the layer.
+    pub fn orientation_time_scale(&self) -> Option<u32> {
+        let Some(PropNode::Group(group)) = self.properties().and_then(|p| p.get("ADBE Transform Group")) else { return None };
+        let Some(PropNode::Other(otst)) = group.get("ADBE Orientation") else { return None };
+        otst.child_list(b"tdbs").and_then(crate::container::typed::Property::from_chunk).and_then(|p| p.time_scale())
+    }
+
+    /// The keyframes of a keyed Orientation (703): the `tdbs` of the `otst` holds one 80-byte
+    /// record per key (time, interpolation sides, flags; the rest is not decoded) and `otky` one
+    /// `otda` (three `f64` degrees) per key, in the same order. Empty when the Orientation is not
+    /// keyed or the counts differ. After Effects interpolates between the keys by a quaternion slerp
+    /// of the rotations `Rx Ry Rz`, not per component (703's values at 0.5 / 1 / 1.5 s).
+    pub fn orientation_keys(&self) -> Vec<OrientationKey> {
+        let Some(PropNode::Group(group)) = self.properties().and_then(|p| p.get("ADBE Transform Group")) else { return Vec::new() };
+        let Some(PropNode::Other(otst)) = group.get("ADBE Orientation") else { return Vec::new() };
+        let Some(list) = otst.child_list(b"tdbs").and_then(crate::container::typed::Property::from_chunk).and_then(|p| p.keys()) else { return Vec::new() };
+        let values: Vec<Option<[f64; 3]>> = otst
+            .child_list(b"otky")
+            .map(|k| {
+                k.children()
+                    .iter()
+                    .filter(|c| c.is(b"otda"))
+                    .map(|c| {
+                        let b = c.bytes()?;
+                        let at = |i: usize| b.get(i * 8..i * 8 + 8).and_then(|s| s.try_into().ok()).map(f64::from_be_bytes);
+                        Some([at(0)?, at(1)?, at(2)?])
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        let keys: Vec<_> = list.keyframes().collect();
+        if keys.len() != values.len() {
+            return Vec::new();
+        }
+        keys.iter()
+            .zip(values)
+            .filter_map(|(k, v)| {
+                Some(OrientationKey {
+                    time_units: k.time_units()?,
+                    interpolation_in: k.interpolation_in()?,
+                    interpolation_out: k.interpolation_out()?,
+                    degrees: v?,
+                })
+            })
+            .collect()
+    }
+}
+
+/// A keyframe of a keyed Orientation.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct OrientationKey {
+    /// The time in the property's time units (layer time).
+    pub time_units: i32,
+    pub interpolation_in: crate::container::Interpolation,
+    pub interpolation_out: crate::container::Interpolation,
+    /// Degrees `[x, y, z]`.
+    pub degrees: [f64; 3],
+}
diff --git a/crates/aep/src/container/version.rs b/crates/aep/src/container/version.rs
new file mode 100644
index 000000000..bf3fbf4c4
--- /dev/null
+++ b/crates/aep/src/container/version.rs
@@ -0,0 +1,120 @@
+//! The After Effects version a project is written for (`head` bytes 4 to 7) and the version of the
+//! After Effects that wrote it (`svap`).
+//!
+//! Both hold the same packed `u32` (see `docs/aep-format.md`, section 1, "Version"). A project saved
+//! normally has the same word in both; File ▸ Save a Copy As 25.x / 24.x of After Effects 2026 keeps
+//! `svap` (the 2026 version) and writes the older version into `head`. The XMP packet after the
+//! container names the application of the first save (`CreatorTool`) and is no guide to either.
+
+use std::fmt;
+
+use crate::container::bytes::{be_u16, be_u32};
+use crate::container::chunk::AepFile;
+
+/// An After Effects version as packed in `head` / `svap`: `26.2.1x2` is major 26, minor 2, bug-fix
+/// 1, build 2 (the form of the scripting API's `app.version`).
+///
+/// Bit layout of the big-endian word (bit 31 first), decoded from the samples (the 2026 word
+/// `0x0f11_0e02` is the version the saving After Effects reports, `26.2.1x2`; the down-saves give
+/// `0x0f0b_0661` and `0x0f03_0641`, read as `25.6.0x97` and `24.6.0x65`):
+///
+/// | bits | field |
+/// |---|---|
+/// | 31-26 | not decoded (`000011` in every sample) |
+/// | 25-24, 21-19 | major (high two bits, then low three bits) |
+/// | 23-22 | not decoded (`00` in every sample) |
+/// | 18-15 | minor |
+/// | 14-11 | bug-fix |
+/// | 10-8 | stage (6 in every sample) |
+/// | 7-0 | build |
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AeVersion {
+    pub major: u8,
+    pub minor: u8,
+    pub bugfix: u8,
+    /// The release stage (6 in every sample; not shown in [`AeVersion::text`]).
+    pub stage: u8,
+    pub build: u8,
+    /// The word as stored.
+    pub raw: u32,
+}
+
+impl AeVersion {
+    /// Decodes a stored word; `None` for a word that holds no version (zero, all ones, or major 0:
+    /// After Effects itself refuses a file whose `head` version is zero, "[0.0x0]").
+    pub fn from_word(raw: u32) -> Option<Self> {
+        if raw == 0 || raw == u32::MAX {
+            return None;
+        }
+        let [b0, b1, b2, b3] = raw.to_be_bytes();
+        let major = ((b0 & 0x03) << 3) | ((b1 >> 3) & 0x07);
+        if major == 0 {
+            return None;
+        }
+        Some(Self { major, minor: ((b1 & 0x07) << 1) | (b2 >> 7), bugfix: (b2 >> 3) & 0x0f, stage: b2 & 0x07, build: b3, raw })
+    }
+
+    /// `26.2.1x2`.
+    pub fn text(&self) -> String {
+        self.to_string()
+    }
+}
+
+impl fmt::Display for AeVersion {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}.{}.{}x{}", self.major, self.minor, self.bugfix, self.build)
+    }
+}
+
+impl AepFile<'_> {
+    /// The version the file is written for: `head` bytes 4 to 7. After Effects 2026 writes its own
+    /// version there, and the older version for File ▸ Save a Copy As 25.x / 24.x. `None` when the
+    /// chunk is missing, short or holds no version.
+    pub fn file_version(&self) -> Option<AeVersion> {
+        AeVersion::from_word(be_u32(self.chunk(b"head")?.bytes()?, 4)?)
+    }
+
+    /// The version of the After Effects that wrote the file: `svap` bytes 0 to 3 (the same word in a
+    /// down-saved copy as in a normal save). `None` when the chunk is missing (After Effects opens such
+    /// a file), short or holds no version.
+    pub fn saved_by_version(&self) -> Option<AeVersion> {
+        AeVersion::from_word(be_u32(self.chunk(b"svap")?.bytes()?, 0)?)
+    }
+
+    /// The `u16` at `head` byte 0: 97 (`0x61`) in a 2026 file, 96 in a copy saved as 25.x, 95 as
+    /// 24.x. It steps with the major version of [`AepFile::file_version`]; what it counts is not
+    /// known, so nothing is derived from it.
+    pub fn head_revision(&self) -> Option<u16> {
+        be_u16(self.chunk(b"head")?.bytes()?, 0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::AeVersion;
+
+    #[test]
+    fn decodes_the_sampled_words() {
+        let v = AeVersion::from_word(0x0f11_0e02).unwrap();
+        assert_eq!((v.major, v.minor, v.bugfix, v.stage, v.build), (26, 2, 1, 6, 2));
+        assert_eq!(v.text(), "26.2.1x2");
+        assert_eq!(AeVersion::from_word(0x0f0b_0661).unwrap().text(), "25.6.0x97");
+        assert_eq!(AeVersion::from_word(0x0f03_0641).unwrap().text(), "24.6.0x65");
+    }
+
+    #[test]
+    fn a_word_without_a_version_is_none() {
+        assert_eq!(AeVersion::from_word(0), None);
+        assert_eq!(AeVersion::from_word(u32::MAX), None);
+        // Major 0 (only the undecoded high bits set).
+        assert_eq!(AeVersion::from_word(0x0c00_0000), None);
+    }
+
+    #[test]
+    fn every_field_takes_its_extremes() {
+        let v = AeVersion::from_word(0x03ff_ffff).unwrap();
+        assert_eq!((v.major, v.minor, v.bugfix, v.stage, v.build), (31, 15, 15, 7, 255));
+        let v = AeVersion::from_word(0x0000_0800 | 0x0008_0000).unwrap();
+        assert_eq!((v.major, v.minor, v.bugfix, v.build), (1, 0, 1, 0));
+    }
+}
diff --git a/crates/aep/src/container/write.rs b/crates/aep/src/container/write.rs
new file mode 100644
index 000000000..3ccab50a4
--- /dev/null
+++ b/crates/aep/src/container/write.rs
@@ -0,0 +1,86 @@
+//! Writing an [`AepFile`] back to bytes.
+
+use std::io::Write;
+
+use crate::container::chunk::{AepFile, Body, Chunk};
+use crate::container::error::AepError;
+
+/// Deepest tree [`write`] accepts (a hand-built tree may be deeper than any parsed one).
+const MAX_WRITE_DEPTH: usize = 256;
+
+/// Serialises `file`: `RIFX`, the recomputed container size, `Egg!`, the chunks and the trailer.
+/// Sizes of the container and of every chunk are recomputed from the tree; an unmodified parsed
+/// file comes back byte for byte.
+///
+/// # Errors
+/// [`AepError::TooLarge`] when a chunk or the container exceeds the 32-bit size field,
+/// [`AepError::TooDeep`] for an absurdly deep hand-built tree.
+pub fn write(file: &AepFile<'_>) -> Result<Vec<u8>, AepError> {
+    let mut out = Vec::new();
+    out.extend_from_slice(b"RIFX");
+    out.extend_from_slice(&[0; 4]);
+    out.extend_from_slice(b"Egg!");
+    write_sequence(&mut out, &file.chunks, 1)?;
+    let size = u32::try_from(out.len().saturating_sub(8)).map_err(|_| AepError::TooLarge)?;
+    patch_u32(&mut out, 4, size)?;
+    out.extend_from_slice(&file.trailer);
+    Ok(out)
+}
+
+/// Like [`write`], into any writer.
+///
+/// # Errors
+/// A size or depth error of [`write`] becomes `ErrorKind::InvalidData`; otherwise I/O errors.
+pub fn write_to(file: &AepFile<'_>, w: &mut impl Write) -> std::io::Result<()> {
+    let bytes = write(file).map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    w.write_all(&bytes)
+}
+
+fn patch_u32(out: &mut [u8], at: usize, v: u32) -> Result<(), AepError> {
+    let end = at.checked_add(4).ok_or(AepError::TooLarge)?;
+    let dst = out.get_mut(at..end).ok_or(AepError::TooLarge)?;
+    for (d, s) in dst.iter_mut().zip(v.to_be_bytes()) {
+        *d = s;
+    }
+    Ok(())
+}
+
+fn write_sequence(out: &mut Vec<u8>, chunks: &[Chunk<'_>], depth: usize) -> Result<(), AepError> {
+    if depth > MAX_WRITE_DEPTH {
+        return Err(AepError::TooDeep);
+    }
+    let count = chunks.len();
+    for (i, chunk) in chunks.iter().enumerate() {
+        write_chunk(out, chunk, i + 1 == count, depth)?;
+    }
+    Ok(())
+}
+
+fn write_chunk(out: &mut Vec<u8>, chunk: &Chunk<'_>, is_last: bool, depth: usize) -> Result<(), AepError> {
+    out.extend_from_slice(&chunk.id);
+    let size_at = out.len();
+    out.extend_from_slice(&[0; 4]);
+    let body_start = out.len();
+    match &chunk.body {
+        Body::Data(d) => out.extend_from_slice(d),
+        Body::Chunks(c) => write_sequence(out, c, depth + 1)?,
+        Body::List { list_type, children } => {
+            out.extend_from_slice(list_type);
+            write_sequence(out, children, depth + 1)?;
+        }
+        Body::OpaqueList { list_type, data } => {
+            out.extend_from_slice(list_type);
+            out.extend_from_slice(data);
+        }
+    }
+    let len = out.len().saturating_sub(body_start);
+    patch_u32(out, size_at, u32::try_from(len).map_err(|_| AepError::TooLarge)?)?;
+    if len % 2 == 1 {
+        match chunk.pad {
+            Some(b) => out.push(b),
+            None if !is_last => out.push(0),
+            None => {}
+        }
+    }
+    Ok(())
+}
diff --git a/crates/aep/src/export.rs b/crates/aep/src/export.rs
new file mode 100644
index 000000000..12f10aa0c
--- /dev/null
+++ b/crates/aep/src/export.rs
@@ -0,0 +1,125 @@
+//! After Effects project (`.aep`) export: an EffectCraft [`Project`] written as an `.aep` that
+//! After Effects 2026 opens.
+//!
+//! Every chunk is built in code: the project skeleton, the item, layer and property records are
+//! prototypes in the layout After Effects writes (`template.rs` gathers them), and the exporter
+//! clones them and writes only the fields whose layout is verified (`docs/aep-format.md` section 3, `docs/aep-export.md`):
+//! item and layer ids, project settings, the composition header, the layer header (switches
+//! including 3D, time stretch, blend modes, track mattes), solid colour and size, the Transform
+//! properties (static values, keyframes with interpolation and ease, expressions), layer masks,
+//! markers, time remapping, precomposition, footage, text (with animators), shape, camera and
+//! light layers, footage items and image sequences, layer styles, and the effects of the table
+//! shared with the importer (`crate::effect_map`). `docs/aep-export.md` has the full
+//! list and the rules After Effects needs.
+//!
+//! What cannot be written is **reported**, never dropped silently ([`ExportReport`]); by default an
+//! export that would lose anything is refused ([`ExportOptions::allow_losses`]).
+//!
+//! The crate sits at L3 (above `effectcraft-project`, next to the importer) and builds for wasm32:
+//! it does no file access, the caller gets the bytes.
+
+mod base;
+mod camlight;
+mod effects;
+mod emit;
+mod footage;
+mod fx_defs;
+mod fxsynth;
+pub(crate) mod icc;
+mod markers;
+mod masks;
+mod plan;
+mod report;
+mod settings;
+mod shapes;
+mod skeleton;
+mod style_defs;
+mod styles;
+mod synth;
+mod template;
+mod text;
+mod textanim;
+mod textdoc;
+mod textproto;
+mod timebase;
+mod tree;
+mod tree_defs;
+mod tree_spec;
+
+use effectcraft_project::Project;
+
+pub use report::{ExportReport, Exported, LIMITATIONS, Loss, LossCategory, MAX_DETAILS};
+
+/// Why an `.aep` was not written.
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum AepExportError {
+    /// Parts of the project cannot be exported and losses were not allowed. Nothing was written;
+    /// the report says what would be lost.
+    #[error("exporting would lose {}; allow losses to export anyway", .0.summary())]
+    Refused(Box<ExportReport>),
+    /// A prototype built in code does not have the shape the exporter expects (a bug in the crate).
+    #[error("internal error: {0}")]
+    Internal(&'static str),
+    /// The container could not be written (a chunk or the file exceeds the format's 4 GB limit).
+    #[error("{0}")]
+    Container(#[from] crate::AepError),
+}
+
+/// Options of [`export`].
+#[derive(Clone, Copy, Debug, Default)]
+pub struct ExportOptions {
+    /// Export even when [`ExportReport::losses`] is not empty.
+    pub allow_losses: bool,
+}
+
+/// An exported project.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ExportResult {
+    /// The `.aep` file.
+    pub bytes: Vec<u8>,
+    pub report: ExportReport,
+}
+
+/// A neutral XMP packet for the end of the file (After Effects writes one; it only holds metadata).
+const XMP: &[u8] = b"<?xpacket begin=\"\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?>\n<x:xmpmeta xmlns:x=\"adobe:ns:meta/\">\n <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\">\n  <rdf:Description rdf:about=\"\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\">\n   <dc:format>application/vnd.adobe.aftereffects.project</dc:format>\n  </rdf:Description>\n </rdf:RDF>\n</x:xmpmeta>\n<?xpacket end=\"w\"?>";
+
+/// Exports `project` as an `.aep`.
+///
+/// # Errors
+/// [`AepExportError::Refused`] when something would be lost and `allow_losses` is not set (nothing
+/// is written), [`AepExportError::Container`] for a file beyond the container's size limits.
+pub fn export(project: &Project, options: &ExportOptions) -> Result<ExportResult, AepExportError> {
+    export_with(project, options, &|_| None)
+}
+
+/// [`export`] with the modification times of the image-sequence folders: `folder_time` is asked
+/// with a sequence's first file path as the project stores it and answers with the modification
+/// time of the folder that holds it, in whole seconds since 1970 (UTC), or `None`. The caller
+/// decides whether that path may be followed (the engine applies its document-path policy) before
+/// it looks at the folder.
+///
+/// After Effects keeps a sequence's stored numbering only while the stored folder time
+/// (`sspc@118`) equals the folder's; otherwise it scans the folder again when the project opens
+/// and warns about every gap in the numbering in a modal dialog (860, `export-tests` x1-x3).
+/// Without a time it is written as 0, and such a folder is scanned again.
+///
+/// # Errors
+/// As [`export`].
+pub fn export_with(project: &Project, options: &ExportOptions, folder_time: &dyn Fn(&str) -> Option<u64>) -> Result<ExportResult, AepExportError> {
+    let mut col = report::Collector::default();
+    let mut plan = plan::plan(project, &mut col);
+    let report = col.finish();
+    if !options.allow_losses && !report.is_lossless() {
+        return Err(AepExportError::Refused(Box::new(report)));
+    }
+    footage::stamp_sequences(&mut plan.root, folder_time);
+    let bytes = emit::emit(&plan, XMP)?;
+    Ok(ExportResult { bytes, report })
+}
+
+/// The report an export would produce, without writing anything (a dry run).
+pub fn analyze(project: &Project) -> ExportReport {
+    let mut col = report::Collector::default();
+    let _ = plan::plan(project, &mut col);
+    col.finish()
+}
diff --git a/crates/aep/src/export/base.rs b/crates/aep/src/export/base.rs
new file mode 100644
index 000000000..d483cefb7
--- /dev/null
+++ b/crates/aep/src/export/base.rs
@@ -0,0 +1,332 @@
+//! The project skeleton built in code (aep-format.md 3.1-3.3, 3.12a): the top-level chunks, the
+//! composition shell with its view layers, the `Solids` folder, a solid item and the records that
+//! follow a composition. Fields the exporter sets per item are left zero here; the bytes that are
+//! not decoded are named constants, each with the value it has in every generated test file of
+//! that kind (cases 000, 022, 211, 259, 620-634) and kept because After Effects refuses the file without them
+//! (read-backs t-no<id>, t-zcdta, u-zsspc, u-noclrs, u-noftgi, u-nofrec, u-nocdrp).
+
+use crate::Chunk;
+use crate::export::synth::{tdmn, tdsn};
+
+/// A zero buffer of `len` bytes with `fields` (offset, bytes) written into it.
+pub(crate) fn bytes(len: usize, fields: &[(usize, &[u8])]) -> Vec<u8> {
+    let mut b = vec![0u8; len];
+    for (at, v) in fields {
+        if let Some(dst) = b.get_mut(*at..at.saturating_add(v.len())) {
+            dst.copy_from_slice(v);
+        }
+    }
+    b
+}
+
+pub(crate) fn utf8(text: &str) -> Chunk<'static> {
+    Chunk::data(*b"Utf8", text.as_bytes().to_vec())
+}
+
+/// The After Effects version the file claims (`svap`, `head` 4..7): 26.x, the version every
+/// sample was saved with.
+const VERSION: [u8; 4] = [0x0f, 0x11, 0x0e, 0x02];
+/// `head` 0..3 and byte 8: the same in every sample (not decoded; a zero `head` is refused as
+/// "created with an older version", read-back u-zhead).
+const HEAD_FORMAT: [u8; 4] = [0x00, 0x61, 0x00, 0x05];
+/// The code page of the project's strings (`nhed` 18, `nnhd` 26): 65001, UTF-8.
+const UTF8_CODE_PAGE: [u8; 2] = 65001u16.to_be_bytes();
+/// The size of the render-queue settings blocks (`AFsi`, `ARsi`); zero bodies of this size are
+/// read (read-back e1-zafsi), a missing one is refused (e1-noafsi).
+const RQ_SETTINGS_LEN: usize = 1872;
+/// The record size of the render-queue item list (`LRdr/list/lhd3` word 4).
+const RQ_ITEM_LEN: u32 = 2246;
+/// The id of the `Solids` folder, which `sfnm/sfid` names.
+pub(crate) const SOLIDS_FOLDER_ID: u32 = 0x19;
+/// The default end time of a view layer (5 s in 25 600 units): view layers keep it whatever the
+/// composition's duration (000, 031, 032).
+const VIEW_OUT: u32 = 128_000;
+
+/// The top-level chunks of a project: the headers (`settings::emit` writes the settings into
+/// them, `emit` the next free id), the project lists (`effects::put_project_lists` fills `Pefl`),
+/// an empty `Fold` with its `fdta`, the workspace name and the render queue.
+pub(crate) fn project_chunks() -> Vec<Chunk<'static>> {
+    let head = bytes(20, &[(0, &HEAD_FORMAT), (4, &VERSION), (8, &[0x80])]);
+    // nhed / nnhd: bytes 7 and 9 the same in every sample, byte 12 / 15 the timecode base (30),
+    // 13 / 19 the frames per foot (16), 14 / 20 the frame count start (2: from 0), 15 / 24 the
+    // colour depth (2: 32 bits); the save noise after the code page is left zero.
+    let nhed = bytes(32, &[(7, &[5]), (9, &[1]), (12, &[0x1e, 16, 2, 2]), (18, &UTF8_CODE_PAGE)]);
+    let nnhd = bytes(40, &[(7, &[5]), (9, &[1]), (15, &[0x1e]), (19, &[16, 2]), (24, &[2]), (26, &UTF8_CODE_PAGE)]);
+    let mut lhd3 = bytes(52, &[(0, &0x00d0_0bee_u32.to_be_bytes()), (12, &1u32.to_be_bytes()), (16, &RQ_ITEM_LEN.to_be_bytes())]);
+    for at in [20, 24, 28] {
+        if let Some(dst) = lhd3.get_mut(at..at + 4) {
+            dst.copy_from_slice(&1u32.to_be_bytes());
+        }
+    }
+    let wsnm: Vec<u8> = "Default".encode_utf16().flat_map(u16::to_be_bytes).collect();
+    vec![
+        Chunk::data(*b"svap", VERSION.to_vec()),
+        Chunk::data(*b"head", head),
+        Chunk::data(*b"nhed", nhed),
+        Chunk::data(*b"nnhd", nnhd),
+        // The project's audio sample rate.
+        Chunk::data(*b"adfr", 48_000f64.to_be_bytes().to_vec()),
+        Chunk::list(*b"Pefl", Vec::new()),
+        Chunk::data(*b"qtlg", vec![0]),
+        Chunk::list(*b"sfnm", vec![utf8("Solids"), Chunk::data(*b"sfid", SOLIDS_FOLDER_ID.to_le_bytes().to_vec())]),
+        Chunk::data(*b"mrid", vec![0; 4]),
+        // Compensate for Scene-referred Profiles: on.
+        Chunk::data(*b"acer", vec![1]),
+        Chunk::list(*b"CPPl", Vec::new()),
+        Chunk::data(*b"cpid", vec![0xff; 16]),
+        Chunk::data(*b"dwga", vec![0; 4]),
+        Chunk::data(*b"pcms", vec![1]),
+        utf8("{\"ocioConfigurationFile\":\"ACES 1.2\"}"),
+        Chunk::data(*b"PwCs", vec![1]),
+        utf8("{}"),
+        Chunk::data(*b"pdvc", vec![1]),
+        utf8("{}"),
+        Chunk::list(*b"ExEn", vec![utf8("javascript-1.0")]),
+        Chunk::list(*b"Fold", vec![Chunk::data(*b"fdta", vec![0; 14])]),
+        Chunk::data(*b"wsns", vec![0, 0x0e]),
+        Chunk::data(*b"wsnm", wsnm),
+        utf8("Default"),
+        Chunk::data(*b"fcid", vec![0; 4]),
+        Chunk::data(*b"oacc", vec![0; 2]),
+        Chunk::list(*b"LSIf", vec![Chunk::data(*b"AFsi", vec![0; RQ_SETTINGS_LEN])]),
+        Chunk::list(
+            *b"LRdr",
+            vec![
+                Chunk::data(*b"Rhed", vec![0; 20]),
+                Chunk::data(*b"Rout", vec![0; 4]),
+                Chunk::list(*b"list", vec![Chunk::data(*b"lhd3", lhd3)]),
+                Chunk::list(*b"LItm", Vec::new()),
+                Chunk::list(*b"LSIf", vec![Chunk::data(*b"ARsi", vec![0; RQ_SETTINGS_LEN])]),
+            ],
+        ),
+    ]
+}
+
+/// `idta` of an item: the kind at 0, byte 23 per kind (0x20 composition, 0x30 footage, 0 folder;
+/// After Effects renders differently without it, read-backs t-zidta and u-zidta2); `emit` writes
+/// the id and the label.
+pub(crate) fn idta(kind: u16, byte23: u8) -> Chunk<'static> {
+    Chunk::data(*b"idta", bytes(84, &[(0, &kind.to_be_bytes()), (23, &[byte23])]))
+}
+
+/// The guides of a layer or item (`Gide`: `gdta` zero and an empty list header).
+pub(crate) fn guides() -> Chunk<'static> {
+    let header = crate::export::synth::key_list(16, 0, Vec::new()).children().iter().filter(|c| c.is(b"lhd3")).cloned().collect();
+    Chunk::list(*b"Gide", vec![Chunk::data(*b"gdta", vec![0; 8]), Chunk::list(*b"list", header)])
+}
+
+/// `cdta` with the bytes `emit::build_comp` does not write: 0..3, the shutter angle and phase
+/// limits (360 at 176 and 184), the motion blur samples per frame (16 at 200) and the adaptive
+/// sample limit (128 at 196); the same in every sample, and a `cdta` without them crashes After
+/// Effects (read-back t-zcdta).
+fn cdta() -> Chunk<'static> {
+    Chunk::data(
+        *b"cdta",
+        bytes(
+            204,
+            &[(0, &[0, 1, 0, 1]), (176, &360u32.to_be_bytes()), (184, &360u32.to_be_bytes()), (196, &128u32.to_be_bytes()), (200, &16u32.to_be_bytes())],
+        ),
+    )
+}
+
+/// The renderer (`PRin`): the Classic 3D match name and display name (aep-format.md 3.2).
+fn renderer() -> Chunk<'static> {
+    let prin = bytes(104, &[(4, b"ADBE Escher"), (52, b"Classic 3D"), (103, &[1])]);
+    Chunk::list(*b"PRin", vec![Chunk::data(*b"prin", prin), Chunk::data(*b"prda", vec![0; 12])])
+}
+
+/// The built-in view layers of a composition: list type, name, `ldta` byte 61 (label) and byte
+/// 128 (layer type: 2 camera, 4 for the markers layer).
+const VIEWS: [(&[u8; 4], &str, u8, u8); 11] = [
+    (b"DLay", "Default", 4, 2),
+    (b"SLay", "Front", 4, 2),
+    (b"SLay", "Left", 4, 2),
+    (b"SLay", "Top", 4, 2),
+    (b"SLay", "Back", 4, 2),
+    (b"SLay", "Right", 4, 2),
+    (b"SLay", "Bottom", 4, 2),
+    (b"CLay", "Custom View 1", 4, 2),
+    (b"CLay", "Custom View 2", 4, 2),
+    (b"CLay", "Custom View 3", 4, 2),
+    (b"SecL", "Markers", 8, 4),
+];
+
+/// One view layer: `ldta` with the decoded fields only (read-back t-zldta), an empty property
+/// tree (t-vempty), the guides, `Ewst` and the two f-record sets. `emit` writes the id.
+fn view_layer(ty: &[u8; 4], name: &str, label: u8, kind: u8) -> Vec<Chunk<'static>> {
+    let markers = kind == 4;
+    let mut name_copy = name.as_bytes().to_vec();
+    name_copy.truncate(31);
+    let mut ldta = bytes(
+        164,
+        &[
+            (8, &1u32.to_be_bytes()),
+            (16, &600u32.to_be_bytes()),
+            (24, &25_600u32.to_be_bytes()),
+            (28, &VIEW_OUT.to_be_bytes()),
+            (32, &25_600u32.to_be_bytes()),
+            (61, &[label]),
+            (64, &name_copy),
+            (108, &1u32.to_be_bytes()),
+            (128, &u32::from(kind).to_be_bytes()),
+        ],
+    );
+    // Byte 38: 3D and auto-orient on the cameras; byte 39: the video switch (and on the markers
+    // layer also effects, locked and collapse); quality Draft and blend mode Normal on the
+    // markers layer.
+    let flags: &[(usize, u8)] = if markers { &[(5, 2), (39, 0x87), (99, 2)] } else { &[(38, 0x44), (39, 1)] };
+    for (at, v) in flags {
+        if let Some(b) = ldta.get_mut(*at) {
+            *b = *v;
+        }
+    }
+    let root = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn(""), tdmn("ADBE Group End")];
+    let layer = Chunk::list(*ty, vec![Chunk::data(*b"ldta", ldta), utf8(name), Chunk::list(*b"tdgp", root), guides()]);
+    let mut out = vec![layer, Chunk::list(*b"Ewst", Vec::new())];
+    out.extend(crate::export::skeleton::f_records());
+    out.extend(crate::export::skeleton::f_records());
+    out
+}
+
+/// The composition item without layers, and the index of its children where the layer blocks go.
+pub(crate) fn comp_shell() -> (Chunk<'static>, usize) {
+    let mut kids = vec![
+        Chunk::data(*b"iide", vec![0; 4]),
+        Chunk::data(*b"idpc", vec![0; 8]),
+        idta(4, 0x20),
+        utf8(""),
+        Chunk::list(*b"dats", vec![Chunk::data(*b"numS", vec![0; 4])]),
+        cdta(),
+        Chunk::data(*b"cdrp", vec![0]),
+        Chunk::data(*b"comr", vec![0]),
+        renderer(),
+    ];
+    let layer_at = kids.len();
+    for (ty, name, label, kind) in VIEWS {
+        kids.extend(view_layer(ty, name, label, kind));
+    }
+    kids.push(guides());
+    (Chunk::list(*b"Item", kids), layer_at)
+}
+
+/// The list that follows a composition item (`FEE `, `ppSn` zero: read-back u-zppsn).
+pub(crate) fn fee() -> Chunk<'static> {
+    Chunk::list(*b"FEE ", vec![Chunk::data(*b"ppSn", vec![0; 8])])
+}
+
+/// An empty folder item (`sfdt` 1 in every sample).
+pub(crate) fn folder_item() -> Chunk<'static> {
+    Chunk::list(
+        *b"Item",
+        vec![
+            Chunk::data(*b"iide", vec![0; 4]),
+            Chunk::data(*b"idpc", vec![0; 8]),
+            idta(1, 0),
+            utf8(""),
+            Chunk::data(*b"sfdt", 1u32.to_be_bytes().to_vec()),
+            Chunk::list(*b"Sfdr", Vec::new()),
+        ],
+    )
+}
+
+/// `ftgi` of a footage item, the same in every sample (required, read-back u-noftgi).
+pub(crate) fn ftgi() -> Chunk<'static> {
+    Chunk::data(*b"ftgi", bytes(16, &[(7, &[1]), (8, &[0xff; 4]), (12, &600u32.to_be_bytes())]))
+}
+
+/// The `sspc` bytes of a solid that are not decoded, the same in every solid (000, 022, 211, 259);
+/// After Effects refuses a solid with only the decoded fields (read-back u-zsspc).
+const SOLID_SSPC: [(usize, &[u8]); 11] = [
+    (50, &[0, 0, 0x02, 0x58]),
+    (73, &[3]),
+    (105, &[1]),
+    (109, &[1]),
+    (125, &[0x0c]),
+    (129, &[1]),
+    (134, &[1]),
+    (139, &[1]),
+    (143, &[1]),
+    (188, &[0xff; 8]),
+    (212, &[1]),
+];
+
+/// A solid's footage item: `sspc` (type `Soli`, duration 0 / 1), `opti` (`Soli`; `emit` writes
+/// the colour and the name), `pgui`, the colour-management list (no profile, the defaults of
+/// every sample; required, read-back u-noclrs), `ftgi` (required, u-noftgi) and the guides. The
+/// solid of a null layer is the same item.
+pub(crate) fn solid_item() -> Chunk<'static> {
+    let mut sspc_fields: Vec<(usize, &[u8])> = vec![(22, b"Soli"), (45, &[1])];
+    sspc_fields.extend(SOLID_SSPC);
+    let clrs = Chunk::list(
+        *b"CLRS",
+        vec![
+            Chunk::data(*b"epid", vec![0xff; 16]),
+            Chunk::data(*b"apid", vec![0xff; 16]),
+            Chunk::data(*b"linl", vec![2, 0, 0, 0]),
+            Chunk::data(*b"embp", vec![1]),
+            Chunk::data(*b"ipws", vec![1]),
+            Chunk::data(*b"dcui", vec![1]),
+            Chunk::data(*b"prgb", vec![1]),
+            Chunk::data(*b"Mcsp", vec![1]),
+            utf8(""),
+            Chunk::data(*b"ocsp", vec![1]),
+            utf8(""),
+            Chunk::data(*b"hdrm", vec![1]),
+            utf8("{}"),
+        ],
+    );
+    let pin = Chunk::list(
+        *b"Pin ",
+        vec![
+            Chunk::data(*b"sspc", bytes(222, &sspc_fields)),
+            utf8(""),
+            Chunk::data(*b"opti", bytes(282, &[(0, b"Soli")])),
+            Chunk::data(*b"pgui", vec![0; 16]),
+            clrs,
+            utf8(""),
+        ],
+    );
+    Chunk::list(*b"Item", vec![Chunk::data(*b"iide", vec![0; 4]), Chunk::data(*b"idpc", vec![0; 8]), idta(7, 0x30), utf8(""), pin, ftgi(), utf8(""), guides()])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The chunks After Effects refuses a file without, or crashes on (aep-export.md, "What After
+    /// Effects needs").
+    #[test]
+    fn the_skeleton_has_what_after_effects_needs() {
+        let top = project_chunks();
+        for id in [b"adfr", b"qtlg", b"mrid", b"acer", b"fcid", b"oacc", b"head", b"nhed"] {
+            assert!(top.iter().any(|c| c.is(id)), "{}", String::from_utf8_lossy(id));
+        }
+        assert!(top.iter().any(|c| c.is_list(b"CPPl")));
+        let head = top.iter().find(|c| c.is(b"head")).and_then(|c| c.bytes()).unwrap();
+        assert_eq!(&head[..8], &[0x00, 0x61, 0x00, 0x05, 0x0f, 0x11, 0x0e, 0x02]);
+        let rq = top.iter().find(|c| c.is_list(b"LRdr")).unwrap();
+        let arsi = rq.child_list(b"LSIf").and_then(|l| l.child(b"ARsi")).and_then(|c| c.bytes()).unwrap();
+        assert_eq!(arsi.len(), RQ_SETTINGS_LEN);
+        let afsi = top.iter().find(|c| c.is_list(b"LSIf")).and_then(|l| l.child(b"AFsi")).and_then(|c| c.bytes()).unwrap();
+        assert_eq!(afsi.len(), RQ_SETTINGS_LEN);
+
+        let (comp, at) = comp_shell();
+        let kids = comp.children();
+        assert!(comp.child_list(b"dats").is_some(), "no dats: After Effects crashes");
+        assert!(kids.iter().any(|c| c.is(b"cdrp")) && kids.iter().any(|c| c.is(b"comr")));
+        let cdta = comp.child(b"cdta").and_then(|c| c.bytes()).unwrap();
+        for at in [1usize, 3, 179, 187, 199, 203] {
+            assert_ne!(cdta[at], 0, "cdta byte {at}: a zero cdta crashes After Effects");
+        }
+        let views = kids.iter().filter(|c| [*b"DLay", *b"SLay", *b"CLay", *b"SecL"].iter().any(|t| c.is_list(t))).count();
+        assert_eq!(views, 11);
+        assert!(kids.get(at).is_some_and(|c| c.is_list(b"DLay")), "the layers go before the view layers");
+
+        let solid = solid_item();
+        let pin = solid.child_list(b"Pin ").unwrap();
+        assert!(pin.child_list(b"CLRS").is_some() && solid.child(b"ftgi").is_some());
+        let sspc = pin.child(b"sspc").and_then(|c| c.bytes()).unwrap();
+        assert!(SOLID_SSPC.iter().all(|(at, v)| &sspc[*at..*at + v.len()] == *v));
+        assert_eq!(solid.child(b"idta").and_then(|c| c.bytes()).unwrap()[23], 0x30);
+    }
+}
diff --git a/crates/aep/src/export/camlight.rs b/crates/aep/src/export/camlight.rs
new file mode 100644
index 000000000..597bf800a
--- /dev/null
+++ b/crates/aep/src/export/camlight.rs
@@ -0,0 +1,283 @@
+//! Camera and light layers (`docs/aep-format.md` 3.12; cases 251-256, 342-346).
+//!
+//! Both are written from a layer block of our own cases: the default two-node camera 256 and the
+//! spot (254, its Intensity record removed) and point (252) lights. The layer header keeps the
+//! case's type (`ldta@128` 2 camera, 1 light), source id (0 / `0xffffffff`), 3D bit and light type
+//! (`ldta@136` 1 spot, 2 point); the exporter sets the auto-orient bit (`ldta@38` 0x40: a two-node
+//! camera and a spot light orient towards their point of interest, 251 vs 256). The point of
+//! interest is the Anchor Point in pixels and the Position an explicit value (253: 76 / 77 = 0),
+//! both through the Transform writer. Options records are cloned from the one-change cases.
+
+use crate::Chunk;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Layer, LightKind};
+
+use crate::export::report::{Collector, LossCategory};
+use crate::export::tree::{R, child_data, kids_mut, list_mut, put_f64, tpl};
+
+/// A camera's options in the file's units (pixels, percent, a switch).
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct CameraPlan {
+    pub two_node: bool,
+    pub zoom: f64,
+    pub dof: bool,
+    pub focus: f64,
+    pub aperture: f64,
+    pub blur: f64,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct LightPlan {
+    /// `ldta@136`: 1 spot, 2 point (252, 254).
+    pub kind: u32,
+    pub intensity: f64,
+    /// `[A, R, G, B]` 0..255 (343).
+    pub color: [f64; 4],
+    pub cone_angle: f64,
+    pub cone_feather: f64,
+}
+
+/// The finite scalar at `path`; a property there that is not one is reported (its default is
+/// written), an absent one is not.
+fn scalar(layer: &Layer, path: &str, what: &str, col: &mut Collector) -> Option<f64> {
+    match layer.props.prop(path).map(|p| &p.value) {
+        Some(Value::Scalar(v)) if v.is_finite() => Some(*v),
+        None => None,
+        Some(_) => {
+            col.lose(LossCategory::InvalidValues, format!("{what}: {path} is not a number, the default is written"));
+            None
+        }
+    }
+}
+
+fn has_keys_or_expr(layer: &Layer, path: &str) -> bool {
+    layer.props.prop(path).is_some_and(|p| !p.keys.is_empty() || p.expr.as_ref().is_some_and(|e| !e.text.is_empty()))
+}
+
+/// The camera's options; keys and expressions on them are reported (the static value is written).
+pub(crate) fn plan_camera(layer: &Layer, comp_width: u32, what: &str, col: &mut Collector) -> CameraPlan {
+    let default_zoom = f64::from(comp_width) * 50.0 / 36.0;
+    if matches!(layer.auto_orient, effectcraft_project::AutoOrient::AlongPath | effectcraft_project::AutoOrient::TowardsCamera) {
+        col.lose(LossCategory::Cameras, format!("{what}: the camera's Auto-Orient {:?} is not written (written as a one-node camera)", layer.auto_orient));
+    }
+    for id in ["zoom", "dof", "focusDistance", "aperture", "blurLevel"] {
+        if has_keys_or_expr(layer, &format!("cameraOptions/{id}")) {
+            col.lose(LossCategory::Cameras, format!("{what}: keys or an expression on the camera's {id} (the static value is written)"));
+        }
+    }
+    let iris_default = [
+        ("irisShape", 0.0),
+        ("irisRotation", 0.0),
+        ("irisRoundness", 0.0),
+        ("irisAspectRatio", 1.0),
+        ("irisDiffractionFringe", 0.0),
+        ("highlightGain", 0.0),
+        ("highlightThreshold", 255.0),
+        ("highlightSaturation", 0.0),
+    ];
+    for (id, d) in iris_default {
+        let v = match layer.props.prop(&format!("cameraOptions/{id}")).map(|p| &p.value) {
+            Some(Value::Scalar(v)) => Some(*v),
+            Some(Value::Enum(e)) => Some(f64::from(*e)),
+            _ => None,
+        };
+        if v.is_some_and(|v| (v - d).abs() > 1e-9) || has_keys_or_expr(layer, &format!("cameraOptions/{id}")) {
+            col.lose(LossCategory::Cameras, format!("{what}: the camera's {id} is not written (not sampled)"));
+        }
+    }
+    let dof = matches!(layer.props.prop("cameraOptions/dof").map(|p| &p.value), Some(Value::Bool(true)));
+    CameraPlan {
+        two_node: layer.auto_orient == effectcraft_project::AutoOrient::TowardsPointOfInterest,
+        zoom: scalar(layer, "cameraOptions/zoom", what, col).unwrap_or(default_zoom),
+        dof,
+        focus: scalar(layer, "cameraOptions/focusDistance", what, col).unwrap_or(default_zoom),
+        aperture: scalar(layer, "cameraOptions/aperture", what, col).unwrap_or(25.3 * f64::from(comp_width) / 1920.0),
+        blur: scalar(layer, "cameraOptions/blurLevel", what, col).unwrap_or(100.0),
+    }
+}
+
+/// The light's options, or `None` (reported) for a type without a sampled case.
+pub(crate) fn plan_light(layer: &Layer, kind: LightKind, what: &str, col: &mut Collector) -> Option<LightPlan> {
+    let code = match kind {
+        LightKind::Spot => 1,
+        LightKind::Point => 2,
+        other => {
+            col.lose(LossCategory::Lights, format!("{what}: a {} light is not written (not sampled)", other.label()));
+            return None;
+        }
+    };
+    // A spot light is written oriented towards its point of interest (a point light has no
+    // orientation that shows).
+    if code == 1 && layer.auto_orient != effectcraft_project::AutoOrient::TowardsPointOfInterest {
+        col.lose(LossCategory::Lights, format!("{what}: the light's Auto-Orient {:?} is written as towards the point of interest", layer.auto_orient));
+    }
+    for id in ["intensity", "color", "coneAngle", "coneFeather"] {
+        if has_keys_or_expr(layer, &format!("lightOptions/{id}")) {
+            col.lose(LossCategory::Lights, format!("{what}: keys or an expression on the light's {id} (the static value is written)"));
+        }
+    }
+    let defaults = [("radius", 500.0), ("falloffDistance", 500.0), ("shadowDarkness", 100.0), ("shadowDiffusion", 0.0)];
+    for (id, d) in defaults {
+        if scalar(layer, &format!("lightOptions/{id}"), what, col).is_some_and(|v| (v - d).abs() > 1e-9)
+            || has_keys_or_expr(layer, &format!("lightOptions/{id}"))
+        {
+            col.lose(LossCategory::Lights, format!("{what}: the light's {id} is not written (not sampled)"));
+        }
+    }
+    // Options that are not written at all: a value other than the default, or keys or an expression
+    // (which change the render even when the static value is the default).
+    if matches!(layer.props.prop("lightOptions/falloff").map(|p| &p.value), Some(Value::Enum(e)) if *e != 0) || has_keys_or_expr(layer, "lightOptions/falloff")
+    {
+        col.lose(LossCategory::Lights, format!("{what}: the light's falloff type is not written (not sampled)"));
+    }
+    if matches!(layer.props.prop("lightOptions/castsShadows").map(|p| &p.value), Some(Value::Bool(true)))
+        || has_keys_or_expr(layer, "lightOptions/castsShadows")
+    {
+        col.lose(LossCategory::Lights, format!("{what}: Casts Shadows is not written (not sampled)"));
+    }
+    let color = match layer.props.prop("lightOptions/color").map(|p| &p.value) {
+        Some(Value::Color(c)) => {
+            let out = [255.0, c[0] * 255.0, c[1] * 255.0, c[2] * 255.0].map(|v| if v.is_finite() { v.clamp(0.0, 255.0) } else { 255.0 });
+            if c.iter().take(3).zip(&out[1..]).any(|(v, o)| (v * 255.0).to_bits() != o.to_bits()) {
+                col.lose(LossCategory::Lights, format!("{what}: a light colour channel outside 0 to 1 is written as the nearest limit"));
+            }
+            out
+        }
+        _ => [255.0; 4],
+    };
+    Some(LightPlan {
+        kind: code,
+        intensity: scalar(layer, "lightOptions/intensity", what, col).unwrap_or(100.0),
+        color,
+        cone_angle: scalar(layer, "lightOptions/coneAngle", what, col).unwrap_or(90.0),
+        cone_feather: scalar(layer, "lightOptions/coneFeather", what, col).unwrap_or(50.0),
+    })
+}
+
+/// The option records: per match name the `tdbs` After Effects wrote when it was changed alone.
+pub(crate) struct OptionProtos {
+    pub records: Vec<(String, Chunk<'static>)>,
+}
+
+impl OptionProtos {
+    fn get(&self, name: &str) -> R<Chunk<'static>> {
+        self.records.iter().find(|(n, _)| n == name).map(|(_, c)| c.clone()).ok_or_else(|| tpl("camera / light option prototype missing"))
+    }
+}
+
+/// The order of the properties inside the Camera and Light Options groups (After Effects' own,
+/// as in 342 and 254 / 343: a record only where the value is not the default).
+const CAMERA_ORDER: &[&str] =
+    &["ADBE Camera Zoom", "ADBE Camera Depth of Field", "ADBE Camera Focus Distance", "ADBE Camera Aperture", "ADBE Camera Blur Level"];
+const LIGHT_ORDER: &[&str] = &[
+    "ADBE Light Env Atom",
+    "ADBE Light Backgd Visible",
+    "ADBE Light Backgd Opacity",
+    "ADBE Light Backgd Blur",
+    "ADBE Light Intensity",
+    "ADBE Light Color",
+    "ADBE Light Cone Angle",
+    "ADBE Light Cone Feather 2",
+    "ADBE Light Falloff Start",
+    "ADBE Light Falloff Distance",
+    "ADBE Casts Shadows",
+];
+
+pub(crate) fn tdmn_chunk(name: &str) -> Chunk<'static> {
+    let mut b = vec![0u8; 40];
+    for (i, c) in name.bytes().take(39).enumerate() {
+        b[i] = c;
+    }
+    Chunk::data(*b"tdmn", b)
+}
+
+fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let b = c.bytes()?;
+    let end = b.iter().position(|x| *x == 0).unwrap_or(b.len());
+    std::str::from_utf8(b.get(..end)?).ok().map(str::to_string)
+}
+
+/// Sets (or inserts) the records of an options group (`tdmn` named `group`) of a layer.
+fn put_group(layr: &mut Chunk<'static>, group: &str, order: &[&str], set: Vec<(&str, Chunk<'static>)>, remove: &[&str]) -> R<()> {
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at = kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(group)).ok_or_else(|| tpl("options group missing"))?;
+    let g = kids.get_mut(at + 1).ok_or_else(|| tpl("options group without a list"))?;
+    let gk = kids_mut(g)?;
+    let first = gk.iter().position(|c| c.is(b"tdmn")).unwrap_or(gk.len());
+    let header: Vec<Chunk<'static>> = gk.drain(..first).collect();
+    let mut pairs: Vec<(String, Vec<Chunk<'static>>)> = Vec::new();
+    let mut it = std::mem::take(gk).into_iter();
+    while let Some(m) = it.next() {
+        let name = tdmn_name(&m).unwrap_or_default();
+        if name == "ADBE Group End" {
+            pairs.push((name, vec![m]));
+            continue;
+        }
+        let Some(node) = it.next() else { break };
+        // An atom group (Light Env Atom) carries its own Group End inside the list.
+        pairs.push((name, vec![m, node]));
+    }
+    pairs.retain(|(n, _)| !remove.contains(&n.as_str()));
+    for (name, rec) in set {
+        let entry = vec![tdmn_chunk(name), rec];
+        match pairs.iter_mut().find(|(n, _)| n == name) {
+            Some(slot) => slot.1 = entry,
+            None => pairs.push((name.to_string(), entry)),
+        }
+    }
+    let rank = |n: &str| if n == "ADBE Group End" { usize::MAX } else { order.iter().position(|g| *g == n).unwrap_or(order.len()) };
+    pairs.sort_by_key(|(n, _)| rank(n));
+    gk.extend(header);
+    gk.extend(pairs.into_iter().flat_map(|(_, v)| v));
+    Ok(())
+}
+
+/// A copy of `proto` with the plain value `v` (`cdat` @0).
+fn with_value(mut proto: Chunk<'static>, v: f64) -> R<Chunk<'static>> {
+    put_f64(child_data(&mut proto, b"cdat")?, 0, v)?;
+    Ok(proto)
+}
+
+pub(crate) fn put_camera(layr: &mut Chunk<'static>, protos: &OptionProtos, p: &CameraPlan) -> R<()> {
+    // Every option is written explicitly (After Effects' defaults depend on the composition
+    // width); Zoom and Blur Level take the plain-double layout of Focus Distance (342).
+    let plain = protos.get("ADBE Camera Focus Distance")?;
+    let set = vec![
+        ("ADBE Camera Zoom", with_value(plain.clone(), p.zoom)?),
+        ("ADBE Camera Depth of Field", with_value(protos.get("ADBE Camera Depth of Field")?, if p.dof { 1.0 } else { 0.0 })?),
+        ("ADBE Camera Focus Distance", with_value(plain.clone(), p.focus)?),
+        ("ADBE Camera Aperture", with_value(protos.get("ADBE Camera Aperture")?, p.aperture)?),
+        ("ADBE Camera Blur Level", with_value(plain, p.blur)?),
+    ];
+    put_group(layr, "ADBE Camera Options Group", CAMERA_ORDER, set, &[])
+}
+
+pub(crate) fn put_light(layr: &mut Chunk<'static>, protos: &OptionProtos, p: &LightPlan) -> R<()> {
+    let mut set = Vec::new();
+    let mut remove = Vec::new();
+    if (p.intensity - 100.0).abs() > 1e-9 {
+        set.push(("ADBE Light Intensity", with_value(protos.get("ADBE Light Intensity")?, p.intensity)?));
+    } else {
+        remove.push("ADBE Light Intensity");
+    }
+    if p.color != [255.0; 4] {
+        let mut rec = protos.get("ADBE Light Color")?;
+        let d = child_data(&mut rec, b"cdat")?;
+        for (i, v) in p.color.iter().enumerate() {
+            put_f64(d, i * 8, *v)?;
+        }
+        set.push(("ADBE Light Color", rec));
+    }
+    // A spot light stores its cone only when it differs (343-345); a point light keeps the inert
+    // records of its block (252).
+    if p.kind == 1 {
+        if (p.cone_angle - 90.0).abs() > 1e-9 {
+            set.push(("ADBE Light Cone Angle", with_value(protos.get("ADBE Light Cone Angle")?, p.cone_angle)?));
+        }
+        if (p.cone_feather - 50.0).abs() > 1e-9 {
+            set.push(("ADBE Light Cone Feather 2", with_value(protos.get("ADBE Light Cone Feather 2")?, p.cone_feather)?));
+        }
+    }
+    put_group(layr, "ADBE Light Options Group", LIGHT_ORDER, set, &remove)
+}
diff --git a/crates/aep/src/export/effects.rs b/crates/aep/src/export/effects.rs
new file mode 100644
index 000000000..9e04a7a46
--- /dev/null
+++ b/crates/aep/src/export/effects.rs
@@ -0,0 +1,1221 @@
+//! Effects: the inverse of the importer, through the same table (`crate::effect_map`).
+//! An EffectCraft effect the table maps is written as the After Effects effect it came from:
+//!
+//! * the instance is the effect's default instance, built in code from the effect table
+//!   (`fx_defs`, `fxsynth`: `tdmn` + `sspc` with its full `parT` and the records After Effects
+//!   always keeps: the input layer, buttons, group markers, hidden entries, arbitrary data), with
+//!   its instance name and the owning layer's id in the input-layer record;
+//! * a parameter whose value differs from its `pard` default gets a value record (absent =
+//!   default, `docs/aep-format.md` 3.7). The record is built from the **record of its parameter
+//!   type**: over the whole corpus every static value record of a type has the same `tdsb` and
+//!   `tdb4` apart from the time scale (`@12`) and, for points, the layer aspect (`@24`), and a
+//!   slider's `tdum` / `tduM` repeat its `pard` slider range (float sliders `f32` @112 / @116,
+//!   fixed sliders 16.16 and integer sliders `i32` @132 / @136); its `tdsn` is the parameter's
+//!   name (a checkbox's `pdnm` label); `tests/effects.rs` rebuilds every value record of every
+//!   effect fixture and compares it with After Effects' bytes;
+//! * a keyed parameter turns its record into the keyed form of its kind (fixed slider 363, colour
+//!   364, point 382, float slider 397: `tdb4@5` bit 0 cleared, `cdat` replaced by the key list);
+//! * an expression is stored as on any property (534, R15);
+//! * Hue/Saturation's master values and Levels' RGB values are patched into the effect's
+//!   arbitrary data (444-446, 512-516);
+//! * the project lists each effect type in `Pefl` and keeps one definition copy per type in
+//!   `EfdG`; the first instance of a type in the file holds the full parameter definitions
+//!   (`parT`), every later one an empty `parT` (383).
+//!
+//! Units are the importer's inverse (`Conv`): colours straight RGBA 0..1 to ARGB 0..255 (alpha
+//! 255), points layer pixels to fractions of the layer size, percent sliders by their valid
+//! maximum, popups by item name to the file's 1-based index, checkboxes 1.0 when on.
+
+use std::collections::HashMap;
+use std::sync::OnceLock;
+
+use crate::effect_map::{Conv, EffectMap, Extra, HUE_SATURATION_MASTER, LEVELS_RGB, by_effect, by_match_name, popup_key};
+use crate::{AepFile, Body, CURVE_IDENTITY, Chunk, CurvesData, MeshData, ParamKind};
+use effectcraft_keyframe::{Interp, Keyframe, Value};
+use effectcraft_project::{GroupKind, Layer, LayerId, Node, ParamUi, PropGroup, Property};
+
+use crate::export::plan::{CompPlan, EaseSlot, KeyPlan, LIMIT};
+use crate::export::report::{Collector, LossCategory};
+use crate::export::tree::{R, child_data, child_mut, data_mut, kids_mut, list_mut, put, put_f64, put_u8, put_u16, put_u32, tpl};
+
+/// How a parameter is stored in its value record.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum PKind {
+    /// ARGB 0..255 (4 components).
+    Color,
+    /// Two fractions of the layer size.
+    Point,
+    /// A fixed slider (pard type 2): the number as it is.
+    Fixed,
+    /// An angle in degrees (pard type 3).
+    Angle,
+    /// An integer slider (pard type 1).
+    Int,
+    /// A float slider, stored as the float32 After Effects keeps (widened to f64).
+    Float,
+    /// A popup, stored 1-based.
+    Popup,
+    /// A checkbox, stored 1.0 when on.
+    Checkbox,
+}
+
+impl PKind {
+    fn of(k: ParamKind) -> Option<PKind> {
+        Some(match k {
+            ParamKind::Color => PKind::Color,
+            ParamKind::Point => PKind::Point,
+            ParamKind::FixedSlider => PKind::Fixed,
+            ParamKind::Angle => PKind::Angle,
+            ParamKind::IntSlider => PKind::Int,
+            ParamKind::FloatSlider => PKind::Float,
+            ParamKind::Popup => PKind::Popup,
+            ParamKind::Checkbox => PKind::Checkbox,
+            _ => return None,
+        })
+    }
+
+    /// The `pard` type code (`docs/aep-format.md` 3.7).
+    fn code(self) -> u32 {
+        match self {
+            PKind::Int => 1,
+            PKind::Fixed => 2,
+            PKind::Angle => 3,
+            PKind::Checkbox => 4,
+            PKind::Color => 5,
+            PKind::Point => 6,
+            PKind::Popup => 7,
+            PKind::Float => 10,
+        }
+    }
+
+    fn dims(self) -> usize {
+        match self {
+            PKind::Color => 4,
+            PKind::Point => 2,
+            _ => 1,
+        }
+    }
+}
+
+/// A parameter value in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum ParamValue {
+    Static(Vec<f64>),
+    Keys(Vec<KeyPlan>),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ParamPlan {
+    pub index: u16,
+    pub kind: PKind,
+    pub value: ParamValue,
+    /// The expression text and its enable switch.
+    pub expr: Option<(String, bool)>,
+}
+
+/// An effect instance in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct EffectPlan {
+    pub match_name: &'static str,
+    pub name: String,
+    pub params: Vec<ParamPlan>,
+    /// New arbitrary data for the parameter with this index (Hue/Saturation, Levels).
+    pub data: Option<(u16, Vec<u8>)>,
+    /// The layer each layer parameter names (by its index); absent = the owning layer.
+    pub layers: Vec<(u16, LayerPick)>,
+    /// The fx switch (the value group's `tdsb`: 1 on, 0 off).
+    pub enabled: bool,
+}
+
+/// What a layer parameter names (`docs/aep-format.md` 3.7: its record always exists, its `tdpi`
+/// is the chosen layer's id, the owning layer's own id by default, 0 for None; 320, 321, 904).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum LayerPick {
+    /// The layer that owns the effect (After Effects' default).
+    Owner,
+    /// None.
+    Nothing,
+    /// Another layer of the composition.
+    Layer(LayerId),
+}
+
+fn sane(v: f64) -> Option<f64> {
+    (v.is_finite() && v.abs() <= LIMIT).then_some(v)
+}
+
+// ---------------------------------------------------------------------------------------------
+// The parameter definitions of the prototypes (read once from the embedded effect template).
+
+/// One parameter definition of a prototype instance (`pard`, `pdnm`).
+#[derive(Clone, Debug, Default)]
+pub(crate) struct ParDef {
+    /// The parameter's match name (`<effect>-NNNN`), the name of its value record. The number in
+    /// it is not the position in `parT` (Fill: position 2 is `ADBE Fill-0007`, 215).
+    pub record: String,
+    /// `pard@12`.
+    pub code: u32,
+    /// `pard@16`, or a checkbox's `pdnm` label.
+    pub name: String,
+    /// The popup items (`pdnm`, separated by `|`).
+    pub items: Vec<String>,
+    /// The default in stored units (`pard@56`).
+    pub default: Vec<f64>,
+    /// The slider range a value record repeats as `tdum` / `tduM`.
+    pub range: Option<(f64, f64)>,
+    /// A slider's valid maximum (the table's scale check).
+    pub valid_max: Option<f64>,
+    /// The default arbitrary data (the `aRbp` after the `pard`).
+    pub data: Option<Vec<u8>>,
+}
+
+fn be_i32(d: &[u8], at: usize) -> Option<i32> {
+    Some(i32::from_be_bytes(d.get(at..at.checked_add(4)?)?.try_into().ok()?))
+}
+fn be_u32(d: &[u8], at: usize) -> Option<u32> {
+    Some(u32::from_be_bytes(d.get(at..at.checked_add(4)?)?.try_into().ok()?))
+}
+fn be_f32(d: &[u8], at: usize) -> Option<f64> {
+    Some(f64::from(f32::from_be_bytes(d.get(at..at.checked_add(4)?)?.try_into().ok()?)))
+}
+fn be_f64(d: &[u8], at: usize) -> Option<f64> {
+    Some(f64::from_be_bytes(d.get(at..at.checked_add(8)?)?.try_into().ok()?))
+}
+
+fn cname(d: &[u8]) -> String {
+    d.iter().take_while(|b| **b != 0).map(|b| char::from(*b)).collect()
+}
+
+impl ParDef {
+    fn from_pard(pard: &[u8], pdnm: Option<&str>, data: Option<&[u8]>) -> ParDef {
+        let code = be_u32(pard, 12).unwrap_or(u32::MAX);
+        let fx = |at: usize| be_i32(pard, at).map(|v| f64::from(v) / 65536.0);
+        let default: Vec<f64> = match code {
+            10 => be_f64(pard, 56).into_iter().collect(),
+            2 | 3 => fx(56).into_iter().collect(),
+            1 => be_i32(pard, 56).map(f64::from).into_iter().collect(),
+            4 | 7 => be_u32(pard, 56).map(f64::from).into_iter().collect(),
+            // Fractions of the layer, or percent after an After Effects re-save (see the reader).
+            6 => {
+                let p: Vec<f64> = [fx(56), fx(60)].into_iter().flatten().collect();
+                if p.iter().any(|c| c.abs() > 1.0 + 1e-9) { p.iter().map(|c| c / 100.0).collect() } else { p }
+            }
+            5 => pard.get(56..60).map(|c| c.iter().map(|b| f64::from(*b)).collect()).unwrap_or_default(),
+            _ => Vec::new(),
+        };
+        let range = match code {
+            10 => be_f32(pard, 112).zip(be_f32(pard, 116)),
+            2 => fx(132).zip(fx(136)),
+            1 => be_i32(pard, 132).map(f64::from).zip(be_i32(pard, 136).map(f64::from)),
+            _ => None,
+        };
+        let valid_max = match code {
+            10 => be_f32(pard, 108),
+            2 => fx(128),
+            1 => be_i32(pard, 128).map(f64::from),
+            _ => None,
+        };
+        let pname = pard.get(16..48).map(cname).unwrap_or_default();
+        let (name, items) = match (code, pdnm) {
+            (7, Some(p)) if !p.is_empty() => (pname, p.split('|').map(str::to_string).collect()),
+            (4, Some(p)) if pname.trim().is_empty() => (p.to_string(), Vec::new()),
+            _ => (pname, Vec::new()),
+        };
+        ParDef { record: String::new(), code, name, items, default, range, valid_max, data: data.map(<[u8]>::to_vec) }
+    }
+}
+
+/// The parameter definitions of an instance's `parT`, by position (the table's index).
+fn par_defs(sspc: &Chunk<'_>) -> HashMap<u16, ParDef> {
+    let mut out = HashMap::new();
+    let Some(part) = sspc.child_list(b"parT") else { return out };
+    let k = part.children();
+    let mut i = 0usize;
+    let mut position = 0u16;
+    while i < k.len() {
+        let (Some(m), Some(p)) = (k.get(i), k.get(i + 1)) else { break };
+        if !(m.is(b"tdmn") && p.is(b"pard")) {
+            i += 1;
+            continue;
+        }
+        let name = tdmn_name(m).unwrap_or_default();
+        let mut j = i + 2;
+        let mut pdnm = None;
+        let mut data = None;
+        while let Some(c) = k.get(j) {
+            if c.is(b"tdmn") {
+                break;
+            }
+            if c.is(b"pdnm") {
+                pdnm = c.children().iter().find(|u| u.is(b"Utf8")).and_then(|u| u.bytes()).map(|b| String::from_utf8_lossy(b).to_string());
+            }
+            if c.is(b"aRbp") {
+                data = c.bytes();
+            }
+            j += 1;
+        }
+        if let Some(bytes) = p.bytes() {
+            out.insert(position, ParDef { record: name, ..ParDef::from_pard(bytes, pdnm.as_deref(), data) });
+        }
+        position = position.saturating_add(1);
+        i = j;
+    }
+    out
+}
+
+/// The parameter definitions of every effect type, by match name (read from the default
+/// instances built from the effect table).
+fn defs() -> &'static HashMap<String, HashMap<u16, ParDef>> {
+    static DEFS: OnceLock<HashMap<String, HashMap<u16, ParDef>>> = OnceLock::new();
+    DEFS.get_or_init(|| {
+        crate::export::fx_defs::FX_DEFS.iter().map(|fx| (fx.match_name.to_string(), par_defs(&crate::export::fxsynth::default_sspc(fx)))).collect()
+    })
+}
+
+// ---------------------------------------------------------------------------------------------
+// Planning.
+
+/// The stored components of an EffectCraft value, `None` when it does not fit.
+fn stored(conv: Conv, kind: PKind, v: &Value, size: (f64, f64), ui: &ParamUi, def: &ParDef) -> Option<Vec<f64>> {
+    let c = v.components();
+    let g = |i: usize| c.get(i).copied().and_then(sane);
+    let one = |x: f64| -> Vec<f64> {
+        match kind {
+            // The float32 After Effects keeps (393, 394).
+            PKind::Float => vec![f64::from(x as f32)],
+            PKind::Int => vec![x.round()],
+            _ => vec![x],
+        }
+    };
+    Some(match conv {
+        Conv::Color => {
+            let ch = |i: usize| g(i).map(|x| x.clamp(0.0, 1.0) * 255.0);
+            vec![255.0, ch(0)?, ch(1)?, ch(2)?]
+        }
+        Conv::Point => vec![g(0)? / size.0.max(1.0), g(1)? / size.1.max(1.0)],
+        Conv::Percent { valid_max } => one(g(0)? * valid_max / 100.0),
+        Conv::Plain { .. } | Conv::Angle => one(g(0)?),
+        Conv::Factor { factor, .. } => one(g(0)? / factor),
+        Conv::Checkbox => match v {
+            Value::Bool(b) => vec![if *b { 1.0 } else { 0.0 }],
+            _ => vec![if g(0)? != 0.0 { 1.0 } else { 0.0 }],
+        },
+        Conv::Popup { items, .. } => {
+            let i = match v {
+                Value::Enum(i) => usize::try_from(*i).ok()?,
+                _ => usize::try_from(g(0)?.round() as i64).ok()?,
+            };
+            let ParamUi::Popup { options } = ui else { return None };
+            let name = options.get(i)?;
+            let file: Vec<&str> = if def.items.is_empty() { items.to_vec() } else { def.items.iter().map(String::as_str).collect() };
+            let at = file.iter().position(|f| f.trim() != "(-" && popup_key(f) == popup_key(name))?;
+            vec![f64::from(u32::try_from(at).ok()?.checked_add(1)?)]
+        }
+        // Not a value record (layer parameters, histograms).
+        Conv::LayerRef { .. } | Conv::Skip => return None,
+    })
+}
+
+/// Whether a popup's items are After Effects' items in the same order (separators included, as
+/// After Effects counts them), so an expression's 1-based result picks the same item in both.
+fn same_popup_order(items: &[&str], ui: &ParamUi, def: &ParDef) -> bool {
+    let ParamUi::Popup { options } = ui else { return false };
+    let file: Vec<&str> = if def.items.is_empty() { items.to_vec() } else { def.items.iter().map(String::as_str).collect() };
+    file.len() == options.len() && file.iter().zip(options).all(|(f, o)| f.trim() != "(-" && popup_key(f) == popup_key(o))
+}
+
+/// [`stored`], reporting what it changes in a value it can store: a colour channel outside 0 to 1
+/// (written as the nearest limit) and a fraction on an integer parameter (rounded).
+fn stored_reported(conv: Conv, kind: PKind, v: &Value, (size, ui, def): ((f64, f64), &ParamUi, &ParDef), what: &str, col: &mut Collector) -> Option<Vec<f64>> {
+    let s = stored(conv, kind, v, size, ui, def)?;
+    if matches!(conv, Conv::Color) {
+        let c = v.components();
+        if c.iter().take(3).any(|x| !(0.0..=1.0).contains(x)) {
+            col.lose(LossCategory::InvalidValues, format!("{what}: a colour channel outside 0 to 1 is written as the nearest limit"));
+        }
+        // After Effects' colour parameters have no opacity (written as 255); Drop Shadow, for
+        // one, uses EffectCraft's.
+        if c.get(3).is_some_and(|a| a.to_bits() != 1f64.to_bits()) {
+            col.lose(LossCategory::Effects, format!("{what}: the colour's opacity is not written"));
+        }
+    }
+    if kind == PKind::Int
+        && let Some(raw) = stored(conv, PKind::Fixed, v, size, ui, def)
+        && raw.iter().zip(&s).any(|(a, b)| a.to_bits() != b.to_bits())
+    {
+        col.lose(LossCategory::Effects, format!("{what}: {raw:?} is written as the whole number {s:?}"));
+    }
+    Some(s)
+}
+
+fn is_default(kind: PKind, s: &[f64], def: &ParDef) -> bool {
+    let tol = |a: f64, b: f64| {
+        let t = match kind {
+            // 16.16 defaults.
+            PKind::Fixed | PKind::Angle | PKind::Point => 1.0 / 65536.0,
+            _ => 1e-9 * a.abs().max(b.abs()).max(1.0),
+        };
+        (a - b).abs() <= t
+    };
+    match kind {
+        // Alpha is not editable in After Effects; the RGB channels decide.
+        PKind::Color => s.get(1..4).zip(def.default.get(1..4)).is_some_and(|(a, b)| a.iter().zip(b).all(|(x, y)| tol(*x, *y))),
+        _ => s.len() == def.default.len() && s.iter().zip(&def.default).all(|(a, b)| tol(*a, *b)),
+    }
+}
+
+/// Plans the effects of `layer` (its source is `size` pixels) and reports what cannot be written.
+pub(crate) fn plan_effects(layer: &Layer, size: (u32, u32), cp: &CompPlan, comp_name: &str, col: &mut Collector) -> Vec<EffectPlan> {
+    let Some(fx) = layer.effects() else { return Vec::new() };
+    let size = (f64::from(size.0.max(1)), f64::from(size.1.max(1)));
+    let mut out = Vec::new();
+    for node in &fx.children {
+        let Node::Group(g) = node else { continue };
+        let here = format!("{comp_name}: '{}' effect '{}'", layer.name, g.name);
+        let GroupKind::Effect { effect } = &g.kind else {
+            col.lose(LossCategory::Effects, format!("{here}: not an effect group"));
+            continue;
+        };
+        let (Some(spec), Some(pdefs)) = (by_effect(effect), by_effect(effect).and_then(|s| defs().get(s.match_name))) else {
+            col.lose(LossCategory::Effects, format!("{comp_name}: '{}' has the effect '{}' ({effect})", layer.name, g.name));
+            continue;
+        };
+        if g.label.is_some() {
+            col.lose(LossCategory::Effects, format!("{here}: the effect's label colour is not written"));
+        }
+        let mut params = Vec::new();
+        let mut layers = Vec::new();
+        for pm in spec.params {
+            let Some(prop) = g.prop(pm.target) else { continue };
+            let Ok(index) = u16::try_from(pm.index) else { continue };
+            if let Conv::LayerRef { own } = pm.conv {
+                if let Some(pick) = plan_layer_param(layer, g, pm.target, own, prop, &here, col) {
+                    layers.push((index, pick));
+                }
+                continue;
+            }
+            let (Some(kind), Some(def)) = (PKind::of(pm.kind), pdefs.get(&index)) else {
+                col.lose(LossCategory::Effects, format!("{here}: parameter '{}' has no prototype definition", prop.name));
+                continue;
+            };
+            if def.code != kind.code() {
+                col.lose(LossCategory::Effects, format!("{here}: parameter '{}': the prototype has another type", prop.name));
+                continue;
+            }
+            if let Some(pp) = plan_param(ParamIn { conv: pm.conv, kind, def, prop, size }, index, cp, &here, col) {
+                params.push(pp);
+            }
+        }
+        let data = match spec.extra {
+            Extra::Curves => plan_curves(g, pdefs, &here, col),
+            Extra::MeshWarp => plan_mesh(g, pdefs, size, &here, col),
+            _ => plan_extra(spec, g, pdefs, &here, col),
+        };
+        report_unmapped(g, (effect, spec), size, &here, col);
+        col.exported.effects = col.exported.effects.saturating_add(1);
+        out.push(EffectPlan {
+            match_name: spec.match_name,
+            name: crate::export::plan::cut_name(&g.name, 255, &here, col),
+            params,
+            data,
+            layers,
+            enabled: g.enabled,
+        });
+    }
+    out
+}
+
+/// A layer parameter (the importer's inverse, `Conv::LayerRef`): an unset layer is None where the
+/// owning layer is EffectCraft's own default (`own`, Layer Control) and the owning layer
+/// elsewhere (Compound Blur, Displacement Map, Set Matte: unset means "this layer" in both
+/// programs); `None` = the default, the owning layer.
+fn plan_layer_param(layer: &Layer, g: &PropGroup, target: &str, own: bool, prop: &Property, here: &str, col: &mut Collector) -> Option<LayerPick> {
+    let what = format!("{here}: parameter '{}'", prop.name);
+    if !prop.keys.is_empty() || prop.has_expression() {
+        col.lose(LossCategory::Effects, format!("{what}: keys or an expression on a layer parameter are not written, its value is"));
+    }
+    let pick = match prop.value {
+        Value::Layer(None) if own => LayerPick::Nothing,
+        Value::Layer(None) => LayerPick::Owner,
+        Value::Layer(Some(effectcraft_project::NO_LAYER)) => LayerPick::Nothing,
+        Value::Layer(Some(id)) if id == layer.id.0 => LayerPick::Owner,
+        Value::Layer(Some(id)) => LayerPick::Layer(LayerId(id)),
+        _ => {
+            col.lose(LossCategory::InvalidValues, format!("{what}: not a layer, the default was written"));
+            LayerPick::Owner
+        }
+    };
+    // After Effects hands the named layer's source to the effect (904 E24, the importer's
+    // companion `Source` = 0); another choice is not sampled. Layer Control (`own`) has no
+    // source choice in After Effects: it only names the layer.
+    if let LayerPick::Layer(_) = pick
+        && !own
+        && g.prop(&format!("{target}Source")).is_some_and(|s| !matches!(s.value, Value::Enum(0)))
+    {
+        col.lose(LossCategory::Effects, format!("{what}: the named layer's masks and effects are not applied in After Effects (it takes the layer's source)"));
+    }
+    (pick != LayerPick::Owner).then_some(pick)
+}
+
+/// Hue/Saturation's master values or Levels' RGB values, as new arbitrary data (the prototype's
+/// default data with the values patched in); `None` when they are at the default.
+fn plan_extra(spec: &EffectMap, g: &PropGroup, pdefs: &HashMap<u16, ParDef>, here: &str, col: &mut Collector) -> Option<(u16, Vec<u8>)> {
+    let ids: &[&str] = match spec.extra {
+        // (the Cryptomatte plug-in's settings are its own binary layout: not written, reported below)
+        Extra::None | Extra::Curves | Extra::MeshWarp | Extra::Lumetri | Extra::Cryptomatte | Extra::Extractor | Extra::Identifier => return None,
+        Extra::HueSaturation => &HUE_SATURATION_MASTER,
+        Extra::Levels => &LEVELS_RGB,
+    };
+    let mut values = Vec::with_capacity(ids.len());
+    for id in ids {
+        let v = g.prop(id).and_then(|p| {
+            if !p.keys.is_empty() || p.has_expression() {
+                col.lose(
+                    LossCategory::Effects,
+                    format!("{here}: keys or an expression on '{}' are not written (arbitrary data, the static value is written)", p.name),
+                );
+            }
+            let v = p.value.components().first().copied();
+            if v.is_some_and(|v| sane(v).is_none()) {
+                col.lose(LossCategory::InvalidValues, format!("{here}: '{}' is beyond the format's range, the default is written", p.name));
+            }
+            v.and_then(sane)
+        });
+        values.push(v);
+    }
+    let (index, mut data) = pdefs.iter().find(|(_, d)| d.code == 11).and_then(|(i, d)| d.data.clone().map(|data| (*i, data)))?;
+    let before = data.clone();
+    for (k, (id, v)) in ids.iter().zip(values).enumerate() {
+        let Some(v) = v else { continue };
+        if spec.extra == Extra::HueSaturation {
+            // Three i32 at 0, 4, 8 (444-446): whole degrees and percents.
+            let r = v.round().clamp(-1e6, 1e6);
+            if (r - v).abs() > 1e-9 {
+                col.lose(LossCategory::Effects, format!("{here}: '{id}' {v} is written as {r} (After Effects keeps whole numbers)"));
+            }
+            put(&mut data, k * 4, &(r as i32).to_be_bytes()).ok()?;
+        } else {
+            // The RGB channel's five f32 at 8.. (512-516).
+            put(&mut data, 8 + k * 4, &(v as f32).to_be_bytes()).ok()?;
+        }
+    }
+    (data != before).then_some((index, data))
+}
+
+/// `x,y` pairs (EffectCraft's curve points and mesh offsets; whitespace or `;` between pairs).
+fn pairs_of(s: &str) -> Vec<(f64, f64)> {
+    s.split(|c: char| c.is_whitespace() || c == ';')
+        .filter(|t| !t.is_empty())
+        .filter_map(|t| {
+            let (x, y) = t.split_once(',')?;
+            let (x, y) = (x.trim().parse::<f64>().ok()?, y.trim().split(',').next()?.trim().parse::<f64>().ok()?);
+            (x.is_finite() && y.is_finite()).then_some((x, y))
+        })
+        .collect()
+}
+
+/// The arbitrary-data parameter's index and default data.
+fn data_param(pdefs: &HashMap<u16, ParDef>) -> Option<(u16, Vec<u8>)> {
+    pdefs.iter().find(|(_, d)| d.code == 11).and_then(|(i, d)| d.data.clone().map(|data| (*i, data)))
+}
+
+fn static_str<'p>(g: &'p PropGroup, id: &str, here: &str, col: &mut Collector) -> Option<&'p str> {
+    let p = g.prop(id)?;
+    if !p.keys.is_empty() || p.has_expression() {
+        col.lose(LossCategory::Effects, format!("{here}: keys or an expression on '{}' are not written (arbitrary data, the static value is written)", p.name));
+    }
+    match &p.value {
+        Value::Str(s) => Some(s.as_str()),
+        _ => {
+            col.lose(LossCategory::InvalidValues, format!("{here}: '{}' is not text, the default is written", p.name));
+            None
+        }
+    }
+}
+
+/// Curves (FORMAT S.1): EffectCraft's points (0..1) as After Effects' whole 0..255 points, with
+/// the lookup tables After Effects stores for them (the natural spline); `None` at the default.
+fn plan_curves(g: &PropGroup, pdefs: &HashMap<u16, ParDef>, here: &str, col: &mut Collector) -> Option<(u16, Vec<u8>)> {
+    let mut curves: [Vec<(u8, u8)>; 5] = Default::default();
+    for (slot, id) in curves.iter_mut().zip(["rgb", "red", "green", "blue", "alpha"]) {
+        let pts = static_str(g, id, here, col).map(pairs_of).unwrap_or_default();
+        let mut ints: Vec<(u8, u8)> = Vec::with_capacity(pts.len());
+        let (mut rounded, mut clipped) = (false, false);
+        for (x, y) in pts {
+            let (x, y) = (x * 255.0, y * 255.0);
+            let (xs, ys) = (x.clamp(0.0, 255.0), y.clamp(0.0, 255.0));
+            clipped |= xs.to_bits() != x.to_bits() || ys.to_bits() != y.to_bits();
+            rounded |= (xs - xs.round()).abs() > 1e-3 || (ys - ys.round()).abs() > 1e-3;
+            ints.push((xs.round() as u8, ys.round() as u8));
+        }
+        // Points with the same input are merged as EffectCraft's own curve merges them (the
+        // first is kept), and fewer than two points are the identity there too.
+        ints.sort_by_key(|p| p.0);
+        ints.dedup_by_key(|p| p.0);
+        if clipped {
+            col.lose(LossCategory::Effects, format!("{here}: curve '{id}' points outside 0 to 1 are written as the nearest limit"));
+        }
+        if rounded {
+            col.lose(LossCategory::Effects, format!("{here}: curve '{id}' points rounded to whole levels (After Effects keeps 0..255)"));
+        }
+        if ints.len() > 16 {
+            col.lose(LossCategory::Effects, format!("{here}: curve '{id}' has {} points, After Effects keeps 16; the first 16 are written", ints.len()));
+            ints.truncate(16);
+        }
+        *slot = if ints.len() < 2 { CURVE_IDENTITY.to_vec() } else { ints };
+    }
+    let d = CurvesData { curves };
+    if d.is_default() {
+        return None;
+    }
+    let (index, _) = data_param(pdefs)?;
+    match d.to_bytes() {
+        Some(bytes) => Some((index, bytes)),
+        None => {
+            col.lose(LossCategory::Effects, format!("{here}: the curves cannot be written, the default is"));
+            None
+        }
+    }
+}
+
+/// Mesh Warp (FORMAT S.2): EffectCraft's per-vertex pixel offsets as After Effects' vertices
+/// (fractions of the layer) with their default handles moved along; `None` at the default.
+fn plan_mesh(g: &PropGroup, pdefs: &HashMap<u16, ParDef>, size: (f64, f64), here: &str, col: &mut Collector) -> Option<(u16, Vec<u8>)> {
+    let int = |id: &str| g.prop(id).map(|p| p.value.as_f64().round().clamp(1.0, 31.0) as u32).unwrap_or(7);
+    let (rows, columns) = (int("rows"), int("columns"));
+    // Per vertex `dx,dy` (pixels), optionally followed by the eight pixel moves of its handles
+    // (top, right, bottom, left) that the importer keeps.
+    let offs: Vec<Vec<f64>> = static_str(g, "mesh", here, col)
+        .map(|s| {
+            s.split(|c: char| c.is_whitespace() || c == ';')
+                .filter(|t| !t.is_empty())
+                .filter_map(|t| {
+                    let v: Vec<f64> = t.split(',').map(|x| x.trim().parse::<f64>().ok().filter(|x| x.is_finite())).collect::<Option<_>>()?;
+                    (v.len() >= 2).then_some(v)
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    let count = usize::try_from((rows + 1) * (columns + 1)).ok()?;
+    let moved = offs.iter().any(|v| v.iter().any(|x| *x != 0.0));
+    if !moved && rows == 7 && columns == 7 {
+        return None;
+    }
+    if moved && offs.len() != count {
+        col.lose(
+            LossCategory::Effects,
+            format!("{here}: the Distortion Mesh has {} vertices for {columns} x {rows} cells, an undistorted mesh is written", offs.len()),
+        );
+    }
+    let (index, default) = data_param(pdefs)?;
+    let tail = MeshData::parse(&default).map(|m| m.tail).unwrap_or([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x0d, 0x0d]);
+    let mut vertices = Vec::with_capacity(count);
+    for k in 0..count {
+        let k32 = u32::try_from(k).ok()?;
+        let (i, j) = (k32 % (columns + 1), k32 / (columns + 1));
+        let mut v = MeshData::default_vertex(columns, rows, i, j);
+        if offs.len() == count
+            && let Some(o) = offs.get(k)
+        {
+            // A moved vertex carries its handles along (985), then each handle its own move.
+            let at = |n: usize| o.get(n).copied().unwrap_or(0.0);
+            let (fx, fy) = ((at(0) / size.0) as f32, (at(1) / size.1) as f32);
+            for (n, p) in v.iter_mut().enumerate() {
+                if n == 0 || *p != [0.0, 0.0] {
+                    let (hx, hy) = if n == 0 { (0.0, 0.0) } else { ((at(2 * n) / size.0) as f32, (at(2 * n + 1) / size.1) as f32) };
+                    *p = [p[0] + fx + hx, p[1] + fy + hy];
+                }
+            }
+        }
+        vertices.push(v);
+    }
+    MeshData { columns, rows, tail, vertices }.to_bytes().map(|b| (index, b))
+}
+
+/// EffectCraft parameters the table does not map are lost when they carry anything.
+/// Reports the parameters of `g` the table has no record for: with keys or an expression, or at
+/// a value other than the one a new instance of the effect has.
+fn report_unmapped(g: &PropGroup, (effect, spec): (&str, &EffectMap), size: (f64, f64), here: &str, col: &mut Collector) {
+    let mut next = 1;
+    let fresh = |size: [f64; 2], next: &mut u64| {
+        effectcraft_effects::find(effect).map(|s| effectcraft_effects::instantiate(s, &mut effectcraft_project::build::Ids(next), &g.name, size))
+    };
+    // A default that depends on the layer size (a centre point) is not compared: the size an
+    // effect was added at is not known here.
+    let (fresh, other) = (fresh([size.0, size.1], &mut next), fresh([size.0 * 2.0 + 7.0, size.1 * 3.0 + 5.0], &mut next));
+    let extra: &[&str] = match spec.extra {
+        // Lumetri Color, EXtractoR and IDentifier have no prototype to write from, so they never
+        // get this far (they are reported).
+        Extra::None | Extra::Lumetri | Extra::Cryptomatte | Extra::Extractor | Extra::Identifier => &[],
+        Extra::HueSaturation => &HUE_SATURATION_MASTER,
+        Extra::Levels => &LEVELS_RGB,
+        Extra::Curves => &["channel", "rgb", "red", "green", "blue", "alpha"],
+        Extra::MeshWarp => &["mesh"],
+    };
+    let mut stack: Vec<(&PropGroup, String)> = vec![(g, String::new())];
+    let mut steps = 0usize;
+    while let Some((grp, prefix)) = stack.pop() {
+        steps += 1;
+        if steps > 10_000 {
+            break;
+        }
+        for n in &grp.children {
+            match n {
+                Node::Group(sub) => stack.push((sub, format!("{prefix}{}/", sub.match_id))),
+                Node::Prop(p) => {
+                    let path = format!("{prefix}{}", p.match_id);
+                    // A layer parameter's source companion is checked with the parameter (`plan_layer_param`).
+                    let companion = spec.params.iter().any(|s| matches!(s.conv, Conv::LayerRef { .. }) && path == format!("{}Source", s.target));
+                    if spec.params.iter().any(|s| s.target == path) || extra.contains(&path.as_str()) || companion {
+                        continue;
+                    }
+                    if !p.keys.is_empty() || p.has_expression() {
+                        col.lose(LossCategory::Effects, format!("{here}: parameter '{}' has no After Effects counterpart", p.name));
+                    } else if let Some(d) = fresh.as_ref().and_then(|f| f.prop(&path))
+                        && other.as_ref().and_then(|f| f.prop(&path)).is_some_and(|o| o.value == d.value)
+                        && d.value != p.value
+                    {
+                        col.lose(LossCategory::Effects, format!("{here}: parameter '{}' has no After Effects counterpart, its value is not written", p.name));
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// One effect parameter to plan: its table conversion, stored kind, prototype definition and
+/// property, and the layer's source size.
+#[derive(Clone, Copy)]
+struct ParamIn<'a> {
+    conv: Conv,
+    kind: PKind,
+    def: &'a ParDef,
+    prop: &'a Property,
+    size: (f64, f64),
+}
+
+fn plan_param(pin: ParamIn<'_>, index: u16, cp: &CompPlan, here: &str, col: &mut Collector) -> Option<ParamPlan> {
+    let ParamIn { conv, kind, def, prop, size } = pin;
+    let what = format!("{here}: parameter '{}'", prop.name);
+    // The table's scale was verified with this valid maximum (the importer checks the same).
+    let vm = match conv {
+        Conv::Percent { valid_max } | Conv::Plain { valid_max } | Conv::Factor { valid_max, .. } => Some(valid_max),
+        _ => None,
+    };
+    if let (Some(want), Some(found)) = (vm, def.valid_max)
+        && (want - found).abs() > want.abs() * 1e-6
+    {
+        col.lose(LossCategory::Effects, format!("{what}: the prototype's scale differs from the table's, not written"));
+        return None;
+    }
+    let expr = prop.expr.as_ref().filter(|e| !e.text.is_empty()).map(|e| (e.text.clone(), e.enabled));
+    if expr.is_some() {
+        col.exported.expressions = col.exported.expressions.saturating_add(1);
+        // The expression is written as it is; where the stored value is scaled (a percent or
+        // factor parameter has other units) or a popup's items are in another order, its result
+        // means something else in After Effects. Popups count from 1 in both programs' expressions.
+        let other_units = match conv {
+            Conv::Popup { items, .. } => !same_popup_order(items, &prop.ui, def),
+            Conv::Percent { valid_max } => (valid_max - 100.0).abs() > 1e-9,
+            Conv::Factor { factor, .. } => (factor - 1.0).abs() > 1e-9,
+            _ => false,
+        };
+        if other_units {
+            col.lose(LossCategory::Expressions, format!("{what}: the expression is written, but After Effects reads its result in other units"));
+        }
+    }
+    if prop.keys.is_empty() {
+        let Some(s) = stored_reported(conv, kind, &prop.value, (size, &prop.ui, def), &what, col) else {
+            if matches!(conv, Conv::Popup { .. }) {
+                col.lose(LossCategory::Effects, format!("{what}: the popup item has no After Effects counterpart, the default was written"));
+            } else {
+                col.lose(LossCategory::InvalidValues, format!("{what}: a value that cannot be stored, the default was written"));
+            }
+            return None;
+        };
+        // A property with an expression keeps its record, also at the default (R15).
+        if is_default(kind, &s, def) && expr.is_none() {
+            return None;
+        }
+        return Some(ParamPlan { index, kind, value: ParamValue::Static(s), expr });
+    }
+    if !matches!(kind, PKind::Fixed | PKind::Float | PKind::Color | PKind::Point) {
+        col.lose(
+            LossCategory::Effects,
+            format!("{what}: keys on a popup, checkbox, angle or integer slider are not written (not sampled), the first key's value was written"),
+        );
+        let first = prop.keys.first().map(|k| &k.value).unwrap_or(&prop.value);
+        let s = stored_reported(conv, kind, first, (size, &prop.ui, def), &what, col)?;
+        return (!is_default(kind, &s, def) || expr.is_some()).then_some(ParamPlan { index, kind, value: ParamValue::Static(s), expr });
+    }
+    let keys = plan_keys(pin, cp, &what, col);
+    if keys.is_empty() {
+        return None;
+    }
+    col.exported.keyframes = col.exported.keyframes.saturating_add(keys.len());
+    Some(ParamPlan { index, kind, value: ParamValue::Keys(keys), expr })
+}
+
+fn plan_keys(pin: ParamIn<'_>, cp: &CompPlan, what: &str, col: &mut Collector) -> Vec<KeyPlan> {
+    let ParamIn { conv, kind, def, prop, size } = pin;
+    let keys: &[Keyframe] = &prop.keys;
+    let mut timed: Vec<(i64, &Keyframe)> = Vec::with_capacity(keys.len());
+    for k in keys {
+        let (u, inexact) = cp.tb.units(k.time);
+        if inexact {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: key at {:.4} s moved to the time base", k.time.seconds()));
+        }
+        timed.push((u, k));
+    }
+    timed.sort_by_key(|(u, _)| *u);
+    let before = timed.len();
+    timed.dedup_by_key(|(u, _)| *u);
+    if timed.len() != before {
+        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: keys at the same time were merged"));
+    }
+    // The ease of colour keys is sampled only as speed 0 / influence 0, which After Effects
+    // interpolates linearly (598): a colour key is written linear.
+    let ease_ok = matches!(kind, PKind::Fixed | PKind::Float | PKind::Point);
+    // Ease speeds are in stored units per second; a point's in pixels per second over the layer
+    // height (597, 598, 730).
+    let factor = match conv {
+        Conv::Percent { valid_max } => 100.0 / valid_max,
+        Conv::Factor { factor, .. } => factor,
+        Conv::Point => size.1.max(1.0),
+        _ => 1.0,
+    };
+    let mut out = Vec::with_capacity(timed.len());
+    let beyond = std::cell::Cell::new(false);
+    for (u, k) in timed {
+        let Ok(time) = i32::try_from(u) else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: key time out of range, key dropped"));
+            continue;
+        };
+        let Some(value) = stored_reported(conv, kind, &k.value, (size, &prop.ui, def), what, col) else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: a key value that cannot be stored, key dropped"));
+            continue;
+        };
+        let mut side = |i: Interp| -> u8 {
+            match i {
+                Interp::Linear => 1,
+                Interp::Hold => 3,
+                Interp::Bezier if ease_ok => 2,
+                Interp::Bezier => {
+                    col.lose(
+                        LossCategory::ApproximatedKeyframes,
+                        format!("{what}: bezier ease of a colour key is written as linear (only speed 0 / influence 0 is sampled)"),
+                    );
+                    1
+                }
+            }
+        };
+        let (in_i, out_i) = (side(k.in_interp), side(k.out_interp));
+        let ease = |eases: &[effectcraft_keyframe::Ease], on: bool| -> Vec<EaseSlot> {
+            if !on {
+                return vec![EaseSlot::default()];
+            }
+            let e = crate::export::plan::key_ease(eases, 0);
+            let speed = sane(e.speed / factor).unwrap_or_else(|| {
+                beyond.set(true);
+                0.0
+            });
+            let influence = if e.influence.is_finite() { e.influence.clamp(0.001, 1.0) } else { 1.0 / 3.0 };
+            vec![EaseSlot { speed, influence }]
+        };
+        let (mut tin, mut tout) = ([0.0; 3], [0.0; 3]);
+        if kind == PKind::Point {
+            for (t, s) in [(&mut tin, k.spatial_in), (&mut tout, k.spatial_out)] {
+                for (o, v) in t.iter_mut().zip([s[0] / size.0, s[1] / size.1]) {
+                    *o = sane(v).unwrap_or_else(|| {
+                        beyond.set(true);
+                        0.0
+                    });
+                }
+            }
+        }
+        out.push(KeyPlan {
+            time,
+            value,
+            in_interp: in_i,
+            out_interp: out_i,
+            in_ease: ease(&k.in_ease, in_i == 2),
+            out_ease: ease(&k.out_ease, out_i == 2),
+            spatial_in: tin,
+            spatial_out: tout,
+            spatial_auto: kind != PKind::Point || k.spatial_auto,
+            roving: false,
+            label: k.label.min(16),
+        });
+        if k.roving {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: a roving key is written as a normal key"));
+        }
+    }
+    crate::export::plan::report_beyond(beyond.get(), what, col);
+    out
+}
+
+// ---------------------------------------------------------------------------------------------
+// Emit.
+
+/// The effect prototypes, built in code ([`FxProtos::build`]).
+pub(crate) struct FxProtos {
+    /// match name -> (`tdmn`, default `sspc`, `EfDf` definition copy).
+    defaults: HashMap<String, (Chunk<'static>, Chunk<'static>, Chunk<'static>)>,
+    /// `pard` type code -> the static value record of that type.
+    kinds: HashMap<u32, Chunk<'static>>,
+    /// Keyed value records by kind.
+    keyed: Vec<(KeyedKind, Chunk<'static>)>,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum KeyedKind {
+    Fixed,
+    Color,
+    Point,
+    Float,
+}
+
+fn keyed_kind(k: PKind) -> Option<KeyedKind> {
+    match k {
+        PKind::Fixed => Some(KeyedKind::Fixed),
+        PKind::Color => Some(KeyedKind::Color),
+        PKind::Point => Some(KeyedKind::Point),
+        PKind::Float => Some(KeyedKind::Float),
+        _ => None,
+    }
+}
+
+pub(crate) fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let d = c.bytes()?;
+    Some(d.iter().take_while(|b| **b != 0).map(|b| char::from(*b)).collect())
+}
+
+impl FxProtos {
+    /// The prototypes built in code from the effect table (`fx_defs`, `fxsynth`).
+    pub(crate) fn build() -> FxProtos {
+        use crate::export::fxsynth::value_spec;
+        let mut defaults = HashMap::new();
+        for fx in crate::export::fx_defs::FX_DEFS {
+            let sspc = crate::export::fxsynth::default_sspc(fx);
+            let m = crate::export::synth::tdmn(fx.match_name);
+            let efdf = Chunk::list(*b"EfDf", vec![m.clone(), sspc.clone()]);
+            defaults.insert(fx.match_name.to_string(), (m, sspc, efdf));
+        }
+        let kinds = [1u8, 2, 3, 4, 5, 6, 7, 10]
+            .iter()
+            .filter_map(|c| value_spec(*c, None).map(|s| (u32::from(*c), crate::export::synth::tdbs(&s, false, 25_600))))
+            .collect();
+        let keyed = [(KeyedKind::Fixed, 2u8), (KeyedKind::Color, 5), (KeyedKind::Point, 6), (KeyedKind::Float, 10)]
+            .iter()
+            .filter_map(|(k, c)| value_spec(*c, None).map(|s| (*k, crate::export::synth::tdbs(&s, true, 25_600))))
+            .collect();
+        FxProtos { defaults, kinds, keyed }
+    }
+}
+
+/// Which effect types already have an instance with full definitions in the file, in the order
+/// they first appear.
+#[derive(Default)]
+pub(crate) struct FxUse {
+    pub types: Vec<&'static str>,
+}
+
+/// A `tdsn` chunk holding `text`.
+fn tdsn(text: &str) -> Chunk<'static> {
+    nested(*b"tdsn", text)
+}
+
+/// A chunk that holds one `Utf8` chunk (`tdsn`, `fnam`).
+fn nested(id: [u8; 4], text: &str) -> Chunk<'static> {
+    Chunk { id, body: Body::Chunks(vec![Chunk::data(*b"Utf8", text.as_bytes().to_vec())]), pad: None }
+}
+
+/// The value record of `p`, built from the record of its parameter type.
+pub(crate) fn value_record(protos: &FxProtos, p: &ParamPlan, def: &ParDef, source_size: (u32, u32)) -> R<(Chunk<'static>, Chunk<'static>)> {
+    let mut rec = protos.kinds.get(&p.kind.code()).cloned().ok_or_else(|| tpl("effect value prototype missing"))?;
+    {
+        let kids = kids_mut(&mut rec)?;
+        if let Some(slot) = kids.iter_mut().find(|c| c.is(b"tdsn"))
+            && !def.name.is_empty()
+        {
+            *slot = tdsn(&def.name);
+        }
+    }
+    if p.kind == PKind::Point {
+        // The layer's aspect, as on the Anchor Point (369: 16 / 9, 383: 1 on 100 x 100).
+        put_f64(child_data(&mut rec, b"tdb4")?, 24, f64::from(source_size.0) / f64::from(source_size.1.max(1)))?;
+    }
+    if let Some((lo, hi)) = def.range {
+        put_f64(child_data(&mut rec, b"tdum")?, 0, lo)?;
+        put_f64(child_data(&mut rec, b"tduM")?, 0, hi)?;
+    }
+    match &p.value {
+        ParamValue::Static(v) => {
+            let cdat = child_data(&mut rec, b"cdat")?;
+            cdat.iter_mut().for_each(|b| *b = 0);
+            for (i, x) in v.iter().enumerate() {
+                put_f64(cdat, i * 8, *x)?;
+            }
+        }
+        ParamValue::Keys(keys) => {
+            let kk = keyed_kind(p.kind).ok_or_else(|| tpl("keys on a parameter kind without a keyed prototype"))?;
+            let proto = protos.keyed.iter().find(|(k, _)| *k == kk).map(|(_, c)| c).ok_or_else(|| tpl("keyed effect prototype missing"))?;
+            let mut list = proto.child_list(b"list").cloned().ok_or_else(|| tpl("keyed effect prototype without keys"))?;
+            {
+                // Static and keyed records of the same parameter differ in `tdb4` bytes 5 (the
+                // static bit), 68 (has keys) and 79 (spatial kinds only): taken from the keyed
+                // record of the kind (362 / 363, 359 / 364, 369 / 382, 391 / 397).
+                let ktdb4 = proto.child(b"tdb4").and_then(|c| c.bytes()).ok_or_else(|| tpl("keyed effect prototype without tdb4"))?;
+                let tdb4 = child_data(&mut rec, b"tdb4")?;
+                for at in [5usize, 68, 79] {
+                    put_u8(tdb4, at, *ktdb4.get(at).ok_or_else(|| tpl("short tdb4"))?)?;
+                }
+            }
+            let n = u32::try_from(keys.len()).map_err(|_| tpl("too many keys"))?;
+            let dims = p.kind.dims();
+            let size = match kk {
+                KeyedKind::Fixed | KeyedKind::Float => 8 + 40 * dims,
+                KeyedKind::Color | KeyedKind::Point => 56 + 24 * dims,
+            };
+            {
+                let lhd3 = child_data(&mut list, b"lhd3")?;
+                crate::export::synth::put_key_counts(lhd3, n, u32::try_from(size).map_err(|_| tpl("record size"))?)?;
+            }
+            let mut ldat = Vec::with_capacity(size * keys.len());
+            for k in keys {
+                ldat.extend(match kk {
+                    KeyedKind::Fixed | KeyedKind::Float => crate::export::emit::plain_record(1, k, size)?,
+                    KeyedKind::Color | KeyedKind::Point => spatial_record(kk, k, dims, size)?,
+                });
+            }
+            {
+                let lk = kids_mut(&mut list)?;
+                match lk.iter_mut().find(|c| c.is(b"ldat")) {
+                    Some(c) => *c = Chunk::data(*b"ldat", ldat),
+                    None => lk.push(Chunk::data(*b"ldat", ldat)),
+                }
+            }
+            let kids = kids_mut(&mut rec)?;
+            let at = kids.iter().position(|c| c.is(b"cdat")).ok_or_else(|| tpl("value record without cdat"))?;
+            if let Some(slot) = kids.get_mut(at) {
+                *slot = list;
+            }
+        }
+    }
+    if let Some((text, enabled)) = &p.expr {
+        // `tdb4@120` = 1 and the text before `tdum` (534; unlike the Transform properties,
+        // bytes 76 and 77 stay 0); `@119` the disabled switch as on the Transform properties (R15).
+        {
+            let tdb4 = child_data(&mut rec, b"tdb4")?;
+            put_u8(tdb4, 120, 1)?;
+            put_u8(tdb4, 119, u8::from(!*enabled))?;
+        }
+        let kids = kids_mut(&mut rec)?;
+        let at = kids.iter().position(|c| c.is(b"tdum")).unwrap_or(kids.len());
+        kids.insert(at, Chunk::data(*b"Utf8", text.as_bytes().to_vec()));
+    }
+    Ok((Chunk::data(*b"tdmn", tdmn_bytes(&def.record)), rec))
+}
+
+/// A key of a colour (flags `0x0001`, 210, 364) or point (flags `0x0007`, `u32@8` the automatic
+/// tangent switch, 382) parameter: the spatial layout with the value at 56.
+fn spatial_record(kk: KeyedKind, k: &KeyPlan, n: usize, size: usize) -> R<Vec<u8>> {
+    let mut r = vec![0u8; size];
+    put(&mut r, 0, &k.time.to_be_bytes())?;
+    put_u8(&mut r, 4, k.in_interp)?;
+    put_u8(&mut r, 5, k.out_interp)?;
+    let base: u16 = if kk == KeyedKind::Point { 0x0007 } else { 0x0001 };
+    put_u16(&mut r, 6, base | (u16::from(k.label) << 6))?;
+    if kk == KeyedKind::Point {
+        put_u32(&mut r, 8, u32::from(k.spatial_auto))?;
+        // The temporal ease (598): speed in layer heights per second, influence a fraction.
+        let (i, o) = (k.in_ease.first().copied().unwrap_or_default(), k.out_ease.first().copied().unwrap_or_default());
+        put_f64(&mut r, 24, i.speed)?;
+        put_f64(&mut r, 32, i.influence)?;
+        put_f64(&mut r, 40, o.speed)?;
+        put_f64(&mut r, 48, o.influence)?;
+    }
+    for j in 0..n {
+        put_f64(&mut r, 56 + 8 * j, k.value.get(j).copied().unwrap_or(0.0))?;
+        if kk == KeyedKind::Point {
+            put_f64(&mut r, 56 + 8 * n + 8 * j, k.spatial_in.get(j).copied().unwrap_or(0.0))?;
+            put_f64(&mut r, 56 + 16 * n + 8 * j, k.spatial_out.get(j).copied().unwrap_or(0.0))?;
+        }
+    }
+    Ok(r)
+}
+
+/// A match name padded to the 40 bytes of `tdmn`.
+fn tdmn_bytes(name: &str) -> Vec<u8> {
+    let mut v = vec![0u8; 40];
+    for (i, b) in name.bytes().take(39).enumerate() {
+        if let Some(slot) = v.get_mut(i) {
+            *slot = b;
+        }
+    }
+    v
+}
+
+/// The `tdmn` + `sspc` of one instance on the layer with id `layer_id`.
+fn instance(
+    protos: &FxProtos,
+    fx: &EffectPlan,
+    layer_id: u32,
+    layer_ids: &HashMap<LayerId, u32>,
+    source_size: (u32, u32),
+    uses: &mut FxUse,
+) -> R<Vec<Chunk<'static>>> {
+    let (tdmn, sspc, _) = protos.defaults.get(fx.match_name).ok_or_else(|| tpl("effect prototype missing"))?;
+    let mut sspc = sspc.clone();
+    let pdefs = par_defs(&sspc);
+    // `fnam` keeps the effect's own name; a name of the user's goes into the value group's
+    // `tdsn`, which holds the placeholder `-_0_/-` otherwise (610 against 609).
+    let own = child_mut(&mut sspc, b"fnam")?.children().iter().find(|c| c.is(b"Utf8")).and_then(|c| c.bytes()).map(|b| String::from_utf8_lossy(b).to_string());
+    if own.as_deref() != Some(fx.name.as_str()) && !fx.name.is_empty() {
+        let values = list_mut(&mut sspc, b"tdgp")?;
+        let slot = child_mut(values, b"tdsn")?;
+        *slot = nested(*b"tdsn", &fx.name);
+    }
+    // The fx switch: the value group's `tdsb` (`fx-switch` cases).
+    put_u32(child_data(list_mut(&mut sspc, b"tdgp")?, b"tdsb")?, 0, u32::from(fx.enabled))?;
+    let mut records = Vec::with_capacity(fx.params.len());
+    for p in &fx.params {
+        let def = pdefs.get(&p.index).ok_or_else(|| tpl("parameter definition missing"))?;
+        records.push((p.index, value_record(protos, p, def, source_size)?));
+    }
+    {
+        let values = list_mut(&mut sspc, b"tdgp")?;
+        let kids = kids_mut(values)?;
+        // The input layer (`-0000`) names the layer that owns the effect (320).
+        let tdpi_of = |kids: &mut Vec<Chunk<'static>>, record: &str| -> Option<usize> {
+            kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(record)).map(|i| i + 1)
+        };
+        let input = pdefs.get(&0).map(|d| d.record.clone()).unwrap_or_default();
+        // The prototype's own layer id (its input layer), to tell "the owning layer" from None.
+        let mut proto_owner = None;
+        if let Some(at) = tdpi_of(kids, &input)
+            && let Some(node) = kids.get_mut(at)
+        {
+            let tdpi = child_data(node, b"tdpi")?;
+            proto_owner = tdpi.get(0..4).and_then(|b| b.try_into().ok()).map(u32::from_be_bytes);
+            put_u32(tdpi, 0, layer_id)?;
+        }
+        // Every layer parameter's record exists in the prototype (its `tdpi` the prototype's
+        // default): a mapped one names what the plan says (the owning layer by default; a layer
+        // that is not exported was reported and left out of the plan in
+        // `plan::resolve_effect_layers`); an unmapped one keeps its default, the prototype's own
+        // layer becoming the owning layer and None (0) staying None (Timewarp's Matte / Warp
+        // Layer, 529).
+        let mapped: Vec<u16> = by_match_name(fx.match_name)
+            .map(|s| s.params.iter().filter(|p| matches!(p.conv, Conv::LayerRef { .. })).filter_map(|p| u16::try_from(p.index).ok()).collect())
+            .unwrap_or_default();
+        for (index, def) in &pdefs {
+            if *index == 0 || def.code != 0 {
+                continue;
+            }
+            let Some(at) = tdpi_of(kids, &def.record) else { continue };
+            let Some(node) = kids.get_mut(at) else { continue };
+            let tdpi = child_data(node, b"tdpi")?;
+            let id = if mapped.contains(index) {
+                match fx.layers.iter().find(|(i, _)| i == index).map(|(_, p)| *p) {
+                    None | Some(LayerPick::Owner) => layer_id,
+                    Some(LayerPick::Nothing) => 0,
+                    Some(LayerPick::Layer(l)) => layer_ids.get(&l).copied().unwrap_or(layer_id),
+                }
+            } else {
+                let stored = tdpi.get(0..4).and_then(|b| b.try_into().ok()).map(u32::from_be_bytes);
+                if stored.is_some() && stored == proto_owner { layer_id } else { stored.unwrap_or(0) }
+            };
+            put_u32(tdpi, 0, id)?;
+        }
+        // Arbitrary data: the `aRbp` of the `LIST aRbs` after the parameter's record.
+        if let Some((index, data)) = &fx.data {
+            let want = pdefs.get(index).map(|d| d.record.clone()).unwrap_or_default();
+            let i = kids
+                .iter()
+                .position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(want.as_str()))
+                .ok_or_else(|| tpl("arbitrary data record missing"))?;
+            let list = kids.iter_mut().skip(i + 1).take(3).find(|c| c.is_list(b"aRbs")).ok_or_else(|| tpl("arbitrary data missing"))?;
+            let arbp = child_mut(list, b"aRbp")?;
+            *data_mut(arbp)? = data.clone();
+        }
+        let position: HashMap<String, u16> = pdefs.iter().map(|(i, d)| (d.record.clone(), *i)).collect();
+        for (index, (m, r)) in records {
+            // Before the first record of a later parameter (or the built-in group, or the end).
+            let at = kids
+                .iter()
+                .enumerate()
+                .filter(|(_, c)| c.is(b"tdmn"))
+                .find(|(_, c)| {
+                    let n = tdmn_name(c).unwrap_or_default();
+                    position.get(&n).is_some_and(|i| *i > index) || n == "ADBE Effect Built In Params" || n == "ADBE Group End"
+                })
+                .map(|(i, _)| i)
+                .unwrap_or(kids.len());
+            kids.splice(at..at, [m, r]);
+        }
+    }
+    // A popup selection is also written into its `pard` default slot (@56, u32; 377, 390, 324).
+    if let Some(part) = sspc.children_mut().iter_mut().find(|c| c.is_list(b"parT")) {
+        for p in &fx.params {
+            let (PKind::Popup, ParamValue::Static(v)) = (p.kind, &p.value) else { continue };
+            let Some(sel) = v.first().map(|x| x.round()).filter(|x| *x >= 1.0 && *x <= 1000.0) else { continue };
+            let want = pdefs.get(&p.index).map(|d| d.record.clone()).unwrap_or_default();
+            let kids = kids_mut(part)?;
+            if let Some(i) = kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(want.as_str()))
+                && let Some(pard) = kids.get_mut(i + 1)
+            {
+                put_u32(data_mut(pard)?, 56, sel as u32)?;
+            }
+        }
+    }
+    if uses.types.contains(&fx.match_name) {
+        // A later instance of a type: its definitions come from the project's copy (383).
+        let part = list_mut(&mut sspc, b"parT")?;
+        *part = Chunk::list(*b"parT", Vec::new());
+    } else {
+        uses.types.push(fx.match_name);
+    }
+    Ok(vec![tdmn.clone(), sspc])
+}
+
+/// The layer's `ADBE Effect Parade` (`tdmn` + `tdgp`), the effects in stack order.
+pub(crate) fn build_parade(
+    protos: &FxProtos,
+    fxs: &[EffectPlan],
+    layer_id: u32,
+    layer_ids: &HashMap<LayerId, u32>,
+    source_size: (u32, u32),
+    uses: &mut FxUse,
+) -> R<Vec<Chunk<'static>>> {
+    let mut kids = vec![Chunk::data(*b"tdsb", vec![0, 0, 0, 1]), tdsn("-_0_/-")];
+    for fx in fxs {
+        kids.extend(instance(protos, fx, layer_id, layer_ids, source_size, uses)?);
+    }
+    kids.push(Chunk::data(*b"tdmn", tdmn_bytes("ADBE Group End")));
+    Ok(vec![Chunk::data(*b"tdmn", tdmn_bytes("ADBE Effect Parade")), Chunk::list(*b"tdgp", kids)])
+}
+
+/// Writes the project-level effect lists: `Pefl` (one `pjef` per type, sorted by match name, 365)
+/// and `EfdG` (the `EfDC` count, little-endian, and one `EfDf` per type in order of first use)
+/// right after `Pefl`.
+pub(crate) fn put_project_lists(protos: &FxProtos, file: &mut AepFile<'static>, uses: &FxUse) -> R<()> {
+    if uses.types.is_empty() {
+        return Ok(());
+    }
+    let at = file.chunks.iter().position(|c| c.is_list(b"Pefl")).ok_or_else(|| tpl("template without Pefl"))?;
+    let mut sorted: Vec<&str> = uses.types.clone();
+    sorted.sort_unstable();
+    if let Some(pefl) = file.chunks.get_mut(at) {
+        let kids = kids_mut(pefl)?;
+        kids.clear();
+        kids.extend(sorted.iter().map(|n| Chunk::data(*b"pjef", n.as_bytes().to_vec())));
+    }
+    let n = u32::try_from(uses.types.len()).map_err(|_| tpl("too many effect types"))?;
+    let mut efdg = vec![Chunk::data(*b"EfDC", n.to_le_bytes().to_vec())];
+    for t in &uses.types {
+        let (_, _, def) = protos.defaults.get(*t).ok_or_else(|| tpl("effect prototype missing"))?;
+        efdg.push(def.clone());
+    }
+    file.chunks.insert(at + 1, Chunk::list(*b"EfdG", efdg));
+    Ok(())
+}
diff --git a/crates/aep/src/export/emit.rs b/crates/aep/src/export/emit.rs
new file mode 100644
index 000000000..e7423efe9
--- /dev/null
+++ b/crates/aep/src/export/emit.rs
@@ -0,0 +1,820 @@
+//! Builds the chunk tree from the plan by cloning prototypes of the template and editing only the
+//! fields whose layout is verified (`docs/aep-format.md`, section 3, and `docs/aep-export.md`).
+
+use std::collections::HashMap;
+
+use crate::{AepFile, Chunk};
+use effectcraft_project::{ItemId, LayerId};
+
+use crate::export::plan::{CompPlan, Entry, ItemPlan, KeyPlan, LayerPlan, LayerSrc, ProjectPlan, PropKind, PropPlan, SolidPlan, natural_key};
+use crate::export::template::Template;
+use crate::export::tree::{
+    R, child_data, data_mut, kids_mut, list_mut, put, put_bits, put_cstr, put_f32, put_f64, put_i32, put_u8, put_u16, put_u32, set_utf8, tpl,
+};
+
+/// The first id given to anything the export creates. The template's `Solids` folder keeps the id
+/// 0x19 that the project header (`sfnm`/`sfid`) names; everything else is allocated from here.
+const FIRST_ID: u32 = 0x1c;
+const SOLIDS_FOLDER_ID: u32 = 0x19;
+/// A composition item uses its own id and one id per built-in view layer (3D views, custom views,
+/// the markers layer).
+const VIEW_LAYERS: u32 = 11;
+/// The name field of a solid (`opti` 26 to 281) holds 255 bytes and a NUL (a 140 character name
+/// saved by After Effects fills it as far as it goes).
+pub(crate) const MAX_SOLID_NAME: usize = 255;
+
+struct Ids {
+    next: u32,
+}
+
+impl Ids {
+    fn alloc(&mut self) -> R<u32> {
+        let id = self.next;
+        self.next = self.next.checked_add(1).ok_or_else(|| tpl("more than 2^32 ids"))?;
+        Ok(id)
+    }
+}
+
+struct Cx<'t> {
+    t: &'t Template,
+    ids: Ids,
+    /// Item ids of the project's solids (for the layer source ids).
+    solid_ids: HashMap<ItemId, u32>,
+    /// Item id and duration in seconds of every exported composition (precomposition layers).
+    comp_ids: HashMap<ItemId, (u32, f64)>,
+    /// Item id and duration in seconds of every exported footage item (footage layers).
+    footage_ids: HashMap<ItemId, (u32, f64)>,
+    /// Hidden solid items of null layers, written into the `Solids` folder.
+    extra_solids: Vec<(String, Chunk<'static>)>,
+    guid: u64,
+    /// A root folder named `Solids` in the project is After Effects' own `Solids` folder (id 0x19).
+    special: Option<ItemId>,
+    special_slot: Option<(Chunk<'static>, Vec<Sorted>)>,
+    /// Effect types written so far (the first instance of a type holds its definitions).
+    fx_use: crate::export::effects::FxUse,
+}
+
+/// A sortable group of chunks: name, tie-break key, chunks.
+type Sorted = (String, u64, Vec<Chunk<'static>>);
+
+pub(crate) fn emit(plan: &ProjectPlan, extra: &[u8]) -> R<Vec<u8>> {
+    let t = Template::load()?;
+    let special = plan.root.iter().find(|e| e.name == "Solids" && matches!(e.plan, ItemPlan::Folder(_))).map(|e| e.ec);
+    let mut cx = Cx {
+        t: &t,
+        ids: Ids { next: FIRST_ID },
+        solid_ids: HashMap::new(),
+        comp_ids: HashMap::new(),
+        footage_ids: HashMap::new(),
+        extra_solids: Vec::new(),
+        guid: 0x9e37_79b9_7f4a_7c15,
+        special,
+        special_slot: None,
+        fx_use: crate::export::effects::FxUse::default(),
+    };
+    let mut ids_by_entry: HashMap<ItemId, u32> = HashMap::new();
+    assign_ids(&plan.root, &mut cx, &mut ids_by_entry)?;
+
+    let mut root: Vec<Sorted> = Vec::new();
+    build_level(&plan.root, &mut cx, &ids_by_entry, &mut |name, key, chunks| root.push((name, key, chunks)))?;
+    // The Solids folder: root-level solids and the hidden solids of null layers.
+    let mut solids_children: Vec<Sorted> = Vec::new();
+    for (name, key, chunks) in root.iter().filter(|(_, k, _)| *k & ROOT_SOLID != 0) {
+        solids_children.push((name.clone(), *key, chunks.clone()));
+    }
+    root.retain(|(_, k, c)| *k & ROOT_SOLID == 0 && !c.is_empty());
+    for (i, (name, chunk)) in cx.extra_solids.iter().enumerate() {
+        let mut v = vec![chunk.clone()];
+        v.extend(cx.t.fset.iter().cloned());
+        solids_children.push((name.clone(), i as u64, v));
+    }
+    let mut folder = match cx.special_slot.take() {
+        Some((item, inner)) => {
+            solids_children.extend(inner);
+            item
+        }
+        None => {
+            let mut f = cx.t.folder_item.clone();
+            set_item_header(&mut f, SOLIDS_FOLDER_ID, 2, "Solids")?;
+            f
+        }
+    };
+    sort_named(&mut solids_children);
+    kids_mut(list_mut(&mut folder, b"Sfdr")?)?.extend(solids_children.into_iter().flat_map(|(_, _, c)| c));
+    root.push(("Solids".to_string(), 0, vec![folder]));
+    sort_named(&mut root);
+
+    let mut file: AepFile<'static> = AepFile { chunks: t.file.chunks.clone(), trailer: std::borrow::Cow::Owned(extra.to_vec()) };
+    {
+        let fold = file.chunks.iter_mut().find(|c| c.is_list(b"Fold")).ok_or_else(|| tpl("template without Fold"))?;
+        let kids = kids_mut(fold)?;
+        let fdta = kids.iter().find(|c| c.is(b"fdta")).cloned().ok_or_else(|| tpl("template without fdta"))?;
+        kids.clear();
+        kids.push(fdta);
+        kids.extend(root.into_iter().flat_map(|(_, _, c)| c));
+    }
+    crate::export::effects::put_project_lists(&t.effects, &mut file, &cx.fx_use)?;
+    crate::export::settings::emit(&mut file, &plan.settings)?;
+    {
+        let head = file.chunks.iter_mut().find(|c| c.is(b"head")).ok_or_else(|| tpl("template without head"))?;
+        put_u32(data_mut(head)?, 12, cx.ids.next)?;
+    }
+    crate::write(&file).map_err(crate::export::AepExportError::Container)
+}
+
+/// Marks a root entry that goes into the `Solids` folder.
+const ROOT_SOLID: u64 = 1 << 63;
+
+fn sort_named(v: &mut [Sorted]) {
+    v.sort_by(|a, b| natural_cmp(&a.0, &b.0).then(a.1.cmp(&b.1)));
+}
+
+fn natural_cmp(a: &str, b: &str) -> std::cmp::Ordering {
+    let (ka, kb) = (natural_key(a), natural_key(b));
+    for (x, y) in ka.iter().zip(kb.iter()) {
+        let c = match (x.0, y.0) {
+            (true, true) => x.2.cmp(&y.2).then_with(|| x.1.cmp(&y.1)),
+            (false, false) => x.1.cmp(&y.1),
+            (true, false) => std::cmp::Ordering::Less,
+            (false, true) => std::cmp::Ordering::Greater,
+        };
+        if c != std::cmp::Ordering::Equal {
+            return c;
+        }
+    }
+    ka.len().cmp(&kb.len())
+}
+
+fn assign_ids(entries: &[Entry], cx: &mut Cx<'_>, map: &mut HashMap<ItemId, u32>) -> R<()> {
+    // Iterative to bound the stack by the folder depth the plan already limits.
+    let mut stack: Vec<&Entry> = entries.iter().rev().collect();
+    while let Some(e) = stack.pop() {
+        let id = if Some(e.ec) == cx.special { SOLIDS_FOLDER_ID } else { cx.ids.alloc()? };
+        match &e.plan {
+            ItemPlan::Comp(cp) => {
+                let seconds = f64::from(cp.duration_units) / f64::from(cp.tb.timescale.max(1));
+                cx.comp_ids.insert(e.ec, (id, seconds));
+                for _ in 0..VIEW_LAYERS {
+                    cx.ids.alloc()?;
+                }
+            }
+            ItemPlan::Solid(_) => {
+                cx.solid_ids.insert(e.ec, id);
+            }
+            ItemPlan::Footage(fp) => {
+                cx.footage_ids.insert(e.ec, (id, fp.seconds));
+            }
+            ItemPlan::Folder(kids) => stack.extend(kids.iter().rev()),
+        }
+        map.insert(e.ec, id);
+    }
+    Ok(())
+}
+
+type Out<'a> = &'a mut dyn FnMut(String, u64, Vec<Chunk<'static>>);
+
+/// Builds the chunks of one folder level (items and their trailing records) and hands each entry
+/// to `sink`. Root-level solids are flagged [`ROOT_SOLID`] in their sort key.
+fn build_level(entries: &[Entry], cx: &mut Cx<'_>, ids: &HashMap<ItemId, u32>, sink: Out<'_>) -> R<()> {
+    build_level_depth(entries, cx, ids, sink, true, 0)
+}
+
+fn build_level_depth(entries: &[Entry], cx: &mut Cx<'_>, ids: &HashMap<ItemId, u32>, sink: Out<'_>, root: bool, depth: usize) -> R<()> {
+    if depth > 80 {
+        return Err(tpl("folders nested too deeply"));
+    }
+    for e in entries {
+        let id = *ids.get(&e.ec).ok_or_else(|| tpl("item without an id"))?;
+        match &e.plan {
+            ItemPlan::Folder(kids) => {
+                let mut item = cx.t.folder_item.clone();
+                set_item_header(&mut item, id, e.label, &e.name)?;
+                let mut inner: Vec<Sorted> = Vec::new();
+                build_level_depth(kids, cx, ids, &mut |n, k, c| inner.push((n, k, c)), false, depth + 1)?;
+                if root && Some(e.ec) == cx.special {
+                    // Completed once the hidden solids of null layers are known.
+                    cx.special_slot = Some((item, inner));
+                    sink(e.name.clone(), e.ec.0, Vec::new());
+                    continue;
+                }
+                sort_named(&mut inner);
+                kids_mut(list_mut(&mut item, b"Sfdr")?)?.extend(inner.into_iter().flat_map(|(_, _, c)| c));
+                sink(e.name.clone(), e.ec.0, vec![item]);
+            }
+            ItemPlan::Comp(cp) => {
+                let item = build_comp(cx, id, e, cp)?;
+                let mut v = vec![item, cx.t.fee.clone()];
+                v.extend(cx.t.fset.iter().cloned());
+                sink(e.name.clone(), e.ec.0, v);
+            }
+            ItemPlan::Footage(fp) => {
+                let guid = unique_guid(cx);
+                let chunks = crate::export::footage::build_footage(&cx.t.footage, id, e.label, &e.name, fp, guid)?;
+                sink(e.name.clone(), e.ec.0, chunks);
+            }
+            ItemPlan::Solid(sp) => {
+                let item = build_solid(cx, id, e.label, &e.name, sp)?;
+                let mut v = vec![item];
+                v.extend(cx.t.fset.iter().cloned());
+                sink(e.name.clone(), e.ec.0 | if root { ROOT_SOLID } else { 0 }, v);
+            }
+        }
+    }
+    Ok(())
+}
+
+/// iide (little endian), idta id at 16 and label at 58, and the name.
+fn set_item_header(item: &mut Chunk<'static>, id: u32, label: u8, name: &str) -> R<()> {
+    put(child_data(item, b"iide")?, 0, &id.to_le_bytes())?;
+    {
+        let idta = child_data(item, b"idta")?;
+        put_u32(idta, 16, id)?;
+        put_u8(idta, 58, label)?;
+    }
+    set_utf8(item, name)
+}
+
+fn unique_guid(cx: &mut Cx<'_>) -> [u8; 16] {
+    // A splitmix64 stream: distinct, deterministic, and no machine data.
+    let mut out = [0u8; 16];
+    for half in 0..2 {
+        cx.guid = cx.guid.wrapping_add(0x9e37_79b9_7f4a_7c15);
+        let mut z = cx.guid;
+        z = (z ^ (z >> 30)).wrapping_mul(0xbf58_476d_1ce4_e5b9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94d0_49bb_1331_11eb);
+        z ^= z >> 31;
+        if let Some(dst) = out.get_mut(half * 8..half * 8 + 8) {
+            dst.copy_from_slice(&z.to_be_bytes());
+        }
+    }
+    out
+}
+
+fn solid_item(cx: &mut Cx<'_>, proto: &Chunk<'static>, id: u32, label: u8, name: &str, color: [f32; 3], (w, h): (u32, u32)) -> R<Chunk<'static>> {
+    let mut item = proto.clone();
+    put(child_data(&mut item, b"iide")?, 0, &id.to_le_bytes())?;
+    {
+        let idta = child_data(&mut item, b"idta")?;
+        put_u32(idta, 16, id)?;
+        put_u8(idta, 58, label)?;
+    }
+    let guid = unique_guid(cx);
+    let pin = list_mut(&mut item, b"Pin ")?;
+    {
+        let sspc = child_data(pin, b"sspc")?;
+        put_u32(sspc, 30, w)?;
+        put_u32(sspc, 34, h)?;
+    }
+    {
+        let opti = child_data(pin, b"opti")?;
+        let [r, g, b] = color;
+        put_f32(opti, 10, 1.0)?;
+        put_f32(opti, 14, r)?;
+        put_f32(opti, 18, g)?;
+        put_f32(opti, 22, b)?;
+        put_cstr(opti, 26, MAX_SOLID_NAME + 1, name)?;
+    }
+    put(child_data(pin, b"pgui")?, 0, &guid)?;
+    Ok(item)
+}
+
+fn build_solid(cx: &mut Cx<'_>, id: u32, label: u8, name: &str, sp: &SolidPlan) -> R<Chunk<'static>> {
+    let proto = cx.t.solid_item.clone();
+    solid_item(cx, &proto, id, label, name, sp.color, (sp.width, sp.height))
+}
+
+/// Rebuilds all `tdb4` time scales (byte 12) below `c` to the composition's.
+fn set_time_scales(c: &mut Chunk<'static>, ts: u32, depth: usize) -> R<()> {
+    if depth > 64 {
+        return Err(tpl("property tree nested too deeply"));
+    }
+    if c.is_list(b"tdbs") {
+        let tdb4 = child_data(c, b"tdb4")?;
+        put_u32(tdb4, 12, ts)?;
+    }
+    if let Ok(kids) = kids_mut(c) {
+        for k in kids.iter_mut() {
+            if k.list_type().is_some() {
+                set_time_scales(k, ts, depth + 1)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+fn build_comp(cx: &mut Cx<'_>, id: u32, e: &Entry, cp: &CompPlan) -> R<Chunk<'static>> {
+    let mut item = cx.t.comp_shell.clone();
+    set_item_header(&mut item, id, e.label, &e.name)?;
+    {
+        let cdta = child_data(&mut item, b"cdta")?;
+        put_u32(cdta, 4, cp.tb.frame_duration)?;
+        put_u32(cdta, 8, cp.tb.timescale)?;
+        put_u32(cdta, 16, 600)?;
+        put_u32(cdta, 24, 600)?;
+        put_u32(cdta, 28, cp.work_start)?;
+        // Start and end of the work area are fractions: the time scale is their denominator once
+        // a work area is set, 600 while it spans the whole composition.
+        let set = cp.work_end.is_some() || cp.work_start != 0;
+        put_u32(cdta, 32, if set { cp.tb.timescale } else { 600 })?;
+        put_u32(cdta, 36, cp.work_end.unwrap_or(u32::MAX))?;
+        put_u32(cdta, 40, if set { cp.tb.timescale } else { 600 })?;
+        put_u32(cdta, 44, cp.duration_units)?;
+        put_u32(cdta, 48, cp.tb.timescale)?;
+        put(cdta, 52, &cp.background)?;
+        put_bits(cdta, 139, 0x08, cp.motion_blur)?;
+        put_u16(cdta, 140, cp.width)?;
+        put_u16(cdta, 142, cp.height)?;
+        put_u32(cdta, 144, cp.pixel_aspect.0)?;
+        put_u32(cdta, 148, cp.pixel_aspect.1)?;
+        put_u32(cdta, 156, crate::export::timebase::fixed_rate(cp.rate))?;
+        put_u32(cdta, 164, cp.display_start)?;
+        put_u32(cdta, 168, if cp.display_start == 0 { 1 } else { cp.tb.timescale })?;
+        put_u32(cdta, 172, cp.shutter_angle)?;
+        put_i32(cdta, 180, cp.shutter_phase)?;
+    }
+    // View layers: ids right after the composition's.
+    {
+        let mut view = id.checked_add(1).ok_or_else(|| tpl("id overflow"))?;
+        for k in kids_mut(&mut item)?.iter_mut() {
+            if k.is_list(b"DLay") || k.is_list(b"SLay") || k.is_list(b"CLay") || k.is_list(b"SecL") {
+                put_u32(child_data(k, b"ldta")?, 0, view)?;
+                view = view.checked_add(1).ok_or_else(|| tpl("id overflow"))?;
+            }
+        }
+    }
+    // The layers.
+    let mut layer_ids: HashMap<LayerId, u32> = HashMap::new();
+    for lp in &cp.layers {
+        layer_ids.insert(lp.ec_id, cx.ids.alloc()?);
+    }
+    let mut blocks: Vec<Chunk<'static>> = Vec::new();
+    for lp in &cp.layers {
+        let lid = *layer_ids.get(&lp.ec_id).ok_or_else(|| tpl("layer without an id"))?;
+        let block = build_layer(cx, lid, lp, cp, &layer_ids)?;
+        blocks.extend(block);
+    }
+    // Composition markers live in the view layer named `Markers` (`SecL`, 122, 509).
+    if !cp.markers.is_empty() {
+        let group = crate::export::markers::build(&cx.t.marker_group, &cp.markers)?;
+        let secl = kids_mut(&mut item)?.iter_mut().find(|c| c.is_list(b"SecL")).ok_or_else(|| tpl("composition without its markers layer"))?;
+        crate::export::markers::insert(list_mut(secl, b"tdgp")?, group)?;
+    }
+    // Every property of the composition counts keyframe times in its time scale (the layers
+    // have theirs already: a stretched layer's is scaled, R36).
+    set_time_scales(&mut item, cp.tb.timescale, 0)?;
+    let at = cx.t.layer_at.min(kids_mut(&mut item)?.len());
+    kids_mut(&mut item)?.splice(at..at, blocks);
+    put_used_comps(cx, &mut item, cp)?;
+    Ok(item)
+}
+
+/// A composition that shows other compositions as layers records each of them once in an `idpi`
+/// chunk (little-endian item id) after `idpc`, and `idpc` starts with their number as a
+/// little-endian `u32` (124, 257, 258, 600, 602: one; 601: two; the After Effects re-save of
+/// `export-tests\precomp\p1`, written with the count 1, rewrote it to 2). The order carries no
+/// meaning: After Effects reverses the list on every re-save (p1 and p1b); the exporter writes
+/// ascending ids, the order After Effects created in 601.
+fn put_used_comps(cx: &Cx<'_>, item: &mut Chunk<'static>, cp: &CompPlan) -> R<()> {
+    let mut used: Vec<u32> = Vec::new();
+    for lp in &cp.layers {
+        if let LayerSrc::Comp(c) = &lp.src {
+            let (id, _) = *cx.comp_ids.get(c).ok_or_else(|| tpl("precomposition without an id"))?;
+            if !used.contains(&id) {
+                used.push(id);
+            }
+        }
+    }
+    if used.is_empty() {
+        return Ok(());
+    }
+    used.sort_unstable();
+    let count = u32::try_from(used.len()).map_err(|_| tpl("too many precompositions"))?;
+    let kids = kids_mut(item)?;
+    let at = kids.iter().position(|c| c.is(b"idpc")).ok_or_else(|| tpl("composition without idpc"))?;
+    if let Some(idpc) = kids.get_mut(at) {
+        put(data_mut(idpc)?, 0, &count.to_le_bytes())?;
+    }
+    let chunks: Vec<Chunk<'static>> = used.iter().map(|id| Chunk::data(*b"idpi", id.to_le_bytes().to_vec())).collect();
+    kids.splice(at + 1..at + 1, chunks);
+    Ok(())
+}
+
+/// Sets the maximum of the inert `ADBE Time Remapping` property (`tduM`, seconds): the duration
+/// of the layer's source (5 for a 5 s precomposition: 124, 257, 258; 0 for a solid: 000).
+fn put_time_remap_max(layr: &mut Chunk<'static>, seconds: f64) -> R<()> {
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at =
+        kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Time Remapping")).ok_or_else(|| tpl("layer without Time Remapping"))?;
+    let tdbs = kids.get_mut(at + 1).ok_or_else(|| tpl("Time Remapping without a record"))?;
+    put_f64(child_data(tdbs, b"tduM")?, 0, seconds)
+}
+
+/// Enables the layer's `ADBE Time Remapping` (aep-format.md, Time Remapping; 319, 354 against
+/// 124, 353): `tdsb` 3 -> 1; with keys `tdb4` byte 5 bit 0 cleared and byte 68 = 1, and the `cdat`
+/// replaced by a key list of plain 48-byte records (value in seconds at 8), the list header as a
+/// keyed Opacity's (the same record kind); the plan always has a key (a remap without keys reads
+/// back switched off, r1). An expression
+/// is written as on the Transform properties (R15). The maximum (`tduM`) stays the source's
+/// duration, as After Effects keeps it (319: 5).
+fn put_time_remap(cx: &Cx<'_>, layr: &mut Chunk<'static>, remap: &PropPlan) -> R<()> {
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at =
+        kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Time Remapping")).ok_or_else(|| tpl("layer without Time Remapping"))?;
+    let tdbs = kids.get_mut(at + 1).ok_or_else(|| tpl("Time Remapping without a record"))?;
+    put_u32(child_data(tdbs, b"tdsb")?, 0, 1)?;
+    {
+        let tdb4 = child_data(tdbs, b"tdb4")?;
+        if !remap.keys.is_empty() {
+            let b5 = tdb4.get(5).copied().ok_or_else(|| tpl("short tdb4"))?;
+            put_u8(tdb4, 5, b5 & !0x01)?;
+            put_u8(tdb4, 68, 1)?;
+        }
+        if let Some((_, enabled)) = &remap.expr {
+            put_u8(tdb4, 76, 1)?;
+            put_u8(tdb4, 77, 1)?;
+            put_u8(tdb4, 120, 1)?;
+            put_u8(tdb4, 119, u8::from(!*enabled))?;
+        }
+    }
+    let rk = kids_mut(tdbs)?;
+    let cdat_at = rk.iter().position(|c| c.is(b"cdat")).ok_or_else(|| tpl("Time Remapping without a value"))?;
+    if remap.keys.is_empty() {
+        if let Some(cdat) = rk.get_mut(cdat_at) {
+            put_f64(data_mut(cdat)?, 0, remap.value.first().copied().unwrap_or(0.0))?;
+        }
+    } else {
+        // The key list of a keyed one-component property (Opacity's prototype).
+        let idx = PropKind::ALL.iter().position(|k| *k == PropKind::Opacity).ok_or_else(|| tpl("unknown property kind"))?;
+        let proto = cx.t.keyd.get(idx * 2 + 1).ok_or_else(|| tpl("prototype missing"))?;
+        let mut list = proto
+            .children()
+            .iter()
+            .find(|k| matches!(&k.body, crate::Body::List { list_type, .. } if list_type == b"list"))
+            .cloned()
+            .ok_or_else(|| tpl("keyed prototype without a list"))?;
+        let n = u32::try_from(remap.keys.len()).map_err(|_| tpl("too many keys"))?;
+        let size = 48usize;
+        {
+            let lhd3 = child_data(&mut list, b"lhd3")?;
+            crate::export::synth::put_key_counts(lhd3, n, 48)?;
+        }
+        let mut ldat = Vec::with_capacity(size * remap.keys.len());
+        for k in &remap.keys {
+            ldat.extend(plain_record(1, k, size)?);
+        }
+        let ld = kids_mut(&mut list)?;
+        match ld.iter_mut().find(|c| c.is(b"ldat")) {
+            Some(c) => *c = Chunk::data(*b"ldat", ldat),
+            None => ld.push(Chunk::data(*b"ldat", ldat)),
+        }
+        if let Some(slot) = rk.get_mut(cdat_at) {
+            *slot = list;
+        }
+    }
+    if let Some((text, _)) = &remap.expr {
+        let at = rk.iter().position(|c| c.is(b"tdum")).unwrap_or(rk.len());
+        rk.insert(at, Chunk::data(*b"Utf8", text.as_bytes().to_vec()));
+    }
+    Ok(())
+}
+
+fn build_layer(cx: &mut Cx<'_>, id: u32, lp: &LayerPlan, cp: &CompPlan, layer_ids: &HashMap<LayerId, u32>) -> R<Vec<Chunk<'static>>> {
+    let is_null = lp.src == LayerSrc::Null;
+    let mut block = match &lp.src {
+        LayerSrc::Null => cx.t.null_block.clone(),
+        LayerSrc::Text(tp) if tp.frame.is_some() => cx.t.text_box.clone(),
+        LayerSrc::Text(_) => cx.t.text_point.clone(),
+        LayerSrc::Camera(_) => cx.t.camera_block.clone(),
+        LayerSrc::Light(l) if l.kind == 2 => cx.t.point_block.clone(),
+        LayerSrc::Light(_) => cx.t.spot_block.clone(),
+        LayerSrc::Shape(_) => cx.t.shapes.block.clone(),
+        _ => cx.t.layer_block.clone(),
+    };
+    let mut remap_max = None;
+    let source_id = match &lp.src {
+        LayerSrc::Solid(item) => *cx.solid_ids.get(item).ok_or_else(|| tpl("layer source without an id"))?,
+        LayerSrc::Comp(item) => {
+            let (id, seconds) = *cx.comp_ids.get(item).ok_or_else(|| tpl("precomposition without an id"))?;
+            remap_max = Some(seconds);
+            id
+        }
+        LayerSrc::Footage(item) => {
+            let (id, seconds) = *cx.footage_ids.get(item).ok_or_else(|| tpl("footage without an id"))?;
+            remap_max = Some(seconds);
+            id
+        }
+        // A text layer and a camera have no source (110, 256), a light `0xffffffff` (252).
+        LayerSrc::Text(_) | LayerSrc::Camera(_) | LayerSrc::Shape(_) => 0,
+        LayerSrc::Light(_) => u32::MAX,
+        LayerSrc::Null => {
+            // The hidden solid every null object has.
+            let item_id = cx.ids.alloc()?;
+            let proto = cx.t.null_item.clone();
+            let name = format!("Null {}", item_id);
+            let item = solid_item(cx, &proto, item_id, 0, &name, [1.0, 1.0, 1.0], (100, 100))?;
+            cx.extra_solids.push((name, item));
+            item_id
+        }
+    };
+    let layr = block.get_mut(0).ok_or_else(|| tpl("empty layer block"))?;
+    {
+        let ldta = child_data(layr, b"ldta")?;
+        put_u32(ldta, 0, id)?;
+        put_u8(ldta, 5, lp.quality)?;
+        put_i32(ldta, 8, lp.stretch.0)?;
+        put_u32(ldta, 108, lp.stretch.1)?;
+        let den = cp.tb.timescale;
+        put_i32(ldta, 12, lp.start)?;
+        put_u32(ldta, 16, den)?;
+        put_i32(ldta, 20, lp.in_rel)?;
+        put_u32(ldta, 24, den)?;
+        put_i32(ldta, 28, lp.out_rel)?;
+        put_u32(ldta, 32, den)?;
+        put_bits(ldta, 37, 0x01, !lp.name.is_empty())?;
+        put_bits(ldta, 37, 0x02, lp.guide)?;
+        put_bits(ldta, 38, 0x02, lp.adjustment)?;
+        put_bits(ldta, 38, 0x04, lp.three_d)?;
+        put_bits(ldta, 38, 0x08, lp.solo)?;
+        put_bits(ldta, 38, 0x80, is_null)?;
+        put_bits(ldta, 39, 0x01, lp.video)?;
+        put_bits(ldta, 39, 0x02, lp.audio)?;
+        put_bits(ldta, 39, 0x04, lp.effects)?;
+        put_bits(ldta, 39, 0x08, lp.motion_blur)?;
+        put_bits(ldta, 39, 0x20, lp.locked)?;
+        put_bits(ldta, 39, 0x40, lp.shy)?;
+        put_bits(ldta, 39, 0x80, lp.collapse)?;
+        put_u32(ldta, 40, source_id)?;
+        put_u8(ldta, 61, lp.label)?;
+        put_cstr(ldta, 64, 32, &lp.name)?;
+        put_u8(ldta, 99, lp.blend)?;
+        // Layer type: 3 text, 2 camera, 1 light, 0 AV (solid, footage, precomposition, null) (3.1);
+        // the light type at 136 (1 spot, 2 point); auto-orient towards the point of interest is
+        // byte 38 bit 0x40 (two-node camera 256 vs one-node 251; set on every light).
+        let ty = match &lp.src {
+            LayerSrc::Text(_) => 3,
+            LayerSrc::Camera(_) => 2,
+            LayerSrc::Light(_) => 1,
+            LayerSrc::Shape(_) => 4,
+            _ => 0,
+        };
+        put_u32(ldta, 128, ty)?;
+        match &lp.src {
+            LayerSrc::Camera(c) => put_bits(ldta, 38, 0x40, c.two_node)?,
+            LayerSrc::Light(l) => {
+                put_u32(ldta, 136, l.kind)?;
+                put_bits(ldta, 38, 0x40, true)?;
+            }
+            _ => {}
+        }
+        let parent = lp.parent.and_then(|p| layer_ids.get(&p).copied()).unwrap_or(0);
+        put_u32(ldta, 132, parent)?;
+        // Track matte: mode at 107, the matte layer's id at 160 (403-408).
+        let (matte_id, matte_mode) = lp.matte.and_then(|(m, mode)| layer_ids.get(&m).map(|id| (*id, mode))).unwrap_or((0, 0));
+        put_u8(ldta, 107, matte_mode)?;
+        put_u32(ldta, 160, matte_id)?;
+    }
+    set_utf8(layr, &lp.name)?;
+    if let LayerSrc::Text(tp) = &lp.src {
+        let guid = unique_guid(cx);
+        crate::export::text::put_doc(layr, tp, guid)?;
+        crate::export::textanim::put_animators(layr, &cx.t.anims, &tp.animators, &cx.t.shapes.key_list)?;
+    }
+    if let Some(seconds) = remap_max {
+        put_time_remap_max(layr, seconds)?;
+    }
+    if let Some(remap) = &lp.remap {
+        put_time_remap(cx, layr, remap)?;
+    }
+    put_properties(cx, layr, lp, cp)?;
+    put_masks(cx, layr, lp)?;
+    put_effects(cx, layr, lp, id, layer_ids)?;
+    if let Some(styles) = &lp.styles {
+        crate::export::styles::put_styles(&cx.t.styles, layr, styles)?;
+    }
+    match &lp.src {
+        LayerSrc::Camera(c) => crate::export::camlight::put_camera(layr, &cx.t.options, c)?,
+        LayerSrc::Light(l) => crate::export::camlight::put_light(layr, &cx.t.options, l)?,
+        LayerSrc::Shape(items) => crate::export::shapes::put_contents(layr, &cx.t.shapes, items)?,
+        _ => {}
+    }
+    if !lp.markers.is_empty() {
+        let group = crate::export::markers::build(&cx.t.marker_group, &lp.markers)?;
+        crate::export::markers::insert(list_mut(layr, b"tdgp")?, group)?;
+    }
+    set_time_scales(layr, lp.time_scale, 0)?;
+    Ok(block)
+}
+
+/// Inserts the layer's `ADBE Mask Parade` before its Transform group (after Time Remapping, as
+/// After Effects stores it: 090).
+fn put_masks(cx: &Cx<'_>, layr: &mut Chunk<'static>, lp: &LayerPlan) -> R<()> {
+    if lp.masks.is_empty() {
+        return Ok(());
+    }
+    let parade = crate::export::masks::build_parade(&cx.t.masks, &lp.masks, lp.source_size)?;
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at = kids
+        .iter()
+        .position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Transform Group"))
+        .ok_or_else(|| tpl("layer without a Transform group"))?;
+    kids.splice(at..at, parade);
+    Ok(())
+}
+
+/// Inserts the layer's `ADBE Effect Parade` right before its Transform group (after the masks:
+/// 357, 398).
+fn put_effects(cx: &mut Cx<'_>, layr: &mut Chunk<'static>, lp: &LayerPlan, layer_id: u32, layer_ids: &HashMap<LayerId, u32>) -> R<()> {
+    if lp.fx.is_empty() {
+        return Ok(());
+    }
+    let parade = crate::export::effects::build_parade(&cx.t.effects, &lp.fx, layer_id, layer_ids, lp.source_size, &mut cx.fx_use)?;
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at = kids
+        .iter()
+        .position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Transform Group"))
+        .ok_or_else(|| tpl("layer without a Transform group"))?;
+    kids.splice(at..at, parade);
+    Ok(())
+}
+
+/// The order of a Transform group's records; `ADBE Group End` closes the group whatever else it
+/// holds.
+const GROUP_ORDER: [&str; 13] = [
+    "ADBE Anchor Point",
+    "ADBE Position",
+    "ADBE Position_0",
+    "ADBE Position_1",
+    "ADBE Position_2",
+    "ADBE Scale",
+    "ADBE Orientation",
+    "ADBE Rotate X",
+    "ADBE Rotate Y",
+    "ADBE Rotate Z",
+    "ADBE Opacity",
+    "ADBE Envir Appear in Reflect",
+    "ADBE Group End",
+];
+
+fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let d = c.bytes()?;
+    Some(d.iter().take_while(|b| **b != 0).map(|b| char::from(*b)).collect())
+}
+
+/// Inserts the properties of `lp` into the layer's Transform group, in the order the file uses.
+fn put_properties(cx: &Cx<'_>, layr: &mut Chunk<'static>, lp: &LayerPlan, cp: &CompPlan) -> R<()> {
+    if lp.props.is_empty() {
+        return Ok(());
+    }
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at = kids
+        .iter()
+        .position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Transform Group"))
+        .ok_or_else(|| tpl("layer without a Transform group"))?;
+    let group = kids.get_mut(at + 1).ok_or_else(|| tpl("Transform group without a list"))?;
+    let gk = kids_mut(group)?;
+    // Split the group into its header (up to the first match name) and (tdmn, node) pairs.
+    let first = gk.iter().position(|c| c.is(b"tdmn")).ok_or_else(|| tpl("empty Transform group"))?;
+    let header: Vec<Chunk<'static>> = gk.drain(..first).collect();
+    let mut pairs: Vec<(String, Vec<Chunk<'static>>)> = Vec::new();
+    let mut it = std::mem::take(gk).into_iter();
+    while let Some(m) = it.next() {
+        let name = tdmn_name(&m).unwrap_or_default();
+        if name == "ADBE Group End" {
+            pairs.push((name, vec![m]));
+            continue;
+        }
+        let node = it.next().ok_or_else(|| tpl("match name without a node"))?;
+        pairs.push((name, vec![m, node]));
+    }
+    for p in &lp.props {
+        let name = p.kind.match_name();
+        let built = build_prop(cx, p, lp, cp)?;
+        let tdmn = pairs.iter().find(|(n, _)| n == name).and_then(|(_, v)| v.first().cloned()).unwrap_or_else(|| {
+            cx.t.stat
+                .iter()
+                .chain(cx.t.keyd.iter())
+                .find(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(name))
+                .cloned()
+                .unwrap_or_else(|| Chunk::data(*b"tdmn", Vec::new()))
+        });
+        let entry = vec![tdmn, built];
+        if let Some(slot) = pairs.iter_mut().find(|(n, _)| n == name) {
+            slot.1 = entry;
+        } else {
+            pairs.push((name.to_string(), entry));
+        }
+    }
+    let rank = |n: &str| if n == "ADBE Group End" { usize::MAX } else { GROUP_ORDER.iter().position(|g| *g == n).unwrap_or(GROUP_ORDER.len()) };
+    pairs.sort_by_key(|(n, _)| rank(n));
+    gk.extend(header);
+    gk.extend(pairs.into_iter().flat_map(|(_, v)| v));
+    Ok(())
+}
+
+fn build_prop(cx: &Cx<'_>, p: &PropPlan, lp: &LayerPlan, cp: &CompPlan) -> R<Chunk<'static>> {
+    let idx = PropKind::ALL.iter().position(|k| *k == p.kind).ok_or_else(|| tpl("unknown property kind"))?;
+    let pool = if p.keys.is_empty() { &cx.t.stat } else { &cx.t.keyd };
+    let tdbs = pool.get(idx * 2 + 1).ok_or_else(|| tpl("prototype missing"))?;
+    let mut tdbs = tdbs.clone();
+    {
+        let tdb4 = child_data(&mut tdbs, b"tdb4")?;
+        put_u32(tdb4, 12, cp.tb.timescale)?;
+        if p.kind == PropKind::Anchor {
+            // The width / height of the layer's source (kept next to the anchor's other
+            // normalisation constants).
+            put_f64(tdb4, 24, f64::from(lp.source_size.0) / f64::from(lp.source_size.1.max(1)))?;
+        }
+        if let Some((_, enabled)) = &p.expr {
+            put_u8(tdb4, 76, 1)?;
+            put_u8(tdb4, 77, 1)?;
+            put_u8(tdb4, 120, 1)?;
+            put_u8(tdb4, 119, u8::from(!*enabled))?;
+        }
+    }
+    if p.keys.is_empty() {
+        let cdat = child_data(&mut tdbs, b"cdat")?;
+        cdat.iter_mut().for_each(|b| *b = 0);
+        for (i, v) in p.value.iter().enumerate() {
+            put_f64(cdat, i * 8, *v)?;
+        }
+    } else {
+        let list = list_mut(&mut tdbs, b"list")?;
+        let n = u32::try_from(p.keys.len()).map_err(|_| tpl("too many keys"))?;
+        let size = if p.kind.spatial() { 56 + 24 * p.kind.dims() } else { 8 + 40 * p.kind.dims() };
+        {
+            let lhd3 = child_data(list, b"lhd3")?;
+            crate::export::synth::put_key_counts(lhd3, n, u32::try_from(size).map_err(|_| tpl("record size"))?)?;
+        }
+        let mut ldat = Vec::with_capacity(size * p.keys.len());
+        for k in &p.keys {
+            ldat.extend(key_record(p.kind, k, size)?);
+        }
+        let ld = kids_mut(list)?;
+        match ld.iter_mut().find(|c| c.is(b"ldat")) {
+            Some(c) => *c = Chunk::data(*b"ldat", ldat),
+            None => ld.push(Chunk::data(*b"ldat", ldat)),
+        }
+    }
+    if let Some((text, _)) = &p.expr {
+        let kids = kids_mut(&mut tdbs)?;
+        let at = kids.iter().position(|c| c.is(b"tdum")).unwrap_or(kids.len());
+        kids.insert(at, Chunk::data(*b"Utf8", text.as_bytes().to_vec()));
+    }
+    Ok(tdbs)
+}
+
+/// One keyframe record (`docs/aep-format.md`, 3.5).
+fn key_record(kind: PropKind, k: &KeyPlan, size: usize) -> R<Vec<u8>> {
+    let mut r = vec![0u8; size];
+    let n = kind.dims();
+    put_i32(&mut r, 0, k.time)?;
+    put_u8(&mut r, 4, k.in_interp)?;
+    put_u8(&mut r, 5, k.out_interp)?;
+    let base: u16 = if kind.spatial() { 0x0007 } else { 0 };
+    let flags = base | if k.roving { 0x0020 } else { 0 } | (u16::from(k.label) << 6);
+    put_u16(&mut r, 6, flags)?;
+    if kind.spatial() {
+        put_u32(&mut r, 8, u32::from(k.spatial_auto))?;
+        let (i, o) = (k.in_ease.first().copied().unwrap_or_default(), k.out_ease.first().copied().unwrap_or_default());
+        put_f64(&mut r, 24, i.speed)?;
+        put_f64(&mut r, 32, i.influence)?;
+        put_f64(&mut r, 40, o.speed)?;
+        put_f64(&mut r, 48, o.influence)?;
+        for j in 0..n {
+            put_f64(&mut r, 56 + 8 * j, k.value.get(j).copied().unwrap_or(0.0))?;
+            put_f64(&mut r, 56 + 8 * n + 8 * j, k.spatial_in.get(j).copied().unwrap_or(0.0))?;
+            put_f64(&mut r, 56 + 16 * n + 8 * j, k.spatial_out.get(j).copied().unwrap_or(0.0))?;
+        }
+    } else {
+        r = plain_record(n, k, size)?;
+    }
+    Ok(r)
+}
+
+/// A plain keyframe record with `n` components: value at 8, then the type-major ease blocks.
+pub(crate) fn plain_record(n: usize, k: &KeyPlan, size: usize) -> R<Vec<u8>> {
+    let mut r = vec![0u8; size];
+    put_i32(&mut r, 0, k.time)?;
+    put_u8(&mut r, 4, k.in_interp)?;
+    put_u8(&mut r, 5, k.out_interp)?;
+    let flags = if k.roving { 0x0020 } else { 0 } | (u16::from(k.label) << 6);
+    put_u16(&mut r, 6, flags)?;
+    for j in 0..n {
+        put_f64(&mut r, 8 + 8 * j, k.value.get(j).copied().unwrap_or(0.0))?;
+    }
+    let base = 8 + 8 * n;
+    for j in 0..n {
+        let i = k.in_ease.get(j).or(k.in_ease.last()).copied().unwrap_or_default();
+        let o = k.out_ease.get(j).or(k.out_ease.last()).copied().unwrap_or_default();
+        put_f64(&mut r, base + 8 * j, i.speed)?;
+        put_f64(&mut r, base + 8 * n + 8 * j, i.influence)?;
+        put_f64(&mut r, base + 16 * n + 8 * j, o.speed)?;
+        put_f64(&mut r, base + 24 * n + 8 * j, o.influence)?;
+    }
+    Ok(r)
+}
diff --git a/crates/aep/src/export/footage.rs b/crates/aep/src/export/footage.rs
new file mode 100644
index 000000000..3ff732db3
--- /dev/null
+++ b/crates/aep/src/export/footage.rs
@@ -0,0 +1,653 @@
+//! Footage items (files), built in code per kind ([`FtProtos::build`]) with the layout of the items
+//! After Effects writes when it imports a file of that kind: png still 607, jpeg 605, OpenEXR 604,
+//! TIFF 613, H.264 mp4 606, QuickTime mov 612, WAV 351, png sequence 353, OpenEXR sequence 603,
+//! jpeg sequence 611, Targa, Photoshop, Illustrator and EPS 650-653. The colour management names
+//! our own sRGB profile (`icc.rs`). The exporter then writes the decoded fields
+//! (`docs/aep-format.md` 3.3, `docs/aep-export.md` R28):
+//!
+//! * the alias JSON (`Als2/alas`): the full path, for a sequence its folder with
+//!   `target_is_folder`;
+//! * `sspc`: width, height, duration (`num / den`), native frame rate, for sequences the first and
+//!   last frame number and the digits, and the folder's modification time when the caller gives
+//!   it ([`crate::export::export_with`]); the two `Utf8` around the number;
+//! * `opti` of png: width, height and the first file's name;
+//! * the item header: id, label, name; a fresh `pgui`.
+//!
+//! After Effects reads the format options of the other kinds from the file (their `opti` beyond
+//! the header can be zero: read-backs v-fN-zoptiA).
+
+use effectcraft_project::{Footage, FootageKind};
+
+use crate::export::report::{Collector, LossCategory};
+
+/// The prototype a footage item is cloned from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum FtKind {
+    Png,
+    Jpeg,
+    Exr,
+    Mp4,
+    Wav,
+    PngSeq,
+    ExrSeq,
+    JpegSeq,
+    Mov,
+    Tiff,
+    Tga,
+    Psd,
+    Ai,
+    Eps,
+}
+
+impl FtKind {
+    /// The key a kind's prototype is found under.
+    pub(crate) fn key(self) -> [u8; 4] {
+        match self {
+            FtKind::Png => *b"png ",
+            FtKind::Jpeg => *b"jpg ",
+            FtKind::Exr => *b"exr ",
+            FtKind::Mp4 => *b"mp4 ",
+            FtKind::Wav => *b"wav ",
+            FtKind::PngSeq => *b"pngS",
+            FtKind::ExrSeq => *b"exrS",
+            FtKind::JpegSeq => *b"jpgS",
+            FtKind::Mov => *b"mov ",
+            FtKind::Tiff => *b"tif ",
+            FtKind::Tga => *b"tga ",
+            FtKind::Psd => *b"psd ",
+            FtKind::Ai => *b"ai  ",
+            FtKind::Eps => *b"eps ",
+        }
+    }
+
+    /// The denominator of a still's duration (`sspc@42`: png 1, jpeg 600, OpenEXR 100).
+    fn still_den(self) -> u32 {
+        match self {
+            FtKind::Jpeg | FtKind::Tiff | FtKind::Tga | FtKind::Psd | FtKind::Ai | FtKind::Eps => 600,
+            FtKind::Exr => 100,
+            _ => 1,
+        }
+    }
+
+    pub(crate) fn is_sequence(self) -> bool {
+        matches!(self, FtKind::PngSeq | FtKind::ExrSeq | FtKind::JpegSeq)
+    }
+}
+
+/// The numbering of a sequence.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Numbering {
+    pub prefix: String,
+    pub suffix: String,
+    pub start: u32,
+    pub end: u32,
+    pub digits: u32,
+}
+
+/// A footage item in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct FootagePlan {
+    pub kind: FtKind,
+    /// The alias target: the file, or a sequence's folder.
+    pub alias: String,
+    /// The (first) file's path as the project stores it: what the caller of
+    /// [`crate::export::export_with`] checks before it reads the sequence folder's time.
+    pub source: String,
+    /// The (first) file's name.
+    pub file_name: String,
+    pub width: u32,
+    pub height: u32,
+    /// Duration as stored, `num / den` seconds.
+    pub duration: (u32, u32),
+    /// Native frame rate (sequences and clips), 0 otherwise.
+    pub fps: u32,
+    /// The rate a clip is conformed to (`sspc@146`, also the effective rate at @150; 645), 0 when
+    /// it plays at its native rate.
+    pub conform: u32,
+    pub numbering: Option<Numbering>,
+    /// The duration in seconds (the Time Remapping maximum of a layer showing it).
+    pub seconds: f64,
+    /// A sequence's folder modification time as stored (`sspc@118`, seconds since 1904, UTC; 860),
+    /// when the caller supplied it ([`crate::export::export_with`]).
+    pub folder_time: Option<u32>,
+}
+
+/// Seconds between 1904-01-01 (the stored time's epoch) and 1970-01-01.
+const SECONDS_1904_TO_1970: u64 = 2_082_844_800;
+
+/// Fills in the folder time of every image sequence in `root` (folders included) from
+/// `folder_time`, asked with the sequence's first file as the project stores it (seconds since
+/// 1970); a time that does not fit the stored field is left out.
+pub(crate) fn stamp_sequences(root: &mut [crate::export::plan::Entry], folder_time: &dyn Fn(&str) -> Option<u64>) {
+    use crate::export::plan::ItemPlan;
+    // Folders were planned with a bounded depth; walk them with an explicit stack anyway.
+    let mut stack: Vec<&mut [crate::export::plan::Entry]> = vec![root];
+    while let Some(entries) = stack.pop() {
+        for e in entries.iter_mut() {
+            match &mut e.plan {
+                ItemPlan::Folder(kids) => stack.push(kids),
+                ItemPlan::Footage(fp) if fp.kind.is_sequence() => {
+                    fp.folder_time = folder_time(&fp.source).and_then(|t| u32::try_from(t.checked_add(SECONDS_1904_TO_1970)?).ok());
+                }
+                _ => {}
+            }
+        }
+    }
+}
+
+fn ext(path: &str) -> String {
+    let name = path.rsplit(['\\', '/']).next().unwrap_or_default();
+    match name.rsplit_once('.') {
+        Some((_, e)) => e.to_ascii_lowercase(),
+        None => String::new(),
+    }
+}
+
+fn split_dir(path: &str) -> (&str, &str) {
+    match path.rfind(['\\', '/']) {
+        Some(i) => (path.get(..i).unwrap_or_default(), path.get(i + 1..).unwrap_or_default()),
+        None => ("", path),
+    }
+}
+
+/// `shot_0101.exr` -> (`shot_`, 101, 4, `.exr`): the last run of digits before the extension.
+fn parse_numbered(name: &str) -> Option<(String, u32, u32, String)> {
+    let dot = name.rfind('.').unwrap_or(name.len());
+    let stem = name.get(..dot)?;
+    let digits = stem.chars().rev().take_while(char::is_ascii_digit).count();
+    if digits == 0 || digits > 9 {
+        return None;
+    }
+    let split = stem.len().checked_sub(digits)?;
+    let number: u32 = stem.get(split..)?.parse().ok()?;
+    Some((stem.get(..split)?.to_string(), number, u32::try_from(digits).ok()?, name.get(dot..)?.to_string()))
+}
+
+/// Whole frames at an integer rate, or `None` (a rate After Effects' footage header stores as an
+/// integer: 30 in 353 and 603, 25 in 606).
+fn integer_rate(f: &Footage) -> Option<u32> {
+    let r = f.frame_rate;
+    (r.den == 1 && r.num > 0).then(|| u32::try_from(r.num).ok()).flatten()
+}
+
+/// Plans one footage item, or reports why it cannot be written.
+pub(crate) fn plan_footage(name: &str, f: &Footage, col: &mut Collector) -> Option<FootagePlan> {
+    let what = |why: &str| format!("footage '{name}': {why}");
+    if f.layer.is_some() {
+        col.lose(LossCategory::FootageItems, what("one layer of a layered file is not exported"));
+        return None;
+    }
+    // Interpret Footage settings other than the defaults are not written (After Effects
+    // interprets the file itself).
+    let d = Footage::default();
+    let unwritten = [
+        ((f.pixel_aspect - d.pixel_aspect).abs() > 1e-9, "pixel aspect"),
+        (f.alpha != d.alpha || f.premul_color != d.premul_color, "alpha interpretation"),
+        (f.invert_alpha, "Invert Alpha"),
+        (f.loop_count != d.loop_count, "loop count"),
+        (f.color_profile.is_some(), "colour profile"),
+        (f.fields != d.fields, "field order"),
+        (f.linear_light != d.linear_light, "Interpret As Linear Light"),
+        (f.preserve_rgb != d.preserve_rgb, "Preserve RGB"),
+        (f.cineon != d.cineon, "Cineon settings"),
+    ];
+    for (_, setting) in unwritten.iter().filter(|(on, _)| *on) {
+        col.lose(LossCategory::FootageItems, what(&format!("the Interpret Footage {setting} is not written (the default is)")));
+    }
+    let e = ext(&f.path);
+    let kind = match (f.kind, e.as_str()) {
+        (FootageKind::Still, "png") => FtKind::Png,
+        (FootageKind::Still, "jpg" | "jpeg") => FtKind::Jpeg,
+        (FootageKind::Still, "exr") => FtKind::Exr,
+        (FootageKind::Still, "tif" | "tiff") => FtKind::Tiff,
+        (FootageKind::Still, "tga") => FtKind::Tga,
+        (FootageKind::Still, "psd") => FtKind::Psd,
+        (FootageKind::Still, "ai") => FtKind::Ai,
+        (FootageKind::Still, "eps") => FtKind::Eps,
+        (FootageKind::Sequence, "jpg" | "jpeg") => FtKind::JpegSeq,
+        (FootageKind::Video, "mov") => FtKind::Mov,
+        (FootageKind::Sequence, "png") => FtKind::PngSeq,
+        (FootageKind::Sequence, "exr") => FtKind::ExrSeq,
+        (FootageKind::Video, "mp4" | "m4v") => FtKind::Mp4,
+        (FootageKind::Audio, "wav") => FtKind::Wav,
+        _ => {
+            col.lose(LossCategory::FootageItems, what(&format!("{:?} footage of type '.{e}' is not exported (no prototype)", f.kind)));
+            return None;
+        }
+    };
+    if f.path.is_empty() || f.path.chars().any(char::is_control) {
+        col.lose(LossCategory::FootageItems, what("no usable path"));
+        return None;
+    }
+    if f.width > crate::export::plan::MAX_SIDE || f.height > crate::export::plan::MAX_SIDE {
+        col.lose(
+            LossCategory::FootageItems,
+            what(&format!("size {} x {} is larger than {}, written smaller", f.width, f.height, crate::export::plan::MAX_SIDE)),
+        );
+    }
+    let width = f.width.min(crate::export::plan::MAX_SIDE);
+    let height = f.height.min(crate::export::plan::MAX_SIDE);
+    let (dir, file) = split_dir(&f.path);
+    let mut plan = FootagePlan {
+        kind,
+        alias: f.path.clone(),
+        source: f.path.clone(),
+        file_name: file.to_string(),
+        width,
+        height,
+        duration: (0, kind.still_den()),
+        fps: 0,
+        conform: 0,
+        numbering: None,
+        seconds: 0.0,
+        folder_time: None,
+    };
+    match kind {
+        FtKind::PngSeq | FtKind::ExrSeq | FtKind::JpegSeq => {
+            let Some(fps) = integer_rate(f) else {
+                col.lose(
+                    LossCategory::FootageItems,
+                    what(&format!("a sequence at {} fps is not exported (only whole rates are sampled)", f.frame_rate.label())),
+                );
+                return None;
+            };
+            let Some((prefix, start, digits, suffix)) = parse_numbered(file) else {
+                col.lose(LossCategory::FootageItems, what("a sequence whose first file has no frame number"));
+                return None;
+            };
+            // The files must be the run start, start + 1, ... with the same name around the number.
+            let files: Vec<&str> = if f.sequence.is_empty() { vec![file] } else { f.sequence.iter().map(|p| split_dir(p).1).collect() };
+            let mut expect = start;
+            for name in &files {
+                let ok = parse_numbered(name).is_some_and(|(p, n, _, s)| p == prefix && s == suffix && n == expect);
+                if !ok {
+                    col.lose(LossCategory::FootageItems, what("a sequence with gaps or mixed names is not exported"));
+                    return None;
+                }
+                expect = expect.saturating_add(1);
+            }
+            let count = u32::try_from(files.len()).unwrap_or(u32::MAX);
+            plan.alias = dir.to_string();
+            plan.fps = fps;
+            plan.duration = (count, fps);
+            plan.seconds = f64::from(count) / f64::from(fps.max(1));
+            plan.numbering = Some(Numbering { prefix, suffix, start, end: start.saturating_add(count.saturating_sub(1)), digits });
+            if dir.is_empty() {
+                col.lose(LossCategory::FootageItems, what("a sequence without a folder"));
+                return None;
+            }
+        }
+        FtKind::Mp4 | FtKind::Mov => {
+            let Some(fps) = integer_rate(f) else {
+                col.lose(LossCategory::FootageItems, what(&format!("a clip at {} fps is not exported (only whole rates are sampled)", f.frame_rate.label())));
+                return None;
+            };
+            // A conformed clip (645): the frames play at `fps`, the stored duration stays in the
+            // native rate's frames, and the conformed rate goes to @146 and @150.
+            let native = match f.native_rate {
+                Some(n) if n != f.frame_rate => {
+                    if n.den == 1 && n.num > 0 && n.num <= i64::from(u32::MAX) {
+                        u32::try_from(n.num).ok()
+                    } else {
+                        col.lose(
+                            LossCategory::FootageItems,
+                            what(&format!("a clip with the native rate {} fps is written at its conformed rate only", n.label())),
+                        );
+                        None
+                    }
+                }
+                _ => None,
+            };
+            let frames = (f.duration.seconds() * f64::from(fps)).round();
+            let frames = if frames.is_finite() && frames >= 1.0 && frames < f64::from(u32::MAX) {
+                frames as u32
+            } else {
+                col.lose(LossCategory::FootageItems, what("a duration that cannot be stored, written as 1 frame"));
+                1
+            };
+            plan.seconds = f64::from(frames) / f64::from(fps.max(1));
+            match native {
+                Some(n) => {
+                    plan.fps = n;
+                    plan.conform = fps;
+                    plan.duration = (frames, n);
+                }
+                None => {
+                    plan.fps = fps;
+                    plan.duration = (frames, fps);
+                }
+            }
+        }
+        FtKind::Wav => {
+            // The sample rate is the denominator (351: 48 000 / 48 000 for 1 s).
+            let secs = f.duration.seconds();
+            let samples = (secs * 48_000.0).round();
+            let samples = if samples.is_finite() && samples >= 1.0 && samples < f64::from(u32::MAX) {
+                samples as u32
+            } else {
+                col.lose(LossCategory::FootageItems, what("a duration that cannot be stored, written as 1 second"));
+                48_000
+            };
+            plan.duration = (samples, 48_000);
+            plan.seconds = f64::from(samples) / 48_000.0;
+        }
+        FtKind::Png | FtKind::Jpeg | FtKind::Exr | FtKind::Tiff | FtKind::Tga | FtKind::Psd | FtKind::Ai | FtKind::Eps => {}
+    }
+    col.exported.footage = col.exported.footage.saturating_add(1);
+    Some(plan)
+}
+
+/// The alias JSON After Effects reads (`Als2/alas`, 126, 351, 353, 603), with the path escaped.
+pub(crate) fn alias_json(p: &FootagePlan) -> Vec<u8> {
+    let mut path = String::with_capacity(p.alias.len() + 8);
+    for c in p.alias.chars() {
+        match c {
+            '"' => path.push_str("\\\""),
+            '\\' => path.push_str("\\\\"),
+            c if (c as u32) < 0x20 => path.push_str(&format!("\\u{:04x}", c as u32)),
+            c => path.push(c),
+        }
+    }
+    let folder = p.kind.is_sequence();
+    format!(
+        "{{\"ascendcount_base\":1,\"ascendcount_target\":{},\"fullpath\":\"{path}\",\"platform\":1,\"server_name\":\"\",\"server_volume_name\":\"\",\"target_is_folder\":{folder}}}",
+        if folder { 2 } else { 1 }
+    )
+    .into_bytes()
+}
+
+// ---------------------------------------------------------------------------------------------
+// Emit.
+
+use crate::Chunk;
+
+use crate::export::tree::{R, child_data, kids_mut, list_mut, put, put_cstr, put_u8, put_u16, put_u32, tpl};
+
+/// The footage prototypes: per kind the item and the f-records that follow it.
+pub(crate) struct FtProtos {
+    items: Vec<([u8; 4], Vec<Chunk<'static>>)>,
+}
+
+/// Every kind the exporter writes.
+const KINDS: [FtKind; 14] = [
+    FtKind::Png,
+    FtKind::Jpeg,
+    FtKind::Exr,
+    FtKind::Mp4,
+    FtKind::Wav,
+    FtKind::PngSeq,
+    FtKind::ExrSeq,
+    FtKind::JpegSeq,
+    FtKind::Mov,
+    FtKind::Tiff,
+    FtKind::Tga,
+    FtKind::Psd,
+    FtKind::Ai,
+    FtKind::Eps,
+];
+
+/// The colour management a kind's item carries (`Pin /CLRS`, 351, 353, 603-607, 611-613, 650-653).
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Clrs {
+    /// Stills, sequences and audio: interpreted in the sRGB profile (`apid` its id).
+    Assigned,
+    /// A file with an embedded profile (TIFF, Photoshop): `epid` its id, the profile twice.
+    Embedded,
+    /// Video and JPEG: Rec. 709 with the codec's colour description.
+    Video(&'static str),
+}
+
+/// The colour description After Effects gives a JPEG, a jpeg sequence and a ProRes clip.
+const BT709_FULL: &str = r#"{"baseColorProfile":{"colorProfileName":"BT.709 RGB Full"},"baseProfileType":1}"#;
+/// The colour description of an H.264 clip.
+const BT709_DISPLAY: &str =
+    r#"{"baseColorProfile":{"colorProfileData":"AQAAAP////8=","colorProfileName":"BT.709,8-bit,Display-Referred"},"baseProfileType":1}"#;
+
+/// What a kind's item stores beyond the decoded fields: the file type tag (`sspc` 22, `opti` 0),
+/// `idta` byte 23, the bits per pixel of the sampled file (`sspc` 63), `sspc` byte 73 (3, 1 for
+/// OpenEXR, 0 for Illustrator and EPS), the `opti` size and its header bytes 4, 5 and 10 (the rest of
+/// `opti` can be zero: read-back v-fN-zoptiA), and the colour management.
+struct KindSpec {
+    tag: [u8; 4],
+    idta23: u8,
+    bpp: u8,
+    b73: u8,
+    opti: (u16, u8, u8, u8),
+    clrs: Clrs,
+}
+
+fn spec(kind: FtKind) -> KindSpec {
+    let (tag, idta23, bpp, b73, opti, clrs) = match kind {
+        FtKind::Png => (*b"png!", 0x30, 24, 3, (322, 0, 1, 1), Clrs::Assigned),
+        FtKind::Jpeg => (*b"ZPEG", 0x30, 24, 3, (58, 0, 5, 0), Clrs::Video(BT709_FULL)),
+        FtKind::Exr => (*b"oEXR", 0x30, 128, 1, (9750, 0, 1, 1), Clrs::Assigned),
+        FtKind::Mp4 => (*b"XCEX", 0x20, 24, 3, (58, 0, 5, 0), Clrs::Video(BT709_DISPLAY)),
+        FtKind::Wav => (*b"WAVE", 0x04, 0, 3, (58, 0, 5, 0), Clrs::Assigned),
+        FtKind::PngSeq => (*b"png!", 0x20, 24, 3, (322, 0, 1, 1), Clrs::Assigned),
+        FtKind::ExrSeq => (*b"oEXR", 0x20, 128, 1, (9750, 0, 1, 1), Clrs::Assigned),
+        FtKind::JpegSeq => (*b"ZPEG", 0x20, 24, 3, (58, 0, 5, 0), Clrs::Video(BT709_FULL)),
+        FtKind::Mov => (*b"MOoV", 0x20, 48, 3, (58, 0, 5, 0), Clrs::Video(BT709_FULL)),
+        FtKind::Tiff => (*b"TIF ", 0x30, 24, 3, (602, 1, 9, 0), Clrs::Embedded),
+        FtKind::Tga => (*b"TPIC", 0x30, 24, 3, (30, 0, 46, 5), Clrs::Assigned),
+        FtKind::Psd => (*b"8BPS", 0x30, 24, 3, (602, 1, 9, 0), Clrs::Embedded),
+        FtKind::Ai | FtKind::Eps => (*b"TEXT", 0x30, 32, 0, (596, 0, 8, 0), Clrs::Assigned),
+    };
+    KindSpec { tag, idta23, bpp, b73, opti, clrs }
+}
+
+/// The colour-management list of a kind (the order After Effects writes).
+fn clrs(kind: Clrs) -> Chunk<'static> {
+    use crate::export::base::utf8;
+    let icc = crate::export::icc::srgb();
+    let id = crate::export::icc::profile_id(&icc).to_vec();
+    let json = crate::export::icc::profile_json(&icc, crate::export::icc::SRGB_NAME);
+    let none = vec![0xffu8; 16];
+    let one = |id: &[u8; 4]| Chunk::data(*id, vec![1u8]);
+    let tail = |kids: &mut Vec<Chunk<'static>>| {
+        kids.push(one(b"hdrm"));
+        kids.push(utf8("{}"));
+    };
+    let mut kids = match kind {
+        Clrs::Assigned => vec![
+            Chunk::data(*b"epid", none),
+            Chunk::data(*b"apid", id),
+            Chunk::data(*b"linl", vec![2, 0, 0, 0]),
+            one(b"embp"),
+            Chunk::data(*b"ipws", vec![0]),
+            one(b"Mcsp"),
+            utf8(""),
+            one(b"ocsp"),
+            utf8(&json),
+        ],
+        Clrs::Embedded => vec![
+            Chunk::data(*b"epid", id),
+            Chunk::data(*b"apid", none),
+            Chunk::data(*b"linl", vec![2, 0, 0, 0]),
+            one(b"embp"),
+            Chunk::data(*b"ipws", vec![0]),
+            one(b"mcsp"),
+            utf8(&json),
+            one(b"Mcsp"),
+            utf8(&json),
+            one(b"ocsp"),
+            utf8(""),
+        ],
+        Clrs::Video(desc) => vec![
+            Chunk::data(*b"epid", none.clone()),
+            Chunk::data(*b"apid", none),
+            one(b"empd"),
+            utf8("Rec. 709"),
+            Chunk::data(*b"linl", vec![0; 4]),
+            one(b"embp"),
+            Chunk::data(*b"ipws", vec![0]),
+            one(b"mcsp"),
+            utf8(desc),
+            one(b"Mcsp"),
+            utf8(desc),
+            one(b"ocsp"),
+            utf8(""),
+        ],
+    };
+    tail(&mut kids);
+    Chunk::list(*b"CLRS", kids)
+}
+
+/// The item of a kind with zero ids and an empty alias (`build_footage` fills them), and the
+/// f-records after it. `sspc` holds the tag, the bits per pixel, the time base of a still (600:
+/// a clip's is its rate, written per item) and the bytes that have the same value in every
+/// generated test file of the kind (125, 129,
+/// 139, 143, 188..195; a sequence also 168, 184, 186, 187; a WAV its sample rate at 160); the bytes
+/// left zero were zero in read-backs v-fN-zsspc1..3. `mnfo` is left out (v-fN-nomnfo).
+fn kind_item(kind: FtKind) -> Vec<Chunk<'static>> {
+    use crate::export::base::{bytes, utf8};
+    let s = spec(kind);
+    let mut fields: Vec<(usize, Vec<u8>)> = vec![
+        (22, s.tag.to_vec()),
+        (50, 600u32.to_be_bytes().to_vec()),
+        (63, vec![s.bpp]),
+        (73, vec![s.b73]),
+        (125, vec![0x0c]),
+        (129, vec![1]),
+        (139, vec![1]),
+        (143, vec![1]),
+        (188, vec![0xff; 8]),
+    ];
+    if kind.is_sequence() {
+        fields.extend([(168, 2u32.to_be_bytes().to_vec()), (184, vec![1]), (186, vec![1, 1])]);
+    }
+    if kind == FtKind::Wav {
+        fields.push((160, 48_000f64.to_be_bytes().to_vec()));
+    }
+    let refs: Vec<(usize, &[u8])> = fields.iter().map(|(at, v)| (*at, v.as_slice())).collect();
+    let (len, b4, b5, b10) = s.opti;
+    let opti = bytes(usize::from(len), &[(0, &s.tag), (4, &[b4, b5]), (8, &len.to_be_bytes()), (10, &[b10])]);
+    let mut pin = vec![Chunk::data(*b"sspc", bytes(222, &refs)), utf8(""), Chunk::list(*b"Als2", vec![Chunk::data(*b"alas", b"{}".to_vec())])];
+    if kind.is_sequence() {
+        pin.extend([utf8(""), utf8("")]);
+    }
+    pin.extend([Chunk::data(*b"opti", opti), Chunk::data(*b"pgui", vec![0; 16]), clrs(s.clrs), utf8("")]);
+    let item = Chunk::list(
+        *b"Item",
+        vec![
+            Chunk::data(*b"iide", vec![0; 4]),
+            Chunk::data(*b"idpc", vec![0; 8]),
+            crate::export::base::idta(7, s.idta23),
+            utf8(""),
+            Chunk::list(*b"Pin ", pin),
+            crate::export::base::ftgi(),
+            utf8(""),
+            crate::export::base::guides(),
+        ],
+    );
+    let mut out = vec![item];
+    out.extend(crate::export::skeleton::f_records());
+    out
+}
+
+impl FtProtos {
+    /// The items of every kind, built in code.
+    pub(crate) fn build() -> FtProtos {
+        FtProtos { items: KINDS.iter().map(|k| (k.key(), kind_item(*k))).collect() }
+    }
+}
+
+/// The item (and its f-records) for `p`, with the id, label and name, and a fresh `pgui`.
+pub(crate) fn build_footage(protos: &FtProtos, id: u32, label: u8, name: &str, p: &FootagePlan, guid: [u8; 16]) -> R<Vec<Chunk<'static>>> {
+    let key = p.kind.key();
+    let mut chunks = protos.items.iter().find(|(k, _)| *k == key).map(|(_, v)| v.clone()).ok_or_else(|| tpl("footage prototype missing"))?;
+    let item = chunks.get_mut(0).ok_or_else(|| tpl("empty footage prototype"))?;
+    put(child_data(item, b"iide")?, 0, &id.to_le_bytes())?;
+    {
+        let idta = child_data(item, b"idta")?;
+        put_u32(idta, 16, id)?;
+        put_u8(idta, 58, label)?;
+    }
+    // After Effects names a footage item after its file and then stores no name of its own (126,
+    // 603-607); a name of the user's is the item's `Utf8`. The WAV prototype keeps the name (351).
+    let default = match &p.numbering {
+        Some(n) => format!("{}[{:0w$}-{:0w$}]{}", n.prefix, n.start, n.end, n.suffix, w = usize::try_from(n.digits.min(16)).unwrap_or(0)),
+        None => p.file_name.clone(),
+    };
+    let stored = if name == default && p.kind != FtKind::Wav { "" } else { name };
+    crate::export::tree::set_utf8(item, stored)?;
+    let pin = list_mut(item, b"Pin ")?;
+    {
+        let sspc = child_data(pin, b"sspc")?;
+        put_u32(sspc, 30, p.width)?;
+        put_u32(sspc, 34, p.height)?;
+        put_u32(sspc, 38, p.duration.0)?;
+        put_u32(sspc, 42, p.duration.1)?;
+        if p.fps > 0 {
+            // A clip counts its time in its native rate (606, 612: 25); stills, sequences and
+            // audio in 600ths.
+            if matches!(p.kind, FtKind::Mp4 | FtKind::Mov) {
+                put_u32(sspc, 50, p.fps)?;
+            }
+            put_u32(sspc, 56, p.fps)?;
+            put_u32(sspc, 150, if p.conform > 0 { p.conform } else { p.fps })?;
+        }
+        if p.conform > 0 {
+            put_u32(sspc, 146, p.conform)?;
+        }
+        if let Some(n) = &p.numbering {
+            put_u32(sspc, 172, n.start)?;
+            put_u32(sspc, 176, n.end)?;
+            put_u32(sspc, 180, n.digits)?;
+        }
+        if let (true, Some(t)) = (p.kind.is_sequence(), p.folder_time) {
+            put_u32(sspc, 118, t)?;
+        }
+    }
+    {
+        let als = list_mut(pin, b"Als2")?;
+        let alas = kids_mut(als)?.iter_mut().find(|c| c.is(b"alas")).ok_or_else(|| tpl("footage prototype without alias"))?;
+        *alas = Chunk::data(*b"alas", alias_json(p));
+    }
+    if let Some(n) = &p.numbering {
+        // The two Utf8 between the alias and opti: the name around the number (353, 603).
+        let kids = kids_mut(pin)?;
+        let at = kids.iter().position(|c| c.is_list(b"Als2")).ok_or_else(|| tpl("footage prototype without alias"))?;
+        let mut names = [n.prefix.as_str(), n.suffix.as_str()].into_iter();
+        for c in kids.iter_mut().skip(at + 1).take_while(|c| !c.is(b"opti")) {
+            if c.is(b"Utf8")
+                && let Some(text) = names.next()
+            {
+                *c = Chunk::data(*b"Utf8", text.as_bytes().to_vec());
+            }
+        }
+    }
+    if matches!(p.kind, FtKind::Png | FtKind::PngSeq) {
+        // png options: width and height (u16 at 20 and 24) and the (first) file's name at 58
+        // (126, 353, 607).
+        let opti = child_data(pin, b"opti")?;
+        put_u16(opti, 20, u16::try_from(p.width).unwrap_or(u16::MAX))?;
+        put_u16(opti, 24, u16::try_from(p.height).unwrap_or(u16::MAX))?;
+        put_cstr(opti, 58, 256, &p.file_name)?;
+    }
+    put(child_data(pin, b"pgui")?, 0, &guid)?;
+    Ok(chunks)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every kind's item has the chunks After Effects refuses it without (`CLRS`, `ftgi`: read-backs
+    /// u-noclrs, u-noftgi) and the f-records after it; `opti` has its header and its size.
+    #[test]
+    fn every_kind_has_what_after_effects_needs() {
+        let protos = FtProtos::build();
+        assert_eq!(protos.items.len(), KINDS.len());
+        for (key, chunks) in &protos.items {
+            let what = String::from_utf8_lossy(key).into_owned();
+            let item = &chunks[0];
+            let pin = item.child_list(b"Pin ").unwrap();
+            assert!(pin.child_list(b"CLRS").is_some() && item.child(b"ftgi").is_some(), "{what}");
+            assert_eq!(chunks.len(), 8, "{what}: the item and seven f-records");
+            let opti = pin.child(b"opti").and_then(|c| c.bytes()).unwrap();
+            assert_eq!(usize::from(u16::from_be_bytes([opti[8], opti[9]])), opti.len(), "{what}");
+            let sspc = pin.child(b"sspc").and_then(|c| c.bytes()).unwrap();
+            assert_eq!(&sspc[22..26], &opti[0..4], "{what}");
+        }
+    }
+}
diff --git a/crates/aep/src/export/fx_defs.rs b/crates/aep/src/export/fx_defs.rs
new file mode 100644
index 000000000..e8464bada
--- /dev/null
+++ b/crates/aep/src/export/fx_defs.rs
@@ -0,0 +1,709 @@
+//! The effects the exporter writes and the parameters of each, in `parT` order: what After
+//! Effects shows for an effect (its match name and name, each parameter's id, type, default, slider
+//! range and valid maximum; aep-format.md 3.7). The exporter builds an effect's `parT` and value
+//! group from this table (`synth`); After Effects takes the full parameter definitions from the
+//! effect itself (read-back e1-zpardfull).
+//!
+//! The rows were listed from our effect cases (356-397 and the later effect batches) through the
+//! reader; `effect_map` names the parameters the importer and exporter convert.
+
+/// The id of the `ADBE Effect Built In Params` entry, the last of every effect.
+pub(crate) const BUILT_IN: u16 = u16::MAX;
+
+/// One parameter: its id (the `-NNNN` of its match name, not its position), its type (`pard`
+/// code: 0 layer, 1 integer slider, 2 fixed slider, 3 angle, 4 checkbox, 5 colour, 6 point, 7
+/// popup, 9 no data, 10 float slider, 11 arbitrary data, 12 path, 13 / 14 group start / end, 15
+/// button), its default in stored units, its slider range and its valid maximum.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct PDef {
+    pub id: u16,
+    pub code: u8,
+    pub default: &'static [f64],
+    pub range: Option<(f64, f64)>,
+    pub valid_max: Option<f64>,
+    /// The valid minimum of a slider.
+    pub valid_min: Option<f64>,
+    /// The display word of a slider: the decimals and the percent switch (fixed and integer
+    /// `pard@144`, float `pard@124`: aep-format.md 3.7); of a popup, its item count.
+    pub display: u32,
+}
+
+/// One effect.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct FxDef {
+    pub match_name: &'static str,
+    /// The effect's name (`fnam`).
+    pub name: &'static str,
+    pub params: &'static [PDef],
+}
+
+impl FxDef {
+    /// The match name of parameter `p` (`ADBE Tint-0003`).
+    pub fn record(&self, p: &PDef) -> String {
+        if p.id == BUILT_IN { "ADBE Effect Built In Params".to_string() } else { format!("{}-{:04}", self.match_name, p.id) }
+    }
+}
+
+const fn p(id: u16, code: u8, default: &'static [f64], range: Option<(f64, f64)>, valid_max: Option<f64>, valid_min: Option<f64>, display: u32) -> PDef {
+    PDef { id, code, default, range, valid_max, valid_min, display }
+}
+
+const fn fx(match_name: &'static str, name: &'static str, params: &'static [PDef]) -> FxDef {
+    FxDef { match_name, name, params }
+}
+
+#[rustfmt::skip]
+pub(crate) static FX_DEFS: &[FxDef] = &[
+    fx("ADBE Tint", "Tint", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 5, &[0.0, 0.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(2, 5, &[0.0, 255.0, 255.0, 255.0], None, None, None, 0x00000000),
+        p(3, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(4, 15, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Ramp", "Gradient Ramp", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.5, 0.0], None, None, None, 0x00000000),
+        p(2, 5, &[255.0, 0.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(3, 6, &[0.5, 1.0], None, None, None, 0x00000000),
+        p(4, 5, &[255.0, 255.0, 255.0, 255.0], None, None, None, 0x00000000),
+        p(5, 7, &[1.0], None, None, None, 0x00000002),
+        p(6, 2, &[0.0], Some((0.0, 50.0)), Some(512.0), Some(0.0), 0x00010000),
+        p(7, 2, &[0.0], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(8, 15, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Exposure2", "Exposure", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000002),
+        p(2, 13, &[], None, None, None, 0x00000000),
+        p(3, 10, &[0.0], Some((-4.0, 4.0)), Some(100.0), Some(-100.0), 0x00020000),
+        p(4, 10, &[0.0], Some((-0.5, 0.5)), Some(2.0), Some(-2.0), 0x00040000),
+        p(5, 10, &[1.0], Some((0.10000000149011612, 10.0)), Some(10.0), Some(0.10000000149011612), 0x00020000),
+        p(6, 14, &[], None, None, None, 0x00000000),
+        p(7, 13, &[], None, None, None, 0x00000000),
+        p(8, 10, &[0.0], Some((-4.0, 4.0)), Some(100.0), Some(-100.0), 0x00020000),
+        p(9, 10, &[0.0], Some((-0.5, 0.5)), Some(2.0), Some(-2.0), 0x00040000),
+        p(10, 10, &[1.0], Some((0.10000000149011612, 10.0)), Some(10.0), Some(0.10000000149011612), 0x00020000),
+        p(11, 14, &[], None, None, None, 0x00000000),
+        p(12, 13, &[], None, None, None, 0x00000000),
+        p(13, 10, &[0.0], Some((-4.0, 4.0)), Some(100.0), Some(-100.0), 0x00020000),
+        p(14, 10, &[0.0], Some((-0.5, 0.5)), Some(2.0), Some(-2.0), 0x00040000),
+        p(15, 10, &[1.0], Some((0.10000000149011612, 10.0)), Some(10.0), Some(0.10000000149011612), 0x00020000),
+        p(16, 14, &[], None, None, None, 0x00000000),
+        p(17, 13, &[], None, None, None, 0x00000000),
+        p(18, 10, &[0.0], Some((-4.0, 4.0)), Some(100.0), Some(-100.0), 0x00020000),
+        p(19, 10, &[0.0], Some((-0.5, 0.5)), Some(2.0), Some(-2.0), 0x00040000),
+        p(20, 10, &[1.0], Some((0.10000000149011612, 10.0)), Some(10.0), Some(0.10000000149011612), 0x00020000),
+        p(21, 14, &[], None, None, None, 0x00000000),
+        p(22, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Invert", "Invert", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000010),
+        p(2, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00000001),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Box Blur2", "Fast Box Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 127.0)), Some(30000.0), Some(0.0), 0x00010000),
+        p(2, 1, &[3.0], Some((1.0, 5.0)), Some(50.0), Some(1.0), 0x00000000),
+        p(3, 7, &[1.0], None, None, None, 0x00000003),
+        p(4, 4, &[1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Gaussian Blur 2", "Gaussian Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 10, &[25.0], Some((0.0, 50.0)), Some(30000.0), Some(0.0), 0x00010000),
+        p(2, 7, &[1.0], None, None, None, 0x00000003),
+        p(3, 4, &[1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Drop Shadow", "Drop Shadow", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 5, &[255.0, 0.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(2, 2, &[127.5], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000001),
+        p(3, 3, &[135.0], None, None, None, 0x00000000),
+        p(4, 2, &[5.0], Some((0.0, 120.0)), Some(4000.0), Some(0.0), 0x00010000),
+        p(5, 2, &[0.0], Some((0.0, 250.0)), Some(30000.0), Some(0.0), 0x00010000),
+        p(6, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Timewarp", "Timewarp", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[3.0], None, None, None, 0x00000003),
+        p(2, 7, &[1.0], None, None, None, 0x00000002),
+        p(3, 2, &[50.0], Some((-100.0, 100.0)), Some(5000.0), Some(-5000.0), 0x00020000),
+        p(4, 2, &[0.0], Some((0.0, 1000.0)), Some(5000.0), Some(-5000.0), 0x00020000),
+        p(5, 13, &[], None, None, None, 0x00000000),
+        p(6, 2, &[20.0], Some((5.0, 100.0)), Some(100.0), Some(5.0), 0x00020000),
+        p(7, 13, &[], None, None, None, 0x00000000),
+        p(8, 2, &[500.0], Some((-1000.0, 1000.0)), Some(5000.0), Some(-5000.0), 0x00020000),
+        p(9, 2, &[500.0], Some((-1000.0, 1000.0)), Some(5000.0), Some(-5000.0), 0x00020000),
+        p(10, 1, &[5.0], Some((1.0, 50.0)), Some(300.0), Some(1.0), 0x00000000),
+        p(11, 14, &[], None, None, None, 0x00000000),
+        p(12, 4, &[0.0], None, None, None, 0x00000000),
+        p(13, 4, &[0.0], None, None, None, 0x00000000),
+        p(14, 7, &[1.0], None, None, None, 0x00000002),
+        p(15, 2, &[1.0], Some((0.0, 10.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(16, 1, &[6.0], Some((4.0, 40.0)), Some(1000.0), Some(4.0), 0x00000000),
+        p(17, 13, &[], None, None, None, 0x00000000),
+        p(18, 2, &[29.899993896484375], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(19, 2, &[58.69999694824219], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(20, 2, &[11.44000244140625], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(277, 14, &[], None, None, None, 0x00000000),
+        p(278, 14, &[], None, None, None, 0x00000000),
+        p(23, 13, &[], None, None, None, 0x00000000),
+        p(24, 4, &[0.0], None, None, None, 0x00000000),
+        p(25, 7, &[2.0], None, None, None, 0x00000002),
+        p(26, 2, &[180.0], Some((0.0, 360.0)), Some(5000.0), Some(0.0), 0x00020000),
+        p(27, 1, &[5.0], Some((1.0, 20.0)), Some(1000.0), Some(1.0), 0x00000000),
+        p(28, 14, &[], None, None, None, 0x00000000),
+        p(29, 0, &[], None, None, None, 0x00000000),
+        p(30, 7, &[3.0], None, None, None, 0x00000004),
+        p(31, 0, &[], None, None, None, 0x00000000),
+        p(32, 7, &[1.0], None, None, None, 0x00000004),
+        p(33, 13, &[], None, None, None, 0x00000000),
+        p(34, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(35, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(36, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(37, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(38, 14, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Glo2", "Glow", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[2.0], None, None, None, 0x00000002),
+        p(2, 2, &[153.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00010001),
+        p(3, 2, &[10.0], Some((0.0, 100.0)), Some(1000.0), Some(0.0), 0x00010000),
+        p(4, 2, &[1.0], Some((0.0, 4.0)), Some(255.0), Some(0.0), 0x00010000),
+        p(5, 7, &[2.0], None, None, None, 0x00000003),
+        p(6, 7, &[3.0], None, None, None, 0x00000019),
+        p(7, 7, &[1.0], None, None, None, 0x00000003),
+        p(8, 7, &[3.0], None, None, None, 0x00000004),
+        p(9, 2, &[1.0], Some((1.0, 10.0)), Some(127.0), Some(1.0), 0x00010000),
+        p(10, 3, &[0.0], None, None, None, 0x00000000),
+        p(11, 2, &[0.5], Some((0.0099945068359375, 0.9900054931640625)), Some(0.9900054931640625), Some(0.0099945068359375), 0x00000001),
+        p(12, 5, &[255.0, 255.0, 255.0, 255.0], None, None, None, 0x00000000),
+        p(13, 5, &[255.0, 0.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(14, 7, &[1.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Fill", "Fill", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 12, &[], None, None, None, 0x00000000),
+        p(7, 4, &[0.0], None, None, None, 0x00000000),
+        p(2, 5, &[255.0, 255.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(6, 4, &[0.0], None, None, None, 0x00000000),
+        p(3, 2, &[0.0], Some((0.0, 50.0)), Some(999.0), Some(0.0), 0x00010000),
+        p(4, 2, &[0.0], Some((0.0, 50.0)), Some(999.0), Some(0.0), 0x00010000),
+        p(5, 2, &[1.0], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE HUE SATURATION", "Hue/Saturation", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(2, 7, &[1.0], None, None, None, 0x00000007),
+        p(3, 11, &[], None, None, None, 0x00000000),
+        p(4, 3, &[0.0], None, None, None, 0x00000000),
+        p(5, 2, &[0.0], Some((-100.0, 100.0)), Some(100.0), Some(-100.0), 0x00000000),
+        p(6, 2, &[0.0], Some((-100.0, 100.0)), Some(100.0), Some(-100.0), 0x00000000),
+        p(7, 4, &[0.0], None, None, None, 0x00000000),
+        p(8, 3, &[0.0], None, None, None, 0x00000000),
+        p(9, 2, &[25.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00000000),
+        p(10, 2, &[0.0], Some((-100.0, 100.0)), Some(100.0), Some(-100.0), 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Easy Levels2", "Levels", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000005),
+        p(2, 11, &[], None, None, None, 0x00000000),
+        p(3, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(4, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(5, 10, &[1.0], Some((0.0, 5.0)), Some(5.0), Some(0.0), 0x00020000),
+        p(6, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(7, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(8, 7, &[3.0], None, None, None, 0x00000003),
+        p(9, 7, &[3.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Motion Blur", "Directional Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 3, &[90.0], None, None, None, 0x00000000),
+        p(2, 2, &[10.0], Some((0.0, 20.0)), Some(1000.0), Some(0.0), 0x00010000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Radial Blur", "Radial Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(5, 9, &[], None, None, None, 0x00000000),
+        p(1, 2, &[10.0], Some((0.0, 100.0)), Some(1000.0), Some(0.0), 0x00010000),
+        p(2, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(3, 7, &[1.0], None, None, None, 0x00000002),
+        p(4, 7, &[1.0], None, None, None, 0x00000002),
+        p(6, 1, &[0.0], Some((0.0, 1000.0)), Some(10000.0), Some(0.0), 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("CC Radial Blur", "CC Radial Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[6.0], None, None, None, 0x00000007),
+        p(2, 2, &[0.0], Some((-100.0, 100.0)), Some(250.0), Some(-250.0), 0x00010000),
+        p(3, 2, &[50.0], Some((25.0, 100.0)), Some(100.0), Some(10.0), 0x00010000),
+        p(4, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Venetian Blinds", "Venetian Blinds", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00000001),
+        p(2, 3, &[0.0], None, None, None, 0x00000000),
+        p(3, 2, &[20.0], Some((1.0, 127.0)), Some(32000.0), Some(1.0), 0x00000000),
+        p(4, 2, &[0.0], Some((0.0, 100.0)), Some(32000.0), Some(0.0), 0x00010000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Channel Blur", "Channel Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 127.0)), Some(32767.0), Some(0.0), 0x00010000),
+        p(2, 2, &[0.0], Some((0.0, 127.0)), Some(32767.0), Some(0.0), 0x00010000),
+        p(3, 2, &[0.0], Some((0.0, 127.0)), Some(32767.0), Some(0.0), 0x00010000),
+        p(4, 2, &[0.0], Some((0.0, 127.0)), Some(32767.0), Some(0.0), 0x00010000),
+        p(5, 4, &[1.0], None, None, None, 0x00000000),
+        p(6, 7, &[1.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Black&White", "Black & White", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 10, &[40.0], Some((-200.0, 300.0)), Some(300.0), Some(-200.0), 0x00010000),
+        p(2, 10, &[60.0], Some((-200.0, 300.0)), Some(300.0), Some(-200.0), 0x00010000),
+        p(3, 10, &[40.0], Some((-200.0, 300.0)), Some(300.0), Some(-200.0), 0x00010000),
+        p(4, 10, &[60.0], Some((-200.0, 300.0)), Some(300.0), Some(-200.0), 0x00010000),
+        p(5, 10, &[20.0], Some((-200.0, 300.0)), Some(300.0), Some(-200.0), 0x00010000),
+        p(6, 10, &[80.0], Some((-200.0, 300.0)), Some(300.0), Some(-200.0), 0x00010000),
+        p(7, 4, &[0.0], None, None, None, 0x00000000),
+        p(8, 5, &[255.0, 225.0, 211.0, 179.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Tritone", "Tritone", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 5, &[0.0, 255.0, 255.0, 255.0], None, None, None, 0x00000000),
+        p(2, 5, &[0.0, 127.0, 100.0, 70.0], None, None, None, 0x00000000),
+        p(3, 5, &[0.0, 0.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(4, 10, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Luma Key", "Luma Key", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[2.0], None, None, None, 0x00000004),
+        p(2, 1, &[0.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000000),
+        p(3, 1, &[0.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000000),
+        p(4, 1, &[0.0], Some((-5.0, 5.0)), Some(5.0), Some(-5.0), 0x00000000),
+        p(5, 2, &[0.0], Some((0.0, 10.0)), Some(100.0), Some(0.0), 0x00010000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Simple Choker", "Simple Choker", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000002),
+        p(2, 2, &[0.0], Some((-10.0, 10.0)), Some(100.0), Some(-100.0), 0x00020000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Matte Choker", "Matte Choker", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[4.0], Some((0.0, 10.0)), Some(100.0), Some(0.0), 0x00010000),
+        p(2, 1, &[75.0], Some((-127.0, 127.0)), Some(127.0), Some(-127.0), 0x00000000),
+        p(3, 2, &[0.100006103515625], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00000001),
+        p(4, 2, &[0.0], Some((0.0, 10.0)), Some(100.0), Some(0.0), 0x00020000),
+        p(5, 1, &[0.0], Some((-127.0, 127.0)), Some(127.0), Some(-127.0), 0x00000000),
+        p(6, 2, &[1.0], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(7, 1, &[1.0], Some((1.0, 10.0)), Some(100.0), Some(1.0), 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Geometry2", "Transform", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(2, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(11, 4, &[1.0], None, None, None, 0x00000000),
+        p(3, 2, &[100.0], Some((-200.0, 200.0)), Some(30000.0), Some(-30000.0), 0x00010000),
+        p(4, 2, &[100.0], Some((-200.0, 200.0)), Some(30000.0), Some(-30000.0), 0x00010000),
+        p(5, 2, &[0.0], Some((-70.0, 70.0)), Some(70.0), Some(-70.0), 0x00010000),
+        p(6, 3, &[0.0], None, None, None, 0x00000000),
+        p(7, 3, &[0.0], None, None, None, 0x00000000),
+        p(8, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010000),
+        p(9, 4, &[1.0], None, None, None, 0x00000000),
+        p(10, 2, &[0.0], Some((0.0, 360.0)), Some(360.0), Some(0.0), 0x00020000),
+        p(12, 7, &[1.0], None, None, None, 0x00000002),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Brightness & Contrast 2", "Brightness & Contrast", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((-150.0, 150.0)), Some(150.0), Some(-150.0), 0x00000000),
+        p(2, 2, &[0.0], Some((-50.0, 100.0)), Some(100.0), Some(-100.0), 0x00000000),
+        p(3, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Turbulent Displace", "Turbulent Displace", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x0000000b),
+        p(2, 2, &[50.0], Some((0.0, 100.0)), Some(10000.0), Some(-10000.0), 0x00010000),
+        p(3, 2, &[100.0], Some((5.0, 400.0)), Some(1000.0), Some(2.0), 0x00010000),
+        p(4, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(5, 2, &[1.0], Some((1.0, 5.0)), Some(10.0), Some(1.0), 0x00010000),
+        p(6, 3, &[0.0], None, None, None, 0x00000000),
+        p(7, 13, &[], None, None, None, 0x00000000),
+        p(8, 4, &[0.0], None, None, None, 0x00000000),
+        p(9, 1, &[1.0], Some((1.0, 30.0)), Some(88.0), Some(1.0), 0x00000000),
+        p(10, 1, &[0.0], Some((0.0, 1000.0)), Some(100000.0), Some(0.0), 0x00000000),
+        p(11, 14, &[], None, None, None, 0x00000000),
+        p(12, 7, &[3.0], None, None, None, 0x00000011),
+        p(13, 4, &[0.0], None, None, None, 0x00000000),
+        p(14, 7, &[1.0], None, None, None, 0x00000002),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Fractal Noise", "Fractal Noise", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000014),
+        p(2, 7, &[3.0], None, None, None, 0x00000004),
+        p(3, 4, &[0.0], None, None, None, 0x00000000),
+        p(4, 2, &[100.0], Some((0.0, 400.0)), Some(10000.0), Some(0.0), 0x00010000),
+        p(5, 2, &[0.0], Some((-100.0, 100.0)), Some(10000.0), Some(-10000.0), 0x00010000),
+        p(6, 7, &[4.0], None, None, None, 0x00000004),
+        p(7, 13, &[], None, None, None, 0x00000000),
+        p(8, 3, &[0.0], None, None, None, 0x00000000),
+        p(9, 4, &[1.0], None, None, None, 0x00000000),
+        p(10, 2, &[100.0], Some((20.0, 600.0)), Some(10000.0), Some(1.0), 0x00010000),
+        p(11, 2, &[100.0], Some((20.0, 600.0)), Some(10000.0), Some(1.0), 0x00010000),
+        p(12, 2, &[100.0], Some((20.0, 600.0)), Some(10000.0), Some(1.0), 0x00010000),
+        p(13, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(31, 4, &[0.0], None, None, None, 0x00000000),
+        p(14, 14, &[], None, None, None, 0x00000000),
+        p(15, 2, &[6.0], Some((1.0, 10.0)), Some(20.0), Some(1.0), 0x00010000),
+        p(16, 13, &[], None, None, None, 0x00000000),
+        p(17, 2, &[70.0], Some((25.0, 100.0)), Some(10000.0), Some(1.52587890625e-05), 0x00010000),
+        p(18, 2, &[56.0], Some((25.0, 100.0)), Some(10000.0), Some(10.0), 0x00010000),
+        p(19, 3, &[0.0], None, None, None, 0x00000000),
+        p(20, 6, &[0.0, 0.0], None, None, None, 0x00000000),
+        p(21, 4, &[0.0], None, None, None, 0x00000000),
+        p(22, 14, &[], None, None, None, 0x00000000),
+        p(23, 3, &[0.0], None, None, None, 0x00000000),
+        p(24, 13, &[], None, None, None, 0x00000000),
+        p(25, 4, &[0.0], None, None, None, 0x00000000),
+        p(26, 1, &[1.0], Some((1.0, 30.0)), Some(88.0), Some(1.0), 0x00000000),
+        p(27, 1, &[0.0], Some((0.0, 1000.0)), Some(100000.0), Some(0.0), 0x00000000),
+        p(28, 14, &[], None, None, None, 0x00000000),
+        p(29, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(30, 7, &[2.0], None, None, None, 0x00000015),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Laser", "Beam", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.100006103515625, 0.5], None, None, None, 0x00000000),
+        p(2, 6, &[0.899993896484375, 0.5], None, None, None, 0x00000000),
+        p(3, 2, &[0.25], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(4, 2, &[0.5], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(5, 2, &[8.0], Some((0.0, 50.0)), Some(4000.0), Some(0.0), 0x00020000),
+        p(6, 2, &[8.0], Some((0.0, 50.0)), Some(4000.0), Some(0.0), 0x00020000),
+        p(7, 2, &[0.5], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(8, 5, &[185.0, 255.0, 190.0, 250.0], None, None, None, 0x00000000),
+        p(9, 5, &[150.0, 255.0, 25.0, 25.0], None, None, None, 0x00000000),
+        p(10, 4, &[1.0], None, None, None, 0x00000000),
+        p(11, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("CC Radial Fast Blur", "CC Radial Fast Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(2, 2, &[50.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010000),
+        p(3, 7, &[1.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Noise2", "Noise", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(2, 4, &[1.0], None, None, None, 0x00000000),
+        p(3, 4, &[1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Pro Levels2", "Levels (Individual Controls)", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000005),
+        p(2, 11, &[], None, None, None, 0x00000000),
+        p(3, 13, &[], None, None, None, 0x00000000),
+        p(4, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(5, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(6, 10, &[1.0], Some((0.0, 5.0)), Some(5.0), Some(0.0), 0x00020000),
+        p(7, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(8, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(9, 14, &[], None, None, None, 0x00000000),
+        p(10, 13, &[], None, None, None, 0x00000000),
+        p(11, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(12, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(13, 10, &[1.0], Some((0.0, 5.0)), Some(5.0), Some(0.0), 0x00020000),
+        p(14, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(15, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(16, 14, &[], None, None, None, 0x00000000),
+        p(17, 13, &[], None, None, None, 0x00000000),
+        p(18, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(19, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(20, 10, &[1.0], Some((0.0, 5.0)), Some(5.0), Some(0.0), 0x00020000),
+        p(21, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(22, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(23, 14, &[], None, None, None, 0x00000000),
+        p(24, 13, &[], None, None, None, 0x00000000),
+        p(25, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(26, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(27, 10, &[1.0], Some((0.0, 5.0)), Some(5.0), Some(0.0), 0x00020000),
+        p(28, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(29, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(30, 14, &[], None, None, None, 0x00000000),
+        p(31, 13, &[], None, None, None, 0x00000000),
+        p(32, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(33, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(34, 10, &[1.0], Some((0.0, 5.0)), Some(5.0), Some(0.0), 0x00020000),
+        p(35, 10, &[0.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(36, 10, &[1.0], Some((0.0, 1.0)), Some(10000.0), Some(-10000.0), 0x00010002),
+        p(37, 14, &[], None, None, None, 0x00000000),
+        p(38, 7, &[3.0], None, None, None, 0x00000003),
+        p(39, 7, &[3.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Corner Pin", "Corner Pin", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.0, 0.0], None, None, None, 0x00000000),
+        p(2, 6, &[1.0, 0.0], None, None, None, 0x00000000),
+        p(3, 6, &[0.0, 1.0], None, None, None, 0x00000000),
+        p(4, 6, &[1.0, 1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Grid", "Grid", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(2, 7, &[1.0], None, None, None, 0x00000003),
+        p(3, 6, &[0.600006103515625, 0.600006103515625], None, None, None, 0x00000000),
+        p(4, 2, &[32.0], Some((4.0, 200.0)), Some(4000.0), Some(1.0), 0x00010000),
+        p(5, 2, &[24.0], Some((4.0, 200.0)), Some(4000.0), Some(1.0), 0x00010000),
+        p(6, 2, &[5.0], Some((0.0, 100.0)), Some(2000.0), Some(0.0), 0x00010000),
+        p(7, 13, &[], None, None, None, 0x00000000),
+        p(8, 2, &[0.0], Some((0.0, 20.0)), Some(400.0), Some(0.0), 0x00010000),
+        p(9, 2, &[0.0], Some((0.0, 20.0)), Some(400.0), Some(0.0), 0x00010000),
+        p(10, 14, &[], None, None, None, 0x00000000),
+        p(11, 4, &[0.0], None, None, None, 0x00000000),
+        p(12, 5, &[255.0, 255.0, 255.0, 255.0], None, None, None, 0x00000000),
+        p(13, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(14, 7, &[1.0], None, None, None, 0x00000017),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Sharpen", "Sharpen", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 1, &[0.0], Some((0.0, 100.0)), Some(4000.0), Some(0.0), 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Linear Color Key2", "Linear Color Key", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 9, &[], None, None, None, 0x00000000),
+        p(2, 7, &[1.0], None, None, None, 0x00000003),
+        p(3, 5, &[255.0, 0.0, 0.0, 255.0], None, None, None, 0x00000000),
+        p(4, 7, &[1.0], None, None, None, 0x00000003),
+        p(5, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(6, 2, &[10.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(7, 7, &[1.0], None, None, None, 0x00000002),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Radial Wipe", "Radial Wipe", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00000001),
+        p(2, 3, &[0.0], None, None, None, 0x00000000),
+        p(3, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(4, 7, &[1.0], None, None, None, 0x00000003),
+        p(5, 2, &[0.0], Some((0.0, 100.0)), Some(32000.0), Some(0.0), 0x00010000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Remove Color Matting", "Remove Color Matting", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 5, &[0.0, 0.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(2, 4, &[1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("CC Bend It", "CC Bend It", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((-100.0, 100.0)), Some(250.0), Some(-250.0), 0x00010000),
+        p(2, 6, &[0.5, 0.75], None, None, None, 0x00000000),
+        p(3, 6, &[0.5, 0.25], None, None, None, 0x00000000),
+        p(4, 7, &[3.0], None, None, None, 0x00000004),
+        p(5, 7, &[1.0], None, None, None, 0x00000002),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("CC Power Pin", "CC Power Pin", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(2, 6, &[0.0, 0.0], None, None, None, 0x00000000),
+        p(3, 6, &[1.0, 0.0], None, None, None, 0x00000000),
+        p(4, 6, &[0.0, 1.0], None, None, None, 0x00000000),
+        p(5, 6, &[1.0, 1.0], None, None, None, 0x00000000),
+        p(6, 2, &[1.0], Some((0.0, 1.0)), Some(1.0), Some(0.0), 0x00010001),
+        p(7, 4, &[0.0], None, None, None, 0x00000000),
+        p(8, 13, &[], None, None, None, 0x00000000),
+        p(9, 2, &[0.0], Some((0.0, 50.0)), Some(200.0), Some(-200.0), 0x00010000),
+        p(10, 2, &[0.0], Some((0.0, 50.0)), Some(200.0), Some(-200.0), 0x00010000),
+        p(11, 2, &[0.0], Some((0.0, 50.0)), Some(200.0), Some(-200.0), 0x00010000),
+        p(12, 2, &[0.0], Some((0.0, 50.0)), Some(200.0), Some(-200.0), 0x00010000),
+        p(13, 14, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE 4ColorGradient", "4-Color Gradient", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(11, 13, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.100006103515625, 0.100006103515625], None, None, None, 0x00000000),
+        p(2, 5, &[255.0, 255.0, 255.0, 0.0], None, None, None, 0x00000000),
+        p(3, 6, &[0.899993896484375, 0.100006103515625], None, None, None, 0x00000000),
+        p(4, 5, &[255.0, 0.0, 255.0, 0.0], None, None, None, 0x00000000),
+        p(5, 6, &[0.100006103515625, 0.899993896484375], None, None, None, 0x00000000),
+        p(6, 5, &[255.0, 255.0, 0.0, 255.0], None, None, None, 0x00000000),
+        p(7, 6, &[0.899993896484375, 0.899993896484375], None, None, None, 0x00000000),
+        p(8, 5, &[255.0, 0.0, 0.0, 255.0], None, None, None, 0x00000000),
+        p(12, 14, &[], None, None, None, 0x00000000),
+        p(9, 2, &[100.0], Some((10.0, 500.0)), Some(10000.0), Some(5.0), 0x00010000),
+        p(10, 2, &[0.0], Some((0.0, 100.0)), Some(500.0), Some(0.0), 0x00010001),
+        p(13, 2, &[100.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(14, 7, &[1.0], None, None, None, 0x00000016),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Change Color", "Change Color", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000002),
+        p(2, 2, &[0.0], Some((-180.0, 180.0)), Some(1800.0), Some(-1800.0), 0x00010000),
+        p(3, 2, &[0.0], Some((-100.0, 100.0)), Some(100.0), Some(-100.0), 0x00010000),
+        p(4, 2, &[0.0], Some((-100.0, 100.0)), Some(100.0), Some(-100.0), 0x00010000),
+        p(5, 5, &[255.0, 0.0, 0.0, 255.0], None, None, None, 0x00000000),
+        p(6, 2, &[15.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(7, 2, &[0.0], Some((0.0, 100.0)), Some(100.0), Some(0.0), 0x00010001),
+        p(8, 7, &[1.0], None, None, None, 0x00000003),
+        p(9, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Extract", "Extract", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 9, &[], None, None, None, 0x00000000),
+        p(2, 7, &[1.0], None, None, None, 0x00000005),
+        p(3, 1, &[0.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000000),
+        p(4, 1, &[255.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000000),
+        p(5, 1, &[0.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000000),
+        p(6, 1, &[0.0], Some((0.0, 255.0)), Some(255.0), Some(0.0), 0x00000000),
+        p(7, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Noise HLS2", "Noise HLS", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000003),
+        p(2, 10, &[0.0], Some((0.0, 100.0)), Some(1000.0), Some(0.0), 0x00010001),
+        p(3, 10, &[0.0], Some((0.0, 100.0)), Some(1000.0), Some(0.0), 0x00010001),
+        p(4, 10, &[0.0], Some((0.0, 100.0)), Some(1000.0), Some(0.0), 0x00010001),
+        p(5, 2, &[1.0], Some((0.0, 4.0)), Some(10.0), Some(0.0), 0x00020000),
+        p(6, 3, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Scatter", "Scatter", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 127.0)), Some(1000.0), Some(0.0), 0x00010000),
+        p(2, 7, &[1.0], None, None, None, 0x00000003),
+        p(3, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("CC Light Sweep", "CC Light Sweep", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.5, 0.25], None, None, None, 0x00000000),
+        p(2, 3, &[-30.0], None, None, None, 0x00000000),
+        p(3, 7, &[3.0], None, None, None, 0x00000003),
+        p(4, 2, &[50.0], Some((0.0, 200.0)), Some(4000.0), Some(0.0), 0x00010000),
+        p(5, 2, &[25.0], Some((0.0, 100.0)), Some(500.0), Some(0.0), 0x00010000),
+        p(6, 2, &[50.0], Some((0.0, 100.0)), Some(500.0), Some(0.0), 0x00010000),
+        p(7, 2, &[4.0], Some((0.0, 10.0)), Some(20.0), Some(0.0), 0x00020000),
+        p(8, 5, &[255.0, 255.0, 250.0, 240.0], None, None, None, 0x00000000),
+        p(9, 7, &[1.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Compound Blur", "Compound Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 0, &[], None, None, None, 0x00000000),
+        p(2, 2, &[20.0], Some((0.0, 100.0)), Some(4000.0), Some(0.0), 0x00010000),
+        p(3, 4, &[1.0], None, None, None, 0x00000000),
+        p(4, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Displacement Map", "Displacement Map", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 0, &[], None, None, None, 0x00000000),
+        p(2, 7, &[1.0], None, None, None, 0x0000000b),
+        p(3, 2, &[5.0], Some((-100.0, 100.0)), Some(32000.0), Some(-32000.0), 0x00010000),
+        p(4, 7, &[2.0], None, None, None, 0x0000000b),
+        p(5, 2, &[5.0], Some((-100.0, 100.0)), Some(32000.0), Some(-32000.0), 0x00010000),
+        p(6, 7, &[1.0], None, None, None, 0x00000003),
+        p(7, 4, &[0.0], None, None, None, 0x00000000),
+        p(8, 4, &[1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Set Matte3", "Set Matte", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 0, &[], None, None, None, 0x00000000),
+        p(2, 7, &[4.0], None, None, None, 0x0000000a),
+        p(3, 4, &[0.0], None, None, None, 0x00000000),
+        p(4, 4, &[1.0], None, None, None, 0x00000000),
+        p(5, 4, &[1.0], None, None, None, 0x00000000),
+        p(6, 4, &[1.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Gaussian Blur", "Gaussian Blur (Legacy)", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 2, &[0.0], Some((0.0, 50.0)), Some(30000.0), Some(0.0), 0x00010000),
+        p(2, 7, &[1.0], None, None, None, 0x00000003),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE OFMotionBlur", "Pixel Motion Blur", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 7, &[1.0], None, None, None, 0x00000002),
+        p(2, 10, &[180.0], Some((0.0, 360.0)), Some(5000.0), Some(0.0), 0x00020000),
+        p(3, 1, &[5.0], Some((1.0, 20.0)), Some(256.0), Some(1.0), 0x00000000),
+        p(4, 10, &[20.0], Some((5.0, 100.0)), Some(100.0), Some(5.0), 0x00010000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Layer Control", "Layer Control", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 0, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Slider Control", "Slider Control", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 10, &[0.0], Some((0.0, 100.0)), Some(1000000.0), Some(-1000000.0), 0x00020000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Angle Control", "Angle Control", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 3, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Checkbox Control", "Checkbox Control", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 4, &[0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Color Control", "Color Control", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 5, &[255.0, 255.0, 0.0, 0.0], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE Point Control", "Point Control", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 6, &[0.5, 0.5], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE CurvesCustom", "Curves", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(2, 7, &[1.0], None, None, None, 0x00000005),
+        p(1, 11, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+    fx("ADBE MESH WARP", "Mesh Warp", &[
+        p(0, 0, &[], None, None, None, 0x00000000),
+        p(1, 1, &[7.0], Some((1.0, 31.0)), Some(31.0), Some(1.0), 0x00000000),
+        p(2, 1, &[7.0], Some((1.0, 31.0)), Some(31.0), Some(1.0), 0x00000000),
+        p(5, 1, &[8.0], Some((1.0, 10.0)), Some(10.0), Some(1.0), 0x00000000),
+        p(4, 11, &[], None, None, None, 0x00000000),
+        p(BUILT_IN, 9, &[], None, None, None, 0x00000000),
+    ]),
+];
diff --git a/crates/aep/src/export/fxsynth.rs b/crates/aep/src/export/fxsynth.rs
new file mode 100644
index 000000000..4fa02f0c5
--- /dev/null
+++ b/crates/aep/src/export/fxsynth.rs
@@ -0,0 +1,270 @@
+//! Effect instances built in code from the effect table (`fx_defs`): the default `sspc` of every
+//! effect type the exporter writes, its project copy (`EfDf`) and the value records of each
+//! parameter type (aep-format.md 3.7).
+//!
+//! What After Effects needs (read-backs in `docs/aep-export.md`, "Built in code"): a `parT` entry
+//! per parameter (`tdmn` + a 148-byte `pard`) whose bytes may be zero, since After Effects takes
+//! the definitions from the effect itself (e1-zpardfull); no `sdat` (e2-nosdat). The `pard` fields
+//! the importer reads back (type, default, valid maximum, slider range, popup item count) are
+//! written from the table so that an exported file imports again.
+
+use crate::Chunk;
+use crate::effect_map::{Conv, by_match_name};
+use crate::export::fx_defs::{BUILT_IN, FxDef, PDef};
+use crate::export::synth::{KeyTemplate, NO_NAME, RecSpec, class, tdmn, tdsn};
+use crate::{CURVE_IDENTITY, CurvesData, MeshData};
+
+/// The layer a prototype's layer parameters name when their default is the owning layer; the
+/// exporter replaces it with the owning layer's id (`effects::instance`).
+pub(crate) const PROTO_OWNER: u32 = 1;
+
+/// Layer parameters whose default is None instead of the owning layer (Timewarp's Matte Layer and
+/// Warp Layer, 529).
+const LAYER_NONE: &[&str] = &["ADBE Timewarp-0029", "ADBE Timewarp-0031"];
+
+/// The record of a parameter type (`pard` code): its components, key template and class word.
+pub(crate) fn value_spec(code: u8, range: Option<(f64, f64)>) -> Option<RecSpec> {
+    let scalar = |class| RecSpec { dims: 1, template: KeyTemplate::Plain, class, limits: None, byte5: None };
+    Some(match code {
+        // Sliders carry their range as `tdum` / `tduM`.
+        1 | 2 | 10 => RecSpec { limits: Some(range.unwrap_or((0.0, 0.0))), ..scalar(class::EFFECT_NUMBER) },
+        3 => scalar(class::EFFECT_NUMBER),
+        4 | 7 => scalar(class::EFFECT_CHOICE),
+        5 => RecSpec { dims: 4, template: KeyTemplate::Spatial(1), class: class::COLOR, limits: None, byte5: None },
+        6 => RecSpec { dims: 2, template: KeyTemplate::Spatial(3), class: class::SPATIAL, limits: None, byte5: None },
+        0 | 13 | 14 | 15 => scalar(class::EFFECT_OTHER),
+        _ => return None,
+    })
+}
+
+fn put(b: &mut [u8], at: usize, bytes: &[u8]) {
+    if let Some(dst) = b.get_mut(at..at + bytes.len()) {
+        dst.copy_from_slice(bytes);
+    }
+}
+
+fn fixed(v: f64) -> [u8; 4] {
+    ((v * 65536.0).round().clamp(f64::from(i32::MIN), f64::from(i32::MAX)) as i32).to_be_bytes()
+}
+
+/// The 148-byte `pard` of a parameter: the type at 12, the default at 56 and the copies After
+/// Effects reads it from (s8-e1..s12-e2), a popup's item count at 60, the valid range, slider
+/// range and display word of a slider (float: `f32` at 104 / 108 / 112 / 116, default 120,
+/// display 124; fixed and integer: 124 / 128 / 132 / 136, default 140, display 144). Every other
+/// byte is zero (the switches at 48 are not needed: s12-e2-nofl).
+pub(crate) fn pard(p: &PDef, popup_items: Option<u16>) -> Vec<u8> {
+    let mut b = vec![0u8; 148];
+    put(&mut b, 12, &u32::from(p.code).to_be_bytes());
+    let d = |i: usize| p.default.get(i).copied().unwrap_or(0.0);
+    // After Effects takes the default of a parameter without a value record from here (s8-e1:
+    // the copies below are the ones it reads).
+    match p.code {
+        10 => {
+            put(&mut b, 56, &d(0).to_be_bytes());
+            // The default again as `f32` at 120, the display word (decimals) at 124.
+            put(&mut b, 120, &(d(0) as f32).to_be_bytes());
+            put(&mut b, 124, &p.display.to_be_bytes());
+        }
+        2 => put(&mut b, 56, &fixed(d(0))),
+        // An angle: the default again at 60.
+        3 => {
+            put(&mut b, 56, &fixed(d(0)));
+            put(&mut b, 60, &fixed(d(0)));
+        }
+        1 => put(&mut b, 56, &(d(0).round() as i32).to_be_bytes()),
+        // A checkbox: the default again as a byte at 60.
+        4 => {
+            put(&mut b, 56, &(d(0).round().max(0.0) as u32).to_be_bytes());
+            put(&mut b, 60, &[u8::from(d(0) != 0.0)]);
+        }
+        // A popup: the default again as `u16` at 62 (the item count is at 60).
+        7 => {
+            let sel = d(0).round().clamp(0.0, f64::from(u16::MAX));
+            put(&mut b, 56, &(sel as u32).to_be_bytes());
+            put(&mut b, 62, &(sel as u16).to_be_bytes());
+        }
+        6 => {
+            // Fractions of the layer at 56 / 60 and the same in percent at 68 / 72.
+            put(&mut b, 56, &fixed(d(0)));
+            put(&mut b, 60, &fixed(d(1)));
+            put(&mut b, 68, &fixed(d(0) * 100.0));
+            put(&mut b, 72, &fixed(d(1) * 100.0));
+        }
+        5 => {
+            // ARGB at 56 and the same at 60.
+            let c: Vec<u8> = (0..4).map(|i| d(i).round().clamp(0.0, 255.0) as u8).collect();
+            put(&mut b, 56, &c);
+            put(&mut b, 60, &c);
+        }
+        _ => {}
+    }
+    if p.code == 7 {
+        let n = popup_items.unwrap_or_else(|| u16::try_from(p.display).unwrap_or(0));
+        put(&mut b, 60, &n.to_be_bytes());
+    }
+    match p.code {
+        10 => {
+            if let Some(m) = p.valid_min {
+                put(&mut b, 104, &(m as f32).to_be_bytes());
+            }
+            if let Some(m) = p.valid_max {
+                put(&mut b, 108, &(m as f32).to_be_bytes());
+            }
+            if let Some((lo, hi)) = p.range {
+                put(&mut b, 112, &(lo as f32).to_be_bytes());
+                put(&mut b, 116, &(hi as f32).to_be_bytes());
+            }
+        }
+        1 | 2 => {
+            let enc = |v: f64| if p.code == 2 { fixed(v) } else { (v.round() as i32).to_be_bytes() };
+            if let Some(m) = p.valid_min {
+                put(&mut b, 124, &enc(m));
+            }
+            if let Some(m) = p.valid_max {
+                put(&mut b, 128, &enc(m));
+            }
+            if let Some((lo, hi)) = p.range {
+                put(&mut b, 132, &enc(lo));
+                put(&mut b, 136, &enc(hi));
+            }
+            // The default again at 140, the display word (decimals, percent) at 144.
+            put(&mut b, 140, &enc(d(0)));
+            put(&mut b, 144, &p.display.to_be_bytes());
+        }
+        _ => {}
+    }
+    b
+}
+
+/// The default arbitrary data of an effect (its type-11 parameter), from the decoded layouts
+/// (aep-format.md 3.7).
+pub(crate) fn default_data(match_name: &str) -> Option<Vec<u8>> {
+    match match_name {
+        // Master hue, saturation, lightness (0), then six colour ranges of four hue bounds and
+        // their hue, saturation and lightness (0): Reds centred at 0 degrees, then every 60, each
+        // range 30 degrees wide with 30 degree fall-off (443-446).
+        "ADBE HUE SATURATION" => {
+            let mut out = vec![0u8; 12];
+            for c in 0..6i32 {
+                let centre = 60 * c;
+                for off in [-45, -15, 15, 45] {
+                    out.extend((centre + off).rem_euclid(360).to_be_bytes());
+                }
+                out.extend([0u8; 12]);
+            }
+            Some(out)
+        }
+        // A header word `0x000f10a7` and the version 1, then five channels (RGB, red, green, blue,
+        // alpha) of input black, input white, gamma, output black, output white as `f32`
+        // (511-516).
+        "ADBE Easy Levels2" | "ADBE Pro Levels2" => {
+            let mut out = Vec::with_capacity(108);
+            out.extend(0x000f_10a7_u32.to_be_bytes());
+            out.extend(1u32.to_be_bytes());
+            for _ in 0..5 {
+                for v in [0.0f32, 1.0, 1.0, 0.0, 1.0] {
+                    out.extend(v.to_be_bytes());
+                }
+            }
+            Some(out)
+        }
+        "ADBE CurvesCustom" => CurvesData { curves: std::array::from_fn(|_| CURVE_IDENTITY.to_vec()) }.to_bytes(),
+        // 7 x 7 cells, undistorted (Rows / Columns default 7, 985).
+        "ADBE MESH WARP" => {
+            let (columns, rows) = (7, 7);
+            let vertices = (0..=rows).flat_map(|j| (0..=columns).map(move |i| MeshData::default_vertex(columns, rows, i, j))).collect();
+            MeshData { columns, rows, tail: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x0d, 0x0d], vertices }.to_bytes()
+        }
+        _ => None,
+    }
+}
+
+/// The popup item count of parameter position `index` from the shared effect table.
+fn popup_items(fx: &FxDef, index: usize) -> Option<u16> {
+    let map = by_match_name(fx.match_name)?;
+    let pm = map.params.iter().find(|p| p.index == index)?;
+    match pm.conv {
+        Conv::Popup { items, .. } => u16::try_from(items.len()).ok(),
+        _ => None,
+    }
+}
+
+/// A record without a value of its own (layer parameters, groups, buttons): `tdsb` `state`, no
+/// user name, the header and a zero `cdat`.
+fn plain_record(state: u32, extra: Vec<Chunk<'static>>) -> Chunk<'static> {
+    let spec = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::EFFECT_OTHER, limits: None, byte5: None };
+    let mut kids = vec![
+        Chunk::data(*b"tdsb", state.to_be_bytes().to_vec()),
+        tdsn(NO_NAME),
+        Chunk::data(*b"tdb4", crate::export::synth::tdb4(&spec, false, 25_600)),
+        Chunk::data(*b"cdat", vec![0u8; spec.cdat_len()]),
+    ];
+    kids.extend(extra);
+    Chunk::list(*b"tdbs", kids)
+}
+
+/// The arbitrary-data record (4-byte `cdat`, class `0x00060007`, colour-like template 1) and the
+/// `LIST aRbs` with the data after it (443, 961).
+fn data_record(data: Vec<u8>) -> [Chunk<'static>; 2] {
+    let spec = RecSpec { dims: 1, template: KeyTemplate::Spatial(1), class: class::ARBITRARY, limits: None, byte5: None };
+    let rec = Chunk::list(
+        *b"tdbs",
+        vec![
+            Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()),
+            tdsn(NO_NAME),
+            Chunk::data(*b"tdb4", crate::export::synth::tdb4(&spec, false, 25_600)),
+            Chunk::data(*b"cdat", vec![0u8; 4]),
+        ],
+    );
+    [rec, Chunk::list(*b"aRbs", vec![Chunk::data(*b"aRbp", data)])]
+}
+
+/// The default `sspc` of an effect: its name (`fnam`), the parameter list (`parT`: the count,
+/// then `tdmn` + `pard` per parameter, the default arbitrary data after its `pard`), the value
+/// group (records only for layer parameters, groups, buttons and arbitrary data, the built-in
+/// group) and `pgui` (zero).
+pub(crate) fn default_sspc(fx: &FxDef) -> Chunk<'static> {
+    let fnam = Chunk { id: *b"fnam", body: crate::Body::Chunks(vec![Chunk::data(*b"Utf8", fx.name.as_bytes().to_vec())]), pad: None };
+    let count = u32::try_from(fx.params.len()).unwrap_or(u32::MAX);
+    let mut part = vec![Chunk::data(*b"parn", count.to_be_bytes().to_vec())];
+    let mut values = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn(NO_NAME)];
+    for (i, p) in fx.params.iter().enumerate() {
+        let record = fx.record(p);
+        part.push(tdmn(&record));
+        part.push(Chunk::data(*b"pard", pard(p, popup_items(fx, i))));
+        if matches!(p.code, 4 | 7 | 15) {
+            // Checkboxes, popups and buttons have a `pdnm` (their label or items); its text may
+            // be empty.
+            part.push(Chunk { id: *b"pdnm", body: crate::Body::Chunks(vec![Chunk::data(*b"Utf8", Vec::new())]), pad: None });
+        }
+        if p.id == BUILT_IN {
+            values.push(tdmn(&record));
+            values.push(Chunk::list(*b"tdgp", vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn(NO_NAME), tdmn("ADBE Group End")]));
+            continue;
+        }
+        match p.code {
+            0 => {
+                let id = if LAYER_NONE.contains(&record.as_str()) { 0 } else { PROTO_OWNER };
+                // The input layer (position 0) and every layer parameter name a layer (`tdpi`);
+                // `tdps` 0 (320, 529).
+                let state = if i == 0 { 3 } else { 1 };
+                values.push(tdmn(&record));
+                values.push(plain_record(state, vec![Chunk::data(*b"tdpi", id.to_be_bytes().to_vec()), Chunk::data(*b"tdps", 0u32.to_be_bytes().to_vec())]));
+            }
+            9 | 13..=15 => {
+                values.push(tdmn(&record));
+                values.push(plain_record(1, Vec::new()));
+            }
+            11 => {
+                if let Some(data) = default_data(fx.match_name) {
+                    part.push(Chunk::data(*b"aRbp", data.clone()));
+                    values.push(tdmn(&record));
+                    values.extend(data_record(data));
+                }
+            }
+            _ => {}
+        }
+    }
+    values.push(tdmn("ADBE Group End"));
+    Chunk::list(*b"sspc", vec![fnam, Chunk::list(*b"parT", part), Chunk::list(*b"tdgp", values), Chunk::data(*b"pgui", vec![0u8; 16])])
+}
diff --git a/crates/aep/src/export/icc.rs b/crates/aep/src/export/icc.rs
new file mode 100644
index 000000000..ae6db7893
--- /dev/null
+++ b/crates/aep/src/export/icc.rs
@@ -0,0 +1,289 @@
+//! Colour profiles for the working spaces the exporter writes, authored here from the standards
+//! so that no profile of another party is copied: "Rec.709 Gamma 2.4" (ITU-R BT.709 primaries,
+//! a pure 2.4 power curve) and "sRGB IEC61966-2.1" (the same primaries, the IEC 61966-2-1
+//! curve), both D65, ICC.1:2010 v4 with a D50 PCS and a Bradford adaptation. After Effects keeps
+//! a working space as the profile's data (base64) and its profile ID (`cpid`, 624: the MD5
+//! profile ID of the v4 header), R49.
+
+/// The profile's description and the name After Effects lists the working space under (624).
+pub(crate) const REC709_NAME: &str = "Rec.709 Gamma 2.4";
+/// The name After Effects lists the sRGB working space under (620).
+pub(crate) const SRGB_NAME: &str = "sRGB IEC61966-2.1";
+
+fn s15(v: f64) -> [u8; 4] {
+    let x = (v * 65536.0).round();
+    let x = if x.is_finite() { x.clamp(f64::from(i32::MIN), f64::from(i32::MAX)) } else { 0.0 };
+    (x as i32).to_be_bytes()
+}
+
+type M3 = [[f64; 3]; 3];
+
+fn mul(a: &M3, b: &M3) -> M3 {
+    let mut o = [[0.0; 3]; 3];
+    for (i, row) in o.iter_mut().enumerate() {
+        for (j, v) in row.iter_mut().enumerate() {
+            *v = (0..3).map(|k| a[i][k] * b[k][j]).sum();
+        }
+    }
+    o
+}
+
+fn mulv(a: &M3, v: [f64; 3]) -> [f64; 3] {
+    [0, 1, 2].map(|i| (0..3).map(|k| a[i][k] * v[k]).sum())
+}
+
+fn inv(m: &M3) -> M3 {
+    let [[a, b, c], [d, e, f], [g, h, i]] = *m;
+    let det = a * (e * i - f * h) - b * (d * i - f * g) + c * (d * h - e * g);
+    let det = if det.abs() < 1e-12 { 1.0 } else { det };
+    [
+        [(e * i - f * h) / det, (c * h - b * i) / det, (b * f - c * e) / det],
+        [(f * g - d * i) / det, (a * i - c * g) / det, (c * d - a * f) / det],
+        [(d * h - e * g) / det, (b * g - a * h) / det, (a * e - b * d) / det],
+    ]
+}
+
+fn xyz(x: f64, y: f64) -> [f64; 3] {
+    [x / y, 1.0, (1.0 - x - y) / y]
+}
+
+fn mluc(text: &str) -> Vec<u8> {
+    let t: Vec<u8> = text.encode_utf16().flat_map(u16::to_be_bytes).collect();
+    let mut v = b"mluc\0\0\0\0".to_vec();
+    v.extend(1u32.to_be_bytes());
+    v.extend(12u32.to_be_bytes());
+    v.extend(b"enUS");
+    v.extend(u32::try_from(t.len()).unwrap_or(0).to_be_bytes());
+    v.extend(28u32.to_be_bytes());
+    v.extend(t);
+    v
+}
+
+fn xyz_tag(v: [f64; 3]) -> Vec<u8> {
+    let mut o = b"XYZ \0\0\0\0".to_vec();
+    for c in v {
+        o.extend(s15(c));
+    }
+    o
+}
+
+/// The Rec.709 Gamma 2.4 display profile (ICC v4.3) with its profile ID filled in.
+pub(crate) fn rec709_gamma24() -> Vec<u8> {
+    // A pure power curve: `para` function type 0.
+    let mut trc = b"para\0\0\0\0".to_vec();
+    trc.extend([0, 0, 0, 0]);
+    trc.extend(s15(2.4));
+    profile("Rec.709 Gamma 2.4 (EffectCraft)", trc)
+}
+
+/// The sRGB display profile (ICC v4.3): IEC 61966-2-1's curve as `para` function type 3, `Y =
+/// ((X + 0.055) / 1.055) ^ 2.4` from 0.04045 and `X / 12.92` below.
+pub(crate) fn srgb() -> Vec<u8> {
+    let mut trc = b"para\0\0\0\0".to_vec();
+    trc.extend([0, 3, 0, 0]);
+    for v in [2.4, 1.0 / 1.055, 0.055 / 1.055, 1.0 / 12.92, 0.04045] {
+        trc.extend(s15(v));
+    }
+    profile(SRGB_NAME, trc)
+}
+
+/// A display profile with BT.709 primaries and D65 white, tone curve `trc` and description
+/// `desc`, its profile ID filled in.
+fn profile(desc: &str, trc: Vec<u8>) -> Vec<u8> {
+    let prim = [(0.640, 0.330), (0.300, 0.600), (0.150, 0.060)];
+    let w65 = xyz(0.3127, 0.3290);
+    let w50 = [0.9642, 1.0, 0.8249];
+    let cols = prim.map(|(x, y)| xyz(x, y));
+    let p: M3 = [0, 1, 2].map(|r| [0, 1, 2].map(|c| cols[c][r]));
+    let s = mulv(&inv(&p), w65);
+    let m: M3 = [0, 1, 2].map(|r| [0, 1, 2].map(|c| p[r][c] * s[c]));
+    let brad: M3 = [[0.8951, 0.2664, -0.1614], [-0.7502, 1.7135, 0.0367], [0.0389, -0.0685, 1.0296]];
+    let (cs, cd) = (mulv(&brad, w65), mulv(&brad, w50));
+    let d: M3 = [[cd[0] / cs[0], 0.0, 0.0], [0.0, cd[1] / cs[1], 0.0], [0.0, 0.0, cd[2] / cs[2]]];
+    let chad = mul(&inv(&brad), &mul(&d, &brad));
+    let m50 = mul(&chad, &m);
+    let mut sf32 = b"sf32\0\0\0\0".to_vec();
+    for row in chad {
+        for v in row {
+            sf32.extend(s15(v));
+        }
+    }
+    let tags: [(&[u8; 4], Vec<u8>); 10] = [
+        (b"desc", mluc(desc)),
+        (b"cprt", mluc("No copyright, use freely (EffectCraft)")),
+        (b"wtpt", xyz_tag(w50)),
+        (b"chad", sf32),
+        (b"rXYZ", xyz_tag([m50[0][0], m50[1][0], m50[2][0]])),
+        (b"gXYZ", xyz_tag([m50[0][1], m50[1][1], m50[2][1]])),
+        (b"bXYZ", xyz_tag([m50[0][2], m50[1][2], m50[2][2]])),
+        (b"rTRC", trc.clone()),
+        (b"gTRC", trc.clone()),
+        (b"bTRC", trc),
+    ];
+    let start = 128 + 4 + 12 * tags.len();
+    let mut table = Vec::new();
+    let mut body: Vec<u8> = Vec::new();
+    let mut placed: Vec<(Vec<u8>, usize)> = Vec::new();
+    for (sig, data) in &tags {
+        let off = match placed.iter().find(|(d, _)| d == data) {
+            Some((_, off)) => *off,
+            None => {
+                let off = start + body.len();
+                body.extend(data);
+                body.resize(body.len().div_ceil(4) * 4, 0);
+                placed.push((data.clone(), off));
+                off
+            }
+        };
+        table.extend(*sig);
+        table.extend(u32::try_from(off).unwrap_or(0).to_be_bytes());
+        table.extend(u32::try_from(data.len()).unwrap_or(0).to_be_bytes());
+    }
+    let size = start + body.len();
+    let mut icc = vec![0u8; 128];
+    icc[0..4].copy_from_slice(&u32::try_from(size).unwrap_or(0).to_be_bytes());
+    icc[8..12].copy_from_slice(&[4, 0x30, 0, 0]);
+    icc[12..16].copy_from_slice(b"mntr");
+    icc[16..20].copy_from_slice(b"RGB ");
+    icc[20..24].copy_from_slice(b"XYZ ");
+    for (i, v) in [2026u16, 10, 19, 0, 0, 0].iter().enumerate() {
+        icc[24 + 2 * i..26 + 2 * i].copy_from_slice(&v.to_be_bytes());
+    }
+    icc[36..40].copy_from_slice(b"acsp");
+    for (i, c) in w50.iter().enumerate() {
+        icc[68 + 4 * i..72 + 4 * i].copy_from_slice(&s15(*c));
+    }
+    icc.extend(u32::try_from(tags.len()).unwrap_or(0).to_be_bytes());
+    icc.extend(table);
+    icc.extend(body);
+    // Profile ID (ICC.1:2010 7.2.18): the MD5 with flags, rendering intent and the ID zeroed (all
+    // zero here already).
+    let id = md5(&icc);
+    icc[84..100].copy_from_slice(&id);
+    icc
+}
+
+/// The profile ID of a v4 profile (header bytes 84..100).
+pub(crate) fn profile_id(icc: &[u8]) -> [u8; 16] {
+    let mut id = [0u8; 16];
+    if let Some(src) = icc.get(84..100) {
+        id.copy_from_slice(src);
+    }
+    id
+}
+
+/// MD5 (RFC 1321).
+pub(crate) fn md5(data: &[u8]) -> [u8; 16] {
+    const S: [u32; 64] = [
+        7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4,
+        11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+    ];
+    let k: [u32; 64] = std::array::from_fn(|i| ((i as f64 + 1.0).sin().abs() * 4_294_967_296.0) as u32);
+    let mut msg = data.to_vec();
+    let bits = (data.len() as u64).wrapping_mul(8);
+    msg.push(0x80);
+    while msg.len() % 64 != 56 {
+        msg.push(0);
+    }
+    msg.extend(bits.to_le_bytes());
+    let (mut a0, mut b0, mut c0, mut d0) = (0x6745_2301u32, 0xefcd_ab89u32, 0x98ba_dcfeu32, 0x1032_5476u32);
+    let (blocks, _) = msg.as_chunks::<64>();
+    for chunk in blocks {
+        let m: [u32; 16] = std::array::from_fn(|i| u32::from_le_bytes([chunk[4 * i], chunk[4 * i + 1], chunk[4 * i + 2], chunk[4 * i + 3]]));
+        let (mut a, mut b, mut c, mut d) = (a0, b0, c0, d0);
+        for i in 0..64 {
+            let (f, g) = match i / 16 {
+                0 => ((b & c) | (!b & d), i),
+                1 => ((d & b) | (!d & c), (5 * i + 1) % 16),
+                2 => (b ^ c ^ d, (3 * i + 5) % 16),
+                _ => (c ^ (b | !d), (7 * i) % 16),
+            };
+            let f = f.wrapping_add(a).wrapping_add(k[i]).wrapping_add(m[g]);
+            a = d;
+            d = c;
+            c = b;
+            b = b.wrapping_add(f.rotate_left(S[i]));
+        }
+        a0 = a0.wrapping_add(a);
+        b0 = b0.wrapping_add(b);
+        c0 = c0.wrapping_add(c);
+        d0 = d0.wrapping_add(d);
+    }
+    let mut out = [0u8; 16];
+    for (i, w) in [a0, b0, c0, d0].iter().enumerate() {
+        out[4 * i..4 * i + 4].copy_from_slice(&w.to_le_bytes());
+    }
+    out
+}
+
+/// The colour profile JSON After Effects stores for a working space or a footage item (620, 624):
+/// the profile's data and its name.
+pub(crate) fn profile_json(icc: &[u8], name: &str) -> String {
+    format!("{{\"baseColorProfile\":{{\"colorProfileData\":\"{}\",\"colorProfileName\":\"{}\"}},\"baseProfileType\":2}}", base64(icc), name)
+}
+
+/// Standard base64 with padding.
+pub(crate) fn base64(data: &[u8]) -> String {
+    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let mut out = String::with_capacity(data.len().div_ceil(3) * 4);
+    for c in data.chunks(3) {
+        let n = (u32::from(c[0]) << 16) | (u32::from(c.get(1).copied().unwrap_or(0)) << 8) | u32::from(c.get(2).copied().unwrap_or(0));
+        for (i, shift) in [18u32, 12, 6, 0].iter().enumerate() {
+            if i <= c.len() {
+                out.push(char::from(T[((n >> shift) & 63) as usize]));
+            } else {
+                out.push('=');
+            }
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn md5_and_base64_match_their_specifications() {
+        // RFC 1321 test suite and RFC 4648.
+        assert_eq!(md5(b"").iter().map(|b| format!("{b:02x}")).collect::<String>(), "d41d8cd98f00b204e9800998ecf8427e");
+        assert_eq!(md5(b"abc").iter().map(|b| format!("{b:02x}")).collect::<String>(), "900150983cd24fb0d6963f7d28e17f72");
+        let long = b"12345678901234567890123456789012345678901234567890123456789012345678901234567890";
+        assert_eq!(md5(long).iter().map(|b| format!("{b:02x}")).collect::<String>(), "57edf4a22be3c955ac49da2e2107b67a");
+        assert_eq!(base64(b"foobar"), "Zm9vYmFy");
+        assert_eq!(base64(b"fooba"), "Zm9vYmE=");
+        assert_eq!(base64(b"foob"), "Zm9vYg==");
+    }
+
+    #[test]
+    fn the_srgb_profile_carries_the_iec_curve() {
+        let icc = srgb();
+        assert_eq!(u32::from_be_bytes(icc[0..4].try_into().unwrap()) as usize, icc.len());
+        let mut z = icc.clone();
+        z[84..100].fill(0);
+        assert_eq!(profile_id(&icc), md5(&z));
+        let at = icc.windows(8).position(|w| w == b"para\0\0\0\0").unwrap();
+        assert_eq!(&icc[at + 8..at + 12], &[0, 3, 0, 0]);
+        // AE shows its own name for the space only when the description is exactly this.
+        let name: Vec<u8> = SRGB_NAME.encode_utf16().flat_map(u16::to_be_bytes).collect();
+        let at = icc.windows(name.len()).position(|w| w == name.as_slice()).unwrap();
+        assert_ne!(&icc[at + name.len()..at + name.len() + 2], b"\0 ", "no suffix after the name");
+    }
+
+    #[test]
+    fn the_rec709_profile_is_a_valid_v4_display_profile() {
+        let icc = rec709_gamma24();
+        assert_eq!(u32::from_be_bytes(icc[0..4].try_into().unwrap()) as usize, icc.len());
+        assert_eq!(&icc[36..40], b"acsp");
+        // The ID is the MD5 of the profile with the ID zeroed.
+        let mut z = icc.clone();
+        z[84..100].fill(0);
+        assert_eq!(profile_id(&icc), md5(&z));
+        // D50 red primary of BT.709 (0.4361, 0.2225, 0.0139).
+        let tags = u32::from_be_bytes(icc[128..132].try_into().unwrap()) as usize;
+        let r = (0..tags).find(|t| &icc[132 + 12 * t..136 + 12 * t] == b"rXYZ").unwrap();
+        let off = u32::from_be_bytes(icc[136 + 12 * r..140 + 12 * r].try_into().unwrap()) as usize;
+        let x = f64::from(i32::from_be_bytes(icc[off + 8..off + 12].try_into().unwrap())) / 65536.0;
+        assert!((x - 0.4361).abs() < 2e-4, "{x}");
+    }
+}
diff --git a/crates/aep/src/export/markers.rs b/crates/aep/src/export/markers.rs
new file mode 100644
index 000000000..fc3fedd59
--- /dev/null
+++ b/crates/aep/src/export/markers.rs
@@ -0,0 +1,126 @@
+//! Layer and composition markers (`docs/aep-format.md` 3.11; cases 122, 123, 249, 347-349, 509,
+//! 510). A marker group is `tdmn ADBE Marker` + `LIST mrst`: a `tdbs` whose key list holds one
+//! 16-byte record per marker (the time in the owner's time units, bytes 4 and 5 = 3, the rest
+//! written 0: After Effects leaves session bytes there) and a `LIST mrky` with one `LIST Nmrd` per
+//! marker (`NmHd`: cue type, number of cue parameters, duration in 1/600 s, 600, label; then the
+//! comment, chapter, URL, frame target and cue point name and the parameter pairs as `Utf8`).
+
+use crate::Chunk;
+use effectcraft_project::Marker;
+
+use crate::export::report::{Collector, LossCategory};
+use crate::export::timebase::TimeBase;
+use crate::export::tree::{R, child_data, kids_mut, list_mut, put, put_u8, put_u32, tpl};
+
+/// The units per second of a marker duration (`NmHd` @12, 249).
+const DURATION_UNITS: f64 = 600.0;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct MarkerPlan {
+    pub time: i32,
+    pub duration: u32,
+    pub label: u8,
+    /// 4 event cue (also without a cue point), 5 navigation cue (347, 348).
+    pub cue: u32,
+    /// Comment, chapter, URL, frame target, cue point name (249).
+    pub strings: [String; 5],
+    pub params: Vec<(String, String)>,
+}
+
+/// The markers in the file's units (`tb` is the owner's time base: the composition's, or the
+/// layer's for layer markers); what cannot be written is reported.
+pub(crate) fn plan(markers: &[Marker], tb: &TimeBase, what: &str, col: &mut Collector) -> Vec<MarkerPlan> {
+    let mut out: Vec<MarkerPlan> = Vec::with_capacity(markers.len());
+    for m in markers {
+        let (u, inexact) = tb.units(m.time);
+        let Ok(time) = i32::try_from(u) else {
+            col.lose(LossCategory::Markers, format!("{what}: a marker time out of range is not written"));
+            continue;
+        };
+        if inexact {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: marker at {:.4} s moved to the time base", m.time.seconds()));
+        }
+        let d = m.duration.seconds() * DURATION_UNITS;
+        let duration = if d.is_finite() && d > 0.0 { d.round().min(f64::from(u32::MAX)) as u32 } else { 0 };
+        if d.is_finite() && d > 0.0 && (d - d.round()).abs() > 1e-6 {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: a marker duration is rounded to 1/600 s"));
+        }
+        if m.protected {
+            col.lose(LossCategory::Markers, format!("{what}: the protected-region switch of a marker is not written"));
+        }
+        let (cue, cue_name, params) = match &m.cue_point {
+            Some(c) => (if c.navigation { 5 } else { 4 }, c.name.clone(), c.params.clone()),
+            None => (4, String::new(), Vec::new()),
+        };
+        out.push(MarkerPlan {
+            time,
+            duration,
+            label: crate::export::plan::label_index(m.label),
+            cue,
+            strings: [m.comment.clone(), m.chapter.clone(), m.url.clone(), m.frame_target.clone(), cue_name],
+            params,
+        });
+    }
+    out.sort_by_key(|m| m.time);
+    col.exported.markers = col.exported.markers.saturating_add(out.len());
+    out
+}
+
+/// The marker group (`tdmn` + `LIST mrst`) for `plans`, cloned from the prototype (249).
+pub(crate) fn build(proto: &[Chunk<'static>], plans: &[MarkerPlan]) -> R<Vec<Chunk<'static>>> {
+    let mut group = proto.to_vec();
+    let mrst = group.get_mut(1).filter(|c| c.is_list(b"mrst")).ok_or_else(|| tpl("marker prototype"))?;
+    let n = u32::try_from(plans.len()).map_err(|_| tpl("too many markers"))?;
+    {
+        let tdbs = list_mut(mrst, b"tdbs")?;
+        let list = list_mut(tdbs, b"list")?;
+        let lhd3 = child_data(list, b"lhd3")?;
+        crate::export::synth::put_key_counts(lhd3, n, 16)?;
+        let ldat = child_data(list, b"ldat")?;
+        ldat.clear();
+        for p in plans {
+            let mut rec = [0u8; 16];
+            put(&mut rec, 0, &p.time.to_be_bytes())?;
+            rec[4] = 3;
+            rec[5] = 3;
+            ldat.extend_from_slice(&rec);
+        }
+    }
+    let mrky = list_mut(mrst, b"mrky")?;
+    let nmrd_proto = kids_mut(mrky)?.first().cloned().ok_or_else(|| tpl("marker prototype without Nmrd"))?;
+    let mut entries = Vec::with_capacity(plans.len());
+    for p in plans {
+        let mut nmrd = nmrd_proto.clone();
+        {
+            let h = child_data(&mut nmrd, b"NmHd")?;
+            put_u32(h, 0, p.cue)?;
+            put_u32(h, 4, u32::try_from(p.params.len()).unwrap_or(0))?;
+            put_u32(h, 8, p.duration)?;
+            put_u32(h, 12, 600)?;
+            put_u8(h, 16, p.label)?;
+        }
+        let kids = kids_mut(&mut nmrd)?;
+        kids.retain(|c| !c.is(b"Utf8"));
+        for s in &p.strings {
+            kids.push(Chunk::data(*b"Utf8", s.as_bytes().to_vec()));
+        }
+        for (k, v) in &p.params {
+            kids.push(Chunk::data(*b"Utf8", k.as_bytes().to_vec()));
+            kids.push(Chunk::data(*b"Utf8", v.as_bytes().to_vec()));
+        }
+        entries.push(nmrd);
+    }
+    *kids_mut(mrky)? = entries;
+    Ok(group)
+}
+
+/// Inserts the marker group as the first property of a top property group (`tdgp`): right after
+/// its `tdsb` / `tdsn` header, before Time Remapping or the Transform group (123, 509).
+pub(crate) fn insert(tdgp: &mut Chunk<'static>, group: Vec<Chunk<'static>>) -> R<()> {
+    let kids = kids_mut(tdgp)?;
+    let at = kids.iter().position(|c| c.is(b"tdmn")).unwrap_or(kids.len());
+    for (i, c) in group.into_iter().enumerate() {
+        kids.insert(at.saturating_add(i), c);
+    }
+    Ok(())
+}
diff --git a/crates/aep/src/export/masks.rs b/crates/aep/src/export/masks.rs
new file mode 100644
index 000000000..61d8634c4
--- /dev/null
+++ b/crates/aep/src/export/masks.rs
@@ -0,0 +1,671 @@
+//! Layer masks: the plan (file units, losses reported) and the chunks, cloned from the mask
+//! prototypes built in code ([`MaskProtos::build`], with the layout of our fixtures 091, 093 and
+//! 208).
+//!
+//! What is written, each with its verified layout (`docs/aep-format.md` 3.4, 3.5 and 3.8):
+//! - per mask a `mkif` (inverted at byte 0, mode `u32` at 4, the layer's running mask counter at
+//!   8; the other bytes are zero, read-back t-zmkif) and an atom with the user name;
+//! - the path as `LIST shap` (`shph`: open bit `0x08` of byte 3, the box of vertices and handles
+//!   normalised to the layer source size; `list`: three `f32` points per vertex, vertex `i`, out
+//!   handle `i`, in handle `i + 1`, normalised inside the box);
+//! - path keys as 64-byte records (time, interpolation, label, the rest copied from the prototype)
+//!   with one `shap` per key;
+//! - Feather (static or keyed, plain template with two components), Opacity (fraction) and
+//!   Expansion (pixels), each only when it is not at its default.
+
+use crate::Chunk;
+use effectcraft_keyframe::{Ease, Interp, ShapePath, Value};
+use effectcraft_project::{FeatherFalloff, GroupKind, Layer, MaskMode, MaskMotionBlur, PropGroup};
+
+use crate::export::plan::{CompPlan, EaseSlot, KeyPlan, LIMIT, cut_name};
+use crate::export::report::{Collector, LossCategory};
+use crate::export::tree::{R, child_data, child_mut, kids_mut, list_mut, put_f32, put_f64, put_i32, put_u8, put_u16, put_u32, tpl};
+
+/// The most vertices one mask path may have (as the importer).
+pub(crate) const MAX_VERTICES: usize = 65_536;
+
+/// One path shape in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ShapePlan {
+    /// Left, top, right, bottom as fractions of the layer source size.
+    pub bbox: [f32; 4],
+    pub open: bool,
+    /// Three points per vertex, normalised inside the box.
+    pub points: Vec<[f32; 2]>,
+}
+
+/// One path keyframe.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct PathKeyPlan {
+    pub time: i32,
+    /// 1 linear, 2 bezier, 3 hold.
+    pub in_interp: u8,
+    pub out_interp: u8,
+    /// The ease of a bezier side: speed (as stored) and influence (a fraction), at bytes 24..55
+    /// as in the spatial template (599, 700).
+    pub in_ease: (f64, f64),
+    pub out_ease: (f64, f64),
+    pub label: u8,
+    pub shape: ShapePlan,
+}
+
+/// A mask in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct MaskPlan {
+    pub name: String,
+    /// `mkif` mode id: None 0, Add 1, Subtract 2, Intersect 3, Lighten 4, Darken 5, Difference 6.
+    pub mode: u32,
+    pub inverted: bool,
+    /// The static path (the first key's when the path is keyed).
+    pub shape: ShapePlan,
+    pub path_keys: Vec<PathKeyPlan>,
+    /// Pixels; `None` at the default `[0, 0]`.
+    pub feather: Option<[f64; 2]>,
+    pub feather_keys: Vec<KeyPlan>,
+    /// A fraction; `None` at the default 1.
+    pub opacity: Option<f64>,
+    /// Pixels; `None` at the default 0.
+    pub expansion: Option<f64>,
+}
+
+fn mode_id(m: MaskMode) -> u32 {
+    match m {
+        MaskMode::None => 0,
+        MaskMode::Add => 1,
+        MaskMode::Subtract => 2,
+        MaskMode::Intersect => 3,
+        MaskMode::Lighten => 4,
+        MaskMode::Darken => 5,
+        MaskMode::Difference => 6,
+    }
+}
+
+fn finite(v: f64) -> Option<f64> {
+    (v.is_finite() && v.abs() <= LIMIT).then_some(v)
+}
+
+/// A project path (layer pixels) in the file's units for a layer source of `size` pixels.
+pub(crate) fn shape_plan(p: &ShapePath, size: (u32, u32)) -> Result<ShapePlan, &'static str> {
+    let n = p.vertices.len();
+    if n == 0 {
+        return Err("its path has no vertices");
+    }
+    if n > MAX_VERTICES {
+        return Err("its path has more than 65 536 vertices");
+    }
+    let (w, h) = (f64::from(size.0.max(1)), f64::from(size.1.max(1)));
+    let at = |i: usize| -> Option<([f64; 2], [f64; 2], [f64; 2])> {
+        let v = *p.vertices.get(i)?;
+        let t_in = p.in_tangents.get(i).copied().unwrap_or([0.0; 2]);
+        let t_out = p.out_tangents.get(i).copied().unwrap_or([0.0; 2]);
+        let add = |a: [f64; 2], b: [f64; 2]| [a[0] + b[0], a[1] + b[1]];
+        Some((v, add(v, t_in), add(v, t_out)))
+    };
+    // Absolute points in layer pixels: vertex i, out handle i, in handle i + 1.
+    let mut abs: Vec<[f64; 2]> = Vec::with_capacity(n.saturating_mul(3));
+    for i in 0..n {
+        let (v, _, out) = at(i).ok_or("its path is incomplete")?;
+        let (_, next_in, _) = at((i + 1) % n).ok_or("its path is incomplete")?;
+        abs.extend([v, out, next_in]);
+    }
+    if !abs.iter().flatten().all(|c| finite(*c).is_some()) {
+        return Err("its path holds a number that is not valid");
+    }
+    // Normalised to the layer size, then the box of all points.
+    let norm: Vec<[f64; 2]> = abs.iter().map(|[x, y]| [x / w, y / h]).collect();
+    let (mut left, mut top, mut right, mut bottom) = (f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY);
+    for [x, y] in &norm {
+        left = left.min(*x);
+        right = right.max(*x);
+        top = top.min(*y);
+        bottom = bottom.max(*y);
+    }
+    let bbox = [left as f32, top as f32, right as f32, bottom as f32];
+    let [l, t, r, b] = bbox.map(f64::from);
+    // A box without width or height (all points on one line) stores 0 for that coordinate.
+    let unit = |v: f64, lo: f64, hi: f64| if hi - lo > 0.0 { ((v - lo) / (hi - lo)) as f32 } else { 0.0 };
+    let points = norm.iter().map(|[x, y]| [unit(*x, l, r), unit(*y, t, b)]).collect();
+    Ok(ShapePlan { bbox, open: !p.closed, points })
+}
+
+/// Plans the masks of a layer whose source is `size` pixels.
+pub(crate) fn plan_masks(layer: &Layer, size: (u32, u32), cp: &CompPlan, comp_name: &str, col: &mut Collector) -> Vec<MaskPlan> {
+    let Some(masks) = layer.masks() else { return Vec::new() };
+    let mut out = Vec::new();
+    for g in masks.groups() {
+        let what = format!("{comp_name}: '{}' {}", layer.name, g.name);
+        if let Some(m) = plan_mask(g, size, cp, &what, col) {
+            col.exported.masks = col.exported.masks.saturating_add(1);
+            out.push(m);
+        }
+    }
+    out
+}
+
+fn plan_mask(g: &PropGroup, size: (u32, u32), cp: &CompPlan, what: &str, col: &mut Collector) -> Option<MaskPlan> {
+    let GroupKind::Mask { mode, inverted, locked, motion_blur, feather_falloff, roto_bezier, .. } = g.kind else {
+        col.lose(LossCategory::Masks, format!("{what}: not a mask, not exported"));
+        return None;
+    };
+    if !g.enabled {
+        col.lose(LossCategory::Masks, format!("{what}: a disabled mask is not exported"));
+        return None;
+    }
+    let Some(path_prop) = g.get("path") else {
+        col.lose(LossCategory::Masks, format!("{what}: no path, not exported"));
+        return None;
+    };
+    let Value::Path(static_path) = &path_prop.value else {
+        col.lose(LossCategory::Masks, format!("{what}: the path is not a path, not exported"));
+        return None;
+    };
+    // Switches the file layout does not hold (not decoded).
+    if locked {
+        col.lose(LossCategory::Masks, format!("{what}: the lock is not written"));
+    }
+    if motion_blur != MaskMotionBlur::SameAsLayer {
+        col.lose(LossCategory::Masks, format!("{what}: mask motion blur is written as Same As Layer"));
+    }
+    if feather_falloff != FeatherFalloff::Smooth {
+        col.lose(LossCategory::Masks, format!("{what}: Linear feather falloff is written as Smooth"));
+    }
+    if roto_bezier {
+        col.lose(LossCategory::Masks, format!("{what}: RotoBezier is not written (the tangents are)"));
+    }
+    for id in ["path", "feather", "opacity", "expansion"] {
+        if g.get(id).is_some_and(|p| p.has_expression()) {
+            col.lose(LossCategory::Masks, format!("{what}: the expression on Mask {id} is not written"));
+        }
+    }
+    // The path and its keys.
+    let mut path_keys: Vec<PathKeyPlan> = Vec::new();
+    let mut keys: Vec<(i64, &effectcraft_keyframe::Keyframe)> = Vec::new();
+    for k in &path_prop.keys {
+        let (u, inexact) = cp.tb.units(k.time);
+        if inexact {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: path key at {:.4} s moved to the time base", k.time.seconds()));
+        }
+        keys.push((u, k));
+    }
+    keys.sort_by_key(|(u, _)| *u);
+    let before = keys.len();
+    keys.dedup_by_key(|(u, _)| *u);
+    if keys.len() != before {
+        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: path keys at the same time were merged"));
+    }
+    let side = |i: Interp| -> u8 {
+        match i {
+            Interp::Linear => 1,
+            Interp::Hold => 3,
+            Interp::Bezier => 2,
+        }
+    };
+    let ease = |e: &[effectcraft_keyframe::Ease], on: bool| -> (f64, f64) {
+        if !on {
+            return (0.0, 0.0);
+        }
+        let e = e.first().copied().unwrap_or(effectcraft_keyframe::Ease { speed: 0.0, influence: 1.0 / 3.0 });
+        let speed = finite(e.speed).filter(|v| v.abs() <= 1e9).unwrap_or(0.0);
+        let influence = if e.influence.is_finite() { e.influence.clamp(0.001, 1.0) } else { 1.0 / 3.0 };
+        (speed, influence)
+    };
+    let mut feather_points = !static_path.feather.is_empty();
+    for (u, k) in &keys {
+        let Ok(time) = i32::try_from(*u) else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: path key time out of range, key dropped"));
+            continue;
+        };
+        let Value::Path(p) = &k.value else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: a path key without a path was dropped"));
+            continue;
+        };
+        feather_points |= !p.feather.is_empty();
+        let shape = match shape_plan(p, size) {
+            Ok(s) => s,
+            Err(why) => {
+                col.lose(LossCategory::InvalidValues, format!("{what}: a path key was dropped, {why}"));
+                continue;
+            }
+        };
+        if k.roving {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: a roving path key is written as a normal key"));
+        }
+        let (in_interp, out_interp) = (side(k.in_interp), side(k.out_interp));
+        if (in_interp == 2 && k.in_ease.first().is_some_and(|e| e.speed != 0.0)) || (out_interp == 2 && k.out_ease.first().is_some_and(|e| e.speed != 0.0)) {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: a path key ease speed other than 0 is written as stored (its unit is not sampled)"));
+        }
+        let (in_ease, out_ease) = (ease(&k.in_ease, in_interp == 2), ease(&k.out_ease, out_interp == 2));
+        path_keys.push(PathKeyPlan { time, in_interp, out_interp, in_ease, out_ease, label: k.label.min(16), shape });
+        col.exported.keyframes = col.exported.keyframes.saturating_add(1);
+    }
+    if feather_points {
+        col.lose(LossCategory::Masks, format!("{what}: variable-width feather points are not written"));
+    }
+    let shape = match path_keys.first() {
+        Some(k) => k.shape.clone(),
+        None => match shape_plan(static_path, size) {
+            Ok(s) => s,
+            Err(why) => {
+                col.lose(LossCategory::Masks, format!("{what}: not exported, {why}"));
+                return None;
+            }
+        },
+    };
+    // Feather, opacity, expansion.
+    let feather_prop = g.get("feather");
+    let feather_value = match feather_prop.map(|p| &p.value) {
+        Some(Value::Vec2(v)) => *v,
+        _ => [0.0, 0.0],
+    };
+    let feather = match (finite(feather_value[0]), finite(feather_value[1])) {
+        (Some(x), Some(y)) if (0.0..=MASK_LIMIT).contains(&x) && (0.0..=MASK_LIMIT).contains(&y) => ([x, y] != [0.0, 0.0]).then_some([x, y]),
+        _ => {
+            col.lose(LossCategory::InvalidValues, format!("{what}: feather {feather_value:?} is not valid, the default was written"));
+            None
+        }
+    };
+    let feather_keys = feather_prop.map_or_else(Vec::new, |p| plan_feather_keys(&p.keys, cp, what, col));
+    let scalar = |id: &str, default: f64, lo: f64, hi: f64, col: &mut Collector| -> Option<f64> {
+        let p = g.get(id)?;
+        if !p.keys.is_empty() {
+            col.lose(LossCategory::Masks, format!("{what}: keys on Mask {id} are not written (no keyed prototype), the static value is"));
+        }
+        let Value::Scalar(v) = p.value else { return None };
+        match finite(v) {
+            Some(v) if (lo..=hi).contains(&v) => ((v - default).abs() > 1e-12).then_some(v),
+            _ => {
+                col.lose(LossCategory::InvalidValues, format!("{what}: Mask {id} {v} is not valid, the default was written"));
+                None
+            }
+        }
+    };
+    let opacity = scalar("opacity", 100.0, 0.0, 100.0, col).map(|v| v / 100.0);
+    // The record holds -32 000 to 32 000, as for the feather (`tduM`, 091).
+    let expansion = scalar("expansion", 0.0, -MASK_LIMIT, MASK_LIMIT, col);
+    let name = cut_name(&g.name, 255, what, col);
+    Some(MaskPlan { name, mode: mode_id(mode), inverted, shape, path_keys, feather, feather_keys, opacity, expansion })
+}
+
+/// Feather keys (plain template, two components, speed in pixels per second).
+fn plan_feather_keys(src: &[effectcraft_keyframe::Keyframe], cp: &CompPlan, what: &str, col: &mut Collector) -> Vec<KeyPlan> {
+    let mut keys: Vec<(i64, &effectcraft_keyframe::Keyframe)> = Vec::with_capacity(src.len());
+    for k in src {
+        let (u, inexact) = cp.tb.units(k.time);
+        if inexact {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: feather key at {:.4} s moved to the time base", k.time.seconds()));
+        }
+        keys.push((u, k));
+    }
+    keys.sort_by_key(|(u, _)| *u);
+    let before = keys.len();
+    keys.dedup_by_key(|(u, _)| *u);
+    if keys.len() != before {
+        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: feather keys at the same time were merged"));
+    }
+    let mut out = Vec::with_capacity(keys.len());
+    let beyond = std::cell::Cell::new(false);
+    for (u, k) in &keys {
+        let Ok(time) = i32::try_from(*u) else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: feather key time out of range, key dropped"));
+            continue;
+        };
+        let value = match &k.value {
+            Value::Vec2([x, y]) => match (finite(*x), finite(*y)) {
+                (Some(x), Some(y)) if (0.0..=MASK_LIMIT).contains(&x) && (0.0..=MASK_LIMIT).contains(&y) => vec![x, y],
+                _ => {
+                    col.lose(LossCategory::InvalidValues, format!("{what}: a feather key that is not valid was dropped"));
+                    continue;
+                }
+            },
+            _ => {
+                col.lose(LossCategory::InvalidValues, format!("{what}: a feather key that is not a pair was dropped"));
+                continue;
+            }
+        };
+        let code = |i: Interp| match i {
+            Interp::Linear => 1u8,
+            Interp::Bezier => 2,
+            Interp::Hold => 3,
+        };
+        let (in_interp, out_interp) = (code(k.in_interp), code(k.out_interp));
+        let ease = |eases: &[Ease], i: usize, on: bool| -> EaseSlot {
+            if !on {
+                return EaseSlot::default();
+            }
+            let e = crate::export::plan::key_ease(eases, i);
+            let speed = finite(e.speed).filter(|v| v.abs() <= 1e9).unwrap_or_else(|| {
+                beyond.set(true);
+                0.0
+            });
+            EaseSlot { speed, influence: if e.influence.is_finite() { e.influence.clamp(0.001, 1.0) } else { 1.0 / 3.0 } }
+        };
+        out.push(KeyPlan {
+            time,
+            value,
+            in_interp,
+            out_interp,
+            in_ease: (0..2).map(|i| ease(&k.in_ease, i, in_interp == 2)).collect(),
+            out_ease: (0..2).map(|i| ease(&k.out_ease, i, out_interp == 2)).collect(),
+            spatial_in: [0.0; 3],
+            spatial_out: [0.0; 3],
+            spatial_auto: false,
+            roving: false,
+            label: k.label.min(16),
+        });
+        if k.roving {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: a roving feather key is written as a normal key"));
+        }
+        col.exported.keyframes = col.exported.keyframes.saturating_add(1);
+    }
+    crate::export::plan::report_beyond(beyond.get(), what, col);
+    out
+}
+
+// ---------------------------------------------------------------- chunks
+
+/// The mask prototypes.
+pub(crate) struct MaskProtos {
+    /// `tdmn ADBE Mask Parade`.
+    pub parade_name: Chunk<'static>,
+    /// The parade group children before its first match name (`tdsb`, `tdsn`).
+    pub parade_header: Vec<Chunk<'static>>,
+    /// `tdmn ADBE Mask Atom`, `mkif`, the atom `tdgp` (with static Feather, Opacity, Offset).
+    pub atom_name: Chunk<'static>,
+    pub mkif: Chunk<'static>,
+    pub atom: Chunk<'static>,
+    /// `tdmn ADBE Group End`.
+    pub group_end: Chunk<'static>,
+    /// The keyed path property (`tdbs`, two 64-byte records).
+    pub keyed_path: Chunk<'static>,
+    /// The keyed Mask Feather property (`tdbs`, two 88-byte records).
+    pub keyed_feather: Chunk<'static>,
+}
+
+pub(crate) fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let d = c.bytes()?;
+    Some(d.iter().take_while(|b| **b != 0).map(|b| char::from(*b)).collect())
+}
+
+/// The limit of a mask's feather and expansion (`tduM` 32 000, 091).
+const MASK_LIMIT: f64 = 32_000.0;
+
+/// A shape header (`shph`, 24 bytes, aep-format.md 3.8): bytes 0..2 `b3 de 02` (in every
+/// sample; meaning not decoded, and zero there is "an internally damaged shape" for After Effects,
+/// s13-m1), byte 3 `0x01` (`0x09` once the path is open), the box at 4..19 (written per shape),
+/// byte 20 1.
+pub(crate) fn shph() -> Vec<u8> {
+    let mut b = vec![0u8; 24];
+    let _ = crate::export::tree::put(&mut b, 0, &[0xb3, 0xde, 0x02, 0x01]);
+    let _ = put_u8(&mut b, 20, 1);
+    b
+}
+
+impl MaskProtos {
+    /// The prototypes built in code (aep-format.md 3.8): the parade and atom groups, `mkif` with
+    /// only its decoded fields (bytes 12..47 zero, read-back t-zmkif), the path, feather, opacity
+    /// and expansion records, and the keyed path and feather records.
+    pub(crate) fn build() -> MaskProtos {
+        use crate::export::synth::{KeyTemplate, NO_NAME, RecSpec, class, key_list, tdb4, tdbs, tdmn, tdsn};
+        let state = || Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec());
+        // The path property: one component of the path template (`tdb4` byte 7 = 1), a 4-byte
+        // `cdat`; the shapes follow in `omks`.
+        let path = RecSpec { dims: 1, template: KeyTemplate::Spatial(1), class: class::PATH, limits: None, byte5: None };
+        let path_rec = |keyed: bool| {
+            let mut kids = vec![state(), tdsn(NO_NAME), Chunk::data(*b"tdb4", tdb4(&path, keyed, 25_600))];
+            if keyed {
+                // Path keys are 64-byte records: flags `0x0001`, the `f64` at 16 1 on the first
+                // key (093; the rest of the record is zero: its last bytes were uninitialised).
+                let mut first = vec![0u8; 64];
+                let mut later = vec![0u8; 64];
+                for r in [&mut first, &mut later] {
+                    let _ = put_u16(r, 6, 0x0001);
+                }
+                let _ = put_f64(&mut first, 16, 1.0);
+                kids.push(key_list(64, 2, [first, later].concat()));
+            } else {
+                kids.push(Chunk::data(*b"cdat", vec![0u8; 4]));
+            }
+            Chunk::list(*b"tdbs", kids)
+        };
+        let shap = Chunk::list(*b"shap", vec![Chunk::data(*b"shph", shph()), key_list(8, 0, Vec::new()), Chunk::data(*b"omtn", Vec::new())]);
+        let feather = RecSpec { dims: 2, template: KeyTemplate::Plain, class: class::EFFECT_NUMBER, limits: Some((0.0, MASK_LIMIT)), byte5: None };
+        let opacity = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::EFFECT_NUMBER, limits: Some((0.0, 100.0)), byte5: None };
+        let offset = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::EFFECT_NUMBER, limits: Some((-MASK_LIMIT, MASK_LIMIT)), byte5: None };
+        let atom = Chunk::list(
+            *b"tdgp",
+            vec![
+                state(),
+                tdsn("Mask 1"),
+                tdmn("ADBE Mask Shape"),
+                Chunk::list(*b"om-s", vec![path_rec(false), Chunk::list(*b"omks", vec![shap])]),
+                tdmn("ADBE Mask Feather"),
+                tdbs(&feather, false, 25_600),
+                tdmn("ADBE Mask Opacity"),
+                tdbs(&opacity, false, 25_600),
+                tdmn("ADBE Mask Offset"),
+                tdbs(&offset, false, 25_600),
+                tdmn("ADBE Group End"),
+            ],
+        );
+        MaskProtos {
+            parade_name: tdmn("ADBE Mask Parade"),
+            parade_header: vec![state(), tdsn(NO_NAME)],
+            atom_name: tdmn("ADBE Mask Atom"),
+            mkif: Chunk::data(*b"mkif", vec![0u8; 48]),
+            atom,
+            group_end: tdmn("ADBE Group End"),
+            keyed_path: path_rec(true),
+            keyed_feather: tdbs(&feather, true, 25_600),
+        }
+    }
+}
+
+/// `tdmn` + `ADBE Mask Parade` group for the masks of a layer (source `size` pixels).
+pub(crate) fn build_parade(t: &MaskProtos, masks: &[MaskPlan], size: (u32, u32)) -> R<[Chunk<'static>; 2]> {
+    let mut kids = t.parade_header.clone();
+    for (i, m) in masks.iter().enumerate() {
+        let mut mkif = t.mkif.clone();
+        {
+            let d = crate::export::tree::data_mut(&mut mkif)?;
+            put_u8(d, 0, u8::from(m.inverted))?;
+            put_u32(d, 4, m.mode)?;
+            put_u32(d, 8, u32::try_from(i.saturating_add(1)).map_err(|_| tpl("too many masks"))?)?;
+        }
+        kids.push(t.atom_name.clone());
+        kids.push(mkif);
+        kids.push(build_atom(t, m, size)?);
+    }
+    kids.push(t.group_end.clone());
+    Ok([t.parade_name.clone(), Chunk::list(*b"tdgp", kids)])
+}
+
+fn build_atom(t: &MaskProtos, m: &MaskPlan, size: (u32, u32)) -> R<Chunk<'static>> {
+    let mut atom = t.atom.clone();
+    {
+        let tdsn = child_mut(&mut atom, b"tdsn")?;
+        crate::export::tree::set_utf8(tdsn, &m.name)?;
+    }
+    let kids = kids_mut(&mut atom)?;
+    let first = kids.iter().position(|c| c.is(b"tdmn")).ok_or_else(|| tpl("empty mask atom"))?;
+    let header: Vec<Chunk<'static>> = kids.drain(..first).collect();
+    let mut pairs: Vec<(String, [Chunk<'static>; 2])> = Vec::new();
+    let mut end: Option<Chunk<'static>> = None;
+    let mut it = std::mem::take(kids).into_iter();
+    while let Some(c) = it.next() {
+        let name = tdmn_name(&c).unwrap_or_default();
+        if name == "ADBE Group End" {
+            end = Some(c);
+            continue;
+        }
+        let node = it.next().ok_or_else(|| tpl("mask match name without a node"))?;
+        pairs.push((name, [c, node]));
+    }
+    let end = end.ok_or_else(|| tpl("mask atom without its end"))?;
+    let mut out = header;
+    for (name, [tdmn, mut node]) in pairs {
+        let keep = match name.as_str() {
+            "ADBE Mask Shape" => {
+                build_shape(t, &mut node, m, size)?;
+                true
+            }
+            "ADBE Mask Feather" => {
+                if !m.feather_keys.is_empty() {
+                    node = keyed_feather(t, &m.feather_keys)?;
+                    true
+                } else if let Some([x, y]) = m.feather {
+                    set_cdat(&mut node, &[x, y])?;
+                    true
+                } else {
+                    false
+                }
+            }
+            "ADBE Mask Opacity" => match m.opacity {
+                Some(v) => {
+                    set_cdat(&mut node, &[v])?;
+                    true
+                }
+                None => false,
+            },
+            "ADBE Mask Offset" => match m.expansion {
+                Some(v) => {
+                    set_cdat(&mut node, &[v])?;
+                    true
+                }
+                None => false,
+            },
+            _ => true,
+        };
+        if keep {
+            out.push(tdmn);
+            out.push(node);
+        }
+    }
+    out.push(end);
+    *kids_mut(&mut atom)? = out;
+    Ok(atom)
+}
+
+fn set_cdat(tdbs: &mut Chunk<'static>, values: &[f64]) -> R<()> {
+    let cdat = child_data(tdbs, b"cdat")?;
+    cdat.iter_mut().for_each(|b| *b = 0);
+    for (i, v) in values.iter().enumerate() {
+        put_f64(cdat, i * 8, *v)?;
+    }
+    Ok(())
+}
+
+/// Rewrites a key list (`lhd3` count words and `ldat`).
+fn set_key_list(tdbs: &mut Chunk<'static>, records: Vec<u8>, count: usize, size: usize) -> R<()> {
+    let list = list_mut(tdbs, b"list")?;
+    let n = u32::try_from(count).map_err(|_| tpl("too many keys"))?;
+    {
+        let lhd3 = child_data(list, b"lhd3")?;
+        crate::export::synth::put_key_counts(lhd3, n, u32::try_from(size).map_err(|_| tpl("record size"))?)?;
+    }
+    let ld = kids_mut(list)?;
+    match ld.iter_mut().find(|c| c.is(b"ldat")) {
+        Some(c) => *c = Chunk::data(*b"ldat", records),
+        None => ld.push(Chunk::data(*b"ldat", records)),
+    }
+    Ok(())
+}
+
+fn keyed_feather(t: &MaskProtos, keys: &[KeyPlan]) -> R<Chunk<'static>> {
+    let mut tdbs = t.keyed_feather.clone();
+    // The plain template with two components (208): 8 + 40 * 2 bytes.
+    let size = 88;
+    let mut ldat = Vec::with_capacity(size * keys.len());
+    for k in keys {
+        ldat.extend(crate::export::emit::plain_record(2, k, size)?);
+    }
+    set_key_list(&mut tdbs, ldat, keys.len(), size)?;
+    Ok(tdbs)
+}
+
+/// The `om-s` of the path: the property (static or keyed) and one `shap` per shape.
+fn build_shape(t: &MaskProtos, oms: &mut Chunk<'static>, m: &MaskPlan, size: (u32, u32)) -> R<()> {
+    let aspect = f64::from(size.0.max(1)) / f64::from(size.1.max(1));
+    let shapes: Vec<&ShapePlan> = if m.path_keys.is_empty() { vec![&m.shape] } else { m.path_keys.iter().map(|k| &k.shape).collect() };
+    let kids = kids_mut(oms)?;
+    // The shape prototype (one static `shap`).
+    let omks = kids.iter_mut().find(|c| c.is_list(b"omks")).ok_or_else(|| tpl("mask path without omks"))?;
+    let proto = kids_mut(omks)?.iter().find(|c| c.is_list(b"shap")).cloned().ok_or_else(|| tpl("mask path without a shape"))?;
+    let mut list = Vec::with_capacity(shapes.len());
+    for s in &shapes {
+        list.push(build_shap(&proto, s)?);
+    }
+    *kids_mut(omks)? = list;
+    let tdbs = kids.iter_mut().find(|c| c.is_list(b"tdbs")).ok_or_else(|| tpl("mask path without its property"))?;
+    if !m.path_keys.is_empty() {
+        let mut keyed = t.keyed_path.clone();
+        // The two prototype records (093). Only the common fields are decoded; the rest of the 64
+        // bytes is copied: the first key from the first record, every later key from the second
+        // (093 differs there: an `f64` 1 at byte 16 of the first record, 0 in the second).
+        let protos: Vec<Vec<u8>> = {
+            let list = keyed.child_list(b"list").ok_or_else(|| tpl("keyed path without keys"))?;
+            let ldat = list.child(b"ldat").and_then(|c| c.bytes()).ok_or_else(|| tpl("keyed path without records"))?;
+            ldat.as_chunks::<64>().0.iter().map(|r| r.to_vec()).collect()
+        };
+        let (first_rec, later_rec) = match protos.as_slice() {
+            [a, b, ..] => (a.clone(), b.clone()),
+            _ => return Err(tpl("keyed path prototype without two records")),
+        };
+        let mut ldat = Vec::with_capacity(64 * m.path_keys.len());
+        for (i, k) in m.path_keys.iter().enumerate() {
+            let mut r = if i == 0 { first_rec.clone() } else { later_rec.clone() };
+            let flags = u16::from_be_bytes([r.get(6).copied().unwrap_or(0), r.get(7).copied().unwrap_or(1)]) & !0x03e0;
+            put_i32(&mut r, 0, k.time)?;
+            put_u8(&mut r, 4, k.in_interp)?;
+            put_u8(&mut r, 5, k.out_interp)?;
+            put_u16(&mut r, 6, flags | (u16::from(k.label) << 6))?;
+            // The ease of bezier sides at 24..55 (599, 700); linear and hold sides keep the
+            // prototype's zeros.
+            if k.in_interp == 2 {
+                put_f64(&mut r, 24, k.in_ease.0)?;
+                put_f64(&mut r, 32, k.in_ease.1)?;
+            }
+            if k.out_interp == 2 {
+                put_f64(&mut r, 40, k.out_ease.0)?;
+                put_f64(&mut r, 48, k.out_ease.1)?;
+            }
+            ldat.extend(r);
+        }
+        set_key_list(&mut keyed, ldat, m.path_keys.len(), 64)?;
+        *tdbs = keyed;
+    }
+    // The width / height of the layer source, as for the Anchor Point (090, 093: 16 / 9 on a
+    // 1920 x 1080 solid; 309: 1 on a 100 x 100 solid).
+    put_f64(child_data(tdbs, b"tdb4")?, 24, aspect)?;
+    Ok(())
+}
+
+pub(crate) fn build_shap(proto: &Chunk<'static>, s: &ShapePlan) -> R<Chunk<'static>> {
+    let mut shap = proto.clone();
+    {
+        let shph = child_data(&mut shap, b"shph")?;
+        crate::export::tree::put_bits(shph, 3, 0x08, s.open)?;
+        for (i, v) in s.bbox.iter().enumerate() {
+            put_f32(shph, 4 + 4 * i, *v)?;
+        }
+    }
+    let list = list_mut(&mut shap, b"list")?;
+    let records = s.points.len();
+    let vertices = u32::try_from(records / 3).map_err(|_| tpl("too many vertices"))?;
+    {
+        // Point lists: word 2 the record count, words 3 and 7 the vertex count and four times it
+        // (090: 12 records, 4 and 16; 233: 9 records, 3 and 12), word 4 the record size 8.
+        let lhd3 = child_data(list, b"lhd3")?;
+        crate::export::synth::put_counts(lhd3, u32::try_from(records).map_err(|_| tpl("too many points"))?, vertices, 8, vertices, vertices.saturating_mul(4))?;
+    }
+    let mut ldat = vec![0u8; records.saturating_mul(8)];
+    for (i, [u, v]) in s.points.iter().enumerate() {
+        put_f32(&mut ldat, i * 8, *u)?;
+        put_f32(&mut ldat, i * 8 + 4, *v)?;
+    }
+    let ld = kids_mut(list)?;
+    match ld.iter_mut().find(|c| c.is(b"ldat")) {
+        Some(c) => *c = Chunk::data(*b"ldat", ldat),
+        None => ld.push(Chunk::data(*b"ldat", ldat)),
+    }
+    Ok(shap)
+}
diff --git a/crates/aep/src/export/plan.rs b/crates/aep/src/export/plan.rs
new file mode 100644
index 000000000..a6789eda9
--- /dev/null
+++ b/crates/aep/src/export/plan.rs
@@ -0,0 +1,1348 @@
+//! The plan: the EffectCraft project reduced to exactly the values the `.aep` can hold, in the
+//! file's units, with everything that cannot be written already reported. Pure data; the chunks
+//! are built from it in `emit`.
+
+use std::collections::{BTreeMap, HashSet};
+
+use effectcraft_color::{BlendMode, Label};
+use effectcraft_keyframe::{Ease, Interp, Keyframe};
+use effectcraft_project::{Comp, ItemId, ItemKind, Layer, LayerId, LayerSource, Project, Property, Quality, Renderer};
+use effectcraft_time::{FrameRate, Tick};
+
+use crate::export::report::{Collector, LossCategory};
+use crate::export::timebase::{TimeBase, time_base};
+
+/// No sensible coordinate, angle or percentage comes near this; larger numbers (and NaN
+/// or infinity) are written as the default.
+pub(crate) const LIMIT: f64 = 1e9;
+/// The largest composition or solid side After Effects accepts.
+pub(crate) const MAX_SIDE: u32 = 30_000;
+/// The longest composition After Effects accepts (3 hours).
+const MAX_SECONDS: i64 = 3 * 3600;
+/// Deepest folder nesting that is exported.
+const MAX_FOLDER_DEPTH: usize = 64;
+
+/// The five Transform properties that are exported, in the file's canonical order.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum PropKind {
+    Anchor,
+    Position,
+    Scale,
+    Rotation,
+    Opacity,
+}
+
+impl PropKind {
+    pub const ALL: [PropKind; 5] = [PropKind::Anchor, PropKind::Position, PropKind::Scale, PropKind::Rotation, PropKind::Opacity];
+
+    /// The match name in the file.
+    pub fn match_name(self) -> &'static str {
+        match self {
+            PropKind::Anchor => "ADBE Anchor Point",
+            PropKind::Position => "ADBE Position",
+            PropKind::Scale => "ADBE Scale",
+            PropKind::Rotation => "ADBE Rotate Z",
+            PropKind::Opacity => "ADBE Opacity",
+        }
+    }
+
+    /// The property id in the project.
+    pub fn id(self) -> &'static str {
+        match self {
+            PropKind::Anchor => "anchor",
+            PropKind::Position => "position",
+            PropKind::Scale => "scale",
+            PropKind::Rotation => "rotation",
+            PropKind::Opacity => "opacity",
+        }
+    }
+
+    /// Components stored in a value.
+    pub fn dims(self) -> usize {
+        match self {
+            PropKind::Anchor | PropKind::Position | PropKind::Scale => 3,
+            PropKind::Rotation | PropKind::Opacity => 1,
+        }
+    }
+
+    /// Anchor and Position have motion paths (the spatial key template).
+    pub fn spatial(self) -> bool {
+        matches!(self, PropKind::Anchor | PropKind::Position)
+    }
+
+    /// The factor from the project's unit to the stored one (percent to fraction).
+    fn unit(self) -> f64 {
+        match self {
+            PropKind::Scale | PropKind::Opacity => 100.0,
+            _ => 1.0,
+        }
+    }
+}
+
+/// One side of a key's temporal ease: speed in stored units per second, influence 0..1.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct EaseSlot {
+    pub speed: f64,
+    pub influence: f64,
+}
+
+impl Default for EaseSlot {
+    fn default() -> Self {
+        EaseSlot { speed: 0.0, influence: 0.0 }
+    }
+}
+
+/// A keyframe in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct KeyPlan {
+    /// In the composition's time units (layer time).
+    pub time: i32,
+    pub value: Vec<f64>,
+    /// 1 linear, 2 bezier, 3 hold.
+    pub in_interp: u8,
+    pub out_interp: u8,
+    /// One slot per component (plain template) or one slot (spatial template).
+    pub in_ease: Vec<EaseSlot>,
+    pub out_ease: Vec<EaseSlot>,
+    pub spatial_in: [f64; 3],
+    pub spatial_out: [f64; 3],
+    pub spatial_auto: bool,
+    pub roving: bool,
+    pub label: u8,
+}
+
+/// A property that differs from its default: a static value, keys, or an expression.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct PropPlan {
+    pub kind: PropKind,
+    pub value: Vec<f64>,
+    pub keys: Vec<KeyPlan>,
+    pub expr: Option<(String, bool)>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum LayerSrc {
+    Solid(ItemId),
+    Null,
+    /// A precomposition layer: the composition item it shows.
+    Comp(ItemId),
+    /// A footage layer: the footage item it shows.
+    Footage(ItemId),
+    /// A text layer and its text document.
+    Text(Box<crate::export::text::TextPlan>),
+    /// A camera (256) and its options.
+    Camera(Box<crate::export::camlight::CameraPlan>),
+    /// A spot or point light (254, 252) and its options.
+    Light(Box<crate::export::camlight::LightPlan>),
+    /// A shape layer and its items (519).
+    Shape(Vec<crate::export::shapes::ShItem>),
+}
+
+/// A layer in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct LayerPlan {
+    pub name: String,
+    pub src: LayerSrc,
+    pub adjustment: bool,
+    pub label: u8,
+    /// 1 draft, 2 best.
+    pub quality: u8,
+    pub start: i32,
+    pub in_rel: i32,
+    pub out_rel: i32,
+    pub blend: u8,
+    pub parent: Option<LayerId>,
+    /// Track matte: the matte layer and the mode (`ldta@107`: 1 alpha, 2 alpha inverted, 3 luma,
+    /// 4 luma inverted; 403-406).
+    pub matte: Option<(LayerId, u8)>,
+    pub markers: Vec<crate::export::markers::MarkerPlan>,
+    pub ec_id: LayerId,
+    pub video: bool,
+    pub audio: bool,
+    pub solo: bool,
+    pub locked: bool,
+    pub shy: bool,
+    pub collapse: bool,
+    pub effects: bool,
+    pub motion_blur: bool,
+    pub guide: bool,
+    pub three_d: bool,
+    /// Time stretch as `numerator / denominator` (1 / 1 = 100 %, -1 / 1 = -100 %).
+    pub stretch: (i32, u32),
+    /// The time scale the layer's properties count in.
+    pub time_scale: u32,
+    pub props: Vec<PropPlan>,
+    /// The layer's masks, in stack order.
+    pub masks: Vec<crate::export::masks::MaskPlan>,
+    /// The layer's effects, in stack order.
+    pub fx: Vec<crate::export::effects::EffectPlan>,
+    /// Size of the layer's source in pixels (the Anchor Point divisor).
+    pub source_size: (u32, u32),
+    /// An enabled Time Remap (source seconds; keys in layer time), written into the layer's
+    /// `ADBE Time Remapping` record (319, 354).
+    pub remap: Option<PropPlan>,
+    /// The layer styles (None: none applied).
+    pub styles: Option<crate::export::styles::StylesPlan>,
+}
+
+/// `cp` without its layers.
+fn comp_header(cp: &CompPlan) -> CompPlan {
+    CompPlan {
+        width: cp.width,
+        height: cp.height,
+        tb: cp.tb,
+        rate: cp.rate,
+        duration_units: cp.duration_units,
+        work_start: cp.work_start,
+        work_end: cp.work_end,
+        background: cp.background,
+        pixel_aspect: cp.pixel_aspect,
+        motion_blur: cp.motion_blur,
+        shutter_angle: cp.shutter_angle,
+        shutter_phase: cp.shutter_phase,
+        display_start: cp.display_start,
+        markers: Vec::new(),
+        layers: Vec::new(),
+    }
+}
+
+/// A composition in the file's units.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct CompPlan {
+    pub width: u16,
+    pub height: u16,
+    pub tb: TimeBase,
+    pub rate: FrameRate,
+    pub duration_units: u32,
+    pub work_start: u32,
+    /// `None` = the whole composition (`0xffffffff`).
+    pub work_end: Option<u32>,
+    pub background: [u8; 3],
+    pub pixel_aspect: (u32, u32),
+    pub motion_blur: bool,
+    pub shutter_angle: u32,
+    pub shutter_phase: i32,
+    pub display_start: u32,
+    /// Composition markers (written into the `Markers` view layer).
+    pub markers: Vec<crate::export::markers::MarkerPlan>,
+    pub layers: Vec<LayerPlan>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct SolidPlan {
+    pub color: [f32; 3],
+    pub width: u32,
+    pub height: u32,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum ItemPlan {
+    Folder(Vec<Entry>),
+    Comp(Box<CompPlan>),
+    Solid(SolidPlan),
+    Footage(Box<crate::export::footage::FootagePlan>),
+}
+
+/// A project item with its name and label.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Entry {
+    pub ec: ItemId,
+    pub name: String,
+    pub label: u8,
+    pub plan: ItemPlan,
+}
+
+/// The whole project: the items at the root.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ProjectPlan {
+    pub root: Vec<Entry>,
+    pub settings: crate::export::settings::SettingsPlan,
+}
+
+/// `name` cut to `max` bytes at a character boundary (after Effects stores a name of up to 255
+/// characters; a solid's name lives in a 256 byte field).
+pub(crate) fn cut_name(name: &str, max: usize, what: &str, col: &mut Collector) -> String {
+    if name.len() <= max {
+        return name.to_string();
+    }
+    let mut end = max;
+    while end > 0 && !name.is_char_boundary(end) {
+        end -= 1;
+    }
+    col.lose(LossCategory::Names, format!("{what}: name of {} bytes cut to {end}", name.len()));
+    name.get(..end).unwrap_or_default().to_string()
+}
+
+/// A number that can be written, or `None`.
+fn sane(v: f64) -> Option<f64> {
+    (v.is_finite() && v.abs() <= LIMIT).then_some(v)
+}
+
+pub(crate) fn label_index(l: Label) -> u8 {
+    Label::ALL.iter().position(|x| *x == l).and_then(|i| u8::try_from(i).ok()).unwrap_or(0)
+}
+
+fn blend_code(mode: BlendMode) -> Option<u8> {
+    Some(match mode {
+        BlendMode::Normal => 2,
+        BlendMode::Add => 4,
+        BlendMode::Multiply => 5,
+        BlendMode::Screen => 6,
+        BlendMode::Overlay => 7,
+        BlendMode::Difference => 26,
+        // The codes After Effects writes for the other modes (906, 907; the importer's table).
+        BlendMode::SoftLight => 8,
+        BlendMode::HardLight => 9,
+        BlendMode::Darken => 10,
+        BlendMode::Lighten => 11,
+        BlendMode::ClassicDifference => 12,
+        BlendMode::Hue => 13,
+        BlendMode::Saturation => 14,
+        BlendMode::Color => 15,
+        BlendMode::Luminosity => 16,
+        BlendMode::StencilAlpha => 17,
+        BlendMode::StencilLuma => 18,
+        BlendMode::SilhouetteAlpha => 19,
+        BlendMode::SilhouetteLuma => 20,
+        BlendMode::ClassicColorDodge => 23,
+        BlendMode::ClassicColorBurn => 24,
+        BlendMode::Exclusion => 25,
+        BlendMode::ColorDodge => 27,
+        BlendMode::ColorBurn => 28,
+        BlendMode::LinearDodge => 29,
+        BlendMode::LinearBurn => 30,
+        BlendMode::LinearLight => 31,
+        BlendMode::VividLight => 32,
+        BlendMode::PinLight => 33,
+        BlendMode::HardMix => 34,
+        _ => return None,
+    })
+}
+
+/// Natural, case-insensitive order of names (digit runs compare as numbers), as After Effects
+/// sorts the project panel and stores the items.
+pub(crate) fn natural_key(name: &str) -> Vec<(bool, String, u128)> {
+    let mut out: Vec<(bool, String, u128)> = Vec::new();
+    let mut chars = name.chars().peekable();
+    while let Some(&c) = chars.peek() {
+        if c.is_ascii_digit() {
+            let mut n: u128 = 0;
+            let mut s = String::new();
+            while let Some(&d) = chars.peek() {
+                if !d.is_ascii_digit() {
+                    break;
+                }
+                n = n.saturating_mul(10).saturating_add(u128::from(d as u8 - b'0'));
+                s.push(d);
+                chars.next();
+            }
+            out.push((true, s, n));
+        } else {
+            let mut s = String::new();
+            while let Some(&d) = chars.peek() {
+                if d.is_ascii_digit() {
+                    break;
+                }
+                s.extend(d.to_lowercase());
+                chars.next();
+            }
+            out.push((false, s, 0));
+        }
+    }
+    out
+}
+
+fn sort_entries(v: &mut [Entry]) {
+    v.sort_by(|a, b| {
+        let ka = natural_key(&a.name);
+        let kb = natural_key(&b.name);
+        let cmp = |x: &(bool, String, u128), y: &(bool, String, u128)| match (x.0, y.0) {
+            (true, true) => x.2.cmp(&y.2).then_with(|| x.1.cmp(&y.1)),
+            (false, false) => x.1.cmp(&y.1),
+            (true, false) => std::cmp::Ordering::Less,
+            (false, true) => std::cmp::Ordering::Greater,
+        };
+        for (x, y) in ka.iter().zip(kb.iter()) {
+            let c = cmp(x, y);
+            if c != std::cmp::Ordering::Equal {
+                return c;
+            }
+        }
+        ka.len().cmp(&kb.len()).then_with(|| a.ec.0.cmp(&b.ec.0))
+    });
+}
+
+/// Plans the whole project.
+pub(crate) fn plan(project: &Project, col: &mut Collector) -> ProjectPlan {
+    // Items whose chain of folders reaches the root (no loop, not nested absurdly deep).
+    let mut ok: HashSet<ItemId> = HashSet::new();
+    for (id, item) in &project.items {
+        let mut at = item.parent.filter(|p| project.items.contains_key(p));
+        let mut steps = 0usize;
+        let reachable = loop {
+            match at {
+                None => break true,
+                Some(p) if p == *id => break false,
+                Some(p) => {
+                    steps += 1;
+                    if steps > MAX_FOLDER_DEPTH {
+                        break false;
+                    }
+                    at = project.items.get(&p).and_then(|i| i.parent).filter(|q| project.items.contains_key(q));
+                }
+            }
+        };
+        if reachable {
+            ok.insert(*id);
+        } else {
+            col.lose(
+                LossCategory::FootageItems,
+                format!("'{}' is in a folder loop or nested deeper than {MAX_FOLDER_DEPTH} levels and was not exported", item.name),
+            );
+        }
+    }
+    // Children per folder, project order (creation order = id order).
+    let mut by_parent: BTreeMap<Option<ItemId>, Vec<ItemId>> = BTreeMap::new();
+    for (id, item) in &project.items {
+        if ok.contains(id) {
+            by_parent.entry(item.parent.filter(|p| project.items.contains_key(p))).or_default().push(*id);
+        }
+    }
+    let cx = PlanCx { project, by_parent: &by_parent, ok: &ok };
+    let root = plan_children(&cx, None, col);
+    // The base writes an empty render queue.
+    for job in &project.render_queue {
+        let comp = project.items.get(&job.comp).map_or("a missing composition", |i| i.name.as_str());
+        col.lose(LossCategory::RenderQueue, format!("the render queue item of '{comp}' is not written"));
+    }
+    ProjectPlan { root, settings: crate::export::settings::plan(&project.settings, col) }
+}
+
+struct PlanCx<'a> {
+    project: &'a Project,
+    by_parent: &'a BTreeMap<Option<ItemId>, Vec<ItemId>>,
+    ok: &'a HashSet<ItemId>,
+}
+
+fn plan_children(cx: &PlanCx<'_>, parent: Option<ItemId>, col: &mut Collector) -> Vec<Entry> {
+    let project = cx.project;
+    let mut out = Vec::new();
+    for id in cx.by_parent.get(&parent).map(Vec::as_slice).unwrap_or(&[]) {
+        let Some(item) = project.item(*id) else { continue };
+        let label = label_index(item.label);
+        let item_name = cut_name(&item.name, 255, "item", col);
+        if !item.comment.is_empty() {
+            col.lose(LossCategory::Names, format!("'{}': the item comment is not written", item.name));
+        }
+        if item.proxy.is_some() {
+            col.lose(LossCategory::FootageItems, format!("'{}': the proxy is not written", item.name));
+        }
+        match &item.kind {
+            ItemKind::Folder => {
+                col.exported.folders += 1;
+                let kids = plan_children(cx, Some(*id), col);
+                out.push(Entry { ec: *id, name: item_name, label, plan: ItemPlan::Folder(kids) });
+            }
+            ItemKind::Comp(comp) => {
+                let cp = plan_comp(cx, *id, &item.name, comp, col);
+                col.exported.compositions += 1;
+                out.push(Entry { ec: *id, name: item_name, label, plan: ItemPlan::Comp(Box::new(cp)) });
+            }
+            ItemKind::Solid(s) => {
+                let width = clamp_side(s.width, &item.name, col);
+                let height = clamp_side(s.height, &item.name, col);
+                let mut color = [0f32; 3];
+                for (c, v) in color.iter_mut().zip(s.color) {
+                    *c = if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 };
+                    if c.to_bits() != v.to_bits() {
+                        col.lose(LossCategory::InvalidValues, format!("solid '{}': colour channel {v} written as {c}", item.name));
+                    }
+                }
+                if s.pixel_aspect.to_bits() != 1f64.to_bits() {
+                    col.lose(LossCategory::FootageItems, format!("solid '{}': pixel aspect {} is not written (written as 1)", item.name, s.pixel_aspect));
+                }
+                col.exported.solids += 1;
+                out.push(Entry { ec: *id, name: item_name, label, plan: ItemPlan::Solid(SolidPlan { color, width, height }) });
+            }
+            ItemKind::Footage(f) => {
+                if !f.markers.is_empty() {
+                    col.lose(LossCategory::Markers, format!("footage '{}': {} footage marker(s) are not written", item.name, f.markers.len()));
+                }
+                if let Some(fp) = crate::export::footage::plan_footage(&item.name, f, col) {
+                    out.push(Entry { ec: *id, name: item_name, label, plan: ItemPlan::Footage(Box::new(fp)) });
+                }
+            }
+        }
+    }
+    sort_entries(&mut out);
+    out
+}
+
+fn clamp_side(v: u32, what: &str, col: &mut Collector) -> u32 {
+    if (1..=MAX_SIDE).contains(&v) {
+        v
+    } else {
+        col.lose(LossCategory::CompositionSettings, format!("'{what}': size {v} is outside 1 to {MAX_SIDE}, written as {}", v.clamp(1, MAX_SIDE)));
+        v.clamp(1, MAX_SIDE)
+    }
+}
+
+/// The best fraction `n / d` of `v` with a denominator up to 1000 (continued fractions).
+fn rational(v: f64) -> (u32, u32) {
+    if !(v.is_finite() && v > 0.0) {
+        return (1, 1);
+    }
+    let (mut h0, mut h1, mut k0, mut k1) = (0i64, 1i64, 1i64, 0i64);
+    let mut x = v;
+    for _ in 0..24 {
+        let a = x.floor();
+        if a > 1e6 {
+            break;
+        }
+        let a = a as i64;
+        let (h2, k2) = (a * h1 + h0, a * k1 + k0);
+        if k2 > 1000 || h2 > 1_000_000 {
+            break;
+        }
+        (h0, h1, k0, k1) = (h1, h2, k1, k2);
+        if (h1 as f64 / k1 as f64 - v).abs() < 1e-9 {
+            break;
+        }
+        let frac = x - a as f64;
+        if frac < 1e-12 {
+            break;
+        }
+        x = 1.0 / frac;
+    }
+    match (u32::try_from(h1), u32::try_from(k1)) {
+        (Ok(n), Ok(d)) if n > 0 && d > 0 => (n, d),
+        _ => (1, 1),
+    }
+}
+
+fn plan_comp(cx: &PlanCx<'_>, comp_id: ItemId, name: &str, comp: &Comp, col: &mut Collector) -> CompPlan {
+    let rate = comp.frame_rate;
+    let tb = time_base(rate).unwrap_or_else(|| {
+        col.lose(LossCategory::CompositionSettings, format!("'{name}': frame rate {} cannot be stored, 25 fps written", rate.label()));
+        TimeBase { frame_duration: 1024, timescale: 25600 }
+    });
+    let rate = if time_base(rate).is_some() { rate } else { FrameRate::new(25, 1) };
+    let width = clamp_side(comp.width, name, col);
+    let height = clamp_side(comp.height, name, col);
+    let max_frames = MAX_SECONDS.saturating_mul(rate.num) / rate.den.max(1);
+    let mut frames = tb.frames(comp.duration, rate);
+    if (1..=max_frames).contains(&frames) && rate.tick_of(frames) != comp.duration {
+        col.lose(LossCategory::RoundedTimes, format!("'{name}': duration moved to whole frames ({frames})"));
+    }
+    if frames < 1 || frames > max_frames {
+        let fixed = frames.clamp(1, max_frames.max(1));
+        col.lose(LossCategory::CompositionSettings, format!("'{name}': duration of {frames} frames is outside 1 frame to 3 hours, written as {fixed} frames"));
+        frames = fixed;
+    }
+    let fd = i64::from(tb.frame_duration);
+    let duration_units = u32::try_from(frames.saturating_mul(fd)).unwrap_or_else(|_| {
+        col.lose(LossCategory::CompositionSettings, format!("'{name}': the duration does not fit the time base of {} fps, written shorter", rate.label()));
+        u32::MAX
+    });
+    let ws = tb.frames(comp.work_area.0, rate).clamp(0, frames - 1);
+    let we = tb.frames(comp.work_area.1, rate).clamp(ws + 1, frames);
+    let whole = ws == 0 && we == frames;
+    if (comp.work_area.0 != rate.tick_of(ws) && comp.work_area.0 != Tick::ZERO) || (comp.work_area.1 != rate.tick_of(we) && comp.work_area.1 != comp.duration) {
+        col.lose(LossCategory::RoundedTimes, format!("'{name}': work area moved to whole frames ({ws} to {we})"));
+    }
+    let mut background = [0u8; 3];
+    for (b, v) in background.iter_mut().zip(comp.background) {
+        *b = if v.is_finite() { (v.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 };
+        // Eight bits per channel is what the format holds (the nearest level is written); a
+        // channel outside 0 to 1 is reported.
+        if !(0.0..=1.0).contains(&v) {
+            col.lose(LossCategory::CompositionSettings, format!("'{name}': background channel {v} written as {b}/255"));
+        }
+    }
+    let pa = sane(comp.pixel_aspect).filter(|v| *v > 0.0).unwrap_or(1.0);
+    let (pn, pd) = rational(pa);
+    if (f64::from(pn) / f64::from(pd) - pa).abs() > 1e-9 || pa.to_bits() != comp.pixel_aspect.to_bits() {
+        col.lose(LossCategory::CompositionSettings, format!("'{name}': pixel aspect {pa} written as {pn}/{pd}"));
+    }
+    if matches!(comp.renderer, Renderer::Advanced3D) {
+        col.lose(LossCategory::CompositionOptions, format!("'{name}': the Advanced 3D renderer is written as Classic 3D"));
+    }
+    let comp_markers = crate::export::markers::plan(&comp.markers, &tb, &format!("'{name}'"), col);
+    if !comp.guides.is_empty() {
+        col.lose(LossCategory::CompositionOptions, format!("'{name}': {} guides", comp.guides.len()));
+    }
+    if comp.essential.is_some() {
+        col.lose(LossCategory::CompositionOptions, format!("'{name}': Essential Graphics"));
+    }
+    // Advanced settings that change rendered frames, which the base does not decode: written at
+    // After Effects' defaults (the samples per frame and adaptive limit are the 16 and 128 every
+    // sample holds at cdta 200 and 196, base.rs), so any other value is reported. Viewer state
+    // (Hide Shy, Draft 3D, the viewer resolution, the poster time) is a listed limitation.
+    let unwritten = [
+        (comp.preserve_frame_rate, "Preserve Frame Rate switched on"),
+        (comp.preserve_resolution, "Preserve Resolution switched on"),
+        (comp.motion_blur_samples != 16, "motion blur samples per frame other than 16"),
+        (comp.motion_blur_adaptive_limit != 128, "adaptive sample limit other than 128"),
+    ];
+    for (_, what) in unwritten.iter().filter(|(lost, _)| *lost) {
+        col.lose(LossCategory::CompositionOptions, format!("'{name}': {what} (written as the default)"));
+    }
+    let (ds, inexact) = tb.units(comp.display_start);
+    let display_start = u32::try_from(ds).unwrap_or(0);
+    if inexact || i64::from(display_start) != ds {
+        col.lose(LossCategory::CompositionSettings, format!("'{name}': start timecode written as {} frames", i64::from(display_start) / fd.max(1)));
+    }
+    let shutter = |v: f64, (lo, hi): (f64, f64), default: f64, what: &str, col: &mut Collector| {
+        let out = sane(v).map_or(default, |v| v.round().clamp(lo, hi));
+        if out.to_bits() != v.to_bits() {
+            col.lose(LossCategory::CompositionSettings, format!("'{name}': shutter {what} {v} written as {out}"));
+        }
+        out
+    };
+    let shutter_angle = shutter(comp.shutter_angle, (0.0, 720.0), 180.0, "angle", col) as u32;
+    let shutter_phase = shutter(comp.shutter_phase, (-720.0, 720.0), 0.0, "phase", col) as i32;
+
+    let mut cp = CompPlan {
+        width: u16::try_from(width).unwrap_or(u16::MAX),
+        height: u16::try_from(height).unwrap_or(u16::MAX),
+        tb,
+        rate,
+        duration_units,
+        work_start: u32::try_from(ws.saturating_mul(fd)).unwrap_or(0),
+        // Both fit when the duration does (`ws < we <= frames`); a duration that does not is reported above.
+        work_end: if whole { None } else { u32::try_from(we.saturating_mul(fd)).ok() },
+        background,
+        pixel_aspect: (pn, pd),
+        motion_blur: comp.enable_motion_blur,
+        shutter_angle,
+        shutter_phase,
+        display_start,
+        markers: comp_markers,
+        layers: Vec::new(),
+    };
+    let ids: HashSet<LayerId> = comp.layers.iter().map(|l| l.id).collect();
+    let at = CompAt { id: comp_id, name, comp, ids: &ids };
+    for layer in &comp.layers {
+        if let Some(lp) = plan_layer(cx, at, &cp, layer, col) {
+            cp.layers.push(lp);
+        }
+    }
+    resolve_parents(&mut cp, name, col);
+    resolve_mattes(&mut cp, name, col);
+    resolve_effect_layers(&mut cp, name, col);
+    cp
+}
+
+/// An effect's layer parameter that names a layer that is not exported falls back to the owning
+/// layer (After Effects' default) and is reported.
+fn resolve_effect_layers(cp: &mut CompPlan, comp_name: &str, col: &mut Collector) {
+    let exported: HashSet<LayerId> = cp.layers.iter().map(|l| l.ec_id).collect();
+    for l in &mut cp.layers {
+        for fx in &mut l.fx {
+            let before = fx.layers.len();
+            fx.layers.retain(|(_, p)| !matches!(p, crate::export::effects::LayerPick::Layer(id) if !exported.contains(id)));
+            if fx.layers.len() != before {
+                col.lose(
+                    LossCategory::Effects,
+                    format!(
+                        "{comp_name}: '{}' effect '{}': a layer parameter names a layer that is not exported, the owning layer was written",
+                        l.name, fx.name
+                    ),
+                );
+            }
+        }
+    }
+}
+
+/// A track matte whose layer is not exported, or is the layer itself, is dropped and reported.
+fn resolve_mattes(cp: &mut CompPlan, comp_name: &str, col: &mut Collector) {
+    let exported: HashSet<LayerId> = cp.layers.iter().map(|l| l.ec_id).collect();
+    for l in &mut cp.layers {
+        if let Some((m, _)) = l.matte
+            && (m == l.ec_id || !exported.contains(&m))
+        {
+            col.lose(LossCategory::TrackMattes, format!("{comp_name}: '{}': the track matte layer is not exported", l.name));
+            l.matte = None;
+        }
+    }
+}
+
+/// Parent links to a layer that was not exported, and links that lead into a loop, are cut.
+fn resolve_parents(cp: &mut CompPlan, comp_name: &str, col: &mut Collector) {
+    let exported: HashSet<LayerId> = cp.layers.iter().map(|l| l.ec_id).collect();
+    let mut links: std::collections::HashMap<LayerId, LayerId> = cp.layers.iter().filter_map(|l| l.parent.map(|p| (l.ec_id, p))).collect();
+    for l in &mut cp.layers {
+        let Some(p) = l.parent else { continue };
+        let mut cut = !exported.contains(&p);
+        if !cut {
+            // Follow the chain; a chain longer than the number of links is a loop.
+            let mut at = p;
+            for _ in 0..=links.len() {
+                if at == l.ec_id {
+                    cut = true;
+                    break;
+                }
+                match links.get(&at) {
+                    Some(next) => at = *next,
+                    None => break,
+                }
+            }
+            if !cut && at == l.ec_id {
+                cut = true;
+            }
+        }
+        if cut {
+            col.lose(LossCategory::ParentLinks, format!("{comp_name}: '{}' has a parent that was not exported or forms a loop", l.name));
+            links.remove(&l.ec_id);
+            l.parent = None;
+        }
+    }
+}
+
+/// The source of a layer and its size; `None` (with a loss) for a layer that is not written.
+fn plan_source(
+    cx: &PlanCx<'_>,
+    comp_id: ItemId,
+    comp_name: &str,
+    comp: &Comp,
+    layer: &Layer,
+    remapped: bool,
+    col: &mut Collector,
+) -> Option<(LayerSrc, (u32, u32))> {
+    let what = |s: &str| format!("{comp_name}: {s} '{}'", layer.name);
+    Some(match &layer.source {
+        LayerSource::Solid { item } => match cx.project.item(*item).filter(|_| cx.ok.contains(item)).map(|i| &i.kind) {
+            Some(ItemKind::Solid(s)) => (LayerSrc::Solid(*item), (s.width.clamp(1, MAX_SIDE), s.height.clamp(1, MAX_SIDE))),
+            _ => {
+                col.lose(LossCategory::UnsupportedLayers, what("solid layer without a solid:"));
+                return None;
+            }
+        },
+        LayerSource::Null => (LayerSrc::Null, (100, 100)),
+        LayerSource::Text => {
+            // A text layer has no source; it spans the composition (the importer's convention).
+            let tp = crate::export::text::plan_text(layer, comp_name, col)?;
+            (LayerSrc::Text(Box::new(tp)), (comp.width.clamp(1, MAX_SIDE), comp.height.clamp(1, MAX_SIDE)))
+        }
+        // A shape layer has no source; its anchor is in pixels (462), its items are planned from
+        // the `contents` group.
+        // (planned below, once the layer's time base is known: their keys count in it)
+        LayerSource::Shape => (LayerSrc::Shape(Vec::new()), (comp.width.clamp(1, MAX_SIDE), comp.height.clamp(1, MAX_SIDE))),
+        // Cameras and lights have no source; their point of interest is the Anchor Point in
+        // pixels (3.12).
+        LayerSource::Camera => (LayerSrc::Camera(Box::new(crate::export::camlight::plan_camera(layer, comp.width, &what("camera"), col))), (1, 1)),
+        LayerSource::Light { kind } => (LayerSrc::Light(Box::new(crate::export::camlight::plan_light(layer, *kind, &what("light"), col)?)), (1, 1)),
+        LayerSource::Model { .. } | LayerSource::Primitive { .. } => {
+            col.lose(LossCategory::ModelLayers, what("3D layer"));
+            return None;
+        }
+        LayerSource::Footage { item } => match cx.project.item(*item).filter(|_| cx.ok.contains(item)).map(|i| (&i.name, &i.kind)) {
+            Some((name, ItemKind::Footage(f))) if let Some(fp) = crate::export::footage::plan_footage(name, f, &mut Collector::default()) => {
+                // After Effects ends a layer of timed footage at the source's end (f1: an mp4,
+                // two sequences and a WAV written 5 s long read back 1, 0.1, 0.1 and 1 s long).
+                // Source time the layer reaches: its span divided by the stretch (a reversed layer reaches
+                // it at its in point).
+                let span = (layer.out_point.seconds() - layer.start_time.seconds()).abs().max((layer.in_point.seconds() - layer.start_time.seconds()).abs())
+                    / (layer.stretch.abs() / 100.0).max(1e-9);
+                // A remapped layer may run past its source (the remap holds a frame); less than a
+                // composition frame past is the rounding of a clip's duration to frames.
+                let frame = comp.frame_rate.frame_duration().seconds();
+                if fp.seconds > 0.0 && span > fp.seconds + frame.max(1e-6) - 1e-9 && !remapped {
+                    col.lose(
+                        LossCategory::LayerTiming,
+                        what(&format!("footage layer runs {span:.3} s, past its source's {:.3} s; After Effects ends it there:", fp.seconds)),
+                    );
+                }
+                (LayerSrc::Footage(*item), (f.width.clamp(1, MAX_SIDE), f.height.clamp(1, MAX_SIDE)))
+            }
+            _ => {
+                col.lose(LossCategory::UnsupportedLayers, what("footage layer whose footage is not exported:"));
+                return None;
+            }
+        },
+        LayerSource::Comp { item } => match cx.project.item(*item).filter(|_| cx.ok.contains(item)).map(|i| &i.kind) {
+            Some(ItemKind::Comp(c)) if !precomp_loop(cx.project, comp_id, *item) => {
+                (LayerSrc::Comp(*item), (c.width.clamp(1, MAX_SIDE), c.height.clamp(1, MAX_SIDE)))
+            }
+            Some(ItemKind::Comp(_)) => {
+                col.lose(LossCategory::UnsupportedLayers, what("precomposition layer that closes a loop:"));
+                return None;
+            }
+            _ => {
+                col.lose(LossCategory::UnsupportedLayers, what("precomposition layer without its composition:"));
+                return None;
+            }
+        },
+    })
+}
+
+/// The exact time stretch ratio of a layer and the time scale its properties count in.
+fn plan_stretch(layer: &Layer, comp_timescale: u32, comp_name: &str, col: &mut Collector) -> ((i32, u32), u32) {
+    let what = |s: &str| format!("{comp_name}: {s} '{}'", layer.name);
+    let mut stretch = (1i32, 1u32);
+    let mut time_scale = comp_timescale;
+    if layer.stretch.is_nan() || (layer.stretch - 100.0).abs() >= 1e-9 {
+        // A negative stretch is a time-reversed layer: the numerator is negative (981-983) and the
+        // properties count in the composition's time scale, as below 100 % (982, 983).
+        let r = layer.stretch / 100.0;
+        let reversed = r < 0.0;
+        let (n, d) = rational(r.abs());
+        let exact = r.is_finite() && r != 0.0 && (f64::from(n) / f64::from(d) - r.abs()).abs() <= 1e-9 * r.abs();
+        let ts = if n >= d && !reversed { u64::from(comp_timescale) * u64::from(n) / u64::from(d) } else { u64::from(comp_timescale) };
+        let ts_exact = n < d || reversed || (u64::from(comp_timescale) * u64::from(n)) % u64::from(d) == 0;
+        let num = i32::try_from(n).ok().map(|n| if reversed { -n } else { n });
+        match num {
+            Some(num) if exact && ts_exact && ts <= u64::from(u32::MAX) => {
+                if has_bezier_keys(&layer.props, 0) {
+                    col.lose(
+                        LossCategory::ApproximatedKeyframes,
+                        what(&format!(
+                            "bezier ease on a {:.2} % stretched layer (its speed unit there is not sampled; written as stored) on layer",
+                            layer.stretch
+                        )),
+                    );
+                }
+                stretch = (num, d);
+                time_scale = u32::try_from(ts).unwrap_or(comp_timescale);
+            }
+            _ => col.lose(LossCategory::TimeStretch, what(&format!("stretch {:.2} % (not an exact small ratio) on layer", layer.stretch))),
+        }
+    }
+    (stretch, time_scale)
+}
+
+/// The Transform properties of a layer that are written.
+fn plan_transform(layer: &Layer, src: &LayerSrc, comp: &Comp, source_size: (u32, u32), cp: &CompPlan, comp_name: &str, col: &mut Collector) -> Vec<PropPlan> {
+    let is_text = matches!(src, LayerSrc::Text(_));
+    let cam_light = matches!(src, LayerSrc::Camera(_) | LayerSrc::Light(_));
+    let is_shape = matches!(src, LayerSrc::Shape(_));
+    let mut props = Vec::new();
+    let at = PropAt { comp, comp_name, layer: &layer.name, source: source_size, text: is_text || cam_light || is_shape, null: matches!(src, LayerSrc::Null) };
+    if let Some(tr) = layer.transform() {
+        for kind in PropKind::ALL {
+            // A camera's or light's point of interest is After Effects' Anchor Point.
+            let id = if cam_light && kind == PropKind::Anchor { "poi" } else { kind.id() };
+            let Some(p) = tr.get(id) else { continue };
+            if let Some(pp) = plan_prop(kind, None, p, at, cp, col) {
+                col.exported.properties += 1;
+                props.push(pp);
+            }
+        }
+        // A camera's or light's block holds After Effects' own Position and point of interest:
+        // a value at EffectCraft's default is written too.
+        if cam_light {
+            for (kind, id) in [(PropKind::Position, "position"), (PropKind::Anchor, "poi")] {
+                if props.iter().any(|p: &PropPlan| p.kind == kind) {
+                    continue;
+                }
+                if let Some(effectcraft_keyframe::Value::Vec3(v)) = tr.get(id).map(|p| &p.value) {
+                    let value: Vec<f64> = v.iter().map(|c| if c.is_finite() { *c } else { 0.0 }).collect();
+                    props.push(PropPlan { kind, value, keys: Vec::new(), expr: None });
+                    col.exported.properties += 1;
+                }
+            }
+        }
+        for node in &tr.children {
+            let id = node.match_id();
+            if PropKind::ALL.iter().any(|k| k.id() == id) || (cam_light && id == "poi") {
+                continue;
+            }
+            if let Some(p) = node.as_prop()
+                && is_non_default_extra(id, p)
+            {
+                col.lose(LossCategory::TransformProperties, format!("{comp_name}: '{}' {}", layer.name, p.name));
+            }
+        }
+    }
+    props
+}
+
+/// The composition a layer is planned in.
+#[derive(Clone, Copy)]
+struct CompAt<'a> {
+    id: ItemId,
+    name: &'a str,
+    comp: &'a Comp,
+    /// The ids of its layers.
+    ids: &'a HashSet<LayerId>,
+}
+
+/// A time relative to the layer start (composition units) in source time: divided by the
+/// stretch `n / d`. A result between two units is rounded, one beyond the format's range is
+/// written as the nearest limit; both are reported.
+fn unstretch(rel: i64, stretch: (i32, u32), what: &str, col: &mut Collector) -> i32 {
+    let v = if stretch == (1, 1) { rel as f64 } else { (rel as f64) * f64::from(stretch.1) / f64::from(stretch.0) };
+    let r = v.round();
+    if r != v {
+        col.lose(LossCategory::RoundedTimes, format!("{what}: rounded to the time base after the time stretch"));
+    }
+    let lim = r.clamp(f64::from(i32::MIN), f64::from(i32::MAX));
+    if lim != r {
+        col.lose(LossCategory::LayerTiming, format!("{what}: beyond the range the format holds, written as the nearest limit"));
+    }
+    lim as i32
+}
+
+/// The ease written for slot `i` of a key side: the slot's, else the last one. A side without an
+/// ease is the first key's incoming or the last key's outgoing side, which no interpolation uses
+/// (the importer clears them); After Effects' 33.33 % is written there.
+pub(crate) fn key_ease(eases: &[Ease], i: usize) -> Ease {
+    eases.get(i).or(eases.last()).copied().unwrap_or(Ease { speed: 0.0, influence: 1.0 / 3.0 })
+}
+
+/// Reports a key speed or spatial tangent beyond the format's range (written as 0).
+pub(crate) fn report_beyond(beyond: bool, what: &str, col: &mut Collector) {
+    if beyond {
+        col.lose(LossCategory::InvalidValues, format!("{what}: a key speed or spatial tangent beyond {LIMIT} is written as 0"));
+    }
+}
+
+/// Reports keys whose evaluation the format does not keep: muted keys (written as active keys) and
+/// auto-Bezier keys (written with their stored ease, not the slope EffectCraft computes).
+fn report_key_flags(layer: &Layer, what: &str, col: &mut Collector) {
+    layer.props.walk("", &mut |_, p| {
+        if p.keys.iter().any(|k| k.muted) {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: '{}': a muted key is written as an active key", p.name));
+        }
+        let n = p.keys.len();
+        let bezier = |k: &Keyframe| k.in_interp == Interp::Bezier || k.out_interp == Interp::Bezier;
+        if p.keys.iter().enumerate().any(|(i, k)| k.auto_bezier && bezier(k) && i > 0 && i + 1 < n) {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: '{}': an auto-Bezier key is written with its stored ease", p.name));
+        }
+    });
+}
+
+fn plan_layer(cx: &PlanCx<'_>, at: CompAt<'_>, cp: &CompPlan, layer: &Layer, col: &mut Collector) -> Option<LayerPlan> {
+    let CompAt { id: comp_id, name: comp_name, comp, ids } = at;
+    let what = |s: &str| format!("{comp_name}: {s} '{}'", layer.name);
+    // An enabled Time Remap (the importer's `timeRemap` property) is written on precomposition
+    // and footage layers, the layers After Effects can remap (319, 354; a solid cannot).
+    let remap_prop = layer.props.prop("timeRemap");
+    let remappable = matches!(layer.source, LayerSource::Comp { .. } | LayerSource::Footage { .. });
+    if remap_prop.is_some() && !remappable {
+        col.lose(LossCategory::TimeRemapping, what("time remapping on a layer After Effects cannot remap is not written; layer"));
+    }
+    let remapped = remap_prop.is_some() && remappable;
+    let (mut src, source_size) = plan_source(cx, comp_id, comp_name, comp, layer, remapped, col)?;
+    report_key_flags(layer, &format!("{comp_name}: '{}'", layer.name), col);
+    let tb = cp.tb;
+    let mut rounded = false;
+    let mut units = |t: Tick, col: &mut Collector, what: &str| -> i32 {
+        let (u, inexact) = tb.units(t);
+        rounded |= inexact;
+        i32::try_from(u).unwrap_or_else(|_| {
+            col.lose(LossCategory::InvalidValues, format!("{comp_name}: '{}' {what} is out of range, written as 0", layer.name));
+            0
+        })
+    };
+    let start = units(layer.start_time, col, "start time");
+    let in_abs = units(layer.in_point, col, "in point");
+    let out_abs = units(layer.out_point, col, "out point");
+    if rounded {
+        col.lose(LossCategory::RoundedTimes, what("start, in or out point moved to the time base; layer"));
+    }
+    // Time stretch: the exact ratio `ldta@8 / @108` (018 200 %: 2 / 1, 316 50 %: 1 / 2, 317 150 %:
+    // 3 / 2); in and out points relative to the start are in source time (absolute = start +
+    // relative x stretch), and the layer's properties count in the composition's time scale x
+    // stretch for a stretch of 100 % or more, in the composition's below (018, 317: 51 200 and
+    // 38 400; 316: 25 600). Keys count source time in that time scale (641: 200 %, a key at comp
+    // 1 s = source 0.5 s stored as 25 600 / 51 200; 642: 50 %, comp 1 s = source 2 s stored as
+    // 51 200 / 25 600; 643: the same with the layer starting at 1 s), which is EffectCraft's layer
+    // time in the layer's time scale.
+    let (stretch, time_scale) = plan_stretch(layer, cp.tb.timescale, comp_name, col);
+    // In and out points relative to the start, in source time (reversed, 981: After Effects' in
+    // point is the later end, source 0 at the start).
+    let (first, last) = if stretch.0 < 0 { (out_abs, in_abs) } else { (in_abs, out_abs) };
+    let in_rel = unstretch(i64::from(first) - i64::from(start), stretch, &what("in point; layer"), col);
+    let out_rel = unstretch(i64::from(last) - i64::from(start), stretch, &what("out point; layer"), col);
+
+    // The layer's properties count in its own time scale (keys in source time units).
+    let layer_cp;
+    let cp: &CompPlan = if time_scale == cp.tb.timescale {
+        cp
+    } else {
+        layer_cp = CompPlan { tb: TimeBase { timescale: time_scale, ..cp.tb }, layers: Vec::new(), ..comp_header(cp) };
+        &layer_cp
+    };
+
+    if let LayerSrc::Shape(items) = &mut src
+        && let Some(c) = layer.props.sub("contents")
+    {
+        let mut sx = crate::export::shapes::ShCx { cp, col };
+        *items = crate::export::shapes::plan_contents(c, &what("shape layer"), 0, &mut sx);
+    }
+    // Text animators count their keys in the layer's time base too.
+    if let LayerSrc::Text(tp) = &mut src {
+        tp.animators = crate::export::textanim::plan(layer, cp, &format!("{comp_name}: '{}'", layer.name), col);
+    }
+
+    // Switches and features that are not written.
+    let sw = &layer.switches;
+    let unwritten = [
+        (sw.quality == Quality::Wireframe, "Wireframe quality (written as Best)"),
+        (sw.sampling != effectcraft_project::Sampling::Bilinear, "Bicubic sampling (written as Bilinear)"),
+        (sw.frame_blend != effectcraft_project::FrameBlend::Off, "frame blending"),
+        (layer.preserve_transparency, "Preserve Transparency"),
+        (layer.auto_orient != effectcraft_project::AutoOrient::Off && !matches!(src, LayerSrc::Camera(_) | LayerSrc::Light(_)), "Auto-Orient"),
+        (layer.environment || layer.environment_background, "the environment layer setting"),
+        (layer.markers_locked, "Lock Markers"),
+    ];
+    for (_, what_lost) in unwritten.iter().filter(|(on, _)| *on) {
+        col.lose(LossCategory::LayerSwitches, what(&format!("{what_lost} is not written; layer")));
+    }
+    // The 3D switch is written (`ldta@38` bit 0x04, 015); a 3D layer's material options are not
+    // (reported below when changed), and its X / Y rotation and orientation are reported too.
+    let per_char_3d = matches!(layer.props.prop("text/perChar3d").map(|p| &p.value), Some(effectcraft_keyframe::Value::Bool(true)));
+    if layer.switches.three_d && matches!(src, LayerSrc::Text(_)) && per_char_3d {
+        col.lose(LossCategory::ThreeD, what("per-character 3D of the text layer is not written; 3D layer"));
+    }
+    // Material Options change how a 3D layer takes lights and shadows; they are not written, so a
+    // value other than After Effects' default, a key or an expression is reported (review
+    // finding). On a 2D layer they have no effect.
+    if layer.switches.three_d {
+        for name in changed_material_options(layer) {
+            col.lose(LossCategory::ThreeD, what(&format!("the material option {name} is not written; 3D layer")));
+        }
+    }
+    // Track matte (403-408): the mode and the matte layer's id; a matte layer that is not
+    // exported (or the layer itself) is reported in `resolve_mattes`.
+    let matte = layer.track_matte.map(|tm| {
+        let mode = match tm.kind {
+            effectcraft_project::MatteKind::Alpha => 1,
+            effectcraft_project::MatteKind::AlphaInverted => 2,
+            effectcraft_project::MatteKind::Luma => 3,
+            effectcraft_project::MatteKind::LumaInverted => 4,
+        };
+        (tm.layer, mode)
+    });
+    // Layer markers count layer time in the layer's units, as its keys do.
+    let markers = crate::export::markers::plan(&layer.markers, &cp.tb, &what("layer"), col);
+    let fx = crate::export::effects::plan_effects(layer, source_size, cp, comp_name, col);
+    let styles = crate::export::styles::plan_styles(layer, comp, cp, &format!("{comp_name}: '{}'", layer.name), col);
+    let is_text = matches!(src, LayerSrc::Text(_));
+    let cam_light = matches!(src, LayerSrc::Camera(_) | LayerSrc::Light(_));
+    let is_shape = matches!(src, LayerSrc::Shape(_));
+    let masks = if is_text || is_shape {
+        let n = layer.masks().map_or(0, |m| m.groups().count());
+        if n > 0 {
+            let kind = if is_text { "text" } else { "shape" };
+            col.lose(LossCategory::Masks, what(&format!("{n} mask(s) on a {kind} layer (the path unit on {kind} layers is not verified) on")));
+        }
+        Vec::new()
+    } else {
+        crate::export::masks::plan_masks(layer, source_size, cp, comp_name, col)
+    };
+    let blend = match blend_code(layer.blend_mode) {
+        Some(c) => c,
+        None => {
+            col.lose(LossCategory::BlendModes, what(&format!("blend mode {} on", layer.blend_mode.label())));
+            2
+        }
+    };
+    let parent = layer.parent.filter(|p| ids.contains(p));
+    if layer.parent.is_some() && parent.is_none() {
+        col.lose(LossCategory::ParentLinks, what("a parent that is not a layer of this composition, written without it, on"));
+    }
+
+    let props = plan_transform(layer, &src, comp, source_size, cp, comp_name, col);
+    let remap = remap_prop.filter(|_| remapped).map(|p| plan_remap(p, comp, cp, &layer.name, comp_name, col));
+    let mut name = cut_name(&layer.name, 255, &what("layer"), col);
+    // A text layer named after its text stores no name (110, 113: After Effects shows the text):
+    // the layer's own rule decides (#3233).
+    if let LayerSrc::Text(tp) = &src
+        && layer.name_follows_text(&effectcraft_project::text_layer_name(&tp.text))
+    {
+        name.clear();
+    }
+    col.exported.layers += 1;
+    match (&src, layer.switches.adjustment) {
+        (LayerSrc::Null, _) => col.exported.null_layers += 1,
+        (LayerSrc::Comp(_), _) => col.exported.precomp_layers += 1,
+        (LayerSrc::Footage(_), _) => col.exported.footage_layers += 1,
+        (LayerSrc::Text(_), _) => col.exported.text_layers += 1,
+        (LayerSrc::Camera(_), _) => col.exported.cameras += 1,
+        (LayerSrc::Light(_), _) => col.exported.lights += 1,
+        (LayerSrc::Shape(_), _) => col.exported.shape_layers += 1,
+        (_, true) => col.exported.adjustment_layers += 1,
+        _ => col.exported.solid_layers += 1,
+    }
+    Some(LayerPlan {
+        name,
+        src,
+        adjustment: layer.switches.adjustment,
+        label: label_index(layer.label),
+        quality: if layer.switches.quality == Quality::Draft { 1 } else { 2 },
+        start,
+        in_rel,
+        out_rel,
+        stretch,
+        time_scale,
+        blend,
+        parent,
+        matte,
+        markers,
+        ec_id: layer.id,
+        video: layer.switches.video,
+        audio: layer.switches.audio,
+        solo: layer.switches.solo,
+        locked: layer.switches.locked,
+        shy: layer.switches.shy,
+        collapse: layer.switches.collapse || is_shape,
+        effects: layer.switches.effects,
+        motion_blur: layer.switches.motion_blur,
+        guide: layer.switches.guide,
+        three_d: layer.switches.three_d || cam_light,
+        props,
+        masks,
+        fx,
+        source_size,
+        remap,
+        styles,
+    })
+}
+
+/// Whether any property below `g` has keyframes.
+/// Whether a property of the group has a key with a bezier side.
+fn has_bezier_keys(g: &effectcraft_project::PropGroup, depth: usize) -> bool {
+    if depth > 64 {
+        return true;
+    }
+    g.children.iter().any(|n| match n {
+        effectcraft_project::Node::Group(s) => has_bezier_keys(s, depth + 1),
+        effectcraft_project::Node::Prop(p) => {
+            p.keys.iter().any(|k| k.in_interp == effectcraft_keyframe::Interp::Bezier || k.out_interp == effectcraft_keyframe::Interp::Bezier)
+        }
+    })
+}
+
+/// Whether showing the composition `to` inside `from` closes a loop (`to` is `from`, or uses it
+/// through its own precomposition layers). The walk is iterative and visits each item once.
+fn precomp_loop(project: &Project, from: ItemId, to: ItemId) -> bool {
+    let mut seen: HashSet<ItemId> = HashSet::new();
+    let mut stack = vec![to];
+    while let Some(at) = stack.pop() {
+        if at == from {
+            return true;
+        }
+        if !seen.insert(at) {
+            continue;
+        }
+        if let Some(ItemKind::Comp(c)) = project.item(at).map(|i| &i.kind) {
+            for l in &c.layers {
+                if let LayerSource::Comp { item } = &l.source {
+                    stack.push(*item);
+                }
+            }
+        }
+    }
+    false
+}
+
+/// The names of a layer's Material Options that differ from a new layer's (value, keys or an
+/// expression); a property EffectCraft's defaults do not list counts as changed.
+fn changed_material_options(layer: &Layer) -> Vec<String> {
+    let Some(g) = layer.props.sub("materialOptions") else { return Vec::new() };
+    let mut next = 0;
+    let defaults = effectcraft_project::build::material_options(&mut effectcraft_project::build::Ids(&mut next));
+    g.props()
+        .filter(|p| !p.keys.is_empty() || p.has_expression() || defaults.props().find(|d| d.match_id == p.match_id).is_none_or(|d| d.value != p.value))
+        .map(|p| p.name.clone())
+        .collect()
+}
+
+/// Whether a transform property outside the five carries something (a keyed or changed value).
+fn is_non_default_extra(id: &str, p: &Property) -> bool {
+    if !p.keys.is_empty() || p.has_expression() {
+        return true;
+    }
+    let comps = p.value.components();
+    match id {
+        "orientation" | "rotation_x" | "rotation_y" | "x_rotation" | "y_rotation" | "orient" => comps.iter().any(|c| c.abs() > 1e-9),
+        _ => false,
+    }
+}
+
+/// The layer a Transform property belongs to.
+#[derive(Clone, Copy)]
+struct PropAt<'a> {
+    comp: &'a Comp,
+    comp_name: &'a str,
+    layer: &'a str,
+    /// The layer's source size.
+    source: (u32, u32),
+    /// The anchor is stored in pixels (text, camera, light and shape layers).
+    text: bool,
+    /// A null layer: an Anchor Point that is not written is its top-left corner (#3099).
+    null: bool,
+}
+
+/// What is written for transform property `p` (`kind`) of a layer: its value or keys in the
+/// stored unit and its expression; `None` when it is at After Effects' default and has neither.
+fn plan_prop(kind: PropKind, label: Option<&str>, p: &Property, at: PropAt<'_>, cp: &CompPlan, col: &mut Collector) -> Option<PropPlan> {
+    let PropAt { comp, comp_name, layer, source, text, null } = at;
+    // A text layer's anchor is stored in pixels, with the origin as its default (385).
+    let (sw, sh) = if text { (1.0, 1.0) } else { (f64::from(source.0.max(1)), f64::from(source.1.max(1))) };
+    let what = format!("{comp_name}: '{layer}' {}", label.unwrap_or(kind.match_name()));
+    let dims = kind.dims();
+    let default: Vec<f64> = match kind {
+        // After Effects 2026 reads a null's absent Anchor Point as `[0, 0]` (#3099).
+        PropKind::Anchor if text || null => vec![0.0, 0.0, 0.0],
+        PropKind::Anchor => vec![0.5, 0.5, 0.0],
+        PropKind::Position => vec![f64::from(comp.width) / 2.0, f64::from(comp.height) / 2.0, 0.0],
+        PropKind::Scale => vec![1.0, 1.0, 1.0],
+        PropKind::Rotation => vec![0.0],
+        PropKind::Opacity => vec![1.0],
+    };
+    // The project's value in the stored unit.
+    let to_file = |c: &[f64], what: &str, col: &mut Collector| -> Vec<f64> {
+        let mut out = Vec::with_capacity(dims);
+        for i in 0..dims {
+            let raw = c.get(i).copied();
+            let fallback = if kind == PropKind::Scale { 100.0 } else { 0.0 };
+            let v = raw.and_then(sane).or(if raw.is_none() { Some(fallback) } else { None });
+            let v = match v {
+                Some(v) => v,
+                None => {
+                    col.lose(LossCategory::InvalidValues, format!("{what}: a value that is not a valid number, the default was written"));
+                    default.get(i).copied().map(|d| d * kind.unit()).unwrap_or(0.0)
+                }
+            };
+            let stored = match kind {
+                PropKind::Anchor => match i {
+                    0 => v / sw,
+                    1 => v / sh,
+                    _ => v,
+                },
+                PropKind::Scale | PropKind::Opacity => v / 100.0,
+                _ => v,
+            };
+            out.push(stored);
+        }
+        out
+    };
+    let static_value = to_file(&p.value.components(), &what, col);
+    let expr = p.expr.as_ref().filter(|e| !e.text.is_empty()).map(|e| (e.text.clone(), e.enabled));
+    if expr.is_some() {
+        col.exported.expressions += 1;
+    }
+    let is_default = static_value.iter().zip(&default).all(|(a, b)| (a - b).abs() < 1e-12);
+    if p.keys.is_empty() {
+        if is_default && expr.is_none() {
+            return None;
+        }
+        return Some(PropPlan { kind, value: static_value, keys: Vec::new(), expr });
+    }
+    // Keys, sorted and unique in time units.
+    let mut keys: Vec<(i64, &Keyframe)> = Vec::with_capacity(p.keys.len());
+    for k in &p.keys {
+        let (u, inexact) = cp.tb.units(k.time);
+        if inexact {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: key at {:.4} s moved to the time base", k.time.seconds()));
+        }
+        keys.push((u, k));
+    }
+    keys.sort_by_key(|(u, _)| *u);
+    let before = keys.len();
+    keys.dedup_by_key(|(u, _)| *u);
+    if keys.len() != before {
+        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: keys at the same time were merged"));
+    }
+    let anchor = kind == PropKind::Anchor;
+    let mut plans = Vec::with_capacity(keys.len());
+    let all: Vec<Keyframe> = keys.iter().map(|(_, k)| (*k).clone()).collect();
+    let beyond = std::cell::Cell::new(false);
+    for (i, (u, k)) in keys.iter().enumerate() {
+        let Ok(time) = i32::try_from(*u) else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: key time out of range, key dropped"));
+            continue;
+        };
+        let value = to_file(&k.value.components(), &what, col);
+        let side = |interp: Interp| -> u8 {
+            match interp {
+                Interp::Linear => 1,
+                Interp::Hold => 3,
+                Interp::Bezier => 2,
+            }
+        };
+        let in_i = side(k.in_interp);
+        let out_i = side(k.out_interp);
+        let slots = if kind.spatial() || dims == 1 { 1 } else { dims };
+        let ease_of = |eases: &[Ease], i: usize| -> EaseSlot {
+            let e = key_ease(eases, i);
+            // An Anchor Point stored as a fraction of the source has its spatial speed in pixels
+            // per second over the source height (597, 730), as the importer reads it.
+            let per = if anchor { sh } else { 1.0 };
+            let speed = sane(e.speed / kind.unit() / per).unwrap_or_else(|| {
+                beyond.set(true);
+                0.0
+            });
+            let influence = if e.influence.is_finite() { e.influence.clamp(0.001, 1.0) } else { 1.0 / 3.0 };
+            EaseSlot { speed, influence }
+        };
+        let in_ease: Vec<EaseSlot> = (0..slots).map(|s| if in_i == 2 { ease_of(&k.in_ease, s) } else { EaseSlot::default() }).collect();
+        let out_ease: Vec<EaseSlot> = (0..slots).map(|s| if out_i == 2 { ease_of(&k.out_ease, s) } else { EaseSlot::default() }).collect();
+        let (mut tin, mut tout) = if kind.spatial() { effectcraft_keyframe::spatial_tangents(&all, i) } else { ([0.0; 3], [0.0; 3]) };
+        for t in tin.iter_mut().chain(tout.iter_mut()) {
+            if sane(*t).is_none() {
+                beyond.set(true);
+                *t = 0.0;
+            }
+        }
+        if anchor {
+            for t in [&mut tin, &mut tout] {
+                t[0] /= sw;
+                t[1] /= sh;
+            }
+        }
+        plans.push(KeyPlan {
+            time,
+            value,
+            in_interp: in_i,
+            out_interp: out_i,
+            in_ease,
+            out_ease,
+            spatial_in: tin,
+            spatial_out: tout,
+            spatial_auto: k.spatial_auto,
+            roving: k.roving,
+            label: k.label.min(16),
+        });
+        col.exported.keyframes += 1;
+    }
+    report_beyond(beyond.get(), &what, col);
+    if plans.is_empty() {
+        return None;
+    }
+    let value = plans.first().map(|k| k.value.clone()).unwrap_or(static_value);
+    Some(PropPlan { kind, value, keys: plans, expr })
+}
+
+/// The Time Remap in the file's terms: a one-component value in seconds, keys in layer time
+/// with the plain 48-byte records of a one-dimensional property (319, 354). An enabled remap
+/// without keys is written as one key at layer time 0 holding its value: After Effects reads a
+/// remap record without keys as switched off (r1, "Freeze": `tdsb` 1 with a static value came
+/// back disabled).
+fn plan_remap(p: &Property, comp: &Comp, cp: &CompPlan, layer: &str, comp_name: &str, col: &mut Collector) -> PropPlan {
+    // Rotation has the same layout (one component, stored as is, not spatial).
+    let at = PropAt { comp, comp_name, layer, source: (1, 1), text: false, null: false };
+    let planned = plan_prop(PropKind::Rotation, Some("Time Remap"), p, at, cp, col);
+    col.exported.time_remaps += 1;
+    let mut plan = planned.unwrap_or_else(|| PropPlan { kind: PropKind::Rotation, value: vec![0.0], keys: Vec::new(), expr: None });
+    if plan.keys.is_empty() {
+        plan.keys.push(KeyPlan {
+            time: 0,
+            value: plan.value.clone(),
+            in_interp: 1,
+            out_interp: 1,
+            in_ease: vec![EaseSlot::default()],
+            out_ease: vec![EaseSlot::default()],
+            spatial_in: [0.0; 3],
+            spatial_out: [0.0; 3],
+            spatial_auto: false,
+            roving: false,
+            label: 0,
+        });
+        col.exported.keyframes += 1;
+    }
+    plan
+}
diff --git a/crates/aep/src/export/report.rs b/crates/aep/src/export/report.rs
new file mode 100644
index 000000000..7caba0e7d
--- /dev/null
+++ b/crates/aep/src/export/report.rs
@@ -0,0 +1,268 @@
+//! The export report: what was written (counts) and everything that was not, per category.
+//!
+//! Plain data (`serde`), so it round-trips through JSON: the engine command returns it and agents
+//! read it. Nothing the exporter leaves out is missing from it.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+
+/// Most example lines kept per loss category (the count is always exact).
+pub const MAX_DETAILS: usize = 20;
+
+/// Why a piece of the project did not arrive in the `.aep`, or arrived changed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum LossCategory {
+    /// Effects on layers that are not written (not in the table, a parameter
+    /// without a counterpart, an expression on a parameter).
+    Effects,
+    /// Mask data that is not written: a disabled mask or one without a usable path, keys on Mask
+    /// Opacity or Expansion, expressions on mask properties, the lock, mask motion blur other than
+    /// Same As Layer, Linear feather falloff, RotoBezier and variable-width feather points.
+    Masks,
+    /// Layer and composition markers.
+    Markers,
+    /// Text layer features that are not written (animators, Source Text keys, strokes, ...), and
+    /// text layers without a text document.
+    TextLayers,
+    /// Shape layer contents that are not written.
+    ShapeLayers,
+    /// Camera settings that are not written, Auto-Orient Along Path or Towards Camera included.
+    Cameras,
+    /// Light settings that are not written, a spot light not oriented towards its point of
+    /// interest included.
+    Lights,
+    /// 3D model and primitive layers (skipped as a whole).
+    ModelLayers,
+    /// Footage items that are not written (a file type without a prototype, a layered file's
+    /// layer, a sequence with gaps or at a fractional rate), and items in a folder loop.
+    FootageItems,
+    /// Layers whose source is not exported (footage that is not written, a precomposition that is
+    /// missing or closes a loop, other).
+    UnsupportedLayers,
+    /// Blend modes After Effects has no code for (written as Normal).
+    BlendModes,
+    /// Track mattes.
+    TrackMattes,
+    /// 3D features that are not written (per-character 3D of a text layer, Material Options other
+    /// than the defaults; the layer's 3D switch itself is written).
+    ThreeD,
+    /// A time stretch that is not an exact small ratio (the layer is written unstretched).
+    TimeStretch,
+    /// Transform properties other than Anchor Point, Position, Scale, Rotation and Opacity.
+    TransformProperties,
+    /// Expression on a property that is not exported.
+    Expressions,
+    /// Keyframes written in a simpler form (see the detail lines).
+    ApproximatedKeyframes,
+    /// A value that is not a finite number or beyond the range of the format (default written).
+    InvalidValues,
+    /// Frame rate that the format cannot hold exactly, composition size or duration out of range.
+    CompositionSettings,
+    /// Parent links to a layer that was not exported.
+    ParentLinks,
+    /// Times rounded to the composition's time base.
+    RoundedTimes,
+    /// Composition options that are not exported (guides, essential graphics, advanced renderer),
+    /// and settings that change rendered frames but are written at After Effects' defaults:
+    /// Preserve Frame Rate or Preserve Resolution switched on, motion blur samples per frame and
+    /// adaptive sample limit other than 16 and 128.
+    CompositionOptions,
+    /// Names longer than the format's name field (the name is kept in full where verified), and
+    /// item comments (not written).
+    Names,
+    /// Layer timing After Effects does not keep: a layer of a clip, sequence or sound that runs
+    /// past the end of its source (After Effects ends it there).
+    LayerTiming,
+    /// Project settings that are not written: a working space other than None, sRGB and Rec.709
+    /// Gamma 2.4, the OCIO
+    /// colour engine, HDR handling and output space, a frame count start other than 0 and 1.
+    ProjectSettings,
+    /// Time remapping on a layer After Effects cannot remap (a solid, a text): not written.
+    TimeRemapping,
+    /// Layer-style data that is not written: a style or Layer Styles switched off, edited
+    /// gradients, keys on colours, points, popups and checkboxes, Knockout.
+    LayerStyles,
+    /// Layer switches and options that are not written: Wireframe quality, Bicubic sampling,
+    /// frame blending, Preserve Transparency, Auto-Orient on a layer other than a camera or light
+    /// (theirs is reported as [`Cameras`](Self::Cameras) / [`Lights`](Self::Lights)), an
+    /// environment layer, locked markers.
+    LayerSwitches,
+    /// Render queue items (the render queue is not written).
+    RenderQueue,
+}
+
+impl LossCategory {
+    /// A short readable name.
+    pub fn label(self) -> &'static str {
+        match self {
+            LossCategory::Effects => "effects",
+            LossCategory::Masks => "masks",
+            LossCategory::Markers => "markers",
+            LossCategory::TextLayers => "text layers",
+            LossCategory::ShapeLayers => "shape layers",
+            LossCategory::Cameras => "cameras",
+            LossCategory::Lights => "lights",
+            LossCategory::ModelLayers => "3D model layers",
+            LossCategory::FootageItems => "footage items",
+            LossCategory::UnsupportedLayers => "unsupported layers",
+            LossCategory::BlendModes => "blend modes",
+            LossCategory::TrackMattes => "track mattes",
+            LossCategory::ThreeD => "3D layers",
+            LossCategory::TimeStretch => "time stretch",
+            LossCategory::TransformProperties => "transform properties",
+            LossCategory::Expressions => "expressions",
+            LossCategory::ApproximatedKeyframes => "approximated keyframes",
+            LossCategory::InvalidValues => "invalid values",
+            LossCategory::CompositionSettings => "composition settings",
+            LossCategory::ParentLinks => "parent links",
+            LossCategory::RoundedTimes => "rounded times",
+            LossCategory::CompositionOptions => "composition options",
+            LossCategory::Names => "names",
+            LossCategory::LayerTiming => "layer timing",
+            LossCategory::ProjectSettings => "project settings",
+            LossCategory::TimeRemapping => "time remapping",
+            LossCategory::LayerStyles => "layer styles",
+            LossCategory::LayerSwitches => "layer switches",
+            LossCategory::RenderQueue => "render queue",
+        }
+    }
+}
+
+/// One category of things that were not exported.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Loss {
+    pub category: LossCategory,
+    /// How many occurrences (exact).
+    pub count: usize,
+    /// Up to [`MAX_DETAILS`] example lines.
+    pub details: Vec<String>,
+}
+
+/// What was written to the file.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Exported {
+    pub folders: usize,
+    pub compositions: usize,
+    pub solids: usize,
+    /// All layers.
+    pub layers: usize,
+    pub solid_layers: usize,
+    pub null_layers: usize,
+    pub adjustment_layers: usize,
+    /// Transform properties written with a value that differs from the default.
+    pub properties: usize,
+    /// Keyframes written.
+    pub keyframes: usize,
+    /// Expressions written (source text and enable switch).
+    pub expressions: usize,
+    /// Layer masks written.
+    #[serde(default)]
+    pub masks: usize,
+    /// Precomposition layers (a composition shown as a layer).
+    #[serde(default)]
+    pub precomp_layers: usize,
+    /// Effect instances written.
+    #[serde(default)]
+    pub effects: usize,
+    /// Footage items (files) written.
+    #[serde(default)]
+    pub footage: usize,
+    /// Footage layers written.
+    #[serde(default)]
+    pub footage_layers: usize,
+    /// Text layers written.
+    #[serde(default)]
+    pub text_layers: usize,
+    /// Layer and composition markers written.
+    #[serde(default)]
+    pub markers: usize,
+    /// Camera layers written.
+    #[serde(default)]
+    pub cameras: usize,
+    /// Light layers written.
+    #[serde(default)]
+    pub lights: usize,
+    /// Shape layers written.
+    #[serde(default)]
+    pub shape_layers: usize,
+    /// Layers written with an enabled Time Remap.
+    #[serde(default)]
+    pub time_remaps: usize,
+    /// Text animators written.
+    #[serde(default)]
+    pub text_animators: usize,
+    /// Layer styles written (one per style on a layer).
+    #[serde(default)]
+    pub layer_styles: usize,
+}
+
+/// Standing limitations of the exporter (what it cannot write at all), listed in every report.
+pub const LIMITATIONS: &[&str] = &[
+    "The render queue (its items are reported), render templates and project settings other than colour depth, working space (None, sRGB or Rec.709 Gamma 2.4), working gamma, the two linear-light switches, time display and frame count start are not exported.",
+    "Composition options other than size, frame rate, duration, work area, background, pixel aspect, shutter, motion blur switch and display start are written at After Effects' defaults: other values of preserve frame rate, preserve resolution, motion blur samples and adaptive sample limit are reported; draft 3D, hide shy, the viewer resolution, the poster time and the composition's frame blending switch (layer frame blending is reported, and no layer blends without it) are not exported. The background is stored with 8 bits per channel.",
+    "Footage is linked, not embedded: png, jpeg, OpenEXR, TIFF, Targa, Photoshop, Illustrator and EPS stills, png, OpenEXR and jpeg sequences, mp4 and mov clips and WAV audio are written with their path, size, duration and frame rate (a conformed clip rate too); the rest of their interpretation (alpha, colour management, fields, loops) is the default.",
+    "Layer comments, a 3D layer's X / Y rotation, orientation and material options (each reported when it is not at its default), parallel and ambient lights, and shape items outside groups, rectangles, ellipses, polystars, paths, fills, strokes, gradients, trim paths, round corners, merge and offset paths and repeaters (wiggle, twist, zig-zag, pucker and bloat, ...) are not written.",
+    "Mask colours are not written: After Effects shows its own colour for every exported mask.",
+];
+
+/// The result of planning/writing an `.aep`: counts of what was written, the losses per category
+/// and the standing limitations of the exporter.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExportReport {
+    pub exported: Exported,
+    /// Only categories that occurred, in category order.
+    pub losses: Vec<Loss>,
+    pub limitations: Vec<String>,
+}
+
+impl ExportReport {
+    /// The sum of all loss counts.
+    pub fn total_losses(&self) -> usize {
+        self.losses.iter().map(|l| l.count).sum()
+    }
+
+    /// True when nothing was lost.
+    pub fn is_lossless(&self) -> bool {
+        self.losses.is_empty()
+    }
+
+    /// The loss count of a category.
+    pub fn count(&self, category: LossCategory) -> usize {
+        self.losses.iter().find(|l| l.category == category).map_or(0, |l| l.count)
+    }
+
+    /// `effects: 3, masks: 1` (empty when lossless).
+    pub fn summary(&self) -> String {
+        self.losses.iter().map(|l| format!("{}: {}", l.category.label(), l.count)).collect::<Vec<_>>().join(", ")
+    }
+}
+
+/// Collects losses while planning.
+#[derive(Default)]
+pub(crate) struct Collector {
+    pub exported: Exported,
+    losses: BTreeMap<LossCategory, Loss>,
+}
+
+impl Collector {
+    /// Records one loss.
+    pub fn lose(&mut self, category: LossCategory, detail: impl Into<String>) {
+        let loss = self.losses.entry(category).or_insert_with(|| Loss { category, count: 0, details: Vec::new() });
+        loss.count = loss.count.saturating_add(1);
+        if loss.details.len() < MAX_DETAILS {
+            loss.details.push(detail.into());
+        }
+    }
+
+    pub fn finish(self) -> ExportReport {
+        ExportReport {
+            exported: self.exported,
+            losses: self.losses.into_values().collect(),
+            limitations: LIMITATIONS.iter().map(|s| (*s).to_string()).collect(),
+        }
+    }
+}
diff --git a/crates/aep/src/export/settings.rs b/crates/aep/src/export/settings.rs
new file mode 100644
index 000000000..d3d7c7a1a
--- /dev/null
+++ b/crates/aep/src/export/settings.rs
@@ -0,0 +1,142 @@
+//! Project settings (`docs/aep-format.md` 3.12a, cases 620-634): colour depth, working space
+//! (None, sRGB or Rec.709 Gamma 2.4, with profiles authored here), working gamma, the two linear-light switches, time display and
+//! frame count start, written into the template's top-level chunks.
+
+use crate::{AepFile, Chunk};
+use effectcraft_color::ColorSpace;
+use effectcraft_project::{BitDepth, ColorEngine, HdrMode, ProjectSettings, TimeDisplayStyle};
+
+use crate::export::report::{Collector, LossCategory};
+use crate::export::tree::{R, data_mut, put_u8, tpl};
+
+/// The settings in the file's terms.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct SettingsPlan {
+    /// `nhed` byte 15: 0 / 1 / 2 for 8 / 16 / 32 bits per channel.
+    pub depth: u8,
+    /// No working space (623); otherwise sRGB unless `rec709`.
+    pub no_working_space: bool,
+    /// Rec.709 Gamma 2.4, written with a profile authored here (`icc.rs`, R49).
+    pub rec709: bool,
+    /// `dwga` byte 0: 1 for a working gamma of 2.4.
+    pub gamma_24: bool,
+    pub linearize: bool,
+    pub blend_linear: bool,
+    /// `nhed` bytes 8, 11, 13: frames, feet + frames, frames per foot.
+    pub frames: bool,
+    pub feet: Option<u8>,
+    /// `nhed` byte 14: 2 for a count from 0, 1 for a count from 1.
+    pub frame_start: u8,
+}
+
+pub(crate) fn plan(s: &ProjectSettings, col: &mut Collector) -> SettingsPlan {
+    let depth = match s.bit_depth {
+        BitDepth::Bpc8 => 0,
+        BitDepth::Bpc16 => 1,
+        BitDepth::Bpc32 => 2,
+    };
+    let (no_working_space, rec709) = match s.working_space {
+        None => (true, false),
+        Some(ColorSpace::Srgb) => (false, false),
+        Some(ColorSpace::Rec709) => (false, true),
+        Some(other) => {
+            col.lose(
+                LossCategory::ProjectSettings,
+                format!("the working space {other:?} is written as sRGB (only None, sRGB and Rec.709 Gamma 2.4 are written)"),
+            );
+            (false, false)
+        }
+    };
+    if s.color_engine != ColorEngine::Adobe {
+        col.lose(LossCategory::ProjectSettings, "the OCIO colour engine is not written".to_string());
+    }
+    if s.hdr != HdrMode::Clip {
+        col.lose(LossCategory::ProjectSettings, "the HDR handling is not written".to_string());
+    }
+    // After Effects renders in the working space (902): an output space equal to the working
+    // space is its normal case (the importer sets it so for Rec.709 Gamma 2.4); another one has
+    // no place in the file.
+    if s.output_space.is_some_and(|o| Some(o) != s.working_space) {
+        col.lose(LossCategory::ProjectSettings, "an output space other than the working space is not written".to_string());
+    }
+    let (frames, feet) = match s.time_display {
+        TimeDisplayStyle::Timecode => (false, None),
+        TimeDisplayStyle::Frames => (true, None),
+        TimeDisplayStyle::Feet35 => (true, Some(16)),
+        TimeDisplayStyle::Feet16 => (true, Some(40)),
+    };
+    let frame_start = match s.frame_start {
+        0 => 2,
+        1 => 1,
+        other => {
+            col.lose(LossCategory::ProjectSettings, format!("a frame count start of {other} is written as 0 (only 0 and 1 exist)"));
+            2
+        }
+    };
+    SettingsPlan {
+        depth,
+        no_working_space,
+        rec709,
+        gamma_24: s.working_gamma_24(),
+        linearize: s.linearize,
+        blend_linear: s.blend_linear,
+        frames,
+        feet,
+        frame_start,
+    }
+}
+
+/// Writes `p` into the template's top-level chunks.
+pub(crate) fn emit(file: &mut AepFile<'static>, p: &SettingsPlan) -> R<()> {
+    let top = &mut file.chunks;
+    let header =
+        |top: &mut Vec<Chunk<'static>>, id: &[u8; 4]| -> R<usize> { top.iter().position(|c| c.is(id)).ok_or_else(|| tpl("template header chunk missing")) };
+    // nhed and its copy nnhd (byte offsets per field: 620-634).
+    for (id, at_depth, at_display, at_feet, at_fpf, at_start) in [(b"nhed", 15, 8, 11, 13, 14), (b"nnhd", 24, 8, 11, 19, 20)] {
+        let i = header(top, id)?;
+        let d = data_mut(top.get_mut(i).ok_or_else(|| tpl("header"))?)?;
+        put_u8(d, at_depth, p.depth)?;
+        put_u8(d, at_display, u8::from(p.frames))?;
+        put_u8(d, at_feet, u8::from(p.feet.is_some()))?;
+        put_u8(d, at_fpf, p.feet.unwrap_or(16))?;
+        put_u8(d, at_start, p.frame_start)?;
+    }
+    {
+        let i = header(top, b"dwga")?;
+        put_u8(data_mut(top.get_mut(i).ok_or_else(|| tpl("dwga"))?)?, 0, u8::from(p.gamma_24))?;
+    }
+    // Blend Colors Using 1.0 Gamma (lnrb) and Linearize Working Space (lnrp): one-byte chunks
+    // right after cpid, in that order (626, 627, 632).
+    top.retain(|c| !c.is(b"lnrb") && !c.is(b"lnrp"));
+    let cpid = header(top, b"cpid")?;
+    let mut at = cpid.saturating_add(1);
+    if p.blend_linear {
+        top.insert(at, Chunk::data(*b"lnrb", vec![1u8]));
+        at = at.saturating_add(1);
+    }
+    if p.linearize {
+        top.insert(at, Chunk::data(*b"lnrp", vec![1u8]));
+    }
+    if !p.no_working_space {
+        // 620, 624: `cpid` is the profile ID, the JSON after PwCs holds the profile's data and the
+        // working space's name; the profiles are our own (R49).
+        let (icc, name) = if p.rec709 {
+            (crate::export::icc::rec709_gamma24(), crate::export::icc::REC709_NAME)
+        } else {
+            (crate::export::icc::srgb(), crate::export::icc::SRGB_NAME)
+        };
+        *top.get_mut(cpid).ok_or_else(|| tpl("cpid"))? = Chunk::data(*b"cpid", crate::export::icc::profile_id(&icc).to_vec());
+        let pw = header(top, b"PwCs")?;
+        let json = top.get_mut(pw.saturating_add(1)).filter(|c| c.is(b"Utf8")).ok_or_else(|| tpl("template without the working-space JSON"))?;
+        let text = crate::export::icc::profile_json(&icc, name);
+        *json = Chunk::data(*b"Utf8", text.into_bytes());
+    }
+    if p.no_working_space {
+        // 623: cpid all 0xff, the working-space JSON after PwCs is `{}`.
+        *top.get_mut(cpid).ok_or_else(|| tpl("cpid"))? = Chunk::data(*b"cpid", vec![0xffu8; 16]);
+        let pw = header(top, b"PwCs")?;
+        let json = top.get_mut(pw.saturating_add(1)).filter(|c| c.is(b"Utf8")).ok_or_else(|| tpl("template without the working-space JSON"))?;
+        *json = Chunk::data(*b"Utf8", b"{}".to_vec());
+    }
+    Ok(())
+}
diff --git a/crates/aep/src/export/shapes.rs b/crates/aep/src/export/shapes.rs
new file mode 100644
index 000000000..74cd49d5b
--- /dev/null
+++ b/crates/aep/src/export/shapes.rs
@@ -0,0 +1,827 @@
+//! Shape layers (`docs/aep-format.md` 3.9; cases 238-242, 451-471, 519, 707-710, 731, 851-857):
+//! groups (nested), rectangle, ellipse, polystar and freeform paths, fills, strokes, gradient
+//! fills and strokes, trim paths, round corners, merge paths, offset paths and repeaters, the
+//! group transform, with keys and expressions on their properties.
+//!
+//! The layer block is the shape layer of 519 with its contents removed; every item is the item
+//! of 519 or 731 (all at After Effects' defaults, no value records) or the path item of 240, and
+//! every property that differs from After Effects' default (or carries keys or an expression)
+//! gets a value record, in After Effects' order (a record only for a non-default value, P.5):
+//! sizes and positions in pixels relative to the layer, colours `[A, R, G, B]` 0..255,
+//! opacities, percentages and the group scale in percent, popups 1-based (fill rule 455, line
+//! cap / join 239, trim type 469, polystar type 331, merge type 707, offset line join 710),
+//! angles in degrees. A record is the record After Effects wrote for the property in a
+//! one-change case, else the record of its property's type (R46): over the corpus every shape
+//! value record of a type has the same bytes but for its match name, the time scale and, for
+//! sliders, the slider range in `tdum` / `tduM` (0..100 for every slider but Skew -85..85 and
+//! Highlight Length -100..100; sizes and scales -32 000..32 000). A keyed record clears `tdb4`
+//! bit 0 of byte 5, sets byte 68 and holds the key list (851-855, 857, 209): one-component and
+//! two-component sizes plain records (48 / 88 bytes), points spatial records (104 bytes),
+//! colours the colour records of effects (152 bytes). An expression is stored as on the
+//! Transform properties (856, R15).
+
+use crate::Chunk;
+use effectcraft_keyframe::{Gradient, Interp, Keyframe, Value};
+use effectcraft_project::{Node, PropGroup, Property};
+
+use crate::export::masks::ShapePlan;
+use crate::export::plan::{CompPlan, EaseSlot, KeyPlan};
+use crate::export::report::{Collector, LossCategory};
+use crate::export::tree::{R, child_data, kids_mut, list_mut, put, put_f64, put_u8, put_u16, put_u32, set_utf8, tpl};
+
+/// The deepest group nesting written.
+const MAX_DEPTH: usize = 16;
+
+/// A property's value in the file's units: the static value, the keys (layer time) and the
+/// expression with its enable switch.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct RecVal {
+    pub value: Vec<f64>,
+    pub keys: Vec<KeyPlan>,
+    pub expr: Option<(String, bool)>,
+}
+
+type Records = Vec<(&'static str, RecVal)>;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum ShItem {
+    Group {
+        name: String,
+        items: Vec<ShItem>,
+        transform: Records,
+    },
+    /// Any other item but a path: the item's match name, name, value records and the records of
+    /// its sub-groups (a repeater's transform).
+    Simple {
+        kind: &'static str,
+        name: String,
+        records: Records,
+        subs: Vec<(&'static str, Records)>,
+    },
+    Path {
+        name: String,
+        shape: ShapePlan,
+    },
+    /// An item switched off (its eye): written with bit 0 of its group's `tdsb` cleared.
+    Off(Box<ShItem>),
+}
+
+/// The prototypes, by match name.
+pub(crate) struct ShapeProtos {
+    /// The shape layer's block (519) with an empty `ADBE Root Vectors Group`.
+    pub block: Vec<Chunk<'static>>,
+    /// Item nodes (`tdmn` + node) at their defaults.
+    pub items: Vec<(String, [Chunk<'static>; 2])>,
+    /// Value records (`tdmn` + `tdbs`) by match name.
+    pub records: Vec<(String, [Chunk<'static>; 2])>,
+    /// The key list (`LIST list`) of a keyed property, whose header is rewritten.
+    pub key_list: Chunk<'static>,
+}
+
+/// How a shape property is stored.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Layout {
+    /// One component (sliders, angles, popups): plain keys of 48 bytes.
+    One,
+    /// A size or scale of two or three components: plain keys of 88 / 128 bytes.
+    Size,
+    /// A point: spatial keys of 104 bytes (853; 128 bytes for a 3D point).
+    Point,
+    /// A colour: the 152-byte colour keys (854).
+    Color,
+    /// A popup (keys not sampled).
+    Popup,
+}
+
+/// The record whose layout a property takes, the slider range its record repeats in `tdum` /
+/// `tduM` (R46), and the key layout.
+#[derive(Clone, Copy)]
+struct RecKind {
+    proto: &'static str,
+    range: Option<(f64, f64)>,
+    layout: Layout,
+}
+
+const SLIDER: RecKind = RecKind { proto: "ADBE Vector Fill Opacity", range: Some((0.0, 100.0)), layout: Layout::One };
+const ANGLE: RecKind = RecKind { proto: "ADBE Vector Rotation", range: None, layout: Layout::One };
+const POPUP: RecKind = RecKind { proto: "ADBE Vector Fill Rule", range: None, layout: Layout::Popup };
+const POINT: RecKind = RecKind { proto: "ADBE Vector Ellipse Position", range: None, layout: Layout::Point };
+const SIZE: RecKind = RecKind { proto: "ADBE Vector Scale", range: Some((-32_000.0, 32_000.0)), layout: Layout::Size };
+const COLOR: RecKind = RecKind { proto: "ADBE Vector Fill Color", range: None, layout: Layout::Color };
+
+/// Every property the exporter writes, in After Effects' order within an item (455, 464, 239,
+/// 331, 332, 828, 709), with its record type (sampled: 451-471, 238-242, 331, 332, 468, 469,
+/// 473-477, 707-710, 828; Offset Paths' Miter Limit, the Repeater's Offset, Composite, Anchor and
+/// Start Opacity are not sampled and take the type of their kind, E).
+const KINDS: &[(&str, RecKind)] = &[
+    ("ADBE Vector Rect Size", SIZE),
+    ("ADBE Vector Rect Position", POINT),
+    ("ADBE Vector Rect Roundness", SLIDER),
+    ("ADBE Vector Ellipse Size", SIZE),
+    ("ADBE Vector Ellipse Position", POINT),
+    ("ADBE Vector Star Type", POPUP),
+    ("ADBE Vector Star Points", SLIDER),
+    ("ADBE Vector Star Position", POINT),
+    ("ADBE Vector Star Rotation", ANGLE),
+    ("ADBE Vector Star Inner Radius", SLIDER),
+    ("ADBE Vector Star Outer Radius", SLIDER),
+    ("ADBE Vector Star Inner Roundess", SLIDER),
+    ("ADBE Vector Star Outer Roundess", SLIDER),
+    ("ADBE Vector Fill Rule", POPUP),
+    ("ADBE Vector Grad Type", POPUP),
+    ("ADBE Vector Grad Start Pt", POINT),
+    ("ADBE Vector Grad End Pt", POINT),
+    ("ADBE Vector Grad HiLite Length", RecKind { proto: "ADBE Vector Fill Opacity", range: Some((-100.0, 100.0)), layout: Layout::One }),
+    ("ADBE Vector Grad HiLite Angle", ANGLE),
+    ("ADBE Vector Fill Color", COLOR),
+    ("ADBE Vector Fill Opacity", SLIDER),
+    ("ADBE Vector Stroke Color", COLOR),
+    ("ADBE Vector Stroke Opacity", SLIDER),
+    ("ADBE Vector Stroke Width", SLIDER),
+    ("ADBE Vector Stroke Line Cap", POPUP),
+    ("ADBE Vector Stroke Line Join", POPUP),
+    ("ADBE Vector Stroke Miter Limit", SLIDER),
+    ("ADBE Vector Trim Start", SLIDER),
+    ("ADBE Vector Trim End", SLIDER),
+    ("ADBE Vector Trim Offset", ANGLE),
+    ("ADBE Vector Trim Type", POPUP),
+    ("ADBE Vector RoundCorner Radius", SLIDER),
+    ("ADBE Vector Merge Type", POPUP),
+    ("ADBE Vector Offset Amount", SLIDER),
+    ("ADBE Vector Offset Line Join", POPUP),
+    ("ADBE Vector Offset Miter Limit", SLIDER),
+    ("ADBE Vector Offset Copies", SLIDER),
+    ("ADBE Vector Offset Copy Offset", SLIDER),
+    ("ADBE Vector Repeater Copies", SLIDER),
+    ("ADBE Vector Repeater Offset", SLIDER),
+    ("ADBE Vector Repeater Order", POPUP),
+    ("ADBE Vector Repeater Anchor", POINT),
+    ("ADBE Vector Repeater Position", POINT),
+    ("ADBE Vector Repeater Scale", SIZE),
+    ("ADBE Vector Repeater Rotation", ANGLE),
+    ("ADBE Vector Repeater Opacity 1", SLIDER),
+    ("ADBE Vector Repeater Opacity 2", SLIDER),
+    ("ADBE Vector Anchor", POINT),
+    ("ADBE Vector Position", POINT),
+    ("ADBE Vector Scale", SIZE),
+    // Skew has its own record (460: a slider of the angle layout, -85..85).
+    ("ADBE Vector Skew", RecKind { proto: "ADBE Vector Skew", range: Some((-85.0, 85.0)), layout: Layout::One }),
+    ("ADBE Vector Skew Axis", ANGLE),
+    ("ADBE Vector Rotation", ANGLE),
+    ("ADBE Vector Group Opacity", SLIDER),
+];
+
+fn kind_of(name: &str) -> Option<RecKind> {
+    KINDS.iter().find(|(n, _)| *n == name).map(|(_, k)| *k)
+}
+
+impl ShapeProtos {
+    fn item(&self, name: &str) -> R<[Chunk<'static>; 2]> {
+        self.items.iter().find(|(n, _)| n == name).map(|(_, c)| c.clone()).ok_or_else(|| tpl("shape item prototype missing"))
+    }
+
+    /// The static value record of `name`: the one After Effects wrote for it in a one-change
+    /// case, else the record of its type (R46).
+    fn record(&self, name: &'static str) -> R<[Chunk<'static>; 2]> {
+        if let Some((_, c)) = self.records.iter().find(|(n, _)| n == name) {
+            return Ok(c.clone());
+        }
+        let kind = kind_of(name).ok_or_else(|| tpl("shape property without a record type"))?;
+        let [_, mut node] = self.records.iter().find(|(n, _)| n == kind.proto).map(|(_, c)| c.clone()).ok_or_else(|| tpl("shape record prototype missing"))?;
+        if let Some((lo, hi)) = kind.range {
+            put_f64(child_data(&mut node, b"tdum")?, 0, lo)?;
+            put_f64(child_data(&mut node, b"tduM")?, 0, hi)?;
+        }
+        Ok([crate::export::camlight::tdmn_chunk(name), node])
+    }
+}
+
+fn finite(v: &[f64]) -> bool {
+    v.iter().all(|x| x.is_finite() && x.abs() <= 1e9)
+}
+
+/// The stored components of a value.
+pub(crate) type Conv = fn(&Value) -> Option<Vec<f64>>;
+
+pub(crate) fn c_scalar(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Scalar(s) => Some(vec![*s]),
+        _ => None,
+    }
+}
+
+/// Offset Paths' Copy Offset: EffectCraft's value + 1 (826-828).
+fn c_copy_offset(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Scalar(s) => Some(vec![*s + 1.0]),
+        _ => None,
+    }
+}
+
+pub(crate) fn c_point(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Vec2(p) => Some(p.to_vec()),
+        Value::Vec3(p) => Some(vec![p[0], p[1]]),
+        _ => None,
+    }
+}
+
+/// A colour as the file stores it (alpha 255, then red, green and blue from 0 to 255). A channel
+/// outside 0 to 1 is written as the nearest limit, as for lights (`rec_value` reports it); a
+/// value that is not finite stays so and is reported as invalid.
+pub(crate) fn c_color(v: &Value) -> Option<Vec<f64>> {
+    let ch = |x: f64| if x.is_finite() { x.clamp(0.0, 1.0) * 255.0 } else { x };
+    match v {
+        Value::Color(c) => Some(vec![255.0, ch(c[0]), ch(c[1]), ch(c[2])]),
+        _ => None,
+    }
+}
+
+/// Whether a colour that is written has a channel outside 0 to 1: the keys of an animated
+/// property (its static value is not written then), else the static value.
+fn colour_beyond(p: &Property, keyed: bool) -> bool {
+    let beyond = |v: &Value| matches!(v, Value::Color(c) if c.iter().take(3).any(|x| x.is_finite() && !(0.0..=1.0).contains(x)));
+    if keyed { p.keys.iter().any(|k| beyond(&k.value)) } else { beyond(&p.value) }
+}
+
+/// Whether a colour that is written has an alpha other than 1 (a colour property of After Effects
+/// has no alpha): the keys of an animated property, else the static value.
+fn colour_alpha(p: &Property, keyed: bool) -> bool {
+    let alpha = |v: &Value| matches!(v, Value::Color(c) if c[3].is_finite() && (c[3] - 1.0).abs() > 1e-9);
+    if keyed { p.keys.iter().any(|k| alpha(&k.value)) } else { alpha(&p.value) }
+}
+
+/// A popup stored 1-based (EffectCraft's items in After Effects' order).
+pub(crate) fn c_popup(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Enum(e) => Some(vec![f64::from(*e) + 1.0]),
+        _ => None,
+    }
+}
+
+/// What planning a shape layer needs: the layer's time base and the report.
+pub(crate) struct ShCx<'a> {
+    pub cp: &'a CompPlan,
+    pub col: &'a mut Collector,
+}
+
+/// The keys of `p` in the file's units.
+fn plan_keys(p: &Property, conv: Conv, layout: Layout, what: &str, cx: &mut ShCx<'_>) -> Vec<KeyPlan> {
+    let mut timed: Vec<(i64, &Keyframe)> = Vec::with_capacity(p.keys.len());
+    for k in &p.keys {
+        let (u, inexact) = cx.cp.tb.units(k.time);
+        if inexact {
+            cx.col.lose(LossCategory::RoundedTimes, format!("{what}: key at {:.4} s moved to the time base", k.time.seconds()));
+        }
+        timed.push((u, k));
+    }
+    timed.sort_by_key(|(u, _)| *u);
+    let before = timed.len();
+    timed.dedup_by_key(|(u, _)| *u);
+    if timed.len() != before {
+        cx.col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: keys at the same time were merged"));
+    }
+    let all: Vec<Keyframe> = timed.iter().map(|(_, k)| (*k).clone()).collect();
+    let mut out = Vec::with_capacity(timed.len());
+    let beyond = std::cell::Cell::new(false);
+    for (i, (u, k)) in timed.iter().enumerate() {
+        let Ok(time) = i32::try_from(*u) else {
+            cx.col.lose(LossCategory::InvalidValues, format!("{what}: key time out of range, key dropped"));
+            continue;
+        };
+        let Some(value) = conv(&k.value).filter(|v| finite(v)) else {
+            cx.col.lose(LossCategory::InvalidValues, format!("{what}: a key value that cannot be stored, key dropped"));
+            continue;
+        };
+        let mut side = |interp: Interp| -> u8 {
+            match interp {
+                Interp::Linear => 1,
+                Interp::Hold => 3,
+                // The ease of colour keys is sampled only as speed 0 / influence 0 (598).
+                Interp::Bezier if layout == Layout::Color => {
+                    cx.col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: bezier ease of a colour key is written as linear (not sampled)"));
+                    1
+                }
+                Interp::Bezier => 2,
+            }
+        };
+        let (in_i, out_i) = (side(k.in_interp), side(k.out_interp));
+        let slots = if layout == Layout::Size { value.len().max(1) } else { 1 };
+        let ease = |eases: &[effectcraft_keyframe::Ease], on: bool| -> Vec<EaseSlot> {
+            (0..slots)
+                .map(|s| {
+                    if !on {
+                        return EaseSlot::default();
+                    }
+                    let e = crate::export::plan::key_ease(eases, s);
+                    let speed = if e.speed.is_finite() && e.speed.abs() <= 1e9 {
+                        e.speed
+                    } else {
+                        beyond.set(true);
+                        0.0
+                    };
+                    let influence = if e.influence.is_finite() { e.influence.clamp(0.001, 1.0) } else { 1.0 / 3.0 };
+                    EaseSlot { speed, influence }
+                })
+                .collect()
+        };
+        let (mut tin, mut tout) = if layout == Layout::Point { effectcraft_keyframe::spatial_tangents(&all, i) } else { ([0.0; 3], [0.0; 3]) };
+        for t in tin.iter_mut().chain(tout.iter_mut()) {
+            if !t.is_finite() || t.abs() > 1e9 {
+                beyond.set(true);
+                *t = 0.0;
+            }
+        }
+        if k.roving {
+            cx.col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: a roving key is written as a normal key"));
+        }
+        out.push(KeyPlan {
+            time,
+            value,
+            in_interp: in_i,
+            out_interp: out_i,
+            in_ease: ease(&k.in_ease, in_i == 2),
+            out_ease: ease(&k.out_ease, out_i == 2),
+            spatial_in: tin,
+            spatial_out: tout,
+            spatial_auto: k.spatial_auto,
+            roving: false,
+            label: k.label.min(16),
+        });
+    }
+    cx.col.exported.keyframes = cx.col.exported.keyframes.saturating_add(out.len());
+    crate::export::plan::report_beyond(beyond.get(), what, cx.col);
+    out
+}
+
+/// A property's value, keys and expression in the file's units; `None` when it needs no record:
+/// at `default` (when given) with no keys and no expression. Keys on a popup are not sampled:
+/// the first key's value is written (reported in `category`).
+pub(crate) fn rec_value(
+    p: &Property,
+    conv: Conv,
+    layout: Layout,
+    default: Option<&[f64]>,
+    w: &str,
+    category: LossCategory,
+    cx: &mut ShCx<'_>,
+) -> Option<RecVal> {
+    let expr = p.expr.as_ref().filter(|e| !e.text.is_empty()).map(|e| (e.text.clone(), e.enabled));
+    if expr.is_some() {
+        cx.col.exported.expressions = cx.col.exported.expressions.saturating_add(1);
+    }
+    let Some(value) = conv(&p.value) else {
+        cx.col.lose(category, format!("{w} holds a value of another type, not written"));
+        return None;
+    };
+    if !finite(&value) {
+        cx.col.lose(LossCategory::InvalidValues, format!("{w} is not a valid number (the default is written)"));
+        return None;
+    }
+    let differs = |v: &[f64]| default.is_none_or(|d| v.iter().zip(d).any(|(a, b)| (a - b).abs() > 1e-9));
+    let mut keys = Vec::new();
+    if !p.keys.is_empty() {
+        if layout == Layout::Popup {
+            cx.col.lose(category, format!("{w}: keys on a popup are not written (not sampled), the first key's value is written"));
+            let first = p.keys.first().and_then(|k| conv(&k.value)).unwrap_or(value);
+            return (differs(&first) || expr.is_some()).then_some(RecVal { value: first, keys: Vec::new(), expr });
+        }
+        keys = plan_keys(p, conv, layout, w, cx);
+    }
+    // Shape and text animator colours alike (both are planned here).
+    if layout == Layout::Color && colour_beyond(p, !keys.is_empty()) {
+        cx.col.lose(category, format!("{w}: a colour channel outside 0 to 1 is written as the nearest limit"));
+    }
+    if layout == Layout::Color && colour_alpha(p, !keys.is_empty()) {
+        cx.col.lose(category, format!("{w}: the colour's alpha is not written (After Effects colours have none; written opaque)"));
+    }
+    if keys.is_empty() && expr.is_none() && !differs(&value) {
+        return None;
+    }
+    let value = keys.first().map(|k| k.value.clone()).unwrap_or(value);
+    Some(RecVal { value, keys, expr })
+}
+
+/// Plans property `id` of `g` as the record `name` (`names`: `(name, id)`) unless it is at After
+/// Effects' default with no keys and no expression.
+fn rec(out: &mut Records, g: &PropGroup, names: (&'static str, &str), conv: Conv, default: &[f64], what: &str, cx: &mut ShCx<'_>) {
+    let (name, id) = names;
+    let Some(p) = g.get(id) else { return };
+    let Some(kind) = kind_of(name) else { return };
+    let w = format!("{what}: {name}");
+    if let Some(v) = rec_value(p, conv, kind.layout, Some(default), &w, LossCategory::ShapeLayers, cx) {
+        out.push((name, v));
+    }
+}
+
+fn en(g: &PropGroup, id: &str) -> Option<u32> {
+    match g.get(id).map(|p| &p.value) {
+        Some(Value::Enum(e)) => Some(*e),
+        _ => None,
+    }
+}
+
+/// Opacity, width, cap, join and miter limit of a stroke or gradient stroke; dashes, taper and
+/// wave are reported when they hold values.
+fn stroke_common(r: &mut Records, g: &PropGroup, w: &str, cx: &mut ShCx<'_>) {
+    rec(r, g, ("ADBE Vector Stroke Opacity", "opacity"), c_scalar, &[100.0], w, cx);
+    rec(r, g, ("ADBE Vector Stroke Width", "width"), c_scalar, &[2.0], w, cx);
+    rec(r, g, ("ADBE Vector Stroke Line Cap", "cap"), c_popup, &[1.0], w, cx);
+    rec(r, g, ("ADBE Vector Stroke Line Join", "join"), c_popup, &[1.0], w, cx);
+    rec(r, g, ("ADBE Vector Stroke Miter Limit", "miter"), c_scalar, &[4.0], w, cx);
+    // Dashes, a taper or a wave change the stroke (After Effects' defaults: no dash, no taper
+    // length, no wave amount).
+    let nonzero = |sub: &str, ids: &[&str]| {
+        g.sub(sub).is_some_and(|s| s.props().any(|p| ids.iter().any(|i| p.match_id.starts_with(i)) && matches!(p.value, Value::Scalar(v) if v != 0.0)))
+    };
+    if nonzero("dashes", &["dash", "gap"]) || nonzero("taper", &["startLength", "endLength"]) || nonzero("wave", &["amount"]) {
+        cx.col.lose(LossCategory::ShapeLayers, format!("{w}: dashes, taper and wave of a stroke are not written"));
+    }
+}
+
+/// The gradient part of a gradient fill or stroke: type, start, end, highlight; the colour
+/// stops are not decoded (only the default white to black is written).
+fn gradient(r: &mut Records, g: &PropGroup, w: &str, cx: &mut ShCx<'_>) {
+    rec(r, g, ("ADBE Vector Grad Type", "type"), c_popup, &[1.0], w, cx);
+    rec(r, g, ("ADBE Vector Grad Start Pt", "start"), c_point, &[0.0, 0.0], w, cx);
+    rec(r, g, ("ADBE Vector Grad End Pt", "end"), c_point, &[100.0, 0.0], w, cx);
+    rec(r, g, ("ADBE Vector Grad HiLite Length", "highlightLength"), c_scalar, &[0.0], w, cx);
+    rec(r, g, ("ADBE Vector Grad HiLite Angle", "highlightAngle"), c_scalar, &[0.0], w, cx);
+    if let Some(p) = g.get("colors")
+        && (matches!(&p.value, Value::Gradient(gr) if *gr != Gradient::default()) || !p.keys.is_empty() || p.has_expression())
+    {
+        cx.col.lose(LossCategory::ShapeLayers, format!("{w}: the colour stops of a gradient are not written (not decoded), white to black"));
+    }
+}
+
+/// The items of a `contents` group, top first, in the file's terms.
+pub(crate) fn plan_contents(contents: &PropGroup, what: &str, depth: usize, cx: &mut ShCx<'_>) -> Vec<ShItem> {
+    let mut out = Vec::new();
+    if depth > MAX_DEPTH {
+        cx.col.lose(LossCategory::ShapeLayers, format!("{what}: shape groups nested deeper than {MAX_DEPTH} levels are not written"));
+        return out;
+    }
+    for node in &contents.children {
+        let Node::Group(g) = node else { continue };
+        let w = format!("{what} / {}", g.name);
+        // A switched-off item keeps its node with bit 0 of its group flags cleared (986, 987).
+        let wrap = |item: ShItem| if g.enabled { item } else { ShItem::Off(Box::new(item)) };
+        if en(g, "direction").is_some_and(|d| d != 0) {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{w}: the path direction is not written"));
+        }
+        // A repeater writes its `composite` as Repeater Order.
+        let composite_lost = g.match_id != "repeater" && en(g, "composite").is_some_and(|d| d != 0);
+        if en(g, "blend").is_some_and(|d| d != 0) || composite_lost {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{w}: blend mode and composite order are not written"));
+        }
+        let mut r = Vec::new();
+        let mut subs = Vec::new();
+        let kind = match g.match_id.as_str() {
+            "group" => {
+                let items = g.sub("contents").map(|c| plan_contents(c, &w, depth + 1, cx)).unwrap_or_default();
+                let mut transform = Vec::new();
+                if let Some(t) = g.sub("transform") {
+                    rec(&mut transform, t, ("ADBE Vector Anchor", "anchor"), c_point, &[0.0, 0.0], &w, cx);
+                    rec(&mut transform, t, ("ADBE Vector Position", "position"), c_point, &[0.0, 0.0], &w, cx);
+                    rec(&mut transform, t, ("ADBE Vector Scale", "scale"), c_point, &[100.0, 100.0], &w, cx);
+                    rec(&mut transform, t, ("ADBE Vector Skew", "skew"), c_scalar, &[0.0], &w, cx);
+                    rec(&mut transform, t, ("ADBE Vector Skew Axis", "skewAxis"), c_scalar, &[0.0], &w, cx);
+                    rec(&mut transform, t, ("ADBE Vector Rotation", "rotation"), c_scalar, &[0.0], &w, cx);
+                    rec(&mut transform, t, ("ADBE Vector Group Opacity", "opacity"), c_scalar, &[100.0], &w, cx);
+                }
+                out.push(wrap(ShItem::Group { name: g.name.clone(), items, transform }));
+                continue;
+            }
+            "path" => {
+                let p = g.get("path");
+                if p.is_some_and(|p| !p.keys.is_empty() || p.has_expression()) {
+                    cx.col.lose(LossCategory::ShapeLayers, format!("{w}: keys or an expression on the path (the static path is written)"));
+                }
+                match p.map(|p| &p.value) {
+                    Some(Value::Path(sp)) => match crate::export::masks::shape_plan(sp, (1, 1)) {
+                        Ok(shape) => out.push(wrap(ShItem::Path { name: g.name.clone(), shape })),
+                        Err(why) => cx.col.lose(LossCategory::ShapeLayers, format!("{w}: the path is not written: {why}")),
+                    },
+                    _ => cx.col.lose(LossCategory::ShapeLayers, format!("{w}: a path item without a path is not written")),
+                }
+                continue;
+            }
+            "rect" => {
+                rec(&mut r, g, ("ADBE Vector Rect Size", "size"), c_point, &[100.0, 100.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Rect Position", "position"), c_point, &[0.0, 0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Rect Roundness", "roundness"), c_scalar, &[0.0], &w, cx);
+                if g.get("perCorner").is_some_and(|p| p.value == Value::Bool(true) || !p.keys.is_empty() || p.has_expression()) {
+                    cx.col.lose(LossCategory::ShapeLayers, format!("{w}: per-corner roundness is not written (the uniform Roundness is)"));
+                }
+                "ADBE Vector Shape - Rect"
+            }
+            "ellipse" => {
+                rec(&mut r, g, ("ADBE Vector Ellipse Size", "size"), c_point, &[100.0, 100.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Ellipse Position", "position"), c_point, &[0.0, 0.0], &w, cx);
+                "ADBE Vector Shape - Ellipse"
+            }
+            // Polystar (104, 331, 473-477): After Effects' defaults are a 5-point star with radii
+            // 100 / 50 (519).
+            "star" => {
+                rec(&mut r, g, ("ADBE Vector Star Type", "type"), c_popup, &[1.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Points", "points"), c_scalar, &[5.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Position", "position"), c_point, &[0.0, 0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Rotation", "rotation"), c_scalar, &[0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Inner Radius", "innerRadius"), c_scalar, &[50.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Outer Radius", "outerRadius"), c_scalar, &[100.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Inner Roundess", "innerRoundness"), c_scalar, &[0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Star Outer Roundess", "outerRoundness"), c_scalar, &[0.0], &w, cx);
+                "ADBE Vector Shape - Star"
+            }
+            "fill" => {
+                rec(&mut r, g, ("ADBE Vector Fill Rule", "rule"), c_popup, &[1.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Fill Color", "color"), c_color, &[255.0, 255.0, 0.0, 0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Fill Opacity", "opacity"), c_scalar, &[100.0], &w, cx);
+                "ADBE Vector Graphic - Fill"
+            }
+            "stroke" => {
+                rec(&mut r, g, ("ADBE Vector Stroke Color", "color"), c_color, &[255.0, 255.0, 255.0, 255.0], &w, cx);
+                stroke_common(&mut r, g, &w, cx);
+                "ADBE Vector Graphic - Stroke"
+            }
+            "gfill" => {
+                rec(&mut r, g, ("ADBE Vector Fill Rule", "rule"), c_popup, &[1.0], &w, cx);
+                gradient(&mut r, g, &w, cx);
+                rec(&mut r, g, ("ADBE Vector Fill Opacity", "opacity"), c_scalar, &[100.0], &w, cx);
+                "ADBE Vector Graphic - G-Fill"
+            }
+            "gstroke" => {
+                gradient(&mut r, g, &w, cx);
+                stroke_common(&mut r, g, &w, cx);
+                "ADBE Vector Graphic - G-Stroke"
+            }
+            // Trim Paths (101, 465-469, 851-856).
+            "trim" => {
+                rec(&mut r, g, ("ADBE Vector Trim Start", "start"), c_scalar, &[0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Trim End", "end"), c_scalar, &[100.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Trim Offset", "offset"), c_scalar, &[0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Trim Type", "mode"), c_popup, &[1.0], &w, cx);
+                "ADBE Vector Filter - Trim"
+            }
+            // Round Corners (238; default radius 10, 519).
+            "round" => {
+                rec(&mut r, g, ("ADBE Vector RoundCorner Radius", "radius"), c_scalar, &[10.0], &w, cx);
+                "ADBE Vector Filter - RC"
+            }
+            // Merge Paths (707, 708, 731).
+            "merge" => {
+                rec(&mut r, g, ("ADBE Vector Merge Type", "mode"), c_popup, &[1.0], &w, cx);
+                "ADBE Vector Filter - Merge"
+            }
+            // Offset Paths (710, 828; defaults 731: amount 10, miter 4, one copy, copy offset 1).
+            "offset" => {
+                rec(&mut r, g, ("ADBE Vector Offset Amount", "amount"), c_scalar, &[10.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Offset Line Join", "join"), c_popup, &[1.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Offset Miter Limit", "miter"), c_scalar, &[4.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Offset Copies", "copies"), c_scalar, &[1.0], &w, cx);
+                // EffectCraft offsets copy i by Amount x (i + 1 + copyOffset), After Effects by
+                // Amount x (i + Copy Offset) (826-828): Copy Offset = copyOffset + 1, the
+                // importer's inverse.
+                rec(&mut r, g, ("ADBE Vector Offset Copy Offset", "copyOffset"), c_copy_offset, &[1.0], &w, cx);
+                if g.get("copyOffset").is_some_and(|p| p.has_expression()) {
+                    cx.col.lose(
+                        LossCategory::ShapeLayers,
+                        format!("{w}: the expression on Offset Paths' Copy Offset is written as it is (After Effects' value is 1 more than EffectCraft's)"),
+                    );
+                }
+                "ADBE Vector Filter - Offset"
+            }
+            // Repeater (102, 709; defaults 731: one copy, offset 0, below, identity transform).
+            "repeater" => {
+                rec(&mut r, g, ("ADBE Vector Repeater Copies", "copies"), c_scalar, &[1.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Repeater Offset", "offset"), c_scalar, &[0.0], &w, cx);
+                rec(&mut r, g, ("ADBE Vector Repeater Order", "composite"), c_popup, &[1.0], &w, cx);
+                let mut t = Vec::new();
+                if let Some(tr) = g.sub("transform") {
+                    rec(&mut t, tr, ("ADBE Vector Repeater Anchor", "anchor"), c_point, &[0.0, 0.0], &w, cx);
+                    rec(&mut t, tr, ("ADBE Vector Repeater Position", "position"), c_point, &[0.0, 0.0], &w, cx);
+                    rec(&mut t, tr, ("ADBE Vector Repeater Scale", "scale"), c_point, &[100.0, 100.0], &w, cx);
+                    rec(&mut t, tr, ("ADBE Vector Repeater Rotation", "rotation"), c_scalar, &[0.0], &w, cx);
+                    rec(&mut t, tr, ("ADBE Vector Repeater Opacity 1", "startOpacity"), c_scalar, &[100.0], &w, cx);
+                    rec(&mut t, tr, ("ADBE Vector Repeater Opacity 2", "endOpacity"), c_scalar, &[100.0], &w, cx);
+                }
+                subs.push(("ADBE Vector Repeater Transform", t));
+                "ADBE Vector Filter - Repeater"
+            }
+            other => {
+                cx.col.lose(LossCategory::ShapeLayers, format!("{w}: the shape item '{other}' is not written"));
+                continue;
+            }
+        };
+        out.push(wrap(ShItem::Simple { kind, name: g.name.clone(), records: r, subs }));
+    }
+    out
+}
+
+fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let b = c.bytes()?;
+    let end = b.iter().position(|x| *x == 0).unwrap_or(b.len());
+    std::str::from_utf8(b.get(..end)?).ok().map(str::to_string)
+}
+
+/// A key of a point (the spatial layout of a 2D Position, 853) or a colour (854).
+fn spatial_key(k: &KeyPlan, n: usize, point: bool, size: usize) -> R<Vec<u8>> {
+    let mut r = vec![0u8; size];
+    put(&mut r, 0, &k.time.to_be_bytes())?;
+    put_u8(&mut r, 4, k.in_interp)?;
+    put_u8(&mut r, 5, k.out_interp)?;
+    let base: u16 = if point { 0x0007 } else { 0x0001 };
+    put_u16(&mut r, 6, base | (u16::from(k.label) << 6))?;
+    if point {
+        put_u32(&mut r, 8, u32::from(k.spatial_auto))?;
+        let (i, o) = (k.in_ease.first().copied().unwrap_or_default(), k.out_ease.first().copied().unwrap_or_default());
+        put_f64(&mut r, 24, i.speed)?;
+        put_f64(&mut r, 32, i.influence)?;
+        put_f64(&mut r, 40, o.speed)?;
+        put_f64(&mut r, 48, o.influence)?;
+    }
+    for j in 0..n {
+        put_f64(&mut r, 56 + 8 * j, k.value.get(j).copied().unwrap_or(0.0))?;
+        if point {
+            put_f64(&mut r, 56 + 8 * n + 8 * j, k.spatial_in.get(j).copied().unwrap_or(0.0))?;
+            put_f64(&mut r, 56 + 16 * n + 8 * j, k.spatial_out.get(j).copied().unwrap_or(0.0))?;
+        }
+    }
+    Ok(r)
+}
+
+/// The value record of `name` holding `v`.
+fn value_record(t: &ShapeProtos, name: &'static str, v: &RecVal) -> R<[Chunk<'static>; 2]> {
+    let [m, node] = t.record(name)?;
+    let layout = kind_of(name).map_or(Layout::One, |k| k.layout);
+    build_record(m, node, layout, v, &t.key_list)
+}
+
+/// A static value record (`node`, after its `tdmn` `m`) turned into the record of `v`: its value,
+/// its keys (`key_list` the list prototype) and its expression.
+pub(crate) fn build_record(m: Chunk<'static>, mut node: Chunk<'static>, layout: Layout, v: &RecVal, key_list: &Chunk<'static>) -> R<[Chunk<'static>; 2]> {
+    if v.keys.is_empty() {
+        let d = child_data(&mut node, b"cdat")?;
+        for (i, x) in v.value.iter().enumerate() {
+            put_f64(d, i * 8, *x)?;
+        }
+    } else {
+        let n = v.value.len().max(1);
+        let size = match layout {
+            Layout::Point | Layout::Color => 56 + 24 * n,
+            _ => 8 + 40 * n,
+        };
+        {
+            let tdb4 = child_data(&mut node, b"tdb4")?;
+            let b5 = tdb4.get(5).copied().ok_or_else(|| tpl("short tdb4"))?;
+            put_u8(tdb4, 5, b5 & !0x01)?;
+            put_u8(tdb4, 68, 1)?;
+            // A keyed point or colour clears byte 79 too (853, 854; as on effects, R25).
+            if matches!(layout, Layout::Point | Layout::Color) {
+                put_u8(tdb4, 79, 0)?;
+            }
+        }
+        let mut list = key_list.clone();
+        let count = u32::try_from(v.keys.len()).map_err(|_| tpl("too many keys"))?;
+        {
+            let lhd3 = child_data(&mut list, b"lhd3")?;
+            crate::export::synth::put_key_counts(lhd3, count, u32::try_from(size).map_err(|_| tpl("record size"))?)?;
+        }
+        let mut ldat = Vec::with_capacity(size * v.keys.len());
+        for k in &v.keys {
+            ldat.extend(match layout {
+                Layout::Point => spatial_key(k, n, true, size)?,
+                Layout::Color => spatial_key(k, n, false, size)?,
+                _ => crate::export::emit::plain_record(n, k, size)?,
+            });
+        }
+        {
+            let lk = kids_mut(&mut list)?;
+            match lk.iter_mut().find(|c| c.is(b"ldat")) {
+                Some(c) => *c = Chunk::data(*b"ldat", ldat),
+                None => lk.push(Chunk::data(*b"ldat", ldat)),
+            }
+        }
+        let kids = kids_mut(&mut node)?;
+        let at = kids.iter().position(|c| c.is(b"cdat")).ok_or_else(|| tpl("shape record without cdat"))?;
+        if let Some(slot) = kids.get_mut(at) {
+            *slot = list;
+        }
+    }
+    if let Some((text, enabled)) = &v.expr {
+        // As on the Transform properties (R15; 856).
+        {
+            let tdb4 = child_data(&mut node, b"tdb4")?;
+            put_u8(tdb4, 76, 1)?;
+            put_u8(tdb4, 77, 1)?;
+            put_u8(tdb4, 120, 1)?;
+            put_u8(tdb4, 119, u8::from(!*enabled))?;
+        }
+        let kids = kids_mut(&mut node)?;
+        let at = kids.iter().position(|c| c.is(b"tdum")).unwrap_or(kids.len());
+        kids.insert(at, Chunk::data(*b"Utf8", text.as_bytes().to_vec()));
+    }
+    Ok([m, node])
+}
+
+/// Inserts value records into an item's `tdgp` (between its header and its sub-groups / end),
+/// in the order of [`KINDS`].
+fn put_records(t: &ShapeProtos, tdgp: &mut Chunk<'static>, records: &[(&'static str, RecVal)]) -> R<()> {
+    let kids = kids_mut(tdgp)?;
+    let mut at = kids.iter().position(|c| c.is(b"tdmn")).unwrap_or(kids.len());
+    let mut sorted: Vec<&(&'static str, RecVal)> = records.iter().collect();
+    sorted.sort_by_key(|(n, _)| KINDS.iter().position(|(o, _)| o == n).unwrap_or(KINDS.len()));
+    for (name, v) in sorted {
+        let [m, node] = value_record(t, name, v)?;
+        kids.insert(at, m);
+        kids.insert(at.saturating_add(1), node);
+        at = at.saturating_add(2);
+    }
+    Ok(())
+}
+
+/// The item nodes (`tdmn` + `tdgp` pairs) for `items`, top first.
+pub(crate) fn build_items(t: &ShapeProtos, items: &[ShItem], depth: usize) -> R<Vec<Chunk<'static>>> {
+    let mut out = Vec::new();
+    if depth > MAX_DEPTH {
+        return Ok(out);
+    }
+    let pos = |kids: &[Chunk<'static>], n: &str| kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(n));
+    for item in items {
+        match item {
+            ShItem::Off(inner) => {
+                let mut built = build_items(t, std::slice::from_ref(inner.as_ref()), depth)?;
+                if let Some(node) = built.get_mut(1) {
+                    let tdsb = child_data(node, b"tdsb")?;
+                    let flags = tdsb.get(3).copied().ok_or_else(|| tpl("short tdsb"))?;
+                    put_u8(tdsb, 3, flags & !1)?;
+                }
+                out.extend(built);
+            }
+            ShItem::Group { name, items, transform } => {
+                let [m, mut node] = t.item("ADBE Vector Group")?;
+                set_name(&mut node, name)?;
+                let children = build_items(t, items, depth + 1)?;
+                let kids = kids_mut(&mut node)?;
+                let vg = pos(kids, "ADBE Vectors Group").ok_or_else(|| tpl("group prototype without contents"))?;
+                let contents = kids.get_mut(vg + 1).ok_or_else(|| tpl("group prototype without contents"))?;
+                let ck = kids_mut(contents)?;
+                let end = ck.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Group End")).unwrap_or(ck.len());
+                ck.splice(end..end, children);
+                let tg = pos(kids, "ADBE Vector Transform Group").ok_or_else(|| tpl("group prototype without transform"))?;
+                let tnode = kids.get_mut(tg + 1).ok_or_else(|| tpl("group prototype without transform"))?;
+                put_records(t, tnode, transform)?;
+                out.extend([m, node]);
+            }
+            ShItem::Simple { kind, name, records, subs } => {
+                let [m, mut node] = t.item(kind)?;
+                set_name(&mut node, name)?;
+                for (sub, recs) in subs {
+                    if recs.is_empty() {
+                        continue;
+                    }
+                    let kids = kids_mut(&mut node)?;
+                    let at = pos(kids, sub).ok_or_else(|| tpl("shape item prototype without its sub-group"))?;
+                    let group = kids.get_mut(at + 1).ok_or_else(|| tpl("shape item prototype without its sub-group"))?;
+                    put_records(t, group, recs)?;
+                }
+                put_records(t, &mut node, records)?;
+                out.extend([m, node]);
+            }
+            ShItem::Path { name, shape } => {
+                let [m, mut node] = t.item("ADBE Vector Shape - Group")?;
+                set_name(&mut node, name)?;
+                let kids = kids_mut(&mut node)?;
+                let oms = kids.iter_mut().find(|c| c.is_list(b"om-s")).ok_or_else(|| tpl("path prototype without its shape"))?;
+                let omks = list_mut(oms, b"omks")?;
+                let proto = kids_mut(omks)?.iter().find(|c| c.is_list(b"shap")).cloned().ok_or_else(|| tpl("path prototype without a shape"))?;
+                *kids_mut(omks)? = vec![crate::export::masks::build_shap(&proto, shape)?];
+                out.extend([m, node]);
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// The item's user name (`tdsn/Utf8`).
+fn set_name(node: &mut Chunk<'static>, name: &str) -> R<()> {
+    let kids = kids_mut(node)?;
+    let tdsn = kids.iter_mut().find(|c| c.is(b"tdsn")).ok_or_else(|| tpl("shape item without a name"))?;
+    set_utf8(tdsn, name)
+}
+
+/// Fills the layer's `ADBE Root Vectors Group` with `items`.
+pub(crate) fn put_contents(layr: &mut Chunk<'static>, t: &ShapeProtos, items: &[ShItem]) -> R<()> {
+    let built = build_items(t, items, 0)?;
+    let root = list_mut(layr, b"tdgp")?;
+    let kids = kids_mut(root)?;
+    let at = kids
+        .iter()
+        .position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Root Vectors Group"))
+        .ok_or_else(|| tpl("shape layer without contents"))?;
+    let rv = kids.get_mut(at + 1).ok_or_else(|| tpl("shape layer without contents"))?;
+    let rk = kids_mut(rv)?;
+    let end = rk.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some("ADBE Group End")).unwrap_or(rk.len());
+    rk.splice(end..end, built);
+    Ok(())
+}
diff --git a/crates/aep/src/export/skeleton.rs b/crates/aep/src/export/skeleton.rs
new file mode 100644
index 000000000..037b4d865
--- /dev/null
+++ b/crates/aep/src/export/skeleton.rs
@@ -0,0 +1,159 @@
+//! The layer, item and project skeletons the exporter fills, built in code (aep-format.md 3.1-3.4):
+//! only the property groups the exporter writes into, the default records it edits, and the small
+//! fixed records each layer carries. After Effects adds the groups that are left out (read-back
+//! e1-sparse).
+
+use crate::Chunk;
+use crate::export::synth::{KeyTemplate, NO_NAME, RecSpec, class, tdbs, tdmn, tdsn};
+
+/// A group: its match name and a `tdgp` with the state `state` (`tdsb`), no user name, `kids` and
+/// the closing `ADBE Group End`.
+pub(crate) fn group(name: &str, state: u32, kids: Vec<Chunk<'static>>) -> [Chunk<'static>; 2] {
+    let mut body = vec![Chunk::data(*b"tdsb", state.to_be_bytes().to_vec()), tdsn(NO_NAME)];
+    body.extend(kids);
+    body.push(tdmn("ADBE Group End"));
+    [tdmn(name), Chunk::list(*b"tdgp", body)]
+}
+
+/// The seven records that follow a layer or item block (`fvdv` 3, the others zero; the same in
+/// every sample, meaning not decoded).
+pub(crate) fn f_records() -> Vec<Chunk<'static>> {
+    vec![
+        Chunk::data(*b"fvdv", 3u32.to_be_bytes().to_vec()),
+        Chunk::data(*b"fiop", vec![0]),
+        Chunk::data(*b"ftts", vec![0; 4]),
+        Chunk::data(*b"foac", vec![0]),
+        Chunk::data(*b"fiac", vec![0]),
+        Chunk::data(*b"fipc", vec![0; 2]),
+        Chunk::data(*b"fifl", vec![0; 4]),
+    ]
+}
+
+/// The layer styles in the order After Effects keeps their switch groups (950).
+const STYLE_ORDER: [&str; 10] =
+    ["dropShadow", "innerShadow", "outerGlow", "innerGlow", "bevelEmboss", "chromeFX", "solidFill", "gradientFill", "patternFill", "frameFX"];
+
+/// The empty `ADBE Layer Styles` group (state 3), Blending Options with the advanced group, and
+/// the switch group of every style (state 2: not applied), for `styles::put_styles` to fill.
+pub(crate) fn layer_styles() -> [Chunk<'static>; 2] {
+    let mut kids: Vec<Chunk<'static>> = group("ADBE Blend Options Group", 3, group("ADBE Adv Blend Group", 1, Vec::new()).into()).into();
+    for s in STYLE_ORDER {
+        kids.extend(group(&format!("{s}/enabled"), 2, Vec::new()));
+    }
+    group("ADBE Layer Styles", 3, kids)
+}
+
+/// The inert Time Remapping record every layer has (`tdsb` 3, value 0, the maximum written per
+/// layer: aep-format.md 3.4).
+fn time_remap() -> Chunk<'static> {
+    let spec = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::LAYER_SCALAR, limits: Some((0.0, 0.0)), byte5: None };
+    let mut rec = tdbs(&spec, false, 25_600);
+    if let Some(state) = rec.children_mut().iter_mut().find(|c| c.is(b"tdsb")) {
+        *state = Chunk::data(*b"tdsb", 3u32.to_be_bytes().to_vec());
+    }
+    rec
+}
+
+/// The block of an AV layer (solid, footage, precomposition): `Layr` (a zero `ldta` the exporter
+/// fills with the decoded fields, read-back t-zldta; the name; the property tree with Time
+/// Remapping, an empty Transform group and the layer styles), `Ewst` and the f-records.
+pub(crate) fn av_layer() -> Vec<Chunk<'static>> {
+    let mut root = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn(""), tdmn("ADBE Time Remapping"), time_remap()];
+    root.extend(group("ADBE Transform Group", 1, crate::export::tree_spec::build(crate::export::tree_defs::AV_TRANSFORM)));
+    root.extend(layer_styles());
+    root.push(tdmn("ADBE Group End"));
+    let layr = Chunk::list(
+        *b"Layr",
+        vec![Chunk::data(*b"ldta", vec![0; 164]), Chunk::data(*b"Utf8", Vec::new()), Chunk::list(*b"tdgp", root), crate::export::base::guides()],
+    );
+    let mut out = vec![layr, Chunk::list(*b"Ewst", Vec::new())];
+    // Two sets of f-records follow every layer (000).
+    out.extend(f_records());
+    out.extend(f_records());
+    out
+}
+
+/// The block of a layer whose property tree is `nodes` (cameras, lights, shapes: `tree_defs`),
+/// with a zero `ldta`, the guides, `Ewst` and the f-records.
+pub(crate) fn layer_block(nodes: &[crate::export::tree_spec::Node]) -> Vec<Chunk<'static>> {
+    let mut root = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn("")];
+    root.extend(crate::export::tree_spec::build(nodes));
+    root.push(tdmn("ADBE Group End"));
+    let layr = Chunk::list(
+        *b"Layr",
+        vec![Chunk::data(*b"ldta", vec![0; 164]), Chunk::data(*b"Utf8", Vec::new()), Chunk::list(*b"tdgp", root), crate::export::base::guides()],
+    );
+    let mut out = vec![layr, Chunk::list(*b"Ewst", Vec::new())];
+    // Two sets of f-records follow every layer (000).
+    out.extend(f_records());
+    out.extend(f_records());
+    out
+}
+
+/// The Source Text record (`btds/tdbs`, 110): one component, class `0x00010004`, a 4-byte zero
+/// `cdat`.
+const SOURCE_TEXT: crate::export::tree_spec::Rec = crate::export::tree_spec::Rec {
+    state: 1,
+    label: NO_NAME,
+    dims: 1,
+    template: 0,
+    class: class::EFFECT_CHOICE,
+    byte5: 0x01,
+    header: &[],
+    cdat_len: 4,
+    cdat: &[],
+    key_size: 0,
+    limits: None,
+    tdpi: None,
+};
+
+/// The block of a text layer (110, 245): `ADBE Text Properties` with the text document (the
+/// Source Text record, the document `doc` as `LIST btdk`, and `btgu` with the document's id and
+/// a zero one), the empty Path and More Options groups; the inert Transform records and the layer
+/// styles; a zero `ldta`, the guides, `Ewst` and the f-records.
+pub(crate) fn text_layer(doc: &[u8]) -> Vec<Chunk<'static>> {
+    use crate::export::tree_spec::{Node, build};
+    let btdk = Chunk { id: *b"LIST", body: crate::Body::OpaqueList { list_type: *b"btdk", data: doc.to_vec().into() }, pad: None };
+    // The record without its match name (`build` gives the pair).
+    let mut btds_kids: Vec<Chunk<'static>> = build(&[Node::R("ADBE Text Document", SOURCE_TEXT)]).into_iter().filter(|c| c.is_list(b"tdbs")).collect();
+    btds_kids.push(btdk);
+    let btgu = Chunk::list(*b"btgu", vec![Chunk::data(*b"pgui", vec![0; 16]), Chunk::data(*b"pgui", vec![0; 16])]);
+    let mut props = vec![tdmn("ADBE Text Document"), Chunk::list(*b"btds", btds_kids), btgu];
+    props.extend(group("ADBE Text Path Options", 1, Vec::new()));
+    props.extend(group("ADBE Text More Options", 1, Vec::new()));
+    let mut root = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn("")];
+    root.extend(group("ADBE Text Properties", 1, props));
+    root.extend(group("ADBE Transform Group", 1, crate::export::tree_spec::build(crate::export::tree_defs::AV_TRANSFORM)));
+    root.extend(layer_styles());
+    root.push(tdmn("ADBE Group End"));
+    let layr = Chunk::list(
+        *b"Layr",
+        vec![Chunk::data(*b"ldta", vec![0; 164]), Chunk::data(*b"Utf8", Vec::new()), Chunk::list(*b"tdgp", root), crate::export::base::guides()],
+    );
+    let mut out = vec![layr, Chunk::list(*b"Ewst", Vec::new())];
+    out.extend(f_records());
+    out.extend(f_records());
+    out
+}
+
+/// `tdmn` + node pairs of `nodes`, by match name.
+pub(crate) fn pairs(nodes: &[crate::export::tree_spec::Node]) -> Vec<(String, [Chunk<'static>; 2])> {
+    let mut out = Vec::new();
+    let mut it = crate::export::tree_spec::build(nodes).into_iter();
+    while let (Some(m), Some(n)) = (it.next(), it.next()) {
+        let name = String::from_utf8_lossy(m.bytes().unwrap_or_default().split(|b| *b == 0).next().unwrap_or_default()).into_owned();
+        out.push((name, [m, n]));
+    }
+    out
+}
+
+/// The marker group (`tdmn ADBE Marker` + `LIST mrst`, aep-format.md 3.11) for
+/// `markers::build`: the marker property as a keyed one-component record (class `0x00010004`,
+/// 16-byte keys, 249) and `mrky` with one `Nmrd` whose header (`NmHd`) and strings are written
+/// per marker.
+pub(crate) fn marker_group() -> Vec<Chunk<'static>> {
+    let spec = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::EFFECT_CHOICE, limits: None, byte5: None };
+    let record = tdbs(&spec, true, 25_600);
+    let nmrd = Chunk::list(*b"Nmrd", vec![Chunk::data(*b"NmHd", vec![0; 20])]);
+    vec![tdmn("ADBE Marker"), Chunk::list(*b"mrst", vec![record, Chunk::list(*b"mrky", vec![nmrd])])]
+}
diff --git a/crates/aep/src/export/style_defs.rs b/crates/aep/src/export/style_defs.rs
new file mode 100644
index 000000000..e99f847a9
--- /dev/null
+++ b/crates/aep/src/export/style_defs.rs
@@ -0,0 +1,104 @@
+//! The layer-style records the exporter writes, one per parameter (aep-format.md 3.12b): the
+//! match name, the components, the key template (`tdb4` byte 7), the class word (`tdb4` 8..11)
+//! and the limits (`tdum` / `tduM`), as After Effects shows them for each style parameter. The
+//! rows were listed from our style cases (950-980) through the reader.
+
+/// One record: match name, components, key template, class word, limits.
+pub(crate) type StyleRec = (&'static str, u8, u8, u32, Option<(f64, f64)>);
+
+const fn s(name: &'static str, dims: u8, template: u8, class: u32, limits: Option<(f64, f64)>) -> StyleRec {
+    (name, dims, template, class, limits)
+}
+
+#[rustfmt::skip]
+pub(crate) static STYLE_RECORDS: &[StyleRec] = &[
+    s("ADBE B Channel Blend", 1, 0, 0xffff0004, None),
+    s("ADBE Blend Interior", 1, 0, 0xffff0004, None),
+    s("ADBE Blend Ranges", 1, 0, 0xffff0004, None),
+    s("ADBE G Channel Blend", 1, 0, 0xffff0004, None),
+    s("ADBE Global Altitude2", 1, 0, 0x0002ffff, None),
+    s("ADBE Global Angle2", 1, 0, 0x0002ffff, None),
+    s("ADBE Layer Fill Opacity2", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("ADBE R Channel Blend", 1, 0, 0xffff0004, None),
+    s("bevelEmboss/bevelDirection", 1, 0, 0x00010004, None),
+    s("bevelEmboss/bevelStyle", 1, 0, 0x00010004, None),
+    s("bevelEmboss/bevelTechnique", 1, 0, 0x00010004, None),
+    s("bevelEmboss/blur", 1, 0, 0xffffffff, Some((0.0, 250.0))),
+    s("bevelEmboss/highlightColor", 4, 1, 0x0002ffff, None),
+    s("bevelEmboss/highlightMode", 1, 0, 0x00010004, None),
+    s("bevelEmboss/highlightOpacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("bevelEmboss/localLightingAltitude", 1, 0, 0xffffffff, None),
+    s("bevelEmboss/localLightingAngle", 1, 0, 0xffffffff, None),
+    s("bevelEmboss/shadowColor", 4, 1, 0x0002ffff, None),
+    s("bevelEmboss/shadowMode", 1, 0, 0x00010004, None),
+    s("bevelEmboss/shadowOpacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("bevelEmboss/softness", 1, 0, 0xffffffff, Some((0.0, 16.0))),
+    s("bevelEmboss/strengthRatio", 1, 0, 0xffffffff, Some((1.0, 1000.0))),
+    s("bevelEmboss/useGlobalAngle", 1, 0, 0x00010004, None),
+    s("chromeFX/blur", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("chromeFX/color", 4, 1, 0x0002ffff, None),
+    s("chromeFX/distance", 1, 0, 0xffffffff, Some((1.0, 100.0))),
+    s("chromeFX/invert", 1, 0, 0x00010004, None),
+    s("chromeFX/localLightingAngle", 1, 0, 0xffffffff, None),
+    s("chromeFX/mode2", 1, 0, 0x00010004, None),
+    s("chromeFX/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("dropShadow/blur", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("dropShadow/chokeMatte", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("dropShadow/color", 4, 1, 0x0002ffff, None),
+    s("dropShadow/distance", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("dropShadow/layerConceals", 1, 0, 0x00010004, None),
+    s("dropShadow/localLightingAngle", 1, 0, 0xffffffff, None),
+    s("dropShadow/mode2", 1, 0, 0x00010004, None),
+    s("dropShadow/noise", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("dropShadow/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("dropShadow/useGlobalAngle", 1, 0, 0x00010004, None),
+    s("frameFX/color", 4, 1, 0x0002ffff, None),
+    s("frameFX/mode2", 1, 0, 0x00010004, None),
+    s("frameFX/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("frameFX/size", 1, 0, 0xffffffff, Some((1.0, 100.0))),
+    s("frameFX/style", 1, 0, 0x00010004, None),
+    s("gradientFill/align", 1, 0, 0x00010004, None),
+    s("gradientFill/angle", 1, 0, 0xffffffff, None),
+    s("gradientFill/gradientSmoothness", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("gradientFill/mode2", 1, 0, 0x00010004, None),
+    s("gradientFill/offset", 2, 3, 0xffffffff, None),
+    s("gradientFill/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("gradientFill/reverse", 1, 0, 0x00010004, None),
+    s("gradientFill/scale", 1, 0, 0xffffffff, Some((10.0, 150.0))),
+    s("gradientFill/type", 1, 0, 0x00010004, None),
+    s("innerGlow/AEColorChoice", 1, 0, 0x00010004, None),
+    s("innerGlow/blur", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerGlow/chokeMatte", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerGlow/color", 4, 1, 0x0002ffff, None),
+    s("innerGlow/glowTechnique", 1, 0, 0x00010004, None),
+    s("innerGlow/gradientSmoothness", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerGlow/innerGlowSource", 1, 0, 0x00010004, None),
+    s("innerGlow/inputRange", 1, 0, 0xffffffff, Some((1.0, 100.0))),
+    s("innerGlow/mode2", 1, 0, 0x00010004, None),
+    s("innerGlow/noise", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerGlow/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerGlow/shadingNoise", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerShadow/blur", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerShadow/chokeMatte", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerShadow/color", 4, 1, 0x0002ffff, None),
+    s("innerShadow/distance", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerShadow/localLightingAngle", 1, 0, 0xffffffff, None),
+    s("innerShadow/mode2", 1, 0, 0x00010004, None),
+    s("innerShadow/noise", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerShadow/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("innerShadow/useGlobalAngle", 1, 0, 0x00010004, None),
+    s("outerGlow/AEColorChoice", 1, 0, 0x00010004, None),
+    s("outerGlow/blur", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("outerGlow/chokeMatte", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("outerGlow/color", 4, 1, 0x0002ffff, None),
+    s("outerGlow/glowTechnique", 1, 0, 0x00010004, None),
+    s("outerGlow/gradientSmoothness", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("outerGlow/inputRange", 1, 0, 0xffffffff, Some((1.0, 100.0))),
+    s("outerGlow/mode2", 1, 0, 0x00010004, None),
+    s("outerGlow/noise", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("outerGlow/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("outerGlow/shadingNoise", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+    s("solidFill/color", 4, 1, 0x0002ffff, None),
+    s("solidFill/mode2", 1, 0, 0x00010004, None),
+    s("solidFill/opacity", 1, 0, 0xffffffff, Some((0.0, 100.0))),
+];
diff --git a/crates/aep/src/export/styles.rs b/crates/aep/src/export/styles.rs
new file mode 100644
index 000000000..4b8cb51f1
--- /dev/null
+++ b/crates/aep/src/export/styles.rs
@@ -0,0 +1,403 @@
+//! Layer styles: the inverse of the importer, through the shared table
+//! [`crate::style_map`].
+//!
+//! Every layer block already holds the `ADBE Layer Styles` group with Blending Options
+//! and the ten switch groups at rest (950). A style is applied by setting its switch group's
+//! `tdsb` to 1 and Layer Styles and Blending Options to 1 (951-960); a parameter that differs
+//! from After Effects' default gets a record, built from the table of the record
+//! After Effects writes for that parameter (`style_defs`, from 977) with the value, in After Effects'
+//! property order (970). Keys on a scalar take the keyed form of 976 (`tdb4` bytes 5, 68 and 79
+//! from it, plain 48-byte key records); an expression is stored as on an effect parameter
+//! (`tdb4@120` 1, `@119` the disabled switch, the text before `tdum`).
+//!
+//! A style switched off keeps its records with its switch group's `tdsb` 0 (988). Not written,
+//! reported: the whole Layer Styles group switched off (not sampled), gradients that differ from the default (`GCst` is not decoded), keys on
+//! colours, points, popups and checkboxes (not sampled), Knockout (After Effects has none).
+
+use std::collections::HashMap;
+
+use crate::Chunk;
+use crate::style_map::{self as sm, StyleConv, StyleParam};
+use effectcraft_keyframe::{Interp, Value};
+use effectcraft_project::build::Ids;
+use effectcraft_project::styles::{self as st, STYLE_BLEND_MODES};
+use effectcraft_project::{Comp, Layer, PropGroup, Property};
+
+use crate::export::plan::{CompPlan, EaseSlot, KeyPlan};
+use crate::export::report::{Collector, LossCategory};
+use crate::export::tree::{R, child_data, kids_mut, put_f64, put_u8, put_u32, tpl};
+
+/// A record's value.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum RecValue {
+    Static(Vec<f64>),
+    Keys(Vec<KeyPlan>),
+}
+
+/// One parameter record to write.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Record {
+    /// The full match name (`dropShadow/opacity`, `ADBE Global Angle2`).
+    pub name: String,
+    pub value: RecValue,
+    /// Expression text and its enabled switch.
+    pub expr: Option<(String, bool)>,
+}
+
+/// The layer styles of one layer.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct StylesPlan {
+    /// Applied styles (switch-group prefix) with their records and their switch, in menu order.
+    pub styles: Vec<(&'static str, Vec<Record>, bool)>,
+    /// Global Light Angle / Altitude records (Blending Options).
+    pub global: Vec<Record>,
+    /// Advanced Blending records.
+    pub adv: Vec<Record>,
+}
+
+fn sane(v: f64) -> Option<f64> {
+    (v.is_finite() && v.abs() <= crate::export::plan::LIMIT).then_some(v)
+}
+
+/// An EffectCraft value in the file's units.
+pub(crate) fn stored(conv: StyleConv, v: &Value) -> Option<Vec<f64>> {
+    let out = match (conv, v) {
+        (StyleConv::Number, Value::Scalar(x)) => vec![sane(*x)?],
+        (StyleConv::Color, Value::Color(c)) => vec![255.0, sane(c[0] * 255.0)?, sane(c[1] * 255.0)?, sane(c[2] * 255.0)?],
+        (StyleConv::Mode, Value::Enum(i)) => {
+            let name = STYLE_BLEND_MODES.get(usize::try_from(*i).ok()?)?.0;
+            vec![f64::from(sm::mode_code(name)?)]
+        }
+        (StyleConv::Popup(map), Value::Enum(i)) => vec![f64::from(sm::popup_code(map, *i)?)],
+        (StyleConv::Checkbox, Value::Bool(b)) => vec![if *b { 1.0 } else { 0.0 }],
+        (StyleConv::Vec2, Value::Vec2(p)) => vec![sane(p[0])?, sane(p[1])?],
+        _ => return None,
+    };
+    Some(out)
+}
+
+/// Whether an expression on a style popup would mean something else in After Effects. Both
+/// programs count popup items from 1 in expressions, so only a popup whose stored item numbers are
+/// not EffectCraft's items in the same order (Inner Glow Source is stored reversed) or a blend
+/// mode whose After Effects item number differs from its place in EffectCraft's list is reported.
+fn popup_expression_differs(conv: StyleConv) -> bool {
+    match conv {
+        StyleConv::Popup(map) => map.iter().enumerate().any(|(i, m)| usize::try_from(*m).ok() != Some(i)),
+        StyleConv::Mode => STYLE_BLEND_MODES.iter().enumerate().any(|(i, (name, _))| sm::mode_code(name).and_then(|c| usize::try_from(c).ok()) != Some(i + 1)),
+        _ => false,
+    }
+}
+
+fn same(a: &[f64], b: &[f64]) -> bool {
+    a.len() == b.len() && a.iter().zip(b).all(|(x, y)| (x - y).abs() <= 1e-9 * x.abs().max(1.0))
+}
+
+/// The record of one parameter, `None` when it stays at After Effects' default (no record).
+fn plan_record(spec: &StyleParam, full: String, prop: &Property, cp: &CompPlan, what: &str, col: &mut Collector) -> Option<Record> {
+    let here = format!("{what}: {full}");
+    let expr = prop.expr.as_ref().filter(|e| !e.text.is_empty()).map(|e| (e.text.clone(), e.enabled));
+    if expr.is_some() {
+        col.exported.expressions = col.exported.expressions.saturating_add(1);
+        if popup_expression_differs(spec.conv) {
+            col.lose(
+                LossCategory::LayerStyles,
+                format!("{here}: an expression on a popup whose items are in another order in After Effects means something else there (written unchanged)"),
+            );
+        }
+    }
+    if !prop.keys.is_empty() {
+        if spec.conv == StyleConv::Number {
+            let keys = plan_number_keys(prop, cp, &here, col);
+            if !keys.is_empty() {
+                return Some(Record { name: full, value: RecValue::Keys(keys), expr });
+            }
+        } else {
+            col.lose(LossCategory::LayerStyles, format!("{here}: keys are not written (not sampled for this kind), the current value is"));
+        }
+    }
+    let Some(value) = stored(spec.conv, &prop.value) else {
+        col.lose(LossCategory::InvalidValues, format!("{here}: a value that cannot be stored, After Effects' default written"));
+        return None;
+    };
+    if same(&value, spec.default) && expr.is_none() {
+        return None;
+    }
+    Some(Record { name: full, value: RecValue::Static(value), expr })
+}
+
+/// The keys of a scalar in the layer's time base: linear, hold and bezier sides with the ease in
+/// stored units per second (the plain template of 976).
+fn plan_number_keys(prop: &Property, cp: &CompPlan, what: &str, col: &mut Collector) -> Vec<KeyPlan> {
+    let mut timed: Vec<(i64, &effectcraft_keyframe::Keyframe)> = Vec::with_capacity(prop.keys.len());
+    for k in &prop.keys {
+        let (u, inexact) = cp.tb.units(k.time);
+        if inexact {
+            col.lose(LossCategory::RoundedTimes, format!("{what}: key at {:.4} s moved to the time base", k.time.seconds()));
+        }
+        timed.push((u, k));
+    }
+    timed.sort_by_key(|(u, _)| *u);
+    let before = timed.len();
+    timed.dedup_by_key(|(u, _)| *u);
+    if timed.len() != before {
+        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: keys at the same time were merged"));
+    }
+    let mut out = Vec::with_capacity(timed.len());
+    let beyond = std::cell::Cell::new(false);
+    for (u, k) in timed {
+        let (Ok(time), Some(v)) = (
+            i32::try_from(u),
+            match &k.value {
+                Value::Scalar(x) => sane(*x),
+                _ => None,
+            },
+        ) else {
+            col.lose(LossCategory::InvalidValues, format!("{what}: a key that cannot be stored, key dropped"));
+            continue;
+        };
+        let side = |i: Interp| -> u8 {
+            match i {
+                Interp::Linear => 1,
+                Interp::Bezier => 2,
+                Interp::Hold => 3,
+            }
+        };
+        let (in_i, out_i) = (side(k.in_interp), side(k.out_interp));
+        let ease = |eases: &[effectcraft_keyframe::Ease], on: bool| -> Vec<EaseSlot> {
+            if !on {
+                return vec![EaseSlot::default()];
+            }
+            let e = crate::export::plan::key_ease(eases, 0);
+            let influence = if e.influence.is_finite() { e.influence.clamp(0.001, 1.0) } else { 1.0 / 3.0 };
+            let speed = sane(e.speed).unwrap_or_else(|| {
+                beyond.set(true);
+                0.0
+            });
+            vec![EaseSlot { speed, influence }]
+        };
+        out.push(KeyPlan {
+            time,
+            value: vec![v],
+            in_interp: in_i,
+            out_interp: out_i,
+            in_ease: ease(&k.in_ease, in_i == 2),
+            out_ease: ease(&k.out_ease, out_i == 2),
+            spatial_in: [0.0; 3],
+            spatial_out: [0.0; 3],
+            spatial_auto: true,
+            roving: false,
+            label: k.label.min(16),
+        });
+        if k.roving {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: a roving key is written as a normal key"));
+        }
+    }
+    crate::export::plan::report_beyond(beyond.get(), what, col);
+    out
+}
+
+/// EffectCraft's default of a style parameter (to tell an edited gradient).
+fn model_default(style: &str, id: &str) -> Option<Value> {
+    let mut next = 1;
+    let g = st::style(&mut Ids(&mut next), style)?;
+    g.get(id).map(|p| p.value.clone())
+}
+
+/// The layer styles of `layer`; `None` when it has none applied.
+pub(crate) fn plan_styles(layer: &Layer, comp: &Comp, cp: &CompPlan, what: &str, col: &mut Collector) -> Option<StylesPlan> {
+    let ls = layer.layer_styles()?;
+    let mut plan = StylesPlan::default();
+    let groups: Vec<&PropGroup> = ls.groups().filter(|g| g.match_id != st::BLENDING).collect();
+    if groups.is_empty() {
+        return None;
+    }
+    if !layer.can_have_styles() {
+        col.lose(LossCategory::LayerStyles, format!("{what}: layer styles on a layer that takes none, not written"));
+        return None;
+    }
+    if !ls.enabled {
+        col.lose(LossCategory::LayerStyles, format!("{what}: Layer Styles switched off (the stored switch is not sampled), not written"));
+        return None;
+    }
+    for g in groups {
+        let Some(spec) = sm::by_ec(&g.match_id) else {
+            col.lose(LossCategory::LayerStyles, format!("{what}: style {} has no After Effects counterpart", g.name));
+            continue;
+        };
+        let mut recs = Vec::new();
+        for prm in spec.params {
+            let Some(prop) = g.get(prm.ec) else { continue };
+            let full = spec.param_name(prm);
+            if prm.conv == StyleConv::Gradient {
+                let edited = !prop.keys.is_empty() || prop.expr.is_some() || model_default(spec.ec, prm.ec).is_some_and(|d| d != prop.value);
+                if edited {
+                    col.lose(LossCategory::LayerStyles, format!("{what}: {full} (gradient colours are not decoded; After Effects' default gradient)"));
+                }
+                continue;
+            }
+            if let Some(r) = plan_record(prm, full, prop, cp, what, col) {
+                recs.push(r);
+            }
+        }
+        plan.styles.push((spec.ae, recs, g.enabled));
+    }
+    if plan.styles.is_empty() {
+        return None;
+    }
+    // Global Light: the composition's, on every styled layer.
+    const ANGLE: &[f64] = &[st::DEFAULT_ANGLE];
+    const ALTITUDE: &[f64] = &[st::DEFAULT_ALTITUDE];
+    for (name, p, default) in [(sm::GLOBAL_ANGLE, &comp.global_light.angle, ANGLE), (sm::GLOBAL_ALTITUDE, &comp.global_light.altitude, ALTITUDE)] {
+        let spec = StyleParam { ae: name, ec: name, conv: StyleConv::Number, default };
+        if let Some(r) = plan_record(&spec, name.to_string(), p, cp, what, col) {
+            plan.global.push(r);
+        }
+    }
+    if let Some(adv) = ls.sub(st::BLENDING).and_then(|b| b.sub("advancedBlending")) {
+        for prm in sm::ADVANCED_BLENDING {
+            if let Some(p) = adv.get(prm.ec)
+                && let Some(r) = plan_record(prm, prm.ae.to_string(), p, cp, what, col)
+            {
+                plan.adv.push(r);
+            }
+        }
+        if adv.get("knockout").is_some_and(|p| p.value != Value::Enum(0) || !p.keys.is_empty()) {
+            col.lose(LossCategory::LayerStyles, format!("{what}: Knockout (After Effects has none)"));
+        }
+    }
+    col.exported.layer_styles += plan.styles.len();
+    Some(plan)
+}
+
+// ---------------------------------------------------------------------------------------------
+// Emit.
+
+/// The style record prototypes, built in code: full match name -> (`tdmn`, `tdbs`), and
+/// the keyed scalar record.
+pub(crate) struct StyleProtos {
+    records: HashMap<String, (Chunk<'static>, Chunk<'static>)>,
+    keyed: Chunk<'static>,
+}
+
+fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let d = c.bytes()?;
+    Some(d.iter().take_while(|b| **b != 0).map(|b| char::from(*b)).collect())
+}
+
+impl StyleProtos {
+    /// The records built in code from the style table (`style_defs`); the keyed form of a scalar
+    /// takes `tdb4` bytes 5, 68 and 79 and the key list of a keyed one-component record.
+    pub(crate) fn from_table() -> StyleProtos {
+        use crate::export::synth::{KeyTemplate, RecSpec, class, tdbs, tdmn};
+        let records = crate::export::style_defs::STYLE_RECORDS
+            .iter()
+            .map(|(name, dims, template, cls, limits)| {
+                let template = if *template == 0 { KeyTemplate::Plain } else { KeyTemplate::Spatial(*template) };
+                let spec = RecSpec { dims: *dims, template, class: *cls, limits: *limits, byte5: None };
+                (name.to_string(), (tdmn(name), tdbs(&spec, false, 25_600)))
+            })
+            .collect();
+        let scalar = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::EFFECT_NUMBER, limits: Some((0.0, 100.0)), byte5: None };
+        StyleProtos { records, keyed: tdbs(&scalar, true, 25_600) }
+    }
+
+    /// The `tdmn` + `tdbs` of one record.
+    fn build(&self, r: &Record) -> R<[Chunk<'static>; 2]> {
+        let (m, proto) = self.records.get(&r.name).ok_or_else(|| tpl("style record prototype missing"))?;
+        let mut rec = proto.clone();
+        match &r.value {
+            RecValue::Static(v) => {
+                let cdat = child_data(&mut rec, b"cdat")?;
+                cdat.iter_mut().for_each(|b| *b = 0);
+                for (i, x) in v.iter().enumerate() {
+                    put_f64(cdat, i * 8, *x)?;
+                }
+            }
+            RecValue::Keys(keys) => {
+                let ktdb4 = self.keyed.child(b"tdb4").and_then(|c| c.bytes()).ok_or_else(|| tpl("keyed style prototype without tdb4"))?;
+                {
+                    let tdb4 = child_data(&mut rec, b"tdb4")?;
+                    for at in [5usize, 68, 79] {
+                        put_u8(tdb4, at, *ktdb4.get(at).ok_or_else(|| tpl("short tdb4"))?)?;
+                    }
+                }
+                let mut list = self.keyed.child_list(b"list").cloned().ok_or_else(|| tpl("keyed style prototype without keys"))?;
+                let n = u32::try_from(keys.len()).map_err(|_| tpl("too many keys"))?;
+                let size = 48usize;
+                {
+                    let lhd3 = child_data(&mut list, b"lhd3")?;
+                    crate::export::synth::put_key_counts(lhd3, n, 48)?;
+                }
+                let mut ldat = Vec::with_capacity(size * keys.len());
+                for k in keys {
+                    ldat.extend(crate::export::emit::plain_record(1, k, size)?);
+                }
+                {
+                    let lk = kids_mut(&mut list)?;
+                    match lk.iter_mut().find(|c| c.is(b"ldat")) {
+                        Some(c) => *c = Chunk::data(*b"ldat", ldat),
+                        None => lk.push(Chunk::data(*b"ldat", ldat)),
+                    }
+                }
+                let kids = kids_mut(&mut rec)?;
+                let at = kids.iter().position(|c| c.is(b"cdat")).ok_or_else(|| tpl("style record without cdat"))?;
+                if let Some(slot) = kids.get_mut(at) {
+                    *slot = list;
+                }
+            }
+        }
+        if let Some((text, enabled)) = &r.expr {
+            {
+                let tdb4 = child_data(&mut rec, b"tdb4")?;
+                put_u8(tdb4, 120, 1)?;
+                put_u8(tdb4, 119, u8::from(!*enabled))?;
+            }
+            let kids = kids_mut(&mut rec)?;
+            let at = kids.iter().position(|c| c.is(b"tdum")).unwrap_or(kids.len());
+            kids.insert(at, Chunk::data(*b"Utf8", text.as_bytes().to_vec()));
+        }
+        Ok([m.clone(), rec])
+    }
+}
+
+/// The node after the `tdmn` named `name` among `kids`.
+fn named_mut<'a>(kids: &'a mut [Chunk<'static>], name: &str) -> R<&'a mut Chunk<'static>> {
+    let i = kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(name)).ok_or_else(|| tpl("layer styles group incomplete"))?;
+    kids.get_mut(i + 1).ok_or_else(|| tpl("layer styles group incomplete"))
+}
+
+fn set_flags(g: &mut Chunk<'static>, flags: u32) -> R<()> {
+    put_u32(child_data(g, b"tdsb")?, 0, flags)
+}
+
+/// Inserts `recs` before the `tdmn` named `before` (or before `ADBE Group End`).
+fn insert_records(protos: &StyleProtos, g: &mut Chunk<'static>, recs: &[Record], before: &str) -> R<()> {
+    let mut built = Vec::with_capacity(recs.len() * 2);
+    for r in recs {
+        built.extend(protos.build(r)?);
+    }
+    let kids = kids_mut(g)?;
+    let at = kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(before)).ok_or_else(|| tpl("layer styles group incomplete"))?;
+    kids.splice(at..at, built);
+    Ok(())
+}
+
+/// Applies `plan` to the layer's `ADBE Layer Styles` group.
+pub(crate) fn put_styles(protos: &StyleProtos, layr: &mut Chunk<'static>, plan: &StylesPlan) -> R<()> {
+    let root = crate::export::tree::list_mut(layr, b"tdgp")?;
+    let ls = named_mut(kids_mut(root)?, sm::GROUP)?;
+    set_flags(ls, sm::FLAGS_ON)?;
+    {
+        let bo = named_mut(kids_mut(ls)?, sm::BLEND_OPTIONS)?;
+        set_flags(bo, sm::FLAGS_ON)?;
+        insert_records(protos, bo, &plan.global, sm::ADV_BLEND)?;
+        let adv = named_mut(kids_mut(bo)?, sm::ADV_BLEND)?;
+        insert_records(protos, adv, &plan.adv, "ADBE Group End")?;
+    }
+    for (prefix, recs, on) in &plan.styles {
+        let g = named_mut(kids_mut(ls)?, &format!("{prefix}/enabled"))?;
+        set_flags(g, if *on { sm::FLAGS_ON } else { sm::FLAGS_OFF })?;
+        insert_records(protos, g, recs, "ADBE Group End")?;
+    }
+    Ok(())
+}
diff --git a/crates/aep/src/export/synth.rs b/crates/aep/src/export/synth.rs
new file mode 100644
index 000000000..07d75c194
--- /dev/null
+++ b/crates/aep/src/export/synth.rs
@@ -0,0 +1,215 @@
+//! Chunks the exporter builds in code instead of copying them from projects After Effects saved.
+//!
+//! Every byte written here is a decoded field (`docs/aep-format.md`), a named constant with its
+//! evidence, or zero where After Effects was shown to accept zero (the read-backs listed in
+//! `docs/aep-export.md`, "Built in code").
+
+use crate::{Body, Chunk};
+
+/// `tdmn`: a match name padded to 40 bytes.
+pub(crate) fn tdmn(name: &str) -> Chunk<'static> {
+    let mut b = vec![0u8; 40];
+    for (slot, c) in b.iter_mut().zip(name.bytes().take(39)) {
+        *slot = c;
+    }
+    Chunk::data(*b"tdmn", b)
+}
+
+/// The user name of a property that has none (`-_0_/-`, aep-format.md 3.4).
+pub(crate) const NO_NAME: &str = "-_0_/-";
+
+/// `tdsn`: the user name, a nested chunk holding one `Utf8`.
+pub(crate) fn tdsn(name: &str) -> Chunk<'static> {
+    Chunk { id: *b"tdsn", body: Body::Chunks(vec![Chunk::data(*b"Utf8", name.as_bytes().to_vec())]), pad: None }
+}
+
+/// How a property's keys are stored (`tdb4` byte 7, aep-format.md 3.5).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum KeyTemplate {
+    /// Value and type-major ease doubles: Opacity, Rotation, Scale, sliders.
+    Plain,
+    /// Ease, value and tangents; byte 7 is 3 on positions and points, 1 on colours and paths.
+    Spatial(u8),
+}
+
+/// The u32 at `tdb4` bytes 8..11. Its two u16 halves follow the kind of property (aep-format.md
+/// 3.4, "class word"); without it After Effects drops a property's keys (read-back e1-bz5).
+pub(crate) mod class {
+    /// Transform Scale, Rotation and Opacity; the other one-dimensional layer properties.
+    pub const LAYER_SCALAR: u32 = 0x0001_ffff;
+    /// Positions and points (spatial, no limits); effect sliders and angles.
+    pub const SPATIAL: u32 = 0xffff_ffff;
+    /// Effect sliders (integer, fixed, float) and angles.
+    pub const EFFECT_NUMBER: u32 = 0xffff_ffff;
+    /// Effect checkboxes and popups.
+    pub const EFFECT_CHOICE: u32 = 0x0001_0004;
+    /// Colours.
+    pub const COLOR: u32 = 0x0002_ffff;
+    /// Effect layer parameters, groups and buttons.
+    pub const EFFECT_OTHER: u32 = 0x0001_0000;
+    /// Arbitrary data (Hue/Saturation, Levels, Curves, Mesh Warp).
+    pub const ARBITRARY: u32 = 0x0006_0007;
+    /// Mask and shape paths.
+    pub const PATH: u32 = 0x0002_0007;
+}
+
+/// Byte 5 bits 1..3 of a spatial property, next to the static bit 0: `0x0e` on positions and
+/// points (`0x0f` static, `0x0e` keyed: Anchor Point, Position, Gradient Ramp's points), `0x06` on
+/// colours (`0x07` / `0x06`: Tint's colours). Meaning not decoded.
+fn spatial_byte5(template: u8) -> u8 {
+    if template == 3 { 0x0e } else { 0x06 }
+}
+
+/// What a property record needs to know about its property.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct RecSpec {
+    /// Components of a value (`tdb4` byte 3).
+    pub dims: u8,
+    pub template: KeyTemplate,
+    /// `tdb4` bytes 8..11 (see [`class`]).
+    pub class: u32,
+    /// `tdum` / `tduM`, written when the property has them (Scale `0, 0`, Opacity `0, 100`).
+    pub limits: Option<(f64, f64)>,
+    /// `tdb4` byte 5 of the static record when it is not the one [`tdb4`] derives (bits 1..3 are
+    /// not decoded; the keyed record clears bit 0).
+    pub byte5: Option<u8>,
+}
+
+impl RecSpec {
+    /// Bytes of a static value (`cdat`): the key record without its 8-byte header, value first,
+    /// the rest zero (aep-format.md 3.4 / 3.5: `40 n` plain, `24 n` spatial).
+    pub fn cdat_len(&self) -> usize {
+        let n = usize::from(self.dims);
+        match self.template {
+            KeyTemplate::Plain => 40 * n,
+            KeyTemplate::Spatial(_) => 24 * n,
+        }
+    }
+
+    /// Bytes of one key record (aep-format.md 3.5).
+    pub fn key_len(&self) -> usize {
+        let n = usize::from(self.dims);
+        match self.template {
+            KeyTemplate::Plain => 8 + 40 * n,
+            KeyTemplate::Spatial(_) => 56 + 24 * n,
+        }
+    }
+}
+
+/// The 124-byte `tdb4` header of a property (aep-format.md 3.4). The decoded bytes, the class
+/// word and the constant doubles at 16..56 are written; After Effects reads the other bytes as
+/// zero (read-back e1-ztdb4d).
+pub(crate) fn tdb4(spec: &RecSpec, keyed: bool, time_scale: u32) -> Vec<u8> {
+    let mut b = vec![0u8; 124];
+    let set = |b: &mut Vec<u8>, at: usize, bytes: &[u8]| {
+        if let Some(dst) = b.get_mut(at..at + bytes.len()) {
+            dst.copy_from_slice(bytes);
+        }
+    };
+    set(&mut b, 0, &[0xdb, 0x99, 0x00, spec.dims]);
+    let spatial = match spec.template {
+        KeyTemplate::Plain => 0,
+        KeyTemplate::Spatial(t) => t,
+    };
+    let byte5 = match spec.byte5 {
+        Some(b) => (b & !0x01) | u8::from(!keyed),
+        None => (if spatial == 0 { 0 } else { spatial_byte5(spatial) }) | u8::from(!keyed),
+    };
+    set(&mut b, 5, &[byte5]);
+    set(&mut b, 7, &[spatial]);
+    set(&mut b, 8, &spec.class.to_be_bytes());
+    set(&mut b, 12, &time_scale.to_be_bytes());
+    // Every record After Effects writes carries 0.0001 and four 1.0 here; without them a roving
+    // key reads back at time zero instead of its retimed place (read-back s14-re-keyframes).
+    set(&mut b, 16, &1e-4f64.to_be_bytes());
+    for at in [24, 32, 40, 48] {
+        set(&mut b, at, &1.0f64.to_be_bytes());
+    }
+    set(&mut b, 68, &[u8::from(keyed)]);
+    // Set on a static spatial property, cleared once it is keyed (aep-format.md 3.4, byte 79).
+    set(&mut b, 79, &[u8::from(spatial != 0 && !keyed)]);
+    b
+}
+
+/// A key list (`LIST list`: `lhd3` + `ldat`) of `count` records of `size` bytes (aep-format.md
+/// 3.5): word 0 `0x00d00bee`, word 2 the count, word 3 the blocks of four (at least one), word 4
+/// the size, words 5 and 7 the capacity (the count rounded up to four, at least two), word 6 one.
+pub(crate) fn key_list(size: u32, count: u32, records: Vec<u8>) -> Chunk<'static> {
+    let mut lhd3 = vec![0u8; 52];
+    // Cannot fail: the header is 52 bytes.
+    let _ = crate::export::tree::put_u32(&mut lhd3, 0, 0x00d0_0bee);
+    let _ = crate::export::tree::put_u32(&mut lhd3, 24, 1);
+    let _ = put_key_counts(&mut lhd3, count, size);
+    Chunk::list(*b"list", vec![Chunk::data(*b"lhd3", lhd3), Chunk::data(*b"ldat", records)])
+}
+
+/// Sets the count words of a key list header for `count` keys of `size` bytes.
+pub(crate) fn put_key_counts(lhd3: &mut [u8], count: u32, size: u32) -> crate::export::tree::R<()> {
+    let capacity = count.div_ceil(4).saturating_mul(4).max(2);
+    put_counts(lhd3, count, count.div_ceil(4).max(1), size, capacity, capacity)
+}
+
+/// Sets the count words of a list header: word 2 the record count, word 3 `blocks`, word 4 the
+/// record size, word 5 `w5`, word 7 the capacity. A key list has `w5` = the capacity; a path
+/// list counts vertices: `blocks` = `w5` = the vertex count, the capacity four times it (090:
+/// 12 points, 4, 4 and 16; aep-format.md 3.5).
+pub(crate) fn put_counts(lhd3: &mut [u8], count: u32, blocks: u32, size: u32, w5: u32, capacity: u32) -> crate::export::tree::R<()> {
+    use crate::export::tree::put_u32;
+    put_u32(lhd3, 8, count)?;
+    put_u32(lhd3, 12, blocks)?;
+    put_u32(lhd3, 16, size)?;
+    put_u32(lhd3, 20, w5)?;
+    put_u32(lhd3, 28, capacity)
+}
+
+/// A property record (`LIST tdbs`) with a zero static value or an empty key list, for the
+/// exporter to fill: `tdsb` 1 (written), no user name, the header, then `cdat` or the key list,
+/// then the limits.
+pub(crate) fn tdbs(spec: &RecSpec, keyed: bool, time_scale: u32) -> Chunk<'static> {
+    let mut kids = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec()), tdsn(NO_NAME), Chunk::data(*b"tdb4", tdb4(spec, keyed, time_scale))];
+    if keyed {
+        kids.push(key_list(u32::try_from(spec.key_len()).unwrap_or(u32::MAX), 0, Vec::new()));
+    } else {
+        kids.push(Chunk::data(*b"cdat", vec![0u8; spec.cdat_len()]));
+    }
+    if let Some((lo, hi)) = spec.limits {
+        kids.push(Chunk::data(*b"tdum", lo.to_be_bytes().to_vec()));
+        kids.push(Chunk::data(*b"tduM", hi.to_be_bytes().to_vec()));
+    }
+    Chunk::list(*b"tdbs", kids)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_record_has_the_decoded_layout() {
+        let pos = RecSpec { dims: 3, template: KeyTemplate::Spatial(3), class: class::SPATIAL, limits: None, byte5: None };
+        let h = tdb4(&pos, false, 25_600);
+        assert_eq!(&h[..8], &[0xdb, 0x99, 0, 3, 0, 0x0f, 0, 3]);
+        assert_eq!(&h[8..16], &[0xff, 0xff, 0xff, 0xff, 0, 0, 0x64, 0]);
+        assert_eq!((h[68], h[79]), (0, 1));
+        // A roving key needs these to keep its time (read-back s14-re-keyframes).
+        assert_eq!(&h[16..24], &1e-4f64.to_be_bytes());
+        assert!(h[24..56].chunks(8).all(|d| d == 1.0f64.to_be_bytes()));
+        assert_eq!(pos.cdat_len(), 72);
+        assert_eq!(pos.key_len(), 128);
+        let opacity = RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::LAYER_SCALAR, limits: Some((0.0, 100.0)), byte5: None };
+        let k = tdb4(&opacity, true, 25_600);
+        assert_eq!((k[5], k[7], k[68]), (0, 0, 1));
+        let rec = tdbs(&opacity, false, 25_600);
+        let ids: Vec<[u8; 4]> = rec.children().iter().map(|c| c.id).collect();
+        assert_eq!(ids, [*b"tdsb", *b"tdsn", *b"tdb4", *b"cdat", *b"tdum", *b"tduM"]);
+        assert_eq!(rec.child(b"cdat").and_then(|c| c.bytes()).map(<[u8]>::len), Some(40));
+    }
+
+    #[test]
+    fn a_key_list_header_counts_and_rounds() {
+        let l = key_list(48, 5, vec![0; 240]);
+        let h = l.child(b"lhd3").and_then(|c| c.bytes()).unwrap();
+        let w = |i: usize| u32::from_be_bytes(h[i * 4..i * 4 + 4].try_into().unwrap());
+        assert_eq!((w(0), w(2), w(3), w(4), w(5), w(6), w(7)), (0x00d0_0bee, 5, 2, 48, 8, 1, 8));
+        assert_eq!(h.len(), 52);
+    }
+}
diff --git a/crates/aep/src/export/template.rs b/crates/aep/src/export/template.rs
new file mode 100644
index 000000000..91daba636
--- /dev/null
+++ b/crates/aep/src/export/template.rs
@@ -0,0 +1,162 @@
+//! The prototypes the exporter clones and edits, all built in code: the project skeleton
+//! (`base`), the layer blocks (`skeleton`, `tree_defs`), and the records of Transform, masks,
+//! effects, layer styles, footage, text and text animators (see `docs/aep-export.md`). Nothing is
+//! read from a file After Effects wrote; each layout was checked by After Effects reading the
+//! export back.
+
+use crate::{AepFile, Chunk};
+
+use crate::export::tree::{R, tpl};
+
+/// The chunks cloned by the exporter.
+pub(crate) struct Template {
+    /// The whole base project; its `Fold` children are replaced by the export.
+    pub file: AepFile<'static>,
+    /// The base composition item without its layer blocks.
+    pub comp_shell: Chunk<'static>,
+    /// Index in the shell's children where the layer blocks go.
+    pub layer_at: usize,
+    /// `Layr`, `Ewst` and the f-records that follow the layer `L`.
+    pub layer_block: Vec<Chunk<'static>>,
+    /// The footage item of the solid `L` (inside `Solids`).
+    pub solid_item: Chunk<'static>,
+    /// The `Solids` folder item.
+    pub folder_item: Chunk<'static>,
+    /// The f-records that follow a footage item inside a folder.
+    pub fset: Vec<Chunk<'static>>,
+    /// The `FEE ` list that follows a composition item.
+    pub fee: Chunk<'static>,
+    /// `tdmn`, `tdbs` pairs of the five Transform properties with a static value.
+    pub stat: Vec<Chunk<'static>>,
+    /// The same with two keys.
+    pub keyd: Vec<Chunk<'static>>,
+    /// The layer block of a null layer.
+    pub null_block: Vec<Chunk<'static>>,
+    /// The hidden solid item of a null layer.
+    pub null_item: Chunk<'static>,
+    /// The mask prototypes (fixtures 091, 093, 208).
+    pub masks: crate::export::masks::MaskProtos,
+    /// The effect prototypes (cases 356-397).
+    pub effects: crate::export::effects::FxProtos,
+    /// The footage item prototypes (cases 351, 353, 603-607).
+    pub footage: crate::export::footage::FtProtos,
+    /// The layer blocks of a point (110) and a box (245) text layer.
+    pub text_point: Vec<Chunk<'static>>,
+    pub text_box: Vec<Chunk<'static>>,
+    /// The text animator prototypes (579, 580-592, 728).
+    pub anims: crate::export::textanim::AnimProtos,
+    /// The marker group (`tdmn ADBE Marker` + `LIST mrst`) of fixture 249.
+    pub marker_group: Vec<Chunk<'static>>,
+    /// The layer blocks of a two-node camera (256), a spot (254) and a point light (252).
+    pub camera_block: Vec<Chunk<'static>>,
+    pub spot_block: Vec<Chunk<'static>>,
+    pub point_block: Vec<Chunk<'static>>,
+    /// Camera and light option records (342-345, 254).
+    pub options: crate::export::camlight::OptionProtos,
+    /// Shape layer, item and record prototypes (519, 240, 451-471, 239, 242).
+    pub shapes: crate::export::shapes::ShapeProtos,
+    /// Layer-style record prototypes (977, 976).
+    pub styles: crate::export::styles::StyleProtos,
+}
+
+/// The `tdmn`, `tdbs` pairs of the five Transform properties, static or keyed, built in code
+/// (aep-format.md 3.4): Anchor Point and Position spatial, Scale, Rotation and Opacity plain;
+/// Scale and Opacity carry their limits.
+fn transform_records(keyed: bool) -> Vec<Chunk<'static>> {
+    use crate::export::plan::PropKind;
+    use crate::export::synth::{KeyTemplate, RecSpec, class};
+    PropKind::ALL
+        .iter()
+        .flat_map(|k| {
+            let spec = match k {
+                PropKind::Anchor | PropKind::Position => {
+                    RecSpec { dims: 3, template: KeyTemplate::Spatial(3), class: class::SPATIAL, limits: None, byte5: None }
+                }
+                PropKind::Scale => RecSpec { dims: 3, template: KeyTemplate::Plain, class: class::LAYER_SCALAR, limits: Some((0.0, 0.0)), byte5: None },
+                PropKind::Rotation => RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::LAYER_SCALAR, limits: None, byte5: None },
+                PropKind::Opacity => RecSpec { dims: 1, template: KeyTemplate::Plain, class: class::LAYER_SCALAR, limits: Some((0.0, 100.0)), byte5: None },
+            };
+            [crate::export::synth::tdmn(k.match_name()), crate::export::synth::tdbs(&spec, keyed, 25_600)]
+        })
+        .collect()
+}
+
+impl Template {
+    pub fn load() -> R<Template> {
+        let file = AepFile { chunks: crate::export::base::project_chunks(), trailer: std::borrow::Cow::Borrowed(&[]) };
+        let fee = crate::export::base::fee();
+        let fset = crate::export::skeleton::f_records();
+        let folder_item = crate::export::base::folder_item();
+        let solid_item = crate::export::base::solid_item();
+        let (comp_shell, first) = crate::export::base::comp_shell();
+        let layer_block = crate::export::skeleton::av_layer();
+        let stat = transform_records(false);
+        let keyd = transform_records(true);
+        // A null layer has the AV layer's block; `ldta` marks it (byte 38 bit 0x80).
+        let null_block = crate::export::skeleton::av_layer();
+        // The hidden solid of a null layer is an ordinary solid item (022).
+        let null_item = crate::export::base::solid_item();
+        let masks = crate::export::masks::MaskProtos::build();
+        let effects = crate::export::effects::FxProtos::build();
+        let styles = crate::export::styles::StyleProtos::from_table();
+        let footage = crate::export::footage::FtProtos::build();
+        // Point (110) and box (245) text layers with a document built in code.
+        use crate::export::{textdoc, textproto};
+        let text_point = crate::export::skeleton::text_layer(&textdoc::write(&textproto::document(false)));
+        let text_box = crate::export::skeleton::text_layer(&textdoc::write(&textproto::document(true)));
+        let anims = crate::export::textanim::AnimProtos {
+            group: crate::export::tree_spec::build(crate::export::tree_defs::TEXT_ANIMATORS),
+            animator: crate::export::tree_spec::build(crate::export::tree_defs::TEXT_ANIMATOR),
+            records: crate::export::skeleton::pairs(crate::export::tree_defs::TEXT_ANIMATOR_RECORDS),
+        };
+        let marker_group = crate::export::skeleton::marker_group();
+        use crate::export::{skeleton, tree_defs};
+        let camera_block = skeleton::layer_block(tree_defs::CAMERA_ROOT);
+        let spot_block = skeleton::layer_block(tree_defs::SPOT_ROOT);
+        let point_block = skeleton::layer_block(tree_defs::POINT_ROOT);
+        let records = skeleton::pairs(tree_defs::OPTIONS).into_iter().map(|(name, [_, node])| (name, node)).collect();
+        let options = crate::export::camlight::OptionProtos { records };
+        // The key list of the keyed Opacity prototype (one-component plain keys; its header is
+        // rewritten for every keyed shape property).
+        let key_list = keyd
+            .iter()
+            .rev()
+            .find(|c| c.is_list(b"tdbs"))
+            .and_then(|c| c.child_list(b"list"))
+            .cloned()
+            .ok_or_else(|| tpl("keyed prototype without a key list"))?;
+        let shapes = crate::export::shapes::ShapeProtos {
+            block: skeleton::layer_block(tree_defs::SHAPE_ROOT),
+            items: skeleton::pairs(tree_defs::SHAPE_ITEMS),
+            records: skeleton::pairs(tree_defs::SHAPE_RECORDS),
+            key_list,
+        };
+        Ok(Template {
+            file,
+            comp_shell,
+            layer_at: first,
+            layer_block,
+            solid_item,
+            folder_item,
+            fset,
+            fee,
+            stat,
+            keyd,
+            null_block,
+            null_item,
+            masks,
+            effects,
+            footage,
+            text_point,
+            text_box,
+            anims,
+            marker_group,
+            camera_block,
+            spot_block,
+            point_block,
+            options,
+            shapes,
+            styles,
+        })
+    }
+}
diff --git a/crates/aep/src/export/text.rs b/crates/aep/src/export/text.rs
new file mode 100644
index 000000000..815a89c83
--- /dev/null
+++ b/crates/aep/src/export/text.rs
@@ -0,0 +1,562 @@
+//! Text layers: the layer block of a point (110) or box (245) text layer, built in code
+//! (`skeleton::text_layer`, `textproto`), with its text document rewritten from the layer's Source
+//! Text (`docs/aep-format.md` 3.10, `docs/aep-export.md` R32-R34):
+//!
+//! * the text (paragraphs end with `\r`, the last one too), the paragraph runs with their
+//!   justification, the style runs with font, size, faux bold / italic, automatic or explicit
+//!   leading, tracking, caps, fill and stroke colour;
+//! * fonts other than the prototype's are appended to the font list (its own entries, which the
+//!   rest of the document refers to by index, keep their places);
+//! * a box text's frame (16 points tracing the rectangle, 245);
+//! * the composed layout (`/1/1[0]/1/2`) is left empty: After Effects lays the text out again
+//!   when it opens the project (t1-t3).
+
+use effectcraft_keyframe::Value;
+use effectcraft_keyframe::text_doc::{BaselineOption, Composer, Direction, Justify, Kerning, TextDoc};
+use effectcraft_project::{Layer, Node, PropGroup};
+
+use crate::export::report::{Collector, LossCategory};
+use crate::export::textdoc::{TNode, boolean, int, number, string};
+
+/// The prototype's own font (index 0 of its font list).
+const PROTO_FONT: &str = "TimesNewRomanPSMT";
+/// The longest text written (characters).
+const MAX_CHARS: usize = 1 << 20;
+
+/// One style run in the file's terms.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct StyleOut {
+    pub font: String,
+    pub size: f64,
+    pub fill: [f64; 3],
+    pub stroke: [f64; 3],
+    pub tracking: f64,
+    /// `None` = automatic leading.
+    pub leading: Option<f64>,
+    pub faux_bold: bool,
+    pub faux_italic: bool,
+    /// 0 normal, 1 small caps, 2 all caps.
+    pub caps: i64,
+    /// Style slot `/13`: 0 normal, 1 superscript, 2 subscript (526-528).
+    pub script: i64,
+    /// Slots `/6` and `/7`: horizontal and vertical scale as factors (539, 540).
+    pub h_scale: f64,
+    pub v_scale: f64,
+    /// Slot `/9`: baseline shift in pixels.
+    pub baseline_shift: f64,
+    /// Slot `/11`: automatic kerning, 0 none, 1 metrics, 2 optical (541-543).
+    pub auto_kern: i64,
+    /// Slot `/18`: standard ligatures (555).
+    pub ligatures: bool,
+    /// Slot `/36`: tsume as a fraction (553).
+    pub tsume: f64,
+    /// Slots `/56`, `/57`: whether fill and stroke are drawn (544-546).
+    pub apply_fill: bool,
+    pub apply_stroke: bool,
+    /// Slot `/63`: stroke width in pixels; `None` keeps the prototype's value.
+    pub stroke_width: Option<f64>,
+    /// Slot `/58`: stroke over fill (one switch for the whole text in EffectCraft; 550).
+    pub stroke_over_fill: bool,
+}
+
+/// One paragraph in the file's terms (paragraph dictionary `RUN/5/0[n]/0/0/5`).
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ParaOut {
+    /// `/0`: 0 left, 1 right, 2 centre, 3-6 justified with the last line left / right / centre /
+    /// justified.
+    pub justify: i64,
+    /// `/1` first-line indent, `/2` start indent, `/3` end indent, `/4` space before, `/5` space
+    /// after, in pixels.
+    pub indents: [f64; 5],
+    /// `/21`: Roman hanging punctuation (558).
+    pub hanging: bool,
+    /// `/29`: the every-line composer (557, 559).
+    pub every_line: bool,
+    /// `/33`: 0 left to right, 1 right to left (569).
+    pub direction: i64,
+}
+
+/// A text document in the file's terms.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct TextPlan {
+    /// The stored text: paragraphs separated and ended by `\r`.
+    pub text: String,
+    /// (characters, style), covering the text including the final `\r`.
+    pub runs: Vec<(usize, StyleOut)>,
+    /// (characters including the `\r`, paragraph settings).
+    pub paras: Vec<(usize, ParaOut)>,
+    /// Box text: left, top, width, height in layer pixels.
+    pub frame: Option<[f64; 4]>,
+    /// The text animators (planned with the layer's time base, `textanim.rs`).
+    pub animators: Vec<crate::export::textanim::AnimPlan>,
+}
+
+/// Where a text value is written, for the loss report.
+struct At<'a, 'c> {
+    what: &'a str,
+    col: &'c mut Collector,
+}
+
+impl At<'_, '_> {
+    /// `v` limited to `lo..=hi` (a value that is not a number becomes `default`); a change is reported.
+    fn fit(&mut self, v: f64, (lo, hi): (f64, f64), default: f64, field: &str) -> f64 {
+        let out = if v.is_finite() { v.clamp(lo, hi) } else { default };
+        if out.to_bits() != v.to_bits() {
+            self.col.lose(LossCategory::TextLayers, format!("{}: {field} {v} is outside {lo} to {hi}, written as {out}", self.what));
+        }
+        out
+    }
+
+    /// The colour channels limited to 0..1, without alpha (a text colour in After Effects has none);
+    /// a change is reported.
+    fn rgb(&mut self, c: [f32; 4], field: &str) -> [f64; 3] {
+        let [r, g, b, a] = c.map(f64::from);
+        if a.to_bits() != 1f64.to_bits() {
+            self.col.lose(LossCategory::TextLayers, format!("{}: the {field} opacity {a} is not written (text colours have no alpha)", self.what));
+        }
+        let name = format!("{field} channel");
+        [self.fit(r, (0.0, 1.0), 0.0, &name), self.fit(g, (0.0, 1.0), 0.0, &name), self.fit(b, (0.0, 1.0), 0.0, &name)]
+    }
+}
+
+/// Plans the text of a text layer and reports what the document cannot hold.
+pub(crate) fn plan_text(layer: &Layer, comp_name: &str, col: &mut Collector) -> Option<TextPlan> {
+    let what = format!("{comp_name}: '{}'", layer.name);
+    let Some(text) = layer.props.sub("text") else {
+        col.lose(LossCategory::TextLayers, format!("{what}: a text layer without text properties"));
+        return None;
+    };
+    let Some(st) = text.prop("sourceText") else {
+        col.lose(LossCategory::TextLayers, format!("{what}: a text layer without Source Text"));
+        return None;
+    };
+    if !st.keys.is_empty() {
+        col.lose(LossCategory::TextLayers, format!("{what}: Source Text keyframes are not written (the first key's text is)"));
+    }
+    if st.has_expression() {
+        col.lose(LossCategory::TextLayers, format!("{what}: the Source Text expression is not written"));
+    }
+    let value = st.keys.first().map(|k| &k.value).unwrap_or(&st.value);
+    let Value::Text(doc) = value else {
+        col.lose(LossCategory::TextLayers, format!("{what}: Source Text holds no text document"));
+        return None;
+    };
+    report_extras(text, &what, col);
+    Some(plan_doc(doc, &what, col))
+}
+
+/// Path / More Options that hold anything other than a new text layer's defaults are not
+/// written (animators are, `textanim.rs`).
+fn report_extras(text: &PropGroup, what: &str, col: &mut Collector) {
+    let mut next = 1u64;
+    let reference = effectcraft_project::build::text(&mut effectcraft_project::build::Ids(&mut next), TextDoc::default());
+    for node in &text.children {
+        let Node::Group(g) = node else { continue };
+        match g.match_id.as_str() {
+            "pathOptions" | "moreOptions" => {
+                let def = reference.children.iter().find_map(|n| match n {
+                    Node::Group(r) if r.match_id == g.match_id => Some(r),
+                    _ => None,
+                });
+                if differs(g, def, 0) {
+                    col.lose(LossCategory::TextLayers, format!("{what}: {} are not written", g.name));
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Whether `g` holds keys, expressions or values other than those of `def` (the same group of a
+/// new text layer).
+fn differs(g: &PropGroup, def: Option<&PropGroup>, depth: usize) -> bool {
+    if depth > 32 {
+        return true;
+    }
+    g.children.iter().any(|n| match n {
+        Node::Group(s) => {
+            let d = def.and_then(|d| {
+                d.children.iter().find_map(|x| match x {
+                    Node::Group(r) if r.match_id == s.match_id => Some(r),
+                    _ => None,
+                })
+            });
+            differs(s, d, depth + 1)
+        }
+        Node::Prop(p) => {
+            let d = def.and_then(|d| d.prop(&p.match_id));
+            !p.keys.is_empty() || p.has_expression() || d.is_none_or(|d| d.value != p.value)
+        }
+    })
+}
+
+fn plan_doc(doc: &TextDoc, what: &str, col: &mut Collector) -> TextPlan {
+    let base = doc.base_style();
+    let runs = doc.runs();
+    // Characters in EffectCraft's text, each with its run, CRLF and LF made After Effects' CR.
+    let chars: Vec<char> = doc.text.chars().collect();
+    let mut style_of: Vec<usize> = Vec::with_capacity(chars.len());
+    for (ri, r) in runs.iter().enumerate() {
+        style_of.extend(std::iter::repeat_n(ri, r.len));
+    }
+    let mut text = String::with_capacity(doc.text.len() + 1);
+    let mut out_style: Vec<usize> = Vec::new();
+    let mut i = 0;
+    while i < chars.len() && out_style.len() < MAX_CHARS {
+        let c = chars.get(i).copied().unwrap_or(' ');
+        let ri = style_of.get(i).copied().unwrap_or(runs.len().saturating_sub(1));
+        if c == '\r' && chars.get(i + 1) == Some(&'\n') {
+            i += 1;
+        }
+        text.push(if c == '\n' { '\r' } else { c });
+        out_style.push(ri);
+        i += 1;
+    }
+    if i < chars.len() {
+        col.lose(LossCategory::TextLayers, format!("{what}: the text is longer than {MAX_CHARS} characters and was cut"));
+    }
+    // The final paragraph end belongs to the last run.
+    text.push('\r');
+    out_style.push(out_style.last().copied().unwrap_or(0));
+
+    let mut styles: Vec<StyleOut> = Vec::with_capacity(runs.len().max(1));
+    for r in &runs {
+        styles.push(style_out(&r.style, what, col));
+    }
+    if styles.is_empty() {
+        styles.push(style_out(&base, what, col));
+    }
+    for st in &mut styles {
+        st.stroke_over_fill = doc.stroke_over_fill;
+    }
+    let mut out_runs: Vec<(usize, StyleOut)> = Vec::new();
+    for ri in out_style {
+        let s = styles.get(ri).or(styles.last()).cloned();
+        let Some(s) = s else { continue };
+        match out_runs.last_mut() {
+            Some((n, last)) if *last == s => *n += 1,
+            _ => out_runs.push((1, s)),
+        }
+    }
+
+    let paras_in = doc.paras();
+    let mut paras = Vec::new();
+    for (pi, part) in text.split_inclusive('\r').enumerate() {
+        let len = part.chars().count();
+        // A paragraph without its own settings takes the document's (every-line composer by
+        // default, as a new text in After Effects' Paragraph panel).
+        let base = doc.base_para();
+        let p = paras_in.get(pi).or(paras_in.last()).unwrap_or(&base);
+        // The stored code is relative to the direction: right-to-left swaps left / right and
+        // the two justified variants with a left / right last line (t7, as the importer).
+        let rtl = p.direction == Direction::Rtl;
+        let j = match p.justify {
+            Justify::Left if rtl => 1,
+            Justify::Right if rtl => 0,
+            Justify::JustifyLastLeft if rtl => 4,
+            Justify::JustifyLastRight if rtl => 3,
+            Justify::Left => 0,
+            Justify::Right => 1,
+            Justify::Center => 2,
+            // The justified variants, as the importer reads them (paragraph `/0`, 3-6).
+            Justify::JustifyLastLeft => 3,
+            Justify::JustifyLastRight => 4,
+            Justify::JustifyLastCenter => 5,
+            Justify::JustifyAll => 6,
+        };
+        let mut at = At { what, col: &mut *col };
+        let mut px = |v: f64, field: &str| at.fit(v, (-100_000.0, 100_000.0), 0.0, field);
+        let indents = [
+            px(p.indent_first, "first-line indent"),
+            px(p.indent_left, "left indent"),
+            px(p.indent_right, "right indent"),
+            px(p.space_before, "space before"),
+            px(p.space_after, "space after"),
+        ];
+        let po = ParaOut { justify: j, indents, hanging: p.hanging_punctuation, every_line: p.composer == Composer::EveryLine, direction: i64::from(rtl) };
+        paras.push((len, po));
+    }
+    if doc.vertical {
+        col.lose(LossCategory::TextLayers, format!("{what}: vertical text is written horizontally"));
+    }
+    let mut at = At { what, col };
+    let frame = doc.box_size.map(|[w, h]| {
+        [
+            at.fit(doc.box_pos[0], (-1e6, 1e6), 0.0, "box left"),
+            at.fit(doc.box_pos[1], (-1e6, 1e6), 0.0, "box top"),
+            at.fit(w, (1.0, 1e6), 1.0, "box width"),
+            at.fit(h, (1.0, 1e6), 1.0, "box height"),
+        ]
+    });
+    TextPlan { text, runs: out_runs, paras, frame, animators: Vec::new() }
+}
+
+fn style_out(s: &effectcraft_keyframe::text_doc::CharStyle, what: &str, col: &mut Collector) -> StyleOut {
+    let auto_kern = match s.kerning {
+        Kerning::Metrics => 1,
+        Kerning::Optical => 2,
+        // No automatic kerning is a manual amount of 0 (542).
+        Kerning::Manual(k) => {
+            if k != 0.0 {
+                col.lose(LossCategory::TextLayers, format!("{what}: a manual kerning amount is not written (written without automatic kerning)"));
+            }
+            0
+        }
+    };
+    if !s.opentype.is_default() || !s.variations.is_empty() {
+        col.lose(LossCategory::TextLayers, format!("{what}: OpenType features and variable font axes are not written"));
+    }
+    if s.style != "Regular" && !s.style.is_empty() {
+        col.lose(LossCategory::TextLayers, format!("{what}: the font style '{}' is not written (the font is named by its PostScript name)", s.style));
+    }
+    if s.font.is_empty() {
+        col.lose(LossCategory::TextLayers, format!("{what}: a run without a font name is written in {PROTO_FONT}"));
+    }
+    let mut at = At { what, col };
+    StyleOut {
+        font: if s.font.is_empty() { PROTO_FONT.to_string() } else { s.font.clone() },
+        size: at.fit(s.size, (0.1, 10_000.0), 100.0, "font size"),
+        fill: at.rgb(s.fill, "fill colour"),
+        stroke: at.rgb(s.stroke, "stroke colour"),
+        tracking: at.fit(s.tracking, (-100_000.0, 100_000.0), 0.0, "tracking"),
+        leading: s.leading.map(|l| at.fit(l, (0.0, 100_000.0), 0.0, "leading")),
+        faux_bold: s.faux_bold,
+        faux_italic: s.faux_italic,
+        caps: if s.all_caps {
+            2
+        } else if s.small_caps {
+            1
+        } else {
+            0
+        },
+        script: match s.baseline {
+            BaselineOption::Normal => 0,
+            BaselineOption::Superscript => 1,
+            BaselineOption::Subscript => 2,
+        },
+        h_scale: at.fit(s.h_scale, (1.0, 10_000.0), 100.0, "horizontal scale") / 100.0,
+        v_scale: at.fit(s.v_scale, (1.0, 10_000.0), 100.0, "vertical scale") / 100.0,
+        baseline_shift: at.fit(s.baseline_shift, (-100_000.0, 100_000.0), 0.0, "baseline shift"),
+        auto_kern,
+        ligatures: s.ligatures,
+        tsume: at.fit(s.tsume, (0.0, 100.0), 0.0, "tsume") / 100.0,
+        apply_fill: s.apply_fill,
+        apply_stroke: s.apply_stroke,
+        stroke_width: (s.apply_stroke || s.stroke_width > 0.0).then(|| at.fit(s.stroke_width, (0.0, 10_000.0), 1.0, "stroke width")),
+        stroke_over_fill: true,
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// The document.
+
+/// The number an atom holds (`1`, `1.0`, `.5`).
+fn atom_f64(n: Option<&TNode>) -> Option<f64> {
+    match n? {
+        TNode::Atom(a) => std::str::from_utf8(a).ok()?.trim().parse::<f64>().ok(),
+        _ => None,
+    }
+}
+
+/// Sets a number slot unless it already holds `v` (`absent` when the slot is missing).
+fn set_num_if(d: &mut TNode, key: &str, v: f64, absent: f64) {
+    let cur = match d.get(key) {
+        None => Some(absent),
+        n => atom_f64(n),
+    };
+    if cur.is_none_or(|c| (c - v).abs() > 1e-9) {
+        d.set(key, number(v));
+    }
+}
+
+/// Sets a boolean slot unless it already holds `v` (`absent` when the slot is missing).
+fn set_bool_if(d: &mut TNode, key: &str, v: bool, absent: bool) {
+    let cur = match d.get(key) {
+        None => Some(absent),
+        Some(TNode::Atom(a)) if a.as_slice() == b"true" => Some(true),
+        Some(TNode::Atom(a)) if a.as_slice() == b"false" => Some(false),
+        Some(_) => None,
+    };
+    if cur != Some(v) {
+        d.set(key, boolean(v));
+    }
+}
+
+fn num_or_int(v: f64) -> TNode {
+    if v.fract() == 0.0 && v.abs() < 1e12 { int(v as i64) } else { number(v) }
+}
+
+fn paint(rgb: [f64; 3]) -> TNode {
+    TNode::Array(vec![number(1.0), number(rgb[0]), number(rgb[1]), number(rgb[2])])
+}
+
+/// The rectangle as After Effects traces it: each corner twice at the ends of the list and four
+/// times in between (245: top-left, top-right, bottom-right, bottom-left).
+fn frame_points(f: [f64; 4]) -> TNode {
+    let [x, y, w, h] = f;
+    let (l, t, r, b) = (x, y, x + w, y + h);
+    let corners = [(l, t), (l, t), (r, t), (r, t), (r, t), (r, t), (r, b), (r, b), (r, b), (r, b), (l, b), (l, b), (l, b), (l, b), (l, t), (l, t)];
+    TNode::Array(corners.iter().flat_map(|(px, py)| [number(*px), number(*py)]).collect())
+}
+
+/// The prototype's document (110 or 245) rewritten for `tp`; `None` when the prototype does not
+/// have the expected shape.
+pub(crate) fn build_doc(proto: &TNode, tp: &TextPlan) -> Option<TNode> {
+    let mut doc = proto.clone();
+    // Fonts: the prototype's own stay where the document refers to them; others are appended.
+    let mut font_index: Vec<(String, usize)> = Vec::new();
+    {
+        let list = doc.path_mut("0/1/0")?;
+        let TNode::Array(entries) = list else { return None };
+        let template = entries.first()?.clone();
+        // Font names compare as the stored atoms (UTF-16 bytes): a lossy text conversion would
+        // make two non-ASCII names equal.
+        let name_of = |e: &TNode| -> Option<Vec<u8>> {
+            match e.path("0/0/0")? {
+                TNode::Atom(a) => Some(a.clone()),
+                _ => None,
+            }
+        };
+        for (_, s) in &tp.runs {
+            if font_index.iter().any(|(f, _)| f == &s.font) {
+                continue;
+            }
+            let TNode::Atom(atom) = string(&s.font) else { continue };
+            let at = match entries.iter().position(|e| name_of(e).as_ref() == Some(&atom)) {
+                Some(i) => i,
+                None => {
+                    let mut e = template.clone();
+                    let inner = e.path_mut("0/0")?;
+                    inner.set("0", string(&s.font));
+                    inner.set("2", int(0));
+                    inner.remove("5");
+                    entries.push(e);
+                    entries.len() - 1
+                }
+            };
+            font_index.push((s.font.clone(), at));
+        }
+    }
+    {
+        let run = doc.path_mut("1/1[0]/0")?;
+        run.set("0", string(&tp.text));
+        let p0 = run.path("5/0[0]")?.clone();
+        let paras: Vec<TNode> = tp
+            .paras
+            .iter()
+            .map(|(len, po)| {
+                let mut p = p0.clone();
+                p.set("1", int(i64::try_from(*len).unwrap_or(i64::MAX)));
+                if let Some(d) = p.path_mut("0/0/5") {
+                    d.set("0", int(po.justify));
+                    // The paragraph settings decoded by the importer (560-569), written only
+                    // where they differ from the prototype.
+                    for (k, v) in ["1", "2", "3", "4", "5"].iter().zip(po.indents) {
+                        set_num_if(d, k, v, 0.0);
+                    }
+                    set_bool_if(d, "21", po.hanging, false);
+                    set_bool_if(d, "29", po.every_line, false);
+                    if atom_f64(d.get("33")).unwrap_or(0.0) != po.direction as f64 {
+                        d.set("33", int(po.direction));
+                    }
+                }
+                p
+            })
+            .collect();
+        *run.path_mut("5/0")? = TNode::Array(paras);
+        let s0 = run.path("6/0[0]")?.clone();
+        let mut styles = Vec::with_capacity(tp.runs.len());
+        for (len, s) in &tp.runs {
+            let mut r = s0.clone();
+            r.set("1", int(i64::try_from(*len).unwrap_or(i64::MAX)));
+            let d = r.path_mut("0/0/6")?;
+            let fi = font_index.iter().find(|(f, _)| f == &s.font).map_or(0, |(_, i)| *i);
+            d.set("0", int(i64::try_from(fi).unwrap_or(0)));
+            d.set("1", number(s.size));
+            d.set("2", boolean(s.faux_bold));
+            d.set("3", boolean(s.faux_italic));
+            // Automatic leading: /4 true and /5 0.01 (400); explicit: /4 false, /5 the leading.
+            d.set("4", boolean(s.leading.is_none()));
+            d.set("5", number(s.leading.unwrap_or(0.01)));
+            d.set("8", num_or_int(s.tracking));
+            d.set("12", int(s.caps));
+            // Normal text must store 0: the prototypes (and every text After Effects creates by
+            // script) hold 1, superscript, which After Effects draws at 58.3 % size (526-528).
+            d.set("13", int(s.script));
+            // The character settings decoded by the importer (539-555): written only where they
+            // differ from what the slot holds, so a document in the default state keeps the
+            // prototype's bytes.
+            set_num_if(d, "6", s.h_scale, 1.0);
+            set_num_if(d, "7", s.v_scale, 1.0);
+            set_num_if(d, "9", s.baseline_shift, 0.0);
+            if atom_f64(d.get("11")).unwrap_or(1.0) != s.auto_kern as f64 {
+                d.set("11", int(s.auto_kern));
+            }
+            set_bool_if(d, "18", s.ligatures, false);
+            set_num_if(d, "36", s.tsume, 0.0);
+            set_bool_if(d, "56", s.apply_fill, true);
+            set_bool_if(d, "57", s.apply_stroke, false);
+            set_bool_if(d, "58", s.stroke_over_fill, true);
+            if let Some(w) = s.stroke_width {
+                set_num_if(d, "63", w, 1.0);
+            }
+            if let Some(fill) = d.path_mut("53/0") {
+                fill.set("1", paint(s.fill));
+            }
+            if let Some(stroke) = d.path_mut("54/0") {
+                stroke.set("1", paint(s.stroke));
+            }
+            styles.push(r);
+        }
+        *run.path_mut("6/0")? = TNode::Array(styles);
+    }
+    if let Some(f) = tp.frame {
+        doc.path_mut("0/8/0[0]/0/1")?.set("0", frame_points(f));
+    }
+    // The composed layout is dropped: After Effects lays the text out again (t3).
+    doc.path_mut("1/1[0]/1")?.set("2", TNode::Array(Vec::new()));
+    Some(doc)
+}
+
+/// Rewrites the text document of a text layer block's `Layr` for `tp` and gives the document a
+/// fresh `btgu/pgui`.
+pub(crate) fn put_doc(layr: &mut crate::Chunk<'static>, tp: &TextPlan, guid: [u8; 16]) -> crate::export::tree::R<()> {
+    use crate::Body;
+    use crate::export::tree::tpl;
+    fn find<'c>(c: &'c mut crate::Chunk<'static>, depth: usize) -> Option<&'c mut crate::Chunk<'static>> {
+        if depth > 32 {
+            return None;
+        }
+        if matches!(&c.body, Body::OpaqueList { list_type, .. } if list_type == b"btdk") {
+            return Some(c);
+        }
+        match &mut c.body {
+            Body::List { children, .. } | Body::Chunks(children) => children.iter_mut().find_map(|k| find(k, depth + 1)),
+            _ => None,
+        }
+    }
+    fn find_pgui<'c>(c: &'c mut crate::Chunk<'static>, depth: usize) -> Option<&'c mut crate::Chunk<'static>> {
+        if depth > 32 {
+            return None;
+        }
+        if c.is_list(b"btgu") {
+            return match &mut c.body {
+                Body::List { children, .. } => children.iter_mut().find(|k| k.is(b"pgui")),
+                _ => None,
+            };
+        }
+        match &mut c.body {
+            Body::List { children, .. } | Body::Chunks(children) => children.iter_mut().find_map(|k| find_pgui(k, depth + 1)),
+            _ => None,
+        }
+    }
+    let btdk = find(layr, 0).ok_or_else(|| tpl("text prototype without a document"))?;
+    let Body::OpaqueList { data, .. } = &mut btdk.body else { return Err(tpl("text prototype without a document")) };
+    let proto = crate::export::textdoc::parse(data.as_ref()).ok_or_else(|| tpl("the text prototype's document does not parse"))?;
+    let doc = build_doc(&proto, tp).ok_or_else(|| tpl("the text prototype's document has another shape"))?;
+    *data = std::borrow::Cow::Owned(crate::export::textdoc::write(&doc));
+    if let Some(p) = find_pgui(layr, 0) {
+        *p = crate::Chunk::data(*b"pgui", guid.to_vec());
+    }
+    Ok(())
+}
diff --git a/crates/aep/src/export/textanim.rs b/crates/aep/src/export/textanim.rs
new file mode 100644
index 000000000..760217cb8
--- /dev/null
+++ b/crates/aep/src/export/textanim.rs
@@ -0,0 +1,311 @@
+//! Text animators (`docs/aep-format.md` 3.10; cases 114, 579-594, 728): the animators of a text
+//! layer with their properties and range selectors, the inverse of the importer's
+//! `text_anim.rs`.
+//!
+//! The layer's `ADBE Text Animators` group is the one of 579 emptied; every animator is its first
+//! animator (one range selector) with the properties and selectors of the EffectCraft animator.
+//! An animator property is written whenever the animator has it (its presence is what After
+//! Effects shows: Animate > Position adds the entry), a range selector property only when it
+//! differs from After Effects' default or carries keys or an expression. Every record has the layout
+//! After Effects writes for that property in a one-change case (579-592, 728; `tree_defs`):
+//! positions, anchor points, stroke widths and line spacing in pixels, scales, opacity, Start /
+//! End / Offset, Amount, Smoothness and the eases in percent, angles in degrees, tracking in 1/1000
+//! em, colours ARGB 0..255, popups 1-based (Units, Based On, Mode, Shape in EffectCraft's item
+//! order). With Units = Index the selector's range is `Index Start / End / Offset` (583). Keys
+//! and expressions are written as on shape properties (R46; 593, 594).
+
+use crate::Chunk;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Layer, Node, PropGroup};
+
+use crate::export::plan::CompPlan;
+use crate::export::report::{Collector, LossCategory};
+use crate::export::shapes::{Conv, Layout, RecVal, ShCx, build_record, c_color, c_popup, c_scalar, rec_value};
+use crate::export::tree::{R, kids_mut, set_utf8, tpl};
+
+/// More animators or selectors than this on one layer are not written (and reported).
+const MAX_ITEMS: usize = 1024;
+
+/// A range selector in the file's terms.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct SelPlan {
+    pub name: String,
+    pub records: Vec<(&'static str, RecVal)>,
+    pub advanced: Vec<(&'static str, RecVal)>,
+}
+
+/// An animator in the file's terms.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct AnimPlan {
+    pub name: String,
+    pub props: Vec<(&'static str, RecVal)>,
+    pub selectors: Vec<SelPlan>,
+}
+
+/// The prototypes, built in code (`tree_defs`).
+pub(crate) struct AnimProtos {
+    /// `tdmn ADBE Text Animators` + the emptied group.
+    pub group: Vec<Chunk<'static>>,
+    /// `tdmn ADBE Text Animator` + the animator with one range selector and no properties.
+    pub animator: Vec<Chunk<'static>>,
+    /// Value records by match name.
+    pub records: Vec<(String, [Chunk<'static>; 2])>,
+}
+
+fn c_vec3(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Vec3(p) => Some(p.to_vec()),
+        Value::Vec2(p) => Some(vec![p[0], p[1], 0.0]),
+        _ => None,
+    }
+}
+
+fn c_vec2(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Vec2(p) => Some(p.to_vec()),
+        Value::Vec3(p) => Some(vec![p[0], p[1]]),
+        _ => None,
+    }
+}
+
+fn c_bool(v: &Value) -> Option<Vec<f64>> {
+    match v {
+        Value::Bool(b) => Some(vec![if *b { 1.0 } else { 0.0 }]),
+        Value::Scalar(s) => Some(vec![if *s != 0.0 { 1.0 } else { 0.0 }]),
+        _ => None,
+    }
+}
+
+/// EffectCraft animator property -> stored match name, conversion, key layout (the importer's
+/// `PROPS`, 579-592, 728).
+const PROPS: &[(&str, &str, Conv, Layout)] = &[
+    ("anchor", "ADBE Text Anchor Point 3D", c_vec3, Layout::Point),
+    ("position", "ADBE Text Position 3D", c_vec3, Layout::Point),
+    ("scale", "ADBE Text Scale 3D", c_vec3, Layout::Size),
+    ("skew", "ADBE Text Skew", c_scalar, Layout::One),
+    ("skewAxis", "ADBE Text Skew Axis", c_scalar, Layout::One),
+    ("rotation", "ADBE Text Rotation", c_scalar, Layout::One),
+    ("opacity", "ADBE Text Opacity", c_scalar, Layout::One),
+    ("fillColor", "ADBE Text Fill Color", c_color, Layout::Color),
+    ("strokeColor", "ADBE Text Stroke Color", c_color, Layout::Color),
+    ("strokeWidth", "ADBE Text Stroke Width", c_scalar, Layout::One),
+    ("tracking", "ADBE Text Tracking Amount", c_scalar, Layout::One),
+    ("lineSpacing", "ADBE Text Line Spacing", c_vec2, Layout::Size),
+    ("blur", "ADBE Text Blur", c_vec2, Layout::Size),
+    ("characterOffset", "ADBE Text Character Offset", c_scalar, Layout::One),
+];
+
+/// Properties After Effects adds with another one and EffectCraft keeps at their default: written
+/// by After Effects itself (Tracking Type with Tracking, Character Range and Alignment with
+/// Character Offset, 728); a value other than the default is reported.
+const DEPENDENT: &[(&str, Value)] = &[("trackingType", Value::Enum(0)), ("characterRange", Value::Enum(0)), ("characterAlignment", Value::Enum(1))];
+
+/// Range selector properties: EffectCraft id, stored match names (percent units, index units),
+/// conversion, default (stored).
+const RANGE: &[(&str, &str, &str, f64)] = &[
+    ("start", "ADBE Text Percent Start", "ADBE Text Index Start", 0.0),
+    ("end", "ADBE Text Percent End", "ADBE Text Index End", 100.0),
+    ("offset", "ADBE Text Percent Offset", "ADBE Text Index Offset", 0.0),
+];
+
+const ADVANCED: &[(&str, &str, Conv, Layout, f64)] = &[
+    ("units", "ADBE Text Range Units", c_popup, Layout::Popup, 1.0),
+    ("basedOn", "ADBE Text Range Type2", c_popup, Layout::Popup, 1.0),
+    ("mode", "ADBE Text Selector Mode", c_popup, Layout::Popup, 1.0),
+    ("amount", "ADBE Text Selector Max Amount", c_scalar, Layout::One, 100.0),
+    ("shape", "ADBE Text Range Shape", c_popup, Layout::Popup, 1.0),
+    ("smoothness", "ADBE Text Selector Smoothness", c_scalar, Layout::One, 100.0),
+    ("easeHigh", "ADBE Text Levels Max Ease", c_scalar, Layout::One, 0.0),
+    ("easeLow", "ADBE Text Levels Min Ease", c_scalar, Layout::One, 0.0),
+    ("randomize", "ADBE Text Randomize Order", c_bool, Layout::Popup, 0.0),
+    ("randomSeed", "ADBE Text Random Seed", c_scalar, Layout::One, 0.0),
+];
+
+fn layout_of(name: &str) -> Layout {
+    if let Some((_, _, _, l)) = PROPS.iter().find(|(_, n, ..)| *n == name) {
+        return *l;
+    }
+    if let Some((_, _, _, l, _)) = ADVANCED.iter().find(|(_, n, ..)| *n == name) {
+        return *l;
+    }
+    Layout::One
+}
+
+/// The animators of `layer` (its `text/animators` group) in the file's terms; what cannot be
+/// written is reported.
+pub(crate) fn plan(layer: &Layer, cp: &CompPlan, what: &str, col: &mut Collector) -> Vec<AnimPlan> {
+    let Some(group) = layer.props.sub("text").and_then(|t| t.sub("animators")) else { return Vec::new() };
+    let mut cx = ShCx { cp, col };
+    let mut out = Vec::new();
+    for (i, node) in group.children.iter().enumerate() {
+        if i >= MAX_ITEMS {
+            cx.col.lose(LossCategory::TextLayers, format!("{what}: more than {MAX_ITEMS} text animators, the rest are not written"));
+            break;
+        }
+        let Node::Group(a) = node else { continue };
+        let here = format!("{what}: animator '{}'", a.name);
+        if !a.enabled {
+            cx.col.lose(LossCategory::TextLayers, format!("{here}: a switched-off animator is written switched on (the switch is not decoded)"));
+        }
+        let mut props = Vec::new();
+        if let Some(pg) = a.sub("properties") {
+            for n in &pg.children {
+                let Node::Prop(p) = n else { continue };
+                if let Some((_, name, conv, layout)) = PROPS.iter().find(|(id, ..)| *id == p.match_id) {
+                    let w = format!("{here}: {name}");
+                    if let Some(v) = rec_value(p, *conv, *layout, None, &w, LossCategory::TextLayers, &mut cx) {
+                        props.push((*name, v));
+                    }
+                } else if let Some((_, def)) = DEPENDENT.iter().find(|(id, _)| *id == p.match_id) {
+                    if p.value != *def || !p.keys.is_empty() || p.has_expression() {
+                        cx.col.lose(LossCategory::TextLayers, format!("{here}: {} is not written (only its default is sampled)", p.name));
+                    }
+                } else {
+                    cx.col.lose(LossCategory::TextLayers, format!("{here}: the animator property {} is not written", p.name));
+                }
+            }
+        }
+        let mut selectors = Vec::new();
+        if let Some(sg) = a.sub("selectors") {
+            for (k, n) in sg.children.iter().enumerate() {
+                if k >= MAX_ITEMS {
+                    cx.col.lose(LossCategory::TextLayers, format!("{here}: more than {MAX_ITEMS} selectors, the rest are not written"));
+                    break;
+                }
+                let Node::Group(s) = n else { continue };
+                if s.match_id != "rangeSelector" {
+                    cx.col.lose(LossCategory::TextLayers, format!("{here}: the selector '{}' ({}) is not written (only range selectors)", s.name, s.match_id));
+                    continue;
+                }
+                if !s.enabled {
+                    cx.col.lose(
+                        LossCategory::TextLayers,
+                        format!("{here}: the switched-off selector '{}' is written switched on (the switch is not decoded)", s.name),
+                    );
+                }
+                selectors.push(plan_selector(s, &here, &mut cx));
+            }
+        }
+        cx.col.exported.text_animators = cx.col.exported.text_animators.saturating_add(1);
+        out.push(AnimPlan { name: crate::export::plan::cut_name(&a.name, 255, &here, cx.col), props, selectors });
+    }
+    out
+}
+
+fn plan_selector(s: &PropGroup, animator: &str, cx: &mut ShCx<'_>) -> SelPlan {
+    let here = format!("{animator} '{}'", s.name);
+    let adv = s.sub("advanced");
+    let index = adv.and_then(|a| a.get("units")).is_some_and(|u| u.value == Value::Enum(1));
+    let mut records = Vec::new();
+    for (id, percent, idx, default) in RANGE {
+        let Some(p) = s.get(id) else { continue };
+        let name = if index { *idx } else { *percent };
+        // With Units = Index After Effects stores the range in characters, records for all three
+        // (583).
+        let default = if index { None } else { Some(std::slice::from_ref(default)) };
+        if let Some(v) = rec_value(p, c_scalar, Layout::One, default, &format!("{here}: {name}"), LossCategory::TextLayers, cx) {
+            records.push((name, v));
+        }
+    }
+    let mut advanced = Vec::new();
+    if let Some(a) = adv {
+        for (id, name, conv, layout, default) in ADVANCED {
+            let Some(p) = a.get(id) else { continue };
+            if let Some(v) = rec_value(p, *conv, *layout, Some(std::slice::from_ref(default)), &format!("{here}: {name}"), LossCategory::TextLayers, cx) {
+                advanced.push((*name, v));
+            }
+        }
+    }
+    SelPlan { name: crate::export::plan::cut_name(&s.name, 255, &here, cx.col), records, advanced }
+}
+
+fn tdmn_name(c: &Chunk<'_>) -> Option<String> {
+    let b = c.bytes()?;
+    let end = b.iter().position(|x| *x == 0).unwrap_or(b.len());
+    std::str::from_utf8(b.get(..end)?).ok().map(str::to_string)
+}
+
+fn pos(kids: &[Chunk<'static>], n: &str) -> Option<usize> {
+    kids.iter().position(|c| c.is(b"tdmn") && tdmn_name(c).as_deref() == Some(n))
+}
+
+/// The item's user name (`tdsn/Utf8`).
+fn set_name(node: &mut Chunk<'static>, name: &str) -> R<()> {
+    let kids = kids_mut(node)?;
+    let tdsn = kids.iter_mut().find(|c| c.is(b"tdsn")).ok_or_else(|| tpl("animator prototype without a name"))?;
+    set_utf8(tdsn, name)
+}
+
+/// Inserts records before the group's first sub-group or end.
+fn put_records(t: &AnimProtos, group: &mut Chunk<'static>, records: &[(&'static str, RecVal)], key_list: &Chunk<'static>) -> R<()> {
+    let kids = kids_mut(group)?;
+    let mut at = kids.iter().position(|c| c.is(b"tdmn")).unwrap_or(kids.len());
+    for (name, v) in records {
+        let [m, node] = t.records.iter().find(|(n, _)| n == name).map(|(_, c)| c.clone()).ok_or_else(|| tpl("text animator record prototype missing"))?;
+        let [m, node] = build_record(m, node, layout_of(name), v, key_list)?;
+        kids.insert(at, m);
+        kids.insert(at.saturating_add(1), node);
+        at = at.saturating_add(2);
+    }
+    Ok(())
+}
+
+/// Adds the `ADBE Text Animators` group with `anims` to the text layer `layr` (after More
+/// Options, as 579 stores it).
+pub(crate) fn put_animators(layr: &mut Chunk<'static>, t: &AnimProtos, anims: &[AnimPlan], key_list: &Chunk<'static>) -> R<()> {
+    if anims.is_empty() {
+        return Ok(());
+    }
+    let [gm, mut group] = <[Chunk<'static>; 2]>::try_from(t.group.clone()).map_err(|_| tpl("animators prototype incomplete"))?;
+    let [am, anim_proto] = <[Chunk<'static>; 2]>::try_from(t.animator.clone()).map_err(|_| tpl("animator prototype incomplete"))?;
+    let mut built = Vec::with_capacity(anims.len() * 2);
+    for a in anims {
+        let mut node = anim_proto.clone();
+        set_name(&mut node, &a.name)?;
+        let kids = kids_mut(&mut node)?;
+        // Selectors: one copy of the prototype's selector each.
+        let si = pos(kids, "ADBE Text Selectors").ok_or_else(|| tpl("animator prototype without selectors"))?;
+        {
+            let sels = kids.get_mut(si + 1).ok_or_else(|| tpl("animator prototype without selectors"))?;
+            let sk = kids_mut(sels)?;
+            let at = pos(sk, "ADBE Text Selector").ok_or_else(|| tpl("animator prototype without a selector"))?;
+            let sm = sk.get(at).cloned().ok_or_else(|| tpl("animator prototype without a selector"))?;
+            let sproto = sk.get(at + 1).cloned().ok_or_else(|| tpl("animator prototype without a selector"))?;
+            sk.drain(at..at + 2);
+            let mut sel_nodes = Vec::with_capacity(a.selectors.len() * 2);
+            for s in &a.selectors {
+                let mut sn = sproto.clone();
+                set_name(&mut sn, &s.name)?;
+                if !s.advanced.is_empty() {
+                    let snk = kids_mut(&mut sn)?;
+                    let ai = pos(snk, "ADBE Text Range Advanced").ok_or_else(|| tpl("selector prototype without Advanced"))?;
+                    let adv = snk.get_mut(ai + 1).ok_or_else(|| tpl("selector prototype without Advanced"))?;
+                    put_records(t, adv, &s.advanced, key_list)?;
+                }
+                put_records(t, &mut sn, &s.records, key_list)?;
+                sel_nodes.push(sm.clone());
+                sel_nodes.push(sn);
+            }
+            sk.splice(at..at, sel_nodes);
+        }
+        let pi = pos(kids, "ADBE Text Animator Properties").ok_or_else(|| tpl("animator prototype without properties"))?;
+        let props = kids.get_mut(pi + 1).ok_or_else(|| tpl("animator prototype without properties"))?;
+        put_records(t, props, &a.props, key_list)?;
+        built.push(am.clone());
+        built.push(node);
+    }
+    {
+        let gk = kids_mut(&mut group)?;
+        let end = pos(gk, "ADBE Group End").unwrap_or(gk.len());
+        gk.splice(end..end, built);
+    }
+    // Into the layer's `ADBE Text Properties`, before its Group End.
+    let root = crate::export::tree::list_mut(layr, b"tdgp")?;
+    let rk = kids_mut(root)?;
+    let ti = pos(rk, "ADBE Text Properties").ok_or_else(|| tpl("text layer without text properties"))?;
+    let tp = rk.get_mut(ti + 1).ok_or_else(|| tpl("text layer without text properties"))?;
+    let tk = kids_mut(tp)?;
+    let end = pos(tk, "ADBE Group End").unwrap_or(tk.len());
+    tk.splice(end..end, [gm, group]);
+    Ok(())
+}
diff --git a/crates/aep/src/export/textdoc.rs b/crates/aep/src/export/textdoc.rs
new file mode 100644
index 000000000..4e7586a42
--- /dev/null
+++ b/crates/aep/src/export/textdoc.rs
@@ -0,0 +1,330 @@
+//! The text document dictionary (`LIST btdk`, `docs/aep-format.md` 3.10) as an editable tree:
+//! `/key value` pairs, `<< >>` dictionaries, `[ ]` arrays, and atoms (numbers, names, booleans,
+//! strings) kept as their raw bytes. Writing it back uses After Effects' own spacing (one space
+//! between tokens, ` /key value` at the top level), so an unedited tree writes the bytes it was
+//! read from.
+
+/// Deepest nesting read (After Effects' documents nest about 16 deep).
+const MAX_DEPTH: usize = 64;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum TNode {
+    Dict(Vec<(String, TNode)>),
+    Array(Vec<TNode>),
+    /// A number, name, boolean or string, as stored.
+    Atom(Vec<u8>),
+}
+
+impl TNode {
+    pub(crate) fn get(&self, key: &str) -> Option<&TNode> {
+        match self {
+            TNode::Dict(kv) => kv.iter().find(|(k, _)| k == key).map(|(_, v)| v),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn get_mut(&mut self, key: &str) -> Option<&mut TNode> {
+        match self {
+            TNode::Dict(kv) => kv.iter_mut().find(|(k, _)| k == key).map(|(_, v)| v),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn at_mut(&mut self, i: usize) -> Option<&mut TNode> {
+        match self {
+            TNode::Array(v) => v.get_mut(i),
+            _ => None,
+        }
+    }
+
+    /// The node at a `/`-separated path of keys and `[n]` indices (`1/1[0]/0`).
+    pub(crate) fn path_mut(&mut self, path: &str) -> Option<&mut TNode> {
+        let mut at = self;
+        for step in path.split('/').filter(|s| !s.is_empty()) {
+            let (key, idx) = match step.split_once('[') {
+                Some((k, rest)) => (k, rest.strip_suffix(']').and_then(|n| n.parse::<usize>().ok())),
+                None => (step, None),
+            };
+            at = at.get_mut(key)?;
+            if let Some(i) = idx {
+                at = at.at_mut(i)?;
+            }
+        }
+        Some(at)
+    }
+
+    pub(crate) fn path(&self, path: &str) -> Option<&TNode> {
+        let mut at = self;
+        for step in path.split('/').filter(|s| !s.is_empty()) {
+            let (key, idx) = match step.split_once('[') {
+                Some((k, rest)) => (k, rest.strip_suffix(']').and_then(|n| n.parse::<usize>().ok())),
+                None => (step, None),
+            };
+            at = at.get(key)?;
+            if let Some(i) = idx {
+                at = match at {
+                    TNode::Array(v) => v.get(i)?,
+                    _ => return None,
+                };
+            }
+        }
+        Some(at)
+    }
+
+    /// Sets (or adds) `key` in a dictionary.
+    pub(crate) fn set(&mut self, key: &str, value: TNode) {
+        if let TNode::Dict(kv) = self {
+            match kv.iter_mut().find(|(k, _)| k == key) {
+                Some((_, v)) => *v = value,
+                None => kv.push((key.to_string(), value)),
+            }
+        }
+    }
+
+    pub(crate) fn remove(&mut self, key: &str) {
+        if let TNode::Dict(kv) = self {
+            kv.retain(|(k, _)| k != key);
+        }
+    }
+}
+
+fn is_ws(c: u8) -> bool {
+    matches!(c, b' ' | b'\t' | b'\r' | b'\n' | 0)
+}
+
+fn is_delim(c: u8) -> bool {
+    is_ws(c) || matches!(c, b'/' | b'[' | b']' | b'(' | b')' | b'<' | b'>')
+}
+
+struct P<'a> {
+    b: &'a [u8],
+    i: usize,
+}
+
+impl P<'_> {
+    fn ws(&mut self) {
+        while self.b.get(self.i).copied().is_some_and(is_ws) {
+            self.i += 1;
+        }
+    }
+
+    fn peek(&self) -> Option<u8> {
+        self.b.get(self.i).copied()
+    }
+
+    fn starts(&self, s: &[u8]) -> bool {
+        self.b.get(self.i..).is_some_and(|r| r.starts_with(s))
+    }
+
+    fn name(&mut self) -> Option<String> {
+        if self.peek() != Some(b'/') {
+            return None;
+        }
+        self.i += 1;
+        let start = self.i;
+        while self.peek().is_some_and(|c| !is_delim(c)) {
+            self.i += 1;
+        }
+        Some(String::from_utf8_lossy(self.b.get(start..self.i)?).to_string())
+    }
+
+    fn value(&mut self, depth: usize) -> Option<TNode> {
+        if depth > MAX_DEPTH {
+            return None;
+        }
+        self.ws();
+        if self.starts(b"<<") {
+            self.i += 2;
+            let mut kv = Vec::new();
+            loop {
+                self.ws();
+                if self.starts(b">>") {
+                    self.i += 2;
+                    return Some(TNode::Dict(kv));
+                }
+                let k = self.name()?;
+                let v = self.value(depth + 1)?;
+                kv.push((k, v));
+            }
+        }
+        match self.peek()? {
+            b'[' => {
+                self.i += 1;
+                let mut v = Vec::new();
+                loop {
+                    self.ws();
+                    if self.peek()? == b']' {
+                        self.i += 1;
+                        return Some(TNode::Array(v));
+                    }
+                    v.push(self.value(depth + 1)?);
+                }
+            }
+            b'(' => {
+                let start = self.i;
+                self.i += 1;
+                loop {
+                    match self.peek()? {
+                        b'\\' => self.i += 2,
+                        b')' => {
+                            self.i += 1;
+                            break;
+                        }
+                        _ => self.i += 1,
+                    }
+                }
+                Some(TNode::Atom(self.b.get(start..self.i)?.to_vec()))
+            }
+            b'/' => {
+                // A name used as a value (`/CoolTypeFont`, `/nil`).
+                let start = self.i;
+                self.name()?;
+                Some(TNode::Atom(self.b.get(start..self.i)?.to_vec()))
+            }
+            _ => {
+                let start = self.i;
+                while self.peek().is_some_and(|c| !is_delim(c)) {
+                    self.i += 1;
+                }
+                if self.i == start {
+                    return None;
+                }
+                Some(TNode::Atom(self.b.get(start..self.i)?.to_vec()))
+            }
+        }
+    }
+}
+
+/// Parses a whole document (a top-level sequence of `/key value` pairs); `None` when it is not
+/// well formed.
+pub(crate) fn parse(b: &[u8]) -> Option<TNode> {
+    let mut p = P { b, i: 0 };
+    let mut kv = Vec::new();
+    loop {
+        p.ws();
+        if p.i >= b.len() {
+            return Some(TNode::Dict(kv));
+        }
+        let k = p.name()?;
+        let v = p.value(0)?;
+        kv.push((k, v));
+    }
+}
+
+fn write_value(n: &TNode, out: &mut Vec<u8>, depth: usize) {
+    if depth > MAX_DEPTH {
+        out.extend_from_slice(b"<< >>");
+        return;
+    }
+    match n {
+        TNode::Atom(a) => out.extend_from_slice(a),
+        TNode::Array(v) => {
+            out.push(b'[');
+            for x in v {
+                out.push(b' ');
+                write_value(x, out, depth + 1);
+            }
+            out.extend_from_slice(b" ]");
+        }
+        TNode::Dict(kv) => {
+            out.extend_from_slice(b"<<");
+            for (k, v) in kv {
+                out.extend_from_slice(b" /");
+                out.extend_from_slice(k.as_bytes());
+                out.push(b' ');
+                write_value(v, out, depth + 1);
+            }
+            out.extend_from_slice(b" >>");
+        }
+    }
+}
+
+/// The document's bytes.
+pub(crate) fn write(doc: &TNode) -> Vec<u8> {
+    let mut out = Vec::new();
+    if let TNode::Dict(kv) = doc {
+        for (k, v) in kv {
+            out.extend_from_slice(b" /");
+            out.extend_from_slice(k.as_bytes());
+            out.push(b' ');
+            write_value(v, &mut out, 0);
+        }
+    }
+    out
+}
+
+/// A string atom: `(` + `fe ff` + UTF-16BE + `)`, with `(`, `)` and `\` escaped.
+pub(crate) fn string(s: &str) -> TNode {
+    let mut out = vec![b'('];
+    let mut push = |b: u8| {
+        if matches!(b, b'(' | b')' | b'\\') {
+            out.push(b'\\');
+        }
+        out.push(b);
+    };
+    push(0xfe);
+    push(0xff);
+    for u in s.encode_utf16() {
+        let [hi, lo] = u.to_be_bytes();
+        push(hi);
+        push(lo);
+    }
+    out.push(b')');
+    TNode::Atom(out)
+}
+
+/// A number as After Effects writes it: integers without a point, others with one (`60.0`,
+/// `.5`, `-49.05029`).
+pub(crate) fn number(v: f64) -> TNode {
+    let v = if v.is_finite() { v } else { 0.0 };
+    let mut s = if v.fract() == 0.0 && v.abs() < 1e15 { format!("{v:.1}") } else { format!("{}", (v * 1e5).round() / 1e5) };
+    // `.5` and `-.25`, but `0.0` (113: `[ 1.0 1.0 .5 0.0 ]`).
+    if v != 0.0 {
+        if let Some(rest) = s.strip_prefix("0.") {
+            s = format!(".{rest}");
+        } else if let Some(rest) = s.strip_prefix("-0.") {
+            s = format!("-.{rest}");
+        }
+    }
+    TNode::Atom(s.into_bytes())
+}
+
+pub(crate) fn int(v: i64) -> TNode {
+    TNode::Atom(v.to_string().into_bytes())
+}
+
+pub(crate) fn boolean(v: bool) -> TNode {
+    TNode::Atom(if v { b"true".to_vec() } else { b"false".to_vec() })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_and_writes_back() {
+        let src = b" /98 << /0 13 >> /0 << /1 [ 1.0 .5 (\xfe\xff\x00A\\)) /nil << >> [ ] ] >>";
+        let t = parse(src).expect("parse");
+        assert_eq!(write(&t), src.to_vec());
+        assert_eq!(t.path("0/1[1]"), Some(&TNode::Atom(b".5".to_vec())));
+    }
+
+    #[test]
+    fn numbers_and_strings_as_after_effects_writes_them() {
+        assert_eq!(number(60.0), TNode::Atom(b"60.0".to_vec()));
+        assert_eq!(number(0.5), TNode::Atom(b".5".to_vec()));
+        assert_eq!(number(0.0), TNode::Atom(b"0.0".to_vec()));
+        assert_eq!(number(-0.25), TNode::Atom(b"-.25".to_vec()));
+        assert_eq!(number(98.123456), TNode::Atom(b"98.12346".to_vec()));
+        assert_eq!(string("A)"), TNode::Atom(b"(\xfe\xff\x00A\x00\\))".to_vec()));
+    }
+
+    #[test]
+    fn damaged_documents_are_none_not_a_panic() {
+        for bad in [&b"/a << /b"[..], b"/a [ 1 2", b"/a (unterminated", b"<<", b"/", b"/a >>", b"/a ]"] {
+            let _ = parse(bad);
+        }
+        let deep: Vec<u8> = std::iter::once(b"/a ".to_vec()).chain(std::iter::repeat_n(b"[ ".to_vec(), 500)).flatten().collect();
+        assert_eq!(parse(&deep), None);
+    }
+}
diff --git a/crates/aep/src/export/textproto.rs b/crates/aep/src/export/textproto.rs
new file mode 100644
index 000000000..98a6f5b5c
--- /dev/null
+++ b/crates/aep/src/export/textproto.rs
@@ -0,0 +1,179 @@
+//! The text document a text layer starts from, built in code (`docs/aep-format.md` 3.10): the
+//! smallest dictionary After Effects reads back unchanged (read-backs t2-*, t3-*). `text::build_doc`
+//! then writes the text, the runs, the fonts and the box frame into it.
+//!
+//! What stays and why: the font list (`/0/1`, names only), the style and paragraph sheets with
+//! their name only (`/0/5`, `/0/6`; without them the layer is skipped), one text frame (`/0/8`: a
+//! point text's, or a box text's with its outline), the document settings (`/1/0`: the line-break
+//! classes of seven characters, the superscript and subscript size and offset, the small caps
+//! size; without them, or with `/1/0/0` cut down, After Effects refuses or crashes), the composer
+//! (`/1/5`; without it After Effects rewrites the document on open) and one run with one
+//! paragraph and one style (`/1/1`) and an empty layout.
+
+use crate::export::textdoc::{TNode, boolean, int, number, string};
+
+fn dict(kv: Vec<(&str, TNode)>) -> TNode {
+    TNode::Dict(kv.into_iter().map(|(k, v)| (k.to_string(), v)).collect())
+}
+
+fn name(n: &str) -> TNode {
+    TNode::Atom(format!("/{n}").into_bytes())
+}
+
+fn numbers(v: &[f64]) -> TNode {
+    TNode::Array(v.iter().map(|x| number(*x)).collect())
+}
+
+/// The fonts of a new document (the first is the one the runs use until `build_doc` sets theirs).
+const FONTS: [&str; 4] = ["TimesNewRomanPSMT", "Myriad-Roman", "MyriadPro-Regular", "AdobeInvisFont"];
+
+/// The line-break class of the characters the text engine treats specially: space, carriage
+/// return, tab, paragraph separator, end of text, ideographic space, soft hyphen.
+const BREAK_CLASSES: [(char, &str); 7] = [(' ', "1"), ('\r', "6"), ('\t', "0"), ('\u{2029}', "5"), ('\u{3}', "5"), ('\u{3000}', "1"), ('\u{ad}', "3")];
+
+/// A sheet list with one sheet named `Normal RGB`, used by every run (`/1 [ << /0 0 >> ]`).
+fn sheets() -> TNode {
+    dict(vec![("0", TNode::Array(vec![dict(vec![("0", dict(vec![("0", string("Normal RGB"))]))])])), ("1", TNode::Array(vec![dict(vec![("0", int(0))])]))])
+}
+
+/// The text frame: a point text's (no outline, size -1), or a box text's with an outline that
+/// `build_doc` replaces with the layer's box.
+fn frame(boxed: bool) -> TNode {
+    let (kind, size) = if boxed { (Some(1), -2.0) } else { (None, -1.0) };
+    let mut settings = vec![("6", numbers(&[size, size])), ("11", dict(vec![("4", int(size as i64)), ("18", number(size)), ("22", number(0.025))]))];
+    if let Some(k) = kind {
+        settings.insert(0, ("0", int(k)));
+    }
+    let mut entry = Vec::new();
+    if boxed {
+        entry.push(("1", dict(vec![("0", numbers(&[0.0; 32]))])));
+    }
+    entry.push(("2", dict(settings)));
+    dict(vec![("0", TNode::Array(vec![dict(vec![("0", dict(entry))])]))])
+}
+
+fn paint() -> TNode {
+    dict(vec![("99", name("SimplePaint")), ("0", dict(vec![("0", int(1)), ("1", numbers(&[1.0, 1.0, 1.0, 1.0]))]))])
+}
+
+/// The run: an empty text with one paragraph and one style run (the keys `build_doc` writes, at
+/// the values it treats as unset) and an empty layout.
+fn run() -> TNode {
+    let para = dict(vec![
+        ("0", int(0)),
+        ("1", number(0.0)),
+        ("2", number(0.0)),
+        ("3", number(0.0)),
+        ("4", number(0.0)),
+        ("5", number(0.0)),
+        ("21", boolean(false)),
+        ("29", boolean(false)),
+        ("33", int(0)),
+    ]);
+    let style = dict(vec![
+        ("0", int(0)),
+        ("1", number(12.0)),
+        ("2", boolean(false)),
+        ("3", boolean(false)),
+        ("4", boolean(true)),
+        ("5", number(0.01)),
+        ("6", number(1.0)),
+        ("7", number(1.0)),
+        ("8", int(0)),
+        ("9", number(0.0)),
+        ("11", int(1)),
+        ("12", int(0)),
+        ("13", int(0)),
+        ("18", boolean(false)),
+        ("36", number(0.0)),
+        ("53", paint()),
+        ("54", paint()),
+        ("56", boolean(true)),
+        ("57", boolean(false)),
+        ("58", boolean(true)),
+        ("63", number(1.0)),
+    ]);
+    // Each run names its sheet (`/0`) and the other sheet's index (0), in key order.
+    let entry = |kv: Vec<(&str, TNode)>| {
+        let mut inner = vec![("0", string(""))];
+        inner.extend(kv);
+        TNode::Array(vec![dict(vec![("0", dict(vec![("0", dict(inner))])), ("1", int(0))])])
+    };
+    let text = dict(vec![
+        ("0", string("")),
+        ("5", dict(vec![("0", entry(vec![("5", para), ("6", int(0))]))])),
+        ("6", dict(vec![("0", entry(vec![("5", int(0)), ("6", style)]))])),
+    ]);
+    let layout = dict(vec![("0", TNode::Array(vec![dict(vec![("0", int(0))])])), ("2", TNode::Array(Vec::new()))]);
+    dict(vec![("0", text), ("1", layout)])
+}
+
+/// A new document, for a box text when `boxed`.
+pub(crate) fn document(boxed: bool) -> TNode {
+    let fonts = FONTS.iter().map(|f| dict(vec![("0", dict(vec![("99", name("CoolTypeFont")), ("0", dict(vec![("0", string(f))]))]))])).collect();
+    let resources = dict(vec![("1", dict(vec![("0", TNode::Array(fonts))])), ("5", sheets()), ("6", sheets()), ("8", frame(boxed))]);
+    let classes = BREAK_CLASSES.iter().map(|(c, class)| dict(vec![("0", string(&c.to_string())), ("1", string(class))])).collect();
+    let settings = dict(vec![
+        ("0", dict(vec![("0", int(3)), ("1", TNode::Array(classes))])),
+        ("1", int(0)),
+        ("2", int(0)),
+        // Superscript size and offset, subscript size and offset, small caps size.
+        ("3", number(0.583)),
+        ("4", number(0.333)),
+        ("5", number(0.583)),
+        ("6", number(0.333)),
+        ("7", number(0.7)),
+        ("8", boolean(true)),
+        ("16", boolean(false)),
+        ("17", int(0)),
+    ]);
+    let composer = TNode::Array(vec![dict(vec![
+        ("0", int(0)),
+        ("1", dict(vec![("0", int(7)), ("1", int(10)), ("2", int(0)), ("3", string("DVA"))])),
+        ("2", string_bits("10000001000001010001100000000011101000000000000110000000")),
+        ("3", string_bits("00110")),
+        ("4", TNode::Array(vec![dict(vec![("0", int(0)), ("1", string("Version 7.12"))])])),
+    ])]);
+    let doc_body = dict(vec![("0", settings), ("5", composer), ("1", TNode::Array(vec![run()]))]);
+    dict(vec![("0", resources), ("1", doc_body)])
+}
+
+/// A string of bits as the composer stores its flags: plain ASCII between parentheses.
+fn string_bits(bits: &str) -> TNode {
+    TNode::Atom(format!("({bits})").into_bytes())
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn the_document_parses_back_and_has_the_paths_build_doc_writes() {
+        for boxed in [false, true] {
+            let doc = super::document(boxed);
+            let bytes = crate::export::textdoc::write(&doc);
+            assert_eq!(crate::export::textdoc::parse(&bytes), Some(doc.clone()));
+            for path in ["0/1/0", "1/1[0]/0/5/0[0]/0/0/5", "1/1[0]/0/6/0[0]/0/0/6/53/0", "1/1[0]/1"] {
+                assert!(doc.path(path).is_some(), "{path}");
+            }
+            assert_eq!(doc.path("0/8/0[0]/0/1").is_some(), boxed);
+        }
+    }
+}
+
+#[cfg(test)]
+mod needed {
+    /// The parts After Effects skips the layer without, or crashes on (read-backs t2-*, t3-*).
+    #[test]
+    fn the_document_keeps_what_after_effects_needs() {
+        for boxed in [false, true] {
+            let doc = super::document(boxed);
+            for path in ["0/5", "0/6", "0/8", "1/0", "1/5", "1/0/0/0"] {
+                assert!(doc.path(path).is_some(), "{path}");
+            }
+            match doc.path("1/0/0/1") {
+                Some(crate::export::textdoc::TNode::Array(classes)) => assert_eq!(classes.len(), 7),
+                other => panic!("line-break classes: {other:?}"),
+            }
+            assert!(doc.path("1/1[0]/0/5/0[0]/0/0/6").is_some() && doc.path("1/1[0]/0/6/0[0]/0/0/5").is_some());
+        }
+    }
+}
diff --git a/crates/aep/src/export/timebase.rs b/crates/aep/src/export/timebase.rs
new file mode 100644
index 000000000..7414a1aa7
--- /dev/null
+++ b/crates/aep/src/export/timebase.rs
@@ -0,0 +1,134 @@
+//! The composition time base: the pair (frame duration, time scale) After Effects stores for a
+//! frame rate, and conversions between [`Tick`]s and time units.
+//!
+//! Evidence (generated compositions saved by After Effects, see `docs/aep-export.md`): the time
+//! scale is 23 976 for the NTSC rates (frame duration 1000, 800, 400, 200 for 23.976, 29.97,
+//! 59.94, 119.88); for every other rate the frame duration is the smallest power of two for which
+//! `rate x frame duration >= 24 576` (25 fps: 1024 and 25 600; 12 fps: 2048 and 24 576; 1 fps:
+//! 32 768 and 32 768; 240 fps: 128 and 30 720).
+
+use effectcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
+
+/// Frame duration and time scale in units; one frame lasts `frame_duration` units and a second
+/// has `timescale` units.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct TimeBase {
+    pub frame_duration: u32,
+    pub timescale: u32,
+}
+
+/// The 16.16 fixed-point rate After Effects stores next to the time base (a float32 rate).
+pub(crate) fn fixed_rate(rate: FrameRate) -> u32 {
+    let fps = ntsc_typed(rate).unwrap_or(rate.as_f64() as f32);
+    let v = (f64::from(fps) * 65536.0).round();
+    if v.is_finite() && v >= 0.0 && v <= f64::from(u32::MAX) { v as u32 } else { 0 }
+}
+
+/// The typed value of an NTSC rate (23.976, 29.97, 59.94, 119.88), which After Effects stores as
+/// a float32 of exactly these decimals.
+pub(crate) fn ntsc_typed(rate: FrameRate) -> Option<f32> {
+    [(FrameRate::FPS_23_976, 23.976f32), (FrameRate::FPS_29_97, 29.97), (FrameRate::FPS_59_94, 59.94), (FrameRate::FPS_119_88, 119.88)]
+        .into_iter()
+        .find(|(r, _)| *r == rate)
+        .map(|(_, v)| v)
+}
+
+/// The time base for `rate`, or `None` for a rate After Effects cannot hold (non-positive, or not
+/// representable with a frame duration that is a power of two).
+pub(crate) fn time_base(rate: FrameRate) -> Option<TimeBase> {
+    if rate.num <= 0 || rate.den <= 0 {
+        return None;
+    }
+    if let Some(v) = ntsc_typed(rate) {
+        let fd = if v < 24.0 {
+            1000
+        } else if v < 30.0 {
+            800
+        } else if v < 60.0 {
+            400
+        } else {
+            200
+        };
+        return Some(TimeBase { frame_duration: fd, timescale: 23976 });
+    }
+    let (num, den) = (i128::from(rate.num), i128::from(rate.den));
+    let mut fd: i128 = 1;
+    while fd <= 65536 {
+        let ts = num.checked_mul(fd)?;
+        if ts % den == 0 {
+            let ts = ts / den;
+            if ts >= 24576 {
+                return Some(TimeBase { frame_duration: u32::try_from(fd).ok()?, timescale: u32::try_from(ts).ok()? });
+            }
+        }
+        fd *= 2;
+    }
+    None
+}
+
+impl TimeBase {
+    /// `tick` in time units, rounded to the nearest unit; the second value tells whether it was
+    /// not exact.
+    pub fn units(&self, tick: Tick) -> (i64, bool) {
+        let n = i128::from(tick.0) * i128::from(self.timescale);
+        let d = i128::from(TICKS_PER_SECOND);
+        let q = n.div_euclid(d);
+        let r = n.rem_euclid(d);
+        let rounded = if r * 2 >= d { q + 1 } else { q };
+        (i64::try_from(rounded).unwrap_or(if rounded < 0 { i64::MIN } else { i64::MAX }), r != 0)
+    }
+
+    /// Whole frames of `tick` (nearest).
+    pub fn frames(&self, tick: Tick, rate: FrameRate) -> i64 {
+        let n = i128::from(tick.0) * i128::from(rate.num);
+        let d = i128::from(TICKS_PER_SECOND) * i128::from(rate.den.max(1));
+        let q = n.div_euclid(d);
+        let r = n.rem_euclid(d);
+        let f = if r * 2 >= d { q + 1 } else { q };
+        i64::try_from(f).unwrap_or(0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rates_match_after_effects() {
+        let tb = |n, d| time_base(FrameRate::new(n, d)).map(|t| (t.frame_duration, t.timescale));
+        assert_eq!(tb(25, 1), Some((1024, 25600)));
+        assert_eq!(tb(30, 1), Some((1024, 30720)));
+        assert_eq!(tb(24, 1), Some((1024, 24576)));
+        assert_eq!(tb(12, 1), Some((2048, 24576)));
+        assert_eq!(tb(25, 2), Some((2048, 25600)));
+        assert_eq!(tb(15, 1), Some((2048, 30720)));
+        assert_eq!(tb(48, 1), Some((512, 24576)));
+        assert_eq!(tb(50, 1), Some((512, 25600)));
+        assert_eq!(tb(60, 1), Some((512, 30720)));
+        assert_eq!(tb(240, 1), Some((128, 30720)));
+        assert_eq!(tb(1, 1), Some((32768, 32768)));
+        assert_eq!(tb(30000, 1001), Some((800, 23976)));
+        assert_eq!(tb(24000, 1001), Some((1000, 23976)));
+        assert_eq!(tb(60000, 1001), Some((400, 23976)));
+        assert_eq!(tb(120000, 1001), Some((200, 23976)));
+        assert_eq!(tb(0, 1), None);
+        assert_eq!(tb(1, 0), None);
+    }
+
+    #[test]
+    fn fixed_point_rates() {
+        assert_eq!(fixed_rate(FrameRate::new(25, 1)), 0x19_0000);
+        assert_eq!(fixed_rate(FrameRate::FPS_29_97), 1_964_114);
+        assert_eq!(fixed_rate(FrameRate::FPS_23_976), 1_571_291);
+        assert_eq!(fixed_rate(FrameRate::new(12, 1)), 0xc0000);
+    }
+
+    #[test]
+    fn units_round_to_the_nearest() {
+        let tb = TimeBase { frame_duration: 1024, timescale: 25600 };
+        assert_eq!(tb.units(Tick(TICKS_PER_SECOND)), (25600, false));
+        assert_eq!(tb.units(Tick(TICKS_PER_SECOND / 3)).0, 8533);
+        assert!(tb.units(Tick(TICKS_PER_SECOND / 3)).1);
+        assert_eq!(tb.frames(Tick(TICKS_PER_SECOND * 2), FrameRate::new(25, 1)), 50);
+    }
+}
diff --git a/crates/aep/src/export/tree.rs b/crates/aep/src/export/tree.rs
new file mode 100644
index 000000000..275d2a82f
--- /dev/null
+++ b/crates/aep/src/export/tree.rs
@@ -0,0 +1,109 @@
+//! Small helpers to edit a chunk tree without panicking: every accessor returns a `Result` with
+//! [`crate::export::AepExportError::Internal`] when a prototype does not have the expected shape.
+
+use crate::{Body, Chunk};
+
+use crate::export::AepExportError;
+
+pub(crate) type R<T> = Result<T, AepExportError>;
+
+pub(crate) fn tpl(msg: &'static str) -> AepExportError {
+    AepExportError::Internal(msg)
+}
+
+/// The bytes of a data chunk, owned and mutable.
+pub(crate) fn data_mut<'a>(c: &'a mut Chunk<'static>) -> R<&'a mut Vec<u8>> {
+    match &mut c.body {
+        Body::Data(d) => Ok(d.to_mut()),
+        _ => Err(tpl("expected a data chunk")),
+    }
+}
+
+/// The child vector of a list or nested chunk.
+pub(crate) fn kids_mut<'a>(c: &'a mut Chunk<'static>) -> R<&'a mut Vec<Chunk<'static>>> {
+    match &mut c.body {
+        Body::List { children, .. } | Body::Chunks(children) => Ok(children),
+        _ => Err(tpl("expected a list chunk")),
+    }
+}
+
+pub(crate) fn child_mut<'a>(c: &'a mut Chunk<'static>, id: &[u8; 4]) -> R<&'a mut Chunk<'static>> {
+    kids_mut(c)?.iter_mut().find(|k| k.is(id)).ok_or_else(|| tpl("missing child chunk"))
+}
+
+pub(crate) fn list_mut<'a>(c: &'a mut Chunk<'static>, list_type: &[u8; 4]) -> R<&'a mut Chunk<'static>> {
+    kids_mut(c)?.iter_mut().find(|k| k.is_list(list_type)).ok_or_else(|| tpl("missing child list"))
+}
+
+/// Mutable bytes of the data child `id`.
+pub(crate) fn child_data<'a>(c: &'a mut Chunk<'static>, id: &[u8; 4]) -> R<&'a mut Vec<u8>> {
+    data_mut(child_mut(c, id)?)
+}
+
+pub(crate) fn put(d: &mut [u8], at: usize, bytes: &[u8]) -> R<()> {
+    let end = at.checked_add(bytes.len()).ok_or_else(|| tpl("offset overflow"))?;
+    let dst = d.get_mut(at..end).ok_or_else(|| tpl("chunk shorter than its layout"))?;
+    dst.copy_from_slice(bytes);
+    Ok(())
+}
+
+pub(crate) fn put_u8(d: &mut [u8], at: usize, v: u8) -> R<()> {
+    put(d, at, &[v])
+}
+pub(crate) fn put_u16(d: &mut [u8], at: usize, v: u16) -> R<()> {
+    put(d, at, &v.to_be_bytes())
+}
+pub(crate) fn put_u32(d: &mut [u8], at: usize, v: u32) -> R<()> {
+    put(d, at, &v.to_be_bytes())
+}
+pub(crate) fn put_i32(d: &mut [u8], at: usize, v: i32) -> R<()> {
+    put(d, at, &v.to_be_bytes())
+}
+pub(crate) fn put_f32(d: &mut [u8], at: usize, v: f32) -> R<()> {
+    put(d, at, &v.to_be_bytes())
+}
+pub(crate) fn put_f64(d: &mut [u8], at: usize, v: f64) -> R<()> {
+    put(d, at, &v.to_be_bytes())
+}
+
+/// Sets or clears the bits `mask` of byte `at`.
+pub(crate) fn put_bits(d: &mut [u8], at: usize, mask: u8, on: bool) -> R<()> {
+    let b = d.get_mut(at).ok_or_else(|| tpl("chunk shorter than its layout"))?;
+    if on {
+        *b |= mask;
+    } else {
+        *b &= !mask;
+    }
+    Ok(())
+}
+
+/// Writes `text` NUL padded into `d[at..at + len]` (cut at a character boundary so that at least
+/// one NUL remains).
+pub(crate) fn put_cstr(d: &mut [u8], at: usize, len: usize, text: &str) -> R<()> {
+    let end = at.checked_add(len).ok_or_else(|| tpl("offset overflow"))?;
+    let dst = d.get_mut(at..end).ok_or_else(|| tpl("chunk shorter than its layout"))?;
+    dst.fill(0);
+    let mut n = 0;
+    for ch in text.chars() {
+        let l = ch.len_utf8();
+        if n + l >= len {
+            break;
+        }
+        let mut buf = [0u8; 4];
+        let enc = ch.encode_utf8(&mut buf);
+        for (i, b) in enc.as_bytes().iter().enumerate() {
+            if let Some(slot) = dst.get_mut(n + i) {
+                *slot = *b;
+            }
+        }
+        n += l;
+    }
+    Ok(())
+}
+
+/// Replaces the `Utf8` child of an item or layer with `text`.
+pub(crate) fn set_utf8(c: &mut Chunk<'static>, text: &str) -> R<()> {
+    let k = child_mut(c, b"Utf8")?;
+    *k = Chunk::data(*b"Utf8", text.as_bytes().to_vec());
+    Ok(())
+}
diff --git a/crates/aep/src/export/tree_defs.rs b/crates/aep/src/export/tree_defs.rs
new file mode 100644
index 000000000..66371ea7a
--- /dev/null
+++ b/crates/aep/src/export/tree_defs.rs
@@ -0,0 +1,299 @@
+//! The camera, light, shape and text animator skeletons as tables of [`Node`]s: match names, states, default
+//! names and the decoded fields of each record (`tree_spec`). The rows were listed from our own
+//! cases (the case numbers in each doc comment) through the decoded fields only.
+
+#![cfg_attr(rustfmt, rustfmt::skip)]
+
+use crate::export::tree_spec::{Node, Node::{G, O, P, R}, Rec};
+
+/// The property tree of a two-node camera layer (256): Transform with its records and the Camera Options group.
+pub(crate) static CAMERA_ROOT: &[Node] = &[
+    G("ADBE Transform Group", 1, "-_0_/-", &[
+        R("ADBE Anchor Point", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 72, cdat: &[960.0, 540.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Position", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[(76, 1), (77, 1)], cdat_len: 72, cdat: &[0.0, 0.0, -2666.6666666], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Position_0", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_1", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_2", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Scale", Rec { state: 3, label: "-_0_/-", dims: 3, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 120, cdat: &[1.0, 1.0, 1.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Rotate Z", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Opacity", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Envir Appear in Reflect", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    ]),
+    G("ADBE Camera Options Group", 1, "-_0_/-", &[
+    ]),
+];
+
+/// The property tree of a spot light layer (254).
+pub(crate) static SPOT_ROOT: &[Node] = &[
+    G("ADBE Transform Group", 1, "-_0_/-", &[
+        R("ADBE Anchor Point", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 72, cdat: &[960.0, 540.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Position", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[(76, 1), (77, 1)], cdat_len: 72, cdat: &[0.0, 0.0, -1333.3333333], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Position_0", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_1", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_2", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Scale", Rec { state: 3, label: "-_0_/-", dims: 3, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 120, cdat: &[1.0, 1.0, 1.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Rotate Z", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Opacity", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Envir Appear in Reflect", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    ]),
+    G("ADBE Light Options Group", 1, "-_0_/-", &[
+        G("ADBE Light Env Atom", 3, "-_0_/-", &[
+        ]),
+        R("ADBE Light Backgd Visible", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Light Backgd Opacity", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[100.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Light Backgd Blur", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Light Intensity", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Light Falloff Start", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[500.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Light Falloff Distance", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[500.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Casts Shadows", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+    ]),
+];
+
+/// The property tree of a point light layer (252).
+pub(crate) static POINT_ROOT: &[Node] = &[
+    G("ADBE Transform Group", 1, "-_0_/-", &[
+        R("ADBE Anchor Point", Rec { state: 3, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 72, cdat: &[960.0, 540.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Position", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[(76, 1), (77, 1)], cdat_len: 72, cdat: &[0.0, 0.0, -1333.3333333], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Position_0", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_1", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_2", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Scale", Rec { state: 3, label: "-_0_/-", dims: 3, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 120, cdat: &[1.0, 1.0, 1.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        O("ADBE Orientation", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x00060007, byte5: 0x07, header: &[(79, 1)], cdat_len: 24, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Rotate X", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Rotate Y", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Rotate Z", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Opacity", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Envir Appear in Reflect", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    ]),
+    G("ADBE Light Options Group", 1, "-_0_/-", &[
+        G("ADBE Light Env Atom", 3, "-_0_/-", &[
+        ]),
+        R("ADBE Light Backgd Visible", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Light Backgd Opacity", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[100.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Light Backgd Blur", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Light Cone Angle", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[90.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Light Cone Feather 2", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Light Falloff Start", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[500.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Light Falloff Distance", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[500.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Casts Shadows", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+    ]),
+];
+
+/// The property tree of a shape layer (519) apart from Time Remapping and the contents.
+pub(crate) static SHAPE_ROOT: &[Node] = &[
+    G("ADBE Root Vectors Group", 1025, "-_0_/-", &[
+    ]),
+    G("ADBE Transform Group", 1, "-_0_/-", &[
+        R("ADBE Position_0", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        R("ADBE Position_1", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+        O("ADBE Orientation", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x00060007, byte5: 0x07, header: &[(79, 1)], cdat_len: 24, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Rotate X", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Rotate Y", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Envir Appear in Reflect", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    ]),
+    G("ADBE Layer Styles", 3, "-_0_/-", &[
+        G("ADBE Blend Options Group", 3, "-_0_/-", &[
+            G("ADBE Adv Blend Group", 1, "-_0_/-", &[
+            ]),
+        ]),
+        G("dropShadow/enabled", 2, "-_0_/-", &[
+        ]),
+        G("innerShadow/enabled", 2, "-_0_/-", &[
+        ]),
+        G("outerGlow/enabled", 2, "-_0_/-", &[
+        ]),
+        G("innerGlow/enabled", 2, "-_0_/-", &[
+        ]),
+        G("bevelEmboss/enabled", 2, "-_0_/-", &[
+        ]),
+        G("chromeFX/enabled", 2, "-_0_/-", &[
+        ]),
+        G("solidFill/enabled", 2, "-_0_/-", &[
+        ]),
+        G("gradientFill/enabled", 2, "-_0_/-", &[
+        ]),
+        G("patternFill/enabled", 2, "-_0_/-", &[
+        ]),
+        G("frameFX/enabled", 2, "-_0_/-", &[
+        ]),
+    ]),
+    G("ADBE Extrsn Options Group", 3, "-_0_/-", &[
+        R("ADBE Bevel Direction", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    ]),
+    G("ADBE Material Options Group", 3, "-_0_/-", &[
+        R("ADBE Casts Shadows", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Light Transmission", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Accepts Shadows", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Accepts Lights", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Shadow Color", Rec { state: 3, label: "-_0_/-", dims: 4, template: 0, class: 0x0002ffff, byte5: 0x07, header: &[(79, 1)], cdat_len: 96, cdat: &[255.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Appears in Reflections", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+        R("ADBE Ambient Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[100.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Diffuse Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Specular Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Shininess Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[5.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Metal Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[100.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Reflection Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Glossiness Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[100.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Fresnel Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Transparency Coefficient", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Transp Rolloff", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+        R("ADBE Index of Refraction", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: Some((1.0, 2.0)), tdpi: None }),
+    ]),
+    G("ADBE Audio Group", 3, "-_0_/-", &[
+    ]),
+    G("ADBE Layer Sets", 3, "-_0_/-", &[
+    ]),
+];
+
+/// The camera and light option records the exporter writes (342-345, 254).
+pub(crate) static OPTIONS: &[Node] = &[
+    R("ADBE Camera Depth of Field", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Camera Focus Distance", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[800.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+    R("ADBE Camera Aperture", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[30.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+    R("ADBE Light Intensity", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+    R("ADBE Light Color", Rec { state: 1, label: "-_0_/-", dims: 4, template: 0, class: 0x0002ffff, byte5: 0x07, header: &[(79, 1)], cdat_len: 96, cdat: &[255.0, 255.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Light Cone Angle", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[60.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Light Cone Feather 2", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[30.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+];
+
+/// The shape items the exporter writes, as empty groups with their default names (240, 451-471).
+pub(crate) static SHAPE_ITEMS: &[Node] = &[
+    G("ADBE Vector Group", 1, "Group 1", &[
+        G("ADBE Vectors Group", 1025, "-_0_/-", &[
+        ]),
+        G("ADBE Vector Transform Group", 1, "-_0_/-", &[
+        ]),
+        G("ADBE Vector Materials Group", 1, "-_0_/-", &[
+        ]),
+    ]),
+    G("ADBE Vector Shape - Rect", 1, "Rectangle Path 1", &[
+    ]),
+    G("ADBE Vector Shape - Ellipse", 1, "Ellipse Path 1", &[
+    ]),
+    G("ADBE Vector Shape - Star", 1, "Polystar Path 1", &[
+    ]),
+    G("ADBE Vector Graphic - Fill", 1, "Fill 1", &[
+    ]),
+    G("ADBE Vector Graphic - Stroke", 1, "Stroke 1", &[
+        G("ADBE Vector Stroke Dashes", 1, "-_0_/-", &[
+        ]),
+        G("ADBE Vector Stroke Taper", 1, "-_0_/-", &[
+        ]),
+        G("ADBE Vector Stroke Wave", 1, "-_0_/-", &[
+        ]),
+    ]),
+    G("ADBE Vector Graphic - G-Fill", 1, "Gradient Fill 1", &[
+    ]),
+    G("ADBE Vector Graphic - G-Stroke", 1, "Gradient Stroke 1", &[
+        G("ADBE Vector Stroke Dashes", 1, "-_0_/-", &[
+        ]),
+        G("ADBE Vector Stroke Taper", 1, "-_0_/-", &[
+        ]),
+        G("ADBE Vector Stroke Wave", 1, "-_0_/-", &[
+        ]),
+    ]),
+    G("ADBE Vector Filter - Trim", 1, "Trim Paths 1", &[
+    ]),
+    G("ADBE Vector Filter - RC", 1, "Round Corners 1", &[
+    ]),
+    G("ADBE Vector Filter - Merge", 1, "Merge Paths 1", &[
+    ]),
+    G("ADBE Vector Filter - Offset", 1, "Offset Paths 1", &[
+    ]),
+    G("ADBE Vector Filter - Repeater", 1, "Repeater 1", &[
+        G("ADBE Vector Repeater Transform", 1, "-_0_/-", &[
+        ]),
+    ]),
+    G("ADBE Vector Shape - Group", 1, "Path 1", &[
+        P("ADBE Vector Shape", Rec { state: 1, label: "-_0_/-", dims: 1, template: 1, class: 0x00020007, byte5: 0x07, header: &[], cdat_len: 4, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+    ]),
+];
+
+/// The shape value records (239, 242).
+pub(crate) static SHAPE_RECORDS: &[Node] = &[
+    R("ADBE Vector Ellipse Size", Rec { state: 1, label: "-_0_/-", dims: 2, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 80, cdat: &[400.0, 300.0], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Vector Fill Color", Rec { state: 1, label: "-_0_/-", dims: 4, template: 0, class: 0x0002ffff, byte5: 0x07, header: &[(79, 1)], cdat_len: 96, cdat: &[255.0, 0.0, 255.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Ellipse Position", Rec { state: 1, label: "-_0_/-", dims: 2, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 48, cdat: &[100.0, 50.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Fill Opacity", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Vector Fill Rule", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[2.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Anchor", Rec { state: 1, label: "-_0_/-", dims: 2, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 48, cdat: &[10.0, 20.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Scale", Rec { state: 1, label: "-_0_/-", dims: 2, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 80, cdat: &[50.0, 80.0], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Vector Rotation", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[30.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Group Opacity", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[40.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Vector Skew", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[20.0], key_size: 0, limits: Some((-85.0, 85.0)), tdpi: None }),
+    R("ADBE Vector Skew Axis", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[45.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Stroke Color", Rec { state: 1, label: "-_0_/-", dims: 4, template: 0, class: 0x0002ffff, byte5: 0x07, header: &[(79, 1)], cdat_len: 96, cdat: &[255.0, 255.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Stroke Width", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[6.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Vector Stroke Opacity", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Vector Rect Size", Rec { state: 1, label: "-_0_/-", dims: 2, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 80, cdat: &[200.0, 100.0], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Vector Rect Roundness", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[30.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Vector Stroke Line Cap", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[2.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Stroke Line Join", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[2.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Vector Stroke Miter Limit", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[4.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Vector Position", Rec { state: 1, label: "-_0_/-", dims: 2, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 48, cdat: &[50.0, 50.0], key_size: 0, limits: None, tdpi: None }),
+];
+
+/// The empty text animator group of a text layer (579).
+pub(crate) static TEXT_ANIMATORS: &[Node] = &[
+    G("ADBE Text Animators", 1, "-_0_/-", &[
+    ]),
+];
+
+/// One text animator with a range selector and an empty property group (579, 580).
+pub(crate) static TEXT_ANIMATOR: &[Node] = &[
+    G("ADBE Text Animator", 1, "Animator 1", &[
+        G("ADBE Text Selectors", 1, "-_0_/-", &[
+            G("ADBE Text Selector", 1, "Range Selector 1", &[
+                G("ADBE Text Range Advanced", 1, "-_0_/-", &[
+                ]),
+            ]),
+        ]),
+        G("ADBE Text Animator Properties", 1, "-_0_/-", &[
+        ]),
+    ]),
+];
+
+/// The text animator property records (580-592, 728).
+pub(crate) static TEXT_ANIMATOR_RECORDS: &[Node] = &[
+    R("ADBE Text Position 3D", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 72, cdat: &[0.0, -50.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Anchor Point 3D", Rec { state: 1, label: "-_0_/-", dims: 3, template: 3, class: 0xffffffff, byte5: 0x0f, header: &[], cdat_len: 72, cdat: &[3.0, 4.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Scale 3D", Rec { state: 1, label: "-_0_/-", dims: 3, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 120, cdat: &[150.0, 120.0, 100.0], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Text Skew", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[10.0], key_size: 0, limits: Some((-70.0, 70.0)), tdpi: None }),
+    R("ADBE Text Skew Axis", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[20.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Rotation", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[45.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Opacity", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[37.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Text Fill Color", Rec { state: 1, label: "-_0_/-", dims: 4, template: 0, class: 0x0002ffff, byte5: 0x07, header: &[(79, 1)], cdat_len: 96, cdat: &[255.0, 0.0, 255.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Stroke Color", Rec { state: 1, label: "-_0_/-", dims: 4, template: 0, class: 0x0002ffff, byte5: 0x07, header: &[(79, 1)], cdat_len: 96, cdat: &[255.0, 0.0, 0.0, 255.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Stroke Width", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[3.0], key_size: 0, limits: Some((-1000.0, 1000.0)), tdpi: None }),
+    R("ADBE Text Tracking Amount", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[20.0], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Text Line Spacing", Rec { state: 1, label: "-_0_/-", dims: 2, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 80, cdat: &[10.0, 20.0], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Text Blur", Rec { state: 1, label: "-_0_/-", dims: 2, template: 0, class: 0x0002ffff, byte5: 0x01, header: &[], cdat_len: 80, cdat: &[5.0, 6.0], key_size: 0, limits: Some((0.0, 10000.0)), tdpi: None }),
+    R("ADBE Text Percent Start", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[25.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Text Percent End", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[75.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Text Percent Offset", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[10.0], key_size: 0, limits: Some((-100.0, 100.0)), tdpi: None }),
+    R("ADBE Text Range Units", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[2.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Index Start", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 32000.0)), tdpi: None }),
+    R("ADBE Text Index End", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[4.0], key_size: 0, limits: Some((0.0, 32000.0)), tdpi: None }),
+    R("ADBE Text Index Offset", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((-32000.0, 32000.0)), tdpi: None }),
+    R("ADBE Text Range Type2", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[3.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Selector Mode", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[2.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Selector Max Amount", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((-100.0, 100.0)), tdpi: None }),
+    R("ADBE Text Range Shape", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0x00020000, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[2.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Selector Smoothness", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[50.0], key_size: 0, limits: Some((0.0, 100.0)), tdpi: None }),
+    R("ADBE Text Levels Max Ease", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[30.0], key_size: 0, limits: Some((-100.0, 100.0)), tdpi: None }),
+    R("ADBE Text Levels Min Ease", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[40.0], key_size: 0, limits: Some((-100.0, 100.0)), tdpi: None }),
+    R("ADBE Text Randomize Order", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Text Random Seed", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[7.0], key_size: 0, limits: Some((0.0, 10000.0)), tdpi: None }),
+    R("ADBE Text Character Offset", Rec { state: 1, label: "-_0_/-", dims: 1, template: 0, class: 0xffffffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[3.0], key_size: 0, limits: Some((-65535.0, 65535.0)), tdpi: None }),
+];
+
+/// The inert Transform records of an AV layer (000): split Position, Orientation, X and Y
+/// Rotation, Appears in Reflections, all at their defaults (state 3).
+pub(crate) static AV_TRANSFORM: &[Node] = &[
+    R("ADBE Position_0", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+    R("ADBE Position_1", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: Some((0.0, 0.0)), tdpi: None }),
+    O("ADBE Orientation", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x00060007, byte5: 0x07, header: &[(79, 1)], cdat_len: 24, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Rotate X", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Rotate Y", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0x0001ffff, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[], key_size: 0, limits: None, tdpi: None }),
+    R("ADBE Envir Appear in Reflect", Rec { state: 3, label: "-_0_/-", dims: 1, template: 0, class: 0xffff0004, byte5: 0x01, header: &[], cdat_len: 40, cdat: &[1.0], key_size: 0, limits: None, tdpi: None }),
+];
diff --git a/crates/aep/src/export/tree_spec.rs b/crates/aep/src/export/tree_spec.rs
new file mode 100644
index 000000000..8db9e267c
--- /dev/null
+++ b/crates/aep/src/export/tree_spec.rs
@@ -0,0 +1,104 @@
+//! Property trees described as data: groups and records by match name with their decoded fields
+//! (aep-format.md 3.4), built into chunks by [`build`]. The camera, light, shape and text
+//! skeletons the exporter fills are tables of these (`tree_defs`).
+
+use crate::Chunk;
+use crate::export::synth::{KeyTemplate, RecSpec, key_list, tdb4, tdmn, tdsn};
+
+/// A property record: its state (`tdsb`), user name, the `tdb4` header fields (components, key
+/// template, class word, byte 5, decoded bytes that differ from what [`tdb4`] derives), the
+/// static value (`cdat`: its length and the leading values, the rest zero) or the record size of
+/// an empty key list, the limits, and a layer id (`tdpi` / `tdps`).
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Rec {
+    pub state: u32,
+    pub label: &'static str,
+    pub dims: u8,
+    pub template: u8,
+    pub class: u32,
+    pub byte5: u8,
+    pub header: &'static [(u8, u8)],
+    pub cdat_len: u16,
+    pub cdat: &'static [f64],
+    pub key_size: u16,
+    pub limits: Option<(f64, f64)>,
+    pub tdpi: Option<u32>,
+}
+
+/// A node of a property tree.
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Node {
+    /// A group: match name, state, user name, children (the closing `ADBE Group End` is added).
+    G(&'static str, u32, &'static str, &'static [Node]),
+    /// A property record under its match name.
+    R(&'static str, Rec),
+    /// Orientation: its record in an `otst` with `otky` holding one zero `otda` (three degrees)
+    /// per key (aep-format.md 3.5, keyed Orientation).
+    O(&'static str, Rec),
+    /// A path property (`om-s`): its record and `omks` with one empty shape (aep-format.md 3.8).
+    P(&'static str, Rec),
+}
+
+fn record(r: &Rec) -> Chunk<'static> {
+    let template = if r.template == 0 { KeyTemplate::Plain } else { KeyTemplate::Spatial(r.template) };
+    let spec = RecSpec { dims: r.dims, template, class: r.class, limits: r.limits, byte5: Some(r.byte5) };
+    let keyed = r.key_size > 0;
+    let mut header = tdb4(&spec, keyed, 25_600);
+    for (at, v) in r.header {
+        if let Some(slot) = header.get_mut(usize::from(*at)) {
+            *slot = *v;
+        }
+    }
+    let mut kids = vec![Chunk::data(*b"tdsb", r.state.to_be_bytes().to_vec()), tdsn(r.label), Chunk::data(*b"tdb4", header)];
+    if keyed {
+        kids.push(key_list(u32::from(r.key_size), 0, Vec::new()));
+    } else {
+        let mut cdat = vec![0u8; usize::from(r.cdat_len)];
+        for (slot, v) in cdat.as_chunks_mut::<8>().0.iter_mut().zip(r.cdat) {
+            slot.copy_from_slice(&v.to_be_bytes());
+        }
+        kids.push(Chunk::data(*b"cdat", cdat));
+    }
+    if let Some((lo, hi)) = r.limits {
+        kids.push(Chunk::data(*b"tdum", lo.to_be_bytes().to_vec()));
+        kids.push(Chunk::data(*b"tduM", hi.to_be_bytes().to_vec()));
+    }
+    if let Some(id) = r.tdpi {
+        kids.push(Chunk::data(*b"tdpi", id.to_be_bytes().to_vec()));
+        kids.push(Chunk::data(*b"tdps", vec![0; 4]));
+    }
+    Chunk::list(*b"tdbs", kids)
+}
+
+/// The chunks of `nodes` (each a `tdmn` and its list).
+pub(crate) fn build(nodes: &[Node]) -> Vec<Chunk<'static>> {
+    let mut out = Vec::with_capacity(nodes.len() * 2);
+    for n in nodes {
+        match n {
+            Node::G(name, state, label, kids) => {
+                let mut body = vec![Chunk::data(*b"tdsb", state.to_be_bytes().to_vec()), tdsn(label)];
+                body.extend(build(kids));
+                body.push(tdmn("ADBE Group End"));
+                out.push(tdmn(name));
+                out.push(Chunk::list(*b"tdgp", body));
+            }
+            Node::R(name, r) => {
+                out.push(tdmn(name));
+                out.push(record(r));
+            }
+            Node::P(name, r) => {
+                let shap = Chunk::list(
+                    *b"shap",
+                    vec![Chunk::data(*b"shph", crate::export::masks::shph()), key_list(8, 0, Vec::new()), Chunk::data(*b"omtn", Vec::new())],
+                );
+                out.push(tdmn(name));
+                out.push(Chunk::list(*b"om-s", vec![record(r), Chunk::list(*b"omks", vec![shap])]));
+            }
+            Node::O(name, r) => {
+                out.push(tdmn(name));
+                out.push(Chunk::list(*b"otst", vec![record(r), Chunk::list(*b"otky", vec![Chunk::data(*b"otda", vec![0; 24])])]));
+            }
+        }
+    }
+    out
+}
diff --git a/crates/aep/src/import.rs b/crates/aep/src/import.rs
new file mode 100644
index 000000000..fae3b3256
--- /dev/null
+++ b/crates/aep/src/import.rs
@@ -0,0 +1,159 @@
+//! After Effects project (`.aep`) import: the typed view of [`effectcraft_aep`] mapped into an
+//! EffectCraft [`Project`]. The XML form (`.aepx`) is accepted as well: it is read into the same
+//! chunk tree ([`crate::parse_any`] picks the reader by content).
+//!
+//! What arrives: the project item tree (folders), project settings (depth, working space, time
+//! display), compositions (size, exact frame rate, duration, work area, background, pixel
+//! aspect, motion blur, shutter, renderer, markers), solid, null, adjustment, footage,
+//! precomposition, text, shape, camera and light layers (name, timing, stretch, switches, label,
+//! blend mode, parent, track matte, markers, time remapping), the Transform properties (static
+//! values and keyframes with interpolation, ease and spatial tangents) and expressions as source
+//! text, layer masks, the Source Text and text animators of text layers, shape groups and their
+//! items, layer styles, the effects of [`supported_effects`] with their parameters and keyframes
+//! in stack order, solids, and footage files and image sequences as links (missing files become
+//! missing-footage placeholders). `docs/aep-import.md` has the full list.
+//!
+//! What does not arrive is **reported**, never dropped silently: [`ImportReport`] counts other
+//! effects (by match name) and unimported effect parameters, unusable masks, layer style
+//! features, text layer features, shape items, unsupported blend modes and transform
+//! properties, simplified keyframes and unreadable data per [`LossCategory`]. By default the import
+//! is refused when anything would be lost ([`ImportOptions::allow_losses`] lifts that); a refusal
+//! changes nothing. A damaged file yields an error or a report, never a panic.
+//!
+//! The crate sits at L3 (above `effectcraft-project`, as `effectcraft-lottie` does) so it builds
+//! for wasm32; it reads no files itself: the caller passes the bytes, a way to ask whether a
+//! footage path exists and one to ask whether a font is installed.
+
+mod build;
+mod camera;
+mod effects;
+mod lumetri;
+mod markers;
+mod masks;
+mod props;
+mod puppet;
+mod report;
+mod settings;
+mod shapes;
+mod styles;
+mod text;
+mod text_anim;
+mod time;
+
+use effectcraft_project::{ItemId, Project, ProjectSettings};
+
+pub use effects::supported_effects;
+pub use report::{AeVersionInfo, ImportReport, Imported, LIMITATIONS, Loss, LossCategory, MAX_DETAILS, TESTED_MAJORS, UNKNOWN};
+
+/// Why an `.aep` was not imported.
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum AepImportError {
+    /// The file is not a readable After Effects project container.
+    #[error("{0}")]
+    Container(#[from] crate::AepError),
+    /// The container has no project (no `Fold` list).
+    #[error("the file holds no After Effects project")]
+    NoProject,
+    /// Parts of the project cannot be imported and losses were not allowed. The project is
+    /// unchanged; the report says what would be lost.
+    #[error("importing would lose {}; allow losses to import anyway", .0.summary())]
+    Refused(Box<ImportReport>),
+}
+
+/// Options of [`import`].
+pub struct ImportOptions<'a> {
+    /// Import even when [`ImportReport::losses`] is not empty.
+    pub allow_losses: bool,
+    /// Whether a footage path exists (the caller's file access); a path that does not becomes a
+    /// missing-footage placeholder.
+    pub exists: &'a dyn Fn(&str) -> bool,
+    /// Whether a font (a PostScript name such as `TimesNewRomanPSMT`) is installed; fonts it
+    /// rejects are listed in [`ImportReport::missing_fonts`]. Text keeps the font name either way.
+    pub has_font: &'a dyn Fn(&str) -> bool,
+    /// The folder every imported item goes into (After Effects names it after the file).
+    pub folder_name: &'a str,
+    /// Whether the caller takes over the file's project settings ([`ImportResult::settings`]).
+    /// When not, a setting EffectCraft has no counterpart for is no loss (nothing is changed), so it
+    /// is not reported.
+    pub settings: bool,
+}
+
+impl<'a> ImportOptions<'a> {
+    /// Losses refused, every font taken as installed, folder `After Effects Project`, the file's
+    /// settings taken over.
+    pub fn new(exists: &'a dyn Fn(&str) -> bool) -> Self {
+        Self { allow_losses: false, exists, has_font: &any_font, folder_name: "After Effects Project", settings: true }
+    }
+}
+
+/// The font check of [`ImportOptions::new`]: every font counts as installed.
+fn any_font(_: &str) -> bool {
+    true
+}
+
+/// What an import created.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ImportResult {
+    /// The folder holding the imported items.
+    pub folder: ItemId,
+    /// The compositions, in file order.
+    pub comps: Vec<ItemId>,
+    /// Every item created, the folder first.
+    pub items: Vec<ItemId>,
+    pub report: ImportReport,
+    /// The project's settings with those the file stores (colour depth, working space, working
+    /// gamma, the linear-light switches, time display, frame count start) put in. [`import`]
+    /// leaves the project's own settings alone; a caller opening the file as a new project
+    /// applies these.
+    pub settings: ProjectSettings,
+}
+
+/// Imports the `.aep` or `.aepx` in `bytes` into `project` (as new items; nothing existing changes).
+///
+/// # Errors
+/// [`AepImportError::Container`] / [`AepImportError::NoProject`] for a file that is not a project,
+/// [`AepImportError::Refused`] when something would be lost and `allow_losses` is not set. On any
+/// error `project` is unchanged.
+pub fn import(project: &mut Project, bytes: &[u8], options: &ImportOptions<'_>) -> Result<ImportResult, AepImportError> {
+    let file = crate::parse_any(bytes)?;
+    let view = crate::Project::new(&file).ok_or(AepImportError::NoProject)?;
+    // Work on a copy so a refusal leaves the project untouched (compositions are shared, cheap).
+    let mut work = project.clone();
+    let (folder, comps, items, mut report) = build::run(&mut work, &view, options);
+    report.ae_version = report::AeVersionInfo::of(&file);
+    if let Some(line) = report.ae_version.limitation() {
+        report.limitations.push(line);
+    }
+    let mut col = report::Collector::default();
+    let settings = settings::map(&file, &work.settings, &mut col);
+    for loss in col.finish().losses.into_iter().filter(|_| options.settings) {
+        let at = report.losses.iter().position(|l| l.category > loss.category).unwrap_or(report.losses.len());
+        report.losses.insert(at, loss);
+    }
+    if !options.allow_losses && !report.is_lossless() {
+        return Err(AepImportError::Refused(Box::new(report)));
+    }
+    work.fix_next_id();
+    *project = work;
+    Ok(ImportResult { folder, comps, items, report, settings })
+}
+
+/// The report an import would produce, without touching any project (a dry run); every font
+/// counts as installed (see [`analyze_with`]).
+///
+/// # Errors
+/// As [`import`], except that losses are never refused.
+pub fn analyze(bytes: &[u8], exists: &dyn Fn(&str) -> bool) -> Result<ImportReport, AepImportError> {
+    analyze_with(bytes, &ImportOptions::new(exists))
+}
+
+/// The report an import with `options` would produce (losses are always allowed), without touching
+/// any project.
+///
+/// # Errors
+/// As [`import`], except that losses are never refused.
+pub fn analyze_with(bytes: &[u8], options: &ImportOptions<'_>) -> Result<ImportReport, AepImportError> {
+    let mut scratch = Project::default();
+    let options = ImportOptions { allow_losses: true, ..*options };
+    Ok(import(&mut scratch, bytes, &options)?.report)
+}
diff --git a/crates/aep/src/import/build.rs b/crates/aep/src/import/build.rs
new file mode 100644
index 000000000..7d5b902f1
--- /dev/null
+++ b/crates/aep/src/import/build.rs
@@ -0,0 +1,966 @@
+//! The walk over the project: items first, then the layers of every composition.
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use crate::{
+    BlendMode as AepBlend, CompHeader, EffectDefinitions, Item as AepItem, ItemKind as AepKind, Layer as AepLayer, LayerHeader, LayerType, LightType,
+    Project as AepProject, PropNode,
+};
+use crate::{MatteMode, Quality as AepQuality, Rational, Renderer as AepRenderer, TrackMatte as AepMatte};
+use effectcraft_color::{BlendMode, Label};
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{
+    AutoOrient, Comp, Footage, FootageKind, ItemId, ItemKind, Layer, LayerId, LayerSource, LightKind, MatteKind, Project, Quality, Solid, TrackMatte,
+};
+use effectcraft_time::Tick;
+
+use crate::import::ImportOptions;
+use crate::import::camera::{import_camera_options, import_light_options};
+use crate::import::effects::{LayerCtx, PendingLayerRef, import_effects, resolve_layer_refs};
+use crate::import::markers::{import_markers, import_time_remap, insert_time_remap};
+use crate::import::masks::{MaskLayer, import_masks};
+use crate::import::props::{AnchorUnit, import_transform};
+use crate::import::report::{Collector, ImportReport, LossCategory};
+use crate::import::shapes::import_shapes;
+use crate::import::styles::import_layer_styles;
+use crate::import::text::{report_text_extras, text_doc};
+use crate::import::text_anim::import_animators;
+use crate::import::time::{TimeMap, frame_rate};
+
+/// What a layer's source id refers to.
+#[derive(Clone, Debug)]
+struct Source {
+    item: ItemId,
+    name: String,
+    kind: SourceKind,
+    width: u32,
+    height: u32,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum SourceKind {
+    Solid,
+    Footage,
+    Comp,
+}
+
+/// A composition whose layers are still to be built.
+struct PendingComp<'f, 'a> {
+    id: ItemId,
+    item: AepItem<'f, 'a>,
+    map: TimeMap,
+}
+
+struct Ctx<'o> {
+    sources: HashMap<u32, Source>,
+    /// Which comps use which comps as precomps (to refuse loops).
+    uses: HashMap<ItemId, Vec<ItemId>>,
+    created: Vec<ItemId>,
+    col: Collector,
+    options: &'o ImportOptions<'o>,
+    /// Sequence file names the import may still create (all sequences together).
+    sequence_budget: u32,
+    /// Bytes of sequence file names the import may still create (all sequences together).
+    sequence_bytes: u64,
+}
+
+pub(crate) fn run(project: &mut Project, view: &AepProject<'_, '_>, options: &ImportOptions<'_>) -> (ItemId, Vec<ItemId>, Vec<ItemId>, ImportReport) {
+    let mut cx = Ctx {
+        sources: HashMap::new(),
+        uses: HashMap::new(),
+        created: Vec::new(),
+        col: Collector::default(),
+        options,
+        sequence_budget: MAX_SEQUENCE_FILES,
+        sequence_bytes: MAX_SEQUENCE_BYTES,
+    };
+    let root = project.add_item(options.folder_name, Label::None, None, ItemKind::Folder);
+    cx.created.push(root);
+
+    let (null_only, _) = null_only_sources(view);
+    let mut pending: Vec<PendingComp<'_, '_>> = Vec::new();
+    let mut order: Vec<ItemId> = Vec::new();
+
+    if view.items_unreadable() {
+        cx.col.lose(LossCategory::DamagedData, "the project's item list is damaged, none of its items is imported".to_string());
+    }
+    // Pass 1: the item tree, depth-first in file order, without recursion.
+    let mut stack: Vec<(AepItem<'_, '_>, ItemId)> = view.items().map(|i| (i, root)).collect();
+    stack.reverse();
+    while let Some((item, parent)) = stack.pop() {
+        let name = item.display_name().unwrap_or_default();
+        let label = item_label(&item);
+        match item.kind() {
+            Some(AepKind::Folder) => {
+                let name = if name.is_empty() { "Folder".to_string() } else { name };
+                let id = project.add_item(&name, label, Some(parent), ItemKind::Folder);
+                cx.created.push(id);
+                cx.col.imported.folders += 1;
+                // After Effects writes an `Sfdr` even for an empty folder (and other chunks next to the
+                // items in it); without one the contents are lost.
+                if !item.has_folder_contents() {
+                    cx.col.lose(LossCategory::DamagedData, format!("folder '{name}': its contents list is missing, imported empty"));
+                } else if item.folder_contents_unreadable() {
+                    cx.col.lose(LossCategory::DamagedData, format!("folder '{name}': its contents list is damaged, imported empty"));
+                }
+                let mut kids: Vec<_> = item.children().map(|k| (k, id)).collect();
+                kids.reverse();
+                stack.extend(kids);
+            }
+            Some(AepKind::Composition) => {
+                let name = if name.is_empty() { "Composition".to_string() } else { name };
+                let Some(comp_view) = item.comp() else {
+                    cx.col.lose(LossCategory::DamagedData, format!("composition '{name}': composition data missing, not imported"));
+                    continue;
+                };
+                let Some(header) = comp_view.header() else {
+                    cx.col.lose(LossCategory::DamagedData, format!("composition '{name}': header unreadable, not imported"));
+                    continue;
+                };
+                let tb = header.time_base;
+                let Some(rate) = frame_rate(tb.timescale, tb.frame_duration) else {
+                    cx.col.lose(LossCategory::DamagedData, format!("composition '{name}': time base unreadable, not imported"));
+                    continue;
+                };
+                let map = TimeMap { timescale: tb.timescale, frame_duration: tb.frame_duration, rate };
+                let comp = new_comp(&header, comp_view.renderer(), &map, &name, &mut cx.col);
+                let id = project.add_item(&name, label, Some(parent), ItemKind::Comp(Arc::new(comp)));
+                cx.created.push(id);
+                cx.col.imported.compositions += 1;
+                order.push(id);
+                if let Some(aep_id) = item.id() {
+                    cx.sources
+                        .insert(aep_id, Source { item: id, name, kind: SourceKind::Comp, width: u32::from(header.width), height: u32::from(header.height) });
+                }
+                pending.push(PendingComp { id, item, map });
+            }
+            Some(AepKind::Footage) => import_footage(project, &mut cx, &item, name, label, parent, &null_only),
+            Some(AepKind::Other(code)) => cx.col.lose(LossCategory::UnsupportedItems, format!("'{name}': item type {code}")),
+            None => cx.col.lose(LossCategory::DamagedData, "a project item without a readable type".to_string()),
+        }
+    }
+
+    // Pass 2: the layers. The effect definitions are indexed once for every layer of every comp.
+    let defs = view.effect_definition_index();
+    for p in &pending {
+        build_layers(project, &mut cx, &defs, p);
+    }
+
+    let Ctx { created, col, .. } = cx;
+    (root, order, created, col.finish())
+}
+
+fn item_label(item: &AepItem<'_, '_>) -> Label {
+    item.label().and_then(|i| Label::ALL.get(usize::from(i)).copied()).unwrap_or(Label::None)
+}
+
+/// The ids of solid items that only null layers use (a null object's hidden placeholder solid,
+/// which has no counterpart in the project: the null layer has no item). Also the ids used by any
+/// other layer.
+fn null_only_sources(view: &AepProject<'_, '_>) -> (HashSet<u32>, HashSet<u32>) {
+    let (mut by_null, mut by_other) = (HashSet::new(), HashSet::new());
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for layer in comp.layers() {
+            let Some(h) = layer.header() else { continue };
+            let Some(src) = h.source_id else { continue };
+            if h.is_null_object() {
+                by_null.insert(src);
+            } else {
+                by_other.insert(src);
+            }
+        }
+    }
+    let only = by_null.difference(&by_other).copied().collect();
+    (only, by_other)
+}
+
+fn new_comp(h: &CompHeader, renderer: Option<AepRenderer>, map: &TimeMap, name: &str, col: &mut Collector) -> Comp {
+    let duration = map.units(i64::from(h.duration_units), map.timescale);
+    let mut comp = Comp::new(u32::from(h.width), u32::from(h.height), map.rate, duration);
+    let start = map.units(i64::from(h.work_area_start_units), map.timescale);
+    let end = h.work_area_end_units.map_or(duration, |e| map.units(i64::from(e), map.timescale));
+    comp.work_area = if start >= Tick::ZERO && end > start {
+        (start, end)
+    } else {
+        col.lose(LossCategory::DamagedData, format!("composition '{name}': the work area is empty or negative, the whole composition is used"));
+        (Tick::ZERO, duration)
+    };
+    comp.background = h.background.map(|c| f32::from(c) / 255.0);
+    comp.pixel_aspect = h.pixel_aspect.to_f64().filter(|v| v.is_finite() && *v > 0.0).unwrap_or_else(|| {
+        col.lose(LossCategory::DamagedData, format!("composition '{name}': the pixel aspect ratio is not valid, 1 is used"));
+        1.0
+    });
+    comp.shutter_angle = f64::from(h.shutter_angle);
+    // The stored phase; a header without one centres the shutter on the frame.
+    comp.shutter_phase = h.shutter_phase.map_or(-comp.shutter_angle / 2.0, f64::from);
+    if let Some(start) = h.display_start.filter(|r| r.num >= 0 && r.den > 0) {
+        comp.display_start = map.ticks(start.num, start.den);
+    }
+    comp.enable_motion_blur = h.motion_blur;
+    if renderer.is_some_and(|r| r.match_name == "ADBE Calder") {
+        comp.renderer = effectcraft_project::Renderer::Advanced3D;
+    }
+    comp
+}
+
+/// Adds one footage item to the project under the given parent.
+/// Unreadable footage is recorded as a loss, solids and null placeholders are handled separately, and file and sequence footage is linked to its files.
+fn import_footage(project: &mut Project, cx: &mut Ctx<'_>, item: &AepItem<'_, '_>, name: String, label: Label, parent: ItemId, null_only: &HashSet<u32>) {
+    let Some(f) = item.footage() else {
+        cx.col.lose(LossCategory::DamagedData, format!("footage '{name}': data unreadable, not imported"));
+        return;
+    };
+    let aep_id = item.id();
+    // An item without a stored name shows its file's name, a sequence `shot_[0101-0103].exr`
+    // (126, 603-607).
+    let name = if name.is_empty() { default_footage_name(item, &f).unwrap_or_else(|| "Footage".to_string()) } else { name };
+    if f.is_solid {
+        // A null object's placeholder solid is not an item here.
+        if aep_id.is_some_and(|i| null_only.contains(&i)) {
+            if let Some(i) = aep_id {
+                cx.sources.insert(i, Source { item: ItemId(0), name, kind: SourceKind::Solid, width: f.width, height: f.height });
+            }
+            return;
+        }
+        // A channel that is not a number cannot be saved or rendered: it falls back to 0 and is reported.
+        let mut rgb = f.solid_rgb().unwrap_or([0.0; 3]);
+        if rgb.iter().any(|c| !c.is_finite()) {
+            rgb = rgb.map(|c| if c.is_finite() { c } else { 0.0 });
+            cx.col.lose(LossCategory::DamagedData, format!("solid '{name}': a color channel is not a number, replaced by 0"));
+        }
+        let solid = Solid { color: rgb, width: f.width, height: f.height, pixel_aspect: 1.0 };
+        let id = project.add_item(&name, label, Some(parent), ItemKind::Solid(solid));
+        cx.created.push(id);
+        cx.col.imported.solids += 1;
+        if let Some(i) = aep_id {
+            cx.sources.insert(i, Source { item: id, name, kind: SourceKind::Solid, width: f.width, height: f.height });
+        }
+        return;
+    }
+    let mut path = f.path.clone().unwrap_or_default();
+    // An image sequence's alias is its folder; its files are named by the stored numbering
+    // (353, 603), or listed one by one when imported with Force alphabetical order. The first
+    // file stands for the sequence, as in EffectCraft.
+    let mut sequence = Vec::new();
+    if let Some(seq) = item.sequence_info().filter(|s| !path.is_empty() && s.frame_count() > 0) {
+        let frames = seq.frame_count();
+        let sep = if path.contains('\\') { '\\' } else { '/' };
+        let folder = path.trim_end_matches(['\\', '/']).to_string();
+        // One name is the folder, a separator and the file name. A numbered name is as wide as the
+        // stored digits or as the largest number, whichever is longer (an upper bound for every
+        // frame); listed names are counted as they are.
+        let len = |n: usize| u64::try_from(n).unwrap_or(u64::MAX);
+        let file_bytes = if seq.files.is_empty() {
+            len(seq.prefix.len().saturating_add(seq.suffix.len()).saturating_add(usize::try_from(seq.digits.min(16)).unwrap_or(16).max(10)))
+                .saturating_mul(u64::from(frames))
+        } else {
+            seq.files.iter().fold(0u64, |sum, n| sum.saturating_add(len(n.len())))
+        };
+        let bytes = len(folder.len().saturating_add(1)).saturating_mul(u64::from(frames)).saturating_add(file_bytes);
+        if frames > MAX_SEQUENCE_FRAMES || frames > cx.sequence_budget || bytes > cx.sequence_bytes {
+            // Not expanded: the item keeps its first file (a still standing for the sequence).
+            cx.col.lose(
+                LossCategory::DamagedData,
+                format!("footage '{name}': a sequence of {frames} frames is longer than the import expands; only its first file is linked"),
+            );
+            path = format!("{folder}{sep}{}", seq.nth_file_name(0).unwrap_or_default());
+        } else {
+            cx.sequence_budget -= frames;
+            cx.sequence_bytes -= bytes;
+            sequence = (0..frames).filter_map(|i| seq.nth_file_name(i)).map(|n| format!("{folder}{sep}{n}")).collect();
+        }
+        if let Some(first) = sequence.first() {
+            path = first.clone();
+        }
+    } else if f.is_sequence && !path.is_empty() {
+        // The alias is a folder, but the file names could not be read: the item links the folder.
+        cx.col.lose(LossCategory::DamagedData, format!("footage '{name}': image sequence naming not read, linked to its folder"));
+    }
+    let present = !path.is_empty() && (cx.options.exists)(&path);
+    if !present {
+        let shown = if path.is_empty() { format!("{name} (no path stored)") } else { path.clone() };
+        cx.col.missing_footage.push(shown);
+    }
+    let kind = if sequence.is_empty() { footage_kind(&path, f.native_frame_rate, f.audio_sample_rate.is_some()) } else { FootageKind::Sequence };
+    // A placed PDF / Illustrator file keeps After Effects' framing and size (#3099).
+    let placed_page = kind == FootageKind::Still && is_placed_page_path(&path);
+    let mut footage = Footage {
+        path,
+        kind,
+        width: f.width,
+        height: f.height,
+        has_video: kind != FootageKind::Audio,
+        // The sample rate is stored for a clip with sound and for a sound file (docs/aep-format.md,
+        // footage), and only then.
+        has_audio: kind == FootageKind::Audio || (kind == FootageKind::Video && f.audio_sample_rate.is_some()),
+        missing: !present,
+        placed_page,
+        sequence,
+        ..Footage::default()
+    };
+    // The native frame rate and the stored duration of sequences and clips (352, 603, 606).
+    if matches!(kind, FootageKind::Sequence | FootageKind::Video) && f.native_frame_rate > 0 {
+        footage.frame_rate = effectcraft_time::FrameRate::new(i64::from(f.native_frame_rate), 1);
+    }
+    if kind == FootageKind::Sequence {
+        footage.sync_sequence_duration();
+    } else if let Some(d) = f.duration.filter(|d| d.num > 0 && d.den > 0) {
+        footage.duration = cx_ticks(d.num, d.den);
+        // A clip conformed to another rate (645: 25 native frames at 30 fps): the stored duration
+        // counts native frames, which now last 1 / conform s each.
+        let conform_rate = item.conform_frame_rate().unwrap_or(0);
+        if kind == FootageKind::Video && conform_rate > 0 && f.native_frame_rate > 0 && conform_rate != f.native_frame_rate {
+            let native = effectcraft_time::FrameRate::new(i64::from(f.native_frame_rate), 1);
+            let conform = effectcraft_time::FrameRate::new(i64::from(conform_rate), 1);
+            if let Some(frames) = d.num.checked_mul(i64::from(f.native_frame_rate)).map(|n| n / d.den.max(1)) {
+                footage.native_rate = Some(native);
+                footage.frame_rate = conform;
+                footage.duration = conform.tick_of(frames);
+            }
+        }
+    }
+    let id = project.add_item(&name, label, Some(parent), ItemKind::Footage(footage));
+    cx.created.push(id);
+    cx.col.imported.footage += 1;
+    if let Some(i) = aep_id {
+        cx.sources.insert(i, Source { item: id, name, kind: SourceKind::Footage, width: f.width, height: f.height });
+    }
+}
+
+/// Whether `path` names a file whose page is framed as After Effects places it
+/// ([`Footage::placed_page`]): an Illustrator or PDF file, by its extension. EPS files keep
+/// their bounding box at their own size: how After Effects sizes them was not measured (#3099).
+fn is_placed_page_path(path: &str) -> bool {
+    let ext = path.rsplit(['/', '\\']).next().and_then(|name| name.rsplit_once('.')).map(|(_, ext)| ext.to_ascii_lowercase());
+    matches!(ext.as_deref(), Some("pdf" | "ai"))
+}
+
+/// The name After Effects shows for a footage item that stores none: the file's name, or for a
+/// sequence the name with the frame range (`shot_[0101-0103].exr`).
+fn default_footage_name(item: &AepItem<'_, '_>, f: &crate::Footage) -> Option<String> {
+    if let Some(s) = item.sequence_info() {
+        // A listed sequence (Force alphabetical order) has no numbering: its first file names it.
+        // Assumption: what After Effects shows for such an item without a stored name was not sampled.
+        if let Some(first) = s.files.first() {
+            return Some(first.clone());
+        }
+        let w = usize::try_from(s.digits.min(16)).unwrap_or(0);
+        return Some(format!("{}[{:0w$}-{:0w$}]{}", s.prefix, s.start, s.end, s.suffix));
+    }
+    let path = f.path.as_deref()?;
+    path.rsplit(['\\', '/']).next().filter(|n| !n.is_empty()).map(str::to_string)
+}
+
+/// The longest image sequence that is imported as a list of files.
+const MAX_SEQUENCE_FRAMES: u32 = 100_000;
+/// The most sequence file names one import creates (all sequences together).
+const MAX_SEQUENCE_FILES: u32 = 1_000_000;
+/// The most bytes of sequence file names one import creates (all sequences together): long names
+/// times many frames would otherwise expand a small file into hundreds of megabytes.
+const MAX_SEQUENCE_BYTES: u64 = 32 * 1024 * 1024;
+
+/// `num / den` seconds as ticks (saturating).
+fn cx_ticks(num: i64, den: i64) -> Tick {
+    let t = i128::from(num).saturating_mul(i128::from(effectcraft_time::TICKS_PER_SECOND)) / i128::from(den.max(1));
+    Tick(i64::try_from(t).unwrap_or(i64::MAX))
+}
+
+/// The footage kind by file extension. An extension not listed is decided by what the project
+/// file stores for it: a native frame rate means moving footage (stills store 0), a sample rate
+/// without one means a sound file. Otherwise a clip with an unlisted extension (`.mts`, `.3gp`, ...)
+/// would arrive as a still, without its sound.
+fn footage_kind(path: &str, native_frame_rate: u32, has_sample_rate: bool) -> FootageKind {
+    let ext = path.rsplit('.').next().map(str::to_ascii_lowercase).unwrap_or_default();
+    match ext.as_str() {
+        "mov" | "mp4" | "m4v" | "avi" | "mxf" | "mkv" | "webm" | "mpg" | "mpeg" | "wmv" | "flv" | "r3d" => FootageKind::Video,
+        "wav" | "mp3" | "aac" | "aif" | "aiff" | "flac" | "ogg" | "opus" | "m4a" => FootageKind::Audio,
+        _ if native_frame_rate > 0 => FootageKind::Video,
+        _ if has_sample_rate => FootageKind::Audio,
+        _ => FootageKind::Still,
+    }
+}
+
+fn blend(mode: AepBlend) -> Option<BlendMode> {
+    Some(match mode {
+        AepBlend::Normal => BlendMode::Normal,
+        AepBlend::Add => BlendMode::Add,
+        AepBlend::Multiply => BlendMode::Multiply,
+        AepBlend::Screen => BlendMode::Screen,
+        AepBlend::Overlay => BlendMode::Overlay,
+        AepBlend::Difference => BlendMode::Difference,
+        AepBlend::Other(code) => blend_code(code)?,
+    })
+}
+
+/// The blend mode codes beyond the reader's six (`ldta` byte 99): 906 (set by name: Soft Light 8,
+/// Hard Light 9, Darken 10, Lighten 11, Exclusion 25, Color Dodge 27, Color Burn 28) and 907
+/// (each code rendered by After Effects over a test image and matched against every EffectCraft
+/// mode: the named mode was the only one within 1/255 on average inside the patch). Codes 23 / 24
+/// render like 27 / 28 on that image; they are taken as the classic variants, which After Effects
+/// keeps beside the newer ones (E). Not imported: 1, 21 and 22 (Alpha Add and Luminescent
+/// Premul render alike on opaque layers), 3 (Dissolve and Dancing Dissolve share it, 906 sweep)
+/// and codes above 34 (not sampled).
+fn blend_code(code: u8) -> Option<BlendMode> {
+    Some(match code {
+        8 => BlendMode::SoftLight,
+        9 => BlendMode::HardLight,
+        10 => BlendMode::Darken,
+        11 => BlendMode::Lighten,
+        12 => BlendMode::ClassicDifference,
+        13 => BlendMode::Hue,
+        14 => BlendMode::Saturation,
+        15 => BlendMode::Color,
+        16 => BlendMode::Luminosity,
+        17 => BlendMode::StencilAlpha,
+        18 => BlendMode::StencilLuma,
+        19 => BlendMode::SilhouetteAlpha,
+        20 => BlendMode::SilhouetteLuma,
+        23 => BlendMode::ClassicColorDodge,
+        24 => BlendMode::ClassicColorBurn,
+        25 => BlendMode::Exclusion,
+        27 => BlendMode::ColorDodge,
+        28 => BlendMode::ColorBurn,
+        29 => BlendMode::LinearDodge,
+        30 => BlendMode::LinearBurn,
+        31 => BlendMode::LinearLight,
+        32 => BlendMode::VividLight,
+        33 => BlendMode::PinLight,
+        34 => BlendMode::HardMix,
+        _ => return None,
+    })
+}
+
+/// `start + offset * stretch` of two stored times, exact and unreduced when they share a
+/// denominator (so frames stay frames), reduced otherwise.
+fn absolute(start: Rational, offset: Rational, stretch: Rational, reduced: Option<Rational>) -> Option<(i64, i64)> {
+    if start.den == offset.den && start.den != 0 && stretch.den == 1 {
+        let num = i128::from(start.num).checked_add(i128::from(offset.num).checked_mul(i128::from(stretch.num))?)?;
+        return Some((i64::try_from(num).ok()?, start.den));
+    }
+    reduced.map(|r| (r.num, r.den))
+}
+
+/// The light kinds that are sampled.
+fn light_kind(t: Option<LightType>) -> Option<LightKind> {
+    match t {
+        Some(LightType::Spot) => Some(LightKind::Spot),
+        Some(LightType::Point) => Some(LightKind::Point),
+        Some(LightType::Parallel) => Some(LightKind::Parallel),
+        Some(LightType::Ambient) => Some(LightKind::Ambient),
+        _ => None,
+    }
+}
+
+/// The auto-orientation of a camera or light.
+fn camera_light_orient(auto_oriented: bool, light: Option<LightKind>) -> AutoOrient {
+    if matches!(light, Some(LightKind::Point | LightKind::Ambient)) {
+        // A point or ambient light has no point of interest here.
+        return AutoOrient::Off;
+    }
+    if auto_oriented { AutoOrient::TowardsPointOfInterest } else { AutoOrient::Off }
+}
+
+/// The unit a layer's anchor is stored in.
+fn anchor_unit(camera_or_light: bool, text_or_shape: bool, null: bool, size: (u32, u32)) -> AnchorUnit {
+    if camera_or_light {
+        AnchorUnit::PointOfInterest
+    } else if text_or_shape {
+        AnchorUnit::Pixels
+    } else if null {
+        AnchorUnit::Null(size.0, size.1)
+    } else {
+        AnchorUnit::Source(size.0, size.1)
+    }
+}
+
+fn build_layers(project: &mut Project, cx: &mut Ctx<'_>, defs: &EffectDefinitions<'_, '_>, p: &PendingComp<'_, '_>) {
+    let Some(comp_view) = p.item.comp() else { return };
+    let Some(mut comp) = project.comp(p.id).cloned() else { return };
+    let comp_name = project.item(p.id).map(|i| i.name.clone()).unwrap_or_default();
+    let tm = p.map;
+    let comp_size = (comp.width, comp.height);
+    // aep layer id -> project layer id, and the stored parent links, resolved at the end.
+    let mut ids: HashMap<u32, LayerId> = HashMap::new();
+    let mut skipped: HashMap<u32, String> = HashMap::new();
+    let mut parents: Vec<(u32, LayerId, String, u32)> = Vec::new();
+    let mut mattes: Vec<PendingMatte> = Vec::new();
+    // Effect layer parameters naming another layer.
+    let mut layer_refs: Vec<PendingLayerRef> = Vec::new();
+    // The id of the layer above in the file (the matte of the older "layer above" form).
+    let mut above: Option<u32> = None;
+
+    for layer in comp_view.layers() {
+        let Some(h) = layer.header() else {
+            cx.col.lose(LossCategory::DamagedData, format!("{comp_name}: a layer header is unreadable, layer not imported"));
+            above = None;
+            continue;
+        };
+        let layer_above = above.replace(h.id);
+        let matte = layer.track_matte();
+        let aep_name = layer.name();
+        let src = h.source_id.and_then(|s| cx.sources.get(&s)).cloned();
+        // A text layer without a name of its own is shown with its text, as in After Effects.
+        let text_name = || {
+            (h.layer_type == LayerType::Text)
+                .then(|| layer.text_document())
+                .flatten()
+                .map(|d| crate::import::text::first_paragraph(&d.raw_text))
+                .filter(|t| !t.trim().is_empty())
+        };
+        let name = aep_name
+            .clone()
+            .or_else(|| src.as_ref().map(|s| s.name.clone()))
+            .or_else(text_name)
+            // An empty text layer without a name is named as a new one is (#3233).
+            .unwrap_or_else(|| if h.layer_type == LayerType::Text { "Text" } else { "Layer" }.to_string());
+        let skip = |cx: &mut Ctx<'_>, skipped: &mut HashMap<u32, String>, category: LossCategory, what: &str| {
+            cx.col.lose(category, format!("{comp_name}: {what} '{name}'"));
+            skipped.insert(h.id, what.to_string());
+        };
+        let is_text = h.layer_type == LayerType::Text;
+        let is_shape = h.layer_type == LayerType::Shape;
+        let is_camera = h.layer_type == LayerType::Camera;
+        // Spot and point lights are sampled (252, 254, 255, 343-345), parallel and ambient lights
+        // too (701, 702); environment lights are not.
+        let light = light_kind(h.light_type());
+        match h.layer_type {
+            LayerType::Av | LayerType::Text | LayerType::Shape | LayerType::Camera => {}
+            LayerType::Light if light.is_some() => {}
+            LayerType::Light => {
+                let code = match h.light_type() {
+                    Some(LightType::Other(c)) => c,
+                    _ => 0,
+                };
+                skip(cx, &mut skipped, LossCategory::Lights, &format!("light of type {code} (not sampled)"));
+                continue;
+            }
+            LayerType::Other(code) => {
+                skip(cx, &mut skipped, LossCategory::UnsupportedLayers, &format!("layer of type {code}"));
+                continue;
+            }
+        }
+        // The source.
+        let is_null = h.is_null_object();
+        // A text layer has no source; it spans the composition (as a new text layer does).
+        let text_size = (comp.width.max(1), comp.height.max(1));
+        let (source, size) = match (&src, is_null) {
+            _ if is_camera => (LayerSource::Camera, text_size),
+            _ if light.is_some() => (LayerSource::Light { kind: light.unwrap_or_default() }, text_size),
+            _ if is_text => (LayerSource::Text, text_size),
+            // A shape layer has no source either and spans the composition.
+            _ if is_shape => (LayerSource::Shape, text_size),
+            (Some(s), true) => (LayerSource::Null, (s.width.max(1), s.height.max(1))),
+            (None, true) => (LayerSource::Null, (100, 100)),
+            (Some(s), false) => match s.kind {
+                SourceKind::Solid => (LayerSource::Solid { item: s.item }, (s.width.max(1), s.height.max(1))),
+                SourceKind::Footage => (LayerSource::Footage { item: s.item }, (s.width.max(1), s.height.max(1))),
+                SourceKind::Comp => {
+                    if would_loop(&cx.uses, p.id, s.item) {
+                        skip(cx, &mut skipped, LossCategory::UnsupportedLayers, "precomposition loop, layer");
+                        continue;
+                    }
+                    cx.uses.entry(p.id).or_default().push(s.item);
+                    (LayerSource::Comp { item: s.item }, (s.width.max(1), s.height.max(1)))
+                }
+            },
+            (None, false) => {
+                skip(cx, &mut skipped, LossCategory::UnsupportedLayers, "layer without a usable source:");
+                continue;
+            }
+        };
+        let mut l: Layer = build::layer(project, &comp, &name, source.clone(), size, None);
+        l.name = name.clone();
+        // A text layer without a stored name follows its text; a stored name is the user's (#3233).
+        if is_text {
+            l.name_follows_text = Some(aep_name.is_none());
+        }
+        l.label = Label::ALL.get(usize::from(h.label)).copied().unwrap_or(Label::None);
+        apply_timing(&mut l, &h, &tm, &name, &mut cx.col);
+        apply_switches(&mut l, &h);
+        match blend(h.blend_mode) {
+            Some(b) => l.blend_mode = b,
+            // Cameras and lights have no blend mode (their byte is 0, 251).
+            None if is_camera || light.is_some() => {}
+            None => cx.col.lose(LossCategory::BlendModes, format!("{comp_name}: '{name}' uses blend mode code {}", h.blend_mode.code())),
+        }
+        let what = format!("{comp_name}: '{name}'");
+        l.markers = import_markers(layer.markers(), layer.chunk(), &what, &tm, &mut cx.col);
+        if let Some(node) = import_time_remap(&layer, &what, &tm, &mut Ids(&mut project.next_id), &mut cx.col) {
+            insert_time_remap(&mut l.props, node);
+        }
+        end_at_source(project, &mut l, comp.frame_rate.frame_duration());
+        import_layer_styles(&layer, &mut l, &comp.global_light, &mut Ids(&mut project.next_id), &tm, &what, &mut cx.col);
+        // Text and shape layers store their anchor in pixels (385, 462); cameras and lights their
+        // point of interest.
+        let anchor = anchor_unit(is_camera || light.is_some(), is_text || is_shape, is_null, size);
+        if let Some(tr) = l.props.sub_mut("transform") {
+            import_transform(&layer, &name, comp_size, anchor, &tm, tr, &mut cx.col);
+        }
+        if is_camera || light.is_some() {
+            // Byte 38 bit 0x40: a two-node camera and every light aim at the point of interest; a
+            // one-node camera does not (251, 256).
+            l.auto_orient = camera_light_orient(h.is_auto_oriented(), light);
+        }
+        if is_camera && let Some(options) = l.props.sub_mut("cameraOptions") {
+            import_camera_options(&layer, &what, comp.width, &tm, options, &mut cx.col);
+        }
+        if light.is_some()
+            && let Some(options) = l.props.sub_mut("lightOptions")
+        {
+            import_light_options(&layer, &what, &tm, options, &mut cx.col);
+        }
+        if is_shape && let Some(contents) = l.props.sub_mut("contents") {
+            import_shapes(&layer, &what, &tm, &mut Ids(&mut project.next_id), contents, &mut cx.col);
+        }
+        if is_text {
+            import_source_text(&mut l, &layer, &what, cx);
+            import_text_animators(&mut l, &layer, &what, &tm, &mut Ids(&mut project.next_id), &mut cx.col);
+        }
+        if let Some(masks) = l.props.sub_mut("masks") {
+            // On a text or shape layer, which has no source, the mask box is stored in layer
+            // pixels (705, 706), so the scale is 1.
+            let mask_scale = if is_text || is_shape { (1, 1) } else { size };
+            let ml = MaskLayer { size: mask_scale, source: !(is_text || is_shape), tm: &tm };
+            import_masks(&layer, &comp_name, &name, ml, &mut build::Ids(&mut project.next_id), masks, &mut cx.col);
+        }
+        if let Some(fx) = l.props.sub_mut("effects") {
+            let lcx = LayerCtx { comp: &comp_name, layer: &name, aep_id: h.id, ec_id: l.id, size, tm: &tm };
+            import_effects(defs, &layer, &lcx, &mut Ids(&mut project.next_id), fx, &mut layer_refs, &mut cx.col);
+        }
+        if let Some(parent) = h.parent_id {
+            parents.push((h.id, l.id, name.clone(), parent));
+        }
+        ids.insert(h.id, l.id);
+        if let Some(m) = matte {
+            mattes.push(PendingMatte { layer: l.id, name: name.clone(), matte: m, above: layer_above });
+        }
+        let counts = &mut cx.col.imported;
+        counts.layers += 1;
+        match &source {
+            LayerSource::Null => counts.null_layers += 1,
+            LayerSource::Comp { .. } => counts.precomp_layers += 1,
+            LayerSource::Footage { .. } => counts.footage_layers += 1,
+            LayerSource::Text => counts.text_layers += 1,
+            LayerSource::Shape => counts.shape_layers += 1,
+            LayerSource::Camera => counts.cameras += 1,
+            LayerSource::Light { .. } => counts.lights += 1,
+            _ if h.is_adjustment() => counts.adjustment_layers += 1,
+            _ => counts.solid_layers += 1,
+        }
+        comp.layers.push(l);
+    }
+
+    resolve_parents(&mut comp, &parents, &ids, &skipped, &comp_name, &mut cx.col);
+    resolve_mattes(&mut comp, &mattes, &ids, &skipped, &comp_name, &mut cx.col);
+    resolve_layer_refs(&mut comp, &layer_refs, &ids, &mut cx.col);
+    // Global Light is one setting per composition here: the layers' stored values are adopted.
+    effectcraft_project::styles::sync_comp(&mut comp);
+
+    if let Some(secl) = p.item.chunk().child_list(b"SecL") {
+        comp.markers = import_markers(comp_view.markers(), secl, &comp_name, &tm, &mut cx.col);
+    }
+    if let Some(item) = project.item_mut(p.id) {
+        item.kind = ItemKind::Comp(Arc::new(comp));
+    }
+}
+
+/// The Source Text of a text layer from its text document, and the reports of what is not
+/// imported.
+fn import_source_text(l: &mut Layer, layer: &AepLayer<'_, '_>, what: &str, cx: &mut Ctx<'_>) {
+    match layer.text_document() {
+        Some(doc) => {
+            let value = text_doc(&doc, what, cx.options.has_font, &mut cx.col);
+            match l.props.prop_mut("text/sourceText") {
+                Some(p) => p.value = Value::Text(Box::new(value)),
+                None => cx.col.lose(LossCategory::DamagedData, format!("{what}: the text layer has no Source Text property, the text is not imported")),
+            }
+        }
+        None => cx.col.lose(LossCategory::DamagedData, format!("{what}: the text document is unreadable, the layer is imported with empty text")),
+    }
+    report_text_extras(layer, what, &mut cx.col);
+}
+
+/// The text animators of a text layer into its `text/animators` group.
+fn import_text_animators(l: &mut Layer, layer: &AepLayer<'_, '_>, what: &str, tm: &TimeMap, ids: &mut Ids<'_>, col: &mut Collector) {
+    let Some(PropNode::Group(text)) = layer.properties().and_then(|p| p.get("ADBE Text Properties")) else { return };
+    let Some(PropNode::Group(animators)) = text.get("ADBE Text Animators") else { return };
+    if animators.entries().is_empty() {
+        return;
+    }
+    match l.props.group_mut("text/animators") {
+        Some(target) => import_animators(&animators, what, tm, ids, target, col),
+        None => col.lose(LossCategory::TextLayers, format!("{what}: the text layer has no animator group, its text animators are not imported")),
+    }
+}
+
+/// Whether adding `to` as a precomp of `from` would close a loop.
+fn would_loop(uses: &HashMap<ItemId, Vec<ItemId>>, from: ItemId, to: ItemId) -> bool {
+    if from == to {
+        return true;
+    }
+    let mut seen = HashSet::new();
+    let mut stack = vec![to];
+    while let Some(c) = stack.pop() {
+        if c == from {
+            return true;
+        }
+        if seen.insert(c) {
+            stack.extend(uses.get(&c).into_iter().flatten().copied());
+        }
+    }
+    false
+}
+
+fn apply_timing(l: &mut Layer, h: &LayerHeader, tm: &TimeMap, name: &str, col: &mut Collector) {
+    // The exact ratio `stretch / stretch_den` (50 % is 1/2, -100 % is -1/1); a zero or unreadable
+    // one is 100 %.
+    let stretch = h.stretch_ratio().filter(|r| r.num != 0).unwrap_or_else(|| {
+        col.lose(LossCategory::DamagedData, format!("layer '{name}': the time stretch is zero or unreadable, 100 % is used"));
+        Rational { num: 1, den: 1 }
+    });
+    let stored = stretch.to_f64().map_or(100.0, |r| r * 100.0);
+    // A ratio such as 1/2^31 (5e-8 %) or 2^31/1 is outside what After Effects allows (±1 % to
+    // ±9900 %); taken as stored, the layer and audio time would divide by ~0 (#3247). The in and
+    // out points keep the comp times the file stores.
+    l.stretch = effectcraft_project::limits::stretch(stored);
+    if l.stretch.to_bits() != stored.to_bits() {
+        col.lose(LossCategory::DamagedData, format!("layer '{name}': the time stretch of {stored:e} % is outside ±1 % to ±9900 %, {} % is used", l.stretch));
+    }
+    // A stored time with a zero denominator (or a sum that overflows) has no value; it is read as 0
+    // and reported, so the layer's timing never changes silently.
+    let unreadable: Vec<&str> = [("start", h.start), ("in point", h.in_relative), ("out point", h.out_relative)]
+        .into_iter()
+        .filter(|(_, t)| t.den == 0)
+        .map(|(what, _)| what)
+        .collect();
+    l.start_time = tm.ticks(h.start.num, h.start.den);
+    let points = [(h.in_relative, h.in_point()), (h.out_relative, h.out_point())].map(|(offset, reduced)| absolute(h.start, offset, stretch, reduced));
+    if !unreadable.is_empty() {
+        col.lose(LossCategory::DamagedData, format!("layer '{name}': the stored {} time is unreadable (zero denominator), 0 is used", unreadable.join(", ")));
+    } else if points.iter().any(Option::is_none) {
+        col.lose(LossCategory::DamagedData, format!("layer '{name}': the in or out point is out of range, 0 is used"));
+    }
+    let [a, b] = points.map(|p| p.map_or(Tick::ZERO, |(n, d)| tm.ticks(n, d)));
+    // A negative stretch reverses the layer (981-983): the stored in point is then the later
+    // end (`start + in * stretch`, 5 s for 0 s of source at -100 %), the out point the earlier.
+    l.in_point = a.min(b);
+    l.out_point = a.max(b);
+}
+
+/// After Effects ends a layer of timed footage (a clip, a sequence, a sound) at its source's end
+/// when it opens a project, whatever out point the file stores (export test f1: layers written
+/// 5 s long over a 1 s clip, a 3-frame sequence and a 1 s WAV read back 1, 0.1 and 1 s long; R31
+/// of aep-export.md). A remapped or looped layer keeps its out point, and so does one that runs
+/// less than a composition frame past (`frame`): a clip's duration need not be whole frames.
+fn end_at_source(project: &Project, l: &mut Layer, frame: Tick) {
+    let LayerSource::Footage { item } = &l.source else { return };
+    if l.props.prop("timeRemap").is_some() {
+        return;
+    }
+    let Some(ItemKind::Footage(f)) = project.item(*item).map(|i| &i.kind) else { return };
+    if !matches!(f.kind, FootageKind::Video | FootageKind::Sequence | FootageKind::Audio) || f.loop_count > 1 || f.duration <= Tick::ZERO {
+        return;
+    }
+    let stretch = l.stretch / 100.0;
+    if !(stretch.is_finite() && stretch > 0.0) {
+        return;
+    }
+    let span = (f.duration.0 as f64 * stretch).round();
+    if !span.is_finite() || span.abs() > 9.0e18 {
+        return;
+    }
+    let end = Tick(l.start_time.0.saturating_add(span as i64));
+    if l.out_point.0.saturating_sub(end.0) >= frame.0.max(1) {
+        l.out_point = end.max(l.in_point);
+    }
+}
+
+fn apply_switches(l: &mut Layer, h: &LayerHeader) {
+    let s = &mut l.switches;
+    s.video = h.is_video_enabled();
+    s.audio = h.is_audio_enabled();
+    s.solo = h.is_solo();
+    s.locked = h.is_locked();
+    s.shy = h.is_shy();
+    s.collapse = h.collapses_transformations();
+    s.effects = h.is_effects_enabled();
+    s.motion_blur = h.is_motion_blur();
+    s.adjustment = h.is_adjustment();
+    s.three_d = h.is_three_d();
+    s.guide = h.is_guide();
+    s.quality = match h.quality {
+        AepQuality::Draft => Quality::Draft,
+        AepQuality::Best | AepQuality::Other(_) => Quality::Best,
+    };
+}
+
+/// A track matte read from a layer header, resolved once every layer of the composition exists.
+struct PendingMatte {
+    layer: LayerId,
+    name: String,
+    matte: AepMatte,
+    /// The id of the layer directly above in the file.
+    above: Option<u32>,
+}
+
+/// Sets the track mattes (402-408: mode at `ldta` byte 107, matte layer id at byte 160). The
+/// matte layer can be anywhere in the composition, also below its target (407). A matte with no
+/// layer id is the form of After Effects before 23.0, where the matte is always the layer directly
+/// above: that layer is used. The matte layer's video switch is imported as stored (After Effects
+/// switches it off when the matte is set, 403; EffectCraft, like After Effects, still uses a
+/// hidden layer as a matte).
+fn resolve_mattes(comp: &mut Comp, mattes: &[PendingMatte], ids: &HashMap<u32, LayerId>, skipped: &HashMap<u32, String>, comp_name: &str, col: &mut Collector) {
+    for m in mattes {
+        let kind = match m.matte.mode {
+            MatteMode::Alpha => MatteKind::Alpha,
+            MatteMode::AlphaInverted => MatteKind::AlphaInverted,
+            MatteMode::Luma => MatteKind::Luma,
+            MatteMode::LumaInverted => MatteKind::LumaInverted,
+            MatteMode::Other(code) => {
+                col.lose(LossCategory::TrackMattes, format!("{comp_name}: '{}' has a track matte of unknown mode {code}", m.name));
+                continue;
+            }
+        };
+        let Some(source) = m.matte.layer.or(m.above) else {
+            col.lose(LossCategory::TrackMattes, format!("{comp_name}: '{}' has a track matte but no layer above it", m.name));
+            continue;
+        };
+        let Some(target) = ids.get(&source).copied() else {
+            let why = skipped.get(&source).map_or("a layer that does not exist", |s| s.as_str());
+            col.lose(LossCategory::TrackMattes, format!("{comp_name}: '{}' has {why} as its track matte", m.name));
+            continue;
+        };
+        if target == m.layer {
+            col.lose(LossCategory::TrackMattes, format!("{comp_name}: '{}' is its own track matte", m.name));
+            continue;
+        }
+        if let Some(l) = comp.layer_mut(m.layer) {
+            l.track_matte = Some(TrackMatte { layer: target, kind });
+            col.imported.track_mattes += 1;
+        }
+    }
+}
+
+/// The layers whose parent chain comes back to them (`links`: layer to parent). Each layer is
+/// visited once, so a long chain costs its length, not its length squared.
+fn parent_cycles(links: &HashMap<LayerId, LayerId>) -> HashSet<LayerId> {
+    // Absent: not seen; `false`: on the chain being walked; `true`: finished.
+    let mut done: HashMap<LayerId, bool> = HashMap::with_capacity(links.len());
+    let mut cycles = HashSet::new();
+    for &start in links.keys() {
+        let mut chain = Vec::new();
+        let mut at = start;
+        loop {
+            match done.get(&at) {
+                Some(false) => {
+                    // Back on the chain: the part from `at` on is a loop.
+                    if let Some(i) = chain.iter().position(|l| *l == at) {
+                        cycles.extend(chain.get(i..).unwrap_or_default().iter().copied());
+                    }
+                    break;
+                }
+                Some(true) => break,
+                None => {}
+            }
+            done.insert(at, false);
+            chain.push(at);
+            match links.get(&at) {
+                Some(next) => at = *next,
+                None => break,
+            }
+        }
+        for l in chain {
+            done.insert(l, true);
+        }
+    }
+    cycles
+}
+
+/// Sets the parent links that point at an imported layer, without loops.
+fn resolve_parents(
+    comp: &mut Comp,
+    parents: &[(u32, LayerId, String, u32)],
+    ids: &HashMap<u32, LayerId>,
+    skipped: &HashMap<u32, String>,
+    comp_name: &str,
+    col: &mut Collector,
+) {
+    let mut links: HashMap<LayerId, LayerId> = HashMap::new();
+    for (_, layer, name, parent) in parents {
+        match ids.get(parent) {
+            Some(target) => {
+                links.insert(*layer, *target);
+            }
+            None => {
+                let why = skipped.get(parent).map_or("a layer that does not exist", |s| s.as_str());
+                col.lose(LossCategory::ParentLinks, format!("{comp_name}: '{name}' has {why} as its parent"));
+            }
+        }
+    }
+    // Drop every link that is part of a loop (including a layer parented to itself).
+    let on_loop = parent_cycles(&links);
+    let looped: Vec<LayerId> = links.keys().copied().filter(|l| on_loop.contains(l)).collect();
+    for l in &looped {
+        links.remove(l);
+        let name = comp.layer(*l).map(|x| x.name.clone()).unwrap_or_default();
+        col.lose(LossCategory::ParentLinks, format!("{comp_name}: '{name}' has a parent loop"));
+    }
+    for (layer, parent) in links {
+        if let Some(l) = comp.layer_mut(layer) {
+            l.parent = Some(parent);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// #3099: an `.ai` or `.pdf` from an `.aep` is a placed page; an EPS (not measured in After
+    /// Effects) and other files are not.
+    #[test]
+    fn only_illustrator_and_pdf_files_are_placed_pages() {
+        for path in [r"C:\fixture\x\logo.ai", "/work/Logo.AI", "art.pdf", r"C:\a.b\page.PDF"] {
+            assert!(is_placed_page_path(path), "{path}");
+        }
+        for path in [r"C:\fixture\x\still.eps", "a.epsf", "a.epsi", "still.png", r"C:\dir.ai\file", "ai", ""] {
+            assert!(!is_placed_page_path(path), "{path}");
+        }
+    }
+
+    #[test]
+    fn unlisted_extensions_follow_what_the_file_stores() {
+        assert_eq!(footage_kind("C:/clips/a.MP4", 0, false), FootageKind::Video);
+        assert_eq!(footage_kind("/s/a.wav", 0, true), FootageKind::Audio);
+        assert_eq!(footage_kind("/s/a.png", 0, false), FootageKind::Still);
+        // A camera clip with an extension the list does not name, with a frame rate and sound.
+        assert_eq!(footage_kind("/cam/0001.mts", 30, true), FootageKind::Video);
+        assert_eq!(footage_kind("/cam/voice.wma", 0, true), FootageKind::Audio);
+        assert_eq!(footage_kind("/s/scan.tif", 0, false), FootageKind::Still);
+    }
+
+    #[test]
+    fn parent_cycles_are_the_layers_on_a_loop() {
+        let l = LayerId;
+        // 1 -> 2 -> 3 -> 1 is a loop; 4 -> 1 only leads into it; 5 -> 5 is parented to itself;
+        // 6 -> 7 ends at a layer without a parent.
+        let links: HashMap<LayerId, LayerId> = [(1, 2), (2, 3), (3, 1), (4, 1), (5, 5), (6, 7)].into_iter().map(|(a, b)| (l(a), l(b))).collect();
+        let mut found: Vec<u64> = parent_cycles(&links).into_iter().map(|x| x.0).collect();
+        found.sort_unstable();
+        assert_eq!(found, [1, 2, 3, 5]);
+    }
+
+    #[test]
+    fn a_long_parent_chain_is_checked_in_linear_time() {
+        // 200 000 layers each parented to the next, the last to the first: walking the chain from
+        // every layer (as before) is 4e10 steps; once per layer it is instant.
+        let n = 200_000u64;
+        let links: HashMap<LayerId, LayerId> = (0..n).map(|i| (LayerId(i), LayerId((i + 1) % n))).collect();
+        assert_eq!(parent_cycles(&links).len(), 200_000);
+        let open: HashMap<LayerId, LayerId> = (0..n - 1).map(|i| (LayerId(i), LayerId(i + 1))).collect();
+        assert!(parent_cycles(&open).is_empty());
+    }
+}
diff --git a/crates/aep/src/import/camera.rs b/crates/aep/src/import/camera.rs
new file mode 100644
index 000000000..396645d27
--- /dev/null
+++ b/crates/aep/src/import/camera.rs
@@ -0,0 +1,114 @@
+//! Camera and light options (docs/aep-format.md 3.12; cases 251-256, 341-345, 535-537).
+//!
+//! The transform of a camera or light goes through [`crate::import::props::import_transform`] (the point
+//! of interest is the Anchor Point record, in pixels); this module imports the Camera Options and
+//! Light Options groups. A property is imported from its record (static value or keys, and an
+//! expression); a stored property that is not mapped is reported.
+
+use crate::{Layer as AepLayer, PropGroup as AepGroup, PropNode};
+use effectcraft_keyframe::Value;
+use effectcraft_project::PropGroup;
+
+use crate::import::props::{Kind, import_expression, import_keys, sane};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// The default aperture of After Effects' 50 mm camera in a 1920 px wide composition (256 read
+/// back 25.309 336 332 958 4); scaled with the composition width like the zoom (not sampled for
+/// other widths).
+const APERTURE_1920: f64 = 25.309_336_332_958_4;
+
+/// Camera Options: match name, project property id, kind (341, 342).
+const CAMERA: [(&str, &str, Kind); 4] = [
+    ("ADBE Camera Zoom", "zoom", Kind::Number),
+    ("ADBE Camera Depth of Field", "dof", Kind::EffectBool),
+    ("ADBE Camera Focus Distance", "focusDistance", Kind::Number),
+    ("ADBE Camera Aperture", "aperture", Kind::Number),
+];
+
+/// Light Options of a spot or point light (254, 343-345). Every light stores Casts Shadows as a
+/// set record holding 0 (off, 252, 254, 255).
+const LIGHT: [(&str, &str, Kind); 5] = [
+    ("ADBE Casts Shadows", "castsShadows", Kind::EffectBool),
+    ("ADBE Light Intensity", "intensity", Kind::Number),
+    ("ADBE Light Color", "color", Kind::EffectColor),
+    ("ADBE Light Cone Angle", "coneAngle", Kind::Number),
+    ("ADBE Light Cone Feather 2", "coneFeather", Kind::Number),
+];
+
+/// Imports the Camera Options of `layer` into `options` (the layer's `cameraOptions` group).
+/// `comp_width` scales the default aperture.
+pub(crate) fn import_camera_options(layer: &AepLayer<'_, '_>, what: &str, comp_width: u32, tm: &TimeMap, options: &mut PropGroup, col: &mut Collector) {
+    // Absent Zoom: the auto Position stores `[0, 0, -zoom]` (251, 256, 341); otherwise the new
+    // layer's default (the 50 mm preset for this width) stays.
+    let auto_z = layer.camera_position().filter(|p| p.auto_state).map(|p| -p.stored[2]).filter(|z| z.is_finite() && *z > 0.0);
+    if let (Some(z), Some(p)) = (auto_z, options.prop_mut("zoom")) {
+        p.value = Value::Scalar(z);
+    }
+    let zoom = match options.prop("zoom").map(|p| &p.value) {
+        Some(Value::Scalar(z)) => Some(*z),
+        _ => None,
+    };
+    // Absent Focus Distance: the zoom (256 reads back 2666.67 for both); absent Aperture: After
+    // Effects' 50 mm value (256).
+    if let (Some(z), Some(p)) = (zoom, options.prop_mut("focusDistance")) {
+        p.value = Value::Scalar(z);
+    }
+    if let Some(p) = options.prop_mut("aperture") {
+        p.value = Value::Scalar(APERTURE_1920 * f64::from(comp_width) / 1920.0);
+    }
+    let Some(PropNode::Group(group)) = layer.properties().and_then(|p| p.get("ADBE Camera Options Group")) else { return };
+    import_group(&group, &CAMERA, what, tm, options, col);
+}
+
+/// Imports the Light Options of `layer` into `options` (the layer's `lightOptions` group).
+pub(crate) fn import_light_options(layer: &AepLayer<'_, '_>, what: &str, tm: &TimeMap, options: &mut PropGroup, col: &mut Collector) {
+    let Some(PropNode::Group(group)) = layer.properties().and_then(|p| p.get("ADBE Light Options Group")) else { return };
+    import_group(&group, &LIGHT, what, tm, options, col);
+}
+
+/// A record that holds something: keys, a set value (`tdsb` 1) or an expression. Point lights
+/// store their cone as `tdsb` 3 records with the defaults (252), which hold nothing.
+fn is_stored(p: &crate::Property<'_, '_>) -> bool {
+    p.is_animated() || p.flags() == Some(1) || p.expression().is_some()
+}
+
+fn import_group(group: &AepGroup<'_, '_>, table: &[(&str, &str, Kind)], what: &str, tm: &TimeMap, options: &mut PropGroup, col: &mut Collector) {
+    for entry in group.entries() {
+        let name = entry.match_name.as_str();
+        if name == "ADBE Group End" {
+            continue;
+        }
+        let PropNode::Property(node) = entry.node else { continue };
+        if !is_stored(&node) {
+            continue;
+        }
+        // Blur Level at 100 (the default) is neutral: the exporter writes it explicitly and After
+        // Effects reads it back as 100 % (export read-back o1); other values are not sampled.
+        if name == "ADBE Camera Blur Level"
+            && !node.is_animated()
+            && node.expression().is_none()
+            && node.static_value().and_then(|raw| Kind::Number.value(&raw)) == Some(Value::Scalar(100.0))
+        {
+            continue;
+        }
+        let mapped = table.iter().find(|(m, _, _)| *m == name).and_then(|(_, id, kind)| options.prop_mut(id).map(|p| (p, *kind)));
+        let Some((prop, kind)) = mapped else {
+            col.lose(LossCategory::TransformProperties, format!("{what}: {name} not imported"));
+            continue;
+        };
+        if node.is_animated() {
+            if kind == Kind::EffectBool {
+                col.lose(LossCategory::TransformProperties, format!("{what}: the keyframes of {name} are not imported (not sampled)"));
+            } else {
+                import_keys(&node, kind, what, name, tm, prop, col);
+            }
+        } else if let Some(raw) = node.static_value() {
+            match kind.value(&raw).filter(sane) {
+                Some(v) => prop.value = v,
+                None => col.lose(LossCategory::DamagedData, format!("{what}: {name} holds a value that is not valid, default used")),
+            }
+        }
+        import_expression(&node, prop, col);
+    }
+}
diff --git a/crates/aep/src/import/effects.rs b/crates/aep/src/import/effects.rs
new file mode 100644
index 000000000..e53d6a9aa
--- /dev/null
+++ b/crates/aep/src/import/effects.rs
@@ -0,0 +1,813 @@
+//! Effects: a table maps an After Effects effect (its match name) and its parameters (by their
+//! index in `parT`) to an EffectCraft effect, a parameter id and a unit conversion. Effects and
+//! parameters outside the table are reported in [`LossCategory::Effects`] by match name, never
+//! dropped silently.
+//!
+//! Every conversion is backed by the corpus (`docs/aep-format.md` 3.7, cases 356-450, 511-516):
+//!
+//! * colour: ARGB 0..255 in the file (alpha first), straight RGBA 0..1 here. Both are values in the
+//!   project's working-space encoding (After Effects stores what its colour picker shows; EffectCraft
+//!   hands parameter colours to the effect as stored, `effectcraft-render`'s colour pipeline), so
+//!   the conversion is `/ 255` with no transfer curve. After Effects colour parameters
+//!   have no editable alpha and Tint's defaults store alpha 0 (356); EffectCraft's colour
+//!   parameters are opaque, so alpha is 1.
+//! * point: a fraction of the layer (source) size in the file, layer pixels here (369, 374, 383).
+//! * slider: each slider has its own stored scale, told by its valid maximum in `pard` (Amount to
+//!   Tint is a percent with maximum 100, Blend With Original a 0..1 fraction with maximum 1, Ramp
+//!   Scatter pixels with maximum 512, Drop Shadow Opacity and Glow Threshold 0..255, Glow's A & B
+//!   Midpoint a 0..0.99 fraction: 361, 378-381, 422, 429, 438). The table names the maximum it
+//!   expects; a file with another maximum is reported instead of guessed.
+//! * popup: 1-based in the file over all items, separators `(-` included (410); mapped to
+//!   EffectCraft's item **by name**, since the orders differ (Levels' clip popups are On, Off, ... in
+//!   After Effects and Off, On, ... here). An item EffectCraft does not have is reported.
+//! * float and integer sliders, angles: the stored number as it is (Exposure, Gaussian Blur 216,
+//!   Fast Box Blur's Iterations 414, Drop Shadow's Direction 423).
+//! * checkbox: stored 1.0 when on, 0.0 when off; without a record it has the `pard` default, which
+//!   can be on (Repeat Edge Pixels, 412 / 417).
+//!
+//! A parameter without a value record has its default: the one in `pard` (sliders, points,
+//! colours, checkboxes, popups), or for a popup whose definitions were borrowed from the project
+//! copy (its default slot holds that copy's selection) the default After Effects reads back for a
+//! fresh effect (Glow's Composite Original is Behind, 427). Keyframes (layer time) are converted
+//! with the same units (363, 364, 382, 397). The implicit input-layer parameter, buttons (Swap
+//! Colors), twirl-down group markers (Exposure) and the closing built-in entry carry nothing to
+//! import. Hue/Saturation's master values and Levels' values are arbitrary data, decoded by the
+//! reader (444-446, 512-516).
+
+use crate::effect_map::{CRYPTOMATTE_OUTPUT, Conv, EFFECTS, EffectMap, Extra, HUE_SATURATION_MASTER, LEVELS_RGB, ParamMap, popup_key};
+use crate::{
+    CryptomatteData, CurvesData, DefinitionSource, Effect as AepEffect, EffectDefinitions, EffectParam, ExtractorChannels, HueSaturationData,
+    Layer as AepLayer, LayerRef, LevelsData, MeshData, ParamKind, ParamValue,
+};
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::Ids;
+use effectcraft_project::{Node, ParamUi, PropGroup};
+
+use crate::import::props::{Kind, import_expression, import_keys};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// The match names of the effects the importer converts (the others are reported).
+pub fn supported_effects() -> impl Iterator<Item = (&'static str, &'static str)> {
+    EFFECTS.iter().map(|e| (e.match_name, e.effect))
+}
+
+/// Everything about the layer the effects need.
+pub(crate) struct LayerCtx<'c> {
+    pub comp: &'c str,
+    pub layer: &'c str,
+    /// The layer's id in the file and in the project (layer parameters).
+    pub aep_id: u32,
+    pub ec_id: effectcraft_project::LayerId,
+    /// The layer's source size in pixels (effect points are fractions of it).
+    pub size: (u32, u32),
+    pub tm: &'c TimeMap,
+}
+
+/// Imports the effects of `layer` into `target` (the layer's `effects` group) in stack order and
+/// reports the ones it cannot. `defs` is the file's effect definition index, built once per import.
+pub(crate) fn import_effects<'f, 'a>(
+    defs: &EffectDefinitions<'f, 'a>,
+    layer: &AepLayer<'f, 'a>,
+    cx: &LayerCtx<'_>,
+    ids: &mut Ids<'_>,
+    target: &mut PropGroup,
+    refs: &mut Vec<PendingLayerRef>,
+    col: &mut Collector,
+) {
+    for fx in layer.effects() {
+        // Puppet keeps its meshes and pins in nested groups, not in `parT` (its own step).
+        if fx.match_name() == crate::import::puppet::MATCH_NAME {
+            crate::import::puppet::import_puppet(defs, &fx, cx, ids, target, col);
+            continue;
+        }
+        let shown = fx.display_name().unwrap_or_else(|| fx.match_name().to_string());
+        let Some(map) = EFFECTS.iter().find(|m| m.match_name == fx.match_name()) else {
+            col.lose(LossCategory::Effects, format!("{}: '{}' has the effect '{shown}' ({})", cx.comp, cx.layer, fx.match_name()));
+            continue;
+        };
+        let Some(spec) = effectcraft_effects::find(map.effect) else {
+            col.lose(LossCategory::Effects, format!("{}: '{}' has the effect '{shown}' ({})", cx.comp, cx.layer, fx.match_name()));
+            continue;
+        };
+        if defs.source(&fx) == DefinitionSource::Missing {
+            col.lose(
+                LossCategory::Effects,
+                format!("{}: '{}' has the effect '{shown}' ({}) without readable parameter definitions, not imported", cx.comp, cx.layer, fx.match_name()),
+            );
+            continue;
+        }
+        let size = [f64::from(cx.size.0), f64::from(cx.size.1)];
+        let mut group = effectcraft_effects::instantiate(spec, ids, &shown, size);
+        match fx.enabled() {
+            Some(on) => group.enabled = on,
+            None => col.lose(LossCategory::DamagedData, format!("{}: '{}': the fx switch of '{shown}' is unreadable, imported switched on", cx.comp, cx.layer)),
+        }
+        let params = defs.params(&fx);
+        // Borrowed definitions (another instance's or the project copy) may not name every value
+        // record this instance has: such a record has nothing to import into, so it is reported.
+        if params.first().is_some_and(|p| p.borrowed_definition) {
+            let defined: std::collections::HashSet<&str> = params.iter().map(|p| p.match_name.as_str()).collect();
+            for name in fx.value_record_names().iter().filter(|n| !defined.contains(n.as_str())) {
+                col.lose(
+                    LossCategory::Effects,
+                    format!(
+                        "{}: '{}' effect '{shown}' ({}): the value record {name} has no parameter definition, not imported",
+                        cx.comp,
+                        cx.layer,
+                        fx.match_name()
+                    ),
+                );
+            }
+        }
+        if map.extra == Extra::Lumetri {
+            crate::import::lumetri::import_lumetri(&fx, &params, cx, &shown, ParamOut { group: &mut group, refs: &mut *refs, col: &mut *col });
+        } else if map.extra == Extra::Cryptomatte {
+            import_cryptomatte(&fx, &params, cx, &shown, &mut group, col);
+        } else {
+            for p in &params {
+                import_param(&fx, map, p, cx, &shown, ParamOut { group: &mut group, refs: &mut *refs, col: &mut *col });
+            }
+        }
+        col.imported.effects = col.imported.effects.saturating_add(1);
+        target.children.push(Node::Group(group));
+    }
+}
+
+/// Parameters that never carry a value to import.
+pub(crate) fn carries_nothing(p: &EffectParam<'_, '_>) -> bool {
+    matches!(p.kind, ParamKind::Button | ParamKind::NoData | ParamKind::GroupStart | ParamKind::GroupEnd) || (p.index == 0 && p.kind == ParamKind::Layer)
+}
+
+/// A layer parameter that names another layer, set once every layer of the composition exists
+/// (the layer can sit below the effect's layer).
+pub(crate) struct PendingLayerRef {
+    /// The layer that owns the effect.
+    pub layer: effectcraft_project::LayerId,
+    /// The parameter.
+    pub prop: effectcraft_project::Uid,
+    /// The file's id of the named layer.
+    pub target: u32,
+    /// Where it is, for the report.
+    pub what: String,
+}
+
+/// Where a parameter is imported to: the effect's group, the layer parameters still to resolve
+/// and the report.
+pub(crate) struct ParamOut<'a> {
+    pub group: &'a mut PropGroup,
+    pub refs: &'a mut Vec<PendingLayerRef>,
+    pub col: &'a mut Collector,
+}
+
+/// How a parameter is named in the report: its name and match name.
+pub(crate) fn param_label(p: &EffectParam<'_, '_>) -> String {
+    if p.name.trim().is_empty() { p.match_name.clone() } else { format!("{} ({})", p.name.trim(), p.match_name) }
+}
+
+/// Imports one parameter of `fx` into its EffectCraft property: its keyframes, the value in its
+/// record or the `pard` default, with a loss for what cannot be read or mapped.
+fn import_param(fx: &AepEffect<'_, '_>, map: &EffectMap, p: &EffectParam<'_, '_>, cx: &LayerCtx<'_>, shown: &str, out: ParamOut<'_>) {
+    let ParamOut { group, refs, col } = out;
+    if carries_nothing(p) {
+        return;
+    }
+    let label = param_label(p);
+    let here = format!("{}: '{}' effect '{shown}' ({})", cx.comp, cx.layer, fx.match_name());
+    if p.kind == ParamKind::ArbitraryData && map.extra != Extra::None {
+        import_extra(fx, map.extra, p, &here, cx.size, group, col);
+        return;
+    }
+    let Some(m) = map.params.iter().find(|m| m.index == p.index) else {
+        // Not in the table: lost only when the file stores something for it. A layer parameter
+        // set to no layer (its record always exists, Timewarp's Matte Layer 529) holds nothing.
+        if p.stored().is_some() && !matches!(p.stored_value(), Some(ParamValue::Layer(0))) {
+            col.lose(LossCategory::Effects, format!("{here}: parameter {label} not imported"));
+        }
+        return;
+    };
+    import_mapped(p, m, cx, (&here, &label), ParamOut { group, refs, col });
+}
+
+/// Imports parameter `p` into the property `m` names, converted by `m.conv`. `names` is
+/// `(here, label)`, the effect and the parameter for the report.
+pub(crate) fn import_mapped(p: &EffectParam<'_, '_>, m: &ParamMap, cx: &LayerCtx<'_>, names: (&str, &str), out: ParamOut<'_>) {
+    let (here, label) = names;
+    let ParamOut { group, refs, col } = out;
+    if p.kind != m.kind {
+        col.lose(LossCategory::Effects, format!("{here}: parameter {label} has type {:?}, expected {:?}; not imported", p.kind, m.kind));
+        return;
+    }
+    match m.conv {
+        Conv::Skip => return,
+        Conv::LayerRef { own } => {
+            import_layer_ref(p, m.target, own, cx, (here, label), ParamOut { group, refs, col });
+            return;
+        }
+        _ => {}
+    }
+    let (w, h) = (f64::from(cx.size.0), f64::from(cx.size.1));
+    let checked = |valid_max: f64, col: &mut Collector| {
+        // The scale comes from the file: a slider whose valid maximum is not the one the table
+        // was verified with is not guessed at.
+        let found = p.valid_max();
+        // Within 1e-4 of it: older files store Glow's A & B Midpoint maximum 0.99 as 0.98999 where
+        // After Effects 2026 writes 0.990005 (the 16.16 rounding differs); the scale is the same.
+        let ok = found.is_some_and(|v| (v - valid_max).abs() <= valid_max.abs() * 1e-4);
+        if !ok {
+            col.lose(LossCategory::Effects, format!("{here}: parameter {label} has the valid maximum {found:?}, expected {valid_max}; not imported"));
+        }
+        ok
+    };
+    // The popup's items: the file's, else After Effects' when the item count agrees.
+    let items: Vec<String> = match (m.conv, &p.items) {
+        (Conv::Popup { .. }, Some(items)) => items.clone(),
+        (Conv::Popup { items, .. }, None) => {
+            if p.popup_item_count().map(usize::from) != Some(items.len()) {
+                col.lose(
+                    LossCategory::Effects,
+                    format!("{here}: parameter {label}: the file names no popup items and has {:?} of them, not imported", p.popup_item_count()),
+                );
+                return;
+            }
+            items.iter().map(|s| s.to_string()).collect()
+        }
+        _ => Vec::new(),
+    };
+    let kind = match m.conv {
+        Conv::Color => Kind::EffectColor,
+        Conv::Point => Kind::EffectPoint(w, h),
+        Conv::Angle => Kind::EffectNumber(1.0),
+        Conv::Popup { .. } => Kind::EffectPopup(u32::try_from(items.len()).unwrap_or(u32::MAX)),
+        Conv::Checkbox => Kind::EffectBool,
+        // Handled above.
+        Conv::LayerRef { .. } | Conv::Skip => return,
+        Conv::Percent { valid_max } => {
+            if !checked(valid_max, col) {
+                return;
+            }
+            Kind::EffectNumber(100.0 / valid_max)
+        }
+        Conv::Plain { valid_max } => {
+            if !checked(valid_max, col) {
+                return;
+            }
+            Kind::EffectNumber(1.0)
+        }
+        Conv::Factor { valid_max, factor } => {
+            if !checked(valid_max, col) {
+                return;
+            }
+            Kind::EffectNumber(factor)
+        }
+    };
+    // Grouped parameters are addressed by path (`master/exposure`).
+    let Some(prop) = group.prop_mut(m.target) else {
+        col.lose(LossCategory::Effects, format!("{here}: parameter {label} has no counterpart '{}'", m.target));
+        return;
+    };
+    // For a popup: file item (0-based over all items) -> EffectCraft item, by name.
+    let popup_map = match m.conv {
+        Conv::Popup { .. } => match popup_mapping(&items, &prop.ui) {
+            Some(map) => Some(map),
+            None => {
+                col.lose(LossCategory::Effects, format!("{here}: parameter {label}: the popup items do not match EffectCraft's, not imported"));
+                return;
+            }
+        },
+        _ => None,
+    };
+    // The expression of an effect parameter is stored as on any property (534).
+    if let Some(stored) = p.stored() {
+        // The expression evaluates in the units After Effects shows (a Glow midpoint 0.25, a popup's
+        // 1-based item), the property here holds the converted value (25, a 0-based item): with a
+        // conversion the expression would read and write the wrong scale, so it is reported instead.
+        let converted = match kind {
+            Kind::EffectNumber(factor) => (factor - 1.0).abs() > f64::EPSILON,
+            Kind::EffectPopup(_) => true,
+            _ => false,
+        };
+        if converted && stored.expression().is_some() {
+            col.lose(LossCategory::Effects, format!("{here}: the expression on parameter {label} is not imported (the value is converted here)"));
+        } else {
+            import_expression(&stored, prop, col);
+        }
+    }
+    if p.is_animated() {
+        if kind == Kind::EffectBool {
+            // Keys on a checkbox are not sampled by the corpus.
+            col.lose(LossCategory::Effects, format!("{here}: the keyframes of parameter {label} are not imported (not decoded), default used"));
+            return;
+        }
+        if let Some(stored) = p.stored() {
+            let before = prop.keys.len();
+            import_keys(&stored, kind, cx.layer, &p.match_name, cx.tm, prop, col);
+            if prop.keys.len() == before {
+                col.lose(LossCategory::DamagedData, format!("{here}: parameter {label} has no readable keyframe, default used"));
+            }
+            if let Some(map) = &popup_map {
+                remap_popup_keys(prop, map, here, label, col);
+            }
+            report_beyond_limit(m.limit, prop.keys.iter().map(|k| &k.value), here, label, col);
+        }
+        return;
+    }
+    // A record in the default state (`tdsb` 3) still holds the value After Effects uses (1200,
+    // 1400: every such record reads back as recorded).
+    let value = match (p.stored(), p.recorded_value()) {
+        (Some(_), Some(v)) => Some(v),
+        (Some(_), None) => {
+            col.lose(LossCategory::DamagedData, format!("{here}: parameter {label} holds an unreadable value, default used"));
+            return;
+        }
+        // Absent = default. A borrowed popup's default slot is not reliable (a selection writes
+        // into it): After Effects' default for a fresh effect is used.
+        (None, _) => match (p.kind, m.conv) {
+            // After Effects' save of a project it opened can leave 0 in the slot (e2 re-save,
+            // Luma Key's Key Type at its default): no selection, the fresh default.
+            (ParamKind::Popup, Conv::Popup { default, .. }) => p.pard_default().filter(|v| *v != ParamValue::Index(0)).or(Some(ParamValue::Index(default))),
+            _ => p.pard_default(),
+        },
+    };
+    let Some(value) = value else { return };
+    let converted = match (value, &popup_map) {
+        (ParamValue::Index(i), Some(map)) => match usize::try_from(i).ok().and_then(|i| i.checked_sub(1)).and_then(|i| map.get(i).copied()) {
+            Some(Some(ec)) => Some(Value::Enum(ec)),
+            Some(None) => {
+                let item = usize::try_from(i).ok().and_then(|i| i.checked_sub(1)).and_then(|i| items.get(i)).cloned().unwrap_or_default();
+                col.lose(LossCategory::Effects, format!("{here}: parameter {label}: item '{item}' has no counterpart, default used"));
+                return;
+            }
+            None => None,
+        },
+        _ => convert(value, kind),
+    };
+    match converted {
+        Some(v) => {
+            report_beyond_limit(m.limit, std::iter::once(&v), here, label, col);
+            prop.value = v;
+        }
+        None => col.lose(LossCategory::DamagedData, format!("{here}: parameter {label} holds a value that is not valid ({value:?}), default used")),
+    }
+}
+
+/// Reports a value After Effects accepts but EffectCraft's effect limits (`ParamMap::limit`): it is
+/// imported as it is, and the effect renders it as the nearest end of its range.
+fn report_beyond_limit<'v>(limit: Option<(f64, f64)>, values: impl Iterator<Item = &'v Value>, here: &str, label: &str, col: &mut Collector) {
+    let Some((lo, hi)) = limit else { return };
+    let beyond: Vec<f64> = values.filter_map(|v| if let Value::Scalar(x) = v { Some(*x) } else { None }).filter(|x| *x < lo || *x > hi).collect();
+    if let Some(x) = beyond.first() {
+        col.lose(LossCategory::Effects, format!("{here}: parameter {label} is {x}, EffectCraft's effect uses {lo} to {hi} (rendered as the nearest of them)"));
+    }
+}
+
+/// A layer parameter: None stays unset, the owning layer is itself (`own`) or unset, another layer
+/// is resolved by [`resolve_layer_refs`] once the composition's layers exist.
+/// `names` is `(here, label)`, the effect and the parameter for the report.
+fn import_layer_ref(p: &EffectParam<'_, '_>, target: &str, own: bool, cx: &LayerCtx<'_>, names: (&str, &str), out: ParamOut<'_>) {
+    let (here, label) = names;
+    let ParamOut { group, refs, col } = out;
+    // After Effects hands the named layer's source to the effect, without its masks and effects
+    // (904 E24: Set Matte's luminance from a grey solid that carries a Gradient Ramp is the grey's,
+    // 0.5 everywhere); EffectCraft's companion choice defaults to Effects & Masks. Where After
+    // Effects stores another choice is not sampled.
+    if let Some(src) = group.prop_mut(&effectcraft_effects::layer_source_id(target)) {
+        src.value = Value::Enum(0);
+    }
+    let Some(prop) = group.prop_mut(target) else {
+        col.lose(LossCategory::Effects, format!("{here}: parameter {label} has no counterpart '{target}'"));
+        return;
+    };
+    if p.is_animated() || p.stored().is_some_and(|s| s.expression().is_some()) {
+        col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on the layer parameter {label} are not imported"));
+    }
+    // No record: the default, the owning layer (320).
+    match p.layer_ref(cx.aep_id).unwrap_or(LayerRef::This) {
+        // None: unset where unset means None (Layer Control), else the explicit None (fx27
+        // `layer-none`: After Effects renders Set Matte None and self differently).
+        LayerRef::Nothing => prop.value = Value::Layer(if own { None } else { Some(effectcraft_project::NO_LAYER) }),
+        LayerRef::This => prop.value = Value::Layer(own.then_some(cx.ec_id.0)),
+        LayerRef::Layer(id) => {
+            prop.value = Value::Layer(None);
+            refs.push(PendingLayerRef { layer: cx.ec_id, prop: prop.uid, target: id, what: format!("{here}: parameter {label}") });
+        }
+    }
+}
+
+/// Sets the layer parameters that name another layer of the composition (`ids`: file id ->
+/// project layer); one whose layer was not imported stays unset and is reported.
+pub(crate) fn resolve_layer_refs(
+    comp: &mut effectcraft_project::Comp,
+    refs: &[PendingLayerRef],
+    ids: &std::collections::HashMap<u32, effectcraft_project::LayerId>,
+    col: &mut Collector,
+) {
+    for r in refs {
+        let Some(target) = ids.get(&r.target) else {
+            col.lose(LossCategory::Effects, format!("{} names a layer that is not imported (id {}), left unset", r.what, r.target));
+            continue;
+        };
+        if let Some(prop) = comp.layers.iter_mut().find(|l| l.id == r.layer).and_then(|l| l.props.find_mut(r.prop)) {
+            prop.value = Value::Layer(Some(target.0));
+        }
+    }
+}
+
+/// The EffectCraft item of each file item (by name, ignoring case and separators); `None` when
+/// the parameter here is not a popup.
+fn popup_mapping(file_items: &[String], ui: &ParamUi) -> Option<Vec<Option<u32>>> {
+    let ParamUi::Popup { options } = ui else { return None };
+    let norm = popup_key;
+    Some(
+        file_items
+            .iter()
+            .map(|item| {
+                if item.trim() == "(-" {
+                    return None;
+                }
+                options.iter().position(|o| norm(o) == norm(item)).and_then(|i| u32::try_from(i).ok())
+            })
+            .collect(),
+    )
+}
+
+/// Keys of a popup were imported as file indices (0-based); maps them to EffectCraft's items.
+fn remap_popup_keys(prop: &mut effectcraft_project::Property, map: &[Option<u32>], here: &str, label: &str, col: &mut Collector) {
+    let before = prop.keys.len();
+    prop.keys.retain_mut(|k| match k.value {
+        Value::Enum(i) => match usize::try_from(i).ok().and_then(|i| map.get(i).copied().flatten()) {
+            Some(ec) => {
+                k.value = Value::Enum(ec);
+                true
+            }
+            None => false,
+        },
+        _ => true,
+    });
+    if prop.keys.len() != before {
+        col.lose(LossCategory::Effects, format!("{here}: a keyframe of parameter {label} has an item without a counterpart, dropped"));
+    }
+    if let Some(first) = prop.keys.first() {
+        prop.value = first.value.clone();
+    }
+}
+
+/// Hue/Saturation's master values, Levels' RGB values: from the arbitrary data of `p`.
+fn import_extra(fx: &AepEffect<'_, '_>, extra: Extra, p: &EffectParam<'_, '_>, here: &str, size: (u32, u32), group: &mut PropGroup, col: &mut Collector) {
+    if p.is_animated() || p.stored().is_some_and(|s| s.expression().is_some()) {
+        col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on {} are not imported", p.name));
+    }
+    let Some(data) = fx.arbitrary_data(&p.match_name) else {
+        // No record: every value is at its default. A Channel Info value record without its
+        // aRbs/aRbp payload (every sampled record has it) is damaged: the payload may have chosen
+        // other channels (`Z`), so the defaults are not what After Effects renders.
+        if p.stored().is_some() && matches!(extra, Extra::Extractor | Extra::Identifier) {
+            col.lose(
+                LossCategory::DamagedData,
+                format!("{here}: the Channel Info data is missing (a value record without its data), the default channels used"),
+            );
+        }
+        return;
+    };
+    let mut set = |id: &str, v: f64| {
+        if let Some(prop) = group.prop_mut(id)
+            && v.is_finite()
+        {
+            prop.value = Value::Scalar(v);
+        }
+    };
+    match extra {
+        Extra::HueSaturation => match HueSaturationData::parse(data) {
+            Some(d) => {
+                for (id, v) in HUE_SATURATION_MASTER.iter().zip(d.master) {
+                    set(id, f64::from(v));
+                }
+                if !d.ranges_are_default() {
+                    col.lose(LossCategory::Effects, format!("{here}: the colour ranges (Reds ... Magentas) are not imported (not sampled)"));
+                }
+            }
+            None => col.lose(LossCategory::DamagedData, format!("{here}: the Hue/Saturation data is unreadable, defaults used")),
+        },
+        Extra::Levels => match LevelsData::parse(data) {
+            Some(d) => {
+                for (id, v) in LEVELS_RGB.iter().zip(d.channels[0]) {
+                    set(id, f64::from(v));
+                }
+                if d.channels[1..].iter().any(|c| *c != LevelsData::DEFAULT_CHANNEL) {
+                    col.lose(LossCategory::Effects, format!("{here}: the per-channel values (Red, Green, Blue, Alpha) are not imported (not sampled)"));
+                }
+            }
+            None => col.lose(LossCategory::DamagedData, format!("{here}: the Levels data is unreadable, defaults used")),
+        },
+        Extra::Curves => match CurvesData::parse(data) {
+            Some(d) => {
+                // EffectCraft's curves are `x,y` points in 0..1 (the stored inputs and outputs /
+                // 255); EffectCraft interpolates them its own way (a renderer difference, the
+                // stored tables are After Effects' natural spline).
+                for (id, pts) in CURVE_IDS.iter().zip(&d.curves) {
+                    if let Some(prop) = group.prop_mut(id) {
+                        let s: Vec<String> = pts.iter().map(|(x, y)| format!("{},{}", fraction(*x), fraction(*y))).collect();
+                        prop.value = Value::Str(s.join(" "));
+                    }
+                }
+            }
+            None => col.lose(LossCategory::DamagedData, format!("{here}: the Curves data is unreadable, defaults used")),
+        },
+        Extra::MeshWarp => match MeshData::parse(data) {
+            Some(m) => import_mesh(&m, here, size, group, col),
+            None => col.lose(LossCategory::DamagedData, format!("{here}: the Distortion Mesh is unreadable, defaults used")),
+        },
+        Extra::Extractor => match ExtractorChannels::parse(data).map(|c| (c.sources(), c)) {
+            // Each output channel reads the footage's channel of the stored name, which
+            // EffectCraft's EXtractoR finds by the same name (`Z`); After Effects' `(copy)` is the
+            // input's own channel, EffectCraft's `(copy)` (not `A`, which EffectCraft reads from an
+            // OpenEXR footage's alpha plane, losing what earlier effects did to it).
+            Some((Ok(names), _)) => {
+                for (id, name) in ["red", "green", "blue", "alpha"].into_iter().zip(names) {
+                    if let Some(prop) = group.prop_mut(id) {
+                        prop.value = Value::Str(name);
+                    }
+                }
+            }
+            Some((Err(k), c)) => {
+                let names: Vec<&str> = c.channels.iter().map(|(_, n)| n.as_str()).collect();
+                col.lose(
+                    LossCategory::Effects,
+                    format!(
+                        "{here}: the channels {} are not imported (record {} is of an unknown kind or names no channel), R, G, B, A used",
+                        names.join(", "),
+                        k.saturating_add(1)
+                    ),
+                );
+            }
+            None => col.lose(LossCategory::Effects, format!("{here}: the Channel Info data is not in the sampled layout, R, G, B, A used")),
+        },
+        Extra::Identifier => match crate::identifier_channel_type(data) {
+            // No channel chosen (the type's label): After Effects lists only the footage's integer
+            // (UINT) channels and, with none chosen, leaves the layer unchanged, where EffectCraft
+            // draws the footage's object ID channel.
+            Some("Object ID") => {
+                if let Some(prop) = group.prop_mut("channelType") {
+                    prop.value = Value::Enum(0);
+                }
+                col.lose(
+                    LossCategory::Effects,
+                    format!("{here}: no ID channel is chosen (Channel Info), so After Effects leaves the layer unchanged; EffectCraft draws the footage's object ID channel"),
+                );
+            }
+            // A chosen channel, by name. EffectCraft's IDentifier has no channel of its own: it
+            // reads the footage's first `ObjectID` (`MaterialID`) channel, names compared without
+            // regard to case, so a channel of that name is the one After Effects reads.
+            Some(name) => match IDENTIFIER_OWN.iter().position(|own| own.eq_ignore_ascii_case(name.trim())) {
+                Some(kind) => {
+                    if let Some(prop) = group.prop_mut("channelType") {
+                        prop.value = Value::Enum(u32::try_from(kind).unwrap_or(0));
+                    }
+                }
+                None => col.lose(
+                    LossCategory::Effects,
+                    format!("{here}: the ID channel '{name}' (Channel Info) is not imported; EffectCraft reads the footage's object ID channel (ObjectID, object_id, objectId, id)"),
+                ),
+            },
+            None => col.lose(LossCategory::Effects, format!("{here}: the Channel Info data is not in the sampled layout, the object ID channel used")),
+        },
+        Extra::None | Extra::Lumetri | Extra::Cryptomatte => {}
+    }
+}
+
+/// The Cryptomatte plug-in (`Extra::Cryptomatte`, docs/aep-format.md 3.7): 1 Settings data
+/// (the layer by name and the selection, both carried as text), 2 Output (EffectCraft's Display
+/// and Matte Only), 3 Selection Mode (reported when on). Anything else stored is reported.
+fn import_cryptomatte(fx: &AepEffect<'_, '_>, params: &[EffectParam<'_, '_>], cx: &LayerCtx<'_>, shown: &str, group: &mut PropGroup, col: &mut Collector) {
+    let here = format!("{}: '{}' effect '{shown}' ({})", cx.comp, cx.layer, fx.match_name());
+    let set = |group: &mut PropGroup, id: &str, v: Value| {
+        if let Some(prop) = group.prop_mut(id) {
+            prop.value = v;
+        }
+    };
+    // The plug-in's Output starts at Colors (EffectCraft's Display starts at Preview); an Output
+    // that cannot be imported keeps it.
+    let (display, matte_only) = CRYPTO_COLORS;
+    set(group, "display", Value::Enum(display));
+    set(group, "matteOnly", Value::Bool(matte_only));
+    for p in params {
+        if carries_nothing(p) {
+            continue;
+        }
+        let label = if p.name.is_empty() { p.match_name.clone() } else { format!("{} ({})", p.name, p.match_name) };
+        let moving = p.is_animated() || p.stored().is_some_and(|s| s.expression().is_some());
+        match (p.index, p.kind) {
+            (1, ParamKind::ArbitraryData) => {
+                if moving {
+                    col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on {label} are not imported"));
+                }
+                // No record: the definition's default, no layer and no selection. A record
+                // without its data (every sampled record has it) is damaged.
+                let Some(data) = fx.arbitrary_data(&p.match_name) else {
+                    if p.stored().is_some() {
+                        col.lose(LossCategory::DamagedData, format!("{here}: the Cryptomatte settings (layer, selection) have no data, none used"));
+                    }
+                    continue;
+                };
+                match CryptomatteData::parse(data) {
+                    Some(d) => {
+                        set(group, "layerName", Value::Str(d.layer));
+                        set(group, "selection", Value::Str(d.selection));
+                    }
+                    None => col.lose(LossCategory::DamagedData, format!("{here}: the Cryptomatte settings (layer, selection) are unreadable, none used")),
+                }
+            }
+            (2, ParamKind::Popup) => {
+                if moving {
+                    col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on {label} are not imported, Colors used"));
+                    continue;
+                }
+                let (display, matte_only) = crypto_output(p, &here, &label, col);
+                set(group, "display", Value::Enum(display));
+                set(group, "matteOnly", Value::Bool(matte_only));
+            }
+            (3, ParamKind::Checkbox) => {
+                if moving {
+                    col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on {label} are not imported"));
+                } else {
+                    match selection_mode_on(p) {
+                        // A picking switch of the plug-in; EffectCraft picks with its own tool.
+                        Some(true) => col.lose(LossCategory::Effects, format!("{here}: parameter {label} is on and has no counterpart")),
+                        Some(false) => {}
+                        None => col.lose(LossCategory::DamagedData, format!("{here}: parameter {label} holds an unreadable value, off used")),
+                    }
+                }
+            }
+            _ => {
+                if p.stored().is_some() && !matches!(p.stored_value(), Some(ParamValue::Layer(0))) {
+                    col.lose(LossCategory::Effects, format!("{here}: parameter {label} ({:?}) not imported", p.kind));
+                }
+            }
+        }
+    }
+}
+
+/// EffectCraft's (Display, Matte Only) for the plug-in's Output Colors, its default.
+const CRYPTO_COLORS: (u32, bool) = (0, false);
+
+/// Is Selection Mode on? The plug-in writes it, when on, as a record in the default state
+/// (`tdsb` 3) holding 1.0, which [`EffectParam::stored_value`] does not read; After Effects
+/// reads it back as on and renders it (1400 `crypto-01-set-all`, `crypto-02-chk-toggled`). So
+/// the record's value counts whatever its state; no record is off (the `pard` default). `None`
+/// when a record is there but its value cannot be read (never the definition's default then).
+fn selection_mode_on(p: &EffectParam<'_, '_>) -> Option<bool> {
+    match p.stored() {
+        Some(s) => s.static_value().and_then(|v| v.first().copied()).map(|v| v != 0.0),
+        None => Some(p.value() == Some(ParamValue::Bool(true))),
+    }
+}
+
+/// Cryptomatte's Output as EffectCraft's (Display, Matte Only): Colors is Colors, Matted RGBA
+/// is Matte (the layer keyed by the selection), Matte Only is Matte Only. Matted Colors (the
+/// ID colours keyed by the selection) becomes Matte, the same matte over the layer's own
+/// colours, and is reported; a value that cannot be read is reported and Colors used.
+fn crypto_output(p: &EffectParam<'_, '_>, here: &str, label: &str, col: &mut Collector) -> (u32, bool) {
+    let items: Vec<String> = match &p.items {
+        Some(items) => items.clone(),
+        None if p.popup_item_count().map(usize::from) == Some(CRYPTOMATTE_OUTPUT.len()) => CRYPTOMATTE_OUTPUT.iter().map(|s| s.to_string()).collect(),
+        None => {
+            col.lose(
+                LossCategory::Effects,
+                format!("{here}: parameter {label}: the file names no popup items and has {:?} of them, not imported, Colors used", p.popup_item_count()),
+            );
+            return CRYPTO_COLORS;
+        }
+    };
+    let index = match (p.stored(), p.stored_value()) {
+        (Some(_), Some(ParamValue::Index(i))) => i,
+        (Some(_), _) => {
+            col.lose(LossCategory::DamagedData, format!("{here}: parameter {label} holds an unreadable value, Colors used"));
+            return CRYPTO_COLORS;
+        }
+        // No record: the default. The plug-in's is Colors (1): the `pard` default of the
+        // instance's own and of the project's shared definition, and what scripting reads from a
+        // fresh effect (1400 `crypto-00-defaults`). An instance's own definition with another
+        // default keeps it; a borrowed one has no reliable popup default.
+        (None, _) => match p.pard_default() {
+            Some(ParamValue::Index(i)) if i != 0 && !p.borrowed_definition => i,
+            _ => return CRYPTO_COLORS,
+        },
+    };
+    let item = usize::try_from(index).ok().and_then(|i| i.checked_sub(1)).and_then(|i| items.get(i)).map(String::as_str).unwrap_or_default();
+    match popup_key(item).as_str() {
+        "colors" => CRYPTO_COLORS,
+        "matted rgba" => (1, false),
+        "matte only" => (1, true),
+        "matted colors" => {
+            col.lose(
+                LossCategory::Effects,
+                format!("{here}: parameter {label}: item '{item}' ({index}) has no counterpart, imported as Matte (the layer's colours keyed by the selection, not the ID colours)"),
+            );
+            (1, false)
+        }
+        _ => {
+            col.lose(LossCategory::Effects, format!("{here}: parameter {label}: item '{item}' ({index}) has no counterpart, Colors used"));
+            CRYPTO_COLORS
+        }
+    }
+}
+
+/// The channels EffectCraft's IDentifier reads first for its Channel Type Object ID and Material
+/// ID (`AuxChannels::object_id`, `material_id`).
+const IDENTIFIER_OWN: [&str; 2] = ["ObjectID", "MaterialID"];
+
+/// Curves' EffectCraft parameters, in the stored order (RGB, Red, Green, Blue, Alpha).
+const CURVE_IDS: [&str; 5] = ["rgb", "red", "green", "blue", "alpha"];
+
+/// A stored 0..255 curve value as EffectCraft's fraction, as short as it is exact.
+fn fraction(v: u8) -> String {
+    let s = format!("{:.6}", f64::from(v) / 255.0);
+    s.trim_end_matches('0').trim_end_matches('.').to_string()
+}
+
+/// The Distortion Mesh as EffectCraft's per-vertex offsets in layer pixels (row-major `dx,dy`).
+/// The grid size comes from the data (rows first, `export-tests\mesh`); After Effects'
+/// Bezier handles are reported when they are not the default ones (EffectCraft's mesh is
+/// bilinear).
+fn import_mesh(m: &MeshData, here: &str, size: (u32, u32), group: &mut PropGroup, col: &mut Collector) {
+    let (w, h) = (f64::from(size.0.max(1)), f64::from(size.1.max(1)));
+    let rows_stored = group.prop("rows").map(|p| p.value.as_f64().round());
+    let cols_stored = group.prop("columns").map(|p| p.value.as_f64().round());
+    if rows_stored != Some(f64::from(m.rows)) || cols_stored != Some(f64::from(m.columns)) {
+        col.lose(LossCategory::Effects, format!("{here}: the Distortion Mesh is {} x {} cells, Rows / Columns say otherwise; not imported", m.columns, m.rows));
+        return;
+    }
+    let mut offs = Vec::with_capacity(m.vertices.len());
+    let mut handles_moved = false;
+    for (k, v) in m.vertices.iter().enumerate() {
+        let k = u32::try_from(k).unwrap_or(u32::MAX);
+        let (i, j) = (k % (m.columns + 1), k / (m.columns + 1));
+        let d = MeshData::default_vertex(m.columns, m.rows, i, j);
+        let (dx, dy) = (f64::from(v[0][0] - d[0][0]), f64::from(v[0][1] - d[0][1]));
+        // A dragged vertex carries its handles along (985): each handle's own move is what is
+        // left after the vertex's (pixels; top, right, bottom, left).
+        let mut own = [0.0f64; 8];
+        for (n, (a, b)) in v.iter().zip(&d).skip(1).enumerate() {
+            if *b == [0.0, 0.0] {
+                continue;
+            }
+            let (hx, hy) = (f64::from(a[0] - b[0]) - dx, f64::from(a[1] - b[1]) - dy);
+            if let Some(s) = own.get_mut(2 * n) {
+                *s = hx * w;
+            }
+            if let Some(s) = own.get_mut(2 * n + 1) {
+                *s = hy * h;
+            }
+        }
+        if !(dx.is_finite() && dy.is_finite() && own.iter().all(|x| x.is_finite())) {
+            col.lose(LossCategory::DamagedData, format!("{here}: the Distortion Mesh holds a number that is not valid, not imported"));
+            return;
+        }
+        // EffectCraft's mesh reads the first two numbers of a vertex; moved handles follow as
+        // eight more (kept for the export, not drawn).
+        let mut token = format!("{},{}", px(dx * w), px(dy * h));
+        if own.iter().any(|x| x.abs() > 0.01) {
+            handles_moved = true;
+            for x in own {
+                token.push_str(&format!(",{}", px(x)));
+            }
+        }
+        offs.push(token);
+    }
+    if handles_moved {
+        col.lose(
+            LossCategory::Effects,
+            format!("{here}: Distortion Mesh Bezier handles moved on their own are not drawn (EffectCraft's mesh is bilinear; they are kept for the export)"),
+        );
+    }
+    if let Some(p) = group.prop_mut("rows") {
+        p.value = Value::Scalar(f64::from(m.rows));
+    }
+    if let Some(p) = group.prop_mut("columns") {
+        p.value = Value::Scalar(f64::from(m.columns));
+    }
+    if let Some(p) = group.prop_mut("mesh") {
+        p.value = Value::Str(offs.join(" "));
+    }
+}
+
+/// A mesh offset in pixels: three decimals, and the float32 noise of an untouched vertex (below
+/// 1/100 px, stored fractions of the layer) as 0.
+fn px(v: f64) -> String {
+    if v.abs() < 0.01 { "0".to_string() } else { format!("{v:.3}") }
+}
+
+/// A decoded value in EffectCraft's units, `None` when it does not fit the kind or is not a valid
+/// number.
+fn convert(value: ParamValue, kind: Kind) -> Option<Value> {
+    let raw = match (value, kind) {
+        // The reader gives colours as ARGB fractions; `Kind` takes the stored 0..255.
+        (ParamValue::Argb(c), Kind::EffectColor) => c.map(|x| x * 255.0).to_vec(),
+        (ParamValue::Point(p), Kind::EffectPoint(..)) => p.to_vec(),
+        (ParamValue::Number(n), Kind::EffectNumber(_)) => vec![n],
+        (ParamValue::Index(i), Kind::EffectPopup(_)) => vec![f64::from(i)],
+        (ParamValue::Bool(b), Kind::EffectBool) => vec![if b { 1.0 } else { 0.0 }],
+        _ => return None,
+    };
+    kind.value(&raw)
+}
diff --git a/crates/aep/src/import/lumetri.rs b/crates/aep/src/import/lumetri.rs
new file mode 100644
index 000000000..5b64d3832
--- /dev/null
+++ b/crates/aep/src/import/lumetri.rs
@@ -0,0 +1,803 @@
+//! Lumetri Color (`ADBE Lumetri`) to EffectCraft's Lumetri Color (`ec.color.lumetri`).
+//!
+//! The parameters are found by their match name (`ADBE Lumetri-0011` is Exposure), not by their
+//! place in `parT`: After Effects has added parameters in the middle of the list over the
+//! versions (`-0127` ... `-0130` sit between older ones), and several sliders share a valid range
+//! (Contrast, Highlights, Shadows, Whites and Blacks are all -150..150), so a shifted index
+//! would map silently to the wrong control. Evidence: the 1200 samples (After Effects 2026,
+//! `docs/aep-format.md` 3.7).
+//!
+//! - **Values in any record state.** Lumetri writes the values of its hidden controls (High
+//!   Dynamic Range, HDR Specular, the second Look popup, ...) in records in the default state
+//!   (`tdsb` 3); After Effects reads them back as set, so every record counts here
+//!   ([`EffectParam::recorded_value`]).
+//! - **Section switches.** Each section (Basic Correction, Creative, Curves, RGB Curves, the five
+//!   hue / saturation curves, Color Wheels, HSL Secondary, Vignette) has an on / off checkbox in
+//!   After Effects; EffectCraft's Lumetri has none. A section that is off does nothing in After
+//!   Effects (1200 `lumetri-03-sec-basic-correction`, `-17-sec-vignette` render as `-00-defaults`),
+//!   so its values are not imported (the effect looks the same) and are listed in the report.
+//! - **Arbitrary data** (`ParamKind::ArbitraryData`, every instance stores it). Curves are a
+//!   curve type, a point count and points as `f64` x, y ([`curve_points`]).
+//!   - The RGB curve (`-0039`) holds four curves; the first is the master (white) curve (1200
+//!     `lumetri-60-preset-curves-rgb`), imported. The other three are reported when moved: no
+//!     sample tells which is which channel.
+//!   - Hue vs Sat (`-0042`): y is an offset from neutral, 1 doubling the saturation (`-61`), so
+//!     EffectCraft's y is `0.5 + y / 2`. The other four hue / saturation curves have no sample
+//!     of their scale and are reported when moved.
+//!   - Color Wheels (`-0047`): Shadows, Midtones, Highlights and a fourth wheel, each hue,
+//!     brightness slider, distance ([`import_wheels`], `-62`).
+//!   - The HSL Secondary key ([`HslKey`]) is imported; Split Toning and the correction wheels are
+//!     reported when they are not the default (not sampled).
+//! - **LUTs and looks.** The Input LUT and the Look are files After Effects names (the Look's name
+//!   is UTF-16 text in `-0096`, the popups only index a list of the installed ones); they are not
+//!   in the project, so a set one is reported by name and EffectCraft's popup stays None.
+//! - **Eyedropper colours** (White Balance, the hue curve selectors, the key's Set / Add /
+//!   Remove colours) only set other controls in After Effects; they are reported when set.
+//! - The `Blob` (`-0001`, an XML copy of the grade After Effects writes when a Look changes and does
+//!   not keep current: 1200 `-01-set-all` holds the defaults of controls set after the Look) and
+//!   the Auto Tone analysis (`-0121`, `-0122`) are derived data and not read.
+
+use crate::effect_map::{Conv, ParamMap};
+use crate::{Effect as AepEffect, EffectParam, ParamKind, ParamValue};
+use effectcraft_keyframe::Value;
+
+use crate::import::effects::{LayerCtx, ParamOut, carries_nothing, import_mapped, param_label};
+use crate::import::report::LossCategory;
+use ParamKind as K;
+
+/// After Effects' Show Mask styles (`-0075`, `pdnm`), EffectCraft's in the same order.
+pub const MASK_STYLE: &[&str] = &["Color/Gray", "Color/Black", "White/Black"];
+
+/// A part of the effect with its own on / off switch.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Section {
+    /// No switch (High Dynamic Range and the controls outside the sections).
+    Always,
+    BasicCorrection,
+    Creative,
+    RgbCurves,
+    /// The five hue / saturation curves (0 Hue vs Sat ... 4 Sat vs Sat).
+    HueSat(u8),
+    ColorWheels,
+    HslSecondary,
+    Vignette,
+    SpeedGradeCustom,
+}
+
+impl Section {
+    fn name(self) -> &'static str {
+        match self {
+            Section::Always => "",
+            Section::BasicCorrection => "Basic Correction",
+            Section::Creative => "Creative",
+            Section::RgbCurves => "RGB Curves",
+            Section::HueSat(0) => "Hue vs Sat",
+            Section::HueSat(1) => "Hue vs Hue",
+            Section::HueSat(2) => "Hue vs Luma",
+            Section::HueSat(3) => "Luma vs Sat",
+            Section::HueSat(_) => "Sat vs Sat",
+            Section::ColorWheels => "Color Wheels",
+            Section::HslSecondary => "HSL Secondary",
+            Section::Vignette => "Vignette",
+            Section::SpeedGradeCustom => "SpeedGrade Custom",
+        }
+    }
+}
+
+/// Arbitrary data the importer reads.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Data {
+    /// The four RGB curves (4 x 520 bytes).
+    RgbCurves,
+    /// One hue / saturation curve (520 bytes); the EffectCraft parameter when the scale of its y
+    /// is known (Hue vs Sat).
+    HueSatCurve(Option<&'static str>),
+    /// Color Wheels (4 x 3 `f64`, each wheel 0, 0.5, 0 by default).
+    Wheels,
+    /// HSL Secondary's correction wheels (8 x 3 `f64`, the same default).
+    CorrectionWheels,
+    /// Split Toning (32 zero bytes by default).
+    SplitToning,
+    /// HSL Secondary's key ([`HslKey`]).
+    HslKey,
+    /// Data without a counterpart, empty by default (`fe fe` or zero bytes).
+    Other,
+}
+
+/// What a Lumetri parameter is.
+#[derive(Clone, Copy, Debug)]
+enum Role {
+    /// An EffectCraft parameter and the conversion.
+    To(&'static str, Conv),
+    /// The on / off switch of a section.
+    Switch,
+    /// No counterpart: reported when not at the default.
+    Missing,
+    /// A checkbox without counterpart whose `pard` default is not reliable: reported when a
+    /// record says on. Legacy Tone And Saturation (`-0097`) is off in a fresh instance, but its
+    /// `pard` default reads off in 1200 as saved by the script and on after the project was
+    /// opened and saved again (`versions/1200-lumetri-26`, `-25x`, `-24x`).
+    MissingWhenOn,
+    /// An eyedropper colour: reported when set.
+    Eyedropper,
+    /// The Input LUT (`lut` true) or the Look: a popup, a name or an asset.
+    Lut {
+        lut: bool,
+    },
+    /// The Look's colour space (its popup and the space's id): goes with the Look.
+    LookSpace,
+    Data(Data),
+    /// Derived data, not read.
+    Derived,
+}
+
+struct Row {
+    suffix: u16,
+    section: Section,
+    kind: Option<ParamKind>,
+    role: Role,
+}
+
+const fn row(suffix: u16, section: Section, kind: Option<ParamKind>, role: Role) -> Row {
+    Row { suffix, section, kind, role }
+}
+
+const fn to(suffix: u16, section: Section, kind: ParamKind, target: &'static str, conv: Conv) -> Row {
+    row(suffix, section, Some(kind), Role::To(target, conv))
+}
+
+const fn plain(valid_max: f64) -> Conv {
+    Conv::Plain { valid_max }
+}
+
+use Section as S;
+
+/// Every Lumetri parameter by match-name suffix (1200: `dump.props` and the `pard` of
+/// `lumetri-00-defaults`). The valid maxima are After Effects 2026's; the stored numbers are the
+/// values After Effects shows (read back in every variant).
+const ROWS: &[Row] = &[
+    to(62, S::Always, K::Checkbox, "highDynamicRange", Conv::Checkbox),
+    // Basic Correction: 3 the switch; 4 / 95 the Input LUT's name data, 5 / 127 its popups.
+    row(3, S::BasicCorrection, Some(K::Checkbox), Role::Switch),
+    row(4, S::BasicCorrection, Some(K::ArbitraryData), Role::Lut { lut: true }),
+    row(95, S::BasicCorrection, Some(K::ArbitraryData), Role::Lut { lut: true }),
+    row(5, S::BasicCorrection, Some(K::Popup), Role::Lut { lut: true }),
+    row(127, S::BasicCorrection, Some(K::Popup), Role::Lut { lut: true }),
+    to(63, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/hdrWhite", plain(1000.0)),
+    // The Auto tone's Intensity (next to the Auto and Reset buttons 120, 119).
+    row(123, S::BasicCorrection, Some(K::FloatSlider), Role::Missing),
+    row(94, S::BasicCorrection, Some(K::Color), Role::Eyedropper),
+    to(7, S::BasicCorrection, K::FloatSlider, "basicCorrection/whiteBalance/temperature", plain(300.0)),
+    to(8, S::BasicCorrection, K::FloatSlider, "basicCorrection/whiteBalance/tint", plain(300.0)),
+    to(20, S::BasicCorrection, K::FloatSlider, "basicCorrection/saturation", plain(300.0)),
+    to(11, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/exposure", plain(7.0)),
+    to(12, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/contrast", plain(150.0)),
+    to(13, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/highlights", plain(150.0)),
+    to(14, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/shadows", plain(150.0)),
+    to(15, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/whites", plain(150.0)),
+    to(16, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/blacks", plain(150.0)),
+    to(64, S::BasicCorrection, K::FloatSlider, "basicCorrection/tone/hdrSpecular", plain(150.0)),
+    // Creative: 23 the switch; 24 / 96 the Look's name, 25 / 128 its popups, 129 / 130 its colour
+    // space.
+    row(23, S::Creative, Some(K::Checkbox), Role::Switch),
+    row(24, S::Creative, Some(K::ArbitraryData), Role::Lut { lut: false }),
+    row(96, S::Creative, Some(K::ArbitraryData), Role::Lut { lut: false }),
+    row(25, S::Creative, Some(K::Popup), Role::Lut { lut: false }),
+    row(128, S::Creative, Some(K::Popup), Role::Lut { lut: false }),
+    row(129, S::Creative, Some(K::ArbitraryData), Role::LookSpace),
+    row(130, S::Creative, Some(K::Popup), Role::LookSpace),
+    to(26, S::Creative, K::FloatSlider, "creative/lookIntensity", plain(200.0)),
+    to(28, S::Creative, K::FloatSlider, "creative/adjustments/fadedFilm", plain(150.0)),
+    to(29, S::Creative, K::FloatSlider, "creative/adjustments/sharpen", plain(100.0)),
+    to(30, S::Creative, K::FloatSlider, "creative/adjustments/vibrance", plain(100.0)),
+    to(31, S::Creative, K::FloatSlider, "creative/adjustments/creativeSaturation", plain(300.0)),
+    row(32, S::Creative, Some(K::ArbitraryData), Role::Data(Data::SplitToning)),
+    to(33, S::Creative, K::FloatSlider, "creative/adjustments/tintBalance", plain(150.0)),
+    // Curves: 37 switches all curves, 118 the RGB curves, 104 ... 111 each hue / saturation curve.
+    row(37, S::RgbCurves, Some(K::Checkbox), Role::Switch),
+    row(118, S::RgbCurves, Some(K::Checkbox), Role::Switch),
+    row(65, S::RgbCurves, Some(K::FloatSlider), Role::Missing),
+    row(39, S::RgbCurves, Some(K::ArbitraryData), Role::Data(Data::RgbCurves)),
+    row(104, S::HueSat(0), Some(K::Checkbox), Role::Switch),
+    row(113, S::HueSat(0), Some(K::Color), Role::Eyedropper),
+    row(42, S::HueSat(0), Some(K::ArbitraryData), Role::Data(Data::HueSatCurve(Some("curves/hueSaturationCurves/hueVsSat")))),
+    row(105, S::HueSat(1), Some(K::Checkbox), Role::Switch),
+    row(114, S::HueSat(1), Some(K::Color), Role::Eyedropper),
+    row(106, S::HueSat(1), Some(K::ArbitraryData), Role::Data(Data::HueSatCurve(None))),
+    row(107, S::HueSat(2), Some(K::Checkbox), Role::Switch),
+    row(115, S::HueSat(2), Some(K::Color), Role::Eyedropper),
+    row(108, S::HueSat(2), Some(K::ArbitraryData), Role::Data(Data::HueSatCurve(None))),
+    row(109, S::HueSat(3), Some(K::Checkbox), Role::Switch),
+    row(116, S::HueSat(3), Some(K::Color), Role::Eyedropper),
+    row(110, S::HueSat(3), Some(K::ArbitraryData), Role::Data(Data::HueSatCurve(None))),
+    row(111, S::HueSat(4), Some(K::Checkbox), Role::Switch),
+    row(117, S::HueSat(4), Some(K::Color), Role::Eyedropper),
+    row(112, S::HueSat(4), Some(K::ArbitraryData), Role::Data(Data::HueSatCurve(None))),
+    // Color Wheels: 46 the switch, 102 Face Detection (on by default), 66 HDR White, 47 the wheels.
+    row(46, S::ColorWheels, Some(K::Checkbox), Role::Switch),
+    row(102, S::ColorWheels, Some(K::Checkbox), Role::Missing),
+    row(66, S::ColorWheels, Some(K::FloatSlider), Role::Missing),
+    row(47, S::ColorWheels, Some(K::ArbitraryData), Role::Data(Data::Wheels)),
+    // HSL Secondary: 68 the switch; the key (70-76), Refine (81, 82), Correction (85-90).
+    row(68, S::HslSecondary, Some(K::Checkbox), Role::Switch),
+    row(70, S::HslSecondary, Some(K::Color), Role::Eyedropper),
+    row(71, S::HslSecondary, Some(K::Color), Role::Eyedropper),
+    row(72, S::HslSecondary, Some(K::Color), Role::Eyedropper),
+    row(73, S::HslSecondary, Some(K::ArbitraryData), Role::Data(Data::HslKey)),
+    to(74, S::HslSecondary, K::Checkbox, "hslSecondary/key/showMask", Conv::Checkbox),
+    to(75, S::HslSecondary, K::Popup, "hslSecondary/key/maskStyle", Conv::Popup { default: 1, items: MASK_STYLE }),
+    to(76, S::HslSecondary, K::Checkbox, "hslSecondary/key/invertMask", Conv::Checkbox),
+    to(81, S::HslSecondary, K::FloatSlider, "hslSecondary/refine/denoise", plain(100.0)),
+    to(82, S::HslSecondary, K::FloatSlider, "hslSecondary/refine/blur", plain(1000.0)),
+    row(85, S::HslSecondary, Some(K::ArbitraryData), Role::Data(Data::CorrectionWheels)),
+    // The correction wheel's mode (4 zero bytes by default).
+    row(93, S::HslSecondary, Some(K::ArbitraryData), Role::Data(Data::Other)),
+    to(86, S::HslSecondary, K::FloatSlider, "hslSecondary/correction/temperature", plain(300.0)),
+    to(87, S::HslSecondary, K::FloatSlider, "hslSecondary/correction/tint", plain(300.0)),
+    to(88, S::HslSecondary, K::FloatSlider, "hslSecondary/correction/contrast", plain(150.0)),
+    to(89, S::HslSecondary, K::FloatSlider, "hslSecondary/correction/sharpen", plain(100.0)),
+    to(90, S::HslSecondary, K::FloatSlider, "hslSecondary/correction/saturation", plain(300.0)),
+    // Vignette: 50 the switch.
+    row(50, S::Vignette, Some(K::Checkbox), Role::Switch),
+    to(51, S::Vignette, K::FloatSlider, "vignette/vignetteAmount", plain(5.0)),
+    to(52, S::Vignette, K::FloatSlider, "vignette/vignetteMidpoint", plain(100.0)),
+    to(53, S::Vignette, K::FloatSlider, "vignette/vignetteRoundness", plain(100.0)),
+    to(54, S::Vignette, K::FloatSlider, "vignette/vignetteFeather", plain(100.0)),
+    // SpeedGrade Custom: 57 Custom Layer (on by default), 60 its data.
+    row(57, S::SpeedGradeCustom, Some(K::Checkbox), Role::Switch),
+    row(60, S::SpeedGradeCustom, Some(K::ArbitraryData), Role::Data(Data::Other)),
+    // Outside the sections: Legacy Tone And Saturation, the embedded LUTs, Auto Tone, Auto Color,
+    // the LUT and Look assets.
+    row(97, S::Always, Some(K::Checkbox), Role::MissingWhenOn),
+    row(98, S::Always, Some(K::ArbitraryData), Role::Data(Data::Other)),
+    row(99, S::Always, Some(K::ArbitraryData), Role::Data(Data::Other)),
+    row(100, S::Always, Some(K::ArbitraryData), Role::Data(Data::Other)),
+    row(124, S::Always, Some(K::Checkbox), Role::Missing),
+    row(125, S::Always, Some(K::ArbitraryData), Role::Lut { lut: true }),
+    row(126, S::Always, Some(K::ArbitraryData), Role::Lut { lut: false }),
+    row(1, S::Always, Some(K::ArbitraryData), Role::Derived),
+    row(121, S::Always, Some(K::FloatSlider), Role::Derived),
+    row(122, S::Always, Some(K::ArbitraryData), Role::Derived),
+];
+
+/// The names After Effects shows for the parameters whose `pard` name is blank (`dump.props`).
+fn blank_name(suffix: u16) -> Option<&'static str> {
+    Some(match suffix {
+        62 => "High Dynamic Range",
+        3 | 23 | 37 | 118 | 104 | 105 | 107 | 109 | 111 | 46 | 68 | 50 => "Active",
+        4 | 95 => "Input LUT data",
+        24 | 96 => "Look name",
+        102 => "Face Detection",
+        74 => "Show Mask",
+        75 => "Mask style",
+        76 => "Invert Mask",
+        97 => "Legacy Tone And Saturation",
+        124 => "Auto Color Active",
+        _ => return None,
+    })
+}
+
+/// The parameter's name for the report: its own, else the one After Effects shows.
+fn name_of(p: &EffectParam<'_, '_>) -> String {
+    match (p.name.trim(), suffix(&p.match_name).and_then(blank_name)) {
+        ("", Some(n)) => n.to_string(),
+        ("", None) => p.match_name.clone(),
+        (n, _) => n.to_string(),
+    }
+}
+
+/// The match-name suffix of a Lumetri parameter (`ADBE Lumetri-0011` is 11).
+fn suffix(match_name: &str) -> Option<u16> {
+    match_name.strip_prefix("ADBE Lumetri-")?.parse().ok()
+}
+
+/// The parameter's value: the recorded one, else the `pard` default.
+fn value_of(p: &EffectParam<'_, '_>) -> Option<ParamValue> {
+    p.recorded_value().or_else(|| p.pard_default())
+}
+
+/// True when the parameter has keyframes, an expression, or a recorded value other than its
+/// default (a record without a readable default counts as set).
+fn is_set(p: &EffectParam<'_, '_>) -> bool {
+    if p.is_animated() || p.stored().is_some_and(|s| s.expression().is_some()) {
+        return true;
+    }
+    match (p.recorded_value(), p.pard_default()) {
+        (Some(v), Some(d)) => !same(v, d),
+        (Some(_), None) => true,
+        (None, _) => false,
+    }
+}
+
+/// Equal within the float noise of a stored `f64` / `f32`.
+fn same(a: ParamValue, b: ParamValue) -> bool {
+    let close = |x: f64, y: f64| (x - y).abs() <= 1e-6 * x.abs().max(y.abs()).max(1.0);
+    match (a, b) {
+        (ParamValue::Number(x), ParamValue::Number(y)) => close(x, y),
+        (ParamValue::Argb(x), ParamValue::Argb(y)) => x.iter().zip(y).skip(1).all(|(x, y)| close(*x, y)),
+        _ => a == b,
+    }
+}
+
+/// A value as the report shows it.
+fn shown_value(v: Option<ParamValue>) -> String {
+    match v {
+        Some(ParamValue::Number(n)) => {
+            let s = format!("{n:.3}");
+            s.trim_end_matches('0').trim_end_matches('.').to_string()
+        }
+        Some(ParamValue::Bool(b)) => if b { "on" } else { "off" }.to_string(),
+        Some(ParamValue::Index(i)) => format!("item {i}"),
+        Some(ParamValue::Argb([_, r, g, b])) => format!("RGB {:.3} {:.3} {:.3}", r, g, b),
+        Some(other) => format!("{other:?}"),
+        None => "set".to_string(),
+    }
+}
+
+/// Empty data: absent, `fe fe` (no text, no asset) or only zero bytes.
+fn is_empty_data(d: Option<&[u8]>) -> bool {
+    match d {
+        None => true,
+        Some(d) => d == [0xfe, 0xfe] || d.iter().all(|b| *b == 0),
+    }
+}
+
+fn le_u32(d: &[u8], at: usize) -> Option<u32> {
+    Some(u32::from_le_bytes(*d.get(at..at.checked_add(4)?)?.first_chunk::<4>()?))
+}
+
+fn le_f32(d: &[u8], at: usize) -> Option<f32> {
+    Some(f32::from_le_bytes(*d.get(at..at.checked_add(4)?)?.first_chunk::<4>()?))
+}
+
+fn le_f64(d: &[u8], at: usize) -> Option<f64> {
+    Some(f64::from_le_bytes(*d.get(at..at.checked_add(8)?)?.first_chunk::<8>()?))
+}
+
+/// A UTF-16LE text up to its NUL (the Look's name, `-0096`: `SL BLUE ICE` in 1200 `-01-set-all`);
+/// `None` for empty data.
+fn utf16_text(d: &[u8]) -> Option<String> {
+    if is_empty_data(Some(d)) {
+        return None;
+    }
+    let units: Vec<u16> = d.as_chunks::<2>().0.iter().map(|c| u16::from_le_bytes(*c)).take_while(|u| *u != 0).collect();
+    let s = String::from_utf16_lossy(&units);
+    let s = s.trim();
+    (!s.is_empty()).then(|| s.to_string())
+}
+
+/// A Lumetri curve (520 bytes): `i32` curve type at 0 (3 for the hue curves, which wrap; 2 for
+/// Luma vs Sat and Sat vs Sat; 0 for an RGB curve), the `u32` point count at 4, then the points
+/// as little-endian `f64` pairs x, y from byte 8 (at most 32), sorted by x. Bytes after the
+/// counted points are stale (a fresh hue curve has count 0 and old points behind it). An RGB
+/// curve's x and y are 0..1 (2 points 0,0 and 1,1 by default); a hue / saturation curve's x is
+/// the hue (0 red, 1/3 green) or the luma / saturation, 0..1, and y its offset from neutral.
+/// `None` when the count does not fit.
+fn curve_points(d: &[u8]) -> Option<Vec<(f64, f64)>> {
+    let n = usize::try_from(le_u32(d, 4)?).ok()?;
+    if n > d.len().saturating_sub(8) / 16 {
+        return None;
+    }
+    (0..n).map(|i| Some((le_f64(d, 8 + 16 * i)?, le_f64(d, 16 + 16 * i)?))).collect()
+}
+
+/// HSL Secondary's key (`-0073`, 40 bytes): a flag byte (1 once a key colour was picked, 0 for a
+/// fresh effect), then hue, saturation and lightness, each three little-endian `f32` (centre,
+/// range, tolerance; fractions of the full hue circle / of 0..1) and an enabled byte. A fresh effect
+/// stores flag 0 and centre 0.5, range 0, tolerance 0, enabled for each (1200 `-00-defaults`);
+/// After Effects' own copy in `-0001` names the same fields (`middleHLS`, `rangeHLS`,
+/// `toleranceHLS`, `enableHLS`, hue in degrees: centre 180). Picking Set color RGB 0.02 0.55 0.85
+/// gives hue centre 0.5605 (that colour's hue, 201.8 degrees) and lightness centre 0.435 (its
+/// HSL lightness) with range 0.05 and tolerance 0.1 (`-01-set-all`).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct HslKey {
+    pub picked: bool,
+    /// Hue, saturation, lightness: centre, range, tolerance, enabled.
+    pub channels: [(f32, f32, f32, bool); 3],
+}
+
+impl HslKey {
+    pub fn parse(d: &[u8]) -> Option<HslKey> {
+        if d.len() != 40 {
+            return None;
+        }
+        let picked = match d.first()? {
+            0 => false,
+            1 => true,
+            _ => return None,
+        };
+        let ch = |at: usize| -> Option<(f32, f32, f32, bool)> {
+            let (c, r, t) = (le_f32(d, at)?, le_f32(d, at + 4)?, le_f32(d, at + 8)?);
+            let on = match d.get(at + 12)? {
+                0 => false,
+                1 => true,
+                _ => return None,
+            };
+            (c.is_finite() && r.is_finite() && t.is_finite()).then_some((c, r, t, on))
+        };
+        Some(HslKey { picked, channels: [ch(1)?, ch(14)?, ch(27)?] })
+    }
+
+    fn is_default(&self) -> bool {
+        !self.picked && self.channels.iter().all(|c| *c == (0.5, 0.0, 0.0, true))
+    }
+}
+
+/// The colour wheel data: triples of `f64`, each wheel `0, 0.5, 0` by default.
+fn wheels_default(d: &[u8], wheels: usize) -> bool {
+    d.len() == wheels * 24 && (0..wheels).all(|w| le_f64(d, w * 24) == Some(0.0) && le_f64(d, w * 24 + 8) == Some(0.5) && le_f64(d, w * 24 + 16) == Some(0.0))
+}
+
+/// Is the data of `data` at After Effects' default (as far as it can be told)?
+fn data_default(data: Data, d: Option<&[u8]>) -> bool {
+    let Some(d) = d else { return true };
+    match data {
+        Data::RgbCurves => {
+            d.len() == 4 * 520 && d.as_chunks::<520>().0.iter().all(|c| curve_points(c).is_some_and(|pts| pts.iter().all(|(x, y)| (x - y).abs() < 1e-9)))
+        }
+        Data::HueSatCurve(_) => curve_points(d).is_some_and(|pts| pts.iter().all(|(_, y)| *y == 0.0)),
+        Data::Wheels => wheels_default(d, 4),
+        Data::CorrectionWheels => wheels_default(d, 8),
+        Data::SplitToning | Data::Other => is_empty_data(Some(d)),
+        Data::HslKey => HslKey::parse(d).is_some_and(|k| k.is_default()),
+    }
+}
+
+/// What the Input LUT or the Look holds: names, a popup item, an asset.
+#[derive(Default)]
+struct LutState {
+    names: Vec<String>,
+    item: Option<String>,
+    asset: bool,
+}
+
+/// How a set parameter of a section that does nothing is listed in the report; `None` when it is
+/// at its default.
+fn off_text(p: &EffectParam<'_, '_>, role: Role, data: Option<&[u8]>) -> Option<String> {
+    match role {
+        Role::Data(d) => (!data_default(d, data)).then(|| name_of(p)),
+        // A LUT by its name (the popups index the same choice).
+        Role::Lut { lut } if p.kind == K::ArbitraryData => {
+            let what = if lut { "Input LUT" } else { "Look" };
+            data.and_then(utf16_text).map(|n| format!("{what} '{n}'")).or_else(|| (!is_empty_data(data)).then(|| what.to_string()))
+        }
+        // The Look's colour space goes with the Look.
+        Role::Lut { .. } | Role::LookSpace | Role::Derived => None,
+        _ => is_set(p).then(|| format!("{} {}", name_of(p), shown_value(p.recorded_value()))),
+    }
+}
+
+/// Notes what an Input LUT or Look parameter holds: a popup item, an asset or a name.
+fn note_lut(p: &EffectParam<'_, '_>, suffix: u16, data: Option<&[u8]>, st: &mut LutState) {
+    if p.kind == K::Popup {
+        // The popup indexes the LUTs installed with After Effects; item 1 is None.
+        if let Some(ParamValue::Index(i)) = p.recorded_value()
+            && i > 1
+        {
+            st.item = usize::try_from(i).ok().and_then(|i| p.items.as_ref()?.get(i - 1).cloned()).or(Some(format!("item {i}")));
+        }
+    } else if suffix == 125 || suffix == 126 {
+        st.asset |= !is_empty_data(data);
+    } else if let Some(name) = data.and_then(utf16_text)
+        && !st.names.contains(&name)
+    {
+        st.names.push(name);
+    }
+}
+
+/// Imports a Lumetri Color instance's parameters into `out.group` and reports what does not arrive.
+pub(crate) fn import_lumetri(fx: &AepEffect<'_, '_>, params: &[EffectParam<'_, '_>], cx: &LayerCtx<'_>, shown: &str, out: ParamOut<'_>) {
+    let ParamOut { group, refs, col } = out;
+    let here = format!("{}: '{}' effect '{shown}' ({})", cx.comp, cx.layer, fx.match_name());
+    let find = |s: u16| params.iter().find(|p| suffix(&p.match_name) == Some(s));
+    // The switches: on unless a record says off. Keys or an expression on a switch are not
+    // imported (the static value counts).
+    let switch_on = |s: u16| -> bool {
+        match find(s) {
+            Some(p) => !matches!(value_of(p), Some(ParamValue::Bool(false))),
+            None => true,
+        }
+    };
+    // HSL Secondary without a picked key colour selects nothing: After Effects applies none of
+    // its correction (1200 `-16-sec-correction`, `-15-sec-refine` render as `-00-defaults`);
+    // EffectCraft's default key is the whole image, so the values are left out too.
+    // Unreadable or missing key data does not count as unpicked (it is reported or older).
+    let key_picked = find(73).and_then(|p| fx.arbitrary_data(&p.match_name)).and_then(HslKey::parse).is_none_or(|k| k.picked);
+    let section_on = |sec: Section| -> bool {
+        match sec {
+            Section::Always => true,
+            Section::BasicCorrection => switch_on(3),
+            Section::Creative => switch_on(23),
+            Section::RgbCurves => switch_on(37) && switch_on(118),
+            Section::HueSat(i) => switch_on(37) && switch_on([104, 105, 107, 109, 111].get(usize::from(i)).copied().unwrap_or(104)),
+            Section::ColorWheels => switch_on(46),
+            Section::HslSecondary => switch_on(68) && key_picked,
+            Section::Vignette => switch_on(50),
+            // Custom Layer off is itself reported (a switch without counterpart).
+            Section::SpeedGradeCustom => true,
+        }
+    };
+    let mut off: Vec<(Section, Vec<String>)> = Vec::new();
+    let mut eyedroppers: Vec<String> = Vec::new();
+    let mut luts = [LutState::default(), LutState::default()];
+    for p in params {
+        if carries_nothing(p) || p.match_name == "ADBE Effect Built In Params" {
+            continue;
+        }
+        let label = if p.name.trim().is_empty() { format!("{} ({})", name_of(p), p.match_name) } else { param_label(p) };
+        let Some(row) = suffix(&p.match_name).and_then(|s| ROWS.iter().find(|r| r.suffix == s)) else {
+            // A parameter this table does not know (a newer version): lost when set.
+            if p.stored().is_some()
+                && (p.kind != K::ArbitraryData && is_set(p) || p.kind == K::ArbitraryData && !is_empty_data(fx.arbitrary_data(&p.match_name)))
+            {
+                col.lose(LossCategory::Effects, format!("{here}: parameter {label} not imported"));
+            }
+            continue;
+        };
+        if row.kind.is_some_and(|k| k != p.kind) {
+            if p.stored().is_some() {
+                col.lose(LossCategory::Effects, format!("{here}: parameter {label} has type {:?}, expected {:?}; not imported", p.kind, row.kind));
+            }
+            continue;
+        }
+        let data = || fx.arbitrary_data(&p.match_name);
+        // A switched-off section: its set values are listed, not imported.
+        if !matches!(row.role, Role::Switch) && !section_on(row.section) {
+            let text = off_text(p, row.role, data());
+            if let Some(text) = text {
+                match off.iter_mut().find(|(s, _)| *s == row.section) {
+                    Some((_, list)) => {
+                        if !list.contains(&text) {
+                            list.push(text);
+                        }
+                    }
+                    None => off.push((row.section, vec![text])),
+                }
+            }
+            continue;
+        }
+        match row.role {
+            Role::To(target, conv) => {
+                let m = ParamMap { index: p.index, kind: p.kind, target, conv, limit: None };
+                import_mapped(p, &m, cx, (&here, &label), ParamOut { group: &mut *group, refs: &mut *refs, col: &mut *col });
+            }
+            Role::Switch => {
+                if p.is_animated() || p.stored().is_some_and(|s| s.expression().is_some()) {
+                    col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on the switch {label} are not imported"));
+                }
+                if row.section == Section::SpeedGradeCustom && !switch_on(row.suffix) {
+                    col.lose(LossCategory::Effects, format!("{here}: parameter {label} is off and has no counterpart"));
+                }
+            }
+            Role::MissingWhenOn => {
+                if p.is_animated() || matches!(p.recorded_value(), Some(ParamValue::Bool(true))) {
+                    col.lose(LossCategory::Effects, format!("{here}: parameter {label} is on and has no counterpart, not imported"));
+                }
+            }
+            Role::Missing => {
+                if is_set(p) {
+                    col.lose(
+                        LossCategory::Effects,
+                        format!("{here}: parameter {label} is {} and has no counterpart, not imported", shown_value(p.recorded_value())),
+                    );
+                }
+            }
+            Role::Eyedropper => {
+                if is_set(p) {
+                    eyedroppers.push(name_of(p));
+                }
+            }
+            Role::Lut { lut } => note_lut(p, row.suffix, data(), &mut luts[usize::from(!lut)]),
+            // The Look's colour space only applies to a Look, which is reported.
+            Role::LookSpace => {}
+            Role::Data(_) if p.stored().is_some() && data().is_none() => {
+                // The value record is there but its aRbs/aRbp payload is not: damaged, not the
+                // default (a parameter without a record is the default).
+                col.lose(LossCategory::DamagedData, format!("{here}: the data of {label} is missing, not imported (the default used)"));
+            }
+            Role::Data(Data::HslKey) => import_hsl_key(data(), &here, &mut *group, &mut *col),
+            Role::Data(d) => {
+                if p.is_animated() || p.stored().is_some_and(|s| s.expression().is_some()) {
+                    col.lose(LossCategory::Effects, format!("{here}: keyframes or an expression on {label} are not imported"));
+                }
+                if !data_default(d, data()) {
+                    let why = match d {
+                        Data::RgbCurves => {
+                            import_rgb_curves(data(), (&here, &label), &mut *group, &mut *col);
+                            continue;
+                        }
+                        Data::HueSatCurve(Some(target)) => {
+                            import_hue_sat_curve(data(), target, (&here, &label), &mut *group, &mut *col);
+                            continue;
+                        }
+                        Data::Wheels => {
+                            import_wheels(data(), (&here, &label), &mut *group, &mut *col);
+                            continue;
+                        }
+                        Data::HueSatCurve(None) => "the curve's points are moved; no sample tells their scale",
+                        Data::CorrectionWheels | Data::SplitToning => "the data is not decoded (not sampled)",
+                        Data::HslKey | Data::Other => "no counterpart",
+                    };
+                    col.lose(LossCategory::Effects, format!("{here}: parameter {label} is not imported ({why})"));
+                }
+            }
+            Role::Derived => {}
+        }
+    }
+    for (sec, list) in off {
+        let why = if sec == Section::HslSecondary && switch_on(68) {
+            "has no key colour picked (After Effects applies it to nothing)"
+        } else {
+            "is switched off (EffectCraft's Lumetri has no section switch)"
+        };
+        col.lose(LossCategory::Effects, format!("{here}: section {} {why}, its values are not imported: {}", sec.name(), list.join(", ")));
+    }
+    if !eyedroppers.is_empty() {
+        col.lose(LossCategory::Effects, format!("{here}: the eyedropper colours {} are not imported (they only set other controls)", eyedroppers.join(", ")));
+    }
+    for (st, what) in luts.iter().zip(["Input LUT", "Look"]) {
+        let name = st.names.first().cloned().or_else(|| st.item.clone());
+        if name.is_some() || st.asset {
+            let name = name.map(|n| format!(" '{n}'")).unwrap_or_default();
+            col.lose(
+                LossCategory::Effects,
+                format!("{here}: the {what}{name} is not imported (the LUT file is not in the project; EffectCraft's {what} stays None)"),
+            );
+        }
+    }
+}
+
+/// HSL Secondary's key as EffectCraft's hue centre / range / softness (degrees) and saturation and
+/// lightness bands (percent): range is taken as the half width, tolerance as the softness. A key
+/// that was never picked keeps EffectCraft's default (the whole image).
+fn import_hsl_key(d: Option<&[u8]>, here: &str, group: &mut effectcraft_project::PropGroup, col: &mut crate::import::report::Collector) {
+    let Some(d) = d else { return };
+    let Some(key) = HslKey::parse(d) else {
+        col.lose(LossCategory::DamagedData, format!("{here}: the HSL Secondary key data is unreadable, the default key used"));
+        return;
+    };
+    if !key.picked {
+        if !key.is_default() {
+            col.lose(LossCategory::Effects, format!("{here}: the HSL Secondary key holds values without a picked colour, not imported"));
+        }
+        return;
+    }
+    let mut set = |id: &str, v: Value| {
+        if let Some(prop) = group.prop_mut(&format!("hslSecondary/key/{id}")) {
+            prop.value = v;
+        }
+    };
+    let [h, s, l] = key.channels.map(|(c, r, t, on)| (f64::from(c), f64::from(r), f64::from(t), on));
+    set("hueEnabled", Value::Bool(h.3));
+    set("hueCenter", Value::Scalar((h.0 * 360.0).rem_euclid(360.0)));
+    set("hueRange", Value::Scalar((h.1 * 360.0).clamp(0.0, 180.0)));
+    set("hueSoftness", Value::Scalar((h.2 * 360.0).clamp(0.0, 180.0)));
+    for ((c, r, t, on), id) in [(s.0, s.1, s.2, s.3), (l.0, l.1, l.2, l.3)].into_iter().zip(["saturation", "lightness"]) {
+        set(&format!("{id}Enabled"), Value::Bool(on));
+        set(&format!("{id}Low"), Value::Scalar(((c - r) * 100.0).clamp(0.0, 100.0)));
+        set(&format!("{id}High"), Value::Scalar(((c + r) * 100.0).clamp(0.0, 100.0)));
+        set(&format!("{id}Softness"), Value::Scalar((t * 100.0).clamp(0.0, 100.0)));
+    }
+}
+
+/// A parameter of `group` set to `v` (ids the spec does not have are skipped).
+fn set_prop(group: &mut effectcraft_project::PropGroup, id: &str, v: Value) {
+    if let Some(prop) = group.prop_mut(id) {
+        prop.value = v;
+    }
+}
+
+/// Curve points as EffectCraft's `x,y x,y ...` text, x and y clamped to 0..1; `None` when a value
+/// is not finite.
+fn points_text(pts: impl IntoIterator<Item = (f64, f64)>) -> Option<String> {
+    let mut out: Vec<String> = Vec::new();
+    for (x, y) in pts {
+        if !x.is_finite() || !y.is_finite() {
+            return None;
+        }
+        out.push(format!("{},{}", x.clamp(0.0, 1.0), y.clamp(0.0, 1.0)));
+    }
+    Some(out.join(" "))
+}
+
+/// The RGB curve (`-0039`, four curves of 520 bytes). The first is the master curve (1200
+/// `lumetri-60-preset-curves-rgb`: its midpoint raised to 0.787 lifts R, G and B alike) and
+/// becomes `curves/rgbCurves/master`. The other three are the channel curves, but no sample moves
+/// one, so which is red, green or blue is not known: a moved one is reported.
+fn import_rgb_curves(d: Option<&[u8]>, (here, label): (&str, &str), group: &mut effectcraft_project::PropGroup, col: &mut crate::import::report::Collector) {
+    let Some(d) = d else { return };
+    let curves: Option<Vec<Vec<(f64, f64)>>> = if d.len() == 4 * 520 { d.as_chunks::<520>().0.iter().map(|c| curve_points(c)).collect() } else { None };
+    let Some(curves) = curves else {
+        col.lose(LossCategory::DamagedData, format!("{here}: the data of {label} is unreadable, the curves are not imported"));
+        return;
+    };
+    let identity = |pts: &[(f64, f64)]| pts.iter().all(|(x, y)| (x - y).abs() < 1e-9);
+    if let Some(master) = curves.first().filter(|c| !identity(c)) {
+        match points_text(master.iter().copied()) {
+            Some(text) => set_prop(group, "curves/rgbCurves/master", Value::Str(text)),
+            None => col.lose(LossCategory::DamagedData, format!("{here}: the master curve of {label} has unreadable points, not imported")),
+        }
+    }
+    let moved = curves.iter().skip(1).filter(|c| !identity(c)).count();
+    if moved > 0 {
+        col.lose(
+            LossCategory::Effects,
+            format!("{here}: {moved} channel curve(s) of {label} are not imported (no sample tells which curve is red, green or blue)"),
+        );
+    }
+}
+
+/// Hue vs Sat (`-0042`): After Effects' y is an offset from neutral where 1 doubles the
+/// saturation (1200 `lumetri-61-preset-curves-huesat`: a point at hue 0.0155, y 0.97 scales pure
+/// red's saturation by about 1.96 in linear light; pins at -0.03 and -0.02 scale green, blue and
+/// cyan by 0.97). EffectCraft's y = 1 doubles it and 0.5 is neutral, so y becomes `0.5 + y / 2`.
+/// x is the hue in both (0 red, 1/3 green).
+fn import_hue_sat_curve(
+    d: Option<&[u8]>,
+    target: &str,
+    (here, label): (&str, &str),
+    group: &mut effectcraft_project::PropGroup,
+    col: &mut crate::import::report::Collector,
+) {
+    let Some(d) = d else { return };
+    match curve_points(d).and_then(|pts| points_text(pts.into_iter().map(|(x, y)| (x, 0.5 + y / 2.0)))) {
+        Some(text) => set_prop(group, target, Value::Str(text)),
+        None => col.lose(LossCategory::DamagedData, format!("{here}: the data of {label} is unreadable, the curve is not imported")),
+    }
+}
+
+/// The colour EffectCraft's wheel takes for After Effects' hue (degrees, 0 red, 120 green) and
+/// distance from the centre (0..1): the HSL colour of that hue with saturation = distance and
+/// lightness 0.5 (grey 0.5 at distance 0). EffectCraft's wheel adds that colour's offset from its
+/// grey, so the direction is After Effects' and the strength grows with the distance.
+fn wheel_colour(hue: f64, distance: f64) -> [f64; 4] {
+    let c = distance.clamp(0.0, 1.0);
+    let h = hue.rem_euclid(360.0) / 60.0;
+    let x = c * (1.0 - (h.rem_euclid(2.0) - 1.0).abs());
+    let (r, g, b) = match h {
+        h if h < 1.0 => (c, x, 0.0),
+        h if h < 2.0 => (x, c, 0.0),
+        h if h < 3.0 => (0.0, c, x),
+        h if h < 4.0 => (0.0, x, c),
+        h if h < 5.0 => (x, 0.0, c),
+        _ => (c, 0.0, x),
+    };
+    let m = 0.5 - c / 2.0;
+    [r + m, g + m, b + m, 1.0]
+}
+
+/// Color Wheels (`-0047`, 96 bytes): four wheels of three little-endian `f64`, the hue in degrees,
+/// the brightness slider (0..1, 0.5 neutral) and the distance from the centre (0..1); `0, 0.5, 0`
+/// each by default. The first three are Shadows, Midtones and Highlights (1200
+/// `lumetri-62-preset-wheels`: Shadows 229 degrees (blue), slider 0.37, distance 0.55; Midtones
+/// 0.1 degrees (red), 0.5, 0.39; Highlights 93 degrees (yellow-green), 0.73, 0.32); the fourth is
+/// not known. Hue and distance become EffectCraft's wheel colour ([`wheel_colour`]); the brightness
+/// sliders and a set fourth wheel have no counterpart and are reported.
+fn import_wheels(d: Option<&[u8]>, (here, label): (&str, &str), group: &mut effectcraft_project::PropGroup, col: &mut crate::import::report::Collector) {
+    let Some(d) = d else { return };
+    let wheels: Option<Vec<[f64; 3]>> = if d.len() == 4 * 24 {
+        (0..4).map(|w| Some([le_f64(d, w * 24)?, le_f64(d, w * 24 + 8)?, le_f64(d, w * 24 + 16)?]).filter(|v| v.iter().all(|x| x.is_finite()))).collect()
+    } else {
+        None
+    };
+    let Some(wheels) = wheels else {
+        col.lose(LossCategory::DamagedData, format!("{here}: the data of {label} is unreadable, the colour wheels are not imported"));
+        return;
+    };
+    let mut lost: Vec<String> = Vec::new();
+    for (w, (id, name)) in wheels.iter().zip([("shadowsWheel", "Shadows"), ("midtonesWheel", "Midtones"), ("highlightsWheel", "Highlights")]) {
+        let [hue, brightness, distance] = *w;
+        if distance != 0.0 {
+            set_prop(group, &format!("colorWheels/{id}"), Value::Color(wheel_colour(hue, distance)));
+        }
+        if (brightness - 0.5).abs() > 1e-9 {
+            lost.push(format!("{name} brightness {brightness:.3} (0.5 is neutral)"));
+        }
+    }
+    if wheels.get(3).is_some_and(|w| *w != [0.0, 0.5, 0.0]) {
+        lost.push("the fourth wheel (its role is not known)".to_string());
+    }
+    if !lost.is_empty() {
+        col.lose(LossCategory::Effects, format!("{here}: {label}: {} not imported (no counterpart)", lost.join(", ")));
+    }
+}
diff --git a/crates/aep/src/import/markers.rs b/crates/aep/src/import/markers.rs
new file mode 100644
index 000000000..b65840c69
--- /dev/null
+++ b/crates/aep/src/import/markers.rs
@@ -0,0 +1,102 @@
+//! Layer and composition markers, and Time Remapping.
+//!
+//! Markers (aep-format.md 3.11; 122, 123, 249, 250, 347-349, 509, 510): the time is a key of the
+//! `mrst` property in its own time scale (layer time for layer markers, as EffectCraft keeps them),
+//! the duration counts 1/600 s, the strings are comment, chapter, URL, frame target and cue point
+//! name, then the cue type (event 4, navigation 5) and the cue parameters; the label is a byte of
+//! the marker header (347).
+//!
+//! Time Remapping (aep-format.md 3.4; 319, 354): an enabled remap is a keyed `ADBE Time Remapping`
+//! property whose plain one-component keys are layer time -> source time in seconds; it becomes
+//! EffectCraft's `timeRemap` property (seconds, keys in layer time) at the top of the layer's
+//! properties, where the engine's Enable Time Remapping puts it.
+
+use crate::{Chunk, CueType, Layer as AepLayer, Marker as AepMarker, PropNode, Property as AepProp};
+use effectcraft_color::Label;
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::Ids;
+use effectcraft_project::{CuePoint, Marker, Node, ParamUi, PropGroup};
+use effectcraft_time::Tick;
+
+use crate::import::props::{Kind, import_expression, import_keys};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// The time scale of the marker list below `holder` (the layer, or the composition's `SecL`).
+fn marker_scale(holder: &Chunk<'_>) -> Option<u32> {
+    holder.find_list(b"mrst")?.child_list(b"tdbs").and_then(AepProp::from_chunk)?.time_scale().filter(|s| *s != 0)
+}
+
+/// The markers of a layer (`holder` = the layer chunk) or a composition (`holder` = its `SecL`).
+pub(crate) fn import_markers(list: Vec<AepMarker>, holder: &Chunk<'_>, what: &str, tm: &TimeMap, col: &mut Collector) -> Vec<Marker> {
+    let scale = marker_scale(holder).unwrap_or(tm.timescale);
+    let mut out: Vec<Marker> = Vec::with_capacity(list.len());
+    for m in list {
+        let time = tm.units(i64::from(m.time_units), scale);
+        let duration = match m.duration_seconds {
+            Some(d) if d.is_finite() && (0.0..=1e7).contains(&d) => Tick::from_seconds_f64(d),
+            Some(_) => {
+                col.lose(LossCategory::DamagedData, format!("{what}: a marker duration is not valid, 0 used"));
+                Tick::ZERO
+            }
+            None => Tick::ZERO,
+        };
+        let label = m.label.and_then(|l| Label::ALL.get(usize::from(l)).copied()).unwrap_or(Label::None);
+        let navigation = match m.cue_type {
+            Some(CueType::Navigation) => true,
+            Some(CueType::Event) | None => false,
+            Some(CueType::Other(code)) => {
+                col.lose(LossCategory::Markers, format!("{what}: marker at {:.3} s has the cue type {code}, read as an event cue", time.seconds()));
+                false
+            }
+        };
+        let cue_point = (!m.cue_point_name.is_empty() || !m.cue_params.is_empty()).then(|| CuePoint {
+            name: m.cue_point_name.clone(),
+            navigation,
+            params: m.cue_params.clone(),
+        });
+        out.push(Marker {
+            time,
+            duration,
+            comment: m.comment,
+            label,
+            chapter: m.chapter,
+            url: m.url,
+            protected: false,
+            frame_target: m.frame_target,
+            cue_point,
+        });
+        col.imported.markers += 1;
+    }
+    out.sort_by_key(|m| m.time);
+    out
+}
+
+/// The Time Remapping of `layer`, as EffectCraft's `timeRemap` property; `None` when the remap is
+/// off. `default_seconds` is the value before the first key (the source time at the in point).
+pub(crate) fn import_time_remap(layer: &AepLayer<'_, '_>, name: &str, tm: &TimeMap, ids: &mut Ids<'_>, col: &mut Collector) -> Option<Node> {
+    let Some(PropNode::Property(p)) = layer.properties().and_then(|g| g.get("ADBE Time Remapping")) else { return None };
+    if !p.is_animated() && p.flags() != Some(1) && p.expression().is_none() {
+        return None;
+    }
+    let mut prop = ids.prop("timeRemap", "Time Remap", Value::Scalar(0.0)).with_ui(ParamUi::Number);
+    if let Some(v) = p.static_value().and_then(|v| v.first().copied()).filter(|v| v.is_finite()) {
+        prop.value = Value::Scalar(v);
+    }
+    if p.is_animated() {
+        let before = col.imported.keyframes;
+        import_keys(&p, Kind::TimeRemap, name, "ADBE Time Remapping", tm, &mut prop, col);
+        if col.imported.keyframes == before {
+            col.lose(LossCategory::TimeRemapping, format!("{name}: Time Remapping has no readable keyframe, not imported"));
+            return None;
+        }
+    }
+    import_expression(&p, &mut prop, col);
+    col.imported.time_remaps += 1;
+    Some(Node::Prop(prop))
+}
+
+/// Puts the `timeRemap` property first in the layer's properties.
+pub(crate) fn insert_time_remap(props: &mut PropGroup, node: Node) {
+    props.children.insert(0, node);
+}
diff --git a/crates/aep/src/import/masks.rs b/crates/aep/src/import/masks.rs
new file mode 100644
index 000000000..184250c4c
--- /dev/null
+++ b/crates/aep/src/import/masks.rs
@@ -0,0 +1,285 @@
+//! Layer masks: path, mode, invert, feather, opacity and expansion, with keyframes and
+//! expressions, in EffectCraft's units.
+//!
+//! Units (`docs/aep-format.md` 3.4 and 3.8): the path is stored as `f32` points normalised inside a
+//! box that is itself normalised to the **layer source** size (090 on a 1920x1080 solid, 309 on a
+//! 100x100 solid), so vertices become layer pixels with the origin at the layer's top left, as the
+//! project's masks are; a tangent is the handle minus the vertex (232). Feather and expansion are
+//! pixels, opacity a fraction (percent here). The path keyframes (64-byte records, 093) carry time,
+//! interpolation, label, roving and the ease at byte 24 (599, 700: EffectCraft's path at 0.5 / 1 /
+//! 1.5 s within 0.5 px of After Effects'); only speed 0 is sampled, another speed is imported as
+//! progress per second and reported.
+
+use crate::{Layer as AepLayer, MaskAtom, MaskMode as AepMode, PropNode, ShapePath as AepPath, ValueSource};
+use effectcraft_keyframe::{Ease, Interp, Keyframe, ShapePath, Value};
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{GroupKind, MaskMode, Node, PropGroup as EcGroup};
+
+use crate::import::props::{Kind, LIMIT, import_expression, import_keys, interp};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// The most vertices one mask path may have (a traced mask has a few hundred). Larger paths are
+/// reported as damaged data and the mask is not imported.
+pub(crate) const MAX_VERTICES: usize = 65_536;
+
+fn mode(m: AepMode) -> Option<MaskMode> {
+    Some(match m {
+        AepMode::None => MaskMode::None,
+        AepMode::Add => MaskMode::Add,
+        AepMode::Subtract => MaskMode::Subtract,
+        AepMode::Intersect => MaskMode::Intersect,
+        AepMode::Lighten => MaskMode::Lighten,
+        AepMode::Darken => MaskMode::Darken,
+        AepMode::Difference => MaskMode::Difference,
+        AepMode::Other(_) => return None,
+    })
+}
+
+/// A stored path in layer pixels (`size` is the layer's source size), or why it cannot be used.
+/// The path of a mask whose path was never set: the source rectangle, clockwise from the top left
+/// as After Effects reads it back (900: `[0,0] [0,1080] [1920,1080] [1920,0]`), no tangents.
+fn source_rectangle(size: (u32, u32)) -> ShapePath {
+    let (w, h) = (f64::from(size.0), f64::from(size.1));
+    ShapePath {
+        vertices: vec![[0.0, 0.0], [0.0, h], [w, h], [w, 0.0]],
+        in_tangents: vec![[0.0, 0.0]; 4],
+        out_tangents: vec![[0.0, 0.0]; 4],
+        closed: true,
+        feather: Vec::new(),
+    }
+}
+
+pub(crate) fn to_path(s: &AepPath, size: (u32, u32)) -> Result<ShapePath, &'static str> {
+    if !s.points.len().is_multiple_of(3) {
+        return Err("its point count is not a multiple of three");
+    }
+    let n = s.vertex_count();
+    if n == 0 {
+        return Err("its path has no vertices");
+    }
+    if n > MAX_VERTICES {
+        return Err("its path has too many vertices");
+    }
+    let vertices = s.vertices((f64::from(size.0), f64::from(size.1)));
+    let ok = |p: [f64; 2]| p.iter().all(|c| c.is_finite() && c.abs() <= LIMIT);
+    let mut path = ShapePath {
+        vertices: Vec::with_capacity(n),
+        in_tangents: Vec::with_capacity(n),
+        out_tangents: Vec::with_capacity(n),
+        closed: !s.open,
+        feather: Vec::new(),
+    };
+    for v in &vertices {
+        let (i, o) = (v.in_tangent(), v.out_tangent());
+        if !(ok(v.position) && ok(i) && ok(o)) {
+            return Err("its path holds a number that is not valid");
+        }
+        path.vertices.push(v.position);
+        path.in_tangents.push(i);
+        path.out_tangents.push(o);
+    }
+    Ok(path)
+}
+
+/// The layer whose masks are imported.
+#[derive(Clone, Copy)]
+pub(crate) struct MaskLayer<'a> {
+    /// The layer's source size (1 x 1 on a layer without a source, whose mask boxes are pixels).
+    pub size: (u32, u32),
+    /// Whether the layer has a source (a mask without a stored path is then its rectangle, 900).
+    pub source: bool,
+    pub tm: &'a TimeMap,
+}
+
+/// Imports the masks of `layer` into its `masks` group.
+pub(crate) fn import_masks(
+    layer: &AepLayer<'_, '_>,
+    comp: &str,
+    layer_name: &str,
+    ml: MaskLayer<'_>,
+    ids: &mut Ids<'_>,
+    target: &mut EcGroup,
+    col: &mut Collector,
+) {
+    for (i, atom) in layer.mask_atoms().iter().enumerate() {
+        let shown = atom.mask.name.clone().unwrap_or_else(|| format!("Mask {}", i.saturating_add(1)));
+        let what = format!("{comp}: '{layer_name}' {shown}");
+        if let Some(g) = import_mask(atom, i, &shown, &what, ml, ids, col) {
+            target.children.push(Node::Group(g));
+            col.imported.masks = col.imported.masks.saturating_add(1);
+        }
+    }
+}
+
+fn import_mask(atom: &MaskAtom<'_, '_>, index: usize, name: &str, what: &str, ml: MaskLayer<'_>, ids: &mut Ids<'_>, col: &mut Collector) -> Option<EcGroup> {
+    let MaskLayer { size, source, tm } = ml;
+    let m = &atom.mask;
+    // The path: the first shape (the static path, or the shape of the first key). A mask atom
+    // without a Mask Path entry is a mask whose path was never set: After Effects reads it back as
+    // the layer's source rectangle (900; 901 renders it shrunk by its expansion).
+    let unset = atom.path_shapes.is_empty() && atom.atom.get("ADBE Mask Shape").is_none();
+    let first = match atom.path_shapes.first() {
+        Some(Some(s)) => to_path(s, size),
+        Some(None) => Err("its path is unreadable"),
+        None if unset && source => Ok(source_rectangle(size)),
+        None if unset => Err("it has no path (the default path of a layer without a source is not sampled)"),
+        None => Err("it has no path"),
+    };
+    let first = match first {
+        Ok(p) => p,
+        Err(why) => {
+            col.lose(LossCategory::Masks, format!("{what}: not imported, {why}"));
+            return None;
+        }
+    };
+    let mask_mode = match m.mode {
+        Some(code) => mode(code).unwrap_or_else(|| {
+            let shown = match code {
+                AepMode::Other(c) => c,
+                _ => 0,
+            };
+            col.lose(LossCategory::Masks, format!("{what}: mode code {shown} is not known, imported as Add"));
+            MaskMode::Add
+        }),
+        None => {
+            col.lose(LossCategory::DamagedData, format!("{what}: mode and invert switch unreadable, Add used"));
+            MaskMode::Add
+        }
+    };
+    let color = build::MASK_COLORS.get(index % build::MASK_COLORS.len()).copied().unwrap_or([0xb1, 0xb4, 0x4f]);
+    let mut g = build::mask(ids, name, first, mask_mode, color);
+    if let GroupKind::Mask { inverted, .. } = &mut g.kind {
+        *inverted = m.inverted.unwrap_or(false);
+    }
+    // The path keyframes.
+    if let (Some(path), Some(prop)) = (atom.path, g.get_mut("path")) {
+        if m.path_animated {
+            import_path_keys(&atom.path_shapes, &path, what, size, tm, prop, col);
+        }
+        import_expression(&path, prop, col);
+    }
+    // Feather, opacity and expansion.
+    let feather = m.feather;
+    set_static(&mut g, "feather", Value::Vec2(feather.value), feather.source, |v| v.components().iter().all(|c| *c >= 0.0), what, col);
+    let opacity = m.opacity_percent;
+    set_static(&mut g, "opacity", Value::Scalar(opacity.value), opacity.source, |v| v.components().iter().all(|c| (0.0..=100.0).contains(c)), what, col);
+    let expansion = m.expansion;
+    set_static(&mut g, "expansion", Value::Scalar(expansion.value), expansion.source, |_| true, what, col);
+    for (match_name, id, kind) in [
+        ("ADBE Mask Feather", "feather", Kind::MaskFeather),
+        ("ADBE Mask Opacity", "opacity", Kind::MaskOpacity),
+        ("ADBE Mask Offset", "expansion", Kind::MaskExpansion),
+    ] {
+        let Some(PropNode::Property(node)) = atom.atom.get(match_name) else { continue };
+        let Some(prop) = g.get_mut(id) else { continue };
+        if node.is_animated() {
+            import_keys(&node, kind, what, match_name, tm, prop, col);
+        }
+        import_expression(&node, prop, col);
+    }
+    Some(g)
+}
+
+/// Sets the static mask value `id` when it is valid; otherwise the default stays and it is reported.
+fn set_static(g: &mut EcGroup, id: &str, value: Value, source: ValueSource, valid: impl Fn(&Value) -> bool, what: &str, col: &mut Collector) {
+    match source {
+        ValueSource::Default | ValueSource::Keyframed => {}
+        ValueSource::Unreadable => col.lose(LossCategory::DamagedData, format!("{what}: {id} unreadable, default used")),
+        ValueSource::Stored => {
+            if crate::import::props::sane(&value) && valid(&value) {
+                if let Some(p) = g.get_mut(id) {
+                    p.value = value;
+                }
+            } else {
+                col.lose(LossCategory::DamagedData, format!("{what}: {id} holds a number that is not valid, default used"));
+            }
+        }
+    }
+}
+
+/// The path keyframes: key `i` of the path property with shape `i` of `omks` (`shapes`); `size`
+/// scales the stored box (the source size for masks, 1 x 1 for shape paths, whose box is pixels).
+pub(crate) fn import_path_keys(
+    shapes: &[Option<AepPath>],
+    path: &crate::Property<'_, '_>,
+    what: &str,
+    size: (u32, u32),
+    tm: &TimeMap,
+    prop: &mut effectcraft_project::Property,
+    col: &mut Collector,
+) {
+    let Some(list) = path.keys() else {
+        col.lose(LossCategory::DamagedData, format!("{what}: path keyframes unreadable, the first shape is static"));
+        return;
+    };
+    let records: Vec<_> = list.keyframes().collect();
+    if records.len() != shapes.len() {
+        col.lose(LossCategory::DamagedData, format!("{what}: {} path keyframes but {} shapes, the first shape is static", records.len(), shapes.len()));
+        return;
+    }
+    let scale = path.time_scale().filter(|s| *s != 0).unwrap_or(tm.timescale);
+    let mut keys: Vec<Keyframe> = Vec::new();
+    for (rec, shape) in records.iter().zip(shapes) {
+        let Some(units) = rec.time_units() else {
+            col.lose(LossCategory::DamagedData, format!("{what}: unreadable path keyframe"));
+            continue;
+        };
+        let path = match shape.as_ref().ok_or("its shape is unreadable").and_then(|s| to_path(s, size)) {
+            Ok(p) => p,
+            Err(why) => {
+                col.lose(LossCategory::DamagedData, format!("{what}: a path keyframe was dropped, {why}"));
+                continue;
+            }
+        };
+        let mut key = Keyframe::new(tm.units(i64::from(units), scale), Value::Path(path));
+        key.in_interp = interp(rec.interpolation_in(), col, what);
+        key.out_interp = interp(rec.interpolation_out(), col, what);
+        if key.in_interp == Interp::Bezier || key.out_interp == Interp::Bezier {
+            // The ease at byte 24 (599, 700): influences as fractions; a speed of 0 is exact, the
+            // unit of another speed is not verified (taken as progress per second).
+            match rec.ease().filter(|e| [e.in_speed, e.in_influence, e.out_speed, e.out_influence].iter().all(|v| v.is_finite())) {
+                Some(e) => {
+                    if key.in_interp == Interp::Bezier {
+                        key.in_ease = vec![Ease { speed: e.in_speed, influence: e.in_influence.clamp(0.001, 1.0) }];
+                    }
+                    if key.out_interp == Interp::Bezier {
+                        key.out_ease = vec![Ease { speed: e.out_speed, influence: e.out_influence.clamp(0.001, 1.0) }];
+                    }
+                    if (key.in_interp == Interp::Bezier && e.in_speed != 0.0) || (key.out_interp == Interp::Bezier && e.out_speed != 0.0) {
+                        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: path key ease speed imported unverified (only speed 0 is sampled)"));
+                    }
+                }
+                None => {
+                    col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: bezier path key read as linear (its ease is unreadable)"));
+                    key.in_interp = if key.in_interp == Interp::Bezier { Interp::Linear } else { key.in_interp };
+                    key.out_interp = if key.out_interp == Interp::Bezier { Interp::Linear } else { key.out_interp };
+                }
+            }
+        }
+        key.roving = rec.is_roving().unwrap_or(false);
+        key.label = rec.label().filter(|l| *l <= 16).unwrap_or(0);
+        keys.push(key);
+    }
+    if keys.is_empty() {
+        return;
+    }
+    keys.sort_by_key(|k| k.time);
+    let before = keys.len();
+    keys.dedup_by_key(|k| k.time);
+    if keys.len() != before {
+        col.lose(LossCategory::DamagedData, format!("{what}: path keyframes at the same time"));
+    }
+    // The first key's incoming and the last key's outgoing ease mean nothing.
+    if let Some(first) = keys.first_mut() {
+        first.in_ease.clear();
+    }
+    if let Some(last) = keys.last_mut() {
+        last.out_ease.clear();
+    }
+    col.imported.keyframes = col.imported.keyframes.saturating_add(keys.len());
+    if let Some(first) = keys.first() {
+        prop.value = first.value.clone();
+    }
+    prop.keys = keys;
+}
diff --git a/crates/aep/src/import/props.rs b/crates/aep/src/import/props.rs
new file mode 100644
index 000000000..fd0a4f9fc
--- /dev/null
+++ b/crates/aep/src/import/props.rs
@@ -0,0 +1,452 @@
+//! The Transform properties of a layer: static values and keyframes in EffectCraft's units, and
+//! expressions as source text.
+//!
+//! Units: Anchor Point is stored as a fraction of the source size (pixels here; on text layers,
+//! which have no source, it is stored in pixels and absent means the text origin), Scale and Opacity
+//! as fractions (percent here, ease speeds scaled likewise), Position in pixels, Rotation in
+//! degrees. Keyframe times are layer time and become ticks through [`TimeMap`].
+
+use crate::{Interpolation, Keyframe as AepKey, KeyframeKind, Layer as AepLayer, PropGroup, PropNode, Property as AepProp, ValueSource};
+use effectcraft_keyframe::{Ease, Interp, Keyframe, Value};
+use effectcraft_project::{Expression, PropGroup as EcGroup, Property as EcProp};
+
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// Which property is being converted: one of the five Transform properties, a mask property, or
+/// an effect parameter (see `effects.rs`).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Kind {
+    Position,
+    /// Anchor Point of a source this big (pixels).
+    Anchor(f64, f64),
+    Scale,
+    Rotation,
+    Opacity,
+    /// Mask Feather: pixels `[x, y]`, never negative.
+    MaskFeather,
+    /// Mask Opacity: stored as a fraction 0..1, percent here.
+    MaskOpacity,
+    /// Mask Expansion: pixels.
+    MaskExpansion,
+    /// An effect slider or angle: the stored number times this factor.
+    EffectNumber(f64),
+    /// An effect point on a layer this big (pixels): stored as fractions of the layer size.
+    EffectPoint(f64, f64),
+    /// An effect colour: stored as ARGB 0..255, imported as straight RGBA 0..1 with alpha 1.
+    EffectColor,
+    /// An effect popup with this many items: stored 1-based, imported 0-based.
+    EffectPopup(u32),
+    /// An effect checkbox: stored 1.0 when on.
+    EffectBool,
+    /// Time Remapping: source seconds, as stored (319, 354).
+    TimeRemap,
+    /// A one-component value used as stored (shape sizes in pixels, percentages, degrees).
+    Number,
+    /// A two-component value used as stored (shape sizes and positions in pixels, group scale in
+    /// percent).
+    Vec2,
+    /// A three-component percentage used as stored (text animator Scale 3D, 592); a missing third
+    /// component is 100.
+    Vec3Percent,
+}
+
+impl Kind {
+    /// Stored value to the unit shown (percent for Scale and Opacity), also applied to ease
+    /// speeds.
+    fn factor(self) -> f64 {
+        match self {
+            Kind::Scale | Kind::Opacity | Kind::MaskOpacity => 100.0,
+            Kind::EffectNumber(f) => f,
+            // A fractional point's spatial speed is pixels per second divided by the layer height
+            // (597, 598, 730).
+            Kind::Anchor(_, h) | Kind::EffectPoint(_, h) => h,
+            _ => 1.0,
+        }
+    }
+
+    /// Whether a bezier ease of this kind can be imported. The ease of effect colours is only
+    /// sampled as speed 0 / influence 0 (598, handled in [`import_keys`]); popups and checkboxes
+    /// have no ease.
+    fn ease_decoded(self) -> bool {
+        !matches!(self, Kind::EffectColor | Kind::EffectPopup(_) | Kind::EffectBool)
+    }
+
+    /// The value as the project stores it; `None` when a needed component is missing or not a
+    /// finite number.
+    pub(crate) fn value(self, c: &[f64]) -> Option<Value> {
+        let g = |i: usize| c.get(i).copied().filter(|v| v.is_finite());
+        let value = match self {
+            Kind::Rotation | Kind::Opacity => Value::Scalar(g(0)? * self.factor()),
+            Kind::Position => Value::Vec3([g(0)?, g(1)?, g(2).unwrap_or(0.0)]),
+            Kind::Scale => Value::Vec3([g(0)? * 100.0, g(1)? * 100.0, g(2).map_or(100.0, |z| z * 100.0)]),
+            Kind::Anchor(w, h) => Value::Vec3([g(0)? * w, g(1)? * h, g(2).unwrap_or(0.0)]),
+            Kind::MaskFeather => Value::Vec2([g(0).filter(|v| *v >= 0.0)?, g(1).filter(|v| *v >= 0.0)?]),
+            Kind::MaskOpacity => Value::Scalar(g(0).filter(|v| (0.0..=1.0).contains(v))? * 100.0),
+            Kind::MaskExpansion => Value::Scalar(g(0)?),
+            Kind::EffectNumber(f) => Value::Scalar(g(0)? * f),
+            Kind::EffectPoint(w, h) => Value::Vec2([g(0)? * w, g(1)? * h]),
+            // ARGB: alpha first. After Effects colour parameters carry no editable alpha (Tint's
+            // defaults even store alpha 0); EffectCraft's colour parameters are opaque.
+            Kind::EffectColor => Value::Color([g(1)? / 255.0, g(2)? / 255.0, g(3)? / 255.0, 1.0]),
+            Kind::EffectPopup(items) => {
+                let i = g(0)?.round();
+                if i < 1.0 || i > f64::from(items) {
+                    return None;
+                }
+                // In range 1..=items, so the conversion is exact.
+                Value::Enum(i as u32 - 1)
+            }
+            Kind::EffectBool => Value::Bool(g(0)? != 0.0),
+            Kind::TimeRemap | Kind::Number => Value::Scalar(g(0)?),
+            Kind::Vec2 => Value::Vec2([g(0)?, g(1)?]),
+            Kind::Vec3Percent => Value::Vec3([g(0)?, g(1)?, g(2).unwrap_or(100.0)]),
+        };
+        sane(&value).then_some(value)
+    }
+
+    /// A tangent offset, in the same units as the value.
+    fn tangent(self, c: &[f64]) -> [f64; 3] {
+        let g = |i: usize| c.get(i).copied().filter(|v| v.is_finite()).unwrap_or(0.0);
+        let t = match self {
+            Kind::Anchor(w, h) => [g(0) * w, g(1) * h, g(2)],
+            Kind::EffectPoint(w, h) => [g(0) * w, g(1) * h, 0.0],
+            _ => [g(0), g(1), g(2)],
+        };
+        if t.iter().all(|v| v.abs() <= LIMIT) { t } else { [0.0; 3] }
+    }
+}
+
+/// No sensible coordinate, angle or percentage comes near this; larger numbers (and
+/// NaN or infinity) mean damaged data.
+pub(crate) const LIMIT: f64 = 1e9;
+
+pub(crate) fn sane(v: &Value) -> bool {
+    v.components().iter().all(|c| c.is_finite() && c.abs() <= LIMIT)
+}
+
+/// The five properties: stored match name, project property id.
+const SPECS: [(&str, &str); 5] =
+    [("ADBE Anchor Point", "anchor"), ("ADBE Position", "position"), ("ADBE Scale", "scale"), ("ADBE Rotate Z", "rotation"), ("ADBE Opacity", "opacity")];
+
+/// Match names of the transform group that are always present and carry nothing in their default
+/// state (the separated position dimensions and the reflection switch).
+const IGNORED: [&str; 4] = ["ADBE Position_0", "ADBE Position_1", "ADBE Position_2", "ADBE Envir Appear in Reflect"];
+
+/// How the stored Anchor Point becomes pixels.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum AnchorUnit {
+    /// A fraction of a source this big (pixels): AV layers; the source's centre when absent.
+    Source(u32, u32),
+    /// A fraction of a null object's source this big (pixels); its top-left corner when absent:
+    /// After Effects 2026 reads a null's absent Anchor Point as `[0, 0]` (#3099: two nulls made
+    /// with `addNull`, one left at its default, read back `[0, 0, 0]` and `[10, 20, 0]`).
+    Null(u32, u32),
+    /// Pixels as stored, the origin when absent: text (385) and shape (462) layers, which have no
+    /// source.
+    Pixels,
+    /// The point of interest of a camera or light: pixels as stored (251, 253, 256), imported into
+    /// `poi`; when absent the new layer's comp centre stays (255, 256 read back `[960, 540, 0]`).
+    PointOfInterest,
+}
+
+/// The 3D rotations: stored match name, project property id (486, 487: plain degrees).
+const ROTATIONS: [(&str, &str); 2] = [("ADBE Rotate X", "rotationX"), ("ADBE Rotate Y", "rotationY")];
+
+/// Imports the transform of `layer` into `target` (the layer's `transform` group).
+///
+/// `comp` is the composition size in pixels; `anchor` says how the stored Anchor Point becomes
+/// pixels.
+pub(crate) fn import_transform(
+    layer: &AepLayer<'_, '_>,
+    layer_name: &str,
+    comp: (u32, u32),
+    anchor: AnchorUnit,
+    tm: &TimeMap,
+    target: &mut EcGroup,
+    col: &mut Collector,
+) {
+    let Some(tr) = layer.transform(comp.0, comp.1) else { return };
+    let Some(PropNode::Group(group)) = layer.properties().and_then(|p| p.get("ADBE Transform Group")) else { return };
+    let (anchor_kind, anchor_px) = match anchor {
+        AnchorUnit::Source(w, h) => {
+            let (sw, sh) = (f64::from(w), f64::from(h));
+            (Kind::Anchor(sw, sh), tr.anchor_px(sw, sh))
+        }
+        AnchorUnit::Null(w, h) => {
+            let (sw, sh) = (f64::from(w), f64::from(h));
+            let px = match tr.anchor_fraction.source {
+                ValueSource::Default | ValueSource::Unreadable => [0.0; 3],
+                ValueSource::Stored | ValueSource::Keyframed => tr.anchor_px(sw, sh),
+            };
+            (Kind::Anchor(sw, sh), px)
+        }
+        AnchorUnit::Pixels | AnchorUnit::PointOfInterest => (Kind::Anchor(1.0, 1.0), tr.text_anchor_px()),
+    };
+    let poi = anchor == AnchorUnit::PointOfInterest;
+    for (match_name, id) in SPECS {
+        let (kind, base, source_of) = match id {
+            "anchor" => (anchor_kind, Value::Vec3(anchor_px), tr.anchor_fraction.source),
+            "position" => (Kind::Position, Value::Vec3(tr.position.value), tr.position.source),
+            "scale" => (Kind::Scale, Value::Vec3(tr.scale_percent.value), tr.scale_percent.source),
+            "rotation" => (Kind::Rotation, Value::Scalar(tr.rotation_degrees.value), tr.rotation_degrees.source),
+            _ => (Kind::Opacity, Value::Scalar(tr.opacity_percent.value), tr.opacity_percent.source),
+        };
+        let target_id = if poi && id == "anchor" { "poi" } else { id };
+        let Some(prop) = target.get_mut(target_id) else { continue };
+        if poi && id == "anchor" && source_of == ValueSource::Default {
+            // No record: the default point of interest of the new layer stays.
+            continue;
+        }
+        if source_of == ValueSource::Unreadable {
+            // Present in the file but not decodable: the reader gave the default in its place.
+            col.lose(LossCategory::DamagedData, format!("{layer_name}: {match_name} unreadable, default used"));
+        }
+        if sane(&base) {
+            prop.value = base;
+        } else {
+            col.lose(LossCategory::DamagedData, format!("{layer_name}: {match_name} holds a number that is not valid, default used"));
+        }
+        let Some(PropNode::Property(node)) = group.get(match_name) else { continue };
+        if source_of == ValueSource::Keyframed {
+            import_keys(&node, kind, layer_name, match_name, tm, prop, col);
+        }
+        import_expression(&node, prop, col);
+    }
+    for (match_name, id) in ROTATIONS {
+        let Some(PropNode::Property(node)) = group.get(match_name) else { continue };
+        let Some(prop) = target.get_mut(id) else {
+            col.lose(LossCategory::TransformProperties, format!("{layer_name}: {match_name}"));
+            continue;
+        };
+        if node.is_animated() {
+            import_keys(&node, Kind::Rotation, layer_name, match_name, tm, prop, col);
+        } else if let Some(v) = node.static_value().and_then(|v| v.first().copied()) {
+            let value = Value::Scalar(v);
+            if sane(&value) {
+                prop.value = value;
+            } else {
+                col.lose(LossCategory::DamagedData, format!("{layer_name}: {match_name} holds a number that is not valid, default used"));
+            }
+        }
+        import_expression(&node, prop, col);
+    }
+    if let Some(PropNode::Other(_)) = group.get("ADBE Orientation") {
+        match (layer.orientation(), target.get_mut("orientation")) {
+            (Some(o), Some(prop)) if !o.animated && !o.has_expression && sane(&Value::Vec3(o.degrees)) => prop.value = Value::Vec3(o.degrees),
+            // A layer without an orientation (an ambient light) loses nothing with the default.
+            (Some(o), None) if !o.animated && !o.has_expression && o.degrees == [0.0; 3] => {}
+            (Some(o), Some(prop)) if o.animated && !o.has_expression => import_orientation_keys(layer, layer_name, tm, prop, col),
+            (Some(o), Some(_)) if o.has_expression => {
+                col.lose(LossCategory::TransformProperties, format!("{layer_name}: ADBE Orientation expression (not decoded)"));
+            }
+            _ => col.lose(LossCategory::TransformProperties, format!("{layer_name}: ADBE Orientation")),
+        }
+    }
+    report_other_properties(&group, layer_name, col);
+}
+
+/// The keys of a keyed Orientation (703). Linear and hold sides arrive as they are; the ease of a
+/// bezier side is not sampled, so it becomes linear and is reported. EffectCraft interpolates the
+/// three angles one by one, After Effects by a slerp of the rotations (a renderer difference).
+fn import_orientation_keys(layer: &AepLayer<'_, '_>, layer_name: &str, tm: &TimeMap, prop: &mut EcProp, col: &mut Collector) {
+    let what = format!("{layer_name}: ADBE Orientation");
+    let stored = layer.orientation_keys();
+    if stored.is_empty() {
+        col.lose(LossCategory::TransformProperties, format!("{what} keys unreadable, the static value is used"));
+        return;
+    }
+    // Key times count in the property's time scale (a stretched layer's is scaled), as in
+    // `import_keys`.
+    let scale = layer.orientation_time_scale().filter(|s| *s != 0).unwrap_or(tm.timescale);
+    let mut keys: Vec<Keyframe> = Vec::with_capacity(stored.len());
+    let mut approximated = false;
+    for k in &stored {
+        let value = Value::Vec3(k.degrees);
+        if !sane(&value) {
+            col.lose(LossCategory::DamagedData, format!("{what}: keyframe value is not a number"));
+            continue;
+        }
+        let mut key = Keyframe::new(tm.units(i64::from(k.time_units), scale), value);
+        for (side, i) in [(&mut key.in_interp, k.interpolation_in), (&mut key.out_interp, k.interpolation_out)] {
+            *side = match interp(Some(i), col, &what) {
+                Interp::Bezier => {
+                    approximated = true;
+                    Interp::Linear
+                }
+                other => other,
+            };
+        }
+        keys.push(key);
+    }
+    if approximated {
+        col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: bezier key read as linear (the Orientation ease is not sampled)"));
+    }
+    keys.sort_by_key(|k| k.time);
+    keys.dedup_by_key(|k| k.time);
+    col.imported.keyframes = col.imported.keyframes.saturating_add(keys.len());
+    if let Some(first) = keys.first() {
+        prop.value = first.value.clone();
+    }
+    prop.keys = keys;
+}
+
+/// Stored transform properties that are not imported are reported.
+fn report_other_properties(group: &PropGroup<'_, '_>, layer_name: &str, col: &mut Collector) {
+    for entry in group.entries() {
+        let name = entry.match_name.as_str();
+        if SPECS.iter().chain(ROTATIONS.iter()).any(|(m, _)| *m == name) || name == "ADBE Group End" {
+            continue;
+        }
+        let PropNode::Property(p) = entry.node else { continue };
+        // A property in its default state (`tdsb` 3) holds nothing to lose.
+        let stored = p.is_animated() || p.flags() == Some(1) || p.expression().is_some();
+        if stored && !(IGNORED.contains(&name) && p.flags() != Some(1) && !p.is_animated()) {
+            col.lose(LossCategory::TransformProperties, format!("{layer_name}: {name}"));
+        }
+    }
+}
+
+/// Attaches the expression of `node` (source text and enable switch) to `prop`.
+pub(crate) fn import_expression(node: &AepProp<'_, '_>, prop: &mut EcProp, col: &mut Collector) {
+    let Some(enabled) = node.expression_enabled() else { return };
+    let Some(text) = node.expression() else { return };
+    prop.expr = Some(Expression { text, enabled });
+    col.imported.expressions += 1;
+}
+
+pub(crate) fn interp(i: Option<Interpolation>, col: &mut Collector, what: &str) -> Interp {
+    match i {
+        Some(Interpolation::Linear) | None => Interp::Linear,
+        Some(Interpolation::Bezier) => Interp::Bezier,
+        Some(Interpolation::Hold) => Interp::Hold,
+        Some(Interpolation::Other(code)) => {
+            col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: unknown interpolation {code} read as linear"));
+            Interp::Linear
+        }
+    }
+}
+
+/// An ease that can be evaluated: finite speed, influence within 0.1 % and 100 %.
+fn ease(speed: f64, influence: f64, factor: f64) -> Option<Ease> {
+    let speed = speed * factor;
+    (speed.is_finite() && speed.abs() <= LIMIT * 100.0 && influence.is_finite()).then(|| Ease { speed, influence: influence.clamp(0.001, 1.0) })
+}
+
+/// The temporal ease of both sides of a key: `(in, out)` lists with one entry per dimension, or
+/// `None` where the data cannot be used.
+fn key_eases(key: &AepKey<'_>, kind: Kind) -> Option<(Vec<Ease>, Vec<Ease>)> {
+    let f = kind.factor();
+    match key.kind() {
+        KeyframeKind::Spatial { .. } | KeyframeKind::Plain { components: 1 } => {
+            let e = key.ease()?;
+            Some((vec![ease(e.in_speed, e.in_influence, f)?], vec![ease(e.out_speed, e.out_influence, f)?]))
+        }
+        KeyframeKind::Plain { components } => {
+            // One ease per dimension (the stored slots are type-major, see
+            // `Keyframe::ease_component`), so Scale keys with a different ease in each
+            // dimension stay bezier.
+            let all = key.ease_components()?;
+            if all.len() != components {
+                return None;
+            }
+            let mut in_e = Vec::with_capacity(components);
+            let mut out_e = Vec::with_capacity(components);
+            for e in &all {
+                in_e.push(ease(e.in_speed, e.in_influence, f)?);
+                out_e.push(ease(e.out_speed, e.out_influence, f)?);
+            }
+            Some((in_e, out_e))
+        }
+        _ => None,
+    }
+}
+
+/// Keyframes of `node` into `prop`. Leaves `prop` untouched when no key is readable.
+pub(crate) fn import_keys(node: &AepProp<'_, '_>, kind: Kind, layer_name: &str, name: &str, tm: &TimeMap, prop: &mut EcProp, col: &mut Collector) {
+    let what = format!("{layer_name}: {name}");
+    let Some(list) = node.keys() else { return };
+    let scale = node.time_scale().filter(|s| *s != 0).unwrap_or(tm.timescale);
+    let mut keys: Vec<Keyframe> = Vec::new();
+    for rec in list.keyframes() {
+        let (Some(units), Some(raw)) = (rec.time_units(), rec.value()) else {
+            col.lose(LossCategory::DamagedData, format!("{what}: unreadable keyframe"));
+            continue;
+        };
+        let Some(value) = kind.value(&raw) else {
+            col.lose(LossCategory::DamagedData, format!("{what}: keyframe value is missing or not a number"));
+            continue;
+        };
+        let mut key = Keyframe::new(tm.units(i64::from(units), scale), value);
+        key.in_interp = interp(rec.interpolation_in(), col, &what);
+        key.out_interp = interp(rec.interpolation_out(), col, &what);
+        if let Some(spatial) = rec.spatial() {
+            // The switch is 1 for automatic spatial tangents (EffectCraft computes them) and 0
+            // once the tangents were set by hand.
+            key.spatial_auto = spatial.auto_bezier_flag != 0;
+            key.spatial_in = kind.tangent(&spatial.in_tangent);
+            key.spatial_out = kind.tangent(&spatial.out_tangent);
+        }
+        key.roving = rec.is_roving().unwrap_or(false);
+        key.label = rec.label().filter(|l| *l <= 16).unwrap_or(0);
+        // Colour keys switched to bezier store speed 0 and influence 0 on both sides, which After
+        // Effects interpolates linearly (598).
+        if kind == Kind::EffectColor
+            && (key.in_interp == Interp::Bezier || key.out_interp == Interp::Bezier)
+            && rec.ease().is_some_and(|e| [e.in_speed, e.in_influence, e.out_speed, e.out_influence] == [0.0; 4])
+        {
+            if key.in_interp == Interp::Bezier {
+                key.in_interp = Interp::Linear;
+            }
+            if key.out_interp == Interp::Bezier {
+                key.out_interp = Interp::Linear;
+            }
+        }
+        if key.in_interp == Interp::Bezier || key.out_interp == Interp::Bezier {
+            let undecoded = !kind.ease_decoded();
+            match key_eases(&rec, kind).filter(|_| !undecoded) {
+                Some((in_e, out_e)) => {
+                    if key.in_interp == Interp::Bezier {
+                        key.in_ease = in_e;
+                    }
+                    if key.out_interp == Interp::Bezier {
+                        key.out_ease = out_e;
+                    }
+                }
+                None => {
+                    // The ease cannot be used, so the bezier sides become linear.
+                    let why = if undecoded { "the ease of this effect parameter is not decoded" } else { "ease data not decodable" };
+                    col.lose(LossCategory::ApproximatedKeyframes, format!("{what}: bezier key read as linear ({why})"));
+                    if key.in_interp == Interp::Bezier {
+                        key.in_interp = Interp::Linear;
+                    }
+                    if key.out_interp == Interp::Bezier {
+                        key.out_interp = Interp::Linear;
+                    }
+                }
+            }
+        }
+        keys.push(key);
+    }
+    if keys.is_empty() {
+        return;
+    }
+    keys.sort_by_key(|k| k.time);
+    let before = keys.len();
+    keys.dedup_by_key(|k| k.time);
+    if keys.len() != before {
+        col.lose(LossCategory::DamagedData, format!("{what}: keyframes at the same time"));
+    }
+    // The first key's incoming and the last key's outgoing ease mean nothing.
+    if let Some(first) = keys.first_mut() {
+        first.in_ease.clear();
+    }
+    if let Some(last) = keys.last_mut() {
+        last.out_ease.clear();
+    }
+    col.imported.keyframes += keys.len();
+    if let Some(first) = keys.first() {
+        prop.value = first.value.clone();
+    }
+    prop.keys = keys;
+}
diff --git a/crates/aep/src/import/puppet.rs b/crates/aep/src/import/puppet.rs
new file mode 100644
index 000000000..ce10ae7f5
--- /dev/null
+++ b/crates/aep/src/import/puppet.rs
@@ -0,0 +1,234 @@
+//! After Effects' Puppet effect (`ADBE FreePin3`) arrives as EffectCraft's Puppet
+//! (`ec.distort.puppet`) in its place in the stack, with its name and fx switch, but **without
+//! its meshes and pins**: how After Effects stores a pin's rest place (a vertex index and offset
+//! into the hidden mesh data) and its Position (pixels or a fraction of the layer) is not decoded
+//! yet, and a guessed rest place would deform the layer wrongly without a word. What the instance
+//! holds is reported instead, mesh by mesh: Triangles, Expansion, and per pin container (Deform,
+//! Stiffness, Overlap) the number of pins, how many are keyed or carry an expression, and the
+//! match names of their atoms (Advanced and Bend pins show up there). Any entry this reader does
+//! not know is named verbatim.
+//!
+//! The tree read here (docs/aep-format.md 3.7, Puppet) comes from an external scripting listing
+//! of the effect's property tree, not from the corpus (no corpus file has a Puppet): **?** until a
+//! byte sample exists. It is read with the same verified group reader as masks, shapes and layer
+//! styles; a file whose tree differs is reported, never guessed at.
+
+use effectcraft_project::build::Ids;
+use effectcraft_project::{Node, PropGroup};
+
+use crate::import::effects::{LayerCtx, carries_nothing};
+use crate::import::report::{Collector, LossCategory};
+use crate::{Effect as AepEffect, EffectDefinitions, ParamValue, PropGroup as AepGroup, PropNode, Property as AepProperty};
+
+/// After Effects' Puppet effect.
+pub(crate) const MATCH_NAME: &str = "ADBE FreePin3";
+/// The hidden group that holds the meshes (`arap`).
+const ARAP: &str = "ADBE FreePin3 ARAP Group";
+/// Auto-traced Shapes, beside the meshes.
+const OUTLINES: &str = "ADBE FreePin3 Outlines";
+/// The hidden group of the meshes.
+const MESH_GROUP: &str = "ADBE FreePin3 Mesh Group";
+/// One mesh (`Mesh 1`).
+const MESH_ATOM: &str = "ADBE FreePin3 Mesh Atom";
+/// A mesh's hidden triangulation.
+const MESH_DATA: &str = "ADBE FreePin3 Mesh";
+const TRIANGLES: &str = "ADBE FreePin3 Mesh Tri Count";
+const EXPANSION: &str = "ADBE FreePin3 Mesh Expansion";
+/// At most this many meshes, pin atom names or unrecognised names are listed in a report line;
+/// the rest are counted (`and 3 more`).
+const LIST_CAP: usize = 10;
+/// The pin containers of a mesh: match name and the name After Effects shows.
+const PIN_GROUPS: [(&str, &str); 3] = [("ADBE FreePin3 PosPins", "Deform"), ("ADBE FreePin3 HghtPins", "Overlap"), ("ADBE FreePin3 StarchPins", "Stiffness")];
+
+/// Imports a Puppet instance (the caller checked the match name) into `target`.
+pub(crate) fn import_puppet<'f, 'a>(
+    defs: &EffectDefinitions<'f, 'a>,
+    fx: &AepEffect<'f, 'a>,
+    cx: &LayerCtx<'_>,
+    ids: &mut Ids<'_>,
+    target: &mut PropGroup,
+    col: &mut Collector,
+) {
+    let shown = fx.display_name().unwrap_or_else(|| fx.match_name().to_string());
+    let here = format!("{}: '{}' effect '{shown}' ({MATCH_NAME})", cx.comp, cx.layer);
+    let Some(spec) = effectcraft_effects::find(effectcraft_effects::puppet::ID) else {
+        col.lose(LossCategory::Effects, format!("{}: '{}' has the effect '{shown}' ({MATCH_NAME})", cx.comp, cx.layer));
+        return;
+    };
+    let size = [f64::from(cx.size.0), f64::from(cx.size.1)];
+    let mut group = effectcraft_effects::instantiate(spec, ids, &shown, size);
+    match fx.enabled() {
+        Some(on) => group.enabled = on,
+        None => col.lose(LossCategory::DamagedData, format!("{}: '{}': the fx switch of '{shown}' is unreadable, imported switched on", cx.comp, cx.layer)),
+    }
+    // The ordinary parameters (`parT`): none is mapped yet, so a stored one is reported.
+    let params = defs.params(fx);
+    for p in &params {
+        if carries_nothing(p) {
+            continue;
+        }
+        if p.stored().is_some() && !matches!(p.stored_value(), Some(ParamValue::Layer(0))) {
+            let label = if p.name.is_empty() { p.match_name.clone() } else { format!("{} ({})", p.name, p.match_name) };
+            col.lose(LossCategory::Effects, format!("{here}: parameter {label} not imported"));
+        }
+    }
+    report_meshes(fx, &params.iter().map(|p| p.match_name.as_str()).collect::<Vec<_>>(), &here, col);
+    // The effect itself arrives (an EffectCraft Puppet the user can pin again), so it counts as
+    // imported; what it held is in the losses above.
+    col.imported.effects = col.imported.effects.saturating_add(1);
+    target.children.push(Node::Group(group));
+}
+
+/// Reports the meshes and pins of `fx` and every entry of its value group that is neither a
+/// `parT` parameter (`param_names`) nor the mesh tree.
+fn report_meshes(fx: &AepEffect<'_, '_>, param_names: &[&str], here: &str, col: &mut Collector) {
+    let mut unknown: Vec<String> = Vec::new();
+    let values = fx.chunk().child_list(b"tdgp").and_then(AepGroup::from_chunk);
+    let mut arap = None;
+    for e in values.map(|g| g.entries()).unwrap_or_default() {
+        if e.match_name == ARAP {
+            if let PropNode::Group(g) = e.node {
+                if arap.is_none() {
+                    arap = Some(g);
+                }
+            } else {
+                push_unique(&mut unknown, e.match_name);
+            }
+        } else if !param_names.contains(&e.match_name.as_str()) {
+            match e.node {
+                // A value outside `parT` (On Transparent, ...): reported with what it holds.
+                PropNode::Property(p) => col.lose(LossCategory::Effects, format!("{here}: property {} ({}) not imported", e.match_name, describe(&p))),
+                PropNode::Group(_) | PropNode::Other(_) => push_unique(&mut unknown, e.match_name),
+            }
+        }
+    }
+    let mut meshes: Vec<String> = Vec::new();
+    let mut found = false;
+    if let Some(arap) = arap {
+        for e in arap.entries() {
+            match (e.match_name.as_str(), e.node) {
+                (MESH_GROUP, PropNode::Group(g)) if !found => {
+                    found = true;
+                    for m in g.entries() {
+                        match (m.match_name.as_str(), m.node) {
+                            (MESH_ATOM, PropNode::Group(mesh)) => {
+                                let n = meshes.len().saturating_add(1);
+                                meshes.push(mesh_summary(&mesh, n, &mut unknown));
+                            }
+                            _ => push_unique(&mut unknown, m.match_name.clone()),
+                        }
+                    }
+                }
+                // Auto-traced Shapes are made from the layer again (EffectCraft traces the alpha).
+                (OUTLINES, _) => {}
+                _ => push_unique(&mut unknown, e.match_name.clone()),
+            }
+        }
+    }
+    let extra = if unknown.is_empty() { String::new() } else { format!("; not recognised: {}", capped(&unknown, ", ")) };
+    if !found {
+        col.lose(
+            LossCategory::Effects,
+            format!("{here}: imported without meshes or pins: its mesh group ({ARAP} / {MESH_GROUP}) was not found or is not a group{extra}"),
+        );
+    } else if !meshes.is_empty() {
+        col.lose(
+            LossCategory::Effects,
+            format!(
+                "{here}: imported without its meshes and pins (After Effects' pin rest places and positions are not decoded yet): {}{extra}",
+                capped(&meshes, "; ")
+            ),
+        );
+    } else if !unknown.is_empty() {
+        col.lose(LossCategory::Effects, format!("{here}: no mesh{extra}"));
+    }
+}
+
+/// `Mesh n (Triangles t, Expansion e): Deform 3 pins (1 keyed) [atom names], Overlap no pins, ...`
+fn mesh_summary(mesh: &AepGroup<'_, '_>, n: usize, unknown: &mut Vec<String>) -> String {
+    let name = mesh.user_name().unwrap_or_else(|| format!("Mesh {n}"));
+    let mut settings: Vec<String> = Vec::new();
+    let mut containers: Vec<String> = Vec::new();
+    for e in mesh.entries() {
+        let label = match e.match_name.as_str() {
+            TRIANGLES => Some("Triangles"),
+            EXPANSION => Some("Expansion"),
+            _ => None,
+        };
+        match (label, e.node) {
+            (Some(label), PropNode::Property(p)) => settings.push(format!("{label} {}", describe(&p))),
+            // The triangulation After Effects keeps; EffectCraft builds its own.
+            _ if e.match_name == MESH_DATA => {}
+            _ => match (PIN_GROUPS.iter().find(|(m, _)| *m == e.match_name), e.node) {
+                (Some((_, shown)), PropNode::Group(g)) => containers.push(format!("{shown} {}", pins_summary(&g, unknown))),
+                _ => push_unique(unknown, e.match_name),
+            },
+        }
+    }
+    let settings = if settings.is_empty() { String::new() } else { format!(" ({})", settings.join(", ")) };
+    let containers = if containers.is_empty() { "no pin groups".to_string() } else { containers.join(", ") };
+    format!("{name}{settings}: {containers}")
+}
+
+/// `3 pins (1 keyed, 1 with an expression) [ADBE FreePin3 PosPin Atom]`, or `no pins`. An entry
+/// of the container that is not a group (a pin is one) goes to `unknown`.
+fn pins_summary(container: &AepGroup<'_, '_>, unknown: &mut Vec<String>) -> String {
+    let mut count = 0usize;
+    let mut keyed = 0usize;
+    let mut expressions = 0usize;
+    let mut atoms: Vec<String> = Vec::new();
+    for e in container.entries() {
+        let PropNode::Group(pin) = e.node else {
+            push_unique(unknown, e.match_name);
+            continue;
+        };
+        count = count.saturating_add(1);
+        push_unique(&mut atoms, e.match_name);
+        let props: Vec<AepProperty<'_, '_>> =
+            pin.entries().into_iter().filter_map(|p| if let PropNode::Property(p) = p.node { Some(p) } else { None }).collect();
+        if props.iter().any(AepProperty::is_animated) {
+            keyed = keyed.saturating_add(1);
+        }
+        if props.iter().any(|p| p.expression().is_some()) {
+            expressions = expressions.saturating_add(1);
+        }
+    }
+    if count == 0 {
+        return "no pins".to_string();
+    }
+    let mut what = vec![format!("{keyed} keyed")];
+    if expressions > 0 {
+        what.push(format!("{expressions} with an expression"));
+    }
+    format!("{count} pin{} ({}) [{}]", if count == 1 { "" } else { "s" }, what.join(", "), capped(&atoms, ", "))
+}
+
+/// A stored property's value for the report: `keyed`, the static value, or `unreadable`.
+fn describe(p: &AepProperty<'_, '_>) -> String {
+    if p.is_animated() {
+        return "keyed".to_string();
+    }
+    match p.static_value() {
+        Some(v) if v.len() == 1 => v.first().map(|x| format!("{x}")).unwrap_or_default(),
+        Some(v) => format!("[{}]", v.iter().map(|x| format!("{x}")).collect::<Vec<_>>().join(", ")),
+        None => "unreadable".to_string(),
+    }
+}
+
+/// Adds `name` to `names` unless it is there already.
+fn push_unique(names: &mut Vec<String>, name: String) {
+    if !names.contains(&name) {
+        names.push(name);
+    }
+}
+
+/// The first [`LIST_CAP`] of `items` joined by `sep`, and how many more there are.
+fn capped(items: &[String], sep: &str) -> String {
+    let shown: Vec<&str> = items.iter().take(LIST_CAP).map(String::as_str).collect();
+    let mut out = shown.join(sep);
+    let more = items.len().saturating_sub(LIST_CAP);
+    if more > 0 {
+        out.push_str(&format!("{sep}and {more} more"));
+    }
+    out
+}
diff --git a/crates/aep/src/import/report.rs b/crates/aep/src/import/report.rs
new file mode 100644
index 000000000..129fcf143
--- /dev/null
+++ b/crates/aep/src/import/report.rs
@@ -0,0 +1,303 @@
+//! The import report: what was imported (counts) and everything that was not, per category.
+//!
+//! The report is plain data (`serde`), so it round-trips through JSON: the engine command returns it
+//! and agents read it. Nothing the importer skips is left out of it.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+
+use crate::container::AepFile;
+
+/// Most example lines kept per loss category (the count is always exact).
+pub const MAX_DETAILS: usize = 20;
+
+/// Why a piece of the file did not arrive in the project, or arrived changed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum LossCategory {
+    /// Effects on layers that are not imported (by match name), and parameters of imported
+    /// effects that are not.
+    Effects,
+    /// Mask data that is not imported: a mask whose path cannot be used (none, unreadable, empty,
+    /// not finite) and an unknown mask mode (imported as Add).
+    Masks,
+    /// Parts of shape layers that are not imported: contents items and properties outside the
+    /// imported set, groups nested too deep, material options. (The layers are imported.)
+    ShapeLayers,
+    /// Parts of text layers that are not imported: wiggly and expression selectors and the other
+    /// animator entries outside the imported set, Path Options and More Options
+    /// with set values, Source Text keyframes and expressions, undecoded character and paragraph
+    /// fields that differ from the default, unknown capitalisation or justification codes, control
+    /// characters of unknown meaning. (The layers themselves are imported.)
+    TextLayers,
+    /// Camera layers that are not imported (none at present: cameras are imported).
+    Cameras,
+    /// Light layers of a light type that is not sampled (the other lights are imported).
+    Lights,
+    /// Layer styles (drop shadow, glow, stroke, ...) with set values.
+    LayerStyles,
+    /// Marker data read in another form: a cue type of unknown code (read as an event cue).
+    Markers,
+    /// Blend mode codes outside the known ones (906, 907; the layer keeps Normal).
+    BlendModes,
+    /// Stored transform properties other than Anchor Point, Position, Scale, Rotation and Opacity
+    /// (3D rotations, orientation, separated position dimensions).
+    TransformProperties,
+    /// Time remapping that is not imported: a Time Remap property without a readable keyframe.
+    TimeRemapping,
+    /// Keyframe data that was imported in a simplified form (see the detail lines).
+    ApproximatedKeyframes,
+    /// Parent links to a layer that was not imported (or that would form a loop).
+    ParentLinks,
+    /// Track mattes that are not imported: an unknown matte mode, a matte layer that was not
+    /// imported or does not exist, a layer matted by itself.
+    TrackMattes,
+    /// Layers that could not be imported for another reason (unknown layer type, missing or
+    /// unsupported source, precomposition loop).
+    UnsupportedLayers,
+    /// Project items of a kind that is not imported.
+    UnsupportedItems,
+    /// Data that could not be read (damaged headers, unreadable keyframes).
+    DamagedData,
+    /// Project settings without an EffectCraft counterpart (a working space other than None,
+    /// sRGB and Rec. 709) or stored as an unknown code (colour depth, time display, frames per
+    /// foot, frame count start).
+    ProjectSettings,
+}
+
+impl LossCategory {
+    /// A short readable name.
+    pub fn label(self) -> &'static str {
+        match self {
+            LossCategory::Effects => "effects",
+            LossCategory::Masks => "masks",
+            LossCategory::ShapeLayers => "shape layers",
+            LossCategory::TextLayers => "text layer features",
+            LossCategory::LayerStyles => "layer styles",
+            LossCategory::Cameras => "cameras",
+            LossCategory::Lights => "lights",
+            LossCategory::Markers => "markers",
+            LossCategory::BlendModes => "blend modes",
+            LossCategory::TransformProperties => "transform properties",
+            LossCategory::TimeRemapping => "time remapping",
+            LossCategory::ApproximatedKeyframes => "approximated keyframes",
+            LossCategory::ParentLinks => "parent links",
+            LossCategory::TrackMattes => "track mattes",
+            LossCategory::UnsupportedLayers => "unsupported layers",
+            LossCategory::UnsupportedItems => "unsupported items",
+            LossCategory::DamagedData => "damaged data",
+            LossCategory::ProjectSettings => "project settings",
+        }
+    }
+}
+
+/// One category of things that were not imported.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Loss {
+    pub category: LossCategory,
+    /// How many occurrences (exact).
+    pub count: usize,
+    /// Up to [`MAX_DETAILS`] example lines.
+    pub details: Vec<String>,
+}
+
+/// What arrived in the project.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Imported {
+    pub folders: usize,
+    pub compositions: usize,
+    pub solids: usize,
+    /// Footage items (files), present or missing.
+    pub footage: usize,
+    /// All layers.
+    pub layers: usize,
+    pub solid_layers: usize,
+    pub null_layers: usize,
+    pub adjustment_layers: usize,
+    pub footage_layers: usize,
+    pub precomp_layers: usize,
+    /// Text layers (with their Source Text).
+    #[serde(default)]
+    pub text_layers: usize,
+    /// Keyframes on the imported properties.
+    pub keyframes: usize,
+    /// Expressions (kept as source text with their enable switch).
+    pub expressions: usize,
+    /// Layer masks.
+    #[serde(default)]
+    pub masks: usize,
+    /// Track mattes (the layer's matte source and mode).
+    #[serde(default)]
+    pub track_mattes: usize,
+    /// Layer and composition markers.
+    #[serde(default)]
+    pub markers: usize,
+    /// Layers with Time Remapping.
+    #[serde(default)]
+    pub time_remaps: usize,
+    /// Shape layers.
+    #[serde(default)]
+    pub shape_layers: usize,
+    /// Shape contents items (groups, paths, paints, operators).
+    #[serde(default)]
+    pub shape_items: usize,
+    /// Camera layers.
+    #[serde(default)]
+    pub cameras: usize,
+    /// Light layers (spot and point).
+    #[serde(default)]
+    pub lights: usize,
+    /// Text animators (with their range selectors).
+    #[serde(default)]
+    pub text_animators: usize,
+    /// Effect instances (with their parameters; the parameters that could not be imported are
+    /// in [`LossCategory::Effects`]).
+    #[serde(default)]
+    pub effects: usize,
+    /// Layer styles (Drop Shadow, Stroke, ...), one per style on a layer.
+    #[serde(default)]
+    pub layer_styles: usize,
+}
+
+/// The result of reading an `.aep`: counts of what was imported, the losses per category, the
+/// footage files that could not be found and the standing limitations of the reader.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ImportReport {
+    pub imported: Imported,
+    /// Only categories that occurred, in category order.
+    pub losses: Vec<Loss>,
+    /// Footage files whose path does not exist here; the items are kept as missing-footage
+    /// placeholders (relink them with File > Replace Footage / Relink).
+    pub missing_footage: Vec<String>,
+    /// Fonts (PostScript names) that the text uses and that are not installed here. The text keeps
+    /// the name and is drawn with the fallback font until the font is installed; this is not a
+    /// loss.
+    #[serde(default)]
+    pub missing_fonts: Vec<String>,
+    /// What the file reader cannot see at all, so it can be neither imported nor counted.
+    pub limitations: Vec<String>,
+    /// The After Effects version the file is written for and the one that wrote it.
+    #[serde(default)]
+    pub ae_version: AeVersionInfo,
+}
+
+/// The After Effects versions the importer is tested with (the major of the version a file is
+/// written for): files written for 24.x, 25.x and 26.x.
+pub const TESTED_MAJORS: std::ops::RangeInclusive<u8> = 24..=26;
+
+/// The After Effects versions of a file, decoded from the container (never from the XMP packet,
+/// which names the application of the first save).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AeVersionInfo {
+    /// The version the file is written for (`head`): `26.2.1x2` for a file saved by After Effects
+    /// 26.2.1, `25.6.0x97` for a copy that After Effects 2026 saved as 25.x. `unknown` when the file
+    /// does not say.
+    pub file_version: String,
+    /// The version of the After Effects that wrote the file (`svap`): `26.2.1x2` for that copy too.
+    /// `unknown` when the file does not say.
+    pub saved_by: String,
+    /// Whether the importer is tested with files written for this version ([`TESTED_MAJORS`]).
+    /// When not, what is read is still imported, and a line in
+    /// [`ImportReport::limitations`] says the version is not tested.
+    pub tested: bool,
+}
+
+impl Default for AeVersionInfo {
+    fn default() -> Self {
+        Self { file_version: UNKNOWN.to_string(), saved_by: UNKNOWN.to_string(), tested: false }
+    }
+}
+
+/// The text of a version the file does not state.
+pub const UNKNOWN: &str = "unknown";
+
+impl AeVersionInfo {
+    /// Reads the versions of a parsed file.
+    pub fn of(file: &AepFile<'_>) -> Self {
+        let file_version = file.file_version();
+        Self {
+            file_version: file_version.map_or_else(|| UNKNOWN.to_string(), |v| v.text()),
+            saved_by: file.saved_by_version().map_or_else(|| UNKNOWN.to_string(), |v| v.text()),
+            tested: file_version.is_some_and(|v| TESTED_MAJORS.contains(&v.major)),
+        }
+    }
+
+    /// The limitation line for a version that is not tested; `None` for a tested one.
+    pub fn limitation(&self) -> Option<String> {
+        (!self.tested).then(|| {
+            format!(
+                "The file is written for After Effects {} (saved by {}); the importer is tested with files written for After Effects {} to {} only. What it reads is imported, but this version is not tested.",
+                self.file_version,
+                self.saved_by,
+                TESTED_MAJORS.start(),
+                TESTED_MAJORS.end()
+            )
+        })
+    }
+}
+
+impl ImportReport {
+    /// The sum of all loss counts.
+    pub fn total_losses(&self) -> usize {
+        self.losses.iter().map(|l| l.count).sum()
+    }
+
+    /// True when nothing was lost.
+    pub fn is_lossless(&self) -> bool {
+        self.losses.is_empty()
+    }
+
+    /// The loss count of a category.
+    pub fn count(&self, category: LossCategory) -> usize {
+        self.losses.iter().find(|l| l.category == category).map_or(0, |l| l.count)
+    }
+
+    /// `effects: 3, masks: 1` (empty when lossless).
+    pub fn summary(&self) -> String {
+        self.losses.iter().map(|l| format!("{}: {}", l.category.label(), l.count)).collect::<Vec<_>>().join(", ")
+    }
+}
+
+/// Collects losses while importing.
+#[derive(Default)]
+pub(crate) struct Collector {
+    pub imported: Imported,
+    losses: BTreeMap<LossCategory, Loss>,
+    pub missing_footage: Vec<String>,
+    pub missing_fonts: Vec<String>,
+}
+
+impl Collector {
+    /// Records one loss.
+    pub fn lose(&mut self, category: LossCategory, detail: impl Into<String>) {
+        let loss = self.losses.entry(category).or_insert_with(|| Loss { category, count: 0, details: Vec::new() });
+        loss.count = loss.count.saturating_add(1);
+        if loss.details.len() < MAX_DETAILS {
+            loss.details.push(detail.into());
+        }
+    }
+
+    pub fn finish(self) -> ImportReport {
+        ImportReport {
+            imported: self.imported,
+            losses: self.losses.into_values().collect(),
+            missing_footage: self.missing_footage,
+            missing_fonts: self.missing_fonts,
+            limitations: LIMITATIONS.iter().map(|s| (*s).to_string()).collect(),
+            ae_version: AeVersionInfo::default(),
+        }
+    }
+}
+
+/// Parts of a project that the container reader does not decode. They are never imported and, as
+/// the reader cannot see them, never counted either.
+pub const LIMITATIONS: &[&str] = &[
+    "Frame blending, 3D material options, audio levels, guides are not decoded and not imported.",
+    "Mask colour, lock, feather falloff, motion blur and RotoBezier are not decoded: imported masks get the default colour, unlocked, Smooth falloff, motion blur Same As Layer and no RotoBezier.",
+    "Text: per-character 3D, text on a path and several style slots of unknown meaning are not decoded (stored values that differ from the default are reported as text layer features).",
+    "Footage that is not a solid is linked by its stored path with its stored frame rate and duration; the importer never opens the files (use Reload Footage after the files are found).",
+];
diff --git a/crates/aep/src/import/settings.rs b/crates/aep/src/import/settings.rs
new file mode 100644
index 000000000..29d520c39
--- /dev/null
+++ b/crates/aep/src/import/settings.rs
@@ -0,0 +1,99 @@
+//! Project settings (colour depth, working space, working gamma, linear-light switches, time
+//! display, frame count start) from [`crate::ProjectSettings`] (cases 620-634).
+
+use crate::{AepFile, TimeDisplay, WorkingSpace};
+use effectcraft_color::ColorSpace;
+use effectcraft_project::{BitDepth, ProjectSettings, TimeDisplayStyle};
+
+use crate::import::report::{Collector, LossCategory};
+
+/// The working spaces whose After Effects name is sampled (620, 624) and that EffectCraft has.
+pub(crate) fn color_space(name: &str) -> Option<ColorSpace> {
+    match name {
+        "sRGB IEC61966-2.1" => Some(ColorSpace::Srgb),
+        // The second name is the one After Effects shows for the profile EffectCraft's exporter
+        // writes (its description tag) once it re-saves such a project.
+        "Rec.709 Gamma 2.4" | "Rec.709 Gamma 2.4 (EffectCraft)" => Some(ColorSpace::Rec709),
+        _ => None,
+    }
+}
+
+/// `current` with every setting the file stores replaced; a setting the file does not hold (or
+/// holds in an unknown form) keeps the current value. The two linear-light switches are always
+/// held: After Effects writes their chunk only when on (626, 627), so a file without it has them off. A working space EffectCraft does not have is
+/// reported.
+pub(crate) fn map(file: &AepFile<'_>, current: &ProjectSettings, col: &mut Collector) -> ProjectSettings {
+    let s = crate::ProjectSettings::read(file);
+    let nhed = file.chunk(b"nhed").and_then(|c| c.bytes());
+    let mut out = current.clone();
+    match s.bits_per_channel {
+        Some(8) => out.bit_depth = BitDepth::Bpc8,
+        Some(16) => out.bit_depth = BitDepth::Bpc16,
+        Some(32) => out.bit_depth = BitDepth::Bpc32,
+        _ => {
+            // The stored code (`nhed` byte 15) is 0, 1 or 2; another one is not guessed at.
+            if let Some(code) = nhed.and_then(|b| b.get(15).copied()) {
+                col.lose(LossCategory::ProjectSettings, format!("colour depth code {code} (not known; the current depth is kept)"));
+            }
+        }
+    }
+    match &s.working_space {
+        Some(WorkingSpace::None) => out.working_space = None,
+        Some(WorkingSpace::Profile(name)) => match color_space(name) {
+            Some(cs) => {
+                out.working_space = Some(cs);
+                // After Effects renders in the working space (902: an sRGB PNG step 128 is 135 in
+                // a Rec.709 Gamma 2.4 project, a grey 0.5 solid 128, in the Render Queue output
+                // and in the captures), EffectCraft converts to `output_space` (sRGB when unset).
+                // sRGB stays unset, which is the same.
+                out.output_space = (cs != ColorSpace::Srgb).then_some(cs);
+            }
+            None => col.lose(LossCategory::ProjectSettings, format!("working space '{name}' (no EffectCraft counterpart; the current one is kept)")),
+        },
+        None => {}
+    }
+    if let Some(g24) = s.working_gamma_24 {
+        out.working_gamma = if g24 { 2.4 } else { 2.2 };
+    }
+    out.linearize = s.linearize;
+    out.blend_linear = s.blend_linear;
+    match s.time_display {
+        Some(TimeDisplay::Timecode) => out.time_display = TimeDisplayStyle::Timecode,
+        Some(TimeDisplay::Frames) => out.time_display = TimeDisplayStyle::Frames,
+        Some(TimeDisplay::FeetFrames { frames_per_foot: 16 }) => out.time_display = TimeDisplayStyle::Feet35,
+        Some(TimeDisplay::FeetFrames { frames_per_foot: 40 }) => out.time_display = TimeDisplayStyle::Feet16,
+        Some(TimeDisplay::FeetFrames { frames_per_foot }) => {
+            col.lose(
+                LossCategory::ProjectSettings,
+                format!("feet + frames with {frames_per_foot} frames per foot (only 16 and 40 are known; the current time display is kept)"),
+            );
+        }
+        None => {
+            // `nhed` bytes 8, 11 and 13; a header too short to hold them is not a setting.
+            if let Some(&[mode, _, _, feet, ..]) = nhed.and_then(|b| b.get(8..14)) {
+                col.lose(LossCategory::ProjectSettings, format!("time display code {mode}/{feet} (not known; the current time display is kept)"));
+            }
+        }
+    }
+    match s.frame_start {
+        Some(start) => out.frame_start = i64::from(start),
+        None => {
+            if let Some(code) = nhed.and_then(|b| b.get(14).copied()) {
+                col.lose(LossCategory::ProjectSettings, format!("frame count start code {code} (not known; the current start is kept)"));
+            }
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rec709_under_both_names() {
+        assert_eq!(color_space("Rec.709 Gamma 2.4"), Some(ColorSpace::Rec709));
+        assert_eq!(color_space("Rec.709 Gamma 2.4 (EffectCraft)"), Some(ColorSpace::Rec709));
+        assert_eq!(color_space("Rec.709 Gamma 2.4 (other)"), None);
+    }
+}
diff --git a/crates/aep/src/import/shapes.rs b/crates/aep/src/import/shapes.rs
new file mode 100644
index 000000000..345346a6f
--- /dev/null
+++ b/crates/aep/src/import/shapes.rs
@@ -0,0 +1,492 @@
+//! Shape layer contents: groups (nested, with their transform), rectangle, ellipse, polystar and
+//! bezier paths, fill, stroke, gradient fill and stroke, trim paths, round corners, merge paths,
+//! offset paths and repeater, with
+//! keyframes and expressions, into EffectCraft's shape model.
+//!
+//! Every value of a shape item is stored as After Effects shows it (aep-format.md 3.9): sizes,
+//! positions, radii, widths and the group anchor in pixels, the group scale, every opacity, the
+//! trim start and end and the polystar roundness in percent, angles in degrees, colours as ARGB
+//! 0..255, popups 1-based (fill rule 455, trim mode 469, polystar type 331, line cap and join 239).
+//! A property without a record has After Effects' default, read back for every item in 519.
+//! Contents keep the file order, which is also EffectCraft's (the first item is on top, a fill
+//! paints the paths above it in its group).
+//!
+//! Not imported, and reported in [`LossCategory::ShapeLayers`]: items other than the ones above
+//! (wiggle, zig zag, pucker, twist, ...), stroke dashes, taper and wave with set values,
+//! blend modes and composite order of items, shape directions, the colour stops of a gradient
+//! (the default white-to-black arrives; the stops of 480 / 519 have no record), and the material
+//! options of extruded shapes.
+
+use crate::{Layer as AepLayer, PropGroup as AepGroup, PropNode, Property as AepProp, ShapePath as AepPath};
+use effectcraft_keyframe::Gradient;
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{Node, PropGroup};
+
+use crate::import::masks::{import_path_keys, to_path};
+use crate::import::props::{Kind, import_expression, import_keys};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// Deeper groups than this are not imported (and reported).
+const MAX_DEPTH: usize = 32;
+
+struct Cx<'c, 'i> {
+    what: &'c str,
+    tm: &'c TimeMap,
+    ids: &'c mut Ids<'i>,
+    col: &'c mut Collector,
+}
+
+/// Imports the contents of a shape layer into `target` (the layer's `contents` group).
+pub(crate) fn import_shapes(layer: &AepLayer<'_, '_>, what: &str, tm: &TimeMap, ids: &mut Ids<'_>, target: &mut PropGroup, col: &mut Collector) {
+    let Some(PropNode::Group(vectors)) = layer.properties().and_then(|p| p.get("ADBE Root Vectors Group")) else { return };
+    let mut cx = Cx { what, tm, ids, col };
+    let items = contents(&vectors, 0, &mut cx);
+    target.children.extend(items.into_iter().map(Node::Group));
+}
+
+/// The items of a contents group, in file order.
+fn contents(g: &AepGroup<'_, '_>, depth: usize, cx: &mut Cx<'_, '_>) -> Vec<PropGroup> {
+    let mut out = Vec::new();
+    for e in g.entries() {
+        match e.node {
+            PropNode::Group(sub) => {
+                if let Some(mut item) = item(&e.match_name, &sub, depth, cx) {
+                    // The item's eye switch: bit 0 of its group flags (986: a Fill at 0 is not
+                    // drawn, 987: at 1 it is).
+                    if let Some(flags) = sub.flags() {
+                        item.enabled = flags & 1 != 0;
+                    }
+                    out.push(item);
+                }
+            }
+            PropNode::Property(p) => {
+                if stored(&p) {
+                    cx.col.lose(LossCategory::ShapeLayers, format!("{}: shape contents property {} not imported", cx.what, e.match_name));
+                }
+            }
+            PropNode::Other(_) => cx.col.lose(LossCategory::ShapeLayers, format!("{}: shape contents entry {} not imported", cx.what, e.match_name)),
+        }
+    }
+    out
+}
+
+/// Whether a property holds anything: a value record, keys or an expression.
+fn stored(p: &AepProp<'_, '_>) -> bool {
+    p.flags() == Some(1) || p.is_animated() || p.expression().is_some()
+}
+
+fn named(mut g: PropGroup, aep: &AepGroup<'_, '_>) -> PropGroup {
+    if let Some(n) = aep.user_name().filter(|n| !n.is_empty()) {
+        g.name = n;
+    }
+    g
+}
+
+fn item(match_name: &str, g: &AepGroup<'_, '_>, depth: usize, cx: &mut Cx<'_, '_>) -> Option<PropGroup> {
+    let item = match match_name {
+        "ADBE Vector Group" => {
+            if depth >= MAX_DEPTH {
+                cx.col.lose(LossCategory::ShapeLayers, format!("{}: shape groups nested deeper than {MAX_DEPTH} not imported", cx.what));
+                return None;
+            }
+            let children = match g.get("ADBE Vectors Group") {
+                Some(PropNode::Group(c)) => contents(&c, depth + 1, cx),
+                _ => Vec::new(),
+            };
+            let mut grp = build::shape_group(cx.ids, "Group 1", children);
+            if let Some(PropNode::Group(t)) = g.get("ADBE Vector Transform Group")
+                && let Some(tr) = grp.sub_mut("transform")
+            {
+                for (m, id, kind) in [
+                    ("ADBE Vector Anchor", "anchor", Kind::Vec2),
+                    ("ADBE Vector Position", "position", Kind::Vec2),
+                    ("ADBE Vector Scale", "scale", Kind::Vec2),
+                    ("ADBE Vector Skew", "skew", Kind::Number),
+                    ("ADBE Vector Skew Axis", "skewAxis", Kind::Number),
+                    ("ADBE Vector Rotation", "rotation", Kind::Number),
+                    ("ADBE Vector Group Opacity", "opacity", Kind::Number),
+                ] {
+                    set(tr, id, &t, m, kind, cx);
+                }
+                unknown(
+                    &t,
+                    &[
+                        "ADBE Vector Anchor",
+                        "ADBE Vector Position",
+                        "ADBE Vector Scale",
+                        "ADBE Vector Skew",
+                        "ADBE Vector Skew Axis",
+                        "ADBE Vector Rotation",
+                        "ADBE Vector Group Opacity",
+                    ],
+                    "group transform",
+                    cx,
+                );
+            }
+            not_default(g, "ADBE Vector Blend Mode", "group blend mode", cx);
+            if let Some(PropNode::Group(m)) = g.get("ADBE Vector Materials Group")
+                && m.entries().iter().any(|e| matches!(e.node, PropNode::Property(p) if stored(&p)))
+            {
+                cx.col.lose(LossCategory::ShapeLayers, format!("{}: shape group material options not imported", cx.what));
+            }
+            unknown(g, &["ADBE Vectors Group", "ADBE Vector Transform Group", "ADBE Vector Blend Mode", "ADBE Vector Materials Group"], "group", cx);
+            grp
+        }
+        "ADBE Vector Shape - Rect" => {
+            let mut r = build::shape_rect(cx.ids, [100.0, 100.0], [0.0, 0.0], 0.0);
+            set(&mut r, "size", g, "ADBE Vector Rect Size", Kind::Vec2, cx);
+            set(&mut r, "position", g, "ADBE Vector Rect Position", Kind::Vec2, cx);
+            set(&mut r, "roundness", g, "ADBE Vector Rect Roundness", Kind::Number, cx);
+            not_default(g, "ADBE Vector Shape Direction", "shape direction", cx);
+            unknown(g, &["ADBE Vector Rect Size", "ADBE Vector Rect Position", "ADBE Vector Rect Roundness", "ADBE Vector Shape Direction"], "rectangle", cx);
+            r
+        }
+        "ADBE Vector Shape - Ellipse" => {
+            let mut e = build::shape_ellipse(cx.ids, [100.0, 100.0], [0.0, 0.0]);
+            set(&mut e, "size", g, "ADBE Vector Ellipse Size", Kind::Vec2, cx);
+            set(&mut e, "position", g, "ADBE Vector Ellipse Position", Kind::Vec2, cx);
+            not_default(g, "ADBE Vector Shape Direction", "shape direction", cx);
+            unknown(g, &["ADBE Vector Ellipse Size", "ADBE Vector Ellipse Position", "ADBE Vector Shape Direction"], "ellipse", cx);
+            e
+        }
+        "ADBE Vector Shape - Star" => star(g, cx),
+        "ADBE Vector Shape - Group" => path(g, cx)?,
+        "ADBE Vector Graphic - Fill" => {
+            let mut f = build::shape_fill(cx.ids, [1.0, 0.0, 0.0, 1.0]);
+            set(&mut f, "color", g, "ADBE Vector Fill Color", Kind::EffectColor, cx);
+            set(&mut f, "opacity", g, "ADBE Vector Fill Opacity", Kind::Number, cx);
+            set(&mut f, "rule", g, "ADBE Vector Fill Rule", Kind::EffectPopup(2), cx);
+            paint_switches(g, cx);
+            unknown(
+                g,
+                &["ADBE Vector Fill Color", "ADBE Vector Fill Opacity", "ADBE Vector Fill Rule", "ADBE Vector Blend Mode", "ADBE Vector Composite Order"],
+                "fill",
+                cx,
+            );
+            f
+        }
+        "ADBE Vector Graphic - Stroke" => {
+            let mut s = build::shape_stroke(cx.ids, [1.0, 1.0, 1.0, 1.0], 2.0);
+            set(&mut s, "color", g, "ADBE Vector Stroke Color", Kind::EffectColor, cx);
+            stroke_common(&mut s, g, cx);
+            unknown(g, &STROKE_KNOWN, "stroke", cx);
+            s
+        }
+        "ADBE Vector Graphic - G-Fill" | "ADBE Vector Graphic - G-Stroke" => {
+            let fill = match_name == "ADBE Vector Graphic - G-Fill";
+            let mut s = if fill {
+                build::shape_gradient_fill(cx.ids, false, [0.0, 0.0], [100.0, 0.0], Gradient::default())
+            } else {
+                build::shape_gradient_stroke(cx.ids, false, [0.0, 0.0], [100.0, 0.0], Gradient::default(), 2.0)
+            };
+            set(&mut s, "type", g, "ADBE Vector Grad Type", Kind::EffectPopup(2), cx);
+            set(&mut s, "start", g, "ADBE Vector Grad Start Pt", Kind::Vec2, cx);
+            set(&mut s, "end", g, "ADBE Vector Grad End Pt", Kind::Vec2, cx);
+            if fill {
+                set(&mut s, "opacity", g, "ADBE Vector Fill Opacity", Kind::Number, cx);
+                set(&mut s, "rule", g, "ADBE Vector Fill Rule", Kind::EffectPopup(2), cx);
+                paint_switches(g, cx);
+            } else {
+                stroke_common(&mut s, g, cx);
+            }
+            // Highlight length and angle are stored, but only their default 0 is sampled (332).
+            not_zero(g, "ADBE Vector Grad HiLite Length", "gradient highlight length", cx);
+            not_zero(g, "ADBE Vector Grad HiLite Angle", "gradient highlight angle", cx);
+            if g.get("ADBE Vector Grad Colors").is_some() {
+                cx.col.lose(LossCategory::ShapeLayers, format!("{}: the colour stops of a gradient are not decoded, white to black used", cx.what));
+            }
+            let mut known: Vec<&str> = vec![
+                "ADBE Vector Grad Type",
+                "ADBE Vector Grad Start Pt",
+                "ADBE Vector Grad End Pt",
+                "ADBE Vector Grad HiLite Length",
+                "ADBE Vector Grad HiLite Angle",
+                "ADBE Vector Grad Colors",
+            ];
+            known.extend(if fill {
+                &["ADBE Vector Fill Opacity", "ADBE Vector Fill Rule", "ADBE Vector Blend Mode", "ADBE Vector Composite Order"][..]
+            } else {
+                &STROKE_KNOWN[1..]
+            });
+            unknown(g, &known, if fill { "gradient fill" } else { "gradient stroke" }, cx);
+            s
+        }
+        "ADBE Vector Filter - Trim" => {
+            let mut t = build::shape_trim(cx.ids, 0.0, 100.0, 0.0);
+            set(&mut t, "start", g, "ADBE Vector Trim Start", Kind::Number, cx);
+            set(&mut t, "end", g, "ADBE Vector Trim End", Kind::Number, cx);
+            set(&mut t, "offset", g, "ADBE Vector Trim Offset", Kind::Number, cx);
+            set(&mut t, "mode", g, "ADBE Vector Trim Type", Kind::EffectPopup(2), cx);
+            unknown(g, &["ADBE Vector Trim Start", "ADBE Vector Trim End", "ADBE Vector Trim Offset", "ADBE Vector Trim Type"], "trim paths", cx);
+            t
+        }
+        "ADBE Vector Filter - RC" => {
+            let mut r = build::shape_simple_op(cx.ids, "round")?;
+            set(&mut r, "radius", g, "ADBE Vector RoundCorner Radius", Kind::Number, cx);
+            unknown(g, &["ADBE Vector RoundCorner Radius"], "round corners", cx);
+            r
+        }
+        // Merge Paths (707, 708, 731): Mode 1-based over Merge, Add, Subtract, Intersect, Exclude
+        // Intersections, EffectCraft's order.
+        "ADBE Vector Filter - Merge" => {
+            let mut m = build::shape_simple_op(cx.ids, "merge")?;
+            set(&mut m, "mode", g, "ADBE Vector Merge Type", Kind::EffectPopup(5), cx);
+            unknown(g, &["ADBE Vector Merge Type"], "merge paths", cx);
+            m
+        }
+        // Offset Paths (710, 731): Line Join 1-based (Miter, Round, Bevel); without a record Copy
+        // Offset is 1. After Effects offsets copy i (0-based) by Amount x (i + Copy Offset)
+        // (826-828: Copies 3, Copy Offset 1.5 -> 30, 50, 70 px for Amount 20), EffectCraft by
+        // Amount x (i + 1 + copyOffset), so copyOffset = Copy Offset - 1 (the default 1 is 0).
+        "ADBE Vector Filter - Offset" => {
+            let mut o = build::shape_simple_op(cx.ids, "offset")?;
+            if let Some(p) = o.get_mut("copyOffset") {
+                p.value = effectcraft_keyframe::Value::Scalar(1.0);
+            }
+            set(&mut o, "amount", g, "ADBE Vector Offset Amount", Kind::Number, cx);
+            set(&mut o, "join", g, "ADBE Vector Offset Line Join", Kind::EffectPopup(3), cx);
+            set(&mut o, "miter", g, "ADBE Vector Offset Miter Limit", Kind::Number, cx);
+            set(&mut o, "copies", g, "ADBE Vector Offset Copies", Kind::Number, cx);
+            set(&mut o, "copyOffset", g, "ADBE Vector Offset Copy Offset", Kind::Number, cx);
+            if let Some(p) = o.get_mut("copyOffset") {
+                shift_copy_offset(p, cx);
+            }
+            const KNOWN: [&str; 5] = [
+                "ADBE Vector Offset Amount",
+                "ADBE Vector Offset Line Join",
+                "ADBE Vector Offset Miter Limit",
+                "ADBE Vector Offset Copies",
+                "ADBE Vector Offset Copy Offset",
+            ];
+            unknown(g, &KNOWN, "offset paths", cx);
+            o
+        }
+        // Repeater (709, 731): without records 1 copy, offset 0, Composite Below, an identity
+        // transform.
+        "ADBE Vector Filter - Repeater" => {
+            let mut r = build::shape_repeater(cx.ids, 1.0, [0.0, 0.0]);
+            set(&mut r, "copies", g, "ADBE Vector Repeater Copies", Kind::Number, cx);
+            set(&mut r, "offset", g, "ADBE Vector Repeater Offset", Kind::Number, cx);
+            set(&mut r, "composite", g, "ADBE Vector Repeater Order", Kind::EffectPopup(2), cx);
+            if let (Some(PropNode::Group(t)), Some(tr)) = (g.get("ADBE Vector Repeater Transform"), r.sub_mut("transform")) {
+                for (m, id, kind) in [
+                    ("ADBE Vector Repeater Anchor", "anchor", Kind::Vec2),
+                    ("ADBE Vector Repeater Position", "position", Kind::Vec2),
+                    ("ADBE Vector Repeater Scale", "scale", Kind::Vec2),
+                    ("ADBE Vector Repeater Rotation", "rotation", Kind::Number),
+                    ("ADBE Vector Repeater Opacity 1", "startOpacity", Kind::Number),
+                    ("ADBE Vector Repeater Opacity 2", "endOpacity", Kind::Number),
+                ] {
+                    set(tr, id, &t, m, kind, cx);
+                }
+                const KNOWN: [&str; 6] = [
+                    "ADBE Vector Repeater Anchor",
+                    "ADBE Vector Repeater Position",
+                    "ADBE Vector Repeater Scale",
+                    "ADBE Vector Repeater Rotation",
+                    "ADBE Vector Repeater Opacity 1",
+                    "ADBE Vector Repeater Opacity 2",
+                ];
+                unknown(&t, &KNOWN, "repeater transform", cx);
+            }
+            unknown(
+                g,
+                &["ADBE Vector Repeater Copies", "ADBE Vector Repeater Offset", "ADBE Vector Repeater Order", "ADBE Vector Repeater Transform"],
+                "repeater",
+                cx,
+            );
+            r
+        }
+        other => {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{}: shape item {other} not imported", cx.what));
+            return None;
+        }
+    };
+    cx.col.imported.shape_items = cx.col.imported.shape_items.saturating_add(1);
+    Some(named(item, g))
+}
+
+const STROKE_KNOWN: [&str; 11] = [
+    "ADBE Vector Stroke Color",
+    "ADBE Vector Stroke Opacity",
+    "ADBE Vector Stroke Width",
+    "ADBE Vector Stroke Line Cap",
+    "ADBE Vector Stroke Line Join",
+    "ADBE Vector Stroke Miter Limit",
+    "ADBE Vector Stroke Dashes",
+    "ADBE Vector Stroke Taper",
+    "ADBE Vector Stroke Wave",
+    "ADBE Vector Blend Mode",
+    "ADBE Vector Composite Order",
+];
+
+/// Opacity, width, cap, join, miter limit of a stroke or gradient stroke; dashes, taper and wave
+/// are reported when they hold values.
+fn stroke_common(s: &mut PropGroup, g: &AepGroup<'_, '_>, cx: &mut Cx<'_, '_>) {
+    set(s, "opacity", g, "ADBE Vector Stroke Opacity", Kind::Number, cx);
+    set(s, "width", g, "ADBE Vector Stroke Width", Kind::Number, cx);
+    // Butt 1 and round 2 are sampled (239); the third item (projecting cap, bevel join) is not.
+    for (m, id, what) in [("ADBE Vector Stroke Line Cap", "cap", "line cap"), ("ADBE Vector Stroke Line Join", "join", "line join")] {
+        if let Some(PropNode::Property(p)) = g.get(m)
+            && p.static_value().and_then(|v| v.first().copied()).is_some_and(|v| v.round() == 3.0)
+        {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{}: {what} 3 is not sampled, imported as the third item", cx.what));
+        }
+        set(s, id, g, m, Kind::EffectPopup(3), cx);
+    }
+    set(s, "miter", g, "ADBE Vector Stroke Miter Limit", Kind::Number, cx);
+    for (m, what) in [("ADBE Vector Stroke Dashes", "dashes"), ("ADBE Vector Stroke Taper", "taper"), ("ADBE Vector Stroke Wave", "wave")] {
+        if let Some(PropNode::Group(sub)) = g.get(m)
+            && sub.entries().iter().any(|e| !matches!(e.node, PropNode::Property(p) if !stored(&p)))
+        {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{}: stroke {what} not imported", cx.what));
+        }
+    }
+    paint_switches(g, cx);
+}
+
+/// The blend mode and composite order of a fill or stroke (only the defaults, 1, are sampled).
+fn paint_switches(g: &AepGroup<'_, '_>, cx: &mut Cx<'_, '_>) {
+    not_default(g, "ADBE Vector Blend Mode", "paint blend mode", cx);
+    not_default(g, "ADBE Vector Composite Order", "composite order", cx);
+}
+
+fn star(g: &AepGroup<'_, '_>, cx: &mut Cx<'_, '_>) -> PropGroup {
+    // Type 1 star, 2 polygon (331); EffectCraft's polygon has no inner radius and roundness.
+    let polygon = matches!(g.get("ADBE Vector Star Type"), Some(PropNode::Property(p)) if p.static_value().and_then(|v| v.first().copied()).is_some_and(|v| v.round() == 2.0));
+    let mut s = build::shape_star(cx.ids, !polygon, 5.0, [0.0, 0.0], 100.0, 50.0);
+    set(&mut s, "type", g, "ADBE Vector Star Type", Kind::EffectPopup(2), cx);
+    set(&mut s, "points", g, "ADBE Vector Star Points", Kind::Number, cx);
+    set(&mut s, "position", g, "ADBE Vector Star Position", Kind::Vec2, cx);
+    set(&mut s, "rotation", g, "ADBE Vector Star Rotation", Kind::Number, cx);
+    set(&mut s, "outerRadius", g, "ADBE Vector Star Outer Radius", Kind::Number, cx);
+    set(&mut s, "outerRoundness", g, "ADBE Vector Star Outer Roundess", Kind::Number, cx);
+    if !polygon {
+        set(&mut s, "innerRadius", g, "ADBE Vector Star Inner Radius", Kind::Number, cx);
+        set(&mut s, "innerRoundness", g, "ADBE Vector Star Inner Roundess", Kind::Number, cx);
+    }
+    not_default(g, "ADBE Vector Shape Direction", "shape direction", cx);
+    unknown(
+        g,
+        &[
+            "ADBE Vector Star Type",
+            "ADBE Vector Star Points",
+            "ADBE Vector Star Position",
+            "ADBE Vector Star Rotation",
+            "ADBE Vector Star Inner Radius",
+            "ADBE Vector Star Outer Radius",
+            "ADBE Vector Star Inner Roundess",
+            "ADBE Vector Star Outer Roundess",
+            "ADBE Vector Shape Direction",
+        ],
+        "polystar",
+        cx,
+    );
+    s
+}
+
+/// A bezier path (`ADBE Vector Shape - Group`): the path in `om-s/omks/shap`, its box in pixels
+/// relative to the layer origin (240).
+fn path(g: &AepGroup<'_, '_>, cx: &mut Cx<'_, '_>) -> Option<PropGroup> {
+    let Some(PropNode::Other(oms)) = g.get("ADBE Vector Shape") else {
+        cx.col.lose(LossCategory::ShapeLayers, format!("{}: a shape path without a path not imported", cx.what));
+        return None;
+    };
+    let shapes: Vec<Option<AepPath>> =
+        oms.child_list(b"omks").map(|k| k.children().iter().filter(|c| c.is_list(b"shap")).map(AepPath::from_chunk).collect()).unwrap_or_default();
+    let first = match shapes.first() {
+        Some(Some(s)) => to_path(s, (1, 1)),
+        Some(None) => Err("its path is unreadable"),
+        None => Err("it has no path"),
+    };
+    let first = match first {
+        Ok(p) => p,
+        Err(why) => {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{}: a shape path not imported, {why}", cx.what));
+            return None;
+        }
+    };
+    let mut p = build::shape_path(cx.ids, first);
+    if let (Some(node), Some(prop)) = (oms.child_list(b"tdbs").and_then(AepProp::from_chunk), p.get_mut("path")) {
+        if node.is_animated() {
+            import_path_keys(&shapes, &node, cx.what, (1, 1), cx.tm, prop, cx.col);
+        }
+        import_expression(&node, prop, cx.col);
+    }
+    not_default(g, "ADBE Vector Shape Direction", "shape direction", cx);
+    unknown(g, &["ADBE Vector Shape", "ADBE Vector Shape Direction"], "path", cx);
+    Some(p)
+}
+
+/// Sets property `id` of `target` from the stored property `match_name` of `g` (static value or
+/// keys, and the expression); absent means the default, which `target` already holds.
+fn set(target: &mut PropGroup, id: &str, g: &AepGroup<'_, '_>, match_name: &str, kind: Kind, cx: &mut Cx<'_, '_>) {
+    let Some(PropNode::Property(node)) = g.get(match_name) else { return };
+    let Some(prop) = target.get_mut(id) else { return };
+    if node.is_animated() {
+        import_keys(&node, kind, cx.what, match_name, cx.tm, prop, cx.col);
+    } else if let Some(v) = node.static_value() {
+        match kind.value(&v) {
+            Some(value) => prop.value = value,
+            None => cx.col.lose(LossCategory::DamagedData, format!("{}: {match_name} holds a value that is not valid, default used", cx.what)),
+        }
+    }
+    import_expression(&node, prop, cx.col);
+}
+
+/// After Effects' Copy Offset (`i + Copy Offset`, default 1) as EffectCraft's (`i + 1 + copyOffset`,
+/// default 0): the value and every key minus 1. An expression gives After Effects' number, so it is
+/// kept but reported.
+fn shift_copy_offset(p: &mut effectcraft_project::Property, cx: &mut Cx<'_, '_>) {
+    use effectcraft_keyframe::Value;
+    let shift = |v: &mut Value| {
+        if let Value::Scalar(x) = v {
+            *x -= 1.0;
+        }
+    };
+    shift(&mut p.value);
+    for k in &mut p.keys {
+        shift(&mut k.value);
+    }
+    if p.expr.is_some() {
+        cx.col.lose(
+            LossCategory::ShapeLayers,
+            format!("{}: the expression on Offset Paths' Copy Offset gives After Effects' value (EffectCraft's is 1 less), kept unchanged", cx.what),
+        );
+    }
+}
+
+/// Reports a property whose only sampled value is the default 1.
+fn not_default(g: &AepGroup<'_, '_>, match_name: &str, what: &str, cx: &mut Cx<'_, '_>) {
+    if let Some(PropNode::Property(p)) = g.get(match_name)
+        && (p.is_animated() || p.expression().is_some() || p.static_value().and_then(|v| v.first().copied()).is_some_and(|v| v != 1.0))
+    {
+        cx.col.lose(LossCategory::ShapeLayers, format!("{}: {what} not imported", cx.what));
+    }
+}
+
+/// Reports a property whose only sampled value is 0.
+fn not_zero(g: &AepGroup<'_, '_>, match_name: &str, what: &str, cx: &mut Cx<'_, '_>) {
+    if let Some(PropNode::Property(p)) = g.get(match_name)
+        && (p.is_animated() || p.expression().is_some() || p.static_value().and_then(|v| v.first().copied()).is_some_and(|v| v != 0.0))
+    {
+        cx.col.lose(LossCategory::ShapeLayers, format!("{}: {what} not imported", cx.what));
+    }
+}
+
+/// Reports stored entries of `g` that are not in `known`.
+fn unknown(g: &AepGroup<'_, '_>, known: &[&str], what: &str, cx: &mut Cx<'_, '_>) {
+    for e in g.entries() {
+        if known.contains(&e.match_name.as_str()) {
+            continue;
+        }
+        let holds = match e.node {
+            PropNode::Property(p) => stored(&p),
+            PropNode::Group(_) | PropNode::Other(_) => true,
+        };
+        if holds {
+            cx.col.lose(LossCategory::ShapeLayers, format!("{}: {what} entry {} not imported", cx.what, e.match_name));
+        }
+    }
+}
diff --git a/crates/aep/src/import/styles.rs b/crates/aep/src/import/styles.rs
new file mode 100644
index 000000000..51585a0e7
--- /dev/null
+++ b/crates/aep/src/import/styles.rs
@@ -0,0 +1,180 @@
+//! Layer styles (`ADBE Layer Styles`, docs `aep-format.md` 3.14) into EffectCraft's `layerStyles`
+//! group, through the shared table [`crate::style_map`].
+//!
+//! A style is imported when its switch group is applied (`tdsb` 1). Every parameter starts at
+//! After Effects' default (not EffectCraft's: Use Global Light is off there), then the stored
+//! records, keys and expressions are applied. Global Light Angle / Altitude are one setting per
+//! composition in EffectCraft: they land on the layer's Blending Options and the composition
+//! adopts them afterwards ([`effectcraft_project::styles::sync_comp`]). Not imported, reported:
+//! gradients (`GCst`, not decoded), Pattern Overlay, switch groups in the state 3 (not
+//! sampled; state 0 is a style switched off, 988), keys on popups and
+//! checkboxes, and styles on layers that take none here (adjustment layers, cameras, lights).
+
+use crate::style_map::{self as sm, StyleConv, StyleParam};
+use crate::{Layer as AepLayer, PropGroup as AepGroup, PropNode, Property as AepProp};
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::Ids;
+use effectcraft_project::styles::{self as st, GlobalLight, STYLE_BLEND_MODES};
+use effectcraft_project::{Layer, Property as EcProp};
+
+use crate::import::props::{Kind, import_expression, import_keys, sane};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// A stored style value as an EffectCraft value; `None` when it does not fit the conversion.
+pub(crate) fn value(conv: StyleConv, c: &[f64]) -> Option<Value> {
+    let g = |i: usize| c.get(i).copied().filter(|v| v.is_finite());
+    let v = match conv {
+        StyleConv::Number => Value::Scalar(g(0)?),
+        StyleConv::Color => Value::Color([g(1)? / 255.0, g(2)? / 255.0, g(3)? / 255.0, 1.0]),
+        StyleConv::Mode => {
+            let name = sm::mode_name(g(0)?)?;
+            let i = STYLE_BLEND_MODES.iter().position(|m| m.0 == name)?;
+            Value::Enum(u32::try_from(i).ok()?)
+        }
+        StyleConv::Popup(map) => Value::Enum(sm::popup_item(map, g(0)?)?),
+        StyleConv::Checkbox => Value::Bool(g(0)? != 0.0),
+        StyleConv::Vec2 => Value::Vec2([g(0)?, g(1)?]),
+        StyleConv::Gradient => return None,
+    };
+    sane(&v).then_some(v)
+}
+
+/// The key conversion of a style value, `None` where keys are not decoded.
+fn key_kind(conv: StyleConv) -> Option<Kind> {
+    match conv {
+        StyleConv::Number => Some(Kind::Number),
+        StyleConv::Color => Some(Kind::EffectColor),
+        StyleConv::Vec2 => Some(Kind::Vec2),
+        _ => None,
+    }
+}
+
+/// One parameter: the default (After Effects'), then the record if there is one.
+fn import_param(spec: &StyleParam, full: &str, node: Option<PropNode<'_, '_>>, prop: &mut EcProp, tm: &TimeMap, what: &str, col: &mut Collector) {
+    if spec.conv == StyleConv::Gradient {
+        if node.is_some() {
+            col.lose(LossCategory::LayerStyles, format!("{what}: {full} (gradient colours are not decoded, EffectCraft's default gradient kept)"));
+        }
+        return;
+    }
+    if let Some(v) = value(spec.conv, spec.default) {
+        prop.value = v;
+    }
+    let Some(node) = node else { return };
+    let PropNode::Property(p) = node else {
+        col.lose(LossCategory::LayerStyles, format!("{what}: {full} is not a property, default used"));
+        return;
+    };
+    import_record(spec.conv, &p, full, prop, tm, what, col);
+}
+
+fn import_record(conv: StyleConv, p: &AepProp<'_, '_>, full: &str, prop: &mut EcProp, tm: &TimeMap, what: &str, col: &mut Collector) {
+    if p.is_animated() {
+        match key_kind(conv) {
+            Some(kind) => import_keys(p, kind, what, full, tm, prop, col),
+            None => col.lose(LossCategory::LayerStyles, format!("{what}: keys on {full} are not imported (not sampled), default used")),
+        }
+    } else if let Some(stored) = p.static_value() {
+        match value(conv, &stored) {
+            Some(v) => prop.value = v,
+            None => col.lose(LossCategory::LayerStyles, format!("{what}: {full} holds a value that is not valid ({stored:?}), default used")),
+        }
+    }
+    import_expression(p, prop, col);
+}
+
+/// Imports the layer styles of `layer` into `l`. `gl` is the composition's Global Light, mirrored
+/// into the new Blending Options.
+pub(crate) fn import_layer_styles(layer: &AepLayer<'_, '_>, l: &mut Layer, gl: &GlobalLight, ids: &mut Ids<'_>, tm: &TimeMap, what: &str, col: &mut Collector) {
+    let Some(PropNode::Group(ls)) = layer.properties().and_then(|p| p.get(sm::GROUP)) else { return };
+    let entries = ls.entries();
+    let mut applied: Vec<(&'static sm::StyleMap, AepGroup<'_, '_>, bool)> = Vec::new();
+    for e in &entries {
+        let PropNode::Group(g) = e.node else { continue };
+        let Some(prefix) = e.match_name.strip_suffix("/enabled") else { continue };
+        let flags = g.flags();
+        if flags == Some(sm::FLAGS_UNUSED) {
+            continue;
+        }
+        // 1 applied, 0 applied but switched off (988); any other state (3) is not sampled.
+        let on = match flags {
+            Some(sm::FLAGS_ON) => true,
+            Some(sm::FLAGS_OFF) => false,
+            other => {
+                col.lose(LossCategory::LayerStyles, format!("{what}: style {prefix} in state {} (not sampled), not imported", other.unwrap_or(0)));
+                continue;
+            }
+        };
+        match sm::by_ae(prefix) {
+            Some(spec) => applied.push((spec, g, on)),
+            None if prefix == sm::PATTERN_OVERLAY => col.lose(LossCategory::LayerStyles, format!("{what}: Pattern Overlay (no counterpart)")),
+            None => col.lose(LossCategory::LayerStyles, format!("{what}: unknown layer style {prefix}")),
+        }
+    }
+    if applied.is_empty() {
+        // Without a style the Blending Options group holds only an empty Advanced Blending group
+        // (every case); stored values there have nowhere to go.
+        if let Some(PropNode::Group(bo)) = ls.get(sm::BLEND_OPTIONS)
+            && holds_values(&bo, 0)
+        {
+            col.lose(LossCategory::LayerStyles, format!("{what}: Blending Options set without a layer style, not imported"));
+        }
+        return;
+    }
+    if !l.can_have_styles() {
+        col.lose(LossCategory::LayerStyles, format!("{what}: this kind of layer takes no layer styles here ({} not imported)", applied.len()));
+        return;
+    }
+    for (spec, g, on) in &applied {
+        let Some(uid) = st::add_style(l, ids, spec.ec, gl, *on) else {
+            col.lose(LossCategory::LayerStyles, format!("{what}: style {} could not be added", spec.ae));
+            continue;
+        };
+        let Some(group) = l.props.find_group_mut(uid) else { continue };
+        let records = g.entries();
+        for prm in spec.params {
+            let full = spec.param_name(prm);
+            let node = records.iter().find(|r| r.match_name == full).map(|r| r.node);
+            match group.get_mut(prm.ec) {
+                Some(prop) => import_param(prm, &full, node, prop, tm, what, col),
+                None => col.lose(LossCategory::LayerStyles, format!("{what}: {full} has no counterpart '{}'", prm.ec)),
+            }
+        }
+        for r in &records {
+            if r.match_name != "ADBE Group End" && !spec.params.iter().any(|prm| spec.param_name(prm) == r.match_name) {
+                col.lose(LossCategory::LayerStyles, format!("{what}: {} is not imported (unknown parameter)", r.match_name));
+            }
+        }
+        col.imported.layer_styles += 1;
+    }
+    import_blending(&ls, l, tm, what, col);
+}
+
+/// True when `g` or a group below it (to a bounded depth) stores a property.
+fn holds_values(g: &AepGroup<'_, '_>, depth: usize) -> bool {
+    depth < 8
+        && g.entries().iter().any(|e| match e.node {
+            PropNode::Property(_) => true,
+            PropNode::Group(sub) => holds_values(&sub, depth.saturating_add(1)),
+            PropNode::Other(_) => false,
+        })
+}
+
+/// Blending Options: Global Light (adopted by the composition later) and Advanced Blending.
+fn import_blending(ls: &AepGroup<'_, '_>, l: &mut Layer, tm: &TimeMap, what: &str, col: &mut Collector) {
+    let Some(PropNode::Group(bo)) = ls.get(sm::BLEND_OPTIONS) else { return };
+    let Some(target) = l.props.sub_mut(st::GROUP).and_then(|g| g.sub_mut(st::BLENDING)) else { return };
+    for (ae, ec) in [(sm::GLOBAL_ANGLE, "globalLightAngle"), (sm::GLOBAL_ALTITUDE, "globalLightAltitude")] {
+        if let (Some(PropNode::Property(p)), Some(prop)) = (bo.get(ae), target.get_mut(ec)) {
+            import_record(StyleConv::Number, &p, ae, prop, tm, what, col);
+        }
+    }
+    let Some(PropNode::Group(adv)) = bo.get(sm::ADV_BLEND) else { return };
+    let Some(target) = target.sub_mut("advancedBlending") else { return };
+    for prm in sm::ADVANCED_BLENDING {
+        if let Some(prop) = target.get_mut(prm.ec) {
+            import_param(prm, prm.ae, adv.get(prm.ae), prop, tm, what, col);
+        }
+    }
+}
diff --git a/crates/aep/src/import/text.rs b/crates/aep/src/import/text.rs
new file mode 100644
index 000000000..5333efcb0
--- /dev/null
+++ b/crates/aep/src/import/text.rs
@@ -0,0 +1,454 @@
+//! Text layers: the text document (`btdk`) as a Source Text value, and everything of a text layer
+//! that is not imported, reported.
+//!
+//! Mapped: the text (paragraphs separated by `\r`; U+0003, which After Effects lays out exactly
+//! like `\r`, becomes `\r`), per style run the font (its PostScript name,
+//! which EffectCraft resolves like a family name), size, fill and stroke colour, whether fill and
+//! stroke are drawn, the stroke width, tracking, leading (automatic or explicit), faux bold /
+//! italic, all caps / small caps, superscript / subscript, horizontal and vertical scale, baseline
+//! shift, automatic kerning (metrics, optical, none), ligatures, tsume; per paragraph the
+//! justification (also the justified variants), indents, space before / after, direction,
+//! composer and hanging punctuation; stroke over fill (one switch for the whole text in
+//! EffectCraft); box text as a box; vertical right-to-left text. A missing font keeps its name (the
+//! renderer falls back as for any missing font) and is listed in the report.
+
+use crate::{AutoKern, Caps, FontBaseline, Justification, Layer as AepLayer, ParagraphRun, PropGroup, PropNode, StyleRun as AepRun, TextDocument};
+use effectcraft_keyframe::text_doc::{BaselineOption, CharStyle, Composer, Direction, Justify, Kerning, ParaStyle, StyleRun, TextDoc};
+
+use crate::import::report::{Collector, LossCategory};
+
+/// How deep the walk over the text property groups goes.
+const MAX_DEPTH: usize = 32;
+
+/// The longest text kept (characters); longer text is cut and reported.
+pub(crate) const MAX_TEXT_CHARS: usize = 1 << 20;
+
+/// U+0003 (END OF TEXT): After Effects' other paragraph break besides `\r`.
+const ETX: char = '\u{3}';
+
+/// The name of a text layer without a name of its own: its first paragraph, cut as EffectCraft
+/// cuts a following name ([`effectcraft_project::text_layer_name`]), so a following name that
+/// export writes as no name comes back unchanged (#3233). U+0003 ends a paragraph like `\r`.
+pub(crate) fn first_paragraph(raw: &str) -> String {
+    effectcraft_project::text_layer_name(raw.split(ETX).next().unwrap_or_default())
+}
+
+/// The Source Text value of `doc`, with what cannot be mapped reported for the layer `what`.
+pub(crate) fn text_doc(doc: &TextDocument, what: &str, has_font: &dyn Fn(&str) -> bool, col: &mut Collector) -> TextDoc {
+    // The stored text ends with the `\r` of the last paragraph; EffectCraft's text does not.
+    let stored = doc.raw_text.strip_suffix('\r').unwrap_or(&doc.raw_text);
+    // U+0003 is a line break that starts a new paragraph in After Effects (386 against 387: the
+    // same two lines and two paragraphs, and the same paragraph runs as a CR). One character for
+    // one character of the same byte length, so the runs and the length check below stay aligned.
+    let text: String = stored.chars().take(MAX_TEXT_CHARS).map(|c| if c == ETX { '\r' } else { c }).collect();
+    if text.len() < stored.len() {
+        col.lose(LossCategory::DamagedData, format!("{what}: the text is longer than {MAX_TEXT_CHARS} characters and was cut"));
+    }
+    report_control_characters(&text, what, col);
+    let chars = text.chars().count();
+
+    let mut out = TextDoc { text, ..TextDoc::default() };
+    // Character runs, cut to the text (the last stored run also covers the final `\r`).
+    let mut runs = Vec::with_capacity(doc.style_runs.len());
+    let mut at = 0usize;
+    for run in &doc.style_runs {
+        if at >= chars {
+            break;
+        }
+        let len = run.length.min(chars - at);
+        let style = char_style(doc, run, what, has_font, col);
+        runs.push(StyleRun { len, style });
+        at = at.saturating_add(len);
+    }
+    if runs.is_empty()
+        && let Some(first) = doc.style_runs.first()
+    {
+        // Empty text: the first run's style is the style text typed into it gets.
+        runs.push(StyleRun { len: 0, style: char_style(doc, first, what, has_font, col) });
+    }
+    if let Some(last) = runs.last_mut()
+        && at < chars
+    {
+        last.len = last.len.saturating_add(chars - at);
+    }
+    if runs.is_empty() {
+        col.lose(LossCategory::DamagedData, format!("{what}: the text has no readable character style, the default style is used"));
+    } else {
+        out.set_runs(runs);
+    }
+
+    // Paragraph settings, one per stored paragraph.
+    let paras: Vec<ParaStyle> = doc.paragraphs.iter().map(|p| para_style(p, what, col)).collect();
+    if !paras.is_empty() {
+        out.set_paras(paras);
+    }
+    // Stroke over fill is one switch for the whole text in EffectCraft (per run in After Effects).
+    if let Some(first) = doc.style_runs.first() {
+        out.stroke_over_fill = first.stroke_over_fill;
+        if doc.style_runs.iter().any(|r| r.stroke_over_fill != first.stroke_over_fill && r.apply_stroke) {
+            col.lose(LossCategory::TextLayers, format!("{what}: stroke over fill differs between characters, the first character's order is used"));
+        }
+    }
+    if !doc.kerning.is_empty() {
+        col.lose(LossCategory::TextLayers, format!("{what}: manual kerning is not imported"));
+    }
+    match doc.line_orientation {
+        None => {}
+        // Vertical, right to left (575).
+        Some(2) => out.vertical = true,
+        Some(code) => col.lose(LossCategory::TextLayers, format!("{what}: line orientation {code} is not decoded, imported as horizontal")),
+    }
+    report_character_extras(doc, what, col);
+
+    if let Some(b) = doc.text_box {
+        let finite = [b.x, b.y, b.width, b.height].iter().all(|v| v.is_finite() && v.abs() <= crate::import::props::LIMIT);
+        if finite {
+            out.box_pos = [b.x, b.y];
+            out.box_size = Some([b.width.max(1.0), b.height.max(1.0)]);
+        } else {
+            col.lose(LossCategory::DamagedData, format!("{what}: the text box is not valid, imported as point text"));
+        }
+    }
+
+    if doc.incomplete_runs > 0 {
+        col.lose(
+            LossCategory::DamagedData,
+            format!("{what}: {} damaged text style or paragraph runs (their missing values were taken from the run before)", doc.incomplete_runs),
+        );
+    }
+    if !doc.undecoded_style_fields.is_empty() {
+        col.lose(
+            LossCategory::TextLayers,
+            format!("{what}: character style fields not imported (they differ from the default): /{}", doc.undecoded_style_fields.join(" /")),
+        );
+    }
+    if !doc.undecoded_paragraph_fields.is_empty() {
+        col.lose(
+            LossCategory::TextLayers,
+            format!("{what}: paragraph fields not imported (they differ from the default): /{}", doc.undecoded_paragraph_fields.join(" /")),
+        );
+    }
+    out
+}
+
+/// Control characters other than the paragraph break (`\r`, and U+0003, mapped to it before) are
+/// kept but reported: their meaning is not sampled.
+fn report_control_characters(text: &str, what: &str, col: &mut Collector) {
+    let mut seen: Vec<char> = Vec::new();
+    for c in text.chars().filter(|c| c.is_control() && !matches!(c, '\r' | '\n' | '\t')) {
+        if !seen.contains(&c) && seen.len() < 8 {
+            seen.push(c);
+        }
+    }
+    if !seen.is_empty() {
+        let list: Vec<String> = seen.iter().map(|c| format!("U+{:04X}", u32::from(*c))).collect();
+        col.lose(
+            LossCategory::TextLayers,
+            format!("{what}: the text contains control characters whose meaning is not decoded ({}); they are kept as they are", list.join(", ")),
+        );
+    }
+}
+
+fn finite(v: f64, lo: f64, hi: f64) -> Option<f64> {
+    v.is_finite().then(|| v.clamp(lo, hi))
+}
+
+/// `v` within `lo..=hi`: a value outside is clamped, a value that is not a number is replaced by
+/// `default`, and both are reported (a normal file stays inside the limits).
+fn fit(v: f64, (lo, hi): (f64, f64), default: f64, field: &str, what: &str, col: &mut Collector) -> f64 {
+    if !v.is_finite() {
+        col.lose(LossCategory::TextLayers, format!("{what}: {field} is not a number, {default} is used"));
+        return default;
+    }
+    let fitted = v.clamp(lo, hi);
+    if (fitted - v).abs() > 1e-9 {
+        col.lose(LossCategory::TextLayers, format!("{what}: {field} {v} is outside {lo}..{hi}, {fitted} is used"));
+    }
+    fitted
+}
+
+fn rgba(argb: [f64; 4]) -> Option<[f32; 4]> {
+    let [a, r, g, b] = argb;
+    let c = |v: f64| v.is_finite().then(|| v.clamp(0.0, 1.0) as f32);
+    Some([c(r)?, c(g)?, c(b)?, c(a)?])
+}
+
+/// Reports a colour whose channels [`rgba`] clipped to `0..=1` (a normal file stays inside; as in
+/// [`fit`], float noise of 1e-9 is not reported).
+fn clipped(argb: [f64; 4], which: &str, what: &str, col: &mut Collector) {
+    let outside: Vec<String> = argb.iter().filter(|v| !(-1e-9..=1.0 + 1e-9).contains(*v)).map(|v| v.to_string()).collect();
+    if !outside.is_empty() {
+        col.lose(LossCategory::TextLayers, format!("{what}: a {which} colour channel is outside 0..1 ({}), clipped", outside.join(", ")));
+    }
+}
+
+fn char_style(doc: &TextDocument, run: &AepRun, what: &str, has_font: &dyn Fn(&str) -> bool, col: &mut Collector) -> CharStyle {
+    let mut s = CharStyle::default();
+    match doc.font_of(run) {
+        Some(font) => {
+            s.font = font.to_string();
+            if !col.missing_fonts.iter().any(|f| f == font) && !has_font(font) {
+                col.missing_fonts.push(font.to_string());
+            }
+        }
+        None => col.lose(LossCategory::DamagedData, format!("{what}: a style run names no readable font, the default font is used")),
+    }
+    s.style = "Regular".to_string();
+    s.size = fit(run.font_size, (0.1, 10_000.0), s.size, "the font size", what, col);
+    match rgba(run.fill_argb) {
+        Some(c) => {
+            s.fill = c;
+            clipped(run.fill_argb, "fill", what, col);
+        }
+        None => col.lose(LossCategory::DamagedData, format!("{what}: a fill colour is not valid, the default is used")),
+    }
+    if let Some(argb) = run.stroke_argb {
+        match rgba(argb) {
+            Some(c) => {
+                s.stroke = c;
+                clipped(argb, "stroke", what, col);
+            }
+            None => col.lose(LossCategory::DamagedData, format!("{what}: a stroke colour is not valid, the default is used")),
+        }
+    }
+    // Whether fill and stroke are drawn and the stroke width (544-546).
+    s.apply_fill = run.apply_fill;
+    s.apply_stroke = run.apply_stroke;
+    s.stroke_width = fit(run.stroke_width, (0.0, 10_000.0), 0.0, "the stroke width", what, col);
+    s.tracking = fit(run.tracking, (-100_000.0, 100_000.0), 0.0, "the tracking", what, col);
+    // Scales are factors in the file (539, 540) and percent in EffectCraft; tsume is a fraction
+    // (553) and a percentage.
+    s.h_scale = fit(run.horizontal_scale * 100.0, (1.0, 10_000.0), 100.0, "the horizontal scale", what, col);
+    s.v_scale = fit(run.vertical_scale * 100.0, (1.0, 10_000.0), 100.0, "the vertical scale", what, col);
+    s.baseline_shift = fit(run.baseline_shift, (-100_000.0, 100_000.0), 0.0, "the baseline shift", what, col);
+    s.tsume = fit(run.tsume * 100.0, (0.0, 100.0), 0.0, "the tsume", what, col);
+    s.ligatures = run.ligatures;
+    s.kerning = match run.auto_kern {
+        AutoKern::Metrics => Kerning::Metrics,
+        AutoKern::Optical => Kerning::Optical,
+        // No automatic kerning: a manual amount of 0 replaces the metrics (542).
+        AutoKern::None => Kerning::Manual(0.0),
+        AutoKern::Other(code) => {
+            col.lose(LossCategory::TextLayers, format!("{what}: kerning code {code} is not decoded, metrics kerning used"));
+            Kerning::Metrics
+        }
+    };
+    s.leading = if run.auto_leading { None } else { run.leading.and_then(|l| finite(l, 0.0, 100_000.0)) };
+    s.faux_bold = run.faux_bold;
+    s.faux_italic = run.faux_italic;
+    match run.caps {
+        Caps::Normal => {}
+        Caps::All => s.all_caps = true,
+        Caps::Small => s.small_caps = true,
+        Caps::Other(code) => col.lose(LossCategory::TextLayers, format!("{what}: capitalisation code {code} is not decoded, imported as normal")),
+    }
+    // Superscript / subscript (526-528): After Effects' 58.3 % size and 33.3 % shift are
+    // EffectCraft's too.
+    s.baseline = match run.baseline {
+        FontBaseline::Normal => BaselineOption::Normal,
+        FontBaseline::Superscript => BaselineOption::Superscript,
+        FontBaseline::Subscript => BaselineOption::Subscript,
+        FontBaseline::Other(code) => {
+            col.lose(LossCategory::TextLayers, format!("{what}: superscript / subscript code {code} is not decoded, imported as normal"));
+            BaselineOption::Normal
+        }
+    };
+    s
+}
+
+/// The paragraph settings of one stored paragraph.
+fn para_style(p: &ParagraphRun, what: &str, col: &mut Collector) -> ParaStyle {
+    let px = |v: f64| finite(v, -100_000.0, 100_000.0).unwrap_or(0.0);
+    if p.leading_type != 0 {
+        col.lose(LossCategory::TextLayers, format!("{what}: the Japanese leading model is not imported, Roman leading used"));
+    }
+    // Automatic hyphenation (`/9`) is not reported: EffectCraft never hyphenates, so a paragraph
+    // with hyphenation off (556) is laid out as After Effects does.
+    let rtl = p.direction == 1;
+    ParaStyle {
+        justify: justify(p.justification, rtl, what, col),
+        indent_left: px(p.start_indent),
+        indent_right: px(p.end_indent),
+        indent_first: px(p.first_line_indent),
+        space_before: px(p.space_before),
+        space_after: px(p.space_after),
+        direction: match p.direction {
+            0 => Direction::Ltr,
+            1 => Direction::Rtl,
+            code => {
+                col.lose(LossCategory::TextLayers, format!("{what}: paragraph direction {code} is not decoded, left to right used"));
+                Direction::Ltr
+            }
+        },
+        // A new After Effects text uses the single-line composer (`/29` false, 557, 559).
+        composer: if p.every_line_composer { Composer::EveryLine } else { Composer::SingleLine },
+        hanging_punctuation: p.hanging_roman,
+    }
+}
+
+/// Character settings EffectCraft has no field for, reported once per text.
+fn report_character_extras(doc: &TextDocument, what: &str, col: &mut Collector) {
+    let runs = &doc.style_runs;
+    if runs.iter().any(|r| r.no_break) {
+        col.lose(LossCategory::TextLayers, format!("{what}: No Break is not imported"));
+    }
+    if runs.iter().any(|r| r.apply_stroke && r.line_join != 0) {
+        col.lose(LossCategory::TextLayers, format!("{what}: the stroke line join is not imported, miter used"));
+    }
+    // Digit set 1 (Arabic) lays out Latin digits as the default does (571: same bounds of `1234`).
+    if runs.iter().any(|r| r.digit_set > 1 || r.digit_set < 0) {
+        col.lose(LossCategory::TextLayers, format!("{what}: the digit set is not imported"));
+    }
+    // The baseline direction only matters for vertical text.
+    if doc.line_orientation.is_some() {
+        let tcy = runs.iter().any(|r| r.baseline_direction == 3);
+        if tcy || runs.iter().any(|r| r.baseline_direction != 1 && r.baseline_direction != 3) {
+            col.lose(LossCategory::TextLayers, format!("{what}: the baseline direction of vertical text is not imported"));
+        }
+    }
+}
+
+/// The stored justification is relative to the paragraph direction: in a right-to-left paragraph
+/// After Effects lays "left" (0) and "justify, last line left" (3) out flush right and "right"
+/// (1, 4) flush left (read-back test t7: point and box text with all seven codes; 2, 5 and 6 are
+/// the same in both directions). EffectCraft's justification is visual, so the two pairs swap.
+fn justify(j: Justification, rtl: bool, what: &str, col: &mut Collector) -> Justify {
+    match j {
+        Justification::Left if rtl => Justify::Right,
+        Justification::Right if rtl => Justify::Left,
+        Justification::FullLeft if rtl => Justify::JustifyLastRight,
+        Justification::FullRight if rtl => Justify::JustifyLastLeft,
+        Justification::Left => Justify::Left,
+        Justification::Right => Justify::Right,
+        Justification::Center => Justify::Center,
+        Justification::FullLeft => Justify::JustifyLastLeft,
+        Justification::FullRight => Justify::JustifyLastRight,
+        Justification::FullCenter => Justify::JustifyLastCenter,
+        Justification::FullAll => Justify::JustifyAll,
+        Justification::Other(code) => {
+            col.lose(LossCategory::TextLayers, format!("{what}: justification code {code} is not decoded, imported as left"));
+            Justify::Left
+        }
+    }
+}
+
+/// Whether a group holds any stored value (a set, keyed or expression property).
+fn has_stored(g: &PropGroup<'_, '_>, depth: usize) -> bool {
+    if depth > MAX_DEPTH {
+        return true;
+    }
+    g.entries().iter().any(|e| match e.node {
+        PropNode::Group(sub) => has_stored(&sub, depth.saturating_add(1)),
+        PropNode::Property(p) => p.flags() == Some(1) || p.is_animated() || p.expression().is_some(),
+        PropNode::Other(_) => false,
+    })
+}
+
+/// The parts of a text layer besides its first text document that are not imported.
+pub(crate) fn report_text_extras(layer: &AepLayer<'_, '_>, what: &str, col: &mut Collector) {
+    if let Some(st) = layer.source_text_property() {
+        if st.is_animated() || layer.text_document_count() > 1 {
+            col.lose(LossCategory::TextLayers, format!("{what}: Source Text keyframes are not imported (the first text document is)"));
+        }
+        if st.expression().is_some() {
+            col.lose(LossCategory::TextLayers, format!("{what}: the Source Text expression is not imported"));
+        }
+    }
+    let Some(PropNode::Group(text)) = layer.properties().and_then(|p| p.get("ADBE Text Properties")) else { return };
+    for e in text.entries() {
+        let PropNode::Group(g) = e.node else { continue };
+        match e.match_name.as_str() {
+            // Imported by `text_anim::import_animators`.
+            "ADBE Text Animators" => {}
+            "ADBE Text Path Options" if has_stored(&g, 0) => col.lose(LossCategory::TextLayers, format!("{what}: Path Options are not imported")),
+            "ADBE Text More Options" if has_stored(&g, 0) => col.lose(LossCategory::TextLayers, format!("{what}: More Options are not imported")),
+            _ => {}
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn values_outside_their_limits_are_fitted_and_reported() {
+        let mut col = Collector::default();
+        // Inside the limits, and the edge itself: nothing to report.
+        assert_eq!(fit(12.0, (0.1, 10_000.0), 1.0, "the font size", "t", &mut col), 12.0);
+        assert_eq!(fit(100.0, (1.0, 10_000.0), 100.0, "the scale", "t", &mut col), 100.0);
+        assert!(col.finish().is_lossless());
+        // Clamped, and a number that is none.
+        let mut col = Collector::default();
+        assert_eq!(fit(1.0e9, (0.1, 10_000.0), 1.0, "the font size", "t", &mut col), 10_000.0);
+        assert_eq!(fit(f64::NAN, (-5.0, 5.0), 0.0, "the tracking", "t", &mut col), 0.0);
+        let report = col.finish();
+        let details: Vec<_> = report.losses.iter().flat_map(|l| l.details.iter().cloned()).collect();
+        assert_eq!(details.len(), 2, "{details:?}");
+        assert!(details[0].contains("outside") && details[1].contains("not a number"), "{details:?}");
+    }
+
+    #[test]
+    fn colour_channels_outside_0_to_1_are_clipped_and_reported() {
+        // A fill channel of 2.0 used to become 1.0 silently.
+        let mut col = Collector::default();
+        let argb = [1.0, 2.0, 0.5, -0.25];
+        assert_eq!(rgba(argb), Some([1.0, 0.5, 0.0, 1.0]));
+        clipped(argb, "fill", "t", &mut col);
+        let report = col.finish();
+        assert_eq!(report.count(LossCategory::TextLayers), 1, "{:?}", report.losses);
+        let detail = &report.losses[0].details[0];
+        assert!(detail.contains("fill colour") && detail.contains('2') && detail.contains("-0.25"), "{detail}");
+        // Inside the range, and its edges: nothing to report.
+        let mut col = Collector::default();
+        clipped([1.0, 0.0, 0.5, 1.0], "stroke", "t", &mut col);
+        assert!(col.finish().is_lossless());
+        // Not a number: no colour (the caller reports that as damage).
+        assert_eq!(rgba([1.0, f64::NAN, 0.0, 0.0]), None);
+    }
+
+    /// A document with one style run, `run`, over the text "A".
+    fn doc_with(run: AepRun) -> TextDocument {
+        TextDocument {
+            text: "A".into(),
+            raw_text: "A\r".into(),
+            font_size: run.font_size,
+            fill_argb: run.fill_argb,
+            font_index: 0,
+            font: Some("F".into()),
+            fonts: vec!["F".into()],
+            paragraphs: Vec::new(),
+            style_runs: vec![AepRun { length: 2, ..run }],
+            text_box: None,
+            incomplete_runs: 0,
+            undecoded_style_fields: Vec::new(),
+            undecoded_paragraph_fields: Vec::new(),
+            kerning: Vec::new(),
+            line_orientation: None,
+        }
+    }
+
+    #[test]
+    fn a_text_layer_reports_its_clipped_fill_and_stroke() {
+        let any_font = |_: &str| true;
+        // The sampled run imports without a text loss.
+        let mut col = Collector::default();
+        text_doc(&doc_with(AepRun::SAMPLED), "t", &any_font, &mut col);
+        assert_eq!(col.finish().count(LossCategory::TextLayers), 0);
+        // A fill red of 2.0 and a stroke blue of -1: imported as 1 and 0, both reported.
+        let mut col = Collector::default();
+        let run = AepRun { fill_argb: [1.0, 2.0, 0.0, 0.0], stroke_argb: Some([1.0, 0.0, 0.0, -1.0]), ..AepRun::SAMPLED };
+        let doc = text_doc(&doc_with(run), "t", &any_font, &mut col);
+        let report = col.finish();
+        let details: Vec<_> = report.losses.iter().flat_map(|l| l.details.iter().cloned()).collect();
+        assert!(details.iter().any(|d| d.contains("fill colour channel")), "{details:?}");
+        assert!(details.iter().any(|d| d.contains("stroke colour channel")), "{details:?}");
+        // One run: its style is the document's own.
+        assert!(doc.runs.is_empty());
+        assert_eq!((doc.fill[0], doc.stroke[2]), (1.0, 0.0));
+        // A stroke that is not a number is damage, as the fill already was.
+        let mut col = Collector::default();
+        text_doc(&doc_with(AepRun { stroke_argb: Some([1.0, f64::NAN, 0.0, 0.0]), ..AepRun::SAMPLED }), "t", &any_font, &mut col);
+        assert!(col.finish().count(LossCategory::DamagedData) == 1);
+    }
+}
diff --git a/crates/aep/src/import/text_anim.rs b/crates/aep/src/import/text_anim.rs
new file mode 100644
index 000000000..d7a8c513c
--- /dev/null
+++ b/crates/aep/src/import/text_anim.rs
@@ -0,0 +1,202 @@
+//! Text animators: the animator properties and range selectors of a text layer, into
+//! EffectCraft's animators (`text/animators`).
+//!
+//! Every value is stored as After Effects shows it (579-593): positions, anchor points, stroke
+//! widths and line spacing in pixels, scales, opacity, Start / End / Offset, Amount, Smoothness and
+//! the eases in percent, angles in degrees, tracking in 1/1000 em, colours as ARGB 0..255, popups
+//! 1-based (Units 583, Based On 584, Mode 585, Shape 587, in EffectCraft's item order). A property
+//! without a record has After Effects' default. With Units = Index (583) the selector's
+//! `Index Start / End / Offset` hold the range in characters; EffectCraft's Start / End / Offset are
+//! characters then too.
+//!
+//! Not imported, and reported in [`LossCategory::TextLayers`]: wiggly and expression selectors,
+//! animator properties other than the ones mapped below (Character Value, Fill / Stroke
+//! Hue, Saturation, Brightness and Opacity, 3D rotations, variable font axes, ...), and a Tracking
+//! Type other than the default.
+
+use crate::{PropGroup as AepGroup, PropNode, Property as AepProp};
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{Node, PropGroup, Property};
+
+use crate::import::props::{Kind, import_expression, import_keys};
+use crate::import::report::{Collector, LossCategory};
+use crate::import::time::TimeMap;
+
+/// More animators or selectors than this on one layer are not imported (and reported).
+const MAX_ITEMS: usize = 1024;
+
+/// The animator properties: stored match name, EffectCraft property kind (the `Animate` entry
+/// that creates it), property id, value conversion.
+const PROPS: &[(&str, &str, &str, Kind)] = &[
+    ("ADBE Text Anchor Point 3D", "anchor", "anchor", Kind::Position),
+    ("ADBE Text Position 3D", "position", "position", Kind::Position),
+    ("ADBE Text Scale 3D", "scale", "scale", Kind::Vec3Percent),
+    ("ADBE Text Skew", "skew", "skew", Kind::Number),
+    ("ADBE Text Skew Axis", "skew", "skewAxis", Kind::Number),
+    ("ADBE Text Rotation", "rotation", "rotation", Kind::Rotation),
+    ("ADBE Text Opacity", "opacity", "opacity", Kind::Number),
+    ("ADBE Text Fill Color", "fillColor", "fillColor", Kind::EffectColor),
+    ("ADBE Text Stroke Color", "strokeColor", "strokeColor", Kind::EffectColor),
+    ("ADBE Text Stroke Width", "strokeWidth", "strokeWidth", Kind::Number),
+    ("ADBE Text Tracking Amount", "tracking", "tracking", Kind::Number),
+    ("ADBE Text Line Spacing", "lineSpacing", "lineSpacing", Kind::Vec2),
+    ("ADBE Text Blur", "blur", "blur", Kind::Vec2),
+    // Character Offset (728): After Effects adds Character Range and Character Alignment with it.
+    ("ADBE Text Character Offset", "characterOffset", "characterOffset", Kind::Number),
+    ("ADBE Text Character Range", "characterOffset", "characterRange", Kind::EffectPopup(2)),
+];
+
+/// Range selector properties: stored match name, property id, conversion. `Index …` replace the
+/// percentages when Units is Index.
+const RANGE: &[(&str, &str, Kind)] =
+    &[("ADBE Text Percent Start", "start", Kind::Number), ("ADBE Text Percent End", "end", Kind::Number), ("ADBE Text Percent Offset", "offset", Kind::Number)];
+const RANGE_INDEX: &[(&str, &str, Kind)] =
+    &[("ADBE Text Index Start", "start", Kind::Number), ("ADBE Text Index End", "end", Kind::Number), ("ADBE Text Index Offset", "offset", Kind::Number)];
+const ADVANCED: &[(&str, &str, Kind)] = &[
+    ("ADBE Text Range Units", "units", Kind::EffectPopup(2)),
+    ("ADBE Text Range Type2", "basedOn", Kind::EffectPopup(4)),
+    ("ADBE Text Selector Mode", "mode", Kind::EffectPopup(6)),
+    ("ADBE Text Selector Max Amount", "amount", Kind::Number),
+    ("ADBE Text Range Shape", "shape", Kind::EffectPopup(6)),
+    ("ADBE Text Selector Smoothness", "smoothness", Kind::Number),
+    ("ADBE Text Levels Max Ease", "easeHigh", Kind::Number),
+    ("ADBE Text Levels Min Ease", "easeLow", Kind::Number),
+    ("ADBE Text Randomize Order", "randomize", Kind::EffectBool),
+    ("ADBE Text Random Seed", "randomSeed", Kind::Number),
+];
+
+struct Cx<'c, 'i> {
+    what: &'c str,
+    tm: &'c TimeMap,
+    ids: &'c mut Ids<'i>,
+    col: &'c mut Collector,
+}
+
+/// Imports the animators of `text` (the layer's `ADBE Text Animators` group) into `target` (its
+/// `text/animators` group).
+pub(crate) fn import_animators(animators: &AepGroup<'_, '_>, what: &str, tm: &TimeMap, ids: &mut Ids<'_>, target: &mut PropGroup, col: &mut Collector) {
+    let mut cx = Cx { what, tm, ids, col };
+    for (i, e) in animators.entries().iter().enumerate() {
+        if i >= MAX_ITEMS {
+            cx.col.lose(LossCategory::TextLayers, format!("{what}: more than {MAX_ITEMS} text animators, the rest not imported"));
+            break;
+        }
+        match e.node {
+            PropNode::Group(g) if e.match_name == "ADBE Text Animator" => {
+                if let Some(a) = animator(&g, i, &mut cx) {
+                    target.children.push(Node::Group(a));
+                    cx.col.imported.text_animators = cx.col.imported.text_animators.saturating_add(1);
+                }
+            }
+            _ => cx.col.lose(LossCategory::TextLayers, format!("{what}: text animator entry {} not imported", e.match_name)),
+        }
+    }
+}
+
+fn animator(g: &AepGroup<'_, '_>, index: usize, cx: &mut Cx<'_, '_>) -> Option<PropGroup> {
+    let name = g.user_name().filter(|n| !n.is_empty()).unwrap_or_else(|| format!("Animator {}", index.saturating_add(1)));
+    let here = format!("{}: animator '{name}'", cx.what);
+    // The properties, created in the order of their `Animate` entries.
+    let mut kinds: Vec<&str> = Vec::new();
+    let aep_props = match g.get("ADBE Text Animator Properties") {
+        Some(PropNode::Group(p)) => Some(p),
+        _ => None,
+    };
+    if let Some(p) = &aep_props {
+        for e in p.entries() {
+            match PROPS.iter().find(|(m, ..)| *m == e.match_name) {
+                Some((_, kind, ..)) if !kinds.contains(kind) => kinds.push(kind),
+                Some(_) => {}
+                None if e.match_name == "ADBE Text Track Type" || e.match_name == "ADBE Text Character Change Type" => {}
+                None => cx.col.lose(LossCategory::TextLayers, format!("{here}: property {} not imported", e.match_name)),
+            }
+        }
+    }
+    let props: Vec<Property> = kinds.iter().flat_map(|k| build::text_anim_props(cx.ids, k, false)).collect();
+    let mut a = build::text_animator(cx.ids, &name, props);
+    if let (Some(p), Some(target)) = (&aep_props, a.sub_mut("properties")) {
+        for (m, _, id, kind) in PROPS {
+            set(target, id, p, m, *kind, &here, cx);
+        }
+        // Tracking Type: only the default (Before & After, 1) is sampled.
+        if let Some(PropNode::Property(t)) = p.get("ADBE Text Track Type")
+            && (t.is_animated() || t.static_value().and_then(|v| v.first().copied()).is_some_and(|v| v != 1.0))
+        {
+            cx.col.lose(LossCategory::TextLayers, format!("{here}: Tracking Type is not imported, Before & After used"));
+        }
+        // Character Alignment: only the value After Effects adds with Character Offset (1, 728) is
+        // sampled; it stays EffectCraft's default.
+        if let Some(PropNode::Property(t)) = p.get("ADBE Text Character Change Type")
+            && (t.is_animated() || t.static_value().and_then(|v| v.first().copied()).is_some_and(|v| v != 1.0))
+        {
+            cx.col.lose(LossCategory::TextLayers, format!("{here}: Character Alignment is not imported, the default used"));
+        }
+    }
+    // The selectors replace the default one.
+    if let Some(sels) = a.sub_mut("selectors") {
+        sels.children.clear();
+        if let Some(PropNode::Group(s)) = g.get("ADBE Text Selectors") {
+            for (i, e) in s.entries().iter().enumerate() {
+                if i >= MAX_ITEMS {
+                    cx.col.lose(LossCategory::TextLayers, format!("{here}: more than {MAX_ITEMS} selectors, the rest not imported"));
+                    break;
+                }
+                match e.node {
+                    PropNode::Group(sg) if e.match_name == "ADBE Text Selector" => {
+                        let r = range_selector(&sg, i, &here, cx);
+                        sels.children.push(Node::Group(r));
+                    }
+                    _ => cx.col.lose(LossCategory::TextLayers, format!("{here}: selector {} not imported", e.match_name)),
+                }
+            }
+        }
+    }
+    Some(a)
+}
+
+fn range_selector(g: &AepGroup<'_, '_>, index: usize, animator: &str, cx: &mut Cx<'_, '_>) -> PropGroup {
+    let name = g.user_name().filter(|n| !n.is_empty()).unwrap_or_else(|| format!("Range Selector {}", index.saturating_add(1)));
+    let here = format!("{animator} '{name}'");
+    let mut r = build::range_selector(cx.ids, &name);
+    let adv = match g.get("ADBE Text Range Advanced") {
+        Some(PropNode::Group(a)) => Some(a),
+        _ => None,
+    };
+    let index_units = adv
+        .as_ref()
+        .and_then(|a| match a.get("ADBE Text Range Units") {
+            Some(PropNode::Property(p)) => p.static_value(),
+            _ => None,
+        })
+        .and_then(|v| v.first().copied())
+        == Some(2.0);
+    for (m, id, kind) in if index_units { RANGE_INDEX } else { RANGE } {
+        set(&mut r, id, g, m, *kind, &here, cx);
+    }
+    if let (Some(a), Some(target)) = (&adv, r.sub_mut("advanced")) {
+        for (m, id, kind) in ADVANCED {
+            set(target, id, a, m, *kind, &here, cx);
+        }
+    }
+    r
+}
+
+/// Sets property `id` of `target` from the stored property `match_name` of `g`: its keys, or its
+/// static value, and its expression.
+fn set(target: &mut PropGroup, id: &str, g: &AepGroup<'_, '_>, match_name: &str, kind: Kind, here: &str, cx: &mut Cx<'_, '_>) {
+    let Some(PropNode::Property(node)) = g.get(match_name) else { return };
+    let Some(prop) = target.get_mut(id) else { return };
+    set_prop(&node, prop, kind, match_name, here, cx);
+}
+
+fn set_prop(node: &AepProp<'_, '_>, prop: &mut Property, kind: Kind, match_name: &str, here: &str, cx: &mut Cx<'_, '_>) {
+    if node.is_animated() {
+        import_keys(node, kind, here, match_name, cx.tm, prop, cx.col);
+    } else if let Some(v) = node.static_value() {
+        match kind.value(&v) {
+            Some(value) => prop.value = value,
+            None => cx.col.lose(LossCategory::DamagedData, format!("{here}: {match_name} holds a value that is not valid, default used")),
+        }
+    }
+    import_expression(node, prop, cx.col);
+}
diff --git a/crates/aep/src/import/time.rs b/crates/aep/src/import/time.rs
new file mode 100644
index 000000000..936d5efcb
--- /dev/null
+++ b/crates/aep/src/import/time.rs
@@ -0,0 +1,112 @@
+//! Exact conversion of composition time (units of the file's time scale, or rational seconds) to
+//! [`Tick`]s.
+//!
+//! A time that falls on a frame of the composition becomes `FrameRate::tick_of(frame)`, so frames
+//! stay frames at every rate (29.97 fps is `23976 / 800` in the file and `30000 / 1001` in the
+//! project). Any other time is rounded to the nearest tick.
+
+use effectcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
+
+/// The composition's frame structure: the stored time base and the rate the project gets.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct TimeMap {
+    /// The stored time scale (units per second).
+    pub timescale: u32,
+    /// The stored frame duration in units.
+    pub frame_duration: u32,
+    /// The project's frame rate.
+    pub rate: FrameRate,
+}
+
+/// The project frame rate for a stored time base. The NTSC rates are stored as typed
+/// (`29.97` is `23976 / 800`, `23.976` is `23976 / 1000`) and become the exact NTSC rates; every
+/// other rate stays exactly the stored fraction.
+pub(crate) fn frame_rate(timescale: u32, frame_duration: u32) -> Option<FrameRate> {
+    if timescale == 0 || frame_duration == 0 {
+        return None;
+    }
+    let exact = FrameRate::new(i64::from(timescale), i64::from(frame_duration));
+    let fps = exact.as_f64();
+    for ntsc in [FrameRate::FPS_23_976, FrameRate::FPS_29_97, FrameRate::FPS_59_94, FrameRate::FPS_119_88] {
+        if (ntsc.as_f64() - fps).abs() < 0.0005 {
+            return Some(ntsc);
+        }
+    }
+    Some(exact)
+}
+
+impl TimeMap {
+    /// Seconds `num / den` as a tick (zero for a zero denominator).
+    pub fn ticks(&self, num: i64, den: i64) -> Tick {
+        if den == 0 {
+            return Tick::ZERO;
+        }
+        let (num, den) = (i128::from(num), i128::from(den));
+        // Whole frames of the stored time base: num/den s * timescale / frame_duration.
+        let scaled = num.saturating_mul(i128::from(self.timescale));
+        let per_frame = den.saturating_mul(i128::from(self.frame_duration));
+        if per_frame != 0 && scaled % per_frame == 0 {
+            let frames = scaled / per_frame;
+            if let Ok(frames) = i64::try_from(frames) {
+                return clamp(self.rate.tick_of(frames).0.into());
+            }
+        }
+        let n = num.saturating_mul(i128::from(TICKS_PER_SECOND));
+        // Round half up on the signed value.
+        let twice = n.saturating_mul(2).saturating_add(den);
+        clamp(twice.div_euclid(den.saturating_mul(2)))
+    }
+
+    /// `units` of `scale` units per second.
+    pub fn units(&self, units: i64, scale: u32) -> Tick {
+        self.ticks(units, i64::from(scale))
+    }
+}
+
+fn clamp(v: i128) -> Tick {
+    Tick(i64::try_from(v).unwrap_or(if v < 0 { i64::MIN } else { i64::MAX }).clamp(Tick::MIN.0, Tick::MAX.0))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn map(timescale: u32, frame_duration: u32) -> TimeMap {
+        TimeMap { timescale, frame_duration, rate: frame_rate(timescale, frame_duration).unwrap() }
+    }
+
+    #[test]
+    fn ntsc_rates_are_exact() {
+        assert_eq!(frame_rate(23976, 800), Some(FrameRate::FPS_29_97));
+        assert_eq!(frame_rate(23976, 1000), Some(FrameRate::FPS_23_976));
+        assert_eq!(frame_rate(25600, 1024), Some(FrameRate::new(25, 1)));
+        assert_eq!(frame_rate(30720, 1024), Some(FrameRate::new(30, 1)));
+        assert_eq!(frame_rate(0, 1), None);
+        assert_eq!(frame_rate(1, 0), None);
+    }
+
+    #[test]
+    fn frames_stay_frames() {
+        let m = map(23976, 800);
+        // 150 frames at 29.97 fps = 120000 units.
+        assert_eq!(m.units(120_000, 23976), FrameRate::FPS_29_97.tick_of(150));
+        assert_eq!(FrameRate::FPS_29_97.frame_at(m.units(120_000, 23976)), 150);
+        // The same time as a reduced rational.
+        assert_eq!(m.ticks(1001, 200), FrameRate::FPS_29_97.tick_of(150));
+        let m25 = map(25600, 1024);
+        assert_eq!(m25.units(25_600, 25_600), Tick(TICKS_PER_SECOND));
+        assert_eq!(m25.ticks(1, 2), Tick(TICKS_PER_SECOND / 2));
+    }
+
+    #[test]
+    fn off_frame_times_round_and_hostile_values_do_not_panic() {
+        let m = map(25600, 1024);
+        assert_eq!(m.ticks(1, 3).0, (TICKS_PER_SECOND as f64 / 3.0).round() as i64);
+        assert_eq!(m.ticks(5, 0), Tick::ZERO);
+        let _ = m.ticks(i64::MAX, 1);
+        let _ = m.ticks(i64::MIN, 1);
+        let _ = m.ticks(i64::MIN, i64::MAX);
+        let _ = m.units(i64::MAX, u32::MAX);
+        assert!(m.ticks(i64::MAX, 1) <= Tick::MAX);
+    }
+}
diff --git a/crates/aep/src/lib.rs b/crates/aep/src/lib.rs
new file mode 100644
index 000000000..4bcdbab9e
--- /dev/null
+++ b/crates/aep/src/lib.rs
@@ -0,0 +1,27 @@
+//! After Effects projects: the `.aep` / `.aepx` container, import into an EffectCraft project and
+//! export back to `.aep`, in one crate (like `effectcraft-lottie`).
+//!
+//! - [`container`]: the RIFX `Egg!` chunk tree (lossless, byte-identical round trip) and its typed,
+//!   read-only view. Its API is re-exported at the crate root.
+//! - [`import`]: maps the typed view into an EffectCraft project and reports what it drops.
+//! - [`export`]: writes an EffectCraft project as an `.aep`, every chunk built in code.
+//!
+//! See `docs/aep-format.md`, `docs/aep-import.md` and `docs/aep-export.md`.
+
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+pub mod container;
+pub mod export;
+pub mod import;
+
+pub use container::{
+    AeVersion, AepError, AepFile, AutoKern, BlendMode, Body, CURVE_IDENTITY, CameraPosition, Caps, Chunk, Comp, CompHeader, CryptomatteData, CueType,
+    CurvesData, DEFAULT_CAMERA_ZOOM, DefinitionSource, Effect, EffectDefinitions, EffectParam, ExpressionFlags, ExtractorChannels, FontBaseline, Footage,
+    GradientType, HueSaturationData, Interpolation, Item, ItemKind, Justification, KernRun, KeyEase, KeyLayout, KeyList, Keyframe, KeyframeKind, LIST, Layer,
+    LayerHeader, LayerRef, LayerType, LevelsData, LightType, Limits, ListHeader, Marker, Mask, MaskAtom, MaskMode, MatteMode, MeshData, NESTED_IDS,
+    Orientation, OrientationKey, ParagraphRun, ParamKind, ParamValue, PathVertex, PolystarType, Project, ProjectSettings, PropEntry, PropGroup, PropNode,
+    Property, Quality, Rational, Renderer, SequenceInfo, ShapeDetail, ShapeGroup, ShapeItem, ShapePath, SpatialKey, Stroke, StrokeCap, StrokeJoin, StyleRun,
+    TextBox, TextDocument, TextValue, TimeBase, TimeDisplay, TimeRemap, TimeRemapKey, TrackMatte, Tracked, Transform, ValueSource, Walk, WorkingSpace,
+    curve_lut, effect_map, identifier_channel_type, is_aepx, parse, parse_any, parse_text_dict, parse_with_limits, read_aepx, read_aepx_with_limits, style_map,
+    write, write_to,
+};
diff --git a/crates/aep/tests/fixtures/CASES.md b/crates/aep/tests/fixtures/CASES.md
new file mode 100644
index 000000000..b9df1942f
--- /dev/null
+++ b/crates/aep/tests/fixtures/CASES.md
@@ -0,0 +1,390 @@
+# The test cases and the files that hold them
+
+The tests of `effectcraft-aep` (and the After Effects import tests of `effectcraft-engine`) address
+a case by the name of the single-case file it was first written against. The cases live in the
+combined projects of the corpus (in the folder named by `EFFECTCRAFT_AEP_FIXTURES`): each case is the composition named like the case without its
+extension, built like the single-case file's composition `C` (1920x1080, 25 fps, 5 s, black, one
+red 1920x1080 solid `L`) plus the case's change (and the compositions that change uses). A test
+gets the case as a project of its own, cut from the combined file (`tests/it/common/mod.rs`).
+`empty.aep` and `fx-switch.aep` (the fx switch of an effect instance) are files of their own.
+
+Project settings have one value per project, so the settings cases share the files `settings-*`
+(each file holds the changes of all its cases). The generator and how to run it:
+[`tools/README.md`](tools/README.md). Every file has an `.attribution` sidecar in the corpus.
+
+| case | file | composition | change |
+|---|---|---|---|
+| `000-base.aep` | `layers-comps.aep` | `000-base` | base state |
+| `000-base.aepx` | `aepx-pair.aepx` | `000-base` | base state |
+| `001-empty.aep` | `empty.aep` | (whole file) | an empty project saved by After Effects (no items) |
+| `010-layer-name.aep` | `layers-comps.aep` | `010-layer-name` | layer name `L` -> `Renamed` (layer.name; source footage name stays `L`) |
+| `012-layer-shy.aep` | `layers-comps.aep` | `012-layer-shy` | layer.shy false -> true |
+| `013-layer-locked.aep` | `layers-comps.aep` | `013-layer-locked` | layer.locked false -> true |
+| `014-layer-solo.aep` | `layers-comps.aep` | `014-layer-solo` | layer.solo false -> true |
+| `015-layer-3d.aep` | `3d.aep` | `015-layer-3d` | layer.threeDLayer false -> true (3D layer switch; adds Orientation/X/Y/Z Rotation, Material Options groups) |
+| `016-layer-blend-multiply.aep` | `layers-comps.aep` | `016-layer-blend-multiply` | blending mode Normal -> Multiply |
+| `017-layer-motionblur.aep` | `layers-comps.aep` | `017-layer-motionblur` | layer.motionBlur false -> true |
+| `018-layer-stretch200.aep` | `keyframes.aep` | `018-layer-stretch200` | time stretch 100 -> 200 (out point becomes 10 s; comp is 5 s) |
+| `019-layer-inpoint1.aep` | `layers-comps.aep` | `019-layer-inpoint1` | inPoint 0 -> 1 (AE moved outPoint to 6, startTime stays 0; solid source is unbounded) |
+| `021-layer-starttime0.5.aep` | `layers-comps.aep` | `021-layer-starttime0.5` | startTime 0 -> 0.5 (in 0.5, out 5.5) |
+| `022-layer-parent-null.aep` | `layers-comps.aep` | `022-layer-parent-null` | NEW null layer "Null" (source "Null 1", 100x100) created on top; L (now index 2) parent = layer 1 (Null). Adds 1 layer + 1 footage item |
+| `023-layer-quality-draft.aep` | `layers-comps.aep` | `023-layer-quality-draft` | layer.quality Best -> Draft |
+| `024-layer-collapse.aep` | `layers-comps.aep` | `024-layer-collapse` | layer.collapseTransformation false -> true (API call accepted; AE may ignore it for a solid, compare with base) |
+| `025-layer-adjustment.aep` | `layers-comps.aep` | `025-layer-adjustment` | layer.adjustmentLayer false -> true |
+| `026-layer-guide.aep` | `layers-comps.aep` | `026-layer-guide` | layer.guideLayer false -> true |
+| `030-comp-size-1280x720.aep` | `layers-comps.aep` | `030-comp-size-1280x720` | comp width/height 1920x1080 -> 1280x720 (layer L stays 1920x1080, not repositioned) |
+| `031-comp-fps30.aep` | `layers-comps.aep` | `031-comp-fps30` | frameRate 25 -> 30 |
+| `032-comp-duration10.aep` | `layers-comps.aep` | `032-comp-duration10` | duration 5 -> 10 s (work area duration also becomes 10) |
+| `033-comp-bg-green.aep` | `layers-comps.aep` | `033-comp-bg-green` | bgColor [0,0,0] -> [0,1,0] |
+| `034-comp-shutter90.aep` | `layers-comps.aep` | `034-comp-shutter90` | shutterAngle 180 -> 90 |
+| `035-comp-workarea-1-2.aep` | `layers-comps.aep` | `035-comp-workarea-1-2` | workAreaStart 0 -> 1, workAreaDuration 5 -> 2 |
+| `037-comp-pixelaspect2.aep` | `layers-comps.aep` | `037-comp-pixelaspect2` | pixelAspect 1 -> 2 |
+| `038-comp-motionblur.aep` | `layers-comps.aep` | `038-comp-motionblur` | comp.motionBlur false -> true |
+| `039-comp-renderer-advanced3d.aep` | `3d.aep` | `039-comp-renderer-advanced3d` | renderer `ADBE Advanced 3d` (classic) -> `ADBE Calder` (= "Advanced 3D" friendly name `advanced3d`) |
+| `040-static-position-100-200.aep` | `layers-comps.aep` | `040-static-position-100-200` | Position [960,540,0] -> [100,200,0] |
+| `041-static-scale-50.aep` | `layers-comps.aep` | `041-static-scale-50` | Scale [100,100,100] -> [50,50,100] |
+| `042-static-rotation-45.aep` | `layers-comps.aep` | `042-static-rotation-45` | Rotation 0 -> 45 |
+| `043-static-opacity-25.aep` | `layers-comps.aep` | `043-static-opacity-25` | Opacity 100 -> 25 |
+| `044-static-anchor-10-20.aep` | `layers-comps.aep` | `044-static-anchor-10-20` | Anchor Point [960,540,0] -> [10,20,0] |
+| `052-key-position-2key-ease.aep` | `keyframes.aep` | `052-key-position-2key-ease` | from 051: both keys set_easing preset 'ease' (bezier in/out, speed 0, influence 33) |
+| `053-key-position-2key-hold-key1.aep` | `keyframes.aep` | `053-key-position-2key-hold-key1` | from 051: key1 inType/outType = HOLD (key2 stays linear) |
+| `054-key-position-2key-spatial-bezier.aep` | `keyframes.aep` | `054-key-position-2key-spatial-bezier` | from 051: key1 spatial outTangent [30,60,0], key2 spatial inTangent [-30,-60,0], autoBezier=false, continuous=false (S-shaped path; verified: value at t=.25 = [23.7,16.95]) |
+| `055-key-position-3key-inserted-t2.5.aep` | `keyframes.aep` | `055-key-position-3key-inserted-t2.5` | from 051: 3rd key inserted into the already animated property at t=2.5 value [200,100,0] (= keys at t=0,1,2.5, all linear) |
+| `056-key-position-3key-roving-key2.aep` | `keyframes.aep` | `056-key-position-3key-roving-key2` | from 055: key2 roving=true (AE moved key2 to t=1.0355078125, value kept [100,0,0]) |
+| `057-key-position-3key-label9-key2.aep` | `keyframes.aep` | `057-key-position-3key-label9-key2` | from 055: key2 keyframe label = 9 (Green). (056 was undone first) |
+| `058-key-opacity-2key.aep` | `keyframes.aep` | `058-key-opacity-2key` | Opacity keys t=0 -> 0, t=2 -> 100 (linear) |
+| `058-key-opacity-2key.aepx` | `aepx-pair.aepx` | `058-key-opacity-2key` | Opacity keys t=0 -> 0, t=2 -> 100 (linear) |
+| `060-expr-opacity-wiggle.aep` | `keyframes.aep` | `060-expr-opacity-wiggle` | Opacity expression `wiggle(1,10)` (enabled, JavaScript engine = project default) |
+| `060-expr-opacity-wiggle.aepx` | `aepx-pair.aepx` | `060-expr-opacity-wiggle` | Opacity expression `wiggle(1,10)` (enabled, JavaScript engine = project default) |
+| `071-fx-slider-value77.aep` | `effects.aep` | `071-fx-slider-value77` | from 070: Slider 0 -> 77 |
+| `073-fx-color-0.2-0.6-1.aep` | `effects.aep` | `073-fx-color-0.2-0.6-1` | add `ADBE Color Control`, Color -> [0.2,0.6,1] (no default-only Color file) |
+| `077-fx-dropdown-default.aep` | `effects.aep` | `077-fx-dropdown-default` | add Dropdown Menu Control (matchName `Pseudo/@@S1iPXtJFTHK4QaDbgJvLhw`, default items) |
+| `080-fx-dropshadow-default.aep` | `effects.aep` | `080-fx-dropshadow-default` | add `ADBE Drop Shadow` (default params) |
+| `090-mask-rect.aep` | `masks.aep` | `090-mask-rect` | mask.add rect size [800,400] centre [960,540]: "Mask 1", vertices [560,340],[1360,340],[1360,740],[560,740], mode Add |
+| `091-mask-rect-props.aep` | `masks.aep` | `091-mask-rect-props` | from 090: feather [0,0]->[20,20], opacity 100->50, mode Add->Subtract, inverted false->true, expansion 0->5 |
+| `093-mask-path-2keys.aep` | `masks.aep` | `093-mask-path-2keys` | from 090: mask path keyed: t=0 rect 400x200 (vertices [760,440],[1160,440],[1160,640],[760,640]), t=1 rect 800x400; linear interp. NOTE: mask.set_path 'time' makes the first write at t=0 the first key (stopwatch on) |
+| `110-text-A.aep` | `text.aep` | `110-text-A` | new point text layer T, text "A" (defaults: Times New Roman TimesNewRomanPSMT, size 100, fill white) |
+| `110-text-A.aepx` | `aepx-pair.aepx` | `110-text-A` | new point text layer T, text "A" (defaults: Times New Roman TimesNewRomanPSMT, size 100, fill white) |
+| `113-text-Hello-size60-fillorange.aep` | `text.aep` | `113-text-Hello-size60-fillorange` | from 112: fillColor [1,1,1] -> [1,0.5,0] |
+| `114-text-animator-opacity.aep` | `text.aep` | `114-text-animator-opacity` | from 113: + text animator "Animator 1" with Opacity=0 and a Range Selector 1 |
+| `122-marker-comp-1s.aep` | `markers.aep` | `122-marker-comp-1s` | comp marker at t=1 s, comment "CompMarker" |
+| `123-marker-layer-1s.aep` | `markers.aep` | `123-marker-layer-1s` | layer marker on L at t=1 s, comment "LayerMarker" |
+| `124-precomp-Pre.aep` | `footage-precomp.aep` | `124-precomp-Pre` | L precomposed (moveAll) into new comp "Pre" (1920x1080, 25 fps, 5 s); C now holds one layer "Pre" (label 15). Adds comp item "Pre" |
+| `124-precomp-Pre.aepx` | `aepx-pair.aepx` | `124-precomp-Pre` | L precomposed (moveAll) into new comp "Pre" (1920x1080, 25 fps, 5 s); C now holds one layer "Pre" (label 15). Adds comp item "Pre" |
+| `126-footage-png-layer.aep` | `footage-precomp.aep` | `126-footage-png-layer` | from 125: layer "png" created from that footage in C (index 1 above L) |
+| `202-key-out-hold-in-linear.aep` | `keyframes.aep` | `202-key-out-hold-in-linear` | Position keys t=0 [0,0,0], t=1 [100,0,0]; key1 inType=LINEAR, outType=HOLD (key2 linear/linear). Confirmed by layer.info: key1 in=linear out=hold |
+| `203-key-in-hold-out-linear.aep` | `keyframes.aep` | `203-key-in-hold-out-linear` | same keys; key1 inType=HOLD, outType=LINEAR. Confirmed: key1 in=hold out=linear |
+| `204-key-ease-asymmetric.aep` | `keyframes.aep` | `204-key-ease-asymmetric` | Position keys t=0 [0,0,0], t=1 [100,0,0]; set_easing key1 inSpeed 5/inInfluence 20, outSpeed 50/outInfluence 80; key2 inSpeed 7/inInfl 60, outSpeed 9/outInfl 40. AE read-back (spatial property): key1 in speed forced to 0 (infl 20), key1 out 50/80, key2 in 7/60, key2 out speed forced to 0 (infl 40); both bezier/bezier |
+| `205-key-opacity-ease-asymmetric.aep` | `keyframes.aep` | `205-key-opacity-ease-asymmetric` | (extra) Opacity keys t=0 -> 0, t=2 -> 100; set_easing key1 inSpeed 5/inInfl 20, outSpeed 20/outInfl 80; key2 inSpeed 30/inInfl 60, outSpeed 9/outInfl 40. AE read-back: key1 in speed 0 (infl 20), key1 out 20/80, key2 in 30/60, key2 out speed 0 (infl 40); bezier/bezier (scalar 48-byte record ease slots) |
+| `206-key-scale-2key-linear.aep` | `keyframes.aep` | `206-key-scale-2key-linear` | Scale keys t=0 [100,100,100], t=1 [200,150,100] (linear; 3-component non-spatial record) |
+| `208-key-mask-feather-2key-linear.aep` | `masks.aep` | `208-key-mask-feather-2key-linear` | NEW mask "Mask 1" (rect 800x400 centre [960,540], mode Add, = 090) + Mask Feather keys t=0 [0,0], t=1 [40,20] (linear, 2-D). Diff against 090 |
+| `210-key-fill-color-2key-linear.aep` | `keyframes.aep` | `210-key-fill-color-2key-linear` | effect `ADBE Fill` (index 1) added (all other params default); Color keys t=0 [1,0,0], t=1 [0,0.5,1] (linear, colour record) |
+| `211-anchor-100x100-solid-10-20.aep` | `layers-comps.aep` | `211-anchor-100x100-solid-10-20` | NEW solid layer `S100` 100x100 white [1,1,1] (new footage item `S100`) in the 1920x1080 comp, Anchor Point set [50,50,0] (default) -> [10,20,0]; Position left at default (comp centre [960,540]) |
+| `212-anchor-400x300-solid-100-50.aep` | `layers-comps.aep` | `212-anchor-400x300-solid-100-50` | NEW solid layer `S400` 400x300 white [1,1,1] (new footage item `S400`), Anchor Point -> [100,50,0]; Position default |
+| `213-expr-opacity-wiggle-disabled.aep` | `keyframes.aep` | `213-expr-opacity-wiggle-disabled` | Opacity expression `wiggle(1,10)` set (as in 060) and then `expression.disable_all` on comp C (sets expressionEnabled=false; the expression text stays in the file, grep confirms 1 occurrence). Diff against 060 to find the enable flag |
+| `214-fx-gaussianblur-default.aep` | `effects.aep` | `214-fx-gaussianblur-default` | add `ADBE Gaussian Blur 2`, all params default (Blurriness 0, Dimensions Horizontal and Vertical, Repeat Edge Pixels off) |
+| `215-fx-fill-default.aep` | `effects.aep` | `215-fx-fill-default` | add `ADBE Fill`, all params default (colour red, opacity 100 %) |
+| `216-fx-gaussianblur-40.aep` | `effects.aep` | `216-fx-gaussianblur-40` | add `ADBE Gaussian Blur 2`, Blurriness 0 -> 40 (compare 214 and 078 = 25) |
+| `217-fx-checkbox-on.aep` | `effects.aep` | `217-fx-checkbox-on` | add `ADBE Checkbox Control`, Checkbox 0 -> 1 (on) |
+| `218-fx-point-111-222.aep` | `effects.aep` | `218-fx-point-111-222` | add `ADBE Point Control`, Point -> [111,222] |
+| `219-fx-angle-90.aep` | `effects.aep` | `219-fx-angle-90` | add `ADBE Angle Control`, Angle 0 -> 90 |
+| `220-fx-layercontrol-to-layer1.aep` | `effects.aep` | `220-fx-layercontrol-to-layer1` | NEW null layer `Null` created on top (index 1, new footage item `Null 1`); L (now index 2) gets `ADBE Layer Control` with Layer = 1 (the Null; layer index 1, read back as value 1). Compare 076 (Layer = None) and 022 (same null) |
+| `221-fx-slider-2key.aep` | `effects.aep` | `221-fx-slider-2key` | add `ADBE Slider Control`, Slider keyed t=0 -> 10, t=2 -> 90 (linear) |
+| `222-layer-video-off.aep` | `layers-comps.aep` | `222-layer-video-off` | layer.enabled true -> false (Video switch). aepx `ldta` byte 39: 07 -> 06 |
+| `223-layer-audio-off.aep` | `layers-comps.aep` | `223-layer-audio-off` | `audioEnabled` = false on L (a solid has no audio; AE accepted it without warning and the flag did change: byte 39: 07 -> 05) |
+| `224-layer-effects-off.aep` | `layers-comps.aep` | `224-layer-effects-off` | `effectsActive` = false on L (no effects present; byte 39: 07 -> 03) |
+| `225-layer-blend-screen.aep` | `layers-comps.aep` | `225-layer-blend-screen` | blending mode Normal -> Screen (aepx `ldta` byte 99 = 6) |
+| `226-layer-blend-add.aep` | `layers-comps.aep` | `226-layer-blend-add` | blending mode Normal -> Add (byte 99 = 4) |
+| `227-layer-blend-overlay.aep` | `layers-comps.aep` | `227-layer-blend-overlay` | blending mode Normal -> Overlay (byte 99 = 7) |
+| `228-layer-blend-difference.aep` | `layers-comps.aep` | `228-layer-blend-difference` | blending mode Normal -> Difference (byte 99 = 26) |
+| `229-comp-fps-29.97.aep` | `layers-comps.aep` | `229-comp-fps-29.97` | comp frameRate 25 -> 29.97 (AE read-back 29.9700012207031; duration snapped 5 s -> 5.00500500500501 s = 150 frames; work area duration follows) |
+| `230-comp-fps-23.976.aep` | `layers-comps.aep` | `230-comp-fps-23.976` | comp frameRate 25 -> 23.976 (read-back 23.9759979248047; duration snapped to 5.00500500500501 s = 120 frames) |
+| `231-comp-bg-grey-0.5.aep` | `layers-comps.aep` | `231-comp-bg-grey-0.5` | comp bgColor [0,0,0] -> [0.5,0.5,0.5] (read-back 0.50196078431373 = 128/255 on all channels) |
+| `232-mask-ellipse.aep` | `masks.aep` | `232-mask-ellipse` | mask.add shape ellipse size [800,400] centre [960,540], mode Add. AE read-back of the path: vertices [960,340],[1360,540],[960,740],[560,540]; inTangents [-220.913879394531,0],[0,-110.456970214844],[220.913940429688,0],[0,110.456970214844]; outTangents [220.913940429688,0],[0,110.456970214844],[-220.913879394531,0],[0,-110.456970214844]; closed |
+| `233-mask-open-path.aep` | `masks.aep` | `233-mask-open-path` | mask.add (no shape, mode Add) + mask.set_path vertices [500,300],[960,700],[1400,300], closed=false, no tangents. Read-back closed=false, vertices stored as float32 (499.999969482422, 699.999938964844) |
+| `234-mask-mode-intersect.aep` | `masks.aep` | `234-mask-mode-intersect` | rect mask 800x400 centre [960,540] (as 090) with mode Intersect (aepx `mkif` @4 = 3; Add = 1 in 090) |
+| `235-mask-mode-lighten.aep` | `masks.aep` | `235-mask-mode-lighten` | same rect, mode Lighten |
+| `236-mask-mode-darken.aep` | `masks.aep` | `236-mask-mode-darken` | same rect, mode Darken |
+| `237-mask-mode-difference.aep` | `masks.aep` | `237-mask-mode-difference` | same rect, mode Difference |
+| `238-shape-rect-rounded-corners.aep` | `shapes.aep` | `238-shape-rect-rounded-corners` | Group 1 = Rectangle Path 400x300 + Fill [0,1,0] + `shape.add_rounded_corners` radius 20 ("Round Corners 1", `ADBE Vector Filter - RC`, `ADBE Vector RoundCorner Radius` 20) |
+| `239-shape-stroke-green-w8-round.aep` | `shapes.aep` | `239-shape-stroke-green-w8-round` | Group 1 = Rectangle Path 400x300 + Stroke colour [0,1,0,1] width 8, Line Cap = 2 (Round), Line Join = 2 (Round); NO fill; read back: cap 2, join 2 |
+| `240-shape-custom-path-tangents.aep` | `shapes.aep` | `240-shape-custom-path-tangents` | Group 1 = Path (closed) vertices [0,-100],[100,100],[-100,100], inTangents [-10,-20],[30,20],[-60,10], outTangents [40,0],[-20,30],[0,-50] (read back out2 = -19.9999847412109) + Fill [0,1,0] |
+| `241-shape-gradient-fill-linear.aep` | `shapes.aep` | `241-shape-gradient-fill-linear` | Group 1 = Rectangle Path 400x300 + Gradient Fill 1 (`ADBE Vector Graphic - G-Fill`), linear, start [-200,0], end [200,0]; colour stops left at AE's default (not scriptable) |
+| `242-shape-group-position-50-50.aep` | `shapes.aep` | `242-shape-group-position-50-50` | Group 1 = Rectangle Path 400x300 + Fill [0,1,0]; Group 1 / Transform / Position [0,0] -> [50,50] |
+| `243-text-multiline-A-CR-B.aep` | `text.aep` | `243-text-multiline-A-CR-B` | point text layer T, text `A\rB` (CR between, 2 paragraphs / 2 lines) |
+| `245-text-box-400x200-Hello.aep` | `text.aep` | `245-text-box-400x200-Hello` | paragraph (box) text layer T, `Hello`, boxSize [400,200] (AE: box position [-200,-100] in layer space), left aligned (default) |
+| `246-text-box-center-align.aep` | `text.aep` | `246-text-box-center-align` | FROM 245 (not from base): justification left -> center (one variable vs 245) |
+| `247-text-tracking-100.aep` | `text.aep` | `247-text-tracking-100` | point text `Hello` with tracking 0 -> 100 (whole document, text.set_style tracking 100) |
+| `248-text-range-fill-red-1-3.aep` | `text.aep` | `248-text-range-fill-red-1-3` | point text `Hello`; per-range style: characters [1,3) ("el") fill colour [1,0,0]; rest white |
+| `249-marker-layer-full.aep` | `markers.aep` | `249-marker-layer-full` | layer marker on L at t=1 s: comment `LM`, duration 1 s, chapter `Chap`, url `http://a.example/u`, frameTarget `_blank`, cuePointName `CueX` (AE read-back: eventCuePoint=true, label 0, params {}). All four link strings non-empty and distinct so that the string order in `Nmrd` can be decided |
+| `251-camera-one-node.aep` | `3d.aep` | `251-camera-one-node` | camera layer `Camera 1` (default 50 mm, label 4) with autoOrient = off (one-node camera). aepx `ldta` byte 38 of the camera: 0x44 (two-node, 120/256) -> 0x04, so bit 0x40 = "orient towards point of interest". AE's summary reports Position [0,0,-2666.67] for this layer (a two-node camera reports [960,540,-2666.67] as in 120) |
+| `252-light-point.aep` | `3d.aep` | `252-light-point` | light layer `Light 1`, lightType point (default intensity 100 %, label 6) |
+| `253-camera-position-100-200-m1000.aep` | `3d.aep` | `253-camera-position-100-200-m1000` | two-node camera `Camera 1`, Position [960,540,-2666.67] -> [100,200,-1000] (read back [100,200,-1000], Point of Interest stays [960,540,0]) |
+| `254-light-spot-intensity-50.aep` | `3d.aep` | `254-light-spot-intensity-50` | spot light `Light 1`, Light Options / Intensity 100 -> 50 |
+| `256-camera-two-node-default.aep` | `3d.aep` | `256-camera-two-node-default` | (extra, noise-matched reference) default two-node camera `Camera 1`, compare 251, 253 and 120 |
+| `259-solid-blue-0-0-1.aep` | `layers-comps.aep` | `259-solid-blue-0-0-1` | NEW solid layer `Blue` [0,0,1], comp size 1920x1080, on top of L (new footage item `Blue`); the colour sits in the `Soli` footage `opti` (compare L red = 1.0,1.0,0,0 as float32 ARGB) |
+| `299-save-noise.aep` | `layers-comps.aep` | `299-save-noise` | plain save of the freshly loaded base copy (no change at all) to measure save noise of THIS session; compare with 000-base and 200/201 |
+| `300-fx-gaussianblur-0-explicit.aep` | `effects.aep` | `300-fx-gaussianblur-0-explicit` | layer 1 effect `ADBE Gaussian Blur 2` added; AE read-back of Blurriness right after add = **25** (property.get value 25, numKeys 0); then Blurriness set explicitly 25 -> 0 (read back 0) |
+| `301-fx-gaussianblur-40-then-25.aep` | `effects.aep` | `301-fx-gaussianblur-40-then-25` | `ADBE Gaussian Blur 2` added, Blurriness 25 -> 40 -> 25 (set twice in one call; read back 25) |
+| `302-fx-fill-opacity-100-explicit.aep` | `effects.aep` | `302-fx-fill-opacity-100-explicit` | `ADBE Fill` added (default Opacity read back 1 = 100 %; scale of effect.set_property is 0..1, 100 is rejected "out of range 0 to 1"); Opacity set explicitly to 1 |
+| `303-fx-fill-opacity-50-then-100.aep` | `effects.aep` | `303-fx-fill-opacity-50-then-100` | `ADBE Fill` added, Opacity 1 -> 0.5 -> 1 (read back 1) |
+| `304-fx-slider-0-explicit.aep` | `effects.aep` | `304-fx-slider-0-explicit` | `ADBE Slider Control` added, Slider set explicitly 0 -> 0 (default is 0; read back 0) |
+| `305-key-scale-bezier-ease.aep` | `keyframes.aep` | `305-key-scale-bezier-ease` | layer 1 Transform/Scale keys t=0 [100,100,100] and t=2 [200,150,100]; set_easing key1 inSpeed 0/inInfl 33, outSpeed 20/outInfl 66; key2 inSpeed 10/inInfl 66, outSpeed 0/outInfl 33. AE read-back: bezier/bezier on both, ease arrays 3 identical entries per side with exactly these values |
+| `306-key-maskfeather-bezier-ease.aep` | `masks.aep` | `306-key-maskfeather-bezier-ease` | NEW mask `Mask 1` (rect 800x400 centre [960,540], vertices [560,340],[1360,340],[1360,740],[560,740], mode Add) + Mask Feather keys t=0 [0,0], t=2 [50,30]; key1 inSpeed 0/infl 33, outSpeed 15/infl 66; key2 inSpeed 8/infl 66, outSpeed 0/infl 33; read back as set (2 ease entries per side) |
+| `307-key-fillcolor-bezier.aep` | `keyframes.aep` | `307-key-fillcolor-bezier` | `ADBE Fill` added; Color keys t=0 [1,0,0,1], t=2 [0,0,1,1] (value at t=1 read back [0.5,0,0.5,1]); both keys then set_interpolation inType/outType bezier (temporalContinuous/AutoBezier false). AE read-back ease: speed 0 / influence 0 on all four sides (colour has 1 ease entry, AE reports influence 0, not the 16.67 default) |
+| `309-solid-100x100-mask-rect.aep` | `masks.aep` | `309-solid-100x100-mask-rect` | 308 + `mask.add` shape rect size [60,40] centre [50,50], mode Add; AE read-back path vertices [20,30],[80,30],[80,70],[20,70], all tangents 0 |
+| `310-solid-100x100-pointcontrol.aep` | `layers-comps.aep` | `310-solid-100x100-pointcontrol` | 308 (NOT 309) + effect `ADBE Point Control`; AE read-back of the default Point = **[50,50]** = centre of the 100x100 layer (a 1920x1080 layer would give [960,540]; compare 074) |
+| `311-position-default-explicit.aep` | `layers-comps.aep` | `311-position-default-explicit` | property.set Transform/Position [960,540,0] (was [960,540,0]) |
+| `316-layer-stretch50.aep` | `keyframes.aep` | `316-layer-stretch50` | layer.set_timing stretch 100 -> 50 (AE: out point 5 -> 2.5, in 0, start 0) |
+| `317-layer-stretch150.aep` | `keyframes.aep` | `317-layer-stretch150` | stretch 100 -> 150 (out point 7.5) |
+| `318-layer-inpoint-0.3333.aep` | `layers-comps.aep` | `318-layer-inpoint-0.3333` | inPoint 0 -> 0.3333 (AE read-back: inPoint 0.33328125, outPoint 5.33328125, start 0, stretch 100; the requested 0.3333 was quantised by AE) |
+| `319-precomp-timeremap.aep` | `footage-precomp.aep` | `319-precomp-timeremap` | SKIPPED on the solid (AE: "Can not set timeRemapEnabled ... canSetTimeRemapEnabled" for solids). Instead: L precomposed (moveAll) into `Pre` as in 124 (layer `Pre`, label 15) AND timeRemapEnabled = true on layer `Pre`; two variables vs base, one vs 124. AE read-back: Time Remap keys t=0 value 0 and t=5 value 5, linear/linear |
+| `320-fx-layercontrol-self-explicit.aep` | `effects.aep` | `320-fx-layercontrol-self-explicit` | `ADBE Layer Control` added (default Layer read back 1) + Layer set explicitly to 1 (no-op) |
+| `321-fx-layercontrol-none.aep` | `effects.aep` | `321-fx-layercontrol-none` | FROM 320: Layer 1 -> 0 (None; read back 0) |
+| `323-fx-dropdown-5items.aep` | `effects.aep` | `323-fx-dropdown-5items` | `ADBE Dropdown Control` added (AE reports the effect matchName as `Pseudo/@@UNgGeIbLTy24Y7LB8Oar1Q`, display name `Dropdown Menu Control`), effect.set_dropdown_items ["Alpha","Beta","Gamma","Delta","Epsilon"]; read back value 1 / "Alpha" |
+| `324-fx-dropdown-5items-select3.aep` | `effects.aep` | `324-fx-dropdown-5items-select3` | FROM 323: Menu set to 3 (read back value 3, valueText "Gamma"); NOTE the property matchName after the re-creation is `Pseudo/@@KbKT0rCPQi2A0ytuyGLWSw-0001` |
+| `325-comp-pixelaspect-0.9091.aep` | `layers-comps.aep` | `325-comp-pixelaspect-0.9091` | pixelAspect 1 -> 0.9091 (AE read-back 0.90909090909091 = 10/11) |
+| `326-comp-shutterphase-m90.aep` | `layers-comps.aep` | `326-comp-shutterphase-m90` | shutterPhase 0 -> -90 (read back -90; shutterAngle stays 180) |
+| `327-comp-displaystartframe-100.aep` | `layers-comps.aep` | `327-comp-displaystartframe-100` | displayStartFrame 0 -> 100 (accepted without warning; comp.info does not report it, but the cdta bytes in the .aepx change vs 326: a (value,scale) pair 00000190 / 00000064 (= 400/100 = 4 s = 100 frames at 25 fps) appears in the tail, and the shutter phase `ffffffa6` of 326 is back to 0) |
+| `328-mask-two-ellipse-rect.aep` | `masks.aep` | `328-mask-two-ellipse-rect` | mask.add ellipse 800x400 centre [960,540] (Mask 1, vertices as 232) + mask.add rect 400x300 centre [700,500] (Mask 2, vertices [500,350],[900,350],[900,650],[500,650] with float noise 499.999969482422 etc.); both mode Add (default) |
+| `329-mask-ellipse-mode-none.aep` | `masks.aep` | `329-mask-ellipse-mode-none` | mask.add ellipse 800x400 centre [960,540] with mode None (compare 232 = same path, mode Add); AE offers no read-back of the mode via property.get (Mask Mode is not a listed property) |
+| `330-shape-polystar-star-5-50-100.aep` | `shapes.aep` | `330-shape-polystar-star-5-50-100` | Polystar Path 1 starType star, Points 5, Outer Radius 100, Inner Radius 50 (Points/Inner/Outer read back as set; Type not read), roundness/rotation/position left default + Fill [0,1,0,1] |
+| `331-shape-polystar-polygon-5-100.aep` | `shapes.aep` | `331-shape-polystar-polygon-5-100` | Polystar Path 1 starType polygon (Type read back = 2), Points 5, Outer Radius 100 + Fill [0,1,0,1] |
+| `332-shape-gradient-fill-radial.aep` | `shapes.aep` | `332-shape-gradient-fill-radial` | Rectangle Path 400x300 + Gradient Fill 1 `ADBE Vector Graphic - G-Fill`, gradientType radial (Type read back 2), Start Point [0,0], End Point [200,0], Highlight Length/Angle 0, Scale [100,100], Rotation 0; colour stops default (not scriptable); compare 241 (linear, type 1) |
+| `333-shape-group-two-rects.aep` | `shapes.aep` | `333-shape-group-two-rects` | Group 1 contents: Rectangle Path 1 size [400,300] + Rectangle Path 2 size [100,100] position [300,0] + Fill 1 [0,1,0,1] (order rect, rect, fill) |
+| `334-text-box-right-align.aep` | `text.aep` | `334-text-box-right-align` | paragraph (box) text `T` "Hello", boxSize [400,200] (boxTextPos [-200,-100]), justification right (AE justification enum 7414; compare 245: left, 246: center) |
+| `335-text-point-fauxbold.aep` | `text.aep` | `335-text-point-fauxbold` | point text "Hello" with fauxBold = true (fontStyle read back still "Regular"; font TimesNewRomanPSMT) |
+| `336-text-point-fauxitalic.aep` | `text.aep` | `336-text-point-fauxitalic` | point text "Hello" (vs 244) with fauxItalic = true |
+| `337-text-point-allcaps.aep` | `text.aep` | `337-text-point-allcaps` | point text "Hello" with allCaps = true (fontCapsOption) |
+| `338-text-point-smallcaps.aep` | `text.aep` | `338-text-point-smallcaps` | point text "Hello" with smallCaps = true |
+| `339-text-point-leading60.aep` | `text.aep` | `339-text-point-leading60` | point text "Hello" with leading 60 (autoLeading default read back leading 98 -> 60; read back 60; justification 7413 = left) |
+| `340-text-range-two-styles.aep` | `styles.aep` | `340-text-range-two-styles` | point text "Hello" with two range styles in one call: characters [1,3) ("el") fill [1,0,0]; characters [3,5) ("lo") fill [0,0,1] and fontSize 60 (compare 248 = one range) |
+| `341-camera-zoom-2000.aep` | `3d.aep` | `341-camera-zoom-2000` | camera layer `Camera 1` (default 50 mm; default Zoom read back 2666.6666666), Camera Options/Zoom set to 2000 (read back 2000) |
+| `342-camera-dof-800-30.aep` | `3d.aep` | `342-camera-dof-800-30` | camera layer `Camera 1`, Camera Options/Depth of Field 0 -> 1, Focus Distance -> 800, Aperture -> 30 (all read back as set; Zoom stays default) |
+| `343-light-spot-color-red.aep` | `3d.aep` | `343-light-spot-color-red` | spot light `Light 1` (defaults read back: Color [1,1,1,1], Cone Angle 90, Cone Feather 50) with Light Options/Color [1,0,0,1] |
+| `344-light-spot-coneangle-60.aep` | `3d.aep` | `344-light-spot-coneangle-60` | spot light `Light 1`, Cone Angle 90 -> 60 (Color stays white; the spot light was created once as step 0 and kept for 343-345, each change undone before the next) |
+| `345-light-spot-conefeather-30.aep` | `3d.aep` | `345-light-spot-conefeather-30` | spot light `Light 1`, Cone Feather 50 -> 30 |
+| `347-marker-layer-label3.aep` | `markers.aep` | `347-marker-layer-label3` | marker.add_layer label 3; read back: label 3, eventCuePoint true, duration 0, strings empty, params {} |
+| `348-marker-layer-navigation-cue.aep` | `markers.aep` | `348-marker-layer-navigation-cue` | cuePointName `CueN`, eventCuePoint = false (navigation cue); read back label 0, eventCuePoint false |
+| `349-marker-layer-event-cue-params.aep` | `markers.aep` | `349-marker-layer-event-cue-params` | cuePointName `CueE`, eventCuePoint = true, params {"speaker":"A","n":"2"}; read back identical |
+| `350-footage-wav-imported.aep` | `footage-precomp.aep` | `350-footage-wav-imported` | project.import_file test-tone.wav (name `test-tone.wav`, new footage item id 32, AE: width 0, height 0, duration 1, numItems 4); no layer |
+| `351-footage-wav-as-layer.aep` | `footage-precomp.aep` | `351-footage-wav-as-layer` | FROM 350: layer.create_footage -> audio layer `test-tone.wav` on top of L in C (hasAudio true, hasVideo false, in 0, out 1, label 7); audio group not reported by the summary |
+| `352-footage-pngseq-imported.aep` | `footage-precomp.aep` | `352-footage-pngseq-imported` | project.import_file seq_001.png with sequence=true -> footage item `seq_[001-003].png` (id 34, 64x64, duration 0.1 s = 3 frames at AE's default 30 fps); no layer |
+| `354-footage-pngseq-timeremap.aep` | `footage-precomp.aep` | `354-footage-pngseq-timeremap` | FROM 353: timeRemapEnabled = true on the sequence layer; read back Time Remap keys t=0 value 0, t=0.1 value 0.1, linear/linear (this is the time-remap case that works on real footage; the solid in 319 cannot, so 319 uses a precomp) |
+| `356-fx-tint-default.aep` | `effects.aep` | `356-fx-tint-default` | add `ADBE Tint` (default name "Tint", all parameters default) |
+| `357-fx-tint-black-0.2-0.4-0.6.aep` | `effects.aep` | `357-fx-tint-black-0.2-0.4-0.6` | FROM 356: Map Black To [0,0,0] -> [0.2,0.4,0.6] (read back [0.20000000298023,0.40000000596046,0.60000002384186,1]) |
+| `361-fx-tint-amount-0.aep` | `effects.aep` | `361-fx-tint-amount-0` | FROM 356: Amount to Tint 100 -> 0 |
+| `363-fx-tint-amount-2key.aep` | `effects.aep` | `363-fx-tint-amount-2key` | FROM 356: Amount to Tint keyed t=0 -> 20, t=2 -> 80 (linear; value at t=1 read back 50) |
+| `364-fx-tint-white-2key.aep` | `effects.aep` | `364-fx-tint-white-2key` | FROM 356: Map White To keyed t=0 -> [1,1,0], t=2 -> [0,0,1] (linear; value at t=1 read back [0.5,0.5,0.5,1]) |
+| `366-fx-blur-then-tint.aep` | `effects.aep` | `366-fx-blur-then-tint` | FROM 365: effect.move Gaussian Blur 2 -> 1 (stack Gaussian Blur, Tint; read back order ["Gaussian Blur","Tint"]) |
+| `368-fx-ramp-default.aep` | `effects.aep` | `368-fx-ramp-default` | add `ADBE Ramp` (default name "Gradient Ramp", all parameters default) |
+| `369-fx-ramp-start-100-200.aep` | `effects.aep` | `369-fx-ramp-start-100-200` | FROM 368: Start of Ramp [960,0] -> [100,200] |
+| `371-fx-ramp-startcolor-red.aep` | `effects.aep` | `371-fx-ramp-startcolor-red` | FROM 368: Start Color [0,0,0] -> [1,0,0]. |
+| `374-fx-ramp-end-2000-m100.aep` | `effects.aep` | `374-fx-ramp-end-2000-m100` | FROM 368: End of Ramp [960,1080] -> [2000,-100] (outside the layer) |
+| `377-fx-ramp-shape-radial.aep` | `effects.aep` | `377-fx-ramp-shape-radial` | FROM 368: Ramp Shape 1 -> 2 (Radial Ramp; read back 2) |
+| `378-fx-ramp-scatter-12.aep` | `effects.aep` | `378-fx-ramp-scatter-12` | FROM 368: Ramp Scatter 0 -> 12 |
+| `380-fx-ramp-blend-25pct.aep` | `effects.aep` | `380-fx-ramp-blend-25pct` | FROM 368: Blend With Original 0 -> 0.25 (= 25 %; a first attempt with 25 was rejected by AE and changed nothing) |
+| `382-fx-ramp-start-2key.aep` | `effects.aep` | `382-fx-ramp-start-2key` | FROM 368: Start of Ramp keyed t=0 -> [100,100], t=2 -> [1800,900] (linear; value at t=1 read back [950,500]) |
+| `383-fx-ramp-on-100x100-start-10-20.aep` | `effects.aep` | `383-fx-ramp-on-100x100-start-10-20` | FROM 368 (L keeps its DEFAULT Gradient Ramp): TWO changes in one call: NEW solid layer `S100` 100x100 white [1,1,1] on top (new footage item `S100`, layer index 1) AND a Gradient Ramp on S100 with Start of Ramp -> [10,20]; AE read-back of the S100 ramp's default End of Ramp = [50,100] (relative to the 100x100 layer). Two Ramp instances of the same type on two layers |
+| `385-text-anchor-10-20.aep` | `text.aep` | `385-text-anchor-10-20` | FROM 384: text layer T Anchor Point -> [10,20]. Stored as cdat f64 pixels [10, 20] (not a fraction of a source size): confirms the text-anchor rule (was H) |
+| `386-text-etx-A-B.aep` | `text.aep` | `386-text-etx-A-B` | FROM 384 (anchor undone): T text -> "A" U+0003 "B". Stored as UTF-16 U+0003. AE text.measure: 2 composed lines, 2 paragraphs, baselines at y 0 and 98 – exactly the same layout as 387 (CR): AE treats U+0003 as a line break |
+| `389-fx-exposure-default.aep` | `effects.aep` | `389-fx-exposure-default` | add `ADBE Exposure2` (default name "Exposure", all parameters default) |
+| `390-fx-exposure-channels-individual.aep` | `effects.aep` | `390-fx-exposure-channels-individual` | FROM 389: Channels 1 -> 2 (Individual Channels; read back 2) |
+| `391-fx-exposure-master-1.5.aep` | `effects.aep` | `391-fx-exposure-master-1.5` | FROM 389: Exposure 0 -> 1.5 (Master Exposure `-0003`) |
+| `393-fx-exposure-offset-0.1.aep` | `effects.aep` | `393-fx-exposure-offset-0.1` | FROM 389: Offset 0 -> 0.1 (Master Offset `-0004`; read back 0.10000000149012) |
+| `394-fx-exposure-gamma-2.2.aep` | `effects.aep` | `394-fx-exposure-gamma-2.2` | FROM 389: Gamma Correction 1 -> 2.2 (Master `-0005`; read back 2.20000004768372) |
+| `395-fx-exposure-individual-red-1.aep` | `effects.aep` | `395-fx-exposure-individual-red-1` | FROM 389: TWO changes in one call: Channels 1 -> 2 AND Red Exposure 0 -> 1 (`-0008`) |
+| `396-fx-exposure-bypass-on.aep` | `effects.aep` | `396-fx-exposure-bypass-on` | FROM 389: Bypass Linear Light Conversion 0 -> 1 (`-0022`) |
+| `397-fx-exposure-master-2key.aep` | `effects.aep` | `397-fx-exposure-master-2key` | FROM 389: Exposure keyed t=0 -> -1, t=2 -> 2 (linear; value at t=1 read back 0.5) |
+| `400-text-autoleading-on.aep` | `text.aep` | `400-text-autoleading-on` | FROM 399: T (text "A" CR "B", size 100, explicit leading 98) Auto Leading -> ON. AE text.measure: second baseline 120 px below the first (= 1.2 x size 100), was 98 in 387/399 |
+| `403-matte-L-alpha-M.aep` | `layers-comps.aep` | `403-matte-L-alpha-M` | FROM 402: L (index 2) track matte = layer M, type alpha (`AVLayer.setTrackMatte`); AE switched M's video off by itself (comp.info: M enabled false) |
+| `404-matte-L-alphainv-M.aep` | `layers-comps.aep` | `404-matte-L-alphainv-M` | FROM 402: L track matte = M, alpha inverted (M video off by AE) |
+| `405-matte-L-luma-M.aep` | `layers-comps.aep` | `405-matte-L-luma-M` | FROM 402: L track matte = M, luma (M video off by AE) |
+| `406-matte-L-lumainv-M.aep` | `layers-comps.aep` | `406-matte-L-lumainv-M` | FROM 402: L track matte = M, luma inverted (M video off by AE) |
+| `407-matte-M-alpha-L-below.aep` | `layers-comps.aep` | `407-matte-M-alpha-L-below` | FROM 402: M (index 1) track matte = L (index 2, BELOW the target), alpha (L video off by AE) |
+| `408-matte-L-alpha-M-visible.aep` | `layers-comps.aep` | `408-matte-L-alpha-M-visible` | FROM 402: TWO changes in one call: L track matte = M alpha AND M video switch back on (comp.info: M enabled true) |
+| `410-fx-invert-channel-2.aep` | `effects.aep` | `410-fx-invert-channel-2` | FROM 409: Channel 1 -> 2 |
+| `411-fx-invert-blend-50.aep` | `effects.aep` | `411-fx-invert-blend-50` | FROM 409: Blend With Original 0 -> 50 (percent; accepted as 50) |
+| `413-fx-fastbox-radius-20.aep` | `effects.aep` | `413-fx-fastbox-radius-20` | FROM 412: Blur Radius 0 -> 20 |
+| `414-fx-fastbox-iterations-1.aep` | `effects.aep` | `414-fx-fastbox-iterations-1` | FROM 412: Iterations 3 -> 1 |
+| `416-fx-fastbox-repeatedge-off.aep` | `effects.aep` | `416-fx-fastbox-repeatedge-off` | FROM 412: Repeat Edge Pixels 1 -> 0 |
+| `418-fx-gaussian-dimensions-3.aep` | `effects.aep` | `418-fx-gaussian-dimensions-3` | FROM 417: Blur Dimensions 1 -> 3 |
+| `419-fx-gaussian-repeatedge-off.aep` | `effects.aep` | `419-fx-gaussian-repeatedge-off` | FROM 417: Repeat Edge Pixels 1 -> 0 |
+| `422-fx-dropshadow-opacity-204.aep` | `effects.aep` | `422-fx-dropshadow-opacity-204` | FROM 420: Opacity 127.5 -> 204 (scripting scale 0..255; 204 = 80 %) |
+| `426-fx-dropshadow-shadowonly-on.aep` | `effects.aep` | `426-fx-dropshadow-shadowonly-on` | FROM 420: Shadow Only 0 -> 1 |
+| `427-fx-glow-default.aep` | `effects.aep` | `427-fx-glow-default` | (Drop Shadow removed) add `ADBE Glo2` "Glow" (defaults read back: Glow Based On 2, Glow Threshold 153, Glow Radius 10, Glow Intensity 1, Composite Original 2, Glow Operation 3, Glow Colors 1, Color Looping 3, Color Loops 1, Color Phase 0, A & B Midpoint 0.5, Color A [1,1,1,1], Color B [0,0,0,1], Glow Dimensions 1) |
+| `429-fx-glow-threshold-76.5.aep` | `effects.aep` | `429-fx-glow-threshold-76.5` | FROM 427: Glow Threshold 153 -> 76.5 (scripting scale 0..255) |
+| `438-fx-glow-midpoint-0.25.aep` | `effects.aep` | `438-fx-glow-midpoint-0.25` | FROM 427: A & B Midpoint 0.5 -> 0.25 (scripting scale 0..1) |
+| `444-fx-huesat-hue-90.aep` | `effects.aep` | `444-fx-huesat-hue-90` | FROM 443: Master Hue 0 -> 90 (the undo afterwards did NOT revert it; 445-450 were each made on a fresh reopen of a copy of 443, verified by property.get) |
+| `446-fx-huesat-light-m30.aep` | `effects.aep` | `446-fx-huesat-light-m30` | FROM 443 (reopened): Master Lightness 0 -> -30 |
+| `448-fx-huesat-colorizehue-120.aep` | `effects.aep` | `448-fx-huesat-colorizehue-120` | FROM 443 (reopened): Colorize Hue 0 -> 120 |
+| `451-shape-ellipse-400x300-fill.aep` | `shapes.aep` | `451-shape-ellipse-400x300-fill` | NEW shape layer `S` on top: Group 1 = Ellipse Path 1 (`ADBE Vector Shape - Ellipse`, Size [400,300], Position default [0,0]) + Fill 1 colour [0,1,0,1]; NOT undone: base of 452-484 |
+| `457-shape-group-scale-50-80.aep` | `shapes.aep` | `457-shape-group-scale-50-80` | FROM 451: Group 1 Transform Scale [100,100] -> [50,80] |
+| `462-shape-layer-anchor-10-20.aep` | `shapes.aep` | `462-shape-layer-anchor-10-20` | FROM 451: layer S Transform Anchor Point [0,0,0] -> [10,20] (read back [10,20,0]) |
+| `464-shape-stroke-opacity-50.aep` | `shapes.aep` | `464-shape-stroke-opacity-50` | FROM 463: Stroke Opacity 100 -> 50 |
+| `467-shape-trim-end-70.aep` | `shapes.aep` | `467-shape-trim-end-70` | FROM 465: Trim End 100 -> 70 |
+| `469-shape-trim-type-2.aep` | `shapes.aep` | `469-shape-trim-type-2` | FROM 465: Trim Multiple Shapes 1 -> 2 |
+| `471-shape-rect-roundness-30.aep` | `shapes.aep` | `471-shape-rect-roundness-30` | FROM 470: Rect Roundness 0 -> 30 |
+| `473-shape-star-points-6.aep` | `shapes.aep` | `473-shape-star-points-6` | FROM 472: Points 5 -> 6 |
+| `482-shape-two-groups.aep` | `shapes.aep` | `482-shape-two-groups` | FROM 451: NEW Group 2 (top level) = Rectangle Path 1 [200,100] + Fill 1 [0,0,1,1] (one call) |
+| `483-shape-nested-group-rect.aep` | `shapes.aep` | `483-shape-nested-group-rect` | FROM 451: TWO calls: a Group added INSIDE Group 1 (after Fill 1, named "Group 1") and a Rectangle Path 1 [100,50] inside it |
+| `485-layer-3d-on.aep` | `3d.aep` | `485-layer-3d-on` | FROM base: L threeDLayer on (compare 015); NOT undone: base of 486-488 |
+| `486-layer-3d-rotx-30.aep` | `3d.aep` | `486-layer-3d-rotx-30` | FROM 485: X Rotation 0 -> 30 |
+| `487-layer-3d-roty-45.aep` | `3d.aep` | `487-layer-3d-roty-45` | FROM 485: Y Rotation 0 -> 45 |
+| `488-layer-3d-orientation-10-20-30.aep` | `3d.aep` | `488-layer-3d-orientation-10-20-30` | FROM 485: Orientation [0,0,0] -> [10,20,30] |
+| `509-marker-comp-two.aep` | `markers.aep` | `509-marker-comp-two` | FROM base: TWO comp markers in one call: t=1 s comment `M1` label 2; t=2.5 s comment `M2` duration 0.5 (read back as set) |
+| `510-marker-layer-0.52-dur0.3.aep` | `markers.aep` | `510-marker-layer-0.52-dur0.3` | FROM base (509 undone, comp markers 0): layer marker on L at t=0.52 s, comment `LM`, duration 0.3 s (read back 0.52 / 0.3) |
+| `512-fx-levels-inblack-0.1.aep` | `effects.aep` | `512-fx-levels-inblack-0.1` | FROM 511: Input Black 0 -> 0.1 (read back 0.10000000149012); the undo did NOT revert it; 513-516 were each made on a fresh reopen of a copy of 511 |
+| `514-fx-levels-gamma-2.aep` | `effects.aep` | `514-fx-levels-gamma-2` | FROM 511 (reopened): Gamma 1 -> 2 |
+| `516-fx-levels-outwhite-0.9.aep` | `effects.aep` | `516-fx-levels-outwhite-0.9` | FROM 511 (reopened): Output White 1 -> 0.9 (read back 0.89999997615814) |
+| `517-text-box-600x400-wrap.aep` | `text.aep` | `517-text-box-600x400-wrap` | FROM base: NEW box text layer `T`, box [600,400] at [-300,-200], text `The quick brown fox jumps over the lazy dog and keeps running far away` (Times New Roman, default style). AE text.measure: 4 composed lines `The quick brown fox ` / `jumps over the lazy dog ` / `and keeps running far ` / `away`, baselines y -163.80, -65.80, 32.20, 130.20 (left x -300), no overflow |
+| `519-shape-all-items-default.aep` | `shapes.aep` | `519-shape-all-items-default` | NEW shape layer `S`: Group 1 with, in this order, `property.add` of Rectangle Path, Ellipse Path, Polystar Path, Fill, Stroke, Gradient Fill, Gradient Stroke, Trim Paths, Round Corners, nothing set. AE read-back of the defaults: Rect Size [100,100], Position [0,0], Roundness 0, Shape Direction 1; Ellipse Size [100,100], Position [0,0]; Star Type 1, Points 5, Position [0,0], Rotation 0, Inner Radius 50, Outer Radius 100, Inner/Outer Roundness 0; Fill Blend Mode 1, Composite 1, Fill Rule 1, Color [1,0,0,1], Opacity 100; Stroke Color [1,1,1,1], Opacity 100, Width 2, Line Cap 1, Line Join 1, Miter Limit 4, Dashes Dash/Gap 1-3 = 10, Offset 0, Taper Length Units 1, lengths/widths/eases 0, Wave Amount 0, Units 1, Wavelength 100, Cycles 10, Phase 0; Gradient Fill/Stroke Type 1, Start Point [0,0], End Point [100,0], Highlight Length/Angle 0, Scale [100,100], Rotation 0, Colors NO_VALUE, Opacity 100 (stroke width 2, cap/join 1, miter 4); Trim Start 0, End 100, Offset 0, Trim Multiple Shapes 1; Round Corners Radius 10; Group Blend Mode 1, Transform Anchor/Position [0,0], Scale [100,100], Skew/Skew Axis/Rotation 0, Opacity 100; layer Anchor [0,0,0], Position [960,540,0] |
+| `526-text-point-HHHH-default.aep` | `text.aep` | `526-text-point-HHHH-default` | NEW point text layer `T` `HHHH` (layer.create_text, nothing else set: 100 px, the default character state). AE: style slot /13 = 1 (superscript); text.measure width 168.4 px, baseline -33.3 (58.3 % size, 33.3 % shift) |
+| `527-text-point-HHHH-baseline-normal.aep` | `text.aep` | `527-text-point-HHHH-baseline-normal` | T fontBaselineOption = normal (text.set_style): slot /13 = 0 (the only changed slot); width 288.9 px, baseline 0 |
+| `528-text-point-HHHH-baseline-subscript.aep` | `text.aep` | `528-text-point-HHHH-baseline-subscript` | T fontBaselineOption = subscript (text.set_style): slot /13 = 2; width 168.4 px, baseline +33.3 |
+| `529-fx-timewarp-default.aep` | `effects.aep` | `529-fx-timewarp-default` | Timewarp (`ADBE Timewarp`) on L at its defaults; AE read back Method 3 (Pixel Motion), Adjust Time By 1 (Speed), Speed 50, Source Frame 0; NOT undone: base of 530-533 |
+| `530-fx-timewarp-speed-25.aep` | `effects.aep` | `530-fx-timewarp-speed-25` | Speed 50 -> 25 (read back 25); undone |
+| `531-fx-timewarp-speed-keyed-50-200.aep` | `effects.aep` | `531-fx-timewarp-speed-keyed-50-200` | Speed keys 50 at 0 s and 200 at 2 s (linear; read back 125 at 1 s); undone |
+| `532-fx-timewarp-method-1.aep` | `effects.aep` | `532-fx-timewarp-method-1` | Method 3 -> 1 (Whole Frames); undone |
+| `533-fx-timewarp-sourceframe-12.aep` | `effects.aep` | `533-fx-timewarp-sourceframe-12` | Adjust Time By 2 (Source Frame) and Source Frame 12 (one batch); undone, and the Timewarp undone |
+| `534-fx-slider-expression-time10.aep` | `effects.aep` | `534-fx-slider-expression-time10` | Slider Control on L, expression `time*10` on Slider (read back 20 at 2 s); undone |
+| `535-camera-position-on-3d-rotx.aep` | `3d.aep` | `535-camera-position-on-3d-rotx` | NEW camera `K` (layer.create_camera, two-node), Position [100,200,-1000] (Point of Interest read back [960,540,0], Zoom 2666.67) |
+| `536-camera-one-node-position-on-3d-rotx.aep` | `3d.aep` | `536-camera-one-node-position-on-3d-rotx` | K autoOrient off (one-node) |
+| `537-camera-default-on-3d-rotx.aep` | `3d.aep` | `537-camera-default-on-3d-rotx` | NEW camera `K` at its defaults (Position read back [0,0,-2666.67]); 255 (POI [960,540,0], Position [0,0,-1333.33]) |
+| `538-text-point-HHHH-normal-ref.aep` | `text.aep` | `538-text-point-HHHH-normal-ref` | NEW point text `T` `HHHH` (layer.create_text) + fontBaselineOption normal in one batch (= the 527 state); noise reference of S17, NOT undone: base of 539-578 |
+| `539-text-hscale-0.9.aep` | `text.aep` | `539-text-hscale-0.9` | horizontalScale 0.9: style /6 1.0 -> 0.9 |
+| `540-text-vscale-1.5.aep` | `text.aep` | `540-text-vscale-1.5` | verticalScale 1.5: style /7 -> 1.5 |
+| `541-text-baselineshift-41.aep` | `text.aep` | `541-text-baselineshift-41` | baselineShift 41: style /9 0.0 -> 41.0 |
+| `542-text-autokern-none.aep` | `text.aep` | `542-text-autokern-none` | autoKernType none: style /11 1 -> 0 |
+| `543-text-autokern-optical.aep` | `text.aep` | `543-text-autokern-optical` | autoKernType optical: style /11 1 -> 2 (1 = metrics, the default) |
+| `544-text-applystroke-on.aep` | `text.aep` | `544-text-applystroke-on` | applyStroke true: style /57 false -> true |
+| `545-text-strokewidth-5.aep` | `text.aep` | `545-text-strokewidth-5` | strokeWidth 5: style /63 1.0 -> 5.0 |
+| `546-text-applyfill-off.aep` | `text.aep` | `546-text-applyfill-off` | applyFill false: style /56 true -> false |
+| `548-text-linejoin-round.aep` | `text.aep` | `548-text-linejoin-round` | lineJoinType round: style /62 0 -> 1 |
+| `550-text-strokeoverfill-off.aep` | `text.aep` | `550-text-strokeoverfill-off` | strokeOverFill false: style /58 true -> false |
+| `552-text-nobreak-on.aep` | `text.aep` | `552-text-nobreak-on` | noBreak true: style /52 -> true |
+| `553-text-tsume-0.5.aep` | `text.aep` | `553-text-tsume-0.5` | tsume 0.5: style /36 0.0 -> 0.5 |
+| `554-text-kerning-50.aep` | `text.aep` | `554-text-kerning-50` | kerning 50: style /11 1 -> 0 and the run gets a kern list `RUN/0/8/0[i]` = << /0 << /0 50 >> /1 1 >> per character (`RUN/0/7` = 50) |
+| `555-text-ligature-on.aep` | `text.aep` | `555-text-ligature-on` | ligature true: style /18 -> true |
+| `556-text-autohyphenate-off.aep` | `text.aep` | `556-text-autohyphenate-off` | autoHyphenate false: paragraph /9 true -> false |
+| `558-text-hangingroman-on.aep` | `text.aep` | `558-text-hangingroman-on` | hangingRoman true: paragraph /21 -> true |
+| `559-text-everyline-on.aep` | `text.aep` | `559-text-everyline-on` | everyLineComposer true: paragraph /29 false -> true |
+| `560-text-firstlineindent-20.aep` | `text.aep` | `560-text-firstlineindent-20` | firstLineIndent 20: paragraph /1 -> 20.0 |
+| `561-text-startindent-30.aep` | `text.aep` | `561-text-startindent-30` | startIndent 30: paragraph /2 -> 30.0 |
+| `562-text-endindent-40.aep` | `text.aep` | `562-text-endindent-40` | endIndent 40: paragraph /3 -> 40.0 |
+| `563-text-spacebefore-10.aep` | `text.aep` | `563-text-spacebefore-10` | spaceBefore 10: paragraph /4 -> 10.0 |
+| `564-text-spaceafter-12.aep` | `text.aep` | `564-text-spaceafter-12` | spaceAfter 12: paragraph /5 -> 12.0 |
+| `565-text-justify-fullleft.aep` | `text.aep` | `565-text-justify-fullleft` | justification fullLeft: paragraph /0 0 -> 3 |
+| `566-text-justify-fullcenter.aep` | `text.aep` | `566-text-justify-fullcenter` | fullCenter: /0 -> 5 |
+| `567-text-justify-fullright.aep` | `text.aep` | `567-text-justify-fullright` | fullRight: /0 -> 4 |
+| `568-text-justify-fullall.aep` | `text.aep` | `568-text-justify-fullall` | fullLastLineFull: /0 -> 6 |
+| `569-text-direction-rtl.aep` | `text.aep` | `569-text-direction-rtl` | direction rightToLeft: paragraph /33 0 -> 1 |
+| `571-text-digitset-arabic.aep` | `text.aep` | `571-text-digitset-arabic` | digitSet arabic: style /70 0 -> 1. Same session, not saved: text `1234` has the same layer.bounds with digitSet default and arabic (left 11.72, width 184.81, top -67.58, height 68.75); undone |
+| `572-text-leadingtype-japanese.aep` | `text.aep` | `572-text-leadingtype-japanese` | leadingType japanese: paragraph /8 0 -> 1 |
+| `573-text-baselinedir-rotated.aep` | `text.aep` | `573-text-baselinedir-rotated` | baselineDirection verticalRotated: style /35 1 -> 2 |
+| `575-text-vertical-rtl.aep` | `text.aep` | `575-text-vertical-rtl` | lineOrientation verticalRtl: document `/0/8/0[0]/0/2/1` -> 2 (absent before) |
+| `576-text-baselinedir-crossstream.aep` | `text.aep` | `576-text-baselinedir-crossstream` | baselineDirection verticalCrossStream: style /35 -> 3 |
+| `578-text-digitset-hindi.aep` | `text.aep` | `578-text-digitset-hindi` | digitSet hindi: style /70 -> 2 |
+| `579-textanim-position-0-m50.aep` | `text.aep` | `579-textanim-position-0-m50` | (538) text.add_animator `Animator 1` with Position 3D [0,-50,0], range selector at its defaults; NOT undone: base of 580-591 |
+| `580-textanim-start-25.aep` | `text.aep` | `580-textanim-start-25` | Range Selector 1 Start (ADBE Text Percent Start) 25 |
+| `581-textanim-end-75.aep` | `text.aep` | `581-textanim-end-75` | End 75 |
+| `582-textanim-offset-10.aep` | `text.aep` | `582-textanim-offset-10` | Offset 10 |
+| `583-textanim-units-index.aep` | `text.aep` | `583-textanim-units-index` | Advanced Units 2 (Index); read back Index Start 0, Index End 4 (the character count) |
+| `584-textanim-basedon-3-words.aep` | `text.aep` | `584-textanim-basedon-3-words` | Based On (ADBE Text Range Type2) 3 |
+| `585-textanim-mode-2-subtract.aep` | `text.aep` | `585-textanim-mode-2-subtract` | Mode 2 |
+| `586-textanim-amount-50.aep` | `text.aep` | `586-textanim-amount-50` | Amount (ADBE Text Selector Max Amount) 50 |
+| `587-textanim-shape-2-rampup.aep` | `text.aep` | `587-textanim-shape-2-rampup` | Shape 2 |
+| `588-textanim-smoothness-50.aep` | `text.aep` | `588-textanim-smoothness-50` | Smoothness 50 |
+| `589-textanim-easehigh-30.aep` | `text.aep` | `589-textanim-easehigh-30` | Ease High (ADBE Text Levels Max Ease) 30 |
+| `590-textanim-easelow-40.aep` | `text.aep` | `590-textanim-easelow-40` | Ease Low (ADBE Text Levels Min Ease) 40 |
+| `591-textanim-randomize-seed-7.aep` | `text.aep` | `591-textanim-randomize-seed-7` | Randomize Order 1 + Random Seed 7 (one batch) |
+| `592-textanim-many-props.aep` | `text.aep` | `592-textanim-many-props` | FROM 579: second animator `Many`: Anchor Point 3D [3,4,0], Scale 3D [150,120,100], Skew 10, Skew Axis 20, Rotation 45, Opacity 37, Fill Color [0,1,0], Stroke Color [0,0,1], Stroke Width 3, Tracking Amount 20 (AE added Track Type itself; setting it failed), Line Spacing [10,20], Blur [5,6] (read back) |
+| `593-textanim-start-keyed-ease-0-100.aep` | `text.aep` | `593-textanim-start-keyed-ease-0-100` | FROM 592: Animator 1 Start keys 0 at 0 s, 100 at 2 s, interp ease (keyframe.apply) |
+| `594-textanim-position-start-keyed-ease.aep` | `text.aep` | `594-textanim-position-start-keyed-ease` | 593 with animator `Many` removed (Animator 1 only: Position [0,-50,0], Start 0 -> 100 eased over 0..2 s) |
+| `595-text-stroke-scale-shift-combined.aep` | `text.aep` | `595-text-stroke-scale-shift-combined` | 538 state (Animator 1 removed) + applyStroke, strokeWidth 5, strokeColor blue, horizontalScale 0.9, verticalScale 1.5, baselineShift 41 (one call) |
+| `596-text-combined-fill-over-stroke.aep` | `text.aep` | `596-text-combined-fill-over-stroke` | 595 + strokeOverFill false |
+| `597-key-anchor-ease-out50-40-in30-60.aep` | `keyframes.aep` | `597-key-anchor-ease-out50-40-in30-60` | L Anchor Point keys [960,540] at 0 s (out speed 50, influence 40) and [1160,640] at 2 s (in speed 30, influence 60), keyframe.apply ease; read back (re-applied in the same session): 0.5 s [1004.4121, 562.2061], 1 s [1084.8353, 602.4177], 1.5 s [1137.1339, 628.5670] |
+| `598-key-ramp-point-ease-color-bezier.aep` | `keyframes.aep` | `598-key-ramp-point-ease-color-bezier` | Gradient Ramp on L: Start of Ramp keys [100,200] at 0 s (out 50 / 40) and [500,400] at 2 s (in 30 / 60): read back 0.5 s [178.4012, 239.2006], 1 s [353.0563, 326.5281], 1.5 s [462.9131, 381.4566]; Start Color keys red at 0 s and blue at 2 s switched to bezier by keyframe.set_interpolation (a custom colour ease is refused by AE: "Value array does not have 1 elements"): read back 0.5 s [0.75,0,0.25], 1 s [0.5,0,0.5], 1.5 s [0.25,0,0.75] |
+| `599-key-mask-path-ease-infl75.aep` | `masks.aep` | `599-key-mask-path-ease-infl75` | L rect mask, path keys 200x200 at 0 s and 600x400 at 2 s (both centred), ease speed 0, out influence 75 on key 1, in influence 75 on key 2; first vertex read back 0.5 s [849.1606, 434.5803], 1 s [760.0, 390.0], 1.5 s [670.8394, 345.4197] |
+| `601-precomp-two-comps-in-C.aep` | `footage-precomp.aep` | `601-precomp-two-comps-in-C` | FROM 600: new comp `Q` 320x240, 25 fps, 2 s with a blue 320x240 solid `B320`, Q added as a layer on top in C (C now shows P30 and Q) |
+| `603-footage-exrseq-0101-as-layer.aep` | `footage-precomp.aep` | `603-footage-exrseq-0101-as-layer` | project.import_file `test-media\exrseq\shot_0101.exr` sequence=true -> item `shot_[0101-0103].exr` (64x48, 0.1 s = 3 frames at 30 fps) + layer on top of L in C |
+| `610-fx-tint-named-My-Tint.aep` | `effects.aep` | `610-fx-tint-named-My-Tint` | effect.add `ADBE Tint` on L with name `My Tint` (effect.list_on_layer: name `My Tint`) |
+| `621-settings-bpc-8.aep` | `settings-a.aep` | `621-settings-bpc-8` | project.set_settings bitsPerChannel 8 |
+| `622-settings-bpc-16.aep` | `settings-c.aep` | `622-settings-bpc-16` | bitsPerChannel 16 |
+| `623-settings-workingspace-none.aep` | `settings-a.aep` | `623-settings-workingspace-none` | workingSpace '' (read back None) |
+| `625-settings-gamma-2.4.aep` | `settings-a.aep` | `625-settings-gamma-2.4` | workingGamma 2.4 |
+| `628-settings-scene-compensation-off.aep` | `settings-a.aep` | `628-settings-scene-compensation-off` | compensateForSceneReferredProfiles false |
+| `629-settings-time-display-frames.aep` | `settings-a.aep` | `629-settings-time-display-frames` | timeDisplayType frames |
+| `630-settings-frame-start-1.aep` | `settings-a.aep` | `630-settings-frame-start-1` | displayStartFrame 1 |
+| `632-settings-linearize-and-blend-linear.aep` | `settings-b.aep` | `632-settings-linearize-and-blend-linear` | linearizeWorkingSpace + linearBlending true |
+| `633-settings-feet-frames-35.aep` | `settings-b.aep` | `633-settings-feet-frames-35` | timeDisplayType frames + framesUseFeetFrames true (film type mm35, read back) |
+| `634-settings-feet-frames-16.aep` | `settings-c.aep` | `634-settings-feet-frames-16` | FROM 633 (same session, not reopened): feetFramesFilmType mm16 |
+| `641-stretch-200-keys-position-1s-2s.aep` | `keyframes.aep` | `641-stretch-200-keys-position-1s-2s` | layer.set_timing stretch 200 on L, then the same two keys at comp 1 s and 2 s (read back: out 10, keys at 1 and 2) |
+| `642-stretch-50-keys-position-1s-2s.aep` | `keyframes.aep` | `642-stretch-50-keys-position-1s-2s` | stretch 50 (out 2.5), keys at comp 1 s and 2 s |
+| `643-stretch-200-start-1-keys-position-2s-3s.aep` | `keyframes.aep` | `643-stretch-200-start-1-keys-position-2s-3s` | startTime 1 + stretch 200 (in 1, out 11), keys at comp 2 s and 3 s |
+| `645-footage-mp4-conform-30.aep` | `footage-precomp.aep` | `645-footage-mp4-conform-30` | FROM 644: footage.interpret conformFrameRate 30 on clip.mp4 (25 fps native; duration 1 -> 0.8333 s) |
+| `650-footage-tga-still-as-layer.aep` | `footage-precomp.aep` | `650-footage-tga-still-as-layer` | (fresh base) import `test-media\still.tga` (64x48, PIL from still.png) + layer in C |
+| `651-footage-psd-flat-as-layer.aep` | `footage-precomp.aep` | `651-footage-psd-flat-as-layer` | import `test-media\still.psd` (flat RGB PSD written by hand) importAs footage + layer in C |
+| `652-footage-ai-as-layer.aep` | `footage-precomp.aep` | `652-footage-ai-as-layer` | import `test-media\still.ai` (hand-written one-page PDF named .ai, 64x48 pt) importAs footage + layer in C |
+| `653-footage-eps-as-layer.aep` | `footage-precomp.aep` | `653-footage-eps-as-layer` | import `test-media\still.eps` (hand-written EPS, 64x48 pt) + layer in C |
+| `700-key-mask-path-ease-out20-in50.aep` | `masks.aep` | `700-key-mask-path-ease-out20-in50` | from 599: out influence 20 on key 1, in influence 50 on key 2 (speed 0); first vertex 0.5 s [803.9844, 411.9922], 1 s [727.6194, 373.8097], 1.5 s [676.9510, 348.4755] |
+| `701-light-parallel-int80-color.aep` | `3d.aep` | `701-light-parallel-int80-color` | NEW parallel light `P`, Intensity 80, Color [1,0.5,0.25] |
+| `702-light-ambient-int50-color.aep` | `3d.aep` | `702-light-ambient-int50-color` | NEW ambient light `A`, Intensity 50, Color [0.25,0.5,1] |
+| `703-key-orientation-0-to-10-20-30-linear.aep` | `3d.aep` | `703-key-orientation-0-to-10-20-30-linear` | L 3D, Orientation keys [0,0,0] at 0 s and [10,20,30] at 2 s (linear): read back 0.5 s [3.4341, 4.4691, 7.7129], 1 s [6.2643, 9.3531, 15.2190], 1.5 s [8.4650, 14.5598, 22.6095] (not per-component linear) |
+| `704-light-environment-default.aep` | `3d.aep` | `704-light-environment-default` | NEW environment light `E` at its defaults |
+| `705-mask-on-text-rect-40-m70-160-10.aep` | `text.aep` | `705-mask-on-text-rect-40-m70-160-10` | NEW point text `T` `HHHH` (normal baseline) with a rect mask (mask.add centre [100,-30], size [120,80]): vertices read back [40,-70] [160,-70] [160,10] [40,10] (layer space) |
+| `706-mask-on-shape-rect-0-m150-100-150.aep` | `masks.aep` | `706-mask-on-shape-rect-0-m150-100-150` | NEW shape layer `S` (Group 1: Rectangle 400x200, Fill green) with a rect mask centre [50,0] size [100,300]: vertices [0,-150] [100,-150] [100,150] [0,150] |
+| `707-shape-merge-subtract-rect-ellipse.aep` | `shapes.aep` | `707-shape-merge-subtract-rect-ellipse` | S without the mask: Rectangle, Ellipse 200x200, Merge Paths mode subtract (read back Merge Type 3), Fill (moved last) |
+| `708-shape-merge-intersect-rect-ellipse.aep` | `shapes.aep` | `708-shape-merge-intersect-rect-ellipse` | 707 with Merge Type 4 |
+| `709-shape-repeater-3-pos150-60-rot10-scale90-80-op40.aep` | `shapes.aep` | `709-shape-repeater-3-pos150-60-rot10-scale90-80-op40` | S: Rectangle, Fill, Repeater (Copies 3, Position [150,60], Rotation 10, Scale [90,80], End Opacity 40) |
+| `710-shape-offset-paths-20-round.aep` | `shapes.aep` | `710-shape-offset-paths-20-round` | S: Rectangle, Offset Paths (Amount 20, Line Join round), Fill |
+| `711-fx-directional-blur-30-40-on-M.aep` | `effects.aep` | `711-fx-directional-blur-30-40-on-M` | Directional Blur (ADBE Motion Blur) on M: Direction 30, Blur Length 40 |
+| `712-fx-eleven-effects-defaults-on-M.aep` | `effects.aep` | `712-fx-eleven-effects-defaults-on-M` | M with, in this order, Radial Blur, CC Radial Blur, Venetian Blinds, Channel Blur, Black & White, Tritone, Luma Key, Simple Choker, Matte Choker, Transform (ADBE Geometry2), Set Matte (ADBE Set Matte3), all at their defaults |
+| `713-fx-radial-blur-zoom-20-on-M.aep` | `effects.aep` | `713-fx-radial-blur-zoom-20-on-M` | Radial Blur: Amount 20, Center [600,300], Type 2 (Zoom), Antialiasing 2 (High) |
+| `714-fx-ccradial-type2-30-60-on-M.aep` | `effects.aep` | `714-fx-ccradial-type2-30-60-on-M` | CC Radial Blur: Type 2, Amount 30, Quality 60, Center [400,200] |
+| `715-fx-venetian-40-30-50-5-on-M.aep` | `effects.aep` | `715-fx-venetian-40-30-50-5-on-M` | Venetian Blinds: Completion 40, Direction 30, Width 50, Feather 5 |
+| `716-fx-channel-blur-5-10-15-20-edge-horiz-on-M.aep` | `effects.aep` | `716-fx-channel-blur-5-10-15-20-edge-horiz-on-M` | Channel Blur: R 5, G 10, B 15, A 20, Edge Behavior (Repeat Edge Pixels) 1, Blur Dimensions 2 |
+| `717-fx-blackwhite-set-tint-on-L.aep` | `effects.aep` | `717-fx-blackwhite-set-tint-on-L` | Black & White on L: Reds 10, Yellows 70, Greens 30, Cyans 50, Blues 90, Magentas 20, Tint 1, Tint Color [1,0.5,0] |
+| `718-fx-tritone-set-blend25-on-L.aep` | `effects.aep` | `718-fx-tritone-set-blend25-on-L` | Tritone on L: Highlights [1,1,0.8], Midtones [0.6,0.2,0.2], Shadows [0,0,0.3], Blend With Original 25 |
+| `719-fx-lumakey-darker-140-20-1-2.5-on-M.aep` | `effects.aep` | `719-fx-lumakey-darker-140-20-1-2.5-on-M` | Luma Key on M: Key Type 2, Threshold 140, Tolerance 20, Edge Thin 1, Edge Feather 2.5 |
+| `720-fx-simplechoker-3.5-on-M.aep` | `effects.aep` | `720-fx-simplechoker-3.5-on-M` | Simple Choker: Choke Matte 3.5 |
+| `721-fx-simplechoker-3.5-view-matte-on-M.aep` | `effects.aep` | `721-fx-simplechoker-3.5-view-matte-on-M` | 720 + View 2 |
+| `722-fx-mattechoker-set-on-M.aep` | `effects.aep` | `722-fx-mattechoker-set-on-M` | Matte Choker: Geometric Softness 1 6, Choke 1 50, Geometric Softness 2 2, Choke 2 -10, Iterations 3 (Gray Level Softness 1 / 2 refused by AE: "Unable to call setValue", left at their defaults) |
+| `723-fx-transform-set-on-M.aep` | `effects.aep` | `723-fx-transform-set-on-M` | Transform: Anchor [400,200], Position [500,300], Uniform Scale 0, Scale Height 80, Scale Width 120, Skew 10, Skew Axis 20, Rotation 30, Opacity 70, Use Composition's Shutter Angle 0, Shutter Angle 90, Sampling 2 |
+| `725-text-point-HHHH-normal-ref-S18.aep` | `text.aep` | `725-text-point-HHHH-normal-ref-S18` | (fresh base) point text `T` `HHHH`, baseline normal: reference of S18 (= 538) |
+| `727-text-reset-paragraph.aep` | `text.aep` | `727-text-reset-paragraph` | (726 undone) text.reset_style paragraph: ONLY paragraph /34 0 -> 7. Same session, not saved: a 600x400 box text of 88 characters, justified (fullLeft), lays out identically before and after a paragraph reset (text.measure: 4 lines, the same breaks and baselines -130.50 / -32.50 / 65.50 / 163.50; layer.bounds identical) |
+| `728-textanim-character-offset-3.aep` | `text.aep` | `728-textanim-character-offset-3` | 727 + text.add_animator `Off` with Character Offset 3; AE adds Character Alignment (ADBE Text Character Change Type) 1 and Character Range 1 with it (read back); setting Character Range to 2 is refused by AE ("Can not set value") |
+| `730-key-anchor-ease-on-400x800-solid.aep` | `keyframes.aep` | `730-key-anchor-ease-on-400x800-solid` | NEW blue solid `P` 400x800, Anchor Point keys [200,400] at 0 s (out speed 50, influence 40) and [300,500] at 2 s (in speed 30, influence 60); stored speeds 0.0625 / 0.0375 = 50 / 800 and 30 / 800 (597: 50 / 1080 on the 1920x1080 L), so a stored spatial speed is pixels per second divided by the layer height; read back 0.5 s [225.2343, 425.2343], 1 s [261.4341, 461.4341], 1.5 s [286.0550, 486.0550] |
+| `731-shape-merge-offset-repeater-defaults.aep` | `shapes.aep` | `731-shape-merge-offset-repeater-defaults` | NEW shape layer `S`: Group 1 with Rectangle 400x200, then property.add of Merge Paths, Offset Paths, Repeater, nothing set; read back: Merge Type 1; Offset Amount 10, Line Join 1, Miter Limit 4, Copies 1, Copy Offset 1; Repeater Copies 1, Offset 0, Composite 1, Anchor [0,0], Position [0,0], Scale [100,100], Rotation 0, Start / End Opacity 100 / 100 (the values of a property without a record; the UI's Add menu and shape.add_repeater store their own) |
+| `732-text-box-byteedit-para24-0.aep` | `text.aep` | `732-text-box-byteedit-para24-0` | 517 with paragraph `/23 true /24 1` -> `/24 0` (the run's paragraph); layout identical to 517 (4 lines, baselines -163.80 / -65.80 / 32.20 / 130.20, bounds 563.61 x 347.06); 732r-resaved keeps `/24 0` |
+| `733-text-box-byteedit-para35-0.aep` | `text.aep` | `733-text-box-byteedit-para35-0` | 517 with paragraph `/34 0 /35 1` -> `/35 0`; layout identical (line ends within 1e-4 px); 733r-resaved keeps `/35 0` |
+| `734-text-box-byteedit-style68-1.aep` | `styles.aep` | `734-text-box-byteedit-style68-1` | 517 with style `/68 0 /69 0` -> `/68 1` (3 occurrences: style sheet and runs); layout identical; 734r-resaved keeps `/68 1` |
+| `828-shape-offset-paths-20-copies3-copyoffset1.5-stroke.aep` | `shapes.aep` | `828-shape-offset-paths-20-copies3-copyoffset1.5-stroke` | shape `S`: Rectangle 400x200, Offset Paths Amount 20, Stroke 2 px green: Copies 1 / Copy Offset 0 -> ring at the path, Copies 3 / Copy Offset 0 -> offsets 0, 20, 40, Copies 3 / Copy Offset 1.5 -> 30, 50, 70: offset of copy i = Amount x (i + Copy Offset) |
+| `851-shape-key-trim-end-0-100-linear.aep` | `shapes.aep` | `851-shape-key-trim-end-0-100-linear` | Trim End keys 0 at 0 s, 100 at 2 s, linear (keyframe.apply); undone |
+| `852-shape-key-trim-end-bezier-out0-60-in20-30.aep` | `shapes.aep` | `852-shape-key-trim-end-bezier-out0-60-in20-30` | Trim End keys 0 at 0 s (bezier, out speed 0 / influence 60) and 100 at 2 s (bezier, in speed 20 / influence 30); read back in ease of key 1 0 / 33, out of key 2 0 / 33; undone |
+| `853-shape-key-group-position-0-200-100-linear.aep` | `shapes.aep` | `853-shape-key-group-position-0-200-100-linear` | Group 1 Transform Position keys [0,0] at 0 s, [200,100] at 2 s, linear; undone |
+| `854-shape-key-fill-color-red-blue-linear.aep` | `shapes.aep` | `854-shape-key-fill-color-red-blue-linear` | Fill Color keys red at 0 s, blue at 2 s, linear; undone |
+| `855-shape-key-trim-offset-0-90-hold.aep` | `shapes.aep` | `855-shape-key-trim-offset-0-90-hold` | Trim Offset keys 0 at 0 s (linear), 90 at 2 s (hold); undone |
+| `856-shape-trim-end-expression-time50.aep` | `shapes.aep` | `856-shape-trim-end-expression-time50` | Trim End expression `time*50` (no keys); undone |
+| `857-shape-key-group-scale-100-50-150-linear.aep` | `shapes.aep` | `857-shape-key-group-scale-100-50-150-linear` | Group 1 Transform Scale keys [100,100] at 0 s, [50,150] at 2 s, linear; undone (base state verified by layer.info) |
+| `900-mask-added-no-path.aep` | `masks.aep` | `900-mask-added-no-path` | property.add `ADBE Mask Atom` on L, nothing set: the file stores the atom WITHOUT an `ADBE Mask Shape` entry (only `ADBE Group End`); read back (also after reopening) Mask Path closed [[0,0],[0,1080],[1920,1080],[1920,0]], tangents 0 = the layer's source rectangle |
+| `901-mask-no-path-expansion-m100.aep` | `masks.aep` | `901-mask-no-path-expansion-m100` | from 900: Mask Expansion -100 (only `ADBE Mask Offset` stored) |
+| `902-settings-rec709-16bpc-steps-png-grey-solid.aep` | `settings-c.aep` | `902-settings-rec709-16bpc-steps-png-grey-solid` | from 901: mask removed, project 16 bpc + working space Rec.709 Gamma 2.4; footage `test-media\steps.png` (sRGB PNG, no profile; top bands 0,16,32,64,96,128,160,192,224,255 grey, bottom (v, v/2, 255-v)) as layer `S`, grey 0.5 solid `G` 400x200 at [1600,900] on top |
+| `905-fx-24-effects-set-one-comp.aep` | `effects.aep` | `905-fx-24-effects-set-one-comp` | the 24 effects and values of 904 in ONE comp `C` (L deleted): `R` = grey 0.5 solid with Gradient Ramp, video off, at the bottom (id 30); 24 layers E01..E24 = steps.png, each with the one effect of the 904 comp of the same name (E24 on top); the layer parameters of E22-E24 name R. Made as a smaller fixture than 904 (0.6 MB against 2 MB); no |
+| `906-blendmodes-13-solids-on-steps.aep` | `layers-comps.aep` | `906-blendmodes-13-solids-on-steps` | L deleted; `S` = steps.png; 13 solids 300x300 [0.9,0.5,0.2] (named by mode) at a 320 x 360 px grid, each with layer.set_blend_mode normal, add, multiply, screen, overlay, softLight, hardLight, difference, exclusion, colorDodge, colorBurn, darken, lighten: `ldta`@99 = 2, 4, 5, 6, 7, 8, 9, 26, 25, 27, 28, 10, 11 |
+| `951-styles-all-nine-defaults-on-B.aep` | `styles.aep` | `951-styles-all-nine-defaults-on-B` | from 950: on B `command.execute` 9000, 9001, 9002, 9003, 9004, 9005, 9006, 9007, 9008 (one call each), nothing set. AE read-back of the defaults (property.get): Drop Shadow mode2 5, color [0,0,0,1], opacity 75, useGlobalAngle 0, localLightingAngle 120, distance 5, chokeMatte 0, blur 5, noise 0, layerConceals 1; Inner Shadow mode2 5, color [0,0,0,1], opacity 75, useGlobalAngle 0, angle 120, distance 5, chokeMatte 0, blur 5, noise 0; Outer Glow mode2 11, opacity 75, noise 0, AEColorChoice 1, color [1,1,0.74509803921569,1], gradientSmoothness 100, glowTechnique 1, chokeMatte 0, blur 5, inputRange 50, shadingNoise 0; Inner Glow as Outer Glow plus innerGlowSource 1; Bevel and Emboss bevelStyle 2, bevelTechnique 1, strengthRatio 100, bevelDirection 1, blur 5, softness 0, useGlobalAngle 0, angle 120, altitude 30, highlightMode 11, highlightColor [1,1,1,1], highlightOpacity 75, shadowMode 5, shadowColor [0,0,0,1], shadowOpacity 75; Satin (chromeFX) mode2 5, color [0,0,0,1], opacity 50, angle 19, distance 11, blur 14, invert 1; Color Overlay (solidFill) mode2 1, color [1,0,0,1], opacity 100; Gradient Overlay mode2 1, opacity 100, gradientSmoothness 100, angle 90, type 1, reverse 0, align 1, scale 100, offset [0,0] (gradient not read); Stroke (frameFX) mode2 1, color [1,0,0,1], size 3, opacity 100, style 1; Blending Options Global Light Angle 120, Altitude 30, Fill Opacity 100, R/G/B Channel Blend 1, Blend Interior 0, Blend Ranges 1 |
+| `963-curves-red-mid-down-on-S.aep` | `styles.aep` | `963-curves-red-mid-down-on-S` | from 984: apply `curves-red-mid-down.ffx` (Red curve: middle point dragged down). AE read-back: Channel: 1 (RGB, default; the editor channel Red is not the Channel parameter), Curves not readable. File: Red curve (0,0) (128,44) (255,255) |
+| `964-curves-rgb-s-curve-on-S.aep` | `styles.aep` | `964-curves-rgb-s-curve-on-S` | from 984: apply `curves-rgb-two-points.ffx` (RGB S-curve: a point at about 1/4 dragged down, one at 3/4 up). AE read-back: Channel: 1, Curves not readable. File: RGB curve (0,0) (62,24) (194,230) (255,255) |
+| `966-style-drop-shadow-opacity50-distance20.aep` | `styles.aep` | `966-style-drop-shadow-opacity50-distance20` | from 952 (opened): dropShadow/opacity 75 -> 50, dropShadow/distance 5 -> 20 (read back 50, 20) |
+| `970-style-stroke-size10-color-green.aep` | `styles.aep` | `970-style-stroke-size10-color-green` | from 960: frameFX/size 3 -> 10, frameFX/color [1,0,0,1] -> [0,1,0,1] (read back 10, [0,1,0,1]) |
+| `974-style-gradient-overlay-angle45-scale150.aep` | `styles.aep` | `974-style-gradient-overlay-angle45-scale150` | from 959: gradientFill/angle 90 -> 45, gradientFill/scale 100 -> 150 (read back 45, 150); the gradient colours were not touched |
+| `975-style-fill-opacity0-with-drop-shadow.aep` | `styles.aep` | `975-style-fill-opacity0-with-drop-shadow` | from 952: ADBE Layer Fill Opacity2 100 -> 0 (Layer Styles > Blending Options > Advanced Blending > Fill Opacity; read back 0) |
+| `976-style-drop-shadow-opacity-keyed-100-20-linear.aep` | `styles.aep` | `976-style-drop-shadow-opacity-keyed-100-20-linear` | from 952: dropShadow/opacity keys t=0 -> 100, t=2 -> 20, linear (keyframe.apply); read back 100 / 60 / 20 at 0 / 1 / 2 s |
+| `977-styles-all-params-changed.aep` | `styles.aep` | `977-styles-all-params-changed` | on B every settable parameter of the nine styles and Blending Options set by `property.set` (one batch): Global Angle2 45, Global Altitude2 40, Fill Opacity2 80, R Channel Blend 0, Blend Interior 1, Blend Ranges 0; dropShadow mode2 1, color [0,0,1], opacity 60, useGlobalAngle 1, localLightingAngle 30, distance 12, chokeMatte 10, blur 8, noise 5, layerConceals 0; innerShadow mode2 1, color [0,1,0], opacity 55, useGlobalAngle 1, localLightingAngle 60, distance 7, chokeMatte 15, blur 9, noise 3; outerGlow mode2 1, opacity 65, noise 2, AEColorChoice 2, color [1,0,0], gradientSmoothness 80, glowTechnique 2, chokeMatte 12, blur 20, inputRange 40, shadingNoise 10; innerGlow mode2 1, opacity 45, noise 4, AEColorChoice 2, color [0,1,0], gradientSmoothness 70, glowTechnique 2, innerGlowSource 2, chokeMatte 8, blur 15, inputRange 30, shadingNoise 20; bevelEmboss bevelStyle 1, bevelTechnique 2, strengthRatio 150, bevelDirection 2, blur 10, softness 3, useGlobalAngle 1, localLightingAngle 70, localLightingAltitude 50, highlightMode 1, highlightColor [1,1,0], highlightOpacity 60, shadowMode 1, shadowColor [0,0,1], shadowOpacity 40; chromeFX mode2 1, color [1,0,1], opacity 70, localLightingAngle 45, distance 20, blur 10, invert 0; solidFill mode2 5, color [0,1,1], opacity 50; gradientFill mode2 5, opacity 70, gradientSmoothness 50, angle 30, type 2, reverse 1, align 0, scale 120, offset [10,20]; frameFX mode2 5, color [0,0,1], size 6, opacity 80, style 2. (Values equal to the default, e.g. dropShadow mode2 1 is not: default 5.) Purpose: one record of every parameter type. property.list read the exact match names (inner shadow / satin angle = `localLightingAngle`; Blending Options = `ADBE Global Angle2`, `ADBE Global Altitude2`, Adv Blend `ADBE Layer Fill Opacity2`, `ADBE R/G/B Channel Blend`, `ADBE Blend Interior`, `ADBE Blend Ranges`; no Knockout) |
+| `979-style-inner-glow-source-2.aep` | `styles.aep` | `979-style-inner-glow-source-2` | innerGlow/innerGlowSource 1 -> 2; 955 centre unchanged 51,102,204) -> 1 = Edge, 2 = Center |
+| `981-layer-stretch-minus100-start5.aep` | `keyframes.aep` | `981-layer-stretch-minus100-start5` | L: layer.set_timing stretch -100, then startTime 5; AE reads startTime 5, inPoint 4.99967, outPoint -0.00033, stretch -100 |
+| `982-layer-stretch-minus100-opacity-keys.aep` | `keyframes.aep` | `982-layer-stretch-minus100-opacity-keys` | from 981 (not undone): Opacity keys added at comp time 0 -> 100 and comp 4 -> 20 (keyframe.add); AE lists the keys at 4.00002 (20) and 0.00002 (100), reads 80 at comp 1 s, 40 at 3 s |
+| `983-layer-stretch-minus50-opacity-keys.aep` | `keyframes.aep` | `983-layer-stretch-minus50-opacity-keys` | from 982: stretch -100 -> -50 (keys kept); AE: inPoint 4.99983, outPoint 2.49983, keys at comp 4.5 (20) and 2.5 (100) |
+| `985-meshwarp-3x3-vertex-moved-on-S.aep` | `styles.aep` | `985-meshwarp-3x3-vertex-moved-on-S` | from 984: apply `meshwarp-3x3-center-right.ffx` (Rows 3, Columns 3 = 3x3 cells, 4x4 vertices; the contributor dragged the LOWER-RIGHT INNER vertex (row 2, column 2, 0-based) to the right, its tangents moved with it). AE read-back: Rows 3, Columns 3, Quality 8, Distortion Mesh not readable. File: that vertex at (0.73542, 0.66481) of the layer = +132 px, -2 px; the instance mesh is byte-identical to the one in the user's `presets\presets-reference.aep` |
+| `986-shape-fill-switched-off-green.aep` | `shapes.aep` | `986-shape-fill-switched-off-green` | from 850: the Fill group's `tdsb` 1 -> 0 patched in a copy (the item eye switch is not scriptable), opened with project.open, Fill Color set to green by property.set, saved by After Effects (it keeps `tdsb` 0); centre 255,0,0 = the solid L) |
+| `988-style-drop-shadow-switched-off.aep` | `styles.aep` | `988-style-drop-shadow-switched-off` | from 952: the `dropShadow/enabled` group `tdsb` 1 -> 0 patched in a copy (the style eye is not scriptable), opened with project.open (AE lists the style, Opacity 75),; Layer Styles and Blending Options stay 1) |
diff --git a/crates/aep/tests/fixtures/ai-mask-3099.aep b/crates/aep/tests/fixtures/ai-mask-3099.aep
new file mode 100644
index 000000000..7223fda82
Binary files /dev/null and b/crates/aep/tests/fixtures/ai-mask-3099.aep differ
diff --git a/crates/aep/tests/fixtures/ai-mask-3099.aep.attribution b/crates/aep/tests/fixtures/ai-mask-3099.aep.attribution
new file mode 100644
index 000000000..86efa3b65
--- /dev/null
+++ b/crates/aep/tests/fixtures/ai-mask-3099.aep.attribution
@@ -0,0 +1,7 @@
+asset:        ai-mask-3099.aep
+title:        Small After Effects test project: placed .ai files with masks under two parented Nulls (#3099)
+author:       EffectCraft contributors
+source:       original work (made in After Effects 2026 from own data: four hand-written one-page PDFs named .ai, generated by tools/ai-mask-3099.py, imported and laid out by tools/ai-mask-3099.jsx)
+license:      MIT OR Apache-2.0
+added:        2026-11-08 by EffectCraft contributors
+notes:        Scrubbed with tools/scrub.py (footage paths C:\fixture\x\<name>.ai of the same length, host name HOST000, the XMP packet of an empty project of the contributor); its four embedded colour profiles replaced by stubs (description only, no colour data) with crates/aep/examples/stubicc.rs, then checked with the corpus repository's tools/aep/inspect-embedded.py (CLEAN). No Adobe asset is in it.
diff --git a/crates/aep/tests/fixtures/corpus.lock b/crates/aep/tests/fixtures/corpus.lock
new file mode 100644
index 000000000..4971944c5
--- /dev/null
+++ b/crates/aep/tests/fixtures/corpus.lock
@@ -0,0 +1,31 @@
+# Pinned After Effects test corpus for `crates/aep` (read by `cargo xtask aep-corpus`).
+#
+#   repo      where the corpus lives (override: EFFECTCRAFT_AEP_CORPUS_REPO, e.g. a local clone)
+#   commit    the exact commit to fetch (40 hex digits; a branch or tag name is not accepted)
+#   <sha256>  <path>   the SHA-256 of every file the tests use, relative to the corpus root
+#
+# The hashes are kept here, not read from the fetched repository, so a changed corpus
+# cannot vouch for itself. To move the pin: change `commit`, then copy the new SHA256SUMS lines.
+repo https://github.com/storytold/effectcraft-corpus.git
+commit 97262276f625afdeeb61787e4cbb74b3f17af510
+
+4a51318c4b37fa95e2c02682183d3982fdfbe1870dc50ba729b776d1826f982e  aep/3d.aep
+da8ba17d095ddb1576db658ad28a3966d7231244cf0391f77d71d7aa68c6e085  aep/aepx-pair.aep
+59e79c1621de108a4960d2bb6b14bc54e39df658f459af777b50fa95f2b7b32b  aep/aepx-pair.aepx
+2e1a59562b52eb97ce32ccc7810a54f0671eae567d1d9869041b391d3cc4a20c  aep/effects.aep
+1e10b8ee47f43c5cd6e19710fbab28f498f8b73dbfa1a8f830ae41ad3b1c19ef  aep/empty.aep
+b4ee29ebd0d46b6013efc05c0f8cce4be61ce2d5b8bc38c5a814b86bceeee286  aep/footage-precomp.aep
+7e162f536d422daffbe909b50fdd83d7160c6b150ce6c34216c65dba46ab87cb  aep/fx-switch.aep
+f6ce60a8ed0fa786625078f61995e1184ef0b016efaeeb0b4ae6337831697821  aep/inputs/curves-red-mid-down.ffx
+e3992190150366b01859e32adcb9bbe2e0ef492bd2259a8b7e85b571afeca24f  aep/inputs/curves-rgb-two-points.ffx
+4a0cd5a0e52d8d14ee0f895b0a3e054199d399094b410a7b2a620eb484d5cba8  aep/inputs/meshwarp-3x3-center-right.ffx
+baad5a326f255797c03b3cc0a776524b7eabfb217fbc301b0596ac3e4e97d71b  aep/keyframes.aep
+57184fec75ec8892ac6c8ac360274fdaa4fc4ed39093f969f30a45fbf2afaf9e  aep/layers-comps.aep
+fca73b3e4f5398a0ab686b74d8eb3e1c2dd37c7db0e8a31b2e0f45ba0bb3c8ff  aep/markers.aep
+93d6a9f2a2980d999bcb628a4e7220d1922b1c535d535663f69043778322d72f  aep/masks.aep
+c3255249dd29279cc6a14c156a0acb82b0bc255a0be77c0178a9c4bc891206a5  aep/settings-a.aep
+b4a61e988743b0f6b5a7ad6875f958ccf173fcf0d7d6097c441a0aa71c5e1fd7  aep/settings-b.aep
+71ba74dade2ef411026a55a945d573cf059ff03aeb2d527fe2c6833e13174df3  aep/settings-c.aep
+9035039df7c34f04c33337719a2fef5ba93db5d2317434eb3476906571654d3b  aep/shapes.aep
+5fe35e08d05e72583fdd19e02878cc974136736e39090fab9d84d132fb2b4d35  aep/styles.aep
+fded434b54532f9001c53a3482deed0c157f76ee067b354a801ec9c2747002db  aep/text.aep
diff --git a/crates/aep/tests/fixtures/synthetic.aep b/crates/aep/tests/fixtures/synthetic.aep
new file mode 100644
index 000000000..7b51e1360
Binary files /dev/null and b/crates/aep/tests/fixtures/synthetic.aep differ
diff --git a/crates/aep/tests/fixtures/synthetic.aep.attribution b/crates/aep/tests/fixtures/synthetic.aep.attribution
new file mode 100644
index 000000000..75d8dc3ba
--- /dev/null
+++ b/crates/aep/tests/fixtures/synthetic.aep.attribution
@@ -0,0 +1,7 @@
+asset:        synthetic.aep
+title:        Small After Effects test project for the .aep importer's damage tests
+author:       EffectCraft contributors
+source:       original work (made in After Effects 2026 from own data: a composition, three generated 8x8 PNGs as an image sequence, a solid, a folder, Levels and Glow effects with expressions)
+license:      MIT OR Apache-2.0
+added:        2026-11-03 by EffectCraft contributors
+notes:        The working space was set to None; the one Utf8 chunk that held an embedded ICC profile was replaced by {} and nothing else was changed. See crates/aep/README.md (Clean room).
diff --git a/crates/aep/tests/fixtures/tools/3d.jsx b/crates/aep/tests/fixtures/tools/3d.jsx
new file mode 100644
index 000000000..f720d1ff1
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/3d.jsx
@@ -0,0 +1,44 @@
+// 3d.jsx - combined fixture of the 3D family (cameras, lights, orientation, 3D layers):
+// one comp per case of partition.txt, recipes from synthetic/MANIFEST.md. Needs fam-common.jsx.
+
+function cam(name) { return op("layer.create_camera", { comp: "$", name: name }); }
+function light(name, type) { return op("layer.create_light", { comp: "$", name: name, lightType: type }); }
+var CAM = cam("Camera 1");
+var SPOT = light("Light 1", "spot");
+var ON3D = props("L", { threeDLayer: true });
+var ROTX30 = setp("L", ["Transform", "X Rotation"], 30);
+
+var PROJECTS = [{
+    out: "3d.aep",
+    settings: null,
+    setup: baseTemplate(),
+    cases: [
+        { id: "015-layer-3d", steps: [ON3D] },
+        { id: "039-comp-renderer-advanced3d", steps: [op("comp.set_renderer", { comp: "$", renderer: "advanced3d" })] },
+        { id: "251-camera-one-node", steps: [CAM, props("Camera 1", { autoOrient: "off" })] },
+        { id: "252-light-point", steps: [light("Light 1", "point")] },
+        { id: "253-camera-position-100-200-m1000", steps: [CAM, setp("Camera 1", ["Transform", "Position"], [100, 200, -1000])] },
+        { id: "254-light-spot-intensity-50", steps: [SPOT, setp("Light 1", ["Light Options", "Intensity"], 50)] },
+        { id: "256-camera-two-node-default", steps: [CAM] },
+        { id: "341-camera-zoom-2000", steps: [CAM, setp("Camera 1", ["Camera Options", "Zoom"], 2000)] },
+        { id: "342-camera-dof-800-30", steps: [CAM, setp("Camera 1", ["Camera Options", "Depth of Field"], 1), setp("Camera 1", ["Camera Options", "Focus Distance"], 800), setp("Camera 1", ["Camera Options", "Aperture"], 30)] },
+        { id: "343-light-spot-color-red", steps: [SPOT, setp("Light 1", ["Light Options", "Color"], [1, 0, 0, 1])] },
+        { id: "344-light-spot-coneangle-60", steps: [SPOT, setp("Light 1", ["Light Options", "Cone Angle"], 60)] },
+        { id: "345-light-spot-conefeather-30", steps: [SPOT, setp("Light 1", ["Light Options", "Cone Feather"], 30)] },
+        { id: "485-layer-3d-on", steps: [ON3D] },
+        { id: "486-layer-3d-rotx-30", steps: [ON3D, ROTX30] },
+        { id: "487-layer-3d-roty-45", steps: [ON3D, setp("L", ["Transform", "Y Rotation"], 45)] },
+        { id: "488-layer-3d-orientation-10-20-30", steps: [ON3D, setp("L", ["Transform", "Orientation"], [10, 20, 30])] },
+        { id: "535-camera-position-on-3d-rotx", steps: [ON3D, ROTX30, cam("K"), setp("K", ["Transform", "Position"], [100, 200, -1000])] },
+        { id: "536-camera-one-node-position-on-3d-rotx", steps: [ON3D, ROTX30, cam("K"), setp("K", ["Transform", "Position"], [100, 200, -1000]), props("K", { autoOrient: "off" })] },
+        { id: "537-camera-default-on-3d-rotx", steps: [ON3D, ROTX30, cam("K")] },
+        { id: "701-light-parallel-int80-color", steps: [light("P", "parallel"), setp("P", ["Light Options", "Intensity"], 80), setp("P", ["Light Options", "Color"], [1, 0.5, 0.25, 1])] },
+        { id: "702-light-ambient-int50-color", steps: [light("A", "ambient"), setp("A", ["Light Options", "Intensity"], 50), setp("A", ["Light Options", "Color"], [0.25, 0.5, 1, 1])] },
+        // Keyed 3-D property: read the value once before the save (pilot lesson 3).
+        { id: "703-key-orientation-0-to-10-20-30-linear", steps: [ON3D,
+            op("keyframe.add", { comp: "$", layer: "L", property: ["Transform", "Orientation"], time: 0, value: [0, 0, 0] }),
+            op("keyframe.add", { comp: "$", layer: "L", property: ["Transform", "Orientation"], time: 2, value: [10, 20, 30] }),
+            getp("L", ["Transform", "Orientation"], 1)] },
+        { id: "704-light-environment-default", steps: [light("E", "environment")] }
+    ]
+}];
diff --git a/crates/aep/tests/fixtures/tools/README.md b/crates/aep/tests/fixtures/tools/README.md
new file mode 100644
index 000000000..f1c720b2e
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/README.md
@@ -0,0 +1,102 @@
+# Generator of the combined test projects
+
+The test projects of the corpus (opt-in, the folder named by `EFFECTCRAFT_AEP_FIXTURES`) were made from scratch with Adobe After Effects 2026, driven through an
+After Effects MCP server (its `batch.run` of atomic operations; `eval.run`, i.e. running
+ExtendScript, is disabled on that server, so the tables below are written in MCP operation terms
+and small Node scripts turn them into `batch.run` lists). Each file holds one composition per
+case, named like the case (`../CASES.md`); every case composition starts as a duplicate of the
+base composition `000-base` (1920x1080, 25 fps, 5 s, black, one red 1920x1080 solid `L`) and adds
+the case's change (and the chain of cases it was made from).
+
+Paths in the scripts are written `<corpus>/...`: a local working folder outside the repository
+that holds an empty project (`combined/gen/empty-work.aep`, a copy of the corpus's `empty.aep`), the test
+media the footage cases import (`synthetic/test-media/`: a png, a WAV, png and OpenEXR sequences,
+an mp4, Targa, Photoshop, Illustrator and EPS stills, all made by the contributor), the earlier
+single-case files some cases are merged from, and the contributor's own animation presets
+(`presets/`). Set them before running.
+
+## Files
+
+| file | what |
+|---|---|
+| `effects.jsx` | effects cases (the trimmed table of the cases the tests use) and the templates `000-base`, `520-solid-M-grey-960x540` |
+| `to-mcp.js` | turns `effects.jsx` into `ops/batch-NN.json` |
+| `masks.jsx`, `shapes.jsx`, `styles.jsx` | masks, shapes and styles cases (styles also 963, 964, 985, 340, 734) |
+| `mss-to-mcp.js` | turns one of those three into `ops/<family>/batch-NN.json` and `merge.json` |
+| `layers-comps.jsx`, `keyframes.jsx` | layer / composition / transform / matte / blend-mode cases, and key / ease / expression / stretch cases; each runs under Node and writes its own batches; `layers-comps.jsx` also holds the `.aep` / `.aepx` pair |
+| `text.jsx` | text cases; runs under Node and writes its batches |
+| `fam-common.jsx`, `fam-to-mcp.js` | shared helpers and translator of the families `3d.jsx`, `footage-precomp.jsx`, `markers.jsx`, `settings.jsx` (settings: one project per group of cases, `settings-a/b/c`) |
+| `scrub.py` | fixture hygiene of a saved `.aep`: footage alias paths replaced by neutral ones of the same length (`C:\fixtures\...`), host name `HOST000...`, neutral ascend counts, the XMP packet replaced by the base project's |
+| `layers-comps-scrub-aepx.py` | the same XMP swap for the `.aepx` of the pair |
+| `patch-text.py` | the byte edits of the text cases 732 and 733 (see below) |
+| `ai-mask-3099.py`, `ai-mask-3099.jsx` | the committed `../ai-mask-3099.aep` (#3099): the `.py` writes four one-page PDFs named `.ai` with distinct page boxes, the `.jsx` (ExtendScript, run once through an After Effects MCP server's script call in an empty untitled project) imports them, builds composition `ai-mask` and returns After Effects' read-back that `../../it/import/ai_mask.rs` compares against |
+
+## Run order (per file)
+
+1. Make sure After Effects shows no dialog. Save the open project somewhere harmless first
+   (opening a project over a dirty untitled one raises a Save As dialog), then open
+   `<corpus>/combined/gen/empty-work.aep`.
+2. Translate the table (`node to-mcp.js ops`, `node mss-to-mcp.js <family>`,
+   `node layers-comps.jsx <outdir>`, `node keyframes.jsx <outdir>`, `node text.jsx <outdir>`,
+   `node fam-to-mcp.js <family> setup` then `... cases <out> ids-<out>.json`) and run the batches
+   in order with `batch.run` (template batch first; check `failed` is 0 after each).
+   - Footage cases: import the media first (`project.import_file`); the translators take the new
+     item id (`stepsItemId`, or the tagged ids of the setup batch) and write the footage batches.
+   - `mss-to-mcp.js`: after the template, merge each project of `merge.json`
+     (`project.merge`) and rename its comp as listed; after the cases delete the `src-*` comps.
+   - A keyed multi-dimensional property is read once (`property.get`) before the save, or After
+     Effects does not write the first key's speed (the tables do this where the case needs it).
+3. Save the project (`ae_save_project`); for the pair, save as `aepx-pair.aep` and right after as
+   `aepx-pair.aepx`.
+4. Text only: `python -I patch-text.py text.aep text-patched.aep` makes the same one-byte edit
+   of a paragraph slot in the text documents of 732 and 733 as the earlier single-case files
+   (built as case 517; the slot is not reachable by scripting).
+5. Scrub: `python -I scrub.py <saved>.aep <fixture>.aep <base project>.aep` (and
+   `layers-comps-scrub-aepx.py` for the `.aepx`). Set `SCRUB_FORBID` to the local folder and
+   machine names that must not remain; the script fails if one does.
+6. Strip the colour profiles: `cargo run -p effectcraft-aep --example stubicc -- <fixture>.aep <fixture>.aep.new`
+   (and the `.aepx`) replaces the working-space profile (and the profile of imported images) by a
+   stub with the same description and no colour data. It stops without writing if a profile cannot
+   be replaced. Then scan the final files independently (the corpus repository's
+   `tools/aep/inspect-embedded.py`). Do not save the projects with working space
+   None instead: the importer reads the working space's name from the profile, and the settings
+   cases (sRGB, Rec.709 Gamma 2.4, gamma) test exactly that.
+7. Check: every case composition must import like the earlier single-case file (the tests in
+   `../../` are that check; `../CASES.md` lists the cases).
+
+Project settings have one value per project, so the settings cases are split over three files.
+In a fresh save After Effects 26.2.1 no longer writes the working-space profile name, only the
+profile data; the reader then takes the name from the profile's own description.
+
+## The three preset cases (963, 964, 985)
+
+Curves and Mesh Warp keep their data in an arbitrary-data parameter that no scripting call can set,
+so these three cases are made by applying an animation preset (`layer.apply_preset`) to layer `S`
+(`steps.png`) of the presets base `984` (solid `B` over `S`, no `L`). The presets are the
+contributor's own, made by hand in Adobe After Effects 2026 (Windows) on 2026-10-19: add the effect
+to a solid, set it as described, select the effect, `Animation > Save Animation Preset`, delete the
+effect. No Adobe preset, sample or asset was used or copied; each file holds only that one effect
+with the values set by hand. They are not decoded anywhere in the importer or the tests: only their
+effect on the saved project (read back from the projects) is.
+
+| preset | made by | used by |
+|---|---|---|
+| `curves-red-mid-down.ffx` | Curves, channel Red: the middle point dragged down (file: Red curve (0,0) (128,44) (255,255)) | 963 |
+| `curves-rgb-two-points.ffx` | Curves, channel RGB: a point at about 1/4 dragged down, one at 3/4 up (file: (0,0) (62,24) (194,230) (255,255)) | 964 |
+| `meshwarp-3x3-center-right.ffx` | Mesh Warp, Rows 3, Columns 3, the lower-right inner vertex dragged about 100 px to the right in the Composition panel | 985 |
+
+Three more presets were made the same way for earlier experiments (cases 961, 962, 965), whose projects are not part of the test set: `curves-default.ffx`, `curves-rgb-mid-up.ffx`, `meshwarp-default.ffx`. The three presets of the test cases and their SHA-256 sums are part of the corpus (`presets/`):
+
+```
+f6ce60a8ed0fa786625078f61995e1184ef0b016efaeeb0b4ae6337831697821  curves-red-mid-down.ffx
+e3992190150366b01859e32adcb9bbe2e0ef492bd2259a8b7e85b571afeca24f  curves-rgb-two-points.ffx
+4a0cd5a0e52d8d14ee0f895b0a3e054199d399094b410a7b2a620eb484d5cba8  meshwarp-3x3-center-right.ffx
+```
+
+Inputs that are not available outside the contributor's machine, and what replaces them: the
+presets base `984` is an intermediate project of the contributor (solid `B` over `S`, noise
+reference; it is merged into the styles project and not shipped on its own); `steps.png` is a contributor-made sRGB PNG (grey ramps, no embedded profile, see
+`../CASES.md` case 902). The presets can be applied to any project that has a layer `S`; the
+case compositions of the corpus are the reference, not a byte-exact rebuild.
+
+`fx-switch.aep` is not generated: it is the base project with two Gaussian Blurs (Blurriness 40) on `L`, added through the MCP server, the first switched off by hand in the Effect Controls (the server has no operation for the fx switch), saved once and scrubbed with `scrub.py`.
diff --git a/crates/aep/tests/fixtures/tools/ai-mask-3099.jsx b/crates/aep/tests/fixtures/tools/ai-mask-3099.jsx
new file mode 100644
index 000000000..bcac03d0b
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/ai-mask-3099.jsx
@@ -0,0 +1,94 @@
+// Issue 3099: how After Effects sizes a placed .ai (PDF) and where masks / parented layers land.
+// Generates ai-mask-3099.aep: run `python -I ai-mask-3099.py <work>` first, set `dir` to that
+// folder, then run this script (ExtendScript) in an empty, untitled project. It returns After
+// Effects' read-back (footage sizes, transforms, mask vertices, toComp points; the tests compare
+// against it) and saves <work>/i3099-ai-mask.aep, which is then scrubbed (README: steps 5 and 6).
+(function () {
+    var dir = "<work>/";
+    var out = {};
+    if (app.project.file !== null || app.project.numItems !== 0) {
+        return "ABORT: project not empty/untitled (" + app.project.numItems + " items)";
+    }
+    var target = new File(dir + "i3099-ai-mask.aep");
+    if (target.exists) { return "ABORT: target exists"; }
+    var names = ["i3099-a-boxes.ai", "i3099-b-frac.ai", "i3099-c-rot.ai", "i3099-d-trim.ai"];
+    var items = {};
+    out.footage = {};
+    for (var i = 0; i < names.length; i++) {
+        var io = new ImportOptions(new File(dir + names[i]));
+        io.importAs = ImportAsType.FOOTAGE;
+        var it = app.project.importFile(io);
+        items[names[i]] = it;
+        out.footage[names[i]] = { w: it.width, h: it.height, par: it.pixelAspect };
+    }
+    var comp = app.project.items.addComp("ai-mask", 1920, 1080, 1, 5, 25);
+    var art = comp.layers.add(items["i3099-a-boxes.ai"]);
+    art.name = "art";
+    var artD = comp.layers.add(items["i3099-d-trim.ai"]);
+    artD.name = "artD";
+    artD.collapseTransformation = true;
+    var artC = comp.layers.add(items["i3099-c-rot.ai"]);
+    artC.name = "artC";
+    artC.property("ADBE Transform Group").property("ADBE Position").setValue([1500, 800]);
+    var n1 = comp.layers.addNull(); n1.name = "N1";
+    var n2 = comp.layers.addNull(); n2.name = "N2";
+    n2.setParentWithJump(n1);
+    art.setParentWithJump(n2);
+    artD.setParentWithJump(n2);
+    var t = function (l, p, v) { l.property("ADBE Transform Group").property(p).setValue(v); };
+    t(n1, "ADBE Position", [700, 400]);
+    t(n1, "ADBE Rotate Z", 15);
+    t(n1, "ADBE Scale", [80, 120]);
+    t(n2, "ADBE Anchor Point", [10, 20]);
+    t(n2, "ADBE Position", [50, -30]);
+    t(n2, "ADBE Scale", [150, 150]);
+    t(art, "ADBE Position", [0, 0]);
+    t(artD, "ADBE Position", [300, 250]);
+    // Two rectangular masks on each art layer, in layer pixels.
+    var rect = function (l, nm, x0, y0, x1, y1) {
+        var m = l.property("ADBE Mask Parade").addProperty("ADBE Mask Atom");
+        m.name = nm;
+        var s = new Shape();
+        s.vertices = [[x0, y0], [x1, y0], [x1, y1], [x0, y1]];
+        s.closed = true;
+        m.property("ADBE Mask Shape").setValue(s);
+    };
+    rect(art, "M1", 40, 30, 200, 90);
+    rect(art, "M2", 220, 100, 350, 160);
+    rect(artD, "M1", 40, 30, 200, 90);
+    rect(artD, "M2", 220, 100, 350, 160);
+    // World positions of layer points through the parent chain (toComp), read via a Point Control.
+    var probe = n1.property("ADBE Effect Parade").addProperty("ADBE Point Control");
+    var pt = probe.property(1);
+    var toComp = function (ln, p) {
+        pt.expression = "thisComp.layer('" + ln + "').toComp([" + p[0] + "," + p[1] + "])";
+        var v = pt.valueAtTime(0, false);
+        return [v[0], v[1]];
+    };
+    var rd = function (l) {
+        var tg = l.property("ADBE Transform Group");
+        var r = {
+            w: l.width, h: l.height,
+            anchor: tg.property("ADBE Anchor Point").value,
+            position: tg.property("ADBE Position").value,
+            scale: tg.property("ADBE Scale").value,
+            rot: tg.property("ADBE Rotate Z").value,
+            masks: []
+        };
+        var mp = l.property("ADBE Mask Parade");
+        for (var k = 1; k <= mp.numProperties; k++) {
+            r.masks.push(mp.property(k).property("ADBE Mask Shape").value.vertices);
+        }
+        return r;
+    };
+    out.layers = { art: rd(art), artD: rd(artD), artC: rd(artC), N1: rd(n1), N2: rd(n2) };
+    out.world = {};
+    var pts = { tl: [0, 0], tr: [art.width, 0], bl: [0, art.height], m1: [40, 30], m2: [350, 160] };
+    for (var key in pts) { out.world["art_" + key] = toComp("art", pts[key]); }
+    var ptsD = { tl: [0, 0], tr: [artD.width, 0], bl: [0, artD.height], m1: [40, 30] };
+    for (var key2 in ptsD) { out.world["artD_" + key2] = toComp("artD", ptsD[key2]); }
+    probe.remove();
+    app.project.save(target);
+    out.saved = target.fsName;
+    return out;
+})();
diff --git a/crates/aep/tests/fixtures/tools/ai-mask-3099.py b/crates/aep/tests/fixtures/tools/ai-mask-3099.py
new file mode 100644
index 000000000..6b5b7facf
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/ai-mask-3099.py
@@ -0,0 +1,66 @@
+"""Writes hand-made one-page PDFs named .ai with distinct page boxes (issue 3099 repro)."""
+import os
+import sys
+
+out = sys.argv[1]
+os.makedirs(out, exist_ok=True)
+
+
+def pdf(page_extra, content):
+    objs = [
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        b"<< /Type /Page /Parent 2 0 R " + page_extra.encode() + b" /Contents 4 0 R >>",
+        b"<< /Length " + str(len(content)).encode() + b" >>\nstream\n" + content + b"\nendstream",
+    ]
+    data = b"%PDF-1.4\n"
+    offs = []
+    for i, o in enumerate(objs, 1):
+        offs.append(len(data))
+        data += str(i).encode() + b" 0 obj\n" + o + b"\nendobj\n"
+    x = len(data)
+    data += b"xref\n0 " + str(len(objs) + 1).encode() + b"\n0000000000 65535 f \n"
+    for o in offs:
+        data += b"%010d 00000 n \n" % o
+    data += b"trailer\n<< /Size " + str(len(objs) + 1).encode() + b" /Root 1 0 R >>\nstartxref\n" + str(x).encode() + b"\n%%EOF\n"
+    return data
+
+
+def boxes_content(boxes):
+    # One outline per box (different colours) plus a filled marker at the media box origin corner.
+    cols = ["0 0 0", "1 0 0", "0 0.6 0", "0 0 1", "1 0.5 0"]
+    s = b"0.85 0.85 0.85 rg "
+    x0, y0, x1, y1 = boxes[0]
+    s += b"%g %g %g %g re f\n" % (x0, y0, x1 - x0, y1 - y0)
+    for c, (a, b, cc, d) in zip(cols, boxes):
+        s += c.encode() + b" RG 1 w %g %g %g %g re S\n" % (a + 0.5, b + 0.5, cc - a - 1, d - b - 1)
+    # A solid square in the lower-left of the last (innermost) box: shows y orientation.
+    a, b, _, _ = boxes[-1]
+    s += b"0.2 0.2 0.8 rg %g %g 20 10 re f" % (a + 4, b + 4)
+    return s
+
+
+def arr(b):
+    return "[%s]" % " ".join("%g" % v for v in b)
+
+
+# A: every box distinct, nested, non-square.
+media, crop, bleed, trim, art = [0, 0, 420, 220], [5, 5, 415, 215], [10, 10, 410, 210], [20, 20, 400, 200], [60, 50, 300.6, 170.4]
+a = pdf(
+    f"/MediaBox {arr(media)} /CropBox {arr(crop)} /BleedBox {arr(bleed)} /TrimBox {arr(trim)} /ArtBox {arr(art)}",
+    boxes_content([media, crop, bleed, trim, art]),
+)
+# B: only a fractional media box.
+mb = [0, 0, 300.6, 120.4]
+b = pdf(f"/MediaBox {arr(mb)}", boxes_content([mb]))
+# C: media box with an offset origin and /Rotate 90.
+mc = [100, 50, 400, 150]
+c = pdf(f"/MediaBox {arr(mc)} /Rotate 90", boxes_content([mc]))
+# D: media + trim + art, no crop box (bleed around the artboard).
+md, td, ad = [0, 0, 418, 218], [9, 9, 409, 209], [40, 30, 250, 150]
+d = pdf(f"/MediaBox {arr(md)} /TrimBox {arr(td)} /BleedBox {arr(md)} /ArtBox {arr(ad)}", boxes_content([md, td, ad]))
+
+for name, data in [("i3099-a-boxes.ai", a), ("i3099-b-frac.ai", b), ("i3099-c-rot.ai", c), ("i3099-d-trim.ai", d)]:
+    with open(os.path.join(out, name), "wb") as f:
+        f.write(data)
+    print(name, len(data))
diff --git a/crates/aep/tests/fixtures/tools/effects.jsx b/crates/aep/tests/fixtures/tools/effects.jsx
new file mode 100644
index 000000000..1b8fd012d
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/effects.jsx
@@ -0,0 +1,353 @@
+// effects.jsx - builds the combined EFFECTS fixture project (ExtendScript, ES3).
+//
+// One composition per case of the synthetic corpus (MANIFEST.md, effects family), named exactly
+// like the case's single-change fixture (e.g. "216-fx-gaussianblur-40"). Every case comp is a
+// duplicate of the base comp "000-base" (comp C of 000-base: 1920x1080, 25 fps, 5 s, black,
+// one red 1920x1080 solid layer "L") plus that case's change (and its FROM chain), so the
+// importer's result for the old fixture's comp C must equal the case comp here.
+// The "-on-M" cases start from "520-solid-M-grey-960x540" (base + a grey 960x540 solid "M" on
+// top). Case 905 is built from its own recipe (steps.png footage, 24 effect layers).
+//
+// Order rule: the FIRST instance of an effect type in the project carries the parameter
+// definitions (parT/pard) that later instances borrow, and AE keeps some set values in that
+// pard; so for every effect type the case that adds it at its defaults comes first (214 before
+// 216, 368 before 369, 712 before 713-723 and 905, ...).
+//
+// Deterministic and idempotent: it opens the empty project EMPTY_AEP (closing the current
+// project WITHOUT saving), builds everything, and saves to OUT_AEP.
+//
+// The same CASES table drives the MCP runner (to-mcp.js turns it into batch.run operations);
+// keep both in step by changing only the table.
+//
+// Step vocabulary (layer = layer name in the case comp, fx = 1-based effect index):
+//   ["fx", layer, matchName]            add an effect (optional 4th: instance name)
+//   ["set", layer, fx, prop, value]     set a parameter (prop = display name or match name;
+//                                       points in layer pixels, colours 0..1, layers by index)
+//   ["key", layer, fx, prop, t, value]  keyframe at layer time t (s), AE's scripted default
+//   ["expr", layer, fxMatch, prop, code] expression on a parameter of the effect with that match name
+//   ["eval", layer, fxMatch, prop, t]   read the value at time t (AE writes the key speeds of a
+//                                       keyed multi-dimensional parameter only after evaluating
+//                                       it; without this 364/382 differ in the first key's speed)
+//   ["move", layer, fx, to]             move effect fx to stack position `to`
+//   ["items", layer, fx, [..]]          Dropdown Menu Control items
+//   ["solid", name, [r,g,b], w, h]      new solid layer on top
+//   ["null", name]                      new null layer on top
+//   ["footage", name]                   new layer of the shared footage item STEPS on top
+//   ["delete", layer]                   delete a layer
+//   ["video", layer, bool]              video switch
+
+var EMPTY_AEP = "<corpus>/combined/gen/empty-work.aep"; // a copy of synthetic/001-empty.aep
+var OUT_AEP = "<corpus>/combined/effects.aep";
+var STEPS_PNG = "<corpus>/synthetic/test-media/steps.png";
+
+// ---------------------------------------------------------------- the case table
+function fx(layer, mn) { return ["fx", layer, mn]; }
+function set1(layer, prop, v) { return ["set", layer, 1, prop, v]; }
+function key1(layer, prop, t, v) { return ["key", layer, 1, prop, t, v]; }
+function cat(a, b) { return a.concat(b); }
+
+var SLIDER = [fx("L", "ADBE Slider Control")];
+var GAUSS = [fx("L", "ADBE Gaussian Blur 2")];
+var FILL = [fx("L", "ADBE Fill")];
+var LAYERCTL = [fx("L", "ADBE Layer Control"), set1("L", "Layer", 1)];
+var DROPDOWN = [fx("L", "ADBE Dropdown Control"), ["items", "L", 1, ["Alpha", "Beta", "Gamma", "Delta", "Epsilon"]]];
+var TINT = [fx("L", "ADBE Tint")];
+var RAMP = [fx("L", "ADBE Ramp")];
+var EXPO = [fx("L", "ADBE Exposure2")];
+var INVERT = [fx("L", "ADBE Invert")];
+var BOX = [fx("L", "ADBE Box Blur2")];
+var SHADOW = [fx("L", "ADBE Drop Shadow")];
+var GLOW = [fx("L", "ADBE Glo2")];
+var HUESAT = [fx("L", "ADBE HUE SATURATION")];
+var LEVELS = [fx("L", "ADBE Easy Levels2")];
+var TIMEWARP = [fx("L", "ADBE Timewarp")];
+
+// base: "000-base" (L only) or "520" (M on top of L)
+var CASES = [
+    { id: "071-fx-slider-value77", steps: cat(SLIDER, [set1("L", "Slider", 77)]) },
+    { id: "073-fx-color-0.2-0.6-1", steps: [fx("L", "ADBE Color Control"), set1("L", "Color", [0.2, 0.6, 1])] },
+    { id: "077-fx-dropdown-default", steps: [fx("L", "ADBE Dropdown Control")] },
+    { id: "080-fx-dropshadow-default", steps: SHADOW },
+    { id: "214-fx-gaussianblur-default", steps: GAUSS },
+    { id: "215-fx-fill-default", steps: FILL },
+    { id: "216-fx-gaussianblur-40", steps: cat(GAUSS, [set1("L", "Blurriness", 40)]) },
+    { id: "217-fx-checkbox-on", steps: [fx("L", "ADBE Checkbox Control"), set1("L", "Checkbox", 1)] },
+    { id: "218-fx-point-111-222", steps: [fx("L", "ADBE Point Control"), set1("L", "Point", [111, 222])] },
+    { id: "219-fx-angle-90", steps: [fx("L", "ADBE Angle Control"), set1("L", "Angle", 90)] },
+    { id: "220-fx-layercontrol-to-layer1", steps: [["null", "Null"], fx("L", "ADBE Layer Control"), set1("L", "Layer", 1)] },
+    { id: "221-fx-slider-2key", steps: cat(SLIDER, [key1("L", "Slider", 0, 10), key1("L", "Slider", 2, 90)]) },
+    { id: "300-fx-gaussianblur-0-explicit", steps: cat(GAUSS, [set1("L", "Blurriness", 0)]) },
+    { id: "301-fx-gaussianblur-40-then-25", steps: cat(GAUSS, [set1("L", "Blurriness", 40), set1("L", "Blurriness", 25)]) },
+    { id: "302-fx-fill-opacity-100-explicit", steps: cat(FILL, [set1("L", "Opacity", 1)]) },
+    { id: "303-fx-fill-opacity-50-then-100", steps: cat(FILL, [set1("L", "Opacity", 0.5), set1("L", "Opacity", 1)]) },
+    { id: "304-fx-slider-0-explicit", steps: cat(SLIDER, [set1("L", "Slider", 0)]) },
+    { id: "320-fx-layercontrol-self-explicit", steps: LAYERCTL },
+    { id: "321-fx-layercontrol-none", steps: cat(LAYERCTL, [set1("L", "Layer", 0)]) },
+    { id: "323-fx-dropdown-5items", steps: DROPDOWN },
+    { id: "324-fx-dropdown-5items-select3", steps: cat(DROPDOWN, [set1("L", "Menu", 3)]) },
+    { id: "356-fx-tint-default", steps: TINT },
+    { id: "357-fx-tint-black-0.2-0.4-0.6", steps: cat(TINT, [set1("L", "Map Black To", [0.2, 0.4, 0.6])]) },
+    { id: "361-fx-tint-amount-0", steps: cat(TINT, [set1("L", "Amount to Tint", 0)]) },
+    { id: "363-fx-tint-amount-2key", steps: cat(TINT, [key1("L", "Amount to Tint", 0, 20), key1("L", "Amount to Tint", 2, 80)]) },
+    { id: "364-fx-tint-white-2key", steps: cat(TINT, [key1("L", "Map White To", 0, [1, 1, 0]), key1("L", "Map White To", 2, [0, 0, 1]), ["eval", "L", "ADBE Tint", "Map White To", 1]]) },
+    { id: "366-fx-blur-then-tint", steps: cat(TINT, [fx("L", "ADBE Gaussian Blur 2"), ["move", "L", 2, 1]]) },
+    { id: "368-fx-ramp-default", steps: RAMP },
+    { id: "369-fx-ramp-start-100-200", steps: cat(RAMP, [set1("L", "Start of Ramp", [100, 200])]) },
+    { id: "371-fx-ramp-startcolor-red", steps: cat(RAMP, [set1("L", "Start Color", [1, 0, 0])]) },
+    { id: "374-fx-ramp-end-2000-m100", steps: cat(RAMP, [set1("L", "End of Ramp", [2000, -100])]) },
+    { id: "377-fx-ramp-shape-radial", steps: cat(RAMP, [set1("L", "Ramp Shape", 2)]) },
+    { id: "378-fx-ramp-scatter-12", steps: cat(RAMP, [set1("L", "Ramp Scatter", 12)]) },
+    { id: "380-fx-ramp-blend-25pct", steps: cat(RAMP, [set1("L", "Blend With Original", 0.25)]) },
+    { id: "382-fx-ramp-start-2key", steps: cat(RAMP, [key1("L", "Start of Ramp", 0, [100, 100]), key1("L", "Start of Ramp", 2, [1800, 900]), ["eval", "L", "ADBE Ramp", "Start of Ramp", 1]]) },
+    { id: "383-fx-ramp-on-100x100-start-10-20", steps: cat(RAMP, [["solid", "S100", [1, 1, 1], 100, 100], fx("S100", "ADBE Ramp"), set1("S100", "Start of Ramp", [10, 20])]) },
+    { id: "389-fx-exposure-default", steps: EXPO },
+    { id: "390-fx-exposure-channels-individual", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0001", 2)]) },
+    { id: "391-fx-exposure-master-1.5", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0003", 1.5)]) },
+    { id: "393-fx-exposure-offset-0.1", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0004", 0.1)]) },
+    { id: "394-fx-exposure-gamma-2.2", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0005", 2.2)]) },
+    { id: "395-fx-exposure-individual-red-1", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0001", 2), set1("L", "ADBE Exposure2-0008", 1)]) },
+    { id: "396-fx-exposure-bypass-on", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0022", 1)]) },
+    { id: "397-fx-exposure-master-2key", steps: cat(EXPO, [key1("L", "ADBE Exposure2-0003", 0, -1), key1("L", "ADBE Exposure2-0003", 2, 2)]) },
+    { id: "410-fx-invert-channel-2", steps: cat(INVERT, [set1("L", "Channel", 2)]) },
+    { id: "411-fx-invert-blend-50", steps: cat(INVERT, [set1("L", "Blend With Original", 50)]) },
+    { id: "413-fx-fastbox-radius-20", steps: cat(BOX, [set1("L", "Blur Radius", 20)]) },
+    { id: "414-fx-fastbox-iterations-1", steps: cat(BOX, [set1("L", "Iterations", 1)]) },
+    { id: "416-fx-fastbox-repeatedge-off", steps: cat(BOX, [set1("L", "ADBE Box Blur2-0004", 0)]) },
+    { id: "418-fx-gaussian-dimensions-3", steps: cat(GAUSS, [set1("L", "Blur Dimensions", 3)]) },
+    { id: "419-fx-gaussian-repeatedge-off", steps: cat(GAUSS, [set1("L", "ADBE Gaussian Blur 2-0003", 0)]) },
+    { id: "422-fx-dropshadow-opacity-204", steps: cat(SHADOW, [set1("L", "Opacity", 204)]) },
+    { id: "426-fx-dropshadow-shadowonly-on", steps: cat(SHADOW, [set1("L", "Shadow Only", 1)]) },
+    { id: "427-fx-glow-default", steps: GLOW },
+    { id: "429-fx-glow-threshold-76.5", steps: cat(GLOW, [set1("L", "Glow Threshold", 76.5)]) },
+    { id: "438-fx-glow-midpoint-0.25", steps: cat(GLOW, [set1("L", "A & B Midpoint", 0.25)]) },
+    { id: "444-fx-huesat-hue-90", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0004", 90)]) },
+    { id: "446-fx-huesat-light-m30", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0006", -30)]) },
+    { id: "448-fx-huesat-colorizehue-120", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0008", 120)]) },
+    { id: "512-fx-levels-inblack-0.1", steps: cat(LEVELS, [set1("L", "Input Black", 0.1)]) },
+    { id: "514-fx-levels-gamma-2", steps: cat(LEVELS, [set1("L", "Gamma", 2)]) },
+    { id: "516-fx-levels-outwhite-0.9", steps: cat(LEVELS, [set1("L", "Output White", 0.9)]) },
+    { id: "529-fx-timewarp-default", steps: TIMEWARP },
+    { id: "530-fx-timewarp-speed-25", steps: cat(TIMEWARP, [set1("L", "Speed", 25)]) },
+    { id: "531-fx-timewarp-speed-keyed-50-200", steps: cat(TIMEWARP, [key1("L", "Speed", 0, 50), key1("L", "Speed", 2, 200)]) },
+    { id: "532-fx-timewarp-method-1", steps: cat(TIMEWARP, [set1("L", "Method", 1)]) },
+    { id: "533-fx-timewarp-sourceframe-12", steps: cat(TIMEWARP, [set1("L", "Adjust Time By", 2), set1("L", "Source Frame", 12)]) },
+    { id: "534-fx-slider-expression-time10", steps: cat(SLIDER, [["expr", "L", "ADBE Slider Control", "Slider", "time*10"]]) },
+    { id: "610-fx-tint-named-My-Tint", steps: [["fx", "L", "ADBE Tint", "My Tint"]] },
+    // ---- from 520: grey 960x540 solid M on top of L
+    { id: "711-fx-directional-blur-30-40-on-M", base: "520", steps: [fx("M", "ADBE Motion Blur"), set1("M", "Direction", 30), set1("M", "Blur Length", 40)] },
+    { id: "712-fx-eleven-effects-defaults-on-M", base: "520", steps: [fx("M", "ADBE Radial Blur"), fx("M", "CC Radial Blur"), fx("M", "ADBE Venetian Blinds"), fx("M", "ADBE Channel Blur"), fx("M", "ADBE Black&White"), fx("M", "ADBE Tritone"), fx("M", "ADBE Luma Key"), fx("M", "ADBE Simple Choker"), fx("M", "ADBE Matte Choker"), fx("M", "ADBE Geometry2"), fx("M", "ADBE Set Matte3")] },
+    { id: "713-fx-radial-blur-zoom-20-on-M", base: "520", steps: [fx("M", "ADBE Radial Blur"), set1("M", "Amount", 20), set1("M", "Center", [600, 300]), set1("M", "Type", 2), set1("M", "Antialiasing (Best Quality)", 2)] },
+    { id: "714-fx-ccradial-type2-30-60-on-M", base: "520", steps: [fx("M", "CC Radial Blur"), set1("M", "Type", 2), set1("M", "Amount", 30), set1("M", "Quality", 60), set1("M", "Center", [400, 200])] },
+    { id: "715-fx-venetian-40-30-50-5-on-M", base: "520", steps: [fx("M", "ADBE Venetian Blinds"), set1("M", "Transition Completion", 40), set1("M", "Direction", 30), set1("M", "Width", 50), set1("M", "Feather", 5)] },
+    { id: "716-fx-channel-blur-5-10-15-20-edge-horiz-on-M", base: "520", steps: [fx("M", "ADBE Channel Blur"), set1("M", "Red Blurriness", 5), set1("M", "Green Blurriness", 10), set1("M", "Blue Blurriness", 15), set1("M", "Alpha Blurriness", 20), set1("M", "ADBE Channel Blur-0005", 1), set1("M", "Blur Dimensions", 2)] },
+    { id: "717-fx-blackwhite-set-tint-on-L", base: "520", steps: [fx("L", "ADBE Black&White"), set1("L", "Reds", 10), set1("L", "Yellows", 70), set1("L", "Greens", 30), set1("L", "Cyans", 50), set1("L", "Blues", 90), set1("L", "Magentas", 20), set1("L", "ADBE Black&White-0007", 1), set1("L", "Tint Color", [1, 0.5, 0])] },
+    { id: "718-fx-tritone-set-blend25-on-L", base: "520", steps: [fx("L", "ADBE Tritone"), set1("L", "Highlights", [1, 1, 0.8]), set1("L", "Midtones", [0.6, 0.2, 0.2]), set1("L", "Shadows", [0, 0, 0.3]), set1("L", "Blend With Original", 25)] },
+    { id: "719-fx-lumakey-darker-140-20-1-2.5-on-M", base: "520", steps: [fx("M", "ADBE Luma Key"), set1("M", "ADBE Luma Key-0001", 2), set1("M", "Threshold", 140), set1("M", "Tolerance", 20), set1("M", "Edge Thin", 1), set1("M", "Edge Feather", 2.5)] },
+    { id: "720-fx-simplechoker-3.5-on-M", base: "520", steps: [fx("M", "ADBE Simple Choker"), set1("M", "Choke Matte", 3.5)] },
+    { id: "721-fx-simplechoker-3.5-view-matte-on-M", base: "520", steps: [fx("M", "ADBE Simple Choker"), set1("M", "Choke Matte", 3.5), set1("M", "View", 2)] },
+    { id: "722-fx-mattechoker-set-on-M", base: "520", steps: [fx("M", "ADBE Matte Choker"), set1("M", "Geometric Softness 1", 6), set1("M", "Choke 1", 50), set1("M", "Geometric Softness 2", 2), set1("M", "Choke 2", -10), set1("M", "Iterations", 3)] },
+    { id: "723-fx-transform-set-on-M", base: "520", steps: [fx("M", "ADBE Geometry2"), set1("M", "Anchor Point", [400, 200]), set1("M", "Position", [500, 300]), set1("M", "ADBE Geometry2-0011", 0), set1("M", "Scale Height", 80), set1("M", "Scale Width", 120), set1("M", "Skew", 10), set1("M", "Skew Axis", 20), set1("M", "Rotation", 30), set1("M", "Opacity", 70), set1("M", "ADBE Geometry2-0009", 0), set1("M", "Shutter Angle", 90), set1("M", "Sampling", 2)] }
+];
+
+
+// Effect cases of MANIFEST.md that never became PR fixtures (old files in <corpus>/synthetic).
+var MORE = [
+    { id: "070-fx-slider-default", steps: SLIDER },
+    { id: "072-fx-checkbox-default", steps: [fx("L", "ADBE Checkbox Control")] },
+    { id: "074-fx-point-default", steps: [fx("L", "ADBE Point Control")] },
+    { id: "075-fx-angle-default", steps: [fx("L", "ADBE Angle Control")] },
+    { id: "076-fx-layercontrol-default", steps: [fx("L", "ADBE Layer Control")] },
+    { id: "078-fx-gaussianblur-25", steps: cat(GAUSS, [set1("L", "Blurriness", 25)]) },
+    { id: "079-fx-fill-color-0-0.5-1", steps: cat(FILL, [set1("L", "Color", [0, 0.5, 1])]) },
+    { id: "322-fx-layercontrol-none-then-self", steps: cat(LAYERCTL, [set1("L", "Layer", 0), set1("L", "Layer", 1)]) },
+    { id: "358-fx-tint-black-red", steps: cat(TINT, [set1("L", "Map Black To", [1, 0, 0])]) },
+    { id: "359-fx-tint-white-green", steps: cat(TINT, [set1("L", "Map White To", [0, 1, 0])]) },
+    { id: "360-fx-tint-white-0.5-0.25-1", steps: cat(TINT, [set1("L", "Map White To", [0.5, 0.25, 1])]) },
+    { id: "362-fx-tint-amount-37.5", steps: cat(TINT, [set1("L", "Amount to Tint", 37.5)]) },
+    { id: "365-fx-tint-then-blur", steps: cat(TINT, [fx("L", "ADBE Gaussian Blur 2")]) },
+    { id: "370-fx-ramp-start-1500-900", steps: cat(RAMP, [set1("L", "Start of Ramp", [1500, 900])]) },
+    { id: "372-fx-ramp-startcolor-0.25-0.5-0.75", steps: cat(RAMP, [set1("L", "Start Color", [0.25, 0.5, 0.75])]) },
+    { id: "373-fx-ramp-end-300-700", steps: cat(RAMP, [set1("L", "End of Ramp", [300, 700])]) },
+    { id: "375-fx-ramp-endcolor-blue", steps: cat(RAMP, [set1("L", "End Color", [0, 0, 1])]) },
+    { id: "376-fx-ramp-endcolor-0.1-0.9-0.3", steps: cat(RAMP, [set1("L", "End Color", [0.1, 0.9, 0.3])]) },
+    { id: "379-fx-ramp-scatter-250.5", steps: cat(RAMP, [set1("L", "Ramp Scatter", 250.5)]) },
+    { id: "381-fx-ramp-blend-100pct", steps: cat(RAMP, [set1("L", "Blend With Original", 1)]) },
+    { id: "392-fx-exposure-master-m2.25", steps: cat(EXPO, [set1("L", "ADBE Exposure2-0003", -2.25)]) },
+    { id: "409-fx-invert-default", steps: INVERT },
+    { id: "412-fx-fastbox-default", steps: BOX },
+    { id: "415-fx-fastbox-dimensions-2", steps: cat(BOX, [set1("L", "Blur Dimensions", 2)]) },
+    { id: "417-fx-gaussian-default", steps: GAUSS },
+    { id: "420-fx-dropshadow-default", steps: SHADOW },
+    { id: "421-fx-dropshadow-color-red", steps: cat(SHADOW, [set1("L", "Shadow Color", [1, 0, 0])]) },
+    { id: "423-fx-dropshadow-direction-45", steps: cat(SHADOW, [set1("L", "Direction", 45)]) },
+    { id: "424-fx-dropshadow-distance-20", steps: cat(SHADOW, [set1("L", "Distance", 20)]) },
+    { id: "425-fx-dropshadow-softness-10", steps: cat(SHADOW, [set1("L", "Softness", 10)]) },
+    { id: "428-fx-glow-based-1", steps: cat(GLOW, [set1("L", "Glow Based On", 1)]) },
+    { id: "430-fx-glow-radius-50", steps: cat(GLOW, [set1("L", "Glow Radius", 50)]) },
+    { id: "431-fx-glow-intensity-2.5", steps: cat(GLOW, [set1("L", "Glow Intensity", 2.5)]) },
+    { id: "432-fx-glow-composite-1", steps: cat(GLOW, [set1("L", "Composite Original", 1)]) },
+    { id: "433-fx-glow-operation-2", steps: cat(GLOW, [set1("L", "Glow Operation", 2)]) },
+    { id: "434-fx-glow-colors-2", steps: cat(GLOW, [set1("L", "Glow Colors", 2)]) },
+    { id: "435-fx-glow-looping-1", steps: cat(GLOW, [set1("L", "Color Looping", 1)]) },
+    { id: "436-fx-glow-loops-3", steps: cat(GLOW, [set1("L", "Color Loops", 3)]) },
+    { id: "437-fx-glow-phase-90", steps: cat(GLOW, [set1("L", "Color Phase", 90)]) },
+    { id: "439-fx-glow-colora-red", steps: cat(GLOW, [set1("L", "Color A", [1, 0, 0])]) },
+    { id: "440-fx-glow-colorb-blue", steps: cat(GLOW, [set1("L", "Color B", [0, 0, 1])]) },
+    { id: "441-fx-glow-dimensions-2", steps: cat(GLOW, [set1("L", "Glow Dimensions", 2)]) },
+    { id: "443-fx-huesat-default", steps: HUESAT },
+    { id: "445-fx-huesat-sat-50", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0005", 50)]) },
+    { id: "447-fx-huesat-colorize-on", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0007", 1)]) },
+    { id: "449-fx-huesat-colorizesat-60", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0009", 60)]) },
+    { id: "450-fx-huesat-colorizelight-20", steps: cat(HUESAT, [set1("L", "ADBE HUE SATURATION-0010", 20)]) },
+    { id: "511-fx-levels-default", steps: LEVELS },
+    { id: "513-fx-levels-inwhite-0.8", steps: cat(LEVELS, [set1("L", "Input White", 0.8)]) },
+    { id: "515-fx-levels-outblack-0.2", steps: cat(LEVELS, [set1("L", "Output Black", 0.2)]) },
+    { id: "522-fx-gaussian-default-on-M", base: "520", steps: [fx("M", "ADBE Gaussian Blur 2")] },
+    { id: "523-fx-dropshadow-default-on-M", base: "520", steps: [fx("M", "ADBE Drop Shadow")] },
+    { id: "524-fx-glow-default-on-M", base: "520", steps: [fx("M", "ADBE Glo2")] },
+    { id: "525-fx-fastbox-20-on-M", base: "520", steps: [fx("M", "ADBE Box Blur2"), set1("M", "Blur Radius", 20)] },
+    { id: "609-fx-tint-default-ref", steps: TINT },
+    { id: "903-fx-33-effects-defaults-on-L", steps: (function () {
+        var m = ["ADBE Brightness & Contrast 2", "ADBE Turbulent Displace", "ADBE Fractal Noise", "ADBE Laser", "CC Radial Fast Blur", "ADBE Noise2", "ADBE Pro Levels2", "ADBE Corner Pin", "ADBE Grid", "ADBE Sharpen", "ADBE Linear Color Key2", "ADBE Radial Wipe", "ADBE Remove Color Matting", "CC Bend It", "CC Power Pin", "ADBE 4ColorGradient", "ADBE Change Color", "ADBE Extract", "ADBE Noise HLS2", "ADBE Scatter", "CC Light Sweep", "ADBE Compound Blur", "ADBE Displacement Map", "ADBE Set Matte3", "ADBE OFMotionBlur", "ADBE Stroke", "ADBE Gaussian Blur", "EXtractoR", "CC Glass", "CC Environment", "ADBE CurvesCustom", "ADBE MESH WARP", "ADBE Lumetri"];
+        var s = [];
+        for (var i = 0; i < m.length; i++) { s.push(fx("L", m[i])); }
+        return s;
+    })() }
+];
+// Size budget: the combined file holds only the PR fixtures (partition.txt, family effects).
+// Set WITH_MORE = true to rebuild the full pilot (all 139 cases, effects-full.aep).
+var WITH_MORE = false;
+if (WITH_MORE) { for (var mi = 0; mi < MORE.length; mi++) { CASES.push(MORE[mi]); } }
+
+// Case 905: comp from 000-base, L deleted; R = grey 1920x1080 solid with a default Gradient
+// Ramp, video off, at the bottom; E01..E24 = steps.png layers (E24 on top), each with one
+// effect. A layer parameter value "R" is R's index at the time of the set.
+var E905 = [
+    ["E01", "ADBE Brightness & Contrast 2", [["Brightness", 20], ["Contrast", 30]]],
+    ["E02", "ADBE Turbulent Displace", [["Amount", 80], ["Size", 150], ["Complexity", 2], ["Evolution", 45], ["Random Seed", 3]]],
+    ["E03", "ADBE Fractal Noise", [["Contrast", 150], ["Brightness", -10], ["Complexity", 4], ["Evolution", 90], ["Random Seed", 5], ["Opacity", 80]]],
+    ["E04", "ADBE Laser", [["Starting Point", [200, 300]], ["Ending Point", [1700, 800]], ["Length", 0.6], ["Time", 0.4], ["Starting Thickness", 20], ["Ending Thickness", 40], ["Softness", 0.3], ["Inside Color", [1, 1, 0]], ["Outside Color", [0, 0, 1]]]],
+    ["E05", "CC Radial Fast Blur", [["Center", [700, 400]], ["Amount", 70], ["Zoom", 2]]],
+    ["E06", "ADBE Noise2", [["Amount of Noise", 30]]],
+    ["E07", "ADBE Pro Levels2", [["Input Black", 0.1], ["Input White", 0.9], ["Gamma", 1.5], ["Output Black", 0.05], ["Output White", 0.95], ["Red Gamma", 0.8], ["Green Input White", 0.8], ["Blue Output Black", 0.2]]],
+    ["E08", "ADBE Corner Pin", [["Upper Left", [100, 50]], ["Upper Right", [1800, 100]], ["Lower Left", [50, 1000]], ["Lower Right", [1850, 1050]]]],
+    ["E09", "ADBE Grid", [["Anchor", [100, 100]], ["Width", 100], ["Height", 80], ["Border", 4], ["Color", [0, 1, 0]], ["Opacity", 70]]],
+    ["E10", "ADBE Sharpen", [["Sharpen Amount", 50]]],
+    ["E11", "ADBE Linear Color Key2", [["Key Color", [0, 0, 1]], ["Matching Tolerance", 20], ["Matching Softness", 15]]],
+    ["E12", "ADBE Radial Wipe", [["Transition Completion", 40], ["Start Angle", 30], ["Wipe Center", [800, 500]], ["Wipe", 2], ["Feather", 20]]],
+    ["E13", "ADBE Remove Color Matting", [["Background Color", [1, 1, 1]]]],
+    ["E14", "CC Bend It", [["Bend", 30], ["Start", [960, 200]], ["End", [960, 900]]]],
+    ["E15", "CC Power Pin", [["Top Left", [200, 100]], ["Top Right", [1700, 50]], ["Bottom Left", [100, 1000]], ["Bottom Right", [1800, 950]]]],
+    ["E16", "ADBE 4ColorGradient", [["Point 1", [300, 200]], ["Color 1", [1, 0, 0]], ["Point 2", [1600, 250]], ["Color 2", [0, 1, 0]], ["Point 3", [250, 900]], ["Color 3", [0, 0, 1]], ["Point 4", [1700, 850]], ["Color 4", [1, 1, 0]], ["Blend", 50], ["Opacity", 80]]],
+    ["E17", "ADBE Change Color", [["Hue Transform", 90], ["Color To Change", [0, 0, 1]], ["Matching Tolerance", 30]]],
+    ["E18", "ADBE Extract", [["Black Point", 30], ["White Point", 220], ["Black Softness", 10]]],
+    ["E19", "ADBE Noise HLS2", [["Hue", 20], ["Lightness", 10], ["Saturation", 30]]],
+    ["E20", "ADBE Scatter", [["Scatter Amount", 20]]],
+    ["E21", "CC Light Sweep", [["Center", [800, 500]], ["Direction", 20], ["Width", 80], ["Sweep Intensity", 60], ["Edge Intensity", 100], ["Light Color", [1, 0.5, 0]]]],
+    ["E22", "ADBE Compound Blur", [["Blur Layer", "R"], ["Maximum Blur", 10]]],
+    ["E23", "ADBE Displacement Map", [["Displacement Map Layer", "R"], ["Max Horizontal Displacement", 20], ["Max Vertical Displacement", 10]]],
+    ["E24", "ADBE Set Matte3", [["Take Matte From Layer", "R"], ["Use For Matte", 5]]]
+];
+
+function steps905() {
+    var s = [["solid", "R", [0.5, 0.5, 0.5], 1920, 1080], fx("R", "ADBE Ramp"), ["video", "R", false], ["delete", "L"]];
+    for (var i = 0; i < E905.length; i++) {
+        var e = E905[i];
+        s.push(["footage", e[0]]);
+        s.push(fx(e[0], e[1]));
+        for (var j = 0; j < e[2].length; j++) {
+            var v = e[2][j][1];
+            if (v === "R") { v = i + 2; } // E01..E(i+1) above R
+            s.push(set1(e[0], e[2][j][0], v));
+        }
+    }
+    return s;
+}
+CASES.push({ id: "905-fx-24-effects-set-one-comp", steps: steps905(), footage: true });
+// Numeric case order (so the at-defaults case of each effect type comes first, see above).
+CASES.sort(function (a, b) { return a.id < b.id ? -1 : (a.id > b.id ? 1 : 0); });
+
+// Template comps (cases of their own): the base, and the base + M of 520.
+var BASE = "000-base";
+var BASE_M = "520-solid-M-grey-960x540";
+
+// ---------------------------------------------------------------- ExtendScript runner
+function findComp(name) {
+    for (var i = 1; i <= app.project.numItems; i++) {
+        var it = app.project.item(i);
+        if (it instanceof CompItem && it.name === name) { return it; }
+    }
+    return null;
+}
+
+function effectParam(eff, prop) {
+    var p = null;
+    try { p = eff.property(prop); } catch (e) { p = null; }
+    if (p === null) { throw new Error("no parameter " + prop + " on " + eff.matchName); }
+    return p;
+}
+
+function runStep(comp, st, steps) {
+    var op = st[0];
+    var layer, eff, p;
+    if (op === "fx") {
+        eff = comp.layer(st[1]).property("ADBE Effect Parade").addProperty(st[2]);
+        if (st.length > 3) { eff.name = st[3]; }
+    } else if (op === "set" || op === "key" || op === "expr") {
+        eff = comp.layer(st[1]).property("ADBE Effect Parade").property(st[2]); // index or match name
+        p = effectParam(eff, st[3]);
+        if (op === "set") { p.setValue(st[4]); }
+        else if (op === "key") { p.setValueAtTime(st[4], st[5]); }
+        else { p.expression = st[4]; }
+    } else if (op === "eval") {
+        comp.layer(st[1]).property("ADBE Effect Parade").property(st[2]).property(st[3]).valueAtTime(st[4], false);
+    } else if (op === "move") {
+        comp.layer(st[1]).property("ADBE Effect Parade").property(st[2]).moveTo(st[3]);
+    } else if (op === "items") {
+        eff = comp.layer(st[1]).property("ADBE Effect Parade").property(st[2]);
+        eff.property(1).setPropertyParameters(st[3]);
+    } else if (op === "solid") {
+        layer = comp.layers.addSolid(st[2], st[1], st[3], st[4], 1);
+    } else if (op === "null") {
+        layer = comp.layers.addNull();
+        layer.name = st[1];
+    } else if (op === "footage") {
+        layer = comp.layers.add(steps);
+        layer.name = st[1];
+    } else if (op === "delete") {
+        comp.layer(st[1]).remove();
+    } else if (op === "video") {
+        comp.layer(st[1]).enabled = st[2];
+    } else {
+        throw new Error("unknown step " + op);
+    }
+}
+
+function main() {
+    app.project.close(CloseOptions.DO_NOT_SAVE_CHANGES);
+    app.open(new File(EMPTY_AEP));
+    var base = app.project.items.addComp(BASE, 1920, 1080, 1, 5, 25);
+    base.bgColor = [0, 0, 0];
+    base.layers.addSolid([1, 0, 0], "L", 1920, 1080, 1);
+    var baseM = base.duplicate();
+    baseM.name = BASE_M;
+    baseM.layers.addSolid([0.5, 0.5, 0.5], "M", 960, 540, 1);
+    var steps = null;
+    for (var i = 0; i < CASES.length; i++) {
+        var c = CASES[i];
+        if (c.footage && steps === null) {
+            steps = app.project.importFile(new ImportOptions(new File(STEPS_PNG)));
+        }
+        var comp = (c.base === "520" ? baseM : base).duplicate();
+        comp.name = c.id;
+        for (var j = 0; j < c.steps.length; j++) {
+            runStep(comp, c.steps[j], steps);
+        }
+    }
+    app.project.save(new File(OUT_AEP));
+    return CASES.length + 2;
+}
+
+if (typeof EC_DATA_ONLY === "undefined") {
+    main();
+}
diff --git a/crates/aep/tests/fixtures/tools/fam-common.jsx b/crates/aep/tests/fixtures/tools/fam-common.jsx
new file mode 100644
index 000000000..37ace96be
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/fam-common.jsx
@@ -0,0 +1,37 @@
+// fam-common.jsx - shared helpers of the combined family generators (3d, footage-precomp,
+// markers, settings). ES3 data only: every family file defines PROJECTS, a list of
+//   { out: "<file>.aep", settings: {...} | null, setup: [op...], cases: [{ id, steps: [op...] }] }
+// where an op is an After Effects MCP atomic operation { operation, args } (ae_do / batch.run).
+// In case steps the comp name "$" stands for the case comp; a value "@key" stands for the
+// project item id that the setup op tagged with `key` (an import or a helper comp), filled in by
+// fam-to-mcp.js from the setup batch's results. Every case comp starts as a duplicate of the
+// base comp "000-base" (comp C of synthetic/000-base.aep: 1920x1080, 25 fps, 5 s, black, one red
+// 1920x1080 solid "L"), so the importer's result for the old fixture's comp C must equal the case
+// comp here.
+
+var MEDIA = "<corpus>/synthetic/";
+var BASE = "000-base";
+
+function op(operation, args) { return { operation: operation, args: args }; }
+// The template comp, exactly as the pilot (effects.jsx / to-mcp.js) builds it.
+function baseTemplate() {
+    return [
+        op("comp.create", { name: BASE, width: 1920, height: 1080, fps: 25, duration: 5, bgColor: [0, 0, 0] }),
+        op("layer.create_solid", { comp: BASE, name: "L", color: [1, 0, 0], width: 1920, height: 1080 })
+    ];
+}
+// A tagged setup op: its result's item id is bound to `key`.
+function tag(key, o) { o.tag = key; return o; }
+function imp(key, rel, extra) {
+    var a = { path: MEDIA + rel };
+    if (extra) for (var k in extra) a[k] = extra[k];
+    return tag(key, op("project.import_file", a));
+}
+function setp(layer, path, value) { return op("property.set", { comp: "$", layer: layer, property: path, value: value }); }
+function getp(layer, path, t) { return op("property.get", { comp: "$", layer: layer, property: path, time: t }); }
+function props(layer, p) { return op("layer.set_props", { comp: "$", layer: layer, props: p }); }
+function footage(key, name) {
+    var a = { comp: "$", sourceItemId: "@" + key };
+    if (name) a.name = name;
+    return op("layer.create_footage", a);
+}
diff --git a/crates/aep/tests/fixtures/tools/fam-to-mcp.js b/crates/aep/tests/fixtures/tools/fam-to-mcp.js
new file mode 100644
index 000000000..279fe698c
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/fam-to-mcp.js
@@ -0,0 +1,78 @@
+// Turns a family table (3d.jsx, footage-precomp.jsx, markers.jsx, settings.jsx; helpers in
+// fam-common.jsx) into After Effects MCP batch.run operation lists (eval.run is disabled on the MCP).
+//
+// Usage:
+//   node fam-to-mcp.js <family> setup            -> ops-<family>/<out>.setup.json per project
+//   node fam-to-mcp.js <family> cases <out> [ids] -> ops-<family>/<out>.cases-NN.json
+// `ids` is a JSON file { key: itemId } with the ids the tagged setup ops returned (imports,
+// helper comps); it is only needed when a case refers to "@key".
+//
+// Run sequence per project (instance.dialogs empty):
+//   1. ae_save_project path <corpus>/scratch-close.aep
+//   2. project.open <corpus>/combined/gen/empty-work.aep (copy of 001-empty.aep)
+//   3. batch.run <out>.setup.json; write the tagged ids into ids-<out>.json
+//   4. node fam-to-mcp.js <family> cases <out> ids-<out>.json; batch.run each cases-NN.json
+//      (check failed == 0)
+//   5. ae_save_project path <corpus>/combined/raw/<out>; scrub.py -> combined/<out>
+var fs = require("fs");
+var path = require("path");
+var family = process.argv[2];
+var mode = process.argv[3];
+var src = fs.readFileSync(path.join(__dirname, "fam-common.jsx"), "utf8") + "\n" + fs.readFileSync(path.join(__dirname, family + ".jsx"), "utf8");
+eval(src); // our own generator files (trusted, local): define PROJECTS and the helpers
+var outDir = path.join(__dirname, "ops-" + family);
+fs.mkdirSync(outDir, { recursive: true });
+
+function clone(v) { return JSON.parse(JSON.stringify(v)); }
+function subst(v, comp, ids) {
+    if (typeof v === "string") {
+        if (v === "$") return comp;
+        if (v.charAt(0) === "@" && v.length > 1) {
+            var k = v.slice(1);
+            if (!(k in ids)) throw new Error("no id for " + v);
+            return ids[k];
+        }
+        return v;
+    }
+    if (Array.isArray(v)) return v.map(function (x) { return subst(x, comp, ids); });
+    if (v && typeof v === "object") {
+        var o = {};
+        for (var key in v) o[key] = subst(v[key], comp, ids);
+        return o;
+    }
+    return v;
+}
+
+if (mode === "setup") {
+    PROJECTS.forEach(function (p) {
+        // Settings first (right after the base template), so footage is imported under them.
+        var setup = p.setup.slice(0, 2);
+        if (p.settings) setup.push({ operation: "project.set_settings", args: p.settings });
+        setup = setup.concat(p.setup.slice(2));
+        var ops = setup.map(function (o) { var c = clone(o); delete c.tag; return c; });
+        ops.push({ operation: "project.get_settings", args: {} });
+        var tags = setup.map(function (o, i) { return o.tag ? i + ":" + o.tag : null; }).filter(Boolean);
+        fs.writeFileSync(path.join(outDir, p.out + ".setup.json"), JSON.stringify(ops));
+        console.log(p.out, "setup ops", ops.length, "tags (result index:key)", tags.join(" "));
+    });
+} else if (mode === "cases") {
+    var out = process.argv[4];
+    var ids = process.argv[5] ? JSON.parse(fs.readFileSync(process.argv[5], "utf8")) : {};
+    var p = PROJECTS.filter(function (x) { return x.out === out; })[0];
+    if (!p) throw new Error("no project " + out);
+    var PER = 12, n = 1, cur = [], count = 0;
+    var flush = function () {
+        if (!cur.length) return;
+        fs.writeFileSync(path.join(outDir, out + ".cases-" + (n < 10 ? "0" : "") + n + ".json"), JSON.stringify(cur));
+        n++; cur = []; count = 0;
+    };
+    p.cases.forEach(function (c) {
+        cur.push({ operation: "comp.duplicate", args: { comp: BASE, newName: c.id } });
+        c.steps.forEach(function (s) { cur.push(subst(clone(s), c.id, ids)); });
+        if (++count >= PER) flush();
+    });
+    flush();
+    console.log(out, "case batches", n - 1, "cases", p.cases.length);
+} else {
+    throw new Error("usage: node fam-to-mcp.js <family> setup|cases <out> [ids.json]");
+}
diff --git a/crates/aep/tests/fixtures/tools/footage-precomp.jsx b/crates/aep/tests/fixtures/tools/footage-precomp.jsx
new file mode 100644
index 000000000..94d28a4c3
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/footage-precomp.jsx
@@ -0,0 +1,44 @@
+// footage-precomp.jsx - combined fixture of the footage-precomp family (stills, sequences, clips,
+// PSD/AI/EPS, precomps, time remap): one comp per case of partition.txt, recipes from
+// synthetic/MANIFEST.md. Footage items are imported once and shared by the cases (pilot lesson
+// 4: layer sources are compared by what they are). Needs fam-common.jsx.
+
+function precompose() { return op("comp.precompose", { comp: "$", layerIndices: [1], newName: "Pre", moveAll: true }); }
+
+var PROJECTS = [{
+    out: "footage-precomp.aep",
+    settings: null,
+    setup: baseTemplate().concat([
+        imp("png8", "test8x8.png"),
+        imp("wav", "test-tone.wav"),
+        imp("seq", "test-seq/seq_001.png", { sequence: true }),
+        imp("exrseq", "test-media/exrseq/shot_0101.exr", { sequence: true }),
+        imp("mp4", "test-media/clip.mp4"),
+        imp("tga", "test-media/still.tga"),
+        imp("psd", "test-media/still.psd", { importAs: "footage" }),
+        imp("ai", "test-media/still.ai", { importAs: "footage" }),
+        imp("eps", "test-media/still.eps"),
+        // 600/601: P30 (640x360, 30 fps, 3 s, green solid G640) and Q (320x240, 25 fps, 2 s, blue B320)
+        tag("P30", op("comp.create", { name: "P30", width: 640, height: 360, fps: 30, duration: 3, bgColor: [0, 0, 0] })),
+        op("layer.create_solid", { comp: "P30", name: "G640", color: [0, 1, 0], width: 640, height: 360 }),
+        tag("Q", op("comp.create", { name: "Q", width: 320, height: 240, fps: 25, duration: 2, bgColor: [0, 0, 0] })),
+        op("layer.create_solid", { comp: "Q", name: "B320", color: [0, 0, 1], width: 320, height: 240 })
+    ]),
+    cases: [
+        { id: "124-precomp-Pre", steps: [precompose()] },
+        { id: "126-footage-png-layer", steps: [footage("png8", "png")] },
+        { id: "319-precomp-timeremap", steps: [precompose(), props("Pre", { timeRemapEnabled: true })] },
+        // item only: the comp is the base, the item is checked at project level
+        { id: "350-footage-wav-imported", steps: [] },
+        { id: "351-footage-wav-as-layer", steps: [footage("wav")] },
+        { id: "352-footage-pngseq-imported", steps: [] },
+        { id: "354-footage-pngseq-timeremap", steps: [footage("seq"), props(1, { timeRemapEnabled: true })] },
+        { id: "601-precomp-two-comps-in-C", steps: [footage("P30"), footage("Q")] },
+        { id: "603-footage-exrseq-0101-as-layer", steps: [footage("exrseq")] },
+        { id: "645-footage-mp4-conform-30", steps: [footage("mp4"), op("footage.interpret", { item: "@mp4", conformFrameRate: 30 })] },
+        { id: "650-footage-tga-still-as-layer", steps: [footage("tga")] },
+        { id: "651-footage-psd-flat-as-layer", steps: [footage("psd")] },
+        { id: "652-footage-ai-as-layer", steps: [footage("ai")] },
+        { id: "653-footage-eps-as-layer", steps: [footage("eps")] }
+    ]
+}];
diff --git a/crates/aep/tests/fixtures/tools/keyframes.jsx b/crates/aep/tests/fixtures/tools/keyframes.jsx
new file mode 100644
index 000000000..fe2214afa
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/keyframes.jsx
@@ -0,0 +1,107 @@
+// keyframes.jsx - the case table of the combined KEYFRAMES fixture project.
+//
+// One composition per case of the synthetic corpus (MANIFEST.md group D, the batch 2/3 key,
+// ease, expression and time-stretch cases), named exactly like the case's single-change fixture
+// (e.g. "058-key-opacity-2key"). Every case comp is a duplicate of the base comp "000-base"
+// (comp C of 000-base: 1920x1080, 25 fps, 5 s, black, one red 1920x1080 solid "L") plus that
+// case's change and its FROM chain (051 -> 052..055, 055 -> 056/057, 981 -> 982 -> 983).
+//
+// Same vocabulary and emitter as layers-comps.jsx: each step is [operation, args] of the After
+// Effects MCP, `comp` is filled in. Key times are what the MCP's keyframe ops take (comp time;
+// AE stores layer time, so the stretched cases land where the old fixtures have them).
+// A keyed multi-dimensional property is read once (property.get) before the save: AE writes the
+// first key's speed only after an evaluation (pilot lesson 3). Not for the linear colour keys of
+// 210 and 598: their old fixtures were saved unevaluated (first key speed 0), and a read writes
+// a speed there. 307 (bezier colour keys) was read in its recipe, so it keeps its read.
+// Run: node keyframes.jsx <outdir>; then the sequence of layers-comps.jsx (no footage).
+
+var LC = require("./layers-comps.jsx");
+var BASE = LC.BASE;
+
+var POS = ["Transform", "Position"];
+var OPA = ["Transform", "Opacity"];
+var SCA = ["Transform", "Scale"];
+var ANC = ["Transform", "Anchor Point"];
+function key(prop, t, v, layer) { return ["keyframe.add", { layer: layer || "L", property: prop, time: t, value: v }]; }
+function get(prop, t, layer) { return ["property.get", { layer: layer || "L", property: prop, time: t }]; }
+function ease(prop, k, a) { a.layer = "L"; a.property = prop; a.keyIndex = k; return ["keyframe.set_easing", a]; }
+function interp(prop, k, a, layer) { a.layer = layer || "L"; a.property = prop; a.keyIndex = k; return ["keyframe.set_interpolation", a]; }
+function timing(a) { a.layer = "L"; return ["layer.set_timing", a]; }
+function cat() { var r = []; for (var i = 0; i < arguments.length; i++) r = r.concat(arguments[i]); return r; }
+// keyframe.apply with an out ease on key 1 and an in ease on key 2 (597, 598, 730)
+function applyEase(prop, layer, v0, v1) {
+    return ["keyframe.apply", { layer: layer, property: prop, interp: "ease", keys: [
+        { time: 0, value: v0, outSpeed: 50, outInfluence: 40 },
+        { time: 2, value: v1, inSpeed: 30, inInfluence: 60 }] }];
+}
+
+var K051 = [key(POS, 0, [0, 0, 0]), key(POS, 1, [100, 0, 0])];
+var K055 = cat(K051, [key(POS, 2.5, [200, 100, 0])]);
+var POSKEYS = [key(POS, 0, [0, 0, 0]), key(POS, 1, [100, 0, 0])]; // 202-204
+var OPAKEYS = [key(OPA, 0, 0), key(OPA, 2, 100)];
+var GETPOS = [get(POS, 0.5)];
+var FILL = ["Effects", "Fill", "Color"];
+var K641 = [key(POS, 1, [100, 100, 0]), key(POS, 2, [500, 300, 0]), get(POS, 1.5)];
+var K643 = [key(POS, 2, [100, 100, 0]), key(POS, 3, [500, 300, 0]), get(POS, 2.5)];
+var K982 = [timing({ stretch: -100 }), timing({ startTime: 5 }), key(OPA, 0, 100), key(OPA, 4, 20)];
+
+var CASES = [
+    { id: "018-layer-stretch200", steps: [timing({ stretch: 200 })] },
+    { id: "052-key-position-2key-ease", steps: cat(K051, [ease(POS, 1, { preset: "ease" }), ease(POS, 2, { preset: "ease" })], GETPOS) },
+    { id: "053-key-position-2key-hold-key1", steps: cat(K051, [interp(POS, 1, { inType: "hold", outType: "hold" })], GETPOS) },
+    { id: "054-key-position-2key-spatial-bezier", steps: cat(K051, [
+        ["keyframe.set_spatial", { layer: "L", property: POS, keyIndex: 1, outTangent: [30, 60, 0], autoBezier: false, continuous: false }],
+        ["keyframe.set_spatial", { layer: "L", property: POS, keyIndex: 2, inTangent: [-30, -60, 0], autoBezier: false, continuous: false }]],
+        [get(POS, 0.25)]) },
+    { id: "055-key-position-3key-inserted-t2.5", steps: cat(K055, GETPOS) },
+    { id: "056-key-position-3key-roving-key2", steps: cat(K055, [["keyframe.set_roving", { layer: "L", property: POS, keyIndex: 2, roving: true }]], GETPOS) },
+    { id: "057-key-position-3key-label9-key2", steps: cat(K055, [["keyframe.set_label", { layer: "L", property: POS, keyIndex: 2, label: 9 }]], GETPOS) },
+    { id: "058-key-opacity-2key", steps: OPAKEYS },
+    { id: "060-expr-opacity-wiggle", steps: [["expression.set", { layer: "L", property: OPA, expression: "wiggle(1,10)" }]] },
+    { id: "202-key-out-hold-in-linear", steps: cat(POSKEYS, [interp(POS, 1, { inType: "linear", outType: "hold" })], GETPOS) },
+    { id: "203-key-in-hold-out-linear", steps: cat(POSKEYS, [interp(POS, 1, { inType: "hold", outType: "linear" })], GETPOS) },
+    { id: "204-key-ease-asymmetric", steps: cat(POSKEYS, [
+        ease(POS, 1, { inSpeed: 5, inInfluence: 20, outSpeed: 50, outInfluence: 80 }),
+        ease(POS, 2, { inSpeed: 7, inInfluence: 60, outSpeed: 9, outInfluence: 40 })], GETPOS) },
+    { id: "205-key-opacity-ease-asymmetric", steps: cat(OPAKEYS, [
+        ease(OPA, 1, { inSpeed: 5, inInfluence: 20, outSpeed: 20, outInfluence: 80 }),
+        ease(OPA, 2, { inSpeed: 30, inInfluence: 60, outSpeed: 9, outInfluence: 40 })]) },
+    { id: "206-key-scale-2key-linear", steps: [key(SCA, 0, [100, 100, 100]), key(SCA, 1, [200, 150, 100]), get(SCA, 0.5)] },
+    { id: "210-key-fill-color-2key-linear", steps: [["effect.add", { layer: "L", matchName: "ADBE Fill" }],
+        ["effect.set_property", { layer: "L", effectIndex: 1, property: ["Color"], value: [1, 0, 0], time: 0 }],
+        ["effect.set_property", { layer: "L", effectIndex: 1, property: ["Color"], value: [0, 0.5, 1], time: 1 }]] },
+    { id: "213-expr-opacity-wiggle-disabled", steps: [["expression.set", { layer: "L", property: OPA, expression: "wiggle(1,10)" }], ["expression.disable_all", {}]] },
+    { id: "305-key-scale-bezier-ease", steps: [key(SCA, 0, [100, 100, 100]), key(SCA, 2, [200, 150, 100]),
+        ["keyframe.set_easing", { layer: "L", property: SCA, keyIndex: 1, inSpeed: 0, inInfluence: 33, outSpeed: 20, outInfluence: 66 }],
+        ["keyframe.set_easing", { layer: "L", property: SCA, keyIndex: 2, inSpeed: 10, inInfluence: 66, outSpeed: 0, outInfluence: 33 }],
+        get(SCA, 1)] },
+    { id: "307-key-fillcolor-bezier", steps: [["effect.add", { layer: "L", matchName: "ADBE Fill" }],
+        ["effect.set_property", { layer: "L", effectIndex: 1, property: ["Color"], value: [1, 0, 0, 1], time: 0 }],
+        ["effect.set_property", { layer: "L", effectIndex: 1, property: ["Color"], value: [0, 0, 1, 1], time: 2 }],
+        get(FILL, 1),
+        interp(FILL, 1, { inType: "bezier", outType: "bezier", temporalContinuous: false, temporalAutoBezier: false }),
+        interp(FILL, 2, { inType: "bezier", outType: "bezier", temporalContinuous: false, temporalAutoBezier: false })] },
+    { id: "316-layer-stretch50", steps: [timing({ stretch: 50 })] },
+    { id: "317-layer-stretch150", steps: [timing({ stretch: 150 })] },
+    { id: "597-key-anchor-ease-out50-40-in30-60", steps: [applyEase(ANC, "L", [960, 540], [1160, 640]), get(ANC, 1)] },
+    { id: "598-key-ramp-point-ease-color-bezier", steps: [["effect.add", { layer: "L", matchName: "ADBE Ramp" }],
+        applyEase(["Effects", "Gradient Ramp", "Start of Ramp"], "L", [100, 200], [500, 400]),
+        get(["Effects", "Gradient Ramp", "Start of Ramp"], 1),
+        key(["Effects", "Gradient Ramp", "Start Color"], 0, [1, 0, 0]),
+        key(["Effects", "Gradient Ramp", "Start Color"], 2, [0, 0, 1]),
+        interp(["Effects", "Gradient Ramp", "Start Color"], 1, { inType: "bezier", outType: "bezier" }),
+        interp(["Effects", "Gradient Ramp", "Start Color"], 2, { inType: "bezier", outType: "bezier" })] },
+    { id: "641-stretch-200-keys-position-1s-2s", steps: cat([timing({ stretch: 200 })], K641) },
+    { id: "642-stretch-50-keys-position-1s-2s", steps: cat([timing({ stretch: 50 })], K641) },
+    { id: "643-stretch-200-start-1-keys-position-2s-3s", steps: cat([timing({ startTime: 1, stretch: 200 })], K643) },
+    { id: "730-key-anchor-ease-on-400x800-solid", steps: [["layer.create_solid", { name: "P", color: [0, 0, 1], width: 400, height: 800 }],
+        applyEase(ANC, "P", [200, 400], [300, 500]), get(ANC, 1, "P")] },
+    { id: "981-layer-stretch-minus100-start5", steps: [timing({ stretch: -100 }), timing({ startTime: 5 })] },
+    { id: "982-layer-stretch-minus100-opacity-keys", steps: K982 },
+    { id: "983-layer-stretch-minus50-opacity-keys", steps: cat(K982, [timing({ stretch: -50 })]) }
+];
+
+if (require.main === module) {
+    LC.emit(CASES, LC.TEMPLATE, BASE, process.argv[2] || "ops-keyframes", null, 16);
+}
+module.exports = { CASES: CASES };
diff --git a/crates/aep/tests/fixtures/tools/layers-comps-scrub-aepx.py b/crates/aep/tests/fixtures/tools/layers-comps-scrub-aepx.py
new file mode 100644
index 000000000..2513645e9
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/layers-comps-scrub-aepx.py
@@ -0,0 +1,25 @@
+# Fixture hygiene for the combined .aepx pair (aepx-pair.aepx): the XMP packet (CDATA of
+# ProjectXMPMetadata) replaced by the base project's packet, as scrub.py does for the .aep, so
+# that the .aep and .aepx of the pair carry the same trailer.
+# Usage: layers-comps-scrub-aepx.py <in.aepx> <out.aepx> <000-base.aep>
+import sys, zlib
+src, dst, base_path = sys.argv[1], sys.argv[2], sys.argv[3]
+d = open(src, 'rb').read()
+base = open(base_path, 'rb').read()
+at = base.find(b'<?xpacket begin')
+assert at >= 0, 'the base project has no XMP packet'
+packet = base[at:]
+tag = b'<ProjectXMPMetadata><![CDATA['
+start = d.find(tag)
+assert start >= 0
+start += len(tag)
+end = d.find(b']]></ProjectXMPMetadata>', start)
+assert end > start
+out = d[:start] + packet + d[end:]
+# Local folder and machine names that must not remain (comma-separated, from the environment so
+# that they are not written here): e.g. SCRUB_FORBID=<folder name>,<host name prefix>.
+import os
+for bad in [w.encode() for w in os.environ.get('SCRUB_FORBID', '').split(',') if w]:
+    assert bad not in out, bad
+open(dst, 'wb').write(out)
+print('raw', len(out), 'zlib', len(zlib.compress(out, 9)))
diff --git a/crates/aep/tests/fixtures/tools/layers-comps.jsx b/crates/aep/tests/fixtures/tools/layers-comps.jsx
new file mode 100644
index 000000000..cd28b3772
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/layers-comps.jsx
@@ -0,0 +1,173 @@
+// layers-comps.jsx - the case table of the combined LAYERS-COMPS fixture project.
+//
+// One composition per case of the synthetic corpus (MANIFEST.md groups A, B, C and the layer /
+// comp header, anchor, matte and blend-mode cases), named exactly like the case's single-change
+// fixture (e.g. "016-layer-blend-multiply"). Every case comp is a duplicate of the base comp
+// "000-base" (comp C of 000-base: 1920x1080, 25 fps, 5 s, black, one red 1920x1080 solid "L")
+// plus that case's change (and its FROM chain), so the importer's result for the old fixture's
+// comp C must equal the case comp here.
+//
+// The table is in the vocabulary of the After Effects MCP (`eval.run` is disabled there): each
+// step is [operation, args]; `comp` is filled in with the case comp. `$STEPS` in an args value
+// is replaced by the item id of the imported steps.png footage (case 906).
+// Also holds the .aep/.aepx pair table (PAIR, below) and the emitter keyframes.jsx uses.
+// Run: node layers-comps.jsx <outdir> [stepsItemId]  -> <outdir>/batch-00.json (template),
+// batch-NN.json (cases), footage-906.json (needs the steps.png item id).
+// Sequence: save the dirty project to scratch-close.aep, project.open
+// gen/empty-work.aep (copy of 001-empty.aep), batch-00, batch-01..NN, project.import_file
+// test-media/steps.png -> id N, rerun with N, footage-906.json, Save As layers-comps.aep, then
+// scrub.py (footage path, host name, XMP):
+//   python -I gen/scrub.py layers-comps.aep layers-comps-scrubbed.aep <fixtures>/000-base.aep
+// The pair: Save As aepx-pair.aep, then at once Save As aepx-pair.aepx, then
+//   python -I gen/scrub.py aepx-pair.aep aepx-pair-scrubbed.aep <fixtures>/000-base.aep
+//   python -I gen/layers-comps-scrub-aepx.py aepx-pair.aepx aepx-pair-scrubbed.aepx <fixtures>/000-base.aep
+// (the .aepx scrub puts the base XMP packet into the ProjectXMPMetadata CDATA, so both halves
+// carry the same trailer). The *-scrubbed files are the fixtures; the raw saves keep real paths.
+
+var STEPS_PNG = "<corpus>/synthetic/test-media/steps.png";
+var BASE = "000-base";
+
+function sp(props) { return ["layer.set_props", { layer: "L", props: props }]; }
+function cp(props) { return ["comp.set_props", { props: props }]; }
+function timing(a) { a.layer = "L"; return ["layer.set_timing", a]; }
+function blend(mode) { return ["layer.set_blend_mode", { layer: "L", mode: mode }]; }
+function tr(a) { a.layer = a.layer || "L"; return ["transform.set", a]; }
+function solid(name, color, w, h) { return ["layer.create_solid", { name: name, color: color, width: w, height: h }]; }
+var M = solid("M", [0.5, 0.5, 0.5], 960, 540); // 402: grey 960x540 on top, the base of 403-408
+function matte(layer, matteLayer, type) { return ["layer.set_track_matte", { layer: layer, matteLayer: matteLayer, matteType: type }]; }
+
+var CASES = [
+    { id: "010-layer-name", steps: [sp({ name: "Renamed" })] },
+    { id: "012-layer-shy", steps: [sp({ shy: true })] },
+    { id: "013-layer-locked", steps: [sp({ locked: true })] },
+    { id: "014-layer-solo", steps: [sp({ solo: true })] },
+    { id: "016-layer-blend-multiply", steps: [blend("multiply")] },
+    { id: "017-layer-motionblur", steps: [sp({ motionBlur: true })] },
+    { id: "019-layer-inpoint1", steps: [timing({ inPoint: 1 })] },
+    { id: "021-layer-starttime0.5", steps: [timing({ startTime: 0.5 })] },
+    { id: "022-layer-parent-null", steps: [["layer.create_null", { name: "Null" }], ["layer.set_parent", { layer: "L", parentLayer: 1 }]] },
+    { id: "023-layer-quality-draft", steps: [sp({ quality: "draft" })] },
+    { id: "024-layer-collapse", steps: [sp({ collapseTransformation: true })] },
+    { id: "025-layer-adjustment", steps: [sp({ adjustmentLayer: true })] },
+    { id: "026-layer-guide", steps: [sp({ guideLayer: true })] },
+    { id: "030-comp-size-1280x720", steps: [cp({ width: 1280, height: 720 })] },
+    { id: "031-comp-fps30", steps: [cp({ frameRate: 30 })] },
+    { id: "032-comp-duration10", steps: [cp({ duration: 10 })] },
+    { id: "033-comp-bg-green", steps: [cp({ bgColor: [0, 1, 0] })] },
+    { id: "034-comp-shutter90", steps: [cp({ shutterAngle: 90 })] },
+    { id: "035-comp-workarea-1-2", steps: [["comp.set_work_area", { start: 1, duration: 2 }]] },
+    { id: "037-comp-pixelaspect2", steps: [cp({ pixelAspect: 2 })] },
+    { id: "038-comp-motionblur", steps: [cp({ motionBlur: true })] },
+    { id: "040-static-position-100-200", steps: [tr({ position: [100, 200, 0] })] },
+    { id: "041-static-scale-50", steps: [tr({ scale: [50, 50, 100] })] },
+    { id: "042-static-rotation-45", steps: [tr({ rotation: 45 })] },
+    { id: "043-static-opacity-25", steps: [tr({ opacity: 25 })] },
+    { id: "044-static-anchor-10-20", steps: [tr({ anchorPoint: [10, 20, 0] })] },
+    { id: "211-anchor-100x100-solid-10-20", steps: [solid("S100", [1, 1, 1], 100, 100), tr({ layer: "S100", anchorPoint: [10, 20, 0] })] },
+    { id: "212-anchor-400x300-solid-100-50", steps: [solid("S400", [1, 1, 1], 400, 300), tr({ layer: "S400", anchorPoint: [100, 50, 0] })] },
+    { id: "222-layer-video-off", steps: [sp({ enabled: false })] },
+    { id: "223-layer-audio-off", steps: [sp({ audioEnabled: false })] },
+    { id: "224-layer-effects-off", steps: [sp({ effectsActive: false })] },
+    { id: "225-layer-blend-screen", steps: [blend("screen")] },
+    { id: "226-layer-blend-add", steps: [blend("add")] },
+    { id: "227-layer-blend-overlay", steps: [blend("overlay")] },
+    { id: "228-layer-blend-difference", steps: [blend("difference")] },
+    { id: "229-comp-fps-29.97", steps: [cp({ frameRate: 29.97 })] },
+    { id: "230-comp-fps-23.976", steps: [cp({ frameRate: 23.976 })] },
+    { id: "231-comp-bg-grey-0.5", steps: [cp({ bgColor: [0.5, 0.5, 0.5] })] },
+    { id: "259-solid-blue-0-0-1", steps: [solid("Blue", [0, 0, 1], 1920, 1080)] },
+    { id: "299-save-noise", steps: [] },
+    { id: "310-solid-100x100-pointcontrol", steps: [solid("S100", [1, 1, 1], 100, 100), ["effect.add", { layer: "S100", matchName: "ADBE Point Control" }]] },
+    { id: "311-position-default-explicit", steps: [["property.set", { layer: "L", property: ["Transform", "Position"], value: [960, 540, 0] }]] },
+    { id: "318-layer-inpoint-0.3333", steps: [timing({ inPoint: 0.3333 })] },
+    { id: "325-comp-pixelaspect-0.9091", steps: [cp({ pixelAspect: 0.9091 })] },
+    { id: "326-comp-shutterphase-m90", steps: [cp({ shutterPhase: -90 })] },
+    { id: "327-comp-displaystartframe-100", steps: [cp({ displayStartFrame: 100 })] },
+    { id: "403-matte-L-alpha-M", steps: [M, matte("L", "M", "alpha")] },
+    { id: "404-matte-L-alphainv-M", steps: [M, matte("L", "M", "alphaInverted")] },
+    { id: "405-matte-L-luma-M", steps: [M, matte("L", "M", "luma")] },
+    { id: "406-matte-L-lumainv-M", steps: [M, matte("L", "M", "lumaInverted")] },
+    { id: "407-matte-M-alpha-L-below", steps: [M, matte("M", "L", "alpha")] },
+    { id: "408-matte-L-alpha-M-visible", steps: [M, matte("L", "M", "alpha"), ["layer.set_enabled", { layer: "M", enabled: true }]] }
+];
+
+// Case 906: L deleted; S = steps.png; 13 solids 300x300 [0.9,0.5,0.2] named by blend mode, in
+// this order (each on top), at a 320 x 360 px grid (6 per row from [160,180]).
+var MODES = ["normal", "add", "multiply", "screen", "overlay", "softLight", "hardLight", "difference", "exclusion", "colorDodge", "colorBurn", "darken", "lighten"];
+function steps906() {
+    var s = [["layer.delete", { layer: "L" }], ["layer.create_footage", { sourceItemId: "$STEPS", name: "S" }]];
+    for (var i = 0; i < MODES.length; i++) {
+        var m = MODES[i];
+        s.push(solid(m, [0.9, 0.5, 0.2], 300, 300));
+        s.push(tr({ layer: m, position: [160 + 320 * (i % 6), 180 + 360 * Math.floor(i / 6)] }));
+        s.push(["layer.set_blend_mode", { layer: m, mode: m }]);
+    }
+    return s;
+}
+CASES.push({ id: "906-blendmodes-13-solids-on-steps", steps: steps906(), footage: true });
+
+// The template comp (case 000-base itself) and the comp every case starts from.
+var TEMPLATE = [
+    ["comp.create", { name: BASE, width: 1920, height: 1080, fps: 25, duration: 5, bgColor: [0, 0, 0] }],
+    ["layer.create_solid", { comp: BASE, name: "L", color: [1, 0, 0], width: 1920, height: 1080 }]
+];
+
+// ---------------------------------------------------------------- the .aep/.aepx pair
+// aepx-pair.aep + aepx-pair.aepx: the `.aepx` tests (crates/aep/tests/aepx.rs,
+// crates/aep-import/tests/aepx.rs, the 110 grafts of crates/aep-import/tests/combined.rs) need
+// an .aep and an .aepx saved by AE from the same state; they read 000-base (lossless import,
+// damage), 058-key-opacity-2key (damage), 060-expr-opacity-wiggle (the `wiggle(1,10)` Utf8),
+// 110-text-A (the `btdk` list, lossless text import) and 124-precomp-Pre. All five go into ONE
+// small project (template 000-base + four case comps), saved as .aep and right after as .aepx
+// with no edit in between; it replaces the five old pairs. (058/060 as in keyframes.jsx.)
+// Run: node layers-comps.jsx <outdir> pair
+var PAIR = [
+    { id: "058-key-opacity-2key", steps: [["keyframe.add", { layer: "L", property: ["Transform", "Opacity"], time: 0, value: 0 }], ["keyframe.add", { layer: "L", property: ["Transform", "Opacity"], time: 2, value: 100 }]] },
+    { id: "060-expr-opacity-wiggle", steps: [["expression.set", { layer: "L", property: ["Transform", "Opacity"], expression: "wiggle(1,10)" }]] },
+    // 110: new point text layer T, text "A" (AE defaults: Times New Roman, 100 px, white fill)
+    { id: "110-text-A", steps: [["layer.create_text", { text: "A", name: "T" }]] },
+    // 124: L precomposed (move all attributes) into a new comp "Pre"
+    { id: "124-precomp-Pre", steps: [["comp.precompose", { layerIndices: [1], newName: "Pre", moveAll: true }]] }
+];
+
+// ---------------------------------------------------------------- MCP batch emitter (node)
+function emit(cases, template, base, out, stepsId, per) {
+    var fs = require("fs");
+    var path = require("path");
+    fs.mkdirSync(out, { recursive: true });
+    function op(comp, st) {
+        var a = {};
+        for (var k in st[1]) {
+            var v = st[1][k];
+            a[k] = v === "$STEPS" ? stepsId : v;
+        }
+        if (a.comp === undefined) a.comp = comp;
+        return { operation: st[0], args: a };
+    }
+    fs.writeFileSync(path.join(out, "batch-00.json"), JSON.stringify(template.map(function (t) { return { operation: t[0], args: t[1] }; })));
+    var n = 1, cur = [], count = 0, total = 0;
+    function flush() {
+        if (!cur.length) return;
+        fs.writeFileSync(path.join(out, "batch-" + (n < 10 ? "0" : "") + n + ".json"), JSON.stringify(cur));
+        n++; cur = []; count = 0;
+    }
+    for (var i = 0; i < cases.length; i++) {
+        var c = cases[i];
+        var list = [{ operation: "comp.duplicate", args: { comp: c.from || base, newName: c.id } }];
+        for (var j = 0; j < c.steps.length; j++) list.push(op(c.id, c.steps[j]));
+        if (c.footage) {
+            if (stepsId !== null) fs.writeFileSync(path.join(out, "footage-" + c.id.slice(0, 3) + ".json"), JSON.stringify(list));
+            continue;
+        }
+        cur = cur.concat(list); total++;
+        if (++count >= per) flush();
+    }
+    flush();
+    console.log("batches", n - 1, "cases", total);
+}
+
+if (typeof require !== "undefined" && typeof module !== "undefined" && require.main === module) {
+    if (process.argv[3] === "pair") emit(PAIR, TEMPLATE, BASE, process.argv[2] || "ops-aepx-pair", null, 16);
+    else emit(CASES, TEMPLATE, BASE, process.argv[2] || "ops-layers-comps", process.argv[3] ? Number(process.argv[3]) : null, 20);
+}
+if (typeof module !== "undefined") module.exports = { CASES: CASES, TEMPLATE: TEMPLATE, BASE: BASE, emit: emit };
diff --git a/crates/aep/tests/fixtures/tools/markers.jsx b/crates/aep/tests/fixtures/tools/markers.jsx
new file mode 100644
index 000000000..a04ba3381
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/markers.jsx
@@ -0,0 +1,21 @@
+// markers.jsx - combined fixture of the markers family: one comp per case of partition.txt,
+// recipes from synthetic/MANIFEST.md (groups J, 12, 249, 509/510). Needs fam-common.jsx.
+
+function cm(a) { a.comp = "$"; return op("marker.add_comp", a); }
+function lm(a) { a.comp = "$"; a.layer = "L"; return op("marker.add_layer", a); }
+
+var PROJECTS = [{
+    out: "markers.aep",
+    settings: null,
+    setup: baseTemplate(),
+    cases: [
+        { id: "122-marker-comp-1s", steps: [cm({ time: 1, comment: "CompMarker" })] },
+        { id: "123-marker-layer-1s", steps: [lm({ time: 1, comment: "LayerMarker" })] },
+        { id: "249-marker-layer-full", steps: [lm({ time: 1, comment: "LM", duration: 1, chapter: "Chap", url: "http://a.example/u", frameTarget: "_blank", cuePointName: "CueX" })] },
+        { id: "347-marker-layer-label3", steps: [lm({ time: 1, comment: "M", label: 3 })] },
+        { id: "348-marker-layer-navigation-cue", steps: [lm({ time: 1, comment: "M", cuePointName: "CueN", eventCuePoint: false })] },
+        { id: "349-marker-layer-event-cue-params", steps: [lm({ time: 1, comment: "M", cuePointName: "CueE", eventCuePoint: true, params: { speaker: "A", n: "2" } })] },
+        { id: "509-marker-comp-two", steps: [cm({ time: 1, comment: "M1", label: 2 }), cm({ time: 2.5, comment: "M2", duration: 0.5 })] },
+        { id: "510-marker-layer-0.52-dur0.3", steps: [lm({ time: 0.52, comment: "LM", duration: 0.3 })] }
+    ]
+}];
diff --git a/crates/aep/tests/fixtures/tools/masks.jsx b/crates/aep/tests/fixtures/tools/masks.jsx
new file mode 100644
index 000000000..d7c2c9595
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/masks.jsx
@@ -0,0 +1,75 @@
+// masks.jsx - case table of the combined MASKS fixture project (<corpus>/combined/masks.aep).
+//
+// One composition per case of the synthetic corpus (MANIFEST.md, masks family), named exactly
+// like the case's single-change fixture. Every case comp is a duplicate of the base comp
+// "000-base" (comp C of 000-base: 1920x1080, 25 fps, 5 s, black, one red 1920x1080 solid "L")
+// plus that case's change (and its FROM chain), as MCP operations (the AE MCP has eval.run
+// disabled, so the table is written in MCP operation terms; mss-to-mcp.js turns it into
+// batch.run lists, "$" stands for the case comp).
+//
+// Keyed multi-dimensional properties are read once (property.get) before the save: AE writes
+// the first key's speed only after an evaluation (pilot lesson 3).
+
+var FAMILY = "masks";
+var OUT_AEP = "<corpus>/combined/masks.aep";
+
+function op(o, a) { return { operation: o, args: a }; }
+function maskAdd(layer, shape, size, center, extra) {
+    var a = { comp: "$", layer: layer, shape: shape, size: size, center: center };
+    for (var k in extra) { a[k] = extra[k]; }
+    return op("mask.add", a);
+}
+function rect800(layer) { return maskAdd(layer || "L", "rect", [800, 400], [960, 540], {}); }
+function maskProp(i, name) { return ["Masks", "Mask " + i, name]; }
+function get(layer, path, t) { return op("property.get", { comp: "$", layer: layer, property: path, time: t }); }
+
+var CASES = [
+    { id: "090-mask-rect", steps: [rect800()] },
+    { id: "091-mask-rect-props", steps: [rect800(), op("mask.set_props", { comp: "$", layer: "L", maskIndex: 1, feather: [20, 20], opacity: 50, mode: "Subtract", inverted: true, expansion: 5 })] },
+    { id: "093-mask-path-2keys", steps: [rect800(),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, shape: "rect", size: [400, 200], center: [960, 540], time: 0 }),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, shape: "rect", size: [800, 400], center: [960, 540], time: 1 }),
+        get("L", maskProp(1, "Mask Path"), 0.5)] },
+    { id: "208-key-mask-feather-2key-linear", steps: [rect800(),
+        op("keyframe.add", { comp: "$", layer: "L", property: maskProp(1, "Mask Feather"), time: 0, value: [0, 0] }),
+        op("keyframe.add", { comp: "$", layer: "L", property: maskProp(1, "Mask Feather"), time: 1, value: [40, 20] }),
+        get("L", maskProp(1, "Mask Feather"), 0.5)] },
+    { id: "232-mask-ellipse", steps: [maskAdd("L", "ellipse", [800, 400], [960, 540], {})] },
+    { id: "233-mask-open-path", steps: [op("mask.add", { comp: "$", layer: "L", mode: "Add" }),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, vertices: [[500, 300], [960, 700], [1400, 300]], closed: false })] },
+    { id: "234-mask-mode-intersect", steps: [maskAdd("L", "rect", [800, 400], [960, 540], { mode: "Intersect" })] },
+    { id: "235-mask-mode-lighten", steps: [maskAdd("L", "rect", [800, 400], [960, 540], { mode: "Lighten" })] },
+    { id: "236-mask-mode-darken", steps: [maskAdd("L", "rect", [800, 400], [960, 540], { mode: "Darken" })] },
+    { id: "237-mask-mode-difference", steps: [maskAdd("L", "rect", [800, 400], [960, 540], { mode: "Difference" })] },
+    { id: "306-key-maskfeather-bezier-ease", steps: [rect800(),
+        op("keyframe.apply", { comp: "$", layer: "L", property: maskProp(1, "Mask Feather"), keys: [
+            { time: 0, value: [0, 0], interp: "ease", inSpeed: 0, inInfluence: 33, outSpeed: 15, outInfluence: 66 },
+            { time: 2, value: [50, 30], interp: "ease", inSpeed: 8, inInfluence: 66, outSpeed: 0, outInfluence: 33 }] }),
+        get("L", maskProp(1, "Mask Feather"), 1)] },
+    { id: "309-solid-100x100-mask-rect", steps: [op("layer.create_solid", { comp: "$", name: "S100", color: [1, 1, 1], width: 100, height: 100 }),
+        maskAdd("S100", "rect", [60, 40], [50, 50], { mode: "Add" })] },
+    { id: "328-mask-two-ellipse-rect", steps: [maskAdd("L", "ellipse", [800, 400], [960, 540], {}), maskAdd("L", "rect", [400, 300], [700, 500], {})] },
+    { id: "329-mask-ellipse-mode-none", steps: [maskAdd("L", "ellipse", [800, 400], [960, 540], { mode: "None" })] },
+    { id: "599-key-mask-path-ease-infl75", steps: [maskAdd("L", "rect", [200, 200], [960, 540], {}),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, shape: "rect", size: [200, 200], center: [960, 540], time: 0 }),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, shape: "rect", size: [600, 400], center: [960, 540], time: 2 }),
+        op("keyframe.set_easing", { comp: "$", layer: "L", property: maskProp(1, "Mask Path"), keyIndex: 1, inSpeed: 0, outSpeed: 0, inInfluence: 75, outInfluence: 75 }),
+        op("keyframe.set_easing", { comp: "$", layer: "L", property: maskProp(1, "Mask Path"), keyIndex: 2, inSpeed: 0, outSpeed: 0, inInfluence: 75, outInfluence: 75 }),
+        get("L", maskProp(1, "Mask Path"), 1)] },
+    { id: "700-key-mask-path-ease-out20-in50", steps: [maskAdd("L", "rect", [200, 200], [960, 540], {}),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, shape: "rect", size: [200, 200], center: [960, 540], time: 0 }),
+        op("mask.set_path", { comp: "$", layer: "L", maskIndex: 1, shape: "rect", size: [600, 400], center: [960, 540], time: 2 }),
+        op("keyframe.set_easing", { comp: "$", layer: "L", property: maskProp(1, "Mask Path"), keyIndex: 1, inSpeed: 0, outSpeed: 0, inInfluence: 20, outInfluence: 20 }),
+        op("keyframe.set_easing", { comp: "$", layer: "L", property: maskProp(1, "Mask Path"), keyIndex: 2, inSpeed: 0, outSpeed: 0, inInfluence: 50, outInfluence: 50 }),
+        get("L", maskProp(1, "Mask Path"), 1)] },
+    { id: "706-mask-on-shape-rect-0-m150-100-150", steps: [op("layer.create_shape", { comp: "$", name: "S" }),
+        op("shape.add_group", { comp: "$", layer: "S", name: "Group 1" }),
+        op("shape.add_rect", { comp: "$", layer: "S", groupIndex: 1, size: [400, 200] }),
+        op("shape.add_fill", { comp: "$", layer: "S", groupIndex: 1, color: [0, 1, 0, 1] }),
+        maskAdd("S", "rect", [100, 300], [50, 0], {})] },
+    { id: "900-mask-added-no-path", steps: [op("property.add", { comp: "$", layer: "L", property: ["ADBE Mask Parade"], matchName: "ADBE Mask Atom" })] },
+    { id: "901-mask-no-path-expansion-m100", steps: [op("property.add", { comp: "$", layer: "L", property: ["ADBE Mask Parade"], matchName: "ADBE Mask Atom" }),
+        op("property.set", { comp: "$", layer: "L", property: maskProp(1, "Mask Expansion"), value: -100 })] }
+];
+var TEMPLATES = [];
+var EXTRA_CASES = ["000-base"];
diff --git a/crates/aep/tests/fixtures/tools/mss-to-mcp.js b/crates/aep/tests/fixtures/tools/mss-to-mcp.js
new file mode 100644
index 000000000..cc3ea4554
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/mss-to-mcp.js
@@ -0,0 +1,63 @@
+// Turns the case table of <family>.jsx (masks, shapes, styles) into After Effects MCP batch.run
+// operation lists. Usage: node mss-to-mcp.js <family> [outdir]
+//
+// Run sequence (instance.dialogs empty):
+//   1. ae_save_project path <corpus>/scratch-close.aep (never project.open on a
+//      dirty project), then project.open <corpus>/combined/gen/empty-work.aep
+//      (copy of 001-empty.aep); instance.dialogs must be empty
+//   2. batch.run ops/<family>/batch-00.json (template comp "000-base")
+//   3. for every entry of ops/<family>/merge.json: project.merge {path, folderName}; rename the
+//      returned comp "C" (item.set_props by id) to `rename`; instance.dialogs must be empty
+//   4. batch.run ops/<family>/batch-01..NN.json (check `failed` == 0 after each)
+//   5. batch.run ops/<family>/cleanup.json is not generated: delete the "src-*" comps by id
+//      (project.delete_item), then ae_save_project path <OUT_AEP>
+//   6. scrub.py <OUT_AEP> <family>-scrubbed.aep synthetic/000-base.aep
+var fs = require("fs");
+var path = require("path");
+var fam = process.argv[2];
+var src = fs.readFileSync(path.join(__dirname, fam + ".jsx"), "utf8");
+var SOURCES = [], MERGED = [];
+eval(src); // our own case table (trusted, local)
+
+var out = process.argv[3] || path.join(__dirname, "ops", fam);
+fs.mkdirSync(out, { recursive: true });
+var BASE = "000-base";
+
+function subst(v, comp) {
+    if (v === "$") return comp;
+    if (Array.isArray(v)) return v.map(function (x) { return subst(x, comp); });
+    if (v && typeof v === "object") {
+        var o = {};
+        for (var k in v) o[k] = subst(v[k], comp);
+        return o;
+    }
+    return v;
+}
+
+var templates = [
+    { operation: "comp.create", args: { name: BASE, width: 1920, height: 1080, fps: 25, duration: 5, bgColor: [0, 0, 0] } },
+    { operation: "layer.create_solid", args: { comp: BASE, name: "L", color: [1, 0, 0], width: 1920, height: 1080 } }
+];
+fs.writeFileSync(path.join(out, "batch-00.json"), JSON.stringify(templates));
+
+var merge = [];
+SOURCES.forEach(function (s) { merge.push({ path: s.path, folderName: "src-" + s.key, rename: "src-" + s.key }); });
+MERGED.forEach(function (m) { merge.push({ path: m.path, folderName: "orig-" + m.id.slice(0, 3), rename: m.id }); });
+fs.writeFileSync(path.join(out, "merge.json"), JSON.stringify(merge, null, 1));
+
+var PER = 8, n = 1, cur = [], count = 0, names = [];
+function flush() {
+    if (!cur.length) return;
+    fs.writeFileSync(path.join(out, "batch-" + (n < 10 ? "0" : "") + n + ".json"), JSON.stringify(cur));
+    n++; cur = []; count = 0;
+}
+CASES.forEach(function (c) {
+    var from = !c.from || c.from === BASE ? BASE : "src-" + c.from;
+    cur.push({ operation: "comp.duplicate", args: { comp: from, newName: c.id } });
+    c.steps.forEach(function (s) { cur.push(subst(s, c.id)); });
+    names.push(c.id);
+    if (++count >= PER) flush();
+});
+flush();
+fs.writeFileSync(path.join(out, "cases.txt"), EXTRA_CASES.concat(names).concat(MERGED.map(function (m) { return m.id; })).join("\n") + "\n");
+console.log(fam, "batches", n - 1, "cases", names.length, "merged", MERGED.length, "sources", SOURCES.length);
diff --git a/crates/aep/tests/fixtures/tools/patch-text.py b/crates/aep/tests/fixtures/tools/patch-text.py
new file mode 100644
index 000000000..bf4313a40
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/patch-text.py
@@ -0,0 +1,72 @@
+# Byte edits of the text family (the old fixtures 732 and 733 are 517 with one paragraph slot
+# changed in the file; AE scripting cannot set those slots). Finds the comp item by name, then
+# the text document (LIST btdk) of its layer, and makes the same one-byte edit there.
+# Usage: patch-text.py <in.aep> <out.aep>
+import struct, sys
+
+EDITS = {
+    "732-text-box-byteedit-para24-0": (b"/23 true /24 1 /25", b"/23 true /24 0 /25"),
+    "733-text-box-byteedit-para35-0": (b"/34 0 /35 1 /36", b"/34 0 /35 0 /36"),
+}
+
+src, dst = sys.argv[1], sys.argv[2]
+d = bytearray(open(src, "rb").read())
+assert d[:4] == b"RIFX" and d[8:12] == b"Egg!"
+
+
+def chunks(start, end):
+    """(id, list type or None, body start, body end) of the chunks in [start, end)."""
+    p = start
+    while p + 8 <= end:
+        cid = bytes(d[p:p + 4])
+        size = struct.unpack(">I", d[p + 4:p + 8])[0]
+        body = p + 8
+        if cid == b"LIST":
+            yield cid, bytes(d[body:body + 4]), body + 4, body + size
+        else:
+            yield cid, None, body, body + size
+        p = body + size + (size & 1)
+
+
+def walk_items(start, end, out):
+    for cid, ltype, b, e in chunks(start, end):
+        if cid != b"LIST" or ltype == b"btdk":
+            continue
+        if ltype == b"Item":
+            name = None
+            for c2, _, b2, e2 in chunks(b, e):
+                if c2 == b"Utf8":
+                    name = bytes(d[b2:e2]).decode("utf-8", "replace")
+                    break
+            out.append((name, b, e))
+        walk_items(b, e, out)
+
+
+def btdks(start, end, out):
+    for cid, ltype, b, e in chunks(start, end):
+        if cid == b"LIST" and ltype == b"btdk":
+            out.append((b, e))
+        elif cid == b"LIST":
+            btdks(b, e, out)
+
+
+items = []
+walk_items(12, len(d), items)
+done = 0
+for name, b, e in items:
+    if name not in EDITS:
+        continue
+    old, new = EDITS[name]
+    docs = []
+    btdks(b, e, docs)
+    assert len(docs) == 1, (name, len(docs))
+    db, de = docs[0]
+    body = bytes(d[db:de])
+    n = body.count(old)
+    assert n == 1, (name, n)
+    at = db + body.index(old)
+    d[at:at + len(old)] = new
+    print(name, "patched at", at)
+    done += 1
+assert done == len(EDITS), done
+open(dst, "wb").write(bytes(d))
diff --git a/crates/aep/tests/fixtures/tools/scrub.py b/crates/aep/tests/fixtures/tools/scrub.py
new file mode 100644
index 000000000..23b270049
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/scrub.py
@@ -0,0 +1,37 @@
+# Fixture hygiene for a combined file, as done for the single fixtures: footage alias JSON with a
+# same-length neutral path, host name HOST000, neutral ascend counts; XMP replaced by the base
+# project's packet. Usage: scrub.py <in.aep> <out.aep> <000-base.aep>
+import re, sys, zlib
+src, dst, base_path = sys.argv[1], sys.argv[2], sys.argv[3]
+d = bytes(open(src, 'rb').read())
+BS2 = bytes([92, 92])  # a JSON-escaped backslash
+
+def fix(m):
+    js = m.group(0)
+    full = re.search(rb'"fullpath":"(.*?)"', js).group(1)
+    name = full.split(BS2)[-1]
+    pre = b'C:' + BS2 + b'fixtures' + BS2
+    mid = len(full) - len(pre) - len(BS2) - len(name)
+    neutral = pre + (b'dir' * 200)[:mid] + BS2 + name
+    out = js.replace(full, neutral)
+    out = re.sub(rb'"server_name":"([^"]*)"', lambda n: b'"server_name":"' + (b'HOST' + b'0' * 64)[:len(n.group(1))] + b'"', out)
+    out = re.sub(rb'"ascendcount_base":\d', b'"ascendcount_base":1', out)
+    out = re.sub(rb'"ascendcount_target":\d', b'"ascendcount_target":2', out)
+    assert len(out) == len(js)
+    return out
+
+d, n = re.subn(rb'\{"ascendcount_base".*?\}', fix, d)
+print('aliases scrubbed', n)
+base = open(base_path, 'rb').read()
+xi = d.find(b'<?xpacket begin')
+xj = base.find(b'<?xpacket begin')
+assert xi >= 0, 'the saved project has no XMP packet'
+assert xj >= 0, 'the base project has no XMP packet'
+out = d[:xi] + base[xj:]
+# Local folder and machine names that must not remain (comma-separated, from the environment so
+# that they are not written here): e.g. SCRUB_FORBID=<folder name>,<host name prefix>.
+import os
+for bad in [w.encode() for w in os.environ.get('SCRUB_FORBID', '').split(',') if w]:
+    assert bad not in out, bad
+open(dst, 'wb').write(out)
+print('raw', len(out), 'zlib', len(zlib.compress(out, 9)))
diff --git a/crates/aep/tests/fixtures/tools/settings.jsx b/crates/aep/tests/fixtures/tools/settings.jsx
new file mode 100644
index 000000000..625700b42
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/settings.jsx
@@ -0,0 +1,44 @@
+// settings.jsx - combined fixtures of the settings family. Project settings hold one value per
+// project, so the 11 cases go into three small projects; each combines as many non-default
+// settings as do not conflict (bpc 8/16, the three time display styles), everything else stays at
+// the 000-base defaults. One comp per case (the base comp, 902 with its layers); the equivalence
+// check compares every setting a case changes against the old fixture and that the file changes
+// no setting none of its cases changes. Needs fam-common.jsx.
+
+var PROJECTS = [
+    {
+        out: "settings-a.aep",
+        settings: { bitsPerChannel: 8, workingSpace: "", workingGamma: 2.4, compensateForSceneReferredProfiles: false, timeDisplayType: "frames", displayStartFrame: 1 },
+        setup: baseTemplate(),
+        cases: [
+            { id: "621-settings-bpc-8", steps: [] },
+            { id: "623-settings-workingspace-none", steps: [] },
+            { id: "625-settings-gamma-2.4", steps: [] },
+            { id: "628-settings-scene-compensation-off", steps: [] },
+            { id: "629-settings-time-display-frames", steps: [] },
+            { id: "630-settings-frame-start-1", steps: [] }
+        ]
+    },
+    {
+        out: "settings-b.aep",
+        settings: { linearizeWorkingSpace: true, linearBlending: true, timeDisplayType: "frames", framesUseFeetFrames: true, feetFramesFilmType: "mm35" },
+        setup: baseTemplate(),
+        cases: [
+            { id: "632-settings-linearize-and-blend-linear", steps: [] },
+            { id: "633-settings-feet-frames-35", steps: [] }
+        ]
+    },
+    {
+        out: "settings-c.aep",
+        settings: { bitsPerChannel: 16, workingSpace: "Rec.709 Gamma 2.4", timeDisplayType: "frames", framesUseFeetFrames: true, feetFramesFilmType: "mm16" },
+        setup: baseTemplate().concat([imp("steps", "test-media/steps.png")]),
+        cases: [
+            { id: "622-settings-bpc-16", steps: [] },
+            { id: "634-settings-feet-frames-16", steps: [] },
+            { id: "902-settings-rec709-16bpc-steps-png-grey-solid", steps: [
+                footage("steps", "S"),
+                op("layer.create_solid", { comp: "$", name: "G", color: [0.5, 0.5, 0.5], width: 400, height: 200 }),
+                setp("G", ["Transform", "Position"], [1600, 900])] }
+        ]
+    }
+];
diff --git a/crates/aep/tests/fixtures/tools/shapes.jsx b/crates/aep/tests/fixtures/tools/shapes.jsx
new file mode 100644
index 000000000..2c968b8e3
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/shapes.jsx
@@ -0,0 +1,96 @@
+// shapes.jsx - case table of the combined SHAPES fixture project (<corpus>/combined/shapes.aep).
+//
+// One composition per case of the synthetic corpus (MANIFEST.md, shapes family), named exactly
+// like the case's single-change fixture. Every case comp is a duplicate of the base comp
+// "000-base" (comp C of 000-base: 1920x1080, 25 fps, 5 s, black, one red solid "L") plus the
+// case's new shape layer on top (named "S", or "Shape" for the batch-3 cases 330-333, as in the
+// originals) built with the same MCP operations as the original (shape.add_* or property.add of
+// the match name; the two store different records), and the case's change / FROM chain
+// (451 -> 457/462/464/467/469/471/473/482/483, 850 -> 851-857). Written in MCP operation
+// terms (eval.run is disabled on the MCP); mss-to-mcp.js turns it into batch.run lists, "$"
+// stands for the case comp.
+//
+// 986 (Fill eye switched off) is not scriptable (the shape item switch has no MCP operation):
+// the original file is merged into the project (project.merge) and its comp renamed; it is an
+// imported original, not a regenerated case.
+
+var FAMILY = "shapes";
+var OUT_AEP = "<corpus>/combined/shapes.aep";
+
+function op(o, a) { return { operation: o, args: a }; }
+function shape(name) { return [op("layer.create_shape", { comp: "$", name: name || "S" }), op("shape.add_group", { comp: "$", layer: name || "S", name: "Group 1" })]; }
+function add(kind, extra, layer, group) {
+    var a = { comp: "$", layer: layer || "S", groupIndex: group || 1 };
+    for (var k in extra) { a[k] = extra[k]; }
+    return op("shape." + kind, a);
+}
+function padd(path, mn, name, layer) {
+    var a = { comp: "$", layer: layer || "S", property: path, matchName: mn };
+    if (name) { a.name = name; }
+    return op("property.add", a);
+}
+function G(rest) { return ["Contents", "Group 1"].concat(rest); }
+function C(item, prop) { return G(["Contents", item, prop]); }
+function set(path, v, layer) { return op("property.set", { comp: "$", layer: layer || "S", property: path, value: v }); }
+function keys(path, ks, layer) { return op("keyframe.apply", { comp: "$", layer: layer || "S", property: path, keys: ks }); }
+function get(path, t, layer) { return op("property.get", { comp: "$", layer: layer || "S", property: path, time: t }); }
+function cat() { var r = []; for (var i = 0; i < arguments.length; i++) { r = r.concat(arguments[i]); } return r; }
+
+var GREEN = [0, 1, 0, 1];
+var RECT43 = add("add_rect", { size: [400, 300] });
+var RECT42 = add("add_rect", { size: [400, 200] });
+var S451 = cat(shape(), [add("add_ellipse", { size: [400, 300] }), add("add_fill", { color: GREEN })]);
+var S850 = cat(shape(), [RECT42, add("add_fill", { color: [1, 0, 0, 1] }), add("add_trim_paths", {})]);
+
+var CASES = [
+    { id: "238-shape-rect-rounded-corners", steps: cat(shape(), [RECT43, add("add_fill", { color: GREEN }), add("add_rounded_corners", { radius: 20 })]) },
+    { id: "239-shape-stroke-green-w8-round", steps: cat(shape(), [RECT43, add("add_stroke", { color: GREEN, width: 8 }), set(C("Stroke 1", "Line Cap"), 2), set(C("Stroke 1", "Line Join"), 2)]) },
+    { id: "240-shape-custom-path-tangents", steps: cat(shape(), [add("add_path", { vertices: [[0, -100], [100, 100], [-100, 100]], inTangents: [[-10, -20], [30, 20], [-60, 10]], outTangents: [[40, 0], [-20, 30], [0, -50]], closed: true }), add("add_fill", { color: GREEN })]) },
+    { id: "241-shape-gradient-fill-linear", steps: cat(shape(), [RECT43, add("add_gradient_fill", { gradientType: "linear", startPoint: [-200, 0], endPoint: [200, 0] })]) },
+    { id: "242-shape-group-position-50-50", steps: cat(shape(), [RECT43, add("add_fill", { color: GREEN }), set(G(["Transform", "Position"]), [50, 50])]) },
+    { id: "330-shape-polystar-star-5-50-100", steps: cat(shape("Shape"), [add("add_polystar", { starType: "star", points: 5, outerRadius: 100, innerRadius: 50 }, "Shape"), add("add_fill", { color: GREEN }, "Shape")]) },
+    { id: "331-shape-polystar-polygon-5-100", steps: cat(shape("Shape"), [add("add_polystar", { starType: "polygon", points: 5, outerRadius: 100 }, "Shape"), add("add_fill", { color: GREEN }, "Shape")]) },
+    { id: "332-shape-gradient-fill-radial", steps: cat(shape("Shape"), [add("add_rect", { size: [400, 300] }, "Shape"), add("add_gradient_fill", { gradientType: "radial", startPoint: [0, 0], endPoint: [200, 0] }, "Shape")]) },
+    { id: "333-shape-group-two-rects", steps: cat(shape("Shape"), [add("add_rect", { size: [400, 300] }, "Shape"), add("add_rect", { size: [100, 100], position: [300, 0] }, "Shape"), add("add_fill", { color: GREEN }, "Shape")]) },
+    { id: "451-shape-ellipse-400x300-fill", steps: S451 },
+    { id: "457-shape-group-scale-50-80", steps: cat(S451, [set(G(["Transform", "Scale"]), [50, 80])]) },
+    { id: "462-shape-layer-anchor-10-20", steps: cat(S451, [set(["Transform", "Anchor Point"], [10, 20])]) },
+    { id: "464-shape-stroke-opacity-50", steps: cat(S451, [add("add_stroke", { color: [1, 0, 0, 1], width: 6 }), set(C("Stroke 1", "Opacity"), 50)]) },
+    { id: "467-shape-trim-end-70", steps: cat(S451, [add("add_trim_paths", {}), set(C("Trim Paths 1", "End"), 70)]) },
+    { id: "469-shape-trim-type-2", steps: cat(S451, [add("add_trim_paths", {}), set(C("Trim Paths 1", "Trim Multiple Shapes"), 2)]) },
+    { id: "471-shape-rect-roundness-30", steps: cat(S451, [add("add_rect", { size: [200, 100] }), set(C("Rectangle Path 1", "Roundness"), 30)]) },
+    { id: "473-shape-star-points-6", steps: cat(S451, [add("add_polystar", { starType: "star", points: 5, outerRadius: 100 }), set(C("Polystar Path 1", "Points"), 6)]) },
+    { id: "482-shape-two-groups", steps: cat(S451, [op("shape.add_group", { comp: "$", layer: "S", name: "Group 2" }), add("add_rect", { size: [200, 100] }, "S", 2), add("add_fill", { color: [0, 0, 1, 1] }, "S", 2)]) },
+    { id: "483-shape-nested-group-rect", steps: cat(S451, [padd(G(["Contents"]), "ADBE Vector Group", "Group 1"),
+        padd(G(["Contents", "Group 1", "Contents"]), "ADBE Vector Shape - Rect"),
+        set(G(["Contents", "Group 1", "Contents", "Rectangle Path 1", "Size"]), [100, 50])]) },
+    { id: "519-shape-all-items-default", steps: cat(shape(), [
+        padd(G(["Contents"]), "ADBE Vector Shape - Rect"), padd(G(["Contents"]), "ADBE Vector Shape - Ellipse"),
+        padd(G(["Contents"]), "ADBE Vector Shape - Star"), padd(G(["Contents"]), "ADBE Vector Graphic - Fill"),
+        padd(G(["Contents"]), "ADBE Vector Graphic - Stroke"), padd(G(["Contents"]), "ADBE Vector Graphic - G-Fill"),
+        padd(G(["Contents"]), "ADBE Vector Graphic - G-Stroke"), padd(G(["Contents"]), "ADBE Vector Filter - Trim"),
+        padd(G(["Contents"]), "ADBE Vector Filter - RC")]) },
+    { id: "707-shape-merge-subtract-rect-ellipse", steps: cat(shape(), [RECT42, add("add_ellipse", { size: [200, 200] }), add("add_merge_paths", { mode: "subtract" }), add("add_fill", { color: GREEN })]) },
+    { id: "708-shape-merge-intersect-rect-ellipse", steps: cat(shape(), [RECT42, add("add_ellipse", { size: [200, 200] }), add("add_merge_paths", { mode: "intersect" }), add("add_fill", { color: GREEN })]) },
+    { id: "709-shape-repeater-3-pos150-60-rot10-scale90-80-op40", // shape.add_repeater fails in this MCP version ("null is not an object" after adding the
+    // Repeater); property.add + property.set gives the same imported result as the original.
+    steps: cat(shape(), [RECT42, add("add_fill", { color: GREEN }), padd(G(["Contents"]), "ADBE Vector Filter - Repeater"),
+        set(C("Repeater 1", "Copies"), 3), set(C("Repeater 1", "Transform").concat(["Position"]), [150, 60]),
+        set(C("Repeater 1", "Transform").concat(["Rotation"]), 10), set(C("Repeater 1", "Transform").concat(["Scale"]), [90, 80]),
+        set(C("Repeater 1", "Transform").concat(["End Opacity"]), 40)]) },
+    { id: "710-shape-offset-paths-20-round", steps: cat(shape(), [RECT42, add("add_offset_paths", { amount: 20, lineJoin: "round" }), add("add_fill", { color: GREEN })]) },
+    { id: "731-shape-merge-offset-repeater-defaults", steps: cat(shape(), [RECT42, padd(G(["Contents"]), "ADBE Vector Filter - Merge"), padd(G(["Contents"]), "ADBE Vector Filter - Offset"), padd(G(["Contents"]), "ADBE Vector Filter - Repeater")]) },
+    { id: "828-shape-offset-paths-20-copies3-copyoffset1.5-stroke", steps: cat(shape(), [RECT42, add("add_offset_paths", { amount: 20 }), add("add_stroke", { color: GREEN, width: 2 }), set(C("Offset Paths 1", "Copies"), 3), set(C("Offset Paths 1", "Copy Offset"), 1.5)]) },
+    { id: "851-shape-key-trim-end-0-100-linear", steps: cat(S850, [keys(C("Trim Paths 1", "End"), [{ time: 0, value: 0, interp: "linear" }, { time: 2, value: 100, interp: "linear" }])]) },
+    { id: "852-shape-key-trim-end-bezier-out0-60-in20-30", steps: cat(S850, [keys(C("Trim Paths 1", "End"), [{ time: 0, value: 0, interp: "ease", outSpeed: 0, outInfluence: 60 }, { time: 2, value: 100, interp: "ease", inSpeed: 20, inInfluence: 30 }])]) },
+    { id: "853-shape-key-group-position-0-200-100-linear", steps: cat(S850, [keys(G(["Transform", "Position"]), [{ time: 0, value: [0, 0], interp: "linear" }, { time: 2, value: [200, 100], interp: "linear" }]), get(G(["Transform", "Position"]), 1)]) },
+    { id: "854-shape-key-fill-color-red-blue-linear", steps: cat(S850, [keys(C("Fill 1", "Color"), [{ time: 0, value: [1, 0, 0, 1], interp: "linear" }, { time: 2, value: [0, 0, 1, 1], interp: "linear" }]), get(C("Fill 1", "Color"), 1)]) },
+    { id: "855-shape-key-trim-offset-0-90-hold", steps: cat(S850, [keys(C("Trim Paths 1", "Offset"), [{ time: 0, value: 0, interp: "linear" }, { time: 2, value: 90, interp: "hold" }])]) },
+    { id: "856-shape-trim-end-expression-time50", steps: cat(S850, [op("expression.set", { comp: "$", layer: "S", property: C("Trim Paths 1", "End"), expression: "time*50" })]) },
+    { id: "857-shape-key-group-scale-100-50-150-linear", steps: cat(S850, [keys(G(["Transform", "Scale"]), [{ time: 0, value: [100, 100], interp: "linear" }, { time: 2, value: [50, 150], interp: "linear" }]), get(G(["Transform", "Scale"]), 1)]) }
+];
+// Imported originals (project.merge of the synthetic file, comp "C" renamed to the case id).
+var MERGED = [
+    { id: "986-shape-fill-switched-off-green", path: "<corpus>/synthetic/986-shape-fill-switched-off-green.aep", why: "Fill eye switch off: not scriptable" }
+];
+var EXTRA_CASES = ["000-base"];
diff --git a/crates/aep/tests/fixtures/tools/styles.jsx b/crates/aep/tests/fixtures/tools/styles.jsx
new file mode 100644
index 000000000..3dbe6a3ba
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/styles.jsx
@@ -0,0 +1,84 @@
+// styles.jsx - case table of the combined STYLES fixture project (<corpus>/combined/styles.aep),
+// which also holds the three preset-made effect cases 963/964/985 that the effects pilot skipped.
+//
+// One composition per case, named exactly like the case's single-change fixture. Written in MCP
+// operation terms (eval.run is disabled on the MCP); mss-to-mcp.js turns it into batch.run
+// lists, "$" stands for the case comp.
+//
+// Layer styles cannot be added through the MCP in an AE session whose Layer menu has not been
+// opened in the UI (command.execute 9000-9008 does nothing; property.add of `dropShadow/enabled`
+// is refused; property.set on an absent style is refused), and keystrokes / menus are not
+// allowed. MCP-only route: the AE-saved style-default originals of the corpus (951 all nine,
+// 952 Drop Shadow, 955 Inner Glow, 959 Gradient Overlay, 960 Stroke) are merged into the project
+// (project.merge; each lands in its own folder; its comp "C" is renamed "src-NNN"), and every
+// case comp is a comp.duplicate of its FROM source plus the case's own changes by property.set /
+// keyframe.apply on match-name paths. The preset cases start from the merged presets base 984
+// (= 949: solid "B" 600x400 [0.2,0.4,0.8] over "S" = steps.png, L deleted) plus
+// layer.apply_preset of the contributor's preset on S. 340 (text) starts from the base comp "000-base".
+// After the cases, the six "src-*" comps are deleted (project.delete_item); their folders, solids
+// and steps.png items stay (the case comps use them).
+//
+// 951 is the duplicate of its own merged source (no change on top). Imported originals (not regenerated; their change is a byte patch or a hand edit that no MCP
+// operation can make): 988 (style eye
+// switched off), 734 (text byte edit).
+
+var FAMILY = "styles";
+var OUT_AEP = "<corpus>/combined/styles.aep";
+var SYN = "<corpus>/synthetic/";
+var PRESETS = "<corpus>/presets/";
+
+function op(o, a) { return { operation: o, args: a }; }
+function st(style, prop) { return ["ADBE Layer Styles", style + "/enabled", style + "/" + prop]; }
+function bo(prop) { return ["ADBE Layer Styles", "ADBE Blend Options Group", prop]; }
+function adv(prop) { return ["ADBE Layer Styles", "ADBE Blend Options Group", "ADBE Adv Blend Group", prop]; }
+function set(path, v) { return op("property.set", { comp: "$", layer: "B", property: path, value: v }); }
+function S(style, kv) { var r = []; for (var k in kv) { r.push(set(st(style, k), kv[k])); } return r; }
+function cat() { var r = []; for (var i = 0; i < arguments.length; i++) { r = r.concat(arguments[i]); } return r; }
+
+// Sources merged into the project: { key, path }; comp "C" of each becomes "src-<key>".
+var SOURCES = [
+    { key: "951", path: SYN + "951-styles-all-nine-defaults-on-B.aep" },
+    { key: "952", path: SYN + "952-style-drop-shadow-defaults-on-B.aep" },
+    { key: "955", path: SYN + "955-style-inner-glow-defaults-on-B.aep" },
+    { key: "959", path: SYN + "959-style-gradient-overlay-defaults-on-B.aep" },
+    { key: "960", path: SYN + "960-style-stroke-defaults-on-B.aep" },
+    { key: "984", path: SYN + "984-presets-save-noise.aep" }
+];
+// Imported originals: merged, comp "C" renamed to the case id.
+var MERGED = [
+    { id: "988-style-drop-shadow-switched-off", path: SYN + "988-style-drop-shadow-switched-off.aep", why: "style eye switched off: byte patch, not scriptable" },
+    { id: "734-text-box-byteedit-style68-1", path: SYN + "734-text-box-byteedit-style68-1.aep", why: "text byte edit, not scriptable" }
+];
+
+var ALL977 = cat(
+    [set(bo("ADBE Global Angle2"), 45), set(bo("ADBE Global Altitude2"), 40), set(adv("ADBE Layer Fill Opacity2"), 80),
+     set(adv("ADBE R Channel Blend"), 0), set(adv("ADBE Blend Interior"), 1), set(adv("ADBE Blend Ranges"), 0)],
+    S("dropShadow", { mode2: 1, color: [0, 0, 1], opacity: 60, useGlobalAngle: 1, localLightingAngle: 30, distance: 12, chokeMatte: 10, blur: 8, noise: 5, layerConceals: 0 }),
+    S("innerShadow", { mode2: 1, color: [0, 1, 0], opacity: 55, useGlobalAngle: 1, localLightingAngle: 60, distance: 7, chokeMatte: 15, blur: 9, noise: 3 }),
+    S("outerGlow", { mode2: 1, opacity: 65, noise: 2, AEColorChoice: 2, color: [1, 0, 0], gradientSmoothness: 80, glowTechnique: 2, chokeMatte: 12, blur: 20, inputRange: 40, shadingNoise: 10 }),
+    S("innerGlow", { mode2: 1, opacity: 45, noise: 4, AEColorChoice: 2, color: [0, 1, 0], gradientSmoothness: 70, glowTechnique: 2, innerGlowSource: 2, chokeMatte: 8, blur: 15, inputRange: 30, shadingNoise: 20 }),
+    S("bevelEmboss", { bevelStyle: 1, bevelTechnique: 2, strengthRatio: 150, bevelDirection: 2, blur: 10, softness: 3, useGlobalAngle: 1, localLightingAngle: 70, localLightingAltitude: 50, highlightMode: 1, highlightColor: [1, 1, 0], highlightOpacity: 60, shadowMode: 1, shadowColor: [0, 0, 1], shadowOpacity: 40 }),
+    S("chromeFX", { mode2: 1, color: [1, 0, 1], opacity: 70, localLightingAngle: 45, distance: 20, blur: 10, invert: 0 }),
+    S("solidFill", { mode2: 5, color: [0, 1, 1], opacity: 50 }),
+    S("gradientFill", { mode2: 5, opacity: 70, gradientSmoothness: 50, angle: 30, type: 2, reverse: 1, align: 0, scale: 120, offset: [10, 20] }),
+    S("frameFX", { mode2: 5, color: [0, 0, 1], size: 6, opacity: 80, style: 2 })
+);
+
+// from: "000-base" (template) or a source key ("952", ...).
+var CASES = [
+    { id: "340-text-range-two-styles", from: "000-base", steps: [op("layer.create_text", { comp: "$", text: "Hello", name: "T" }),
+        op("text.set_style_range", { comp: "$", layer: "T", start: 1, end: 3, fillColor: [1, 0, 0] }),
+        op("text.set_style_range", { comp: "$", layer: "T", start: 3, end: 5, fillColor: [0, 0, 1], fontSize: 60 })] },
+    { id: "951-styles-all-nine-defaults-on-B", from: "951", steps: [] },
+    { id: "966-style-drop-shadow-opacity50-distance20", from: "952", steps: S("dropShadow", { opacity: 50, distance: 20 }) },
+    { id: "970-style-stroke-size10-color-green", from: "960", steps: S("frameFX", { size: 10, color: [0, 1, 0] }) },
+    { id: "974-style-gradient-overlay-angle45-scale150", from: "959", steps: S("gradientFill", { angle: 45, scale: 150 }) },
+    { id: "975-style-fill-opacity0-with-drop-shadow", from: "952", steps: [set(adv("ADBE Layer Fill Opacity2"), 0)] },
+    { id: "976-style-drop-shadow-opacity-keyed-100-20-linear", from: "952", steps: [op("keyframe.apply", { comp: "$", layer: "B", property: st("dropShadow", "opacity"), keys: [{ time: 0, value: 100, interp: "linear" }, { time: 2, value: 20, interp: "linear" }] })] },
+    { id: "977-styles-all-params-changed", from: "951", steps: ALL977 },
+    { id: "979-style-inner-glow-source-2", from: "955", steps: S("innerGlow", { innerGlowSource: 2 }) },
+    { id: "963-curves-red-mid-down-on-S", from: "984", steps: [op("layer.apply_preset", { comp: "$", layer: "S", path: PRESETS + "curves-red-mid-down.ffx" })] },
+    { id: "964-curves-rgb-s-curve-on-S", from: "984", steps: [op("layer.apply_preset", { comp: "$", layer: "S", path: PRESETS + "curves-rgb-two-points.ffx" })] },
+    { id: "985-meshwarp-3x3-vertex-moved-on-S", from: "984", steps: [op("layer.apply_preset", { comp: "$", layer: "S", path: PRESETS + "meshwarp-3x3-center-right.ffx" })] }
+];
+var EXTRA_CASES = ["000-base"];
diff --git a/crates/aep/tests/fixtures/tools/text.jsx b/crates/aep/tests/fixtures/tools/text.jsx
new file mode 100644
index 000000000..046f1d1b7
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/text.jsx
@@ -0,0 +1,322 @@
+// text.jsx - builds the combined TEXT fixture project (ExtendScript, ES3), and, run under node,
+// translates the same case table into After Effects MCP batch.run operation lists.
+//
+// One composition per case of the synthetic corpus (MANIFEST.md, text family in partition.txt),
+// named exactly like the case's single-change fixture (e.g. "539-text-hscale-0.9"). Every case
+// comp is a duplicate of the base comp "000-base" (comp C of 000-base: 1920x1080, 25 fps, 5 s,
+// black, one red 1920x1080 solid layer "L") plus that case's steps: a new text layer "T" on top
+// of L and the case's change, with its whole FROM chain replayed (e.g. 400 = 110 -> text
+// "A" ETX "B" (386) -> "A" CR "B" (387) -> Auto Leading on). Noise references (384, 399, 725)
+// are no-ops.
+//
+// Text layers are created with the panel's default character state (Times New Roman
+// TimesNewRomanPSMT, 100 px, white; the default stores the superscript baseline slot, which
+// is why the S17 cases set fontBaselineOption normal first).
+//
+// Byte-edited cases (732, 733: one paragraph slot of 517 changed in the file, not reachable by
+// scripting) are built as 517 here and patched afterwards by patch-text.py (same edit as the
+// old fixtures: one byte in the comp's text document).
+//
+// Step vocabulary (the text layer is always "T"):
+//   ["text", s, opts]            new text layer T, text s; opts {box: [w,h], boxPos: [x,y]}
+//   ["content", s]               Source Text text -> s
+//   ["style", {..}]              text.set_style attributes on the whole document
+//   ["range", start, end, {..}]  text.set_style_range on characters [start, end)
+//   ["reset", scope]             text.reset_style character|paragraph|both
+//   ["anim", name, {..}]         text animator with these properties and a Range Selector
+//   ["sel", a, match, v]         property match of Range Selector 1 of animator a -> v
+//   ["skey", a, match, [[t,v],..], interp]  keys on that selector property
+//   ["get", a, match]            read that selector property (as the old case did)
+//   ["rmanim", a]                remove animator a
+//   ["anchor", [x,y,z]]          T Transform / Anchor Point
+//   ["mask", center, size]       rect mask on T (layer space)
+//
+// Usage under node: node text.jsx <outdir>   (writes batch-00.json = template comp,
+// batch-NN.json = cases, smoke.json = a few cases built on batch-00)
+
+var OUT_AEP = "<corpus>/combined/text.aep";
+var EMPTY_AEP = "<corpus>/combined/gen/empty-work.aep"; // a copy of synthetic/001-empty.aep
+
+function cat() {
+    var r = [];
+    for (var i = 0; i < arguments.length; i++) { r = r.concat(arguments[i]); }
+    return r;
+}
+function st(o) { return [["style", o]]; }
+
+var A = [["text", "A", {}]];
+var HELLO = [["text", "Hello", {}]];
+var BOX_HELLO = [["text", "Hello", { box: [400, 200] }]];
+var B517 = [["text", "The quick brown fox jumps over the lazy dog and keeps running far away", { box: [600, 400], boxPos: [-300, -200] }]];
+var HHHH = [["text", "HHHH", {}]];
+var B538 = cat(HHHH, st({ fontBaselineOption: "normal" }));
+var B113 = cat(A, [["content", "Hello"]], st({ fontSize: 60 }), st({ fillColor: [1, 0.5, 0] }));
+var B386 = cat(A, [["content", "A\u0003B"]]);
+var B579 = cat(B538, [["anim", "Animator 1", { "ADBE Text Position 3D": [0, -50, 0] }]]);
+var B592 = cat(B579, [["anim", "Many", {
+    "ADBE Text Anchor Point 3D": [3, 4, 0], "ADBE Text Scale 3D": [150, 120, 100], "ADBE Text Skew": 10,
+    "ADBE Text Skew Axis": 20, "ADBE Text Rotation": 45, "ADBE Text Opacity": 37, "ADBE Text Fill Color": [0, 1, 0],
+    "ADBE Text Stroke Color": [0, 0, 1], "ADBE Text Stroke Width": 3, "ADBE Text Tracking Amount": 20,
+    "ADBE Text Line Spacing": [10, 20], "ADBE Text Blur": [5, 6]
+}]]);
+var B593 = cat(B592, [["skey", "Animator 1", "ADBE Text Percent Start", [[0, 0], [2, 100]], "ease"]]);
+var B594 = cat(B593, [["rmanim", "Many"]]);
+var B595 = cat(B594, [["rmanim", "Animator 1"]], st({ applyStroke: true, strokeWidth: 5, strokeColor: [0, 0, 1], horizontalScale: 0.9, verticalScale: 1.5, baselineShift: 41 }));
+var B727 = cat(B538, [["reset", "paragraph"]]);
+function sel(m, v) { return cat(B579, [["sel", "Animator 1", m, v]]); }
+
+var CASES = [
+    { id: "110-text-A", steps: A },
+    { id: "113-text-Hello-size60-fillorange", steps: B113 },
+    { id: "114-text-animator-opacity", steps: cat(B113, [["anim", "Animator 1", { "ADBE Text Opacity": 0 }]]) },
+    { id: "243-text-multiline-A-CR-B", steps: [["text", "A\rB", {}]] },
+    { id: "245-text-box-400x200-Hello", steps: BOX_HELLO },
+    { id: "246-text-box-center-align", steps: cat(BOX_HELLO, st({ justification: "center" })) },
+    { id: "247-text-tracking-100", steps: cat(HELLO, st({ tracking: 100 })) },
+    { id: "248-text-range-fill-red-1-3", steps: cat(HELLO, [["range", 1, 3, { fillColor: [1, 0, 0] }]]) },
+    { id: "334-text-box-right-align", steps: cat(BOX_HELLO, st({ justification: "right" })) },
+    { id: "335-text-point-fauxbold", steps: cat(HELLO, st({ fauxBold: true })) },
+    { id: "336-text-point-fauxitalic", steps: cat(HELLO, st({ fauxItalic: true })) },
+    { id: "337-text-point-allcaps", steps: cat(HELLO, st({ allCaps: true })) },
+    { id: "338-text-point-smallcaps", steps: cat(HELLO, st({ smallCaps: true })) },
+    { id: "339-text-point-leading60", steps: cat(HELLO, st({ leading: 60 })) },
+    { id: "385-text-anchor-10-20", steps: cat(A, [["anchor", [10, 20, 0]]]) },
+    { id: "386-text-etx-A-B", steps: B386 },
+    { id: "400-text-autoleading-on", steps: cat(B386, [["content", "A\rB"]], st({ autoLeading: true })) },
+    { id: "517-text-box-600x400-wrap", steps: B517 },
+    { id: "526-text-point-HHHH-default", steps: HHHH },
+    { id: "527-text-point-HHHH-baseline-normal", steps: cat(HHHH, st({ fontBaselineOption: "normal" })) },
+    { id: "528-text-point-HHHH-baseline-subscript", steps: cat(HHHH, st({ fontBaselineOption: "normal" }), st({ fontBaselineOption: "subscript" })) },
+    { id: "538-text-point-HHHH-normal-ref", steps: B538 },
+    { id: "539-text-hscale-0.9", steps: cat(B538, st({ horizontalScale: 0.9 })) },
+    { id: "540-text-vscale-1.5", steps: cat(B538, st({ verticalScale: 1.5 })) },
+    { id: "541-text-baselineshift-41", steps: cat(B538, st({ baselineShift: 41 })) },
+    { id: "542-text-autokern-none", steps: cat(B538, st({ autoKernType: "none" })) },
+    { id: "543-text-autokern-optical", steps: cat(B538, st({ autoKernType: "optical" })) },
+    { id: "544-text-applystroke-on", steps: cat(B538, st({ applyStroke: true })) },
+    { id: "545-text-strokewidth-5", steps: cat(B538, st({ strokeWidth: 5 })) },
+    { id: "546-text-applyfill-off", steps: cat(B538, st({ applyFill: false })) },
+    { id: "548-text-linejoin-round", steps: cat(B538, st({ lineJoinType: "round" })) },
+    { id: "550-text-strokeoverfill-off", steps: cat(B538, st({ strokeOverFill: false })) },
+    { id: "552-text-nobreak-on", steps: cat(B538, st({ noBreak: true })) },
+    { id: "553-text-tsume-0.5", steps: cat(B538, st({ tsume: 0.5 })) },
+    { id: "554-text-kerning-50", steps: cat(B538, st({ kerning: 50 })) },
+    { id: "555-text-ligature-on", steps: cat(B538, st({ ligature: true })) },
+    { id: "556-text-autohyphenate-off", steps: cat(B538, st({ autoHyphenate: false })) },
+    { id: "558-text-hangingroman-on", steps: cat(B538, st({ hangingRoman: true })) },
+    { id: "559-text-everyline-on", steps: cat(B538, st({ everyLineComposer: true })) },
+    { id: "560-text-firstlineindent-20", steps: cat(B538, st({ firstLineIndent: 20 })) },
+    { id: "561-text-startindent-30", steps: cat(B538, st({ startIndent: 30 })) },
+    { id: "562-text-endindent-40", steps: cat(B538, st({ endIndent: 40 })) },
+    { id: "563-text-spacebefore-10", steps: cat(B538, st({ spaceBefore: 10 })) },
+    { id: "564-text-spaceafter-12", steps: cat(B538, st({ spaceAfter: 12 })) },
+    { id: "565-text-justify-fullleft", steps: cat(B538, st({ justification: "fullLeft" })) },
+    { id: "566-text-justify-fullcenter", steps: cat(B538, st({ justification: "fullCenter" })) },
+    { id: "567-text-justify-fullright", steps: cat(B538, st({ justification: "fullRight" })) },
+    { id: "568-text-justify-fullall", steps: cat(B538, st({ justification: "fullLastLineFull" })) },
+    { id: "569-text-direction-rtl", steps: cat(B538, st({ direction: "rightToLeft" })) },
+    { id: "571-text-digitset-arabic", steps: cat(B538, st({ digitSet: "arabic" })) },
+    { id: "572-text-leadingtype-japanese", steps: cat(B538, st({ leadingType: "japanese" })) },
+    { id: "573-text-baselinedir-rotated", steps: cat(B538, st({ baselineDirection: "verticalRotated" })) },
+    { id: "575-text-vertical-rtl", steps: cat(B538, st({ lineOrientation: "verticalRtl" })) },
+    { id: "576-text-baselinedir-crossstream", steps: cat(B538, st({ baselineDirection: "verticalCrossStream" })) },
+    { id: "578-text-digitset-hindi", steps: cat(B538, st({ digitSet: "hindi" })) },
+    { id: "579-textanim-position-0-m50", steps: B579 },
+    { id: "580-textanim-start-25", steps: sel("ADBE Text Percent Start", 25) },
+    { id: "581-textanim-end-75", steps: sel("ADBE Text Percent End", 75) },
+    { id: "582-textanim-offset-10", steps: sel("ADBE Text Percent Offset", 10) },
+    { id: "583-textanim-units-index", steps: cat(sel("ADBE Text Range Units", 2), [["get", "Animator 1", "ADBE Text Index Start"], ["get", "Animator 1", "ADBE Text Index End"]]) },
+    { id: "584-textanim-basedon-3-words", steps: sel("ADBE Text Range Type2", 3) },
+    { id: "585-textanim-mode-2-subtract", steps: sel("ADBE Text Selector Mode", 2) },
+    { id: "586-textanim-amount-50", steps: sel("ADBE Text Selector Max Amount", 50) },
+    { id: "587-textanim-shape-2-rampup", steps: sel("ADBE Text Range Shape", 2) },
+    { id: "588-textanim-smoothness-50", steps: sel("ADBE Text Selector Smoothness", 50) },
+    { id: "589-textanim-easehigh-30", steps: sel("ADBE Text Levels Max Ease", 30) },
+    { id: "590-textanim-easelow-40", steps: sel("ADBE Text Levels Min Ease", 40) },
+    { id: "591-textanim-randomize-seed-7", steps: cat(B579, [["sel", "Animator 1", "ADBE Text Randomize Order", 1], ["sel", "Animator 1", "ADBE Text Random Seed", 7]]) },
+    { id: "592-textanim-many-props", steps: B592 },
+    { id: "593-textanim-start-keyed-ease-0-100", steps: B593 },
+    { id: "594-textanim-position-start-keyed-ease", steps: B594 },
+    { id: "595-text-stroke-scale-shift-combined", steps: B595 },
+    { id: "596-text-combined-fill-over-stroke", steps: cat(B595, st({ strokeOverFill: false })) },
+    { id: "705-mask-on-text-rect-40-m70-160-10", steps: cat(B538, [["mask", [100, -30], [120, 80]]]) },
+    { id: "725-text-point-HHHH-normal-ref-S18", steps: B538 },
+    { id: "727-text-reset-paragraph", steps: B727 },
+    { id: "728-textanim-character-offset-3", steps: cat(B727, [["anim", "Off", { "ADBE Text Character Offset": 3 }]]) },
+    { id: "732-text-box-byteedit-para24-0", steps: B517, patch: "para24" },
+    { id: "733-text-box-byteedit-para35-0", steps: B517, patch: "para35" }
+];
+
+var BASE = "000-base";
+var TEXT_GROUP = ["ADBE Text Properties", "ADBE Text Animators"];
+// Range Selector properties that sit in its "Advanced" group.
+var ADVANCED = { "ADBE Text Range Units": 1, "ADBE Text Range Type2": 1, "ADBE Text Selector Mode": 1, "ADBE Text Selector Max Amount": 1,
+    "ADBE Text Range Shape": 1, "ADBE Text Selector Smoothness": 1, "ADBE Text Levels Max Ease": 1, "ADBE Text Levels Min Ease": 1,
+    "ADBE Text Randomize Order": 1, "ADBE Text Random Seed": 1 };
+
+// ---------------------------------------------------------------- MCP translation (node)
+function mcpOps(comp, s) {
+    var op = s[0];
+    if (op === "text") {
+        var a = { comp: comp, text: s[1], name: "T" };
+        if (s[2].box) a.boxSize = s[2].box;
+        if (s[2].boxPos) a.boxPosition = s[2].boxPos;
+        return [{ operation: "layer.create_text", args: a }];
+    }
+    if (op === "content") return [{ operation: "text.set_content", args: { comp: comp, layer: "T", text: s[1] } }];
+    if (op === "style" || op === "range") {
+        var o = op === "style" ? s[1] : s[3];
+        var b = { comp: comp, layer: "T" };
+        for (var k in o) b[k] = o[k];
+        if (op === "range") { b.rangeType = "characters"; b.start = s[1]; b.end = s[2]; }
+        return [{ operation: op === "style" ? "text.set_style" : "text.set_style_range", args: b }];
+    }
+    if (op === "reset") return [{ operation: "text.reset_style", args: { comp: comp, layer: "T", scope: s[1] } }];
+    if (op === "anim") return [{ operation: "text.add_animator", args: { comp: comp, layer: "T", name: s[1], properties: s[2], selector: "range" } }];
+    var selPath = function (a, m) { return TEXT_GROUP.concat([a, "ADBE Text Selectors", "Range Selector 1"], ADVANCED[m] ? ["ADBE Text Range Advanced", m] : [m]); };
+    if (op === "get") return [{ operation: "property.get", args: { comp: comp, layer: "T", property: selPath(s[1], s[2]) } }];
+    if (op === "sel") return [{ operation: "property.set", args: { comp: comp, layer: "T", property: selPath(s[1], s[2]), value: s[3] } }];
+    if (op === "skey") {
+        var keys = [];
+        for (var i = 0; i < s[3].length; i++) keys.push({ time: s[3][i][0], value: s[3][i][1], interp: s[4] });
+        return [{ operation: "keyframe.apply", args: { comp: comp, layer: "T", property: selPath(s[1], s[2]), keys: keys } }];
+    }
+    if (op === "rmanim") return [{ operation: "property.remove", args: { comp: comp, layer: "T", property: TEXT_GROUP.concat([s[1]]) } }];
+    if (op === "anchor") return [{ operation: "property.set", args: { comp: comp, layer: "T", property: ["ADBE Transform Group", "ADBE Anchor Point"], value: s[1] } }];
+    if (op === "mask") return [{ operation: "mask.add", args: { comp: comp, layer: "T", shape: "rect", center: s[1], size: s[2] } }];
+    throw new Error("unknown step " + op);
+}
+
+if (typeof app === "undefined" && typeof require === "function") {
+    var fs = require("fs");
+    var path = require("path");
+    var out = process.argv[2] || path.join(__dirname, "ops-text");
+    fs.mkdirSync(out, { recursive: true });
+    var templates = [
+        { operation: "comp.create", args: { name: BASE, width: 1920, height: 1080, fps: 25, duration: 5, bgColor: [0, 0, 0] } },
+        { operation: "layer.create_solid", args: { comp: BASE, name: "L", color: [1, 0, 0], width: 1920, height: 1080 } }
+    ];
+    fs.writeFileSync(path.join(out, "batch-00.json"), JSON.stringify(templates));
+    // Pass 1 creates every case comp and its text layer (the first step of every case is the
+    // "text" step), pass 2 runs the remaining steps: a new text layer takes the panel's current
+    // character state, so no layer is created after another layer was styled.
+    var createOps = function (c) {
+        return [{ operation: "comp.duplicate", args: { comp: BASE, newName: c.id } }].concat(mcpOps(c.id, c.steps[0]));
+    };
+    var changeOps = function (c) {
+        var list = [];
+        for (var j = 1; j < c.steps.length; j++) list = list.concat(mcpOps(c.id, c.steps[j]));
+        return list;
+    };
+    var write = function (prefix, list, per, fn) {
+        var n = 1, cur = [], count = 0;
+        for (var ci = 0; ci < list.length; ci++) {
+            cur = cur.concat(fn(list[ci]));
+            if (++count >= per || ci === list.length - 1) {
+                if (cur.length) fs.writeFileSync(path.join(out, prefix + (n < 10 ? "0" : "") + n + ".json"), JSON.stringify(cur));
+                n++; cur = []; count = 0;
+            }
+        }
+        return n - 1;
+    };
+    var nc = write("create-", CASES, 40, createOps);
+    var nx = write("change-", CASES, 20, changeOps);
+    var SMOKE = ["110-", "113-", "245-", "248-", "385-", "386-", "538-", "554-", "575-", "583-", "591-", "592-", "593-", "595-", "705-", "727-", "728-"];
+    var smoke = [];
+    for (var q = 0; q < CASES.length; q++) {
+        for (var r = 0; r < SMOKE.length; r++) if (CASES[q].id.indexOf(SMOKE[r]) === 0) smoke.push(CASES[q]);
+    }
+    write("smoke-create", smoke, 100, createOps);
+    write("smoke-change", smoke, 100, changeOps);
+    console.log("create batches", nc, "change batches", nx, "cases", CASES.length);
+}
+
+// ---------------------------------------------------------------- ExtendScript runner
+function findText(comp) { return comp.layer("T"); }
+
+function applyAttrs(td, o) {
+    var map = { fontSize: "fontSize", fillColor: "fillColor", strokeColor: "strokeColor", strokeWidth: "strokeWidth", tracking: "tracking",
+        leading: "leading", applyFill: "applyFill", applyStroke: "applyStroke", strokeOverFill: "strokeOverFill", baselineShift: "baselineShift",
+        autoLeading: "autoLeading", fauxBold: "fauxBold", fauxItalic: "fauxItalic", horizontalScale: "horizontalScale", verticalScale: "verticalScale",
+        tsume: "tsume", kerning: "kerning", ligature: "ligature", noBreak: "noBreak", autoHyphenate: "autoHyphenate", everyLineComposer: "everyLineComposer",
+        hangingRoman: "hangingRoman", firstLineIndent: "firstLineIndent", startIndent: "startIndent", endIndent: "endIndent",
+        spaceBefore: "spaceBefore", spaceAfter: "spaceAfter" };
+    var enums = {
+        justification: { left: ParagraphJustification.LEFT_JUSTIFY, center: ParagraphJustification.CENTER_JUSTIFY, right: ParagraphJustification.RIGHT_JUSTIFY,
+            fullLeft: ParagraphJustification.FULL_JUSTIFY_LASTLINE_LEFT, fullCenter: ParagraphJustification.FULL_JUSTIFY_LASTLINE_CENTER,
+            fullRight: ParagraphJustification.FULL_JUSTIFY_LASTLINE_RIGHT, fullLastLineFull: ParagraphJustification.FULL_JUSTIFY_LASTLINE_FULL },
+        fontBaselineOption: { normal: FontBaselineOption.FONT_NORMAL_BASELINE, superscript: FontBaselineOption.FONT_FAUXED_SUPERSCRIPT, subscript: FontBaselineOption.FONT_FAUXED_SUBSCRIPT },
+        autoKernType: { none: AutoKernType.NO_AUTO_KERN, metric: AutoKernType.METRIC_KERN, optical: AutoKernType.OPTICAL_KERN },
+        lineJoinType: { miter: LineJoinType.LINE_JOIN_MITER, round: LineJoinType.LINE_JOIN_ROUND, bevel: LineJoinType.LINE_JOIN_BEVEL },
+        direction: { leftToRight: ParagraphDirection.DIRECTION_LEFT_TO_RIGHT, rightToLeft: ParagraphDirection.DIRECTION_RIGHT_TO_LEFT },
+        digitSet: { "default": DigitSet.DEFAULT_DIGITS, arabic: DigitSet.ARABIC_DIGITS, hindi: DigitSet.HINDI_DIGITS },
+        leadingType: { roman: LeadingType.ROMAN_LEADING_TYPE, japanese: LeadingType.JAPANESE_LEADING_TYPE },
+        baselineDirection: { withStream: BaselineDirection.BASELINE_WITH_STREAM, verticalRotated: BaselineDirection.BASELINE_VERTICAL_ROTATED,
+            verticalCrossStream: BaselineDirection.BASELINE_VERTICAL_CROSS_STREAM },
+        lineOrientation: { horizontal: LineOrientation.HORIZONTAL, verticalRtl: LineOrientation.VERTICAL_RIGHT_TO_LEFT, verticalLtr: LineOrientation.VERTICAL_LEFT_TO_RIGHT }
+    };
+    for (var k in o) {
+        if (k === "allCaps") { td.fontCapsOption = o[k] ? FontCapsOption.FONT_ALL_CAPS : FontCapsOption.FONT_NORMAL_CAPS; }
+        else if (k === "smallCaps") { td.fontCapsOption = o[k] ? FontCapsOption.FONT_SMALL_CAPS : FontCapsOption.FONT_NORMAL_CAPS; }
+        else if (k === "autoKernType" || k === "justification" || enums[k]) { td[k] = enums[k][o[k]]; }
+        else { td[map[k]] = o[k]; }
+    }
+}
+
+function runStep(comp, s) {
+    var op = s[0], t, td, prop;
+    if (op === "text") {
+        t = s[2].box ? comp.layers.addBoxText(s[2].box, s[1]) : comp.layers.addText(s[1]);
+        t.name = "T";
+        if (s[2].boxPos) { td = t.property("ADBE Text Properties").property("ADBE Text Document").value; td.boxTextPos = s[2].boxPos; t.property("ADBE Text Properties").property("ADBE Text Document").setValue(td); }
+        return;
+    }
+    t = findText(comp);
+    var src = t.property("ADBE Text Properties").property("ADBE Text Document");
+    if (op === "content") { td = src.value; td.text = s[1]; src.setValue(td); }
+    else if (op === "style") { td = src.value; applyAttrs(td, s[1]); src.setValue(td); }
+    else if (op === "range") { td = src.value; applyAttrs(td.characterRange(s[1], s[2]), s[3]); src.setValue(td); }
+    else if (op === "reset") { td = src.value; if (s[1] !== "paragraph") { td.resetCharStyle(); } if (s[1] !== "character") { td.resetParagraphStyle(); } src.setValue(td); }
+    else if (op === "anim") {
+        var an = t.property("ADBE Text Properties").property("ADBE Text Animators").addProperty("ADBE Text Animator");
+        an.name = s[1];
+        an.property("ADBE Text Selectors").addProperty("ADBE Text Selector");
+        for (var m in s[2]) { an.property("ADBE Text Animator Properties").addProperty(m).setValue(s[2][m]); }
+    } else if (op === "sel" || op === "skey" || op === "get") {
+        prop = t.property("ADBE Text Properties").property("ADBE Text Animators").property(s[1]).property("ADBE Text Selectors").property(1);
+        prop = ADVANCED[s[2]] ? prop.property("ADBE Text Range Advanced").property(s[2]) : prop.property(s[2]);
+        if (op === "get") { prop.valueAtTime(0, false); }
+        else if (op === "sel") { prop.setValue(s[3]); }
+        else {
+            for (var i = 0; i < s[3].length; i++) { prop.setValueAtTime(s[3][i][0], s[3][i][1]); }
+            var e = [new KeyframeEase(0, 33.333333)];
+            for (var j = 1; j <= prop.numKeys; j++) { prop.setTemporalEaseAtKey(j, e, e); }
+        }
+    } else if (op === "rmanim") { t.property("ADBE Text Properties").property("ADBE Text Animators").property(s[1]).remove(); }
+    else if (op === "anchor") { t.property("ADBE Transform Group").property("ADBE Anchor Point").setValue(s[1]); }
+    else if (op === "mask") {
+        var sh = new Shape(), cx = s[1][0], cy = s[1][1], hw = s[2][0] / 2, hh = s[2][1] / 2;
+        sh.vertices = [[cx - hw, cy - hh], [cx + hw, cy - hh], [cx + hw, cy + hh], [cx - hw, cy + hh]];
+        sh.closed = true;
+        t.property("ADBE Mask Parade").addProperty("ADBE Mask Atom").property("ADBE Mask Shape").setValue(sh);
+    } else { throw new Error("unknown step " + op); }
+}
+
+function main() {
+    app.project.close(CloseOptions.DO_NOT_SAVE_CHANGES);
+    app.open(new File(EMPTY_AEP));
+    var base = app.project.items.addComp(BASE, 1920, 1080, 1, 5, 25);
+    base.bgColor = [0, 0, 0];
+    base.layers.addSolid([1, 0, 0], "L", 1920, 1080, 1);
+    for (var i = 0; i < CASES.length; i++) {
+        var comp = base.duplicate();
+        comp.name = CASES[i].id;
+        for (var j = 0; j < CASES[i].steps.length; j++) { runStep(comp, CASES[i].steps[j]); }
+    }
+    app.project.save(new File(OUT_AEP)); // then patch-text.py for 732/733
+    return CASES.length + 1;
+}
+
+if (typeof app !== "undefined" && typeof EC_DATA_ONLY === "undefined") {
+    main();
+}
diff --git a/crates/aep/tests/fixtures/tools/to-mcp.js b/crates/aep/tests/fixtures/tools/to-mcp.js
new file mode 100644
index 000000000..658b72b8f
--- /dev/null
+++ b/crates/aep/tests/fixtures/tools/to-mcp.js
@@ -0,0 +1,99 @@
+// Turns the CASES table of effects.jsx into After Effects MCP batch.run operation lists (for
+// running the generator through the MCP, where eval.run is disabled).
+// Usage: node to-mcp.js <outdir> [stepsItemId]
+//
+// Run sequence (instance.dialogs empty):
+//   1. ae_save_project path <corpus>/scratch-close.aep (never project.open on a
+//      dirty untitled project: AE then raises a Save As dialog)
+//   2. project.open <corpus>/combined/gen/empty-work.aep (copy of 001-empty.aep);
+//      instance.dialogs must be empty
+//   3. batch.run ops/batch-00.json (templates 000-base, 520-solid-M-grey-960x540), then
+//      ops/smoke.json; ae_save_project path .../combined/effects-smoke.aep; run the Rust check
+//      with COMBINED_AEP=that file and COMBINED_CASES=216,390,221,534,323,321,077,220,366
+//   4. fix the table, reopen empty-work.aep (step 1-2), batch-00, batch-01..NN one by one
+//      (check `failed` == 0 after each; timeoutMs 180000)
+//   5. project.import_file test-media/steps.png -> item id N; node to-mcp.js ops N;
+//      batch.run ops/footage-905-....json
+//   6. ae_save_project path <corpus>/combined/effects.aep
+// Writes <outdir>/batch-00.json (templates), batch-NN.json (cases, a few per batch) and, when a
+// stepsItemId is given, the footage case(s) that need the imported steps.png item.
+var fs = require("fs");
+var path = require("path");
+var src = fs.readFileSync(path.join(__dirname, "effects.jsx"), "utf8");
+var EC_DATA_ONLY = true;
+eval(src); // our own generator file (trusted, local): defines CASES, BASE, BASE_M
+
+var out = process.argv[2] || path.join(__dirname, "ops");
+var stepsId = process.argv[3] ? Number(process.argv[3]) : null;
+fs.mkdirSync(out, { recursive: true });
+
+function ops(comp, st) {
+    var op = st[0];
+    if (op === "fx") {
+        var a = { comp: comp, layer: st[1], matchName: st[2] };
+        if (st.length > 3) a.name = st[3];
+        return { operation: "effect.add", args: a };
+    }
+    if (op === "set") return { operation: "effect.set_property", args: { comp: comp, layer: st[1], effectIndex: st[2], property: [st[3]], value: st[4] } };
+    if (op === "key") return { operation: "effect.set_property", args: { comp: comp, layer: st[1], effectIndex: st[2], property: [st[3]], value: st[5], time: st[4] } };
+    if (op === "expr") return { operation: "expression.set", args: { comp: comp, layer: st[1], property: ["ADBE Effect Parade", st[2], st[3]], expression: st[4] } };
+    if (op === "eval") return { operation: "property.get", args: { comp: comp, layer: st[1], property: ["ADBE Effect Parade", st[2], st[3]], time: st[4] } };
+    if (op === "move") return { operation: "effect.move", args: { comp: comp, layer: st[1], effectIndex: st[2], toIndex: st[3] } };
+    if (op === "items") return { operation: "effect.set_dropdown_items", args: { comp: comp, layer: st[1], effect: st[2], items: st[3] } };
+    if (op === "solid") return { operation: "layer.create_solid", args: { comp: comp, name: st[1], color: st[2], width: st[3], height: st[4] } };
+    if (op === "null") return { operation: "layer.create_null", args: { comp: comp, name: st[1] } };
+    if (op === "footage") return { operation: "layer.create_footage", args: { comp: comp, sourceItemId: stepsId, name: st[1] } };
+    if (op === "delete") return { operation: "layer.delete", args: { comp: comp, layer: st[1] } };
+    if (op === "video") return { operation: "layer.set_enabled", args: { comp: comp, layer: st[1], enabled: st[2] } };
+    throw new Error("unknown step " + op);
+}
+
+var templates = [
+    { operation: "comp.create", args: { name: BASE, width: 1920, height: 1080, fps: 25, duration: 5, bgColor: [0, 0, 0] } },
+    { operation: "layer.create_solid", args: { comp: BASE, name: "L", color: [1, 0, 0], width: 1920, height: 1080 } },
+    { operation: "comp.duplicate", args: { comp: BASE, newName: BASE_M } },
+    { operation: "layer.create_solid", args: { comp: BASE_M, name: "M", color: [0.5, 0.5, 0.5], width: 960, height: 540 } }
+];
+fs.writeFileSync(path.join(out, "batch-00.json"), JSON.stringify(templates));
+
+var PER = 16;
+var n = 1, cur = [], count = 0, names = [];
+function flush() {
+    if (cur.length) {
+        fs.writeFileSync(path.join(out, "batch-" + (n < 10 ? "0" : "") + n + ".json"), JSON.stringify(cur));
+        n++;
+        cur = [];
+        count = 0;
+    }
+}
+for (var i = 0; i < CASES.length; i++) {
+    var c = CASES[i];
+    if (c.footage) continue;
+    cur.push({ operation: "comp.duplicate", args: { comp: c.base === "520" ? BASE_M : BASE, newName: c.id } });
+    for (var j = 0; j < c.steps.length; j++) cur.push(ops(c.id, c.steps[j]));
+    names.push(c.id);
+    if (++count >= PER) flush();
+}
+flush();
+if (stepsId !== null) {
+    for (var k = 0; k < CASES.length; k++) {
+        var f = CASES[k];
+        if (!f.footage) continue;
+        var list = [{ operation: "comp.duplicate", args: { comp: BASE, newName: f.id } }];
+        for (var m = 0; m < f.steps.length; m++) list.push(ops(f.id, f.steps[m]));
+        fs.writeFileSync(path.join(out, "footage-" + f.id + ".json"), JSON.stringify(list));
+    }
+}
+// Smoke test: one case per step kind, built on top of batch-00 (run on a scratch save first).
+var SMOKE = ["216-", "390-", "221-", "534-", "323-", "321-", "077-", "220-", "366-"];
+var smoke = [];
+for (var q = 0; q < CASES.length; q++) {
+    var sc = CASES[q];
+    var hit = false;
+    for (var r = 0; r < SMOKE.length; r++) if (sc.id.indexOf(SMOKE[r]) === 0) hit = true;
+    if (!hit) continue;
+    smoke.push({ operation: "comp.duplicate", args: { comp: sc.base === "520" ? BASE_M : BASE, newName: sc.id } });
+    for (var u = 0; u < sc.steps.length; u++) smoke.push(ops(sc.id, sc.steps[u]));
+}
+fs.writeFileSync(path.join(out, "smoke.json"), JSON.stringify(smoke));
+console.log("batches", n - 1, "cases", names.length);
diff --git a/crates/aep/tests/it/common/cases.rs b/crates/aep/tests/it/common/cases.rs
new file mode 100644
index 000000000..46a758e98
--- /dev/null
+++ b/crates/aep/tests/it/common/cases.rs
@@ -0,0 +1,381 @@
+//! The old single-case fixture names and the combined test project that holds each case (as
+//! the composition named like the file without its extension). Generated from the family
+//! partition of the cases (`tests/fixtures/CASES.md`).
+
+/// `(old file name, combined file)`, sorted by name.
+pub const CASES: &[(&str, &str)] = &[
+    ("000-base.aep", "layers-comps.aep"),
+    ("000-base.aepx", "aepx-pair.aepx"),
+    ("001-empty.aep", "empty.aep"),
+    ("010-layer-name.aep", "layers-comps.aep"),
+    ("012-layer-shy.aep", "layers-comps.aep"),
+    ("013-layer-locked.aep", "layers-comps.aep"),
+    ("014-layer-solo.aep", "layers-comps.aep"),
+    ("015-layer-3d.aep", "3d.aep"),
+    ("016-layer-blend-multiply.aep", "layers-comps.aep"),
+    ("017-layer-motionblur.aep", "layers-comps.aep"),
+    ("018-layer-stretch200.aep", "keyframes.aep"),
+    ("019-layer-inpoint1.aep", "layers-comps.aep"),
+    ("021-layer-starttime0.5.aep", "layers-comps.aep"),
+    ("022-layer-parent-null.aep", "layers-comps.aep"),
+    ("023-layer-quality-draft.aep", "layers-comps.aep"),
+    ("024-layer-collapse.aep", "layers-comps.aep"),
+    ("025-layer-adjustment.aep", "layers-comps.aep"),
+    ("026-layer-guide.aep", "layers-comps.aep"),
+    ("030-comp-size-1280x720.aep", "layers-comps.aep"),
+    ("031-comp-fps30.aep", "layers-comps.aep"),
+    ("032-comp-duration10.aep", "layers-comps.aep"),
+    ("033-comp-bg-green.aep", "layers-comps.aep"),
+    ("034-comp-shutter90.aep", "layers-comps.aep"),
+    ("035-comp-workarea-1-2.aep", "layers-comps.aep"),
+    ("037-comp-pixelaspect2.aep", "layers-comps.aep"),
+    ("038-comp-motionblur.aep", "layers-comps.aep"),
+    ("039-comp-renderer-advanced3d.aep", "3d.aep"),
+    ("040-static-position-100-200.aep", "layers-comps.aep"),
+    ("041-static-scale-50.aep", "layers-comps.aep"),
+    ("042-static-rotation-45.aep", "layers-comps.aep"),
+    ("043-static-opacity-25.aep", "layers-comps.aep"),
+    ("044-static-anchor-10-20.aep", "layers-comps.aep"),
+    ("052-key-position-2key-ease.aep", "keyframes.aep"),
+    ("053-key-position-2key-hold-key1.aep", "keyframes.aep"),
+    ("054-key-position-2key-spatial-bezier.aep", "keyframes.aep"),
+    ("055-key-position-3key-inserted-t2.5.aep", "keyframes.aep"),
+    ("056-key-position-3key-roving-key2.aep", "keyframes.aep"),
+    ("057-key-position-3key-label9-key2.aep", "keyframes.aep"),
+    ("058-key-opacity-2key.aep", "keyframes.aep"),
+    ("058-key-opacity-2key.aepx", "aepx-pair.aepx"),
+    ("060-expr-opacity-wiggle.aep", "keyframes.aep"),
+    ("060-expr-opacity-wiggle.aepx", "aepx-pair.aepx"),
+    ("071-fx-slider-value77.aep", "effects.aep"),
+    ("073-fx-color-0.2-0.6-1.aep", "effects.aep"),
+    ("077-fx-dropdown-default.aep", "effects.aep"),
+    ("080-fx-dropshadow-default.aep", "effects.aep"),
+    ("090-mask-rect.aep", "masks.aep"),
+    ("091-mask-rect-props.aep", "masks.aep"),
+    ("093-mask-path-2keys.aep", "masks.aep"),
+    ("110-text-A.aep", "text.aep"),
+    ("110-text-A.aepx", "aepx-pair.aepx"),
+    ("113-text-Hello-size60-fillorange.aep", "text.aep"),
+    ("114-text-animator-opacity.aep", "text.aep"),
+    ("122-marker-comp-1s.aep", "markers.aep"),
+    ("123-marker-layer-1s.aep", "markers.aep"),
+    ("124-precomp-Pre.aep", "footage-precomp.aep"),
+    ("124-precomp-Pre.aepx", "aepx-pair.aepx"),
+    ("126-footage-png-layer.aep", "footage-precomp.aep"),
+    ("202-key-out-hold-in-linear.aep", "keyframes.aep"),
+    ("203-key-in-hold-out-linear.aep", "keyframes.aep"),
+    ("204-key-ease-asymmetric.aep", "keyframes.aep"),
+    ("205-key-opacity-ease-asymmetric.aep", "keyframes.aep"),
+    ("206-key-scale-2key-linear.aep", "keyframes.aep"),
+    ("208-key-mask-feather-2key-linear.aep", "masks.aep"),
+    ("210-key-fill-color-2key-linear.aep", "keyframes.aep"),
+    ("211-anchor-100x100-solid-10-20.aep", "layers-comps.aep"),
+    ("212-anchor-400x300-solid-100-50.aep", "layers-comps.aep"),
+    ("213-expr-opacity-wiggle-disabled.aep", "keyframes.aep"),
+    ("214-fx-gaussianblur-default.aep", "effects.aep"),
+    ("215-fx-fill-default.aep", "effects.aep"),
+    ("216-fx-gaussianblur-40.aep", "effects.aep"),
+    ("217-fx-checkbox-on.aep", "effects.aep"),
+    ("218-fx-point-111-222.aep", "effects.aep"),
+    ("219-fx-angle-90.aep", "effects.aep"),
+    ("220-fx-layercontrol-to-layer1.aep", "effects.aep"),
+    ("221-fx-slider-2key.aep", "effects.aep"),
+    ("222-layer-video-off.aep", "layers-comps.aep"),
+    ("223-layer-audio-off.aep", "layers-comps.aep"),
+    ("224-layer-effects-off.aep", "layers-comps.aep"),
+    ("225-layer-blend-screen.aep", "layers-comps.aep"),
+    ("226-layer-blend-add.aep", "layers-comps.aep"),
+    ("227-layer-blend-overlay.aep", "layers-comps.aep"),
+    ("228-layer-blend-difference.aep", "layers-comps.aep"),
+    ("229-comp-fps-29.97.aep", "layers-comps.aep"),
+    ("230-comp-fps-23.976.aep", "layers-comps.aep"),
+    ("231-comp-bg-grey-0.5.aep", "layers-comps.aep"),
+    ("232-mask-ellipse.aep", "masks.aep"),
+    ("233-mask-open-path.aep", "masks.aep"),
+    ("234-mask-mode-intersect.aep", "masks.aep"),
+    ("235-mask-mode-lighten.aep", "masks.aep"),
+    ("236-mask-mode-darken.aep", "masks.aep"),
+    ("237-mask-mode-difference.aep", "masks.aep"),
+    ("238-shape-rect-rounded-corners.aep", "shapes.aep"),
+    ("239-shape-stroke-green-w8-round.aep", "shapes.aep"),
+    ("240-shape-custom-path-tangents.aep", "shapes.aep"),
+    ("241-shape-gradient-fill-linear.aep", "shapes.aep"),
+    ("242-shape-group-position-50-50.aep", "shapes.aep"),
+    ("243-text-multiline-A-CR-B.aep", "text.aep"),
+    ("245-text-box-400x200-Hello.aep", "text.aep"),
+    ("246-text-box-center-align.aep", "text.aep"),
+    ("247-text-tracking-100.aep", "text.aep"),
+    ("248-text-range-fill-red-1-3.aep", "text.aep"),
+    ("249-marker-layer-full.aep", "markers.aep"),
+    ("251-camera-one-node.aep", "3d.aep"),
+    ("252-light-point.aep", "3d.aep"),
+    ("253-camera-position-100-200-m1000.aep", "3d.aep"),
+    ("254-light-spot-intensity-50.aep", "3d.aep"),
+    ("256-camera-two-node-default.aep", "3d.aep"),
+    ("259-solid-blue-0-0-1.aep", "layers-comps.aep"),
+    ("299-save-noise.aep", "layers-comps.aep"),
+    ("300-fx-gaussianblur-0-explicit.aep", "effects.aep"),
+    ("301-fx-gaussianblur-40-then-25.aep", "effects.aep"),
+    ("302-fx-fill-opacity-100-explicit.aep", "effects.aep"),
+    ("303-fx-fill-opacity-50-then-100.aep", "effects.aep"),
+    ("304-fx-slider-0-explicit.aep", "effects.aep"),
+    ("305-key-scale-bezier-ease.aep", "keyframes.aep"),
+    ("306-key-maskfeather-bezier-ease.aep", "masks.aep"),
+    ("307-key-fillcolor-bezier.aep", "keyframes.aep"),
+    ("309-solid-100x100-mask-rect.aep", "masks.aep"),
+    ("310-solid-100x100-pointcontrol.aep", "layers-comps.aep"),
+    ("311-position-default-explicit.aep", "layers-comps.aep"),
+    ("316-layer-stretch50.aep", "keyframes.aep"),
+    ("317-layer-stretch150.aep", "keyframes.aep"),
+    ("318-layer-inpoint-0.3333.aep", "layers-comps.aep"),
+    ("319-precomp-timeremap.aep", "footage-precomp.aep"),
+    ("320-fx-layercontrol-self-explicit.aep", "effects.aep"),
+    ("321-fx-layercontrol-none.aep", "effects.aep"),
+    ("323-fx-dropdown-5items.aep", "effects.aep"),
+    ("324-fx-dropdown-5items-select3.aep", "effects.aep"),
+    ("325-comp-pixelaspect-0.9091.aep", "layers-comps.aep"),
+    ("326-comp-shutterphase-m90.aep", "layers-comps.aep"),
+    ("327-comp-displaystartframe-100.aep", "layers-comps.aep"),
+    ("328-mask-two-ellipse-rect.aep", "masks.aep"),
+    ("329-mask-ellipse-mode-none.aep", "masks.aep"),
+    ("330-shape-polystar-star-5-50-100.aep", "shapes.aep"),
+    ("331-shape-polystar-polygon-5-100.aep", "shapes.aep"),
+    ("332-shape-gradient-fill-radial.aep", "shapes.aep"),
+    ("333-shape-group-two-rects.aep", "shapes.aep"),
+    ("334-text-box-right-align.aep", "text.aep"),
+    ("335-text-point-fauxbold.aep", "text.aep"),
+    ("336-text-point-fauxitalic.aep", "text.aep"),
+    ("337-text-point-allcaps.aep", "text.aep"),
+    ("338-text-point-smallcaps.aep", "text.aep"),
+    ("339-text-point-leading60.aep", "text.aep"),
+    ("340-text-range-two-styles.aep", "styles.aep"),
+    ("341-camera-zoom-2000.aep", "3d.aep"),
+    ("342-camera-dof-800-30.aep", "3d.aep"),
+    ("343-light-spot-color-red.aep", "3d.aep"),
+    ("344-light-spot-coneangle-60.aep", "3d.aep"),
+    ("345-light-spot-conefeather-30.aep", "3d.aep"),
+    ("347-marker-layer-label3.aep", "markers.aep"),
+    ("348-marker-layer-navigation-cue.aep", "markers.aep"),
+    ("349-marker-layer-event-cue-params.aep", "markers.aep"),
+    ("350-footage-wav-imported.aep", "footage-precomp.aep"),
+    ("351-footage-wav-as-layer.aep", "footage-precomp.aep"),
+    ("352-footage-pngseq-imported.aep", "footage-precomp.aep"),
+    ("354-footage-pngseq-timeremap.aep", "footage-precomp.aep"),
+    ("356-fx-tint-default.aep", "effects.aep"),
+    ("357-fx-tint-black-0.2-0.4-0.6.aep", "effects.aep"),
+    ("361-fx-tint-amount-0.aep", "effects.aep"),
+    ("363-fx-tint-amount-2key.aep", "effects.aep"),
+    ("364-fx-tint-white-2key.aep", "effects.aep"),
+    ("366-fx-blur-then-tint.aep", "effects.aep"),
+    ("368-fx-ramp-default.aep", "effects.aep"),
+    ("369-fx-ramp-start-100-200.aep", "effects.aep"),
+    ("371-fx-ramp-startcolor-red.aep", "effects.aep"),
+    ("374-fx-ramp-end-2000-m100.aep", "effects.aep"),
+    ("377-fx-ramp-shape-radial.aep", "effects.aep"),
+    ("378-fx-ramp-scatter-12.aep", "effects.aep"),
+    ("380-fx-ramp-blend-25pct.aep", "effects.aep"),
+    ("382-fx-ramp-start-2key.aep", "effects.aep"),
+    ("383-fx-ramp-on-100x100-start-10-20.aep", "effects.aep"),
+    ("385-text-anchor-10-20.aep", "text.aep"),
+    ("386-text-etx-A-B.aep", "text.aep"),
+    ("389-fx-exposure-default.aep", "effects.aep"),
+    ("390-fx-exposure-channels-individual.aep", "effects.aep"),
+    ("391-fx-exposure-master-1.5.aep", "effects.aep"),
+    ("393-fx-exposure-offset-0.1.aep", "effects.aep"),
+    ("394-fx-exposure-gamma-2.2.aep", "effects.aep"),
+    ("395-fx-exposure-individual-red-1.aep", "effects.aep"),
+    ("396-fx-exposure-bypass-on.aep", "effects.aep"),
+    ("397-fx-exposure-master-2key.aep", "effects.aep"),
+    ("400-text-autoleading-on.aep", "text.aep"),
+    ("403-matte-L-alpha-M.aep", "layers-comps.aep"),
+    ("404-matte-L-alphainv-M.aep", "layers-comps.aep"),
+    ("405-matte-L-luma-M.aep", "layers-comps.aep"),
+    ("406-matte-L-lumainv-M.aep", "layers-comps.aep"),
+    ("407-matte-M-alpha-L-below.aep", "layers-comps.aep"),
+    ("408-matte-L-alpha-M-visible.aep", "layers-comps.aep"),
+    ("410-fx-invert-channel-2.aep", "effects.aep"),
+    ("411-fx-invert-blend-50.aep", "effects.aep"),
+    ("413-fx-fastbox-radius-20.aep", "effects.aep"),
+    ("414-fx-fastbox-iterations-1.aep", "effects.aep"),
+    ("416-fx-fastbox-repeatedge-off.aep", "effects.aep"),
+    ("418-fx-gaussian-dimensions-3.aep", "effects.aep"),
+    ("419-fx-gaussian-repeatedge-off.aep", "effects.aep"),
+    ("422-fx-dropshadow-opacity-204.aep", "effects.aep"),
+    ("426-fx-dropshadow-shadowonly-on.aep", "effects.aep"),
+    ("427-fx-glow-default.aep", "effects.aep"),
+    ("429-fx-glow-threshold-76.5.aep", "effects.aep"),
+    ("438-fx-glow-midpoint-0.25.aep", "effects.aep"),
+    ("444-fx-huesat-hue-90.aep", "effects.aep"),
+    ("446-fx-huesat-light-m30.aep", "effects.aep"),
+    ("448-fx-huesat-colorizehue-120.aep", "effects.aep"),
+    ("451-shape-ellipse-400x300-fill.aep", "shapes.aep"),
+    ("457-shape-group-scale-50-80.aep", "shapes.aep"),
+    ("462-shape-layer-anchor-10-20.aep", "shapes.aep"),
+    ("464-shape-stroke-opacity-50.aep", "shapes.aep"),
+    ("467-shape-trim-end-70.aep", "shapes.aep"),
+    ("469-shape-trim-type-2.aep", "shapes.aep"),
+    ("471-shape-rect-roundness-30.aep", "shapes.aep"),
+    ("473-shape-star-points-6.aep", "shapes.aep"),
+    ("482-shape-two-groups.aep", "shapes.aep"),
+    ("483-shape-nested-group-rect.aep", "shapes.aep"),
+    ("485-layer-3d-on.aep", "3d.aep"),
+    ("486-layer-3d-rotx-30.aep", "3d.aep"),
+    ("487-layer-3d-roty-45.aep", "3d.aep"),
+    ("488-layer-3d-orientation-10-20-30.aep", "3d.aep"),
+    ("509-marker-comp-two.aep", "markers.aep"),
+    ("510-marker-layer-0.52-dur0.3.aep", "markers.aep"),
+    ("512-fx-levels-inblack-0.1.aep", "effects.aep"),
+    ("514-fx-levels-gamma-2.aep", "effects.aep"),
+    ("516-fx-levels-outwhite-0.9.aep", "effects.aep"),
+    ("517-text-box-600x400-wrap.aep", "text.aep"),
+    ("519-shape-all-items-default.aep", "shapes.aep"),
+    ("526-text-point-HHHH-default.aep", "text.aep"),
+    ("527-text-point-HHHH-baseline-normal.aep", "text.aep"),
+    ("528-text-point-HHHH-baseline-subscript.aep", "text.aep"),
+    ("529-fx-timewarp-default.aep", "effects.aep"),
+    ("530-fx-timewarp-speed-25.aep", "effects.aep"),
+    ("531-fx-timewarp-speed-keyed-50-200.aep", "effects.aep"),
+    ("532-fx-timewarp-method-1.aep", "effects.aep"),
+    ("533-fx-timewarp-sourceframe-12.aep", "effects.aep"),
+    ("534-fx-slider-expression-time10.aep", "effects.aep"),
+    ("535-camera-position-on-3d-rotx.aep", "3d.aep"),
+    ("536-camera-one-node-position-on-3d-rotx.aep", "3d.aep"),
+    ("537-camera-default-on-3d-rotx.aep", "3d.aep"),
+    ("538-text-point-HHHH-normal-ref.aep", "text.aep"),
+    ("539-text-hscale-0.9.aep", "text.aep"),
+    ("540-text-vscale-1.5.aep", "text.aep"),
+    ("541-text-baselineshift-41.aep", "text.aep"),
+    ("542-text-autokern-none.aep", "text.aep"),
+    ("543-text-autokern-optical.aep", "text.aep"),
+    ("544-text-applystroke-on.aep", "text.aep"),
+    ("545-text-strokewidth-5.aep", "text.aep"),
+    ("546-text-applyfill-off.aep", "text.aep"),
+    ("548-text-linejoin-round.aep", "text.aep"),
+    ("550-text-strokeoverfill-off.aep", "text.aep"),
+    ("552-text-nobreak-on.aep", "text.aep"),
+    ("553-text-tsume-0.5.aep", "text.aep"),
+    ("554-text-kerning-50.aep", "text.aep"),
+    ("555-text-ligature-on.aep", "text.aep"),
+    ("556-text-autohyphenate-off.aep", "text.aep"),
+    ("558-text-hangingroman-on.aep", "text.aep"),
+    ("559-text-everyline-on.aep", "text.aep"),
+    ("560-text-firstlineindent-20.aep", "text.aep"),
+    ("561-text-startindent-30.aep", "text.aep"),
+    ("562-text-endindent-40.aep", "text.aep"),
+    ("563-text-spacebefore-10.aep", "text.aep"),
+    ("564-text-spaceafter-12.aep", "text.aep"),
+    ("565-text-justify-fullleft.aep", "text.aep"),
+    ("566-text-justify-fullcenter.aep", "text.aep"),
+    ("567-text-justify-fullright.aep", "text.aep"),
+    ("568-text-justify-fullall.aep", "text.aep"),
+    ("569-text-direction-rtl.aep", "text.aep"),
+    ("571-text-digitset-arabic.aep", "text.aep"),
+    ("572-text-leadingtype-japanese.aep", "text.aep"),
+    ("573-text-baselinedir-rotated.aep", "text.aep"),
+    ("575-text-vertical-rtl.aep", "text.aep"),
+    ("576-text-baselinedir-crossstream.aep", "text.aep"),
+    ("578-text-digitset-hindi.aep", "text.aep"),
+    ("579-textanim-position-0-m50.aep", "text.aep"),
+    ("580-textanim-start-25.aep", "text.aep"),
+    ("581-textanim-end-75.aep", "text.aep"),
+    ("582-textanim-offset-10.aep", "text.aep"),
+    ("583-textanim-units-index.aep", "text.aep"),
+    ("584-textanim-basedon-3-words.aep", "text.aep"),
+    ("585-textanim-mode-2-subtract.aep", "text.aep"),
+    ("586-textanim-amount-50.aep", "text.aep"),
+    ("587-textanim-shape-2-rampup.aep", "text.aep"),
+    ("588-textanim-smoothness-50.aep", "text.aep"),
+    ("589-textanim-easehigh-30.aep", "text.aep"),
+    ("590-textanim-easelow-40.aep", "text.aep"),
+    ("591-textanim-randomize-seed-7.aep", "text.aep"),
+    ("592-textanim-many-props.aep", "text.aep"),
+    ("593-textanim-start-keyed-ease-0-100.aep", "text.aep"),
+    ("594-textanim-position-start-keyed-ease.aep", "text.aep"),
+    ("595-text-stroke-scale-shift-combined.aep", "text.aep"),
+    ("596-text-combined-fill-over-stroke.aep", "text.aep"),
+    ("597-key-anchor-ease-out50-40-in30-60.aep", "keyframes.aep"),
+    ("598-key-ramp-point-ease-color-bezier.aep", "keyframes.aep"),
+    ("599-key-mask-path-ease-infl75.aep", "masks.aep"),
+    ("601-precomp-two-comps-in-C.aep", "footage-precomp.aep"),
+    ("603-footage-exrseq-0101-as-layer.aep", "footage-precomp.aep"),
+    ("610-fx-tint-named-My-Tint.aep", "effects.aep"),
+    ("621-settings-bpc-8.aep", "settings-a.aep"),
+    ("622-settings-bpc-16.aep", "settings-c.aep"),
+    ("623-settings-workingspace-none.aep", "settings-a.aep"),
+    ("625-settings-gamma-2.4.aep", "settings-a.aep"),
+    ("628-settings-scene-compensation-off.aep", "settings-a.aep"),
+    ("629-settings-time-display-frames.aep", "settings-a.aep"),
+    ("630-settings-frame-start-1.aep", "settings-a.aep"),
+    ("632-settings-linearize-and-blend-linear.aep", "settings-b.aep"),
+    ("633-settings-feet-frames-35.aep", "settings-b.aep"),
+    ("634-settings-feet-frames-16.aep", "settings-c.aep"),
+    ("641-stretch-200-keys-position-1s-2s.aep", "keyframes.aep"),
+    ("642-stretch-50-keys-position-1s-2s.aep", "keyframes.aep"),
+    ("643-stretch-200-start-1-keys-position-2s-3s.aep", "keyframes.aep"),
+    ("645-footage-mp4-conform-30.aep", "footage-precomp.aep"),
+    ("650-footage-tga-still-as-layer.aep", "footage-precomp.aep"),
+    ("651-footage-psd-flat-as-layer.aep", "footage-precomp.aep"),
+    ("652-footage-ai-as-layer.aep", "footage-precomp.aep"),
+    ("653-footage-eps-as-layer.aep", "footage-precomp.aep"),
+    ("700-key-mask-path-ease-out20-in50.aep", "masks.aep"),
+    ("701-light-parallel-int80-color.aep", "3d.aep"),
+    ("702-light-ambient-int50-color.aep", "3d.aep"),
+    ("703-key-orientation-0-to-10-20-30-linear.aep", "3d.aep"),
+    ("704-light-environment-default.aep", "3d.aep"),
+    ("705-mask-on-text-rect-40-m70-160-10.aep", "text.aep"),
+    ("706-mask-on-shape-rect-0-m150-100-150.aep", "masks.aep"),
+    ("707-shape-merge-subtract-rect-ellipse.aep", "shapes.aep"),
+    ("708-shape-merge-intersect-rect-ellipse.aep", "shapes.aep"),
+    ("709-shape-repeater-3-pos150-60-rot10-scale90-80-op40.aep", "shapes.aep"),
+    ("710-shape-offset-paths-20-round.aep", "shapes.aep"),
+    ("711-fx-directional-blur-30-40-on-M.aep", "effects.aep"),
+    ("712-fx-eleven-effects-defaults-on-M.aep", "effects.aep"),
+    ("713-fx-radial-blur-zoom-20-on-M.aep", "effects.aep"),
+    ("714-fx-ccradial-type2-30-60-on-M.aep", "effects.aep"),
+    ("715-fx-venetian-40-30-50-5-on-M.aep", "effects.aep"),
+    ("716-fx-channel-blur-5-10-15-20-edge-horiz-on-M.aep", "effects.aep"),
+    ("717-fx-blackwhite-set-tint-on-L.aep", "effects.aep"),
+    ("718-fx-tritone-set-blend25-on-L.aep", "effects.aep"),
+    ("719-fx-lumakey-darker-140-20-1-2.5-on-M.aep", "effects.aep"),
+    ("720-fx-simplechoker-3.5-on-M.aep", "effects.aep"),
+    ("721-fx-simplechoker-3.5-view-matte-on-M.aep", "effects.aep"),
+    ("722-fx-mattechoker-set-on-M.aep", "effects.aep"),
+    ("723-fx-transform-set-on-M.aep", "effects.aep"),
+    ("725-text-point-HHHH-normal-ref-S18.aep", "text.aep"),
+    ("727-text-reset-paragraph.aep", "text.aep"),
+    ("728-textanim-character-offset-3.aep", "text.aep"),
+    ("730-key-anchor-ease-on-400x800-solid.aep", "keyframes.aep"),
+    ("731-shape-merge-offset-repeater-defaults.aep", "shapes.aep"),
+    ("732-text-box-byteedit-para24-0.aep", "text.aep"),
+    ("733-text-box-byteedit-para35-0.aep", "text.aep"),
+    ("734-text-box-byteedit-style68-1.aep", "styles.aep"),
+    ("828-shape-offset-paths-20-copies3-copyoffset1.5-stroke.aep", "shapes.aep"),
+    ("851-shape-key-trim-end-0-100-linear.aep", "shapes.aep"),
+    ("852-shape-key-trim-end-bezier-out0-60-in20-30.aep", "shapes.aep"),
+    ("853-shape-key-group-position-0-200-100-linear.aep", "shapes.aep"),
+    ("854-shape-key-fill-color-red-blue-linear.aep", "shapes.aep"),
+    ("855-shape-key-trim-offset-0-90-hold.aep", "shapes.aep"),
+    ("856-shape-trim-end-expression-time50.aep", "shapes.aep"),
+    ("857-shape-key-group-scale-100-50-150-linear.aep", "shapes.aep"),
+    ("900-mask-added-no-path.aep", "masks.aep"),
+    ("901-mask-no-path-expansion-m100.aep", "masks.aep"),
+    ("902-settings-rec709-16bpc-steps-png-grey-solid.aep", "settings-c.aep"),
+    ("905-fx-24-effects-set-one-comp.aep", "effects.aep"),
+    ("906-blendmodes-13-solids-on-steps.aep", "layers-comps.aep"),
+    ("951-styles-all-nine-defaults-on-B.aep", "styles.aep"),
+    ("963-curves-red-mid-down-on-S.aep", "styles.aep"),
+    ("964-curves-rgb-s-curve-on-S.aep", "styles.aep"),
+    ("966-style-drop-shadow-opacity50-distance20.aep", "styles.aep"),
+    ("970-style-stroke-size10-color-green.aep", "styles.aep"),
+    ("974-style-gradient-overlay-angle45-scale150.aep", "styles.aep"),
+    ("975-style-fill-opacity0-with-drop-shadow.aep", "styles.aep"),
+    ("976-style-drop-shadow-opacity-keyed-100-20-linear.aep", "styles.aep"),
+    ("977-styles-all-params-changed.aep", "styles.aep"),
+    ("979-style-inner-glow-source-2.aep", "styles.aep"),
+    ("981-layer-stretch-minus100-start5.aep", "keyframes.aep"),
+    ("982-layer-stretch-minus100-opacity-keys.aep", "keyframes.aep"),
+    ("983-layer-stretch-minus50-opacity-keys.aep", "keyframes.aep"),
+    ("985-meshwarp-3x3-vertex-moved-on-S.aep", "styles.aep"),
+    ("986-shape-fill-switched-off-green.aep", "shapes.aep"),
+    ("988-style-drop-shadow-switched-off.aep", "styles.aep"),
+];
diff --git a/crates/aep/tests/it/common/mod.rs b/crates/aep/tests/it/common/mod.rs
new file mode 100644
index 000000000..134aff2fd
--- /dev/null
+++ b/crates/aep/tests/it/common/mod.rs
@@ -0,0 +1,333 @@
+//! The one place the tests reach the generated `.aep` / `.aepx` test projects.
+//!
+//! Every test addresses a case by its case name, the name of the single-case file it was first
+//! written against (`"058-key-opacity-2key.aep"`). The cases now live in a few combined projects
+//! (`tests/fixtures/CASES.md`): each case is the composition named like the case without its
+//! extension (`058-key-opacity-2key`), built like the single-case file's composition `C` (plus
+//! the compositions it uses). [`try_fixture`] hands a test the case as a project of its own: the
+//! combined file with every project item removed that the case composition does not use
+//! (directly or through precomposition layers), written back with [`effectcraft_aep::write`].
+//! The case composition is renamed `C` as in the single-case files; everything else of the file
+//! (project settings, the effect definitions, the XMP packet) stays, and the layers and items keep
+//! the ids they have in the combined file.
+//!
+//! A case name that is a file of its own in the directory (an old single-case fixture or a
+//! combined file's own name) is read as it is. When the file is not
+//! there the test prints `SKIPPED: fixture <name> missing` and returns without failing (the
+//! macros below), so the suite runs without the projects. The directory is the one in the
+//! `EFFECTCRAFT_AEP_FIXTURES` environment variable (which may also hold the old single-case
+//! files); without it every such test skips. With `EFFECTCRAFT_AEP_FIXTURES_REQUIRED` set (to
+//! anything but an empty string) a missing project fails the test instead, so a run against the
+//! corpus cannot pass by skipping. The engine tests include this file too.
+#![allow(dead_code, unused_macros)]
+
+mod cases;
+
+use std::collections::{BTreeSet, HashMap};
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex, OnceLock};
+
+use effectcraft_aep::{AepFile, Body, Chunk, ItemKind, Project};
+
+pub use cases::CASES;
+
+/// The directory the test projects are read from, or `None` when `EFFECTCRAFT_AEP_FIXTURES` is
+/// not set (the projects are opt-in).
+pub fn dir() -> Option<PathBuf> {
+    std::env::var_os("EFFECTCRAFT_AEP_FIXTURES").filter(|d| !d.is_empty()).map(PathBuf::from)
+}
+
+/// The combined files the cases live in (and the empty project, a file of its own), sorted.
+pub const FILES: &[&str] = &[
+    "3d.aep",
+    "aepx-pair.aep",
+    "aepx-pair.aepx",
+    "effects.aep",
+    "empty.aep",
+    "footage-precomp.aep",
+    "fx-switch.aep",
+    "keyframes.aep",
+    "layers-comps.aep",
+    "markers.aep",
+    "masks.aep",
+    "settings-a.aep",
+    "settings-b.aep",
+    "settings-c.aep",
+    "shapes.aep",
+    "styles.aep",
+    "text.aep",
+];
+
+/// Where a case is read from.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Source {
+    /// A file of its own, read as it is.
+    File(PathBuf),
+    /// The composition `comp` of the combined project `file`.
+    Case { file: PathBuf, comp: String },
+}
+
+impl Source {
+    /// The file the case is in.
+    pub fn path(&self) -> &PathBuf {
+        match self {
+            Source::File(p) | Source::Case { file: p, .. } => p,
+        }
+    }
+}
+
+/// The combined file of a case name (`None` for a name that is not a case).
+pub fn combined_file(name: &str) -> Option<&'static str> {
+    CASES.binary_search_by(|(n, _)| n.cmp(&name)).ok().and_then(|i| CASES.get(i)).map(|(_, f)| *f)
+}
+
+/// The name of the case's composition: the case name without its extension.
+pub fn case_comp(name: &str) -> &str {
+    name.rsplit_once('.').map_or(name, |(stem, _)| stem)
+}
+
+/// Whether `path` is a file. Only a missing path is `false`: any other error (no permission, a
+/// broken folder) fails the test, so a fixture that is there but unreadable never turns into a skip.
+fn is_fixture(path: &std::path::Path) -> bool {
+    match std::fs::metadata(path) {
+        Ok(m) if m.is_file() => true,
+        Ok(_) => panic!("{}: not a file", path.display()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => false,
+        Err(e) => panic!("{}: {e}", path.display()),
+    }
+}
+
+/// Where a case is, or `None` (after printing the skip line) when its file is missing.
+pub fn locate(name: &str) -> Option<Source> {
+    let Some(dir) = dir() else {
+        skipped(name);
+        return None;
+    };
+    let own = dir.join(name);
+    if is_fixture(&own) {
+        return Some(Source::File(own));
+    }
+    let Some(file) = combined_file(name) else {
+        skipped(name);
+        return None;
+    };
+    let path = dir.join(file);
+    if !is_fixture(&path) {
+        skipped(name);
+        return None;
+    }
+    // The empty project is a whole file: it has no composition.
+    if file == "empty.aep" {
+        return Some(Source::File(path));
+    }
+    Some(Source::Case { file: path, comp: case_comp(name).to_string() })
+}
+
+/// The file a case is in (the combined project for a case in one), or `None` when it is missing.
+pub fn resolve(name: &str) -> Option<PathBuf> {
+    locate(name).map(|s| s.path().clone())
+}
+
+/// The bytes of a case (see the module comment), or `None` when it is missing.
+pub fn try_fixture(name: &str) -> Option<Vec<u8>> {
+    match locate(name)? {
+        Source::File(path) => Some(std::fs::read(&path).unwrap_or_else(|e| panic!("{}: {e}", path.display()))),
+        Source::Case { file, comp } => Some(case_bytes(&file, &comp).as_ref().clone()),
+    }
+}
+
+/// The bytes of a whole file of the directory (a combined project), or `None` when it is missing.
+pub fn try_file(file: &str) -> Option<Vec<u8>> {
+    let path = dir()?.join(file);
+    if is_fixture(&path) {
+        Some(std::fs::read(&path).unwrap_or_else(|e| panic!("{}: {e}", path.display())))
+    } else {
+        skipped(file);
+        None
+    }
+}
+
+/// The case names with this extension (sorted), or `None` when there are none: the cases of
+/// [`CASES`] whose file (of its own or combined) is there, else the files with that extension.
+pub fn names(ext: &str) -> Option<Vec<String>> {
+    let Some(dir) = dir() else {
+        skipped(&format!("*.{ext}"));
+        return None;
+    };
+    let mut v: Vec<String> = CASES
+        .iter()
+        .filter(|(n, f)| std::path::Path::new(n).extension().is_some_and(|x| x == ext) && (is_fixture(&dir.join(n)) || is_fixture(&dir.join(f))))
+        .map(|(n, _)| n.to_string())
+        .collect();
+    if v.is_empty() {
+        let entries = match std::fs::read_dir(&dir) {
+            Ok(entries) => entries.map(|e| e.unwrap_or_else(|e| panic!("{}: {e}", dir.display()))).collect(),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Vec::new(),
+            Err(e) => panic!("{}: {e}", dir.display()),
+        };
+        v = entries
+            .into_iter()
+            .filter_map(|e| e.file_name().into_string().ok())
+            .filter(|n| std::path::Path::new(n).extension().is_some_and(|x| x == ext))
+            .collect();
+    }
+    v.sort();
+    if v.is_empty() {
+        skipped(&format!("*.{ext}"));
+        None
+    } else {
+        Some(v)
+    }
+}
+
+pub fn skipped(name: &str) {
+    assert!(
+        std::env::var_os("EFFECTCRAFT_AEP_FIXTURES_REQUIRED").is_none_or(|v| v.is_empty()),
+        "fixture {name} missing (EFFECTCRAFT_AEP_FIXTURES_REQUIRED is set; EFFECTCRAFT_AEP_FIXTURES = {:?})",
+        std::env::var_os("EFFECTCRAFT_AEP_FIXTURES")
+    );
+    println!("SKIPPED: fixture {name} missing");
+}
+
+/// A parsed combined file, read once per test binary.
+fn parsed(file: &PathBuf) -> &'static AepFile<'static> {
+    static FILES: OnceLock<Mutex<HashMap<PathBuf, &'static AepFile<'static>>>> = OnceLock::new();
+    let mut files = FILES.get_or_init(Default::default).lock().unwrap_or_else(|e| e.into_inner());
+    files.entry(file.clone()).or_insert_with(|| {
+        let bytes: &'static [u8] = Box::leak(std::fs::read(file).unwrap_or_else(|e| panic!("{}: {e}", file.display())).into_boxed_slice());
+        Box::leak(Box::new(effectcraft_aep::parse_any(bytes).unwrap_or_else(|e| panic!("{}: {e}", file.display()))))
+    })
+}
+
+/// The single-case project of composition `comp` in `file`, made once per test binary.
+fn case_bytes(file: &PathBuf, comp: &str) -> Arc<Vec<u8>> {
+    static CASES_MADE: OnceLock<Mutex<HashMap<(PathBuf, String), Arc<Vec<u8>>>>> = OnceLock::new();
+    let key = (file.clone(), comp.to_string());
+    if let Some(b) = CASES_MADE.get_or_init(Default::default).lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
+        return b.clone();
+    }
+    let bytes = Arc::new(isolate(parsed(file), comp).unwrap_or_else(|e| panic!("{}: case {comp}: {e}", file.display())));
+    CASES_MADE.get_or_init(Default::default).lock().unwrap_or_else(|e| e.into_inner()).insert(key, bytes.clone());
+    bytes
+}
+
+/// The item id of an `Item` list (`idta` byte 16).
+fn item_id(item: &Chunk<'_>) -> Option<u32> {
+    let idta = item.child(b"idta")?.bytes()?;
+    Some(u32::from_be_bytes(idta.get(16..20)?.try_into().ok()?))
+}
+
+/// The cases that import a footage file without using it in their composition, and how to find
+/// that item: it stays with the case.
+const UNUSED_FOOTAGE: &[(&str, &str, fn(&effectcraft_aep::Item<'_, '_>) -> bool)] = &[
+    ("350-footage-wav-imported", "the WAV", |i| i.footage().and_then(|f| f.path).is_some_and(|p| p.ends_with("test-tone.wav"))),
+    ("352-footage-pngseq-imported", "the png sequence", |i| i.sequence_info().is_some_and(|s| s.prefix == "seq_" && s.suffix == ".png")),
+];
+
+/// `file` with only the composition `comp` and the project items it uses (layer sources,
+/// transitively), and the folders that hold them; the composition is renamed `C`.
+pub fn isolate(file: &AepFile<'_>, comp: &str) -> Result<Vec<u8>, String> {
+    let project = Project::new(file).ok_or("no project")?;
+    let items = project.all_items();
+    let case =
+        items.iter().find(|i| i.kind() == Some(ItemKind::Composition) && i.name().as_deref() == Some(comp)).ok_or_else(|| format!("no composition {comp}"))?;
+    let mut keep = BTreeSet::new();
+    let mut todo = vec![case.id().ok_or("case without id")?];
+    for (_, what, is) in UNUSED_FOOTAGE.iter().filter(|(c, _, _)| *c == comp) {
+        todo.push(items.iter().find(|i| is(i)).and_then(|i| i.id()).ok_or_else(|| format!("no item {what}"))?);
+    }
+    while let Some(id) = todo.pop() {
+        if !keep.insert(id) {
+            continue;
+        }
+        let Some(item) = items.iter().find(|i| i.id() == Some(id)) else { continue };
+        if let Some(c) = item.comp() {
+            todo.extend(c.layers().filter_map(|l| l.header()?.source_id));
+        }
+    }
+    let mut out = file.clone();
+    let fold = out.chunks.iter_mut().find(|c| c.is_list(b"Fold")).ok_or("no LIST Fold")?;
+    prune(fold, &keep);
+    rename(fold, case.id().ok_or("case without id")?, "C");
+    effectcraft_aep::write(&out).map_err(|e| e.to_string())
+}
+
+/// Removes the items of `list` (and of its folders) that are not kept; a folder stays while it
+/// holds a kept item.
+fn prune(list: &mut Chunk<'_>, keep: &BTreeSet<u32>) {
+    let Body::List { children, .. } = &mut list.body else { return };
+    children.retain_mut(|c| {
+        if !c.is_list(b"Item") {
+            return true;
+        }
+        if let Body::List { children: inner, .. } = &mut c.body
+            && let Some(sfdr) = inner.iter_mut().find(|x| x.is_list(b"Sfdr"))
+        {
+            prune(sfdr, keep);
+            let holds = sfdr.children().iter().any(|x| x.is_list(b"Item"));
+            return holds || item_id(c).is_some_and(|id| keep.contains(&id));
+        }
+        item_id(c).is_some_and(|id| keep.contains(&id))
+    });
+}
+
+/// Renames the item with this id (searching folders too).
+fn rename(list: &mut Chunk<'_>, id: u32, name: &str) -> bool {
+    let Body::List { children, .. } = &mut list.body else { return false };
+    for c in children.iter_mut().filter(|c| c.is_list(b"Item")) {
+        if item_id(c) == Some(id) {
+            let Body::List { children: inner, .. } = &mut c.body else { return false };
+            let Some(utf8) = inner.iter_mut().find(|x| x.is(b"Utf8")) else { return false };
+            *utf8 = Chunk::data(*b"Utf8", name.as_bytes().to_vec());
+            return true;
+        }
+        if let Body::List { children: inner, .. } = &mut c.body
+            && let Some(sfdr) = inner.iter_mut().find(|x| x.is_list(b"Sfdr"))
+            && rename(sfdr, id, name)
+        {
+            return true;
+        }
+    }
+    false
+}
+
+/// The bytes of a case; returns from the calling test when it is missing.
+macro_rules! fixture {
+    ($name:expr) => {
+        match $crate::common::try_fixture(&$name) {
+            Some(bytes) => bytes,
+            None => return,
+        }
+    };
+}
+
+/// The path of a case's file; returns from the calling test when it is missing.
+macro_rules! fixture_path {
+    ($name:expr) => {
+        match $crate::common::resolve(&$name) {
+            Some(path) => path,
+            None => return,
+        }
+    };
+}
+
+/// The case names with this extension; returns from the calling test when there are none.
+macro_rules! fixture_names {
+    ($ext:expr) => {
+        match $crate::common::names($ext) {
+            Some(names) => names,
+            None => return,
+        }
+    };
+}
+
+/// The value of a helper that returns `None` for a missing case; returns from the calling test
+/// then (the helper has printed the skip line).
+macro_rules! skip {
+    ($e:expr) => {
+        match $e {
+            Some(value) => value,
+            None => return,
+        }
+    };
+}
diff --git a/crates/aep/tests/it/container.rs b/crates/aep/tests/it/container.rs
new file mode 100644
index 000000000..5031a11dc
--- /dev/null
+++ b/crates/aep/tests/it/container.rs
@@ -0,0 +1,29 @@
+//! container tests of effectcraft-aep.
+
+#[macro_use]
+mod helpers;
+
+mod aepx;
+mod batch3_core;
+mod batch3_objects;
+mod batch5;
+mod cases_600;
+mod ease_round2;
+mod effects;
+mod effects_batch4;
+mod effects_batch5;
+mod effects_exposure;
+mod header;
+mod keyframes;
+mod layer_switches;
+mod masks;
+mod matte;
+mod odd_cases;
+mod robustness;
+mod roundtrip;
+mod shapes;
+mod text_fields;
+mod text_markers_footage;
+mod text_style_slots;
+mod typed;
+mod values;
diff --git a/crates/aep/tests/it/container/aepx.rs b/crates/aep/tests/it/container/aepx.rs
new file mode 100644
index 000000000..0baf1afd8
--- /dev/null
+++ b/crates/aep/tests/it/container/aepx.rs
@@ -0,0 +1,174 @@
+//! `.aepx` (the XML form) read into the chunk tree, compared with the `.aep` of the same project.
+//!
+//! The pair `aepx-pair` (cases 000, 058, 060, 110 and 124, one composition each) was saved by
+//! After Effects from the same state, the `.aepx` right after the `.aep`.
+//! The trees are identical except for two documented differences: the save counter (`head`
+//! `u32` at byte 16) is one higher in the `.aepx`, and pad bytes are not written in XML (an odd
+//! body gets a zero pad byte). The XMP packet of the fixtures is the base packet in both forms.
+
+use effectcraft_aep::{AepError, AepFile, Body, Chunk, Limits, Project, is_aepx, parse, parse_any, read_aepx, read_aepx_with_limits, write};
+
+/// The `.aepx` fixtures; each has the `.aep` of the same name.
+const PAIRS: &[&str] = &["aepx-pair"];
+
+/// The `.aep` tree with the differences an `.aepx` of the next save has removed: the `head` save
+/// counter is taken from `other`.
+fn with_head_of(mut file: AepFile<'static>, other: &AepFile<'_>) -> AepFile<'static> {
+    if let (Some(h), Some(src)) = (file.chunks.iter_mut().find(|c| c.is(b"head")), other.chunk(b"head")) {
+        *h = src.clone().into_owned();
+    }
+    file
+}
+
+/// The first difference of two chunk sequences, as a path, ignoring pad bytes.
+fn first_difference(a: &[Chunk<'_>], b: &[Chunk<'_>], path: &str) -> Option<String> {
+    if a.len() != b.len() {
+        return Some(format!("{path}: {} chunks against {}", a.len(), b.len()));
+    }
+    for (i, (x, y)) in a.iter().zip(b).enumerate() {
+        let name = String::from_utf8_lossy(&x.list_type().unwrap_or(x.id)).into_owned();
+        let here = format!("{path}/{i}:{name}");
+        if x.id != y.id || x.list_type() != y.list_type() {
+            return Some(format!("{here}: id differs"));
+        }
+        match (&x.body, &y.body) {
+            (Body::Data(p), Body::Data(q)) | (Body::OpaqueList { data: p, .. }, Body::OpaqueList { data: q, .. }) => {
+                if p != q {
+                    return Some(format!("{here}: body differs"));
+                }
+            }
+            (Body::Chunks(p), Body::Chunks(q)) | (Body::List { children: p, .. }, Body::List { children: q, .. }) => {
+                if let Some(d) = first_difference(p, q, &here) {
+                    return Some(d);
+                }
+            }
+            _ => return Some(format!("{here}: body kind differs")),
+        }
+    }
+    None
+}
+
+fn head_counter(file: &AepFile<'_>) -> u32 {
+    let h = file.chunk(b"head").and_then(Chunk::bytes).expect("head");
+    u32::from_be_bytes([h[16], h[17], h[18], h[19]])
+}
+
+#[test]
+fn every_pair_gives_the_same_chunk_tree() {
+    for name in PAIRS {
+        let aep = skip!(crate::common::try_file(&format!("{name}.aep")));
+        let aepx = skip!(crate::common::try_file(&format!("{name}.aepx")));
+        assert!(is_aepx(&aepx) && !is_aepx(&aep), "{name}");
+        let bin = parse(&aep).unwrap();
+        let xml = read_aepx(&aepx).unwrap_or_else(|e| panic!("{name}: {e}"));
+        // The save counter is the only difference in the container.
+        assert_eq!(head_counter(&xml), head_counter(&bin) + 1, "{name}");
+        let same = with_head_of(bin.clone().into_owned(), &xml);
+        assert_eq!(first_difference(&same.chunks, &xml.chunks, ""), None, "{name}");
+        assert_eq!(xml.trailer, bin.trailer, "{name}: XMP packet");
+        // Even the bytes agree: written as an `.aep`, the tree is the `.aep` with the next save counter.
+        assert!(write(&xml).unwrap() == write(&same).unwrap(), "{name}: written bytes differ");
+        // And the content sniffer picks the right reader for both.
+        assert_eq!(parse_any(&aepx).unwrap(), xml, "{name}");
+        assert_eq!(parse_any(&aep).unwrap(), bin, "{name}");
+    }
+}
+
+#[test]
+fn the_typed_view_reads_the_same_values() {
+    for name in PAIRS {
+        let aep = skip!(crate::common::try_file(&format!("{name}.aep")));
+        let aepx = skip!(crate::common::try_file(&format!("{name}.aepx")));
+        let bin = parse(&aep).unwrap();
+        let xml = read_aepx(&aepx).unwrap();
+        let (pb, px) = (Project::new(&bin).unwrap(), Project::new(&xml).unwrap());
+        let items = |p: &Project<'_, '_>| p.all_items().iter().map(|i| (i.kind(), i.display_name(), i.id())).collect::<Vec<_>>();
+        assert_eq!(items(&pb), items(&px), "{name}");
+        for (cb, cx) in pb.all_items().iter().filter_map(|i| i.comp()).zip(px.all_items().iter().filter_map(|i| i.comp())) {
+            assert_eq!(cb.header(), cx.header(), "{name}");
+            let layers = |c: &effectcraft_aep::Comp<'_, '_>| c.layers().map(|l| (l.name(), l.header(), l.transform(1920, 1080))).collect::<Vec<_>>();
+            assert_eq!(layers(&cb), layers(&cx), "{name}");
+        }
+    }
+    // Spot checks against the values the cases were made with (060's expression, 110's text).
+    let aepx = skip!(crate::common::try_file("aepx-pair.aepx"));
+    let xml = read_aepx(&aepx).unwrap();
+    assert!(xml.walk().any(|(_, c)| c.is(b"Utf8") && c.bytes() == Some(&b"wiggle(1,10)"[..])));
+    assert!(xml.walk().any(|(_, c)| c.is_list(b"btdk") && matches!(c.body, Body::OpaqueList { .. })));
+    let names: Vec<_> = Project::new(&xml).unwrap().all_items().iter().filter(|i| i.comp().is_some()).filter_map(|i| i.name()).collect();
+    assert_eq!(names, ["000-base", "058-key-opacity-2key", "060-expr-opacity-wiggle", "110-text-A", "124-precomp-Pre", "Pre"]);
+}
+
+#[test]
+fn damaged_aepx_is_an_error_or_a_tree_never_a_panic() {
+    let aepx = skip!(crate::common::try_file("aepx-pair.aepx"));
+    // Truncation at about 160 points.
+    for cut in (0..aepx.len()).step_by(aepx.len() / 160) {
+        let _ = read_aepx(&aepx[..cut]);
+    }
+    assert!(read_aepx(&aepx[..aepx.len() / 2]).is_err());
+    // Byte flips: each result is an error or a tree that writes and reads back.
+    let mut state = 0x2545_f491_u32;
+    for _ in 0..400 {
+        let mut damaged = aepx.clone();
+        for _ in 0..4 {
+            state ^= state << 13;
+            state ^= state >> 17;
+            state ^= state << 5;
+            let at = state as usize % damaged.len();
+            damaged[at] ^= 1 << (state % 8);
+        }
+        if let Ok(file) = read_aepx(&damaged) {
+            let bytes = write(&file).unwrap();
+            let _ = Project::new(&parse(&bytes).unwrap()).map(|p| p.all_items().len());
+        }
+    }
+    // Invalid hex and a damaged entity are errors.
+    let text = String::from_utf8(aepx.clone()).unwrap();
+    let odd = text.replacen("bdata=\"00", "bdata=\"0", 1);
+    assert!(matches!(read_aepx(odd.as_bytes()), Err(AepError::Xml { .. })));
+    let nonhex = text.replacen("bdata=\"00", "bdata=\"0g", 1);
+    assert!(matches!(read_aepx(nonhex.as_bytes()), Err(AepError::Xml { .. })));
+    // Deep nesting is refused at the limit; many elements are bounded.
+    let deep = format!("<AfterEffectsProject>{}</AfterEffectsProject>", "<Fold>".repeat(1_000_000));
+    assert_eq!(read_aepx(deep.as_bytes()), Err(AepError::TooDeep));
+    assert_eq!(read_aepx_with_limits(&aepx, Limits { max_depth: 64, max_chunks: 100 }), Err(AepError::TooManyChunks));
+    assert_eq!(read_aepx_with_limits(&aepx, Limits { max_depth: 3, max_chunks: 10_000_000 }), Err(AepError::TooDeep));
+    // A huge hex body is bounded by the input: nothing is allocated from a declared size.
+    let huge = format!("<AfterEffectsProject><cdat bdata=\"{}\"/></AfterEffectsProject>", "ab".repeat(1 << 20));
+    assert_eq!(read_aepx(huge.as_bytes()).unwrap().chunks[0].bytes().map(<[u8]>::len), Some(1 << 20));
+}
+
+/// Every pair of the local corpus (not in the repository): `AEP_CORPUS=<folder> cargo test
+/// --release -p effectcraft-aep --test it container::aepx:: -- --ignored --nocapture`.
+#[test]
+#[ignore = "needs the local corpus (AEP_CORPUS)"]
+fn every_corpus_pair_gives_the_same_chunk_tree() {
+    let Ok(dir) = std::env::var("AEP_CORPUS") else { return };
+    let mut names: Vec<_> =
+        std::fs::read_dir(&dir).unwrap().filter_map(|e| e.ok()).map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "aepx")).collect();
+    names.sort();
+    let (mut same, mut differ) = (0, Vec::new());
+    for x in &names {
+        let aepx = std::fs::read(x).unwrap();
+        let aep = std::fs::read(x.with_extension("aep")).unwrap();
+        let bin = parse(&aep).unwrap();
+        let xml = match read_aepx(&aepx) {
+            Ok(f) => f,
+            Err(e) => {
+                differ.push(format!("{}: {e}", x.display()));
+                continue;
+            }
+        };
+        let fixed = with_head_of(bin.clone().into_owned(), &xml);
+        match first_difference(&fixed.chunks, &xml.chunks, "") {
+            None if write(&xml).unwrap() == write(&AepFile { trailer: xml.trailer.clone(), ..fixed }).unwrap() => same += 1,
+            None => differ.push(format!("{}: bytes differ", x.display())),
+            Some(d) => differ.push(format!("{}: {d}", x.display())),
+        }
+    }
+    println!("{same} of {} pairs give the same chunk tree", names.len());
+    for d in &differ {
+        println!("{d}");
+    }
+}
diff --git a/crates/aep/tests/it/container/batch3_core.rs b/crates/aep/tests/it/container/batch3_core.rs
new file mode 100644
index 000000000..925deaa28
--- /dev/null
+++ b/crates/aep/tests/it/container/batch3_core.rs
@@ -0,0 +1,383 @@
+//! Batch 3 (core): explicit defaults, multi-component bezier ease, colour key distance, exact time
+//! stretch and in / out points, Time Remapping, composition aspect / shutter phase / display start.
+//! Every expected value is the value the corpus case was made with (its MANIFEST).
+
+use crate::container::helpers::{assert_near, base_layer, first_comp, layer_shown_as, layer_with_id, near, open, without_layer_id};
+use effectcraft_aep::{Interpolation, KeyEase, KeyframeKind, LayerHeader, ParamValue, Project, PropNode, Property, Rational, ValueSource};
+
+const L: u32 = 0x1b;
+
+fn with_layer<R>(name: &str, id: u32, f: impl FnOnce(&Project<'_, '_>, &effectcraft_aep::Layer<'_, '_>) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        // `L` names the base solid, whatever its id in the case.
+        let layer = if id == L { base_layer(&comp) } else { layer_with_id(&comp, id) };
+        f(&project, &layer)
+    })
+}
+
+fn header(name: &str) -> Option<LayerHeader> {
+    with_layer(name, L, |_, l| l.header().unwrap())
+}
+
+fn rat(num: i64, den: i64) -> Rational {
+    Rational { num, den }
+}
+
+fn ease(in_speed: f64, in_influence: f64, out_speed: f64, out_influence: f64) -> KeyEase {
+    KeyEase { in_speed, in_influence, out_speed, out_influence }
+}
+
+fn same_ease(a: &KeyEase, b: &KeyEase) -> bool {
+    near(a.in_speed, b.in_speed, 1e-9)
+        && near(a.in_influence, b.in_influence, 1e-9)
+        && near(a.out_speed, b.out_speed, 1e-9)
+        && near(a.out_influence, b.out_influence, 1e-9)
+}
+
+/// The property at a path of match names below a layer.
+fn with_property<R>(name: &str, id: u32, path: &[&str], f: impl FnOnce(&Property<'_, '_>) -> R) -> Option<R> {
+    Some({
+        with_layer(name, id, |_, layer| {
+            let Some(PropNode::Property(p)) = layer.properties().unwrap().find(path) else { panic!("{name}: no property {path:?}") };
+            f(&p)
+        })?
+    })
+}
+
+// ------------------------------------------------------------------ explicit defaults (300-304, 311)
+
+fn blur_param(name: &str) -> Option<(Option<ParamValue>, Option<ParamValue>, Option<bool>, ParamValue, bool)> {
+    Some({
+        with_layer(name, L, |project, layer| {
+            let effects = layer.effects();
+            assert_eq!(effects.len(), 1, "{name}");
+            let p = project.effect_params(&effects[0]).into_iter().find(|p| p.name == "Blurriness").unwrap();
+            (p.stored_value(), p.pard_default(), p.is_default(), p.value().unwrap(), p.stored().is_some())
+        })?
+    })
+}
+
+#[test]
+fn an_explicit_zero_blurriness_is_a_value_record_and_25_is_the_default() {
+    // 300: a fresh Gaussian Blur reads back Blurriness 25 (the MANIFEST row 214 "0" was wrong);
+    // Blurriness set explicitly to 0 writes a record, the default in pard stays 25.
+    let (stored, default, is_default, value, has_record) = skip!(blur_param("300-fx-gaussianblur-0-explicit.aep"));
+    assert_eq!((stored, default, value, has_record), (Some(ParamValue::Number(0.0)), Some(ParamValue::Number(25.0)), ParamValue::Number(0.0), true));
+    assert_eq!(is_default, Some(false));
+    // 301: 25 -> 40 -> 25: the record is removed again, the effective value is the default 25.
+    let (stored, default, is_default, value, has_record) = skip!(blur_param("301-fx-gaussianblur-40-then-25.aep"));
+    assert_eq!((stored, default, value, has_record), (None, Some(ParamValue::Number(25.0)), ParamValue::Number(25.0), false));
+    assert_eq!(is_default, Some(true));
+    // 216 (Blurriness 40): a record, default still 25.
+    let (stored, default, is_default, value, _) = skip!(blur_param("216-fx-gaussianblur-40.aep"));
+    assert_eq!((stored, default, value), (Some(ParamValue::Number(40.0)), Some(ParamValue::Number(25.0)), ParamValue::Number(40.0)));
+    assert_eq!(is_default, Some(false));
+}
+
+#[test]
+fn setting_a_parameter_back_to_its_default_leaves_no_record() {
+    // 303: Fill Opacity 1 -> 0.5 -> 1 and 302: Opacity set to 1 explicitly: no record, value 1.0 (100 %).
+    for name in ["302-fx-fill-opacity-100-explicit.aep", "303-fx-fill-opacity-50-then-100.aep"] {
+        skip!(with_layer(name, L, |project, layer| {
+            let p = project.effect_params(&layer.effects()[0]).into_iter().find(|p| p.name == "Opacity").unwrap();
+            assert!(p.stored().is_none(), "{name}");
+            assert_eq!((p.value(), p.is_default()), (Some(ParamValue::Number(1.0)), Some(true)), "{name}");
+        }));
+    }
+    // 304: Slider set to 0 explicitly: no record, value 0.
+    skip!(with_layer("304-fx-slider-0-explicit.aep", L, |project, layer| {
+        let p = project.effect_params(&layer.effects()[0]).into_iter().find(|p| p.name == "Slider").unwrap();
+        assert!(p.stored().is_none());
+        assert_eq!((p.value(), p.is_default()), (Some(ParamValue::Number(0.0)), Some(true)));
+    }));
+    // The implicit input layer and the built-in entry are not "at default" questions.
+    skip!(with_layer("304-fx-slider-0-explicit.aep", L, |project, layer| {
+        let params = project.effect_params(&layer.effects()[0]);
+        assert_eq!(params.len(), 3);
+        assert_eq!(params[0].is_default(), None);
+    }));
+    // 071 (Slider 77) is a record that differs from the default.
+    skip!(with_layer("071-fx-slider-value77.aep", L, |project, layer| {
+        let p = project.effect_params(&layer.effects()[0]).into_iter().find(|p| p.name == "Slider").unwrap();
+        assert_eq!((p.value(), p.is_default()), (Some(ParamValue::Number(77.0)), Some(false)));
+    }));
+}
+
+#[test]
+fn a_transform_set_to_its_default_adds_no_record() {
+    // 311: Position set to the value it already had ([960,540,0]): the layer tree is the tree of the
+    // unedited 299 (which equals the base layer except for the session), no ADBE Position record.
+    skip!(with_layer("311-position-default-explicit.aep", L, |_, layer| {
+        let t = layer.transform(1920, 1080).unwrap();
+        assert_eq!((t.position.value, t.position.source), ([960.0, 540.0, 0.0], ValueSource::Default));
+        assert_eq!(t.opacity_percent.source, ValueSource::Default);
+        assert!(layer.properties().unwrap().find(&["ADBE Transform Group", "ADBE Position"]).is_none());
+        // The two cases are layers of one file: they differ in the layer id only.
+        let a = without_layer_id(layer.chunk());
+        skip!(with_layer("299-save-noise.aep", L, |_, other| assert_eq!(a, without_layer_id(other.chunk()))));
+    }));
+}
+
+// ------------------------------------------------------------------ bezier ease layouts (305-307)
+
+#[test]
+fn scale_keys_keep_their_ease_type_major() {
+    // 305: Scale keys t=0 [100,100,100] and t=2 [200,150,100]; key1 in speed 0 / influence 33, out
+    // speed 20 / influence 66; key2 in speed 10 / influence 66, out speed 0 / influence 33. The
+    // stored speed is a fraction per second (percent / 100), the influence a fraction.
+    skip!(with_property("305-key-scale-bezier-ease.aep", L, &["ADBE Transform Group", "ADBE Scale"], |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        let scale = p.time_scale().unwrap();
+        assert_eq!(keys.iter().map(|k| k.seconds(scale).unwrap()).collect::<Vec<_>>(), [0.0, 2.0]);
+        for k in &keys {
+            assert_eq!(k.kind(), KeyframeKind::Plain { components: 3 });
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Bezier), Some(Interpolation::Bezier)));
+        }
+        assert_near(&keys[0].value().unwrap(), &[1.0, 1.0, 1.0], 1e-9);
+        assert_near(&keys[1].value().unwrap(), &[2.0, 1.5, 1.0], 1e-9);
+        // The raw block: [in speed x3][in influence x3][out speed x3][out influence x3].
+        assert_near(&keys[0].plain_ease_slots().unwrap(), &[0.0, 0.0, 0.0, 0.33, 0.33, 0.33, 0.2, 0.2, 0.2, 0.66, 0.66, 0.66], 1e-9);
+        assert_near(&keys[1].plain_ease_slots().unwrap(), &[0.1, 0.1, 0.1, 0.66, 0.66, 0.66, 0.0, 0.0, 0.0, 0.33, 0.33, 0.33], 1e-9);
+        for i in 0..3 {
+            assert!(same_ease(&keys[0].ease_component(i).unwrap(), &ease(0.0, 0.33, 0.2, 0.66)), "key 1 component {i}");
+            assert!(same_ease(&keys[1].ease_component(i).unwrap(), &ease(0.1, 0.66, 0.0, 0.33)), "key 2 component {i}");
+        }
+        assert!(keys[0].ease_component(3).is_none());
+        assert_eq!(keys[0].ease_components().unwrap().len(), 3);
+        assert!(keys[0].color_distance().is_none());
+    }));
+}
+
+#[test]
+fn mask_feather_keys_keep_their_ease_type_major() {
+    // 306: Mask Feather keys t=0 [0,0], t=2 [50,30]; key1 in 0/33, out 15/66; key2 in 8/66, out 0/33
+    // (speed in pixels per second).
+    skip!(with_layer("306-key-maskfeather-bezier-ease.aep", L, |_, layer| {
+        let masks = layer.masks();
+        assert_eq!(masks.len(), 1);
+        assert_eq!(masks[0].feather.source, ValueSource::Keyframed);
+        assert_eq!(masks[0].feather.value, [0.0, 0.0]);
+    }));
+    skip!(with_property("306-key-maskfeather-bezier-ease.aep", L, &["ADBE Mask Parade", "ADBE Mask Atom", "ADBE Mask Feather"], |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        for k in &keys {
+            assert_eq!(k.kind(), KeyframeKind::Plain { components: 2 });
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Bezier), Some(Interpolation::Bezier)));
+        }
+        assert_near(&keys[0].value().unwrap(), &[0.0, 0.0], 1e-9);
+        assert_near(&keys[1].value().unwrap(), &[50.0, 30.0], 1e-9);
+        assert_near(&keys[0].plain_ease_slots().unwrap(), &[0.0, 0.0, 0.33, 0.33, 15.0, 15.0, 0.66, 0.66], 1e-9);
+        for i in 0..2 {
+            assert!(same_ease(&keys[0].ease_component(i).unwrap(), &ease(0.0, 0.33, 15.0, 0.66)), "key 1 component {i}");
+            assert!(same_ease(&keys[1].ease_component(i).unwrap(), &ease(8.0, 0.66, 0.0, 0.33)), "key 2 component {i}");
+        }
+        assert!(keys[1].ease_component(2).is_none());
+    }));
+}
+
+#[test]
+fn one_component_and_position_ease_through_the_component_accessor() {
+    // 205 (Opacity, n = 1): in 0.05 / 0.2, out 0.2 / 0.8; 204 (Position): the single entry.
+    skip!(with_property("205-key-opacity-ease-asymmetric.aep", L, &["ADBE Transform Group", "ADBE Opacity"], |p| {
+        let k = p.keys().unwrap().keyframes().next().unwrap();
+        assert_eq!(k.ease_component(0), k.ease());
+        assert!(same_ease(&k.ease_component(0).unwrap(), &ease(0.05, 0.2, 0.2, 0.8)));
+        assert!(k.ease_component(1).is_none());
+    }));
+    skip!(with_property("204-key-ease-asymmetric.aep", L, &["ADBE Transform Group", "ADBE Position"], |p| {
+        let k = p.keys().unwrap().keyframes().next().unwrap();
+        assert_eq!(k.ease_component(0), k.ease());
+        assert!(k.ease_component(1).is_none());
+        assert_eq!(k.ease_components().unwrap().len(), 1);
+    }));
+}
+
+#[test]
+fn bezier_colour_keys_carry_the_distance_to_the_next_key() {
+    // 307: Fill Color keys t=0 [1,0,0,1] and t=2 [0,0,1,1], both bezier; ease 0/0; f64@16 = the
+    // ARGB distance 255 sqrt(2) = 360.6245 on key 1 and 0 on the last key. The linear keys of 210 have 0.
+    skip!(with_layer("307-key-fillcolor-bezier.aep", L, |project, layer| {
+        let p = project.effect_params(&layer.effects()[0]).into_iter().find(|p| p.name == "Color").unwrap();
+        let keys: Vec<_> = p.stored().unwrap().keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert_eq!(keys[0].kind(), KeyframeKind::Spatial { components: 4 });
+        assert_near(&keys[0].value().unwrap(), &[255.0, 255.0, 0.0, 0.0], 1e-9);
+        assert_near(&keys[1].value().unwrap(), &[255.0, 0.0, 0.0, 255.0], 1e-9);
+        for k in &keys {
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Bezier), Some(Interpolation::Bezier)));
+            assert!(same_ease(&k.ease_component(0).unwrap(), &ease(0.0, 0.0, 0.0, 0.0)));
+        }
+        assert!(near(keys[0].color_distance().unwrap(), 255.0 * 2f64.sqrt(), 1e-3), "{:?}", keys[0].color_distance());
+        assert!(near(keys[0].color_distance().unwrap(), 360.6245, 1e-3));
+        assert_eq!(keys[1].color_distance(), Some(0.0));
+    }));
+    skip!(with_layer("210-key-fill-color-2key-linear.aep", L, |_, layer| {
+        let p = layer.effects()[0].params().into_iter().find(|p| p.name == "Color").unwrap();
+        let k = p.stored().unwrap().keys().unwrap().keyframes().next().unwrap();
+        assert_eq!(k.color_distance(), Some(0.0));
+    }));
+}
+
+// ------------------------------------------------------------------ time stretch and in / out points (316-318, 351, 353)
+
+fn stretch_facts(name: &str) -> Option<(LayerHeader, Option<Rational>, Option<Rational>, u32)> {
+    Some({
+        with_layer(name, L, |_, layer| {
+            let h = layer.header().unwrap();
+            let Some(PropNode::Property(p)) = layer.properties().unwrap().get("ADBE Time Remapping") else { panic!("no time remap property") };
+            (h.clone(), h.in_point(), h.out_point(), p.time_scale().unwrap())
+        })?
+    })
+}
+
+#[test]
+fn time_stretch_is_an_exact_ratio() {
+    // 316: stretch 100 -> 50 %: 1/2; the stored out point stays 5 s, the layer ends at 2.5 s; the
+    // property time scale stays 25600.
+    let (h, in_p, out_p, scale) = skip!(stretch_facts("316-layer-stretch50.aep"));
+    assert_eq!((h.stretch, h.stretch_den), (1, 2));
+    assert_eq!(h.stretch_ratio(), Some(rat(1, 2)));
+    assert_eq!(h.stretch_percent(), 50.0);
+    assert_eq!(h.out_relative, rat(128000, 25600));
+    assert_eq!((in_p, out_p, scale), (Some(rat(0, 1)), Some(rat(5, 2)), 25600));
+    // 317: 150 %: 3/2, ends at 7.5 s, the property time scale is 25600 x 3/2.
+    let (h, in_p, out_p, scale) = skip!(stretch_facts("317-layer-stretch150.aep"));
+    assert_eq!((h.stretch, h.stretch_den), (3, 2));
+    assert_eq!(h.stretch_ratio(), Some(rat(3, 2)));
+    assert_eq!(h.stretch_percent(), 150.0);
+    assert_eq!((in_p, out_p, scale), (Some(rat(0, 1)), Some(rat(15, 2)), 38400));
+    // 018: 200 %: 2/1, ends at 10 s, time scale 51200. The base is 1/1.
+    let (h, _, out_p, scale) = skip!(stretch_facts("018-layer-stretch200.aep"));
+    assert_eq!((h.stretch, h.stretch_den, h.stretch_ratio()), (2, 1, Some(rat(2, 1))));
+    assert_eq!((out_p, scale), (Some(rat(10, 1)), 51200));
+    let (h, _, out_p, scale) = skip!(stretch_facts("000-base.aep"));
+    assert_eq!((h.stretch, h.stretch_den, h.stretch_percent()), (1, 1, 100.0));
+    assert_eq!((out_p, scale), (Some(rat(5, 1)), 25600));
+}
+
+#[test]
+fn fractional_times_are_exact_multiples_of_one_over_25600() {
+    // 318: inPoint 0.3333 s became 8532/25600 = 0.33328125 s; the out point moved with it (duration
+    // kept): 136532/25600 = 5.33328125 s; start stays 0.
+    let h = skip!(header("318-layer-inpoint-0.3333.aep"));
+    assert_eq!(h.in_relative, rat(8532, 25600));
+    assert_eq!(h.out_relative, rat(136532, 25600));
+    assert_eq!(h.start, rat(0, 25600));
+    assert_eq!(h.in_point(), Some(rat(2133, 6400)));
+    assert_eq!(h.in_point_seconds(), Some(0.33328125));
+    assert_eq!(h.out_point_seconds(), Some(5.33328125));
+    assert_eq!(h.stretch_ratio(), Some(rat(1, 1)));
+}
+
+#[test]
+fn footage_layers_use_the_footage_time_base_as_out_point_denominator() {
+    // 351: the audio layer's out point is 48000/48000 (the sample rate as denominator), start and
+    // in point keep 25600; the layer copies the item's label 7 and shows the item's name.
+    let bytes = fixture!("351-footage-wav-as-layer.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = comp.layers().find(|l| project.layer_source(l).and_then(|s| s.footage()).is_some_and(|f| f.file_type == "WAVE")).unwrap();
+    let h = layer.header().unwrap();
+    assert_eq!(h.out_relative, rat(48000, 48000));
+    assert_eq!((h.start.den, h.in_relative.den), (25600, 25600));
+    assert_eq!(h.out_point(), Some(rat(1, 1)));
+    // The source is the WAV item (item id 0x20 in the single-case file).
+    assert_eq!(h.label, 7);
+    assert!(layer.name().is_none());
+    assert!(h.is_video_enabled(), "the video switch stays set on an audio-only layer (flag byte 39 = 07)");
+    // 354: the image sequence layer: out point 3/30 = 0.1 s (the frame rate as denominator), label 3,
+    // the layer has no name of its own and shows the first file name.
+    let bytes = fixture!("354-footage-pngseq-timeremap.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = layer_shown_as(&project, &comp, "seq_001.png");
+    let h = layer.header().unwrap();
+    assert_eq!(h.out_relative, rat(3, 30));
+    assert_eq!(h.out_point(), Some(rat(1, 10)));
+    assert_eq!((h.label, h.start.den), (3, 25600));
+    // The source is the sequence item (item id 0x22 in the single-case file).
+    assert!(project.layer_source(&layer).and_then(|s| s.footage()).is_some_and(|f| f.is_sequence));
+}
+
+// ------------------------------------------------------------------ Time Remapping (319, 354)
+
+#[test]
+fn time_remapping_is_an_inert_property_until_enabled() {
+    // Every layer has an inert ADBE Time Remapping property (tdsb 3, static 0, no keys).
+    skip!(with_layer("000-base.aep", L, |_, layer| {
+        let t = layer.time_remap().unwrap();
+        assert!(!t.enabled && t.keys.is_empty());
+        let Some(PropNode::Property(p)) = layer.properties().unwrap().get("ADBE Time Remapping") else { panic!() };
+        assert_eq!((p.flags(), p.is_animated(), p.static_value()), (Some(3), false, Some(vec![0.0])));
+    }));
+    // 319: the precomp layer `Pre` with the remap on: keyed (tdsb 1), two keys 0 s -> 0 and 5 s -> 5;
+    // the layer inside Pre and the other layers stay inert.
+    let bytes = fixture!("319-precomp-timeremap.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = layer_shown_as(&project, &comp, "Pre");
+    let t = layer.time_remap().unwrap();
+    assert!(t.enabled);
+    assert_eq!(t.keys.len(), 2);
+    assert_eq!((t.keys[0].time_seconds, t.keys[0].value_seconds), (Some(0.0), 0.0));
+    assert_eq!((t.keys[1].time_seconds, t.keys[1].value_seconds), (Some(5.0), 5.0));
+    assert_eq!(t.keys[1].time_units, 128000);
+    let Some(PropNode::Property(p)) = layer.properties().unwrap().get("ADBE Time Remapping") else { panic!() };
+    assert_eq!((p.flags(), p.is_animated(), p.static_value()), (Some(1), true, None));
+    let pre = project.all_items().into_iter().find(|i| i.name().as_deref() == Some("Pre")).unwrap().comp().unwrap();
+    assert!(pre.layers().all(|l| !l.time_remap().unwrap().enabled));
+    // 354: on a footage layer: keys 0 s -> 0 and 0.1 s -> 0.1.
+    let bytes = fixture!("354-footage-pngseq-timeremap.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = layer_shown_as(&project, &comp, "seq_001.png");
+    let t = layer.time_remap().unwrap();
+    assert!(t.enabled);
+    assert_eq!(t.keys.len(), 2);
+    assert_eq!((t.keys[0].time_units, t.keys[0].value_seconds), (0, 0.0));
+    assert!(near(t.keys[1].time_seconds.unwrap(), 0.1, 1e-6) && near(t.keys[1].value_seconds, 0.1, 1e-6), "{t:?}");
+    assert!(!base_layer(&comp).time_remap().unwrap().enabled);
+}
+
+// ------------------------------------------------------------------ composition (325-327)
+
+fn comp_header(name: &str) -> Option<effectcraft_aep::CompHeader> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        first_comp(&Project::new(&file).unwrap()).header().unwrap()
+    })
+}
+
+#[test]
+fn pixel_aspect_shutter_phase_and_display_start() {
+    // 325: pixelAspect 0.9091 reads back 0.90909090909091 = the exact ratio 10/11.
+    let h = skip!(comp_header("325-comp-pixelaspect-0.9091.aep"));
+    assert_eq!(h.pixel_aspect.reduced(), Some(rat(10, 11)));
+    assert!(near(h.pixel_aspect_ratio().unwrap(), 0.90909090909091, 1e-12));
+    // 326: shutterPhase -90, the shutter angle stays 180.
+    let h = skip!(comp_header("326-comp-shutterphase-m90.aep"));
+    assert_eq!((h.shutter_phase, h.shutter_angle), (Some(-90), 180));
+    // 327: displayStartFrame 100 at 25 fps = 4 s = 102400/25600; the shutter phase is back to 0.
+    let h = skip!(comp_header("327-comp-displaystartframe-100.aep"));
+    assert_eq!(h.display_start, Some(rat(102400, 25600)));
+    assert_eq!((h.display_start_seconds(), h.display_start_frame(), h.shutter_phase), (Some(4.0), Some(100), Some(0)));
+    // The base: no phase, start 0.
+    let h = skip!(comp_header("000-base.aep"));
+    assert_eq!((h.shutter_phase, h.display_start_seconds(), h.display_start_frame()), (Some(0), Some(0.0), Some(0)));
+    assert_eq!(h.pixel_aspect_ratio(), Some(1.0));
+    // A short chunk still decodes the old fields.
+    let bytes = [0u8; 176];
+    let h = effectcraft_aep::CompHeader::parse(&bytes).unwrap();
+    assert_eq!((h.shutter_phase, h.display_start.map(|r| r.den)), (None, Some(0)));
+}
diff --git a/crates/aep/tests/it/container/batch3_objects.rs b/crates/aep/tests/it/container/batch3_objects.rs
new file mode 100644
index 000000000..d1cfbac29
--- /dev/null
+++ b/crates/aep/tests/it/container/batch3_objects.rs
@@ -0,0 +1,543 @@
+//! Batch 3 (objects): Point / Layer / Dropdown controls, masks, shape items, text styles, camera,
+//! light, marker data and footage items. Every expected value is the value the corpus case was
+//! made with (its MANIFEST).
+
+use crate::container::helpers::{assert_near, base_layer, first_comp, layer_named, layer_of_type, layer_shown_as, near, open};
+use effectcraft_aep::{
+    Caps, CueType, GradientType, ItemKind, Justification, LayerRef, LayerType, MaskMode, ParamKind, ParamValue, PolystarType, Project, PropNode, Rational,
+    ShapeDetail, ShapeItem, TextDocument, ValueSource,
+};
+
+fn rat(num: i64, den: i64) -> Rational {
+    Rational { num, den }
+}
+
+// ------------------------------------------------------------------ Point control (310, 218)
+
+#[test]
+fn the_point_default_is_a_fraction_of_the_layer() {
+    // 310: the default Point of a Point Control on a 100x100 solid reads back [50, 50]: the default is
+    // two 16.16 fractions 0.5 in pard, relative to the layer, not pixels.
+    let bytes = fixture!("310-solid-100x100-pointcontrol.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = layer_shown_as(&project, &comp, "S100");
+    assert_eq!(project.layer_source_size(&layer), Some((100, 100)));
+    let effects = layer.effects();
+    assert_eq!(effects.len(), 1);
+    let p = effects[0].params().into_iter().find(|p| p.kind == ParamKind::Point).unwrap();
+    assert!(p.stored().is_none());
+    assert_eq!(p.pard_default(), Some(ParamValue::Point([0.5, 0.5])));
+    assert_eq!((p.value(), p.is_default()), (Some(ParamValue::Point([0.5, 0.5])), Some(true)));
+    assert_eq!(p.point_px(100.0, 100.0), Some([50.0, 50.0]));
+    assert_eq!(&p.pard()[56..64], &[0, 0, 0x80, 0, 0, 0, 0x80, 0], "two 16.16 fractions 0.5");
+    // 218: an explicit [111, 222] on the 1920x1080 solid is [111/1920, 222/1080] of the layer.
+    let bytes = fixture!("218-fx-point-111-222.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let p = layer.effects()[0].params().into_iter().find(|p| p.kind == ParamKind::Point).unwrap();
+    assert_eq!(p.is_default(), Some(false));
+    let px = p.point_px(1920.0, 1080.0).unwrap();
+    assert_near(&px, &[111.0, 222.0], 1e-9);
+    assert!(p.point_px(f64::NAN, 1.0).is_some());
+    let other = layer.effects()[0].params().into_iter().find(|p| p.kind == ParamKind::Layer).unwrap();
+    assert_eq!(other.point_px(1.0, 1.0), None);
+}
+
+// ------------------------------------------------------------------ Layer Control (320, 321, 220)
+
+/// The Layer Control's reference, the input layer's stored value and reference, the id of `L`
+/// (the owner) and the id of the top layer.
+#[allow(clippy::type_complexity)]
+fn layer_ref(name: &str) -> Option<(Option<LayerRef>, Option<ParamValue>, Option<LayerRef>, u32, u32)> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let layer = base_layer(&comp);
+        let owner = layer.id().unwrap();
+        let effects = layer.effects();
+        assert_eq!(effects.len(), 1, "{name}");
+        assert_eq!(effects[0].match_name(), "ADBE Layer Control");
+        let params = project.effect_params(&effects[0]);
+        let p = params.iter().find(|p| p.kind == ParamKind::Layer && p.index == 1).unwrap();
+        // The implicit input layer is not a layer reference.
+        (p.layer_ref(owner), params[0].stored_value(), params[0].layer_ref(owner), owner, comp.layers().next().unwrap().id().unwrap())
+    })
+}
+
+#[test]
+fn layer_control_self_versus_none() {
+    // 320: Layer set explicitly to 1 = the layer itself: tdpi = the owning layer's id.
+    let (r, input, input_ref, owner, _) = skip!(layer_ref("320-fx-layercontrol-self-explicit.aep"));
+    assert_eq!((r, input, input_ref), (Some(LayerRef::This), Some(ParamValue::Layer(owner)), None));
+    // 321: None: tdpi = 0.
+    let (r, input, input_ref, owner, _) = skip!(layer_ref("321-fx-layercontrol-none.aep"));
+    assert_eq!((r, input, input_ref), (Some(LayerRef::Nothing), Some(ParamValue::Layer(owner)), None));
+    // 220: Layer 1 of a new Null layer (the top layer).
+    let (r, _, _, owner, top) = skip!(layer_ref("220-fx-layercontrol-to-layer1.aep"));
+    assert_ne!(top, owner);
+    assert_eq!(r, Some(LayerRef::Layer(top)));
+}
+
+// ------------------------------------------------------------------ Dropdown (323, 324, 077)
+
+#[test]
+fn dropdown_items_selection_and_count() {
+    for (name, selected, text, is_default) in
+        [("323-fx-dropdown-5items.aep", 1, "Alpha", Some(true)), ("324-fx-dropdown-5items-select3.aep", 3, "Gamma", Some(false))]
+    {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let effects = layer.effects();
+        assert_eq!(effects.len(), 1);
+        // set_dropdown_items re-creates the effect definition under a new match name.
+        assert!(effects[0].match_name().starts_with("Pseudo/@@") && effects[0].match_name().len() == 31, "{name}");
+        assert_eq!(effects[0].name().as_deref(), Some("Dropdown Menu Control"));
+        let p = effects[0].params().into_iter().find(|p| p.kind == ParamKind::Popup).unwrap();
+        assert_eq!(p.items.as_deref(), Some(&["Alpha", "Beta", "Gamma", "Delta", "Epsilon"].map(String::from)[..]), "{name}");
+        assert_eq!(p.popup_item_count(), Some(5), "{name}");
+        assert_eq!((p.popup_selected_index(), p.popup_selected_item()), (Some(selected), Some(text)), "{name}");
+        assert_eq!(p.is_default(), is_default, "{name}");
+        assert_eq!(p.stored().is_some(), selected != 1, "{name}");
+        if selected == 3 {
+            // The selection is a value record and also overwrites pard@56.
+            assert_eq!(p.stored_value(), Some(ParamValue::Index(3)));
+            assert_eq!(p.pard_default(), Some(ParamValue::Index(3)));
+        } else {
+            assert_eq!(p.stored_value(), None);
+            assert_eq!(p.pard_default(), Some(ParamValue::Index(1)));
+        }
+    }
+    // 077: the default dropdown with three items.
+    let bytes = fixture!("077-fx-dropdown-default.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let p = layer.effects()[0].params().into_iter().find(|p| p.kind == ParamKind::Popup).unwrap();
+    assert_eq!((p.popup_item_count(), p.popup_selected_item()), (Some(3), Some("Item 1")));
+    let no_data = layer.effects()[0].params().into_iter().find(|p| p.kind == ParamKind::NoData).unwrap();
+    assert_eq!((no_data.popup_item_count(), no_data.popup_selected_index(), no_data.popup_selected_item()), (None, None, None));
+}
+
+// ------------------------------------------------------------------ masks (309, 328, 329)
+
+fn ellipse_vertices() -> [[f64; 2]; 4] {
+    [[960.0, 340.0], [1360.0, 540.0], [960.0, 740.0], [560.0, 540.0]]
+}
+
+#[test]
+fn a_mask_box_is_normalised_to_the_layer_size() {
+    // 309: a 60x40 rectangle at [50,50] on a 100x100 solid: box 0.2, 0.3, 0.8, 0.7 of the LAYER;
+    // vertices [20,30] [80,30] [80,70] [20,70].
+    let bytes = fixture!("309-solid-100x100-mask-rect.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = layer_shown_as(&project, &comp, "S100");
+    let masks = layer.masks();
+    assert_eq!(masks.len(), 1);
+    let m = &masks[0];
+    assert_eq!((m.mode, m.inverted, m.counter), (Some(MaskMode::Add), Some(false), Some(1)));
+    let want_box = [0.2, 0.3, 0.8, 0.7];
+    for (got, want) in m.shapes[0].bbox.iter().zip(want_box) {
+        assert!(near(f64::from(*got), want, 1e-6), "{:?}", m.shapes[0].bbox);
+    }
+    let shapes = project.mask_vertices_px(&layer, m).unwrap();
+    assert_eq!(shapes.len(), 1);
+    let got: Vec<[f64; 2]> = shapes[0].iter().map(|v| v.position).collect();
+    for (g, w) in got.iter().zip([[20.0, 30.0], [80.0, 30.0], [80.0, 70.0], [20.0, 70.0]]) {
+        assert_near(g, &w, 1e-3);
+    }
+    assert_eq!(got.len(), 4);
+    // A layer without a sized source has no pixel vertices.
+    let bytes = fixture!("333-shape-group-two-rects.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let shape = layer_named(&first_comp(&project), "Shape");
+    assert!(project.mask_vertices_px(&shape, m).is_none());
+}
+
+#[test]
+fn one_mkif_per_mask_and_the_mode_none() {
+    // 328: ellipse 800x400 at [960,540] (Mask 1) and rectangle 400x300 at [700,500] (Mask 2), both Add;
+    // the per-layer counter gives 1 and 2.
+    let bytes = fixture!("328-mask-two-ellipse-rect.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let masks = layer.masks();
+    assert_eq!(masks.len(), 2);
+    assert_eq!(masks.iter().map(|m| m.name.as_deref()).collect::<Vec<_>>(), [Some("Mask 1"), Some("Mask 2")]);
+    for (m, counter) in masks.iter().zip([1, 2]) {
+        assert_eq!((m.mode, m.inverted, m.counter), (Some(MaskMode::Add), Some(false), Some(counter)));
+        assert_eq!(m.shapes.len(), 1);
+    }
+    let v1 = project.mask_vertices_px(&layer, &masks[0]).unwrap();
+    for (v, w) in v1[0].iter().zip(ellipse_vertices()) {
+        assert_near(&v.position, &w, 1e-2);
+    }
+    // Mask 2 has its own box (500..900 x 350..650) normalised to the layer.
+    let v2 = project.mask_vertices_px(&layer, &masks[1]).unwrap();
+    for (v, w) in v2[0].iter().zip([[500.0, 350.0], [900.0, 350.0], [900.0, 650.0], [500.0, 650.0]]) {
+        assert_near(&v.position, &w, 1e-2);
+    }
+    assert_eq!(v2[0].len(), 4);
+    // 329: the same ellipse as 232 with the mode None (0). The layer's mask counter is 1: the case is the first mask on its layer.
+    let bytes = fixture!("329-mask-ellipse-mode-none.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let none = base_layer(&first_comp(&project)).masks();
+    assert_eq!(none.len(), 1);
+    assert_eq!((none[0].mode, none[0].counter), (Some(MaskMode::None), Some(1)));
+    assert_eq!(MaskMode::from_id(0), MaskMode::None);
+    let bytes = fixture!("232-mask-ellipse.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let add = base_layer(&first_comp(&project)).masks();
+    assert_eq!(add[0].mode, Some(MaskMode::Add));
+    assert_eq!(add[0].shapes, none[0].shapes, "329 is 232 with another mode");
+}
+
+// ------------------------------------------------------------------ shapes (330-333)
+
+fn shape_group(name: &str) -> Option<effectcraft_aep::ShapeGroup> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = layer_named(&first_comp(&project), "Shape");
+        let h = layer.header().unwrap();
+        assert_eq!((h.layer_type, h.label), (LayerType::Shape, 8), "{name}");
+        let mut groups = layer.shape_groups();
+        assert_eq!(groups.len(), 1, "{name}");
+        groups.remove(0)
+    })
+}
+
+fn other_name(item: &ShapeItem) -> &str {
+    match item {
+        ShapeItem::Other { match_name, .. } => match_name,
+        _ => "",
+    }
+}
+
+#[test]
+fn polystar_defaults_and_polygon() {
+    // 330: star, 5 points, outer 100, inner 50 = the defaults: no property record at all.
+    let g = skip!(shape_group("330-shape-polystar-star-5-50-100.aep"));
+    assert_eq!(g.name.as_deref(), Some("Group 1"));
+    assert_eq!(g.items.len(), 2);
+    assert_eq!(other_name(&g.items[0]), "ADBE Vector Shape - Star");
+    assert!(matches!(&g.items[1], ShapeItem::Fill { color: Some(c), .. } if c.value == [1.0, 0.0, 1.0, 0.0]));
+    let [ShapeDetail::Polystar { item_index, star_type, outer_radius, inner_radius, inner_roundness }] = &g.details[..] else { panic!("{:?}", g.details) };
+    assert_eq!(*item_index, 0);
+    assert_eq!((star_type.value, star_type.source), (PolystarType::Star, ValueSource::Default));
+    assert_eq!((outer_radius.value, outer_radius.source), (100.0, ValueSource::Default));
+    assert_eq!((inner_radius.value, inner_radius.source), (50.0, ValueSource::Default));
+    assert!(inner_roundness.is_none());
+    // 331: polygon (type 2): the type record, plus Inner Radius 50 and Inner Roundess 0 in their default state.
+    let g = skip!(shape_group("331-shape-polystar-polygon-5-100.aep"));
+    let [ShapeDetail::Polystar { star_type, outer_radius, inner_radius, inner_roundness, .. }] = &g.details[..] else { panic!("{:?}", g.details) };
+    assert_eq!((star_type.value, star_type.source), (PolystarType::Polygon, ValueSource::Stored));
+    assert_eq!((outer_radius.value, outer_radius.source), (100.0, ValueSource::Default));
+    assert_eq!((inner_radius.value, inner_radius.source), (50.0, ValueSource::Stored));
+    let r = inner_roundness.unwrap();
+    assert_eq!((r.value, r.source), (0.0, ValueSource::Stored));
+    // The tdsb states: the type is a written record (1), the other two are default-state records (3).
+    let bytes = fixture!("331-shape-polystar-polygon-5-100.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = layer_named(&first_comp(&project), "Shape");
+    let base = ["ADBE Root Vectors Group", "ADBE Vector Group", "ADBE Vectors Group", "ADBE Vector Shape - Star"];
+    for (prop, flags) in [("ADBE Vector Star Type", 1), ("ADBE Vector Star Inner Radius", 3), ("ADBE Vector Star Inner Roundess", 3)] {
+        let path: Vec<&str> = base.iter().copied().chain([prop]).collect();
+        let Some(PropNode::Property(p)) = layer.properties().unwrap().find(&path) else { panic!("{prop}") };
+        assert_eq!(p.flags(), Some(flags), "{prop}");
+    }
+}
+
+#[test]
+fn radial_gradient_extra_records() {
+    // 332: Rectangle Path 400x300 + Gradient Fill, radial (type 2), Start [0,0] = default (absent),
+    // End [200,0], Highlight Length / Angle 0 written as records.
+    let g = skip!(shape_group("332-shape-gradient-fill-radial.aep"));
+    assert_eq!(g.items.len(), 2);
+    let ShapeItem::GradientFill { start, end, .. } = &g.items[1] else { panic!("{:?}", g.items[1]) };
+    assert!(start.is_none());
+    assert_eq!(end.map(|e| (e.value, e.source)), Some(([200.0, 0.0], ValueSource::Stored)));
+    let gradient = g.details.iter().find_map(|d| match d {
+        ShapeDetail::Gradient { item_index, gradient_type, highlight_length, highlight_angle } => {
+            Some((*item_index, *gradient_type, *highlight_length, *highlight_angle))
+        }
+        _ => None,
+    });
+    let (index, kind, length, angle) = gradient.unwrap();
+    assert_eq!(index, 1);
+    assert_eq!((kind.value, kind.source), (GradientType::Radial, ValueSource::Stored));
+    assert_eq!(length.map(|t| (t.value, t.source)), Some((0.0, ValueSource::Stored)));
+    assert_eq!(angle.map(|t| (t.value, t.source)), Some((0.0, ValueSource::Stored)));
+    // 241 (linear): the type is the default and the highlight records are absent.
+    let bytes = fixture!("241-shape-gradient-fill-linear.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = layer_named(&first_comp(&project), "S");
+    let g = layer.shape_groups().remove(0);
+    let linear = g.details.iter().find_map(|d| match d {
+        ShapeDetail::Gradient { gradient_type, highlight_length, highlight_angle, .. } => Some((*gradient_type, *highlight_length, *highlight_angle)),
+        _ => None,
+    });
+    let (kind, length, angle) = linear.unwrap();
+    assert_eq!((kind.value, kind.source), (GradientType::Linear, ValueSource::Default));
+    assert!(length.is_none() && angle.is_none());
+}
+
+#[test]
+fn two_rectangles_in_one_group_are_two_items() {
+    // 333: Rectangle Path 1 [400,300], Rectangle Path 2 [100,100] (= default, no Size record) at
+    // position [300,0], Fill 1 (order: rect, rect, fill).
+    let g = skip!(shape_group("333-shape-group-two-rects.aep"));
+    assert_eq!(g.items.len(), 3);
+    let ShapeItem::Rect { name: n1, size: s1 } = &g.items[0] else { panic!() };
+    let ShapeItem::Rect { name: n2, size: s2 } = &g.items[1] else { panic!() };
+    assert_eq!((n1.as_deref(), n2.as_deref()), (Some("Rectangle Path 1"), Some("Rectangle Path 2")));
+    assert_eq!(s1.map(|s| s.value), Some([400.0, 300.0]));
+    assert!(s2.is_none(), "[100, 100] is the default size");
+    assert!(matches!(&g.items[2], ShapeItem::Fill { color: Some(c), .. } if c.value == [1.0, 0.0, 1.0, 0.0]));
+    let positions: Vec<_> = g
+        .details
+        .iter()
+        .filter_map(|d| match d {
+            ShapeDetail::RectPosition { item_index, position } => Some((*item_index, position.value, position.source)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(positions, [(0, [0.0, 0.0], ValueSource::Default), (1, [300.0, 0.0], ValueSource::Stored)]);
+}
+
+// ------------------------------------------------------------------ text (334-340)
+
+fn text(name: &str, layer: &str) -> Option<TextDocument> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        layer_named(&first_comp(&project), layer).text_document().unwrap_or_else(|| panic!("{name}: no text document"))
+    })
+}
+
+#[test]
+fn right_justification_in_box_text() {
+    // 334: box text "Hello" in a 400x200 box at [-200,-100], right aligned (stored 1; compare 245: 0, 246: 2).
+    let t = skip!(text("334-text-box-right-align.aep", "T"));
+    assert_eq!(t.text, "Hello");
+    assert_eq!((t.paragraphs.len(), t.paragraphs[0].length, t.paragraphs[0].justification), (1, 6, Justification::Right));
+    let b = t.text_box.unwrap();
+    assert_eq!((b.x, b.y, b.width, b.height), (-200.0, -100.0, 400.0, 200.0));
+    assert_eq!(skip!(text("245-text-box-400x200-Hello.aep", "T")).paragraphs[0].justification, Justification::Left);
+    assert_eq!(skip!(text("246-text-box-center-align.aep", "T")).paragraphs[0].justification, Justification::Center);
+}
+
+#[test]
+fn faux_styles_caps_and_leading() {
+    // The reference style: no faux styles, normal caps, auto leading (stored 98), the font list of four.
+    let t = skip!(text("337-text-point-allcaps.aep", "T"));
+    assert_eq!(t.style_runs.len(), 1);
+    let plain = t.style_runs[0];
+    assert_eq!((plain.faux_bold, plain.faux_italic, plain.leading, plain.font_index), (false, false, Some(98.0), 0));
+    assert_eq!((plain.caps, t.fonts.len()), (Caps::All, 4));
+    // 335 / 336: faux bold / italic; the font list gains a first entry (4 -> 5) and the style uses font 1.
+    for (name, bold, italic) in [("335-text-point-fauxbold.aep", true, false), ("336-text-point-fauxitalic.aep", false, true)] {
+        let t = skip!(text(name, "T"));
+        let s = t.style_runs[0];
+        assert_eq!((s.faux_bold, s.faux_italic, s.caps), (bold, italic, Caps::Normal), "{name}");
+        assert_eq!((t.fonts.len(), s.font_index, t.font_index), (5, 1, 1), "{name}");
+        assert_eq!((t.fonts[0].as_str(), t.fonts[1].as_str()), ("TimesNewRomanPSMT", "TimesNewRomanPSMT"), "{name}");
+        assert_eq!(t.font.as_deref(), Some("TimesNewRomanPSMT"));
+    }
+    // 338: small caps; 337: all caps.
+    assert_eq!(skip!(text("338-text-point-smallcaps.aep", "T")).style_runs[0].caps, Caps::Small);
+    // 339: leading 60.
+    let s = skip!(text("339-text-point-leading60.aep", "T")).style_runs[0];
+    assert_eq!((s.leading, s.caps, s.faux_bold), (Some(60.0), Caps::Normal, false));
+}
+
+#[test]
+fn the_last_style_run_absorbs_the_final_carriage_return() {
+    // 340: "el" red, "lo" blue and size 60 on "Hello": runs of 1, 2 and 3 characters (the last one
+    // includes the \r), fills white / red / blue, sizes 100 / 100 / 60.
+    let t = skip!(text("340-text-range-two-styles.aep", "T"));
+    assert_eq!(t.raw_text, "Hello\r");
+    assert_eq!(t.style_runs.iter().map(|r| r.length).collect::<Vec<_>>(), [1, 2, 3]);
+    assert_eq!(t.style_runs.iter().map(|r| r.length).sum::<usize>(), t.raw_text.chars().count());
+    assert_eq!(t.style_runs.iter().map(|r| r.fill_argb).collect::<Vec<_>>(), [[1.0, 1.0, 1.0, 1.0], [1.0, 1.0, 0.0, 0.0], [1.0, 0.0, 0.0, 1.0]]);
+    assert_eq!(t.style_runs.iter().map(|r| r.font_size).collect::<Vec<_>>(), [100.0, 100.0, 60.0]);
+    assert_eq!(t.paragraphs.iter().map(|p| p.length).collect::<Vec<_>>(), [6]);
+}
+
+// ------------------------------------------------------------------ camera and light (341-345)
+
+#[test]
+fn camera_zoom_and_depth_of_field() {
+    let camera = |name: &str| {
+        Some({
+            let bytes = crate::common::try_fixture(name)?;
+            let file = open(&bytes);
+            let project = Project::new(&file).unwrap();
+            let layer = layer_of_type(&first_comp(&project), LayerType::Camera);
+            (
+                layer.camera_zoom(),
+                layer.camera_depth_of_field(),
+                layer.camera_focus_distance(),
+                layer.camera_aperture(),
+                layer.camera_position().map(|p| (p.stored, p.auto_state)),
+            )
+        })
+    };
+    // 341: Zoom 2000 is stored; the auto Position keeps [0, 0, -2666.67].
+    let (zoom, dof, focus, aperture, pos) = skip!(camera("341-camera-zoom-2000.aep"));
+    assert_eq!(zoom.map(|z| (z.value, z.source)), Some((2000.0, ValueSource::Stored)));
+    assert_eq!((dof.map(|d| (d.value, d.source)), focus, aperture), (Some((false, ValueSource::Default)), None, None));
+    let (stored, auto) = pos.unwrap();
+    assert!(auto && near(stored[2], -2666.67, 0.01) && stored[0] == 0.0, "{stored:?}");
+    // 342: DOF on, Focus Distance 800, Aperture 30; Zoom stays the default.
+    let (zoom, dof, focus, aperture, _) = skip!(camera("342-camera-dof-800-30.aep"));
+    assert_eq!(zoom.map(|z| (z.source, near(z.value, 2666.67, 0.01))), Some((ValueSource::Default, true)));
+    assert_eq!(dof.map(|d| (d.value, d.source)), Some((true, ValueSource::Stored)));
+    assert_eq!(focus.map(|f| (f.value, f.source)), Some((800.0, ValueSource::Stored)));
+    assert_eq!(aperture.map(|f| (f.value, f.source)), Some((30.0, ValueSource::Stored)));
+    // The default camera (256) has nothing but the default zoom.
+    let (zoom, dof, ..) = skip!(camera("256-camera-two-node-default.aep"));
+    assert_eq!((zoom.unwrap().source, dof.unwrap().value), (ValueSource::Default, false));
+    assert_eq!(zoom.unwrap().value, effectcraft_aep::DEFAULT_CAMERA_ZOOM);
+}
+
+#[test]
+fn light_colour_cone_angle_and_feather() {
+    let light = |name: &str| {
+        Some({
+            let bytes = crate::common::try_fixture(name)?;
+            let file = open(&bytes);
+            let project = Project::new(&file).unwrap();
+            let layer = layer_of_type(&first_comp(&project), LayerType::Light);
+            assert_eq!(layer.header().unwrap().light_type(), Some(effectcraft_aep::LightType::Spot), "{name}");
+            let t = |x: Option<effectcraft_aep::Tracked<f64>>| x.map(|x| (x.value, x.source));
+            (layer.light_color().map(|c| (c.value, c.source)), t(layer.light_cone_angle()), t(layer.light_cone_feather()))
+        })
+    };
+    // The default spot light: white, 90, 50, all absent.
+    let (colour, angle, feather) = skip!(light("254-light-spot-intensity-50.aep"));
+    assert_eq!((colour, angle, feather), (Some(([1.0; 4], ValueSource::Default)), Some((90.0, ValueSource::Default)), Some((50.0, ValueSource::Default))));
+    // 343: colour [1,0,0,1] = ARGB doubles [255,255,0,0].
+    let (colour, angle, feather) = skip!(light("343-light-spot-color-red.aep"));
+    assert_eq!(colour, Some(([1.0, 1.0, 0.0, 0.0], ValueSource::Stored)));
+    assert_eq!((angle, feather), (Some((90.0, ValueSource::Default)), Some((50.0, ValueSource::Default))));
+    // 344: Cone Angle 60. 345: Cone Feather 30.
+    let (colour, angle, feather) = skip!(light("344-light-spot-coneangle-60.aep"));
+    assert_eq!((colour.unwrap().1, angle, feather), (ValueSource::Default, Some((60.0, ValueSource::Stored)), Some((50.0, ValueSource::Default))));
+    let (_, angle, feather) = skip!(light("345-light-spot-conefeather-30.aep"));
+    assert_eq!((angle, feather), (Some((90.0, ValueSource::Default)), Some((30.0, ValueSource::Stored))));
+    // A point light (252) stores Cone Angle 90 / Feather 50 in their default state.
+    let bytes = fixture!("252-light-point.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = layer_of_type(&first_comp(&project), LayerType::Light);
+    assert_eq!(layer.light_cone_angle().map(|a| (a.value, a.source)), Some((90.0, ValueSource::Stored)));
+    // Layers without light options have no light accessors.
+    let bytes = fixture!("000-base.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let solid = base_layer(&first_comp(&project));
+    assert!(solid.light_color().is_none() && solid.camera_zoom().is_none() && solid.camera_depth_of_field().is_none());
+}
+
+// ------------------------------------------------------------------ marker data (347-349, 249)
+
+fn layer_markers(name: &str) -> Option<Vec<effectcraft_aep::Marker>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        base_layer(&first_comp(&project)).markers()
+    })
+}
+
+#[test]
+fn marker_label_cue_type_and_parameters() {
+    // 347: marker at 1 s, comment M, label 3 (event cue by default, no parameters).
+    let m = skip!(layer_markers("347-marker-layer-label3.aep"));
+    assert_eq!(m.len(), 1);
+    assert_eq!((m[0].seconds, m[0].comment.as_str(), m[0].label, m[0].cue_type), (Some(1.0), "M", Some(3), Some(CueType::Event)));
+    assert_eq!((m[0].duration_seconds, m[0].cue_point_name.as_str(), m[0].cue_params.len()), (Some(0.0), "", 0));
+    // 348: cue point name CueN, navigation cue (5).
+    let m = skip!(layer_markers("348-marker-layer-navigation-cue.aep"));
+    assert_eq!((m[0].cue_type, m[0].cue_point_name.as_str(), m[0].label), (Some(CueType::Navigation), "CueN", Some(0)));
+    // 349: CueE, event cue, parameters speaker = A and n = 2.
+    let m = skip!(layer_markers("349-marker-layer-event-cue-params.aep"));
+    assert_eq!((m[0].cue_type, m[0].cue_point_name.as_str(), m[0].comment.as_str()), (Some(CueType::Event), "CueE", "M"));
+    assert_eq!(m[0].cue_params, [("speaker".to_string(), "A".to_string()), ("n".to_string(), "2".to_string())]);
+    assert_eq!((m[0].chapter.as_str(), m[0].url.as_str(), m[0].frame_target.as_str()), ("", "", ""));
+    // 249 (batch 2): duration 1 s, the five strings, event cue, no parameters, label 0.
+    let m = skip!(layer_markers("249-marker-layer-full.aep"));
+    assert_eq!((m[0].cue_type, m[0].label, m[0].duration_seconds, m[0].cue_params.len()), (Some(CueType::Event), Some(0), Some(1.0), 0));
+}
+
+// ------------------------------------------------------------------ footage items (126, 350, 352, 354)
+
+#[test]
+fn audio_footage_item() {
+    let bytes = fixture!("350-footage-wav-imported.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    // The solid L and the WAV (item id 32 in the single-case file): the WAV is not used in a layer.
+    let footage: Vec<_> = project.all_items().into_iter().filter(|i| i.kind() == Some(ItemKind::Footage)).collect();
+    assert_eq!(footage.len(), 2);
+    let item = footage.iter().find(|i| i.footage().is_some_and(|f| !f.is_solid)).unwrap();
+    let f = item.footage().unwrap();
+    assert_eq!(f.file_type, "WAVE");
+    assert_eq!((f.width, f.height, f.is_solid), (0, 0, false));
+    assert_eq!(f.duration, Some(rat(48000, 48000)));
+    assert_eq!((f.audio_sample_rate, f.file_size, f.bits_per_pixel, f.native_frame_rate), (Some(48000.0), 96044, 0, 0));
+    assert!(!f.is_sequence && f.sequence_frame_count().is_none());
+    // The combined file stores no display name for the item (the single-case file had
+    // "test-tone.wav"); the path names the file.
+    assert_eq!(item.label(), Some(7));
+    assert!(f.path.as_deref().is_some_and(|p| p.ends_with("test-tone.wav")));
+    // The solid has no sample rate.
+    let solid = footage.iter().find(|i| i.footage().is_some_and(|f| f.is_solid)).unwrap().footage().unwrap();
+    assert_eq!((solid.audio_sample_rate, solid.duration.map(|d| d.num), solid.file_size), (None, Some(0), 0));
+}
+
+#[test]
+fn image_sequence_is_one_item() {
+    for name in ["352-footage-pngseq-imported.aep", "354-footage-pngseq-timeremap.aep"] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let footage: Vec<_> = project.all_items().into_iter().filter(|i| i.kind() == Some(ItemKind::Footage)).collect();
+        assert_eq!(footage.len(), 2, "{name}: the solid and ONE sequence item");
+        let item = footage.iter().find(|i| i.footage().is_some_and(|f| !f.is_solid)).unwrap();
+        let f = item.footage().unwrap();
+        assert_eq!((f.width, f.height, f.is_solid), (64, 64, false), "{name}");
+        assert_eq!(f.duration, Some(rat(3, 30)), "{name}");
+        assert_eq!((f.native_frame_rate, f.bits_per_pixel, f.file_size, f.audio_sample_rate), (30, 24, 504, None), "{name}");
+        assert!(f.is_sequence, "{name}");
+        assert_eq!(f.sequence_frame_count(), Some(3), "{name}");
+        // The first file name sits in opti; the alias points at the sequence folder.
+        assert_eq!(f.name.as_deref(), Some("seq_001.png"), "{name}");
+        assert!(f.path.as_deref().is_some_and(|p| p.ends_with("test-seq")), "{name}");
+        assert_eq!(item.label(), Some(3), "{name}");
+    }
+    // The single png still (126): 32 bits per pixel, 149 bytes, not a sequence, duration 0.
+    let bytes = fixture!("126-footage-png-layer.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let f = project.all_items().into_iter().filter_map(|i| i.footage()).find(|f| !f.is_solid).unwrap();
+    assert_eq!((f.bits_per_pixel, f.file_size, f.native_frame_rate, f.is_sequence), (32, 149, 0, false));
+    assert_eq!(f.duration.map(|d| d.num), Some(0));
+}
diff --git a/crates/aep/tests/it/container/batch5.rs b/crates/aep/tests/it/container/batch5.rs
new file mode 100644
index 000000000..d716c79a7
--- /dev/null
+++ b/crates/aep/tests/it/container/batch5.rs
@@ -0,0 +1,152 @@
+//! Batch 5 checks of fields decoded before (markers with several entries and fractional
+//! durations, 509 and 510).
+
+use crate::container::helpers::{first_comp, open};
+use effectcraft_aep::Project;
+
+#[test]
+fn two_composition_markers_in_time_order_with_label_and_duration() {
+    let bytes = fixture!("509-marker-comp-two.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let m = first_comp(&project).markers();
+    let got: Vec<_> = m.iter().map(|m| (m.time_units, m.comment.as_str(), m.duration_seconds, m.label)).collect();
+    assert_eq!(got, vec![(25_600, "M1", Some(0.0), Some(2)), (64_000, "M2", Some(0.5), Some(0))]);
+}
+
+#[test]
+fn a_fractional_marker_time_and_duration() {
+    let bytes = fixture!("510-marker-layer-0.52-dur0.3.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let comp = first_comp(&project);
+    let layer = comp.layers().next().expect("L");
+    let m = layer.markers();
+    assert_eq!(m.len(), 1);
+    // 0.52 s = 13 312 / 25 600; 0.3 s = 180 / 600.
+    assert_eq!((m[0].time_units, m[0].comment.as_str()), (13_312, "LM"));
+    assert!((m[0].duration_seconds.expect("duration") - 0.3).abs() < 1e-12);
+}
+
+/// The stored value of the property at `path` (match names) of the first layer.
+fn shape_value(name: &str, path: &[&str]) -> Option<Option<Vec<f64>>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        let layer = comp.layers().next().expect("S");
+        match layer.properties()?.find(path)? {
+            effectcraft_aep::PropNode::Property(p) => p.static_value(),
+            _ => None,
+        }
+    })
+}
+
+const G1: [&str; 2] = ["ADBE Root Vectors Group", "ADBE Vector Group"];
+
+#[test]
+fn shape_values_are_stored_as_shown() {
+    let at = |rest: &[&'static str]| -> Vec<&'static str> { G1.iter().chain(rest.iter()).copied().collect() };
+    assert_eq!(
+        skip!(shape_value("451-shape-ellipse-400x300-fill.aep", &at(&["ADBE Vectors Group", "ADBE Vector Shape - Ellipse", "ADBE Vector Ellipse Size"]))),
+        Some(vec![400.0, 300.0])
+    );
+    assert_eq!(
+        skip!(shape_value("451-shape-ellipse-400x300-fill.aep", &at(&["ADBE Vectors Group", "ADBE Vector Graphic - Fill", "ADBE Vector Fill Color"]))),
+        Some(vec![255.0, 0.0, 255.0, 0.0])
+    );
+    // Group scale in percent, not a fraction.
+    assert_eq!(skip!(shape_value("457-shape-group-scale-50-80.aep", &at(&["ADBE Vector Transform Group", "ADBE Vector Scale"]))), Some(vec![50.0, 80.0]));
+    assert_eq!(
+        skip!(shape_value("464-shape-stroke-opacity-50.aep", &at(&["ADBE Vectors Group", "ADBE Vector Graphic - Stroke", "ADBE Vector Stroke Opacity"]))),
+        Some(vec![50.0])
+    );
+    assert_eq!(
+        skip!(shape_value("467-shape-trim-end-70.aep", &at(&["ADBE Vectors Group", "ADBE Vector Filter - Trim", "ADBE Vector Trim End"]))),
+        Some(vec![70.0])
+    );
+    assert_eq!(
+        skip!(shape_value("469-shape-trim-type-2.aep", &at(&["ADBE Vectors Group", "ADBE Vector Filter - Trim", "ADBE Vector Trim Type"]))),
+        Some(vec![2.0])
+    );
+    assert_eq!(
+        skip!(shape_value("471-shape-rect-roundness-30.aep", &at(&["ADBE Vectors Group", "ADBE Vector Shape - Rect", "ADBE Vector Rect Roundness"]))),
+        Some(vec![30.0])
+    );
+    assert_eq!(
+        skip!(shape_value("473-shape-star-points-6.aep", &at(&["ADBE Vectors Group", "ADBE Vector Shape - Star", "ADBE Vector Star Points"]))),
+        Some(vec![6.0])
+    );
+    // The shape layer's own anchor: pixels as stored.
+    assert_eq!(skip!(shape_value("462-shape-layer-anchor-10-20.aep", &["ADBE Transform Group", "ADBE Anchor Point"])), Some(vec![10.0, 20.0, 0.0]));
+    // A new Trim Paths and every default item of 519 have no record.
+    for item in
+        ["ADBE Vector Shape - Rect", "ADBE Vector Shape - Ellipse", "ADBE Vector Shape - Star", "ADBE Vector Graphic - Fill", "ADBE Vector Filter - Trim"]
+    {
+        let bytes = fixture!("519-shape-all-items-default.aep");
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        let layer = comp.layers().next().expect("S");
+        let Some(effectcraft_aep::PropNode::Group(g)) = layer.properties().and_then(|p| p.find(&at(&["ADBE Vectors Group", item]))) else { panic!("{item}") };
+        assert!(g.entries().iter().all(|e| !matches!(e.node, effectcraft_aep::PropNode::Property(p) if p.flags() == Some(1))), "{item} has a value record");
+    }
+}
+
+/// The baseline option of the first style run of the first text layer.
+fn script_of(name: &str) -> Option<effectcraft_aep::FontBaseline> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        let layer = comp.layers().find(|l| l.text_document().is_some()).expect("a text layer");
+        let doc = layer.text_document().expect("document");
+        assert!(doc.undecoded_style_fields.is_empty(), "{name}: {:?}", doc.undecoded_style_fields);
+        doc.style_runs.first().expect("a run").baseline
+    })
+}
+
+#[test]
+fn superscript_and_subscript_are_style_slot_13() {
+    use effectcraft_aep::FontBaseline;
+    // The character state the corpus was made in is superscript (526, and 243, 517).
+    assert_eq!(skip!(script_of("526-text-point-HHHH-default.aep")), FontBaseline::Superscript);
+    assert_eq!(skip!(script_of("243-text-multiline-A-CR-B.aep")), FontBaseline::Superscript);
+    assert_eq!(skip!(script_of("527-text-point-HHHH-baseline-normal.aep")), FontBaseline::Normal);
+    assert_eq!(skip!(script_of("528-text-point-HHHH-baseline-subscript.aep")), FontBaseline::Subscript);
+}
+
+#[test]
+fn a_wrapping_box_text() {
+    let bytes = fixture!("517-text-box-600x400-wrap.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let comp = first_comp(&project);
+    let doc = comp.layers().find_map(|l| l.text_document()).expect("text");
+    let b = doc.text_box.expect("box text");
+    assert_eq!((b.x, b.y, b.width, b.height), (-300.0, -200.0, 600.0, 400.0));
+    assert_eq!(doc.raw_text, "The quick brown fox jumps over the lazy dog and keeps running far away\r");
+    assert_eq!(doc.style_runs[0].font_size, 100.0);
+}
+
+fn layer_l<T>(name: &str, f: impl Fn(&effectcraft_aep::Layer<'_, '_>) -> T) -> Option<T> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        let layer = comp.layers().next().expect("the solid L, the only layer");
+        f(&layer)
+    })
+}
+
+#[test]
+fn orientation_is_otst_otda() {
+    let o = skip!(layer_l("488-layer-3d-orientation-10-20-30.aep", |l| l.orientation())).expect("orientation");
+    assert_eq!((o.degrees, o.animated, o.has_expression), ([10.0, 20.0, 30.0], false, false));
+    for name in ["485-layer-3d-on.aep", "486-layer-3d-rotx-30.aep", "487-layer-3d-roty-45.aep"] {
+        assert_eq!(skip!(layer_l(name, |l| l.orientation())), None, "{name}: absent at the default");
+    }
+}
diff --git a/crates/aep/tests/it/container/cases_600.rs b/crates/aep/tests/it/container/cases_600.rs
new file mode 100644
index 000000000..53651e6e3
--- /dev/null
+++ b/crates/aep/tests/it/container/cases_600.rs
@@ -0,0 +1,186 @@
+//! Cases of the 600 series (sessions X1 / X2): a renamed effect instance, a composition that shows
+//! two precompositions, image sequences, project settings, a conformed clip and more still types.
+//! Every expected value is the one the case was made with (its MANIFEST row).
+
+use crate::container::helpers::open;
+use effectcraft_aep::Project;
+
+#[test]
+fn a_renamed_effect_keeps_its_name_in_the_value_group() {
+    let bytes = fixture!("610-fx-tint-named-My-Tint.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let comp = project.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("layer");
+    let fx = layer.effects();
+    assert_eq!(fx.len(), 1);
+    assert_eq!(fx[0].match_name(), "ADBE Tint");
+    // fnam keeps the effect's own name, the instance name is the value group's tdsn.
+    assert_eq!(fx[0].name().as_deref(), Some("Tint"));
+    assert_eq!(fx[0].user_name().as_deref(), Some("My Tint"));
+    assert_eq!(fx[0].display_name().as_deref(), Some("My Tint"));
+    // An unnamed instance (356) shows the effect's name.
+    let bytes = fixture!("356-fx-tint-default.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let comp = project.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let fx = comp.layers().next().expect("layer").effects();
+    assert_eq!(fx[0].user_name(), None);
+    assert_eq!(fx[0].display_name().as_deref(), Some("Tint"));
+}
+
+#[test]
+fn a_composition_counts_the_compositions_it_shows() {
+    let bytes = fixture!("601-precomp-two-comps-in-C.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let items = project.all_items();
+    let id = |n: &str| items.iter().find(|i| i.display_name().as_deref() == Some(n)).and_then(|i| i.id()).expect(n);
+    let c = items.iter().find(|i| i.display_name().as_deref() == Some("C")).expect("C");
+    // The list holds each used composition once (in no particular order).
+    let mut used = c.used_item_ids();
+    used.sort();
+    let mut want = vec![id("P30"), id("Q")];
+    want.sort();
+    assert_eq!(used, want);
+    let idpc = c.chunk().child(b"idpc").and_then(|x| x.bytes()).expect("idpc");
+    assert_eq!(&idpc[..4], &2u32.to_le_bytes());
+    // The precomposition layers: P30 640x360 30 fps 3 s, Q 320x240 25 fps 2 s.
+    let comp = c.comp().expect("comp");
+    let sizes: Vec<_> = comp.layers().filter_map(|l| project.layer_source_size(&l)).collect();
+    assert_eq!(sizes, vec![(320, 240), (640, 360), (1920, 1080)]);
+}
+
+#[test]
+fn an_image_sequence_knows_its_numbering() {
+    // 603: shot_0101.exr .. shot_0103.exr imported as a sequence (64x48, 3 frames at 30 fps).
+    let bytes = fixture!("603-footage-exrseq-0101-as-layer.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    let item = project.all_items().into_iter().find(|i| i.footage().is_some_and(|f| !f.is_solid)).expect("sequence");
+    let f = item.footage().expect("footage");
+    assert_eq!((f.file_type.as_str(), f.width, f.height, f.native_frame_rate, f.is_sequence), ("oEXR", 64, 48, 30, true));
+    assert_eq!(f.sequence_frame_count(), Some(3));
+    let s = item.sequence_info().expect("numbering");
+    assert_eq!((s.prefix.as_str(), s.suffix.as_str(), s.start, s.end, s.digits), ("shot_", ".exr", 101, 103, 4));
+    assert_eq!(s.file_name(101), "shot_0101.exr");
+    // A still has no numbering (000: the solid; the base has no other footage).
+    let bytes = fixture!("126-footage-png-layer.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).expect("project");
+    assert!(project.all_items().iter().all(|i| i.sequence_info().is_none()));
+}
+
+#[test]
+fn project_settings_are_read_from_the_header_chunks() {
+    use effectcraft_aep::{ProjectSettings, TimeDisplay, WorkingSpace};
+    let read = |name: &str| {
+        Some({
+            let bytes = crate::common::try_fixture(name)?;
+            let file = open(&bytes);
+            ProjectSettings::read(&file)
+        })
+    };
+    // The base (620 = 000): 32 bpc, sRGB, gamma 2.2, both linear switches off, compensation on,
+    // timecode, frames from 0.
+    let base = skip!(read("000-base.aep"));
+    assert_eq!(
+        base,
+        ProjectSettings {
+            bits_per_channel: Some(32),
+            working_space: Some(WorkingSpace::Profile("sRGB IEC61966-2.1".into())),
+            working_gamma_24: Some(false),
+            linearize: false,
+            blend_linear: false,
+            scene_compensation: Some(true),
+            time_display: Some(TimeDisplay::Timecode),
+            frame_start: Some(0),
+        }
+    );
+    // A project has one value per setting, so the settings cases (MANIFEST 621-634) share three
+    // files: each holds the base with the changes of all its cases (tests/fixtures/CASES.md).
+    let a = ProjectSettings {
+        bits_per_channel: Some(8),
+        working_space: Some(WorkingSpace::None),
+        working_gamma_24: Some(true),
+        scene_compensation: Some(false),
+        time_display: Some(TimeDisplay::Frames),
+        frame_start: Some(1),
+        ..base.clone()
+    };
+    let b = ProjectSettings { linearize: true, blend_linear: true, time_display: Some(TimeDisplay::FeetFrames { frames_per_foot: 16 }), ..base.clone() };
+    // The file of 622, 634 and 902 is Rec.709: After Effects 26.2.1 stored the profile without its
+    // name, so the name is the profile's own description.
+    let c = ProjectSettings {
+        bits_per_channel: Some(16),
+        working_space: Some(WorkingSpace::Profile("Rec.709 Gamma 2.4".into())),
+        time_display: Some(TimeDisplay::FeetFrames { frames_per_foot: 40 }),
+        ..base.clone()
+    };
+    for (names, want) in [
+        (
+            &[
+                "621-settings-bpc-8.aep",
+                "623-settings-workingspace-none.aep",
+                "625-settings-gamma-2.4.aep",
+                "628-settings-scene-compensation-off.aep",
+                "629-settings-time-display-frames.aep",
+                "630-settings-frame-start-1.aep",
+            ][..],
+            a,
+        ),
+        (&["632-settings-linearize-and-blend-linear.aep", "633-settings-feet-frames-35.aep"][..], b),
+        (&["622-settings-bpc-16.aep", "634-settings-feet-frames-16.aep", "902-settings-rec709-16bpc-steps-png-grey-solid.aep"][..], c),
+    ] {
+        for name in names {
+            assert_eq!(skip!(read(name)), want, "{name}");
+        }
+    } // nnhd repeats the depth at byte 24.
+    for (name, v) in [("621-settings-bpc-8.aep", 0u8), ("622-settings-bpc-16.aep", 1), ("000-base.aep", 2)] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        assert_eq!(file.chunk(b"nnhd").and_then(|c| c.bytes()).and_then(|b| b.get(24).copied()), Some(v), "{name}");
+    }
+}
+
+#[test]
+fn a_conformed_clip_keeps_its_native_rate_and_frames() {
+    // 645: the 25 fps, 25-frame mp4 of 606 conformed to 30 fps; 644 the same file unconformed.
+    let read = |name: &str| {
+        Some({
+            let bytes = crate::common::try_fixture(name)?;
+            let file = open(&bytes);
+            let project = Project::new(&file).expect("project");
+            let item = project.all_items().into_iter().find(|i| i.footage().is_some_and(|f| !f.is_solid)).expect("clip");
+            let f = item.footage().expect("footage");
+            (f.native_frame_rate, item.conform_frame_rate(), f.duration.map(|d| (d.num, d.den)))
+        })
+    };
+    assert_eq!(skip!(read("645-footage-mp4-conform-30.aep")), (25, Some(30), Some((25, 25))));
+    // Not conformed (the exr sequence 603, the stills of 650-653).
+    assert_eq!(skip!(read("603-footage-exrseq-0101-as-layer.aep")).1, None);
+    for name in ["650-footage-tga-still-as-layer.aep", "651-footage-psd-flat-as-layer.aep", "652-footage-ai-as-layer.aep", "653-footage-eps-as-layer.aep"] {
+        assert_eq!(skip!(read(name)).1, None, "{name}");
+    }
+}
+
+#[test]
+fn still_footage_of_four_more_types() {
+    // 650-653: a 64 x 48 tga, a flat psd, an ai and an eps imported as footage (MANIFEST); ai and
+    // eps share the type tag `TEXT`.
+    for (name, tag) in [
+        ("650-footage-tga-still-as-layer.aep", "TPIC"),
+        ("651-footage-psd-flat-as-layer.aep", "8BPS"),
+        ("652-footage-ai-as-layer.aep", "TEXT"),
+        ("653-footage-eps-as-layer.aep", "TEXT"),
+    ] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let f = project.all_items().into_iter().find_map(|i| i.footage().filter(|f| !f.is_solid)).expect(name);
+        assert_eq!((f.width, f.height, f.native_frame_rate, f.is_sequence), (64, 48, 0, false), "{name}");
+        assert_eq!(f.file_type, tag, "{name}");
+        let ext = name.get(12..).and_then(|r| r.split('-').next()).unwrap_or_default();
+        assert!(f.path.as_deref().is_some_and(|p| p.ends_with(&format!("still.{ext}"))), "{name}: {:?}", f.path);
+    }
+}
diff --git a/crates/aep/tests/it/container/ease_round2.rs b/crates/aep/tests/it/container/ease_round2.rs
new file mode 100644
index 000000000..89cf20a2c
--- /dev/null
+++ b/crates/aep/tests/it/container/ease_round2.rs
@@ -0,0 +1,69 @@
+//! Ease of Anchor Point, effect point and colour, and mask path keys (597-599, 700, 730); light
+//! type codes (701, 702).
+
+use crate::container::helpers::{first_comp, layer_shown_as, open};
+use effectcraft_aep::{KeyframeKind, Project};
+
+#[test]
+fn mask_path_keys_keep_their_ease_at_byte_24() {
+    for (name, first_out, last_in) in [("599-key-mask-path-ease-infl75.aep", 0.75, 0.75), ("700-key-mask-path-ease-out20-in50.aep", 0.2, 0.5)] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let layer = layer_shown_as(&project, &comp, "L");
+        let atoms = layer.mask_atoms();
+        let list = atoms[0].path.as_ref().and_then(|p| p.keys()).expect("path keys");
+        let keys: Vec<_> = list.keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert_eq!(keys[0].kind(), KeyframeKind::MaskPath);
+        let (a, b) = (keys[0].ease().unwrap(), keys[1].ease().unwrap());
+        assert_eq!((a.out_speed, a.out_influence), (0.0, first_out), "{name}");
+        assert_eq!((b.in_speed, b.in_influence), (0.0, last_in), "{name}");
+    }
+}
+
+#[test]
+fn a_spatial_speed_is_divided_by_the_layer_height() {
+    // 597: 1920x1080 L, out speed 50 px/s stored as 50 / 1080; 730: 400x800 P, 50 / 800.
+    for (name, layer, h) in [("597-key-anchor-ease-out50-40-in30-60.aep", "L", 1080.0), ("730-key-anchor-ease-on-400x800-solid.aep", "P", 800.0)] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let props = layer_shown_as(&project, &comp, layer).properties().unwrap();
+        let Some(effectcraft_aep::PropNode::Group(t)) = props.get("ADBE Transform Group") else { panic!() };
+        let Some(effectcraft_aep::PropNode::Property(a)) = t.get("ADBE Anchor Point") else { panic!() };
+        let keys: Vec<_> = a.keys().unwrap().keyframes().collect();
+        let (e0, e1) = (keys[0].ease().unwrap(), keys[1].ease().unwrap());
+        assert!((e0.out_speed * h - 50.0).abs() < 1e-9 && (e1.in_speed * h - 30.0).abs() < 1e-9, "{name}: {e0:?} {e1:?}");
+        assert_eq!((e0.out_influence, e1.in_influence), (0.4, 0.6));
+    }
+}
+
+#[test]
+fn parallel_and_ambient_lights_have_codes_0_and_3() {
+    use effectcraft_aep::{LayerType, LightType};
+    for (name, want) in [("701-light-parallel-int80-color.aep", LightType::Parallel), ("702-light-ambient-int50-color.aep", LightType::Ambient)] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let light = comp.layers().find(|l| l.header().is_some_and(|h| h.layer_type == LayerType::Light)).expect("light");
+        assert_eq!(light.header().unwrap().light_type(), Some(want), "{name}");
+    }
+}
+
+#[test]
+fn keyed_orientation_pairs_records_and_values() {
+    use effectcraft_aep::Interpolation;
+    let bytes = fixture!("703-key-orientation-0-to-10-20-30-linear.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = layer_shown_as(&project, &comp, "L");
+    assert!(layer.orientation().unwrap().animated);
+    let keys = layer.orientation_keys();
+    assert_eq!(keys.iter().map(|k| (k.time_units, k.degrees)).collect::<Vec<_>>(), [(0, [0.0; 3]), (51200, [10.0, 20.0, 30.0])]);
+    assert!(keys.iter().all(|k| k.interpolation_in == Interpolation::Linear && k.interpolation_out == Interpolation::Linear));
+}
diff --git a/crates/aep/tests/it/container/effects.rs b/crates/aep/tests/it/container/effects.rs
new file mode 100644
index 000000000..93e4b0e55
--- /dev/null
+++ b/crates/aep/tests/it/container/effects.rs
@@ -0,0 +1,292 @@
+//! Effect instances: match names, parameter lists from `parT`/`pard` and stored values, checked
+//! against the values the corpus was made with (its MANIFEST).
+
+use crate::container::helpers::{base_layer, first_comp, open};
+use effectcraft_aep::{Effect, ParamKind, ParamValue, Project};
+
+/// Runs `f` on the single effect of the solid `L` in a fixture.
+fn with_effect<R>(name: &str, f: impl FnOnce(&Effect<'_, '_>) -> R) -> Option<R> {
+    with_effect_in(name, |_, _, e| f(e))
+}
+
+/// Runs `f` on the project, the solid `L` and its single effect in a fixture.
+fn with_effect_in<R>(name: &str, f: impl FnOnce(&Project<'_, '_>, &effectcraft_aep::Layer<'_, '_>, &Effect<'_, '_>) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let effects = layer.effects();
+        assert_eq!(effects.len(), 1, "{name}");
+        f(&project, &layer, &effects[0])
+    })
+}
+
+fn kinds(e: &Effect<'_, '_>) -> Vec<(ParamKind, String)> {
+    e.params().into_iter().map(|p| (p.kind, p.name)).collect()
+}
+
+fn approx(v: Option<ParamValue>, expected: f64) {
+    match v {
+        Some(ParamValue::Number(n)) => assert!((n - expected).abs() < 1e-9, "{n} != {expected}"),
+        other => panic!("{other:?} is not the number {expected}"),
+    }
+}
+
+#[test]
+fn no_effects_without_a_parade_entry() {
+    let bytes = fixture!("000-base.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    assert!(base_layer(&first_comp(&project)).effects().is_empty());
+}
+
+#[test]
+fn slider_control_with_a_stored_value() {
+    // 071: Slider Control, Slider = 77.
+    skip!(with_effect_in("071-fx-slider-value77.aep", |_, layer, e| {
+        assert_eq!((e.match_name(), e.name().as_deref()), ("ADBE Slider Control", Some("Slider Control")));
+        assert_eq!(e.declared_param_count(), Some(3));
+        assert_eq!(kinds(e), [(ParamKind::Layer, String::new()), (ParamKind::FloatSlider, "Slider".to_string()), (ParamKind::NoData, String::new())]);
+        let params = e.params();
+        assert_eq!(params[1].match_name, "ADBE Slider Control-0001");
+        assert_eq!(params[2].match_name, "ADBE Effect Built In Params");
+        assert_eq!(params[1].stored_value(), Some(ParamValue::Number(77.0)));
+        assert_eq!(params[1].value(), Some(ParamValue::Number(77.0)));
+        // The pard default of the slider is 0 (070 has the untouched control).
+        assert_eq!(params[1].pard_default(), Some(ParamValue::Number(0.0)));
+        // The input layer parameter has a value record of its own: its `tdpi` holds the id of the layer that owns the effect.
+        assert_eq!(params[0].stored_value(), Some(ParamValue::Layer(layer.id().unwrap())));
+        assert_eq!(params[0].pard().len(), 148);
+    }));
+}
+
+#[test]
+fn color_control_stores_argb_doubles() {
+    // 073: Color -> [0.2, 0.6, 1], stored as [255, 51, 153, 255] (alpha first).
+    skip!(with_effect("073-fx-color-0.2-0.6-1.aep", |e| {
+        assert_eq!((e.match_name(), e.name().as_deref()), ("ADBE Color Control", Some("Color Control")));
+        assert_eq!(kinds(e), [(ParamKind::Layer, String::new()), (ParamKind::Color, "Color".to_string()), (ParamKind::NoData, String::new())]);
+        let color = e.params()[1].value();
+        let Some(ParamValue::Argb([a, r, g, b])) = color else { panic!("{color:?}") };
+        for (got, want) in [(a, 1.0), (r, 0.2), (g, 0.6), (b, 1.0)] {
+            assert!((got - want).abs() < 1e-6, "{color:?}");
+        }
+    }));
+}
+
+#[test]
+fn dropdown_menu_items_and_default() {
+    // 077: Dropdown Menu Control with the default items.
+    skip!(with_effect("077-fx-dropdown-default.aep", |e| {
+        // A dropdown's match name is a fresh `Pseudo/@@` + 22-character id for every instance.
+        assert!(e.match_name().starts_with("Pseudo/@@") && e.match_name().len() == 31, "{}", e.match_name());
+        assert_eq!(e.name().as_deref(), Some("Dropdown Menu Control"));
+        assert_eq!(kinds(e), [(ParamKind::Layer, String::new()), (ParamKind::Popup, "Menu".to_string()), (ParamKind::NoData, String::new())]);
+        let menu = &e.params()[1];
+        assert_eq!(menu.items.as_deref(), Some(&["Item 1".to_string(), "Item 2".to_string(), "Item 3".to_string()][..]));
+        assert_eq!(menu.pard_default(), Some(ParamValue::Index(1)));
+        // The choice count is the u16 at byte 60 of pard.
+        assert_eq!(u16::from_be_bytes([menu.pard()[60], menu.pard()[61]]), 3);
+        // No other parameter has items.
+        assert!(e.params().iter().filter(|p| p.index != 1).all(|p| p.items.is_none()));
+    }));
+}
+
+#[test]
+fn drop_shadow_defaults_come_from_pard() {
+    // 080: Drop Shadow at its defaults (opacity 50 % = 127.5 of 255, direction 135, distance 5, softness 0).
+    skip!(with_effect("080-fx-dropshadow-default.aep", |e| {
+        assert_eq!((e.match_name(), e.name().as_deref()), ("ADBE Drop Shadow", Some("Drop Shadow")));
+        let k: Vec<_> = e.params().into_iter().map(|p| (p.kind, p.name)).collect();
+        let expected = [
+            (ParamKind::Layer, ""),
+            (ParamKind::Color, "Shadow Color"),
+            (ParamKind::FixedSlider, "Opacity"),
+            (ParamKind::Angle, "Direction"),
+            (ParamKind::FixedSlider, "Distance"),
+            (ParamKind::FixedSlider, "Softness"),
+            (ParamKind::Checkbox, "Shadow Only"),
+            (ParamKind::NoData, ""),
+        ];
+        assert_eq!(k, expected.map(|(kind, n)| (kind, n.to_string())));
+        let p = e.params();
+        approx(p[2].value(), 127.5);
+        approx(p[3].value(), 135.0);
+        approx(p[4].value(), 5.0);
+        approx(p[5].value(), 0.0);
+        // A checkbox without a record is off; the shadow colour default (ARGB bytes in pard) is black.
+        assert_eq!(p[6].value(), Some(ParamValue::Bool(false)));
+        assert_eq!(p[1].value(), Some(ParamValue::Argb([1.0, 0.0, 0.0, 0.0])));
+    }));
+}
+
+// ---------------------------------------------------------------------------- batch 2 (defaults and values)
+
+fn param<'f, 'a>(e: &Effect<'f, 'a>, name: &str) -> effectcraft_aep::EffectParam<'f, 'a> {
+    e.params().into_iter().find(|p| p.name == name).unwrap_or_else(|| panic!("no parameter {name}"))
+}
+
+#[test]
+fn gaussian_blur_default_is_the_pard_default_25() {
+    // 214: Gaussian Blur, all parameters default. The file has no value record and a pard default of 25
+    // (the manifest says 0; the files only ever contain 25, see docs/aep-format.md).
+    skip!(with_effect("214-fx-gaussianblur-default.aep", |e| {
+        assert_eq!(e.match_name(), "ADBE Gaussian Blur 2");
+        let blur = param(e, "Blurriness");
+        assert_eq!(blur.kind, ParamKind::FloatSlider);
+        assert!(blur.stored().is_none());
+        assert_eq!(blur.stored_value(), None);
+        assert_eq!(blur.value(), Some(ParamValue::Number(25.0)));
+        assert_eq!(f64::from_be_bytes(blur.pard()[56..64].try_into().unwrap()), 25.0);
+        assert_eq!(f32::from_be_bytes(blur.pard()[120..124].try_into().unwrap()), 25.0);
+        // Dimensions: Horizontal and Vertical (the first item of the popup); Repeat Edge Pixels: on
+        // (its pard default is 1; After Effects reads a fresh Gaussian Blur back with Repeat Edge
+        // Pixels 1, 417; the corpus manifest's "off" for 214 was wrong).
+        let dims = param(e, "Blur Dimensions");
+        assert_eq!(dims.kind, ParamKind::Popup);
+        assert_eq!(dims.value(), Some(ParamValue::Index(1)));
+        assert_eq!(dims.items.as_ref().and_then(|i| i.first()).map(String::as_str), Some("Horizontal and Vertical"));
+        // The last parameter is the Repeat Edge Pixels checkbox (its label is not in pard).
+        let edge = &e.params()[3];
+        assert_eq!(edge.kind, ParamKind::Checkbox);
+        assert!(edge.stored().is_none());
+        assert_eq!(edge.value(), Some(ParamValue::Bool(true)));
+    }));
+}
+
+#[test]
+fn gaussian_blur_40_adds_a_value_record_and_leaves_pard_at_the_default() {
+    // 216: Blurriness 40.
+    // The case takes its definitions from the project copy (an earlier Gaussian Blur of its file).
+    skip!(with_effect_in("216-fx-gaussianblur-40.aep", |project, _, e| {
+        let blur = project.effect_params(e).into_iter().find(|p| p.name == "Blurriness").unwrap();
+        assert_eq!(blur.stored().unwrap().flags(), Some(1));
+        assert_eq!(blur.stored_value(), Some(ParamValue::Number(40.0)));
+        assert_eq!(blur.value(), Some(ParamValue::Number(40.0)));
+        // pard holds the default, not the current value.
+        assert_eq!(blur.pard_default(), Some(ParamValue::Number(25.0)));
+    }));
+}
+
+#[test]
+fn fill_defaults_come_from_pard() {
+    // 215: Fill with the default colour (red) and opacity (100 %); the file has no value records for them.
+    skip!(with_effect("215-fx-fill-default.aep", |e| {
+        assert_eq!(e.match_name(), "ADBE Fill");
+        let color = param(e, "Color");
+        assert_eq!(color.kind, ParamKind::Color);
+        assert!(color.stored().is_none());
+        assert_eq!(&color.pard()[56..60], [0xff, 0xff, 0x00, 0x00]);
+        assert_eq!(color.value(), Some(ParamValue::Argb([1.0, 1.0, 0.0, 0.0])));
+        let opacity = param(e, "Opacity");
+        assert_eq!(opacity.kind, ParamKind::FixedSlider);
+        assert!(opacity.stored().is_none());
+        assert_eq!(opacity.value(), Some(ParamValue::Number(1.0)));
+    }));
+}
+
+#[test]
+fn checkbox_point_and_angle_values() {
+    // 217: Checkbox 0 -> 1 (stored 1.0).
+    skip!(with_effect("217-fx-checkbox-on.aep", |e| {
+        let p = param(e, "Checkbox");
+        assert_eq!(p.kind, ParamKind::Checkbox);
+        assert_eq!(p.stored_value(), Some(ParamValue::Bool(true)));
+        assert_eq!(p.value(), Some(ParamValue::Bool(true)));
+        assert_eq!(p.stored().unwrap().static_value(), Some(vec![1.0]));
+    }));
+    // 218: Point -> [111, 222], stored as a fraction of the layer size (the layer is 1920x1080).
+    skip!(with_effect("218-fx-point-111-222.aep", |e| {
+        let p = param(e, "Point");
+        assert_eq!(p.kind, ParamKind::Point);
+        let Some(ParamValue::Point([x, y])) = p.value() else { panic!("{:?}", p.value()) };
+        assert!((x - 111.0 / 1920.0).abs() < 1e-12 && (y - 222.0 / 1080.0).abs() < 1e-12, "{x} {y}");
+        assert!((x * 1920.0 - 111.0).abs() < 1e-9 && (y * 1080.0 - 222.0).abs() < 1e-9);
+    }));
+    // 219: Angle -> 90, stored as plain degrees.
+    skip!(with_effect("219-fx-angle-90.aep", |e| {
+        let p = param(e, "Angle");
+        assert_eq!(p.kind, ParamKind::Angle);
+        assert_eq!(p.stored_value(), Some(ParamValue::Number(90.0)));
+        assert_eq!(p.value(), Some(ParamValue::Number(90.0)));
+    }));
+}
+
+#[test]
+fn layer_control_refers_to_a_layer_by_id() {
+    // 220: a new Null on top (layer index 1); L (now index 2) gets a Layer Control with Layer = 1: the tdpi
+    // next to the value record holds the id of the Null.
+    let bytes = fixture!("220-fx-layercontrol-to-layer1.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let null = comp.layers().next().unwrap();
+    let null_id = null.id().unwrap();
+    assert_ne!(Some(null_id), base_layer(&comp).id());
+    assert!(null.header().unwrap().is_null_object());
+    let layer = base_layer(&comp);
+    let e = &layer.effects()[0];
+    assert_eq!(e.match_name(), "ADBE Layer Control");
+    let p = param(e, "Layer");
+    assert_eq!(p.kind, ParamKind::Layer);
+    assert_eq!(p.stored_value(), Some(ParamValue::Layer(null_id)));
+    // The implicit input layer parameter refers to the layer that owns the effect.
+    assert_eq!(e.params()[0].stored_value(), Some(ParamValue::Layer(layer.id().unwrap())));
+}
+
+#[test]
+fn curves_and_mesh_warp_data() {
+    // 963: Red (0,0) (128,44) (255,255); 964: RGB (0,0) (62,24) (194,230) (255,255). Every stored
+    // table is the natural spline through its points.
+    for (name, curve, points) in [
+        ("963-curves-red-mid-down-on-S.aep", 1usize, vec![(0u8, 0u8), (128, 44), (255, 255)]),
+        ("964-curves-rgb-s-curve-on-S.aep", 0, vec![(0, 0), (62, 24), (194, 230), (255, 255)]),
+    ] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = effectcraft_aep::Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        let fx = comp.layers().flat_map(|l| l.effects()).find(|e| e.match_name() == "ADBE CurvesCustom").expect("curves");
+        let data = fx.arbitrary_data("ADBE CurvesCustom-0001").expect("data");
+        let d = effectcraft_aep::CurvesData::parse(data).expect("parse");
+        assert_eq!(d.curves[curve], points, "{name}");
+        assert!(d.curves.iter().enumerate().all(|(i, c)| i == curve || c.as_slice() == effectcraft_aep::CURVE_IDENTITY), "{name}");
+        // Rebuilt from the points, the data is the stored data byte for byte.
+        assert_eq!(d.to_bytes().as_deref(), Some(data), "{name}");
+    }
+    // 985: a 3 x 3 mesh (4 x 4 vertices), vertex (2, 2) moved by (+132, -2) px on 1920 x 1080 with
+    // its handles; the others at their default.
+    let bytes = fixture!("985-meshwarp-3x3-vertex-moved-on-S.aep");
+    let file = open(&bytes);
+    let project = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = first_comp(&project);
+    let fx = comp.layers().flat_map(|l| l.effects()).find(|e| e.match_name() == "ADBE MESH WARP").expect("mesh");
+    let data = fx.arbitrary_data("ADBE MESH WARP-0004").expect("data");
+    let m = effectcraft_aep::MeshData::parse(data).expect("parse");
+    assert_eq!((m.columns, m.rows, m.vertices.len()), (3, 3, 16));
+    for (k, v) in m.vertices.iter().enumerate() {
+        let (i, j) = (k as u32 % 4, k as u32 / 4);
+        let d = effectcraft_aep::MeshData::default_vertex(3, 3, i, j);
+        let (dx, dy) = if (i, j) == (2, 2) { (132.0 / 1920.0, -2.0 / 1080.0) } else { (0.0, 0.0) };
+        for (a, b) in v.iter().zip(&d) {
+            let moved = if *b == [0.0, 0.0] { [0.0, 0.0] } else { [b[0] + dx, b[1] + dy] };
+            assert!((a[0] - moved[0]).abs() < 2e-6 && (a[1] - moved[1]).abs() < 2e-6, "vertex {i},{j}: {a:?} vs {moved:?}");
+        }
+    }
+    assert_eq!(m.to_bytes().as_deref(), Some(data));
+}
+
+#[test]
+fn the_fx_switch_is_the_value_group_flag() {
+    // fx-switch.aep: two Gaussian Blurs on L, the first switched off in After Effects, the second
+    // added after it and left on (one save).
+    let bytes = skip!(crate::common::try_file("fx-switch.aep"));
+    let file = open(&bytes);
+    let p = Project::new(&file).expect("project");
+    let comp = first_comp(&p);
+    let layer = base_layer(&comp);
+    let fx = layer.effects();
+    assert_eq!(fx.iter().map(|e| e.match_name().to_string()).collect::<Vec<_>>(), ["ADBE Gaussian Blur 2", "ADBE Gaussian Blur 2"]);
+    assert_eq!(fx.iter().map(Effect::enabled).collect::<Vec<_>>(), [Some(false), Some(true)]);
+}
diff --git a/crates/aep/tests/it/container/effects_batch4.rs b/crates/aep/tests/it/container/effects_batch4.rs
new file mode 100644
index 000000000..c53ce8ae8
--- /dev/null
+++ b/crates/aep/tests/it/container/effects_batch4.rs
@@ -0,0 +1,307 @@
+//! Batch 4 (cases 356-383): Tint and Gradient Ramp parameters, their defaults, values, keys and
+//! scales, the effect stack order, and the second instance of an effect type whose `parT` is
+//! empty. Every expected value is the one the case was made with (its MANIFEST row).
+
+use crate::container::helpers::{assert_near, base_layer, first_comp, open};
+use effectcraft_aep::{DefinitionSource, EffectParam, Interpolation, KeyframeKind, ParamKind, ParamValue, Project};
+
+/// Key time 2 s in the property timescale 25600.
+const T2: i32 = 51200;
+
+/// Runs `f` on the project view and the parameters of the single effect of `L`.
+fn with_params<R>(name: &str, f: impl FnOnce(&Project<'_, '_>, &[EffectParam<'_, '_>]) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let effects = layer.effects();
+        assert_eq!(effects.len(), 1, "{name}");
+        // The first instance of a type in the combined file (the case that adds it at its defaults)
+        // keeps its own definitions; the later cases read the project copy.
+        let first = ["356-fx-tint-default.aep", "368-fx-ramp-default.aep", "389-fx-exposure-default.aep"].contains(&name);
+        let want = if first { DefinitionSource::Instance } else { DefinitionSource::Project };
+        assert_eq!(project.definition_source(&effects[0]), want, "{name}");
+        let params = project.effect_params(&effects[0]);
+        f(&project, &params)
+    })
+}
+
+fn argb(v: Option<ParamValue>) -> [f64; 4] {
+    match v {
+        Some(ParamValue::Argb(c)) => c,
+        other => panic!("{other:?} is not a colour"),
+    }
+}
+
+fn point(v: Option<ParamValue>) -> [f64; 2] {
+    match v {
+        Some(ParamValue::Point(p)) => p,
+        other => panic!("{other:?} is not a point"),
+    }
+}
+
+fn number(v: Option<ParamValue>) -> f64 {
+    match v {
+        Some(ParamValue::Number(n)) => n,
+        other => panic!("{other:?} is not a number"),
+    }
+}
+
+/// The colour as the case set it: float32 precision (0.2 becomes 0.20000000298).
+const F32: f64 = 1e-6;
+
+// ---------------------------------------------------------------------------- Tint
+
+#[test]
+fn tint_parameters_and_defaults() {
+    // 356: Tint with every parameter at its default.
+    let bytes = fixture!("356-fx-tint-default.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let fx = base_layer(&first_comp(&project)).effects();
+    let e = &fx[0];
+    assert_eq!((e.match_name(), e.name().as_deref()), ("ADBE Tint", Some("Tint")));
+    assert_eq!(e.declared_param_count(), Some(6));
+    let p = project.effect_params(e);
+    let kinds: Vec<_> = p.iter().map(|p| (p.kind, p.name.as_str())).collect();
+    assert_eq!(
+        kinds,
+        [
+            (ParamKind::Layer, ""),
+            (ParamKind::Color, "Map Black To"),
+            (ParamKind::Color, "Map White To"),
+            (ParamKind::FixedSlider, "Amount to Tint"),
+            (ParamKind::Button, ""),
+            (ParamKind::NoData, ""),
+        ]
+    );
+    assert_eq!(p[4].match_name, "ADBE Tint-0004");
+    // The defaults have alpha 0 (what After Effects reads back: [0,0,0,0] / [1,1,1,0]).
+    assert_eq!(p[1].value(), Some(ParamValue::Argb([0.0, 0.0, 0.0, 0.0])));
+    assert_eq!(p[2].value(), Some(ParamValue::Argb([0.0, 1.0, 1.0, 1.0])));
+    assert!(p[1].stored().is_none() && p[2].stored().is_none() && p[3].stored().is_none());
+    // Amount to Tint: 100 percent, stored as a plain percent (valid max 100).
+    assert_eq!(p[3].value(), Some(ParamValue::Number(100.0)));
+    assert_eq!(p[3].valid_max(), Some(100.0));
+    // Swap Colors: a button whose record always exists and holds no value; its label is in pdnm.
+    assert!(p[4].stored().is_some());
+    assert_eq!(p[4].value(), None);
+    assert_eq!(p[4].is_default(), None);
+    assert_eq!(p[4].items.as_deref(), Some(&["Swap Colors".to_string()][..]));
+    assert!(p.iter().all(|p| !p.borrowed_definition && !p.is_animated()));
+}
+
+#[test]
+fn tint_colour_and_amount_values() {
+    // 357: Map Black To [0.2, 0.4, 0.6], stored with alpha 255.
+    skip!(with_params("357-fx-tint-black-0.2-0.4-0.6.aep", |_, p| {
+        assert_near(&argb(p[1].stored_value()), &[1.0, 0.2, 0.4, 0.6], F32);
+        assert_eq!(p[1].is_default(), Some(false));
+        assert_eq!(p[2].value(), Some(ParamValue::Argb([0.0, 1.0, 1.0, 1.0])));
+    }));
+    // 361: Amount to Tint 0 writes a record with 0.
+    skip!(with_params("361-fx-tint-amount-0.aep", |_, p| {
+        assert_eq!(p[3].stored_value(), Some(ParamValue::Number(0.0)));
+        assert_eq!(p[3].is_default(), Some(false));
+    }));
+}
+
+#[test]
+fn tint_keyframes() {
+    // 363: Amount to Tint keyed 20 at 0 s, 80 at 2 s, linear: plain 48-byte records.
+    skip!(with_params("363-fx-tint-amount-2key.aep", |_, p| {
+        let amount = &p[3];
+        assert!(amount.is_animated());
+        assert_eq!(amount.stored_value(), None);
+        let keys: Vec<_> = amount.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert_eq!(keys.iter().map(|k| k.time_units().unwrap()).collect::<Vec<_>>(), [0, T2]);
+        assert_eq!(keys.iter().map(|k| k.scalar_value().unwrap()).collect::<Vec<_>>(), [20.0, 80.0]);
+        assert!(keys.iter().all(|k| k.kind() == KeyframeKind::Plain { components: 1 } && k.interpolation_out() == Some(Interpolation::Linear)));
+    }));
+    // 364: Map White To keyed [1,1,0] -> [0,0,1]: 152-byte colour records, ARGB 0..255.
+    skip!(with_params("364-fx-tint-white-2key.aep", |_, p| {
+        let white = &p[2];
+        assert!(white.is_animated());
+        let keys: Vec<_> = white.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert!(keys.iter().all(|k| k.kind() == KeyframeKind::Spatial { components: 4 } && k.raw().len() == 152));
+        assert_eq!(keys.iter().map(|k| k.time_units().unwrap()).collect::<Vec<_>>(), [0, T2]);
+        assert_near(&keys[0].value().unwrap(), &[255.0, 255.0, 255.0, 0.0], 1e-9);
+        assert_near(&keys[1].value().unwrap(), &[255.0, 0.0, 0.0, 255.0], 1e-9);
+    }));
+}
+
+#[test]
+fn effect_stack_order_is_the_parade_order() {
+    // 366: Gaussian Blur moved above the Tint.
+    let bytes = fixture!("366-fx-blur-then-tint.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let fx = base_layer(&first_comp(&project)).effects();
+    assert_eq!(fx.iter().map(|e| e.match_name()).collect::<Vec<_>>(), ["ADBE Gaussian Blur 2", "ADBE Tint"]);
+    // Both types first appear in earlier cases of the combined file (214, 356), so both read the
+    // project copy, which holds one copy per type.
+    assert!(fx.iter().all(|e| project.definition_source(e) == DefinitionSource::Project));
+    let defs: Vec<String> = project.effect_definitions().into_iter().map(|(m, _)| m).collect();
+    for m in ["ADBE Gaussian Blur 2", "ADBE Tint"] {
+        assert_eq!(defs.iter().filter(|d| *d == m).count(), 1, "{m}");
+    }
+}
+
+// ---------------------------------------------------------------------------- Gradient Ramp
+
+#[test]
+fn ramp_parameters_and_defaults() {
+    // 368: Gradient Ramp with every parameter at its default.
+    skip!(with_params("368-fx-ramp-default.aep", |_, p| {
+        let kinds: Vec<_> = p.iter().map(|p| (p.kind, p.name.as_str())).collect();
+        assert_eq!(
+            kinds,
+            [
+                (ParamKind::Layer, ""),
+                (ParamKind::Point, "Start of Ramp"),
+                (ParamKind::Color, "Start Color"),
+                (ParamKind::Point, "End of Ramp"),
+                (ParamKind::Color, "End Color"),
+                (ParamKind::Popup, "Ramp Shape"),
+                (ParamKind::FixedSlider, "Ramp Scatter"),
+                (ParamKind::FixedSlider, "Blend With Original"),
+                (ParamKind::Button, ""),
+                (ParamKind::NoData, ""),
+            ]
+        );
+        // Start [960,0] and End [960,1080] on the 1920x1080 layer: fractions of the layer size.
+        assert_eq!(p[1].value(), Some(ParamValue::Point([0.5, 0.0])));
+        assert_eq!(p[3].value(), Some(ParamValue::Point([0.5, 1.0])));
+        assert_eq!(p[1].point_px(1920.0, 1080.0), Some([960.0, 0.0]));
+        assert_eq!(p[3].point_px(1920.0, 1080.0), Some([960.0, 1080.0]));
+        // Black to white with alpha 255.
+        assert_eq!(p[2].value(), Some(ParamValue::Argb([1.0, 0.0, 0.0, 0.0])));
+        assert_eq!(p[4].value(), Some(ParamValue::Argb([1.0, 1.0, 1.0, 1.0])));
+        // Linear Ramp is item 1 of 2.
+        assert_eq!(p[5].value(), Some(ParamValue::Index(1)));
+        assert_eq!(p[5].popup_item_count(), Some(2));
+        assert_eq!(p[5].popup_selected_item(), Some("Linear Ramp"));
+        // Scatter 0 (pixels, valid max 512); Blend 0 (a 0..1 fraction, valid max 1).
+        assert_eq!((p[6].value(), p[6].valid_max()), (Some(ParamValue::Number(0.0)), Some(512.0)));
+        assert_eq!((p[7].value(), p[7].valid_max()), (Some(ParamValue::Number(0.0)), Some(1.0)));
+        assert!(p[8].stored().is_some() && p[8].value().is_none());
+        assert!((1..=7).all(|i| p[i].stored().is_none()));
+    }));
+}
+
+#[test]
+fn ramp_values() {
+    // 369: Start of Ramp [100, 200] -> [100/1920, 200/1080].
+    skip!(with_params("369-fx-ramp-start-100-200.aep", |_, p| {
+        assert_near(&point(p[1].stored_value()), &[100.0 / 1920.0, 200.0 / 1080.0], 1e-12);
+        assert_near(&p[1].point_px(1920.0, 1080.0).unwrap(), &[100.0, 200.0], 1e-9);
+    }));
+    // 371: Start Color red.
+    skip!(with_params("371-fx-ramp-startcolor-red.aep", |_, p| {
+        assert_eq!(p[2].stored_value(), Some(ParamValue::Argb([1.0, 1.0, 0.0, 0.0])));
+    }));
+    // 374: End of Ramp [2000, -100], outside the layer.
+    skip!(with_params("374-fx-ramp-end-2000-m100.aep", |_, p| {
+        assert_near(&p[3].point_px(1920.0, 1080.0).unwrap(), &[2000.0, -100.0], 1e-9);
+    }));
+    // 377: Ramp Shape 2 = Radial Ramp.
+    skip!(with_params("377-fx-ramp-shape-radial.aep", |_, p| {
+        assert_eq!(p[5].stored_value(), Some(ParamValue::Index(2)));
+        assert_eq!(p[5].popup_selected_item(), Some("Radial Ramp"));
+    }));
+    // 378: Ramp Scatter 12 (plain pixels).
+    skip!(with_params("378-fx-ramp-scatter-12.aep", |_, p| assert_eq!(number(p[6].stored_value()), 12.0)));
+    // 380: Blend With Original 25 % is stored as the fraction 0.25.
+    skip!(with_params("380-fx-ramp-blend-25pct.aep", |_, p| {
+        assert_eq!(number(p[7].stored_value()), 0.25);
+        assert_eq!(p[7].valid_max(), Some(1.0));
+    }));
+}
+
+#[test]
+fn ramp_point_keyframes() {
+    // 382: Start of Ramp keyed [100,100] at 0 s, [1800,900] at 2 s, linear: 104-byte spatial records.
+    skip!(with_params("382-fx-ramp-start-2key.aep", |_, p| {
+        let start = &p[1];
+        assert!(start.is_animated());
+        let keys: Vec<_> = start.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert!(keys.iter().all(|k| k.kind() == KeyframeKind::Spatial { components: 2 } && k.raw().len() == 104));
+        assert_eq!(keys.iter().map(|k| k.time_units().unwrap()).collect::<Vec<_>>(), [0, T2]);
+        assert_near(&keys[0].value().unwrap(), &[100.0 / 1920.0, 100.0 / 1080.0], 1e-12);
+        assert_near(&keys[1].value().unwrap(), &[1800.0 / 1920.0, 900.0 / 1080.0], 1e-12);
+        assert!(keys.iter().all(|k| k.interpolation_in() == Some(Interpolation::Linear)));
+        let s = keys[0].spatial().unwrap();
+        assert_eq!((s.auto_bezier_flag, s.in_tangent.clone(), s.out_tangent.clone()), (1, vec![0.0; 2], vec![0.0; 2]));
+    }));
+}
+
+#[test]
+fn second_instance_takes_its_definitions_from_the_project_and_its_values_from_itself() {
+    // 383: L keeps its default Gradient Ramp; the new 100x100 solid S100 above it has a Ramp with
+    // Start of Ramp [10, 20]. One of the two instances has an empty parT.
+    let bytes = fixture!("383-fx-ramp-on-100x100-start-10-20.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layers: Vec<_> = comp.layers().collect();
+    assert_eq!(layers.len(), 2);
+    let l = base_layer(&comp);
+    let small = layers.iter().find(|x| x.id() != l.id()).unwrap();
+
+    let small_fx = small.effects();
+    let l_fx = l.effects();
+    assert_eq!((small_fx.len(), l_fx.len()), (1, 1));
+    // In the combined file an earlier case holds the type's full definitions, so here both
+    // instances take them from the project copy.
+    assert_eq!(project.definition_source(&small_fx[0]), DefinitionSource::Project);
+    assert_eq!(project.definition_source(&l_fx[0]), DefinitionSource::Project);
+    assert!(l_fx[0].params().is_empty());
+    assert_eq!(l_fx[0].declared_param_count(), None);
+
+    // S100: [10,20] px on its own 100x100 size; End of Ramp default [50,100].
+    let sp = project.effect_params(&small_fx[0]);
+    assert_near(&point(sp[1].stored_value()), &[0.1, 0.2], 1e-12);
+    assert_near(&sp[1].point_px(100.0, 100.0).unwrap(), &[10.0, 20.0], 1e-9);
+    assert_eq!(sp[3].point_px(100.0, 100.0), Some([50.0, 100.0]));
+
+    // L: the 368 defaults, not the values of the project copy (which is S100's instance).
+    let lp = project.effect_params(&l_fx[0]);
+    assert_eq!(lp.len(), 10);
+    assert!(lp.iter().all(|p| p.borrowed_definition));
+    assert_eq!(lp[1].name, "Start of Ramp");
+    assert!(lp[1].stored().is_none());
+    assert_eq!(lp[1].value(), Some(ParamValue::Point([0.5, 0.0])));
+    assert_eq!(lp[3].value(), Some(ParamValue::Point([0.5, 1.0])));
+    assert_eq!(lp[2].value(), Some(ParamValue::Argb([1.0, 0.0, 0.0, 0.0])));
+    assert_eq!(lp[4].value(), Some(ParamValue::Argb([1.0, 1.0, 1.0, 1.0])));
+    assert_eq!((number(lp[6].value()), number(lp[7].value())), (0.0, 0.0));
+    // A borrowed popup has no reliable pard default (a selection writes into that slot).
+    assert_eq!(lp[5].pard_default(), None);
+    assert_eq!(lp[5].items.as_deref().map(<[String]>::len), Some(2));
+    // L's own records: the input layer (its own id) and the button.
+    assert_eq!(lp[0].stored_value(), Some(ParamValue::Layer(l.id().unwrap())));
+    assert!(lp[8].stored().is_some());
+
+    // One definition for the type, although there are two instances.
+    let defs = project.effect_definitions();
+    assert_eq!(defs.iter().filter(|(m, _)| m == "ADBE Ramp").count(), 1);
+}
+
+#[test]
+fn files_without_effects_have_no_definitions() {
+    // The definitions are per file: a file has some exactly when one of its layers has an effect.
+    let mut without = 0;
+    for name in crate::common::FILES.iter().filter(|n| n.ends_with(".aep")) {
+        let bytes = skip!(crate::common::try_file(name));
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let has_effects = project.all_items().iter().filter_map(|i| i.comp()).any(|c| c.layers().any(|l| !l.effects().is_empty()));
+        assert_eq!(project.effect_definitions().is_empty(), !has_effects, "{name}");
+        without += usize::from(!has_effects);
+    }
+    assert!(without > 0);
+}
diff --git a/crates/aep/tests/it/container/effects_batch5.rs b/crates/aep/tests/it/container/effects_batch5.rs
new file mode 100644
index 000000000..d776f650f
--- /dev/null
+++ b/crates/aep/tests/it/container/effects_batch5.rs
@@ -0,0 +1,151 @@
+//! Effects of batch 5 (cases 409-450, 511-516): integer sliders, checkbox defaults, the stored
+//! scale of each slider (its valid maximum), popup items, and the arbitrary data of Hue/Saturation
+//! and Levels.
+
+use crate::container::helpers::{first_comp, open};
+use effectcraft_aep::{EffectParam, HueSaturationData, LevelsData, ParamKind, ParamValue, Project};
+
+/// Runs `f` on the parameters of the first effect of layer L (the only layer).
+fn with_params<R>(name: &str, f: impl FnOnce(&[EffectParam<'_, '_>], &effectcraft_aep::Effect<'_, '_>) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        let layer = comp.layers().next().expect("L");
+        let fx = layer.effects().into_iter().next().expect("an effect");
+        let params = project.effect_params(&fx);
+        f(&params, &fx)
+    })
+}
+
+fn by_name<'p, 'f, 'a>(params: &'p [EffectParam<'f, 'a>], name: &str) -> &'p EffectParam<'f, 'a> {
+    params.iter().find(|p| p.name == name || p.items.as_ref().is_some_and(|i| i.first().is_some_and(|f| f == name))).unwrap_or_else(|| panic!("no {name}"))
+}
+
+#[test]
+fn invert_channel_items_and_blend() {
+    skip!(with_params("410-fx-invert-channel-2.aep", |p, fx| {
+        assert_eq!(fx.match_name(), "ADBE Invert");
+        let ch = by_name(p, "Channel");
+        assert_eq!(ch.kind, ParamKind::Popup);
+        // The items include separators "(-" (one index each).
+        assert_eq!(ch.items.as_ref().map(|i| (i.len(), i[1].as_str(), i[4].as_str(), i[15].as_str())), Some((16, "Red", "(-", "Alpha")));
+        assert_eq!(ch.stored_value(), Some(ParamValue::Index(2)));
+        assert_eq!(by_name(p, "Blend With Original").valid_max(), Some(100.0));
+    }));
+    skip!(with_params("411-fx-invert-blend-50.aep", |p, _| assert_eq!(by_name(p, "Blend With Original").stored_value(), Some(ParamValue::Number(50.0)))));
+}
+
+#[test]
+fn fast_box_blur_integer_slider_and_checkbox_default_on() {
+    skip!(with_params("413-fx-fastbox-radius-20.aep", |p, _| {
+        let r = by_name(p, "Blur Radius");
+        assert_eq!((r.kind, r.valid_max(), r.stored_value()), (ParamKind::FixedSlider, Some(30000.0), Some(ParamValue::Number(20.0))));
+        let it = by_name(p, "Iterations");
+        assert_eq!((it.kind, it.pard_default(), it.valid_max(), it.stored_value()), (ParamKind::IntSlider, Some(ParamValue::Number(3.0)), Some(50.0), None));
+        // Repeat Edge Pixels is on by default (AE read-back 1): the pard default, no record.
+        let rep = by_name(p, "Repeat Edge Pixels");
+        assert_eq!((rep.kind, rep.pard_default(), rep.value()), (ParamKind::Checkbox, Some(ParamValue::Bool(true)), Some(ParamValue::Bool(true))));
+    }));
+    skip!(with_params("414-fx-fastbox-iterations-1.aep", |p, _| assert_eq!(by_name(p, "Iterations").stored_value(), Some(ParamValue::Number(1.0)))));
+    skip!(with_params("416-fx-fastbox-repeatedge-off.aep", |p, _| {
+        let rep = by_name(p, "Repeat Edge Pixels");
+        assert_eq!((rep.stored_value(), rep.value(), rep.is_default()), (Some(ParamValue::Bool(false)), Some(ParamValue::Bool(false)), Some(false)));
+    }));
+}
+
+#[test]
+fn gaussian_blur_dimensions_and_repeat_edge() {
+    skip!(with_params("418-fx-gaussian-dimensions-3.aep", |p, _| {
+        assert_eq!(by_name(p, "Blur Dimensions").stored_value(), Some(ParamValue::Index(3)));
+        assert_eq!(by_name(p, "Blurriness").pard_default(), Some(ParamValue::Number(25.0)));
+        assert_eq!(by_name(p, "Repeat Edge Pixels").value(), Some(ParamValue::Bool(true)));
+    }));
+    skip!(with_params("419-fx-gaussian-repeatedge-off.aep", |p, _| assert_eq!(by_name(p, "Repeat Edge Pixels").value(), Some(ParamValue::Bool(false)))));
+}
+
+#[test]
+fn drop_shadow_opacity_is_stored_on_0_to_255() {
+    skip!(with_params("422-fx-dropshadow-opacity-204.aep", |p, _| {
+        let o = by_name(p, "Opacity");
+        assert_eq!((o.valid_max(), o.pard_default(), o.stored_value()), (Some(255.0), Some(ParamValue::Number(127.5)), Some(ParamValue::Number(204.0))));
+        assert_eq!(by_name(p, "Distance").valid_max(), Some(4000.0));
+        assert_eq!(by_name(p, "Shadow Only").pard_default(), Some(ParamValue::Bool(false)));
+    }));
+    skip!(with_params("426-fx-dropshadow-shadowonly-on.aep", |p, _| assert_eq!(by_name(p, "Shadow Only").stored_value(), Some(ParamValue::Bool(true)))));
+}
+
+#[test]
+fn glow_defaults_items_and_scales() {
+    skip!(with_params("427-fx-glow-default.aep", |p, _| {
+        let popup = |n: &str| (by_name(p, n).pard_default(), by_name(p, n).items.as_ref().map(|i| i.len()));
+        assert_eq!(popup("Glow Based On"), (Some(ParamValue::Index(2)), Some(2)));
+        assert_eq!(popup("Composite Original"), (Some(ParamValue::Index(2)), Some(3)));
+        assert_eq!(popup("Glow Operation"), (Some(ParamValue::Index(3)), Some(25)));
+        assert_eq!(popup("Color Looping"), (Some(ParamValue::Index(3)), Some(4)));
+        let t = by_name(p, "Glow Threshold");
+        assert_eq!((t.valid_max(), t.pard_default()), (Some(255.0), Some(ParamValue::Number(153.0))));
+        let m = by_name(p, "A & B Midpoint");
+        assert_eq!(m.pard_default(), Some(ParamValue::Number(0.5)));
+        assert!(m.valid_max().is_some_and(|v| (v - 0.99).abs() < 0.001));
+    }));
+    skip!(with_params("429-fx-glow-threshold-76.5.aep", |p, _| assert_eq!(by_name(p, "Glow Threshold").stored_value(), Some(ParamValue::Number(76.5)))));
+    skip!(with_params("438-fx-glow-midpoint-0.25.aep", |p, _| assert_eq!(by_name(p, "A & B Midpoint").stored_value(), Some(ParamValue::Number(0.25)))));
+}
+
+#[test]
+fn hue_saturation_master_values_are_arbitrary_data() {
+    for (name, master) in [("444-fx-huesat-hue-90.aep", [90, 0, 0]), ("446-fx-huesat-light-m30.aep", [0, 0, -30])] {
+        skip!(with_params(name, |p, fx| {
+            // The visible Master parameters keep no record.
+            assert!(by_name(p, "Master Hue").stored().is_none(), "{name}");
+            let range = by_name(p, "Channel Range");
+            assert_eq!(range.kind, ParamKind::ArbitraryData);
+            let data = fx.arbitrary_data(&range.match_name).expect("data");
+            let d = HueSaturationData::parse(data).expect("180 bytes");
+            assert_eq!(d.master, master, "{name}");
+            assert!(d.ranges_are_default(), "{name}");
+        }));
+    }
+    skip!(with_params("448-fx-huesat-colorizehue-120.aep", |p, fx| {
+        assert_eq!(by_name(p, "Colorize Hue").stored_value(), Some(ParamValue::Number(120.0)));
+        assert_eq!(by_name(p, "Colorize Saturation").pard_default(), Some(ParamValue::Number(25.0)));
+        let d = HueSaturationData::parse(fx.arbitrary_data(&by_name(p, "Channel Range").match_name).expect("data")).expect("parses");
+        assert_eq!(d.master, [0, 0, 0]);
+    }));
+}
+
+#[test]
+fn levels_values_are_arbitrary_data() {
+    let f32r = |x: f64| f32::from_bits((x as f32).to_bits());
+    for (name, rgb) in [
+        ("512-fx-levels-inblack-0.1.aep", [f32r(0.1), 1.0, 1.0, 0.0, 1.0]),
+        ("514-fx-levels-gamma-2.aep", [0.0, 1.0, 2.0, 0.0, 1.0]),
+        ("516-fx-levels-outwhite-0.9.aep", [0.0, 1.0, 1.0, 0.0, f32r(0.9)]),
+    ] {
+        skip!(with_params(name, |p, fx| {
+            assert!(by_name(p, "Input Black").stored().is_none(), "{name}: the visible parameter keeps no record");
+            let h = by_name(p, "Histogram");
+            assert_eq!(h.kind, ParamKind::ArbitraryData);
+            let d = LevelsData::parse(fx.arbitrary_data(&h.match_name).expect("data")).expect("108 bytes");
+            assert_eq!(d.header, [0x000f_10a7, 1], "{name}");
+            assert_eq!(d.channels[0], rgb, "{name}");
+            for c in &d.channels[1..] {
+                assert_eq!(*c, LevelsData::DEFAULT_CHANNEL, "{name}");
+            }
+            let clip = by_name(p, "Clip To Output Black");
+            assert_eq!(clip.items.as_ref().map(|i| i.join("|")), Some("On|Off|Off for 32 bpc Color".to_string()));
+            // A borrowed popup (a later Levels of the combined file) has no reliable pard default.
+            let want = if clip.borrowed_definition { None } else { Some(ParamValue::Index(3)) };
+            assert_eq!(clip.pard_default(), want, "{name}");
+        }));
+    }
+}
+
+#[test]
+fn hostile_arbitrary_data_is_none() {
+    assert_eq!(HueSaturationData::parse(&[0; 179]), None);
+    assert_eq!(LevelsData::parse(&[0; 200]), None);
+    assert!(HueSaturationData::parse(&[0xff; 180]).is_some());
+}
diff --git a/crates/aep/tests/it/container/effects_exposure.rs b/crates/aep/tests/it/container/effects_exposure.rs
new file mode 100644
index 000000000..f29c8b7fe
--- /dev/null
+++ b/crates/aep/tests/it/container/effects_exposure.rs
@@ -0,0 +1,145 @@
+//! Batch 4, session S7 (cases 389-397): Exposure (`ADBE Exposure2`): the popup, the four
+//! twirl-down groups (start / end markers that hold no value), float sliders with their valid and
+//! slider ranges, the Bypass checkbox and a keyed slider. Every expected value is the one the case
+//! was made with (its MANIFEST row).
+
+use crate::container::helpers::{assert_near, base_layer, first_comp, open};
+use effectcraft_aep::{DefinitionSource, EffectParam, Interpolation, KeyframeKind, ParamKind, ParamValue, Project};
+
+/// Key time 2 s in the property timescale 25600.
+const T2: i32 = 51200;
+/// Float sliders hold the float32 value widened to f64 (0.1 is 0.10000000149).
+const F32: f64 = 1e-6;
+
+/// Runs `f` on the parameters of the single effect of `L`.
+fn with_params<R>(name: &str, f: impl FnOnce(&[EffectParam<'_, '_>]) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let effects = layer.effects();
+        assert_eq!(effects.len(), 1, "{name}");
+        assert_eq!(effects[0].match_name(), "ADBE Exposure2", "{name}");
+        // The first instance of a type in the combined file (the case that adds it at its defaults)
+        // keeps its own definitions; the later cases read the project copy.
+        let first = ["356-fx-tint-default.aep", "368-fx-ramp-default.aep", "389-fx-exposure-default.aep"].contains(&name);
+        let want = if first { DefinitionSource::Instance } else { DefinitionSource::Project };
+        assert_eq!(project.definition_source(&effects[0]), want, "{name}");
+        let params = project.effect_params(&effects[0]);
+        assert_eq!(params.len(), 24, "{name}");
+        f(&params)
+    })
+}
+
+fn number(v: Option<ParamValue>) -> f64 {
+    match v {
+        Some(ParamValue::Number(n)) => n,
+        other => panic!("{other:?} is not a number"),
+    }
+}
+
+/// The `parT` indices of the Exposure / Offset / Gamma Correction sliders of Master, Red, Green
+/// and Blue.
+const GROUPS: [(usize, &str); 4] = [(2, "Master"), (7, "Red"), (12, "Green"), (17, "Blue")];
+
+#[test]
+fn exposure_parameters_and_defaults() {
+    // 389: Exposure with every parameter at its default.
+    let bytes = fixture!("389-fx-exposure-default.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let fx = base_layer(&first_comp(&project)).effects();
+    assert_eq!((fx[0].match_name(), fx[0].name().as_deref()), ("ADBE Exposure2", Some("Exposure")));
+    assert_eq!(fx[0].declared_param_count(), Some(24));
+    skip!(with_params("389-fx-exposure-default.aep", |p| {
+        assert_eq!((p[0].kind, p[1].kind, p[22].kind, p[23].kind), (ParamKind::Layer, ParamKind::Popup, ParamKind::Checkbox, ParamKind::NoData));
+        assert_eq!(p[1].name, "Channels:");
+        assert_eq!(p[1].items.as_deref(), Some(&["Master".to_string(), "Individual Channels".to_string()][..]));
+        assert_eq!((p[1].value(), p[1].popup_item_count(), p[1].popup_selected_item()), (Some(ParamValue::Index(1)), Some(2), Some("Master")));
+        for (start, group) in GROUPS {
+            let prefix = if group == "Master" { String::new() } else { format!("{group} ") };
+            // The group markers: always a record, no value, the end repeats the group's name.
+            for (i, kind) in [(start, ParamKind::GroupStart), (start + 4, ParamKind::GroupEnd)] {
+                assert_eq!((p[i].kind, p[i].name.as_str()), (kind, group));
+                assert!(p[i].stored().is_some(), "{group} {kind:?}");
+                assert_eq!((p[i].stored_value(), p[i].pard_default(), p[i].value(), p[i].is_default()), (None, None, None, None));
+            }
+            let names = [format!("{prefix}Exposure"), format!("{prefix}Offset"), format!("{prefix}Gamma Correction")];
+            // Valid range, slider range and default per slider (the same for all four groups).
+            let want = [((-100.0, 100.0), (-4.0, 4.0), 0.0), ((-2.0, 2.0), (-0.5, 0.5), 0.0), ((0.1, 10.0), (0.1, 10.0), 1.0)];
+            for (k, (valid, slider, default)) in want.into_iter().enumerate() {
+                let s = &p[start + 1 + k];
+                assert_eq!((s.kind, s.name.as_str()), (ParamKind::FloatSlider, names[k].as_str()));
+                assert_eq!(s.match_name, format!("ADBE Exposure2-{:04}", start + 1 + k));
+                assert!(s.stored().is_none(), "{}", s.name);
+                assert_eq!(s.value(), Some(ParamValue::Number(default)), "{}", s.name);
+                assert_eq!(s.is_default(), Some(true));
+                assert_near(&[s.valid_min().unwrap(), s.valid_max().unwrap()], &[valid.0, valid.1], F32);
+                let (lo, hi) = s.slider_range().unwrap();
+                assert_near(&[lo, hi], &[slider.0, slider.1], F32);
+            }
+        }
+        // Bypass Linear Light Conversion: an unnamed checkbox labelled in pdnm, off.
+        assert_eq!(p[22].name, "");
+        assert_eq!(p[22].items.as_deref(), Some(&["Bypass Linear Light Conversion".to_string()][..]));
+        assert!(p[22].stored().is_none());
+        assert_eq!(p[22].value(), Some(ParamValue::Bool(false)));
+        // Ranges exist only on float sliders.
+        assert_eq!((p[1].valid_min(), p[1].slider_range(), p[22].slider_range(), p[2].valid_max()), (None, None, None, None));
+        assert!(p.iter().all(|p| !p.borrowed_definition && !p.is_animated()));
+    }));
+}
+
+#[test]
+fn exposure_values() {
+    // 390: Channels -> Individual Channels (2).
+    skip!(with_params("390-fx-exposure-channels-individual.aep", |p| {
+        assert_eq!(p[1].stored_value(), Some(ParamValue::Index(2)));
+        assert_eq!(p[1].popup_selected_item(), Some("Individual Channels"));
+        assert_eq!(p[1].is_default(), Some(false));
+    }));
+    // 391: Exposure 1.5.
+    skip!(with_params("391-fx-exposure-master-1.5.aep", |p| {
+        assert_eq!(p[3].stored_value(), Some(ParamValue::Number(1.5)));
+        assert_eq!(p[3].is_default(), Some(false));
+        assert_eq!(p[4].value(), Some(ParamValue::Number(0.0)));
+    }));
+    // 393: Offset 0.1 (float32: 0.10000000149).
+    skip!(with_params("393-fx-exposure-offset-0.1.aep", |p| {
+        assert_near(&[number(p[4].stored_value())], &[0.1], F32);
+        assert_eq!(p[3].value(), Some(ParamValue::Number(0.0)));
+    }));
+    // 394: Gamma Correction 2.2 (float32: 2.2000000477).
+    skip!(with_params("394-fx-exposure-gamma-2.2.aep", |p| {
+        assert_near(&[number(p[5].stored_value())], &[2.2], F32);
+        assert_eq!(p[5].is_default(), Some(false));
+    }));
+    // 395: Channels 2 and Red Exposure 1: two ordinary records.
+    skip!(with_params("395-fx-exposure-individual-red-1.aep", |p| {
+        assert_eq!(p[1].stored_value(), Some(ParamValue::Index(2)));
+        assert_eq!(p[8].stored_value(), Some(ParamValue::Number(1.0)));
+        assert_eq!(p[3].value(), Some(ParamValue::Number(0.0)));
+    }));
+    // 396: Bypass on: a record with 1.0.
+    skip!(with_params("396-fx-exposure-bypass-on.aep", |p| {
+        assert_eq!(p[22].stored_value(), Some(ParamValue::Bool(true)));
+        assert_eq!(p[22].is_default(), Some(false));
+    }));
+}
+
+#[test]
+fn exposure_keyframes() {
+    // 397: Exposure keyed -1 at 0 s, 2 at 2 s, linear: plain 48-byte records.
+    skip!(with_params("397-fx-exposure-master-2key.aep", |p| {
+        let e = &p[3];
+        assert!(e.is_animated());
+        assert_eq!(e.stored_value(), None);
+        let keys: Vec<_> = e.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert_eq!(keys.iter().map(|k| k.time_units().unwrap()).collect::<Vec<_>>(), [0, T2]);
+        assert_eq!(keys.iter().map(|k| k.scalar_value().unwrap()).collect::<Vec<_>>(), [-1.0, 2.0]);
+        assert!(keys.iter().all(|k| k.kind() == KeyframeKind::Plain { components: 1 } && k.raw().len() == 48));
+        assert!(keys.iter().all(|k| k.interpolation_in() == Some(Interpolation::Linear) && k.interpolation_out() == Some(Interpolation::Linear)));
+    }));
+}
diff --git a/crates/aep/tests/it/container/header.rs b/crates/aep/tests/it/container/header.rs
new file mode 100644
index 000000000..bb07e96b3
--- /dev/null
+++ b/crates/aep/tests/it/container/header.rs
@@ -0,0 +1,364 @@
+//! The layer header (`ldta`) and the composition header (`cdta`, `PRin`), checked against the values
+//! the synthetic corpus was made with (its MANIFEST): comp `C` 1920x1080, 25 fps, 5 s, background
+//! black, shutter angle 180, one solid layer `L` (red, 1920x1080, label 1, Normal, Best, start 0,
+//! in 0, out 5, stretch 100), then one change per file.
+
+use crate::container::helpers::{base_layer, first_comp, open};
+use effectcraft_aep::{BlendMode, LayerHeader, LayerType, Project, Quality, Rational};
+
+const L: u32 = 0x1b;
+
+/// The header of the solid layer `L` in a fixture.
+fn l_header(name: &str) -> Option<LayerHeader> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        base_layer(&comp).header().unwrap()
+    })
+}
+
+/// The switches that the MANIFEST lists, so that a case can say which one differs from the base.
+#[derive(Debug, Clone, PartialEq)]
+struct Switches {
+    shy: bool,
+    locked: bool,
+    solo: bool,
+    three_d: bool,
+    motion_blur: bool,
+    collapse: bool,
+    adjustment: bool,
+    guide: bool,
+}
+
+fn switches(h: &LayerHeader) -> Switches {
+    Switches {
+        shy: h.is_shy(),
+        locked: h.is_locked(),
+        solo: h.is_solo(),
+        three_d: h.is_three_d(),
+        motion_blur: h.is_motion_blur(),
+        collapse: h.collapses_transformations(),
+        adjustment: h.is_adjustment(),
+        guide: h.is_guide(),
+    }
+}
+
+const NONE: Switches =
+    Switches { shy: false, locked: false, solo: false, three_d: false, motion_blur: false, collapse: false, adjustment: false, guide: false };
+
+/// Everything the base layer and every one-switch case share.
+fn assert_plain(h: &LayerHeader) {
+    // The id is the case's own (0x1b in the single-case files); the source is the solid `L`.
+    assert_eq!(h.layer_type, LayerType::Av);
+    assert_eq!(h.label, 1);
+    // No name was set, so the copy of the name at byte 64 is empty (the layer shows its source name).
+    assert_eq!(h.name_copy, "");
+    assert!(!h.name_is_user_set());
+    assert!(!h.is_null_object());
+    assert_eq!(h.parent_id, None);
+    assert_eq!(h.source_id, Some(0x1a));
+}
+
+#[test]
+fn base_layer_header() {
+    let h = skip!(l_header("000-base.aep"));
+    assert_plain(&h);
+    assert_eq!(h.quality, Quality::Best);
+    assert_eq!(h.blend_mode, BlendMode::Normal);
+    assert_eq!(h.stretch, 1);
+    assert_eq!(h.stretch_percent(), 100.0);
+    assert_eq!(switches(&h), NONE);
+    // start 0 s, in 0 s, out 5 s; denominator = the composition timescale.
+    assert_eq!(h.start, Rational { num: 0, den: 25600 });
+    assert_eq!(h.in_relative, Rational { num: 0, den: 25600 });
+    assert_eq!(h.out_relative, Rational { num: 128_000, den: 25600 });
+    assert_eq!(h.start_seconds(), Some(0.0));
+    assert_eq!(h.in_point_seconds(), Some(0.0));
+    assert_eq!(h.out_point_seconds(), Some(5.0));
+    assert_eq!(h.out_point(), Rational::new(5, 1));
+}
+
+#[test]
+fn one_switch_per_case() {
+    // (file, the switches that case turns on)
+    let cases = [
+        ("012-layer-shy.aep", Switches { shy: true, ..NONE }),
+        ("013-layer-locked.aep", Switches { locked: true, ..NONE }),
+        ("014-layer-solo.aep", Switches { solo: true, ..NONE }),
+        ("015-layer-3d.aep", Switches { three_d: true, ..NONE }),
+        ("017-layer-motionblur.aep", Switches { motion_blur: true, ..NONE }),
+        ("024-layer-collapse.aep", Switches { collapse: true, ..NONE }),
+        ("025-layer-adjustment.aep", Switches { adjustment: true, ..NONE }),
+        ("026-layer-guide.aep", Switches { guide: true, ..NONE }),
+    ];
+    for (name, expected) in cases {
+        let h = skip!(l_header(name));
+        assert_eq!(switches(&h), expected, "{name}");
+        assert_plain(&h);
+        assert_eq!((h.quality, h.blend_mode, h.stretch), (Quality::Best, BlendMode::Normal, 1), "{name}");
+        assert_eq!(h.out_point_seconds(), Some(5.0), "{name}");
+    }
+}
+
+#[test]
+fn name_blend_mode_and_quality() {
+    let h = skip!(l_header("010-layer-name.aep"));
+    assert_eq!(h.name_copy, "Renamed");
+    assert!(h.name_is_user_set());
+    let bytes = fixture!("010-layer-name.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    // The layer name is the user's; the source footage keeps its own name.
+    assert_eq!(layer.name().as_deref(), Some("Renamed"));
+    assert_eq!(project.layer_source(&layer).and_then(|i| i.display_name()).as_deref(), Some("L"));
+    assert_eq!(project.layer_display_name(&layer).as_deref(), Some("Renamed"));
+
+    assert_eq!(skip!(l_header("016-layer-blend-multiply.aep")).blend_mode, BlendMode::Multiply);
+    assert_eq!(skip!(l_header("023-layer-quality-draft.aep")).quality, Quality::Draft);
+}
+
+#[test]
+fn display_name_falls_back_to_the_source_name() {
+    let bytes = fixture!("000-base.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    assert_eq!(layer.name(), None);
+    assert_eq!(project.layer_display_name(&layer).as_deref(), Some("L"));
+    assert_eq!(project.layer_source_size(&layer), Some((1920, 1080)));
+    let source = project.layer_source(&layer).unwrap();
+    assert_eq!(source.id(), Some(0x1a));
+    assert!(source.footage().unwrap().is_solid);
+}
+
+#[test]
+fn time_stretch_and_the_in_out_start_convention() {
+    // 018: stretch 100 -> 200: the stored out point stays 5 s, the layer ends at 10 s.
+    let h = skip!(l_header("018-layer-stretch200.aep"));
+    assert_eq!(h.stretch, 2);
+    assert_eq!(h.stretch_percent(), 200.0);
+    assert_eq!(h.out_relative, Rational { num: 128_000, den: 25600 });
+    assert_eq!(h.out_point_seconds(), Some(10.0));
+    assert_eq!(h.in_point_seconds(), Some(0.0));
+
+    // 019: inPoint 0 -> 1; AE moved the out point to 6 s and left the start at 0.
+    let h = skip!(l_header("019-layer-inpoint1.aep"));
+    assert_eq!(h.start_seconds(), Some(0.0));
+    assert_eq!(h.in_relative, Rational { num: 25600, den: 25600 });
+    assert_eq!(h.in_point(), Rational::new(1, 1));
+    assert_eq!(h.out_point_seconds(), Some(6.0));
+
+    // 021: startTime 0 -> 0.5: in 0.5 s and out 5.5 s although the stored in point stays 0.
+    let h = skip!(l_header("021-layer-starttime0.5.aep"));
+    assert_eq!(h.start, Rational { num: 12800, den: 25600 });
+    assert_eq!(h.start_seconds(), Some(0.5));
+    assert_eq!(h.in_relative.num, 0);
+    assert_eq!(h.in_point(), Rational::new(1, 2));
+    assert_eq!(h.in_point_seconds(), Some(0.5));
+    assert_eq!(h.out_point_seconds(), Some(5.5));
+    assert_eq!(h.out_point(), Rational::new(11, 2));
+}
+
+#[test]
+fn parent_link_and_null_object() {
+    // 022: a new null layer "Null" (source "Null 1", 100x100) on top; L is its child.
+    let bytes = fixture!("022-layer-parent-null.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layers: Vec<_> = comp.layers().collect();
+    assert_eq!(layers.len(), 2);
+    let null = &layers[0];
+    let nh = null.header().unwrap();
+    assert_eq!(null.name().as_deref(), Some("Null"));
+    assert!(nh.is_null_object());
+    assert!(nh.name_is_user_set());
+    assert_eq!(nh.layer_type, LayerType::Av);
+    assert_eq!(nh.parent_id, None);
+    assert_eq!(project.layer_source(null).and_then(|i| i.display_name()).as_deref(), Some("Null 1"));
+    assert_eq!(project.layer_source_size(null), Some((100, 100)));
+    let lh = layers[1].header().unwrap();
+    assert_ne!(lh.id, nh.id);
+    assert_eq!(lh.parent_id, Some(nh.id));
+    assert!(!lh.is_null_object());
+}
+
+#[test]
+fn layer_header_is_none_when_ldta_is_too_short() {
+    assert!(LayerHeader::parse(&[0; 139]).is_none());
+    assert!(LayerHeader::parse(&[]).is_none());
+    assert!(LayerHeader::parse(&[0; 140]).is_some());
+}
+
+#[test]
+fn rational_is_exact() {
+    assert_eq!(Rational::new(12800, 25600), Some(Rational { num: 1, den: 2 }));
+    assert_eq!(Rational::new(-3, -6), Some(Rational { num: 1, den: 2 }));
+    assert_eq!(Rational::new(3, -6), Some(Rational { num: -1, den: 2 }));
+    assert_eq!(Rational::new(0, 7), Some(Rational { num: 0, den: 1 }));
+    assert_eq!(Rational::new(1, 0), None);
+    assert_eq!(Rational { num: 1, den: 0 }.to_f64(), None);
+    assert_eq!(Rational::new(i64::MIN, 1), None);
+}
+
+// ----------------------------------------------------------------------------------- composition
+
+use effectcraft_aep::CompHeader;
+
+fn comp_header(name: &str) -> Option<(CompHeader, Option<String>, Option<(String, String)>)> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        (comp.header().unwrap(), comp.name(), comp.renderer().map(|r| (r.match_name, r.display_name)))
+    })
+}
+
+#[test]
+fn base_comp_header() {
+    let (h, name, renderer) = skip!(comp_header("000-base.aep"));
+    assert_eq!(name.as_deref(), Some("C"));
+    assert_eq!((h.width, h.height), (1920, 1080));
+    assert_eq!((h.time_base.frame_duration, h.time_base.timescale), (1024, 25600));
+    assert_eq!(h.frame_rate(), Some(25.0));
+    assert_eq!(h.frame_rate_from_fixed(), 25.0);
+    assert_eq!(h.duration_units, 128_000);
+    assert_eq!(h.duration_seconds(), Some(5.0));
+    assert_eq!(h.background, [0, 0, 0]);
+    assert_eq!(h.background_rgb(), [0.0, 0.0, 0.0]);
+    assert_eq!(h.shutter_angle, 180);
+    assert_eq!(h.work_area_start_seconds(), Some(0.0));
+    assert_eq!(h.work_area_end_units, None);
+    assert_eq!(h.work_area_end_seconds(), Some(5.0));
+    assert_eq!(h.pixel_aspect, Rational { num: 1, den: 1 });
+    assert_eq!(h.pixel_aspect_ratio(), Some(1.0));
+    assert!(!h.motion_blur);
+    // The manifest calls the classic renderer `ADBE Advanced 3d`; the file stores `ADBE Escher`
+    // and the display name `Classic 3D`.
+    assert_eq!(renderer, Some(("ADBE Escher".to_string(), "Classic 3D".to_string())));
+}
+
+#[test]
+fn one_comp_change_per_case() {
+    let (base, _, _) = skip!(comp_header("000-base.aep"));
+
+    let (h, _, _) = skip!(comp_header("030-comp-size-1280x720.aep"));
+    assert_eq!((h.width, h.height), (1280, 720));
+    assert_eq!(CompHeader { width: 1920, height: 1080, ..h }, base);
+
+    // 031: frameRate 25 -> 30: the frame duration stays 1024, the timescale becomes 30720; the
+    // duration stays 5 s (153 600 units).
+    let (h, _, _) = skip!(comp_header("031-comp-fps30.aep"));
+    assert_eq!((h.time_base.frame_duration, h.time_base.timescale), (1024, 30720));
+    assert_eq!(h.frame_rate(), Some(30.0));
+    assert_eq!(h.frame_rate_from_fixed(), 30.0);
+    assert_eq!(h.duration_units, 153_600);
+    assert_eq!(h.duration_seconds(), Some(5.0));
+
+    // 032: duration 5 -> 10 s; the work area stays the whole composition.
+    let (h, _, _) = skip!(comp_header("032-comp-duration10.aep"));
+    assert_eq!(h.duration_units, 256_000);
+    assert_eq!(h.duration_seconds(), Some(10.0));
+    assert_eq!(h.work_area_end_seconds(), Some(10.0));
+
+    // 033: bgColor [0,0,0] -> [0,1,0].
+    let (h, _, _) = skip!(comp_header("033-comp-bg-green.aep"));
+    assert_eq!(h.background, [0, 255, 0]);
+    assert_eq!(h.background_rgb(), [0.0, 1.0, 0.0]);
+
+    // 034: shutterAngle 180 -> 90.
+    let (h, _, _) = skip!(comp_header("034-comp-shutter90.aep"));
+    assert_eq!(h.shutter_angle, 90);
+    assert_eq!(CompHeader { shutter_angle: 180, ..h }, base);
+
+    // 035: workAreaStart 0 -> 1, workAreaDuration 5 -> 2: the end is start + duration = 3 s.
+    let (h, _, _) = skip!(comp_header("035-comp-workarea-1-2.aep"));
+    assert_eq!(h.work_area_start_units, 25600);
+    assert_eq!(h.work_area_end_units, Some(76_800));
+    assert_eq!(h.work_area_start_seconds(), Some(1.0));
+    assert_eq!(h.work_area_end_seconds(), Some(3.0));
+}
+
+#[test]
+fn one_comp_change_per_case_aspect_blur_renderer() {
+    let (base, _, base_renderer) = skip!(comp_header("000-base.aep"));
+
+    // 037: pixelAspect 1 -> 2.
+    let (h, _, _) = skip!(comp_header("037-comp-pixelaspect2.aep"));
+    assert_eq!(h.pixel_aspect, Rational { num: 2, den: 1 });
+    assert_eq!(h.pixel_aspect_ratio(), Some(2.0));
+
+    // 038: comp motion blur on.
+    let (h, _, _) = skip!(comp_header("038-comp-motionblur.aep"));
+    assert!(h.motion_blur);
+    assert_eq!(CompHeader { motion_blur: false, ..h }, base);
+
+    // 039: renderer -> Advanced 3D.
+    let (h, _, renderer) = skip!(comp_header("039-comp-renderer-advanced3d.aep"));
+    assert_eq!(renderer, Some(("ADBE Calder".to_string(), "Advanced 3D".to_string())));
+    assert_ne!(renderer, base_renderer);
+    assert_eq!(h, base);
+}
+
+#[test]
+fn comp_header_is_none_when_cdta_is_too_short() {
+    assert!(CompHeader::parse(&[0; 175]).is_none());
+    assert!(CompHeader::parse(&[0; 176]).is_some());
+}
+
+#[test]
+fn precomp_item_ids_and_labels() {
+    // 124: L precomposed into "Pre"; the layer in C is a comp-sourced layer labelled 15.
+    let bytes = fixture!("124-precomp-Pre.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comps: Vec<_> = project.all_items().into_iter().filter_map(|i| i.comp().map(|c| (i, c))).collect();
+    let names: Vec<_> = comps.iter().map(|(_, c)| c.name().unwrap()).collect();
+    assert_eq!(names, ["C", "Pre"]);
+    let (c_item, c) = &comps[0];
+    let (pre_item, pre) = &comps[1];
+    let layers: Vec<_> = c.layers().collect();
+    assert_eq!(layers.len(), 1);
+    let layer = &layers[0];
+    let h = layer.header().unwrap();
+    assert_eq!(h.source_id, pre_item.id());
+    assert_eq!(project.layer_source(layer).unwrap().id(), pre_item.id());
+    assert_eq!(h.label, 15);
+    assert!(!h.name_is_user_set());
+    assert_eq!(layer.name(), None);
+    assert_eq!(project.layer_display_name(layer).as_deref(), Some("Pre"));
+    assert_eq!(project.layer_source_size(layer), Some((1920, 1080)));
+    // The precomp layer's start time has the denominator 1; the Pre comp is 1920x1080, 25 fps, 5 s.
+    assert_eq!(h.start.den, 1);
+    let ph = pre.header().unwrap();
+    assert_eq!((ph.width, ph.height, ph.frame_rate(), ph.duration_seconds()), (1920, 1080, Some(25.0), Some(5.0)));
+    // C records that it uses the comp Pre (chunk idpi, a little-endian u32).
+    assert_eq!(c_item.used_item_ids(), [pre_item.id().unwrap()]);
+    assert!(pre_item.used_item_ids().is_empty());
+    assert_eq!(pre_item.label(), Some(15));
+    // The layer inside Pre is a new layer made from the solid L (moving the layers into a precomp
+    // creates new layers).
+    let inner: Vec<_> = pre.layers().collect();
+    assert_eq!(inner.len(), 1);
+    let ih = inner[0].header().unwrap();
+    assert_ne!(ih.id, L);
+    assert_eq!(ih.source_id, Some(0x1a));
+    assert_eq!(project.layer_display_name(&inner[0]).as_deref(), Some("L"));
+}
+
+#[test]
+fn a_negative_stretch_is_a_reversed_layer() {
+    // 981: Time Reverse (stretch -100 %, start 5 s): numerator -1 (`0xffffffff`), the stored in
+    // point 0 and out point 5 s relative, so the layer runs from 5 s back to 0 s; 983: -50 % = -1/2.
+    let h = skip!(l_header("981-layer-stretch-minus100-start5.aep"));
+    assert_eq!((h.stretch, h.stretch_den), (-1, 1));
+    assert_eq!(h.stretch_percent(), -100.0);
+    assert_eq!((h.in_point_seconds(), h.out_point_seconds()), (Some(5.0), Some(0.0)));
+    let h = skip!(l_header("983-layer-stretch-minus50-opacity-keys.aep"));
+    assert_eq!((h.stretch, h.stretch_den), (-1, 2));
+    assert_eq!((h.in_point_seconds(), h.out_point_seconds()), (Some(5.0), Some(2.5)));
+}
diff --git a/crates/aep/tests/it/container/helpers.rs b/crates/aep/tests/it/container/helpers.rs
new file mode 100644
index 000000000..d255692c0
--- /dev/null
+++ b/crates/aep/tests/it/container/helpers.rs
@@ -0,0 +1,413 @@
+//! Helpers shared by the container tests.
+#![allow(dead_code)]
+
+/// The generated fixtures (own test data, see ATTRIBUTION.md).
+pub const FIXTURES: &[&str] = &[
+    "000-base.aep",
+    "001-empty.aep",
+    "010-layer-name.aep",
+    "012-layer-shy.aep",
+    "013-layer-locked.aep",
+    "014-layer-solo.aep",
+    "015-layer-3d.aep",
+    "016-layer-blend-multiply.aep",
+    "017-layer-motionblur.aep",
+    "018-layer-stretch200.aep",
+    "019-layer-inpoint1.aep",
+    "021-layer-starttime0.5.aep",
+    "022-layer-parent-null.aep",
+    "023-layer-quality-draft.aep",
+    "024-layer-collapse.aep",
+    "025-layer-adjustment.aep",
+    "026-layer-guide.aep",
+    "030-comp-size-1280x720.aep",
+    "031-comp-fps30.aep",
+    "032-comp-duration10.aep",
+    "033-comp-bg-green.aep",
+    "034-comp-shutter90.aep",
+    "035-comp-workarea-1-2.aep",
+    "037-comp-pixelaspect2.aep",
+    "038-comp-motionblur.aep",
+    "039-comp-renderer-advanced3d.aep",
+    "040-static-position-100-200.aep",
+    "041-static-scale-50.aep",
+    "042-static-rotation-45.aep",
+    "043-static-opacity-25.aep",
+    "044-static-anchor-10-20.aep",
+    "052-key-position-2key-ease.aep",
+    "053-key-position-2key-hold-key1.aep",
+    "054-key-position-2key-spatial-bezier.aep",
+    "055-key-position-3key-inserted-t2.5.aep",
+    "056-key-position-3key-roving-key2.aep",
+    "057-key-position-3key-label9-key2.aep",
+    "058-key-opacity-2key.aep",
+    "060-expr-opacity-wiggle.aep",
+    "071-fx-slider-value77.aep",
+    "073-fx-color-0.2-0.6-1.aep",
+    "077-fx-dropdown-default.aep",
+    "080-fx-dropshadow-default.aep",
+    "090-mask-rect.aep",
+    "091-mask-rect-props.aep",
+    "093-mask-path-2keys.aep",
+    "110-text-A.aep",
+    "113-text-Hello-size60-fillorange.aep",
+    "122-marker-comp-1s.aep",
+    "123-marker-layer-1s.aep",
+    "124-precomp-Pre.aep",
+    "126-footage-png-layer.aep",
+    "202-key-out-hold-in-linear.aep",
+    "203-key-in-hold-out-linear.aep",
+    "204-key-ease-asymmetric.aep",
+    "205-key-opacity-ease-asymmetric.aep",
+    "206-key-scale-2key-linear.aep",
+    "208-key-mask-feather-2key-linear.aep",
+    "210-key-fill-color-2key-linear.aep",
+    "211-anchor-100x100-solid-10-20.aep",
+    "212-anchor-400x300-solid-100-50.aep",
+    "213-expr-opacity-wiggle-disabled.aep",
+    "214-fx-gaussianblur-default.aep",
+    "215-fx-fill-default.aep",
+    "216-fx-gaussianblur-40.aep",
+    "217-fx-checkbox-on.aep",
+    "218-fx-point-111-222.aep",
+    "219-fx-angle-90.aep",
+    "220-fx-layercontrol-to-layer1.aep",
+    "221-fx-slider-2key.aep",
+    "222-layer-video-off.aep",
+    "223-layer-audio-off.aep",
+    "224-layer-effects-off.aep",
+    "225-layer-blend-screen.aep",
+    "226-layer-blend-add.aep",
+    "227-layer-blend-overlay.aep",
+    "228-layer-blend-difference.aep",
+    "229-comp-fps-29.97.aep",
+    "230-comp-fps-23.976.aep",
+    "231-comp-bg-grey-0.5.aep",
+    "232-mask-ellipse.aep",
+    "233-mask-open-path.aep",
+    "234-mask-mode-intersect.aep",
+    "235-mask-mode-lighten.aep",
+    "236-mask-mode-darken.aep",
+    "237-mask-mode-difference.aep",
+    "238-shape-rect-rounded-corners.aep",
+    "239-shape-stroke-green-w8-round.aep",
+    "240-shape-custom-path-tangents.aep",
+    "241-shape-gradient-fill-linear.aep",
+    "242-shape-group-position-50-50.aep",
+    "243-text-multiline-A-CR-B.aep",
+    "245-text-box-400x200-Hello.aep",
+    "246-text-box-center-align.aep",
+    "247-text-tracking-100.aep",
+    "248-text-range-fill-red-1-3.aep",
+    "249-marker-layer-full.aep",
+    "251-camera-one-node.aep",
+    "252-light-point.aep",
+    "253-camera-position-100-200-m1000.aep",
+    "254-light-spot-intensity-50.aep",
+    "256-camera-two-node-default.aep",
+    "259-solid-blue-0-0-1.aep",
+    "299-save-noise.aep",
+    "300-fx-gaussianblur-0-explicit.aep",
+    "301-fx-gaussianblur-40-then-25.aep",
+    "302-fx-fill-opacity-100-explicit.aep",
+    "303-fx-fill-opacity-50-then-100.aep",
+    "304-fx-slider-0-explicit.aep",
+    "305-key-scale-bezier-ease.aep",
+    "306-key-maskfeather-bezier-ease.aep",
+    "307-key-fillcolor-bezier.aep",
+    "309-solid-100x100-mask-rect.aep",
+    "310-solid-100x100-pointcontrol.aep",
+    "311-position-default-explicit.aep",
+    "316-layer-stretch50.aep",
+    "317-layer-stretch150.aep",
+    "318-layer-inpoint-0.3333.aep",
+    "319-precomp-timeremap.aep",
+    "320-fx-layercontrol-self-explicit.aep",
+    "321-fx-layercontrol-none.aep",
+    "323-fx-dropdown-5items.aep",
+    "324-fx-dropdown-5items-select3.aep",
+    "325-comp-pixelaspect-0.9091.aep",
+    "326-comp-shutterphase-m90.aep",
+    "327-comp-displaystartframe-100.aep",
+    "328-mask-two-ellipse-rect.aep",
+    "329-mask-ellipse-mode-none.aep",
+    "330-shape-polystar-star-5-50-100.aep",
+    "331-shape-polystar-polygon-5-100.aep",
+    "332-shape-gradient-fill-radial.aep",
+    "333-shape-group-two-rects.aep",
+    "334-text-box-right-align.aep",
+    "335-text-point-fauxbold.aep",
+    "336-text-point-fauxitalic.aep",
+    "337-text-point-allcaps.aep",
+    "338-text-point-smallcaps.aep",
+    "339-text-point-leading60.aep",
+    "340-text-range-two-styles.aep",
+    "341-camera-zoom-2000.aep",
+    "342-camera-dof-800-30.aep",
+    "343-light-spot-color-red.aep",
+    "344-light-spot-coneangle-60.aep",
+    "345-light-spot-conefeather-30.aep",
+    "347-marker-layer-label3.aep",
+    "348-marker-layer-navigation-cue.aep",
+    "349-marker-layer-event-cue-params.aep",
+    "350-footage-wav-imported.aep",
+    "351-footage-wav-as-layer.aep",
+    "352-footage-pngseq-imported.aep",
+    "354-footage-pngseq-timeremap.aep",
+    "356-fx-tint-default.aep",
+    "357-fx-tint-black-0.2-0.4-0.6.aep",
+    "361-fx-tint-amount-0.aep",
+    "363-fx-tint-amount-2key.aep",
+    "364-fx-tint-white-2key.aep",
+    "366-fx-blur-then-tint.aep",
+    "368-fx-ramp-default.aep",
+    "369-fx-ramp-start-100-200.aep",
+    "371-fx-ramp-startcolor-red.aep",
+    "374-fx-ramp-end-2000-m100.aep",
+    "377-fx-ramp-shape-radial.aep",
+    "378-fx-ramp-scatter-12.aep",
+    "380-fx-ramp-blend-25pct.aep",
+    "382-fx-ramp-start-2key.aep",
+    "383-fx-ramp-on-100x100-start-10-20.aep",
+    "389-fx-exposure-default.aep",
+    "390-fx-exposure-channels-individual.aep",
+    "391-fx-exposure-master-1.5.aep",
+    "393-fx-exposure-offset-0.1.aep",
+    "394-fx-exposure-gamma-2.2.aep",
+    "395-fx-exposure-individual-red-1.aep",
+    "396-fx-exposure-bypass-on.aep",
+    "397-fx-exposure-master-2key.aep",
+    "403-matte-L-alpha-M.aep",
+    "404-matte-L-alphainv-M.aep",
+    "405-matte-L-luma-M.aep",
+    "406-matte-L-lumainv-M.aep",
+    "407-matte-M-alpha-L-below.aep",
+    "408-matte-L-alpha-M-visible.aep",
+    "509-marker-comp-two.aep",
+    "510-marker-layer-0.52-dur0.3.aep",
+    "451-shape-ellipse-400x300-fill.aep",
+    "457-shape-group-scale-50-80.aep",
+    "462-shape-layer-anchor-10-20.aep",
+    "464-shape-stroke-opacity-50.aep",
+    "467-shape-trim-end-70.aep",
+    "469-shape-trim-type-2.aep",
+    "471-shape-rect-roundness-30.aep",
+    "473-shape-star-points-6.aep",
+    "482-shape-two-groups.aep",
+    "483-shape-nested-group-rect.aep",
+    "519-shape-all-items-default.aep",
+    "410-fx-invert-channel-2.aep",
+    "411-fx-invert-blend-50.aep",
+    "413-fx-fastbox-radius-20.aep",
+    "414-fx-fastbox-iterations-1.aep",
+    "416-fx-fastbox-repeatedge-off.aep",
+    "418-fx-gaussian-dimensions-3.aep",
+    "419-fx-gaussian-repeatedge-off.aep",
+    "422-fx-dropshadow-opacity-204.aep",
+    "426-fx-dropshadow-shadowonly-on.aep",
+    "427-fx-glow-default.aep",
+    "429-fx-glow-threshold-76.5.aep",
+    "438-fx-glow-midpoint-0.25.aep",
+    "444-fx-huesat-hue-90.aep",
+    "446-fx-huesat-light-m30.aep",
+    "448-fx-huesat-colorizehue-120.aep",
+    "512-fx-levels-inblack-0.1.aep",
+    "514-fx-levels-gamma-2.aep",
+    "516-fx-levels-outwhite-0.9.aep",
+    "517-text-box-600x400-wrap.aep",
+    "526-text-point-HHHH-default.aep",
+    "527-text-point-HHHH-baseline-normal.aep",
+    "528-text-point-HHHH-baseline-subscript.aep",
+    "485-layer-3d-on.aep",
+    "486-layer-3d-rotx-30.aep",
+    "487-layer-3d-roty-45.aep",
+    "488-layer-3d-orientation-10-20-30.aep",
+    "529-fx-timewarp-default.aep",
+    "530-fx-timewarp-speed-25.aep",
+    "531-fx-timewarp-speed-keyed-50-200.aep",
+    "532-fx-timewarp-method-1.aep",
+    "533-fx-timewarp-sourceframe-12.aep",
+    "534-fx-slider-expression-time10.aep",
+    "535-camera-position-on-3d-rotx.aep",
+    "536-camera-one-node-position-on-3d-rotx.aep",
+    "537-camera-default-on-3d-rotx.aep",
+    "538-text-point-HHHH-normal-ref.aep",
+    "539-text-hscale-0.9.aep",
+    "540-text-vscale-1.5.aep",
+    "541-text-baselineshift-41.aep",
+    "542-text-autokern-none.aep",
+    "543-text-autokern-optical.aep",
+    "544-text-applystroke-on.aep",
+    "545-text-strokewidth-5.aep",
+    "546-text-applyfill-off.aep",
+    "548-text-linejoin-round.aep",
+    "550-text-strokeoverfill-off.aep",
+    "552-text-nobreak-on.aep",
+    "553-text-tsume-0.5.aep",
+    "554-text-kerning-50.aep",
+    "555-text-ligature-on.aep",
+    "556-text-autohyphenate-off.aep",
+    "558-text-hangingroman-on.aep",
+    "559-text-everyline-on.aep",
+    "560-text-firstlineindent-20.aep",
+    "561-text-startindent-30.aep",
+    "562-text-endindent-40.aep",
+    "563-text-spacebefore-10.aep",
+    "564-text-spaceafter-12.aep",
+    "565-text-justify-fullleft.aep",
+    "566-text-justify-fullcenter.aep",
+    "567-text-justify-fullright.aep",
+    "568-text-justify-fullall.aep",
+    "569-text-direction-rtl.aep",
+    "571-text-digitset-arabic.aep",
+    "572-text-leadingtype-japanese.aep",
+    "573-text-baselinedir-rotated.aep",
+    "575-text-vertical-rtl.aep",
+    "576-text-baselinedir-crossstream.aep",
+    "578-text-digitset-hindi.aep",
+    "595-text-stroke-scale-shift-combined.aep",
+    "596-text-combined-fill-over-stroke.aep",
+    "579-textanim-position-0-m50.aep",
+    "580-textanim-start-25.aep",
+    "581-textanim-end-75.aep",
+    "582-textanim-offset-10.aep",
+    "583-textanim-units-index.aep",
+    "584-textanim-basedon-3-words.aep",
+    "585-textanim-mode-2-subtract.aep",
+    "586-textanim-amount-50.aep",
+    "587-textanim-shape-2-rampup.aep",
+    "588-textanim-smoothness-50.aep",
+    "589-textanim-easehigh-30.aep",
+    "590-textanim-easelow-40.aep",
+    "591-textanim-randomize-seed-7.aep",
+    "592-textanim-many-props.aep",
+    "593-textanim-start-keyed-ease-0-100.aep",
+    "594-textanim-position-start-keyed-ease.aep",
+    "725-text-point-HHHH-normal-ref-S18.aep",
+    "727-text-reset-paragraph.aep",
+    "728-textanim-character-offset-3.aep",
+    "711-fx-directional-blur-30-40-on-M.aep",
+    "712-fx-eleven-effects-defaults-on-M.aep",
+    "713-fx-radial-blur-zoom-20-on-M.aep",
+    "714-fx-ccradial-type2-30-60-on-M.aep",
+    "715-fx-venetian-40-30-50-5-on-M.aep",
+    "716-fx-channel-blur-5-10-15-20-edge-horiz-on-M.aep",
+    "717-fx-blackwhite-set-tint-on-L.aep",
+    "718-fx-tritone-set-blend25-on-L.aep",
+    "719-fx-lumakey-darker-140-20-1-2.5-on-M.aep",
+    "720-fx-simplechoker-3.5-on-M.aep",
+    "721-fx-simplechoker-3.5-view-matte-on-M.aep",
+    "722-fx-mattechoker-set-on-M.aep",
+    "723-fx-transform-set-on-M.aep",
+    "597-key-anchor-ease-out50-40-in30-60.aep",
+    "598-key-ramp-point-ease-color-bezier.aep",
+    "599-key-mask-path-ease-infl75.aep",
+    "700-key-mask-path-ease-out20-in50.aep",
+    "701-light-parallel-int80-color.aep",
+    "702-light-ambient-int50-color.aep",
+    "703-key-orientation-0-to-10-20-30-linear.aep",
+    "704-light-environment-default.aep",
+    "705-mask-on-text-rect-40-m70-160-10.aep",
+    "706-mask-on-shape-rect-0-m150-100-150.aep",
+    "707-shape-merge-subtract-rect-ellipse.aep",
+    "708-shape-merge-intersect-rect-ellipse.aep",
+    "709-shape-repeater-3-pos150-60-rot10-scale90-80-op40.aep",
+    "710-shape-offset-paths-20-round.aep",
+    "730-key-anchor-ease-on-400x800-solid.aep",
+    "731-shape-merge-offset-repeater-defaults.aep",
+    "732-text-box-byteedit-para24-0.aep",
+    "733-text-box-byteedit-para35-0.aep",
+    "734-text-box-byteedit-style68-1.aep",
+    "828-shape-offset-paths-20-copies3-copyoffset1.5-stroke.aep",
+    "851-shape-key-trim-end-0-100-linear.aep",
+    "852-shape-key-trim-end-bezier-out0-60-in20-30.aep",
+    "853-shape-key-group-position-0-200-100-linear.aep",
+    "854-shape-key-fill-color-red-blue-linear.aep",
+    "855-shape-key-trim-offset-0-90-hold.aep",
+    "856-shape-trim-end-expression-time50.aep",
+    "857-shape-key-group-scale-100-50-150-linear.aep",
+    "900-mask-added-no-path.aep",
+    "901-mask-no-path-expansion-m100.aep",
+    "902-settings-rec709-16bpc-steps-png-grey-solid.aep",
+    "905-fx-24-effects-set-one-comp.aep",
+    "906-blendmodes-13-solids-on-steps.aep",
+    "963-curves-red-mid-down-on-S.aep",
+    "964-curves-rgb-s-curve-on-S.aep",
+    "951-styles-all-nine-defaults-on-B.aep",
+    "966-style-drop-shadow-opacity50-distance20.aep",
+    "970-style-stroke-size10-color-green.aep",
+    "974-style-gradient-overlay-angle45-scale150.aep",
+    "975-style-fill-opacity0-with-drop-shadow.aep",
+    "976-style-drop-shadow-opacity-keyed-100-20-linear.aep",
+    "977-styles-all-params-changed.aep",
+    "979-style-inner-glow-source-2.aep",
+    "981-layer-stretch-minus100-start5.aep",
+    "982-layer-stretch-minus100-opacity-keys.aep",
+    "983-layer-stretch-minus50-opacity-keys.aep",
+    "985-meshwarp-3x3-vertex-moved-on-S.aep",
+    "986-shape-fill-switched-off-green.aep",
+    "988-style-drop-shadow-switched-off.aep",
+];
+
+use effectcraft_aep::{AepFile, Comp, Layer, LayerType, Project, parse};
+
+/// Parses a fixture; the bytes must outlive the file, so the caller keeps them.
+pub fn open(bytes: &[u8]) -> AepFile<'_> {
+    parse(bytes).expect("fixture parses")
+}
+
+/// The first composition of a project (comp `C` in the corpus; in 124 the precomp `Pre` comes later).
+pub fn first_comp<'f, 'a>(project: &Project<'f, 'a>) -> Comp<'f, 'a> {
+    project.all_items().into_iter().find_map(|i| i.comp()).expect("a composition")
+}
+
+/// The solid `L` of the base composition: the bottom layer (the first one made; id 0x1b in the
+/// single-case files, another id in each case of a combined file).
+pub fn base_layer<'f, 'a>(comp: &Comp<'f, 'a>) -> Layer<'f, 'a> {
+    comp.layers().last().expect("a layer")
+}
+
+/// The layer with this id in a composition.
+pub fn layer_with_id<'f, 'a>(comp: &Comp<'f, 'a>, id: u32) -> Layer<'f, 'a> {
+    comp.layers().find(|l| l.id() == Some(id)).unwrap_or_else(|| panic!("no layer with id {id:#x}"))
+}
+
+/// The layer with this user-set name in a composition.
+pub fn layer_named<'f, 'a>(comp: &Comp<'f, 'a>, name: &str) -> Layer<'f, 'a> {
+    comp.layers().find(|l| l.name().as_deref() == Some(name)).unwrap_or_else(|| panic!("no layer named {name}"))
+}
+
+/// The layer that shows this name: its own name, or its source's while it has none.
+pub fn layer_shown_as<'f, 'a>(project: &Project<'f, 'a>, comp: &Comp<'f, 'a>, name: &str) -> Layer<'f, 'a> {
+    comp.layers().find(|l| project.layer_display_name(l).as_deref() == Some(name)).unwrap_or_else(|| panic!("no layer shown as {name}"))
+}
+
+/// The first layer of this type in a composition.
+pub fn layer_of_type<'f, 'a>(comp: &Comp<'f, 'a>, layer_type: LayerType) -> Layer<'f, 'a> {
+    comp.layers().find(|l| l.header().is_some_and(|h| h.layer_type == layer_type)).unwrap_or_else(|| panic!("no {layer_type:?} layer"))
+}
+
+/// A copy of a layer's `LIST Layr` with its id (`ldta` bytes 0-3) set to 0, for comparing the
+/// same layer in two cases of a combined file.
+pub fn without_layer_id(layer: &effectcraft_aep::Chunk<'_>) -> effectcraft_aep::Chunk<'static> {
+    let mut c = layer.clone().into_owned();
+    if let effectcraft_aep::Body::List { children, .. } = &mut c.body
+        && let Some(ldta) = children.iter_mut().find(|x| x.is(b"ldta"))
+        && let effectcraft_aep::Body::Data(d) = &mut ldta.body
+    {
+        d.to_mut()[..4].fill(0);
+    }
+    c
+}
+
+/// Compares floats with a tolerance.
+pub fn near(a: f64, b: f64, tol: f64) -> bool {
+    (a - b).abs() <= tol
+}
+
+pub fn assert_near(got: &[f64], want: &[f64], tol: f64) {
+    assert_eq!(got.len(), want.len(), "{got:?} vs {want:?}");
+    for (g, w) in got.iter().zip(want) {
+        assert!(near(*g, *w, tol), "{got:?} != {want:?}");
+    }
+}
diff --git a/crates/aep/tests/it/container/keyframes.rs b/crates/aep/tests/it/container/keyframes.rs
new file mode 100644
index 000000000..611c7027e
--- /dev/null
+++ b/crates/aep/tests/it/container/keyframes.rs
@@ -0,0 +1,230 @@
+//! Keyframe interpolation sides and ease, the record layouts per template, the anchor point
+//! normalisation and the disabled-expression flag, checked against the values the corpus was made
+//! with (its MANIFEST, batch 2). The solid `L` is 1920x1080 in a 1920x1080 composition.
+
+use crate::container::helpers::{assert_near, base_layer, first_comp, layer_shown_as, open};
+use effectcraft_aep::{Interpolation, KeyEase, KeyframeKind, Project, PropNode, Property, ValueSource};
+
+fn prop_of<R>(name: &str, path: &[&str], f: impl FnOnce(Property<'_, '_>) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let Some(PropNode::Property(p)) = layer.properties().unwrap().find(path) else { panic!("{name}: no {path:?}") };
+        f(p)
+    })
+}
+
+const POSITION: &[&str] = &["ADBE Transform Group", "ADBE Position"];
+const OPACITY: &[&str] = &["ADBE Transform Group", "ADBE Opacity"];
+
+fn ease(in_speed: f64, in_influence: f64, out_speed: f64, out_influence: f64) -> KeyEase {
+    KeyEase { in_speed, in_influence, out_speed, out_influence }
+}
+
+#[test]
+fn in_and_out_interpolation_are_separate_bytes() {
+    // 202: Position keys at 0 s [0,0,0] and 1 s [100,0,0]; key 1 inType LINEAR, outType HOLD (record bytes 01 03).
+    skip!(prop_of("202-key-out-hold-in-linear.aep", POSITION, |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert_eq!(&keys[0].raw()[4..6], [1, 3]);
+        assert_eq!((keys[0].interpolation_in(), keys[0].interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Hold)));
+        assert_eq!((keys[1].interpolation_in(), keys[1].interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Linear)));
+        assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 1.0]);
+        assert_eq!(keys[1].spatial_value(), Some([100.0, 0.0, 0.0]));
+    }));
+    // 203: key 1 inType HOLD, outType LINEAR (bytes 03 01): byte 4 is the incoming side.
+    skip!(prop_of("203-key-in-hold-out-linear.aep", POSITION, |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(&keys[0].raw()[4..6], [3, 1]);
+        assert_eq!((keys[0].interpolation_in(), keys[0].interpolation_out()), (Some(Interpolation::Hold), Some(Interpolation::Linear)));
+        assert_eq!((keys[1].interpolation_in(), keys[1].interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Linear)));
+    }));
+}
+
+#[test]
+fn position_ease_slots_in_speed_influence_out_speed_influence() {
+    // 204: key 1 inSpeed 5 / inInfluence 20, outSpeed 50 / outInfluence 80; key 2 in 7 / 60, out 9 / 40.
+    // After Effects reads key 1's in speed and key 2's out speed back as 0; the file keeps 5 and 9.
+    skip!(prop_of("204-key-ease-asymmetric.aep", POSITION, |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(keys[0].ease(), Some(ease(5.0, 0.2, 50.0, 0.8)));
+        assert_eq!(keys[1].ease(), Some(ease(7.0, 0.6, 9.0, 0.4)));
+        for k in &keys {
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Bezier), Some(Interpolation::Bezier)));
+            assert_eq!(k.kind(), KeyframeKind::Spatial { components: 3 });
+        }
+        // The spatial record gives the same four slots.
+        assert_eq!(keys[0].spatial().unwrap().ease, [5.0, 0.2, 50.0, 0.8]);
+        // The arc length of the segment to the next key (100 px) is on key 1, none on the last key.
+        assert_eq!(keys.iter().map(|k| k.spatial().unwrap().segment_length).collect::<Vec<_>>(), [100.0, 0.0]);
+    }));
+}
+
+#[test]
+fn opacity_ease_speed_is_in_stored_units_per_second() {
+    // 205: Opacity 0 at 0 s, 100 at 2 s; key 1 in 5 / 20 %, out 20 / 80 %; key 2 in 30 / 60 %, out 9 / 40 %.
+    // The speed is in stored value units (fractions), 100 times smaller than the UI value; the influence is a fraction.
+    skip!(prop_of("205-key-opacity-ease-asymmetric.aep", OPACITY, |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert!(keys.iter().all(|k| k.kind() == KeyframeKind::Plain { components: 1 } && k.raw().len() == 48));
+        assert_eq!(keys.iter().map(|k| k.scalar_value().unwrap()).collect::<Vec<_>>(), [0.0, 1.0]);
+        assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 2.0]);
+        let e0 = keys[0].ease().unwrap();
+        assert_near(&[e0.in_speed, e0.in_influence, e0.out_speed, e0.out_influence], &[0.05, 0.2, 0.2, 0.8], 1e-12);
+        let e1 = keys[1].ease().unwrap();
+        assert_near(&[e1.in_speed, e1.in_influence, e1.out_speed, e1.out_influence], &[0.3, 0.6, 0.09, 0.4], 1e-12);
+        assert_eq!(keys[0].plain_ease_slots().unwrap().len(), 4);
+        for k in &keys {
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Bezier), Some(Interpolation::Bezier)));
+        }
+    }));
+}
+
+#[test]
+fn scale_keys_use_the_plain_template_with_three_components() {
+    // 206: Scale keys at 0 s [100,100,100] and 1 s [200,150,100], linear: 128-byte plain records.
+    skip!(prop_of("206-key-scale-2key-linear.aep", &["ADBE Transform Group", "ADBE Scale"], |p| {
+        assert_eq!(p.dims(), Some(3));
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        for k in &keys {
+            assert_eq!(k.raw().len(), 128);
+            // A 128-byte record is not always spatial: the header's template flag decides.
+            assert_eq!(k.kind(), KeyframeKind::Plain { components: 3 });
+            assert_eq!(k.spatial(), None);
+            assert_eq!(k.plain_ease_slots(), Some(vec![0.0; 12]));
+            assert_eq!(k.ease(), None);
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Linear)));
+        }
+        assert_eq!(keys.iter().map(|k| k.value().unwrap()).collect::<Vec<_>>(), [vec![1.0, 1.0, 1.0], vec![2.0, 1.5, 1.0]]);
+        assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 1.0]);
+        assert_eq!(p.first_key_value(), Some(vec![1.0, 1.0, 1.0]));
+    }));
+    // The transform reports the first key as percent (before the template flag was used it read the wrong bytes).
+    let bytes = fixture!("206-key-scale-2key-linear.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let t = layer.transform(1920, 1080).unwrap();
+    assert_eq!((t.scale_percent.source, t.scale_percent.value), (ValueSource::Keyframed, [100.0, 100.0, 100.0]));
+}
+
+#[test]
+fn two_dimensional_mask_feather_keys() {
+    // 208: Mask Feather keys at 0 s [0,0] and 1 s [40,20], linear: 88-byte plain records with two components.
+    let bytes = fixture!("208-key-mask-feather-2key-linear.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let Some(PropNode::Group(parade)) = layer.properties().unwrap().get("ADBE Mask Parade") else { panic!("no mask parade") };
+    let Some(PropNode::Group(atom)) = parade.get("ADBE Mask Atom") else { panic!("no mask atom") };
+    let Some(PropNode::Property(feather)) = atom.get("ADBE Mask Feather") else { panic!("no feather") };
+    let keys: Vec<_> = feather.keys().unwrap().keyframes().collect();
+    assert!(keys.iter().all(|k| k.raw().len() == 88 && k.kind() == KeyframeKind::Plain { components: 2 }));
+    assert_eq!(keys.iter().map(|k| k.value().unwrap()).collect::<Vec<_>>(), [vec![0.0, 0.0], vec![40.0, 20.0]]);
+    assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 1.0]);
+    assert_eq!(keys[0].plain_ease_slots(), Some(vec![0.0; 8]));
+    let mask = &layer.masks()[0];
+    assert!(mask.feather.source == ValueSource::Keyframed && mask.feather.value == [0.0, 0.0]);
+}
+
+#[test]
+fn colour_keys_use_the_spatial_template_with_four_components() {
+    // 210: Fill colour keys at 0 s [1,0,0] and 1 s [0,0.5,1], linear: 152-byte records, ARGB doubles 0..255 at byte 56.
+    let bytes = fixture!("210-key-fill-color-2key-linear.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let effects = layer.effects();
+    assert_eq!(effects.len(), 1);
+    let params = effects[0].params();
+    let color = params.iter().find(|p| p.name == "Color").unwrap();
+    let keys: Vec<_> = color.stored().unwrap().keys().unwrap().keyframes().collect();
+    assert_eq!(keys.len(), 2);
+    for k in &keys {
+        assert_eq!(k.raw().len(), 152);
+        assert_eq!(k.kind(), KeyframeKind::Spatial { components: 4 });
+        assert_eq!(k.flags(), Some(0x0001));
+        let s = k.spatial().unwrap();
+        assert_eq!(s.in_tangent, [0.0; 4]);
+        assert_eq!(s.out_tangent, [0.0; 4]);
+    }
+    assert_eq!(keys[0].value(), Some(vec![255.0, 255.0, 0.0, 0.0]));
+    assert_eq!(keys[1].value(), Some(vec![255.0, 0.0, 127.5, 255.0]));
+    assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 1.0]);
+    // A keyframed parameter has no single stored value.
+    assert_eq!(color.stored_value(), None);
+}
+
+#[test]
+fn keyed_slider_uses_48_byte_records() {
+    // 221: Slider Control, Slider keyed 10 at 0 s and 90 at 2 s (linear).
+    let bytes = fixture!("221-fx-slider-2key.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let params = project.effect_params(&layer.effects()[0]);
+    let slider = params.iter().find(|p| p.name == "Slider").unwrap();
+    let stored = slider.stored().unwrap();
+    assert!(stored.is_animated());
+    assert_eq!(stored.static_value(), None);
+    let keys: Vec<_> = stored.keys().unwrap().keyframes().collect();
+    assert!(keys.iter().all(|k| k.raw().len() == 48));
+    assert_eq!(keys.iter().filter_map(|k| k.scalar_value()).collect::<Vec<_>>(), [10.0, 90.0]);
+    assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 2.0]);
+}
+
+#[test]
+fn anchor_is_a_fraction_of_the_layer_source_size() {
+    // 211: a new 100x100 solid in the 1920x1080 composition, Anchor Point [50,50,0] -> [10,20,0], stored [0.1, 0.2, 0].
+    // 212: a 400x300 solid, Anchor Point [100,50,0], stored [0.25, 1/6, 0]. The composition size is not the divisor.
+    for (name, solid, size, fraction, px) in [
+        ("211-anchor-100x100-solid-10-20.aep", "S100", (100, 100), [0.1, 0.2, 0.0], [10.0, 20.0, 0.0]),
+        ("212-anchor-400x300-solid-100-50.aep", "S400", (400, 300), [0.25, 1.0 / 6.0, 0.0], [100.0, 50.0, 0.0]),
+    ] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let layer = layer_shown_as(&project, &comp, solid);
+        assert_eq!(project.layer_source_size(&layer), Some(size), "{name}");
+        let t = layer.transform(1920, 1080).unwrap();
+        assert_eq!(t.anchor_fraction.source, ValueSource::Stored);
+        assert_near(&t.anchor_fraction.value, &fraction, 1e-12);
+        let anchor = project.layer_anchor_px(&layer).unwrap();
+        assert_eq!(anchor.source, ValueSource::Stored);
+        assert_near(&anchor.value, &px, 1e-9);
+        // Position stays at the default, the composition centre.
+        assert_eq!((t.position.source, t.position.value), (ValueSource::Default, [960.0, 540.0, 0.0]));
+        // L is unchanged: the anchor is its centre.
+        let l = base_layer(&comp);
+        let a = project.layer_anchor_px(&l).unwrap();
+        assert_eq!((a.source, a.value), (ValueSource::Default, [960.0, 540.0, 0.0]));
+    }
+}
+
+fn expression_state(name: &str) -> Option<(Option<String>, Option<bool>, bool, bool)> {
+    Some({
+        prop_of(name, OPACITY, |p| {
+            let f = p.expression_flags().unwrap();
+            // Byte 120 marks the expression (bytes 76 and 77 are not always set with it).
+            (p.expression(), p.expression_enabled(), f.byte_120 == 1, f.disabled())
+        })?
+    })
+}
+
+#[test]
+fn disabled_expression_keeps_its_text() {
+    // 060: Opacity wiggle(1,10), enabled; 213: the same expression after expression.disable_all.
+    assert_eq!(skip!(expression_state("060-expr-opacity-wiggle.aep")), (Some("wiggle(1,10)".to_string()), Some(true), true, false));
+    assert_eq!(skip!(expression_state("213-expr-opacity-wiggle-disabled.aep")), (Some("wiggle(1,10)".to_string()), Some(false), true, true));
+    // Only byte 119 differs between the two property headers.
+    let header = |name: &str| prop_of(name, OPACITY, |p| p.header().unwrap().to_vec());
+    let (enabled, disabled) = (skip!(header("060-expr-opacity-wiggle.aep")), skip!(header("213-expr-opacity-wiggle-disabled.aep")));
+    let differing: Vec<_> = (0..enabled.len()).filter(|i| enabled[*i] != disabled[*i]).collect();
+    assert_eq!(differing, [119]);
+    // A property without an expression has no enabled state.
+    assert_eq!(skip!(prop_of("058-key-opacity-2key.aep", OPACITY, |p| p.expression_enabled())), None);
+}
diff --git a/crates/aep/tests/it/container/layer_switches.rs b/crates/aep/tests/it/container/layer_switches.rs
new file mode 100644
index 000000000..292863a9e
--- /dev/null
+++ b/crates/aep/tests/it/container/layer_switches.rs
@@ -0,0 +1,225 @@
+//! Layer switches, blend modes, composition frame rates and background, cameras, lights and solid
+//! colours, checked against the values the corpus was made with (its MANIFEST, batch 2).
+
+use crate::container::helpers::{assert_near, base_layer, first_comp, layer_of_type, layer_shown_as, open};
+use effectcraft_aep::{BlendMode, CompHeader, LayerHeader, LayerType, LightType, Project, Rational, ValueSource};
+
+fn l_header(name: &str) -> Option<LayerHeader> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        base_layer(&first_comp(&project)).header().unwrap()
+    })
+}
+
+fn comp_header(name: &str) -> Option<CompHeader> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        first_comp(&project).header().unwrap()
+    })
+}
+
+#[test]
+fn video_audio_and_effects_switches_are_bits_1_2_and_4_of_byte_39() {
+    // The base has all three on (byte 39 = 07); 222 turns the video switch off (06), 223 the audio switch
+    // (05), 224 the effects switch (03). Each case changes only that byte.
+    for (name, byte, video, audio, effects) in [
+        ("000-base.aep", 0x07, true, true, true),
+        ("222-layer-video-off.aep", 0x06, false, true, true),
+        ("223-layer-audio-off.aep", 0x05, true, false, true),
+        ("224-layer-effects-off.aep", 0x03, true, true, false),
+    ] {
+        let h = skip!(l_header(name));
+        assert_eq!(h.flag_bytes[2], byte, "{name}");
+        assert_eq!((h.is_video_enabled(), h.is_audio_enabled(), h.is_effects_enabled()), (video, audio, effects), "{name}");
+        assert_eq!(h.is_enabled(), video, "{name}");
+        // The other switches stay as in the base.
+        assert!(!h.is_shy() && !h.is_locked() && !h.is_motion_blur() && !h.collapses_transformations(), "{name}");
+    }
+    let bytes = fixture!("222-layer-video-off.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    assert_eq!((layer.is_enabled(), layer.is_audio_enabled(), layer.is_effects_enabled()), (Some(false), Some(true), Some(true)));
+    // Only byte 39 of ldta differs from the base layer (besides the layer id, bytes 0-3: the two
+    // are layers of one combined file).
+    let base_bytes = fixture!("000-base.aep");
+    let base_file = open(&base_bytes);
+    let base_project = Project::new(&base_file).unwrap();
+    let base_ldta = base_layer(&first_comp(&base_project)).chunk().child(b"ldta").unwrap().bytes().unwrap().to_vec();
+    let ldta = layer.chunk().child(b"ldta").unwrap().bytes().unwrap();
+    let differing: Vec<_> = (4..ldta.len()).filter(|i| ldta[*i] != base_ldta[*i]).collect();
+    assert_eq!(differing, [39]);
+}
+
+#[test]
+fn blend_mode_codes() {
+    // Normal 2 (base), Multiply 5 (016), Screen 6 (225), Add 4 (226), Overlay 7 (227), Difference 26 (228).
+    for (name, mode, code) in [
+        ("000-base.aep", BlendMode::Normal, 2),
+        ("016-layer-blend-multiply.aep", BlendMode::Multiply, 5),
+        ("225-layer-blend-screen.aep", BlendMode::Screen, 6),
+        ("226-layer-blend-add.aep", BlendMode::Add, 4),
+        ("227-layer-blend-overlay.aep", BlendMode::Overlay, 7),
+        ("228-layer-blend-difference.aep", BlendMode::Difference, 26),
+    ] {
+        let h = skip!(l_header(name));
+        assert_eq!((h.blend_mode, h.blend_mode.code()), (mode, code), "{name}");
+        assert_eq!(BlendMode::from_code(code), mode);
+    }
+    // A mode that was not sampled keeps its raw code.
+    assert_eq!(BlendMode::from_code(30), BlendMode::Other(30));
+    assert_eq!(BlendMode::Other(30).code(), 30);
+}
+
+#[test]
+fn ntsc_frame_rates_are_exact_fractions() {
+    // 229: frameRate 29.97 -> read back 29.9700012207031; the duration snaps from 5 s to 150 frames (5.005005 s).
+    let h = skip!(comp_header("229-comp-fps-29.97.aep"));
+    assert_eq!((h.time_base.frame_duration, h.time_base.timescale), (800, 23976));
+    assert_eq!(h.frame_rate_exact(), Some(Rational { num: 2997, den: 100 }));
+    assert!((h.frame_rate().unwrap() - 29.97).abs() < 1e-12);
+    assert!((h.frame_rate_from_fixed() - 29.970_001_220_703_1).abs() < 1e-7);
+    assert_eq!((h.duration_units, h.duration_frames()), (120_000, Some(150)));
+    assert!((h.duration_seconds().unwrap() - 5.005_005_005_005_01).abs() < 1e-9);
+    // 230: frameRate 23.976 -> read back 23.9759979248047; 120 frames.
+    let h = skip!(comp_header("230-comp-fps-23.976.aep"));
+    assert_eq!((h.time_base.frame_duration, h.time_base.timescale), (1000, 23976));
+    assert_eq!(h.frame_rate_exact(), Some(Rational { num: 2997, den: 125 }));
+    assert!((h.frame_rate().unwrap() - 23.976).abs() < 1e-12);
+    assert!((h.frame_rate_from_fixed() - 23.975_997_924_804_7).abs() < 1e-7);
+    assert_eq!((h.duration_units, h.duration_frames()), (120_000, Some(120)));
+    assert!((h.duration_seconds().unwrap() - 5.005_005_005_005_01).abs() < 1e-9);
+    // 25 fps stays 25.
+    let h = skip!(comp_header("000-base.aep"));
+    assert_eq!((h.frame_rate_exact(), h.duration_frames()), (Some(Rational { num: 25, den: 1 }), Some(125)));
+}
+
+#[test]
+fn keyframe_times_follow_the_ntsc_timescale() {
+    // All keyframe time scales in the composition follow its timescale (tdb4 byte 12 = 23976 in every property).
+    for name in ["229-comp-fps-29.97.aep", "230-comp-fps-23.976.aep"] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let mut scales = std::collections::BTreeSet::new();
+        let mut stack = vec![layer.properties().unwrap()];
+        while let Some(group) = stack.pop() {
+            for e in group.entries() {
+                match e.node {
+                    effectcraft_aep::PropNode::Group(g) => stack.push(g),
+                    effectcraft_aep::PropNode::Property(p) => {
+                        scales.extend(p.time_scale());
+                    }
+                    effectcraft_aep::PropNode::Other(_) => {}
+                }
+            }
+        }
+        assert_eq!(scales.into_iter().collect::<Vec<_>>(), [23976], "{name}");
+    }
+}
+
+#[test]
+fn background_is_8_bits_per_channel() {
+    // 231: bgColor [0.5, 0.5, 0.5] is stored as 128 and reads back as 128/255 = 0.50196.
+    let h = skip!(comp_header("231-comp-bg-grey-0.5.aep"));
+    assert_eq!(h.background, [128, 128, 128]);
+    assert_near(&h.background_rgb(), &[0.501_960_784_313_73; 3], 1e-12);
+    // The frame rate stays 25 even though an earlier edit of the AE session left other numbers in the cache-like fields.
+    assert_eq!((h.time_base.frame_duration, h.time_base.timescale), (1024, 25600));
+}
+
+#[test]
+fn cameras_auto_orient_and_position() {
+    // 256: the default two-node camera (ldta byte 38 = 0x44); 251: one-node (autoOrient off, 0x04).
+    let bytes = fixture!("256-camera-two-node-default.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let camera = layer_of_type(&comp, LayerType::Camera);
+    let h = camera.header().unwrap();
+    assert_eq!((h.flag_bytes[1], h.is_auto_oriented(), h.is_three_d(), h.source_id, h.light_type()), (0x44, true, true, None, None));
+    // The default Position is an "auto state" record that stores [0, 0, -2666.67]; the two-node camera reports the comp centre.
+    let pos = camera.camera_position().unwrap();
+    assert!(pos.auto_state);
+    assert_near(&pos.stored, &[0.0, 0.0, -2666.67], 0.01);
+    assert_near(&pos.reported(1920, 1080, true), &[960.0, 540.0, -2666.67], 0.01);
+    assert_eq!(camera.camera_point_of_interest(), Some([960.0, 540.0, 0.0]));
+
+    let bytes = fixture!("251-camera-one-node.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let camera = layer_of_type(&first_comp(&project), LayerType::Camera);
+    let h = camera.header().unwrap();
+    assert_eq!((h.flag_bytes[1], h.is_auto_oriented(), h.is_three_d()), (0x04, false, true));
+    // AE reports [0, 0, -2666.67] for the one-node camera: the stored value.
+    let pos = camera.camera_position().unwrap();
+    assert!(pos.auto_state);
+    assert_near(&pos.reported(1920, 1080, h.is_auto_oriented()), &[0.0, 0.0, -2666.67], 0.01);
+    assert_eq!(camera.camera_point_of_interest(), Some([960.0, 540.0, 0.0]));
+
+    // 253: Position set to [100, 200, -1000]: stored as given, no auto state; the point of interest stays [960, 540, 0].
+    let bytes = fixture!("253-camera-position-100-200-m1000.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let camera = layer_of_type(&first_comp(&project), LayerType::Camera);
+    let pos = camera.camera_position().unwrap();
+    assert!(!pos.auto_state);
+    assert_eq!(pos.stored, [100.0, 200.0, -1000.0]);
+    assert_eq!(pos.reported(1920, 1080, true), [100.0, 200.0, -1000.0]);
+    assert_eq!(camera.camera_point_of_interest(), Some([960.0, 540.0, 0.0]));
+    // A camera has no light intensity.
+    assert_eq!(camera.light_intensity(), None);
+}
+
+#[test]
+fn lights_type_and_intensity() {
+    // 254: a spot light, Intensity 100 -> 50 (stored as 50.0 percent, absent at the default 100).
+    let bytes = fixture!("254-light-spot-intensity-50.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let light = layer_of_type(&first_comp(&project), LayerType::Light);
+    let h = light.header().unwrap();
+    assert_eq!((h.light_type(), h.light_type_code, h.source_id, h.is_auto_oriented(), h.is_three_d()), (Some(LightType::Spot), 1, None, true, true));
+    let intensity = light.light_intensity().unwrap();
+    assert_eq!((intensity.value, intensity.source), (50.0, ValueSource::Stored));
+    assert!(light.camera_position().unwrap().auto_state);
+    assert_near(&light.camera_position().unwrap().stored, &[0.0, 0.0, -1333.33], 0.01);
+
+    // 252: a point light (light type 2) at the default intensity, which is not stored.
+    let bytes = fixture!("252-light-point.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let light = layer_of_type(&first_comp(&project), LayerType::Light);
+    let h = light.header().unwrap();
+    assert_eq!((h.light_type(), h.light_type_code), (Some(LightType::Point), 2));
+    let intensity = light.light_intensity().unwrap();
+    assert_eq!((intensity.value, intensity.source), (100.0, ValueSource::Default));
+    // The solid under it is no light.
+    let solid = base_layer(&first_comp(&project)).header().unwrap();
+    assert_eq!((solid.light_type(), solid.light_type_code), (None, 0));
+}
+
+#[test]
+fn solid_colour_is_four_float32_argb() {
+    // 259: a new solid `Blue` [0, 0, 1] in the 1920x1080 composition: float32 ARGB 1.0, 0, 0, 1.0.
+    let bytes = fixture!("259-solid-blue-0-0-1.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let blue = layer_shown_as(&project, &comp, "Blue");
+    assert_eq!(project.layer_source_size(&blue), Some((1920, 1080)));
+    let f = project.layer_source(&blue).unwrap().footage().unwrap();
+    assert!(f.is_solid);
+    assert_eq!(f.solid_argb, Some([1.0, 0.0, 0.0, 1.0]));
+    assert_eq!(f.solid_rgb(), Some([0.0, 0.0, 1.0]));
+    // L is still red.
+    let red = project.layer_source(&base_layer(&comp)).unwrap().footage().unwrap();
+    assert_eq!(red.solid_rgb(), Some([1.0, 0.0, 0.0]));
+    // The new layer has no user-set name flag (it shows its source's name).
+    assert!(!blue.header().unwrap().name_is_user_set());
+}
diff --git a/crates/aep/tests/it/container/masks.rs b/crates/aep/tests/it/container/masks.rs
new file mode 100644
index 000000000..a9c1b82c0
--- /dev/null
+++ b/crates/aep/tests/it/container/masks.rs
@@ -0,0 +1,203 @@
+//! Masks: mode, invert switch, feather / opacity / expansion, and the path shapes, checked against
+//! the values the corpus was made with (its MANIFEST). The solid `L` is 1920x1080.
+
+use crate::container::helpers::{base_layer, first_comp, open};
+use effectcraft_aep::{KeyframeKind, Mask, MaskMode, PathVertex, Project, PropNode, Property, ShapePath, ValueSource};
+
+const SIZE: (f64, f64) = (1920.0, 1080.0);
+
+fn masks(name: &str) -> Option<Vec<Mask>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        base_layer(&first_comp(&project)).masks()
+    })
+}
+
+fn assert_points(vertices: &[PathVertex], expected: &[[f64; 2]]) {
+    assert_eq!(vertices.len(), expected.len());
+    for (v, e) in vertices.iter().zip(expected) {
+        for (got, want) in v.position.iter().zip(e) {
+            assert!((got - want).abs() < 1e-3, "{:?} != {e:?}", v.position);
+        }
+        // No tangents: both handles sit on the vertex.
+        assert_eq!(v.in_handle, v.position);
+        assert_eq!(v.out_handle, v.position);
+    }
+}
+
+#[test]
+fn no_masks_in_the_base() {
+    assert!(skip!(masks("000-base.aep")).is_empty());
+}
+
+#[test]
+fn rectangular_mask_with_defaults() {
+    // 090: rect size [800,400], centre [960,540]: "Mask 1", vertices [560,340] [1360,340] [1360,740] [560,740], mode Add.
+    let m = skip!(masks("090-mask-rect.aep"));
+    assert_eq!(m.len(), 1);
+    let m = &m[0];
+    assert_eq!(m.name.as_deref(), Some("Mask 1"));
+    assert_eq!((m.mode, m.inverted), (Some(MaskMode::Add), Some(false)));
+    // Feather, opacity and expansion are absent at their defaults.
+    assert_eq!((m.feather.value, m.feather.source), ([0.0, 0.0], ValueSource::Default));
+    assert_eq!((m.opacity_percent.value, m.opacity_percent.source), (100.0, ValueSource::Default));
+    assert_eq!((m.expansion.value, m.expansion.source), (0.0, ValueSource::Default));
+    assert!(!m.path_animated);
+    assert!(m.path_key_seconds.is_empty());
+    assert_eq!(m.shapes.len(), 1);
+    let s = &m.shapes[0];
+    // The box is normalised to the layer size: 560/1920, 340/1080, 1360/1920, 740/1080.
+    let want_box = [560.0 / 1920.0, 340.0 / 1080.0, 1360.0 / 1920.0, 740.0 / 1080.0];
+    for (got, want) in s.bbox.iter().zip(want_box) {
+        assert!((f64::from(*got) - want).abs() < 1e-6, "{:?}", s.bbox);
+    }
+    assert_eq!(s.closed_flag, 1);
+    assert_eq!(s.vertex_count(), 4);
+    // Three points per vertex, [vertex, out handle, next in handle], inside the box.
+    let rect: [[f32; 2]; 12] =
+        [[0.0, 0.0], [0.0, 0.0], [1.0, 0.0], [1.0, 0.0], [1.0, 0.0], [1.0, 1.0], [1.0, 1.0], [1.0, 1.0], [0.0, 1.0], [0.0, 1.0], [0.0, 1.0], [0.0, 0.0]];
+    assert_eq!(s.points, rect);
+    assert_points(&s.vertices(SIZE), &[[560.0, 340.0], [1360.0, 340.0], [1360.0, 740.0], [560.0, 740.0]]);
+}
+
+#[test]
+fn mask_properties_mode_and_invert() {
+    // 091: feather [0,0] -> [20,20], opacity 100 -> 50, mode Add -> Subtract, inverted, expansion 0 -> 5.
+    let m = skip!(masks("091-mask-rect-props.aep"));
+    let m = &m[0];
+    assert_eq!((m.mode, m.inverted), (Some(MaskMode::Subtract), Some(true)));
+    assert_eq!((m.feather.value, m.feather.source), ([20.0, 20.0], ValueSource::Stored));
+    assert_eq!((m.opacity_percent.value, m.opacity_percent.source), (50.0, ValueSource::Stored));
+    assert_eq!((m.expansion.value, m.expansion.source), (5.0, ValueSource::Stored));
+    // The path is unchanged from 090.
+    assert_points(&m.shapes[0].vertices(SIZE), &[[560.0, 340.0], [1360.0, 340.0], [1360.0, 740.0], [560.0, 740.0]]);
+}
+
+#[test]
+fn animated_mask_path_has_one_shape_per_key() {
+    // 093: path keys at t=0 (rect 400x200: [760,440] [1160,440] [1160,640] [760,640]) and t=1 (rect 800x400).
+    let m = skip!(masks("093-mask-path-2keys.aep"));
+    let m = &m[0];
+    assert!(m.path_animated);
+    assert_eq!(m.path_key_seconds, [0.0, 1.0]);
+    // The path property keeps its keys in a list of 64-byte records (the shapes are in `shap`).
+    let bytes = fixture!("093-mask-path-2keys.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = base_layer(&first_comp(&project));
+    let Some(PropNode::Group(parade)) = layer.properties().unwrap().get("ADBE Mask Parade") else { panic!("mask parade") };
+    let Some(PropNode::Group(atom)) = parade.get("ADBE Mask Atom") else { panic!("mask atom") };
+    let Some(PropNode::Other(path)) = atom.get("ADBE Mask Shape") else { panic!("mask shape") };
+    let prop = Property::from_chunk(path.child_list(b"tdbs").unwrap()).unwrap();
+    let list = prop.keys().unwrap();
+    assert_eq!((list.len(), list.header.record_size), (2, 64));
+    assert!(list.keyframes().all(|k| k.kind() == KeyframeKind::MaskPath));
+    assert_eq!(m.shapes.len(), 2);
+    assert_points(&m.shapes[0].vertices(SIZE), &[[760.0, 440.0], [1160.0, 440.0], [1160.0, 640.0], [760.0, 640.0]]);
+    assert_points(&m.shapes[1].vertices(SIZE), &[[560.0, 340.0], [1360.0, 340.0], [1360.0, 740.0], [560.0, 740.0]]);
+}
+
+#[test]
+fn shape_path_maths_with_a_pixel_box_and_tangents() {
+    // The documented point order [vertex i, out handle i, in handle i + 1] with a box in pixels (the
+    // shape-layer convention): a triangle [0,-100] [100,100] [-100,100] in the box (-100,-100,100,100),
+    // the first vertex with an out handle at [50,-100] and the last record the in handle of vertex 0.
+    let p = ShapePath {
+        bbox: [-100.0, -100.0, 100.0, 100.0],
+        closed_flag: 1,
+        open: false,
+        points: vec![
+            [0.5, 0.0],
+            [0.75, 0.0],
+            [1.0, 1.0], // vertex 0, out handle 0, in handle 1
+            [1.0, 1.0],
+            [1.0, 1.0],
+            [0.0, 1.0], // vertex 1, out handle 1, in handle 2
+            [0.0, 1.0],
+            [0.0, 1.0],
+            [0.25, 0.0], // vertex 2, out handle 2, in handle 0
+        ],
+    };
+    let v = p.vertices((1.0, 1.0));
+    assert_eq!(v.len(), 3);
+    assert_eq!(v[0].position, [0.0, -100.0]);
+    assert_eq!(v[0].out_handle, [50.0, -100.0]);
+    assert_eq!(v[0].in_handle, [-50.0, -100.0]);
+    assert_eq!(v[1].position, [100.0, 100.0]);
+    assert_eq!(v[1].in_handle, [100.0, 100.0]);
+    assert_eq!(v[2].position, [-100.0, 100.0]);
+    assert_eq!(v[2].out_handle, [-100.0, 100.0]);
+    assert!(ShapePath { bbox: [0.0; 4], closed_flag: 0, open: false, points: Vec::new() }.vertices((1.0, 1.0)).is_empty());
+}
+
+// ---------------------------------------------------------------------------- batch 2
+
+fn near2(got: [f64; 2], want: [f64; 2], tol: f64) {
+    assert!((got[0] - want[0]).abs() < tol && (got[1] - want[1]).abs() < tol, "{got:?} != {want:?}");
+}
+
+#[test]
+fn mask_mode_ids() {
+    // 090 Add 1, 091 Subtract 2, 234 Intersect 3, 235 Lighten 4, 236 Darken 5, 237 Difference 6.
+    for (name, mode, id) in [
+        ("090-mask-rect.aep", MaskMode::Add, 1),
+        ("091-mask-rect-props.aep", MaskMode::Subtract, 2),
+        ("234-mask-mode-intersect.aep", MaskMode::Intersect, 3),
+        ("235-mask-mode-lighten.aep", MaskMode::Lighten, 4),
+        ("236-mask-mode-darken.aep", MaskMode::Darken, 5),
+        ("237-mask-mode-difference.aep", MaskMode::Difference, 6),
+    ] {
+        let m = skip!(masks(name));
+        assert_eq!(m.len(), 1, "{name}");
+        assert_eq!(m[0].mode, Some(mode), "{name}");
+        assert_eq!(MaskMode::from_id(id), mode);
+        assert_eq!(m[0].name.as_deref(), Some("Mask 1"));
+        assert_eq!(m[0].shapes.len(), 1);
+        assert!(!m[0].shapes[0].open);
+    }
+    assert_eq!(MaskMode::from_id(0), MaskMode::None);
+    assert_eq!(MaskMode::from_id(9), MaskMode::Other(9));
+}
+
+#[test]
+fn ellipse_has_tangents_of_0_5523_times_the_radius() {
+    // 232: ellipse 800x400 at [960,540]: vertices [960,340] [1360,540] [960,740] [560,540]; in tangents
+    // [-220.91,0] [0,-110.457] [220.91,0] [0,110.457]; out tangents the opposite ones; closed.
+    let m = skip!(masks("232-mask-ellipse.aep"));
+    let shape = &m[0].shapes[0];
+    assert!(!shape.open);
+    assert_eq!(shape.vertex_count(), 4);
+    let v = shape.vertices(SIZE);
+    let vertices = [[960.0, 340.0], [1360.0, 540.0], [960.0, 740.0], [560.0, 540.0]];
+    let in_tangents = [[-220.913_879, 0.0], [0.0, -110.456_97], [220.913_94, 0.0], [0.0, 110.456_97]];
+    let out_tangents = [[220.913_94, 0.0], [0.0, 110.456_97], [-220.913_879, 0.0], [0.0, -110.456_97]];
+    for i in 0..4 {
+        near2(v[i].position, vertices[i], 1e-3);
+        near2(v[i].in_tangent(), in_tangents[i], 1e-2);
+        near2(v[i].out_tangent(), out_tangents[i], 1e-2);
+        // Tangent = handle minus vertex.
+        near2(v[i].in_handle, [v[i].position[0] + v[i].in_tangent()[0], v[i].position[1] + v[i].in_tangent()[1]], 1e-9);
+    }
+    // The box is the vertex box 560,340,1360,740 (normalised to the 1920x1080 layer).
+    let [l, t, r, b] = shape.bbox.map(f64::from);
+    near2([l * SIZE.0, t * SIZE.1], [560.0, 340.0], 1e-2);
+    near2([r * SIZE.0, b * SIZE.1], [1360.0, 740.0], 1e-2);
+}
+
+#[test]
+fn open_path_has_bit_8_in_the_shph_flags() {
+    // 233: three vertices [500,300] [960,700] [1400,300], closed=false, no tangents.
+    let m = skip!(masks("233-mask-open-path.aep"));
+    let shape = &m[0].shapes[0];
+    assert!(shape.open);
+    assert_eq!(shape.closed_flag, 1);
+    assert_eq!(shape.vertex_count(), 3);
+    assert_points(&shape.vertices(SIZE), &[[500.0, 300.0], [960.0, 700.0], [1400.0, 300.0]]);
+    assert_eq!(m[0].mode, Some(MaskMode::Add));
+    // The closed paths of the same session have the bit clear.
+    for name in ["232-mask-ellipse.aep", "234-mask-mode-intersect.aep"] {
+        assert!(!skip!(masks(name))[0].shapes[0].open, "{name}");
+    }
+}
diff --git a/crates/aep/tests/it/container/matte.rs b/crates/aep/tests/it/container/matte.rs
new file mode 100644
index 000000000..65fe3e6b3
--- /dev/null
+++ b/crates/aep/tests/it/container/matte.rs
@@ -0,0 +1,82 @@
+//! Track mattes (cases 402-408): mode and matte layer in the layer header.
+
+use crate::container::helpers::{first_comp, open};
+use effectcraft_aep::{MatteMode, Project, TrackMatte};
+
+/// `(name, video switch, track matte)` of every layer of comp `C`, top first.
+fn layers(name: &str) -> Option<Vec<(String, bool, Option<TrackMatte>, u32)>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).expect("project");
+        let comp = first_comp(&project);
+        comp.layers()
+            .map(|l| {
+                let h = l.header().expect("header");
+                (project.layer_display_name(&l).unwrap_or_default(), h.is_video_enabled(), l.track_matte(), h.id)
+            })
+            .collect()
+    })
+}
+
+#[test]
+fn the_four_matte_modes_and_the_matte_layer_id() {
+    for (case, mode) in [
+        ("403-matte-L-alpha-M.aep", MatteMode::Alpha),
+        ("404-matte-L-alphainv-M.aep", MatteMode::AlphaInverted),
+        ("405-matte-L-luma-M.aep", MatteMode::Luma),
+        ("406-matte-L-lumainv-M.aep", MatteMode::LumaInverted),
+    ] {
+        let l = skip!(layers(case));
+        assert_eq!(l.len(), 2, "{case}");
+        let (m_name, m_video, m_matte, m_id) = &l[0];
+        let (l_name, l_video, l_matte, l_id) = &l[1];
+        assert_eq!((m_name.as_str(), l_name.as_str()), ("M", "L"), "{case}");
+        // The matte layer M has an id of its own (0x1d in the single-case files).
+        assert_ne!(m_id, l_id, "{case}");
+        assert_eq!(*m_matte, None, "{case}: the matte layer has no matte itself");
+        assert_eq!(*l_matte, Some(TrackMatte { mode, layer: Some(*m_id) }), "{case}");
+        // After Effects switches the matte layer's video off by itself.
+        assert!(!m_video, "{case}");
+        assert!(l_video, "{case}");
+    }
+}
+
+#[test]
+fn a_matte_layer_below_its_target() {
+    let l = skip!(layers("407-matte-M-alpha-L-below.aep"));
+    assert_eq!(l[0].2, Some(TrackMatte { mode: MatteMode::Alpha, layer: Some(l[1].3) }));
+    // The matte is L (0x1b in the single-case file).
+    assert_eq!(l[1].0, "L");
+    assert!(l[0].1, "M stays visible");
+    assert!(!l[1].1, "L, the matte, is switched off");
+    assert_eq!(l[1].2, None);
+}
+
+#[test]
+fn a_matte_layer_whose_video_was_switched_back_on() {
+    let l = skip!(layers("408-matte-L-alpha-M-visible.aep"));
+    assert!(l[0].1, "M visible");
+    assert_eq!(l[1].2, Some(TrackMatte { mode: MatteMode::Alpha, layer: Some(l[0].3) }));
+}
+
+#[test]
+fn no_layer_without_a_matte_reads_one() {
+    for name in crate::container::helpers::FIXTURES.iter().filter(|n| !n.contains("-matte-")) {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let Some(project) = Project::new(&file) else { continue };
+        for item in project.all_items() {
+            let Some(comp) = item.comp() else { continue };
+            for layer in comp.layers() {
+                assert_eq!(layer.track_matte(), None, "{name}");
+            }
+        }
+    }
+}
+
+#[test]
+fn modes_from_codes() {
+    assert_eq!(MatteMode::from_code(0), None);
+    assert_eq!(MatteMode::from_code(9), Some(MatteMode::Other(9)));
+}
diff --git a/crates/aep/tests/it/container/odd_cases.rs b/crates/aep/tests/it/container/odd_cases.rs
new file mode 100644
index 000000000..eadc757cf
--- /dev/null
+++ b/crates/aep/tests/it/container/odd_cases.rs
@@ -0,0 +1,266 @@
+//! Hand-built containers for odd but well-formed shapes the reader must keep, and the limits against hostile
+//! input. Every successfully parsed input must write back byte for byte.
+
+use effectcraft_aep::{AepError, Body, Chunk, Limits, parse, parse_with_limits, write};
+
+/// One chunk with its pad byte (`pad` is used when the body is odd).
+fn chunk(id: &[u8; 4], body: &[u8], pad: u8) -> Vec<u8> {
+    let mut v = id.to_vec();
+    v.extend_from_slice(&(body.len() as u32).to_be_bytes());
+    v.extend_from_slice(body);
+    if body.len() % 2 == 1 {
+        v.push(pad);
+    }
+    v
+}
+
+fn list(list_type: &[u8; 4], children: &[Vec<u8>]) -> Vec<u8> {
+    let mut body = list_type.to_vec();
+    for c in children {
+        body.extend_from_slice(c);
+    }
+    chunk(b"LIST", &body, 0)
+}
+
+/// A whole file: `RIFX`, size, `Egg!`, chunks, trailer.
+fn file(chunks: &[Vec<u8>], trailer: &[u8]) -> Vec<u8> {
+    let mut body = b"Egg!".to_vec();
+    for c in chunks {
+        body.extend_from_slice(c);
+    }
+    let mut v = b"RIFX".to_vec();
+    v.extend_from_slice(&(body.len() as u32).to_be_bytes());
+    v.extend_from_slice(&body);
+    v.extend_from_slice(trailer);
+    v
+}
+
+fn assert_round_trip(bytes: &[u8]) -> effectcraft_aep::AepFile<'_> {
+    let f = parse(bytes).unwrap();
+    assert!(write(&f).unwrap() == bytes, "round trip differs");
+    f
+}
+
+#[test]
+fn minimal_file_and_empty_container() {
+    let bytes = file(&[], b"");
+    let f = assert_round_trip(&bytes);
+    assert!(f.chunks.is_empty() && f.trailer.is_empty());
+}
+
+#[test]
+fn empty_input_and_bad_headers_are_errors() {
+    assert_eq!(parse(b""), Err(AepError::NotRifx));
+    assert_eq!(parse(b"RIFX"), Err(AepError::NotRifx));
+    assert_eq!(parse(b"RIFF\0\0\0\x04Egg!"), Err(AepError::NotRifx));
+    assert_eq!(parse(b"RIFX\0\0\0\x04Evil"), Err(AepError::BadFormType(*b"Evil")));
+    assert!(matches!(parse(b"RIFX\0\0\0\x03Egg!"), Err(AepError::Truncated { .. })));
+    // Declared size past the end of the input.
+    assert!(matches!(parse(b"RIFX\0\0\0\x20Egg!"), Err(AepError::Truncated { declared: 32, available: 4 })));
+    assert!(matches!(parse(b"RIFX\xff\xff\xff\xffEgg!"), Err(AepError::Truncated { .. })));
+}
+
+#[test]
+fn ids_ending_in_a_space_are_kept() {
+    let bytes = file(&[chunk(b"seq ", &[1, 2], 0), chunk(b"Pin ", &[], 0), chunk(b"FEE ", &[9, 9, 9, 9], 0), chunk(b"LOm ", &[1], 0)], b"");
+    let f = assert_round_trip(&bytes);
+    let ids: Vec<&[u8; 4]> = f.chunks.iter().map(|c| &c.id).collect();
+    assert_eq!(ids, [b"seq ", b"Pin ", b"FEE ", b"LOm "]);
+    assert!(f.chunks[0].is(b"seq "));
+}
+
+#[test]
+fn odd_sized_chunks_keep_their_pad_byte_even_when_not_zero() {
+    let bytes = file(&[chunk(b"abcd", &[1, 2, 3], 0xAA), chunk(b"efgh", &[4], 0)], b"");
+    let f = assert_round_trip(&bytes);
+    assert_eq!(f.chunks[0].pad, Some(0xAA));
+    assert_eq!(f.chunks[1].pad, Some(0));
+    assert_eq!(f.chunks[0].bytes(), Some(&[1, 2, 3][..]));
+}
+
+#[test]
+fn odd_last_chunk_without_pad_byte() {
+    // The container ends right after an odd body: no pad byte exists in the file.
+    let mut body = b"Egg!".to_vec();
+    body.extend_from_slice(b"abcd\0\0\0\x03xyz");
+    let mut bytes = b"RIFX".to_vec();
+    bytes.extend_from_slice(&(body.len() as u32).to_be_bytes());
+    bytes.extend_from_slice(&body);
+    let f = assert_round_trip(&bytes);
+    assert_eq!(f.chunks.len(), 1);
+    assert_eq!(f.chunks[0].pad, None);
+    // The same with a trailer following.
+    bytes.extend_from_slice(b"<?xpacket begin?>");
+    let f = assert_round_trip(&bytes);
+    assert_eq!(f.chunks[0].pad, None);
+    assert_eq!(&*f.trailer, b"<?xpacket begin?>");
+}
+
+#[test]
+fn list_with_raw_text_body_is_opaque() {
+    // Like LIST btdk: the body after the list type is text, not chunks.
+    let text = b"{\"a\": 1, \"b\": [1, 2, 3]} not a chunk sequence at all";
+    let bytes = file(&[chunk(b"LIST", &[b"btdk".as_slice(), text].concat(), 0), chunk(b"next", &[], 0)], b"");
+    let f = assert_round_trip(&bytes);
+    assert!(matches!(f.chunks[0].body, Body::OpaqueList { .. }));
+    assert_eq!(f.chunks[0].list_type(), Some(*b"btdk"));
+    assert_eq!(f.chunks[0].bytes(), Some(&text[..]));
+    assert!(f.chunks[1].is(b"next"));
+}
+
+#[test]
+fn list_with_a_child_larger_than_the_list_is_opaque_not_an_error() {
+    let mut bad_child = b"kid1".to_vec();
+    bad_child.extend_from_slice(&1000u32.to_be_bytes());
+    bad_child.extend_from_slice(&[0; 4]);
+    let bytes = file(&[chunk(b"LIST", &[b"lsta".as_slice(), &bad_child].concat(), 0), chunk(b"tail", &[], 0)], b"");
+    let f = assert_round_trip(&bytes);
+    assert!(matches!(f.chunks[0].body, Body::OpaqueList { .. }));
+    assert!(f.chunks[1].is(b"tail"));
+}
+
+#[test]
+fn list_with_trailing_bytes_shorter_than_a_header_is_opaque() {
+    let bytes = file(&[chunk(b"LIST", &[b"lsta".as_slice(), &chunk(b"kid1", &[], 0), &[1, 2, 3]].concat(), 0)], b"");
+    let f = assert_round_trip(&bytes);
+    assert!(matches!(f.chunks[0].body, Body::OpaqueList { .. }));
+}
+
+#[test]
+fn empty_list_and_list_shorter_than_its_type() {
+    let bytes = file(&[list(b"Pefl", &[]), chunk(b"LIST", &[1, 2], 0), chunk(b"LIST", &[], 0)], b"");
+    let f = assert_round_trip(&bytes);
+    assert!(matches!(&f.chunks[0].body, Body::List { children, .. } if children.is_empty()));
+    // A LIST chunk too short to hold a type stays plain data.
+    assert!(matches!(f.chunks[1].body, Body::Data(_)));
+    assert!(matches!(f.chunks[2].body, Body::Data(_)));
+}
+
+#[test]
+fn nested_ids_hold_a_utf8_chunk() {
+    let name = chunk(b"Utf8", b"Hello", 0x7f);
+    let empty = chunk(b"Utf8", b"", 0);
+    let bytes = file(&[chunk(b"tdsn", &name, 0), chunk(b"pdnm", &empty, 0), chunk(b"fnam", &name, 0), chunk(b"othr", &name, 0)], b"");
+    let f = assert_round_trip(&bytes);
+    for c in &f.chunks[..3] {
+        assert!(matches!(c.body, Body::Chunks(_)), "{:?}", c.id);
+        assert_eq!(c.children().len(), 1);
+        let expect: &[u8] = if c.id == *b"pdnm" { b"" } else { b"Hello" };
+        assert_eq!(c.children()[0].bytes(), Some(expect));
+    }
+    assert_eq!(f.chunks[0].children()[0].pad, Some(0x7f));
+    // An id outside the nested set is plain data even though its body looks like a chunk.
+    assert!(matches!(f.chunks[3].body, Body::Data(_)));
+}
+
+#[test]
+fn nested_id_with_a_body_that_is_not_a_chunk_stays_data() {
+    let bytes = file(&[chunk(b"tdsn", b"not a chunk sequence!", 0), chunk(b"tdsn", &[0; 3], 0), chunk(b"tdsn", &[], 0)], b"");
+    let f = assert_round_trip(&bytes);
+    assert!(f.chunks.iter().all(|c| matches!(c.body, Body::Data(_))));
+}
+
+#[test]
+fn xmp_packet_follows_the_container() {
+    let xmp = b"<?xpacket begin=\"x\" id=\"W5M0\"?>\n<x:xmpmeta>data</x:xmpmeta>\n   \n<?xpacket end=\"w\"?>";
+    let mut trailer = b"junk before ".to_vec();
+    trailer.extend_from_slice(xmp);
+    trailer.extend_from_slice(b"\n\n");
+    let bytes = file(&[chunk(b"abcd", &[1, 2], 0)], &trailer);
+    let f = assert_round_trip(&bytes);
+    assert_eq!(&*f.trailer, &trailer[..]);
+    assert_eq!(f.xmp(), Some(&xmp[..]));
+    // No packet, no XMP.
+    let bytes = file(&[], b"nothing here");
+    assert_eq!(assert_round_trip(&bytes).xmp(), None);
+    // An unterminated packet is not returned.
+    let bytes = file(&[], b"<?xpacket begin?> and no end");
+    assert_eq!(assert_round_trip(&bytes).xmp(), None);
+}
+
+#[test]
+fn chunk_larger_than_its_parent_is_an_error_at_the_top_level() {
+    let mut bad = b"big!".to_vec();
+    bad.extend_from_slice(&0xffff_fff0u32.to_be_bytes());
+    bad.extend_from_slice(&[0; 4]);
+    let bytes = file(&[bad], b"");
+    assert!(matches!(parse(&bytes), Err(AepError::ChunkTooLarge { size: 0xffff_fff0, .. })));
+    // A chunk header cut short by the container end.
+    let bytes = file(&[vec![b'a', b'b', b'c', b'd', 0, 0]], b"");
+    assert!(matches!(parse(&bytes), Err(AepError::Malformed { .. })));
+}
+
+#[test]
+fn deep_nesting_is_kept_opaque_below_the_depth_limit() {
+    // 50 000 nested lists, emitted outermost first so building stays linear.
+    let levels: usize = 50_000;
+    let leaf = chunk(b"leaf", &[1, 2], 0);
+    let mut chunk_bytes = Vec::new();
+    for _ in 0..levels {
+        chunk_bytes.extend_from_slice(b"LIST");
+        // placeholder for the size, filled below
+        chunk_bytes.extend_from_slice(&[0; 4]);
+        chunk_bytes.extend_from_slice(b"deep");
+    }
+    chunk_bytes.extend_from_slice(&leaf);
+    let mut inner_total = leaf.len();
+    for level in (0..levels).rev() {
+        let size = 4 + inner_total;
+        let at = level * 12 + 4;
+        chunk_bytes[at..at + 4].copy_from_slice(&(size as u32).to_be_bytes());
+        inner_total = 8 + size;
+    }
+    let bytes = file(&[chunk_bytes], b"");
+    let f = assert_round_trip(&bytes);
+    let depth = f.walk().map(|(d, _)| d).max().unwrap();
+    assert!(depth <= Limits::default().max_depth, "depth {depth}");
+    // A smaller limit parses less and still round-trips.
+    let f = parse_with_limits(&bytes, Limits { max_depth: 3, max_chunks: 1000 }).unwrap();
+    assert!(f.walk().map(|(d, _)| d).max().unwrap() <= 3);
+    assert!(write(&f).unwrap() == bytes);
+}
+
+#[test]
+fn chunk_count_limit() {
+    let many: Vec<Vec<u8>> = (0..100).map(|_| chunk(b"abcd", &[], 0)).collect();
+    let bytes = file(&many, b"");
+    assert_eq!(parse_with_limits(&bytes, Limits { max_depth: 8, max_chunks: 99 }), Err(AepError::TooManyChunks));
+    assert!(parse_with_limits(&bytes, Limits { max_depth: 8, max_chunks: 100 }).is_ok());
+}
+
+#[test]
+fn huge_declared_sizes_do_not_allocate() {
+    // A list that claims a gigantic child inside a small file: no allocation sized by the claim.
+    let mut c = b"LIST".to_vec();
+    c.extend_from_slice(&u32::MAX.to_be_bytes());
+    c.extend_from_slice(b"lsta");
+    let bytes = file(&[c], b"");
+    assert!(matches!(parse(&bytes), Err(AepError::ChunkTooLarge { .. })));
+}
+
+#[test]
+fn modified_trees_are_re_sized_on_write() {
+    let bytes = file(&[list(b"Fold", &[chunk(b"name", b"abc", 0), chunk(b"keep", &[7, 7], 0)])], b"tail");
+    let mut f = parse(&bytes).unwrap();
+    if let Some(Chunk { body: Body::List { children, .. }, .. }) = f.chunks.first_mut() {
+        children[0] = Chunk::data(*b"name", b"a longer name!".to_vec());
+    }
+    let out = write(&f).unwrap();
+    let g = parse(&out).unwrap();
+    let kids = g.chunks[0].children();
+    assert_eq!(kids[0].bytes(), Some(&b"a longer name!"[..]));
+    assert_eq!(kids[1].bytes(), Some(&[7u8, 7][..]));
+    assert_eq!(&*g.trailer, b"tail");
+    assert!(write(&g).unwrap() == out);
+}
+
+#[test]
+fn writer_rejects_absurd_depth_instead_of_overflowing_the_stack() {
+    let mut c = Chunk::data(*b"leaf", vec![1u8, 2]);
+    for _ in 0..2000 {
+        c = Chunk::list(*b"deep", vec![c]);
+    }
+    let f = effectcraft_aep::AepFile { chunks: vec![c], trailer: std::borrow::Cow::Borrowed(&[]) };
+    assert_eq!(write(&f), Err(AepError::TooDeep));
+    // Dropping the deep tree must not overflow either (2000 levels).
+}
diff --git a/crates/aep/tests/it/container/robustness.rs b/crates/aep/tests/it/container/robustness.rs
new file mode 100644
index 000000000..5c3422a10
--- /dev/null
+++ b/crates/aep/tests/it/container/robustness.rs
@@ -0,0 +1,731 @@
+//! Hostile and damaged input: nothing may panic; whatever parses must write back identically.
+
+use effectcraft_aep::{AepError, parse, write};
+
+/// Parses; on success, the invariant "parse then write is the identity" must hold.
+fn check(bytes: &[u8]) -> Result<(), AepError> {
+    let file = parse(bytes)?;
+    let back = write(&file).map_err(|_| AepError::TooLarge)?;
+    assert!(back == bytes, "round trip of an accepted input differs ({} bytes)", bytes.len());
+    Ok(())
+}
+
+/// A small deterministic generator (xorshift64*).
+struct Rng(u64);
+
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        self.0.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+#[test]
+fn empty_and_tiny_inputs() {
+    assert_eq!(check(&[]), Err(AepError::NotRifx));
+    for n in 0..16 {
+        let bytes = fixture!("001-empty.aep");
+        let _ = check(&bytes[..n]);
+    }
+}
+
+#[test]
+fn truncated_at_every_length() {
+    let bytes = fixture!("001-empty.aep");
+    let declared = u32::from_be_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]) as usize + 8;
+    for len in 0..=bytes.len() {
+        let r = check(&bytes[..len]);
+        if len < declared {
+            assert!(r.is_err(), "length {len} of {declared} must be rejected");
+        } else {
+            assert!(r.is_ok(), "length {len} (>= declared end) must parse: {r:?}");
+        }
+    }
+}
+
+#[test]
+fn truncated_larger_fixture_at_sampled_lengths() {
+    let bytes = fixture!("090-mask-rect.aep");
+    let declared = u32::from_be_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]) as usize + 8;
+    let mut rng = Rng(0x9e37_79b9_7f4a_7c15);
+    for _ in 0..400 {
+        let len = rng.below(bytes.len() + 1);
+        let r = check(&bytes[..len]);
+        assert_eq!(r.is_ok(), len >= declared, "len {len}");
+    }
+}
+
+#[test]
+fn random_byte_flips() {
+    for (name, iterations) in [("001-empty.aep", 4000), ("000-base.aep", 1500), ("110-text-A.aep", 600)] {
+        let original = fixture!(name);
+        let mut rng = Rng(0x1234_5678_9abc_def1 ^ original.len() as u64);
+        let (mut ok, mut err) = (0, 0);
+        for _ in 0..iterations {
+            let mut b = original.clone();
+            for _ in 0..=rng.below(8) {
+                let at = rng.below(b.len());
+                b[at] = rng.next() as u8;
+            }
+            match check(&b) {
+                Ok(()) => ok += 1,
+                Err(_) => err += 1,
+            }
+        }
+        assert_eq!(ok + err, iterations, "{name}");
+    }
+}
+
+#[test]
+fn a_whole_combined_file_survives_flips_and_truncation() {
+    // The cases above are cut from the combined files by our writer; this one is After Effects'
+    // own bytes (the smallest combined file).
+    let original = skip!(crate::common::try_file("aepx-pair.aep"));
+    let declared = u32::from_be_bytes([original[4], original[5], original[6], original[7]]) as usize + 8;
+    let mut rng = Rng(0x0bad_5eed_1234_5678);
+    for _ in 0..200 {
+        let len = rng.below(original.len() + 1);
+        assert_eq!(check(&original[..len]).is_ok(), len >= declared, "len {len}");
+        let mut b = original.clone();
+        for _ in 0..=rng.below(8) {
+            let at = rng.below(b.len());
+            b[at] = rng.next() as u8;
+        }
+        let _ = check(&b);
+    }
+}
+
+#[test]
+fn flips_in_the_headers_and_sizes() {
+    // Aim at the bytes that matter most: the first 200 bytes, every value of every byte.
+    let original = fixture!("001-empty.aep");
+    for at in 0..200 {
+        for v in [0u8, 1, 0x7f, 0x80, 0xff] {
+            let mut b = original.clone();
+            b[at] = v;
+            let _ = check(&b);
+        }
+    }
+}
+
+#[test]
+fn oversized_chunk_sizes() {
+    let original = fixture!("001-empty.aep");
+    // Every chunk header's size field set to huge values, one at a time, at every 4-byte aligned
+    // offset of the first 2 KB.
+    for at in (12..2048).step_by(2) {
+        for v in [u32::MAX, 0x8000_0000, 0x0100_0000, original.len() as u32, 1 << 20] {
+            let mut b = original.clone();
+            b[at..at + 4].copy_from_slice(&v.to_be_bytes());
+            let _ = check(&b);
+        }
+    }
+    // The container size itself.
+    for v in [0u32, 3, 4, 5, u32::MAX, original.len() as u32] {
+        let mut b = original.clone();
+        b[4..8].copy_from_slice(&v.to_be_bytes());
+        let _ = check(&b);
+    }
+}
+
+#[test]
+fn garbage_after_a_valid_header() {
+    let mut rng = Rng(42);
+    for _ in 0..2000 {
+        let n = rng.below(200);
+        let mut b = b"RIFX\0\0\0\0Egg!".to_vec();
+        for _ in 0..n {
+            b.push(rng.next() as u8);
+        }
+        let size = (b.len() - 8) as u32;
+        b[4..8].copy_from_slice(&size.to_be_bytes());
+        let _ = check(&b);
+    }
+}
+
+// ----------------------------------------------------------------------------------- typed view
+
+use effectcraft_aep::{AepFile, Body, Chunk, Comp, Layer, Project, PropGroup, PropNode, Property};
+
+/// Touches the property accessors; none may panic on a damaged property.
+fn exercise_property(p: &Property<'_, '_>) {
+    let _ = (p.header(), p.dims(), p.is_animated(), p.static_value(), p.time_scale(), p.flags(), p.is_static_flag_set());
+    let _ = (p.expression(), p.expression_flags().map(|f| (f.all_set(), f.disabled())), p.expression_enabled(), p.user_name(), p.first_key_value());
+    let _ = p.color_argb();
+    if let Some(keys) = p.keys() {
+        let scale = p.time_scale().unwrap_or(0);
+        for k in keys.keyframes() {
+            let _ = (k.time_units(), k.spatial_value(), k.raw().len(), k.kind(), k.seconds(scale), k.seconds(0));
+            let _ = (k.interpolation_in(), k.interpolation_out(), k.flags(), k.label(), k.is_roving());
+            let _ = (k.scalar_value(), k.ease(), k.spatial(), k.components(), k.value(), k.plain_ease_slots());
+            let _ = (k.ease_components(), k.color_distance());
+            for component in [0, 1, 2, 3, 7, 255, usize::MAX] {
+                let _ = k.ease_component(component);
+            }
+            let _ = k.spatial().map(|s| (s.value.len(), s.in_tangent.len(), s.out_tangent.len(), s.ease));
+        }
+    }
+}
+
+fn exercise_group(g: &PropGroup<'_, '_>, depth: usize) {
+    if depth > 24 {
+        return;
+    }
+    let _ = (g.flags(), g.names(), g.user_name());
+    for e in g.entries() {
+        match e.node {
+            PropNode::Group(g) => exercise_group(&g, depth + 1),
+            PropNode::Property(p) => exercise_property(&p),
+            PropNode::Other(c) => {
+                if let Some(g) = c.child_list(b"tdgp").and_then(PropGroup::from_chunk) {
+                    exercise_group(&g, depth + 1);
+                }
+            }
+        }
+    }
+}
+
+fn exercise_layer(project: &Project<'_, '_>, comp_size: (u32, u32), layer: &Layer<'_, '_>) {
+    let _ = (layer.name(), layer.is_three_d(), layer.id(), layer.track_matte());
+    if let Some(h) = layer.header() {
+        let _ = (h.in_point(), h.out_point(), h.in_point_seconds(), h.out_point_seconds(), h.start_seconds(), h.stretch_percent());
+        let _ = (h.stretch_ratio(), h.stretch_den);
+        let _ = (h.is_shy(), h.is_locked(), h.is_solo(), h.is_three_d(), h.is_motion_blur(), h.is_adjustment(), h.is_guide());
+        let _ = (h.is_null_object(), h.collapses_transformations(), h.name_is_user_set(), h.quality, h.blend_mode, h.layer_type);
+        let _ = (h.is_enabled(), h.is_video_enabled(), h.is_audio_enabled(), h.is_effects_enabled(), h.is_auto_oriented(), h.light_type(), h.blend_mode.code());
+    }
+    let _ = (layer.is_enabled(), layer.is_audio_enabled(), layer.is_effects_enabled());
+    let _ = (layer.camera_position().map(|p| p.reported(comp_size.0, comp_size.1, true)), layer.camera_point_of_interest(), layer.light_intensity());
+    let _ = project.layer_anchor_px(layer);
+    let _ = (layer.camera_zoom(), layer.camera_depth_of_field(), layer.camera_focus_distance(), layer.camera_aperture());
+    let _ = (layer.light_color(), layer.light_cone_angle(), layer.light_cone_feather());
+    let _ = layer
+        .time_remap()
+        .map(|t| (t.enabled, t.keys.iter().fold(0.0, |acc, k| acc + k.value_seconds + k.time_seconds.unwrap_or(0.0) + f64::from(k.time_units))));
+    for g in layer.shape_groups() {
+        let _ = (g.name, g.position, g.details.len());
+        for d in &g.details {
+            match d {
+                effectcraft_aep::ShapeDetail::Polystar { star_type, outer_radius, inner_radius, inner_roundness, item_index } => {
+                    let _ = (star_type.value, outer_radius.value, inner_radius.value, inner_roundness.map(|r| r.value), *item_index);
+                }
+                effectcraft_aep::ShapeDetail::Gradient { gradient_type, highlight_length, highlight_angle, item_index } => {
+                    let _ = (gradient_type.value, highlight_length.map(|t| t.value), highlight_angle.map(|t| t.value), *item_index);
+                }
+                effectcraft_aep::ShapeDetail::RectPosition { position, item_index } => {
+                    let _ = (position.value, *item_index);
+                }
+            }
+        }
+        for item in g.items {
+            if let effectcraft_aep::ShapeItem::Path { paths, .. } = item {
+                for s in paths {
+                    let _ = s.vertices((1.0, 1.0)).iter().fold(0.0, |acc, v| acc + v.in_tangent()[0] + v.out_tangent()[1]);
+                }
+            }
+        }
+    }
+    let _ = (project.layer_source(layer).map(|i| i.id()), project.layer_display_name(layer), project.layer_source_size(layer));
+    if let Some(t) = layer.transform(comp_size.0, comp_size.1) {
+        let _ = (t.anchor_px(f64::from(comp_size.0), f64::from(comp_size.1)), t.position.value, t.opacity_percent.value);
+    }
+    if let Some(root) = layer.properties() {
+        exercise_group(&root, 0);
+    }
+    // One index for the layer's effects: building it walks every layer of the file.
+    let defs = project.effect_definition_index();
+    for e in layer.effects() {
+        let _ = (e.match_name().len(), e.name(), e.declared_param_count(), e.has_own_definitions(), defs.source(&e));
+        for p in e.params().into_iter().chain(defs.params(&e)) {
+            let _ = (p.index, p.kind, p.name.len(), p.items.as_ref().map(Vec::len), p.pard().len(), p.value(), p.stored_value(), p.pard_default());
+            let _ = (p.is_default(), p.popup_item_count(), p.popup_selected_index(), p.popup_selected_item(), p.valid_max(), p.is_animated());
+            let _ = (p.valid_min(), p.slider_range());
+            if let Some(keys) = p.keys() {
+                for k in keys.keyframes() {
+                    let _ = (k.value(), k.spatial(), k.time_units(), k.ease());
+                }
+            }
+            for owner in [0, 1, 0x1b, u32::MAX] {
+                let _ = p.layer_ref(owner);
+            }
+            for size in [0.0, 1920.0, f64::NAN, f64::INFINITY, f64::MAX] {
+                let _ = p.point_px(size, size);
+            }
+            if let Some(s) = p.stored() {
+                exercise_property(&s);
+            }
+        }
+    }
+    for m in layer.masks() {
+        let _ = (m.name.clone(), m.mode, m.inverted, m.counter, m.feather, m.opacity_percent, m.expansion, m.path_animated, m.path_key_seconds.len());
+        let _ = project.mask_vertices_px(layer, &m).map(|shapes| shapes.iter().map(Vec::len).sum::<usize>());
+        for s in &m.shapes {
+            let _ = (s.vertex_count(), s.vertices((1920.0, 1080.0)).len(), s.vertices((f64::NAN, f64::INFINITY)).len(), s.open);
+        }
+    }
+    if let Some(t) = layer.text_document() {
+        let _ = (t.fill_rgb(), t.fonts.len(), t.text.len(), t.raw_text.len(), t.font_size, t.font.clone(), t.paragraph_texts().len());
+        let _ = (t.paragraphs.iter().fold(0, |acc, p| acc + p.length), t.style_runs.iter().fold(0.0, |acc, r| acc + r.tracking + r.fill_argb[0]), t.text_box);
+        let _ = t
+            .style_runs
+            .iter()
+            .fold(0.0, |acc, r| acc + r.leading.unwrap_or(0.0) + f64::from(u8::from(r.faux_bold)) + f64::from(u8::from(r.faux_italic)) + r.font_index as f64);
+        let _ = t.style_runs.iter().map(|r| r.caps).collect::<Vec<_>>();
+        let _ = t.paragraphs.iter().map(|p| p.justification).collect::<Vec<_>>();
+    }
+    for m in layer.markers() {
+        let _ = (m.comment.len(), m.chapter.len(), m.url.len(), m.frame_target.len(), m.cue_point_name.len(), m.duration_seconds);
+        let _ = (m.label, m.cue_type, m.cue_params.iter().map(|(k, v)| k.len() + v.len()).sum::<usize>());
+    }
+}
+
+fn exercise_comp(project: &Project<'_, '_>, comp: &Comp<'_, '_>) {
+    let tb = comp.time_base();
+    let _ = tb.map(|t| (t.frame_rate(), t.seconds(i32::MIN), t.seconds(i32::MAX)));
+    let _ = (comp.name(), comp.renderer(), comp.markers());
+    let mut size = (1920, 1080);
+    if let Some(h) = comp.header() {
+        size = (u32::from(h.width), u32::from(h.height));
+        let _ = (h.frame_rate(), h.frame_rate_from_fixed(), h.duration_seconds(), h.work_area_start_seconds(), h.work_area_end_seconds());
+        let _ = (h.frame_rate_exact(), h.duration_frames());
+        let _ = (h.background_rgb(), h.pixel_aspect_ratio(), h.pixel_aspect.reduced(), h.shutter_angle, h.motion_blur);
+        let _ = (h.shutter_phase, h.display_start, h.display_start_seconds(), h.display_start_frame());
+    }
+    for layer in comp.layers() {
+        exercise_layer(project, size, &layer);
+    }
+}
+
+/// Touches every accessor of the typed view; none may panic on a damaged tree.
+fn exercise(file: &AepFile<'_>) {
+    let Some(project) = Project::new(file) else { return };
+    for item in project.all_items() {
+        let _ = (item.kind(), item.name(), item.id(), item.label(), item.used_item_ids(), item.footage(), item.display_name());
+        let _ = item
+            .footage()
+            .map(|f| (f.duration, f.native_frame_rate, f.bits_per_pixel, f.file_size, f.audio_sample_rate, f.is_sequence, f.sequence_frame_count()));
+        let _ = item.id().and_then(|id| project.item_by_id(id));
+        if let Some(comp) = item.comp() {
+            exercise_comp(&project, &comp);
+        }
+    }
+}
+
+/// The fixtures whose typed fields are decoded, one per kind of chunk body.
+const DECODED: &[&str] = &[
+    "000-base.aep",
+    "010-layer-name.aep",
+    "022-layer-parent-null.aep",
+    "030-comp-size-1280x720.aep",
+    "035-comp-workarea-1-2.aep",
+    "039-comp-renderer-advanced3d.aep",
+    "044-static-anchor-10-20.aep",
+    "052-key-position-2key-ease.aep",
+    "054-key-position-2key-spatial-bezier.aep",
+    "056-key-position-3key-roving-key2.aep",
+    "058-key-opacity-2key.aep",
+    "060-expr-opacity-wiggle.aep",
+    "071-fx-slider-value77.aep",
+    "073-fx-color-0.2-0.6-1.aep",
+    "077-fx-dropdown-default.aep",
+    "080-fx-dropshadow-default.aep",
+    "091-mask-rect-props.aep",
+    "093-mask-path-2keys.aep",
+    "113-text-Hello-size60-fillorange.aep",
+    "122-marker-comp-1s.aep",
+    "123-marker-layer-1s.aep",
+    "124-precomp-Pre.aep",
+    "126-footage-png-layer.aep",
+    "202-key-out-hold-in-linear.aep",
+    "204-key-ease-asymmetric.aep",
+    "205-key-opacity-ease-asymmetric.aep",
+    "206-key-scale-2key-linear.aep",
+    "208-key-mask-feather-2key-linear.aep",
+    "210-key-fill-color-2key-linear.aep",
+    "211-anchor-100x100-solid-10-20.aep",
+    "213-expr-opacity-wiggle-disabled.aep",
+    "214-fx-gaussianblur-default.aep",
+    "215-fx-fill-default.aep",
+    "218-fx-point-111-222.aep",
+    "220-fx-layercontrol-to-layer1.aep",
+    "221-fx-slider-2key.aep",
+    "222-layer-video-off.aep",
+    "228-layer-blend-difference.aep",
+    "229-comp-fps-29.97.aep",
+    "232-mask-ellipse.aep",
+    "233-mask-open-path.aep",
+    "237-mask-mode-difference.aep",
+    "239-shape-stroke-green-w8-round.aep",
+    "240-shape-custom-path-tangents.aep",
+    "241-shape-gradient-fill-linear.aep",
+    "242-shape-group-position-50-50.aep",
+    "245-text-box-400x200-Hello.aep",
+    "248-text-range-fill-red-1-3.aep",
+    "249-marker-layer-full.aep",
+    "251-camera-one-node.aep",
+    "252-light-point.aep",
+    "253-camera-position-100-200-m1000.aep",
+    "254-light-spot-intensity-50.aep",
+    "259-solid-blue-0-0-1.aep",
+    "300-fx-gaussianblur-0-explicit.aep",
+    "305-key-scale-bezier-ease.aep",
+    "306-key-maskfeather-bezier-ease.aep",
+    "307-key-fillcolor-bezier.aep",
+    "309-solid-100x100-mask-rect.aep",
+    "310-solid-100x100-pointcontrol.aep",
+    "317-layer-stretch150.aep",
+    "318-layer-inpoint-0.3333.aep",
+    "319-precomp-timeremap.aep",
+    "321-fx-layercontrol-none.aep",
+    "324-fx-dropdown-5items-select3.aep",
+    "327-comp-displaystartframe-100.aep",
+    "328-mask-two-ellipse-rect.aep",
+    "329-mask-ellipse-mode-none.aep",
+    "331-shape-polystar-polygon-5-100.aep",
+    "332-shape-gradient-fill-radial.aep",
+    "333-shape-group-two-rects.aep",
+    "334-text-box-right-align.aep",
+    "335-text-point-fauxbold.aep",
+    "340-text-range-two-styles.aep",
+    "342-camera-dof-800-30.aep",
+    "343-light-spot-color-red.aep",
+    "349-marker-layer-event-cue-params.aep",
+    "351-footage-wav-as-layer.aep",
+    "352-footage-pngseq-imported.aep",
+    "354-footage-pngseq-timeremap.aep",
+    "364-fx-tint-white-2key.aep",
+    "382-fx-ramp-start-2key.aep",
+    "383-fx-ramp-on-100x100-start-10-20.aep",
+    "389-fx-exposure-default.aep",
+    "395-fx-exposure-individual-red-1.aep",
+    "397-fx-exposure-master-2key.aep",
+];
+
+#[test]
+fn typed_view_reads_every_undamaged_fixture() {
+    for name in crate::container::helpers::FIXTURES {
+        let bytes = fixture!(name);
+        exercise(&parse(&bytes).unwrap());
+    }
+}
+
+#[test]
+fn typed_view_survives_damaged_files() {
+    for (name, iterations) in [("000-base.aep", 1500), ("055-key-position-3key-inserted-t2.5.aep", 800), ("071-fx-slider-value77.aep", 800)] {
+        let original = fixture!(name);
+        let mut rng = Rng(0xfeed_beef_1234_5678 ^ original.len() as u64);
+        for _ in 0..iterations {
+            let mut b = original.clone();
+            for _ in 0..=rng.below(12) {
+                let at = rng.below(b.len());
+                b[at] = rng.next() as u8;
+            }
+            if let Ok(file) = parse(&b) {
+                exercise(&file);
+            }
+        }
+    }
+}
+
+#[test]
+fn typed_view_survives_byte_flips_in_the_decoded_fixtures() {
+    for name in DECODED {
+        let original = fixture!(name);
+        let mut rng = Rng(0x0dd_ba11_cafe_f00d ^ original.len() as u64);
+        let (mut parsed, mut total) = (0, 0);
+        for _ in 0..250 {
+            let mut b = original.clone();
+            for _ in 0..=rng.below(16) {
+                let at = rng.below(b.len());
+                b[at] = rng.next() as u8;
+            }
+            total += 1;
+            if let Ok(file) = parse(&b) {
+                parsed += 1;
+                exercise(&file);
+            }
+        }
+        // Flips that land inside bodies keep the file parseable; sizes that break the structure do not.
+        assert!(parsed > 0 && parsed <= total, "{name}: {parsed} of {total}");
+    }
+}
+
+#[test]
+fn truncated_typed_files_never_panic() {
+    // A cut inside the container is an error; a cut in the trailer still parses. Either way no panic.
+    for name in DECODED {
+        let original = fixture!(name);
+        let declared = u32::from_be_bytes([original[4], original[5], original[6], original[7]]) as usize + 8;
+        let mut rng = Rng(0x7e57_7e57 ^ original.len() as u64);
+        for _ in 0..120 {
+            let len = rng.below(original.len() + 1);
+            if let Ok(file) = parse(&original[..len]) {
+                assert!(len >= declared, "{name}: {len} < {declared}");
+                exercise(&file);
+            }
+        }
+        // Also cut right before and after the declared end.
+        for len in [declared - 1, declared, declared + 1] {
+            if let Ok(file) = parse(&original[..len.min(original.len())]) {
+                exercise(&file);
+            }
+        }
+    }
+}
+
+/// The chunks whose bodies the typed view decodes.
+const DECODED_IDS: &[&[u8; 4]] = &[
+    b"ldta", b"cdta", b"prin", b"idta", b"idpi", b"tdb4", b"cdat", b"tdsb", b"lhd3", b"ldat", b"mkif", b"shph", b"parn", b"pard", b"sspc", b"opti", b"alas",
+    b"Utf8", b"tdmn", b"NmHd", b"btdk", b"tdpi",
+];
+
+/// Applies a random mutation to a body.
+fn damage(body: &mut Vec<u8>, rng: &mut Rng) {
+    match rng.below(7) {
+        0 => body.truncate(rng.below(body.len() + 1)),
+        1 => body.clear(),
+        2 => {
+            for _ in 0..=rng.below(4) {
+                if !body.is_empty() {
+                    let at = rng.below(body.len());
+                    body[at] = rng.next() as u8;
+                }
+            }
+        }
+        3 => {
+            // A 4-byte window set to an extreme value (sizes, counts, offsets).
+            if body.len() >= 4 {
+                let at = rng.below(body.len() - 3);
+                let v = [0xffff_ffffu32, 0x8000_0000, 0x7fff_ffff, 0, 1][rng.below(5)];
+                body[at..at + 4].copy_from_slice(&v.to_be_bytes());
+            }
+        }
+        4 => body.extend((0..=rng.below(64)).map(|_| rng.next() as u8)),
+        5 => {
+            // An 8-byte window set to NaN / infinity / a huge double.
+            if body.len() >= 8 {
+                let at = rng.below(body.len() - 7);
+                let v = [f64::NAN, f64::INFINITY, f64::NEG_INFINITY, 1e308, -1e308][rng.below(5)];
+                body[at..at + 8].copy_from_slice(&v.to_be_bytes());
+            }
+        }
+        _ => body.iter_mut().for_each(|b| *b = 0xff),
+    }
+}
+
+fn damage_tree(chunks: &mut [Chunk<'static>], rng: &mut Rng, depth: usize) {
+    if depth > 70 {
+        return;
+    }
+    for chunk in chunks {
+        let id = chunk.id;
+        match &mut chunk.body {
+            Body::Data(d) => {
+                if DECODED_IDS.contains(&&id) && rng.below(12) == 0 {
+                    damage(d.to_mut(), rng);
+                }
+            }
+            Body::OpaqueList { data, .. } => {
+                if rng.below(3) == 0 {
+                    damage(data.to_mut(), rng);
+                }
+            }
+            Body::Chunks(c) | Body::List { children: c, .. } => damage_tree(c, rng, depth + 1),
+        }
+    }
+}
+
+#[test]
+fn typed_view_survives_damaged_chunk_bodies() {
+    // Damage the bodies the typed view decodes (not the container framing), directly in the tree:
+    // wrong sizes, empty and truncated bodies, extreme counts, NaN doubles, unterminated text.
+    for name in DECODED {
+        let bytes = fixture!(name);
+        let original = parse(&bytes).unwrap().into_owned();
+        let mut rng = Rng(0xbad_c0de_0001 ^ bytes.len() as u64);
+        for _ in 0..120 {
+            let mut file = original.clone();
+            damage_tree(&mut file.chunks, &mut rng, 0);
+            exercise(&file);
+        }
+    }
+}
+
+#[test]
+fn extreme_values_in_the_decoded_headers() {
+    use effectcraft_aep::{CompHeader, LayerHeader, Rational, ShapePath};
+    // Every field at its maximum: no overflow, no division by zero, no panic.
+    let h = LayerHeader::parse(&[0xff; 164]).unwrap();
+    let _ = (h.in_point(), h.out_point(), h.in_point_seconds(), h.out_point_seconds(), h.start_seconds(), h.stretch_percent());
+    let mut zero_den = [0u8; 164];
+    zero_den[8..12].copy_from_slice(&u32::MAX.to_be_bytes());
+    zero_den[12..16].copy_from_slice(&i32::MIN.to_be_bytes());
+    let h = LayerHeader::parse(&zero_den).unwrap();
+    assert_eq!((h.in_point(), h.out_point(), h.start_seconds()), (None, None, None));
+    let mut wide = [0u8; 164];
+    wide[8..12].copy_from_slice(&u32::MAX.to_be_bytes());
+    wide[12..16].copy_from_slice(&i32::MIN.to_be_bytes());
+    wide[16..20].copy_from_slice(&u32::MAX.to_be_bytes());
+    wide[20..24].copy_from_slice(&i32::MAX.to_be_bytes());
+    wide[24..28].copy_from_slice(&u32::MAX.to_be_bytes());
+    let h = LayerHeader::parse(&wide).unwrap();
+    let _ = (h.in_point(), h.in_point_seconds());
+    let c = CompHeader::parse(&[0xff; 204]).unwrap();
+    assert_eq!((c.duration_seconds(), c.work_area_start_seconds(), c.work_area_end_units), (None, None, None));
+    let _ = (c.frame_rate(), c.frame_rate_from_fixed(), c.background_rgb(), c.pixel_aspect_ratio(), c.frame_rate_exact());
+    assert_eq!(c.duration_frames(), Some(1));
+    let zero = CompHeader::parse(&[0; 204]).unwrap();
+    assert_eq!((zero.frame_rate(), zero.pixel_aspect_ratio(), zero.duration_seconds()), (None, None, None));
+    assert_eq!((zero.frame_rate_exact(), zero.duration_frames()), (None, None));
+    let all = LayerHeader::parse(&[0xff; 164]).unwrap();
+    let _ = (all.is_enabled(), all.is_auto_oriented(), all.light_type(), all.blend_mode.code());
+    assert_eq!(LayerHeader::parse(&[0u8; 164]).unwrap().light_type(), None);
+    assert_eq!(Rational { num: i64::MAX, den: i64::MIN }.reduced(), None);
+    assert_eq!(Rational { num: i64::MIN, den: i64::MIN }.reduced(), Rational::new(1, 1));
+    // A path whose point count is not a multiple of three, and non-finite box and scale.
+    let path = ShapePath { bbox: [f32::NAN, f32::INFINITY, f32::MIN, f32::MAX], closed_flag: 9, open: true, points: vec![[f32::NAN, 0.0]; 7] };
+    assert_eq!(path.vertex_count(), 2);
+    assert_eq!(path.vertices((f64::NAN, f64::MAX)).len(), 2);
+}
+
+/// Calls `f` on the body of every data chunk with this id, anywhere in the tree.
+fn for_each_body(chunks: &mut [Chunk<'static>], id: &[u8; 4], f: &mut dyn FnMut(&mut Vec<u8>), depth: usize) {
+    if depth > 70 {
+        return;
+    }
+    for chunk in chunks {
+        let this = chunk.id;
+        match &mut chunk.body {
+            Body::Data(d) if this == *id => f(d.to_mut()),
+            Body::Data(_) | Body::OpaqueList { .. } => {}
+            Body::Chunks(c) | Body::List { children: c, .. } => for_each_body(c, id, f, depth + 1),
+        }
+    }
+}
+
+#[test]
+fn hostile_keyframe_layouts_never_panic() {
+    // The property header selects the record template: every component count (0..=255) with the
+    // template flag at 0, 1 and 0xff, over keyframe lists of every record size in these fixtures.
+    for name in [
+        "204-key-ease-asymmetric.aep",
+        "206-key-scale-2key-linear.aep",
+        "208-key-mask-feather-2key-linear.aep",
+        "210-key-fill-color-2key-linear.aep",
+        "093-mask-path-2keys.aep",
+        "122-marker-comp-1s.aep",
+        "305-key-scale-bezier-ease.aep",
+        "306-key-maskfeather-bezier-ease.aep",
+        "307-key-fillcolor-bezier.aep",
+        "319-precomp-timeremap.aep",
+    ] {
+        let bytes = fixture!(name);
+        let original = parse(&bytes).unwrap().into_owned();
+        for components in 0..=255u8 {
+            for template in [0u8, 1, 0xff] {
+                let mut file = original.clone();
+                for_each_body(
+                    &mut file.chunks,
+                    b"tdb4",
+                    &mut |body| {
+                        if body.len() > 7 {
+                            body[3] = components;
+                            body[7] = template;
+                        }
+                    },
+                    0,
+                );
+                exercise(&file);
+            }
+        }
+    }
+}
+
+#[test]
+fn hostile_text_dictionaries_and_marker_headers_never_panic() {
+    // Damage the marker header (NmHd), the strings and the layer reference in many ways, and the
+    // opaque text lists.
+    for name in [
+        "245-text-box-400x200-Hello.aep",
+        "248-text-range-fill-red-1-3.aep",
+        "249-marker-layer-full.aep",
+        "220-fx-layercontrol-to-layer1.aep",
+        "334-text-box-right-align.aep",
+        "335-text-point-fauxbold.aep",
+        "340-text-range-two-styles.aep",
+        "349-marker-layer-event-cue-params.aep",
+        "321-fx-layercontrol-none.aep",
+        "324-fx-dropdown-5items-select3.aep",
+        "352-footage-pngseq-imported.aep",
+        "350-footage-wav-imported.aep",
+    ] {
+        let bytes = fixture!(name);
+        let original = parse(&bytes).unwrap().into_owned();
+        let mut rng = Rng(0x07e4_70dd_ba11 ^ bytes.len() as u64);
+        for _ in 0..300 {
+            let mut file = original.clone();
+            for id in [b"NmHd", b"Utf8", b"tdpi"] {
+                for_each_body(&mut file.chunks, id, &mut |body| damage(body, &mut rng), 0);
+            }
+            damage_tree(&mut file.chunks, &mut rng, 0);
+            exercise(&file);
+        }
+    }
+}
+
+#[test]
+fn extreme_values_in_the_batch_3_fields() {
+    use effectcraft_aep::{CompHeader, Footage, LayerHeader, Rational};
+    // Time stretch: zero and maximal numerators and denominators (bytes 8 and 108), with extreme times.
+    for (num, den) in [(0u32, 0u32), (1, 0), (0, 1), (u32::MAX, 1), (1, u32::MAX), (u32::MAX, u32::MAX), (3, 2)] {
+        let mut ldta = [0u8; 164];
+        ldta[8..12].copy_from_slice(&num.to_be_bytes());
+        ldta[108..112].copy_from_slice(&den.to_be_bytes());
+        ldta[12..16].copy_from_slice(&i32::MIN.to_be_bytes());
+        ldta[16..20].copy_from_slice(&1u32.to_be_bytes());
+        ldta[20..24].copy_from_slice(&i32::MAX.to_be_bytes());
+        ldta[24..28].copy_from_slice(&u32::MAX.to_be_bytes());
+        ldta[28..32].copy_from_slice(&i32::MIN.to_be_bytes());
+        ldta[32..36].copy_from_slice(&1u32.to_be_bytes());
+        let h = LayerHeader::parse(&ldta).unwrap();
+        let _ = (h.stretch_ratio(), h.stretch_percent(), h.in_point(), h.out_point(), h.in_point_seconds(), h.out_point_seconds());
+        if den == 0 {
+            assert_eq!((h.stretch_ratio(), h.in_point(), h.out_point()), (None, None, None));
+        }
+    }
+    // Display start and shutter phase from extreme bytes; a missing tail leaves them unknown.
+    for fill in [0x00u8, 0x7f, 0x80, 0xff] {
+        let c = CompHeader::parse(&[fill; 204]).unwrap();
+        let _ = (c.shutter_phase, c.display_start, c.display_start_seconds(), c.display_start_frame());
+    }
+    let zero_rate = CompHeader::parse(&[0; 204]).unwrap();
+    assert_eq!((zero_rate.display_start_seconds(), zero_rate.display_start_frame()), (None, None));
+    // Footage durations: zero denominator, negative and maximal numerators, a huge frame rate.
+    let base = Footage {
+        file_type: String::new(),
+        width: 0,
+        height: 0,
+        name: None,
+        is_solid: false,
+        solid_argb: None,
+        path: None,
+        duration: None,
+        native_frame_rate: 0,
+        bits_per_pixel: 0,
+        file_size: 0,
+        audio_sample_rate: None,
+        is_sequence: true,
+    };
+    for (num, den, rate) in [(3i64, 30i64, 30u32), (3, 0, 30), (-3, 30, 30), (i64::MAX, 1, u32::MAX), (i64::MIN, -1, u32::MAX), (1, i64::MAX, 1), (0, 1, 0)] {
+        let f = Footage { duration: Some(Rational { num, den }), native_frame_rate: rate, ..base.clone() };
+        let _ = f.sequence_frame_count();
+    }
+    assert_eq!(Footage { duration: Some(Rational { num: 3, den: 30 }), native_frame_rate: 30, ..base.clone() }.sequence_frame_count(), Some(3));
+    assert_eq!(Footage { duration: Some(Rational { num: 3, den: 0 }), native_frame_rate: 30, ..base.clone() }.sequence_frame_count(), None);
+    assert_eq!(Footage { duration: None, ..base }.sequence_frame_count(), None);
+}
diff --git a/crates/aep/tests/it/container/roundtrip.rs b/crates/aep/tests/it/container/roundtrip.rs
new file mode 100644
index 000000000..e6d7cba7a
--- /dev/null
+++ b/crates/aep/tests/it/container/roundtrip.rs
@@ -0,0 +1,130 @@
+//! Byte-identical round trip over the generated test projects as After Effects wrote them (the
+//! combined files, not the single-case projects cut from them), and the structural facts of the
+//! container.
+
+use std::collections::BTreeMap;
+
+use effectcraft_aep::{AepFile, Body, parse, write};
+
+/// The binary files of the fixture directory (the `.aepx` has its own tests).
+fn files() -> Vec<&'static str> {
+    crate::common::FILES.iter().copied().filter(|n| n.ends_with(".aep")).collect()
+}
+
+/// The bytes of a whole file; returns from the calling test when it is missing.
+macro_rules! file {
+    ($name:expr) => {
+        skip!(crate::common::try_file($name))
+    };
+}
+
+fn id(c: &[u8; 4]) -> String {
+    String::from_utf8_lossy(c).into_owned()
+}
+
+#[test]
+fn every_fixture_round_trips_byte_for_byte() {
+    for name in files() {
+        let bytes = file!(name);
+        let file = parse(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let back = write(&file).unwrap();
+        assert_eq!(back.len(), bytes.len(), "{name}: length");
+        assert!(back == bytes, "{name}: bytes differ");
+        // Owned copy round-trips too.
+        let owned: AepFile<'static> = file.into_owned();
+        assert!(write(&owned).unwrap() == bytes, "{name}: owned copy differs");
+    }
+}
+
+#[test]
+fn header_and_trailer_facts() {
+    for name in files() {
+        let bytes = file!(name);
+        assert_eq!(&bytes[..4], b"RIFX");
+        assert_eq!(&bytes[8..12], b"Egg!");
+        let declared = u32::from_be_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]) as usize;
+        let file = parse(&bytes).unwrap();
+        // The declared size ends before the end of the file; the rest is the XMP packet.
+        assert!(declared + 8 < bytes.len(), "{name}");
+        assert_eq!(file.trailer.len(), bytes.len() - declared - 8, "{name}");
+        assert!(file.trailer.starts_with(b"<?xpacket begin"), "{name}");
+        let xmp = file.xmp().unwrap_or_else(|| panic!("{name}: no xmp"));
+        assert!(xmp.starts_with(b"<?xpacket begin") && xmp.ends_with(b"?>"), "{name}");
+        assert!(std::str::from_utf8(xmp).is_ok(), "{name}: xmp is UTF-8");
+    }
+}
+
+#[test]
+fn top_level_chunks_of_the_base_project() {
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let ids: Vec<String> = file.chunks.iter().map(|c| if c.id == *b"LIST" { format!("LIST {}", id(&c.list_type().unwrap())) } else { id(&c.id) }).collect();
+    // The first chunks, in file order (observed in every generated file).
+    assert_eq!(&ids[..3], ["svap", "head", "nhed"]);
+    assert!(ids.iter().any(|i| i == "LIST Fold"), "{ids:?}");
+    // Chunk offsets are 2-byte aligned and every id is 4 printable ASCII bytes.
+    for (_, c) in file.walk() {
+        assert!(c.id.iter().all(|b| (0x20..0x7f).contains(b)), "{:?}", c.id);
+    }
+}
+
+#[test]
+fn nesting_depth_is_below_the_limit() {
+    for name in files() {
+        let bytes = file!(name);
+        let file = parse(&bytes).unwrap();
+        let max = file.walk().map(|(d, _)| d).max().unwrap();
+        assert!(max <= 13, "{name}: depth {max}");
+        // Nothing is kept opaque because of the depth limit.
+        assert!(max < 64);
+    }
+}
+
+#[test]
+fn nested_chunk_ids_hold_one_utf8_chunk() {
+    let mut nested = BTreeMap::<String, usize>::new();
+    for name in files() {
+        let bytes = file!(name);
+        let file = parse(&bytes).unwrap();
+        for (_, c) in file.walk() {
+            if matches!(c.body, Body::Chunks(_)) {
+                *nested.entry(id(&c.id)).or_default() += 1;
+                // Each holds exactly one Utf8 chunk.
+                assert_eq!(c.children().len(), 1);
+                assert_eq!(c.children()[0].id, *b"Utf8");
+            }
+        }
+    }
+    assert!(nested.contains_key("tdsn"), "{nested:?}");
+}
+
+#[test]
+fn raw_text_lists_are_kept_opaque() {
+    // LIST btdk holds raw text, not chunks (observed once a project has a text layer).
+    let bytes = fixture!("110-text-A.aep");
+    let file = parse(&bytes).unwrap();
+    let mut found = 0;
+    for (_, c) in file.walk() {
+        if let Body::OpaqueList { list_type, data } = &c.body {
+            assert!(!data.is_empty());
+            if list_type == b"btdk" {
+                found += 1;
+                assert!(data.iter().all(|b| b.is_ascii() || *b >= 0x80), "btdk is text");
+            }
+        }
+    }
+    assert!(found >= 1, "expected a LIST btdk kept opaque");
+}
+
+#[test]
+fn list_types_ending_in_a_space_are_kept() {
+    // `LIST Pin ` and `LIST FEE ` occur in every generated project that has an item (all but the
+    // empty one); the space is part of the type.
+    for name in files().into_iter().filter(|n| *n != "empty.aep") {
+        let bytes = file!(name);
+        let file = parse(&bytes).unwrap();
+        for ty in [b"Pin ", b"FEE "] {
+            assert!(file.walk().any(|(_, c)| c.is_list(ty)), "{name}: no LIST {:?}", String::from_utf8_lossy(ty));
+        }
+    }
+}
diff --git a/crates/aep/tests/it/container/shapes.rs b/crates/aep/tests/it/container/shapes.rs
new file mode 100644
index 000000000..cf5ff9298
--- /dev/null
+++ b/crates/aep/tests/it/container/shapes.rs
@@ -0,0 +1,128 @@
+//! Shape layers: rectangle, fill, stroke, rounded corners, custom path, gradient fill and group
+//! position, checked against the values the corpus was made with (its MANIFEST, batch 2). The shape
+//! layer `S` is on top of the solid `L`; its group is `Group 1`.
+
+use crate::container::helpers::{assert_near, first_comp, layer_named, open};
+use effectcraft_aep::{LayerType, Project, ShapeGroup, ShapeItem, StrokeCap, StrokeJoin, ValueSource};
+
+fn groups(name: &str) -> Option<Vec<ShapeGroup>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = layer_named(&first_comp(&project), "S");
+        let h = layer.header().unwrap();
+        assert_eq!(h.layer_type, LayerType::Shape, "{name}");
+        assert!(h.collapses_transformations(), "{name}: shape layers have the collapse switch from creation");
+        layer.shape_groups()
+    })
+}
+
+fn only_group(name: &str) -> Option<ShapeGroup> {
+    Some({
+        let mut g = groups(name)?;
+        assert_eq!(g.len(), 1, "{name}");
+        g.remove(0)
+    })
+}
+
+fn rect_size(item: &ShapeItem) -> [f64; 2] {
+    let ShapeItem::Rect { name, size } = item else { panic!("{item:?}") };
+    assert_eq!(name.as_deref(), Some("Rectangle Path 1"));
+    let size = size.expect("rect size");
+    assert_eq!(size.source, ValueSource::Stored);
+    size.value
+}
+
+#[test]
+fn rectangle_fill_and_rounded_corners() {
+    // 238: Rectangle Path 400x300, Fill [0,1,0], Round Corners radius 20 (in this order).
+    let g = skip!(only_group("238-shape-rect-rounded-corners.aep"));
+    assert_eq!(g.name.as_deref(), Some("Group 1"));
+    assert_eq!((g.position.value, g.position.source), ([0.0, 0.0], ValueSource::Default));
+    assert_eq!(g.items.len(), 3);
+    assert_eq!(rect_size(&g.items[0]), [400.0, 300.0]);
+    let ShapeItem::Fill { name, color } = &g.items[1] else { panic!("{:?}", g.items[1]) };
+    assert_eq!(name.as_deref(), Some("Fill 1"));
+    assert_eq!(color.unwrap().value, [1.0, 0.0, 1.0, 0.0]);
+    let ShapeItem::RoundCorners { name, radius } = &g.items[2] else { panic!("{:?}", g.items[2]) };
+    assert_eq!(name.as_deref(), Some("Round Corners 1"));
+    assert_eq!(radius.unwrap().value, 20.0);
+}
+
+#[test]
+fn stroke_colour_width_cap_and_join() {
+    // 239: Stroke [0,1,0] width 8, Line Cap 2 (round), Line Join 2 (round); no Fill.
+    let g = skip!(only_group("239-shape-stroke-green-w8-round.aep"));
+    assert_eq!(g.items.len(), 2);
+    assert_eq!(rect_size(&g.items[0]), [400.0, 300.0]);
+    let ShapeItem::Stroke { name, stroke } = &g.items[1] else { panic!("{:?}", g.items[1]) };
+    assert_eq!(name.as_deref(), Some("Stroke 1"));
+    assert_eq!(stroke.color.unwrap().value, [1.0, 0.0, 1.0, 0.0]);
+    assert_eq!(stroke.width.unwrap().value, 8.0);
+    assert_eq!((stroke.cap.value, stroke.cap.source), (StrokeCap::Round, ValueSource::Stored));
+    assert_eq!((stroke.join.value, stroke.join.source), (StrokeJoin::Round, ValueSource::Stored));
+    // Touching the join stores the miter limit in its default state (4).
+    assert_eq!(stroke.miter_limit.unwrap().value, 4.0);
+    assert!(!g.items.iter().any(|i| matches!(i, ShapeItem::Fill { .. })));
+}
+
+#[test]
+fn custom_path_with_tangents_in_pixels() {
+    // 240: Path 1, closed, vertices [0,-100] [100,100] [-100,100], inTangents [-10,-20] [30,20] [-60,10],
+    // outTangents [40,0] [-20,30] [0,-50] (the box of vertices and handles is -160,-120,130,130), then a Fill.
+    let g = skip!(only_group("240-shape-custom-path-tangents.aep"));
+    assert_eq!(g.items.len(), 2);
+    let ShapeItem::Path { name, paths } = &g.items[0] else { panic!("{:?}", g.items[0]) };
+    assert_eq!(name.as_deref(), Some("Path 1"));
+    assert_eq!(paths.len(), 1);
+    let p = &paths[0];
+    assert!(!p.open);
+    assert_near(&p.bbox.map(f64::from), &[-160.0, -120.0, 130.0, 130.0], 1e-6);
+    let v = p.vertices((1.0, 1.0));
+    let positions: Vec<[f64; 2]> = v.iter().map(|x| x.position).collect();
+    let in_t: Vec<[f64; 2]> = v.iter().map(|x| x.in_tangent()).collect();
+    let out_t: Vec<[f64; 2]> = v.iter().map(|x| x.out_tangent()).collect();
+    for (got, want) in positions.iter().zip([[0.0, -100.0], [100.0, 100.0], [-100.0, 100.0]]) {
+        assert_near(got, &want, 1e-3);
+    }
+    for (got, want) in in_t.iter().zip([[-10.0, -20.0], [30.0, 20.0], [-60.0, 10.0]]) {
+        assert_near(got, &want, 1e-3);
+    }
+    for (got, want) in out_t.iter().zip([[40.0, 0.0], [-20.0, 30.0], [0.0, -50.0]]) {
+        assert_near(got, &want, 1e-3);
+    }
+    assert!(matches!(g.items[1], ShapeItem::Fill { .. }));
+}
+
+#[test]
+fn gradient_fill_start_and_end() {
+    // 241: Gradient Fill 1 (linear), start [-200,0], end [200,0] in pixels; type and stops are not stored.
+    let g = skip!(only_group("241-shape-gradient-fill-linear.aep"));
+    assert_eq!(g.items.len(), 2);
+    assert_eq!(rect_size(&g.items[0]), [400.0, 300.0]);
+    let ShapeItem::GradientFill { name, start, end } = &g.items[1] else { panic!("{:?}", g.items[1]) };
+    assert_eq!(name.as_deref(), Some("Gradient Fill 1"));
+    assert_eq!(start.unwrap().value, [-200.0, 0.0]);
+    assert_eq!(end.unwrap().value, [200.0, 0.0]);
+}
+
+#[test]
+fn group_position() {
+    // 242: Group 1 / Transform / Position [0,0] -> [50,50]; the contents are unchanged.
+    let g = skip!(only_group("242-shape-group-position-50-50.aep"));
+    assert_eq!((g.position.value, g.position.source), ([50.0, 50.0], ValueSource::Stored));
+    assert_eq!(g.items.len(), 2);
+    assert_eq!(rect_size(&g.items[0]), [400.0, 300.0]);
+    assert!(matches!(g.items[1], ShapeItem::Fill { .. }));
+}
+
+#[test]
+fn other_layers_have_no_shape_groups() {
+    let bytes = fixture!("238-shape-rect-rounded-corners.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let solid = comp.layers().find(|l| l.header().is_some_and(|h| h.layer_type == LayerType::Av)).unwrap();
+    assert!(solid.shape_groups().is_empty());
+}
diff --git a/crates/aep/tests/it/container/text_fields.rs b/crates/aep/tests/it/container/text_fields.rs
new file mode 100644
index 000000000..6c08d8993
--- /dev/null
+++ b/crates/aep/tests/it/container/text_fields.rs
@@ -0,0 +1,209 @@
+//! Text document fields used by the importer: stroke colour, automatic leading, the font of each
+//! run, the undecoded-slot check, damaged runs, the Source Text record and the text anchor rule.
+
+use crate::container::helpers::{first_comp, layer_named, open};
+use effectcraft_aep::{Caps, LayerType, Project, TextDocument, ValueSource};
+
+/// Every synthetic text case that has a fixture, with its text.
+const CASES: &[(&str, &str)] = &[
+    ("110-text-A.aep", "A"),
+    ("113-text-Hello-size60-fillorange.aep", "Hello"),
+    ("114-text-animator-opacity.aep", "Hello"),
+    ("243-text-multiline-A-CR-B.aep", "A\rB"),
+    ("245-text-box-400x200-Hello.aep", "Hello"),
+    ("246-text-box-center-align.aep", "Hello"),
+    ("247-text-tracking-100.aep", "Hello"),
+    ("248-text-range-fill-red-1-3.aep", "Hello"),
+    ("334-text-box-right-align.aep", "Hello"),
+    ("335-text-point-fauxbold.aep", "Hello"),
+    ("336-text-point-fauxitalic.aep", "Hello"),
+    ("337-text-point-allcaps.aep", "Hello"),
+    ("338-text-point-smallcaps.aep", "Hello"),
+    ("339-text-point-leading60.aep", "Hello"),
+    ("340-text-range-two-styles.aep", "Hello"),
+    ("385-text-anchor-10-20.aep", "A"),
+    ("386-text-etx-A-B.aep", "A\u{3}B"),
+];
+
+fn doc(name: &str) -> Option<TextDocument> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        layer_named(&first_comp(&project), "T").text_document().unwrap_or_else(|| panic!("{name}: no text document"))
+    })
+}
+
+/// The raw `btdk` body of the text layer of a fixture.
+fn body(name: &str) -> Option<Vec<u8>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let layer = layer_named(&comp, "T");
+        layer.chunk().find_list(b"btdk").and_then(|c| c.bytes()).unwrap().to_vec()
+    })
+}
+
+fn replace_once(hay: &[u8], from: &[u8], to: &[u8]) -> Vec<u8> {
+    replace_after(hay, b"", from, to)
+}
+
+/// Replaces the first `from` after the first `anchor` (the run style of 244 starts with
+/// `/0 0 /1 100.0`; the document's style sheet before it has the same slots).
+fn replace_after(hay: &[u8], anchor: &[u8], from: &[u8], to: &[u8]) -> Vec<u8> {
+    let start = if anchor.is_empty() { 0 } else { hay.windows(anchor.len()).position(|w| w == anchor).unwrap() };
+    let at = start + hay[start..].windows(from.len()).position(|w| w == from).unwrap_or_else(|| panic!("{:?} not found", String::from_utf8_lossy(from)));
+    [&hay[..at], to, &hay[at + from.len()..]].concat()
+}
+
+#[test]
+fn every_sample_is_complete_and_has_only_decoded_slots_changed() {
+    for (name, text) in CASES {
+        let d = skip!(doc(name));
+        assert_eq!(d.text, *text, "{name}");
+        assert_eq!(d.incomplete_runs, 0, "{name}");
+        assert!(d.undecoded_style_fields.is_empty(), "{name}: {:?}", d.undecoded_style_fields);
+        assert!(d.undecoded_paragraph_fields.is_empty(), "{name}: {:?}", d.undecoded_paragraph_fields);
+        assert_eq!(d.style_runs.iter().map(|r| r.length).sum::<usize>(), d.raw_text.chars().count(), "{name}");
+        for run in &d.style_runs {
+            // No sample has automatic leading: the stored leading is used (98 by default).
+            assert!(!run.auto_leading, "{name}");
+            // The stroke colour is white in every sample (no stroke was sampled).
+            assert_eq!(run.stroke_argb, Some([1.0; 4]), "{name}");
+            assert_eq!(d.font_of(run), Some("TimesNewRomanPSMT"), "{name}");
+        }
+    }
+}
+
+#[test]
+fn stored_leading_and_font_of_a_run() {
+    assert_eq!(skip!(doc("243-text-multiline-A-CR-B.aep")).style_runs[0].leading, Some(98.0));
+    assert_eq!(skip!(doc("339-text-point-leading60.aep")).style_runs[0].leading, Some(60.0));
+    // 335: faux bold moves the run to font index 1, which is still Times New Roman.
+    let d = skip!(doc("335-text-point-fauxbold.aep"));
+    assert_eq!((d.style_runs[0].font_index, d.font_of(&d.style_runs[0])), (1, Some("TimesNewRomanPSMT")));
+}
+
+#[test]
+fn automatic_leading_is_slot_4() {
+    let b = replace_once(&skip!(body("110-text-A.aep")), b"/4 false /5 98.0", b"/4 true /5 98.0");
+    let d = TextDocument::parse(&b).unwrap();
+    assert!(d.style_runs[0].auto_leading);
+    assert!(d.undecoded_style_fields.is_empty());
+}
+
+#[test]
+fn automatic_leading_as_after_effects_stores_it() {
+    // 400: Auto Leading switched on for 387's "A" CR "B" (size 100, explicit leading 98 before).
+    // Against its unedited save 399 the run style differs in `/4` (true) and `/5` (0.01) only, and
+    // the composed second line sits 120 px (1.2 x 100) below the first, as After Effects measures.
+    let d = skip!(doc("400-text-autoleading-on.aep"));
+    assert_eq!(d.text, "A\rB");
+    assert_eq!(d.incomplete_runs, 0);
+    assert!(d.undecoded_style_fields.is_empty(), "{:?}", d.undecoded_style_fields);
+    assert!(d.undecoded_paragraph_fields.is_empty(), "{:?}", d.undecoded_paragraph_fields);
+    for run in &d.style_runs {
+        assert!(run.auto_leading);
+        assert_eq!((run.font_size, run.leading), (100.0, Some(0.01)));
+    }
+    let b = skip!(body("400-text-autoleading-on.aep"));
+    let text = String::from_utf8_lossy(&b);
+    assert!(text.contains("/0 << /0 [ 0.0 120.00001 ] >>"), "composed second baseline at 120 px");
+}
+
+#[test]
+fn undecoded_slots_that_differ_are_listed() {
+    let src = skip!(body("110-text-A.aep"));
+    // Style slot 68 and paragraph slot 24 changed to values outside their neutral ones (0 and 1,
+    // 732, 734); a zero slot the samples lack (93) is not listed.
+    const RUN: &[u8] = b"/0 0 /1 100.0";
+    let b = replace_after(&src, RUN, b"/68 0 ", b"/68 2 ");
+    let b = replace_after(&b, RUN, b"/96 true >>", b"/93 0.0 /94 0.0 /96 true >>");
+    // The run's paragraph is the one with `/22 1 /23 true` (the style sheet's has `/22 0`).
+    let para = b"/20 6 /21 false /22 1 /23 true /24 1";
+    let b = replace_once(&b, para, b"/20 6 /21 false /22 1 /23 true /24 2");
+    let d = TextDocument::parse(&b).unwrap();
+    assert_eq!(d.undecoded_style_fields, ["68"]);
+    assert_eq!(d.undecoded_paragraph_fields, ["24"]);
+    // A non-zero unknown slot is listed.
+    let d = TextDocument::parse(&replace_after(&src, RUN, b"/96 true >>", b"/97 2 /96 true >>")).unwrap();
+    assert_eq!(d.undecoded_style_fields, ["97"]);
+    // `/nil` is the stored form of a slot without a value (244 has three): not listed.
+    let d = TextDocument::parse(&replace_once(&src, b"/22 1 /23 true /24 1", b"/22 1 /23 true /24 1 /48 /nil")).unwrap();
+    assert!(d.undecoded_paragraph_fields.is_empty(), "{:?}", d.undecoded_paragraph_fields);
+}
+
+#[test]
+fn a_damaged_run_is_kept_and_counted() {
+    // 340 has three runs; the size of the third (60) is removed: the run stays and takes the size of
+    // the one before it.
+    let src = skip!(body("340-text-range-two-styles.aep"));
+    let at = src.windows(b"/1 60.0".len()).position(|w| w == b"/1 60.0").unwrap();
+    let b = [&src[..at], &src[at + b"/1 60.0".len()..]].concat();
+    let d = TextDocument::parse(&b).unwrap();
+    assert_eq!(d.style_runs.len(), 3);
+    assert_eq!(d.incomplete_runs, 1);
+    assert_eq!(d.style_runs[2].font_size, 100.0);
+    assert_eq!(d.style_runs[2].fill_argb, [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(d.style_runs[2].caps, Caps::Normal);
+}
+
+#[test]
+fn source_text_record_and_text_anchor() {
+    for name in ["110-text-A.aep", "114-text-animator-opacity.aep", "248-text-range-fill-red-1-3.aep"] {
+        let bytes = fixture!(name);
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let t = layer_named(&comp, "T");
+        assert_eq!(t.header().unwrap().layer_type, LayerType::Text);
+        let st = t.source_text_property().expect("source text record");
+        assert!(!st.is_animated() && st.expression().is_none(), "{name}");
+        assert_eq!(t.text_document_count(), 1, "{name}");
+        // The text anchor is absent: the text origin, not the centre of a source.
+        let tr = t.transform(1920, 1080).unwrap();
+        assert_eq!(tr.anchor_fraction.source, ValueSource::Default, "{name}");
+        assert_eq!(tr.text_anchor_px(), [0.0; 3], "{name}");
+        assert_eq!(tr.position.value, [960.0, 540.0, 0.0], "{name}");
+    }
+}
+
+#[test]
+fn a_stored_text_anchor_is_pixels() {
+    // 385: 110's text layer with Anchor Point [10, 20], stored as pixels (a text layer has no source).
+    let bytes = fixture!("385-text-anchor-10-20.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let tr = layer_named(&comp, "T").transform(1920, 1080).unwrap();
+    assert_eq!(tr.anchor_fraction.source, ValueSource::Stored);
+    assert_eq!(tr.text_anchor_px(), [10.0, 20.0, 0.0]);
+    assert_eq!(tr.position.value, [960.0, 540.0, 0.0]);
+}
+
+#[test]
+fn etx_is_stored_as_it_is_and_splits_the_paragraph_runs() {
+    // 386: "A" U+0003 "B" is stored with the U+0003; After Effects lays it out like 243's CR (two
+    // lines, two paragraphs), and the paragraph runs say the same.
+    let etx = skip!(doc("386-text-etx-A-B.aep"));
+    let cr = skip!(doc("243-text-multiline-A-CR-B.aep"));
+    assert_eq!(etx.raw_text, "A\u{3}B\r");
+    assert_eq!(etx.paragraphs.len(), cr.paragraphs.len());
+    assert_eq!(etx.paragraphs.iter().map(|p| p.length).collect::<Vec<_>>(), cr.paragraphs.iter().map(|p| p.length).collect::<Vec<_>>());
+}
+
+#[test]
+fn hostile_documents_never_panic() {
+    let src = skip!(body("340-text-range-two-styles.aep"));
+    // Every prefix, a run length that overflows, a string with a lone surrogate, deep nesting.
+    for cut in (0..src.len()).step_by(97) {
+        let _ = TextDocument::parse(&src[..cut]);
+    }
+    let _ = TextDocument::parse(&replace_once(&src, b"/1 3 >>", b"/1 99999999999999999999 >>"));
+    let lone = [b"/1 << /1 [ << /0 << /0 (".as_slice(), &[0xfe, 0xff, 0xd8, 0x00, 0x00, b'A'], b") >> >> ] >>"].concat();
+    let _ = TextDocument::parse(&lone);
+    let deep = [b"/1 ".as_slice(), &b"<< /0 ".repeat(10_000), &b">> ".repeat(10_000)].concat();
+    assert!(TextDocument::parse(&deep).is_none());
+}
diff --git a/crates/aep/tests/it/container/text_markers_footage.rs b/crates/aep/tests/it/container/text_markers_footage.rs
new file mode 100644
index 000000000..9517c0453
--- /dev/null
+++ b/crates/aep/tests/it/container/text_markers_footage.rs
@@ -0,0 +1,275 @@
+//! Text documents, markers and footage items, checked against the values the corpus was made
+//! with (its MANIFEST).
+
+use crate::container::helpers::{base_layer, first_comp, open};
+use effectcraft_aep::{CueType, ItemKind, KeyframeKind, LayerType, Marker, Project, Property, TextDocument, TextValue, parse_text_dict};
+
+fn text_layer_document(name: &str) -> Option<TextDocument> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let layer = comp.layers().find(|l| l.name().as_deref() == Some("T")).expect("the text layer T");
+        let h = layer.header().unwrap();
+        assert_eq!(h.layer_type, LayerType::Text);
+        assert!(h.name_is_user_set());
+        layer.text_document().expect("text document")
+    })
+}
+
+#[test]
+fn text_a_with_the_defaults() {
+    // 110: point text "A": Times New Roman (TimesNewRomanPSMT), size 100, white fill.
+    let d = skip!(text_layer_document("110-text-A.aep"));
+    assert_eq!(d.text, "A");
+    assert_eq!(d.raw_text, "A\r");
+    assert_eq!(d.font_size, 100.0);
+    assert_eq!(d.fill_argb, [1.0, 1.0, 1.0, 1.0]);
+    assert_eq!(d.fill_rgb(), [1.0, 1.0, 1.0]);
+    assert_eq!(d.font.as_deref(), Some("TimesNewRomanPSMT"));
+    assert!(d.fonts.iter().any(|f| f == "TimesNewRomanPSMT"));
+}
+
+#[test]
+fn text_hello_size_60_orange() {
+    // 113 (chain 111-113): text "Hello", fontSize 60, fillColor [1, 0.5, 0].
+    let d = skip!(text_layer_document("113-text-Hello-size60-fillorange.aep"));
+    assert_eq!(d.text, "Hello");
+    assert_eq!(d.font_size, 60.0);
+    assert_eq!(d.fill_rgb(), [1.0, 0.5, 0.0]);
+    assert_eq!(d.font.as_deref(), Some("TimesNewRomanPSMT"));
+}
+
+#[test]
+fn a_solid_layer_has_no_text_document() {
+    let bytes = fixture!("000-base.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    assert!(base_layer(&first_comp(&project)).text_document().is_none());
+}
+
+#[test]
+fn text_dictionary_parser() {
+    // Names, numbers, booleans, nested dictionaries and arrays, a UTF-16BE string with an escaped
+    // parenthesis, a string without a byte order mark.
+    let mut doc = Vec::new();
+    doc.extend_from_slice(b"/0 << /a 1 /b -2.5 /c true /d [ 1 2.0 /x ] >>\n/1 (");
+    doc.extend_from_slice(&[0xfe, 0xff, 0x00, b'H', 0x00, 0x69, 0x00, 0x5c, b')', 0x00, 0x21]);
+    doc.extend_from_slice(b")\n/2 (plain) /3 word");
+    let top = parse_text_dict(&doc);
+    assert_eq!(top.get("0").unwrap().get("a"), Some(&TextValue::Int(1)));
+    assert_eq!(top.get("0").unwrap().get("b"), Some(&TextValue::Float(-2.5)));
+    assert_eq!(top.get("0").unwrap().get("c"), Some(&TextValue::Bool(true)));
+    let d = top.get("0").unwrap().get("d").unwrap();
+    assert_eq!((d.at(0), d.at(1), d.at(2)), (Some(&TextValue::Int(1)), Some(&TextValue::Float(2.0)), Some(&TextValue::Name("x".to_string()))));
+    // The byte after a backslash is kept literally: the units are 0x0048 0x0069 0x0029 0x0021.
+    assert_eq!(top.get("1").and_then(TextValue::as_str), Some("Hi)!"));
+    assert_eq!(top.get("2"), Some(&TextValue::Bytes(b"plain".to_vec())));
+    assert_eq!(top.get("3"), Some(&TextValue::Token("word".to_string())));
+}
+
+#[test]
+fn text_dictionary_parser_survives_garbage() {
+    // Unbalanced brackets, a string that never ends, nothing, binary junk, 100 levels of nesting.
+    for body in [&b"<< /a"[..], b"[ 1 2", b"(abc", b"(abc\\", b"", b">>", b")", b"/a <<", &[0xff, 0xfe, 0x00, 0x80, 0x28]] {
+        let _ = parse_text_dict(body);
+    }
+    let deep = [b"/k ".as_slice(), &b"[".repeat(100), &b"]".repeat(100)].concat();
+    let top = parse_text_dict(&deep);
+    // Nesting beyond the limit stops the parse; nothing was read for the key.
+    assert_eq!(top, TextValue::Dict(Vec::new()));
+    let ok = [b"/k ".as_slice(), &b"[".repeat(10), &b"]".repeat(10)].concat();
+    assert!(matches!(parse_text_dict(&ok), TextValue::Dict(p) if p.len() == 1));
+    // A body that is not a text document yields no document.
+    assert_eq!(TextDocument::parse(b"/0 1 /1 2"), None);
+}
+
+// ------------------------------------------------------------------------------------- markers
+
+#[test]
+fn comp_marker() {
+    // 122: a composition marker at 1 s with the comment "CompMarker".
+    let bytes = fixture!("122-marker-comp-1s.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    assert_eq!(
+        comp.markers(),
+        [Marker {
+            time_units: 25600,
+            seconds: Some(1.0),
+            comment: "CompMarker".to_string(),
+            duration_seconds: Some(0.0),
+            label: Some(0),
+            cue_type: Some(CueType::Event),
+            ..Marker::default()
+        }]
+    );
+    // The times are 16-byte records of the property inside `mrst`.
+    let mrst = comp.item().chunk().child_list(b"SecL").unwrap().find_list(b"mrst").unwrap();
+    let keys = Property::from_chunk(mrst.child_list(b"tdbs").unwrap()).unwrap().keys().unwrap();
+    assert_eq!((keys.len(), keys.header.record_size), (1, 16));
+    assert!(keys.keyframes().all(|k| k.kind() == KeyframeKind::Marker));
+    // The layer has none.
+    assert!(base_layer(&comp).markers().is_empty());
+}
+
+#[test]
+fn layer_marker() {
+    // 123: a marker on L at 1 s, comment "LayerMarker".
+    let bytes = fixture!("123-marker-layer-1s.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    assert_eq!(
+        base_layer(&comp).markers(),
+        [Marker {
+            time_units: 25600,
+            seconds: Some(1.0),
+            comment: "LayerMarker".to_string(),
+            duration_seconds: Some(0.0),
+            label: Some(0),
+            cue_type: Some(CueType::Event),
+            ..Marker::default()
+        }]
+    );
+    assert!(comp.markers().is_empty());
+}
+
+#[test]
+fn no_markers_in_the_base() {
+    let bytes = fixture!("000-base.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    assert!(comp.markers().is_empty());
+    assert!(base_layer(&comp).markers().is_empty());
+}
+
+// ------------------------------------------------------------------------------------- footage
+
+#[test]
+fn solid_footage_item() {
+    // The base solid L: red [1,0,0], 1920x1080 (ARGB floats 1, 1, 0, 0).
+    let bytes = fixture!("000-base.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let solid = project.item_by_id(0x1a).unwrap();
+    assert_eq!(solid.kind(), Some(ItemKind::Footage));
+    let f = solid.footage().unwrap();
+    assert!(f.is_solid);
+    assert_eq!(f.file_type, "Soli");
+    assert_eq!((f.width, f.height), (1920, 1080));
+    assert_eq!(f.name.as_deref(), Some("L"));
+    assert_eq!(f.solid_argb, Some([1.0, 1.0, 0.0, 0.0]));
+    assert_eq!(f.solid_rgb(), Some([1.0, 0.0, 0.0]));
+    assert_eq!(f.path, None);
+    assert_eq!(solid.name(), None);
+    assert_eq!(solid.label(), Some(1));
+    // A composition is not footage.
+    assert!(first_comp(&project).item().footage().is_none());
+}
+
+#[test]
+fn png_footage_layer() {
+    // 126: the png test8x8.png (8x8) imported and used for a layer "png" (label 5).
+    let bytes = fixture!("126-footage-png-layer.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let layer = comp.layers().find(|l| l.name().as_deref() == Some("png")).unwrap();
+    let h = layer.header().unwrap();
+    assert_eq!((h.label, h.layer_type), (5, LayerType::Av));
+    let item = project.layer_source(&layer).unwrap();
+    assert_eq!(item.kind(), Some(ItemKind::Footage));
+    let f = item.footage().unwrap();
+    assert!(!f.is_solid);
+    assert_eq!(f.file_type, "png!");
+    assert_eq!((f.width, f.height), (8, 8));
+    assert_eq!(f.name.as_deref(), Some("test8x8.png"));
+    assert_eq!(f.solid_argb, None);
+    // The path comes from the alias JSON (the fixture holds a neutral replacement of the original).
+    assert!(f.path.as_deref().is_some_and(|p| p.ends_with("test8x8.png")), "{:?}", f.path);
+    assert_eq!(project.layer_source_size(&layer), Some((8, 8)));
+    assert_eq!(project.layer_display_name(&layer).as_deref(), Some("png"));
+    // L is still there below it.
+    assert_eq!(comp.layers().count(), 2);
+}
+
+// ---------------------------------------------------------------------------- batch 2
+
+use effectcraft_aep::Justification;
+
+#[test]
+fn multi_line_text_is_paragraphs_separated_by_cr() {
+    // 243: point text `A\rB`: stored `A\rB\r`, two paragraph runs of 2 characters, one style run of 4.
+    let d = skip!(text_layer_document("243-text-multiline-A-CR-B.aep"));
+    assert_eq!(d.raw_text, "A\rB\r");
+    assert_eq!(d.text, "A\rB");
+    assert_eq!(d.paragraph_texts(), ["A", "B"]);
+    assert_eq!(d.paragraphs.iter().map(|p| p.length).collect::<Vec<_>>(), [2, 2]);
+    assert!(d.paragraphs.iter().all(|p| p.justification == Justification::Left));
+    assert_eq!(d.style_runs.iter().map(|r| r.length).collect::<Vec<_>>(), [4]);
+    assert_eq!(d.text_box, None);
+}
+
+#[test]
+fn paragraph_box_text_and_justification() {
+    // 245: paragraph (box) text `Hello` in a 400x200 box, top-left [-200,-100] in layer space, left aligned.
+    let d = skip!(text_layer_document("245-text-box-400x200-Hello.aep"));
+    assert_eq!(d.text, "Hello");
+    let b = d.text_box.expect("box text has a frame");
+    assert_eq!((b.x, b.y, b.width, b.height), (-200.0, -100.0, 400.0, 200.0));
+    assert_eq!(d.paragraphs.iter().map(|p| (p.length, p.justification)).collect::<Vec<_>>(), [(6, Justification::Left)]);
+    // 246: the same box with the justification changed from left to centre; only the justification differs.
+    let d = skip!(text_layer_document("246-text-box-center-align.aep"));
+    assert_eq!(d.paragraphs.iter().map(|p| (p.length, p.justification)).collect::<Vec<_>>(), [(6, Justification::Center)]);
+    let b = d.text_box.expect("box text has a frame");
+    assert_eq!((b.x, b.y, b.width, b.height), (-200.0, -100.0, 400.0, 200.0));
+    // Point text has no frame.
+    assert_eq!(skip!(text_layer_document("247-text-tracking-100.aep")).text_box, None);
+}
+
+#[test]
+fn tracking_and_style_ranges() {
+    // 247: point text `Hello`, tracking 0 -> 100 for the whole document.
+    let d = skip!(text_layer_document("247-text-tracking-100.aep"));
+    assert_eq!(d.text, "Hello");
+    assert_eq!(d.style_runs.iter().map(|r| (r.length, r.tracking)).collect::<Vec<_>>(), [(6, 100.0)]);
+    // 243 has the default tracking 0.
+    assert_eq!(skip!(text_layer_document("243-text-multiline-A-CR-B.aep")).style_runs[0].tracking, 0.0);
+    // 248: characters [1,3) ("el") filled red [1,0,0], the rest white: the style runs split into 1, 2 and 3 characters.
+    let d = skip!(text_layer_document("248-text-range-fill-red-1-3.aep"));
+    assert_eq!(d.style_runs.iter().map(|r| r.length).collect::<Vec<_>>(), [1, 2, 3]);
+    assert_eq!(d.style_runs.iter().map(|r| r.fill_argb).collect::<Vec<_>>(), [[1.0; 4], [1.0, 1.0, 0.0, 0.0], [1.0; 4]]);
+    assert_eq!(d.paragraphs.iter().map(|p| p.length).collect::<Vec<_>>(), [6]);
+    assert!(d.style_runs.iter().all(|r| r.font_size == 100.0 && r.tracking == 0.0));
+}
+
+#[test]
+fn marker_with_duration_and_all_strings() {
+    // 249: a layer marker on L at 1 s: comment `LM`, duration 1 s, chapter `Chap`, URL `http://a.example/u`,
+    // frame target `_blank`, cue point `CueX`.
+    let bytes = fixture!("249-marker-layer-full.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let comp = first_comp(&project);
+    let markers = base_layer(&comp).markers();
+    assert_eq!(
+        markers,
+        [Marker {
+            time_units: 25600,
+            seconds: Some(1.0),
+            comment: "LM".to_string(),
+            duration_seconds: Some(1.0),
+            chapter: "Chap".to_string(),
+            url: "http://a.example/u".to_string(),
+            frame_target: "_blank".to_string(),
+            cue_point_name: "CueX".to_string(),
+            label: Some(0),
+            cue_type: Some(effectcraft_aep::CueType::Event),
+            cue_params: Vec::new(),
+        }]
+    );
+}
diff --git a/crates/aep/tests/it/container/text_style_slots.rs b/crates/aep/tests/it/container/text_style_slots.rs
new file mode 100644
index 000000000..d2e938200
--- /dev/null
+++ b/crates/aep/tests/it/container/text_style_slots.rs
@@ -0,0 +1,153 @@
+//! Character and paragraph slots of the text document, each found with one scripted change
+//! against the reference point text 538 (`HHHH`, Times New Roman 100 px, normal baseline).
+
+use crate::container::helpers::{first_comp, layer_named, open};
+use effectcraft_aep::{AutoKern, Justification, KernRun, Project, TextDocument};
+
+fn text(name: &str) -> Option<TextDocument> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        layer_named(&first_comp(&project), "T").text_document().unwrap_or_else(|| panic!("{name}: no text document"))
+    })
+}
+
+#[test]
+fn the_reference_text_has_the_defaults_and_nothing_undecoded() {
+    let t = skip!(text("538-text-point-HHHH-normal-ref.aep"));
+    let r = t.style_runs[0];
+    assert_eq!((r.horizontal_scale, r.vertical_scale, r.baseline_shift, r.tsume, r.stroke_width), (1.0, 1.0, 0.0, 0.0, 1.0));
+    assert_eq!(r.auto_kern, AutoKern::Metrics);
+    assert_eq!((r.ligatures, r.no_break, r.apply_fill, r.apply_stroke, r.stroke_over_fill), (false, false, true, false, true));
+    assert_eq!((r.line_join, r.baseline_direction, r.digit_set), (0, 1, 0));
+    let p = t.paragraphs[0];
+    assert_eq!(p.justification, Justification::Left);
+    assert_eq!((p.first_line_indent, p.start_indent, p.end_indent, p.space_before, p.space_after), (0.0, 0.0, 0.0, 0.0, 0.0));
+    assert_eq!((p.leading_type, p.auto_hyphenate, p.hanging_roman, p.every_line_composer, p.direction), (0, true, false, false, 0));
+    assert!(t.kerning.is_empty());
+    assert_eq!(t.line_orientation, None);
+    assert!(t.undecoded_style_fields.is_empty() && t.undecoded_paragraph_fields.is_empty(), "{t:?}");
+}
+
+#[test]
+fn character_slots_each_hold_one_setting() {
+    let run = |name: &str| {
+        Some({
+            let t = text(name)?;
+            assert!(t.undecoded_style_fields.is_empty() && t.undecoded_paragraph_fields.is_empty(), "{name}: {:?}", t.undecoded_style_fields);
+            t.style_runs[0]
+        })
+    };
+    assert_eq!(skip!(run("539-text-hscale-0.9.aep")).horizontal_scale, 0.9);
+    assert_eq!(skip!(run("540-text-vscale-1.5.aep")).vertical_scale, 1.5);
+    assert_eq!(skip!(run("541-text-baselineshift-41.aep")).baseline_shift, 41.0);
+    assert_eq!(skip!(run("542-text-autokern-none.aep")).auto_kern, AutoKern::None);
+    assert_eq!(skip!(run("543-text-autokern-optical.aep")).auto_kern, AutoKern::Optical);
+    assert!(skip!(run("544-text-applystroke-on.aep")).apply_stroke);
+    assert_eq!(skip!(run("545-text-strokewidth-5.aep")).stroke_width, 5.0);
+    assert!(!skip!(run("546-text-applyfill-off.aep")).apply_fill);
+    assert_eq!(skip!(run("548-text-linejoin-round.aep")).line_join, 1);
+    assert!(!skip!(run("550-text-strokeoverfill-off.aep")).stroke_over_fill);
+    assert!(skip!(run("552-text-nobreak-on.aep")).no_break);
+    assert_eq!(skip!(run("553-text-tsume-0.5.aep")).tsume, 0.5);
+    assert!(skip!(run("555-text-ligature-on.aep")).ligatures);
+    assert_eq!(skip!(run("571-text-digitset-arabic.aep")).digit_set, 1);
+    assert_eq!(skip!(run("578-text-digitset-hindi.aep")).digit_set, 2);
+    assert_eq!(skip!(run("573-text-baselinedir-rotated.aep")).baseline_direction, 2);
+    assert_eq!(skip!(run("576-text-baselinedir-crossstream.aep")).baseline_direction, 3);
+}
+
+#[test]
+fn paragraph_slots_each_hold_one_setting() {
+    let para = |name: &str| {
+        Some({
+            let t = text(name)?;
+            assert!(t.undecoded_style_fields.is_empty() && t.undecoded_paragraph_fields.is_empty(), "{name}: {:?}", t.undecoded_paragraph_fields);
+            t.paragraphs[0]
+        })
+    };
+    assert_eq!(skip!(para("560-text-firstlineindent-20.aep")).first_line_indent, 20.0);
+    assert_eq!(skip!(para("561-text-startindent-30.aep")).start_indent, 30.0);
+    assert_eq!(skip!(para("562-text-endindent-40.aep")).end_indent, 40.0);
+    assert_eq!(skip!(para("563-text-spacebefore-10.aep")).space_before, 10.0);
+    assert_eq!(skip!(para("564-text-spaceafter-12.aep")).space_after, 12.0);
+    assert_eq!(skip!(para("572-text-leadingtype-japanese.aep")).leading_type, 1);
+    assert!(!skip!(para("556-text-autohyphenate-off.aep")).auto_hyphenate);
+    assert!(skip!(para("558-text-hangingroman-on.aep")).hanging_roman);
+    assert!(skip!(para("559-text-everyline-on.aep")).every_line_composer);
+    assert_eq!(skip!(para("569-text-direction-rtl.aep")).direction, 1);
+    assert_eq!(skip!(para("565-text-justify-fullleft.aep")).justification, Justification::FullLeft);
+    assert_eq!(skip!(para("566-text-justify-fullcenter.aep")).justification, Justification::FullCenter);
+    assert_eq!(skip!(para("567-text-justify-fullright.aep")).justification, Justification::FullRight);
+    assert_eq!(skip!(para("568-text-justify-fullall.aep")).justification, Justification::FullAll);
+}
+
+#[test]
+fn manual_kerning_is_a_list_of_character_runs() {
+    // 554: kerning 50 on the whole text: automatic kerning is switched off (0) and each of the four
+    // characters carries 50; the closing `\r` has no amount.
+    let t = skip!(text("554-text-kerning-50.aep"));
+    assert_eq!(t.style_runs[0].auto_kern, AutoKern::None);
+    assert_eq!(t.kerning.iter().map(|k| k.length).sum::<usize>(), 5);
+    assert!(t.kerning.iter().take(4).all(|k| *k == KernRun { length: 1, amount: Some(50.0) }), "{:?}", t.kerning);
+    assert_eq!(t.kerning.last().and_then(|k| k.amount), None);
+}
+
+#[test]
+fn vertical_text_has_its_line_orientation() {
+    assert_eq!(skip!(text("575-text-vertical-rtl.aep")).line_orientation, Some(2));
+}
+
+#[test]
+fn several_settings_in_one_document() {
+    // 595: stroke on, width 5, blue, horizontal 0.9, vertical 1.5, baseline shift 41; 596 the same
+    // with the fill over the stroke.
+    let a = skip!(text("595-text-stroke-scale-shift-combined.aep")).style_runs[0];
+    assert_eq!((a.apply_stroke, a.stroke_width, a.horizontal_scale, a.vertical_scale, a.baseline_shift), (true, 5.0, 0.9, 1.5, 41.0));
+    assert_eq!(a.stroke_argb, Some([1.0, 0.0, 0.0, 1.0]));
+    assert!(a.stroke_over_fill);
+    assert!(!skip!(text("596-text-combined-fill-over-stroke.aep")).style_runs[0].stroke_over_fill);
+}
+
+#[test]
+fn paragraph_slot_34_is_neutral_for_its_two_sampled_values() {
+    // 727: Reset Paragraph changes only /34 (0 -> 7); both values lay text out alike (S18).
+    assert_eq!(skip!(text("725-text-point-HHHH-normal-ref-S18.aep")).undecoded_paragraph_fields, Vec::<String>::new());
+    let t = skip!(text("727-text-reset-paragraph.aep"));
+    assert!(t.undecoded_paragraph_fields.is_empty(), "{:?}", t.undecoded_paragraph_fields);
+    // Another value of /34 is still listed.
+    let bytes = fixture!("727-text-reset-paragraph.aep");
+    let file = open(&bytes);
+    let project = Project::new(&file).unwrap();
+    let layer = layer_named(&first_comp(&project), "T");
+    let body = layer.chunk().find_list(b"btdk").and_then(|c| c.bytes()).unwrap().to_vec();
+    // Every `/34 7` (the run's paragraph and the document's paragraph sheet) becomes `/34 5`.
+    let mut changed = Vec::with_capacity(body.len());
+    let mut i = 0;
+    while i < body.len() {
+        if body[i..].starts_with(b"/34 7 ") {
+            changed.extend_from_slice(b"/34 5 ");
+            i += 6;
+        } else {
+            changed.push(body[i]);
+            i += 1;
+        }
+    }
+    assert_eq!(TextDocument::parse(&changed).unwrap().undecoded_paragraph_fields, ["34"]);
+}
+
+#[test]
+fn slots_24_35_and_68_are_neutral_for_0_and_1() {
+    // 732-734: 517 with paragraph /24, paragraph /35 or style /68 edited; After Effects keeps the
+    // value and lays the text out the same (S21).
+    for name in ["732-text-box-byteedit-para24-0.aep", "733-text-box-byteedit-para35-0.aep", "734-text-box-byteedit-style68-1.aep"] {
+        let t = skip!(text(name));
+        assert!(
+            t.undecoded_style_fields.is_empty() && t.undecoded_paragraph_fields.is_empty(),
+            "{name}: {:?} {:?}",
+            t.undecoded_style_fields,
+            t.undecoded_paragraph_fields
+        );
+    }
+}
diff --git a/crates/aep/tests/it/container/typed.rs b/crates/aep/tests/it/container/typed.rs
new file mode 100644
index 000000000..15d26992c
--- /dev/null
+++ b/crates/aep/tests/it/container/typed.rs
@@ -0,0 +1,268 @@
+//! The typed view, checked against the values the generated corpus was made with (the synthetic
+//! MANIFEST: composition `C` 1920x1080 at 25 fps with one solid layer `L`, then one change per
+//! file).
+
+use crate::container::helpers::FIXTURES;
+use effectcraft_aep::{AepFile, Body, ItemKind, KeyList, Layer, Project, PropGroup, PropNode, Property, parse};
+
+fn first_layer<'f, 'a>(project: &Project<'f, 'a>) -> Layer<'f, 'a> {
+    let comp = project.all_items().into_iter().find_map(|i| i.comp()).expect("a composition");
+    comp.layers().next().expect("a layer")
+}
+
+fn transform<'f, 'a>(layer: &Layer<'f, 'a>) -> PropGroup<'f, 'a> {
+    match layer.properties().expect("layer properties").get("ADBE Transform Group") {
+        Some(PropNode::Group(g)) => g,
+        other => panic!("transform group: {other:?}"),
+    }
+}
+
+fn property<'f, 'a>(group: &PropGroup<'f, 'a>, name: &str) -> Property<'f, 'a> {
+    match group.get(name) {
+        Some(PropNode::Property(p)) => p,
+        other => panic!("{name}: {other:?}"),
+    }
+}
+
+#[test]
+fn base_project_items() {
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let project = Project::new(&file).unwrap();
+    // Comp C and the folder Solids at the top; the solid's footage item lives inside the folder.
+    let top: Vec<_> = project.items().map(|i| (i.kind(), i.name())).collect();
+    assert_eq!(top, [(Some(ItemKind::Composition), Some("C".to_string())), (Some(ItemKind::Folder), Some("Solids".to_string()))]);
+    let all: Vec<_> = project.all_items().iter().map(|i| i.kind()).collect();
+    assert_eq!(all, [Some(ItemKind::Composition), Some(ItemKind::Folder), Some(ItemKind::Footage)]);
+    // numItems = 3 in the manifest.
+    assert_eq!(all.len(), 3);
+    let folder = project.items().nth(1).unwrap();
+    assert_eq!(folder.children().count(), 1);
+}
+
+#[test]
+fn empty_project_has_no_items_of_a_composition() {
+    let bytes = fixture!("001-empty.aep");
+    let file = parse(&bytes).unwrap();
+    let project = Project::new(&file).unwrap();
+    assert!(project.all_items().iter().all(|i| i.comp().is_none()));
+}
+
+#[test]
+fn composition_time_base_gives_the_frame_rate() {
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let comp = Project::new(&file).unwrap().items().find_map(|i| i.comp()).unwrap();
+    let tb = comp.time_base().unwrap();
+    assert_eq!((tb.frame_duration, tb.timescale), (1024, 25600));
+    assert_eq!(tb.frame_rate(), Some(25.0));
+    assert_eq!(tb.seconds(25600), Some(1.0));
+    // 031: frameRate 25 -> 30 changes the time base.
+    let bytes = fixture!("031-comp-fps30.aep");
+    let file = parse(&bytes).unwrap();
+    let comp = Project::new(&file).unwrap().items().find_map(|i| i.comp()).unwrap();
+    assert_eq!(comp.time_base().unwrap().frame_rate(), Some(30.0));
+}
+
+#[test]
+fn layers_and_names() {
+    // Base: one layer L whose name is its source's (no explicit name stored).
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let comp = Project::new(&file).unwrap().items().find_map(|i| i.comp()).unwrap();
+    let layers: Vec<_> = comp.layers().collect();
+    assert_eq!(layers.len(), 1);
+    assert_eq!(layers[0].name(), None);
+    assert_eq!(layers[0].is_three_d(), Some(false));
+    // 110: a text layer T on top of L.
+    let bytes = fixture!("110-text-A.aep");
+    let file = parse(&bytes).unwrap();
+    let comp = Project::new(&file).unwrap().items().find_map(|i| i.comp()).unwrap();
+    let names: Vec<_> = comp.layers().map(|l| l.name()).collect();
+    assert_eq!(names, [Some("T".to_string()), None]);
+}
+
+#[test]
+fn three_d_switch() {
+    let bytes = fixture!("015-layer-3d.aep");
+    let file = parse(&bytes).unwrap();
+    let project = Project::new(&file).unwrap();
+    let layer = first_layer(&project);
+    assert_eq!(layer.is_three_d(), Some(true));
+    // The 3D switch adds the Z rotation to the transform group.
+    assert!(transform(&layer).names().iter().any(|n| n == "ADBE Rotate Z"));
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let project = Project::new(&file).unwrap();
+    assert!(!transform(&first_layer(&project)).names().iter().any(|n| n == "ADBE Rotate Z"));
+}
+
+#[test]
+fn match_names_come_from_the_tdmn_chunks() {
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let layer = first_layer(&Project::new(&file).unwrap());
+    let root = layer.properties().unwrap();
+    let names = root.names();
+    assert_eq!(&names[..2], ["ADBE Time Remapping", "ADBE Transform Group"]);
+    assert!(names.iter().any(|n| n == "ADBE Material Options Group"));
+    // The path lookup follows nested groups; "ADBE Group End" names nothing.
+    assert!(matches!(root.find(&["ADBE Transform Group"]), Some(PropNode::Group(_))));
+    assert!(!names.iter().any(|n| n == "ADBE Group End"));
+    assert!(root.find(&["ADBE Transform Group", "ADBE Nonexistent"]).is_none());
+    // The raw tdmn body is 40 bytes, NUL padded.
+    let raw = root.chunk().children().iter().find(|c| c.is(b"tdmn")).unwrap();
+    assert_eq!(raw.bytes().unwrap().len(), 40);
+}
+
+#[test]
+fn static_value_is_the_first_dims_doubles_of_cdat() {
+    // 040: Position [960,540,0] -> [100,200,0]; AE stores only non-default transform values.
+    let bytes = fixture!("040-static-position-100-200.aep");
+    let file = parse(&bytes).unwrap();
+    let layer = first_layer(&Project::new(&file).unwrap());
+    let position = property(&transform(&layer), "ADBE Position");
+    assert_eq!(position.dims(), Some(3));
+    assert!(!position.is_animated());
+    assert_eq!(position.header().map(|h| h.len()), Some(124));
+    assert_eq!(position.header().and_then(|h| h.get(68).copied()), Some(0));
+    assert_eq!(position.static_value(), Some(vec![100.0, 200.0, 0.0]));
+    assert!(position.keys().is_none());
+    // The base file stores no Position at all.
+    let bytes = fixture!("000-base.aep");
+    let file = parse(&bytes).unwrap();
+    let layer = first_layer(&Project::new(&file).unwrap());
+    assert!(transform(&layer).get("ADBE Position").is_none());
+}
+
+#[test]
+fn effect_parameter_value() {
+    // 071: Slider Control effect with Slider = 77.
+    let bytes = fixture!("071-fx-slider-value77.aep");
+    let file = parse(&bytes).unwrap();
+    let layer = first_layer(&Project::new(&file).unwrap());
+    let parade = match layer.properties().unwrap().get("ADBE Effect Parade") {
+        Some(PropNode::Group(g)) => g,
+        other => panic!("{other:?}"),
+    };
+    assert_eq!(parade.names(), ["ADBE Slider Control"]);
+    let Some(PropNode::Other(instance)) = parade.get("ADBE Slider Control") else { panic!("effect instance") };
+    assert!(instance.is_list(b"sspc"));
+    // The effect's name is in a nested fnam chunk.
+    let fnam = instance.child(b"fnam").unwrap();
+    assert!(matches!(fnam.body, Body::Chunks(_)));
+    assert_eq!(fnam.children()[0].bytes(), Some(&b"Slider Control"[..]));
+    // The parameters are a property group inside the instance.
+    let params = PropGroup::from_chunk(instance.child_list(b"tdgp").unwrap()).unwrap();
+    assert_eq!(params.names(), ["ADBE Slider Control-0000", "ADBE Slider Control-0001", "ADBE Effect Built In Params"]);
+    let slider = property(&params, "ADBE Slider Control-0001");
+    assert_eq!(slider.dims(), Some(1));
+    assert_eq!(slider.static_value(), Some(vec![77.0]));
+}
+
+#[test]
+fn position_keyframes() {
+    // 055: Position keys at 0 s [0,0,0], 1 s [100,0,0] and 2.5 s [200,100,0], all linear.
+    let bytes = fixture!("055-key-position-3key-inserted-t2.5.aep");
+    let file = parse(&bytes).unwrap();
+    let project = Project::new(&file).unwrap();
+    let comp = project.items().find_map(|i| i.comp()).unwrap();
+    let tb = comp.time_base().unwrap();
+    let layer = first_layer(&project);
+    let position = property(&transform(&layer), "ADBE Position");
+    assert!(position.is_animated());
+    assert_eq!(position.header().and_then(|h| h.get(68).copied()), Some(1));
+    assert_eq!(position.dims(), Some(3));
+    assert_eq!(position.static_value(), None);
+    let keys = position.keys().unwrap();
+    // lhd3: record count (word 2), record size (word 4), capacity rounded up to 4 (word 7).
+    assert_eq!(keys.header.magic, 0x00d0_0bee);
+    assert_eq!(keys.header.count, 3);
+    assert_eq!(keys.header.record_size, 128);
+    assert_eq!(keys.header.words[3], 1);
+    assert_eq!(keys.header.words[7], 4);
+    assert_eq!(keys.len(), 3);
+    let times: Vec<i32> = keys.keyframes().map(|k| k.time_units().unwrap()).collect();
+    assert_eq!(times, [0, 25_600, 64_000]);
+    let seconds: Vec<f64> = times.iter().map(|t| tb.seconds(*t).unwrap()).collect();
+    assert_eq!(seconds, [0.0, 1.0, 2.5]);
+    let values: Vec<[f64; 3]> = keys.keyframes().map(|k| k.spatial_value().unwrap()).collect();
+    assert_eq!(values, [[0.0, 0.0, 0.0], [100.0, 0.0, 0.0], [200.0, 100.0, 0.0]]);
+}
+
+#[test]
+fn list_header_facts_hold_in_every_list_of_every_fixture() {
+    let mut lists = 0;
+    let mut with_records = 0;
+    for name in FIXTURES {
+        let bytes = fixture!(name);
+        let file = parse(&bytes).unwrap();
+        for (_, c) in file.walk() {
+            if !c.is_list(b"list") || c.child(b"lhd3").is_none() {
+                continue;
+            }
+            lists += 1;
+            let keys = KeyList::from_chunk(c).unwrap_or_else(|| panic!("{name}: len(ldat) != count * record size"));
+            assert_eq!(keys.header.magic, 0x00d0_0bee, "{name}");
+            assert!(keys.header.words[8..].iter().all(|w| *w == 0), "{name}");
+            if !keys.is_empty() {
+                with_records += 1;
+            }
+            assert_eq!(keys.records().count(), keys.len());
+        }
+    }
+    assert!(lists >= 9 * 10, "lists seen: {lists}");
+    assert!(with_records >= 1);
+}
+
+/// Visits every property under a group, depth-limited.
+fn visit(group: &PropGroup<'_, '_>, depth: usize, f: &mut dyn FnMut(&Property<'_, '_>)) {
+    if depth > 24 {
+        return;
+    }
+    for e in group.entries() {
+        match e.node {
+            PropNode::Group(g) => visit(&g, depth + 1, f),
+            PropNode::Property(p) => f(&p),
+            PropNode::Other(c) => {
+                if let Some(g) = c.child_list(b"tdgp").and_then(PropGroup::from_chunk) {
+                    visit(&g, depth + 1, f);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn property_header_facts_hold_in_every_property_of_every_fixture() {
+    let (mut props, mut animated) = (0, 0);
+    for name in FIXTURES {
+        let bytes = fixture!(name);
+        let file: AepFile<'_> = parse(&bytes).unwrap();
+        let Some(project) = Project::new(&file) else { continue };
+        for item in project.all_items() {
+            let Some(comp) = item.comp() else { continue };
+            for layer in comp.layers() {
+                let Some(root) = layer.properties() else { continue };
+                visit(&root, 0, &mut |p| {
+                    props += 1;
+                    let header = p.header().unwrap_or_else(|| panic!("{name}: property without tdb4"));
+                    assert_eq!(header.len(), 124, "{name}");
+                    // Constant first three bytes, and byte 68 = has keyframes.
+                    assert_eq!(&header[..3], &[0xdb, 0x99, 0x00], "{name}");
+                    assert_eq!(header[68] == 1, p.is_animated(), "{name}");
+                    if p.is_animated() {
+                        animated += 1;
+                        let keys = p.keys().unwrap_or_else(|| panic!("{name}: no key list"));
+                        let (count, w) = (keys.header.count, keys.header.words);
+                        assert_eq!(w[3], count.div_ceil(4), "{name}: word 3");
+                        assert_eq!(w[7], count.div_ceil(4) * 4, "{name}: word 7");
+                        assert!(p.static_value().is_none(), "{name}");
+                    }
+                });
+            }
+        }
+    }
+    assert!(props > 100, "properties seen: {props}");
+    assert!(animated >= 1);
+}
diff --git a/crates/aep/tests/it/container/values.rs b/crates/aep/tests/it/container/values.rs
new file mode 100644
index 000000000..b9ceadd57
--- /dev/null
+++ b/crates/aep/tests/it/container/values.rs
@@ -0,0 +1,252 @@
+//! Static transform values with their units, the "absent = default" rule, keyframe records and
+//! expressions, checked against the values the corpus was made with (its MANIFEST).
+
+use crate::container::helpers::{base_layer, first_comp, open};
+use effectcraft_aep::{Interpolation, KeyEase, KeyframeKind, Project, PropNode, Property, Transform, ValueSource};
+
+/// The transform of the solid `L` (comp-size defaults) in a fixture.
+fn transform(name: &str) -> Option<(Transform, (u32, u32))> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let comp = first_comp(&project);
+        let layer = base_layer(&comp);
+        let ch = comp.header().unwrap();
+        let t = layer.transform(u32::from(ch.width), u32::from(ch.height)).unwrap();
+        (t, project.layer_source_size(&layer).unwrap())
+    })
+}
+
+fn approx(a: [f64; 3], b: [f64; 3]) {
+    for (x, y) in a.iter().zip(b) {
+        assert!((x - y).abs() < 1e-9, "{a:?} != {b:?}");
+    }
+}
+
+#[test]
+fn absent_properties_are_the_defaults() {
+    let (t, size) = skip!(transform("000-base.aep"));
+    assert_eq!(size, (1920, 1080));
+    // The base stores none of the five: Position is the comp centre, Anchor the layer centre.
+    assert_eq!(t.position.value, [960.0, 540.0, 0.0]);
+    assert_eq!(t.anchor_fraction.value, [0.5, 0.5, 0.0]);
+    assert_eq!(t.anchor_px(1920.0, 1080.0), [960.0, 540.0, 0.0]);
+    assert_eq!(t.scale_percent.value, [100.0, 100.0, 100.0]);
+    assert_eq!(t.rotation_degrees.value, 0.0);
+    assert_eq!(t.opacity_percent.value, 100.0);
+    for source in [t.position.source, t.anchor_fraction.source, t.scale_percent.source, t.rotation_degrees.source, t.opacity_percent.source] {
+        assert_eq!(source, ValueSource::Default);
+    }
+}
+
+#[test]
+fn one_static_value_per_case() {
+    // 040 Position [960,540,0] -> [100,200,0].
+    let (t, _) = skip!(transform("040-static-position-100-200.aep"));
+    assert_eq!(t.position.value, [100.0, 200.0, 0.0]);
+    assert_eq!(t.position.source, ValueSource::Stored);
+    assert_eq!(t.scale_percent.value, [100.0, 100.0, 100.0]);
+    assert_eq!(t.scale_percent.source, ValueSource::Default);
+
+    // 041 Scale [100,100,100] -> [50,50,100]: stored as fractions.
+    let (t, _) = skip!(transform("041-static-scale-50.aep"));
+    assert_eq!(t.scale_percent.value, [50.0, 50.0, 100.0]);
+    assert_eq!(t.scale_percent.source, ValueSource::Stored);
+    assert_eq!(t.position.value, [960.0, 540.0, 0.0]);
+
+    // 042 Rotation 0 -> 45 degrees.
+    let (t, _) = skip!(transform("042-static-rotation-45.aep"));
+    assert_eq!(t.rotation_degrees.value, 45.0);
+    assert_eq!(t.rotation_degrees.source, ValueSource::Stored);
+
+    // 043 Opacity 100 -> 25 percent.
+    let (t, _) = skip!(transform("043-static-opacity-25.aep"));
+    assert_eq!(t.opacity_percent.value, 25.0);
+    assert_eq!(t.opacity_percent.source, ValueSource::Stored);
+
+    // 044 Anchor Point [960,540,0] -> [10,20,0]: a fraction of the layer size, 10/1920 and 20/1080.
+    let (t, (w, h)) = skip!(transform("044-static-anchor-10-20.aep"));
+    assert_eq!(t.anchor_fraction.source, ValueSource::Stored);
+    approx(t.anchor_fraction.value, [10.0 / 1920.0, 20.0 / 1080.0, 0.0]);
+    approx(t.anchor_px(f64::from(w), f64::from(h)), [10.0, 20.0, 0.0]);
+}
+
+#[test]
+fn a_composition_resize_materialises_the_old_centre() {
+    // 030: the comp becomes 1280x720 and L (1920x1080) is not moved: its Position, which was
+    // "absent = centre" in the base, is now stored as [960,540,0] (the new centre would be
+    // [640,360]); the layer size is unchanged.
+    let (t, size) = skip!(transform("030-comp-size-1280x720.aep"));
+    assert_eq!(size, (1920, 1080));
+    assert_eq!(t.position.value, [960.0, 540.0, 0.0]);
+    assert_eq!(t.position.source, ValueSource::Stored);
+    assert_eq!(t.anchor_fraction.source, ValueSource::Default);
+}
+
+// ------------------------------------------------------------------------------------ keyframes
+
+/// The Position property of `L` in a fixture, handed to `f`.
+fn with_position<R>(name: &str, f: impl FnOnce(Property<'_, '_>) -> R) -> Option<R> {
+    with_transform_property(name, "ADBE Position", f)
+}
+
+fn with_transform_property<R>(name: &str, prop: &str, f: impl FnOnce(Property<'_, '_>) -> R) -> Option<R> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let file = open(&bytes);
+        let project = Project::new(&file).unwrap();
+        let layer = base_layer(&first_comp(&project));
+        let Some(PropNode::Property(p)) = layer.properties().unwrap().find(&["ADBE Transform Group", prop]) else { panic!("{name}: no {prop}") };
+        f(p)
+    })
+}
+
+#[test]
+fn linear_position_keys() {
+    skip!(with_position("055-key-position-3key-inserted-t2.5.aep", |p| {
+        assert_eq!(p.time_scale(), Some(25600));
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 3);
+        // Keys added through the scripting interface are linear in and out, uncoloured, not roving.
+        for k in &keys {
+            assert_eq!(k.kind(), KeyframeKind::Spatial { components: 3 });
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Linear)));
+            assert_eq!((k.label(), k.is_roving()), (Some(0), Some(false)));
+        }
+        let secs: Vec<_> = keys.iter().map(|k| k.seconds(25600).unwrap()).collect();
+        assert_eq!(secs, [0.0, 1.0, 2.5]);
+        let values: Vec<_> = keys.iter().map(|k| k.spatial().unwrap().value).collect();
+        assert_eq!(values, [[0.0, 0.0, 0.0], [100.0, 0.0, 0.0], [200.0, 100.0, 0.0]]);
+        assert_eq!(p.first_key_value(), Some(vec![0.0, 0.0, 0.0]));
+        assert_eq!(p.is_static_flag_set(), Some(false));
+    }));
+    // The transform of the layer reports the animated Position as keyframed (value at the first key).
+    let (t, _) = skip!(transform("055-key-position-3key-inserted-t2.5.aep"));
+    assert_eq!(t.position.source, ValueSource::Keyframed);
+    assert_eq!(t.position.value, [0.0, 0.0, 0.0]);
+}
+
+#[test]
+fn ease_preset_sets_bezier_and_influence() {
+    // 052: both keys use the ease preset: bezier in and out, speed 0, influence 0.33 (33 %).
+    skip!(with_position("052-key-position-2key-ease.aep", |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        for k in &keys {
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Bezier), Some(Interpolation::Bezier)));
+            let s = k.spatial().unwrap();
+            // The speeds sit at slots 0 and 2, the influences at slots 1 and 3; which pair is "in"
+            // is not decided, so the slots are exposed as stored.
+            assert_eq!((s.ease[0], s.ease[2]), (0.0, 0.0));
+            assert_eq!((s.ease[1], s.ease[3]), (0.33, 0.33));
+        }
+        let secs: Vec<_> = keys.iter().map(|k| k.seconds(25600).unwrap()).collect();
+        assert_eq!(secs, [0.0, 1.0]);
+    }));
+}
+
+#[test]
+fn hold_keyframe() {
+    // 053: key 1 is a hold keyframe on both sides (bytes 3, 3), key 2 stays linear; the values are unchanged.
+    skip!(with_position("053-key-position-2key-hold-key1.aep", |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        assert_eq!((keys[0].interpolation_in(), keys[0].interpolation_out()), (Some(Interpolation::Hold), Some(Interpolation::Hold)));
+        assert_eq!((keys[1].interpolation_in(), keys[1].interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Linear)));
+        assert_eq!(keys[0].spatial().unwrap().value, [0.0, 0.0, 0.0]);
+        assert_eq!(keys[1].spatial().unwrap().value, [100.0, 0.0, 0.0]);
+    }));
+}
+
+#[test]
+fn spatial_tangents() {
+    // 054: key 1 spatial out tangent [30,60,0], key 2 spatial in tangent [-30,-60,0]; the
+    // auto-bezier / continuous switches were turned off together (the flag word becomes 0).
+    skip!(with_position("054-key-position-2key-spatial-bezier.aep", |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().map(|k| k.spatial().unwrap()).collect();
+        assert_eq!(keys[0].out_tangent, [30.0, 60.0, 0.0]);
+        assert_eq!(keys[1].in_tangent, [-30.0, -60.0, 0.0]);
+        assert_eq!(keys[0].in_tangent, [0.0, 0.0, 0.0]);
+        assert_eq!(keys[1].out_tangent, [0.0, 0.0, 0.0]);
+        assert_eq!((keys[0].auto_bezier_flag, keys[1].auto_bezier_flag), (0, 0));
+    }));
+}
+
+#[test]
+fn roving_and_label_flags() {
+    // 056: key 2 roving (AE moved it from 1 s to 26509/25600 s, the value is kept).
+    skip!(with_position("056-key-position-3key-roving-key2.aep", |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        let roving: Vec<_> = keys.iter().map(|k| k.is_roving().unwrap()).collect();
+        assert_eq!(roving, [false, true, false]);
+        assert_eq!(keys[1].time_units(), Some(26509));
+        assert_eq!(keys[1].seconds(25600), Some(1.0355078125));
+        assert_eq!(keys[1].spatial_value(), Some([100.0, 0.0, 0.0]));
+        assert_eq!(keys[1].flags(), Some(0x0027));
+        assert_eq!(keys[1].label(), Some(0));
+    }));
+    // 057: key 2 gets keyframe label 9; flags 0x0007 become 0x0247.
+    skip!(with_position("057-key-position-3key-label9-key2.aep", |p| {
+        let keys: Vec<_> = p.keys().unwrap().keyframes().collect();
+        let labels: Vec<_> = keys.iter().map(|k| k.label().unwrap()).collect();
+        assert_eq!(labels, [0, 9, 0]);
+        assert_eq!(keys[1].flags(), Some(0x0247));
+        assert_eq!(keys[0].flags(), Some(0x0007));
+        assert_eq!(keys[1].is_roving(), Some(false));
+        assert_eq!(keys[1].spatial_value(), Some([100.0, 0.0, 0.0]));
+    }));
+}
+
+#[test]
+fn scalar_opacity_keys() {
+    // 058: Opacity 0 % at 0 s, 100 % at 2 s, linear: 48-byte records, the value is a fraction.
+    skip!(with_transform_property("058-key-opacity-2key.aep", "ADBE Opacity", |p| {
+        assert!(p.is_animated());
+        assert_eq!(p.dims(), Some(1));
+        assert_eq!(p.time_scale(), Some(25600));
+        assert_eq!(p.is_static_flag_set(), Some(false));
+        let list = p.keys().unwrap();
+        assert_eq!(list.header.record_size, 48);
+        let keys: Vec<_> = list.keyframes().collect();
+        assert_eq!(keys.len(), 2);
+        assert!(keys.iter().all(|k| k.kind() == KeyframeKind::Plain { components: 1 }));
+        assert_eq!(keys.iter().map(|k| k.seconds(25600).unwrap()).collect::<Vec<_>>(), [0.0, 2.0]);
+        assert_eq!(keys.iter().map(|k| k.scalar_value().unwrap()).collect::<Vec<_>>(), [0.0, 1.0]);
+        for k in &keys {
+            assert_eq!((k.interpolation_in(), k.interpolation_out()), (Some(Interpolation::Linear), Some(Interpolation::Linear)));
+            assert_eq!(k.ease(), Some(KeyEase { in_speed: 0.0, in_influence: 0.0, out_speed: 0.0, out_influence: 0.0 }));
+            assert_eq!(k.flags(), Some(0));
+        }
+        assert_eq!(keys[0].spatial(), None);
+    }));
+    let (t, _) = skip!(transform("058-key-opacity-2key.aep"));
+    assert_eq!(t.opacity_percent.source, ValueSource::Keyframed);
+    assert_eq!(t.opacity_percent.value, 0.0);
+}
+
+// ---------------------------------------------------------------------------------- expressions
+
+#[test]
+fn expression_text_and_flag_bytes() {
+    // 060: Opacity expression `wiggle(1,10)`; the static value 1.0 is kept.
+    skip!(with_transform_property("060-expr-opacity-wiggle.aep", "ADBE Opacity", |p| {
+        assert_eq!(p.expression().as_deref(), Some("wiggle(1,10)"));
+        let flags = p.expression_flags().unwrap();
+        // Byte 120 marks the expression. Bytes 76 and 77 were 1 too in the single-case file and
+        // are 0 in the combined one, so they do not mark it.
+        assert_eq!(flags.byte_120, 1);
+        assert_eq!(p.static_value(), Some(vec![1.0]));
+        assert!(!p.is_animated());
+    }));
+    // A property without an expression has none of the three bytes set.
+    skip!(with_position("040-static-position-100-200.aep", |p| {
+        assert_eq!(p.expression(), None);
+        let flags = p.expression_flags().unwrap();
+        assert_eq!((flags.byte_76, flags.byte_77, flags.byte_120), (0, 0, 0));
+        assert!(!flags.all_set());
+        // A written static property: tdsb 1, byte 5 of tdb4 has bit 0 set (15 for Position).
+        assert_eq!(p.flags(), Some(1));
+        assert_eq!(p.is_static_flag_set(), Some(true));
+        assert_eq!(p.header().and_then(|h| h.get(5).copied()), Some(15));
+    }));
+}
diff --git a/crates/aep/tests/it/export.rs b/crates/aep/tests/it/export.rs
new file mode 100644
index 000000000..13d438b48
--- /dev/null
+++ b/crates/aep/tests/it/export.rs
@@ -0,0 +1,21 @@
+//! export tests of effectcraft-aep.
+
+#[macro_use]
+mod helpers;
+
+mod built;
+mod ease;
+mod effects;
+mod footage;
+mod masks;
+mod objects;
+mod precomp;
+mod remap;
+mod repairs;
+mod robustness;
+mod roundtrip;
+mod settings;
+mod shape_switch;
+mod stretch;
+mod styles;
+mod text;
diff --git a/crates/aep/tests/it/export/built.rs b/crates/aep/tests/it/export/built.rs
new file mode 100644
index 000000000..0da683cc4
--- /dev/null
+++ b/crates/aep/tests/it/export/built.rs
@@ -0,0 +1,554 @@
+//! The exported bytes are parsed back with `effectcraft-aep` and every exported field is compared
+//! with the project it came from.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::{AepExportError, ExportOptions, LossCategory, analyze, export};
+use effectcraft_aep::{BlendMode as AepBlend, Interpolation, ItemKind as AepKind, PropNode, Quality as AepQuality, parse, write};
+use effectcraft_color::{BlendMode, Label};
+use effectcraft_keyframe::{Ease, Interp, Value};
+use effectcraft_project::{ItemKind, LayerSource, Project, Quality};
+use effectcraft_time::FrameRate;
+
+fn close(a: f64, b: f64) -> bool {
+    (a - b).abs() < 1e-9
+}
+
+#[test]
+fn simple_project_round_trips_through_the_container() {
+    let (p, _, _) = simple();
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    // The container is consistent: writing it back gives the same bytes.
+    assert_eq!(write(&file).expect("write"), r.bytes);
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let items = view.all_items();
+    let kinds: Vec<_> = items.iter().filter_map(|i| i.kind()).collect();
+    assert_eq!(kinds.iter().filter(|k| **k == AepKind::Composition).count(), 1);
+    assert_eq!(kinds.iter().filter(|k| **k == AepKind::Folder).count(), 1);
+    assert_eq!(kinds.iter().filter(|k| **k == AepKind::Footage).count(), 1);
+}
+
+#[test]
+fn composition_header_fields() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "Flags", 800, 600, FrameRate::new(30, 1), 10.0, None);
+    with_comp(&mut p, c, |cc| {
+        cc.work_area = (secs(1.0), secs(3.0));
+        cc.background = [0.5, 0.25, 1.0];
+        cc.pixel_aspect = 0.9091;
+        cc.shutter_angle = 90.0;
+        cc.shutter_phase = -45.0;
+        cc.display_start = secs(4.0);
+        cc.enable_motion_blur = true;
+    });
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let item = view.all_items().into_iter().find(|i| i.display_name().as_deref() == Some("Flags")).expect("comp");
+    let h = item.comp().expect("comp").header().expect("header");
+    assert_eq!((h.width, h.height), (800, 600));
+    assert_eq!((h.time_base.frame_duration, h.time_base.timescale), (1024, 30720));
+    assert_eq!(h.duration_units, 307_200);
+    assert_eq!(h.work_area_start_units, 30_720);
+    assert_eq!(h.work_area_end_units, Some(92_160));
+    assert_eq!(h.background, [128, 64, 255]);
+    assert_eq!((h.pixel_aspect.num, h.pixel_aspect.den), (10, 11));
+    assert_eq!(h.shutter_angle, 90);
+    assert_eq!(h.shutter_phase, Some(-45));
+    assert!(h.motion_blur);
+    assert_eq!(h.display_start.map(|d| (d.num, d.den)), Some((122_880, 30_720)));
+    assert_eq!(h.frame_rate_fixed, 30 << 16);
+}
+
+#[test]
+fn ntsc_and_odd_frame_rates_use_the_time_bases_after_effects_writes() {
+    for (rate, fd, ts, fixed) in [
+        (FrameRate::FPS_29_97, 800u32, 23_976u32, 1_964_114u32),
+        (FrameRate::FPS_23_976, 1000, 23_976, 1_571_291),
+        (FrameRate::new(24, 1), 1024, 24_576, 24 << 16),
+        (FrameRate::new(12, 1), 2048, 24_576, 12 << 16),
+        (FrameRate::new(60, 1), 512, 30_720, 60 << 16),
+    ] {
+        let mut p = Project::default();
+        add_comp(&mut p, "R", 640, 360, rate, 2.0, None);
+        let r = export_all(&p);
+        let file = parse(&r.bytes).expect("parse");
+        let view = effectcraft_aep::Project::new(&file).expect("project");
+        let item = view.all_items().into_iter().find(|i| i.display_name().as_deref() == Some("R")).expect("comp");
+        let h = item.comp().expect("c").header().expect("h");
+        assert_eq!((h.time_base.frame_duration, h.time_base.timescale, h.frame_rate_fixed), (fd, ts, fixed), "{}", rate.label());
+        let frames = (rate.as_f64() * 2.0).round() as u32;
+        assert_eq!(h.duration_units, frames * fd);
+    }
+}
+
+/// #3099: After Effects reads a null's absent Anchor Point as its top-left corner `[0, 0]`. A
+/// null anchored at its centre is written (it was left out as "the default" and came back at the
+/// corner); one at the corner is not, and both import back as they were.
+#[test]
+fn null_anchor_points_round_trip() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 800, 600, FrameRate::new(30, 1), 2.0, None);
+    add_layer(&mut p, c, "Corner", LayerSource::Null, (100, 100));
+    add_layer(&mut p, c, "Centre", LayerSource::Null, (100, 100));
+    for (idx, anchor) in [(0, [50.0, 50.0, 0.0]), (1, [0.0, 0.0, 0.0])] {
+        with_layer(&mut p, c, idx, |l| {
+            if let Some(a) = l.props.prop_mut("transform/anchor") {
+                a.value = Value::Vec3(anchor);
+            }
+        });
+    }
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find(|i| i.comp().is_some()).expect("comp");
+    let stored: Vec<_> =
+        comp.comp().expect("c").layers().map(|l| (l.name().unwrap_or_default(), l.transform(800, 600).expect("transform").anchor_fraction.source)).collect();
+    assert_eq!(stored, [("Centre".to_string(), effectcraft_aep::ValueSource::Stored), ("Corner".to_string(), effectcraft_aep::ValueSource::Default)]);
+    let mut back = Project::default();
+    let none = |_: &str| false;
+    let res = effectcraft_aep::import::import(
+        &mut back,
+        &r.bytes,
+        &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+    )
+    .expect("import");
+    let comp = res.comps.first().and_then(|id| back.comp(*id)).expect("comp");
+    for (name, want) in [("Centre", [50.0, 50.0]), ("Corner", [0.0, 0.0])] {
+        let l = comp.layers.iter().find(|l| l.name == name).expect("layer");
+        let a = l.props.prop("transform/anchor").expect("anchor").value.as_vec2();
+        assert!(close(a[0], want[0]) && close(a[1], want[1]), "{name}: {a:?}");
+    }
+}
+
+#[test]
+fn layer_header_fields() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 800, 600, FrameRate::new(30, 1), 10.0, None);
+    let s = add_solid(&mut p, "Sol", 800, 600, [0.1, 0.2, 0.3], None);
+    for name in ["Bottom", "Mid", "Top"] {
+        add_layer(&mut p, c, name, LayerSource::Solid { item: s }, (800, 600));
+    }
+    add_layer(&mut p, c, "Nul", LayerSource::Null, (100, 100));
+    let bottom = p.comp(c).and_then(|cc| cc.layers.last().map(|l| l.id)).expect("bottom");
+    with_layer(&mut p, c, 1, |l| {
+        l.switches.adjustment = true;
+        l.blend_mode = BlendMode::Multiply;
+        l.label = Label::Lavender;
+        l.switches.quality = Quality::Draft;
+        l.parent = Some(bottom);
+    });
+    with_layer(&mut p, c, 2, |l| {
+        l.switches.locked = true;
+        l.switches.shy = true;
+        l.switches.solo = true;
+        l.blend_mode = BlendMode::Screen;
+        l.start_time = secs(1.5);
+        l.in_point = secs(2.0);
+        l.out_point = secs(6.0);
+        l.switches.video = false;
+        l.switches.audio = false;
+        l.switches.effects = false;
+        l.switches.motion_blur = true;
+        l.switches.guide = true;
+    });
+    let r = export_all(&p);
+    assert!(r.report.is_lossless());
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find(|i| i.comp().is_some()).expect("comp");
+    let layers: Vec<_> = comp.comp().expect("c").layers().collect();
+    assert_eq!(layers.len(), 4);
+    let names: Vec<_> = layers.iter().map(|l| l.name().unwrap_or_default()).collect();
+    assert_eq!(names, ["Nul", "Top", "Mid", "Bottom"]);
+    let h: Vec<_> = layers.iter().map(|l| l.header().expect("header")).collect();
+    // Null.
+    assert!(h[0].is_null_object());
+    assert!(h[0].source_id.is_some());
+    // Adjustment layer "Top".
+    assert!(h[1].is_adjustment());
+    assert_eq!(h[1].blend_mode, AepBlend::Multiply);
+    assert_eq!(h[1].label, 5);
+    assert_eq!(h[1].quality, AepQuality::Draft);
+    assert_eq!(h[1].parent_id, Some(h[3].id));
+    // "Mid".
+    assert!(h[2].is_locked() && h[2].is_shy() && h[2].is_solo());
+    assert!(!h[2].is_video_enabled() && !h[2].is_audio_enabled() && !h[2].is_effects_enabled());
+    assert!(h[2].is_motion_blur() && h[2].is_guide());
+    assert_eq!(h[2].blend_mode, AepBlend::Screen);
+    assert_eq!((h[2].start.num, h[2].start.den), (46_080, 30_720));
+    assert_eq!(h[2].in_point_seconds(), Some(2.0));
+    assert_eq!(h[2].out_point_seconds(), Some(6.0));
+    assert_eq!(h[2].name_copy, "Mid");
+    // Ids are unique.
+    let mut ids: Vec<u32> = h.iter().map(|x| x.id).collect();
+    ids.sort_unstable();
+    ids.dedup();
+    assert_eq!(ids.len(), 4);
+}
+
+#[test]
+fn solids_and_items() {
+    let mut p = Project::default();
+    let f = p.add_item("Folder A", Label::None, None, ItemKind::Folder);
+    add_comp(&mut p, "Comp 1", 100, 100, FrameRate::new(25, 1), 1.0, Some(f));
+    add_solid(&mut p, "Blue", 640, 360, [0.0, 0.0, 1.0], Some(f));
+    add_solid(&mut p, "Root solid", 31, 17, [1.0, 0.5, 0.25], None);
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let all = view.all_items();
+    let folder = all.iter().find(|i| i.display_name().as_deref() == Some("Folder A")).expect("folder");
+    let kids: Vec<_> = folder.children().collect();
+    assert_eq!(kids.len(), 2);
+    let blue = kids.iter().find(|i| i.kind() == Some(AepKind::Footage)).expect("blue");
+    let f = blue.footage().expect("footage");
+    assert!(f.is_solid);
+    assert_eq!((f.width, f.height), (640, 360));
+    assert_eq!(f.solid_rgb(), Some([0.0, 0.0, 1.0]));
+    let solids = all.iter().find(|i| i.display_name().as_deref() == Some("Solids")).expect("Solids folder");
+    let rs = solids.children().next().expect("root solid").footage().expect("f");
+    assert_eq!((rs.width, rs.height), (31, 17));
+    assert_eq!(rs.solid_rgb(), Some([1.0, 0.5, 0.25]));
+}
+
+fn transform_of(bytes: &[u8]) -> (effectcraft_aep::Transform, Vec<(String, Vec<(i32, Option<Interpolation>, Option<Interpolation>, Vec<f64>)>)>) {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find(|i| i.comp().is_some()).expect("comp");
+    let h = comp.comp().expect("c").header().expect("h");
+    let layer = comp.comp().expect("c").layers().next().expect("layer");
+    let tr = layer.transform(u32::from(h.width), u32::from(h.height)).expect("transform");
+    let mut keys = Vec::new();
+    if let Some(PropNode::Group(g)) = layer.properties().and_then(|p| p.get("ADBE Transform Group")) {
+        for name in ["ADBE Anchor Point", "ADBE Position", "ADBE Scale", "ADBE Rotate Z", "ADBE Opacity"] {
+            if let Some(PropNode::Property(pr)) = g.get(name)
+                && let Some(list) = pr.keys()
+            {
+                let recs = list
+                    .keyframes()
+                    .map(|k| (k.time_units().unwrap_or(0), k.interpolation_in(), k.interpolation_out(), k.value().unwrap_or_default()))
+                    .collect();
+                keys.push((name.to_string(), recs));
+            }
+        }
+    }
+    (tr, keys)
+}
+
+#[test]
+fn static_transform_values_use_the_file_units() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    let s = add_solid(&mut p, "L", 400, 300, [1.0, 0.5, 0.0], None);
+    add_layer(&mut p, c, "L", LayerSource::Solid { item: s }, (400, 300));
+    with_layer(&mut p, c, 0, |l| {
+        let tr = l.transform_mut().expect("tr");
+        tr.get_mut("anchor").expect("a").value = Value::Vec3([100.0, 50.0, 0.0]);
+        tr.get_mut("position").expect("p").value = Value::Vec3([300.0, 200.0, 0.0]);
+        tr.get_mut("scale").expect("s").value = Value::Vec3([50.0, 60.0, 100.0]);
+        tr.get_mut("rotation").expect("r").value = Value::Scalar(45.0);
+        tr.get_mut("opacity").expect("o").value = Value::Scalar(25.0);
+    });
+    let r = export_all(&p);
+    let (tr, keys) = transform_of(&r.bytes);
+    assert!(keys.is_empty());
+    let a = tr.anchor_px(400.0, 300.0);
+    assert!(close(a[0], 100.0) && close(a[1], 50.0));
+    assert_eq!(tr.anchor_fraction.value, [0.25, 50.0 / 300.0, 0.0]);
+    assert_eq!(tr.position.value, [300.0, 200.0, 0.0]);
+    assert_eq!(tr.scale_percent.value, [50.0, 60.0, 100.0]);
+    assert!(close(tr.rotation_degrees.value, 45.0));
+    assert!(close(tr.opacity_percent.value, 25.0));
+}
+
+#[test]
+fn defaults_are_not_written() {
+    let (p, _, _) = simple();
+    let r = export_all(&p);
+    let plain = export_all(&p);
+    assert_eq!(r.bytes, plain.bytes);
+    // A layer at the default values has no property record beyond the template's.
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find(|i| i.comp().is_some()).expect("comp");
+    let layer = comp.comp().expect("c").layers().next().expect("layer");
+    let Some(PropNode::Group(g)) = layer.properties().and_then(|p| p.get("ADBE Transform Group")) else { panic!("no group") };
+    for n in ["ADBE Anchor Point", "ADBE Position", "ADBE Scale", "ADBE Rotate Z", "ADBE Opacity"] {
+        assert!(g.get(n).is_none(), "{n} must be absent at its default");
+    }
+}
+
+#[test]
+fn keyframes_with_interpolation_ease_and_expressions() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    let s = add_solid(&mut p, "S", 400, 300, [0.2, 0.4, 0.6], None);
+    add_layer(&mut p, c, "S", LayerSource::Solid { item: s }, (400, 300));
+    with_layer(&mut p, c, 0, |l| {
+        let tr = l.transform_mut().expect("tr");
+        let o = tr.get_mut("opacity").expect("o");
+        let mut k0 = key(0.0, Value::Scalar(0.0));
+        let mut k1 = key(1.0, Value::Scalar(100.0));
+        k0.out_interp = Interp::Bezier;
+        k0.out_ease = vec![Ease { speed: 0.0, influence: 0.5 }];
+        k1.in_interp = Interp::Bezier;
+        k1.in_ease = vec![Ease { speed: 0.0, influence: 0.25 }];
+        k1.out_interp = Interp::Hold;
+        o.keys = vec![k0, k1, key(2.0, Value::Scalar(50.0))];
+        let rot = tr.get_mut("rotation").expect("r");
+        rot.value = Value::Scalar(10.0);
+        rot.expr = Some(effectcraft_project::Expression { text: "time*20".into(), enabled: false });
+    });
+    let r = export_all(&p);
+    assert_eq!(r.report.exported.keyframes, 3);
+    assert_eq!(r.report.exported.expressions, 1);
+    let (tr, keys) = transform_of(&r.bytes);
+    let (_, opacity) = keys.iter().find(|(n, _)| n == "ADBE Opacity").expect("opacity keys");
+    assert_eq!(opacity.len(), 3);
+    assert_eq!(opacity[0].0, 0);
+    assert_eq!(opacity[1].0, 25_600);
+    assert_eq!(opacity[2].0, 51_200);
+    assert_eq!(opacity[0].2, Some(Interpolation::Bezier));
+    assert_eq!(opacity[1].1, Some(Interpolation::Bezier));
+    assert_eq!(opacity[1].2, Some(Interpolation::Hold));
+    assert_eq!(opacity[1].3, vec![1.0]);
+    assert!(close(tr.rotation_degrees.value, 10.0));
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find(|i| i.comp().is_some()).expect("comp");
+    let layer = comp.comp().expect("c").layers().next().expect("layer");
+    let Some(PropNode::Group(g)) = layer.properties().and_then(|p| p.get("ADBE Transform Group")) else { panic!("no group") };
+    let Some(PropNode::Property(rot)) = g.get("ADBE Rotate Z") else { panic!("no rotation") };
+    assert_eq!(rot.expression().as_deref(), Some("time*20"));
+    assert_eq!(rot.expression_enabled(), Some(false));
+}
+
+#[test]
+fn losses_are_reported_and_refused_unless_allowed() {
+    let (mut p, c, _) = simple();
+    let t = add_comp(&mut p, "T", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    add_layer(&mut p, t, "Par", LayerSource::Light { kind: effectcraft_project::LightKind::Parallel }, (100, 100));
+    add_layer(&mut p, t, "Amb", LayerSource::Light { kind: effectcraft_project::LightKind::Ambient }, (100, 100));
+    with_layer(&mut p, c, 0, |l| {
+        l.blend_mode = BlendMode::Dissolve;
+        l.switches.three_d = true;
+        // A stretch that is not an exact small ratio is written unstretched.
+        l.stretch = 100.0 * std::f64::consts::PI;
+        l.transform_mut().expect("tr").get_mut("rotation").expect("r").keys = vec![key(0.0, Value::Scalar(0.0)), key(1.0, Value::Scalar(90.0))];
+    });
+    let rep = analyze(&p);
+    assert_eq!(rep.count(LossCategory::Lights), 2);
+    assert_eq!(rep.count(LossCategory::BlendModes), 1);
+    // The 3D switch is written.
+    assert_eq!(rep.count(LossCategory::ThreeD), 0);
+    assert_eq!(rep.count(LossCategory::TimeStretch), 1);
+    assert!(!rep.limitations.is_empty());
+    match export(&p, &ExportOptions::default()) {
+        Err(AepExportError::Refused(r)) => assert_eq!(*r, rep),
+        other => panic!("expected a refusal, got {other:?}"),
+    }
+    let ok = export(&p, &ExportOptions { allow_losses: true }).expect("allowed");
+    assert_eq!(ok.report, rep);
+    // The report round-trips through JSON.
+    let json = serde_json::to_string(&rep).expect("json");
+    assert_eq!(serde_json::from_str::<effectcraft_aep::export::ExportReport>(&json).expect("back"), rep);
+}
+
+#[test]
+fn the_exported_file_is_deterministic() {
+    let (p, _, _) = simple();
+    assert_eq!(export_all(&p).bytes, export_all(&p).bytes);
+}
+
+/// The user, host and domain names of the machine that runs the test, lower-cased. They are read from
+/// the environment so that no name is written down in the repository; names shorter than three
+/// characters are skipped because they would match by chance.
+fn local_names() -> Vec<String> {
+    ["USERNAME", "USER", "COMPUTERNAME", "HOSTNAME", "USERDOMAIN"]
+        .into_iter()
+        .filter_map(|key| std::env::var(key).ok())
+        .map(|v| v.trim().to_lowercase())
+        .filter(|v| v.len() >= 3)
+        .collect()
+}
+
+/// Absolute drive-letter paths (`X:\…`, `X:/…`) in a lower-cased text, except the neutral
+/// `c:\fixtures\` paths the fixtures use.
+fn drive_paths(hay: &str) -> Vec<String> {
+    let b = hay.as_bytes();
+    let mut found = Vec::new();
+    for i in 0..b.len().saturating_sub(3) {
+        let starts = i == 0 || !b[i - 1].is_ascii_alphanumeric();
+        if starts
+            && b[i].is_ascii_alphabetic()
+            && b[i + 1] == b':'
+            && matches!(b[i + 2], b'\\' | b'/')
+            && b[i + 3].is_ascii_alphanumeric()
+            && !b[i..].starts_with(b"c:\\fixtures\\")
+            && !b[i..].starts_with(b"c:/fixtures/")
+        {
+            found.push(String::from_utf8_lossy(&b[i..b.len().min(i + 16)]).into_owned());
+        }
+    }
+    found
+}
+
+/// E-mail-like strings (`local@domain.tld`) in a lower-cased text.
+fn email_like(hay: &str) -> Vec<String> {
+    let b = hay.as_bytes();
+    let local = |c: u8| c.is_ascii_alphanumeric() || b"._%+-".contains(&c);
+    let domain = |c: u8| c.is_ascii_alphanumeric() || c == b'-' || c == b'.';
+    let mut found = Vec::new();
+    for at in (0..b.len()).filter(|&i| b[i] == b'@') {
+        let mut s = at;
+        while s > 0 && local(b[s - 1]) {
+            s -= 1;
+        }
+        let mut e = at + 1;
+        while e < b.len() && domain(b[e]) {
+            e += 1;
+        }
+        while e > at + 1 && b[e - 1] == b'.' {
+            e -= 1;
+        }
+        let host = &b[at + 1..e];
+        let tld = host.iter().rposition(|&c| c == b'.').map(|dot| &host[dot + 1..]);
+        let has_dot_inside = host.iter().position(|&c| c == b'.').is_some_and(|dot| dot > 0);
+        if s < at && has_dot_inside && tld.is_some_and(|t| t.len() >= 2 && t.iter().all(u8::is_ascii_alphabetic)) {
+            found.push(String::from_utf8_lossy(&b[s..e]).into_owned());
+        }
+    }
+    found
+}
+
+/// Everything the exporter writes is built in code: an export holds no local name, path or
+/// address.
+#[test]
+fn the_export_holds_no_local_data() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    let s = add_solid(&mut p, "Red", 50, 50, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, c, "Red", LayerSource::Solid { item: s }, (50, 50));
+    add_layer(&mut p, c, "N", LayerSource::Null, (100, 100));
+    let export = export_all(&p).bytes;
+    let names = local_names();
+    let fixed = ["desktop-", "\\users\\", "/users/", "/home/"];
+    for (name, bytes) in [("export", &export[..])] {
+        // Strings are searched as bytes and, with the NUL bytes removed, as UTF-16 text.
+        let utf16: Vec<u8> = bytes.iter().copied().filter(|&c| c != 0).collect();
+        for hay in [String::from_utf8_lossy(bytes).to_lowercase(), String::from_utf8_lossy(&utf16).to_lowercase()] {
+            for needle in names.iter().map(String::as_str).chain(fixed) {
+                assert!(!hay.contains(needle), "{name} contains a local name or path");
+            }
+            assert_eq!(drive_paths(&hay), Vec::<String>::new(), "{name} holds an absolute local path");
+            assert_eq!(email_like(&hay), Vec::<String>::new(), "{name} holds an e-mail address");
+        }
+    }
+}
+
+#[test]
+fn the_local_data_search_finds_what_it_looks_for() {
+    assert_eq!(drive_paths("x d:\\work\\a.aep y"), vec!["d:\\work\\a.aep y".to_string()]);
+    assert_eq!(drive_paths("q:/media/a.mov"), vec!["q:/media/a.mov".to_string()]);
+    assert!(drive_paths("c:\\fixtures\\a.png and c:/fixtures/b.png").is_empty());
+    assert!(drive_paths("http://example and 12:30 and ab:/x").is_empty());
+    assert_eq!(email_like("by jane.doe@example.org."), vec!["jane.doe@example.org".to_string()]);
+    assert!(email_like("@@ a@b x@.org y@host").is_empty());
+}
+
+#[test]
+fn a_root_folder_named_solids_is_the_solids_folder() {
+    let mut p = Project::default();
+    let f = p.add_item("Solids", Label::None, None, ItemKind::Folder);
+    let c = add_comp(&mut p, "C", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    let s = add_solid(&mut p, "Orange", 50, 50, [1.0, 0.5, 0.0], Some(f));
+    add_layer(&mut p, c, "Orange", LayerSource::Solid { item: s }, (50, 50));
+    add_layer(&mut p, c, "N", LayerSource::Null, (100, 100));
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let folders: Vec<_> = view.all_items().into_iter().filter(|i| i.kind() == Some(AepKind::Folder)).collect();
+    assert_eq!(folders.len(), 1, "one Solids folder, not two");
+    let kids: Vec<_> = folders[0].children().filter_map(|k| k.footage()).collect();
+    assert_eq!(kids.len(), 2, "the solid and the hidden null solid");
+    assert!(kids.iter().all(|k| k.is_solid));
+}
+
+#[test]
+fn the_3d_switch_is_written() {
+    // 015: ldta@38 bit 0x04.
+    let (mut p, c, _) = simple();
+    with_layer(&mut p, c, 0, |l| {
+        l.switches.three_d = true;
+        l.transform_mut().expect("tr").get_mut("position").expect("p").value = Value::Vec3([960.0, 540.0, 300.0]);
+    });
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let layer = view.all_items().into_iter().find_map(|i| i.comp()).and_then(|c| c.layers().next()).expect("layer");
+    assert!(layer.header().expect("header").is_three_d());
+    let Some(PropNode::Group(g)) = layer.properties().and_then(|p| p.get("ADBE Transform Group")) else { panic!("transform") };
+    let Some(PropNode::Property(pos)) = g.get("ADBE Position") else { panic!("position") };
+    assert_eq!(pos.static_value().expect("value")[..3], [960.0, 540.0, 300.0]);
+}
+
+#[test]
+fn time_stretch_is_the_exact_ratio_and_scales_the_time_scale() {
+    // 018 (200 %: 2/1, 51 200), 316 (50 %: 1/2, 25 600), 317 (150 %: 3/2, 38 400).
+    for (pct, num, den, ts) in [(200.0, 2i32, 1u32, 51_200u32), (50.0, 1, 2, 25_600), (150.0, 3, 2, 38_400)] {
+        let (mut p, c, _) = simple();
+        with_layer(&mut p, c, 0, |l| {
+            l.stretch = pct;
+            l.start_time = secs(1.0);
+            l.in_point = secs(1.0);
+            l.out_point = secs(1.0 + 2.0 * pct / 100.0);
+            l.transform_mut().expect("tr").get_mut("opacity").expect("o").value = Value::Scalar(50.0);
+        });
+        let r = export_all(&p);
+        assert!(r.report.is_lossless(), "{pct}: {:?}", r.report.losses);
+        let file = parse(&r.bytes).expect("parse");
+        let view = effectcraft_aep::Project::new(&file).expect("project");
+        let layer = view.all_items().into_iter().find_map(|i| i.comp()).and_then(|c| c.layers().next()).expect("layer");
+        let h = layer.header().expect("header");
+        assert_eq!((h.stretch, h.stretch_den), (num, den), "{pct}");
+        // Relative times in source time: the 2 s of source end 2 s after the start.
+        assert_eq!((h.in_relative.num, h.out_relative.num), (0, 51_200), "{pct}");
+        let Some(PropNode::Group(g)) = layer.properties().and_then(|p| p.get("ADBE Transform Group")) else { panic!("transform") };
+        let Some(PropNode::Property(o)) = g.get("ADBE Opacity") else { panic!("opacity") };
+        assert_eq!(o.time_scale(), Some(ts), "{pct}");
+        // And back.
+        let mut q = Project::default();
+        let none = |_: &str| false;
+        effectcraft_aep::import::import(
+            &mut q,
+            &r.bytes,
+            &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+        )
+        .expect("import");
+        let l = q.items.values().find_map(|i| if let ItemKind::Comp(c) = &i.kind { c.layers.first().cloned() } else { None }).expect("layer");
+        assert!((l.stretch - pct).abs() < 1e-9 && l.out_point == secs(1.0 + 2.0 * pct / 100.0), "{pct}: {} {:?}", l.stretch, l.out_point);
+    }
+    // A ratio that is not small and exact is reported.
+    let (mut p, c, _) = simple();
+    with_layer(&mut p, c, 0, |l| l.stretch = 31.4159265);
+    assert_eq!(export_all(&p).report.count(LossCategory::TimeStretch), 1);
+}
+
+#[test]
+fn unwritten_layer_switches_and_off_frame_times_are_reported() {
+    // Each of these changes the result in After Effects, so none may pass as lossless.
+    let (mut p, c, _) = simple();
+    with_layer(&mut p, c, 0, |l| {
+        l.switches.quality = Quality::Wireframe;
+        l.preserve_transparency = true;
+        l.auto_orient = effectcraft_project::AutoOrient::AlongPath;
+        l.in_point = secs(0.013);
+    });
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::LayerSwitches), 3, "{:?}", r.report.losses);
+    assert_eq!(r.report.count(LossCategory::RoundedTimes), 1, "{:?}", r.report.losses);
+    assert!(matches!(export(&p, &ExportOptions { allow_losses: false }), Err(AepExportError::Refused(_))));
+}
diff --git a/crates/aep/tests/it/export/ease.rs b/crates/aep/tests/it/export/ease.rs
new file mode 100644
index 000000000..f27057f0a
--- /dev/null
+++ b/crates/aep/tests/it/export/ease.rs
@@ -0,0 +1,65 @@
+//! Bezier ease the importer decodes is written back: Anchor Point keys (597, 730: speed in pixels
+//! per second over the source height), effect point keys (598) and mask path keys (599, 700:
+//! the ease at bytes 24..55 of the 64-byte record). The key records of the export equal After
+//! Effects' in time, interpolation and ease.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{Body, Chunk, parse};
+use effectcraft_project::Project;
+
+/// The key records (`ldat`) of the first property named `name` below a layer, split into records.
+fn key_records(bytes: &[u8], name: &str) -> Vec<Vec<u8>> {
+    fn walk(cs: &[Chunk<'_>], name: &str) -> Option<Vec<Vec<u8>>> {
+        for (i, c) in cs.iter().enumerate() {
+            if c.is(b"tdmn") && matches!(&c.body, Body::Data(d) if d.split(|x| *x == 0).next() == Some(name.as_bytes())) {
+                let node = cs.get(i + 1)?;
+                // A property record, or the mask shape inside its atom.
+                let tdbs = if node.is_list(b"tdbs") { Some(node) } else { node.children().iter().find(|k| k.is_list(b"tdbs")) };
+                if let Some(list) = tdbs.and_then(|t| t.child_list(b"list")) {
+                    let size =
+                        list.child(b"lhd3").and_then(|c| c.bytes()).and_then(|b| b.get(16..20)).map(|b| u32::from_be_bytes(b.try_into().unwrap()) as usize)?;
+                    let ldat = list.child(b"ldat").and_then(|c| c.bytes())?;
+                    return Some(ldat.chunks(size).map(<[u8]>::to_vec).collect());
+                }
+            }
+            if let Some(r) = walk(c.children(), name) {
+                return Some(r);
+            }
+        }
+        None
+    }
+    let f = parse(bytes).expect("parse");
+    walk(&f.chunks, name).unwrap_or_default()
+}
+
+#[test]
+fn decoded_bezier_ease_is_written_as_after_effects_wrote_it() {
+    for (name, prop) in [
+        ("597-key-anchor-ease-out50-40-in30-60.aep", "ADBE Anchor Point"),
+        ("730-key-anchor-ease-on-400x800-solid.aep", "ADBE Anchor Point"),
+        ("598-key-ramp-point-ease-color-bezier.aep", "ADBE Ramp-0001"),
+        ("599-key-mask-path-ease-infl75.aep", "ADBE Mask Shape"),
+        ("700-key-mask-path-ease-out20-in50.aep", "ADBE Mask Shape"),
+    ] {
+        let bytes = fixture!(name);
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        import(&mut p, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+        let r = export_all(&p);
+        assert_eq!(r.report.count(LossCategory::ApproximatedKeyframes), 0, "{name}: {:?}", r.report.losses);
+        let (a, b) = (key_records(&bytes, prop), key_records(&r.bytes, prop));
+        assert!(a.len() >= 2, "{name}: {}", a.len());
+        assert_eq!(a.len(), b.len(), "{name}");
+        let f = |r: &[u8], at: usize| f64::from_be_bytes(r[at..at + 8].try_into().unwrap());
+        for (i, (x, y)) in a.iter().zip(&b).enumerate() {
+            assert_eq!(x[..6], y[..6], "{name} key {i}: time and interpolation");
+            // The used sides: the out side of the first key, the in side of the last.
+            let sides: &[usize] = if i == 0 { &[40, 48] } else { &[24, 32] };
+            for at in sides {
+                assert!((f(x, *at) - f(y, *at)).abs() < 1e-9, "{name} key {i} @{at}: {} vs {}", f(x, *at), f(y, *at));
+            }
+        }
+    }
+}
diff --git a/crates/aep/tests/it/export/effects.rs b/crates/aep/tests/it/export/effects.rs
new file mode 100644
index 000000000..f8f388d0f
--- /dev/null
+++ b/crates/aep/tests/it/export/effects.rs
@@ -0,0 +1,751 @@
+//! Effects (Tint, Gradient Ramp, Exposure): every effect fixture is imported and exported, and the
+//! exported effects are parsed back with `effectcraft-aep` and compared with the ones After
+//! Effects wrote, parameter by parameter (stored values, keys, definitions); projects edited in
+//! code check the parameters no fixture changes, several instances, and what is reported.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{AepFile, ParamValue, parse};
+use effectcraft_keyframe::{Interp, Value};
+use effectcraft_project::{ItemKind, Node, Project, PropGroup};
+
+fn fixtures_with_effects() -> Option<Vec<String>> {
+    Some({
+        let mut v: Vec<String> = crate::common::names("aep")?
+            .into_iter()
+            // Every fixture with an effect of the table (the dropdown and layer controls are not in it).
+            .filter(|n| {
+                n.ends_with(".aep")
+                    && (n.contains("-fx-") || n.contains("key-fill") || n.contains("key-ramp") || n.contains("adj-ramp"))
+                    && !n.contains("dropdown")
+                    && !n.contains("layercontrol")
+            })
+            .collect();
+        v.sort();
+        v
+    })
+}
+
+fn import_bytes(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    import(&mut p, bytes, &opts).expect("import");
+    p
+}
+
+/// One effect as the reader sees it: match name, instance name, and per parameter index the
+/// stored value (None = default) and the keys `(time units, value)`.
+#[derive(Debug, PartialEq)]
+struct Seen {
+    match_name: String,
+    name: Option<String>,
+    params: Vec<(usize, Option<ParamValue>, Vec<(i32, Vec<f64>, (u8, u8))>)>,
+}
+
+/// The effects of every layer, by (composition name, layer index).
+fn effects_of(file: &AepFile<'_>) -> Vec<((String, usize), Vec<Seen>)> {
+    let view = effectcraft_aep::Project::new(file).expect("project");
+    let mut out = Vec::new();
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        let cname = item.display_name().unwrap_or_default();
+        for (i, layer) in comp.layers().enumerate() {
+            let mut fx = Vec::new();
+            // Effects outside the table are reported by the importer, not written.
+            for e in layer.effects().into_iter().filter(|e| effectcraft_aep::effect_map::by_match_name(e.match_name()).is_some()) {
+                let mut params = Vec::new();
+                for p in view.effect_params(&e) {
+                    let keys = p
+                        .keys()
+                        .map(|k| {
+                            k.keyframes()
+                                .map(|r| {
+                                    let interp = (
+                                        r.interpolation_in().map_or(0, |x| match x {
+                                            effectcraft_aep::Interpolation::Linear => 1,
+                                            effectcraft_aep::Interpolation::Bezier => 2,
+                                            effectcraft_aep::Interpolation::Hold => 3,
+                                            effectcraft_aep::Interpolation::Other(c) => c,
+                                        }),
+                                        r.interpolation_out().map_or(0, |x| match x {
+                                            effectcraft_aep::Interpolation::Linear => 1,
+                                            effectcraft_aep::Interpolation::Bezier => 2,
+                                            effectcraft_aep::Interpolation::Hold => 3,
+                                            effectcraft_aep::Interpolation::Other(c) => c,
+                                        }),
+                                    );
+                                    (r.time_units().unwrap_or(-1), r.value().unwrap_or_default(), interp)
+                                })
+                                .collect()
+                        })
+                        .unwrap_or_default();
+                    let value = if p.is_animated() { None } else { p.stored_value() };
+                    params.push((p.index, value, keys));
+                }
+                fx.push(Seen { match_name: e.match_name().to_string(), name: e.display_name(), params });
+            }
+            if !fx.is_empty() {
+                out.push(((cname.clone(), i), fx));
+            }
+        }
+    }
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+fn close_value(a: &Option<ParamValue>, b: &Option<ParamValue>) -> bool {
+    let comps = |v: &ParamValue| -> Vec<f64> {
+        match v {
+            ParamValue::Number(n) => vec![*n],
+            ParamValue::Point(p) => p.to_vec(),
+            ParamValue::Argb(c) => c.iter().skip(1).copied().collect(),
+            ParamValue::Index(i) => vec![f64::from(*i)],
+            ParamValue::Bool(b) => vec![if *b { 1.0 } else { 0.0 }],
+            other => panic!("unexpected {other:?}"),
+        }
+    };
+    match (a, b) {
+        (None, None) => true,
+        // The input layer names the owning layer by its id, which differs between the files.
+        (Some(ParamValue::Layer(_)), Some(ParamValue::Layer(_))) => true,
+        (Some(x), Some(y)) => comps(x).iter().zip(comps(y)).all(|(p, q)| (p - q).abs() < 1e-6),
+        _ => false,
+    }
+}
+
+#[test]
+fn every_effect_fixture_is_written_as_after_effects_wrote_it() {
+    let names = skip!(fixtures_with_effects());
+    assert!(names.len() >= 20, "{names:?}");
+    let mut compared = 0;
+    for name in &names {
+        let bytes = fixture!(name);
+        let original = parse(&bytes).expect("parse");
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let imported = import(&mut p, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+        let lossy: Vec<String> = imported.report.losses.iter().flat_map(|l| l.details.clone()).collect();
+        let r = export_all(&p);
+        assert_eq!(r.report.count(LossCategory::Effects), 0, "{name}: {:?}", r.report.losses);
+        let exported = parse(&r.bytes).expect("parse export");
+        let (a, b) = (effects_of(&original), effects_of(&exported));
+        assert_eq!(a.len(), b.len(), "{name}: layers with effects");
+        for ((ka, fa), (kb, fb)) in a.iter().zip(&b) {
+            assert_eq!(ka, kb, "{name}");
+            assert_eq!(fa.len(), fb.len(), "{name}: effect count");
+            for (x, y) in fa.iter().zip(fb) {
+                assert_eq!((&x.match_name, &x.name), (&y.match_name, &y.name), "{name}");
+                // Written as the importer took it over (712: CC Radial Blur's Type Scratch has no
+                // EffectCraft item, reported on import).
+                if lossy.iter().any(|d| d.contains(&format!("({})", x.match_name))) {
+                    continue;
+                }
+                assert_eq!(x.params.len(), y.params.len(), "{name}: parameters of {}", x.match_name);
+                for (px, py) in x.params.iter().zip(&y.params) {
+                    assert_eq!(px.0, py.0, "{name}");
+                    assert!(close_value(&px.1, &py.1), "{name} {} #{}: {:?} vs {:?}", x.match_name, px.0, px.1, py.1);
+                    assert_eq!(px.2.len(), py.2.len(), "{name} #{} keys", px.0);
+                    // A colour key switched to bezier stores speed 0 / influence 0, which After
+                    // Effects interpolates linearly (598): it is imported and written linear.
+                    let colour = matches!(px.2.first().map(|k| k.1.len()), Some(4));
+                    let lin = |i: (u8, u8)| if colour { (i.0.min(1), i.1.min(1)) } else { i };
+                    for (kx, ky) in px.2.iter().zip(&py.2) {
+                        assert_eq!((kx.0, lin(kx.2)), (ky.0, lin(ky.2)), "{name} #{} key", px.0);
+                        assert!(kx.1.iter().zip(&ky.1).all(|(p, q)| (p - q).abs() < 1e-6), "{name} #{} key value {:?} {:?}", px.0, kx.1, ky.1);
+                    }
+                }
+                compared += 1;
+            }
+        }
+        // The input layer of every exported instance names the layer that owns it (320).
+        let view = effectcraft_aep::Project::new(&exported).expect("project");
+        for item in view.all_items() {
+            let Some(comp) = item.comp() else { continue };
+            for layer in comp.layers() {
+                let id = layer.header().map(|h| h.id).expect("header");
+                for e in layer.effects() {
+                    let input = view.effect_params(&e).into_iter().find(|p| p.index == 0).and_then(|p| p.stored_value());
+                    assert_eq!(input, Some(ParamValue::Layer(id)), "{name}: input layer of {}", e.match_name());
+                }
+            }
+        }
+        // The container is consistent and the result imports to the same effect values.
+        assert_eq!(effectcraft_aep::write(&exported).expect("write"), r.bytes, "{name}");
+        let q = import_bytes(&r.bytes);
+        assert_eq!(effect_values(&p), effect_values(&q), "{name}: values after a second import");
+    }
+    assert!(compared >= 20, "{compared}");
+}
+
+/// Every effect parameter of the project: (comp, layer, effect, param path, value, key count).
+fn effect_values(p: &Project) -> Vec<(String, String, String, String, Vec<i64>, usize)> {
+    let mut out = Vec::new();
+    for item in p.items.values() {
+        let ItemKind::Comp(c) = &item.kind else { continue };
+        for l in &c.layers {
+            let Some(fx) = l.effects() else { continue };
+            for g in fx.groups() {
+                let mut stack: Vec<(&PropGroup, String)> = vec![(g, String::new())];
+                while let Some((grp, pre)) = stack.pop() {
+                    for n in &grp.children {
+                        match n {
+                            Node::Group(s) => stack.push((s, format!("{pre}{}/", s.match_id))),
+                            Node::Prop(pr) => out.push((
+                                item.name.clone(),
+                                l.name.clone(),
+                                g.name.clone(),
+                                format!("{pre}{}", pr.match_id),
+                                pr.value.components().iter().map(|v| (v * 1e6).round() as i64).collect(),
+                                pr.keys.len(),
+                            )),
+                        }
+                    }
+                }
+            }
+        }
+    }
+    out.sort();
+    out
+}
+
+/// The Tint of 356 imported, edited by `f`.
+fn tint(f: impl FnOnce(&mut PropGroup)) -> Option<Project> {
+    Some({
+        let mut p = import_bytes(&crate::common::try_fixture("356-fx-tint-default.aep")?);
+        let id = p.items.values().find(|i| i.name == "C").map(|i| i.id).expect("C");
+        with_layer(&mut p, id, 0, |l| {
+            let g =
+                l.props.sub_mut("effects").and_then(|e| e.children.iter_mut().find_map(|n| if let Node::Group(g) = n { Some(g) } else { None })).expect("tint");
+            f(g);
+        });
+        p
+    })
+}
+
+#[test]
+fn edited_parameters_and_keys_no_fixture_has() {
+    let p = skip!(tint(|g| {
+        g.get_mut("black").expect("black").value = Value::Color([0.25, 0.5, 0.75, 1.0]);
+        g.get_mut("white").expect("white").keys = vec![key(0.0, Value::Color([1.0, 0.0, 0.0, 1.0])), key(1.0, Value::Color([0.0, 0.0, 1.0, 1.0]))];
+        // A keyed property shows its first key's value.
+        g.get_mut("white").expect("white").value = Value::Color([1.0, 0.0, 0.0, 1.0]);
+        g.get_mut("amount").expect("amount").value = Value::Scalar(10.0);
+        let mut k0 = key(0.0, Value::Scalar(10.0));
+        k0.out_interp = Interp::Hold;
+        g.get_mut("amount").expect("amount").keys = vec![k0, key(2.0, Value::Scalar(90.0))];
+        g.name = "My Tint".into();
+    }));
+    let r = export_all(&p);
+    assert_eq!(r.report.exported.effects, 1);
+    assert_eq!(r.report.count(LossCategory::Effects), 0, "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    let seen = effects_of(&file);
+    let fx = &seen.first().expect("layer").1[0];
+    assert_eq!(fx.name.as_deref(), Some("My Tint"));
+    // As After Effects stores a renamed instance (610): fnam keeps the effect's name.
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let e = view.all_items().into_iter().find_map(|i| i.comp()).and_then(|c| c.layers().next()).map(|l| l.effects()).expect("effects");
+    assert_eq!((e[0].name().as_deref(), e[0].user_name().as_deref()), (Some("Tint"), Some("My Tint")));
+    let param = |i: usize| fx.params.iter().find(|p| p.0 == i).expect("param");
+    match &param(1).1 {
+        Some(ParamValue::Argb(c)) => assert!((c[1] - 0.25).abs() < 1e-6 && (c[2] - 0.5).abs() < 1e-6 && (c[3] - 0.75).abs() < 1e-6, "{c:?}"),
+        other => panic!("{other:?}"),
+    }
+    let white = &param(2).2;
+    assert_eq!(white.len(), 2);
+    assert_eq!(white[1].0, 25_600);
+    assert_eq!(white[1].1, vec![255.0, 0.0, 0.0, 255.0]);
+    let amount = &param(3).2;
+    assert_eq!(amount.iter().map(|k| (k.0, k.1[0], k.2)).collect::<Vec<_>>(), vec![(0, 10.0, (1, 3)), (51_200, 90.0, (1, 1))]);
+    // And back.
+    let q = import_bytes(&r.bytes);
+    assert_eq!(effect_values(&p).into_iter().filter(|v| v.2 == "My Tint").count(), 3);
+    assert_eq!(
+        effect_values(&p)
+            .into_iter()
+            .map(|mut v| {
+                v.1.clear();
+                v
+            })
+            .collect::<Vec<_>>(),
+        effect_values(&q)
+            .into_iter()
+            .map(|mut v| {
+                v.1.clear();
+                v
+            })
+            .collect::<Vec<_>>()
+    );
+}
+
+#[test]
+fn several_instances_share_one_definition_copy() {
+    // Two Tints and a Ramp on one layer, a Ramp on a second layer.
+    let mut p = import_bytes(&fixture!("383-fx-ramp-on-100x100-start-10-20.aep"));
+    let tint_src = import_bytes(&fixture!("356-fx-tint-default.aep"));
+    let tint_group = tint_src
+        .items
+        .values()
+        .find_map(|i| if let ItemKind::Comp(c) = &i.kind { c.layers.first().and_then(|l| l.effects()).and_then(|e| e.groups().next().cloned()) } else { None })
+        .expect("tint");
+    let c = p.items.values().find(|i| i.name == "C").map(|i| i.id).expect("C");
+    with_layer(&mut p, c, 0, |l| {
+        let fx = l.props.sub_mut("effects").expect("effects");
+        fx.children.push(Node::Group(tint_group.clone()));
+        fx.children.push(Node::Group(tint_group));
+    });
+    let r = export_all(&p);
+    assert_eq!(r.report.exported.effects, 4, "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let mut full = Vec::new();
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for layer in comp.layers() {
+            for e in layer.effects() {
+                full.push((e.match_name().to_string(), e.has_own_definitions()));
+            }
+        }
+    }
+    // The first instance of each type in the file holds the definitions.
+    assert_eq!(full.iter().filter(|(_, own)| *own).count(), 2, "{full:?}");
+    assert_eq!(full.len(), 4);
+    let defs: Vec<String> = view.effect_definitions().into_iter().map(|(n, _)| n).collect();
+    assert_eq!(defs, vec!["ADBE Ramp".to_string(), "ADBE Tint".to_string()]);
+    let pefl: Vec<String> =
+        file.list(b"Pefl").expect("Pefl").children().iter().filter_map(|c| c.bytes()).map(|b| String::from_utf8_lossy(b).to_string()).collect();
+    assert_eq!(pefl, vec!["ADBE Ramp".to_string(), "ADBE Tint".to_string()]);
+    let efdc = file.list(b"EfdG").and_then(|g| g.child(b"EfDC")).and_then(|c| c.bytes()).expect("EfDC");
+    assert_eq!(efdc, &2u32.to_le_bytes());
+    // Every instance reads its parameters (borrowed definitions included) and imports again.
+    let q = import_bytes(&r.bytes);
+    assert_eq!(effect_values(&q).iter().map(|v| v.2.clone()).collect::<std::collections::BTreeSet<_>>().len(), 2);
+    let n: usize = q
+        .items
+        .values()
+        .filter_map(|i| {
+            if let ItemKind::Comp(c) = &i.kind { Some(c.layers.iter().filter_map(|l| l.effects()).map(|e| e.groups().count()).sum::<usize>()) } else { None }
+        })
+        .sum();
+    assert_eq!(n, 4);
+}
+
+#[test]
+fn what_cannot_be_written_is_reported() {
+    let p = skip!(tint(|g| {
+        g.enabled = false;
+        g.get_mut("amount").expect("amount").expr = Some(effectcraft_project::Expression { text: "50".into(), enabled: true });
+    }));
+    let r = export_all(&p);
+    // The switch (fx-switch cases) and the expression (534) are written; a second import gets the
+    // effect switched off.
+    assert_eq!(r.report.count(LossCategory::Effects), 0, "{:?}", r.report.losses);
+    let back = import_bytes(&r.bytes);
+    let off = back
+        .comps()
+        .flat_map(|(_, c)| c.layers.iter())
+        .filter_map(|l| l.props.sub("effects"))
+        .flat_map(|e| e.children.iter())
+        .any(|n| matches!(n, Node::Group(g) if !g.enabled));
+    assert!(off, "the switched-off effect comes back switched off");
+    // An effect outside the table.
+    let mut q = import_bytes(&fixture!("356-fx-tint-default.aep"));
+    let c = q.items.values().find(|i| i.name == "C").map(|i| i.id).expect("C");
+    with_layer(&mut q, c, 0, |l| {
+        if let Some(Node::Group(g)) = l.props.sub_mut("effects").and_then(|e| e.children.first_mut()) {
+            g.kind = effectcraft_project::GroupKind::Effect { effect: "ec.distort.notmapped".into() };
+        }
+    });
+    let r = export_all(&q);
+    assert_eq!(r.report.count(LossCategory::Effects), 1);
+    assert_eq!(r.report.exported.effects, 0);
+    parse(&r.bytes).expect("still a valid file");
+}
+
+/// Lumetri Color is imported but not written (no prototype to write from): the export reports it
+/// as a loss and still produces a valid file.
+#[test]
+fn lumetri_color_is_reported_not_written() {
+    let mut p = skip!(tint(|_| {}));
+    let c = p.items.values().find(|i| i.name == "C").map(|i| i.id).expect("C");
+    with_layer(&mut p, c, 0, |l| {
+        if let Some(Node::Group(g)) = l.props.sub_mut("effects").and_then(|e| e.children.first_mut()) {
+            g.kind = effectcraft_project::GroupKind::Effect { effect: "ec.color.lumetri".into() };
+        }
+    });
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::Effects), 1, "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.effects, 0);
+    parse(&r.bytes).expect("still a valid file");
+}
+
+/// CC Color Neutralizer, EXtractoR and IDentifier are in the import table but have no prototype
+/// to write from: each is reported, not written.
+#[test]
+fn imported_plug_in_effects_are_reported_not_written() {
+    for effect in ["ec.color.cccolorneutralizer", "ec.3d.extractor", "ec.3d.identifier"] {
+        let mut p = skip!(tint(|_| {}));
+        let c = p.items.values().find(|i| i.name == "C").map(|i| i.id).expect("C");
+        with_layer(&mut p, c, 0, |l| {
+            if let Some(Node::Group(g)) = l.props.sub_mut("effects").and_then(|e| e.children.first_mut()) {
+                g.kind = effectcraft_project::GroupKind::Effect { effect: effect.into() };
+            }
+        });
+        let r = export_all(&p);
+        assert_eq!(r.report.count(LossCategory::Effects), 1, "{effect}: {:?}", r.report.losses);
+        assert_eq!(r.report.exported.effects, 0, "{effect}");
+        parse(&r.bytes).expect("still a valid file");
+    }
+}
+
+#[test]
+fn hostile_effect_values_never_panic() {
+    for v in [Value::Scalar(f64::NAN), Value::Scalar(1e300), Value::Color([f32::NAN as f64, 2.0, -1.0, 1.0]), Value::Bool(true), Value::Text(Box::default())] {
+        let p = skip!(tint(|g| {
+            g.get_mut("black").expect("black").value = v.clone();
+            g.get_mut("amount").expect("amount").value = v.clone();
+            g.get_mut("white").expect("white").keys = vec![key(0.0, v.clone()), key(0.0, v.clone()), key(1e12, v.clone())];
+        }));
+        let r = export_all(&p);
+        let file = parse(&r.bytes).expect("parse");
+        assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+        let _ = import_bytes(&r.bytes);
+    }
+}
+
+/// The static value records (`tdbs` with a `cdat`) of the mapped parameters of every effect
+/// instance, by (composition, layer index, effect index, record name).
+fn static_records(file: &AepFile<'_>) -> std::collections::BTreeMap<(String, usize, usize, String), effectcraft_aep::Chunk<'static>> {
+    let view = effectcraft_aep::Project::new(file).expect("project");
+    let mut out = std::collections::BTreeMap::new();
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        let cname = item.display_name().unwrap_or_default();
+        for (li, layer) in comp.layers().enumerate() {
+            for (ei, e) in layer.effects().into_iter().enumerate() {
+                let Some(spec) = effectcraft_aep::effect_map::by_match_name(e.match_name()) else { continue };
+                let Some(values) = e.chunk().child_list(b"tdgp") else { continue };
+                let k = values.children();
+                for (i, c) in k.iter().enumerate() {
+                    let Some(name) =
+                        c.bytes().filter(|_| c.is(b"tdmn")).map(|b| String::from_utf8_lossy(b.split(|x| *x == 0).next().unwrap_or(b"")).to_string())
+                    else {
+                        continue;
+                    };
+                    let Some(index) = name.rsplit('-').next().and_then(|s| s.parse::<usize>().ok()) else { continue };
+                    if !spec.params.iter().any(|p| p.index == index) {
+                        continue;
+                    }
+                    if let Some(rec) = k.get(i + 1).filter(|r| r.is_list(b"tdbs") && r.child(b"cdat").is_some()) {
+                        let mut rec = rec.clone().into_owned();
+                        // A layer parameter's `tdpi` is a layer id, which differs between the
+                        // files (`layer_parameters_name_the_same_layers` checks the layers).
+                        if let effectcraft_aep::Body::List { children, .. } = &mut rec.body {
+                            for c in children.iter_mut().filter(|c| c.is(b"tdpi")) {
+                                *c = effectcraft_aep::Chunk::data(*b"tdpi", vec![0; 4]);
+                            }
+                        }
+                        out.insert((cname.clone(), li, ei, name), rec);
+                    }
+                }
+            }
+        }
+    }
+    out
+}
+
+#[test]
+fn every_static_value_record_is_rebuilt_in_its_decoded_bytes() {
+    // The records are built in code from the parameter's type and slider range (R45): every
+    // static record After Effects wrote for a mapped parameter of an effect fixture comes back
+    // with the same decoded bytes (the rest of the header is zero, the user name the placeholder).
+    let mut compared = 0;
+    for name in skip!(fixtures_with_effects()) {
+        let bytes = fixture!(&name);
+        let original = parse(&bytes).expect("parse");
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let imported = import(&mut p, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+        // An effect the importer could not take over completely (712: CC Radial Blur's Type
+        // Scratch has no EffectCraft item) is written as EffectCraft has it.
+        let lossy: Vec<String> = imported.report.losses.iter().flat_map(|l| l.details.clone()).collect();
+        let r = export_all(&p);
+        let exported = parse(&r.bytes).expect("parse export");
+        let skip = |k: &(String, usize, usize, String)| lossy.iter().any(|d| d.contains(k.3.rsplit_once('-').map_or("", |x| x.0)));
+        let (mut a, mut b) = (static_records(&original), static_records(&exported));
+        a.retain(|k, _| !skip(k));
+        b.retain(|k, _| !skip(k));
+        for (key, rec) in &a {
+            let got = b.get(key).unwrap_or_else(|| panic!("{name}: {key:?} not written"));
+            assert_eq!(decoded(got), decoded(rec), "{name}: {key:?}");
+            compared += 1;
+        }
+        for key in b.keys() {
+            assert!(a.contains_key(key), "{name}: {key:?} written but After Effects has none");
+        }
+    }
+    assert!(compared >= 60, "{compared}");
+}
+
+#[test]
+fn hue_saturation_and_levels_data_is_written_as_after_effects_wrote_it() {
+    // Master Hue / Lightness (444, 446) and Levels' RGB input black, gamma, output white (512,
+    // 514, 516) live in the effect's arbitrary data: the exported `aRbp` equals After Effects'.
+    for (name, param) in [
+        ("444-fx-huesat-hue-90.aep", "ADBE HUE SATURATION-0003"),
+        ("446-fx-huesat-light-m30.aep", "ADBE HUE SATURATION-0003"),
+        ("512-fx-levels-inblack-0.1.aep", "ADBE Easy Levels2-0002"),
+        ("514-fx-levels-gamma-2.aep", "ADBE Easy Levels2-0002"),
+        ("516-fx-levels-outwhite-0.9.aep", "ADBE Easy Levels2-0002"),
+    ] {
+        let bytes = fixture!(name);
+        let data = |b: &[u8]| -> Vec<u8> {
+            let f = parse(b).expect("parse");
+            let view = effectcraft_aep::Project::new(&f).expect("project");
+            let mut out = Vec::new();
+            for item in view.all_items() {
+                let Some(comp) = item.comp() else { continue };
+                for layer in comp.layers() {
+                    for e in layer.effects() {
+                        if let Some(d) = e.arbitrary_data(param) {
+                            out = d.to_vec();
+                        }
+                    }
+                }
+            }
+            out
+        };
+        let r = export_all(&import_bytes(&bytes));
+        assert!(!data(&bytes).is_empty(), "{name}");
+        assert_eq!(data(&r.bytes), data(&bytes), "{name}");
+    }
+}
+
+/// The layer each layer parameter names, by layer index (comp, layer, effect,
+/// parameter index, named layer or "None").
+fn layer_params(file: &AepFile<'_>) -> Vec<(String, String, String, usize, String)> {
+    let view = effectcraft_aep::Project::new(file).expect("project");
+    let mut out = Vec::new();
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        let cname = item.display_name().unwrap_or_default();
+        let names: std::collections::HashMap<u32, String> = comp.layers().enumerate().filter_map(|(i, l)| Some((l.header()?.id, format!("#{i}")))).collect();
+        for (i, layer) in comp.layers().enumerate() {
+            let lname = format!("#{i}");
+            for e in layer.effects() {
+                for p in view.effect_params(&e).into_iter().filter(|p| p.index > 0 && p.kind == effectcraft_aep::ParamKind::Layer) {
+                    let named = match p.stored_value() {
+                        Some(ParamValue::Layer(0)) => "None".to_string(),
+                        Some(ParamValue::Layer(id)) => names.get(&id).cloned().unwrap_or_else(|| format!("? {id}")),
+                        other => format!("{other:?}"),
+                    };
+                    out.push((cname.clone(), lname.clone(), e.match_name().to_string(), p.index, named));
+                }
+            }
+        }
+    }
+    out.sort();
+    out
+}
+
+#[test]
+fn layer_parameters_name_the_same_layers() {
+    // 905: Compound Blur, Displacement Map and Set Matte name the grey solid R (904 E22-E24);
+    // 220 / 320 / 321: Layer Control on another layer, on itself, None.
+    let mut checked = 0;
+    for name in
+        ["905-fx-24-effects-set-one-comp.aep", "220-fx-layercontrol-to-layer1.aep", "320-fx-layercontrol-self-explicit.aep", "321-fx-layercontrol-none.aep"]
+    {
+        let bytes = fixture!(name);
+        let original = parse(&bytes).expect("parse");
+        let p = import_bytes(&bytes);
+        let r = export_all(&p);
+        assert_eq!(r.report.count(LossCategory::Effects), 0, "{name}: {:?}", r.report.losses);
+        let exported = parse(&r.bytes).expect("parse export");
+        let (a, b) = (layer_params(&original), layer_params(&exported));
+        assert!(!a.is_empty(), "{name}");
+        assert_eq!(a, b, "{name}");
+        checked += 1;
+    }
+    assert_eq!(checked, 4);
+}
+
+/// Sets every property with this match id (in every effect of every layer) to `v`.
+fn set_all(p: &mut Project, id: &str, v: Value) -> usize {
+    fn walk(g: &mut PropGroup, id: &str, v: &Value, n: &mut usize) {
+        for c in &mut g.children {
+            match c {
+                Node::Prop(pr) if pr.match_id == id => {
+                    pr.value = v.clone();
+                    *n += 1;
+                }
+                Node::Group(sub) => walk(sub, id, v, n),
+                _ => {}
+            }
+        }
+    }
+    let mut n = 0;
+    let ids: Vec<_> = p.comps().map(|(i, _)| *i).collect();
+    for cid in ids {
+        let Some(mut c) = p.comp(cid).cloned() else { continue };
+        for l in &mut c.layers {
+            walk(&mut l.props, id, &v, &mut n);
+        }
+        if let Some(it) = p.item_mut(cid) {
+            it.kind = ItemKind::Comp(std::sync::Arc::new(c));
+        }
+    }
+    n
+}
+
+fn find_id<'a>(g: &'a PropGroup, id: &str) -> Option<&'a effectcraft_project::Property> {
+    g.children.iter().find_map(|c| match c {
+        Node::Prop(pr) if pr.match_id == id => Some(pr),
+        Node::Group(sub) => find_id(sub, id),
+        _ => None,
+    })
+}
+
+#[test]
+fn an_explicit_none_is_written_as_none() {
+    // After Effects' None on Compound Blur / Displacement Map / Set Matte (`tdpi` 0) differs from
+    // the owning layer (fx27 `layer-none`); it is EffectCraft's `NO_LAYER` both ways.
+    let mut p = import_bytes(&fixture!("905-fx-24-effects-set-one-comp.aep"));
+    let none = Value::Layer(Some(effectcraft_project::NO_LAYER));
+    let n: usize = ["blurLayer", "displacementMapLayer", "takeMatteFromLayer"].iter().map(|id| set_all(&mut p, id, none.clone())).sum();
+    assert_eq!(n, 3);
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::Effects), 0, "{:?}", r.report.losses);
+    let named: Vec<_> = layer_params(&parse(&r.bytes).expect("parse")).into_iter().filter(|x| x.2 != "ADBE Layer Control").map(|x| x.4).collect();
+    assert_eq!(named, ["None", "None", "None"]);
+    let q = import_bytes(&r.bytes);
+    let mut back = 0;
+    for (_, c) in q.comps() {
+        for l in &c.layers {
+            for id in ["blurLayer", "displacementMapLayer", "takeMatteFromLayer"] {
+                if let Some(pr) = find_id(&l.props, id) {
+                    assert_eq!(pr.value, none, "{id}");
+                    back += 1;
+                }
+            }
+        }
+    }
+    assert_eq!(back, 3);
+}
+
+#[test]
+fn layer_control_on_a_named_layer_needs_no_source_choice() {
+    // Layer Control has no source choice in After Effects: a companion other than Source (a
+    // Layer Control made here defaults to Effects & Masks) is no loss.
+    let mut p = import_bytes(&fixture!("220-fx-layercontrol-to-layer1.aep"));
+    assert_eq!(set_all(&mut p, "layerSource", Value::Enum(2)), 1);
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::Effects), 0, "{:?}", r.report.losses);
+}
+
+#[test]
+fn unmapped_layer_parameters_keep_their_default() {
+    // Timewarp's Matte Layer and Warp Layer are not in the table; their default is None (`tdpi`
+    // 0), which the export keeps: the re-import reports nothing (529-533). Written as the owning
+    // layer, the re-import reported both as "not imported".
+    for name in ["529-fx-timewarp-default.aep", "531-fx-timewarp-speed-keyed-50-200.aep"] {
+        let p = import_bytes(&fixture!(name));
+        let r = export_all(&p);
+        let mut q = Project::default();
+        let none = |_: &str| false;
+        let back = import(&mut q, &r.bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("re-import");
+        assert_eq!(back.report.count(effectcraft_aep::import::LossCategory::Effects), 0, "{name}: {:?}", back.report.losses);
+    }
+}
+
+/// The arbitrary data of the first instance of `match_name` in a file.
+fn arb(bytes: &[u8], match_name: &str, record: &str) -> Vec<u8> {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let fx = comp.layers().flat_map(|l| l.effects()).find(|e| e.match_name() == match_name).expect("effect");
+    fx.arbitrary_data(record).expect("data").to_vec()
+}
+
+#[test]
+fn curves_and_mesh_warp_are_written_as_after_effects_stores_them() {
+    // Curves: the points and the tables rebuilt from them are After Effects' bytes (963, 964).
+    for name in ["963-curves-red-mid-down-on-S.aep", "964-curves-rgb-s-curve-on-S.aep"] {
+        let bytes = fixture!(name);
+        let r = export_all(&import_bytes(&bytes));
+        assert_eq!(r.report.count(LossCategory::Effects), 0, "{name}: {:?}", r.report.losses);
+        assert_eq!(arb(&r.bytes, "ADBE CurvesCustom", "ADBE CurvesCustom-0001"), arb(&bytes, "ADBE CurvesCustom", "ADBE CurvesCustom-0001"), "{name}");
+    }
+    // Mesh Warp (985): the same grid, every coordinate within 1e-5 of the layer.
+    let bytes = fixture!("985-meshwarp-3x3-vertex-moved-on-S.aep");
+    let r = export_all(&import_bytes(&bytes));
+    assert_eq!(r.report.count(LossCategory::Effects), 0, "{:?}", r.report.losses);
+    let (a, b) = (arb(&r.bytes, "ADBE MESH WARP", "ADBE MESH WARP-0004"), arb(&bytes, "ADBE MESH WARP", "ADBE MESH WARP-0004"));
+    let (ma, mb) = (effectcraft_aep::MeshData::parse(&a).expect("written"), effectcraft_aep::MeshData::parse(&b).expect("stored"));
+    assert_eq!((ma.columns, ma.rows, ma.tail), (mb.columns, mb.rows, mb.tail));
+    for (x, y) in ma.vertices.iter().zip(&mb.vertices) {
+        for (p, q) in x.iter().zip(y) {
+            assert!((p[0] - q[0]).abs() < 1e-5 && (p[1] - q[1]).abs() < 1e-5, "{p:?} vs {q:?}");
+        }
+    }
+}
+
+#[test]
+fn mesh_handles_moved_on_their_own_survive_the_round_trip() {
+    // 985 imported, then the right handle of vertex (2, 2) moved by 30 px on its own: the importer
+    // keeps such moves as extra numbers of the vertex (EffectCraft draws a bilinear mesh).
+    let mut p = import_bytes(&fixture!("985-meshwarp-3x3-vertex-moved-on-S.aep"));
+    let id: Vec<_> = p.comps().map(|(i, _)| *i).collect();
+    let mut tokens = Vec::new();
+    for cid in id {
+        let Some(mut c) = p.comp(cid).cloned() else { continue };
+        for l in &mut c.layers {
+            fn walk(g: &mut PropGroup, tokens: &mut Vec<String>) {
+                for n in &mut g.children {
+                    match n {
+                        Node::Prop(pr) if pr.match_id == "mesh" => {
+                            if let Value::Str(s) = &pr.value {
+                                let mut t: Vec<String> = s.split(' ').map(str::to_string).collect();
+                                t[10] = format!("{},0,0,30,0,0,0,0,0", t[10]);
+                                *tokens = t.clone();
+                                pr.value = Value::Str(t.join(" "));
+                            }
+                        }
+                        Node::Group(sub) => walk(sub, tokens),
+                        _ => {}
+                    }
+                }
+            }
+            walk(&mut l.props, &mut tokens);
+        }
+        if let Some(it) = p.item_mut(cid) {
+            it.kind = ItemKind::Comp(std::sync::Arc::new(c));
+        }
+    }
+    assert_eq!(tokens.len(), 16);
+    let r = export_all(&p);
+    let data = arb(&r.bytes, "ADBE MESH WARP", "ADBE MESH WARP-0004");
+    let m = effectcraft_aep::MeshData::parse(&data).expect("mesh");
+    let d = effectcraft_aep::MeshData::default_vertex(3, 3, 2, 2);
+    let v = m.vertices[10];
+    // The right handle: default + the vertex's move + 30 px.
+    assert!((v[2][0] - (d[2][0] + (132.0 + 30.0) / 1920.0)).abs() < 1e-5, "{:?}", v[2]);
+    assert!((v[1][0] - (d[1][0] + 132.0 / 1920.0)).abs() < 1e-5, "{:?}", v[1]);
+    // Re-imported, the vertex keeps the handle move.
+    let q = import_bytes(&r.bytes);
+    let mut found = false;
+    for (_, c) in q.comps() {
+        for l in &c.layers {
+            if let Some(Value::Str(s)) = find_id(&l.props, "mesh").map(|p| p.value.clone()) {
+                let t: Vec<&str> = s.split(' ').collect();
+                let n: Vec<f64> = t[10].split(',').map(|x| x.parse().expect("number")).collect();
+                assert_eq!(n.len(), 10, "{}", t[10]);
+                assert!((n[4] - 30.0).abs() < 0.01 && (n[0] - 132.0).abs() < 0.01, "{n:?}");
+                found = true;
+            }
+        }
+    }
+    assert!(found);
+}
diff --git a/crates/aep/tests/it/export/footage.rs b/crates/aep/tests/it/export/footage.rs
new file mode 100644
index 000000000..fe4581e6a
--- /dev/null
+++ b/crates/aep/tests/it/export/footage.rs
@@ -0,0 +1,338 @@
+//! Footage items and layers: projects with every footage kind the exporter writes are exported
+//! and parsed back with `effectcraft-aep` (type tag, size, duration, rate, numbering, alias path,
+//! the name), the footage fixtures go through import, export and import, and what cannot be
+//! written is reported.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{PropNode, parse};
+use effectcraft_color::Label;
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, LayerSource, Project};
+use effectcraft_time::FrameRate;
+
+fn still(path: &str, w: u32, h: u32) -> Footage {
+    Footage { path: path.to_string(), kind: FootageKind::Still, width: w, height: h, has_video: true, ..Footage::default() }
+}
+
+fn seq(dir: &str, prefix: &str, start: u32, n: u32, digits: usize, suffix: &str, rate: FrameRate) -> Footage {
+    let files: Vec<String> = (start..start + n).map(|k| format!("{dir}\\{prefix}{k:0digits$}{suffix}")).collect();
+    let mut f = Footage { kind: FootageKind::Sequence, frame_rate: rate, sequence: files.clone(), ..still(&files[0], 64, 48) };
+    f.sync_sequence_duration();
+    f
+}
+
+/// Adds the footage and a layer showing it, as long as the footage (stills: the composition).
+fn add_footage(p: &mut Project, comp: ItemId, name: &str, f: Footage) -> ItemId {
+    let size = (f.width.max(1), f.height.max(1));
+    let timed = f.kind != FootageKind::Still && f.duration > effectcraft_time::Tick::ZERO;
+    let duration = f.duration;
+    let id = p.add_item(name, Label::Lavender, None, ItemKind::Footage(f));
+    add_layer(p, comp, name, LayerSource::Footage { item: id }, size);
+    if timed {
+        with_layer(p, comp, 0, |l| l.out_point = l.start_time + duration);
+    }
+    id
+}
+
+fn reimport(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    import(&mut p, bytes, &opts).expect("import");
+    p
+}
+
+/// One of every kind in a composition.
+fn all_kinds() -> Project {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_footage(&mut p, c, "still.png", still(r"C:\media\still.png", 64, 48));
+    add_footage(&mut p, c, "still.jpg", still(r"C:\media\still.jpg", 64, 48));
+    add_footage(&mut p, c, "Renamed EXR", still(r"C:\media\still.exr", 64, 48));
+    add_footage(&mut p, c, "shot_[0101-0103].exr", seq(r"C:\media\exrseq", "shot_", 101, 3, 4, ".exr", FrameRate::new(30, 1)));
+    add_footage(&mut p, c, "seq_[001-003].png", seq(r"C:\media\test-seq", "seq_", 1, 3, 3, ".png", FrameRate::new(24, 1)));
+    let clip = Footage { kind: FootageKind::Video, frame_rate: FrameRate::new(25, 1), duration: secs(2.0), ..still(r"C:\media\clip.mp4", 64, 48) };
+    add_footage(&mut p, c, "clip.mp4", clip);
+    let wav = Footage { kind: FootageKind::Audio, duration: secs(1.5), has_video: false, has_audio: true, ..still(r"C:\media\tone.wav", 0, 0) };
+    add_footage(&mut p, c, "tone.wav", wav);
+    add_footage(&mut p, c, "still.tif", still(r"C:\media\still.tif", 64, 48));
+    add_footage(&mut p, c, "j_[000-002].jpg", seq(r"C:\media\jpgseq", "j_", 0, 3, 3, ".jpg", FrameRate::new(25, 1)));
+    let mov = Footage { kind: FootageKind::Video, frame_rate: FrameRate::new(25, 1), duration: secs(1.0), ..still(r"C:\media\clip.mov", 64, 48) };
+    add_footage(&mut p, c, "clip.mov", mov);
+    for e in ["tga", "psd", "ai", "eps"] {
+        add_footage(&mut p, c, &format!("still.{e}"), still(&format!(r"C:\media\still.{e}"), 64, 48));
+    }
+    // 645: 25 native frames conformed to 30 fps.
+    let conformed = Footage {
+        kind: FootageKind::Video,
+        frame_rate: FrameRate::new(30, 1),
+        native_rate: Some(FrameRate::new(25, 1)),
+        duration: FrameRate::new(30, 1).tick_of(25),
+        ..still(r"C:\media\conformed.mp4", 64, 48)
+    };
+    add_footage(&mut p, c, "conformed.mp4", conformed);
+    // Its 25/30 s does not fall on the composition's 25 fps frames: the layer ends on a frame, as
+    // in After Effects (an off-frame out point is a rounded-time loss).
+    with_layer(&mut p, c, 0, |l| l.out_point = l.start_time + secs(0.8));
+    p
+}
+
+#[test]
+fn every_kind_is_written_with_its_fields() {
+    let p = all_kinds();
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!((r.report.exported.footage, r.report.exported.footage_layers), (15, 15));
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let items = view.all_items();
+    let by_path = |end: &str| items.iter().find(|i| i.footage().and_then(|f| f.path).is_some_and(|p| p.ends_with(end))).copied().expect(end);
+    // (path end, tag, w, h, duration num / den, fps, sequence)
+    let want: [(&str, &str, u32, u32, i64, i64, u32, bool); 15] = [
+        (r"\still.png", "png!", 64, 48, 0, 1, 0, false),
+        (r"\still.jpg", "ZPEG", 64, 48, 0, 600, 0, false),
+        (r"\still.exr", "oEXR", 64, 48, 0, 100, 0, false),
+        (r"\exrseq", "oEXR", 64, 48, 3, 30, 30, true),
+        (r"\test-seq", "png!", 64, 48, 3, 24, 24, true),
+        (r"\clip.mp4", "XCEX", 64, 48, 50, 25, 25, false),
+        (r"\tone.wav", "WAVE", 0, 0, 72_000, 48_000, 0, false),
+        (r"\still.tif", "TIF ", 64, 48, 0, 600, 0, false),
+        (r"\jpgseq", "ZPEG", 64, 48, 3, 25, 25, true),
+        (r"\clip.mov", "MOoV", 64, 48, 25, 25, 25, false),
+        (r"\still.tga", "TPIC", 64, 48, 0, 600, 0, false),
+        (r"\still.psd", "8BPS", 64, 48, 0, 600, 0, false),
+        (r"\still.ai", "TEXT", 64, 48, 0, 600, 0, false),
+        (r"\still.eps", "TEXT", 64, 48, 0, 600, 0, false),
+        (r"\conformed.mp4", "XCEX", 64, 48, 25, 25, 25, false),
+    ];
+    for (end, tag, w, h, num, den, fps, is_seq) in want {
+        let item = by_path(end);
+        let f = item.footage().expect("footage");
+        assert_eq!((f.file_type.as_str(), f.width, f.height, f.native_frame_rate, f.is_sequence), (tag, w, h, fps, is_seq), "{end}");
+        let d = f.duration.expect("duration");
+        assert_eq!((d.num, d.den), (num, den), "{end}");
+    }
+    // The conformed clip keeps its native rate and frames and stores the conformed rate (645).
+    assert_eq!(by_path(r"\conformed.mp4").conform_frame_rate(), Some(30));
+    assert_eq!(by_path(r"\clip.mp4").conform_frame_rate(), None);
+    let s = by_path(r"\exrseq").sequence_info().expect("numbering");
+    assert_eq!((s.prefix.as_str(), s.suffix.as_str(), s.start, s.end, s.digits), ("shot_", ".exr", 101, 103, 4));
+    let s = by_path(r"\test-seq").sequence_info().expect("numbering");
+    assert_eq!((s.prefix.as_str(), s.suffix.as_str(), s.start, s.end, s.digits), ("seq_", ".png", 1, 3, 3));
+    // A default name is not stored (After Effects names the item after its file), another one is.
+    assert_eq!(by_path(r"\still.png").name(), None);
+    assert_eq!(by_path(r"\still.png").display_name().as_deref(), Some("still.png"));
+    assert_eq!(by_path(r"\exrseq").name(), None);
+    assert_eq!(by_path(r"\still.exr").name().as_deref(), Some("Renamed EXR"));
+    // png options: size and the first file's name.
+    assert_eq!(by_path(r"\test-seq").footage().and_then(|f| f.name).as_deref(), Some("seq_001.png"));
+    // Layers: the source, its size, the Time Remapping maximum (the source's duration).
+    let comp = items.iter().find_map(|i| i.comp()).expect("comp");
+    for layer in comp.layers() {
+        let src = view.layer_source(&layer).expect("source");
+        let f = src.footage().expect("footage source");
+        let Some(PropNode::Property(tr)) = layer.properties().and_then(|g| g.get("ADBE Time Remapping")) else { panic!("time remap") };
+        let max = tr.chunk().child(b"tduM").and_then(|c| c.bytes()).map(|b| f64::from_be_bytes(b[..8].try_into().expect("8"))).expect("tduM");
+        let d = f.duration.expect("duration");
+        // A conformed clip lasts its native frames at the conformed rate (645: 25 / 30 s).
+        let den = src.conform_frame_rate().map_or(d.den, i64::from);
+        assert!((max - d.num as f64 / den as f64).abs() < 1e-9, "{:?}: {max}", f.path);
+    }
+}
+
+#[test]
+fn the_alias_holds_the_path_escaped() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 1.0, None);
+    add_footage(&mut p, c, "odd", still("C:\\a \"quoted\" dir\\Ünïcödé\\x.png", 8, 8));
+    add_footage(&mut p, c, "mac", still("/Volumes/Media/a.jpg", 8, 8));
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let paths: Vec<String> = view.all_items().iter().filter_map(|i| i.footage()).filter_map(|f| f.path).collect();
+    assert!(paths.contains(&"C:\\a \"quoted\" dir\\Ünïcödé\\x.png".to_string()), "{paths:?}");
+    assert!(paths.contains(&"/Volumes/Media/a.jpg".to_string()), "{paths:?}");
+}
+
+#[test]
+fn footage_survives_import_export_import() {
+    for name in [
+        "126-footage-png-layer.aep",
+        "603-footage-exrseq-0101-as-layer.aep",
+        "645-footage-mp4-conform-30.aep",
+        "650-footage-tga-still-as-layer.aep",
+        "651-footage-psd-flat-as-layer.aep",
+        "652-footage-ai-as-layer.aep",
+        "653-footage-eps-as-layer.aep",
+    ] {
+        let p1 = reimport(&fixture!(name));
+        let r = export_all(&p1);
+        assert_eq!(r.report.count(LossCategory::FootageItems) + r.report.count(LossCategory::UnsupportedLayers), 0, "{name}: {:?}", r.report.losses);
+        let p2 = reimport(&r.bytes);
+        let footage = |p: &Project| -> Vec<(String, Footage)> {
+            let mut v: Vec<(String, Footage)> =
+                p.items.values().filter_map(|i| if let ItemKind::Footage(f) = &i.kind { Some((i.name.clone(), f.clone())) } else { None }).collect();
+            v.sort_by(|a, b| a.0.cmp(&b.0));
+            v
+        };
+        let (a, b) = (footage(&p1), footage(&p2));
+        assert_eq!(a.len(), 1, "{name}");
+        assert_eq!(a.len(), b.len(), "{name}");
+        for ((na, fa), (nb, fb)) in a.iter().zip(&b) {
+            assert_eq!(na, nb, "{name}");
+            assert_eq!((&fa.path, fa.kind, fa.width, fa.height, &fa.sequence), (&fb.path, fb.kind, fb.width, fb.height, &fb.sequence), "{name}");
+            assert_eq!((fa.frame_rate, fa.native_rate, fa.duration), (fb.frame_rate, fb.native_rate, fb.duration), "{name}");
+        }
+        let layers = |p: &Project| -> usize {
+            p.items
+                .values()
+                .filter_map(|i| {
+                    if let ItemKind::Comp(c) = &i.kind {
+                        Some(c.layers.iter().filter(|l| matches!(l.source, LayerSource::Footage { .. })).count())
+                    } else {
+                        None
+                    }
+                })
+                .sum()
+        };
+        assert_eq!(layers(&p1), 1, "{name}");
+        assert_eq!(layers(&p2), 1, "{name}");
+    }
+}
+
+/// The stored folder time (`sspc@118`) of the sequence item, big-endian.
+fn sequence_folder_time(bytes: &[u8]) -> u32 {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let item = view.all_items().into_iter().find(|i| i.footage().is_some_and(|f| f.is_sequence)).expect("sequence");
+    let sspc = item.chunk().child_list(b"Pin ").and_then(|pin| pin.child(b"sspc")).and_then(|c| c.bytes()).expect("sspc");
+    u32::from_be_bytes(sspc[118..122].try_into().expect("4 bytes"))
+}
+
+/// 860: After Effects stores the sequence folder's modification time (seconds since 1904, UTC) at
+/// `sspc@118` and rescans the folder on open when it differs from the folder's, warning about the
+/// missing number of a sparse sequence in a modal dialog (export-tests x1-x3: the folder's time
+/// opens without the dialog, the first or the last file's time does not). The export writes the
+/// time the caller gives (the folder of 860 at 2026-10-19 03:51:22 UTC is stored as 0xe6fb443a),
+/// only for sequences, and keeps the template's without one.
+#[test]
+fn a_sequence_stores_its_folder_time() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 64, 48, FrameRate::new(30, 1), 1.0, None);
+    add_footage(&mut p, c, "sp_[0001-0005].png", seq(r"C:\media\sparse", "sp_", 1, 5, 4, ".png", FrameRate::new(30, 1)));
+    add_footage(&mut p, c, "still.png", still(r"C:\media\still.png", 64, 48));
+    let asked = std::cell::RefCell::new(Vec::<String>::new());
+    let time = |dir: &str| {
+        asked.borrow_mut().push(dir.to_string());
+        Some(1_792_381_882)
+    };
+    let opts = effectcraft_aep::export::ExportOptions { allow_losses: true };
+    let r = effectcraft_aep::export::export_with(&p, &opts, &time).expect("export");
+    assert_eq!(sequence_folder_time(&r.bytes), 0xe6fb_443a);
+    // The caller is asked with the sequence's first file as stored (it checks that path before it
+    // looks at the folder), and only for the sequence.
+    assert_eq!(*asked.borrow(), [r"C:\media\sparse\sp_0001.png"], "only the sequence is asked for");
+    // Without a time (plain `export`, or an unknown folder) the template's value stays.
+    let plain = export_all(&p);
+    let unknown = effectcraft_aep::export::export_with(&p, &opts, &|_| None).expect("export");
+    assert_eq!(sequence_folder_time(&unknown.bytes), sequence_folder_time(&plain.bytes));
+    assert_ne!(sequence_folder_time(&plain.bytes), 0xe6fb_443a);
+    // A time beyond the field (after 2040) is not written either.
+    let late = effectcraft_aep::export::export_with(&p, &opts, &|_| Some(u64::MAX)).expect("export");
+    assert_eq!(sequence_folder_time(&late.bytes), sequence_folder_time(&plain.bytes));
+    // The stills stay byte for byte as without times.
+    let still_bytes = |bytes: &[u8]| {
+        let file = parse(bytes).expect("parse");
+        let view = effectcraft_aep::Project::new(&file).expect("project");
+        let item = view.all_items().into_iter().find(|i| i.footage().is_some_and(|f| !f.is_sequence)).expect("still");
+        item.chunk().child_list(b"Pin ").and_then(|pin| pin.child(b"sspc")).and_then(|c| c.bytes()).expect("sspc").to_vec()
+    };
+    assert_eq!(still_bytes(&r.bytes), still_bytes(&plain.bytes));
+}
+
+/// A sparse sequence (860: After Effects imports sp_0001, 0002, 0004, 0005 as `sp_[0001-0005].png`
+/// and stores only the folder and the numbering 1-5): the import lists every number in the range,
+/// files on disk or not, and the export writes the same range, so After Effects finds the folder
+/// and treats the missing number as it does in the original (it holds the frame before). Opened
+/// without a dialog only with the folder's time (`a_sequence_stores_its_folder_time`).
+#[test]
+fn a_sparse_sequence_keeps_its_range() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 64, 48, FrameRate::new(30, 1), 1.0, None);
+    add_footage(&mut p, c, "sp_[0001-0005].png", seq(r"C:\media\sparse", "sp_", 1, 5, 4, ".png", FrameRate::new(30, 1)));
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let item = view.all_items().into_iter().find(|i| i.footage().is_some()).expect("footage");
+    assert_eq!(item.footage().and_then(|f| f.path).as_deref(), Some(r"C:\media\sparse"), "the alias is the folder");
+    let s = item.sequence_info().expect("numbering");
+    assert_eq!((s.start, s.end, s.digits), (1, 5, 4));
+    // Re-import with number 3 absent on disk: still five frames, 1 to 5.
+    let mut q = Project::default();
+    let exists = |path: &str| !path.ends_with("sp_0003.png");
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&exists) };
+    import(&mut q, &r.bytes, &opts).expect("import");
+    let f = q.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).expect("footage");
+    let names: Vec<&str> = f.sequence.iter().map(|s| s.rsplit('\\').next().unwrap_or(s)).collect();
+    assert_eq!(names, ["sp_0001.png", "sp_0002.png", "sp_0003.png", "sp_0004.png", "sp_0005.png"]);
+}
+
+#[test]
+fn what_cannot_be_written_is_reported() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 1.0, None);
+    add_footage(&mut p, c, "avi", Footage { kind: FootageKind::Video, frame_rate: FrameRate::new(25, 1), ..still(r"C:\m\a.avi", 8, 8) });
+    add_footage(&mut p, c, "bmp", still(r"C:\m\a.bmp", 8, 8));
+    add_footage(&mut p, c, "ntsc", Footage { kind: FootageKind::Video, frame_rate: FrameRate::FPS_29_97, ..still(r"C:\m\a.mp4", 8, 8) });
+    let mut gaps = seq(r"C:\m", "g_", 1, 3, 2, ".png", FrameRate::new(25, 1));
+    gaps.sequence.remove(1);
+    add_footage(&mut p, c, "gaps", gaps);
+    add_footage(&mut p, c, "nopath", still("", 8, 8));
+    add_footage(&mut p, c, "mp3", Footage { kind: FootageKind::Audio, ..still(r"C:\m\a.mp3", 0, 0) });
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::FootageItems), 6, "{:?}", r.report.losses);
+    assert_eq!(r.report.count(LossCategory::UnsupportedLayers), 6, "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.footage, 0);
+    parse(&r.bytes).expect("still a valid file");
+}
+
+#[test]
+fn a_layer_past_its_source_s_end_is_reported() {
+    // After Effects ends such a layer at the source's end (f1 read-back).
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 5.0, None);
+    add_footage(
+        &mut p,
+        c,
+        "clip.mp4",
+        Footage { kind: FootageKind::Video, frame_rate: FrameRate::new(25, 1), duration: secs(2.0), ..still(r"C:\m\clip.mp4", 8, 8) },
+    );
+    with_layer(&mut p, c, 0, |l| l.out_point = secs(4.0));
+    add_footage(&mut p, c, "still.png", still(r"C:\m\still.png", 8, 8));
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::LayerTiming), 1, "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.footage_layers, 2);
+}
+
+#[test]
+fn hostile_footage_never_panics() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 1.0, None);
+    let big = seq(r"C:\m", "f", 1, 100_000, 6, ".exr", FrameRate::new(25, 1));
+    add_footage(&mut p, c, "big", big);
+    add_footage(&mut p, c, "huge", still(r"C:\m\h.png", u32::MAX, u32::MAX));
+    add_footage(&mut p, c, "ctl", still("C:\\m\\a\u{1}b.png", 8, 8));
+    add_footage(&mut p, c, "nodigits", seq(r"C:\m", "x", 1, 1, 1, ".png", FrameRate::new(25, 1)));
+    let mut nod = still(r"C:\m\plain.png", 8, 8);
+    nod.kind = FootageKind::Sequence;
+    add_footage(&mut p, c, "plain-seq", nod);
+    add_footage(&mut p, c, "zero-rate", Footage { kind: FootageKind::Video, frame_rate: FrameRate::new(0, 1), ..still(r"C:\m\z.mp4", 8, 8) });
+    add_footage(&mut p, c, "long", Footage { kind: FootageKind::Audio, duration: effectcraft_time::Tick(i64::MAX), ..still(r"C:\m\l.wav", 0, 0) });
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    let _ = reimport(&r.bytes);
+}
diff --git a/crates/aep/tests/it/export/helpers.rs b/crates/aep/tests/it/export/helpers.rs
new file mode 100644
index 000000000..a9026b0b9
--- /dev/null
+++ b/crates/aep/tests/it/export/helpers.rs
@@ -0,0 +1,100 @@
+#![allow(dead_code)]
+//! Builders shared by the exporter tests.
+
+use std::sync::Arc;
+
+use effectcraft_aep::export::{ExportOptions, ExportResult, export};
+use effectcraft_color::Label;
+use effectcraft_keyframe::{Keyframe, Value};
+use effectcraft_project::{Comp, ItemId, ItemKind, Layer, LayerSource, Project, Solid, build};
+use effectcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
+
+pub fn secs(s: f64) -> Tick {
+    Tick((s * TICKS_PER_SECOND as f64).round() as i64)
+}
+
+pub fn add_comp(p: &mut Project, name: &str, w: u32, h: u32, fps: FrameRate, dur: f64, parent: Option<ItemId>) -> ItemId {
+    let comp = Comp::new(w, h, fps, secs(dur));
+    p.add_item(name, Label::None, parent, ItemKind::Comp(Arc::new(comp)))
+}
+
+pub fn add_solid(p: &mut Project, name: &str, w: u32, h: u32, color: [f32; 3], parent: Option<ItemId>) -> ItemId {
+    p.add_item(name, Label::Red, parent, ItemKind::Solid(Solid { color, width: w, height: h, pixel_aspect: 1.0 }))
+}
+
+/// Adds a layer on top of the composition.
+pub fn add_layer(p: &mut Project, comp: ItemId, name: &str, source: LayerSource, size: (u32, u32)) {
+    let mut c = p.comp(comp).cloned().expect("comp");
+    let mut l = build::layer(p, &c, name, source, size, None);
+    l.name = name.to_string();
+    c.layers.insert(0, l);
+    if let Some(i) = p.item_mut(comp) {
+        i.kind = ItemKind::Comp(Arc::new(c));
+    }
+}
+
+pub fn with_layer(p: &mut Project, comp: ItemId, idx: usize, f: impl FnOnce(&mut Layer)) {
+    let mut c = p.comp(comp).cloned().expect("comp");
+    if let Some(l) = c.layers.get_mut(idx) {
+        f(l);
+    }
+    if let Some(i) = p.item_mut(comp) {
+        i.kind = ItemKind::Comp(Arc::new(c));
+    }
+}
+
+pub fn with_comp(p: &mut Project, comp: ItemId, f: impl FnOnce(&mut Comp)) {
+    let mut c = p.comp(comp).cloned().expect("comp");
+    f(&mut c);
+    if let Some(i) = p.item_mut(comp) {
+        i.kind = ItemKind::Comp(Arc::new(c));
+    }
+}
+
+pub fn key(t: f64, v: Value) -> Keyframe {
+    Keyframe::new(secs(t), v)
+}
+
+pub fn export_all(p: &Project) -> ExportResult {
+    export(p, &ExportOptions { allow_losses: true }).expect("export")
+}
+
+/// One comp `C` (1920x1080, 25 fps, 5 s) with one solid layer `L`.
+pub fn simple() -> (Project, ItemId, ItemId) {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    let s = add_solid(&mut p, "L", 1920, 1080, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, c, "L", LayerSource::Solid { item: s }, (1920, 1080));
+    (p, c, s)
+}
+
+/// `c` as far as the exporter writes property records: in every `tdbs` the user name is left out
+/// and the header bytes that are not decoded are zero (aep-format.md 3.4; After Effects reads
+/// them as zero, read-back e1-ztdb4d).
+pub fn decoded(c: &effectcraft_aep::Chunk<'static>) -> effectcraft_aep::Chunk<'static> {
+    use effectcraft_aep::{Body, Chunk};
+    const KEEP: &[(usize, usize)] = &[(0, 4), (5, 6), (7, 16), (68, 69), (76, 78), (79, 80), (119, 121)];
+    let record = c.is_list(b"tdbs");
+    let kids = |children: &[Chunk<'static>]| -> Vec<Chunk<'static>> {
+        children
+            .iter()
+            .filter(|k| !(record && k.is(b"tdsn")))
+            .map(|k| {
+                if record && k.is(b"tdb4") {
+                    let d = k.bytes().unwrap_or_default();
+                    Chunk::data(
+                        *b"tdb4",
+                        d.iter().enumerate().map(|(i, b)| if KEEP.iter().any(|(f, e)| (*f..*e).contains(&i)) { *b } else { 0 }).collect::<Vec<u8>>(),
+                    )
+                } else {
+                    decoded(k)
+                }
+            })
+            .collect()
+    };
+    match &c.body {
+        Body::List { list_type, children } => Chunk { id: c.id, body: Body::List { list_type: *list_type, children: kids(children) }, pad: c.pad },
+        Body::Chunks(children) => Chunk { id: c.id, body: Body::Chunks(kids(children)), pad: c.pad },
+        _ => c.clone(),
+    }
+}
diff --git a/crates/aep/tests/it/export/masks.rs b/crates/aep/tests/it/export/masks.rs
new file mode 100644
index 000000000..544797802
--- /dev/null
+++ b/crates/aep/tests/it/export/masks.rs
@@ -0,0 +1,381 @@
+//! Masks: projects built in code are exported, parsed back with `effectcraft-aep` (every written
+//! field compared) and imported again; the mask fixtures go through import -> export -> import.
+
+use crate::export::helpers::{add_comp, add_layer, add_solid, export_all, key, with_layer};
+use effectcraft_aep::export::{ExportOptions, LossCategory, export};
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{Interpolation, KeyframeKind, MaskMode as AepMode, PropNode, ValueSource, parse, write};
+use effectcraft_keyframe::{Ease, Interp, ShapePath, Value};
+use effectcraft_project::{Expression, FeatherFalloff, GroupKind, Layer, LayerSource, MaskMode, Project, PropGroup, build};
+use effectcraft_time::FrameRate;
+
+fn add_mask(l: &mut Layer, next: &mut u64, name: &str, path: ShapePath, mode: MaskMode, f: impl FnOnce(&mut PropGroup)) {
+    let i = l.masks().map_or(0, |m| m.children.len());
+    let mut g = build::mask(&mut build::Ids(next), name, path, mode, build::MASK_COLORS[i % 8]);
+    f(&mut g);
+    l.props.sub_mut("masks").expect("masks group").children.push(g.into());
+}
+
+fn set(g: &mut PropGroup, id: &str, v: Value) {
+    g.get_mut(id).expect(id).value = v;
+}
+
+fn invert(g: &mut PropGroup) {
+    if let GroupKind::Mask { inverted, .. } = &mut g.kind {
+        *inverted = true;
+    }
+}
+
+/// A five-vertex open path with tangents.
+fn open_path() -> ShapePath {
+    ShapePath {
+        vertices: vec![[200.0, 200.0], [600.0, 150.0], [900.0, 500.0], [700.0, 900.0], [300.0, 800.0]],
+        in_tangents: vec![[0.0, 0.0], [-100.0, -20.0], [0.0, -150.0], [120.0, 0.0], [40.0, 60.0]],
+        out_tangents: vec![[50.0, -30.0], [100.0, 20.0], [0.0, 150.0], [-120.0, 0.0], [0.0, 0.0]],
+        closed: false,
+        feather: Vec::new(),
+    }
+}
+
+/// A six-vertex closed polygon with tangents.
+fn hexagon() -> ShapePath {
+    let mut p = ShapePath::polygon(&[[960.0, 200.0], [1260.0, 370.0], [1260.0, 710.0], [960.0, 880.0], [660.0, 710.0], [660.0, 370.0]], true);
+    p.in_tangents[1] = [-40.0, -40.0];
+    p.out_tangents[1] = [40.0, 40.0];
+    p
+}
+
+/// Composition C (1920x1080, 25 fps, 5 s) with solid layer L and the masks `f` adds.
+fn project(f: impl FnOnce(&mut Layer, &mut u64)) -> Project {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    let s = add_solid(&mut p, "L", 1920, 1080, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, c, "L", LayerSource::Solid { item: s }, (1920, 1080));
+    let mut next = p.next_id;
+    with_layer(&mut p, c, 0, |l| f(l, &mut next));
+    p.next_id = next;
+    p
+}
+
+fn all_modes() -> Project {
+    project(|l, n| {
+        add_mask(l, n, "Rect", ShapePath::rect([960.0, 540.0], 800.0, 400.0), MaskMode::Add, |_| {});
+        add_mask(l, n, "Ellipse", ShapePath::ellipse([960.0, 540.0], 600.0, 300.0), MaskMode::Subtract, |g| {
+            invert(g);
+            set(g, "feather", Value::Vec2([20.0, 10.0]));
+            set(g, "opacity", Value::Scalar(50.0));
+            set(g, "expansion", Value::Scalar(5.0));
+        });
+        add_mask(l, n, "Open", open_path(), MaskMode::Intersect, |_| {});
+        add_mask(l, n, "Hex", hexagon(), MaskMode::Difference, |g| set(g, "expansion", Value::Scalar(-12.5)));
+        add_mask(l, n, "Lighten", ShapePath::rect([300.0, 300.0], 200.0, 100.0), MaskMode::Lighten, |_| {});
+        add_mask(l, n, "Darken", ShapePath::rect([1600.0, 300.0], 200.0, 100.0), MaskMode::Darken, |_| {});
+        add_mask(l, n, "None", ShapePath::ellipse([300.0, 900.0], 100.0, 100.0), MaskMode::None, |_| {});
+    })
+}
+
+fn animated() -> Project {
+    project(|l, n| {
+        add_mask(l, n, "Keyed", ShapePath::rect([960.0, 540.0], 400.0, 200.0), MaskMode::Add, |g| {
+            let path = g.get_mut("path").expect("path");
+            let mut k1 = key(1.0, Value::Path(ShapePath::rect([960.0, 540.0], 800.0, 400.0)));
+            k1.out_interp = Interp::Hold;
+            k1.label = 3;
+            path.keys = vec![
+                key(0.0, Value::Path(ShapePath::rect([960.0, 540.0], 400.0, 200.0))),
+                k1,
+                key(2.0, Value::Path(ShapePath::rect([900.0, 500.0], 600.0, 300.0))),
+            ];
+            let feather = g.get_mut("feather").expect("feather");
+            let mut a = key(0.0, Value::Vec2([0.0, 0.0]));
+            a.out_interp = Interp::Bezier;
+            a.out_ease = vec![Ease { speed: 15.0, influence: 0.66 }, Ease { speed: 5.0, influence: 0.5 }];
+            let mut b = key(2.0, Value::Vec2([50.0, 30.0]));
+            b.in_interp = Interp::Bezier;
+            b.in_ease = vec![Ease { speed: 8.0, influence: 0.66 }, Ease { speed: 8.0, influence: 0.66 }];
+            feather.keys = vec![a, b];
+        });
+    })
+}
+
+fn masks_of(p: &Project) -> Vec<PropGroup> {
+    let c = p.items.values().find_map(|i| match &i.kind {
+        effectcraft_project::ItemKind::Comp(c) if i.name == "C" => Some(c.clone()),
+        _ => None,
+    });
+    let c = c.expect("comp C");
+    c.layers.iter().find(|l| l.name == "L").and_then(|l| l.masks()).map(|m| m.groups().cloned().collect()).unwrap_or_default()
+}
+
+fn reimport(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    import(&mut p, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+    p
+}
+
+fn path_of(v: &Value) -> &ShapePath {
+    match v {
+        Value::Path(p) => p,
+        other => panic!("{other:?}"),
+    }
+}
+
+fn same_path(a: &ShapePath, b: &ShapePath, what: &str) {
+    assert_eq!((a.len(), a.closed), (b.len(), b.closed), "{what}");
+    let near = |x: [f64; 2], y: [f64; 2]| (x[0] - y[0]).abs() < 0.01 && (x[1] - y[1]).abs() < 0.01;
+    for i in 0..a.len() {
+        assert!(near(a.vertices[i], b.vertices[i]), "{what} vertex {i}: {:?} {:?}", a.vertices[i], b.vertices[i]);
+        assert!(near(a.in_tangents[i], b.in_tangents[i]), "{what} in {i}: {:?} {:?}", a.in_tangents[i], b.in_tangents[i]);
+        assert!(near(a.out_tangents[i], b.out_tangents[i]), "{what} out {i}: {:?} {:?}", a.out_tangents[i], b.out_tangents[i]);
+    }
+}
+
+/// Two projects' masks are equal for every written field.
+fn same_masks(a: &[PropGroup], b: &[PropGroup]) {
+    assert_eq!(a.len(), b.len());
+    for (x, y) in a.iter().zip(b) {
+        let w = x.name.as_str();
+        assert_eq!(x.name, y.name);
+        let k = |g: &PropGroup| match g.kind {
+            GroupKind::Mask { mode, inverted, .. } => (mode, inverted),
+            _ => panic!("not a mask"),
+        };
+        assert_eq!(k(x), k(y), "{w}");
+        for id in ["path", "feather", "opacity", "expansion"] {
+            let (px, py) = (x.get(id).unwrap(), y.get(id).unwrap());
+            assert_eq!(px.keys.len(), py.keys.len(), "{w} {id} keys");
+            let pairs = std::iter::once((&px.value, &py.value)).chain(px.keys.iter().map(|k| &k.value).zip(py.keys.iter().map(|k| &k.value)));
+            for (vx, vy) in pairs {
+                if id == "path" {
+                    same_path(path_of(vx), path_of(vy), w);
+                } else {
+                    assert!(vx.components().iter().zip(vy.components()).all(|(p, q)| (p - q).abs() < 1e-9), "{w} {id} {vx:?} {vy:?}");
+                }
+            }
+            for (kx, ky) in px.keys.iter().zip(&py.keys) {
+                assert_eq!((kx.time, kx.in_interp, kx.out_interp, kx.label), (ky.time, ky.in_interp, ky.out_interp, ky.label), "{w} {id}");
+                if id == "feather" {
+                    let near = |e: &[Ease], f: &[Ease]| {
+                        e.len() == f.len() && e.iter().zip(f).all(|(a, b)| (a.speed - b.speed).abs() < 1e-9 && (a.influence - b.influence).abs() < 1e-9)
+                    };
+                    // The first key's in ease and the last key's out ease are not carried.
+                    if kx.in_interp == Interp::Bezier && !kx.in_ease.is_empty() && !ky.in_ease.is_empty() {
+                        assert!(near(&kx.in_ease, &ky.in_ease), "{w} in ease {:?} {:?}", kx.in_ease, ky.in_ease);
+                    }
+                    if kx.out_interp == Interp::Bezier && !kx.out_ease.is_empty() && !ky.out_ease.is_empty() {
+                        assert!(near(&kx.out_ease, &ky.out_ease), "{w} out ease {:?} {:?}", kx.out_ease, ky.out_ease);
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn every_written_field_parses_back() {
+    let p = all_modes();
+    let res = export_all(&p);
+    assert!(res.report.is_lossless(), "{:?}", res.report.losses);
+    assert_eq!(res.report.exported.masks, 7);
+    // The container is consistent: it writes back byte for byte.
+    let file = parse(&res.bytes).expect("parse");
+    assert_eq!(write(&file).expect("write"), res.bytes);
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("layer");
+    let masks = layer.masks();
+    let names: Vec<_> = masks.iter().map(|m| m.name.clone().unwrap_or_default()).collect();
+    assert_eq!(names, ["Rect", "Ellipse", "Open", "Hex", "Lighten", "Darken", "None"]);
+    let modes: Vec<_> = masks.iter().map(|m| m.mode).collect();
+    assert_eq!(modes, [AepMode::Add, AepMode::Subtract, AepMode::Intersect, AepMode::Difference, AepMode::Lighten, AepMode::Darken, AepMode::None].map(Some));
+    assert_eq!(masks.iter().map(|m| m.inverted).collect::<Vec<_>>(), [false, true, false, false, false, false, false].map(Some));
+    // The running counter of the layer: 1 to n.
+    assert_eq!(masks.iter().map(|m| m.counter).collect::<Vec<_>>(), (1..=7).map(Some).collect::<Vec<_>>());
+    // Feather, opacity, expansion: stored only when not at the default.
+    let e = &masks[1];
+    assert_eq!((e.feather.value, e.feather.source), ([20.0, 10.0], ValueSource::Stored));
+    assert_eq!((e.opacity_percent.value, e.opacity_percent.source), (50.0, ValueSource::Stored));
+    assert_eq!((e.expansion.value, e.expansion.source), (5.0, ValueSource::Stored));
+    assert_eq!(masks[3].expansion.value, -12.5);
+    for m in [&masks[0], &masks[2], &masks[4]] {
+        assert_eq!((m.feather.source, m.opacity_percent.source, m.expansion.source), (ValueSource::Default, ValueSource::Default, ValueSource::Default));
+    }
+    // Paths: vertices in layer pixels, open bit.
+    let px = view.mask_vertices_px(&layer, &masks[2]).expect("vertices");
+    let open = open_path();
+    assert!(masks[2].shapes[0].open && !masks[0].shapes[0].open);
+    for (v, (want, (ti, to))) in px[0].iter().zip(open.vertices.iter().zip(open.in_tangents.iter().zip(&open.out_tangents))) {
+        let near = |a: [f64; 2], b: [f64; 2]| (a[0] - b[0]).abs() < 0.01 && (a[1] - b[1]).abs() < 0.01;
+        assert!(near(v.position, *want) && near(v.in_tangent(), *ti) && near(v.out_tangent(), *to), "{v:?}");
+    }
+    // The point list header: count, vertex capacity and four times it (as 090 and 233).
+    let atoms = layer.mask_atoms();
+    let hex = &atoms[3].mask.shapes[0];
+    assert_eq!((hex.vertex_count(), hex.points.len()), (6, 18));
+    // The whole mask set imports back as it was exported.
+    same_masks(&masks_of(&p), &masks_of(&reimport(&res.bytes)));
+}
+
+#[test]
+fn path_and_feather_keys_parse_back() {
+    let p = animated();
+    let res = export_all(&p);
+    assert!(res.report.is_lossless(), "{:?}", res.report.losses);
+    let file = parse(&res.bytes).expect("parse");
+    assert_eq!(write(&file).expect("write"), res.bytes);
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("layer");
+    let atoms = layer.mask_atoms();
+    let m = &atoms[0];
+    assert!(m.mask.path_animated);
+    assert_eq!(m.mask.path_key_seconds, [0.0, 1.0, 2.0]);
+    assert_eq!(m.path_shapes.len(), 3);
+    let path = m.path.expect("path property");
+    let keys: Vec<_> = path.keys().expect("keys").keyframes().collect();
+    assert!(keys.iter().all(|k| k.kind() == KeyframeKind::MaskPath));
+    assert_eq!((keys[1].interpolation_in(), keys[1].interpolation_out(), keys[1].label()), (Some(Interpolation::Linear), Some(Interpolation::Hold), Some(3)));
+    let Some(PropNode::Property(feather)) = m.atom.get("ADBE Mask Feather") else { panic!("feather") };
+    let fk: Vec<_> = feather.keys().expect("feather keys").keyframes().collect();
+    assert_eq!(fk.len(), 2);
+    assert_eq!(fk[1].value(), Some(vec![50.0, 30.0]));
+    let e = fk[0].ease_components().expect("ease");
+    assert_eq!((e[0].out_speed, e[0].out_influence, e[1].out_speed, e[1].out_influence), (15.0, 0.66, 5.0, 0.5));
+    same_masks(&masks_of(&p), &masks_of(&reimport(&res.bytes)));
+}
+
+#[test]
+fn a_mask_on_a_small_solid_is_normalised_to_the_layer_size() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1280, 720, FrameRate::new(25, 1), 2.0, None);
+    let s = add_solid(&mut p, "L", 400, 300, [0.0, 1.0, 0.0], None);
+    add_layer(&mut p, c, "L", LayerSource::Solid { item: s }, (400, 300));
+    let mut next = p.next_id;
+    with_layer(&mut p, c, 0, |l| add_mask(l, &mut next, "Mask 1", ShapePath::rect([200.0, 150.0], 200.0, 100.0), MaskMode::Add, |_| {}));
+    p.next_id = next;
+    let res = export_all(&p);
+    let file = parse(&res.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("layer");
+    let m = &layer.masks()[0];
+    // The box is a fraction of the 400x300 solid: 100..300 / 400, 100..200 / 300.
+    let b = m.shapes[0].bbox.map(f64::from);
+    for (got, want) in b.iter().zip([0.25, 1.0 / 3.0, 0.75, 2.0 / 3.0]) {
+        assert!((got - want).abs() < 1e-6, "{b:?}");
+    }
+    same_masks(&masks_of(&p), &masks_of(&reimport(&res.bytes)));
+}
+
+#[test]
+fn what_cannot_be_written_is_reported() {
+    let p = project(|l, n| {
+        add_mask(l, n, "Off", ShapePath::rect([960.0, 540.0], 100.0, 100.0), MaskMode::Add, |g| g.enabled = false);
+        add_mask(l, n, "Empty", ShapePath::default(), MaskMode::Add, |_| {});
+        add_mask(l, n, "Keyed opacity", ShapePath::rect([960.0, 540.0], 100.0, 100.0), MaskMode::Add, |g| {
+            g.get_mut("opacity").unwrap().keys = vec![key(0.0, Value::Scalar(10.0)), key(1.0, Value::Scalar(90.0))];
+            g.get_mut("expansion").unwrap().expr = Some(Expression { text: "time".into(), enabled: true });
+            if let GroupKind::Mask { locked, feather_falloff, roto_bezier, .. } = &mut g.kind {
+                *locked = true;
+                *feather_falloff = FeatherFalloff::Linear;
+                *roto_bezier = true;
+            }
+        });
+        add_mask(l, n, "Bezier path", ShapePath::rect([960.0, 540.0], 100.0, 100.0), MaskMode::Add, |g| {
+            let mut a = key(0.0, Value::Path(ShapePath::rect([960.0, 540.0], 100.0, 100.0)));
+            a.out_interp = Interp::Bezier;
+            g.get_mut("path").unwrap().keys = vec![a, key(1.0, Value::Path(ShapePath::rect([960.0, 540.0], 200.0, 100.0)))];
+        });
+        add_mask(l, n, "NaN", ShapePath::polygon(&[[f64::NAN, 0.0], [10.0, 10.0]], true), MaskMode::Add, |g| {
+            set(g, "feather", Value::Vec2([f64::INFINITY, -1.0]));
+            set(g, "opacity", Value::Scalar(400.0));
+        });
+    });
+    let err = export(&p, &ExportOptions { allow_losses: false }).unwrap_err();
+    assert!(err.to_string().contains("masks"), "{err}");
+    let res = export_all(&p);
+    let r = &res.report;
+    // Off, Empty and NaN are not written; Keyed opacity (5 losses: keys, expression, lock,
+    // falloff, RotoBezier) and Bezier path (its ease is written, 599 / 700) are.
+    assert_eq!(r.exported.masks, 2, "{:?}", r.losses);
+    assert_eq!(r.count(LossCategory::Masks), 3 + 5, "{:?}", r.losses);
+    assert_eq!(r.count(LossCategory::ApproximatedKeyframes), 0, "{:?}", r.losses);
+    let back = reimport(&res.bytes);
+    let m = masks_of(&back);
+    assert_eq!(m.len(), 2);
+    assert_eq!(m[1].get("path").unwrap().keys[0].out_interp, Interp::Bezier);
+}
+
+#[test]
+fn hostile_masks_never_panic() {
+    let huge = ShapePath::polygon(&vec![[1.0, 2.0]; 70_000], true);
+    let line = ShapePath::polygon(&[[5.0, 5.0], [5.0, 900.0], [5.0, 30.0]], false);
+    let point = ShapePath::polygon(&[[5.0, 5.0]], true);
+    let lopsided = ShapePath { vertices: vec![[0.0, 0.0], [10.0, 0.0]], in_tangents: vec![], out_tangents: vec![[1.0, 1.0]], closed: true, feather: vec![] };
+    let p = project(|l, n| {
+        for (i, path) in [huge, line, point, lopsided, ShapePath::polygon(&[[1e300, 0.0], [0.0, 0.0]], true)].into_iter().enumerate() {
+            add_mask(l, n, &format!("M{i}"), path, MaskMode::Add, |_| {});
+        }
+        add_mask(l, n, &"x".repeat(1000), ShapePath::rect([1.0, 1.0], 1.0, 1.0), MaskMode::Add, |_| {});
+    });
+    let res = export_all(&p);
+    let file = parse(&res.bytes).expect("parse");
+    assert_eq!(write(&file).expect("write"), res.bytes);
+    // The line (zero width box), the point (zero box), the lopsided path and the long name are
+    // written; the huge and the out-of-range paths are not.
+    assert_eq!(res.report.exported.masks, 4, "{:?}", res.report.losses);
+    let back = masks_of(&reimport(&res.bytes));
+    assert_eq!(back.len(), 4);
+    let line = path_of(&back[0].get("path").unwrap().value);
+    assert!(line.vertices.iter().all(|v| (v[0] - 5.0).abs() < 1e-3));
+    assert!((line.vertices[1][1] - 900.0).abs() < 1e-2);
+    assert!(back[3].name.len() <= 255);
+}
+
+#[test]
+fn mask_fixtures_round_trip() {
+    for name in [
+        "090-mask-rect.aep",
+        "091-mask-rect-props.aep",
+        "093-mask-path-2keys.aep",
+        "208-key-mask-feather-2key-linear.aep",
+        "232-mask-ellipse.aep",
+        "233-mask-open-path.aep",
+        "234-mask-mode-intersect.aep",
+        "235-mask-mode-lighten.aep",
+        "236-mask-mode-darken.aep",
+        "237-mask-mode-difference.aep",
+        "306-key-maskfeather-bezier-ease.aep",
+        "309-solid-100x100-mask-rect.aep",
+        "328-mask-two-ellipse-rect.aep",
+        "329-mask-ellipse-mode-none.aep",
+    ] {
+        let a = reimport(&fixture!(name));
+        let res = export_all(&a);
+        assert_eq!(res.report.count(LossCategory::Masks), 0, "{name}: {:?}", res.report.losses);
+        let b = reimport(&res.bytes);
+        // 309 has its masked layer on a 100x100 solid in a second composition layer list; compare
+        // every layer with masks.
+        let all = |p: &Project| -> Vec<Vec<PropGroup>> {
+            let mut v: Vec<(String, Vec<PropGroup>)> = Vec::new();
+            for item in p.items.values() {
+                if let effectcraft_project::ItemKind::Comp(c) = &item.kind {
+                    for l in &c.layers {
+                        if let Some(m) = l.masks().filter(|m| !m.children.is_empty()) {
+                            v.push((format!("{}/{}", item.name, l.name), m.groups().cloned().collect()));
+                        }
+                    }
+                }
+            }
+            v.sort_by(|x, y| x.0.cmp(&y.0));
+            v.into_iter().map(|(_, m)| m).collect()
+        };
+        let (ma, mb) = (all(&a), all(&b));
+        assert_eq!(ma.len(), mb.len(), "{name}");
+        assert!(!ma.is_empty(), "{name}");
+        for (x, y) in ma.iter().zip(&mb) {
+            same_masks(x, y);
+        }
+    }
+}
diff --git a/crates/aep/tests/it/export/objects.rs b/crates/aep/tests/it/export/objects.rs
new file mode 100644
index 000000000..d42f1c399
--- /dev/null
+++ b/crates/aep/tests/it/export/objects.rs
@@ -0,0 +1,892 @@
+//! Track mattes, markers, cameras, lights and shape layers: written from projects built in code
+//! and read back with `effectcraft-aep`.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::parse;
+use effectcraft_project::{LayerSource, MatteKind, Project, TrackMatte};
+use effectcraft_time::FrameRate;
+
+/// `ldta` of every layer of the first composition, top first.
+fn ldtas(bytes: &[u8]) -> Vec<Vec<u8>> {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    comp.layers().map(|l| l.chunk().child(b"ldta").and_then(|c| c.bytes()).expect("ldta").to_vec()).collect()
+}
+
+fn u32_at(b: &[u8], at: usize) -> u32 {
+    u32::from_be_bytes(b[at..at + 4].try_into().expect("4"))
+}
+
+fn two_solids() -> (Project, effectcraft_project::ItemId) {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 2.0, None);
+    let s = add_solid(&mut p, "S", 640, 360, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, c, "Target", LayerSource::Solid { item: s }, (640, 360));
+    add_layer(&mut p, c, "Matte", LayerSource::Solid { item: s }, (640, 360));
+    (p, c)
+}
+
+#[test]
+fn track_mattes_are_written_with_mode_and_layer() {
+    // 403-406: the mode at ldta@107 (1 alpha, 2 alpha inverted, 3 luma, 4 luma inverted) and
+    // the matte layer's id at ldta@160, on the target layer.
+    for (kind, mode) in [(MatteKind::Alpha, 1u8), (MatteKind::AlphaInverted, 2), (MatteKind::Luma, 3), (MatteKind::LumaInverted, 4)] {
+        let (mut p, c) = two_solids();
+        let matte_id = p.comp(c).expect("c").layers[0].id;
+        with_layer(&mut p, c, 1, |l| l.track_matte = Some(TrackMatte { layer: matte_id, kind }));
+        let r = export_all(&p);
+        assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+        let l = ldtas(&r.bytes);
+        // Top: Matte, then Target.
+        assert_eq!((l[0][107], u32_at(&l[0], 160)), (0, 0));
+        assert_eq!(l[1][107], mode);
+        assert_eq!(u32_at(&l[1], 160), u32_at(&l[0], 0), "the matte layer's id");
+    }
+    // A matte below the target (407) is written as well; one that is not exported is reported.
+    let (mut p, c) = two_solids();
+    let target = p.comp(c).expect("c").layers[1].id;
+    with_layer(&mut p, c, 0, |l| l.track_matte = Some(TrackMatte { layer: target, kind: MatteKind::Alpha }));
+    let l = ldtas(&export_all(&p).bytes);
+    assert_eq!((l[0][107], u32_at(&l[0], 160)), (1, u32_at(&l[1], 0)));
+    let (mut p, c) = two_solids();
+    with_layer(&mut p, c, 1, |l| l.track_matte = Some(TrackMatte { layer: effectcraft_project::LayerId(987_654), kind: MatteKind::Luma }));
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::TrackMattes), 1);
+    assert_eq!(ldtas(&r.bytes)[1][107], 0);
+}
+
+fn marker(t: f64, comment: &str) -> effectcraft_project::Marker {
+    effectcraft_project::Marker { time: secs(t), comment: comment.into(), ..Default::default() }
+}
+
+#[test]
+fn markers_are_written_like_after_effects_stores_them() {
+    let (mut p, c) = two_solids();
+    with_comp(&mut p, c, |cc| {
+        cc.markers = vec![
+            effectcraft_project::Marker { label: effectcraft_color::Label::Yellow, ..marker(1.0, "M1") },
+            effectcraft_project::Marker { duration: secs(0.5), ..marker(2.5, "M2") },
+        ];
+    });
+    with_layer(&mut p, c, 0, |l| {
+        l.markers = vec![
+            effectcraft_project::Marker {
+                duration: secs(1.0),
+                chapter: "Chap".into(),
+                url: "http://a.example/u".into(),
+                frame_target: "_blank".into(),
+                cue_point: Some(effectcraft_project::CuePoint {
+                    name: "CueX".into(),
+                    navigation: false,
+                    params: vec![("speaker".into(), "A".into()), ("n".into(), "2".into())],
+                }),
+                ..marker(1.0, "LM")
+            },
+            effectcraft_project::Marker {
+                cue_point: Some(effectcraft_project::CuePoint { name: "CueN".into(), navigation: true, params: Vec::new() }),
+                ..marker(0.52, "Nav")
+            },
+        ];
+    });
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.markers, 4);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let cm = comp.markers();
+    assert_eq!(
+        cm.iter().map(|m| (m.time_units, m.comment.as_str(), m.duration_seconds, m.label)).collect::<Vec<_>>(),
+        vec![
+            (25_600, "M1", Some(0.0), Some(effectcraft_color::Label::ALL.iter().position(|l| *l == effectcraft_color::Label::Yellow).expect("label") as u8)),
+            // EffectCraft's default marker label is Red, index 1 (After Effects' own default is 0, None).
+            (64_000, "M2", Some(0.5), Some(1)),
+        ]
+    );
+    let layer = comp.layers().next().expect("layer");
+    let lm = layer.markers();
+    assert_eq!(lm.len(), 2);
+    // In time order: Nav at 0.52 s (13 312 units, 510), LM at 1 s.
+    assert_eq!(
+        (lm[0].time_units, lm[0].comment.as_str(), lm[0].cue_type, lm[0].cue_point_name.as_str()),
+        (13_312, "Nav", Some(effectcraft_aep::CueType::Navigation), "CueN")
+    );
+    let m = &lm[1];
+    assert_eq!(
+        (m.time_units, m.comment.as_str(), m.chapter.as_str(), m.url.as_str(), m.frame_target.as_str(), m.cue_point_name.as_str()),
+        (25_600, "LM", "Chap", "http://a.example/u", "_blank", "CueX")
+    );
+    assert_eq!((m.duration_seconds, m.cue_type), (Some(1.0), Some(effectcraft_aep::CueType::Event)));
+    assert_eq!(m.cue_params, vec![("speaker".to_string(), "A".to_string()), ("n".to_string(), "2".to_string())]);
+    // A protected marker is reported (the switch is not decoded).
+    with_layer(&mut p, c, 1, |l| l.markers = vec![effectcraft_project::Marker { protected: true, ..marker(0.2, "P") }]);
+    assert_eq!(export_all(&p).report.count(LossCategory::Markers), 1);
+}
+
+#[test]
+fn marker_fixtures_are_written_as_after_effects_wrote_them() {
+    // 122 (composition), 123, 249, 347-349 (layer): the reader sees the same markers after an
+    // import of the fixture, its markers put back from the reader's view (the importer does not
+    // read markers yet), and an export.
+    for name in [
+        "122-marker-comp-1s.aep",
+        "123-marker-layer-1s.aep",
+        "249-marker-layer-full.aep",
+        "347-marker-layer-label3.aep",
+        "348-marker-layer-navigation-cue.aep",
+        "349-marker-layer-event-cue-params.aep",
+    ] {
+        let bytes = fixture!(name);
+        let file = parse(&bytes).expect("parse");
+        let view = effectcraft_aep::Project::new(&file).expect("project");
+        let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+        let to_ec = |m: &effectcraft_aep::Marker| effectcraft_project::Marker {
+            time: secs(m.seconds.unwrap_or(0.0)),
+            duration: secs(m.duration_seconds.unwrap_or(0.0)),
+            comment: m.comment.clone(),
+            label: effectcraft_color::Label::ALL.get(usize::from(m.label.unwrap_or(0))).copied().unwrap_or_default(),
+            chapter: m.chapter.clone(),
+            url: m.url.clone(),
+            frame_target: m.frame_target.clone(),
+            cue_point: (!m.cue_point_name.is_empty() || m.cue_type == Some(effectcraft_aep::CueType::Navigation) || !m.cue_params.is_empty()).then(|| {
+                effectcraft_project::CuePoint {
+                    name: m.cue_point_name.clone(),
+                    navigation: m.cue_type == Some(effectcraft_aep::CueType::Navigation),
+                    params: m.cue_params.clone(),
+                }
+            }),
+            protected: false,
+        };
+        let comp_markers: Vec<_> = comp.markers().iter().map(to_ec).collect();
+        let layer_markers: Vec<_> = comp.layers().next().map(|l| l.markers().iter().map(to_ec).collect()).unwrap_or_default();
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        effectcraft_aep::import::import(
+            &mut p,
+            &bytes,
+            &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+        )
+        .expect(name);
+        let cid = p.comps().next().map(|(id, _)| *id).expect("comp");
+        with_comp(&mut p, cid, |c| c.markers = comp_markers);
+        with_layer(&mut p, cid, 0, |l| l.markers = layer_markers);
+        let r = export_all(&p);
+        let out = parse(&r.bytes).expect("parse");
+        let oview = effectcraft_aep::Project::new(&out).expect("project");
+        let ocomp = oview.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+        assert_eq!(ocomp.markers(), comp.markers(), "{name}");
+        assert_eq!(ocomp.layers().next().map(|l| l.markers()), comp.layers().next().map(|l| l.markers()), "{name}");
+    }
+}
+
+fn with_props(p: &mut Project, c: effectcraft_project::ItemId, idx: usize, set: &[(&str, effectcraft_keyframe::Value)]) {
+    with_layer(p, c, idx, |l| {
+        for (path, v) in set {
+            l.props.prop_mut(path).unwrap_or_else(|| panic!("{path}")).value = v.clone();
+        }
+    });
+}
+
+fn first_comp_layers(bytes: &[u8], mut f: impl FnMut(&effectcraft_aep::Layer<'_, '_>)) {
+    let file = parse(bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), bytes);
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    for l in comp.layers() {
+        f(&l);
+    }
+}
+
+#[test]
+fn cameras_are_written_with_position_point_of_interest_and_options() {
+    use effectcraft_keyframe::Value;
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "Cam", LayerSource::Camera, (1920, 1080));
+    with_props(
+        &mut p,
+        c,
+        0,
+        &[
+            ("transform/position", Value::Vec3([100.0, 200.0, -1000.0])),
+            ("transform/poi", Value::Vec3([960.0, 540.0, 0.0])),
+            ("cameraOptions/dof", Value::Bool(true)),
+            ("cameraOptions/focusDistance", Value::Scalar(800.0)),
+            ("cameraOptions/aperture", Value::Scalar(30.0)),
+            ("cameraOptions/zoom", Value::Scalar(1500.0)),
+            ("cameraOptions/blurLevel", Value::Scalar(80.0)),
+        ],
+    );
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.cameras, 1);
+    first_comp_layers(&r.bytes, |l| {
+        let h = l.header().expect("header");
+        assert_eq!(h.layer_type, effectcraft_aep::LayerType::Camera);
+        assert!(h.is_three_d() && h.is_auto_oriented(), "two-node camera");
+        let pos = l.camera_position().expect("position");
+        assert_eq!((pos.stored, pos.auto_state), ([100.0, 200.0, -1000.0], false));
+        assert_eq!(l.camera_point_of_interest(), Some([960.0, 540.0, 0.0]));
+        assert_eq!(l.camera_depth_of_field().map(|t| t.value), Some(true));
+        assert_eq!(l.camera_focus_distance().map(|t| t.value), Some(800.0));
+        assert_eq!(l.camera_aperture().map(|t| t.value), Some(30.0));
+        assert_eq!(l.camera_zoom().map(|t| t.value), Some(1500.0));
+    });
+    // One-node (auto-orient off): bit 0x40 clear (251).
+    with_layer(&mut p, c, 0, |l| l.auto_orient = effectcraft_project::AutoOrient::Off);
+    first_comp_layers(&export_all(&p).bytes, |l| assert!(!l.header().expect("h").is_auto_oriented()));
+}
+
+#[test]
+fn spot_and_point_lights_are_written_with_their_options() {
+    use effectcraft_keyframe::Value;
+    use effectcraft_project::LightKind;
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "Spot", LayerSource::Light { kind: LightKind::Spot }, (1920, 1080));
+    add_layer(&mut p, c, "Point", LayerSource::Light { kind: LightKind::Point }, (1920, 1080));
+    // Layer 0 is the point light (added last, on top), 1 the spot.
+    with_props(
+        &mut p,
+        c,
+        1,
+        &[
+            ("lightOptions/intensity", Value::Scalar(50.0)),
+            ("lightOptions/color", Value::Color([1.0, 0.0, 0.0, 1.0])),
+            ("lightOptions/coneAngle", Value::Scalar(60.0)),
+            ("lightOptions/coneFeather", Value::Scalar(30.0)),
+            ("transform/position", Value::Vec3([100.0, 50.0, -500.0])),
+        ],
+    );
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.lights, 2);
+    let mut seen = Vec::new();
+    first_comp_layers(&r.bytes, |l| {
+        let h = l.header().expect("header");
+        assert_eq!(h.layer_type, effectcraft_aep::LayerType::Light);
+        seen.push(h.light_type());
+        match h.light_type() {
+            Some(effectcraft_aep::LightType::Spot) => {
+                assert_eq!(l.light_intensity().map(|t| t.value), Some(50.0));
+                assert_eq!(l.light_color().map(|t| t.value), Some([1.0, 1.0, 0.0, 0.0]));
+                assert_eq!(l.light_cone_angle().map(|t| t.value), Some(60.0));
+                assert_eq!(l.light_cone_feather().map(|t| t.value), Some(30.0));
+                assert_eq!(l.camera_position().map(|p| p.stored), Some([100.0, 50.0, -500.0]));
+                assert_eq!(l.camera_point_of_interest(), Some([960.0, 540.0, 0.0]));
+            }
+            Some(effectcraft_aep::LightType::Point) => {
+                assert_eq!(l.light_intensity().map(|t| t.value), Some(100.0));
+            }
+            other => panic!("{other:?}"),
+        }
+    });
+    assert_eq!(seen.len(), 2);
+    // Parallel and ambient lights, and unsampled options, are reported.
+    let mut q = Project::default();
+    let c = add_comp(&mut q, "C", 640, 360, FrameRate::new(25, 1), 1.0, None);
+    add_layer(&mut q, c, "Par", LayerSource::Light { kind: LightKind::Parallel }, (640, 360));
+    add_layer(&mut q, c, "Spot", LayerSource::Light { kind: LightKind::Spot }, (640, 360));
+    with_props(&mut q, c, 0, &[("lightOptions/castsShadows", Value::Bool(true))]);
+    assert_eq!(export_all(&q).report.count(LossCategory::Lights), 2);
+}
+
+#[test]
+fn shape_layers_are_written_with_their_items() {
+    use effectcraft_keyframe::{ShapePath, Value};
+    use effectcraft_project::build;
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "S", LayerSource::Shape, (1920, 1080));
+    let mut next = p.next_id;
+    {
+        let mut ids = build::Ids(&mut next);
+        let mut rect = build::shape_rect(&mut ids, [400.0, 300.0], [10.0, -20.0], 15.0);
+        rect.name = "Rectangle Path 1".into();
+        let mut fill = build::shape_fill(&mut ids, [0.0, 1.0, 0.0, 1.0]);
+        if let Some(r) = fill.get_mut("rule") {
+            r.value = Value::Enum(1);
+        }
+        if let Some(o) = fill.get_mut("opacity") {
+            o.value = Value::Scalar(50.0);
+        }
+        let mut stroke = build::shape_stroke(&mut ids, [1.0, 0.0, 0.0, 1.0], 6.0);
+        if let Some(cap) = stroke.get_mut("cap") {
+            cap.value = Value::Enum(1);
+        }
+        let mut g1 = build::shape_group(&mut ids, "Group 1", vec![rect, stroke, fill]);
+        if let Some(t) = g1.sub_mut("transform") {
+            t.get_mut("position").expect("pos").value = Value::Vec2([50.0, 50.0]);
+            t.get_mut("scale").expect("scale").value = Value::Vec2([50.0, 80.0]);
+            t.get_mut("rotation").expect("rot").value = Value::Scalar(30.0);
+        }
+        let ellipse = build::shape_ellipse(&mut ids, [500.0, 200.0], [100.0, 50.0]);
+        let path = build::shape_path(
+            &mut ids,
+            ShapePath {
+                vertices: vec![[0.0, -100.0], [100.0, 100.0], [-100.0, 100.0]],
+                in_tangents: vec![[-10.0, -20.0], [30.0, 20.0], [-60.0, 10.0]],
+                out_tangents: vec![[40.0, 0.0], [-20.0, 30.0], [0.0, -50.0]],
+                closed: true,
+                feather: Vec::new(),
+            },
+        );
+        let fill2 = build::shape_fill(&mut ids, [0.0, 0.0, 1.0, 1.0]);
+        let inner = build::shape_group(&mut ids, "Inner", vec![ellipse]);
+        let g2 = build::shape_group(&mut ids, "Group 2", vec![inner, path, fill2]);
+        let star = build::shape_star(&mut ids, true, 5.0, [0.0, 0.0], 100.0, 50.0);
+        with_layer(&mut p, c, 0, |l| {
+            let contents = l.props.sub_mut("contents").expect("contents");
+            contents.children = vec![g1.into(), g2.into(), star.into()];
+        });
+    }
+    p.next_id = next;
+    let r = export_all(&p);
+    // Everything is written, the polystar too.
+    assert_eq!(r.report.count(LossCategory::ShapeLayers), 0, "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.shape_layers, 1);
+    first_comp_layers(&r.bytes, |l| {
+        assert_eq!(l.header().expect("h").layer_type, effectcraft_aep::LayerType::Shape);
+        let groups = l.shape_groups();
+        assert_eq!(groups.len(), 2, "{groups:?}");
+        let names: Vec<_> = groups.iter().map(|g| g.name.clone()).collect();
+        assert_eq!(names, vec![Some("Group 1".to_string()), Some("Group 2".to_string())]);
+        let s = format!("{groups:?}");
+        // The path box equals the one After Effects stored for the same path (240).
+        for want in [
+            "400.0, 300.0",
+            "[10.0, -20.0]",
+            "50.0, 50.0",
+            "width: Some(Tracked { value: 6.0",
+            "cap: Tracked { value: Round",
+            "bbox: [-160.0, -120.0, 130.0, 130.0]",
+        ] {
+            assert!(s.contains(want), "{want} in {s}");
+        }
+    });
+}
+
+#[test]
+fn hostile_objects_never_panic() {
+    use effectcraft_keyframe::Value;
+    use effectcraft_project::{LightKind, build};
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "S", LayerSource::Shape, (640, 360));
+    let mut next = p.next_id;
+    {
+        let mut ids = build::Ids(&mut next);
+        // 200 nested groups, a NaN rectangle, an empty path.
+        let bad = build::shape_rect(&mut ids, [f64::NAN, 1e300], [0.0, 0.0], f64::INFINITY);
+        let mut inner = build::shape_group(&mut ids, "deep", vec![bad]);
+        for i in 0..200 {
+            inner = build::shape_group(&mut ids, &format!("g{i}"), vec![inner]);
+        }
+        let empty = build::shape_path(&mut ids, effectcraft_keyframe::ShapePath::default());
+        with_layer(&mut p, c, 0, |l| l.props.sub_mut("contents").expect("contents").children = vec![inner.into(), empty.into()]);
+    }
+    p.next_id = next;
+    add_layer(&mut p, c, "Cam", LayerSource::Camera, (640, 360));
+    with_props(&mut p, c, 0, &[("cameraOptions/zoom", Value::Scalar(f64::NAN)), ("transform/position", Value::Vec3([f64::INFINITY, 0.0, 0.0]))]);
+    add_layer(&mut p, c, "L", LayerSource::Light { kind: LightKind::Spot }, (640, 360));
+    with_props(&mut p, c, 0, &[("lightOptions/color", Value::Color([f64::NAN, 2.0, -1.0, 1.0])), ("lightOptions/intensity", Value::Scalar(-1e9))]);
+    with_layer(&mut p, c, 0, |l| {
+        l.markers = (0..500).map(|i| marker(f64::from(i) * 1e7, "x")).collect();
+        l.track_matte = Some(TrackMatte { layer: l.id, kind: MatteKind::Alpha });
+    });
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    assert!(r.report.count(LossCategory::ShapeLayers) >= 2, "{:?}", r.report.losses);
+    assert!(r.report.count(LossCategory::TrackMattes) == 1);
+}
+
+#[test]
+fn camera_fixtures_come_back_without_a_loss() {
+    // The exporter writes every camera option, Blur Level 100 too; importing the export must not
+    // report it (it was reported as "not imported" before the importer and exporter lines met).
+    use effectcraft_aep::import::{ImportOptions, import};
+    let none = |_: &str| false;
+    for name in ["251-camera-one-node.aep", "256-camera-two-node-default.aep", "342-camera-dof-800-30.aep", "537-camera-default-on-3d-rotx.aep"] {
+        let bytes = fixture!(name);
+        let mut p = Project::default();
+        let r1 = import(&mut p, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+        assert!(r1.report.losses.is_empty(), "{name}: {:?}", r1.report.losses);
+        let out = export_all(&p);
+        assert!(out.report.is_lossless(), "{name}: {:?}", out.report.losses);
+        let mut p2 = Project::default();
+        let r2 = import(&mut p2, &out.bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("reimport");
+        assert!(r2.report.losses.is_empty(), "{name}: {:?}", r2.report.losses);
+        assert_eq!(r2.report.imported.cameras, 1, "{name}");
+    }
+}
+
+/// The static value records below the shape contents of every layer, by (layer index, path of
+/// item match names, record match name).
+fn shape_records(bytes: &[u8]) -> std::collections::BTreeMap<(usize, String), effectcraft_aep::Chunk<'static>> {
+    fn walk(
+        cs: &[effectcraft_aep::Chunk<'_>],
+        path: &str,
+        li: usize,
+        inside: bool,
+        out: &mut std::collections::BTreeMap<(usize, String), effectcraft_aep::Chunk<'static>>,
+    ) {
+        let mut seen: std::collections::HashMap<String, usize> = std::collections::HashMap::new();
+        for (i, c) in cs.iter().enumerate() {
+            let name = if c.is(b"tdmn") { c.bytes().map(|b| String::from_utf8_lossy(b.split(|x| *x == 0).next().unwrap_or(b"")).to_string()) } else { None };
+            let Some(name) = name else { continue };
+            let Some(node) = cs.get(i + 1) else { continue };
+            let n = seen.entry(name.clone()).or_insert(0);
+            let key = format!("{path}/{name}#{n}");
+            *n += 1;
+            let here = inside || name == "ADBE Root Vectors Group";
+            if here && node.is_list(b"tdbs") && node.child(b"cdat").is_some() {
+                let has_expression = node.child(b"Utf8").is_some();
+                let mut node = node.clone().into_owned();
+                // Header bytes 76 and 77 next to an expression vary between saves (see
+                // `keyed_shape_records`).
+                if has_expression
+                    && let effectcraft_aep::Body::List { children, .. } = &mut node.body
+                    && let Some(effectcraft_aep::Body::Data(d)) = children.iter_mut().find(|x| x.is(b"tdb4")).map(|x| &mut x.body)
+                    && let Some(b) = d.to_mut().get_mut(76..78)
+                {
+                    b.fill(0);
+                }
+                out.insert((li, key.clone()), node);
+            }
+            if node.is_list(b"tdgp") {
+                walk(node.children(), &key, li, here, out);
+            }
+        }
+    }
+    let f = parse(bytes).expect("parse");
+    let mut out = std::collections::BTreeMap::new();
+    let view = effectcraft_aep::Project::new(&f).expect("project");
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for (li, layer) in comp.layers().enumerate() {
+            if let Some(g) = layer.chunk().child_list(b"tdgp") {
+                walk(g.children(), "", li, false, &mut out);
+            }
+        }
+    }
+    out
+}
+
+#[test]
+fn every_shape_value_record_is_written_as_after_effects_wrote_it() {
+    // Every static record of a shape fixture comes back with After Effects' bytes, built from the
+    // record of its property's type (R46).
+    let mut names: Vec<String> = fixture_names!("aep").into_iter().filter(|n| n.ends_with(".aep") && n.contains("shape")).collect();
+    names.sort();
+    let mut compared = 0;
+    for name in &names {
+        let bytes = fixture!(name);
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let imported = effectcraft_aep::import::import(
+            &mut p,
+            &bytes,
+            &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+        )
+        .expect("import");
+        if imported.report.count(effectcraft_aep::import::LossCategory::ShapeLayers) > 0 {
+            continue;
+        }
+        let r = export_all(&p);
+        let (a, b) = (shape_records(&bytes), shape_records(&r.bytes));
+        for (k, rec) in &a {
+            // A record After Effects keeps for a value set to its default (239: Miter Limit 4)
+            // is not needed: absent = default.
+            let first = rec.child(b"cdat").and_then(|c| c.bytes()).and_then(|d| d.get(..8)).and_then(|b| b.try_into().ok()).map(f64::from_be_bytes);
+            let explicit_default =
+                [("ADBE Vector Stroke Miter Limit#0", 4.0), ("ADBE Vector Grad HiLite Angle#0", 0.0), ("ADBE Vector Grad HiLite Length#0", 0.0)]
+                    .iter()
+                    .any(|(n, v)| k.1.ends_with(n) && first == Some(*v));
+            // A polygon has no inner radius or roundness in EffectCraft (After Effects keeps their
+            // records, 331; a polygon ignores them).
+            let polygon_inner = name.contains("polygon") && k.1.contains("ADBE Vector Star Inner");
+            let Some(got) = b.get(k) else {
+                assert!(explicit_default || polygon_inner, "{name}: {k:?} not written");
+                continue;
+            };
+            assert_eq!(crate::export::helpers::decoded(got), crate::export::helpers::decoded(rec), "{name}: {k:?}");
+            compared += 1;
+        }
+        for k in b.keys() {
+            assert!(a.contains_key(k), "{name}: {k:?} written but After Effects has none");
+        }
+    }
+    assert!(compared >= 40, "{compared}");
+}
+
+/// The keyed (or expression) records below the shape contents of the first layer: `(path,
+/// tdb4, lhd3, ldat with spatial arc lengths zeroed, expression)`.
+fn keyed_shape_records(bytes: &[u8]) -> Vec<(String, Vec<u8>, Vec<u8>, Vec<u8>, Option<Vec<u8>>)> {
+    fn walk(cs: &[effectcraft_aep::Chunk<'_>], path: &str, inside: bool, out: &mut Vec<(String, Vec<u8>, Vec<u8>, Vec<u8>, Option<Vec<u8>>)>) {
+        for (i, c) in cs.iter().enumerate() {
+            let Some(name) = c.bytes().filter(|_| c.is(b"tdmn")).map(|b| String::from_utf8_lossy(b.split(|x| *x == 0).next().unwrap_or(b"")).to_string())
+            else {
+                continue;
+            };
+            let Some(node) = cs.get(i + 1) else { continue };
+            let key = format!("{path}/{name}");
+            let here = inside || name == "ADBE Root Vectors Group";
+            if here && node.is_list(b"tdbs") {
+                let list = node.child_list(b"list");
+                let expr = node.child(b"Utf8").and_then(|u| u.bytes()).map(<[u8]>::to_vec);
+                if list.is_some() || expr.is_some() {
+                    // The header bytes the exporter writes (the others are zero: `decoded`).
+                    let mut tdb4 =
+                        crate::export::helpers::decoded(&node.clone().into_owned()).child(b"tdb4").and_then(|c| c.bytes()).unwrap_or_default().to_vec();
+                    // Header bytes 76 and 77 of a property with an expression: After Effects
+                    // wrote 1 in one save and 0 in another (060 and 856 of the combined files);
+                    // byte 120 marks the expression.
+                    if expr.is_some()
+                        && let Some(b) = tdb4.get_mut(76..78)
+                    {
+                        b.fill(0);
+                    }
+                    let lhd3 = list.and_then(|l| l.child(b"lhd3")).and_then(|c| c.bytes()).unwrap_or_default().to_vec();
+                    let mut ldat = list.and_then(|l| l.child(b"ldat")).and_then(|c| c.bytes()).unwrap_or_default().to_vec();
+                    let size = lhd3.get(16..20).map_or(0, |b| u32::from_be_bytes(b.try_into().unwrap()) as usize);
+                    if size == 104 {
+                        for r in ldat.chunks_mut(104) {
+                            r[16..24].fill(0);
+                            // Automatic spatial tangents: After Effects keeps 0 for two keys
+                            // made by script (853), the exporter writes the tangents it computes
+                            // (collinear: the same straight path, R14).
+                            if r[8..12] == [0, 0, 0, 1] {
+                                r[72..104].fill(0);
+                            }
+                        }
+                    }
+                    // The colour distance to the next key (f64 at 16) of a colour key: After
+                    // Effects wrote 0 for 854's linear keys in one save and 255 sqrt(2) in
+                    // another (the combined file); the exporter writes 0.
+                    if size == 152 {
+                        for r in ldat.chunks_mut(152) {
+                            r[16..24].fill(0);
+                        }
+                    }
+                    // The ease before the first key and after the last one is never used (the
+                    // importer keeps none, the exporter writes 1/3 influence there).
+                    if size == 48 && ldat.len() >= 96 {
+                        ldat[16..32].fill(0);
+                        let n = ldat.len();
+                        ldat[n - 16..n].fill(0);
+                    }
+                    out.push((key.clone(), tdb4, lhd3, ldat, expr));
+                }
+            }
+            if node.is_list(b"tdgp") {
+                walk(node.children(), &key, here, out);
+            }
+        }
+    }
+    let f = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&f).expect("project");
+    let mut out = Vec::new();
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for layer in comp.layers() {
+            if let Some(g) = layer.chunk().child_list(b"tdgp") {
+                walk(g.children(), "", false, &mut out);
+            }
+        }
+    }
+    out
+}
+
+#[test]
+fn keyed_shape_properties_are_written_as_after_effects_wrote_them() {
+    // 851-857: Trim End linear and bezier keys, group Position (spatial), Fill Color, Trim
+    // Offset with a hold key, an expression on Trim End, group Scale (two components).
+    for name in [
+        "851-shape-key-trim-end-0-100-linear.aep",
+        "852-shape-key-trim-end-bezier-out0-60-in20-30.aep",
+        "853-shape-key-group-position-0-200-100-linear.aep",
+        "854-shape-key-fill-color-red-blue-linear.aep",
+        "855-shape-key-trim-offset-0-90-hold.aep",
+        "856-shape-trim-end-expression-time50.aep",
+        "857-shape-key-group-scale-100-50-150-linear.aep",
+    ] {
+        let bytes = fixture!(name);
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        effectcraft_aep::import::import(
+            &mut p,
+            &bytes,
+            &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+        )
+        .expect("import");
+        let r = export_all(&p);
+        assert_eq!(r.report.count(LossCategory::ShapeLayers), 0, "{name}: {:?}", r.report.losses);
+        let (a, b) = (keyed_shape_records(&bytes), keyed_shape_records(&r.bytes));
+        assert_eq!(a.len(), 1, "{name}");
+        assert_eq!(a, b, "{name}");
+    }
+}
+
+#[test]
+fn shape_operators_and_keys_built_in_code_come_back() {
+    // Polystar, gradient fill / stroke, trim paths with keys, round corners, merge / offset paths
+    // and a repeater with a transform: exported, imported again, the same values and keys.
+    use effectcraft_keyframe::{Gradient, Keyframe, Value};
+    use effectcraft_project::build;
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "S", LayerSource::Shape, (1920, 1080));
+    let mut next = p.next_id;
+    {
+        let mut ids = build::Ids(&mut next);
+        let rect = build::shape_rect(&mut ids, [400.0, 300.0], [0.0, 0.0], 0.0);
+        let mut star = build::shape_star(&mut ids, true, 7.0, [10.0, 20.0], 120.0, 40.0);
+        star.get_mut("rotation").unwrap().value = Value::Scalar(15.0);
+        let mut gfill = build::shape_gradient_fill(&mut ids, true, [-50.0, 0.0], [60.0, 10.0], Gradient::default());
+        gfill.get_mut("opacity").unwrap().value = Value::Scalar(70.0);
+        let gstroke = build::shape_gradient_stroke(&mut ids, false, [0.0, 0.0], [100.0, 50.0], Gradient::default(), 5.0);
+        let mut trim = build::shape_trim(&mut ids, 10.0, 90.0, 30.0);
+        trim.get_mut("end").unwrap().keys = vec![
+            key(0.0, Value::Scalar(0.0)),
+            Keyframe { out_interp: effectcraft_keyframe::Interp::Hold, ..key(1.0, Value::Scalar(60.0)) },
+            key(1.5, Value::Scalar(100.0)),
+        ];
+        let mut round = build::shape_simple_op(&mut ids, "round").unwrap();
+        round.get_mut("radius").unwrap().value = Value::Scalar(25.0);
+        let mut merge = build::shape_simple_op(&mut ids, "merge").unwrap();
+        merge.get_mut("mode").unwrap().value = Value::Enum(2);
+        let mut offset = build::shape_simple_op(&mut ids, "offset").unwrap();
+        offset.get_mut("amount").unwrap().value = Value::Scalar(-5.0);
+        offset.get_mut("join").unwrap().value = Value::Enum(1);
+        let mut rep = build::shape_repeater(&mut ids, 4.0, [80.0, 0.0]);
+        if let Some(t) = rep.sub_mut("transform") {
+            t.get_mut("rotation").unwrap().value = Value::Scalar(12.0);
+            t.get_mut("endOpacity").unwrap().value = Value::Scalar(30.0);
+            t.get_mut("position").unwrap().keys = vec![key(0.0, Value::Vec2([0.0, 0.0])), key(1.0, Value::Vec2([80.0, 40.0]))];
+        }
+        let mut fill = build::shape_fill(&mut ids, [0.0, 1.0, 0.0, 1.0]);
+        fill.get_mut("color").unwrap().keys = vec![key(0.0, Value::Color([1.0, 0.0, 0.0, 1.0])), key(1.0, Value::Color([0.0, 0.0, 1.0, 1.0]))];
+        let g = build::shape_group(&mut ids, "Group 1", vec![rect, star, gfill, gstroke, trim, round, merge, offset, rep, fill]);
+        with_layer(&mut p, c, 0, |l| l.props.sub_mut("contents").expect("contents").children = vec![g.into()]);
+    }
+    p.next_id = next;
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::ShapeLayers), 0, "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    let mut q = Project::default();
+    let none = |_: &str| false;
+    let back = effectcraft_aep::import::import(
+        &mut q,
+        &r.bytes,
+        &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+    )
+    .expect("import");
+    assert!(back.report.losses.is_empty(), "{:?}", back.report.losses);
+    // Every property of the contents: value and key count (ids differ).
+    let flat = |p: &Project| -> Vec<(String, String, usize)> {
+        let mut out = Vec::new();
+        for item in p.items.values() {
+            let effectcraft_project::ItemKind::Comp(c) = &item.kind else { continue };
+            for l in &c.layers {
+                let Some(contents) = l.props.sub("contents") else { continue };
+                let mut stack = vec![(contents, String::new())];
+                while let Some((g, pre)) = stack.pop() {
+                    for n in &g.children {
+                        match n {
+                            effectcraft_project::Node::Group(s) => stack.push((s, format!("{pre}{}/", s.match_id))),
+                            // A keyed property's static value is its first key's in the file.
+                            effectcraft_project::Node::Prop(pr) => out.push((
+                                format!("{pre}{}", pr.match_id),
+                                if pr.keys.is_empty() {
+                                    format!("{:?}", pr.value)
+                                } else {
+                                    format!("{:?}", pr.keys.iter().map(|k| (k.time, k.value.clone(), k.out_interp)).collect::<Vec<_>>())
+                                },
+                                pr.keys.len(),
+                            )),
+                        }
+                    }
+                }
+            }
+        }
+        out.sort();
+        out
+    };
+    assert_eq!(flat(&p), flat(&q));
+}
+
+#[test]
+fn hostile_shape_keys_never_panic() {
+    use effectcraft_keyframe::Value;
+    use effectcraft_project::build;
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "S", LayerSource::Shape, (640, 360));
+    let mut next = p.next_id;
+    {
+        let mut ids = build::Ids(&mut next);
+        let mut trim = build::shape_trim(&mut ids, 0.0, 100.0, 0.0);
+        trim.get_mut("end").unwrap().keys = (0..20_000).map(|i| key(f64::from(i) * 0.0001, Value::Scalar(f64::from(i)))).collect();
+        trim.get_mut("start").unwrap().keys = vec![key(0.0, Value::Scalar(f64::NAN)), key(-5.0, Value::Bool(true)), key(1e12, Value::Scalar(1.0))];
+        trim.get_mut("mode").unwrap().keys = vec![key(0.0, Value::Enum(1)), key(1.0, Value::Enum(900))];
+        let mut fill = build::shape_fill(&mut ids, [0.0, 1.0, 0.0, 1.0]);
+        fill.get_mut("color").unwrap().keys = vec![key(0.0, Value::Color([f64::INFINITY, 0.0, 0.0, 1.0])), key(0.0, Value::Scalar(3.0))];
+        let g = build::shape_group(&mut ids, "G", vec![trim, fill]);
+        with_layer(&mut p, c, 0, |l| l.props.sub_mut("contents").expect("contents").children = vec![g.into()]);
+    }
+    p.next_id = next;
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    assert!(r.report.count(LossCategory::InvalidValues) >= 1, "{:?}", r.report.losses);
+}
+
+/// A shape colour channel outside 0 to 1 (an over-bright or negative value) is written as the
+/// nearest limit and reported, as for lights; it was written unclamped (review finding). A colour
+/// inside the range stays lossless.
+#[test]
+fn a_shape_colour_outside_the_range_is_clamped_and_reported() {
+    use effectcraft_keyframe::Value;
+    use effectcraft_project::build;
+    let shape = |fill_color: [f64; 4], key_color: Option<[f64; 4]>| {
+        let mut p = Project::default();
+        let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 2.0, None);
+        add_layer(&mut p, c, "S", LayerSource::Shape, (640, 360));
+        let mut next = p.next_id;
+        {
+            let mut ids = build::Ids(&mut next);
+            let rect = build::shape_rect(&mut ids, [100.0, 50.0], [0.0, 0.0], 0.0);
+            let mut fill = build::shape_fill(&mut ids, fill_color);
+            if let Some(k) = key_color {
+                fill.get_mut("color").unwrap().keys = vec![key(0.0, Value::Color([0.0, 0.0, 1.0, 1.0])), key(1.0, Value::Color(k))];
+            }
+            let g = build::shape_group(&mut ids, "G", vec![rect, fill]);
+            with_layer(&mut p, c, 0, |l| l.props.sub_mut("contents").expect("contents").children = vec![g.into()]);
+        }
+        p.next_id = next;
+        p
+    };
+    let strict = |p: &Project| effectcraft_aep::export::export(p, &effectcraft_aep::export::ExportOptions { allow_losses: false }).is_ok();
+    let inside = shape([0.25, 0.5, 1.0, 1.0], None);
+    assert_eq!(export_all(&inside).report.count(LossCategory::ShapeLayers), 0);
+    assert!(strict(&inside));
+    // Keyed in range: the static value (here over-bright) is not written, so nothing is lost.
+    let keyed = shape([2.0, 0.0, 0.0, 1.0], Some([0.5, 0.5, 0.5, 1.0]));
+    assert_eq!(export_all(&keyed).report.count(LossCategory::ShapeLayers), 0, "{:?}", export_all(&keyed).report.losses);
+    assert!(strict(&keyed));
+    for p in [shape([2.0, 0.5, -0.5, 1.0], None), shape([0.0, 1.0, 0.0, 1.0], Some([1.5, 0.0, 0.0, 1.0]))] {
+        let r = export_all(&p);
+        assert_eq!(r.report.count(LossCategory::ShapeLayers), 1, "{:?}", r.report.losses);
+        assert!(!strict(&p));
+        // Every stored colour channel is within 0 to 255.
+        let mut q = Project::default();
+        let none = |_: &str| false;
+        let opts = effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) };
+        effectcraft_aep::import::import(&mut q, &r.bytes, &opts).expect("import");
+        let mut colours = Vec::new();
+        for item in q.items.values() {
+            let effectcraft_project::ItemKind::Comp(c) = &item.kind else { continue };
+            for l in &c.layers {
+                let mut stack: Vec<&effectcraft_project::PropGroup> = l.props.sub("contents").into_iter().collect();
+                while let Some(g) = stack.pop() {
+                    for n in &g.children {
+                        match n {
+                            effectcraft_project::Node::Group(s) => stack.push(s),
+                            effectcraft_project::Node::Prop(pr) => {
+                                for v in std::iter::once(&pr.value).chain(pr.keys.iter().map(|k| &k.value)) {
+                                    if let Value::Color(c) = v {
+                                        colours.push(*c);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        assert!(!colours.is_empty());
+        assert!(colours.iter().all(|c| c.iter().take(3).all(|x| (0.0..=1.0).contains(x))), "{colours:?}");
+    }
+}
+
+/// The Transform group of a camera ends with its Group End: the camera's `ADBE Position_2` record
+/// sorts before it (review finding: an unlisted record used to sort after the end marker).
+#[test]
+fn a_camera_transform_group_ends_with_its_group_end() {
+    use effectcraft_keyframe::Value;
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "Cam", LayerSource::Camera, (1920, 1080));
+    with_props(&mut p, c, 0, &[("transform/position", Value::Vec3([100.0, 200.0, -1000.0]))]);
+    let bytes = export_all(&p).bytes;
+    let file = parse(&bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("camera");
+    let root = layer.chunk().child_list(b"tdgp").expect("tree").children();
+    let name =
+        |c: &effectcraft_aep::Chunk<'_>| String::from_utf8_lossy(c.bytes().unwrap_or_default().split(|b| *b == 0).next().unwrap_or_default()).into_owned();
+    let at = root.iter().position(|c| c.is(b"tdmn") && name(c) == "ADBE Transform Group").expect("transform");
+    let names: Vec<String> = root[at + 1].children().iter().filter(|c| c.is(b"tdmn")).map(name).collect();
+    assert_eq!(names.last().map(String::as_str), Some("ADBE Group End"), "{names:?}");
+    assert!(names.iter().any(|n| n == "ADBE Position_2"));
+}
+
+/// Camera and light options that are not written (the iris, the highlight, the light's radius,
+/// falloff and shadow settings) are reported when they are animated, also while their static value
+/// is the default: keys and expressions change the render, and the export was identical to the
+/// unanimated layer with no loss (review finding). The default layer stays lossless.
+#[test]
+fn animated_camera_and_light_options_that_are_not_written_are_reported() {
+    use effectcraft_project::{Expression, LightKind};
+    let camera_ids = [
+        "irisShape",
+        "irisRotation",
+        "irisRoundness",
+        "irisAspectRatio",
+        "irisDiffractionFringe",
+        "highlightGain",
+        "highlightThreshold",
+        "highlightSaturation",
+    ];
+    let light_ids = ["radius", "falloffDistance", "shadowDarkness", "shadowDiffusion", "falloff", "castsShadows"];
+    let make = |source: LayerSource, path: Option<String>, keyed: bool| {
+        let mut p = Project::default();
+        let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 2.0, None);
+        add_layer(&mut p, c, "L", source, (640, 360));
+        if let Some(path) = path {
+            with_layer(&mut p, c, 0, |l| {
+                let prop = l.props.prop_mut(&path).unwrap_or_else(|| panic!("no {path}"));
+                if keyed {
+                    let v = prop.value.clone();
+                    prop.keys = vec![key(0.0, v.clone()), key(1.0, v)];
+                } else {
+                    prop.expr = Some(Expression { text: "value".into(), enabled: true });
+                }
+            });
+        }
+        p
+    };
+    let strict = |p: &Project| effectcraft_aep::export::export(p, &effectcraft_aep::export::ExportOptions { allow_losses: false }).is_ok();
+    let cam = make(LayerSource::Camera, None, true);
+    assert!(export_all(&cam).report.is_lossless() && strict(&cam));
+    let light = make(LayerSource::Light { kind: LightKind::Spot }, None, true);
+    assert!(export_all(&light).report.is_lossless() && strict(&light));
+    for keyed in [true, false] {
+        for id in camera_ids {
+            let p = make(LayerSource::Camera, Some(format!("cameraOptions/{id}")), keyed);
+            assert_eq!(export_all(&p).report.count(LossCategory::Cameras), 1, "camera {id} keyed {keyed}");
+            assert!(!strict(&p), "camera {id} keyed {keyed}");
+        }
+        for id in light_ids {
+            let p = make(LayerSource::Light { kind: LightKind::Spot }, Some(format!("lightOptions/{id}")), keyed);
+            assert_eq!(export_all(&p).report.count(LossCategory::Lights), 1, "light {id} keyed {keyed}");
+            assert!(!strict(&p), "light {id} keyed {keyed}");
+        }
+    }
+}
diff --git a/crates/aep/tests/it/export/precomp.rs b/crates/aep/tests/it/export/precomp.rs
new file mode 100644
index 000000000..e384bfd1b
--- /dev/null
+++ b/crates/aep/tests/it/export/precomp.rs
@@ -0,0 +1,146 @@
+//! Precomposition layers: a composition shown as a layer of another composition. The exported
+//! bytes are parsed back with `effectcraft-aep` (source id, `idpc` / `idpi`, the Time Remapping
+//! maximum, the anchor unit) and imported again.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{PropNode, parse};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{ItemId, ItemKind, LayerSource, Project};
+use effectcraft_time::FrameRate;
+
+fn reimport(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    import(&mut p, bytes, &opts).expect("import");
+    p
+}
+
+/// `Pre` (640 x 360, 30 fps, 3 s, one solid) shown in `C` with an anchor and a position.
+fn nested() -> (Project, ItemId, ItemId) {
+    let mut p = Project::default();
+    let pre = add_comp(&mut p, "Pre", 640, 360, FrameRate::new(30, 1), 3.0, None);
+    let s = add_solid(&mut p, "S", 640, 360, [0.0, 1.0, 0.0], None);
+    add_layer(&mut p, pre, "S", LayerSource::Solid { item: s }, (640, 360));
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_layer(&mut p, c, "Pre", LayerSource::Comp { item: pre }, (640, 360));
+    with_layer(&mut p, c, 0, |l| {
+        let tr = l.props.sub_mut("transform").expect("transform");
+        tr.get_mut("anchor").expect("anchor").value = Value::Vec3([160.0, 90.0, 0.0]);
+        tr.get_mut("position").expect("position").value = Value::Vec3([300.0, 200.0, 0.0]);
+    });
+    (p, c, pre)
+}
+
+#[test]
+fn a_precomposition_layer_points_at_its_composition() {
+    let (p, _, _) = nested();
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.precomp_layers, 1);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let items = view.all_items();
+    let by_name = |n: &str| items.iter().find(|i| i.display_name().as_deref() == Some(n)).copied().expect(n);
+    let (c, pre) = (by_name("C"), by_name("Pre"));
+    let pre_id = pre.id().expect("id");
+    // C records the composition it uses (idpi, little-endian), idpc byte 0 is 1.
+    assert_eq!(c.used_item_ids(), vec![pre_id]);
+    let idpc = c.chunk().child(b"idpc").and_then(|x| x.bytes()).expect("idpc");
+    assert_eq!(idpc.first(), Some(&1));
+    assert_eq!(pre.used_item_ids(), Vec::<u32>::new());
+    assert_eq!(pre.chunk().child(b"idpc").and_then(|x| x.bytes()).and_then(|b| b.first().copied()), Some(0));
+    let layer = c.comp().expect("comp").layers().next().expect("layer");
+    let h = layer.header().expect("header");
+    assert_eq!(h.source_id, Some(pre_id));
+    assert_eq!(view.layer_source_size(&layer), Some((640, 360)));
+    assert_eq!(layer.name().as_deref(), Some("Pre"));
+    // The anchor is a fraction of the precomposition's size.
+    let tr = layer.properties().and_then(|g| g.get("ADBE Transform Group"));
+    let Some(PropNode::Group(tr)) = tr else { panic!("transform") };
+    let Some(PropNode::Property(a)) = tr.get("ADBE Anchor Point") else { panic!("anchor") };
+    let v = a.static_value().expect("value");
+    assert!((v[0] - 0.25).abs() < 1e-12 && (v[1] - 0.25).abs() < 1e-12, "{v:?}");
+    // The Time Remapping maximum is the precomposition's duration (3 s; 0 on a solid).
+    let tdum_max = |l: &effectcraft_aep::Layer<'_, '_>| -> f64 {
+        let Some(PropNode::Property(tr)) = l.properties().and_then(|g| g.get("ADBE Time Remapping")) else { panic!("time remap") };
+        let b = tr.chunk().child(b"tduM").and_then(|x| x.bytes()).expect("tduM");
+        f64::from_be_bytes(b.get(..8).and_then(|s| s.try_into().ok()).expect("8 bytes"))
+    };
+    assert_eq!(tdum_max(&layer), 3.0);
+    let inner = pre.comp().expect("comp").layers().next().expect("layer");
+    assert_eq!(tdum_max(&inner), 0.0);
+}
+
+#[test]
+fn a_precomposition_survives_import() {
+    let (p, _, _) = nested();
+    let q = reimport(&export_all(&p).bytes);
+    let comp_named = |n: &str| q.items.values().find(|i| i.name == n && matches!(i.kind, ItemKind::Comp(_))).expect(n);
+    let (c, pre) = (comp_named("C"), comp_named("Pre"));
+    let ItemKind::Comp(cc) = &c.kind else { unreachable!() };
+    let ItemKind::Comp(pc) = &pre.kind else { unreachable!() };
+    assert_eq!((pc.width, pc.height, pc.frame_rate), (640, 360, FrameRate::new(30, 1)));
+    let l = cc.layers.first().expect("layer");
+    assert_eq!(l.source, LayerSource::Comp { item: pre.id });
+    let tr = l.transform().expect("transform");
+    assert_eq!(tr.get("anchor").expect("anchor").value.components()[..2], [160.0, 90.0]);
+    assert_eq!(tr.get("position").expect("position").value.components()[..2], [300.0, 200.0]);
+}
+
+#[test]
+fn one_composition_used_twice_is_recorded_once_and_chains_nest() {
+    let mut p = Project::default();
+    let a = add_comp(&mut p, "A", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    let b = add_comp(&mut p, "B", 200, 100, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, b, "A1", LayerSource::Comp { item: a }, (100, 100));
+    add_layer(&mut p, b, "A2", LayerSource::Comp { item: a }, (100, 100));
+    let c = add_comp(&mut p, "C", 400, 300, FrameRate::new(25, 1), 3.0, None);
+    add_layer(&mut p, c, "B", LayerSource::Comp { item: b }, (200, 100));
+    add_layer(&mut p, c, "A", LayerSource::Comp { item: a }, (100, 100));
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.precomp_layers, 4);
+    let file = parse(&r.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let items = view.all_items();
+    let id = |n: &str| items.iter().find(|i| i.display_name().as_deref() == Some(n)).and_then(|i| i.id()).expect(n);
+    let used = |n: &str| items.iter().find(|i| i.display_name().as_deref() == Some(n)).expect(n).used_item_ids();
+    assert_eq!(used("B"), vec![id("A")]);
+    // Ascending ids (601; the order carries no meaning), and idpc counts them.
+    let mut ab = vec![id("A"), id("B")];
+    ab.sort_unstable();
+    assert_eq!(used("C"), ab);
+    let idpc = |n: &str| {
+        items.iter().find(|i| i.display_name().as_deref() == Some(n)).and_then(|i| i.chunk().child(b"idpc")).and_then(|c| c.bytes()).map(|b| b[..4].to_vec())
+    };
+    assert_eq!(idpc("C"), Some(vec![2, 0, 0, 0]));
+    assert_eq!(idpc("B"), Some(vec![1, 0, 0, 0]));
+    assert!(used("A").is_empty());
+    let q = reimport(&r.bytes);
+    let n = q.items.values().filter_map(|i| if let ItemKind::Comp(c) = &i.kind { Some(c.layers.len()) } else { None }).sum::<usize>();
+    assert_eq!(n, 4);
+}
+
+#[test]
+fn a_loop_of_precompositions_is_reported_not_written() {
+    let mut p = Project::default();
+    let a = add_comp(&mut p, "A", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    let b = add_comp(&mut p, "B", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    add_layer(&mut p, a, "self", LayerSource::Comp { item: a }, (100, 100));
+    add_layer(&mut p, a, "B", LayerSource::Comp { item: b }, (100, 100));
+    add_layer(&mut p, b, "A", LayerSource::Comp { item: a }, (100, 100));
+    // A missing composition.
+    add_layer(&mut p, b, "gone", LayerSource::Comp { item: ItemId(999_999) }, (100, 100));
+    // C uses A without a loop through C.
+    let c = add_comp(&mut p, "C", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    add_layer(&mut p, c, "A", LayerSource::Comp { item: a }, (100, 100));
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::UnsupportedLayers), 4, "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.precomp_layers, 1);
+    // What was written still parses and imports.
+    let q = reimport(&r.bytes);
+    assert!(q.items.values().any(|i| i.name == "A"));
+}
diff --git a/crates/aep/tests/it/export/remap.rs b/crates/aep/tests/it/export/remap.rs
new file mode 100644
index 000000000..f5313c26c
--- /dev/null
+++ b/crates/aep/tests/it/export/remap.rs
@@ -0,0 +1,186 @@
+//! Time Remapping: the fixtures with an enabled remap (319 on a precomposition layer, 354 on an
+//! image-sequence layer) go through import, export and parse, and the remap record equals the one
+//! After Effects wrote; remaps built in code (hold, reverse, bezier, an expression, no keys) are
+//! written and imported back; what cannot be remapped is reported; hostile remaps never panic.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{Body, Chunk, parse};
+use effectcraft_keyframe::{Ease, Interp, Keyframe, Value};
+use effectcraft_project::{Expression, ItemKind, LayerSource, Project, Property};
+use effectcraft_time::FrameRate;
+
+fn reimport(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    import(&mut p, bytes, &opts).expect("import");
+    p
+}
+
+/// The enabled (`tdsb` 1) `ADBE Time Remapping` records of a file.
+fn enabled_remaps(bytes: &[u8]) -> Vec<Chunk<'static>> {
+    fn walk(cs: &[Chunk<'_>], out: &mut Vec<Chunk<'static>>) {
+        for (i, c) in cs.iter().enumerate() {
+            if c.is(b"tdmn")
+                && matches!(&c.body, Body::Data(d) if d.starts_with(b"ADBE Time Remapping\0"))
+                && let Some(rec) = cs.get(i + 1)
+                && rec.children().iter().any(|k| k.is(b"tdsb") && matches!(&k.body, Body::Data(d) if d.as_ref() == [0, 0, 0, 1]))
+            {
+                out.push(rec.clone().into_owned());
+            }
+            walk(c.children(), out);
+        }
+    }
+    let f = parse(bytes).expect("parse");
+    let mut out = Vec::new();
+    walk(&f.chunks, &mut out);
+    out
+}
+
+fn remap_of(p: &Project) -> Vec<Property> {
+    let mut v = Vec::new();
+    for item in p.items.values() {
+        let ItemKind::Comp(c) = &item.kind else { continue };
+        for l in &c.layers {
+            if let Some(r) = l.props.prop("timeRemap") {
+                v.push(Property { uid: 0, ..r.clone() });
+            }
+        }
+    }
+    v
+}
+
+#[test]
+fn the_remap_fixtures_are_written_as_after_effects_wrote_them() {
+    for name in ["319-precomp-timeremap.aep", "354-footage-pngseq-timeremap.aep"] {
+        let bytes = fixture!(name);
+        let p1 = reimport(&bytes);
+        assert_eq!(remap_of(&p1).len(), 1, "{name}");
+        let r = export_all(&p1);
+        assert_eq!(r.report.count(LossCategory::TimeRemapping), 0, "{name}: {:?}", r.report.losses);
+        assert_eq!(r.report.exported.time_remaps, 1, "{name}");
+        let (a, b) = (enabled_remaps(&bytes), enabled_remaps(&r.bytes));
+        assert_eq!(a.len(), 1, "{name}");
+        // In the bytes the exporter writes (`decoded`).
+        let d = |v: &[effectcraft_aep::Chunk<'static>]| v.iter().map(crate::export::helpers::decoded).collect::<Vec<_>>();
+        assert_eq!(d(&a), d(&b), "{name}: the remap record differs from After Effects'");
+        let p2 = reimport(&r.bytes);
+        assert_eq!(remap_of(&p1), remap_of(&p2), "{name}");
+    }
+}
+
+/// A 25 fps comp `C` showing a 3 s precomposition `P` (a red solid) as layer 0, with `remap`
+/// as the layer's `timeRemap` property.
+fn remapped(remap: Property) -> Project {
+    let mut p = Project::default();
+    let pre = add_comp(&mut p, "P", 640, 360, FrameRate::new(25, 1), 3.0, None);
+    let s = add_solid(&mut p, "S", 640, 360, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, pre, "S", LayerSource::Solid { item: s }, (640, 360));
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_layer(&mut p, c, "P", LayerSource::Comp { item: pre }, (640, 360));
+    with_layer(&mut p, c, 0, |l| l.props.children.insert(0, remap.into()));
+    p
+}
+
+fn remap_prop(keys: Vec<Keyframe>) -> Property {
+    let mut r = Property::new(9_000, "timeRemap", "Time Remap", Value::Scalar(0.0));
+    r.keys = keys;
+    r
+}
+
+#[test]
+fn remaps_built_in_code_come_back() {
+    let k = |t: f64, v: f64| key(t, Value::Scalar(v));
+    let hold = Keyframe { out_interp: Interp::Hold, ..k(1.0, 2.0) };
+    let ease = Keyframe {
+        in_interp: Interp::Bezier,
+        out_interp: Interp::Bezier,
+        in_ease: vec![Ease { speed: 0.5, influence: 0.4 }],
+        out_ease: vec![Ease { speed: 1.5, influence: 0.25 }],
+        label: 3,
+        ..k(2.0, 1.0)
+    };
+    let cases: Vec<(&str, Property)> = vec![
+        ("reverse", remap_prop(vec![k(0.0, 3.0), k(3.0, 0.0)])),
+        ("hold and ease", remap_prop(vec![k(0.0, 0.0), hold, ease, k(4.96, 2.96)])),
+        ("expression", {
+            let mut r = remap_prop(vec![k(0.0, 0.0), k(3.0, 3.0)]);
+            r.expr = Some(Expression { text: "time * 0.5".into(), enabled: true });
+            r
+        }),
+        ("static", Property { value: Value::Scalar(1.2), ..remap_prop(Vec::new()) }),
+    ];
+    for (name, prop) in cases {
+        let p1 = remapped(prop.clone());
+        let r = export_all(&p1);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        assert_eq!(r.report.exported.time_remaps, 1, "{name}");
+        let file = parse(&r.bytes).expect("parse");
+        assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes, "{name}");
+        let back = remap_of(&reimport(&r.bytes));
+        assert_eq!(back.len(), 1, "{name}");
+        let got = &back[0];
+        if prop.keys.is_empty() {
+            // Written as one key holding the value (a keyless remap reads back off in After
+            // Effects, r1).
+            assert_eq!(got.keys.len(), 1, "{name}");
+            assert_eq!(got.keys[0].value, prop.value, "{name}");
+            continue;
+        }
+        assert_eq!(got.keys.len(), prop.keys.len(), "{name}");
+        for (a, b) in got.keys.iter().zip(&prop.keys) {
+            assert_eq!((a.time, a.in_interp, a.out_interp, a.label), (b.time, b.in_interp, b.out_interp, b.label), "{name}");
+            assert_eq!(a.value, b.value, "{name}");
+            if b.in_interp == Interp::Bezier {
+                assert_eq!(a.in_ease, b.in_ease, "{name}");
+                assert_eq!(a.out_ease, b.out_ease, "{name}");
+            }
+        }
+        assert_eq!(got.expr.as_ref().map(|e| (&e.text, e.enabled)), prop.expr.as_ref().map(|e| (&e.text, e.enabled)), "{name}");
+    }
+}
+
+#[test]
+fn a_remapped_layer_may_run_past_its_source() {
+    // A remap holding the last frame: the layer runs 5 s over a 3 s source without a timing loss.
+    let mut p = remapped(remap_prop(vec![key(0.0, Value::Scalar(0.0)), key(3.0, Value::Scalar(3.0))]));
+    let c = p.comps().find(|(_, c)| c.width == 1920).map(|(id, _)| *id).unwrap();
+    with_layer(&mut p, c, 0, |l| {
+        l.out_point = secs(5.0);
+    });
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::LayerTiming), 0, "{:?}", r.report.losses);
+}
+
+#[test]
+fn a_remap_where_after_effects_has_none_is_reported() {
+    // A solid cannot be remapped in After Effects (319): reported, not written.
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    let s = add_solid(&mut p, "S", 100, 100, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, c, "S", LayerSource::Solid { item: s }, (100, 100));
+    with_layer(&mut p, c, 0, |l| l.props.children.insert(0, remap_prop(vec![key(0.0, Value::Scalar(0.0))]).into()));
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::TimeRemapping), 1, "{:?}", r.report.losses);
+    assert!(enabled_remaps(&r.bytes).is_empty());
+}
+
+#[test]
+fn hostile_remaps_never_panic() {
+    let many: Vec<Keyframe> = (0..20_000).map(|i| key(f64::from(i) * 0.000_2, Value::Scalar(f64::from(i)))).collect();
+    let cases = vec![
+        remap_prop(vec![key(0.0, Value::Scalar(f64::NAN)), key(1.0, Value::Scalar(f64::INFINITY))]),
+        remap_prop(vec![key(-10.0, Value::Scalar(1e300)), key(1e9, Value::Scalar(-1e300))]),
+        remap_prop(vec![key(1.0, Value::Vec3([1.0, 2.0, 3.0])), key(1.0, Value::Bool(true))]),
+        remap_prop(many),
+        Property { value: Value::Scalar(f64::NAN), ..remap_prop(Vec::new()) },
+    ];
+    for prop in cases {
+        let r = export_all(&remapped(prop));
+        let file = parse(&r.bytes).expect("parse");
+        assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+        let _ = reimport(&r.bytes);
+    }
+}
diff --git a/crates/aep/tests/it/export/repairs.rs b/crates/aep/tests/it/export/repairs.rs
new file mode 100644
index 000000000..73b5c369c
--- /dev/null
+++ b/crates/aep/tests/it/export/repairs.rs
@@ -0,0 +1,430 @@
+//! Values the export cannot write as they are (clamped, rounded, replaced or left out) are
+//! reported, and a strict export refuses before writing anything. Every project is built in code,
+//! so these run without the corpus.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::{AepExportError, ExportOptions, LossCategory, analyze, export};
+use effectcraft_color::Label;
+use effectcraft_keyframe::text_doc::{CharStyle, StyleRun, TextDoc};
+use effectcraft_keyframe::{Ease, Interp, Value};
+use effectcraft_project::{AutoOrient, Footage, FootageKind, ItemKind, Layer, LayerSource, LightKind, Marker, Node, Project, PropGroup, Proxy, build};
+use effectcraft_time::FrameRate;
+
+/// `p` reports a loss in `category` whose detail contains `needle`, and a strict export refuses.
+#[track_caller]
+fn reported(p: &Project, category: LossCategory, needle: &str) {
+    let r = analyze(p);
+    let hit = r.losses.iter().any(|l| l.category == category && l.details.iter().any(|d| d.contains(needle)));
+    assert!(hit, "no {category:?} loss with '{needle}': {:?}", r.losses);
+    assert!(matches!(export(p, &ExportOptions { allow_losses: false }), Err(AepExportError::Refused(_))));
+}
+
+#[track_caller]
+fn lossless(p: &Project) {
+    let r = analyze(p);
+    assert!(r.is_lossless(), "{:?}", r.losses);
+}
+
+fn first_layer(p: &mut Project, c: effectcraft_project::ItemId, f: impl FnOnce(&mut Layer)) {
+    with_layer(p, c, 0, f);
+}
+
+#[test]
+fn composition_settings_the_format_cannot_hold_are_reported() {
+    let (p, c, _) = simple();
+    lossless(&p);
+    // A duration that is not a whole number of frames (the rate changed afterwards).
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| comp.duration = secs(5.01));
+    reported(&q, LossCategory::RoundedTimes, "duration moved to whole frames");
+    // Shutter angle and phase are whole degrees.
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| comp.shutter_angle = 180.5);
+    reported(&q, LossCategory::CompositionSettings, "shutter angle 180.5");
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| comp.shutter_phase = -12.25);
+    reported(&q, LossCategory::CompositionSettings, "shutter phase -12.25");
+    // The background has 8 bits per channel: the nearest level is written, a channel outside
+    // 0 to 1 is reported.
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| comp.background = [0.5, 0.0, 1.0]);
+    lossless(&q);
+    with_comp(&mut q, c, |comp| comp.background = [1.5, 0.0, 1.0]);
+    reported(&q, LossCategory::CompositionSettings, "background channel 1.5");
+    // The start timecode is a whole, non-negative number of frames.
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| comp.display_start = secs(-2.0));
+    reported(&q, LossCategory::CompositionSettings, "start timecode");
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| comp.display_start = secs(1.0 + 1.0 / 51_200.0));
+    reported(&q, LossCategory::CompositionSettings, "start timecode");
+    // A pixel aspect without a small exact fraction.
+    let mut q = p;
+    with_comp(&mut q, c, |comp| comp.pixel_aspect = 1.0926);
+    reported(&q, LossCategory::CompositionSettings, "pixel aspect 1.0926");
+}
+
+#[test]
+fn solid_values_the_format_cannot_hold_are_reported() {
+    let (p, _, s) = simple();
+    let set = |f: &dyn Fn(&mut effectcraft_project::Solid)| {
+        let mut q = p.clone();
+        if let Some(ItemKind::Solid(solid)) = q.item_mut(s).map(|i| &mut i.kind) {
+            f(solid);
+        }
+        q
+    };
+    reported(&set(&|s| s.color = [1.5, 0.0, 0.0]), LossCategory::InvalidValues, "colour channel 1.5");
+    reported(&set(&|s| s.pixel_aspect = 2.0), LossCategory::FootageItems, "pixel aspect 2");
+}
+
+#[test]
+fn items_lose_their_comment_proxy_and_footage_markers_with_a_report() {
+    let (p, c, s) = simple();
+    let mut q = p.clone();
+    if let Some(i) = q.item_mut(c) {
+        i.comment = "a note".into();
+    }
+    reported(&q, LossCategory::Names, "item comment");
+    let still = Footage { path: "C:/x/a.png".into(), kind: FootageKind::Still, width: 64, height: 64, has_video: true, ..Footage::default() };
+    let mut q = p.clone();
+    if let Some(i) = q.item_mut(s) {
+        i.proxy = Some(Box::new(Proxy { footage: still.clone(), enabled: true }));
+    }
+    reported(&q, LossCategory::FootageItems, "proxy");
+    let mut q = p;
+    let marked = Footage { markers: vec![Marker { time: secs(0.5), ..Marker::default() }], ..still };
+    q.add_item("a.png", Label::None, None, ItemKind::Footage(marked));
+    reported(&q, LossCategory::Markers, "footage marker");
+}
+
+#[test]
+fn key_settings_the_export_does_not_keep_are_reported() {
+    let (mut p, c, _) = simple();
+    first_layer(&mut p, c, |l| {
+        let o = l.props.prop_mut("transform/opacity").expect("opacity");
+        o.keys = vec![key(0.0, Value::Scalar(0.0)), key(1.0, Value::Scalar(50.0)), key(2.0, Value::Scalar(100.0))];
+    });
+    lossless(&p);
+    let keyed = |f: &dyn Fn(&mut effectcraft_keyframe::Keyframe)| {
+        let mut q = p.clone();
+        first_layer(&mut q, c, |l| {
+            if let Some(k) = l.props.prop_mut("transform/opacity").and_then(|o| o.keys.get_mut(1)) {
+                f(k);
+            }
+        });
+        q
+    };
+    reported(&keyed(&|k| k.muted = true), LossCategory::ApproximatedKeyframes, "muted key");
+    reported(
+        &keyed(&|k| {
+            k.in_interp = Interp::Bezier;
+            k.out_interp = Interp::Bezier;
+            k.auto_bezier = true;
+        }),
+        LossCategory::ApproximatedKeyframes,
+        "auto-Bezier",
+    );
+    reported(
+        &keyed(&|k| {
+            k.out_interp = Interp::Bezier;
+            k.out_ease = vec![Ease { speed: 1e12, influence: 0.5 }];
+        }),
+        LossCategory::InvalidValues,
+        "key speed",
+    );
+}
+
+#[test]
+fn a_time_stretch_that_moves_a_layer_end_is_reported() {
+    let (mut p, c, _) = simple();
+    first_layer(&mut p, c, |l| {
+        l.stretch = 150.0;
+        l.start_time = secs(0.4);
+        l.in_point = secs(0.0);
+    });
+    reported(&p, LossCategory::RoundedTimes, "after the time stretch");
+}
+
+fn text_doc(f: impl FnOnce(&mut CharStyle)) -> TextDoc {
+    let mut d = TextDoc::plain("Text");
+    let mut style = CharStyle { font: "ArialMT".into(), style: "Regular".into(), size: 50.0, leading: Some(60.0), ..CharStyle::default() };
+    f(&mut style);
+    d.set_runs(vec![StyleRun { len: 4, style }]);
+    d
+}
+
+fn text_project(doc: TextDoc) -> Project {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_layer(&mut p, c, "T", LayerSource::Text, (1920, 1080));
+    first_layer(&mut p, c, |l| {
+        if let Some(st) = l.props.prop_mut("text/sourceText") {
+            st.value = Value::Text(Box::new(doc));
+        }
+    });
+    p
+}
+
+#[test]
+fn text_values_the_document_cannot_hold_are_reported() {
+    lossless(&text_project(text_doc(|_| {})));
+    reported(&text_project(text_doc(|s| s.fill = [2.0, 0.0, 0.0, 1.0])), LossCategory::TextLayers, "fill colour channel 2");
+    reported(&text_project(text_doc(|s| s.fill = [1.0, 0.0, 0.0, 0.5])), LossCategory::TextLayers, "fill colour opacity 0.5");
+    reported(&text_project(text_doc(|s| s.tracking = 200_000.0)), LossCategory::TextLayers, "tracking 200000");
+    reported(&text_project(text_doc(|s| s.baseline_shift = -2e5)), LossCategory::TextLayers, "baseline shift");
+    reported(&text_project(text_doc(|s| s.font = String::new())), LossCategory::TextLayers, "without a font name");
+    let mut boxed = text_doc(|_| {});
+    boxed.box_size = Some([2e6, 100.0]);
+    reported(&text_project(boxed), LossCategory::TextLayers, "box width");
+}
+
+#[test]
+fn a_switched_off_range_selector_is_reported() {
+    let mut p = text_project(text_doc(|_| {}));
+    let c = p.comps().next().map(|(id, _)| *id).expect("comp");
+    let mut next = p.next_id;
+    let mut animator = build::text_animator(&mut build::Ids(&mut next), "Animator 1", Vec::new());
+    p.next_id = next;
+    first_layer(&mut p, c, |l| {
+        if let Some(Node::Group(sel)) = animator.sub_mut("selectors").and_then(|s| s.children.first_mut()) {
+            sel.enabled = false;
+        }
+        l.props.sub_mut("text").and_then(|t| t.sub_mut("animators")).expect("animators").children.push(animator.into());
+    });
+    reported(&p, LossCategory::TextLayers, "switched-off selector");
+}
+
+#[test]
+fn camera_and_light_options_that_are_not_written_are_reported() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_layer(&mut p, c, "Cam", LayerSource::Camera, (1920, 1080));
+    let mut q = p.clone();
+    first_layer(&mut q, c, |l| l.auto_orient = AutoOrient::AlongPath);
+    reported(&q, LossCategory::Cameras, "Auto-Orient");
+
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_layer(&mut p, c, "Spot", LayerSource::Light { kind: LightKind::Spot }, (1920, 1080));
+    let mut q = p.clone();
+    first_layer(&mut q, c, |l| l.auto_orient = AutoOrient::Off);
+    reported(&q, LossCategory::Lights, "Auto-Orient");
+    let mut q = p;
+    first_layer(&mut q, c, |l| {
+        if let Some(col) = l.props.prop_mut("lightOptions/color") {
+            col.value = Value::Color([2.0, 0.5, 0.5, 1.0]);
+        }
+    });
+    reported(&q, LossCategory::Lights, "light colour channel");
+}
+
+/// `simple()` with a new instance of the effect `id` on its layer, changed by `f`.
+fn with_effect(id: &str, f: impl FnOnce(&mut PropGroup)) -> Project {
+    let (mut p, c, _) = simple();
+    let spec = effectcraft_effects::find(id).expect(id);
+    let mut next = p.next_id;
+    let mut g = effectcraft_effects::instantiate(spec, &mut build::Ids(&mut next), spec.name, [1920.0, 1080.0]);
+    p.next_id = next;
+    f(&mut g);
+    first_layer(&mut p, c, |l| l.props.sub_mut("effects").expect("effects").children.push(Node::Group(g)));
+    p
+}
+
+fn set(g: &mut PropGroup, path: &str, v: Value) {
+    g.prop_mut(path).unwrap_or_else(|| panic!("{path}")).value = v;
+}
+
+#[test]
+fn effect_values_the_format_cannot_hold_are_reported() {
+    lossless(&with_effect("ec.color.tint", |_| {}));
+    reported(&with_effect("ec.color.tint", |g| set(g, "white", Value::Color([1.5, 0.0, 0.0, 1.0]))), LossCategory::InvalidValues, "colour channel");
+    reported(&with_effect("ec.blur.fastbox", |g| set(g, "iterations", Value::Scalar(2.5))), LossCategory::Effects, "whole number");
+    reported(&with_effect("ec.color.tint", |g| g.label = Some(Label::Red)), LossCategory::Effects, "label colour");
+    // After Effects' colour parameters have no opacity; Drop Shadow uses EffectCraft's.
+    reported(&with_effect("ec.perspective.dropshadow", |g| set(g, "color", Value::Color([0.0, 0.0, 0.0, 0.5]))), LossCategory::Effects, "opacity");
+    // A parameter the table has no record for, at a value other than a new instance's.
+    lossless(&with_effect("ec.time.timewarp", |_| {}));
+    reported(&with_effect("ec.time.timewarp", |g| set(g, "tuning/vectorDetail", Value::Scalar(50.0))), LossCategory::Effects, "Vector Detail");
+    // Curves points outside 0..1.
+    reported(&with_effect("ec.color.curves", |g| set(g, "rgb", Value::Str("0,0;1.2,1".into()))), LossCategory::Effects, "outside 0 to 1");
+}
+
+#[test]
+fn per_corner_roundness_is_reported() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "S", LayerSource::Shape, (1920, 1080));
+    let mut next = p.next_id;
+    let mut ids = build::Ids(&mut next);
+    let mut rect = build::shape_rect(&mut ids, [400.0, 300.0], [0.0, 0.0], 15.0);
+    set(&mut rect, "perCorner", Value::Bool(true));
+    let fill = build::shape_fill(&mut ids, [0.0, 1.0, 0.0, 1.0]);
+    let group = build::shape_group(&mut ids, "Group 1", vec![rect, fill]);
+    p.next_id = next;
+    first_layer(&mut p, c, |l| l.props.sub_mut("contents").expect("contents").children.push(group.into()));
+    reported(&p, LossCategory::ShapeLayers, "per-corner roundness");
+}
+
+#[test]
+fn footage_interpretation_and_durations_that_are_not_written_are_reported() {
+    let still = Footage { path: "C:/x/a.png".into(), kind: FootageKind::Still, width: 64, height: 64, has_video: true, ..Footage::default() };
+    let with = |f: Footage| {
+        let (mut p, _, _) = simple();
+        p.add_item("a", Label::None, None, ItemKind::Footage(f));
+        p
+    };
+    lossless(&with(still.clone()));
+    reported(&with(Footage { alpha: effectcraft_project::AlphaMode::Premultiplied, ..still.clone() }), LossCategory::FootageItems, "alpha interpretation");
+    reported(&with(Footage { pixel_aspect: 2.0, ..still.clone() }), LossCategory::FootageItems, "pixel aspect");
+    reported(&with(Footage { loop_count: 3, ..still.clone() }), LossCategory::FootageItems, "loop count");
+    let clip = Footage { path: "C:/x/a.mp4".into(), kind: FootageKind::Video, frame_rate: FrameRate::new(25, 1), duration: secs(0.0), ..still };
+    reported(&with(clip), LossCategory::FootageItems, "written as 1 frame");
+}
+
+#[test]
+fn mask_values_beyond_the_record_limits_are_reported() {
+    let (mut p, c, _) = simple();
+    let mut next = p.next_id;
+    let mut g = build::mask(
+        &mut build::Ids(&mut next),
+        "Mask 1",
+        effectcraft_keyframe::ShapePath::rect([960.0, 540.0], 400.0, 200.0),
+        effectcraft_project::MaskMode::Add,
+        build::MASK_COLORS[0],
+    );
+    p.next_id = next;
+    set(&mut g, "feather", Value::Vec2([40_000.0, 10.0]));
+    let mut q = p.clone();
+    let h = g.clone();
+    first_layer(&mut q, c, |l| l.props.sub_mut("masks").expect("masks").children.push(h.into()));
+    reported(&q, LossCategory::InvalidValues, "feather");
+    set(&mut g, "feather", Value::Vec2([10.0, 10.0]));
+    set(&mut g, "expansion", Value::Scalar(-50_000.0));
+    first_layer(&mut p, c, |l| l.props.sub_mut("masks").expect("masks").children.push(g.into()));
+    reported(&p, LossCategory::InvalidValues, "Mask expansion");
+}
+
+#[test]
+fn camera_options_stretch_curves_and_expressions_that_change_are_reported() {
+    // A camera option that is not a number.
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    add_layer(&mut p, c, "Cam", LayerSource::Camera, (1920, 1080));
+    first_layer(&mut p, c, |l| {
+        if let Some(z) = l.props.prop_mut("cameraOptions/zoom") {
+            z.value = Value::Bool(true);
+        }
+    });
+    reported(&p, LossCategory::InvalidValues, "cameraOptions/zoom");
+    // A stretch that is not a number is reported, not taken as 100 %.
+    let (mut p, c, _) = simple();
+    first_layer(&mut p, c, |l| l.stretch = f64::NAN);
+    reported(&p, LossCategory::TimeStretch, "");
+    // A curve that is not text.
+    reported(&with_effect("ec.color.curves", |g| set(g, "rgb", Value::Scalar(1.0))), LossCategory::InvalidValues, "not text");
+    // An expression on a popup whose items are After Effects' in another order (Invert's
+    // channels: After Effects counts its separators, EffectCraft has none).
+    let p = with_effect("ec.channel.invert", |g| {
+        g.prop_mut("channel").expect("channel").expr = Some(effectcraft_project::Expression { text: "6".into(), enabled: true });
+    });
+    reported(&p, LossCategory::Expressions, "other units");
+}
+
+/// A 3D layer's Material Options are not written: a value other than a new layer's, a key or an
+/// expression is reported (one loss each), and a strict export refuses (review finding: changed
+/// options were dropped without a report). The defaults, and any value on a 2D layer (where they
+/// do nothing), stay lossless.
+#[test]
+fn changed_material_options_of_a_3d_layer_are_reported() {
+    let three_d = |f: &dyn Fn(&mut PropGroup)| {
+        let (mut p, c, _) = simple();
+        first_layer(&mut p, c, |l| {
+            l.switches.three_d = true;
+            f(l.props.sub_mut("materialOptions").expect("material options"));
+        });
+        p
+    };
+    lossless(&three_d(&|_| {}));
+    for (name, change) in [
+        ("Accepts Lights", &(|g: &mut PropGroup| set(g, "acceptsLights", Value::Bool(false))) as &dyn Fn(&mut PropGroup)),
+        ("Casts Shadows", &|g: &mut PropGroup| set(g, "castsShadows", Value::Enum(1))),
+        ("Diffuse", &|g: &mut PropGroup| g.prop_mut("diffuse").expect("diffuse").keys = vec![key(0.0, Value::Scalar(50.0)), key(1.0, Value::Scalar(80.0))]),
+        ("Ambient", &|g: &mut PropGroup| {
+            g.prop_mut("ambient").expect("ambient").expr = Some(effectcraft_project::Expression { text: "100".into(), enabled: true })
+        }),
+    ] {
+        let p = three_d(change);
+        reported(&p, LossCategory::ThreeD, &format!("material option {name}"));
+        assert_eq!(analyze(&p).count(LossCategory::ThreeD), 1, "{name}");
+    }
+    let (mut flat, c, _) = simple();
+    first_layer(&mut flat, c, |l| set(l.props.sub_mut("materialOptions").expect("material options"), "acceptsLights", Value::Bool(false)));
+    lossless(&flat);
+}
+
+/// A popup expression is written as it is: both programs count popup items from 1, so where the
+/// items are the same in the same order (Fast Box Blur's Blur Dimensions) its result picks the
+/// same item, and nothing is reported (review finding: every popup expression was reported).
+#[test]
+fn a_popup_expression_with_the_same_items_is_not_a_loss() {
+    let p = with_effect("ec.blur.fastbox", |g| {
+        g.prop_mut("dimensions").expect("dimensions").expr = Some(effectcraft_project::Expression { text: "1".into(), enabled: true });
+    });
+    let r = effectcraft_aep::export::export(&p, &effectcraft_aep::export::ExportOptions { allow_losses: true }).expect("export");
+    assert_eq!(r.report.count(LossCategory::Expressions), 0, "{:?}", r.report.losses);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert!(effectcraft_aep::export::export(&p, &effectcraft_aep::export::ExportOptions { allow_losses: false }).is_ok());
+    assert_eq!(r.report.exported.expressions, 1);
+}
+
+#[test]
+fn a_repeaters_order_is_written_not_reported() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 2.0, None);
+    add_layer(&mut p, c, "S", LayerSource::Shape, (1920, 1080));
+    let mut next = p.next_id;
+    let mut ids = build::Ids(&mut next);
+    let rect = build::shape_rect(&mut ids, [100.0, 100.0], [0.0, 0.0], 0.0);
+    let fill = build::shape_fill(&mut ids, [0.0, 1.0, 0.0, 1.0]);
+    let mut rep = build::shape_repeater(&mut ids, 3.0, [120.0, 0.0]);
+    set(&mut rep, "composite", Value::Enum(1));
+    let group = build::shape_group(&mut ids, "Group 1", vec![rect, fill, rep]);
+    p.next_id = next;
+    first_layer(&mut p, c, |l| l.props.sub_mut("contents").expect("contents").children.push(group.into()));
+    lossless(&p);
+}
+
+#[test]
+fn composition_options_and_the_render_queue_that_are_not_written_are_reported() {
+    // The base writes these at After Effects' defaults (cdta 196 and 200 hold 128 and 16 in every
+    // sample, the switches are not decoded) and writes an empty render queue: each non-default
+    // value is reported, and a strict export refuses.
+    let (p, c, _) = simple();
+    lossless(&p);
+    let cases: [(&dyn Fn(&mut effectcraft_project::Comp), &str); 4] = [
+        (&|comp| comp.preserve_frame_rate = true, "Preserve Frame Rate"),
+        (&|comp| comp.preserve_resolution = true, "Preserve Resolution"),
+        (&|comp| comp.motion_blur_samples = 32, "motion blur samples per frame"),
+        (&|comp| comp.motion_blur_adaptive_limit = 256, "adaptive sample limit"),
+    ];
+    for (set, needle) in cases {
+        let mut q = p.clone();
+        with_comp(&mut q, c, set);
+        reported(&q, LossCategory::CompositionOptions, needle);
+        assert_eq!(analyze(&q).count(LossCategory::CompositionOptions), 1, "{needle}");
+    }
+    // Viewer state is a listed limitation, not a loss (the Home templates set a poster time).
+    let mut q = p.clone();
+    with_comp(&mut q, c, |comp| {
+        comp.hide_shy = true;
+        comp.draft_3d = true;
+        comp.poster_time = secs(1.5);
+        comp.resolution = effectcraft_project::Resolution::Half;
+    });
+    lossless(&q);
+    // A render queue item is not written.
+    let mut q = p;
+    q.render_queue.push(effectcraft_project::render_queue::RenderQueueItem::new(1, c));
+    reported(&q, LossCategory::RenderQueue, "render queue item of 'C'");
+}
diff --git a/crates/aep/tests/it/export/robustness.rs b/crates/aep/tests/it/export/robustness.rs
new file mode 100644
index 000000000..7db1186da
--- /dev/null
+++ b/crates/aep/tests/it/export/robustness.rs
@@ -0,0 +1,164 @@
+//! Odd projects never panic and always produce a container that parses and writes back.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::{ExportOptions, LossCategory, export};
+use effectcraft_aep::{parse, write};
+use effectcraft_color::Label;
+use effectcraft_keyframe::{Ease, Interp, Value};
+use effectcraft_project::{ItemKind, LayerSource, Project};
+use effectcraft_time::{FrameRate, Tick};
+
+fn check(p: &Project) -> effectcraft_aep::export::ExportResult {
+    let r = export(p, &ExportOptions { allow_losses: true }).expect("export");
+    let f = parse(&r.bytes).expect("parse");
+    assert_eq!(write(&f).expect("write"), r.bytes);
+    r
+}
+
+#[test]
+fn empty_project_and_empty_names() {
+    let p = Project::default();
+    let r = check(&p);
+    assert!(r.report.is_lossless());
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "", 100, 100, FrameRate::new(25, 1), 1.0, None);
+    let s = add_solid(&mut p, "", 10, 10, [0.0; 3], None);
+    add_layer(&mut p, c, "", LayerSource::Solid { item: s }, (10, 10));
+    let f = p.add_item("", Label::None, None, ItemKind::Folder);
+    add_comp(&mut p, "x", 10, 10, FrameRate::new(25, 1), 1.0, Some(f));
+    check(&p);
+}
+
+#[test]
+fn huge_zero_and_negative_sizes_and_durations() {
+    let mut p = Project::default();
+    for (w, h) in [(0, 0), (1, 1), (30_000, 30_000), (u32::MAX, u32::MAX), (65_536, 3)] {
+        let c = add_comp(&mut p, "c", w, h, FrameRate::new(25, 1), 1.0, None);
+        let s = add_solid(&mut p, "s", w, h, [2.0, -1.0, f32::NAN], None);
+        add_layer(&mut p, c, "l", LayerSource::Solid { item: s }, (w, h));
+    }
+    for dur in [0.0, -5.0, 1e9, 1e-9] {
+        add_comp(&mut p, "d", 100, 100, FrameRate::new(25, 1), dur, None);
+    }
+    let r = check(&p);
+    assert!(r.report.count(LossCategory::CompositionSettings) >= 1);
+}
+
+#[test]
+fn strange_frame_rates() {
+    let mut p = Project::default();
+    for (n, d) in [(0, 1), (1, 0), (-25, 1), (7, 3), (i64::MAX, 1), (1, i64::MAX), (25, 1), (1000, 1), (24_000, 1001)] {
+        let rate = FrameRate { num: n, den: d };
+        let mut c = effectcraft_project::Comp::new(100, 100, FrameRate::new(25, 1), Tick(254_016_000_000));
+        c.frame_rate = rate;
+        p.add_item("r", Label::None, None, ItemKind::Comp(std::sync::Arc::new(c)));
+    }
+    check(&p);
+}
+
+#[test]
+fn non_finite_and_huge_values_are_written_as_defaults() {
+    let (mut p, c, _) = simple();
+    with_layer(&mut p, c, 0, |l| {
+        let tr = l.transform_mut().expect("tr");
+        tr.get_mut("position").expect("p").value = Value::Vec3([f64::NAN, f64::INFINITY, 1e300]);
+        tr.get_mut("opacity").expect("o").value = Value::Scalar(f64::NAN);
+        let sc = tr.get_mut("scale").expect("s");
+        let mut k0 = key(0.0, Value::Vec3([f64::NAN, 1e30, 0.0]));
+        k0.out_interp = Interp::Bezier;
+        k0.out_ease = vec![Ease { speed: f64::NAN, influence: f64::INFINITY }];
+        let mut k1 = key(1.0, Value::Vec3([1.0, 2.0, 3.0]));
+        k1.in_interp = Interp::Bezier;
+        k1.in_ease = vec![Ease { speed: 1e300, influence: -5.0 }];
+        sc.keys = vec![k0, k1];
+        let rot = tr.get_mut("rotation").expect("r");
+        rot.keys = vec![key(0.0, Value::Scalar(1.0)), key(0.0, Value::Scalar(2.0)), key(1e12, Value::Scalar(3.0)), key(-1e12, Value::Scalar(4.0))];
+    });
+    let r = check(&p);
+    assert!(r.report.count(LossCategory::InvalidValues) >= 3);
+}
+
+#[test]
+fn thousands_of_layers_and_keys() {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "Many", 640, 360, FrameRate::new(25, 1), 20.0, None);
+    let s = add_solid(&mut p, "S", 64, 64, [0.5; 3], None);
+    let mut comp = p.comp(c).cloned().expect("comp");
+    for i in 0..2000 {
+        let mut l = effectcraft_project::build::layer(&mut p, &comp, &format!("L{i}"), LayerSource::Solid { item: s }, (64, 64), None);
+        l.name = format!("L{i}");
+        let pos = l.transform_mut().expect("tr").get_mut("position").expect("p");
+        pos.keys = (0..10).map(|k| key(f64::from(k), Value::Vec3([f64::from(i), f64::from(k), 0.0]))).collect();
+        comp.layers.push(l);
+    }
+    if let Some(i) = p.item_mut(c) {
+        i.kind = ItemKind::Comp(std::sync::Arc::new(comp));
+    }
+    let r = check(&p);
+    assert_eq!(r.report.exported.layers, 2000);
+    assert_eq!(r.report.exported.keyframes, 20_000);
+}
+
+#[test]
+fn parent_loops_missing_sources_and_folder_loops() {
+    let (mut p, c, _) = simple();
+    add_layer(&mut p, c, "B", LayerSource::Solid { item: effectcraft_project::ItemId(9999) }, (10, 10));
+    add_layer(&mut p, c, "A", LayerSource::Null, (10, 10));
+    let (a, b) = {
+        let cc = p.comp(c).expect("c");
+        (cc.layers[0].id, cc.layers[1].id)
+    };
+    // A layer that is its own parent, and the unsupported layer B as the parent of a third.
+    with_layer(&mut p, c, 0, |l| l.parent = Some(a));
+    with_layer(&mut p, c, 2, |l| l.parent = Some(b));
+    // A loop of two exported layers.
+    add_layer(&mut p, c, "P", LayerSource::Null, (10, 10));
+    add_layer(&mut p, c, "Q", LayerSource::Null, (10, 10));
+    let (pid, qid) = {
+        let cc = p.comp(c).expect("c");
+        (cc.layers[1].id, cc.layers[0].id)
+    };
+    with_layer(&mut p, c, 1, |l| l.parent = Some(qid));
+    with_layer(&mut p, c, 0, |l| l.parent = Some(pid));
+    // Two folders that are each other's parent, and an item that names a missing parent.
+    let f1 = p.add_item("F1", Label::None, None, ItemKind::Folder);
+    let f2 = p.add_item("F2", Label::None, Some(f1), ItemKind::Folder);
+    if let Some(i) = p.item_mut(f1) {
+        i.parent = Some(f2);
+    }
+    let s = add_solid(&mut p, "InLoop", 10, 10, [0.0; 3], Some(f1));
+    add_layer(&mut p, c, "UsesLoopSolid", LayerSource::Solid { item: s }, (10, 10));
+    let r = check(&p);
+    assert!(r.report.count(LossCategory::ParentLinks) >= 3, "{}", r.report.summary());
+    assert!(r.report.count(LossCategory::FootageItems) >= 3);
+    assert!(r.report.count(LossCategory::UnsupportedLayers) >= 2);
+}
+
+#[test]
+fn very_long_and_odd_names() {
+    let mut p = Project::default();
+    let long = "x".repeat(10_000);
+    let weird = "a\0b\u{1f600}\u{202e}\"'<>&\n\r\t".to_string();
+    let c = add_comp(&mut p, &long, 100, 100, FrameRate::new(25, 1), 1.0, None);
+    let s = add_solid(&mut p, &long, 10, 10, [0.0; 3], None);
+    add_layer(&mut p, c, &long, LayerSource::Solid { item: s }, (10, 10));
+    add_layer(&mut p, c, &weird, LayerSource::Null, (10, 10));
+    let s2 = add_solid(&mut p, &weird, 10, 10, [0.0; 3], None);
+    add_layer(&mut p, c, "\u{3042}".repeat(100).as_str(), LayerSource::Solid { item: s2 }, (10, 10));
+    let r = check(&p);
+    assert!(r.report.count(LossCategory::Names) >= 1);
+}
+
+#[test]
+fn a_wide_folder_tree() {
+    let mut p = Project::default();
+    let mut parent = None;
+    for i in 0..100 {
+        parent = Some(p.add_item(&format!("F{i}"), Label::None, parent, ItemKind::Folder));
+    }
+    for i in 0..300 {
+        add_solid(&mut p, &format!("s{i}"), 8, 8, [0.1; 3], parent);
+    }
+    let r = check(&p);
+    assert!(r.report.count(LossCategory::FootageItems) > 0, "folders deeper than the limit are reported");
+}
diff --git a/crates/aep/tests/it/export/roundtrip.rs b/crates/aep/tests/it/export/roundtrip.rs
new file mode 100644
index 000000000..716a7b816
--- /dev/null
+++ b/crates/aep/tests/it/export/roundtrip.rs
@@ -0,0 +1,145 @@
+//! fixture -> import -> export -> import: the two imported projects are equal for the exported
+//! subset (masks included), and the exporter never fails on what the importer produces.
+
+use crate::export::helpers::export_all;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_project::{Comp, Item, ItemKind, Layer, LayerSource, Project};
+
+fn import_bytes(bytes: &[u8]) -> Option<Project> {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    import(&mut p, bytes, &opts).ok()?;
+    Some(p)
+}
+
+/// Items in tree order: (depth, name) with the item.
+fn tree<'a>(p: &'a Project, parent: Option<effectcraft_project::ItemId>, depth: usize, out: &mut Vec<(usize, &'a Item)>) {
+    let mut kids: Vec<&Item> = p.items.values().filter(|i| i.parent == parent).collect();
+    kids.sort_by(|a, b| a.name.to_lowercase().cmp(&b.name.to_lowercase()).then(a.id.0.cmp(&b.id.0)));
+    for k in kids {
+        out.push((depth, k));
+        if k.is_folder() && depth < 50 {
+            tree(p, Some(k.id), depth + 1, out);
+        }
+    }
+}
+
+fn same_comp(a: &Comp, b: &Comp, name: &str, pa: &Project, pb: &Project) {
+    assert_eq!((a.width, a.height, a.frame_rate, a.duration), (b.width, b.height, b.frame_rate, b.duration), "{name}");
+    assert_eq!(a.work_area, b.work_area, "{name} work area");
+    assert!((0..3).all(|i| (a.background[i] - b.background[i]).abs() < 1e-6), "{name} background");
+    assert!((a.pixel_aspect - b.pixel_aspect).abs() < 1e-3, "{name} pixel aspect");
+    assert_eq!(
+        (a.shutter_angle, a.shutter_phase, a.enable_motion_blur, a.display_start),
+        (b.shutter_angle, b.shutter_phase, b.enable_motion_blur, b.display_start),
+        "{name}"
+    );
+    // Layers that the exporter keeps (solid, null) in order.
+    let keep = |c: &Comp| -> Vec<Layer> {
+        c.layers.iter().filter(|l| matches!(l.source, LayerSource::Solid { .. } | LayerSource::Null | LayerSource::Comp { .. })).cloned().collect()
+    };
+    let (la, lb) = (keep(a), keep(b));
+    assert_eq!(la.len(), lb.len(), "{name} layer count");
+    for (x, y) in la.iter().zip(&lb) {
+        same_layer(x, y, a, b, name, pa, pb);
+    }
+}
+
+fn same_layer(x: &Layer, y: &Layer, ca: &Comp, cb: &Comp, comp: &str, pa: &Project, pb: &Project) {
+    let w = format!("{comp}/{}", x.name);
+    assert_eq!(x.name, y.name, "{w}");
+    assert_eq!((x.start_time, x.in_point, x.out_point), (y.start_time, y.in_point, y.out_point), "{w} timing");
+    assert_eq!(x.blend_mode, y.blend_mode, "{w}");
+    assert_eq!(x.label, y.label, "{w}");
+    assert_eq!(x.switches, y.switches, "{w} switches");
+    let idx = |c: &Comp, p: Option<effectcraft_project::LayerId>| p.and_then(|id| c.index_of(id));
+    assert_eq!(idx(ca, x.parent), idx(cb, y.parent), "{w} parent");
+    let src = |p: &Project, l: &Layer| match &l.source {
+        LayerSource::Solid { item } => p.item(*item).map(|i| (i.name.clone(), Some(i.kind.clone()))),
+        // A precomposition layer shows the composition of the same name.
+        LayerSource::Comp { item } => p.item(*item).map(|i| (i.name.clone(), None)),
+        _ => None,
+    };
+    assert_eq!(src(pa, x), src(pb, y), "{w} source");
+    // Masks (names, mode, invert, values and key counts; the field-by-field check is in masks.rs).
+    let masks = |l: &Layer| -> Vec<effectcraft_project::PropGroup> { l.masks().map(|m| m.groups().cloned().collect()).unwrap_or_default() };
+    let (mx, my) = (masks(x), masks(y));
+    assert_eq!(mx.len(), my.len(), "{w} mask count");
+    for (a, b) in mx.iter().zip(&my) {
+        assert_eq!((&a.name, &a.kind), (&b.name, &b.kind), "{w} mask");
+        for id in ["feather", "opacity", "expansion"] {
+            let (pa, pb) = (a.get(id).expect("p"), b.get(id).expect("p"));
+            assert!(pa.value.components().iter().zip(pb.value.components()).all(|(p, q)| (p - q).abs() < 1e-9), "{w} mask {id}");
+            assert_eq!(pa.keys.len(), pb.keys.len(), "{w} mask {id} keys");
+        }
+        assert_eq!(a.get("path").expect("path").keys.len(), b.get("path").expect("path").keys.len(), "{w} mask path keys");
+    }
+    let (tx, ty) = (x.transform().expect("t"), y.transform().expect("t"));
+    for id in ["anchor", "position", "scale", "rotation", "opacity"] {
+        let (px, py) = (tx.get(id).expect("p"), ty.get(id).expect("p"));
+        let close =
+            |a: &effectcraft_keyframe::Value, b: &effectcraft_keyframe::Value| a.components().iter().zip(b.components()).all(|(p, q)| (p - q).abs() < 1e-6);
+        assert!(close(&px.value, &py.value), "{w} {id} value {:?} {:?}", px.value, py.value);
+        assert_eq!(px.expr, py.expr, "{w} {id} expression");
+        assert_eq!(px.keys.len(), py.keys.len(), "{w} {id} key count");
+        for (kx, ky) in px.keys.iter().zip(&py.keys) {
+            same_key(kx, ky, px.spatial, &format!("{w} {id}"));
+        }
+    }
+}
+
+fn same_key(kx: &effectcraft_keyframe::Keyframe, ky: &effectcraft_keyframe::Keyframe, spatial: bool, w: &str) {
+    let close = |a: &effectcraft_keyframe::Value, b: &effectcraft_keyframe::Value| a.components().iter().zip(b.components()).all(|(p, q)| (p - q).abs() < 1e-6);
+    assert_eq!(kx.time, ky.time, "{w} key time");
+    assert!(close(&kx.value, &ky.value), "{w} key value");
+    assert_eq!(kx.roving, ky.roving, "{w}");
+    assert_eq!(kx.label, ky.label, "{w}");
+    assert_eq!(kx.spatial_auto, ky.spatial_auto, "{w}");
+    if spatial && !kx.spatial_auto {
+        assert!(kx.spatial_in.iter().zip(ky.spatial_in).all(|(p, q)| (p - q).abs() < 1e-6), "{w} tangent");
+    }
+    // Every side keeps its kind (the Anchor Point's ease too: 597, 730).
+    for (sx, sy, ex, ey) in [(kx.in_interp, ky.in_interp, &kx.in_ease, &ky.in_ease), (kx.out_interp, ky.out_interp, &kx.out_ease, &ky.out_ease)] {
+        assert_eq!(sx, sy, "{w} interpolation");
+        if sx == effectcraft_keyframe::Interp::Bezier {
+            assert_eq!(ex.len().max(1), ey.len().max(1), "{w} ease dims");
+            for (a, b) in ex.iter().zip(ey) {
+                assert!((a.speed - b.speed).abs() < 1e-6 && (a.influence - b.influence).abs() < 1e-6, "{w} ease {a:?} {b:?}");
+            }
+        }
+    }
+}
+
+#[test]
+fn every_fixture_survives_import_export_import() {
+    let mut compared = 0;
+    let mut precomps = 0;
+    for name in fixture_names!("aep") {
+        let bytes = fixture!(name);
+        let Some(p1) = import_bytes(&bytes) else { continue };
+        let r = export_all(&p1);
+        precomps += r.report.exported.precomp_layers;
+        let p2 = import_bytes(&r.bytes).unwrap_or_else(|| panic!("{name}: the exported file does not import"));
+        let (mut t1, mut t2) = (Vec::new(), Vec::new());
+        tree(&p1, None, 0, &mut t1);
+        tree(&p2, None, 0, &mut t2);
+        // The exporter drops footage items and puts root solids in the Solids folder; compare the
+        // compositions by name.
+        let comps = |t: &[(usize, &Item)]| -> Vec<(String, Comp)> {
+            let mut v: Vec<(String, Comp)> =
+                t.iter().filter_map(|(_, i)| if let ItemKind::Comp(c) = &i.kind { Some((i.name.clone(), (**c).clone())) } else { None }).collect();
+            v.sort_by(|a, b| a.0.cmp(&b.0));
+            v
+        };
+        let (c1, c2) = (comps(&t1), comps(&t2));
+        assert_eq!(c1.len(), c2.len(), "{name}: composition count");
+        for ((n1, a), (n2, b)) in c1.iter().zip(&c2) {
+            assert_eq!(n1, n2, "{name}");
+            same_comp(a, b, &format!("{name}/{n1}"), &p1, &p2);
+            compared += 1;
+        }
+    }
+    assert!(compared > 100, "only {compared} compositions compared");
+    assert!(precomps >= 2, "only {precomps} precomposition layers compared");
+}
diff --git a/crates/aep/tests/it/export/settings.rs b/crates/aep/tests/it/export/settings.rs
new file mode 100644
index 000000000..6914087d0
--- /dev/null
+++ b/crates/aep/tests/it/export/settings.rs
@@ -0,0 +1,186 @@
+//! Project settings (cases 620-634): written into the template's header chunks, read back with
+//! `effectcraft-aep`, and the settings fixtures through import, export and import.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::{TimeDisplay, WorkingSpace, parse, write};
+use effectcraft_color::ColorSpace;
+use effectcraft_project::{BitDepth, ColorEngine, Project, ProjectSettings, TimeDisplayStyle};
+
+fn read_back(p: &Project) -> effectcraft_aep::ProjectSettings {
+    let r = export_all(p);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(write(&file).expect("write"), r.bytes, "container consistent");
+    effectcraft_aep::ProjectSettings::read(&file)
+}
+
+fn with(f: impl FnOnce(&mut ProjectSettings)) -> Project {
+    let (mut p, _, _) = simple();
+    f(&mut p.settings);
+    p
+}
+
+#[test]
+fn every_setting_is_written_as_after_effects_stores_it() {
+    // EffectCraft's defaults: 8 bpc, no working space, gamma 2.2, timecode, frames from 0.
+    let d = read_back(&with(|_| {}));
+    assert_eq!(d.bits_per_channel, Some(8));
+    assert_eq!(d.working_space, Some(WorkingSpace::None));
+    assert_eq!(d.working_gamma_24, Some(false));
+    assert!(!d.linearize && !d.blend_linear);
+    assert_eq!(d.time_display, Some(TimeDisplay::Timecode));
+    assert_eq!(d.frame_start, Some(0));
+    assert_eq!(d.scene_compensation, Some(true), "kept from the template");
+    for (depth, bpc) in [(BitDepth::Bpc8, 8), (BitDepth::Bpc16, 16), (BitDepth::Bpc32, 32)] {
+        assert_eq!(read_back(&with(|s| s.bit_depth = depth)).bits_per_channel, Some(bpc));
+    }
+    let srgb = read_back(&with(|s| s.working_space = Some(ColorSpace::Srgb)));
+    assert_eq!(srgb.working_space, Some(WorkingSpace::Profile("sRGB IEC61966-2.1".into())));
+    assert_eq!(read_back(&with(|s| s.working_gamma = 2.4)).working_gamma_24, Some(true));
+    for (lin, blend) in [(true, false), (false, true), (true, true)] {
+        let r = read_back(&with(|s| {
+            s.linearize = lin;
+            s.blend_linear = blend;
+        }));
+        assert_eq!((r.linearize, r.blend_linear), (lin, blend));
+    }
+    for (style, want) in [
+        (TimeDisplayStyle::Frames, TimeDisplay::Frames),
+        (TimeDisplayStyle::Feet35, TimeDisplay::FeetFrames { frames_per_foot: 16 }),
+        (TimeDisplayStyle::Feet16, TimeDisplay::FeetFrames { frames_per_foot: 40 }),
+        (TimeDisplayStyle::Timecode, TimeDisplay::Timecode),
+    ] {
+        assert_eq!(read_back(&with(|s| s.time_display = style)).time_display, Some(want));
+    }
+    assert_eq!(read_back(&with(|s| s.frame_start = 1)).frame_start, Some(1));
+}
+
+fn unbase64(s: &str) -> Vec<u8> {
+    let val = |c: u8| match c {
+        b'A'..=b'Z' => u32::from(c - b'A'),
+        b'a'..=b'z' => u32::from(c - b'a') + 26,
+        b'0'..=b'9' => u32::from(c - b'0') + 52,
+        b'+' => 62,
+        b'/' => 63,
+        _ => panic!("not base64: {c}"),
+    };
+    let mut out = Vec::new();
+    for q in s.as_bytes().chunks(4) {
+        let n = q.iter().filter(|&&c| c != b'=').count();
+        let v = q.iter().filter(|&&c| c != b'=').enumerate().fold(0u32, |acc, (i, &c)| acc | (val(c) << (18 - 6 * i)));
+        out.extend_from_slice(&v.to_be_bytes()[1..n]);
+    }
+    out
+}
+
+#[test]
+fn rec709_gamma_24_is_written_with_a_profile_of_our_own() {
+    let p = with(|s| s.working_space = Some(ColorSpace::Rec709));
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let file = parse(&r.bytes).expect("parse");
+    let s = effectcraft_aep::ProjectSettings::read(&file);
+    assert_eq!(s.working_space, Some(WorkingSpace::Profile("Rec.709 Gamma 2.4".into())));
+    let cpid = file.chunks.iter().find(|c| c.is(b"cpid")).and_then(|c| c.bytes()).expect("cpid").to_vec();
+    let pw = file.chunks.iter().position(|c| c.is(b"PwCs")).expect("PwCs");
+    let json: serde_json::Value = serde_json::from_slice(file.chunks[pw + 1].bytes().expect("Utf8")).expect("json");
+    assert_eq!(json["baseProfileType"], 2);
+    let icc = unbase64(json["baseColorProfile"]["colorProfileData"].as_str().expect("data"));
+    // An ICC v4 display profile: size, 'acsp', and the ID in cpid equals the one in the header.
+    assert_eq!(u32::from_be_bytes([icc[0], icc[1], icc[2], icc[3]]) as usize, icc.len());
+    assert_eq!(&icc[36..40], b"acsp");
+    assert_eq!(icc[8], 4);
+    assert_eq!(&icc[84..100], &cpid[..]);
+    assert_ne!(cpid, vec![0xffu8; 16]);
+    // Import maps it back to Rec.709.
+    let mut q = Project::default();
+    let none = |_: &str| false;
+    let back = effectcraft_aep::import::import(&mut q, &r.bytes, &effectcraft_aep::import::ImportOptions::new(&none)).expect("import");
+    assert_eq!(back.settings.working_space, Some(ColorSpace::Rec709));
+}
+
+#[test]
+fn our_rec709_profile_without_its_name_is_still_rec709() {
+    // After Effects 26.2.1 drops the name on a re-save (settings-c): the name is then our profile's
+    // description. The name is blanked to spaces, so the JSON keeps its length.
+    let mut bytes = export_all(&with(|s| s.working_space = Some(ColorSpace::Rec709))).bytes;
+    let key = b",\"colorProfileName\":\"Rec.709 Gamma 2.4\"";
+    let at = bytes.windows(key.len()).position(|w| w == key).expect("name");
+    bytes[at..at + key.len()].fill(b' ');
+    let s = effectcraft_aep::ProjectSettings::read(&parse(&bytes).expect("parse"));
+    assert_eq!(s.working_space, Some(WorkingSpace::Profile("Rec.709 Gamma 2.4 (EffectCraft)".into())));
+    let mut q = Project::default();
+    let none = |_: &str| false;
+    let back = effectcraft_aep::import::import(&mut q, &bytes, &effectcraft_aep::import::ImportOptions::new(&none)).expect("import");
+    assert_eq!(back.settings.working_space, Some(ColorSpace::Rec709));
+}
+
+#[test]
+fn what_the_file_cannot_hold_is_reported() {
+    let lossy = [
+        with(|s| s.working_space = Some(ColorSpace::Rec2020)),
+        with(|s| s.color_engine = ColorEngine::Ocio),
+        with(|s| s.output_space = Some(ColorSpace::Rec2100Pq)),
+        with(|s| s.frame_start = 7),
+    ];
+    for p in &lossy {
+        let r = export_all(p);
+        assert_eq!(r.report.count(LossCategory::ProjectSettings), 1, "{:?}", r.report.losses);
+    }
+    // Rec. 2020 is written as sRGB.
+    assert_eq!(read_back(&lossy[0]).working_space, Some(WorkingSpace::Profile("sRGB IEC61966-2.1".into())));
+    assert!(export_all(&with(|_| {})).report.is_lossless());
+}
+
+#[test]
+fn settings_fixtures_round_trip() {
+    let names = [
+        "000-base.aep",
+        "621-settings-bpc-8.aep",
+        "622-settings-bpc-16.aep",
+        "623-settings-workingspace-none.aep",
+        "625-settings-gamma-2.4.aep",
+        "629-settings-time-display-frames.aep",
+        "630-settings-frame-start-1.aep",
+        "632-settings-linearize-and-blend-linear.aep",
+        "633-settings-feet-frames-35.aep",
+        "634-settings-feet-frames-16.aep",
+    ];
+    for name in names {
+        let bytes = fixture!(name);
+        let orig = effectcraft_aep::ProjectSettings::read(&parse(&bytes).expect("parse"));
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let r = effectcraft_aep::import::import(&mut p, &bytes, &effectcraft_aep::import::ImportOptions::new(&none)).expect(name);
+        p.settings = r.settings;
+        let back = read_back(&p);
+        // 621-630 share a file with 628 (scene compensation off), which the round trip does not
+        // carry (628 is not in this list); every other setting comes back.
+        let back = effectcraft_aep::ProjectSettings { scene_compensation: orig.scene_compensation, ..back };
+        assert_eq!(back, orig, "{name}");
+    }
+}
+
+#[test]
+fn an_output_space_equal_to_the_working_space_is_the_normal_case() {
+    // After Effects renders in the working space (902): the importer sets the output space of a
+    // Rec.709 Gamma 2.4 project to Rec.709, and the export of such a project loses nothing.
+    let bytes = fixture!("902-settings-rec709-16bpc-steps-png-grey-solid.aep");
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) };
+    let r = effectcraft_aep::import::import(&mut p, &bytes, &opts).expect("import");
+    assert_eq!((r.settings.working_space, r.settings.output_space), (Some(ColorSpace::Rec709), Some(ColorSpace::Rec709)));
+    p.settings = r.settings;
+    let e = export_all(&p);
+    assert_eq!(e.report.count(LossCategory::ProjectSettings), 0, "{:?}", e.report.losses);
+    let mut q = Project::default();
+    let back = effectcraft_aep::import::import(&mut q, &e.bytes, &opts).expect("re-import");
+    assert_eq!((back.settings.working_space, back.settings.output_space), (Some(ColorSpace::Rec709), Some(ColorSpace::Rec709)));
+    // Another output space is still reported.
+    let other = with(|s| {
+        s.working_space = Some(ColorSpace::Rec709);
+        s.output_space = Some(ColorSpace::Srgb);
+    });
+    assert_eq!(export_all(&other).report.count(LossCategory::ProjectSettings), 1);
+}
diff --git a/crates/aep/tests/it/export/shape_switch.rs b/crates/aep/tests/it/export/shape_switch.rs
new file mode 100644
index 000000000..1492dc2ce
--- /dev/null
+++ b/crates/aep/tests/it/export/shape_switch.rs
@@ -0,0 +1,107 @@
+//! A shape item's eye switch (986, 987): bit 0 of the item group's `tdsb`. After Effects does
+//! not draw a Fill whose bit is clear (986), and draws it once set (987). The importer keeps it as
+//! the item's `enabled`, the exporter writes it back.
+
+use crate::export::helpers::export_all;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{PropGroup as AepGroup, PropNode, parse};
+use effectcraft_project::{Node, Project, PropGroup};
+
+fn import_bytes(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut p, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+    assert!(r.report.losses.is_empty(), "{:?}", r.report.losses);
+    p
+}
+
+/// (match id, enabled) of every shape item, depth first.
+fn items(g: &PropGroup, out: &mut Vec<(String, bool)>) {
+    for c in &g.children {
+        if let Node::Group(sub) = c {
+            if sub.match_id != "transform" && sub.match_id != "contents" {
+                out.push((sub.match_id.clone(), sub.enabled));
+            }
+            items(sub, out);
+        }
+    }
+}
+
+fn switches(p: &Project) -> Vec<(String, bool)> {
+    let mut out = Vec::new();
+    for (_, c) in p.comps() {
+        for l in &c.layers {
+            if let Some(contents) = l.props.sub("contents") {
+                items(contents, &mut out);
+            }
+        }
+    }
+    out
+}
+
+/// The stored flags of every `ADBE Vector Graphic - Fill` group in a file.
+fn fill_flags(bytes: &[u8]) -> Vec<u32> {
+    fn walk(g: &AepGroup<'_, '_>, out: &mut Vec<u32>, depth: usize) {
+        if depth > 16 {
+            return;
+        }
+        for e in g.entries() {
+            if let PropNode::Group(sub) = e.node {
+                if e.match_name == "ADBE Vector Graphic - Fill" {
+                    out.push(sub.flags().unwrap_or(99));
+                }
+                walk(&sub, out, depth + 1);
+            }
+        }
+    }
+    let f = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&f).expect("project");
+    let mut out = Vec::new();
+    for item in view.all_items() {
+        let Some(c) = item.comp() else { continue };
+        for l in c.layers() {
+            if let Some(root) = l.properties() {
+                walk(&root, &mut out, 0);
+            }
+        }
+    }
+    out
+}
+
+#[test]
+fn a_switched_off_fill_stays_off() {
+    let bytes = fixture!("986-shape-fill-switched-off-green.aep");
+    assert_eq!(fill_flags(&bytes), [0]);
+    let p = import_bytes(&bytes);
+    let s = switches(&p);
+    assert!(s.contains(&("fill".to_string(), false)), "{s:?}");
+    assert!(s.iter().filter(|(id, _)| id != "fill").all(|(_, on)| *on), "{s:?}");
+    let r = export_all(&p);
+    assert!(r.report.losses.is_empty(), "{:?}", r.report.losses);
+    assert_eq!(fill_flags(&r.bytes), [0]);
+    assert_eq!(switches(&import_bytes(&r.bytes)), s);
+    // Switched on again, it is written with the bit set (987).
+    let mut q = p.clone();
+    let ids: Vec<_> = q.comps().map(|(i, _)| *i).collect();
+    for id in ids {
+        if let Some(mut c) = q.comp(id).cloned() {
+            for l in &mut c.layers {
+                fn on(g: &mut PropGroup) {
+                    g.enabled = true;
+                    for c in &mut g.children {
+                        if let Node::Group(s) = c {
+                            on(s);
+                        }
+                    }
+                }
+                if let Some(contents) = l.props.sub_mut("contents") {
+                    on(contents);
+                }
+            }
+            if let Some(it) = q.item_mut(id) {
+                it.kind = effectcraft_project::ItemKind::Comp(std::sync::Arc::new(c));
+            }
+        }
+    }
+    assert_eq!(fill_flags(&export_all(&q).bytes), [1]);
+}
diff --git a/crates/aep/tests/it/export/stretch.rs b/crates/aep/tests/it/export/stretch.rs
new file mode 100644
index 000000000..86b4e5da3
--- /dev/null
+++ b/crates/aep/tests/it/export/stretch.rs
@@ -0,0 +1,127 @@
+//! Keys on time-stretched layers (cases 641-643): the key times count source time in the layer's
+//! time scale (the composition's x stretch at 100 % or more, the composition's below).
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::{PropNode, parse};
+use effectcraft_keyframe::{Interp, Value};
+use effectcraft_project::{LayerSource, Project};
+use effectcraft_time::FrameRate;
+
+/// (stretch numerator, denominator, start units, Position time scale, key times) of the first
+/// layer of the first composition.
+fn position_keys(bytes: &[u8]) -> (i32, u32, i32, u32, Vec<i32>) {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("layer");
+    let h = layer.header().expect("header");
+    let Some(PropNode::Property(pos)) = layer.properties().and_then(|g| g.find(&["ADBE Transform Group", "ADBE Position"])) else { panic!("position") };
+    let times = pos.keys().expect("keys").keyframes().filter_map(|k| k.time_units()).collect();
+    (h.stretch, h.stretch_den, h.start.num as i32, pos.time_scale().expect("time scale"), times)
+}
+
+fn reimport(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    effectcraft_aep::import::import(
+        &mut p,
+        bytes,
+        &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+    )
+    .expect("import");
+    p
+}
+
+#[test]
+fn keys_on_stretched_layers_are_written_as_after_effects_stores_them() {
+    for name in ["641-stretch-200-keys-position-1s-2s.aep", "642-stretch-50-keys-position-1s-2s.aep", "643-stretch-200-start-1-keys-position-2s-3s.aep"] {
+        let bytes = fixture!(name);
+        let p1 = reimport(&bytes);
+        let r = export_all(&p1);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        assert_eq!(position_keys(&r.bytes), position_keys(&bytes), "{name}");
+        // A second import gives the same layer and keys.
+        let p2 = reimport(&r.bytes);
+        let layer = |p: &Project| p.comps().next().map(|(_, c)| c.layers[0].clone()).expect("layer");
+        let (a, b) = (layer(&p1), layer(&p2));
+        assert_eq!((a.stretch, a.start_time, a.in_point, a.out_point), (b.stretch, b.start_time, b.in_point, b.out_point), "{name}");
+        let keys =
+            |l: &effectcraft_project::Layer| l.props.prop("transform/position").map(|p| p.keys.iter().map(|k| (k.time, k.value.clone())).collect::<Vec<_>>());
+        assert_eq!(keys(&a), keys(&b), "{name}");
+    }
+    // What the cases hold (MANIFEST): 200 % keys at comp 1 s / 2 s = units 25 600 / 51 200 at
+    // time scale 51 200; 50 % at time scale 25 600 = 51 200 / 102 400.
+    assert_eq!(position_keys(&fixture!("641-stretch-200-keys-position-1s-2s.aep")), (2, 1, 0, 51200, vec![25600, 51200]));
+    assert_eq!(position_keys(&fixture!("642-stretch-50-keys-position-1s-2s.aep")), (1, 2, 0, 25600, vec![51200, 102400]));
+}
+
+#[test]
+fn a_comp_time_survives_any_stretch() {
+    // Keys built in code on a 150 % layer starting at 0.4 s: the key at layer time 2 s is at
+    // comp 0.4 + 3 s, in source units 2 x 38 400.
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 640, 360, FrameRate::new(25, 1), 10.0, None);
+    let s = add_solid(&mut p, "S", 100, 100, [1.0, 0.0, 0.0], None);
+    add_layer(&mut p, c, "S", LayerSource::Solid { item: s }, (100, 100));
+    with_layer(&mut p, c, 0, |l| {
+        l.stretch = 150.0;
+        l.start_time = secs(0.4);
+        let pos = l.props.prop_mut("transform/position").expect("pos");
+        pos.keys = vec![key(1.0, Value::Vec3([0.0, 0.0, 0.0])), key(2.0, Value::Vec3([100.0, 0.0, 0.0]))];
+    });
+    // The in point (comp 0 s) is 0.4 s before the start: -10 240 units, -6 826.67 in source time
+    // at 150 %, which the format cannot hold. It is rounded, and the rounding is reported.
+    let r = export_all(&p);
+    assert_eq!(r.report.count(LossCategory::RoundedTimes), 1, "{:?}", r.report.losses);
+    let in_point = |p: &Project| p.comps().next().map(|(_, c)| c.layers[0].in_point.seconds()).expect("layer");
+    let moved = (in_point(&reimport(&r.bytes)) - in_point(&p)).abs();
+    assert!(moved > 0.0 && moved < 1.5 / 25_600.0, "{moved}");
+    // With the in point at the start, nothing is rounded.
+    with_layer(&mut p, c, 0, |l| l.in_point = l.start_time);
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (n, d, _, ts, times) = position_keys(&r.bytes);
+    assert_eq!((n, d, ts, times), (3, 2, 38400, vec![38400, 76800]));
+    // Bezier ease on a stretched layer is written but reported (its speed unit is not sampled).
+    with_layer(&mut p, c, 0, |l| {
+        let pos = l.props.prop_mut("transform/position").expect("pos");
+        pos.keys[0].out_interp = Interp::Bezier;
+    });
+    assert_eq!(export_all(&p).report.count(LossCategory::ApproximatedKeyframes), 1);
+    assert_eq!(export_all(&p).report.count(LossCategory::TimeStretch), 0);
+}
+
+/// (stretch numerator, denominator, start, in, out as stored; Opacity time scale and key times).
+fn reversed_header(bytes: &[u8]) -> (i32, u32, i64, i64, i64, u32, Vec<i32>) {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let comp = view.all_items().into_iter().find_map(|i| i.comp()).expect("comp");
+    let layer = comp.layers().next().expect("layer");
+    let h = layer.header().expect("header");
+    let (ts, times) = match layer.properties().and_then(|g| g.find(&["ADBE Transform Group", "ADBE Opacity"])) {
+        Some(PropNode::Property(p)) if p.is_animated() => {
+            (p.time_scale().unwrap_or(0), p.keys().expect("keys").keyframes().filter_map(|k| k.time_units()).collect())
+        }
+        _ => (0, Vec::new()),
+    };
+    (h.stretch, h.stretch_den, h.start.num, h.in_relative.num, h.out_relative.num, ts, times)
+}
+
+#[test]
+fn a_reversed_layer_is_written_as_after_effects_stores_it() {
+    // 981-983: a negative stretch numerator, the start at the later end, in / out relative in
+    // source time, keys in the composition's time scale.
+    for name in ["981-layer-stretch-minus100-start5.aep", "982-layer-stretch-minus100-opacity-keys.aep", "983-layer-stretch-minus50-opacity-keys.aep"] {
+        let bytes = fixture!(name);
+        let p1 = reimport(&bytes);
+        let l = p1.comps().next().map(|(_, c)| c.layers[0].clone()).expect("layer");
+        assert!(l.stretch < 0.0 && l.in_point < l.out_point, "{name}: {} {:?} {:?}", l.stretch, l.in_point, l.out_point);
+        let r = export_all(&p1);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        assert_eq!(reversed_header(&r.bytes), reversed_header(&bytes), "{name}");
+        let p2 = reimport(&r.bytes);
+        let m = p2.comps().next().map(|(_, c)| c.layers[0].clone()).expect("layer");
+        assert_eq!((l.stretch, l.start_time, l.in_point, l.out_point), (m.stretch, m.start_time, m.in_point, m.out_point), "{name}");
+    }
+}
diff --git a/crates/aep/tests/it/export/styles.rs b/crates/aep/tests/it/export/styles.rs
new file mode 100644
index 000000000..ee3524a36
--- /dev/null
+++ b/crates/aep/tests/it/export/styles.rs
@@ -0,0 +1,224 @@
+//! Layer styles: fixture -> import -> export -> import keeps every style value, the written
+//! `ADBE Layer Styles` group is After Effects' own (951-979), and styles made in EffectCraft are
+//! written with After Effects' defaults in mind.
+
+use crate::export::helpers::{add_comp, add_layer, add_solid, export_all, key, with_comp, with_layer};
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{PropNode, parse};
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::Ids;
+use effectcraft_project::styles::{self as st, GROUP};
+use effectcraft_project::{Expression, Layer, LayerSource, Project, PropGroup};
+use effectcraft_time::FrameRate;
+
+fn import_bytes(bytes: &[u8]) -> (Project, Vec<String>) {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut p, bytes, &opts).expect("import");
+    let losses = r.report.losses.iter().flat_map(|l| l.details.clone()).collect();
+    (p, losses)
+}
+
+fn layer<'p>(p: &'p Project, name: &str) -> &'p Layer {
+    p.comps().flat_map(|(_, c)| c.layers.iter()).find(|l| l.name == name).expect("layer")
+}
+
+/// Every style parameter as (style, param, value, keys, expression).
+fn values(g: &PropGroup) -> Vec<(String, String, Value, usize, Option<Expression>)> {
+    let mut out = Vec::new();
+    for s in g.groups() {
+        for sub in std::iter::once(s).chain(s.groups()) {
+            for n in &sub.children {
+                if let Some(p) = n.as_prop() {
+                    // A keyed property's static value means nothing (the importer takes the first key's).
+                    let v = p.keys.first().map_or_else(|| p.value.clone(), |k| k.value.clone());
+                    out.push((s.match_id.clone(), p.match_id.clone(), v, p.keys.len(), p.expr.clone()));
+                }
+            }
+        }
+    }
+    out
+}
+
+/// The stored `ADBE Layer Styles` group of the first layer with a style applied.
+fn stored_group(bytes: &[u8]) -> Vec<u8> {
+    let f = parse(bytes).expect("parse");
+    let project = effectcraft_aep::Project::new(&f).expect("project");
+    for item in project.all_items() {
+        let Some(c) = item.comp() else { continue };
+        for l in c.layers() {
+            if let Some(PropNode::Group(g)) = l.properties().and_then(|p| p.get("ADBE Layer Styles"))
+                && g.flags() == Some(1)
+            {
+                // As far as the exporter writes records (`decoded`).
+                let mut f2 = effectcraft_aep::AepFile {
+                    chunks: vec![crate::export::helpers::decoded(&g.chunk().clone().into_owned())],
+                    trailer: std::borrow::Cow::Owned(vec![]),
+                };
+                f2.trailer = std::borrow::Cow::Owned(vec![]);
+                return effectcraft_aep::write(&f2).expect("write");
+            }
+        }
+    }
+    panic!("no layer with a style");
+}
+
+const CASES: &[&str] = &[
+    "951-styles-all-nine-defaults-on-B.aep",
+    "966-style-drop-shadow-opacity50-distance20.aep",
+    "970-style-stroke-size10-color-green.aep",
+    "974-style-gradient-overlay-angle45-scale150.aep",
+    "975-style-fill-opacity0-with-drop-shadow.aep",
+    "976-style-drop-shadow-opacity-keyed-100-20-linear.aep",
+    "977-styles-all-params-changed.aep",
+    "979-style-inner-glow-source-2.aep",
+    "988-style-drop-shadow-switched-off.aep",
+];
+
+#[test]
+fn fixtures_round_trip_without_losses() {
+    for name in CASES {
+        let bytes = fixture!(name);
+        let (p, losses) = import_bytes(&bytes);
+        assert!(losses.is_empty(), "{name}: {losses:?}");
+        let r = export_all(&p);
+        assert!(r.report.losses.is_empty(), "{name}: {:?}", r.report.losses);
+        assert!(r.report.exported.layer_styles > 0, "{name}");
+        let (q, losses) = import_bytes(&r.bytes);
+        assert!(losses.is_empty(), "{name} re-import: {losses:?}");
+        let (a, b) = (layer(&p, "B"), layer(&q, "B"));
+        assert_eq!(values(a.props.sub(GROUP).expect("styles")), values(b.props.sub(GROUP).expect("styles")), "{name}");
+        // The written group is the one After Effects saved, in its decoded bytes.
+        assert_eq!(stored_group(&bytes), stored_group(&r.bytes), "{name}: stored group differs");
+        let (ca, cb) = (p.comps().next().expect("comp").1, q.comps().next().expect("comp").1);
+        assert_eq!(ca.global_light, cb.global_light, "{name}");
+    }
+}
+
+#[test]
+fn a_style_made_here_is_written_with_after_effects_defaults_in_mind() {
+    let mut p = Project::default();
+    let comp = add_comp(&mut p, "C", 400, 300, FrameRate::FPS_25, 4.0, None);
+    let s = add_solid(&mut p, "S", 200, 100, [0.2, 0.4, 0.8], None);
+    add_layer(&mut p, comp, "S", LayerSource::Solid { item: s }, (200, 100));
+    let gl = p.comp(comp).expect("comp").global_light.clone();
+    let mut next = p.next_id;
+    with_layer(&mut p, comp, 0, |l| {
+        let mut ids = Ids(&mut next);
+        st::add_style(l, &mut ids, "dropShadow", &gl, true);
+        st::add_style(l, &mut ids, "stroke", &gl, true);
+        let g = l.props.sub_mut(GROUP).expect("styles");
+        let ds = g.sub_mut("dropShadow").expect("ds");
+        ds.get_mut("opacity").expect("opacity").keys = vec![key(0.0, Value::Scalar(100.0)), key(2.0, Value::Scalar(20.0))];
+        ds.get_mut("color").expect("color").expr = Some(Expression { text: "[1, 0, 0, 1]".into(), enabled: true });
+        let stroke = g.sub_mut("stroke").expect("stroke");
+        stroke.get_mut("position").expect("position").value = Value::Enum(2);
+        stroke.get_mut("blendMode").expect("mode").value = Value::Enum(23);
+    });
+    p.next_id = next;
+    with_comp(&mut p, comp, |c| st::set_global_light(c, Some(60.0), None, effectcraft_time::Tick::ZERO));
+    let r = export_all(&p);
+    assert!(r.report.losses.is_empty(), "{:?}", r.report.losses);
+    let (q, losses) = import_bytes(&r.bytes);
+    assert!(losses.is_empty(), "{losses:?}");
+    let (a, b) = (layer(&p, "S"), layer(&q, "S"));
+    assert_eq!(values(a.props.sub(GROUP).expect("styles")), values(b.props.sub(GROUP).expect("styles")));
+    // EffectCraft's Use Global Light default (on) differs from After Effects' (off): written.
+    assert_eq!(b.props.sub(GROUP).and_then(|g| g.sub("dropShadow")).and_then(|g| g.get("useGlobalLight")).map(|p| p.value.clone()), Some(Value::Bool(true)));
+    assert_eq!(q.comps().next().expect("comp").1.global_light.angle.value, Value::Scalar(60.0));
+}
+
+#[test]
+fn what_is_not_written_is_reported() {
+    let mut p = Project::default();
+    let comp = add_comp(&mut p, "C", 400, 300, FrameRate::FPS_25, 4.0, None);
+    let s = add_solid(&mut p, "S", 200, 100, [0.2, 0.4, 0.8], None);
+    add_layer(&mut p, comp, "S", LayerSource::Solid { item: s }, (200, 100));
+    let gl = p.comp(comp).expect("comp").global_light.clone();
+    let mut next = p.next_id;
+    with_layer(&mut p, comp, 0, |l| {
+        let mut ids = Ids(&mut next);
+        st::add_style(l, &mut ids, "satin", &gl, false);
+        st::add_style(l, &mut ids, "gradientOverlay", &gl, true);
+        let g = l.props.sub_mut(GROUP).expect("styles");
+        let go = g.sub_mut("gradientOverlay").expect("go");
+        if let Some(Value::Gradient(gr)) = go.get_mut("colors").map(|p| &mut p.value) {
+            gr.colors[0].1 = [1.0, 0.0, 0.0, 1.0];
+        }
+        go.get_mut("style").expect("style").keys = vec![key(0.0, Value::Enum(1)), key(1.0, Value::Enum(2))];
+        let adv = g.sub_mut(st::BLENDING).and_then(|b| b.sub_mut("advancedBlending")).expect("adv");
+        adv.get_mut("knockout").expect("knockout").value = Value::Enum(1);
+    });
+    p.next_id = next;
+    let r = export_all(&p);
+    let lines: Vec<String> = r.report.losses.iter().flat_map(|l| l.details.clone()).collect();
+    let has = |s: &str| lines.iter().any(|l| l.contains(s));
+    assert!(has("gradientFill/gradient"), "{lines:?}");
+    assert!(has("gradientFill/type: keys"), "{lines:?}");
+    assert!(has("Knockout"), "{lines:?}");
+    let (q, _) = import_bytes(&r.bytes);
+    let g = layer(&q, "S").props.sub(GROUP).expect("styles");
+    // A switched-off style is written switched off (988).
+    assert!(g.sub("satin").is_some_and(|s| !s.enabled) && g.sub("gradientOverlay").is_some_and(|s| s.enabled));
+}
+
+#[test]
+fn styles_on_every_layer_kind_that_takes_them() {
+    let mut p = Project::default();
+    let comp = add_comp(&mut p, "C", 400, 300, FrameRate::FPS_25, 4.0, None);
+    let s = add_solid(&mut p, "S", 200, 100, [0.2, 0.4, 0.8], None);
+    add_layer(&mut p, comp, "S", LayerSource::Solid { item: s }, (200, 100));
+    add_layer(&mut p, comp, "Shape", LayerSource::Shape, (400, 300));
+    add_layer(&mut p, comp, "Text", LayerSource::Text, (400, 300));
+    add_layer(&mut p, comp, "Null", LayerSource::Null, (100, 100));
+    let gl = p.comp(comp).expect("comp").global_light.clone();
+    let mut next = p.next_id;
+    for i in 0..4 {
+        with_layer(&mut p, comp, i, |l| {
+            st::add_style(l, &mut Ids(&mut next), "stroke", &gl, true);
+        });
+    }
+    p.next_id = next;
+    let r = export_all(&p);
+    let (q, _) = import_bytes(&r.bytes);
+    for name in ["S", "Shape", "Text"] {
+        assert!(layer(&q, name).props.sub(GROUP).and_then(|g| g.sub("stroke")).is_some(), "{name}");
+    }
+}
+
+/// An expression on a style popup that After Effects stores in another order (Inner Glow Source:
+/// Edge is 1 there, Center 1 here) means something else there: reported, and a strict export
+/// refuses. A popup in the same order stays lossless (review finding).
+#[test]
+fn a_style_popup_expression_is_reported_only_when_the_items_are_stored_in_another_order() {
+    let build = |param: &str| {
+        let mut p = Project::default();
+        let comp = add_comp(&mut p, "C", 400, 300, FrameRate::FPS_25, 4.0, None);
+        let s = add_solid(&mut p, "S", 200, 100, [0.2, 0.4, 0.8], None);
+        add_layer(&mut p, comp, "S", LayerSource::Solid { item: s }, (200, 100));
+        let gl = p.comp(comp).expect("comp").global_light.clone();
+        let mut next = p.next_id;
+        with_layer(&mut p, comp, 0, |l| {
+            let mut ids = Ids(&mut next);
+            st::add_style(l, &mut ids, "innerGlow", &gl, true);
+            let g = l.props.sub_mut(GROUP).expect("styles");
+            let glow = g.sub_mut("innerGlow").expect("glow");
+            if let Some(prop) = glow.get_mut(param) {
+                prop.expr = Some(Expression { text: "1".into(), enabled: true });
+            } else {
+                panic!("no {param}");
+            }
+        });
+        p.next_id = next;
+        p
+    };
+    let strict = |p: &Project| effectcraft_aep::export::export(p, &effectcraft_aep::export::ExportOptions { allow_losses: false }).is_ok();
+    let reversed = build("source");
+    let r = export_all(&reversed);
+    assert_eq!(r.report.count(effectcraft_aep::export::LossCategory::LayerStyles), 1, "{:?}", r.report.losses);
+    assert!(!strict(&reversed));
+    let same = build("technique");
+    assert_eq!(export_all(&same).report.count(effectcraft_aep::export::LossCategory::LayerStyles), 0);
+    assert!(strict(&same));
+}
diff --git a/crates/aep/tests/it/export/text.rs b/crates/aep/tests/it/export/text.rs
new file mode 100644
index 000000000..befc2f47e
--- /dev/null
+++ b/crates/aep/tests/it/export/text.rs
@@ -0,0 +1,686 @@
+//! Text layers: every text fixture is imported, exported and parsed back with `effectcraft-aep`;
+//! the text document (text, paragraphs, style runs, fonts, box) must equal the one After Effects
+//! wrote for every decoded field, and a second import gives the same Source Text. Documents built
+//! in code check line breaks, runs, fonts, and what is reported.
+
+use crate::export::helpers::*;
+use effectcraft_aep::export::LossCategory;
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{Caps, Justification, TextDocument, parse};
+use effectcraft_keyframe::Value;
+use effectcraft_keyframe::text_doc::{BaselineOption, CharStyle, Justify, ParaStyle, StyleRun, TextDoc};
+use effectcraft_project::{ItemId, ItemKind, LayerSource, Project};
+use effectcraft_time::FrameRate;
+
+fn text_fixtures() -> Option<Vec<String>> {
+    Some({
+        let mut v: Vec<String> = crate::common::names("aep")?.into_iter().filter(|n| n.ends_with(".aep") && n.contains("-text-")).collect();
+        v.sort();
+        v
+    })
+}
+
+fn reimport(bytes: &[u8]) -> Project {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    import(&mut p, bytes, &opts).expect("import");
+    p
+}
+
+/// The text documents of all text layers, by composition name and layer index.
+fn documents(bytes: &[u8]) -> Vec<((String, usize), TextDocument)> {
+    let file = parse(bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let mut out = Vec::new();
+    for item in view.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for (i, layer) in comp.layers().enumerate() {
+            if let Some(d) = layer.text_document() {
+                out.push(((item.display_name().unwrap_or_default(), i), d));
+            }
+        }
+    }
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+fn close(a: f64, b: f64) -> bool {
+    (a - b).abs() < 1e-4
+}
+
+/// The decoded fields of two documents are equal (`font_of` resolves the font indices).
+fn same_doc(a: &TextDocument, b: &TextDocument, w: &str) {
+    // U+0003 is imported as a paragraph break and written as one (386: the same layout).
+    assert_eq!(a.raw_text.replace('\u{3}', "\r"), b.raw_text, "{w}");
+    let paras = |d: &TextDocument| -> Vec<(usize, Justification)> { d.paragraphs.iter().map(|p| (p.length, p.justification)).collect() };
+    assert_eq!(paras(a), paras(b), "{w}");
+    assert_eq!(a.style_runs.len(), b.style_runs.len(), "{w}: style runs");
+    for (x, y) in a.style_runs.iter().zip(&b.style_runs) {
+        assert_eq!(x.length, y.length, "{w}");
+        assert_eq!(a.font_of(x), b.font_of(y), "{w}");
+        assert!(close(x.font_size, y.font_size), "{w}: size {} {}", x.font_size, y.font_size);
+        assert!((1..4).all(|i| close(x.fill_argb[i], y.fill_argb[i])), "{w}: fill {:?} {:?}", x.fill_argb, y.fill_argb);
+        assert!(close(x.tracking, y.tracking), "{w}: tracking");
+        assert_eq!((x.faux_bold, x.faux_italic, x.caps, x.auto_leading), (y.faux_bold, y.faux_italic, y.caps, y.auto_leading), "{w}");
+        if !x.auto_leading {
+            assert_eq!(x.leading.map(|l| (l * 1e4).round()), y.leading.map(|l| (l * 1e4).round()), "{w}: leading");
+        }
+    }
+    let bx = |d: &TextDocument| d.text_box.map(|t| [t.x, t.y, t.width, t.height]);
+    match (bx(a), bx(b)) {
+        (None, None) => {}
+        (Some(p), Some(q)) => assert!(p.iter().zip(q).all(|(u, v)| close(*u, v)), "{w}: box {p:?} {q:?}"),
+        other => panic!("{w}: box {other:?}"),
+    }
+}
+
+fn source_text(p: &Project) -> Vec<TextDoc> {
+    let mut v = Vec::new();
+    for item in p.items.values() {
+        let ItemKind::Comp(c) = &item.kind else { continue };
+        for l in &c.layers {
+            if let Some(Value::Text(d)) = l.props.prop("text/sourceText").map(|s| &s.value) {
+                v.push((**d).clone());
+            }
+        }
+    }
+    v.sort_by(|a, b| a.text.cmp(&b.text));
+    v
+}
+
+#[test]
+fn every_text_fixture_is_written_with_its_document() {
+    let names = skip!(text_fixtures());
+    assert!(names.len() >= 15, "{names:?}");
+    for name in &names {
+        let bytes = fixture!(name);
+        let p1 = reimport(&bytes);
+        let r = export_all(&p1);
+        // Text animators and vertical text are imported but not written: the only text losses
+        // allowed.
+        let animators = r
+            .report
+            .losses
+            .iter()
+            .filter(|l| l.category == LossCategory::TextLayers)
+            .flat_map(|l| &l.details)
+            .filter(|d| d.contains("text animator") || d.contains("vertical text"))
+            .count();
+        assert_eq!(r.report.count(LossCategory::TextLayers), animators, "{name}: {:?}", r.report.losses);
+        let (a, b) = (documents(&bytes), documents(&r.bytes));
+        assert_eq!(a.len(), b.len(), "{name}");
+        for ((ka, da), (kb, db)) in a.iter().zip(&b) {
+            assert_eq!(ka.0, kb.0, "{name}");
+            same_doc(da, db, name);
+        }
+        // The container is consistent and a second import gives the same Source Text.
+        let file = parse(&r.bytes).expect("parse");
+        assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes, "{name}");
+        let p2 = reimport(&r.bytes);
+        // Vertical text comes back horizontal (reported above).
+        let horizontal = |v: Vec<TextDoc>| v.into_iter().map(|d| TextDoc { vertical: false, ..d }).collect::<Vec<_>>();
+        assert_eq!(horizontal(source_text(&p1)), horizontal(source_text(&p2)), "{name}");
+    }
+}
+
+fn style(font: &str, size: f64) -> CharStyle {
+    CharStyle { font: font.into(), style: "Regular".into(), size, leading: Some(size * 1.2), ..CharStyle::default() }
+}
+
+fn text_project(docs: Vec<TextDoc>) -> (Project, ItemId) {
+    let mut p = Project::default();
+    let c = add_comp(&mut p, "C", 1920, 1080, FrameRate::new(25, 1), 5.0, None);
+    for (i, d) in docs.into_iter().enumerate() {
+        add_layer(&mut p, c, &format!("T{i}"), LayerSource::Text, (1920, 1080));
+        with_layer(&mut p, c, 0, |l| {
+            if let Some(st) = l.props.prop_mut("text/sourceText") {
+                st.value = Value::Text(Box::new(d));
+            }
+        });
+    }
+    (p, c)
+}
+
+#[test]
+fn documents_built_in_code_are_written_as_their_fields() {
+    let mut runs = TextDoc::plain("Red\r\nBlue\nX");
+    runs.set_runs(vec![
+        StyleRun { len: 5, style: CharStyle { fill: [1.0, 0.0, 0.0, 1.0], tracking: 25.0, ..style("ArialMT", 50.0) } },
+        StyleRun { len: 6, style: CharStyle { fill: [0.0, 0.0, 1.0, 1.0], faux_bold: true, small_caps: true, leading: None, ..style("Georgia", 70.0) } },
+    ]);
+    runs.set_paras(vec![
+        ParaStyle { justify: Justify::Center, ..runs.base_para() },
+        ParaStyle { justify: Justify::Right, ..runs.base_para() },
+        ParaStyle { justify: Justify::Left, ..runs.base_para() },
+    ]);
+    let mut boxed = TextDoc::plain("In a box");
+    boxed.set_runs(vec![StyleRun { len: 8, style: style("TimesNewRomanPSMT", 30.0) }]);
+    boxed.box_size = Some([300.0, 120.0]);
+    boxed.box_pos = [-150.0, -60.0];
+    let empty = TextDoc::plain("");
+    let (p, _) = text_project(vec![runs, boxed, empty]);
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.exported.text_layers, 3);
+    let docs = documents(&r.bytes);
+    let by_text = |t: &str| docs.iter().map(|(_, d)| d).find(|d| d.raw_text == t).unwrap_or_else(|| panic!("{t}"));
+    // CRLF and LF are After Effects' CR; the final paragraph ends with one too.
+    let d = by_text("Red\rBlue\rX\r");
+    assert_eq!(
+        d.paragraphs.iter().map(|p| (p.length, p.justification)).collect::<Vec<_>>(),
+        vec![(4, Justification::Center), (5, Justification::Right), (2, Justification::Left)]
+    );
+    // Runs in After Effects' characters: "Red\r" + 'B' of the first style (the CRLF counted
+    // once), then "lue\rX\r".
+    let runs: Vec<_> = d.style_runs.iter().map(|s| (s.length, d.font_of(s).map(str::to_string), s.font_size, s.faux_bold, s.caps, s.auto_leading)).collect();
+    assert_eq!(runs, vec![(4, Some("ArialMT".into()), 50.0, false, Caps::Normal, false), (7, Some("Georgia".into()), 70.0, true, Caps::Small, true)]);
+    assert!(close(d.style_runs[0].tracking, 25.0) && close(d.style_runs[0].fill_argb[1], 1.0) && close(d.style_runs[1].fill_argb[3], 1.0));
+    // The prototype's own fonts keep their places; new ones are appended.
+    assert_eq!(d.fonts.first().map(String::as_str), Some("TimesNewRomanPSMT"));
+    let b = by_text("In a box\r");
+    let tb = b.text_box.expect("box");
+    assert_eq!([tb.x, tb.y, tb.width, tb.height], [-150.0, -60.0, 300.0, 120.0]);
+    let e = by_text("\r");
+    assert_eq!(e.style_runs.iter().map(|s| s.length).sum::<usize>(), 1);
+    // A text layer named after its text stores no name.
+    let (p2, _) = text_project(vec![TextDoc::plain("Named")]);
+    let mut p2 = p2;
+    let c = p2.items.values().find(|i| i.name == "C").map(|i| i.id).expect("C");
+    with_layer(&mut p2, c, 0, |l| l.name = "Named".into());
+    let r2 = export_all(&p2);
+    let file = parse(&r2.bytes).expect("parse");
+    let view = effectcraft_aep::Project::new(&file).expect("project");
+    let layer = view.all_items().into_iter().find_map(|i| i.comp()).and_then(|c| c.layers().next()).expect("layer");
+    assert_eq!(layer.name(), None);
+    assert_eq!(layer.header().map(|h| h.layer_type), Some(effectcraft_aep::LayerType::Text));
+}
+
+/// #3233: whether a text layer's name follows its text survives export and import. A followed
+/// name is written as no name (After Effects shows the text) and comes back following; a name the
+/// user gave is written, even when it equals the text, and comes back as the user's. Without a
+/// recorded state (older projects) a name equal to the text follows.
+#[test]
+fn a_text_layer_name_follows_its_text_through_export_and_import() {
+    for (name, follows, stored) in [
+        ("Hello", Some(false), Some("Hello")),
+        ("Hello 2", Some(true), None),
+        ("Hello", None, None),
+        ("Text 2", None, None),
+        ("Text Title", None, Some("Text Title")),
+        ("Text Title", Some(false), Some("Text Title")),
+    ] {
+        let case = format!("{name:?} {follows:?}");
+        let (mut p, c) = text_project(vec![TextDoc::plain("Hello")]);
+        with_layer(&mut p, c, 0, |l| {
+            l.name = name.into();
+            l.name_follows_text = follows;
+        });
+        let r = export_all(&p);
+        let file = parse(&r.bytes).expect("parse");
+        let view = effectcraft_aep::Project::new(&file).expect("project");
+        let layer = view.all_items().into_iter().find_map(|i| i.comp()).and_then(|c| c.layers().next()).expect("layer");
+        assert_eq!(layer.name().as_deref(), stored, "stored name ({case})");
+        let back = reimport(&r.bytes);
+        let l = back.comps().flat_map(|(_, c)| c.layers.iter()).find(|l| matches!(l.source, LayerSource::Text)).expect("text layer");
+        assert_eq!(l.name, stored.unwrap_or("Hello"), "imported name ({case})");
+        assert_eq!(l.name_follows_text, Some(stored.is_none()), "imported state ({case})");
+    }
+    // An empty text layer that follows its text is written without a name, as After Effects
+    // writes it, and comes back named "Text", still following.
+    let (mut p, c) = text_project(vec![TextDoc::plain("")]);
+    with_layer(&mut p, c, 0, |l| {
+        l.name = "Text".into();
+        l.name_follows_text = Some(true);
+    });
+    let back = reimport(&export_all(&p).bytes);
+    let l = back.comps().flat_map(|(_, c)| c.layers.iter()).find(|l| matches!(l.source, LayerSource::Text)).expect("text layer");
+    assert_eq!((l.name.as_str(), l.name_follows_text), ("Text", Some(true)), "an empty text layer");
+}
+
+/// #3233: a following name cut from a first line longer than 40 characters is written as no name
+/// and comes back as the same cut name, still following; a long name the user gave stays whole.
+#[test]
+fn a_long_first_line_names_a_text_layer_the_same_after_export_and_import() {
+    let line = "A headline that runs past forty characters, to 64";
+    assert!((41..=64).contains(&line.chars().count()));
+    let text = format!("{line}\rSecond");
+    let cut = effectcraft_project::text_layer_name(&text);
+    assert_eq!(cut.chars().count(), 40);
+    for (name, follows, back_name) in [(cut.as_str(), Some(true), cut.as_str()), (line, Some(false), line)] {
+        let (mut p, c) = text_project(vec![TextDoc::plain(&text)]);
+        with_layer(&mut p, c, 0, |l| {
+            l.name = name.into();
+            l.name_follows_text = follows;
+        });
+        let back = reimport(&export_all(&p).bytes);
+        let l = back.comps().flat_map(|(_, c)| c.layers.iter()).find(|l| matches!(l.source, LayerSource::Text)).expect("text layer");
+        assert_eq!((l.name.as_str(), l.name_follows_text), (back_name, follows), "{name:?}");
+    }
+}
+
+#[test]
+fn what_a_text_document_cannot_hold_is_reported() {
+    let mut d = TextDoc::plain("x");
+    d.set_runs(vec![StyleRun { len: 1, style: CharStyle { apply_stroke: true, stroke_width: 3.0, h_scale: 80.0, ..style("ArialMT", 40.0) } }]);
+    d.set_paras(vec![ParaStyle { justify: Justify::JustifyAll, indent_left: 10.0, ..d.base_para() }]);
+    d.vertical = true;
+    let (mut p, c) = text_project(vec![d]);
+    with_layer(&mut p, c, 0, |l| {
+        if let Some(st) = l.props.prop_mut("text/sourceText") {
+            st.keys = vec![key(0.0, st.value.clone()), key(1.0, Value::Text(Box::new(TextDoc::plain("y"))))];
+        }
+    });
+    let r = export_all(&p);
+    // Vertical text and Source Text keys (stroke, scale, justification and indents are written).
+    assert_eq!(r.report.count(LossCategory::TextLayers), 2, "{:?}", r.report.losses);
+    // A 3D text layer is written; only per-character 3D is reported.
+    let (mut p3, c3) = text_project(vec![TextDoc::plain("3D")]);
+    with_layer(&mut p3, c3, 0, |l| l.switches.three_d = true);
+    assert_eq!(export_all(&p3).report.count(LossCategory::ThreeD), 0);
+    with_layer(&mut p3, c3, 0, |l| {
+        if let Some(pc) = l.props.prop_mut("text/perChar3d") {
+            pc.value = Value::Bool(true);
+        }
+    });
+    assert_eq!(export_all(&p3).report.count(LossCategory::ThreeD), 1);
+    assert_eq!(r.report.exported.text_layers, 1);
+}
+
+#[test]
+fn hostile_text_never_panics() {
+    let long: String = "ab\r".repeat(50_000);
+    let mut nan = TextDoc::plain("nan");
+    nan.set_runs(vec![StyleRun {
+        len: 3,
+        style: CharStyle { size: f64::NAN, tracking: f64::INFINITY, leading: Some(f64::NAN), fill: [f32::NAN, 2.0, -1.0, 1.0], ..style("", 10.0) },
+    }]);
+    let mut odd = TextDoc::plain("()\\ \u{3} \u{1F600} ünï");
+    odd.box_size = Some([f64::NAN, 1e300]);
+    odd.box_pos = [f64::INFINITY, -1e300];
+    // Runs that do not cover the text, or cover more.
+    let mut short = TextDoc::plain("short text");
+    short.runs = vec![StyleRun { len: 2, style: style("ArialMT", 20.0) }];
+    let mut over = TextDoc::plain("ab");
+    over.runs = vec![StyleRun { len: 1000, style: style("ArialMT", 20.0) }, StyleRun { len: usize::MAX, style: style("ArialMT", 20.0) }];
+    let mut max = TextDoc::plain("max");
+    max.runs = vec![StyleRun { len: usize::MAX, style: style("ArialMT", 20.0) }];
+    max.paragraphs = vec![effectcraft_keyframe::text_doc::ParaStyle::default(); 3];
+    let (p, _) = text_project(vec![TextDoc::plain(&long), nan, odd, short, over, max]);
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    let _ = reimport(&r.bytes);
+}
+
+#[test]
+fn the_baseline_option_is_written_into_style_slot_13() {
+    // 526-528: slot /13 is 1 superscript (After Effects' scripted default, also in the prototypes),
+    // 0 normal, 2 subscript; normal text written as 1 is drawn by After Effects at 58.3 % size.
+    let doc = |b: BaselineOption| {
+        let mut d = TextDoc::plain("HHHH");
+        d.set_runs(vec![StyleRun { len: 4, style: CharStyle { baseline: b, ..style("ArialMT", 100.0) } }]);
+        d
+    };
+    for (b, slot_differs) in [(BaselineOption::Normal, true), (BaselineOption::Superscript, false), (BaselineOption::Subscript, true)] {
+        let (p, _) = text_project(vec![doc(b)]);
+        let r = export_all(&p);
+        assert!(r.report.is_lossless(), "{b:?}: {:?}", r.report.losses);
+        let docs = documents(&r.bytes);
+        let d = &docs.first().expect("doc").1;
+        // The reader decodes /13 now; the scripted default (also in the prototypes) is 1.
+        assert!(d.undecoded_style_fields.iter().all(|f| f != "13"), "{b:?}: {:?}", d.undecoded_style_fields);
+        let _ = slot_differs;
+        // A second import gives the same baseline option back (normal stays normal).
+        let back = source_text(&reimport(&r.bytes));
+        let got = back.first().and_then(|t| t.runs().first().map(|r| r.style.baseline));
+        assert_eq!(got, Some(b), "{b:?}");
+        let text = String::from_utf8_lossy(&r.bytes).to_string();
+        let want = match b {
+            BaselineOption::Normal => "/13 0",
+            BaselineOption::Superscript => "/13 1",
+            BaselineOption::Subscript => "/13 2",
+        };
+        assert!(text.contains(want), "{b:?}");
+    }
+}
+
+#[test]
+fn superscript_stays_superscript_and_normal_stays_normal() {
+    // 526 and 113 are superscript (the scripted default), 527 normal, 528 subscript: the merged
+    // importer reads /13 and the exporter writes it back, so a round trip keeps each one.
+    for (name, want) in [
+        ("113-text-Hello-size60-fillorange.aep", BaselineOption::Superscript),
+        ("526-text-point-HHHH-default.aep", BaselineOption::Superscript),
+        ("527-text-point-HHHH-baseline-normal.aep", BaselineOption::Normal),
+        ("528-text-point-HHHH-baseline-subscript.aep", BaselineOption::Subscript),
+    ] {
+        let p1 = reimport(&fixture!(name));
+        let baselines = |p: &Project| source_text(p).iter().flat_map(|d| d.runs().into_iter().map(|r| r.style.baseline)).collect::<Vec<_>>();
+        let b1 = baselines(&p1);
+        assert!(!b1.is_empty() && b1.iter().all(|b| *b == want), "{name}: {b1:?}");
+        let r = export_all(&p1);
+        let p2 = reimport(&r.bytes);
+        assert_eq!(baselines(&p2), b1, "{name}");
+        let docs = documents(&r.bytes);
+        let stored = match want {
+            BaselineOption::Normal => effectcraft_aep::FontBaseline::Normal,
+            BaselineOption::Superscript => effectcraft_aep::FontBaseline::Superscript,
+            BaselineOption::Subscript => effectcraft_aep::FontBaseline::Subscript,
+        };
+        assert!(docs.iter().flat_map(|(_, d)| &d.style_runs).all(|s| s.baseline == stored), "{name}");
+    }
+}
+
+#[test]
+fn a_text_made_in_effectcraft_is_written_with_the_every_line_composer() {
+    // A plain box text without paragraph entries uses the document's settings: EffectCraft's
+    // default composer is every-line, which After Effects reads back as such (t6).
+    let mut d = TextDoc::plain("One two three four five six seven eight\rTwo");
+    d.set_runs(vec![StyleRun { len: d.text.chars().count(), style: style("ArialMT", 30.0) }]);
+    d.box_size = Some([300.0, 200.0]);
+    assert!(d.paragraphs.is_empty());
+    let (p, _) = text_project(vec![d.clone()]);
+    let r = export_all(&p);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let docs = documents(&r.bytes);
+    let paras = &docs[0].1.paragraphs;
+    assert_eq!(paras.len(), 2);
+    assert!(paras.iter().all(|p| p.every_line_composer && p.direction == 0 && p.justification == Justification::Left), "{paras:?}");
+    assert_eq!(source_text(&reimport(&r.bytes))[0].para(0).composer, effectcraft_keyframe::text_doc::Composer::EveryLine);
+}
+
+#[test]
+fn right_to_left_justification_is_stored_relative_to_the_direction() {
+    // t7: in a right-to-left paragraph After Effects lays code 0 and 3 out flush right and 1 and
+    // 4 flush left; 2, 5, 6 are the same in both directions.
+    use effectcraft_keyframe::text_doc::Direction;
+    let cases = [
+        (Justify::Left, Justification::Right),
+        (Justify::Right, Justification::Left),
+        (Justify::Center, Justification::Center),
+        (Justify::JustifyLastLeft, Justification::FullRight),
+        (Justify::JustifyLastRight, Justification::FullLeft),
+        (Justify::JustifyLastCenter, Justification::FullCenter),
+        (Justify::JustifyAll, Justification::FullAll),
+    ];
+    for (rtl, ltr_stored) in [(true, false), (false, true)] {
+        let docs: Vec<TextDoc> = cases
+            .iter()
+            .enumerate()
+            .map(|(i, (j, _))| {
+                let mut d = TextDoc::plain(&format!("T{i}"));
+                d.set_runs(vec![StyleRun { len: 2, style: style("ArialMT", 30.0) }]);
+                let dir = if rtl { Direction::Rtl } else { Direction::Ltr };
+                d.set_paras(vec![ParaStyle { justify: *j, direction: dir, ..d.base_para() }]);
+                d
+            })
+            .collect();
+        let (p, _) = text_project(docs);
+        let r = export_all(&p);
+        let written = documents(&r.bytes);
+        let back = source_text(&reimport(&r.bytes));
+        for (i, (j, swapped)) in cases.iter().enumerate() {
+            let stored = written.iter().find(|(_, d)| d.raw_text == format!("T{i}\r")).map(|(_, d)| d.paragraphs[0].justification).unwrap();
+            let want = if ltr_stored { effectcraft_aep_justification(*j) } else { *swapped };
+            assert_eq!(stored, want, "rtl {rtl}: {j:?}");
+            assert_eq!(back[i].para(0).justify, *j, "rtl {rtl}: round trip");
+        }
+    }
+}
+
+fn effectcraft_aep_justification(j: Justify) -> Justification {
+    match j {
+        Justify::Left => Justification::Left,
+        Justify::Right => Justification::Right,
+        Justify::Center => Justification::Center,
+        Justify::JustifyLastLeft => Justification::FullLeft,
+        Justify::JustifyLastRight => Justification::FullRight,
+        Justify::JustifyLastCenter => Justification::FullCenter,
+        Justify::JustifyAll => Justification::FullAll,
+    }
+}
+
+/// Every `(path of match names, record)` below `ADBE Text Animators`, keyed records with the
+/// unused ease before the first / after the last key and spatial arc lengths zeroed, and the
+/// sequence of match names (the structure).
+fn animator_records(bytes: &[u8]) -> (Vec<String>, Vec<(String, Vec<u8>)>) {
+    fn walk(cs: &[effectcraft_aep::Chunk<'_>], path: &str, inside: bool, names: &mut Vec<String>, out: &mut Vec<(String, Vec<u8>)>) {
+        for (i, c) in cs.iter().enumerate() {
+            let Some(name) = c.bytes().filter(|_| c.is(b"tdmn")).map(|b| String::from_utf8_lossy(b.split(|x| *x == 0).next().unwrap_or(b"")).to_string())
+            else {
+                // Items, layers and other lists: look inside (a node after a `tdmn` is walked
+                // with it).
+                let after_tdmn = i > 0 && cs.get(i - 1).is_some_and(|p| p.is(b"tdmn"));
+                if !inside && !after_tdmn {
+                    walk(c.children(), path, inside, names, out);
+                }
+                continue;
+            };
+            let here = inside || name == "ADBE Text Animators";
+            let key = format!("{path}/{name}");
+            if here {
+                names.push(key.clone());
+            }
+            let Some(node) = cs.get(i + 1) else { continue };
+            if here && node.is_list(b"tdbs") {
+                // In the bytes the exporter writes (`decoded`).
+                let mut f = effectcraft_aep::AepFile { chunks: vec![crate::export::helpers::decoded(&node.clone().into_owned())], trailer: Default::default() };
+                if let Some(list) = f.chunks[0].children_mut().iter_mut().find(|k| k.is_list(b"list")) {
+                    let size = list
+                        .child(b"lhd3")
+                        .and_then(|c| c.bytes())
+                        .and_then(|b| b.get(16..20))
+                        .map_or(0, |b| u32::from_be_bytes(b.try_into().unwrap()) as usize);
+                    if let Some(ldat) = list.children_mut().iter_mut().find(|k| k.is(b"ldat"))
+                        && let effectcraft_aep::Body::Data(d) = &mut ldat.body
+                    {
+                        let mut v = d.to_vec();
+                        let n = v.len();
+                        if size == 48 && n >= 96 {
+                            v[16..32].fill(0);
+                            v[n - 16..n].fill(0);
+                        }
+                        if size >= 104 && size % 8 == 0 && (size - 56) % 24 == 0 {
+                            for r in v.chunks_mut(size) {
+                                r[16..24].fill(0);
+                            }
+                        }
+                        *d = v.into();
+                    }
+                }
+                out.push((key.clone(), effectcraft_aep::write(&f).unwrap()));
+            }
+            if node.is_list(b"tdgp") {
+                walk(node.children(), &key, here, names, out);
+            }
+        }
+    }
+    let f = parse(bytes).expect("parse");
+    let (mut names, mut out) = (Vec::new(), Vec::new());
+    walk(&f.chunks, "", false, &mut names, &mut out);
+    (names, out)
+}
+
+#[test]
+fn text_animators_are_written_as_after_effects_wrote_them() {
+    // 114, 579-594, 728: the animators, their properties and range selectors come back with
+    // After Effects' structure and records.
+    let mut names: Vec<String> =
+        fixture_names!("aep").into_iter().filter(|n| n.ends_with(".aep") && (n.contains("textanim") || n.contains("text-animator"))).collect();
+    names.sort();
+    assert!(names.len() >= 16, "{names:?}");
+    let mut compared = 0;
+    for name in &names {
+        let bytes = fixture!(name);
+        let r = export_all(&reimport(&bytes));
+        assert_eq!(r.report.count(LossCategory::TextLayers), 0, "{name}: {:?}", r.report.losses);
+        let (mut na, mut ra) = animator_records(&bytes);
+        let (nb, rb) = animator_records(&r.bytes);
+        // With Units = Index After Effects keeps the percent range it had before (583); the
+        // index range is what it uses, the export has only that.
+        if na.iter().any(|n| n.ends_with("ADBE Text Index Start")) {
+            na.retain(|n| !n.contains("ADBE Text Percent"));
+            ra.retain(|(n, _)| !n.contains("ADBE Text Percent"));
+        }
+        // A record After Effects writes for a value at its default when another one makes it
+        // matter (587: Smoothness 100 with Shape Ramp Up): absent = default.
+        let explicit = |n: &str| n.ends_with("ADBE Text Selector Smoothness") && !nb.iter().any(|m| m == n);
+        let default_100 = |rec: &[u8]| rec.windows(8).any(|w| w == 100.0f64.to_be_bytes());
+        let drop: Vec<String> = ra.iter().filter(|(n, rec)| explicit(n) && default_100(rec)).map(|(n, _)| n.clone()).collect();
+        na.retain(|n| !drop.contains(n));
+        ra.retain(|(n, _)| !drop.contains(n));
+        if na != nb {
+            let short = |v: &[String]| v.iter().map(|s| s.rsplit('/').next().unwrap_or_default().to_string()).collect::<Vec<_>>();
+            panic!(
+                "{name}: structure
+ AE  {:?}
+ out {:?}",
+                short(&na),
+                short(&nb)
+            );
+        }
+        for ((ka, a), (kb, b)) in ra.iter().zip(&rb) {
+            assert_eq!(ka, kb, "{name}");
+            assert_eq!(a, b, "{name}: {ka}");
+            compared += 1;
+        }
+        assert_eq!(ra.len(), rb.len(), "{name}");
+    }
+    assert!(compared >= 30, "{compared}");
+}
+
+#[test]
+fn hostile_text_animators_never_panic() {
+    use effectcraft_project::build;
+    let mut d = TextDoc::plain("Hostile");
+    d.set_runs(vec![StyleRun { len: 7, style: style("ArialMT", 40.0) }]);
+    let (mut p, c) = text_project(vec![d]);
+    let mut next = p.next_id;
+    {
+        let mut ids = build::Ids(&mut next);
+        let mut anims = Vec::new();
+        for i in 0..300 {
+            let props: Vec<_> =
+                ["position", "scale", "fillColor", "tracking", "blur"].iter().flat_map(|k| build::text_anim_props(&mut ids, k, false)).collect();
+            let mut a = build::text_animator(&mut ids, &format!("A{i}"), props);
+            if let Some(pg) = a.sub_mut("properties") {
+                pg.get_mut("position").unwrap().value = Value::Vec3([f64::NAN, 1e300, 0.0]);
+                pg.get_mut("tracking").unwrap().keys = (0..2000).map(|k| key(f64::from(k) * 0.001, Value::Scalar(f64::from(k)))).collect();
+                pg.get_mut("fillColor").unwrap().keys = vec![key(0.0, Value::Scalar(1.0)), key(1.0, Value::Color([f64::INFINITY, 0.0, 0.0, 1.0]))];
+            }
+            if let Some(sels) = a.sub_mut("selectors") {
+                sels.children.push(build::wiggly_selector(&mut ids, "W").into());
+            }
+            anims.push(effectcraft_project::Node::Group(a));
+        }
+        with_layer(&mut p, c, 0, |l| l.props.sub_mut("text").unwrap().sub_mut("animators").unwrap().children = anims);
+    }
+    p.next_id = next;
+    let r = export_all(&p);
+    let file = parse(&r.bytes).expect("parse");
+    assert_eq!(effectcraft_aep::write(&file).expect("write"), r.bytes);
+    assert!(r.report.count(LossCategory::TextLayers) >= 300, "{:?}", r.report.losses);
+    let _ = reimport(&r.bytes);
+}
+
+/// A text animator's Fill Color outside 0 to 1 is clamped and reported under text layers, like a
+/// shape colour (review finding: the animator path skipped the check); an in-range one is
+/// lossless.
+#[test]
+fn a_text_animator_colour_outside_the_range_is_reported() {
+    use effectcraft_project::build;
+    let with_fill = |colour: [f64; 4]| {
+        let mut d = TextDoc::plain("Glow");
+        d.set_runs(vec![StyleRun { len: 4, style: style("ArialMT", 40.0) }]);
+        let (mut p, c) = text_project(vec![d]);
+        let mut next = p.next_id;
+        {
+            let mut ids = build::Ids(&mut next);
+            let props = build::text_anim_props(&mut ids, "fillColor", false);
+            let mut a = build::text_animator(&mut ids, "A", props);
+            if let Some(pg) = a.sub_mut("properties") {
+                pg.get_mut("fillColor").unwrap().value = Value::Color(colour);
+            }
+            with_layer(&mut p, c, 0, |l| l.props.sub_mut("text").unwrap().sub_mut("animators").unwrap().children = vec![effectcraft_project::Node::Group(a)]);
+        }
+        p.next_id = next;
+        p
+    };
+    let lost = |p: &Project| {
+        let r = export_all(p);
+        r.report
+            .losses
+            .iter()
+            .filter(|l| l.category == LossCategory::TextLayers)
+            .flat_map(|l| l.details.clone())
+            .filter(|d| d.contains("outside 0 to 1"))
+            .count()
+    };
+    assert_eq!(lost(&with_fill([0.2, 0.4, 0.6, 1.0])), 0);
+    assert_eq!(lost(&with_fill([3.0, 0.4, -1.0, 1.0])), 1);
+}
+
+/// A text animator's Fill or Stroke Color alpha is reported (After Effects colours have none; the
+/// converter wrote them opaque without a word, review finding), for the static value and for keys;
+/// the check follows the values that are written: an alpha on the static value of a keyed colour
+/// is not reported, an opaque control is lossless.
+#[test]
+fn a_text_animator_colour_alpha_is_reported_for_the_values_that_are_written() {
+    use effectcraft_project::build;
+    for id in ["fillColor", "strokeColor"] {
+        let make = |value: [f64; 4], keys: Option<([f64; 4], [f64; 4])>| {
+            let mut d = TextDoc::plain("Glow");
+            d.set_runs(vec![StyleRun { len: 4, style: style("ArialMT", 40.0) }]);
+            let (mut p, c) = text_project(vec![d]);
+            let mut next = p.next_id;
+            {
+                let mut ids = build::Ids(&mut next);
+                let props = build::text_anim_props(&mut ids, id, false);
+                let mut a = build::text_animator(&mut ids, "A", props);
+                if let Some(pg) = a.sub_mut("properties") {
+                    let prop = pg.get_mut(id).unwrap();
+                    prop.value = Value::Color(value);
+                    if let Some((k0, k1)) = keys {
+                        prop.keys = vec![key(0.0, Value::Color(k0)), key(1.0, Value::Color(k1))];
+                    }
+                }
+                with_layer(&mut p, c, 0, |l| {
+                    l.props.sub_mut("text").unwrap().sub_mut("animators").unwrap().children = vec![effectcraft_project::Node::Group(a)]
+                });
+            }
+            p.next_id = next;
+            p
+        };
+        let alpha_lost = |p: &Project| {
+            let r = export_all(p);
+            r.report.losses.iter().filter(|l| l.category == LossCategory::TextLayers).flat_map(|l| l.details.clone()).filter(|d| d.contains("alpha")).count()
+        };
+        let strict = |p: &Project| effectcraft_aep::export::export(p, &effectcraft_aep::export::ExportOptions { allow_losses: false }).is_ok();
+        let opaque = [0.2, 0.4, 0.6, 1.0];
+        let clear = [0.2, 0.4, 0.6, 0.25];
+        let control = make(opaque, None);
+        assert_eq!(alpha_lost(&control), 0, "{id}");
+        let static_alpha = make(clear, None);
+        assert_eq!(alpha_lost(&static_alpha), 1, "{id}");
+        assert!(!strict(&static_alpha), "{id}");
+        let keyed_alpha = make(opaque, Some((opaque, clear)));
+        assert_eq!(alpha_lost(&keyed_alpha), 1, "{id}");
+        // The static value of a keyed colour is not written: its alpha is not reported.
+        let keyed_opaque = make(clear, Some((opaque, opaque)));
+        assert_eq!(alpha_lost(&keyed_opaque), 0, "{id}");
+    }
+}
+
+/// Two fonts whose names differ only in bytes a lossy UTF-8 conversion turns into the same text
+/// (U+4E80 and U+4E81 both read as `N` + U+FFFD) get entries of their own (review finding).
+#[test]
+fn non_ascii_font_names_keep_their_own_font_entries() {
+    let mut d = TextDoc::plain("ab");
+    d.set_runs(vec![StyleRun { len: 1, style: style("\u{4e80}", 40.0) }, StyleRun { len: 1, style: style("\u{4e81}", 40.0) }]);
+    let (p, _) = text_project(vec![d]);
+    let r = export_all(&p);
+    let docs = documents(&r.bytes);
+    let (_, doc) = docs.first().expect("document");
+    assert!(doc.fonts.iter().any(|f| f == "\u{4e80}") && doc.fonts.iter().any(|f| f == "\u{4e81}"), "{:?}", doc.fonts);
+}
diff --git a/crates/aep/tests/it/import.rs b/crates/aep/tests/it/import.rs
new file mode 100644
index 000000000..2535edcff
--- /dev/null
+++ b/crates/aep/tests/it/import.rs
@@ -0,0 +1,35 @@
+//! import tests of effectcraft-aep.
+
+#[macro_use]
+mod helpers;
+
+mod aepx;
+mod ai_mask;
+mod blend_modes;
+mod cameras;
+mod cases;
+mod combined;
+mod cryptomatte;
+mod ease_round2;
+mod effects;
+mod effects_batch5;
+mod effects_quickwins;
+mod effects_round2;
+mod effects_round3;
+mod effects_thirdparty;
+mod fx_inject;
+mod lumetri;
+mod markers;
+mod masks;
+mod mattes;
+mod puppet;
+mod resaved_defaults;
+mod robustness;
+mod shapes;
+mod shapes_round2;
+mod styles;
+mod synthetic;
+mod text;
+mod text_anim;
+mod timing;
+mod versions;
diff --git a/crates/aep/tests/it/import/aepx.rs b/crates/aep/tests/it/import/aepx.rs
new file mode 100644
index 000000000..5fe588803
--- /dev/null
+++ b/crates/aep/tests/it/import/aepx.rs
@@ -0,0 +1,95 @@
+//! Importing the `.aepx` of a project gives the same project and report as importing its `.aep`.
+//!
+//! The two files of the pair (`aepx-pair.aep` / `.aepx`, the cases 000, 058, 060, 110 and 124)
+//! hold the same chunk tree apart from the save counter in `head` (see
+//! `crates/aep/tests/it/container/aepx.rs`), which the importer does not read, so the results are
+//! equal, not only similar. The tests read the two whole files: a case cut from the `.aepx` would
+//! be written back as `.aep`.
+
+use effectcraft_aep::import::{AepImportError, ImportOptions, analyze, import};
+use effectcraft_project::Project;
+
+fn import_bytes(bytes: &[u8]) -> (Project, effectcraft_aep::import::ImportResult) {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut project, bytes, &opts).unwrap();
+    (project, r)
+}
+
+fn pair() -> Option<(Vec<u8>, Vec<u8>)> {
+    Some((crate::common::try_file("aepx-pair.aep")?, crate::common::try_file("aepx-pair.aepx")?))
+}
+
+#[test]
+fn aepx_imports_like_the_aep() {
+    let (aep, aepx) = skip!(pair());
+    assert!(effectcraft_aep::is_aepx(&aepx) && !effectcraft_aep::is_aepx(&aep));
+    let (pa, ra) = import_bytes(&aep);
+    let (px, rx) = import_bytes(&aepx);
+    assert_eq!(ra, rx, "import result and report");
+    assert_eq!(pa, px, "project");
+    assert_eq!(ra.comps.len(), 6, "the five case compositions and the precomposition of 124");
+    let none = |_: &str| false;
+    assert_eq!(analyze(&aep, &none).unwrap(), analyze(&aepx, &none).unwrap(), "dry run");
+}
+
+#[test]
+fn lossless_aepx_imports_without_allowing_losses() {
+    // The pair imports completely, so the refusal rule applies to `.aepx` as to `.aep`. The text
+    // layer of 110 is imported (with its Source Text), so it needs no `allow_losses` either.
+    let (_, aepx) = skip!(pair());
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, &aepx, &ImportOptions::new(&none)).unwrap();
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.imported.text_layers, 1);
+}
+
+#[test]
+fn damaged_aepx_is_an_error_not_a_panic() {
+    let (_, aepx) = skip!(pair());
+    let none = |_: &str| false;
+    for cut in (0..aepx.len()).step_by(4999) {
+        let _ = analyze(&aepx[..cut], &none);
+    }
+    let mut state = 0x9e37_79b9_u32;
+    for _ in 0..200 {
+        let mut damaged = aepx.clone();
+        state ^= state << 13;
+        state ^= state >> 17;
+        state ^= state << 5;
+        let at = state as usize % damaged.len();
+        damaged[at] = damaged[at].wrapping_add(1 + (state >> 24) as u8 % 7);
+        let _ = analyze(&damaged, &none);
+    }
+    assert!(matches!(analyze(b"<?xml version=\"1.0\"?><Other/>", &none), Err(AepImportError::Container(_))));
+    assert!(matches!(analyze(b"<AfterEffectsProject/>", &none), Err(AepImportError::NoProject)));
+}
+
+/// Every pair of the local corpus (not in the repository): `AEP_CORPUS=<folder> cargo test
+/// --release -p effectcraft-aep --test it import::aepx:: -- --ignored --nocapture`.
+#[test]
+#[ignore = "needs the local corpus (AEP_CORPUS)"]
+fn every_corpus_pair_imports_alike() {
+    let Ok(dir) = std::env::var("AEP_CORPUS") else { return };
+    let mut paths: Vec<_> =
+        std::fs::read_dir(&dir).unwrap().filter_map(|e| e.ok()).map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "aepx")).collect();
+    paths.sort();
+    let none = |_: &str| false;
+    let mut same = 0;
+    for x in &paths {
+        let aepx = std::fs::read(x).unwrap();
+        let aep = std::fs::read(x.with_extension("aep")).unwrap();
+        let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+        let (mut pa, mut px) = (Project::default(), Project::default());
+        let ra = import(&mut pa, &aep, &opts).map_err(|e| e.to_string());
+        let rx = import(&mut px, &aepx, &opts).map_err(|e| e.to_string());
+        if ra == rx && pa == px {
+            same += 1;
+        } else {
+            println!("{}: differs", x.display());
+        }
+    }
+    println!("{same} of {} pairs import alike", paths.len());
+}
diff --git a/crates/aep/tests/it/import/ai_mask.rs b/crates/aep/tests/it/import/ai_mask.rs
new file mode 100644
index 000000000..e5f57abe0
--- /dev/null
+++ b/crates/aep/tests/it/import/ai_mask.rs
@@ -0,0 +1,113 @@
+//! A placed Illustrator file with masks under two parented Nulls (#3099), against After Effects
+//! 2026's own read-back of the committed project `tests/fixtures/ai-mask-3099.aep` (generator:
+//! `tests/fixtures/tools/ai-mask-3099.py` and `ai-mask-3099.jsx`). Most of these guard After
+//! Effects' values the importer already read so (the drawing of the page is tested in
+//! `effectcraft-media` and the host's `vector_import` tests); the Anchor Point of the null left
+//! at its default (`[0, 0]`, not the centre) was wrong before #3099.
+//!
+//! The four `.ai` files are hand-written one-page PDFs with distinct page boxes. After Effects
+//! sized them by their ArtBox (a, d), by the MediaBox rounded up (b: 300.6 × 120.4 → 301 × 121)
+//! and ignored `/Rotate 90` (c). Composition `ai-mask` (1920 × 1080): `art` (a) and `artD` (d,
+//! Continuously Rasterize) are children of Null `N2`, itself a child of Null `N1`; both carry two
+//! rectangular masks; `artC` (c) is on its own.
+
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{ItemKind, Layer, Project};
+
+use crate::import::helpers::comp;
+
+const AI_MASK: &[u8] = include_bytes!("../../fixtures/ai-mask-3099.aep");
+
+/// The fixture imported into an empty project (losses allowed, no footage file present).
+fn load() -> (Project, effectcraft_aep::import::ImportResult) {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, AI_MASK, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    (project, r)
+}
+
+/// The first two components of the static value of property `path` of `l`.
+fn vec2(l: &Layer, path: &str) -> [f64; 2] {
+    let v = l.props.prop(path).unwrap_or_else(|| panic!("{}: {path}", l.name)).value.as_vec2();
+    [v[0], v[1]]
+}
+
+/// `a` and `b` agree within float32 noise.
+fn near(a: [f64; 2], b: [f64; 2]) -> bool {
+    (a[0] - b[0]).abs() < 1e-3 && (a[1] - b[1]).abs() < 1e-3
+}
+
+/// The four `.ai` items have After Effects' sizes and are placed pages.
+#[test]
+fn placed_ai_sizes_are_after_effects_sizes() {
+    let (p, _) = load();
+    let mut sizes: Vec<(String, (u32, u32))> = p
+        .items
+        .values()
+        .filter_map(|i| match &i.kind {
+            ItemKind::Footage(f) if f.path.ends_with(".ai") => {
+                // Framed and drawn as After Effects places the page (#3099).
+                assert!(f.placed_page, "{}", i.name);
+                Some((i.name.clone(), (f.width, f.height)))
+            }
+            _ => None,
+        })
+        .collect();
+    sizes.sort();
+    assert_eq!(
+        sizes,
+        [
+            ("i3099-a-boxes.ai".to_string(), (241, 121)),
+            ("i3099-b-frac.ai".to_string(), (301, 121)),
+            ("i3099-c-rot.ai".to_string(), (300, 100)),
+            ("i3099-d-trim.ai".to_string(), (210, 120)),
+        ]
+    );
+}
+
+/// Parents, transforms (the default null anchor at `[0, 0]`) and both masks of each art layer
+/// as After Effects read them back.
+#[test]
+fn masks_anchors_and_parents_are_after_effects_values() {
+    let (p, r) = load();
+    let (_, c) = comp(&p, &r, "ai-mask");
+    let layer = |name: &str| c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("no layer {name}"));
+    let (art, art_d, art_c, n1, n2) = (layer("art"), layer("artD"), layer("artC"), layer("N1"), layer("N2"));
+    // Parents: art, artD -> N2 -> N1.
+    assert_eq!(art.parent, Some(n2.id));
+    assert_eq!(art_d.parent, Some(n2.id));
+    assert_eq!(n2.parent, Some(n1.id));
+    assert_eq!(n1.parent, None);
+    assert_eq!(art_c.parent, None);
+    // Transforms as After Effects read them back (anchor = half the source size for footage).
+    for (l, anchor, position, scale) in [
+        (art, [120.5, 60.5], [0.0, 0.0], [100.0, 100.0]),
+        (art_d, [105.0, 60.0], [300.0, 250.0], [100.0, 100.0]),
+        (art_c, [150.0, 50.0], [1500.0, 800.0], [100.0, 100.0]),
+        (n1, [0.0, 0.0], [700.0, 400.0], [80.0, 120.0]),
+        (n2, [10.0, 20.0], [50.0, -30.0], [150.0, 150.0]),
+    ] {
+        assert!(near(vec2(l, "transform/anchor"), anchor), "{} anchor {:?}", l.name, vec2(l, "transform/anchor"));
+        assert!(near(vec2(l, "transform/position"), position), "{} position {:?}", l.name, vec2(l, "transform/position"));
+        assert!(near(vec2(l, "transform/scale"), scale), "{} scale {:?}", l.name, vec2(l, "transform/scale"));
+    }
+    match n1.props.prop("transform/rotation").map(|p| &p.value) {
+        Some(Value::Scalar(v)) => assert!((v - 15.0).abs() < 1e-9, "N1 rotation {v}"),
+        other => panic!("N1 rotation {other:?}"),
+    }
+    // Both art layers: M1 (40, 30)-(200, 90) and M2 (220, 100)-(350, 160) in layer pixels, the
+    // second reaching past the layer, as After Effects read the vertices back.
+    let rects = [[[40.0, 30.0], [200.0, 30.0], [200.0, 90.0], [40.0, 90.0]], [[220.0, 100.0], [350.0, 100.0], [350.0, 160.0], [220.0, 160.0]]];
+    for l in [art, art_d] {
+        let masks: Vec<_> = l.masks().expect("masks").groups().collect();
+        assert_eq!(masks.len(), 2, "{}", l.name);
+        for (m, want) in masks.iter().zip(&rects) {
+            let Some(Value::Path(path)) = m.get("path").map(|p| &p.value) else { panic!("{}: {} has no path", l.name, m.name) };
+            assert_eq!(path.vertices.len(), 4, "{}: {}", l.name, m.name);
+            for (v, w) in path.vertices.iter().zip(want) {
+                assert!(near(*v, *w), "{}: {} vertex {v:?} != {w:?}", l.name, m.name);
+            }
+        }
+    }
+}
diff --git a/crates/aep/tests/it/import/blend_modes.rs b/crates/aep/tests/it/import/blend_modes.rs
new file mode 100644
index 000000000..2caecb932
--- /dev/null
+++ b/crates/aep/tests/it/import/blend_modes.rs
@@ -0,0 +1,87 @@
+//! Blend modes beyond the six of batch 1: 906 (13 solids over a test image, each with a mode set
+//! by name) and the codes of 907 (each rendered by After Effects and matched against EffectCraft's
+//! modes), here written into 906's top layer.
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{ImportOptions, LossCategory, import};
+use effectcraft_color::BlendMode;
+use effectcraft_project::Project;
+
+const F906: &str = "906-blendmodes-13-solids-on-steps.aep";
+
+#[test]
+fn the_13_modes_of_906_import_lossless() {
+    let (p, r) = load!(F906);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    let mode = |name: &str| c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("{name}")).blend_mode;
+    for (name, want) in [
+        ("normal", BlendMode::Normal),
+        ("add", BlendMode::Add),
+        ("multiply", BlendMode::Multiply),
+        ("screen", BlendMode::Screen),
+        ("overlay", BlendMode::Overlay),
+        ("softLight", BlendMode::SoftLight),
+        ("hardLight", BlendMode::HardLight),
+        ("difference", BlendMode::Difference),
+        ("exclusion", BlendMode::Exclusion),
+        ("colorDodge", BlendMode::ColorDodge),
+        ("colorBurn", BlendMode::ColorBurn),
+        ("darken", BlendMode::Darken),
+        ("lighten", BlendMode::Lighten),
+    ] {
+        assert_eq!(mode(name), want, "{name}");
+    }
+}
+
+/// 906 with the top layer's code (`ldta` byte 99 of the first layer in the file) replaced.
+fn with_code(code: u8) -> Option<(Project, effectcraft_aep::import::ImportResult)> {
+    Some({
+        let mut b = crate::common::try_fixture(F906)?;
+        let at = b.windows(4).position(|w| w == b"ldta").expect("ldta") + 8 + 99;
+        assert_eq!(b[at], 11, "the top layer is Lighten");
+        b[at] = code;
+        let none = |_: &str| false;
+        let mut p = Project::default();
+        let r = import(&mut p, &b, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("imports");
+        (p, r)
+    })
+}
+
+#[test]
+fn the_codes_of_907_map_to_their_modes() {
+    for (code, want) in [
+        (12, BlendMode::ClassicDifference),
+        (13, BlendMode::Hue),
+        (14, BlendMode::Saturation),
+        (15, BlendMode::Color),
+        (16, BlendMode::Luminosity),
+        (17, BlendMode::StencilAlpha),
+        (18, BlendMode::StencilLuma),
+        (19, BlendMode::SilhouetteAlpha),
+        (20, BlendMode::SilhouetteLuma),
+        (23, BlendMode::ClassicColorDodge),
+        (24, BlendMode::ClassicColorBurn),
+        (29, BlendMode::LinearDodge),
+        (30, BlendMode::LinearBurn),
+        (31, BlendMode::LinearLight),
+        (32, BlendMode::VividLight),
+        (33, BlendMode::PinLight),
+        (34, BlendMode::HardMix),
+    ] {
+        let (p, r) = skip!(with_code(code));
+        assert!(r.report.is_lossless(), "{code}: {:?}", r.report.losses);
+        let (_, c) = comp(&p, &r, "C");
+        assert_eq!(c.layers.iter().find(|l| l.name == "lighten").unwrap().blend_mode, want, "{code}");
+    }
+}
+
+#[test]
+fn unsampled_and_ambiguous_codes_stay_reported() {
+    for code in [0u8, 1, 3, 21, 22, 35, 200, 255] {
+        let (p, r) = skip!(with_code(code));
+        assert_eq!(r.report.count(LossCategory::BlendModes), 1, "{code}");
+        let (_, c) = comp(&p, &r, "C");
+        assert_eq!(c.layers.iter().find(|l| l.name == "lighten").unwrap().blend_mode, BlendMode::Normal, "{code}");
+    }
+}
diff --git a/crates/aep/tests/it/import/cameras.rs b/crates/aep/tests/it/import/cameras.rs
new file mode 100644
index 000000000..863f8bee1
--- /dev/null
+++ b/crates/aep/tests/it/import/cameras.rs
@@ -0,0 +1,92 @@
+//! Cameras, lights and the 3D rotations (251-256, 341-345, 485-488, 535-537).
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{AutoOrient, Layer, LayerSource, LightKind, Project};
+
+/// Imports without losses and returns layer `name` of comp C.
+fn layer(file: &str, name: &str) -> Option<Layer> {
+    Some({
+        let mut p = Project::default();
+        let r = crate::import::helpers::try_import_fixture(&mut p, file, false)?.unwrap_or_else(|e| panic!("{file}: lossless import refused: {e}"));
+        let (_, c) = comp(&p, &r, "C");
+        c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("{file}: no layer {name}")).clone()
+    })
+}
+
+fn v(l: &Layer, path: &str) -> Value {
+    l.props.prop(path).unwrap_or_else(|| panic!("no {path}")).value.clone()
+}
+
+fn close(a: &Value, b: &[f64]) {
+    let c = a.components();
+    assert_eq!(c.len(), b.len(), "{a:?}");
+    for (x, y) in c.iter().zip(b) {
+        assert!((x - y).abs() < 1e-3, "{a:?} != {b:?}");
+    }
+}
+
+#[test]
+fn rotations_and_orientation_of_a_3d_layer() {
+    let l = skip!(layer("486-layer-3d-rotx-30.aep", "L"));
+    assert!(l.switches.three_d);
+    close(&v(&l, "transform/rotationX"), &[30.0]);
+    close(&v(&l, "transform/rotationY"), &[0.0]);
+    close(&v(&skip!(layer("487-layer-3d-roty-45.aep", "L")), "transform/rotationY"), &[45.0]);
+    close(&v(&skip!(layer("488-layer-3d-orientation-10-20-30.aep", "L")), "transform/orientation"), &[10.0, 20.0, 30.0]);
+    close(&v(&skip!(layer("485-layer-3d-on.aep", "L")), "transform/orientation"), &[0.0, 0.0, 0.0]);
+}
+
+#[test]
+fn cameras() {
+    // 256: default two-node camera: point of interest at the centre, the auto Position as After
+    // Effects reports it, Zoom = Focus Distance = 2666.67, Aperture 25.309.
+    let c = skip!(layer("256-camera-two-node-default.aep", "Camera 1"));
+    assert!(matches!(c.source, LayerSource::Camera));
+    assert_eq!(c.auto_orient, AutoOrient::TowardsPointOfInterest);
+    close(&v(&c, "transform/poi"), &[960.0, 540.0, 0.0]);
+    close(&v(&c, "transform/position"), &[0.0, 0.0, -2666.6667]);
+    close(&v(&c, "cameraOptions/zoom"), &[2666.6667]);
+    close(&v(&c, "cameraOptions/focusDistance"), &[2666.6667]);
+    close(&v(&c, "cameraOptions/aperture"), &[25.3093]);
+    assert_eq!(v(&c, "cameraOptions/dof"), Value::Bool(false));
+    // 251: one-node camera.
+    assert_eq!(skip!(layer("251-camera-one-node.aep", "Camera 1")).auto_orient, AutoOrient::Off);
+    // 253: position set by the user.
+    close(&v(&skip!(layer("253-camera-position-100-200-m1000.aep", "Camera 1")), "transform/position"), &[100.0, 200.0, -1000.0]);
+    // 341, 342: zoom, depth of field.
+    close(&v(&skip!(layer("341-camera-zoom-2000.aep", "Camera 1")), "cameraOptions/zoom"), &[2000.0]);
+    let c = skip!(layer("342-camera-dof-800-30.aep", "Camera 1"));
+    assert_eq!(v(&c, "cameraOptions/dof"), Value::Bool(true));
+    close(&v(&c, "cameraOptions/focusDistance"), &[800.0]);
+    close(&v(&c, "cameraOptions/aperture"), &[30.0]);
+    // 535-537: a camera above the 3D solid of 486.
+    let c = skip!(layer("535-camera-position-on-3d-rotx.aep", "K"));
+    close(&v(&c, "transform/position"), &[100.0, 200.0, -1000.0]);
+    assert_eq!(c.auto_orient, AutoOrient::TowardsPointOfInterest);
+    assert_eq!(skip!(layer("536-camera-one-node-position-on-3d-rotx.aep", "K")).auto_orient, AutoOrient::Off);
+}
+
+#[test]
+fn spot_and_point_lights() {
+    let l = skip!(layer("254-light-spot-intensity-50.aep", "Light 1"));
+    assert!(matches!(l.source, LayerSource::Light { kind: LightKind::Spot }));
+    close(&v(&l, "lightOptions/intensity"), &[50.0]);
+    close(&v(&l, "transform/poi"), &[960.0, 540.0, 0.0]);
+    close(&v(&l, "transform/position"), &[0.0, 0.0, -1333.3333]);
+    assert_eq!(l.auto_orient, AutoOrient::TowardsPointOfInterest);
+    close(&v(&skip!(layer("343-light-spot-color-red.aep", "Light 1")), "lightOptions/color"), &[1.0, 0.0, 0.0, 1.0]);
+    close(&v(&skip!(layer("344-light-spot-coneangle-60.aep", "Light 1")), "lightOptions/coneAngle"), &[60.0]);
+    close(&v(&skip!(layer("345-light-spot-conefeather-30.aep", "Light 1")), "lightOptions/coneFeather"), &[30.0]);
+    // 252: a point light stores its cone as default-state records, which hold nothing.
+    let l = skip!(layer("252-light-point.aep", "Light 1"));
+    assert!(matches!(l.source, LayerSource::Light { kind: LightKind::Point }));
+    close(&v(&l, "lightOptions/intensity"), &[100.0]);
+    assert_eq!(l.auto_orient, AutoOrient::Off);
+}
+
+#[test]
+fn cameras_count_in_the_report() {
+    let (_, r) = load!("537-camera-default-on-3d-rotx.aep");
+    assert_eq!((r.report.imported.cameras, r.report.imported.lights, r.report.total_losses()), (1, 0, 0));
+}
diff --git a/crates/aep/tests/it/import/cases.rs b/crates/aep/tests/it/import/cases.rs
new file mode 100644
index 000000000..4f98f95d8
--- /dev/null
+++ b/crates/aep/tests/it/import/cases.rs
@@ -0,0 +1,736 @@
+//! The importer against the synthetic fixtures of `effectcraft-aep` (one change per file on top of
+//! composition `C`: 1920x1080 at 25 fps, 5 s, with one red solid layer `L`).
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{AepImportError, ImportReport, LossCategory, analyze};
+use effectcraft_color::{BlendMode, Label};
+use effectcraft_keyframe::{Ease, Interp, Value};
+use effectcraft_project::{Comp, FootageKind, ItemKind, Layer, LayerSource, Project, Quality, Renderer};
+use effectcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
+
+const SEC: i64 = TICKS_PER_SECOND;
+
+fn secs(s: f64) -> Tick {
+    Tick((s * SEC as f64).round() as i64)
+}
+
+fn layer<'c>(c: &'c Comp, name: &str) -> &'c Layer {
+    c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("no layer {name}"))
+}
+
+fn only_layer(project: &Project, r: &effectcraft_aep::import::ImportResult) -> Layer {
+    let (_, c) = comp(project, r, "C");
+    layer(c, "L").clone()
+}
+
+fn value(l: &Layer, path: &str) -> Value {
+    l.props.prop(path).unwrap_or_else(|| panic!("no property {path}")).value.clone()
+}
+
+fn vec3(l: &Layer, path: &str) -> [f64; 3] {
+    match value(l, path) {
+        Value::Vec3(v) => v,
+        other => panic!("{path}: {other:?}"),
+    }
+}
+
+fn scalar(l: &Layer, path: &str) -> f64 {
+    match value(l, path) {
+        Value::Scalar(v) => v,
+        other => panic!("{path}: {other:?}"),
+    }
+}
+
+fn close(a: f64, b: f64) {
+    assert!((a - b).abs() < 1e-9, "{a} != {b}");
+}
+
+fn close3(a: [f64; 3], b: [f64; 3]) {
+    for (x, y) in a.iter().zip(b) {
+        close(*x, y);
+    }
+}
+
+// ---------------------------------------------------------------- items and composition
+
+#[test]
+fn base_project_items_comp_and_layer() {
+    let (p, r) = load!("000-base.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    // The wrapper folder, then Solids (folder), the solid L and the composition C inside it.
+    let root = p.item(r.folder).unwrap();
+    assert_eq!((root.name.as_str(), root.parent), ("After Effects Project", None));
+    assert_eq!(r.items.len(), 4);
+    let solids = p.children(Some(r.folder)).into_iter().find(|i| i.name == "Solids").unwrap();
+    assert!(solids.is_folder());
+    let kids = p.children(Some(solids.id));
+    assert_eq!(kids.len(), 1);
+    match &kids[0].kind {
+        ItemKind::Solid(s) => assert_eq!((kids[0].name.as_str(), s.color, s.width, s.height), ("L", [1.0, 0.0, 0.0], 1920, 1080)),
+        other => panic!("{other:?}"),
+    }
+    let im = &r.report.imported;
+    assert_eq!((im.folders, im.compositions, im.solids, im.layers, im.solid_layers, im.keyframes), (1, 1, 1, 1, 1, 0));
+
+    let (id, c) = comp(&p, &r, "C");
+    assert_eq!(p.item(id).unwrap().parent, Some(r.folder));
+    assert_eq!((c.width, c.height), (1920, 1080));
+    assert_eq!(c.frame_rate, FrameRate::new(25, 1));
+    assert_eq!(c.duration, Tick(5 * SEC));
+    assert_eq!(c.work_area, (Tick::ZERO, Tick(5 * SEC)));
+    assert_eq!(c.background, [0.0, 0.0, 0.0]);
+    assert_eq!((c.pixel_aspect, c.shutter_angle, c.enable_motion_blur, c.renderer), (1.0, 180.0, false, Renderer::Classic3D));
+    assert_eq!(c.layers.len(), 1);
+
+    let l = &c.layers[0];
+    assert_eq!(l.name, "L");
+    assert!(matches!(l.source, LayerSource::Solid { .. }));
+    assert_eq!((l.in_point, l.out_point, l.start_time, l.stretch), (Tick::ZERO, Tick(5 * SEC), Tick::ZERO, 100.0));
+    assert_eq!((l.switches.video, l.switches.audio, l.switches.effects), (true, true, true));
+    assert_eq!((l.switches.solo, l.switches.locked, l.switches.shy, l.switches.three_d, l.switches.adjustment), (false, false, false, false, false));
+    assert_eq!((l.blend_mode, l.parent, l.label), (BlendMode::Normal, None, Label::Red));
+    // Absent properties are the defaults: centred position and anchor, 100 %.
+    close3(vec3(l, "transform/position"), [960.0, 540.0, 0.0]);
+    close3(vec3(l, "transform/anchor"), [960.0, 540.0, 0.0]);
+    close3(vec3(l, "transform/scale"), [100.0, 100.0, 100.0]);
+    close(scalar(l, "transform/rotation"), 0.0);
+    close(scalar(l, "transform/opacity"), 100.0);
+}
+
+#[test]
+fn empty_project_imports_just_the_folder() {
+    let (p, r) = load!("001-empty.aep");
+    assert!(r.comps.is_empty());
+    assert!(p.item(r.folder).unwrap().is_folder());
+    assert!(r.report.is_lossless());
+}
+
+#[test]
+fn imports_into_an_existing_project_without_touching_it() {
+    let mut p = Project::default();
+    let first = try_import!(&mut p, "000-base.aep", false).unwrap();
+    let before = p.items.len();
+    let second = try_import!(&mut p, "000-base.aep", false).unwrap();
+    assert_eq!(p.items.len(), before * 2);
+    assert_ne!(first.folder, second.folder);
+    // Layer, item and property ids stay unique across both imports.
+    let ids: Vec<_> = [&first, &second].iter().flat_map(|r| r.comps.iter().filter_map(|c| p.comp(*c)).flat_map(|c| c.layers.iter().map(|l| l.id))).collect();
+    assert_eq!(ids.len(), 2);
+    assert_ne!(ids[0], ids[1]);
+}
+
+#[test]
+fn composition_settings() {
+    let cases: [(&str, &dyn Fn(&Comp)); 10] = [
+        ("030-comp-size-1280x720.aep", &|c| {
+            assert_eq!((c.width, c.height), (1280, 720));
+        }),
+        ("031-comp-fps30.aep", &|c| assert_eq!(c.frame_rate, FrameRate::new(30, 1))),
+        ("032-comp-duration10.aep", &|c| {
+            assert_eq!(c.duration, Tick(10 * SEC));
+            assert_eq!(c.work_area, (Tick::ZERO, Tick(10 * SEC)));
+        }),
+        ("033-comp-bg-green.aep", &|c| assert_ne!(c.background, [0.0, 0.0, 0.0])),
+        ("034-comp-shutter90.aep", &|c| {
+            assert_eq!(c.shutter_angle, 90.0);
+            // The stored phase (0 in this file), not an assumed centring.
+            assert_eq!(c.shutter_phase, 0.0);
+        }),
+        ("035-comp-workarea-1-2.aep", &|c| assert_eq!(c.work_area, (Tick(SEC), Tick(3 * SEC)))),
+        ("037-comp-pixelaspect2.aep", &|c| assert_eq!(c.pixel_aspect, 2.0)),
+        ("038-comp-motionblur.aep", &|c| assert!(c.enable_motion_blur)),
+        ("039-comp-renderer-advanced3d.aep", &|c| assert_eq!(c.renderer, Renderer::Advanced3D)),
+        ("231-comp-bg-grey-0.5.aep", &|c| assert_eq!(c.background, [128.0 / 255.0; 3])),
+    ];
+    for (name, check) in cases {
+        let (p, r) = load!(name);
+        let (_, c) = comp(&p, &r, "C");
+        check(c);
+    }
+    // Green: 0, 1, 0 up to the 8-bit storage.
+    let (p, r) = load!("033-comp-bg-green.aep");
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.background[0], 0.0);
+    assert!(c.background[1] > 0.4, "{:?}", c.background);
+}
+
+#[test]
+fn resized_comp_keeps_the_stored_position() {
+    // The comp was resized without moving the layer: After Effects then stores the old centre,
+    // while a layer still at the default sits at the new centre.
+    let (p, r) = load!("030-comp-size-1280x720.aep");
+    let l = only_layer(&p, &r);
+    close3(vec3(&l, "transform/position"), [960.0, 540.0, 0.0]);
+}
+
+#[test]
+fn ntsc_frame_rates_are_exact() {
+    let (p, r) = load!("229-comp-fps-29.97.aep");
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.frame_rate, FrameRate::FPS_29_97);
+    // 120000 units of 1/23976 s: 150 frames, 5.005 s, and a whole number of frames.
+    assert_eq!(c.duration, FrameRate::FPS_29_97.tick_of(150));
+    assert_eq!(c.frame_rate.frame_at(c.duration), 150);
+    assert_eq!(c.work_area, (Tick::ZERO, c.duration));
+
+    let (p, r) = load!("230-comp-fps-23.976.aep");
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.frame_rate, FrameRate::FPS_23_976);
+    assert_eq!(c.duration, FrameRate::FPS_23_976.tick_of(120));
+    assert_eq!(c.frame_rate.frame_at(c.duration), 120);
+}
+
+// ---------------------------------------------------------------- layers
+
+#[test]
+fn layer_switches_timing_and_blend() {
+    let sw = |name: &str| {
+        Some({
+            let (p, r) = crate::import::helpers::try_load(name)?;
+            comp(&p, &r, "C").1.layers[0].clone()
+        })
+    };
+    assert!(skip!(sw("012-layer-shy.aep")).switches.shy);
+    assert!(skip!(sw("013-layer-locked.aep")).switches.locked);
+    assert!(skip!(sw("014-layer-solo.aep")).switches.solo);
+    assert!(skip!(sw("015-layer-3d.aep")).switches.three_d);
+    assert!(skip!(sw("017-layer-motionblur.aep")).switches.motion_blur);
+    assert!(skip!(sw("024-layer-collapse.aep")).switches.collapse);
+    assert!(skip!(sw("025-layer-adjustment.aep")).switches.adjustment);
+    assert!(skip!(sw("026-layer-guide.aep")).switches.guide);
+    assert_eq!(skip!(sw("023-layer-quality-draft.aep")).switches.quality, Quality::Draft);
+    assert!(!skip!(sw("222-layer-video-off.aep")).switches.video);
+    assert!(!skip!(sw("223-layer-audio-off.aep")).switches.audio);
+    assert!(!skip!(sw("224-layer-effects-off.aep")).switches.effects);
+    assert_eq!(skip!(sw("010-layer-name.aep")).name, "Renamed");
+
+    for (name, mode) in [
+        ("016-layer-blend-multiply.aep", BlendMode::Multiply),
+        ("225-layer-blend-screen.aep", BlendMode::Screen),
+        ("226-layer-blend-add.aep", BlendMode::Add),
+        ("227-layer-blend-overlay.aep", BlendMode::Overlay),
+        ("228-layer-blend-difference.aep", BlendMode::Difference),
+    ] {
+        assert_eq!(skip!(sw(name)).blend_mode, mode, "{name}");
+    }
+
+    // Stretch 200 %: the out point is the start plus the relative out point times the stretch.
+    let l = skip!(sw("018-layer-stretch200.aep"));
+    assert_eq!((l.stretch, l.in_point, l.out_point), (200.0, Tick::ZERO, Tick(10 * SEC)));
+    // In point 1 s, out 6 s.
+    let l = skip!(sw("019-layer-inpoint1.aep"));
+    assert_eq!((l.in_point, l.out_point, l.start_time), (Tick(SEC), Tick(6 * SEC), Tick::ZERO));
+    // Start time 0.5 s moves the whole span.
+    let l = skip!(sw("021-layer-starttime0.5.aep"));
+    assert_eq!((l.start_time, l.in_point, l.out_point), (Tick(SEC / 2), Tick(SEC / 2), secs(5.5)));
+}
+
+#[test]
+fn null_layer_and_parent() {
+    let (p, r) = load!("022-layer-parent-null.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.layers.len(), 2);
+    let null = layer(c, "Null");
+    let child = layer(c, "L");
+    assert!(matches!(null.source, LayerSource::Null));
+    assert_eq!(child.parent, Some(null.id));
+    assert_eq!(null.parent, None);
+    close3(vec3(child, "transform/position"), [0.0, 0.0, 0.0]);
+    // The null's placeholder solid is not an item: only L's solid exists.
+    let solids = p.items.values().filter(|i| matches!(i.kind, ItemKind::Solid(_))).count();
+    assert_eq!(solids, 1);
+    let im = &r.report.imported;
+    assert_eq!((im.layers, im.null_layers, im.solid_layers), (2, 1, 1));
+}
+
+#[test]
+fn adjustment_layer_is_counted() {
+    let (_, r) = load!("025-layer-adjustment.aep");
+    let im = &r.report.imported;
+    assert_eq!((im.adjustment_layers, im.solid_layers), (1, 0));
+}
+
+#[test]
+fn solid_colour_and_size_and_anchor_scaling() {
+    let (p, r) = load!("259-solid-blue-0-0-1.aep");
+    assert!(p.items.values().any(|i| matches!(&i.kind, ItemKind::Solid(s) if s.color == [0.0, 0.0, 1.0])));
+    // A 400x300 solid with Anchor Point 100, 50 stores 0.25, 1/6: back to pixels.
+    let (p, r2) = load!("212-anchor-400x300-solid-100-50.aep");
+    let (_, c) = comp(&p, &r2, "C");
+    let s400 = layer(c, "S400");
+    close3(vec3(s400, "transform/anchor"), [100.0, 50.0, 0.0]);
+    // The 100x100 solid anchor 10, 20.
+    let (p, r3) = load!("211-anchor-100x100-solid-10-20.aep");
+    let (_, c) = comp(&p, &r3, "C");
+    let l = c.layers.iter().find(|l| vec3(l, "transform/anchor")[0] < 50.0).unwrap();
+    close3(vec3(l, "transform/anchor"), [10.0, 20.0, 0.0]);
+    let _ = r;
+}
+
+#[test]
+fn precomposition_layer_links_the_comp() {
+    let (p, r) = load!("124-precomp-Pre.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (pre_id, pre) = comp(&p, &r, "Pre");
+    assert_eq!(pre.layers.len(), 1);
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.layers.len(), 1);
+    assert_eq!(c.layers[0].name, "Pre");
+    assert_eq!(c.layers[0].source, LayerSource::Comp { item: pre_id });
+    assert_eq!(r.report.imported.precomp_layers, 1);
+    assert_eq!(c.layers[0].label, Label::Sandstone);
+}
+
+#[test]
+fn footage_is_a_placeholder_unless_the_file_exists() {
+    let (p, r) = load!("126-footage-png-layer.aep");
+    assert!(r.report.is_lossless());
+    assert_eq!(r.report.missing_footage, ["C:\\fixtures\\dirdirdirdirdirdirdi\\test8x8.png"]);
+    let item = p.items.values().find(|i| i.name == "test8x8.png").unwrap();
+    match &item.kind {
+        ItemKind::Footage(f) => {
+            assert_eq!(
+                (f.path.as_str(), f.width, f.height, f.missing, f.kind),
+                ("C:\\fixtures\\dirdirdirdirdirdirdi\\test8x8.png", 8, 8, true, FootageKind::Still)
+            )
+        }
+        other => panic!("{other:?}"),
+    }
+    let (_, c) = comp(&p, &r, "C");
+    let l = layer(c, "png");
+    assert_eq!(l.source, LayerSource::Footage { item: item.id });
+    assert_eq!(r.report.imported.footage_layers, 1);
+
+    // With the file present the item is linked, not missing, and the report lists nothing missing.
+    let mut project = Project::default();
+    let bytes = fixture!("126-footage-png-layer.aep");
+    let exists = |path: &str| path.ends_with("test8x8.png");
+    let opts = effectcraft_aep::import::ImportOptions::new(&exists);
+    let r = effectcraft_aep::import::import(&mut project, &bytes, &opts).unwrap();
+    assert!(r.report.missing_footage.is_empty());
+    let item = project.items.values().find(|i| i.name == "test8x8.png").unwrap();
+    assert!(matches!(&item.kind, ItemKind::Footage(f) if !f.missing));
+}
+
+// ---------------------------------------------------------------- transform values
+
+#[test]
+fn static_transform_values_have_the_right_units() {
+    let l = |n: &str| {
+        Some({
+            let (p, r) = crate::import::helpers::try_load(n)?;
+            only_layer(&p, &r)
+        })
+    };
+    let a = skip!(l("040-static-position-100-200.aep"));
+    close3(vec3(&a, "transform/position"), [100.0, 200.0, 0.0]);
+    assert!(a.props.prop("transform/position").unwrap().keys.is_empty());
+    close3(vec3(&skip!(l("041-static-scale-50.aep")), "transform/scale"), [50.0, 50.0, 100.0]);
+    close(scalar(&skip!(l("042-static-rotation-45.aep")), "transform/rotation"), 45.0);
+    close(scalar(&skip!(l("043-static-opacity-25.aep")), "transform/opacity"), 25.0);
+    // 10, 20 on a 1920x1080 solid is stored as 10/1920, 20/1080.
+    close3(vec3(&skip!(l("044-static-anchor-10-20.aep")), "transform/anchor"), [10.0, 20.0, 0.0]);
+}
+
+#[test]
+fn position_keys_with_time_value_and_interpolation() {
+    let (p, r) = load!("055-key-position-3key-inserted-t2.5.aep");
+    let l = only_layer(&p, &r);
+    let pos = l.props.prop("transform/position").unwrap();
+    assert_eq!(pos.keys.len(), 3);
+    assert_eq!(r.report.imported.keyframes, 3);
+    let times: Vec<Tick> = pos.keys.iter().map(|k| k.time).collect();
+    assert_eq!(times, [Tick::ZERO, Tick(SEC), secs(2.5)]);
+    let values: Vec<[f64; 3]> = pos.keys.iter().map(|k| if let Value::Vec3(v) = k.value { v } else { [f64::NAN; 3] }).collect();
+    assert_eq!(values, [[0.0, 0.0, 0.0], [100.0, 0.0, 0.0], [200.0, 100.0, 0.0]]);
+    assert!(pos.keys.iter().all(|k| k.in_interp == Interp::Linear && k.out_interp == Interp::Linear));
+    // Automatic spatial tangents.
+    assert!(pos.keys.iter().all(|k| k.spatial_auto));
+    // Values at the key times are exact.
+    for (k, want) in pos.keys.iter().zip(&values) {
+        assert_eq!(pos.value_at(k.time), Value::Vec3(*want));
+    }
+    // The static value follows the first key.
+    close3(vec3(&l, "transform/position"), [0.0, 0.0, 0.0]);
+}
+
+#[test]
+fn spatial_tangents_and_hold_keys() {
+    let (p, r) = load!("054-key-position-2key-spatial-bezier.aep");
+    let l = only_layer(&p, &r);
+    let pos = l.props.prop("transform/position").unwrap();
+    assert_eq!(pos.keys.len(), 2);
+    assert!(!pos.keys[0].spatial_auto && !pos.keys[1].spatial_auto);
+    assert_eq!(pos.keys[0].spatial_out, [30.0, 60.0, 0.0]);
+    assert_eq!(pos.keys[1].spatial_in, [-30.0, -60.0, 0.0]);
+
+    let (p, r) = load!("053-key-position-2key-hold-key1.aep");
+    let pos = only_layer(&p, &r).props.prop("transform/position").unwrap().clone();
+    assert_eq!(pos.keys.len(), 2);
+    assert_eq!((pos.keys[0].out_interp, pos.keys[1].in_interp), (Interp::Hold, Interp::Linear));
+    // Held until the second key.
+    let mid = Tick((pos.keys[0].time.0 + pos.keys[1].time.0) / 2);
+    assert_eq!(pos.value_at(mid), pos.keys[0].value);
+
+    let (p, r) = load!("202-key-out-hold-in-linear.aep");
+    let pos = only_layer(&p, &r).props.prop("transform/position").unwrap().clone();
+    assert_eq!((pos.keys[0].out_interp, pos.keys[1].in_interp), (Interp::Hold, Interp::Linear));
+    let (p, r) = load!("203-key-in-hold-out-linear.aep");
+    let pos = only_layer(&p, &r).props.prop("transform/position").unwrap().clone();
+    assert_eq!((pos.keys[0].in_interp, pos.keys[0].out_interp), (Interp::Hold, Interp::Linear));
+}
+
+#[test]
+fn ease_speed_and_influence() {
+    // Position: pixels per second, kept as stored; the first key's in and the last key's out are
+    // meaningless and dropped.
+    let (p, r) = load!("204-key-ease-asymmetric.aep");
+    let pos = only_layer(&p, &r).props.prop("transform/position").unwrap().clone();
+    assert_eq!((pos.keys[0].in_interp, pos.keys[0].out_interp), (Interp::Bezier, Interp::Bezier));
+    assert_eq!(pos.keys[0].out_ease, [Ease { speed: 50.0, influence: 0.8 }]);
+    assert_eq!(pos.keys[1].in_ease, [Ease { speed: 7.0, influence: 0.6 }]);
+    assert!(pos.keys[0].in_ease.is_empty() && pos.keys[1].out_ease.is_empty());
+
+    // Opacity: stored per second as a fraction, here in percent (x 100).
+    let (p, r) = load!("205-key-opacity-ease-asymmetric.aep");
+    let op = only_layer(&p, &r).props.prop("transform/opacity").unwrap().clone();
+    assert_eq!(op.keys.len(), 2);
+    assert_eq!((op.keys[0].time, op.keys[1].time), (Tick::ZERO, Tick(2 * SEC)));
+    assert_eq!((op.keys[0].value.clone(), op.keys[1].value.clone()), (Value::Scalar(0.0), Value::Scalar(100.0)));
+    let e0 = op.keys[0].out_ease[0];
+    let e1 = op.keys[1].in_ease[0];
+    close(e0.speed, 20.0);
+    close(e0.influence, 0.8);
+    close(e1.speed, 30.0);
+    close(e1.influence, 0.6);
+    assert_eq!(op.value_at(Tick::ZERO), Value::Scalar(0.0));
+    assert_eq!(op.value_at(Tick(2 * SEC)), Value::Scalar(100.0));
+
+    let (p, r) = load!("058-key-opacity-2key.aep");
+    let op = only_layer(&p, &r).props.prop("transform/opacity").unwrap().clone();
+    assert_eq!(op.keys.len(), 2);
+}
+
+#[test]
+fn scale_keys_are_percent() {
+    let (p, r) = load!("206-key-scale-2key-linear.aep");
+    let s = only_layer(&p, &r).props.prop("transform/scale").unwrap().clone();
+    assert_eq!(s.keys.len(), 2);
+    assert_eq!(s.keys[0].value, Value::Vec3([100.0, 100.0, 100.0]));
+    assert_eq!(s.keys[1].value, Value::Vec3([200.0, 150.0, 100.0]));
+    assert_eq!(s.keys[1].time, Tick(SEC));
+    assert!(s.keys.iter().all(|k| k.in_interp == Interp::Linear && k.out_interp == Interp::Linear));
+}
+
+#[test]
+fn roving_and_labelled_keys() {
+    let (p, r) = load!("056-key-position-3key-roving-key2.aep");
+    let pos = only_layer(&p, &r).props.prop("transform/position").unwrap().clone();
+    assert!(pos.keys[1].roving && !pos.keys[0].roving);
+    // Roving moved the key to 1.0355078125 s.
+    assert_eq!(pos.keys[1].time, secs(1.0355078125));
+    let (p, r) = load!("057-key-position-3key-label9-key2.aep");
+    let pos = only_layer(&p, &r).props.prop("transform/position").unwrap().clone();
+    assert_eq!(pos.keys[1].label, 9);
+    assert_eq!(pos.keys[0].label, 0);
+}
+
+#[test]
+fn expressions_keep_source_and_enable_switch() {
+    let (p, r) = load!("060-expr-opacity-wiggle.aep");
+    let l = only_layer(&p, &r);
+    let e = l.props.prop("transform/opacity").unwrap().expr.clone().unwrap();
+    assert_eq!((e.text.as_str(), e.enabled), ("wiggle(1,10)", true));
+    assert_eq!(r.report.imported.expressions, 1);
+    close(scalar(&l, "transform/opacity"), 100.0);
+
+    let (p, r) = load!("213-expr-opacity-wiggle-disabled.aep");
+    let e = only_layer(&p, &r).props.prop("transform/opacity").unwrap().expr.clone().unwrap();
+    assert_eq!((e.text.as_str(), e.enabled), ("wiggle(1,10)", false));
+}
+
+// ---------------------------------------------------------------- the report
+
+fn loss(r: &ImportReport, c: LossCategory) -> usize {
+    r.count(c)
+}
+
+#[test]
+fn unsupported_features_are_reported_per_category() {
+    let expect: [(&str, LossCategory, usize); 1] = [("077-fx-dropdown-default.aep", LossCategory::Effects, 1)];
+    for (name, category, n) in expect {
+        let (p, r) = load!(name);
+        assert_eq!(loss(&r.report, category), n, "{name}: {:?}", r.report.losses);
+        assert_eq!(r.report.total_losses(), n, "{name}: {:?}", r.report.losses);
+        // The solid layer L still arrived.
+        let (_, c) = comp(&p, &r, "C");
+        assert!(c.layers.iter().any(|l| l.name == "L"), "{name}");
+    }
+    // Effect detail names the effect.
+    let (_, r) = load!("077-fx-dropdown-default.aep");
+    assert!(r.report.losses[0].details[0].contains("Dropdown"), "{:?}", r.report.losses);
+}
+
+#[test]
+fn losses_are_refused_unless_allowed_and_a_refusal_changes_nothing() {
+    let mut p = Project::default();
+    let before = p.clone();
+    let err = try_import!(&mut p, "077-fx-dropdown-default.aep", false).unwrap_err();
+    let AepImportError::Refused(report) = &err else { panic!("{err:?}") };
+    assert_eq!(report.count(LossCategory::Effects), 1);
+    assert!(err.to_string().contains("effects: 1"), "{err}");
+    assert_eq!(p, before);
+    // Allowed: imported, the report is the same.
+    let r = try_import!(&mut p, "077-fx-dropdown-default.aep", true).unwrap();
+    assert_eq!(&r.report, report.as_ref());
+    assert!(p.items.len() > before.items.len());
+    // A lossless file needs no permission.
+    let mut p = Project::default();
+    assert!(try_import!(&mut p, "000-base.aep", false).is_ok());
+}
+
+#[test]
+fn the_report_round_trips_through_json() {
+    let (_, r) = load!("077-fx-dropdown-default.aep");
+    let json = serde_json::to_string(&r.report).unwrap();
+    let back: ImportReport = serde_json::from_str(&json).unwrap();
+    assert_eq!(back, r.report);
+    let v: serde_json::Value = serde_json::from_str(&json).unwrap();
+    assert_eq!(v["losses"][0]["category"], "effects");
+    assert_eq!(v["imported"]["layers"], 1);
+    assert!(v["limitations"].as_array().unwrap().len() >= 2);
+}
+
+#[test]
+fn analyze_is_a_dry_run() {
+    let bytes = fixture!("077-fx-dropdown-default.aep");
+    let report = analyze(&bytes, &|_| false).unwrap();
+    assert_eq!(report.count(LossCategory::Effects), 1);
+    assert_eq!(report.imported.layers, 1);
+}
+
+#[test]
+fn files_that_are_not_projects_are_errors() {
+    let mut p = Project::default();
+    for bytes in [&b""[..], b"RIFX", b"hello world, not an aep", b"RIFX\0\0\0\x04Egg!"] {
+        let none = |_: &str| false;
+        let opts = effectcraft_aep::import::ImportOptions::new(&none);
+        assert!(effectcraft_aep::import::import(&mut p, bytes, &opts).is_err());
+    }
+    assert!(p.items.is_empty());
+}
+
+#[test]
+fn time_stretch_is_the_exact_ratio() {
+    // 316: 50 %, the stored out point 5 s becomes 2.5 s.
+    let (p, r) = load!("316-layer-stretch50.aep");
+    let l = only_layer(&p, &r);
+    assert_eq!((l.stretch, l.start_time, l.in_point, l.out_point), (50.0, Tick::ZERO, Tick::ZERO, secs(2.5)));
+    // 317: 150 %, ends at 7.5 s.
+    let (p, r) = load!("317-layer-stretch150.aep");
+    let l = only_layer(&p, &r);
+    assert_eq!((l.stretch, l.in_point, l.out_point), (150.0, Tick::ZERO, secs(7.5)));
+}
+
+#[test]
+fn fractional_in_point_is_exact() {
+    // 318: in point 8532/25600 s, out 136532/25600 s.
+    let (p, r) = load!("318-layer-inpoint-0.3333.aep");
+    let l = only_layer(&p, &r);
+    assert_eq!(l.stretch, 100.0);
+    assert_eq!(l.in_point, Tick(8532 * (SEC / 25600)));
+    assert_eq!(l.out_point, Tick(136532 * (SEC / 25600)));
+    assert_eq!(l.start_time, Tick::ZERO);
+}
+
+#[test]
+fn composition_pixel_aspect_shutter_phase_and_display_start() {
+    let (p, r) = load!("325-comp-pixelaspect-0.9091.aep");
+    close(comp(&p, &r, "C").1.pixel_aspect, 10.0 / 11.0);
+    let (p, r) = load!("326-comp-shutterphase-m90.aep");
+    let c = comp(&p, &r, "C").1;
+    assert_eq!((c.shutter_angle, c.shutter_phase), (180.0, -90.0));
+    let (p, r) = load!("327-comp-displaystartframe-100.aep");
+    let c = comp(&p, &r, "C").1;
+    assert_eq!((c.display_start, c.shutter_phase), (Tick(4 * SEC), 0.0));
+    let (p, r) = load!("000-base.aep");
+    assert_eq!(comp(&p, &r, "C").1.display_start, Tick::ZERO);
+}
+
+#[test]
+fn ntsc_fixtures_import_as_exact_rates() {
+    let (p, r) = load!("229-comp-fps-29.97.aep");
+    assert_eq!(comp(&p, &r, "C").1.frame_rate, FrameRate::FPS_29_97);
+    let (p, r) = load!("230-comp-fps-23.976.aep");
+    assert_eq!(comp(&p, &r, "C").1.frame_rate, FrameRate::FPS_23_976);
+}
+
+#[test]
+fn scale_bezier_ease_is_imported_per_dimension() {
+    // 305: key 1 in 0 / 33 %, out 0.2 / 66 %; key 2 in 0.1 / 66 %, out 0 / 33 % in every
+    // dimension. Speeds are fractions per second, here percent.
+    let (p, r) = load!("305-key-scale-bezier-ease.aep");
+    let s = only_layer(&p, &r).props.prop("transform/scale").unwrap().clone();
+    assert_eq!(s.keys.len(), 2);
+    for k in &s.keys {
+        assert_eq!((k.in_interp, k.out_interp), (Interp::Bezier, Interp::Bezier));
+    }
+    assert_eq!(s.keys[0].value, Value::Vec3([100.0, 100.0, 100.0]));
+    assert_eq!(s.keys[1].value, Value::Vec3([200.0, 150.0, 100.0]));
+    assert_eq!(s.keys[1].time, Tick(2 * SEC));
+    assert!(s.keys[0].in_ease.is_empty() && s.keys[1].out_ease.is_empty());
+    assert_eq!(s.keys[0].out_ease.len(), 3);
+    for e in &s.keys[0].out_ease {
+        close(e.speed, 20.0);
+        close(e.influence, 0.66);
+    }
+    assert_eq!(s.keys[1].in_ease.len(), 3);
+    for e in &s.keys[1].in_ease {
+        close(e.speed, 10.0);
+        close(e.influence, 0.66);
+    }
+    assert_eq!(loss(&r.report, LossCategory::ApproximatedKeyframes), 0);
+}
+
+#[test]
+fn an_image_sequence_becomes_a_sequence_of_its_files() {
+    // 603: shot_0101.exr .. shot_0103.exr in a folder (64x48, 30 fps, 3 frames).
+    let (p, r) = load!("603-footage-exrseq-0101-as-layer.aep");
+    let (name, f) = p.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some((i.name.clone(), f.clone())) } else { None }).expect("footage");
+    // No name is stored: the item shows the sequence's name with the frame range, as in AE.
+    assert_eq!(name, "shot_[0101-0103].exr");
+    assert_eq!(f.kind, FootageKind::Sequence);
+    let names: Vec<&str> = f.sequence.iter().map(|s| s.rsplit(['\\', '/']).next().unwrap_or_default()).collect();
+    assert_eq!(names, vec!["shot_0101.exr", "shot_0102.exr", "shot_0103.exr"]);
+    assert!(f.path.ends_with("exrseq\\shot_0101.exr"), "{}", f.path);
+    assert_eq!(f.frame_rate, FrameRate::new(30, 1));
+    assert_eq!(f.duration, FrameRate::new(30, 1).tick_of(3));
+    assert_eq!((f.width, f.height), (64, 48));
+    // The missing-footage list names the first file (no file exists in the test).
+    assert!(r.report.missing_footage.iter().any(|m| m.ends_with("shot_0101.exr")), "{:?}", r.report.missing_footage);
+}
+
+#[test]
+fn project_settings_come_with_the_result_not_into_the_project() {
+    use effectcraft_project::{BitDepth, ProjectSettings, TimeDisplayStyle};
+    let def = ProjectSettings::default();
+    // The base: 32 bpc, sRGB, gamma 2.2, timecode, frames from 0.
+    let (p, r) = load!("000-base.aep");
+    assert_eq!(p.settings, def, "import leaves the project's settings alone");
+    assert_eq!((r.settings.bit_depth, r.settings.working_space), (BitDepth::Bpc32, Some(effectcraft_color::ColorSpace::Srgb)));
+    assert_eq!((r.settings.working_gamma, r.settings.linearize, r.settings.blend_linear), (2.2, false, false));
+    assert!(r.report.is_lossless());
+    let s = |name: &str| crate::import::helpers::try_load(name).map(|(_, r)| r.settings);
+    assert_eq!(skip!(s("621-settings-bpc-8.aep")).bit_depth, BitDepth::Bpc8);
+    assert_eq!(skip!(s("622-settings-bpc-16.aep")).bit_depth, BitDepth::Bpc16);
+    assert_eq!(skip!(s("623-settings-workingspace-none.aep")).working_space, None);
+    // After Effects renders in the working space, so a Rec.709 project is also output in Rec.709
+    // (902); an sRGB one keeps the default output (sRGB).
+    let rec709 = skip!(s("902-settings-rec709-16bpc-steps-png-grey-solid.aep"));
+    assert_eq!((rec709.working_space, rec709.output_space), (Some(effectcraft_color::ColorSpace::Rec709), Some(effectcraft_color::ColorSpace::Rec709)));
+    assert_eq!(rec709.bit_depth, BitDepth::Bpc16);
+    assert_eq!(skip!(s("000-base.aep")).output_space, None);
+    assert_eq!(skip!(s("625-settings-gamma-2.4.aep")).working_gamma, 2.4);
+    let both = skip!(s("632-settings-linearize-and-blend-linear.aep"));
+    assert!(both.linearize && both.blend_linear);
+    assert_eq!(skip!(s("629-settings-time-display-frames.aep")).time_display, TimeDisplayStyle::Frames);
+    assert_eq!(skip!(s("633-settings-feet-frames-35.aep")).time_display, TimeDisplayStyle::Feet35);
+    assert_eq!(skip!(s("634-settings-feet-frames-16.aep")).time_display, TimeDisplayStyle::Feet16);
+    assert_eq!(skip!(s("630-settings-frame-start-1.aep")).frame_start, 1);
+    // Settings EffectCraft does not keep (scene-referred compensation) change nothing: 628 shares
+    // its file with 621, 623, 625, 629 and 630 (one value per project), and reads as their changes.
+    let base = skip!(s("000-base.aep"));
+    let others =
+        ProjectSettings { bit_depth: BitDepth::Bpc8, working_space: None, working_gamma: 2.4, time_display: TimeDisplayStyle::Frames, frame_start: 1, ..base };
+    assert_eq!(skip!(s("628-settings-scene-compensation-off.aep")), others);
+}
+
+#[test]
+fn a_working_space_without_a_counterpart_is_reported() {
+    // The base with the profile name in the working-space JSON replaced (same length).
+    let bytes = fixture!("000-base.aep");
+    let from = b"\"colorProfileName\":\"sRGB IEC61966-2.1\"";
+    let to = b"\"colorProfileName\":\"Some Other Space!\"";
+    let at = bytes.windows(from.len()).position(|w| w == from).expect("profile name");
+    let mut edited = bytes.clone();
+    edited[at..at + from.len()].copy_from_slice(to);
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = effectcraft_aep::import::import(
+        &mut p,
+        &edited,
+        &effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) },
+    )
+    .expect("import");
+    assert_eq!(r.report.count(LossCategory::ProjectSettings), 1, "{:?}", r.report.losses);
+    assert_eq!(r.settings.working_space, effectcraft_project::ProjectSettings::default().working_space);
+    // Refused without allowLosses.
+    let mut q = Project::default();
+    assert!(effectcraft_aep::import::import(&mut q, &edited, &effectcraft_aep::import::ImportOptions::new(&none)).is_err());
+    // Into a project whose settings stay (the caller does not take the file's over), nothing is
+    // lost: the import goes through without allowLosses.
+    let keep = effectcraft_aep::import::ImportOptions { settings: false, ..effectcraft_aep::import::ImportOptions::new(&none) };
+    let r = effectcraft_aep::import::import(&mut q, &edited, &keep).expect("settings are not taken over");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+}
+
+#[test]
+fn a_conformed_clip_plays_its_frames_at_the_conformed_rate() {
+    // 645: the 25-frame, 25 fps mp4 conformed to 30 fps (AE: 0.8333 s).
+    let (p, _) = load!("645-footage-mp4-conform-30.aep");
+    let f = p.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).expect("clip");
+    assert_eq!(f.kind, FootageKind::Video);
+    assert_eq!((f.frame_rate, f.native_rate), (FrameRate::new(30, 1), Some(FrameRate::new(25, 1))));
+    assert_eq!(f.duration, FrameRate::new(30, 1).tick_of(25));
+}
+
+#[test]
+fn a_clip_with_sound_has_audio() {
+    // The sample rate (`sspc` f64 at byte 160) is stored for a clip that carries sound (read back
+    // from After Effects with a 48 kHz and a 44.1 kHz mp4) and absent for one that does not (the
+    // 645 clip has none): the importer reads the clip's audio from it.
+    fn set_rate(chunks: &mut [effectcraft_aep::Chunk<'_>], rate: f64) -> usize {
+        let mut n = 0;
+        for c in chunks {
+            if c.id == *b"sspc" && c.bytes().is_some_and(|b| b.get(22..26) == Some(b"XCEX".as_slice())) {
+                let mut data = c.bytes().unwrap_or_default().to_vec();
+                data[160..168].copy_from_slice(&rate.to_be_bytes());
+                *c = effectcraft_aep::Chunk::data(*b"sspc", data);
+                n += 1;
+            } else if let effectcraft_aep::Body::List { children, .. } | effectcraft_aep::Body::Chunks(children) = &mut c.body {
+                n += set_rate(children, rate);
+            }
+        }
+        n
+    }
+    let bytes = fixture!("645-footage-mp4-conform-30.aep");
+    let clip = |bytes: &[u8]| {
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let options = effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) };
+        effectcraft_aep::import::import(&mut p, bytes, &options).expect("import");
+        p.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).expect("clip")
+    };
+    assert!(!clip(&bytes).has_audio);
+    let mut file = effectcraft_aep::parse(&bytes).expect("parse");
+    assert_eq!(set_rate(&mut file.chunks, 48_000.0), 1);
+    let loud = clip(&effectcraft_aep::write(&file).expect("write"));
+    assert_eq!((loud.kind, loud.has_video, loud.has_audio), (FootageKind::Video, true, true));
+}
+
+#[test]
+fn stills_of_four_more_types_are_footage() {
+    for (name, ext) in [
+        ("650-footage-tga-still-as-layer.aep", "tga"),
+        ("651-footage-psd-flat-as-layer.aep", "psd"),
+        ("652-footage-ai-as-layer.aep", "ai"),
+        ("653-footage-eps-as-layer.aep", "eps"),
+    ] {
+        let (p, r) = load!(name);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        let f = p.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).expect(name);
+        assert_eq!((f.kind, f.width, f.height), (FootageKind::Still, 64, 48), "{name}");
+        assert!(f.path.ends_with(&format!("still.{ext}")), "{name}: {}", f.path);
+    }
+}
diff --git a/crates/aep/tests/it/import/combined.rs b/crates/aep/tests/it/import/combined.rs
new file mode 100644
index 000000000..e6897e004
--- /dev/null
+++ b/crates/aep/tests/it/import/combined.rs
@@ -0,0 +1,244 @@
+//! Masks, effects and text together on one layer, a common setup (an adjustment layer
+//! with a Gradient Ramp or Tint and a mask, a text layer with an effect), and the same through the
+//! `.aepx` reader.
+//!
+//! No fixture has both, so the files are built here from the fixtures: the `ADBE Mask Parade` or
+//! `ADBE Effect Parade` group of one fixture's layer is grafted into the layer of another (all of
+//! them are one change against the same base project, so the parades fit). The expected values are
+//! those of importing each donor fixture on its own.
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{ImportOptions, ImportResult, import};
+use effectcraft_aep::{AepFile, Chunk, parse, parse_any, write};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{GroupKind, Layer, Project, PropGroup};
+
+const MASK_PARADE: &[u8] = b"ADBE Mask Parade";
+const EFFECT_PARADE: &[u8] = b"ADBE Effect Parade";
+
+/// Whether `c` is the `tdmn` that names `name`.
+fn names(c: &Chunk<'_>, name: &[u8]) -> bool {
+    c.is(b"tdmn") && c.bytes().is_some_and(|b| b.strip_prefix(name).is_some_and(|rest| rest.first() == Some(&0)))
+}
+
+/// The root property group (`LIST tdgp`) of every layer (`LIST Layr`) under `chunks`.
+fn layer_roots<'c, 'a>(chunks: &'c mut [Chunk<'a>], out: &mut Vec<&'c mut Chunk<'a>>) {
+    for c in chunks {
+        if c.is_list(b"Layr") {
+            if let Some(root) = c.children_mut().iter_mut().find(|k| k.is_list(b"tdgp")) {
+                out.push(root);
+            }
+        } else {
+            layer_roots(c.children_mut(), out);
+        }
+    }
+}
+
+/// The `tdmn` naming `name` in the first layer's root group of `file`, and the group after it.
+fn parade<'a>(file: &mut AepFile<'a>, name: &[u8]) -> Vec<Chunk<'a>> {
+    let mut roots = Vec::new();
+    layer_roots(&mut file.chunks, &mut roots);
+    let root = roots.into_iter().next().expect("a layer");
+    let kids = root.children();
+    let at = kids.iter().position(|k| names(k, name)).unwrap_or_else(|| panic!("no {}", String::from_utf8_lossy(name)));
+    kids[at..at + 2].to_vec()
+}
+
+/// Puts `pair` (a `tdmn` and its group) into the root group of every layer of `file`: in place of
+/// the group of the same name, or after the mask parade (After Effects' order), or first.
+fn graft<'a>(file: &mut AepFile<'a>, pair: &[Chunk<'a>]) {
+    let name = pair[0].bytes().unwrap().split(|b| *b == 0).next().unwrap().to_vec();
+    let mut roots = Vec::new();
+    layer_roots(&mut file.chunks, &mut roots);
+    assert!(!roots.is_empty());
+    for root in roots {
+        let effectcraft_aep::Body::List { children, .. } = &mut root.body else { panic!("tdgp is a list") };
+        if let Some(at) = children.iter().position(|k| names(k, &name)) {
+            children.splice(at..at + 2, pair.iter().cloned());
+        } else {
+            let at = children.iter().position(|k| names(k, MASK_PARADE)).map_or(0, |i| i + 2);
+            children.splice(at..at, pair.iter().cloned());
+        }
+    }
+}
+
+/// Gives every effect of a parade whose definitions are the donor's project copy (a later
+/// instance of its type in a combined file has an empty `parT`) that copy as its own `parT`: the
+/// target's project copy does not hold the donor's types.
+fn own_definitions<'a>(pair: &mut [Chunk<'a>], donor: &AepFile<'_>) {
+    let defs: Vec<(String, Chunk<'static>)> = effectcraft_aep::Project::new(donor)
+        .map(|p| p.effect_definitions().into_iter().map(|(m, part)| (m, part.clone().into_owned())).collect())
+        .unwrap_or_default();
+    let Some(effectcraft_aep::Body::List { children, .. }) = pair.get_mut(1).map(|g| &mut g.body) else { return };
+    let mut name: Option<String> = None;
+    for c in children.iter_mut() {
+        if c.is(b"tdmn") {
+            name = c.bytes().map(|b| String::from_utf8_lossy(b.split(|x| *x == 0).next().unwrap_or(b"")).into_owned());
+        } else if c.is_list(b"sspc")
+            && let Some(n) = name.take()
+            && let Some((_, def)) = defs.iter().find(|(m, _)| *m == n)
+            && let effectcraft_aep::Body::List { children: kids, .. } = &mut c.body
+            && let Some(part) = kids.iter_mut().find(|k| k.is_list(b"parT"))
+            && !part.children().iter().any(|x| x.is(b"pard"))
+        {
+            *part = def.clone();
+        }
+    }
+}
+
+/// `target` (read with the `.aep` or `.aepx` reader) with the named parades of the donors, written
+/// as an `.aep`.
+fn build(target: &str, donors: &[(&str, &[u8])]) -> Option<Vec<u8>> {
+    Some({
+        let target_bytes = crate::common::try_fixture(target)?;
+        let donor_bytes: Vec<Vec<u8>> = donors.iter().map(|(d, _)| crate::common::try_fixture(d)).collect::<Option<_>>()?;
+        let mut file = parse_any(&target_bytes).unwrap();
+        for ((_, name), bytes) in donors.iter().zip(&donor_bytes) {
+            let mut donor = parse(bytes).unwrap();
+            let mut pair = parade(&mut donor, name);
+            own_definitions(&mut pair, &donor);
+            graft(&mut file, &pair);
+        }
+        write(&file).unwrap()
+    })
+}
+
+/// Imports without allowing losses: every combination here is supported, so a loss fails.
+fn import_lossless(bytes: &[u8]) -> (Project, ImportResult) {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, bytes, &ImportOptions::new(&none)).unwrap_or_else(|e| panic!("{e}"));
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    (project, r)
+}
+
+fn only_layer(project: &Project, r: &ImportResult) -> Layer {
+    let (_, c) = comp(project, r, "C");
+    assert_eq!(c.layers.len(), 1);
+    c.layers[0].clone()
+}
+
+fn text_layer(project: &Project, r: &ImportResult) -> Layer {
+    let (_, c) = comp(project, r, "C");
+    c.layers.iter().find(|l| matches!(l.source, effectcraft_project::LayerSource::Text)).expect("a text layer").clone()
+}
+
+fn groups<'l>(l: &'l Layer, id: &str) -> Vec<&'l PropGroup> {
+    l.props.sub(id).map(|g| g.groups().collect()).unwrap_or_default()
+}
+
+/// The values of a group's properties by id (ids of the project tree differ between imports).
+fn values(g: &PropGroup) -> Vec<(String, Value, usize)> {
+    g.props().map(|p| (p.match_id.clone(), p.value.clone(), p.keys.len())).collect()
+}
+
+fn mask_kind(g: &PropGroup) -> String {
+    match &g.kind {
+        GroupKind::Mask { mode, inverted, .. } => format!("{mode:?} {inverted}"),
+        other => panic!("{other:?} is not a mask"),
+    }
+}
+
+/// The layer `L` of a donor fixture imported on its own.
+fn donor_layer(name: &str) -> Option<Layer> {
+    Some({
+        let (p, r) = import_lossless(&crate::common::try_fixture(name)?);
+        only_layer(&p, &r)
+    })
+}
+
+/// Asserts that `l` carries the masks of `mask_donor` and the effects of `effect_donor`.
+fn assert_same_masks_and_effects(l: &Layer, mask_donor: &str, effect_donor: &str) {
+    let want = skip!(donor_layer(mask_donor));
+    let (got_m, want_m) = (groups(l, "masks"), groups(&want, "masks"));
+    assert_eq!(got_m.len(), want_m.len());
+    for (g, w) in got_m.iter().zip(&want_m) {
+        assert_eq!((g.name.as_str(), mask_kind(g), values(g)), (w.name.as_str(), mask_kind(w), values(w)));
+    }
+    let want = skip!(donor_layer(effect_donor));
+    let (got_e, want_e) = (groups(l, "effects"), groups(&want, "effects"));
+    assert_eq!(got_e.len(), want_e.len());
+    for (g, w) in got_e.iter().zip(&want_e) {
+        assert_eq!((g.match_id.as_str(), g.name.as_str(), values(g)), (w.match_id.as_str(), w.name.as_str(), values(w)));
+    }
+}
+
+#[test]
+fn a_mask_and_a_tint_on_one_solid() {
+    // 091: a rectangle mask with feather, opacity and expansion; 356: Tint.
+    let bytes = skip!(build("091-mask-rect-props.aep", &[("356-fx-tint-default.aep", EFFECT_PARADE)]));
+    let (p, r) = import_lossless(&bytes);
+    assert_eq!((r.report.imported.masks, r.report.imported.effects), (1, 1));
+    assert_same_masks_and_effects(&only_layer(&p, &r), "091-mask-rect-props.aep", "356-fx-tint-default.aep");
+}
+
+#[test]
+fn an_adjustment_layer_with_a_keyed_ramp_and_masks() {
+    // 025: the layer is an adjustment layer; 328: an ellipse and a rectangle; 382: Gradient Ramp
+    // with Start of Ramp keys.
+    let bytes = skip!(build("025-layer-adjustment.aep", &[("328-mask-two-ellipse-rect.aep", MASK_PARADE), ("382-fx-ramp-start-2key.aep", EFFECT_PARADE)]));
+    let (p, r) = import_lossless(&bytes);
+    let i = &r.report.imported;
+    assert_eq!((i.adjustment_layers, i.masks, i.effects), (1, 2, 1), "{i:?}");
+    let l = only_layer(&p, &r);
+    assert!(l.switches.adjustment);
+    assert_same_masks_and_effects(&l, "328-mask-two-ellipse-rect.aep", "382-fx-ramp-start-2key.aep");
+    // The ramp's keys arrive next to the masks.
+    assert!(groups(&l, "effects")[0].props().any(|p| p.keys.len() == 2));
+}
+
+#[test]
+fn the_grafting_order_does_not_matter() {
+    // Grafting the effect first and the mask after it gives the same layer.
+    let a = skip!(build("000-base.aep", &[("090-mask-rect.aep", MASK_PARADE), ("368-fx-ramp-default.aep", EFFECT_PARADE)]));
+    let b = skip!(build("000-base.aep", &[("368-fx-ramp-default.aep", EFFECT_PARADE), ("090-mask-rect.aep", MASK_PARADE)]));
+    for bytes in [a, b] {
+        let (p, r) = import_lossless(&bytes);
+        assert_same_masks_and_effects(&only_layer(&p, &r), "090-mask-rect.aep", "368-fx-ramp-default.aep");
+    }
+}
+
+#[test]
+fn a_text_layer_with_a_tint() {
+    // 110 has the text layer above the solid `L`; both get the Tint.
+    let (p, r) = import_lossless(&skip!(build("110-text-A.aep", &[("356-fx-tint-default.aep", EFFECT_PARADE)])));
+    assert_eq!((r.report.imported.text_layers, r.report.imported.effects), (1, 2));
+    let l = text_layer(&p, &r);
+    let (wp, wr) = import_lossless(&fixture!("110-text-A.aep"));
+    let want = text_layer(&wp, &wr);
+    assert_eq!(l.props.prop("text/sourceText").unwrap().value, want.props.prop("text/sourceText").unwrap().value);
+    let fx = groups(&l, "effects");
+    assert_eq!(fx.len(), 1);
+    let tint = skip!(donor_layer("356-fx-tint-default.aep"));
+    assert_eq!(values(fx[0]), values(groups(&tint, "effects")[0]));
+}
+
+#[test]
+fn the_aepx_tree_takes_masks_and_effects_like_the_aep() {
+    // The same grafts on the chunk tree read from 110's `.aepx` and from its `.aep` import alike:
+    // text, a mask and an effect.
+    let donors: &[(&str, &[u8])] = &[("368-fx-ramp-default.aep", EFFECT_PARADE)];
+    let from_aep = skip!(build("110-text-A.aep", donors));
+    let from_aepx = skip!(build("110-text-A.aepx", donors));
+    let (pa, ra) = import_lossless(&from_aep);
+    let (px, rx) = import_lossless(&from_aepx);
+    assert_eq!(ra, rx);
+    assert_eq!(pa, px);
+
+    // With a mask as well (on the text layer too: its box is read in layer pixels, 705).
+    let donors: &[(&str, &[u8])] = &[("090-mask-rect.aep", MASK_PARADE), ("368-fx-ramp-default.aep", EFFECT_PARADE)];
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let mut results = Vec::new();
+    for target in ["110-text-A.aep", "110-text-A.aepx"] {
+        let mut p = Project::default();
+        let r = import(&mut p, &skip!(build(target, donors)), &opts).unwrap();
+        assert!(r.report.is_lossless(), "{target}: {:?}", r.report.losses);
+        // Both layers get the mask and the ramp.
+        assert_eq!((r.report.imported.text_layers, r.report.imported.masks, r.report.imported.effects), (1, 2, 2), "{target}");
+        let fx = groups(&text_layer(&p, &r), "effects").len();
+        assert_eq!(fx, 1, "{target}");
+        results.push((p, r));
+    }
+    assert_eq!(results[0], results[1]);
+}
diff --git a/crates/aep/tests/it/import/cryptomatte.rs b/crates/aep/tests/it/import/cryptomatte.rs
new file mode 100644
index 000000000..96f532c05
--- /dev/null
+++ b/crates/aep/tests/it/import/cryptomatte.rs
@@ -0,0 +1,449 @@
+//! The Cryptomatte plug-in (match name `Cryptomatte`) arrives as EffectCraft's Cryptomatte
+//! (`ec.3d.cryptomatte`): the layer and selection from its Settings data, Output as Display and
+//! Matte Only. The effect is built into the committed `synthetic.aep` in place of its Glow, in
+//! the layout docs/aep-format.md 3.7 describes (made-up layer names and ID hashes).
+
+use effectcraft_aep::import::{ImportOptions, ImportResult, LossCategory, import};
+use effectcraft_aep::{Body, Chunk, ParamKind, Project as AepProject, parse, write};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Project, PropGroup};
+
+const SYNTHETIC: &[u8] = include_bytes!("../../fixtures/synthetic.aep");
+
+/// A match name chunk (`tdmn`, 40 bytes).
+fn tdmn(name: &str) -> Chunk<'static> {
+    let mut b = name.as_bytes().to_vec();
+    b.resize(40, 0);
+    Chunk::data(*b"tdmn", b)
+}
+
+/// A parameter definition: the type at byte 15, the name at 16; a popup's default at 56 and
+/// item count at 60.
+fn pard(kind: u8, name: &str, popup: Option<(u32, u16)>) -> Chunk<'static> {
+    let mut b = vec![0u8; 148];
+    b[15] = kind;
+    b[16..16 + name.len()].copy_from_slice(name.as_bytes());
+    if let Some((default, count)) = popup {
+        b[56..60].copy_from_slice(&default.to_be_bytes());
+        b[60..62].copy_from_slice(&count.to_be_bytes());
+    }
+    Chunk::data(*b"pard", b)
+}
+
+fn utf8(s: &str) -> Chunk<'static> {
+    Chunk::data(*b"Utf8", s.as_bytes().to_vec())
+}
+
+/// A chunk whose body is chunks without being a `LIST`, as After Effects writes `pdnm` and `fnam`
+/// (`NESTED_IDS`). A `LIST pdnm` is not read as popup items.
+fn nested(id: [u8; 4], children: Vec<Chunk<'static>>) -> Chunk<'static> {
+    Chunk { id, body: Body::Chunks(children), pad: None }
+}
+
+/// The plug-in's Output items in the order After Effects 2026 stores them (1400).
+const OUTPUT: &[&str] = &["Colors", "Matted Colors", "Matted RGBA", "Matte Only"];
+
+/// A static value record holding `v` in state `tdsb` (1 written, 3 the default state), after the
+/// one After Effects wrote for Glow's A & B Midpoint (its header; without the expression).
+fn record(template: &Chunk<'_>, tdsb: u32, v: f64) -> Chunk<'static> {
+    let mut kids = Vec::new();
+    for c in template.children() {
+        match &c.body {
+            Body::Data(_) if c.id == *b"tdsb" => kids.push(Chunk::data(*b"tdsb", tdsb.to_be_bytes().to_vec())),
+            Body::Data(d) if c.id == *b"tdb4" => kids.push(Chunk::data(c.id, d.to_vec())),
+            Body::Data(_) if c.id == *b"cdat" => {
+                let mut d = vec![0u8; 40];
+                d[..8].copy_from_slice(&v.to_be_bytes());
+                kids.push(Chunk::data(*b"cdat", d));
+            }
+            _ => {}
+        }
+    }
+    Chunk::list(*b"tdbs", kids)
+}
+
+/// The plug-in's Settings data: `cry1`, 28 bytes not read, the layer name in 64 bytes, a `u32` 1,
+/// a `u32` not read, the text's length with its NUL, a `u32` not read, a zero byte, the text.
+fn settings(layer: &str, selection: &str) -> Vec<u8> {
+    let mut d = b"cry1".to_vec();
+    d.resize(32, 0x5a);
+    d.extend(layer.as_bytes());
+    d.resize(96, 0);
+    d.extend(1u32.to_le_bytes());
+    d.extend(0x1234_5678u32.to_le_bytes());
+    d.extend(u32::try_from(selection.len() + 1).unwrap().to_le_bytes());
+    d.extend(0x9abc_def0u32.to_le_bytes());
+    d.push(0);
+    d.extend(selection.as_bytes());
+    d.push(0);
+    d.extend(b" <1"); // left-overs of a longer earlier text
+    d
+}
+
+struct Crypto {
+    /// The Settings data, if stored.
+    settings: Option<Vec<u8>>,
+    /// Output (1-based), if stored.
+    output: Option<u32>,
+    /// Selection Mode, if stored: on, and the record's `tdsb`.
+    selection_mode: Option<(bool, u32)>,
+    /// The instance has no definitions of its own (an empty `parT`) and borrows the project's,
+    /// as every instance but the first of a project does (1400).
+    borrowed: bool,
+    /// Output's popup items as written in its `pdnm`; `None` writes no `pdnm` (a definition with
+    /// four items then falls back to the plug-in's own list).
+    items: Option<&'static [&'static str]>,
+}
+
+/// The Cryptomatte instance: its own definitions (input layer, Settings, Output, Selection Mode,
+/// the built-in entry; none when `own` is false) and the stored values of `c`.
+fn sspc(c: &Crypto, template: &Chunk<'_>, own: bool) -> Chunk<'static> {
+    let name = |i: u32| format!("Cryptomatte-{i:04}");
+    let mut part = vec![
+        Chunk::data(*b"parn", 5u32.to_be_bytes().to_vec()),
+        tdmn(&name(0)),
+        pard(0, "", None),
+        tdmn(&name(1)),
+        pard(11, "Settings", None),
+        Chunk::data(*b"aRbp", settings("", "")),
+        tdmn(&name(2)),
+        pard(7, "Output", Some((1, c.items.map_or(4, |i| u16::try_from(i.len()).unwrap())))),
+        tdmn(&name(3)),
+        pard(4, "Selection Mode", None),
+        tdmn("ADBE Effect Built In Params"),
+        pard(9, "", None),
+    ];
+    if let Some(items) = c.items {
+        // After the Output definition, as After Effects writes it.
+        part.insert(8, nested(*b"pdnm", vec![utf8(&items.join("|"))]));
+    }
+    let part = if own { part } else { Vec::new() };
+    let mut values = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec())];
+    if let Some(d) = &c.settings {
+        values.push(tdmn(&name(1)));
+        values.push(record(template, 1, 0.0));
+        values.push(Chunk::list(*b"aRbs", vec![Chunk::data(*b"aRbp", d.clone())]));
+    }
+    if let Some(o) = c.output {
+        values.push(tdmn(&name(2)));
+        values.push(record(template, 1, f64::from(o)));
+    }
+    if let Some((on, tdsb)) = c.selection_mode {
+        values.push(tdmn(&name(3)));
+        values.push(record(template, tdsb, if on { 1.0 } else { 0.0 }));
+    }
+    Chunk::list(*b"sspc", vec![nested(*b"fnam", vec![utf8("Cryptomatte")]), Chunk::list(*b"parT", part), Chunk::list(*b"tdgp", values)])
+}
+
+fn find_glow_template<'a>(chunks: &'a [Chunk<'a>]) -> Option<Chunk<'a>> {
+    for c in chunks {
+        let kids = c.children();
+        if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(b"ADBE Glo2-0011\0")))
+            && let Some(record) = kids.get(at + 1).filter(|k| k.is_list(b"tdbs"))
+        {
+            return Some(record.clone());
+        }
+        if let Some(t) = find_glow_template(kids) {
+            return Some(t);
+        }
+    }
+    None
+}
+
+/// Puts `c` in place of the Glow effect (the instance in the effect parade and the project's
+/// shared definitions, `defs` below `EfDf`); the number of places.
+fn replace_glow(chunks: &mut [Chunk<'_>], c: &Crypto, template: &Chunk<'_>, defs: bool) -> usize {
+    let mut n = 0;
+    for ch in chunks {
+        let defs = defs || ch.is_list(b"EfDf");
+        let kids = ch.children_mut();
+        if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(b"ADBE Glo2\0")))
+            && kids.get(at + 1).is_some_and(|k| k.is_list(b"sspc"))
+        {
+            kids[at] = tdmn("Cryptomatte");
+            kids[at + 1] = sspc(c, template, defs || !c.borrowed);
+            n += 1;
+        }
+        n += replace_glow(kids, c, template, defs);
+    }
+    n
+}
+
+/// `synthetic.aep` with `c` in place of the Glow effect.
+fn bytes_with(c: &Crypto) -> Vec<u8> {
+    let file = parse(SYNTHETIC).unwrap();
+    let template = find_glow_template(&file.chunks).expect("Glow's A & B Midpoint record");
+    let mut file = parse(SYNTHETIC).unwrap();
+    assert_eq!(replace_glow(&mut file.chunks, c, &template, false), 2, "the Glow effect and its shared definitions");
+    write(&file).unwrap()
+}
+
+fn run(c: &Crypto) -> (Option<PropGroup>, ImportResult) {
+    let bytes = bytes_with(c);
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    let g = project.comps().flat_map(|(_, c)| c.layers.iter()).find_map(|l| {
+        l.props.sub("effects").and_then(|fx| fx.children.iter().filter_map(|n| n.as_group()).find(|g| g.match_id == "ec.3d.cryptomatte").cloned())
+    });
+    (g, r)
+}
+
+fn losses(r: &ImportResult, category: LossCategory) -> Vec<String> {
+    r.report.losses.iter().filter(|l| l.category == category).flat_map(|l| l.details.clone()).filter(|d| d.contains("Cryptomatte")).collect()
+}
+
+fn v(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id}")).value.clone()
+}
+
+fn str(s: &str) -> Value {
+    Value::Str(s.into())
+}
+
+#[test]
+fn cryptomatte_arrives_with_its_layer_selection_and_output() {
+    let sel = "<0000002a>, <deadbeef>";
+    let (g, r) = run(&Crypto { settings: Some(settings("Layer_A", sel)), output: Some(3), selection_mode: None, borrowed: false, items: Some(OUTPUT) });
+    assert_eq!(losses(&r, LossCategory::Effects), Vec::<String>::new());
+    assert_eq!(losses(&r, LossCategory::DamagedData), Vec::<String>::new());
+    let g = g.expect("an EffectCraft Cryptomatte");
+    // Matted RGBA: the layer keyed by the selection.
+    assert_eq!((v(&g, "layerName"), v(&g, "selection"), v(&g, "display"), v(&g, "matteOnly")), (str("Layer_A"), str(sel), Value::Enum(1), Value::Bool(false)));
+    // The selection's `<hex>` tokens are EffectCraft's own grammar.
+    assert_eq!(effectcraft_effects::selection_hashes(sel, None), vec![0x2a, 0xdead_beef]);
+}
+
+#[test]
+fn cryptomatte_output_maps_to_display_and_matte_only() {
+    for (output, display, matte_only) in [(1, 0, false), (3, 1, false), (4, 1, true)] {
+        let (g, r) = run(&Crypto {
+            settings: Some(settings("L", "<00000001>")),
+            output: Some(output),
+            selection_mode: Some((false, 1)),
+            borrowed: false,
+            items: Some(OUTPUT),
+        });
+        assert_eq!(losses(&r, LossCategory::Effects), Vec::<String>::new(), "output {output}");
+        let g = g.expect("effect");
+        assert_eq!((v(&g, "display"), v(&g, "matteOnly")), (Value::Enum(display), Value::Bool(matte_only)), "output {output}");
+    }
+    // No Output record: the default, Colors, from the instance's own definition or, borrowed,
+    // the plug-in's (1400 `crypto-00-defaults`; every other composition there borrows).
+    for borrowed in [false, true] {
+        let (g, r) = run(&Crypto { settings: None, output: None, selection_mode: None, borrowed, items: Some(OUTPUT) });
+        assert_eq!(losses(&r, LossCategory::Effects), Vec::<String>::new(), "borrowed {borrowed}");
+        let g = g.expect("effect");
+        assert_eq!(
+            (v(&g, "display"), v(&g, "matteOnly"), v(&g, "layerName"), v(&g, "selection")),
+            (Value::Enum(0), Value::Bool(false), str(""), str("")),
+            "the default settings: Colors, no layer, no selection (borrowed {borrowed})"
+        );
+    }
+    // A borrowed definition with a stored Output.
+    let (g, r) = run(&Crypto { settings: None, output: Some(4), selection_mode: None, borrowed: true, items: Some(OUTPUT) });
+    assert_eq!(losses(&r, LossCategory::Effects), Vec::<String>::new());
+    let g = g.expect("effect");
+    assert_eq!((v(&g, "display"), v(&g, "matteOnly")), (Value::Enum(1), Value::Bool(true)));
+}
+
+/// The harness writes Output's items as After Effects does: the reader finds them in the `pdnm`
+/// (and the instance name in `fnam`), so the Output tests go through the item names.
+#[test]
+fn the_injected_definition_reads_back_with_its_popup_items() {
+    let bytes = bytes_with(&Crypto { settings: None, output: Some(4), selection_mode: None, borrowed: false, items: Some(OUTPUT) });
+    let file = parse(&bytes).unwrap();
+    let proj = AepProject::new(&file).unwrap();
+    let defs = proj.effect_definition_index();
+    let fx = proj
+        .all_items()
+        .into_iter()
+        .filter_map(|i| i.comp())
+        .flat_map(|c| c.layers().collect::<Vec<_>>())
+        .flat_map(|l| l.effects())
+        .find(|e| e.match_name() == "Cryptomatte")
+        .expect("the effect");
+    let output = defs.params(&fx).into_iter().find(|p| p.index == 2).expect("Output");
+    let want: Vec<String> = OUTPUT.iter().map(|s| s.to_string()).collect();
+    assert_eq!((output.kind, output.popup_item_count(), output.items), (ParamKind::Popup, Some(4), Some(want)));
+    assert_eq!(fx.name().as_deref(), Some("Cryptomatte"));
+}
+
+/// Output is mapped by the item the stored index names, not by its position in the plug-in's
+/// list: with the items in another order, index 4 is Colors and index 1 Matte Only.
+#[test]
+fn cryptomatte_output_maps_by_item_name() {
+    const REORDERED: &[&str] = &["Matte Only", "Matted RGBA", "Matted Colors", "Colors"];
+    for (output, display, matte_only) in [(1, 1, true), (2, 1, false), (4, 0, false)] {
+        let (g, r) = run(&Crypto { settings: None, output: Some(output), selection_mode: None, borrowed: false, items: Some(REORDERED) });
+        assert_eq!(losses(&r, LossCategory::Effects), Vec::<String>::new(), "output {output}");
+        let g = g.expect("effect");
+        assert_eq!((v(&g, "display"), v(&g, "matteOnly")), (Value::Enum(display), Value::Bool(matte_only)), "output {output}");
+    }
+    // Item names are matched without regard to case and spacing.
+    let (g, _) = run(&Crypto {
+        settings: None,
+        output: Some(2),
+        selection_mode: None,
+        borrowed: false,
+        items: Some(&["colors", "MATTE ONLY", "Matted RGBA", "Matted Colors"]),
+    });
+    assert_eq!((v(&g.expect("effect"), "matteOnly")), Value::Bool(true));
+    // An item EffectCraft does not know: reported, Colors used.
+    let (g, r) = run(&Crypto {
+        settings: None,
+        output: Some(2),
+        selection_mode: None,
+        borrowed: false,
+        items: Some(&["Colors", "Something New", "Matted RGBA", "Matte Only"]),
+    });
+    let found = losses(&r, LossCategory::Effects);
+    assert!(found.iter().any(|d| d.contains("'Something New'") && d.contains("Colors used")), "{found:?}");
+    assert_eq!((v(&g.expect("effect"), "display")), Value::Enum(0));
+}
+
+/// A file without Output's `pdnm` and four items in the definition: the plug-in's own list.
+#[test]
+fn cryptomatte_output_without_items_falls_back_to_the_plugin_list() {
+    let (g, r) = run(&Crypto { settings: None, output: Some(4), selection_mode: None, borrowed: false, items: None });
+    assert_eq!(losses(&r, LossCategory::Effects), Vec::<String>::new());
+    assert_eq!((v(&g.expect("effect"), "matteOnly")), Value::Bool(true));
+}
+
+#[test]
+fn cryptomatte_values_without_a_counterpart_are_reported() {
+    // Matted Colors has no counterpart: reported, imported as Matte (the same matte).
+    let (g, r) = run(&Crypto { settings: Some(settings("L", "")), output: Some(2), selection_mode: Some((true, 1)), borrowed: false, items: Some(OUTPUT) });
+    let found = losses(&r, LossCategory::Effects);
+    assert!(found.iter().any(|d| d.contains("'Matted Colors'") && d.contains("no counterpart") && d.contains("imported as Matte")), "{found:?}");
+    assert!(found.iter().any(|d| d.contains("Selection Mode") && d.contains("is on")), "{found:?}");
+    assert_eq!(found.len(), 2, "{found:?}");
+    let g = g.expect("still imported");
+    assert_eq!((v(&g, "display"), v(&g, "matteOnly"), v(&g, "layerName")), (Value::Enum(1), Value::Bool(false), str("L")));
+
+    // Selection Mode on as After Effects writes it: a default-state record (`tdsb` 3) holding 1
+    // (1400 `crypto-01-set-all`). Reported like a written one; off in that form is not.
+    for (on, n) in [(true, 1), (false, 0)] {
+        let (_, r) = run(&Crypto { settings: None, output: None, selection_mode: Some((on, 3)), borrowed: true, items: Some(OUTPUT) });
+        let found = losses(&r, LossCategory::Effects);
+        assert_eq!(found.iter().filter(|d| d.contains("Selection Mode") && d.contains("is on")).count(), n, "on {on}: {found:?}");
+        assert_eq!(found.len(), n, "on {on}: {found:?}");
+    }
+
+    // Unreadable Settings data: reported as damaged, no layer and no selection.
+    let mut bad = settings("L", "<00000001>");
+    bad[0] = b'x';
+    let (g, r) = run(&Crypto { settings: Some(bad), output: Some(3), selection_mode: None, borrowed: false, items: Some(OUTPUT) });
+    let found = losses(&r, LossCategory::DamagedData);
+    assert!(found.iter().any(|d| d.contains("settings (layer, selection) are unreadable")), "{found:?}");
+    assert_eq!((v(&g.expect("effect"), "layerName")), str(""));
+}
+
+/// `bytes` with `f` applied to the children of every value group (`tdgp`) that holds the
+/// parameter `match_name`, given the position of its match name.
+fn edit_values(bytes: &[u8], match_name: &str, f: &dyn Fn(&mut Vec<Chunk<'static>>, usize)) -> Vec<u8> {
+    fn walk(chunks: &mut [Chunk<'_>], match_name: &str, f: &dyn Fn(&mut Vec<Chunk<'static>>, usize)) {
+        for c in chunks {
+            if c.is_list(b"tdgp") {
+                let mut kids: Vec<Chunk<'static>> = c.children().iter().cloned().map(Chunk::into_owned).collect();
+                if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(format!("{match_name}").as_bytes()))) {
+                    f(&mut kids, at);
+                    *c = Chunk::list(*b"tdgp", kids);
+                    continue;
+                }
+            }
+            walk(c.children_mut(), match_name, f);
+        }
+    }
+    let mut file = parse(bytes).unwrap();
+    walk(&mut file.chunks, match_name, f);
+    write(&file).unwrap()
+}
+
+fn import_bytes(bytes: &[u8]) -> ImportResult {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    import(&mut project, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap()
+}
+
+/// A stored record that has lost its data is reported as damaged, not read as the default.
+#[test]
+fn cryptomatte_records_without_their_data_are_reported() {
+    let c = Crypto { settings: Some(settings("L", "<00000001>")), output: None, selection_mode: Some((true, 3)), borrowed: false, items: Some(OUTPUT) };
+    let bytes = bytes_with(&c);
+    // The Settings record without its `aRbs` list.
+    let no_data = edit_values(&bytes, "Cryptomatte-0001", &|kids, at| {
+        if kids.get(at + 2).is_some_and(|k| k.is_list(b"aRbs")) {
+            kids.remove(at + 2);
+        }
+    });
+    let found = losses(&import_bytes(&no_data), LossCategory::DamagedData);
+    assert!(found.len() == 1 && found[0].contains("settings (layer, selection) have no data"), "{found:?}");
+    // The Selection Mode record without a readable value: damaged, not the `pard` default.
+    let unreadable = edit_values(&bytes, "Cryptomatte-0003", &|kids, at| {
+        if let Some(rec) = kids.get_mut(at + 1) {
+            let inner: Vec<Chunk<'static>> = rec.children().iter().filter(|k| !k.is(b"cdat")).cloned().map(Chunk::into_owned).collect();
+            *rec = Chunk::list(*b"tdbs", inner);
+        }
+    });
+    let r = import_bytes(&unreadable);
+    let found = losses(&r, LossCategory::DamagedData);
+    assert!(found.len() == 1 && found[0].contains("Selection Mode") && found[0].contains("unreadable value, off used"), "{found:?}");
+    assert!(losses(&r, LossCategory::Effects).iter().all(|d| !d.contains("is on")));
+    // Both intact: nothing damaged.
+    assert_eq!(losses(&import_bytes(&bytes), LossCategory::DamagedData), Vec::<String>::new());
+}
+
+/// Our own After Effects 2026 sample of the plug-in (2.6.6), corpus `aep/cryptomatte.aep`: one
+/// Cryptomatte on an EXR layer per composition. The first instance has its own definitions, the
+/// others borrow the project's. The first six hold the fresh Settings data (no layer, no
+/// selection); the last two come from presets that chose a layer and picked one object
+/// (`box_red` on CryptoObject) or one material (`mat_paint` on CryptoMaterial) in the plug-in's
+/// UI. The EXR's manifest names those hashes, and After Effects draws exactly those objects as
+/// selected.
+#[test]
+#[ignore = "needs aep/cryptomatte.aep in the corpus (EFFECTCRAFT_AEP_FIXTURES); not pinned yet"]
+fn the_after_effects_sample_arrives_as_after_effects_shows_it() {
+    let bytes = fixture!("cryptomatte.aep");
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    assert_eq!(losses(&r, LossCategory::DamagedData), Vec::<String>::new());
+    let found = losses(&r, LossCategory::Effects);
+    // (composition, Display, Matte Only, layer, selection, the loss it reports): the readbacks
+    // are Output 1 (fresh), 1, 1, 2, 3, 4, 1, 1 and Selection Mode 0, 1, 1, 0, 0, 0, 0, 0.
+    let want = [
+        ("crypto-00-defaults", 0, false, "", "", None),
+        ("crypto-01-set-all", 0, false, "", "", Some("Selection Mode")),
+        ("crypto-02-chk-toggled", 0, false, "", "", Some("Selection Mode")),
+        ("crypto-03-pop2-2", 1, false, "", "", Some("'Matted Colors'")),
+        ("crypto-04-pop2-3", 1, false, "", "", None),
+        ("crypto-05-pop2-4", 1, true, "", "", None),
+        ("crypto-06-preset-object-box", 0, false, "CryptoObject", "<11a97486>", None),
+        ("crypto-07-preset-material-paint", 0, false, "CryptoMaterial", "<a5deeb9e>", None),
+    ];
+    for (comp, display, matte_only, layer, selection, loss) in want {
+        let c = project.find_by_name(comp).and_then(|i| i.as_comp()).unwrap_or_else(|| panic!("no {comp}"));
+        let g = c.layers.iter().find_map(|l| {
+            l.props.sub("effects").and_then(|fx| fx.children.iter().filter_map(|n| n.as_group()).find(|g| g.match_id == "ec.3d.cryptomatte").cloned())
+        });
+        let g = g.unwrap_or_else(|| panic!("{comp}: no Cryptomatte"));
+        assert_eq!(
+            (v(&g, "display"), v(&g, "matteOnly"), v(&g, "layerName"), v(&g, "selection")),
+            (Value::Enum(display), Value::Bool(matte_only), str(layer), str(selection)),
+            "{comp}"
+        );
+        let mine: Vec<_> = found.iter().filter(|d| d.starts_with(&format!("{comp}:"))).collect();
+        match loss {
+            None => assert!(mine.is_empty(), "{comp}: {mine:?}"),
+            Some(what) => assert!(mine.len() == 1 && mine[0].contains(what), "{comp}: {mine:?}"),
+        }
+    }
+    assert_eq!(found.len(), 3, "{found:?}");
+    // The picked tokens are the manifest's hashes, which are the hashes of the names: EffectCraft
+    // reads `<11a97486>` and `box_red` as the same object.
+    for (name, token) in [("box_red", "<11a97486>"), ("mat_paint", "<a5deeb9e>")] {
+        assert_eq!(effectcraft_effects::selection_hashes(token, None), effectcraft_effects::selection_hashes(name, None), "{name}");
+    }
+    assert_eq!(effectcraft_effects::selection_hashes("<11a97486>", None), vec![0x11a9_7486]);
+}
diff --git a/crates/aep/tests/it/import/ease_round2.rs b/crates/aep/tests/it/import/ease_round2.rs
new file mode 100644
index 000000000..1677be165
--- /dev/null
+++ b/crates/aep/tests/it/import/ease_round2.rs
@@ -0,0 +1,80 @@
+//! Eases that were read as linear before: Anchor Point (597, 730), an effect point and an effect
+//! colour (598), mask paths (599, 700). EffectCraft's values between the keys are compared with
+//! After Effects' read-backs (MANIFEST S17 / S19).
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Layer, Project};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+fn at(s: f64) -> Tick {
+    Tick((s * TICKS_PER_SECOND as f64).round() as i64)
+}
+
+fn layer<'p>(p: &'p Project, r: &effectcraft_aep::import::ImportResult, name: &str) -> &'p Layer {
+    let (_, c) = comp(p, r, "C");
+    c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("no {name}"))
+}
+
+fn xy(v: &Value) -> [f64; 2] {
+    match v {
+        Value::Vec2(a) => *a,
+        Value::Vec3(a) => [a[0], a[1]],
+        v => panic!("{v:?}"),
+    }
+}
+
+fn close(got: [f64; 2], want: [f64; 2], tol: f64, what: &str) {
+    assert!((got[0] - want[0]).abs() <= tol && (got[1] - want[1]).abs() <= tol, "{what}: {got:?} vs After Effects {want:?}");
+}
+
+#[test]
+fn anchor_point_ease_matches_after_effects() {
+    for (name, l, want) in [
+        ("597-key-anchor-ease-out50-40-in30-60.aep", "L", [[1004.4121, 562.2061], [1084.8353, 602.4177], [1137.1339, 628.5670]]),
+        ("730-key-anchor-ease-on-400x800-solid.aep", "P", [[225.2343, 425.2343], [261.4341, 461.4341], [286.0550, 486.0550]]),
+    ] {
+        let (p, r) = load!(name);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        let a = layer(&p, &r, l).props.prop("transform/anchor").unwrap();
+        for (t, w) in [0.5, 1.0, 1.5].into_iter().zip(want) {
+            close(xy(&a.value_at(at(t))), w, 0.5, &format!("{name} at {t} s"));
+        }
+    }
+}
+
+#[test]
+fn effect_point_and_colour_ease_match_after_effects() {
+    let (p, r) = load!("598-key-ramp-point-ease-color-bezier.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let l = layer(&p, &r, "L");
+    let fx = l.props.sub("effects").and_then(|e| e.groups().next()).expect("ramp");
+    let start = fx.prop("start").unwrap();
+    for (t, w) in [0.5, 1.0, 1.5].into_iter().zip([[178.4012, 239.2006], [353.0563, 326.5281], [462.9131, 381.4566]]) {
+        close(xy(&start.value_at(at(t))), w, 0.5, &format!("Start of Ramp at {t} s"));
+    }
+    let colour = fx.prop("startColor").unwrap();
+    for (t, red) in [(0.5, 0.75), (1.0, 0.5), (1.5, 0.25)] {
+        let Value::Color(c) = colour.value_at(at(t)) else { panic!() };
+        assert!((c[0] - red).abs() < 1e-3 && (c[2] - (1.0 - red)).abs() < 1e-3, "{t}: {c:?}");
+    }
+}
+
+#[test]
+fn mask_path_ease_matches_after_effects() {
+    for (name, want) in [
+        ("599-key-mask-path-ease-infl75.aep", [[849.1606, 434.5803], [760.0, 390.0], [670.8394, 345.4197]]),
+        ("700-key-mask-path-ease-out20-in50.aep", [[803.9844, 411.9922], [727.6194, 373.8097], [676.9510, 348.4755]]),
+    ] {
+        let (p, r) = load!(name);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        let l = layer(&p, &r, "L");
+        let mask = l.props.sub("masks").and_then(|m| m.groups().next()).expect("mask");
+        let path = mask.prop("path").unwrap();
+        for (t, w) in [0.5, 1.0, 1.5].into_iter().zip(want) {
+            let Value::Path(s) = path.value_at(at(t)) else { panic!() };
+            let v = s.vertices.iter().copied().fold([f64::MAX, f64::MAX], |m, v| [m[0].min(v[0]), m[1].min(v[1])]);
+            close(v, w, 0.5, &format!("{name} at {t} s"));
+        }
+    }
+}
diff --git a/crates/aep/tests/it/import/effects.rs b/crates/aep/tests/it/import/effects.rs
new file mode 100644
index 000000000..52f618520
--- /dev/null
+++ b/crates/aep/tests/it/import/effects.rs
@@ -0,0 +1,312 @@
+//! Effects: Tint, Gradient Ramp and Exposure arrive with every parameter and key in EffectCraft's
+//! units (cases 356-397, the values each case was made with), in stack order; other effects and
+//! parameters are reported.
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{LossCategory, analyze, supported_effects};
+use effectcraft_keyframe::{Interp, Value};
+use effectcraft_project::{GroupKind, Layer, Project, PropGroup};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+/// The layer named `name` in composition `C`.
+fn layer<'p>(project: &'p Project, r: &effectcraft_aep::import::ImportResult, name: &str) -> &'p Layer {
+    let (_, c) = comp(project, r, "C");
+    c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("no layer {name}"))
+}
+
+/// The effect instances of a layer, in stack order.
+fn effects(l: &Layer) -> Vec<&PropGroup> {
+    l.props.sub("effects").expect("an effects group").groups().collect()
+}
+
+/// The only effect of `L` in a fixture imported without losses.
+fn only_effect(name: &str) -> Option<PropGroup> {
+    Some({
+        let mut project = Project::default();
+        let r = crate::import::helpers::try_import_fixture(&mut project, name, false)?.unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        assert_eq!(r.report.imported.effects, 1, "{name}");
+        let fx = effects(layer(&project, &r, "L"));
+        assert_eq!(fx.len(), 1, "{name}");
+        fx[0].clone()
+    })
+}
+
+/// A parameter by its id; grouped ones by path (`master/exposure`).
+fn value(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no parameter {id}")).value.clone()
+}
+
+fn assert_scalar(v: Value, want: f64, tol: f64) {
+    let Value::Scalar(x) = v else { panic!("{v:?} is not a number") };
+    assert!((x - want).abs() <= tol, "{x} != {want}");
+}
+
+fn assert_color(v: Value, want: [f64; 4], tol: f64) {
+    let Value::Color(c) = v else { panic!("{v:?} is not a colour") };
+    for (g, w) in c.iter().zip(want) {
+        assert!((g - w).abs() <= tol, "{c:?} != {want:?}");
+    }
+}
+
+fn assert_vec2(v: Value, want: [f64; 2]) {
+    let Value::Vec2(p) = v else { panic!("{v:?} is not a point") };
+    for (g, w) in p.iter().zip(want) {
+        assert!((g - w).abs() <= 1e-9, "{p:?} != {want:?}");
+    }
+}
+
+const T1: Tick = Tick(TICKS_PER_SECOND);
+const T2: Tick = Tick(2 * TICKS_PER_SECOND);
+
+#[test]
+fn the_table_names_tint_gradient_ramp_and_exposure() {
+    let t: Vec<_> = supported_effects().collect();
+    for want in [
+        ("ADBE Tint", "ec.color.tint"),
+        ("ADBE Ramp", "ec.generate.gradientramp"),
+        ("ADBE Exposure2", "ec.color.exposure"),
+        ("ADBE Glo2", "ec.stylize.glow"),
+        ("ADBE Easy Levels2", "ec.color.levels"),
+        ("ADBE Timewarp", "ec.time.timewarp"),
+    ] {
+        assert!(t.contains(&want), "{want:?}");
+    }
+    assert_eq!(t.len(), 67);
+    for (_, id) in t {
+        assert!(effectcraft_effects::find(id).is_some(), "{id}");
+    }
+}
+
+// ---------------------------------------------------------------------------- Tint
+
+#[test]
+fn default_tint_equals_effectcrafts_default() {
+    // 356: every parameter at its default (alpha 0 in the file's defaults; the colours arrive opaque).
+    let g = skip!(only_effect("356-fx-tint-default.aep"));
+    assert_eq!((g.match_id.as_str(), g.name.as_str()), ("ec.color.tint", "Tint"));
+    assert!(matches!(&g.kind, GroupKind::Effect { effect } if effect == "ec.color.tint"));
+    assert!(g.enabled);
+    assert_eq!(value(&g, "black"), Value::Color([0.0, 0.0, 0.0, 1.0]));
+    assert_eq!(value(&g, "white"), Value::Color([1.0, 1.0, 1.0, 1.0]));
+    assert_eq!(value(&g, "amount"), Value::Scalar(100.0));
+    // The file's pard defaults, converted, are EffectCraft's defaults.
+    let spec = effectcraft_effects::find("ec.color.tint").unwrap();
+    for ps in &spec.params {
+        assert_eq!(value(&g, ps.id), effectcraft_effects::default_value(ps, [1920.0, 1080.0]), "{}", ps.id);
+    }
+}
+
+#[test]
+fn tint_values() {
+    // 357: Map Black To [0.2, 0.4, 0.6] (float32 in the file).
+    let g = skip!(only_effect("357-fx-tint-black-0.2-0.4-0.6.aep"));
+    assert_color(value(&g, "black"), [0.2, 0.4, 0.6, 1.0], 1e-7);
+    assert_eq!(value(&g, "white"), Value::Color([1.0, 1.0, 1.0, 1.0]));
+    // 361: Amount to Tint 0.
+    assert_eq!(value(&skip!(only_effect("361-fx-tint-amount-0.aep")), "amount"), Value::Scalar(0.0));
+}
+
+#[test]
+fn tint_keyframes() {
+    // 363: Amount to Tint 20 at 0 s, 80 at 2 s, linear; After Effects reads 50 at 1 s.
+    let g = skip!(only_effect("363-fx-tint-amount-2key.aep"));
+    let p = g.get("amount").unwrap();
+    assert_eq!(p.keys.iter().map(|k| (k.time, k.value.clone())).collect::<Vec<_>>(), [(Tick::ZERO, Value::Scalar(20.0)), (T2, Value::Scalar(80.0))]);
+    assert!(p.keys.iter().all(|k| k.in_interp == Interp::Linear && k.out_interp == Interp::Linear));
+    assert_eq!(p.value_at(T1), Value::Scalar(50.0));
+
+    // 364: Map White To [1,1,0] at 0 s, [0,0,1] at 2 s, linear; [0.5,0.5,0.5] at 1 s.
+    let g = skip!(only_effect("364-fx-tint-white-2key.aep"));
+    let p = g.get("white").unwrap();
+    assert_eq!(p.keys.len(), 2);
+    assert_eq!((p.keys[0].time, p.keys[1].time), (Tick::ZERO, T2));
+    assert_eq!(p.keys[0].value, Value::Color([1.0, 1.0, 0.0, 1.0]));
+    assert_eq!(p.keys[1].value, Value::Color([0.0, 0.0, 1.0, 1.0]));
+    assert_color(p.value_at(T1), [0.5, 0.5, 0.5, 1.0], 1e-9);
+}
+
+#[test]
+fn stack_order_is_kept_and_other_effects_are_reported() {
+    // 366: Gaussian Blur above Tint: both arrive, in stack order.
+    let (project, r) = load!("366-fx-blur-then-tint.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.imported.effects, 2);
+    let fx = effects(layer(&project, &r, "L"));
+    assert_eq!(fx.iter().map(|g| g.match_id.as_str()).collect::<Vec<_>>(), ["ec.blur.gaussian", "ec.color.tint"]);
+}
+
+// ---------------------------------------------------------------------------- Gradient Ramp
+
+#[test]
+fn default_ramp_equals_effectcrafts_default() {
+    // 368: Start [960, 0], End [960, 1080] on the 1920x1080 solid, black to white, linear.
+    let g = skip!(only_effect("368-fx-ramp-default.aep"));
+    assert_eq!((g.match_id.as_str(), g.name.as_str()), ("ec.generate.gradientramp", "Gradient Ramp"));
+    assert_eq!(value(&g, "start"), Value::Vec2([960.0, 0.0]));
+    assert_eq!(value(&g, "end"), Value::Vec2([960.0, 1080.0]));
+    assert_eq!(value(&g, "startColor"), Value::Color([0.0, 0.0, 0.0, 1.0]));
+    assert_eq!(value(&g, "endColor"), Value::Color([1.0, 1.0, 1.0, 1.0]));
+    assert_eq!(value(&g, "shape"), Value::Enum(0));
+    assert_eq!(value(&g, "scatter"), Value::Scalar(0.0));
+    assert_eq!(value(&g, "blend"), Value::Scalar(0.0));
+    let spec = effectcraft_effects::find("ec.generate.gradientramp").unwrap();
+    for ps in &spec.params {
+        assert_eq!(value(&g, ps.id), effectcraft_effects::default_value(ps, [1920.0, 1080.0]), "{}", ps.id);
+    }
+}
+
+#[test]
+fn ramp_values() {
+    assert_vec2(value(&skip!(only_effect("369-fx-ramp-start-100-200.aep")), "start"), [100.0, 200.0]);
+    assert_eq!(value(&skip!(only_effect("371-fx-ramp-startcolor-red.aep")), "startColor"), Value::Color([1.0, 0.0, 0.0, 1.0]));
+    // Outside the layer stays outside.
+    assert_vec2(value(&skip!(only_effect("374-fx-ramp-end-2000-m100.aep")), "end"), [2000.0, -100.0]);
+    // Radial Ramp is item 2 in the file, 1 here.
+    assert_eq!(value(&skip!(only_effect("377-fx-ramp-shape-radial.aep")), "shape"), Value::Enum(1));
+    // Scatter in pixels; Blend With Original 0.25 in the file is 25 % here.
+    assert_eq!(value(&skip!(only_effect("378-fx-ramp-scatter-12.aep")), "scatter"), Value::Scalar(12.0));
+    assert_eq!(value(&skip!(only_effect("380-fx-ramp-blend-25pct.aep")), "blend"), Value::Scalar(25.0));
+}
+
+#[test]
+fn ramp_point_keyframes() {
+    // 382: Start of Ramp [100,100] at 0 s, [1800,900] at 2 s, linear; [950,500] at 1 s.
+    let g = skip!(only_effect("382-fx-ramp-start-2key.aep"));
+    let p = g.get("start").unwrap();
+    assert_eq!(p.keys.len(), 2);
+    assert_eq!((p.keys[0].time, p.keys[1].time), (Tick::ZERO, T2));
+    assert_vec2(p.keys[0].value.clone(), [100.0, 100.0]);
+    assert_vec2(p.keys[1].value.clone(), [1800.0, 900.0]);
+    assert!(p.keys.iter().all(|k| k.in_interp == Interp::Linear && k.out_interp == Interp::Linear));
+    assert_vec2(p.value_at(T1), [950.0, 500.0]);
+    assert_eq!(p.keys[0].spatial_in, [0.0; 3]);
+}
+
+#[test]
+fn second_instance_on_another_layer() {
+    // 383: L keeps its default Ramp (its parT is empty); S100 (100x100) has Start [10,20].
+    let mut project = Project::default();
+    let r = try_import!(&mut project, "383-fx-ramp-on-100x100-start-10-20.aep", false).unwrap();
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.imported.effects, 2);
+    let small = effects(layer(&project, &r, "S100"));
+    assert_eq!(small.len(), 1);
+    assert_eq!(value(small[0], "start"), Value::Vec2([10.0, 20.0]));
+    // Its default End is relative to its own size: [50, 100].
+    assert_eq!(value(small[0], "end"), Value::Vec2([50.0, 100.0]));
+    // L: the defaults on 1920x1080, not S100's values from the project-level copy.
+    let l = effects(layer(&project, &r, "L"));
+    assert_eq!(l.len(), 1);
+    assert_eq!(value(l[0], "start"), Value::Vec2([960.0, 0.0]));
+    assert_eq!(value(l[0], "end"), Value::Vec2([960.0, 1080.0]));
+    assert_eq!(value(l[0], "shape"), Value::Enum(0));
+    assert_eq!(value(l[0], "startColor"), Value::Color([0.0, 0.0, 0.0, 1.0]));
+}
+
+// ---------------------------------------------------------------------------- Exposure
+
+/// Exposure's slider ids per group, in the file's order (Exposure, Offset, Gamma Correction).
+const EXPOSURE_GROUPS: [[&str; 3]; 4] = [
+    ["master/exposure", "master/offset", "master/gamma"],
+    ["red/redExposure", "red/redOffset", "red/redGamma"],
+    ["green/greenExposure", "green/greenOffset", "green/greenGamma"],
+    ["blue/blueExposure", "blue/blueOffset", "blue/blueGamma"],
+];
+
+/// Float sliders hold the float32 value (0.1 is 0.10000000149).
+const F32: f64 = 1e-6;
+
+#[test]
+fn default_exposure_equals_effectcrafts_default() {
+    // 389: every parameter at its default; the group markers carry nothing (no losses).
+    let g = skip!(only_effect("389-fx-exposure-default.aep"));
+    assert_eq!((g.match_id.as_str(), g.name.as_str()), ("ec.color.exposure", "Exposure"));
+    assert_eq!(value(&g, "channels"), Value::Enum(0));
+    for ids in EXPOSURE_GROUPS {
+        assert_eq!([value(&g, ids[0]), value(&g, ids[1]), value(&g, ids[2])], [Value::Scalar(0.0), Value::Scalar(0.0), Value::Scalar(1.0)]);
+    }
+    assert_eq!(value(&g, "bypassLinearLight"), Value::Bool(false));
+    let spec = effectcraft_effects::find("ec.color.exposure").unwrap();
+    for ps in &spec.params {
+        assert_eq!(value(&g, ps.id), effectcraft_effects::default_value(ps, [1920.0, 1080.0]), "{}", ps.id);
+    }
+}
+
+#[test]
+fn exposure_values() {
+    // 390: Channels -> Individual Channels (2 in the file, 1 here).
+    assert_eq!(value(&skip!(only_effect("390-fx-exposure-channels-individual.aep")), "channels"), Value::Enum(1));
+    // 391: Exposure 1.5 stops, the rest default.
+    let g = skip!(only_effect("391-fx-exposure-master-1.5.aep"));
+    assert_eq!(value(&g, "master/exposure"), Value::Scalar(1.5));
+    assert_eq!((value(&g, "master/offset"), value(&g, "master/gamma"), value(&g, "channels")), (Value::Scalar(0.0), Value::Scalar(1.0), Value::Enum(0)));
+    // 393: Offset 0.1; 394: Gamma Correction 2.2 (float32 in the file, imported as stored).
+    assert_scalar(value(&skip!(only_effect("393-fx-exposure-offset-0.1.aep")), "master/offset"), 0.1, F32);
+    assert_scalar(value(&skip!(only_effect("394-fx-exposure-gamma-2.2.aep")), "master/gamma"), 2.2, F32);
+    // 395: Individual Channels and Red Exposure 1; Master and the other channels stay default.
+    let g = skip!(only_effect("395-fx-exposure-individual-red-1.aep"));
+    assert_eq!(value(&g, "channels"), Value::Enum(1));
+    assert_eq!(value(&g, "red/redExposure"), Value::Scalar(1.0));
+    assert_eq!(
+        (value(&g, "master/exposure"), value(&g, "green/greenExposure"), value(&g, "blue/blueExposure")),
+        (Value::Scalar(0.0), Value::Scalar(0.0), Value::Scalar(0.0))
+    );
+    // 396: Bypass Linear Light Conversion on.
+    let g = skip!(only_effect("396-fx-exposure-bypass-on.aep"));
+    assert_eq!(value(&g, "bypassLinearLight"), Value::Bool(true));
+    assert_eq!(value(&g, "master/exposure"), Value::Scalar(0.0));
+}
+
+#[test]
+fn exposure_keyframes() {
+    // 397: Exposure -1 at 0 s, 2 at 2 s, linear; After Effects reads 0.5 at 1 s.
+    let g = skip!(only_effect("397-fx-exposure-master-2key.aep"));
+    let p = g.prop("master/exposure").unwrap();
+    assert_eq!(p.keys.iter().map(|k| (k.time, k.value.clone())).collect::<Vec<_>>(), [(Tick::ZERO, Value::Scalar(-1.0)), (T2, Value::Scalar(2.0))]);
+    assert!(p.keys.iter().all(|k| k.in_interp == Interp::Linear && k.out_interp == Interp::Linear));
+    assert_eq!(p.value_at(T1), Value::Scalar(0.5));
+    // The other sliders are not keyed.
+    assert!(g.prop("master/offset").unwrap().keys.is_empty());
+}
+
+#[test]
+fn unmapped_effects_stay_reported_by_match_name() {
+    // A dropdown is not in the table (a Layer Control is since 905).
+    {
+        let (name, matchname) = ("077-fx-dropdown-default.aep", "Pseudo/");
+        let report = analyze(&fixture!(name), &|_| false).unwrap();
+        assert_eq!(report.count(LossCategory::Effects), 1, "{name}");
+        assert_eq!(report.imported.effects, 0);
+        assert!(report.losses[0].details[0].contains(matchname), "{:?}", report.losses);
+    }
+}
+
+#[test]
+fn imported_effects_survive_a_json_round_trip() {
+    let (project, r) = load!("383-fx-ramp-on-100x100-start-10-20.aep");
+    let json = serde_json::to_string(&project).unwrap();
+    let back: Project = serde_json::from_str(&json).unwrap();
+    assert_eq!(effects(layer(&back, &r, "S100"))[0].get("start").unwrap().value, Value::Vec2([10.0, 20.0]));
+    let report = serde_json::to_value(&r.report).unwrap();
+    assert_eq!(report["imported"]["effects"], 2);
+}
+
+#[test]
+fn a_renamed_effect_keeps_its_name() {
+    // 610: a Tint added with the name My Tint (fnam stays Tint, the name is in the value group).
+    assert_eq!(skip!(only_effect("610-fx-tint-named-My-Tint.aep")).name, "My Tint");
+    assert_eq!(skip!(only_effect("356-fx-tint-default.aep")).name, "Tint");
+}
+
+#[test]
+fn a_switched_off_effect_arrives_switched_off() {
+    let bytes = skip!(crate::common::try_file("fx-switch.aep"));
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = effectcraft_aep::import::import(&mut p, &bytes, &effectcraft_aep::import::ImportOptions::new(&none)).expect("lossless import");
+    let (_, c) = comp(&p, &r, "C");
+    let fx = c.layers[0].props.sub("effects").expect("effects");
+    let on: Vec<bool> = fx.children.iter().filter_map(|n| if let effectcraft_project::Node::Group(g) = n { Some(g.enabled) } else { None }).collect();
+    assert_eq!(on, [false, true]);
+}
diff --git a/crates/aep/tests/it/import/effects_batch5.rs b/crates/aep/tests/it/import/effects_batch5.rs
new file mode 100644
index 000000000..734fbcfcb
--- /dev/null
+++ b/crates/aep/tests/it/import/effects_batch5.rs
@@ -0,0 +1,196 @@
+//! The effects of batch 5 (409-450, 511-516) and the expression controls and Fill of earlier
+//! batches import without losses with the values they were made with.
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Project, PropGroup};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+/// The only effect of layer L, imported without losses.
+fn only_effect(name: &str) -> Option<PropGroup> {
+    Some({
+        let mut p = Project::default();
+        let r = crate::import::helpers::try_import_fixture(&mut p, name, false)?.unwrap_or_else(|e| panic!("{name}: lossless import refused: {e}"));
+        let (_, c) = comp(&p, &r, "C");
+        let l = c.layers.iter().find(|l| l.name == "L").expect("L");
+        let fx = l.props.sub("effects").expect("effects");
+        let groups: Vec<_> = fx.children.iter().filter_map(|n| n.as_group()).cloned().collect();
+        assert_eq!(groups.len(), 1, "{name}");
+        groups.into_iter().next().expect("effect")
+    })
+}
+
+fn v(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id} in {}", g.match_id)).value.clone()
+}
+
+fn s(x: f64) -> Value {
+    Value::Scalar(x)
+}
+
+fn close(a: &Value, b: f64) {
+    let Value::Scalar(a) = a else { panic!("{a:?}") };
+    assert!((a - b).abs() < 1e-6, "{a} != {b}");
+}
+
+#[test]
+fn invert() {
+    let g = skip!(only_effect("410-fx-invert-channel-2.aep"));
+    assert_eq!(g.match_id, "ec.channel.invert");
+    // The second file item, Red, is EffectCraft's item 1 (the separators are skipped by name).
+    assert_eq!((v(&g, "channel"), v(&g, "blend")), (Value::Enum(1), s(0.0)));
+    let g = skip!(only_effect("411-fx-invert-blend-50.aep"));
+    assert_eq!((v(&g, "channel"), v(&g, "blend")), (Value::Enum(0), s(50.0)));
+}
+
+#[test]
+fn fast_box_blur_and_gaussian_blur() {
+    let g = skip!(only_effect("413-fx-fastbox-radius-20.aep"));
+    assert_eq!(
+        (v(&g, "radius"), v(&g, "iterations"), v(&g, "dimensions"), v(&g, "repeatEdge")),
+        (s(20.0), s(3.0), Value::Enum(0), Value::Bool(true)),
+        "Repeat Edge Pixels is on by default"
+    );
+    assert_eq!(v(&skip!(only_effect("414-fx-fastbox-iterations-1.aep")), "iterations"), s(1.0));
+    assert_eq!(v(&skip!(only_effect("416-fx-fastbox-repeatedge-off.aep")), "repeatEdge"), Value::Bool(false));
+
+    let g = skip!(only_effect("418-fx-gaussian-dimensions-3.aep"));
+    assert_eq!((v(&g, "blurriness"), v(&g, "dimensions"), v(&g, "repeatEdge")), (s(25.0), Value::Enum(2), Value::Bool(true)));
+    assert_eq!(v(&skip!(only_effect("419-fx-gaussian-repeatedge-off.aep")), "repeatEdge"), Value::Bool(false));
+    assert_eq!(v(&skip!(only_effect("216-fx-gaussianblur-40.aep")), "blurriness"), s(40.0));
+    assert_eq!(v(&skip!(only_effect("214-fx-gaussianblur-default.aep")), "blurriness"), s(25.0));
+}
+
+#[test]
+fn drop_shadow() {
+    let g = skip!(only_effect("422-fx-dropshadow-opacity-204.aep"));
+    assert_eq!(g.match_id, "ec.perspective.dropshadow");
+    close(&v(&g, "opacity"), 80.0);
+    assert_eq!((v(&g, "direction"), v(&g, "distance"), v(&g, "softness"), v(&g, "shadowOnly")), (s(135.0), s(5.0), s(0.0), Value::Bool(false)));
+    assert_eq!(v(&g, "color"), Value::Color([0.0, 0.0, 0.0, 1.0]));
+    assert_eq!(v(&skip!(only_effect("426-fx-dropshadow-shadowonly-on.aep")), "shadowOnly"), Value::Bool(true));
+    close(&v(&skip!(only_effect("080-fx-dropshadow-default.aep")), "opacity"), 50.0);
+}
+
+#[test]
+fn glow_defaults_follow_after_effects() {
+    let g = skip!(only_effect("427-fx-glow-default.aep"));
+    assert_eq!(g.match_id, "ec.stylize.glow");
+    assert_eq!(v(&g, "based"), Value::Enum(1), "Color Channels");
+    close(&v(&g, "threshold"), 60.0);
+    assert_eq!((v(&g, "radius"), v(&g, "intensity")), (s(10.0), s(1.0)));
+    assert_eq!(v(&g, "operation"), Value::Enum(1), "Composite Original: Behind");
+    assert_eq!(v(&g, "glowOperation"), Value::Enum(1), "Add");
+    assert_eq!((v(&g, "colors"), v(&g, "colorLooping")), (Value::Enum(0), Value::Enum(2)));
+    assert_eq!((v(&g, "colorLoops"), v(&g, "colorPhase")), (s(1.0), s(0.0)));
+    close(&v(&g, "abMidpoint"), 50.0);
+    assert_eq!((v(&g, "colorA"), v(&g, "colorB"), v(&g, "glowDimensions")), (Value::Color([1.0; 4]), Value::Color([0.0, 0.0, 0.0, 1.0]), Value::Enum(0)));
+    close(&v(&skip!(only_effect("429-fx-glow-threshold-76.5.aep")), "threshold"), 30.0);
+    close(&v(&skip!(only_effect("438-fx-glow-midpoint-0.25.aep")), "abMidpoint"), 25.0);
+}
+
+#[test]
+fn hue_saturation_master_values_and_colorize() {
+    let g = skip!(only_effect("444-fx-huesat-hue-90.aep"));
+    assert_eq!(g.match_id, "ec.color.huesaturation");
+    assert_eq!((v(&g, "hue"), v(&g, "saturation"), v(&g, "lightness")), (s(90.0), s(0.0), s(0.0)));
+    assert_eq!(v(&skip!(only_effect("446-fx-huesat-light-m30.aep")), "lightness"), s(-30.0));
+    let g = skip!(only_effect("448-fx-huesat-colorizehue-120.aep"));
+    assert_eq!((v(&g, "colorize"), v(&g, "colorizeHue"), v(&g, "colorizeSaturation"), v(&g, "hue")), (Value::Bool(false), s(120.0), s(25.0), s(0.0)));
+}
+
+#[test]
+fn levels_values_from_the_data() {
+    let f32r = |x: f64| f64::from(x as f32);
+    let g = skip!(only_effect("512-fx-levels-inblack-0.1.aep"));
+    assert_eq!(g.match_id, "ec.color.levels");
+    assert_eq!((v(&g, "inBlack"), v(&g, "inWhite"), v(&g, "gamma"), v(&g, "outBlack"), v(&g, "outWhite")), (s(f32r(0.1)), s(1.0), s(1.0), s(0.0), s(1.0)));
+    // Clip To Output Black / White: After Effects' default "Off for 32 bpc Color" (item 3 there,
+    // item 2 here).
+    assert_eq!((v(&g, "clipToOutputBlack"), v(&g, "clipToOutputWhite"), v(&g, "channel")), (Value::Enum(2), Value::Enum(2), Value::Enum(0)));
+    assert_eq!(v(&skip!(only_effect("514-fx-levels-gamma-2.aep")), "gamma"), s(2.0));
+    assert_eq!(v(&skip!(only_effect("516-fx-levels-outwhite-0.9.aep")), "outWhite"), s(f32r(0.9)));
+}
+
+#[test]
+fn expression_controls() {
+    assert_eq!(v(&skip!(only_effect("071-fx-slider-value77.aep")), "slider"), s(77.0));
+    assert_eq!(v(&skip!(only_effect("304-fx-slider-0-explicit.aep")), "slider"), s(0.0));
+    let k = skip!(only_effect("221-fx-slider-2key.aep")).prop("slider").expect("slider").keys.clone();
+    assert_eq!(k.iter().map(|k| (k.time, k.value.clone())).collect::<Vec<_>>(), vec![(Tick::ZERO, s(10.0)), (Tick(2 * TICKS_PER_SECOND), s(90.0))]);
+    assert_eq!(v(&skip!(only_effect("217-fx-checkbox-on.aep")), "checkbox"), Value::Bool(true));
+    let Value::Color(c) = v(&skip!(only_effect("073-fx-color-0.2-0.6-1.aep")), "color") else { panic!("colour") };
+    for (a, b) in c.iter().zip([0.2, 0.6, 1.0, 1.0]) {
+        assert!((a - b).abs() < 1e-6, "{c:?}");
+    }
+    let Value::Vec2(p) = v(&skip!(only_effect("218-fx-point-111-222.aep")), "point") else { panic!("point") };
+    assert!((p[0] - 111.0).abs() < 1e-6 && (p[1] - 222.0).abs() < 1e-6, "{p:?}");
+    assert_eq!(v(&skip!(only_effect("219-fx-angle-90.aep")), "angle"), s(90.0));
+}
+
+#[test]
+fn fill() {
+    let g = skip!(only_effect("215-fx-fill-default.aep"));
+    assert_eq!(g.match_id, "ec.generate.fill");
+    assert_eq!(
+        (v(&g, "color"), v(&g, "allMasks"), v(&g, "invert"), v(&g, "horizontalFeather"), v(&g, "verticalFeather")),
+        (Value::Color([1.0, 0.0, 0.0, 1.0]), Value::Bool(false), Value::Bool(false), s(0.0), s(0.0))
+    );
+    close(&v(&g, "opacity"), 100.0);
+    close(&v(&skip!(only_effect("303-fx-fill-opacity-50-then-100.aep")), "opacity"), 100.0);
+}
+
+/// Drops every `pdnm` (popup items) from the tree.
+fn drop_pdnm(chunks: &mut Vec<effectcraft_aep::Chunk<'_>>) -> usize {
+    let before = chunks.len();
+    chunks.retain(|c| c.id != *b"pdnm");
+    let mut n = before - chunks.len();
+    for c in chunks.iter_mut() {
+        if let effectcraft_aep::Body::List { children, .. } | effectcraft_aep::Body::Chunks(children) = &mut c.body {
+            n += drop_pdnm(children);
+        }
+    }
+    n
+}
+
+#[test]
+fn popups_without_item_names_use_after_effects_items() {
+    // A popup may come without its `pdnm`; the item count in `pard` still says how many
+    // there are. 410 (Invert Channel Red) and 427 (Glow) with every `pdnm` removed.
+    for (name, id, want) in
+        [("410-fx-invert-channel-2.aep", "channel", 1), ("427-fx-glow-default.aep", "operation", 1), ("427-fx-glow-default.aep", "glowOperation", 1)]
+    {
+        let bytes = fixture!(name);
+        let mut file = effectcraft_aep::parse(&bytes).expect("parse");
+        assert!(drop_pdnm(&mut file.chunks) > 0, "{name}");
+        let bytes = effectcraft_aep::write(&file).expect("write");
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let r = effectcraft_aep::import::import(&mut p, &bytes, &effectcraft_aep::import::ImportOptions::new(&none)).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let (_, c) = comp(&p, &r, "C");
+        let l = c.layers.iter().find(|l| l.name == "L").expect("L");
+        let g = l.props.sub("effects").and_then(|fx| fx.children.iter().find_map(|n| n.as_group())).expect("effect");
+        assert_eq!(v(g, id), Value::Enum(want), "{name} {id}");
+    }
+}
+
+#[test]
+fn timewarp() {
+    let g = skip!(only_effect("529-fx-timewarp-default.aep"));
+    assert_eq!(g.match_id, "ec.time.timewarp");
+    // After Effects' defaults: Pixel Motion, by Speed, 50, Source Frame 0.
+    assert_eq!((v(&g, "method"), v(&g, "adjustTimeBy"), v(&g, "speed"), v(&g, "sourceFrame")), (Value::Enum(2), Value::Enum(0), s(50.0), s(0.0)));
+    assert_eq!(v(&skip!(only_effect("530-fx-timewarp-speed-25.aep")), "speed"), s(25.0));
+    let k = skip!(only_effect("531-fx-timewarp-speed-keyed-50-200.aep")).prop("speed").expect("speed").keys.clone();
+    assert_eq!(k.iter().map(|k| (k.time, k.value.clone())).collect::<Vec<_>>(), vec![(Tick::ZERO, s(50.0)), (Tick(2 * TICKS_PER_SECOND), s(200.0))]);
+    assert_eq!(v(&skip!(only_effect("532-fx-timewarp-method-1.aep")), "method"), Value::Enum(0));
+    let g = skip!(only_effect("533-fx-timewarp-sourceframe-12.aep"));
+    assert_eq!((v(&g, "adjustTimeBy"), v(&g, "sourceFrame")), (Value::Enum(1), s(12.0)));
+}
+
+#[test]
+fn an_expression_on_an_effect_parameter() {
+    let g = skip!(only_effect("534-fx-slider-expression-time10.aep"));
+    let e = g.prop("slider").and_then(|p| p.expr.clone()).expect("expression");
+    assert_eq!((e.text.as_str(), e.enabled), ("time*10", true));
+}
diff --git a/crates/aep/tests/it/import/effects_quickwins.rs b/crates/aep/tests/it/import/effects_quickwins.rs
new file mode 100644
index 000000000..f2b0594b6
--- /dev/null
+++ b/crates/aep/tests/it/import/effects_quickwins.rs
@@ -0,0 +1,179 @@
+//! HDR Highlight Compression, Echo, Linear Wipe, Offset and Color Stabilizer (#3110) arrive as
+//! EffectCraft's effects of the same name. Each is built into `synthetic.aep` (`fx_inject`) with
+//! the definitions After Effects 2026 wrote for it in the importer block of 2026-11-05 (valid
+//! ranges, defaults, popup items) and the values of that block's compositions.
+
+use crate::import::fx_inject::{Default, Fx, losses, near, num, other, popup, pt, run, slider, v};
+use effectcraft_aep::ParamKind as K;
+use effectcraft_aep::import::LossCategory;
+use effectcraft_keyframe::Value;
+
+const ECHO_OPS: &[&str] = &["Add", "Maximum", "Minimum", "Screen", "Composite In Back", "Composite In Front", "Blend"];
+
+/// Echo with the definitions After Effects 2026 wrote and the stored `values`.
+fn echo(values: Vec<(usize, f64)>) -> Fx {
+    Fx {
+        match_name: "ADBE Echo",
+        name: "Echo",
+        defs: vec![
+            slider(K::FloatSlider, "Echo Time (seconds)", -1.0 / 30.0, (-30000.0, 30000.0)),
+            slider(K::IntSlider, "Number Of Echoes", 1.0, (0.0, 30000.0)),
+            slider(K::FloatSlider, "Starting Intensity", 1.0, (0.0, 1.0)),
+            slider(K::FloatSlider, "Decay", 1.0, (0.0, 100.0)),
+            popup("Echo Operator", 1, ECHO_OPS),
+        ],
+        values,
+        data: vec![],
+        keys: vec![],
+    }
+}
+
+/// HDR Highlight Compression's Amount, set and default.
+#[test]
+fn hdr_highlight_compression_amount() {
+    let fx = |values| Fx {
+        match_name: "ADBE HDR ToneMap",
+        name: "HDR Highlight Compression",
+        defs: vec![slider(K::FloatSlider, "Amount", 100.0, (0.0, 100.0))],
+        values,
+        data: vec![],
+        keys: vec![],
+    };
+    // `hdr-01-set-all`: 90; `hdr-00-defaults`: no record, 100.
+    for (values, want) in [(vec![(1, 90.0)], 90.0), (vec![], 100.0)] {
+        let (g, r) = run(&fx(values), "ec.utility.hdrcompression");
+        assert_eq!(losses(&r, LossCategory::Effects, "ADBE HDR ToneMap"), Vec::<String>::new());
+        near(&g.expect("imported"), "amount", want);
+    }
+}
+
+/// Echo's values and operator, set and default.
+#[test]
+fn echo_values_and_operator() {
+    // `echo-01-set-all` (without its Decay 20, below) and `echo-09-pop5-6`.
+    let (g, r) = run(&echo(vec![(1, 9.967), (2, 14.0), (3, 0.0), (5, 6.0)]), "ec.time.echo");
+    assert_eq!(losses(&r, LossCategory::Effects, "ADBE Echo"), Vec::<String>::new());
+    let g = g.expect("imported");
+    near(&g, "echoTime", 9.967);
+    near(&g, "numberOfEchoes", 14.0);
+    near(&g, "startingIntensity", 0.0);
+    near(&g, "decay", 1.0);
+    assert_eq!(v(&g, "echoOperator"), Value::Enum(5), "Composite In Front");
+    // `echo-00-defaults`: one echo a frame back (1/30 s), Add.
+    let (g, _) = run(&echo(vec![]), "ec.time.echo");
+    let g = g.expect("imported");
+    assert!((num(&g, "echoTime") + 1.0 / 30.0).abs() < 1e-6);
+    assert_eq!((num(&g, "numberOfEchoes"), v(&g, "echoOperator")), (1.0, Value::Enum(0)));
+}
+
+/// Echo values beyond EffectCraft's ranges are imported as stored and reported.
+#[test]
+fn echo_values_beyond_effectcrafts_range_are_reported() {
+    // `echo-03-max`: 30 000 echoes and Decay 100; EffectCraft's Echo uses at most 255 and 1.
+    let (g, r) = run(&echo(vec![(2, 30000.0), (4, 100.0)]), "ec.time.echo");
+    let found = losses(&r, LossCategory::Effects, "ADBE Echo");
+    assert_eq!(found.len(), 2, "{found:?}");
+    assert!(found.iter().any(|d| d.contains("Number Of Echoes") && d.contains("0 to 255")), "{found:?}");
+    assert!(found.iter().any(|d| d.contains("Decay") && d.contains("0 to 1")), "{found:?}");
+    // Kept as stored.
+    let g = g.expect("still imported");
+    near(&g, "numberOfEchoes", 30000.0);
+    near(&g, "decay", 100.0);
+}
+
+/// A keyframed Echo parameter keeps its keys as stored and reports the range loss.
+#[test]
+fn echo_keys_beyond_effectcrafts_range_are_kept_and_reported() {
+    // Number Of Echoes keyed 10 -> 30 000: the second key is beyond EffectCraft's 255.
+    let mut fx = echo(vec![]);
+    fx.keys = vec![(2, vec![(0, 10.0), (1000, 30000.0)])];
+    let (g, r) = run(&fx, "ec.time.echo");
+    let found = losses(&r, LossCategory::Effects, "ADBE Echo");
+    assert_eq!(found.len(), 1, "{found:?}");
+    assert!(found[0].contains("Number Of Echoes") && found[0].contains("30000") && found[0].contains("0 to 255"), "{found:?}");
+    assert!(losses(&r, LossCategory::DamagedData, "ADBE Echo").is_empty());
+    // Both keys arrive with their values.
+    let g = g.expect("still imported");
+    let keys = &g.prop("numberOfEchoes").expect("numberOfEchoes").keys;
+    let values: Vec<Value> = keys.iter().map(|k| k.value.clone()).collect();
+    assert_eq!(values, [Value::Scalar(10.0), Value::Scalar(30000.0)]);
+}
+
+/// Linear Wipe's values, set and default.
+#[test]
+fn linear_wipe_values() {
+    let fx = |values| Fx {
+        match_name: "ADBE Linear Wipe",
+        name: "Linear Wipe",
+        defs: vec![
+            slider(K::FixedSlider, "Transition Completion", 0.0, (0.0, 100.0)),
+            other(K::Angle, "Wipe Angle", Default::Number(90.0)),
+            slider(K::FixedSlider, "Feather", 0.0, (0.0, 32000.0)),
+        ],
+        values,
+        data: vec![],
+        keys: vec![],
+    };
+    // `linwipe-01-set-all`.
+    let (g, r) = run(&fx(vec![(1, 10.0), (2, 77.0), (3, 16.0)]), "ec.transition.linearwipe");
+    assert_eq!(losses(&r, LossCategory::Effects, "ADBE Linear Wipe"), Vec::<String>::new());
+    let g = g.expect("imported");
+    near(&g, "completion", 10.0);
+    near(&g, "angle", 77.0);
+    near(&g, "feather", 16.0);
+    // `linwipe-00-defaults`: the Wipe Angle default 90.
+    near(&run(&fx(vec![]), "ec.transition.linearwipe").0.expect("imported"), "angle", 90.0);
+}
+
+/// Offset's Blend With Original as a percentage and its centre as a point.
+#[test]
+fn offset_blend_is_a_fraction_and_the_centre_a_point() {
+    let fx = |values| Fx {
+        match_name: "ADBE Offset",
+        name: "Offset",
+        defs: vec![other(K::Point, "Shift Center To", Default::Point(0.5, 0.5)), slider(K::FixedSlider, "Blend With Original", 0.0, (0.0, 1.0))],
+        values,
+        data: vec![],
+        keys: vec![],
+    };
+    // `offset-02-chk-toggled`: Blend With Original stored 1.0 is 100 %.
+    let (g, r) = run(&fx(vec![(2, 1.0)]), "ec.distort.offset");
+    assert_eq!(losses(&r, LossCategory::Effects, "ADBE Offset"), Vec::<String>::new());
+    let g = g.expect("imported");
+    near(&g, "blend", 100.0);
+    // The default centre is the layer's centre (synthetic.aep's layer is 8x8).
+    pt(&g, "shift", [4.0, 4.0]);
+    near(&run(&fx(vec![(2, 0.25)]), "ec.distort.offset").0.expect("imported"), "blend", 25.0);
+}
+
+/// Color Stabilizer's points, Sample Size and Stabilize, default and set.
+#[test]
+fn color_stabilizer_points_sample_size_and_stabilize() {
+    let fx = |values| Fx {
+        match_name: "ADBE Deflicker",
+        name: "Color Stabilizer",
+        defs: vec![
+            popup("Stabilize", 2, &["Brightness", "Levels", "Curves"]),
+            other(K::Point, "Black Point", Default::Point(0.2, 0.5)),
+            other(K::Point, "Mid Point", Default::Point(0.5, 0.5)),
+            other(K::Point, "White Point", Default::Point(0.8, 0.5)),
+            slider(K::FixedSlider, "Sample Size", 3.0, (0.0, 50.0)),
+        ],
+        values,
+        data: vec![],
+        keys: vec![],
+    };
+    // `colstab-00-defaults`: Levels, the points at 20 %, 50 % and 80 % of the width.
+    let (g, r) = run(&fx(vec![]), "ec.color.colorstabilizer");
+    assert_eq!(losses(&r, LossCategory::Effects, "ADBE Deflicker"), Vec::<String>::new());
+    let g = g.expect("imported");
+    assert_eq!(v(&g, "stabilize"), Value::Enum(1), "Levels");
+    pt(&g, "blackPoint", [1.6, 4.0]);
+    pt(&g, "whitePoint", [6.4, 4.0]);
+    near(&g, "sampleSize", 3.0);
+    // `colstab-03-pop1-3` and `colstab-27-pop5-25`.
+    let (g, _) = run(&fx(vec![(1, 3.0), (5, 25.0)]), "ec.color.colorstabilizer");
+    let g = g.expect("imported");
+    assert_eq!(v(&g, "stabilize"), Value::Enum(2), "Curves");
+    near(&g, "sampleSize", 25.0);
+}
diff --git a/crates/aep/tests/it/import/effects_round2.rs b/crates/aep/tests/it/import/effects_round2.rs
new file mode 100644
index 000000000..9f21a4f30
--- /dev/null
+++ b/crates/aep/tests/it/import/effects_round2.rs
@@ -0,0 +1,139 @@
+//! Effects of session S18 (711-723): Directional Blur, Radial Blur, CC Radial Blur, Venetian
+//! Blinds, Channel Blur, Black & White, Tritone, Luma Key, Simple Choker, Matte Choker and
+//! Transform import with the values they were made with.
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::PropGroup;
+
+/// The effects of layer `layer`, and the import report's loss count.
+fn effects(name: &str, layer: &str) -> Option<(Vec<PropGroup>, usize, String)> {
+    Some({
+        let (p, r) = crate::import::helpers::try_load(name)?;
+        let (_, c) = comp(&p, &r, "C");
+        let l = c.layers.iter().find(|l| l.name == layer).unwrap_or_else(|| panic!("{name}: no {layer}"));
+        let fx = l.props.sub("effects").expect("effects");
+        (fx.children.iter().filter_map(|n| n.as_group()).cloned().collect(), r.report.total_losses(), format!("{:?}", r.report.losses))
+    })
+}
+
+fn one(name: &str, layer: &str, id: &str) -> Option<PropGroup> {
+    Some({
+        let (g, losses, detail) = effects(name, layer)?;
+        assert_eq!(losses, 0, "{name}: {detail}");
+        assert_eq!(g.len(), 1, "{name}");
+        assert_eq!(g[0].match_id, id, "{name}");
+        g[0].clone()
+    })
+}
+
+fn v(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id} in {}", g.match_id)).value.clone()
+}
+
+fn s(x: f64) -> Value {
+    Value::Scalar(x)
+}
+
+fn near2(a: &Value, b: [f64; 2]) {
+    let Value::Vec2(a) = a else { panic!("{a:?}") };
+    assert!((a[0] - b[0]).abs() < 1e-3 && (a[1] - b[1]).abs() < 1e-3, "{a:?} != {b:?}");
+}
+
+fn near_color(a: &Value, b: [f64; 3]) {
+    let Value::Color(a) = a else { panic!("{a:?}") };
+    assert!(a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-3) && a[3] == 1.0, "{a:?} != {b:?}");
+}
+
+#[test]
+fn the_eleven_defaults_import_lossless() {
+    let (g, losses, detail) = skip!(effects("712-fx-eleven-effects-defaults-on-M.aep", "M"));
+    // CC Radial Blur's fresh Type is item 6, Scratch, which EffectCraft does not have. Set Matte
+    // (the eleventh) is imported since its layer parameter is (905).
+    assert_eq!(g.len(), 11, "{detail}");
+    assert_eq!(losses, 1, "{detail}");
+    assert!(detail.contains("Scratch"), "{detail}");
+    let ids: Vec<&str> = g.iter().map(|e| e.match_id.as_str()).collect();
+    assert_eq!(
+        ids,
+        [
+            "ec.blur.radial",
+            "ec.blur.ccradial",
+            "ec.transition.venetian",
+            "ec.blur.channel",
+            "ec.color.blackwhite",
+            "ec.color.tritone",
+            "ec.key.luma",
+            "ec.matte.simplechoker",
+            "ec.matte.mattechoker",
+            "ec.distort.transform",
+            "ec.channel.setmatte"
+        ]
+    );
+    // After Effects' defaults where they differ from EffectCraft's.
+    assert_eq!(v(&g[2], "direction"), s(0.0));
+    assert_eq!(v(&g[2], "width"), s(20.0));
+    assert_eq!(v(&g[3], "repeatEdge"), Value::Bool(true));
+    near_color(&v(&g[4], "tintColor"), [225.0 / 255.0, 211.0 / 255.0, 179.0 / 255.0]);
+    near_color(&v(&g[5], "midtones"), [127.0 / 255.0, 100.0 / 255.0, 70.0 / 255.0]);
+    assert_eq!(v(&g[8], "grayLevelSoftness1"), s(0.100006103515625 * 100.0));
+    near2(&v(&g[9], "anchor"), [480.0, 270.0]);
+}
+
+#[test]
+fn blurs_and_venetian_blinds() {
+    let g = skip!(one("711-fx-directional-blur-30-40-on-M.aep", "M", "ec.blur.directional"));
+    assert_eq!((v(&g, "direction"), v(&g, "length")), (s(30.0), s(40.0)));
+    let g = skip!(one("713-fx-radial-blur-zoom-20-on-M.aep", "M", "ec.blur.radial"));
+    assert_eq!((v(&g, "amount"), v(&g, "type"), v(&g, "antialiasing")), (s(20.0), Value::Enum(1), Value::Enum(1)));
+    near2(&v(&g, "center"), [600.0, 300.0]);
+    let g = skip!(one("714-fx-ccradial-type2-30-60-on-M.aep", "M", "ec.blur.ccradial"));
+    assert_eq!((v(&g, "type"), v(&g, "amount"), v(&g, "quality")), (Value::Enum(1), s(30.0), s(60.0)));
+    near2(&v(&g, "center"), [400.0, 200.0]);
+    let g = skip!(one("715-fx-venetian-40-30-50-5-on-M.aep", "M", "ec.transition.venetian"));
+    assert_eq!((v(&g, "completion"), v(&g, "direction"), v(&g, "width"), v(&g, "feather")), (s(40.0), s(30.0), s(50.0), s(5.0)));
+    let g = skip!(one("716-fx-channel-blur-5-10-15-20-edge-horiz-on-M.aep", "M", "ec.blur.channel"));
+    assert_eq!((v(&g, "redBlurriness"), v(&g, "greenBlurriness"), v(&g, "blueBlurriness"), v(&g, "alphaBlurriness")), (s(5.0), s(10.0), s(15.0), s(20.0)));
+    assert_eq!((v(&g, "repeatEdge"), v(&g, "dimensions")), (Value::Bool(true), Value::Enum(1)));
+}
+
+#[test]
+fn colour_effects() {
+    let g = skip!(one("717-fx-blackwhite-set-tint-on-L.aep", "L", "ec.color.blackwhite"));
+    assert_eq!(["reds", "yellows", "greens", "cyans", "blues", "magentas"].map(|id| v(&g, id)), [s(10.0), s(70.0), s(30.0), s(50.0), s(90.0), s(20.0)]);
+    assert_eq!(v(&g, "tint"), Value::Bool(true));
+    near_color(&v(&g, "tintColor"), [1.0, 0.5, 0.0]);
+    let g = skip!(one("718-fx-tritone-set-blend25-on-L.aep", "L", "ec.color.tritone"));
+    near_color(&v(&g, "highlights"), [1.0, 1.0, 0.8]);
+    near_color(&v(&g, "midtones"), [0.6, 0.2, 0.2]);
+    near_color(&v(&g, "shadows"), [0.0, 0.0, 0.3]);
+    assert_eq!(v(&g, "blend"), s(25.0));
+}
+
+#[test]
+fn keys_and_mattes() {
+    let g = skip!(one("719-fx-lumakey-darker-140-20-1-2.5-on-M.aep", "M", "ec.key.luma"));
+    assert_eq!(
+        (v(&g, "keyType"), v(&g, "threshold"), v(&g, "tolerance"), v(&g, "edgeThin"), v(&g, "edgeFeather")),
+        (Value::Enum(1), s(140.0), s(20.0), s(1.0), s(2.5))
+    );
+    let g = skip!(one("720-fx-simplechoker-3.5-on-M.aep", "M", "ec.matte.simplechoker"));
+    assert_eq!((v(&g, "view"), v(&g, "chokeMatte")), (Value::Enum(0), s(3.5)));
+    assert_eq!(v(&skip!(one("721-fx-simplechoker-3.5-view-matte-on-M.aep", "M", "ec.matte.simplechoker")), "view"), Value::Enum(1));
+    let g = skip!(one("722-fx-mattechoker-set-on-M.aep", "M", "ec.matte.mattechoker"));
+    assert_eq!(["geometricSoftness1", "choke1", "geometricSoftness2", "choke2", "iterations"].map(|id| v(&g, id)), [s(6.0), s(50.0), s(2.0), s(-10.0), s(3.0)]);
+    // The gray level softnesses kept their defaults (AE refused the scripted values): 10 % and 100 %.
+    assert_eq!((v(&g, "grayLevelSoftness1"), v(&g, "grayLevelSoftness2")), (s(0.100006103515625 * 100.0), s(100.0)));
+}
+
+#[test]
+fn transform() {
+    let g = skip!(one("723-fx-transform-set-on-M.aep", "M", "ec.distort.transform"));
+    near2(&v(&g, "anchor"), [400.0, 200.0]);
+    near2(&v(&g, "position"), [500.0, 300.0]);
+    assert_eq!(
+        ["scaleHeight", "scaleWidth", "skew", "skewAxis", "rotation", "opacity", "shutterAngle"].map(|id| v(&g, id)),
+        [s(80.0), s(120.0), s(10.0), s(20.0), s(30.0), s(70.0), s(90.0)]
+    );
+    assert_eq!((v(&g, "uniform"), v(&g, "useCompositionShutterAngle"), v(&g, "sampling")), (Value::Bool(false), Value::Bool(false), Value::Enum(1)));
+}
diff --git a/crates/aep/tests/it/import/effects_round3.rs b/crates/aep/tests/it/import/effects_round3.rs
new file mode 100644
index 000000000..e6a5c652d
--- /dev/null
+++ b/crates/aep/tests/it/import/effects_round3.rs
@@ -0,0 +1,323 @@
+//! Effects of session I3 (905: the 24 effects of 904, one per layer of one composition) import
+//! with the values they were made with, After Effects' defaults where nothing was set, and the
+//! layer parameters naming the layer they were set to. Layer Control: 220, 320, 321.
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Comp, PropGroup};
+
+const F905: &str = "905-fx-24-effects-set-one-comp.aep";
+
+fn fx_of(c: &Comp, layer: &str) -> PropGroup {
+    let l = c.layers.iter().find(|l| l.name == layer).unwrap_or_else(|| panic!("no {layer}"));
+    let fx = l.props.sub("effects").expect("effects");
+    let g: Vec<&PropGroup> = fx.children.iter().filter_map(|n| n.as_group()).collect();
+    assert_eq!(g.len(), 1, "{layer}");
+    g[0].clone()
+}
+
+fn v(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id} in {}", g.match_id)).value.clone()
+}
+
+fn num(g: &PropGroup, id: &str) -> f64 {
+    match v(g, id) {
+        Value::Scalar(x) => x,
+        other => panic!("{id}: {other:?}"),
+    }
+}
+
+fn near(g: &PropGroup, id: &str, want: f64) {
+    let got = num(g, id);
+    assert!((got - want).abs() < 1e-4, "{} {id}: {got} != {want}", g.match_id);
+}
+
+fn pt(g: &PropGroup, id: &str, want: [f64; 2]) {
+    let Value::Vec2(a) = v(g, id) else { panic!("{id}") };
+    assert!((a[0] - want[0]).abs() < 1e-3 && (a[1] - want[1]).abs() < 1e-3, "{} {id}: {a:?} != {want:?}", g.match_id);
+}
+
+fn col(g: &PropGroup, id: &str, want: [f64; 3]) {
+    let Value::Color(a) = v(g, id) else { panic!("{id}") };
+    assert!(a.iter().zip(want).all(|(x, y)| (x - y).abs() < 1e-3) && a[3] == 1.0, "{} {id}: {a:?} != {want:?}", g.match_id);
+}
+
+#[test]
+fn the_24_effects_import_with_their_values() {
+    let (p, r) = load!(F905);
+    // The one loss: CC Bend It's default Render Prestart "Bend" has no EffectCraft item.
+    assert_eq!(r.report.total_losses(), 1, "{:?}", r.report.losses);
+    assert!(format!("{:?}", r.report.losses).contains("'Bend' has no counterpart"));
+    let (_, c) = comp(&p, &r, "C");
+    let e = |n: &str| fx_of(c, n);
+
+    let g = e("E01");
+    assert_eq!(g.match_id, "ec.color.brightnesscontrast");
+    near(&g, "brightness", 20.0);
+    near(&g, "contrast", 30.0);
+    assert_eq!(v(&g, "useLegacy"), Value::Bool(false));
+
+    let g = e("E02");
+    near(&g, "amount", 80.0);
+    near(&g, "size", 150.0);
+    near(&g, "complexity", 2.0);
+    near(&g, "evolution", 45.0);
+    near(&g, "evolutionOptions/randomSeed", 3.0);
+    // After Effects' defaults: Turbulent, Pin All.
+    assert_eq!((v(&g, "displacement"), v(&g, "pinning")), (Value::Enum(0), Value::Enum(1)));
+
+    let g = e("E03");
+    near(&g, "contrast", 150.0);
+    near(&g, "brightness", -10.0);
+    near(&g, "complexity", 4.0);
+    near(&g, "evolution", 90.0);
+    near(&g, "evolutionOptions/seed", 5.0);
+    near(&g, "opacity", 80.0);
+    // Defaults: Basic, Soft Linear, Allow HDR Results, Normal, Sub Influence 70.
+    assert_eq!(
+        (v(&g, "fractalType"), v(&g, "noiseType"), v(&g, "overflow"), v(&g, "blendingMode")),
+        (Value::Enum(0), Value::Enum(2), Value::Enum(3), Value::Enum(1))
+    );
+    near(&g, "subSettings/subInfluence", 70.0);
+
+    // Beam: Length / Time / Softness are fractions in the file, percentages here; After Effects'
+    // defaults where nothing was set (3D Perspective on, Composite On Original off).
+    let g = e("E04");
+    pt(&g, "startPoint", [200.0, 300.0]);
+    pt(&g, "endPoint", [1700.0, 800.0]);
+    near(&g, "length", 60.0);
+    near(&g, "time", 40.0);
+    near(&g, "startThickness", 20.0);
+    near(&g, "endThickness", 40.0);
+    near(&g, "softness", 30.0);
+    col(&g, "insideColor", [1.0, 1.0, 0.0]);
+    col(&g, "outsideColor", [0.0, 0.0, 1.0]);
+    assert_eq!((v(&g, "perspective3d"), v(&g, "compositeOnOriginal")), (Value::Bool(true), Value::Bool(false)));
+
+    let g = e("E05");
+    pt(&g, "center", [700.0, 400.0]);
+    near(&g, "amount", 70.0);
+    assert_eq!(v(&g, "zoom"), Value::Enum(1));
+
+    near(&e("E06"), "amount", 30.0);
+
+    let g = e("E07");
+    for (id, want) in [
+        ("rgb/rgbInBlack", 0.1),
+        ("rgb/rgbInWhite", 0.9),
+        ("rgb/rgbGamma", 1.5),
+        ("rgb/rgbOutBlack", 0.05),
+        ("rgb/rgbOutWhite", 0.95),
+        ("red/redGamma", 0.8),
+        ("green/greenInWhite", 0.8),
+        ("blue/blueOutBlack", 0.2),
+        ("alpha/alphaOutWhite", 1.0),
+    ] {
+        near(&g, id, want);
+    }
+    // After Effects' Off for 32 bpc Color.
+    assert_eq!(v(&g, "clipToOutputBlack"), Value::Enum(2));
+
+    let g = e("E08");
+    pt(&g, "ul", [100.0, 50.0]);
+    pt(&g, "lr", [1850.0, 1050.0]);
+
+    let g = e("E09");
+    pt(&g, "anchor", [100.0, 100.0]);
+    near(&g, "width", 100.0);
+    near(&g, "height", 80.0);
+    near(&g, "border", 4.0);
+    col(&g, "color", [0.0, 1.0, 0.0]);
+    near(&g, "opacity", 70.0);
+    // After Effects' Size From default is Corner Point.
+    assert_eq!(v(&g, "sizeFrom"), Value::Enum(0));
+
+    near(&e("E10"), "amount", 50.0);
+
+    let g = e("E11");
+    col(&g, "keyColor", [0.0, 0.0, 1.0]);
+    near(&g, "tolerance", 20.0);
+    near(&g, "softness", 15.0);
+
+    let g = e("E12");
+    near(&g, "completion", 40.0);
+    near(&g, "startAngle", 30.0);
+    pt(&g, "center", [800.0, 500.0]);
+    assert_eq!(v(&g, "wipe"), Value::Enum(1));
+    near(&g, "feather", 20.0);
+
+    col(&e("E13"), "backgroundColor", [1.0, 1.0, 1.0]);
+
+    let g = e("E14");
+    near(&g, "bend", 30.0);
+    pt(&g, "start", [960.0, 200.0]);
+
+    let g = e("E15");
+    pt(&g, "topRight", [1700.0, 50.0]);
+    pt(&g, "bottomRight", [1800.0, 950.0]);
+    near(&g, "perspective", 100.0);
+
+    let g = e("E16");
+    pt(&g, "positionsColors/point2", [1600.0, 250.0]);
+    col(&g, "positionsColors/color1", [1.0, 0.0, 0.0]);
+    col(&g, "positionsColors/color4", [1.0, 1.0, 0.0]);
+    near(&g, "blend", 50.0);
+    near(&g, "opacity", 80.0);
+
+    let g = e("E17");
+    near(&g, "hueTransform", 90.0);
+    col(&g, "colorToChange", [0.0, 0.0, 1.0]);
+    near(&g, "matchingTolerance", 30.0);
+    // After Effects' Match Colors default is Using RGB (EffectCraft's own: Using Hue).
+    assert_eq!(v(&g, "matchColors"), Value::Enum(0));
+
+    let g = e("E18");
+    near(&g, "blackPoint", 30.0);
+    near(&g, "whitePoint", 220.0);
+    near(&g, "blackSoftness", 10.0);
+
+    let g = e("E19");
+    near(&g, "hue", 20.0);
+    near(&g, "lightness", 10.0);
+    near(&g, "saturation", 30.0);
+
+    near(&e("E20"), "amount", 20.0);
+
+    let g = e("E21");
+    pt(&g, "center", [800.0, 500.0]);
+    near(&g, "direction", 20.0);
+    near(&g, "width", 80.0);
+    near(&g, "sweepIntensity", 60.0);
+    near(&g, "edgeIntensity", 100.0);
+    near(&g, "edgeThickness", 4.0);
+    col(&g, "lightColor", [1.0, 0.5, 0.0]);
+    // After Effects' Shape default is Sharp.
+    assert_eq!(v(&g, "shape"), Value::Enum(2));
+}
+
+/// The layer parameters of 905 name `R` (below them), with its source only (After Effects hands
+/// the named layer's source to the effect, 904 E24).
+#[test]
+fn layer_parameters_name_the_layer_they_were_set_to() {
+    let (p, r) = load!(F905);
+    let (_, c) = comp(&p, &r, "C");
+    let rid = c.layers.iter().find(|l| l.name == "R").unwrap().id.0;
+    for (layer, id) in [("E22", "blurLayer"), ("E23", "displacementMapLayer"), ("E24", "takeMatteFromLayer")] {
+        let g = fx_of(c, layer);
+        assert_eq!(v(&g, id), Value::Layer(Some(rid)), "{layer}");
+        assert_eq!(v(&g, &format!("{id}Source")), Value::Enum(0), "{layer}");
+    }
+    let g = fx_of(c, "E24");
+    // Luminance, by name: "Luminance" here, after "Red Channel" ... "Alpha Channel" -> "Red" ...
+    assert_eq!(v(&g, "takeMatteFrom"), Value::Enum(4));
+    near(&fx_of(c, "E22"), "maximumBlur", 10.0);
+    near(&fx_of(c, "E23"), "maxHorizontal", 20.0);
+    near(&fx_of(c, "E23"), "maxVertical", 10.0);
+}
+
+/// Layer Control: another layer (220: the Null above), the owning layer (320, also the default),
+/// None (321).
+#[test]
+fn layer_control_names_another_layer_itself_or_none() {
+    let (p, r) = load!("220-fx-layercontrol-to-layer1.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    let null = c.layers.iter().find(|l| l.name != "L").unwrap().id.0;
+    assert_eq!(v(&fx_of(c, "L"), "layer"), Value::Layer(Some(null)));
+
+    let (p, r) = load!("320-fx-layercontrol-self-explicit.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    let own = c.layers.iter().find(|l| l.name == "L").unwrap().id.0;
+    assert_eq!(v(&fx_of(c, "L"), "layer"), Value::Layer(Some(own)));
+
+    let (p, r) = load!("321-fx-layercontrol-none.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(v(&fx_of(c, "L"), "layer"), Value::Layer(None));
+}
+
+/// Hostile layer ids in valid structure: a layer that does not exist is reported and left unset,
+/// the owning layer's own id is "this layer", 0 is the explicit None (`NO_LAYER`); nothing panics.
+#[test]
+fn hostile_layer_parameter_ids_are_reported_or_neutral() {
+    use effectcraft_aep::import::{ImportOptions, LossCategory, import};
+    let bytes = fixture!(F905);
+    // The value records (the layer's and the project list's copy): the match name followed by its
+    // `LIST tdbs`, not the definition in `parT`.
+    let records: Vec<usize> = (0..bytes.len().saturating_sub(64))
+        .filter(|&i| bytes[i..].starts_with(b"ADBE Set Matte3-0001\0") && bytes[i..i + 64].windows(4).any(|w| w == b"tdbs"))
+        .map(|at| at + bytes[at..].windows(4).position(|w| w == b"tdpi").expect("tdpi") + 8)
+        .collect();
+    assert!(!records.is_empty());
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let none_value = Value::Layer(Some(effectcraft_project::NO_LAYER));
+    for (id, expected) in [(u32::MAX, Value::Layer(None)), (0, none_value), (12345, Value::Layer(None))] {
+        let mut b = bytes.clone();
+        for &tdpi in &records {
+            b[tdpi..tdpi + 4].copy_from_slice(&id.to_be_bytes());
+        }
+        let mut p = effectcraft_project::Project::default();
+        let r = import(&mut p, &b, &opts).expect("imports");
+        let (_, c) = comp(&p, &r, "C");
+        let g = fx_of(c, "E24");
+        assert_eq!(v(&g, "takeMatteFromLayer"), expected, "{id}");
+        let named_missing = id != 0;
+        assert_eq!(r.report.count(LossCategory::Effects), 1 + usize::from(named_missing), "{id}: {:?}", r.report.losses);
+    }
+}
+
+/// Older files store Glow's A & B Midpoint maximum as 0.98999 (16.16 64 880) where After Effects
+/// 2026 writes 0.990005 (64 881): the same scale, imported.
+#[test]
+fn a_valid_maximum_off_by_one_16_16_step_is_the_same_scale() {
+    use effectcraft_aep::import::{ImportOptions, LossCategory, import};
+    let mut b = fixture!("438-fx-glow-midpoint-0.25.aep");
+    let mut n = 0;
+    let mut i = 0;
+    while let Some(off) = b[i..].windows(14).position(|w| w == b"A & B Midpoint") {
+        let at = i + off;
+        // In `pard` the name is at byte 16 and the valid maximum at 128.
+        let max = at - 16 + 128;
+        if b[max..max + 4] == 64_881u32.to_be_bytes() {
+            b[max..max + 4].copy_from_slice(&64_880u32.to_be_bytes());
+            n += 1;
+        }
+        i = at + 14;
+    }
+    assert!(n >= 1);
+    let none = |_: &str| false;
+    let mut p = effectcraft_project::Project::default();
+    let r = import(&mut p, &b, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("imports");
+    assert_eq!(r.report.count(LossCategory::Effects), 0, "{:?}", r.report.losses);
+}
+
+#[test]
+fn curves_and_mesh_warp_import() {
+    use effectcraft_aep::import::{ImportOptions, import};
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: false, ..ImportOptions::new(&none) };
+    let fx = |name: &str| -> Option<effectcraft_project::PropGroup> {
+        let mut p = effectcraft_project::Project::default();
+        let r = import(&mut p, &crate::common::try_fixture(name)?, &opts).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let (_, c) = comp(&p, &r, "C");
+        Some(c.layers.iter().filter_map(|l| l.props.sub("effects")).flat_map(|e| e.children.iter()).find_map(|n| n.as_group().cloned()).expect("effect"))
+    };
+    let g = skip!(fx("963-curves-red-mid-down-on-S.aep"));
+    assert_eq!(v(&g, "red"), Value::Str("0,0 0.501961,0.172549 1,1".into()));
+    assert_eq!(v(&g, "rgb"), Value::Str("0,0 1,1".into()));
+    let g = skip!(fx("964-curves-rgb-s-curve-on-S.aep"));
+    assert_eq!(v(&g, "rgb"), Value::Str("0,0 0.243137,0.094118 0.760784,0.901961 1,1".into()));
+    let g = skip!(fx("985-meshwarp-3x3-vertex-moved-on-S.aep"));
+    assert_eq!((v(&g, "rows"), v(&g, "columns"), v(&g, "quality")), (Value::Scalar(3.0), Value::Scalar(3.0), Value::Scalar(8.0)));
+    let Value::Str(mesh) = v(&g, "mesh") else { panic!("mesh") };
+    let offs: Vec<&str> = mesh.split(' ').collect();
+    assert_eq!(offs.len(), 16);
+    for (k, o) in offs.iter().enumerate() {
+        let (x, y) = o.split_once(',').expect("pair");
+        let (x, y): (f64, f64) = (x.parse().expect("x"), y.parse().expect("y"));
+        let want = if k == 10 { (132.0, -2.0) } else { (0.0, 0.0) };
+        assert!((x - want.0).abs() < 0.01 && (y - want.1).abs() < 0.01, "{k}: {o}");
+    }
+}
diff --git a/crates/aep/tests/it/import/effects_thirdparty.rs b/crates/aep/tests/it/import/effects_thirdparty.rs
new file mode 100644
index 000000000..567d77642
--- /dev/null
+++ b/crates/aep/tests/it/import/effects_thirdparty.rs
@@ -0,0 +1,296 @@
+//! CC Color Neutralizer, EXtractoR and IDentifier (#3112) arrive as EffectCraft's effects of the
+//! same name. Each is built into `synthetic.aep` (`fx_inject`) with the definitions After Effects
+//! 2026 wrote for it in the importer block of 2026-11-05 (`1300-thirdparty.aep`) and the values
+//! of that block's compositions; the Channel Info data is laid out as those instances store it.
+
+use crate::import::fx_inject::{Default, Fx, losses, near, other, popup, run, slider, v};
+use effectcraft_aep::import::LossCategory;
+use effectcraft_aep::{ExtractorChannels, ParamKind as K, identifier_channel_type};
+use effectcraft_keyframe::Value;
+
+fn neutralizer(values: Vec<(usize, f64)>) -> Fx {
+    let range = |name| slider(K::FloatSlider, name, 0.0, (-100.0, 100.0));
+    let group = |name| other(K::GroupStart, name, Default::None);
+    let end = || other(K::GroupEnd, "", Default::None);
+    Fx {
+        match_name: "CS Color Neutralizer",
+        name: "CC Color Neutralizer",
+        defs: vec![
+            other(K::Color, "Shadows Unbalance", Default::Color([0, 0, 0, 0])),
+            group("Shadows"),
+            range("Red - Shadows"),
+            range("Green - Shadows"),
+            range("Blue - Shadows"),
+            end(),
+            other(K::Color, "Midtones Unbalance", Default::Color([255, 127, 127, 127])),
+            group("Midtones"),
+            range("Red - Midtones"),
+            range("Green - Midtones"),
+            range("Blue - Midtones"),
+            end(),
+            other(K::Color, "Highlights Unbalance", Default::Color([255, 255, 255, 255])),
+            group("Highlights"),
+            range("Red - Highlights"),
+            range("Green - Highlights"),
+            range("Blue - Highlights"),
+            end(),
+            slider(K::FloatSlider, "Pinning", 0.0, (0.0, 100.0)),
+            slider(K::FloatSlider, "Blend w. Original", 0.0, (0.0, 100.0)),
+            group("Special"),
+            popup("View", 1, &["Final Result", "Correction B to W", "Correction Stair"]),
+            slider(K::FloatSlider, "Black Point", 0.0, (0.0, 49.9)),
+            slider(K::FloatSlider, "White Point", 100.0, (50.1, 100.0)),
+            end(),
+        ],
+        values,
+        data: vec![],
+        keys: vec![],
+    }
+}
+
+#[test]
+fn cc_color_neutralizer_pinning_and_blend() {
+    // `ccneutral-00-defaults` and the Pinning / Blend of `ccneutral-01-set-all`.
+    let (g, r) = run(&neutralizer(vec![(19, 16.0), (20, 19.0)]), "ec.color.cccolorneutralizer");
+    assert_eq!(losses(&r, LossCategory::Effects, "CS Color Neutralizer"), Vec::<String>::new());
+    let g = g.expect("imported");
+    near(&g, "pinning", 16.0);
+    near(&g, "blendWOriginal", 19.0);
+    // EffectCraft's own (identity) balance stays.
+    assert_eq!(v(&g, "midtonesUnbalance"), v(&g, "midtonesBalance"));
+}
+
+#[test]
+fn cc_color_neutralizer_corrections_without_a_counterpart_are_reported() {
+    // `ccneutral-03-sec-shadows`, `ccneutral-09-pop22-2`, `ccneutral-06-sec-special`.
+    let (g, r) = run(&neutralizer(vec![(3, 13.0), (4, 16.0), (5, 19.0), (22, 2.0), (23, 10.0), (24, 87.0)]), "ec.color.cccolorneutralizer");
+    let found = losses(&r, LossCategory::Effects, "CS Color Neutralizer");
+    for name in ["Red - Shadows", "Green - Shadows", "Blue - Shadows", "View", "Black Point", "White Point"] {
+        assert!(found.iter().any(|d| d.contains(&format!("parameter {name} (")) && d.contains("not imported")), "{name}: {found:?}");
+    }
+    assert_eq!(found.len(), 6, "{found:?}");
+    assert!(g.is_some(), "the effect itself is imported");
+}
+
+/// EXtractoR's Channel Info data with these record kinds and names.
+fn channels(recs: [(u32, &str); 4]) -> Vec<u8> {
+    let mut d = vec![0u8; ExtractorChannels::LEN];
+    d[..4].copy_from_slice(&1u32.to_le_bytes());
+    for (k, (kind, name)) in recs.iter().enumerate() {
+        let at = 32 + k * 164;
+        d[at..at + 4].copy_from_slice(&kind.to_le_bytes());
+        d[at + 35..at + 35 + name.len()].copy_from_slice(name.as_bytes());
+    }
+    d
+}
+
+const DEFAULT_CHANNELS: [(u32, &str); 4] = [(1, "R"), (1, "G"), (1, "B"), (2, "(copy)")];
+
+fn extractor(values: Vec<(usize, f64)>, data: Vec<u8>) -> Fx {
+    let mut values = values;
+    values.insert(0, (1, 0.0));
+    Fx {
+        match_name: "EXtractoR",
+        name: "EXtractoR",
+        defs: vec![
+            other(K::ArbitraryData, "Channel Info", Default::None),
+            other(K::GroupStart, "Process", Default::None),
+            slider(K::FloatSlider, "Black Point", 0.0, (-f64::from(f32::MAX), f64::from(f32::MAX))),
+            slider(K::FloatSlider, "White Point", 1.0, (-f64::from(f32::MAX), f64::from(f32::MAX))),
+            other(K::Checkbox, "", Default::Number(0.0)),
+            other(K::GroupEnd, "", Default::None),
+        ],
+        values,
+        data: vec![(1, data)],
+        keys: vec![],
+    }
+}
+
+#[test]
+fn extractor_channel_info_layout() {
+    let c = ExtractorChannels::parse(&channels(DEFAULT_CHANNELS)).expect("the default layout");
+    assert!(c.is_default());
+    let c = ExtractorChannels::parse(&channels([(1, "Z"), (1, "G"), (1, "B"), (2, "(copy)")])).expect("parses");
+    assert!(!c.is_default());
+    assert_eq!(c.channels[0], (1, "Z".to_string()));
+    assert_eq!(ExtractorChannels::parse(&[0u8; 10]), None);
+    // The kind is byte 0 of a record: the definition default of `extractor-00-defaults` has
+    // `02 00 00 32` on Alpha, still the input's own channel.
+    let c = ExtractorChannels::parse(&channels([(1, "R"), (1, "G"), (1, "B"), (0x3200_0002, "(copy)")])).expect("parses");
+    assert!(c.is_default());
+    assert_eq!(c.sources(), Ok(["R", "G", "B", "(copy)"].map(String::from)));
+}
+
+#[test]
+fn extractor_points_unmult_and_default_channels() {
+    // `extractor-01-set-all`: Black Point 10, White Point 14, UnMult on.
+    let (g, r) = run(&extractor(vec![(3, 10.0), (4, 14.0), (5, 1.0)], channels(DEFAULT_CHANNELS)), "ec.3d.extractor");
+    assert_eq!(losses(&r, LossCategory::Effects, "EXtractoR"), Vec::<String>::new());
+    let g = g.expect("imported");
+    near(&g, "blackPoint", 10.0);
+    near(&g, "whitePoint", 14.0);
+    assert_eq!((v(&g, "unMult"), v(&g, "clip")), (Value::Bool(true), Value::Bool(false)));
+    // After Effects' `(copy)` Alpha is the input's alpha: EffectCraft's `(copy)`, not `A` (an
+    // OpenEXR's own alpha plane).
+    for (id, want) in [("red", "R"), ("green", "G"), ("blue", "B"), ("alpha", "(copy)")] {
+        assert_eq!(v(&g, id), Value::Str(want.into()), "{id}");
+    }
+}
+
+/// `extractor-07-preset-channel-z` (a preset of our own): `Z` into Red, Green and Blue, Alpha
+/// `(copy)`. EffectCraft's EXtractoR reads the footage's channel by the same name.
+#[test]
+fn extractor_channels_are_imported_by_name() {
+    let (g, r) = run(&extractor(vec![], channels([(1, "Z"), (1, "Z"), (1, "Z"), (2, "(copy)")])), "ec.3d.extractor");
+    assert_eq!(losses(&r, LossCategory::Effects, "EXtractoR"), Vec::<String>::new());
+    let g = g.expect("imported");
+    for (id, want) in [("red", "Z"), ("green", "Z"), ("blue", "Z"), ("alpha", "(copy)")] {
+        assert_eq!(v(&g, id), Value::Str(want.into()), "{id}");
+    }
+    // `(copy)` on another channel is that channel of the input (EffectCraft's `(copy)` there).
+    let (g, _) = run(&extractor(vec![], channels([(2, "(copy)"), (1, "CryptoObject00.R"), (2, "(copy)"), (1, "Z")])), "ec.3d.extractor");
+    let g = g.expect("imported");
+    for (id, want) in [("red", "(copy)"), ("green", "CryptoObject00.R"), ("blue", "(copy)"), ("alpha", "Z")] {
+        assert_eq!(v(&g, id), Value::Str(want.into()), "{id}");
+    }
+}
+
+#[test]
+fn extractor_channels_of_an_unknown_kind_are_reported() {
+    for recs in [[(1, "Z"), (3, "Z"), (1, "Z"), (2, "(copy)")], [(1, "Z"), (1, ""), (1, "Z"), (2, "(copy)")]] {
+        let (g, r) = run(&extractor(vec![], channels(recs)), "ec.3d.extractor");
+        let found = losses(&r, LossCategory::Effects, "EXtractoR");
+        assert!(found.len() == 1 && found[0].contains("are not imported (record 2 is of an unknown kind or names no channel)"), "{recs:?}: {found:?}");
+        assert_eq!(v(&g.expect("imported"), "red"), Value::Str("R".into()), "{recs:?}");
+    }
+}
+
+/// IDentifier's Channel Info: the channel type's name at 19 among bytes that are not read.
+fn id_info(name: &str) -> Vec<u8> {
+    let mut d: Vec<u8> = (0..148u32).map(|i| (i * 37 % 251) as u8 | 1).collect();
+    d[19..19 + name.len()].copy_from_slice(name.as_bytes());
+    d[19 + name.len()] = 0;
+    d
+}
+
+fn identifier(values: Vec<(usize, f64)>, data: Vec<u8>) -> Fx {
+    let mut values = values;
+    values.insert(0, (1, 0.0));
+    Fx {
+        match_name: "IDentifier",
+        name: "IDentifier",
+        defs: vec![
+            other(K::ArbitraryData, "Channel Info", Default::None),
+            popup("Display", 1, &["Colors", "Luma Matte", "Alpha Matte", "Raw"]),
+            slider(K::IntSlider, "ID", 0.0, (0.0, 2_147_483_647.0)),
+        ],
+        values,
+        data: vec![(1, data)],
+        keys: vec![],
+    }
+}
+
+#[test]
+fn identifier_display_id_and_channel_type() {
+    assert_eq!(identifier_channel_type(&id_info("Object ID")), Some("Object ID"));
+    // `identifier-01-set-all` (ID 10) and `identifier-05-pop2-3` (Alpha Matte): no channel chosen
+    // (After Effects found none or none was picked), so After Effects leaves the layer unchanged.
+    let (g, r) = run(&identifier(vec![(2, 3.0), (3, 10.0)], id_info("Object ID")), "ec.3d.identifier");
+    let found = losses(&r, LossCategory::Effects, "IDentifier");
+    assert!(found.len() == 1 && found[0].contains("no ID channel is chosen"), "{found:?}");
+    let g = g.expect("imported");
+    assert_eq!((v(&g, "display"), v(&g, "channelType")), (Value::Enum(2), Value::Enum(0)));
+    near(&g, "id", 10.0);
+}
+
+/// `identifier-09-preset-channel-objectid-id2` (1310, a preset of our own): the UINT channel
+/// `objectId` chosen and ID 2. EffectCraft's IDentifier reads that channel itself (`ObjectID`
+/// without regard to case), so nothing is lost; another name is reported.
+#[test]
+fn identifier_chosen_channels_by_name() {
+    for (name, kind) in [("objectId", 0), ("ObjectID", 0), ("materialid", 1)] {
+        let (g, r) = run(&identifier(vec![(3, 2.0)], id_info(name)), "ec.3d.identifier");
+        assert_eq!(losses(&r, LossCategory::Effects, "IDentifier"), Vec::<String>::new(), "{name}");
+        let g = g.expect("imported");
+        assert_eq!(v(&g, "channelType"), Value::Enum(kind), "{name}");
+        near(&g, "id", 2.0);
+    }
+    for name in ["IndexOB.X", "ID", "Material ID"] {
+        let (_, r) = run(&identifier(vec![], id_info(name)), "ec.3d.identifier");
+        let found = losses(&r, LossCategory::Effects, "IDentifier");
+        assert!(found.len() == 1 && found[0].contains(&format!("the ID channel '{name}' (Channel Info) is not imported")), "{name}: {found:?}");
+    }
+}
+
+/// EXtractoR's data with the name of record `k` from byte 35 replaced by `name` (no NUL added; the
+/// rest of the record's name field is left as `fill`).
+fn channels_with_raw_name(k: usize, name: &[u8], fill: u8) -> Vec<u8> {
+    let mut d = channels(DEFAULT_CHANNELS);
+    let at = 32 + k * 164 + 35;
+    d[at..at + 129].fill(fill);
+    d[at..at + name.len()].copy_from_slice(name);
+    d
+}
+
+/// A channel name that never ends (no NUL up to the end of its record) or is not UTF-8 is
+/// refused by the decoder and reported at the importer; the defaults R, G, B, A stay.
+#[test]
+fn extractor_names_without_a_terminator_or_in_invalid_utf8_are_refused() {
+    let unterminated = channels_with_raw_name(2, b"Z", b'Z');
+    let invalid = channels_with_raw_name(1, &[0x5a, 0xff, 0xfe, 0x00], 0);
+    for (what, data) in [("unterminated", unterminated), ("invalid UTF-8", invalid)] {
+        assert_eq!(ExtractorChannels::parse(&data), None, "{what}");
+        let (g, r) = run(&extractor(vec![], data), "ec.3d.extractor");
+        let found = losses(&r, LossCategory::Effects, "EXtractoR");
+        assert!(found.len() == 1 && found[0].contains("not in the sampled layout"), "{what}: {found:?}");
+        let g = g.expect("imported");
+        for (id, want) in [("red", "R"), ("green", "G"), ("blue", "B"), ("alpha", "A")] {
+            assert_eq!(v(&g, id), Value::Str(want.into()), "{what}: {id}");
+        }
+    }
+}
+
+/// The same for IDentifier: a channel name without NUL up to the end of the data, or in invalid
+/// UTF-8, is refused and reported; the Object ID channel stays.
+#[test]
+fn identifier_names_without_a_terminator_or_in_invalid_utf8_are_refused() {
+    let mut unterminated = id_info("objectId");
+    unterminated[19..].fill(b'x');
+    let mut invalid = id_info("objectId");
+    invalid[19..22].copy_from_slice(&[b'o', 0xff, 0]);
+    for (what, data) in [("unterminated", unterminated), ("invalid UTF-8", invalid)] {
+        assert_eq!(identifier_channel_type(&data), None, "{what}");
+        let (g, r) = run(&identifier(vec![], data), "ec.3d.identifier");
+        let found = losses(&r, LossCategory::Effects, "IDentifier");
+        assert!(found.len() == 1 && found[0].contains("not in the sampled layout"), "{what}: {found:?}");
+        assert_eq!(v(&g.expect("imported"), "channelType"), Value::Enum(0), "{what}");
+    }
+    // Data too short to reach the name.
+    assert_eq!(identifier_channel_type(&[1; 10]), None);
+}
+
+/// A Channel Info value record without its arbitrary data (no `aRbs`): the effect still imports,
+/// with the defaults, nothing panics, and the missing data is reported as damaged (it may have
+/// chosen other channels, so the defaults are not what After Effects renders).
+#[test]
+fn a_missing_channel_info_payload_is_reported_and_leaves_the_defaults() {
+    let mut fx = extractor(vec![], vec![]);
+    fx.data.clear();
+    let (g, r) = run(&fx, "ec.3d.extractor");
+    assert_eq!(losses(&r, LossCategory::Effects, "EXtractoR"), Vec::<String>::new());
+    let found = losses(&r, LossCategory::DamagedData, "EXtractoR");
+    assert!(found.len() == 1 && found[0].contains("Channel Info data is missing"), "{found:?}");
+    let g = g.expect("imported");
+    for (id, want) in [("red", "R"), ("green", "G"), ("blue", "B"), ("alpha", "A")] {
+        assert_eq!(v(&g, id), Value::Str(want.into()), "{id}");
+    }
+    let mut fx = identifier(vec![(3, 5.0)], vec![]);
+    fx.data.clear();
+    let (g, r) = run(&fx, "ec.3d.identifier");
+    assert_eq!(losses(&r, LossCategory::Effects, "IDentifier"), Vec::<String>::new());
+    let found = losses(&r, LossCategory::DamagedData, "IDentifier");
+    assert!(found.len() == 1 && found[0].contains("Channel Info data is missing"), "{found:?}");
+    let g = g.expect("imported");
+    assert_eq!(v(&g, "channelType"), Value::Enum(0));
+    near(&g, "id", 5.0);
+}
diff --git a/crates/aep/tests/it/import/fx_inject.rs b/crates/aep/tests/it/import/fx_inject.rs
new file mode 100644
index 000000000..ae61794d3
--- /dev/null
+++ b/crates/aep/tests/it/import/fx_inject.rs
@@ -0,0 +1,378 @@
+//! Builds an effect instance into the committed `synthetic.aep` in place of its Glow (the instance
+//! on the layer and the project's shared definitions), so an effect mapping can be tested without
+//! the external corpus. The parameter definitions are written in the `pard` layout of
+//! docs/aep-format.md 3.7 (type at byte 15, name at 16, default at 56, a float slider's valid
+//! range as `f32` at 104 / 108 and its slider range at 112 / 116, a fixed or integer slider's valid
+//! maximum at 128, a popup's item count at 60); `pard_layout_decodes_as_written` reads them back.
+//! The ranges and defaults the tests use are the ones After Effects 2026 wrote in the importer
+//! block of 2026-11-05 (`1100-quickwins.aep`, `1300-thirdparty.aep`, own projects).
+
+use effectcraft_aep::import::{ImportOptions, ImportResult, LossCategory, import};
+use effectcraft_aep::{Body, Chunk, ParamKind, ParamValue, Project as AepProject, parse, write};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Project, PropGroup};
+
+const SYNTHETIC: &[u8] = include_bytes!("../../fixtures/synthetic.aep");
+
+/// A parameter definition.
+#[derive(Clone)]
+pub struct Def {
+    pub kind: ParamKind,
+    pub name: &'static str,
+    pub default: Default,
+    /// A float slider's valid range, a fixed or integer slider's valid maximum (`.1`).
+    pub valid: (f64, f64),
+    /// A popup's items.
+    pub items: &'static [&'static str],
+}
+
+/// The default a definition holds at byte 56.
+#[derive(Clone, Copy)]
+pub enum Default {
+    None,
+    Number(f64),
+    Index(u32),
+    Point(f64, f64),
+    /// ARGB 0..255.
+    Color([u8; 4]),
+}
+
+/// The parameter type code `pard` byte 15 holds for `k`.
+fn kind_code(k: ParamKind) -> u8 {
+    match k {
+        ParamKind::Layer => 0,
+        ParamKind::IntSlider => 1,
+        ParamKind::FixedSlider => 2,
+        ParamKind::Angle => 3,
+        ParamKind::Checkbox => 4,
+        ParamKind::Color => 5,
+        ParamKind::Point => 6,
+        ParamKind::Popup => 7,
+        ParamKind::NoData => 9,
+        ParamKind::FloatSlider => 10,
+        ParamKind::ArbitraryData => 11,
+        ParamKind::GroupStart => 13,
+        ParamKind::GroupEnd => 14,
+        ParamKind::Button => 15,
+        _ => 9,
+    }
+}
+
+/// `v` as a big-endian 16.16 fixed-point value.
+fn fixed(v: f64) -> [u8; 4] {
+    ((v * 65536.0).round() as i32).to_be_bytes()
+}
+
+/// The 148-byte parameter definition (`pard`) of `d`: type, name, default and range.
+pub fn pard(d: &Def) -> Chunk<'static> {
+    let mut b = vec![0u8; 148];
+    b[15] = kind_code(d.kind);
+    b[16..16 + d.name.len()].copy_from_slice(d.name.as_bytes());
+    match (d.kind, d.default) {
+        (ParamKind::FloatSlider, Default::Number(v)) => b[56..64].copy_from_slice(&v.to_be_bytes()),
+        (ParamKind::FixedSlider | ParamKind::Angle, Default::Number(v)) => b[56..60].copy_from_slice(&fixed(v)),
+        (ParamKind::IntSlider | ParamKind::Checkbox, Default::Number(v)) => b[56..60].copy_from_slice(&(v as i32).to_be_bytes()),
+        (ParamKind::Popup, Default::Index(i)) => b[56..60].copy_from_slice(&i.to_be_bytes()),
+        (ParamKind::Point, Default::Point(x, y)) => {
+            b[56..60].copy_from_slice(&fixed(x));
+            b[60..64].copy_from_slice(&fixed(y));
+        }
+        (ParamKind::Color, Default::Color(c)) => b[56..60].copy_from_slice(&c),
+        _ => {}
+    }
+    match d.kind {
+        ParamKind::FloatSlider => {
+            b[104..108].copy_from_slice(&(d.valid.0 as f32).to_be_bytes());
+            b[108..112].copy_from_slice(&(d.valid.1 as f32).to_be_bytes());
+            b[112..116].copy_from_slice(&(d.valid.0 as f32).to_be_bytes());
+            b[116..120].copy_from_slice(&(d.valid.1 as f32).to_be_bytes());
+        }
+        ParamKind::FixedSlider => b[128..132].copy_from_slice(&fixed(d.valid.1)),
+        ParamKind::IntSlider => b[128..132].copy_from_slice(&(d.valid.1 as i32).to_be_bytes()),
+        ParamKind::Popup => b[60..62].copy_from_slice(&(d.items.len() as u16).to_be_bytes()),
+        _ => {}
+    }
+    Chunk::data(*b"pard", b)
+}
+
+/// A match name chunk (`tdmn`, 40 bytes).
+pub fn tdmn(name: &str) -> Chunk<'static> {
+    let mut b = name.as_bytes().to_vec();
+    b.resize(40, 0);
+    Chunk::data(*b"tdmn", b)
+}
+
+/// A UTF-8 string chunk (`Utf8`).
+pub fn utf8(s: &str) -> Chunk<'static> {
+    Chunk::data(*b"Utf8", s.as_bytes().to_vec())
+}
+
+/// A chunk whose body is chunks without being a `LIST` (`pdnm`, `fnam`: `NESTED_IDS`).
+pub fn nested(id: [u8; 4], children: Vec<Chunk<'static>>) -> Chunk<'static> {
+    Chunk { id, body: Body::Chunks(children), pad: None }
+}
+
+/// A static value record holding `v`, after the one After Effects wrote for Glow's A & B Midpoint
+/// (its header; without the expression).
+pub fn record(template: &Chunk<'_>, v: f64) -> Chunk<'static> {
+    let mut kids = Vec::new();
+    for c in template.children() {
+        match &c.body {
+            Body::Data(d) if c.id == *b"tdsb" || c.id == *b"tdb4" => kids.push(Chunk::data(c.id, d.to_vec())),
+            Body::Data(_) if c.id == *b"cdat" => {
+                let mut d = vec![0u8; 40];
+                d[..8].copy_from_slice(&v.to_be_bytes());
+                kids.push(Chunk::data(*b"cdat", d));
+            }
+            _ => {}
+        }
+    }
+    Chunk::list(*b"tdbs", kids)
+}
+
+/// A keyframed value record: `record`'s header with a key list of linear one-component keys.
+pub fn keyed_record(template: &Chunk<'_>, keys: &[(i32, f64)]) -> Chunk<'static> {
+    let Body::List { children, .. } = record(template, keys.first().map_or(0.0, |k| k.1)).body else { unreachable!("record builds a LIST") };
+    let mut children = children;
+    let mut lhd3 = vec![0u8; 52];
+    lhd3[0..4].copy_from_slice(&0x00d0_0beeu32.to_be_bytes());
+    lhd3[8..12].copy_from_slice(&(keys.len() as u32).to_be_bytes());
+    lhd3[16..20].copy_from_slice(&48u32.to_be_bytes());
+    let mut ldat = Vec::new();
+    for (time, value) in keys {
+        let mut rec = vec![0u8; 48];
+        rec[0..4].copy_from_slice(&time.to_be_bytes());
+        rec[4] = 1;
+        rec[5] = 1;
+        rec[8..16].copy_from_slice(&value.to_be_bytes());
+        ldat.extend(rec);
+    }
+    children.push(Chunk::list(*b"list", vec![Chunk::data(*b"lhd3", lhd3), Chunk::data(*b"ldat", ldat)]));
+    Chunk::list(*b"tdbs", children)
+}
+
+/// An effect instance: its match name, display name, parameter definitions (after the input
+/// layer, before the built-in entry), the 1-D values stored (`parT` index, value) and the
+/// arbitrary data stored (`parT` index, bytes).
+pub struct Fx {
+    pub match_name: &'static str,
+    pub name: &'static str,
+    pub defs: Vec<Def>,
+    pub values: Vec<(usize, f64)>,
+    pub data: Vec<(usize, Vec<u8>)>,
+    /// Keyframed 1-D parameters (`parT` index, (time units, value) per key), linear keys; the
+    /// parameter then has no entry in `values`.
+    pub keys: Vec<(usize, Vec<(i32, f64)>)>,
+}
+
+/// The match name of parameter `i` of `fx` (`<match>-NNNN`).
+fn param_name(fx: &Fx, i: usize) -> String {
+    format!("{}-{i:04}", fx.match_name)
+}
+
+/// The effect's `sspc`: its name, the parameter definitions (`parT`) and the stored values
+/// (`tdgp`), each value record copied from `template`.
+fn sspc(fx: &Fx, template: &Chunk<'_>) -> Chunk<'static> {
+    let n = fx.defs.len() + 2;
+    let mut part = vec![
+        Chunk::data(*b"parn", (n as u32).to_be_bytes().to_vec()),
+        tdmn(&param_name(fx, 0)),
+        pard(&Def { kind: ParamKind::Layer, name: "", default: Default::None, valid: (0.0, 0.0), items: &[] }),
+    ];
+    for (i, d) in fx.defs.iter().enumerate() {
+        part.push(tdmn(&param_name(fx, i + 1)));
+        part.push(pard(d));
+        if d.kind == ParamKind::Popup {
+            part.push(nested(*b"pdnm", vec![utf8(&d.items.join("|"))]));
+        }
+    }
+    part.push(tdmn("ADBE Effect Built In Params"));
+    part.push(pard(&Def { kind: ParamKind::NoData, name: "", default: Default::None, valid: (0.0, 0.0), items: &[] }));
+    let mut values = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec())];
+    for (i, v) in &fx.values {
+        values.push(tdmn(&param_name(fx, *i)));
+        values.push(record(template, *v));
+        if let Some((_, d)) = fx.data.iter().find(|(j, _)| j == i) {
+            values.push(Chunk::list(*b"aRbs", vec![Chunk::data(*b"aRbp", d.clone())]));
+        }
+    }
+    for (i, keys) in &fx.keys {
+        values.push(tdmn(&param_name(fx, *i)));
+        values.push(keyed_record(template, keys));
+    }
+    Chunk::list(*b"sspc", vec![nested(*b"fnam", vec![utf8(fx.name)]), Chunk::list(*b"parT", part), Chunk::list(*b"tdgp", values)])
+}
+
+/// The value record of Glow's A & B Midpoint (`ADBE Glo2-0011`): a 1-D static record.
+fn find_glow_template(chunks: &[Chunk<'_>]) -> Option<Chunk<'static>> {
+    for c in chunks {
+        let kids = c.children();
+        if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(b"ADBE Glo2-0011\0")))
+            && let Some(record) = kids.get(at + 1).filter(|k| k.is_list(b"tdbs"))
+        {
+            return Some(Chunk::list(
+                *b"tdbs",
+                record
+                    .children()
+                    .iter()
+                    .map(|k| match &k.body {
+                        Body::Data(d) => Chunk::data(k.id, d.to_vec()),
+                        _ => Chunk::data(k.id, Vec::new()),
+                    })
+                    .collect(),
+            ));
+        }
+        if let Some(t) = find_glow_template(kids) {
+            return Some(t);
+        }
+    }
+    None
+}
+
+/// Replaces every Glow (`ADBE Glo2` with its `sspc`) below `chunks` with the effect `match_name`
+/// and its `sspc`; the number replaced.
+fn replace_glow(chunks: &mut [Chunk<'_>], match_name: &str, sspc: &Chunk<'static>) -> usize {
+    let mut n = 0;
+    for ch in chunks {
+        let kids = ch.children_mut();
+        if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(b"ADBE Glo2\0")))
+            && kids.get(at + 1).is_some_and(|k| k.is_list(b"sspc"))
+        {
+            kids[at] = tdmn(match_name);
+            kids[at + 1] = sspc.clone();
+            n += 1;
+        }
+        n += replace_glow(kids, match_name, sspc);
+    }
+    n
+}
+
+/// `synthetic.aep` with the effect `match_name` in place of the Glow effect; `make` builds its
+/// `sspc` from the Glow's value record (the template of every record).
+pub fn bytes_with_effect(match_name: &str, make: impl Fn(&Chunk<'_>) -> Chunk<'static>) -> Vec<u8> {
+    let file = parse(SYNTHETIC).unwrap();
+    let template = find_glow_template(&file.chunks).expect("Glow's A & B Midpoint record");
+    let sspc = make(&template);
+    let mut file = parse(SYNTHETIC).unwrap();
+    assert_eq!(replace_glow(&mut file.chunks, match_name, &sspc), 2, "the Glow effect and its shared definitions");
+    write(&file).unwrap()
+}
+
+/// `synthetic.aep` with `fx` in place of the Glow effect.
+pub fn bytes_with(fx: &Fx) -> Vec<u8> {
+    bytes_with_effect(fx.match_name, |t| sspc(fx, t))
+}
+
+/// Imports `synthetic.aep` with `fx` in place of its Glow: the EffectCraft effect `effect` (if
+/// imported) and the result.
+pub fn run(fx: &Fx, effect: &str) -> (Option<PropGroup>, ImportResult) {
+    import_bytes(&bytes_with(fx), effect)
+}
+
+/// Imports `bytes`: the first EffectCraft effect `effect` (if imported) and the result.
+pub fn import_bytes(bytes: &[u8], effect: &str) -> (Option<PropGroup>, ImportResult) {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    let g = project
+        .comps()
+        .flat_map(|(_, c)| c.layers.iter())
+        .find_map(|l| l.props.sub("effects").and_then(|fx| fx.children.iter().filter_map(|n| n.as_group()).find(|g| g.match_id == effect).cloned()));
+    (g, r)
+}
+
+/// The losses of `category` that name the effect `match_name`.
+pub fn losses(r: &ImportResult, category: LossCategory, match_name: &str) -> Vec<String> {
+    let tag = format!("({match_name})");
+    r.report.losses.iter().filter(|l| l.category == category).flat_map(|l| l.details.clone()).filter(|d| d.contains(&tag)).collect()
+}
+
+/// The value of property `id` of `g` (panics when it is missing).
+pub fn v(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id} in {}", g.match_id)).value.clone()
+}
+
+/// The scalar value of property `id` of `g`.
+pub fn num(g: &PropGroup, id: &str) -> f64 {
+    match v(g, id) {
+        Value::Scalar(x) => x,
+        other => panic!("{id}: {other:?}"),
+    }
+}
+
+/// Asserts that property `id` of `g` is `want` (relative 1e-6).
+pub fn near(g: &PropGroup, id: &str, want: f64) {
+    let got = num(g, id);
+    assert!((got - want).abs() <= want.abs().max(1.0) * 1e-6, "{} {id}: {got} != {want}", g.match_id);
+}
+
+/// Asserts that the point property `id` of `g` is `want` (within 0.01).
+pub fn pt(g: &PropGroup, id: &str, want: [f64; 2]) {
+    let Value::Vec2(a) = v(g, id) else { panic!("{id}") };
+    assert!((a[0] - want[0]).abs() < 1e-2 && (a[1] - want[1]).abs() < 1e-2, "{} {id}: {a:?} != {want:?}", g.match_id);
+}
+
+/// A slider definition.
+pub fn slider(kind: ParamKind, name: &'static str, default: f64, valid: (f64, f64)) -> Def {
+    Def { kind, name, default: Default::Number(default), valid, items: &[] }
+}
+
+/// A popup definition: default item (1-based) and items.
+pub fn popup(name: &'static str, default: u32, items: &'static [&'static str]) -> Def {
+    Def { kind: ParamKind::Popup, name, default: Default::Index(default), valid: (0.0, 0.0), items }
+}
+
+/// A definition of another kind (angle, point, colour, ...) with `default`.
+pub fn other(kind: ParamKind, name: &'static str, default: Default) -> Def {
+    Def { kind, name, default, valid: (0.0, 0.0), items: &[] }
+}
+
+/// The definitions written here read back as the reader decodes After Effects' `pard`.
+#[test]
+fn pard_layout_decodes_as_written() {
+    // Echo's Decay (float, valid 0..100, default 1), Linear Wipe's Feather (fixed, valid max
+    // 32 000), Echo's Number Of Echoes (integer, max 30 000, default 1), Offset's centre point,
+    // Color Stabilizer's Stabilize (default 2 of 3): what the sample dump of 2026-11-05 read.
+    let fx = Fx {
+        match_name: "Test FX",
+        name: "Test FX",
+        defs: vec![
+            slider(ParamKind::FloatSlider, "Decay", 1.0, (0.0, 100.0)),
+            slider(ParamKind::FixedSlider, "Feather", 0.0, (0.0, 32000.0)),
+            slider(ParamKind::IntSlider, "Number Of Echoes", 1.0, (0.0, 30000.0)),
+            other(ParamKind::Point, "Shift Center To", Default::Point(0.5, 0.5)),
+            popup("Stabilize", 2, &["Brightness", "Levels", "Curves"]),
+            other(ParamKind::Color, "Shadows Unbalance", Default::Color([0, 0, 0, 0])),
+        ],
+        values: vec![(1, 20.0)],
+        data: vec![],
+        keys: vec![],
+    };
+    let bytes = bytes_with(&fx);
+    let file = parse(&bytes).unwrap();
+    let proj = AepProject::new(&file).unwrap();
+    let defs = proj.effect_definition_index();
+    let found = proj
+        .all_items()
+        .into_iter()
+        .filter_map(|i| i.comp())
+        .flat_map(|c| c.layers().collect::<Vec<_>>())
+        .flat_map(|l| l.effects())
+        .find(|e| e.match_name() == "Test FX")
+        .expect("the effect");
+    let p = defs.params(&found);
+    let by = |i: usize| p.iter().find(|q| q.index == i).expect("parameter").clone();
+    let decay = by(1);
+    assert_eq!(
+        (decay.kind, decay.name.as_str(), decay.valid_min(), decay.valid_max(), decay.pard_default()),
+        (ParamKind::FloatSlider, "Decay", Some(0.0), Some(100.0), Some(ParamValue::Number(1.0)))
+    );
+    assert_eq!(decay.stored_value(), Some(ParamValue::Number(20.0)));
+    assert_eq!((by(2).kind, by(2).valid_max(), by(2).pard_default()), (ParamKind::FixedSlider, Some(32000.0), Some(ParamValue::Number(0.0))));
+    assert_eq!((by(3).kind, by(3).valid_max(), by(3).pard_default()), (ParamKind::IntSlider, Some(30000.0), Some(ParamValue::Number(1.0))));
+    assert_eq!(by(4).pard_default(), Some(ParamValue::Point([0.5, 0.5])));
+    let stab = by(5);
+    assert_eq!((stab.popup_item_count(), stab.items.clone()), (Some(3), Some(vec!["Brightness".to_string(), "Levels".into(), "Curves".into()])));
+    assert_eq!(found.display_name().as_deref(), Some("Test FX"));
+    assert_eq!(by(6).pard_default(), Some(ParamValue::Argb([0.0, 0.0, 0.0, 0.0])));
+}
diff --git a/crates/aep/tests/it/import/helpers.rs b/crates/aep/tests/it/import/helpers.rs
new file mode 100644
index 000000000..5afee0371
--- /dev/null
+++ b/crates/aep/tests/it/import/helpers.rs
@@ -0,0 +1,69 @@
+//! Helpers shared by the import tests.
+#![allow(dead_code, unused_macros)]
+use effectcraft_aep::import::{AepImportError, ImportOptions, ImportResult, import};
+use effectcraft_project::{Comp, ItemId, ItemKind, Project};
+
+/// Imports a fixture into an empty project, allowing losses, with no footage file present;
+/// `None` when the fixture is missing.
+pub fn try_load(name: &str) -> Option<(Project, ImportResult)> {
+    let mut project = Project::default();
+    let bytes = crate::common::try_fixture(name)?;
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut project, &bytes, &opts).unwrap_or_else(|e| panic!("{name}: {e}"));
+    Some((project, r))
+}
+
+/// Imports a fixture into `project`; `None` when the fixture is missing.
+pub fn try_import_fixture(project: &mut Project, name: &str, allow: bool) -> Option<Result<ImportResult, AepImportError>> {
+    let bytes = crate::common::try_fixture(name)?;
+    let none = |_: &str| false;
+    Some(import(project, &bytes, &ImportOptions { allow_losses: allow, ..ImportOptions::new(&none) }))
+}
+
+/// [`try_load`]; returns from the calling test when the fixture is missing.
+macro_rules! load {
+    ($name:expr) => {
+        match $crate::import::helpers::try_load(&$name) {
+            Some(loaded) => loaded,
+            None => return,
+        }
+    };
+}
+
+/// [`try_import_fixture`]; returns from the calling test when the fixture is missing.
+macro_rules! try_import {
+    ($project:expr, $name:expr, $allow:expr) => {
+        match $crate::import::helpers::try_import_fixture($project, &$name, $allow) {
+            Some(result) => result,
+            None => return,
+        }
+    };
+}
+
+pub fn comp<'p>(project: &'p Project, r: &ImportResult, name: &str) -> (ItemId, &'p Comp) {
+    for id in &r.comps {
+        if let Some(item) = project.item(*id)
+            && item.name == name
+            && let ItemKind::Comp(c) = &item.kind
+        {
+            return (*id, c);
+        }
+    }
+    panic!("no comp {name}")
+}
+
+/// The name, item id and layer ids (top first) of every composition of a case, from the
+/// container; `None` when the case is missing. Ids differ between the single-case files and the
+/// cases of a combined file, so tests that patch ids read them here.
+pub fn comp_ids(name: &str) -> Option<Vec<(String, u32, Vec<u32>)>> {
+    let bytes = crate::common::try_fixture(name)?;
+    let file = effectcraft_aep::parse(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+    let view = effectcraft_aep::Project::new(&file).expect("a project");
+    Some(
+        view.all_items()
+            .into_iter()
+            .filter_map(|i| Some((i.name().unwrap_or_default(), i.id()?, i.comp()?.layers().filter_map(|l| l.id()).collect())))
+            .collect(),
+    )
+}
diff --git a/crates/aep/tests/it/import/lumetri.rs b/crates/aep/tests/it/import/lumetri.rs
new file mode 100644
index 000000000..d31960cef
--- /dev/null
+++ b/crates/aep/tests/it/import/lumetri.rs
@@ -0,0 +1,573 @@
+//! Lumetri Color (`ADBE Lumetri`) arrives as EffectCraft's Lumetri Color (`ec.color.lumetri`),
+//! its parameters found by match name. The effect is built into the committed `synthetic.aep` in
+//! place of its Glow, in the layout of the 1200 samples (After Effects 2026, docs/aep-format.md
+//! 3.7): the definitions are a subset in an order of our own, so a mapping by `parT` index fails.
+
+use effectcraft_aep::import::{ImportOptions, ImportResult, LossCategory, import};
+use effectcraft_aep::{Body, Chunk, parse, write};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Project, PropGroup};
+
+const SYNTHETIC: &[u8] = include_bytes!("../../fixtures/synthetic.aep");
+
+fn tdmn(name: &str) -> Chunk<'static> {
+    let mut b = name.as_bytes().to_vec();
+    b.resize(40, 0);
+    Chunk::data(*b"tdmn", b)
+}
+
+/// A chunk holding chunks (`pdnm`, `fnam`: `NESTED_IDS`) with one `Utf8`.
+fn nested(id: [u8; 4], text: &[u8]) -> Chunk<'static> {
+    Chunk { id, body: Body::Chunks(vec![Chunk::data(*b"Utf8", text.to_vec())]), pad: None }
+}
+
+fn mn(suffix: u16) -> String {
+    format!("ADBE Lumetri-{suffix:04}")
+}
+
+/// A parameter definition (`pard`, 148 bytes): the type at byte 15, the name at 16, the default at
+/// 56 (a float slider's `f64`, a checkbox's or popup's `u32`), a popup's item count at 60, a float
+/// slider's valid range at 104 / 108 and slider range at 112 / 116 (`f32`).
+#[derive(Clone)]
+enum Def {
+    Float { name: &'static str, default: f64, min: f32, max: f32 },
+    Check { default: bool },
+    Popup { name: &'static str, items: &'static [&'static str] },
+    Data { name: &'static str },
+    Group { name: &'static str, end: bool },
+}
+
+fn pard(d: &Def) -> Vec<Chunk<'static>> {
+    let mut b = vec![0u8; 148];
+    let name = |b: &mut Vec<u8>, n: &str| b[16..16 + n.len()].copy_from_slice(n.as_bytes());
+    let mut extra = Vec::new();
+    match d {
+        Def::Float { name: n, default, min, max } => {
+            b[15] = 10;
+            name(&mut b, n);
+            b[56..64].copy_from_slice(&default.to_be_bytes());
+            b[104..108].copy_from_slice(&min.to_be_bytes());
+            b[108..112].copy_from_slice(&max.to_be_bytes());
+            b[112..116].copy_from_slice(&min.to_be_bytes());
+            b[116..120].copy_from_slice(&max.to_be_bytes());
+        }
+        Def::Check { default } => {
+            b[15] = 4;
+            name(&mut b, " ");
+            b[56..60].copy_from_slice(&u32::from(*default).to_be_bytes());
+        }
+        Def::Popup { name: n, items } => {
+            b[15] = 7;
+            name(&mut b, n);
+            b[56..60].copy_from_slice(&1u32.to_be_bytes());
+            b[60..62].copy_from_slice(&u16::try_from(items.len()).unwrap().to_be_bytes());
+            extra.push(nested(*b"pdnm", items.join("|").as_bytes()));
+        }
+        Def::Data { name: n } => {
+            b[15] = 11;
+            name(&mut b, n);
+        }
+        Def::Group { name: n, end } => {
+            b[15] = if *end { 14 } else { 13 };
+            name(&mut b, n);
+        }
+    }
+    let mut v = vec![Chunk::data(*b"pard", b)];
+    v.extend(extra);
+    v
+}
+
+/// A stored value.
+#[derive(Clone)]
+enum Rec {
+    /// A number in a record of state `tdsb` (1 written, 3 the default state).
+    Num(f64, u32),
+    /// Arbitrary data.
+    Data(Vec<u8>),
+    /// A value record whose arbitrary data (`aRbs`) is missing.
+    NoData,
+}
+
+/// A static value record after the one After Effects wrote for Glow's A & B Midpoint (its header,
+/// one component).
+fn record(template: &Chunk<'_>, tdsb: u32, v: f64) -> Chunk<'static> {
+    let mut kids = Vec::new();
+    for c in template.children() {
+        match &c.body {
+            Body::Data(_) if c.id == *b"tdsb" => kids.push(Chunk::data(*b"tdsb", tdsb.to_be_bytes().to_vec())),
+            Body::Data(d) if c.id == *b"tdb4" => kids.push(Chunk::data(c.id, d.to_vec())),
+            Body::Data(_) if c.id == *b"cdat" => {
+                let mut d = vec![0u8; 40];
+                d[..8].copy_from_slice(&v.to_be_bytes());
+                kids.push(Chunk::data(*b"cdat", d));
+            }
+            _ => {}
+        }
+    }
+    Chunk::list(*b"tdbs", kids)
+}
+
+/// The defaults of a fresh instance's data (1200 `lumetri-00-defaults`).
+fn empty() -> Vec<u8> {
+    vec![0xfe, 0xfe]
+}
+
+/// A Lumetri curve: type, point count, points (`f64` x, y), padded to 520 bytes.
+fn curve(kind: i32, pts: &[(f64, f64)]) -> Vec<u8> {
+    let mut d = kind.to_le_bytes().to_vec();
+    d.extend(u32::try_from(pts.len()).unwrap().to_le_bytes());
+    for (x, y) in pts {
+        d.extend(x.to_le_bytes());
+        d.extend(y.to_le_bytes());
+    }
+    d.resize(520, 0);
+    d
+}
+
+fn rgb_curves() -> Vec<u8> {
+    (0..4).flat_map(|_| curve(0, &[(0.0, 0.0), (1.0, 1.0)])).collect()
+}
+
+fn wheels(n: usize) -> Vec<u8> {
+    (0..n).flat_map(|_| [0.0f64, 0.5, 0.0].into_iter().flat_map(f64::to_le_bytes)).collect()
+}
+
+fn utf16(s: &str) -> Vec<u8> {
+    s.encode_utf16().chain([0]).flat_map(u16::to_le_bytes).collect()
+}
+
+/// HSL Secondary's key data as 1200 `lumetri-01-set-all` stores it (Set color RGB 0.02 0.55 0.85).
+const HSL_PICKED: &str = "01327f0f3fcdcc4c3dcdcccc3d01d519683f2e57c93dcade173e01dfdede3ecdcc4c3dcdcccc3d01";
+/// A fresh instance's key data (`-00-defaults`).
+const HSL_FRESH: &str = "000000003f0000000000000000010000003f0000000000000000010000003f000000000000000001";
+
+fn hex(s: &str) -> Vec<u8> {
+    (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
+}
+
+const MASK_STYLE: &[&str] = &["Color/Gray", "Color/Black", "White/Black"];
+const LOOKS: &[&str] = &["None", "[Custom]", "Browse...", "(-", "SL BIG", "SL BLUE ICE"];
+
+/// The definitions, an order of our own (not After Effects' `parT` order) and without the ones
+/// After Effects 2026 added late (-0127 ... -0130).
+fn defs() -> Vec<(u16, Def)> {
+    let f = |name, default, min, max| Def::Float { name, default, min, max };
+    vec![
+        (1, Def::Data { name: "Blob" }),
+        (62, Def::Check { default: false }),
+        (2, Def::Group { name: "Basic Correction", end: false }),
+        (3, Def::Check { default: true }),
+        (95, Def::Data { name: " " }),
+        (64, f("HDR Specular", 0.0, -150.0, 150.0)),
+        (16, f("Blacks", 0.0, -150.0, 150.0)),
+        (11, f("Exposure", 0.0, -7.0, 7.0)),
+        (12, f("Contrast", 0.0, -150.0, 150.0)),
+        (7, f("Temperature", 0.0, -300.0, 300.0)),
+        (21, Def::Group { name: "", end: true }),
+        (22, Def::Group { name: "Creative", end: false }),
+        (23, Def::Check { default: true }),
+        (96, Def::Data { name: " " }),
+        (25, Def::Popup { name: "Look", items: LOOKS }),
+        (26, f("Intensity", 100.0, 0.0, 200.0)),
+        (32, Def::Data { name: "Split Toning" }),
+        (35, Def::Group { name: "", end: true }),
+        (39, Def::Data { name: "RGB Curve" }),
+        (104, Def::Check { default: true }),
+        (42, Def::Data { name: "Hue vs Sat" }),
+        (106, Def::Data { name: "Hue vs Hue" }),
+        (47, Def::Data { name: "Wheels" }),
+        (68, Def::Check { default: true }),
+        (73, Def::Data { name: "HSL Sliders" }),
+        (74, Def::Check { default: false }),
+        (75, Def::Popup { name: " ", items: MASK_STYLE }),
+        (85, Def::Data { name: "Color Wheels" }),
+        (86, f("Temperature", 0.0, -300.0, 300.0)),
+        (50, Def::Check { default: true }),
+        (51, f("Amount", 0.0, -5.0, 5.0)),
+        (54, f("Feather", 50.0, 0.0, 100.0)),
+        (97, Def::Check { default: false }),
+    ]
+}
+
+/// The data every instance stores, at the defaults.
+fn default_data() -> Vec<(u16, Rec)> {
+    vec![
+        (1, Rec::Data(empty())),
+        (95, Rec::Data(empty())),
+        (96, Rec::Data(empty())),
+        (32, Rec::Data(vec![0; 32])),
+        (39, Rec::Data(rgb_curves())),
+        (42, Rec::Data(curve(3, &[]))),
+        (106, Rec::Data(curve(3, &[]))),
+        (47, Rec::Data(wheels(4))),
+        (73, Rec::Data(hex(HSL_FRESH))),
+        (85, Rec::Data(wheels(8))),
+    ]
+}
+
+/// The Lumetri instance: the definitions, then the stored values `recs` (data replaces the
+/// default data of the same parameter).
+fn sspc(defs: &[(u16, Def)], recs: &[(u16, Rec)], template: &Chunk<'_>) -> Chunk<'static> {
+    let mut part = vec![Chunk::data(*b"parn", u32::try_from(defs.len() + 2).unwrap().to_be_bytes().to_vec()), tdmn(&mn(0))];
+    let mut layer = vec![0u8; 148];
+    layer[15] = 0;
+    part.push(Chunk::data(*b"pard", layer));
+    for (s, d) in defs {
+        part.push(tdmn(&mn(*s)));
+        part.extend(pard(d));
+    }
+    part.push(tdmn("ADBE Effect Built In Params"));
+    let mut end = vec![0u8; 148];
+    end[15] = 9;
+    part.push(Chunk::data(*b"pard", end));
+    let mut all: Vec<(u16, Rec)> = default_data().into_iter().filter(|(s, _)| !recs.iter().any(|(r, _)| r == s)).collect();
+    all.extend(recs.iter().cloned());
+    let mut values = vec![Chunk::data(*b"tdsb", 1u32.to_be_bytes().to_vec())];
+    for (s, r) in all {
+        values.push(tdmn(&mn(s)));
+        match r {
+            Rec::Num(v, tdsb) => values.push(record(template, tdsb, v)),
+            Rec::Data(d) => {
+                values.push(record(template, 1, 0.0));
+                values.push(Chunk::list(*b"aRbs", vec![Chunk::data(*b"aRbp", d)]));
+            }
+            Rec::NoData => values.push(record(template, 1, 0.0)),
+        }
+    }
+    Chunk::list(*b"sspc", vec![nested(*b"fnam", b"Lumetri Color"), Chunk::list(*b"parT", part), Chunk::list(*b"tdgp", values)])
+}
+
+fn find_glow_template<'a>(chunks: &'a [Chunk<'a>]) -> Option<Chunk<'a>> {
+    for c in chunks {
+        let kids = c.children();
+        if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(b"ADBE Glo2-0011\0")))
+            && let Some(record) = kids.get(at + 1).filter(|k| k.is_list(b"tdbs"))
+        {
+            return Some(record.clone());
+        }
+        if let Some(t) = find_glow_template(kids) {
+            return Some(t);
+        }
+    }
+    None
+}
+
+/// Puts the instance in place of the Glow effect (in the effect parade and the project's shared
+/// definitions); the number of places.
+fn replace_glow(chunks: &mut [Chunk<'_>], instance: &Chunk<'static>) -> usize {
+    let mut n = 0;
+    for ch in chunks {
+        let kids = ch.children_mut();
+        if let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.starts_with(b"ADBE Glo2\0")))
+            && kids.get(at + 1).is_some_and(|k| k.is_list(b"sspc"))
+        {
+            kids[at] = tdmn("ADBE Lumetri");
+            kids[at + 1] = instance.clone();
+            n += 1;
+        }
+        n += replace_glow(kids, instance);
+    }
+    n
+}
+
+fn run_with(defs: &[(u16, Def)], recs: &[(u16, Rec)]) -> (PropGroup, ImportResult) {
+    let file = parse(SYNTHETIC).unwrap();
+    let template = find_glow_template(&file.chunks).expect("Glow's A & B Midpoint record");
+    let instance = sspc(defs, recs, &template);
+    let mut file = parse(SYNTHETIC).unwrap();
+    assert_eq!(replace_glow(&mut file.chunks, &instance), 2, "the Glow effect and its shared definitions");
+    let bytes = write(&file).unwrap();
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    let g = project
+        .comps()
+        .flat_map(|(_, c)| c.layers.iter())
+        .find_map(|l| l.props.sub("effects").and_then(|fx| fx.children.iter().filter_map(|n| n.as_group()).find(|g| g.match_id == "ec.color.lumetri").cloned()))
+        .expect("an EffectCraft Lumetri Color");
+    (g, r)
+}
+
+fn run(recs: &[(u16, Rec)]) -> (PropGroup, ImportResult) {
+    run_with(&defs(), recs)
+}
+
+fn losses(r: &ImportResult) -> Vec<String> {
+    r.report
+        .losses
+        .iter()
+        .filter(|l| matches!(l.category, LossCategory::Effects | LossCategory::DamagedData))
+        .flat_map(|l| l.details.clone())
+        .filter(|d| d.contains("Lumetri"))
+        .collect()
+}
+
+fn num(g: &PropGroup, id: &str) -> f64 {
+    g.prop(id).unwrap_or_else(|| panic!("no {id}")).value.as_f64()
+}
+
+fn val(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id}")).value.clone()
+}
+
+#[test]
+fn a_fresh_lumetri_arrives_without_losses() {
+    let (g, r) = run(&[]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+    assert_eq!((num(&g, "basicCorrection/tone/exposure"), num(&g, "creative/lookIntensity"), num(&g, "vignette/vignetteFeather")), (0.0, 100.0, 50.0));
+    assert_eq!(val(&g, "creative/look"), Value::Enum(0));
+}
+
+#[test]
+fn lumetri_values_arrive_by_match_name_also_from_default_state_records() {
+    // 1200 `lumetri-01-set-all` / `-06-sec-light`: High Dynamic Range and HDR Specular are
+    // recorded in the default state (`tdsb` 3) and read back as set.
+    let (g, r) = run(&[
+        (62, Rec::Num(1.0, 3)),
+        (64, Rec::Num(22.0, 3)),
+        (11, Rec::Num(2.589_999_914_169_311_5, 1)),
+        (12, Rec::Num(37.0, 1)),
+        (16, Rec::Num(-150.0, 1)),
+        (7, Rec::Num(300.0, 1)),
+        (26, Rec::Num(134.0, 1)),
+        (51, Rec::Num(1.85, 1)),
+        (74, Rec::Num(1.0, 1)),
+        (75, Rec::Num(3.0, 1)),
+        (73, Rec::Data(hex(HSL_PICKED))),
+    ]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+    assert_eq!(val(&g, "highDynamicRange"), Value::Bool(true));
+    for (id, want) in [
+        ("basicCorrection/tone/hdrSpecular", 22.0),
+        ("basicCorrection/tone/exposure", 2.589_999_914_169_311_5),
+        ("basicCorrection/tone/contrast", 37.0),
+        ("basicCorrection/tone/blacks", -150.0),
+        // Past EffectCraft's old slider range: kept (the range is After Effects' now).
+        ("basicCorrection/whiteBalance/temperature", 300.0),
+        ("creative/lookIntensity", 134.0),
+        ("vignette/vignetteAmount", 1.85),
+    ] {
+        assert_eq!(num(&g, id), want, "{id}");
+    }
+    assert_eq!((val(&g, "hslSecondary/key/showMask"), val(&g, "hslSecondary/key/maskStyle")), (Value::Bool(true), Value::Enum(2)));
+}
+
+#[test]
+fn a_switched_off_section_is_reported_and_not_applied() {
+    // 1200 `-03-sec-basic-correction`, `-17-sec-vignette`: a section that is off does nothing.
+    let (g, r) = run(&[(3, Rec::Num(0.0, 1)), (11, Rec::Num(2.0, 1)), (50, Rec::Num(0.0, 1)), (51, Rec::Num(-2.0, 1)), (12, Rec::Num(37.0, 1))]);
+    assert_eq!((num(&g, "basicCorrection/tone/exposure"), num(&g, "basicCorrection/tone/contrast"), num(&g, "vignette/vignetteAmount")), (0.0, 0.0, 0.0));
+    let l = losses(&r);
+    assert_eq!(l.len(), 2, "{l:?}");
+    assert!(l[0].contains("section Basic Correction is switched off") && l[0].contains("Exposure 2, Contrast 37"), "{l:?}");
+    assert!(l[1].contains("section Vignette is switched off") && l[1].contains("Amount -2"), "{l:?}");
+}
+
+#[test]
+fn a_look_is_reported_by_name() {
+    // 1200 `-01-set-all`: the Look's name in -0096, the popup's record in the default state.
+    let (g, r) = run(&[(96, Rec::Data(utf16("SL BLUE ICE"))), (25, Rec::Num(6.0, 3))]);
+    assert_eq!(val(&g, "creative/look"), Value::Enum(0));
+    let l = losses(&r);
+    assert_eq!(l.len(), 1, "{l:?}");
+    assert!(l[0].contains("the Look 'SL BLUE ICE' is not imported"), "{l:?}");
+    // Only the popup: its item.
+    let (_, r) = run(&[(25, Rec::Num(5.0, 1))]);
+    assert!(losses(&r).iter().any(|d| d.contains("the Look 'SL BIG' is not imported")), "{:?}", losses(&r));
+}
+
+#[test]
+fn hue_vs_sat_arrives_with_its_y_scaled_other_moved_curves_are_reported() {
+    // 1200 `-11-sec-hue-saturation-curves`: the selector put three neutral points on the curve.
+    let neutral = curve(3, &[(0.742_483, 0.0), (0.798_038, 0.0), (0.853_594, 0.0)]);
+    let (g, r) = run(&[(42, Rec::Data(neutral))]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+    assert_eq!(val(&g, "curves/hueSaturationCurves/hueVsSat"), Value::Str(String::new()));
+    // 1200 `-61-preset-curves-huesat`: red raised to 0.97 (After Effects nearly doubles its
+    // saturation), the neighbours pinned near 0. EffectCraft's y: 0.5 + y / 2.
+    let preset = curve(3, &[(0.015_463_917_525_773_196, 0.97), (0.262_886_597_938_144_34, -0.03), (0.764_604_810_996_563_5, -0.02)]);
+    let (g, r) = run(&[(42, Rec::Data(preset))]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+    let Value::Str(text) = val(&g, "curves/hueSaturationCurves/hueVsSat") else { panic!("a point list") };
+    let pts: Vec<(f64, f64)> = text
+        .split(' ')
+        .map(|p| {
+            let (x, y) = p.split_once(',').unwrap();
+            (x.parse().unwrap(), y.parse().unwrap())
+        })
+        .collect();
+    let want = [(0.015_464, 0.985), (0.262_887, 0.485), (0.764_605, 0.49)];
+    assert_eq!(pts.len(), 3, "{text}");
+    for ((x, y), (wx, wy)) in pts.iter().zip(want) {
+        assert!((x - wx).abs() < 1e-5 && (y - wy).abs() < 1e-9, "{text}");
+    }
+    // Hue vs Hue moved: no sample tells its scale, reported and left neutral.
+    let (g, r) = run(&[(106, Rec::Data(curve(3, &[(0.5, 0.25)])))]);
+    let l = losses(&r);
+    assert!(l.len() == 1 && l[0].contains("Hue vs Hue (ADBE Lumetri-0106) is not imported"), "{l:?}");
+    assert_eq!(val(&g, "curves/hueSaturationCurves/hueVsHue"), Value::Str(String::new()));
+    // A point count past the data: not a default, reported as damaged, no panic.
+    let mut bad = curve(3, &[]);
+    bad[4..8].copy_from_slice(&1000u32.to_le_bytes());
+    let (g, r) = run(&[(42, Rec::Data(bad))]);
+    let l = losses(&r);
+    assert!(l.len() == 1 && l[0].contains("Hue vs Sat (ADBE Lumetri-0042) is unreadable"), "{l:?}");
+    assert_eq!(val(&g, "curves/hueSaturationCurves/hueVsSat"), Value::Str(String::new()));
+}
+
+#[test]
+fn the_master_rgb_curve_arrives_moved_channel_curves_are_reported() {
+    // 1200 `-60-preset-curves-rgb`: the first of the four curves, its midpoint raised.
+    let master = curve(0, &[(0.0, 0.0), (0.491_408_934_707_903_76, 0.786_885_245_901_639_3), (1.0, 1.0)]);
+    let identity = curve(0, &[(0.0, 0.0), (1.0, 1.0)]);
+    let mut d = master.clone();
+    (0..3).for_each(|_| d.extend(&identity));
+    let (g, r) = run(&[(39, Rec::Data(d))]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+    assert_eq!(val(&g, "curves/rgbCurves/master"), Value::Str("0,0 0.49140893470790376,0.7868852459016393 1,1".into()));
+    assert_eq!(val(&g, "curves/rgbCurves/red"), Value::Str("0,0 1,1".into()));
+    // A moved channel curve: which channel it is is not known, reported.
+    let mut d = identity.clone();
+    d.extend(&master);
+    (0..2).for_each(|_| d.extend(&identity));
+    let (g, r) = run(&[(39, Rec::Data(d))]);
+    let l = losses(&r);
+    assert!(l.len() == 1 && l[0].contains("1 channel curve(s) of RGB Curve (ADBE Lumetri-0039) are not imported"), "{l:?}");
+    assert_eq!(val(&g, "curves/rgbCurves/master"), Value::Str("0,0 1,1".into()));
+    // Damaged: the wrong length.
+    let (_, r) = run(&[(39, Rec::Data(master))]);
+    assert!(losses(&r).iter().any(|x| x.contains("RGB Curve (ADBE Lumetri-0039) is unreadable")), "{:?}", losses(&r));
+}
+
+/// A value record without its arbitrary data is damaged, not the default: reported for the RGB
+/// curve and the HSL key, the neighbours stay as they were.
+#[test]
+fn a_value_record_without_its_data_is_reported_as_damaged() {
+    for (suffix, name) in [(39, "RGB Curve (ADBE Lumetri-0039)"), (73, "HSL Sliders (ADBE Lumetri-0073)")] {
+        let (g, r) = run(&[(suffix, Rec::NoData)]);
+        let l = losses(&r);
+        assert!(l.len() == 1 && l[0].contains(name) && l[0].contains("is missing"), "{suffix}: {l:?}");
+        assert!(r.report.losses.iter().any(|x| x.category == LossCategory::DamagedData), "{suffix}");
+        // The grade stays at the default.
+        assert_eq!(val(&g, "curves/rgbCurves/master"), Value::Str("0,0 1,1".into()));
+        assert_eq!(num(&g, "hslSecondary/key/hueRange"), 180.0);
+    }
+}
+
+#[test]
+fn colour_wheels_arrive_as_colours_their_brightness_is_reported() {
+    // 1200 `-62-preset-wheels`: Shadows towards blue with the slider down, Midtones towards red,
+    // Highlights towards yellow-green with the slider up; the fourth wheel at its default.
+    let w: Vec<u8> = [
+        229.119_895_976_548_18,
+        0.369_892_467_494_294_2,
+        0.547_209_348_004_638,
+        0.104_745_366_878_020_72,
+        0.5,
+        0.394_961_840_132_529_44,
+        93.374_076_744_668_57,
+        0.726_881_718_523_399_9,
+        0.318_976_840_675_999_35,
+        0.0,
+        0.5,
+        0.0,
+    ]
+    .into_iter()
+    .flat_map(f64::to_le_bytes)
+    .collect();
+    let (g, r) = run(&[(47, Rec::Data(w.clone()))]);
+    let colour = |id: &str| match val(&g, id) {
+        Value::Color(c) => c,
+        other => panic!("{id}: {other:?}"),
+    };
+    // The hue's direction: blue strongest in Shadows, red in Midtones, green in Highlights.
+    let s = colour("colorWheels/shadowsWheel");
+    assert!(s[2] > 0.77 && s[0] < 0.23 && (s[0] + s[2] - 1.0).abs() < 1e-9, "{s:?}");
+    let m = colour("colorWheels/midtonesWheel");
+    assert!((m[0] - 0.697_480_920_066_264_7).abs() < 1e-9 && m[1] > m[2], "{m:?}");
+    let h = colour("colorWheels/highlightsWheel");
+    assert!(h[1] > h[0] && h[0] > h[2], "{h:?}");
+    let l = losses(&r);
+    assert!(l.len() == 1 && l[0].contains("Shadows brightness 0.370") && l[0].contains("Highlights brightness 0.727"), "{l:?}");
+    assert!(!l[0].contains("Midtones") && !l[0].contains("fourth"), "{l:?}");
+    // The fourth wheel set: reported; damaged data: reported, the wheels stay grey.
+    let mut w4 = w;
+    w4[88..96].copy_from_slice(&0.3f64.to_le_bytes());
+    let (_, r) = run(&[(47, Rec::Data(w4))]);
+    assert!(losses(&r).iter().any(|x| x.contains("the fourth wheel")), "{:?}", losses(&r));
+    let (g, r) = run(&[(47, Rec::Data(vec![1; 95]))]);
+    assert!(losses(&r).iter().any(|x| x.contains("Wheels (ADBE Lumetri-0047) is unreadable")), "{:?}", losses(&r));
+    assert_eq!(val(&g, "colorWheels/shadowsWheel"), Value::Color([0.5, 0.5, 0.5, 1.0]));
+}
+
+#[test]
+fn the_picked_hsl_key_becomes_hue_saturation_and_lightness_ranges() {
+    let (g, r) = run(&[(73, Rec::Data(hex(HSL_PICKED)))]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+    let close = |id: &str, want: f64| assert!((num(&g, id) - want).abs() < 0.01, "{id}: {} != {want}", num(&g, id));
+    // Hue centre 0.5605 of the circle, range 0.05, tolerance 0.1.
+    close("hslSecondary/key/hueCenter", 201.79);
+    close("hslSecondary/key/hueRange", 18.0);
+    close("hslSecondary/key/hueSoftness", 36.0);
+    // Lightness centre 0.435 +- 0.05, tolerance 0.1, as percent.
+    close("hslSecondary/key/lightnessLow", 38.53);
+    close("hslSecondary/key/lightnessHigh", 48.53);
+    close("hslSecondary/key/lightnessSoftness", 10.0);
+    assert_eq!(val(&g, "hslSecondary/key/hueEnabled"), Value::Bool(true));
+    // With the key picked the correction applies; without, After Effects applies it to nothing
+    // (1200 `-16-sec-correction` renders as `-00-defaults`): left out and reported.
+    let (g, _) = run(&[(73, Rec::Data(hex(HSL_PICKED))), (86, Rec::Num(19.0, 1))]);
+    assert_eq!(num(&g, "hslSecondary/correction/temperature"), 19.0);
+    let (g, r) = run(&[(86, Rec::Num(19.0, 1))]);
+    assert_eq!(num(&g, "hslSecondary/correction/temperature"), 0.0);
+    let l = losses(&r);
+    assert!(l.len() == 1 && l[0].contains("HSL Secondary has no key colour picked") && l[0].contains("Temperature 19"), "{l:?}");
+    // Damaged key data: reported, the default key kept.
+    let (g, r) = run(&[(73, Rec::Data(vec![7; 40]))]);
+    assert!(losses(&r).iter().any(|d| d.contains("HSL Secondary key data is unreadable")), "{:?}", losses(&r));
+    assert_eq!(num(&g, "hslSecondary/key/hueRange"), 180.0);
+}
+
+#[test]
+fn undecoded_data_and_controls_without_counterpart_are_reported_when_set() {
+    let mut split = vec![0u8; 32];
+    split[0] = 1;
+    let (_, r) = run(&[(32, Rec::Data(split)), (97, Rec::Num(1.0, 3)), (95, Rec::Data(utf16("my.cube")))]);
+    let l = losses(&r);
+    assert_eq!(l.len(), 3, "{l:?}");
+    assert!(l.iter().any(|d| d.contains("Split Toning (ADBE Lumetri-0032) is not imported")), "{l:?}");
+    assert!(l.iter().any(|d| d.contains("Legacy Tone And Saturation (ADBE Lumetri-0097) is on")), "{l:?}");
+    assert!(l.iter().any(|d| d.contains("the Input LUT 'my.cube' is not imported")), "{l:?}");
+}
+
+#[test]
+fn legacy_tone_on_is_reported_whatever_the_pard_default_says() {
+    // After the project is opened and saved again, the `pard` default of Legacy Tone And
+    // Saturation reads on (versions/1200-lumetri-26 / -25x / -24x; off in 1200 as the script
+    // saved it): a record that says on is still reported, a missing record is not.
+    let mut d = defs();
+    if let Some((_, Def::Check { default })) = d.iter_mut().find(|(s, _)| *s == 97) {
+        *default = true;
+    }
+    let (_, r) = run_with(&d, &[(97, Rec::Num(1.0, 3))]);
+    let l = losses(&r);
+    assert!(l.len() == 1 && l[0].contains("Legacy Tone And Saturation (ADBE Lumetri-0097) is on"), "{l:?}");
+    let (_, r) = run_with(&d, &[]);
+    assert_eq!(losses(&r), Vec::<String>::new());
+}
+
+#[test]
+fn an_unknown_scale_or_parameter_is_reported_not_guessed() {
+    let mut d = defs();
+    // Exposure with another valid range (an older or newer version): not guessed at.
+    if let Some((_, Def::Float { min, max, .. })) = d.iter_mut().find(|(s, _)| *s == 11) {
+        (*min, *max) = (-100.0, 100.0);
+    }
+    // A parameter this importer does not know, set.
+    d.push((200, Def::Float { name: "Future", default: 0.0, min: -1.0, max: 1.0 }));
+    let (g, r) = run_with(&d, &[(11, Rec::Num(3.0, 1)), (200, Rec::Num(0.5, 1))]);
+    assert_eq!(num(&g, "basicCorrection/tone/exposure"), 0.0);
+    let l = losses(&r);
+    assert!(l.iter().any(|x| x.contains("Exposure (ADBE Lumetri-0011) has the valid maximum Some(100.0), expected 7")), "{l:?}");
+    assert!(l.iter().any(|x| x.contains("Future (ADBE Lumetri-0200) not imported")), "{l:?}");
+}
diff --git a/crates/aep/tests/it/import/markers.rs b/crates/aep/tests/it/import/markers.rs
new file mode 100644
index 000000000..780b49c71
--- /dev/null
+++ b/crates/aep/tests/it/import/markers.rs
@@ -0,0 +1,96 @@
+//! Markers (122, 123, 249, 347-349, 509, 510) and Time Remapping (319, 354) import with the
+//! values the cases were made with.
+
+use crate::import::helpers::comp;
+use effectcraft_color::Label;
+use effectcraft_keyframe::{Interp, Value};
+use effectcraft_project::{Marker, Project};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+fn secs(s: f64) -> Tick {
+    Tick((s * TICKS_PER_SECOND as f64).round() as i64)
+}
+
+fn lossless(name: &str) -> Option<(Project, effectcraft_aep::import::ImportResult)> {
+    Some({
+        let mut p = Project::default();
+        let r = crate::import::helpers::try_import_fixture(&mut p, name, false)?.unwrap_or_else(|e| panic!("{name}: {e}"));
+        (p, r)
+    })
+}
+
+fn layer_markers(name: &str, layer: &str) -> Option<Vec<Marker>> {
+    Some({
+        let (p, r) = lossless(name)?;
+        let (_, c) = comp(&p, &r, "C");
+        c.layers.iter().find(|l| l.name == layer).expect("layer").markers.clone()
+    })
+}
+
+#[test]
+fn composition_markers() {
+    let (p, r) = skip!(lossless("122-marker-comp-1s.aep"));
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.markers.len(), 1);
+    assert_eq!((c.markers[0].time, c.markers[0].comment.as_str(), c.markers[0].duration), (secs(1.0), "CompMarker", Tick::ZERO));
+    assert_eq!(r.report.imported.markers, 1);
+
+    // Two markers, one with a label and one with a duration of 0.5 s (300 / 600).
+    let (p, r) = skip!(lossless("509-marker-comp-two.aep"));
+    let (_, c) = comp(&p, &r, "C");
+    let m: Vec<_> = c.markers.iter().map(|m| (m.time, m.comment.as_str(), m.duration, m.label)).collect();
+    assert_eq!(m, vec![(secs(1.0), "M1", Tick::ZERO, Label::Yellow), (secs(2.5), "M2", secs(0.5), Label::None)]);
+}
+
+#[test]
+fn layer_markers_with_every_field() {
+    let m = skip!(layer_markers("123-marker-layer-1s.aep", "L"));
+    assert_eq!((m.len(), m[0].time, m[0].comment.as_str()), (1, secs(1.0), "LayerMarker"));
+
+    let m = &skip!(layer_markers("249-marker-layer-full.aep", "L"))[0];
+    assert_eq!(
+        (m.time, m.duration, m.comment.as_str(), m.chapter.as_str(), m.url.as_str(), m.frame_target.as_str()),
+        (secs(1.0), secs(1.0), "LM", "Chap", "http://a.example/u", "_blank")
+    );
+    let cue = m.cue_point.as_ref().expect("cue point");
+    assert_eq!((cue.name.as_str(), cue.navigation, cue.params.len()), ("CueX", false, 0));
+    assert_eq!(m.label, Label::None);
+
+    assert_eq!(skip!(layer_markers("347-marker-layer-label3.aep", "L"))[0].label, Label::Aqua);
+    let n = &skip!(layer_markers("348-marker-layer-navigation-cue.aep", "L"))[0];
+    assert_eq!(n.cue_point.as_ref().map(|c| (c.name.as_str(), c.navigation)), Some(("CueN", true)));
+    let e = &skip!(layer_markers("349-marker-layer-event-cue-params.aep", "L"))[0];
+    let cue = e.cue_point.as_ref().expect("cue");
+    assert_eq!((cue.name.as_str(), cue.navigation), ("CueE", false));
+    assert_eq!(cue.params, vec![("speaker".to_string(), "A".to_string()), ("n".to_string(), "2".to_string())]);
+}
+
+#[test]
+fn a_marker_at_a_fractional_time_with_a_fractional_duration() {
+    // 0.52 s is 13 312 / 25 600 (frame 13); 0.3 s is 180 / 600.
+    let m = skip!(layer_markers("510-marker-layer-0.52-dur0.3.aep", "L"));
+    assert_eq!((m.len(), m[0].time, m[0].duration, m[0].comment.as_str()), (1, secs(0.52), secs(0.3), "LM"));
+}
+
+#[test]
+fn time_remapping_becomes_the_time_remap_property() {
+    for (name, layer, end) in [("319-precomp-timeremap.aep", "Pre", 5.0), ("354-footage-pngseq-timeremap.aep", "seq_001.png", 0.1)] {
+        let (p, r) = load!(name);
+        let (_, c) = comp(&p, &r, "C");
+        let l = c.layers.iter().find(|l| l.name == layer).unwrap_or_else(|| panic!("{name}: {:?}", c.layers.iter().map(|l| &l.name).collect::<Vec<_>>()));
+        let tr = l.props.get("timeRemap").unwrap_or_else(|| panic!("{name}: no timeRemap"));
+        let keys: Vec<_> = tr.keys.iter().map(|k| (k.time, k.value.clone(), k.in_interp, k.out_interp)).collect();
+        assert_eq!(
+            keys,
+            vec![(Tick::ZERO, Value::Scalar(0.0), Interp::Linear, Interp::Linear), (secs(end), Value::Scalar(end), Interp::Linear, Interp::Linear)],
+            "{name}"
+        );
+        assert_eq!(l.props.children.first().map(|n| n.match_id()), Some("timeRemap"), "{name}: first property");
+        assert_eq!(r.report.imported.time_remaps, 1, "{name}");
+        assert_eq!(r.report.count(effectcraft_aep::import::LossCategory::TimeRemapping), 0, "{name}");
+    }
+    // A layer without remapping gets no property.
+    let (p, r) = load!("000-base.aep");
+    let (_, c) = comp(&p, &r, "C");
+    assert!(c.layers[0].props.get("timeRemap").is_none());
+}
diff --git a/crates/aep/tests/it/import/masks.rs b/crates/aep/tests/it/import/masks.rs
new file mode 100644
index 000000000..d6ae92169
--- /dev/null
+++ b/crates/aep/tests/it/import/masks.rs
@@ -0,0 +1,285 @@
+//! Masks against the synthetic mask fixtures of `effectcraft-aep` (on the red 1920x1080 solid `L`
+//! of composition `C`, 25 fps, unless noted). Expected values are those the fixtures were made with
+//! (`MANIFEST.md` of the corpus; After Effects read the paths back as listed there).
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{LossCategory, analyze};
+use effectcraft_keyframe::{Ease, Interp, ShapePath, Value};
+use effectcraft_project::{GroupKind, Layer, MaskMode, PropGroup};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+/// Every mask fixture in the repository.
+const MASK_FIXTURES: [&str; 17] = [
+    "090-mask-rect.aep",
+    "091-mask-rect-props.aep",
+    "093-mask-path-2keys.aep",
+    "208-key-mask-feather-2key-linear.aep",
+    "232-mask-ellipse.aep",
+    "233-mask-open-path.aep",
+    "234-mask-mode-intersect.aep",
+    "235-mask-mode-lighten.aep",
+    "236-mask-mode-darken.aep",
+    "237-mask-mode-difference.aep",
+    "306-key-maskfeather-bezier-ease.aep",
+    "309-solid-100x100-mask-rect.aep",
+    "328-mask-two-ellipse-rect.aep",
+    "329-mask-ellipse-mode-none.aep",
+    "900-mask-added-no-path.aep",
+    "901-mask-no-path-expansion-m100.aep",
+    "000-base.aep",
+];
+
+/// The rectangle 800x400 at the composition centre (090), clockwise from the top left.
+const RECT: [[f64; 2]; 4] = [[560.0, 340.0], [1360.0, 340.0], [1360.0, 740.0], [560.0, 740.0]];
+
+fn layer_l(name: &str) -> Option<Layer> {
+    Some({
+        let (p, r) = crate::import::helpers::try_load(name)?;
+        let (_, c) = comp(&p, &r, "C");
+        c.layers.iter().find(|l| l.name == "L").unwrap_or_else(|| panic!("{name}: no layer L")).clone()
+    })
+}
+
+fn masks(l: &Layer) -> Vec<PropGroup> {
+    l.masks().expect("masks group").groups().cloned().collect()
+}
+
+fn kind(g: &PropGroup) -> (MaskMode, bool) {
+    match g.kind {
+        GroupKind::Mask { mode, inverted, .. } => (mode, inverted),
+        _ => panic!("{} is not a mask", g.name),
+    }
+}
+
+fn path(g: &PropGroup) -> ShapePath {
+    match &g.get("path").expect("path").value {
+        Value::Path(p) => p.clone(),
+        other => panic!("{other:?}"),
+    }
+}
+
+fn near(a: [f64; 2], b: [f64; 2], tol: f64) {
+    assert!((a[0] - b[0]).abs() < tol && (a[1] - b[1]).abs() < tol, "{a:?} != {b:?}");
+}
+
+/// Vertices within float32 noise, no tangents.
+fn assert_polygon(p: &ShapePath, expected: &[[f64; 2]]) {
+    assert_eq!(p.len(), expected.len());
+    for (v, e) in p.vertices.iter().zip(expected) {
+        near(*v, *e, 1e-3);
+    }
+    for t in p.in_tangents.iter().chain(&p.out_tangents) {
+        near(*t, [0.0, 0.0], 1e-3);
+    }
+}
+
+fn scalar(g: &PropGroup, id: &str) -> f64 {
+    match g.get(id).expect(id).value {
+        Value::Scalar(v) => v,
+        ref other => panic!("{other:?}"),
+    }
+}
+
+fn vec2(v: &Value) -> [f64; 2] {
+    match v {
+        Value::Vec2(v) => *v,
+        other => panic!("{other:?}"),
+    }
+}
+
+fn secs(s: f64) -> Tick {
+    Tick((s * TICKS_PER_SECOND as f64).round() as i64)
+}
+
+#[test]
+fn every_mask_fixture_imports_without_losses() {
+    for name in MASK_FIXTURES {
+        let (p, r) = load!(name);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        let (_, c) = comp(&p, &r, "C");
+        let n: usize = c.layers.iter().map(|l| l.masks().map_or(0, |m| m.groups().count())).sum();
+        assert_eq!(r.report.imported.masks, n, "{name}");
+        let expected = match name {
+            "000-base.aep" => 0,
+            "328-mask-two-ellipse-rect.aep" => 2,
+            _ => 1,
+        };
+        assert_eq!(n, expected, "{name}");
+    }
+}
+
+#[test]
+fn rectangle_with_defaults_090() {
+    let l = skip!(layer_l("090-mask-rect.aep"));
+    let m = masks(&l);
+    assert_eq!(m.len(), 1);
+    assert_eq!(m[0].name, "Mask 1");
+    assert_eq!(kind(&m[0]), (MaskMode::Add, false));
+    let p = path(&m[0]);
+    assert!(p.closed);
+    assert_polygon(&p, &RECT);
+    assert_eq!(vec2(&m[0].get("feather").unwrap().value), [0.0, 0.0]);
+    assert_eq!(scalar(&m[0], "opacity"), 100.0);
+    assert_eq!(scalar(&m[0], "expansion"), 0.0);
+    assert!(m[0].get("path").unwrap().keys.is_empty());
+}
+
+/// A mask whose path was never set stores no Mask Path entry (900); After Effects reads it back as
+/// the source rectangle `[0,0] [0,1080] [1920,1080] [1920,0]` and renders it so (901: expansion
+/// -100 leaves a 100 px border).
+#[test]
+fn a_mask_without_a_stored_path_is_the_source_rectangle_900_901() {
+    for (name, expansion) in [("900-mask-added-no-path.aep", 0.0), ("901-mask-no-path-expansion-m100.aep", -100.0)] {
+        let m = masks(&skip!(layer_l(name)));
+        assert_eq!(m.len(), 1, "{name}");
+        assert_eq!(kind(&m[0]), (MaskMode::Add, false), "{name}");
+        let p = path(&m[0]);
+        assert!(p.closed, "{name}");
+        assert_eq!(p.vertices, [[0.0, 0.0], [0.0, 1080.0], [1920.0, 1080.0], [1920.0, 0.0]], "{name}");
+        assert!(p.in_tangents.iter().chain(&p.out_tangents).all(|t| *t == [0.0, 0.0]), "{name}");
+        assert_eq!(scalar(&m[0], "expansion"), expansion, "{name}");
+        assert_eq!(scalar(&m[0], "opacity"), 100.0, "{name}");
+    }
+}
+
+#[test]
+fn feather_opacity_expansion_mode_and_invert_091() {
+    let m = masks(&skip!(layer_l("091-mask-rect-props.aep")));
+    assert_eq!(kind(&m[0]), (MaskMode::Subtract, true));
+    assert_eq!(vec2(&m[0].get("feather").unwrap().value), [20.0, 20.0]);
+    assert_eq!(scalar(&m[0], "opacity"), 50.0);
+    assert_eq!(scalar(&m[0], "expansion"), 5.0);
+    assert_polygon(&path(&m[0]), &RECT);
+}
+
+#[test]
+fn animated_path_093() {
+    let m = masks(&skip!(layer_l("093-mask-path-2keys.aep")));
+    let prop = m[0].get("path").unwrap();
+    assert_eq!(prop.keys.len(), 2);
+    assert_eq!((prop.keys[0].time, prop.keys[1].time), (Tick::ZERO, secs(1.0)));
+    for k in &prop.keys {
+        assert_eq!((k.in_interp, k.out_interp), (Interp::Linear, Interp::Linear));
+    }
+    let shape = |i: usize| match &prop.keys[i].value {
+        Value::Path(p) => p.clone(),
+        other => panic!("{other:?}"),
+    };
+    assert_polygon(&shape(0), &[[760.0, 440.0], [1160.0, 440.0], [1160.0, 640.0], [760.0, 640.0]]);
+    assert_polygon(&shape(1), &RECT);
+    // The static value is the first key's.
+    assert_eq!(prop.value, prop.keys[0].value);
+}
+
+#[test]
+fn feather_keys_linear_208() {
+    let m = masks(&skip!(layer_l("208-key-mask-feather-2key-linear.aep")));
+    assert_eq!(kind(&m[0]), (MaskMode::Add, false));
+    let f = m[0].get("feather").unwrap();
+    assert_eq!(f.keys.len(), 2);
+    assert_eq!((f.keys[0].time, f.keys[1].time), (Tick::ZERO, secs(1.0)));
+    assert_eq!(vec2(&f.keys[0].value), [0.0, 0.0]);
+    assert_eq!(vec2(&f.keys[1].value), [40.0, 20.0]);
+    for k in &f.keys {
+        assert_eq!((k.in_interp, k.out_interp), (Interp::Linear, Interp::Linear));
+    }
+    assert_polygon(&path(&m[0]), &RECT);
+}
+
+#[test]
+fn feather_keys_bezier_ease_306() {
+    let m = masks(&skip!(layer_l("306-key-maskfeather-bezier-ease.aep")));
+    let f = m[0].get("feather").unwrap();
+    assert_eq!(f.keys.len(), 2);
+    assert_eq!((f.keys[0].time, f.keys[1].time), (Tick::ZERO, secs(2.0)));
+    assert_eq!(vec2(&f.keys[1].value), [50.0, 30.0]);
+    let (k1, k2) = (&f.keys[0], &f.keys[1]);
+    assert_eq!((k1.out_interp, k2.in_interp), (Interp::Bezier, Interp::Bezier));
+    // Speed in pixels per second, influence a fraction, one ease per dimension. The first key's
+    // incoming and the last key's outgoing ease mean nothing and are dropped.
+    let check = |eases: &[Ease], speed: f64, influence: f64| {
+        assert_eq!(eases.len(), 2);
+        for e in eases {
+            assert!((e.speed - speed).abs() < 1e-9 && (e.influence - influence).abs() < 1e-9, "{e:?}");
+        }
+    };
+    check(&k1.out_ease, 15.0, 0.66);
+    check(&k2.in_ease, 8.0, 0.66);
+    assert!(k1.in_ease.is_empty() && k2.out_ease.is_empty());
+}
+
+#[test]
+fn ellipse_tangents_232() {
+    let m = masks(&skip!(layer_l("232-mask-ellipse.aep")));
+    let p = path(&m[0]);
+    assert!(p.closed);
+    // After Effects read the path back as vertices [960,340],[1360,540],[960,740],[560,540] and
+    // tangents of 0.5523 times the radius: the same as an EffectCraft ellipse.
+    let e = ShapePath::ellipse([960.0, 540.0], 800.0, 400.0);
+    assert_eq!(p.len(), 4);
+    for i in 0..4 {
+        near(p.vertices[i], e.vertices[i], 1e-3);
+        near(p.in_tangents[i], e.in_tangents[i], 1e-2);
+        near(p.out_tangents[i], e.out_tangents[i], 1e-2);
+    }
+    near(p.in_tangents[0], [-220.913879394531, 0.0], 1e-3);
+    near(p.out_tangents[1], [0.0, 110.456970214844], 1e-3);
+}
+
+#[test]
+fn open_path_233() {
+    let p = path(&masks(&skip!(layer_l("233-mask-open-path.aep")))[0]);
+    assert!(!p.closed);
+    assert_polygon(&p, &[[500.0, 300.0], [960.0, 700.0], [1400.0, 300.0]]);
+}
+
+#[test]
+fn every_mode_234_to_237_and_329() {
+    for (name, want) in [
+        ("090-mask-rect.aep", MaskMode::Add),
+        ("234-mask-mode-intersect.aep", MaskMode::Intersect),
+        ("235-mask-mode-lighten.aep", MaskMode::Lighten),
+        ("236-mask-mode-darken.aep", MaskMode::Darken),
+        ("237-mask-mode-difference.aep", MaskMode::Difference),
+        ("329-mask-ellipse-mode-none.aep", MaskMode::None),
+    ] {
+        let m = masks(&skip!(layer_l(name)));
+        assert_eq!(kind(&m[0]), (want, false), "{name}");
+    }
+}
+
+#[test]
+fn vertices_are_in_layer_pixels_309() {
+    // A 60x40 rectangle centred on a 100x100 solid: the stored box is normalised to the layer size,
+    // so the vertices are layer pixels, not composition pixels.
+    let (p, r) = load!("309-solid-100x100-mask-rect.aep");
+    let (_, c) = comp(&p, &r, "C");
+    let l = c.layers.iter().find(|l| !masks(l).is_empty()).expect("a layer with a mask");
+    assert_polygon(&path(&masks(l)[0]), &[[20.0, 30.0], [80.0, 30.0], [80.0, 70.0], [20.0, 70.0]]);
+}
+
+#[test]
+fn two_masks_in_stack_order_328() {
+    let m = masks(&skip!(layer_l("328-mask-two-ellipse-rect.aep")));
+    assert_eq!(m.len(), 2);
+    assert_eq!((m[0].name.as_str(), m[1].name.as_str()), ("Mask 1", "Mask 2"));
+    assert_eq!((kind(&m[0]), kind(&m[1])), ((MaskMode::Add, false), (MaskMode::Add, false)));
+    assert_eq!(path(&m[0]).len(), 4);
+    near(path(&m[0]).vertices[0], [960.0, 340.0], 1e-3);
+    assert_polygon(&path(&m[1]), &[[500.0, 350.0], [900.0, 350.0], [900.0, 650.0], [500.0, 650.0]]);
+    // Distinct ids and the default colour cycle.
+    assert_ne!(m[0].uid, m[1].uid);
+    let color = |g: &PropGroup| match g.kind {
+        GroupKind::Mask { color, .. } => color,
+        _ => [0; 3],
+    };
+    assert_ne!(color(&m[0]), color(&m[1]));
+}
+
+#[test]
+fn the_dry_run_counts_masks_and_lists_the_mask_limitations() {
+    let report = analyze(&fixture!("091-mask-rect-props.aep"), &|_| false).unwrap();
+    assert_eq!(report.count(LossCategory::Masks), 0);
+    assert_eq!(report.imported.masks, 1);
+    assert!(report.limitations.iter().any(|l| l.contains("feather falloff")));
+}
diff --git a/crates/aep/tests/it/import/mattes.rs b/crates/aep/tests/it/import/mattes.rs
new file mode 100644
index 000000000..2445e4227
--- /dev/null
+++ b/crates/aep/tests/it/import/mattes.rs
@@ -0,0 +1,105 @@
+//! Track mattes (cases 403-408): every matte fixture imports without losses with the mode and the
+//! matte layer it was made with.
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{ImportOptions, LossCategory, import};
+use effectcraft_project::{MatteKind, Project};
+
+/// The layers of comp `C` as `(name, video switch, matte layer name, matte kind)`, top first.
+fn mattes(project: &Project, r: &effectcraft_aep::import::ImportResult) -> Vec<(String, bool, Option<(String, MatteKind)>)> {
+    let (_, c) = comp(project, r, "C");
+    c.layers
+        .iter()
+        .map(|l| {
+            let m = l.track_matte.map(|tm| (c.layer(tm.layer).map(|x| x.name.clone()).unwrap_or_default(), tm.kind));
+            (l.name.clone(), l.switches.video, m)
+        })
+        .collect()
+}
+
+#[test]
+fn the_four_modes_import_with_their_matte_layer() {
+    for (case, kind) in [
+        ("403-matte-L-alpha-M.aep", MatteKind::Alpha),
+        ("404-matte-L-alphainv-M.aep", MatteKind::AlphaInverted),
+        ("405-matte-L-luma-M.aep", MatteKind::Luma),
+        ("406-matte-L-lumainv-M.aep", MatteKind::LumaInverted),
+    ] {
+        let mut p = Project::default();
+        let r = try_import!(&mut p, case, false).unwrap_or_else(|e| panic!("{case}: lossless import refused: {e}"));
+        assert_eq!(r.report.imported.track_mattes, 1, "{case}");
+        let l = mattes(&p, &r);
+        assert_eq!(l[0], ("M".to_string(), false, None), "{case}: the matte layer is hidden, as stored");
+        assert_eq!(l[1], ("L".to_string(), true, Some(("M".to_string(), kind))), "{case}");
+    }
+}
+
+#[test]
+fn a_matte_below_its_target_and_a_visible_matte() {
+    let (p, r) = load!("407-matte-M-alpha-L-below.aep");
+    assert!(r.report.is_lossless());
+    let l = mattes(&p, &r);
+    assert_eq!(l[0], ("M".to_string(), true, Some(("L".to_string(), MatteKind::Alpha))));
+    assert_eq!(l[1], ("L".to_string(), false, None));
+
+    let (p, r) = load!("408-matte-L-alpha-M-visible.aep");
+    assert!(r.report.is_lossless());
+    let l = mattes(&p, &r);
+    assert!(l[0].1, "M stays visible");
+    assert_eq!(l[1].2, Some(("M".to_string(), MatteKind::Alpha)));
+}
+
+/// Offset of the `u32` matte layer id (`ldta` byte 160) of the layer with this id.
+fn matte_id_offset(bytes: &[u8], layer_id: u32) -> usize {
+    let mut needle = b"ldta".to_vec();
+    needle.extend_from_slice(&164u32.to_be_bytes());
+    needle.extend_from_slice(&layer_id.to_be_bytes());
+    let at = bytes.windows(needle.len()).position(|w| w == needle.as_slice()).expect("ldta of the layer");
+    at + 8 + 160
+}
+
+fn import_patched(bytes: &[u8]) -> (Project, effectcraft_aep::import::ImportResult) {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("imports");
+    (project, r)
+}
+
+/// A matte mode without a matte layer id (built in-test from 403; After Effects 2026 always writes
+/// the id): the layer directly above is the matte, as in After Effects before 23.0.
+#[test]
+fn a_matte_without_a_layer_id_uses_the_layer_above() {
+    // The layer ids (top first: M, L; 0x1d and 0x1b in the single-case files).
+    let ids = skip!(crate::import::helpers::comp_ids("403-matte-L-alpha-M.aep"));
+    let mut bytes = fixture!("403-matte-L-alpha-M.aep");
+    let at = matte_id_offset(&bytes, ids[0].2[1]);
+    bytes[at..at + 4].copy_from_slice(&0u32.to_be_bytes());
+    let (p, r) = import_patched(&bytes);
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(mattes(&p, &r)[1].2, Some(("M".to_string(), MatteKind::Alpha)));
+
+    // On the top layer there is no layer above: reported.
+    let ids = skip!(crate::import::helpers::comp_ids("407-matte-M-alpha-L-below.aep"));
+    let mut bytes = fixture!("407-matte-M-alpha-L-below.aep");
+    let at = matte_id_offset(&bytes, ids[0].2[0]);
+    bytes[at..at + 4].copy_from_slice(&0u32.to_be_bytes());
+    let (p, r) = import_patched(&bytes);
+    assert_eq!(r.report.count(LossCategory::TrackMattes), 1);
+    assert_eq!(mattes(&p, &r)[0].2, None);
+}
+
+#[test]
+fn hostile_matte_fields_are_reported() {
+    // A matte layer that does not exist, the layer itself (L), and an unknown mode (with M).
+    let ids = skip!(crate::import::helpers::comp_ids("403-matte-L-alpha-M.aep"));
+    let (m, l) = (ids[0].2[0], ids[0].2[1]);
+    for (id, mode) in [(0x7fff_u32, 1u8), (l, 1), (m, 9)] {
+        let mut bytes = fixture!("403-matte-L-alpha-M.aep");
+        let at = matte_id_offset(&bytes, l);
+        bytes[at..at + 4].copy_from_slice(&id.to_be_bytes());
+        bytes[at - 160 + 107] = mode;
+        let (p, r) = import_patched(&bytes);
+        assert_eq!(r.report.count(LossCategory::TrackMattes), 1, "id {id:#x} mode {mode}");
+        assert_eq!(mattes(&p, &r)[1].2, None);
+    }
+}
diff --git a/crates/aep/tests/it/import/puppet.rs b/crates/aep/tests/it/import/puppet.rs
new file mode 100644
index 000000000..a3054286e
--- /dev/null
+++ b/crates/aep/tests/it/import/puppet.rs
@@ -0,0 +1,171 @@
+//! After Effects' Puppet (`ADBE FreePin3`, #3093) arrives as EffectCraft's Puppet
+//! (`ec.distort.puppet`) in its place in the stack, and what its meshes and pins hold is reported
+//! mesh by mesh instead of the one line "has the effect 'Puppet'". The effect is built into the
+//! committed `synthetic.aep` in place of its Glow (`fx_inject`, in memory), in the tree
+//! docs/aep-format.md 3.7 gives for Puppet. That tree comes from an external scripting listing,
+//! not a byte sample: these tests prove the reader's walk and its report, not the format.
+
+use effectcraft_aep::Chunk;
+use effectcraft_aep::import::{ImportOptions, LossCategory, import};
+use effectcraft_project::Project;
+
+use crate::import::fx_inject::{bytes_with_effect, import_bytes, keyed_record, losses, nested, record, tdmn, utf8};
+
+const SYNTHETIC: &[u8] = include_bytes!("../../fixtures/synthetic.aep");
+const PUPPET: &str = "ADBE FreePin3";
+const POS_ATOM: &str = "ADBE FreePin3 PosPin Atom";
+
+fn tdsb(v: u32) -> Chunk<'static> {
+    Chunk::data(*b"tdsb", v.to_be_bytes().to_vec())
+}
+
+/// A property group of `entries` (match name, node).
+fn group(entries: Vec<(&str, Chunk<'static>)>) -> Chunk<'static> {
+    let mut kids = vec![tdsb(1)];
+    for (name, node) in entries {
+        kids.push(tdmn(name));
+        kids.push(node);
+    }
+    Chunk::list(*b"tdgp", kids)
+}
+
+/// A pin atom with its hidden vertex records and Position (keyed when `keys`). The values are
+/// one-component records: the reader only asks whether a pin is keyed.
+fn pin(t: &Chunk<'_>, atom: &'static str, keys: bool) -> (&'static str, Chunk<'static>) {
+    let position = if keys { keyed_record(t, &[(0, 1.0), (25_600, 2.0)]) } else { record(t, 1.0) };
+    (
+        atom,
+        group(vec![
+            ("ADBE FreePin3 PosPin Vtx Offset", record(t, 0.0)),
+            ("ADBE FreePin3 PosPin Vtx Index", record(t, 7.0)),
+            ("ADBE FreePin3 PosPin Position", position),
+        ]),
+    )
+}
+
+/// `Mesh 1`: Triangles 500, Expansion 5, four Deform pins (one keyed, one with an atom name
+/// nobody knows) and a property among them, no Overlap pin, one Stiffness pin, and a group
+/// nobody knows.
+fn full_mesh(t: &Chunk<'_>) -> Chunk<'static> {
+    let mesh_data =
+        Chunk::list(*b"tdbs", vec![tdsb(1), Chunk::data(*b"cdat", vec![0u8; 4]), Chunk::list(*b"aRbs", vec![Chunk::data(*b"aRbp", vec![1, 2, 3, 4])])]);
+    let deform = group(vec![
+        pin(t, POS_ATOM, false),
+        pin(t, POS_ATOM, true),
+        pin(t, POS_ATOM, false),
+        pin(t, "ADBE FreePin3 Test Atom", false),
+        ("ADBE FreePin3 Test Prop", record(t, 3.0)),
+    ]);
+    let starch = group(vec![("ADBE FreePin3 StarchPin Atom", group(vec![("ADBE FreePin3 StarchPin Amount", record(t, 0.5))]))]);
+    group(vec![
+        ("ADBE FreePin3 Mesh", mesh_data),
+        ("ADBE FreePin3 Mesh Tri Count", record(t, 500.0)),
+        ("ADBE FreePin3 Mesh Expansion", record(t, 5.0)),
+        ("ADBE FreePin3 PosPins", deform),
+        ("ADBE FreePin3 HghtPins", group(vec![])),
+        ("ADBE FreePin3 StarchPins", starch),
+        ("ADBE FreePin3 Test Group", group(vec![])),
+    ])
+}
+
+/// The Puppet instance: `fx_switch` is the value group's `tdsb`, `arap` its mesh tree (`None`:
+/// none), `extra` more entries of its value group.
+fn sspc(fx_switch: u32, arap: Option<Chunk<'static>>, extra: Vec<(&str, Chunk<'static>)>) -> Chunk<'static> {
+    let pard = |kind: u8| {
+        let mut b = vec![0u8; 148];
+        b[15] = kind;
+        Chunk::data(*b"pard", b)
+    };
+    let part = vec![Chunk::data(*b"parn", 2u32.to_be_bytes().to_vec()), tdmn("ADBE FreePin3-0000"), pard(0), tdmn("ADBE Effect Built In Params"), pard(9)];
+    let mut values = vec![tdsb(fx_switch)];
+    if let Some(arap) = arap {
+        values.push(tdmn("ADBE FreePin3 ARAP Group"));
+        values.push(arap);
+    }
+    for (name, node) in extra {
+        values.push(tdmn(name));
+        values.push(node);
+    }
+    Chunk::list(*b"sspc", vec![nested(*b"fnam", vec![utf8("Puppet")]), Chunk::list(*b"parT", part), Chunk::list(*b"tdgp", values)])
+}
+
+/// The layer that holds `effect`, the effect's place in that layer's stack and the stack's size.
+fn stack_place(bytes: &[u8], effect: &str) -> Option<(String, usize, usize)> {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    import(&mut project, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    project.comps().flat_map(|(_, c)| c.layers.iter()).find_map(|l| {
+        let fx: Vec<_> = l.props.sub("effects")?.children.iter().filter_map(|n| n.as_group()).collect();
+        let at = fx.iter().position(|g| g.match_id == effect)?;
+        Some((l.name.clone(), at, fx.len()))
+    })
+}
+
+#[test]
+fn puppet_arrives_and_its_pins_are_reported_mesh_by_mesh() {
+    let bytes = bytes_with_effect(PUPPET, |t| {
+        let arap = group(vec![("ADBE FreePin3 Outlines", group(vec![])), ("ADBE FreePin3 Mesh Group", group(vec![("ADBE FreePin3 Mesh Atom", full_mesh(t))]))]);
+        sspc(1, Some(arap), vec![("ADBE FreePin3 On Transparent", record(t, 1.0))])
+    });
+    let (g, r) = import_bytes(&bytes, effectcraft_effects::puppet::ID);
+    let g = g.expect("an EffectCraft Puppet in the Glow's place");
+    assert!(g.enabled);
+    assert_eq!(g.name, "Puppet");
+    // No pin is made up: the rest places are not decoded.
+    assert_eq!(effectcraft_effects::puppet::pin_count(&g), 0);
+    // In the Glow's place in its layer's stack (the second of two effects there).
+    assert!(stack_place(SYNTHETIC, "ec.stylize.glow").is_some_and(|(_, at, n)| at > 0 && n > 1));
+    assert_eq!(stack_place(&bytes, effectcraft_effects::puppet::ID), stack_place(SYNTHETIC, "ec.stylize.glow"));
+    let l = losses(&r, LossCategory::Effects, PUPPET);
+    assert_eq!(l.len(), 2, "{l:#?}");
+    assert!(!l.iter().any(|d| d.contains("has the effect")), "not the old one-line report: {l:#?}");
+    assert!(l.iter().any(|d| d.ends_with("property ADBE FreePin3 On Transparent (1) not imported")), "{l:#?}");
+    let mesh = l.iter().find(|d| d.contains("imported without its meshes and pins")).expect("the mesh report");
+    assert!(
+        mesh.ends_with(
+            ": Mesh 1 (Triangles 500, Expansion 5): Deform 4 pins (1 keyed) [ADBE FreePin3 PosPin Atom, ADBE FreePin3 Test Atom], \
+             Overlap no pins, Stiffness 1 pin (0 keyed) [ADBE FreePin3 StarchPin Atom]; not recognised: ADBE FreePin3 Test Prop, ADBE FreePin3 Test Group"
+        ),
+        "{mesh}"
+    );
+    assert_eq!(losses(&r, LossCategory::DamagedData, PUPPET), Vec::<String>::new());
+}
+
+#[test]
+fn many_meshes_are_listed_up_to_ten_and_names_once() {
+    let bytes = bytes_with_effect(PUPPET, |_| {
+        let mesh = || group(vec![("ADBE FreePin3 Test Group", group(vec![]))]);
+        let meshes = (0..12).map(|_| ("ADBE FreePin3 Mesh Atom", mesh())).collect();
+        sspc(1, Some(group(vec![("ADBE FreePin3 Mesh Group", group(meshes))])), vec![])
+    });
+    let (_, r) = import_bytes(&bytes, effectcraft_effects::puppet::ID);
+    let l = losses(&r, LossCategory::Effects, PUPPET);
+    assert_eq!(l.len(), 1, "{l:#?}");
+    assert!(l[0].ends_with("Mesh 9: no pin groups; Mesh 10: no pin groups; and 2 more; not recognised: ADBE FreePin3 Test Group"), "{}", l[0]);
+}
+
+#[test]
+fn a_puppet_without_a_mesh_loses_nothing_and_keeps_its_fx_switch() {
+    let bytes = bytes_with_effect(PUPPET, |_| sspc(0, Some(group(vec![("ADBE FreePin3 Mesh Group", group(vec![]))])), vec![]));
+    let (g, r) = import_bytes(&bytes, effectcraft_effects::puppet::ID);
+    let g = g.expect("an EffectCraft Puppet");
+    assert!(!g.enabled, "switched off in the Effect Controls");
+    assert_eq!(losses(&r, LossCategory::Effects, PUPPET), Vec::<String>::new());
+}
+
+#[test]
+fn a_puppet_whose_mesh_tree_is_not_found_is_reported() {
+    let bytes = bytes_with_effect(PUPPET, |t| sspc(1, None, vec![("ADBE FreePin3 Other Group", group(vec![("x", record(t, 1.0))]))]));
+    let (g, r) = import_bytes(&bytes, effectcraft_effects::puppet::ID);
+    assert!(g.is_some(), "the effect still arrives");
+    let l = losses(&r, LossCategory::Effects, PUPPET);
+    assert_eq!(l.len(), 1, "{l:#?}");
+    assert!(
+        l[0].ends_with(
+            "imported without meshes or pins: its mesh group (ADBE FreePin3 ARAP Group / ADBE FreePin3 Mesh Group) was not found or is not a group; \
+             not recognised: ADBE FreePin3 Other Group"
+        ),
+        "{}",
+        l[0]
+    );
+}
diff --git a/crates/aep/tests/it/import/resaved_defaults.rs b/crates/aep/tests/it/import/resaved_defaults.rs
new file mode 100644
index 000000000..03ea5fb0f
--- /dev/null
+++ b/crates/aep/tests/it/import/resaved_defaults.rs
@@ -0,0 +1,74 @@
+//! Parameter defaults in the form After Effects writes when it saves a project it opened (the
+//! re-saves of read-back tests e1 and e2): point defaults in percent of the layer instead of
+//! fractions, and a popup default slot of 0. Simulated by patching our own fixtures.
+
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{ItemKind, Project, PropGroup};
+
+/// Rewrites `pard@56..` of every parameter definition named `name` (the 32-byte name at @16).
+fn patch_default(bytes: &mut [u8], name: &str, value: &[u8]) -> usize {
+    let mut n = 0;
+    let pat = name.as_bytes();
+    let mut i = 0;
+    while i + pat.len() < bytes.len() {
+        if &bytes[i..i + pat.len()] == pat && i >= 16 && bytes[i + pat.len()] == 0 && &bytes[i - 24..i - 20] == b"pard" {
+            let at = i - 16 + 56;
+            bytes[at..at + value.len()].copy_from_slice(value);
+            n += 1;
+        }
+        i += 1;
+    }
+    n
+}
+
+fn effects(bytes: &[u8]) -> (Vec<PropGroup>, String) {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut p, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+    let mut out = Vec::new();
+    for item in p.items.values() {
+        if let ItemKind::Comp(c) = &item.kind {
+            for l in &c.layers {
+                if let Some(fx) = l.effects() {
+                    out.extend(fx.groups().cloned());
+                }
+            }
+        }
+    }
+    (out, format!("{:?}", r.report.losses))
+}
+
+fn fixed(v: f64) -> [u8; 4] {
+    ((v * 65536.0) as i32).to_be_bytes()
+}
+
+#[test]
+fn point_defaults_in_percent_are_read_as_fractions() {
+    // 368: Gradient Ramp at its defaults on a 1920 x 1080 layer; the re-saved form stores Start
+    // 50 / 0 and End 50 / 100.
+    let mut bytes = fixture!("368-fx-ramp-default.aep");
+    let start = [fixed(50.0), fixed(0.0)].concat();
+    let end = [fixed(50.0), fixed(100.0)].concat();
+    assert!(patch_default(&mut bytes, "Start of Ramp", &start) >= 1);
+    assert!(patch_default(&mut bytes, "End of Ramp", &end) >= 1);
+    let (fx, losses) = effects(&bytes);
+    assert_eq!(fx[0].prop("start").unwrap().value, Value::Vec2([960.0, 0.0]), "{losses}");
+    assert_eq!(fx[0].prop("end").unwrap().value, Value::Vec2([960.0, 1080.0]));
+    // The fraction form of the fresh instance still reads the same.
+    let (fx, _) = effects(&fixture!("368-fx-ramp-default.aep"));
+    assert_eq!(fx[0].prop("end").unwrap().value, Value::Vec2([960.0, 1080.0]));
+}
+
+#[test]
+fn a_popup_default_slot_of_zero_is_the_fresh_default() {
+    // 712: Luma Key at its defaults (Key Out Darker); the re-saved form leaves 0 in the slot.
+    let mut bytes = fixture!("712-fx-eleven-effects-defaults-on-M.aep");
+    assert!(patch_default(&mut bytes, "Key Type", &0u32.to_be_bytes()) >= 1);
+    let (fx, losses) = effects(&bytes);
+    let luma = fx.iter().find(|g| g.match_id == "ec.key.luma").expect("luma key");
+    let (fresh, _) = effects(&fixture!("712-fx-eleven-effects-defaults-on-M.aep"));
+    let want = fresh.iter().find(|g| g.match_id == "ec.key.luma").unwrap().prop("keyType").unwrap().value.clone();
+    assert_eq!(luma.prop("keyType").unwrap().value, want);
+    assert!(!losses.contains("Key Type"), "{losses}");
+}
diff --git a/crates/aep/tests/it/import/robustness.rs b/crates/aep/tests/it/import/robustness.rs
new file mode 100644
index 000000000..902c9cc4b
--- /dev/null
+++ b/crates/aep/tests/it/import/robustness.rs
@@ -0,0 +1,813 @@
+//! Damaged and hostile files produce an error or a report, never a panic.
+
+use effectcraft_aep::import::LossCategory;
+use effectcraft_aep::import::{AepImportError, ImportOptions, import};
+use effectcraft_aep::{AepFile, Body, Chunk, parse, write};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{ItemKind, Project};
+
+fn fixtures() -> Option<Vec<String>> {
+    let names = crate::common::names("aep")?;
+    assert!(names.len() > 100, "{} fixtures", names.len());
+    Some(names)
+}
+
+/// Imports with and without allowing losses; both must return, and a result must be sane.
+fn try_all(bytes: &[u8]) -> bool {
+    let none = |_: &str| false;
+    let mut ok = false;
+    for allow in [false, true] {
+        let mut project = Project::default();
+        let opts = ImportOptions { allow_losses: allow, ..ImportOptions::new(&none) };
+        match import(&mut project, bytes, &opts) {
+            Ok(r) => {
+                ok = true;
+                check_sane(&project, r.comps.len());
+            }
+            Err(AepImportError::Refused(report)) => assert!(!report.is_lossless()),
+            Err(_) => assert!(project.items.is_empty()),
+        }
+    }
+    ok
+}
+
+/// What a consumer relies on: the project serialises, keyframes are in time order, parents exist.
+fn check_sane(project: &Project, comps: usize) {
+    serde_json::to_string(project).expect("a project that serialises");
+    let mut seen = 0;
+    for item in project.items.values() {
+        if let ItemKind::Comp(c) = &item.kind {
+            seen += 1;
+            for l in &c.layers {
+                if let Some(parent) = l.parent {
+                    assert!(c.layer(parent).is_some());
+                    assert_ne!(parent, l.id);
+                }
+                assert!(l.in_point <= l.out_point);
+                // Effect parameters: finite values and keys in time order.
+                for fx in l.props.sub("effects").into_iter().flat_map(|g| g.groups()) {
+                    for p in fx.props() {
+                        assert!(p.value.components().iter().all(|v| v.is_finite()), "{}: {:?}", p.match_id, p.value);
+                        assert!(p.keys.windows(2).all(|w| w[0].time < w[1].time));
+                        assert!(p.keys.iter().all(|k| k.value.components().iter().all(|v| v.is_finite())));
+                    }
+                }
+                for path in ["transform/anchor", "transform/position", "transform/scale", "transform/rotation", "transform/opacity"] {
+                    if let Some(p) = l.props.prop(path) {
+                        assert!(p.keys.windows(2).all(|w| w[0].time < w[1].time));
+                        assert!(p.value.components().iter().all(|v| v.is_finite()), "{path}: {:?}", p.value);
+                        for k in &p.keys {
+                            assert!(k.value.components().iter().all(|v| v.is_finite()));
+                        }
+                    }
+                }
+                check_masks(l);
+                if let Some(Value::Text(t)) = l.props.prop("text/sourceText").map(|p| &p.value) {
+                    // Runs cover the text; sizes, colours, leading and the box are usable.
+                    assert_eq!(t.runs().iter().map(|r| r.len).sum::<usize>(), t.char_len());
+                    assert!(t.runs().iter().all(|r| r.style.size.is_finite() && r.style.size > 0.0 && r.style.fill.iter().all(|c| c.is_finite())));
+                    assert!(t.leading.is_none_or(f64::is_finite) && t.tracking.is_finite());
+                    assert!(t.box_size.is_none_or(|b| b.iter().all(|v| v.is_finite() && *v >= 1.0)));
+                }
+            }
+        }
+    }
+    assert!(seen >= comps);
+}
+
+/// Imported masks: finite paths with matching tangent lists, sorted keys, valid feather and opacity.
+fn check_masks(l: &effectcraft_project::Layer) {
+    let Some(masks) = l.masks() else { return };
+    let path_ok = |v: &Value| match v {
+        Value::Path(p) => {
+            !p.vertices.is_empty()
+                && p.in_tangents.len() == p.vertices.len()
+                && p.out_tangents.len() == p.vertices.len()
+                && p.vertices.iter().chain(&p.in_tangents).chain(&p.out_tangents).flatten().all(|c| c.is_finite())
+        }
+        _ => false,
+    };
+    for g in masks.groups() {
+        assert!(matches!(g.kind, effectcraft_project::GroupKind::Mask { .. }));
+        for id in ["path", "feather", "opacity", "expansion"] {
+            let p = g.get(id).expect("mask property");
+            assert!(p.keys.windows(2).all(|w| w[0].time < w[1].time), "{id}");
+            for v in std::iter::once(&p.value).chain(p.keys.iter().map(|k| &k.value)) {
+                match id {
+                    "path" => assert!(path_ok(v), "{v:?}"),
+                    "feather" => assert!(v.components().iter().all(|c| c.is_finite() && *c >= 0.0), "{v:?}"),
+                    "opacity" => assert!(v.components().iter().all(|c| (0.0..=100.0).contains(c)), "{v:?}"),
+                    _ => assert!(v.components().iter().all(|c| c.is_finite()), "{v:?}"),
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn every_fixture_imports_or_reports() {
+    for name in skip!(fixtures()) {
+        assert!(try_all(&fixture!(&name)), "{name}");
+    }
+}
+
+#[test]
+fn truncated_files_never_panic() {
+    for name in skip!(fixtures()) {
+        let bytes = fixture!(&name);
+        let n = bytes.len();
+        for cut in (0..n).step_by((n / 40).max(1)).chain([n.saturating_sub(1), n.saturating_sub(2), 11, 12, 13, 100]) {
+            try_all(&bytes[..cut.min(n)]);
+        }
+    }
+}
+
+#[test]
+fn a_damaged_whole_combined_file_never_panics() {
+    // The cases are cut from the combined files by our writer; this is After Effects' own bytes
+    // (the smallest combined file): truncated, and with flipped bytes.
+    let original = skip!(crate::common::try_file("aepx-pair.aep"));
+    assert!(try_all(&original));
+    let n = original.len();
+    for cut in (0..n).step_by(n / 40) {
+        try_all(&original[..cut]);
+    }
+    let mut state = 0x51ed_2701_0bad_cafeu64;
+    for round in 0..40 {
+        let mut bytes = original.clone();
+        for _ in 0..1 + round % 6 {
+            let at = (next(&mut state) % n as u64) as usize;
+            bytes[at] ^= 1 << (next(&mut state) % 8);
+        }
+        try_all(&bytes);
+    }
+}
+
+/// A small deterministic generator (xorshift) for the byte flips.
+fn next(state: &mut u64) -> u64 {
+    *state ^= *state << 13;
+    *state ^= *state >> 7;
+    *state ^= *state << 17;
+    *state
+}
+
+#[test]
+fn flipped_bytes_never_panic() {
+    let mut state = 0x9e37_79b9_7f4a_7c15u64;
+    for name in skip!(fixtures()) {
+        let original = fixture!(&name);
+        for round in 0..40 {
+            let mut bytes = original.clone();
+            let flips = 1 + round % 6;
+            for _ in 0..flips {
+                let at = (next(&mut state) % bytes.len() as u64) as usize;
+                bytes[at] ^= 1 << (next(&mut state) % 8);
+            }
+            try_all(&bytes);
+        }
+        // Runs of 0xff / 0x00 over parts of the file, the classic size-field killers.
+        for round in 0..12 {
+            let mut bytes = original.clone();
+            let at = (next(&mut state) % bytes.len() as u64) as usize;
+            let len = 1 + (next(&mut state) % 64) as usize;
+            let fill = if round % 2 == 0 { 0xff } else { 0x00 };
+            for b in bytes.iter_mut().skip(at).take(len) {
+                *b = fill;
+            }
+            try_all(&bytes);
+        }
+    }
+}
+
+fn visit(chunks: &mut [Chunk<'_>], f: &mut dyn FnMut(&mut Chunk<'_>)) {
+    for c in chunks {
+        f(c);
+        visit(c.children_mut(), f);
+    }
+}
+
+fn set(chunk: &mut Chunk<'_>, at: usize, bytes: &[u8]) {
+    if let Body::Data(d) = &mut chunk.body {
+        let d = d.to_mut();
+        for (i, b) in bytes.iter().enumerate() {
+            if let Some(slot) = d.get_mut(at + i) {
+                *slot = *b;
+            }
+        }
+    }
+}
+
+/// Rewrites a fixture with `edit` applied to every chunk.
+fn mutate(name: &str, edit: &mut dyn FnMut(&mut Chunk<'_>)) -> Option<Vec<u8>> {
+    Some({
+        let bytes = crate::common::try_fixture(name)?;
+        let mut file: AepFile<'_> = parse(&bytes).unwrap();
+        visit(&mut file.chunks, edit);
+        write(&file).unwrap()
+    })
+}
+
+const NAN: [u8; 8] = [0x7f, 0xf8, 0, 0, 0, 0, 0, 1];
+const INF: [u8; 8] = [0x7f, 0xf0, 0, 0, 0, 0, 0, 0];
+const HUGE: [u8; 8] = [0x7f, 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff];
+
+#[test]
+fn hostile_values_in_valid_structure() {
+    let keyed =
+        ["055-key-position-3key-inserted-t2.5.aep", "204-key-ease-asymmetric.aep", "205-key-opacity-ease-asymmetric.aep", "206-key-scale-2key-linear.aep"];
+    let others = [
+        "000-base.aep",
+        "022-layer-parent-null.aep",
+        "124-precomp-Pre.aep",
+        "126-footage-png-layer.aep",
+        "212-anchor-400x300-solid-100-50.aep",
+        "091-mask-rect-props.aep",
+        "093-mask-path-2keys.aep",
+        "208-key-mask-feather-2key-linear.aep",
+        "306-key-maskfeather-bezier-ease.aep",
+        "328-mask-two-ellipse-rect.aep",
+    ];
+    for name in keyed.iter().chain(&others) {
+        // Composition header: zero and extreme sizes, time base, durations.
+        for (at, value) in [(4usize, 0u32), (8, 0), (4, u32::MAX), (8, u32::MAX), (44, u32::MAX), (28, u32::MAX), (36, 5), (172, u32::MAX)] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"cdta") {
+                    set(c, at, &value.to_be_bytes());
+                }
+            }));
+            try_all(&bytes);
+        }
+        for (at, bytes2) in [(140usize, [0u8, 0]), (142, [0, 0]), (140, [0xff, 0xff]), (142, [0xff, 0xff]), (144, [0, 0])] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"cdta") {
+                    set(c, at, &bytes2);
+                }
+            }));
+            try_all(&bytes);
+        }
+        // Layer header: stretch, times, source and parent links.
+        for (at, value) in [
+            (8usize, 0u32),
+            (8, u32::MAX),
+            (12, 0x8000_0000),
+            (16, 0),
+            (20, 0x7fff_ffff),
+            (24, 0),
+            (28, 0x8000_0000),
+            (32, 0),
+            (40, 0),
+            (40, 27),
+            (132, 27),
+            (132, 29),
+            (0, 0),
+            (0, 29),
+            (132, u32::MAX),
+        ] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"ldta") {
+                    set(c, at, &value.to_be_bytes());
+                }
+            }));
+            try_all(&bytes);
+        }
+        // Every double of every property: NaN, infinity, huge.
+        for bad in [NAN, INF, HUGE] {
+            for chunk_id in [b"cdat", b"ldat"] {
+                let bytes = skip!(mutate(name, &mut |c| {
+                    if c.is(chunk_id) {
+                        let len = c.bytes().map_or(0, <[u8]>::len);
+                        for at in (0..len).step_by(8) {
+                            set(c, at, &bad);
+                        }
+                    }
+                }));
+                try_all(&bytes);
+            }
+        }
+        // Keyframe times and flags, interpolation bytes.
+        for fill in [0xffu8, 0x7f, 0x03, 0x00] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"ldat") {
+                    let len = c.bytes().map_or(0, <[u8]>::len);
+                    for at in (0..len).step_by(8) {
+                        set(c, at, &[fill; 4]);
+                    }
+                }
+            }));
+            try_all(&bytes);
+        }
+        // Property headers (component counts, templates, time scale, expression bytes).
+        for (at, value) in [(3usize, 0u8), (3, 255), (7, 0), (7, 1), (12, 0), (68, 1), (76, 1), (120, 1), (119, 1)] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"tdb4") {
+                    set(c, at, &[value]);
+                }
+            }));
+            try_all(&bytes);
+        }
+        // Footage headers.
+        for (at, value) in [(30usize, u32::MAX), (34, u32::MAX), (30, 0), (34, 0)] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"sspc") {
+                    set(c, at, &value.to_be_bytes());
+                }
+            }));
+            try_all(&bytes);
+        }
+    }
+}
+
+/// Regression: a layer whose parent is itself, or a pair of layers that are each other's
+/// parent, must not produce a parent loop in the project.
+#[test]
+fn parent_loops_are_dropped() {
+    // 022: the child L (id 27 in the single-case file) has the null (29) as its parent. Make the
+    // null's parent the child, and the child's parent the null.
+    let ids = skip!(crate::import::helpers::comp_ids("022-layer-parent-null.aep"));
+    let (null, child) = (ids[0].2[0], ids[0].2[1]);
+    let looped = skip!(mutate("022-layer-parent-null.aep", &mut |c| {
+        if c.is(b"ldta") {
+            let id = c.bytes().and_then(|b| b.get(..4)).map(|b| u32::from_be_bytes([b[0], b[1], b[2], b[3]]));
+            if id == Some(null) {
+                set(c, 132, &child.to_be_bytes());
+            } else if id == Some(child) {
+                set(c, 132, &null.to_be_bytes());
+            }
+        }
+    }));
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut p, &looped, &opts).unwrap();
+    assert_eq!(r.report.count(effectcraft_aep::import::LossCategory::ParentLinks), 2);
+    let c = p.comp(r.comps[0]).unwrap();
+    assert!(c.layers.iter().all(|l| l.parent.is_none()));
+
+    let selfish = skip!(mutate("022-layer-parent-null.aep", &mut |c| {
+        if c.is(b"ldta") && c.bytes().and_then(|b| b.get(..4)) == Some(&null.to_be_bytes()[..]) {
+            set(c, 132, &null.to_be_bytes());
+        }
+    }));
+    let mut p = Project::default();
+    let r = import(&mut p, &selfish, &opts).unwrap();
+    assert_eq!(r.report.count(effectcraft_aep::import::LossCategory::ParentLinks), 1);
+}
+
+/// Regression: a precomposition that contains itself (or two comps containing each other) is cut
+/// at the loop instead of building a cyclic project.
+#[test]
+fn precomposition_loops_are_cut() {
+    // 124: comp C holds a layer of comp Pre (item id 37 in the single-case file), and Pre holds
+    // the solid (id 26). Point the layer in Pre (39) at Pre itself.
+    let ids = skip!(crate::import::helpers::comp_ids("124-precomp-Pre.aep"));
+    let (_, pre, pre_layers) = ids.iter().find(|(n, _, _)| n == "Pre").cloned().expect("Pre");
+    let looped = skip!(mutate("124-precomp-Pre.aep", &mut |c| {
+        if c.is(b"ldta") {
+            let id = c.bytes().and_then(|b| b.get(..4)).map(|b| u32::from_be_bytes([b[0], b[1], b[2], b[3]]));
+            if id == Some(pre_layers[0]) {
+                set(c, 40, &pre.to_be_bytes());
+            }
+        }
+    }));
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut p, &looped, &opts).unwrap();
+    assert_eq!(r.report.count(effectcraft_aep::import::LossCategory::UnsupportedLayers), 1, "{:?}", r.report.losses);
+    // No composition uses itself, directly or through another.
+    for id in &r.comps {
+        let mut stack = vec![*id];
+        let mut seen = std::collections::HashSet::new();
+        while let Some(c) = stack.pop() {
+            for l in &p.comp(c).unwrap().layers {
+                if let effectcraft_project::LayerSource::Comp { item } = l.source {
+                    assert_ne!(item, *id);
+                    if seen.insert(item) {
+                        stack.push(item);
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Regression: a NaN or infinite static value used to reach the project as such.
+#[test]
+fn non_finite_static_values_fall_back_to_the_default() {
+    let bytes = skip!(mutate("040-static-position-100-200.aep", &mut |c| {
+        if c.is(b"cdat") {
+            set(c, 0, &NAN);
+            set(c, 8, &INF);
+            set(c, 16, &HUGE);
+        }
+    }));
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut p, &bytes, &opts).unwrap();
+    assert!(r.report.count(effectcraft_aep::import::LossCategory::DamagedData) >= 1, "{:?}", r.report.losses);
+    let layer = &p.comp(r.comps[0]).unwrap().layers[0];
+    let pos = layer.props.prop("transform/position").unwrap();
+    assert_eq!(pos.value, effectcraft_keyframe::Value::Vec3([960.0, 540.0, 0.0]));
+}
+
+fn import_allowing(bytes: &[u8]) -> (Project, effectcraft_aep::import::ImportResult) {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut p, bytes, &opts).expect("import");
+    check_sane(&p, r.comps.len());
+    (p, r)
+}
+
+fn mask_count(p: &Project, r: &effectcraft_aep::import::ImportResult) -> usize {
+    p.comp(r.comps[0]).unwrap().layers.iter().map(|l| l.masks().map_or(0, |m| m.groups().count())).sum()
+}
+
+/// Rewrites the point list of every mask path shape to `records` points of `point`.
+fn with_points(name: &str, records: usize, point: [u8; 8]) -> Option<Vec<u8>> {
+    Some({
+        (mutate(name, &mut |c| {
+            if c.is_list(b"shap") {
+                for k in c.children_mut() {
+                    if k.is_list(b"list") {
+                        for d in k.children_mut() {
+                            if d.is(b"lhd3") {
+                                set(d, 8, &u32::try_from(records).unwrap().to_be_bytes());
+                            } else if d.is(b"ldat") {
+                                d.body = Body::Data(std::borrow::Cow::Owned(point.repeat(records)));
+                            }
+                        }
+                    }
+                }
+            }
+        }))?
+    })
+}
+
+/// Hostile mask paths: no vertices, a point count that is not a multiple of three, too many
+/// vertices, NaN points and boxes, a malformed shape header. Each gives a report and the mask is
+/// left out; the layer and the project stay valid.
+#[test]
+fn hostile_mask_paths_are_reported() {
+    let half = 0.5f32.to_be_bytes();
+    let mid = [half[0], half[1], half[2], half[3], half[0], half[1], half[2], half[3]];
+    let nan = f32::NAN.to_be_bytes();
+    let nan_point = [nan[0], nan[1], nan[2], nan[3], nan[0], nan[1], nan[2], nan[3]];
+    let cases: [(usize, [u8; 8]); 5] = [(0, mid), (10, mid), (3 * 65_537, mid), (12, nan_point), (3, mid)];
+    for (records, point) in cases {
+        let bytes = skip!(with_points("090-mask-rect.aep", records, point));
+        let (p, r) = import_allowing(&bytes);
+        let lost = r.report.count(LossCategory::Masks);
+        let kept = mask_count(&p, &r);
+        assert_eq!(lost + kept, 1, "{records}: {:?}", r.report.losses);
+        // Only the valid single-vertex path (3 records) survives.
+        assert_eq!(kept, usize::from(records == 3), "{records}");
+        assert_eq!(p.comp(r.comps[0]).unwrap().layers.len(), 1);
+    }
+    // NaN, infinity and huge numbers in the box.
+    for bad in [f32::NAN, f32::INFINITY, f32::MAX] {
+        let bytes = skip!(mutate("232-mask-ellipse.aep", &mut |c| {
+            if c.is(b"shph") {
+                for at in [4, 8, 12, 16] {
+                    set(c, at, &bad.to_be_bytes());
+                }
+            }
+        }));
+        let (p, r) = import_allowing(&bytes);
+        assert_eq!(r.report.count(LossCategory::Masks) + mask_count(&p, &r), 1, "{bad}");
+    }
+    // A malformed shape header (too short).
+    let bytes = skip!(mutate("090-mask-rect.aep", &mut |c| {
+        if c.is(b"shph") {
+            c.body = Body::Data(std::borrow::Cow::Owned(vec![0u8; 3]));
+        }
+    }));
+    let (p, r) = import_allowing(&bytes);
+    assert_eq!((r.report.count(LossCategory::Masks), mask_count(&p, &r)), (1, 0));
+}
+
+/// An unknown mode is reported and becomes Add; a missing `mkif` body is damaged data.
+#[test]
+fn mask_modes_and_switches_from_hostile_mkif() {
+    let bytes = skip!(mutate("234-mask-mode-intersect.aep", &mut |c| {
+        if c.is(b"mkif") {
+            set(c, 4, &99u32.to_be_bytes());
+        }
+    }));
+    let (p, r) = import_allowing(&bytes);
+    assert_eq!(r.report.count(LossCategory::Masks), 1);
+    let l = &p.comp(r.comps[0]).unwrap().layers[0];
+    let g = l.masks().unwrap().groups().next().unwrap().clone();
+    assert!(matches!(g.kind, effectcraft_project::GroupKind::Mask { mode: effectcraft_project::MaskMode::Add, .. }));
+
+    let bytes = skip!(mutate("091-mask-rect-props.aep", &mut |c| {
+        if c.is(b"mkif") {
+            c.body = Body::Data(std::borrow::Cow::Owned(Vec::new()));
+        }
+    }));
+    let (p, r) = import_allowing(&bytes);
+    assert_eq!(r.report.count(LossCategory::DamagedData), 1, "{:?}", r.report.losses);
+    assert_eq!(mask_count(&p, &r), 1);
+}
+
+/// Path keys whose count does not match the stored shapes: the first shape is imported as a
+/// static path and the mismatch is reported.
+#[test]
+fn path_keys_without_matching_shapes_fall_back_to_a_static_path() {
+    let original = fixture!("093-mask-path-2keys.aep");
+    let mut file: AepFile<'_> = parse(&original).unwrap();
+    visit(&mut file.chunks, &mut |c| {
+        if c.is_list(b"omks")
+            && let Body::List { children, .. } = &mut c.body
+            && let Some(last) = children.iter().rposition(|k| k.is_list(b"shap"))
+        {
+            children.remove(last);
+        }
+    });
+    let bytes = write(&file).unwrap();
+    let (p, r) = import_allowing(&bytes);
+    assert_eq!(r.report.count(LossCategory::DamagedData), 1, "{:?}", r.report.losses);
+    let l = &p.comp(r.comps[0]).unwrap().layers[0];
+    let g = l.masks().unwrap().groups().next().unwrap().clone();
+    assert!(g.get("path").unwrap().keys.is_empty());
+}
+
+/// The effect fixtures: Tint, Gradient Ramp and Exposure, static and keyed, and a second instance.
+const EFFECT_FIXTURES: [&str; 10] = [
+    "356-fx-tint-default.aep",
+    "363-fx-tint-amount-2key.aep",
+    "364-fx-tint-white-2key.aep",
+    "366-fx-blur-then-tint.aep",
+    "377-fx-ramp-shape-radial.aep",
+    "382-fx-ramp-start-2key.aep",
+    "383-fx-ramp-on-100x100-start-10-20.aep",
+    "395-fx-exposure-individual-red-1.aep",
+    "396-fx-exposure-bypass-on.aep",
+    "397-fx-exposure-master-2key.aep",
+];
+
+fn report_of(bytes: &[u8]) -> effectcraft_aep::import::ImportReport {
+    effectcraft_aep::import::analyze(bytes, &|_| false).expect("a readable project")
+}
+
+#[test]
+fn hostile_effect_parameter_records() {
+    for name in EFFECT_FIXTURES {
+        // Every parameter type in every pard, including unknown ones.
+        for kind in [0u32, 2, 3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16, u32::MAX] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"pard") {
+                    set(c, 12, &kind.to_be_bytes());
+                }
+            }));
+            assert!(try_all(&bytes), "{name}: type {kind}");
+        }
+        // Defaults, popup counts, valid ranges and slider ranges: zero, negative, huge, NaN.
+        for at in [56usize, 60, 62, 104, 108, 112, 116, 128] {
+            for value in [0u32, 0x8000_0000, u32::MAX, 0x7fff_ffff, 0x7fc0_0000] {
+                let bytes = skip!(mutate(name, &mut |c| {
+                    if c.is(b"pard") {
+                        set(c, at, &value.to_be_bytes());
+                    }
+                }));
+                assert!(try_all(&bytes), "{name}: pard@{at} = {value:#x}");
+            }
+        }
+        // Values: non-finite, huge, and out-of-range popup indices.
+        for bad in [NAN, INF, HUGE, 99.0f64.to_be_bytes(), (-3.0f64).to_be_bytes(), 0.0f64.to_be_bytes()] {
+            for chunk_id in [b"cdat", b"ldat"] {
+                let bytes = skip!(mutate(name, &mut |c| {
+                    if c.is(chunk_id) {
+                        let len = c.bytes().map_or(0, <[u8]>::len);
+                        for at in (0..len).step_by(8) {
+                            set(c, at, &bad);
+                        }
+                    }
+                }));
+                assert!(try_all(&bytes), "{name}");
+            }
+        }
+        // Truncated and empty pard bodies.
+        for len in [0usize, 3, 13, 57, 129] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"pard")
+                    && let Body::Data(d) = &mut c.body
+                {
+                    d.to_mut().truncate(len);
+                }
+            }));
+            assert!(try_all(&bytes), "{name}: pard cut to {len}");
+        }
+        // Component counts and templates of the value records.
+        for (at, value) in [(3usize, 0u8), (3, 1), (3, 4), (3, 255), (7, 0), (7, 3)] {
+            let bytes = skip!(mutate(name, &mut |c| {
+                if c.is(b"tdb4") {
+                    set(c, at, &[value]);
+                }
+            }));
+            assert!(try_all(&bytes), "{name}: tdb4@{at} = {value}");
+        }
+    }
+}
+
+#[test]
+fn bogus_effect_structure_is_reported_not_imported_blindly() {
+    // An unknown effect match name: reported by name.
+    let bytes = skip!(mutate("356-fx-tint-default.aep", &mut |c| {
+        if c.is(b"tdmn") && c.bytes().is_some_and(|b| b.starts_with(b"ADBE Tint\0")) {
+            set(c, 0, b"XYZ Unknown\0");
+        }
+    }));
+    let r = report_of(&bytes);
+    assert_eq!(r.imported.effects, 0);
+    assert!(
+        r.losses.iter().any(|l| l.category == effectcraft_aep::import::LossCategory::Effects && l.details.iter().any(|d| d.contains("XYZ Unknown"))),
+        "{r:?}"
+    );
+
+    // No project-level definitions: a Ramp with an empty parT borrows the definitions of a Ramp
+    // in the file that has its own parT (#3170). In the single-case file one of the two has its
+    // own, so both arrive; in the case cut from the combined file an earlier case (not kept)
+    // held them, so neither has readable definitions and both are reported.
+    let own = {
+        let bytes = skip!(crate::common::try_fixture("383-fx-ramp-on-100x100-start-10-20.aep"));
+        let file = parse(&bytes).unwrap();
+        let view = effectcraft_aep::Project::new(&file).unwrap();
+        let effects: Vec<_> = view.all_items().iter().filter_map(|i| i.comp()).flat_map(|c| c.layers().flat_map(|l| l.effects()).collect::<Vec<_>>()).collect();
+        assert_eq!(effects.len(), 2);
+        effects.iter().filter(|e| e.has_own_definitions()).count()
+    };
+    assert!(own < 2);
+    let bytes = skip!(mutate("383-fx-ramp-on-100x100-start-10-20.aep", &mut |c| {
+        if let Body::List { list_type, .. } = &mut c.body
+            && list_type == b"EfdG"
+        {
+            *list_type = *b"XfdG";
+        }
+    }));
+    let r = report_of(&bytes);
+    let arrive = if own > 0 { 2 } else { 0 };
+    assert_eq!(r.imported.effects, arrive, "{r:?}");
+    assert_eq!(r.count(effectcraft_aep::import::LossCategory::Effects), 2 - arrive, "{r:?}");
+    assert!(try_all(&bytes)); // 368, the first Gradient Ramp of its file, has its own parT: it still arrives.
+    let bytes = skip!(mutate("368-fx-ramp-default.aep", &mut |c| {
+        if let Body::List { list_type, .. } = &mut c.body
+            && list_type == b"EfdG"
+        {
+            *list_type = *b"XfdG";
+        }
+    }));
+    let r = report_of(&bytes);
+    assert_eq!(r.imported.effects, 1, "{r:?}");
+    assert_eq!(r.count(effectcraft_aep::import::LossCategory::Effects), 0, "{r:?}");
+
+    // A parT whose definitions were renamed (no pard at all) and an empty definition list.
+    for id in [*b"Xard", *b"pard"] {
+        let bytes = skip!(mutate("368-fx-ramp-default.aep", &mut |c| {
+            if c.is(b"pard") {
+                c.id = id;
+                if let Body::Data(d) = &mut c.body {
+                    d.to_mut().clear();
+                }
+            }
+        }));
+        assert!(try_all(&bytes));
+        let r = report_of(&bytes);
+        assert!(r.imported.effects <= 1, "{r:?}");
+    }
+
+    // A wrong valid maximum is not guessed: the slider is reported.
+    let bytes = skip!(mutate("380-fx-ramp-blend-25pct.aep", &mut |c| {
+        if c.is(b"pard") && c.bytes().is_some_and(|b| b.get(16..35) == Some(b"Blend With Original")) {
+            set(c, 128, &(100u32 << 16).to_be_bytes());
+        }
+    }));
+    let r = report_of(&bytes);
+    assert!(r.losses.iter().any(|l| l.details.iter().any(|d| d.contains("Blend With Original") && d.contains("valid maximum"))), "{r:?}");
+
+    // The same for a float slider (Exposure's Gamma Correction with another valid maximum).
+    let bytes = skip!(mutate("394-fx-exposure-gamma-2.2.aep", &mut |c| {
+        if c.is(b"pard") && c.bytes().is_some_and(|b| b.get(16..33) == Some(b"Gamma Correction\0")) {
+            set(c, 108, &20f32.to_be_bytes());
+        }
+    }));
+    let r = report_of(&bytes);
+    assert!(r.losses.iter().any(|l| l.details.iter().any(|d| d.contains("Gamma Correction") && d.contains("valid maximum"))), "{r:?}");
+    assert_eq!(r.imported.effects, 1);
+
+    // A group marker typed as a slider is reported, not read as a value.
+    let bytes = skip!(mutate("389-fx-exposure-default.aep", &mut |c| {
+        if c.is(b"pard") && c.bytes().is_some_and(|b| b.get(12..16) == Some(&13u32.to_be_bytes()[..]) && b.get(16..23) == Some(b"Master\0")) {
+            set(c, 12, &10u32.to_be_bytes());
+        }
+    }));
+    assert!(try_all(&bytes));
+    let r = report_of(&bytes);
+    assert_eq!(r.imported.effects, 1, "{r:?}");
+    assert!(r.count(effectcraft_aep::import::LossCategory::Effects) >= 1, "{r:?}");
+}
+
+#[test]
+fn exposure_values_beyond_effectcrafts_slider_range_are_kept() {
+    // After Effects accepts Exposure -100..100 stops (389); EffectCraft's own range is narrower.
+    // A stored 50 is imported as stored (the effect renders it), not clamped and not reported.
+    let bytes = skip!(mutate("391-fx-exposure-master-1.5.aep", &mut |c| {
+        if c.is(b"cdat") && c.bytes().is_some_and(|b| b.get(0..8) == Some(&1.5f64.to_be_bytes()[..])) {
+            set(c, 0, &50f64.to_be_bytes());
+        }
+    }));
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, &bytes, &ImportOptions::new(&none)).expect("lossless");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let mut found = None;
+    for id in &r.comps {
+        if let Some(item) = project.item(*id)
+            && let ItemKind::Comp(c) = &item.kind
+        {
+            for l in &c.layers {
+                if let Some(fx) = l.props.sub("effects").and_then(|g| g.groups().next()) {
+                    found = fx.prop("master/exposure").map(|p| p.value.clone());
+                }
+            }
+        }
+    }
+    assert_eq!(found, Some(effectcraft_keyframe::Value::Scalar(50.0)));
+}
+
+#[test]
+fn huge_effect_lists_stay_bounded() {
+    // The Tint's parT with its pard records repeated 2 000 times and the effect parade with 200
+    // copies of the effect: the import finishes and every copy arrives or is reported.
+    let bytes = fixture!("356-fx-tint-default.aep");
+    let mut file: AepFile<'_> = parse(&bytes).unwrap();
+    fn grow(chunks: &mut [Chunk<'_>]) {
+        for c in chunks {
+            if let Body::List { list_type, children } = &mut c.body {
+                if list_type == b"parT" {
+                    let extra: Vec<Chunk<'_>> = children.iter().filter(|k| k.is(b"pard") || k.is(b"tdmn")).cloned().collect();
+                    for _ in 0..2_000 / extra.len().max(1) {
+                        children.extend(extra.iter().cloned());
+                    }
+                } else if list_type == b"tdgp" && children.iter().any(|k| k.is_list(b"sspc")) {
+                    let pair: Vec<Chunk<'_>> = children.iter().filter(|k| k.is(b"tdmn") || k.is_list(b"sspc")).cloned().collect();
+                    for _ in 0..200 {
+                        children.extend(pair.iter().cloned());
+                    }
+                }
+            }
+            grow(c.children_mut());
+        }
+    }
+    grow(&mut file.chunks);
+    let bytes = write(&file).unwrap();
+    assert!(try_all(&bytes));
+    let r = report_of(&bytes);
+    assert!(r.imported.effects >= 1, "{:?}", r.summary());
+}
+
+#[test]
+fn huge_image_sequences_are_bounded() {
+    // 603 with the last frame number at 99 999 (sspc u32 at 176) and its item copied 15 times:
+    // 1.5 million file names would be created; the import expands at most a million in total and
+    // links the first file of the others.
+    let bytes = fixture!("603-footage-exrseq-0101-as-layer.aep");
+    let mut file: AepFile<'static> = parse(&bytes).expect("parse").into_owned();
+    let fold = file.chunks.iter_mut().find(|c| c.is_list(b"Fold")).expect("Fold");
+    let Body::List { children, .. } = &mut fold.body else { panic!("Fold") };
+    let at = children
+        .iter()
+        .position(|c| c.is_list(b"Item") && c.child_list(b"Pin ").and_then(|p| p.child(b"sspc")).and_then(|s| s.bytes()).is_some_and(|b| &b[22..26] == b"oEXR"))
+        .expect("sequence item");
+    let mut item = children[at].clone();
+    visit(std::slice::from_mut(&mut item), &mut |c| {
+        if c.is(b"sspc") && c.bytes().is_some_and(|b| b.len() > 180 && &b[22..26] == b"oEXR") {
+            set(c, 176, &99_999u32.to_be_bytes());
+        }
+    });
+    for _ in 0..15 {
+        children.insert(at, item.clone());
+    }
+    let out = write(&file).expect("write");
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut p, &out, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+    let files: usize = p.items.values().filter_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.sequence.len()) } else { None }).sum();
+    assert!(files <= 1_000_000, "{files}");
+    assert!(r.report.count(LossCategory::DamagedData) > 0, "{:?}", r.report.losses);
+}
+
+#[test]
+fn a_composition_without_its_data_is_reported_not_dropped() {
+    // A composition item whose `cdta` is gone (renamed here, the same length) is damaged data: the
+    // default import refuses it instead of reporting success without the composition.
+    let mut bytes = fixture!("000-base.aep");
+    let at = bytes.windows(4).position(|w| w == b"cdta").expect("cdta");
+    bytes[at..at + 4].copy_from_slice(b"xdta");
+    let none = |_: &str| false;
+    let mut p = effectcraft_project::Project::default();
+    assert!(effectcraft_aep::import::import(&mut p, &bytes, &effectcraft_aep::import::ImportOptions::new(&none)).is_err());
+    let report = effectcraft_aep::import::analyze(&bytes, &none).expect("analyze");
+    assert_eq!(report.count(effectcraft_aep::import::LossCategory::DamagedData), 1, "{:?}", report.losses);
+}
diff --git a/crates/aep/tests/it/import/shapes.rs b/crates/aep/tests/it/import/shapes.rs
new file mode 100644
index 000000000..e436ac027
--- /dev/null
+++ b/crates/aep/tests/it/import/shapes.rs
@@ -0,0 +1,203 @@
+//! Shape layers (238-242, 330-333, 451-483, 519): every shape fixture imports without losses with
+//! the values it was made with.
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::LossCategory;
+use effectcraft_keyframe::{Gradient, Value};
+use effectcraft_project::{Layer, LayerSource, Project, PropGroup};
+
+fn shape_layer(p: &Project, r: &effectcraft_aep::import::ImportResult) -> Layer {
+    let (_, c) = comp(p, r, "C");
+    c.layers.iter().find(|l| matches!(l.source, LayerSource::Shape)).cloned().expect("a shape layer")
+}
+
+fn lossless(name: &str) -> Option<Layer> {
+    Some({
+        let mut p = Project::default();
+        let r = crate::import::helpers::try_import_fixture(&mut p, name, false)?.unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(r.report.imported.shape_layers, 1, "{name}");
+        shape_layer(&p, &r)
+    })
+}
+
+/// The items of the contents group `path` (`""` = the layer's contents), as `(match id, name)`.
+fn items(g: &PropGroup) -> Vec<(String, String)> {
+    g.children.iter().filter_map(|n| n.as_group()).map(|g| (g.match_id.clone(), g.name.clone())).collect()
+}
+
+fn contents(l: &Layer) -> &PropGroup {
+    l.props.sub("contents").expect("contents")
+}
+
+fn group(g: &PropGroup, i: usize) -> &PropGroup {
+    g.children.iter().filter_map(|n| n.as_group()).nth(i).expect("item")
+}
+
+fn val(g: &PropGroup, path: &str) -> Value {
+    g.prop(path).unwrap_or_else(|| panic!("no {path}")).value.clone()
+}
+
+#[test]
+fn an_ellipse_with_a_fill_in_a_group() {
+    let l = skip!(lossless("451-shape-ellipse-400x300-fill.aep"));
+    let c = contents(&l);
+    assert_eq!(items(c), vec![("group".to_string(), "Group 1".to_string())]);
+    let g = group(c, 0);
+    let inner = g.sub("contents").expect("group contents");
+    assert_eq!(items(inner), vec![("ellipse".into(), "Ellipse Path 1".into()), ("fill".into(), "Fill 1".into())]);
+    assert_eq!(val(group(inner, 0), "size"), Value::Vec2([400.0, 300.0]));
+    assert_eq!(val(group(inner, 0), "position"), Value::Vec2([0.0, 0.0]));
+    assert_eq!(val(group(inner, 1), "color"), Value::Color([0.0, 1.0, 0.0, 1.0]));
+    assert_eq!(val(group(inner, 1), "opacity"), Value::Scalar(100.0));
+    // The layer: anchor at the origin, position the composition centre.
+    assert_eq!(val(&l.props, "transform/anchor"), Value::Vec3([0.0, 0.0, 0.0]));
+    assert_eq!(val(&l.props, "transform/position"), Value::Vec3([960.0, 540.0, 0.0]));
+}
+
+#[test]
+fn group_transform_layer_anchor_stroke_trim_rect_star() {
+    let inner = |l: &Layer| group(contents(l), 0).sub("contents").cloned().expect("contents");
+    let tr = |l: &Layer| group(contents(l), 0).sub("transform").cloned().expect("transform");
+
+    let l = skip!(lossless("457-shape-group-scale-50-80.aep"));
+    assert_eq!(val(&tr(&l), "scale"), Value::Vec2([50.0, 80.0]), "group scale is percent as stored");
+
+    let l = skip!(lossless("462-shape-layer-anchor-10-20.aep"));
+    assert_eq!(val(&l.props, "transform/anchor"), Value::Vec3([10.0, 20.0, 0.0]), "a shape layer's anchor is pixels as stored");
+
+    let l = skip!(lossless("464-shape-stroke-opacity-50.aep"));
+    let s = group(&inner(&l), 2).clone();
+    assert_eq!(
+        (s.match_id.as_str(), val(&s, "color"), val(&s, "width"), val(&s, "opacity")),
+        ("stroke", Value::Color([1.0, 0.0, 0.0, 1.0]), Value::Scalar(6.0), Value::Scalar(50.0))
+    );
+
+    let l = skip!(lossless("467-shape-trim-end-70.aep"));
+    let t = group(&inner(&l), 2).clone();
+    assert_eq!(
+        (t.match_id.as_str(), val(&t, "start"), val(&t, "end"), val(&t, "offset"), val(&t, "mode")),
+        ("trim", Value::Scalar(0.0), Value::Scalar(70.0), Value::Scalar(0.0), Value::Enum(0))
+    );
+    let l = skip!(lossless("469-shape-trim-type-2.aep"));
+    assert_eq!(val(group(&inner(&l), 2), "mode"), Value::Enum(1), "individually");
+
+    let l = skip!(lossless("471-shape-rect-roundness-30.aep"));
+    let r = group(&inner(&l), 2).clone();
+    assert_eq!((r.match_id.as_str(), val(&r, "size"), val(&r, "roundness")), ("rect", Value::Vec2([200.0, 100.0]), Value::Scalar(30.0)));
+
+    let l = skip!(lossless("473-shape-star-points-6.aep"));
+    let s = group(&inner(&l), 2).clone();
+    assert_eq!(
+        (s.match_id.as_str(), val(&s, "type"), val(&s, "points"), val(&s, "outerRadius"), val(&s, "innerRadius"), val(&s, "rotation")),
+        ("star", Value::Enum(0), Value::Scalar(6.0), Value::Scalar(100.0), Value::Scalar(50.0), Value::Scalar(0.0))
+    );
+}
+
+#[test]
+fn two_groups_and_a_nested_group() {
+    let l = skip!(lossless("482-shape-two-groups.aep"));
+    let c = contents(&l);
+    assert_eq!(items(c), vec![("group".into(), "Group 1".into()), ("group".into(), "Group 2".into())]);
+    let g2 = group(c, 1).sub("contents").expect("contents").clone();
+    assert_eq!(val(group(&g2, 0), "size"), Value::Vec2([200.0, 100.0]));
+    assert_eq!(val(group(&g2, 1), "color"), Value::Color([0.0, 0.0, 1.0, 1.0]));
+
+    let l = skip!(lossless("483-shape-nested-group-rect.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    assert_eq!(items(&inner).iter().map(|i| i.0.as_str()).collect::<Vec<_>>(), vec!["ellipse", "fill", "group"]);
+    let nested = group(&inner, 2).sub("contents").expect("nested contents").clone();
+    assert_eq!(val(group(&nested, 0), "size"), Value::Vec2([100.0, 50.0]));
+}
+
+#[test]
+fn every_item_at_its_default() {
+    let l = skip!(lossless("519-shape-all-items-default.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    assert_eq!(
+        items(&inner).iter().map(|i| i.0.as_str()).collect::<Vec<_>>(),
+        vec!["rect", "ellipse", "star", "fill", "stroke", "gfill", "gstroke", "trim", "round"]
+    );
+    let g = |i| group(&inner, i).clone();
+    assert_eq!((val(&g(0), "size"), val(&g(0), "roundness")), (Value::Vec2([100.0, 100.0]), Value::Scalar(0.0)));
+    assert_eq!(val(&g(1), "size"), Value::Vec2([100.0, 100.0]));
+    assert_eq!((val(&g(2), "points"), val(&g(2), "innerRadius"), val(&g(2), "outerRadius")), (Value::Scalar(5.0), Value::Scalar(50.0), Value::Scalar(100.0)));
+    assert_eq!((val(&g(3), "color"), val(&g(3), "rule")), (Value::Color([1.0, 0.0, 0.0, 1.0]), Value::Enum(0)));
+    assert_eq!(
+        (val(&g(4), "color"), val(&g(4), "width"), val(&g(4), "cap"), val(&g(4), "join"), val(&g(4), "miter")),
+        (Value::Color([1.0; 4]), Value::Scalar(2.0), Value::Enum(0), Value::Enum(0), Value::Scalar(4.0))
+    );
+    for i in [5, 6] {
+        assert_eq!((val(&g(i), "start"), val(&g(i), "end"), val(&g(i), "type")), (Value::Vec2([0.0, 0.0]), Value::Vec2([100.0, 0.0]), Value::Enum(0)));
+        assert_eq!(val(&g(i), "colors"), Value::Gradient(Gradient::default()), "white to black");
+    }
+    assert_eq!((val(&g(7), "start"), val(&g(7), "end")), (Value::Scalar(0.0), Value::Scalar(100.0)));
+    assert_eq!(val(&g(8), "radius"), Value::Scalar(10.0));
+}
+
+#[test]
+fn the_earlier_shape_cases() {
+    // 238: rectangle 400x300, green fill, round corners 20.
+    let l = skip!(lossless("238-shape-rect-rounded-corners.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    assert_eq!(items(&inner).iter().map(|i| i.0.as_str()).collect::<Vec<_>>(), vec!["rect", "fill", "round"]);
+    assert_eq!(val(group(&inner, 2), "radius"), Value::Scalar(20.0));
+    // 239: green stroke 8 px, round cap and join.
+    let l = skip!(lossless("239-shape-stroke-green-w8-round.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    let s = group(&inner, 1);
+    assert_eq!(
+        (val(s, "width"), val(s, "cap"), val(s, "join"), val(s, "color")),
+        (Value::Scalar(8.0), Value::Enum(1), Value::Enum(1), Value::Color([0.0, 1.0, 0.0, 1.0]))
+    );
+    // 240: the custom path in pixels with its tangents.
+    let l = skip!(lossless("240-shape-custom-path-tangents.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    let Value::Path(p) = val(group(&inner, 0), "path") else { panic!("not a path") };
+    let close = |a: [f64; 2], b: [f64; 2]| (a[0] - b[0]).abs() < 1e-3 && (a[1] - b[1]).abs() < 1e-3;
+    for (got, want) in p.vertices.iter().zip([[0.0, -100.0], [100.0, 100.0], [-100.0, 100.0]]) {
+        assert!(close(*got, want), "{got:?} {want:?}");
+    }
+    for (got, want) in p.in_tangents.iter().zip([[-10.0, -20.0], [30.0, 20.0], [-60.0, 10.0]]) {
+        assert!(close(*got, want), "{got:?} {want:?}");
+    }
+    for (got, want) in p.out_tangents.iter().zip([[40.0, 0.0], [-20.0, 30.0], [0.0, -50.0]]) {
+        assert!(close(*got, want), "{got:?} {want:?}");
+    }
+    assert!(p.closed);
+    // 241 linear, 332 radial gradient fills: points, type.
+    let l = skip!(lossless("241-shape-gradient-fill-linear.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    let gf = group(&inner, 1);
+    assert_eq!((val(gf, "start"), val(gf, "end"), val(gf, "type")), (Value::Vec2([-200.0, 0.0]), Value::Vec2([200.0, 0.0]), Value::Enum(0)));
+    let l = skip!(lossless("332-shape-gradient-fill-radial.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    let gf = group(&inner, 1);
+    assert_eq!((val(gf, "start"), val(gf, "end"), val(gf, "type")), (Value::Vec2([0.0, 0.0]), Value::Vec2([200.0, 0.0]), Value::Enum(1)));
+    // 242: group position.
+    let l = skip!(lossless("242-shape-group-position-50-50.aep"));
+    assert_eq!(val(group(contents(&l), 0).sub("transform").expect("transform"), "position"), Value::Vec2([50.0, 50.0]));
+    // 330 star, 331 polygon.
+    let l = skip!(lossless("330-shape-polystar-star-5-50-100.aep"));
+    let s = group(group(contents(&l), 0).sub("contents").expect("contents"), 0).clone();
+    assert_eq!(
+        (val(&s, "type"), val(&s, "points"), val(&s, "innerRadius"), val(&s, "outerRadius")),
+        (Value::Enum(0), Value::Scalar(5.0), Value::Scalar(50.0), Value::Scalar(100.0))
+    );
+    let l = skip!(lossless("331-shape-polystar-polygon-5-100.aep"));
+    let s = group(group(contents(&l), 0).sub("contents").expect("contents"), 0).clone();
+    assert_eq!((val(&s, "type"), val(&s, "outerRadius")), (Value::Enum(1), Value::Scalar(100.0)));
+    assert!(s.prop("innerRadius").is_none(), "a polygon has no inner radius");
+    // 333: two rectangles, the second at its default size with a position.
+    let l = skip!(lossless("333-shape-group-two-rects.aep"));
+    let inner = group(contents(&l), 0).sub("contents").expect("contents").clone();
+    assert_eq!(items(&inner).iter().map(|i| i.0.as_str()).collect::<Vec<_>>(), vec!["rect", "rect", "fill"]);
+    assert_eq!((val(group(&inner, 1), "size"), val(group(&inner, 1), "position")), (Value::Vec2([100.0, 100.0]), Value::Vec2([300.0, 0.0])));
+}
+
+#[test]
+fn shape_layers_are_no_longer_skipped() {
+    let (p, r) = load!("238-shape-rect-rounded-corners.aep");
+    assert_eq!(r.report.count(LossCategory::ShapeLayers), 0);
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(c.layers.len(), 2);
+}
diff --git a/crates/aep/tests/it/import/shapes_round2.rs b/crates/aep/tests/it/import/shapes_round2.rs
new file mode 100644
index 000000000..6b6880f13
--- /dev/null
+++ b/crates/aep/tests/it/import/shapes_round2.rs
@@ -0,0 +1,114 @@
+//! Masks on text and shape layers (705, 706) and the shape operators Merge Paths, Offset Paths and
+//! Repeater (707-710, 731).
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::{Layer, Project, PropGroup};
+
+fn layer<'p>(p: &'p Project, r: &effectcraft_aep::import::ImportResult, name: &str) -> &'p Layer {
+    let (_, c) = comp(p, r, "C");
+    c.layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("no {name}"))
+}
+
+fn mask_box(l: &Layer) -> [f64; 4] {
+    let m = l.props.sub("masks").and_then(|m| m.groups().next()).expect("a mask");
+    let Value::Path(p) = &m.prop("path").unwrap().value else { panic!() };
+    p.vertices.iter().fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, v| [b[0].min(v[0]), b[1].min(v[1]), b[2].max(v[0]), b[3].max(v[1])])
+}
+
+#[test]
+fn masks_on_text_and_shape_layers_are_in_layer_pixels() {
+    let (p, r) = load!("705-mask-on-text-rect-40-m70-160-10.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(mask_box(layer(&p, &r, "T")), [40.0, -70.0, 160.0, 10.0]);
+    let (p, r) = load!("706-mask-on-shape-rect-0-m150-100-150.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(mask_box(layer(&p, &r, "S")), [0.0, -150.0, 100.0, 150.0]);
+}
+
+/// The items of the first group of shape layer S.
+fn items(name: &str) -> Option<Vec<PropGroup>> {
+    Some({
+        let (p, r) = crate::import::helpers::try_load(name)?;
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        let l = layer(&p, &r, "S");
+        let g = l.props.sub("contents").and_then(|c| c.groups().next()).expect("group");
+        g.sub("contents").expect("group contents").groups().cloned().collect()
+    })
+}
+
+fn find<'a>(items: &'a [PropGroup], id: &str) -> &'a PropGroup {
+    items.iter().find(|g| g.match_id == id).unwrap_or_else(|| panic!("no {id}"))
+}
+
+fn v(g: &PropGroup, id: &str) -> Value {
+    g.prop(id).unwrap_or_else(|| panic!("no {id}")).value.clone()
+}
+
+#[test]
+fn shape_operators_arrive() {
+    assert_eq!(v(find(&skip!(items("707-shape-merge-subtract-rect-ellipse.aep")), "merge"), "mode"), Value::Enum(2));
+    assert_eq!(v(find(&skip!(items("708-shape-merge-intersect-rect-ellipse.aep")), "merge"), "mode"), Value::Enum(3));
+    let i = skip!(items("709-shape-repeater-3-pos150-60-rot10-scale90-80-op40.aep"));
+    let r = find(&i, "repeater");
+    assert_eq!((v(r, "copies"), v(r, "offset"), v(r, "composite")), (Value::Scalar(3.0), Value::Scalar(0.0), Value::Enum(0)));
+    assert_eq!(
+        ["transform/position", "transform/scale", "transform/rotation", "transform/startOpacity", "transform/endOpacity"].map(|id| v(r, id)),
+        [Value::Vec2([150.0, 60.0]), Value::Vec2([90.0, 80.0]), Value::Scalar(10.0), Value::Scalar(100.0), Value::Scalar(40.0)]
+    );
+    let o = skip!(items("710-shape-offset-paths-20-round.aep"));
+    let o = find(&o, "offset");
+    assert_eq!(
+        (v(o, "amount"), v(o, "join"), v(o, "miter"), v(o, "copies"), v(o, "copyOffset")),
+        (Value::Scalar(20.0), Value::Enum(1), Value::Scalar(4.0), Value::Scalar(1.0), Value::Scalar(0.0))
+    );
+}
+
+/// After Effects offsets copy i by Amount x (i + Copy Offset) (826-828): 828 (Amount 20, Copies 3,
+/// Copy Offset 1.5) draws rings at 30, 50, 70 px; EffectCraft's copy i is Amount x (i + 1 +
+/// copyOffset), so copyOffset is 0.5.
+#[test]
+fn offset_paths_copy_offset_is_after_effects_minus_one() {
+    let i = skip!(items("828-shape-offset-paths-20-copies3-copyoffset1.5-stroke.aep"));
+    let o = find(&i, "offset");
+    assert_eq!((v(o, "amount"), v(o, "copies"), v(o, "copyOffset")), (Value::Scalar(20.0), Value::Scalar(3.0), Value::Scalar(0.5)));
+    let rings: Vec<f64> = (0..3).map(|k| 20.0 * (f64::from(k) + 1.0 + 0.5)).collect();
+    assert_eq!(rings, [30.0, 50.0, 70.0]);
+}
+
+#[test]
+fn shape_operator_defaults_are_after_effects_ones() {
+    let i = skip!(items("731-shape-merge-offset-repeater-defaults.aep"));
+    assert_eq!(v(find(&i, "merge"), "mode"), Value::Enum(0));
+    let o = find(&i, "offset");
+    assert_eq!((v(o, "amount"), v(o, "join"), v(o, "copyOffset")), (Value::Scalar(10.0), Value::Enum(0), Value::Scalar(0.0)));
+    let r = find(&i, "repeater");
+    assert_eq!((v(r, "copies"), v(r, "transform/position")), (Value::Scalar(1.0), Value::Vec2([0.0, 0.0])));
+}
+
+#[test]
+fn parallel_and_ambient_lights_arrive() {
+    use effectcraft_project::{LayerSource, LightKind};
+    for (name, l, kind, intensity, colour) in [
+        ("701-light-parallel-int80-color.aep", "P", LightKind::Parallel, 80.0, [1.0, 0.5, 0.25]),
+        ("702-light-ambient-int50-color.aep", "A", LightKind::Ambient, 50.0, [0.25, 0.5, 1.0]),
+    ] {
+        let (p, r) = load!(name);
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        let light = layer(&p, &r, l);
+        assert!(matches!(light.source, LayerSource::Light { kind: k } if k == kind), "{name}: {:?}", light.source);
+        let o = light.props.sub("lightOptions").expect("light options");
+        assert_eq!(v(o, "intensity"), Value::Scalar(intensity));
+        let Value::Color(c) = v(o, "color") else { panic!() };
+        assert!((0..3).all(|i| (c[i] - colour[i]).abs() < 1e-3), "{c:?}");
+    }
+}
+
+#[test]
+fn keyed_orientation_arrives() {
+    let (p, r) = load!("703-key-orientation-0-to-10-20-30-linear.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let o = layer(&p, &r, "L").props.prop("transform/orientation").unwrap();
+    assert_eq!(o.keys.iter().map(|k| k.value.clone()).collect::<Vec<_>>(), [Value::Vec3([0.0; 3]), Value::Vec3([10.0, 20.0, 30.0])]);
+    assert_eq!(o.keys[1].time, effectcraft_time::Tick(2 * effectcraft_time::TICKS_PER_SECOND));
+}
diff --git a/crates/aep/tests/it/import/styles.rs b/crates/aep/tests/it/import/styles.rs
new file mode 100644
index 000000000..bc2411e9a
--- /dev/null
+++ b/crates/aep/tests/it/import/styles.rs
@@ -0,0 +1,192 @@
+//! Layer styles (951-979): the applied styles arrive with After Effects' defaults and the stored
+//! values, keys and Blending Options, without losses.
+
+use crate::import::helpers::comp;
+use effectcraft_keyframe::Value;
+use effectcraft_project::styles::{BLENDING, GROUP, STYLE_BLEND_MODES};
+use effectcraft_project::{Comp, Layer, Project, PropGroup};
+use effectcraft_time::Tick;
+
+fn lossless(name: &str) -> Option<(Project, Comp)> {
+    Some({
+        let mut p = Project::default();
+        let r = crate::import::helpers::try_import_fixture(&mut p, name, false)?.unwrap_or_else(|e| panic!("{name}: lossless import refused: {e}"));
+        let (_, c) = comp(&p, &r, "C");
+        let c = c.clone();
+        (p, c)
+    })
+}
+
+fn b(c: &Comp) -> &Layer {
+    c.layers.iter().find(|l| l.name == "B").expect("B")
+}
+
+fn style<'a>(l: &'a Layer, id: &str) -> &'a PropGroup {
+    l.props.sub(GROUP).and_then(|g| g.sub(id)).unwrap_or_else(|| panic!("no style {id}"))
+}
+
+fn v(g: &PropGroup, id: &str) -> Value {
+    g.get(id).unwrap_or_else(|| panic!("no {id} in {}", g.match_id)).value.clone()
+}
+
+fn mode(name: &str) -> Value {
+    Value::Enum(STYLE_BLEND_MODES.iter().position(|m| m.0 == name).expect("mode") as u32)
+}
+
+fn s(x: f64) -> Value {
+    Value::Scalar(x)
+}
+
+fn rgb(r: f64, g: f64, b: f64) -> Value {
+    Value::Color([r, g, b, 1.0])
+}
+
+#[test]
+fn all_nine_at_after_effects_defaults() {
+    let (_, c) = skip!(lossless("951-styles-all-nine-defaults-on-B.aep"));
+    let l = b(&c);
+    let ls = l.props.sub(GROUP).expect("layer styles");
+    let ids: Vec<&str> = ls.children.iter().map(|n| n.match_id()).collect();
+    assert_eq!(ids, [BLENDING, "dropShadow", "innerShadow", "outerGlow", "innerGlow", "bevelEmboss", "satin", "colorOverlay", "gradientOverlay", "stroke"]);
+    assert!(ls.groups().all(|g| g.enabled));
+    let ds = style(l, "dropShadow");
+    assert_eq!((v(ds, "blendMode"), v(ds, "opacity"), v(ds, "angle")), (mode("Multiply"), s(75.0), s(120.0)));
+    // After Effects' Use Global Light is off by default (EffectCraft's own default is on).
+    assert_eq!(v(ds, "useGlobalLight"), Value::Bool(false));
+    assert_eq!(v(style(l, "outerGlow"), "blendMode"), mode("Screen"));
+    assert_eq!(v(style(l, "innerGlow"), "source"), Value::Enum(1), "Edge");
+    assert_eq!(v(style(l, "bevelEmboss"), "style"), Value::Enum(1), "Inner Bevel");
+    assert_eq!(v(style(l, "bevelEmboss"), "useGlobalLight"), Value::Bool(false));
+    assert_eq!(v(style(l, "satin"), "invert"), Value::Bool(true));
+    assert_eq!(v(style(l, "colorOverlay"), "color"), rgb(1.0, 0.0, 0.0));
+    assert_eq!(v(style(l, "stroke"), "size"), s(3.0));
+    // The footage layer S has none.
+    let sl = c.layers.iter().find(|l| l.name == "S").expect("S");
+    assert!(sl.props.sub(GROUP).is_none());
+}
+
+#[test]
+fn stored_values_in_ui_units() {
+    let (_, c) = skip!(lossless("966-style-drop-shadow-opacity50-distance20.aep"));
+    let l = b(&c);
+    assert_eq!(l.props.sub(GROUP).map(|g| g.children.len()), Some(2), "Blending Options + Drop Shadow");
+    let ds = style(l, "dropShadow");
+    assert_eq!((v(ds, "opacity"), v(ds, "distance"), v(ds, "size")), (s(50.0), s(20.0), s(5.0)));
+    let (_, c) = skip!(lossless("970-style-stroke-size10-color-green.aep"));
+    let st = style(b(&c), "stroke");
+    assert_eq!((v(st, "size"), v(st, "color")), (s(10.0), rgb(0.0, 1.0, 0.0)));
+    let (_, c) = skip!(lossless("974-style-gradient-overlay-angle45-scale150.aep"));
+    let go = style(b(&c), "gradientOverlay");
+    assert_eq!((v(go, "angle"), v(go, "scale")), (s(45.0), s(150.0)));
+    let (_, c) = skip!(lossless("975-style-fill-opacity0-with-drop-shadow.aep"));
+    let adv = b(&c).props.sub(GROUP).and_then(|g| g.sub(BLENDING)).and_then(|g| g.sub("advancedBlending")).expect("advanced");
+    assert_eq!(v(adv, "fillOpacity"), s(0.0));
+    let (_, c) = skip!(lossless("979-style-inner-glow-source-2.aep"));
+    assert_eq!(v(style(b(&c), "innerGlow"), "source"), Value::Enum(0), "Center");
+}
+
+#[test]
+fn keyed_opacity() {
+    let (_, c) = skip!(lossless("976-style-drop-shadow-opacity-keyed-100-20-linear.aep"));
+    let p = style(b(&c), "dropShadow").get("opacity").expect("opacity");
+    assert_eq!(p.keys.len(), 2);
+    assert_eq!(p.value_at(Tick::from_seconds_f64(1.0)), s(60.0), "After Effects reads 60 at 1 s");
+}
+
+#[test]
+fn every_parameter_of_977() {
+    let (_, c) = skip!(lossless("977-styles-all-params-changed.aep"));
+    let l = b(&c);
+    // Global Light is the composition's and every layer's Blending Options mirror it.
+    assert_eq!((c.global_light.angle.value.clone(), c.global_light.altitude.value.clone()), (s(45.0), s(40.0)));
+    let bo = l.props.sub(GROUP).and_then(|g| g.sub(BLENDING)).expect("blending");
+    assert_eq!(v(bo, "globalLightAngle"), s(45.0));
+    let adv = bo.sub("advancedBlending").expect("advanced");
+    assert_eq!(
+        (v(adv, "fillOpacity"), v(adv, "red"), v(adv, "green"), v(adv, "blendInteriorAsGroup"), v(adv, "useBlendRanges")),
+        (s(80.0), Value::Bool(false), Value::Bool(true), Value::Bool(true), Value::Bool(false))
+    );
+    let ds = style(l, "dropShadow");
+    assert_eq!(
+        [
+            v(ds, "blendMode"),
+            v(ds, "color"),
+            v(ds, "opacity"),
+            v(ds, "useGlobalLight"),
+            v(ds, "angle"),
+            v(ds, "distance"),
+            v(ds, "spread"),
+            v(ds, "size"),
+            v(ds, "noise"),
+            v(ds, "knocksOut")
+        ],
+        [mode("Normal"), rgb(0.0, 0.0, 1.0), s(60.0), Value::Bool(true), s(30.0), s(12.0), s(10.0), s(8.0), s(5.0), Value::Bool(false)]
+    );
+    let og = style(l, "outerGlow");
+    assert_eq!(
+        [v(og, "colorType"), v(og, "technique"), v(og, "range"), v(og, "jitter"), v(og, "gradientSmoothness")],
+        [Value::Enum(1), Value::Enum(1), s(40.0), s(10.0), s(80.0)]
+    );
+    assert_eq!(v(style(l, "innerGlow"), "source"), Value::Enum(0));
+    let be = style(l, "bevelEmboss");
+    assert_eq!(
+        [
+            v(be, "style"),
+            v(be, "technique"),
+            v(be, "depth"),
+            v(be, "direction"),
+            v(be, "soften"),
+            v(be, "altitude"),
+            v(be, "highlightMode"),
+            v(be, "shadowColor")
+        ],
+        [Value::Enum(0), Value::Enum(1), s(150.0), Value::Enum(1), s(3.0), s(50.0), mode("Normal"), rgb(0.0, 0.0, 1.0)]
+    );
+    let sa = style(l, "satin");
+    assert_eq!([v(sa, "angle"), v(sa, "invert"), v(sa, "color")], [s(45.0), Value::Bool(false), rgb(1.0, 0.0, 1.0)]);
+    let co = style(l, "colorOverlay");
+    assert_eq!([v(co, "blendMode"), v(co, "opacity")], [mode("Multiply"), s(50.0)]);
+    let go = style(l, "gradientOverlay");
+    assert_eq!(
+        [v(go, "style"), v(go, "reverse"), v(go, "alignWithLayer"), v(go, "offset"), v(go, "angle")],
+        [Value::Enum(1), Value::Bool(true), Value::Bool(false), Value::Vec2([10.0, 20.0]), s(30.0)]
+    );
+    let st = style(l, "stroke");
+    assert_eq!([v(st, "position"), v(st, "size"), v(st, "blendMode")], [Value::Enum(1), s(6.0), mode("Multiply")]);
+}
+
+#[test]
+fn blending_options_without_a_style_are_reported() {
+    // 977 with every style marked unused (`tdsb` 2): its Blending Options values have no style.
+    let mut bytes = fixture!("977-styles-all-params-changed.aep");
+    let mut at = 0;
+    let mut marked = 0;
+    while let Some(i) = bytes[at..].windows(9).position(|w| w == b"/enabled\0").map(|i| at + i) {
+        let t = i + bytes[i..].windows(4).position(|w| w == b"tdsb").expect("tdsb");
+        bytes[t + 8..t + 12].copy_from_slice(&2u32.to_be_bytes());
+        marked += 1;
+        at = t + 12;
+    }
+    assert!(marked >= 9, "{marked}");
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let opts = effectcraft_aep::import::ImportOptions { allow_losses: true, ..effectcraft_aep::import::ImportOptions::new(&none) };
+    let r = effectcraft_aep::import::import(&mut p, &bytes, &opts).expect("import").report;
+    assert_eq!(r.imported.layer_styles, 0);
+    let lost = r.losses.iter().filter(|l| l.category == effectcraft_aep::import::LossCategory::LayerStyles).flat_map(|l| l.details.iter());
+    assert!(lost.clone().any(|d| d.contains("Blending Options set without a layer style")), "{:?}", r.losses);
+    // A layer without styles and without Blending Options values reports nothing.
+    let mut q = Project::default();
+    let base = fixture!("000-base.aep");
+    let r = effectcraft_aep::import::import(&mut q, &base, &effectcraft_aep::import::ImportOptions::new(&none)).expect("base").report;
+    assert_eq!(r.count(effectcraft_aep::import::LossCategory::LayerStyles), 0);
+}
+
+#[test]
+fn a_switched_off_style_arrives_switched_off() {
+    // 988: the Drop Shadow's switch group at `tdsb` 0 (After Effects does not draw it).
+    let (_, c) = skip!(lossless("988-style-drop-shadow-switched-off.aep"));
+    let ds = style(b(&c), "dropShadow");
+    assert!(!ds.enabled);
+    assert_eq!(v(ds, "opacity"), s(75.0));
+}
diff --git a/crates/aep/tests/it/import/synthetic.rs b/crates/aep/tests/it/import/synthetic.rs
new file mode 100644
index 000000000..8e4c28f16
--- /dev/null
+++ b/crates/aep/tests/it/import/synthetic.rs
@@ -0,0 +1,844 @@
+//! Hostile values in a small committed project (`tests/fixtures/synthetic.aep`), so these cases
+//! run without the external corpus.
+//!
+//! The project was made in After Effects 2026 with the working space set to None: one
+//! composition `C` (64x48, 25 fps) with an image sequence layer (`shot_[0001-0003].png`, three
+//! 8x8 PNGs) holding a Levels and a Glow effect, a solid layer and a folder. Levels' Clip To
+//! Output Black has the expression `2`, Glow's A & B Midpoint the expression `0.25`. The only
+//! change made to what After Effects wrote is that the one `Utf8` chunk holding an embedded
+//! colour profile was replaced by `{}`.
+
+use effectcraft_aep::import::{ImportOptions, ImportResult, LossCategory, import};
+use effectcraft_aep::{AepFile, Body, Chunk, parse, write};
+use effectcraft_project::{FootageKind, ItemKind, Project};
+
+const SYNTHETIC: &[u8] = include_bytes!("../../fixtures/synthetic.aep");
+
+fn visit(chunks: &mut [Chunk<'_>], f: &mut dyn FnMut(&mut Chunk<'_>)) {
+    for c in chunks {
+        f(c);
+        visit(c.children_mut(), f);
+    }
+}
+
+/// The project with `edit` applied to every chunk.
+fn mutate(edit: &mut dyn FnMut(&mut Chunk<'_>)) -> Vec<u8> {
+    let mut file: AepFile<'_> = parse(SYNTHETIC).unwrap();
+    visit(&mut file.chunks, edit);
+    write(&file).unwrap()
+}
+
+fn set_data(c: &mut Chunk<'_>, at: usize, bytes: &[u8]) {
+    if let Body::Data(d) = &mut c.body {
+        let d = d.to_mut();
+        for (i, b) in bytes.iter().enumerate() {
+            if let Some(slot) = d.get_mut(at + i) {
+                *slot = *b;
+            }
+        }
+    }
+}
+
+fn run(bytes: &[u8], allow_losses: bool) -> (Project, Result<ImportResult, effectcraft_aep::import::AepImportError>) {
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut project, bytes, &ImportOptions { allow_losses, ..ImportOptions::new(&none) });
+    (project, r)
+}
+
+fn losses(r: &ImportResult, category: LossCategory) -> Vec<String> {
+    r.report.losses.iter().filter(|l| l.category == category).flat_map(|l| l.details.clone()).collect()
+}
+
+#[test]
+fn the_unchanged_project_imports_its_sequence() {
+    let (p, r) = run(SYNTHETIC, true);
+    r.unwrap();
+    let seq = p.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).expect("the sequence");
+    assert_eq!((seq.kind, seq.sequence.len()), (FootageKind::Sequence, 3));
+}
+
+#[test]
+fn a_sequence_with_long_names_is_not_expanded_past_the_byte_budget() {
+    // 100 000 frames (within the frame limits) of 400-character names are 40 MB of strings.
+    let bytes = mutate(&mut |c| {
+        if c.id == *b"sspc" {
+            set_data(c, 176, &100_000u32.to_be_bytes());
+        }
+        if c.id == *b"Utf8" && c.bytes() == Some(b"shot_") {
+            *c = Chunk::data(*b"Utf8", vec![b'a'; 400]);
+        }
+    });
+    let (p, r) = run(&bytes, true);
+    let r = r.unwrap();
+    let found = losses(&r, LossCategory::DamagedData);
+    assert!(found.iter().any(|d| d.contains("longer than the import expands")), "{found:?}");
+    let longest = p.items.values().filter_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.sequence.len()) } else { None }).max().unwrap_or(0);
+    assert_eq!(longest, 0, "the sequence was not expanded");
+}
+
+/// The project with the sequence's naming (the chunks between `Als2` and `opti` in its `Pin `)
+/// replaced by `naming`, and the `sspc` numbering (start, end, digits at 172, 176, 180) set to
+/// `numbering` when given.
+fn with_sequence_naming(naming: &[Chunk<'static>], numbering: Option<[u32; 3]>) -> Vec<u8> {
+    let mut file: AepFile<'_> = parse(SYNTHETIC).unwrap();
+    let mut patched = 0;
+    visit(&mut file.chunks, &mut |c| {
+        if !c.is_list(b"Pin ") {
+            return;
+        }
+        let Body::List { children, .. } = &mut c.body else { return };
+        let Some(als) = children.iter().position(|k| k.is_list(b"Als2")) else { return };
+        let Some(opti) = children.iter().position(|k| k.is(b"opti")) else { return };
+        assert!(als < opti);
+        let tail = children.split_off(opti);
+        children.truncate(als + 1);
+        children.extend(naming.iter().map(shorten));
+        children.extend(tail);
+        if let Some(numbering) = numbering {
+            let sspc = children.iter_mut().find(|k| k.is(b"sspc")).unwrap();
+            for (at, v) in [172, 176, 180].into_iter().zip(numbering) {
+                set_data(sspc, at, &v.to_be_bytes());
+            }
+        }
+        patched += 1;
+    });
+    assert_eq!(patched, 1, "the synthetic project has one sequence");
+    write(&file).unwrap()
+}
+
+/// `bytes` with the first file name the sequence stores in its png `opti` (byte 58, NUL-terminated)
+/// set to `name`.
+fn with_first_file(bytes: &[u8], name: &str) -> Vec<u8> {
+    let mut file: AepFile<'_> = parse(bytes).unwrap();
+    let mut patched = 0;
+    visit(&mut file.chunks, &mut |c| {
+        if c.is(b"opti") && c.bytes().is_some_and(|d| d.get(..4) == Some(&b"png!"[..])) {
+            let mut z = name.as_bytes().to_vec();
+            z.push(0);
+            set_data(c, 58, &z);
+            patched += 1;
+        }
+    });
+    assert_eq!(patched, 1, "the synthetic project has one png item");
+    write(&file).unwrap()
+}
+
+/// The imported sequence item's footage.
+fn the_footage(p: &Project) -> effectcraft_project::Footage {
+    p.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).expect("the sequence")
+}
+
+/// The file names (without the folder) of a footage's sequence.
+fn file_names(f: &effectcraft_project::Footage) -> Vec<String> {
+    f.sequence.iter().map(|s| s.rsplit(['\\', '/']).next().unwrap_or_default().to_string()).collect()
+}
+
+/// A copy of `c` that borrows for any lifetime (a chunk is covariant in its lifetime).
+fn shorten<'a>(c: &Chunk<'static>) -> Chunk<'a> {
+    c.clone()
+}
+
+/// A `Utf8` string chunk holding `s`.
+fn utf8(s: &str) -> Chunk<'static> {
+    Chunk::data(*b"Utf8", s.as_bytes().to_vec())
+}
+
+/// A sequence whose naming has only a suffix (no filename prefix) imports as a sequence of its files.
+#[test]
+fn a_sequence_without_a_filename_prefix_imports_its_files() {
+    // `0001.png` .. `0003.png`: After Effects omits the empty prefix, so only `.png` follows the
+    // alias. Before, `.png` was read as the prefix, the suffix was missing and the item became a
+    // video linked to its folder.
+    let (p, r) = run(&with_sequence_naming(&[utf8(".png")], None), true);
+    r.unwrap();
+    let f = the_footage(&p);
+    assert_eq!(f.kind, FootageKind::Sequence);
+    assert_eq!(file_names(&f), ["0001.png", "0002.png", "0003.png"]);
+    assert!(f.path.ends_with("0001.png"), "{}", f.path);
+}
+
+/// A single `Utf8` naming part is read as the suffix or the prefix depending on how the stored first file name matches it.
+#[test]
+fn a_single_naming_part_is_placed_by_the_stored_first_file_name() {
+    // `0001_v2.png` ..: the one `Utf8` is the suffix, as the first file name (`opti`) ends with it.
+    let bytes = with_first_file(&with_sequence_naming(&[utf8("_v2.png")], None), "0001_v2.png");
+    let (p, r) = run(&bytes, true);
+    r.unwrap();
+    let f = the_footage(&p);
+    assert_eq!(f.kind, FootageKind::Sequence);
+    assert_eq!(file_names(&f), ["0001_v2.png", "0002_v2.png", "0003_v2.png"]);
+    // `shot_0001` ..: a name without an extension; the one `Utf8` is the prefix.
+    let bytes = with_first_file(&with_sequence_naming(&[utf8("shot_")], None), "shot_0001");
+    let (p, r) = run(&bytes, true);
+    r.unwrap();
+    assert_eq!(file_names(&the_footage(&p)), ["shot_0001", "shot_0002", "shot_0003"]);
+    // Without that evidence (the stored first file is `shot_0001.png`), a part that is no extension
+    // is not guessed: the item is reported.
+    let bytes = with_sequence_naming(&[utf8("_v2.png")], None);
+    reported_and_refused(&bytes, LossCategory::DamagedData, "image sequence naming not read, linked to its folder");
+}
+
+/// A file list containing a name with a separator, drive colon, dot directory or control character is refused and reported.
+#[test]
+fn a_file_list_with_a_name_that_is_not_a_plain_file_name_is_reported() {
+    // The listed names are joined to the folder: a separator, a drive colon or a dot directory
+    // would point outside it, and a NUL or another control character is no file name, so such a
+    // list is not read.
+    for hostile in ["..\\..\\x.png", "../x.png", "C:x.png", "..", ".", "x\0.png", "x\n.png"] {
+        let list = Chunk::list(*b"StVc", vec![Chunk::data(*b"StVS", 2u32.to_le_bytes().to_vec()), utf8("a.png"), utf8(hostile)]);
+        let bytes = with_sequence_naming(&[list], Some([u32::MAX, u32::MAX, 0]));
+        reported_and_refused(&bytes, LossCategory::DamagedData, "image sequence naming not read, linked to its folder");
+    }
+}
+
+/// A file list with a missing or too short count chunk is refused and reported.
+#[test]
+fn a_file_list_without_a_readable_count_is_reported() {
+    // No `StVS`, or one too short for its `u32`: the list is not read rather than taken whole.
+    for count in [None, Some(vec![2u8, 0])] {
+        let mut kids: Vec<Chunk<'static>> = count.map(|c| Chunk::data(*b"StVS", c)).into_iter().collect();
+        kids.extend([utf8("a.png"), utf8("b.png")]);
+        let bytes = with_sequence_naming(&[Chunk::list(*b"StVc", kids)], Some([u32::MAX, u32::MAX, 0]));
+        reported_and_refused(&bytes, LossCategory::DamagedData, "image sequence naming not read, linked to its folder");
+    }
+}
+
+/// A force-alphabetical sequence imports its stored file list in the stored order.
+#[test]
+fn a_sequence_imported_with_force_alphabetical_order_imports_its_file_list() {
+    // Force alphabetical order: `LIST StVc` with `StVS` (the count, little-endian) and one `Utf8`
+    // per file instead of the prefix and suffix; the numbering in `sspc` is not set. Before, the
+    // item became a video linked to its folder.
+    let list = Chunk::list(*b"StVc", vec![Chunk::data(*b"StVS", 3u32.to_le_bytes().to_vec()), utf8("b_take.png"), utf8("a_take.png"), utf8("c_take.png")]);
+    let (p, r) = run(&with_sequence_naming(&[list], Some([u32::MAX, u32::MAX, 0])), true);
+    let r = r.unwrap();
+    let f = the_footage(&p);
+    assert_eq!(f.kind, FootageKind::Sequence);
+    // The stored order is kept.
+    assert_eq!(file_names(&f), ["b_take.png", "a_take.png", "c_take.png"]);
+    assert!(f.path.ends_with("b_take.png"), "{}", f.path);
+    assert!(losses(&r, LossCategory::DamagedData).is_empty(), "{:?}", r.report.losses);
+    // The count bounds the list.
+    let list = Chunk::list(*b"StVc", vec![Chunk::data(*b"StVS", 2u32.to_le_bytes().to_vec()), utf8("x.png"), utf8("y.png"), utf8("z.png")]);
+    let (p, r) = run(&with_sequence_naming(&[list], Some([u32::MAX, u32::MAX, 0])), true);
+    r.unwrap();
+    assert_eq!(file_names(&the_footage(&p)), ["x.png", "y.png"]);
+}
+
+/// A sequence with no naming or an empty file list is reported and linked to its folder.
+#[test]
+fn a_sequence_whose_naming_cannot_be_read_is_reported() {
+    // No naming at all after the alias. Before, the item silently linked its folder.
+    let bytes = with_sequence_naming(&[], None);
+    reported_and_refused(&bytes, LossCategory::DamagedData, "image sequence naming not read, linked to its folder");
+    // An empty file list is no naming either.
+    let empty = Chunk::list(*b"StVc", vec![Chunk::data(*b"StVS", 0u32.to_le_bytes().to_vec())]);
+    let bytes = with_sequence_naming(&[empty], Some([u32::MAX, u32::MAX, 0]));
+    reported_and_refused(&bytes, LossCategory::DamagedData, "image sequence naming not read, linked to its folder");
+}
+
+#[test]
+fn a_solid_with_a_nan_channel_is_repaired_and_reported() {
+    let nan = f32::NAN.to_be_bytes();
+    let bytes = mutate(&mut |c| {
+        // The solid's colour: ARGB as four f32 from byte 10 of `opti`.
+        if c.id == *b"opti" && c.bytes().is_some_and(|d| d.len() > 22 && d.get(..4) == Some(b"Soli")) {
+            set_data(c, 14, &nan);
+        }
+    });
+    let (p, r) = run(&bytes, true);
+    let r = r.unwrap();
+    for item in p.items.values() {
+        if let ItemKind::Solid(s) = &item.kind {
+            assert!(s.color.iter().all(|c| c.is_finite()), "{:?}", s.color);
+        }
+    }
+    assert!(losses(&r, LossCategory::DamagedData).iter().any(|d| d.contains("not a number")), "{:?}", r.report.losses);
+    // Strict import refuses and leaves the project alone.
+    let (p, r) = run(&bytes, false);
+    assert!(r.is_err());
+    assert_eq!(p.items.values().count(), 0);
+}
+
+#[test]
+fn expressions_on_converted_effect_parameters_are_reported_not_imported() {
+    let (p, r) = run(SYNTHETIC, true);
+    let r = r.unwrap();
+    let found = losses(&r, LossCategory::Effects);
+    assert!(found.iter().any(|d| d.contains("expression") && d.contains("Clip To Output Black")), "{found:?}");
+    assert!(found.iter().any(|d| d.contains("expression") && d.contains("Midpoint")), "{found:?}");
+    for item in p.items.values() {
+        if let ItemKind::Comp(c) = &item.kind {
+            for layer in &c.layers {
+                if let Some(fx) = layer.effects() {
+                    fx.walk("", &mut |path, prop| assert!(prop.expr.is_none(), "an expression on the converted parameter {path}"));
+                }
+            }
+        }
+    }
+}
+
+/// Imports `bytes` with and without allowing losses: the lenient import reports `needle` under
+/// `category`, the strict one refuses and leaves the project empty.
+fn reported_and_refused(bytes: &[u8], category: LossCategory, needle: &str) {
+    let (_, r) = run(bytes, true);
+    let r = r.unwrap();
+    let found = losses(&r, category);
+    assert!(found.iter().any(|d| d.contains(needle)), "{needle:?} not in {:?}", r.report.losses);
+    let (p, r) = run(bytes, false);
+    assert!(r.is_err(), "strict import must refuse");
+    assert!(p.items.is_empty(), "a refused import leaves the project alone");
+}
+
+#[test]
+fn the_unchanged_project_has_no_damage_reports() {
+    let (_, r) = run(SYNTHETIC, true);
+    let r = r.unwrap();
+    for c in [LossCategory::DamagedData, LossCategory::TextLayers, LossCategory::ProjectSettings] {
+        assert!(losses(&r, c).is_empty(), "{c:?}: {:?}", r.report.losses);
+    }
+}
+
+#[test]
+fn a_folder_without_its_contents_list_is_reported() {
+    // After Effects writes an empty `Sfdr` for an empty folder; removing it damages the folder.
+    let mut removed = 0;
+    let bytes = {
+        let mut file = parse(SYNTHETIC).unwrap();
+        fn drop_empty_sfdr(chunks: &mut Vec<Chunk<'_>>, n: &mut usize) {
+            chunks.retain(|c| {
+                let empty = c.is_list(b"Sfdr") && c.children().is_empty();
+                *n += usize::from(empty);
+                !empty
+            });
+            for c in chunks.iter_mut() {
+                if let Body::List { children, .. } | Body::Chunks(children) = &mut c.body {
+                    drop_empty_sfdr(children, n);
+                }
+            }
+        }
+        drop_empty_sfdr(&mut file.chunks, &mut removed);
+        write(&file).unwrap()
+    };
+    assert_eq!(removed, 1, "the synthetic project has one empty folder");
+    reported_and_refused(&bytes, LossCategory::DamagedData, "contents list is missing");
+}
+
+#[test]
+fn invalid_timing_is_reported() {
+    // The work area ends before it starts (cdta bytes 28 and 36).
+    let bytes = mutate(&mut |c| {
+        if c.id == *b"cdta" {
+            set_data(c, 28, &10u32.to_be_bytes());
+            set_data(c, 36, &5u32.to_be_bytes());
+        }
+    });
+    reported_and_refused(&bytes, LossCategory::DamagedData, "work area");
+    // A pixel aspect ratio with a zero denominator.
+    let bytes = mutate(&mut |c| {
+        if c.id == *b"cdta" {
+            set_data(c, 148, &0u32.to_be_bytes());
+        }
+    });
+    reported_and_refused(&bytes, LossCategory::DamagedData, "pixel aspect");
+    // A layer with a zero time stretch (ldta bytes 8 and 108).
+    let bytes = mutate(&mut |c| {
+        if c.id == *b"ldta" {
+            set_data(c, 8, &0u32.to_be_bytes());
+        }
+    });
+    reported_and_refused(&bytes, LossCategory::DamagedData, "time stretch");
+}
+
+#[test]
+fn an_unknown_colour_depth_code_is_reported() {
+    let bytes = mutate(&mut |c| {
+        if c.id == *b"nhed" {
+            set_data(c, 15, &[7]);
+        }
+    });
+    let (_, r) = run(&bytes, true);
+    let r = r.unwrap();
+    assert!(losses(&r, LossCategory::ProjectSettings).iter().any(|d| d.contains("colour depth code 7")), "{:?}", r.report.losses);
+}
+
+/// The project with every `LIST` of type `list_type` made unreadable: its content replaced by three
+/// bytes that are no chunk sequence, so the reader keeps it as an opaque list. Returns the bytes and
+/// how many lists were damaged.
+fn damage_lists(list_type: &[u8; 4], only_empty: bool) -> (Vec<u8>, usize) {
+    fn walk(chunks: &mut [Chunk<'_>], list_type: &[u8; 4], only_empty: bool, n: &mut usize) {
+        for c in chunks.iter_mut() {
+            if c.is_list(list_type) && (!only_empty || c.children().is_empty()) {
+                c.body = Body::OpaqueList { list_type: *list_type, data: vec![0xff; 3].into() };
+                *n += 1;
+            } else {
+                walk(c.children_mut(), list_type, only_empty, n);
+            }
+        }
+    }
+    let mut file = parse(SYNTHETIC).unwrap();
+    let mut n = 0;
+    walk(&mut file.chunks, list_type, only_empty, &mut n);
+    let bytes = write(&file).unwrap();
+    // The damage survives a round trip through the reader.
+    let reread = parse(&bytes).unwrap();
+    let mut opaque = 0;
+    fn count(chunks: &[Chunk<'_>], list_type: &[u8; 4], n: &mut usize) {
+        for c in chunks {
+            *n += usize::from(c.is_list(list_type) && c.is_opaque_list());
+            count(c.children(), list_type, n);
+        }
+    }
+    count(&reread.chunks, list_type, &mut opaque);
+    assert_eq!(opaque, n, "the damaged lists read back as opaque");
+    (bytes, n)
+}
+
+#[test]
+fn a_damaged_project_item_list_is_reported() {
+    // Before, the import gave an empty project folder and no loss.
+    let (bytes, n) = damage_lists(b"Fold", false);
+    assert_eq!(n, 1);
+    reported_and_refused(&bytes, LossCategory::DamagedData, "item list is damaged");
+}
+
+#[test]
+fn a_damaged_folder_contents_list_is_reported() {
+    let (bytes, n) = damage_lists(b"Sfdr", true);
+    assert_eq!(n, 1, "the synthetic project has one empty folder");
+    reported_and_refused(&bytes, LossCategory::DamagedData, "contents list is damaged");
+}
+
+/// The project with the `ldta` time at byte `at` (numerator, then denominator) set to `num/den`
+/// in every layer.
+fn layer_time(at: usize, num: i32, den: u32) -> Vec<u8> {
+    mutate(&mut |c| {
+        if c.id == *b"ldta" {
+            set_data(c, at, &num.to_be_bytes());
+            set_data(c, at + 4, &den.to_be_bytes());
+        }
+    })
+}
+
+#[test]
+fn layer_times_with_a_zero_denominator_are_reported() {
+    // ldta bytes 12 (start), 20 (in point) and 28 (out point), each a numerator and a
+    // denominator. Before, a zero denominator silently became 0 s.
+    for (at, what) in [(12, "start"), (20, "in point"), (28, "out point")] {
+        let bytes = layer_time(at, 2, 0);
+        reported_and_refused(&bytes, LossCategory::DamagedData, &format!("stored {what} time is unreadable"));
+    }
+    // A valid time with another denominator is no damage.
+    let (_, r) = run(&layer_time(12, 4, 2), true);
+    assert!(losses(&r.unwrap(), LossCategory::DamagedData).is_empty());
+}
+
+/// The time stretch of every imported layer.
+fn stretches(p: &Project) -> Vec<f64> {
+    p.items.values().filter_map(|i| if let ItemKind::Comp(c) = &i.kind { Some(c) } else { None }).flat_map(|c| c.layers.iter().map(|l| l.stretch)).collect()
+}
+
+#[test]
+fn a_time_stretch_outside_one_to_9900_percent_is_clamped_and_reported() {
+    // ldta byte 8 is the stretch numerator (i32), byte 108 the denominator (u32). 1/(2^31 - 1) is
+    // about 5e-8 %: imported as stored, the layer and audio time divided by ~0 (#3247).
+    for (num, den, want) in [(1i32, i32::MAX as u32, 1.0), (-1, i32::MAX as u32, -1.0), (i32::MAX, 1, 9900.0), (i32::MIN, 1, -9900.0)] {
+        let bytes = mutate(&mut |c| {
+            if c.id == *b"ldta" {
+                set_data(c, 8, &num.to_be_bytes());
+                set_data(c, 108, &den.to_be_bytes());
+            }
+        });
+        let (p, r) = run(&bytes, true);
+        let r = r.unwrap();
+        let found = losses(&r, LossCategory::DamagedData);
+        assert!(found.iter().any(|d| d.contains("time stretch") && d.contains("outside")), "{num}/{den}: {found:?}");
+        let s = stretches(&p);
+        assert!(!s.is_empty() && s.iter().all(|v| *v == want), "{num}/{den}: {s:?}");
+        let (p, r) = run(&bytes, false);
+        assert!(r.is_err(), "{num}/{den}: strict import must refuse");
+        assert!(p.items.is_empty());
+    }
+    // A small stretch within the range (1/64: 1.5625 %) and -9900 % itself are no damage.
+    for (num, den, want) in [(1i32, 64u32, 1.5625), (-99, 1, -9900.0)] {
+        let bytes = mutate(&mut |c| {
+            if c.id == *b"ldta" {
+                set_data(c, 8, &num.to_be_bytes());
+                set_data(c, 108, &den.to_be_bytes());
+            }
+        });
+        let (p, r) = run(&bytes, true);
+        let r = r.unwrap();
+        assert!(!losses(&r, LossCategory::DamagedData).iter().any(|d| d.contains("time stretch")), "{num}/{den}: {:?}", r.report.losses);
+        assert!(stretches(&p).iter().all(|v| *v == want), "{num}/{den}: {:?}", stretches(&p));
+    }
+}
+
+/// The project with `nhed` bytes from `at` replaced.
+fn header(at: usize, bytes: &[u8]) -> Vec<u8> {
+    mutate(&mut |c| {
+        if c.id == *b"nhed" {
+            set_data(c, at, bytes);
+        }
+    })
+}
+
+#[test]
+fn unknown_time_display_and_frame_start_codes_are_reported() {
+    // nhed byte 8: 0 timecode, 1 frames or feet + frames; byte 11 = 1 feet + frames, byte 13 the
+    // frames per foot (16 or 40); byte 14 the frame count start (2 from 0, 1 from 1).
+    reported_and_refused(&header(8, &[5]), LossCategory::ProjectSettings, "time display code 5/");
+    reported_and_refused(&header(8, &[1, 0, 0, 1, 0, 24]), LossCategory::ProjectSettings, "24 frames per foot");
+    reported_and_refused(&header(14, &[9]), LossCategory::ProjectSettings, "frame count start code 9");
+    // The known codes are no loss.
+    for (at, bytes) in [(8, &[1u8, 0, 0, 0][..]), (8, &[1, 0, 0, 1, 0, 16]), (8, &[1, 0, 0, 1, 0, 40]), (14, &[1])] {
+        let (_, r) = run(&header(at, bytes), true);
+        assert!(losses(&r.unwrap(), LossCategory::ProjectSettings).is_empty(), "nhed {at}: {bytes:?}");
+    }
+}
+
+/// The project with the value records named `param` (`<effect>-NNNN`: the instance's and the one in
+/// the project's copy of the effect, `EfdG`) set to state `tdsb` and holding `value` (the `cdat`
+/// starts with the big-endian `f64`).
+fn with_record(param: &str, tdsb: u32, value: f64) -> Vec<u8> {
+    let mut file: AepFile<'_> = parse(SYNTHETIC).unwrap();
+    let mut patched = 0;
+    visit(&mut file.chunks, &mut |c| {
+        if !c.is_list(b"tdgp") {
+            return;
+        }
+        let kids = c.children_mut();
+        let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.split(|x| *x == 0).next() == Some(param.as_bytes()))) else {
+            return;
+        };
+        let Some(record) = kids.get_mut(at + 1).filter(|k| k.is_list(b"tdbs")) else { return };
+        for k in record.children_mut() {
+            if k.is(b"tdsb") {
+                set_data(k, 0, &tdsb.to_be_bytes());
+            } else if k.is(b"cdat") {
+                set_data(k, 0, &value.to_be_bytes());
+            }
+        }
+        patched += 1;
+    });
+    assert_eq!(patched, 2, "{param}: the instance and the EfdG copy");
+    write(&file).unwrap()
+}
+
+/// The values of the imported effect parameters, by property id, in file order.
+fn effect_values(p: &Project) -> Vec<(String, effectcraft_keyframe::Value)> {
+    let mut out = Vec::new();
+    for item in p.items.values() {
+        if let ItemKind::Comp(c) = &item.kind {
+            for layer in &c.layers {
+                if let Some(fx) = layer.effects() {
+                    fx.walk("", &mut |_, prop| out.push((prop.match_id.clone(), prop.value.clone())));
+                }
+            }
+        }
+    }
+    out
+}
+
+/// A default-state record (`tdsb` 3) reads like a written one, except through `stored_value`.
+#[test]
+fn a_default_state_effect_record_holds_the_value() {
+    // After Effects writes the values of some parameters as records in the default state (`tdsb`
+    // 3): Lumetri Color's hidden controls (1200) and Cryptomatte's Selection Mode (1400), each
+    // read back as recorded. The reader reads them like a written record (`tdsb` 1).
+    let bytes = with_record("ADBE Glo2-0011", 3, 0.75);
+    let file = parse(&bytes).unwrap();
+    let project = effectcraft_aep::Project::new(&file).unwrap();
+    let defs = project.effect_definition_index();
+    let mut seen = 0;
+    for item in project.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for layer in comp.layers() {
+            for fx in layer.effects().iter().filter(|fx| fx.match_name() == "ADBE Glo2") {
+                let params = defs.params(fx);
+                let p = params.iter().find(|p| p.match_name == "ADBE Glo2-0011").unwrap();
+                assert_eq!(p.stored().and_then(|s| s.flags()), Some(3));
+                // `stored_value` keeps reading written records only.
+                assert_eq!(p.stored_value(), None);
+                assert_eq!(p.recorded_value(), Some(effectcraft_aep::ParamValue::Number(0.75)));
+                assert_eq!(p.value(), Some(effectcraft_aep::ParamValue::Number(0.75)));
+                assert_eq!(p.is_default(), Some(false));
+                seen += 1;
+            }
+        }
+    }
+    assert_eq!(seen, 1);
+}
+
+/// Default-state records import with their values and no loss, like written records.
+#[test]
+fn default_state_effect_records_import_like_written_ones() {
+    // Before, such a record was reported as an unreadable value and the default used.
+    for (param, value) in [("ADBE Glo2-0011", 0.75), ("ADBE Easy Levels2-0008", 1.0)] {
+        let (written, r1) = run(&with_record(param, 1, value), true);
+        let (default_state, r3) = run(&with_record(param, 3, value), true);
+        let (r1, r3) = (r1.unwrap(), r3.unwrap());
+        assert!(losses(&r3, LossCategory::DamagedData).is_empty(), "{param}: {:?}", r3.report.losses);
+        assert_eq!(r3.report.losses, r1.report.losses, "{param}");
+        assert_eq!(effect_values(&default_state), effect_values(&written), "{param}");
+    }
+    // Glow's A & B Midpoint 0.75 is 75 % (the default is 50).
+    let (p, _) = run(&with_record("ADBE Glo2-0011", 3, 0.75), true);
+    let mid: Vec<_> = effect_values(&p).into_iter().filter(|(id, _)| id == "abMidpoint").collect();
+    assert_eq!(mid, vec![("abMidpoint".to_string(), effectcraft_keyframe::Value::Scalar(75.0))]);
+    // Levels' Clip To Output Black (`-0008`) recorded as After Effects' item 1, On: EffectCraft's
+    // On is item 1 of Off, On, Off for 32 bpc Color (the default is item 2).
+    let (p, _) = run(&with_record("ADBE Easy Levels2-0008", 3, 1.0), true);
+    let clip: Vec<_> = effect_values(&p).into_iter().filter(|(id, _)| id == "clipToOutputBlack").collect();
+    assert_eq!(clip, vec![("clipToOutputBlack".to_string(), effectcraft_keyframe::Value::Enum(1))]);
+}
+
+/// Sets the `cdat` of the value record `param` in the value group `tdgp` (the first `f64`), and
+/// its state to `tdsb` when given. True when the group has that record.
+fn patch_record(tdgp: &mut Chunk<'_>, param: &str, tdsb: Option<u32>, value: f64) -> bool {
+    let kids = tdgp.children_mut();
+    let Some(at) = kids.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.split(|x| *x == 0).next() == Some(param.as_bytes()))) else {
+        return false;
+    };
+    let Some(record) = kids.get_mut(at + 1).filter(|k| k.is_list(b"tdbs")) else { return false };
+    for k in record.children_mut() {
+        if k.is(b"tdsb")
+            && let Some(state) = tdsb
+        {
+            set_data(k, 0, &state.to_be_bytes());
+        } else if k.is(b"cdat") {
+            set_data(k, 0, &value.to_be_bytes());
+        }
+    }
+    true
+}
+
+/// The project without its project-level effect definitions (`EfdG`; some files have none, seen
+/// in the projects inside After Effects-made Motion Graphics templates) and with a second Glow
+/// just above the first on the layer: a copy of it whose `parT` is empty, as such files write
+/// every instance of a type but one. `edit_copy` is applied to every chunk of the copy; with
+/// `empty_original` the original's `parT` is emptied too.
+fn second_glow_without_definitions(edit_copy: &mut dyn FnMut(&mut Chunk<'_>), empty_original: bool) -> Vec<u8> {
+    fn empty_part(fx: &mut Chunk<'_>) {
+        for k in fx.children_mut() {
+            if let Body::List { list_type, children, .. } = &mut k.body
+                && list_type == b"parT"
+            {
+                children.clear();
+            }
+        }
+    }
+    let mut file: AepFile<'_> = parse(SYNTHETIC).unwrap();
+    let mut added = 0;
+    visit(&mut file.chunks, &mut |c| {
+        if let Body::List { list_type, children, .. } = &mut c.body {
+            if list_type == b"EfdG" {
+                *list_type = *b"XfdG";
+                return;
+            }
+            if list_type != b"tdgp" {
+                return;
+            }
+            let Some(at) = children.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.split(|x| *x == 0).next() == Some(b"ADBE Glo2"))) else {
+                return;
+            };
+            let (Some(name), Some(mut fx)) = (children.get(at).cloned(), children.get(at + 1).filter(|k| k.is_list(b"sspc")).cloned()) else { return };
+            empty_part(&mut fx);
+            edit_copy(&mut fx);
+            visit(fx.children_mut(), edit_copy);
+            if empty_original && let Some(original) = children.get_mut(at + 1) {
+                empty_part(original);
+            }
+            children.insert(at, fx);
+            children.insert(at, name);
+            added += 1;
+        }
+    });
+    assert_eq!(added, 1, "one Glow on the layer");
+    write(&file).unwrap()
+}
+
+/// The imported Glows in stack order, each as its property values by property id.
+fn glow_values(p: &Project) -> Vec<Vec<(String, effectcraft_keyframe::Value)>> {
+    let glow = effectcraft_project::GroupKind::Effect { effect: "ec.stylize.glow".to_string() };
+    let mut glows = Vec::new();
+    for item in p.items.values() {
+        if let ItemKind::Comp(c) = &item.kind {
+            for layer in &c.layers {
+                for node in layer.effects().map(|fx| fx.children.as_slice()).unwrap_or_default() {
+                    if let effectcraft_project::Node::Group(g) = node
+                        && g.kind == glow
+                    {
+                        let mut values = Vec::new();
+                        g.walk("", &mut |_, prop| values.push((prop.match_id.clone(), prop.value.clone())));
+                        glows.push(values);
+                    }
+                }
+            }
+        }
+    }
+    glows
+}
+
+/// The value of property `id` in `values`.
+fn value_of<'v>(values: Option<&'v Vec<(String, effectcraft_keyframe::Value)>>, id: &str) -> Option<&'v effectcraft_keyframe::Value> {
+    values?.iter().find(|(i, _)| i == id).map(|(_, v)| v)
+}
+
+/// Every instance of an effect type but one has an empty `parT`; without a project-level copy the
+/// others borrow the definitions of that one (#3170: 129 Color Controls of a template were
+/// reported "without readable parameter definitions" and dropped).
+#[test]
+fn an_instance_without_definitions_imports_with_those_of_another_instance() {
+    // Both Glows import; before, the copy was reported and not imported.
+    let (p, r) = run(&second_glow_without_definitions(&mut |_| {}, false), true);
+    let r = r.unwrap();
+    let found = losses(&r, LossCategory::Effects);
+    assert!(!found.iter().any(|d| d.contains("without readable parameter definitions") || d.contains("no parameter definition")), "{found:?}");
+    assert_eq!(r.report.imported.effects, 3, "Levels and both Glows: {:?}", r.report.losses);
+    let glows = glow_values(&p);
+    assert_eq!(glows.len(), 2);
+    assert_eq!(glows.first(), glows.get(1), "the copy has the same records, so the same values");
+
+    // The values come from each instance's own records: the copy's A & B Midpoint (`-0011`) set
+    // to 0.75 arrives as 75 % in the copy only; the Glow it borrows from keeps its own.
+    let mut patched = 0;
+    let bytes = second_glow_without_definitions(
+        &mut |c| {
+            if c.is_list(b"tdgp") && patch_record(c, "ADBE Glo2-0011", None, 0.75) {
+                patched += 1;
+            }
+        },
+        false,
+    );
+    assert_eq!(patched, 1, "the copy's record");
+    let (p, r) = run(&bytes, true);
+    r.unwrap();
+    let glows = glow_values(&p);
+    let seventy_five = effectcraft_keyframe::Value::Scalar(75.0);
+    assert_eq!(value_of(glows.first(), "abMidpoint"), Some(&seventy_five));
+    let own = value_of(glows.get(1), "abMidpoint");
+    assert!(own.is_some() && own != Some(&seventy_five), "{own:?}");
+}
+
+/// A value record that the borrowed definitions do not name is reported, not dropped silently.
+#[test]
+fn a_value_record_the_borrowed_definitions_do_not_name_is_reported() {
+    let bytes = second_glow_without_definitions(
+        &mut |c| {
+            if c.is(b"tdmn") && c.bytes().is_some_and(|b| b.split(|x| *x == 0).next() == Some(b"ADBE Glo2-0011")) {
+                set_data(c, 0, b"ADBE Glo2-0099\0");
+            }
+        },
+        false,
+    );
+    let (_, r) = run(&bytes, true);
+    let r = r.unwrap();
+    let found = losses(&r, LossCategory::Effects);
+    assert!(found.iter().any(|d| d.contains("ADBE Glo2-0099") && d.contains("no parameter definition")), "{found:?}");
+    assert_eq!(r.report.imported.effects, 3, "{:?}", r.report.losses);
+}
+
+/// When no instance of the type keeps its definitions, every instance is reported.
+#[test]
+fn instances_without_any_definitions_are_reported() {
+    let (p, r) = run(&second_glow_without_definitions(&mut |_| {}, true), true);
+    let r = r.unwrap();
+    let found = losses(&r, LossCategory::Effects);
+    assert_eq!(found.iter().filter(|d| d.contains("ADBE Glo2") && d.contains("without readable parameter definitions, not imported")).count(), 2, "{found:?}");
+    assert_eq!(r.report.imported.effects, 1, "Levels only: {:?}", r.report.losses);
+    assert!(glow_values(&p).is_empty());
+}
+
+/// The reader's side: the copy's definitions come from the other instance.
+#[test]
+fn an_instance_without_definitions_reads_those_of_another_instance() {
+    let bytes = second_glow_without_definitions(&mut |_| {}, false);
+    let file = parse(&bytes).unwrap();
+    let project = effectcraft_aep::Project::new(&file).unwrap();
+    let defs = project.effect_definition_index();
+    let mut sources = Vec::new();
+    for item in project.all_items() {
+        let Some(comp) = item.comp() else { continue };
+        for layer in comp.layers() {
+            for fx in layer.effects().iter().filter(|fx| fx.match_name() == "ADBE Glo2") {
+                sources.push(defs.source(fx));
+                let params = defs.params(fx);
+                assert_eq!(params.len(), 16, "Glow's parameters");
+                assert_eq!(params.iter().all(|p| p.borrowed_definition), defs.source(fx) == effectcraft_aep::DefinitionSource::OtherInstance);
+            }
+        }
+    }
+    // The copy is above the instance it borrows from (earlier in the stack).
+    assert_eq!(sources, [effectcraft_aep::DefinitionSource::OtherInstance, effectcraft_aep::DefinitionSource::Instance]);
+}
+
+/// A record in a state other than 1 or 3 is not read and is reported.
+#[test]
+fn an_effect_record_in_another_state_is_reported_as_damaged() {
+    // Only the written (1) and the default (3) state hold a value; any other state is not read.
+    for tdsb in [0, 2, 5] {
+        let (_, r) = run(&with_record("ADBE Glo2-0011", tdsb, 0.75), true);
+        let r = r.unwrap();
+        let damaged = losses(&r, LossCategory::DamagedData);
+        assert!(damaged.iter().any(|l| l.contains("unreadable value")), "tdsb {tdsb}: {:?}", r.report.losses);
+    }
+}
+
+/// The project with a value record for Glow's Color A (`ADBE Glo2-0012`, which the project does
+/// not store) in state `tdsb` holding the ARGB doubles `argb` (0..255): a copy of the A & B
+/// Midpoint record (`-0011`) made a 4-component colour without its expression.
+fn with_color_a(tdsb: u32, argb: [f64; 4]) -> Vec<u8> {
+    let mut file: AepFile<'_> = parse(SYNTHETIC).unwrap();
+    let mut added = 0;
+    visit(&mut file.chunks, &mut |c| {
+        let Body::List { list_type, children, .. } = &mut c.body else { return };
+        if list_type != b"tdgp" {
+            return;
+        }
+        let Some(at) = children.iter().position(|k| k.is(b"tdmn") && k.bytes().is_some_and(|b| b.split(|x| *x == 0).next() == Some(b"ADBE Glo2-0011"))) else {
+            return;
+        };
+        let (Some(mut name), Some(mut record)) = (children.get(at).cloned(), children.get(at + 1).filter(|k| k.is_list(b"tdbs")).cloned()) else { return };
+        set_data(&mut name, 0, b"ADBE Glo2-0012\0");
+        if let Body::List { children: kids, .. } = &mut record.body {
+            kids.retain(|k| !k.is(b"Utf8"));
+            for k in kids.iter_mut() {
+                if k.is(b"tdsb") {
+                    set_data(k, 0, &tdsb.to_be_bytes());
+                } else if k.is(b"tdb4") {
+                    // 4 components; no expression (bytes 76, 77 and 120).
+                    set_data(k, 3, &[4]);
+                    for byte in [76, 77, 120] {
+                        set_data(k, byte, &[0]);
+                    }
+                } else if k.is(b"cdat") {
+                    *k = Chunk::data(*b"cdat", argb.iter().flat_map(|v| v.to_be_bytes()).collect::<Vec<u8>>());
+                }
+            }
+        }
+        children.insert(at + 2, record);
+        children.insert(at + 2, name);
+        added += 1;
+    });
+    assert_eq!(added, 2, "the instance and the EfdG copy");
+    write(&file).unwrap()
+}
+
+/// A colour recorded in the default state (`tdsb` 3) reads like a written one (#3170's "parameter
+/// Color ... holds an unreadable value" on 0.21.1, which read only written records).
+#[test]
+fn a_default_state_colour_record_holds_the_value() {
+    let argb = [255.0, 51.0, 153.0, 255.0];
+    let (written, r1) = run(&with_color_a(1, argb), true);
+    let (default_state, r3) = run(&with_color_a(3, argb), true);
+    let (r1, r3) = (r1.unwrap(), r3.unwrap());
+    assert!(losses(&r3, LossCategory::DamagedData).is_empty(), "{:?}", r3.report.losses);
+    assert_eq!(r3.report.losses, r1.report.losses);
+    let colour = |p: &Project| value_of(glow_values(p).first(), "colorA").cloned();
+    let (unchanged, _) = run(SYNTHETIC, true);
+    assert!(colour(&written).is_some());
+    assert_eq!(colour(&default_state), colour(&written));
+    assert_ne!(colour(&default_state), colour(&unchanged), "the recorded colour, not the default");
+}
diff --git a/crates/aep/tests/it/import/text.rs b/crates/aep/tests/it/import/text.rs
new file mode 100644
index 000000000..7a77fae03
--- /dev/null
+++ b/crates/aep/tests/it/import/text.rs
@@ -0,0 +1,511 @@
+//! Text layers: every text fixture imports with the values it was made with (the corpus
+//! MANIFEST), style runs, a parented text layer with Opacity keys, the font report and hostile
+//! text documents.
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{ImportOptions, ImportResult, LossCategory, import};
+use effectcraft_aep::{AepFile, Body, Chunk, parse, write};
+use effectcraft_keyframe::Value;
+use effectcraft_keyframe::text_doc::{Justify, TextDoc};
+use effectcraft_project::{Comp, ItemKind, Layer, LayerSource, Project};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+const WHITE: [f32; 4] = [1.0, 1.0, 1.0, 1.0];
+const RED: [f32; 4] = [1.0, 0.0, 0.0, 1.0];
+const BLUE: [f32; 4] = [0.0, 0.0, 1.0, 1.0];
+
+fn text_layer(c: &Comp) -> &Layer {
+    c.layers.iter().find(|l| l.name == "T").expect("text layer T")
+}
+
+fn source_text(l: &Layer) -> TextDoc {
+    match &l.props.prop("text/sourceText").expect("source text").value {
+        Value::Text(t) => (**t).clone(),
+        other => panic!("source text is {other:?}"),
+    }
+}
+
+fn vec3(l: &Layer, path: &str) -> [f64; 3] {
+    match l.props.prop(path).map(|p| p.value.clone()) {
+        Some(Value::Vec3(v)) => v,
+        other => panic!("{path}: {other:?}"),
+    }
+}
+
+/// Imports a fixture and returns the text layer's Source Text, checking what every text layer
+/// shares: a text layer on top of L, the text origin as anchor, Position at the comp centre, font
+/// Times New Roman, no stroke.
+fn imported(name: &str) -> Option<(TextDoc, ImportResult)> {
+    Some({
+        let (p, r) = crate::import::helpers::try_load(name)?;
+        let (_, c) = comp(&p, &r, "C");
+        assert_eq!(c.layers.len(), 2, "{name}");
+        let t = text_layer(c);
+        assert_eq!(c.layers[0].id, t.id, "{name}: T is the top layer");
+        assert!(c.layers.iter().any(|l| l.name == "L"), "{name}");
+        assert!(matches!(t.source, LayerSource::Text), "{name}");
+        assert_eq!(vec3(t, "transform/anchor"), [0.0, 0.0, 0.0], "{name}");
+        assert_eq!(vec3(t, "transform/position"), [960.0, 540.0, 0.0], "{name}");
+        assert_eq!(r.report.imported.text_layers, 1, "{name}");
+        let d = source_text(t);
+        for run in d.runs() {
+            assert_eq!(run.style.font, "TimesNewRomanPSMT", "{name}");
+            assert_eq!(run.style.style, "Regular", "{name}");
+            assert!(!run.style.apply_stroke, "{name}");
+        }
+        assert!(r.report.missing_fonts.is_empty(), "{name}: every font counts as installed by default");
+        (d, r)
+    })
+}
+
+/// The fixtures with nothing to lose.
+fn lossless(name: &str) -> Option<TextDoc> {
+    Some({
+        let (d, r) = imported(name)?;
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        d
+    })
+}
+
+#[test]
+fn point_text_defaults_size_and_fill() {
+    // 110: "A", Times New Roman 100 px, white.
+    let d = skip!(lossless("110-text-A.aep"));
+    assert_eq!((d.text.as_str(), d.size, d.fill, d.box_size), ("A", 100.0, WHITE, None));
+    assert_eq!((d.tracking, d.leading, d.justify), (0.0, Some(98.0), Justify::Left));
+    assert!(d.is_uniform());
+    assert!(!(d.faux_bold || d.faux_italic || d.all_caps || d.small_caps));
+    // 113: "Hello" at 60 px, orange [1, 0.5, 0].
+    let d = skip!(lossless("113-text-Hello-size60-fillorange.aep"));
+    assert_eq!((d.text.as_str(), d.size, d.fill), ("Hello", 60.0, [1.0, 0.5, 0.0, 1.0]));
+}
+
+#[test]
+fn two_paragraphs() {
+    // 243: "A" CR "B": two paragraphs, leading 98 (the second baseline is 98 px lower in AE).
+    let d = skip!(lossless("243-text-multiline-A-CR-B.aep"));
+    assert_eq!(d.text, "A\rB");
+    assert_eq!(d.para_count(), 2);
+    assert_eq!(d.paras().iter().map(|p| p.justify).collect::<Vec<_>>(), [Justify::Left, Justify::Left]);
+    assert_eq!(d.leading, Some(98.0));
+}
+
+#[test]
+fn automatic_leading_imports_as_automatic_leading() {
+    // 400: 387's "A" CR "B" with Auto Leading switched on (After Effects then sets the second
+    // baseline 120 px below the first, 1.2 x the size 100): EffectCraft's automatic leading is the
+    // same 120 % rule, so no explicit leading is set (the stored 0.01 is not used).
+    let d = skip!(lossless("400-text-autoleading-on.aep"));
+    assert_eq!((d.text.as_str(), d.size, d.para_count()), ("A\rB", 100.0, 2));
+    assert_eq!(d.leading, None);
+}
+
+#[test]
+fn etx_is_a_paragraph_break() {
+    // 386: "A" U+0003 "B". After Effects lays it out exactly as 387's "A" CR "B" (two lines, two
+    // paragraphs, baselines 98 px apart): it imports as 243's CR text, without a loss.
+    let d = skip!(lossless("386-text-etx-A-B.aep"));
+    let cr = skip!(lossless("243-text-multiline-A-CR-B.aep"));
+    assert_eq!(d.text, "A\rB");
+    assert_eq!(d.para_count(), 2);
+    assert_eq!(d.paras().iter().map(|p| p.justify).collect::<Vec<_>>(), [Justify::Left, Justify::Left]);
+    assert_eq!((d.leading, d.size), (cr.leading, cr.size));
+    assert_eq!(d.runs().iter().map(|r| r.len).sum::<usize>(), 3);
+}
+
+#[test]
+fn an_unnamed_text_layer_is_named_after_its_first_paragraph() {
+    // 386 and 243 with the text layer's own name removed: both are named "A", as U+0003 and CR
+    // both end the first paragraph.
+    for name in ["386-text-etx-A-B.aep", "243-text-multiline-A-CR-B.aep"] {
+        let src = fixture!(name);
+        let mut file = parse(&src).unwrap();
+        let mut done = false;
+        visit(&mut file.chunks, &mut |c| {
+            if c.is_list(b"Layr") && utf8_name(c).as_deref() == Some("T") {
+                for k in c.children_mut() {
+                    if k.is(b"Utf8")
+                        && let Body::Data(d) = &mut k.body
+                    {
+                        *d = Vec::new().into();
+                        done = true;
+                    }
+                }
+            }
+        });
+        assert!(done, "{name}");
+        let bytes = write(&file).unwrap();
+        let mut p = Project::default();
+        let none = |_: &str| false;
+        let r = import(&mut p, &bytes, &ImportOptions::new(&none)).expect("lossless");
+        let (_, c) = comp(&p, &r, "C");
+        assert!(
+            c.layers.iter().any(|l| l.name == "A" && matches!(l.source, LayerSource::Text)),
+            "{name}: {:?}",
+            c.layers.iter().map(|l| &l.name).collect::<Vec<_>>()
+        );
+    }
+}
+
+#[test]
+fn other_control_characters_are_still_reported() {
+    // A text with U+0003 and U+0007: the U+0003 becomes a paragraph break, the U+0007 is kept and reported.
+    let src = fixture!("386-text-etx-A-B.aep");
+    let from = utf16("A\u{3}B\r");
+    let to = utf16("A\u{3}\u{7}\r");
+    let at = src.windows(from.len()).position(|w| w == from.as_slice()).expect("the stored text");
+    let bytes = [&src[..at], to.as_slice(), &src[at + from.len()..]].concat();
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut p, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    let (_, c) = comp(&p, &r, "C");
+    assert_eq!(source_text(text_layer(c)).text, "A\r\u{7}");
+    let loss = r.report.losses.iter().find(|l| l.category == LossCategory::TextLayers).expect("reported");
+    assert!(loss.details.iter().any(|d| d.contains("U+0007") && !d.contains("U+0003")), "{:?}", loss.details);
+}
+
+#[test]
+fn a_stored_text_anchor_imports_as_pixels() {
+    // 385: 110 with the text layer's Anchor Point set to [10, 20], stored as pixels.
+    let (p, r) = load!("385-text-anchor-10-20.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    let t = text_layer(c);
+    assert_eq!(vec3(t, "transform/anchor"), [10.0, 20.0, 0.0]);
+    assert_eq!(vec3(t, "transform/position"), [960.0, 540.0, 0.0]);
+    assert_eq!(source_text(t).text, "A");
+}
+
+#[test]
+fn box_text_and_justification() {
+    // 245: box 400 x 200, top-left [-200, -100] in layer space, left; 246 centre; 334 right.
+    for (name, justify) in [
+        ("245-text-box-400x200-Hello.aep", Justify::Left),
+        ("246-text-box-center-align.aep", Justify::Center),
+        ("334-text-box-right-align.aep", Justify::Right),
+    ] {
+        let d = skip!(lossless(name));
+        assert_eq!(d.text, "Hello", "{name}");
+        assert_eq!((d.box_size, d.box_pos), (Some([400.0, 200.0]), [-200.0, -100.0]), "{name}");
+        assert_eq!(d.justify, justify, "{name}");
+    }
+}
+
+#[test]
+fn character_styles() {
+    // 247: tracking 100.
+    assert_eq!(skip!(lossless("247-text-tracking-100.aep")).tracking, 100.0);
+    // 335 / 336: faux bold / italic (the font stays Times New Roman Regular).
+    let d = skip!(lossless("335-text-point-fauxbold.aep"));
+    assert!(d.faux_bold && !d.faux_italic);
+    let d = skip!(lossless("336-text-point-fauxitalic.aep"));
+    assert!(d.faux_italic && !d.faux_bold);
+    // 337 / 338: all caps / small caps.
+    let d = skip!(lossless("337-text-point-allcaps.aep"));
+    assert!(d.all_caps && !d.small_caps);
+    let d = skip!(lossless("338-text-point-smallcaps.aep"));
+    assert!(d.small_caps && !d.all_caps);
+    // 339: leading 60.
+    assert_eq!(skip!(lossless("339-text-point-leading60.aep")).leading, Some(60.0));
+}
+
+#[test]
+fn style_runs() {
+    // 248: characters 1..3 ("el") red, the rest white.
+    let d = skip!(lossless("248-text-range-fill-red-1-3.aep"));
+    let runs = d.runs();
+    assert_eq!(runs.iter().map(|r| r.len).collect::<Vec<_>>(), [1, 2, 2]);
+    assert_eq!(runs.iter().map(|r| r.style.fill).collect::<Vec<_>>(), [WHITE, RED, WHITE]);
+    assert_eq!(d.substring(1..3), "el");
+    // 340: "el" red; "lo" blue at 60 px. AE's last run (3 characters) includes the final CR.
+    let d = skip!(lossless("340-text-range-two-styles.aep"));
+    let runs = d.runs();
+    assert_eq!(runs.iter().map(|r| r.len).collect::<Vec<_>>(), [1, 2, 2]);
+    assert_eq!(runs.iter().map(|r| r.style.fill).collect::<Vec<_>>(), [WHITE, RED, BLUE]);
+    assert_eq!(runs.iter().map(|r| r.style.size).collect::<Vec<_>>(), [100.0, 100.0, 60.0]);
+    assert_eq!(d.style_at(4).size, 60.0);
+}
+
+#[test]
+fn the_text_of_an_animated_layer_arrives() {
+    // 114: 113 plus "Animator 1" (Opacity 0, Range Selector 1): the text arrives, and the animator
+    // too (tests/text_anim.rs).
+    let (d, r) = skip!(imported("114-text-animator-opacity.aep"));
+    assert_eq!((d.text.as_str(), d.size, d.fill), ("Hello", 60.0, [1.0, 0.5, 0.0, 1.0]));
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+}
+
+#[test]
+fn a_text_layer_is_no_loss_and_the_import_is_not_refused() {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut p, &fixture!("113-text-Hello-size60-fillorange.aep"), &ImportOptions::new(&none)).expect("lossless import");
+    assert!(r.report.is_lossless());
+}
+
+#[test]
+fn missing_fonts_are_listed_not_lost() {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let no_fonts = |_: &str| false;
+    let opts = ImportOptions { has_font: &no_fonts, ..ImportOptions::new(&none) };
+    // Losses are not allowed: a missing font must not refuse the import.
+    let r = import(&mut p, &fixture!("340-text-range-two-styles.aep"), &opts).expect("a missing font is not a loss");
+    // The font list has four entries; only the one the runs use is checked and listed, once.
+    assert_eq!(r.report.missing_fonts, ["TimesNewRomanPSMT"]);
+    let (_, c) = comp(&p, &r, "C");
+    assert!(source_text(text_layer(c)).runs().iter().all(|run| run.style.font == "TimesNewRomanPSMT"));
+    // A checker that knows the font lists nothing.
+    let mut p = Project::default();
+    let times = |f: &str| f == "TimesNewRomanPSMT";
+    let r = import(&mut p, &fixture!("340-text-range-two-styles.aep"), &ImportOptions { has_font: &times, ..ImportOptions::new(&none) }).unwrap();
+    assert!(r.report.missing_fonts.is_empty());
+    // The dry run reports the same.
+    let report = effectcraft_aep::import::analyze_with(&fixture!("110-text-A.aep"), &opts).unwrap();
+    assert_eq!(report.missing_fonts, ["TimesNewRomanPSMT"]);
+}
+
+// ---------------------------------------------------------------- built cases
+
+fn visit(chunks: &mut [Chunk<'_>], f: &mut dyn FnMut(&mut Chunk<'_>)) {
+    for c in chunks {
+        f(c);
+        visit(c.children_mut(), f);
+    }
+}
+
+fn utf8_name(c: &Chunk<'_>) -> Option<String> {
+    c.children().iter().find(|k| k.is(b"Utf8")).and_then(Chunk::bytes).map(|b| String::from_utf8_lossy(b).to_string())
+}
+
+fn tdmn_is(c: &Chunk<'_>, name: &str) -> bool {
+    c.is(b"tdmn") && c.bytes().is_some_and(|b| b.split(|x| *x == 0).next() == Some(name.as_bytes()))
+}
+
+/// The list that follows the `tdmn` named `name` among `children`.
+fn index_after(children: &[Chunk<'_>], name: &str) -> Option<usize> {
+    let at = children.iter().position(|c| tdmn_is(c, name))?;
+    Some(at + 1)
+}
+
+/// The id of a layer (`ldta` bytes 0..4).
+fn layer_id(c: &Chunk<'_>) -> Option<u32> {
+    let b = c.children().iter().find(|k| k.is(b"ldta"))?.bytes()?;
+    Some(u32::from_be_bytes(b.get(0..4)?.try_into().ok()?))
+}
+
+/// The `tdmn` + `LIST tdbs` pair of `ADBE Opacity` in the transform group of the layer `id`.
+fn opacity_pair<'a>(file: &AepFile<'a>, id: u32) -> (Chunk<'a>, Chunk<'a>) {
+    let mut out = None;
+    let mut stack: Vec<&Chunk<'a>> = file.chunks.iter().collect();
+    while let Some(c) = stack.pop() {
+        if c.is_list(b"Layr") && layer_id(c) == Some(id) {
+            let root = c.child_list(b"tdgp").unwrap();
+            let tr = &root.children()[index_after(root.children(), "ADBE Transform Group").unwrap()];
+            let i = index_after(tr.children(), "ADBE Opacity").unwrap();
+            out = Some((tr.children()[i - 1].clone(), tr.children()[i].clone()));
+        }
+        stack.extend(c.children());
+    }
+    out.expect("opacity of the layer")
+}
+
+#[test]
+fn parented_text_with_opacity_keys() {
+    // 113's text layer T, parented to the solid L (`ldta` byte 132 as in 022), with the two
+    // Opacity keys of 058 (0 % at 0 s, 100 % at 2 s) copied into T's transform group. The layer
+    // ids are the cases' own (L is 0x1b in the single-case files).
+    let keys_id = skip!(crate::import::helpers::comp_ids("058-key-opacity-2key.aep"))[0].2[0];
+    let l_id = *skip!(crate::import::helpers::comp_ids("113-text-Hello-size60-fillorange.aep"))[0].2.last().unwrap();
+    let keys_src = fixture!("058-key-opacity-2key.aep");
+    let keys_file = parse(&keys_src).unwrap();
+    let (tdmn, tdbs) = opacity_pair(&keys_file, keys_id);
+    let (tdmn, tdbs) = (tdmn.into_owned(), tdbs.into_owned());
+    let src = fixture!("113-text-Hello-size60-fillorange.aep");
+    let mut file = parse(&src).unwrap();
+    let mut done = (false, false);
+    visit(&mut file.chunks, &mut |c| {
+        if !(c.is_list(b"Layr") && utf8_name(c).as_deref() == Some("T")) {
+            return;
+        }
+        for k in c.children_mut() {
+            if k.is(b"ldta")
+                && let Body::Data(d) = &mut k.body
+            {
+                d.to_mut()[132..136].copy_from_slice(&l_id.to_be_bytes());
+                done.0 = true;
+            }
+            if k.is_list(b"tdgp") {
+                let i = index_after(k.children(), "ADBE Transform Group").unwrap();
+                if let Body::List { children, .. } = &mut k.children_mut()[i].body {
+                    let end = children.iter().position(|c| tdmn_is(c, "ADBE Group End")).unwrap();
+                    children.insert(end, tdbs.clone());
+                    children.insert(end, tdmn.clone());
+                    done.1 = true;
+                }
+            }
+        }
+    });
+    assert_eq!(done, (true, true));
+    let bytes = write(&file).unwrap();
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    let r = import(&mut p, &bytes, &ImportOptions::new(&none)).expect("lossless");
+    let (_, c) = comp(&p, &r, "C");
+    let t = text_layer(c);
+    let l = c.layers.iter().find(|l| l.name == "L").unwrap();
+    assert_eq!(t.parent, Some(l.id));
+    let opacity = t.props.prop("transform/opacity").unwrap();
+    let keys: Vec<(Tick, Value)> = opacity.keys.iter().map(|k| (k.time, k.value.clone())).collect();
+    assert_eq!(keys, [(Tick::ZERO, Value::Scalar(0.0)), (Tick(2 * TICKS_PER_SECOND), Value::Scalar(100.0))]);
+    assert_eq!(source_text(t).text, "Hello");
+    assert_eq!(r.report.imported.keyframes, 2);
+}
+
+/// Replaces the body of the text layer's `btdk` list.
+fn with_btdk(name: &str, body: &[u8]) -> Option<Vec<u8>> {
+    Some({
+        let src = crate::common::try_fixture(name)?;
+        let mut file = parse(&src).unwrap();
+        visit(&mut file.chunks, &mut |c| {
+            if let Body::OpaqueList { list_type, data } = &mut c.body
+                && list_type == b"btdk"
+            {
+                *data = body.to_vec().into();
+            }
+        });
+        write(&file).unwrap()
+    })
+}
+
+/// Imports with and without losses allowed; checks the result is usable.
+fn import_hostile(bytes: &[u8]) -> Option<ImportResult> {
+    let none = |_: &str| false;
+    let no_fonts = |_: &str| false;
+    let mut last = None;
+    for allow in [false, true] {
+        let mut p = Project::default();
+        let opts = ImportOptions { allow_losses: allow, has_font: &no_fonts, ..ImportOptions::new(&none) };
+        if let Ok(r) = import(&mut p, bytes, &opts) {
+            serde_json::to_string(&p).expect("the project serialises");
+            for item in p.items.values() {
+                let ItemKind::Comp(c) = &item.kind else { continue };
+                for l in &c.layers {
+                    if let Some(Value::Text(t)) = l.props.prop("text/sourceText").map(|p| &p.value) {
+                        let runs = t.runs();
+                        assert_eq!(runs.iter().map(|r| r.len).sum::<usize>(), t.char_len());
+                        assert!(runs.iter().all(|r| r.style.size.is_finite() && r.style.size > 0.0 && r.style.fill.iter().all(|c| c.is_finite())));
+                        assert!(t.leading.is_none_or(f64::is_finite) && t.tracking.is_finite());
+                        assert!(t.box_size.is_none_or(|b| b.iter().all(|v| v.is_finite() && *v >= 1.0)));
+                    }
+                }
+            }
+            last = Some(r);
+        }
+    }
+    last
+}
+
+fn utf16(s: &str) -> Vec<u8> {
+    let mut out = vec![0xfe, 0xff];
+    for u in s.encode_utf16() {
+        out.extend_from_slice(&u.to_be_bytes());
+    }
+    out
+}
+
+#[test]
+fn hostile_text_documents_never_panic() {
+    let real = {
+        let src = fixture!("340-text-range-two-styles.aep");
+        let f = parse(&src).unwrap();
+        let mut body = None;
+        let mut stack: Vec<&Chunk<'_>> = f.chunks.iter().collect();
+        while let Some(c) = stack.pop() {
+            if let Body::OpaqueList { list_type, data } = &c.body
+                && list_type == b"btdk"
+            {
+                body = Some(data.to_vec());
+            }
+            stack.extend(c.children());
+        }
+        body.unwrap()
+    };
+    let hello = utf16("Hello\r");
+    let at = real.windows(hello.len()).position(|w| w == hello.as_slice()).expect("the text in the body");
+    let with_text = |t: &[u8]| [&real[..at], t, &real[at + hello.len()..]].concat();
+    let mut cases: Vec<Vec<u8>> = vec![
+        b"garbage".to_vec(),
+        Vec::new(),
+        b"/1 << /1 [ << /0 << /0 (".to_vec(),
+        // Lone surrogates and an odd byte count.
+        with_text(&[0xfe, 0xff, 0xd8, 0x00, 0x00, b'H', 0xdc, 0x00, 0x00]),
+        // A huge text (2 MB of UTF-16) with the runs of a five-character one.
+        with_text(&[vec![0xfe, 0xff], [0x00, b'x'].repeat(1 << 20)].concat()),
+        // Control characters (U+0003 is a paragraph break, U+0007 is reported) and an empty text.
+        with_text(&utf16("He\u{3}l\u{7}lo\r")),
+        with_text(&utf16("")),
+        // Run lengths that overflow, are negative or much longer than the text.
+        real.replacen(b"/1 3 >>", b"/1 99999999999999999999999 >>"),
+        real.replacen(b"/1 3 >>", b"/1 -3 >>"),
+        real.replacen(b"/1 1 >>", b"/1 1000000 >>"),
+        // Not-a-number sizes and colours, a font index far outside the font list.
+        real.replacen(b"/1 60.0", b"/1 nan"),
+        real.replacen(b"[ 1.0 0.0 0.0 1.0 ]", b"[ 1.0 inf -inf 1e309 ]"),
+        real.replacen(b"/6 << /0 0 /1 100.0", b"/6 << /0 999999 /1 100.0"),
+        // Unknown caps and justification codes.
+        real.replacen(b"/12 0 ", b"/12 7 "),
+        // Deep nesting.
+        [b"/1 ".as_slice(), &b"<< /0 ".repeat(50_000), &b">> ".repeat(50_000)].concat(),
+        [b"/1 ".as_slice(), &b"[ ".repeat(50_000)].concat(),
+    ];
+    for cut in (0..real.len()).step_by(211) {
+        cases.push(real[..cut].to_vec());
+    }
+    for (i, body) in cases.iter().enumerate() {
+        let r = import_hostile(&skip!(with_btdk("340-text-range-two-styles.aep", body)));
+        assert!(r.is_some(), "case {i}: the import with losses allowed must succeed");
+    }
+}
+
+/// `replacen` for byte strings (first occurrence; panics when absent so a case cannot rot).
+trait ReplaceBytes {
+    fn replacen(&self, from: &[u8], to: &[u8]) -> Vec<u8>;
+}
+
+impl ReplaceBytes for Vec<u8> {
+    fn replacen(&self, from: &[u8], to: &[u8]) -> Vec<u8> {
+        let at = self.windows(from.len()).position(|w| w == from).unwrap_or_else(|| panic!("{:?} not in the body", String::from_utf8_lossy(from)));
+        [&self[..at], to, &self[at + from.len()..]].concat()
+    }
+}
+
+#[test]
+fn unreadable_text_keeps_the_layer() {
+    let r = import_hostile(&skip!(with_btdk("113-text-Hello-size60-fillorange.aep", b"not a text document"))).unwrap();
+    assert_eq!(r.report.imported.text_layers, 1);
+    assert_eq!(r.report.count(LossCategory::DamagedData), 1, "{:?}", r.report.losses);
+}
+
+#[test]
+fn superscript_and_subscript_import_as_such() {
+    use effectcraft_keyframe::text_doc::BaselineOption;
+    // 526: the corpus' default character state is superscript; 527 normal; 528 subscript.
+    for (name, want) in [
+        ("526-text-point-HHHH-default.aep", BaselineOption::Superscript),
+        ("527-text-point-HHHH-baseline-normal.aep", BaselineOption::Normal),
+        ("528-text-point-HHHH-baseline-subscript.aep", BaselineOption::Subscript),
+        ("243-text-multiline-A-CR-B.aep", BaselineOption::Superscript),
+    ] {
+        let doc = skip!(lossless(name));
+        assert_eq!(doc.style_at(0).baseline, want, "{name}");
+    }
+}
+
+#[test]
+fn a_wrapping_box_text_keeps_its_box() {
+    let doc = skip!(lossless("517-text-box-600x400-wrap.aep"));
+    assert_eq!(doc.text, "The quick brown fox jumps over the lazy dog and keeps running far away");
+    assert_eq!((doc.box_size, doc.box_pos), (Some([600.0, 400.0]), [-300.0, -200.0]));
+    assert_eq!(doc.style_at(0).size, 100.0);
+}
diff --git a/crates/aep/tests/it/import/text_anim.rs b/crates/aep/tests/it/import/text_anim.rs
new file mode 100644
index 000000000..a40a2058d
--- /dev/null
+++ b/crates/aep/tests/it/import/text_anim.rs
@@ -0,0 +1,227 @@
+//! Text animators and range selectors (579-594, 114) and the character and paragraph settings of
+//! S17 (538-578, 595, 596).
+
+use crate::import::helpers::comp;
+use effectcraft_aep::import::{ImportResult, LossCategory};
+use effectcraft_keyframe::Value;
+use effectcraft_keyframe::text_doc::{Composer, Direction, Justify, Kerning, TextDoc};
+use effectcraft_project::{Layer, Project, PropGroup};
+use effectcraft_time::{TICKS_PER_SECOND, Tick};
+
+fn text_layer<'p>(p: &'p Project, r: &ImportResult) -> &'p Layer {
+    let (_, c) = comp(p, r, "C");
+    c.layers.iter().find(|l| l.name == "T").expect("text layer T")
+}
+
+fn animators(l: &Layer) -> Vec<&PropGroup> {
+    l.props.group("text/animators").expect("animators").groups().collect()
+}
+
+fn scalar(g: &PropGroup, path: &str) -> f64 {
+    match g.prop(path).unwrap_or_else(|| panic!("no {path}")).value {
+        Value::Scalar(v) => v,
+        ref v => panic!("{path}: {v:?}"),
+    }
+}
+
+fn enumv(g: &PropGroup, path: &str) -> u32 {
+    match g.prop(path).unwrap_or_else(|| panic!("no {path}")).value {
+        Value::Enum(v) => v,
+        ref v => panic!("{path}: {v:?}"),
+    }
+}
+
+fn selector(a: &PropGroup) -> &PropGroup {
+    a.sub("selectors").and_then(|s| s.groups().next()).expect("a selector")
+}
+
+#[test]
+fn an_animator_with_position_imports_lossless() {
+    let (p, r) = load!("579-textanim-position-0-m50.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    assert_eq!(r.report.imported.text_animators, 1);
+    let l = text_layer(&p, &r);
+    let a = animators(l);
+    assert_eq!(a.len(), 1);
+    assert_eq!(a[0].name, "Animator 1");
+    assert_eq!(a[0].prop("properties/position").unwrap().value, Value::Vec3([0.0, -50.0, 0.0]));
+    let s = selector(a[0]);
+    assert_eq!(s.name, "Range Selector 1");
+    assert_eq!((scalar(s, "start"), scalar(s, "end"), scalar(s, "offset")), (0.0, 100.0, 0.0));
+}
+
+#[test]
+fn range_selector_settings_arrive() {
+    let one = |name: &str| {
+        Some({
+            let (p, r) = crate::import::helpers::try_load(name)?;
+            assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+            let l = text_layer(&p, &r);
+            selector(animators(l)[0]).clone()
+        })
+    };
+    assert_eq!(scalar(&skip!(one("580-textanim-start-25.aep")), "start"), 25.0);
+    assert_eq!(scalar(&skip!(one("581-textanim-end-75.aep")), "end"), 75.0);
+    assert_eq!(scalar(&skip!(one("582-textanim-offset-10.aep")), "offset"), 10.0);
+    // Units = Index: Start / End are characters (End = the 4 characters of HHHH).
+    let s = skip!(one("583-textanim-units-index.aep"));
+    assert_eq!((enumv(&s, "advanced/units"), scalar(&s, "start"), scalar(&s, "end")), (1, 0.0, 4.0));
+    assert_eq!(enumv(&skip!(one("584-textanim-basedon-3-words.aep")), "advanced/basedOn"), 2);
+    assert_eq!(enumv(&skip!(one("585-textanim-mode-2-subtract.aep")), "advanced/mode"), 1);
+    assert_eq!(scalar(&skip!(one("586-textanim-amount-50.aep")), "advanced/amount"), 50.0);
+    assert_eq!(enumv(&skip!(one("587-textanim-shape-2-rampup.aep")), "advanced/shape"), 1);
+    assert_eq!(scalar(&skip!(one("588-textanim-smoothness-50.aep")), "advanced/smoothness"), 50.0);
+    assert_eq!(scalar(&skip!(one("589-textanim-easehigh-30.aep")), "advanced/easeHigh"), 30.0);
+    assert_eq!(scalar(&skip!(one("590-textanim-easelow-40.aep")), "advanced/easeLow"), 40.0);
+    let s = skip!(one("591-textanim-randomize-seed-7.aep"));
+    assert_eq!((s.prop("advanced/randomize").unwrap().value.clone(), scalar(&s, "advanced/randomSeed")), (Value::Bool(true), 7.0));
+}
+
+#[test]
+fn every_mapped_animator_property_arrives() {
+    let (p, r) = load!("592-textanim-many-props.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let l = text_layer(&p, &r);
+    let a = animators(l);
+    assert_eq!(a.len(), 2);
+    let m = a[1];
+    assert_eq!(m.name, "Many");
+    let v = |id: &str| m.prop(&format!("properties/{id}")).unwrap_or_else(|| panic!("no {id}")).value.clone();
+    assert_eq!(v("anchor"), Value::Vec3([3.0, 4.0, 0.0]));
+    assert_eq!(v("scale"), Value::Vec3([150.0, 120.0, 100.0]));
+    assert_eq!((v("skew"), v("skewAxis"), v("rotation"), v("opacity")), (Value::Scalar(10.0), Value::Scalar(20.0), Value::Scalar(45.0), Value::Scalar(37.0)));
+    assert_eq!(v("fillColor"), Value::Color([0.0, 1.0, 0.0, 1.0]));
+    assert_eq!(v("strokeColor"), Value::Color([0.0, 0.0, 1.0, 1.0]));
+    assert_eq!((v("strokeWidth"), v("tracking")), (Value::Scalar(3.0), Value::Scalar(20.0)));
+    assert_eq!((v("lineSpacing"), v("blur")), (Value::Vec2([10.0, 20.0]), Value::Vec2([5.0, 6.0])));
+    assert_eq!(v("trackingType"), Value::Enum(0));
+}
+
+#[test]
+fn keyed_start_keeps_its_ease() {
+    let (p, r) = load!("594-textanim-position-start-keyed-ease.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let l = text_layer(&p, &r);
+    let start = selector(animators(l)[0]).prop("start").unwrap();
+    assert_eq!(start.keys.len(), 2);
+    let at = |s: f64| match start.value_at(Tick((s * TICKS_PER_SECOND as f64) as i64)) {
+        Value::Scalar(v) => v,
+        v => panic!("{v:?}"),
+    };
+    assert_eq!((at(0.0), at(2.0)), (0.0, 100.0));
+    // Easy ease: half way at 1 s, slower than linear at 0.5 s.
+    assert!((at(1.0) - 50.0).abs() < 0.01, "{}", at(1.0));
+    assert!(at(0.5) < 20.0, "{}", at(0.5));
+}
+
+#[test]
+fn the_opacity_animator_of_114_imports() {
+    let (p, r) = load!("114-text-animator-opacity.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let (_, c) = comp(&p, &r, "C");
+    let l = c.layers.iter().find(|l| l.props.group("text/animators").is_some_and(|a| a.groups().next().is_some())).expect("animated text");
+    assert_eq!(animators(l)[0].prop("properties/opacity").unwrap().value, Value::Scalar(0.0));
+}
+
+fn doc(name: &str) -> Option<(TextDoc, ImportResult)> {
+    Some({
+        let (p, r) = crate::import::helpers::try_load(name)?;
+        let l = text_layer(&p, &r);
+        match &l.props.prop("text/sourceText").unwrap().value {
+            Value::Text(d) => ((**d).clone(), r),
+            v => panic!("{v:?}"),
+        }
+    })
+}
+
+#[test]
+fn character_settings_arrive() {
+    let style = |name: &str| {
+        let (d, r) = doc(name)?;
+        assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+        Some(d.style_at(0))
+    };
+    assert_eq!(skip!(style("539-text-hscale-0.9.aep")).h_scale, 90.0);
+    assert_eq!(skip!(style("540-text-vscale-1.5.aep")).v_scale, 150.0);
+    assert_eq!(skip!(style("541-text-baselineshift-41.aep")).baseline_shift, 41.0);
+    assert_eq!(skip!(style("542-text-autokern-none.aep")).kerning, Kerning::Manual(0.0));
+    assert_eq!(skip!(style("543-text-autokern-optical.aep")).kerning, Kerning::Optical);
+    assert_eq!(skip!(style("538-text-point-HHHH-normal-ref.aep")).kerning, Kerning::Metrics);
+    let s = skip!(style("544-text-applystroke-on.aep"));
+    assert!(s.apply_stroke && s.stroke_width == 1.0);
+    assert_eq!(skip!(style("545-text-strokewidth-5.aep")).stroke_width, 5.0);
+    assert!(!skip!(style("546-text-applyfill-off.aep")).apply_fill);
+    assert_eq!(skip!(style("553-text-tsume-0.5.aep")).tsume, 50.0);
+    assert!(skip!(style("555-text-ligature-on.aep")).ligatures);
+    assert!(!skip!(style("538-text-point-HHHH-normal-ref.aep")).ligatures);
+    // Digit set Arabic lays out like the default (571) and is no loss.
+    skip!(style("571-text-digitset-arabic.aep"));
+    let (d, r) = skip!(doc("596-text-combined-fill-over-stroke.aep"));
+    assert!(r.report.is_lossless() && !d.stroke_over_fill);
+    let (d, _) = skip!(doc("595-text-stroke-scale-shift-combined.aep"));
+    let s = d.style_at(0);
+    assert!(d.stroke_over_fill && s.apply_stroke);
+    assert_eq!((s.stroke_width, s.stroke, s.h_scale, s.v_scale, s.baseline_shift), (5.0, [0.0, 0.0, 1.0, 1.0], 90.0, 150.0, 41.0));
+}
+
+#[test]
+fn paragraph_settings_arrive() {
+    let para = |name: &str| {
+        Some({
+            let (d, r) = doc(name)?;
+            assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses);
+            d.para(0)
+        })
+    };
+    assert_eq!(skip!(para("560-text-firstlineindent-20.aep")).indent_first, 20.0);
+    assert_eq!(skip!(para("561-text-startindent-30.aep")).indent_left, 30.0);
+    assert_eq!(skip!(para("562-text-endindent-40.aep")).indent_right, 40.0);
+    assert_eq!(skip!(para("563-text-spacebefore-10.aep")).space_before, 10.0);
+    assert_eq!(skip!(para("564-text-spaceafter-12.aep")).space_after, 12.0);
+    assert!(skip!(para("558-text-hangingroman-on.aep")).hanging_punctuation);
+    assert_eq!(skip!(para("559-text-everyline-on.aep")).composer, Composer::EveryLine);
+    assert_eq!(skip!(para("538-text-point-HHHH-normal-ref.aep")).composer, Composer::SingleLine);
+    assert_eq!(skip!(para("569-text-direction-rtl.aep")).direction, Direction::Rtl);
+    // 569 stores "left" (0) in a right-to-left paragraph: After Effects lays it out flush right
+    // (read-back test t7), so it arrives as visual right.
+    assert_eq!(skip!(para("569-text-direction-rtl.aep")).justify, Justify::Right);
+    assert_eq!(skip!(para("556-text-autohyphenate-off.aep")).justify, Justify::Left);
+    assert_eq!(skip!(para("565-text-justify-fullleft.aep")).justify, Justify::JustifyLastLeft);
+    assert_eq!(skip!(para("566-text-justify-fullcenter.aep")).justify, Justify::JustifyLastCenter);
+    assert_eq!(skip!(para("567-text-justify-fullright.aep")).justify, Justify::JustifyLastRight);
+    assert_eq!(skip!(para("568-text-justify-fullall.aep")).justify, Justify::JustifyAll);
+    let (d, r) = skip!(doc("575-text-vertical-rtl.aep"));
+    assert!(d.vertical && r.report.is_lossless(), "{:?}", r.report.losses);
+}
+
+#[test]
+fn settings_without_an_effectcraft_field_are_reported() {
+    for (name, what) in [
+        ("548-text-linejoin-round.aep", None),
+        ("552-text-nobreak-on.aep", Some("No Break")),
+        ("554-text-kerning-50.aep", Some("manual kerning")),
+        ("572-text-leadingtype-japanese.aep", Some("Japanese leading")),
+        ("578-text-digitset-hindi.aep", Some("digit set")),
+    ] {
+        let (_, r) = skip!(doc(name));
+        match what {
+            // The line join of a stroke that is not drawn carries nothing.
+            None => assert!(r.report.is_lossless(), "{name}: {:?}", r.report.losses),
+            Some(w) => {
+                assert_eq!(r.report.count(LossCategory::TextLayers), 1, "{name}: {:?}", r.report.losses);
+                assert!(r.report.losses.iter().any(|l| l.details.iter().any(|d| d.contains(w))), "{name}: {:?}", r.report.losses);
+            }
+        }
+    }
+}
+
+#[test]
+fn a_character_offset_animator_imports() {
+    // 728: Character Offset 3; After Effects adds Character Alignment 1 and Character Range 1.
+    let (p, r) = load!("728-textanim-character-offset-3.aep");
+    assert!(r.report.is_lossless(), "{:?}", r.report.losses);
+    let l = text_layer(&p, &r);
+    let a = animators(l)[0];
+    assert_eq!(a.prop("properties/characterOffset").unwrap().value, Value::Scalar(3.0));
+    assert_eq!(enumv(a, "properties/characterRange"), 0);
+}
diff --git a/crates/aep/tests/it/import/timing.rs b/crates/aep/tests/it/import/timing.rs
new file mode 100644
index 000000000..dbf12247e
--- /dev/null
+++ b/crates/aep/tests/it/import/timing.rs
@@ -0,0 +1,88 @@
+//! A layer of timed footage ends at its source's end, as After Effects ends it when it opens a
+//! project (export test f1, aep-export R31): the three-frame OpenEXR sequence layer of 603 and the
+//! 1 s WAV layer of 351 with their out points moved to 5 s import as long as their source; the
+//! remapped layer of 354 keeps its out point.
+
+use effectcraft_aep::import::{ImportOptions, import};
+use effectcraft_aep::{Body, Chunk, parse, write};
+use effectcraft_project::{ItemKind, LayerSource, Project};
+
+/// Moves the out point of every `Layr` of the file to `seconds` (relative to its start).
+fn with_out_point(bytes: &[u8], seconds: u32) -> Vec<u8> {
+    fn walk(cs: &mut [Chunk<'static>], seconds: u32) {
+        for c in cs.iter_mut() {
+            if c.is_list(b"Layr") {
+                if let Body::List { children, .. } = &mut c.body
+                    && let Some(ldta) = children.iter_mut().find(|k| k.is(b"ldta"))
+                    && let Body::Data(d) = &mut ldta.body
+                {
+                    let den = u32::from_be_bytes(d[32..36].try_into().unwrap());
+                    let mut v = d.to_vec();
+                    v[28..32].copy_from_slice(&(seconds * den).to_be_bytes());
+                    *d = v.into();
+                }
+                continue;
+            }
+            if let Body::List { children, .. } = &mut c.body {
+                walk(children, seconds);
+            }
+        }
+    }
+    let mut f = parse(bytes).expect("parse").into_owned();
+    walk(&mut f.chunks, seconds);
+    write(&f).expect("write")
+}
+
+/// (layer span, source duration) of every footage layer, in seconds.
+fn footage_layers(bytes: &[u8]) -> Vec<(f64, f64)> {
+    let mut p = Project::default();
+    let none = |_: &str| false;
+    import(&mut p, bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).expect("import");
+    let mut out = Vec::new();
+    for item in p.items.values() {
+        let ItemKind::Comp(c) = &item.kind else { continue };
+        for l in &c.layers {
+            if let LayerSource::Footage { item } = l.source
+                && let Some(ItemKind::Footage(f)) = p.item(item).map(|i| &i.kind)
+            {
+                out.push(((l.out_point - l.start_time).seconds(), f.duration.seconds()));
+            }
+        }
+    }
+    out
+}
+
+#[test]
+fn a_footage_layer_ends_at_its_source() {
+    for name in ["603-footage-exrseq-0101-as-layer.aep", "351-footage-wav-as-layer.aep"] {
+        let long = with_out_point(&fixture!(name), 5);
+        let layers = footage_layers(&long);
+        assert_eq!(layers.len(), 1, "{name}");
+        let (span, source) = layers[0];
+        assert!(source > 0.0 && source < 5.0, "{name}: {source}");
+        assert!((span - source).abs() < 1e-9, "{name}: {span} vs {source}");
+    }
+    // The remapped layer keeps its 5 s.
+    let remapped = with_out_point(&fixture!("354-footage-pngseq-timeremap.aep"), 5);
+    let layers = footage_layers(&remapped);
+    assert!((layers[0].0 - 5.0).abs() < 1e-9, "{layers:?}");
+}
+
+#[test]
+fn a_reversed_layer_plays_backwards() {
+    // 982: stretch -100 %, start 5 s, Opacity keys at layer time 1 s (20 %) and 5 s (100 %);
+    // After Effects reads 80 % at comp 1 s and 40 % at 3 s (MANIFEST).
+    let mut p = effectcraft_project::Project::default();
+    let none = |_: &str| false;
+    let opts = effectcraft_aep::import::ImportOptions { allow_losses: false, ..effectcraft_aep::import::ImportOptions::new(&none) };
+    effectcraft_aep::import::import(&mut p, &fixture!("982-layer-stretch-minus100-opacity-keys.aep"), &opts).expect("lossless");
+    let l = p.comps().next().map(|(_, c)| c.layers[0].clone()).expect("layer");
+    assert_eq!(l.stretch, -100.0);
+    assert_eq!((l.in_point.seconds(), l.out_point.seconds()), (0.0, 5.0));
+    let op = l.props.prop("transform/opacity").expect("opacity");
+    for (comp_s, want) in [(1.0, 80.0), (3.0, 40.0)] {
+        let t = l.layer_time(effectcraft_time::Tick::from_seconds_f64(comp_s));
+        let v = op.value_at(t).as_f64();
+        assert!((v - want).abs() < 0.01, "{comp_s}: {v}");
+    }
+}
diff --git a/crates/aep/tests/it/import/versions.rs b/crates/aep/tests/it/import/versions.rs
new file mode 100644
index 000000000..cac6a9a6b
--- /dev/null
+++ b/crates/aep/tests/it/import/versions.rs
@@ -0,0 +1,181 @@
+//! The After Effects version of a file (`head`, `svap`) in the import report, and files that After
+//! Effects 2026 saved as copies for 25.x and 24.x (issue #3115).
+//!
+//! The fixture-free tests edit the committed `synthetic.aep` (saved by 26.2.1x2). The fixture tests
+//! read, per family of the corpus, the same-session 2026 save `<family>-26.aep` and its copies
+//! `<family>-25x.aep` (File ▸ Save a Copy As 25.x) and `<family>-24x.aep` (24.x) from
+//! `EFFECTCRAFT_AEP_FIXTURES`; they are ignored until the corpus holds those files.
+
+use effectcraft_aep::import::{AeVersionInfo, ImportOptions, ImportReport, ImportResult, TESTED_MAJORS, UNKNOWN, analyze, import};
+use effectcraft_aep::{AepFile, Body, Chunk, parse, write};
+use effectcraft_project::Project;
+
+const SYNTHETIC: &[u8] = include_bytes!("../../fixtures/synthetic.aep");
+
+/// The project with `edit` applied to every top-level chunk.
+fn mutate(edit: &mut dyn FnMut(&mut Chunk<'_>)) -> Vec<u8> {
+    let mut file: AepFile<'_> = parse(SYNTHETIC).unwrap();
+    for c in &mut file.chunks {
+        edit(c);
+    }
+    write(&file).unwrap()
+}
+
+/// `synthetic.aep` with `head` bytes 4 to 7 replaced by `word`.
+fn with_head_word(word: u32) -> Vec<u8> {
+    mutate(&mut |c| {
+        if c.is(b"head")
+            && let Body::Data(d) = &mut c.body
+        {
+            d.to_mut().get_mut(4..8).unwrap().copy_from_slice(&word.to_be_bytes());
+        }
+    })
+}
+
+/// The report of an analysis of `bytes` (no footage on disk).
+fn report(bytes: &[u8]) -> ImportReport {
+    analyze(bytes, &|_| false).unwrap()
+}
+
+/// The limitation lines about an untested version.
+fn version_limitations(r: &ImportReport) -> Vec<&String> {
+    r.limitations.iter().filter(|l| l.contains("is not tested")).collect()
+}
+
+#[test]
+fn the_report_names_the_version_the_file_is_written_for_and_saved_by() {
+    let r = report(SYNTHETIC);
+    assert_eq!(r.ae_version, AeVersionInfo { file_version: "26.2.1x2".into(), saved_by: "26.2.1x2".into(), tested: true });
+    assert!(version_limitations(&r).is_empty());
+    let json = serde_json::to_value(&r).unwrap();
+    assert_eq!(json["aeVersion"]["fileVersion"], "26.2.1x2");
+    assert_eq!(json["aeVersion"]["savedBy"], "26.2.1x2");
+    assert_eq!(json["aeVersion"]["tested"], true);
+}
+
+/// A copy saved for 25.x or 24.x reports that version and the 2026 writer, and counts as tested.
+#[test]
+fn a_copy_saved_for_an_older_version_names_both() {
+    // The words of the copies After Effects 2026 saved as 25.x and 24.x; `svap` stays 2026's.
+    for (word, text) in [(0x0f0b_0661, "25.6.0x97"), (0x0f03_0641, "24.6.0x65")] {
+        let r = report(&with_head_word(word));
+        assert_eq!(r.ae_version.file_version, text);
+        assert_eq!(r.ae_version.saved_by, "26.2.1x2");
+        assert!(r.ae_version.tested);
+        assert!(version_limitations(&r).is_empty());
+    }
+}
+
+#[test]
+fn an_untested_version_is_imported_and_said_to_be_untested() {
+    // 23.6.0x97: major 23 (bits 25-24 = 10, bits 21-19 = 111).
+    let bytes = with_head_word(0x0e3b_0661);
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    // Not a loss: the losses are those of the unedited file.
+    let r: ImportResult = import(&mut project, &bytes, &ImportOptions { allow_losses: true, ..ImportOptions::new(&none) }).unwrap();
+    assert_eq!(r.report.losses, report(SYNTHETIC).losses);
+    assert_eq!(r.report.ae_version.file_version, "23.6.0x97");
+    assert!(!r.report.ae_version.tested);
+    assert!(!TESTED_MAJORS.contains(&23));
+    let lines = version_limitations(&r.report);
+    assert_eq!(lines.len(), 1);
+    assert!(lines[0].contains("After Effects 23.6.0x97 (saved by 26.2.1x2)"), "{}", lines[0]);
+    assert!(!r.comps.is_empty());
+}
+
+/// A missing, short or empty version word reads as `unknown` and the file still imports.
+#[test]
+fn a_file_without_a_version_reads_as_unknown_and_imports() {
+    // A zero word (After Effects itself refuses it, "[0.0x0]") and all ones.
+    for word in [0, u32::MAX] {
+        let r = report(&with_head_word(word));
+        assert_eq!(r.ae_version.file_version, UNKNOWN);
+        assert!(!r.ae_version.tested);
+        assert_eq!(version_limitations(&r).len(), 1);
+    }
+    // No `svap` (After Effects opens such a file): the id is renamed, the size kept.
+    let bytes = mutate(&mut |c| {
+        if c.is(b"svap") {
+            c.id = *b"xsvp";
+        }
+    });
+    let r = report(&bytes);
+    assert_eq!(r.ae_version.saved_by, UNKNOWN);
+    assert_eq!(r.ae_version.file_version, "26.2.1x2");
+    // A `head` too short for the word, and none at all.
+    for keep in [Some(5usize), None] {
+        let bytes = mutate(&mut |c| {
+            if c.is(b"head") {
+                match keep {
+                    Some(n) => {
+                        if let Body::Data(d) = &mut c.body {
+                            d.to_mut().truncate(n);
+                        }
+                    }
+                    None => c.id = *b"xhed",
+                }
+            }
+        });
+        let r = report(&bytes);
+        assert_eq!(r.ae_version, AeVersionInfo { file_version: UNKNOWN.into(), saved_by: "26.2.1x2".into(), tested: false });
+    }
+}
+
+#[test]
+fn a_report_without_the_field_still_reads() {
+    let mut json = serde_json::to_value(report(SYNTHETIC)).unwrap();
+    json.as_object_mut().unwrap().remove("aeVersion");
+    let r: ImportReport = serde_json::from_value(json).unwrap();
+    assert_eq!(r.ae_version, AeVersionInfo::default());
+    assert_eq!(r.ae_version.file_version, UNKNOWN);
+}
+
+/// The corpus families saved three ways.
+const FAMILIES: &[&str] =
+    &["1200-lumetri", "3d", "effects", "footage-precomp", "keyframes", "layers-comps", "markers", "masks", "settings-a", "shapes", "styles", "text"];
+
+/// The import of a file: the project as JSON, the report and the parsed versions.
+fn import_file(name: &str) -> Option<(serde_json::Value, ImportReport, effectcraft_project::ProjectSettings)> {
+    let bytes = crate::common::try_file(name)?;
+    let mut project = Project::default();
+    let none = |_: &str| false;
+    let opts = ImportOptions { allow_losses: true, ..ImportOptions::new(&none) };
+    let r = import(&mut project, &bytes, &opts).unwrap_or_else(|e| panic!("{name}: {e}"));
+    Some((serde_json::to_value(&project).unwrap(), r.report, r.settings))
+}
+
+/// Per corpus family, the 25.x and 24.x copies import to the same project and report as the 2026 save.
+#[test]
+#[ignore = "needs the version fixtures of the corpus (<family>-26/-25x/-24x.aep)"]
+fn copies_saved_as_25x_and_24x_import_like_the_2026_file() {
+    for family in FAMILIES {
+        let Some((project_26, report_26, settings_26)) = import_file(&format!("{family}-26.aep")) else { continue };
+        assert_eq!(report_26.ae_version, AeVersionInfo { file_version: "26.2.1x2".into(), saved_by: "26.2.1x2".into(), tested: true }, "{family}");
+        for (suffix, version) in [("25x", "25.6.0x97"), ("24x", "24.6.0x65")] {
+            let name = format!("{family}-{suffix}.aep");
+            let Some((project, report, settings)) = import_file(&name) else { continue };
+            assert_eq!(report.ae_version, AeVersionInfo { file_version: version.into(), saved_by: "26.2.1x2".into(), tested: true }, "{name}");
+            assert_eq!(project, project_26, "{name}: the imported project differs from the 2026 file's");
+            assert_eq!(settings, settings_26, "{name}: the imported settings differ from the 2026 file's");
+            let same_but_version = ImportReport { ae_version: report_26.ae_version.clone(), ..report };
+            assert_eq!(same_but_version, report_26, "{name}: the report differs from the 2026 file's");
+        }
+    }
+}
+
+/// Per corpus family, `head` holds the version each copy is written for and `svap` the writer.
+#[test]
+#[ignore = "needs the version fixtures of the corpus (<family>-26/-25x/-24x.aep)"]
+fn the_container_of_a_copy_states_its_version_in_head_and_the_writer_in_svap() {
+    for family in FAMILIES {
+        for (suffix, version, revision) in [("26", "26.2.1x2", 97), ("25x", "25.6.0x97", 96), ("24x", "24.6.0x65", 95)] {
+            let name = format!("{family}-{suffix}.aep");
+            let Some(bytes) = crate::common::try_file(&name) else { continue };
+            let file = parse(&bytes).unwrap();
+            assert_eq!(file.file_version().map(|v| v.text()).as_deref(), Some(version), "{name}");
+            assert_eq!(file.saved_by_version().map(|v| v.text()).as_deref(), Some("26.2.1x2"), "{name}");
+            assert_eq!(file.head_revision(), Some(revision), "{name}");
+        }
+    }
+}
diff --git a/crates/aep/tests/it/main.rs b/crates/aep/tests/it/main.rs
new file mode 100644
index 000000000..d004ac311
--- /dev/null
+++ b/crates/aep/tests/it/main.rs
@@ -0,0 +1,9 @@
+//! The integration tests of effectcraft-aep, one binary: the container (chunk tree and typed
+//! view), import and export tests, and the fixture access they share (`common`).
+
+#[macro_use]
+mod common;
+
+mod container;
+mod export;
+mod import;
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index b14b16321..e0caf3218 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -14,7 +14,9 @@ effectcraft-engine = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 image = { workspace = true }
+effectcraft-model = { workspace = true }
 
 [dev-dependencies]
 effectcraft-script = { workspace = true }
 effectcraft-host = { workspace = true }
+tempfile = { workspace = true }
diff --git a/crates/automation/src/backend.rs b/crates/automation/src/backend.rs
index c3947c876..69f75df2e 100644
--- a/crates/automation/src/backend.rs
+++ b/crates/automation/src/backend.rs
@@ -4,7 +4,7 @@ use effectcraft_engine::Session;
 use effectcraft_engine::time::Tick;
 use serde_json::{Value, json};
 
-use crate::confine::Confinement;
+use crate::confine::{ConfinedFootage, ConfinedServices, Confinement, Lookup};
 use crate::{BridgeClient, Error, Result, base64, encode_png, recompress_png};
 
 pub struct Backend {
@@ -39,8 +39,14 @@ impl Backend {
         Ok(Backend { target: Target::Bridge(BridgeClient::new(addr)?), confinement: None })
     }
 
-    /// Confine the files the commands run here may read and write ([`Confinement`]).
+    /// Confine the files the commands run here may read and write ([`Confinement`]). In-process,
+    /// the session's own footage and file reads are confined too, so a project from a read root
+    /// can't show footage from outside it.
     pub fn confine(&mut self, confinement: Confinement) {
+        if let Target::Headless(s) = &mut self.target {
+            s.footage = std::sync::Arc::new(ConfinedFootage::new(s.footage.clone(), confinement.clone()));
+            s.services = std::sync::Arc::new(ConfinedServices::new(s.services.clone(), confinement.clone()));
+        }
         self.confinement = Some(confinement);
     }
 
@@ -63,12 +69,11 @@ impl Backend {
     pub fn exec(&mut self, id: &str, params: Value) -> Result<Value> {
         let params = if params.is_null() { json!({}) } else { params };
         if let Some(c) = self.confinement.clone() {
-            let lookup = match c.check_command(id, &params)? {
-                Some(crate::confine::Lookup::ProjectFile) => Some((crate::confine::Lookup::ProjectFile, self.run("project.summary", json!({}))?)),
-                Some(crate::confine::Lookup::RenderOutputs) => Some((crate::confine::Lookup::RenderOutputs, self.run("renderQueue.list", json!({}))?)),
-                None => None,
-            };
-            if let Some((lookup, found)) = lookup {
+            for lookup in c.check_command(id, &params)? {
+                let found = match lookup {
+                    Lookup::ProjectFile | Lookup::QueueDefault => self.run("project.summary", json!({}))?,
+                    Lookup::RenderOutputs => self.run("renderQueue.list", json!({}))?,
+                };
                 c.check_lookup(&lookup, &found)?;
             }
         }
@@ -86,6 +91,18 @@ impl Backend {
         }
     }
 
+    /// Query whether the current project protects `path`. This is an advisory snapshot, not a
+    /// reservation: use [`Self::render_to_file`] to validate and write in the owning session.
+    /// Relative paths are resolved against this process's folder, because the app has its own.
+    pub fn check_output(&mut self, path: &str) -> Result<()> {
+        let absolute = std::path::absolute(path).map_err(|e| Error::BadArgs(format!("cannot resolve {path}: {e}")))?;
+        let found = self.exec("file.checkOutput", json!({"path": absolute.to_string_lossy()}))?;
+        match found.get("blocked").and_then(Value::as_bool) {
+            Some(false) => Ok(()),
+            _ => Err(Error::BadArgs(found.get("reason").and_then(Value::as_str).unwrap_or("this file is one the project reads").to_string())),
+        }
+    }
+
     /// Call a raw control-channel method (bridge only).
     pub fn control(&mut self, method: &str, params: Value) -> Result<Value> {
         match &mut self.target {
@@ -103,16 +120,40 @@ impl Backend {
     /// [`Backend::render`]; `transparent` keeps the frame's alpha instead of compositing it over
     /// the comp's background colour.
     pub fn render_with(&mut self, comp: Option<&Value>, time: Option<f64>, max_side: u32, transparent: bool) -> Result<Frame> {
+        self.render_output(comp, time, max_side, transparent, None)
+    }
+
+    /// Render and save in the owning session. In bridge mode, checking and writing are one
+    /// desktop operation, so another command cannot make the destination protected in between.
+    pub fn render_to_file(&mut self, comp: Option<&Value>, time: Option<f64>, max_side: u32, transparent: bool, path: &str) -> Result<Frame> {
+        if let Some(confinement) = self.confinement() {
+            confinement.check(path, crate::confine::Access::Write)?;
+        }
+        let absolute = std::path::absolute(path).map_err(|e| Error::BadArgs(format!("cannot resolve {path}: {e}")))?;
+        self.render_output(comp, time, max_side, transparent, Some(&absolute.to_string_lossy()))
+    }
+
+    fn render_output(&mut self, comp: Option<&Value>, time: Option<f64>, max_side: u32, transparent: bool, path: Option<&str>) -> Result<Frame> {
         match &mut self.target {
             Target::Headless(s) => {
+                if let Some(path) = path {
+                    s.refuse_export(path)?;
+                }
                 let cid = s.resolve_comp(comp).map_err(|_| no_comp(comp))?;
                 let t = time.map(Tick::from_seconds_f64).unwrap_or_else(|| s.time());
                 let (w, h, rgba) = s.render_rgba8_alpha(cid, t, max_side, transparent)?;
                 let png = encode_png(w, h, rgba, max_side)?;
+                if let Some(path) = path {
+                    s.write_output(path, &png)?;
+                }
                 Ok(Frame { png, comp: json!(cid.0), time: t.seconds(), width: w, height: h })
             }
             Target::Bridge(b) => {
                 let mut p = json!({"max_side": max_side, "base64": true});
+                if let Some(path) = path {
+                    p["path"] = json!(path);
+                    p["write"] = json!(true);
+                }
                 if transparent {
                     p["transparent"] = json!(true);
                 }
@@ -123,6 +164,11 @@ impl Backend {
                     p["comp"] = c.clone();
                 }
                 let r = b.call("render.frame", p)?;
+                if let Some(path) = path
+                    && r.get("path").and_then(Value::as_str) != Some(path)
+                {
+                    return Err(Error::App("render.frame did not confirm the saved path; update the connected app before saving frames".into()));
+                }
                 let data = r.get("png").and_then(Value::as_str).ok_or_else(|| Error::App("render.frame returned no `png`".into()))?;
                 let raw = base64::decode(data).ok_or_else(|| Error::App("render.frame: bad base64".into()))?;
                 let (png, width, height) = recompress_png(&raw, max_side)?;
diff --git a/crates/automation/src/confine.rs b/crates/automation/src/confine.rs
index f396b3da0..570726932 100644
--- a/crates/automation/src/confine.rs
+++ b/crates/automation/src/confine.rs
@@ -6,11 +6,23 @@
 //! `engine.batch`) is checked before it runs: its file parameters must be absolute paths inside
 //! the roots (symbolic links resolved, no `..`), any other absolute path in its parameters too,
 //! and commands that write to a file they are not given (Save, Increment and Save, rendering the
-//! Render Queue) are checked against where they would write. Commands that run code or open
-//! other applications (scripts, Execute File, Reveal in Finder…) are refused while confined.
+//! Render Queue) are checked against where they would write. Queueing a render without naming
+//! its output needs a saved project, because the default output of an unsaved one is the home
+//! folder. In a headless session the footage and other files a project or an imported file names
+//! are read only inside the roots ([`ConfinedFootage`], [`ConfinedServices`]). Commands that run
+//! code or open other applications (scripts, ScriptUI panels and the events that reach them,
+//! Execute File, effect helpers, Reveal in Finder…) are refused while confined, as is granting scripts the file
+//! and network access the user withheld.
 
 use std::path::{Component, Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
 
+use effectcraft_engine::Services;
+use effectcraft_engine::project::{Footage, ItemId};
+use effectcraft_engine::raster::{AuxChannels, Image};
+use effectcraft_engine::render::{FloatCurve, FootageSource};
+use effectcraft_engine::time::Tick;
 use serde_json::Value;
 
 use crate::{Error, Result};
@@ -28,18 +40,39 @@ pub struct Confinement {
     write: Vec<PathBuf>,
 }
 
-/// Commands that run code, act outside the project or open other applications.
+/// Commands that run code, act outside the project or open other applications, besides the
+/// commands that run scripts ([`effectcraft_engine::commands::scripts::RUNS_SCRIPTS`]).
 const REFUSED: &[&str] = &[
-    "script.run",
-    "file.runScript",
     "file.installScript",
     "file.installScriptUIPanel",
     "file.uninstallScript",
+    // Copies a plug-in (and a bundle's ScriptUI panels) from a user-chosen path into the folders
+    // the app loads code from: an agent must not plant code that runs on every start, and its
+    // sources are checked no better than `file.installScript`'s.
+    "effect.plugins.install",
+    // A ScriptUI panel's script runs when the panel opens, when an event reaches one of its
+    // controls, and when one of its `app.scheduleTask` tasks comes due.
+    "window.scriptPanel",
+    "window.restoreScriptPanels",
+    "script.runTasks",
+    "scriptui.click",
+    "scriptui.set",
+    "scriptui.mouse",
+    "scriptui.close",
     "file.executeFile",
+    "effect.helpers.scan",
+    "effect.helpers.load",
     "file.revealInFinder",
     "layer.openSource",
     "help.revealLogFile",
     "file.autoSave",
+    // The Plug-in Library downloads code, installs it to load at start-up and reads `file://` catalogs.
+    "library.refresh",
+    "library.install",
+    "library.update",
+    "library.uninstall",
+    "library.loadInstalled",
+    "library.preview",
 ];
 
 /// Commands that read files named by these parameters.
@@ -50,6 +83,7 @@ const READS: &[(&str, &[&str])] = &[
     ("file.importMultiple", &["paths"]),
     ("file.importRecent", &["path"]),
     ("file.importLottie", &["path"]),
+    ("file.importAep", &["path"]),
     ("file.importTimeline", &["path"]),
     ("file.replaceFootage", &["path"]),
     ("file.relinkFootage", &["folder"]),
@@ -64,16 +98,40 @@ const READS: &[(&str, &[&str])] = &[
     ("effect.plugins.load", &["path", "folder"]),
     ("mediaBrowser.go", &["path"]),
     ("mediaBrowser.addFavorite", &["path"]),
+    // #1243: these read the files they are given but were missing, so a relative path went
+    // unchecked.
+    ("essential.templateInfo", &["path"]),
+    ("file.importProject", &["path"]),
+    ("file.watchFolder.poll", &["folder"]),
+    ("footage.relink", &["path"]),
+    ("layer.newModel", &["path"]),
+    ("mediaBrowser.fileInfo", &["path"]),
+    ("mediaBrowser.list", &["path"]),
+    ("mediaBrowser.import", &["paths"]),
+    ("mediaBrowser.removeFavorite", &["path"]),
+    ("face.model.install", &["path"]),
+    ("roto.model.install", &["path"]),
+    // Looks up what the file at `path` is (writable roots are readable too).
+    ("file.checkOutput", &["path"]),
+    // Reads the template at `path`; what it writes is in `MIXED_WRITES`.
+    ("templates.create", &["path"]),
 ];
 
+/// Commands that read some parameters (listed in [`READS`]) and write others.
+const MIXED_WRITES: &[(&str, &[&str])] = &[("templates.create", &["projectPath", "footageDir"])];
+
 /// Commands that write files named by these parameters.
 const WRITES: &[(&str, &[&str])] = &[
+    ("camera.exportBlender", &["path"]),
     ("file.save", &["path"]),
     ("file.saveAs", &["path"]),
     ("file.saveCopy", &["path"]),
     ("file.saveCopyAsXml", &["path"]),
     ("file.collectFiles", &["folder"]),
+    // This query checks a proposed write destination, so it follows write confinement.
+    ("file.checkOutput", &["path"]),
     ("file.exportLottie", &["path"]),
+    ("file.exportAep", &["path"]),
     ("comp.saveFrameAs", &["path"]),
     ("comp.saveFrameAsPsd", &["path"]),
     ("comp.saveFrameAsExr", &["path"]),
@@ -84,11 +142,17 @@ const WRITES: &[(&str, &[&str])] = &[
     ("essential.exportTemplate", &["path"]),
     ("shortcuts.export", &["path"]),
     ("renderQueue.add", &["output", "path"]),
+    ("file.exportTimeline", &["path"]),
+    // `path` / `output` may also be a file-name template, as for render.preRender.
+    ("file.createProxy", &["path", "output"]),
 ];
 
 /// Commands that write where they are not told: the project's file, the Render Queue's outputs.
 const IMPLICIT_WRITES: &[&str] = &["file.save", "file.incrementAndSave", "renderQueue.render", "render.preRender"];
 
+/// Commands that queue a render, whose output defaults to the project's folder when not given.
+const QUEUES_AN_OUTPUT: &[&str] = &["renderQueue.add", "render.preRender", "file.createProxy"];
+
 /// What must be looked up before an implicitly writing command may run.
 #[derive(Debug, PartialEq, Eq)]
 pub enum Lookup {
@@ -96,6 +160,10 @@ pub enum Lookup {
     ProjectFile,
     /// Every output of the queued Render Queue items (`renderQueue.list`).
     RenderOutputs,
+    /// Whether the open project has a file (`project.summary` → `path`): a render queued without
+    /// `output` (Render Queue, Pre-render, Create Proxy) writes beside it, or to the home folder
+    /// before the first save.
+    QueueDefault,
 }
 
 impl Confinement {
@@ -134,24 +202,34 @@ impl Confinement {
 
     /// Check engine command `id` with `params` before it runs. Returns what must still be looked
     /// up and passed to [`Confinement::check_lookup`] for commands that write implicitly.
-    pub fn check_command(&self, id: &str, params: &Value) -> Result<Option<Lookup>> {
-        if REFUSED.contains(&id) {
+    pub fn check_command(&self, id: &str, params: &Value) -> Result<Vec<Lookup>> {
+        if REFUSED.contains(&id) || effectcraft_engine::commands::scripts::RUNS_SCRIPTS.contains(&id) {
             return Err(Error::BadArgs(format!("`{id}` is not available while file access is confined (--automation-read-root/--automation-write-root)")));
         }
+        // Scripts can't grant themselves the access the user withheld
+        // (`effectcraft_engine::prefs::Scripting::same_permissions`), and neither may a confined
+        // agent: `prefs.set` saves the settings file, so a script run long after this session
+        // would still have it. (`prefs.reset` only puts the defaults back, which grant nothing.)
+        if id == "prefs.set" && prefs_keys(params).iter().any(|k| is_scripting_pref(k)) {
+            return Err(Error::BadArgs(
+                "`prefs.set`: the Scripting settings decide what a script may do, so they can't be changed while file access is confined".into(),
+            ));
+        }
         if id == "engine.batch" {
             for step in params.get("steps").and_then(Value::as_array).into_iter().flatten() {
                 let Some(inner) = step.get("command").or_else(|| step.get("id")).and_then(Value::as_str) else { continue };
                 let inner_params = step.get("params").cloned().unwrap_or(Value::Null);
                 let named = keys_of(READS, inner).or_else(|| keys_of(WRITES, inner)).unwrap_or(&[]);
+                let mixed = keys_of(MIXED_WRITES, inner).unwrap_or(&[]);
                 // A step's `$N` reference is resolved only as the batch runs: never for a file.
-                if named.iter().filter_map(|k| inner_params.get(*k)).any(has_reference) {
+                if named.iter().chain(mixed).filter_map(|k| inner_params.get(*k)).any(has_reference) {
                     return Err(Error::BadArgs(format!("`{inner}` in a batch: file paths can't be `$N` references while file access is confined")));
                 }
-                if self.check_command(inner, &inner_params)?.is_some() {
+                if !self.check_command(inner, &inner_params)?.is_empty() {
                     return Err(Error::BadArgs(format!("`{inner}` writes to its project's or queue's files: run it on its own while file access is confined")));
                 }
             }
-            return Ok(None);
+            return Ok(vec![]);
         }
         let (named, access) = match (keys_of(WRITES, id), keys_of(READS, id)) {
             (Some(k), _) => (k, Access::Write),
@@ -160,6 +238,10 @@ impl Confinement {
             (None, None) => (&[][..], Access::Read),
         };
         let mut given = false;
+        // Whether one of them is a file: not a Render Queue template, whose own output is relative
+        // and resolved like one the agent never gave, and not an array, which the commands that
+        // take a single output read as nothing at all.
+        let mut gave_a_file = false;
         for key in named {
             let Some(v) = params.get(*key).filter(|v| !v.is_null()) else { continue };
             given = true;
@@ -170,17 +252,27 @@ impl Confinement {
             for p in paths {
                 // A Render Queue output may name a template instead of a file.
                 match p.as_str() {
-                    Some(s) if id == "render.preRender" && !looks_like_path(s) => {}
+                    Some(s) if matches!(id, "render.preRender" | "file.createProxy") && !looks_like_path(s) => {}
                     Some(s) => {
+                        gave_a_file |= v.is_string();
                         self.check(s, access)?;
                     }
                     None => return Err(Error::BadArgs(format!("`{id}`: `{key}` must be a path"))),
                 }
             }
         }
+        // Parameters of a reading command that it writes to.
+        let mixed = keys_of(MIXED_WRITES, id).unwrap_or(&[]);
+        for key in mixed {
+            if let Some(p) = params.get(*key).filter(|v| !v.is_null()) {
+                let p = p.as_str().ok_or_else(|| Error::BadArgs(format!("`{id}`: `{key}` must be a path")))?;
+                self.check(p, Access::Write)?;
+            }
+        }
         // Any other absolute path the command is given.
+        let named: Vec<&str> = named.iter().chain(mixed).copied().collect();
         let mut other = vec![];
-        absolute_strings(params, named, &mut other);
+        absolute_strings(params, &named, &mut other);
         for s in other {
             self.check(&s, access)?;
         }
@@ -188,10 +280,19 @@ impl Confinement {
         if matches!(id, "file.openRecent" | "file.importRecent" | "anim.applyRecentPreset") && !given {
             return Err(Error::BadArgs(format!("`{id}`: give `path` while file access is confined")));
         }
-        if IMPLICIT_WRITES.contains(&id) && !(given && id == "file.save") {
-            return Ok(Some(if id == "file.save" || id == "file.incrementAndSave" { Lookup::ProjectFile } else { Lookup::RenderOutputs }));
+        let mut lookups = vec![];
+        // An output the agent did not name is derived from where the project sits: the Default
+        // Output Folder preference when that is set, beside the project file otherwise — and the
+        // home folder when the project has never been saved, outside every root (#2479). Only
+        // that last case is certainly outside, and reading the preference here would duplicate
+        // the engine's precedence, so an unsaved project is told to name its output instead.
+        if QUEUES_AN_OUTPUT.contains(&id) && !gave_a_file {
+            lookups.push(Lookup::QueueDefault);
         }
-        Ok(None)
+        if IMPLICIT_WRITES.contains(&id) && !(given && id == "file.save") {
+            lookups.push(if id == "file.save" || id == "file.incrementAndSave" { Lookup::ProjectFile } else { Lookup::RenderOutputs });
+        }
+        Ok(lookups)
     }
 
     /// Check what a [`Lookup`] found: `project.summary` or `renderQueue.list`'s result.
@@ -202,6 +303,13 @@ impl Confinement {
                 Some(p) => self.check(p, Access::Write).map(drop),
                 None => Err(Error::BadArgs("the project has no file yet: give `path` (Save As) inside an automation write root".into())),
             },
+            // A saved project's default output sits beside it, and rendering checks it then.
+            Lookup::QueueDefault => match found.get("path").and_then(Value::as_str) {
+                Some(_) => Ok(()),
+                None => Err(Error::BadArgs(
+                    "the project has no file yet, so the default output would go to the home folder: give `output` inside an automation write root, or save the project inside one first".into(),
+                )),
+            },
             Lookup::RenderOutputs => {
                 let items = found.get("items").or(Some(found)).and_then(Value::as_array).cloned().unwrap_or_default();
                 for it in items.iter().filter(|it| it.get("render").and_then(Value::as_bool) != Some(false)) {
@@ -218,6 +326,187 @@ impl Confinement {
     }
 }
 
+/// The session's footage, read only inside the read roots (#2131 F-11, "Indirect reads"). The
+/// commands an agent runs are checked by the paths they are given, but a project opened or
+/// imported from a read root names its own footage, which is read when it renders: a file
+/// outside the roots shows as missing footage instead.
+pub struct ConfinedFootage {
+    inner: Arc<dyn FootageSource>,
+    confinement: Confinement,
+}
+
+impl ConfinedFootage {
+    pub fn new(inner: Arc<dyn FootageSource>, confinement: Confinement) -> Self {
+        Self { inner, confinement }
+    }
+
+    /// Whether every file of `f` (its file and each frame of a sequence) is inside the roots.
+    /// Checked on every read, not remembered: a symbolic link inside a root can be pointed
+    /// elsewhere after it was first read.
+    fn inside(&self, f: &Footage) -> bool {
+        std::iter::once(&f.path).chain(&f.sequence).filter(|p| !p.is_empty()).all(|p| self.confinement.check(p, Access::Read).is_ok())
+    }
+
+    /// [`Self::inside`] for a read: a refused one is counted on this thread, so the render
+    /// [`recording`](FootageSource::recording) it can't list what it made without the footage.
+    fn readable(&self, f: &Footage) -> bool {
+        let inside = self.inside(f);
+        if !inside {
+            let _ = REFUSED_READS.try_with(|n| n.set(n.get().wrapping_add(1)));
+        }
+        inside
+    }
+}
+
+thread_local! {
+    /// Footage reads refused on this thread (see [`ConfinedFootage::readable`]).
+    static REFUSED_READS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
+/// The number of reads this thread has refused for lying outside the allowed roots.
+fn refused_reads() -> u64 {
+    REFUSED_READS.try_with(std::cell::Cell::get).unwrap_or(0)
+}
+
+impl FootageSource for ConfinedFootage {
+    /// The frame from the inner source, or `None` when the footage lies outside the allowed roots.
+    fn frame(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<Image>> {
+        self.readable(footage).then(|| self.inner.frame(item, footage, t)).flatten()
+    }
+    /// The frame scaled to `width` by `height`, or `None` when the footage lies outside the allowed roots.
+    fn frame_at_size(&self, item: ItemId, footage: &Footage, t: Tick, width: u32, height: u32) -> Option<Arc<Image>> {
+        self.readable(footage).then(|| self.inner.frame_at_size(item, footage, t, width, height)).flatten()
+    }
+    /// The frame with an explicit size and float curve, or `None` when the footage lies outside the allowed roots.
+    fn frame_with(&self, item: ItemId, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) -> Option<Arc<Image>> {
+        self.readable(footage).then(|| self.inner.frame_with(item, footage, t, size, float)).flatten()
+    }
+    /// The footage audio from the inner source, or `None` when the footage lies outside the allowed roots.
+    fn audio(&self, item: ItemId, footage: &Footage, t: Tick, frames: usize, rate: u32) -> Option<Vec<f32>> {
+        self.readable(footage).then(|| self.inner.audio(item, footage, t, frames, rate)).flatten()
+    }
+    /// The auxiliary channels of the footage frame, or `None` when the footage lies outside the allowed roots.
+    fn aux(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<AuxChannels>> {
+        self.readable(footage).then(|| self.inner.aux(item, footage, t)).flatten()
+    }
+    /// Forwards the auxiliary footage paths to the inner source.
+    fn set_aux_footage(&self, paths: &[String]) {
+        self.inner.set_aux_footage(paths)
+    }
+    /// The 3D model for the footage, or `None` when the footage lies outside the allowed roots.
+    fn model(&self, item: ItemId, footage: &Footage) -> Option<Arc<effectcraft_model::Model>> {
+        self.readable(footage).then(|| self.inner.model(item, footage)).flatten()
+    }
+    /// The rasterised vector footage at `scale`, or `None` when the footage lies outside the allowed roots.
+    fn vector_frame(&self, item: ItemId, footage: &Footage, scale: f64) -> Option<Arc<Image>> {
+        self.readable(footage).then(|| self.inner.vector_frame(item, footage, scale)).flatten()
+    }
+    /// Says why footage outside the roots shows nothing, so the agent can act on it.
+    fn problem(&self, footage: &Footage) -> Option<String> {
+        if !self.inside(footage) {
+            return Some(format!("{} is outside the automation read roots, so it is not read", footage.path));
+        }
+        self.inner.problem(footage)
+    }
+    fn set_cache_budget(&self, bytes: usize) {
+        self.inner.set_cache_budget(bytes)
+    }
+    fn purge(&self) {
+        self.inner.purge()
+    }
+    fn forget(&self, path: &str) {
+        self.inner.forget(path)
+    }
+    fn set_conform_folder(&self, folder: Option<PathBuf>) {
+        self.inner.set_conform_folder(folder)
+    }
+    /// The inner source's cache budget.
+    fn cache_budget(&self) -> Option<usize> {
+        self.inner.cache_budget()
+    }
+    /// Runs `f` under the inner source's cancel flag.
+    fn cancellable(&self, cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
+        self.inner.cancellable(cancel, f)
+    }
+    /// Whether the inner source has been called off.
+    fn called_off(&self) -> bool {
+        self.inner.called_off()
+    }
+    /// The files read inside the roots, as the inner source notes them. Footage outside reads
+    /// nothing, and what is made without it can't be listed by its files: a refused read makes
+    /// the list incomplete, so it never outlives the session in a disk cache (another session
+    /// with other roots would read the footage).
+    fn recording(&self, reads: &effectcraft_engine::render::reads::ReadLog, f: &mut dyn FnMut()) {
+        let refused = refused_reads();
+        self.inner.recording(reads, f);
+        if refused_reads() != refused {
+            reads.mark_incomplete();
+        }
+    }
+}
+
+/// The session's file reads, only inside the read roots: what a project or an imported file
+/// pulls in by itself (an SVG's or Lottie's images, a timeline's media) is checked like a path
+/// the agent gives. Writes are left to the command checks.
+pub struct ConfinedServices {
+    inner: Arc<dyn Services>,
+    confinement: Confinement,
+}
+
+impl ConfinedServices {
+    pub fn new(inner: Arc<dyn Services>, confinement: Confinement) -> Self {
+        Self { inner, confinement }
+    }
+
+    fn inside(&self, path: &str) -> bool {
+        self.confinement.check(path, Access::Read).is_ok()
+    }
+}
+
+impl Services for ConfinedServices {
+    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+        self.confinement.check(path, Access::Read).map_err(|e| std::io::Error::new(std::io::ErrorKind::PermissionDenied, e.to_string()))?;
+        self.inner.read_file(path)
+    }
+    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        self.inner.write_file(path, data)
+    }
+    fn exists(&self, path: &str) -> bool {
+        self.inside(path) && self.inner.exists(path)
+    }
+    fn stamp(&self, path: &str) -> Option<(u64, u128)> {
+        if self.inside(path) { self.inner.stamp(path) } else { None }
+    }
+    fn store_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        self.inner.store_file(path, data)
+    }
+    fn list_dir(&self, dir: &str) -> Vec<String> {
+        if self.inside(dir) { self.inner.list_dir(dir) } else { vec![] }
+    }
+    fn is_dir(&self, path: &str) -> bool {
+        self.inside(path) && self.inner.is_dir(path)
+    }
+    fn full_path(&self, path: &str) -> Option<String> {
+        self.inner.full_path(path)
+    }
+}
+
+/// Whether a `prefs.set` key reaches the Scripting page. `Prefs::set` turns the key into a JSON
+/// pointer (`key.replace('.', "/")`), so `scripting/allowScriptsWriteFiles` resolves as well as
+/// the dotted spelling, and the page on its own replaces every setting on it.
+fn is_scripting_pref(key: &str) -> bool {
+    key.split(['.', '/']).next().is_some_and(|page| page.eq_ignore_ascii_case("scripting"))
+}
+
+/// The settings `prefs.set` is given: `key`, and the keys of `values`.
+fn prefs_keys(params: &Value) -> Vec<&str> {
+    let mut keys: Vec<&str> = params.get("key").and_then(Value::as_str).into_iter().collect();
+    if let Some(Value::Object(m)) = params.get("values") {
+        keys.extend(m.keys().map(String::as_str));
+    }
+    keys
+}
+
 fn keys_of(table: &[(&str, &'static [&'static str])], id: &str) -> Option<&'static [&'static str]> {
     table.iter().find(|(c, _)| *c == id).map(|(_, k)| *k)
 }
@@ -274,3 +563,189 @@ fn resolve(p: &Path) -> Option<PathBuf> {
         at = at.parent()?;
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Commands whose parameters are named like files but aren't: property paths
+    /// (`path|prop`), project folders, layers to track or target.
+    const NOT_FILES: &[&str] = &[
+        "camera.createFromSolve",
+        "edit.label",
+        "edit.pasteReversedKeyframes",
+        "effect.editDropdown",
+        "essential.addProperty",
+        "essential.canAdd",
+        "essential.linkProperty",
+        "essential.unlinkProperty",
+        "keys.paste",
+        "keys.set",
+        "keys.setEase",
+        "keys.setSpatialTangents",
+        "paths.nullsFollowPoints",
+        "paths.pointsFollowNulls",
+        "paths.tracePath",
+        "project.move",
+        "prop.addKey",
+        "prop.convertExpressionToKeyframes",
+        "prop.deselect",
+        "prop.editGradient",
+        "prop.get",
+        "prop.pickWhip",
+        "prop.reset",
+        "prop.select",
+        "prop.set",
+        "prop.setExpression",
+        "prop.toggleAnimation",
+        "prop.toggleKey",
+        "track.new",
+        "track.property",
+        "track.setTarget",
+    ];
+
+    /// Every engine command with a parameter named like a file is classified, so a new one
+    /// can't silently skip confinement (#1243): it reads or writes the files it is given, is
+    /// refused, writes where it isn't told (checked by a lookup), sets Render Queue outputs
+    /// (checked when the queue renders), or is listed in `NOT_FILES`.
+    #[test]
+    fn every_command_with_file_parameters_is_classified() {
+        const FILE_KEYS: &[&str] =
+            &["path", "paths", "folder", "file", "files", "dir", "directory", "output", "outputs", "source", "target", "projectPath", "footageDir"];
+        let mut missing = vec![];
+        for spec in effectcraft_engine::command_specs() {
+            let Some(params) = effectcraft_engine::commands::accepted_params(spec.params) else { continue };
+            let id = spec.id;
+            let classified = keys_of(READS, id).is_some()
+                || keys_of(WRITES, id).is_some()
+                || REFUSED.contains(&id)
+                || effectcraft_engine::commands::scripts::RUNS_SCRIPTS.contains(&id)
+                || IMPLICIT_WRITES.contains(&id)
+                || id.starts_with("renderQueue.")
+                || id == "render.addOutputModule"
+                || NOT_FILES.contains(&id);
+            if params.iter().any(|p| FILE_KEYS.contains(&p.as_str())) && !classified {
+                missing.push(format!("{id} {}", spec.params));
+            }
+        }
+        assert!(missing.is_empty(), "add these to READS / WRITES / REFUSED or NOT_FILES:\n{}", missing.join("\n"));
+        // And every listed command exists.
+        for id in READS.iter().chain(WRITES).chain(MIXED_WRITES).map(|(c, _)| *c).chain(NOT_FILES.iter().copied()) {
+            assert!(effectcraft_engine::command_specs().iter().any(|s| s.id == id), "{id} is not a command");
+        }
+    }
+
+    /// Footage outside the roots shows nothing: a render that asked for it can't be listed by its
+    /// files (#3184), or a disk cache would keep the empty picture for a session with other
+    /// roots. Reads inside the roots record as the inner source tells.
+    #[test]
+    fn a_refused_footage_read_makes_the_render_unlisted() {
+        use effectcraft_engine::render::reads::{FileStamp, ReadFile, ReadLog};
+        /// Reads every file, noting it.
+        struct Noting;
+        impl FootageSource for Noting {
+            /// Returns a 1x1 frame and notes the footage path it was asked for.
+            fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+                NOTED.with(|n| n.borrow_mut().push(f.path.clone()));
+                Some(Arc::new(Image::new(1, 1)))
+            }
+            /// Runs `f`, then reports every path noted meanwhile to `reads` as a file with a missing stamp.
+            fn recording(&self, reads: &ReadLog, f: &mut dyn FnMut()) {
+                f();
+                for p in NOTED.with(|n| std::mem::take(&mut *n.borrow_mut())) {
+                    reads.note(ReadFile::new(p, FileStamp::Missing));
+                }
+            }
+        }
+        thread_local! {
+            static NOTED: std::cell::RefCell<Vec<String>> = const { std::cell::RefCell::new(Vec::new()) };
+        }
+        // (a fresh directory, removed when the test ends, panicking or not)
+        let tmp = tempfile::tempdir().unwrap();
+        let base = tmp.path();
+        let (inside, outside) = (base.join("in"), base.join("elsewhere"));
+        for d in [&inside, &outside] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        let c = Confinement::new(std::slice::from_ref(&inside), &[]).unwrap();
+        let src = ConfinedFootage::new(Arc::new(Noting), c);
+        let footage = |d: &std::path::Path| Footage { path: d.join("a.png").to_string_lossy().into_owned(), ..Default::default() };
+        let read = |f: &Footage| {
+            let log = ReadLog::new();
+            let mut got = None;
+            src.recording(&log, &mut || got = src.frame(ItemId(1), f, Tick::ZERO));
+            (got.is_some(), log.into_files())
+        };
+        let (shown, files) = read(&footage(&inside));
+        assert!(shown && files.is_complete() && files.len() == 1, "inside the roots: {files:?}");
+        let (shown, files) = read(&footage(&outside));
+        assert!(!shown && !files.is_complete(), "outside the roots: {files:?}");
+        // The next render on the thread is not affected.
+        assert!(read(&footage(&inside)).1.is_complete());
+    }
+
+    #[test]
+    fn relative_and_outside_paths_of_newly_listed_commands_are_refused() {
+        let base = std::env::temp_dir().join(format!("ec-confine-1243-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let (read, write, outside) = (base.join("in"), base.join("out"), base.join("elsewhere"));
+        for d in [&read, &write, &outside] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        let c = Confinement::new(std::slice::from_ref(&read), std::slice::from_ref(&write)).unwrap();
+        let p = |d: &std::path::Path, f: &str| d.join(f).to_string_lossy().into_owned();
+        let up = format!("{}/../elsewhere/t.ectemplate", read.display());
+        for (id, key) in [
+            ("essential.templateInfo", "path"),
+            ("file.importProject", "path"),
+            ("footage.relink", "path"),
+            ("layer.newModel", "path"),
+            ("mediaBrowser.fileInfo", "path"),
+            ("mediaBrowser.list", "path"),
+            ("face.model.install", "path"),
+            ("templates.create", "path"),
+        ] {
+            for bad in ["t.ectemplate".to_string(), "../elsewhere/t.ectemplate".to_string(), up.clone(), p(&outside, "t.ectemplate")] {
+                assert!(c.check_command(id, &serde_json::json!({key: bad})).is_err(), "{id} {key}={bad}");
+            }
+            assert!(c.check_command(id, &serde_json::json!({key: p(&read, "t.ectemplate")})).is_ok(), "{id} in a read root");
+        }
+        // Batched too.
+        let steps = serde_json::json!({"steps": [{"command": "essential.templateInfo", "params": {"path": "t.ectemplate"}}]});
+        assert!(c.check_command("engine.batch", &steps).is_err());
+        // Writes: into a write root only.
+        for id in ["file.exportTimeline", "file.checkOutput"] {
+            for bad in ["cut.xml".to_string(), p(&read, "cut.xml"), p(&outside, "cut.xml")] {
+                assert!(c.check_command(id, &serde_json::json!({"path": bad})).is_err(), "{id} {bad}");
+            }
+            assert!(c.check_command(id, &serde_json::json!({"path": p(&write, "cut.xml")})).is_ok());
+        }
+        let create = |project: String| serde_json::json!({"path": p(&read, "t.ectemplate"), "projectPath": project});
+        assert!(c.check_command("templates.create", &create(p(&read, "new.ecproj"))).is_err(), "templates.create writes projectPath");
+        assert!(c.check_command("templates.create", &create(p(&write, "new.ecproj"))).is_ok());
+        assert!(c.check_command("file.createProxy", &serde_json::json!({"output": "[compName]_proxy"})).is_ok(), "a template name");
+        assert!(c.check_command("file.createProxy", &serde_json::json!({"output": p(&outside, "proxy.mov")})).is_err());
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
+    /// Installing a plug-in plants code the app runs at every start, so confinement refuses it
+    /// even when the file is inside a read root (like `file.installScript`).
+    #[test]
+    fn installing_plugins_is_refused_while_confined() {
+        let base = std::env::temp_dir().join(format!("ec-confine-plugins-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let read = base.join("in");
+        std::fs::create_dir_all(&read).unwrap();
+        let c = Confinement::new(std::slice::from_ref(&read), &[]).unwrap();
+        let inside = read.join("a.wasm").to_string_lossy().into_owned();
+        for params in [
+            serde_json::json!({"path": inside}),
+            serde_json::json!({"folder": read.to_string_lossy()}),
+            serde_json::json!({"path": "a.wasm"}),
+            serde_json::json!({"bundle": true}),
+        ] {
+            assert!(c.check_command("effect.plugins.install", &params).is_err(), "{params}");
+        }
+        let _ = std::fs::remove_dir_all(&base);
+    }
+}
diff --git a/crates/automation/src/tests.rs b/crates/automation/src/tests.rs
index 6e622b377..92b62da2f 100644
--- a/crates/automation/src/tests.rs
+++ b/crates/automation/src/tests.rs
@@ -57,6 +57,50 @@ fn property_group_error_points_to_layer_inspection() {
     assert!(call_json(&mut s, "get_property", json!({"layer": l, "path": "geometryOptions/extrusionDepth"}))["value"].is_number());
 }
 
+/// Enum properties list their values and labels, so a client can set one without guessing (#2085).
+#[test]
+fn enum_properties_list_their_options() {
+    let mut s = server();
+    call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"name": "probe"}}));
+    call_json(&mut s, "execute_command", json!({"command": "layer.newText", "params": {"name": "T", "text": "Hello"}}));
+    call_json(&mut s, "execute_command", json!({"command": "layer.addTextAnimator", "params": {"layer": "T", "properties": ["opacity"], "name": "A"}}));
+    let path = "text/animators/animator/selectors/rangeSelector/advanced/shape";
+    let shapes = ["Square", "Ramp Up", "Ramp Down", "Triangle", "Round", "Smooth"];
+    let expected = json!(shapes.iter().enumerate().map(|(value, label)| json!({"value": value, "label": label})).collect::<Vec<_>>());
+
+    let p = call_json(&mut s, "get_property", json!({"layer": "T", "path": path}));
+    assert_eq!(p["type"], "enum");
+    assert_eq!(p["options"], expected, "{p}");
+    let opacity = call_json(&mut s, "get_property", json!({"layer": "T", "path": "transform/opacity"}));
+    assert!(opacity.get("options").is_none(), "{opacity}");
+
+    fn find<'a>(node: &'a Value, path: &str) -> Option<&'a Value> {
+        if node["path"] == path {
+            return Some(node);
+        }
+        node["children"].as_array()?.iter().find_map(|c| find(c, path))
+    }
+    let tree = call_json(&mut s, "get_layer", json!({"layer": "T"}));
+    let node = find(&tree["properties"], path).unwrap_or_else(|| panic!("{tree}"));
+    assert_eq!(node["options"], expected);
+    assert!(find(&tree["properties"], "transform/opacity").unwrap()["options"].is_null());
+
+    let flat = call_json(&mut s, "get_layer", json!({"layer": "T", "flat": true}));
+    let props = flat["properties"].as_array().unwrap();
+    assert_eq!(props.iter().find(|p| p["path"] == path).unwrap()["options"], expected);
+    assert!(props.iter().find(|p| p["path"] == "transform/opacity").unwrap().get("options").is_none());
+
+    // Path Options ▸ Path offers None and the layer's masks, as the Timeline does.
+    for _ in 0..2 {
+        call_json(&mut s, "execute_command", json!({"command": "mask.new", "params": {"layer": "T", "vertices": [[0, 0], [40, 0], [40, 40]], "closed": true}}));
+    }
+    let masks = json!([{"value": 0, "label": "None"}, {"value": 1, "label": "Mask 1"}, {"value": 2, "label": "Mask 2"}]);
+    let p = call_json(&mut s, "get_property", json!({"layer": "T", "path": "text/pathOptions/path"}));
+    assert_eq!(p["options"], masks, "{p}");
+    let tree = call_json(&mut s, "get_layer", json!({"layer": "T"}));
+    assert_eq!(find(&tree["properties"], "text/pathOptions/path").unwrap_or_else(|| panic!("{tree}"))["options"], masks);
+}
+
 #[test]
 fn initialize_and_list_tools() {
     let mut s = server();
@@ -442,6 +486,21 @@ fn autosave_flushes_on_read_errors_and_broken_output() {
     std::fs::remove_dir_all(dir).unwrap();
 }
 
+fn fake_render_frame(session: &Session, params: &Value) -> Value {
+    let png = crate::encode_png(4, 2, vec![255; 32], 0).unwrap();
+    if params["write"] == true {
+        let Some(path) = params["path"].as_str() else { return json!({"ok": false, "error": "missing output path"}) };
+        if let Err(error) = session.write_output(path, &png) {
+            return json!({"ok": false, "error": error.to_string()});
+        }
+    }
+    let mut result = json!({"comp": 1, "time": 0.5, "width": 4, "height": 2, "png": base64::encode(&png)});
+    if params["write"] == true {
+        result["path"] = params["path"].clone();
+    }
+    json!({"ok": true, "result": result})
+}
+
 /// A fake desktop control channel: answers `engine.execute` from a real session, and canned
 /// `render.frame` / `ui.screenshot` replies.
 fn fake_app() -> u16 {
@@ -459,10 +518,7 @@ fn fake_app() -> u16 {
                     Ok(v) => json!({"ok": true, "result": v}),
                     Err(e) => json!({"ok": false, "error": e.to_string()}),
                 },
-                "render.frame" => {
-                    let png = crate::encode_png(4, 2, vec![255; 32], 0).unwrap();
-                    json!({"ok": true, "result": {"comp": 1, "time": 0.5, "width": 4, "height": 2, "png": base64::encode(&png)}})
-                }
+                "render.frame" => fake_render_frame(&session, p),
                 "ui.screenshot" => {
                     let png = crate::encode_png(8, 8, vec![128; 256], 0).unwrap();
                     std::fs::write(p["path"].as_str().unwrap(), png).unwrap();
@@ -491,6 +547,8 @@ fn bridge_forwards_to_control_channel() {
 
     call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"name": "B", "width": 64, "height": 64}}));
     assert_eq!(call_json(&mut s, "get_comp", json!({}))["name"], "B");
+    let cmds = call_json(&mut s, "list_commands", json!({"filter": "layer.newSolid", "compact": true}));
+    assert!(cmds.as_array().unwrap().contains(&json!({"id": "layer.newSolid", "label": "Solid..."})), "{cmds}");
 
     let (c, err) = call(&mut s, "render_frame", json!({}));
     assert!(!err, "{c:?}");
@@ -738,6 +796,40 @@ fn every_engine_command_is_reachable_over_mcp() {
     }
 }
 
+/// `compact: true` shrinks the listings for MCP clients' tool-result limits (#2020): commands with
+/// only `id` and `label`, effects with only `id`, `name` and `category`.
+#[test]
+fn compact_listings_keep_only_ids_and_names() {
+    let mut s = server();
+    let cmds = call_json(&mut s, "list_commands", json!({"filter": "layer.new", "compact": true}));
+    assert!(cmds.as_array().unwrap().contains(&json!({"id": "layer.newSolid", "label": "Solid..."})), "{cmds}");
+    let fx = call_json(&mut s, "list_effects", json!({"filter": "gaussian", "compact": true}));
+    assert!(fx.as_array().unwrap().contains(&json!({"id": "ec.blur.gaussian", "name": "Gaussian Blur", "category": "Blur & Sharpen"})), "{fx}");
+    // Each compact listing is the full one with the same arguments, entry for entry; `compact`
+    // wins over `schemas`.
+    let check = |s: &mut McpServer, tool: &str, args: Value, keys: &[&str]| {
+        let full = call_json(s, tool, args.clone());
+        let want: Value = full.as_array().unwrap().iter().map(|e| Value::Object(keys.iter().map(|&k| (k.to_string(), e[k].clone())).collect())).collect();
+        let mut compact = args.clone();
+        compact["compact"] = json!(true);
+        assert_eq!(call_json(s, tool, compact), want, "{tool} {args}");
+    };
+    for args in [json!({}), json!({"filter": "layer.new"}), json!({"enabled_only": true}), json!({"schemas": true})] {
+        check(&mut s, "list_commands", args.clone(), &["id", "label"]);
+        check(&mut s, "command_list", args, &["id", "label"]);
+    }
+    check(&mut s, "list_effects", json!({}), &["id", "name", "category"]);
+    check(&mut s, "list_effects", json!({"filter": "gaussian"}), &["id", "name", "category"]);
+    // `compact: false` is the default listing, byte for byte; `compact: true` is a fraction of it.
+    let text = |s: &mut McpServer, tool: &str, args: Value| call(s, tool, args).0[0]["text"].as_str().unwrap().to_string();
+    for (tool, ratio) in [("list_commands", 2), ("list_effects", 10)] {
+        let full = text(&mut s, tool, json!({}));
+        assert_eq!(text(&mut s, tool, json!({"compact": false})), full, "{tool}");
+        let compact = text(&mut s, tool, json!({"compact": true})).len();
+        assert!(compact * ratio < full.len(), "{tool}: {compact} of {} bytes", full.len());
+    }
+}
+
 #[test]
 fn high_level_tools_add_effect_and_report_state() {
     let mut s = server();
@@ -1336,6 +1428,12 @@ fn automation_roots_confine_file_access() {
         assert!(err, "{name} {args} should be refused: {c:?}");
         c[0]["text"].as_str().unwrap_or_default().to_string()
     };
+    // #2479: an unsaved project's queue item without `output` would write to the home folder.
+    call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"name": "Unsaved", "width": 64, "height": 64}}));
+    let msg = denied(&mut s, "execute_command", json!({"command": "renderQueue.add", "params": {"comp": "Unsaved"}}));
+    assert!(msg.contains("home folder") && msg.contains("give `output`"), "{msg}");
+    call_json(&mut s, "execute_command", json!({"command": "renderQueue.add", "params": {"comp": "Unsaved", "output": p(&write, "unsaved.mp4")}}));
+    call_json(&mut s, "execute_command", json!({"command": "renderQueue.remove"}));
     // Reading: inside a read root, not outside.
     call_json(&mut s, "open_project", json!({"path": p(&read, "source.ecproj")}));
     let msg = denied(&mut s, "open_project", json!({"path": p(&outside, "free.ecproj")}));
@@ -1376,7 +1474,394 @@ fn automation_roots_confine_file_access() {
     // Scripts can read and write anything: refused.
     denied(&mut s, "run_script", json!({"code": "1 + 1"}));
     denied(&mut s, "execute_command", json!({"command": "file.runScript", "params": {"path": p(&read, "x.jsx")}}));
+    // So can Plug-in Library jobs: they download modules, install code that loads at start-up and read `file://` catalogs.
+    for c in ["library.refresh", "library.install", "library.update", "library.uninstall", "library.loadInstalled", "library.preview"] {
+        let msg = denied(&mut s, "execute_command", json!({"command": c, "params": {"id": "x"}}));
+        assert!(msg.contains("not available while file access is confined"), "{msg}");
+    }
+    let steps = json!([{"command": "library.install", "params": {"id": "x"}}]);
+    denied(&mut s, "batch", json!({"steps": steps}));
+    call_json(&mut s, "execute_command", json!({"command": "library.list"}));
+    // Effect helpers are native programs: starting them or loading through them is refused too.
+    denied(&mut s, "execute_command", json!({"command": "effect.helpers.scan"}));
+    denied(&mut s, "execute_command", json!({"command": "effect.helpers.load", "params": {"path": p(&read, "x.ofx")}}));
+    for (id, params) in [
+        ("file.runStartupScripts", json!({})),
+        ("file.runShutdownScripts", json!({})),
+        // ScriptUI panels run their script when they open.
+        ("window.scriptPanel", json!({"name": "Layer Tools.jsx"})),
+        ("window.restoreScriptPanels", json!({})),
+    ] {
+        let msg = denied(&mut s, "execute_command", json!({"command": id, "params": params}));
+        assert!(msg.contains("not available while file access is confined"), "{id}: {msg}");
+        let msg = denied(&mut s, "batch", json!({"steps": [{"command": id, "params": params}]}));
+        assert!(msg.contains("not available while file access is confined"), "{id}: {msg}");
+    }
     // Writes to the files the agent named: none outside.
     assert_eq!(std::fs::read_dir(&outside).unwrap().count(), 1, "only the unconfined save");
     let _ = std::fs::remove_dir_all(&base);
 }
+
+/// #2479: a queued output the agent didn't name is derived from where the project sits, so on a
+/// project that has never been saved it lands in the home folder, outside every automation root.
+/// Queueing it there is refused, rather than leaving an item that can never be rendered.
+#[test]
+fn automation_roots_refuse_a_queued_output_from_an_unsaved_project() {
+    use crate::confine::Confinement;
+    let base = std::env::temp_dir().join(format!("ec-mcp-default-out-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    let write = base.join("out");
+    std::fs::create_dir_all(&write).unwrap();
+    let p = |f: &str| write.join(f).to_string_lossy().into_owned();
+    let mut s = server();
+    s.backend().confine(Confinement::new(&[], std::slice::from_ref(&write)).unwrap());
+    call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"name": "A", "width": 64, "height": 64}}));
+    // Never saved: neither way of queueing a render may fall back to the home folder.
+    for command in ["renderQueue.add", "render.preRender", "file.createProxy"] {
+        let (c, err) = call(&mut s, "execute_command", json!({"command": command, "params": {"comp": "A"}}));
+        assert!(err, "`{command}` without an output should be refused: {c:?}");
+        let msg = c[0]["text"].as_str().unwrap_or_default();
+        assert!(msg.contains("the project has no file yet"), "`{command}`: {msg}");
+    }
+    // An array where a path goes: the engine reads a scalar, so this is no output either.
+    let (c, err) = call(&mut s, "execute_command", json!({"command": "file.createProxy", "params": {"comp": "A", "path": [p("arr.mov")]}}));
+    assert!(err, "an array where the output goes should be refused: {c:?}");
+    assert!(c[0]["text"].as_str().unwrap_or_default().contains("the project has no file yet"), "{c:?}");
+    // Naming an Output Module template instead of a file is the same: its own output is relative.
+    let (c, err) = call(&mut s, "execute_command", json!({"command": "render.preRender", "params": {"comp": "A", "output": "Lossless"}}));
+    assert!(err, "a template output should be refused too: {c:?}");
+    assert!(c[0]["text"].as_str().unwrap_or_default().contains("the project has no file yet"), "{c:?}");
+    let queue = call_json(&mut s, "execute_command", json!({"command": "renderQueue.list"}));
+    assert_eq!(queue["items"].as_array().map(Vec::len), Some(0), "nothing was queued: {queue}");
+    // Naming an output inside a write root is how it is done.
+    call_json(&mut s, "execute_command", json!({"command": "renderQueue.add", "params": {"comp": "A", "output": p("named.mp4")}}));
+    // A proxy named outside the roots is refused. Whether that reads as a write or a read is
+    // #1347's to classify, so this asserts the refusal and not its wording. The path is a sibling
+    // of the write root rather than `/elsewhere/…`, which is not absolute on Windows and would be
+    // refused for that instead.
+    let outside = base.join("elsewhere").join("proxy.mov").to_string_lossy().into_owned();
+    let (c, err) = call(&mut s, "execute_command", json!({"command": "file.createProxy", "params": {"comp": "A", "path": outside}}));
+    assert!(err, "a proxy outside the roots should be refused: {c:?}");
+    assert!(c[0]["text"].as_str().unwrap_or_default().contains("outside the automation roots"), "{c:?}");
+    // Once the project is saved there, the default output (beside it) is queued as before.
+    call_json(&mut s, "save_project", json!({"path": p("proj.ecproj")}));
+    // A name that is not a path is an Output Module template, and the output it resolves to lands
+    // beside the saved project: inside the write root, so it is allowed (#1347 relies on this).
+    call_json(&mut s, "execute_command", json!({"command": "file.createProxy", "params": {"comp": "A", "path": "ProxyTemplate"}}));
+    call_json(&mut s, "execute_command", json!({"command": "renderQueue.add", "params": {"comp": "A"}}));
+    let queue = call_json(&mut s, "execute_command", json!({"command": "renderQueue.list"}));
+    let out = queue["items"][1]["outputPath"].as_str().unwrap_or_default();
+    assert!(out.starts_with(&*write.to_string_lossy()), "{queue}");
+    let _ = std::fs::remove_dir_all(&base);
+}
+
+/// #2131 (audit F-11, "Running code"): `script.run` and the Scripts menu are refused while file
+/// access is confined, but a ScriptUI panel's script runs just as freely — when the panel opens,
+/// when an event reaches one of its controls, or when one of its tasks comes due — and
+/// `prefs.set` could grant every script run afterwards the file and network access the user
+/// withheld, in the settings file, long after the session. All of that is refused too.
+#[test]
+fn automation_roots_refuse_running_script_code() {
+    use crate::confine::Confinement;
+    let base = std::env::temp_dir().join(format!("ec-mcp-scripts-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    std::fs::create_dir_all(&base).unwrap();
+    let mut s = server();
+    s.backend().confine(Confinement::new(&[], std::slice::from_ref(&base)).unwrap());
+    let refused = |s: &mut McpServer, name: &str, args: Value| {
+        let (c, err) = call(s, name, args.clone());
+        assert!(err, "{name} {args} should be refused: {c:?}");
+        c[0]["text"].as_str().unwrap_or_default().to_string()
+    };
+    // Every way a script's code starts.
+    for (command, params) in [
+        ("window.scriptPanel", json!({"name": "Layer Tools.jsx"})),
+        ("window.restoreScriptPanels", json!({})),
+        ("script.runTasks", json!({})),
+        ("scriptui.click", json!({"window": 1, "widget": 2})),
+        ("scriptui.set", json!({"window": 1, "widget": 2, "value": 1})),
+        ("scriptui.mouse", json!({"window": 1, "widget": 2, "type": "click"})),
+        ("scriptui.close", json!({"window": 1})),
+    ] {
+        let msg = refused(&mut s, "execute_command", json!({"command": command, "params": params}));
+        assert!(msg.contains("not available while file access is confined"), "`{command}`: {msg}");
+    }
+    // Including as a batch step.
+    let msg = refused(&mut s, "batch", json!({"steps": [{"command": "window.scriptPanel", "params": {"name": "x.jsx"}}]}));
+    assert!(msg.contains("not available while file access is confined"), "{msg}");
+    // What scripts may do stays as the user left it, by either spelling of the setting.
+    for params in [
+        json!({"key": "scripting.allowScriptsWriteFiles", "value": true}),
+        json!({"key": "scripting.allow_scripts_write_files", "value": true}),
+        json!({"values": {"scripting.warnExecutingFiles": false}}),
+        json!({"values": {"general.showToolTips": false, "scripting.enableJsDebugger": true}}),
+        // `Prefs::set` makes a JSON pointer of the key, so this spelling resolves too…
+        json!({"key": "scripting/allowScriptsWriteFiles", "value": true}),
+        // …and the page on its own replaces every setting on it.
+        json!({"key": "scripting", "value": {"allowScriptsWriteFiles": true}}),
+        json!({"values": {"scripting": {"warnExecutingFiles": false}}}),
+    ] {
+        let msg = refused(&mut s, "execute_command", json!({"command": "prefs.set", "params": params}));
+        assert!(msg.contains("what a script may do"), "{msg}");
+    }
+    let got = call_json(&mut s, "execute_command", json!({"command": "prefs.get", "params": {"key": "scripting.allowScriptsWriteFiles"}}));
+    assert_eq!(got, json!(false), "{got}");
+    // Other settings, and looking at the script windows, still work.
+    call_json(&mut s, "execute_command", json!({"command": "prefs.set", "params": {"key": "general.showToolTips", "value": false}}));
+    call_json(&mut s, "execute_command", json!({"command": "scriptui.list"}));
+    let _ = std::fs::remove_dir_all(&base);
+}
+
+#[test]
+fn blender_export_requires_an_absolute_path_in_a_write_root() {
+    use crate::confine::Confinement;
+    let base = std::env::temp_dir().join(format!("ec-blender-confine-{}", std::process::id()));
+    let (read, write) = (base.join("read"), base.join("write"));
+    for dir in [&read, &write] {
+        std::fs::create_dir_all(dir).unwrap();
+    }
+    let confinement = Confinement::new(std::slice::from_ref(&read), std::slice::from_ref(&write)).unwrap();
+    let check = |path: &std::path::Path| confinement.check_command("camera.exportBlender", &json!({"path": path}));
+    assert!(check(&write.join("scene.py")).unwrap().is_empty());
+    for path in [read.join("scene.py"), base.join("outside.py"), write.join("../read/scene.py")] {
+        assert!(check(&path).is_err(), "must deny {}", path.display());
+    }
+    for path in ["scene.py", "./scene.py", "write/scene.py", "../scene.py"] {
+        let error = check(std::path::Path::new(path)).unwrap_err().to_string();
+        assert!(error.contains("give an absolute path"), "{path}: {error}");
+    }
+    let read_only = Confinement::new(std::slice::from_ref(&write), &[]).unwrap();
+    assert!(read_only.check_command("camera.exportBlender", &json!({"path": write.join("scene.py")})).is_err());
+    for path in [json!(read.join("scene.py")), json!("scene.py"), json!("$1.path")] {
+        let batch = json!({"steps": [{"command": "camera.exportBlender", "params": {"path": path}}]});
+        assert!(confinement.check_command("engine.batch", &batch).is_err());
+    }
+    std::fs::remove_dir_all(&base).unwrap();
+}
+
+/// `render_frame` writes the frame to the `path` it is given, and never over a file the open
+/// project reads (#1743): footage, a proxy or the project file. The refusal comes before the
+/// frame is rendered, and the file is untouched.
+#[test]
+fn render_frame_never_writes_over_a_file_the_project_reads() {
+    use effectcraft_engine::{
+        color::Label,
+        project::{Footage, FootageKind, ItemKind},
+    };
+    use std::sync::Arc;
+    let dir = std::env::temp_dir().join(format!("effectcraft-mcp-overwrite-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let (clip, project) = (dir.join("clip.png"), dir.join("Project.ecproj"));
+    std::fs::write(&clip, b"SOURCE FOOTAGE").unwrap();
+    let mut session = Session::default();
+    session.execute("comp.new", json!({"width": 16, "height": 16})).unwrap();
+    session.execute("file.saveAs", json!({"path": project.to_string_lossy()})).unwrap();
+    Arc::make_mut(&mut session.project).add_item(
+        "clip.png",
+        Label::Aqua,
+        None,
+        ItemKind::Footage(Footage {
+            path: clip.to_string_lossy().into_owned(),
+            kind: FootageKind::Still,
+            width: 16,
+            height: 16,
+            has_video: true,
+            ..Default::default()
+        }),
+    );
+    let saved = std::fs::read(&project).unwrap();
+    let mut s = McpServer::new(Backend::headless(session));
+    for (file, what) in [(&clip, "footage"), (&project, "project")] {
+        let (c, err) = call(&mut s, "render_frame", json!({"path": file.to_string_lossy(), "inline": false}));
+        let text = c[0]["text"].as_str().unwrap();
+        assert!(err && text.contains(&*file.to_string_lossy()) && text.contains(what), "{what}: {text}");
+    }
+    assert_eq!(std::fs::read(&clip).unwrap(), b"SOURCE FOOTAGE", "the footage is as it was");
+    assert_eq!(std::fs::read(&project).unwrap(), saved, "the project file is as it was");
+    // Anywhere else it writes the PNG.
+    let free = dir.join("frame.png");
+    let (c, err) = call(&mut s, "render_frame", json!({"path": free.to_string_lossy(), "inline": false}));
+    assert!(!err, "{c:?}");
+    assert_eq!(&std::fs::read(&free).unwrap()[..8], b"\x89PNG\r\n\x1a\n");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// The same through the desktop app: the app knows the project's files, so the tool asks it
+/// (`file.checkOutput`) before it writes anything.
+#[test]
+fn bridged_render_frame_asks_the_app_before_it_writes() {
+    use effectcraft_engine::project::{Footage, FootageKind};
+    struct Probe;
+    impl effectcraft_engine::Importer for Probe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            Ok(Footage { path: path.to_string(), kind: FootageKind::Still, width: 4, height: 4, has_video: true, ..Default::default() })
+        }
+    }
+    let dir = std::env::temp_dir().join(format!("effectcraft-mcp-bridge-overwrite-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let clip = dir.join("clip.png");
+    std::fs::write(&clip, b"SOURCE FOOTAGE").unwrap();
+
+    let l = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = l.local_addr().unwrap().port();
+    std::thread::spawn(move || {
+        let (stream, _) = l.accept().unwrap();
+        let mut out = stream.try_clone().unwrap();
+        let mut session = Session { importer: Some(std::sync::Arc::new(Probe)), ..Default::default() };
+        for line in BufReader::new(stream).lines() {
+            let msg: Value = serde_json::from_str(&line.unwrap()).unwrap();
+            let p = &msg["params"];
+            let mut reply = match msg["method"].as_str().unwrap() {
+                "engine.execute" => match session.execute(p["command"].as_str().unwrap(), p["params"].clone()) {
+                    Ok(v) => json!({"ok": true, "result": v}),
+                    Err(e) => json!({"ok": false, "error": e.to_string()}),
+                },
+                "render.frame" if p["write"] == true && p["path"].is_string() => fake_render_frame(&session, p),
+                "render.frame" => json!({"ok": false, "error": "a frame save must be one app-owned write"}),
+                m => json!({"ok": false, "error": format!("unknown method `{m}`")}),
+            };
+            reply["id"] = msg["id"].clone();
+            writeln!(out, "{reply}").unwrap();
+        }
+    });
+    let mut s = McpServer::new(Backend::bridge(&port.to_string()).unwrap());
+    call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"width": 16, "height": 16}}));
+    call_json(&mut s, "execute_command", json!({"command": "file.import", "params": {"paths": [clip.to_string_lossy()]}}));
+
+    let (c, err) = call(&mut s, "render_frame", json!({"path": clip.to_string_lossy(), "inline": false}));
+    let text = c[0]["text"].as_str().unwrap();
+    assert!(err && text.contains("clip.png") && text.contains("footage"), "{text}");
+    assert_eq!(std::fs::read(&clip).unwrap(), b"SOURCE FOOTAGE", "the footage is as it was");
+    // Anywhere else it writes the PNG.
+    let free = dir.join("frame.png");
+    let (c, err) = call(&mut s, "render_frame", json!({"path": free.to_string_lossy(), "inline": false}));
+    assert!(!err, "{c:?}");
+    assert_eq!(&std::fs::read(&free).unwrap()[..8], b"\x89PNG\r\n\x1a\n");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #2131 F-11 ("Indirect reads"): a project opened or imported from inside a read root names its
+/// footage, and those files are read when it renders. Footage outside the roots (an absolute
+/// path, `../`, a symbolic link to a file or a folder out of the root) must not reach the agent:
+/// its layer renders as missing footage, while footage inside the roots still renders.
+#[test]
+fn automation_roots_confine_the_footage_a_project_names() {
+    use crate::confine::Confinement;
+    let base = std::env::temp_dir().join(format!("ec-mcp-footage-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    let (read, write, outside) = (base.join("in"), base.join("out"), base.join("elsewhere"));
+    for d in [&read, &write, &outside] {
+        std::fs::create_dir_all(d).unwrap();
+    }
+    let red = image::RgbaImage::from_pixel(8, 8, image::Rgba([255, 0, 0, 255]));
+    red.save(outside.join("secret.png")).unwrap();
+    red.save(read.join("own.png")).unwrap();
+    let p = |d: &std::path::Path, f: &str| d.join(f).to_string_lossy().into_owned();
+    // A project in the read root showing `footage`, saved unconfined.
+    let project = |name: &str, footage: &str| {
+        let mut s = McpServer::new(Backend::headless(effectcraft_host::session()));
+        call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"name": "C", "width": 8, "height": 8}}));
+        let imported = call_json(&mut s, "execute_command", json!({"command": "file.import", "params": {"paths": [footage]}}));
+        let item = imported["items"][0].as_u64().or_else(|| imported["item"].as_u64()).unwrap_or_else(|| panic!("{imported}"));
+        call_json(&mut s, "execute_command", json!({"command": "layer.addItem", "params": {"comp": "C", "item": item}}));
+        let path = p(&read, name);
+        call_json(&mut s, "save_project", json!({"path": path}));
+        path
+    };
+    // The middle pixel of comp C: red when the footage was read.
+    let shows_red = |s: &mut McpServer| {
+        let (c, err) = call(s, "render_frame", json!({"comp": "C"}));
+        assert!(!err, "{c:?}");
+        let png = base64::decode(c[0]["data"].as_str().unwrap()).unwrap();
+        let px = image::load_from_memory(&png).unwrap().to_rgba8().get_pixel(4, 4).0;
+        px[0] > 200 && px[3] > 200
+    };
+    let mut projects = vec![("absolute", project("absolute.ecproj", &p(&outside, "secret.png")))];
+    #[cfg(unix)]
+    {
+        std::os::unix::fs::symlink(outside.join("secret.png"), read.join("link.png")).unwrap();
+        std::os::unix::fs::symlink(&outside, read.join("dir")).unwrap();
+        projects.push(("linked file", project("linked-file.ecproj", &p(&read, "link.png"))));
+        projects.push(("linked folder", project("linked-folder.ecproj", &p(&read.join("dir"), "secret.png"))));
+    }
+    // Relative to the project: `../elsewhere/secret.png`, written into a copy of a project.
+    let own = project("own.ecproj", &p(&read, "own.png"));
+    let text = std::fs::read_to_string(&own).unwrap();
+    assert!(text.contains(&p(&read, "own.png")) || text.contains("own.png"), "{text}");
+    let relative = text.replace(&p(&read, "own.png"), "../elsewhere/secret.png").replace("\"own.png\"", "\"../elsewhere/secret.png\"");
+    std::fs::write(read.join("relative.ecproj"), relative).unwrap();
+    projects.push(("relative", p(&read, "relative.ecproj")));
+
+    let confined = || {
+        let mut s = McpServer::new(Backend::headless(effectcraft_host::session()));
+        s.backend().confine(Confinement::new(std::slice::from_ref(&read), std::slice::from_ref(&write)).unwrap());
+        s
+    };
+    // Footage inside the read root renders.
+    let mut s = confined();
+    call_json(&mut s, "open_project", json!({"path": own}));
+    assert!(shows_red(&mut s), "footage inside the read root");
+    for (how, path) in &projects {
+        // Unconfined, the project shows the outside file.
+        let mut s = McpServer::new(Backend::headless(effectcraft_host::session()));
+        call_json(&mut s, "open_project", json!({"path": path}));
+        assert!(shows_red(&mut s), "{how}: unconfined shows the footage");
+        // Confined: opened, or imported into the open project.
+        let mut s = confined();
+        call_json(&mut s, "open_project", json!({"path": path}));
+        assert!(!shows_red(&mut s), "{how}: opened, the footage outside the roots was read");
+        let mut s = confined();
+        call_json(&mut s, "execute_command", json!({"command": "file.importProject", "params": {"path": path}}));
+        assert!(!shows_red(&mut s), "{how}: imported, the footage outside the roots was read");
+    }
+    let _ = std::fs::remove_dir_all(&base);
+}
+
+/// A symbolic link inside the read root, read once while it pointed inside, is checked again
+/// on every read: pointed outside afterwards, its footage must not come back once the frame
+/// cache is emptied.
+#[cfg(unix)]
+#[test]
+fn automation_roots_check_relinked_footage_again() {
+    use crate::confine::Confinement;
+    let base = std::env::temp_dir().join(format!("ec-mcp-relink-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    let (read, write, outside) = (base.join("in"), base.join("out"), base.join("elsewhere"));
+    for d in [&read, &write, &outside] {
+        std::fs::create_dir_all(d).unwrap();
+    }
+    image::RgbaImage::from_pixel(8, 8, image::Rgba([0, 0, 255, 255])).save(read.join("own.png")).unwrap();
+    image::RgbaImage::from_pixel(8, 8, image::Rgba([255, 0, 0, 255])).save(outside.join("secret.png")).unwrap();
+    let link = read.join("link.png");
+    std::os::unix::fs::symlink(read.join("own.png"), &link).unwrap();
+    let link_path = link.to_string_lossy().into_owned();
+    let project = read.join("relink.ecproj").to_string_lossy().into_owned();
+    {
+        let mut s = McpServer::new(Backend::headless(effectcraft_host::session()));
+        call_json(&mut s, "execute_command", json!({"command": "comp.new", "params": {"name": "C", "width": 8, "height": 8}}));
+        let imported = call_json(&mut s, "execute_command", json!({"command": "file.import", "params": {"paths": [link_path]}}));
+        let item = imported["items"][0].as_u64().or_else(|| imported["item"].as_u64()).unwrap_or_else(|| panic!("{imported}"));
+        call_json(&mut s, "execute_command", json!({"command": "layer.addItem", "params": {"comp": "C", "item": item}}));
+        call_json(&mut s, "save_project", json!({"path": project}));
+    }
+    // The middle pixel of comp C.
+    let pixel = |s: &mut McpServer| {
+        let (c, err) = call(s, "render_frame", json!({"comp": "C"}));
+        assert!(!err, "{c:?}");
+        let png = base64::decode(c[0]["data"].as_str().unwrap()).unwrap();
+        image::load_from_memory(&png).unwrap().to_rgba8().get_pixel(4, 4).0
+    };
+    let mut s = McpServer::new(Backend::headless(effectcraft_host::session()));
+    s.backend().confine(Confinement::new(std::slice::from_ref(&read), std::slice::from_ref(&write)).unwrap());
+    call_json(&mut s, "open_project", json!({"path": project}));
+    let px = pixel(&mut s);
+    assert!(px[2] > 200 && px[0] < 50, "the link pointing inside renders: {px:?}");
+    std::fs::remove_file(&link).unwrap();
+    std::os::unix::fs::symlink(outside.join("secret.png"), &link).unwrap();
+    call_json(&mut s, "execute_command", json!({"command": "edit.purge", "params": {"what": "memory"}}));
+    let px = pixel(&mut s);
+    assert!(!(px[0] > 200 && px[3] > 200), "the link pointed outside afterwards was read: {px:?}");
+    let _ = std::fs::remove_dir_all(&base);
+}
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index a83e0d1ec..cb1a3cdab 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -175,16 +175,21 @@ fn params_of(v: Option<&Value>) -> Result<Value> {
 
 // ------------------------------------------------------------------ engine tools
 
+/// `list_commands` tool: the engine command list, minus empty fields; with `compact`, only `id` and `label`.
 fn list_commands(b: &mut Backend, a: &Value) -> Result<Reply> {
-    let schemas = get(a, "schemas").and_then(Value::as_bool).unwrap_or(false).then_some(json!(true));
+    let compact = get(a, "compact").and_then(Value::as_bool).unwrap_or(false);
+    let schemas = (!compact && get(a, "schemas").and_then(Value::as_bool).unwrap_or(false)).then_some(json!(true));
     let r = b.exec("command.list", obj(&[("filter", get(a, "filter")), ("enabledOnly", get(a, "enabled_only")), ("schemas", schemas.as_ref())]))?;
-    // Drop empty fields to keep the listing compact.
     let list: Vec<Value> = r
         .as_array()
         .cloned()
         .unwrap_or_default()
         .into_iter()
         .map(|mut c| {
+            if compact {
+                return json!({"id": c["id"], "label": c["label"]});
+            }
+            // Drop empty fields.
             if let Some(o) = c.as_object_mut() {
                 o.retain(|_, v| !(v.is_null() || v.as_array().is_some_and(Vec::is_empty) || v.as_str() == Some("{}")));
             }
@@ -205,8 +210,13 @@ fn describe_command(b: &mut Backend, a: &Value) -> Result<Reply> {
     json_reply(b.exec("command.describe", json!({"command": id}))?)
 }
 
+/// `list_effects` tool: the effect registry; with `compact`, only `id`, `name` and `category`.
 fn list_effects(b: &mut Backend, a: &Value) -> Result<Reply> {
-    json_reply(b.exec("effect.list", obj(&[("filter", get(a, "filter"))]))?)
+    let mut r = b.exec("effect.list", obj(&[("filter", get(a, "filter"))]))?;
+    if get(a, "compact").and_then(Value::as_bool).unwrap_or(false) {
+        r = r.as_array().into_iter().flatten().map(|e| json!({"id": e["id"], "name": e["name"], "category": e["category"]})).collect();
+    }
+    json_reply(r)
 }
 
 fn list_fonts(b: &mut Backend, a: &Value) -> Result<Reply> {
@@ -275,7 +285,7 @@ fn get_comp(b: &mut Backend, a: &Value) -> Result<Reply> {
     json_reply(b.exec("comp.info", obj(&[("comp", get(a, "comp"))]))?)
 }
 
-/// Flatten a `layer.tree` property tree into `[{path, type, value, keys?, expression?}]`.
+/// Flatten a `layer.tree` property tree into `[{path, type, value, keys?, expression?, options?}]`.
 fn flatten(node: &Value, out: &mut Vec<Value>) {
     // A group cut off by `depth` stays visible (instead of vanishing from the flat list).
     if node.get("truncated").and_then(Value::as_bool) == Some(true) {
@@ -292,6 +302,9 @@ fn flatten(node: &Value, out: &mut Vec<Value>) {
             if let Some(e) = node.get("expression") {
                 o["expression"] = e.clone();
             }
+            if let Some(opts) = node.get("options") {
+                o["options"] = opts.clone();
+            }
             out.push(o);
         }
     }
@@ -393,13 +406,15 @@ fn add_keyframe(b: &mut Backend, a: &Value) -> Result<Reply> {
 fn render_frame(b: &mut Backend, a: &Value) -> Result<Reply> {
     let max_side = get(a, "max_side").and_then(Value::as_u64).unwrap_or(960) as u32;
     let transparent = get(a, "transparent").and_then(Value::as_bool).unwrap_or(false);
-    let f = b.render_with(get(a, "comp"), get(a, "time").and_then(Value::as_f64), max_side, transparent)?;
+    let path = get(a, "path").and_then(Value::as_str);
+    let comp = get(a, "comp");
+    let time = get(a, "time").and_then(Value::as_f64);
+    let f = match path {
+        Some(path) => b.render_to_file(comp, time, max_side, transparent, path)?,
+        None => b.render_with(comp, time, max_side, transparent)?,
+    };
     let mut info = json!({"comp": f.comp, "time": f.time, "width": f.width, "height": f.height});
-    if let Some(p) = get(a, "path").and_then(Value::as_str) {
-        if let Some(c) = b.confinement() {
-            c.check(p, crate::confine::Access::Write)?;
-        }
-        std::fs::write(p, &f.png).map_err(|e| Error::Other(format!("cannot write {p}: {e}")))?;
+    if let Some(p) = path {
         info["path"] = json!(p);
     }
     if get(a, "inline").and_then(Value::as_bool) == Some(false) {
@@ -542,14 +557,15 @@ fn control(b: &mut Backend, a: &Value) -> Result<Reply> {
 static TOOLS: &[ToolDef] = &[
     ToolDef {
         name: "list_commands",
-        description: "List engine commands: id, label, menu path, shortcut, `params` doc (e.g. `{name?, width?, height?, frameRate?, duration? (s)}`) and whether it can run now (`why` if not). Every menu item, shortcut and panel gesture maps to one of these ids; run them with execute_command. Narrow with `filter` (e.g. `layer.new`, `keys`, `effect`).",
+        description: "List engine commands: id, label, menu path, shortcut, `params` doc (e.g. `{name?, width?, height?, frameRate?, duration? (s)}`) and whether it can run now (`why` if not). Every menu item, shortcut and panel gesture maps to one of these ids; run them with execute_command. Narrow with `filter` (e.g. `layer.new`, `keys`, `effect`); `compact: true` lists only ids and labels.",
         bridge_only: false,
         schema: || {
             schema(
                 json!({
                     "filter": {"type": "string", "description": "Only commands whose id or label contains this text (case-insensitive)."},
                     "enabled_only": {"type": "boolean", "description": "Only commands that can run right now."},
-                    "schemas": {"type": "boolean", "description": "Also return each command's parameter JSON Schema (`schema`)."}
+                    "schemas": {"type": "boolean", "description": "Also return each command's parameter JSON Schema (`schema`)."},
+                    "compact": {"type": "boolean", "description": "Return only each command's `id` and `label` (overrides `schemas`)."}
                 }),
                 &[],
             )
@@ -615,7 +631,7 @@ static TOOLS: &[ToolDef] = &[
     },
     ToolDef {
         name: "get_layer",
-        description: "A layer's property tree (transform, masks, effects, text, shape contents, ...): leaf properties have a `path` usable with get_property/set_property/add_keyframe, plus uid, match id, name, type, value at `time`, keyframes and expression. Groups contain children; inspect them here, then select a leaf path. `flat: true` returns just a list of {path, type, value, keys, expression} (compact).",
+        description: "A layer's property tree (transform, masks, effects, text, shape contents, ...): leaf properties have a `path` usable with get_property/set_property/add_keyframe, plus uid, match id, name, type, value at `time`, keyframes and expression; popup (enum) properties add `options` ([{value, label}]). Groups contain children; inspect them here, then select a leaf path. `flat: true` returns just a list of {path, type, value, keys, expression, options} (compact).",
         bridge_only: false,
         schema: || {
             schema(
@@ -632,7 +648,7 @@ static TOOLS: &[ToolDef] = &[
     },
     ToolDef {
         name: "get_property",
-        description: "Read one property: type, value at `time` (comp seconds; default the current time), whether it is animated, its keyframes (time, value, in/out interpolation) and expression.",
+        description: "Read one property: type, value at `time` (comp seconds; default the current time), whether it is animated, its keyframes (time, value, in/out interpolation) and expression. Popup (enum) properties add `options`: [{value, label}], the values set_property takes.",
         bridge_only: false,
         schema: || {
             schema(
@@ -696,9 +712,17 @@ static TOOLS: &[ToolDef] = &[
     },
     ToolDef {
         name: "list_effects",
-        description: "The effect registry: id, After Effects name, category, GPU and 32-bpc support. Narrow with `filter` (id, name or category text). Apply with add_effect.",
+        description: "The effect registry: id, After Effects name, category, GPU and 32-bpc support. Narrow with `filter` (id, name or category text); `compact: true` lists only ids, names and categories. Apply with add_effect.",
         bridge_only: false,
-        schema: || schema(json!({"filter": {"type": "string", "description": "Only effects whose id, name or category contains this text."}}), &[]),
+        schema: || {
+            schema(
+                json!({
+                    "filter": {"type": "string", "description": "Only effects whose id, name or category contains this text."},
+                    "compact": {"type": "boolean", "description": "Return only each effect's `id`, `name` and `category`."}
+                }),
+                &[],
+            )
+        },
         run: list_effects,
     },
     ToolDef {
@@ -911,14 +935,15 @@ static TOOLS: &[ToolDef] = &[
     },
     ToolDef {
         name: "command_list",
-        description: "List engine commands: id, label, menu path, shortcut, `params` doc (e.g. `{name?, width?, height?, frameRate?, duration? (s)}`) and whether it can run now (`why` if not). Every menu item, shortcut and panel gesture maps to one of these ids; run them with execute_command. Narrow with `filter` (e.g. `layer.new`, `keys`, `effect`).",
+        description: "List engine commands: id, label, menu path, shortcut, `params` doc (e.g. `{name?, width?, height?, frameRate?, duration? (s)}`) and whether it can run now (`why` if not). Every menu item, shortcut and panel gesture maps to one of these ids; run them with execute_command. Narrow with `filter` (e.g. `layer.new`, `keys`, `effect`); `compact: true` lists only ids and labels.",
         bridge_only: false,
         schema: || {
             schema(
                 json!({
                     "filter": {"type": "string", "description": "Only commands whose id or label contains this text (case-insensitive)."},
                     "enabled_only": {"type": "boolean", "description": "Only commands that can run right now."},
-                    "schemas": {"type": "boolean", "description": "Also return each command's parameter JSON Schema (`schema`)."}
+                    "schemas": {"type": "boolean", "description": "Also return each command's parameter JSON Schema (`schema`)."},
+                    "compact": {"type": "boolean", "description": "Return only each command's `id` and `label` (overrides `schemas`)."}
                 }),
                 &[],
             )
diff --git a/crates/automation/tests/qa/compositing.rs b/crates/automation/tests/qa/compositing.rs
index 52d5e4fb2..3cf8356fb 100644
--- a/crates/automation/tests/qa/compositing.rs
+++ b/crates/automation/tests/qa/compositing.rs
@@ -7,6 +7,10 @@ use serde_json::{Value, json};
 
 use crate::harness::{Img, Qa, coverage, luma, mean_diff};
 
+fn lum(i: &Img, x: u32, y: u32) -> f64 {
+    luma(i.get_pixel(x, y))
+}
+
 fn px(img: &Img, x: u32, y: u32) -> [u8; 4] {
     img.get_pixel(x, y).0
 }
@@ -25,14 +29,13 @@ fn write_sequence(qa: &Qa) -> String {
     qa.path("seq/ball_000.png")
 }
 
-#[test]
-fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
-    let mut qa = Qa::new("compositing");
-
+/// Import the sequence (reinterpreted at 12 fps) and a PSD written by the app; returns the
+/// sequence item and the PSD's composition.
+fn import_footage(qa: &mut Qa) -> (Value, Value) {
     // Footage: the sequence, and a layered PSD written by the app itself (Save Frame As ▸
     // Photoshop Layers) from a small comp.
-    let seq = write_sequence(&qa);
-    let imp = qa.exec("file.import", json!({"paths": [seq]}));
+    let seq = write_sequence(qa);
+    let imp = qa.exec("file.import", json!({"paths": [seq], "sequence": true}));
     let seq_item = imp["items"][0].clone();
     let project = qa.tool("get_project", json!({}));
     let it = project["items"].as_array().unwrap().iter().find(|i| i["id"] == seq_item).unwrap().clone();
@@ -55,10 +58,14 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     let pc = qa.tool("get_comp", json!({"comp": psd_comp.clone()}));
     let names: Vec<&str> = pc["layers"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap()).collect();
     assert_eq!(names, ["Bar", "Gray"], "the PSD's layers, top first: {pc}");
+    (seq_item, psd_comp)
+}
 
+/// The main comp: the sequence plays, then a Screen-blended PSD; returns the Normal-mode frame.
+fn main_comp_and_blend(qa: &mut Qa, seq_item: &Value, psd_comp: &Value) -> Img {
     // The main comp.
-    let main = qa.exec("comp.new", json!({"name": "Main", "width": 160, "height": 90, "frameRate": 12, "duration": 1}))["comp"].clone();
-    qa.exec("layer.addItem", json!({"item": seq_item}));
+    qa.exec("comp.new", json!({"name": "Main", "width": 160, "height": 90, "frameRate": 12, "duration": 1}));
+    qa.exec("layer.addItem", json!({"item": seq_item.clone()}));
     let a = qa.frame(None, 0.0);
     let b = qa.frame(None, 0.5);
     assert!(mean_diff(&a, &b) > 1.0, "the sequence plays");
@@ -75,7 +82,10 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     for c in 0..3 {
         assert!(s[c] > n[c] && s[c] > [32, 64, 96][c], "Screen brightens channel {c}: {s:?}");
     }
+    normal
+}
 
+fn track_matte(qa: &mut Qa) {
     // Track matte: a magenta solid seen only through text.
     qa.exec("layer.newText", json!({"text": "MATTE", "name": "Matte", "size": 40, "fill": "#ffffff"}));
     qa.exec("layer.newSolid", json!({"name": "Fill", "color": "#ff00ff", "width": 160, "height": 90}));
@@ -91,10 +101,12 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     let fill = info["layers"].as_array().unwrap().iter().find(|l| l["name"] == "Fill").unwrap().clone();
     assert_eq!(fill["trackMatte"]["kind"], "Alpha Matte");
     qa.exec("layer.setSwitch", json!({"layers": ["Fill", "Matte"], "switch": "video", "value": false}));
+}
 
+fn adjustment_layer(qa: &mut Qa, normal: &Img) {
     // Adjustment layer: Lumetri exposure, inside a feathered, expanded elliptical mask; then Glow.
     qa.exec("layer.newAdjustment", json!({"name": "Grade"}));
-    let fx = qa.exec("effect.apply", json!({"effect": "Lumetri Color", "layers": ["Grade"]}));
+    let fx = qa.exec("effect.apply", json!({"effect": "Color Grading", "layers": ["Grade"]}));
     assert_eq!(fx["paths"], json!(["effects/#1"]), "effect.apply answers with the instance path: {fx}");
     qa.tool("set_property", json!({"layer": "Grade", "path": "effects/#1/basicCorrection/tone/exposure", "value": 2}));
     let before = qa.frame(None, 0.5);
@@ -103,7 +115,6 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     let mk = qa.exec("layer.addMask", json!({"layer": "Grade", "shape": "ellipse", "rect": [40, 20, 80, 50]}));
     assert!(mk["mask"].is_u64(), "{mk}");
     let hard = qa.frame(None, 0.5);
-    let lum = |i: &Img, x, y| luma(i.get_pixel(x, y));
     assert!(lum(&hard, 80, 45) > lum(&before, 80, 45) - 1.0 && lum(&hard, 5, 5) < lum(&before, 5, 5) - 10.0, "the mask limits the grade to the ellipse");
     qa.exec("layer.mask.set", json!({"layer": "Grade", "field": "expansion", "value": 8}));
     let grown = qa.frame(None, 0.5);
@@ -116,7 +127,7 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
         }
         n
     };
-    assert!(bright(&grown, &normal) > bright(&hard, &normal) + 100, "expansion grows the graded area");
+    assert!(bright(&grown, normal) > bright(&hard, normal) + 100, "expansion grows the graded area");
     qa.exec("layer.mask.set", json!({"layer": "Grade", "field": "feather", "value": 20}));
     let soft = qa.frame(None, 0.5);
     // At the ellipse's edge (x = 40 − 8): feathered is in between none and full.
@@ -125,7 +136,10 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     qa.exec("effect.apply", json!({"effect": "Glow", "layers": ["Grade"]}));
     let glow = qa.frame(None, 0.5);
     assert!(mean_diff(&soft, &glow) > 0.5, "Glow changes the frame");
+}
 
+/// The 3D stage with depth of field and a light; returns the stage comp.
+fn stage_3d(qa: &mut Qa) -> Value {
     // 3D stage: a near and a far card, a camera with depth of field, a light.
     let stage = qa.exec("comp.new", json!({"name": "Stage", "width": 160, "height": 90, "frameRate": 12, "duration": 1}))["comp"].clone();
     qa.exec("layer.newSolid", json!({"name": "Near", "color": "#ff4040", "width": 40, "height": 40}));
@@ -155,7 +169,10 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     let advanced = qa.frame(None, 0.0);
     assert!(mean_diff(&classic, &advanced) > 0.2, "Advanced 3D renders the stage its own way");
     assert!(lum(&advanced, 50, 45) > 60.0, "Advanced 3D still lights the card");
+    stage
+}
 
+fn alpha_renders(qa: &mut Qa, stage: &Value) {
     // Renders with alpha: the stage has no background layer, so most of it is transparent.
     let mov = qa.path("stage.mov");
     let webm = qa.path("stage.webm");
@@ -165,7 +182,7 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
     assert!(done["items"].as_array().unwrap().iter().all(|i| i["status"] == "Done"), "{done}");
     let reference = qa.tool("render_frame", json!({"comp": stage.clone(), "time": 0, "transparent": true, "inline": false}));
     assert_eq!(reference["width"], 160);
-    let refa = alpha_frame(&mut qa, stage.clone());
+    let refa = alpha_frame(qa, stage.clone());
     assert!(px(&refa, 2, 2)[3] < 40 && px(&refa, 50, 45)[3] == 255, "render_frame transparent keeps alpha: {:?} {:?}", px(&refa, 2, 2), px(&refa, 50, 45));
     // ProRes 4444 carries alpha in the frame; WebM VP9 as a second VP9 stream in BlockAdditions
     // (AlphaMode 1), which FilmCraft's Matroska reader decodes into the frame's alpha plane.
@@ -174,14 +191,24 @@ fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
         assert_eq!(r["errors"], json!([]));
         assert_eq!(r["unlabeledAlpha"], r["items"], "{path}: the importer sees an alpha channel");
         let c = qa.exec("file.newCompFromSelection", json!({}))["comps"][0].clone();
-        let f = alpha_frame(&mut qa, c.clone());
+        let f = alpha_frame(qa, c.clone());
         // The opaque card decodes to the stage's colours (lossy codecs, so loosely).
         let (got, want) = (px(&f, 50, 45), px(&refa, 50, 45));
         assert!((0..3).all(|c| got[c].abs_diff(want[c]) < 12), "{path} decodes to the stage: {got:?} vs {want:?}");
         assert!(mean_diff(&qa.frame(Some(c.clone()), 0.0), &qa.frame(Some(stage.clone()), 0.0)) < 8.0, "{path} composites like the stage");
         assert!(px(&f, 2, 2)[3] < 40 && px(&f, 50, 45)[3] > 250, "{path}: transparent corners, opaque card: {:?} {:?}", px(&f, 2, 2), px(&f, 50, 45));
     }
-    let _ = main;
+}
+
+#[test]
+fn compositing_matte_blend_adjustment_3d_and_alpha_renders() {
+    let mut qa = Qa::new("compositing");
+    let (seq_item, psd_comp) = import_footage(&mut qa);
+    let normal = main_comp_and_blend(&mut qa, &seq_item, &psd_comp);
+    track_matte(&mut qa);
+    adjustment_layer(&mut qa, &normal);
+    let stage = stage_3d(&mut qa);
+    alpha_renders(&mut qa, &stage);
 }
 
 fn alpha_frame(qa: &mut Qa, comp: Value) -> Img {
diff --git a/crates/automation/tests/qa/tracking.rs b/crates/automation/tests/qa/tracking.rs
index 837872658..ee6bbb2e9 100644
--- a/crates/automation/tests/qa/tracking.rs
+++ b/crates/automation/tests/qa/tracking.rs
@@ -52,7 +52,7 @@ fn shake_offset(f: u32) -> (i64, i64) {
 
 /// Import a sequence at 12 fps and make a comp of it; returns (comp, layer).
 fn plate_comp(qa: &mut Qa, first: &str, name: &str) -> (Value, Value) {
-    let item = qa.exec("file.import", json!({"paths": [first]}))["items"][0].clone();
+    let item = qa.exec("file.import", json!({"paths": [first], "sequence": true}))["items"][0].clone();
     qa.exec("file.interpretFootage", json!({"items": [item.clone()], "frameRate": 12}));
     let comp = qa.exec("comp.new", json!({"name": name, "width": 160, "height": 90, "frameRate": 12, "duration": 1}))["comp"].clone();
     let layer = qa.exec("layer.addItem", json!({"item": item}))["layer"].clone();
diff --git a/crates/av1enc/README.md b/crates/av1enc/README.md
index 6ced20ba1..dcc343693 100644
--- a/crates/av1enc/README.md
+++ b/crates/av1enc/README.md
@@ -4,8 +4,8 @@ Clean-room, pure-Rust AV1 encoder for EffectCraft's MP4 / WebM export (layer L0,
 no `unsafe`, builds for `wasm32-unknown-unknown`).
 
 Output is decoded **bit-exactly** by libdav1d (`ffmpeg -c:v libdav1d`, checked in
-`tests/ffmpeg_oracle.rs` when ffmpeg is installed) and by FilmCraft's spec-derived
-`filmcraft-av1` decoder (`tests/roundtrip.rs`): every decoded frame equals the encoder's own
+`tests/it/ffmpeg_oracle.rs` when ffmpeg is installed) and by FilmCraft's spec-derived
+`filmcraft-av1` decoder (`tests/it/roundtrip.rs`): every decoded frame equals the encoder's own
 reconstruction, so prediction never drifts.
 
 ## What is implemented
@@ -48,8 +48,10 @@ reconstruction, so prediction never drifts.
   reconstruction loop; full coefficient coding (all_zero, tx type, eob_pt, eob_extra,
   coeff_base_eob, coeff_base, coeff_br, dc_sign, Golomb) with the exact contexts.
 - **Rate control**: `ConstantQ(base_q_idx)`; `Bitrate { kbps }` adapts `base_q_idx` per frame
-  towards the average target (key frames get a lower quantizer and a larger share; the first
-  key frame is searched in a few passes).
+  towards the average target (key frames get a lower quantizer and a larger share of the budget of
+  their group of `keyint` frames, the inter frames the rest; the first key frame is searched in a
+  few passes, a later key frame that misses its budget by more than 19 % is coded again; the
+  deviation from the budget is paid back over 16 frames).
 
 ## Limits
 
diff --git a/crates/av1enc/src/cdf.rs b/crates/av1enc/src/cdf.rs
index 0466a1592..777164d1a 100644
--- a/crates/av1enc/src/cdf.rs
+++ b/crates/av1enc/src/cdf.rs
@@ -2,7 +2,15 @@
 //! init_coeff_cdfs that its syntax uses). Layout as in filmcraft-av1: each innermost array
 //! holds N cumulative values (the last is 32768) plus the adaptation counter.
 
-use crate::tables::*;
+use crate::tables::{
+    DEFAULT_ANGLE_DELTA_CDF, DEFAULT_COEFF_BASE_CDF, DEFAULT_COEFF_BASE_EOB_CDF, DEFAULT_COEFF_BR_CDF, DEFAULT_DC_SIGN_CDF, DEFAULT_DRL_MODE_CDF,
+    DEFAULT_EOB_EXTRA_CDF, DEFAULT_EOB_PT_16_CDF, DEFAULT_EOB_PT_32_CDF, DEFAULT_EOB_PT_64_CDF, DEFAULT_EOB_PT_128_CDF, DEFAULT_EOB_PT_256_CDF,
+    DEFAULT_EOB_PT_512_CDF, DEFAULT_EOB_PT_1024_CDF, DEFAULT_INTER_TX_TYPE_SET3_CDF, DEFAULT_INTRA_TX_TYPE_SET2_CDF, DEFAULT_IS_INTER_CDF, DEFAULT_MV_BIT_CDF,
+    DEFAULT_MV_CLASS_CDF, DEFAULT_MV_CLASS0_BIT_CDF, DEFAULT_MV_CLASS0_FR_CDF, DEFAULT_MV_FR_CDF, DEFAULT_MV_JOINT_CDF, DEFAULT_MV_SIGN_CDF,
+    DEFAULT_NEW_MV_CDF, DEFAULT_PARTITION_W8_CDF, DEFAULT_PARTITION_W16_CDF, DEFAULT_PARTITION_W32_CDF, DEFAULT_PARTITION_W64_CDF, DEFAULT_REF_MV_CDF,
+    DEFAULT_SINGLE_REF_CDF, DEFAULT_SKIP_CDF, DEFAULT_TXB_SKIP_CDF, DEFAULT_UV_MODE_CFL_ALLOWED_CDF, DEFAULT_UV_MODE_CFL_NOT_ALLOWED_CDF, DEFAULT_Y_MODE_CDF,
+    DEFAULT_ZERO_MV_CDF,
+};
 
 #[derive(Clone)]
 pub(crate) struct Cdfs {
diff --git a/crates/av1enc/src/decide.rs b/crates/av1enc/src/decide.rs
index 494e914c0..b06852809 100644
--- a/crates/av1enc/src/decide.rs
+++ b/crates/av1enc/src/decide.rs
@@ -3,8 +3,12 @@
 //! processes, so the reconstruction built here is exactly what a decoder produces; the syntax
 //! is written afterwards by `writer.rs`.
 
-use crate::pred::*;
-use crate::tables::*;
+use crate::pred::{INTRA_MODES_USED, InterBlock, IntraEdge, Plane, edges, half_planes, predict_inter, predict_intra};
+use crate::tables::{
+    AC_QLOOKUP, BLOCK_8X8, BLOCK_64X64, DC_PRED, DC_QLOOKUP, DCT_DCT, DEFAULT_SCAN_4X4, DEFAULT_SCAN_8X8, DEFAULT_SCAN_16X16, DEFAULT_SCAN_32X32, MODE_TO_TXFM,
+    NEWMV, NUM_4X4_BLOCKS_WIDE, PARTITION_SPLIT, PARTITION_SUBSIZE, TX_4X4, TX_8X8, TX_16X16, TX_32X32, TX_64X64, TX_SET_DCTONLY, TX_SET_INTER_3,
+    TX_SET_INTRA_2, TX_SIZE_SQR_UP, TX_TYPE_IN_SET_INTER, TX_TYPE_IN_SET_INTRA,
+};
 use crate::transform::{forward_2d, inverse_2d};
 
 /// Decisions for one coded block.
@@ -100,6 +104,17 @@ pub(crate) fn intra_uv_tx_type(uv_mode: usize, uv_tx: usize) -> usize {
     if tx_in_set(tx_set(uv_tx, false), false, t) { t } else { DCT_DCT }
 }
 
+/// Geometry and coding mode of one square transform block.
+#[derive(Clone, Copy)]
+struct TransformBlock {
+    plane: usize,
+    x: usize,
+    y: usize,
+    log2: u32,
+    tx_type: usize,
+    intra: bool,
+}
+
 struct TxResult {
     levels: Vec<i32>,
     nonzero: bool,
@@ -107,10 +122,43 @@ struct TxResult {
     bits: f64,
 }
 
+/// The output and scratch buffers of one reconstruction, each `n * n` entries long.
+struct ReconBuffers<'a> {
+    deq: &'a mut [i32],
+    resid: &'a mut [i32],
+    recon: &'a mut [u16],
+}
+
+/// Outcome of trying one transform block; the levels and the reconstruction stay in `TxScratch`.
+#[derive(Clone, Copy)]
+struct TxEval {
+    nonzero: bool,
+    dist: f64,
+    bits: f64,
+}
+
+/// Buffers of the transform path, sized for the largest coded transform block (32x32). Only the
+/// first `n * n` entries are used; they are reused across candidates instead of being allocated.
+struct TxScratch {
+    res: [i32; 1024],
+    coef: [f32; 1024],
+    levels: [i32; 1024],
+    deq: [i32; 1024],
+    resid: [i32; 1024],
+    recon: [u16; 1024],
+}
+
+impl Default for TxScratch {
+    fn default() -> Self {
+        TxScratch { res: [0; 1024], coef: [0.0; 1024], levels: [0; 1024], deq: [0; 1024], resid: [0; 1024], recon: [0; 1024] }
+    }
+}
+
 /// Saved encoder state of a block area (reconstruction, BlockDecoded flags).
 struct Snapshot {
     planes: [Vec<u16>; 3],
-    decoded: Box<[[[bool; 35]; 35]; 3]>,
+    /// BlockDecoded flags of the block area only (the only flags coding inside it can change).
+    decoded: [[[bool; 16]; 16]; 3],
 }
 
 pub(crate) struct Decider<'a> {
@@ -127,13 +175,20 @@ pub(crate) struct Decider<'a> {
     ac_q: f32,
     dc_qi: i64,
     ac_qi: i64,
+    /// Smallest magnitude that quantises to a non-zero level, `[dc, ac][intra]`.
+    dead_zone: [[f32; 2]; 2],
     lambda: f64,
     lambda_sad: f64,
     /// Half-sample interpolations of the reference luma (visible area): (8, 0), (0, 8), (8, 8).
     half: [Vec<u16>; 3],
+    /// Transform buffers, taken out while a block is being tried (see `code_tx`).
+    scratch: Option<Box<TxScratch>>,
 }
 
 const MODE_BITS_INTRA: f64 = 3.0;
+/// Dead-zone quantiser rounding offsets (below one half) for inter and intra blocks.
+const INTER_RND: f32 = 0.30;
+const INTRA_RND: f32 = 0.38;
 
 impl<'a> Decider<'a> {
     pub fn new(g: &'a FrameGeom, bd: u32, qidx: u8, intra_only: bool, src: &'a [Plane; 3], refr: Option<&'a RefFrame>) -> Self {
@@ -160,12 +215,14 @@ impl<'a> Decider<'a> {
             ac_q: ac_qi as f32,
             dc_qi,
             ac_qi,
+            dead_zone: [dc_qi, ac_qi].map(|q| [INTER_RND, INTRA_RND].map(|rnd| zero_threshold(q as f32, rnd))),
             lambda,
             lambda_sad: lambda.sqrt(),
             half: match refr {
-                Some(rf) => [(8, 0), (0, 8), (8, 8)].map(|(fx, fy)| subpel_plane(&rf.planes[0], g.width, g.height, fx, fy, bd)),
+                Some(rf) => half_planes(&rf.planes[0], g.width, g.height, bd),
                 None => Default::default(),
             },
+            scratch: None,
         }
     }
 
@@ -211,6 +268,13 @@ impl<'a> Decider<'a> {
         }
     }
 
+    /// The BlockDecoded cells `mark_decoded` can set for blocks inside (r, c, n4): rows and
+    /// columns `by + 1 .. by + 1 + step` / `bx + 1 ..` of `decoded[plane]`.
+    fn decoded_region(plane: usize, r: usize, c: usize, n4: usize) -> (usize, usize, usize) {
+        let s = (plane > 0) as usize;
+        ((r & 15) >> s, (c & 15) >> s, (n4 >> s).max(1))
+    }
+
     fn snapshot(&self, r: usize, c: usize, n4: usize) -> Snapshot {
         let planes = std::array::from_fn(|p| {
             let s = (p > 0) as usize;
@@ -222,7 +286,14 @@ impl<'a> Decider<'a> {
             }
             v
         });
-        Snapshot { planes, decoded: self.decoded.clone() }
+        let mut decoded = [[[false; 16]; 16]; 3];
+        for (p, d) in decoded.iter_mut().enumerate() {
+            let (by, bx, step) = Self::decoded_region(p, r, c, n4);
+            for i in 0..step {
+                d[i][..step].copy_from_slice(&self.decoded[p][by + i + 1][bx + 1..bx + 1 + step]);
+            }
+        }
+        Snapshot { planes, decoded }
     }
 
     fn restore(&mut self, snap: &Snapshot, r: usize, c: usize, n4: usize) {
@@ -234,7 +305,12 @@ impl<'a> Decider<'a> {
                 pl.data[y * pl.stride + x0..y * pl.stride + x0 + n].copy_from_slice(&snap.planes[p][i * n..i * n + n]);
             }
         }
-        self.decoded.clone_from(&snap.decoded);
+        for p in 0..3 {
+            let (by, bx, step) = Self::decoded_region(p, r, c, n4);
+            for i in 0..step {
+                self.decoded[p][by + i + 1][bx + 1..bx + 1 + step].copy_from_slice(&snap.decoded[p][i][..step]);
+            }
+        }
     }
 
     fn set_mvs(&mut self, r: usize, c: usize, n4: usize, mv: [i32; 2]) {
@@ -324,8 +400,10 @@ impl<'a> Decider<'a> {
         let log2 = (n4 * 4).trailing_zeros();
         let (sbr, sbc) = ((r & 15) as isize, (c & 15) as isize);
         let bd = self.bd;
-        let mut pred = vec![0u16; 32 * 32];
-        let mut best_pred = vec![0u16; 32 * 32];
+        let mut pred = [0u16; 32 * 32];
+        let mut best_pred = [0u16; 32 * 32];
+        let mut best_levels = [0i32; 32 * 32];
+        let mut best_recon = [0u16; 32 * 32];
         let n = 1usize << log2;
         // luma
         let e = IntraEdge {
@@ -343,26 +421,26 @@ impl<'a> Decider<'a> {
         let ed = edges(&self.rec[0], &e);
         // modes ranked by SATD, then a rate-distortion choice of mode and transform type among
         // the best three
-        let mut ranked: Vec<(f64, usize)> = INTRA_MODES_USED
-            .iter()
-            .map(|&mode| {
-                predict_intra(&ed, &e, mode, &mut pred);
-                let sad = self.satd(0, c * 4, r * 4, n, &pred[..n * n]) as f64;
-                (sad + self.lambda_sad * if mode == DC_PRED { 1.0 } else { MODE_BITS_INTRA }, mode)
-            })
-            .collect();
+        let mut ranked: [(f64, usize); INTRA_MODES_USED.len()] = INTRA_MODES_USED.map(|mode| {
+            predict_intra(&ed, &e, mode, &mut pred);
+            let sad = self.satd(0, c * 4, r * 4, n, &pred[..n * n]) as f64;
+            (sad + self.lambda_sad * if mode == DC_PRED { 1.0 } else { MODE_BITS_INTRA }, mode)
+        });
         ranked.sort_by(|a, b| a.0.total_cmp(&b.0));
         let tx_y = tx_size_for(log2);
-        let mut best: Option<(f64, usize, usize, TxResult, Option<Vec<u16>>)> = None;
+        let mut best: Option<(f64, usize, usize, TxEval, bool)> = None;
+        let mut sc = self.scratch.take().unwrap_or_default();
         for &(_, mode) in ranked.iter().take(3) {
             predict_intra(&ed, &e, mode, &mut pred);
-            let mut types = vec![DCT_DCT];
+            let mut types = [DCT_DCT; 2];
+            let mut n_types = 1;
             let alt = MODE_TO_TXFM[mode] as usize;
             if alt != DCT_DCT && tx_in_set(tx_set(tx_y, false), false, alt) {
-                types.push(alt);
+                types[1] = alt;
+                n_types = 2;
             }
-            for &t in &types {
-                let (res, recon) = self.try_tx(0, c * 4, r * 4, log2, t, &pred[..n * n], true);
+            for &t in &types[..n_types] {
+                let (res, has_recon) = self.try_tx(&mut sc, TransformBlock { plane: 0, x: c * 4, y: r * 4, log2, tx_type: t, intra: true }, &pred[..n * n]);
                 let type_bits = if !res.nonzero || tx_set(tx_y, false) == TX_SET_DCTONLY {
                     0.0
                 } else if t == DCT_DCT {
@@ -374,18 +452,24 @@ impl<'a> Decider<'a> {
                 let cost = res.dist + self.lambda * (res.bits + type_bits + mode_bits);
                 if best.as_ref().is_none_or(|b| cost < b.0) {
                     best_pred[..n * n].copy_from_slice(&pred[..n * n]);
-                    best = Some((cost, mode, t, res, recon));
+                    best_levels[..n * n].copy_from_slice(&sc.levels[..n * n]);
+                    if has_recon {
+                        best_recon[..n * n].copy_from_slice(&sc.recon[..n * n]);
+                    }
+                    best = Some((cost, mode, t, res, has_recon));
                 }
             }
         }
+        self.scratch = Some(sc);
         // Every ranked mode tries DCT_DCT, so `best` is always set; without a candidate the block
         // can't be coded intra (an infinite cost keeps it from being chosen).
-        let Some((_, y_mode, tx_type_y, ty, recon)) = best else {
+        let Some((_, y_mode, tx_type_y, ty, has_recon)) = best else {
             let leaf =
                 Leaf { bsize, is_inter: false, y_mode: DC_PRED, uv_mode: DC_PRED, tx_type_y: DCT_DCT, mv: [0, 0], skip: true, coefs: Default::default() };
             return (leaf, f64::INFINITY);
         };
-        self.put(0, c * 4, r * 4, n, recon.as_deref().unwrap_or(&best_pred[..n * n]));
+        self.put(0, c * 4, r * 4, n, if has_recon { &best_recon[..n * n] } else { &best_pred[..n * n] });
+        let ty = TxResult { levels: best_levels[..n * n].to_vec(), nonzero: ty.nonzero, dist: ty.dist, bits: ty.bits };
         let tx_type_y = if ty.nonzero { tx_type_y } else { DCT_DCT };
         self.mark_decoded(0, r, c, n4);
         // chroma (one mode for both planes)
@@ -422,7 +506,7 @@ impl<'a> Decider<'a> {
         let uv_type = intra_uv_tx_type(uv_mode, uv_tx);
         let mut code_uv = |i: usize| {
             predict_intra(&ced[i], &ce[i], uv_mode, &mut pred);
-            let t = self.code_tx(1 + i, c * 2, r * 2, clog2, uv_type, &pred[..cn * cn], true);
+            let t = self.code_tx(TransformBlock { plane: 1 + i, x: c * 2, y: r * 2, log2: clog2, tx_type: uv_type, intra: true }, &pred[..cn * cn]);
             self.mark_decoded(1 + i, r, c, n4);
             t
         };
@@ -450,13 +534,17 @@ impl<'a> Decider<'a> {
             let (vw, vh) = self.g.visible(p);
             let pn = n >> s;
             let (x, y) = ((c * 4) >> s, (r * 4) >> s);
-            predict_inter(&refr.planes[p], vw as i32 - 1, vh as i32 - 1, x, y, pn, pn, mv, s, self.bd, &mut pred[..pn * pn]);
+            predict_inter(
+                &refr.planes[p],
+                &InterBlock { last_x: vw as i32 - 1, last_y: vh as i32 - 1, x, y, width: pn, height: pn, mv, subsampling: s, bit_depth: self.bd },
+                &mut pred[..pn * pn],
+            );
             if bsize == BLOCK_64X64 {
                 // coded as a skip block: the prediction is the reconstruction
                 dist += self.sse(p, x, y, pn, &pred[..pn * pn]);
                 self.put(p, x, y, pn, &pred[..pn * pn]);
             } else {
-                let t = self.code_tx(p, x, y, log2 - s as u32, DCT_DCT, &pred[..pn * pn], false);
+                let t = self.code_tx(TransformBlock { plane: p, x, y, log2: log2 - s as u32, tx_type: DCT_DCT, intra: false }, &pred[..pn * pn]);
                 dist += t.dist;
                 tx.push(t);
             }
@@ -515,19 +603,27 @@ impl<'a> Decider<'a> {
             let (dy, dx) = (m[0] >> 3, m[1] >> 3);
             dx >= lim_x.0 && dx <= lim_x.1 && dy >= lim_y.0 && dy <= lim_y.1
         };
+        let lg = log2_table();
         let mv_bits = |m: [i32; 2]| -> f64 {
-            let comp = |d: i32| if d == 0 { 0.5 } else { 2.0 + 2.0 * ((d.abs() / 8) as f64 + 1.0).log2() };
+            let comp = |d: i32| if d == 0 { 0.5 } else { 2.0 + 2.0 * log2_of(lg, (d.abs() / 8) as usize + 1) };
             comp(m[0] - pred_mv[0]) + comp(m[1] - pred_mv[1])
         };
-        let cost =
-            |m: [i32; 2]| -> f64 { self.sad_ref(&refr.planes[0], x0 + (m[1] >> 3), y0 + (m[0] >> 3), c * 4, r * 4, n) as f64 + self.lambda_sad * mv_bits(m) };
+        // `bound` is the cost to beat: the SAD stops early once the cost cannot be below it (the
+        // callers only accept a strictly lower cost, so the result is unchanged)
+        let cost = |m: [i32; 2], bound: f64| -> f64 {
+            let lb = self.lambda_sad * mv_bits(m);
+            self.sad_ref(&refr.planes[0], [x0 + (m[1] >> 3), y0 + (m[0] >> 3)], [c * 4, r * 4], n, [lb, bound]) as f64 + lb
+        };
+        // positions already evaluated cannot beat `best` again (costs are deterministic)
+        let mut seen: Vec<[i32; 2]> = Vec::with_capacity(64);
         let mut best = ([0, 0], f64::MAX);
         for &m in &cands {
             let m = [m[0] & !7, m[1] & !7];
-            if !valid(m) {
+            if !valid(m) || seen.contains(&m) {
                 continue;
             }
-            let cst = cost(m);
+            seen.push(m);
+            let cst = cost(m, best.1);
             if cst < best.1 {
                 best = (m, cst);
             }
@@ -548,10 +644,11 @@ impl<'a> Decider<'a> {
                 let center = best.0;
                 for d in [[-step, 0], [step, 0], [0, -step], [0, step]] {
                     let m = [center[0] + d[0], center[1] + d[1]];
-                    if !valid(m) {
+                    if !valid(m) || seen.contains(&m) {
                         continue;
                     }
-                    let cst = cost(m);
+                    seen.push(m);
+                    let cst = cost(m, best.1);
                     if cst < best.1 {
                         best = (m, cst);
                         moved = true;
@@ -562,15 +659,18 @@ impl<'a> Decider<'a> {
         }
         // half- then quarter-sample refinement (plus the exact neighbour candidates)
         let mut buf = vec![0u16; n * n];
-        let sub_cost = |m: [i32; 2], buf: &mut Vec<u16>| -> f64 {
+        let sub_cost = |m: [i32; 2], buf: &mut Vec<u16>, bound: f64| -> f64 {
             self.search_block(m, c * 4, r * 4, n, buf);
-            self.sad(0, c * 4, r * 4, n, buf) as f64 + self.lambda_sad * mv_bits(m)
+            let lb = self.lambda_sad * mv_bits(m);
+            self.sad_bounded(0, [c * 4, r * 4], n, buf, [lb, bound]) as f64 + lb
         };
+        let mut seen_sub: Vec<[i32; 2]> = Vec::with_capacity(24);
         for m in cands {
             if m[0] & 7 != 0 || m[1] & 7 != 0 {
                 let m = [m[0] & !1, m[1] & !1];
-                if valid(m) {
-                    let cst = sub_cost(m, &mut buf);
+                if valid(m) && !seen_sub.contains(&m) {
+                    seen_sub.push(m);
+                    let cst = sub_cost(m, &mut buf, best.1);
                     if cst < best.1 {
                         best = (m, cst);
                     }
@@ -581,10 +681,11 @@ impl<'a> Decider<'a> {
             let center = best.0;
             for d in [[-1, -1], [-1, 0], [-1, 1], [0, -1], [0, 1], [1, -1], [1, 0], [1, 1]] {
                 let m = [center[0] + d[0] * step, center[1] + d[1] * step];
-                if !valid(m) {
+                if !valid(m) || seen_sub.contains(&m) {
                     continue;
                 }
-                let cst = sub_cost(m, &mut buf);
+                seen_sub.push(m);
+                let cst = sub_cost(m, &mut buf, best.1);
                 if cst < best.1 {
                     best = (m, cst);
                 }
@@ -670,7 +771,8 @@ impl<'a> Decider<'a> {
     }
 
     /// SAD of the source block at (x, y) (luma) against the reference block at (rx, ry).
-    fn sad_ref(&self, refp: &Plane, rx: i32, ry: i32, x: usize, y: usize, n: usize) -> u64 {
+    /// Stops after a row once `sad + lb >= bound` (the cost can no longer win).
+    fn sad_ref(&self, refp: &Plane, [rx, ry]: [i32; 2], [x, y]: [usize; 2], n: usize, [lb, bound]: [f64; 2]) -> u64 {
         let (vw, vh) = (self.g.width, self.g.height);
         let w = n.min(vw.saturating_sub(x));
         let h = n.min(vh.saturating_sub(y));
@@ -690,45 +792,16 @@ impl<'a> Decider<'a> {
                     sad += (s[j] as i32 - b as i32).unsigned_abs() as u64;
                 }
             }
+            if sad as f64 + lb >= bound {
+                return sad;
+            }
         }
         sad
     }
 
-    /// Sum of absolute Hadamard-transformed differences (4x4 or 8x8 sub-blocks) of a prediction
-    /// against the source, scaled to about the size of the SAD.
-    fn satd(&self, p: usize, x: usize, y: usize, n: usize, pred: &[u16]) -> u64 {
-        let src = &self.src[p];
-        let k = n.min(8);
-        let mut total = 0u64;
-        let mut d = [0i32; 64];
-        for by in (0..n).step_by(k) {
-            for bx in (0..n).step_by(k) {
-                for i in 0..k {
-                    let row = &src.row(y + by + i)[x + bx..x + bx + k];
-                    for j in 0..k {
-                        d[i * k + j] = row[j] as i32 - pred[(by + i) * n + bx + j] as i32;
-                    }
-                }
-                for i in 0..k {
-                    hadamard(&mut d[i * k..i * k + k]);
-                }
-                let mut col = [0i32; 8];
-                let mut s = 0u64;
-                for j in 0..k {
-                    for i in 0..k {
-                        col[i] = d[i * k + j];
-                    }
-                    hadamard(&mut col[..k]);
-                    s += col[..k].iter().map(|v| v.unsigned_abs() as u64).sum::<u64>();
-                }
-                total += s / (k as u64 / 2);
-            }
-        }
-        total
-    }
-
-    /// SAD of a prediction against the source over the visible part of the block.
-    fn sad(&self, p: usize, x: usize, y: usize, n: usize, pred: &[u16]) -> u64 {
+    /// SAD of a prediction against the source over the visible part of the block. Stops after a row
+    /// once `sad + lb >= bound` (the cost can no longer win).
+    fn sad_bounded(&self, p: usize, [x, y]: [usize; 2], n: usize, pred: &[u16], [lb, bound]: [f64; 2]) -> u64 {
         let (vw, vh) = self.g.visible(p);
         let w = n.min(vw.saturating_sub(x));
         let h = n.min(vh.saturating_sub(y));
@@ -737,10 +810,60 @@ impl<'a> Decider<'a> {
         for i in 0..h {
             let row = &src.row(y + i)[x..x + w];
             s += row.iter().zip(&pred[i * n..i * n + w]).map(|(&a, &b)| (a as i32 - b as i32).unsigned_abs()).sum::<u32>() as u64;
+            if s as f64 + lb >= bound {
+                return s;
+            }
         }
         s
     }
 
+    /// Sum of absolute Hadamard-transformed differences (4x4 or 8x8 sub-blocks) of a prediction
+    /// against the source, scaled to about the size of the SAD.
+    fn satd(&self, p: usize, x: usize, y: usize, n: usize, pred: &[u16]) -> u64 {
+        if n >= 8 { self.satd_k::<8>(p, x, y, n, pred) } else { self.satd_k::<4>(p, x, y, n, pred) }
+    }
+
+    /// `satd` with K x K Hadamard sub-blocks (fixed sizes so the butterflies vectorise).
+    fn satd_k<const K: usize>(&self, p: usize, x: usize, y: usize, n: usize, pred: &[u16]) -> u64 {
+        let src = &self.src[p];
+        let mut total = 0u64;
+        for by in (0..n).step_by(K) {
+            for bx in (0..n).step_by(K) {
+                // d[i] holds row i of the differences
+                let mut d = [[0i32; K]; K];
+                for (i, di) in d.iter_mut().enumerate() {
+                    let row = &src.row(y + by + i)[x + bx..x + bx + K];
+                    let pr = &pred[(by + i) * n + bx..(by + i) * n + bx + K];
+                    for j in 0..K {
+                        di[j] = row[j] as i32 - pr[j] as i32;
+                    }
+                }
+                // vertical butterflies across rows (all columns at once)
+                let mut h = 1;
+                while h < K {
+                    for i0 in (0..K).step_by(2 * h) {
+                        for i in i0..i0 + h {
+                            let (a, b) = (d[i], d[i + h]);
+                            for j in 0..K {
+                                d[i][j] = a[j] + b[j];
+                                d[i + h][j] = a[j] - b[j];
+                            }
+                        }
+                    }
+                    h *= 2;
+                }
+                // horizontal butterflies within each row
+                let mut s = 0u64;
+                for di in d.iter_mut() {
+                    hadamard(di);
+                    s += di.iter().map(|v| v.unsigned_abs() as u64).sum::<u64>();
+                }
+                total += s / (K as u64 / 2);
+            }
+        }
+        total
+    }
+
     fn sse(&self, p: usize, x: usize, y: usize, n: usize, blk: &[u16]) -> f64 {
         let (vw, vh) = self.g.visible(p);
         let w = n.min(vw.saturating_sub(x));
@@ -771,36 +894,48 @@ impl<'a> Decider<'a> {
 
     /// Transform, quantise and reconstruct one square transform block of `plane` at (x, y)
     /// over the prediction `pred`; the reconstruction is written to `rec`.
-    fn code_tx(&mut self, p: usize, x: usize, y: usize, log2: u32, tx_type: usize, pred: &[u16], intra: bool) -> TxResult {
-        let (res, recon) = self.try_tx(p, x, y, log2, tx_type, pred, intra);
+    fn code_tx(&mut self, block: TransformBlock, pred: &[u16]) -> TxResult {
+        let TransformBlock { plane: p, x, y, log2, .. } = block;
+        let mut sc = self.scratch.take().unwrap_or_default();
+        let (res, has_recon) = self.try_tx(&mut sc, block, pred);
         let n = 1usize << log2;
-        self.put(p, x, y, n, recon.as_deref().unwrap_or(pred));
-        res
+        self.put(p, x, y, n, if has_recon { &sc.recon[..n * n] } else { pred });
+        let levels = sc.levels[..n * n].to_vec();
+        self.scratch = Some(sc);
+        TxResult { levels, nonzero: res.nonzero, dist: res.dist, bits: res.bits }
     }
 
-    /// Transform and quantise one block; returns the result and its reconstruction (None: the
-    /// prediction) without writing it.
-    fn try_tx(&self, p: usize, x: usize, y: usize, log2: u32, tx_type: usize, pred: &[u16], intra: bool) -> (TxResult, Option<Vec<u16>>) {
+    /// Transform and quantise one block without writing it. The levels are left in `sc.levels`;
+    /// the flag tells whether `sc.recon` holds the reconstruction (false: it is the prediction).
+    fn try_tx(&self, sc: &mut TxScratch, block: TransformBlock, pred: &[u16]) -> (TxEval, bool) {
+        let TransformBlock { plane: p, x, y, log2, tx_type, intra } = block;
         let n = 1usize << log2;
+        let nn = n * n;
         let tx_sz = tx_size_for(log2);
         let bd = self.bd;
         let src = &self.src[p];
-        let mut res = vec![0i32; n * n];
+        let TxScratch { res, coef, levels, deq, resid, recon } = sc;
+        let (res, coef, levels) = (&mut res[..nn], &mut coef[..nn], &mut levels[..nn]);
         for i in 0..n {
             let row = &src.row(y + i)[x..x + n];
             for j in 0..n {
                 res[i * n + j] = row[j] as i32 - pred[i * n + j] as i32;
             }
         }
-        let mut coef = vec![0f32; n * n];
-        forward_2d(&res, &mut coef, n, tx_type);
+        forward_2d(res, coef, n, tx_type);
         // dead-zone quantiser: rounding offset below one half
-        let rnd = if intra { 0.38f32 } else { 0.30f32 };
-        let mut levels = vec![0i32; n * n];
+        let rnd = if intra { INTRA_RND } else { INTER_RND };
+        let [dc_thr, ac_thr] = [self.dead_zone[0][intra as usize], self.dead_zone[1][intra as usize]];
+        levels.fill(0);
         let mut nonzero = false;
         for (k, (&cf, l)) in coef.iter().zip(levels.iter_mut()).enumerate() {
-            let q = if k == 0 { self.dc_q } else { self.ac_q };
-            let a = (cf.abs() / q + rnd).floor() as i32;
+            let (q, thr) = if k == 0 { (self.dc_q, dc_thr) } else { (self.ac_q, ac_thr) };
+            // dead zone: below the exact threshold the level is zero, no division needed
+            if cf.abs() < thr {
+                continue;
+            }
+            // the operand is >= 0, so truncation equals floor
+            let a = (cf.abs() / q + rnd) as i32;
             if a != 0 {
                 *l = if cf < 0.0 { -a.min(1 << 16) } else { a.min(1 << 16) };
                 nonzero = true;
@@ -808,23 +943,26 @@ impl<'a> Decider<'a> {
         }
         let zero_dist = self.sse(p, x, y, n, pred);
         if !nonzero {
-            return (TxResult { levels, nonzero, dist: zero_dist, bits: 1.0 }, None);
+            return (TxEval { nonzero, dist: zero_dist, bits: 1.0 }, false);
         }
-        let recon = self.reconstruct(&levels, tx_sz, tx_type, pred, n, bd);
-        let dist = self.sse(p, x, y, n, &recon);
-        let bits = estimate_bits(&levels, tx_sz);
+        let recon = &mut recon[..nn];
+        self.reconstruct(levels, ReconBuffers { deq: &mut deq[..nn], resid: &mut resid[..nn], recon }, tx_sz, tx_type, pred, bd);
+        let dist = self.sse(p, x, y, n, recon);
+        let bits = estimate_bits(levels, tx_sz);
         if dist + self.lambda * bits >= zero_dist + self.lambda {
-            levels.iter_mut().for_each(|l| *l = 0);
-            return (TxResult { levels, nonzero: false, dist: zero_dist, bits: 1.0 }, None);
+            levels.fill(0);
+            return (TxEval { nonzero: false, dist: zero_dist, bits: 1.0 }, false);
         }
-        (TxResult { levels, nonzero: true, dist, bits }, Some(recon))
+        (TxEval { nonzero: true, dist, bits }, true)
     }
 
-    /// Dequantisation (7.12.3) and the inverse transform, added to the prediction.
-    fn reconstruct(&self, levels: &[i32], tx_sz: usize, tx_type: usize, pred: &[u16], n: usize, bd: u32) -> Vec<u16> {
+    /// Dequantisation (7.12.3) and the inverse transform, added to the prediction; the result is
+    /// written to `recon`. `deq` and `resid` are scratch buffers of `n * n` entries.
+    fn reconstruct(&self, levels: &[i32], bufs: ReconBuffers, tx_sz: usize, tx_type: usize, pred: &[u16], bd: u32) {
+        let ReconBuffers { deq, resid, recon } = bufs;
         let denom: i64 = if tx_sz == TX_32X32 { 2 } else { 1 };
         let lim = 1i64 << (7 + bd);
-        let mut deq = vec![0i32; n * n];
+        deq.fill(0);
         for (k, (&l, d)) in levels.iter().zip(deq.iter_mut()).enumerate() {
             if l == 0 {
                 continue;
@@ -834,13 +972,41 @@ impl<'a> Decider<'a> {
             let mag = (dq.abs() & 0xFF_FFFF) / denom;
             *d = (if dq < 0 { -mag } else { mag }).clamp(-lim, lim - 1) as i32;
         }
-        let mut resid = vec![0i32; n * n];
-        inverse_2d(&deq, &mut resid, tx_sz, tx_type, bd);
+        inverse_2d(deq, resid, tx_sz, tx_type, bd);
         let max = (1i32 << bd) - 1;
-        pred.iter().zip(&resid).map(|(&p, &r)| (p as i32 + r).clamp(0, max) as u16).collect()
+        for ((o, &p), &r) in recon.iter_mut().zip(pred).zip(resid.iter()) {
+            *o = (p as i32 + r).clamp(0, max) as u16;
+        }
     }
 }
 
+/// Smallest `x >= 0` with `(x / q + rnd) as i32 >= 1` in f32 arithmetic. The expression is
+/// monotone in `x`, so a binary search over the bit patterns finds the exact boundary.
+fn zero_threshold(q: f32, rnd: f32) -> f32 {
+    let (mut lo, mut hi) = (0u32, f32::MAX.to_bits());
+    while lo < hi {
+        let mid = lo + (hi - lo) / 2;
+        if (f32::from_bits(mid) / q + rnd) as i32 >= 1 {
+            hi = mid;
+        } else {
+            lo = mid + 1;
+        }
+    }
+    f32::from_bits(lo)
+}
+
+const LOG2_TABLE_LEN: usize = 1025;
+
+/// `log2(i)` for `i < LOG2_TABLE_LEN`, computed with the same `f64::log2` call as the direct form.
+fn log2_table() -> &'static [f64; LOG2_TABLE_LEN] {
+    static TABLE: std::sync::OnceLock<[f64; LOG2_TABLE_LEN]> = std::sync::OnceLock::new();
+    TABLE.get_or_init(|| std::array::from_fn(|i| (i as f64).log2()))
+}
+
+fn log2_of(table: &[f64; LOG2_TABLE_LEN], v: usize) -> f64 {
+    if v < LOG2_TABLE_LEN { table[v] } else { (v as f64).log2() }
+}
+
 /// Unnormalised Walsh-Hadamard transform of 4 or 8 values, in place.
 fn hadamard(v: &mut [i32]) {
     let n = v.len();
@@ -869,13 +1035,14 @@ fn estimate_bits(levels: &[i32], tx_sz: usize) -> f64 {
     if eob == 0 {
         return 1.0;
     }
-    let mut bits = 3.0 + (eob as f64).log2();
+    let lg = log2_table();
+    let mut bits = 3.0 + log2_of(lg, eob);
     for &pos in &scan[..eob] {
         let a = levels[pos as usize].unsigned_abs();
         bits += match a {
             0 => 0.7,
             1 => 2.5,
-            _ => 3.5 + 1.6 * (a as f64).log2(),
+            _ => 3.5 + 1.6 * log2_of(lg, a as usize),
         };
     }
     bits
@@ -889,3 +1056,218 @@ pub(crate) fn scan_for(tx_sz: usize) -> &'static [u16] {
         _ => &DEFAULT_SCAN_32X32,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::tables::{AC_QLOOKUP, DC_QLOOKUP};
+
+    /// The quantiser as it was before the dead-zone threshold and the truncation.
+    fn quant_ref(cf: f32, q: f32, rnd: f32) -> i32 {
+        (cf.abs() / q + rnd).floor() as i32
+    }
+
+    fn quant_new(cf: f32, q: f32, rnd: f32, thr: f32) -> i32 {
+        if cf.abs() < thr {
+            return 0;
+        }
+        (cf.abs() / q + rnd) as i32
+    }
+
+    #[test]
+    fn dead_zone_threshold_is_exact() {
+        let mut state = 0x1234_5678_9abc_def0u64;
+        let mut next = move || {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            state
+        };
+        for table in AC_QLOOKUP.iter().chain(DC_QLOOKUP.iter()) {
+            for &qi in table.iter() {
+                let q = qi as f32;
+                for rnd in [INTER_RND, INTRA_RND] {
+                    let thr = zero_threshold(q, rnd);
+                    // the boundary itself and its neighbours
+                    let b = thr.to_bits();
+                    for bits in b.saturating_sub(3)..=b + 3 {
+                        let cf = f32::from_bits(bits);
+                        assert_eq!(quant_ref(cf, q, rnd), quant_new(cf, q, rnd, thr), "q {q} rnd {rnd} cf {cf}");
+                        assert_eq!(quant_ref(-cf, q, rnd), quant_new(-cf, q, rnd, thr));
+                    }
+                    for _ in 0..200 {
+                        let cf = f32::from_bits((next() >> 32) as u32 & 0x7fff_ffff);
+                        if cf.is_nan() {
+                            continue;
+                        }
+                        assert_eq!(quant_ref(cf, q, rnd), quant_new(cf, q, rnd, thr));
+                        let cf = (next() % 100_000) as f32 / 100.0;
+                        assert_eq!(quant_ref(cf, q, rnd), quant_new(cf, q, rnd, thr));
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn log2_table_matches_direct_log2() {
+        let t = log2_table();
+        for v in 1..3000usize {
+            assert_eq!(log2_of(t, v).to_bits(), (v as f64).log2().to_bits(), "{v}");
+        }
+    }
+
+    /// The SATD as it was before the fixed-size version: runtime block size, column gather.
+    fn satd_ref(src: &Plane, x: usize, y: usize, n: usize, pred: &[u16]) -> u64 {
+        let k = n.min(8);
+        let mut total = 0u64;
+        let mut d = [0i32; 64];
+        for by in (0..n).step_by(k) {
+            for bx in (0..n).step_by(k) {
+                for i in 0..k {
+                    let row = &src.row(y + by + i)[x + bx..x + bx + k];
+                    for j in 0..k {
+                        d[i * k + j] = row[j] as i32 - pred[(by + i) * n + bx + j] as i32;
+                    }
+                }
+                for i in 0..k {
+                    hadamard(&mut d[i * k..i * k + k]);
+                }
+                let mut col = [0i32; 8];
+                let mut s = 0u64;
+                for j in 0..k {
+                    for i in 0..k {
+                        col[i] = d[i * k + j];
+                    }
+                    hadamard(&mut col[..k]);
+                    s += col[..k].iter().map(|v| v.unsigned_abs() as u64).sum::<u64>();
+                }
+                total += s / (k as u64 / 2);
+            }
+        }
+        total
+    }
+
+    #[test]
+    fn satd_fixed_size_matches_runtime_size() {
+        let g = FrameGeom::new(100, 80);
+        let mut state = 0x9e37_79b9_7f4a_7c15u64;
+        let mut next = move || {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            state
+        };
+        for bd in [8u32, 10] {
+            let max = (1u64 << bd) - 1;
+            let mut mk = |w: usize, h: usize| {
+                let mut p = Plane::new(w, h);
+                p.data.iter_mut().for_each(|v| *v = (next() % (max + 1)) as u16);
+                p
+            };
+            let src = [mk(128, 128), mk(64, 64), mk(64, 64)];
+            let dec = Decider::new(&g, bd, 100, true, &src, None);
+            for n in [4usize, 8, 16, 32] {
+                let pred: Vec<u16> = (0..n * n).map(|_| (next() % (max + 1)) as u16).collect();
+                for (p, x, y) in [(0, 0, 0), (0, 32, 40), (1, 8, 4)] {
+                    assert_eq!(dec.satd(p, x, y, n, &pred), satd_ref(&src[p], x, y, n, &pred), "n {n} plane {p}");
+                }
+            }
+        }
+    }
+
+    fn xorshift(seed: u64) -> impl FnMut() -> u64 {
+        let mut state = seed;
+        move || {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            state
+        }
+    }
+
+    /// A snapshot keeps only the BlockDecoded cells of the block area. Coding inside the block
+    /// marks sub-blocks of every smaller size; restoring must give back the whole 3x35x35 array
+    /// as it was, for every block size of a 64x64 superblock and every aligned position.
+    #[test]
+    fn snapshot_restore_brings_back_every_blockdecoded_flag() {
+        let g = FrameGeom::new(256, 256);
+        let mut next = xorshift(0x2545_f491_4f6c_dd1d);
+        let src = [Plane::new(256, 256), Plane::new(128, 128), Plane::new(128, 128)];
+        let mut dec = Decider::new(&g, 8, 100, true, &src, None);
+        for random_start in [false, true] {
+            for n4 in [1usize, 2, 4, 8, 16] {
+                for sb in [0usize, 16] {
+                    for r in (sb..sb + 16).step_by(n4) {
+                        for c in (sb..sb + 16).step_by(n4) {
+                            for plane in dec.decoded.iter_mut() {
+                                for row in plane.iter_mut() {
+                                    for v in row.iter_mut() {
+                                        *v = random_start && next() & 1 == 1;
+                                    }
+                                }
+                            }
+                            let before = dec.decoded.clone();
+                            let snap = dec.snapshot(r, c, n4);
+                            // every sub-block of every size inside the block, as coding marks them
+                            let mut m = n4;
+                            loop {
+                                for rr in (r..r + n4).step_by(m) {
+                                    for cc in (c..c + n4).step_by(m) {
+                                        for p in 0..3 {
+                                            dec.mark_decoded(p, rr, cc, m);
+                                        }
+                                    }
+                                }
+                                if m == 1 {
+                                    break;
+                                }
+                                m /= 2;
+                            }
+                            dec.restore(&snap, r, c, n4);
+                            assert!(dec.decoded == before, "n4 {n4} at ({r}, {c}), random start {random_start}");
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// The bounded SADs return the full SAD whenever the cost can still win (`sad + lb < bound`)
+    /// and otherwise a partial sum that already loses, so the callers' strict `<` decides the same.
+    #[test]
+    fn bounded_sad_stops_only_once_the_cost_cannot_win() {
+        let g = FrameGeom::new(100, 80);
+        let mut next = xorshift(0x9e37_79b9_7f4a_7c15);
+        let mut mk = |w: usize, h: usize| {
+            let mut p = Plane::new(w, h);
+            p.data.iter_mut().for_each(|v| *v = (next() % 256) as u16);
+            p
+        };
+        let src = [mk(128, 128), mk(64, 64), mk(64, 64)];
+        let refp = mk(128, 128);
+        let mut next = xorshift(0x1234_5678_9abc_def1);
+        let dec = Decider::new(&g, 8, 100, false, &src, None);
+        for n in [4usize, 8, 16, 32] {
+            for (x, y, rx, ry) in [(0usize, 0usize, 0i32, 0i32), (32, 40, 29, 43), (96, 72, 90, 70), (8, 8, -5, -3)] {
+                let full_ref = dec.sad_ref(&refp, [rx, ry], [x, y], n, [0.0, f64::INFINITY]);
+                let pred: Vec<u16> = (0..n * n).map(|_| (next() % 256) as u16).collect();
+                let full_pred = dec.sad_bounded(0, [x, y], n, &pred, [0.0, f64::INFINITY]);
+                for _ in 0..50 {
+                    let lb = (next() % 64) as f64 * 0.75;
+                    let b_ref = (next() % (2 * full_ref + 2)) as f64;
+                    let b_pred = (next() % (2 * full_pred + 2)) as f64;
+                    let got_ref = dec.sad_ref(&refp, [rx, ry], [x, y], n, [lb, b_ref]);
+                    let got_pred = dec.sad_bounded(0, [x, y], n, &pred, [lb, b_pred]);
+                    for (got, full, bound) in [(got_ref, full_ref, b_ref), (got_pred, full_pred, b_pred)] {
+                        if full as f64 + lb < bound {
+                            assert_eq!(got, full, "n {n} at ({x}, {y}) bound {bound}");
+                        } else {
+                            assert!(got as f64 + lb >= bound && got <= full, "n {n} at ({x}, {y}) bound {bound}");
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/crates/av1enc/src/lib.rs b/crates/av1enc/src/lib.rs
index 6b1edfbe8..2962833d9 100644
--- a/crates/av1enc/src/lib.rs
+++ b/crates/av1enc/src/lib.rs
@@ -24,6 +24,7 @@ use bitw::{BitWriter, obu};
 use decide::{Decider, FrameGeom, RefFrame};
 use loopfilter::{LfInfo, loop_filter};
 use pred::Plane;
+use tables::AC_QLOOKUP;
 use writer::TileWriter;
 
 /// Rate control.
@@ -51,11 +52,28 @@ pub struct EncoderConfig {
     pub keyint: u32,
     /// BT.709 limited range is signalled unless this is set.
     pub full_range: bool,
+    /// The colour description of `color_config` (ITU-T H.273 code points); BT.709 by default.
+    pub color_primaries: u8,
+    pub transfer_characteristics: u8,
+    pub matrix_coefficients: u8,
 }
 
 impl EncoderConfig {
     pub fn new(width: u32, height: u32, fps_num: u32, fps_den: u32) -> Self {
-        EncoderConfig { width, height, fps_num, fps_den, bit_depth: 8, level_idx: None, rate: RateControl::ConstantQ(100), keyint: 60, full_range: false }
+        EncoderConfig {
+            width,
+            height,
+            fps_num,
+            fps_den,
+            bit_depth: 8,
+            level_idx: None,
+            rate: RateControl::ConstantQ(100),
+            keyint: 60,
+            full_range: false,
+            color_primaries: 1,
+            transfer_characteristics: 1,
+            matrix_coefficients: 1,
+        }
     }
 }
 
@@ -136,10 +154,118 @@ struct RateState {
     frame_bits: f64,
     /// Quantizer index for inter frames (continuous).
     q: f64,
+    /// Key frame quantizer index minus the inter frame one.
+    key_off: f64,
+    /// Quantizer index steps per halving of the frame size, measured from consecutive inter
+    /// frames (the size/quantizer curve is much steeper than the default on noisy content).
+    slope: f64,
+    /// Quantizer index and size (in bits) of the previous inter frame.
+    prev_inter: Option<(f64, f64)>,
     /// Accumulated (spent - budget) bits.
     debt: f64,
 }
 
+/// Quantizer index steps per halving of the frame size before any measurement.
+const RC_SLOPE: f64 = 28.0;
+/// Fraction of the quantizer step the size error asks for that is applied per frame.
+const RC_GAIN: f64 = 0.8;
+/// Frames over which an accumulated deviation from the budget is paid back.
+const RC_PAYBACK: f64 = 16.0;
+
+impl RateState {
+    /// The nominal bit budget and the starting quantizer index of a key or inter frame. A key
+    /// frame gets a larger share, and the inter frames of the group get the rest, so that a whole
+    /// group of `keyint` frames adds up to `keyint * frame_bits`.
+    fn frame_budget(&self, keyint: u32, key: bool) -> (f64, f64) {
+        let keyint = keyint.max(1) as f64;
+        let boost = (1.0 + (keyint.clamp(1.0, 60.0) - 1.0).sqrt() * 0.75).min(0.5 * keyint + 0.5);
+        if key {
+            (self.frame_bits * boost, (self.q + self.key_off).clamp(1.0, 255.0))
+        } else if keyint > 1.0 {
+            (self.frame_bits * (keyint - boost) / (keyint - 1.0), self.q)
+        } else {
+            (self.frame_bits, self.q)
+        }
+    }
+
+    /// Adapts the quantizers to the size of the frame just coded at `q_used` against `target`.
+    fn update(&mut self, key: bool, first: bool, q_used: f64, bits: f64, target: f64) {
+        let err = (bits / target).log2().clamp(-1.5, 1.5);
+        if first && key {
+            // four passes ran: the key frame quantizer is known, the inter one follows from the offset
+            self.q = (q_used - self.key_off).clamp(1.0, 255.0);
+        } else if key {
+            self.key_off = q_used - self.q + RC_GAIN * self.slope * err;
+        } else {
+            if let Some((pq, pbits)) = self.prev_inter {
+                let (dq, dr) = (q_used - pq, (pbits / bits).log2());
+                if dq.abs() >= 3.0 && dr.abs() >= 0.15 && dq * dr > 0.0 {
+                    self.slope = (0.6 * self.slope + 0.4 * (dq / dr)).clamp(3.0, 45.0);
+                }
+            }
+            self.prev_inter = Some((q_used, bits));
+            self.q = (q_used + RC_GAIN * self.slope * err).clamp(1.0, 255.0);
+        }
+    }
+}
+
+/// Most passes on the first frame, and how far from the target (octaves, 3 %) its size may be
+/// before it is accepted.
+const RC_FIRST_PASSES: usize = 4;
+const RC_FIRST_TOLERANCE: f64 = 0.04;
+/// Quantizer index steps per halving of the size, for the first correction of the first frame
+/// (the starting quantizer comes from the bits per sample; the first pass shows how far off it
+/// is, and from there on the passes are placed by `next_probe_q`).
+const RC_FIRST_SLOPE: f64 = 30.0;
+/// The same for a key frame after the first: coded again when its size is more than 0.25 octaves
+/// (19 %) off the target.
+const RC_KEY_PASSES: usize = 3;
+const RC_KEY_TOLERANCE: f64 = 0.25;
+/// Octaves of frame size per octave of quantizer step assumed for the first correction of a frame.
+const RC_PROBE_SLOPE: f64 = 1.0;
+/// Largest change of the quantizer step (octaves) between two passes on one frame.
+const RC_PROBE_MAX_STEP: f64 = 2.0;
+
+/// The quantizer index whose step size is closest to `2^x`.
+fn q_for_step(bit_depth: u8, x: f64) -> u8 {
+    let table = &AC_QLOOKUP[((bit_depth - 8) / 2) as usize];
+    let mut best = 1;
+    for q in 1..=255usize {
+        if ((table[q] as f64).log2() - x).abs() < ((table[best] as f64).log2() - x).abs() {
+            best = q;
+        }
+    }
+    best as u8
+}
+
+/// The next quantizer to try for a frame, from the `(quantizer, log2(size / target))`
+/// pairs coded so far. The size follows the quantizer step (not the index, which is linear in the
+/// step only below about 60) in a near log-log line: false position between the closest pair of
+/// passes that enclose the target, otherwise a step from the latest one with the slope of the
+/// last two. `None` when no untried quantizer lies between the enclosing passes.
+fn next_probe_q(bit_depth: u8, tried: &[(u8, f64)]) -> Option<u8> {
+    let table = &AC_QLOOKUP[((bit_depth - 8) / 2) as usize];
+    let x = |q: u8| (table[q as usize] as f64).log2();
+    let over = tried.iter().filter(|t| t.1 > 0.0).max_by_key(|t| t.0);
+    let under = tried.iter().filter(|t| t.1 <= 0.0).min_by_key(|t| t.0);
+    if let (Some(&(q_lo, e_lo)), Some(&(q_hi, e_hi))) = (over, under) {
+        if q_hi - q_lo < 2 {
+            return None;
+        }
+        let next = x(q_lo) + (x(q_hi) - x(q_lo)) * e_lo / (e_lo - e_hi);
+        return Some(q_for_step(bit_depth, next).clamp(q_lo + 1, q_hi - 1));
+    }
+    let &(q, err) = tried.last()?;
+    let mut slope = RC_PROBE_SLOPE;
+    if let [.., (q0, e0), (q1, e1)] = tried
+        && (x(*q1) - x(*q0)).abs() > 0.05
+        && (e0 - e1) / (x(*q1) - x(*q0)) > 0.0
+    {
+        slope = ((e0 - e1) / (x(*q1) - x(*q0))).clamp(0.25, 3.0);
+    }
+    Some(q_for_step(bit_depth, x(q) + (err / slope).clamp(-RC_PROBE_MAX_STEP, RC_PROBE_MAX_STEP)))
+}
+
 /// AV1 encoder. Frames come out in input order (no hidden/reordered frames).
 pub struct Encoder {
     cfg: EncoderConfig,
@@ -185,7 +311,7 @@ impl Encoder {
                 // initial guess from the bits per sample
                 let bpp = frame_bits / (cfg.width as f64 * cfg.height as f64);
                 let q = (110.0 - 40.0 * (bpp / 0.1).log2()).clamp(20.0, 230.0);
-                Some(RateState { frame_bits, q, debt: 0.0 })
+                Some(RateState { frame_bits, q, key_off: -24.0, slope: RC_SLOPE, prev_inter: None, debt: 0.0 })
             }
         };
         let mut enc = Encoder { cfg, geom, level, seq_obu: Vec::new(), frame_num: 0, refr: None, rc };
@@ -255,9 +381,9 @@ impl Encoder {
         w.f(1, (c.bit_depth > 8) as u32); // high_bitdepth
         w.f(1, 0); // mono_chrome
         w.f(1, 1); // color_description_present_flag
-        w.f(8, 1); // color_primaries: BT.709
-        w.f(8, 1); // transfer_characteristics: BT.709
-        w.f(8, 1); // matrix_coefficients: BT.709
+        w.f(8, c.color_primaries as u32); // color_primaries
+        w.f(8, c.transfer_characteristics as u32); // transfer_characteristics
+        w.f(8, c.matrix_coefficients as u32); // matrix_coefficients
         w.f(1, c.full_range as u32); // color_range
         w.f(2, 0); // chroma_sample_position: unknown
         w.f(1, 0); // separate_uv_delta_q
@@ -409,11 +535,13 @@ impl Encoder {
         };
         let bd = self.cfg.bit_depth as u32;
         let mut cache: Vec<(u32, u64)> = vec![(0, sse(&rec[0]))];
+        // one working copy of the luma plane for all candidate levels
+        let mut planes = [rec[0].clone(), Plane::new(0, 0), Plane::new(0, 0)];
         let mut eval = |lvl: u32| -> u64 {
             if let Some(&(_, e)) = cache.iter().find(|(l, _)| *l == lvl) {
                 return e;
             }
-            let mut planes = [rec[0].clone(), Plane::new(0, 0), Plane::new(0, 0)];
+            planes[0].data.copy_from_slice(&rec[0].data);
             loop_filter(&mut planes, info, [lvl; 4], bd, true, sb_row_step);
             let e = sse(&planes[0]);
             cache.push((lvl, e));
@@ -469,38 +597,52 @@ impl Encoder {
 
     fn encode_rate_controlled(&mut self, src: &[Plane; 3], key: bool, rc: &mut RateState) -> (Vec<u8>, RefFrame) {
         let first = self.frame_num == 0;
-        let (frame_bits, debt, q_inter) = (rc.frame_bits, rc.debt, rc.q);
-        // key frames get a lower quantizer and a larger share of the budget
-        let key_boost = 1.0 + (self.cfg.keyint.clamp(1, 60) as f64 - 1.0).sqrt() * 0.75;
-        let budget = if key { frame_bits * key_boost } else { frame_bits };
-        // pay back a fraction of the accumulated deviation
-        let target = (budget - debt * 0.25).max(budget * 0.25);
-        let mut q = if key { q_inter - 24.0 } else { q_inter };
-        let mut best: Option<(Vec<u8>, RefFrame, f64)> = None;
-        let passes = if first { 4 } else { 1 };
-        for pass in 0..passes {
+        let (budget, q_start) = rc.frame_budget(self.cfg.keyint, key);
+        // pay back the accumulated deviation over the next RC_PAYBACK frames
+        let target = (budget - rc.debt / RC_PAYBACK).clamp(budget * 0.35, budget * 2.0);
+        let mut q = q_start;
+        let mut best: Option<(Vec<u8>, RefFrame, f64, f64)> = None;
+        // The first frame is coded up to four times to find its quantizer (it fixes the
+        // quantizers of everything after it), a later key frame up to three times (it is a large
+        // part of the budget of its group). A frame is coded again only while its size is far from
+        // the target and an untried quantizer is left to try; other frames are coded once.
+        let (max_passes, tolerance) = if first {
+            (RC_FIRST_PASSES, RC_FIRST_TOLERANCE)
+        } else if key {
+            (RC_KEY_PASSES, RC_KEY_TOLERANCE)
+        } else {
+            (1, 0.0)
+        };
+        let mut tried: Vec<(u8, f64)> = Vec::new();
+        for _ in 0..max_passes {
             let qi = q.round().clamp(1.0, 255.0) as u8;
+            if tried.iter().any(|t| t.0 == qi) {
+                break;
+            }
             let (obu, rf) = self.encode_frame(src, key, qi);
             let bits = obu.len() as f64 * 8.0;
             let err = (bits / target).log2();
-            let better = best.as_ref().is_none_or(|b| err.abs() < (b.2 / target).log2().abs());
-            if better {
-                best = Some((obu, rf, bits));
+            tried.push((qi, err));
+            if best.as_ref().is_none_or(|b| err.abs() < (b.2 / target).log2().abs()) {
+                best = Some((obu, rf, bits, qi as f64));
             }
-            if pass + 1 < passes {
-                q = (q + 30.0 * err).clamp(1.0, 255.0);
+            if err.abs() <= tolerance {
+                break;
+            }
+            let next = if first && tried.len() == 1 {
+                Some((q + RC_FIRST_SLOPE * err).clamp(1.0, 255.0))
+            } else {
+                next_probe_q(self.cfg.bit_depth, &tried).map(f64::from)
+            };
+            match next {
+                Some(next) => q = next,
+                None => break,
             }
         }
         // At least one pass ran, so `best` is set.
-        let Some((obu, rf, bits)) = best else { return self.encode_frame(src, key, q.round().clamp(1.0, 255.0) as u8) };
+        let Some((obu, rf, bits, q_used)) = best else { return self.encode_frame(src, key, q.round().clamp(1.0, 255.0) as u8) };
         rc.debt += bits - budget;
-        // adapt the inter quantizer: about 30 index steps per doubling of the rate
-        let err = (bits / target).log2().clamp(-1.0, 1.0);
-        if first && key {
-            rc.q = (q + 24.0).clamp(1.0, 255.0);
-        } else {
-            rc.q = (rc.q + 12.0 * err).clamp(1.0, 255.0);
-        }
+        rc.update(key, first, q_used, bits, target);
         (obu, rf)
     }
 
diff --git a/crates/av1enc/src/loopfilter.rs b/crates/av1enc/src/loopfilter.rs
index 2add41edc..cf350fbd2 100644
--- a/crates/av1enc/src/loopfilter.rs
+++ b/crates/av1enc/src/loopfilter.rs
@@ -3,7 +3,7 @@
 //! is 0 in the frames this encoder writes.
 
 use crate::pred::Plane;
-use crate::tables::*;
+use crate::tables::{MAX_LOOP_FILTER, NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, SUBSAMPLED_SIZE, TX_HEIGHT, TX_WIDTH};
 
 /// Mode info the loop filter reads (per 4x4 luma unit, row stride `mi_cols`), and the
 /// transform size per 4x4 unit of each plane (`LoopfilterTxSizes`, row stride `mi_cols + 32`).
@@ -39,7 +39,7 @@ pub(crate) fn loop_filter(planes: &mut [Plane; 3], info: &LfInfo, level: [u32; 4
                 }
                 let mut col = 0;
                 while col < info.mi_cols {
-                    edge(pl, info, level, bit_depth, plane, pass, row, col);
+                    edge(pl, info, level, bit_depth, plane, pass, (row, col));
                     col += step;
                 }
                 row += step;
@@ -48,7 +48,8 @@ pub(crate) fn loop_filter(planes: &mut [Plane; 3], info: &LfInfo, level: [u32; 4
     }
 }
 
-fn edge(pl: &mut Plane, info: &LfInfo, level: [u32; 4], bd: u32, plane: usize, pass: usize, row: usize, col: usize) {
+fn edge(pl: &mut Plane, info: &LfInfo, level: [u32; 4], bd: u32, plane: usize, pass: usize, position: (usize, usize)) {
+    let (row, col) = position;
     let s = (plane > 0) as usize;
     let (dx, dy) = if pass == 0 { (1usize, 0usize) } else { (0, 1) };
     let x = col * 4;
@@ -88,13 +89,24 @@ fn edge(pl: &mut Plane, info: &LfInfo, level: [u32; 4], bd: u32, plane: usize, p
     let limit = lvl.max(1);
     let blimit = 2 * (lvl + 2) + limit;
     let thresh = lvl >> 4;
+    let strength = FilterStrength { limit, blimit, thresh };
     for k in 0..4 {
-        sample_filter(pl, xp + dy * k, yp + dx * k, plane, limit, blimit, thresh, dx as isize, dy as isize, filter_size, bd);
+        sample_filter(pl, (xp + dy * k, yp + dx * k), plane, &strength, (dx as isize, dy as isize), filter_size, bd);
     }
 }
 
+/// Thresholds derived from the loop-filter level (spec 7.14.4).
+struct FilterStrength {
+    limit: i32,
+    blimit: i32,
+    thresh: i32,
+}
+
 #[inline]
-fn sample_filter(pl: &mut Plane, x: usize, y: usize, plane: usize, limit: i32, blimit: i32, thresh: i32, dx: isize, dy: isize, filter_size: usize, bd: u32) {
+fn sample_filter(pl: &mut Plane, position: (usize, usize), plane: usize, strength: &FilterStrength, direction: (isize, isize), filter_size: usize, bd: u32) {
+    let (x, y) = position;
+    let (dx, dy) = direction;
+    let FilterStrength { limit, blimit, thresh } = *strength;
     let stride = pl.stride as isize;
     let step = dy * stride + dx;
     let base = y as isize * stride + x as isize;
diff --git a/crates/av1enc/src/pred.rs b/crates/av1enc/src/pred.rs
index d61a6fa94..b899202f4 100644
--- a/crates/av1enc/src/pred.rs
+++ b/crates/av1enc/src/pred.rs
@@ -2,7 +2,10 @@
 //! modes plus V_PRED / H_PRED without edge filtering, 7.11.3 block inter prediction without
 //! reference scaling) so that the encoder predicts exactly like a decoder.
 
-use crate::tables::*;
+use crate::tables::{
+    DC_PRED, EIGHTTAP, H_PRED, PAETH_PRED, SM_WEIGHTS_TX_4X4, SM_WEIGHTS_TX_8X8, SM_WEIGHTS_TX_16X16, SM_WEIGHTS_TX_32X32, SMOOTH_H_PRED, SMOOTH_PRED,
+    SMOOTH_V_PRED, SUBPEL_FILTERS, V_PRED,
+};
 use crate::transform::round2;
 
 /// A plane buffer (padded to whole superblocks).
@@ -184,19 +187,20 @@ pub(crate) fn predict_intra(ed: &Edges, e: &IntraEdge, mode: usize, pred: &mut [
 /// final rounding is the identity) of the `w x h` block at plane position (x, y) displaced by
 /// `mv` (1/8 luma sample units, [row, col]). `last_x` / `last_y` are the largest sample
 /// coordinates of the reference plane; the result goes to `pred` (row stride `w`).
-pub(crate) fn predict_inter(
-    refp: &Plane,
-    last_x: i32,
-    last_y: i32,
-    x: usize,
-    y: usize,
-    w: usize,
-    h: usize,
-    mv: [i32; 2],
-    ss: usize,
-    bit_depth: u32,
-    pred: &mut [u16],
-) {
+pub(crate) struct InterBlock {
+    pub last_x: i32,
+    pub last_y: i32,
+    pub x: usize,
+    pub y: usize,
+    pub width: usize,
+    pub height: usize,
+    pub mv: [i32; 2],
+    pub subsampling: usize,
+    pub bit_depth: u32,
+}
+
+pub(crate) fn predict_inter(refp: &Plane, block: &InterBlock, pred: &mut [u16]) {
+    let InterBlock { last_x, last_y, x, y, width: w, height: h, mv, subsampling: ss, bit_depth } = *block;
     // positions in 1/16 sample units ((startX >> 6) & 15 is the filter phase)
     let px = ((x as i32) << 4) + ((2 * mv[1]) >> ss);
     let py = ((y as i32) << 4) + ((2 * mv[0]) >> ss);
@@ -293,7 +297,8 @@ pub(crate) fn predict_inter(
 
 /// The visible `w x h` area of a reference plane interpolated at the sub-sample phase
 /// (`fx`, `fy`) (1/16 units) with the EIGHTTAP filter, as `predict_inter` computes it for
-/// blocks wider and taller than 4. Used for motion search.
+/// blocks wider and taller than 4. The reference for `half_planes`, which the encoder uses.
+#[cfg(test)]
 pub(crate) fn subpel_plane(refp: &Plane, w: usize, h: usize, fx: usize, fy: usize, bit_depth: u32) -> Vec<u16> {
     let kh = &SUBPEL_FILTERS[EIGHTTAP][fx];
     let kv = &SUBPEL_FILTERS[EIGHTTAP][fy];
@@ -323,6 +328,66 @@ pub(crate) fn subpel_plane(refp: &Plane, w: usize, h: usize, fx: usize, fy: usiz
     out
 }
 
+/// The three half-sample planes (8, 0), (0, 8), (8, 8) of `subpel_plane` in one pass: the
+/// horizontal half-sample pass is shared by (8, 0) and (8, 8), and the phase-0 kernels reduce to
+/// exact shifts (Round2( 128 * v, 11 ) = Round2( v, 4 ), Round2( 16 * s, 11 ) = Round2( s, 7 )),
+/// so the result equals three `subpel_plane` calls bit for bit.
+pub(crate) fn half_planes(refp: &Plane, w: usize, h: usize, bit_depth: u32) -> [Vec<u16>; 3] {
+    let k = &SUBPEL_FILTERS[EIGHTTAP][8];
+    let max = (1i32 << bit_depth) - 1;
+    let (lx, ly) = (w as i32 - 1, h as i32 - 1);
+    // horizontal pass at phase 8: Round2( sum, 3 )
+    let mut hp = vec![0i32; w * h];
+    for y in 0..h {
+        let row = &refp.row(y)[..w];
+        let out = &mut hp[y * w..y * w + w];
+        let tap = |x: i32| -> i32 {
+            let mut s = 0i32;
+            for t in 0..8 {
+                s += k[t] as i32 * row[(x + t as i32 - 3).clamp(0, lx) as usize] as i32;
+            }
+            round2(s, 3)
+        };
+        if w >= 8 {
+            for x in 0..3 {
+                out[x] = tap(x as i32);
+            }
+            for (x, o) in out.iter_mut().enumerate().take(w - 4).skip(3) {
+                let seg = &row[x - 3..x + 5];
+                let mut s = 0i32;
+                for t in 0..8 {
+                    s += k[t] as i32 * seg[t] as i32;
+                }
+                *o = round2(s, 3);
+            }
+            for x in w - 4..w {
+                out[x] = tap(x as i32);
+            }
+        } else {
+            for (x, o) in out.iter_mut().enumerate() {
+                *o = tap(x as i32);
+            }
+        }
+    }
+    let p80: Vec<u16> = hp.iter().map(|&v| round2(v, 4).clamp(0, max) as u16).collect();
+    let mut p08 = vec![0u16; w * h];
+    let mut p88 = vec![0u16; w * h];
+    for y in 0..h {
+        let rows: [usize; 8] = std::array::from_fn(|t| (y as i32 + t as i32 - 3).clamp(0, ly) as usize);
+        let (o08, o88) = (&mut p08[y * w..y * w + w], &mut p88[y * w..y * w + w]);
+        for x in 0..w {
+            let (mut a, mut b) = (0i32, 0i32);
+            for t in 0..8 {
+                a += k[t] as i32 * refp.data[rows[t] * refp.stride + x] as i32;
+                b += k[t] as i32 * hp[rows[t] * w + x];
+            }
+            o08[x] = round2(a, 7).clamp(0, max) as u16;
+            o88[x] = round2(b, 11).clamp(0, max) as u16;
+        }
+    }
+    [p80, p08, p88]
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -340,7 +405,11 @@ mod tests {
             for (bx, by) in [(0i32, 0i32), (8, 8), (24, 16), (-5, 20), (30, -3)] {
                 let mut pred = vec![0u16; 64];
                 let mv = [by * 8 + fy as i32 / 2, bx * 8 + fx as i32 / 2];
-                predict_inter(&p, w as i32 - 1, h as i32 - 1, 0, 0, 8, 8, mv, 0, 8, &mut pred);
+                predict_inter(
+                    &p,
+                    &InterBlock { last_x: w as i32 - 1, last_y: h as i32 - 1, x: 0, y: 0, width: 8, height: 8, mv, subsampling: 0, bit_depth: 8 },
+                    &mut pred,
+                );
                 for r in 0..8 {
                     for c in 0..8 {
                         let (x, y) = ((bx + c).clamp(0, w as i32 - 1), (by + r).clamp(0, h as i32 - 1));
@@ -353,6 +422,20 @@ mod tests {
         }
     }
 
+    #[test]
+    fn half_planes_match_subpel_plane() {
+        for (w, h) in [(37usize, 29usize), (5, 3), (1, 1), (64, 64)] {
+            let mut p = Plane::new(64, 64);
+            for (i, v) in p.data.iter_mut().enumerate() {
+                *v = ((i * 7919) % 1024) as u16;
+            }
+            let hp = half_planes(&p, w, h, 10);
+            for (i, (fx, fy)) in [(8, 0), (0, 8), (8, 8)].into_iter().enumerate() {
+                assert_eq!(hp[i], subpel_plane(&p, w, h, fx, fy, 10), "{w}x{h} phase ({fx}, {fy})");
+            }
+        }
+    }
+
     #[test]
     fn phase_zero_filters_are_impulses() {
         for f in SUBPEL_FILTERS.iter() {
diff --git a/crates/av1enc/src/transform.rs b/crates/av1enc/src/transform.rs
index 90042e26a..9d81ead0b 100644
--- a/crates/av1enc/src/transform.rs
+++ b/crates/av1enc/src/transform.rs
@@ -4,7 +4,7 @@
 
 use std::sync::OnceLock;
 
-use crate::tables::*;
+use crate::tables::{ADST_ADST, ADST_DCT, COS128_LOOKUP, DCT_ADST, DCT_DCT, TRANSFORM_ROW_SHIFT, TX_WIDTH_LOG2};
 
 #[inline(always)]
 fn round2_64(x: i64, n: u32) -> i32 {
@@ -32,6 +32,7 @@ fn sin128(angle: i32) -> i64 {
     cos128(angle - 64)
 }
 
+#[inline(always)]
 fn brev(num_bits: u32, x: usize) -> usize {
     let mut t = 0;
     for i in 0..num_bits {
@@ -63,14 +64,24 @@ fn hd(t: &mut [i32], a: usize, b: usize, flip: bool, r: u32) {
     t[b] = (x - y).clamp(lo, hi);
 }
 
-/// Inverse DCT of length 2^n, n = 2..=5 (7.13.2.3), in place.
-fn inverse_dct(t: &mut [i32], n: u32, r: u32) {
+/// Inverse DCT of length 2^N, N = 2..=5 (7.13.2.3), in place. `N` is a const generic so that the
+/// bit-reversal permutations and loop bounds fold at compile time.
+#[inline(always)]
+fn inverse_dct_n<const N: u32>(t: &mut [i32], r: u32) {
+    let n = N;
     let len = 1usize << n;
     let mut copy = [0i32; 32];
     copy[..len].copy_from_slice(&t[..len]);
     for i in 0..len {
         t[i] = copy[brev(n, i)];
     }
+    inverse_dct_initial_stages(t, n, r);
+    inverse_dct_final_stages(t, n, r);
+}
+
+/// Rotate the high-frequency branches before the four-point core.
+#[inline(always)]
+fn inverse_dct_initial_stages(t: &mut [i32], n: u32, r: u32) {
     if n >= 5 {
         for i in 0..8 {
             bf(t, 16 + i, 31 - i, 6 + ((brev(3, 7 - i) as i32) << 3), false);
@@ -103,6 +114,11 @@ fn inverse_dct(t: &mut [i32], n: u32, r: u32) {
             }
         }
     }
+}
+
+/// Evaluate the four-point core and merge progressively larger branches.
+#[inline(always)]
+fn inverse_dct_final_stages(t: &mut [i32], n: u32, r: u32) {
     for i in 0..2 {
         bf(t, 2 * i, 2 * i + 1, 32 + 16 * i as i32, i == 0);
     }
@@ -180,6 +196,7 @@ const SINPI_2_9: i64 = 2482;
 const SINPI_3_9: i64 = 3344;
 const SINPI_4_9: i64 = 3803;
 
+#[inline(always)]
 fn inverse_adst4(t: &mut [i32]) {
     let (t0, t1, t2, t3) = (t[0] as i64, t[1] as i64, t[2] as i64, t[3] as i64);
     let mut s = [SINPI_1_9 * t0, SINPI_2_9 * t0, SINPI_3_9 * t1, SINPI_4_9 * t2, SINPI_1_9 * t2, SINPI_2_9 * t3, SINPI_4_9 * t3];
@@ -197,7 +214,9 @@ fn inverse_adst4(t: &mut [i32]) {
     }
 }
 
-fn adst_in_permute(t: &mut [i32], n: u32) {
+#[inline(always)]
+fn adst_in_permute<const N: u32>(t: &mut [i32]) {
+    let n = N;
     let n0 = 1usize << n;
     let mut copy = [0i32; 16];
     copy[..n0].copy_from_slice(&t[..n0]);
@@ -207,7 +226,9 @@ fn adst_in_permute(t: &mut [i32], n: u32) {
     }
 }
 
-fn adst_out_permute(t: &mut [i32], n: u32) {
+#[inline(always)]
+fn adst_out_permute<const N: u32>(t: &mut [i32]) {
+    let n = N;
     let n0 = 1usize << n;
     let mut copy = [0i32; 16];
     copy[..n0].copy_from_slice(&t[..n0]);
@@ -221,8 +242,9 @@ fn adst_out_permute(t: &mut [i32], n: u32) {
     }
 }
 
+#[inline(always)]
 fn inverse_adst8(t: &mut [i32], r: u32) {
-    adst_in_permute(t, 3);
+    adst_in_permute::<3>(t);
     for i in 0..4 {
         bf(t, 2 * i, 2 * i + 1, 60 - 16 * i as i32, true);
     }
@@ -240,11 +262,12 @@ fn inverse_adst8(t: &mut [i32], r: u32) {
     for i in 0..2 {
         bf(t, 2 + 4 * i, 3 + 4 * i, 32, true);
     }
-    adst_out_permute(t, 3);
+    adst_out_permute::<3>(t);
 }
 
+#[inline(always)]
 fn inverse_adst16(t: &mut [i32], r: u32) {
-    adst_in_permute(t, 4);
+    adst_in_permute::<4>(t);
     for i in 0..8 {
         bf(t, 2 * i, 2 * i + 1, 62 - 8 * i as i32, true);
     }
@@ -273,7 +296,7 @@ fn inverse_adst16(t: &mut [i32], r: u32) {
     for i in 0..4 {
         bf(t, 2 + 4 * i, 3 + 4 * i, 32, true);
     }
-    adst_out_permute(t, 4);
+    adst_out_permute::<4>(t);
 }
 
 /// 1-D transform kind.
@@ -298,6 +321,17 @@ pub(crate) fn kinds(tx_type: usize) -> (Kind, Kind) {
     }
 }
 
+#[inline(always)]
+fn inverse_dct(t: &mut [i32], n: u32, r: u32) {
+    match n {
+        2 => inverse_dct_n::<2>(t, r),
+        3 => inverse_dct_n::<3>(t, r),
+        4 => inverse_dct_n::<4>(t, r),
+        _ => inverse_dct_n::<5>(t, r),
+    }
+}
+
+#[inline(always)]
 fn inverse_1d(t: &mut [i32], kind: Kind, n: u32, r: u32) {
     match kind {
         Kind::Dct => inverse_dct(t, n, r),
@@ -312,7 +346,17 @@ fn inverse_1d(t: &mut [i32], kind: Kind, n: u32, r: u32) {
 /// 2-D inverse transform (7.13.3) of a square `n x n` block (n = 4..=32) of dequantised
 /// coefficients (row stride `n`) into `residual` (row stride `n`).
 pub(crate) fn inverse_2d(dequant: &[i32], residual: &mut [i32], tx_sz: usize, tx_type: usize, bit_depth: u32) {
-    let log2 = TX_WIDTH_LOG2[tx_sz] as u32;
+    match TX_WIDTH_LOG2[tx_sz] {
+        2 => inverse_2d_n::<2>(dequant, residual, tx_sz, tx_type, bit_depth),
+        3 => inverse_2d_n::<3>(dequant, residual, tx_sz, tx_type, bit_depth),
+        4 => inverse_2d_n::<4>(dequant, residual, tx_sz, tx_type, bit_depth),
+        _ => inverse_2d_n::<5>(dequant, residual, tx_sz, tx_type, bit_depth),
+    }
+}
+
+/// `inverse_2d` for a block of width `1 << LOG2`.
+fn inverse_2d_n<const LOG2: u32>(dequant: &[i32], residual: &mut [i32], tx_sz: usize, tx_type: usize, bit_depth: u32) {
+    let log2 = LOG2;
     let n = 1usize << log2;
     let row_shift = TRANSFORM_ROW_SHIFT[tx_sz] as u32;
     let row_clamp = bit_depth + 8;
@@ -419,6 +463,51 @@ fn basis(kind: Kind, n: usize) -> &'static [f32] {
 /// Forward 2-D transform of the `n x n` residual (row stride `n`) into orthonormal-domain
 /// coefficients scaled by 8 (so that `level = out / q` with the spec's dequantiser).
 pub(crate) fn forward_2d(residual: &[i32], out: &mut [f32], n: usize, tx_type: usize) {
+    match n {
+        4 => forward_2d_n::<4, 16>(residual, out, tx_type),
+        8 => forward_2d_n::<8, 64>(residual, out, tx_type),
+        16 => forward_2d_n::<16, 256>(residual, out, tx_type),
+        _ => forward_2d_dyn(residual, out, n, tx_type),
+    }
+}
+
+/// `forward_2d` for a fixed size, so `tmp` is exactly `NN = N * N` floats (no 4 KiB zeroing).
+#[inline(always)]
+fn forward_2d_n<const N: usize, const NN: usize>(residual: &[i32], out: &mut [f32], tx_type: usize) {
+    let n = N;
+    let (ck, rk) = kinds(tx_type);
+    let bc = &basis(ck, n)[..NN];
+    let brt = &basis_t(rk, n)[..NN];
+    let residual = &residual[..NN];
+    let out = &mut out[..NN];
+    let mut tmp = [0f32; NN];
+    for i in 0..n {
+        let t = &mut tmp[i * n..i * n + n];
+        for j in 0..n {
+            let r = residual[i * n + j];
+            if r == 0 {
+                continue;
+            }
+            let r = r as f32;
+            for (o, &b) in t.iter_mut().zip(&brt[j * n..j * n + n]) {
+                *o += r * b;
+            }
+        }
+    }
+    out.iter_mut().for_each(|v| *v = 0.0);
+    for k in 0..n {
+        let o = &mut out[k * n..k * n + n];
+        for i in 0..n {
+            let b = 8.0 * bc[k * n + i];
+            for (v, &t) in o.iter_mut().zip(&tmp[i * n..i * n + n]) {
+                *v += b * t;
+            }
+        }
+    }
+}
+
+/// 32x32 (and any other size): a const-generic 32 version measured slower.
+fn forward_2d_dyn(residual: &[i32], out: &mut [f32], n: usize, tx_type: usize) {
     let (ck, rk) = kinds(tx_type);
     let bc = basis(ck, n);
     let brt = basis_t(rk, n);
@@ -454,6 +543,7 @@ pub(crate) fn forward_2d(residual: &[i32], out: &mut [f32], n: usize, tx_type: u
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::tables::{TX_4X4, TX_8X8, TX_16X16, TX_32X32};
 
     /// forward (float) then the normative inverse reproduces the residual: the forward basis
     /// and scale match the decoder's inverse transforms for every supported size and type.
diff --git a/crates/av1enc/src/writer.rs b/crates/av1enc/src/writer.rs
index 54c545fa4..a10bd2e9a 100644
--- a/crates/av1enc/src/writer.rs
+++ b/crates/av1enc/src/writer.rs
@@ -8,7 +8,15 @@ use crate::cdf::Cdfs;
 use crate::decide::{FrameGeom, Leaf, Node, intra_uv_tx_type, scan_for, tx_in_set, tx_set, tx_size_for};
 use crate::loopfilter::LfInfo;
 use crate::symbol::SymbolWriter;
-use crate::tables::*;
+use crate::tables::{
+    ADST_ADST, ADST_DCT, ALTREF_FRAME, ALTREF2_FRAME, BLOCK_8X8, BLOCK_64X64, BR_CDF_SIZE, BWDREF_FRAME, CLASS0_SIZE, COEFF_BASE_CTX_OFFSET, COEFF_BASE_RANGE,
+    D67_PRED, DC_PRED, DCT_ADST, DCT_DCT, DEFAULT_INTRA_FRAME_Y_MODE_CDF, GLOBALMV, GOLDEN_FRAME, INTRA_FRAME, INTRA_MODE_CONTEXT, LAST_FRAME, LAST2_FRAME,
+    LAST3_FRAME, MAG_REF_OFFSET_WITH_TX_CLASS, MAX_ANGLE_DELTA, MAX_REF_MV_STACK_SIZE, MI_HEIGHT_LOG2, MI_WIDTH_LOG2, MV_BORDER, MV_CLASS_0, NEARESTMV, NEARMV,
+    NEWMV, NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, NUM_BASE_LEVELS, PARTITION_HORZ, PARTITION_HORZ_4, PARTITION_HORZ_A, PARTITION_HORZ_B, PARTITION_NONE,
+    PARTITION_SPLIT, PARTITION_SUBSIZE, PARTITION_VERT, PARTITION_VERT_4, PARTITION_VERT_A, PARTITION_VERT_B, REF_CAT_LEVEL, SIG_REF_DIFF_OFFSET, SIZE_GROUP,
+    SUBSAMPLED_SIZE, TX_32X32, TX_CLASS_2D, TX_HEIGHT, TX_HEIGHT_LOG2, TX_SIZE_SQR, TX_SIZE_SQR_UP, TX_TYPE_INTER_INV_SET3, TX_TYPE_INTRA_INV_SET2, TX_WIDTH,
+    TX_WIDTH_LOG2, V_PRED,
+};
 
 type MvP = [i32; 2];
 
@@ -62,6 +70,8 @@ pub(crate) struct TileWriter<'a> {
     left_dc: [Vec<u8>; 3],
     /// LoopfilterTxSizes per plane (row stride mi_cols + 32).
     lf_tx: [Vec<u8>; 3],
+    /// Scratch for the levels coded so far in `coeffs`.
+    quant: Vec<i32>,
     // current block
     r: usize,
     c: usize,
@@ -114,6 +124,7 @@ impl<'a> TileWriter<'a> {
             left_level: std::array::from_fn(|_| vec![0; g.mi_rows + 64]),
             left_dc: std::array::from_fn(|_| vec![0; g.mi_rows + 64]),
             lf_tx: std::array::from_fn(|_| vec![0; (g.mi_cols + 32) * (g.mi_rows + 32)]),
+            quant: Vec::new(),
             r: 0,
             c: 0,
             bsize: 0,
@@ -181,10 +192,10 @@ impl<'a> TileWriter<'a> {
             self.sw.symbol(partition, cdf);
         } else if has_cols || has_rows {
             assert!(split, "blocks crossing the frame edge are split");
-            let pcdf: Vec<u16> = match bsl {
-                2 => self.cdf.partition_w16[ctx].to_vec(),
-                3 => self.cdf.partition_w32[ctx].to_vec(),
-                _ => self.cdf.partition_w64[ctx].to_vec(),
+            let pcdf: &[u16] = match bsl {
+                2 => &self.cdf.partition_w16[ctx],
+                3 => &self.cdf.partition_w32[ctx],
+                _ => &self.cdf.partition_w64[ctx],
             };
             let pr = |k: usize| pcdf[k] as i32 - if k == 0 { 0 } else { pcdf[k - 1] as i32 };
             let psum = if has_cols {
@@ -455,23 +466,7 @@ impl<'a> TileWriter<'a> {
             }
         } else {
             if plane == 0 {
-                // transform_type( )
-                let set = tx_set(tx_sz, b.is_inter);
-                let t = b.tx_type_y;
-                if set > 0 && self.qidx > 0 {
-                    let sqr = TX_SIZE_SQR[tx_sz] as usize;
-                    if b.is_inter {
-                        // The decision only picks types of this set (DCT_DCT otherwise).
-                        let s = TX_TYPE_INTER_INV_SET3.iter().position(|&v| v as usize == t).unwrap_or_default();
-                        self.sw.symbol(s, &mut self.cdf.inter_tx_type_set3[sqr]);
-                    } else {
-                        let s = TX_TYPE_INTRA_INV_SET2.iter().position(|&v| v as usize == t).unwrap_or_default();
-                        self.sw.symbol(s, &mut self.cdf.intra_tx_type_set2[sqr][b.y_mode]);
-                    }
-                } else {
-                    assert_eq!(t, DCT_DCT);
-                }
-                self.set_tx_types(x4, y4, tx_sz, t);
+                self.write_transform_type(x4, y4, tx_sz, b);
             }
             let plane_tx_type = self.compute_tx_type(plane, tx_sz, x4, y4, b);
             debug_assert!(plane_tx_type == DCT_DCT || matches!(plane_tx_type, ADST_DCT | DCT_ADST | ADST_ADST));
@@ -501,7 +496,9 @@ impl<'a> TileWriter<'a> {
             let height = TX_HEIGHT[tx_sz] as usize;
             let width = 1usize << bwl;
             // Quant[] as the decoder sees it while parsing: the levels coded so far (capped)
-            let mut quant = vec![0i32; width * height];
+            let mut quant = std::mem::take(&mut self.quant);
+            quant.clear();
+            quant.resize(width * height, 0);
             for c in (0..eob).rev() {
                 let pos = scan[c] as usize;
                 let a = levels[pos].unsigned_abs().min(15) as i32;
@@ -526,6 +523,7 @@ impl<'a> TileWriter<'a> {
                 }
                 quant[pos] = a;
             }
+            self.quant = quant;
             for c in 0..eob {
                 let pos = scan[c] as usize;
                 let v = levels[pos];
@@ -571,6 +569,26 @@ impl<'a> TileWriter<'a> {
         }
     }
 
+    fn write_transform_type(&mut self, x4: usize, y4: usize, tx_sz: usize, b: &Leaf) {
+        // transform_type( )
+        let set = tx_set(tx_sz, b.is_inter);
+        let t = b.tx_type_y;
+        if set > 0 && self.qidx > 0 {
+            let sqr = TX_SIZE_SQR[tx_sz] as usize;
+            if b.is_inter {
+                // The decision only picks types of this set (DCT_DCT otherwise).
+                let s = TX_TYPE_INTER_INV_SET3.iter().position(|&v| v as usize == t).unwrap_or_default();
+                self.sw.symbol(s, &mut self.cdf.inter_tx_type_set3[sqr]);
+            } else {
+                let s = TX_TYPE_INTRA_INV_SET2.iter().position(|&v| v as usize == t).unwrap_or_default();
+                self.sw.symbol(s, &mut self.cdf.intra_tx_type_set2[sqr][b.y_mode]);
+            }
+        } else {
+            assert_eq!(t, DCT_DCT);
+        }
+        self.set_tx_types(x4, y4, tx_sz, t);
+    }
+
     fn set_tx_types(&mut self, x4: usize, y4: usize, tx_sz: usize, t: usize) {
         for i in 0..(TX_WIDTH[tx_sz] as usize >> 2) {
             for j in 0..(TX_HEIGHT[tx_sz] as usize >> 2) {
diff --git a/crates/av1enc/tests/bench.rs b/crates/av1enc/tests/it/bench.rs
similarity index 97%
rename from crates/av1enc/tests/bench.rs
rename to crates/av1enc/tests/it/bench.rs
index 6577f8f9f..b29817e1a 100644
--- a/crates/av1enc/tests/bench.rs
+++ b/crates/av1enc/tests/it/bench.rs
@@ -1,7 +1,7 @@
 //! Speed / efficiency measurements on ffmpeg-generated test sources (ignored by default):
-//! `cargo test -p effectcraft-av1enc --test bench -- --ignored --nocapture`.
+//! `cargo test -p effectcraft-av1enc --test it bench:: -- --ignored --nocapture`.
 
-mod common;
+use crate::common;
 
 use std::process::Command;
 use std::time::Instant;
diff --git a/crates/av1enc/tests/common/mod.rs b/crates/av1enc/tests/it/common/mod.rs
similarity index 100%
rename from crates/av1enc/tests/common/mod.rs
rename to crates/av1enc/tests/it/common/mod.rs
diff --git a/crates/av1enc/tests/ffmpeg_oracle.rs b/crates/av1enc/tests/it/ffmpeg_oracle.rs
similarity index 99%
rename from crates/av1enc/tests/ffmpeg_oracle.rs
rename to crates/av1enc/tests/it/ffmpeg_oracle.rs
index 66f380ac2..b35cbf496 100644
--- a/crates/av1enc/tests/ffmpeg_oracle.rs
+++ b/crates/av1enc/tests/it/ffmpeg_oracle.rs
@@ -2,7 +2,7 @@
 //! bit for bit. Skipped when `ffmpeg` (with libdav1d) is not installed. ffmpeg's native `av1`
 //! decoder only drives hardware decoders, so it is not used.
 
-mod common;
+use crate::common;
 
 use std::process::Command;
 
diff --git a/crates/av1enc/tests/it/main.rs b/crates/av1enc/tests/it/main.rs
new file mode 100644
index 000000000..c66bacde5
--- /dev/null
+++ b/crates/av1enc/tests/it/main.rs
@@ -0,0 +1,6 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod bench;
+mod common;
+mod ffmpeg_oracle;
+mod roundtrip;
diff --git a/crates/av1enc/tests/roundtrip.rs b/crates/av1enc/tests/it/roundtrip.rs
similarity index 77%
rename from crates/av1enc/tests/roundtrip.rs
rename to crates/av1enc/tests/it/roundtrip.rs
index 1e777e509..edc98c370 100644
--- a/crates/av1enc/tests/roundtrip.rs
+++ b/crates/av1enc/tests/it/roundtrip.rs
@@ -1,7 +1,7 @@
 //! Round trips through FilmCraft's spec-derived AV1 decoder: decoded frames must equal the
 //! encoder's own reconstruction bit for bit.
 
-mod common;
+use crate::common;
 
 use common::*;
 use effectcraft_av1enc::{EncoderConfig, RateControl};
@@ -80,6 +80,23 @@ fn bitrate_mode_tracks_target() {
     assert!(kbps > 400.0 / 2.0 && kbps < 400.0 * 2.0, "{kbps} kbit/s");
 }
 
+/// Over several key frame intervals the average rate stays within 5 % of the target, for a
+/// range of targets (the key frame budget is taken out of the inter frames of its group).
+#[test]
+fn bitrate_mode_is_accurate_over_many_groups() {
+    let n = 180;
+    for (kbps, keyint, bd) in [(40, 30, 8), (100, 30, 8), (200, 60, 8), (150, 20, 10)] {
+        let pics: Vec<Pic> = (0..n).map(|t| synth(192, 128, bd, t)).collect();
+        let mut c = cfg(192, 128, bd as u8, 0, keyint);
+        c.rate = RateControl::Bitrate { kbps };
+        let mut enc = effectcraft_av1enc::Encoder::new(c).unwrap();
+        let bits: usize = pics.iter().map(|p| enc.encode(&p.frame()).data.len() * 8).sum();
+        let got = bits as f64 / (n as f64 / 30.0) / 1000.0;
+        eprintln!("{bd} bit, keyint {keyint}: {got:.1} kbit/s for {kbps}");
+        assert!((got / kbps as f64 - 1.0).abs() < 0.05, "{got:.1} kbit/s for a {kbps} kbit/s target ({bd} bit, keyint {keyint})");
+    }
+}
+
 #[test]
 fn headers() {
     let enc = effectcraft_av1enc::Encoder::new(cfg(1920, 1080, 10, 100, 60)).unwrap();
diff --git a/crates/color/src/lib.rs b/crates/color/src/lib.rs
index 1fae0ea90..71eb43296 100644
--- a/crates/color/src/lib.rs
+++ b/crates/color/src/lib.rs
@@ -39,7 +39,13 @@ impl Rgba {
     /// `#rrggbb` or `#rrggbbaa`.
     pub fn from_hex(s: &str) -> Option<Rgba> {
         let s = s.trim().trim_start_matches('#');
-        let p = |i: usize| u8::from_str_radix(s.get(i..i + 2)?, 16).ok();
+        let p = |i: usize| {
+            let pair = s.get(i..i + 2)?;
+            if !pair.bytes().all(|b| b.is_ascii_hexdigit()) {
+                return None;
+            }
+            u8::from_str_radix(pair, 16).ok()
+        };
         match s.len() {
             6 => Some(Rgba::from_u8(p(0)?, p(2)?, p(4)?)),
             8 => Some(Rgba { a: p(6)? as f32 / 255.0, ..Rgba::from_u8(p(0)?, p(2)?, p(4)?) }),
@@ -91,9 +97,11 @@ pub fn rgb_to_hsl(r: f32, g: f32, b: f32) -> (f32, f32, f32) {
         return (0.0, 0.0, l);
     }
     let d = max - min;
-    let s = if l > 0.5 { d / (2.0 - max - min) } else { d / (max + min) };
+    let denom = if l > 0.5 { 2.0 - max - min } else { max + min };
+    // Over-range (HDR) or negative inputs can make the denominator zero or negative.
+    let s = if denom > 0.0 { d / denom } else { 1.0 };
     let h = if max == r {
-        ((g - b) / d + if g < b { 6.0 } else { 0.0 }) / 6.0
+        (((g - b) / d + if g < b { 6.0 } else { 0.0 }) / 6.0).rem_euclid(1.0)
     } else if max == g {
         ((b - r) / d + 2.0) / 6.0
     } else {
@@ -130,7 +138,7 @@ pub fn rgb_to_hsv(r: f32, g: f32, b: f32) -> (f32, f32, f32) {
     let h = if d < 1e-7 {
         0.0
     } else if max == r {
-        ((g - b) / d).rem_euclid(6.0) / 6.0
+        (((g - b) / d).rem_euclid(6.0) / 6.0).rem_euclid(1.0)
     } else if max == g {
         ((b - r) / d + 2.0) / 6.0
     } else {
@@ -141,7 +149,11 @@ pub fn rgb_to_hsv(r: f32, g: f32, b: f32) -> (f32, f32, f32) {
 }
 
 pub fn hsv_to_rgb(h: f32, s: f32, v: f32) -> (f32, f32, f32) {
-    let h6 = h.rem_euclid(1.0) * 6.0;
+    let mut h6 = h.rem_euclid(1.0) * 6.0;
+    // In f32, a tiny negative hue wraps to exactly 1.0; treat it as 0.
+    if h6 >= 6.0 {
+        h6 = 0.0;
+    }
     let i = h6.floor();
     let f = h6 - i;
     let p = v * (1.0 - s);
@@ -252,6 +264,42 @@ impl Label {
 mod tests {
     use super::*;
 
+    #[test]
+    fn hsl_round_trip_is_finite_for_out_of_range_colours() {
+        for (r, g, b) in [(1.5, 0.5, 0.5), (2.0, 0.1, 0.3), (-0.5, 0.2, 0.9)] {
+            let (h, s, l) = rgb_to_hsl(r, g, b);
+            assert!(h.is_finite() && s.is_finite() && l.is_finite(), "{h} {s} {l}");
+            let (r2, g2, b2) = hsl_to_rgb(h, s, l);
+            assert!(r2.is_finite() && g2.is_finite() && b2.is_finite(), "{r2} {g2} {b2}");
+        }
+        // A 32 bpc colour whose denominator stays positive still round-trips exactly.
+        let (h, s, l) = rgb_to_hsl(1.2, 0.5, 0.5);
+        let (r, g, b) = hsl_to_rgb(h, s, l);
+        assert!((r - 1.2).abs() < 1e-5 && (g - 0.5).abs() < 1e-5 && (b - 0.5).abs() < 1e-5, "{r} {g} {b}");
+    }
+
+    #[test]
+    fn hsv_to_rgb_tiny_negative_hue_is_red() {
+        let (r, g, b) = hsv_to_rgb(-1e-9, 1.0, 1.0);
+        assert!(r > 0.99 && g < 0.01 && b < 0.01, "{r} {g} {b}");
+    }
+
+    #[test]
+    fn hue_stays_below_one_for_tiny_blue() {
+        let (h, _, _) = rgb_to_hsv(1.0, 0.0, 1e-9);
+        assert!((0.0..1.0).contains(&h), "rgb_to_hsv hue {h} not in 0..1");
+        let (h, _, _) = rgb_to_hsl(1.0, 0.0, 1e-9);
+        assert!((0.0..1.0).contains(&h), "rgb_to_hsl hue {h} not in 0..1");
+    }
+
+    #[test]
+    fn rejects_signed_hex_pairs() {
+        assert!(Rgba::from_hex("#+1+2+3").is_none());
+        assert!(Rgba::from_hex("#1+2+3+").is_none());
+        assert!(Rgba::from_hex("#ff00+0ff").is_none());
+        assert!(Rgba::from_hex("#a1B2c3").is_some());
+    }
+
     #[test]
     fn srgb_roundtrip() {
         for i in 0..=100 {
diff --git a/crates/color/src/space.rs b/crates/color/src/space.rs
index ee7590eca..324627934 100644
--- a/crates/color/src/space.rs
+++ b/crates/color/src/space.rs
@@ -177,7 +177,7 @@ impl ColorSpace {
 
     /// Parse an id or label (case-insensitive, loose).
     pub fn parse(s: &str) -> Option<ColorSpace> {
-        let k: String = s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase();
+        let k: String = s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase();
         match k.as_str() {
             "srgb" | "srgbiec6196621" | "srgbiec61966" | "iec6196621" => Some(ColorSpace::Srgb),
             "rec709" | "bt709" | "hdtvrec709" | "hdtv" | "709" => Some(ColorSpace::Rec709),
@@ -210,6 +210,14 @@ impl ColorSpace {
         }
     }
 
+    /// The primaries and white as the OpenEXR `chromaticities` attribute stores them: red, green,
+    /// blue, white (CIE xy). Every space has a defined mapping: the PQ and HLG spaces are BT.2020
+    /// primaries with D65, the ACES spaces carry the ACES white.
+    pub fn exr_chromaticities(self) -> [[f32; 2]; 4] {
+        let [r, g, b] = self.primaries();
+        [r, g, b, self.white()].map(|c| c.map(|v| v as f32))
+    }
+
     /// The transfer curve.
     pub fn curve(self) -> Curve {
         match self {
diff --git a/crates/effects/Cargo.toml b/crates/effects/Cargo.toml
index c37d09949..bb26d3127 100644
--- a/crates/effects/Cargo.toml
+++ b/crates/effects/Cargo.toml
@@ -21,4 +21,5 @@ rayon = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 
diff --git a/crates/effects/src/analysis_cache.rs b/crates/effects/src/analysis_cache.rs
new file mode 100644
index 000000000..98764d205
--- /dev/null
+++ b/crates/effects/src/analysis_cache.rs
@@ -0,0 +1,97 @@
+//! Bounded parsed-JSON caches. Keep the content key with the owned source text so repeated
+//! renders do not rehash long analyses. Compare contents on lookup: evaluated parameter
+//! strings can be cloned, edited in place, or allocated again at an old address.
+
+use std::sync::{Arc, Mutex, OnceLock};
+
+struct Entry<T> {
+    json: Box<str>,
+    key: u64,
+    value: Arc<T>,
+}
+
+pub(crate) struct AnalysisCache<T> {
+    entries: OnceLock<Mutex<Vec<Entry<T>>>>,
+}
+
+pub(crate) fn fnv(bytes: &[u8]) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for b in bytes {
+        h ^= *b as u64;
+        h = h.wrapping_mul(0x0100_0000_01b3);
+    }
+    h
+}
+
+impl<T> AnalysisCache<T> {
+    pub(crate) const fn new() -> Self {
+        Self { entries: OnceLock::new() }
+    }
+
+    pub(crate) fn get(&self, json: &str, parse: impl FnOnce(&str) -> Option<T>) -> Option<(u64, Arc<T>)> {
+        let entries = self.entries.get_or_init(Default::default);
+        {
+            let m = entries.lock().unwrap_or_else(|e| e.into_inner());
+            if let Some(e) = m.iter().rev().find(|e| e.json.as_ref() == json) {
+                return Some((e.key, e.value.clone()));
+            }
+        }
+        let value = Arc::new(parse(json)?);
+        let key = fnv(json.as_bytes());
+        let mut m = entries.lock().unwrap_or_else(|e| e.into_inner());
+        // Another render may have filled the entry while this one parsed it.
+        if let Some(e) = m.iter().rev().find(|e| e.json.as_ref() == json) {
+            return Some((e.key, e.value.clone()));
+        }
+        // Preserve the existing nine-entry bound and clear-on-overflow policy.
+        if m.len() > 8 {
+            m.clear();
+        }
+        m.push(Entry { json: json.into(), key, value: value.clone() });
+        Some((key, value))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cell::Cell;
+
+    #[test]
+    fn reuses_content_and_invalidates_same_allocation_edits() {
+        let cache = AnalysisCache::new();
+        let calls = Cell::new(0);
+        let parse = |s: &str| {
+            calls.set(calls.get() + 1);
+            Some(s.to_owned())
+        };
+        let mut json = String::from("analysis-1");
+        let (key, a) = cache.get(&json, parse).unwrap();
+        let copy = json.clone();
+        assert_ne!(json.as_ptr(), copy.as_ptr());
+        let (same_key, same) = cache.get(&copy, parse).unwrap();
+        assert_eq!(key, fnv(json.as_bytes()));
+        assert_eq!(key, same_key);
+        assert!(Arc::ptr_eq(&a, &same));
+        assert_eq!(calls.get(), 1);
+        let ptr = json.as_ptr();
+        json.replace_range(9..10, "2");
+        assert_eq!(ptr, json.as_ptr());
+        let (changed_key, changed) = cache.get(&json, parse).unwrap();
+        assert_ne!(key, changed_key);
+        assert_eq!(&*changed, "analysis-2");
+        assert_eq!(&*a, "analysis-1");
+        assert_eq!(calls.get(), 2);
+        assert!(cache.get("invalid", |_| None).is_none());
+        assert!(Arc::ptr_eq(&cache.get(&json, parse).unwrap().1, &changed));
+    }
+
+    #[test]
+    fn source_text_retention_is_bounded() {
+        let cache = AnalysisCache::new();
+        for i in 0..30 {
+            cache.get(&i.to_string(), |s| Some(s.to_owned())).unwrap();
+            assert!(cache.entries.get().unwrap().lock().unwrap().len() <= 9);
+        }
+    }
+}
diff --git a/crates/effects/src/audio_fx.rs b/crates/effects/src/audio_fx.rs
index cd9153d66..c4cb50de2 100644
--- a/crates/effects/src/audio_fx.rs
+++ b/crates/effects/src/audio_fx.rs
@@ -193,7 +193,7 @@ pub fn specs() -> Vec<EffectSpec> {
 
 /// Is `id` an audio effect (applied by the mixdown rather than the compositor)?
 pub fn is_audio_effect(id: &str) -> bool {
-    id.starts_with("ec.audio.")
+    effectcraft_project::is_audio_effect(id)
 }
 
 /// Does the effect produce sound on its own (so a layer without audio becomes audible)?
@@ -206,6 +206,12 @@ pub fn reverses(id: &str) -> bool {
     id == "ec.audio.backwards"
 }
 
+/// Does each output sample depend only on the input sample at the same time (no state), so the
+/// mixer may run the effect in short pieces with parameters animated between them?
+pub fn per_sample(id: &str) -> bool {
+    matches!(id, "ec.audio.stereomixer" | "ec.audio.backwards")
+}
+
 /// Seconds of input history the effect needs before a block to reach the state it would have
 /// had when processing continuously.
 pub fn preroll(id: &str, params: &Params) -> f64 {
diff --git a/crates/effects/src/blur2.rs b/crates/effects/src/blur2.rs
index e4f2b0348..880ad16c5 100644
--- a/crates/effects/src/blur2.rs
+++ b/crates/effects/src/blur2.rs
@@ -1,6 +1,6 @@
 //! Blur & Sharpen, batch 2: edge-preserving blurs (Bilateral, Smart), per-channel and map-driven
 //! blurs (Channel, Compound, CC Vector), bokeh (Camera Lens Blur), radial streaks and small
-//! utilities (Reduce Interlace Flicker, CC Cross Blur).
+//! utilities (Reduce Interlace Flicker, Cross Blur).
 
 use effectcraft_color::luminance;
 use effectcraft_keyframe::Value;
@@ -507,13 +507,26 @@ fn camera_lens_blur(ctx: &EffectCtx, mut b: Buf) -> Buf {
 }
 
 // ---------------------------------------------------------------------------------------------
-// CC Radial Fast Blur
+// Fast Radial Blur
+
+/// Transparent pixels Fast Radial Blur adds on every side of a `w` × `h` buffer with Center
+/// at `c` (buffer pixels) and smear `s`: content `r` from Center streaks out to `r / (1 − s)`,
+/// so the farthest corner reaches `d · s / (1 − s)` past itself (at most 4096, as the other
+/// growing effects). Shared with the GPU path so both grow the same way.
+pub fn radial_fast_pad(c: (f64, f64), w: u32, h: u32, s: f64) -> u32 {
+    let (w, h) = (f64::from(w), f64::from(h));
+    let far = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h)].iter().map(|&(x, y)| (x - c.0).hypot(y - c.1)).fold(0.0, f64::max);
+    ((far * s / (1.0 - s)).ceil() + 1.0).min(4096.0) as u32
+}
 
 fn radial_fast_blur(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let s = (ctx.params.f("amount") / 100.0).clamp(0.0, 1.0) * 0.5;
     if s <= 0.0 {
         return b;
     }
+    if !ctx.adjustment {
+        b.pad(radial_fast_pad(b.to_px(ctx.params.v2("center")), b.img.width, b.img.height, s));
+    }
     let c = b.to_px(ctx.params.v2("center"));
     let mode = ctx.params.e("zoom");
     let src = b.img.clone();
@@ -549,7 +562,7 @@ fn radial_fast_blur(ctx: &EffectCtx, mut b: Buf) -> Buf {
 }
 
 // ---------------------------------------------------------------------------------------------
-// CC Vector Blur
+// Vector Blur
 
 fn vector_blur(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let amount = ctx.params.f("amount").max(0.0) * b.scale;
@@ -603,7 +616,7 @@ fn vector_blur(ctx: &EffectCtx, mut b: Buf) -> Buf {
 }
 
 // ---------------------------------------------------------------------------------------------
-// Reduce Interlace Flicker / CC Cross Blur
+// Reduce Interlace Flicker / Cross Blur
 
 fn reduce_flicker(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let s = ctx.params.f("softness").max(0.0) * b.scale;
@@ -722,7 +735,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.blur.ccradialfast",
-            "CC Radial Fast Blur",
+            "Fast Radial Blur",
             vec![
                 p("center", "Center", Value::Vec2([0.5, 0.5]), ParamUi::Point),
                 p("amount", "Amount", num(50.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
@@ -732,7 +745,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.blur.ccvector",
-            "CC Vector Blur",
+            "Vector Blur",
             vec![
                 p("type", "Type", Value::Enum(0), popup(&["Natural", "Constant Length", "Perpendicular", "Direction Center", "Direction Fading"])),
                 p("amount", "Amount", num(10.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
@@ -752,7 +765,7 @@ pub fn specs() -> Vec<EffectSpec> {
         },
         spec(
             "ec.blur.cccross",
-            "CC Cross Blur",
+            "Cross Blur",
             vec![
                 p("radiusX", "Radius X", num(10.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
                 p("radiusY", "Radius Y", num(10.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
@@ -906,6 +919,23 @@ mod tests {
         assert_eq!(circle.len(), 21);
     }
 
+    #[test]
+    fn radial_fast_blur_streaks_past_the_layer_edge() {
+        // Center left of an opaque square: the streaks run right, beyond the layer rectangle (#2095).
+        let img = Image::filled(20, 20, [1.0, 1.0, 1.0, 1.0]);
+        let out = run("ec.blur.ccradialfast", &img, &[("center", Value::Vec2([-20.0, 10.0])), ("amount", num(80.0))]);
+        assert!(out.img.width > 20 && out.img.height > 20, "{}x{}", out.img.width, out.img.height);
+        let (o, d) = (out.offset[0] as i64, out.offset[1] as i64);
+        assert!(out.img.get(30 + o, 10 + d)[3] > 0.1, "{:?}", out.img.get(30 + o, 10 + d));
+        // Its streak samples only the square: still opaque, so the content keeps its place.
+        assert!((out.img.get(19 + o, 10 + d)[3] - 1.0).abs() < 1e-5, "{:?}", out.img.get(19 + o, 10 + d));
+        // An adjustment layer is comp-sized already; its buffer is not grown.
+        let s = find("ec.blur.ccradialfast").unwrap();
+        let params = Params { values: [("center".into(), Value::Vec2([-20.0, 10.0])), ("amount".into(), num(80.0))].into_iter().collect() };
+        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [20.0, 20.0], seed: 1, adjustment: true, env: Default::default() };
+        assert_eq!((s.render)(&ctx, Buf { img, offset: [0.0, 0.0], scale: 1.0 }).img.width, 20);
+    }
+
     #[test]
     fn reduce_flicker_blurs_vertically_only() {
         let mut img = Image::filled(8, 8, [0.0, 0.0, 0.0, 1.0]);
diff --git a/crates/effects/src/blur3.rs b/crates/effects/src/blur3.rs
index aee2a2713..6369a8ced 100644
--- a/crates/effects/src/blur3.rs
+++ b/crates/effects/src/blur3.rs
@@ -1,6 +1,6 @@
-//! Blur & Sharpen: CC Radial Blur and Camera-Shake Deblur.
+//! Blur & Sharpen: Variable Radial Blur and Camera-Shake Deblur.
 //!
-//! * **CC Radial Blur** — zoom (straight, fading, centred both ways) and rotational (plain or
+//! * **Variable Radial Blur** — zoom (straight, fading, centred both ways) and rotational (plain or
 //!   fading) blurs around a centre point, sampled along the ray / arc through each pixel with a
 //!   sample count set by Quality.
 //! * **Camera-Shake Deblur** — frame-based restoration in the spirit of published video deblurring
@@ -22,7 +22,7 @@ fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, ren
     EffectSpec { id, name, category: "Blur & Sharpen", params, render, gpu: false, float: true }
 }
 
-// ---------------------------------------------------------------- CC Radial Blur
+// ---------------------------------------------------------------- Variable Radial Blur
 
 pub const RADIAL_TYPES: [&str; 5] = ["Straight Zoom", "Fading Zoom", "Centered", "Rotate", "Rotate Fading"];
 
@@ -246,7 +246,7 @@ pub fn specs() -> Vec<EffectSpec> {
     vec![
         spec(
             "ec.blur.ccradial",
-            "CC Radial Blur",
+            "Variable Radial Blur",
             vec![
                 p("type", "Type", Value::Enum(1), popup(&RADIAL_TYPES)),
                 p("amount", "Amount", num(10.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
diff --git a/crates/effects/src/camera_tracker.rs b/crates/effects/src/camera_tracker.rs
index ff4e51fe4..c58df3593 100644
--- a/crates/effects/src/camera_tracker.rs
+++ b/crates/effects/src/camera_tracker.rs
@@ -16,8 +16,9 @@
 //! on it draws the solved points (as the viewer shows them) into the frame. The viewer overlay, target and the Create
 //! commands live in the engine and the UI.
 
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex, OnceLock};
+use std::sync::Arc;
+
+use crate::analysis_cache::AnalysisCache;
 
 use effectcraft_keyframe::Value;
 use effectcraft_project::ParamUi;
@@ -122,50 +123,24 @@ pub fn solve_key(st: &SolveSettings) -> String {
     format!("{:?}|{hfov}|{:?}|{:?}{lens}", st.shot, st.method, st.deleted)
 }
 
-fn fnv(bytes: &[u8]) -> u64 {
-    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
-    for b in bytes {
-        h ^= *b as u64;
-        h = h.wrapping_mul(0x0100_0000_01b3);
-    }
-    h
-}
-
-type Cache<T> = Mutex<HashMap<u64, Arc<T>>>;
-
-fn cached<T>(c: &'static OnceLock<Cache<T>>, json: &str, parse: impl Fn(&str) -> Option<T>) -> Option<Arc<T>> {
-    let key = fnv(json.as_bytes());
-    let c = c.get_or_init(Default::default);
-    if let Some(a) = c.lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
-        return Some(a.clone());
-    }
-    let a = Arc::new(parse(json)?);
-    let mut m = c.lock().unwrap_or_else(|e| e.into_inner());
-    if m.len() > 8 {
-        m.clear();
-    }
-    m.insert(key, a.clone());
-    Some(a)
-}
-
 /// The stored feature tracks of an instance (`None` when not analysed).
 pub fn tracks(params: &Params) -> Option<Arc<CameraTracks>> {
-    static C: OnceLock<Cache<CameraTracks>> = OnceLock::new();
+    static C: AnalysisCache<CameraTracks> = AnalysisCache::new();
     let j = s(params, TRACKS);
     if j.is_empty() {
         return None;
     }
-    cached(&C, j, CameraTracks::from_json).filter(|t| !t.is_empty())
+    C.get(j, CameraTracks::from_json).map(|(_, a)| a).filter(|t| !t.is_empty())
 }
 
 /// The stored camera solve of an instance (`None` when not solved).
 pub fn solve(params: &Params) -> Option<Arc<CameraSolve>> {
-    static C: OnceLock<Cache<CameraSolve>> = OnceLock::new();
+    static C: AnalysisCache<CameraSolve> = AnalysisCache::new();
     let j = s(params, SOLVE);
     if j.is_empty() {
         return None;
     }
-    cached(&C, j, CameraSolve::from_json).filter(|t| !t.is_empty())
+    C.get(j, CameraSolve::from_json).map(|(_, a)| a).filter(|t| !t.is_empty())
 }
 
 /// Screen size (layer pixels) of a target drawn for a point at depth `z`, relative to the
@@ -338,6 +313,27 @@ mod tests {
         assert!(!st.lens_distortion && !solve_key(&st).contains("lens"));
     }
 
+    #[test]
+    fn tracks_and_solve_follow_analysis_replacements() {
+        let mut t = CameraTracks { frames: 3, start: 1.0, ..Default::default() };
+        let mut sol = CameraSolve { frames: vec![SolvedFrame::default()], start: 1.0, ..Default::default() };
+        let mut ps = params_with(&sol, false);
+        ps.values.insert(TRACKS.into(), Value::Str(t.to_json()));
+        assert_eq!(*tracks(&ps).unwrap(), t);
+        assert_eq!(*solve(&ps).unwrap(), sol);
+        t.start = 2.0;
+        sol.start = 2.0;
+        ps.values.insert(TRACKS.into(), Value::Str(t.to_json()));
+        ps.values.insert(SOLVE.into(), Value::Str(sol.to_json()));
+        assert_eq!(*tracks(&ps).unwrap(), t);
+        assert_eq!(*solve(&ps).unwrap(), sol);
+        assert_eq!(*tracks(&ps.clone()).unwrap(), t);
+        ps.values.insert(TRACKS.into(), Value::Str("invalid".into()));
+        ps.values.insert(SOLVE.into(), Value::Str(String::new()));
+        assert!(tracks(&ps).is_none());
+        assert!(solve(&ps).is_none());
+    }
+
     #[test]
     fn undistort_footage_remaps_through_the_solved_lens() {
         use effectcraft_track::camtrack::Distortion;
diff --git a/crates/effects/src/catalog.rs b/crates/effects/src/catalog.rs
index 0be2b04f5..7fcb024bf 100644
--- a/crates/effects/src/catalog.rs
+++ b/crates/effects/src/catalog.rs
@@ -92,8 +92,8 @@ const CPU_ONLY_CONTROLS: &[(&str, &[&str])] = &[
 ];
 
 /// Whether the GPU kernel of effect `id` covers the instance's current settings (see
-/// [`CPU_ONLY_CONTROLS`]; plus Cell Pattern's HQ variants and Turbulent Displace's locked
-/// pinning).
+/// `CPU_ONLY_CONTROLS`; plus Cell Pattern's HQ variants, Turbulent Displace's locked
+/// pinning and CC Particle World's motion trails and textured squares).
 pub fn gpu_supported(id: &str, ctx: &crate::EffectCtx) -> bool {
     match id {
         "ec.generate.cellpattern" if (6..=10).contains(&ctx.params.e("cellPattern")) => return false,
@@ -101,6 +101,8 @@ pub fn gpu_supported(id: &str, ctx: &crate::EffectCtx) -> bool {
         // #1195: CC Particle World's motion trails (the averaged shutter samples) render on the
         // CPU kernel until the GPU particle pass supports them.
         "ec.sim.ccparticleworld" if ctx.env.shutter.filter(|(a, _, _)| *a > 0.0).is_some() => return false,
+        // #1465: Textured Square's Texture Layer is drawn on the CPU only.
+        "ec.sim.ccparticleworld" if crate::sim::particle_world_textured(ctx) => return false,
         _ => {}
     }
     let Some((_, controls)) = CPU_ONLY_CONTROLS.iter().find(|(e, _)| *e == id) else { return true };
@@ -126,7 +128,8 @@ pub fn effects_markdown() -> String {
     s.push_str("# Effects\n\n");
     s.push_str("<!-- Generated from the effect registry (crates/effects/src/catalog.rs); do not edit by hand.\n");
     s.push_str("     Regenerate: UPDATE_DOCS=1 cargo test -p effectcraft-effects --lib effects_doc_is_current -->\n\n");
-    let params: usize = r.iter().map(|e| e.params.len()).sum();
+    // The parameters the table's rows list: the shown ones, not the hidden bookkeeping ones.
+    let params: usize = r.iter().map(|e| e.params.iter().filter(|p| !matches!(p.ui, effectcraft_project::ParamUi::Hidden)).count()).sum();
     let gpu = r.iter().filter(|e| e.gpu).count();
     let float = r.iter().filter(|e| e.float).count();
     let partial = r.iter().filter(|e| PARTIAL.iter().any(|(id, _)| *id == e.id)).count();
@@ -182,6 +185,20 @@ mod tests {
         assert!(have == want, "docs/effects.md is stale: UPDATE_DOCS=1 cargo test -p effectcraft-effects --lib effects_doc_is_current");
     }
 
+    /// The README quotes the number of effects (#2565): every count it gives is the registry's.
+    #[test]
+    fn readme_effect_counts_are_current() {
+        let readme = std::fs::read_to_string(concat!(env!("CARGO_MANIFEST_DIR"), "/../../README.md")).unwrap_or_default();
+        let words: Vec<&str> = readme.split_whitespace().collect();
+        let counts: Vec<&str> = words
+            .windows(3)
+            .filter(|w| w[0].parse::<u32>().is_ok() && (w[1].starts_with("effects") || (w[1] == "built-in" && w[2].starts_with("effects"))))
+            .map(|w| w[0])
+            .collect();
+        let n = super::registry().len().to_string();
+        assert!(!counts.is_empty() && counts.iter().all(|c| *c == n), "README.md says {counts:?} effects; the registry has {n}");
+    }
+
     #[test]
     fn cpu_only_controls_keep_effects_off_the_gpu() {
         use effectcraft_keyframe::Value;
@@ -210,6 +227,10 @@ mod tests {
             assert!(!super::gpu_supported("ec.sim.ccparticleworld", &ctx));
         }
         assert!(ok("ec.sim.ccparticleworld", &[]));
+        // #1465: the Texture Layer keeps CC Particle World on the CPU only when Textured Square draws it.
+        let tex = ("particle/texture/textureLayer", Value::Layer(Some(1)));
+        assert!(ok("ec.sim.ccparticleworld", &[tex.clone(), ("particle/particleType", Value::Enum(2))]));
+        assert!(!ok("ec.sim.ccparticleworld", &[tex, ("particle/particleType", Value::Enum(8))]));
         assert!(ok("ec.generate.cellpattern", &[("cellPattern", Value::Enum(3))]));
         assert!(!ok("ec.generate.cellpattern", &[("cellPattern", Value::Enum(9))]));
         assert!(!ok("ec.distort.turbulentdisplace", &[("pinning", Value::Enum(9))]));
diff --git a/crates/effects/src/channel.rs b/crates/effects/src/channel.rs
index b763ac21f..44e9dd89a 100644
--- a/crates/effects/src/channel.rs
+++ b/crates/effects/src/channel.rs
@@ -49,12 +49,15 @@ fn set_channels(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
+/// Shift Channels' Take … From menu. After Effects' ten options come first, in its order, so a
+/// project or script that sets 10 ("Full Off" there) turns the channel off here too; "Half On" is
+/// an EffectCraft extra and sits last.
 const SHIFT_ORDER: [Src; 11] =
-    [Src::Alpha, Src::Red, Src::Green, Src::Blue, Src::Luminance, Src::Hue, Src::Lightness, Src::Saturation, Src::Full, Src::Half, Src::Off];
-const SHIFT_NAMES: [&str; 11] = ["Alpha", "Red", "Green", "Blue", "Luminance", "Hue", "Lightness", "Saturation", "Full On", "Half On", "Full Off"];
+    [Src::Alpha, Src::Red, Src::Green, Src::Blue, Src::Luminance, Src::Hue, Src::Lightness, Src::Saturation, Src::Full, Src::Off, Src::Half];
+const SHIFT_NAMES: [&str; 11] = ["Alpha", "Red", "Green", "Blue", "Luminance", "Hue", "Lightness", "Saturation", "Full On", "Full Off", "Half On"];
 
 fn shift_channels(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let s = ["takeRedFrom", "takeGreenFrom", "takeBlueFrom", "takeAlphaFrom"].map(|id| SHIFT_ORDER[(ctx.params.e(id) as usize).min(10)]);
+    let s = ["takeRedFrom", "takeGreenFrom", "takeBlueFrom", "takeAlphaFrom"].map(|id| SHIFT_ORDER[(ctx.params.e(id) as usize).min(SHIFT_ORDER.len() - 1)]);
     route(&mut b, s);
     b
 }
@@ -548,6 +551,24 @@ mod tests {
         assert!(close(out.get(7, 0), [0.25, 0.25, 0.45, 0.5]));
     }
 
+    /// #1797: the Take … From menu keeps After Effects' order, where the tenth option (`Enum(9)`
+    /// here, 10 to a script) is Full Off, not Half On.
+    #[test]
+    fn shift_channels_menu_follows_after_effects_order() {
+        assert_eq!(SHIFT_NAMES[8..], ["Full On", "Full Off", "Half On"]);
+        // The sample's right-hand pixels are half transparent, so a straight 0.0 and 0.5 are
+        // stored as 0.0 and 0.25.
+        let off = run("ec.channel.shiftchannels", &[("takeGreenFrom", Value::Enum(9))], sample());
+        assert!(close(off.get(0, 0), [0.2, 0.0, 0.9, 1.0]), "{:?}", off.get(0, 0));
+        assert!(close(off.get(7, 0), [0.1, 0.0, 0.45, 0.5]), "{:?}", off.get(7, 0));
+        let half = run("ec.channel.shiftchannels", &[("takeGreenFrom", Value::Enum(10))], sample());
+        assert!(close(half.get(0, 0), [0.2, 0.5, 0.9, 1.0]), "{:?}", half.get(0, 0));
+        assert!(close(half.get(7, 0), [0.1, 0.25, 0.45, 0.5]), "{:?}", half.get(7, 0));
+        // A value past the last option stays on the last one instead of panicking.
+        let past = run("ec.channel.shiftchannels", &[("takeGreenFrom", Value::Enum(99))], sample());
+        assert_eq!(past.get(0, 0), half.get(0, 0));
+    }
+
     #[test]
     fn channel_combiner_hls_round_trip() {
         let img = sample();
diff --git a/crates/effects/src/channel2.rs b/crates/effects/src/channel2.rs
index 5be3c94e7..ef391f6f1 100644
--- a/crates/effects/src/channel2.rs
+++ b/crates/effects/src/channel2.rs
@@ -1,5 +1,5 @@
 //! Channel effects, batch 2: layer-to-layer combinations (Blend, Calculations, Compound
-//! Arithmetic) and CC Composite. Second layers come from layer parameters through the effect
+//! Arithmetic) and Source Composite. Second layers come from layer parameters through the effect
 //! host; with no layer chosen the effect uses the layer itself, as After Effects does.
 
 use effectcraft_color::{BlendMode, blend_pixel, hsl_to_rgb, luminance, rgb_to_hsl};
@@ -69,7 +69,7 @@ fn blend(ctx: &EffectCtx, mut b: Buf) -> Buf {
 
 // ---------------------------------------------------------------- Calculations
 
-/// Blending modes offered by Calculations / CC Composite (menu order).
+/// Blending modes offered by Calculations / Source Composite (menu order).
 const CALC_MODES: [BlendMode; 22] = [
     BlendMode::Normal,
     BlendMode::Darken,
@@ -150,7 +150,7 @@ fn calculations(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Composite
+// ---------------------------------------------------------------- Source Composite
 
 const CC_COMPOSITE_MODES: [&str; 16] = [
     "In Front",
@@ -321,7 +321,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.channel.cccomposite",
-            "CC Composite",
+            "Source Composite",
             vec![
                 p("opacity", "Opacity", num(100.0), pct()),
                 p("compositeOriginal", "Composite Original", Value::Enum(0), popup(&CC_COMPOSITE_MODES)),
diff --git a/crates/effects/src/channel3d.rs b/crates/effects/src/channel3d.rs
index 7884e8084..b84b89ebb 100644
--- a/crates/effects/src/channel3d.rs
+++ b/crates/effects/src/channel3d.rs
@@ -7,6 +7,11 @@
 //! pass for a precomp of a 3D comp. Without auxiliary channels they pass the layer through
 //! (EXtractoR still maps the layer's own R, G, B and A).
 //!
+//! 3D Layer Instance (Create 3D Layer Instance's own effect, Layer ▸ Create) is not an aux
+//! reader: it replaces the layer's pixels with a referenced layer's render — for a 3D model
+//! layer, its render on its own through the comp's camera — so 2D effects can be applied to a
+//! 3D layer's render.
+//!
 //! Aux pixels are looked up nearest-neighbour (IDs must not be interpolated) at each buffer
 //! pixel's layer position, so render scale and layer padding are respected.
 
@@ -25,6 +30,25 @@ fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, ren
     EffectSpec { id, name, category: "3D Channel", params, render, gpu: false, float: true }
 }
 
+/// The effects that read their layer's auxiliary channels ([`crate::EffectHost::aux`]): every
+/// 3D Channel effect but 3D Layer Instance.
+const READS_AUX: [&str; 8] = [
+    "ec.3d.channelextract",
+    "ec.3d.cryptomatte",
+    "ec.3d.depthmatte",
+    "ec.3d.depthoffield",
+    "ec.3d.extractor",
+    "ec.3d.fog3d",
+    "ec.3d.idmatte",
+    "ec.3d.identifier",
+];
+
+/// Does effect `id` read its layer's auxiliary channels ([`crate::EffectHost::aux`])? The media
+/// layer then decodes the footage's picture together with its channels (#474).
+pub fn reads_aux(id: &str) -> bool {
+    READS_AUX.contains(&id)
+}
+
 fn aux(ctx: &EffectCtx) -> Option<Arc<AuxChannels>> {
     ctx.env.host?.aux()
 }
@@ -37,16 +61,24 @@ fn index_map(b: &Buf, a: &AuxChannels) -> Vec<Option<usize>> {
 /// [`index_map`] sampling each pixel at sub-pixel position `at` (0..1).
 fn index_map_at(b: &Buf, a: &AuxChannels, at: [f64; 2]) -> Vec<Option<usize>> {
     let (w, h) = (b.img.width as usize, b.img.height as usize);
-    let inv = 1.0 / b.scale.max(1e-9);
     (0..w * h)
         .into_par_iter()
         .map(|i| {
-            let (x, y) = ((i % w) as f64 + at[0], (i / w) as f64 + at[1]);
-            a.index_at((x - b.offset[0]) * inv, (y - b.offset[1]) * inv)
+            let [x, y] = aux_point(b.scale, b.offset, [(i % w) as f64 + at[0], (i / w) as f64 + at[1]]);
+            a.index_at(x, y)
         })
         .collect()
 }
 
+/// The layer point where 3D Channel effects look up the aux for buffer position `p` (pixel
+/// `i` + sub-pixel offset) of a buffer with `scale` and `offset`. The Cryptomatte pick calls
+/// it too, so the two can't pick different aux pixels.
+#[inline]
+pub fn aux_point(scale: f64, offset: [f64; 2], p: [f64; 2]) -> [f64; 2] {
+    let inv = 1.0 / scale.max(1e-9);
+    [(p[0] - offset[0]) * inv, (p[1] - offset[1]) * inv]
+}
+
 /// A channel sampled into the buffer grid (`fill` outside).
 fn plane_of(b: &Buf, idx: &[Option<usize>], ch: &[f32], fill: f32) -> Plane {
     Plane { w: b.img.width as usize, h: b.img.height as usize, data: idx.par_iter().map(|i| i.map_or(fill, |i| ch[i])).collect() }
@@ -326,7 +358,7 @@ fn wild(pat: &str, name: &str) -> bool {
 /// Split a selection at its commas. A name in double or single quotes stays whole, commas
 /// included (Blender allows `Green, Glossy`), and a backslash takes the next character
 /// literally (`Green\, Glossy`, `\"`). Unquoted text is trimmed; the quotes are dropped.
-fn selection_names(sel: &str) -> Vec<String> {
+pub(crate) fn selection_names(sel: &str) -> Vec<String> {
     let mut out = vec![];
     let mut cur = String::new();
     let mut quote: Option<char> = None;
@@ -351,7 +383,7 @@ fn selection_names(sel: &str) -> Vec<String> {
     out
 }
 
-/// Parse a selection: comma-separated names (optionally quoted, see [`selection_names`]) or
+/// Parse a selection: comma-separated names (optionally quoted, see `selection_names`) or
 /// `<hex>` hashes / wildcards.
 pub fn selection_hashes(sel: &str, manifest: Option<&[(String, u32)]>) -> Vec<u32> {
     let mut out = vec![];
@@ -377,8 +409,68 @@ pub fn selection_hashes(sel: &str, manifest: Option<&[(String, u32)]>) -> Vec<u3
     out
 }
 
+/// The Cryptomatte layers every renderer names, and the Layer popup's options when the footage
+/// has no Cryptomatte metadata. The stored Layer value is an index: 0-2 are these (an exact
+/// match or a suffix such as `ViewLayer.CryptoObject`), 3 and up are the file's other Cryptomatte
+/// layers in name order, so a project saved before the popup followed the footage loads unchanged.
 pub const CRYPTO_LAYERS: [&str; 3] = ["CryptoObject", "CryptoMaterial", "CryptoAsset"];
 
+/// The Layer popup's entries for Cryptomatte `layers` (sorted, as [`AuxChannels::crypto_layers`]
+/// returns them): the stored value and the layer's name, in value order. Of several layers
+/// that fit one standard slot (`A.CryptoObject`, `B.CryptoObject`) the first one keeps the standard
+/// slot, so existing projects load unchanged, and the others get the next custom slots.
+fn crypto_layer_slots(layers: &[String]) -> Vec<(usize, &str)> {
+    let mut out: Vec<(usize, &str)> = vec![];
+    let mut custom = CRYPTO_LAYERS.len();
+    for l in layers {
+        match CRYPTO_LAYERS.iter().position(|w| l == w || l.ends_with(w)) {
+            Some(i) if !out.iter().any(|(j, _)| *j == i) => out.push((i, l)),
+            _ => {
+                out.push((custom, l));
+                custom += 1;
+            }
+        }
+    }
+    out.sort_by_key(|(i, _)| *i);
+    out
+}
+
+/// What the Layer popup lists for the footage `aux`: the Cryptomatte layers the file has, as
+/// (stored value, name), or the three standard ones when there is none (no footage, not an
+/// OpenEXR, no Cryptomatte channels).
+pub fn crypto_layer_choices(aux: Option<&AuxChannels>) -> Vec<(usize, String)> {
+    crypto_layer_menu(aux, 0).0
+}
+
+/// The Layer popup for the stored value `index`: [`crypto_layer_choices`], and the name of the
+/// entry the effect reads (the first when `index` names none, as the effect does).
+pub fn crypto_layer_menu(aux: Option<&AuxChannels>, index: usize) -> (Vec<(usize, String)>, Option<String>) {
+    let layers = aux.map(AuxChannels::crypto_layers).unwrap_or_default();
+    if layers.is_empty() {
+        let all: Vec<(usize, String)> = CRYPTO_LAYERS.iter().enumerate().map(|(i, n)| (i, n.to_string())).collect();
+        let shown = all.iter().find(|c| c.0 == index).or(all.first()).map(|c| c.1.clone());
+        return (all, shown);
+    }
+    let slots = crypto_layer_slots(&layers);
+    let shown = slots.iter().find(|(i, _)| *i == index).map(|(_, n)| n.to_string()).or_else(|| layers.first().cloned());
+    (slots.into_iter().map(|(i, n)| (i, n.to_string())).collect(), shown)
+}
+
+/// The Cryptomatte layer the effect reads: the one called `name` when the footage has it (Layer
+/// Name, the layer an imported After Effects project names), else [`crypto_layer_name`]'s.
+pub fn crypto_layer_named(aux: &AuxChannels, name: &str, index: usize) -> Option<String> {
+    aux.resolve_crypto_layer_named(name, &crypto_layer_name(aux, index)?)
+}
+
+/// The Cryptomatte layer of `aux` that the stored Layer value `index` reads: its slot's layer, else
+/// the first layer (what a file without that layer has always shown). `None` without any.
+pub fn crypto_layer_name(aux: &AuxChannels, index: usize) -> Option<String> {
+    if aux.crypto_layers().is_empty() {
+        return None;
+    }
+    crypto_layer_menu(Some(aux), index).1
+}
+
 /// Rank planes as [`AuxChannels::crypto_rank_planes`] returns them.
 type RankPlanes<'a> = [(&'a [f32], &'a [f32])];
 
@@ -395,13 +487,42 @@ fn crypto_matte(planes: &RankPlanes, sel: &[u32], i: usize) -> f32 {
         .clamp(0.0, 1.0)
 }
 
+/// [`id_color`] of the last ID seen on each rank plane, per worker. Neighbouring pixels mostly
+/// carry the same IDs, so this skips the hash and the HSL conversion for most of them. Keyed by the
+/// ID's bits, so it returns exactly what [`id_color`] would.
+///
+/// Keep the per-pixel loop below as it is: with NaN coverage, which NaN payload ends up in a
+/// channel depends on the order the compiler adds the ranks in, and a row-wise loop let it reorder
+/// them (`crypto_aux_image_is_bit_exact_on_edge_values` catches that).
+#[derive(Default)]
+struct IdColorMemo(Vec<(u32, [f32; 3])>);
+
+impl IdColorMemo {
+    #[inline]
+    fn get(&mut self, rank: usize, id: f32) -> [f32; 3] {
+        let bits = id.to_bits();
+        match self.0.get_mut(rank) {
+            Some(e) if e.0 == bits => e.1,
+            Some(e) => {
+                *e = (bits, id_color(id));
+                e.1
+            }
+            None => {
+                let c = id_color(id);
+                self.0.resize(rank + 1, (bits, c));
+                c
+            }
+        }
+    }
+}
+
 /// The coverage-weighted ID colours at aux pixel `i` (the spec's preview).
 #[inline]
-fn crypto_colors(planes: &RankPlanes, i: usize) -> [f32; 3] {
+fn crypto_colors(planes: &RankPlanes, i: usize, memo: &mut IdColorMemo) -> [f32; 3] {
     let mut c = [0.0f32; 3];
-    for (id, cov) in planes {
+    for (rank, (id, cov)) in planes.iter().enumerate() {
         let (Some(&id), Some(&cov)) = (id.get(i), cov.get(i)) else { continue };
-        let k = id_color(id);
+        let k = memo.get(rank, id);
         for j in 0..3 {
             c[j] += k[j] * cov;
         }
@@ -413,48 +534,82 @@ fn crypto_colors(planes: &RankPlanes, i: usize) -> [f32; 3] {
 /// selection's coverage (A), computed in parallel with the rank planes resolved once. The GPU
 /// effect uploads this image and samples it per layer pixel.
 pub fn crypto_aux_image(a: &AuxChannels, layer: &str, sel: &[u32]) -> Image {
+    crypto_aux_image_with(a, layer, sel, CryptoAux::ColorsAndMatte)
+}
+
+/// What [`crypto_aux_image_with`] computes per aux pixel.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CryptoAux {
+    /// The coverage-weighted ID colours (RGB) and the selection's coverage (A).
+    ColorsAndMatte,
+    /// Only the selection's coverage (A); the RGB stays 0.
+    MatteOnly,
+}
+
+impl CryptoAux {
+    /// What the Cryptomatte effect reads for `display` and Matte Only: the ID colours are only
+    /// read by the Colors display (0) without Matte Only; Matte, Preview and Matte Only need the
+    /// matte alone.
+    pub fn for_display(display: u32, matte_only: bool) -> Self {
+        if display == 0 && !matte_only { Self::ColorsAndMatte } else { Self::MatteOnly }
+    }
+}
+
+/// [`crypto_aux_image`]; with [`CryptoAux::MatteOnly`] the RGB stays 0 and only the matte (A) is
+/// computed, for the displays that never read the ID colours.
+pub fn crypto_aux_image_with(a: &AuxChannels, layer: &str, sel: &[u32], what: CryptoAux) -> Image {
     let planes = a.crypto_rank_planes(layer);
     let mut img = Image::new(a.width, a.height);
-    img.data.par_iter_mut().enumerate().for_each(|(i, px)| {
-        let c = crypto_colors(&planes, i);
+    img.data.par_iter_mut().enumerate().for_each_init(IdColorMemo::default, |memo, (i, px)| {
+        let c = match what {
+            CryptoAux::ColorsAndMatte => crypto_colors(&planes, i, memo),
+            CryptoAux::MatteOnly => [0.0; 3],
+        };
         *px = [c[0], c[1], c[2], crypto_matte(&planes, sel, i)];
     });
     img
 }
 
+/// The hidden switch that keeps Matte Only as projects saved before #3127 render it: the matte in
+/// RGB and alpha. Fresh instances have it off (the matte in RGB over alpha 1, as After Effects'
+/// Cryptomatte plug-in shows Matte Only); `migrate::legacy_default` turns it on for older saves.
+pub const MATTE_ONLY_IN_ALPHA: &str = "matteOnlyInAlpha";
+
+/// A Matte Only pixel for matte `m`: grey `m` over alpha 1, or with `in_alpha` (older
+/// projects) `m` in every channel. The GPU shader (`fx_depth.wgsl`, op 7) does the same.
+#[inline]
+pub fn matte_only_px(m: f32, in_alpha: bool) -> Px {
+    if in_alpha { [m; 4] } else { [m, m, m, 1.0] }
+}
+
 fn cryptomatte(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let Some(a) = aux(ctx) else { return b };
-    let layers = a.crypto_layers();
-    if layers.is_empty() {
-        return b;
-    }
-    let want = CRYPTO_LAYERS[(ctx.params.e("layer") as usize).min(2)];
-    let layer = layers.iter().find(|l| l.as_str() == want || l.ends_with(want)).unwrap_or(&layers[0]).clone();
+    let Some(layer) = crypto_layer_named(&a, ctx.params.s("layerName"), ctx.params.e("layer") as usize) else { return b };
     let manifest = a.manifests.iter().find(|(l, _)| *l == layer).map(|(_, m)| m.as_slice());
     let sel = selection_hashes(ctx.params.s("selection"), manifest);
     let idx = index_map(&b, &a);
     let display = ctx.params.e("display");
     let matte_only = ctx.params.b("matteOnly");
+    let in_alpha = ctx.params.b(MATTE_ONLY_IN_ALPHA);
     let planes = a.crypto_rank_planes(&layer);
-    let src = b.img.clone();
-    b.img.data.par_iter_mut().enumerate().for_each(|(i, px)| {
-        let m = idx[i].map_or(0.0, |k| crypto_matte(&planes, &sel, k));
+    b.img.data.par_iter_mut().zip(idx.par_iter()).for_each_init(IdColorMemo::default, |memo, (px, &k)| {
+        let m = k.map_or(0.0, |k| crypto_matte(&planes, &sel, k));
         if matte_only {
-            *px = [m, m, m, m];
+            *px = matte_only_px(m, in_alpha);
             return;
         }
         *px = match display {
             // Colors: coverage-weighted ID colours (the spec's preview), selection brighter.
             0 => {
-                let c = idx[i].map_or([0.0; 3], |k| crypto_colors(&planes, k));
+                let c = k.map_or([0.0; 3], |k| crypto_colors(&planes, k, memo));
                 let c = c.map(|v| v * (1.0 - 0.5 * m) + 0.5 * m);
                 [c[0], c[1], c[2], 1.0]
             }
-            // Matte: the layer keyed by the selection.
-            1 => src.data[i].map(|v| v * m),
+            // Matte: the layer keyed by the selection (each pixel only reads itself, so no copy).
+            1 => px.map(|v| v * m),
             // Preview: the layer with the selection tinted.
             _ => {
-                let s = src.data[i];
+                let s = *px;
                 [s[0] * (1.0 - 0.5 * m) + 0.5 * m * s[3], s[1] * (1.0 - 0.5 * m) + 0.5 * m * s[3], s[2] * (1.0 - 0.5 * m), s[3]]
             }
         };
@@ -464,6 +619,39 @@ fn cryptomatte(ctx: &EffectCtx, mut b: Buf) -> Buf {
 
 // ---------------------------------------------------------------- EXtractoR
 
+/// EXtractoR's channel name for After Effects' `(copy)`: the effect input's own channel of the
+/// same position (red's red ... alpha's alpha), as the earlier effects left it, never a footage
+/// channel of some name (an OpenEXR's `A` is the file's alpha, not the input's).
+pub const EXTRACTOR_COPY: &str = "(copy)";
+
+/// Whether an EXtractoR channel name is [`EXTRACTOR_COPY`].
+pub fn is_extractor_copy(name: &str) -> bool {
+    name.trim().eq_ignore_ascii_case(EXTRACTOR_COPY)
+}
+
+/// The layer's own channel an EXtractoR output channel at position `k` reads when no footage
+/// channel of that name exists: `R`/`G`/`B`/`A` (or the long names) by name, [`EXTRACTOR_COPY`]
+/// its own position.
+pub fn extractor_own_channel(k: usize, name: &str) -> Option<usize> {
+    if is_extractor_copy(name) {
+        return (k < 4).then_some(k);
+    }
+    match name.trim().to_ascii_uppercase().as_str() {
+        "R" | "RED" => Some(0),
+        "G" | "GREEN" => Some(1),
+        "B" | "BLUE" => Some(2),
+        "A" | "ALPHA" => Some(3),
+        _ => None,
+    }
+}
+
+/// The footage channel an EXtractoR output channel reads by name: none for an empty name or
+/// [`EXTRACTOR_COPY`] (the input's own channel).
+pub fn extractor_aux_channel<'a>(a: &'a AuxChannels, name: &str) -> Option<&'a [f32]> {
+    let n = name.trim();
+    if n.is_empty() || is_extractor_copy(n) { None } else { a.get(n) }
+}
+
 fn extractor(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let a = aux(ctx);
     let names = [ctx.params.s("red"), ctx.params.s("green"), ctx.params.s("blue"), ctx.params.s("alpha")];
@@ -471,17 +659,11 @@ fn extractor(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let unmult = ctx.params.b("unMult");
     let clip = ctx.params.b("clip");
     let idx = a.as_ref().map(|a| index_map(&b, a));
-    // Each output channel: an aux channel by name, or the layer's own R/G/B/A.
-    let own = |n: &str| match n.trim().to_ascii_uppercase().as_str() {
-        "R" | "RED" => Some(0),
-        "G" | "GREEN" => Some(1),
-        "B" | "BLUE" => Some(2),
-        "A" | "ALPHA" => Some(3),
-        "" => None,
-        _ => None,
-    };
-    let src_ch: Vec<Option<&[f32]>> = names.iter().map(|n| a.as_ref().and_then(|a| if n.trim().is_empty() { None } else { a.get(n.trim()) })).collect();
-    if src_ch.iter().all(Option::is_none) && bp == 0.0 && wp == 1.0 && !unmult && names.iter().enumerate().all(|(k, n)| own(n) == Some(k)) {
+    // Each output channel: an aux channel by name, or the layer's own R/G/B/A (`(copy)`: its
+    // own position, never an aux channel).
+    let own = |k: usize, n: &str| extractor_own_channel(k, n);
+    let src_ch: Vec<Option<&[f32]>> = names.iter().map(|n| a.as_ref().and_then(|a| extractor_aux_channel(a, n))).collect();
+    if src_ch.iter().all(Option::is_none) && bp == 0.0 && wp == 1.0 && !unmult && names.iter().enumerate().all(|(k, n)| own(k, n) == Some(k)) {
         return b;
     }
     let src = b.img.clone();
@@ -497,7 +679,7 @@ fn extractor(ctx: &EffectCtx, mut b: Buf) -> Buf {
             o[k] = match (src_ch[k], idx.as_ref().and_then(|m| m[i])) {
                 (Some(ch), Some(j)) => ch[j],
                 (Some(_), None) => 0.0,
-                (None, _) => match own(names[k]) {
+                (None, _) => match own(k, names[k]) {
                     Some(c) => straight[c],
                     None => {
                         if k == 3 {
@@ -519,6 +701,19 @@ fn extractor(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
+/// A 2D copy of a referenced layer (Create 3D Layer Instance's solid): the layer's pixels
+/// replaced with the referenced layer's render, alpha included — the copy is transparent
+/// where the referenced layer isn't. A 3D model or primitive layer is rendered on its own
+/// through the comp's camera, as After Effects renders 3D layers; another layer is read with
+/// its masks and effects. With no layer chosen the effect passes the layer through, as a layer
+/// parameter with nothing chosen does.
+fn instance_3d(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    if let Some(o) = ctx.layer_param("layer", true) {
+        b.img = crate::util::fit_layer(ctx, &b, &o, false);
+    }
+    b
+}
+
 pub fn specs() -> Vec<EffectSpec> {
     let text = |id: &'static str, name: &'static str, d: &str| p(id, name, Value::Str(d.into()), ParamUi::Text);
     vec![
@@ -543,6 +738,11 @@ pub fn specs() -> Vec<EffectSpec> {
                 text("selection", "Selection", ""),
                 p("display", "Display", Value::Enum(2), popup(&["Colors", "Matte", "Preview"])),
                 p("matteOnly", "Matte Only", Value::Bool(false), ParamUi::Checkbox),
+                p(MATTE_ONLY_IN_ALPHA, "Matte Only In Alpha", Value::Bool(false), ParamUi::Hidden),
+                // A layer named in full (`CryptoMaterial`); empty uses Layer. Last, so the
+                // earlier parameters keep their indexes and saved instances, which get it
+                // appended, have the same order as new ones.
+                text("layerName", "Layer Name", ""),
             ],
             cryptomatte,
         ),
@@ -619,349 +819,9 @@ pub fn specs() -> Vec<EffectSpec> {
             ],
             identifier,
         ),
+        spec("ec.3d.instance3d", "3D Layer Instance", vec![p("layer", "Layer", Value::Layer(None), ParamUi::Layer)], instance_3d),
     ]
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, EffectHost, LayerPixels, run_fx};
-    use effectcraft_raster::channels3d::crypto_float;
-
-    /// A 20×10 layer: left half object 1 at depth 100, right half object 2 at depth 500; the
-    /// top-right corner is background. Cryptomatte: "left" / "right".
-    struct AuxHost(Arc<AuxChannels>);
-    impl EffectHost for AuxHost {
-        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
-            None
-        }
-        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-            None
-        }
-        fn aux(&self) -> Option<Arc<AuxChannels>> {
-            Some(self.0.clone())
-        }
-    }
-
-    fn scene() -> AuxHost {
-        let (w, h) = (20usize, 10usize);
-        let mut a = AuxChannels::new(w as u32, h as u32, 1.0);
-        let (mut z, mut id, mut r, mut g) = (vec![0.0; w * h], vec![0.0; w * h], vec![0.0; w * h], vec![0.0; w * h]);
-        let (hl, hr) = (crypto_hash("left"), crypto_hash("right"));
-        for y in 0..h {
-            for x in 0..w {
-                let i = y * w + x;
-                if x >= 15 && y < 3 {
-                    z[i] = BACKGROUND_DEPTH;
-                } else if x < 10 {
-                    z[i] = 100.0;
-                    id[i] = 1.0;
-                    r[i] = crypto_float(hl);
-                    g[i] = 1.0;
-                } else {
-                    z[i] = 500.0;
-                    id[i] = 2.0;
-                    r[i] = crypto_float(hr);
-                    g[i] = 1.0;
-                }
-            }
-        }
-        a.channels = vec![("Z".into(), z), ("ObjectID".into(), id), ("CryptoObject00.R".into(), r), ("CryptoObject00.G".into(), g)];
-        a.manifests = vec![("CryptoObject".into(), vec![("left".into(), hl), ("right".into(), hr)])];
-        AuxHost(Arc::new(a))
-    }
-
-    fn img() -> Image {
-        Image::filled(20, 10, [0.5, 0.5, 0.5, 1.0])
-    }
-
-    fn run(id: &str, vals: &[(&str, Value)], host: &AuxHost) -> Image {
-        run_fx(id, vals, img(), 0.0, EffectEnv { host: Some(host), ..Default::default() }).img
-    }
-
-    #[test]
-    fn passes_through_without_aux_channels() {
-        for s in specs() {
-            let out = run_fx(s.id, &[], img(), 0.0, EffectEnv::default());
-            assert_eq!(out.img.data, img().data, "{}", s.id);
-        }
-    }
-
-    #[test]
-    fn depth_matte_thresholds() {
-        let h = scene();
-        let o = run("ec.3d.depthmatte", &[("depth", num(300.0))], &h);
-        assert_eq!(o.get(2, 5)[3], 0.0);
-        assert_eq!(o.get(12, 5)[3], 1.0);
-        let inv = run("ec.3d.depthmatte", &[("depth", num(300.0)), ("invert", Value::Bool(true))], &h);
-        assert_eq!(inv.get(2, 5)[3], 1.0);
-        assert_eq!(inv.get(12, 5)[3], 0.0);
-        // Feather: a ramp of 800 units centred on 300 → depth 100 at 0.25, 500 at 0.75.
-        let f = run("ec.3d.depthmatte", &[("depth", num(300.0)), ("feather", num(800.0))], &h);
-        assert!((f.get(2, 5)[3] - 0.25).abs() < 1e-5 && (f.get(12, 5)[3] - 0.75).abs() < 1e-5);
-    }
-
-    #[test]
-    fn channel_extract_maps_depth_and_ids() {
-        let h = scene();
-        let o = run("ec.3d.channelextract", &[("blackPoint", num(0.0)), ("whitePoint", num(1000.0))], &h);
-        assert!((o.get(2, 5)[0] - 0.1).abs() < 1e-6 && (o.get(12, 5)[0] - 0.5).abs() < 1e-6);
-        assert_eq!(o.get(17, 1)[0], 1.0);
-        let ids = run("ec.3d.channelextract", &[("channel", Value::Enum(1)), ("whitePoint", num(2.0))], &h);
-        assert_eq!(ids.get(2, 5)[0], 0.5);
-        // Invert Depth Map flips the ramp; without Clamp Output values run past 1.
-        let inv = run("ec.3d.channelextract", &[("blackPoint", num(0.0)), ("whitePoint", num(1000.0)), ("invertDepthMap", Value::Bool(true))], &h);
-        assert!((inv.get(2, 5)[0] - 0.9).abs() < 1e-6);
-        let raw = run("ec.3d.channelextract", &[("blackPoint", num(0.0)), ("whitePoint", num(100.0)), ("clampOutput", Value::Bool(false))], &h);
-        assert!(raw.get(12, 5)[0] > 1.5);
-    }
-
-    #[test]
-    fn id_matte_and_identifier() {
-        let h = scene();
-        let o = run("ec.3d.idmatte", &[("idSelection", num(2.0))], &h);
-        assert_eq!(o.get(2, 5)[3], 0.0);
-        assert_eq!(o.get(12, 5)[3], 1.0);
-        let l = run("ec.3d.identifier", &[("display", Value::Enum(1)), ("id", num(1.0))], &h);
-        assert_eq!(l.get(2, 5)[0], 1.0);
-        assert_eq!(l.get(12, 5)[0], 0.0);
-        let c = run("ec.3d.identifier", &[], &h);
-        assert_ne!(c.get(2, 5), c.get(12, 5));
-    }
-
-    /// The parallel aux image (rank planes resolved once) is bit-identical to the per-pixel
-    /// reduction over `crypto_ranks` it replaces.
-    #[test]
-    fn crypto_aux_image_matches_the_per_pixel_reduction() {
-        let (w, h) = (7u32, 5u32);
-        let n = (w * h) as usize;
-        let mut a = AuxChannels::new(w, h, 1.0);
-        let ids = [crypto_hash("cube"), crypto_hash("sphere"), crypto_hash("ring")].map(effectcraft_raster::channels3d::crypto_float);
-        for (k, ch) in ["00.R", "00.G", "00.B", "00.A", "01.R", "01.G", "01.B", "01.A"].iter().enumerate() {
-            let v: Vec<f32> = (0..n).map(|i| if k % 2 == 0 { ids[(i + k) % 3] } else { ((i * 7 + k * 3) % 11) as f32 / 10.0 }).collect();
-            a.channels.push((format!("CryptoObject{ch}"), v));
-        }
-        let sel = vec![crypto_hash("sphere"), crypto_hash("ring")];
-        let img = crypto_aux_image(&a, "CryptoObject", &sel);
-        for i in 0..n {
-            let ranks = a.crypto_ranks("CryptoObject", i);
-            let m: f32 = ranks.iter().filter(|(id, c)| *c > 0.0 && sel.contains(&id.to_bits())).map(|(_, c)| *c).sum::<f32>().clamp(0.0, 1.0);
-            let mut c = [0.0f32; 3];
-            for (id, cov) in &ranks {
-                let k = id_color(*id);
-                for j in 0..3 {
-                    c[j] += k[j] * cov;
-                }
-            }
-            let want = [c[0], c[1], c[2], m];
-            assert_eq!(img.data[i].map(f32::to_bits), want.map(f32::to_bits), "pixel {i}");
-        }
-    }
-
-    /// The lookup before #473, kept as the reference: the rank channels formatted and searched
-    /// by name for every pixel.
-    fn ranks_by_name(a: &AuxChannels, layer: &str, i: usize) -> Vec<(f32, f32)> {
-        let mut out = vec![];
-        for k in 0.. {
-            let get = |c: &str| a.get(&format!("{layer}{k:02}.{c}"));
-            let (Some(r), Some(g)) = (get("R"), get("G")) else { break };
-            out.push((r[i], g[i]));
-            if let (Some(b), Some(al)) = (get("B"), get("A")) {
-                out.push((b[i], al[i]));
-            }
-        }
-        out
-    }
-
-    /// The reduction before #473 over those ranks: (ID colours, selection coverage).
-    fn reduce_by_name(a: &AuxChannels, layer: &str, sel: &[u32], i: usize) -> ([f32; 3], f32) {
-        let ranks = ranks_by_name(a, layer, i);
-        let m: f32 = ranks.iter().filter(|(id, c)| *c > 0.0 && sel.contains(&id.to_bits())).map(|(_, c)| *c).sum::<f32>().clamp(0.0, 1.0);
-        let mut c = [0.0f32; 3];
-        for (id, cov) in &ranks {
-            let k = id_color(*id);
-            for j in 0..3 {
-                c[j] += k[j] * cov;
-            }
-        }
-        (c, m)
-    }
-
-    /// A 6×2 Cryptomatte layer with awkward values: NaN, ±inf, negative and -0.0 coverage, NaN
-    /// and -0.0 IDs; rank 01 has no B/A pair, rank 02 is missing, so rank 03 (filled with values
-    /// that would change every pixel) must be ignored as before.
-    fn edge_aux(with_rank_after_gap: bool) -> AuxChannels {
-        let (w, h) = (6u32, 2u32);
-        let nan_payload = f32::from_bits(0x7fc0_1234);
-        let (hs, hc) = (crypto_float(crypto_hash("sphere")), crypto_float(crypto_hash("cube")));
-        let cov = [f32::NAN, f32::INFINITY, f32::NEG_INFINITY, -0.5, -0.0, 0.0, 0.25, 1.0, 2.0, f32::MIN_POSITIVE, nan_payload, 0.5];
-        let ids = [hs, f32::NAN, hc, -0.0, 0.0, nan_payload, hs, hc, f32::NAN, hs, hc, -0.0];
-        let rot = |v: &[f32; 12], k: usize| -> Vec<f32> { (0..12).map(|i| v[(i + k) % 12]).collect() };
-        let mut a = AuxChannels::new(w, h, 1.0);
-        let mut push = |n: &str, v: Vec<f32>| a.channels.push((format!("CryptoObject{n}"), v));
-        push("00.R", rot(&ids, 0));
-        push("00.G", rot(&cov, 0));
-        push("00.B", rot(&ids, 3));
-        push("00.A", rot(&cov, 5));
-        push("01.R", rot(&ids, 7));
-        push("01.G", rot(&cov, 2));
-        if with_rank_after_gap {
-            push("03.R", vec![hs; 12]);
-            push("03.G", vec![1.0; 12]);
-            push("03.B", vec![hc; 12]);
-            push("03.A", vec![1.0; 12]);
-        }
-        a
-    }
-
-    fn edge_selection() -> Vec<u32> {
-        vec![crypto_hash("sphere"), f32::NAN.to_bits(), 0x7fc0_1234, (-0.0f32).to_bits()]
-    }
-
-    /// Edge values give bit-identical results to the lookup by name, the missing B/A pair is
-    /// skipped and a rank after a gap is ignored.
-    #[test]
-    fn crypto_aux_image_is_bit_exact_on_edge_values() {
-        let sel = edge_selection();
-        let a = edge_aux(true);
-        assert_eq!(a.crypto_rank_planes("CryptoObject").len(), 3, "00.R/G, 00.B/A, 01.R/G; not 03 after the gap");
-        let img = crypto_aux_image(&a, "CryptoObject", &sel);
-        let without_gap_rank = crypto_aux_image(&edge_aux(false), "CryptoObject", &sel);
-        for i in 0..12 {
-            let (c, m) = reduce_by_name(&a, "CryptoObject", &sel, i);
-            let want = [c[0], c[1], c[2], m];
-            assert_eq!(img.data[i].map(f32::to_bits), want.map(f32::to_bits), "pixel {i}");
-            assert_eq!(img.data[i].map(f32::to_bits), without_gap_rank.data[i].map(f32::to_bits), "pixel {i}: the rank after the gap was used");
-        }
-    }
-
-    /// The CPU effect on a 20×10 layer over the 6×2 edge aux: pixels inside the aux area match
-    /// the lookup by name bit for bit in every display mode, pixels outside it (no aux index)
-    /// get an empty matte and no ID colour.
-    #[test]
-    fn cryptomatte_cpu_path_is_bit_exact_inside_and_outside_the_aux_area() {
-        let a = edge_aux(true);
-        let host = AuxHost(Arc::new(a.clone()));
-        let names = "sphere, <7fc00000>, <7fc01234>, <80000000>";
-        assert_eq!(selection_hashes(names, None), edge_selection());
-        let src = img().data[0];
-        for (display, matte_only) in [(0, false), (1, false), (2, false), (0, true)] {
-            let out = run(
-                "ec.3d.cryptomatte",
-                &[("selection", Value::Str(names.into())), ("display", Value::Enum(display)), ("matteOnly", Value::Bool(matte_only))],
-                &host,
-            );
-            let expect = |c: [f32; 3], m: f32| -> [f32; 4] {
-                if matte_only {
-                    return [m; 4];
-                }
-                match display {
-                    0 => {
-                        let c = c.map(|v| v * (1.0 - 0.5 * m) + 0.5 * m);
-                        [c[0], c[1], c[2], 1.0]
-                    }
-                    1 => src.map(|v| v * m),
-                    _ => [src[0] * (1.0 - 0.5 * m) + 0.5 * m * src[3], src[1] * (1.0 - 0.5 * m) + 0.5 * m * src[3], src[2] * (1.0 - 0.5 * m), src[3]],
-                }
-            };
-            for (x, y) in [(0u32, 0u32), (1, 0), (5, 0), (0, 1), (3, 1), (5, 1)] {
-                let (c, m) = reduce_by_name(&a, "CryptoObject", &edge_selection(), (y * 6 + x) as usize);
-                assert_eq!(
-                    out.get(x as i64, y as i64).map(f32::to_bits),
-                    expect(c, m).map(f32::to_bits),
-                    "display {display} matteOnly {matte_only} at ({x}, {y})"
-                );
-            }
-            for (x, y) in [(6u32, 0u32), (19, 0), (0, 2), (12, 9)] {
-                assert_eq!(
-                    out.get(x as i64, y as i64).map(f32::to_bits),
-                    expect([0.0; 3], 0.0).map(f32::to_bits),
-                    "display {display} matteOnly {matte_only} outside the aux at ({x}, {y})"
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn cryptomatte_selects_by_name_and_wildcard() {
-        let h = scene();
-        let m = run("ec.3d.cryptomatte", &[("selection", Value::Str("right".into())), ("matteOnly", Value::Bool(true))], &h);
-        assert_eq!(m.get(2, 5)[3], 0.0);
-        assert_eq!(m.get(12, 5)[3], 1.0);
-        let w = run("ec.3d.cryptomatte", &[("selection", Value::Str("l*".into())), ("display", Value::Enum(1))], &h);
-        assert_eq!(w.get(2, 5)[3], 1.0);
-        assert_eq!(w.get(12, 5)[3], 0.0);
-        assert!(wild("*ight", "right") && wild("r*t", "right") && !wild("x*", "right"));
-        let hex = format!("<{:08x}>", crypto_hash("left"));
-        assert_eq!(selection_hashes(&hex, None), vec![crypto_hash("left")]);
-    }
-
-    /// #473: a name with a comma in it (Blender allows `Green, Glossy`) is selected when it is
-    /// quoted or its comma escaped, instead of being cut into two names that match nothing.
-    #[test]
-    fn cryptomatte_selection_keeps_quoted_names_with_commas_whole() {
-        let manifest = vec![("Green, Glossy".to_string(), 7), ("Green".to_string(), 1), ("Glossy".to_string(), 2), ("ring".to_string(), 3)];
-        let m = Some(manifest.as_slice());
-        assert_eq!(selection_hashes(r#""Green, Glossy""#, m), vec![7]);
-        assert_eq!(selection_hashes("'Green, Glossy', ring", m), vec![7, 3]);
-        assert_eq!(selection_hashes(r"Green\, Glossy", m), vec![7]);
-        assert_eq!(selection_hashes(r#"ring , "Green, Glossy""#, m), vec![3, 7]);
-        // Without a manifest the whole name is hashed.
-        assert_eq!(selection_hashes(r#""Green, Glossy""#, None), vec![crypto_hash("Green, Glossy")]);
-        // Plain lists, apostrophes inside names and an unclosed quote still parse.
-        assert_eq!(selection_hashes("Green, Glossy", m), vec![1, 2]);
-        assert_eq!(selection_names("Bob's mat, ring"), vec!["Bob's mat", "ring"]);
-        assert_eq!(selection_names(r#""Green, Glossy"#), vec!["Green, Glossy"]);
-        assert_eq!(selection_names(r#"say \"hi\""#), vec![r#"say "hi""#]);
-    }
-
-    #[test]
-    fn fog_and_depth_of_field_follow_depth() {
-        let h = scene();
-        let f = run("ec.3d.fog3d", &[("fogColor", col(1.0, 0.0, 0.0)), ("fogEndDepth", num(1000.0)), ("scatteringDensity", num(0.0))], &h);
-        // Linear fog: 10 % at depth 100, 50 % at 500, full on the background.
-        assert!((f.get(2, 5)[0] - 0.55).abs() < 1e-4, "{:?}", f.get(2, 5));
-        assert!((f.get(12, 5)[0] - 0.75).abs() < 1e-4);
-        assert!((f.get(17, 1)[0] - 1.0).abs() < 1e-4 && f.get(17, 1)[1] < 1e-4);
-        assert!((dof_radius(100.0, 100.0, 0.0, 10.0, 50.0)).abs() < 1e-6);
-        assert!((dof_radius(200.0, 100.0, 0.0, 10.0, 50.0) - 10.0).abs() < 1e-6);
-        assert_eq!(dof_radius(140.0, 100.0, 100.0, 10.0, 50.0), 0.0);
-        // A sharp edge at the far object blurs when focused near.
-        let mut pic = Image::new(20, 10);
-        for y in 0..10 {
-            for x in 0..20 {
-                let v = if x % 2 == 0 { 1.0 } else { 0.0 };
-                pic.set(x, y, [v, v, v, 1.0]);
-            }
-        }
-        let env = EffectEnv { host: Some(&h), ..Default::default() };
-        let d = run_fx("ec.3d.depthoffield", &[("focalPlane", num(100.0)), ("maximumRadius", num(4.0))], pic.clone(), 0.0, env).img;
-        assert_eq!(d.get(4, 5), pic.get(4, 5));
-        assert!((d.get(12, 5)[0] - 0.5).abs() < 0.3 && d.get(12, 5) != pic.get(12, 5));
-    }
-
-    #[test]
-    fn extractor_maps_named_channels() {
-        let h = scene();
-        let o = run("ec.3d.extractor", &[("red", Value::Str("Z".into())), ("whitePoint", num(1000.0))], &h);
-        assert!((o.get(2, 5)[0] - 0.1).abs() < 1e-6);
-        assert!((o.get(2, 5)[1] - 0.0005).abs() < 1e-6);
-        // Without aux: the layer's own channels can be swapped.
-        let s = run_fx("ec.3d.extractor", &[("red", Value::Str("A".into()))], Image::filled(2, 2, [0.2, 0.3, 0.4, 1.0]), 0.0, EffectEnv::default());
-        assert_eq!(s.img.get(0, 0), [1.0, 0.3, 0.4, 1.0]);
-    }
-
-    #[test]
-    fn channel_extract_antialias_averages_sub_pixels() {
-        // Depth at twice the layer resolution, alternating 0 / 1000 per aux column.
-        let mut a = AuxChannels::new(40, 20, 2.0);
-        a.channels = vec![("Z".into(), (0..800).map(|i| if i % 2 == 0 { 0.0 } else { 1000.0 }).collect())];
-        let host = AuxHost(Arc::new(a));
-        let vals = [("blackPoint", num(0.0)), ("whitePoint", num(1000.0))];
-        let hard = run("ec.3d.channelextract", &vals, &host);
-        let v = hard.get(5, 5)[0];
-        assert!(v == 0.0 || v == 1.0, "{v}");
-        let soft = run("ec.3d.channelextract", &[vals.as_slice(), &[("antialias", Value::Bool(true))]].concat(), &host);
-        assert!((soft.get(5, 5)[0] - 0.5).abs() < 1e-5, "{:?}", soft.get(5, 5));
-    }
-}
+mod tests;
diff --git a/crates/effects/src/channel3d/tests.rs b/crates/effects/src/channel3d/tests.rs
new file mode 100644
index 000000000..c1fa21711
--- /dev/null
+++ b/crates/effects/src/channel3d/tests.rs
@@ -0,0 +1,662 @@
+use super::*;
+use crate::{EffectEnv, EffectHost, LayerPixels, run_fx};
+use effectcraft_raster::channels3d::crypto_float;
+
+/// A 20×10 layer: left half object 1 at depth 100, right half object 2 at depth 500; the
+/// top-right corner is background. Cryptomatte: "left" / "right".
+struct AuxHost(Arc<AuxChannels>);
+impl EffectHost for AuxHost {
+    fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+        None
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn aux(&self) -> Option<Arc<AuxChannels>> {
+        Some(self.0.clone())
+    }
+}
+
+fn scene() -> AuxHost {
+    let (w, h) = (20usize, 10usize);
+    let mut a = AuxChannels::new(w as u32, h as u32, 1.0);
+    let (mut z, mut id, mut r, mut g) = (vec![0.0; w * h], vec![0.0; w * h], vec![0.0; w * h], vec![0.0; w * h]);
+    let (hl, hr) = (crypto_hash("left"), crypto_hash("right"));
+    for y in 0..h {
+        for x in 0..w {
+            let i = y * w + x;
+            if x >= 15 && y < 3 {
+                z[i] = BACKGROUND_DEPTH;
+            } else if x < 10 {
+                z[i] = 100.0;
+                id[i] = 1.0;
+                r[i] = crypto_float(hl);
+                g[i] = 1.0;
+            } else {
+                z[i] = 500.0;
+                id[i] = 2.0;
+                r[i] = crypto_float(hr);
+                g[i] = 1.0;
+            }
+        }
+    }
+    a.channels = vec![("Z".into(), z), ("ObjectID".into(), id), ("CryptoObject00.R".into(), r), ("CryptoObject00.G".into(), g)];
+    a.manifests = vec![("CryptoObject".into(), vec![("left".into(), hl), ("right".into(), hr)])];
+    AuxHost(Arc::new(a))
+}
+
+fn img() -> Image {
+    Image::filled(20, 10, [0.5, 0.5, 0.5, 1.0])
+}
+
+fn run(id: &str, vals: &[(&str, Value)], host: &AuxHost) -> Image {
+    run_fx(id, vals, img(), 0.0, EffectEnv { host: Some(host), ..Default::default() }).img
+}
+
+#[test]
+fn passes_through_without_aux_channels() {
+    for s in specs() {
+        let out = run_fx(s.id, &[], img(), 0.0, EffectEnv::default());
+        assert_eq!(out.img.data, img().data, "{}", s.id);
+    }
+}
+
+#[test]
+fn depth_matte_thresholds() {
+    let h = scene();
+    let o = run("ec.3d.depthmatte", &[("depth", num(300.0))], &h);
+    assert_eq!(o.get(2, 5)[3], 0.0);
+    assert_eq!(o.get(12, 5)[3], 1.0);
+    let inv = run("ec.3d.depthmatte", &[("depth", num(300.0)), ("invert", Value::Bool(true))], &h);
+    assert_eq!(inv.get(2, 5)[3], 1.0);
+    assert_eq!(inv.get(12, 5)[3], 0.0);
+    // Feather: a ramp of 800 units centred on 300 → depth 100 at 0.25, 500 at 0.75.
+    let f = run("ec.3d.depthmatte", &[("depth", num(300.0)), ("feather", num(800.0))], &h);
+    assert!((f.get(2, 5)[3] - 0.25).abs() < 1e-5 && (f.get(12, 5)[3] - 0.75).abs() < 1e-5);
+}
+
+#[test]
+fn channel_extract_maps_depth_and_ids() {
+    let h = scene();
+    let o = run("ec.3d.channelextract", &[("blackPoint", num(0.0)), ("whitePoint", num(1000.0))], &h);
+    assert!((o.get(2, 5)[0] - 0.1).abs() < 1e-6 && (o.get(12, 5)[0] - 0.5).abs() < 1e-6);
+    assert_eq!(o.get(17, 1)[0], 1.0);
+    let ids = run("ec.3d.channelextract", &[("channel", Value::Enum(1)), ("whitePoint", num(2.0))], &h);
+    assert_eq!(ids.get(2, 5)[0], 0.5);
+    // Invert Depth Map flips the ramp; without Clamp Output values run past 1.
+    let inv = run("ec.3d.channelextract", &[("blackPoint", num(0.0)), ("whitePoint", num(1000.0)), ("invertDepthMap", Value::Bool(true))], &h);
+    assert!((inv.get(2, 5)[0] - 0.9).abs() < 1e-6);
+    let raw = run("ec.3d.channelextract", &[("blackPoint", num(0.0)), ("whitePoint", num(100.0)), ("clampOutput", Value::Bool(false))], &h);
+    assert!(raw.get(12, 5)[0] > 1.5);
+}
+
+#[test]
+fn id_matte_and_identifier() {
+    let h = scene();
+    let o = run("ec.3d.idmatte", &[("idSelection", num(2.0))], &h);
+    assert_eq!(o.get(2, 5)[3], 0.0);
+    assert_eq!(o.get(12, 5)[3], 1.0);
+    let l = run("ec.3d.identifier", &[("display", Value::Enum(1)), ("id", num(1.0))], &h);
+    assert_eq!(l.get(2, 5)[0], 1.0);
+    assert_eq!(l.get(12, 5)[0], 0.0);
+    let c = run("ec.3d.identifier", &[], &h);
+    assert_ne!(c.get(2, 5), c.get(12, 5));
+}
+
+/// The parallel aux image (rank planes resolved once) is bit-identical to the per-pixel
+/// reduction over `crypto_ranks` it replaces.
+#[test]
+fn crypto_aux_image_matches_the_per_pixel_reduction() {
+    let (w, h) = (7u32, 5u32);
+    let n = (w * h) as usize;
+    let mut a = AuxChannels::new(w, h, 1.0);
+    let ids = [crypto_hash("cube"), crypto_hash("sphere"), crypto_hash("ring")].map(effectcraft_raster::channels3d::crypto_float);
+    for (k, ch) in ["00.R", "00.G", "00.B", "00.A", "01.R", "01.G", "01.B", "01.A"].iter().enumerate() {
+        let v: Vec<f32> = (0..n).map(|i| if k % 2 == 0 { ids[(i + k) % 3] } else { ((i * 7 + k * 3) % 11) as f32 / 10.0 }).collect();
+        a.channels.push((format!("CryptoObject{ch}"), v));
+    }
+    let sel = vec![crypto_hash("sphere"), crypto_hash("ring")];
+    let img = crypto_aux_image(&a, "CryptoObject", &sel);
+    for i in 0..n {
+        let ranks = a.crypto_ranks("CryptoObject", i);
+        let m: f32 = ranks.iter().filter(|(id, c)| *c > 0.0 && sel.contains(&id.to_bits())).map(|(_, c)| *c).sum::<f32>().clamp(0.0, 1.0);
+        let mut c = [0.0f32; 3];
+        for (id, cov) in &ranks {
+            let k = id_color(*id);
+            for j in 0..3 {
+                c[j] += k[j] * cov;
+            }
+        }
+        let want = [c[0], c[1], c[2], m];
+        assert_eq!(img.data[i].map(f32::to_bits), want.map(f32::to_bits), "pixel {i}");
+    }
+}
+
+/// The lookup before #473, kept as the reference: the rank channels formatted and searched
+/// by name for every pixel.
+fn ranks_by_name(a: &AuxChannels, layer: &str, i: usize) -> Vec<(f32, f32)> {
+    let mut out = vec![];
+    for k in 0.. {
+        let get = |c: &str| a.get(&format!("{layer}{k:02}.{c}"));
+        let (Some(r), Some(g)) = (get("R"), get("G")) else { break };
+        out.push((r[i], g[i]));
+        if let (Some(b), Some(al)) = (get("B"), get("A")) {
+            out.push((b[i], al[i]));
+        }
+    }
+    out
+}
+
+/// The reduction before #473 over those ranks: (ID colours, selection coverage).
+fn reduce_by_name(a: &AuxChannels, layer: &str, sel: &[u32], i: usize) -> ([f32; 3], f32) {
+    let ranks = ranks_by_name(a, layer, i);
+    let m: f32 = ranks.iter().filter(|(id, c)| *c > 0.0 && sel.contains(&id.to_bits())).map(|(_, c)| *c).sum::<f32>().clamp(0.0, 1.0);
+    let mut c = [0.0f32; 3];
+    for (id, cov) in &ranks {
+        let k = id_color(*id);
+        for j in 0..3 {
+            c[j] += k[j] * cov;
+        }
+    }
+    (c, m)
+}
+
+/// A 6×2 Cryptomatte layer with awkward values: NaN, ±inf, negative and -0.0 coverage, NaN
+/// and -0.0 IDs; rank 01 has no B/A pair, rank 02 is missing, so rank 03 (filled with values
+/// that would change every pixel) must be ignored as before.
+fn edge_aux(with_rank_after_gap: bool) -> AuxChannels {
+    let (w, h) = (6u32, 2u32);
+    let nan_payload = f32::from_bits(0x7fc0_1234);
+    let (hs, hc) = (crypto_float(crypto_hash("sphere")), crypto_float(crypto_hash("cube")));
+    let cov = [f32::NAN, f32::INFINITY, f32::NEG_INFINITY, -0.5, -0.0, 0.0, 0.25, 1.0, 2.0, f32::MIN_POSITIVE, nan_payload, 0.5];
+    let ids = [hs, f32::NAN, hc, -0.0, 0.0, nan_payload, hs, hc, f32::NAN, hs, hc, -0.0];
+    let rot = |v: &[f32; 12], k: usize| -> Vec<f32> { (0..12).map(|i| v[(i + k) % 12]).collect() };
+    let mut a = AuxChannels::new(w, h, 1.0);
+    let mut push = |n: &str, v: Vec<f32>| a.channels.push((format!("CryptoObject{n}"), v));
+    push("00.R", rot(&ids, 0));
+    push("00.G", rot(&cov, 0));
+    push("00.B", rot(&ids, 3));
+    push("00.A", rot(&cov, 5));
+    push("01.R", rot(&ids, 7));
+    push("01.G", rot(&cov, 2));
+    if with_rank_after_gap {
+        push("03.R", vec![hs; 12]);
+        push("03.G", vec![1.0; 12]);
+        push("03.B", vec![hc; 12]);
+        push("03.A", vec![1.0; 12]);
+    }
+    a
+}
+
+/// The memo hands out exactly `id_color`'s bits for every rank and pixel of the edge values
+/// (NaN IDs with and without a payload, -0.0 and 0.0 are keyed by their bits).
+#[test]
+fn id_color_memo_matches_id_color() {
+    let a = edge_aux(true);
+    let planes = a.crypto_rank_planes("CryptoObject");
+    let mut memo = IdColorMemo::default();
+    for i in 0..12 {
+        for (r, (id, _)) in planes.iter().enumerate() {
+            assert_eq!(memo.get(r, id[i]).map(f32::to_bits), id_color(id[i]).map(f32::to_bits), "pixel {i} rank {r}");
+        }
+    }
+}
+
+fn edge_selection() -> Vec<u32> {
+    vec![crypto_hash("sphere"), f32::NAN.to_bits(), 0x7fc0_1234, (-0.0f32).to_bits()]
+}
+
+/// Edge values give bit-identical results to the lookup by name, the missing B/A pair is
+/// skipped and a rank after a gap is ignored.
+#[test]
+fn crypto_aux_image_is_bit_exact_on_edge_values() {
+    let sel = edge_selection();
+    let a = edge_aux(true);
+    assert_eq!(a.crypto_rank_planes("CryptoObject").len(), 3, "00.R/G, 00.B/A, 01.R/G; not 03 after the gap");
+    let img = crypto_aux_image(&a, "CryptoObject", &sel);
+    let without_gap_rank = crypto_aux_image(&edge_aux(false), "CryptoObject", &sel);
+    for i in 0..12 {
+        let (c, m) = reduce_by_name(&a, "CryptoObject", &sel, i);
+        let want = [c[0], c[1], c[2], m];
+        assert_eq!(img.data[i].map(f32::to_bits), want.map(f32::to_bits), "pixel {i}");
+        assert_eq!(img.data[i].map(f32::to_bits), without_gap_rank.data[i].map(f32::to_bits), "pixel {i}: the rank after the gap was used");
+    }
+}
+
+/// Without the ID colours the matte (A) is bit-identical and the RGB is 0, on the edge values.
+#[test]
+fn crypto_aux_image_without_colors_keeps_the_matte() {
+    let a = edge_aux(true);
+    let sel = edge_selection();
+    let full = crypto_aux_image(&a, "CryptoObject", &sel);
+    let matte = crypto_aux_image_with(&a, "CryptoObject", &sel, CryptoAux::MatteOnly);
+    for (f, m) in full.data.iter().zip(&matte.data) {
+        assert_eq!(f[3].to_bits(), m[3].to_bits());
+        assert_eq!(m[..3], [0.0; 3]);
+    }
+}
+
+/// Only the Colors display without Matte Only reads the ID colours.
+#[test]
+fn crypto_aux_for_display_reads_colors_only_for_the_colors_display() {
+    assert_eq!(CryptoAux::for_display(0, false), CryptoAux::ColorsAndMatte);
+    assert_eq!(CryptoAux::for_display(0, true), CryptoAux::MatteOnly);
+    for display in [1, 2, 3, u32::MAX] {
+        for matte_only in [false, true] {
+            assert_eq!(CryptoAux::for_display(display, matte_only), CryptoAux::MatteOnly, "display {display}");
+        }
+    }
+}
+
+/// The CPU effect on a 20×10 layer over the 6×2 edge aux: pixels inside the aux area match
+/// the lookup by name bit for bit in every display mode, pixels outside it (no aux index)
+/// get an empty matte and no ID colour.
+#[test]
+fn cryptomatte_cpu_path_is_bit_exact_inside_and_outside_the_aux_area() {
+    let a = edge_aux(true);
+    let host = AuxHost(Arc::new(a.clone()));
+    let names = "sphere, <7fc00000>, <7fc01234>, <80000000>";
+    assert_eq!(selection_hashes(names, None), edge_selection());
+    let src = img().data[0];
+    for (display, matte_only, in_alpha) in [(0, false, false), (1, false, false), (2, false, false), (0, true, false), (0, true, true)] {
+        let out = run(
+            "ec.3d.cryptomatte",
+            &[
+                ("selection", Value::Str(names.into())),
+                ("display", Value::Enum(display)),
+                ("matteOnly", Value::Bool(matte_only)),
+                (MATTE_ONLY_IN_ALPHA, Value::Bool(in_alpha)),
+            ],
+            &host,
+        );
+        let expect = |c: [f32; 3], m: f32| -> [f32; 4] {
+            if matte_only {
+                return if in_alpha { [m; 4] } else { [m, m, m, 1.0] };
+            }
+            match display {
+                0 => {
+                    let c = c.map(|v| v * (1.0 - 0.5 * m) + 0.5 * m);
+                    [c[0], c[1], c[2], 1.0]
+                }
+                1 => src.map(|v| v * m),
+                _ => [src[0] * (1.0 - 0.5 * m) + 0.5 * m * src[3], src[1] * (1.0 - 0.5 * m) + 0.5 * m * src[3], src[2] * (1.0 - 0.5 * m), src[3]],
+            }
+        };
+        for (x, y) in [(0u32, 0u32), (1, 0), (5, 0), (0, 1), (3, 1), (5, 1)] {
+            let (c, m) = reduce_by_name(&a, "CryptoObject", &edge_selection(), (y * 6 + x) as usize);
+            assert_eq!(
+                out.get(x as i64, y as i64).map(f32::to_bits),
+                expect(c, m).map(f32::to_bits),
+                "display {display} matteOnly {matte_only} inAlpha {in_alpha} at ({x}, {y})"
+            );
+        }
+        for (x, y) in [(6u32, 0u32), (19, 0), (0, 2), (12, 9)] {
+            assert_eq!(
+                out.get(x as i64, y as i64).map(f32::to_bits),
+                expect([0.0; 3], 0.0).map(f32::to_bits),
+                "display {display} matteOnly {matte_only} inAlpha {in_alpha} outside the aux at ({x}, {y})"
+            );
+        }
+    }
+}
+
+/// #3127: Matte Only shows the matte as After Effects' Cryptomatte plug-in does, in RGB over
+/// alpha 1 (its Matte Only render of 2026-11-05 is opaque black where nothing is selected), not
+/// in alpha. A partly covered pixel is grey, not translucent; the hidden Matte Only In Alpha
+/// switch (on for projects saved before) keeps the old matte in every channel.
+#[test]
+fn cryptomatte_matte_only_is_the_matte_in_rgb_over_alpha_one() {
+    let a = edge_aux(true);
+    let host = AuxHost(Arc::new(a.clone()));
+    let names = "sphere, <7fc00000>, <7fc01234>, <80000000>";
+    let only = |in_alpha: bool| {
+        run(
+            "ec.3d.cryptomatte",
+            &[("selection", Value::Str(names.into())), ("matteOnly", Value::Bool(true)), (MATTE_ONLY_IN_ALPHA, Value::Bool(in_alpha))],
+            &host,
+        )
+    };
+    let (new, old) = (only(false), only(true));
+    let partial = (0..6u32 * 2).map(|i| (i % 6, i / 6)).find(|&(x, y)| {
+        let m = reduce_by_name(&a, "CryptoObject", &edge_selection(), (y * 6 + x) as usize).1;
+        m > 0.0 && m < 1.0
+    });
+    let (x, y) = partial.expect("the edge aux has a partly covered pixel");
+    let m = reduce_by_name(&a, "CryptoObject", &edge_selection(), (y * 6 + x) as usize).1;
+    assert_eq!(new.get(x as i64, y as i64), [m, m, m, 1.0]);
+    assert_eq!(old.get(x as i64, y as i64), [m; 4]);
+    // Outside the aux area (and unselected): opaque black, as After Effects renders it.
+    assert_eq!(new.get(12, 9), [0.0, 0.0, 0.0, 1.0]);
+    assert_eq!(old.get(12, 9), [0.0; 4]);
+    // A fresh instance has the switch off.
+    let spec = crate::find("ec.3d.cryptomatte").unwrap();
+    let ps = spec.params.iter().find(|p| p.id == MATTE_ONLY_IN_ALPHA).expect("the hidden switch");
+    assert_eq!((&ps.default, &ps.ui), (&Value::Bool(false), &ParamUi::Hidden));
+}
+
+#[test]
+fn cryptomatte_selects_by_name_and_wildcard() {
+    let h = scene();
+    let m = run("ec.3d.cryptomatte", &[("selection", Value::Str("right".into())), ("matteOnly", Value::Bool(true))], &h);
+    assert_eq!(m.get(2, 5), [0.0, 0.0, 0.0, 1.0]);
+    assert_eq!(m.get(12, 5), [1.0; 4]);
+    let w = run("ec.3d.cryptomatte", &[("selection", Value::Str("l*".into())), ("display", Value::Enum(1))], &h);
+    assert_eq!(w.get(2, 5)[3], 1.0);
+    assert_eq!(w.get(12, 5)[3], 0.0);
+    assert!(wild("*ight", "right") && wild("r*t", "right") && !wild("x*", "right"));
+    let hex = format!("<{:08x}>", crypto_hash("left"));
+    assert_eq!(selection_hashes(&hex, None), vec![crypto_hash("left")]);
+}
+
+/// Layer Name picks a Cryptomatte layer named in full (`Crypto_Material`, which the Layer popup's
+/// CryptoMaterial does not match); empty or missing it falls back to the Layer popup.
+#[test]
+fn cryptomatte_layer_name_picks_the_named_layer() {
+    let base = scene();
+    let mut a = (*base.0).clone();
+    // A second layer with the IDs swapped: left is on the right half there.
+    let swap = |name: &str| a.channels.iter().find(|(n, _)| n == name).map(|(_, v)| v.clone()).unwrap();
+    let (r, g) = (swap("CryptoObject00.R"), swap("CryptoObject00.G"));
+    let w = 20;
+    let r2: Vec<f32> = (0..r.len()).map(|i| r[(i / w) * w + (w - 1 - i % w)]).collect();
+    a.channels.push(("Crypto_Material00.R".into(), r2));
+    a.channels.push(("Crypto_Material00.G".into(), g));
+    let h = AuxHost(Arc::new(a));
+    let sel = format!("<{:08x}>", crypto_hash("left"));
+    let matte = |vals: &[(&str, Value)]| {
+        let mut v = vec![("selection", Value::Str(sel.clone())), ("matteOnly", Value::Bool(true))];
+        v.extend(vals.iter().cloned());
+        let m = run("ec.3d.cryptomatte", &v, &h);
+        (m.get(2, 5)[0], m.get(17, 5)[0])
+    };
+    assert_eq!(matte(&[("layerName", Value::Str("Crypto_Material".into()))]), (0.0, 1.0), "the named layer");
+    assert_eq!(matte(&[]), (1.0, 0.0), "the Layer popup's CryptoObject");
+    assert_eq!(matte(&[("layerName", Value::Str("Crypto_Name".into()))]), (1.0, 0.0), "a missing name falls back to the popup");
+}
+
+/// Layers whose names differ only in case are different layers: `layerName` "crypto_a" mattes
+/// from crypto_a's own IDs, not from the earlier `Crypto_A`.
+#[test]
+fn cryptomatte_layer_name_is_case_sensitive() {
+    let base = scene();
+    let mut a = (*base.0).clone();
+    let (r, g) = (
+        a.channels.iter().find(|(n, _)| n == "CryptoObject00.R").unwrap().1.clone(),
+        a.channels.iter().find(|(n, _)| n == "CryptoObject00.G").unwrap().1.clone(),
+    );
+    let w = 20;
+    let flipped: Vec<f32> = (0..r.len()).map(|i| r[(i / w) * w + (w - 1 - i % w)]).collect();
+    // `Crypto_A` first, with left/right as in the base scene; `crypto_a` has them swapped.
+    a.channels.push(("Crypto_A00.R".into(), r));
+    a.channels.push(("Crypto_A00.G".into(), g.clone()));
+    a.channels.push(("crypto_a00.r".into(), flipped));
+    a.channels.push(("crypto_a00.g".into(), g));
+    let h = AuxHost(Arc::new(a));
+    let sel = format!("<{:08x}>", crypto_hash("left"));
+    let matte = |name: &str| {
+        let v = [("selection", Value::Str(sel.clone())), ("matteOnly", Value::Bool(true)), ("layerName", Value::Str(name.into()))];
+        let m = run("ec.3d.cryptomatte", &v, &h);
+        (m.get(2, 5)[0], m.get(17, 5)[0])
+    };
+    assert_eq!(matte("Crypto_A"), (1.0, 0.0));
+    assert_eq!(matte("crypto_a"), (0.0, 1.0));
+}
+
+/// #473: a name with a comma in it (Blender allows `Green, Glossy`) is selected when it is
+/// quoted or its comma escaped, instead of being cut into two names that match nothing.
+#[test]
+fn cryptomatte_selection_keeps_quoted_names_with_commas_whole() {
+    let manifest = vec![("Green, Glossy".to_string(), 7), ("Green".to_string(), 1), ("Glossy".to_string(), 2), ("ring".to_string(), 3)];
+    let m = Some(manifest.as_slice());
+    assert_eq!(selection_hashes(r#""Green, Glossy""#, m), vec![7]);
+    assert_eq!(selection_hashes("'Green, Glossy', ring", m), vec![7, 3]);
+    assert_eq!(selection_hashes(r"Green\, Glossy", m), vec![7]);
+    assert_eq!(selection_hashes(r#"ring , "Green, Glossy""#, m), vec![3, 7]);
+    // Without a manifest the whole name is hashed.
+    assert_eq!(selection_hashes(r#""Green, Glossy""#, None), vec![crypto_hash("Green, Glossy")]);
+    // Plain lists, apostrophes inside names and an unclosed quote still parse.
+    assert_eq!(selection_hashes("Green, Glossy", m), vec![1, 2]);
+    assert_eq!(selection_names("Bob's mat, ring"), vec!["Bob's mat", "ring"]);
+    assert_eq!(selection_names(r#""Green, Glossy"#), vec!["Green, Glossy"]);
+    assert_eq!(selection_names(r#"say \"hi\""#), vec![r#"say "hi""#]);
+}
+
+#[test]
+fn fog_and_depth_of_field_follow_depth() {
+    let h = scene();
+    let f = run("ec.3d.fog3d", &[("fogColor", col(1.0, 0.0, 0.0)), ("fogEndDepth", num(1000.0)), ("scatteringDensity", num(0.0))], &h);
+    // Linear fog: 10 % at depth 100, 50 % at 500, full on the background.
+    assert!((f.get(2, 5)[0] - 0.55).abs() < 1e-4, "{:?}", f.get(2, 5));
+    assert!((f.get(12, 5)[0] - 0.75).abs() < 1e-4);
+    assert!((f.get(17, 1)[0] - 1.0).abs() < 1e-4 && f.get(17, 1)[1] < 1e-4);
+    assert!((dof_radius(100.0, 100.0, 0.0, 10.0, 50.0)).abs() < 1e-6);
+    assert!((dof_radius(200.0, 100.0, 0.0, 10.0, 50.0) - 10.0).abs() < 1e-6);
+    assert_eq!(dof_radius(140.0, 100.0, 100.0, 10.0, 50.0), 0.0);
+    // A sharp edge at the far object blurs when focused near.
+    let mut pic = Image::new(20, 10);
+    for y in 0..10 {
+        for x in 0..20 {
+            let v = if x % 2 == 0 { 1.0 } else { 0.0 };
+            pic.set(x, y, [v, v, v, 1.0]);
+        }
+    }
+    let env = EffectEnv { host: Some(&h), ..Default::default() };
+    let d = run_fx("ec.3d.depthoffield", &[("focalPlane", num(100.0)), ("maximumRadius", num(4.0))], pic.clone(), 0.0, env).img;
+    assert_eq!(d.get(4, 5), pic.get(4, 5));
+    assert!((d.get(12, 5)[0] - 0.5).abs() < 0.3 && d.get(12, 5) != pic.get(12, 5));
+}
+
+#[test]
+fn extractor_maps_named_channels() {
+    let h = scene();
+    let o = run("ec.3d.extractor", &[("red", Value::Str("Z".into())), ("whitePoint", num(1000.0))], &h);
+    assert!((o.get(2, 5)[0] - 0.1).abs() < 1e-6);
+    assert!((o.get(2, 5)[1] - 0.0005).abs() < 1e-6);
+    // Without aux: the layer's own channels can be swapped.
+    let s = run_fx("ec.3d.extractor", &[("red", Value::Str("A".into()))], Image::filled(2, 2, [0.2, 0.3, 0.4, 1.0]), 0.0, EffectEnv::default());
+    assert_eq!(s.img.get(0, 0), [1.0, 0.3, 0.4, 1.0]);
+}
+
+/// `(copy)` (After Effects' EXtractoR choice, imported from .aep) is the effect input's own
+/// channel as earlier effects left it, never the OpenEXR's plane of the same name: here the input
+/// buffer differs from the footage's R, G, B and A planes, as after an earlier effect.
+#[test]
+fn extractor_copy_reads_the_current_input_not_the_footage_plane() {
+    let (w, h) = (4usize, 3usize);
+    let mut a = AuxChannels::new(w as u32, h as u32, 1.0);
+    // The file's own planes (what the footage held before any effect) and a depth channel.
+    a.channels = ["R", "G", "B", "A"].iter().map(|n| (n.to_string(), vec![0.9; w * h])).collect();
+    a.channels.push(("Z".into(), vec![0.7; w * h]));
+    let host = AuxHost(Arc::new(a));
+    let env = || EffectEnv { host: Some(&host), ..Default::default() };
+    // The input after an earlier effect: straight (0.2, 0.3, 0.4) at alpha 0.5, premultiplied.
+    let input = Image::filled(w as u32, h as u32, [0.1, 0.15, 0.2, 0.5]);
+    let copy = || Value::Str(EXTRACTOR_COPY.into());
+    // All four `(copy)`: the input unchanged.
+    let all = [("red", copy()), ("green", copy()), ("blue", copy()), ("alpha", copy())];
+    let o = run_fx("ec.3d.extractor", &all, input.clone(), 0.0, env()).img;
+    assert_eq!(o.data, input.data);
+    // Mixed with a named channel (no pass-through): red from Z, green and alpha copied, blue the
+    // footage's B plane.
+    let vals = [("red", Value::Str("Z".into())), ("green", copy()), ("blue", Value::Str("B".into())), ("alpha", copy())];
+    let px = run_fx("ec.3d.extractor", &vals, input.clone(), 0.0, env()).img.get(1, 1);
+    let want = [0.7 * 0.5, 0.3 * 0.5, 0.9 * 0.5, 0.5];
+    for (c, (got, want)) in px.iter().zip(want).enumerate() {
+        assert!((got - want).abs() < 1e-6, "channel {c}: {got} != {want} ({px:?})");
+    }
+    // `A` by name is the footage's alpha plane (0.9), not the input's alpha (0.5).
+    let named = [("alpha", Value::Str("A".into())), ("red", Value::Str("Z".into()))];
+    assert!((run_fx("ec.3d.extractor", &named, input, 0.0, env()).img.get(1, 1)[3] - 0.9).abs() < 1e-6);
+}
+
+#[test]
+fn channel_extract_antialias_averages_sub_pixels() {
+    // Depth at twice the layer resolution, alternating 0 / 1000 per aux column.
+    let mut a = AuxChannels::new(40, 20, 2.0);
+    a.channels = vec![("Z".into(), (0..800).map(|i| if i % 2 == 0 { 0.0 } else { 1000.0 }).collect())];
+    let host = AuxHost(Arc::new(a));
+    let vals = [("blackPoint", num(0.0)), ("whitePoint", num(1000.0))];
+    let hard = run("ec.3d.channelextract", &vals, &host);
+    let v = hard.get(5, 5)[0];
+    assert!(v == 0.0 || v == 1.0, "{v}");
+    let soft = run("ec.3d.channelextract", &[vals.as_slice(), &[("antialias", Value::Bool(true))]].concat(), &host);
+    assert!((soft.get(5, 5)[0] - 0.5).abs() < 1e-5, "{:?}", soft.get(5, 5));
+}
+
+#[test]
+fn instance3d_replaces_the_pixels_with_the_referenced_layer() {
+    // Create 3D Layer Instance's copy: the chosen layer's render takes the place of the layer's
+    // own pixels, alpha included — the copy is transparent where the referenced layer isn't —
+    // and with no layer chosen the layer passes through.
+    struct Host(Image);
+    impl EffectHost for Host {
+        fn layer(&self, id: u64, _: bool) -> Option<LayerPixels> {
+            (id == 7).then(|| LayerPixels { buf: Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 }, size: [self.0.width as f64, self.0.height as f64] })
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+    }
+    let solid = || Image::filled(4, 4, [1.0, 1.0, 1.0, 1.0]);
+    let mut render = Image::new(4, 4);
+    render.set(1, 1, [1.0, 0.0, 0.0, 1.0]);
+    let env = EffectEnv { host: Some(&Host(render)), ..Default::default() };
+    let out = run_fx("ec.3d.instance3d", &[("layer", Value::Layer(Some(7)))], solid(), 0.0, env);
+    assert_eq!(out.img.get(1, 1), [1.0, 0.0, 0.0, 1.0], "the referenced layer's pixel");
+    assert_eq!(out.img.get(3, 3), [0.0; 4], "transparent where the referenced layer isn't");
+    // No layer chosen: the layer's own pixels.
+    let out = run_fx("ec.3d.instance3d", &[], solid(), 0.0, EffectEnv::default());
+    assert_eq!(out.img.data, solid().data);
+}
+
+/// A 20×10 layer of one Cryptomatte layer `name` that holds "left" on its left half and
+/// "right" on its right half, as [`scene`] does for `CryptoObject`.
+fn crypto_only(names: &[&str]) -> AuxHost {
+    let (w, h) = (20usize, 10usize);
+    let mut a = AuxChannels::new(w as u32, h as u32, 1.0);
+    let (hl, hr) = (crypto_hash("left"), crypto_hash("right"));
+    for name in names {
+        let ids: Vec<f32> = (0..w * h).map(|i| crypto_float(if i % w < 10 { hl } else { hr })).collect();
+        a.channels.push((format!("{name}00.R"), ids));
+        a.channels.push((format!("{name}00.G"), vec![1.0; w * h]));
+        a.manifests.push((name.to_string(), vec![("left".into(), hl), ("right".into(), hr)]));
+    }
+    AuxHost(Arc::new(a))
+}
+
+fn choices(names: &[&str]) -> Vec<(usize, String)> {
+    crypto_layer_choices(Some(&crypto_only(names).0))
+}
+
+/// #473: the Layer popup lists the Cryptomatte layers the footage has, and the three standard
+/// ones when there is no footage, no OpenEXR or no Cryptomatte in it.
+#[test]
+fn crypto_layer_popup_lists_the_layers_of_the_footage() {
+    let standard: Vec<(usize, String)> = CRYPTO_LAYERS.iter().enumerate().map(|(i, n)| (i, n.to_string())).collect();
+    assert_eq!(crypto_layer_choices(None), standard);
+    assert_eq!(crypto_layer_choices(Some(&AuxChannels::new(1, 1, 1.0))), standard, "an EXR without Cryptomatte");
+    assert_eq!(crypto_layer_choices(Some(&scene().0)), vec![(0, "CryptoObject".to_string())]);
+    // Only CryptoMaterial: it, not CryptoObject, with its own stored value.
+    assert_eq!(choices(&["CryptoMaterial"]), vec![(1, "CryptoMaterial".to_string())]);
+    // Standard layers come in slot order whatever the names sort like; prefixed ones fill their slot.
+    assert_eq!(choices(&["CryptoAsset", "ViewLayer.CryptoObject"]), vec![(0, "ViewLayer.CryptoObject".to_string()), (2, "CryptoAsset".to_string())]);
+    // A layer under another name gets a value after the standard ones, in name order.
+    assert_eq!(choices(&["Zed", "CryptoMaterial", "Alpha"]), vec![(1, "CryptoMaterial".to_string()), (3, "Alpha".to_string()), (4, "Zed".to_string())]);
+    // A name that only ends in a standard one fills its slot, as the effect always matched it.
+    assert_eq!(
+        choices(&["MyCryptoObject", "ViewLayer.CryptoMaterial", "Other"]),
+        vec![(0, "MyCryptoObject".to_string()), (1, "ViewLayer.CryptoMaterial".to_string()), (3, "Other".to_string())]
+    );
+    // The entry shown: the value's own, else the first layer; with no layers, the standard one.
+    let shown = |names: &[&str], i| crypto_layer_menu(Some(&crypto_only(names).0), i).1;
+    assert_eq!(
+        [0, 1, 7].map(|i| shown(&["CryptoMaterial"], i)),
+        [Some("CryptoMaterial".to_string()), Some("CryptoMaterial".to_string()), Some("CryptoMaterial".to_string())]
+    );
+    assert_eq!(crypto_layer_menu(None, 2).1.as_deref(), Some("CryptoAsset"));
+    assert_eq!(crypto_layer_menu(None, 9).1.as_deref(), Some("CryptoObject"), "a custom value with no footage");
+    // Two layers for one slot: the first keeps it, the next gets a custom value.
+    assert_eq!(choices(&["A.CryptoObject", "B.CryptoObject"]), vec![(0, "A.CryptoObject".to_string()), (3, "B.CryptoObject".to_string())]);
+    assert_eq!(choices(&["A.CryptoObject", "B.CryptoObject", "C.CryptoObject", "Mine"]).iter().map(|c| c.0).collect::<Vec<_>>(), [0, 3, 4, 5]);
+}
+
+/// A project saved with Layer = CryptoObject / CryptoMaterial / CryptoAsset renders the same layer
+/// as before: the stored value's own layer, else the file's first; and the custom layers are read
+/// by their value.
+#[test]
+fn crypto_layer_values_keep_their_meaning() {
+    let all = crypto_only(&["CryptoAsset", "CryptoMaterial", "CryptoObject", "Mine"]).0;
+    let name = |i| crypto_layer_name(&all, i);
+    assert_eq!([0, 1, 2, 3].map(name), ["CryptoObject", "CryptoMaterial", "CryptoAsset", "Mine"].map(|n| Some(n.to_string())));
+    // A value the file has no layer for reads its first layer, as the effect always did.
+    assert_eq!(name(4).as_deref(), Some("CryptoAsset"));
+    let only = crypto_only(&["CryptoMaterial"]).0;
+    assert_eq!(
+        [0, 1, 2].map(|i| crypto_layer_name(&only, i)),
+        [Some("CryptoMaterial".to_string()), Some("CryptoMaterial".to_string()), Some("CryptoMaterial".to_string())]
+    );
+    assert_eq!(crypto_layer_name(&AuxChannels::new(1, 1, 1.0), 0), None);
+}
+
+/// The effect keys the layer the Layer value names: a Material-only file renders its matte
+/// whether Layer says Object (a saved project) or Material (what the popup now stores), and a
+/// custom layer by its own value.
+#[test]
+fn cryptomatte_renders_the_layer_the_value_names() {
+    let sel = ("selection", Value::Str("left".into()));
+    let matte = |layer: u32, host: &AuxHost| run("ec.3d.cryptomatte", &[("layer", Value::Enum(layer)), sel.clone(), ("display", Value::Enum(1))], host);
+    let only = crypto_only(&["CryptoMaterial"]);
+    let (old, new) = (matte(0, &only), matte(1, &only));
+    assert_eq!(old.data, new.data);
+    assert_eq!((new.get(2, 5)[3], new.get(12, 5)[3]), (1.0, 0.0));
+    // Two layers: "left" is in both, under hashes the manifests share, so tell them apart by
+    // which has it on the right half.
+    let (hl, hr) = (crypto_hash("left"), crypto_hash("right"));
+    let mut a = AuxChannels::new(20, 10, 1.0);
+    for (name, flip) in [("CryptoObject", false), ("Mine", true)] {
+        let ids: Vec<f32> = (0..200).map(|i| crypto_float(if (i % 20 < 10) != flip { hl } else { hr })).collect();
+        a.channels.push((format!("{name}00.R"), ids));
+        a.channels.push((format!("{name}00.G"), vec![1.0; 200]));
+    }
+    let two = AuxHost(Arc::new(a));
+    let (object, mine) = (matte(0, &two), matte(3, &two));
+    assert_eq!((object.get(2, 5)[3], object.get(12, 5)[3]), (1.0, 0.0));
+    assert_eq!((mine.get(2, 5)[3], mine.get(12, 5)[3]), (0.0, 1.0), "Layer 3 is the custom layer");
+    // A second view's layer of a standard kind is selectable too: B.CryptoObject is Layer 3.
+    let mut a = AuxChannels::new(20, 10, 1.0);
+    for (name, flip) in [("A.CryptoObject", false), ("B.CryptoObject", true)] {
+        let ids: Vec<f32> = (0..200).map(|i| crypto_float(if (i % 20 < 10) != flip { hl } else { hr })).collect();
+        a.channels.push((format!("{name}00.R"), ids));
+        a.channels.push((format!("{name}00.G"), vec![1.0; 200]));
+    }
+    let views = AuxHost(Arc::new(a));
+    assert_eq!(crypto_layer_name(&views.0, 0).as_deref(), Some("A.CryptoObject"));
+    assert_eq!(crypto_layer_name(&views.0, 3).as_deref(), Some("B.CryptoObject"));
+    let (first, second) = (matte(0, &views), matte(3, &views));
+    assert_eq!((first.get(2, 5)[3], first.get(12, 5)[3]), (1.0, 0.0));
+    assert_eq!((second.get(2, 5)[3], second.get(12, 5)[3]), (0.0, 1.0), "Layer 3 renders B");
+}
+
+/// #474: [`reads_aux`] names exactly the 3D Channel effects that ask the host for channels.
+#[test]
+fn reads_aux_names_the_effects_that_read_channels() {
+    struct Counting(AuxHost, std::sync::atomic::AtomicUsize);
+    impl EffectHost for Counting {
+        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn aux(&self) -> Option<Arc<AuxChannels>> {
+            self.1.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            self.0.aux()
+        }
+    }
+    for s in specs() {
+        let host = Counting(scene(), Default::default());
+        run_fx(s.id, &[], img(), 0.0, EffectEnv { host: Some(&host), ..Default::default() });
+        assert_eq!(host.1.into_inner() > 0, reads_aux(s.id), "{}", s.id);
+    }
+    assert!(READS_AUX.iter().all(|id| specs().iter().any(|s| s.id == *id)), "every listed effect exists");
+}
diff --git a/crates/effects/src/color2.rs b/crates/effects/src/color2.rs
index 71dee87b4..6639e649e 100644
--- a/crates/effects/src/color2.rs
+++ b/crates/effects/src/color2.rs
@@ -55,6 +55,17 @@ impl Curve {
     /// Parse "x,y x,y …" (separators: whitespace or ';'). Returns None for an identity curve or
     /// fewer than two valid points.
     pub fn parse(s: &str) -> Option<Curve> {
+        Self::parse_with(s, false)
+    }
+
+    /// [`Curve::parse`] interpolated as After Effects' Curves effect does: a natural cubic spline
+    /// through the points, clamped to 0..1 (AE 2026: RGB points (0,0) (125,199) (255,255) and
+    /// Red (0,0) (128,44) (255,255) map every grey step exactly as the natural spline does).
+    pub fn parse_natural(s: &str) -> Option<Curve> {
+        Self::parse_with(s, true)
+    }
+
+    fn parse_with(s: &str, natural: bool) -> Option<Curve> {
         let mut pts: Vec<(f32, f32)> = s
             .split(|c: char| c.is_whitespace() || c == ';')
             .filter(|t| !t.is_empty())
@@ -74,6 +85,12 @@ impl Curve {
         let ys: Vec<f32> = pts.iter().map(|p| p.1).collect();
         let n = xs.len();
         let d: Vec<f32> = (0..n - 1).map(|k| (ys[k + 1] - ys[k]) / (xs[k + 1] - xs[k])).collect();
+        if natural {
+            let ms = natural_slopes(&xs, &d);
+            let mut c = Curve { xs, ys, ms, lut: Vec::new() };
+            c.lut = (0..=LUT_N).map(|i| c.eval_exact(i as f32 / LUT_N as f32).clamp(0.0, 1.0)).collect();
+            return Some(c);
+        }
         let mut ms = vec![0.0f32; n];
         ms[0] = d[0];
         ms[n - 1] = d[n - 2];
@@ -136,6 +153,40 @@ impl Curve {
     }
 }
 
+/// Knot slopes of the natural cubic spline (zero curvature at both ends) through points with
+/// abscissae `xs` and segment slopes `d`; as Hermite tangents they reproduce the spline exactly.
+fn natural_slopes(xs: &[f32], d: &[f32]) -> Vec<f32> {
+    let n = xs.len();
+    if n < 3 {
+        return vec![d.first().copied().unwrap_or(0.0); n];
+    }
+    let h: Vec<f64> = (0..n - 1).map(|k| f64::from(xs[k + 1] - xs[k])).collect();
+    let dd: Vec<f64> = d.iter().map(|&v| f64::from(v)).collect();
+    // Second derivatives M[1..n-1] (M[0] = M[n-1] = 0): tridiagonal system, Thomas algorithm.
+    let m = n - 2;
+    let (mut a, mut b, mut c, mut r) = (vec![0.0; m], vec![0.0; m], vec![0.0; m], vec![0.0; m]);
+    for i in 0..m {
+        let k = i + 1;
+        a[i] = h[k - 1];
+        b[i] = 2.0 * (h[k - 1] + h[k]);
+        c[i] = h[k];
+        r[i] = 6.0 * (dd[k] - dd[k - 1]);
+    }
+    for i in 1..m {
+        let w = a[i] / b[i - 1];
+        b[i] -= w * c[i - 1];
+        r[i] -= w * r[i - 1];
+    }
+    let mut sec = vec![0.0f64; n];
+    for i in (0..m).rev() {
+        let next = if i + 1 < m { sec[i + 2] } else { 0.0 };
+        sec[i + 1] = (r[i] - c[i] * next) / b[i];
+    }
+    let mut ms: Vec<f32> = (0..n - 1).map(|k| (dd[k] - h[k] * (2.0 * sec[k] + sec[k + 1]) / 6.0) as f32).collect();
+    ms.push((dd[n - 2] + h[n - 2] * (sec[n - 2] + 2.0 * sec[n - 1]) / 6.0) as f32);
+    ms
+}
+
 fn ev(c: &Option<Curve>, v: f32) -> f32 {
     c.as_ref().map(|c| c.eval(v)).unwrap_or(v)
 }
@@ -145,7 +196,7 @@ fn ev(c: &Option<Curve>, v: f32) -> f32 {
 /// sorted on load); the default `"0,0 1,1"` is the identity. Colour channels go through the
 /// master RGB curve first, then their own curve.
 fn curves(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let [m, r, g, bl, a] = ["rgb", "red", "green", "blue", "alpha"].map(|id| Curve::parse(ctx.params.s(id)));
+    let [m, r, g, bl, a] = ["rgb", "red", "green", "blue", "alpha"].map(|id| Curve::parse_natural(ctx.params.s(id)));
     if m.is_none() && r.is_none() && g.is_none() && bl.is_none() && a.is_none() {
         return b;
     }
@@ -201,7 +252,7 @@ impl Lv {
         if clip_w {
             t = t.min(1.0);
         }
-        self.ob + (self.ow - self.ob) * t.max(0.0).powf(1.0 / self.g.max(0.01))
+        self.ob + (self.ow - self.ob) * crate::color_fx::levels_gamma(t, self.g.max(0.01))
     }
 }
 
@@ -217,7 +268,10 @@ fn levels_ic(ctx: &EffectCtx, mut b: Buf) -> Buf {
         return b;
     }
     let clip = crate::color_fx::levels_clip(ctx);
-    map_ca(&mut b.img, |c, a| ([0, 1, 2].map(|i| lv[i + 1].apply(lv[0].apply(c[i], clip), clip)), lv[4].apply(a, clip).clamp(0.0, 1.0)));
+    // Each channel's own controls first, then the RGB controls: After Effects 2026 with RGB
+    // (0.1, 0.9, gamma 1.5, 0.05, 0.95) and Green Input White 0.8 maps grey 32/255 to green
+    // 52/255 (RGB first would give 45).
+    map_ca(&mut b.img, |c, a| ([0, 1, 2].map(|i| lv[0].apply(lv[i + 1].apply(c[i], clip), clip)), lv[4].apply(a, clip).clamp(0.0, 1.0)));
     b
 }
 
@@ -824,7 +878,7 @@ fn broadcast_colors(ctx: &EffectCtx, mut b: Buf) -> Buf {
 }
 
 // ---------------------------------------------------------------------------------------------
-// CC Toner, CC Color Offset, CC Kernel
+// Multi-Tone Tint, Channel Offset, Convolution Kernel
 
 fn cc_toner(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let g = |id: &str| {
@@ -1047,7 +1101,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.color.cctoner",
-            "CC Toner",
+            "Multi-Tone Tint",
             vec![
                 p("tones", "Tones", Value::Enum(1), popup(&["Duotone", "Tritone", "Pentone"])),
                 p("highlights", "Highlights", col(1.0, 1.0, 1.0), ParamUi::Color),
@@ -1061,7 +1115,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.color.cccoloroffset",
-            "CC Color Offset",
+            "Channel Offset",
             vec![
                 p("redPhase", "Red Phase", num(0.0), ParamUi::Angle),
                 p("greenPhase", "Green Phase", num(0.0), ParamUi::Angle),
@@ -1070,272 +1124,9 @@ pub fn specs() -> Vec<EffectSpec> {
             ],
             cc_color_offset,
         ),
-        spec("ec.color.cckernel", "CC Kernel", k_params, cc_kernel),
+        spec("ec.color.cckernel", "Convolution Kernel", k_params, cc_kernel),
     ]
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{Params, find};
-
-    fn run(id: &str, img: &Image, over: &[(&str, Value)]) -> Image {
-        let s = find(id).unwrap();
-        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        for (k, v) in over {
-            params.values.insert(k.to_string(), v.clone());
-        }
-        let ctx =
-            EffectCtx { params: &params, time: 0.0, layer_size: [img.width as f64, img.height as f64], seed: 1, adjustment: false, env: Default::default() };
-        (s.render)(&ctx, Buf { img: img.clone(), offset: [0.0, 0.0], scale: 1.0 }).img
-    }
-
-    fn ramp() -> Image {
-        let mut img = Image::new(16, 8);
-        for y in 0..8 {
-            for x in 0..16 {
-                let v = x as f32 / 15.0;
-                let a = if y == 0 { 0.5 } else { 1.0 };
-                img.set(x, y, [v * a, (1.0 - v) * a, 0.3 * a, a]);
-            }
-        }
-        img
-    }
-
-    fn close(a: &Image, b: &Image, eps: f32) -> bool {
-        a.data.iter().zip(&b.data).all(|(p, q)| (0..4).all(|i| (p[i] - q[i]).abs() <= eps))
-    }
-
-    #[test]
-    fn curve_parsing() {
-        assert!(Curve::parse("0,0 1,1").is_none());
-        assert!(Curve::parse("garbage").is_none());
-        let c = Curve::parse("1,1; 0,0 0.5,0.7").unwrap();
-        assert_eq!(c.xs, vec![0.0, 0.5, 1.0]);
-        assert!((c.eval(0.5) - 0.7).abs() < 1e-3);
-        // Monotone: never decreases.
-        let mut last = -1.0;
-        for i in 0..=100 {
-            let v = c.eval(i as f32 / 100.0);
-            assert!(v >= last - 1e-6);
-            last = v;
-        }
-    }
-
-    #[test]
-    fn curves_identity_is_identity() {
-        let img = ramp();
-        assert_eq!(run("ec.color.curves", &img, &[]), img);
-        let explicit = run("ec.color.curves", &img, &[("rgb", Value::Str("0,0 0.25,0.25 1,1".into()))]);
-        assert!(close(&explicit, &img, 1e-4));
-    }
-
-    #[test]
-    fn curves_midpoint_brightens() {
-        let img = Image::filled(4, 4, [0.5, 0.5, 0.5, 1.0]);
-        let out = run("ec.color.curves", &img, &[("rgb", Value::Str("0,0 0.5,0.75 1,1".into()))]);
-        assert!((out.data[0][0] - 0.75).abs() < 1e-3);
-        let red = run("ec.color.curves", &img, &[("red", Value::Str("0,1 1,1".into()))]);
-        assert!((red.data[0][0] - 1.0).abs() < 1e-4 && (red.data[0][1] - 0.5).abs() < 1e-6);
-    }
-
-    #[test]
-    fn levels_ic_identity_and_red_only() {
-        let img = ramp();
-        assert_eq!(run("ec.color.levelsic", &img, &[]), img);
-        let out = run("ec.color.levelsic", &img, &[("red/redOutWhite", num(0.5))]);
-        let p = out.get(15, 3);
-        assert!((p[0] - 0.5).abs() < 1e-4 && (p[1] - 0.0).abs() < 1e-4);
-    }
-
-    #[test]
-    fn auto_levels_stretches_low_contrast() {
-        let mut img = Image::new(32, 4);
-        for y in 0..4 {
-            for x in 0..32 {
-                let v = 0.4 + 0.2 * x as f32 / 31.0;
-                img.set(x, y, [v, v, v, 1.0]);
-            }
-        }
-        let out = run("ec.color.autolevels", &img, &[("blackClip", num(0.0)), ("whiteClip", num(0.0))]);
-        let lo = out.data.iter().map(|p| p[0]).fold(1.0, f32::min);
-        let hi = out.data.iter().map(|p| p[0]).fold(0.0, f32::max);
-        assert!(lo < 0.02 && hi > 0.98, "{lo} {hi}");
-        let ac = run("ec.color.autocontrast", &img, &[("blackClip", num(0.0)), ("whiteClip", num(0.0))]);
-        assert!(ac.data.iter().map(|p| p[0]).fold(0.0, f32::max) > 0.98);
-    }
-
-    #[test]
-    fn auto_color_neutralises_cast() {
-        let mut img = Image::new(16, 4);
-        for y in 0..4 {
-            for x in 0..16 {
-                let v = x as f32 / 15.0;
-                img.set(x, y, [v * 0.6 + 0.1, v * 0.9, v * 0.5, 1.0]);
-            }
-        }
-        let out = run("ec.color.autocolor", &img, &[]);
-        let p = out.get(8, 1);
-        assert!((p[0] - p[1]).abs() < 0.08 && (p[1] - p[2]).abs() < 0.08, "{p:?}");
-    }
-
-    #[test]
-    fn equalize_flattens_histogram() {
-        let mut img = Image::new(64, 1);
-        for x in 0..64 {
-            let v = if x < 48 { 0.1 + x as f32 * 0.001 } else { 0.9 };
-            img.set(x, 0, [v, v, v, 1.0]);
-        }
-        let out = run("ec.color.equalize", &img, &[]);
-        // The crowded dark values are spread across the range.
-        assert!(out.get(47, 0)[0] > 0.6, "{}", out.get(47, 0)[0]);
-        assert!(out.get(0, 0)[0] < 0.1);
-        assert_eq!(run("ec.color.equalize", &img, &[("amount", num(0.0))]), img);
-    }
-
-    #[test]
-    fn selective_color_zero_is_identity_and_reds_respond() {
-        let img = ramp();
-        assert_eq!(run("ec.color.selectivecolor", &img, &[]), img);
-        let red = Image::filled(2, 2, [1.0, 0.1, 0.1, 1.0]);
-        let out = run("ec.color.selectivecolor", &red, &[("details/reds/redsCyan", num(100.0)), ("method", Value::Enum(1))]);
-        assert!(out.data[0][0] < 0.3, "{:?}", out.data[0]);
-        let blue = Image::filled(2, 2, [0.1, 0.1, 1.0, 1.0]);
-        assert_eq!(run("ec.color.selectivecolor", &blue, &[("details/reds/redsCyan", num(100.0))]), blue);
-    }
-
-    #[test]
-    fn color_offset_full_turn_is_identity() {
-        let img = ramp();
-        let out = run("ec.color.cccoloroffset", &img, &[("redPhase", num(360.0)), ("greenPhase", num(720.0))]);
-        assert_eq!(out, img);
-        let out = run("ec.color.cccoloroffset", &img, &[("redPhase", num(180.0))]);
-        assert!((out.get(0, 3)[0] - 0.5).abs() < 1e-4);
-    }
-
-    #[test]
-    fn broadcast_reduces_unsafe_color() {
-        let img = Image::filled(2, 2, [1.0, 1.0, 0.0, 1.0]);
-        let out = run("ec.color.broadcast", &img, &[]);
-        assert!(out.data[0][0] < 1.0);
-        let key = run("ec.color.broadcast", &img, &[("howToMakeSafe", Value::Enum(2))]);
-        assert_eq!(key.data[0][3], 0.0);
-        let gray = Image::filled(2, 2, [0.5, 0.5, 0.5, 1.0]);
-        assert_eq!(run("ec.color.broadcast", &gray, &[]), gray);
-    }
-
-    #[test]
-    fn color_balance_hls_zero_identity_and_hue_shift() {
-        let img = ramp();
-        assert_eq!(run("ec.color.colorbalancehls", &img, &[]), img);
-        let red = Image::filled(1, 1, [1.0, 0.0, 0.0, 1.0]);
-        let out = run("ec.color.colorbalancehls", &red, &[("hue", num(120.0))]);
-        assert!(out.data[0][1] > 0.99 && out.data[0][0] < 0.01);
-    }
-
-    #[test]
-    fn color_link_fills_with_average_keeping_alpha() {
-        let mut img = Image::new(2, 1);
-        img.set(0, 0, [1.0, 0.0, 0.0, 1.0]);
-        img.set(1, 0, [0.0, 0.0, 0.5, 0.5]);
-        let out = run("ec.color.colorlink", &img, &[]);
-        assert!((out.data[1][3] - 0.5).abs() < 1e-5);
-        let (c, _) = unpremul(out.data[0]);
-        assert!((c[0] - 2.0 / 3.0).abs() < 1e-3 && (c[2] - 1.0 / 3.0).abs() < 1e-3, "{c:?}");
-    }
-
-    #[test]
-    fn cc_kernel_identity_and_toner_duotone() {
-        let img = ramp();
-        assert_eq!(run("ec.color.cckernel", &img, &[]), img);
-        let g = Image::filled(1, 1, [0.5, 0.5, 0.5, 1.0]);
-        let t = run("ec.color.cctoner", &g, &[("tones", Value::Enum(0)), ("highlights", col(1.0, 0.0, 0.0))]);
-        assert!((t.data[0][0] - 0.5).abs() < 1e-3 && t.data[0][1] < 1e-3);
-    }
-
-    #[test]
-    fn shadow_highlight_lifts_shadows() {
-        let img = Image::filled(8, 8, [0.1, 0.1, 0.1, 1.0]);
-        let out = run("ec.color.shadowhighlight", &img, &[("autoAmounts", Value::Bool(false))]);
-        assert!(out.data[0][0] > 0.15);
-    }
-
-    #[test]
-    fn levels_ic_clip_popups() {
-        let img = Image::filled(2, 2, [0.9, 0.9, 0.9, 1.0]);
-        let lv = [("rgb/rgbInWhite", num(0.5))];
-        assert!((run("ec.color.levelsic", &img, &lv).data[0][0] - 1.0).abs() < 1e-6);
-        let off = [("rgb/rgbInWhite", num(0.5)), ("clipToOutputWhite", Value::Enum(0))];
-        assert!(run("ec.color.levelsic", &img, &off).data[0][0] > 1.5);
-    }
-
-    /// A host whose other layers and other frames are a fixed image.
-    struct ImgHost(Image);
-    impl crate::EffectHost for ImgHost {
-        fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
-            Some(crate::LayerPixels { buf: Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 }, size: [2.0, 2.0] })
-        }
-        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-            None
-        }
-        fn self_at(&self, _: f64, _: usize) -> Option<Buf> {
-            Some(Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 })
-        }
-    }
-
-    fn run_host(id: &str, img: &Image, over: &[(&str, Value)], host: &ImgHost) -> Image {
-        let env = crate::EffectEnv { host: Some(host), frame_rate: 10.0, ..Default::default() };
-        crate::run_fx(id, over, img.clone(), 1.0, env).img
-    }
-
-    #[test]
-    fn color_link_samples_clip_and_source_layer() {
-        let mut img = Image::new(5, 1);
-        for (x, v) in [0.0f32, 0.1, 0.2, 0.3, 1.0].iter().enumerate() {
-            img.set(x as u32, 0, [*v, *v, *v, 1.0]);
-        }
-        // Median ignores the outlier the average follows.
-        let med = run("ec.color.colorlink", &img, &[("sampleSource", Value::Enum(1))]);
-        assert!((med.data[0][0] - 0.2).abs() < 1e-5);
-        // Brightest with 20 % clip skips the brightest pixel.
-        let br = run("ec.color.colorlink", &img, &[("sampleSource", Value::Enum(2)), ("clip", num(20.0))]);
-        assert!((br.data[0][0] - 0.3).abs() < 1e-5);
-        // Min Alpha of a half-transparent source layer sets the alpha.
-        let host = ImgHost(Image::filled(2, 2, [0.25, 0.25, 0.25, 0.5]));
-        let out = run_host("ec.color.colorlink", &img, &[("sourceLayer", Value::Layer(Some(9))), ("sampleSource", Value::Enum(9))], &host);
-        assert!((out.data[4][3] - 0.5).abs() < 1e-5);
-        // Average of the source layer (not the effect's own pixels).
-        let out = run_host("ec.color.colorlink", &img, &[("sourceLayer", Value::Layer(Some(9)))], &host);
-        assert!((out.data[4][0] - 0.5).abs() < 1e-5);
-    }
-
-    #[test]
-    fn auto_levels_temporal_smoothing_reads_neighbour_frames() {
-        let mut img = Image::new(4, 1);
-        for x in 0..4 {
-            let v = 0.3 + 0.1 * x as f32;
-            img.set(x, 0, [v, v, v, 1.0]);
-        }
-        let wide = ImgHost(ramp());
-        let p0 = [("blackClip", num(0.0)), ("whiteClip", num(0.0))];
-        let alone = run_host("ec.color.autolevels", &img, &p0, &wide);
-        let smooth = run_host("ec.color.autolevels", &img, &[p0[0].clone(), p0[1].clone(), ("temporalSmoothing", num(0.2))], &wide);
-        // Alone the frame is stretched to full range; with full-range neighbours much less.
-        assert!(alone.data[0][0] < 0.01);
-        assert!(smooth.data[0][0] > 0.1, "{:?}", smooth.data[0]);
-    }
-
-    #[test]
-    fn shadow_highlight_clip_keeps_the_tonal_range() {
-        let img = ramp();
-        let lift = [("autoAmounts", Value::Bool(false)), ("shadowAmount", num(80.0))];
-        let unclipped = run(
-            "ec.color.shadowhighlight",
-            &img,
-            &[lift[0].clone(), lift[1].clone(), ("moreOptions/blackClip", num(0.0)), ("moreOptions/whiteClip", num(0.0))],
-        );
-        let clipped = run("ec.color.shadowhighlight", &img, &[lift[0].clone(), lift[1].clone(), ("moreOptions/blackClip", num(1.0))]);
-        let min = |im: &Image| im.data.iter().filter(|p| p[3] > 0.99).map(|p| luminance(p[0], p[1], p[2])).fold(f32::MAX, f32::min);
-        assert!(min(&clipped) < min(&unclipped));
-    }
-}
+mod tests;
diff --git a/crates/effects/src/color2/tests.rs b/crates/effects/src/color2/tests.rs
new file mode 100644
index 000000000..5f57692a0
--- /dev/null
+++ b/crates/effects/src/color2/tests.rs
@@ -0,0 +1,338 @@
+use super::*;
+use crate::{Params, find};
+
+fn run(id: &str, img: &Image, over: &[(&str, Value)]) -> Image {
+    let s = find(id).unwrap();
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    for (k, v) in over {
+        params.values.insert(k.to_string(), v.clone());
+    }
+    let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [img.width as f64, img.height as f64], seed: 1, adjustment: false, env: Default::default() };
+    (s.render)(&ctx, Buf { img: img.clone(), offset: [0.0, 0.0], scale: 1.0 }).img
+}
+
+fn ramp() -> Image {
+    let mut img = Image::new(16, 8);
+    for y in 0..8 {
+        for x in 0..16 {
+            let v = x as f32 / 15.0;
+            let a = if y == 0 { 0.5 } else { 1.0 };
+            img.set(x, y, [v * a, (1.0 - v) * a, 0.3 * a, a]);
+        }
+    }
+    img
+}
+
+fn close(a: &Image, b: &Image, eps: f32) -> bool {
+    a.data.iter().zip(&b.data).all(|(p, q)| (0..4).all(|i| (p[i] - q[i]).abs() <= eps))
+}
+
+#[test]
+fn curve_parsing() {
+    assert!(Curve::parse("0,0 1,1").is_none());
+    assert!(Curve::parse("garbage").is_none());
+    let c = Curve::parse("1,1; 0,0 0.5,0.7").unwrap();
+    assert_eq!(c.xs, vec![0.0, 0.5, 1.0]);
+    assert!((c.eval(0.5) - 0.7).abs() < 1e-3);
+    // Monotone: never decreases.
+    let mut last = -1.0;
+    for i in 0..=100 {
+        let v = c.eval(i as f32 / 100.0);
+        assert!(v >= last - 1e-6);
+        last = v;
+    }
+}
+
+#[test]
+fn curves_identity_is_identity() {
+    let img = ramp();
+    assert_eq!(run("ec.color.curves", &img, &[]), img);
+    let explicit = run("ec.color.curves", &img, &[("rgb", Value::Str("0,0 0.25,0.25 1,1".into()))]);
+    assert!(close(&explicit, &img, 1e-4));
+}
+
+#[test]
+fn curves_midpoint_brightens() {
+    let img = Image::filled(4, 4, [0.5, 0.5, 0.5, 1.0]);
+    let out = run("ec.color.curves", &img, &[("rgb", Value::Str("0,0 0.5,0.75 1,1".into()))]);
+    assert!((out.data[0][0] - 0.75).abs() < 1e-3);
+    let red = run("ec.color.curves", &img, &[("red", Value::Str("0,1 1,1".into()))]);
+    assert!((red.data[0][0] - 1.0).abs() < 1e-4 && (red.data[0][1] - 0.5).abs() < 1e-6);
+}
+
+/// After Effects 2026, 32 bpc project, Levels (Individual Controls) with RGB Input Black 0.1,
+/// Input White 0.9, Gamma 1.5, Output Black 0.05, Output White 0.95, Red Gamma 0.8, Green
+/// Input White 0.8, Blue Output Black 0.2, both clips "Off for 32 bpc Color", on grey steps:
+/// the channel controls run first, nothing clips (8-bit captures clamp the results).
+#[test]
+fn levels_ic_matches_after_effects_in_32_bpc() {
+    let steps = [0, 16, 32, 64, 96, 128, 160, 192, 224, 255];
+    let ae = [
+        [0, 0, 70],
+        [0, 0, 88],
+        [0, 52, 104],
+        [61, 108, 132],
+        [102, 150, 158],
+        [138, 187, 181],
+        [171, 220, 203],
+        [203, 250, 223],
+        [233, 255, 243],
+        [255, 255, 255],
+    ];
+    let mut img = Image::new(10, 1);
+    for (x, v) in steps.iter().enumerate() {
+        let v = *v as f32 / 255.0;
+        img.set(x as u32, 0, [v, v, v, 1.0]);
+    }
+    let vals = [
+        ("rgb/rgbInBlack", Value::Scalar(0.1)),
+        ("rgb/rgbInWhite", Value::Scalar(0.9)),
+        ("rgb/rgbGamma", Value::Scalar(1.5)),
+        ("rgb/rgbOutBlack", Value::Scalar(0.05)),
+        ("rgb/rgbOutWhite", Value::Scalar(0.95)),
+        ("red/redGamma", Value::Scalar(0.8)),
+        ("green/greenInWhite", Value::Scalar(0.8)),
+        ("blue/blueOutBlack", Value::Scalar(0.2)),
+    ];
+    let s = find("ec.color.levelsic").unwrap();
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    for (k, v) in &vals {
+        params.values.insert(k.to_string(), v.clone());
+    }
+    let render = |float_depth: bool| {
+        let env = crate::EffectEnv { float_depth, ..Default::default() };
+        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [10.0, 1.0], seed: 1, adjustment: false, env };
+        (s.render)(&ctx, Buf { img: img.clone(), offset: [0.0, 0.0], scale: 1.0 }).img
+    };
+    let out = render(true);
+    for (x, want) in ae.iter().enumerate() {
+        let p = out.get(x as i64, 0);
+        for c in 0..3 {
+            let got = p[c].clamp(0.0, 1.0) * 255.0;
+            assert!((got - want[c] as f32).abs() <= 2.0, "step {} channel {c}: {got} vs AE {}", steps[x], want[c]);
+        }
+    }
+    // In 8 / 16 bpc "Off for 32 bpc Color" clips: black stops at Output Black.
+    let clipped = render(false);
+    assert!((clipped.get(0, 0)[0] - 0.05).abs() < 1e-5, "{:?}", clipped.get(0, 0));
+}
+
+/// After Effects 2026 (cases 962 / 963): Curves through RGB (0,0) (125,199)
+/// (255,255) and Red (0,0) (128,44) (255,255) on grey steps 0..255, 8-bit results.
+#[test]
+fn curves_follow_a_natural_spline_as_in_after_effects() {
+    let steps = [0u8, 16, 32, 64, 96, 128, 160, 192, 224, 255];
+    let mut img = Image::new(10, 1);
+    for (x, v) in steps.iter().enumerate() {
+        let v = *v as f32 / 255.0;
+        img.set(x as u32, 0, [v, v, v, 1.0]);
+    }
+    let p = |pts: &[(f32, f32)]| Value::Str(pts.iter().map(|(x, y)| format!("{},{}", x / 255.0, y / 255.0)).collect::<Vec<_>>().join(" "));
+    let rgb = run("ec.color.curves", &img, &[("rgb", p(&[(0.0, 0.0), (125.0, 199.0), (255.0, 255.0)]))]);
+    let red = run("ec.color.curves", &img, &[("red", p(&[(0.0, 0.0), (128.0, 44.0), (255.0, 255.0)]))]);
+    let ae_rgb = [0, 30, 59, 115, 164, 202, 227, 242, 250, 255];
+    let ae_red = [0, 0, 1, 6, 19, 44, 83, 135, 194, 255];
+    for x in 0..10 {
+        let g = (rgb.get(x as i64, 0)[1] * 255.0).round() as i32;
+        let r = (red.get(x as i64, 0)[0] * 255.0).round() as i32;
+        assert!((g - ae_rgb[x]).abs() <= 1, "RGB step {}: {g} vs AE {}", steps[x], ae_rgb[x]);
+        assert!((r - ae_red[x]).abs() <= 1, "Red step {}: {r} vs AE {}", steps[x], ae_red[x]);
+    }
+}
+
+#[test]
+fn levels_ic_identity_and_red_only() {
+    let img = ramp();
+    assert_eq!(run("ec.color.levelsic", &img, &[]), img);
+    let out = run("ec.color.levelsic", &img, &[("red/redOutWhite", num(0.5))]);
+    let p = out.get(15, 3);
+    assert!((p[0] - 0.5).abs() < 1e-4 && (p[1] - 0.0).abs() < 1e-4);
+}
+
+#[test]
+fn auto_levels_stretches_low_contrast() {
+    let mut img = Image::new(32, 4);
+    for y in 0..4 {
+        for x in 0..32 {
+            let v = 0.4 + 0.2 * x as f32 / 31.0;
+            img.set(x, y, [v, v, v, 1.0]);
+        }
+    }
+    let out = run("ec.color.autolevels", &img, &[("blackClip", num(0.0)), ("whiteClip", num(0.0))]);
+    let lo = out.data.iter().map(|p| p[0]).fold(1.0, f32::min);
+    let hi = out.data.iter().map(|p| p[0]).fold(0.0, f32::max);
+    assert!(lo < 0.02 && hi > 0.98, "{lo} {hi}");
+    let ac = run("ec.color.autocontrast", &img, &[("blackClip", num(0.0)), ("whiteClip", num(0.0))]);
+    assert!(ac.data.iter().map(|p| p[0]).fold(0.0, f32::max) > 0.98);
+}
+
+#[test]
+fn auto_color_neutralises_cast() {
+    let mut img = Image::new(16, 4);
+    for y in 0..4 {
+        for x in 0..16 {
+            let v = x as f32 / 15.0;
+            img.set(x, y, [v * 0.6 + 0.1, v * 0.9, v * 0.5, 1.0]);
+        }
+    }
+    let out = run("ec.color.autocolor", &img, &[]);
+    let p = out.get(8, 1);
+    assert!((p[0] - p[1]).abs() < 0.08 && (p[1] - p[2]).abs() < 0.08, "{p:?}");
+}
+
+#[test]
+fn equalize_flattens_histogram() {
+    let mut img = Image::new(64, 1);
+    for x in 0..64 {
+        let v = if x < 48 { 0.1 + x as f32 * 0.001 } else { 0.9 };
+        img.set(x, 0, [v, v, v, 1.0]);
+    }
+    let out = run("ec.color.equalize", &img, &[]);
+    // The crowded dark values are spread across the range.
+    assert!(out.get(47, 0)[0] > 0.6, "{}", out.get(47, 0)[0]);
+    assert!(out.get(0, 0)[0] < 0.1);
+    assert_eq!(run("ec.color.equalize", &img, &[("amount", num(0.0))]), img);
+}
+
+#[test]
+fn selective_color_zero_is_identity_and_reds_respond() {
+    let img = ramp();
+    assert_eq!(run("ec.color.selectivecolor", &img, &[]), img);
+    let red = Image::filled(2, 2, [1.0, 0.1, 0.1, 1.0]);
+    let out = run("ec.color.selectivecolor", &red, &[("details/reds/redsCyan", num(100.0)), ("method", Value::Enum(1))]);
+    assert!(out.data[0][0] < 0.3, "{:?}", out.data[0]);
+    let blue = Image::filled(2, 2, [0.1, 0.1, 1.0, 1.0]);
+    assert_eq!(run("ec.color.selectivecolor", &blue, &[("details/reds/redsCyan", num(100.0))]), blue);
+}
+
+#[test]
+fn color_offset_full_turn_is_identity() {
+    let img = ramp();
+    let out = run("ec.color.cccoloroffset", &img, &[("redPhase", num(360.0)), ("greenPhase", num(720.0))]);
+    assert_eq!(out, img);
+    let out = run("ec.color.cccoloroffset", &img, &[("redPhase", num(180.0))]);
+    assert!((out.get(0, 3)[0] - 0.5).abs() < 1e-4);
+}
+
+#[test]
+fn broadcast_reduces_unsafe_color() {
+    let img = Image::filled(2, 2, [1.0, 1.0, 0.0, 1.0]);
+    let out = run("ec.color.broadcast", &img, &[]);
+    assert!(out.data[0][0] < 1.0);
+    let key = run("ec.color.broadcast", &img, &[("howToMakeSafe", Value::Enum(2))]);
+    assert_eq!(key.data[0][3], 0.0);
+    let gray = Image::filled(2, 2, [0.5, 0.5, 0.5, 1.0]);
+    assert_eq!(run("ec.color.broadcast", &gray, &[]), gray);
+}
+
+#[test]
+fn color_balance_hls_zero_identity_and_hue_shift() {
+    let img = ramp();
+    assert_eq!(run("ec.color.colorbalancehls", &img, &[]), img);
+    let red = Image::filled(1, 1, [1.0, 0.0, 0.0, 1.0]);
+    let out = run("ec.color.colorbalancehls", &red, &[("hue", num(120.0))]);
+    assert!(out.data[0][1] > 0.99 && out.data[0][0] < 0.01);
+}
+
+#[test]
+fn color_link_fills_with_average_keeping_alpha() {
+    let mut img = Image::new(2, 1);
+    img.set(0, 0, [1.0, 0.0, 0.0, 1.0]);
+    img.set(1, 0, [0.0, 0.0, 0.5, 0.5]);
+    let out = run("ec.color.colorlink", &img, &[]);
+    assert!((out.data[1][3] - 0.5).abs() < 1e-5);
+    let (c, _) = unpremul(out.data[0]);
+    assert!((c[0] - 2.0 / 3.0).abs() < 1e-3 && (c[2] - 1.0 / 3.0).abs() < 1e-3, "{c:?}");
+}
+
+#[test]
+fn cc_kernel_identity_and_toner_duotone() {
+    let img = ramp();
+    assert_eq!(run("ec.color.cckernel", &img, &[]), img);
+    let g = Image::filled(1, 1, [0.5, 0.5, 0.5, 1.0]);
+    let t = run("ec.color.cctoner", &g, &[("tones", Value::Enum(0)), ("highlights", col(1.0, 0.0, 0.0))]);
+    assert!((t.data[0][0] - 0.5).abs() < 1e-3 && t.data[0][1] < 1e-3);
+}
+
+#[test]
+fn shadow_highlight_lifts_shadows() {
+    let img = Image::filled(8, 8, [0.1, 0.1, 0.1, 1.0]);
+    let out = run("ec.color.shadowhighlight", &img, &[("autoAmounts", Value::Bool(false))]);
+    assert!(out.data[0][0] > 0.15);
+}
+
+#[test]
+fn levels_ic_clip_popups() {
+    let img = Image::filled(2, 2, [0.9, 0.9, 0.9, 1.0]);
+    let lv = [("rgb/rgbInWhite", num(0.5))];
+    assert!((run("ec.color.levelsic", &img, &lv).data[0][0] - 1.0).abs() < 1e-6);
+    let off = [("rgb/rgbInWhite", num(0.5)), ("clipToOutputWhite", Value::Enum(0))];
+    assert!(run("ec.color.levelsic", &img, &off).data[0][0] > 1.5);
+}
+
+/// A host whose other layers and other frames are a fixed image.
+struct ImgHost(Image);
+impl crate::EffectHost for ImgHost {
+    fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+        Some(crate::LayerPixels { buf: Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 }, size: [2.0, 2.0] })
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn self_at(&self, _: f64, _: usize) -> Option<Buf> {
+        Some(Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 })
+    }
+}
+
+fn run_host(id: &str, img: &Image, over: &[(&str, Value)], host: &ImgHost) -> Image {
+    let env = crate::EffectEnv { host: Some(host), frame_rate: 10.0, ..Default::default() };
+    crate::run_fx(id, over, img.clone(), 1.0, env).img
+}
+
+#[test]
+fn color_link_samples_clip_and_source_layer() {
+    let mut img = Image::new(5, 1);
+    for (x, v) in [0.0f32, 0.1, 0.2, 0.3, 1.0].iter().enumerate() {
+        img.set(x as u32, 0, [*v, *v, *v, 1.0]);
+    }
+    // Median ignores the outlier the average follows.
+    let med = run("ec.color.colorlink", &img, &[("sampleSource", Value::Enum(1))]);
+    assert!((med.data[0][0] - 0.2).abs() < 1e-5);
+    // Brightest with 20 % clip skips the brightest pixel.
+    let br = run("ec.color.colorlink", &img, &[("sampleSource", Value::Enum(2)), ("clip", num(20.0))]);
+    assert!((br.data[0][0] - 0.3).abs() < 1e-5);
+    // Min Alpha of a half-transparent source layer sets the alpha.
+    let host = ImgHost(Image::filled(2, 2, [0.25, 0.25, 0.25, 0.5]));
+    let out = run_host("ec.color.colorlink", &img, &[("sourceLayer", Value::Layer(Some(9))), ("sampleSource", Value::Enum(9))], &host);
+    assert!((out.data[4][3] - 0.5).abs() < 1e-5);
+    // Average of the source layer (not the effect's own pixels).
+    let out = run_host("ec.color.colorlink", &img, &[("sourceLayer", Value::Layer(Some(9)))], &host);
+    assert!((out.data[4][0] - 0.5).abs() < 1e-5);
+}
+
+#[test]
+fn auto_levels_temporal_smoothing_reads_neighbour_frames() {
+    let mut img = Image::new(4, 1);
+    for x in 0..4 {
+        let v = 0.3 + 0.1 * x as f32;
+        img.set(x, 0, [v, v, v, 1.0]);
+    }
+    let wide = ImgHost(ramp());
+    let p0 = [("blackClip", num(0.0)), ("whiteClip", num(0.0))];
+    let alone = run_host("ec.color.autolevels", &img, &p0, &wide);
+    let smooth = run_host("ec.color.autolevels", &img, &[p0[0].clone(), p0[1].clone(), ("temporalSmoothing", num(0.2))], &wide);
+    // Alone the frame is stretched to full range; with full-range neighbours much less.
+    assert!(alone.data[0][0] < 0.01);
+    assert!(smooth.data[0][0] > 0.1, "{:?}", smooth.data[0]);
+}
+
+#[test]
+fn shadow_highlight_clip_keeps_the_tonal_range() {
+    let img = ramp();
+    let lift = [("autoAmounts", Value::Bool(false)), ("shadowAmount", num(80.0))];
+    let unclipped =
+        run("ec.color.shadowhighlight", &img, &[lift[0].clone(), lift[1].clone(), ("moreOptions/blackClip", num(0.0)), ("moreOptions/whiteClip", num(0.0))]);
+    let clipped = run("ec.color.shadowhighlight", &img, &[lift[0].clone(), lift[1].clone(), ("moreOptions/blackClip", num(1.0))]);
+    let min = |im: &Image| im.data.iter().filter(|p| p[3] > 0.99).map(|p| luminance(p[0], p[1], p[2])).fold(f32::MAX, f32::min);
+    assert!(min(&clipped) < min(&unclipped));
+}
diff --git a/crates/effects/src/color3.rs b/crates/effects/src/color3.rs
index 4850710ab..d0d398100 100644
--- a/crates/effects/src/color3.rs
+++ b/crates/effects/src/color3.rs
@@ -1,5 +1,5 @@
-//! Color Correction effects, batch 3: Change Color, Video Limiter, CC Color Neutralizer,
-//! PS Arbitrary Map and Lumetri Color (Basic Correction, Creative, Curves, Color Wheels,
+//! Color Correction effects, batch 3: Change Color, Video Limiter, Color Neutralizer,
+//! PS Arbitrary Map and Color Grading (Basic Correction, Creative, Curves, Color Wheels,
 //! Vignette).
 
 use effectcraft_color::{hsl_to_rgb, luminance, rgb_to_hsl};
@@ -154,7 +154,7 @@ fn video_limiter(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Color Neutralizer
+// ---------------------------------------------------------------- Color Neutralizer
 
 fn color_neutralizer(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let pairs = [("shadowsUnbalance", "shadowsBalance"), ("midtonesUnbalance", "midtonesBalance"), ("highlightsUnbalance", "highlightsBalance")];
@@ -225,7 +225,7 @@ fn arbitrary_map(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- Lumetri Color
+// ---------------------------------------------------------------- Color Grading
 
 /// Smooth tone-curve adjustment: offsets for shadows/midtones/highlights (each -1..1), with the
 /// end points fixed.
@@ -431,7 +431,7 @@ impl HslKey {
     }
 }
 
-/// Lumetri Color: Basic Correction (input LUT, white balance, HDR range, tone, saturation),
+/// Color Grading: Basic Correction (input LUT, white balance, HDR range, tone, saturation),
 /// Creative (look, adjustments), Curves (tone sliders, RGB curves, hue/saturation curves),
 /// Color Wheels, HSL Secondary (key, refine, correction), Vignette, in that order.
 fn lumetri(ctx: &EffectCtx, mut b: Buf) -> Buf {
@@ -705,32 +705,37 @@ fn lumetri(ctx: &EffectCtx, mut b: Buf) -> Buf {
 
 pub fn specs() -> Vec<EffectSpec> {
     let grey = || col(0.5, 0.5, 0.5);
+    // After Effects' valid ranges (a value past the slider's drag range is still kept: .aep
+    // import, 1200), the slider over the range After Effects' slider covers.
+    let wb = || slider(-300.0, 300.0, -100.0, 100.0, 1);
+    let tone = || slider(-150.0, 150.0, -100.0, 100.0, 1);
+    let sat = || slider(0.0, 300.0, 0.0, 200.0, 1);
     let mut lum = vec![
         p("highDynamicRange", "High Dynamic Range", Value::Bool(false), ParamUi::Checkbox),
         p("basicCorrection/inputLut", "Input LUT", Value::Enum(0), popup(&["None", "Custom"])),
         // A .cube file path (or the file's text) for Input LUT = Custom.
         p("basicCorrection/inputLutFile", "Input LUT File", Value::Str(String::new()), ParamUi::Text),
-        p("basicCorrection/whiteBalance/temperature", "Temperature", num(0.0), bipolar()),
-        p("basicCorrection/whiteBalance/tint", "Tint", num(0.0), bipolar()),
-        p("basicCorrection/tone/exposure", "Exposure", num(0.0), slider(-5.0, 5.0, -5.0, 5.0, 2)),
-        p("basicCorrection/tone/contrast", "Contrast", num(0.0), bipolar()),
-        p("basicCorrection/tone/highlights", "Highlights", num(0.0), bipolar()),
-        p("basicCorrection/tone/shadows", "Shadows", num(0.0), bipolar()),
-        p("basicCorrection/tone/whites", "Whites", num(0.0), bipolar()),
-        p("basicCorrection/tone/blacks", "Blacks", num(0.0), bipolar()),
+        p("basicCorrection/whiteBalance/temperature", "Temperature", num(0.0), wb()),
+        p("basicCorrection/whiteBalance/tint", "Tint", num(0.0), wb()),
+        p("basicCorrection/tone/exposure", "Exposure", num(0.0), slider(-7.0, 7.0, -5.0, 5.0, 2)),
+        p("basicCorrection/tone/contrast", "Contrast", num(0.0), tone()),
+        p("basicCorrection/tone/highlights", "Highlights", num(0.0), tone()),
+        p("basicCorrection/tone/shadows", "Shadows", num(0.0), tone()),
+        p("basicCorrection/tone/whites", "Whites", num(0.0), tone()),
+        p("basicCorrection/tone/blacks", "Blacks", num(0.0), tone()),
         p("basicCorrection/tone/hdrWhite", "HDR White", num(100.0), slider(100.0, 10000.0, 100.0, 4000.0, 0)),
-        p("basicCorrection/tone/hdrSpecular", "HDR Specular", num(0.0), bipolar()),
-        p("basicCorrection/saturation", "Saturation", num(100.0), slider(0.0, 200.0, 0.0, 200.0, 1)),
+        p("basicCorrection/tone/hdrSpecular", "HDR Specular", num(0.0), tone()),
+        p("basicCorrection/saturation", "Saturation", num(100.0), sat()),
         p("creative/look", "Look", Value::Enum(0), popup(&LUMETRI_LOOKS)),
         p("creative/lookFile", "Look File", Value::Str(String::new()), ParamUi::Text),
         p("creative/lookIntensity", "Intensity", num(100.0), slider(0.0, 200.0, 0.0, 200.0, 1)),
-        p("creative/adjustments/fadedFilm", "Faded Film", num(0.0), pct()),
+        p("creative/adjustments/fadedFilm", "Faded Film", num(0.0), slider(0.0, 150.0, 0.0, 100.0, 1)),
         p("creative/adjustments/sharpen", "Sharpen", num(0.0), bipolar()),
         p("creative/adjustments/vibrance", "Vibrance", num(0.0), bipolar()),
-        p("creative/adjustments/creativeSaturation", "Saturation", num(100.0), slider(0.0, 200.0, 0.0, 200.0, 1)),
+        p("creative/adjustments/creativeSaturation", "Saturation", num(100.0), sat()),
         p("creative/adjustments/shadowTint", "Shadow Tint", grey(), ParamUi::Color),
         p("creative/adjustments/highlightTint", "Highlight Tint", grey(), ParamUi::Color),
-        p("creative/adjustments/tintBalance", "Tint Balance", num(0.0), bipolar()),
+        p("creative/adjustments/tintBalance", "Tint Balance", num(0.0), tone()),
     ];
     const CURVES: [(&str, &str); 12] = [
         ("curves/curveMasterShadows", "RGB Curve Shadows"),
@@ -786,13 +791,13 @@ pub fn specs() -> Vec<EffectSpec> {
         p("hslSecondary/key/maskStyle", "Mask Style", Value::Enum(0), popup(&HSL_MASK_STYLES)),
         p("hslSecondary/key/invertMask", "Invert Mask", Value::Bool(false), ParamUi::Checkbox),
         p("hslSecondary/refine/denoise", "Denoise", num(0.0), pct()),
-        p("hslSecondary/refine/blur", "Blur", num(0.0), pct()),
+        p("hslSecondary/refine/blur", "Blur", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
         p("hslSecondary/correction/correctionWheel", "Correction", grey(), ParamUi::Color),
-        p("hslSecondary/correction/temperature", "Temperature", num(0.0), bipolar()),
-        p("hslSecondary/correction/tint", "Tint", num(0.0), bipolar()),
-        p("hslSecondary/correction/contrast", "Contrast", num(0.0), bipolar()),
+        p("hslSecondary/correction/temperature", "Temperature", num(0.0), wb()),
+        p("hslSecondary/correction/tint", "Tint", num(0.0), wb()),
+        p("hslSecondary/correction/contrast", "Contrast", num(0.0), tone()),
         p("hslSecondary/correction/sharpen", "Sharpen", num(0.0), bipolar()),
-        p("hslSecondary/correction/saturation", "Saturation", num(100.0), slider(0.0, 200.0, 0.0, 200.0, 1)),
+        p("hslSecondary/correction/saturation", "Saturation", num(100.0), sat()),
         p("vignette/vignetteAmount", "Amount", num(0.0), slider(-5.0, 5.0, -5.0, 5.0, 2)),
         p("vignette/vignetteMidpoint", "Midpoint", num(50.0), pct()),
         p("vignette/vignetteRoundness", "Roundness", num(0.0), bipolar()),
@@ -829,7 +834,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.color.cccolorneutralizer",
-            "CC Color Neutralizer",
+            "Color Neutralizer",
             vec![
                 p("shadowsUnbalance", "Shadows Unbalance", col(0.0, 0.0, 0.0), ParamUi::Color),
                 p("shadowsBalance", "Shadows Balance", col(0.0, 0.0, 0.0), ParamUi::Color),
@@ -855,7 +860,7 @@ pub fn specs() -> Vec<EffectSpec> {
             ],
             arbitrary_map,
         ),
-        spec("ec.color.lumetri", "Lumetri Color", lum, lumetri),
+        spec("ec.color.lumetri", "Color Grading", lum, lumetri),
     ]
 }
 
diff --git a/crates/effects/src/color_fx.rs b/crates/effects/src/color_fx.rs
index cf6698fee..3a52e7a54 100644
--- a/crates/effects/src/color_fx.rs
+++ b/crates/effects/src/color_fx.rs
@@ -14,12 +14,27 @@ fn mix(a: [f32; 3], b: [f32; 3], t: f32) -> [f32; 3] {
     [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, a[2] + (b[2] - a[2]) * t]
 }
 
+/// Rec. 601 luminance on the working-space values (sRGB working space, not linearised: red
+/// 76/255, green 150/255, blue 29/255), as After Effects 2026 renders Tint, Tritone, Luma Key and
+/// Extract. Tritone, case 718: a red solid with Blend With Original 25 gives (132, 23, 46), from
+/// luminance 0.299; Rec. 709's 0.213 gave (113, 16, 49); on a grey ramp both weightings agree
+/// (case 815). Luma Key and Extract: Key Out Darker / Extract Black Point at 65, 166 and 24 on
+/// pure red, green and blue keep red (601: 76, 709: 54) and blue (29 / 18) and key out green
+/// (150 / 182). The GPU kernels (`pointwise` op 1, `fx_color` op 4, `fxk_key_luma`) mirror it.
+pub(crate) fn luma_601(c: [f32; 3]) -> f32 {
+    LUMA_601[0] * c[0] + LUMA_601[1] * c[1] + LUMA_601[2] * c[2]
+}
+
+/// The Rec. 601 luma weights of `luma_601`. The WGSL kernels repeat them as literals; the GPU
+/// test `shader_constants_match_the_cpu` checks that they are these.
+pub const LUMA_601: [f32; 3] = [0.299, 0.587, 0.114];
+
 fn tint(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let black = ctx.params.color("black");
     let white = ctx.params.color("white");
     let amt = ctx.params.f("amount") as f32 / 100.0;
     b.img.map_straight(|c| {
-        let l = luminance(c[0], c[1], c[2]).clamp(0.0, 1.0);
+        let l = luma_601(c).clamp(0.0, 1.0);
         let t = [black[0] + (white[0] - black[0]) * l, black[1] + (white[1] - black[1]) * l, black[2] + (white[2] - black[2]) * l];
         mix(c, t, amt)
     });
@@ -32,7 +47,7 @@ fn tritone(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let sh = ctx.params.color("shadows");
     let blend = 1.0 - ctx.params.f("blend") as f32 / 100.0;
     b.img.map_straight(|c| {
-        let l = luminance(c[0], c[1], c[2]).clamp(0.0, 1.0);
+        let l = luma_601(c).clamp(0.0, 1.0);
         let t = if l < 0.5 {
             mix([sh[0], sh[1], sh[2]], [mid[0], mid[1], mid[2]], l * 2.0)
         } else {
@@ -49,18 +64,22 @@ fn tritone(ctx: &EffectCtx, mut b: Buf) -> Buf {
 /// power toward white (`1-(1-v)^e`) or black (`v^e`); contrast uses `g = 1 + 0.53 c` instead of
 /// the old `2^(2c)` (that crushed 0.25 to ~8/255 at Contrast 100; AE is ~40/255). Values above 1
 /// pass through. The GPU kernel mirrors it.
+///
+/// Negative Brightness and Contrast are the inverse curves of the positive ones (After Effects
+/// 2026 ramps: Brightness −40 is Brightness +40 inverted within 2.6/255, Contrast −50 likewise),
+/// so they use the reciprocal exponents: Brightness −40 was 20/255 off AE, now 6.2.
 pub fn bc_modern(v: f32, b: f32, c: f32) -> f32 {
     if v >= 1.0 {
         return v;
     }
     let mut v = v.max(0.0);
-    if b > 0.0 {
-        v = 1.0 - (1.0 - v).powf(2f32.powf(1.24 * b));
-    } else if b < 0.0 {
-        v = v.powf(2f32.powf(-1.32 * b));
+    if b != 0.0 {
+        let e = 2f32.powf(1.24 * b.abs());
+        v = 1.0 - (1.0 - v).powf(if b > 0.0 { e } else { 1.0 / e });
     }
     if c != 0.0 {
-        let g = (1.0 + 0.53 * c).max(0.05);
+        let g = (1.0 + 0.53 * c.abs()).max(0.05);
+        let g = if c > 0.0 { g } else { 1.0 / g };
         v = if v < 0.5 { 0.5 * (2.0 * v).powf(g) } else { 1.0 - 0.5 * (2.0 - 2.0 * v).max(0.0).powf(g) };
     }
     v
@@ -197,16 +216,32 @@ fn hue_saturation(ctx: &EffectCtx, mut b: Buf) -> Buf {
 pub const LEVELS_CLIP: [&str; 3] = ["Off", "On", "Off for 32 bpc Color"];
 
 /// Whether Levels clips below Input Black / above Input White. "Off for 32 bpc Color" clips
-/// (effects can't see the project's bit depth; 8/16 bpc behaviour). The hidden `noClip` switch
-/// of projects saved before the two popups existed turns both off.
+/// in 8 and 16 bpc projects and not in 32 bpc ones (After Effects 2026, Levels (Individual
+/// Controls) in a 32 bpc project: values below Input Black end below Output Black). The hidden
+/// `noClip` switch of projects saved before the two popups existed turns both off.
 pub fn levels_clip(ctx: &EffectCtx) -> (bool, bool) {
     if ctx.params.b("noClip") {
         return (false, false);
     }
-    let on = |id: &str| ctx.params.get(id).is_none_or(|v| v.as_enum() != 0);
+    let on = |id: &str| levels_clip_on(ctx, id);
     (on("clipToOutputBlack"), on("clipToOutputWhite"))
 }
 
+/// One Clip To Output popup: 0 Off, 1 On, 2 Off for 32 bpc Color (missing: clip).
+pub fn levels_clip_on(ctx: &EffectCtx, id: &str) -> bool {
+    match ctx.params.get(id).map(|v| v.as_enum()) {
+        Some(0) => false,
+        Some(2) => !ctx.env.float_depth,
+        _ => true,
+    }
+}
+
+/// Levels' gamma on the normalised input `t`: unclipped values below Input Black extrapolate
+/// (the curve mirrored through 0) instead of stopping at Output Black.
+pub fn levels_gamma(t: f32, g: f32) -> f32 {
+    if t >= 0.0 { t.powf(1.0 / g) } else { -(-t).powf(1.0 / g) }
+}
+
 /// Levels' Channel popup.
 pub const LEVELS_CHANNELS: [&str; 5] = ["RGB", "Red", "Green", "Blue", "Alpha"];
 
@@ -232,8 +267,7 @@ fn level(v: f32, [ib, iw, g, ob, ow]: [f32; 5], (clip_b, clip_w): (bool, bool))
     if clip_w {
         t = t.min(1.0);
     }
-    let t = t.max(0.0).powf(1.0 / g);
-    ob + (ow - ob) * t
+    ob + (ow - ob) * levels_gamma(t, g)
 }
 
 const LEVELS_IDENTITY: [f32; 5] = [0.0, 1.0, 1.0, 0.0, 1.0];
@@ -276,7 +310,7 @@ pub fn levels_channel_settings(ctx: &EffectCtx) -> [([f32; 5], (bool, bool)); 4]
         let ids = levels_channel_ids(i + 1);
         let v: [f32; 5] = std::array::from_fn(|k| ctx.params.get(&ids[k]).map(|v| v.as_f64() as f32).unwrap_or(LEVELS_IDENTITY[k]));
         let pre = LEVELS_CHANNEL_PREFIX[i];
-        let on = |id: String| ctx.params.get(&id).is_none_or(|v| v.as_enum() != 0);
+        let on = |id: String| levels_clip_on(ctx, &id);
         let clip = if ctx.params.b("noClip") { (false, false) } else { (on(format!("{pre}ClipToOutputBlack")), on(format!("{pre}ClipToOutputWhite"))) };
         ([v[0], v[1], v[2].max(0.01), v[3], v[4]], clip)
     })
@@ -304,6 +338,18 @@ pub fn exposure_settings(ctx: &EffectCtx) -> [(f32, f32, f32); 3] {
     }
 }
 
+/// The power curve Exposure's own linear-light conversion uses (Bypass Linear Light Conversion
+/// off). After Effects decodes with a pure 2.2 power, not the piecewise sRGB curve: Offset 0.0005
+/// on black measures 8/255 there, which 2.2 predicts (8.06) and sRGB does not (1.65).
+/// `kernels.wgsl` repeats it as a literal; the GPU test `shader_constants_match_the_cpu` checks it.
+pub const EXPOSURE_LINEAR_GAMMA: f32 = 2.2;
+
+/// Exposure: per channel, `(value · 2^exposure + offset)^(1 / gamma)`, in linear light unless
+/// Bypass Linear Light Conversion is on. The conversion is the effect's own pure 2.2 power curve
+/// (see [`EXPOSURE_LINEAR_GAMMA`]), applied whatever the project's working space, also when it
+/// is already linear (Linearize Working Space), as before. Negative values (32 bpc, or a
+/// negative Offset) go through the curves mirrored, so a negative Offset darkens smoothly past
+/// black and the default settings leave every value unchanged.
 fn exposure(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let s = exposure_settings(ctx);
     let bypass = ctx.params.b("bypassLinearLight");
@@ -313,9 +359,9 @@ fn exposure(ctx: &EffectCtx, mut b: Buf) -> Buf {
             if bypass {
                 return mirror_pow(c[i] * e + off, 1.0 / g);
             }
-            let lin = effectcraft_color::srgb_to_linear(c[i].max(0.0));
+            let lin = mirror_pow(c[i], EXPOSURE_LINEAR_GAMMA);
             let o = mirror_pow(lin * e + off, 1.0 / g);
-            effectcraft_color::linear_to_srgb(o.abs()).copysign(o)
+            mirror_pow(o, 1.0 / EXPOSURE_LINEAR_GAMMA)
         })
     });
     b
@@ -333,6 +379,37 @@ pub fn mirror_pow(v: f32, p: f32) -> f32 {
 /// It used to offset the luminance by the HSL saturation, which is near 1 for any tinted
 /// near-black pixel: the faint colour noise of compressed footage's shadows came out as bright
 /// and black blocks (#1463), and 32-bpc overbrights divided by zero.
+/// Black & White's Tint: the tint colour's hue and saturation at the gray's luminosity, as a
+/// Color blend does (luminosity with weights 0.3 / 0.59 / 0.11, out-of-range channels pulled
+/// back toward the gray). After Effects 2026 with Tint Color [1, 0.5, 0]: gray 0.1 (a red solid
+/// at Reds 10, case 717) → (43, 21, 0), gray 0.6 (yellow at defaults, case 825) → (255, 129, 2),
+/// white → white; the old hue / saturation / lightness mix gave (51, 26, 0) for the first.
+/// The luminosity weights of `bw_tint` (a Color blend's). `fx_color.wgsl` repeats them; the GPU
+/// test `shader_constants_match_the_cpu` checks that they are these.
+pub const BW_TINT_LUMA: [f32; 3] = [0.3, 0.59, 0.11];
+
+pub fn bw_tint(tint: [f32; 3], gray: f32) -> [f32; 3] {
+    let lum = |c: [f32; 3]| BW_TINT_LUMA[0] * c[0] + BW_TINT_LUMA[1] * c[1] + BW_TINT_LUMA[2] * c[2];
+    if !gray.is_finite() || gray <= 0.0 {
+        return [0.0; 3];
+    }
+    if gray >= 1.0 {
+        return [gray; 3];
+    }
+    let d = gray - lum(tint);
+    let c = tint.map(|v| v + d);
+    let l = lum(c);
+    let (n, x) = (c[0].min(c[1]).min(c[2]), c[0].max(c[1]).max(c[2]));
+    let mut o = c;
+    if n < 0.0 && l - n > 1e-9 {
+        o = o.map(|v| l + (v - l) * l / (l - n));
+    }
+    if x > 1.0 && x - l > 1e-9 {
+        o = o.map(|v| l + (v - l) * (1.0 - l) / (x - l));
+    }
+    o
+}
+
 fn black_white(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let w = [ctx.params.f("reds"), ctx.params.f("yellows"), ctx.params.f("greens"), ctx.params.f("cyans"), ctx.params.f("blues"), ctx.params.f("magentas")]
         .map(|v| v as f32 / 100.0);
@@ -347,13 +424,7 @@ fn black_white(ctx: &EffectCtx, mut b: Buf) -> Buf {
         let wt = w[i] + (w[(i + 1) % 6] - w[i]) * f;
         let (max, min) = (c[0].max(c[1]).max(c[2]), c[0].min(c[1]).min(c[2]));
         let gray = (min + (max - min) * wt).max(0.0);
-        if tint_on {
-            let (th, ts, _) = rgb_to_hsl(tc[0], tc[1], tc[2]);
-            let (r, g, bl) = hsl_to_rgb(th, ts, gray.min(1.0));
-            [r, g, bl]
-        } else {
-            [gray, gray, gray]
-        }
+        if tint_on { bw_tint([tc[0], tc[1], tc[2]], gray) } else { [gray, gray, gray] }
     });
     b
 }
@@ -418,15 +489,12 @@ fn fill(ctx: &EffectCtx, mut b: Buf) -> Buf {
         });
         return b;
     }
+    // Without masks the layer becomes the fill colour, and Opacity is the layer's opacity: After
+    // Effects 2026 renders Fill (0, 0.5, 1) at Opacity 50 % as that colour at half alpha, with
+    // nothing of the original showing through (it is not a mix with the original).
     b.img.data.iter_mut().for_each(|px| {
-        let a = if invert { 1.0 - px[3] } else { px[3] };
-        let f = [c[0] * a, c[1] * a, c[2] * a];
-        for i in 0..3 {
-            px[i] += (f[i] - px[i]) * opacity;
-        }
-        if invert {
-            px[3] += (a - px[3]) * opacity;
-        }
+        let a = if invert { 1.0 - px[3] } else { px[3] } * opacity;
+        *px = [c[0] * a, c[1] * a, c[2] * a, a];
     });
     b
 }
@@ -687,7 +755,7 @@ impl ColoramaPalette {
         }
     }
 
-    /// Parse "pos:r,g,b[,a] pos:r,g,b …" (positions 0..1, channels 0..1). `None` without stops.
+    /// Parse "pos:r,g,b\[,a\] pos:r,g,b …" (positions 0..1, channels 0..1). `None` without stops.
     pub fn parse(s: &str) -> Option<ColoramaPalette> {
         let mut stops: Vec<(f32, [f32; 4])> = s
             .split_whitespace()
@@ -969,11 +1037,13 @@ pub fn specs() -> Vec<EffectSpec> {
             "Exposure",
             {
                 let mut v = vec![p("channels", "Channels", Value::Enum(0), popup(&["Master", "Individual Channels"]))];
+                // After Effects' ranges (valid, slider, decimals). Gamma values below 0.1 from
+                // older projects or Photoshop imports (0.01..9.99) are kept and still render.
                 let group = |ids: [&'static str; 3]| {
                     [
-                        p(ids[0], "Exposure", num(0.0), slider(-20.0, 20.0, -5.0, 5.0, 2)),
+                        p(ids[0], "Exposure", num(0.0), slider(-100.0, 100.0, -4.0, 4.0, 2)),
                         p(ids[1], "Offset", num(0.0), slider(-2.0, 2.0, -0.5, 0.5, 4)),
-                        p(ids[2], "Gamma Correction", num(1.0), slider(0.01, 9.99, 0.1, 3.0, 2)),
+                        p(ids[2], "Gamma Correction", num(1.0), slider(0.1, 10.0, 0.1, 10.0, 2)),
                     ]
                 };
                 v.extend(group(["master/exposure", "master/offset", "master/gamma"]));
@@ -1145,360 +1215,4 @@ pub fn specs() -> Vec<EffectSpec> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, run_fx};
-    use effectcraft_raster::Image;
-
-    fn px(id: &str, vals: &[(&str, Value)], c: [f32; 4]) -> [f32; 4] {
-        run_fx(id, vals, Image::filled(2, 2, c), 0.0, EffectEnv::default()).img.get(0, 0)
-    }
-    fn close(a: [f32; 4], b: [f32; 4], eps: f32) -> bool {
-        a.iter().zip(b).all(|(x, y)| (x - y).abs() <= eps)
-    }
-
-    /// Projects saved before Use Legacy / the Photo Filter menu existed keep rendering as before.
-    #[test]
-    fn old_saves_get_legacy_values_for_added_params() {
-        use effectcraft_project::build::Ids;
-        let mut next = 1;
-        for (id, param, want) in
-            [("ec.color.brightnesscontrast", "useLegacy", Value::Bool(true)), ("ec.color.photofilter", "filter", Value::Enum(PHOTO_FILTER_CUSTOM))]
-        {
-            let spec = crate::find(id).unwrap();
-            let mut g = crate::instantiate(spec, &mut Ids(&mut next), spec.name, [10.0, 10.0]);
-            g.children.retain(|c| c.match_id() != param);
-            crate::migrate::upgrade_instance(spec, &mut g, &mut Ids(&mut next), [10.0, 10.0]);
-            assert_eq!(g.get(param).unwrap().value, want, "{id}");
-        }
-    }
-
-    #[test]
-    fn colorama_reads_get_phase_from() {
-        // Same intensity, different red: Intensity gives one colour, Red gives two.
-        let a = [0.6, 0.2, 0.2, 1.0];
-        let b = [0.2, 0.2, 0.6, 1.0];
-        let red = |c| px("ec.color.colorama", &[("inputPhase/mode", Value::Enum(1))], c);
-        assert!(!close(red(a), red(b), 1e-3));
-        // Zero maps everything to the start of the cycle (red).
-        assert!(close(px("ec.color.colorama", &[("inputPhase/mode", Value::Enum(9))], b), [1.0, 0.0, 0.0, 1.0], 1e-5));
-        // Interpolate Palette off posterizes: two nearby inputs land on the same colour.
-        let off = |v: f32| px("ec.color.colorama", &[("outputCycle/interpolatePalette", Value::Bool(false))], [v, v, v, 1.0]);
-        assert_eq!(off(0.20), off(0.22));
-    }
-
-    #[test]
-    fn brightness_contrast_modern_keeps_black_and_white_and_legacy_is_linear() {
-        let bc = |vals: &[(&str, Value)], v: f32| px("ec.color.brightnesscontrast", vals, [v, v, v, 1.0])[0];
-        let up = [("brightness", num(50.0)), ("contrast", num(40.0))];
-        assert_eq!(bc(&up, 0.0), 0.0);
-        assert!((bc(&up, 1.0) - 1.0).abs() < 1e-6);
-        assert!(bc(&up, 0.4) > 0.4);
-        let legacy = [("brightness", num(50.0)), ("useLegacy", Value::Bool(true))];
-        assert!((bc(&legacy, 0.2) - 0.7).abs() < 1e-5);
-        assert!((bc(&legacy, 0.0) - 0.5).abs() < 1e-5);
-    }
-
-    /// After Effects non-legacy ramps (kasper9n, #681). B0 C-100 matched B0 C-50 and is omitted.
-    #[test]
-    fn brightness_contrast_modern_matches_ae_ramp_samples() {
-        let u8 = |v: f32| (v * 255.0).round() as i32;
-        let go = |b: f64, c: f64, x: u8| {
-            u8(px("ec.color.brightnesscontrast", &[("brightness", num(b)), ("contrast", num(c))], [x as f32 / 255.0, x as f32 / 255.0, x as f32 / 255.0, 1.0])
-                [0])
-        };
-        // (brightness, contrast, input, AE 8-bit)
-        let samples: &[(f64, f64, u8, u8)] = &[
-            (0.0, 100.0, 64, 40),
-            (0.0, 100.0, 128, 129),
-            (0.0, 100.0, 192, 217),
-            (0.0, 50.0, 64, 53),
-            (0.0, 50.0, 192, 205),
-            (0.0, -50.0, 64, 77),
-            (100.0, 0.0, 128, 209),
-            (50.0, 0.0, 128, 171),
-            (106.0, -18.0, 128, 214),
-        ];
-        for &(b, c, x, ae) in samples {
-            let got = go(b, c, x);
-            assert!((got - ae as i32).abs() <= 10, "B{b} C{c} in {x}: got {got} AE {ae}");
-        }
-        // Old g=4 S-curve put Contrast 100 at ~8/255 here.
-        assert!(go(0.0, 100.0, 64) >= 30);
-    }
-
-    /// #1463: Black & White's sliders set the gray of each pure hue and blend between
-    /// neighbouring hues; neutral pixels keep their value, overbright ones too, and an overbright
-    /// colour stays finite (it used to divide by zero).
-    #[test]
-    fn black_white_sliders_set_the_gray_of_each_hue() {
-        let bw = |vals: &[(&str, Value)], c: [f32; 3]| px("ec.color.blackwhite", vals, [c[0], c[1], c[2], 1.0]);
-        let gray = |v: f32| [v, v, v, 1.0];
-        // The defaults: Reds 40, Yellows 60, Greens 40, Cyans 60, Blues 20, Magentas 80 (%).
-        let hues = [
-            ([1.0, 0.0, 0.0], 0.4),
-            ([1.0, 1.0, 0.0], 0.6),
-            ([0.0, 1.0, 0.0], 0.4),
-            ([0.0, 1.0, 1.0], 0.6),
-            ([0.0, 0.0, 1.0], 0.2),
-            ([1.0, 0.0, 1.0], 0.8),
-            // Half as bright, half the gray; orange is halfway from Reds to Yellows.
-            ([0.5, 0.0, 0.0], 0.2),
-            ([1.0, 0.5, 0.0], 0.5),
-            // Neutral pixels keep their value.
-            ([0.3, 0.3, 0.3], 0.3),
-            ([4.0, 4.0, 4.0], 4.0),
-            // An overbright red: its smallest channel plus its chroma at Reds' 40 %.
-            ([1.5, 0.5, 0.5], 0.9),
-        ];
-        for (c, want) in hues {
-            let o = bw(&[], c);
-            assert!(close(o, gray(want), 1e-5), "{c:?}: {o:?}, want {want}");
-        }
-        assert!(close(bw(&[("reds", num(120.0))], [1.0, 0.0, 0.0]), gray(1.2), 1e-5));
-        assert!(close(bw(&[("reds", num(-200.0))], [1.0, 0.0, 0.0]), gray(0.0), 1e-5));
-        assert!(close(bw(&[("blues", num(300.0))], [0.1, 0.1, 0.3]), gray(0.7), 1e-5));
-    }
-
-    /// #1463: faint colour noise stays faint. The shadows of compressed footage carry a code or
-    /// two of colour noise, which Black & White turned into bright and black blocks (the HSL
-    /// saturation it scaled is near 1 for any tinted near-black pixel). At 8, 16 and 32 bpc the
-    /// gray of a dark ramp with ±2 steps of colour noise stays within 2 steps of the clean ramp's.
-    #[test]
-    fn black_white_keeps_faint_colour_noise_faint() {
-        // A step of 8 bpc, of 16 bpc (After Effects' 0..32768), and a small 32-bpc float one.
-        for step in [1.0 / 255.0, 1.0 / 32768.0, 1e-3_f32] {
-            let (w, h) = (64u32, 4u32);
-            let (mut clean, mut noisy) = (Image::new(w, h), Image::new(w, h));
-            for y in 0..h {
-                for x in 0..w {
-                    // A dark ramp up to a quarter gray, in whole steps...
-                    let v = (x as f32 / w as f32 * 0.25 / step).round() * step;
-                    // ...and up to ±2 steps of noise per channel, mixed differently in each pixel.
-                    let n = |k: u32| (((x * 7 + y * 13 + k * 2) % 5) as f32 - 2.0) * step;
-                    clean.set(x, y, [v, v, v, 1.0]);
-                    noisy.set(x, y, [(v + n(0)).max(0.0), (v + n(1)).max(0.0), (v + n(2)).max(0.0), 1.0]);
-                }
-            }
-            let bw = |img| run_fx("ec.color.blackwhite", &[], img, 0.0, EffectEnv::default()).img;
-            let (a, b) = (bw(clean), bw(noisy));
-            let worst = a.data.iter().zip(&b.data).map(|(p, q)| (p[0] - q[0]).abs()).fold(0.0, f32::max);
-            assert!(worst <= 2.0 * step + 1e-6, "step {step}: the noise moved the gray by {} steps", worst / step);
-        }
-    }
-
-    #[test]
-    fn levels_clips_black_and_white_independently() {
-        let lv = |vals: &[(&str, Value)], v: f32| px("ec.color.levels", vals, [v, v, v, 1.0])[0];
-        let base = [("inBlack", num(0.2)), ("inWhite", num(0.6)), ("outBlack", num(0.1)), ("outWhite", num(0.9))];
-        assert!((lv(&base, 0.9) - 0.9).abs() < 1e-5);
-        let mut no_white = base.to_vec();
-        no_white.push(("clipToOutputWhite", Value::Enum(0)));
-        assert!(lv(&no_white, 0.9) > 0.9);
-        assert!((lv(&no_white, 0.0) - 0.1).abs() < 1e-5);
-        // The hidden switch of older projects turns both off.
-        let mut legacy = base.to_vec();
-        legacy.push(("noClip", Value::Bool(true)));
-        assert!(lv(&legacy, 0.9) > 0.9);
-    }
-
-    #[test]
-    fn exposure_individual_channels_and_bypass() {
-        let g = [0.5, 0.5, 0.5, 1.0];
-        let one = px("ec.color.exposure", &[("channels", Value::Enum(1)), ("red/redExposure", num(1.0))], g);
-        assert!(one[0] > 0.6 && (one[1] - 0.5).abs() < 1e-5 && (one[2] - 0.5).abs() < 1e-5);
-        // Master values are ignored in Individual Channels mode.
-        assert!(close(px("ec.color.exposure", &[("channels", Value::Enum(1)), ("master/exposure", num(2.0))], g), g, 1e-5));
-        // Bypass Linear Light Conversion: +1 stop doubles the raw value.
-        let raw = px("ec.color.exposure", &[("master/exposure", num(1.0)), ("bypassLinearLight", Value::Bool(true))], [0.25, 0.25, 0.25, 1.0]);
-        assert!((raw[0] - 0.5).abs() < 1e-5);
-        // Negative results are mirrored, not clipped.
-        let neg = px(
-            "ec.color.exposure",
-            &[("master/offset", num(-0.5)), ("bypassLinearLight", Value::Bool(true)), ("master/gamma", num(2.0))],
-            [0.25, 0.25, 0.25, 1.0],
-        );
-        assert!((neg[0] + 0.5).abs() < 1e-4, "{neg:?}");
-    }
-
-    #[test]
-    fn change_to_color_change_modes_tolerances_and_matte() {
-        let red = [0.8, 0.1, 0.1, 1.0];
-        let green = [0.1, 0.8, 0.1, 1.0];
-        let base = [("from", col(0.8, 0.1, 0.1)), ("to", col(0.1, 0.1, 0.8))];
-        // Hue only: red turns blue with its own lightness / saturation; green is untouched.
-        let o = px("ec.color.changetocolor", &base, red);
-        assert!(o[2] > 0.7 && o[0] < 0.2, "{o:?}");
-        assert!(close(px("ec.color.changetocolor", &base, green), green, 1e-5));
-        // The matte is white where matched, black elsewhere.
-        let mut m = base.to_vec();
-        m.push(("viewCorrectionMatte", Value::Bool(true)));
-        assert!(close(px("ec.color.changetocolor", &m, red), [1.0, 1.0, 1.0, 1.0], 1e-5));
-        assert!(close(px("ec.color.changetocolor", &m, green), [0.0, 0.0, 0.0, 1.0], 1e-5));
-        // A lightness tolerance of 0 rejects a lighter red.
-        let mut strict = m.clone();
-        strict.push(("toleranceGroup/lightness", num(0.0)));
-        strict.push(("softness", num(0.0)));
-        assert!(close(px("ec.color.changetocolor", &strict, [1.0, 0.5, 0.5, 1.0]), [0.0, 0.0, 0.0, 1.0], 1e-5));
-        // Hue, Lightness & Saturation, set: a matched pixel becomes the To colour.
-        let mut all = base.to_vec();
-        all.push(("change", Value::Enum(3)));
-        assert!(close(px("ec.color.changetocolor", &all, red), [0.1, 0.1, 0.8, 1.0], 1e-4));
-    }
-
-    #[test]
-    fn leave_color_tolerance_softness_and_match_mode() {
-        let green = [0.1, 0.8, 0.1, 1.0];
-        let lc = |vals: &[(&str, Value)]| {
-            let mut v = vec![("amount", num(100.0))];
-            v.extend_from_slice(vals);
-            px("ec.color.leavecolor", &v, green)
-        };
-        let g = luminance(0.1, 0.8, 0.1);
-        assert!(close(lc(&[]), [g, g, g, 1.0], 1e-5));
-        assert!(close(lc(&[("tolerance", num(100.0))]), green, 1e-6));
-        // Softness keeps part of the colour.
-        let s = lc(&[("tolerance", num(10.0)), ("edgeSoftness", num(100.0))]);
-        assert!(s[1] > g + 0.05 && s[1] < 0.8);
-        // Using Hue: a dark red still matches pure red.
-        let dark = px("ec.color.leavecolor", &[("amount", num(100.0)), ("tolerance", num(5.0)), ("matchColors", Value::Enum(1))], [0.4, 0.0, 0.0, 1.0]);
-        assert!(close(dark, [0.4, 0.0, 0.0, 1.0], 1e-6));
-    }
-
-    #[test]
-    fn photo_filter_presets_and_custom() {
-        let g = [0.5, 0.5, 0.5, 1.0];
-        let cool = px("ec.color.photofilter", &[("filter", Value::Enum(3)), ("preserveLuminosity", Value::Bool(false))], g);
-        assert!(cool[2] > cool[0], "a cooling filter is blue: {cool:?}");
-        let custom = |c| px("ec.color.photofilter", &[("filter", Value::Enum(PHOTO_FILTER_CUSTOM)), ("color", c)], g);
-        assert!(custom(col(0.0, 1.0, 0.0))[1] > custom(col(1.0, 0.0, 0.0))[1]);
-        // The Color swatch is ignored by the presets.
-        let warm = |c| px("ec.color.photofilter", &[("color", c)], g);
-        assert_eq!(warm(col(0.0, 1.0, 0.0)), warm(col(1.0, 0.0, 0.0)));
-    }
-
-    #[test]
-    fn color_balance_preserve_luminosity_and_black_stretch() {
-        let g = [0.5, 0.5, 0.5, 1.0];
-        let o = px("ec.color.colorbalance", &[("midRed", num(60.0)), ("preserveLuminosity", Value::Bool(true))], g);
-        assert!((luminance(o[0], o[1], o[2]) - 0.5).abs() < 1e-4 && o[0] > o[2]);
-        let dark = [0.1, 0.1, 0.1, 1.0];
-        assert!(px("ec.color.gammapedestalgain", &[("blackStretch", num(4.0))], dark)[0] > 0.15);
-        assert!(close(px("ec.color.gammapedestalgain", &[], dark), dark, 1e-6));
-    }
-
-    #[test]
-    fn levels_channel_controls_act_on_their_channel() {
-        let g = [0.5, 0.5, 0.5, 1.0];
-        assert!(close(px("ec.color.levels", &[("channel", Value::Enum(1))], g), g, 1e-6), "the popup alone changes nothing");
-        let r = px("ec.color.levels", &[("redOutWhite", num(0.5))], g);
-        assert!(close(r, [0.25, 0.5, 0.5, 1.0], 1e-5), "{r:?}");
-        let b = px("ec.color.levels", &[("blueGamma", num(2.0)), ("inWhite", num(0.5))], [0.25, 0.25, 0.25, 1.0]);
-        assert!(close(b, [0.5, 0.5, 0.5f32.sqrt(), 1.0], 1e-5), "RGB first, then blue: {b:?}");
-        let a = px("ec.color.levels", &[("alphaOutWhite", num(0.5))], [0.5, 0.5, 0.5, 1.0]);
-        assert!(close(a, [0.25, 0.25, 0.25, 0.5], 1e-5), "{a:?}");
-        // Per-channel clipping follows its own popups.
-        let hot = [0.9, 0.9, 0.9, 1.0];
-        let c = px("ec.color.levels", &[("greenInWhite", num(0.5))], hot)[1];
-        let nc = px("ec.color.levels", &[("greenInWhite", num(0.5)), ("greenClipToOutputWhite", Value::Enum(0))], hot)[1];
-        assert!((c - 1.0).abs() < 1e-6 && (nc - 1.8).abs() < 1e-5, "{c} {nc}");
-    }
-
-    #[test]
-    fn hue_saturation_ranges_adjust_their_hues_only() {
-        let red = [0.8, 0.1, 0.1, 1.0];
-        let blue = [0.1, 0.1, 0.8, 1.0];
-        let grey = [0.5, 0.5, 0.5, 1.0];
-        let v = [("redsSaturation", num(-100.0))];
-        let r = px("ec.color.huesaturation", &v, red);
-        assert!((r[0] - r[1]).abs() < 1e-4, "reds desaturated: {r:?}");
-        assert!(close(px("ec.color.huesaturation", &v, blue), blue, 1e-5));
-        assert!(close(px("ec.color.huesaturation", &v, grey), grey, 1e-5));
-        // Blues hue +120°: blue becomes red.
-        let b = px("ec.color.huesaturation", &[("bluesHue", num(120.0))], blue);
-        assert!(b[0] > 0.7 && b[2] < 0.2, "{b:?}");
-        // Fall-off: a hue 15° past the range end (Reds: −15..15, fall-off 30) gets half.
-        let orange_ish = {
-            let (r, g, b) = hsl_to_rgb(30.0 / 360.0, 0.8, 0.5);
-            [r, g, b, 1.0]
-        };
-        let o = px("ec.color.huesaturation", &[("redsLightness", num(100.0))], orange_ish);
-        let (_, _, l) = rgb_to_hsl(o[0], o[1], o[2]);
-        assert!((l - 0.75).abs() < 0.01, "half weight: {l}");
-        // Moving the range changes which hues it takes.
-        let o2 = px("ec.color.huesaturation", &[("redsLightness", num(100.0)), ("redsRangeEnd", num(40.0))], orange_ish);
-        assert!(rgb_to_hsl(o2[0], o2[1], o2[2]).2 > 0.99);
-        let params = crate::Params { values: [("redsHue".to_string(), num(10.0))].into_iter().collect() };
-        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [1.0, 1.0], seed: 0, adjustment: false, env: Default::default() };
-        assert!(!huesat_ranges_identity(&ctx));
-    }
-
-    #[test]
-    fn fill_mask_all_masks_feather_and_invert() {
-        let sq = |x0: f64, x1: f64| crate::MaskShape {
-            name: String::new(),
-            points: vec![[x0, 0.0], [x1, 0.0], [x1, 10.0], [x0, 10.0]],
-            closed: true,
-            inverted: false,
-        };
-        let masks = [sq(0.0, 5.0), sq(15.0, 20.0)];
-        let env = EffectEnv { masks: &masks, ..Default::default() };
-        let grey = Image::filled(20, 10, [0.5, 0.5, 0.5, 1.0]);
-        let run = |vals: &[(&str, Value)]| run_fx("ec.generate.fill", vals, grey.clone(), 0.0, env).img;
-        let one = run(&[("fillMask", num(1.0))]);
-        assert_eq!(one.get(2, 5), [1.0, 0.0, 0.0, 1.0]);
-        assert_eq!(one.get(10, 5), [0.5, 0.5, 0.5, 1.0]);
-        assert_eq!(one.get(17, 5), [0.5, 0.5, 0.5, 1.0]);
-        let all = run(&[("allMasks", Value::Bool(true))]);
-        assert_eq!(all.get(17, 5), [1.0, 0.0, 0.0, 1.0]);
-        let inv = run(&[("fillMask", num(1.0)), ("invert", Value::Bool(true))]);
-        assert_eq!(inv.get(2, 5), [0.5, 0.5, 0.5, 1.0]);
-        assert_eq!(inv.get(10, 5), [1.0, 0.0, 0.0, 1.0]);
-        let soft = run(&[("fillMask", num(1.0)), ("horizontalFeather", num(6.0))]);
-        let v = soft.get(6, 5)[1];
-        assert!(v > 0.05 && v < 0.5, "feathered edge {v}");
-        // Without masks, Fill fills the layer as before.
-        let plain = run_fx("ec.generate.fill", &[("fillMask", num(1.0))], grey.clone(), 0.0, EffectEnv::default()).img;
-        assert_eq!(plain.get(10, 5), [1.0, 0.0, 0.0, 1.0]);
-    }
-
-    #[test]
-    fn colorama_palettes_modify_selection_masking_and_add_phase() {
-        let grey = [0.5, 0.5, 0.5, 1.0];
-        let red = [1.0, 0.0, 0.0, 1.0];
-        // Ramp Grayscale: intensity 0.5 maps to mid grey.
-        let g = px("ec.color.colorama", &[("outputCycle/usePresetPalette", Value::Enum(1))], grey);
-        assert!((g[0] - 0.5).abs() < 0.01 && (g[0] - g[2]).abs() < 1e-5, "{g:?}");
-        // Custom palette: two stops, black at 0 and blue at 0.5.
-        let custom = [("outputCycle/usePresetPalette", Value::Enum(8)), ("outputCycle/palette", Value::Str("0:0,0,0 0.5:0,0,1".into()))];
-        let c = px("ec.color.colorama", &custom, grey);
-        assert!(c[2] > 0.99 && c[0] < 0.01, "{c:?}");
-        // Modify Lightness keeps the hue of the pixel (red stays red).
-        let l = px("ec.color.colorama", &[("modify/modify", Value::Enum(5)), ("outputCycle/usePresetPalette", Value::Enum(1))], red);
-        assert!(l[0] > l[1] + 0.2 && l[1] < 0.01 + l[2] + 1e-4, "{l:?}");
-        // Pixel Selection: only colours near Matching Color change.
-        let sel = [
-            ("pixelSelection/matchingMode", Value::Enum(1)),
-            ("pixelSelection/matchingColor", col(1.0, 0.0, 0.0)),
-            ("pixelSelection/matchingTolerance", num(10.0)),
-        ];
-        assert!(close(px("ec.color.colorama", &sel, grey), grey, 1e-6));
-        assert!(!close(px("ec.color.colorama", &sel, red), red, 1e-3));
-        // Composite Over Layer off: unselected pixels vanish.
-        let mut off = sel.to_vec();
-        off.push(("masking/compositeOverLayer", Value::Bool(false)));
-        assert_eq!(px("ec.color.colorama", &off, grey)[3], 0.0);
-        // Modify Alpha takes the palette alpha.
-        let alpha = [
-            ("outputCycle/usePresetPalette", Value::Enum(8)),
-            ("outputCycle/palette", Value::Str("0:1,1,1,0.25".into())),
-            ("modify/modifyAlpha", Value::Bool(true)),
-        ];
-        assert!((px("ec.color.colorama", &alpha, grey)[3] - 0.25).abs() < 1e-5);
-        // Palette parsing and evaluation.
-        let p = ColoramaPalette::parse("0.5:0,0,1 0:1,0,0").unwrap();
-        assert_eq!(p.eval(0.25, true), [0.5, 0.0, 0.5, 1.0]);
-        assert_eq!(p.eval(0.75, true), [0.5, 0.0, 0.5, 1.0], "wraps around");
-        assert_eq!(p.eval(0.25, false), [1.0, 0.0, 0.0, 1.0]);
-    }
-}
+mod tests;
diff --git a/crates/effects/src/color_fx/tests.rs b/crates/effects/src/color_fx/tests.rs
new file mode 100644
index 000000000..2f3370204
--- /dev/null
+++ b/crates/effects/src/color_fx/tests.rs
@@ -0,0 +1,508 @@
+use super::*;
+use crate::{EffectEnv, run_fx};
+use effectcraft_raster::Image;
+
+fn px(id: &str, vals: &[(&str, Value)], c: [f32; 4]) -> [f32; 4] {
+    run_fx(id, vals, Image::filled(2, 2, c), 0.0, EffectEnv::default()).img.get(0, 0)
+}
+fn close(a: [f32; 4], b: [f32; 4], eps: f32) -> bool {
+    a.iter().zip(b).all(|(x, y)| (x - y).abs() <= eps)
+}
+
+/// Projects saved before Use Legacy / the Photo Filter menu existed keep rendering as before.
+#[test]
+fn old_saves_get_legacy_values_for_added_params() {
+    use effectcraft_project::build::Ids;
+    let mut next = 1;
+    for (id, param, want) in
+        [("ec.color.brightnesscontrast", "useLegacy", Value::Bool(true)), ("ec.color.photofilter", "filter", Value::Enum(PHOTO_FILTER_CUSTOM))]
+    {
+        let spec = crate::find(id).unwrap();
+        let mut g = crate::instantiate(spec, &mut Ids(&mut next), spec.name, [10.0, 10.0]);
+        g.children.retain(|c| c.match_id() != param);
+        crate::migrate::upgrade_instance(spec, &mut g, &mut Ids(&mut next), [10.0, 10.0]);
+        assert_eq!(g.get(param).unwrap().value, want, "{id}");
+    }
+}
+
+/// After Effects 2026 renders of full-frame solids with Tint at its defaults (sRGB working
+/// space, not linearised, 32 bpc, 8-bit capture): Rec. 601 weights on the encoded values.
+#[test]
+fn tint_defaults_match_after_effects_greys() {
+    for (c, want) in [([1.0, 0.0, 0.0], 76.0), ([0.0, 1.0, 0.0], 150.0), ([0.0, 0.0, 1.0], 29.0), ([0.5, 0.5, 0.5], 128.0)] {
+        let o = px("ec.color.tint", &[], [c[0], c[1], c[2], 1.0]);
+        let want = want / 255.0;
+        assert!(close(o, [want, want, want, 1.0], 1.0 / 255.0), "{c:?}: {o:?} vs {want}");
+    }
+}
+
+#[test]
+fn colorama_reads_get_phase_from() {
+    // Same intensity, different red: Intensity gives one colour, Red gives two.
+    let a = [0.6, 0.2, 0.2, 1.0];
+    let b = [0.2, 0.2, 0.6, 1.0];
+    let red = |c| px("ec.color.colorama", &[("inputPhase/mode", Value::Enum(1))], c);
+    assert!(!close(red(a), red(b), 1e-3));
+    // Zero maps everything to the start of the cycle (red).
+    assert!(close(px("ec.color.colorama", &[("inputPhase/mode", Value::Enum(9))], b), [1.0, 0.0, 0.0, 1.0], 1e-5));
+    // Interpolate Palette off posterizes: two nearby inputs land on the same colour.
+    let off = |v: f32| px("ec.color.colorama", &[("outputCycle/interpolatePalette", Value::Bool(false))], [v, v, v, 1.0]);
+    assert_eq!(off(0.20), off(0.22));
+}
+
+#[test]
+fn brightness_contrast_modern_keeps_black_and_white_and_legacy_is_linear() {
+    let bc = |vals: &[(&str, Value)], v: f32| px("ec.color.brightnesscontrast", vals, [v, v, v, 1.0])[0];
+    let up = [("brightness", num(50.0)), ("contrast", num(40.0))];
+    assert_eq!(bc(&up, 0.0), 0.0);
+    assert!((bc(&up, 1.0) - 1.0).abs() < 1e-6);
+    assert!(bc(&up, 0.4) > 0.4);
+    let legacy = [("brightness", num(50.0)), ("useLegacy", Value::Bool(true))];
+    assert!((bc(&legacy, 0.2) - 0.7).abs() < 1e-5);
+    assert!((bc(&legacy, 0.0) - 0.5).abs() < 1e-5);
+}
+
+/// After Effects non-legacy ramps (kasper9n, #681). B0 C-100 matched B0 C-50 and is omitted.
+#[test]
+fn brightness_contrast_modern_matches_ae_ramp_samples() {
+    let u8 = |v: f32| (v * 255.0).round() as i32;
+    let go = |b: f64, c: f64, x: u8| {
+        u8(px("ec.color.brightnesscontrast", &[("brightness", num(b)), ("contrast", num(c))], [x as f32 / 255.0, x as f32 / 255.0, x as f32 / 255.0, 1.0])[0])
+    };
+    // (brightness, contrast, input, AE 8-bit)
+    let samples: &[(f64, f64, u8, u8)] = &[
+        (0.0, 100.0, 64, 40),
+        (0.0, 100.0, 128, 129),
+        (0.0, 100.0, 192, 217),
+        (0.0, 50.0, 64, 53),
+        (0.0, 50.0, 192, 205),
+        (0.0, -50.0, 64, 77),
+        (100.0, 0.0, 128, 209),
+        (50.0, 0.0, 128, 171),
+        (106.0, -18.0, 128, 214),
+    ];
+    for &(b, c, x, ae) in samples {
+        let got = go(b, c, x);
+        assert!((got - ae as i32).abs() <= 10, "B{b} C{c} in {x}: got {got} AE {ae}");
+    }
+    // Old g=4 S-curve put Contrast 100 at ~8/255 here.
+    assert!(go(0.0, 100.0, 64) >= 30);
+}
+
+/// After Effects 2026: Tritone Highlights [1, 1, 0.8], Midtones [0.6, 0.2, 0.2], Shadows
+/// [0, 0, 0.3]. On a red solid with Blend With Original 25 (case 718) AE gives (132, 23, 46);
+/// on a grey ramp (case 815) levels 0, 63.9, 127.6, 191.4 give (0, 0, 77), (77, 26, 64),
+/// (153, 51, 51), (204, 153, 128).
+#[test]
+fn tritone_matches_after_effects() {
+    let colours =
+        [("highlights", Value::Color([1.0, 1.0, 0.8, 1.0])), ("midtones", Value::Color([0.6, 0.2, 0.2, 1.0])), ("shadows", Value::Color([0.0, 0.0, 0.3, 1.0]))];
+    let near = |o: [f32; 4], ae: [f32; 3]| (0..3).all(|i| (o[i] * 255.0 - ae[i]).abs() <= 1.0);
+    let mut red = colours.to_vec();
+    red.push(("blend", num(25.0)));
+    let o = px("ec.color.tritone", &red, [1.0, 0.0, 0.0, 1.0]);
+    assert!(near(o, [132.0, 23.0, 46.0]), "{:?}", o.map(|v| v * 255.0));
+    for (level, ae) in [(0.1f32, [0.0, 0.0, 77.0]), (63.9, [77.0, 26.0, 64.0]), (127.6, [153.0, 51.0, 51.0]), (191.4, [204.0, 153.0, 128.0])] {
+        let v = level / 255.0;
+        let o = px("ec.color.tritone", &colours, [v, v, v, 1.0]);
+        assert!(near(o, ae), "level {level}: {:?} vs {ae:?}", o.map(|v| v * 255.0));
+    }
+}
+
+/// After Effects 2026, Tint Color [1, 0.5, 0]: a red solid at Reds 10 (case 717) and yellow
+/// and white solids at the default sliders (case 825).
+#[test]
+fn black_white_tint_matches_after_effects() {
+    let tint = [("tint", Value::Bool(true)), ("tintColor", Value::Color([1.0, 0.5, 0.0, 1.0]))];
+    let near = |o: [f32; 4], ae: [f32; 3]| (0..3).all(|i| (o[i] * 255.0 - ae[i]).abs() <= 1.5);
+    let mut reds = tint.to_vec();
+    reds.push(("reds", num(10.0)));
+    let o = px("ec.color.blackwhite", &reds, [1.0, 0.0, 0.0, 1.0]);
+    assert!(near(o, [43.0, 21.0, 0.0]), "{:?}", o.map(|v| v * 255.0));
+    let o = px("ec.color.blackwhite", &tint, [1.0, 1.0, 0.0, 1.0]);
+    assert!(near(o, [255.0, 129.0, 2.0]), "{:?}", o.map(|v| v * 255.0));
+    let o = px("ec.color.blackwhite", &tint, [1.0, 1.0, 1.0, 1.0]);
+    assert!(near(o, [255.0, 255.0, 255.0]), "{:?}", o.map(|v| v * 255.0));
+    // Hostile grays stay finite.
+    for g in [f32::NAN, -1.0, 0.0, 4.0] {
+        assert!(bw_tint([1.0, 0.5, 0.0], g).iter().all(|v| v.is_finite()));
+    }
+}
+
+/// After Effects 2026 ramps (RENDERER round 2, session R8): negative Brightness and Contrast
+/// are the inverses of the positive curves. (brightness, contrast, input, AE 8-bit)
+#[test]
+fn negative_brightness_and_contrast_invert_the_positive_curves() {
+    let go = |b: f64, c: f64, x: u8| {
+        let v = x as f32 / 255.0;
+        (px("ec.color.brightnesscontrast", &[("brightness", num(b)), ("contrast", num(c))], [v, v, v, 1.0])[0] * 255.0).round() as i32
+    };
+    let samples: &[(f64, f64, u8, u8)] = &[
+        (-40.0, 0.0, 64, 50),
+        (-40.0, 0.0, 128, 99),
+        (-40.0, 0.0, 191, 155),
+        (-40.0, 0.0, 234, 207),
+        (0.0, -50.0, 21, 28),
+        (0.0, -50.0, 64, 76),
+        (0.0, -50.0, 191, 179),
+        (0.0, -50.0, 234, 227),
+        (40.0, 0.0, 128, 162),
+        (0.0, 50.0, 64, 52),
+    ];
+    for &(b, c, x, ae) in samples {
+        let got = go(b, c, x);
+        assert!((got - ae as i32).abs() <= 7, "B{b} C{c} in {x}: got {got} AE {ae}");
+    }
+}
+
+/// #1463: Black & White's sliders set the gray of each pure hue and blend between
+/// neighbouring hues; neutral pixels keep their value, overbright ones too, and an overbright
+/// colour stays finite (it used to divide by zero).
+#[test]
+fn black_white_sliders_set_the_gray_of_each_hue() {
+    let bw = |vals: &[(&str, Value)], c: [f32; 3]| px("ec.color.blackwhite", vals, [c[0], c[1], c[2], 1.0]);
+    let gray = |v: f32| [v, v, v, 1.0];
+    // The defaults: Reds 40, Yellows 60, Greens 40, Cyans 60, Blues 20, Magentas 80 (%).
+    let hues = [
+        ([1.0, 0.0, 0.0], 0.4),
+        ([1.0, 1.0, 0.0], 0.6),
+        ([0.0, 1.0, 0.0], 0.4),
+        ([0.0, 1.0, 1.0], 0.6),
+        ([0.0, 0.0, 1.0], 0.2),
+        ([1.0, 0.0, 1.0], 0.8),
+        // Half as bright, half the gray; orange is halfway from Reds to Yellows.
+        ([0.5, 0.0, 0.0], 0.2),
+        ([1.0, 0.5, 0.0], 0.5),
+        // Neutral pixels keep their value.
+        ([0.3, 0.3, 0.3], 0.3),
+        ([4.0, 4.0, 4.0], 4.0),
+        // An overbright red: its smallest channel plus its chroma at Reds' 40 %.
+        ([1.5, 0.5, 0.5], 0.9),
+    ];
+    for (c, want) in hues {
+        let o = bw(&[], c);
+        assert!(close(o, gray(want), 1e-5), "{c:?}: {o:?}, want {want}");
+    }
+    assert!(close(bw(&[("reds", num(120.0))], [1.0, 0.0, 0.0]), gray(1.2), 1e-5));
+    assert!(close(bw(&[("reds", num(-200.0))], [1.0, 0.0, 0.0]), gray(0.0), 1e-5));
+    assert!(close(bw(&[("blues", num(300.0))], [0.1, 0.1, 0.3]), gray(0.7), 1e-5));
+}
+
+/// #1463: faint colour noise stays faint. The shadows of compressed footage carry a code or
+/// two of colour noise, which Black & White turned into bright and black blocks (the HSL
+/// saturation it scaled is near 1 for any tinted near-black pixel). At 8, 16 and 32 bpc the
+/// gray of a dark ramp with ±2 steps of colour noise stays within 2 steps of the clean ramp's.
+#[test]
+fn black_white_keeps_faint_colour_noise_faint() {
+    // A step of 8 bpc, of 16 bpc (After Effects' 0..32768), and a small 32-bpc float one.
+    for step in [1.0 / 255.0, 1.0 / 32768.0, 1e-3_f32] {
+        let (w, h) = (64u32, 4u32);
+        let (mut clean, mut noisy) = (Image::new(w, h), Image::new(w, h));
+        for y in 0..h {
+            for x in 0..w {
+                // A dark ramp up to a quarter gray, in whole steps...
+                let v = (x as f32 / w as f32 * 0.25 / step).round() * step;
+                // ...and up to ±2 steps of noise per channel, mixed differently in each pixel.
+                let n = |k: u32| (((x * 7 + y * 13 + k * 2) % 5) as f32 - 2.0) * step;
+                clean.set(x, y, [v, v, v, 1.0]);
+                noisy.set(x, y, [(v + n(0)).max(0.0), (v + n(1)).max(0.0), (v + n(2)).max(0.0), 1.0]);
+            }
+        }
+        let bw = |img| run_fx("ec.color.blackwhite", &[], img, 0.0, EffectEnv::default()).img;
+        let (a, b) = (bw(clean), bw(noisy));
+        let worst = a.data.iter().zip(&b.data).map(|(p, q)| (p[0] - q[0]).abs()).fold(0.0, f32::max);
+        assert!(worst <= 2.0 * step + 1e-6, "step {step}: the noise moved the gray by {} steps", worst / step);
+    }
+}
+
+#[test]
+fn levels_clips_black_and_white_independently() {
+    let lv = |vals: &[(&str, Value)], v: f32| px("ec.color.levels", vals, [v, v, v, 1.0])[0];
+    let base = [("inBlack", num(0.2)), ("inWhite", num(0.6)), ("outBlack", num(0.1)), ("outWhite", num(0.9))];
+    assert!((lv(&base, 0.9) - 0.9).abs() < 1e-5);
+    let mut no_white = base.to_vec();
+    no_white.push(("clipToOutputWhite", Value::Enum(0)));
+    assert!(lv(&no_white, 0.9) > 0.9);
+    assert!((lv(&no_white, 0.0) - 0.1).abs() < 1e-5);
+    // The hidden switch of older projects turns both off.
+    let mut legacy = base.to_vec();
+    legacy.push(("noClip", Value::Bool(true)));
+    assert!(lv(&legacy, 0.9) > 0.9);
+}
+
+#[test]
+fn exposure_individual_channels_and_bypass() {
+    let g = [0.5, 0.5, 0.5, 1.0];
+    let one = px("ec.color.exposure", &[("channels", Value::Enum(1)), ("red/redExposure", num(1.0))], g);
+    assert!(one[0] > 0.6 && (one[1] - 0.5).abs() < 1e-5 && (one[2] - 0.5).abs() < 1e-5);
+    // Master values are ignored in Individual Channels mode.
+    assert!(close(px("ec.color.exposure", &[("channels", Value::Enum(1)), ("master/exposure", num(2.0))], g), g, 1e-5));
+    // Bypass Linear Light Conversion: +1 stop doubles the raw value.
+    let raw = px("ec.color.exposure", &[("master/exposure", num(1.0)), ("bypassLinearLight", Value::Bool(true))], [0.25, 0.25, 0.25, 1.0]);
+    assert!((raw[0] - 0.5).abs() < 1e-5);
+    // Negative results are mirrored, not clipped.
+    let neg =
+        px("ec.color.exposure", &[("master/offset", num(-0.5)), ("bypassLinearLight", Value::Bool(true)), ("master/gamma", num(2.0))], [0.25, 0.25, 0.25, 1.0]);
+    assert!((neg[0] + 0.5).abs() < 1e-4, "{neg:?}");
+}
+
+/// After Effects' Exposure ranges for all twelve sliders; a saved value outside them (a gamma
+/// of 0.05, valid before, as in Photoshop) survives loading and still renders.
+#[test]
+fn exposure_has_after_effects_ranges_and_keeps_old_values() {
+    use effectcraft_project::build::Ids;
+    let spec = crate::find("ec.color.exposure").unwrap();
+    let want = [(-100.0, 100.0, -4.0, 4.0, 2), (-2.0, 2.0, -0.5, 0.5, 4), (0.1, 10.0, 0.1, 10.0, 2)];
+    let sliders: Vec<_> = spec
+        .params
+        .iter()
+        .filter_map(|p| match p.ui {
+            ParamUi::Slider { min, max, slider_min, slider_max, decimals } => Some((p.id, (min, max, slider_min, slider_max, decimals))),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(sliders.len(), 12);
+    for (i, (id, r)) in sliders.iter().enumerate() {
+        assert_eq!(*r, want[i % 3], "{id}");
+    }
+    let mut next = 1;
+    let mut g = crate::instantiate(spec, &mut Ids(&mut next), spec.name, [10.0, 10.0]);
+    let gamma = g.prop_mut("master/gamma").unwrap();
+    gamma.value = num(0.05);
+    gamma.ui = slider(0.01, 9.99, 0.1, 3.0, 2);
+    crate::migrate::upgrade_instance(spec, &mut g, &mut Ids(&mut next), [10.0, 10.0]);
+    let gamma = g.prop_mut("master/gamma").unwrap();
+    assert_eq!(gamma.value, num(0.05));
+    assert!(matches!(gamma.ui, ParamUi::Slider { min, .. } if min == 0.1));
+    let o = px("ec.color.exposure", &[("master/gamma", num(0.05)), ("bypassLinearLight", Value::Bool(true))], [0.5, 0.5, 0.5, 1.0]);
+    assert!((o[0] - 0.5f32.powf(20.0)).abs() < 1e-9, "{o:?}");
+}
+
+/// Exposure on a red [1, 0, 0] solid against After Effects 2026 renders (sRGB working space,
+/// not linearised, 32 bpc, 8-bit captures): the linear-light conversion is a pure 2.2 power.
+/// The piecewise sRGB curve gave 2 / 7 / 39 for the three smallest Offsets.
+#[test]
+fn exposure_matches_after_effects_gamma_2_2() {
+    let red = [1.0, 0.0, 0.0, 1.0];
+    let code = |o: [f32; 4], i: usize| o[i] * 255.0;
+    // Master Offset only: G and B carry the curve; R goes over 1 (255 in the 8-bit capture).
+    for (offset, ae) in [(0.0005, 8.0), (0.002, 15.0), (0.02, 43.0), (0.1, 90.0)] {
+        let o = px("ec.color.exposure", &[("master/offset", num(offset))], red);
+        for i in [1, 2] {
+            assert!((code(o, i) - ae).abs() <= 1.0, "offset {offset}: {} vs AE {ae}", code(o, i));
+        }
+        assert!(o[0] >= 1.0, "{o:?}");
+    }
+    // Exposure −2.25: AE 126; with Bypass Linear Light Conversion (gain on encoded values) 54.
+    let o = px("ec.color.exposure", &[("master/exposure", num(-2.25))], red);
+    assert!((code(o, 0) - 126.0).abs() <= 1.0 && o[1] == 0.0, "{o:?}");
+    let o = px("ec.color.exposure", &[("master/exposure", num(-2.25)), ("bypassLinearLight", Value::Bool(true))], red);
+    assert!((code(o, 0) - 54.0).abs() <= 1.0 && o[1] == 0.0, "{o:?}");
+    // Default settings leave 32-bpc values alone, negative and over-range ones included.
+    let hdr = [-0.25, 0.5, 2.0, 1.0];
+    assert!(close(px("ec.color.exposure", &[], hdr), hdr, 1e-5));
+    // A negative Offset pushes black below zero, mirrored, rather than clipping or NaN.
+    let o = px("ec.color.exposure", &[("master/offset", num(-0.02))], [0.0, 0.0, 0.0, 1.0]);
+    assert!((o[0] + 0.02f32.powf(1.0 / 2.2)).abs() < 1e-5, "{o:?}");
+}
+
+#[test]
+fn change_to_color_change_modes_tolerances_and_matte() {
+    let red = [0.8, 0.1, 0.1, 1.0];
+    let green = [0.1, 0.8, 0.1, 1.0];
+    let base = [("from", col(0.8, 0.1, 0.1)), ("to", col(0.1, 0.1, 0.8))];
+    // Hue only: red turns blue with its own lightness / saturation; green is untouched.
+    let o = px("ec.color.changetocolor", &base, red);
+    assert!(o[2] > 0.7 && o[0] < 0.2, "{o:?}");
+    assert!(close(px("ec.color.changetocolor", &base, green), green, 1e-5));
+    // The matte is white where matched, black elsewhere.
+    let mut m = base.to_vec();
+    m.push(("viewCorrectionMatte", Value::Bool(true)));
+    assert!(close(px("ec.color.changetocolor", &m, red), [1.0, 1.0, 1.0, 1.0], 1e-5));
+    assert!(close(px("ec.color.changetocolor", &m, green), [0.0, 0.0, 0.0, 1.0], 1e-5));
+    // A lightness tolerance of 0 rejects a lighter red.
+    let mut strict = m.clone();
+    strict.push(("toleranceGroup/lightness", num(0.0)));
+    strict.push(("softness", num(0.0)));
+    assert!(close(px("ec.color.changetocolor", &strict, [1.0, 0.5, 0.5, 1.0]), [0.0, 0.0, 0.0, 1.0], 1e-5));
+    // Hue, Lightness & Saturation, set: a matched pixel becomes the To colour.
+    let mut all = base.to_vec();
+    all.push(("change", Value::Enum(3)));
+    assert!(close(px("ec.color.changetocolor", &all, red), [0.1, 0.1, 0.8, 1.0], 1e-4));
+}
+
+#[test]
+fn leave_color_tolerance_softness_and_match_mode() {
+    let green = [0.1, 0.8, 0.1, 1.0];
+    let lc = |vals: &[(&str, Value)]| {
+        let mut v = vec![("amount", num(100.0))];
+        v.extend_from_slice(vals);
+        px("ec.color.leavecolor", &v, green)
+    };
+    let g = luminance(0.1, 0.8, 0.1);
+    assert!(close(lc(&[]), [g, g, g, 1.0], 1e-5));
+    assert!(close(lc(&[("tolerance", num(100.0))]), green, 1e-6));
+    // Softness keeps part of the colour.
+    let s = lc(&[("tolerance", num(10.0)), ("edgeSoftness", num(100.0))]);
+    assert!(s[1] > g + 0.05 && s[1] < 0.8);
+    // Using Hue: a dark red still matches pure red.
+    let dark = px("ec.color.leavecolor", &[("amount", num(100.0)), ("tolerance", num(5.0)), ("matchColors", Value::Enum(1))], [0.4, 0.0, 0.0, 1.0]);
+    assert!(close(dark, [0.4, 0.0, 0.0, 1.0], 1e-6));
+}
+
+#[test]
+fn photo_filter_presets_and_custom() {
+    let g = [0.5, 0.5, 0.5, 1.0];
+    let cool = px("ec.color.photofilter", &[("filter", Value::Enum(3)), ("preserveLuminosity", Value::Bool(false))], g);
+    assert!(cool[2] > cool[0], "a cooling filter is blue: {cool:?}");
+    let custom = |c| px("ec.color.photofilter", &[("filter", Value::Enum(PHOTO_FILTER_CUSTOM)), ("color", c)], g);
+    assert!(custom(col(0.0, 1.0, 0.0))[1] > custom(col(1.0, 0.0, 0.0))[1]);
+    // The Color swatch is ignored by the presets.
+    let warm = |c| px("ec.color.photofilter", &[("color", c)], g);
+    assert_eq!(warm(col(0.0, 1.0, 0.0)), warm(col(1.0, 0.0, 0.0)));
+}
+
+#[test]
+fn color_balance_preserve_luminosity_and_black_stretch() {
+    let g = [0.5, 0.5, 0.5, 1.0];
+    let o = px("ec.color.colorbalance", &[("midRed", num(60.0)), ("preserveLuminosity", Value::Bool(true))], g);
+    assert!((luminance(o[0], o[1], o[2]) - 0.5).abs() < 1e-4 && o[0] > o[2]);
+    let dark = [0.1, 0.1, 0.1, 1.0];
+    assert!(px("ec.color.gammapedestalgain", &[("blackStretch", num(4.0))], dark)[0] > 0.15);
+    assert!(close(px("ec.color.gammapedestalgain", &[], dark), dark, 1e-6));
+}
+
+#[test]
+fn levels_channel_controls_act_on_their_channel() {
+    let g = [0.5, 0.5, 0.5, 1.0];
+    assert!(close(px("ec.color.levels", &[("channel", Value::Enum(1))], g), g, 1e-6), "the popup alone changes nothing");
+    let r = px("ec.color.levels", &[("redOutWhite", num(0.5))], g);
+    assert!(close(r, [0.25, 0.5, 0.5, 1.0], 1e-5), "{r:?}");
+    let b = px("ec.color.levels", &[("blueGamma", num(2.0)), ("inWhite", num(0.5))], [0.25, 0.25, 0.25, 1.0]);
+    assert!(close(b, [0.5, 0.5, 0.5f32.sqrt(), 1.0], 1e-5), "RGB first, then blue: {b:?}");
+    let a = px("ec.color.levels", &[("alphaOutWhite", num(0.5))], [0.5, 0.5, 0.5, 1.0]);
+    assert!(close(a, [0.25, 0.25, 0.25, 0.5], 1e-5), "{a:?}");
+    // Per-channel clipping follows its own popups.
+    let hot = [0.9, 0.9, 0.9, 1.0];
+    let c = px("ec.color.levels", &[("greenInWhite", num(0.5))], hot)[1];
+    let nc = px("ec.color.levels", &[("greenInWhite", num(0.5)), ("greenClipToOutputWhite", Value::Enum(0))], hot)[1];
+    assert!((c - 1.0).abs() < 1e-6 && (nc - 1.8).abs() < 1e-5, "{c} {nc}");
+}
+
+#[test]
+fn hue_saturation_ranges_adjust_their_hues_only() {
+    let red = [0.8, 0.1, 0.1, 1.0];
+    let blue = [0.1, 0.1, 0.8, 1.0];
+    let grey = [0.5, 0.5, 0.5, 1.0];
+    let v = [("redsSaturation", num(-100.0))];
+    let r = px("ec.color.huesaturation", &v, red);
+    assert!((r[0] - r[1]).abs() < 1e-4, "reds desaturated: {r:?}");
+    assert!(close(px("ec.color.huesaturation", &v, blue), blue, 1e-5));
+    assert!(close(px("ec.color.huesaturation", &v, grey), grey, 1e-5));
+    // Blues hue +120°: blue becomes red.
+    let b = px("ec.color.huesaturation", &[("bluesHue", num(120.0))], blue);
+    assert!(b[0] > 0.7 && b[2] < 0.2, "{b:?}");
+    // Fall-off: a hue 15° past the range end (Reds: −15..15, fall-off 30) gets half.
+    let orange_ish = {
+        let (r, g, b) = hsl_to_rgb(30.0 / 360.0, 0.8, 0.5);
+        [r, g, b, 1.0]
+    };
+    let o = px("ec.color.huesaturation", &[("redsLightness", num(100.0))], orange_ish);
+    let (_, _, l) = rgb_to_hsl(o[0], o[1], o[2]);
+    assert!((l - 0.75).abs() < 0.01, "half weight: {l}");
+    // Moving the range changes which hues it takes.
+    let o2 = px("ec.color.huesaturation", &[("redsLightness", num(100.0)), ("redsRangeEnd", num(40.0))], orange_ish);
+    assert!(rgb_to_hsl(o2[0], o2[1], o2[2]).2 > 0.99);
+    let params = crate::Params { values: [("redsHue".to_string(), num(10.0))].into_iter().collect() };
+    let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [1.0, 1.0], seed: 0, adjustment: false, env: Default::default() };
+    assert!(!huesat_ranges_identity(&ctx));
+}
+
+#[test]
+fn fill_mask_all_masks_feather_and_invert() {
+    let sq =
+        |x0: f64, x1: f64| crate::MaskShape { name: String::new(), points: vec![[x0, 0.0], [x1, 0.0], [x1, 10.0], [x0, 10.0]], closed: true, inverted: false };
+    let masks = [sq(0.0, 5.0), sq(15.0, 20.0)];
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let grey = Image::filled(20, 10, [0.5, 0.5, 0.5, 1.0]);
+    let run = |vals: &[(&str, Value)]| run_fx("ec.generate.fill", vals, grey.clone(), 0.0, env).img;
+    let one = run(&[("fillMask", num(1.0))]);
+    assert_eq!(one.get(2, 5), [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(one.get(10, 5), [0.5, 0.5, 0.5, 1.0]);
+    assert_eq!(one.get(17, 5), [0.5, 0.5, 0.5, 1.0]);
+    let all = run(&[("allMasks", Value::Bool(true))]);
+    assert_eq!(all.get(17, 5), [1.0, 0.0, 0.0, 1.0]);
+    let inv = run(&[("fillMask", num(1.0)), ("invert", Value::Bool(true))]);
+    assert_eq!(inv.get(2, 5), [0.5, 0.5, 0.5, 1.0]);
+    assert_eq!(inv.get(10, 5), [1.0, 0.0, 0.0, 1.0]);
+    let soft = run(&[("fillMask", num(1.0)), ("horizontalFeather", num(6.0))]);
+    let v = soft.get(6, 5)[1];
+    assert!(v > 0.05 && v < 0.5, "feathered edge {v}");
+    // Without masks, Fill fills the layer as before.
+    let plain = run_fx("ec.generate.fill", &[("fillMask", num(1.0))], grey.clone(), 0.0, EffectEnv::default()).img;
+    assert_eq!(plain.get(10, 5), [1.0, 0.0, 0.0, 1.0]);
+}
+
+/// After Effects 2026: Fill (0, 0.5, 1) at Opacity 50 % on an opaque layer (a Gradient Ramp
+/// on a red solid) renders premultiplied (0, 0.251, 0.502) at alpha 0.502 everywhere: the
+/// fill colour at half the layer's alpha, nothing of the ramp left.
+#[test]
+fn fill_opacity_is_the_layers_opacity_as_in_after_effects() {
+    let mut img = Image::new(16, 4);
+    for x in 0..16 {
+        let v = x as f32 / 15.0;
+        for y in 0..4 {
+            img.set(x, y, [v, 0.0, 0.0, 1.0]);
+        }
+    }
+    let vals = [("color", Value::Color([0.0, 0.5, 1.0, 1.0])), ("opacity", num(50.0))];
+    let out = run_fx("ec.generate.fill", &vals, img, 0.0, EffectEnv::default()).img;
+    for x in [0, 7, 15] {
+        let p = out.get(x, 2);
+        let ae = [0.0, 0.251, 0.502, 0.502];
+        assert!(p.iter().zip(ae).all(|(v, a)| (v - a).abs() < 1.0 / 255.0), "x {x}: {p:?} vs AE {ae:?}");
+    }
+    // A half-transparent pixel ends at a quarter alpha, still the fill colour.
+    let half = run_fx("ec.generate.fill", &vals, Image::filled(2, 2, [0.2, 0.2, 0.2, 0.5]), 0.0, EffectEnv::default()).img;
+    assert_eq!(half.get(0, 0), [0.0, 0.125, 0.25, 0.25]);
+}
+
+#[test]
+fn colorama_palettes_modify_selection_masking_and_add_phase() {
+    let grey = [0.5, 0.5, 0.5, 1.0];
+    let red = [1.0, 0.0, 0.0, 1.0];
+    // Ramp Grayscale: intensity 0.5 maps to mid grey.
+    let g = px("ec.color.colorama", &[("outputCycle/usePresetPalette", Value::Enum(1))], grey);
+    assert!((g[0] - 0.5).abs() < 0.01 && (g[0] - g[2]).abs() < 1e-5, "{g:?}");
+    // Custom palette: two stops, black at 0 and blue at 0.5.
+    let custom = [("outputCycle/usePresetPalette", Value::Enum(8)), ("outputCycle/palette", Value::Str("0:0,0,0 0.5:0,0,1".into()))];
+    let c = px("ec.color.colorama", &custom, grey);
+    assert!(c[2] > 0.99 && c[0] < 0.01, "{c:?}");
+    // Modify Lightness keeps the hue of the pixel (red stays red).
+    let l = px("ec.color.colorama", &[("modify/modify", Value::Enum(5)), ("outputCycle/usePresetPalette", Value::Enum(1))], red);
+    assert!(l[0] > l[1] + 0.2 && l[1] < 0.01 + l[2] + 1e-4, "{l:?}");
+    // Pixel Selection: only colours near Matching Color change.
+    let sel = [
+        ("pixelSelection/matchingMode", Value::Enum(1)),
+        ("pixelSelection/matchingColor", col(1.0, 0.0, 0.0)),
+        ("pixelSelection/matchingTolerance", num(10.0)),
+    ];
+    assert!(close(px("ec.color.colorama", &sel, grey), grey, 1e-6));
+    assert!(!close(px("ec.color.colorama", &sel, red), red, 1e-3));
+    // Composite Over Layer off: unselected pixels vanish.
+    let mut off = sel.to_vec();
+    off.push(("masking/compositeOverLayer", Value::Bool(false)));
+    assert_eq!(px("ec.color.colorama", &off, grey)[3], 0.0);
+    // Modify Alpha takes the palette alpha.
+    let alpha = [
+        ("outputCycle/usePresetPalette", Value::Enum(8)),
+        ("outputCycle/palette", Value::Str("0:1,1,1,0.25".into())),
+        ("modify/modifyAlpha", Value::Bool(true)),
+    ];
+    assert!((px("ec.color.colorama", &alpha, grey)[3] - 0.25).abs() < 1e-5);
+    // Palette parsing and evaluation.
+    let p = ColoramaPalette::parse("0.5:0,0,1 0:1,0,0").unwrap();
+    assert_eq!(p.eval(0.25, true), [0.5, 0.0, 0.5, 1.0]);
+    assert_eq!(p.eval(0.75, true), [0.5, 0.0, 0.5, 1.0], "wraps around");
+    assert_eq!(p.eval(0.25, false), [1.0, 0.0, 0.0, 1.0]);
+}
diff --git a/crates/effects/src/crypto_select.rs b/crates/effects/src/crypto_select.rs
new file mode 100644
index 000000000..19d93cdba
--- /dev/null
+++ b/crates/effects/src/crypto_select.rs
@@ -0,0 +1,122 @@
+//! Editing a Cryptomatte effect's Selection text from a pick in the viewer (#473): replace it
+//! with the picked ID, add it, or remove it, in the grammar `selection_hashes` reads.
+
+use crate::channel3d::{selection_hashes, selection_names};
+
+/// How a pick changes the selection.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PickMode {
+    Replace,
+    Add,
+    Remove,
+}
+
+/// A name as a selection token: quoted (with `\` escapes) when it has a comma, a quote or a
+/// backslash, which the selection parser would otherwise split on or read as syntax.
+fn quote(name: &str) -> String {
+    if !name.contains([',', '"', '\'', '\\']) {
+        return name.to_string();
+    }
+    let mut out = String::from("\"");
+    for c in name.chars() {
+        if c == '"' || c == '\\' {
+            out.push('\\');
+        }
+        out.push(c);
+    }
+    out.push('"');
+    out
+}
+
+/// The selection token for the ID `hash` named `name` in `manifest`: the (quoted) name when it
+/// reads back as exactly that ID, else `<hex>`. That covers unnamed IDs, names with `*` (which
+/// would select by wildcard), names that look like `<hex>`, names with surrounding spaces (the
+/// parser trims them) and names shared by several IDs.
+pub fn token_for(name: Option<&str>, hash: u32, manifest: Option<&[(String, u32)]>) -> String {
+    match name {
+        Some(n) if !n.is_empty() && !n.contains('*') && selection_hashes(&quote(n), manifest) == [hash] => quote(n),
+        _ => format!("<{hash:08x}>"),
+    }
+}
+
+/// `sel` edited by a pick of the ID `hash` whose token is `token` (see [`token_for`]). The text
+/// stays as typed when the edit wouldn't change what it selects: Replace when it selects just
+/// that ID, Add when it already selects it, Remove when no name or `<hex>` token selects it (a
+/// wildcard that matches it stays). Other tokens (wildcards included) keep their text,
+/// re-quoted where needed, separated by `, `.
+pub fn edit_selection(sel: &str, token: &str, hash: u32, mode: PickMode, manifest: Option<&[(String, u32)]>) -> String {
+    let tokens: Vec<String> = selection_names(sel).into_iter().filter(|t| !t.is_empty()).collect();
+    let selects = |t: &String| !t.contains('*') && selection_hashes(&quote(t), manifest).contains(&hash);
+    let kept: Vec<String> = match mode {
+        PickMode::Replace if selection_hashes(sel, manifest) == [hash] => return sel.to_string(),
+        PickMode::Replace => return token.to_string(),
+        PickMode::Add if selection_hashes(sel, manifest).contains(&hash) => return sel.to_string(),
+        PickMode::Add => tokens.iter().map(|t| quote(t)).chain([token.to_string()]).collect(),
+        PickMode::Remove if !tokens.iter().any(selects) => return sel.to_string(),
+        PickMode::Remove => tokens.iter().filter(|t| !selects(t)).map(|t| quote(t)).collect(),
+    };
+    kept.join(", ")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use effectcraft_raster::channels3d::crypto_hash;
+
+    fn manifest() -> Vec<(String, u32)> {
+        ["bunny", "Green, Glossy", r#"say "hi""#, r"back\slash", "  pad ", "star*", "<0000abcd>", "twin"]
+            .iter()
+            .map(|n| (n.to_string(), crypto_hash(n)))
+            .chain([("twin".to_string(), 7)])
+            .collect()
+    }
+
+    /// Every name's token reads back as exactly its ID, through the effect's own parser.
+    #[test]
+    fn tokens_round_trip_through_selection_hashes() {
+        let m = manifest();
+        for (n, h) in &m {
+            let t = token_for(Some(n), *h, Some(&m));
+            assert_eq!(selection_hashes(&t, Some(&m)), [*h], "{n:?} → {t:?}");
+        }
+        assert_eq!(token_for(Some("bunny"), crypto_hash("bunny"), Some(&m)), "bunny");
+        assert_eq!(token_for(Some("Green, Glossy"), crypto_hash("Green, Glossy"), Some(&m)), r#""Green, Glossy""#);
+        assert_eq!(token_for(Some(r#"say "hi""#), crypto_hash(r#"say "hi""#), Some(&m)), r#""say \"hi\"""#);
+        // Wildcard-looking, hash-looking, empty, unnamed and shared names: the hash.
+        assert_eq!(token_for(Some("star*"), crypto_hash("star*"), Some(&m)), format!("<{:08x}>", crypto_hash("star*")));
+        assert_eq!(token_for(Some("<0000abcd>"), crypto_hash("<0000abcd>"), Some(&m)), format!("<{:08x}>", crypto_hash("<0000abcd>")));
+        assert_eq!(token_for(Some(""), 5, Some(&m)), "<00000005>");
+        assert_eq!(token_for(Some("  pad "), crypto_hash("  pad "), Some(&m)), format!("<{:08x}>", crypto_hash("  pad ")));
+        assert_eq!(token_for(None, 0xdead_beef, None), "<deadbeef>");
+        assert_eq!(token_for(Some("twin"), 7, Some(&m)), "<00000007>", "the name selects the other twin");
+    }
+
+    #[test]
+    fn add_and_remove_keep_other_tokens_and_skip_duplicates() {
+        let m = manifest();
+        let (b, g) = (crypto_hash("bunny"), crypto_hash("Green, Glossy"));
+        let tok = |n: &str| token_for(Some(n), crypto_hash(n), Some(&m));
+        let edit = |sel: &str, n: &str, mode| edit_selection(sel, &tok(n), crypto_hash(n), mode, Some(&m));
+        assert_eq!(edit("anything, else", "bunny", PickMode::Replace), "bunny");
+        assert_eq!(edit(" bunny ", "bunny", PickMode::Replace), " bunny ", "same meaning: unchanged");
+        assert_eq!(edit("", "bunny", PickMode::Add), "bunny");
+        assert_eq!(edit("bunny", "Green, Glossy", PickMode::Add), r#"bunny, "Green, Glossy""#);
+        // Already selected: by name, by hash, by a wildcard. The text stays as typed.
+        assert_eq!(edit("bunny,floor", "bunny", PickMode::Add), "bunny,floor");
+        assert_eq!(edit(&format!("<{b:08x}>"), "bunny", PickMode::Add), format!("<{b:08x}>"));
+        assert_eq!(edit("bun*", "bunny", PickMode::Add), "bun*");
+        // Other tokens keep their meaning: quoted where needed, wildcards stay wildcards.
+        assert_eq!(edit(r#"'a, b', fl*, "x, *""#, "bunny", PickMode::Add), r#""a, b", fl*, "x, *", bunny"#);
+        assert_eq!(edit(r#""Green, Glossy", bunny"#, "bunny", PickMode::Remove), r#""Green, Glossy""#);
+        assert_eq!(edit(&format!("bunny, <{b:08x}>, x, bunny"), "bunny", PickMode::Remove), "x");
+        assert_eq!(edit(&format!("<{g:08x}>"), "Green, Glossy", PickMode::Remove), "");
+        // Not selected, or only by a wildcard: unchanged.
+        assert_eq!(edit("a ,b", "bunny", PickMode::Remove), "a ,b");
+        assert_eq!(edit("bun*, x", "bunny", PickMode::Remove), "bun*, x");
+        for sel in [r#""a, b", fl*, bunny"#, r#"x, "Green, Glossy", "say \"hi\"", "back\\slash""#] {
+            let before = selection_hashes(sel, Some(&m));
+            let after = selection_hashes(&edit(sel, "  pad ", PickMode::Add), Some(&m));
+            assert_eq!(after, [before, vec![crypto_hash("  pad ")]].concat(), "{sel}");
+        }
+    }
+}
diff --git a/crates/effects/src/display_names.rs b/crates/effects/src/display_names.rs
new file mode 100644
index 000000000..b30c00d46
--- /dev/null
+++ b/crates/effects/src/display_names.rs
@@ -0,0 +1,123 @@
+//! Display naming must not change file, command or script identities.
+use crate::{find, instantiate, lookup, name_matches};
+use effectcraft_project::build::Ids;
+
+const RENAMED: &[(&str, &str, &str)] = &[
+    ("ec.sim.ccballaction", "CC Ball Action", "Ball Grid"),
+    ("ec.distort.ccbendit", "CC Bend It", "Two-Point Bend"),
+    ("ec.distort.ccbender", "CC Bender", "Flexible Bend"),
+    ("ec.distort.ccblobbylize", "CC Blobbylize", "Organic Displacement"),
+    ("ec.stylize.ccblockload", "CC Block Load", "Block Reveal"),
+    ("ec.sim.ccbubbles", "CC Bubbles", "Bubbles"),
+    ("ec.stylize.ccburnfilm", "CC Burn Film", "Film Burn"),
+    ("ec.color.cccolorneutralizer", "CC Color Neutralizer", "Color Neutralizer"),
+    ("ec.color.cccoloroffset", "CC Color Offset", "Channel Offset"),
+    ("ec.channel.cccomposite", "CC Composite", "Source Composite"),
+    ("ec.blur.cccross", "CC Cross Blur", "Cross Blur"),
+    ("ec.perspective.cccylinder", "CC Cylinder", "Cylinder Wrap"),
+    ("ec.sim.ccdrizzle", "CC Drizzle", "Water Ripples"),
+    ("ec.perspective.ccenvironment", "CC Environment", "Environment Map"),
+    ("ec.distort.ccflomotion", "CC Flo Motion", "Dual Lens Warp"),
+    ("ec.time.ccforcemotionblur", "CC Force Motion Blur", "Temporal Motion Blur"),
+    ("ec.stylize.ccglass", "CC Glass", "Glass Relief"),
+    ("ec.transition.ccglasswipe", "CC Glass Wipe", "Glass Wipe"),
+    ("ec.generate.ccgluegun", "CC Glue Gun", "Paint Beads"),
+    ("ec.transition.ccgridwipe", "CC Grid Wipe", "Grid Wipe"),
+    ("ec.distort.ccgriddler", "CC Griddler", "Tile Grid"),
+    ("ec.sim.cchair", "CC Hair", "Surface Fibers"),
+    ("ec.stylize.cchextile", "CC HexTile", "Hexagonal Tiles"),
+    ("ec.transition.ccimagewipe", "CC Image Wipe", "Luminance Image Wipe"),
+    ("ec.transition.ccjaws", "CC Jaws", "Serrated Wipe"),
+    ("ec.stylize.cckaleida", "CC Kaleida", "Kaleidoscope"),
+    ("ec.color.cckernel", "CC Kernel", "Convolution Kernel"),
+    ("ec.distort.cclens", "CC Lens", "Lens Distortion"),
+    ("ec.generate.cclightburst", "CC Light Burst 2.5", "Radial Light Burst"),
+    ("ec.generate.cclightrays", "CC Light Rays", "Light Rays"),
+    ("ec.generate.cclightsweep", "CC Light Sweep", "Light Sweep"),
+    ("ec.transition.cclightwipe", "CC Light Wipe", "Light Wipe"),
+    ("ec.transition.cclinesweep", "CC Line Sweep", "Line Sweep"),
+    ("ec.sim.ccmrmercury", "CC Mr. Mercury", "Liquid Particles"),
+    ("ec.stylize.ccmrsmoothie", "CC Mr. Smoothie", "Palette Map"),
+    ("ec.utility.ccoverbrights", "CC Overbrights", "Out-of-Range Display"),
+    ("ec.distort.ccpageturn", "CC Page Turn", "Page Curl"),
+    ("ec.sim.ccparticlesystems2", "CC Particle Systems II", "Particle Emitter 2D"),
+    ("ec.sim.ccparticleworld", "CC Particle World", "Particle Emitter 3D"),
+    ("ec.sim.ccpixelpolly", "CC Pixel Polly", "Pixel Shatter"),
+    ("ec.stylize.ccplastic", "CC Plastic", "Plastic Shading"),
+    ("ec.distort.ccpowerpin", "CC Power Pin", "Perspective Pin"),
+    ("ec.blur.ccradial", "CC Radial Blur", "Variable Radial Blur"),
+    ("ec.blur.ccradialfast", "CC Radial Fast Blur", "Fast Radial Blur"),
+    ("ec.transition.ccradialscalewipe", "CC Radial ScaleWipe", "Radial Scale Wipe"),
+    ("ec.sim.ccrainfall", "CC Rainfall", "Rainfall"),
+    ("ec.stylize.ccrepetile", "CC RepeTile", "Edge Tile Repeat"),
+    ("ec.distort.ccripplepulse", "CC Ripple Pulse", "Pulsed Ripple"),
+    ("ec.transition.ccscalewipe", "CC Scale Wipe", "Scale Wipe"),
+    ("ec.sim.ccscatterize", "CC Scatterize", "Pixel Scatter"),
+    ("ec.key.ccsimplewireremoval", "CC Simple Wire Removal", "Line Removal"),
+    ("ec.distort.ccslant", "CC Slant", "Slant"),
+    ("ec.distort.ccsmear", "CC Smear", "Directional Smear"),
+    ("ec.sim.ccsnowfall", "CC Snowfall", "Snowfall"),
+    ("ec.perspective.ccsphere", "CC Sphere", "Sphere Wrap"),
+    ("ec.distort.ccsplit", "CC Split", "Split Warp"),
+    ("ec.distort.ccsplit2", "CC Split 2", "Dual Split Warp"),
+    ("ec.perspective.ccspotlight", "CC Spotlight", "Surface Spotlight"),
+    ("ec.sim.ccstarburst", "CC Star Burst", "Starfield"),
+    ("ec.generate.ccthreads", "CC Threads", "Woven Threads"),
+    ("ec.stylize.ccthreshold", "CC Threshold", "Channel Threshold"),
+    ("ec.stylize.ccthresholdrgb", "CC Threshold RGB", "RGB Threshold"),
+    ("ec.distort.cctiler", "CC Tiler", "Scaled Tiles"),
+    ("ec.color.cctoner", "CC Toner", "Multi-Tone Tint"),
+    ("ec.transition.cctwister", "CC Twister", "Twist Wipe"),
+    ("ec.blur.ccvector", "CC Vector Blur", "Vector Blur"),
+    ("ec.stylize.ccvignette", "CC Vignette", "Vignette"),
+    ("ec.transition.ccwarpomatic", "CC WarpoMatic", "Warp Dissolve"),
+    ("ec.time.ccwidetime", "CC Wide Time", "Temporal Blend"),
+    ("ec.color.lumetri", "Lumetri Color", "Color Grading"),
+    ("ec.obsolete.mochashape", "Mocha shape", "Tracked Shape Matte"),
+    ("ec.keying.keylight", "Key Light", "Screen Color Key"),
+];
+
+#[test]
+fn descriptive_names_keep_every_legacy_lookup_and_search() {
+    for &(id, old, new) in RENAMED {
+        let spec = find(id).unwrap();
+        assert_eq!(spec.name, new, "{id}");
+        for query in [id.to_string(), old.to_string(), old.to_lowercase(), new.to_string()] {
+            assert_eq!(lookup(&query).map(|s| s.id), Some(id), "{query}");
+        }
+        assert!(name_matches(spec, &old.to_lowercase()), "{old}");
+        assert!(name_matches(spec, &new.to_lowercase()), "{new}");
+    }
+    for alias in ["Keylight", "Keylight (1.2)", "Key Light"] {
+        assert_eq!(lookup(alias).map(|s| s.id), Some("ec.keying.keylight"));
+    }
+}
+
+#[test]
+fn descriptive_display_names_do_not_collide() {
+    let mut names = std::collections::HashSet::new();
+    for spec in crate::registry() {
+        assert!(names.insert(spec.name.to_lowercase()), "duplicate name {}", spec.name);
+        let label = spec.name.to_lowercase();
+        assert!(!label.starts_with("cc "), "{}", spec.name);
+        for mark in ["lumetri", "mercury", "mocha", "keylight"] {
+            assert!(!label.contains(mark), "{}", spec.name);
+        }
+    }
+}
+
+#[test]
+fn legacy_instance_names_and_parameter_data_survive_refresh() {
+    for &(id, old, _) in RENAMED {
+        let spec = find(id).unwrap();
+        for stored in [old.to_string(), format!("{old} 2"), "My custom instance".to_string()] {
+            let mut next = 1;
+            let mut ids = Ids(&mut next);
+            let mut instance = instantiate(spec, &mut ids, &stored, [128.0, 72.0]);
+            let before = serde_json::to_value(&instance).unwrap();
+            crate::migrate::upgrade_instance(spec, &mut instance, &mut ids, [128.0, 72.0]);
+            assert_eq!(instance.name, stored, "{id}: never rewrite a stored instance name");
+            assert_eq!(serde_json::to_value(&instance).unwrap(), before, "{id}");
+        }
+    }
+}
diff --git a/crates/effects/src/distort.rs b/crates/effects/src/distort.rs
index 534da8061..610f73f4c 100644
--- a/crates/effects/src/distort.rs
+++ b/crates/effects/src/distort.rs
@@ -275,27 +275,70 @@ pub fn transform_shutter(ctx: &EffectCtx) -> Option<(f64, f64, u32)> {
     (angle > 0.0).then_some((angle, phase, n.clamp(2, 64)))
 }
 
-fn transform_matrix(pr: &crate::Params, b: &Buf) -> Mat3 {
-    let anchor = b.to_px(pr.v2("anchor"));
-    let pos = b.to_px(pr.v2("position"));
+/// The Transform effect's matrix in buffer pixels (`to_px` maps layer pixels into the buffer),
+/// as After Effects 2026 draws it (cases 723, 819, 820): `position + K · R · S · (p − anchor)`
+/// with the skew `K = rot(−axis) · shearY(tan skew) · rot(axis)` applied after the rotation.
+pub fn transform_matrix_px(pr: &crate::Params, to_px: impl Fn([f64; 2]) -> (f64, f64)) -> Mat3 {
+    let anchor = to_px(pr.v2("anchor"));
+    let pos = to_px(pr.v2("position"));
     let sh = pr.f("scaleHeight");
     let sw = if pr.b("uniform") { sh } else { pr.f("scaleWidth") };
+    let axis = pr.f("skewAxis");
+    let k = pr.f("skew").clamp(-85.0, 85.0).to_radians().tan();
+    let k = if k.is_finite() { k } else { 0.0 };
+    let skew = Mat3::rotate_deg(-axis) * Mat3([[1.0, 0.0, 0.0], [k, 1.0, 0.0], [0.0, 0.0, 1.0]]) * Mat3::rotate_deg(axis);
     Mat3::translate(vec2(pos.0, pos.1))
+        * skew
         * Mat3::rotate_deg(pr.f("rotation"))
-        * Mat3::skew_deg(pr.f("skew"), pr.f("skewAxis"))
         * Mat3::scale(vec2(sw / 100.0, sh / 100.0))
         * Mat3::translate(vec2(-anchor.0, -anchor.1))
 }
 
+fn transform_matrix(pr: &crate::Params, b: &Buf) -> Mat3 {
+    transform_matrix_px(pr, |p| b.to_px(p))
+}
+
+/// The transparent margins (left, top, right, bottom) a `w` x `h` buffer needs so its warp by
+/// any of `ms` stays on it: After Effects draws Transform's result outside the layer's bounds
+/// (case 723). Each side grows by its own overshoot; the grown buffer is capped at 16 384 px a
+/// side and 16 Mpx in all (the margins shrink in proportion), so a layer moved far away costs
+/// a bounded allocation.
+pub fn transform_grow(ms: &[Mat3], w: u32, h: u32) -> [u32; 4] {
+    const SIDE: f64 = 16_384.0;
+    const AREA: f64 = 16_777_216.0;
+    let (wf, hf) = (w as f64, h as f64);
+    let mut m = [0.0f64; 4];
+    for mat in ms {
+        for (x, y) in [(0.0, 0.0), (wf, 0.0), (0.0, hf), (wf, hf)] {
+            let q = mat.apply(vec2(x, y));
+            if q.x.is_finite() && q.y.is_finite() {
+                m = [m[0].max(-q.x), m[1].max(-q.y), m[2].max(q.x - wf), m[3].max(q.y - hf)];
+            }
+        }
+    }
+    let m = m.map(|v| v.ceil().max(0.0));
+    let fit = |len: f64, a: f64, b: f64| -> f64 {
+        let room = (SIDE - len).max(0.0);
+        if a + b > room && a + b > 0.0 { room / (a + b) } else { 1.0 }
+    };
+    let kx = fit(wf, m[0], m[2]);
+    let ky = fit(hf, m[1], m[3]);
+    let area = |k: f64| (wf + (m[0] + m[2]) * kx * k) * (hf + (m[1] + m[3]) * ky * k);
+    let k = if area(1.0) > AREA && area(1.0) > wf * hf {
+        // Shrink both margins by the same factor until the area fits.
+        let (mut lo, mut hi) = (0.0f64, 1.0f64);
+        for _ in 0..40 {
+            let mid = (lo + hi) / 2.0;
+            if area(mid) > AREA { hi = mid } else { lo = mid }
+        }
+        lo
+    } else {
+        1.0
+    };
+    [m[0] * kx * k, m[1] * ky * k, m[2] * kx * k, m[3] * ky * k].map(|v| v.floor().clamp(0.0, SIDE) as u32)
+}
+
 fn transform(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let anchor = b.to_px(ctx.params.v2("anchor"));
-    let pos = b.to_px(ctx.params.v2("position"));
-    let uniform = ctx.params.b("uniform");
-    let sh = ctx.params.f("scaleHeight");
-    let sw = if uniform { sh } else { ctx.params.f("scaleWidth") };
-    let skew = ctx.params.f("skew");
-    let skew_axis = ctx.params.f("skewAxis");
-    let rot = ctx.params.f("rotation");
     let opacity = ctx.params.f("opacity") as f32 / 100.0;
     let sampling = if ctx.params.e("sampling") == 1 { effectcraft_raster::Sampling::Bicubic } else { effectcraft_raster::Sampling::Bilinear };
     // Motion blur: the transform at Samples instants across the shutter, averaged (the
@@ -304,33 +347,35 @@ fn transform(ctx: &EffectCtx, mut b: Buf) -> Buf {
         && let Some(host) = ctx.env.host
     {
         let fd = 1.0 / ctx.fps();
-        let mut acc = Image::new(b.img.width, b.img.height);
-        let mut count = 0.0f32;
-        for k in 0..n {
-            let t = ctx.time + (phase + angle * k as f64 / (n - 1) as f64) / 360.0 * fd;
-            let Some(pr) = host.params_at(t) else { continue };
-            let mut one = Image::new(b.img.width, b.img.height);
-            let op = pr.f("opacity") as f32 / 100.0;
-            effectcraft_raster::composite_warp(
-                &mut one,
-                &b.img,
-                &transform_matrix(&pr, &b),
-                &effectcraft_raster::WarpOpts { opacity: op, sampling, ..Default::default() },
-            );
-            acc.data.iter_mut().zip(&one.data).for_each(|(a, o)| (0..4).for_each(|c| a[c] += o[c]));
-            count += 1.0;
-        }
-        if count > 0.0 {
+        let samples: Vec<crate::Params> = (0..n).filter_map(|k| host.params_at(ctx.time + (phase + angle * k as f64 / (n - 1) as f64) / 360.0 * fd)).collect();
+        if !samples.is_empty() {
+            if !ctx.adjustment {
+                let ms: Vec<Mat3> = samples.iter().map(|pr| transform_matrix(pr, &b)).collect();
+                b.pad_sides(transform_grow(&ms, b.img.width, b.img.height));
+            }
+            let mut acc = Image::new(b.img.width, b.img.height);
+            for pr in &samples {
+                let mut one = Image::new(b.img.width, b.img.height);
+                let op = pr.f("opacity") as f32 / 100.0;
+                effectcraft_raster::composite_warp(
+                    &mut one,
+                    &b.img,
+                    &transform_matrix(pr, &b),
+                    &effectcraft_raster::WarpOpts { opacity: op, sampling, ..Default::default() },
+                );
+                acc.data.iter_mut().zip(&one.data).for_each(|(a, o)| (0..4).for_each(|c| a[c] += o[c]));
+            }
+            let count = samples.len() as f32;
             acc.data.iter_mut().for_each(|p| p.iter_mut().for_each(|v| *v /= count));
             b.img = acc;
             return b;
         }
     }
-    let m = Mat3::translate(vec2(pos.0, pos.1))
-        * Mat3::rotate_deg(rot)
-        * Mat3::skew_deg(skew, skew_axis)
-        * Mat3::scale(vec2(sw / 100.0, sh / 100.0))
-        * Mat3::translate(vec2(-anchor.0, -anchor.1));
+    if !ctx.adjustment {
+        let m = transform_matrix(ctx.params, &b);
+        b.pad_sides(transform_grow(&[m], b.img.width, b.img.height));
+    }
+    let m = transform_matrix(ctx.params, &b);
     let mut out = Image::new(b.img.width, b.img.height);
     effectcraft_raster::composite_warp(&mut out, &b.img, &m, &effectcraft_raster::WarpOpts { opacity, sampling, ..Default::default() });
     b.img = out;
@@ -339,6 +384,18 @@ fn transform(ctx: &EffectCtx, mut b: Buf) -> Buf {
 
 fn corner_pin(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let (w, h) = (b.layer_w(ctx), b.layer_h(ctx));
+    // The warped layer is drawn wherever the corners are, so grow the buffer to hold the quad;
+    // an adjustment layer keeps the size of the comp below it.
+    if !ctx.adjustment {
+        let pts = ["ul", "ur", "lr", "ll"].map(|k| {
+            let p = b.to_px(ctx.params.v2(k));
+            [p.0, p.1]
+        });
+        let (lo, hi) = crate::quad_bounds(&pts);
+        if let Some(sides) = crate::grow_sides(lo, hi, b.img.width, b.img.height) {
+            b.pad_sides(sides);
+        }
+    }
     let q = ["ul", "ur", "lr", "ll"].map(|k| {
         let p = b.to_px(ctx.params.v2(k));
         vec2(p.0, p.1)
@@ -497,6 +554,74 @@ mod tests {
         crate::apply(s, &ctx, Buf { img: im, offset: [0.0, 0.0], scale: 1.0 })
     }
 
+    #[test]
+    fn corner_pin_draws_outside_the_layer_rectangle() {
+        // A 20×10 layer pinned to a quad that lies entirely right of and below it.
+        let im = crate::util::gen_image(20, 10, |_, _| [1.0, 0.0, 0.0, 1.0]);
+        let set = [("ul", Value::Vec2([40.0, 30.0])), ("ur", Value::Vec2([60.0, 30.0])), ("lr", Value::Vec2([60.0, 40.0])), ("ll", Value::Vec2([40.0, 40.0]))];
+        let o = run("ec.distort.cornerpin", &set, im);
+        assert!(o.img.width >= 60 && o.img.height >= 40, "{}x{}", o.img.width, o.img.height);
+        let (cx, cy) = (o.offset[0] as i64 + 50, o.offset[1] as i64 + 35);
+        assert!(o.img.get(cx, cy)[0] > 0.9);
+    }
+
+    #[test]
+    fn corner_pin_keeps_the_size_on_an_adjustment_layer() {
+        let s = crate::find("ec.distort.cornerpin").unwrap();
+        let im = crate::util::gen_image(20, 10, |_, _| [1.0, 0.0, 0.0, 1.0]);
+        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), crate::default_value(p, [20.0, 10.0]))).collect() };
+        params.values.insert("lr".to_string(), Value::Vec2([400.0, 300.0]));
+        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [20.0, 10.0], seed: 3, adjustment: true, env: Default::default() };
+        let o = crate::apply(s, &ctx, Buf { img: im, offset: [0.0, 0.0], scale: 1.0 });
+        assert_eq!((o.img.width, o.img.height, o.offset), (20, 10, [0.0, 0.0]));
+    }
+
+    #[test]
+    fn corner_pin_with_a_far_pin_grows_to_it() {
+        let im = crate::util::gen_image(20, 10, |_, _| [1.0, 0.0, 0.0, 1.0]);
+        let o = run("ec.distort.cornerpin", &[("lr", Value::Vec2([1500.0, 1000.0]))], im);
+        assert!(o.img.width >= 1500 && o.img.height >= 1000, "{}x{}", o.img.width, o.img.height);
+    }
+
+    #[test]
+    fn corner_pin_with_a_non_finite_pin_returns_a_buffer_without_panicking() {
+        for bad in [f64::NAN, f64::INFINITY, f64::NEG_INFINITY] {
+            for corner in ["ul", "ur", "lr", "ll"] {
+                let im = crate::util::gen_image(20, 10, |_, _| [1.0, 0.0, 0.0, 1.0]);
+                let o = run("ec.distort.cornerpin", &[(corner, Value::Vec2([bad, 5.0]))], im);
+                assert!(
+                    o.img.width >= 1 && o.img.height >= 1 && o.img.width <= 16384 && o.img.height <= 16384,
+                    "{corner} {bad}: {}x{}",
+                    o.img.width,
+                    o.img.height
+                );
+                assert!(o.offset.iter().all(|v| v.is_finite()), "{corner} {bad}: offset {:?}", o.offset);
+            }
+        }
+    }
+
+    #[test]
+    fn corner_pin_growth_is_continuous_as_a_pin_moves_far_away() {
+        let mut last: Option<u64> = None;
+        for k in 0..60 {
+            let far = 100.0 * 1.4_f64.powi(k);
+            let im = crate::util::gen_image(20, 10, |_, _| [1.0, 0.0, 0.0, 1.0]);
+            let o = run("ec.distort.cornerpin", &[("lr", Value::Vec2([far, far]))], im);
+            let size = (o.img.width, o.img.height);
+            assert!(size.0 >= 20 && size.1 >= 10 && u64::from(size.0) * u64::from(size.1) <= 1 << 24, "pin {far}: {size:?}");
+            let area = u64::from(size.0) * u64::from(size.1);
+            if let Some(prev) = last {
+                // The shared cut factor may trade width for height as the pin direction changes,
+                // but the buffer as a whole does not shrink (beyond whole-pixel flooring at the budget)
+                // as the pin moves further away.
+                assert!(area * 10_000 >= prev * 9_999, "pin {far}: the buffer shrank from {prev} to {area} pixels ({size:?})");
+            }
+            let opaque = (0..o.img.height as i64).any(|y| (0..o.img.width as i64).any(|x| o.img.get(x, y)[3] > 0.0));
+            assert!(opaque, "pin {far}: the pinned layer vanished");
+            last = Some(area);
+        }
+    }
+
     fn differs(a: Px4, b: Px4) -> bool {
         (0..4).any(|i| (a[i] - b[i]).abs() > 1e-4)
     }
@@ -576,6 +701,144 @@ mod tests {
         }
     }
 
+    /// After Effects 2026 (cases 723, 819, 820): a grey 960 × 540 solid centred in a 1920 × 1080
+    /// comp with Transform. The skew applies after the rotation, and the result is drawn outside
+    /// the layer's bounds. Points are comp pixels sampled from AE's renders (at least 3 px from
+    /// an edge; true = the solid covers it), half where the old order and clipping differed.
+    #[test]
+    fn transform_matches_after_effects() {
+        let solid = Image::filled(960, 540, [0.5, 0.5, 0.5, 1.0]);
+        let p2 = |x: f64, y: f64| Value::Vec2([x, y]);
+        let cases: [(&str, Vec<(&str, Value)>, &[(u32, u32, bool)]); 3] = [
+            (
+                "723",
+                vec![
+                    ("anchor", p2(400.0, 200.0)),
+                    ("position", p2(500.0, 300.0)),
+                    ("uniform", Value::Bool(false)),
+                    ("scaleHeight", num(80.0)),
+                    ("scaleWidth", num(120.0)),
+                    ("skew", num(10.0)),
+                    ("skewAxis", num(20.0)),
+                    ("rotation", num(30.0)),
+                ],
+                &[
+                    (1465, 954, true),
+                    (1127, 821, true),
+                    (1378, 846, true),
+                    (1416, 878, true),
+                    (1486, 850, true),
+                    (492, 467, true),
+                    (706, 239, true),
+                    (1402, 1021, true),
+                    (518, 440, true),
+                    (1218, 882, true),
+                    (454, 448, true),
+                    (1473, 920, true),
+                    (1048, 654, true),
+                    (1050, 486, true),
+                    (1060, 736, true),
+                    (932, 804, true),
+                    (1074, 562, true),
+                    (653, 591, true),
+                    (1353, 466, false),
+                    (88, 1021, false),
+                    (1855, 886, false),
+                    (1796, 401, false),
+                    (497, 913, false),
+                    (1445, 515, false),
+                ],
+            ),
+            (
+                "819",
+                vec![("skew", num(15.0)), ("skewAxis", num(60.0))],
+                &[
+                    (465, 367, true),
+                    (554, 793, false),
+                    (481, 529, true),
+                    (1451, 599, true),
+                    (428, 575, true),
+                    (432, 600, true),
+                    (463, 444, true),
+                    (759, 803, false),
+                    (445, 684, true),
+                    (1411, 757, true),
+                    (915, 784, false),
+                    (480, 737, true),
+                    (758, 620, true),
+                    (975, 705, true),
+                    (1289, 376, true),
+                    (575, 420, true),
+                    (1015, 507, true),
+                    (1377, 448, true),
+                    (1679, 171, false),
+                    (194, 435, false),
+                    (413, 159, false),
+                    (327, 741, false),
+                    (1824, 138, false),
+                    (1093, 29, false),
+                ],
+            ),
+            (
+                "820",
+                vec![
+                    ("skew", num(15.0)),
+                    ("skewAxis", num(60.0)),
+                    ("rotation", num(-25.0)),
+                    ("uniform", Value::Bool(false)),
+                    ("scaleWidth", num(130.0)),
+                    ("scaleHeight", num(70.0)),
+                    ("anchor", p2(100.0, 50.0)),
+                ],
+                &[
+                    (1674, 566, true),
+                    (1425, 317, false),
+                    (1788, 278, true),
+                    (1530, 390, true),
+                    (1531, 652, true),
+                    (1589, 545, true),
+                    (1890, 441, true),
+                    (1724, 400, true),
+                    (1657, 511, true),
+                    (1895, 261, true),
+                    (1697, 344, true),
+                    (933, 840, true),
+                    (1413, 467, true),
+                    (1295, 691, true),
+                    (1353, 548, true),
+                    (1293, 548, true),
+                    (1103, 551, true),
+                    (973, 758, true),
+                    (446, 484, false),
+                    (1009, 420, false),
+                    (144, 761, false),
+                    (1812, 111, false),
+                    (1241, 10, false),
+                    (900, 854, false),
+                ],
+            ),
+        ];
+        for (case, set, pts) in cases {
+            let o = run("ec.distort.transform", &set, solid.clone());
+            for &(x, y, inside) in pts {
+                // Comp pixel → layer pixel (the solid's top-left sits at 480, 270) → buffer.
+                let (bx, by) = o.to_px([x as f64 + 0.5 - 480.0, y as f64 + 0.5 - 270.0]);
+                let a = if bx >= 0.0 && by >= 0.0 && bx < o.img.width as f64 && by < o.img.height as f64 { o.img.get(bx as i64, by as i64)[3] } else { 0.0 };
+                assert_eq!(a > 0.5, inside, "case {case}: comp pixel ({x}, {y}) alpha {a}");
+            }
+        }
+        // A huge scale stays within the buffer cap.
+        let o = run("ec.distort.transform", &[("scaleHeight", num(100_000.0))], Image::filled(8, 8, [1.0; 4]));
+        assert!(o.img.width <= 16_384 && o.img.height <= 16_384);
+        // A layer moved far right grows the buffer on that side only, within 16 Mpx.
+        let o = run("ec.distort.transform", &[("position", p2(960.0 + 2000.0, 540.0))], Image::filled(1920, 1080, [1.0; 4]));
+        assert_eq!((o.offset[0], o.img.height), (0.0, 1080), "only the right side grows");
+        assert!(o.img.width >= 1920 + 2000 && o.img.width as u64 * o.img.height as u64 <= 16_777_216, "{} x {}", o.img.width, o.img.height);
+        assert!(o.img.get(2000 + 960, 540)[3] > 0.99 && o.img.get(10, 540)[3] < 0.01);
+        let o = run("ec.distort.transform", &[("position", p2(40_000.0, 30_000.0))], Image::filled(1920, 1080, [1.0; 4]));
+        assert!(o.img.width as u64 * o.img.height as u64 <= 16_777_216, "{} x {}", o.img.width, o.img.height);
+    }
+
     #[test]
     fn transform_sampling_bicubic_differs_from_bilinear() {
         let im = img(32, 32);
diff --git a/crates/effects/src/distort2.rs b/crates/effects/src/distort2.rs
index 10ec59735..bbd8738a8 100644
--- a/crates/effects/src/distort2.rs
+++ b/crates/effects/src/distort2.rs
@@ -1,6 +1,6 @@
 //! Distort effects, batch 2: Turbulent Displace, Displacement Map (self as map), Optics
-//! Compensation, Magnify, Mesh Warp, Bezier Warp, CC Bend It, CC Lens, CC Page Turn, CC Tiler,
-//! CC Griddler.
+//! Compensation, Magnify, Mesh Warp, Bezier Warp, Two-Point Bend, Lens Distortion, Page Curl, Scaled Tiles,
+//! Tile Grid.
 //!
 //! Mesh Warp and Bezier Warp share a grid rasteriser: a (nx+1)×(ny+1) grid of destination points
 //! and matching source points is split into triangles, bucketed per output row and filled
@@ -19,7 +19,7 @@ use effectcraft_project::ParamUi;
 use effectcraft_raster::{Image, Px};
 use rayon::prelude::*;
 
-use crate::generate::value_noise;
+use crate::generate::value_noise_linear_z;
 use crate::util::{SRC_NAMES, Src, fit_layer, layer_cover_pad, layer_rect, lerp4, map_xy, pick, premul, remap, smoothstep, src_at, unpremul};
 use crate::{Buf, EffectCtx, EffectSpec, col, num, p, popup, slider};
 
@@ -37,13 +37,15 @@ fn pct(max: f64) -> ParamUi {
 
 // ---------------------------------------------------------------- Turbulent Displace
 
+/// Fractional-octave fBm of value noise in 0..1. Evolution (`z`) is linear: with the eased z of
+/// plain value noise a few degrees of Evolution barely moved the pattern (#943).
 fn fbm(u: f64, v: f64, z: f64, seed: u32, octaves: f64, falloff: f32) -> f32 {
     let n = octaves.ceil().max(1.0) as usize;
     let frac = (octaves - octaves.floor()) as f32;
     let (mut sum, mut norm, mut amp, mut f) = (0.0f32, 0.0f32, 1.0f32, 1.0f32);
     for o in 0..n {
         let w = if o + 1 == n && frac > 0.0 { frac } else { 1.0 };
-        sum += value_noise(u as f32 * f, v as f32 * f, z as f32 + o as f32 * 5.17, seed.wrapping_add(o as u32 * 101)) * amp * w;
+        sum += value_noise_linear_z(u as f32 * f, v as f32 * f, z as f32 + o as f32 * 5.17, seed.wrapping_add(o as u32 * 101)) * amp * w;
         norm += amp * w;
         amp *= falloff;
         f *= 2.0;
@@ -93,6 +95,9 @@ fn turbulent_displace(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let size = (ctx.params.f("size") * b.scale).max(1.0);
     if ctx.params.b("resizeLayer") && !ctx.adjustment {
         b.pad(amount.abs().ceil() as u32 + 1);
+    } else {
+        // Room for pixels displaced past the content, up to the layer's edge (#1205).
+        b.pad(crate::cover_pad(ctx, [b.img.width, b.img.height], b.offset, b.scale, amount.abs().ceil() as u32 + 1));
     }
     let off = b.to_px(ctx.params.v2("offset"));
     let oct = ctx.params.f("complexity").clamp(1.0, 10.0);
@@ -545,7 +550,7 @@ pub fn bezier_grid(ctx: &EffectCtx, offset: [f64; 2], scale: f64) -> (usize, Vec
     (n, dest, srcp)
 }
 
-// ---------------------------------------------------------------- CC Bend It
+// ---------------------------------------------------------------- Two-Point Bend
 
 fn bend_it(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let mut beta = ctx.params.f("bend").to_radians();
@@ -601,7 +606,7 @@ fn bend_it(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Lens
+// ---------------------------------------------------------------- Lens Distortion
 
 fn cc_lens(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = b.to_px(ctx.params.v2("center"));
@@ -624,7 +629,7 @@ fn cc_lens(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Page Turn
+// ---------------------------------------------------------------- Page Curl
 
 fn page_turn(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let f = b.to_px(ctx.params.v2("foldPosition"));
@@ -674,7 +679,7 @@ fn page_turn(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Tiler / CC Griddler
+// ---------------------------------------------------------------- Scaled Tiles / Tile Grid
 
 fn cc_tiler(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let s = (ctx.params.f("scale") / 100.0).max(0.001);
@@ -824,7 +829,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccbendit",
-            "CC Bend It",
+            "Two-Point Bend",
             vec![
                 p("bend", "Bend", num(0.0), ParamUi::Angle),
                 p("start", "Start", pt(0.5, 0.2), ParamUi::Point),
@@ -835,7 +840,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.cclens",
-            "CC Lens",
+            "Lens Distortion",
             vec![
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
                 p("size", "Size", num(50.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
@@ -845,7 +850,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccpageturn",
-            "CC Page Turn",
+            "Page Curl",
             vec![
                 p("foldPosition", "Fold Position", pt(0.7, 0.7), ParamUi::Point),
                 p("foldDirection", "Fold Direction", num(315.0), ParamUi::Angle),
@@ -859,7 +864,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.cctiler",
-            "CC Tiler",
+            "Scaled Tiles",
             vec![
                 p("scale", "Scale", num(50.0), slider(1.0, 10000.0, 1.0, 200.0, 1)),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
@@ -869,7 +874,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccgriddler",
-            "CC Griddler",
+            "Tile Grid",
             vec![
                 p("horizontalScale", "Horizontal Scale", num(100.0), slider(1.0, 1000.0, 1.0, 400.0, 1)),
                 p("verticalScale", "Vertical Scale", num(100.0), slider(1.0, 1000.0, 1.0, 400.0, 1)),
@@ -1115,6 +1120,45 @@ mod tests {
         assert_eq!(TURBULENT_PINNING[11], "Pin Left Locked");
     }
 
+    /// #943: every non-equivalent Evolution value renders a visibly different frame. The eased
+    /// evolution axis left 0 and 37 degrees (or 360 and 400) within a hundredth of each other.
+    #[test]
+    fn turbulent_displace_evolution_changes_the_output() {
+        // A smooth ramp (red = x, green = y) with Pin All Locked, so the frame stays opaque and
+        // the difference is purely how far the pattern moved.
+        let mut ramp = Image::new(64, 64);
+        for y in 0..64u32 {
+            for x in 0..64u32 {
+                ramp.set(x, y, [x as f32 / 63.0, y as f32 / 63.0, 0.25, 1.0]);
+            }
+        }
+        let render = |evo: f64, extra: &[(&str, Value)]| {
+            let base = [("evolution", num(evo)), ("size", num(10.0)), ("pinning", Value::Enum(8))];
+            run("ec.distort.turbulentdisplace", &[base.as_slice(), extra].concat(), ramp.clone()).img
+        };
+        let evolutions = [0.0, 37.0, 90.5, 180.0, 360.0, 400.25, 725.0, 1000.5];
+        let frames: Vec<Image> = evolutions.iter().map(|&e| render(e, &[])).collect();
+        for (i, a) in frames.iter().enumerate() {
+            for (j, b) in frames.iter().enumerate().skip(i + 1) {
+                let d = max_diff(a, b);
+                assert!(d > 0.01, "evolution {} and {} differ by only {d}", evolutions[i], evolutions[j]);
+            }
+        }
+        // Constant rate: 20 degrees next to a whole revolution (from either side) is a visible
+        // step, not the rounding-error size the eased axis gave (under 0.001).
+        assert!(max_diff(&frames[0], &render(20.0, &[])) > 0.02);
+        assert!(max_diff(&render(340.0, &[]), &frames[4]) > 0.02);
+        // 0 and 360 degrees are different frames without Cycle Evolution, and the same frame with
+        // Cycle (in Revolutions) = 1, at any starting angle.
+        assert!(max_diff(&frames[0], &frames[4]) > 0.01);
+        let cycle = [("evolutionOptions/cycleEvolution", Value::Bool(true)), ("evolutionOptions/cycle", num(1.0))];
+        assert!(max_diff(&render(0.0, &cycle), &render(360.0, &cycle)) < 1e-4);
+        assert!(max_diff(&render(37.0, &cycle), &render(397.0, &cycle)) < 1e-4);
+        assert!(max_diff(&render(0.0, &cycle), &render(37.0, &cycle)) > 0.01);
+        // Random Seed still gives a different pattern at the same Evolution.
+        assert!(max_diff(&frames[1], &render(37.0, &[("evolutionOptions/randomSeed", num(5.0))])) > 0.01);
+    }
+
     #[test]
     fn magnify_blending_none_and_scaling() {
         let img = test_img(32, 32);
diff --git a/crates/effects/src/distort3.rs b/crates/effects/src/distort3.rs
index 99139483f..34fc282ed 100644
--- a/crates/effects/src/distort3.rs
+++ b/crates/effects/src/distort3.rs
@@ -1,5 +1,5 @@
-//! Distort effects, batch 3: CC Bender, CC Blobbylize, CC Power Pin, CC Ripple Pulse, CC Slant,
-//! CC Smear, CC Split, CC Split 2, Smear and Reshape (mask driven), Twirl (Legacy), Warp (the
+//! Distort effects, batch 3: Flexible Bend, Organic Displacement, Perspective Pin, Pulsed Ripple, Slant,
+//! Directional Smear, Split Warp, Dual Split Warp, Smear and Reshape (mask driven), Twirl (Legacy), Warp (the
 //! fifteen warp styles) and Detail-preserving Upscale.
 //!
 //! All warps are inverse mapped: every output pixel finds the source point that lands on it.
@@ -59,7 +59,7 @@ fn elastic_exp(i: u32) -> f64 {
     [1.0, 1.25, 1.5, 2.0, 2.5, 3.0, 3.5, 4.5][(i as usize).min(7)]
 }
 
-// ---------------------------------------------------------------- CC Bender
+// ---------------------------------------------------------------- Flexible Bend
 
 fn cc_bender(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let amount = ctx.params.f("amount") / 100.0;
@@ -107,22 +107,38 @@ fn norm3(v: [f64; 3]) -> [f64; 3] {
     [v[0] / l, v[1] / l, v[2] / l]
 }
 
-fn dot3(a: [f64; 3], b: [f64; 3]) -> f64 {
+/// f32 normal/dot helpers for the Organic Displacement lighting pass. The GPU kernel runs in f32;
+/// matching its precision here keeps specular highlights within the CPU/GPU parity tolerance.
+fn norm3f(v: [f32; 3]) -> [f32; 3] {
+    let l = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt().max(1e-12);
+    [v[0] / l, v[1] / l, v[2] / l]
+}
+
+fn dot3f(a: [f32; 3], b: [f32; 3]) -> f32 {
     a[0] * b[0] + a[1] * b[1] + a[2] * b[2]
 }
 
-// ---------------------------------------------------------------- CC Blobbylize
+// ---------------------------------------------------------------- Organic Displacement
 
 fn cc_blobbylize(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let soft = ctx.params.f("softness").max(0.0) * b.scale;
-    let cut = (ctx.params.f("cutAway") / 100.0).clamp(0.0, 0.99) as f32;
+    let cut = (ctx.params.f("cutAway") / 100.0).clamp(0.0, 1.0) as f32;
+    if cut >= 1.0 {
+        // Endpoint guard: at Cut Away 100 the gradient antialias must not leave a half-covered
+        // pixel where an opaque source reaches exactly 1.0.
+        b.img.data.fill([0.0; 4]);
+        return b;
+    }
     let blob = layer_or_self(ctx, &b, "blobLayer", true, false);
     let prop = src_at(ctx.params.e("property"));
     let raw = Plane::from_image(&blob, |px| {
         let (c, a) = unpremul(px);
         pick(prop, c, a) * if matches!(prop, crate::util::Src::Alpha) { 1.0 } else { a }
     });
-    let h = gauss_plane(&raw, soft, soft);
+    // Oracle (AE 26.2, 16 bpc): a step thresholded at Cut 25/75 with Softness 20 moves the
+    // 50% contour by 5.55 px. For a Gaussian that is 0.67449 sigma, so sigma = 0.42 Softness.
+    // The same probe shows the matte stays a ~1 px antialiased threshold, not a broad ramp.
+    let h = gauss_plane(&raw, soft * 0.42, soft * 0.42);
     let intensity = ctx.params.f("lightIntensity") / 100.0;
     let lc = ctx.params.color("lightColor");
     let point = ctx.params.e("lightType") == 1;
@@ -135,37 +151,69 @@ fn cc_blobbylize(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let rough = ctx.params.f("roughness").clamp(0.001, 1.0);
     let metal = (ctx.params.f("metal") / 100.0) as f32;
     let shininess = (1.0 / rough).min(500.0);
-    let depth = (soft * 0.5).max(1.0);
     let src = b.img.clone();
     let (w, hh) = (b.img.width as usize, b.img.height as usize);
     let span = (w.max(hh) as f64).max(1.0);
+
+    // The source matte and the RGB refraction are separate in the oracle:
+    // - the matte edge of a self step moves 5/9/14/18 px at Softness 5/10/20/40. A normal
+    //   with z = 1, a ~30 px depth at 1920 and a slope scale of 1.5 Softness reproduces that;
+    // - RGB follows a height-field refraction with z = height: on a linear ramp the measured
+    //   horizontal offset is dx = -0.34 / h, independent of Softness.
+    let matte_slope = soft * 1.5;
+    let matte_depth = if soft > 0.05 { span / 64.0 } else { 0.0 };
+    let rgb_depth = span * 0.34 * b.scale;
+    let light_slope = (soft * 0.65).max(1.0);
+    let limit = span * 0.5;
     b.img.rows_mut().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
             let (xi, yi) = (x as i64, y as i64);
             let hv = h.get(x, y);
             let gx = (h.get_clamped(xi + 1, yi) - h.get_clamped(xi - 1, yi)) as f64 * 0.5;
             let gy = (h.get_clamped(xi, yi + 1) - h.get_clamped(xi, yi - 1)) as f64 * 0.5;
-            // Refraction-like displacement down the slope, then the blobby matte.
-            let sx = x as f64 + 0.5 - gx * depth * 2.0;
-            let sy = y as f64 + 0.5 - gy * depth * 2.0;
-            let s = src.sample_bilinear(sx, sy);
-            let (c, a) = unpremul(s);
-            let m = ((hv - cut) / ((1.0 - cut) * 0.5).max(1e-3)).clamp(0.0, 1.0);
-            let alpha = a.max(s[3]) * m;
+            let grad = (gx * gx + gy * gy).sqrt();
+            // One-pixel antialiased threshold. A flat field is either fully in or fully out.
+            let aa = (1.25 * grad).max(5e-4);
+            let m = if grad > 1e-9 {
+                (0.5 + (hv - cut) as f64 / aa).clamp(0.0, 1.0) as f32
+            } else if hv > cut {
+                1.0
+            } else {
+                0.0
+            };
+            if m <= 0.0 {
+                *px = [0.0; 4];
+                continue;
+            }
+            // Warp the source matte with the softness-scaled bevel normal (z = 1).
+            let na = norm3([-gx * matte_slope, -gy * matte_slope, 1.0]);
+            let sa = src.sample_bilinear(x as f64 + 0.5 + na[0] * matte_depth, y as f64 + 0.5 + na[1] * matte_depth);
+            let alpha = sa[3].max(0.0) * m;
             if alpha <= 0.0 {
                 *px = [0.0; 4];
                 continue;
             }
-            let n = norm3([-gx * depth, -gy * depth, 1.0]);
-            let l = if point { norm3([lpos.0 - x as f64, lpos.1 - y as f64, lheight / 100.0 * span]) } else { ldir };
-            let ndl = dot3(n, l).max(0.0);
-            let hv3 = norm3([l[0], l[1], l[2] + 1.0]);
-            let sp = dot3(n, hv3).max(0.0).powf(shininess) * specular;
+            // Refract the colour through the height field (z = height for this pass).
+            let hz = (hv as f64).max(1e-3);
+            let rx = (-rgb_depth * gx / hz).clamp(-limit, limit);
+            let ry = (-rgb_depth * gy / hz).clamp(-limit, limit);
+            let srgb = src.sample_bilinear(x as f64 + 0.5 + rx, y as f64 + 0.5 + ry);
+            let (c, _) = unpremul(srgb);
+            let (gx32, gy32) = (gx as f32, gy as f32);
+            let n = norm3f([-gx32 * light_slope as f32, -gy32 * light_slope as f32, 1.0]);
+            let l = if point {
+                norm3f([lpos.0 as f32 - (x as f32 + 0.5), lpos.1 as f32 - (y as f32 + 0.5), (lheight / 100.0 * span) as f32])
+            } else {
+                [ldir[0] as f32, ldir[1] as f32, ldir[2] as f32]
+            };
+            let ndl = dot3f(n, l).max(0.0);
+            let hv3 = norm3f([l[0], l[1], l[2] + 1.0]);
+            let sp = dot3f(n, hv3).max(0.0).powf(shininess as f32) * specular as f32;
             let mut out = [0.0f32; 3];
             for i in 0..3 {
-                let lit = (ambient + diffuse * ndl * intensity) as f32 * lc[i];
+                let lit = (ambient + diffuse * ndl as f64 * intensity) as f32 * lc[i];
                 let spec_col = (1.0 - metal) * lc[i] + metal * c[i] * lc[i];
-                out[i] = c[i] * lit + (sp * intensity) as f32 * spec_col;
+                out[i] = c[i] * lit + (sp as f64 * intensity) as f32 * spec_col;
             }
             *px = premul(out, alpha);
         }
@@ -173,7 +221,7 @@ fn cc_blobbylize(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Power Pin
+// ---------------------------------------------------------------- Perspective Pin
 
 fn cc_power_pin(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let (lw, lh) = (ctx.layer_size[0].max(1.0), ctx.layer_size[1].max(1.0));
@@ -256,7 +304,7 @@ fn cc_power_pin(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Ripple Pulse
+// ---------------------------------------------------------------- Pulsed Ripple
 
 fn cc_ripple_pulse(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let level = ctx.params.f("pulseLevel") / 100.0;
@@ -302,7 +350,7 @@ fn cc_ripple_pulse(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Slant
+// ---------------------------------------------------------------- Slant
 
 fn cc_slant(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let k = ctx.params.f("slant") / 100.0;
@@ -327,7 +375,7 @@ fn cc_slant(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Smear
+// ---------------------------------------------------------------- Directional Smear
 
 fn cc_smear(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let reach = ctx.params.f("reach") / 100.0;
@@ -355,7 +403,7 @@ fn cc_smear(ctx: &EffectCtx, mut b: Buf) -> Buf {
 }
 
 /// The transparent pixels to add on every side of a buffer `size` pixels big (with `offset` and
-/// `scale`) for CC Smear: it moves pixels by up to Reach × From→To, and they may move out to the
+/// `scale`) for Directional Smear: it moves pixels by up to Reach × From→To, and they may move out to the
 /// layer bounds. A text or shape layer's buffer ends at its content while its bounds are
 /// comp-sized, so the smear was cut off at the content's box (#659).
 pub fn cc_smear_pad(ctx: &EffectCtx, size: [u32; 2], offset: [f64; 2], scale: f64) -> u32 {
@@ -369,7 +417,7 @@ pub fn cc_smear_pad(ctx: &EffectCtx, size: [u32; 2], offset: [f64; 2], scale: f6
     (moved.min(4096.0) as u32).min(crate::util::layer_cover_pad(ctx, size, offset, scale))
 }
 
-// ---------------------------------------------------------------- CC Split / CC Split 2
+// ---------------------------------------------------------------- Split Warp / Dual Split Warp
 
 fn split_impl(ctx: &EffectCtx, mut b: Buf, s1: f64, s2: f64) -> Buf {
     if s1 == 0.0 && s2 == 0.0 {
@@ -865,7 +913,7 @@ pub fn specs() -> Vec<EffectSpec> {
     vec![
         spec(
             "ec.distort.ccbender",
-            "CC Bender",
+            "Flexible Bend",
             vec![
                 p("amount", "Amount", num(0.0), slider(-200.0, 200.0, -100.0, 100.0, 1)),
                 p("style", "Style", Value::Enum(0), popup(&["Bend", "Marilyn", "Sharp", "Boxer"])),
@@ -877,29 +925,29 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccblobbylize",
-            "CC Blobbylize",
+            "Organic Displacement",
             vec![
                 p("blobLayer", "Blob Layer", Value::Layer(None), ParamUi::Layer),
-                p("property", "Property", Value::Enum(3), popup(&crate::util::SRC_NAMES[..8])),
-                p("softness", "Softness", num(6.0), slider(0.0, 200.0, 0.0, 50.0, 1)),
-                p("cutAway", "Cut Away", num(0.0), pct()),
-                p("lightIntensity", "Light Intensity", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
+                p("property", "Property", Value::Enum(0), popup(&crate::util::SRC_NAMES[..8])),
+                p("softness", "Softness", num(20.0), slider(0.0, 500.0, 0.0, 50.0, 1)),
+                p("cutAway", "Cut Away", num(25.0), pct()),
+                p("lightIntensity", "Light Intensity", num(100.0), slider(0.0, 1000.0, 0.0, 200.0, 1)),
                 p("lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
                 p("lightType", "Light Type", Value::Enum(0), popup(&["Distant Light", "Point Light"])),
-                p("lightHeight", "Light Height", num(50.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
-                p("lightPosition", "Light Position", pt(0.25, 0.25), ParamUi::Point),
+                p("lightHeight", "Light Height", num(65.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
+                p("lightPosition", "Light Position", pt(0.5, 0.5), ParamUi::Point),
                 p("lightDirection", "Light Direction", num(-45.0), ParamUi::Angle),
-                p("ambient", "Ambient", num(20.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("diffuse", "Diffuse", num(70.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("specular", "Specular", num(40.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("roughness", "Roughness", num(0.05), slider(0.001, 0.5, 0.001, 0.5, 3)),
+                p("ambient", "Ambient", num(75.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("diffuse", "Diffuse", num(25.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("specular", "Specular", num(100.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("roughness", "Roughness", num(0.025), slider(0.001, 1.0, 0.001, 1.0, 3)),
                 p("metal", "Metal", num(100.0), pct()),
             ],
             cc_blobbylize,
         ),
         spec(
             "ec.distort.ccpowerpin",
-            "CC Power Pin",
+            "Perspective Pin",
             vec![
                 p("topLeft", "Top Left", pt(0.0, 0.0), ParamUi::Point),
                 p("topRight", "Top Right", pt(1.0, 0.0), ParamUi::Point),
@@ -916,7 +964,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccripplepulse",
-            "CC Ripple Pulse",
+            "Pulsed Ripple",
             vec![
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
                 p("pulseLevel", "Pulse Level (animate)", num(0.0), slider(-1000.0, 1000.0, -100.0, 100.0, 1)),
@@ -928,7 +976,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccslant",
-            "CC Slant",
+            "Slant",
             vec![
                 p("slant", "Slant", num(0.0), slider(-1000.0, 1000.0, -100.0, 100.0, 1)),
                 p("stretching", "Stretching", Value::Bool(false), ParamUi::Checkbox),
@@ -939,7 +987,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccsmear",
-            "CC Smear",
+            "Directional Smear",
             vec![
                 p("from", "From", pt(0.35, 0.5), ParamUi::Point),
                 p("to", "To", pt(0.65, 0.5), ParamUi::Point),
@@ -950,7 +998,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccsplit",
-            "CC Split",
+            "Split Warp",
             vec![
                 p("pointA", "Point A", pt(0.25, 0.5), ParamUi::Point),
                 p("pointB", "Point B", pt(0.75, 0.5), ParamUi::Point),
@@ -960,7 +1008,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.distort.ccsplit2",
-            "CC Split 2",
+            "Dual Split Warp",
             vec![
                 p("pointA", "Point A", pt(0.25, 0.5), ParamUi::Point),
                 p("pointB", "Point B", pt(0.75, 0.5), ParamUi::Point),
@@ -1036,260 +1084,4 @@ pub fn specs() -> Vec<EffectSpec> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, MaskShape, Params};
-
-    fn img(w: u32, h: u32) -> Image {
-        crate::util::gen_image(w, h, |x, y| [x as f32 / w as f32, y as f32 / h as f32, ((x * 7 + y * 3) % 11) as f32 / 11.0, 1.0])
-    }
-
-    /// Run with Point defaults scaled to the layer (like `instantiate`).
-    fn run(id: &str, set: &[(&str, Value)], im: Image, masks: &[MaskShape]) -> Buf {
-        let s = crate::find(id).unwrap();
-        let ls = [im.width as f64, im.height as f64];
-        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        for ps in &s.params {
-            if let (ParamUi::Point, Value::Vec2(v)) = (&ps.ui, &ps.default) {
-                params.values.insert(ps.id.to_string(), Value::Vec2([v[0] * ls[0], v[1] * ls[1]]));
-            }
-        }
-        for (k, v) in set {
-            assert!(params.values.contains_key(*k), "{id}: {k}");
-            params.values.insert(k.to_string(), v.clone());
-        }
-        let env = EffectEnv { masks, ..Default::default() };
-        let ctx = EffectCtx { params: &params, time: 0.5, layer_size: ls, seed: 1, adjustment: false, env };
-        crate::apply(s, &ctx, Buf { img: im, offset: [0.0, 0.0], scale: 1.0 })
-    }
-
-    fn maxd(a: &Image, b: &Image) -> f32 {
-        assert_eq!((a.width, a.height), (b.width, b.height));
-        a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|i| (p[i] - q[i]).abs()).fold(0.0, f32::max)).fold(0.0, f32::max)
-    }
-
-    fn rect_mask(x0: f64, y0: f64, x1: f64, y1: f64) -> MaskShape {
-        MaskShape { name: "m".into(), points: vec![[x0, y0], [x1, y0], [x1, y1], [x0, y1]], closed: true, inverted: false }
-    }
-
-    #[test]
-    fn identity_at_neutral_settings() {
-        let im = img(40, 30);
-        let cases: &[(&str, Vec<(&str, Value)>)] = &[
-            ("ec.distort.ccbender", vec![]),
-            ("ec.distort.ccpowerpin", vec![]),
-            ("ec.distort.ccripplepulse", vec![]),
-            ("ec.distort.ccslant", vec![]),
-            ("ec.distort.ccsmear", vec![("reach", num(0.0))]),
-            ("ec.distort.ccsplit", vec![("split", num(0.0))]),
-            ("ec.distort.ccsplit2", vec![("split1", num(0.0)), ("split2", num(0.0))]),
-            ("ec.distort.smear", vec![]),
-            ("ec.distort.reshape", vec![]),
-            ("ec.distort.twirllegacy", vec![]),
-            ("ec.distort.warp", vec![("warpStyle", Value::Enum(5))]),
-            ("ec.distort.upscale", vec![]),
-        ];
-        for (id, set) in cases {
-            let o = run(id, set, im.clone(), &[]);
-            assert!(maxd(&o.img, &im) < 1e-5, "{id} not identity");
-            assert_eq!(o.offset, [0.0, 0.0], "{id}");
-        }
-        // Power pin with perspective 0 at default corners is also identity.
-        let o = run("ec.distort.ccpowerpin", &[("perspective", num(0.0))], im.clone(), &[]);
-        assert!(maxd(&o.img, &im) < 1e-4);
-    }
-
-    #[test]
-    fn all_deterministic() {
-        let im = img(36, 28);
-        let masks = [rect_mask(8.0, 8.0, 16.0, 16.0), rect_mask(12.0, 10.0, 22.0, 20.0), rect_mask(2.0, 2.0, 34.0, 26.0)];
-        let cases: &[(&str, Vec<(&str, Value)>)] = &[
-            ("ec.distort.ccbender", vec![("amount", num(40.0)), ("style", Value::Enum(3))]),
-            ("ec.distort.ccblobbylize", vec![]),
-            ("ec.distort.ccpowerpin", vec![("topLeft", pt(5.0, 3.0)), ("perspective", num(40.0))]),
-            ("ec.distort.ccripplepulse", vec![("pulseLevel", num(80.0))]),
-            ("ec.distort.ccslant", vec![("slant", num(30.0)), ("stretching", Value::Bool(true))]),
-            ("ec.distort.ccsmear", vec![]),
-            ("ec.distort.ccsplit", vec![]),
-            ("ec.distort.ccsplit2", vec![("split2", num(10.0))]),
-            ("ec.distort.smear", vec![("sourceMask", Value::Enum(1)), ("boundaryMask", Value::Enum(3)), ("maskOffset", pt(4.0, 2.0))]),
-            ("ec.distort.reshape", vec![("sourceMask", Value::Enum(1)), ("destinationMask", Value::Enum(2)), ("boundaryMask", Value::Enum(3))]),
-            ("ec.distort.twirllegacy", vec![("angle", num(90.0))]),
-            ("ec.distort.warp", vec![("bend", num(50.0)), ("horizontalDistortion", num(20.0))]),
-            ("ec.distort.upscale", vec![("scale", num(200.0))]),
-        ];
-        for (id, set) in cases {
-            let a = run(id, set, im.clone(), &masks);
-            let b = run(id, set, im.clone(), &masks);
-            assert_eq!(a.img, b.img, "{id}");
-            assert!(a.img.data.iter().all(|p| p.iter().all(|v| v.is_finite())), "{id}");
-            assert!(a.img.width != im.width || a.img.height != im.height || maxd(&a.img, &im) > 1e-3, "{id} did nothing");
-        }
-    }
-
-    /// A text layer's buffer: 20 × 10 opaque pixels at (90, 45)–(110, 55) of its comp-sized
-    /// (200 × 100) layer bounds, after `id` with `set`.
-    fn on_text(id: &str, set: &[(&str, Value)]) -> Buf {
-        let s = crate::find(id).unwrap();
-        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        for (k, v) in set {
-            assert!(params.values.contains_key(*k), "{id}: {k}");
-            params.values.insert(k.to_string(), v.clone());
-        }
-        let mut im = Image::new(20, 10);
-        im.data.iter_mut().for_each(|p| *p = [1.0; 4]);
-        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [200.0, 100.0], seed: 1, adjustment: false, env: Default::default() };
-        crate::apply(s, &ctx, Buf { img: im, offset: [-90.0, -45.0], scale: 1.0 })
-    }
-
-    /// Alpha at layer point `p` (0 outside the buffer).
-    fn alpha_at(b: &Buf, p: [f64; 2]) -> f32 {
-        let (x, y) = b.to_px(p);
-        b.img.get(x.floor() as i64, y.floor() as i64)[3]
-    }
-
-    /// #659: CC Smear and CC Tiler on a text layer reach past the text's box to the layer bounds
-    /// (comp-sized, as in After Effects), not cut off where the glyphs end.
-    #[test]
-    fn effects_on_text_reach_past_its_box() {
-        let smear = on_text("ec.distort.ccsmear", &[("from", pt(100.0, 50.0)), ("to", pt(140.0, 50.0)), ("reach", num(100.0)), ("radius", num(30.0))]);
-        assert!(alpha_at(&smear, [130.0, 50.0]) > 0.9, "the smear is cut off at the text's box");
-        assert!(smear.img.width < 200, "it grows only as far as pixels move");
-        let tiles = on_text("ec.distort.cctiler", &[("scale", num(50.0)), ("center", pt(100.0, 50.0))]);
-        assert!(alpha_at(&tiles, [100.0, 50.0]) > 0.9);
-        assert!(alpha_at(&tiles, [2.0, 50.0]) > 0.9, "tiles fill the layer bounds");
-        assert!(alpha_at(&tiles, [50.0, 50.0]) < 0.1);
-        // A footage layer's buffer is its bounds already: no change.
-        let o = run("ec.distort.ccsmear", &[], img(40, 30), &[]);
-        assert_eq!((o.img.width, o.img.height, o.offset), (40, 30, [0.0, 0.0]));
-    }
-
-    #[test]
-    fn every_warp_style_runs_and_bends() {
-        let im = img(40, 30);
-        for s in 0..WARP_STYLES.len() as u32 {
-            for axis in 0..2 {
-                let o = run("ec.distort.warp", &[("warpStyle", Value::Enum(s)), ("warpAxis", Value::Enum(axis)), ("bend", num(50.0))], im.clone(), &[]);
-                let pad = o.offset[0] as u32;
-                // The layer centre's neighbourhood is still made of source pixels.
-                assert!(o.img.get(pad as i64 + 20, pad as i64 + 15)[3] > 0.5, "style {s}");
-                assert!(o.img.width > im.width);
-            }
-        }
-        // Arc with positive bend raises the middle of the layer: the top edge in the middle
-        // moves up (opaque pixels above the original top).
-        let o = run("ec.distort.warp", &[("warpStyle", Value::Enum(3)), ("bend", num(50.0))], im.clone(), &[]);
-        let pad = o.offset[1] as i64;
-        assert!(o.img.get(o.offset[0] as i64 + 20, pad - 3)[3] > 0.5);
-        assert!(o.img.get(o.offset[0] as i64 + 1, pad - 3)[3] < 0.5);
-    }
-
-    #[test]
-    fn power_pin_moves_corners() {
-        let im = img(20, 20);
-        // Pin to the right half: output x in 10..20 shows the whole layer squeezed.
-        let set = [("topLeft", pt(10.0, 0.0)), ("bottomLeft", pt(10.0, 20.0))];
-        let o = run("ec.distort.ccpowerpin", &set, im.clone(), &[]);
-        assert_eq!(o.img.get(3, 10)[3], 0.0);
-        let px = o.img.get(15, 10);
-        assert!((px[0] - 0.5).abs() < 0.1, "{px:?}");
-    }
-
-    #[test]
-    fn power_pin_unstretch_expands_pinned_region() {
-        let im = crate::util::gen_image(24, 16, |_, _| [1.0, 0.0, 0.0, 1.0]);
-        let inset = [("topLeft", pt(6.0, 4.0)), ("topRight", pt(18.0, 4.0)), ("bottomRight", pt(18.0, 12.0)), ("bottomLeft", pt(6.0, 12.0))];
-        let opaque = |o: &Buf| o.img.data.iter().filter(|p| p[3] > 0.99).count();
-        let off = run("ec.distort.ccpowerpin", &inset, im.clone(), &[]);
-        assert_eq!(opaque(&off), 96);
-        let mut set = inset.to_vec();
-        set.push(("unstretch", Value::Bool(true)));
-        let on = run("ec.distort.ccpowerpin", &set, im.clone(), &[]);
-        assert_eq!(opaque(&on), 24 * 16);
-        assert!(on.img.get(0, 0)[3] > 0.99);
-        // Default corners are the identity either way.
-        let id = run("ec.distort.ccpowerpin", &[("unstretch", Value::Bool(true))], im.clone(), &[]);
-        assert!(maxd(&id.img, &im) < 1e-4);
-    }
-
-    #[test]
-    fn split_opens_a_gap() {
-        let im = img(40, 30);
-        let o = run("ec.distort.ccsplit", &[("split", num(40.0))], im.clone(), &[]);
-        assert_eq!(o.img.get(20, 15)[3], 0.0);
-        assert_eq!(o.img.get(2, 2), im.get(2, 2));
-    }
-
-    #[test]
-    fn slant_shears_from_floor() {
-        let im = img(20, 20);
-        let o = run("ec.distort.ccslant", &[("slant", num(50.0))], im.clone(), &[]);
-        let pad = o.offset[0] as i64;
-        // Bottom row stays put; the top row shifts right by ~10 px.
-        assert!((o.img.get(pad + 5, pad + 19)[0] - im.get(5, 19)[0]).abs() < 0.05);
-        assert!((o.img.get(pad + 15, pad)[0] - im.get(5, 0)[0]).abs() < 0.08);
-    }
-
-    #[test]
-    fn reshape_moves_source_to_destination() {
-        // A bright square at the source mask; reshape to a shifted destination mask.
-        let im = crate::util::gen_image(40, 40, |x, y| if (10..20).contains(&x) && (10..20).contains(&y) { [1.0; 4] } else { [0.0, 0.0, 0.0, 1.0] });
-        let masks = [rect_mask(10.0, 10.0, 20.0, 20.0), rect_mask(16.0, 10.0, 26.0, 20.0), rect_mask(0.0, 0.0, 40.0, 40.0)];
-        let o = run("ec.distort.reshape", &[("sourceMask", Value::Enum(1)), ("destinationMask", Value::Enum(2)), ("boundaryMask", Value::Enum(3))], im, &masks);
-        assert!(o.img.get(24, 15)[0] > 0.8, "{:?}", o.img.get(24, 15));
-        assert!(o.img.get(11, 15)[0] < 0.3, "{:?}", o.img.get(11, 15));
-    }
-
-    #[test]
-    fn reshape_correspondence_points_steer_the_match() {
-        // Matching outlines with a zero pair change nothing; a quarter-turn offset twists.
-        let im = img(40, 40);
-        let masks = [rect_mask(10.0, 10.0, 30.0, 30.0), rect_mask(10.0, 10.0, 30.0, 30.0), rect_mask(0.0, 0.0, 40.0, 40.0)];
-        let base = [("sourceMask", Value::Enum(1)), ("destinationMask", Value::Enum(2)), ("boundaryMask", Value::Enum(3))];
-        let same = run("ec.distort.reshape", &[base.as_slice(), &[("correspondencePoints", Value::Str("0,0".into()))]].concat(), im.clone(), &masks);
-        assert!(maxd(&same.img, &im) < 1e-3, "matching outlines: no change");
-        let twisted = run("ec.distort.reshape", &[base.as_slice(), &[("correspondencePoints", Value::Str("0.25,0".into()))]].concat(), im.clone(), &masks);
-        assert!(maxd(&twisted.img, &im) > 0.1);
-        // Fraction mapping.
-        assert!((map_fraction(&[(0.0, 0.0), (0.5, 0.25)], 0.125, true) - 0.25).abs() < 1e-9);
-        assert!((map_fraction(&[(0.2, 0.0)], 0.9, true) - 0.1).abs() < 1e-9);
-        assert!((map_fraction(&[(0.5, 0.5)], 0.25, false) - 0.25).abs() < 1e-9);
-    }
-
-    #[test]
-    fn upscale_grows_about_centre() {
-        let im = img(20, 10);
-        let o = run("ec.distort.upscale", &[("scale", num(200.0)), ("detail", num(0.0))], im.clone(), &[]);
-        assert_eq!((o.img.width, o.img.height), (40, 20));
-        // Grown about the layer centre: layer point (0,0) now sits at buffer pixel (10,5), so the
-        // centre (10,5) lands in the middle of the 40×20 buffer.
-        assert_eq!(o.offset, [10.0, 5.0]);
-        let c = o.img.sample_bilinear(20.0, 10.0);
-        assert!((c[0] - im.sample_bilinear(10.0, 5.0)[0]).abs() < 0.03);
-    }
-
-    #[test]
-    fn twirl_legacy_rotates_inside_radius() {
-        let im = img(40, 40);
-        let o = run("ec.distort.twirllegacy", &[("angle", num(180.0)), ("radius", num(100.0))], im.clone(), &[]);
-        assert!(maxd(&o.img, &im) > 0.1);
-        // Corners lie outside the radius.
-        assert_eq!(o.img.get(0, 0), im.get(0, 0));
-    }
-
-    #[test]
-    fn half_resolution_matches_scaled_geometry() {
-        // Bender at scale 0.5: the buffer is half size, parameters in layer pixels.
-        let s = crate::find("ec.distort.ccbender").unwrap();
-        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        params.values.insert("amount".into(), num(30.0));
-        params.values.insert("top".into(), pt(20.0, 0.0));
-        params.values.insert("base".into(), pt(20.0, 40.0));
-        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [40.0, 40.0], seed: 1, adjustment: false, env: Default::default() };
-        let full = crate::apply(s, &ctx, Buf { img: img(40, 40), offset: [0.0; 2], scale: 1.0 });
-        let half = crate::apply(s, &ctx, Buf { img: effectcraft_raster::resample(&img(40, 40), 20, 20), offset: [0.0; 2], scale: 0.5 });
-        let a = full.img.sample_bilinear(20.0, 4.0)[3];
-        let b = half.img.sample_bilinear(10.0, 2.0)[3];
-        assert!((a - b).abs() < 0.3);
-    }
-}
+mod tests;
diff --git a/crates/effects/src/distort3/tests.rs b/crates/effects/src/distort3/tests.rs
new file mode 100644
index 000000000..b50d6b450
--- /dev/null
+++ b/crates/effects/src/distort3/tests.rs
@@ -0,0 +1,332 @@
+use super::*;
+use crate::{EffectEnv, MaskShape, Params};
+
+fn img(w: u32, h: u32) -> Image {
+    crate::util::gen_image(w, h, |x, y| [x as f32 / w as f32, y as f32 / h as f32, ((x * 7 + y * 3) % 11) as f32 / 11.0, 1.0])
+}
+
+/// Run with Point defaults scaled to the layer (like `instantiate`).
+fn run(id: &str, set: &[(&str, Value)], im: Image, masks: &[MaskShape]) -> Buf {
+    let s = crate::find(id).unwrap();
+    let ls = [im.width as f64, im.height as f64];
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    for ps in &s.params {
+        if let (ParamUi::Point, Value::Vec2(v)) = (&ps.ui, &ps.default) {
+            params.values.insert(ps.id.to_string(), Value::Vec2([v[0] * ls[0], v[1] * ls[1]]));
+        }
+    }
+    for (k, v) in set {
+        assert!(params.values.contains_key(*k), "{id}: {k}");
+        params.values.insert(k.to_string(), v.clone());
+    }
+    let env = EffectEnv { masks, ..Default::default() };
+    let ctx = EffectCtx { params: &params, time: 0.5, layer_size: ls, seed: 1, adjustment: false, env };
+    crate::apply(s, &ctx, Buf { img: im, offset: [0.0, 0.0], scale: 1.0 })
+}
+
+fn maxd(a: &Image, b: &Image) -> f32 {
+    assert_eq!((a.width, a.height), (b.width, b.height));
+    a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|i| (p[i] - q[i]).abs()).fold(0.0, f32::max)).fold(0.0, f32::max)
+}
+
+fn rect_mask(x0: f64, y0: f64, x1: f64, y1: f64) -> MaskShape {
+    MaskShape { name: "m".into(), points: vec![[x0, y0], [x1, y0], [x1, y1], [x0, y1]], closed: true, inverted: false }
+}
+
+#[test]
+fn identity_at_neutral_settings() {
+    let im = img(40, 30);
+    let cases: &[(&str, Vec<(&str, Value)>)] = &[
+        ("ec.distort.ccbender", vec![]),
+        ("ec.distort.ccpowerpin", vec![]),
+        ("ec.distort.ccripplepulse", vec![]),
+        ("ec.distort.ccslant", vec![]),
+        ("ec.distort.ccsmear", vec![("reach", num(0.0))]),
+        ("ec.distort.ccsplit", vec![("split", num(0.0))]),
+        ("ec.distort.ccsplit2", vec![("split1", num(0.0)), ("split2", num(0.0))]),
+        ("ec.distort.smear", vec![]),
+        ("ec.distort.reshape", vec![]),
+        ("ec.distort.twirllegacy", vec![]),
+        ("ec.distort.warp", vec![("warpStyle", Value::Enum(5))]),
+        ("ec.distort.upscale", vec![]),
+    ];
+    for (id, set) in cases {
+        let o = run(id, set, im.clone(), &[]);
+        assert!(maxd(&o.img, &im) < 1e-5, "{id} not identity");
+        assert_eq!(o.offset, [0.0, 0.0], "{id}");
+    }
+    // Power pin with perspective 0 at default corners is also identity.
+    let o = run("ec.distort.ccpowerpin", &[("perspective", num(0.0))], im.clone(), &[]);
+    assert!(maxd(&o.img, &im) < 1e-4);
+}
+
+#[test]
+fn all_deterministic() {
+    let im = img(36, 28);
+    let masks = [rect_mask(8.0, 8.0, 16.0, 16.0), rect_mask(12.0, 10.0, 22.0, 20.0), rect_mask(2.0, 2.0, 34.0, 26.0)];
+    let cases: &[(&str, Vec<(&str, Value)>)] = &[
+        ("ec.distort.ccbender", vec![("amount", num(40.0)), ("style", Value::Enum(3))]),
+        ("ec.distort.ccblobbylize", vec![]),
+        ("ec.distort.ccpowerpin", vec![("topLeft", pt(5.0, 3.0)), ("perspective", num(40.0))]),
+        ("ec.distort.ccripplepulse", vec![("pulseLevel", num(80.0))]),
+        ("ec.distort.ccslant", vec![("slant", num(30.0)), ("stretching", Value::Bool(true))]),
+        ("ec.distort.ccsmear", vec![]),
+        ("ec.distort.ccsplit", vec![]),
+        ("ec.distort.ccsplit2", vec![("split2", num(10.0))]),
+        ("ec.distort.smear", vec![("sourceMask", Value::Enum(1)), ("boundaryMask", Value::Enum(3)), ("maskOffset", pt(4.0, 2.0))]),
+        ("ec.distort.reshape", vec![("sourceMask", Value::Enum(1)), ("destinationMask", Value::Enum(2)), ("boundaryMask", Value::Enum(3))]),
+        ("ec.distort.twirllegacy", vec![("angle", num(90.0))]),
+        ("ec.distort.warp", vec![("bend", num(50.0)), ("horizontalDistortion", num(20.0))]),
+        ("ec.distort.upscale", vec![("scale", num(200.0))]),
+    ];
+    for (id, set) in cases {
+        let a = run(id, set, im.clone(), &masks);
+        let b = run(id, set, im.clone(), &masks);
+        assert_eq!(a.img, b.img, "{id}");
+        assert!(a.img.data.iter().all(|p| p.iter().all(|v| v.is_finite())), "{id}");
+        assert!(a.img.width != im.width || a.img.height != im.height || maxd(&a.img, &im) > 1e-3, "{id} did nothing");
+    }
+}
+
+#[test]
+fn blobbylize_defaults_match_ae() {
+    let s = crate::find("ec.distort.ccblobbylize").unwrap();
+    let default = |id: &str| s.params.iter().find(|p| p.id == id).unwrap().default.clone();
+    assert_eq!(default("property"), Value::Enum(0), "Property defaults to Red");
+    assert_eq!(default("softness"), num(20.0));
+    assert_eq!(default("cutAway"), num(25.0));
+    assert_eq!(default("lightHeight"), num(65.0));
+    assert_eq!(default("lightPosition"), pt(0.5, 0.5));
+    assert_eq!(default("ambient"), num(75.0));
+    assert_eq!(default("diffuse"), num(25.0));
+    assert_eq!(default("specular"), num(100.0));
+    assert_eq!(default("roughness"), num(0.025));
+    assert_eq!(default("metal"), num(100.0));
+}
+
+#[test]
+fn blobbylize_cut_away_thresholds_a_height_ramp() {
+    // AE oracle: Cut Away is a linear height threshold with a ~1 px antialiased edge.
+    let im = crate::util::gen_image(1920, 8, |x, _| {
+        let h = x as f32 / 1920.0;
+        [h, h, h, 1.0]
+    });
+    let o = run("ec.distort.ccblobbylize", &[("property", Value::Enum(0)), ("softness", num(0.0)), ("cutAway", num(25.0))], im, &[]);
+    assert_eq!(o.img.get(400, 4)[3], 0.0, "below Cut Away must be transparent");
+    assert_eq!(o.img.get(560, 4)[3], 1.0, "above Cut Away must be opaque");
+    let edge = o.img.get(480, 4)[3];
+    assert!((0.45..=0.55).contains(&edge), "edge alpha {edge} is not a one-pixel threshold");
+    let partial = (450..510).filter(|&x| (0.001..0.999).contains(&o.img.get(x, 4)[3])).count();
+    assert!(partial <= 2, "{partial} antialiased columns instead of one");
+}
+
+#[test]
+fn blobbylize_cut_away_100_is_empty() {
+    // Regression: the old clamp to 0.99 left the top of the ramp opaque at Cut Away 100.
+    let im = crate::util::gen_image(1920, 8, |x, _| {
+        let h = x as f32 / 1920.0;
+        [h, h, h, 1.0]
+    });
+    let o = run("ec.distort.ccblobbylize", &[("property", Value::Enum(0)), ("softness", num(0.0)), ("cutAway", num(100.0))], im, &[]);
+    assert!(o.img.data.iter().all(|p| p[3] == 0.0), "Cut Away 100 left opaque pixels");
+}
+
+#[test]
+fn blobbylize_cut_away_100_clears_an_opaque_edge() {
+    // An opaque source reaches h = 1 on the high side of an edge; the gradient antialias
+    // used to leave m = 0.5 there, so Cut Away 100 still produced visible pixels.
+    let im = crate::util::gen_image(64, 8, |x, _| if x < 32 { [1.0; 4] } else { [0.0; 4] });
+    let o = run("ec.distort.ccblobbylize", &[("property", Value::Enum(3)), ("softness", num(0.0)), ("cutAway", num(100.0))], im, &[]);
+    assert!(o.img.data.iter().all(|p| p[3] == 0.0), "Cut Away 100 left an opaque edge");
+}
+
+#[test]
+fn blobbylize_softness_warps_a_step_matte_inward() {
+    // AE oracle T2: a self alpha step at x = 960, Softness 20, Cut Away 0 puts the matte
+    // edge at about x = 946, not at the source edge. The PR's matte-preserving version
+    // left it at 960; the effect must warp the source matte.
+    let im = crate::util::gen_image(1920, 32, |x, _| if x < 960 { [1.0; 4] } else { [0.0; 4] });
+    let o = run(
+        "ec.distort.ccblobbylize",
+        &[
+            ("property", Value::Enum(3)),
+            ("softness", num(20.0)),
+            ("cutAway", num(0.0)),
+            ("ambient", num(100.0)),
+            ("diffuse", num(0.0)),
+            ("specular", num(0.0)),
+            ("metal", num(0.0)),
+        ],
+        im,
+        &[],
+    );
+    assert!(o.img.get(945, 16)[3] > 0.95, "the matte did not move inward: {}", o.img.get(945, 16)[3]);
+    assert!(o.img.get(949, 16)[3] < 0.05, "source alpha leaked past the warped edge");
+    assert_eq!(o.img.get(960, 16)[3], 0.0, "the source matte was preserved instead of warped");
+}
+
+/// A text layer's buffer: 20 × 10 opaque pixels at (90, 45)–(110, 55) of its comp-sized
+/// (200 × 100) layer bounds, after `id` with `set`.
+fn on_text(id: &str, set: &[(&str, Value)]) -> Buf {
+    let s = crate::find(id).unwrap();
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    for (k, v) in set {
+        assert!(params.values.contains_key(*k), "{id}: {k}");
+        params.values.insert(k.to_string(), v.clone());
+    }
+    let mut im = Image::new(20, 10);
+    im.data.iter_mut().for_each(|p| *p = [1.0; 4]);
+    let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [200.0, 100.0], seed: 1, adjustment: false, env: Default::default() };
+    crate::apply(s, &ctx, Buf { img: im, offset: [-90.0, -45.0], scale: 1.0 })
+}
+
+/// Alpha at layer point `p` (0 outside the buffer).
+fn alpha_at(b: &Buf, p: [f64; 2]) -> f32 {
+    let (x, y) = b.to_px(p);
+    b.img.get(x.floor() as i64, y.floor() as i64)[3]
+}
+
+/// #659: CC Smear and CC Tiler on a text layer reach past the text's box to the layer bounds
+/// (comp-sized, as in After Effects), not cut off where the glyphs end.
+#[test]
+fn effects_on_text_reach_past_its_box() {
+    let smear = on_text("ec.distort.ccsmear", &[("from", pt(100.0, 50.0)), ("to", pt(140.0, 50.0)), ("reach", num(100.0)), ("radius", num(30.0))]);
+    assert!(alpha_at(&smear, [130.0, 50.0]) > 0.9, "the smear is cut off at the text's box");
+    assert!(smear.img.width < 200, "it grows only as far as pixels move");
+    let tiles = on_text("ec.distort.cctiler", &[("scale", num(50.0)), ("center", pt(100.0, 50.0))]);
+    assert!(alpha_at(&tiles, [100.0, 50.0]) > 0.9);
+    assert!(alpha_at(&tiles, [2.0, 50.0]) > 0.9, "tiles fill the layer bounds");
+    assert!(alpha_at(&tiles, [50.0, 50.0]) < 0.1);
+    // A footage layer's buffer is its bounds already: no change.
+    let o = run("ec.distort.ccsmear", &[], img(40, 30), &[]);
+    assert_eq!((o.img.width, o.img.height, o.offset), (40, 30, [0.0, 0.0]));
+}
+
+#[test]
+fn every_warp_style_runs_and_bends() {
+    let im = img(40, 30);
+    for s in 0..WARP_STYLES.len() as u32 {
+        for axis in 0..2 {
+            let o = run("ec.distort.warp", &[("warpStyle", Value::Enum(s)), ("warpAxis", Value::Enum(axis)), ("bend", num(50.0))], im.clone(), &[]);
+            let pad = o.offset[0] as u32;
+            // The layer centre's neighbourhood is still made of source pixels.
+            assert!(o.img.get(pad as i64 + 20, pad as i64 + 15)[3] > 0.5, "style {s}");
+            assert!(o.img.width > im.width);
+        }
+    }
+    // Arc with positive bend raises the middle of the layer: the top edge in the middle
+    // moves up (opaque pixels above the original top).
+    let o = run("ec.distort.warp", &[("warpStyle", Value::Enum(3)), ("bend", num(50.0))], im.clone(), &[]);
+    let pad = o.offset[1] as i64;
+    assert!(o.img.get(o.offset[0] as i64 + 20, pad - 3)[3] > 0.5);
+    assert!(o.img.get(o.offset[0] as i64 + 1, pad - 3)[3] < 0.5);
+}
+
+#[test]
+fn power_pin_moves_corners() {
+    let im = img(20, 20);
+    // Pin to the right half: output x in 10..20 shows the whole layer squeezed.
+    let set = [("topLeft", pt(10.0, 0.0)), ("bottomLeft", pt(10.0, 20.0))];
+    let o = run("ec.distort.ccpowerpin", &set, im.clone(), &[]);
+    assert_eq!(o.img.get(3, 10)[3], 0.0);
+    let px = o.img.get(15, 10);
+    assert!((px[0] - 0.5).abs() < 0.1, "{px:?}");
+}
+
+#[test]
+fn power_pin_unstretch_expands_pinned_region() {
+    let im = crate::util::gen_image(24, 16, |_, _| [1.0, 0.0, 0.0, 1.0]);
+    let inset = [("topLeft", pt(6.0, 4.0)), ("topRight", pt(18.0, 4.0)), ("bottomRight", pt(18.0, 12.0)), ("bottomLeft", pt(6.0, 12.0))];
+    let opaque = |o: &Buf| o.img.data.iter().filter(|p| p[3] > 0.99).count();
+    let off = run("ec.distort.ccpowerpin", &inset, im.clone(), &[]);
+    assert_eq!(opaque(&off), 96);
+    let mut set = inset.to_vec();
+    set.push(("unstretch", Value::Bool(true)));
+    let on = run("ec.distort.ccpowerpin", &set, im.clone(), &[]);
+    assert_eq!(opaque(&on), 24 * 16);
+    assert!(on.img.get(0, 0)[3] > 0.99);
+    // Default corners are the identity either way.
+    let id = run("ec.distort.ccpowerpin", &[("unstretch", Value::Bool(true))], im.clone(), &[]);
+    assert!(maxd(&id.img, &im) < 1e-4);
+}
+
+#[test]
+fn split_opens_a_gap() {
+    let im = img(40, 30);
+    let o = run("ec.distort.ccsplit", &[("split", num(40.0))], im.clone(), &[]);
+    assert_eq!(o.img.get(20, 15)[3], 0.0);
+    assert_eq!(o.img.get(2, 2), im.get(2, 2));
+}
+
+#[test]
+fn slant_shears_from_floor() {
+    let im = img(20, 20);
+    let o = run("ec.distort.ccslant", &[("slant", num(50.0))], im.clone(), &[]);
+    let pad = o.offset[0] as i64;
+    // Bottom row stays put; the top row shifts right by ~10 px.
+    assert!((o.img.get(pad + 5, pad + 19)[0] - im.get(5, 19)[0]).abs() < 0.05);
+    assert!((o.img.get(pad + 15, pad)[0] - im.get(5, 0)[0]).abs() < 0.08);
+}
+
+#[test]
+fn reshape_moves_source_to_destination() {
+    // A bright square at the source mask; reshape to a shifted destination mask.
+    let im = crate::util::gen_image(40, 40, |x, y| if (10..20).contains(&x) && (10..20).contains(&y) { [1.0; 4] } else { [0.0, 0.0, 0.0, 1.0] });
+    let masks = [rect_mask(10.0, 10.0, 20.0, 20.0), rect_mask(16.0, 10.0, 26.0, 20.0), rect_mask(0.0, 0.0, 40.0, 40.0)];
+    let o = run("ec.distort.reshape", &[("sourceMask", Value::Enum(1)), ("destinationMask", Value::Enum(2)), ("boundaryMask", Value::Enum(3))], im, &masks);
+    assert!(o.img.get(24, 15)[0] > 0.8, "{:?}", o.img.get(24, 15));
+    assert!(o.img.get(11, 15)[0] < 0.3, "{:?}", o.img.get(11, 15));
+}
+
+#[test]
+fn reshape_correspondence_points_steer_the_match() {
+    // Matching outlines with a zero pair change nothing; a quarter-turn offset twists.
+    let im = img(40, 40);
+    let masks = [rect_mask(10.0, 10.0, 30.0, 30.0), rect_mask(10.0, 10.0, 30.0, 30.0), rect_mask(0.0, 0.0, 40.0, 40.0)];
+    let base = [("sourceMask", Value::Enum(1)), ("destinationMask", Value::Enum(2)), ("boundaryMask", Value::Enum(3))];
+    let same = run("ec.distort.reshape", &[base.as_slice(), &[("correspondencePoints", Value::Str("0,0".into()))]].concat(), im.clone(), &masks);
+    assert!(maxd(&same.img, &im) < 1e-3, "matching outlines: no change");
+    let twisted = run("ec.distort.reshape", &[base.as_slice(), &[("correspondencePoints", Value::Str("0.25,0".into()))]].concat(), im.clone(), &masks);
+    assert!(maxd(&twisted.img, &im) > 0.1);
+    // Fraction mapping.
+    assert!((map_fraction(&[(0.0, 0.0), (0.5, 0.25)], 0.125, true) - 0.25).abs() < 1e-9);
+    assert!((map_fraction(&[(0.2, 0.0)], 0.9, true) - 0.1).abs() < 1e-9);
+    assert!((map_fraction(&[(0.5, 0.5)], 0.25, false) - 0.25).abs() < 1e-9);
+}
+
+#[test]
+fn upscale_grows_about_centre() {
+    let im = img(20, 10);
+    let o = run("ec.distort.upscale", &[("scale", num(200.0)), ("detail", num(0.0))], im.clone(), &[]);
+    assert_eq!((o.img.width, o.img.height), (40, 20));
+    // Grown about the layer centre: layer point (0,0) now sits at buffer pixel (10,5), so the
+    // centre (10,5) lands in the middle of the 40×20 buffer.
+    assert_eq!(o.offset, [10.0, 5.0]);
+    let c = o.img.sample_bilinear(20.0, 10.0);
+    assert!((c[0] - im.sample_bilinear(10.0, 5.0)[0]).abs() < 0.03);
+}
+
+#[test]
+fn twirl_legacy_rotates_inside_radius() {
+    let im = img(40, 40);
+    let o = run("ec.distort.twirllegacy", &[("angle", num(180.0)), ("radius", num(100.0))], im.clone(), &[]);
+    assert!(maxd(&o.img, &im) > 0.1);
+    // Corners lie outside the radius.
+    assert_eq!(o.img.get(0, 0), im.get(0, 0));
+}
+
+#[test]
+fn half_resolution_matches_scaled_geometry() {
+    // Bender at scale 0.5: the buffer is half size, parameters in layer pixels.
+    let s = crate::find("ec.distort.ccbender").unwrap();
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    params.values.insert("amount".into(), num(30.0));
+    params.values.insert("top".into(), pt(20.0, 0.0));
+    params.values.insert("base".into(), pt(20.0, 40.0));
+    let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [40.0, 40.0], seed: 1, adjustment: false, env: Default::default() };
+    let full = crate::apply(s, &ctx, Buf { img: img(40, 40), offset: [0.0; 2], scale: 1.0 });
+    let half = crate::apply(s, &ctx, Buf { img: effectcraft_raster::resample(&img(40, 40), 20, 20), offset: [0.0; 2], scale: 0.5 });
+    let a = full.img.sample_bilinear(20.0, 4.0)[3];
+    let b = half.img.sample_bilinear(10.0, 2.0)[3];
+    assert!((a - b).abs() < 0.3);
+}
diff --git a/crates/effects/src/distort4.rs b/crates/effects/src/distort4.rs
index b724a5830..9913c6ea5 100644
--- a/crates/effects/src/distort4.rs
+++ b/crates/effects/src/distort4.rs
@@ -1,6 +1,6 @@
-//! Distort: CC Flo Motion, Liquify and Rolling Shutter Repair.
+//! Distort: Dual Lens Warp, Liquify and Rolling Shutter Repair.
 //!
-//! * **CC Flo Motion** — two knots that pull the image toward themselves (positive amount) or
+//! * **Dual Lens Warp** — two knots that pull the image toward themselves (positive amount) or
 //!   push it away (negative), with a falloff exponent, optional tiling and supersampled
 //!   antialiasing.
 //! * **Liquify** — brush strokes build a displacement mesh (a grid of layer-space offsets). The
@@ -32,7 +32,7 @@ fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, ren
     EffectSpec { id, name, category: "Distort", params, render, gpu: false, float: true }
 }
 
-// ---------------------------------------------------------------- CC Flo Motion
+// ---------------------------------------------------------------- Dual Lens Warp
 
 fn flo_motion(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let knots = [(ctx.params.v2("knot1"), ctx.params.f("amount1") / 100.0), (ctx.params.v2("knot2"), ctx.params.f("amount2") / 100.0)];
@@ -560,7 +560,7 @@ pub fn specs() -> Vec<EffectSpec> {
     vec![
         spec(
             "ec.distort.ccflomotion",
-            "CC Flo Motion",
+            "Dual Lens Warp",
             vec![
                 p("knot1", "Knot 1", Value::Vec2([0.25, 0.5]), ParamUi::Point),
                 p("amount1", "Amount 1", num(50.0), slider(-400.0, 100.0, -100.0, 100.0, 1)),
diff --git a/crates/effects/src/generate.rs b/crates/effects/src/generate.rs
index fd5a54123..ae0d61861 100644
--- a/crates/effects/src/generate.rs
+++ b/crates/effects/src/generate.rs
@@ -112,10 +112,19 @@ pub(crate) fn gen_blend(o: Px, g: Px, mode: u32) -> Px {
     }
 }
 
+/// 4-Color Gradient's weights are inverse squared distances softened by Blend²: each point
+/// weighs 1 / (d² + Blend²) (pixels). Fitted to After Effects 2026 renders at Blend 10, 50, 100
+/// and 300 (power 2.00 at every Blend, softening 0 / 2367 / 9817 / 90127 ≈ Blend²; mean error
+/// 0.27/255, max 0.9). Returns Blend² in buffer pixels, never 0.
+pub fn four_color_softening(blend: f64, scale: f64) -> f64 {
+    let b = blend.max(0.0) * scale;
+    (b * b).max(1e-6)
+}
+
 fn four_color(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let pts: Vec<((f64, f64), [f32; 4])> =
         (1..=4).map(|i| (b.to_px(ctx.params.v2(&format!("positionsColors/point{i}"))), ctx.params.color(&format!("positionsColors/color{i}")))).collect();
-    let blend = ctx.params.f("blend").max(1.0);
+    let k = four_color_softening(ctx.params.f("blend"), b.scale);
     let jitter = (ctx.params.f("jitter") / 100.0).clamp(0.0, 1.0) as f32;
     let op = ctx.params.f("opacity") as f32 / 100.0;
     let mode = ctx.params.e("blendingMode");
@@ -126,7 +135,7 @@ fn four_color(ctx: &EffectCtx, mut b: Buf) -> Buf {
             let mut wsum = 0.0;
             for ((qx, qy), c) in &pts {
                 let d2 = (x as f64 + 0.5 - qx).powi(2) + (y as f64 + 0.5 - qy).powi(2);
-                let w = 1.0 / (d2 / (blend * 100.0) + 1e-6).powf(1.5);
+                let w = 1.0 / (d2 + k);
                 for i in 0..3 {
                     acc[i] += c[i] as f64 * w;
                 }
@@ -283,10 +292,22 @@ pub(crate) fn fade(t: f32) -> f32 {
     t * t * t * (t * (t * 6.0 - 15.0) + 10.0)
 }
 
-/// 3D value noise in 0..1 (z = evolution).
+/// 3D value noise in 0..1 (z = evolution). The quintic fade applies on all three axes, so z
+/// eases in and out of every integer.
 pub fn value_noise(x: f32, y: f32, z: f32, seed: u32) -> f32 {
+    value_noise_z(x, y, z, seed, true)
+}
+
+/// [`value_noise`] with the evolution axis z interpolated linearly (x and y keep the quintic
+/// fade). The fade's zero slope at every integer z made a small Evolution change almost invisible
+/// next to a whole revolution (#943, #1816); linear z moves the pattern at a constant rate.
+pub fn value_noise_linear_z(x: f32, y: f32, z: f32, seed: u32) -> f32 {
+    value_noise_z(x, y, z, seed, false)
+}
+
+fn value_noise_z(x: f32, y: f32, z: f32, seed: u32, ease_z: bool) -> f32 {
     let (x0, y0, z0) = (x.floor(), y.floor(), z.floor());
-    let (fx, fy, fz) = (fade(x - x0), fade(y - y0), fade(z - z0));
+    let (fx, fy, fz) = (fade(x - x0), fade(y - y0), if ease_z { fade(z - z0) } else { z - z0 });
     let (ix, iy, iz) = (x0 as i32, y0 as i32, z0 as i32);
     let l = |a: f32, b: f32, t: f32| a + (b - a) * t;
     let c = |dx: i32, dy: i32, dz: i32| lattice(ix + dx, iy + dy, iz + dz, seed);
@@ -405,6 +426,27 @@ mod generator_tests {
         Image::filled(32, 32, [1.0, 0.0, 0.0, 1.0])
     }
 
+    /// #943: the evolution axis is linear, so z moves the noise at a constant rate, while the
+    /// classic `value_noise` keeps its eased z (other effects and their pinned goldens use it).
+    #[test]
+    fn linear_z_value_noise_moves_at_a_constant_rate() {
+        for (x, y, seed) in [(0.3f32, 0.7f32, 5u32), (2.4, -1.6, 11), (-3.1, 4.9, 0)] {
+            let a = value_noise_linear_z(x, y, 0.0, seed);
+            let b = value_noise_linear_z(x, y, 1.0, seed);
+            for z in [0.1f32, 0.25, 0.5, 0.75, 0.9] {
+                let want = a + (b - a) * z;
+                let got = value_noise_linear_z(x, y, z, seed);
+                assert!((got - want).abs() < 1e-5, "({x}, {y}) z {z}: {got} vs {want}");
+            }
+            // Same lattice values at whole z, and x / y are untouched.
+            assert_eq!(value_noise_linear_z(x, y, 2.0, seed), value_noise(x, y, 2.0, seed));
+        }
+        // The eased version still has the old shape: at z = 0.25 it lags the linear one.
+        let (a, b) = (value_noise(0.3, 0.7, 0.0, 5), value_noise(0.3, 0.7, 1.0, 5));
+        let eased = value_noise(0.3, 0.7, 0.25, 5);
+        assert!((eased - (a + (b - a) * 0.25)).abs() > 1e-3);
+    }
+
     #[test]
     fn gradient_ramp_stays_inside_the_layer_alpha() {
         // #1063: a shape's transparent pixels stay transparent; the ramp fills only the shape.
@@ -423,6 +465,59 @@ mod generator_tests {
         }
     }
 
+    /// After Effects 2026, 4-Color Gradient defaults (yellow, green, magenta, blue at 10 % / 90 %
+    /// of a 1920 × 1080 layer) at Blend 100 and 300, here on a tenth-size layer with Blend 10
+    /// and 30 (the weights scale with the layer): colours at AE pixels (10x + 5, 10y + 5).
+    #[test]
+    fn four_color_blend_matches_after_effects() {
+        let pts = [
+            ("positionsColors/point1", [19.2, 10.8]),
+            ("positionsColors/point2", [172.8, 10.8]),
+            ("positionsColors/point3", [19.2, 97.2]),
+            ("positionsColors/point4", [172.8, 97.2]),
+        ];
+        let cols = [
+            ("positionsColors/color1", [1.0, 1.0, 0.0, 1.0]),
+            ("positionsColors/color2", [0.0, 1.0, 0.0, 1.0]),
+            ("positionsColors/color3", [1.0, 0.0, 1.0, 1.0]),
+            ("positionsColors/color4", [0.0, 0.0, 1.0, 1.0]),
+        ];
+        let ae: [(f64, [(i64, i64, [f32; 3]); 5]); 2] = [
+            (
+                10.0,
+                [
+                    (30, 20, [249.0, 240.0, 15.0]),
+                    (150, 30, [20.0, 208.0, 47.0]),
+                    (60, 90, [213.0, 56.0, 199.0]),
+                    (100, 10, [115.0, 177.0, 78.0]),
+                    (10, 50, [238.0, 145.0, 110.0]),
+                ],
+            ),
+            (
+                30.0,
+                [
+                    (30, 20, [236.0, 214.0, 41.0]),
+                    (150, 30, [30.0, 189.0, 66.0]),
+                    (60, 90, [203.0, 67.0, 188.0]),
+                    (100, 10, [117.0, 173.0, 82.0]),
+                    (10, 50, [233.0, 140.0, 115.0]),
+                ],
+            ),
+        ];
+        for (blend, samples) in ae {
+            let mut vals: Vec<(&str, Value)> = pts.iter().map(|(k, v)| (*k, Value::Vec2(*v))).collect();
+            vals.extend(cols.iter().map(|(k, v)| (*k, Value::Color(*v))));
+            vals.push(("blend", num(blend)));
+            let o = run_fx("ec.generate.fourcolor", &vals, Image::filled(192, 108, [1.0, 0.0, 0.0, 1.0]), 0.0, EffectEnv::default());
+            for (x, y, want) in samples {
+                let p = o.img.get(x, y);
+                for c in 0..3 {
+                    assert!((p[c] * 255.0 - want[c]).abs() <= 3.0, "blend {blend} at ({x}, {y}) channel {c}: {} vs AE {}", p[c] * 255.0, want[c]);
+                }
+            }
+        }
+    }
+
     #[test]
     fn four_color_none_stays_inside_the_layer_alpha() {
         // #1381: like the Gradient Ramp, the gradient fills a shape or text, not its bounding box.
diff --git a/crates/effects/src/generate2.rs b/crates/effects/src/generate2.rs
index 80d32ce0e..ad80cb9cd 100644
--- a/crates/effects/src/generate2.rs
+++ b/crates/effects/src/generate2.rs
@@ -1,5 +1,5 @@
 //! Generate effects, batch 2: Cell Pattern (Worley), Ellipse, Lens Flare, Beam, Radio Waves,
-//! Advanced Lightning, CC Light Rays, CC Light Burst 2.5, CC Light Sweep.
+//! Advanced Lightning, Light Rays, Radial Light Burst, Light Sweep.
 //!
 //! All designs are original procedural renderings written from the public descriptions of what
 //! each effect produces.
@@ -61,7 +61,7 @@ const CELL_PATTERNS: [&str; 12] = [
     "Tubular",
 ];
 
-/// Shaping used for Cell Pattern option `i` (see [`cell_value`]).
+/// Shaping used for Cell Pattern option `i` (see `cell_value`).
 pub fn pattern_kind(i: u32) -> u32 {
     match i {
         0..=5 => i,
@@ -692,18 +692,33 @@ impl BoltCfg<'_> {
     }
 }
 
-/// Grow a bolt from `a` to `z` by midpoint displacement (`depth` levels), forking at random.
-/// Segments go to `out` with their intensity; `mains` marks the main core's segments.
-#[allow(clippy::too_many_arguments)]
-fn bolt(cfg: &BoltCfg, a: (f64, f64), z: (f64, f64), depth: u32, inten: f32, main: bool, rng: &mut Rng, out: &mut Vec<Seg>, mains: &mut Vec<bool>) {
-    if out.len() > 20_000 {
+/// One branch's geometry and recursive growth state.
+struct BoltBranch {
+    start: (f64, f64),
+    end: (f64, f64),
+    depth: u32,
+    intensity: f32,
+    main: bool,
+}
+
+/// Segments and their matching main-core flags, kept in the same traversal order.
+#[derive(Default)]
+struct BoltOutput {
+    segments: Vec<Seg>,
+    mains: Vec<bool>,
+}
+
+/// Grow a branch by midpoint displacement, recursively appending its segments and forks.
+fn bolt(cfg: &BoltCfg, branch: BoltBranch, rng: &mut Rng, output: &mut BoltOutput) {
+    let BoltBranch { start: a, end: z, depth, intensity: inten, main } = branch;
+    if output.segments.len() > 20_000 {
         return;
     }
     let (dx, dy) = (z.0 - a.0, z.1 - a.1);
     let len = (dx * dx + dy * dy).sqrt();
     if depth == 0 || len < 1.0 {
-        out.push((a, z, inten));
-        mains.push(main);
+        output.segments.push((a, z, inten));
+        output.mains.push(main);
         return;
     }
     let (nx, ny) = (-dy / len.max(1e-9), dx / len.max(1e-9));
@@ -725,8 +740,8 @@ fn bolt(cfg: &BoltCfg, a: (f64, f64), z: (f64, f64), depth: u32, inten: f32, mai
     if cfg.obstacle > 0.0 && !main && cfg.alpha_at(m) > 0.5 && rng.f() < cfg.obstacle / 10.0 {
         return;
     }
-    bolt(cfg, a, m, depth - 1, inten, main, rng, out, mains);
-    bolt(cfg, m, z, depth - 1, inten, main, rng, out, mains);
+    bolt(cfg, BoltBranch { start: a, end: m, depth: depth - 1, intensity: inten, main }, rng, output);
+    bolt(cfg, BoltBranch { start: m, end: z, depth: depth - 1, intensity: inten, main }, rng, output);
     if rng.f() < cfg.fork && inten > cfg.term && len >= cfg.min_fork {
         let ang = rng.s() * 0.7;
         let (s, c) = ang.sin_cos();
@@ -734,7 +749,7 @@ fn bolt(cfg: &BoltCfg, a: (f64, f64), z: (f64, f64), depth: u32, inten: f32, mai
         let k = 1.2;
         // Fork Strength 50 % keeps the decayed intensity; Fork Variation randomises it.
         let fi = inten * (1.0 - cfg.decay) * cfg.fork_strength * 2.0 * if cfg.fork_var > 0.0 { 1.0 - cfg.fork_var * rng.f() as f32 } else { 1.0 };
-        bolt(cfg, m, (m.0 + fx * k, m.1 + fy * k), depth.saturating_sub(1), fi.min(1.0), false, rng, out, mains);
+        bolt(cfg, BoltBranch { start: m, end: (m.0 + fx * k, m.1 + fy * k), depth: depth.saturating_sub(1), intensity: fi.min(1.0), main: false }, rng, output);
     }
 }
 
@@ -772,10 +787,9 @@ pub fn lightning_segments(ctx: &EffectCtx, b: &Buf) -> Vec<Seg> {
         fork_strength: (g("expertSettings/forkStrength", 50.0) / 100.0).clamp(0.0, 1.0) as f32,
         fork_var: (g("expertSettings/forkVariation", 0.0) / 100.0).clamp(0.0, 1.0) as f32,
     };
-    let mut segs = Vec::new();
-    let mut mains = Vec::new();
+    let mut output = BoltOutput::default();
     let (h, w) = (b.img.height as f64, b.img.width as f64);
-    let mut go = |a, z, depth, cfg: &BoltCfg, rng: &mut Rng| bolt(cfg, a, z, depth, 1.0, true, rng, &mut segs, &mut mains);
+    let mut go = |a, z, depth, cfg: &BoltCfg, rng: &mut Rng| bolt(cfg, BoltBranch { start: a, end: z, depth, intensity: 1.0, main: true }, rng, &mut output);
     // LIGHTNING_TYPES order.
     match kind {
         // Direction: travels toward the Direction point and beyond.
@@ -811,6 +825,7 @@ pub fn lightning_segments(ctx: &EffectCtx, b: &Buf) -> Vec<Seg> {
         // Strike.
         _ => go(o, d, depth, &cfg, &mut rng),
     }
+    let BoltOutput { segments: mut segs, mains } = output;
     let dist = |p: (f64, f64)| ((p.0 - o.0).powi(2) + (p.1 - o.1).powi(2)).sqrt();
     let far = segs.iter().map(|(_, z, _)| dist(*z)).fold(1e-9, f64::max);
     // Decay Main Core: the whole bolt fades with distance from the origin.
@@ -882,7 +897,7 @@ fn advanced_lightning(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Light Rays / Burst
+// ---------------------------------------------------------------- Light Rays / Burst
 
 const RAY_STEPS: usize = 32;
 
@@ -992,7 +1007,7 @@ fn light_burst(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Light Sweep
+// ---------------------------------------------------------------- Light Sweep
 
 fn light_sweep(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = b.to_px(ctx.params.v2("center"));
@@ -1177,7 +1192,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.generate.cclightrays",
-            "CC Light Rays",
+            "Light Rays",
             vec![
                 p("intensity", "Intensity", num(100.0), slider(0.0, 600.0, 0.0, 200.0, 1)),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
@@ -1192,7 +1207,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.generate.cclightburst",
-            "CC Light Burst 2.5",
+            "Radial Light Burst",
             vec![
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
                 p("intensity", "Intensity", num(100.0), slider(0.0, 600.0, 0.0, 200.0, 1)),
@@ -1205,7 +1220,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.generate.cclightsweep",
-            "CC Light Sweep",
+            "Light Sweep",
             vec![
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
                 p("direction", "Direction", num(-30.0), ang()),
@@ -1223,315 +1238,4 @@ pub fn specs() -> Vec<EffectSpec> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::Params;
-    use effectcraft_raster::Image;
-
-    fn run(id: &str, set: &[(&str, Value)], img: Image) -> Buf {
-        let s = crate::find(id).unwrap();
-        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        let ls = [img.width as f64, img.height as f64];
-        for p in &s.params {
-            if let (ParamUi::Point, Value::Vec2(v)) = (&p.ui, &p.default) {
-                params.values.insert(p.id.to_string(), Value::Vec2([v[0] * ls[0], v[1] * ls[1]]));
-            }
-        }
-        for (k, v) in set {
-            params.values.insert(k.to_string(), v.clone());
-        }
-        let ctx = EffectCtx { params: &params, time: 0.5, layer_size: ls, seed: 3, adjustment: false, env: Default::default() };
-        crate::apply(s, &ctx, Buf { img, offset: [0.0, 0.0], scale: 1.0 })
-    }
-
-    #[test]
-    fn cell_pattern_is_deterministic_and_seeded() {
-        let a = run("ec.generate.cellpattern", &[("size", num(10.0))], Image::new(40, 30));
-        let b2 = run("ec.generate.cellpattern", &[("size", num(10.0))], Image::new(40, 30));
-        assert_eq!(a.img, b2.img);
-        let c = run("ec.generate.cellpattern", &[("size", num(10.0)), ("evolutionOptions/randomSeed", num(5.0))], Image::new(40, 30));
-        assert_ne!(a.img, c.img);
-        assert!(a.img.data.iter().all(|p| p[3] == 1.0 && (0.0..=1.0).contains(&p[0])));
-    }
-
-    #[test]
-    fn ellipse_ring_coverage() {
-        let o = run("ec.generate.ellipse", &[("width", num(40.0)), ("height", num(40.0)), ("thickness", num(6.0))], Image::new(64, 64));
-        // Ring passes through (32 + 20, 32); centre is empty.
-        assert!(o.img.get(51, 32)[3] > 0.9, "{:?}", o.img.get(51, 32));
-        assert!(o.img.get(32, 32)[3] < 1e-3);
-        assert!(o.img.get(2, 2)[3] < 1e-3);
-    }
-
-    #[test]
-    fn lightning_is_deterministic_per_conductivity() {
-        let a = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
-        let b2 = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
-        assert_eq!(a.img, b2.img);
-        assert!(a.img.data.iter().any(|p| p[3] > 0.5));
-        let c = run("ec.generate.advancedlightning", &[("conductivityState", num(11.0))], Image::new(64, 48));
-        assert_ne!(a.img, c.img);
-    }
-
-    #[test]
-    fn beam_draws_between_points() {
-        let o = run("ec.generate.beam", &[("length", num(100.0)), ("softness", num(0.0))], Image::new(64, 32));
-        assert!(o.img.get(32, 16)[3] > 0.99);
-        assert!(o.img.get(32, 2)[3] < 1e-3);
-        assert!(o.img.get(2, 16)[3] < 1e-3);
-    }
-
-    #[test]
-    fn cell_pattern_tiles() {
-        // 4×4-cell tiles of 8 px: the pattern repeats every 32 px.
-        let set = [
-            ("size", num(8.0)),
-            ("tilingOptions/enableTiling", Value::Bool(true)),
-            ("tilingOptions/cellsHorizontal", num(4.0)),
-            ("tilingOptions/cellsVertical", num(4.0)),
-        ];
-        let o = run("ec.generate.cellpattern", &set, Image::new(64, 64));
-        for (x, y) in [(3, 5), (10, 20), (17, 2)] {
-            let (a, b2) = (o.img.get(x, y), o.img.get(x + 32, y + 32));
-            assert!((a[0] - b2[0]).abs() < 1e-4, "{x},{y}: {a:?} vs {b2:?}");
-        }
-    }
-
-    #[test]
-    fn radio_waves_expansion_velocity_and_star() {
-        let r = |set: &[(&str, Value)], t: f64| {
-            let s = crate::find("ec.generate.radiowaves").unwrap();
-            let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-            params.values.insert("producerPoint".into(), Value::Vec2([32.0, 32.0]));
-            for (k, v) in set {
-                params.values.insert(k.to_string(), v.clone());
-            }
-            let ctx = EffectCtx { params: &params, time: t, layer_size: [64.0, 64.0], seed: 3, adjustment: false, env: Default::default() };
-            crate::apply(s, &ctx, Buf { img: Image::new(64, 64), offset: [0.0, 0.0], scale: 1.0 })
-        };
-        // One wave born at t = 0, 0.2 s old: radius = Expansion × age = 20 px.
-        let base = [("waveMotion/expansion", num(100.0)), ("waveMotion/frequency", num(0.5))];
-        let o = r(&base, 0.2);
-        assert!(o.img.get(52, 32)[3] > 0.9, "{:?}", o.img.get(52, 32));
-        assert!(o.img.get(32, 32)[3] < 0.01);
-        // Velocity moves the wave toward Direction (90° = right).
-        let mut moving = base.to_vec();
-        moving.push(("waveMotion/velocity", num(50.0)));
-        let o = r(&moving, 0.2);
-        assert!(o.img.get(62, 32)[3] > 0.9 && o.img.get(52, 32)[3] < 0.5, "{:?}", o.img.get(62, 32));
-        // A 4-point star: the outline dips toward the centre between the points.
-        let mut star = base.to_vec();
-        star.extend([("polygon/sides", num(4.0)), ("polygon/star", Value::Bool(true)), ("polygon/starDepth", num(-0.5))]);
-        let o = r(&star, 0.2);
-        assert!(o.img.get(32, 12)[3] > 0.9, "point straight up");
-        // Between points (45°) the outline sits near half the radius.
-        assert!(o.img.get(39, 24)[3] > 0.5, "{:?}", o.img.get(39, 24));
-        assert!(o.img.get(46, 18)[3] < 0.01, "no circle there");
-    }
-
-    #[test]
-    fn lightning_alpha_obstacle_and_expert_settings() {
-        let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
-        let alpha_in = |img: &Image, src: &Image| img.data.iter().zip(&src.data).filter(|(_, s)| s[3] > 0.5).map(|(p, _)| p[3]).sum::<f32>();
-        // A wall of opaque pixels across the middle of the bolt's path.
-        let mut wall = Image::new(64, 48);
-        for y in 0..48 {
-            for x in 0..64 {
-                if (18..30).contains(&y) && x < 50 {
-                    wall.set(x, y, [0.0, 0.0, 0.0, 1.0]);
-                }
-            }
-        }
-        let opts = |o: f64| {
-            vec![("alphaObstacle", num(o)), ("compositeOnOriginal", Value::Bool(false)), ("glowSettings/glowRadius", num(0.0)), ("forking", num(60.0))]
-        };
-        let free = run("ec.generate.advancedlightning", &opts(0.0), wall.clone());
-        let avoid = run("ec.generate.advancedlightning", &opts(10.0), wall.clone());
-        assert!(alpha_in(&avoid.img, &wall) < alpha_in(&free.img, &wall), "{} vs {}", alpha_in(&avoid.img, &wall), alpha_in(&free.img, &wall));
-        // Fractal Type, Core Drain, Fork Strength, Termination Threshold, Min Fork Distance.
-        let base = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
-        for (id, v) in [
-            ("expertSettings/fractalType", Value::Enum(2)),
-            ("expertSettings/coreDrain", num(100.0)),
-            ("expertSettings/forkStrength", num(100.0)),
-            ("expertSettings/forkVariation", num(100.0)),
-        ] {
-            assert_ne!(run("ec.generate.advancedlightning", &[(id, v)], Image::new(64, 48)).img, base.img, "{id}");
-        }
-        let drained = run("ec.generate.advancedlightning", &[("expertSettings/coreDrain", num(100.0))], Image::new(64, 48));
-        assert!(sum(&drained.img) < sum(&base.img));
-        let no_forks = run("ec.generate.advancedlightning", &[("expertSettings/minForkDistance", num(1000.0))], Image::new(64, 48));
-        let term = run("ec.generate.advancedlightning", &[("expertSettings/terminationThreshold", num(100.0))], Image::new(64, 48));
-        assert_eq!(no_forks.img, term.img, "no forks either way");
-        assert!(sum(&no_forks.img) < sum(&base.img));
-    }
-
-    #[test]
-    fn lightning_types_and_decay_main_core() {
-        let a = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
-        let strike = run("ec.generate.advancedlightning", &[("lightningType", Value::Enum(1))], Image::new(64, 48));
-        assert_eq!(a.img, strike.img, "Strike is the default");
-        for t in 0..8 {
-            let o = run("ec.generate.advancedlightning", &[("lightningType", Value::Enum(t))], Image::new(64, 48));
-            assert!(o.img.data.iter().any(|p| p[3] > 0.3), "type {t} draws");
-        }
-        let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
-        let d = run("ec.generate.advancedlightning", &[("decayMainCore", Value::Bool(true)), ("decay", num(0.9))], Image::new(64, 48));
-        let n = run("ec.generate.advancedlightning", &[("decay", num(0.9))], Image::new(64, 48));
-        assert!(sum(&d.img) < sum(&n.img));
-    }
-
-    #[test]
-    fn beam_3d_perspective_controls_thickness() {
-        // Short beam near the start: with 3D Perspective its thickness comes from its position
-        // (thin, near the start); without, its head takes the full ending thickness.
-        let set = |p: bool| {
-            vec![
-                ("length", num(20.0)),
-                ("time", num(0.0)),
-                ("softness", num(0.0)),
-                ("startThickness", num(2.0)),
-                ("endThickness", num(20.0)),
-                ("perspective3d", Value::Bool(p)),
-            ]
-        };
-        let on = run("ec.generate.beam", &set(true), Image::new(64, 32));
-        let off = run("ec.generate.beam", &set(false), Image::new(64, 32));
-        let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
-        assert!(sum(&off.img) > sum(&on.img) * 1.5, "{} {}", sum(&off.img), sum(&on.img));
-    }
-
-    #[test]
-    fn lens_flare_brightest_at_center() {
-        let o = run("ec.generate.lensflare", &[], Image::new(64, 64));
-        let c = o.img.get(16, 16)[0];
-        assert!(c > o.img.get(60, 4)[0]);
-        assert!(c > 0.5);
-    }
-
-    fn rw(set: &[(&str, Value)], t: f64, env: crate::EffectEnv) -> Image {
-        let mut v: Vec<(&str, Value)> =
-            vec![("producerPoint", Value::Vec2([32.0, 32.0])), ("waveMotion/frequency", num(0.5)), ("waveMotion/expansion", num(100.0))];
-        v.extend_from_slice(set);
-        crate::run_fx("ec.generate.radiowaves", &v, Image::new(64, 64), t, env).img
-    }
-
-    #[test]
-    fn signed_distance_of_a_square() {
-        let (w, h) = (20, 20);
-        let inside: Vec<bool> = (0..w * h).map(|i| (5..15).contains(&(i % w)) && (5..15).contains(&(i / w))).collect();
-        let d = crate::util::signed_distance(&inside, w, h);
-        assert!((d.get(10, 10) + 4.5).abs() < 1e-4, "{}", d.get(10, 10));
-        assert!((d.get(0, 10) - 4.5).abs() < 1e-4, "{}", d.get(0, 10));
-        assert!((d.get(0, 0) - (50f32.sqrt() - 0.5)).abs() < 1e-4);
-    }
-
-    #[test]
-    fn radio_waves_mask_contours_profile_reflection_and_birth() {
-        // Mask waves: a 10×10 square mask; after 0.1 s (10 px) the wave is 10 px outside it.
-        let sq = crate::MaskShape { name: String::new(), points: vec![[27.0, 27.0], [37.0, 27.0], [37.0, 37.0], [27.0, 37.0]], closed: true, inverted: false };
-        let masks = [sq];
-        let env = crate::EffectEnv { masks: &masks, ..Default::default() };
-        let m = rw(&[("waveType", Value::Enum(2)), ("waveMask/mask", num(1.0))], 0.1, env);
-        assert!(m.get(47, 32)[3] > 0.9, "{:?}", m.get(47, 32));
-        assert!(m.get(32, 32)[3] < 0.01 && m.get(40, 32)[3] < 0.01);
-        // Rounded corner: diagonal distance 10 from (37, 37).
-        assert!(m.get(44, 44)[3] > 0.5, "{:?}", m.get(44, 44));
-        // No mask chosen: nothing drawn.
-        assert!(rw(&[("waveType", Value::Enum(2))], 0.1, env).data.iter().all(|p| p[3] == 0.0));
-        // Image Contours: the bright square of a source layer.
-        struct Src;
-        impl crate::EffectHost for Src {
-            fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
-                let mut img = Image::new(64, 64);
-                for y in 27..37 {
-                    for x in 27..37 {
-                        img.set(x, y, [1.0, 1.0, 1.0, 1.0]);
-                    }
-                }
-                Some(crate::LayerPixels { buf: Buf { img, offset: [0.0; 2], scale: 1.0 }, size: [64.0, 64.0] })
-            }
-            fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-                None
-            }
-            fn params_at(&self, t: f64) -> Option<Params> {
-                // Colour animates from red (born at 0) to green (born later).
-                let s = crate::find("ec.generate.radiowaves").unwrap();
-                let mut p = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-                p.values.insert("producerPoint".into(), Value::Vec2([32.0, 32.0]));
-                p.values.insert("waveMotion/frequency".into(), num(1.0));
-                p.values.insert("waveMotion/expansion".into(), num(20.0));
-                p.values.insert("waveStroke/color".into(), if t < 0.5 { col(1.0, 0.0, 0.0) } else { col(0.0, 1.0, 0.0) });
-                Some(p)
-            }
-        }
-        let env = crate::EffectEnv { host: Some(&Src), ..Default::default() };
-        let ic = rw(
-            &[
-                ("waveType", Value::Enum(1)),
-                ("imageContour/sourceLayer", Value::Layer(Some(1))),
-                ("imageContour/preBlur", num(0.0)),
-                ("imageContour/tolerance", num(0.0)),
-            ],
-            0.1,
-            env,
-        );
-        assert!(ic.get(47, 32)[3] > 0.9 && ic.get(32, 32)[3] < 0.01, "{:?}", ic.get(47, 32));
-        // Source Center off the square shifts the contour onto the producer point accordingly.
-        let sh = rw(
-            &[
-                ("waveType", Value::Enum(1)),
-                ("imageContour/sourceLayer", Value::Layer(Some(1))),
-                ("imageContour/sourceCenter", Value::Vec2([22.0, 32.0])),
-                ("imageContour/preBlur", num(0.0)),
-                ("imageContour/tolerance", num(0.0)),
-            ],
-            0.1,
-            env,
-        );
-        assert!(sh.get(57, 32)[3] > 0.9, "{:?}", sh.get(57, 32));
-        // Profile: Taper Both thins the stroke edges; Square is solid across.
-        let wide = [("waveStroke/startWidth", num(10.0)), ("waveStroke/endWidth", num(10.0))];
-        let sqr = rw(&wide, 0.2, crate::EffectEnv::default());
-        let mut tap = wide.to_vec();
-        tap.push(("waveStroke/profile", Value::Enum(3)));
-        let tap = rw(&tap, 0.2, crate::EffectEnv::default());
-        assert!(sqr.get(55, 32)[3] > 0.9 && tap.get(55, 32)[3] < 0.6, "{:?} {:?}", sqr.get(55, 32), tap.get(55, 32));
-        assert!(tap.get(52, 32)[3] > 0.8);
-        // Reflection: a fast wave bounces back off the right edge.
-        let fast = [("waveMotion/velocity", num(200.0)), ("waveMotion/expansion", num(10.0))];
-        let gone = rw(&fast, 0.3, crate::EffectEnv::default());
-        let mut rf = fast.to_vec();
-        rf.push(("waveMotion/reflection", Value::Bool(true)));
-        let back = rw(&rf, 0.3, crate::EffectEnv::default());
-        let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
-        assert!(sum(&back) > sum(&gone) + 5.0, "{} vs {}", sum(&back), sum(&gone));
-        // Parameters Are Set At Birth: the older wave keeps red, the newer one is green.
-        let both = rw(&[("parametersAreSetAt", Value::Enum(0)), ("waveMotion/frequency", num(1.0)), ("waveMotion/expansion", num(20.0))], 1.15, env);
-        let (old, new) = (both.get(55, 32), both.get(35, 32));
-        assert!(old[0] > 0.9 && old[1] < 0.1, "{old:?}");
-        assert!(new[1] > 0.9 && new[0] < 0.1, "{new:?}");
-    }
-
-    #[test]
-    fn cell_pattern_hq_variants_antialias() {
-        let s = crate::find("ec.generate.cellpattern").unwrap();
-        let r = |pat: u32| {
-            let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-            params.values.insert("cellPattern".into(), Value::Enum(pat));
-            params.values.insert("size".into(), num(12.0));
-            let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [48.0, 48.0], seed: 1, adjustment: false, env: Default::default() };
-            crate::apply(s, &ctx, Buf { img: Image::new(48, 48), offset: [0.0; 2], scale: 1.0 }).img
-        };
-        let distinct = |img: &Image| {
-            let mut v: Vec<u32> = img.data.iter().map(|p| (p[0] * 10000.0) as u32).collect();
-            v.sort_unstable();
-            v.dedup();
-            v.len()
-        };
-        let (std, hq) = (r(4), r(9));
-        assert_eq!(CELL_PATTERNS[9], "Crystallize HQ");
-        assert_ne!(std, hq);
-        assert!(distinct(&hq) > distinct(&std) * 2, "{} vs {}", distinct(&hq), distinct(&std));
-    }
-}
+mod tests;
diff --git a/crates/effects/src/generate2/tests.rs b/crates/effects/src/generate2/tests.rs
new file mode 100644
index 000000000..c2acff446
--- /dev/null
+++ b/crates/effects/src/generate2/tests.rs
@@ -0,0 +1,309 @@
+use super::*;
+use crate::Params;
+use effectcraft_raster::Image;
+
+fn run(id: &str, set: &[(&str, Value)], img: Image) -> Buf {
+    let s = crate::find(id).unwrap();
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    let ls = [img.width as f64, img.height as f64];
+    for p in &s.params {
+        if let (ParamUi::Point, Value::Vec2(v)) = (&p.ui, &p.default) {
+            params.values.insert(p.id.to_string(), Value::Vec2([v[0] * ls[0], v[1] * ls[1]]));
+        }
+    }
+    for (k, v) in set {
+        params.values.insert(k.to_string(), v.clone());
+    }
+    let ctx = EffectCtx { params: &params, time: 0.5, layer_size: ls, seed: 3, adjustment: false, env: Default::default() };
+    crate::apply(s, &ctx, Buf { img, offset: [0.0, 0.0], scale: 1.0 })
+}
+
+#[test]
+fn cell_pattern_is_deterministic_and_seeded() {
+    let a = run("ec.generate.cellpattern", &[("size", num(10.0))], Image::new(40, 30));
+    let b2 = run("ec.generate.cellpattern", &[("size", num(10.0))], Image::new(40, 30));
+    assert_eq!(a.img, b2.img);
+    let c = run("ec.generate.cellpattern", &[("size", num(10.0)), ("evolutionOptions/randomSeed", num(5.0))], Image::new(40, 30));
+    assert_ne!(a.img, c.img);
+    assert!(a.img.data.iter().all(|p| p[3] == 1.0 && (0.0..=1.0).contains(&p[0])));
+}
+
+#[test]
+fn ellipse_ring_coverage() {
+    let o = run("ec.generate.ellipse", &[("width", num(40.0)), ("height", num(40.0)), ("thickness", num(6.0))], Image::new(64, 64));
+    // Ring passes through (32 + 20, 32); centre is empty.
+    assert!(o.img.get(51, 32)[3] > 0.9, "{:?}", o.img.get(51, 32));
+    assert!(o.img.get(32, 32)[3] < 1e-3);
+    assert!(o.img.get(2, 2)[3] < 1e-3);
+}
+
+#[test]
+fn lightning_is_deterministic_per_conductivity() {
+    let a = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
+    let b2 = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
+    assert_eq!(a.img, b2.img);
+    assert!(a.img.data.iter().any(|p| p[3] > 0.5));
+    let c = run("ec.generate.advancedlightning", &[("conductivityState", num(11.0))], Image::new(64, 48));
+    assert_ne!(a.img, c.img);
+}
+
+#[test]
+fn beam_draws_between_points() {
+    let o = run("ec.generate.beam", &[("length", num(100.0)), ("softness", num(0.0))], Image::new(64, 32));
+    assert!(o.img.get(32, 16)[3] > 0.99);
+    assert!(o.img.get(32, 2)[3] < 1e-3);
+    assert!(o.img.get(2, 16)[3] < 1e-3);
+}
+
+#[test]
+fn cell_pattern_tiles() {
+    // 4×4-cell tiles of 8 px: the pattern repeats every 32 px.
+    let set = [
+        ("size", num(8.0)),
+        ("tilingOptions/enableTiling", Value::Bool(true)),
+        ("tilingOptions/cellsHorizontal", num(4.0)),
+        ("tilingOptions/cellsVertical", num(4.0)),
+    ];
+    let o = run("ec.generate.cellpattern", &set, Image::new(64, 64));
+    for (x, y) in [(3, 5), (10, 20), (17, 2)] {
+        let (a, b2) = (o.img.get(x, y), o.img.get(x + 32, y + 32));
+        assert!((a[0] - b2[0]).abs() < 1e-4, "{x},{y}: {a:?} vs {b2:?}");
+    }
+}
+
+#[test]
+fn radio_waves_expansion_velocity_and_star() {
+    let r = |set: &[(&str, Value)], t: f64| {
+        let s = crate::find("ec.generate.radiowaves").unwrap();
+        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+        params.values.insert("producerPoint".into(), Value::Vec2([32.0, 32.0]));
+        for (k, v) in set {
+            params.values.insert(k.to_string(), v.clone());
+        }
+        let ctx = EffectCtx { params: &params, time: t, layer_size: [64.0, 64.0], seed: 3, adjustment: false, env: Default::default() };
+        crate::apply(s, &ctx, Buf { img: Image::new(64, 64), offset: [0.0, 0.0], scale: 1.0 })
+    };
+    // One wave born at t = 0, 0.2 s old: radius = Expansion × age = 20 px.
+    let base = [("waveMotion/expansion", num(100.0)), ("waveMotion/frequency", num(0.5))];
+    let o = r(&base, 0.2);
+    assert!(o.img.get(52, 32)[3] > 0.9, "{:?}", o.img.get(52, 32));
+    assert!(o.img.get(32, 32)[3] < 0.01);
+    // Velocity moves the wave toward Direction (90° = right).
+    let mut moving = base.to_vec();
+    moving.push(("waveMotion/velocity", num(50.0)));
+    let o = r(&moving, 0.2);
+    assert!(o.img.get(62, 32)[3] > 0.9 && o.img.get(52, 32)[3] < 0.5, "{:?}", o.img.get(62, 32));
+    // A 4-point star: the outline dips toward the centre between the points.
+    let mut star = base.to_vec();
+    star.extend([("polygon/sides", num(4.0)), ("polygon/star", Value::Bool(true)), ("polygon/starDepth", num(-0.5))]);
+    let o = r(&star, 0.2);
+    assert!(o.img.get(32, 12)[3] > 0.9, "point straight up");
+    // Between points (45°) the outline sits near half the radius.
+    assert!(o.img.get(39, 24)[3] > 0.5, "{:?}", o.img.get(39, 24));
+    assert!(o.img.get(46, 18)[3] < 0.01, "no circle there");
+}
+
+#[test]
+fn lightning_alpha_obstacle_and_expert_settings() {
+    let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
+    let alpha_in = |img: &Image, src: &Image| img.data.iter().zip(&src.data).filter(|(_, s)| s[3] > 0.5).map(|(p, _)| p[3]).sum::<f32>();
+    // A wall of opaque pixels across the middle of the bolt's path.
+    let mut wall = Image::new(64, 48);
+    for y in 0..48 {
+        for x in 0..64 {
+            if (18..30).contains(&y) && x < 50 {
+                wall.set(x, y, [0.0, 0.0, 0.0, 1.0]);
+            }
+        }
+    }
+    let opts =
+        |o: f64| vec![("alphaObstacle", num(o)), ("compositeOnOriginal", Value::Bool(false)), ("glowSettings/glowRadius", num(0.0)), ("forking", num(60.0))];
+    let free = run("ec.generate.advancedlightning", &opts(0.0), wall.clone());
+    let avoid = run("ec.generate.advancedlightning", &opts(10.0), wall.clone());
+    assert!(alpha_in(&avoid.img, &wall) < alpha_in(&free.img, &wall), "{} vs {}", alpha_in(&avoid.img, &wall), alpha_in(&free.img, &wall));
+    // Fractal Type, Core Drain, Fork Strength, Termination Threshold, Min Fork Distance.
+    let base = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
+    for (id, v) in [
+        ("expertSettings/fractalType", Value::Enum(2)),
+        ("expertSettings/coreDrain", num(100.0)),
+        ("expertSettings/forkStrength", num(100.0)),
+        ("expertSettings/forkVariation", num(100.0)),
+    ] {
+        assert_ne!(run("ec.generate.advancedlightning", &[(id, v)], Image::new(64, 48)).img, base.img, "{id}");
+    }
+    let drained = run("ec.generate.advancedlightning", &[("expertSettings/coreDrain", num(100.0))], Image::new(64, 48));
+    assert!(sum(&drained.img) < sum(&base.img));
+    let no_forks = run("ec.generate.advancedlightning", &[("expertSettings/minForkDistance", num(1000.0))], Image::new(64, 48));
+    let term = run("ec.generate.advancedlightning", &[("expertSettings/terminationThreshold", num(100.0))], Image::new(64, 48));
+    assert_eq!(no_forks.img, term.img, "no forks either way");
+    assert!(sum(&no_forks.img) < sum(&base.img));
+}
+
+#[test]
+fn lightning_types_and_decay_main_core() {
+    let a = run("ec.generate.advancedlightning", &[], Image::new(64, 48));
+    let strike = run("ec.generate.advancedlightning", &[("lightningType", Value::Enum(1))], Image::new(64, 48));
+    assert_eq!(a.img, strike.img, "Strike is the default");
+    for t in 0..8 {
+        let o = run("ec.generate.advancedlightning", &[("lightningType", Value::Enum(t))], Image::new(64, 48));
+        assert!(o.img.data.iter().any(|p| p[3] > 0.3), "type {t} draws");
+    }
+    let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
+    let d = run("ec.generate.advancedlightning", &[("decayMainCore", Value::Bool(true)), ("decay", num(0.9))], Image::new(64, 48));
+    let n = run("ec.generate.advancedlightning", &[("decay", num(0.9))], Image::new(64, 48));
+    assert!(sum(&d.img) < sum(&n.img));
+}
+
+#[test]
+fn beam_3d_perspective_controls_thickness() {
+    // Short beam near the start: with 3D Perspective its thickness comes from its position
+    // (thin, near the start); without, its head takes the full ending thickness.
+    let set = |p: bool| {
+        vec![
+            ("length", num(20.0)),
+            ("time", num(0.0)),
+            ("softness", num(0.0)),
+            ("startThickness", num(2.0)),
+            ("endThickness", num(20.0)),
+            ("perspective3d", Value::Bool(p)),
+        ]
+    };
+    let on = run("ec.generate.beam", &set(true), Image::new(64, 32));
+    let off = run("ec.generate.beam", &set(false), Image::new(64, 32));
+    let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
+    assert!(sum(&off.img) > sum(&on.img) * 1.5, "{} {}", sum(&off.img), sum(&on.img));
+}
+
+#[test]
+fn lens_flare_brightest_at_center() {
+    let o = run("ec.generate.lensflare", &[], Image::new(64, 64));
+    let c = o.img.get(16, 16)[0];
+    assert!(c > o.img.get(60, 4)[0]);
+    assert!(c > 0.5);
+}
+
+fn rw(set: &[(&str, Value)], t: f64, env: crate::EffectEnv) -> Image {
+    let mut v: Vec<(&str, Value)> =
+        vec![("producerPoint", Value::Vec2([32.0, 32.0])), ("waveMotion/frequency", num(0.5)), ("waveMotion/expansion", num(100.0))];
+    v.extend_from_slice(set);
+    crate::run_fx("ec.generate.radiowaves", &v, Image::new(64, 64), t, env).img
+}
+
+#[test]
+fn signed_distance_of_a_square() {
+    let (w, h) = (20, 20);
+    let inside: Vec<bool> = (0..w * h).map(|i| (5..15).contains(&(i % w)) && (5..15).contains(&(i / w))).collect();
+    let d = crate::util::signed_distance(&inside, w, h);
+    assert!((d.get(10, 10) + 4.5).abs() < 1e-4, "{}", d.get(10, 10));
+    assert!((d.get(0, 10) - 4.5).abs() < 1e-4, "{}", d.get(0, 10));
+    assert!((d.get(0, 0) - (50f32.sqrt() - 0.5)).abs() < 1e-4);
+}
+
+#[test]
+fn radio_waves_mask_contours_profile_reflection_and_birth() {
+    // Mask waves: a 10×10 square mask; after 0.1 s (10 px) the wave is 10 px outside it.
+    let sq = crate::MaskShape { name: String::new(), points: vec![[27.0, 27.0], [37.0, 27.0], [37.0, 37.0], [27.0, 37.0]], closed: true, inverted: false };
+    let masks = [sq];
+    let env = crate::EffectEnv { masks: &masks, ..Default::default() };
+    let m = rw(&[("waveType", Value::Enum(2)), ("waveMask/mask", num(1.0))], 0.1, env);
+    assert!(m.get(47, 32)[3] > 0.9, "{:?}", m.get(47, 32));
+    assert!(m.get(32, 32)[3] < 0.01 && m.get(40, 32)[3] < 0.01);
+    // Rounded corner: diagonal distance 10 from (37, 37).
+    assert!(m.get(44, 44)[3] > 0.5, "{:?}", m.get(44, 44));
+    // No mask chosen: nothing drawn.
+    assert!(rw(&[("waveType", Value::Enum(2))], 0.1, env).data.iter().all(|p| p[3] == 0.0));
+    // Image Contours: the bright square of a source layer.
+    struct Src;
+    impl crate::EffectHost for Src {
+        fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+            let mut img = Image::new(64, 64);
+            for y in 27..37 {
+                for x in 27..37 {
+                    img.set(x, y, [1.0, 1.0, 1.0, 1.0]);
+                }
+            }
+            Some(crate::LayerPixels { buf: Buf { img, offset: [0.0; 2], scale: 1.0 }, size: [64.0, 64.0] })
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn params_at(&self, t: f64) -> Option<Params> {
+            // Colour animates from red (born at 0) to green (born later).
+            let s = crate::find("ec.generate.radiowaves").unwrap();
+            let mut p = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+            p.values.insert("producerPoint".into(), Value::Vec2([32.0, 32.0]));
+            p.values.insert("waveMotion/frequency".into(), num(1.0));
+            p.values.insert("waveMotion/expansion".into(), num(20.0));
+            p.values.insert("waveStroke/color".into(), if t < 0.5 { col(1.0, 0.0, 0.0) } else { col(0.0, 1.0, 0.0) });
+            Some(p)
+        }
+    }
+    let env = crate::EffectEnv { host: Some(&Src), ..Default::default() };
+    let ic = rw(
+        &[
+            ("waveType", Value::Enum(1)),
+            ("imageContour/sourceLayer", Value::Layer(Some(1))),
+            ("imageContour/preBlur", num(0.0)),
+            ("imageContour/tolerance", num(0.0)),
+        ],
+        0.1,
+        env,
+    );
+    assert!(ic.get(47, 32)[3] > 0.9 && ic.get(32, 32)[3] < 0.01, "{:?}", ic.get(47, 32));
+    // Source Center off the square shifts the contour onto the producer point accordingly.
+    let sh = rw(
+        &[
+            ("waveType", Value::Enum(1)),
+            ("imageContour/sourceLayer", Value::Layer(Some(1))),
+            ("imageContour/sourceCenter", Value::Vec2([22.0, 32.0])),
+            ("imageContour/preBlur", num(0.0)),
+            ("imageContour/tolerance", num(0.0)),
+        ],
+        0.1,
+        env,
+    );
+    assert!(sh.get(57, 32)[3] > 0.9, "{:?}", sh.get(57, 32));
+    // Profile: Taper Both thins the stroke edges; Square is solid across.
+    let wide = [("waveStroke/startWidth", num(10.0)), ("waveStroke/endWidth", num(10.0))];
+    let sqr = rw(&wide, 0.2, crate::EffectEnv::default());
+    let mut tap = wide.to_vec();
+    tap.push(("waveStroke/profile", Value::Enum(3)));
+    let tap = rw(&tap, 0.2, crate::EffectEnv::default());
+    assert!(sqr.get(55, 32)[3] > 0.9 && tap.get(55, 32)[3] < 0.6, "{:?} {:?}", sqr.get(55, 32), tap.get(55, 32));
+    assert!(tap.get(52, 32)[3] > 0.8);
+    // Reflection: a fast wave bounces back off the right edge.
+    let fast = [("waveMotion/velocity", num(200.0)), ("waveMotion/expansion", num(10.0))];
+    let gone = rw(&fast, 0.3, crate::EffectEnv::default());
+    let mut rf = fast.to_vec();
+    rf.push(("waveMotion/reflection", Value::Bool(true)));
+    let back = rw(&rf, 0.3, crate::EffectEnv::default());
+    let sum = |i: &Image| i.data.iter().map(|p| p[3]).sum::<f32>();
+    assert!(sum(&back) > sum(&gone) + 5.0, "{} vs {}", sum(&back), sum(&gone));
+    // Parameters Are Set At Birth: the older wave keeps red, the newer one is green.
+    let both = rw(&[("parametersAreSetAt", Value::Enum(0)), ("waveMotion/frequency", num(1.0)), ("waveMotion/expansion", num(20.0))], 1.15, env);
+    let (old, new) = (both.get(55, 32), both.get(35, 32));
+    assert!(old[0] > 0.9 && old[1] < 0.1, "{old:?}");
+    assert!(new[1] > 0.9 && new[0] < 0.1, "{new:?}");
+}
+
+#[test]
+fn cell_pattern_hq_variants_antialias() {
+    let s = crate::find("ec.generate.cellpattern").unwrap();
+    let r = |pat: u32| {
+        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+        params.values.insert("cellPattern".into(), Value::Enum(pat));
+        params.values.insert("size".into(), num(12.0));
+        let ctx = EffectCtx { params: &params, time: 0.0, layer_size: [48.0, 48.0], seed: 1, adjustment: false, env: Default::default() };
+        crate::apply(s, &ctx, Buf { img: Image::new(48, 48), offset: [0.0; 2], scale: 1.0 }).img
+    };
+    let distinct = |img: &Image| {
+        let mut v: Vec<u32> = img.data.iter().map(|p| (p[0] * 10000.0) as u32).collect();
+        v.sort_unstable();
+        v.dedup();
+        v.len()
+    };
+    let (std, hq) = (r(4), r(9));
+    assert_eq!(CELL_PATTERNS[9], "Crystallize HQ");
+    assert_ne!(std, hq);
+    assert!(distinct(&hq) > distinct(&std) * 2, "{} vs {}", distinct(&hq), distinct(&std));
+}
diff --git a/crates/effects/src/generate3.rs b/crates/effects/src/generate3.rs
index 6beec4cb7..a61c3f769 100644
--- a/crates/effects/src/generate3.rs
+++ b/crates/effects/src/generate3.rs
@@ -17,2430 +17,26 @@ use rayon::prelude::*;
 use crate::util::{Plane, gauss_plane, hash1, layer_or_self, morph_frac, poly_length, premul, smoothstep, unpremul};
 use crate::{Buf, EffectCtx, EffectSpec, Params, col, num, p, popup, slider};
 
-fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, render: crate::RenderFn) -> EffectSpec {
-    EffectSpec { id, name, category: "Generate", params, render, gpu: false, float: true }
-}
-
-fn pt(x: f64, y: f64) -> Value {
-    Value::Vec2([x, y])
-}
-
-fn pct() -> ParamUi {
-    slider(0.0, 100.0, 0.0, 100.0, 1)
-}
-
-// ---------------------------------------------------------------- shared rasterisation
-
-/// A round-capped line segment in buffer pixels with radius `r` and intensity `v`.
-#[derive(Clone, Copy, Debug)]
-pub struct Seg {
-    pub a: [f64; 2],
-    pub b: [f64; 2],
-    pub r: f64,
-    pub v: f32,
-}
-
-/// Rasterise segments into a coverage plane (max-combined). `hardness` (0..1) is the fraction
-/// of the radius that is fully opaque; the rest falls off smoothly.
-pub(crate) fn raster_segs(w: usize, h: usize, segs: &[Seg], hardness: f64) -> Plane {
-    let mut out = Plane::new(w, h);
-    if w == 0 || h == 0 || segs.is_empty() {
-        return out;
-    }
-    let mut buckets: Vec<Vec<u32>> = vec![Vec::new(); h];
-    for (i, s) in segs.iter().enumerate() {
-        let pad = s.r + 1.0;
-        let y0 = (s.a[1].min(s.b[1]) - pad).floor().max(0.0) as usize;
-        let y1 = (s.a[1].max(s.b[1]) + pad).ceil().min(h as f64);
-        if y1 <= 0.0 || y0 >= h {
-            continue;
-        }
-        for row in buckets.iter_mut().take(y1 as usize).skip(y0) {
-            row.push(i as u32);
-        }
-    }
-    let hard = hardness.clamp(0.0, 1.0);
-    out.data.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
-        let py = y as f64 + 0.5;
-        for &i in &buckets[y] {
-            let s = segs[i as usize];
-            let pad = s.r + 1.0;
-            let x0 = (s.a[0].min(s.b[0]) - pad).floor().max(0.0) as usize;
-            let x1 = ((s.a[0].max(s.b[0]) + pad).ceil().max(0.0) as usize).min(w);
-            let (dx, dy) = (s.b[0] - s.a[0], s.b[1] - s.a[1]);
-            let l2 = dx * dx + dy * dy;
-            let inner = s.r * hard - 0.5;
-            let outer = s.r + 0.5;
-            for (x, o) in row.iter_mut().enumerate().take(x1).skip(x0) {
-                let px = x as f64 + 0.5;
-                let t = if l2 > 1e-12 { (((px - s.a[0]) * dx + (py - s.a[1]) * dy) / l2).clamp(0.0, 1.0) } else { 0.0 };
-                let d = ((px - s.a[0] - dx * t).powi(2) + (py - s.a[1] - dy * t).powi(2)).sqrt();
-                if d >= outer {
-                    continue;
-                }
-                let c = if d <= inner { 1.0 } else { 1.0 - smoothstep(inner as f32, outer as f32, d as f32) } * s.v;
-                if c > *o {
-                    *o = c;
-                }
-            }
-        }
-    });
-    out
-}
-
-/// Segments along a polyline (buffer px).
-pub fn poly_segs(pts: &[[f64; 2]], closed: bool, r: f64, v: f32, out: &mut Vec<Seg>) {
-    let n = pts.len();
-    if n == 1 {
-        out.push(Seg { a: pts[0], b: pts[0], r, v });
-    }
-    if n < 2 {
-        return;
-    }
-    let segs = if closed { n } else { n - 1 };
-    for i in 0..segs {
-        out.push(Seg { a: pts[i], b: pts[(i + 1) % n], r, v });
-    }
-}
-
-/// Portion `[s0, s1]` (arc length) of a polyline.
-pub(crate) fn trim_poly(pts: &[[f64; 2]], closed: bool, s0: f64, s1: f64) -> Vec<[f64; 2]> {
-    let n = pts.len();
-    let mut out = Vec::new();
-    if n < 2 || s1 <= s0 {
-        return out;
-    }
-    let segs = if closed { n } else { n - 1 };
-    let mut acc = 0.0;
-    for i in 0..segs {
-        let (a, b) = (pts[i], pts[(i + 1) % n]);
-        let l = ((b[0] - a[0]).powi(2) + (b[1] - a[1]).powi(2)).sqrt();
-        let (e0, e1) = (acc, acc + l);
-        acc = e1;
-        if e1 < s0 || e0 > s1 || l <= 0.0 {
-            continue;
-        }
-        let at = |s: f64| {
-            let t = ((s - e0) / l).clamp(0.0, 1.0);
-            [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t]
-        };
-        let p0 = at(s0.max(e0));
-        if out.last() != Some(&p0) {
-            out.push(p0);
-        }
-        out.push(at(s1.min(e1)));
-    }
-    out
-}
-
-/// How painted coverage meets the layer: 0 On Original Image, 1 On Transparent, 2 Reveal
-/// Original Image.
-pub(crate) fn paint(img: &mut Image, cov: &Plane, color: [f32; 4], opacity: f32, style: u32) {
-    img.data.par_iter_mut().zip(cov.data.par_iter()).for_each(|(px, &c)| {
-        let a = (c * opacity * color[3]).clamp(0.0, 1.0);
-        let s = [color[0] * a, color[1] * a, color[2] * a, a];
-        *px = match style {
-            1 => s,
-            2 => [px[0] * a, px[1] * a, px[2] * a, px[3] * a],
-            _ => over(*px, s),
-        };
-    });
-}
-
-/// Coverage of a plan-drawn generator: round-capped segments rasterised by [`raster_segs`]
-/// with `hardness`, or the union of convex polygons ([`raster_convex`]).
-#[derive(Clone, Debug)]
-pub enum Coverage {
-    Segs { segs: Vec<Seg>, hardness: f64 },
-    Convex(Vec<Vec<[f64; 2]>>),
-}
-
-impl Coverage {
-    fn raster(&self, w: usize, h: usize) -> Plane {
-        match self {
-            Coverage::Segs { segs, hardness } => raster_segs(w, h, segs, *hardness),
-            Coverage::Convex(polys) => raster_convex(w, h, polys),
-        }
-    }
-}
-
-/// Stroke, Scribble, Vegas and Write-on, shared with the GPU compositor (effectcraft-gpu
-/// `fx_gen2`): the coverage and how it is painted. `style` 0–2 as [`paint`] (On Original
-/// Image, On Transparent, Reveal Original Image), 3 = under the layer (Vegas' Composite Under).
-#[derive(Clone, Debug)]
-pub struct PaintPlan {
-    pub cov: Coverage,
-    pub color: [f32; 4],
-    pub opacity: f32,
-    pub style: u32,
-}
-
-/// Draw a [`PaintPlan`].
-fn draw_paint(b: &mut Buf, plan: &PaintPlan) {
-    let cov = plan.cov.raster(b.img.width as usize, b.img.height as usize);
-    if plan.style == 3 {
-        let color = plan.color;
-        b.img.data.par_iter_mut().zip(cov.data.par_iter()).for_each(|(px, &c)| {
-            let a = c * color[3];
-            *px = over([color[0] * a, color[1] * a, color[2] * a, a], *px);
-        });
-    } else {
-        paint(&mut b.img, &cov, plan.color, plan.opacity, plan.style);
-    }
-}
-
-/// Generators drawn from a plan that need the layer's own pixels (`b.img`) to build it.
-pub fn plan_reads_pixels(id: &str, ctx: &EffectCtx) -> bool {
-    match id {
-        // Image Contours read the layer itself when no (resolvable) Input Layer is chosen.
-        "ec.generate.vegas" => ctx.params.e("stroke") == 0,
-        "ec.generate.paintbucket" | "ec.generate.eyedropperfill" => true,
-        "ec.generate.advancedlightning" => ctx.params.f("alphaObstacle").clamp(-10.0, 10.0) != 0.0,
-        _ => false,
-    }
-}
-
-/// [`PaintPlan`] of Stroke, Scribble, Vegas or Write-on on `b`'s geometry (`b.img` is read
-/// only when [`plan_reads_pixels`]). `None`: Scribble without a usable mask (the layer is
-/// cleared when it composites On Transparent, else kept).
-pub fn paint_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<PaintPlan> {
-    match id {
-        "ec.generate.stroke" => Some(stroke_plan(ctx, b)),
-        "ec.generate.scribble" => scribble_plan(ctx, b),
-        "ec.generate.vegas" => Some(vegas_plan(ctx, b)),
-        "ec.generate.writeon" => Some(write_on_plan(ctx, b)),
-        _ => None,
-    }
-}
-
-/// Scribble's Composite as a [`paint`] style.
-pub fn scribble_style(ctx: &EffectCtx) -> u32 {
-    match ctx.params.e("composite") {
-        0 => 0,
-        2 => 2,
-        _ => 1,
-    }
-}
-
-#[inline]
-fn over(dst: Px, src: Px) -> Px {
-    let k = 1.0 - src[3];
-    [src[0] + dst[0] * k, src[1] + dst[1] * k, src[2] + dst[2] * k, src[3] + dst[3] * k]
-}
-
-/// Mask `idx` (1-based; 0 = none) mapped to buffer pixels.
-pub(crate) fn mask_px(ctx: &EffectCtx, b: &Buf, idx: usize) -> Option<(Vec<[f64; 2]>, bool, bool)> {
-    let m = ctx.env.masks.get(idx.checked_sub(1)?)?;
-    if m.points.is_empty() {
-        return None;
-    }
-    Some((m.points.iter().map(|&q| [q[0] * b.scale + b.offset[0], q[1] * b.scale + b.offset[1]]).collect(), m.closed, m.inverted))
-}
-
-/// All masks mapped to buffer pixels.
-fn all_masks_px(ctx: &EffectCtx, b: &Buf) -> Vec<(Vec<[f64; 2]>, bool, bool)> {
-    (1..=ctx.env.masks.len()).filter_map(|i| mask_px(ctx, b, i)).collect()
-}
-
-/// Chaikin corner cutting (open polyline, endpoints kept).
-fn chaikin(pts: &[[f64; 2]], iters: usize) -> Vec<[f64; 2]> {
-    let mut cur = pts.to_vec();
-    for _ in 0..iters {
-        if cur.len() < 3 {
-            return cur;
-        }
-        let mut nx = Vec::with_capacity(cur.len() * 2);
-        nx.push(cur[0]);
-        for w in cur.windows(2) {
-            let (a, b) = (w[0], w[1]);
-            nx.push([a[0] * 0.75 + b[0] * 0.25, a[1] * 0.75 + b[1] * 0.25]);
-            nx.push([a[0] * 0.25 + b[0] * 0.75, a[1] * 0.25 + b[1] * 0.75]);
-        }
-        nx.push(*cur.last().unwrap_or(&[0.0; 2]));
-        cur = nx;
-    }
-    cur
-}
-
-// ---------------------------------------------------------------- Fractal
-
-#[derive(Clone, Copy)]
-struct FracSet {
-    /// Mandelbrot iterations start at the Julia centre (the "Over Julia" set choices).
-    over_julia: bool,
-    julia: bool,
-    inverse: bool,
-}
-
-/// Smooth escape count, or `None` inside the set.
-fn escape(z0: (f64, f64), c: (f64, f64), power: u32, limit: f64, max_iter: u32) -> Option<f64> {
-    let (mut x, mut y) = z0;
-    let lim2 = limit * limit;
-    for i in 0..max_iter {
-        let (nx, ny) = match power {
-            3 => (x * x * x - 3.0 * x * y * y, 3.0 * x * x * y - y * y * y),
-            4 => {
-                let (a, b) = (x * x - y * y, 2.0 * x * y);
-                (a * a - b * b, 2.0 * a * b)
-            }
-            _ => (x * x - y * y, 2.0 * x * y),
-        };
-        x = nx + c.0;
-        y = ny + c.1;
-        let m2 = x * x + y * y;
-        if m2 > lim2 {
-            let lz = m2.ln() * 0.5;
-            let nu = (lz / limit.max(1.0001).ln()).max(1e-9).ln() / (power as f64).ln();
-            return Some((i as f64 + 1.0 - nu).max(0.0));
-        }
-    }
-    None
-}
-
-/// Fractal Set Choice options.
-pub(crate) const FRACTAL_SETS: [&str; 6] =
-    ["Mandelbrot", "Mandelbrot Inverse", "Mandelbrot Over Julia", "Mandelbrot Inverse Over Julia", "Julia", "Julia Inverse"];
-/// Fractal Palette options.
-pub(crate) const FRACTAL_PALETTES: [&str; 4] = ["Lightness Gradient", "Hue Wheel", "Black And White", "Solid Color"];
-/// Fractal Oversample Method options.
-pub(crate) const FRACTAL_OVERSAMPLE: [&str; 2] = ["Edge Detect-Fast-May Miss Pixels", "Brute Force-Slow-Every Pixel"];
-
-fn fractal(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let set_choice = pr.e("setChoice");
-    let power = 2 + pr.e("equation").min(2);
-    let mc = (pr.f("mandelbrot/mandelbrotX"), pr.f("mandelbrot/mandelbrotY"));
-    let mmag = pr.f("mandelbrot/mandelbrotMagnification");
-    let mlim = pr.f("mandelbrot/mandelbrotEscapeLimit").max(1.01);
-    let jc = (pr.f("julia/juliaX"), pr.f("julia/juliaY"));
-    let jmag = pr.f("julia/juliaMagnification");
-    let jlim = pr.f("julia/juliaEscapeLimit").max(1.01);
-    let post = (pr.f("postInversionOffset/postInversionX"), pr.f("postInversionOffset/postInversionY"));
-    let overlay = pr.b("fractalColor/overlay");
-    let transparency = pr.b("fractalColor/transparency");
-    let transparent_inside = transparency || overlay;
-    let palette = pr.e("fractalColor/palette");
-    let hue = (pr.f("fractalColor/hue") / 360.0) as f32;
-    let steps = pr.f("fractalColor/cycleSteps").max(1.0);
-    let cyc_off = pr.f("fractalColor/cycleOffset") / 360.0;
-    let edge = pr.b("fractalColor/edgeHighlight");
-    let every = pr.e("highQualitySettings/samplingMethod") == 1;
-    let factor = pr.f("highQualitySettings/samplingFactor").round().clamp(1.0, 9.0) as usize;
-    let (w, h) = (b.img.width as usize, b.img.height as usize);
-    let lw = ctx.layer_size[0].max(1.0);
-    let lh = ctx.layer_size[1].max(1.0);
-    let inv = 1.0 / b.scale.max(1e-9);
-    let (off_x, off_y) = (b.offset[0], b.offset[1]);
-    // FRACTAL_SETS order.
-    let set = |julia, inverse, over_julia| FracSet { over_julia, julia, inverse };
-    let sets: (FracSet, Option<FracSet>) = match set_choice {
-        1 => (set(false, true, false), None),
-        2 => (set(false, false, true), None),
-        3 => (set(false, true, true), None),
-        4 => (set(true, false, false), None),
-        5 => (set(true, true, false), None),
-        _ => (set(false, false, false), None),
-    };
-    let iter_for = |mag: f64| (96.0 + 48.0 * mag.max(0.0)).clamp(64.0, 3000.0) as u32;
-    let eval_set = |s: FracSet, lx: f64, ly: f64| -> Option<f64> {
-        let (center, mag, lim) = if s.julia { (jc, jmag, jlim) } else { (mc, mmag, mlim) };
-        let span = 3.5 / 2f64.powf(mag);
-        let mut u = (lx - lw * 0.5) / lw * span + center.0;
-        let mut v = (ly - lh * 0.5) / lw * span + center.1;
-        if s.inverse {
-            let d = (u * u + v * v).max(1e-12);
-            u = u / d + post.0;
-            v = -v / d + post.1;
-        }
-        if s.julia {
-            escape((u, v), mc, power, lim, iter_for(mag))
-        } else {
-            let z0 = if s.over_julia { jc } else { (0.0, 0.0) };
-            escape(z0, (u, v), power, lim, iter_for(mag))
-        }
-    };
-    let eval = |lx: f64, ly: f64| -> Option<f64> {
-        let a = eval_set(sets.0, lx, ly);
-        match (a, sets.1) {
-            (None, Some(s2)) => eval_set(s2, lx, ly),
-            _ => a,
-        }
-    };
-    let shade = |n: Option<f64>| -> Px {
-        // Solid Color: only the inside of the set is drawn (Transparency flips the sides).
-        if palette == 3 {
-            let (r, g, bl) = hsl_to_rgb(hue, 1.0, 0.5);
-            return if n.is_none() != transparency { [r, g, bl, 1.0] } else { [0.0; 4] };
-        }
-        let Some(n) = n else {
-            return if transparent_inside { [0.0; 4] } else { [0.0, 0.0, 0.0, 1.0] };
-        };
-        let u = n / steps + cyc_off;
-        let band = (u.rem_euclid(1.0)) as f32;
-        let (r, g, bl) = match palette {
-            // Hue Wheel: the full hue circle at full saturation and brightness.
-            1 => hsl_to_rgb((hue + band).rem_euclid(1.0), 1.0, 0.5),
-            // Black And White: alternating bands.
-            2 => {
-                let v = if (u.floor() as i64).rem_euclid(2) == 0 { 0.0 } else { 1.0 };
-                (v, v, v)
-            }
-            // Lightness Gradient: black → hue → white, the hue moving 45° each cycle.
-            _ => hsl_to_rgb((hue + u.floor() as f32 * 0.125).rem_euclid(1.0), 0.85, band.clamp(0.0, 1.0)),
-        };
-        let mut c = [r, g, bl];
-        if edge && n.fract() < 0.12 {
-            c = [c[0] * 0.4 + 0.6, c[1] * 0.4 + 0.6, c[2] * 0.4 + 0.6];
-        }
-        [c[0], c[1], c[2], 1.0]
-    };
-    // First pass: one sample per pixel.
-    let mut first: Vec<Option<f64>> = vec![None; w * h];
-    first.par_chunks_mut(w.max(1)).enumerate().for_each(|(y, row)| {
-        for (x, v) in row.iter_mut().enumerate() {
-            *v = eval((x as f64 + 0.5 - off_x) * inv, (y as f64 + 0.5 - off_y) * inv);
-        }
-    });
-    let src = if overlay { Some(b.img.clone()) } else { None };
-    b.img.rows_mut().for_each(|(y, row)| {
-        for (x, px) in row.iter_mut().enumerate() {
-            let here = first[y * w + x];
-            let needs_ss = factor > 1
-                && (every || {
-                    let mut diff = false;
-                    for (dx, dy) in [(-1i64, 0i64), (1, 0), (0, -1), (0, 1)] {
-                        let (nx, ny) = (x as i64 + dx, y as i64 + dy);
-                        if nx < 0 || ny < 0 || nx >= w as i64 || ny >= h as i64 {
-                            continue;
-                        }
-                        let o = first[ny as usize * w + nx as usize];
-                        diff |= match (here, o) {
-                            (Some(a), Some(c)) => (a - c).abs() > steps * 0.25,
-                            (None, None) => false,
-                            _ => true,
-                        };
-                    }
-                    diff
-                });
-            let c = if needs_ss {
-                let mut acc = [0.0f32; 4];
-                for sy in 0..factor {
-                    for sx in 0..factor {
-                        let fx = x as f64 + (sx as f64 + 0.5) / factor as f64;
-                        let fy = y as f64 + (sy as f64 + 0.5) / factor as f64;
-                        let s = shade(eval((fx - off_x) * inv, (fy - off_y) * inv));
-                        let a = s[3];
-                        for k in 0..3 {
-                            acc[k] += s[k] * a;
-                        }
-                        acc[3] += a;
-                    }
-                }
-                let n = (factor * factor) as f32;
-                [acc[0] / n, acc[1] / n, acc[2] / n, acc[3] / n]
-            } else {
-                let s = shade(here);
-                [s[0] * s[3], s[1] * s[3], s[2] * s[3], s[3]]
-            };
-            *px = match &src {
-                Some(o) => over(o.data[y * w + x], c),
-                None => c,
-            };
-        }
-    });
-    b
-}
-
-// ---------------------------------------------------------------- Scribble
-
-/// Scan runs (start, end along direction `d`) of the fill region on the line `n·p = s`.
-#[allow(clippy::too_many_arguments)]
-fn scan_runs(polys: &[(Vec<[f64; 2]>, bool, bool)], fill: u32, ew: f64, d: [f64; 2], n: [f64; 2], s: f64, out: &mut Vec<(f64, f64)>) {
-    out.clear();
-    for (pts, _closed, inverted) in polys {
-        let m = pts.len();
-        if m < 2 {
-            continue;
-        }
-        // Crossings: (t along d, |sin| of crossing angle).
-        let mut xs: Vec<(f64, f64)> = Vec::new();
-        for i in 0..m {
-            let (a, b) = (pts[i], pts[(i + 1) % m]);
-            let (na, nb) = (a[0] * n[0] + a[1] * n[1] - s, b[0] * n[0] + b[1] * n[1] - s);
-            if (na > 0.0) == (nb > 0.0) {
-                continue;
-            }
-            let t = na / (na - nb);
-            let q = [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t];
-            let (ex, ey) = (b[0] - a[0], b[1] - a[1]);
-            let el = (ex * ex + ey * ey).sqrt().max(1e-9);
-            let sin = ((ex * n[0] + ey * n[1]) / el).abs().max(0.2);
-            xs.push((q[0] * d[0] + q[1] * d[1], sin));
-        }
-        xs.sort_by(|a, b| a.0.total_cmp(&b.0));
-        // Signed area decides which side is "left".
-        let area: f64 = (0..m).map(|i| pts[i][0] * pts[(i + 1) % m][1] - pts[(i + 1) % m][0] * pts[i][1]).sum();
-        let left_is_inside = area < 0.0;
-        let mode = match fill {
-            4 => {
-                if left_is_inside {
-                    2
-                } else {
-                    3
-                }
-            }
-            5 => {
-                if left_is_inside {
-                    3
-                } else {
-                    2
-                }
-            }
-            f => f,
-        };
-        let mode = if *inverted && mode == 0 { 6 } else { mode };
-        for (k, &(t, sin)) in xs.iter().enumerate() {
-            let entering = k % 2 == 0;
-            let l = ew / sin;
-            match mode {
-                0 if entering && k + 1 < xs.len() => {
-                    out.push((t, xs[k + 1].0));
-                }
-                1 => out.push((t - l * 0.5, t + l * 0.5)),
-                2 => out.push(if entering { (t, t + l) } else { (t - l, t) }),
-                3 => out.push(if entering { (t - l, t) } else { (t, t + l) }),
-                _ => {}
-            }
-        }
-        if mode == 6 {
-            // Inverted Inside: outside of the polygon within the bounds.
-            let lo = pts.iter().map(|q| q[0] * d[0] + q[1] * d[1]).fold(f64::INFINITY, f64::min) - ew;
-            let hi = pts.iter().map(|q| q[0] * d[0] + q[1] * d[1]).fold(f64::NEG_INFINITY, f64::max) + ew;
-            let mut cur = lo;
-            for pair in xs.chunks(2) {
-                out.push((cur, pair[0].0));
-                cur = pair.get(1).map(|v| v.0).unwrap_or(hi);
-            }
-            out.push((cur, hi));
-        }
-    }
-    out.sort_by(|a, b| a.0.total_cmp(&b.0));
-    // Merge overlaps.
-    let mut merged: Vec<(f64, f64)> = Vec::with_capacity(out.len());
-    for &(a, b) in out.iter() {
-        if let Some(last) = merged.last_mut()
-            && a <= last.1
-        {
-            last.1 = last.1.max(b);
-            continue;
-        }
-        merged.push((a, b));
-    }
-    *out = merged;
-}
-
-/// End Cap and Join options (Scribble's Edge Options).
-const END_CAPS: [&str; 3] = ["Round", "Butt", "Projecting"];
-const JOINS: [&str; 3] = ["Round", "Miter", "Bevel"];
-
-/// Convex polygons whose union is the stroke of the polylines `lines` with half width `r`:
-/// one quad per segment, plus the joins (Round discs, Miter wedges up to `miter_limit` × the
-/// half width, Bevel triangles) and the caps (Round discs, Butt none, Projecting square ends).
-pub(crate) fn stroke_outline(lines: &[Vec<[f64; 2]>], r: f64, cap: u32, join: u32, miter_limit: f64) -> Vec<Vec<[f64; 2]>> {
-    let disc = |c: [f64; 2]| -> Vec<[f64; 2]> {
-        (0..16).map(|k| (k as f64 / 16.0 * std::f64::consts::TAU).sin_cos()).map(|(s, co)| [c[0] + co * r, c[1] + s * r]).collect()
-    };
-    let mut out = Vec::new();
-    for l in lines {
-        let pts: Vec<[f64; 2]> = l.iter().copied().fold(Vec::new(), |mut v, p| {
-            if v.last().is_none_or(|q: &[f64; 2]| (q[0] - p[0]).hypot(q[1] - p[1]) > 1e-9) {
-                v.push(p);
-            }
-            v
-        });
-        if pts.len() < 2 {
-            if let (Some(p), 0) = (pts.first(), cap) {
-                out.push(disc(*p));
-            }
-            continue;
-        }
-        let dir = |a: [f64; 2], b: [f64; 2]| {
-            let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
-            let l = dx.hypot(dy).max(1e-12);
-            [dx / l, dy / l]
-        };
-        let n = pts.len();
-        for k in 0..n - 1 {
-            let (mut a, mut b) = (pts[k], pts[k + 1]);
-            let d = dir(a, b);
-            // Projecting caps extend the end segments by the half width.
-            if cap == 2 && k == 0 {
-                a = [a[0] - d[0] * r, a[1] - d[1] * r];
-            }
-            if cap == 2 && k == n - 2 {
-                b = [b[0] + d[0] * r, b[1] + d[1] * r];
-            }
-            let nn = [-d[1] * r, d[0] * r];
-            out.push(vec![[a[0] + nn[0], a[1] + nn[1]], [b[0] + nn[0], b[1] + nn[1]], [b[0] - nn[0], b[1] - nn[1]], [a[0] - nn[0], a[1] - nn[1]]]);
-        }
-        // Joins.
-        for k in 1..n - 1 {
-            let (p, d0, d1) = (pts[k], dir(pts[k - 1], pts[k]), dir(pts[k], pts[k + 1]));
-            let cross = d0[0] * d1[1] - d0[1] * d1[0];
-            if cross.abs() < 1e-9 && d0[0] * d1[0] + d0[1] * d1[1] > 0.0 {
-                continue;
-            }
-            if join == 0 {
-                out.push(disc(p));
-                continue;
-            }
-            // The outer side of the turn.
-            let s = if cross > 0.0 { -1.0 } else { 1.0 };
-            let o0 = [p[0] - d0[1] * r * s, p[1] + d0[0] * r * s];
-            let o1 = [p[0] - d1[1] * r * s, p[1] + d1[0] * r * s];
-            let bevel = vec![p, o0, o1];
-            if join == 1 {
-                // Miter point: where the two offset edges meet.
-                let bis = [d0[0] - d1[0], d0[1] - d1[1]];
-                let bl = bis[0].hypot(bis[1]);
-                let cos_half = ((1.0 + d0[0] * d1[0] + d0[1] * d1[1]) * 0.5).max(0.0).sqrt();
-                let len = if cos_half > 1e-6 { r / cos_half } else { f64::INFINITY };
-                if bl > 1e-9 && len <= miter_limit * r {
-                    let m = [p[0] + (o0[0] + o1[0] - 2.0 * p[0]) * 0.5, p[1] + (o0[1] + o1[1] - 2.0 * p[1]) * 0.5];
-                    let ml = (m[0] - p[0]).hypot(m[1] - p[1]).max(1e-12);
-                    let tip = [p[0] + (m[0] - p[0]) / ml * len, p[1] + (m[1] - p[1]) / ml * len];
-                    out.push(vec![p, o0, tip, o1]);
-                    continue;
-                }
-            }
-            out.push(bevel);
-        }
-        if cap == 0 {
-            out.push(disc(pts[0]));
-            out.push(disc(pts[n - 1]));
-        }
-    }
-    out
-}
-
-/// Coverage (union, 4×4 samples per pixel) of convex polygons on a `w`×`h` grid.
-pub(crate) fn raster_convex(w: usize, h: usize, polys: &[Vec<[f64; 2]>]) -> Plane {
-    let mut out = Plane::new(w, h);
-    let inside = |poly: &[[f64; 2]], x: f64, y: f64| {
-        let n = poly.len();
-        let mut sign = 0.0;
-        for i in 0..n {
-            let (a, b) = (poly[i], poly[(i + 1) % n]);
-            let c = (b[0] - a[0]) * (y - a[1]) - (b[1] - a[1]) * (x - a[0]);
-            if c.abs() < 1e-12 {
-                continue;
-            }
-            if sign == 0.0 {
-                sign = c.signum();
-            } else if c.signum() != sign {
-                return false;
-            }
-        }
-        true
-    };
-    for poly in polys {
-        if poly.len() < 3 {
-            continue;
-        }
-        let (mut x0, mut y0, mut x1, mut y1) = (f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY);
-        for p in poly {
-            x0 = x0.min(p[0]);
-            y0 = y0.min(p[1]);
-            x1 = x1.max(p[0]);
-            y1 = y1.max(p[1]);
-        }
-        let (xa, xb) = (x0.floor().max(0.0) as usize, (x1.ceil().max(0.0) as usize).min(w));
-        let (ya, yb) = (y0.floor().max(0.0) as usize, (y1.ceil().max(0.0) as usize).min(h));
-        for y in ya..yb {
-            for x in xa..xb {
-                let mut hit = 0;
-                for sy in 0..4 {
-                    for sx in 0..4 {
-                        if inside(poly, x as f64 + (sx as f64 + 0.5) / 4.0, y as f64 + (sy as f64 + 0.5) / 4.0) {
-                            hit += 1;
-                        }
-                    }
-                }
-                let v = &mut out.data[y * w + x];
-                *v = v.max(hit as f32 / 16.0);
-            }
-        }
-    }
-    out
-}
-
-fn scribble(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    match scribble_plan(ctx, &b) {
-        Some(plan) => draw_paint(&mut b, &plan),
-        None if scribble_style(ctx) == 1 => b.img = Image::new(b.img.width, b.img.height),
-        None => {}
-    }
-    b
-}
-
-fn scribble_plan(ctx: &EffectCtx, b: &Buf) -> Option<PaintPlan> {
-    let pr = ctx.params;
-    let which = pr.e("scribble");
-    let polys: Vec<_> = if which == 0 { mask_px(ctx, b, pr.f("mask").round().max(1.0) as usize).into_iter().collect() } else { all_masks_px(ctx, b) };
-    let polys: Vec<_> = polys.into_iter().filter(|p| p.0.len() >= 3).map(|(p, c, i)| (p, c, i && which == 2)).collect();
-    let style = scribble_style(ctx);
-    if polys.is_empty() {
-        return None;
-    }
-    let sc = b.scale;
-    let fill = pr.e("fillType");
-    let ew = pr.f("edgeOptions/edgeWidth").max(0.1) * sc;
-    let ang = pr.f("angle").to_radians();
-    let d = [ang.cos(), ang.sin()];
-    let n = [-d[1], d[0]];
-    let width = (pr.f("strokeWidth") * sc).max(0.1);
-    let curv = pr.f("strokeOptions/curviness") / 100.0;
-    let curv_var = pr.f("strokeOptions/curvinessVariation") / 100.0;
-    let spacing = (pr.f("strokeOptions/spacing") * sc).max(0.75).max(width * 0.25);
-    let spacing_var = pr.f("strokeOptions/spacingVariation") / 100.0;
-    let overlap = pr.f("strokeOptions/pathOverlap") / 100.0;
-    let overlap_var = pr.f("strokeOptions/pathOverlapVariation") / 100.0;
-    let start = pr.f("start").clamp(0.0, 100.0) / 100.0;
-    let end = pr.f("end").clamp(0.0, 100.0) / 100.0;
-    let sequential = pr.b("fillPathsSequentially");
-    let wiggle = pr.e("wiggleType");
-    let wps = pr.f("wigglesPerSecond").max(0.0);
-    let seed = pr.f("randomSeed") as i64 as u32 ^ ctx.seed;
-    let (step, frac) = match wiggle {
-        0 => (0u32, 0.0f32),
-        1 => ((ctx.time * wps).floor().max(0.0) as u32, 0.0),
-        _ => {
-            let u = (ctx.time * wps).max(0.0);
-            (u.floor() as u32, smoothstep(0.0, 1.0, u.fract() as f32))
-        }
-    };
-    let rnd = |i: u32, k: u32| {
-        let a = hash1(i, k.wrapping_mul(31).wrapping_add(step.wrapping_mul(7919)), seed) * 2.0 - 1.0;
-        if frac > 0.0 {
-            let c = hash1(i, k.wrapping_mul(31).wrapping_add((step + 1).wrapping_mul(7919)), seed) * 2.0 - 1.0;
-            a + (c - a) * frac
-        } else {
-            a
-        }
-    };
-    let groups: Vec<Vec<(Vec<[f64; 2]>, bool, bool)>> =
-        if which == 0 || sequential { vec![polys.clone()] } else { polys.iter().map(|p| vec![p.clone()]).collect() };
-    // Per group a zig-zag polyline (in buffer px).
-    let mut lines: Vec<Vec<Vec<[f64; 2]>>> = Vec::new();
-    let mut runs = Vec::new();
-    for (gi, g) in groups.iter().enumerate() {
-        let mut nmin = f64::INFINITY;
-        let mut nmax = f64::NEG_INFINITY;
-        for (pts, _, _) in g {
-            for q in pts {
-                let v = q[0] * n[0] + q[1] * n[1];
-                nmin = nmin.min(v);
-                nmax = nmax.max(v);
-            }
-        }
-        nmin -= ew;
-        nmax += ew;
-        // Chains of zig-zags: each run joins the nearest chain that ended on the previous
-        // scan line (so separate regions get separate strokes).
-        let mut chains: Vec<(Vec<[f64; 2]>, u32)> = Vec::new();
-        let mut s = nmin + spacing * 0.5;
-        let mut li = 0u32;
-        let reach = spacing * 3.0 + ew;
-        while s < nmax && li < 20_000 {
-            scan_runs(g, fill, ew, d, n, s, &mut runs);
-            for (ri, &(a, bb)) in runs.iter().enumerate() {
-                let k = (gi as u32) << 20 | ri as u32;
-                let ov = spacing * (overlap + overlap_var * rnd(li, k * 4) as f64 * 0.5).max(-0.45);
-                let ov2 = spacing * (overlap + overlap_var * rnd(li, k * 4 + 1) as f64 * 0.5).max(-0.45);
-                let (a, bb) = (a - ov, bb + ov2);
-                if bb <= a {
-                    continue;
-                }
-                let at = |t: f64| [d[0] * t + n[0] * s, d[1] * t + n[1] * s];
-                let (pa, pb) = (at(a), at(bb));
-                let dist = |p: [f64; 2], q: [f64; 2]| ((p[0] - q[0]).powi(2) + (p[1] - q[1]).powi(2)).sqrt();
-                let best = chains
-                    .iter()
-                    .enumerate()
-                    .filter(|(_, c)| li > 0 && c.1 == li - 1)
-                    .map(|(i, c)| {
-                        let last = *c.0.last().unwrap_or(&pa);
-                        (i, dist(last, pa).min(dist(last, pb)))
-                    })
-                    .filter(|&(_, dd)| dd < reach)
-                    .min_by(|x, y| x.1.total_cmp(&y.1));
-                match best {
-                    Some((ci, _)) => {
-                        let last = *chains[ci].0.last().unwrap_or(&pa);
-                        let (p0, p1, dir) = if dist(last, pa) <= dist(last, pb) { (pa, pb, -1.0) } else { (pb, pa, 1.0) };
-                        // Curved turn: an extra point pushed past the edge.
-                        let c = (curv + curv_var * rnd(li, k * 4 + 2) as f64 * 0.5).max(0.0);
-                        let mid = [(last[0] + p0[0]) * 0.5 + d[0] * dir * c * spacing, (last[1] + p0[1]) * 0.5 + d[1] * dir * c * spacing];
-                        let ch = &mut chains[ci];
-                        ch.0.extend([mid, p0, p1]);
-                        ch.1 = li;
-                    }
-                    None => chains.push((vec![pa, pb], li)),
-                }
-            }
-            s += spacing * (1.0 + spacing_var * rnd(li, 3) as f64 * 0.5).max(0.25);
-            li += 1;
-        }
-        lines.push(chains.into_iter().map(|(z, _)| if curv > 0.0 { chaikin(&z, 2) } else { z }).collect());
-    }
-    let r = width * 0.5;
-    // Start / End Apply To: all of a mask's strokes as one path, or each stroke on its own.
-    let each = pr.e("startEndApplyTo") == 1;
-    let mut parts: Vec<Vec<[f64; 2]>> = Vec::new();
-    for group in &lines {
-        let lens: Vec<f64> = group.iter().map(|l| poly_length(l, false)).collect();
-        let total: f64 = lens.iter().sum();
-        let (g0, g1) = (total * start, total * end);
-        let mut acc = 0.0;
-        for (l, len) in group.iter().zip(lens) {
-            let part =
-                if each { trim_poly(l, false, len * start, len * end) } else { trim_poly(l, false, (g0 - acc).clamp(0.0, len), (g1 - acc).clamp(0.0, len)) };
-            acc += len;
-            parts.push(part);
-        }
-    }
-    let cap = pr.e("edgeOptions/endCap");
-    let join = pr.e("edgeOptions/join");
-    let cov = if cap == 0 && join == 0 {
-        let mut segs = Vec::new();
-        for part in &parts {
-            poly_segs(part, false, r, 1.0, &mut segs);
-        }
-        Coverage::Segs { segs, hardness: 0.9 }
-    } else {
-        Coverage::Convex(stroke_outline(&parts, r, cap, join, pr.f("edgeOptions/miterLimit").max(1.0)))
-    };
-    Some(PaintPlan { cov, color: pr.color("color"), opacity: (pr.f("opacity") / 100.0) as f32, style })
-}
-
-// ---------------------------------------------------------------- Stroke
-
-fn stroke(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let plan = stroke_plan(ctx, &b);
-    draw_paint(&mut b, &plan);
-    b
-}
-
-fn stroke_plan(ctx: &EffectCtx, b: &Buf) -> PaintPlan {
-    let pr = ctx.params;
-    let all = pr.b("allMasks");
-    let polys: Vec<_> = if all { all_masks_px(ctx, b) } else { mask_px(ctx, b, pr.f("path").round() as usize).into_iter().collect() };
-    let style = pr.e("paintStyle");
-    let size = (pr.f("brushSize") * b.scale).max(0.1);
-    let r = size * 0.5;
-    let hard = pr.f("brushHardness") / 100.0;
-    let start = pr.f("start").clamp(0.0, 100.0) / 100.0;
-    let end = pr.f("end").clamp(0.0, 100.0) / 100.0;
-    let spacing = pr.f("spacing") / 100.0;
-    let sequential = pr.b("strokeSequentially");
-    let lens: Vec<f64> = polys.iter().map(|(p, c, _)| poly_length(p, *c)).collect();
-    let total: f64 = lens.iter().sum();
-    let mut segs = Vec::new();
-    let mut acc = 0.0;
-    for ((pts, closed, _), &len) in polys.iter().zip(&lens) {
-        let (s0, s1) = if all && sequential {
-            let (g0, g1) = (total * start, total * end);
-            ((g0 - acc).clamp(0.0, len), (g1 - acc).clamp(0.0, len))
-        } else {
-            (len * start, len * end)
-        };
-        acc += len;
-        if s1 <= s0 {
-            continue;
-        }
-        if spacing <= 0.5 {
-            let part = trim_poly(pts, *closed, s0, s1);
-            poly_segs(&part, false, r, 1.0, &mut segs);
-        } else {
-            let step = (size * spacing).max(0.5);
-            let mut s = s0;
-            while s <= s1 + 1e-9 && segs.len() < 200_000 {
-                let (q, _) = crate::util::poly_point_at(pts, *closed, s);
-                segs.push(Seg { a: q, b: q, r, v: 1.0 });
-                s += step;
-            }
-        }
-    }
-    PaintPlan { cov: Coverage::Segs { segs, hardness: hard }, color: pr.color("color"), opacity: (pr.f("opacity") / 100.0) as f32, style }
-}
-
-// ---------------------------------------------------------------- Vegas
-
-/// Marching-squares iso-contours of `pl` at `thr`, chained into polylines (closed flag).
-fn contours(pl: &Plane, thr: f32) -> Vec<(Vec<[f64; 2]>, bool)> {
-    use std::collections::HashMap;
-    let (w, h) = (pl.w, pl.h);
-    if w < 2 || h < 2 {
-        return Vec::new();
-    }
-    // Edge key: horizontal edge (x,y)-(x+1,y) = 2*(y*w+x), vertical (x,y)-(x,y+1) = 2*(y*w+x)+1.
-    let hk = |x: usize, y: usize| 2 * (y * w + x) as u64;
-    let vk = |x: usize, y: usize| 2 * (y * w + x) as u64 + 1;
-    let mut pos: HashMap<u64, [f64; 2]> = HashMap::new();
-    let mut adj: HashMap<u64, Vec<u64>> = HashMap::new();
-    let v = |x: usize, y: usize| pl.data[y * w + x];
-    let interp = |a: f32, b: f32| if (b - a).abs() > 1e-9 { ((thr - a) / (b - a)).clamp(0.0, 1.0) as f64 } else { 0.5 };
-    for y in 0..h - 1 {
-        for x in 0..w - 1 {
-            let (a, bb, c, d) = (v(x, y), v(x + 1, y), v(x + 1, y + 1), v(x, y + 1));
-            let idx = (a > thr) as u8 | ((bb > thr) as u8) << 1 | ((c > thr) as u8) << 2 | ((d > thr) as u8) << 3;
-            if idx == 0 || idx == 15 {
-                continue;
-            }
-            // Edge points (pixel centres at +0.5).
-            let top = (hk(x, y), [x as f64 + 0.5 + interp(a, bb), y as f64 + 0.5]);
-            let right = (vk(x + 1, y), [x as f64 + 1.5, y as f64 + 0.5 + interp(bb, c)]);
-            let bottom = (hk(x, y + 1), [x as f64 + 0.5 + interp(d, c), y as f64 + 1.5]);
-            let left = (vk(x, y), [x as f64 + 0.5, y as f64 + 0.5 + interp(a, d)]);
-            let pairs: &[(usize, usize)] = match idx {
-                1 | 14 => &[(3, 0)],
-                2 | 13 => &[(0, 1)],
-                3 | 12 => &[(3, 1)],
-                4 | 11 => &[(1, 2)],
-                5 => &[(3, 0), (1, 2)],
-                6 | 9 => &[(0, 2)],
-                7 | 8 => &[(3, 2)],
-                10 => &[(0, 1), (2, 3)],
-                _ => &[],
-            };
-            let e = [top, right, bottom, left];
-            for &(i, j) in pairs {
-                pos.insert(e[i].0, e[i].1);
-                pos.insert(e[j].0, e[j].1);
-                adj.entry(e[i].0).or_default().push(e[j].0);
-                adj.entry(e[j].0).or_default().push(e[i].0);
-            }
-        }
-    }
-    let mut keys: Vec<u64> = adj.keys().copied().collect();
-    keys.sort_unstable();
-    // Start open chains at endpoints (degree 1) first, then closed loops.
-    keys.sort_by_key(|k| adj[k].len() != 1);
-    let mut used: std::collections::HashSet<(u64, u64)> = std::collections::HashSet::new();
-    let mut out = Vec::new();
-    for &k0 in &keys {
-        for &first in &adj[&k0] {
-            if used.contains(&(k0.min(first), k0.max(first))) {
-                continue;
-            }
-            let mut chain = vec![pos[&k0]];
-            let (mut prev, mut cur) = (k0, first);
-            used.insert((prev.min(cur), prev.max(cur)));
-            let mut closed = false;
-            loop {
-                chain.push(pos[&cur]);
-                if cur == k0 {
-                    closed = true;
-                    chain.pop();
-                    break;
-                }
-                let next = adj[&cur].iter().copied().find(|&n| n != prev && !used.contains(&(cur.min(n), cur.max(n))));
-                match next {
-                    Some(n) => {
-                        used.insert((cur.min(n), cur.max(n)));
-                        prev = cur;
-                        cur = n;
-                    }
-                    None => break,
-                }
-            }
-            if chain.len() >= 2 {
-                out.push((chain, closed));
-            }
-        }
-    }
-    out
-}
-
-fn vegas(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let plan = vegas_plan(ctx, &b);
-    draw_paint(&mut b, &plan);
-    b
-}
-
-fn vegas_plan(ctx: &EffectCtx, b: &Buf) -> PaintPlan {
-    let pr = ctx.params;
-    let (w, h) = (b.img.width as usize, b.img.height as usize);
-    let sc = b.scale;
-    let paths: Vec<(Vec<[f64; 2]>, bool)> = if pr.e("stroke") == 1 {
-        mask_px(ctx, b, pr.f("path").round() as usize).map(|(p, c, _)| vec![(p, c)]).unwrap_or_default()
-    } else {
-        let src = layer_or_self(ctx, b, "inputLayer", true, pr.e("ifLayerSizesDiffer") == 1);
-        let ch = pr.e("channel");
-        let inv = pr.b("invertInput");
-        let mut pl = Plane::from_image(&src, |px| {
-            let (c, a) = unpremul(px);
-            let v = match ch {
-                1 => c[0],
-                2 => c[1],
-                3 => c[2],
-                4 => a,
-                _ => luminance(c[0], c[1], c[2]) * a,
-            };
-            if inv { 1.0 - v } else { v }
-        });
-        let blur = pr.f("preBlur") * sc;
-        if blur > 0.05 {
-            pl = gauss_plane(&pl, blur, blur);
-        }
-        let mut cs = contours(&pl, (pr.f("threshold") / 100.0) as f32);
-        // Simplify by tolerance (drop points closer than tol × size).
-        let tol = pr.f("tolerance").max(0.0) * (w.max(h) as f64) * 0.1;
-        if tol > 0.0 {
-            for (c, _) in cs.iter_mut() {
-                let mut keep: Vec<[f64; 2]> = Vec::with_capacity(c.len());
-                for &q in c.iter() {
-                    if keep.last().is_none_or(|l: &[f64; 2]| ((l[0] - q[0]).powi(2) + (l[1] - q[1]).powi(2)).sqrt() >= tol) {
-                        keep.push(q);
-                    }
-                }
-                *c = keep;
-            }
-        }
-        cs.sort_by(|a, b| poly_length(&b.0, b.1).total_cmp(&poly_length(&a.0, a.1)));
-        if pr.e("renderMode") == 1 {
-            let sel = (pr.f("selectedContour").round().max(1.0) as usize) - 1;
-            cs.into_iter().skip(sel).take(1).collect()
-        } else {
-            cs
-        }
-    };
-    let nseg = pr.f("segments").round().clamp(1.0, 1000.0) as usize;
-    // Shorter Contours Have Fewer Segments: segment count scales with contour length.
-    let fewer = pr.e("stroke") == 0 && pr.e("shorterContoursHave") == 1;
-    let longest = paths.iter().map(|(p, c)| poly_length(p, *c)).fold(0.0, f64::max);
-    let seg_len = pr.f("length").clamp(0.0, 1.0);
-    let bunched = pr.e("segmentDistribution") == 0;
-    let rot = pr.f("rotation") / 360.0;
-    let random_phase = pr.b("randomPhase");
-    let seed = pr.f("randomSeed") as i64 as u32 ^ ctx.seed;
-    let width = (pr.f("width") * sc).max(0.1);
-    let hard = pr.f("hardness").clamp(0.0, 1.0);
-    let (o0, om, o1, mp) = (pr.f("startOpacity") as f32, pr.f("midpointOpacity") as f32, pr.f("endOpacity") as f32, pr.f("midpointPosition").clamp(0.01, 0.99));
-    let mut segs = Vec::new();
-    for (ci, (pts, closed)) in paths.iter().enumerate() {
-        let len = poly_length(pts, *closed);
-        if len <= 0.0 {
-            continue;
-        }
-        let phase = rot + if random_phase { hash1(ci as u32, 1, seed) as f64 } else { 0.0 };
-        let nseg = if fewer && longest > 0.0 { ((nseg as f64 * len / longest).round() as usize).max(1) } else { nseg };
-        let each = len / nseg as f64 * seg_len;
-        for i in 0..nseg {
-            let base = if bunched { (i as f64 + (hash1(ci as u32, i as u32 + 7, seed) as f64 - 0.5) * 0.8) / nseg as f64 } else { i as f64 / nseg as f64 };
-            let s0 = (base + phase).rem_euclid(1.0) * len;
-            // Sub-sample the segment so opacity can ramp along it.
-            let sub = 12usize;
-            let mut prev: Option<[f64; 2]> = None;
-            for k in 0..=sub {
-                let f = k as f64 / sub as f64;
-                let mut s = s0 + each * f;
-                if *closed {
-                    s = s.rem_euclid(len);
-                } else if s > len {
-                    break;
-                }
-                let (q, _) = crate::util::poly_point_at(pts, *closed, s);
-                let op = if f < mp { o0 + (om - o0) * (f / mp) as f32 } else { om + (o1 - om) * ((f - mp) / (1.0 - mp)) as f32 };
-                if let Some(pv) = prev
-                    && ((pv[0] - q[0]).powi(2) + (pv[1] - q[1]).powi(2)) < (each * 0.5).powi(2) + 4.0
-                {
-                    segs.push(Seg { a: pv, b: q, r: width * 0.5, v: op.clamp(0.0, 1.0) });
-                }
-                prev = Some(q);
-            }
-        }
-    }
-    let style = match pr.e("blendMode") {
-        1 => 0,
-        2 => 3,
-        3 => 2,
-        _ => 1,
-    };
-    PaintPlan { cov: Coverage::Segs { segs, hardness: hard }, color: pr.color("color"), opacity: 1.0, style }
-}
-
-// ---------------------------------------------------------------- Write-on / Glue Gun
-
-/// Write-on draws a stroke along the animated Brush Position, as in After Effects: a dab every
-/// Brush Spacing seconds from the layer's start up to now, each one lasting Stroke Length
-/// seconds (0: for ever). The dabs' positions come from the host's parameters at their times;
-/// with Paint Time Properties ▸ Opacity or Brush Time Properties ▸ Size each dab keeps its own
-/// opacity or size, else the current ones apply to every dab. (Colour and hardness are one per
-/// stroke: the current ones.) Without a host (or dabs) the current dab draws. Deterministic.
-fn write_on(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let plan = write_on_plan(ctx, &b);
-    draw_paint(&mut b, &plan);
-    b
-}
-
-/// The most dabs one Write-on frame draws; longer strokes lay them further apart, joined.
-const WRITE_ON_MAX_DABS: i64 = 4096;
-
-fn write_on_plan(ctx: &EffectCtx, b: &Buf) -> PaintPlan {
-    let pr = ctx.params;
-    let own_opacity = pr.e("paintTimeProperties") == 1;
-    let own_size = matches!(pr.e("brushTimeProperties"), 1 | 3);
-    let opacity = |p: &Params| (p.f("brushOpacity") / 100.0).clamp(0.0, 1.0) as f32;
-    let radius = |p: &Params| (p.f("brushSize") * b.scale * 0.5).max(0.05);
-    let dab = |p: &Params| {
-        let q = b.to_px(p.v2("brushPosition"));
-        ([q.0, q.1], radius(if own_size { p } else { pr }), if own_opacity { opacity(p) } else { 1.0 })
-    };
-    let mut segs = vec![];
-    let t = ctx.time;
-    let spacing = pr.f("brushSpacing").max(0.001);
-    let life = pr.f("strokeLength").max(0.0);
-    if let Some(host) = ctx.env.host
-        && t.is_finite()
-        && t >= 0.0
-    {
-        let start = if life > 0.0 { (t - life).max(0.0) } else { 0.0 };
-        let k0 = (start / spacing - 1e-9).ceil().max(0.0) as i64;
-        let k1 = (t / spacing + 1e-9).floor().max(0.0) as i64;
-        let n = k1.saturating_sub(k0).saturating_add(1);
-        let stride = (n / WRITE_ON_MAX_DABS).saturating_add(1).max(1);
-        let mut prev: Option<[f64; 2]> = None;
-        let mut k = k0;
-        while k <= k1 {
-            let tk = k as f64 * spacing;
-            let at = if (tk - t).abs() < 1e-9 { Some(dab(pr)) } else { host.params_at(tk).map(|p| dab(&p)) };
-            if let Some((q, r, v)) = at {
-                // Dabs laid further apart than the brush spacing are joined into a line.
-                let a = if stride > 1 { prev.unwrap_or(q) } else { q };
-                segs.push(Seg { a, b: q, r, v });
-                prev = Some(q);
-            }
-            k = k.saturating_add(stride);
-        }
-    }
-    if segs.is_empty() {
-        let (q, r, v) = dab(pr);
-        segs.push(Seg { a: q, b: q, r, v });
-    }
-    PaintPlan {
-        cov: Coverage::Segs { segs, hardness: pr.f("brushHardness") / 100.0 },
-        color: pr.color("color"),
-        opacity: if own_opacity { 1.0 } else { opacity(pr) },
-        style: pr.e("paintStyle"),
-    }
-}
-
-fn glue_gun(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let q = b.to_px(pr.v2("brushPosition"));
-    let rad = (pr.f("strokeWidth") * b.scale * 0.5).max(0.5);
-    let density = pr.f("density").max(0.0);
-    let refl = pr.f("reflection").to_radians();
-    let strength = (pr.f("strength") / 100.0) as f32;
-    let glue_only = pr.e("style") == 1;
-    let src = b.img.clone();
-    let light = [refl.cos() * 0.6, -refl.sin() * 0.6, 0.53];
-    let beads = (density.round() as usize).clamp(1, 32);
-    let seed = ctx.seed;
-    let centers: Vec<([f64; 2], f64)> = (0..beads)
-        .map(|i| {
-            let a = hash1(i as u32, 1, seed) as f64 * 2.0 * PI;
-            let d = if i == 0 { 0.0 } else { hash1(i as u32, 2, seed) as f64 * rad * 0.35 };
-            ([q.0 + a.cos() * d, q.1 + a.sin() * d], rad * (0.75 + 0.25 * hash1(i as u32, 3, seed) as f64))
-        })
-        .collect();
-    b.img.rows_mut().for_each(|(y, row)| {
-        for (x, px) in row.iter_mut().enumerate() {
-            let (fx, fy) = (x as f64 + 0.5, y as f64 + 0.5);
-            // Height field: union of hemispheres.
-            let mut best = (0.0f64, [0.0f64; 2], 1.0f64);
-            for &(c, r) in &centers {
-                let (dx, dy) = ((fx - c[0]) / r, (fy - c[1]) / r);
-                let d2 = dx * dx + dy * dy;
-                if d2 < 1.0 {
-                    let hgt = (1.0 - d2).sqrt();
-                    if hgt > best.0 {
-                        best = (hgt, [dx, dy], r);
-                    }
-                }
-            }
-            if best.0 <= 0.0 {
-                if glue_only {
-                    *px = [0.0; 4];
-                }
-                continue;
-            }
-            let nrm = [best.1[0], best.1[1], best.0];
-            let ndl = (nrm[0] * light[0] + nrm[1] * light[1] + nrm[2] * light[2]).max(0.0);
-            let spec = ndl.powi(24) as f32;
-            // Refraction: look through the bead.
-            let s = src.sample_bilinear_clamped(fx - nrm[0] * best.2 * 0.5 * strength as f64, fy - nrm[1] * best.2 * 0.5 * strength as f64);
-            let edge = smoothstep(0.0, 0.15, best.0 as f32);
-            let shade = 0.65 + 0.35 * ndl as f32;
-            let g = [s[0] * shade + spec, s[1] * shade + spec, s[2] * shade + spec, s[3].max(0.6)];
-            let gp = [g[0].min(g[3] + spec), g[1].min(g[3] + spec), g[2].min(g[3] + spec), g[3].min(1.0)];
-            let base = if glue_only { [0.0; 4] } else { *px };
-            *px = crate::util::lerp4(base, gp, edge * strength.clamp(0.0, 1.0).max(0.3));
-            px[3] = px[3].clamp(0.0, 1.0);
-        }
-    });
-    b
-}
-
-// ---------------------------------------------------------------- Paint Bucket
-
-/// Paint Bucket's filled region (1 inside) on `b`: the flood fill from the Fill Point over the
-/// layer's pixels (shared with the GPU compositor, which reads the layer back for it).
-pub fn paint_bucket_region(ctx: &EffectCtx, b: &Buf) -> Plane {
-    let pr = ctx.params;
-    let (w, h) = (b.img.width as usize, b.img.height as usize);
-    let fp = b.to_px(pr.v2("fillPoint"));
-    let (sx, sy) = (fp.0.floor() as i64, fp.1.floor() as i64);
-    let sel = pr.e("fillSelector");
-    let tol = (pr.f("tolerance") / 255.0) as f32;
-    let key = |p: Px| -> [f32; 4] {
-        let (c, a) = unpremul(p);
-        match sel {
-            1 => [c[0], c[1], c[2], 0.0],
-            2 => [0.0, 0.0, 0.0, if a <= 1e-3 { 0.0 } else { 1.0 }],
-            3 | 4 => [0.0, 0.0, 0.0, a],
-            _ => p,
-        }
-    };
-    let mut region = Plane::new(w, h);
-    if sx >= 0 && sy >= 0 && (sx as usize) < w && (sy as usize) < h {
-        let seed = key(b.img.data[sy as usize * w + sx as usize]);
-        let within = |i: usize| {
-            let k = key(b.img.data[i]);
-            if sel == 2 {
-                return k[3] == seed[3];
-            }
-            (0..4).all(|j| (k[j] - seed[j]).abs() <= tol + 1e-6)
-        };
-        let mut seen = vec![false; w * h];
-        let mut stack = vec![(sx as usize, sy as usize)];
-        while let Some((x, y)) = stack.pop() {
-            let row = y * w;
-            if seen[row + x] || !within(row + x) {
-                continue;
-            }
-            let mut l = x;
-            while l > 0 && !seen[row + l - 1] && within(row + l - 1) {
-                l -= 1;
-            }
-            let mut r = x;
-            while r + 1 < w && !seen[row + r + 1] && within(row + r + 1) {
-                r += 1;
-            }
-            for i in l..=r {
-                seen[row + i] = true;
-                region.data[row + i] = 1.0;
-                if y > 0 && !seen[row - w + i] {
-                    stack.push((i, y - 1));
-                }
-                if y + 1 < h && !seen[row + w + i] {
-                    stack.push((i, y + 1));
-                }
-            }
-        }
-    }
-    region
-}
-
-fn paint_bucket(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let (w, h) = (b.img.width as usize, b.img.height as usize);
-    if w == 0 || h == 0 {
-        return b;
-    }
-    let region = paint_bucket_region(ctx, &b);
-    if pr.b("viewThreshold") {
-        b.img.data.par_iter_mut().zip(region.data.par_iter()).for_each(|(px, &v)| *px = [v, v, v, 1.0]);
-        return b;
-    }
-    let sc = b.scale;
-    let mut cov = match pr.e("stroke") {
-        1 => {
-            let s = pr.f("featherSoftness") * sc * 0.5;
-            if s > 0.05 { gauss_plane(&region, s, s) } else { region.clone() }
-        }
-        2 => morph_frac(&region, pr.f("spreadRadius") * sc, true),
-        3 => morph_frac(&region, pr.f("spreadRadius") * sc, false),
-        4 => {
-            let r = pr.f("strokeWidth") * sc;
-            let out = morph_frac(&region, r * 0.5, true);
-            let inn = morph_frac(&region, r * 0.5, false);
-            out.zip_map(&inn, |a, b| (a - b).max(0.0))
-        }
-        _ => gauss_plane(&region, 0.5, 0.5),
-    };
-    if pr.e("stroke") == 0 {
-        // Antialias: keep the hard interior, soften only the boundary.
-        cov = cov.zip_map(&region, |a, r| if r > 0.0 { a.max(0.5) } else { a });
-    }
-    let color = pr.color("color");
-    let op = (pr.f("opacity") / 100.0) as f32;
-    let mode = pr.e("blendingMode");
-    b.img.data.par_iter_mut().zip(cov.data.par_iter()).for_each(|(px, &c)| {
-        let k = (c * op * color[3]).clamp(0.0, 1.0);
-        if k <= 0.0 {
-            if mode == 9 {
-                *px = [0.0; 4];
-            }
-            return;
-        }
-        let (dc, da) = unpremul(*px);
-        let fc = [color[0], color[1], color[2]];
-        let mixed = match mode {
-            1 => [dc[0] + fc[0], dc[1] + fc[1], dc[2] + fc[2]],
-            2 => [dc[0] * fc[0], dc[1] * fc[1], dc[2] * fc[2]],
-            3 => [1.0 - (1.0 - dc[0]) * (1.0 - fc[0]), 1.0 - (1.0 - dc[1]) * (1.0 - fc[1]), 1.0 - (1.0 - dc[2]) * (1.0 - fc[2])],
-            4..=7 => {
-                let (dh, ds, dl) = rgb_to_hsl(dc[0], dc[1], dc[2]);
-                let (fh, fs, fl) = rgb_to_hsl(fc[0], fc[1], fc[2]);
-                let (r, g, bl) = match mode {
-                    4 => hsl_to_rgb(fh, ds, dl),
-                    5 => hsl_to_rgb(dh, fs, dl),
-                    6 => hsl_to_rgb(fh, fs, dl),
-                    _ => hsl_to_rgb(dh, ds, fl),
-                };
-                [r, g, bl]
-            }
-            _ => fc,
-        };
-        *px = match mode {
-            8 => over(premul(fc, k), *px),
-            9 => premul(fc, k),
-            0 => over(*px, premul(fc, k)),
-            _ => {
-                if da <= 1e-6 {
-                    return;
-                }
-                let c3 = crate::util::lerp3(dc, mixed, k);
-                premul(c3, da)
-            }
-        };
-    });
-    b
-}
-
-// ---------------------------------------------------------------- Eyedropper Fill
-
-fn eyedropper_fill(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let fill = eyedropper_color(ctx, &b);
-    let keep_alpha = pr.b("maintainOriginalAlpha");
-    let blend = (pr.f("blendWithOriginal") / 100.0) as f32;
-    b.img.data.par_iter_mut().for_each(|px| {
-        let a = if keep_alpha { px[3] } else { fill[3] };
-        let f = premul([fill[0], fill[1], fill[2]], a);
-        *px = crate::util::lerp4(f, *px, blend);
-    });
-    b
-}
-
-/// Eyedropper Fill's sampled colour (straight RGB, alpha) from the layer's pixels (shared with
-/// the GPU compositor, which reads the layer back for it).
-pub fn eyedropper_color(ctx: &EffectCtx, b: &Buf) -> Px {
-    let pr = ctx.params;
-    let (w, h) = (b.img.width as i64, b.img.height as i64);
-    let c = b.to_px(pr.v2("samplePoint"));
-    let r = (pr.f("sampleRadius") * b.scale).max(0.0);
-    let mode = pr.e("averagePixelColors");
-    let (cx, cy) = (c.0.floor() as i64, c.1.floor() as i64);
-    let ri = r.ceil() as i64;
-    let mut acc = [0.0f64; 4];
-    let mut n = 0.0f64;
-    for y in (cy - ri).max(0)..=(cy + ri).min(h - 1) {
-        for x in (cx - ri).max(0)..=(cx + ri).min(w - 1) {
-            if ((x - cx).pow(2) + (y - cy).pow(2)) as f64 > r * r + 0.5 {
-                continue;
-            }
-            let px = b.img.data[(y * w + x) as usize];
-            match mode {
-                0 => {
-                    if px[3] > 1e-4 {
-                        let (s, _) = unpremul(px);
-                        for k in 0..3 {
-                            acc[k] += s[k] as f64;
-                        }
-                        acc[3] += 1.0;
-                        n += 1.0;
-                    }
-                }
-                1 => {
-                    let (s, _) = unpremul(px);
-                    for k in 0..3 {
-                        acc[k] += s[k] as f64;
-                    }
-                    acc[3] += 1.0;
-                    n += 1.0;
-                }
-                2 => {
-                    for k in 0..3 {
-                        acc[k] += px[k] as f64;
-                    }
-                    acc[3] += 1.0;
-                    n += 1.0;
-                }
-                _ => {
-                    for k in 0..4 {
-                        acc[k] += px[k] as f64;
-                    }
-                    n += 1.0;
-                }
-            }
-        }
-    }
-    if n > 0.0 {
-        if mode == 3 {
-            let a = (acc[3] / n) as f32;
-            let s = if a > 1e-6 { [(acc[0] / n) as f32 / a, (acc[1] / n) as f32 / a, (acc[2] / n) as f32 / a] } else { [0.0; 3] };
-            [s[0], s[1], s[2], a]
-        } else {
-            [(acc[0] / n) as f32, (acc[1] / n) as f32, (acc[2] / n) as f32, 1.0]
-        }
-    } else {
-        [0.0, 0.0, 0.0, 0.0]
-    }
-}
-
-// ---------------------------------------------------------------- CC Threads
-
-fn threads(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let sc = b.scale;
-    let tw = (pr.f("width") * sc).max(1.0);
-    let th = (pr.f("height") * sc).max(1.0);
-    let overlaps = pr.f("overlaps").round().clamp(1.0, 20.0) as i64;
-    let ang = pr.f("direction").to_radians();
-    let (sn, cs) = ang.sin_cos();
-    let c = b.to_px(pr.v2("center"));
-    let coverage = (pr.f("coverage") / 100.0).clamp(0.0, 1.0);
-    let shadow = (pr.f("shadowing") / 100.0) as f32;
-    let texture = (pr.f("texture") / 100.0) as f32;
-    let src = b.img.clone();
-    let to_px = |u: f64, v: f64| (c.0 + u * cs - v * sn, c.1 + u * sn + v * cs);
-    b.img.rows_mut().for_each(|(y, row)| {
-        for (x, px) in row.iter_mut().enumerate() {
-            let (dx, dy) = (x as f64 + 0.5 - c.0, y as f64 + 0.5 - c.1);
-            let u = dx * cs + dy * sn;
-            let v = -dx * sn + dy * cs;
-            let (ci, cj) = ((u / tw).floor() as i64, (v / th).floor() as i64);
-            let (fu, fv) = (u / tw - ci as f64, v / th - cj as f64);
-            // Horizontal thread j occupies the band |fv-0.5| < coverage/2; vertical thread i the
-            // band |fu-0.5| < coverage/2.
-            let in_h = (fv - 0.5).abs() < coverage * 0.5;
-            let in_v = (fu - 0.5).abs() < coverage * 0.5;
-            // Twill: horizontal is on top when (i + j) mod (2·overlaps) < overlaps.
-            let h_top = (ci + cj).rem_euclid(2 * overlaps) < overlaps;
-            let which = match (in_h, in_v) {
-                (true, true) => Some(h_top),
-                (true, false) => Some(true),
-                (false, true) => Some(false),
-                _ => None,
-            };
-            let Some(horizontal) = which else {
-                *px = [0.0; 4];
-                continue;
-            };
-            // Thread colour: the source sampled along the thread centre line.
-            let (sx, sy) = if horizontal { to_px(u, (cj as f64 + 0.5) * th) } else { to_px((ci as f64 + 0.5) * tw, v) };
-            let s = src.sample_bilinear_clamped(sx, sy);
-            // Round profile across the thread + darkening where it dives under its neighbour.
-            let across = if horizontal { (fv - 0.5) / (coverage * 0.5).max(1e-6) } else { (fu - 0.5) / (coverage * 0.5).max(1e-6) };
-            let along = if horizontal { fu } else { fv };
-            let profile = (1.0 - across * across).max(0.0).sqrt() as f32;
-            let dive = 1.0 - (along - 0.5).abs() as f32 * 2.0;
-            let shade = 1.0 - shadow * (1.0 - profile) * 0.8 - shadow * 0.25 * (1.0 - dive) * if horizontal == h_top { 0.0 } else { 1.0 };
-            let fib =
-                if texture > 0.0 { 1.0 - texture * 0.3 * hash1((along * 64.0) as u32, (across * 8.0 + 8.0) as u32, ci as u32 ^ (cj as u32) << 8) } else { 1.0 };
-            let k = (shade * fib).max(0.0);
-            *px = [s[0] * k, s[1] * k, s[2] * k, s[3]];
-        }
-    });
-    b
-}
-
-// ---------------------------------------------------------------- Audio Spectrum / Waveform
-
-/// In-place iterative radix-2 FFT (`re`, `im` lengths a power of two).
-pub(crate) fn fft(re: &mut [f64], im: &mut [f64]) {
-    let n = re.len();
-    if n < 2 {
-        return;
-    }
-    let mut j = 0;
-    for i in 1..n {
-        let mut bit = n >> 1;
-        while j & bit != 0 {
-            j ^= bit;
-            bit >>= 1;
-        }
-        j |= bit;
-        if i < j {
-            re.swap(i, j);
-            im.swap(i, j);
-        }
-    }
-    let mut len = 2;
-    while len <= n {
-        let ang = -2.0 * PI / len as f64;
-        let (ws, wc) = ang.sin_cos();
-        for start in (0..n).step_by(len) {
-            let (mut cr, mut ci) = (1.0, 0.0);
-            for k in 0..len / 2 {
-                let (a, bb) = (start + k, start + k + len / 2);
-                let tr = re[bb] * cr - im[bb] * ci;
-                let ti = re[bb] * ci + im[bb] * cr;
-                re[bb] = re[a] - tr;
-                im[bb] = im[a] - ti;
-                re[a] += tr;
-                im[a] += ti;
-                let ncr = cr * wc - ci * ws;
-                ci = cr * ws + ci * wc;
-                cr = ncr;
-            }
-        }
-        len <<= 1;
-    }
-}
-
-const AUDIO_RATE: u32 = 48_000;
-
-/// Fetch mono (or one channel) samples of the audio layer around the current time.
-fn audio_window(ctx: &EffectCtx, dur_ms: f64, offset_ms: f64, channel: u32) -> Option<Vec<f64>> {
-    let id = ctx.params.get("audioLayer")?.as_layer()?;
-    let host = ctx.env.host?;
-    let dur = (dur_ms / 1000.0).max(0.001);
-    let frames = ((dur * AUDIO_RATE as f64) as usize).clamp(16, 1 << 16);
-    let start = ctx.env.comp_time + offset_ms / 1000.0 - dur * 0.5;
-    let s = host.audio(id, start, frames, AUDIO_RATE)?;
-    Some(
-        (0..frames)
-            .map(|i| {
-                let (l, r) = (*s.get(2 * i).unwrap_or(&0.0) as f64, *s.get(2 * i + 1).unwrap_or(&0.0) as f64);
-                match channel {
-                    1 => l,
-                    2 => r,
-                    _ => (l + r) * 0.5,
-                }
-            })
-            .collect(),
-    )
-}
-
-/// The drawing baseline: a polyline in buffer px (mask path or start→end line), sampled at
-/// parameter u∈[0,1] → (point, unit normal).
-struct Baseline {
-    pts: Vec<[f64; 2]>,
-    closed: bool,
-    len: f64,
-    polar: bool,
-    center: [f64; 2],
-    radius: f64,
-}
-
-impl Baseline {
-    fn new(ctx: &EffectCtx, b: &Buf) -> Baseline {
-        let pr = ctx.params;
-        let polar = pr.b("usePolarPath");
-        let (pts, closed) = match mask_px(ctx, b, pr.f("path").round() as usize) {
-            Some((p, c, _)) if !polar => (p, c),
-            _ => {
-                let s = b.to_px(pr.v2("startPoint"));
-                let e = b.to_px(pr.v2("endPoint"));
-                (vec![[s.0, s.1], [e.0, e.1]], false)
-            }
-        };
-        let len = poly_length(&pts, closed);
-        let center = pts[0];
-        let radius = if pts.len() > 1 { ((pts[1][0] - pts[0][0]).powi(2) + (pts[1][1] - pts[0][1]).powi(2)).sqrt() } else { 1.0 };
-        Baseline { pts, closed, len, polar, center, radius }
-    }
-    fn at(&self, u: f64) -> ([f64; 2], [f64; 2]) {
-        if self.polar {
-            let a = u * 2.0 * PI - PI * 0.5;
-            let (s, c) = a.sin_cos();
-            return ([self.center[0] + c * self.radius * 0.5, self.center[1] + s * self.radius * 0.5], [c, s]);
-        }
-        let (q, d) = crate::util::poly_point_at(&self.pts, self.closed, u * self.len);
-        (q, [d[1], -d[0]])
-    }
-}
-
-/// Draw line/dot marks with core (inside colour) and soft halo (outside colour).
-fn draw_marks(b: &mut Buf, segs_core: &[Seg], thickness: f64, softness: f64, inside: [f32; 4], outside: [f32; 4], composite: bool) {
-    let (w, h) = (b.img.width as usize, b.img.height as usize);
-    let core = raster_segs(w, h, segs_core, 1.0);
-    let halo_segs: Vec<Seg> = segs_core.iter().map(|s| Seg { r: s.r + thickness * softness.max(0.0) + 0.5, ..*s }).collect();
-    let halo = if softness > 0.0 { raster_segs(w, h, &halo_segs, 0.0) } else { core.clone() };
-    b.img.data.par_iter_mut().enumerate().for_each(|(i, px)| {
-        let (c, hl) = (core.data[i], halo.data[i]);
-        let a = c.max(hl);
-        let base = if composite { *px } else { [0.0; 4] };
-        if a <= 0.0 {
-            *px = base;
-            return;
-        }
-        let t = if a > 0.0 { c / a } else { 0.0 };
-        let col = crate::util::lerp3([outside[0], outside[1], outside[2]], [inside[0], inside[1], inside[2]], t);
-        *px = over(base, premul(col, a));
-    });
-}
-
-/// Audio Spectrum / Audio Waveform, shared with the GPU compositor (effectcraft-gpu `fx_gen2`):
-/// the marks (the audio analysis runs on the CPU) and how [`draw_marks`] colours them.
-#[derive(Clone, Debug)]
-pub struct MarksPlan {
-    pub segs: Vec<Seg>,
-    pub thickness: f64,
-    pub softness: f64,
-    pub inside: [f32; 4],
-    pub outside: [f32; 4],
-    pub composite: bool,
-}
-
-/// [`MarksPlan`] of Audio Spectrum or Audio Waveform on `b`'s geometry (`None` = no audio:
-/// the layer passes through).
-pub fn marks_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<MarksPlan> {
-    match id {
-        "ec.generate.audiospectrum" => spectrum_plan(ctx, b),
-        "ec.generate.audiowaveform" => waveform_plan(ctx, b),
-        _ => None,
-    }
-}
-
-fn marks(ctx: &EffectCtx, segs: Vec<Seg>, thick: f64, soft: f64) -> MarksPlan {
-    let pr = ctx.params;
-    MarksPlan {
-        segs,
-        thickness: thick,
-        softness: soft * 2.0,
-        inside: pr.color("insideColor"),
-        outside: pr.color("outsideColor"),
-        composite: pr.b("compositeOnOriginal"),
-    }
-}
-
-fn audio_spectrum(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    if let Some(m) = spectrum_plan(ctx, &b) {
-        draw_marks(&mut b, &m.segs, m.thickness, m.softness, m.inside, m.outside, m.composite);
-    }
-    b
-}
-
-fn audio_waveform(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    if let Some(m) = waveform_plan(ctx, &b) {
-        draw_marks(&mut b, &m.segs, m.thickness, m.softness, m.inside, m.outside, m.composite);
-    }
-    b
-}
-
-fn compute_fft_mags(samples: &[f64]) -> (usize, f64, Vec<f64>) {
-    let m = samples.len();
-    let n = m.next_power_of_two().max(64);
-    let mut re = vec![0.0; n];
-    let mut im = vec![0.0; n];
-    let denom = (m.max(2) - 1) as f64;
-    for (i, s) in samples.iter().enumerate() {
-        let w = 0.5 - 0.5 * (2.0 * PI * i as f64 / denom).cos();
-        if let Some(r) = re.get_mut(i) {
-            *r = s * w;
-        }
-    }
-    fft(&mut re, &mut im);
-    let hz_per_bin = AUDIO_RATE as f64 / n as f64;
-    let scale = 4.0 / m.max(1) as f64;
-    let num_bins = n / 2 + 1;
-    let mut mags = Vec::with_capacity(num_bins);
-    for k in 0..num_bins {
-        let r = re.get(k).copied().unwrap_or(0.0);
-        let im_val = im.get(k).copied().unwrap_or(0.0);
-        let mag = (r * r + im_val * im_val).sqrt() * scale;
-        mags.push(mag);
-    }
-    (n, hz_per_bin, mags)
-}
-
-fn spectrum_plan(ctx: &EffectCtx, b: &Buf) -> Option<MarksPlan> {
-    let pr = ctx.params;
-    let samples = audio_window(ctx, pr.f("audioDuration"), pr.f("audioOffset"), 0)?;
-    let (_n, hz_per_bin, mags) = compute_fft_mags(&samples);
-
-    let bands = pr.f("frequencyBands").round().clamp(1.0, 4096.0) as usize;
-    let f0 = pr.f("startFrequency").max(0.0);
-    let f1 = pr.f("endFrequency").max(f0 + 1.0);
-    let max_bin = mags.len().saturating_sub(1);
-
-    let get_band_mag = |fc: f64| -> f64 {
-        if mags.is_empty() || hz_per_bin <= 0.0 {
-            return 0.0;
-        }
-        let k_float = (fc / hz_per_bin).clamp(0.0, max_bin as f64);
-        let k0 = (k_float.floor() as usize).min(max_bin.saturating_sub(1));
-        let k1 = (k0 + 1).min(max_bin);
-        let frac = (k_float - k0 as f64).clamp(0.0, 1.0);
-        let m0 = mags.get(k0).copied().unwrap_or(0.0);
-        let m1 = mags.get(k1).copied().unwrap_or(0.0);
-        m0 * (1.0 - frac) + m1 * frac
-    };
-
-    let max_h = pr.f("maximumHeight") * b.scale;
-    let thick = (pr.f("thickness") * b.scale).max(0.1);
-    let soft = pr.f("softness") / 100.0;
-    let disp = pr.e("displayOptions");
-    let side = pr.e("sideOptions");
-    let base = Baseline::new(ctx, b);
-    let mut tops = Vec::with_capacity(bands);
-    let mut segs = Vec::new();
-    for i in 0..bands {
-        let u = if bands > 1 { i as f64 / (bands - 1) as f64 } else { 0.5 };
-        let fc = f0 + (f1 - f0) * u;
-        let v = get_band_mag(fc);
-        let hgt = if (v * max_h).is_finite() { (v * max_h).clamp(0.0, max_h.max(0.0)) } else { 0.0 };
-        let (q, nrm) = base.at(u);
-        let (ua, ub) = match side {
-            0 => (0.0, hgt),
-            1 => (-hgt, 0.0),
-            _ => (-hgt, hgt),
-        };
-        let pa = [q[0] + nrm[0] * ua, q[1] + nrm[1] * ua];
-        let pb = [q[0] + nrm[0] * ub, q[1] + nrm[1] * ub];
-        match disp {
-            0 => segs.push(Seg { a: pa, b: pb, r: thick * 0.5, v: 1.0 }),
-            _ => tops.push((pa, pb)),
-        }
-    }
-    if disp == 1 {
-        for w2 in tops.windows(2) {
-            segs.push(Seg { a: w2[0].1, b: w2[1].1, r: thick * 0.5, v: 1.0 });
-            if side == 2 {
-                segs.push(Seg { a: w2[0].0, b: w2[1].0, r: thick * 0.5, v: 1.0 });
-            }
-        }
-    } else if disp == 2 {
-        for &(pa, pb) in &tops {
-            segs.push(Seg { a: pb, b: pb, r: thick * 0.5, v: 1.0 });
-            if side == 2 {
-                segs.push(Seg { a: pa, b: pa, r: thick * 0.5, v: 1.0 });
-            }
-        }
-    }
-    Some(marks(ctx, segs, thick, soft))
-}
-
-fn waveform_plan(ctx: &EffectCtx, b: &Buf) -> Option<MarksPlan> {
-    let pr = ctx.params;
-    let samples = audio_window(ctx, pr.f("audioDuration"), pr.f("audioOffset"), pr.e("waveformOptions"))?;
-    let count = pr.f("displayedSamples").round().clamp(2.0, 4096.0) as usize;
-    let max_h = pr.f("maximumHeight") * b.scale;
-    let thick = (pr.f("thickness") * b.scale).max(0.1);
-    let soft = pr.f("softness") / 100.0;
-    let disp = pr.e("displayOptions");
-    let base = Baseline::new(ctx, b);
-    let m = samples.len();
-    let mut pts = Vec::with_capacity(count);
-    let mut segs = Vec::new();
-    for i in 0..count {
-        let u = i as f64 / (count - 1) as f64;
-        let a = ((u * (m - 1) as f64) as usize).min(m - 1);
-        let bnd = (((i + 1) as f64 / count as f64 * (m - 1) as f64) as usize).clamp(a, m - 1);
-        // Peak with sign of the window for a stable digital display.
-        let (mut lo, mut hi) = (0.0f64, 0.0f64);
-        for s in &samples[a..=bnd] {
-            lo = lo.min(*s);
-            hi = hi.max(*s);
-        }
-        let (q, nrm) = base.at(u);
-        match disp {
-            0 => segs.push(Seg {
-                a: [q[0] + nrm[0] * lo * max_h, q[1] + nrm[1] * lo * max_h],
-                b: [q[0] + nrm[0] * hi * max_h, q[1] + nrm[1] * hi * max_h],
-                r: thick * 0.5,
-                v: 1.0,
-            }),
-            _ => {
-                let v = samples[a] * max_h;
-                pts.push([q[0] + nrm[0] * v, q[1] + nrm[1] * v]);
-            }
-        }
-    }
-    if disp == 1 {
-        poly_segs(&pts, false, thick * 0.5, 1.0, &mut segs);
-    } else if disp == 2 {
-        segs.extend(pts.iter().map(|&q| Seg { a: q, b: q, r: thick * 0.5, v: 1.0 }));
-    }
-    Some(marks(ctx, segs, thick, soft))
-}
-
-// ---------------------------------------------------------------- registry
-
-pub fn specs() -> Vec<EffectSpec> {
-    let ang = || ParamUi::Angle;
-    let check = |id: &'static str, name: &'static str, v: bool| p(id, name, Value::Bool(v), ParamUi::Checkbox);
-    let paint_style = || popup(&["On Original Image", "On Transparent", "Reveal Original Image"]);
-    let mask_idx = |id: &'static str, name: &'static str, d: f64| p(id, name, num(d), ParamUi::Mask);
-    let display = || popup(&["Digital", "Analog lines", "Analog dots"]);
-    vec![
-        spec(
-            "ec.generate.fractal",
-            "Fractal",
-            vec![
-                p("setChoice", "Set Choice", Value::Enum(0), popup(&FRACTAL_SETS)),
-                p("equation", "Equation", Value::Enum(0), popup(&["z = z^2 + c", "z = z^3 + c", "z = z^4 + c"])),
-                p("mandelbrot/mandelbrotX", "X (Real)", num(-0.74), slider(-2.0, 2.0, -2.0, 2.0, 4)),
-                p("mandelbrot/mandelbrotY", "Y (Imaginary)", num(0.15), slider(-2.0, 2.0, -2.0, 2.0, 4)),
-                p("mandelbrot/mandelbrotMagnification", "Magnification", num(0.0), slider(-5.0, 30.0, -5.0, 30.0, 2)),
-                p("mandelbrot/mandelbrotEscapeLimit", "Escape Limit", num(4.0), slider(1.0, 1000.0, 1.0, 100.0, 1)),
-                p("julia/juliaX", "X (Real)", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
-                p("julia/juliaY", "Y (Imaginary)", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
-                p("julia/juliaMagnification", "Magnification", num(0.0), slider(-5.0, 30.0, -5.0, 30.0, 2)),
-                p("julia/juliaEscapeLimit", "Escape Limit", num(4.0), slider(1.0, 1000.0, 1.0, 100.0, 1)),
-                p("postInversionOffset/postInversionX", "X Offset", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
-                p("postInversionOffset/postInversionY", "Y Offset", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
-                check("fractalColor/overlay", "Overlay", false),
-                check("fractalColor/transparency", "Transparency", false),
-                p("fractalColor/palette", "Palette", Value::Enum(0), popup(&FRACTAL_PALETTES)),
-                p("fractalColor/hue", "Hue", num(0.0), ang()),
-                p("fractalColor/cycleSteps", "Cycle Steps", num(32.0), slider(1.0, 1000.0, 1.0, 256.0, 0)),
-                p("fractalColor/cycleOffset", "Cycle Offset", num(0.0), ang()),
-                check("fractalColor/edgeHighlight", "Edge Highlight", false),
-                p("highQualitySettings/samplingMethod", "Oversample Method", Value::Enum(0), popup(&FRACTAL_OVERSAMPLE)),
-                p("highQualitySettings/samplingFactor", "Oversample Factor", num(2.0), slider(1.0, 9.0, 1.0, 9.0, 0)),
-            ],
-            fractal,
-        ),
-        spec(
-            "ec.generate.scribble",
-            "Scribble",
-            vec![
-                p("scribble", "Scribble", Value::Enum(0), popup(&["Single Mask", "All Masks", "All Masks Using Modes"])),
-                mask_idx("mask", "Mask", 1.0),
-                p("fillType", "Fill Type", Value::Enum(0), popup(&["Inside", "Centered Edge", "Inside Edge", "Outside Edge", "Left Edge", "Right Edge"])),
-                p("edgeOptions/edgeWidth", "Edge Width", num(10.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
-                p("edgeOptions/endCap", "End Cap", Value::Enum(0), popup(&END_CAPS)),
-                p("edgeOptions/join", "Join", Value::Enum(0), popup(&JOINS)),
-                p("edgeOptions/miterLimit", "Miter Limit", num(4.0), slider(1.0, 100.0, 1.0, 20.0, 1)),
-                p("color", "Color", col(1.0, 0.0, 0.0), ParamUi::Color),
-                p("opacity", "Opacity", num(100.0), pct()),
-                p("angle", "Angle", num(45.0), ang()),
-                p("strokeWidth", "Stroke Width", num(2.0), slider(0.1, 50.0, 0.1, 50.0, 1)),
-                p("strokeOptions/curviness", "Curviness", num(50.0), pct()),
-                p("strokeOptions/curvinessVariation", "Curviness Variation", num(50.0), pct()),
-                p("strokeOptions/spacing", "Spacing", num(5.0), slider(0.1, 100.0, 0.1, 50.0, 1)),
-                p("strokeOptions/spacingVariation", "Spacing Variation", num(50.0), pct()),
-                p("strokeOptions/pathOverlap", "Path Overlap", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
-                p("strokeOptions/pathOverlapVariation", "Path Overlap Variation", num(50.0), pct()),
-                p("start", "Start", num(0.0), pct()),
-                p("end", "End", num(100.0), pct()),
-                p("startEndApplyTo", "Start/End Apply To", Value::Enum(0), popup(&["All Strokes", "Each Stroke"])),
-                check("fillPathsSequentially", "Fill Paths Sequentially", true),
-                p("wiggleType", "Wiggle Type", Value::Enum(1), popup(&["Static", "Jumpy", "Smooth"])),
-                p("wigglesPerSecond", "Wiggles/Second", num(5.0), slider(0.0, 100.0, 0.0, 30.0, 2)),
-                p("randomSeed", "Random Seed", num(1.0), slider(0.0, 10000.0, 0.0, 100.0, 0)),
-                p("composite", "Composite", Value::Enum(1), popup(&["On Original Image", "On Transparent", "Reveal Original Image"])),
-            ],
-            scribble,
-        ),
-        spec(
-            "ec.generate.stroke",
-            "Stroke",
-            vec![
-                mask_idx("path", "Path", 1.0),
-                check("allMasks", "All Masks", false),
-                check("strokeSequentially", "Stroke Sequentially", true),
-                p("color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("brushSize", "Brush Size", num(2.0), slider(0.0, 50.0, 0.0, 50.0, 1)),
-                p("brushHardness", "Brush Hardness", num(75.0), pct()),
-                p("opacity", "Opacity", num(100.0), pct()),
-                p("start", "Start", num(0.0), pct()),
-                p("end", "End", num(100.0), pct()),
-                p("spacing", "Spacing", num(15.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
-                p("paintStyle", "Paint Style", Value::Enum(0), paint_style()),
-            ],
-            stroke,
-        ),
-        spec(
-            "ec.generate.vegas",
-            "Vegas",
-            vec![
-                p("stroke", "Stroke", Value::Enum(0), popup(&["Image Contours", "Mask/Path"])),
-                p("inputLayer", "Image Contours: Input Layer", Value::Layer(None), ParamUi::Layer),
-                check("invertInput", "Image Contours: Invert Input", false),
-                p("ifLayerSizesDiffer", "Image Contours: If Layer Sizes Differ", Value::Enum(0), popup(&["Center", "Stretch to Fit"])),
-                p("channel", "Image Contours: Channel", Value::Enum(0), popup(&["Intensity", "Red", "Green", "Blue", "Alpha"])),
-                p("threshold", "Image Contours: Threshold", num(50.0), pct()),
-                p("preBlur", "Image Contours: Pre-Blur", num(1.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
-                p("tolerance", "Image Contours: Tolerance", num(0.01), slider(0.0, 1.0, 0.0, 0.1, 3)),
-                p("renderMode", "Image Contours: Render", Value::Enum(0), popup(&["All Contours", "Selected Contour"])),
-                p("selectedContour", "Image Contours: Selected Contour", num(1.0), slider(1.0, 1000.0, 1.0, 20.0, 0)),
-                p("shorterContoursHave", "Image Contours: Shorter Contours Have", Value::Enum(0), popup(&["Same Number of Segments", "Fewer Segments"])),
-                mask_idx("path", "Mask/Path: Path", 1.0),
-                p("segments", "Segments: Segments", num(32.0), slider(1.0, 1000.0, 1.0, 100.0, 0)),
-                p("length", "Segments: Length", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("segmentDistribution", "Segments: Segment Distribution", Value::Enum(0), popup(&["Bunched", "Even"])),
-                p("rotation", "Segments: Rotation", num(0.0), ang()),
-                check("randomPhase", "Segments: Random Phase", false),
-                p("randomSeed", "Segments: Random Seed", num(1.0), slider(1.0, 10000.0, 1.0, 100.0, 0)),
-                p("blendMode", "Rendering: Blend Mode", Value::Enum(1), popup(&["Transparent", "Over", "Under", "Stencil"])),
-                p("color", "Rendering: Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("width", "Rendering: Width", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
-                p("hardness", "Rendering: Hardness", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("startOpacity", "Rendering: Start Opacity", num(1.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("midpointOpacity", "Rendering: Mid-point Opacity", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("midpointPosition", "Rendering: Mid-point Position", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("endOpacity", "Rendering: End Opacity", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-            ],
-            vegas,
-        ),
-        spec(
-            "ec.generate.writeon",
-            "Write-on",
-            vec![
-                p("brushPosition", "Brush Position", pt(0.5, 0.5), ParamUi::Point),
-                p("color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("brushSize", "Brush Size", num(6.0), slider(0.0, 50.0, 0.0, 50.0, 1)),
-                p("brushHardness", "Brush Hardness", num(75.0), pct()),
-                p("brushOpacity", "Brush Opacity", num(100.0), pct()),
-                p("strokeLength", "Stroke Length (secs)", num(0.0), slider(0.0, 30.0, 0.0, 30.0, 1)),
-                p("brushSpacing", "Brush Spacing (secs)", num(0.001), slider(0.001, 5.0, 0.001, 5.0, 3)),
-                p("paintTimeProperties", "Paint Time Properties", Value::Enum(0), popup(&["None", "Opacity", "Color"])),
-                p("brushTimeProperties", "Brush Time Properties", Value::Enum(0), popup(&["None", "Size", "Hardness", "Size & Hardness"])),
-                p("paintStyle", "Paint Style", Value::Enum(0), paint_style()),
-            ],
-            write_on,
-        ),
-        spec(
-            "ec.generate.paintbucket",
-            "Paint Bucket",
-            vec![
-                p("fillPoint", "Fill Point", pt(0.5, 0.5), ParamUi::Point),
-                p("fillSelector", "Fill Selector", Value::Enum(0), popup(&["Color & Alpha", "Straight Color", "Transparency", "Opacity", "Alpha Channel"])),
-                p("tolerance", "Tolerance", num(10.0), slider(0.0, 255.0, 0.0, 100.0, 1)),
-                check("viewThreshold", "View Threshold", false),
-                p("stroke", "Stroke", Value::Enum(0), popup(&["Antialias", "Feather", "Spread", "Choke", "Stroke"])),
-                p("featherSoftness", "Feather Softness", num(10.0), slider(0.0, 100.0, 0.0, 50.0, 1)),
-                p("spreadRadius", "Spread Radius", num(3.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
-                p("strokeWidth", "Stroke Width", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
-                p("color", "Color", col(1.0, 0.0, 0.0), ParamUi::Color),
-                p("opacity", "Opacity", num(100.0), pct()),
-                p(
-                    "blendingMode",
-                    "Blending Mode",
-                    Value::Enum(0),
-                    popup(&["Normal", "Add", "Multiply", "Screen", "Hue", "Saturation", "Color", "Luminosity", "Behind", "Fill Only"]),
-                ),
-            ],
-            paint_bucket,
-        ),
-        spec(
-            "ec.generate.eyedropperfill",
-            "Eyedropper Fill",
-            vec![
-                p("samplePoint", "Sample Point", pt(0.5, 0.5), ParamUi::Point),
-                p("sampleRadius", "Sample Radius", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
-                p("averagePixelColors", "Average Pixel Colors", Value::Enum(0), popup(&["Skip Empty", "All", "All Premultiplied", "Including Alpha"])),
-                check("maintainOriginalAlpha", "Maintain Original Alpha", false),
-                p("blendWithOriginal", "Blend With Original", num(0.0), pct()),
-            ],
-            eyedropper_fill,
-        ),
-        spec(
-            "ec.generate.ccgluegun",
-            "CC Glue Gun",
-            vec![
-                p("brushPosition", "Brush Position", pt(0.5, 0.5), ParamUi::Point),
-                p("strokeWidth", "Stroke Width", num(25.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
-                p("density", "Density", num(5.0), slider(0.0, 32.0, 0.0, 32.0, 1)),
-                p("timeSpan", "Time Span (sec)", num(1.0), slider(0.0, 60.0, 0.0, 10.0, 2)),
-                p("reflection", "Reflection", num(45.0), ang()),
-                p("strength", "Strength", num(100.0), pct()),
-                p("style", "Style", Value::Enum(0), popup(&["Over Layer", "Glue Only"])),
-            ],
-            glue_gun,
-        ),
-        spec(
-            "ec.generate.ccthreads",
-            "CC Threads",
-            vec![
-                p("width", "Width", num(50.0), slider(1.0, 1000.0, 1.0, 200.0, 1)),
-                p("height", "Height", num(50.0), slider(1.0, 1000.0, 1.0, 200.0, 1)),
-                p("overlaps", "Overlaps", num(1.0), slider(1.0, 20.0, 1.0, 10.0, 0)),
-                p("direction", "Direction", num(0.0), ang()),
-                p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
-                p("coverage", "Coverage", num(80.0), pct()),
-                p("shadowing", "Shadowing", num(50.0), pct()),
-                p("texture", "Texture", num(10.0), pct()),
-            ],
-            threads,
-        ),
-        spec(
-            "ec.generate.audiospectrum",
-            "Audio Spectrum",
-            vec![
-                p("audioLayer", "Audio Layer", Value::Layer(None), ParamUi::Layer),
-                p("startPoint", "Start Point", pt(0.1, 0.5), ParamUi::Point),
-                p("endPoint", "End Point", pt(0.9, 0.5), ParamUi::Point),
-                mask_idx("path", "Path", 0.0),
-                check("usePolarPath", "Use Polar Path", false),
-                p("startFrequency", "Start Frequency", num(20.0), slider(1.0, 20000.0, 1.0, 2000.0, 0)),
-                p("endFrequency", "End Frequency", num(2000.0), slider(1.0, 20000.0, 1.0, 10000.0, 0)),
-                p("frequencyBands", "Frequency bands", num(64.0), slider(1.0, 4096.0, 1.0, 256.0, 0)),
-                p("maximumHeight", "Maximum Height", num(50.0), slider(0.0, 10000.0, 0.0, 500.0, 1)),
-                p("audioDuration", "Audio Duration (milliseconds)", num(90.0), slider(1.0, 30000.0, 1.0, 1000.0, 1)),
-                p("audioOffset", "Audio Offset (milliseconds)", num(0.0), slider(-30000.0, 30000.0, -1000.0, 1000.0, 1)),
-                p("thickness", "Thickness", num(3.0), slider(0.0, 1000.0, 0.0, 50.0, 2)),
-                p("softness", "Softness", num(50.0), pct()),
-                p("insideColor", "Inside Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("outsideColor", "Outside Color", col(0.2, 0.4, 1.0), ParamUi::Color),
-                check("blendOverlappingColors", "Blend Overlapping Colors", true),
-                p("hueInterpolation", "Hue Interpolation", num(0.0), ang()),
-                check("dynamicHuePhase", "Dynamic Hue Phase", false),
-                check("colorSymmetry", "Color Symmetry", false),
-                p("displayOptions", "Display Options", Value::Enum(0), display()),
-                p("sideOptions", "Side Options", Value::Enum(0), popup(&["Side A", "Side B", "Side A & B"])),
-                check("durationAveraging", "Duration Averaging", false),
-                check("compositeOnOriginal", "Composite On Original", false),
-            ],
-            audio_spectrum,
-        ),
-        spec(
-            "ec.generate.audiowaveform",
-            "Audio Waveform",
-            vec![
-                p("audioLayer", "Audio Layer", Value::Layer(None), ParamUi::Layer),
-                p("startPoint", "Start Point", pt(0.1, 0.5), ParamUi::Point),
-                p("endPoint", "End Point", pt(0.9, 0.5), ParamUi::Point),
-                mask_idx("path", "Path", 0.0),
-                check("usePolarPath", "Use Polar Path", false),
-                p("displayedSamples", "Displayed Samples", num(200.0), slider(2.0, 4096.0, 2.0, 1000.0, 0)),
-                p("maximumHeight", "Maximum Height", num(100.0), slider(0.0, 10000.0, 0.0, 500.0, 1)),
-                p("audioDuration", "Audio Duration (milliseconds)", num(200.0), slider(1.0, 30000.0, 1.0, 1000.0, 1)),
-                p("audioOffset", "Audio Offset (milliseconds)", num(0.0), slider(-30000.0, 30000.0, -1000.0, 1000.0, 1)),
-                p("thickness", "Thickness", num(2.0), slider(0.0, 1000.0, 0.0, 50.0, 2)),
-                p("softness", "Softness", num(10.0), pct()),
-                p("randomSeed", "Random Seed (Analog)", num(1.0), slider(1.0, 10000.0, 1.0, 100.0, 0)),
-                p("insideColor", "Inside Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("outsideColor", "Outside Color", col(0.2, 0.4, 1.0), ParamUi::Color),
-                p("waveformOptions", "Waveform Options", Value::Enum(0), popup(&["Mono", "Left", "Right"])),
-                p("displayOptions", "Display Options", Value::Enum(1), display()),
-                check("compositeOnOriginal", "Composite On Original", false),
-            ],
-            audio_waveform,
-        ),
-    ]
-}
+mod audio;
+mod common;
+mod fill;
+mod fractal;
+mod paths;
+mod raster;
+mod registry;
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, EffectHost, LayerPixels, MaskShape, Params};
+pub(crate) use audio::fft;
+pub use audio::{MarksPlan, marks_plan};
+pub use fill::{eyedropper_color, paint_bucket_region};
+#[cfg(test)]
+use paths::contours;
+pub use paths::{Coverage, PaintPlan, paint_plan, plan_reads_pixels, scribble_style};
+pub use raster::{Seg, poly_segs};
+pub(crate) use raster::{mask_px, raster_segs};
+#[cfg(test)]
+pub(crate) use raster::{raster_convex, stroke_outline};
+pub use registry::specs;
 
-    /// Run with point defaults scaled to the layer size.
-    pub(crate) fn run_env(id: &str, set: &[(&str, Value)], img: Image, time: f64, env: EffectEnv) -> Buf {
-        let s = crate::find(id).unwrap();
-        let ls = [img.width as f64, img.height as f64];
-        let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        for p in &s.params {
-            if let (ParamUi::Point, Value::Vec2(v)) = (&p.ui, &p.default) {
-                params.values.insert(p.id.to_string(), Value::Vec2([v[0] * ls[0], v[1] * ls[1]]));
-            }
-        }
-        for (k, v) in set {
-            assert!(params.values.contains_key(*k), "{id}: unknown {k}");
-            params.values.insert(k.to_string(), v.clone());
-        }
-        let ctx = EffectCtx { params: &params, time, layer_size: ls, seed: 3, adjustment: false, env };
-        crate::apply(s, &ctx, Buf { img, offset: [0.0, 0.0], scale: 1.0 })
-    }
-
-    fn run(id: &str, set: &[(&str, Value)], img: Image) -> Buf {
-        run_env(id, set, img, 0.5, EffectEnv::default())
-    }
-
-    fn square_mask() -> Vec<MaskShape> {
-        vec![MaskShape { name: "Mask 1".into(), points: vec![[16.0, 16.0], [48.0, 16.0], [48.0, 48.0], [16.0, 48.0]], closed: true, inverted: false }]
-    }
-
-    fn alpha_sum(img: &Image, x0: usize, y0: usize, x1: usize, y1: usize) -> f32 {
-        let mut s = 0.0;
-        for y in y0..y1 {
-            for x in x0..x1 {
-                s += img.data[y * img.width as usize + x][3];
-            }
-        }
-        s
-    }
-
-    #[test]
-    fn audio_spectrum_linear_frequency_and_linear_amplitude() {
-        let host = Tone; // Tone produces 440 Hz
-        let env = EffectEnv { host: Some(&host), comp_time: 1.0, ..Default::default() };
-        let img = Image::new(200, 100);
-        let out = run_env(
-            "ec.generate.audiospectrum",
-            &[
-                ("audioLayer", Value::Layer(Some(1))),
-                ("startPoint", Value::Vec2([0.0, 50.0])),
-                ("endPoint", Value::Vec2([200.0, 50.0])),
-                ("startFrequency", num(20.0)),
-                ("endFrequency", num(2000.0)),
-                ("frequencyBands", num(100.0)),
-                ("maximumHeight", num(40.0)),
-                ("thickness", num(2.0)),
-                ("softness", num(0.0)),
-            ],
-            img,
-            1.0,
-            env,
-        );
-        // Verify 440 Hz tone produces a peak above baseline, while high frequencies have zero bar height
-        let peak_zone = alpha_sum(&out.img, 36, 10, 48, 48);
-        let high_zone = alpha_sum(&out.img, 120, 10, 150, 48);
-        let silent_zone = alpha_sum(&out.img, 170, 10, 195, 48);
-        assert!(peak_zone > 5.0, "peak zone has energy: {peak_zone}");
-        assert!(peak_zone > high_zone * 2.0, "linear peak is distinctly taller than far frequencies: {peak_zone} vs {high_zone}");
-        assert_eq!(silent_zone, 0.0, "silent end has zero height, not boosted by dB scale");
-    }
-
-    #[test]
-    fn fractal_deterministic_and_has_inside_set() {
-        let img = Image::new(64, 48);
-        let a = run("ec.generate.fractal", &[], img.clone());
-        let b = run("ec.generate.fractal", &[], img.clone());
-        assert_eq!(a.img.data, b.img.data);
-        // The default view contains the main cardioid (black, opaque) and escaped (coloured) points.
-        assert!(a.img.data.iter().any(|p| p[3] > 0.99 && p[0] + p[1] + p[2] < 0.01));
-        assert!(a.img.data.iter().any(|p| p[0] + p[1] + p[2] > 0.3));
-        let t = run("ec.generate.fractal", &[("fractalColor/transparency", Value::Bool(true))], img);
-        assert!(t.img.data.iter().any(|p| p[3] == 0.0));
-    }
-
-    #[test]
-    fn fractal_palettes_and_set_choices() {
-        let img = Image::new(64, 48);
-        // Solid Color: only the inside of the set is drawn; Transparency flips it.
-        let solid = run("ec.generate.fractal", &[("fractalColor/palette", Value::Enum(3))], img.clone());
-        assert!(solid.img.data.iter().any(|p| p[3] == 0.0) && solid.img.data.iter().any(|p| p[3] > 0.99 && p[0] > 0.9));
-        let flipped = run("ec.generate.fractal", &[("fractalColor/palette", Value::Enum(3)), ("fractalColor/transparency", Value::Bool(true))], img.clone());
-        for (a, b) in solid.img.data.iter().zip(&flipped.img.data) {
-            assert!((a[3] > 0.5) != (b[3] > 0.5) || (a[3] - 0.5).abs() < 0.49);
-        }
-        // Black And White: escaped pixels are pure black or white (away from supersampled edges).
-        let bw = run("ec.generate.fractal", &[("fractalColor/palette", Value::Enum(2)), ("highQualitySettings/samplingFactor", num(1.0))], img.clone());
-        assert!(bw.img.data.iter().all(|p| p[0] == p[1] && p[1] == p[2] && (p[0] == 0.0 || p[0] == 1.0)));
-        // Mandelbrot Over Julia depends on the Julia centre.
-        let o1 = run("ec.generate.fractal", &[("setChoice", Value::Enum(2)), ("julia/juliaX", num(0.3))], img.clone());
-        let o2 = run("ec.generate.fractal", &[("setChoice", Value::Enum(2)), ("julia/juliaX", num(-0.2))], img.clone());
-        assert_ne!(o1.img.data, o2.img.data);
-        let plain = run("ec.generate.fractal", &[("julia/juliaX", num(0.3))], img);
-        assert_ne!(o1.img.data, plain.img.data);
-    }
-
-    #[test]
-    fn scribble_fills_mask_and_animates() {
-        let masks = square_mask();
-        let env = EffectEnv { masks: &masks, ..Default::default() };
-        let img = Image::filled(64, 64, [0.0, 0.0, 1.0, 1.0]);
-        let a = run_env("ec.generate.scribble", &[], img.clone(), 0.5, env);
-        let b = run_env("ec.generate.scribble", &[], img.clone(), 0.5, env);
-        assert_eq!(a.img.data, b.img.data);
-        let inside = alpha_sum(&a.img, 18, 18, 46, 46);
-        let outside = alpha_sum(&a.img, 0, 0, 10, 64);
-        assert!(inside > 100.0 && outside < 1.0, "{inside} {outside}");
-        let c = run_env("ec.generate.scribble", &[], img.clone(), 1.5, env);
-        assert_ne!(a.img.data, c.img.data, "jumpy wiggle changes over time");
-        let s = run_env("ec.generate.scribble", &[("wiggleType", Value::Enum(0))], img.clone(), 0.5, env);
-        let s2 = run_env("ec.generate.scribble", &[("wiggleType", Value::Enum(0))], img.clone(), 3.5, env);
-        assert_eq!(s.img.data, s2.img.data, "static wiggle is constant");
-        let half = run_env("ec.generate.scribble", &[("end", num(50.0))], img, 0.5, env);
-        assert!(alpha_sum(&half.img, 0, 0, 64, 64) < alpha_sum(&a.img, 0, 0, 64, 64));
-    }
-
-    #[test]
-    fn scribble_edge_types() {
-        let masks = square_mask();
-        let env = EffectEnv { masks: &masks, ..Default::default() };
-        let img = Image::new(64, 64);
-        let o = run_env("ec.generate.scribble", &[("fillType", Value::Enum(3)), ("edgeOptions/edgeWidth", num(6.0))], img, 0.5, env);
-        // Outside edge: paint near the border outside, nothing in the centre.
-        assert!(alpha_sum(&o.img, 26, 26, 38, 38) < 0.5);
-        assert!(alpha_sum(&o.img, 8, 8, 16, 56) > 5.0);
-    }
-
-    #[test]
-    fn stroke_draws_along_mask() {
-        let masks = square_mask();
-        let env = EffectEnv { masks: &masks, ..Default::default() };
-        let img = Image::new(64, 64);
-        let a = run_env("ec.generate.stroke", &[("brushSize", num(4.0)), ("paintStyle", Value::Enum(1))], img.clone(), 0.0, env);
-        assert!(a.img.get(32, 16)[3] > 0.9, "on the top edge");
-        assert!(a.img.get(32, 32)[3] < 0.01, "centre empty");
-        let b = run_env("ec.generate.stroke", &[("brushSize", num(4.0)), ("end", num(25.0))], img.clone(), 0.0, env);
-        assert!(b.img.get(32, 16)[3] > 0.9 && b.img.get(48, 32)[3] < 0.01, "first quarter only");
-        let d = run_env("ec.generate.stroke", &[("brushSize", num(4.0)), ("spacing", num(300.0))], img, 0.0, env);
-        assert!(alpha_sum(&d.img, 0, 0, 64, 64) < alpha_sum(&a.img, 0, 0, 64, 64), "spaced dabs");
-        // No masks: unchanged.
-        let src = Image::filled(8, 8, [0.2, 0.3, 0.4, 1.0]);
-        assert_eq!(run("ec.generate.stroke", &[], src.clone()).img.data, src.data);
-    }
-
-    #[test]
-    fn vegas_traces_contours() {
-        let mut img = Image::new(64, 64);
-        for y in 16..48 {
-            for x in 16..48 {
-                img.set(x, y, [1.0, 1.0, 1.0, 1.0]);
-            }
-        }
-        let a = run(
-            "ec.generate.vegas",
-            &[("blendMode", Value::Enum(0)), ("length", num(1.0)), ("midpointOpacity", num(1.0)), ("endOpacity", num(1.0))],
-            img.clone(),
-        );
-        let b = run(
-            "ec.generate.vegas",
-            &[("blendMode", Value::Enum(0)), ("length", num(1.0)), ("midpointOpacity", num(1.0)), ("endOpacity", num(1.0))],
-            img.clone(),
-        );
-        assert_eq!(a.img.data, b.img.data);
-        assert!(alpha_sum(&a.img, 14, 14, 50, 50) > 50.0, "edges drawn");
-        assert!(alpha_sum(&a.img, 26, 26, 38, 38) < 0.5, "interior untouched");
-        let r = run("ec.generate.vegas", &[("blendMode", Value::Enum(0)), ("rotation", num(90.0))], img);
-        assert_ne!(r.img.data, a.img.data);
-    }
-
-    #[test]
-    fn contours_of_square_are_closed() {
-        let mut pl = Plane::new(20, 20);
-        for y in 5..15 {
-            for x in 5..15 {
-                pl.data[y * 20 + x] = 1.0;
-            }
-        }
-        let c = contours(&pl, 0.5);
-        assert_eq!(c.len(), 1);
-        assert!(c[0].1);
-        let l = poly_length(&c[0].0, true);
-        assert!((l - 40.0).abs() < 4.0, "{l}");
-    }
-
-    #[test]
-    fn write_on_and_glue_gun_draw_at_brush() {
-        let img = Image::new(32, 32);
-        let a = run("ec.generate.writeon", &[], img.clone());
-        assert!(a.img.get(16, 16)[3] > 0.9 && a.img.get(2, 2)[3] == 0.0);
-        assert_eq!(a.img.data, run("ec.generate.writeon", &[], img.clone()).img.data);
-        let src = Image::filled(32, 32, [0.5, 0.2, 0.1, 1.0]);
-        let g = run("ec.generate.ccgluegun", &[], src.clone());
-        assert_eq!(g.img.data, run("ec.generate.ccgluegun", &[], src.clone()).img.data);
-        assert_ne!(g.img.get(16, 16), src.get(16, 16));
-        assert_eq!(g.img.get(0, 0), src.get(0, 0));
-    }
-
-    /// #536: an animated Brush Position draws a stroke that stays (Stroke Length 0), expires
-    /// after Stroke Length, and lays its dabs Brush Spacing seconds apart.
-    #[test]
-    fn write_on_accumulates_a_stroke_along_the_animated_brush() {
-        // Brush Position from [8, 16] at 0 s to [56, 16] at 1 s; red, hard, 6 px.
-        struct Brush(Vec<(&'static str, Value)>);
-        impl Brush {
-            fn at(&self, t: f64) -> Vec<(&'static str, Value)> {
-                let mut v = self.0.clone();
-                v.push(("brushPosition", Value::Vec2([8.0 + 48.0 * t.clamp(0.0, 1.0), 16.0])));
-                v
-            }
-        }
-        impl EffectHost for Brush {
-            fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
-                None
-            }
-            fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-                None
-            }
-            fn params_at(&self, t: f64) -> Option<Params> {
-                let s = crate::find("ec.generate.writeon").unwrap();
-                let mut p = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-                for (k, v) in self.at(t) {
-                    p.values.insert(k.to_string(), v);
-                }
-                Some(p)
-            }
-        }
-        let render = |extra: &[(&'static str, Value)], t: f64| {
-            let mut set = vec![("color", col(1.0, 0.0, 0.0)), ("brushSize", num(6.0)), ("brushHardness", num(100.0)), ("brushSpacing", num(0.05))];
-            set.extend(extra.iter().cloned());
-            let host = Brush(set);
-            let env = EffectEnv { host: Some(&host), ..Default::default() };
-            let at = host.at(t);
-            run_env("ec.generate.writeon", &at, Image::new(64, 32), t, env).img
-        };
-        let on = |img: &Image, x: i64| img.get(x, 16)[3] > 0.9;
-        let half = render(&[], 0.5);
-        assert!(on(&half, 8) && on(&half, 20) && on(&half, 32) && !on(&half, 44) && !on(&half, 56));
-        let end = render(&[], 1.0);
-        assert!([8, 20, 32, 44, 56].iter().all(|x| on(&end, *x)));
-        // Stroke Length 0.25 s: only the last quarter second's trail.
-        let trail = render(&[("strokeLength", num(0.25))], 1.0);
-        assert!(!on(&trail, 8) && !on(&trail, 32) && on(&trail, 48) && on(&trail, 56));
-        // Brush Spacing 0.5 s: three separate marks.
-        let spaced = render(&[("brushSpacing", num(0.5))], 1.0);
-        assert!(on(&spaced, 8) && on(&spaced, 32) && on(&spaced, 56) && !on(&spaced, 20) && !on(&spaced, 44));
-        // Paint Time Properties ▸ Opacity: each dab keeps the opacity it was laid with.
-        struct Fade;
-        impl EffectHost for Fade {
-            fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
-                None
-            }
-            fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-                None
-            }
-            fn params_at(&self, t: f64) -> Option<Params> {
-                let mut p = Brush(vec![("brushHardness", num(100.0)), ("brushSpacing", num(0.05)), ("paintTimeProperties", Value::Enum(1))]).params_at(t)?;
-                p.values.insert("brushOpacity".into(), num(if t < 0.5 { 100.0 } else { 20.0 }));
-                Some(p)
-            }
-        }
-        let p1 = Fade.params_at(1.0).unwrap();
-        let set: Vec<(&str, Value)> = p1.values.iter().map(|(k, v)| (k.as_str(), v.clone())).collect();
-        let faded = run_env("ec.generate.writeon", &set, Image::new(64, 32), 1.0, EffectEnv { host: Some(&Fade), ..Default::default() }).img;
-        assert!(faded.get(8, 16)[3] > 0.9 && (faded.get(56, 16)[3] - 0.2).abs() < 0.05, "{:?} {:?}", faded.get(8, 16), faded.get(56, 16));
-    }
-
-    #[test]
-    fn paint_bucket_fills_enclosed_region_only() {
-        let mut img = Image::filled(32, 32, [1.0, 1.0, 1.0, 1.0]);
-        for i in 8..24 {
-            for &(x, y) in &[(i, 8), (i, 23), (8, i), (23, i)] {
-                img.set(x, y, [0.0, 0.0, 0.0, 1.0]);
-            }
-        }
-        let out = run("ec.generate.paintbucket", &[], img.clone());
-        let inside = out.img.get(16, 16);
-        assert!(inside[0] > 0.99 && inside[1] < 0.01, "{inside:?}");
-        assert_eq!(out.img.get(2, 2), [1.0, 1.0, 1.0, 1.0], "outside untouched");
-        assert_eq!(out.img.get(8, 16), [0.0, 0.0, 0.0, 1.0], "border untouched");
-        assert_eq!(out.img.data, run("ec.generate.paintbucket", &[], img).img.data);
-    }
-
-    #[test]
-    fn eyedropper_fill_uses_sample() {
-        let mut img = Image::filled(16, 16, [0.0, 0.0, 1.0, 1.0]);
-        img.set(8, 8, [1.0, 0.0, 0.0, 1.0]);
-        let out = run("ec.generate.eyedropperfill", &[], img.clone());
-        assert!(out.img.data.iter().all(|p| *p == [1.0, 0.0, 0.0, 1.0]));
-        let blended = run("ec.generate.eyedropperfill", &[("blendWithOriginal", num(100.0))], img.clone());
-        assert_eq!(blended.img.data, img.data);
-    }
-
-    #[test]
-    fn threads_weave_is_deterministic_and_gappy() {
-        let src = Image::filled(64, 64, [0.4, 0.6, 0.2, 1.0]);
-        let a = run("ec.generate.ccthreads", &[("width", num(16.0)), ("height", num(16.0)), ("coverage", num(50.0))], src.clone());
-        assert_eq!(a.img.data, run("ec.generate.ccthreads", &[("width", num(16.0)), ("height", num(16.0)), ("coverage", num(50.0))], src).img.data);
-        assert!(a.img.data.iter().any(|p| p[3] == 0.0), "gaps between threads");
-        assert!(a.img.data.iter().any(|p| p[3] > 0.99), "threads");
-    }
-
-    struct Tone;
-    impl EffectHost for Tone {
-        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
-            None
-        }
-        fn audio(&self, _: u64, start: f64, frames: usize, rate: u32) -> Option<Vec<f32>> {
-            Some(
-                (0..frames)
-                    .flat_map(|i| {
-                        let t = start + i as f64 / rate as f64;
-                        let v = (2.0 * PI * 440.0 * t).sin() as f32 * 0.8;
-                        [v, v]
-                    })
-                    .collect(),
-            )
-        }
-    }
-
-    #[test]
-    fn audio_effects_without_audio_pass_through() {
-        let src = Image::filled(16, 16, [0.3, 0.3, 0.3, 1.0]);
-        for id in ["ec.generate.audiospectrum", "ec.generate.audiowaveform"] {
-            assert_eq!(run(id, &[], src.clone()).img.data, src.data, "{id}");
-        }
-    }
-
-    #[test]
-    fn audio_effects_draw_with_host() {
-        let host = Tone;
-        let env = EffectEnv { host: Some(&host), comp_time: 1.0, ..Default::default() };
-        let img = Image::new(96, 64);
-        for id in ["ec.generate.audiospectrum", "ec.generate.audiowaveform"] {
-            let a = run_env(id, &[("audioLayer", Value::Layer(Some(1)))], img.clone(), 1.0, env);
-            let b = run_env(id, &[("audioLayer", Value::Layer(Some(1)))], img.clone(), 1.0, env);
-            assert_eq!(a.img.data, b.img.data, "{id}");
-            assert!(alpha_sum(&a.img, 0, 0, 96, 64) > 10.0, "{id} drew nothing");
-        }
-    }
-
-    #[test]
-    fn fft_finds_tone() {
-        let n = 256;
-        let mut re: Vec<f64> = (0..n).map(|i| (2.0 * PI * 8.0 * i as f64 / n as f64).cos()).collect();
-        let mut im = vec![0.0; n];
-        fft(&mut re, &mut im);
-        let mags: Vec<f64> = (0..n / 2).map(|k| (re[k] * re[k] + im[k] * im[k]).sqrt()).collect();
-        let peak = mags.iter().enumerate().max_by(|a, b| a.1.total_cmp(b.1)).unwrap().0;
-        assert_eq!(peak, 8);
-    }
-
-    #[test]
-    fn stroke_outline_caps_and_joins() {
-        let line = vec![vec![[10.0, 10.0], [30.0, 10.0]]];
-        let cov = |cap: u32| raster_convex(40, 20, &stroke_outline(&line, 3.0, cap, 0, 4.0));
-        // Round caps reach 3 px past the ends (on the axis), Butt stops there, Projecting is square.
-        let (round, butt, proj) = (cov(0), cov(1), cov(2));
-        assert!(round.get(8, 10) > 0.9 && butt.get(8, 10) < 0.1 && proj.get(8, 10) > 0.9);
-        assert!(proj.get(7, 7) > 0.9 && round.get(7, 7) < 0.5, "square corner");
-        // A right-angle turn: Miter fills the outer corner, Bevel cuts it.
-        let corner = vec![vec![[5.0, 30.0], [30.0, 30.0], [30.0, 5.0]]];
-        let j = |join: u32| raster_convex(40, 40, &stroke_outline(&corner, 3.0, 1, join, 4.0));
-        let (miter, bevel) = (j(1), j(2));
-        assert!(miter.get(32, 32) > 0.9 && bevel.get(32, 32) < 0.1, "{} {}", miter.get(32, 32), bevel.get(32, 32));
-        // A tight miter limit falls back to a bevel.
-        let limited = raster_convex(40, 40, &stroke_outline(&corner, 3.0, 1, 1, 1.0));
-        assert!(limited.get(32, 32) < 0.1);
-    }
-
-    #[test]
-    fn scribble_caps_and_start_end_apply_to() {
-        let masks = square_mask();
-        let env = EffectEnv { masks: &masks, ..Default::default() };
-        let img = Image::new(64, 64);
-        let base = [("wiggleType", Value::Enum(0)), ("strokeWidth", num(3.0))];
-        let round = run_env("ec.generate.scribble", &base, img.clone(), 0.0, env);
-        let butt = run_env(
-            "ec.generate.scribble",
-            &[base.as_slice(), &[("edgeOptions/endCap", Value::Enum(1)), ("edgeOptions/join", Value::Enum(2))]].concat(),
-            img.clone(),
-            0.0,
-            env,
-        );
-        assert_ne!(round.img.data, butt.img.data);
-        // Each Stroke: every stroke is trimmed on its own, so the half-way image has ink all over.
-        let two = vec![
-            crate::MaskShape { name: String::new(), points: vec![[4.0, 4.0], [28.0, 4.0], [28.0, 60.0], [4.0, 60.0]], closed: true, inverted: false },
-            crate::MaskShape { name: String::new(), points: vec![[36.0, 4.0], [60.0, 4.0], [60.0, 60.0], [36.0, 60.0]], closed: true, inverted: false },
-        ];
-        let env2 = EffectEnv { masks: &two, ..Default::default() };
-        let seq = [("scribble", Value::Enum(1)), ("end", num(50.0))];
-        let all = run_env("ec.generate.scribble", &[base.as_slice(), &seq].concat(), img.clone(), 0.0, env2);
-        let each = run_env("ec.generate.scribble", &[base.as_slice(), &seq, &[("startEndApplyTo", Value::Enum(1))]].concat(), img, 0.0, env2);
-        assert_ne!(all.img.data, each.img.data);
-    }
-}
+#[cfg(test)]
+mod tests;
diff --git a/crates/effects/src/generate3/audio.rs b/crates/effects/src/generate3/audio.rs
new file mode 100644
index 000000000..6c8d66e4a
--- /dev/null
+++ b/crates/effects/src/generate3/audio.rs
@@ -0,0 +1,314 @@
+use super::raster::{Seg, mask_px, over, poly_segs, raster_segs};
+use super::{Buf, EffectCtx, IndexedParallelIterator, IntoParallelRefMutIterator, PI, ParallelIterator, poly_length, premul};
+
+// ---------------------------------------------------------------- Audio Spectrum / Waveform
+
+/// In-place iterative radix-2 FFT (`re`, `im` lengths a power of two).
+pub(crate) fn fft(re: &mut [f64], im: &mut [f64]) {
+    let n = re.len();
+    if n < 2 {
+        return;
+    }
+    let mut j = 0;
+    for i in 1..n {
+        let mut bit = n >> 1;
+        while j & bit != 0 {
+            j ^= bit;
+            bit >>= 1;
+        }
+        j |= bit;
+        if i < j {
+            re.swap(i, j);
+            im.swap(i, j);
+        }
+    }
+    let mut len = 2;
+    while len <= n {
+        let ang = -2.0 * PI / len as f64;
+        let (ws, wc) = ang.sin_cos();
+        for start in (0..n).step_by(len) {
+            let (mut cr, mut ci) = (1.0, 0.0);
+            for k in 0..len / 2 {
+                let (a, bb) = (start + k, start + k + len / 2);
+                let tr = re[bb] * cr - im[bb] * ci;
+                let ti = re[bb] * ci + im[bb] * cr;
+                re[bb] = re[a] - tr;
+                im[bb] = im[a] - ti;
+                re[a] += tr;
+                im[a] += ti;
+                let ncr = cr * wc - ci * ws;
+                ci = cr * ws + ci * wc;
+                cr = ncr;
+            }
+        }
+        len <<= 1;
+    }
+}
+
+const AUDIO_RATE: u32 = 48_000;
+
+/// Fetch mono (or one channel) samples of the audio layer around the current time.
+fn audio_window(ctx: &EffectCtx, dur_ms: f64, offset_ms: f64, channel: u32) -> Option<Vec<f64>> {
+    let id = ctx.params.get("audioLayer")?.as_layer()?;
+    let host = ctx.env.host?;
+    let dur = (dur_ms / 1000.0).max(0.001);
+    let frames = ((dur * AUDIO_RATE as f64) as usize).clamp(16, 1 << 16);
+    let start = ctx.env.comp_time + offset_ms / 1000.0 - dur * 0.5;
+    let s = host.audio(id, start, frames, AUDIO_RATE)?;
+    Some(
+        (0..frames)
+            .map(|i| {
+                let (l, r) = (*s.get(2 * i).unwrap_or(&0.0) as f64, *s.get(2 * i + 1).unwrap_or(&0.0) as f64);
+                match channel {
+                    1 => l,
+                    2 => r,
+                    _ => (l + r) * 0.5,
+                }
+            })
+            .collect(),
+    )
+}
+
+/// The drawing baseline: a polyline in buffer px (mask path or start→end line), sampled at
+/// parameter u∈[0,1] → (point, unit normal).
+struct Baseline {
+    pts: Vec<[f64; 2]>,
+    closed: bool,
+    len: f64,
+    polar: bool,
+    center: [f64; 2],
+    radius: f64,
+}
+
+impl Baseline {
+    fn new(ctx: &EffectCtx, b: &Buf) -> Baseline {
+        let pr = ctx.params;
+        let polar = pr.b("usePolarPath");
+        let (pts, closed) = match mask_px(ctx, b, pr.f("path").round() as usize) {
+            Some((p, c, _)) if !polar => (p, c),
+            _ => {
+                let s = b.to_px(pr.v2("startPoint"));
+                let e = b.to_px(pr.v2("endPoint"));
+                (vec![[s.0, s.1], [e.0, e.1]], false)
+            }
+        };
+        let len = poly_length(&pts, closed);
+        let center = pts[0];
+        let radius = if pts.len() > 1 { ((pts[1][0] - pts[0][0]).powi(2) + (pts[1][1] - pts[0][1]).powi(2)).sqrt() } else { 1.0 };
+        Baseline { pts, closed, len, polar, center, radius }
+    }
+    fn at(&self, u: f64) -> ([f64; 2], [f64; 2]) {
+        if self.polar {
+            let a = u * 2.0 * PI - PI * 0.5;
+            let (s, c) = a.sin_cos();
+            return ([self.center[0] + c * self.radius * 0.5, self.center[1] + s * self.radius * 0.5], [c, s]);
+        }
+        let (q, d) = crate::util::poly_point_at(&self.pts, self.closed, u * self.len);
+        (q, [d[1], -d[0]])
+    }
+}
+
+/// Draw line/dot marks with core (inside colour) and soft halo (outside colour).
+fn draw_marks(b: &mut Buf, segs_core: &[Seg], thickness: f64, softness: f64, inside: [f32; 4], outside: [f32; 4], composite: bool) {
+    let (w, h) = (b.img.width as usize, b.img.height as usize);
+    let core = raster_segs(w, h, segs_core, 1.0);
+    let halo_segs: Vec<Seg> = segs_core.iter().map(|s| Seg { r: s.r + thickness * softness.max(0.0) + 0.5, ..*s }).collect();
+    let halo = if softness > 0.0 { raster_segs(w, h, &halo_segs, 0.0) } else { core.clone() };
+    b.img.data.par_iter_mut().enumerate().for_each(|(i, px)| {
+        let (c, hl) = (core.data[i], halo.data[i]);
+        let a = c.max(hl);
+        let base = if composite { *px } else { [0.0; 4] };
+        if a <= 0.0 {
+            *px = base;
+            return;
+        }
+        let t = if a > 0.0 { c / a } else { 0.0 };
+        let col = crate::util::lerp3([outside[0], outside[1], outside[2]], [inside[0], inside[1], inside[2]], t);
+        *px = over(base, premul(col, a));
+    });
+}
+
+/// Audio Spectrum / Audio Waveform, shared with the GPU compositor (effectcraft-gpu `fx_gen2`):
+/// the marks (the audio analysis runs on the CPU) and how `draw_marks` colours them.
+#[derive(Clone, Debug)]
+pub struct MarksPlan {
+    pub segs: Vec<Seg>,
+    pub thickness: f64,
+    pub softness: f64,
+    pub inside: [f32; 4],
+    pub outside: [f32; 4],
+    pub composite: bool,
+}
+
+/// [`MarksPlan`] of Audio Spectrum or Audio Waveform on `b`'s geometry (`None` = no audio:
+/// the layer passes through).
+pub fn marks_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<MarksPlan> {
+    match id {
+        "ec.generate.audiospectrum" => spectrum_plan(ctx, b),
+        "ec.generate.audiowaveform" => waveform_plan(ctx, b),
+        _ => None,
+    }
+}
+
+fn marks(ctx: &EffectCtx, segs: Vec<Seg>, thick: f64, soft: f64) -> MarksPlan {
+    let pr = ctx.params;
+    MarksPlan {
+        segs,
+        thickness: thick,
+        softness: soft * 2.0,
+        inside: pr.color("insideColor"),
+        outside: pr.color("outsideColor"),
+        composite: pr.b("compositeOnOriginal"),
+    }
+}
+
+pub(super) fn audio_spectrum(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    if let Some(m) = spectrum_plan(ctx, &b) {
+        draw_marks(&mut b, &m.segs, m.thickness, m.softness, m.inside, m.outside, m.composite);
+    }
+    b
+}
+
+pub(super) fn audio_waveform(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    if let Some(m) = waveform_plan(ctx, &b) {
+        draw_marks(&mut b, &m.segs, m.thickness, m.softness, m.inside, m.outside, m.composite);
+    }
+    b
+}
+
+fn compute_fft_mags(samples: &[f64]) -> (usize, f64, Vec<f64>) {
+    let m = samples.len();
+    let n = m.next_power_of_two().max(64);
+    let mut re = vec![0.0; n];
+    let mut im = vec![0.0; n];
+    let denom = (m.max(2) - 1) as f64;
+    for (i, s) in samples.iter().enumerate() {
+        let w = 0.5 - 0.5 * (2.0 * PI * i as f64 / denom).cos();
+        if let Some(r) = re.get_mut(i) {
+            *r = s * w;
+        }
+    }
+    fft(&mut re, &mut im);
+    let hz_per_bin = AUDIO_RATE as f64 / n as f64;
+    let scale = 4.0 / m.max(1) as f64;
+    let num_bins = n / 2 + 1;
+    let mut mags = Vec::with_capacity(num_bins);
+    for k in 0..num_bins {
+        let r = re.get(k).copied().unwrap_or(0.0);
+        let im_val = im.get(k).copied().unwrap_or(0.0);
+        let mag = (r * r + im_val * im_val).sqrt() * scale;
+        mags.push(mag);
+    }
+    (n, hz_per_bin, mags)
+}
+
+fn spectrum_plan(ctx: &EffectCtx, b: &Buf) -> Option<MarksPlan> {
+    let pr = ctx.params;
+    let samples = audio_window(ctx, pr.f("audioDuration"), pr.f("audioOffset"), 0)?;
+    let (_n, hz_per_bin, mags) = compute_fft_mags(&samples);
+
+    let bands = pr.f("frequencyBands").round().clamp(1.0, 4096.0) as usize;
+    let f0 = pr.f("startFrequency").max(0.0);
+    let f1 = pr.f("endFrequency").max(f0 + 1.0);
+    let max_bin = mags.len().saturating_sub(1);
+
+    let get_band_mag = |fc: f64| -> f64 {
+        if mags.is_empty() || hz_per_bin <= 0.0 {
+            return 0.0;
+        }
+        let k_float = (fc / hz_per_bin).clamp(0.0, max_bin as f64);
+        let k0 = (k_float.floor() as usize).min(max_bin.saturating_sub(1));
+        let k1 = (k0 + 1).min(max_bin);
+        let frac = (k_float - k0 as f64).clamp(0.0, 1.0);
+        let m0 = mags.get(k0).copied().unwrap_or(0.0);
+        let m1 = mags.get(k1).copied().unwrap_or(0.0);
+        m0 * (1.0 - frac) + m1 * frac
+    };
+
+    let max_h = pr.f("maximumHeight") * b.scale;
+    let thick = (pr.f("thickness") * b.scale).max(0.1);
+    let soft = pr.f("softness") / 100.0;
+    let disp = pr.e("displayOptions");
+    let side = pr.e("sideOptions");
+    let base = Baseline::new(ctx, b);
+    let mut tops = Vec::with_capacity(bands);
+    let mut segs = Vec::new();
+    for i in 0..bands {
+        let u = if bands > 1 { i as f64 / (bands - 1) as f64 } else { 0.5 };
+        let fc = f0 + (f1 - f0) * u;
+        let v = get_band_mag(fc);
+        let hgt = if (v * max_h).is_finite() { (v * max_h).clamp(0.0, max_h.max(0.0)) } else { 0.0 };
+        let (q, nrm) = base.at(u);
+        let (ua, ub) = match side {
+            0 => (0.0, hgt),
+            1 => (-hgt, 0.0),
+            _ => (-hgt, hgt),
+        };
+        let pa = [q[0] + nrm[0] * ua, q[1] + nrm[1] * ua];
+        let pb = [q[0] + nrm[0] * ub, q[1] + nrm[1] * ub];
+        match disp {
+            0 => segs.push(Seg { a: pa, b: pb, r: thick * 0.5, v: 1.0 }),
+            _ => tops.push((pa, pb)),
+        }
+    }
+    if disp == 1 {
+        for w2 in tops.windows(2) {
+            segs.push(Seg { a: w2[0].1, b: w2[1].1, r: thick * 0.5, v: 1.0 });
+            if side == 2 {
+                segs.push(Seg { a: w2[0].0, b: w2[1].0, r: thick * 0.5, v: 1.0 });
+            }
+        }
+    } else if disp == 2 {
+        for &(pa, pb) in &tops {
+            segs.push(Seg { a: pb, b: pb, r: thick * 0.5, v: 1.0 });
+            if side == 2 {
+                segs.push(Seg { a: pa, b: pa, r: thick * 0.5, v: 1.0 });
+            }
+        }
+    }
+    Some(marks(ctx, segs, thick, soft))
+}
+
+fn waveform_plan(ctx: &EffectCtx, b: &Buf) -> Option<MarksPlan> {
+    let pr = ctx.params;
+    let samples = audio_window(ctx, pr.f("audioDuration"), pr.f("audioOffset"), pr.e("waveformOptions"))?;
+    let count = pr.f("displayedSamples").round().clamp(2.0, 4096.0) as usize;
+    let max_h = pr.f("maximumHeight") * b.scale;
+    let thick = (pr.f("thickness") * b.scale).max(0.1);
+    let soft = pr.f("softness") / 100.0;
+    let disp = pr.e("displayOptions");
+    let base = Baseline::new(ctx, b);
+    let m = samples.len();
+    let mut pts = Vec::with_capacity(count);
+    let mut segs = Vec::new();
+    for i in 0..count {
+        let u = i as f64 / (count - 1) as f64;
+        let a = ((u * (m - 1) as f64) as usize).min(m - 1);
+        let bnd = (((i + 1) as f64 / count as f64 * (m - 1) as f64) as usize).clamp(a, m - 1);
+        // Peak with sign of the window for a stable digital display.
+        let (mut lo, mut hi) = (0.0f64, 0.0f64);
+        for s in &samples[a..=bnd] {
+            lo = lo.min(*s);
+            hi = hi.max(*s);
+        }
+        let (q, nrm) = base.at(u);
+        match disp {
+            0 => segs.push(Seg {
+                a: [q[0] + nrm[0] * lo * max_h, q[1] + nrm[1] * lo * max_h],
+                b: [q[0] + nrm[0] * hi * max_h, q[1] + nrm[1] * hi * max_h],
+                r: thick * 0.5,
+                v: 1.0,
+            }),
+            _ => {
+                let v = samples[a] * max_h;
+                pts.push([q[0] + nrm[0] * v, q[1] + nrm[1] * v]);
+            }
+        }
+    }
+    if disp == 1 {
+        poly_segs(&pts, false, thick * 0.5, 1.0, &mut segs);
+    } else if disp == 2 {
+        segs.extend(pts.iter().map(|&q| Seg { a: q, b: q, r: thick * 0.5, v: 1.0 }));
+    }
+    Some(marks(ctx, segs, thick, soft))
+}
diff --git a/crates/effects/src/generate3/common.rs b/crates/effects/src/generate3/common.rs
new file mode 100644
index 000000000..7e341ad8d
--- /dev/null
+++ b/crates/effects/src/generate3/common.rs
@@ -0,0 +1,13 @@
+use super::{EffectSpec, ParamUi, Value, slider};
+
+pub(super) fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, render: crate::RenderFn) -> EffectSpec {
+    EffectSpec { id, name, category: "Generate", params, render, gpu: false, float: true }
+}
+
+pub(super) fn pt(x: f64, y: f64) -> Value {
+    Value::Vec2([x, y])
+}
+
+pub(super) fn pct() -> ParamUi {
+    slider(0.0, 100.0, 0.0, 100.0, 1)
+}
diff --git a/crates/effects/src/generate3/fill.rs b/crates/effects/src/generate3/fill.rs
new file mode 100644
index 000000000..5df782a89
--- /dev/null
+++ b/crates/effects/src/generate3/fill.rs
@@ -0,0 +1,337 @@
+use super::raster::over;
+use super::{
+    Buf, EffectCtx, IndexedParallelIterator, IntoParallelRefIterator, IntoParallelRefMutIterator, PI, ParallelIterator, Plane, Px, gauss_plane, hash1,
+    hsl_to_rgb, morph_frac, premul, rgb_to_hsl, smoothstep, unpremul,
+};
+
+pub(super) fn glue_gun(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let q = b.to_px(pr.v2("brushPosition"));
+    let rad = (pr.f("strokeWidth") * b.scale * 0.5).max(0.5);
+    let density = pr.f("density").max(0.0);
+    let refl = pr.f("reflection").to_radians();
+    let strength = (pr.f("strength") / 100.0) as f32;
+    let glue_only = pr.e("style") == 1;
+    let src = b.img.clone();
+    let light = [refl.cos() * 0.6, -refl.sin() * 0.6, 0.53];
+    let beads = (density.round() as usize).clamp(1, 32);
+    let seed = ctx.seed;
+    let centers: Vec<([f64; 2], f64)> = (0..beads)
+        .map(|i| {
+            let a = hash1(i as u32, 1, seed) as f64 * 2.0 * PI;
+            let d = if i == 0 { 0.0 } else { hash1(i as u32, 2, seed) as f64 * rad * 0.35 };
+            ([q.0 + a.cos() * d, q.1 + a.sin() * d], rad * (0.75 + 0.25 * hash1(i as u32, 3, seed) as f64))
+        })
+        .collect();
+    b.img.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let (fx, fy) = (x as f64 + 0.5, y as f64 + 0.5);
+            // Height field: union of hemispheres.
+            let mut best = (0.0f64, [0.0f64; 2], 1.0f64);
+            for &(c, r) in &centers {
+                let (dx, dy) = ((fx - c[0]) / r, (fy - c[1]) / r);
+                let d2 = dx * dx + dy * dy;
+                if d2 < 1.0 {
+                    let hgt = (1.0 - d2).sqrt();
+                    if hgt > best.0 {
+                        best = (hgt, [dx, dy], r);
+                    }
+                }
+            }
+            if best.0 <= 0.0 {
+                if glue_only {
+                    *px = [0.0; 4];
+                }
+                continue;
+            }
+            let nrm = [best.1[0], best.1[1], best.0];
+            let ndl = (nrm[0] * light[0] + nrm[1] * light[1] + nrm[2] * light[2]).max(0.0);
+            let spec = ndl.powi(24) as f32;
+            // Refraction: look through the bead.
+            let s = src.sample_bilinear_clamped(fx - nrm[0] * best.2 * 0.5 * strength as f64, fy - nrm[1] * best.2 * 0.5 * strength as f64);
+            let edge = smoothstep(0.0, 0.15, best.0 as f32);
+            let shade = 0.65 + 0.35 * ndl as f32;
+            let g = [s[0] * shade + spec, s[1] * shade + spec, s[2] * shade + spec, s[3].max(0.6)];
+            let gp = [g[0].min(g[3] + spec), g[1].min(g[3] + spec), g[2].min(g[3] + spec), g[3].min(1.0)];
+            let base = if glue_only { [0.0; 4] } else { *px };
+            *px = crate::util::lerp4(base, gp, edge * strength.clamp(0.0, 1.0).max(0.3));
+            px[3] = px[3].clamp(0.0, 1.0);
+        }
+    });
+    b
+}
+
+// ---------------------------------------------------------------- Paint Bucket
+
+/// Paint Bucket's filled region (1 inside) on `b`: the flood fill from the Fill Point over the
+/// layer's pixels (shared with the GPU compositor, which reads the layer back for it).
+pub fn paint_bucket_region(ctx: &EffectCtx, b: &Buf) -> Plane {
+    let pr = ctx.params;
+    let (w, h) = (b.img.width as usize, b.img.height as usize);
+    let fp = b.to_px(pr.v2("fillPoint"));
+    let (sx, sy) = (fp.0.floor() as i64, fp.1.floor() as i64);
+    let sel = pr.e("fillSelector");
+    let tol = (pr.f("tolerance") / 255.0) as f32;
+    let key = |p: Px| -> [f32; 4] {
+        let (c, a) = unpremul(p);
+        match sel {
+            1 => [c[0], c[1], c[2], 0.0],
+            2 => [0.0, 0.0, 0.0, if a <= 1e-3 { 0.0 } else { 1.0 }],
+            3 | 4 => [0.0, 0.0, 0.0, a],
+            _ => p,
+        }
+    };
+    let mut region = Plane::new(w, h);
+    if sx >= 0 && sy >= 0 && (sx as usize) < w && (sy as usize) < h {
+        let seed = key(b.img.data[sy as usize * w + sx as usize]);
+        let within = |i: usize| {
+            let k = key(b.img.data[i]);
+            if sel == 2 {
+                return k[3] == seed[3];
+            }
+            (0..4).all(|j| (k[j] - seed[j]).abs() <= tol + 1e-6)
+        };
+        let mut seen = vec![false; w * h];
+        let mut stack = vec![(sx as usize, sy as usize)];
+        while let Some((x, y)) = stack.pop() {
+            let row = y * w;
+            if seen[row + x] || !within(row + x) {
+                continue;
+            }
+            let mut l = x;
+            while l > 0 && !seen[row + l - 1] && within(row + l - 1) {
+                l -= 1;
+            }
+            let mut r = x;
+            while r + 1 < w && !seen[row + r + 1] && within(row + r + 1) {
+                r += 1;
+            }
+            for i in l..=r {
+                seen[row + i] = true;
+                region.data[row + i] = 1.0;
+                if y > 0 && !seen[row - w + i] {
+                    stack.push((i, y - 1));
+                }
+                if y + 1 < h && !seen[row + w + i] {
+                    stack.push((i, y + 1));
+                }
+            }
+        }
+    }
+    region
+}
+
+pub(super) fn paint_bucket(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let (w, h) = (b.img.width as usize, b.img.height as usize);
+    if w == 0 || h == 0 {
+        return b;
+    }
+    let region = paint_bucket_region(ctx, &b);
+    if pr.b("viewThreshold") {
+        b.img.data.par_iter_mut().zip(region.data.par_iter()).for_each(|(px, &v)| *px = [v, v, v, 1.0]);
+        return b;
+    }
+    let sc = b.scale;
+    let mut cov = match pr.e("stroke") {
+        1 => {
+            let s = pr.f("featherSoftness") * sc * 0.5;
+            if s > 0.05 { gauss_plane(&region, s, s) } else { region.clone() }
+        }
+        2 => morph_frac(&region, pr.f("spreadRadius") * sc, true),
+        3 => morph_frac(&region, pr.f("spreadRadius") * sc, false),
+        4 => {
+            let r = pr.f("strokeWidth") * sc;
+            let out = morph_frac(&region, r * 0.5, true);
+            let inn = morph_frac(&region, r * 0.5, false);
+            out.zip_map(&inn, |a, b| (a - b).max(0.0))
+        }
+        _ => gauss_plane(&region, 0.5, 0.5),
+    };
+    if pr.e("stroke") == 0 {
+        // Antialias: keep the hard interior, soften only the boundary.
+        cov = cov.zip_map(&region, |a, r| if r > 0.0 { a.max(0.5) } else { a });
+    }
+    let color = pr.color("color");
+    let op = (pr.f("opacity") / 100.0) as f32;
+    let mode = pr.e("blendingMode");
+    b.img.data.par_iter_mut().zip(cov.data.par_iter()).for_each(|(px, &c)| {
+        let k = (c * op * color[3]).clamp(0.0, 1.0);
+        if k <= 0.0 {
+            if mode == 9 {
+                *px = [0.0; 4];
+            }
+            return;
+        }
+        let (dc, da) = unpremul(*px);
+        let fc = [color[0], color[1], color[2]];
+        let mixed = match mode {
+            1 => [dc[0] + fc[0], dc[1] + fc[1], dc[2] + fc[2]],
+            2 => [dc[0] * fc[0], dc[1] * fc[1], dc[2] * fc[2]],
+            3 => [1.0 - (1.0 - dc[0]) * (1.0 - fc[0]), 1.0 - (1.0 - dc[1]) * (1.0 - fc[1]), 1.0 - (1.0 - dc[2]) * (1.0 - fc[2])],
+            4..=7 => {
+                let (dh, ds, dl) = rgb_to_hsl(dc[0], dc[1], dc[2]);
+                let (fh, fs, fl) = rgb_to_hsl(fc[0], fc[1], fc[2]);
+                let (r, g, bl) = match mode {
+                    4 => hsl_to_rgb(fh, ds, dl),
+                    5 => hsl_to_rgb(dh, fs, dl),
+                    6 => hsl_to_rgb(fh, fs, dl),
+                    _ => hsl_to_rgb(dh, ds, fl),
+                };
+                [r, g, bl]
+            }
+            _ => fc,
+        };
+        *px = match mode {
+            8 => over(premul(fc, k), *px),
+            9 => premul(fc, k),
+            0 => over(*px, premul(fc, k)),
+            _ => {
+                if da <= 1e-6 {
+                    return;
+                }
+                let c3 = crate::util::lerp3(dc, mixed, k);
+                premul(c3, da)
+            }
+        };
+    });
+    b
+}
+
+// ---------------------------------------------------------------- Eyedropper Fill
+
+pub(super) fn eyedropper_fill(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let fill = eyedropper_color(ctx, &b);
+    let keep_alpha = pr.b("maintainOriginalAlpha");
+    let blend = (pr.f("blendWithOriginal") / 100.0) as f32;
+    b.img.data.par_iter_mut().for_each(|px| {
+        let a = if keep_alpha { px[3] } else { fill[3] };
+        let f = premul([fill[0], fill[1], fill[2]], a);
+        *px = crate::util::lerp4(f, *px, blend);
+    });
+    b
+}
+
+/// Eyedropper Fill's sampled colour (straight RGB, alpha) from the layer's pixels (shared with
+/// the GPU compositor, which reads the layer back for it).
+pub fn eyedropper_color(ctx: &EffectCtx, b: &Buf) -> Px {
+    let pr = ctx.params;
+    let (w, h) = (b.img.width as i64, b.img.height as i64);
+    let c = b.to_px(pr.v2("samplePoint"));
+    let r = (pr.f("sampleRadius") * b.scale).max(0.0);
+    let mode = pr.e("averagePixelColors");
+    let (cx, cy) = (c.0.floor() as i64, c.1.floor() as i64);
+    let ri = r.ceil() as i64;
+    let mut acc = [0.0f64; 4];
+    let mut n = 0.0f64;
+    for y in (cy - ri).max(0)..=(cy + ri).min(h - 1) {
+        for x in (cx - ri).max(0)..=(cx + ri).min(w - 1) {
+            if ((x - cx).pow(2) + (y - cy).pow(2)) as f64 > r * r + 0.5 {
+                continue;
+            }
+            let px = b.img.data[(y * w + x) as usize];
+            match mode {
+                0 => {
+                    if px[3] > 1e-4 {
+                        let (s, _) = unpremul(px);
+                        for k in 0..3 {
+                            acc[k] += s[k] as f64;
+                        }
+                        acc[3] += 1.0;
+                        n += 1.0;
+                    }
+                }
+                1 => {
+                    let (s, _) = unpremul(px);
+                    for k in 0..3 {
+                        acc[k] += s[k] as f64;
+                    }
+                    acc[3] += 1.0;
+                    n += 1.0;
+                }
+                2 => {
+                    for k in 0..3 {
+                        acc[k] += px[k] as f64;
+                    }
+                    acc[3] += 1.0;
+                    n += 1.0;
+                }
+                _ => {
+                    for k in 0..4 {
+                        acc[k] += px[k] as f64;
+                    }
+                    n += 1.0;
+                }
+            }
+        }
+    }
+    if n > 0.0 {
+        if mode == 3 {
+            let a = (acc[3] / n) as f32;
+            let s = if a > 1e-6 { [(acc[0] / n) as f32 / a, (acc[1] / n) as f32 / a, (acc[2] / n) as f32 / a] } else { [0.0; 3] };
+            [s[0], s[1], s[2], a]
+        } else {
+            [(acc[0] / n) as f32, (acc[1] / n) as f32, (acc[2] / n) as f32, 1.0]
+        }
+    } else {
+        [0.0, 0.0, 0.0, 0.0]
+    }
+}
+
+// ---------------------------------------------------------------- CC Threads
+
+pub(super) fn threads(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let sc = b.scale;
+    let tw = (pr.f("width") * sc).max(1.0);
+    let th = (pr.f("height") * sc).max(1.0);
+    let overlaps = pr.f("overlaps").round().clamp(1.0, 20.0) as i64;
+    let ang = pr.f("direction").to_radians();
+    let (sn, cs) = ang.sin_cos();
+    let c = b.to_px(pr.v2("center"));
+    let coverage = (pr.f("coverage") / 100.0).clamp(0.0, 1.0);
+    let shadow = (pr.f("shadowing") / 100.0) as f32;
+    let texture = (pr.f("texture") / 100.0) as f32;
+    let src = b.img.clone();
+    let to_px = |u: f64, v: f64| (c.0 + u * cs - v * sn, c.1 + u * sn + v * cs);
+    b.img.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let (dx, dy) = (x as f64 + 0.5 - c.0, y as f64 + 0.5 - c.1);
+            let u = dx * cs + dy * sn;
+            let v = -dx * sn + dy * cs;
+            let (ci, cj) = ((u / tw).floor() as i64, (v / th).floor() as i64);
+            let (fu, fv) = (u / tw - ci as f64, v / th - cj as f64);
+            // Horizontal thread j occupies the band |fv-0.5| < coverage/2; vertical thread i the
+            // band |fu-0.5| < coverage/2.
+            let in_h = (fv - 0.5).abs() < coverage * 0.5;
+            let in_v = (fu - 0.5).abs() < coverage * 0.5;
+            // Twill: horizontal is on top when (i + j) mod (2·overlaps) < overlaps.
+            let h_top = (ci + cj).rem_euclid(2 * overlaps) < overlaps;
+            let which = match (in_h, in_v) {
+                (true, true) => Some(h_top),
+                (true, false) => Some(true),
+                (false, true) => Some(false),
+                _ => None,
+            };
+            let Some(horizontal) = which else {
+                *px = [0.0; 4];
+                continue;
+            };
+            // Thread colour: the source sampled along the thread centre line.
+            let (sx, sy) = if horizontal { to_px(u, (cj as f64 + 0.5) * th) } else { to_px((ci as f64 + 0.5) * tw, v) };
+            let s = src.sample_bilinear_clamped(sx, sy);
+            // Round profile across the thread + darkening where it dives under its neighbour.
+            let across = if horizontal { (fv - 0.5) / (coverage * 0.5).max(1e-6) } else { (fu - 0.5) / (coverage * 0.5).max(1e-6) };
+            let along = if horizontal { fu } else { fv };
+            let profile = (1.0 - across * across).max(0.0).sqrt() as f32;
+            let dive = 1.0 - (along - 0.5).abs() as f32 * 2.0;
+            let shade = 1.0 - shadow * (1.0 - profile) * 0.8 - shadow * 0.25 * (1.0 - dive) * if horizontal == h_top { 0.0 } else { 1.0 };
+            let fib =
+                if texture > 0.0 { 1.0 - texture * 0.3 * hash1((along * 64.0) as u32, (across * 8.0 + 8.0) as u32, ci as u32 ^ (cj as u32) << 8) } else { 1.0 };
+            let k = (shade * fib).max(0.0);
+            *px = [s[0] * k, s[1] * k, s[2] * k, s[3]];
+        }
+    });
+    b
+}
diff --git a/crates/effects/src/generate3/fractal.rs b/crates/effects/src/generate3/fractal.rs
new file mode 100644
index 000000000..05a76d5f0
--- /dev/null
+++ b/crates/effects/src/generate3/fractal.rs
@@ -0,0 +1,193 @@
+use super::raster::over;
+use super::{Buf, EffectCtx, IndexedParallelIterator, ParallelIterator, ParallelSliceMut, Px, hsl_to_rgb};
+
+// ---------------------------------------------------------------- Fractal
+
+#[derive(Clone, Copy)]
+struct FracSet {
+    /// Mandelbrot iterations start at the Julia centre (the "Over Julia" set choices).
+    over_julia: bool,
+    julia: bool,
+    inverse: bool,
+}
+
+/// Smooth escape count, or `None` inside the set.
+fn escape(z0: (f64, f64), c: (f64, f64), power: u32, limit: f64, max_iter: u32) -> Option<f64> {
+    let (mut x, mut y) = z0;
+    let lim2 = limit * limit;
+    for i in 0..max_iter {
+        let (nx, ny) = match power {
+            3 => (x * x * x - 3.0 * x * y * y, 3.0 * x * x * y - y * y * y),
+            4 => {
+                let (a, b) = (x * x - y * y, 2.0 * x * y);
+                (a * a - b * b, 2.0 * a * b)
+            }
+            _ => (x * x - y * y, 2.0 * x * y),
+        };
+        x = nx + c.0;
+        y = ny + c.1;
+        let m2 = x * x + y * y;
+        if m2 > lim2 {
+            let lz = m2.ln() * 0.5;
+            let nu = (lz / limit.max(1.0001).ln()).max(1e-9).ln() / (power as f64).ln();
+            return Some((i as f64 + 1.0 - nu).max(0.0));
+        }
+    }
+    None
+}
+
+/// Fractal Set Choice options.
+pub(crate) const FRACTAL_SETS: [&str; 6] =
+    ["Mandelbrot", "Mandelbrot Inverse", "Mandelbrot Over Julia", "Mandelbrot Inverse Over Julia", "Julia", "Julia Inverse"];
+
+/// Fractal Palette options.
+pub(crate) const FRACTAL_PALETTES: [&str; 4] = ["Lightness Gradient", "Hue Wheel", "Black And White", "Solid Color"];
+
+/// Fractal Oversample Method options.
+pub(crate) const FRACTAL_OVERSAMPLE: [&str; 2] = ["Edge Detect-Fast-May Miss Pixels", "Brute Force-Slow-Every Pixel"];
+
+pub(super) fn fractal(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let set_choice = pr.e("setChoice");
+    let power = 2 + pr.e("equation").min(2);
+    let mc = (pr.f("mandelbrot/mandelbrotX"), pr.f("mandelbrot/mandelbrotY"));
+    let mmag = pr.f("mandelbrot/mandelbrotMagnification");
+    let mlim = pr.f("mandelbrot/mandelbrotEscapeLimit").max(1.01);
+    let jc = (pr.f("julia/juliaX"), pr.f("julia/juliaY"));
+    let jmag = pr.f("julia/juliaMagnification");
+    let jlim = pr.f("julia/juliaEscapeLimit").max(1.01);
+    let post = (pr.f("postInversionOffset/postInversionX"), pr.f("postInversionOffset/postInversionY"));
+    let overlay = pr.b("fractalColor/overlay");
+    let transparency = pr.b("fractalColor/transparency");
+    let transparent_inside = transparency || overlay;
+    let palette = pr.e("fractalColor/palette");
+    let hue = (pr.f("fractalColor/hue") / 360.0) as f32;
+    let steps = pr.f("fractalColor/cycleSteps").max(1.0);
+    let cyc_off = pr.f("fractalColor/cycleOffset") / 360.0;
+    let edge = pr.b("fractalColor/edgeHighlight");
+    let every = pr.e("highQualitySettings/samplingMethod") == 1;
+    let factor = pr.f("highQualitySettings/samplingFactor").round().clamp(1.0, 9.0) as usize;
+    let (w, h) = (b.img.width as usize, b.img.height as usize);
+    let lw = ctx.layer_size[0].max(1.0);
+    let lh = ctx.layer_size[1].max(1.0);
+    let inv = 1.0 / b.scale.max(1e-9);
+    let (off_x, off_y) = (b.offset[0], b.offset[1]);
+    // FRACTAL_SETS order.
+    let set = |julia, inverse, over_julia| FracSet { over_julia, julia, inverse };
+    let sets: (FracSet, Option<FracSet>) = match set_choice {
+        1 => (set(false, true, false), None),
+        2 => (set(false, false, true), None),
+        3 => (set(false, true, true), None),
+        4 => (set(true, false, false), None),
+        5 => (set(true, true, false), None),
+        _ => (set(false, false, false), None),
+    };
+    let iter_for = |mag: f64| (96.0 + 48.0 * mag.max(0.0)).clamp(64.0, 3000.0) as u32;
+    let eval_set = |s: FracSet, lx: f64, ly: f64| -> Option<f64> {
+        let (center, mag, lim) = if s.julia { (jc, jmag, jlim) } else { (mc, mmag, mlim) };
+        let span = 3.5 / 2f64.powf(mag);
+        let mut u = (lx - lw * 0.5) / lw * span + center.0;
+        let mut v = (ly - lh * 0.5) / lw * span + center.1;
+        if s.inverse {
+            let d = (u * u + v * v).max(1e-12);
+            u = u / d + post.0;
+            v = -v / d + post.1;
+        }
+        if s.julia {
+            escape((u, v), mc, power, lim, iter_for(mag))
+        } else {
+            let z0 = if s.over_julia { jc } else { (0.0, 0.0) };
+            escape(z0, (u, v), power, lim, iter_for(mag))
+        }
+    };
+    let eval = |lx: f64, ly: f64| -> Option<f64> {
+        let a = eval_set(sets.0, lx, ly);
+        match (a, sets.1) {
+            (None, Some(s2)) => eval_set(s2, lx, ly),
+            _ => a,
+        }
+    };
+    let shade = |n: Option<f64>| -> Px {
+        // Solid Color: only the inside of the set is drawn (Transparency flips the sides).
+        if palette == 3 {
+            let (r, g, bl) = hsl_to_rgb(hue, 1.0, 0.5);
+            return if n.is_none() != transparency { [r, g, bl, 1.0] } else { [0.0; 4] };
+        }
+        let Some(n) = n else {
+            return if transparent_inside { [0.0; 4] } else { [0.0, 0.0, 0.0, 1.0] };
+        };
+        let u = n / steps + cyc_off;
+        let band = (u.rem_euclid(1.0)) as f32;
+        let (r, g, bl) = match palette {
+            // Hue Wheel: the full hue circle at full saturation and brightness.
+            1 => hsl_to_rgb((hue + band).rem_euclid(1.0), 1.0, 0.5),
+            // Black And White: alternating bands.
+            2 => {
+                let v = if (u.floor() as i64).rem_euclid(2) == 0 { 0.0 } else { 1.0 };
+                (v, v, v)
+            }
+            // Lightness Gradient: black → hue → white, the hue moving 45° each cycle.
+            _ => hsl_to_rgb((hue + u.floor() as f32 * 0.125).rem_euclid(1.0), 0.85, band.clamp(0.0, 1.0)),
+        };
+        let mut c = [r, g, bl];
+        if edge && n.fract() < 0.12 {
+            c = [c[0] * 0.4 + 0.6, c[1] * 0.4 + 0.6, c[2] * 0.4 + 0.6];
+        }
+        [c[0], c[1], c[2], 1.0]
+    };
+    // First pass: one sample per pixel.
+    let mut first: Vec<Option<f64>> = vec![None; w * h];
+    first.par_chunks_mut(w.max(1)).enumerate().for_each(|(y, row)| {
+        for (x, v) in row.iter_mut().enumerate() {
+            *v = eval((x as f64 + 0.5 - off_x) * inv, (y as f64 + 0.5 - off_y) * inv);
+        }
+    });
+    let src = if overlay { Some(b.img.clone()) } else { None };
+    b.img.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let here = first[y * w + x];
+            let needs_ss = factor > 1
+                && (every || {
+                    let mut diff = false;
+                    for (dx, dy) in [(-1i64, 0i64), (1, 0), (0, -1), (0, 1)] {
+                        let (nx, ny) = (x as i64 + dx, y as i64 + dy);
+                        if nx < 0 || ny < 0 || nx >= w as i64 || ny >= h as i64 {
+                            continue;
+                        }
+                        let o = first[ny as usize * w + nx as usize];
+                        diff |= match (here, o) {
+                            (Some(a), Some(c)) => (a - c).abs() > steps * 0.25,
+                            (None, None) => false,
+                            _ => true,
+                        };
+                    }
+                    diff
+                });
+            let c = if needs_ss {
+                let mut acc = [0.0f32; 4];
+                for sy in 0..factor {
+                    for sx in 0..factor {
+                        let fx = x as f64 + (sx as f64 + 0.5) / factor as f64;
+                        let fy = y as f64 + (sy as f64 + 0.5) / factor as f64;
+                        let s = shade(eval((fx - off_x) * inv, (fy - off_y) * inv));
+                        let a = s[3];
+                        for k in 0..3 {
+                            acc[k] += s[k] * a;
+                        }
+                        acc[3] += a;
+                    }
+                }
+                let n = (factor * factor) as f32;
+                [acc[0] / n, acc[1] / n, acc[2] / n, acc[3] / n]
+            } else {
+                let s = shade(here);
+                [s[0] * s[3], s[1] * s[3], s[2] * s[3], s[3]]
+            };
+            *px = match &src {
+                Some(o) => over(o.data[y * w + x], c),
+                None => c,
+            };
+        }
+    });
+    b
+}
diff --git a/crates/effects/src/generate3/paths.rs b/crates/effects/src/generate3/paths.rs
new file mode 100644
index 000000000..9158a274e
--- /dev/null
+++ b/crates/effects/src/generate3/paths.rs
@@ -0,0 +1,565 @@
+use super::raster::{Seg, all_masks_px, chaikin, mask_px, over, poly_segs, raster_convex, raster_segs, scan_runs, stroke_outline, trim_poly};
+use super::{
+    Buf, EffectCtx, Image, IndexedParallelIterator, IntoParallelRefIterator, IntoParallelRefMutIterator, ParallelIterator, Params, Plane, gauss_plane, hash1,
+    layer_or_self, luminance, poly_length, smoothstep, unpremul,
+};
+
+/// How painted coverage meets the layer: 0 On Original Image, 1 On Transparent, 2 Reveal
+/// Original Image.
+pub(crate) fn paint(img: &mut Image, cov: &Plane, color: [f32; 4], opacity: f32, style: u32) {
+    img.data.par_iter_mut().zip(cov.data.par_iter()).for_each(|(px, &c)| {
+        let a = (c * opacity * color[3]).clamp(0.0, 1.0);
+        let s = [color[0] * a, color[1] * a, color[2] * a, a];
+        *px = match style {
+            1 => s,
+            2 => [px[0] * a, px[1] * a, px[2] * a, px[3] * a],
+            _ => over(*px, s),
+        };
+    });
+}
+
+/// Coverage of a plan-drawn generator: round-capped segments rasterised by `raster_segs`
+/// with `hardness`, or the union of convex polygons (`raster_convex`).
+#[derive(Clone, Debug)]
+pub enum Coverage {
+    Segs { segs: Vec<Seg>, hardness: f64 },
+    Convex(Vec<Vec<[f64; 2]>>),
+}
+
+impl Coverage {
+    fn raster(&self, w: usize, h: usize) -> Plane {
+        match self {
+            Coverage::Segs { segs, hardness } => raster_segs(w, h, segs, *hardness),
+            Coverage::Convex(polys) => raster_convex(w, h, polys),
+        }
+    }
+}
+
+/// Stroke, Scribble, Vegas and Write-on, shared with the GPU compositor (effectcraft-gpu
+/// `fx_gen2`): the coverage and how it is painted. `style` 0–2 as `paint` (On Original
+/// Image, On Transparent, Reveal Original Image), 3 = under the layer (Vegas' Composite Under).
+#[derive(Clone, Debug)]
+pub struct PaintPlan {
+    pub cov: Coverage,
+    pub color: [f32; 4],
+    pub opacity: f32,
+    pub style: u32,
+}
+
+/// Draw a [`PaintPlan`].
+fn draw_paint(b: &mut Buf, plan: &PaintPlan) {
+    let cov = plan.cov.raster(b.img.width as usize, b.img.height as usize);
+    if plan.style == 3 {
+        let color = plan.color;
+        b.img.data.par_iter_mut().zip(cov.data.par_iter()).for_each(|(px, &c)| {
+            let a = c * color[3];
+            *px = over([color[0] * a, color[1] * a, color[2] * a, a], *px);
+        });
+    } else {
+        paint(&mut b.img, &cov, plan.color, plan.opacity, plan.style);
+    }
+}
+
+/// Generators drawn from a plan that need the layer's own pixels (`b.img`) to build it.
+pub fn plan_reads_pixels(id: &str, ctx: &EffectCtx) -> bool {
+    match id {
+        // Image Contours read the layer itself when no (resolvable) Input Layer is chosen.
+        "ec.generate.vegas" => ctx.params.e("stroke") == 0,
+        "ec.generate.paintbucket" | "ec.generate.eyedropperfill" => true,
+        "ec.generate.advancedlightning" => ctx.params.f("alphaObstacle").clamp(-10.0, 10.0) != 0.0,
+        _ => false,
+    }
+}
+
+/// [`PaintPlan`] of Stroke, Scribble, Vegas or Write-on on `b`'s geometry (`b.img` is read
+/// only when [`plan_reads_pixels`]). `None`: Scribble without a usable mask (the layer is
+/// cleared when it composites On Transparent, else kept).
+pub fn paint_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<PaintPlan> {
+    match id {
+        "ec.generate.stroke" => Some(stroke_plan(ctx, b)),
+        "ec.generate.scribble" => scribble_plan(ctx, b),
+        "ec.generate.vegas" => Some(vegas_plan(ctx, b)),
+        "ec.generate.writeon" => Some(write_on_plan(ctx, b)),
+        _ => None,
+    }
+}
+
+/// Scribble's Composite as a `paint` style.
+pub fn scribble_style(ctx: &EffectCtx) -> u32 {
+    match ctx.params.e("composite") {
+        0 => 0,
+        2 => 2,
+        _ => 1,
+    }
+}
+
+pub(super) fn scribble(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    match scribble_plan(ctx, &b) {
+        Some(plan) => draw_paint(&mut b, &plan),
+        None if scribble_style(ctx) == 1 => b.img = Image::new(b.img.width, b.img.height),
+        None => {}
+    }
+    b
+}
+
+fn scribble_plan(ctx: &EffectCtx, b: &Buf) -> Option<PaintPlan> {
+    let pr = ctx.params;
+    let which = pr.e("scribble");
+    let polys: Vec<_> = if which == 0 { mask_px(ctx, b, pr.f("mask").round().max(1.0) as usize).into_iter().collect() } else { all_masks_px(ctx, b) };
+    let polys: Vec<_> = polys.into_iter().filter(|p| p.0.len() >= 3).map(|(p, c, i)| (p, c, i && which == 2)).collect();
+    let style = scribble_style(ctx);
+    if polys.is_empty() {
+        return None;
+    }
+    let sc = b.scale;
+    let fill = pr.e("fillType");
+    let ew = pr.f("edgeOptions/edgeWidth").max(0.1) * sc;
+    let ang = pr.f("angle").to_radians();
+    let d = [ang.cos(), ang.sin()];
+    let n = [-d[1], d[0]];
+    let width = (pr.f("strokeWidth") * sc).max(0.1);
+    let curv = pr.f("strokeOptions/curviness") / 100.0;
+    let curv_var = pr.f("strokeOptions/curvinessVariation") / 100.0;
+    let spacing = (pr.f("strokeOptions/spacing") * sc).max(0.75).max(width * 0.25);
+    let spacing_var = pr.f("strokeOptions/spacingVariation") / 100.0;
+    let overlap = pr.f("strokeOptions/pathOverlap") / 100.0;
+    let overlap_var = pr.f("strokeOptions/pathOverlapVariation") / 100.0;
+    let start = pr.f("start").clamp(0.0, 100.0) / 100.0;
+    let end = pr.f("end").clamp(0.0, 100.0) / 100.0;
+    let sequential = pr.b("fillPathsSequentially");
+    let wiggle = pr.e("wiggleType");
+    let wps = pr.f("wigglesPerSecond").max(0.0);
+    let seed = pr.f("randomSeed") as i64 as u32 ^ ctx.seed;
+    let (step, frac) = match wiggle {
+        0 => (0u32, 0.0f32),
+        1 => ((ctx.time * wps).floor().max(0.0) as u32, 0.0),
+        _ => {
+            let u = (ctx.time * wps).max(0.0);
+            (u.floor() as u32, smoothstep(0.0, 1.0, u.fract() as f32))
+        }
+    };
+    let rnd = |i: u32, k: u32| {
+        let a = hash1(i, k.wrapping_mul(31).wrapping_add(step.wrapping_mul(7919)), seed) * 2.0 - 1.0;
+        if frac > 0.0 {
+            let c = hash1(i, k.wrapping_mul(31).wrapping_add((step + 1).wrapping_mul(7919)), seed) * 2.0 - 1.0;
+            a + (c - a) * frac
+        } else {
+            a
+        }
+    };
+    let groups: Vec<Vec<(Vec<[f64; 2]>, bool, bool)>> =
+        if which == 0 || sequential { vec![polys.clone()] } else { polys.iter().map(|p| vec![p.clone()]).collect() };
+    // Per group a zig-zag polyline (in buffer px).
+    let mut lines: Vec<Vec<Vec<[f64; 2]>>> = Vec::new();
+    let mut runs = Vec::new();
+    for (gi, g) in groups.iter().enumerate() {
+        let mut nmin = f64::INFINITY;
+        let mut nmax = f64::NEG_INFINITY;
+        for (pts, _, _) in g {
+            for q in pts {
+                let v = q[0] * n[0] + q[1] * n[1];
+                nmin = nmin.min(v);
+                nmax = nmax.max(v);
+            }
+        }
+        nmin -= ew;
+        nmax += ew;
+        // Chains of zig-zags: each run joins the nearest chain that ended on the previous
+        // scan line (so separate regions get separate strokes).
+        let mut chains: Vec<(Vec<[f64; 2]>, u32)> = Vec::new();
+        let mut s = nmin + spacing * 0.5;
+        let mut li = 0u32;
+        let reach = spacing * 3.0 + ew;
+        while s < nmax && li < 20_000 {
+            scan_runs(g, fill, ew, d, n, s, &mut runs);
+            for (ri, &(a, bb)) in runs.iter().enumerate() {
+                let k = (gi as u32) << 20 | ri as u32;
+                let ov = spacing * (overlap + overlap_var * rnd(li, k * 4) as f64 * 0.5).max(-0.45);
+                let ov2 = spacing * (overlap + overlap_var * rnd(li, k * 4 + 1) as f64 * 0.5).max(-0.45);
+                let (a, bb) = (a - ov, bb + ov2);
+                if bb <= a {
+                    continue;
+                }
+                let at = |t: f64| [d[0] * t + n[0] * s, d[1] * t + n[1] * s];
+                let (pa, pb) = (at(a), at(bb));
+                let dist = |p: [f64; 2], q: [f64; 2]| ((p[0] - q[0]).powi(2) + (p[1] - q[1]).powi(2)).sqrt();
+                let best = chains
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, c)| li > 0 && c.1 == li - 1)
+                    .map(|(i, c)| {
+                        let last = *c.0.last().unwrap_or(&pa);
+                        (i, dist(last, pa).min(dist(last, pb)))
+                    })
+                    .filter(|&(_, dd)| dd < reach)
+                    .min_by(|x, y| x.1.total_cmp(&y.1));
+                match best {
+                    Some((ci, _)) => {
+                        let last = *chains[ci].0.last().unwrap_or(&pa);
+                        let (p0, p1, dir) = if dist(last, pa) <= dist(last, pb) { (pa, pb, -1.0) } else { (pb, pa, 1.0) };
+                        // Curved turn: an extra point pushed past the edge.
+                        let c = (curv + curv_var * rnd(li, k * 4 + 2) as f64 * 0.5).max(0.0);
+                        let mid = [(last[0] + p0[0]) * 0.5 + d[0] * dir * c * spacing, (last[1] + p0[1]) * 0.5 + d[1] * dir * c * spacing];
+                        let ch = &mut chains[ci];
+                        ch.0.extend([mid, p0, p1]);
+                        ch.1 = li;
+                    }
+                    None => chains.push((vec![pa, pb], li)),
+                }
+            }
+            s += spacing * (1.0 + spacing_var * rnd(li, 3) as f64 * 0.5).max(0.25);
+            li += 1;
+        }
+        lines.push(chains.into_iter().map(|(z, _)| if curv > 0.0 { chaikin(&z, 2) } else { z }).collect());
+    }
+    let r = width * 0.5;
+    // Start / End Apply To: all of a mask's strokes as one path, or each stroke on its own.
+    let each = pr.e("startEndApplyTo") == 1;
+    let mut parts: Vec<Vec<[f64; 2]>> = Vec::new();
+    for group in &lines {
+        let lens: Vec<f64> = group.iter().map(|l| poly_length(l, false)).collect();
+        let total: f64 = lens.iter().sum();
+        let (g0, g1) = (total * start, total * end);
+        let mut acc = 0.0;
+        for (l, len) in group.iter().zip(lens) {
+            let part =
+                if each { trim_poly(l, false, len * start, len * end) } else { trim_poly(l, false, (g0 - acc).clamp(0.0, len), (g1 - acc).clamp(0.0, len)) };
+            acc += len;
+            parts.push(part);
+        }
+    }
+    let cap = pr.e("edgeOptions/endCap");
+    let join = pr.e("edgeOptions/join");
+    let cov = if cap == 0 && join == 0 {
+        let mut segs = Vec::new();
+        for part in &parts {
+            poly_segs(part, false, r, 1.0, &mut segs);
+        }
+        Coverage::Segs { segs, hardness: 0.9 }
+    } else {
+        Coverage::Convex(stroke_outline(&parts, r, cap, join, pr.f("edgeOptions/miterLimit").max(1.0)))
+    };
+    Some(PaintPlan { cov, color: pr.color("color"), opacity: (pr.f("opacity") / 100.0) as f32, style })
+}
+
+// ---------------------------------------------------------------- Stroke
+
+pub(super) fn stroke(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let plan = stroke_plan(ctx, &b);
+    draw_paint(&mut b, &plan);
+    b
+}
+
+fn stroke_plan(ctx: &EffectCtx, b: &Buf) -> PaintPlan {
+    let pr = ctx.params;
+    let all = pr.b("allMasks");
+    let polys: Vec<_> = if all { all_masks_px(ctx, b) } else { mask_px(ctx, b, pr.f("path").round() as usize).into_iter().collect() };
+    let style = pr.e("paintStyle");
+    let size = (pr.f("brushSize") * b.scale).max(0.1);
+    let r = size * 0.5;
+    let hard = pr.f("brushHardness") / 100.0;
+    let start = pr.f("start").clamp(0.0, 100.0) / 100.0;
+    let end = pr.f("end").clamp(0.0, 100.0) / 100.0;
+    let spacing = pr.f("spacing") / 100.0;
+    let sequential = pr.b("strokeSequentially");
+    let lens: Vec<f64> = polys.iter().map(|(p, c, _)| poly_length(p, *c)).collect();
+    let total: f64 = lens.iter().sum();
+    let mut segs = Vec::new();
+    let mut acc = 0.0;
+    for ((pts, closed, _), &len) in polys.iter().zip(&lens) {
+        let (s0, s1) = if all && sequential {
+            let (g0, g1) = (total * start, total * end);
+            ((g0 - acc).clamp(0.0, len), (g1 - acc).clamp(0.0, len))
+        } else {
+            (len * start, len * end)
+        };
+        acc += len;
+        if s1 <= s0 {
+            continue;
+        }
+        if spacing <= 0.5 {
+            let part = trim_poly(pts, *closed, s0, s1);
+            poly_segs(&part, false, r, 1.0, &mut segs);
+        } else {
+            let step = (size * spacing).max(0.5);
+            let mut s = s0;
+            while s <= s1 + 1e-9 && segs.len() < 200_000 {
+                let (q, _) = crate::util::poly_point_at(pts, *closed, s);
+                segs.push(Seg { a: q, b: q, r, v: 1.0 });
+                s += step;
+            }
+        }
+    }
+    PaintPlan { cov: Coverage::Segs { segs, hardness: hard }, color: pr.color("color"), opacity: (pr.f("opacity") / 100.0) as f32, style }
+}
+
+// ---------------------------------------------------------------- Vegas
+
+/// Marching-squares iso-contours of `pl` at `thr`, chained into polylines (closed flag).
+pub(super) fn contours(pl: &Plane, thr: f32) -> Vec<(Vec<[f64; 2]>, bool)> {
+    use std::collections::HashMap;
+    let (w, h) = (pl.w, pl.h);
+    if w < 2 || h < 2 {
+        return Vec::new();
+    }
+    // Edge key: horizontal edge (x,y)-(x+1,y) = 2*(y*w+x), vertical (x,y)-(x,y+1) = 2*(y*w+x)+1.
+    let hk = |x: usize, y: usize| 2 * (y * w + x) as u64;
+    let vk = |x: usize, y: usize| 2 * (y * w + x) as u64 + 1;
+    let mut pos: HashMap<u64, [f64; 2]> = HashMap::new();
+    let mut adj: HashMap<u64, Vec<u64>> = HashMap::new();
+    let v = |x: usize, y: usize| pl.data[y * w + x];
+    let interp = |a: f32, b: f32| if (b - a).abs() > 1e-9 { ((thr - a) / (b - a)).clamp(0.0, 1.0) as f64 } else { 0.5 };
+    for y in 0..h - 1 {
+        for x in 0..w - 1 {
+            let (a, bb, c, d) = (v(x, y), v(x + 1, y), v(x + 1, y + 1), v(x, y + 1));
+            let idx = (a > thr) as u8 | ((bb > thr) as u8) << 1 | ((c > thr) as u8) << 2 | ((d > thr) as u8) << 3;
+            if idx == 0 || idx == 15 {
+                continue;
+            }
+            // Edge points (pixel centres at +0.5).
+            let top = (hk(x, y), [x as f64 + 0.5 + interp(a, bb), y as f64 + 0.5]);
+            let right = (vk(x + 1, y), [x as f64 + 1.5, y as f64 + 0.5 + interp(bb, c)]);
+            let bottom = (hk(x, y + 1), [x as f64 + 0.5 + interp(d, c), y as f64 + 1.5]);
+            let left = (vk(x, y), [x as f64 + 0.5, y as f64 + 0.5 + interp(a, d)]);
+            let pairs: &[(usize, usize)] = match idx {
+                1 | 14 => &[(3, 0)],
+                2 | 13 => &[(0, 1)],
+                3 | 12 => &[(3, 1)],
+                4 | 11 => &[(1, 2)],
+                5 => &[(3, 0), (1, 2)],
+                6 | 9 => &[(0, 2)],
+                7 | 8 => &[(3, 2)],
+                10 => &[(0, 1), (2, 3)],
+                _ => &[],
+            };
+            let e = [top, right, bottom, left];
+            for &(i, j) in pairs {
+                pos.insert(e[i].0, e[i].1);
+                pos.insert(e[j].0, e[j].1);
+                adj.entry(e[i].0).or_default().push(e[j].0);
+                adj.entry(e[j].0).or_default().push(e[i].0);
+            }
+        }
+    }
+    let mut keys: Vec<u64> = adj.keys().copied().collect();
+    keys.sort_unstable();
+    // Start open chains at endpoints (degree 1) first, then closed loops.
+    keys.sort_by_key(|k| adj[k].len() != 1);
+    let mut used: std::collections::HashSet<(u64, u64)> = std::collections::HashSet::new();
+    let mut out = Vec::new();
+    for &k0 in &keys {
+        for &first in &adj[&k0] {
+            if used.contains(&(k0.min(first), k0.max(first))) {
+                continue;
+            }
+            let mut chain = vec![pos[&k0]];
+            let (mut prev, mut cur) = (k0, first);
+            used.insert((prev.min(cur), prev.max(cur)));
+            let mut closed = false;
+            loop {
+                chain.push(pos[&cur]);
+                if cur == k0 {
+                    closed = true;
+                    chain.pop();
+                    break;
+                }
+                let next = adj[&cur].iter().copied().find(|&n| n != prev && !used.contains(&(cur.min(n), cur.max(n))));
+                match next {
+                    Some(n) => {
+                        used.insert((cur.min(n), cur.max(n)));
+                        prev = cur;
+                        cur = n;
+                    }
+                    None => break,
+                }
+            }
+            if chain.len() >= 2 {
+                out.push((chain, closed));
+            }
+        }
+    }
+    out
+}
+
+pub(super) fn vegas(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let plan = vegas_plan(ctx, &b);
+    draw_paint(&mut b, &plan);
+    b
+}
+
+/// Sub-samples per Vegas segment: at least 12 (opacity ramp), more for long segments so each straight piece stays
+/// short compared with the stroke width and the segment follows rounded corners smoothly. Always even.
+pub(super) fn vegas_substeps(each: f64, width: f64) -> usize {
+    let step = width.max(2.0);
+    let n = ((each / step).ceil().max(12.0) as usize).min(512);
+    // Even, so the segment's midpoint (0.5) is always one of the samples.
+    n + (n & 1)
+}
+
+fn vegas_plan(ctx: &EffectCtx, b: &Buf) -> PaintPlan {
+    let pr = ctx.params;
+    let (w, h) = (b.img.width as usize, b.img.height as usize);
+    let sc = b.scale;
+    let paths: Vec<(Vec<[f64; 2]>, bool)> = if pr.e("stroke") == 1 {
+        mask_px(ctx, b, pr.f("path").round() as usize).map(|(p, c, _)| vec![(p, c)]).unwrap_or_default()
+    } else {
+        let src = layer_or_self(ctx, b, "inputLayer", true, pr.e("ifLayerSizesDiffer") == 1);
+        let ch = pr.e("channel");
+        let inv = pr.b("invertInput");
+        let mut pl = Plane::from_image(&src, |px| {
+            let (c, a) = unpremul(px);
+            let v = match ch {
+                1 => c[0],
+                2 => c[1],
+                3 => c[2],
+                4 => a,
+                _ => luminance(c[0], c[1], c[2]) * a,
+            };
+            if inv { 1.0 - v } else { v }
+        });
+        let blur = pr.f("preBlur") * sc;
+        if blur > 0.05 {
+            pl = gauss_plane(&pl, blur, blur);
+        }
+        let mut cs = contours(&pl, (pr.f("threshold") / 100.0) as f32);
+        // Simplify by tolerance (drop points closer than tol × size).
+        let tol = pr.f("tolerance").max(0.0) * (w.max(h) as f64) * 0.1;
+        if tol > 0.0 {
+            for (c, _) in cs.iter_mut() {
+                let mut keep: Vec<[f64; 2]> = Vec::with_capacity(c.len());
+                for &q in c.iter() {
+                    if keep.last().is_none_or(|l: &[f64; 2]| ((l[0] - q[0]).powi(2) + (l[1] - q[1]).powi(2)).sqrt() >= tol) {
+                        keep.push(q);
+                    }
+                }
+                *c = keep;
+            }
+        }
+        cs.sort_by(|a, b| poly_length(&b.0, b.1).total_cmp(&poly_length(&a.0, a.1)));
+        if pr.e("renderMode") == 1 {
+            let sel = (pr.f("selectedContour").round().max(1.0) as usize) - 1;
+            cs.into_iter().skip(sel).take(1).collect()
+        } else {
+            cs
+        }
+    };
+    let nseg = pr.f("segments").round().clamp(1.0, 1000.0) as usize;
+    // Shorter Contours Have Fewer Segments: segment count scales with contour length.
+    let fewer = pr.e("stroke") == 0 && pr.e("shorterContoursHave") == 1;
+    let longest = paths.iter().map(|(p, c)| poly_length(p, *c)).fold(0.0, f64::max);
+    let seg_len = pr.f("length").clamp(0.0, 1.0);
+    let bunched = pr.e("segmentDistribution") == 0;
+    let rot = pr.f("rotation") / 360.0;
+    let random_phase = pr.b("randomPhase");
+    let seed = pr.f("randomSeed") as i64 as u32 ^ ctx.seed;
+    let width = (pr.f("width") * sc).max(0.1);
+    let hard = pr.f("hardness").clamp(0.0, 1.0);
+    let (o0, om, o1, mp) = (pr.f("startOpacity") as f32, pr.f("midpointOpacity") as f32, pr.f("endOpacity") as f32, pr.f("midpointPosition").clamp(0.01, 0.99));
+    let mut segs = Vec::new();
+    for (ci, (pts, closed)) in paths.iter().enumerate() {
+        let len = poly_length(pts, *closed);
+        if len <= 0.0 {
+            continue;
+        }
+        let phase = rot + if random_phase { hash1(ci as u32, 1, seed) as f64 } else { 0.0 };
+        let nseg = if fewer && longest > 0.0 { ((nseg as f64 * len / longest).round() as usize).max(1) } else { nseg };
+        let each = len / nseg as f64 * seg_len;
+        for i in 0..nseg {
+            let base = if bunched { (i as f64 + (hash1(ci as u32, i as u32 + 7, seed) as f64 - 0.5) * 0.8) / nseg as f64 } else { i as f64 / nseg as f64 };
+            let s0 = (base + phase).rem_euclid(1.0) * len;
+            // Sub-sample the segment so opacity can ramp along it.
+            let sub = vegas_substeps(each, width);
+            let mut prev: Option<[f64; 2]> = None;
+            for k in 0..=sub {
+                let f = k as f64 / sub as f64;
+                let mut s = s0 + each * f;
+                if *closed {
+                    s = s.rem_euclid(len);
+                } else if s > len {
+                    break;
+                }
+                let (q, _) = crate::util::poly_point_at(pts, *closed, s);
+                let op = if f < mp { o0 + (om - o0) * (f / mp) as f32 } else { om + (o1 - om) * ((f - mp) / (1.0 - mp)) as f32 };
+                if let Some(pv) = prev
+                    && ((pv[0] - q[0]).powi(2) + (pv[1] - q[1]).powi(2)) < (each * 0.5).powi(2) + 4.0
+                {
+                    segs.push(Seg { a: pv, b: q, r: width * 0.5, v: op.clamp(0.0, 1.0) });
+                }
+                prev = Some(q);
+            }
+        }
+    }
+    let style = match pr.e("blendMode") {
+        1 => 0,
+        2 => 3,
+        3 => 2,
+        _ => 1,
+    };
+    PaintPlan { cov: Coverage::Segs { segs, hardness: hard }, color: pr.color("color"), opacity: 1.0, style }
+}
+
+// ---------------------------------------------------------------- Write-on / Glue Gun
+
+/// Write-on draws a stroke along the animated Brush Position, as in After Effects: a dab every
+/// Brush Spacing seconds from the layer's start up to now, each one lasting Stroke Length
+/// seconds (0: for ever). The dabs' positions come from the host's parameters at their times;
+/// with Paint Time Properties ▸ Opacity or Brush Time Properties ▸ Size each dab keeps its own
+/// opacity or size, else the current ones apply to every dab. (Colour and hardness are one per
+/// stroke: the current ones.) Without a host (or dabs) the current dab draws. Deterministic.
+pub(super) fn write_on(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let plan = write_on_plan(ctx, &b);
+    draw_paint(&mut b, &plan);
+    b
+}
+
+/// The most dabs one Write-on frame draws; longer strokes lay them further apart, joined.
+const WRITE_ON_MAX_DABS: i64 = 4096;
+
+fn write_on_plan(ctx: &EffectCtx, b: &Buf) -> PaintPlan {
+    let pr = ctx.params;
+    let own_opacity = pr.e("paintTimeProperties") == 1;
+    let own_size = matches!(pr.e("brushTimeProperties"), 1 | 3);
+    let opacity = |p: &Params| (p.f("brushOpacity") / 100.0).clamp(0.0, 1.0) as f32;
+    let radius = |p: &Params| (p.f("brushSize") * b.scale * 0.5).max(0.05);
+    let dab = |p: &Params| {
+        let q = b.to_px(p.v2("brushPosition"));
+        ([q.0, q.1], radius(if own_size { p } else { pr }), if own_opacity { opacity(p) } else { 1.0 })
+    };
+    let mut segs = vec![];
+    let t = ctx.time;
+    let spacing = pr.f("brushSpacing").max(0.001);
+    let life = pr.f("strokeLength").max(0.0);
+    if let Some(host) = ctx.env.host
+        && t.is_finite()
+        && t >= 0.0
+    {
+        let start = if life > 0.0 { (t - life).max(0.0) } else { 0.0 };
+        let k0 = (start / spacing - 1e-9).ceil().max(0.0) as i64;
+        let k1 = (t / spacing + 1e-9).floor().max(0.0) as i64;
+        let n = k1.saturating_sub(k0).saturating_add(1);
+        let stride = (n / WRITE_ON_MAX_DABS).saturating_add(1).max(1);
+        let mut prev: Option<[f64; 2]> = None;
+        let mut k = k0;
+        while k <= k1 {
+            let tk = k as f64 * spacing;
+            let at = if (tk - t).abs() < 1e-9 { Some(dab(pr)) } else { host.params_at(tk).map(|p| dab(&p)) };
+            if let Some((q, r, v)) = at {
+                // Dabs laid further apart than the brush spacing are joined into a line.
+                let a = if stride > 1 { prev.unwrap_or(q) } else { q };
+                segs.push(Seg { a, b: q, r, v });
+                prev = Some(q);
+            }
+            k = k.saturating_add(stride);
+        }
+    }
+    if segs.is_empty() {
+        let (q, r, v) = dab(pr);
+        segs.push(Seg { a: q, b: q, r, v });
+    }
+    PaintPlan {
+        cov: Coverage::Segs { segs, hardness: pr.f("brushHardness") / 100.0 },
+        color: pr.color("color"),
+        opacity: if own_opacity { 1.0 } else { opacity(pr) },
+        style: pr.e("paintStyle"),
+    }
+}
diff --git a/crates/effects/src/generate3/raster.rs b/crates/effects/src/generate3/raster.rs
new file mode 100644
index 000000000..1b85818d0
--- /dev/null
+++ b/crates/effects/src/generate3/raster.rs
@@ -0,0 +1,368 @@
+use super::{Buf, EffectCtx, IndexedParallelIterator, ParallelIterator, ParallelSliceMut, Plane, Px, smoothstep};
+
+// ---------------------------------------------------------------- shared rasterisation
+
+/// A round-capped line segment in buffer pixels with radius `r` and intensity `v`.
+#[derive(Clone, Copy, Debug)]
+pub struct Seg {
+    pub a: [f64; 2],
+    pub b: [f64; 2],
+    pub r: f64,
+    pub v: f32,
+}
+
+/// Rasterise segments into a coverage plane (max-combined). `hardness` (0..1) is the fraction
+/// of the radius that is fully opaque; the rest falls off smoothly.
+pub(crate) fn raster_segs(w: usize, h: usize, segs: &[Seg], hardness: f64) -> Plane {
+    let mut out = Plane::new(w, h);
+    if w == 0 || h == 0 || segs.is_empty() {
+        return out;
+    }
+    let mut buckets: Vec<Vec<u32>> = vec![Vec::new(); h];
+    for (i, s) in segs.iter().enumerate() {
+        let pad = s.r + 1.0;
+        let y0 = (s.a[1].min(s.b[1]) - pad).floor().max(0.0) as usize;
+        let y1 = (s.a[1].max(s.b[1]) + pad).ceil().min(h as f64);
+        if y1 <= 0.0 || y0 >= h {
+            continue;
+        }
+        for row in buckets.iter_mut().take(y1 as usize).skip(y0) {
+            row.push(i as u32);
+        }
+    }
+    let hard = hardness.clamp(0.0, 1.0);
+    out.data.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
+        let py = y as f64 + 0.5;
+        for &i in &buckets[y] {
+            let s = segs[i as usize];
+            let pad = s.r + 1.0;
+            let x0 = (s.a[0].min(s.b[0]) - pad).floor().max(0.0) as usize;
+            let x1 = ((s.a[0].max(s.b[0]) + pad).ceil().max(0.0) as usize).min(w);
+            let (dx, dy) = (s.b[0] - s.a[0], s.b[1] - s.a[1]);
+            let l2 = dx * dx + dy * dy;
+            let inner = s.r * hard - 0.5;
+            let outer = s.r + 0.5;
+            for (x, o) in row.iter_mut().enumerate().take(x1).skip(x0) {
+                let px = x as f64 + 0.5;
+                let t = if l2 > 1e-12 { (((px - s.a[0]) * dx + (py - s.a[1]) * dy) / l2).clamp(0.0, 1.0) } else { 0.0 };
+                let d = ((px - s.a[0] - dx * t).powi(2) + (py - s.a[1] - dy * t).powi(2)).sqrt();
+                if d >= outer {
+                    continue;
+                }
+                let c = if d <= inner { 1.0 } else { 1.0 - smoothstep(inner as f32, outer as f32, d as f32) } * s.v;
+                if c > *o {
+                    *o = c;
+                }
+            }
+        }
+    });
+    out
+}
+
+/// Segments along a polyline (buffer px).
+pub fn poly_segs(pts: &[[f64; 2]], closed: bool, r: f64, v: f32, out: &mut Vec<Seg>) {
+    let n = pts.len();
+    if n == 1 {
+        out.push(Seg { a: pts[0], b: pts[0], r, v });
+    }
+    if n < 2 {
+        return;
+    }
+    let segs = if closed { n } else { n - 1 };
+    for i in 0..segs {
+        out.push(Seg { a: pts[i], b: pts[(i + 1) % n], r, v });
+    }
+}
+
+/// Portion `[s0, s1]` (arc length) of a polyline.
+pub(crate) fn trim_poly(pts: &[[f64; 2]], closed: bool, s0: f64, s1: f64) -> Vec<[f64; 2]> {
+    let n = pts.len();
+    let mut out = Vec::new();
+    if n < 2 || s1 <= s0 {
+        return out;
+    }
+    let segs = if closed { n } else { n - 1 };
+    let mut acc = 0.0;
+    for i in 0..segs {
+        let (a, b) = (pts[i], pts[(i + 1) % n]);
+        let l = ((b[0] - a[0]).powi(2) + (b[1] - a[1]).powi(2)).sqrt();
+        let (e0, e1) = (acc, acc + l);
+        acc = e1;
+        if e1 < s0 || e0 > s1 || l <= 0.0 {
+            continue;
+        }
+        let at = |s: f64| {
+            let t = ((s - e0) / l).clamp(0.0, 1.0);
+            [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t]
+        };
+        let p0 = at(s0.max(e0));
+        if out.last() != Some(&p0) {
+            out.push(p0);
+        }
+        out.push(at(s1.min(e1)));
+    }
+    out
+}
+
+#[inline]
+pub(super) fn over(dst: Px, src: Px) -> Px {
+    let k = 1.0 - src[3];
+    [src[0] + dst[0] * k, src[1] + dst[1] * k, src[2] + dst[2] * k, src[3] + dst[3] * k]
+}
+
+/// Mask `idx` (1-based; 0 = none) mapped to buffer pixels.
+pub(crate) fn mask_px(ctx: &EffectCtx, b: &Buf, idx: usize) -> Option<(Vec<[f64; 2]>, bool, bool)> {
+    let m = ctx.env.masks.get(idx.checked_sub(1)?)?;
+    if m.points.is_empty() {
+        return None;
+    }
+    Some((m.points.iter().map(|&q| [q[0] * b.scale + b.offset[0], q[1] * b.scale + b.offset[1]]).collect(), m.closed, m.inverted))
+}
+
+/// All masks mapped to buffer pixels.
+pub(super) fn all_masks_px(ctx: &EffectCtx, b: &Buf) -> Vec<(Vec<[f64; 2]>, bool, bool)> {
+    (1..=ctx.env.masks.len()).filter_map(|i| mask_px(ctx, b, i)).collect()
+}
+
+/// Chaikin corner cutting (open polyline, endpoints kept).
+pub(super) fn chaikin(pts: &[[f64; 2]], iters: usize) -> Vec<[f64; 2]> {
+    let mut cur = pts.to_vec();
+    for _ in 0..iters {
+        if cur.len() < 3 {
+            return cur;
+        }
+        let mut nx = Vec::with_capacity(cur.len() * 2);
+        nx.push(cur[0]);
+        for w in cur.windows(2) {
+            let (a, b) = (w[0], w[1]);
+            nx.push([a[0] * 0.75 + b[0] * 0.25, a[1] * 0.75 + b[1] * 0.25]);
+            nx.push([a[0] * 0.25 + b[0] * 0.75, a[1] * 0.25 + b[1] * 0.75]);
+        }
+        nx.push(*cur.last().unwrap_or(&[0.0; 2]));
+        cur = nx;
+    }
+    cur
+}
+
+// ---------------------------------------------------------------- Scribble
+
+/// Scan runs (start, end along direction `d`) of the fill region on the line `n·p = s`.
+pub(super) fn scan_runs(polys: &[(Vec<[f64; 2]>, bool, bool)], fill: u32, ew: f64, d: [f64; 2], n: [f64; 2], s: f64, out: &mut Vec<(f64, f64)>) {
+    out.clear();
+    for (pts, _closed, inverted) in polys {
+        let m = pts.len();
+        if m < 2 {
+            continue;
+        }
+        // Crossings: (t along d, |sin| of crossing angle).
+        let mut xs: Vec<(f64, f64)> = Vec::new();
+        for i in 0..m {
+            let (a, b) = (pts[i], pts[(i + 1) % m]);
+            let (na, nb) = (a[0] * n[0] + a[1] * n[1] - s, b[0] * n[0] + b[1] * n[1] - s);
+            if (na > 0.0) == (nb > 0.0) {
+                continue;
+            }
+            let t = na / (na - nb);
+            let q = [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t];
+            let (ex, ey) = (b[0] - a[0], b[1] - a[1]);
+            let el = (ex * ex + ey * ey).sqrt().max(1e-9);
+            let sin = ((ex * n[0] + ey * n[1]) / el).abs().max(0.2);
+            xs.push((q[0] * d[0] + q[1] * d[1], sin));
+        }
+        xs.sort_by(|a, b| a.0.total_cmp(&b.0));
+        // Signed area decides which side is "left".
+        let area: f64 = (0..m).map(|i| pts[i][0] * pts[(i + 1) % m][1] - pts[(i + 1) % m][0] * pts[i][1]).sum();
+        let left_is_inside = area < 0.0;
+        let mode = match fill {
+            4 => {
+                if left_is_inside {
+                    2
+                } else {
+                    3
+                }
+            }
+            5 => {
+                if left_is_inside {
+                    3
+                } else {
+                    2
+                }
+            }
+            f => f,
+        };
+        let mode = if *inverted && mode == 0 { 6 } else { mode };
+        for (k, &(t, sin)) in xs.iter().enumerate() {
+            let entering = k % 2 == 0;
+            let l = ew / sin;
+            match mode {
+                0 if entering && k + 1 < xs.len() => {
+                    out.push((t, xs[k + 1].0));
+                }
+                1 => out.push((t - l * 0.5, t + l * 0.5)),
+                2 => out.push(if entering { (t, t + l) } else { (t - l, t) }),
+                3 => out.push(if entering { (t - l, t) } else { (t, t + l) }),
+                _ => {}
+            }
+        }
+        if mode == 6 {
+            // Inverted Inside: outside of the polygon within the bounds.
+            let lo = pts.iter().map(|q| q[0] * d[0] + q[1] * d[1]).fold(f64::INFINITY, f64::min) - ew;
+            let hi = pts.iter().map(|q| q[0] * d[0] + q[1] * d[1]).fold(f64::NEG_INFINITY, f64::max) + ew;
+            let mut cur = lo;
+            for pair in xs.chunks(2) {
+                out.push((cur, pair[0].0));
+                cur = pair.get(1).map(|v| v.0).unwrap_or(hi);
+            }
+            out.push((cur, hi));
+        }
+    }
+    out.sort_by(|a, b| a.0.total_cmp(&b.0));
+    // Merge overlaps.
+    let mut merged: Vec<(f64, f64)> = Vec::with_capacity(out.len());
+    for &(a, b) in out.iter() {
+        if let Some(last) = merged.last_mut()
+            && a <= last.1
+        {
+            last.1 = last.1.max(b);
+            continue;
+        }
+        merged.push((a, b));
+    }
+    *out = merged;
+}
+
+/// End Cap and Join options (Scribble's Edge Options).
+pub(super) const END_CAPS: [&str; 3] = ["Round", "Butt", "Projecting"];
+
+pub(super) const JOINS: [&str; 3] = ["Round", "Miter", "Bevel"];
+
+/// Convex polygons whose union is the stroke of the polylines `lines` with half width `r`:
+/// one quad per segment, plus the joins (Round discs, Miter wedges up to `miter_limit` × the
+/// half width, Bevel triangles) and the caps (Round discs, Butt none, Projecting square ends).
+pub(crate) fn stroke_outline(lines: &[Vec<[f64; 2]>], r: f64, cap: u32, join: u32, miter_limit: f64) -> Vec<Vec<[f64; 2]>> {
+    let disc = |c: [f64; 2]| -> Vec<[f64; 2]> {
+        (0..16).map(|k| (k as f64 / 16.0 * std::f64::consts::TAU).sin_cos()).map(|(s, co)| [c[0] + co * r, c[1] + s * r]).collect()
+    };
+    let mut out = Vec::new();
+    for l in lines {
+        let pts: Vec<[f64; 2]> = l.iter().copied().fold(Vec::new(), |mut v, p| {
+            if v.last().is_none_or(|q: &[f64; 2]| (q[0] - p[0]).hypot(q[1] - p[1]) > 1e-9) {
+                v.push(p);
+            }
+            v
+        });
+        if pts.len() < 2 {
+            if let (Some(p), 0) = (pts.first(), cap) {
+                out.push(disc(*p));
+            }
+            continue;
+        }
+        let dir = |a: [f64; 2], b: [f64; 2]| {
+            let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
+            let l = dx.hypot(dy).max(1e-12);
+            [dx / l, dy / l]
+        };
+        let n = pts.len();
+        for k in 0..n - 1 {
+            let (mut a, mut b) = (pts[k], pts[k + 1]);
+            let d = dir(a, b);
+            // Projecting caps extend the end segments by the half width.
+            if cap == 2 && k == 0 {
+                a = [a[0] - d[0] * r, a[1] - d[1] * r];
+            }
+            if cap == 2 && k == n - 2 {
+                b = [b[0] + d[0] * r, b[1] + d[1] * r];
+            }
+            let nn = [-d[1] * r, d[0] * r];
+            out.push(vec![[a[0] + nn[0], a[1] + nn[1]], [b[0] + nn[0], b[1] + nn[1]], [b[0] - nn[0], b[1] - nn[1]], [a[0] - nn[0], a[1] - nn[1]]]);
+        }
+        // Joins.
+        for k in 1..n - 1 {
+            let (p, d0, d1) = (pts[k], dir(pts[k - 1], pts[k]), dir(pts[k], pts[k + 1]));
+            let cross = d0[0] * d1[1] - d0[1] * d1[0];
+            if cross.abs() < 1e-9 && d0[0] * d1[0] + d0[1] * d1[1] > 0.0 {
+                continue;
+            }
+            if join == 0 {
+                out.push(disc(p));
+                continue;
+            }
+            // The outer side of the turn.
+            let s = if cross > 0.0 { -1.0 } else { 1.0 };
+            let o0 = [p[0] - d0[1] * r * s, p[1] + d0[0] * r * s];
+            let o1 = [p[0] - d1[1] * r * s, p[1] + d1[0] * r * s];
+            let bevel = vec![p, o0, o1];
+            if join == 1 {
+                // Miter point: where the two offset edges meet.
+                let bis = [d0[0] - d1[0], d0[1] - d1[1]];
+                let bl = bis[0].hypot(bis[1]);
+                let cos_half = ((1.0 + d0[0] * d1[0] + d0[1] * d1[1]) * 0.5).max(0.0).sqrt();
+                let len = if cos_half > 1e-6 { r / cos_half } else { f64::INFINITY };
+                if bl > 1e-9 && len <= miter_limit * r {
+                    let m = [p[0] + (o0[0] + o1[0] - 2.0 * p[0]) * 0.5, p[1] + (o0[1] + o1[1] - 2.0 * p[1]) * 0.5];
+                    let ml = (m[0] - p[0]).hypot(m[1] - p[1]).max(1e-12);
+                    let tip = [p[0] + (m[0] - p[0]) / ml * len, p[1] + (m[1] - p[1]) / ml * len];
+                    out.push(vec![p, o0, tip, o1]);
+                    continue;
+                }
+            }
+            out.push(bevel);
+        }
+        if cap == 0 {
+            out.push(disc(pts[0]));
+            out.push(disc(pts[n - 1]));
+        }
+    }
+    out
+}
+
+/// Coverage (union, 4×4 samples per pixel) of convex polygons on a `w`×`h` grid.
+pub(crate) fn raster_convex(w: usize, h: usize, polys: &[Vec<[f64; 2]>]) -> Plane {
+    let mut out = Plane::new(w, h);
+    let inside = |poly: &[[f64; 2]], x: f64, y: f64| {
+        let n = poly.len();
+        let mut sign = 0.0;
+        for i in 0..n {
+            let (a, b) = (poly[i], poly[(i + 1) % n]);
+            let c = (b[0] - a[0]) * (y - a[1]) - (b[1] - a[1]) * (x - a[0]);
+            if c.abs() < 1e-12 {
+                continue;
+            }
+            if sign == 0.0 {
+                sign = c.signum();
+            } else if c.signum() != sign {
+                return false;
+            }
+        }
+        true
+    };
+    for poly in polys {
+        if poly.len() < 3 {
+            continue;
+        }
+        let (mut x0, mut y0, mut x1, mut y1) = (f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY);
+        for p in poly {
+            x0 = x0.min(p[0]);
+            y0 = y0.min(p[1]);
+            x1 = x1.max(p[0]);
+            y1 = y1.max(p[1]);
+        }
+        let (xa, xb) = (x0.floor().max(0.0) as usize, (x1.ceil().max(0.0) as usize).min(w));
+        let (ya, yb) = (y0.floor().max(0.0) as usize, (y1.ceil().max(0.0) as usize).min(h));
+        for y in ya..yb {
+            for x in xa..xb {
+                let mut hit = 0;
+                for sy in 0..4 {
+                    for sx in 0..4 {
+                        if inside(poly, x as f64 + (sx as f64 + 0.5) / 4.0, y as f64 + (sy as f64 + 0.5) / 4.0) {
+                            hit += 1;
+                        }
+                    }
+                }
+                let v = &mut out.data[y * w + x];
+                *v = v.max(hit as f32 / 16.0);
+            }
+        }
+    }
+    out
+}
diff --git a/crates/effects/src/generate3/registry.rs b/crates/effects/src/generate3/registry.rs
new file mode 100644
index 000000000..baa493110
--- /dev/null
+++ b/crates/effects/src/generate3/registry.rs
@@ -0,0 +1,265 @@
+use super::audio::{audio_spectrum, audio_waveform};
+use super::common::{pct, pt, spec};
+use super::fill::{eyedropper_fill, glue_gun, paint_bucket, threads};
+use super::fractal::{FRACTAL_OVERSAMPLE, FRACTAL_PALETTES, FRACTAL_SETS, fractal};
+use super::paths::{scribble, stroke, vegas, write_on};
+use super::raster::{END_CAPS, JOINS};
+use super::{EffectSpec, ParamUi, Value, col, num, p, popup, slider};
+
+// ---------------------------------------------------------------- registry
+
+pub fn specs() -> Vec<EffectSpec> {
+    let ang = || ParamUi::Angle;
+    let check = |id: &'static str, name: &'static str, v: bool| p(id, name, Value::Bool(v), ParamUi::Checkbox);
+    let paint_style = || popup(&["On Original Image", "On Transparent", "Reveal Original Image"]);
+    let mask_idx = |id: &'static str, name: &'static str, d: f64| p(id, name, num(d), ParamUi::Mask);
+    let display = || popup(&["Digital", "Analog lines", "Analog dots"]);
+    vec![
+        spec(
+            "ec.generate.fractal",
+            "Fractal",
+            vec![
+                p("setChoice", "Set Choice", Value::Enum(0), popup(&FRACTAL_SETS)),
+                p("equation", "Equation", Value::Enum(0), popup(&["z = z^2 + c", "z = z^3 + c", "z = z^4 + c"])),
+                p("mandelbrot/mandelbrotX", "X (Real)", num(-0.74), slider(-2.0, 2.0, -2.0, 2.0, 4)),
+                p("mandelbrot/mandelbrotY", "Y (Imaginary)", num(0.15), slider(-2.0, 2.0, -2.0, 2.0, 4)),
+                p("mandelbrot/mandelbrotMagnification", "Magnification", num(0.0), slider(-5.0, 30.0, -5.0, 30.0, 2)),
+                p("mandelbrot/mandelbrotEscapeLimit", "Escape Limit", num(4.0), slider(1.0, 1000.0, 1.0, 100.0, 1)),
+                p("julia/juliaX", "X (Real)", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
+                p("julia/juliaY", "Y (Imaginary)", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
+                p("julia/juliaMagnification", "Magnification", num(0.0), slider(-5.0, 30.0, -5.0, 30.0, 2)),
+                p("julia/juliaEscapeLimit", "Escape Limit", num(4.0), slider(1.0, 1000.0, 1.0, 100.0, 1)),
+                p("postInversionOffset/postInversionX", "X Offset", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
+                p("postInversionOffset/postInversionY", "Y Offset", num(0.0), slider(-2.0, 2.0, -2.0, 2.0, 4)),
+                check("fractalColor/overlay", "Overlay", false),
+                check("fractalColor/transparency", "Transparency", false),
+                p("fractalColor/palette", "Palette", Value::Enum(0), popup(&FRACTAL_PALETTES)),
+                p("fractalColor/hue", "Hue", num(0.0), ang()),
+                p("fractalColor/cycleSteps", "Cycle Steps", num(32.0), slider(1.0, 1000.0, 1.0, 256.0, 0)),
+                p("fractalColor/cycleOffset", "Cycle Offset", num(0.0), ang()),
+                check("fractalColor/edgeHighlight", "Edge Highlight", false),
+                p("highQualitySettings/samplingMethod", "Oversample Method", Value::Enum(0), popup(&FRACTAL_OVERSAMPLE)),
+                p("highQualitySettings/samplingFactor", "Oversample Factor", num(2.0), slider(1.0, 9.0, 1.0, 9.0, 0)),
+            ],
+            fractal,
+        ),
+        spec(
+            "ec.generate.scribble",
+            "Scribble",
+            vec![
+                p("scribble", "Scribble", Value::Enum(0), popup(&["Single Mask", "All Masks", "All Masks Using Modes"])),
+                mask_idx("mask", "Mask", 1.0),
+                p("fillType", "Fill Type", Value::Enum(0), popup(&["Inside", "Centered Edge", "Inside Edge", "Outside Edge", "Left Edge", "Right Edge"])),
+                p("edgeOptions/edgeWidth", "Edge Width", num(10.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
+                p("edgeOptions/endCap", "End Cap", Value::Enum(0), popup(&END_CAPS)),
+                p("edgeOptions/join", "Join", Value::Enum(0), popup(&JOINS)),
+                p("edgeOptions/miterLimit", "Miter Limit", num(4.0), slider(1.0, 100.0, 1.0, 20.0, 1)),
+                p("color", "Color", col(1.0, 0.0, 0.0), ParamUi::Color),
+                p("opacity", "Opacity", num(100.0), pct()),
+                p("angle", "Angle", num(45.0), ang()),
+                p("strokeWidth", "Stroke Width", num(2.0), slider(0.1, 50.0, 0.1, 50.0, 1)),
+                p("strokeOptions/curviness", "Curviness", num(50.0), pct()),
+                p("strokeOptions/curvinessVariation", "Curviness Variation", num(50.0), pct()),
+                p("strokeOptions/spacing", "Spacing", num(5.0), slider(0.1, 100.0, 0.1, 50.0, 1)),
+                p("strokeOptions/spacingVariation", "Spacing Variation", num(50.0), pct()),
+                p("strokeOptions/pathOverlap", "Path Overlap", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
+                p("strokeOptions/pathOverlapVariation", "Path Overlap Variation", num(50.0), pct()),
+                p("start", "Start", num(0.0), pct()),
+                p("end", "End", num(100.0), pct()),
+                p("startEndApplyTo", "Start/End Apply To", Value::Enum(0), popup(&["All Strokes", "Each Stroke"])),
+                check("fillPathsSequentially", "Fill Paths Sequentially", true),
+                p("wiggleType", "Wiggle Type", Value::Enum(1), popup(&["Static", "Jumpy", "Smooth"])),
+                p("wigglesPerSecond", "Wiggles/Second", num(5.0), slider(0.0, 100.0, 0.0, 30.0, 2)),
+                p("randomSeed", "Random Seed", num(1.0), slider(0.0, 10000.0, 0.0, 100.0, 0)),
+                p("composite", "Composite", Value::Enum(1), popup(&["On Original Image", "On Transparent", "Reveal Original Image"])),
+            ],
+            scribble,
+        ),
+        spec(
+            "ec.generate.stroke",
+            "Stroke",
+            vec![
+                mask_idx("path", "Path", 1.0),
+                check("allMasks", "All Masks", false),
+                check("strokeSequentially", "Stroke Sequentially", true),
+                p("color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("brushSize", "Brush Size", num(2.0), slider(0.0, 200.0, 0.0, 50.0, 1)),
+                p("brushHardness", "Brush Hardness", num(75.0), pct()),
+                p("opacity", "Opacity", num(100.0), pct()),
+                p("start", "Start", num(0.0), pct()),
+                p("end", "End", num(100.0), pct()),
+                p("spacing", "Spacing", num(15.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
+                p("paintStyle", "Paint Style", Value::Enum(0), paint_style()),
+            ],
+            stroke,
+        ),
+        spec(
+            "ec.generate.vegas",
+            "Vegas",
+            vec![
+                p("stroke", "Stroke", Value::Enum(0), popup(&["Image Contours", "Mask/Path"])),
+                p("inputLayer", "Image Contours: Input Layer", Value::Layer(None), ParamUi::Layer),
+                check("invertInput", "Image Contours: Invert Input", false),
+                p("ifLayerSizesDiffer", "Image Contours: If Layer Sizes Differ", Value::Enum(0), popup(&["Center", "Stretch to Fit"])),
+                p("channel", "Image Contours: Channel", Value::Enum(0), popup(&["Intensity", "Red", "Green", "Blue", "Alpha"])),
+                p("threshold", "Image Contours: Threshold", num(50.0), pct()),
+                p("preBlur", "Image Contours: Pre-Blur", num(1.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
+                p("tolerance", "Image Contours: Tolerance", num(0.01), slider(0.0, 1.0, 0.0, 0.1, 3)),
+                p("renderMode", "Image Contours: Render", Value::Enum(0), popup(&["All Contours", "Selected Contour"])),
+                p("selectedContour", "Image Contours: Selected Contour", num(1.0), slider(1.0, 1000.0, 1.0, 20.0, 0)),
+                p("shorterContoursHave", "Image Contours: Shorter Contours Have", Value::Enum(0), popup(&["Same Number of Segments", "Fewer Segments"])),
+                mask_idx("path", "Mask/Path: Path", 1.0),
+                p("segments", "Segments: Segments", num(32.0), slider(1.0, 1000.0, 1.0, 100.0, 0)),
+                p("length", "Segments: Length", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("segmentDistribution", "Segments: Segment Distribution", Value::Enum(0), popup(&["Bunched", "Even"])),
+                p("rotation", "Segments: Rotation", num(0.0), ang()),
+                check("randomPhase", "Segments: Random Phase", false),
+                p("randomSeed", "Segments: Random Seed", num(1.0), slider(1.0, 10000.0, 1.0, 100.0, 0)),
+                p("blendMode", "Rendering: Blend Mode", Value::Enum(1), popup(&["Transparent", "Over", "Under", "Stencil"])),
+                p("color", "Rendering: Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("width", "Rendering: Width", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
+                p("hardness", "Rendering: Hardness", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("startOpacity", "Rendering: Start Opacity", num(1.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("midpointOpacity", "Rendering: Mid-point Opacity", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("midpointPosition", "Rendering: Mid-point Position", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("endOpacity", "Rendering: End Opacity", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+            ],
+            vegas,
+        ),
+        spec(
+            "ec.generate.writeon",
+            "Write-on",
+            vec![
+                p("brushPosition", "Brush Position", pt(0.5, 0.5), ParamUi::Point),
+                p("color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("brushSize", "Brush Size", num(6.0), slider(0.0, 200.0, 0.0, 50.0, 1)),
+                p("brushHardness", "Brush Hardness", num(75.0), pct()),
+                p("brushOpacity", "Brush Opacity", num(100.0), pct()),
+                p("strokeLength", "Stroke Length (secs)", num(0.0), slider(0.0, 30.0, 0.0, 30.0, 1)),
+                p("brushSpacing", "Brush Spacing (secs)", num(0.001), slider(0.001, 5.0, 0.001, 5.0, 3)),
+                p("paintTimeProperties", "Paint Time Properties", Value::Enum(0), popup(&["None", "Opacity", "Color"])),
+                p("brushTimeProperties", "Brush Time Properties", Value::Enum(0), popup(&["None", "Size", "Hardness", "Size & Hardness"])),
+                p("paintStyle", "Paint Style", Value::Enum(0), paint_style()),
+            ],
+            write_on,
+        ),
+        spec(
+            "ec.generate.paintbucket",
+            "Paint Bucket",
+            vec![
+                p("fillPoint", "Fill Point", pt(0.5, 0.5), ParamUi::Point),
+                p("fillSelector", "Fill Selector", Value::Enum(0), popup(&["Color & Alpha", "Straight Color", "Transparency", "Opacity", "Alpha Channel"])),
+                p("tolerance", "Tolerance", num(10.0), slider(0.0, 255.0, 0.0, 100.0, 1)),
+                check("viewThreshold", "View Threshold", false),
+                p("stroke", "Stroke", Value::Enum(0), popup(&["Antialias", "Feather", "Spread", "Choke", "Stroke"])),
+                p("featherSoftness", "Feather Softness", num(10.0), slider(0.0, 100.0, 0.0, 50.0, 1)),
+                p("spreadRadius", "Spread Radius", num(3.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
+                p("strokeWidth", "Stroke Width", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
+                p("color", "Color", col(1.0, 0.0, 0.0), ParamUi::Color),
+                p("opacity", "Opacity", num(100.0), pct()),
+                p(
+                    "blendingMode",
+                    "Blending Mode",
+                    Value::Enum(0),
+                    popup(&["Normal", "Add", "Multiply", "Screen", "Hue", "Saturation", "Color", "Luminosity", "Behind", "Fill Only"]),
+                ),
+            ],
+            paint_bucket,
+        ),
+        spec(
+            "ec.generate.eyedropperfill",
+            "Eyedropper Fill",
+            vec![
+                p("samplePoint", "Sample Point", pt(0.5, 0.5), ParamUi::Point),
+                p("sampleRadius", "Sample Radius", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
+                p("averagePixelColors", "Average Pixel Colors", Value::Enum(0), popup(&["Skip Empty", "All", "All Premultiplied", "Including Alpha"])),
+                check("maintainOriginalAlpha", "Maintain Original Alpha", false),
+                p("blendWithOriginal", "Blend With Original", num(0.0), pct()),
+            ],
+            eyedropper_fill,
+        ),
+        spec(
+            "ec.generate.ccgluegun",
+            "Paint Beads",
+            vec![
+                p("brushPosition", "Brush Position", pt(0.5, 0.5), ParamUi::Point),
+                p("strokeWidth", "Stroke Width", num(25.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
+                p("density", "Density", num(5.0), slider(0.0, 32.0, 0.0, 32.0, 1)),
+                p("timeSpan", "Time Span (sec)", num(1.0), slider(0.0, 60.0, 0.0, 10.0, 2)),
+                p("reflection", "Reflection", num(45.0), ang()),
+                p("strength", "Strength", num(100.0), pct()),
+                p("style", "Style", Value::Enum(0), popup(&["Over Layer", "Glue Only"])),
+            ],
+            glue_gun,
+        ),
+        spec(
+            "ec.generate.ccthreads",
+            "Woven Threads",
+            vec![
+                p("width", "Width", num(50.0), slider(1.0, 1000.0, 1.0, 200.0, 1)),
+                p("height", "Height", num(50.0), slider(1.0, 1000.0, 1.0, 200.0, 1)),
+                p("overlaps", "Overlaps", num(1.0), slider(1.0, 20.0, 1.0, 10.0, 0)),
+                p("direction", "Direction", num(0.0), ang()),
+                p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
+                p("coverage", "Coverage", num(80.0), pct()),
+                p("shadowing", "Shadowing", num(50.0), pct()),
+                p("texture", "Texture", num(10.0), pct()),
+            ],
+            threads,
+        ),
+        spec(
+            "ec.generate.audiospectrum",
+            "Audio Spectrum",
+            vec![
+                p("audioLayer", "Audio Layer", Value::Layer(None), ParamUi::Layer),
+                p("startPoint", "Start Point", pt(0.1, 0.5), ParamUi::Point),
+                p("endPoint", "End Point", pt(0.9, 0.5), ParamUi::Point),
+                mask_idx("path", "Path", 0.0),
+                check("usePolarPath", "Use Polar Path", false),
+                p("startFrequency", "Start Frequency", num(20.0), slider(1.0, 20000.0, 1.0, 2000.0, 0)),
+                p("endFrequency", "End Frequency", num(2000.0), slider(1.0, 20000.0, 1.0, 10000.0, 0)),
+                p("frequencyBands", "Frequency bands", num(64.0), slider(1.0, 4096.0, 1.0, 256.0, 0)),
+                p("maximumHeight", "Maximum Height", num(50.0), slider(0.0, 10000.0, 0.0, 500.0, 1)),
+                p("audioDuration", "Audio Duration (milliseconds)", num(90.0), slider(1.0, 30000.0, 1.0, 1000.0, 1)),
+                p("audioOffset", "Audio Offset (milliseconds)", num(0.0), slider(-30000.0, 30000.0, -1000.0, 1000.0, 1)),
+                p("thickness", "Thickness", num(3.0), slider(0.0, 1000.0, 0.0, 50.0, 2)),
+                p("softness", "Softness", num(50.0), pct()),
+                p("insideColor", "Inside Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("outsideColor", "Outside Color", col(0.2, 0.4, 1.0), ParamUi::Color),
+                check("blendOverlappingColors", "Blend Overlapping Colors", true),
+                p("hueInterpolation", "Hue Interpolation", num(0.0), ang()),
+                check("dynamicHuePhase", "Dynamic Hue Phase", false),
+                check("colorSymmetry", "Color Symmetry", false),
+                p("displayOptions", "Display Options", Value::Enum(0), display()),
+                p("sideOptions", "Side Options", Value::Enum(0), popup(&["Side A", "Side B", "Side A & B"])),
+                check("durationAveraging", "Duration Averaging", false),
+                check("compositeOnOriginal", "Composite On Original", false),
+            ],
+            audio_spectrum,
+        ),
+        spec(
+            "ec.generate.audiowaveform",
+            "Audio Waveform",
+            vec![
+                p("audioLayer", "Audio Layer", Value::Layer(None), ParamUi::Layer),
+                p("startPoint", "Start Point", pt(0.1, 0.5), ParamUi::Point),
+                p("endPoint", "End Point", pt(0.9, 0.5), ParamUi::Point),
+                mask_idx("path", "Path", 0.0),
+                check("usePolarPath", "Use Polar Path", false),
+                p("displayedSamples", "Displayed Samples", num(200.0), slider(2.0, 4096.0, 2.0, 1000.0, 0)),
+                p("maximumHeight", "Maximum Height", num(100.0), slider(0.0, 10000.0, 0.0, 500.0, 1)),
+                p("audioDuration", "Audio Duration (milliseconds)", num(200.0), slider(1.0, 30000.0, 1.0, 1000.0, 1)),
+                p("audioOffset", "Audio Offset (milliseconds)", num(0.0), slider(-30000.0, 30000.0, -1000.0, 1000.0, 1)),
+                p("thickness", "Thickness", num(2.0), slider(0.0, 1000.0, 0.0, 50.0, 2)),
+                p("softness", "Softness", num(10.0), pct()),
+                p("randomSeed", "Random Seed (Analog)", num(1.0), slider(1.0, 10000.0, 1.0, 100.0, 0)),
+                p("insideColor", "Inside Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("outsideColor", "Outside Color", col(0.2, 0.4, 1.0), ParamUi::Color),
+                p("waveformOptions", "Waveform Options", Value::Enum(0), popup(&["Mono", "Left", "Right"])),
+                p("displayOptions", "Display Options", Value::Enum(1), display()),
+                check("compositeOnOriginal", "Composite On Original", false),
+            ],
+            audio_waveform,
+        ),
+    ]
+}
diff --git a/crates/effects/src/generate3/tests.rs b/crates/effects/src/generate3/tests.rs
new file mode 100644
index 000000000..be7c14ed7
--- /dev/null
+++ b/crates/effects/src/generate3/tests.rs
@@ -0,0 +1,455 @@
+use super::*;
+use crate::{EffectEnv, EffectHost, LayerPixels, MaskShape, Params};
+
+/// Run with point defaults scaled to the layer size.
+pub(crate) fn run_env(id: &str, set: &[(&str, Value)], img: Image, time: f64, env: EffectEnv) -> Buf {
+    let s = crate::find(id).unwrap();
+    let ls = [img.width as f64, img.height as f64];
+    let mut params = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    for p in &s.params {
+        if let (ParamUi::Point, Value::Vec2(v)) = (&p.ui, &p.default) {
+            params.values.insert(p.id.to_string(), Value::Vec2([v[0] * ls[0], v[1] * ls[1]]));
+        }
+    }
+    for (k, v) in set {
+        assert!(params.values.contains_key(*k), "{id}: unknown {k}");
+        params.values.insert(k.to_string(), v.clone());
+    }
+    let ctx = EffectCtx { params: &params, time, layer_size: ls, seed: 3, adjustment: false, env };
+    crate::apply(s, &ctx, Buf { img, offset: [0.0, 0.0], scale: 1.0 })
+}
+
+fn run(id: &str, set: &[(&str, Value)], img: Image) -> Buf {
+    run_env(id, set, img, 0.5, EffectEnv::default())
+}
+
+fn square_mask() -> Vec<MaskShape> {
+    vec![MaskShape { name: "Mask 1".into(), points: vec![[16.0, 16.0], [48.0, 16.0], [48.0, 48.0], [16.0, 48.0]], closed: true, inverted: false }]
+}
+
+fn alpha_sum(img: &Image, x0: usize, y0: usize, x1: usize, y1: usize) -> f32 {
+    let mut s = 0.0;
+    for y in y0..y1 {
+        for x in x0..x1 {
+            s += img.data[y * img.width as usize + x][3];
+        }
+    }
+    s
+}
+
+#[test]
+fn audio_spectrum_linear_frequency_and_linear_amplitude() {
+    let host = Tone; // Tone produces 440 Hz
+    let env = EffectEnv { host: Some(&host), comp_time: 1.0, ..Default::default() };
+    let img = Image::new(200, 100);
+    let out = run_env(
+        "ec.generate.audiospectrum",
+        &[
+            ("audioLayer", Value::Layer(Some(1))),
+            ("startPoint", Value::Vec2([0.0, 50.0])),
+            ("endPoint", Value::Vec2([200.0, 50.0])),
+            ("startFrequency", num(20.0)),
+            ("endFrequency", num(2000.0)),
+            ("frequencyBands", num(100.0)),
+            ("maximumHeight", num(40.0)),
+            ("thickness", num(2.0)),
+            ("softness", num(0.0)),
+        ],
+        img,
+        1.0,
+        env,
+    );
+    // Verify 440 Hz tone produces a peak above baseline, while high frequencies have zero bar height
+    let peak_zone = alpha_sum(&out.img, 36, 10, 48, 48);
+    let high_zone = alpha_sum(&out.img, 120, 10, 150, 48);
+    let silent_zone = alpha_sum(&out.img, 170, 10, 195, 48);
+    assert!(peak_zone > 5.0, "peak zone has energy: {peak_zone}");
+    assert!(peak_zone > high_zone * 2.0, "linear peak is distinctly taller than far frequencies: {peak_zone} vs {high_zone}");
+    assert_eq!(silent_zone, 0.0, "silent end has zero height, not boosted by dB scale");
+}
+
+#[test]
+fn fractal_deterministic_and_has_inside_set() {
+    let img = Image::new(64, 48);
+    let a = run("ec.generate.fractal", &[], img.clone());
+    let b = run("ec.generate.fractal", &[], img.clone());
+    assert_eq!(a.img.data, b.img.data);
+    // The default view contains the main cardioid (black, opaque) and escaped (coloured) points.
+    assert!(a.img.data.iter().any(|p| p[3] > 0.99 && p[0] + p[1] + p[2] < 0.01));
+    assert!(a.img.data.iter().any(|p| p[0] + p[1] + p[2] > 0.3));
+    let t = run("ec.generate.fractal", &[("fractalColor/transparency", Value::Bool(true))], img);
+    assert!(t.img.data.iter().any(|p| p[3] == 0.0));
+}
+
+#[test]
+fn fractal_palettes_and_set_choices() {
+    let img = Image::new(64, 48);
+    // Solid Color: only the inside of the set is drawn; Transparency flips it.
+    let solid = run("ec.generate.fractal", &[("fractalColor/palette", Value::Enum(3))], img.clone());
+    assert!(solid.img.data.iter().any(|p| p[3] == 0.0) && solid.img.data.iter().any(|p| p[3] > 0.99 && p[0] > 0.9));
+    let flipped = run("ec.generate.fractal", &[("fractalColor/palette", Value::Enum(3)), ("fractalColor/transparency", Value::Bool(true))], img.clone());
+    for (a, b) in solid.img.data.iter().zip(&flipped.img.data) {
+        assert!((a[3] > 0.5) != (b[3] > 0.5) || (a[3] - 0.5).abs() < 0.49);
+    }
+    // Black And White: escaped pixels are pure black or white (away from supersampled edges).
+    let bw = run("ec.generate.fractal", &[("fractalColor/palette", Value::Enum(2)), ("highQualitySettings/samplingFactor", num(1.0))], img.clone());
+    assert!(bw.img.data.iter().all(|p| p[0] == p[1] && p[1] == p[2] && (p[0] == 0.0 || p[0] == 1.0)));
+    // Mandelbrot Over Julia depends on the Julia centre.
+    let o1 = run("ec.generate.fractal", &[("setChoice", Value::Enum(2)), ("julia/juliaX", num(0.3))], img.clone());
+    let o2 = run("ec.generate.fractal", &[("setChoice", Value::Enum(2)), ("julia/juliaX", num(-0.2))], img.clone());
+    assert_ne!(o1.img.data, o2.img.data);
+    let plain = run("ec.generate.fractal", &[("julia/juliaX", num(0.3))], img);
+    assert_ne!(o1.img.data, plain.img.data);
+}
+
+#[test]
+fn scribble_fills_mask_and_animates() {
+    let masks = square_mask();
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let img = Image::filled(64, 64, [0.0, 0.0, 1.0, 1.0]);
+    let a = run_env("ec.generate.scribble", &[], img.clone(), 0.5, env);
+    let b = run_env("ec.generate.scribble", &[], img.clone(), 0.5, env);
+    assert_eq!(a.img.data, b.img.data);
+    let inside = alpha_sum(&a.img, 18, 18, 46, 46);
+    let outside = alpha_sum(&a.img, 0, 0, 10, 64);
+    assert!(inside > 100.0 && outside < 1.0, "{inside} {outside}");
+    let c = run_env("ec.generate.scribble", &[], img.clone(), 1.5, env);
+    assert_ne!(a.img.data, c.img.data, "jumpy wiggle changes over time");
+    let s = run_env("ec.generate.scribble", &[("wiggleType", Value::Enum(0))], img.clone(), 0.5, env);
+    let s2 = run_env("ec.generate.scribble", &[("wiggleType", Value::Enum(0))], img.clone(), 3.5, env);
+    assert_eq!(s.img.data, s2.img.data, "static wiggle is constant");
+    let half = run_env("ec.generate.scribble", &[("end", num(50.0))], img, 0.5, env);
+    assert!(alpha_sum(&half.img, 0, 0, 64, 64) < alpha_sum(&a.img, 0, 0, 64, 64));
+}
+
+#[test]
+fn scribble_edge_types() {
+    let masks = square_mask();
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let img = Image::new(64, 64);
+    let o = run_env("ec.generate.scribble", &[("fillType", Value::Enum(3)), ("edgeOptions/edgeWidth", num(6.0))], img, 0.5, env);
+    // Outside edge: paint near the border outside, nothing in the centre.
+    assert!(alpha_sum(&o.img, 26, 26, 38, 38) < 0.5);
+    assert!(alpha_sum(&o.img, 8, 8, 16, 56) > 5.0);
+}
+
+#[test]
+fn stroke_draws_along_mask() {
+    let masks = square_mask();
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let img = Image::new(64, 64);
+    let a = run_env("ec.generate.stroke", &[("brushSize", num(4.0)), ("paintStyle", Value::Enum(1))], img.clone(), 0.0, env);
+    assert!(a.img.get(32, 16)[3] > 0.9, "on the top edge");
+    assert!(a.img.get(32, 32)[3] < 0.01, "centre empty");
+    let b = run_env("ec.generate.stroke", &[("brushSize", num(4.0)), ("end", num(25.0))], img.clone(), 0.0, env);
+    assert!(b.img.get(32, 16)[3] > 0.9 && b.img.get(48, 32)[3] < 0.01, "first quarter only");
+    let d = run_env("ec.generate.stroke", &[("brushSize", num(4.0)), ("spacing", num(300.0))], img, 0.0, env);
+    assert!(alpha_sum(&d.img, 0, 0, 64, 64) < alpha_sum(&a.img, 0, 0, 64, 64), "spaced dabs");
+    // No masks: unchanged.
+    let src = Image::filled(8, 8, [0.2, 0.3, 0.4, 1.0]);
+    assert_eq!(run("ec.generate.stroke", &[], src.clone()).img.data, src.data);
+}
+
+#[test]
+fn vegas_traces_contours() {
+    let mut img = Image::new(64, 64);
+    for y in 16..48 {
+        for x in 16..48 {
+            img.set(x, y, [1.0, 1.0, 1.0, 1.0]);
+        }
+    }
+    let a =
+        run("ec.generate.vegas", &[("blendMode", Value::Enum(0)), ("length", num(1.0)), ("midpointOpacity", num(1.0)), ("endOpacity", num(1.0))], img.clone());
+    let b =
+        run("ec.generate.vegas", &[("blendMode", Value::Enum(0)), ("length", num(1.0)), ("midpointOpacity", num(1.0)), ("endOpacity", num(1.0))], img.clone());
+    assert_eq!(a.img.data, b.img.data);
+    assert!(alpha_sum(&a.img, 14, 14, 50, 50) > 50.0, "edges drawn");
+    assert!(alpha_sum(&a.img, 26, 26, 38, 38) < 0.5, "interior untouched");
+    let r = run("ec.generate.vegas", &[("blendMode", Value::Enum(0)), ("rotation", num(90.0))], img);
+    assert_ne!(r.img.data, a.img.data);
+}
+
+#[test]
+fn contours_of_square_are_closed() {
+    let mut pl = Plane::new(20, 20);
+    for y in 5..15 {
+        for x in 5..15 {
+            pl.data[y * 20 + x] = 1.0;
+        }
+    }
+    let c = contours(&pl, 0.5);
+    assert_eq!(c.len(), 1);
+    assert!(c[0].1);
+    let l = poly_length(&c[0].0, true);
+    assert!((l - 40.0).abs() < 4.0, "{l}");
+}
+
+#[test]
+fn write_on_and_glue_gun_draw_at_brush() {
+    let img = Image::new(32, 32);
+    let a = run("ec.generate.writeon", &[], img.clone());
+    assert!(a.img.get(16, 16)[3] > 0.9 && a.img.get(2, 2)[3] == 0.0);
+    assert_eq!(a.img.data, run("ec.generate.writeon", &[], img.clone()).img.data);
+    let src = Image::filled(32, 32, [0.5, 0.2, 0.1, 1.0]);
+    let g = run("ec.generate.ccgluegun", &[], src.clone());
+    assert_eq!(g.img.data, run("ec.generate.ccgluegun", &[], src.clone()).img.data);
+    assert_ne!(g.img.get(16, 16), src.get(16, 16));
+    assert_eq!(g.img.get(0, 0), src.get(0, 0));
+}
+
+/// #2980: Brush Size of Write-on and Stroke goes up to 200 px as in After Effects (read back from
+/// After Effects 2026: setting 201 is refused with "out of range 0 to 200"), and a brush that
+/// wide paints that wide.
+#[test]
+fn brush_size_goes_up_to_200() {
+    for id in ["ec.generate.writeon", "ec.generate.stroke"] {
+        let spec = crate::find(id).unwrap();
+        let size = spec.params.iter().find(|p| p.id == "brushSize").unwrap();
+        assert!(matches!(size.ui, ParamUi::Slider { min, max, .. } if min == 0.0 && max == 200.0), "{id}: {:?}", size.ui);
+    }
+    let set = [("brushSize", num(120.0)), ("brushHardness", num(100.0)), ("brushPosition", Value::Vec2([128.0, 128.0]))];
+    let wide = run("ec.generate.writeon", &set, Image::new(256, 256));
+    assert!(wide.img.get(128 + 55, 128)[3] > 0.9, "radius 60 reaches 55 px from the centre");
+    assert!(wide.img.get(128 + 70, 128)[3] == 0.0);
+}
+
+/// #536: an animated Brush Position draws a stroke that stays (Stroke Length 0), expires
+/// after Stroke Length, and lays its dabs Brush Spacing seconds apart.
+#[test]
+fn write_on_accumulates_a_stroke_along_the_animated_brush() {
+    // Brush Position from [8, 16] at 0 s to [56, 16] at 1 s; red, hard, 6 px.
+    struct Brush(Vec<(&'static str, Value)>);
+    impl Brush {
+        fn at(&self, t: f64) -> Vec<(&'static str, Value)> {
+            let mut v = self.0.clone();
+            v.push(("brushPosition", Value::Vec2([8.0 + 48.0 * t.clamp(0.0, 1.0), 16.0])));
+            v
+        }
+    }
+    impl EffectHost for Brush {
+        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn params_at(&self, t: f64) -> Option<Params> {
+            let s = crate::find("ec.generate.writeon").unwrap();
+            let mut p = Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+            for (k, v) in self.at(t) {
+                p.values.insert(k.to_string(), v);
+            }
+            Some(p)
+        }
+    }
+    let render = |extra: &[(&'static str, Value)], t: f64| {
+        let mut set = vec![("color", col(1.0, 0.0, 0.0)), ("brushSize", num(6.0)), ("brushHardness", num(100.0)), ("brushSpacing", num(0.05))];
+        set.extend(extra.iter().cloned());
+        let host = Brush(set);
+        let env = EffectEnv { host: Some(&host), ..Default::default() };
+        let at = host.at(t);
+        run_env("ec.generate.writeon", &at, Image::new(64, 32), t, env).img
+    };
+    let on = |img: &Image, x: i64| img.get(x, 16)[3] > 0.9;
+    let half = render(&[], 0.5);
+    assert!(on(&half, 8) && on(&half, 20) && on(&half, 32) && !on(&half, 44) && !on(&half, 56));
+    let end = render(&[], 1.0);
+    assert!([8, 20, 32, 44, 56].iter().all(|x| on(&end, *x)));
+    // Stroke Length 0.25 s: only the last quarter second's trail.
+    let trail = render(&[("strokeLength", num(0.25))], 1.0);
+    assert!(!on(&trail, 8) && !on(&trail, 32) && on(&trail, 48) && on(&trail, 56));
+    // Brush Spacing 0.5 s: three separate marks.
+    let spaced = render(&[("brushSpacing", num(0.5))], 1.0);
+    assert!(on(&spaced, 8) && on(&spaced, 32) && on(&spaced, 56) && !on(&spaced, 20) && !on(&spaced, 44));
+    // Paint Time Properties ▸ Opacity: each dab keeps the opacity it was laid with.
+    struct Fade;
+    impl EffectHost for Fade {
+        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn params_at(&self, t: f64) -> Option<Params> {
+            let mut p = Brush(vec![("brushHardness", num(100.0)), ("brushSpacing", num(0.05)), ("paintTimeProperties", Value::Enum(1))]).params_at(t)?;
+            p.values.insert("brushOpacity".into(), num(if t < 0.5 { 100.0 } else { 20.0 }));
+            Some(p)
+        }
+    }
+    let p1 = Fade.params_at(1.0).unwrap();
+    let set: Vec<(&str, Value)> = p1.values.iter().map(|(k, v)| (k.as_str(), v.clone())).collect();
+    let faded = run_env("ec.generate.writeon", &set, Image::new(64, 32), 1.0, EffectEnv { host: Some(&Fade), ..Default::default() }).img;
+    assert!(faded.get(8, 16)[3] > 0.9 && (faded.get(56, 16)[3] - 0.2).abs() < 0.05, "{:?} {:?}", faded.get(8, 16), faded.get(56, 16));
+}
+
+#[test]
+fn paint_bucket_fills_enclosed_region_only() {
+    let mut img = Image::filled(32, 32, [1.0, 1.0, 1.0, 1.0]);
+    for i in 8..24 {
+        for &(x, y) in &[(i, 8), (i, 23), (8, i), (23, i)] {
+            img.set(x, y, [0.0, 0.0, 0.0, 1.0]);
+        }
+    }
+    let out = run("ec.generate.paintbucket", &[], img.clone());
+    let inside = out.img.get(16, 16);
+    assert!(inside[0] > 0.99 && inside[1] < 0.01, "{inside:?}");
+    assert_eq!(out.img.get(2, 2), [1.0, 1.0, 1.0, 1.0], "outside untouched");
+    assert_eq!(out.img.get(8, 16), [0.0, 0.0, 0.0, 1.0], "border untouched");
+    assert_eq!(out.img.data, run("ec.generate.paintbucket", &[], img).img.data);
+}
+
+#[test]
+fn eyedropper_fill_uses_sample() {
+    let mut img = Image::filled(16, 16, [0.0, 0.0, 1.0, 1.0]);
+    img.set(8, 8, [1.0, 0.0, 0.0, 1.0]);
+    let out = run("ec.generate.eyedropperfill", &[], img.clone());
+    assert!(out.img.data.iter().all(|p| *p == [1.0, 0.0, 0.0, 1.0]));
+    let blended = run("ec.generate.eyedropperfill", &[("blendWithOriginal", num(100.0))], img.clone());
+    assert_eq!(blended.img.data, img.data);
+}
+
+#[test]
+fn threads_weave_is_deterministic_and_gappy() {
+    let src = Image::filled(64, 64, [0.4, 0.6, 0.2, 1.0]);
+    let a = run("ec.generate.ccthreads", &[("width", num(16.0)), ("height", num(16.0)), ("coverage", num(50.0))], src.clone());
+    assert_eq!(a.img.data, run("ec.generate.ccthreads", &[("width", num(16.0)), ("height", num(16.0)), ("coverage", num(50.0))], src).img.data);
+    assert!(a.img.data.iter().any(|p| p[3] == 0.0), "gaps between threads");
+    assert!(a.img.data.iter().any(|p| p[3] > 0.99), "threads");
+}
+
+struct Tone;
+impl EffectHost for Tone {
+    fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+        None
+    }
+    fn audio(&self, _: u64, start: f64, frames: usize, rate: u32) -> Option<Vec<f32>> {
+        Some(
+            (0..frames)
+                .flat_map(|i| {
+                    let t = start + i as f64 / rate as f64;
+                    let v = (2.0 * PI * 440.0 * t).sin() as f32 * 0.8;
+                    [v, v]
+                })
+                .collect(),
+        )
+    }
+}
+
+#[test]
+fn audio_effects_without_audio_pass_through() {
+    let src = Image::filled(16, 16, [0.3, 0.3, 0.3, 1.0]);
+    for id in ["ec.generate.audiospectrum", "ec.generate.audiowaveform"] {
+        assert_eq!(run(id, &[], src.clone()).img.data, src.data, "{id}");
+    }
+}
+
+#[test]
+fn audio_effects_draw_with_host() {
+    let host = Tone;
+    let env = EffectEnv { host: Some(&host), comp_time: 1.0, ..Default::default() };
+    let img = Image::new(96, 64);
+    for id in ["ec.generate.audiospectrum", "ec.generate.audiowaveform"] {
+        let a = run_env(id, &[("audioLayer", Value::Layer(Some(1)))], img.clone(), 1.0, env);
+        let b = run_env(id, &[("audioLayer", Value::Layer(Some(1)))], img.clone(), 1.0, env);
+        assert_eq!(a.img.data, b.img.data, "{id}");
+        assert!(alpha_sum(&a.img, 0, 0, 96, 64) > 10.0, "{id} drew nothing");
+    }
+}
+
+#[test]
+fn fft_finds_tone() {
+    let n = 256;
+    let mut re: Vec<f64> = (0..n).map(|i| (2.0 * PI * 8.0 * i as f64 / n as f64).cos()).collect();
+    let mut im = vec![0.0; n];
+    fft(&mut re, &mut im);
+    let mags: Vec<f64> = (0..n / 2).map(|k| (re[k] * re[k] + im[k] * im[k]).sqrt()).collect();
+    let peak = mags.iter().enumerate().max_by(|a, b| a.1.total_cmp(b.1)).unwrap().0;
+    assert_eq!(peak, 8);
+}
+
+#[test]
+fn stroke_outline_caps_and_joins() {
+    let line = vec![vec![[10.0, 10.0], [30.0, 10.0]]];
+    let cov = |cap: u32| raster_convex(40, 20, &stroke_outline(&line, 3.0, cap, 0, 4.0));
+    // Round caps reach 3 px past the ends (on the axis), Butt stops there, Projecting is square.
+    let (round, butt, proj) = (cov(0), cov(1), cov(2));
+    assert!(round.get(8, 10) > 0.9 && butt.get(8, 10) < 0.1 && proj.get(8, 10) > 0.9);
+    assert!(proj.get(7, 7) > 0.9 && round.get(7, 7) < 0.5, "square corner");
+    // A right-angle turn: Miter fills the outer corner, Bevel cuts it.
+    let corner = vec![vec![[5.0, 30.0], [30.0, 30.0], [30.0, 5.0]]];
+    let j = |join: u32| raster_convex(40, 40, &stroke_outline(&corner, 3.0, 1, join, 4.0));
+    let (miter, bevel) = (j(1), j(2));
+    assert!(miter.get(32, 32) > 0.9 && bevel.get(32, 32) < 0.1, "{} {}", miter.get(32, 32), bevel.get(32, 32));
+    // A tight miter limit falls back to a bevel.
+    let limited = raster_convex(40, 40, &stroke_outline(&corner, 3.0, 1, 1, 1.0));
+    assert!(limited.get(32, 32) < 0.1);
+}
+
+#[test]
+fn scribble_caps_and_start_end_apply_to() {
+    let masks = square_mask();
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let img = Image::new(64, 64);
+    let base = [("wiggleType", Value::Enum(0)), ("strokeWidth", num(3.0))];
+    let round = run_env("ec.generate.scribble", &base, img.clone(), 0.0, env);
+    let butt = run_env(
+        "ec.generate.scribble",
+        &[base.as_slice(), &[("edgeOptions/endCap", Value::Enum(1)), ("edgeOptions/join", Value::Enum(2))]].concat(),
+        img.clone(),
+        0.0,
+        env,
+    );
+    assert_ne!(round.img.data, butt.img.data);
+    // Each Stroke: every stroke is trimmed on its own, so the half-way image has ink all over.
+    let two = vec![
+        crate::MaskShape { name: String::new(), points: vec![[4.0, 4.0], [28.0, 4.0], [28.0, 60.0], [4.0, 60.0]], closed: true, inverted: false },
+        crate::MaskShape { name: String::new(), points: vec![[36.0, 4.0], [60.0, 4.0], [60.0, 60.0], [36.0, 60.0]], closed: true, inverted: false },
+    ];
+    let env2 = EffectEnv { masks: &two, ..Default::default() };
+    let seq = [("scribble", Value::Enum(1)), ("end", num(50.0))];
+    let all = run_env("ec.generate.scribble", &[base.as_slice(), &seq].concat(), img.clone(), 0.0, env2);
+    let each = run_env("ec.generate.scribble", &[base.as_slice(), &seq, &[("startEndApplyTo", Value::Enum(1))]].concat(), img, 0.0, env2);
+    assert_ne!(all.img.data, each.img.data);
+}
+
+#[test]
+fn vegas_long_segments_are_sampled_finely() {
+    // A short segment keeps the 12 samples; a long one gets more so it bends smoothly round rounded corners.
+    assert_eq!(super::paths::vegas_substeps(10.0, 4.0), 12);
+    let n = super::paths::vegas_substeps(400.0, 4.0);
+    assert!(n > 12 && n.is_multiple_of(2), "{n}");
+    assert!(super::paths::vegas_substeps(13.0 * 4.0, 4.0).is_multiple_of(2));
+    assert!(400.0 / n as f64 <= 4.0 + 1e-9);
+    assert_eq!(super::paths::vegas_substeps(1.0e9, 4.0), 512);
+}
+
+#[test]
+fn vegas_long_segment_follows_curved_mask() {
+    // One segment as long as a round mask (radius 90 px): with only 12 straight pieces the
+    // chords cut ~3 px inside the curve, leaving gaps on the mask outline.
+    let (c, r) = (100.0, 90.0);
+    let mut points = Vec::new();
+    for i in 0..256 {
+        let a = i as f64 / 256.0 * std::f64::consts::TAU;
+        points.push([c + r * a.cos(), c + r * a.sin()]);
+    }
+    let masks = vec![MaskShape { name: "Mask 1".into(), points, closed: true, inverted: false }];
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let set = [
+        ("stroke", Value::Enum(1)),
+        ("segments", num(1.0)),
+        ("length", num(1.0)),
+        ("segmentDistribution", Value::Enum(1)),
+        ("blendMode", Value::Enum(0)),
+        ("hardness", num(1.0)),
+        ("midpointOpacity", num(1.0)),
+        ("endOpacity", num(1.0)),
+    ];
+    let out = run_env("ec.generate.vegas", &set, Image::new(200, 200), 0.5, env);
+    for k in 0..720 {
+        let a = k as f64 / 720.0 * std::f64::consts::TAU;
+        let (x, y) = ((c + r * a.cos()).floor() as usize, (c + r * a.sin()).floor() as usize);
+        let alpha = out.img.data[y * 200 + x][3];
+        assert!(alpha > 0.5, "gap on the curve at {k}/720 turn: alpha {alpha}");
+    }
+}
diff --git a/crates/effects/src/keying.rs b/crates/effects/src/keying.rs
index 9d61ff8c8..4953d482c 100644
--- a/crates/effects/src/keying.rs
+++ b/crates/effects/src/keying.rs
@@ -2,12 +2,13 @@
 //! matte clean-up. Written from public behaviour descriptions and the standard colour-difference /
 //! blue-screen matting literature (Vlahos; Smith & Blinn, "Blue Screen Matting").
 
-use effectcraft_color::{luminance, rgb_to_hsl, srgb_to_linear};
+use effectcraft_color::{rgb_to_hsl, srgb_to_linear};
 use effectcraft_keyframe::Value;
 use effectcraft_project::ParamUi;
 use effectcraft_raster::{Image, gaussian_blur};
 use rayon::prelude::*;
 
+use crate::color_fx::luma_601;
 use crate::util::{Plane, gauss_plane, morph_frac, premul, unpremul};
 use crate::{Buf, EffectCtx, EffectSpec, col, num, p, popup, slider};
 
@@ -135,46 +136,23 @@ fn color_key(ctx: &EffectCtx, mut b: Buf) -> Buf {
 
 // ---- Luma Key ----
 
+/// Luma Key as After Effects 2026 keys a grey ramp (cases 812-814, 719): Key Out Brighter and
+/// Darker cut hard at Threshold and ignore Tolerance; Key Out Similar removes, and Dissimilar
+/// keeps, a hard band of Threshold ± Tolerance (levels of 255). Edge Thin and Edge Feather
+/// then soften the cut.
 fn luma_key(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let kind = ctx.params.e("keyType");
     let thr = ctx.params.f("threshold") as f32 / 255.0;
     let tol = ctx.params.f("tolerance") as f32 / 255.0;
     let m = matte_of(&b.img, |c, _| {
-        let l = luminance(c[0], c[1], c[2]);
-        match kind {
-            0 => {
-                if tol > 0.0 {
-                    ((thr + tol - l) / tol).clamp(0.0, 1.0)
-                } else if l > thr {
-                    0.0
-                } else {
-                    1.0
-                }
-            }
-            2 => {
-                if (l - thr).abs() <= tol {
-                    0.0
-                } else {
-                    1.0
-                }
-            }
-            3 => {
-                if (l - thr).abs() <= tol {
-                    1.0
-                } else {
-                    0.0
-                }
-            }
-            _ => {
-                if tol > 0.0 {
-                    ((l - (thr - tol)) / tol).clamp(0.0, 1.0)
-                } else if l < thr {
-                    0.0
-                } else {
-                    1.0
-                }
-            }
-        }
+        let l = luma_601([c[0], c[1], c[2]]);
+        let keep = match kind {
+            0 => l <= thr,
+            2 => (l - thr).abs() > tol,
+            3 => (l - thr).abs() <= tol,
+            _ => l >= thr,
+        };
+        if keep { 1.0 } else { 0.0 }
     });
     let m = thin_feather(m, ctx.params.f("edgeThin") * b.scale, ctx.params.f("edgeFeather") * b.scale);
     apply_matte(&mut b.img, &m, 0);
@@ -334,7 +312,7 @@ fn extract(ctx: &EffectCtx, mut b: Buf) -> Buf {
                 2 => c[1],
                 3 => c[2],
                 4 => a,
-                _ => luminance(c[0], c[1], c[2]),
+                _ => luma_601([c[0], c[1], c[2]]),
             };
         let mut k = 1.0f32;
         if v < bp {
@@ -802,6 +780,68 @@ mod tests {
         assert_eq!(out.get(1, 0)[3], 1.0);
     }
 
+    /// After Effects 2026 (cases 812-814): Luma Key on a vertical black-to-white ramp (row y
+    /// has level (y + 0.5) / 1080 × 255), Threshold 140, Tolerance 20. EffectCraft ramped the
+    /// matte over the tolerance (case 719: a 50 % grey kept 80 % of its alpha where AE keys it
+    /// out).
+    #[test]
+    fn luma_key_matches_after_effects() {
+        let ramp = || {
+            let mut img = Image::new(1, 1080);
+            for y in 0..1080 {
+                let v = (y as f32 + 0.5) / 1080.0;
+                img.set(0, y, [v, v, v, 1.0]);
+            }
+            img
+        };
+        let key = |kind: u32, thin: f64, feather: f64| {
+            let set =
+                [("keyType", Value::Enum(kind)), ("threshold", num(140.0)), ("tolerance", num(20.0)), ("edgeThin", num(thin)), ("edgeFeather", num(feather))];
+            let o = run("ec.key.luma", &set, ramp());
+            (0..1080).map(|y| o.get(0, y)[3]).collect::<Vec<f32>>()
+        };
+        // Key Out Darker (AE 2 = EffectCraft 1): keyed up to row 592, kept from 593.
+        let d = key(1, 0.0, 0.0);
+        assert!(d[..593].iter().all(|a| *a == 0.0) && d[593..].iter().all(|a| *a == 1.0), "{:?}", &d[588..598]);
+        // Key Out Similar: AE keys rows 509..=677 (levels 120.3..160.0) and keeps the rest; the
+        // rows at the band's ends sit within 0.1 level of 120 / 160, so they may go either way.
+        let s = key(2, 0.0, 0.0);
+        assert!(
+            (0..1080).filter(|y| !(507..=510).contains(y) && !(676..=679).contains(y)).all(|y| (s[y] == 0.0) == (509..=677).contains(&y)),
+            "{:?} {:?}",
+            &s[505..512],
+            &s[674..681]
+        );
+        // Key Out Brighter and Dissimilar are the complements.
+        let b = key(0, 0.0, 0.0);
+        assert!(b[595] == 0.0 && b[590] == 1.0);
+        let ds = key(3, 0.0, 0.0);
+        assert!(ds[600] == 1.0 && ds[400] == 0.0 && ds[700] == 0.0);
+        // A 50 % grey at Darker 140 / 20 is keyed out entirely (case 719).
+        let o =
+            run("ec.key.luma", &[("keyType", Value::Enum(1)), ("threshold", num(140.0)), ("tolerance", num(20.0))], Image::filled(2, 2, [0.5, 0.5, 0.5, 1.0]));
+        assert_eq!(o.get(0, 0)[3], 0.0);
+        // Edge Thin 1, Edge Feather 2.5 (case 814): AE's alpha rises over rows 591..596.
+        let f = key(1, 1.0, 2.5);
+        for (y, ae) in [(590, 0.0), (591, 0.026), (592, 0.139), (593, 0.357), (594, 0.635), (595, 0.868), (596, 0.97), (597, 1.0)] {
+            assert!((f[y] - ae).abs() < 0.2, "row {y}: {} vs AE {ae}", f[y]);
+        }
+    }
+
+    /// After Effects 2026: Key Out Darker and Extract's Black Point at 65 / 166 / 24 on pure
+    /// red / green / blue keep red and blue and key out green: Rec. 601 luminance (Rec. 709
+    /// would key out red and blue and keep green).
+    #[test]
+    fn luma_key_and_extract_use_rec601_as_after_effects() {
+        for (c, thr, kept) in [([1.0, 0.0, 0.0], 65.0, true), ([0.0, 1.0, 0.0], 166.0, false), ([0.0, 0.0, 1.0], 24.0, true)] {
+            let img = Image::filled(2, 1, [c[0], c[1], c[2], 1.0]);
+            let key = run("ec.key.luma", &[("keyType", Value::Enum(1)), ("threshold", num(thr))], img.clone());
+            let ext = run("ec.key.extract", &[("blackPoint", num(thr))], img);
+            let want = if kept { 1.0 } else { 0.0 };
+            assert_eq!((key.get(0, 0)[3], ext.get(0, 0)[3]), (want, want), "{c:?} at {thr}");
+        }
+    }
+
     #[test]
     fn extract_keeps_range() {
         let mut img = Image::new(3, 1);
diff --git a/crates/effects/src/keying2.rs b/crates/effects/src/keying2.rs
index a03fe804d..5512d1820 100644
--- a/crates/effects/src/keying2.rs
+++ b/crates/effects/src/keying2.rs
@@ -317,7 +317,7 @@ fn unmult(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---------------------------------------------------------------- CC Simple Wire Removal
+// ---------------------------------------------------------------- Line Removal
 
 fn wire_removal(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let pa = ctx.params.v2("pointA");
@@ -464,7 +464,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.key.ccsimplewireremoval",
-            "CC Simple Wire Removal",
+            "Line Removal",
             vec![
                 p("pointA", "Point A", Value::Vec2([0.25, 0.25]), ParamUi::Point),
                 p("pointB", "Point B", Value::Vec2([0.75, 0.75]), ParamUi::Point),
diff --git a/crates/effects/src/keylight.rs b/crates/effects/src/keylight.rs
index 84085f4e3..fb36075cb 100644
--- a/crates/effects/src/keylight.rs
+++ b/crates/effects/src/keylight.rs
@@ -1,6 +1,6 @@
-//! Key Light — a full screen-colour keyer with the controls of After Effects' bundled
+//! Screen Color Key — a full screen-colour keyer with the controls of After Effects' bundled
 //! "Keylight (1.2)" (that name is a trademark of its vendor, so the effect is registered as
-//! **Key Light**; `lookup("Keylight (1.2)")` finds it through [`KEYLIGHT_ALIASES`]).
+//! **Screen Color Key**; `lookup("Keylight (1.2)")` finds it through [`KEYLIGHT_ALIASES`]).
 //!
 //! The method is the textbook *screen difference* key, written from the public description of
 //! the controls:
@@ -31,7 +31,7 @@ use crate::util::{Plane, gauss_plane, morph_frac, point_in_poly, premul, unpremu
 use crate::{Buf, EffectCtx, EffectSpec, col, num, p, popup, slider};
 
 /// Other names the effect answers to in [`crate::lookup`].
-pub const KEYLIGHT_ALIASES: &[&str] = &["Keylight (1.2)", "Keylight"];
+pub const KEYLIGHT_ALIASES: &[&str] = &["Keylight (1.2)", "Keylight", "Key Light"];
 
 pub const VIEWS: [&str; 11] = [
     "Source",
@@ -463,7 +463,7 @@ pub fn specs() -> Vec<EffectSpec> {
     let cc = |id: &'static str, name: &'static str| p(id, name, num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1));
     vec![EffectSpec {
         id: "ec.keying.keylight",
-        name: "Key Light",
+        name: "Screen Color Key",
         category: "Keying",
         params: vec![
             p("view", "View", Value::Enum(10), popup(&VIEWS)),
@@ -622,7 +622,7 @@ mod tests {
         let spec = crate::find("ec.keying.keylight").unwrap();
         let mut next = 1;
         let mut ids = Ids(&mut next);
-        let mut g = crate::instantiate(spec, &mut ids, "Key Light", [10.0, 10.0]);
+        let mut g = crate::instantiate(spec, &mut ids, "Screen Color Key", [10.0, 10.0]);
         // Flatten it the way older versions saved it.
         let mut flat = vec![];
         g.walk_mut(&mut |p| flat.push(p.clone()));
diff --git a/crates/effects/src/lib.rs b/crates/effects/src/lib.rs
index 40ed79a7d..771d51068 100644
--- a/crates/effects/src/lib.rs
+++ b/crates/effects/src/lib.rs
@@ -8,6 +8,7 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+mod analysis_cache;
 pub mod audio_fx;
 mod blur2;
 mod blur3;
@@ -21,6 +22,9 @@ mod color2;
 mod color3;
 mod color_fx;
 pub mod controls;
+pub mod crypto_select;
+#[cfg(test)]
+mod display_names;
 mod distort;
 mod distort2;
 mod distort3;
@@ -34,6 +38,7 @@ mod keying;
 mod keying2;
 pub mod keylight;
 mod matte;
+
 pub mod migrate;
 mod misc;
 pub mod mocha_shape;
@@ -70,14 +75,14 @@ use std::collections::HashMap;
 use std::sync::OnceLock;
 
 pub use card3d::{CompLight, CompScene};
-pub use color_fx::{COLORAMA_PRESETS, ColoramaPalette};
 pub use color_fx::{
-    HUESAT_CHANNELS, HUESAT_RANGES, LEVELS_CHANNELS, PHOTO_FILTER_CUSTOM, PHOTO_FILTERS, exposure_settings, fill_uses_masks, huesat_ranges_identity,
-    levels_channel_ids, levels_channel_settings, levels_channels_identity, levels_clip,
+    BW_TINT_LUMA, EXPOSURE_LINEAR_GAMMA, HUESAT_CHANNELS, HUESAT_RANGES, LEVELS_CHANNELS, LUMA_601, PHOTO_FILTER_CUSTOM, PHOTO_FILTERS, exposure_settings,
+    fill_uses_masks, huesat_ranges_identity, levels_channel_ids, levels_channel_settings, levels_channels_identity, levels_clip,
 };
+pub use color_fx::{COLORAMA_PRESETS, ColoramaPalette};
 pub use color2::{Curve, auto_correct_settings, color_link_mode, color_link_sample, equalize_tables, luma_clip_points, shadow_highlight_amounts};
 pub use color3::OffsetCurve;
-pub use distort::transform_shutter;
+pub use distort::{transform_grow, transform_matrix_px, transform_shutter};
 pub use distort2::{MAGNIFY_MODES, bezier_grid, parse_mesh};
 pub use distort3::{RESHAPE_POINTS, ReshapeSetup, SmearSetup, cc_smear_pad, reshape_setup, smear_setup, warp_inverse_map};
 pub use distort4::liquify_mesh;
@@ -85,13 +90,16 @@ use effectcraft_keyframe::Value;
 use effectcraft_project::build::Ids;
 use effectcraft_project::{GroupKind, ParamUi, PropGroup, Property};
 pub use effectcraft_raster::{AuxChannels, Image};
-pub use misc::{INVERT_ALPHA, INVERT_CHANNELS, glow_ab_t, glow_operation};
+pub use misc::{
+    GLOW_GAIN, GLOW_KNEE, INVERT_ALPHA, INVERT_CHANNELS, glow_ab_t, glow_operation, glow_sigma, linear_wipe_axis, linear_wipe_sigma, radial_wipe_sigma,
+    radial_wipe_wedge, venetian_cover, venetian_origin,
+};
 pub use sim::particle_state;
 pub use sim3::{PgBlit, PgPlan, playground_plan, playground_state};
 pub use stylize2::strobe_on;
 // CPU helpers the GPU kernels share (effectcraft-gpu).
-pub use blur2::{camera_lens_plain, camera_lens_spans};
-pub use generate::gen_mode;
+pub use blur2::{camera_lens_plain, camera_lens_spans, radial_fast_pad};
+pub use generate::{four_color_softening, gen_mode};
 pub use generate2::pattern_kind as cell_pattern_kind;
 pub use generate2::{BoltSeg, Contour, Ghost, RadioPlan, Wave, flare_ghosts, lightning_segments, radio_plan};
 pub use generate3::{
@@ -99,20 +107,24 @@ pub use generate3::{
 };
 pub use noise::GrainLook;
 pub use textfx::{BoltPlan, TextLook, TextPass, bolt_plan, text_passes};
-pub use transition::place_layer;
+pub use transition::{GridWipe, place_layer};
 // effectcraft-gpu fx_noise.
 pub use keying2::{InnerOuterPlan, inner_outer_plan};
 pub use noise::remove_grain_level;
-pub use noise3::{FractalGpu, fractal_gpu};
-pub use stylize3::{BumpLight, bump_layer_id};
+pub use noise3::{FractalGpu, NOISE_CELL, fractal_gpu};
+pub use stylize3::{BumpLight, HexTile, bump_layer_id};
 pub use textfx::{TextLayer, text_layer};
 pub use time_fx::{PixelMotion, TimewarpPlan, TwStep, pmb_plan, posterized_time, time_frames, timewarp_crop, timewarp_plan};
 // effectcraft-gpu fx_tone.
 pub use ocio::color_stabilizer_maps;
 // GPU effects, part B (3D Channel, Immersive Video, colour management, simulation render passes).
-pub use channel3d::{CRYPTO_LAYERS, crypto_aux_image, id_color, selection_hashes};
+pub use channel3d::{
+    CRYPTO_LAYERS, CryptoAux, EXTRACTOR_COPY, MATTE_ONLY_IN_ALPHA, aux_point, crypto_aux_image, crypto_aux_image_with, crypto_layer_choices, crypto_layer_menu,
+    crypto_layer_name, crypto_layer_named, extractor_aux_channel, extractor_own_channel, id_color, is_extractor_copy, matte_only_px, reads_aux,
+    selection_hashes,
+};
 pub use ocio::{ColorOp, Straight, Tf, color_program};
-pub use sim::{Acc, Blob, Bubble, Post, Shape, Sprite, SpritePlan, Tint, bubble_list, drizzle_drops, mercury_blobs, sprite_plan};
+pub use sim::{Acc, Blob, Bubble, Post, Shape, Sprite, SpritePlan, Tint, bubble_list, bubble_sample_bounds, drizzle_drops, mercury_blobs, sprite_plan};
 pub use sim2::{
     CausticsSetup, FoamDisc, FoamEnv, FoamPlan, Piece, PiecePlan, PieceTex, PixelPlan, WavePlan, Waves, caustics_setup, foam_full_plan, piece_plan, pixel_plan,
     wave_world_plan,
@@ -286,15 +298,181 @@ impl Buf {
         self.offset[0] += origin[0] * self.scale;
         self.offset[1] += origin[1] * self.scale;
     }
-    /// Grow by `pad` transparent pixels on every side.
-    pub fn pad(&mut self, pad: u32) {
-        if pad == 0 {
+    /// Grow by transparent pixels: `sides` = left, top, right, bottom. Content keeps its place.
+    pub fn pad_sides(&mut self, sides: [u32; 4]) {
+        let [l, t, r, b] = sides;
+        if l == 0 && t == 0 && r == 0 && b == 0 {
             return;
         }
-        self.img = self.img.padded(pad);
-        self.offset[0] += pad as f64;
-        self.offset[1] += pad as f64;
+        let (Some(w), Some(h)) = (self.img.width.checked_add(l).and_then(|v| v.checked_add(r)), self.img.height.checked_add(t).and_then(|v| v.checked_add(b)))
+        else {
+            return;
+        };
+        let mut out = Image::new(w, h);
+        let (sw, ow) = (self.img.width as usize, w as usize);
+        for y in 0..self.img.height as usize {
+            let at = (y + t as usize) * ow + l as usize;
+            let (Some(src), Some(dst)) = (self.img.data.get(y * sw..(y + 1) * sw), out.data.get_mut(at..at + sw)) else { continue };
+            dst.copy_from_slice(src);
+        }
+        self.img = out;
+        self.offset[0] += l as f64;
+        self.offset[1] += t as f64;
     }
+    /// Grow by `left` and `top` transparent pixels on those sides only.
+    pub fn grow_left_top(&mut self, left: u32, top: u32) {
+        self.pad_sides([left, top, 0, 0]);
+    }
+    /// Give the buffer the pixel-grid phase (modulo [`GRID_ALIGN`]) that [`Buf::cover`] of
+    /// `size` would, by growing left/top only ([`align_plan`]). A downscaled layer is resampled
+    /// through a pyramid whose 2x2 blocks follow the buffer's grid, so a buffer that starts at
+    /// its content's corner instead of the cover's resamples to different pixels (#1205).
+    pub fn align(&mut self, size: [f64; 2]) {
+        if let Some((l, t)) = align_plan(self.offset, self.scale, size, self.img.width, self.img.height) {
+            self.grow_left_top(l, t);
+        }
+    }
+    /// Grow by `pad` transparent pixels on every side, within [`pad_within_budget`] and as
+    /// clamped by [`Image::effective_pad`].
+    pub fn pad(&mut self, pad: u32) {
+        let eff = self.img.effective_pad(pad_within_budget(self.img.width, self.img.height, pad));
+        if eff == 0 {
+            return;
+        }
+        self.img = self.img.padded(eff);
+        self.offset[0] += eff as f64;
+        self.offset[1] += eff as f64;
+    }
+}
+
+/// The most pixels a `w` × `h` effect buffer may grow to: 16 Mpx (256 MiB of f32 RGBA) or four
+/// times its own area, whichever is larger. Shared by every effect that grows its buffer.
+fn pixel_budget(w: f64, h: f64) -> f64 {
+    const MIN_BUDGET: f64 = 16_777_216.0;
+    MIN_BUDGET.max(4.0 * w * h)
+}
+
+/// `pad` on every side of a `w` × `h` effect buffer, cut so the padded buffer stays within
+/// [`pixel_budget`]: a small layer far from an effect's centre can't ask for gigabytes (#2261).
+/// Shared with the GPU path.
+pub fn pad_within_budget(w: u32, h: u32, pad: u32) -> u32 {
+    let (w, h) = (f64::from(w), f64::from(h));
+    let budget = pixel_budget(w, h);
+    if (w + 2.0 * f64::from(pad)) * (h + 2.0 * f64::from(pad)) <= budget {
+        return pad;
+    }
+    // (w + 2p)(h + 2p) = budget, solved for p.
+    let p = (((w - h).powi(2) + 4.0 * budget).sqrt() - (w + h)) / 4.0;
+    (p.floor().max(0.0) as u32).min(pad)
+}
+
+/// The most pixels on a side that [`grow_sides`] grows a buffer to.
+const MAX_GROWN_SIDE: f64 = 16384.0;
+
+/// The transparent pixels to add (left, top, right, bottom; for [`Buf::pad_sides`]) so a
+/// `width` × `height` buffer also spans the pixel box `lo`..`hi`, in the buffer's own coordinates.
+/// When the full growth would pass [`MAX_GROWN_SIDE`] or the [`pixel_budget`], every side is cut
+/// by the same factor instead of giving up, so the picture shrinks smoothly rather than popping.
+/// `None` when the buffer already spans the box, or the box is not finite.
+pub fn grow_sides(lo: [f64; 2], hi: [f64; 2], width: u32, height: u32) -> Option<[u32; 4]> {
+    if !lo.iter().chain(hi.iter()).all(|v| v.is_finite()) {
+        return None;
+    }
+    let (w, h) = (f64::from(width), f64::from(height));
+    let want = |v: f64| v.clamp(0.0, MAX_GROWN_SIDE);
+    let [l, t] = [want(-lo[0].floor()), want(-lo[1].floor())];
+    let [r, b] = [want(hi[0].ceil() - w), want(hi[1].ceil() - h)];
+    let (sx, sy) = (l + r, t + b);
+    if sx == 0.0 && sy == 0.0 {
+        return None;
+    }
+    let mut f = 1.0_f64;
+    if sx > 0.0 {
+        f = f.min((MAX_GROWN_SIDE - w).max(0.0) / sx);
+    }
+    if sy > 0.0 {
+        f = f.min((MAX_GROWN_SIDE - h).max(0.0) / sy);
+    }
+    let budget = pixel_budget(w, h);
+    if (w + sx * f) * (h + sy * f) > budget {
+        // (w + sx·f)(h + sy·f) = budget, solved for f.
+        let (a, bq, c) = (sx * sy, w * sy + h * sx, w * h - budget);
+        let q = if a > 0.0 { (-bq + (bq * bq - 4.0 * a * c).max(0.0).sqrt()) / (2.0 * a) } else { -c / bq };
+        f = f.min(q);
+    }
+    let f = if f.is_finite() { f.clamp(0.0, 1.0) } else { 0.0 };
+    let sides = [l, t, r, b].map(|v| (v * f).floor() as u32);
+    sides.iter().any(|&v| v != 0).then_some(sides)
+}
+
+/// The pixel box (min, max) enclosing the four points of a quad.
+pub fn quad_bounds(q: &[[f64; 2]; 4]) -> ([f64; 2], [f64; 2]) {
+    let f = |i: usize, init: f64, g: fn(f64, f64) -> f64| q.iter().fold(init, |a, p| g(a, p[i]));
+    ([f(0, f64::INFINITY, f64::min), f(1, f64::INFINITY, f64::min)], [f(0, f64::NEG_INFINITY, f64::max), f(1, f64::NEG_INFINITY, f64::max)])
+}
+
+/// Motion Tile's output frame for a buffer with layer origin `offset` (pixels) at `scale`:
+/// `(width, height, offset)`. Output Width / Height grow (or crop) the layer rectangle about its
+/// centre, on adjustment layers too, where the rectangle is the comp's and starts at the comp
+/// origin in the buffer below (After Effects; a Transform after it brings the tiles into view,
+/// #1727). An adjustment at 100 % keeps the buffer it was given; one whose frame would pass
+/// 16 384 pixels a side does too.
+pub fn motion_tile_frame(ctx: &EffectCtx, offset: [f64; 2], size: (u32, u32), scale: f64) -> (u32, u32, [f64; 2]) {
+    let (lw, lh) = (ctx.layer_size[0], ctx.layer_size[1]);
+    let (pw, ph) = (ctx.params.f("outputWidth"), ctx.params.f("outputHeight"));
+    let ow = (lw * pw / 100.0).max(1.0 / scale);
+    let oh = (lh * ph / 100.0).max(1.0 / scale);
+    let (nw, nh) = ((ow * scale).round().max(1.0), (oh * scale).round().max(1.0));
+    let grow = [(ow - lw) * 0.5 * scale, (oh - lh) * 0.5 * scale];
+    if !ctx.adjustment {
+        return (nw as u32, nh as u32, grow);
+    }
+    // The grown rectangle's top-left in the buffer below, on whole pixels so the result lines
+    // up with the comp again when the stack ends.
+    let (x0, y0) = ((offset[0] - grow[0]).round(), (offset[1] - grow[1]).round());
+    let fits = [x0, y0, nw, nh].iter().all(|v| v.is_finite()) && nw <= 16384.0 && nh <= 16384.0;
+    if (pw == 100.0 && ph == 100.0) || !fits {
+        return (size.0, size.1, offset);
+    }
+    (nw as u32, nh as u32, [offset[0] - x0, offset[1] - y0])
+}
+
+/// Where an adjustment stack's result (comp origin at `offset`, `size` pixels) lies on the canvas
+/// it came from (comp origin at `canvas_offset`): the result pixel at canvas pixel (0, 0).
+/// `None` when it already is the canvas, frame for frame.
+pub fn adjustment_crop(offset: [f64; 2], canvas_offset: [f64; 2], size: (u32, u32), canvas: (u32, u32)) -> Option<(i64, i64)> {
+    let (dx, dy) = ((offset[0] - canvas_offset[0]).round(), (offset[1] - canvas_offset[1]).round());
+    if !dx.is_finite() || !dy.is_finite() || (dx == 0.0 && dy == 0.0 && size == canvas) {
+        return None;
+    }
+    Some((dx as i64, dy as i64))
+}
+
+/// Effects that grow their own buffer by what they need (blur and glow margins, Repeat Edge
+/// Pixels through [`Buf::cover`], displacement through [`cover_pad`]): a stack of only these
+/// skips the renderer's cover of the whole layer rectangle (#1205).
+pub const SKIPS_COVER: &[&str] = &["ec.blur.gaussian", "ec.blur.fastbox", "ec.stylize.glow", "ec.distort.turbulentdisplace"];
+
+/// The grid phase [`Buf::align`] keeps and the step [`cover_pad`] grows in: covers the levels
+/// of the resampling pyramid used for downscaled layers.
+pub const GRID_ALIGN: u32 = 64;
+
+/// Left/top growth giving a buffer [`cover_plan`]'s grid phase modulo [`GRID_ALIGN`]; `None`
+/// when there is nothing to add.
+pub fn align_plan(offset: [f64; 2], scale: f64, size: [f64; 2], width: u32, height: u32) -> Option<(u32, u32)> {
+    let (dx, dy, _, _) = cover_plan(offset, scale, size, width, height)?;
+    let (l, t) = (dx % GRID_ALIGN, dy % GRID_ALIGN);
+    (l != 0 || t != 0).then_some((l, t))
+}
+
+/// Padding for an effect that moves pixels up to `want` past the content (not an adjustment
+/// layer): `want`, capped at what reaches the layer rectangle, in whole [`GRID_ALIGN`] steps so
+/// the grid phase stays. 0 once the buffer covers the layer.
+pub fn cover_pad(ctx: &EffectCtx, size: [u32; 2], offset: [f64; 2], scale: f64, want: u32) -> u32 {
+    if ctx.adjustment {
+        return 0;
+    }
+    want.min(util::layer_cover_pad(ctx, size, offset, scale)).div_ceil(GRID_ALIGN) * GRID_ALIGN
 }
 
 /// Where [`Buf::cover`] would take a buffer: shift its pixels by `(dx, dy)` and resize it to
@@ -383,6 +561,18 @@ pub trait EffectHost: Sync {
     fn params_at(&self, _layer_time: f64) -> Option<Params> {
         None
     }
+    /// Parameter `id` (a [`flatten_params`] id such as `birthRate`) of effect `effect_index` in
+    /// the layer's stack (the running effect's [`EffectEnv::effect_index`]) at another **layer
+    /// time**: Particle Emitter 3D samples its Birth Rate at every step it simulates (#1373).
+    /// `None` when unavailable.
+    fn param_at(&self, _effect_index: usize, _id: &str, _layer_time: f64) -> Option<Value> {
+        None
+    }
+    /// Parameter `id` of effect `effect_index` has one value at every time (no keyframes, no
+    /// expression), so sampling it over time can be skipped. `false` when unknown.
+    fn param_is_static(&self, _effect_index: usize, _id: &str) -> bool {
+        false
+    }
     /// A particle simulation backend (GPU particles; see [`psim`]). `None` = simulate on the
     /// CPU.
     fn particles(&self) -> Option<&dyn psim::ParticleSim> {
@@ -406,10 +596,18 @@ pub struct EffectEnv<'a> {
     pub working_space: Option<effectcraft_color::ColorSpace>,
     /// Working-space pixels are linear light (Linearize Working Space).
     pub working_linear: bool,
+    /// The project works in 32 bpc float (Levels' "Off for 32 bpc Color" clips only below it).
+    pub float_depth: bool,
     /// The composition's shutter (angle and phase in degrees, samples per frame) when both the
     /// comp's and the layer's motion blur switches are on (Transform's Use Composition's
     /// Shutter Angle).
     pub shutter: Option<(f64, f64, u32)>,
+    /// The layer's source time range in **layer time** seconds as (first, end): the layer time of
+    /// the first source frame and the time just past the last one (so the source lasts
+    /// `end - first` seconds and its last frame starts one frame before `end`). `None` when the
+    /// source has no duration (stills, solids, text, shapes) or the renderer does not know it.
+    /// Retimers clamp their source requests to it.
+    pub layer_span: Option<(f64, f64)>,
 }
 
 /// What an effect gets to render with.
@@ -461,6 +659,15 @@ pub struct EffectSpec {
     pub float: bool,
 }
 
+impl EffectSpec {
+    /// True when this effect grows its own buffer (blur/glow margins, Repeat Edge
+    /// [`Buf::cover`], displacement [`cover_pad`]) so a stack of only these can skip the
+    /// renderer's full-layer cover and keep the pyramid grid phase (#1205).
+    pub fn skips_cover(&self) -> bool {
+        SKIPS_COVER.contains(&self.id)
+    }
+}
+
 pub(crate) fn p(id: &'static str, name: &'static str, default: Value, ui: ParamUi) -> ParamSpec {
     ParamSpec { id, name, default, ui }
 }
@@ -572,8 +779,82 @@ pub fn categories() -> Vec<&'static str> {
     v
 }
 
-/// After Effects' third-party display names of effects we register under a generic name.
-const ALIASES: &[(&str, &[&str])] = &[("ec.keying.keylight", keylight::KEYLIGHT_ALIASES)];
+/// Legacy display names accepted for saved scripts and searches. Never display these as
+/// native feature names; stable effect IDs and external format match names stay unchanged.
+const ALIASES: &[(&str, &[&str])] = &[
+    ("ec.sim.ccballaction", &["CC Ball Action"]),
+    ("ec.distort.ccbendit", &["CC Bend It"]),
+    ("ec.distort.ccbender", &["CC Bender"]),
+    ("ec.distort.ccblobbylize", &["CC Blobbylize"]),
+    ("ec.stylize.ccblockload", &["CC Block Load"]),
+    ("ec.sim.ccbubbles", &["CC Bubbles"]),
+    ("ec.stylize.ccburnfilm", &["CC Burn Film"]),
+    ("ec.color.cccolorneutralizer", &["CC Color Neutralizer"]),
+    ("ec.color.cccoloroffset", &["CC Color Offset"]),
+    ("ec.channel.cccomposite", &["CC Composite"]),
+    ("ec.blur.cccross", &["CC Cross Blur"]),
+    ("ec.perspective.cccylinder", &["CC Cylinder"]),
+    ("ec.sim.ccdrizzle", &["CC Drizzle"]),
+    ("ec.perspective.ccenvironment", &["CC Environment"]),
+    ("ec.distort.ccflomotion", &["CC Flo Motion"]),
+    ("ec.time.ccforcemotionblur", &["CC Force Motion Blur"]),
+    ("ec.stylize.ccglass", &["CC Glass"]),
+    ("ec.transition.ccglasswipe", &["CC Glass Wipe"]),
+    ("ec.generate.ccgluegun", &["CC Glue Gun"]),
+    ("ec.transition.ccgridwipe", &["CC Grid Wipe"]),
+    ("ec.distort.ccgriddler", &["CC Griddler"]),
+    ("ec.sim.cchair", &["CC Hair"]),
+    ("ec.stylize.cchextile", &["CC HexTile"]),
+    ("ec.transition.ccimagewipe", &["CC Image Wipe"]),
+    ("ec.transition.ccjaws", &["CC Jaws"]),
+    ("ec.stylize.cckaleida", &["CC Kaleida"]),
+    ("ec.color.cckernel", &["CC Kernel"]),
+    ("ec.distort.cclens", &["CC Lens"]),
+    ("ec.generate.cclightburst", &["CC Light Burst 2.5"]),
+    ("ec.generate.cclightrays", &["CC Light Rays"]),
+    ("ec.generate.cclightsweep", &["CC Light Sweep"]),
+    ("ec.transition.cclightwipe", &["CC Light Wipe"]),
+    ("ec.transition.cclinesweep", &["CC Line Sweep"]),
+    ("ec.sim.ccmrmercury", &["CC Mr. Mercury"]),
+    ("ec.stylize.ccmrsmoothie", &["CC Mr. Smoothie"]),
+    ("ec.utility.ccoverbrights", &["CC Overbrights"]),
+    ("ec.distort.ccpageturn", &["CC Page Turn"]),
+    ("ec.sim.ccparticlesystems2", &["CC Particle Systems II"]),
+    ("ec.sim.ccparticleworld", &["CC Particle World"]),
+    ("ec.sim.ccpixelpolly", &["CC Pixel Polly"]),
+    ("ec.stylize.ccplastic", &["CC Plastic"]),
+    ("ec.distort.ccpowerpin", &["CC Power Pin"]),
+    ("ec.blur.ccradial", &["CC Radial Blur"]),
+    ("ec.blur.ccradialfast", &["CC Radial Fast Blur"]),
+    ("ec.transition.ccradialscalewipe", &["CC Radial ScaleWipe"]),
+    ("ec.sim.ccrainfall", &["CC Rainfall"]),
+    ("ec.stylize.ccrepetile", &["CC RepeTile"]),
+    ("ec.distort.ccripplepulse", &["CC Ripple Pulse"]),
+    ("ec.transition.ccscalewipe", &["CC Scale Wipe"]),
+    ("ec.sim.ccscatterize", &["CC Scatterize"]),
+    ("ec.key.ccsimplewireremoval", &["CC Simple Wire Removal"]),
+    ("ec.distort.ccslant", &["CC Slant"]),
+    ("ec.distort.ccsmear", &["CC Smear"]),
+    ("ec.sim.ccsnowfall", &["CC Snowfall"]),
+    ("ec.perspective.ccsphere", &["CC Sphere"]),
+    ("ec.distort.ccsplit", &["CC Split"]),
+    ("ec.distort.ccsplit2", &["CC Split 2"]),
+    ("ec.perspective.ccspotlight", &["CC Spotlight"]),
+    ("ec.sim.ccstarburst", &["CC Star Burst"]),
+    ("ec.generate.ccthreads", &["CC Threads"]),
+    ("ec.stylize.ccthreshold", &["CC Threshold"]),
+    ("ec.stylize.ccthresholdrgb", &["CC Threshold RGB"]),
+    ("ec.distort.cctiler", &["CC Tiler"]),
+    ("ec.color.cctoner", &["CC Toner"]),
+    ("ec.transition.cctwister", &["CC Twister"]),
+    ("ec.blur.ccvector", &["CC Vector Blur"]),
+    ("ec.stylize.ccvignette", &["CC Vignette"]),
+    ("ec.transition.ccwarpomatic", &["CC WarpoMatic"]),
+    ("ec.time.ccwidetime", &["CC Wide Time"]),
+    ("ec.color.lumetri", &["Lumetri Color"]),
+    ("ec.obsolete.mochashape", &["Mocha shape", "mocha shape"]),
+    ("ec.keying.keylight", keylight::KEYLIGHT_ALIASES),
+];
 
 /// Other names effect `id` answers to (in [`lookup`] and searches).
 pub fn aliases(id: &str) -> &'static [&'static str] {
@@ -657,7 +938,7 @@ pub fn instantiate(spec: &EffectSpec, ids: &mut Ids, instance_name: &str, layer_
 /// effects without their own table.
 pub const PARAM_GROUPS: &[(&str, &str)] = &[
     // Color Correction: Exposure, Levels (Individual Controls), Change to Color, Colorama,
-    // Shadow/Highlight, Lumetri Color.
+    // Shadow/Highlight, Color Grading.
     ("master", "Master"),
     ("rgb", "RGB"),
     ("red", "Red"),
@@ -786,7 +1067,7 @@ pub const PARAM_GROUPS: &[(&str, &str)] = &[
     ("particleExploder", "Particle Exploder"),
     ("affects", "Affects"),
     ("options", "Options"),
-    // Keying, Matte, Obsolete (Key Light's groups are in `keylight::GROUPS`).
+    // Keying, Matte, Obsolete (Screen Color Key's groups are in `keylight::GROUPS`).
     ("ultraSettings", "Ultra Settings"),
     ("additionalForeground", "Additional Foreground"),
     ("additionalBackground", "Additional Background"),
@@ -871,7 +1152,7 @@ fn nested_group<'a>(g: &'a mut PropGroup, ids: &mut Ids, path: &str) -> Option<&
 }
 
 /// Effects the GPU compositor (`effectcraft-gpu`) implements with the CPU effect's semantics
-/// (Mercury GPU Acceleration; the Effects & Presets GPU badge). Expression controls are
+/// (GPU Acceleration; the Effects & Presets GPU badge). Expression controls are
 /// pass-throughs and count as GPU effects too.
 pub const GPU_EFFECTS: &[&str] = &[
     "ec.blur.gaussian",
@@ -1233,7 +1514,14 @@ pub const TIME_DEPENDENT: &[&str] = &[
 pub fn is_time_dependent(id: &str) -> bool {
     // Simulations replay from layer time 0, so every frame differs even when the defaults
     // happen to look static at the test's two sample times.
-    id.starts_with("ec.sim.") || TIME_DEPENDENT.contains(&id)
+    id.starts_with("ec.sim.") || TIME_DEPENDENT.contains(&id) || (!id.starts_with("ec.") && plugin::reads_other_times(id))
+}
+
+/// Does effect `id` read its own parameters at earlier times (the stepped particle systems sample
+/// their Birth Rate at every step, #1373)? Caches keyed on the current values can't see what an
+/// expression returned then.
+pub fn reads_param_history(id: &str) -> bool {
+    matches!(id, "ec.sim.ccparticleworld" | "ec.sim.ccparticlesystems2" | "ec.sim.ccmrmercury")
 }
 
 /// Run an effect on a buffer.
@@ -1260,6 +1548,47 @@ pub(crate) fn run_fx(id: &str, vals: &[(&str, Value)], img: Image, time: f64, en
 mod tests {
     use super::*;
 
+    /// #1938: Corner Pin's growth spans the pinned quad, and past the side cap or the pixel
+    /// budget it is cut by one factor instead of being dropped.
+    #[test]
+    fn grow_sides_spans_the_box_and_clamps_instead_of_giving_up() {
+        let area = |w: u32, h: u32, s: [u32; 4]| (u64::from(w) + u64::from(s[0]) + u64::from(s[2])) * (u64::from(h) + u64::from(s[1]) + u64::from(s[3]));
+        assert_eq!(grow_sides([-3.5, 2.0], [30.0, 40.2], 20, 10), Some([4, 0, 10, 31]));
+        assert_eq!(grow_sides([1.0, 1.0], [19.0, 9.0], 20, 10), None, "already inside");
+        assert_eq!(grow_sides([f64::NAN, 0.0], [30.0, 40.0], 20, 10), None);
+        assert_eq!(grow_sides([0.0, 0.0], [f64::INFINITY, 40.0], 20, 10), None);
+        // A pin near (16000, 16000) on a small layer: cut to the budget, still growing, in the same ratio.
+        let s = grow_sides([0.0, 0.0], [16000.0, 16000.0], 20, 10).unwrap();
+        assert!(s[2] > 1000 && s[3] > 1000 && area(20, 10, s) <= 1 << 24, "{s:?}");
+        // An absurdly far pin is still bounded and still grows.
+        let s = grow_sides([-1e12, -1e12], [1e12, 1e12], 1920, 1080).unwrap();
+        assert!(s.iter().all(|&v| v > 0) && area(1920, 1080, s) <= 1 << 24, "{s:?}");
+        assert!(1920 + u64::from(s[0]) + u64::from(s[2]) <= 16384);
+        // A layer already past the side cap does not grow.
+        assert_eq!(grow_sides([0.0, 0.0], [20000.0, 100.0], 17000, 50), None);
+        // A degenerate quad (all four points equal) grows to its point only.
+        let q = [[50.0, 30.0]; 4];
+        let (lo, hi) = quad_bounds(&q);
+        assert_eq!(grow_sides(lo, hi, 20, 10), Some([0, 0, 30, 20]));
+    }
+
+    /// #2261: a 20 × 20 layer with Fast Radial Blur's Center far away grows to at most 16 Mpx;
+    /// big layers may still grow to four times their area, and small pads are untouched.
+    #[test]
+    fn padded_buffers_stay_within_the_budget() {
+        let area = |w: u32, h: u32, p: u32| (u64::from(w) + 2 * u64::from(p)) * (u64::from(h) + 2 * u64::from(p));
+        let far = radial_fast_pad((6500.0, 6500.0), 20, 20, 0.8);
+        assert_eq!(far, 4096, "the effect asks for its full pad");
+        let mut b = Buf { img: Image::new(20, 20), offset: [0.0; 2], scale: 1.0 };
+        b.pad(far);
+        assert!(area(20, 20, 0) < area(b.img.width, b.img.height, 0) && area(b.img.width, b.img.height, 0) <= 1 << 24, "{}x{}", b.img.width, b.img.height);
+        assert_eq!(b.offset, [f64::from((b.img.width - 20) / 2); 2], "the content keeps its place");
+        let p = pad_within_budget(3840, 2160, 4096);
+        assert!(p > 1000 && area(3840, 2160, p) <= 4 * 3840 * 2160 && area(3840, 2160, p + 1) > 4 * 3840 * 2160);
+        assert_eq!(pad_within_budget(640, 360, 200), 200);
+        assert_eq!(pad_within_budget(20, 20, 0), 0);
+    }
+
     #[test]
     fn run_fx_passthrough() {
         let img = Image::filled(4, 3, [0.5, 0.25, 0.125, 1.0]);
@@ -1267,6 +1596,20 @@ mod tests {
         assert_eq!(out.img.data, img.data);
     }
 
+    #[test]
+    fn pad_offset_follows_the_clamped_pad() {
+        // Image::padded clamps a hostile pad to keep each side within MAX_PADDED_SIDE; the offset
+        // must move by the pad actually applied, or the content drifts from its layer position.
+        let mut img = Image::new(29_990, 2);
+        img.set(0, 0, [1.0, 0.0, 0.0, 1.0]);
+        let mut buf = Buf { img, offset: [3.0, 4.0], scale: 1.0 };
+        buf.pad(u32::MAX);
+        // Width binds: (MAX_PADDED_SIDE - 29 990) / 2 = 5.
+        assert_eq!(buf.offset, [8.0, 9.0]);
+        let (x, y) = buf.to_px([-3.0, -4.0]);
+        assert_eq!(buf.img.get(x as i64, y as i64), [1.0, 0.0, 0.0, 1.0]);
+    }
+
     #[test]
     #[ignore]
     fn dump_registry() {
@@ -1451,4 +1794,24 @@ mod tests {
         assert_eq!(g.get("noiseSourceLayerSource").map(|p| p.value.clone()), Some(Value::Enum(0)));
         assert_eq!(g.props().filter(|p| p.match_id == "noiseSourceLayerSource").count(), 1);
     }
+
+    #[test]
+    fn align_plan_is_cover_shift_mod_grid() {
+        // Content inset from the layer origin: pixel 0 maps to layer (50, 30).
+        let offset = [-50.0, -30.0];
+        let scale = 1.0;
+        let size = [1920.0, 1080.0];
+        let (dx, dy, _, _) = cover_plan(offset, scale, size, 80, 40).unwrap();
+        assert_eq!((dx, dy), (50, 30));
+        assert_eq!(align_plan(offset, scale, size, 80, 40), Some((50, 30)));
+        assert_eq!(align_plan([-64.0, -128.0], 1.0, size, 80, 40), None);
+    }
+
+    #[test]
+    fn known_margin_effects_skip_cover_and_twirl_does_not() {
+        for id in SKIPS_COVER {
+            assert!(find(id).expect(id).skips_cover(), "{id}");
+        }
+        assert!(!find("ec.distort.twirl").unwrap().skips_cover());
+    }
 }
diff --git a/crates/effects/src/matte.rs b/crates/effects/src/matte.rs
index 4c42c9c39..d695a3b41 100644
--- a/crates/effects/src/matte.rs
+++ b/crates/effects/src/matte.rs
@@ -362,6 +362,22 @@ mod tests {
         assert!(a > 0.99 && c[0] > 0.5, "{c:?}");
     }
 
+    /// #2102: negative Choke Matte keeps growing the matte past -20, down to -100: a 120 px hole
+    /// in an opaque frame closes a bit more with every step.
+    #[test]
+    fn simple_choker_grows_the_matte_at_large_negative_values() {
+        let mut img = Image::filled(200, 200, [1.0, 1.0, 1.0, 1.0]);
+        for y in 40..160 {
+            for x in 40..160 {
+                img.set(x, y, [0.0; 4]);
+            }
+        }
+        let filled = |c: f64| alpha_sum(&run("ec.matte.simplechoker", &[("chokeMatte", num(c))], img.clone()));
+        let sums: Vec<f32> = [-10.0, -20.0, -40.0, -60.0].into_iter().map(filled).collect();
+        assert!(sums.windows(2).all(|w| w[1] > w[0] + 100.0), "{sums:?}");
+        assert!((filled(-100.0) - 200.0 * 200.0).abs() < 1.0, "-100 closes the hole");
+    }
+
     #[test]
     fn matte_choker_defaults_shrink() {
         let img = square();
diff --git a/crates/effects/src/migrate.rs b/crates/effects/src/migrate.rs
index 0e037022e..59daca49d 100644
--- a/crates/effects/src/migrate.rs
+++ b/crates/effects/src/migrate.rs
@@ -161,6 +161,10 @@ pub fn legacy_default(effect: &str, param: &str) -> Option<Value> {
         ("ec.key.advancedspill", "ultraSettings/tolerance") => Value::Scalar(100.0),
         // Transition: Block Dissolve's blocks had hard edges.
         ("ec.transition.blockdissolve", "softEdges") => Value::Bool(false),
+        // Linear Wipe's feather was a linear ramp with the travel extended by it (#3125).
+        ("ec.transition.linearwipe", "legacyFeather") => Value::Bool(true),
+        // 3D Channel: Cryptomatte's Matte Only put the matte in alpha too (#3127).
+        ("ec.3d.cryptomatte", crate::channel3d::MATTE_ONLY_IN_ALPHA) => Value::Bool(true),
         _ => return None,
     })
 }
@@ -344,6 +348,23 @@ pub fn upgrade_instance(spec: &EffectSpec, g: &mut PropGroup, ids: &mut Ids, lay
     *g != before
 }
 
+/// The spec id of the parameter that an instance of `spec` saved at `id` (`a/b/param`) is now:
+/// `id` itself when the spec still has it, the new id of a renamed parameter
+/// ([`PARAM_ID_ALIASES`]), or the twirl-down path of a top-level parameter that moved into a
+/// group, as [`upgrade_instance`] finds them. Returns `None` when no parameter matches.
+pub fn current_param_id(spec: &EffectSpec, id: &str) -> Option<&'static str> {
+    if let Some(ps) = spec.params.iter().find(|ps| ps.id == id) {
+        return Some(ps.id);
+    }
+    if let Some((_, _, new)) = PARAM_ID_ALIASES.iter().find(|(e, old, _)| *e == spec.id && *old == id) {
+        return Some(new);
+    }
+    if id.contains('/') {
+        return None;
+    }
+    spec.params.iter().find(|ps| ps.id.rsplit('/').next() == Some(id)).map(|ps| ps.id)
+}
+
 /// Bring an effect instance saved before project schema 2 into effect space (#227).
 ///
 /// Layers without a source rectangle (shape, text) have comp-sized effect bounds centred on
@@ -499,6 +520,37 @@ mod tests {
         assert_eq!(pr.ui, popup.ui);
     }
 
+    /// #3127: Cryptomatte's Matte Only moved the matte from RGBA to RGB over alpha 1; a project
+    /// saved before has no Matte Only In Alpha switch and gets it on, keeping its render. A fresh
+    /// instance has it off.
+    #[test]
+    fn cryptomatte_saved_before_matte_only_in_rgb_keeps_the_matte_in_alpha() {
+        let id = crate::channel3d::MATTE_ONLY_IN_ALPHA;
+        let mut next = 1;
+        let (spec, mut g) = instance("ec.3d.cryptomatte", &mut next);
+        assert_eq!(g.get(id).map(|p| p.value.clone()), Some(Value::Bool(false)));
+        g.children.retain(|c| c.match_id() != id);
+        assert!(upgrade_instance(spec, &mut g, &mut Ids(&mut next), SIZE));
+        let pr = g.get(id).expect("added on upgrade");
+        assert_eq!((&pr.value, &pr.ui), (&Value::Bool(true), &ParamUi::Hidden));
+    }
+
+    /// #1797: Shift Channels' menu put Half On before Full Off; a project saved then keeps the
+    /// option it chose, by label.
+    #[test]
+    fn shift_channels_half_on_and_full_off_are_remapped_by_label() {
+        const OLD: [&str; 11] = ["Alpha", "Red", "Green", "Blue", "Luminance", "Hue", "Lightness", "Saturation", "Full On", "Half On", "Full Off"];
+        for (saved, want) in [(9u32, 10u32), (10, 9), (1, 1)] {
+            let mut next = 1;
+            let (spec, mut g) = instance("ec.channel.shiftchannels", &mut next);
+            let pr = g.get_mut("takeGreenFrom").unwrap();
+            pr.ui = ParamUi::Popup { options: OLD.iter().map(|s| s.to_string()).collect() };
+            pr.value = Value::Enum(saved);
+            upgrade_instance(spec, &mut g, &mut Ids(&mut next), SIZE);
+            assert_eq!(g.get("takeGreenFrom").unwrap().value, Value::Enum(want), "saved {saved}");
+        }
+    }
+
     /// #514: Apply Color LUT's LUT was hidden (set only by commands) and the OCIO files were
     /// plain text; old projects get the Choose… file parameter, keeping the path.
     #[test]
@@ -543,6 +595,33 @@ mod tests {
         assert_eq!(prop_at(&mut g, "stabilization/smoothness").unwrap().value, Value::Scalar(12.0));
     }
 
+    /// A saved parameter id maps to the parameter `upgrade_instance` moves it to.
+    #[test]
+    fn current_param_id_follows_renames_and_twirl_down_moves() {
+        let stab = find(crate::warp_stab::ID).unwrap();
+        assert_eq!(current_param_id(stab, "stabilization/smoothness"), Some("stabilization/smoothness"));
+        assert_eq!(current_param_id(stab, "smoothness"), Some("stabilization/smoothness"));
+        let ctc = find("ec.color.changetocolor").unwrap();
+        assert_eq!(current_param_id(ctc, "tolerance"), Some("toleranceGroup/hue"));
+        // Radio Waves' old Velocity is the growth speed, not the new Velocity.
+        let waves = find("ec.generate.radiowaves").unwrap();
+        assert_eq!(current_param_id(waves, "velocity"), Some("waveMotion/expansion"));
+        assert_eq!(current_param_id(stab, "noSuchParam"), None);
+        assert_eq!(current_param_id(stab, "other/smoothness"), None);
+    }
+
+    /// #3125: a Linear Wipe saved before its feather followed After Effects keeps the old ramp;
+    /// a new one doesn't.
+    #[test]
+    fn old_linear_wipes_keep_the_legacy_feather() {
+        let mut next = 1;
+        let (spec, mut g) = instance("ec.transition.linearwipe", &mut next);
+        assert_eq!(g.get("legacyFeather").unwrap().value, Value::Bool(false));
+        take_prop(&mut g, "legacyFeather");
+        assert!(upgrade_instance(spec, &mut g, &mut Ids(&mut next), SIZE));
+        assert_eq!(g.get("legacyFeather").unwrap().value, Value::Bool(true));
+    }
+
     #[test]
     fn card_wipe_back_layer_popup_becomes_a_layer_parameter() {
         let spec = find("ec.transition.cardwipe").unwrap();
@@ -717,7 +796,13 @@ not a stroke",
         let data = effectcraft_track::roto::RotoData {
             base: Some(0),
             span: [0, 10],
-            strokes: vec![effectcraft_track::roto::Stroke { kind: effectcraft_track::roto::StrokeKind::Fg, frame: 0, radius: 5.0, points: vec![[2.0, 2.0]] }],
+            strokes: vec![effectcraft_track::roto::Stroke {
+                kind: effectcraft_track::roto::StrokeKind::Fg,
+                frame: 0,
+                radius: 5.0,
+                points: vec![[2.0, 2.0]],
+                object: 0,
+            }],
         };
         roto.get_mut(crate::roto::STROKES).unwrap().value = Value::Str(data.to_json());
         to_effect_space(spec, &mut roto, SIZE, D, &own);
diff --git a/crates/effects/src/misc.rs b/crates/effects/src/misc.rs
index c119118db..65951ad97 100644
--- a/crates/effects/src/misc.rs
+++ b/crates/effects/src/misc.rs
@@ -34,23 +34,51 @@ fn gaussian(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let repeat = ctx.params.b("repeatEdge");
     if !repeat && !ctx.adjustment {
         b.pad((s * 3.0).ceil() as u32);
+    } else if repeat && !ctx.adjustment {
+        // The edge it repeats is the layer's, not the painted content's (#1205).
+        b.cover(ctx.layer_size);
     }
-    b.img = gaussian_blur(&b.img, s * kx, s * ky, repeat || ctx.adjustment);
+    let (sx, sy) = (s * kx, s * ky);
+    // Small sigmas: integer-radius box passes would step (and do nothing below ~0.6 px), so sample the kernel (#1939).
+    b.img = if effectcraft_raster::gaussian_is_exact(sx, sy) {
+        effectcraft_raster::gaussian_blur_exact(&b.img, sx, sy, repeat || ctx.adjustment)
+    } else {
+        gaussian_blur(&b.img, sx, sy, repeat || ctx.adjustment)
+    };
     b
 }
 
 fn box_blur(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let r = (ctx.params.f("radius") * b.scale).round().max(0.0) as usize;
-    if r == 0 {
+    let radius = (ctx.params.f("radius") * b.scale).max(0.0);
+    let r = radius.floor() as usize;
+    let frac = (radius - r as f64) as f32;
+    // Fractional radius: blend the two neighbouring integer radii so the result changes continuously (#1939).
+    let frac = if frac < 1e-4 { 0.0 } else { frac };
+    if r == 0 && frac == 0.0 {
         return b;
     }
     let it = ctx.params.f("iterations").round().clamp(1.0, 50.0) as usize;
     let (kx, ky) = dims_xy(ctx.params.e("dimensions"));
     let repeat = ctx.params.b("repeatEdge");
     if !repeat && !ctx.adjustment {
-        b.pad((r * it) as u32 + 1);
+        let reach = if frac > 0.0 { r + 1 } else { r };
+        b.pad((reach * it) as u32 + 1);
+    } else if repeat && !ctx.adjustment {
+        // The edge it repeats is the layer's, not the painted content's (#1205).
+        b.cover(ctx.layer_size);
+    }
+    let edge = repeat || ctx.adjustment;
+    let lo = effectcraft_raster::box_blur(&b.img, r * kx as usize, r * ky as usize, it, edge);
+    if frac == 0.0 {
+        b.img = lo;
+        return b;
+    }
+    let hi = effectcraft_raster::box_blur(&b.img, (r + 1) * kx as usize, (r + 1) * ky as usize, it, edge);
+    for ((l, h), o) in lo.data.iter().zip(hi.data.iter()).zip(b.img.data.iter_mut()) {
+        for c in 0..4 {
+            o[c] = l[c] + (h[c] - l[c]) * frac;
+        }
     }
-    b.img = effectcraft_raster::box_blur(&b.img, r * kx as usize, r * ky as usize, it, repeat || ctx.adjustment);
     b
 }
 
@@ -120,6 +148,28 @@ pub fn glow_ab_t(l: f32, looping: u32, loops: f32, phase: f32, mid: f32) -> f32
     t.max(0.0).powf(0.5f32.ln() / m.ln())
 }
 
+/// Glow's blur: a Gaussian of σ = 0.384 × Glow Radius. Fitted to After Effects 2026 (cases
+/// 807 and 808, Glow Radius 10 and 30 on a grey solid): the edge profile of the glow's
+/// coverage is an erfc step of that σ within 1.7/255 (it was σ = radius / 2).
+pub fn glow_sigma(radius: f64) -> f64 {
+    (radius * 0.384).max(0.5)
+}
+
+/// Glow's bright pass for the original colours, per channel of the straight colour `v`:
+/// `8 × (v − threshold + 0.0611)`, nothing below. Fitted to After Effects 2026 renders of grey
+/// 0.65 / 0.8 / 0.9 / 1, orange and light-blue solids at Threshold 40 / 60 / 80 % and Radius 10
+/// / 30 (36 channel values, exact to the 8-bit capture): the glow is linear in each channel,
+/// its gain is the same at every threshold and radius, and channels below the threshold add
+/// nothing (an orange solid glows red only).
+pub fn glow_bright_channel(v: f32, thr: f32) -> f32 {
+    (GLOW_GAIN * (v - thr + GLOW_KNEE)).max(0.0)
+}
+
+/// [`glow_bright_channel`]'s gain and threshold offset. `kernels.wgsl` repeats both as literals;
+/// the GPU test `glow_constants_match_the_cpu` checks that they are these.
+pub const GLOW_GAIN: f32 = 8.0;
+pub const GLOW_KNEE: f32 = 0.0611;
+
 /// Glow Operation options (blend modes the glow is applied with).
 pub const GLOW_OPERATIONS: [&str; 17] = [
     "Normal",
@@ -183,23 +233,31 @@ fn glow(ctx: &EffectCtx, mut b: Buf) -> Buf {
         // Glow Based On: brightness from the colours, or from the alpha channel.
         let l = if alpha_based { a } else { luminance(px[0] / a, px[1] / a, px[2] / a) };
         let k = ((l - thr) / (1.0 - thr).max(1e-3)).clamp(0.0, 1.0);
+        // Based on the colour channels, the glow's coverage is the layer's whole alpha, below
+        // the threshold too: After Effects darkens what lies under a dim layer's edge (glow_alpha).
+        let ga = if alpha_based { k * a } else { a };
         if let Some(map) = &arbitrary {
             let t = glow_ab_t(l, looping, loops, phase, mid);
             let c = map.iter().map(|cv| cv.as_ref().map_or(t, |cv| cv.eval(t))).collect::<Vec<f32>>();
-            *px = [c[0] * k * a, c[1] * k * a, c[2] * k * a, k * a];
+            *px = [c[0] * k * a, c[1] * k * a, c[2] * k * a, ga];
         } else if use_colors {
             let t = glow_ab_t(l, looping, loops, phase, mid);
             let c = [ca[0] + (cb[0] - ca[0]) * t, ca[1] + (cb[1] - ca[1]) * t, ca[2] + (cb[2] - ca[2]) * t];
-            *px = [c[0] * k * a, c[1] * k * a, c[2] * k * a, k * a];
+            *px = [c[0] * k * a, c[1] * k * a, c[2] * k * a, ga];
+        } else if alpha_based {
+            *px = [px[0] * k, px[1] * k, px[2] * k, ga];
         } else {
-            *px = px.map(|v| v * k);
+            // Original colours: each channel of the straight colour against the threshold.
+            let c = [px[0] / a, px[1] / a, px[2] / a].map(|v| glow_bright_channel(v, thr) * a);
+            *px = [c[0], c[1], c[2], ga];
         }
     });
-    let s = (radius / 2.0).max(0.5);
+    let s = glow_sigma(radius);
     let blurred = gaussian_blur(&bright, s * kx, s * ky, false);
     let mode = ctx.params.e("operation");
     b.img.data.par_iter_mut().zip(blurred.data.par_iter()).for_each(|(o, g)| {
-        let g = g.map(|v| v * intensity);
+        // Intensity scales the glow's colour; with the colour channels its coverage stays.
+        let g = [g[0] * intensity, g[1] * intensity, g[2] * intensity, if alpha_based { g[3] * intensity } else { g[3] }];
         match mode {
             // Behind: the glow shows only where the original is transparent.
             1 => {
@@ -480,16 +538,83 @@ fn noise(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-fn linear_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let done = ctx.params.f("completion") / 100.0;
-    let ang = ctx.params.f("angle").to_radians();
-    let feather = (ctx.params.f("feather") * b.scale).max(0.001);
-    let (w, h) = (b.img.width as f64, b.img.height as f64);
-    // Direction the wipe travels: angle 90° wipes left→right.
+/// Linear Wipe's geometry: the direction the wipe travels (angle 90° wipes left → right) and the
+/// range of `x·dx + y·dy` over a `w` × `h` buffer's corners.
+pub fn linear_wipe_axis(angle_deg: f64, w: f64, h: f64) -> ([f64; 2], f64, f64) {
+    let ang = angle_deg.to_radians();
     let (dx, dy) = (ang.sin(), -ang.cos());
     let corners = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h)];
-    let proj: Vec<f64> = corners.iter().map(|(x, y)| x * dx + y * dy).collect();
-    let (lo, hi) = (proj.iter().cloned().fold(f64::INFINITY, f64::min), proj.iter().cloned().fold(f64::NEG_INFINITY, f64::max));
+    let proj = corners.map(|(x, y)| x * dx + y * dy);
+    let (lo, hi) = (proj.iter().copied().fold(f64::INFINITY, f64::min), proj.iter().copied().fold(f64::NEG_INFINITY, f64::max));
+    ([dx, dy], lo, hi)
+}
+
+/// Linear Wipe's Feather (`feather` pixels at preview `scale`) as the Gaussian sigma that
+/// softens the edge of a `w` × `h` buffer. After Effects' feathered edge is the hard wipe
+/// blurred with the layer's edges repeated; our importer sample (Feather 16 at 77°, 2026-11-05)
+/// matches three box passes of radius 6 per axis, sigma 6.35..6.6, so sigma = Feather / 2.5
+/// (pinned at Feather 16 only, #3125). Capped at twice the buffer's longer side, past which
+/// a blur with repeated edges no longer changes and the running sums only cost time.
+pub fn linear_wipe_sigma(feather: f64, scale: f64, w: f64, h: f64) -> f64 {
+    let s = feather * scale / 2.5;
+    if s.is_finite() && s > 0.0 { s.min(2.0 * w.max(h).max(1.0)) } else { 0.0 }
+}
+
+fn linear_wipe(ctx: &EffectCtx, b: Buf) -> Buf {
+    if ctx.params.b("legacyFeather") {
+        return linear_wipe_legacy(ctx, b);
+    }
+    linear_wipe_blurred(ctx, b)
+}
+
+/// After Effects' Linear Wipe (#3125): the edge sits at `lo + completion·(hi − lo)` whatever the
+/// feather (0 % keeps the layer, 100 % clears it), anti-aliased by pixel coverage, and Feather
+/// blurs that hard matte with the layer's edges repeated (so the feather leans opaque where it
+/// meets the layer's sides, as After Effects' does).
+fn linear_wipe_blurred(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let done = ctx.params.f("completion") / 100.0;
+    if done.is_nan() || done <= 0.0 {
+        return b;
+    }
+    if done >= 1.0 {
+        b.img.data.iter_mut().for_each(|px| *px = [0.0; 4]);
+        return b;
+    }
+    let (w, h) = (b.img.width as f64, b.img.height as f64);
+    let ([dx, dy], lo, hi) = linear_wipe_axis(ctx.params.f("angle"), w, h);
+    let edge = lo + (hi - lo) * done;
+    if !(edge.is_finite() && dx.is_finite() && dy.is_finite()) {
+        return b;
+    }
+    let mut mask = Image::new(b.img.width, b.img.height);
+    mask.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let d = (x as f64 + 0.5) * dx + (y as f64 + 0.5) * dy;
+            *px = [((d - edge) + 0.5).clamp(0.0, 1.0) as f32; 4];
+        }
+    });
+    let sigma = linear_wipe_sigma(ctx.params.f("feather"), b.scale, w, h);
+    // Three box passes per axis (the measured shape; the GPU runs the same passes). Below
+    // Feather ~2 they leave the anti-aliased edge alone.
+    if sigma > 1e-3 {
+        mask = gaussian_blur(&mask, sigma, sigma, true);
+    }
+    for (px, m) in b.img.data.iter_mut().zip(mask.data.iter()) {
+        let k = m[3].clamp(0.0, 1.0);
+        for c in px.iter_mut() {
+            *c *= k;
+        }
+    }
+    b
+}
+
+/// Linear Wipe as EffectCraft drew it before #3125 (projects saved then keep it): a linear ramp
+/// Feather pixels wide, the travel extended by the feather at both ends.
+fn linear_wipe_legacy(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let done = ctx.params.f("completion") / 100.0;
+    let feather = (ctx.params.f("feather") * b.scale).max(0.001);
+    let (w, h) = (b.img.width as f64, b.img.height as f64);
+    let ([dx, dy], lo, hi) = linear_wipe_axis(ctx.params.f("angle"), w, h);
     let edge = lo - feather + (hi - lo + 2.0 * feather) * done;
     b.img.rows_mut().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
@@ -503,22 +628,67 @@ fn linear_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
+/// Standard normal CDF Φ (Abramowitz & Stegun 7.1.26 erf, |error| < 1.5e-7).
+fn norm_cdf(z: f64) -> f64 {
+    let x = z.abs() / std::f64::consts::SQRT_2;
+    let t = 1.0 / (1.0 + 0.327_591_1 * x);
+    let poly = t * (0.254_829_592 + t * (-0.284_496_736 + t * (1.421_413_741 + t * (-1.453_152_027 + t * 1.061_405_429))));
+    let erf = 1.0 - poly * (-x * x).exp();
+    if z >= 0.0 { 0.5 * (1.0 + erf) } else { 0.5 * (1.0 - erf) }
+}
+
+/// Radial Wipe's wiped wedge relative to the Start Angle: (first ray, span), degrees clockwise
+/// from up. Clockwise (0) wipes from the start angle on, Counterclockwise (1) back from it,
+/// Both (2) half each way.
+pub fn radial_wipe_wedge(wipe: u32, done: f64) -> (f64, f64) {
+    let span = done.clamp(0.0, 1.0) * 360.0;
+    match wipe {
+        1 => (-span, span),
+        2 => (-span / 2.0, span),
+        _ => (0.0, span),
+    }
+}
+
+/// Radial Wipe's feather: a Gaussian of σ = 0.4 × Feather pixels across both edges of the wedge
+/// (After Effects 2026, Feather 20: the edge profile is the same width in pixels at every
+/// radius, σ = 8.0 px, mean error 0.0002 over the frame).
+pub fn radial_wipe_sigma(feather: f64) -> f64 {
+    feather.max(0.0) * 0.4
+}
+
+/// Visible fraction of a pixel at `(ux, uy)` from the centre (y down) for a wiped wedge from
+/// `ray0` (absolute degrees clockwise from up) over `span` degrees: the signed distance to the
+/// wedge's nearer edge, through the feather's Gaussian.
+pub fn radial_wipe_alpha(ux: f64, uy: f64, ray0: f64, span: f64, sigma: f64) -> f64 {
+    let a = (ux.atan2(-uy).to_degrees() - ray0).rem_euclid(360.0);
+    let wiped = a < span;
+    let ray_dist = |deg: f64| {
+        let (s, c) = deg.to_radians().sin_cos();
+        // Ray direction (sin, −cos) in y-down pixels.
+        let along = ux * s - uy * c;
+        if along > 0.0 { (ux * c + uy * s).abs() } else { ux.hypot(uy) }
+    };
+    let d = ray_dist(ray0).min(ray_dist(ray0 + span));
+    let sd = if wiped { -d } else { d };
+    if sigma < 1e-3 {
+        return if wiped { 0.0 } else { 1.0 };
+    }
+    norm_cdf(sd / sigma)
+}
+
 fn radial_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let done = ctx.params.f("completion") / 100.0;
+    let done = (ctx.params.f("completion") / 100.0).clamp(0.0, 1.0);
+    if done <= 0.0 {
+        return b;
+    }
     let start = ctx.params.f("startAngle");
     let c = b.to_px(ctx.params.v2("center"));
-    let dir = ctx.params.e("wipe");
-    let feather = (ctx.params.f("feather")).max(0.01);
+    let (w0, span) = radial_wipe_wedge(ctx.params.e("wipe"), done);
+    let sigma = radial_wipe_sigma(ctx.params.f("feather")) * b.scale;
+    let full = done >= 1.0;
     b.img.rows_mut().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
-            let a = ((x as f64 + 0.5 - c.0).atan2(-(y as f64 + 0.5 - c.1)).to_degrees() - start).rem_euclid(360.0);
-            // Both: the wipe opens in both directions from the start angle at once.
-            let (a, edge) = match dir {
-                1 => (360.0 - a, done * 360.0),
-                2 => (a.min(360.0 - a), done * 180.0),
-                _ => (a, done * 360.0),
-            };
-            let k = ((a - edge) / feather + 0.5).clamp(0.0, 1.0) as f32;
+            let k = if full { 0.0 } else { radial_wipe_alpha(x as f64 + 0.5 - c.0, y as f64 + 0.5 - c.1, start + w0, span, sigma) as f32 };
             for ch in px.iter_mut() {
                 *ch *= k;
             }
@@ -527,16 +697,49 @@ fn radial_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
+/// Venetian Blinds: how much of a pixel at phase `d` (0..`width`) a band of `done × width`
+/// covers, its two edges softened by a Gaussian of σ = Feather / 2 (σ in the units of `width`).
+/// Fitted to After Effects 2026 (Completion 40, Direction 30, Width 50, Feather 5 on 960 × 540
+/// and 480 × 270 layers): band from phase 0 to done × width, both edges Gaussian, within 6/255.
+pub fn venetian_cover(d: f64, width: f64, done: f64, sigma: f64) -> f64 {
+    let band = done * width;
+    if sigma < 1e-3 {
+        return if d < band { 1.0 } else { 0.0 };
+    }
+    // Wider than a few blinds the stripes blur into an even veil.
+    if sigma > 8.0 * width {
+        return done.clamp(0.0, 1.0);
+    }
+    let n = ((4.0 * sigma / width).ceil() as i64 + 1).clamp(1, 40);
+    let mut t = 0.0;
+    for k in -n..=n {
+        let u = d + k as f64 * width;
+        t += norm_cdf(u / sigma) - norm_cdf((u - band) / sigma);
+    }
+    t.clamp(0.0, 1.0)
+}
+
+/// Venetian Blinds' phase origin in layer pixels: the layer centre plus 0.6 px (fitted to the
+/// AE renders above; the stripes are measured from the layer's centre, not its corner).
+pub fn venetian_origin(layer_size: [f64; 2]) -> [f64; 2] {
+    [layer_size[0] / 2.0 + 0.6, layer_size[1] / 2.0 + 0.6]
+}
+
 fn venetian(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let done = ctx.params.f("completion") / 100.0;
+    let done = (ctx.params.f("completion") / 100.0).clamp(0.0, 1.0);
+    if done <= 0.0 {
+        return b;
+    }
     let ang = ctx.params.f("direction").to_radians();
     let width = (ctx.params.f("width") * b.scale).max(1.0);
-    let feather = (ctx.params.f("feather") * b.scale).max(0.001);
+    let sigma = ctx.params.f("feather").max(0.0) * b.scale / 2.0;
     let (dx, dy) = (ang.cos(), ang.sin());
+    let (ox, oy) = b.to_px(venetian_origin(ctx.layer_size));
     b.img.rows_mut().for_each(|(y, row)| {
+        let ry = (y as f64 + 0.5 - oy) * dy;
         for (x, px) in row.iter_mut().enumerate() {
-            let d = ((x as f64 + 0.5) * dx + (y as f64 + 0.5) * dy).rem_euclid(width);
-            let k = ((d - done * width) / feather + 0.5).clamp(0.0, 1.0) as f32;
+            let d = ((x as f64 + 0.5 - ox) * dx + ry).rem_euclid(width);
+            let k = (1.0 - venetian_cover(d, width, done, sigma)) as f32;
             for c in px.iter_mut() {
                 *c *= k;
             }
@@ -702,6 +905,8 @@ pub fn specs() -> Vec<EffectSpec> {
                 p("completion", "Transition Completion", num(0.0), slider(0.0, 100.0, 0.0, 100.0, 0)),
                 p("angle", "Wipe Angle", num(90.0), ParamUi::Angle),
                 p("feather", "Feather", num(0.0), slider(0.0, 32000.0, 0.0, 500.0, 1)),
+                // Projects saved before #3125 keep the earlier linear feather ramp.
+                p("legacyFeather", "Legacy Feather", Value::Bool(false), ParamUi::Hidden),
             ],
             linear_wipe,
         ),
@@ -738,6 +943,108 @@ mod tests {
     use super::*;
     use crate::{EffectEnv, run_fx};
 
+    /// White left half, black right half (one vertical edge at x = 20).
+    fn edge() -> effectcraft_raster::Image {
+        let mut img = effectcraft_raster::Image::filled(40, 8, [0.0, 0.0, 0.0, 1.0]);
+        for y in 0..8 {
+            for x in 0..20 {
+                img.set(x, y, [1.0, 1.0, 1.0, 1.0]);
+            }
+        }
+        img
+    }
+
+    fn blurred_row(id: &str, param: &str, v: f64) -> Vec<f32> {
+        let out = run_fx(id, &[(param, num(v)), ("repeatEdge", Value::Bool(true))], edge(), 0.0, EffectEnv::default());
+        (16..24).map(|x| out.img.get(x, 4)[0]).collect()
+    }
+
+    fn wipe(vals: &[(&str, Value)]) -> effectcraft_raster::Image {
+        let card = effectcraft_raster::Image::filled(320, 180, [1.0, 1.0, 1.0, 1.0]);
+        run_fx("ec.transition.linearwipe", vals, card, 0.0, EffectEnv::default()).img
+    }
+
+    /// #3125: After Effects 2026's Linear Wipe on our 320 × 180 importer sample (2026-11-05,
+    /// `linwipe-01-set-all`): Completion 10, Wipe Angle 77, Feather 16. Alpha (8-bit) of rows
+    /// 150 and 120 from x = 8, where the feathered edge crosses the layer away from its sides.
+    #[test]
+    fn linear_wipe_feather_matches_after_effects() {
+        const ROW150: [u8; 48] = [
+            0, 0, 0, 0, 0, 1, 2, 3, 6, 9, 12, 17, 23, 31, 39, 49, 61, 73, 86, 100, 115, 129, 144, 158, 172, 185, 198, 208, 218, 226, 233, 239, 244, 247, 250,
+            252, 254, 254, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
+        ];
+        const ROW120: [u8; 48] = [
+            3, 5, 8, 12, 17, 23, 30, 39, 49, 60, 72, 85, 99, 114, 128, 143, 157, 171, 184, 197, 208, 217, 226, 233, 239, 243, 247, 250, 252, 253, 254, 255,
+            255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
+        ];
+        let vals = [("completion", num(10.0)), ("angle", num(77.0)), ("feather", num(16.0))];
+        let out = wipe(&vals);
+        for (y, row) in [(150, &ROW150), (120, &ROW120)] {
+            for (i, &ae) in row.iter().enumerate() {
+                let x = 8 + i as i64;
+                let a = out.get(x, y)[3] * 255.0;
+                assert!((a - ae as f32).abs() <= 2.5, "({x}, {y}): {a} vs After Effects {ae}");
+            }
+        }
+        // Where the edge meets the layer's left side the feather leans opaque, as in After
+        // Effects (179 at (0, 30); a profile across the edge alone gives about 110).
+        assert!(out.get(0, 30)[3] * 255.0 > 160.0, "{}", out.get(0, 30)[3] * 255.0);
+        // Projects saved before keep the old linear ramp, which put the edge 13 px further left.
+        let legacy = wipe(&[vals.as_slice(), &[("legacyFeather", Value::Bool(true))]].concat());
+        assert!((legacy.get(23, 150)[3] * 255.0 - 129.0).abs() > 100.0);
+    }
+
+    /// #3125: without feather After Effects' edge sits at Completion × the layer's extent along
+    /// the wipe (9.5 % of 320 px = 30.4, `linwipe-04-keys`; 22 % = 70.4, `linwipe-05-expr`); the
+    /// edge pixel is anti-aliased (After Effects 143 / 255, coverage gives 0.6). 0 % keeps the
+    /// layer and 100 % clears it whatever the feather (`linwipe-02-min`, `linwipe-03-max`).
+    #[test]
+    fn linear_wipe_edge_follows_completion() {
+        for (c, col) in [(9.5, 30), (22.0, 70)] {
+            let out = wipe(&[("completion", num(c)), ("angle", num(90.0))]);
+            for y in [0, 90, 179] {
+                assert_eq!(out.get(col - 1, y)[3], 0.0, "{c}");
+                assert_eq!(out.get(col + 1, y)[3], 1.0, "{c}");
+                assert!((out.get(col, y)[3] - 143.0 / 255.0).abs() < 0.05, "{c}: {}", out.get(col, y)[3]);
+            }
+        }
+        let max = wipe(&[("completion", num(100.0)), ("feather", num(32000.0))]);
+        assert!(max.data.iter().all(|p| p[3] == 0.0));
+        let min = wipe(&[("completion", num(0.0)), ("feather", num(32000.0))]);
+        assert!(min.data.iter().all(|p| p[3] == 1.0));
+    }
+
+    /// Hostile values: a huge feather is capped (no slow or oversized blur), NaN does not spread.
+    #[test]
+    fn linear_wipe_survives_hostile_values() {
+        let out = wipe(&[("completion", num(50.0)), ("feather", num(1e12))]);
+        assert!(out.data.iter().all(|p| p[3].is_finite()));
+        let out = wipe(&[("completion", num(50.0)), ("angle", num(f64::NAN)), ("feather", num(f64::NAN))]);
+        assert!(out.data.iter().all(|p| p[3].is_finite()));
+        let out = wipe(&[("completion", num(f64::NAN))]);
+        assert!(out.data.iter().all(|p| p[3] == 1.0));
+    }
+
+    #[test]
+    fn small_gaussian_blurriness_is_continuous() {
+        // #1939: 0.9 used to be identical to 0, and 1.2 / 1.6 / 2.0 identical to each other.
+        let row = |v| blurred_row("ec.blur.gaussian", "blurriness", v);
+        assert_ne!(row(0.0), row(0.9));
+        assert_ne!(row(0.9), row(1.2));
+        assert_ne!(row(1.2), row(1.6));
+        assert_ne!(row(1.6), row(2.0));
+        assert_ne!(row(2.0), row(2.4));
+    }
+
+    #[test]
+    fn fractional_box_blur_radius_is_continuous() {
+        let row = |v| blurred_row("ec.blur.fastbox", "radius", v);
+        assert_ne!(row(0.0), row(0.5));
+        assert_ne!(row(0.5), row(0.9));
+        assert_ne!(row(1.2), row(1.6));
+        assert_ne!(row(1.6), row(2.4));
+    }
+
     /// A bright square on mid grey.
     fn scene() -> effectcraft_raster::Image {
         let mut img = effectcraft_raster::Image::filled(24, 24, [0.3, 0.3, 0.3, 1.0]);
@@ -749,6 +1056,189 @@ mod tests {
         img
     }
 
+    /// After Effects 2026 (cases 524, 807, 808, 809): Glow on a 50 % grey solid, which is below
+    /// the 60 % threshold, still covers a blurred copy of the layer's alpha with black, so the
+    /// red layer underneath darkens outside the edge. The halo is the same at Intensity 1 and 3
+    /// and with Composite Original On Top or Behind; its width follows Glow Radius.
+    #[test]
+    fn glow_halo_matches_after_effects() {
+        let grey = effectcraft_raster::Image::filled(200, 120, [0.5, 0.5, 0.5, 1.0]);
+        // AE's red under the halo at 0.5, 1.5, 3.5, 5.5 and 7.5 px outside the left edge
+        // (radius 10) and at 0.5, 5.5, 10.5, 20.5 px (radius 30); halo alpha = 1 − red.
+        let r10 = [(0.5, 140.0), (1.5, 165.0), (3.5, 208.0), (5.5, 234.0), (7.5, 248.0)];
+        let r30 = [(0.5, 132.0), (5.5, 173.0), (10.5, 208.0), (20.5, 245.0)];
+        for (radius, intensity, operation, profile) in [(10.0, 1.0, 1, &r10[..]), (10.0, 3.0, 1, &r10[..]), (10.0, 1.0, 0, &r10[..]), (30.0, 1.0, 1, &r30[..])]
+        {
+            let set = [
+                ("based", Value::Enum(1)),
+                ("threshold", num(60.0)),
+                ("radius", num(radius)),
+                ("intensity", num(intensity)),
+                ("operation", Value::Enum(operation)),
+            ];
+            let o = run_fx("ec.stylize.glow", &set, grey.clone(), 0.0, EffectEnv::default());
+            for &(d, red) in profile {
+                // Layer x = −d (pixel centre), mid-height; over AE's red: R = 1 − α, colour 0.
+                let (bx, by) = o.to_px([-d, 60.0]);
+                let p = o.img.get(bx.floor() as i64, by.floor() as i64);
+                let ae = 1.0 - red / 255.0;
+                assert!((p[3] - ae).abs() < 3.0 / 255.0, "radius {radius} intensity {intensity} op {operation} at {d} px: alpha {} vs AE {ae}", p[3]);
+                assert!(p[0].abs() < 1e-6, "the halo is black: {p:?}");
+            }
+        }
+    }
+
+    /// After Effects 2026, Glow at Threshold 60 %, Radius 10, Intensity 0.25 on 200 × 200
+    /// solids over red: the glow 1.5 px outside the left edge, premultiplied (the green / blue
+    /// channels of the render, where the red background adds nothing), and its alpha 0.353.
+    #[test]
+    fn glow_brightness_matches_after_effects() {
+        // (solid colour, channel, AE glow value 0..255)
+        let cases = [
+            ([0.65, 0.65, 0.65], 1, 20.0),
+            ([0.8, 0.8, 0.8], 1, 47.0),
+            ([0.9, 0.9, 0.9], 1, 65.0),
+            ([1.0, 1.0, 1.0], 1, 83.0),
+            ([1.0, 0.5, 0.0], 1, 0.0),
+            ([0.2, 0.6, 1.0], 1, 11.0),
+            ([0.2, 0.6, 1.0], 2, 83.0),
+        ];
+        for (c, ch, ae) in cases {
+            let img = effectcraft_raster::Image::filled(200, 200, [c[0], c[1], c[2], 1.0]);
+            let set = [("threshold", num(60.0)), ("radius", num(10.0)), ("intensity", num(0.25))];
+            let o = run_fx("ec.stylize.glow", &set, img, 0.0, EffectEnv::default());
+            let (bx, by) = o.to_px([-1.5, 100.0]);
+            let p = o.img.get(bx.floor() as i64, by.floor() as i64);
+            assert!((p[ch] * 255.0 - ae).abs() <= 2.5, "{c:?} channel {ch}: {} vs AE {ae}", p[ch] * 255.0);
+            assert!((p[3] - 0.353).abs() < 3.0 / 255.0, "{c:?}: alpha {}", p[3]);
+        }
+        // Intensity scales the colour linearly: white at Intensity 1 is 3.7 × its alpha.
+        let white = effectcraft_raster::Image::filled(200, 200, [1.0, 1.0, 1.0, 1.0]);
+        let o = run_fx("ec.stylize.glow", &[("threshold", num(60.0)), ("radius", num(10.0))], white, 0.0, EffectEnv::default());
+        let (bx, by) = o.to_px([-1.5, 100.0]);
+        let p = o.img.get(bx.floor() as i64, by.floor() as i64);
+        assert!((p[1] / p[3] - 3.69).abs() < 0.05, "{p:?}");
+    }
+
+    /// After Effects 2026: Radial Blur keeps the layer's edges. Zoom 20 on a flat grey 960 × 540
+    /// solid (case 713) leaves it flat and opaque to the edge (EffectCraft faded the edges toward
+    /// transparency, letting the red layer below show through); on a full-frame horizontal ramp
+    /// (case 829, centre [960, 540]) row 540 reads 2/255 at x = 2 and 253/255 at x = 1917.
+    #[test]
+    fn radial_blur_keeps_the_layer_edges_as_after_effects() {
+        let zoom = |c: [f64; 2]| [("amount", num(20.0)), ("type", Value::Enum(1)), ("center", Value::Vec2(c))];
+        let grey = effectcraft_raster::Image::filled(960, 540, [0.5, 0.5, 0.5, 1.0]);
+        let o = run_fx("ec.blur.radial", &zoom([600.0, 300.0]), grey, 0.0, EffectEnv::default());
+        for (x, y) in [(0, 270), (1, 270), (959, 270), (480, 0), (480, 539), (0, 0), (959, 539)] {
+            let p = o.img.get(x, y);
+            assert!((p[3] - 1.0).abs() < 1e-4 && (p[0] - 0.5).abs() < 1e-4, "({x}, {y}): {p:?}");
+        }
+        let mut ramp = effectcraft_raster::Image::new(1920, 1080);
+        ramp.rows_mut().for_each(|(_, row)| {
+            for (x, px) in row.iter_mut().enumerate() {
+                let v = (x as f32 + 0.5) / 1920.0;
+                *px = [v, v, v, 1.0];
+            }
+        });
+        let o = run_fx("ec.blur.radial", &zoom([960.0, 540.0]), ramp, 0.0, EffectEnv::default());
+        for (x, ae) in [(2, 2.0), (1917, 253.0)] {
+            let p = o.img.get(x, 540);
+            assert!((p[0] * 255.0 - ae).abs() <= 2.0 && (p[3] - 1.0).abs() < 1e-4, "x {x}: {p:?} vs AE {ae}");
+        }
+    }
+
+    /// After Effects 2026, Venetian Blinds Completion 40, Direction 30, Width 50, Feather 5 on
+    /// an opaque 480 × 270 layer: alpha (0..255) along row y = 135. The transparent band starts
+    /// at the layer centre's phase, both edges are Gaussian (σ = Feather / 2).
+    #[test]
+    fn venetian_blinds_match_after_effects() {
+        let img = effectcraft_raster::Image::filled(480, 270, [0.5, 0.5, 0.5, 1.0]);
+        let vals = [("completion", Value::Scalar(40.0)), ("direction", Value::Scalar(30.0)), ("width", Value::Scalar(50.0)), ("feather", Value::Scalar(5.0))];
+        let o = run_fx("ec.transition.venetian", &vals, img, 0.0, EffectEnv::default());
+        let ae = [
+            (200, 5.0),
+            (203, 47.0),
+            (206, 145.0),
+            (209, 228.0),
+            (212, 253.0),
+            (224, 255.0),
+            (236, 238.0),
+            (239, 168.0),
+            (242, 66.0),
+            (245, 10.0),
+            (251, 0.0),
+            (257, 2.0),
+            (260, 31.0),
+        ];
+        for (x, a) in ae {
+            let got = o.img.get(x, 135)[3] * 255.0;
+            assert!((got - a).abs() <= 6.0, "x {x}: alpha {got} vs AE {a}");
+        }
+        // No completion leaves the layer; full completion clears it; no feather is a hard edge.
+        let full = [("completion", Value::Scalar(100.0)), ("feather", Value::Scalar(5.0))];
+        let img = effectcraft_raster::Image::filled(40, 20, [0.5, 0.5, 0.5, 1.0]);
+        assert!(run_fx("ec.transition.venetian", &full, img.clone(), 0.0, EffectEnv::default()).img.data.iter().all(|p| p[3] < 1e-4));
+        assert_eq!(run_fx("ec.transition.venetian", &[("completion", Value::Scalar(0.0))], img.clone(), 0.0, EffectEnv::default()).img, img);
+        let hard = run_fx(
+            "ec.transition.venetian",
+            &[("completion", Value::Scalar(50.0)), ("width", Value::Scalar(10.0)), ("feather", Value::Scalar(0.0))],
+            img,
+            0.0,
+            EffectEnv::default(),
+        );
+        assert!(hard.img.data.iter().all(|p| p[3] == 0.0 || p[3] == 1.0));
+        // A feather far wider than the blinds is an even veil.
+        assert_eq!(venetian_cover(3.0, 10.0, 0.5, 1e9), 0.5);
+    }
+
+    /// After Effects 2026, Radial Wipe Completion 40, Start Angle 30, Wipe Counterclockwise,
+    /// Feather 20, centre (800, 500): visible fraction at pixel offsets from the centre on both
+    /// edges (8-bit captures of dark steps, so ±0.05).
+    #[test]
+    fn radial_wipe_feather_matches_after_effects() {
+        let img = effectcraft_raster::Image::filled(400, 300, [1.0, 1.0, 1.0, 1.0]);
+        let vals = [
+            ("completion", Value::Scalar(40.0)),
+            ("startAngle", Value::Scalar(30.0)),
+            ("center", Value::Vec2([200.0, 150.0])),
+            ("wipe", Value::Enum(1)),
+            ("feather", Value::Scalar(20.0)),
+        ];
+        let o = run_fx("ec.transition.radialwipe", &vals, img.clone(), 0.0, EffectEnv::default());
+        let ae = [
+            ((-50, 34), 0.922),
+            ((-52, 30), 0.797),
+            ((-54, 26), 0.609),
+            ((-55, 24), 0.5),
+            ((-56, 22), 0.406),
+            ((-57, 19), 0.266),
+            ((-58, 15), 0.125),
+            ((-104, 60), 0.951),
+            ((-108, 53), 0.732),
+            ((-111, 45), 0.341),
+            ((-114, 37), 0.062),
+            ((22, -56), 0.156),
+            ((26, -54), 0.312),
+            ((30, -52), 0.531),
+            ((34, -50), 0.729),
+            ((37, -47), 0.875),
+            ((53, -108), 0.177),
+            ((67, -99), 0.875),
+        ];
+        for ((dx, dy), a) in ae {
+            let got = o.img.get(200 + dx, 150 + dy)[3];
+            assert!((got - a).abs() < 0.05, "offset ({dx}, {dy}): {got} vs AE {a}");
+        }
+        // 0 % leaves the layer, 100 % clears it, Feather 0 is a hard edge.
+        let at = |c: f64, f: f64| {
+            let v = [("completion", Value::Scalar(c)), ("feather", Value::Scalar(f))];
+            run_fx("ec.transition.radialwipe", &v, img.clone(), 0.0, EffectEnv::default()).img
+        };
+        assert_eq!(at(0.0, 20.0), img);
+        assert!(at(100.0, 20.0).data.iter().all(|p| p[3] == 0.0));
+        assert!(at(50.0, 0.0).data.iter().all(|p| p[3] == 0.0 || p[3] == 1.0));
+    }
+
     #[test]
     fn glow_operation_and_arbitrary_map() {
         // Pixels addressed in layer space (Glow pads its buffer).
diff --git a/crates/effects/src/mocha_shape.rs b/crates/effects/src/mocha_shape.rs
index cf9e2bd88..c669580c6 100644
--- a/crates/effects/src/mocha_shape.rs
+++ b/crates/effects/src/mocha_shape.rs
@@ -1,4 +1,4 @@
-//! Matte ▸ Mocha shape: renders planar-tracked roto shapes as a matte.
+//! Matte ▸ Tracked Shape Matte: renders planar-tracked roto shapes as a matte.
 //!
 //! Mocha's own clipboard / export formats are not publicly specified, so the effect reads shape
 //! data in a small documented JSON format of ours (in the hidden `shapeData` parameter, either the
@@ -184,7 +184,7 @@ fn mocha_shape(ctx: &EffectCtx, mut b: Buf) -> Buf {
 pub fn specs() -> Vec<EffectSpec> {
     vec![EffectSpec {
         id: "ec.obsolete.mochashape",
-        name: "Mocha shape",
+        name: "Tracked Shape Matte",
         category: "Matte",
         params: vec![
             p("blendMode", "Blend mode", Value::Enum(0), popup(&["Add", "Subtract", "Intersect", "Difference"])),
diff --git a/crates/effects/src/noise.rs b/crates/effects/src/noise.rs
index d39fd6528..b6f76a268 100644
--- a/crates/effects/src/noise.rs
+++ b/crates/effects/src/noise.rs
@@ -254,8 +254,14 @@ pub(crate) fn preview_compose(ctx: &EffectCtx, b: &mut Buf, orig: &Image) {
     });
 }
 
+/// How far the grain statistics read around a sample box: their high-pass subtracts a Gaussian
+/// of sigma 1.5, three box passes of radius 1 (`noise2::grain_stats_boxes`).
+const SAMPLE_REACH: usize = 3;
+
 /// Boxes (x, y, size in buffer px) where grain is sampled: the flattest of a grid of
-/// candidate boxes (real grain shows best where the picture has no detail).
+/// candidate boxes (real grain shows best where the picture has no detail). A box and the
+/// [`SAMPLE_REACH`] px around it are opaque: a transparent pixel there is black once
+/// unpremultiplied, and the high-pass would measure that edge as grain.
 pub(crate) fn sample_boxes(img: &Image, count: usize, size: usize) -> Vec<(usize, usize, usize)> {
     let (w, h) = (img.width as usize, img.height as usize);
     let size = size.clamp(3, w.min(h).max(3));
@@ -264,25 +270,46 @@ pub(crate) fn sample_boxes(img: &Image, count: usize, size: usize) -> Vec<(usize
     }
     let low = Plane::luma(img);
     let step = (size / 2).max(1);
-    let mut cands: Vec<(f32, usize, usize)> = Vec::new();
-    for y in (0..=h - size).step_by(step) {
-        for x in (0..=w - size).step_by(step) {
-            // Variance of the picture inside the box (the flattest boxes hold the least detail).
-            let (mut s, mut sq, mut n, mut opaque) = (0.0f32, 0.0f32, 0.0f32, true);
-            for yy in y..y + size {
-                for xx in x..x + size {
-                    let v = low.data[yy * w + xx];
-                    s += v;
-                    sq += v * v;
-                    n += 1.0;
-                    opaque &= img.data[yy * w + xx][3] > 0.5;
-                }
-            }
-            if opaque {
-                cands.push((sq / n - (s / n).powi(2), x, y));
-            }
+    // Transparent pixels (alpha 0.5 or less) in a summed-area table: `sat[y * (w + 1) + x]`
+    // counts them above and left of (x, y).
+    let sw = w + 1;
+    let mut sat = vec![0usize; sw * (h + 1)];
+    for y in 0..h {
+        let mut run = 0;
+        for x in 0..w {
+            let opaque = img.data[y * w + x][3] > 0.5;
+            run += usize::from(!opaque);
+            sat[(y + 1) * sw + x + 1] = sat[y * sw + x + 1] + run;
         }
     }
+    let sat = sat.as_slice();
+    // Candidate rows in parallel; the sort below is a total order (variance, y, x), so the
+    // result does not depend on the collection order.
+    let rows: Vec<usize> = (0..=h - size).step_by(step).collect();
+    let mut cands: Vec<(f32, usize, usize)> = rows
+        .par_iter()
+        .flat_map_iter(|&y| {
+            let data = low.data.as_slice();
+            (0..=w - size).step_by(step).filter_map(move |x| {
+                let (x0, y0) = (x.saturating_sub(SAMPLE_REACH), y.saturating_sub(SAMPLE_REACH));
+                let (x1, y1) = ((x + size + SAMPLE_REACH).min(w), (y + size + SAMPLE_REACH).min(h));
+                if sat[y1 * sw + x1] + sat[y0 * sw + x0] != sat[y0 * sw + x1] + sat[y1 * sw + x0] {
+                    return None;
+                }
+                // Variance of the picture inside the box (the flattest boxes hold the least detail).
+                let (mut s, mut sq, mut n) = (0.0f32, 0.0f32, 0.0f32);
+                for yy in y..y + size {
+                    for xx in x..x + size {
+                        let v = data[yy * w + xx];
+                        s += v;
+                        sq += v * v;
+                        n += 1.0;
+                    }
+                }
+                Some((sq / n - (s / n).powi(2), x, y))
+            })
+        })
+        .collect();
     cands.sort_by(|a, b| a.0.total_cmp(&b.0).then(a.2.cmp(&b.2)).then(a.1.cmp(&b.1)));
     cands.into_iter().take(count).map(|(_, x, y)| (x, y, size)).collect()
 }
@@ -479,16 +506,7 @@ pub(crate) fn sampling_boxes(ctx: &EffectCtx, img: &Image, scale: f64) -> Vec<(u
 
 /// The grain level (0.5..2) measured in the sample boxes of `img`.
 fn grain_level(img: &Image, boxes: &[(usize, usize, usize)]) -> f32 {
-    let mut m = vec![false; img.data.len()];
-    let w = img.width as usize;
-    for &(x, y, s) in boxes {
-        for yy in y..y + s {
-            for xx in x..x + s {
-                m[yy * w + xx] = true;
-            }
-        }
-    }
-    let st = crate::noise2::grain_stats_masked(img, Some(&m));
+    let st = crate::noise2::grain_stats_boxes(img, boxes);
     let s = (st.std[0] + st.std[1] + st.std[2]) / 3.0;
     if boxes.is_empty() { 1.0 } else { (s / 0.02).clamp(0.5, 2.0) }
 }
diff --git a/crates/effects/src/noise2.rs b/crates/effects/src/noise2.rs
index 4c22f6d8f..56de9943e 100644
--- a/crates/effects/src/noise2.rs
+++ b/crates/effects/src/noise2.rs
@@ -75,6 +75,102 @@ pub(crate) fn grain_stats_masked(img: &Image, mask: Option<&[bool]>) -> GrainSta
     GrainStats { std, size: (1.0 / (1.0 - rho as f32)).clamp(0.5, 20.0) * 0.6 }
 }
 
+/// Grain statistics over sample `boxes` (in image pixels), measured from small crops around each
+/// box instead of the whole image. Empty `boxes` measures every opaque pixel, like
+/// [`grain_stats_masked`] without a mask. Overlapping boxes are deduplicated, so the sums match
+/// the masked version.
+pub(crate) fn grain_stats_boxes(img: &Image, boxes: &[(usize, usize, usize)]) -> GrainStats {
+    if boxes.is_empty() {
+        return grain_stats_masked(img, None);
+    }
+    let (w, h) = (img.width as usize, img.height as usize);
+    if w < 3 || h < 3 {
+        return GrainStats::default();
+    }
+    // The Gaussian's three box passes at sigma 1.5 have radius 1 each, so 3 px of halo make the
+    // residual exact inside a box; one more column covers the right neighbour used by the lag-1
+    // correlation.
+    const HALO: usize = 4;
+    let mut mask = vec![false; w * h];
+    for &(x, y, s) in boxes {
+        for yy in y..y.saturating_add(s).min(h) {
+            for xx in x..x.saturating_add(s).min(w) {
+                mask[yy * w + xx] = true;
+            }
+        }
+    }
+    let mut counted = vec![false; w * h];
+    let mut n = [0.0f64; 3];
+    let mut sum = [0.0f64; 3];
+    let mut sq = [0.0f64; 3];
+    let mut rho_num = 0.0f64;
+    let mut rho_den = 0.0f64;
+    let mut crop: Vec<([f32; 3], f32)> = Vec::new();
+    let mut planes: Vec<Plane> = Vec::new();
+    for &(bx, by, bs) in boxes {
+        let x0 = bx.saturating_sub(HALO);
+        let y0 = by.saturating_sub(HALO);
+        let x1 = bx.saturating_add(bs).saturating_add(HALO).min(w);
+        let y1 = by.saturating_add(bs).saturating_add(HALO).min(h);
+        if x1 <= x0 || y1 <= y0 {
+            continue;
+        }
+        let (cw, ch) = (x1 - x0, y1 - y0);
+        crop.clear();
+        crop.extend((y0..y1).flat_map(|y| (x0..x1).map(move |x| unpremul(img.data[y * w + x]))));
+        planes.clear();
+        for k in 0..3 {
+            let pl = Plane { w: cw, h: ch, data: crop.iter().map(|s| s.0[k]).collect() };
+            planes.push(gauss_plane(&pl, 1.5, 1.5));
+        }
+        for ly in 0..bs {
+            let y = by + ly;
+            if y >= h {
+                break;
+            }
+            for lx in 0..bs {
+                let x = bx + lx;
+                if x >= w {
+                    break;
+                }
+                let g = y * w + x;
+                if !mask[g] || counted[g] {
+                    continue;
+                }
+                counted[g] = true;
+                let l = (y - y0) * cw + (x - x0);
+                let (_, a) = crop[l];
+                if a <= 0.5 {
+                    continue;
+                }
+                for k in 0..3 {
+                    let hp = crop[l].0[k] - planes[k].data[l];
+                    sum[k] += hp as f64;
+                    sq[k] += (hp as f64) * (hp as f64);
+                    n[k] += 1.0;
+                }
+                if x + 1 < w && mask[g + 1] && crop[l + 1].1 > 0.5 {
+                    for k in 0..3 {
+                        let hp = crop[l].0[k] - planes[k].data[l];
+                        let hn = crop[l + 1].0[k] - planes[k].data[l + 1];
+                        rho_num += (hp * hn) as f64;
+                        rho_den += (hp * hp) as f64;
+                    }
+                }
+            }
+        }
+    }
+    let mut std = [0.0f32; 3];
+    for k in 0..3 {
+        if n[k] > 1.0 {
+            let mean = sum[k] / n[k];
+            std[k] = ((sq[k] / n[k] - mean * mean).max(0.0)).sqrt() as f32;
+        }
+    }
+    let rho = if rho_den > 1e-12 { (rho_num / rho_den).clamp(0.0, 0.95) } else { 0.0 };
+    GrainStats { std, size: (1.0 / (1.0 - rho as f32)).clamp(0.5, 20.0) * 0.6 }
+}
+
 /// Match Grain's Viewing Mode options.
 const MATCH_GRAIN_VIEWS: [&str; 5] = ["Preview", "Noise Samples", "Compensation Samples", "Blending Matte", "Final Output"];
 
@@ -86,34 +182,23 @@ fn match_grain(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let view = ctx.params.e("viewingMode");
     let source = layer_or_self(ctx, &b, "noiseSourceLayer", false, false);
     let src_boxes = sampling_boxes(ctx, &source, b.scale);
-    let own_boxes = sampling_boxes(ctx, &b.img, b.scale);
     let box_col = ctx.params.get("sampling/sampleBoxColor").map(|v| v.as_color()).unwrap_or([1.0, 1.0, 0.0, 1.0]);
     if view == 1 || view == 2 {
         // Noise Samples (on the source) / Compensation Samples (on this layer).
-        let (mut img, boxes) = if view == 1 { (source, src_boxes) } else { (b.img.clone(), own_boxes) };
+        let (mut img, boxes) = if view == 1 { (source, src_boxes) } else { (b.img.clone(), sampling_boxes(ctx, &b.img, b.scale)) };
         draw_boxes(&mut img, &boxes, box_col);
         b.img = img;
         return b;
     }
-    let mask_of = |img: &Image, boxes: &[(usize, usize, usize)]| -> Option<Vec<bool>> {
-        if boxes.is_empty() {
-            return None;
-        }
-        let w = img.width as usize;
-        let mut m = vec![false; img.data.len()];
-        for &(x, y, s) in boxes {
-            for yy in y..y + s {
-                for xx in x..x + s {
-                    m[yy * w + xx] = true;
-                }
-            }
-        }
-        Some(m)
-    };
-    let src_stats = grain_stats_masked(&source, mask_of(&source, &src_boxes).as_deref());
+    // No box with an opaque surround (a small layer inside transparent pixels) means no clean
+    // sample: no grain to match, as After Effects applies none when its samples hold transparent
+    // areas. The whole-image fallback of `grain_stats_boxes` would measure the edge again.
+    let clean_stats = |img: &Image, boxes: &[(usize, usize, usize)]| if boxes.is_empty() { GrainStats::default() } else { grain_stats_boxes(img, boxes) };
+    let src_stats = clean_stats(&source, &src_boxes);
     let comp = (ctx.params.f("compensateForExistingNoise") / 100.0) as f32;
-    let own = if comp > 0.0 { grain_stats_masked(&b.img, mask_of(&b.img, &own_boxes).as_deref()) } else { GrainStats::default() };
-    let orig = b.img.clone();
+    // The own-layer boxes only matter for the compensation term; skip them when it is off.
+    let own = if comp > 0.0 { clean_stats(&b.img, &sampling_boxes(ctx, &b.img, b.scale)) } else { GrainStats::default() };
+    let orig = (view == 0).then(|| b.img.clone());
     let look = GrainLook::from_params(ctx);
     let amp: [f32; 3] = [0, 1, 2].map(|k| {
         let s = src_stats.std[k];
@@ -147,8 +232,8 @@ fn match_grain(ctx: &EffectCtx, mut b: Buf) -> Buf {
             }
         }
     });
-    if view == 0 {
-        crate::noise::preview_compose(ctx, &mut b, &orig);
+    if let Some(orig) = &orig {
+        crate::noise::preview_compose(ctx, &mut b, orig);
     }
     b
 }
@@ -306,6 +391,63 @@ mod tests {
         img
     }
 
+    #[test]
+    fn boxed_grain_stats_match_the_masked_ones() {
+        // Noisy image with alpha holes; the boxes cover overlapping, edge-adjacent and
+        // bottom-right corner cases (clamped crops).
+        let mut img = noisy(64, 48, 0.2, 9);
+        for y in 0..img.height {
+            for x in 0..img.width {
+                if (x / 7 + y / 5) % 6 == 0 {
+                    let mut p = img.get(x as i64, y as i64);
+                    p[3] = 0.0;
+                    img.set(x, y, p);
+                }
+            }
+        }
+        let boxes = [(3usize, 4usize, 9usize), (8, 6, 9), (40, 20, 12), (39, 21, 12), (55, 39, 9)];
+        let w = img.width as usize;
+        let mut mask = vec![false; img.data.len()];
+        for &(x, y, s) in &boxes {
+            for yy in y..y + s {
+                for xx in x..x + s {
+                    mask[yy * w + xx] = true;
+                }
+            }
+        }
+        let masked = grain_stats_masked(&img, Some(&mask));
+        let boxed = grain_stats_boxes(&img, &boxes);
+        for k in 0..3 {
+            assert!((masked.std[k] - boxed.std[k]).abs() < 1e-6, "{k}: {masked:?} vs {boxed:?}");
+        }
+        assert!((masked.size - boxed.size).abs() <= 1e-7, "size: {masked:?} vs {boxed:?}");
+        // A denser grid where every box overlaps its neighbours (mask dedup across boxes).
+        let img2 = noisy(96, 64, 0.15, 21);
+        let mut boxes2 = Vec::new();
+        for gy in 0..5 {
+            for gx in 0..6 {
+                boxes2.push((gx * 11 + (gy % 3) * 4, gy * 10 + gx % 2, 12));
+            }
+        }
+        let w2 = img2.width as usize;
+        let mut mask2 = vec![false; img2.data.len()];
+        for &(x, y, s) in &boxes2 {
+            for yy in y..y + s {
+                for xx in x..x + s {
+                    mask2[yy * w2 + xx] = true;
+                }
+            }
+        }
+        let masked2 = grain_stats_masked(&img2, Some(&mask2));
+        let boxed2 = grain_stats_boxes(&img2, &boxes2);
+        for k in 0..3 {
+            assert!((masked2.std[k] - boxed2.std[k]).abs() < 1e-6, "{k}: {masked2:?} vs {boxed2:?}");
+        }
+        assert!((masked2.size - boxed2.size).abs() <= 1e-7, "size: {masked2:?} vs {boxed2:?}");
+        // No boxes measures the whole image, like no mask.
+        assert_eq!(grain_stats_boxes(&img, &[]), grain_stats(&img));
+    }
+
     #[test]
     fn match_grain_transfers_grain_strength() {
         let flat = Image::filled(48, 48, [0.5, 0.5, 0.5, 1.0]);
@@ -321,6 +463,54 @@ mod tests {
         assert_eq!(out.img.data, again.img.data);
     }
 
+    /// #2919: a sample box beside transparent pixels measured the edge as grain. Its own
+    /// pixels are opaque, but the high-pass blur reads 3 px around it, where transparent pixels
+    /// are black once unpremultiplied. An earlier blur pads the layer with transparent pixels,
+    /// so a clean plate got blocky colour grain on the frames whose flattest boxes sat at the
+    /// edge, and fine grain on the others.
+    #[test]
+    fn match_grain_ignores_the_edge_of_a_transparent_border() {
+        // A flat colour inside the 2 px transparent frame of a padded buffer.
+        let framed = |w: u32, h: u32, c: [f32; 4]| {
+            let mut img = Image::filled(w, h, c);
+            for y in 0..h {
+                for x in 0..w {
+                    if x < 2 || y < 2 || x >= w - 2 || y >= h - 2 {
+                        img.set(x, y, [0.0; 4]);
+                    }
+                }
+            }
+            img
+        };
+        let most_change = |a: &Image, b: &Image| a.data.iter().zip(&b.data).flat_map(|(p, q)| (0..3).map(move |k| (p[k] - q[k]).abs())).fold(0.0f32, f32::max);
+        // A noiseless sky. At 16 px no 9 px box has an opaque 3 px surround, so there is no
+        // clean sample at all (the whole-image fallback would measure the edge).
+        for (w, h, clean_boxes) in [(64u32, 48u32, true), (16, 16, false)] {
+            let sky = framed(w, h, [0.4, 0.6, 0.9, 1.0]);
+            let boxes = crate::noise::sample_boxes(&sky, 80, 9);
+            assert_eq!(!boxes.is_empty(), clean_boxes, "{w}x{h}: {boxes:?}");
+            if clean_boxes {
+                let st = grain_stats_boxes(&sky, &boxes);
+                assert!(st.std.iter().all(|s| *s < 1e-5), "{w}x{h}: {st:?} from {boxes:?}");
+            }
+            // So Match Grain finds no grain to add.
+            let host = FakeHost(sky);
+            let env = EffectEnv { host: Some(&host), ..Default::default() };
+            let target = Image::filled(w, h, [0.2, 0.3, 0.5, 1.0]);
+            let out = run_fx("ec.noise.matchgrain", &[("noiseSourceLayer", Value::Layer(Some(7)))], target.clone(), 0.5, env);
+            let most = most_change(&out.img, &target);
+            assert!(most < 1e-5, "{w}x{h}: Match Grain added {most}");
+        }
+        // Compensate for Existing Noise has no clean sample of such a layer either, so its edge
+        // doesn't cancel the source's grain.
+        let host = FakeHost(noisy(16, 16, 0.1, 3));
+        let env = EffectEnv { host: Some(&host), ..Default::default() };
+        let target = framed(16, 16, [0.9, 0.9, 0.9, 1.0]);
+        let params = [("noiseSourceLayer", Value::Layer(Some(7))), ("compensateForExistingNoise", crate::num(100.0))];
+        let out = run_fx("ec.noise.matchgrain", &params, target.clone(), 0.5, env);
+        assert!(most_change(&out.img, &target) > 0.01, "the layer's own edge cancelled the grain");
+    }
+
     #[test]
     fn median_legacy_radius_zero_identity_and_removes_speck() {
         let mut img = Image::filled(9, 9, [0.2, 0.2, 0.2, 1.0]);
diff --git a/crates/effects/src/noise3.rs b/crates/effects/src/noise3.rs
index 88a5c01d5..49f200553 100644
--- a/crates/effects/src/noise3.rs
+++ b/crates/effects/src/noise3.rs
@@ -17,7 +17,7 @@ use effectcraft_keyframe::Value;
 use effectcraft_project::ParamUi;
 use rayon::prelude::*;
 
-use crate::generate::{fade, lattice};
+use crate::generate::lattice;
 use crate::{Buf, EffectCtx, EffectSpec, ParamSpec, num, p, popup, slider};
 
 /// Fractal Type options (shared by both effects).
@@ -60,6 +60,11 @@ pub const BLEND_NORMAL: u32 = 1;
 /// Index of "Soft Linear" in [`NOISE_TYPES`] (the default, and the GPU path's interpolation).
 pub const NOISE_SOFT_LINEAR: u32 = 2;
 
+/// Lattice cell of Fractal / Turbulent Noise in pixels per percent of Scale: After Effects 2026
+/// draws Block noise at Scale 100 in 66.67 px cells (and Soft Linear noise has the matching
+/// correlation length), not 100 px.
+pub const NOISE_CELL: f64 = 2.0 / 3.0;
+
 fn spec(id: &'static str, name: &'static str, params: Vec<ParamSpec>, render: crate::RenderFn) -> EffectSpec {
     EffectSpec { id, name, category: "Noise & Grain", params, render, gpu: false, float: true }
 }
@@ -139,7 +144,7 @@ fn bspline(t: f32) -> [f32; 3] {
 }
 
 /// 3D value noise in about 0..1 with the given [`NOISE_TYPES`] interpolation in x and y (the
-/// evolution axis z always fades smoothly).
+/// evolution axis z always interpolates linearly, so evolution moves at a constant rate).
 ///
 /// Soft Linear is linear interpolation softened by a one-cell box filter, which is the quadratic
 /// B-spline: smooth like Spline from 9 lattice values instead of 16. A fade between two values
@@ -149,7 +154,7 @@ pub fn typed_noise(x: f32, y: f32, z: f32, seed: u32, noise_type: u32) -> f32 {
     // Soft Linear's taps are centred on the nearest lattice point, the others start at the cell's.
     let h = if noise_type == NOISE_SOFT_LINEAR { 0.5 } else { 0.0 };
     let (x0, y0, z0) = ((x + h).floor(), (y + h).floor(), z.floor());
-    let (tx, ty, fz) = (x + h - x0, y + h - y0, fade(z - z0));
+    let (tx, ty, fz) = (x + h - x0, y + h - y0, z - z0);
     let (ix, iy, iz) = (x0 as i32, y0 as i32, z0 as i32);
     let l = |a: f32, b: f32, t: f32| a + (b - a) * t;
     let slice = |dz: i32| -> f32 {
@@ -236,7 +241,7 @@ impl Fractal {
             overflow: pr.e("overflow"),
             invert: pr.b("invert"),
             rot: rot.sin_cos(),
-            size: [(sw * b.scale).max(1.0) as f32, (sh * b.scale).max(1.0) as f32],
+            size: [(sw * NOISE_CELL * b.scale).max(1.0) as f32, (sh * NOISE_CELL * b.scale).max(1.0) as f32],
             origin: [ox as f32, oy as f32],
             center: [cx as f32, cy as f32],
             perspective: pr.b("transform/perspectiveOffset"),
@@ -333,7 +338,7 @@ impl Fractal {
 }
 
 /// Fractal / Turbulent Noise resolved for the GPU kernel (effectcraft-gpu `fx_noise`): the
-/// per-pixel constants and, per octave, the terms [`Fractal::raw`] computes before touching the
+/// per-pixel constants and, per octave, the terms `Fractal::raw` computes before touching the
 /// pixel, in the same f32 order.
 pub struct FractalGpu {
     pub kind: u32,
@@ -406,15 +411,20 @@ pub fn fractal_gpu(ctx: &EffectCtx, offset: [f64; 2], scale: f64, turbulent: boo
         sub_rotation: fr.sub_rotation != 0.0,
         norm,
         octaves,
-        mode: match ctx.params.get("blendingMode").map(Value::as_enum).unwrap_or(BLEND_NONE) {
-            BLEND_NONE => None,
-            m => Some(BLEND_MODES.get(m as usize).and_then(|l| BlendMode::from_name(l)).unwrap_or(BlendMode::Normal)),
-        },
+        mode: blend_mode(ctx.params.get("blendingMode").map(Value::as_enum).unwrap_or(BLEND_NONE)),
         opacity: (ctx.params.f("opacity") as f32 / 100.0).clamp(0.0, 1.0),
         blend: ctx.params.f("blend") as f32 / 100.0,
     }
 }
 
+/// Resolve a Blending Mode index: None → `None`, unknown → Normal.
+fn blend_mode(m: u32) -> Option<BlendMode> {
+    match m {
+        BLEND_NONE => None,
+        m => Some(BLEND_MODES.get(m as usize).and_then(|l| BlendMode::from_name(l)).unwrap_or(BlendMode::Normal)),
+    }
+}
+
 /// Map a value by an [`OVERFLOWS`] option.
 pub fn overflow(v: f32, mode: u32) -> f32 {
     match mode {
@@ -431,14 +441,11 @@ pub fn overflow(v: f32, mode: u32) -> f32 {
 /// Composite grey noise `val` over the original pixel by Blending Mode, Opacity and (ours) Blend
 /// With Original. The noise stays inside the layer's alpha, so a masked solid shows it only within
 /// its masks (#939).
-pub(crate) fn composite(orig: [f32; 4], val: f32, opacity: f32, mode: u32, blend_orig: f32) -> [f32; 4] {
+pub(crate) fn composite(orig: [f32; 4], val: f32, opacity: f32, mode: Option<BlendMode>, blend_orig: f32) -> [f32; 4] {
     let src = [val * opacity, val * opacity, val * opacity, opacity];
     let out = match mode {
-        BLEND_NONE => src,
-        m => {
-            let bm = BLEND_MODES.get(m as usize).and_then(|l| BlendMode::from_name(l)).unwrap_or(BlendMode::Normal);
-            blend_pixel(bm, orig, src, 0.5)
-        }
+        None => src,
+        Some(bm) => blend_pixel(bm, orig, src, 0.5),
     };
     let k = 1.0 - blend_orig;
     [0, 1, 2, 3].map(|c| orig[c] * blend_orig + out[c] * orig[3] * k)
@@ -447,7 +454,7 @@ pub(crate) fn composite(orig: [f32; 4], val: f32, opacity: f32, mode: u32, blend
 fn render(ctx: &EffectCtx, mut b: Buf, turbulent: bool) -> Buf {
     let fr = Fractal::from_params(ctx, &b, turbulent);
     let opacity = (ctx.params.f("opacity") as f32 / 100.0).clamp(0.0, 1.0);
-    let mode = ctx.params.get("blendingMode").map(Value::as_enum).unwrap_or(BLEND_NONE);
+    let mode = blend_mode(ctx.params.get("blendingMode").map(Value::as_enum).unwrap_or(BLEND_NONE));
     let blend = ctx.params.f("blend") as f32 / 100.0;
     b.img.rows_mut().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
@@ -476,6 +483,20 @@ mod tests {
         run_fx(id, vals, Image::filled(40, 24, [0.2, 0.4, 0.6, 1.0]), 0.0, EffectEnv::default()).img
     }
 
+    /// Evolution moves the noise at a constant rate: no ease in or out within a revolution.
+    #[test]
+    fn evolution_is_linear() {
+        for noise_type in [0, 1, 2, 3] {
+            let a = typed_noise(0.3, 0.7, 0.0, 5, noise_type);
+            let b = typed_noise(0.3, 0.7, 1.0, 5, noise_type);
+            for z in [0.25, 0.5, 0.75] {
+                let want = a + (b - a) * z;
+                let got = typed_noise(0.3, 0.7, z, 5, noise_type);
+                assert!((got - want).abs() < 1e-4, "type {noise_type} z {z}: {got} vs {want}");
+            }
+        }
+    }
+
     /// A Fractal Noise saved before the twirl-downs existed: flat ids move into their groups and
     /// the new controls take values that keep the old look.
     #[test]
@@ -519,14 +540,34 @@ mod tests {
 
     #[test]
     fn noise_types_differ_and_block_is_piecewise_constant() {
-        let a = run("ec.noise.fractal", &[("noiseType", Value::Enum(0)), ("complexity", num(1.0)), ("transform/scale", num(10.0))]);
-        // Block noise: neighbours inside one 10 px cell share a value.
+        let a = run("ec.noise.fractal", &[("noiseType", Value::Enum(0)), ("complexity", num(1.0)), ("transform/scale", num(15.0))]);
+        // Block noise: neighbours inside one 10 px cell (Scale 15) share a value.
         assert_eq!(a.get(4, 4), a.get(5, 5));
         let others: Vec<Image> = (1..4).map(|t| run("ec.noise.fractal", &[("noiseType", Value::Enum(t)), ("transform/scale", num(10.0))])).collect();
         assert_ne!(others[0], others[1]);
         assert_ne!(others[1], others[2]);
     }
 
+    /// After Effects 2026 (R9): Block noise at Scale 100, Complexity 1 changes value every
+    /// 66.67 px along a row.
+    #[test]
+    fn block_noise_cells_are_two_thirds_of_scale_as_in_after_effects() {
+        let img = run_fx(
+            "ec.noise.fractal",
+            &[("noiseType", Value::Enum(0)), ("complexity", num(1.0)), ("blendingMode", Value::Enum(BLEND_NONE))],
+            Image::filled(400, 8, [0.0, 0.0, 0.0, 1.0]),
+            0.0,
+            EffectEnv::default(),
+        )
+        .img;
+        let changes: Vec<i64> = (1..400).filter(|&x| img.get(x, 4) != img.get(x - 1, 4)).collect();
+        assert!(changes.len() >= 4, "{changes:?}");
+        for w in changes.windows(2) {
+            let d = (w[1] - w[0]) as f64;
+            assert!((d - 200.0 / 3.0).abs() <= 1.0, "cell width {d}: {changes:?}");
+        }
+    }
+
     #[test]
     fn scale_width_height_apply_without_uniform_scaling() {
         let base = &[("complexity", num(1.0)), ("transform/scale", num(8.0))];
@@ -665,4 +706,34 @@ mod tests {
         }
         assert!(axis / diag < 1.15, "gradient along the axes / along the diagonals: {}", axis / diag);
     }
+
+    /// The base composite, resolving the Blending Mode by name on every call, kept only to prove
+    /// the hoisted lookup changes nothing.
+    fn old_composite(orig: [f32; 4], val: f32, opacity: f32, mode: u32, blend_orig: f32) -> [f32; 4] {
+        let src = [val * opacity, val * opacity, val * opacity, opacity];
+        let out = match mode {
+            BLEND_NONE => src,
+            m => {
+                let bm = BLEND_MODES.get(m as usize).and_then(|l| BlendMode::from_name(l)).unwrap_or(BlendMode::Normal);
+                blend_pixel(bm, orig, src, 0.5)
+            }
+        };
+        let k = 1.0 - blend_orig;
+        [0, 1, 2, 3].map(|c| orig[c] * blend_orig + out[c] * orig[3] * k)
+    }
+
+    #[test]
+    fn resolved_blend_matches_per_pixel_lookup() {
+        for m in (0..BLEND_MODES.len() as u32).chain([24, 999]) {
+            for orig in [[0.2, 0.4, 0.6, 1.0], [0.9, 0.1, 0.5, 0.5], [0.0, 0.0, 0.0, 0.0]] {
+                for val in [0.0, 0.3, 0.75, 1.0] {
+                    for (op, bl) in [(1.0, 0.0), (0.6, 0.25)] {
+                        assert_eq!(composite(orig, val, op, blend_mode(m), bl), old_composite(orig, val, op, m, bl), "mode {m}");
+                    }
+                }
+            }
+        }
+        assert_eq!(blend_mode(BLEND_NONE), None);
+        assert_eq!(blend_mode(999), Some(BlendMode::Normal));
+    }
 }
diff --git a/crates/effects/src/object_matte.rs b/crates/effects/src/object_matte.rs
index 32a196af2..8a9750282 100644
--- a/crates/effects/src/object_matte.rs
+++ b/crates/effects/src/object_matte.rs
@@ -144,7 +144,7 @@ pub fn prompt_strokes(params: &Params, layer_size: [f64; 2], frame: i64, with_mo
     if !inside(pt) {
         return None;
     }
-    let mut out = vec![Stroke { kind: StrokeKind::Fg, frame, radius: POINT_RADIUS, points: vec![pt] }];
+    let mut out = vec![Stroke { kind: StrokeKind::Fg, frame, radius: POINT_RADIUS, points: vec![pt], object: 0 }];
     let rect = |x0: f64, y0: f64, x1: f64, y1: f64| vec![[x0, y0], [x1, y0], [x1, y1], [x0, y1], [x0, y0]];
     let boxed = b(params, "useBox").then(|| Some((v2(params, "boxTopLeft")?, v2(params, "boxBottomRight")?))).flatten();
     match boxed {
@@ -158,9 +158,9 @@ pub fn prompt_strokes(params: &Params, layer_size: [f64; 2], frame: i64, with_mo
             }
             out.push(if with_model {
                 // The model takes the box itself as its box prompt.
-                Stroke { kind: StrokeKind::Box, frame, radius: 0.0, points: vec![[x0, y0], [x1, y1]] }
+                Stroke { kind: StrokeKind::Box, frame, radius: 0.0, points: vec![[x0, y0], [x1, y1]], object: 0 }
             } else {
-                Stroke { kind: StrokeKind::Bg, frame, radius: EDGE_RADIUS, points: rect(x0, y0, x1, y1) }
+                Stroke { kind: StrokeKind::Bg, frame, radius: EDGE_RADIUS, points: rect(x0, y0, x1, y1), object: 0 }
             });
         }
         None if !with_model => {
@@ -168,7 +168,7 @@ pub fn prompt_strokes(params: &Params, layer_size: [f64; 2], frame: i64, with_mo
             if w <= 4.0 * i || h <= 4.0 * i {
                 return None;
             }
-            out.push(Stroke { kind: StrokeKind::Bg, frame, radius: EDGE_RADIUS, points: rect(i, i, w - i, h - i) });
+            out.push(Stroke { kind: StrokeKind::Bg, frame, radius: EDGE_RADIUS, points: rect(i, i, w - i, h - i), object: 0 });
         }
         None => {}
     }
@@ -191,6 +191,11 @@ pub fn roto_data(params: &Params, layer_size: [f64; 2], f: i64, with_model: bool
 /// Seed of the chain keys: what the frames are (the Input Key), the layer size, the frame rate,
 /// the mode and the model. The prompt is in each frame's key.
 pub fn seed(params: &Params, layer_size: [f64; 2], fps: f64, model: Option<&dyn MaskModel>) -> u64 {
+    seed_of(params, layer_size, fps, model.map_or(effectcraft_segment::CLASSICAL, |m| m.info().id))
+}
+
+/// [`seed`] for the model with id `model` ([`effectcraft_segment::CLASSICAL`]: no model).
+fn seed_of(params: &Params, layer_size: [f64; 2], fps: f64, model: &str) -> u64 {
     let mut h = 0xcbf2_9ce4_8422_2325;
     fnv(&mut h, ID.as_bytes());
     fnv(&mut h, s(params, INPUT_KEY).as_bytes());
@@ -198,7 +203,7 @@ pub fn seed(params: &Params, layer_size: [f64; 2], fps: f64, model: Option<&dyn
         fnv(&mut h, &v.to_bits().to_le_bytes());
     }
     fnv(&mut h, &[tracks(params) as u8]);
-    fnv(&mut h, model.map_or(effectcraft_segment::CLASSICAL, |m| m.info().id).as_bytes());
+    fnv(&mut h, model.as_bytes());
     h
 }
 
@@ -222,7 +227,7 @@ pub fn job_frames(params: &Params, limits: [i64; 2]) -> Vec<i64> {
 pub fn chain(params: &Params, layer_size: [f64; 2], fps: f64, f: i64, scale: f64, model: Option<Arc<dyn MaskModel>>) -> Option<Chain> {
     let data = roto_data(params, layer_size, f, model.is_some())?;
     let keys = data.chain_keys(seed(params, layer_size, fps, model.as_deref()));
-    Some(Chain { data: Arc::new(data), keys, opts: seg_opts(scale), refine_radius: 0.0, model })
+    Some(Chain { data: Arc::new(data), keys, opts: seg_opts(scale), refine_radius: 0.0, model, saved: None, show_object: 0 })
 }
 
 /// Frame `f`'s segmentation at full resolution, computing what is missing (the background
@@ -255,9 +260,14 @@ pub fn frame_keys(params: &Params, layer_size: [f64; 2], fps: f64, frames: &[i64
 /// What frozen mattes depend on: what the frames are (the seed: Input Key, size, rate, mode,
 /// model), the prompt, the tracked span and the matte settings.
 pub fn frozen_key(params: &Params, layer_size: [f64; 2], fps: f64, model: Option<&dyn MaskModel>) -> String {
-    let mut h = seed(params, layer_size, fps, model);
+    frozen_key_of(params, layer_size, fps, model.map_or(effectcraft_segment::CLASSICAL, |m| m.info().id))
+}
+
+/// [`frozen_key`] for the model with id `model` ([`effectcraft_segment::CLASSICAL`]: no model).
+fn frozen_key_of(params: &Params, layer_size: [f64; 2], fps: f64, model: &str) -> String {
+    let mut h = seed_of(params, layer_size, fps, model);
     let base = reference_frame(params);
-    if let Some(st) = prompt_strokes(params, layer_size, base, model.is_some()) {
+    if let Some(st) = prompt_strokes(params, layer_size, base, model != effectcraft_segment::CLASSICAL) {
         fnv(&mut h, serde_json::to_string(&st).unwrap_or_default().as_bytes());
     }
     for v in [base, reach(params)[0], reach(params)[1]] {
@@ -273,7 +283,9 @@ pub fn is_frozen(params: &Params) -> bool {
 }
 
 /// Frame `f`'s frozen matte on a `w`×`h` grid, when the instance is frozen, the mattes still
-/// match ([`frozen_key`]) and `f` is one of them.
+/// match ([`frozen_key`]) and `f` is one of them. The mattes match under the session's `model`
+/// or under the model that froze them (which this session may not have loaded, e.g. a fresh
+/// headless render): frozen mattes need no segmentation.
 pub fn frozen_alpha(params: &Params, layer_size: [f64; 2], fps: f64, f: i64, w: usize, h: usize, model: Option<&dyn MaskModel>) -> Option<Vec<f32>> {
     let j = s(params, FROZEN);
     if j.is_empty() {
@@ -281,12 +293,19 @@ pub fn frozen_alpha(params: &Params, layer_size: [f64; 2], fps: f64, f: i64, w:
     }
     let fc = frozen_cache(j)?;
     if fc.key != frozen_key(params, layer_size, fps, model) {
-        return None;
+        let ids = std::iter::once(effectcraft_segment::CLASSICAL).chain(effectcraft_segment::MODELS.iter().map(|m| m.id));
+        if !ids.into_iter().any(|id| fc.key == frozen_key_of(params, layer_size, fps, id)) {
+            return None;
+        }
     }
     let fr = fc.frames.get(&f)?;
-    let a = rle::decode(&fr.a)?;
     let [fw, fh] = fc.size;
-    if fw == 0 || fh == 0 || a.len() != fw.checked_mul(fh)? {
+    let expected = fw.checked_mul(fh)?;
+    if fw == 0 || fh == 0 || expected > rle::MAX_PLANE_BYTES {
+        return None;
+    }
+    let a = rle::decode_bounded(&fr.a, expected)?;
+    if a.len() != expected {
         return None;
     }
     let af: Vec<f32> = a.iter().map(|v| *v as f32 / 255.0).collect();
@@ -354,20 +373,24 @@ pub enum FrameMatte {
     Outside,
 }
 
-/// The matte of layer frame `f` on the layer grid of `img` (the effect's input on that frame at
-/// `scale`), computing what is missing. `frame(g)`: the input on frame g on the same grid.
-#[allow(clippy::too_many_arguments)]
+/// The layer grid and timing used to compute one object matte.
+pub struct MatteFrame<'a> {
+    pub layer_size: [f64; 2],
+    pub fps: f64,
+    pub frame: i64,
+    pub scale: f64,
+    pub img: &'a Image,
+}
+
+/// Compute the object's alpha for one layer frame, loading other frames on the same grid as needed.
 pub fn frame_matte(
     params: &Params,
-    layer_size: [f64; 2],
-    fps: f64,
-    f: i64,
-    scale: f64,
-    img: &Image,
+    input: &MatteFrame<'_>,
     model: Option<Arc<dyn MaskModel>>,
     frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>,
     cancel: &dyn Fn() -> bool,
 ) -> FrameMatte {
+    let MatteFrame { layer_size, fps, frame: f, scale, img } = *input;
     let Some(chain) = chain(params, layer_size, fps, f, scale, model) else { return FrameMatte::NoPrompt };
     if !chain.data.in_span(f) {
         return FrameMatte::Outside;
@@ -404,7 +427,7 @@ fn render(ctx: &EffectCtx, buf: Buf) -> Buf {
     if let Some(a) = frozen_alpha(ctx.params, layer_size, fps, f, w, h, model.as_deref()) {
         return compose(&buf, Some(&a), w, h, b(ctx.params, "invert"), param(ctx.params, "view").map(Value::as_enum).unwrap_or(0) == 1);
     }
-    let alpha = match frame_matte(ctx.params, layer_size, fps, f, sc, &img, model, &mut frame, &|| false) {
+    let alpha = match frame_matte(ctx.params, &MatteFrame { layer_size, fps, frame: f, scale: sc, img: &img }, model, &mut frame, &|| false) {
         FrameMatte::Alpha(a) if a.len() == w * h => Some(a),
         FrameMatte::NoPrompt => return buf,
         _ => None,
@@ -604,7 +627,11 @@ mod tests {
         assert_ne!(seed(&p, [100.0, 80.0], 25.0, Some(stub.as_ref())), seed(&p, [100.0, 80.0], 25.0, None));
         let img = frame_at(0);
         let mut frame = |g: i64| Some(Arc::new(frame_at(g)));
-        let FrameMatte::Alpha(a) = frame_matte(&p, [100.0, 80.0], 25.0, 0, 1.0, &img, Some(stub.clone()), &mut frame, &|| false) else { panic!("no matte") };
+        let FrameMatte::Alpha(a) =
+            frame_matte(&p, &MatteFrame { layer_size: [100.0, 80.0], fps: 25.0, frame: 0, scale: 1.0, img: &img }, Some(stub.clone()), &mut frame, &|| false)
+        else {
+            panic!("no matte")
+        };
         assert!(a[40 * 100 + 40] > 0.5 && a[5 * 100 + 5] < 0.5);
         assert_eq!(stub.calls.load(std::sync::atomic::Ordering::Relaxed), 1);
         assert_eq!(*stub.bbox.lock().unwrap(), None);
@@ -630,7 +657,11 @@ mod tests {
         let stub = Arc::new(Stub::default());
         let img = frame_at(0);
         let mut frame = |g: i64| Some(Arc::new(frame_at(g)));
-        let FrameMatte::Alpha(a) = frame_matte(&p, [100.0, 80.0], 25.0, 0, 1.0, &img, Some(stub.clone()), &mut frame, &|| false) else { panic!("no matte") };
+        let FrameMatte::Alpha(a) =
+            frame_matte(&p, &MatteFrame { layer_size: [100.0, 80.0], fps: 25.0, frame: 0, scale: 1.0, img: &img }, Some(stub.clone()), &mut frame, &|| false)
+        else {
+            panic!("no matte")
+        };
         assert_eq!(*stub.bbox.lock().unwrap(), Some([74.0, 54.0, 100.0, 80.0]));
         assert!(a[70 * 100 + 90] > 0.5 && a[40 * 100 + 40] < 0.5);
         // At half resolution the box is scaled with the frame (another Input Key, so the
@@ -639,7 +670,8 @@ mod tests {
         p.values.insert(INPUT_KEY.into(), Value::Str("half".into()));
         let half = effectcraft_raster::resample(&img, 50, 40);
         let mut frame = |g: i64| Some(Arc::new(effectcraft_raster::resample(&frame_at(g), 50, 40)));
-        let _ = frame_matte(&p, [100.0, 80.0], 25.0, 0, 0.5, &half, Some(stub.clone()), &mut frame, &|| false);
+        let _ =
+            frame_matte(&p, &MatteFrame { layer_size: [100.0, 80.0], fps: 25.0, frame: 0, scale: 0.5, img: &half }, Some(stub.clone()), &mut frame, &|| false);
         assert_eq!(*stub.bbox.lock().unwrap(), Some([37.0, 27.0, 50.0, 40.0]));
     }
 
@@ -688,4 +720,28 @@ mod tests {
         p.values.insert(FROZEN.into(), Value::Str(fc2.to_json()));
         assert_eq!(frozen_alpha(&p, [100.0, 80.0], 25.0, 2, 100, 80, None), None);
     }
+
+    /// Mattes frozen with a model stay usable in a session where that model is not loaded (a
+    /// fresh headless render): they are used as stored, not re-segmented with another model.
+    #[test]
+    fn frozen_mattes_survive_a_session_without_their_model() {
+        let mut p = params(&[
+            ("objectPoint", Value::Vec2([40.0, 40.0])),
+            ("useBox", Value::Bool(true)),
+            ("boxTopLeft", Value::Vec2([10.0, 10.0])),
+            ("boxBottomRight", Value::Vec2([90.0, 70.0])),
+            ("objectTracking/framesAfter", Value::Scalar(3.0)),
+        ]);
+        p.values.insert(INPUT_KEY.into(), Value::Str("frozen-model-test".into()));
+        let stub = Stub::default();
+        let alpha: Vec<f32> = (0..100 * 80).map(|i| ((i % 100) < 50) as u8 as f32).collect();
+        let mut fc = FrozenCache { key: frozen_key(&p, [100.0, 80.0], 25.0, Some(&stub)), size: [100, 80], ..Default::default() };
+        fc.frames.insert(2, roto::freeze_frame(&alpha, &[]));
+        p.values.insert(FROZEN.into(), Value::Str(fc.to_json()));
+        assert!(is_frozen(&p));
+        assert!(frozen_alpha(&p, [100.0, 80.0], 25.0, 2, 100, 80, Some(&stub)).is_some());
+        assert_eq!(frozen_alpha(&p, [100.0, 80.0], 25.0, 2, 50, 40, None).map(|a| (a[20 * 50 + 5], a[20 * 50 + 45])), Some((1.0, 0.0)));
+        let out = run(&p, 2);
+        assert!(out.data[40 * 100 + 10][3] > 0.99 && out.data[40 * 100 + 90][3] < 0.01, "the frozen matte is used");
+    }
 }
diff --git a/crates/effects/src/obsolete.rs b/crates/effects/src/obsolete.rs
index c58f5ca6b..a2b161b39 100644
--- a/crates/effects/src/obsolete.rs
+++ b/crates/effects/src/obsolete.rs
@@ -99,7 +99,13 @@ fn gaussian_legacy(ctx: &EffectCtx, mut b: Buf) -> Buf {
     if !ctx.adjustment {
         b.pad((s * 3.0).ceil() as u32);
     }
-    b.img = gaussian_blur(&b.img, s * kx, s * ky, ctx.adjustment);
+    let (sx, sy) = (s * kx, s * ky);
+    // Small sigmas use the sampled kernel, like Gaussian Blur (#1939).
+    b.img = if effectcraft_raster::gaussian_is_exact(sx, sy) {
+        effectcraft_raster::gaussian_blur_exact(&b.img, sx, sy, ctx.adjustment)
+    } else {
+        gaussian_blur(&b.img, sx, sy, ctx.adjustment)
+    };
     b
 }
 
@@ -175,6 +181,16 @@ mod tests {
         assert!(out.img.get(c as i64, c as i64)[3] < 0.5);
     }
 
+    #[test]
+    fn gaussian_legacy_small_blurriness_blurs() {
+        // #1939: Blurriness under ~1.2 used to be a no-op.
+        let mut img = Image::new(15, 15);
+        img.set(7, 7, [1.0, 1.0, 1.0, 1.0]);
+        let out = run_fx("ec.obsolete.gaussianlegacy", &[("blurriness", num(0.9))], img, 0.0, EffectEnv::default());
+        let c = out.img.width / 2;
+        assert!(out.img.get(c as i64, c as i64)[3] < 0.9);
+    }
+
     #[test]
     fn moved_effects_are_obsolete() {
         for id in ["ec.key.luma", "ec.key.spill", "ec.blur.reduceflicker"] {
diff --git a/crates/effects/src/ocio.rs b/crates/effects/src/ocio.rs
index 74816b110..2daa9857d 100644
--- a/crates/effects/src/ocio.rs
+++ b/crates/effects/src/ocio.rs
@@ -37,1802 +37,31 @@ use crate::util::unpremul;
 use crate::utility::{Lut, parse_cube};
 use crate::{Buf, EffectCtx, EffectSpec, num, p, popup, slider};
 
-type M3 = [[f64; 3]; 3];
+mod cdl;
+mod effects;
+mod lut;
+mod program;
+mod registry;
+mod space;
 
-pub(crate) const D65: [f64; 2] = [0.3127, 0.3290];
-const ACES_WHITE: [f64; 2] = [0.32168, 0.33767];
-const AP0: [[f64; 2]; 3] = [[0.7347, 0.2653], [0.0, 1.0], [0.0001, -0.0770]];
-const AP1: [[f64; 2]; 3] = [[0.713, 0.293], [0.165, 0.830], [0.128, 0.044]];
-pub(crate) const REC709: [[f64; 2]; 3] = [[0.640, 0.330], [0.300, 0.600], [0.150, 0.060]];
-pub(crate) const REC2020: [[f64; 2]; 3] = [[0.708, 0.292], [0.170, 0.797], [0.131, 0.046]];
-pub(crate) const P3: [[f64; 2]; 3] = [[0.680, 0.320], [0.265, 0.690], [0.150, 0.060]];
-const IDENTITY: M3 = [[1.0, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]];
-
-/// Transfer functions (encoded ↔ linear).
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Tf {
-    Linear,
-    Srgb,
-    Gamma(f64),
-    AcesCct,
-    /// ACEScc (Academy S-2014-003), the pure-log grading encoding.
-    AcesCc,
-    /// SMPTE ST 2084 with 1.0 = 100 cd/m².
-    Pq,
-}
-
-/// ACEScc: the lowest code value (linear 0 and below) and the end of its toe (linear 2⁻¹⁵).
-const ACESCC_MIN: f64 = (-16.0 + 9.72) / 17.52;
-const ACESCC_TOE: f64 = (-15.0 + 9.72) / 17.52;
-
-impl Tf {
-    pub fn decode(self, v: f64) -> f64 {
-        match self {
-            Tf::Linear => v,
-            Tf::Srgb => {
-                let a = v.abs();
-                let l = if a <= 0.04045 { a / 12.92 } else { ((a + 0.055) / 1.055).powf(2.4) };
-                l.copysign(v)
-            }
-            Tf::Gamma(g) => v.abs().powf(g).copysign(v),
-            Tf::AcesCct => {
-                if v <= 0.155_251_141_552_511 {
-                    (v - 0.072_905_534_195_835_5) / 10.540_237_741_654_5
-                } else if v < (65504f64.log2() + 9.72) / 17.52 {
-                    2f64.powf(v * 17.52 - 9.72)
-                } else {
-                    65504.0
-                }
-            }
-            Tf::AcesCc => {
-                if v < ACESCC_TOE {
-                    (2f64.powf(v * 17.52 - 9.72) - 2f64.powi(-16)) * 2.0
-                } else if v < (65504f64.log2() + 9.72) / 17.52 {
-                    2f64.powf(v * 17.52 - 9.72)
-                } else {
-                    65504.0
-                }
-            }
-            Tf::Pq => {
-                let (m1, m2, c1, c2, c3) = pq_consts();
-                let e = v.max(0.0).powf(1.0 / m2);
-                let l = ((e - c1).max(0.0) / (c2 - c3 * e)).powf(1.0 / m1);
-                l * 100.0
-            }
-        }
-    }
-    pub fn encode(self, v: f64) -> f64 {
-        match self {
-            Tf::Linear => v,
-            Tf::Srgb => {
-                let a = v.abs();
-                let e = if a <= 0.003_130_8 { a * 12.92 } else { 1.055 * a.powf(1.0 / 2.4) - 0.055 };
-                e.copysign(v)
-            }
-            Tf::Gamma(g) => v.abs().powf(1.0 / g).copysign(v),
-            Tf::AcesCct => {
-                if v <= 0.007_812_5 {
-                    10.540_237_741_654_5 * v + 0.072_905_534_195_835_5
-                } else {
-                    (v.log2() + 9.72) / 17.52
-                }
-            }
-            Tf::AcesCc => {
-                if v <= 0.0 {
-                    ACESCC_MIN
-                } else if v < 2f64.powi(-15) {
-                    ((2f64.powi(-16) + v * 0.5).log2() + 9.72) / 17.52
-                } else {
-                    (v.log2() + 9.72) / 17.52
-                }
-            }
-            Tf::Pq => {
-                let (m1, m2, c1, c2, c3) = pq_consts();
-                let y = (v / 100.0).max(0.0).powf(m1);
-                ((c1 + c2 * y) / (1.0 + c3 * y)).powf(m2)
-            }
-        }
-    }
-}
-
-fn pq_consts() -> (f64, f64, f64, f64, f64) {
-    (2610.0 / 16384.0, 2523.0 / 4096.0 * 128.0, 3424.0 / 4096.0, 2413.0 / 4096.0 * 32.0, 2392.0 / 4096.0 * 32.0)
-}
-
-/// A colour space of the built-in config.
-#[derive(Clone, Copy, Debug)]
-pub struct Space {
-    pub name: &'static str,
-    /// Primaries and white (None = CIE XYZ itself).
-    pub prims: Option<([[f64; 2]; 3], [f64; 2])>,
-    pub tf: Tf,
-    /// Passes data through untouched.
-    pub raw: bool,
-}
-
-pub(crate) const fn sp(name: &'static str, prims: [[f64; 2]; 3], white: [f64; 2], tf: Tf) -> Space {
-    Space { name, prims: Some((prims, white)), tf, raw: false }
-}
-
-/// The built-in configuration's colour spaces, in popup order.
-pub(crate) const ACES2065_1: Space = sp("ACES2065-1", AP0, ACES_WHITE, Tf::Linear);
-pub(crate) const ACES_CG: Space = sp("ACEScg", AP1, ACES_WHITE, Tf::Linear);
-const ACES_CCT: Space = sp("ACEScct", AP1, ACES_WHITE, Tf::AcesCct);
-
-pub const SPACES: &[Space] = &[
-    ACES2065_1,
-    ACES_CG,
-    ACES_CCT,
-    sp("Linear Rec.709 (sRGB)", REC709, D65, Tf::Linear),
-    sp("sRGB", REC709, D65, Tf::Srgb),
-    sp("Gamma 2.4 Rec.709", REC709, D65, Tf::Gamma(2.4)),
-    sp("Linear Rec.2020", REC2020, D65, Tf::Linear),
-    sp("Gamma 2.4 Rec.2020", REC2020, D65, Tf::Gamma(2.4)),
-    sp("Linear P3-D65", P3, D65, Tf::Linear),
-    sp("Display P3", P3, D65, Tf::Srgb),
-    Space { name: "CIE-XYZ-D65", prims: None, tf: Tf::Linear, raw: false },
-    Space { name: "Raw", prims: None, tf: Tf::Linear, raw: true },
-];
-
-pub fn space_names() -> Vec<&'static str> {
-    SPACES.iter().map(|s| s.name).collect()
-}
+pub use cdl::Cdl;
+pub(crate) use effects::CUSTOM_CONFIG_FX;
+#[cfg(test)]
+pub use effects::parse_looks;
+pub use effects::{color_stabilizer_maps, warning};
+#[cfg(test)]
+use effects::{tonemap, tonemap_inv};
+pub use lut::{FileXform, load_file};
+#[cfg(test)]
+pub use lut::{parse_file, parse_spi1d, parse_spi3d, parse_spimtx};
+pub use program::{ColorOp, Straight, color_program};
+pub use registry::specs;
+#[cfg(test)]
+use space::M3;
+pub(crate) use space::{ACES_CG, ACES2065_1, D65, P3, REC709, REC2020, sp};
+#[cfg(test)]
+pub use space::{SPACES, Xform, bradford, space_by_name};
+pub use space::{Space, Tf, matrix};
 
 #[cfg(test)]
-pub fn space_by_name(n: &str) -> Option<&'static Space> {
-    SPACES.iter().find(|s| s.name.eq_ignore_ascii_case(n))
-}
-
-/// Bradford chromatic adaptation from white `src` to white `dst` (xy).
-pub fn bradford(src: [f64; 2], dst: [f64; 2]) -> M3 {
-    if src == dst {
-        return IDENTITY;
-    }
-    const MB: M3 = [[0.8951, 0.2664, -0.1614], [-0.7502, 1.7135, 0.0367], [0.0389, -0.0685, 1.0296]];
-    let xyz = |c: [f64; 2]| [c[0] / c[1], 1.0, (1.0 - c[0] - c[1]) / c[1]];
-    let s = mul_vec(&MB, xyz(src));
-    let d = mul_vec(&MB, xyz(dst));
-    let diag = [[d[0] / s[0], 0.0, 0.0], [0.0, d[1] / s[1], 0.0], [0.0, 0.0, d[2] / s[2]]];
-    mul(&invert(&MB), &mul(&diag, &MB))
-}
-
-impl Space {
-    /// Linear RGB → XYZ D65 (Bradford-adapted when `adapt`, else the space's own white).
-    pub fn to_ref(self, adapt: bool) -> M3 {
-        match self.prims {
-            None => IDENTITY,
-            Some((p, w)) => {
-                let m = rgb_to_xyz(p, w);
-                if adapt { mul(&bradford(w, D65), &m) } else { m }
-            }
-        }
-    }
-}
-
-/// Linear-RGB matrix from space `a` to space `b`.
-pub fn matrix(a: &Space, b: &Space) -> M3 {
-    mul(&invert(&b.to_ref(true)), &a.to_ref(true))
-}
-
-/// A compiled colour-space conversion.
-#[derive(Clone, Copy, Debug)]
-pub struct Xform {
-    dec: Tf,
-    m: [[f32; 3]; 3],
-    ident: bool,
-    enc: Tf,
-}
-
-impl Xform {
-    pub fn new(a: &Space, b: &Space) -> Xform {
-        if a.raw || b.raw {
-            return Xform { dec: Tf::Linear, m: IDENTITY.map(|r| r.map(|v| v as f32)), ident: true, enc: Tf::Linear };
-        }
-        let m = matrix(a, b);
-        let ident = (0..3).all(|i| (0..3).all(|j| (m[i][j] - IDENTITY[i][j]).abs() < 1e-12));
-        Xform { dec: a.tf, m: m.map(|r| r.map(|v| v as f32)), ident, enc: b.tf }
-    }
-    #[inline]
-    pub fn apply(&self, c: [f32; 3]) -> [f32; 3] {
-        let l = c.map(|v| self.dec.decode(v as f64) as f32);
-        let l = if self.ident { l } else { [0, 1, 2].map(|i| self.m[i][0] * l[0] + self.m[i][1] * l[1] + self.m[i][2] * l[2]) };
-        l.map(|v| self.enc.encode(v as f64) as f32)
-    }
-}
-
-// ---------------------------------------------------------------- ASC CDL
-
-/// An ASC Colour Decision List correction.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Cdl {
-    pub slope: [f64; 3],
-    pub offset: [f64; 3],
-    pub power: [f64; 3],
-    pub sat: f64,
-}
-
-impl Default for Cdl {
-    fn default() -> Self {
-        Cdl { slope: [1.0; 3], offset: [0.0; 3], power: [1.0; 3], sat: 1.0 }
-    }
-}
-
-const LUMA: [f64; 3] = [0.2126, 0.7152, 0.0722];
-
-impl Cdl {
-    /// Forward CDL. `clamp` = the v1.2 style (results clamped to 0..1 after SOP and saturation).
-    pub fn apply(&self, c: [f64; 3], clamp: bool) -> [f64; 3] {
-        let mut o = [0.0; 3];
-        for i in 0..3 {
-            let v = c[i] * self.slope[i] + self.offset[i];
-            o[i] = if clamp {
-                v.clamp(0.0, 1.0).powf(self.power[i])
-            } else if v >= 0.0 {
-                v.powf(self.power[i])
-            } else {
-                v
-            };
-        }
-        let l = o[0] * LUMA[0] + o[1] * LUMA[1] + o[2] * LUMA[2];
-        let o = o.map(|v| l + self.sat * (v - l));
-        if clamp { o.map(|v| v.clamp(0.0, 1.0)) } else { o }
-    }
-    /// Exact inverse of [`Cdl::apply`] (inside the clamped range).
-    pub fn invert(&self, c: [f64; 3], clamp: bool) -> [f64; 3] {
-        let c = if clamp { c.map(|v| v.clamp(0.0, 1.0)) } else { c };
-        let l = c[0] * LUMA[0] + c[1] * LUMA[1] + c[2] * LUMA[2];
-        let s = if self.sat.abs() < 1e-9 { 1e-9 } else { self.sat };
-        let o = c.map(|v| l + (v - l) / s);
-        let mut r = [0.0; 3];
-        for i in 0..3 {
-            let v = if clamp { o[i].clamp(0.0, 1.0) } else { o[i] };
-            let pw = self.power[i].max(1e-9);
-            let u = if v >= 0.0 { v.powf(1.0 / pw) } else { v };
-            let sl = if self.slope[i].abs() < 1e-9 { 1e-9 } else { self.slope[i] };
-            r[i] = (u - self.offset[i]) / sl;
-        }
-        if clamp { r.map(|v| v.clamp(0.0, 1.0)) } else { r }
-    }
-}
-
-fn tag<'a>(xml: &'a str, name: &str) -> Option<&'a str> {
-    let open = xml.find(&format!("<{name}"))?;
-    let gt = open + xml[open..].find('>')?;
-    if xml[..gt].ends_with('/') {
-        return Some("");
-    }
-    let close = xml[gt..].find(&format!("</{name}>"))? + gt;
-    Some(&xml[gt + 1..close])
-}
-
-fn nums3(s: &str) -> Option<[f64; 3]> {
-    let v: Vec<f64> = s.split_whitespace().filter_map(|t| t.parse().ok()).collect();
-    (v.len() >= 3).then(|| [v[0], v[1], v[2]])
-}
-
-fn parse_cc(block: &str) -> Cdl {
-    let mut c = Cdl::default();
-    if let Some(s) = tag(block, "Slope").and_then(nums3) {
-        c.slope = s;
-    }
-    if let Some(s) = tag(block, "Offset").and_then(nums3) {
-        c.offset = s;
-    }
-    if let Some(s) = tag(block, "Power").and_then(nums3) {
-        c.power = s;
-    }
-    if let Some(s) = tag(block, "Saturation").and_then(|t| t.trim().parse().ok()) {
-        c.sat = s;
-    }
-    c
-}
-
-/// Parse ASC CDL XML (`.cc`, `.ccc`, `.cdl`): every `<ColorCorrection>` with its `id`.
-pub fn parse_cdl_xml(xml: &str) -> Vec<(String, Cdl)> {
-    let mut out = vec![];
-    let mut rest = xml;
-    while let Some(i) = rest.find("<ColorCorrection") {
-        let after = &rest[i..];
-        let head_end = after.find('>').unwrap_or(after.len());
-        let head = &after[..head_end];
-        let id = head
-            .find("id=")
-            .and_then(|k| {
-                let q = head[k + 3..].chars().next()?;
-                let s = &head[k + 4..];
-                s.find(q).map(|e| s[..e].to_string())
-            })
-            .unwrap_or_default();
-        let end = after.find("</ColorCorrection>").map(|e| e + "</ColorCorrection>".len()).unwrap_or(after.len());
-        out.push((id, parse_cc(&after[..end])));
-        rest = &after[end..];
-    }
-    out
-}
-
-// ---------------------------------------------------------------- LUT files
-
-/// A loaded transform file.
-#[derive(Clone, Debug)]
-pub enum FileXform {
-    /// A lattice/1D LUT with an optional per-channel piecewise-linear shaper (cineSpace pre-LUT).
-    Lut { lut: Lut, shaper: Option<[Vec<(f32, f32)>; 3]> },
-    /// CDL corrections by id (in file order).
-    Cdl(Vec<(String, Cdl)>),
-    /// A matrix with offset (Sony Imageworks `.spimtx`), as a MatrixTransform's.
-    Matrix { m: [f64; 16], offset: [f64; 4] },
-}
-
-/// Parse a Sony Imageworks `.spimtx` matrix: three rows of four numbers, three matrix columns
-/// and an offset in 16-bit code values (÷ 65535).
-pub fn parse_spimtx(text: &str) -> Option<FileXform> {
-    let v: Vec<f64> = text.split_whitespace().map(|t| t.parse().ok()).collect::<Option<_>>()?;
-    if v.len() != 12 || v.iter().any(|x| !x.is_finite()) {
-        return None;
-    }
-    let mut m = [0.0; 16];
-    let mut offset = [0.0; 4];
-    for (r, row) in v.as_chunks::<4>().0.iter().enumerate() {
-        m[r * 4..r * 4 + 3].copy_from_slice(&row[..3]);
-        offset[r] = row[3] / 65535.0;
-    }
-    m[15] = 1.0;
-    Some(FileXform::Matrix { m, offset })
-}
-
-/// Parse a Sony Imageworks `.spi1d` 1D LUT: `From <min> <max>`, `Length <n>`, `Components
-/// <1 | 3>`, then `{` the values `}`.
-pub fn parse_spi1d(text: &str) -> Option<Lut> {
-    let (mut from, mut len, mut comps) = ([0.0f32, 1.0], 0usize, 1usize);
-    let mut values: Vec<f32> = vec![];
-    let mut body = false;
-    for line in text.lines().map(str::trim).filter(|l| !l.is_empty()) {
-        if body {
-            if line.starts_with('}') {
-                break;
-            }
-            for t in line.split_whitespace() {
-                values.push(t.parse().ok()?);
-            }
-            continue;
-        }
-        let mut t = line.split_whitespace();
-        match t.next()? {
-            "{" => body = true,
-            "From" => from = [t.next()?.parse().ok()?, t.next()?.parse().ok()?],
-            "Length" => len = t.next()?.parse().ok()?,
-            "Components" => comps = t.next()?.parse().ok()?,
-            _ => {}
-        }
-    }
-    // A 1D table is interpolated by index, so cap it like the lattices (2²⁴ entries).
-    if !(2..=1 << 24).contains(&len)
-        || !matches!(comps, 1 | 3)
-        || values.len() != len.checked_mul(comps)?
-        || from[1] <= from[0]
-        || from.iter().any(|v| !v.is_finite())
-    {
-        return None;
-    }
-    let d1 = values.chunks_exact(comps).map(|c| if comps == 3 { [c[0], c[1], c[2]] } else { [c[0]; 3] }).collect();
-    Some(Lut { n1: len, d1, n3: 0, d3: vec![], dmin: [from[0]; 3], dmax: [from[1]; 3] })
-}
-
-/// Parse a Sony Imageworks `.spi3d` lattice: `SPILUT 1.0`, `3 3`, the sizes, then one
-/// `r g b  R G B` line per lattice point (indices, then the colour).
-pub fn parse_spi3d(text: &str) -> Option<Lut> {
-    let mut lines = text.lines().map(str::trim).filter(|l| !l.is_empty());
-    if !lines.next()?.starts_with("SPILUT") {
-        return None;
-    }
-    lines.next()?;
-    let size: Vec<usize> = lines.next()?.split_whitespace().map(|t| t.parse().ok()).collect::<Option<_>>()?;
-    let n = *size.first()?;
-    if size.len() != 3 || size.iter().any(|s| *s != n) || !(2..=129).contains(&n) {
-        return None;
-    }
-    let mut d3 = vec![[0.0f32; 3]; n * n * n];
-    let mut seen = 0usize;
-    for line in lines {
-        let v: Vec<&str> = line.split_whitespace().collect();
-        let [r, g, b, cr, cg, cb] = v.as_slice() else { return None };
-        let (r, g, b): (usize, usize, usize) = (r.parse().ok()?, g.parse().ok()?, b.parse().ok()?);
-        if r >= n || g >= n || b >= n {
-            return None;
-        }
-        // Our lattice is red fastest.
-        *d3.get_mut(r + g * n + b * n * n)? = [cr.parse().ok()?, cg.parse().ok()?, cb.parse().ok()?];
-        seen += 1;
-    }
-    (seen == n * n * n).then_some(Lut { n1: 0, d1: vec![], n3: n, d3, dmin: [0.0; 3], dmax: [1.0; 3] })
-}
-
-/// Parse an Autodesk `.3dl` lattice (integers, blue fastest; an optional input-mesh line).
-pub fn parse_3dl(text: &str) -> Option<Lut> {
-    let mut mesh: Option<Vec<f64>> = None;
-    let mut rows: Vec<[f64; 3]> = vec![];
-    let mut out_bits: Option<u32> = None;
-    for line in text.lines() {
-        let l = line.trim();
-        if l.is_empty() || l.starts_with('#') || l.starts_with('<') {
-            continue;
-        }
-        if l.starts_with(|c: char| c.is_ascii_alphabetic()) {
-            // "Mesh <in bits> <out bits>" (Lustre header); other keywords are ignored.
-            let t: Vec<&str> = l.split_whitespace().collect();
-            if t[0].eq_ignore_ascii_case("mesh") && t.len() >= 3 {
-                out_bits = t[2].parse().ok();
-            }
-            continue;
-        }
-        let v: Vec<f64> = l.split_whitespace().filter_map(|t| t.parse().ok()).collect();
-        if v.len() > 3 && mesh.is_none() && rows.is_empty() {
-            mesh = Some(v);
-        } else if v.len() == 3 {
-            rows.push([v[0], v[1], v[2]]);
-        } else {
-            return None;
-        }
-    }
-    let is_cube = |k: usize| {
-        let n = (k as f64).cbrt().round() as usize;
-        n * n * n == k
-    };
-    // A 3-entry input mesh (3³ lattice) looks like a data row: tell them apart by the count.
-    if mesh.is_none() && !is_cube(rows.len()) && rows.len() == 28 {
-        mesh = Some(rows.remove(0).to_vec());
-    }
-    let n = match &mesh {
-        Some(m) => m.len(),
-        None => (rows.len() as f64).cbrt().round() as usize,
-    };
-    if n < 2 || rows.len() != n * n * n {
-        return None;
-    }
-    let maxv = rows.iter().flat_map(|r| r.iter()).fold(0.0f64, |m, &v| m.max(v));
-    let out_max = match out_bits {
-        Some(b) if b > 0 && b < 32 => (1u64 << b) as f64 - 1.0,
-        _ => [255.0, 1023.0, 4095.0, 65535.0].into_iter().find(|&m| maxv <= m).unwrap_or(maxv.max(1.0)),
-    };
-    // .3dl rows: red slowest, blue fastest. Our lattice is red fastest.
-    let mut d3 = vec![[0.0f32; 3]; n * n * n];
-    for (k, r) in rows.iter().enumerate() {
-        let (ri, gi, bi) = (k / (n * n), (k / n) % n, k % n);
-        d3[ri + gi * n + bi * n * n] = r.map(|v| (v / out_max) as f32);
-    }
-    Some(Lut { n1: 0, d1: vec![], n3: n, d3, dmin: [0.0; 3], dmax: [1.0; 3] })
-}
-
-/// Parse a cineSpace `.csp` LUT (1D or 3D, with its three pre-LUT shapers).
-pub fn parse_csp(text: &str) -> Option<(Lut, [Vec<(f32, f32)>; 3])> {
-    let mut lines = text.lines().map(str::trim).filter(|l| !l.is_empty());
-    if !lines.next()?.starts_with("CSPLUTV100") {
-        return None;
-    }
-    let kind = lines.next()?;
-    let mut lines = lines.peekable();
-    if lines.peek().is_some_and(|l| l.starts_with("BEGIN METADATA")) {
-        for l in lines.by_ref() {
-            if l.starts_with("END METADATA") {
-                break;
-            }
-        }
-    }
-    let nums = |l: &str| -> Option<Vec<f32>> { l.split_whitespace().map(|t| t.parse().ok()).collect() };
-    let mut shaper: [Vec<(f32, f32)>; 3] = Default::default();
-    for ch in shaper.iter_mut() {
-        let n: usize = lines.next()?.parse().ok()?;
-        let ins = nums(lines.next()?)?;
-        let outs = nums(lines.next()?)?;
-        if ins.len() != n || outs.len() != n || n < 2 {
-            return None;
-        }
-        *ch = ins.into_iter().zip(outs).collect();
-    }
-    if kind.starts_with("3D") {
-        let sz = nums(lines.next()?)?;
-        if sz.len() != 3 || sz[0] != sz[1] || sz[1] != sz[2] {
-            return None;
-        }
-        let n = sz[0] as usize;
-        let mut d3 = Vec::with_capacity(n * n * n);
-        for _ in 0..n * n * n {
-            let v = nums(lines.next()?)?;
-            if v.len() != 3 {
-                return None;
-            }
-            d3.push([v[0], v[1], v[2]]);
-        }
-        (n >= 2).then_some((Lut { n1: 0, d1: vec![], n3: n, d3, dmin: [0.0; 3], dmax: [1.0; 3] }, shaper))
-    } else {
-        let n: usize = lines.next()?.parse().ok()?;
-        let mut d1 = Vec::with_capacity(n);
-        for _ in 0..n {
-            let v = nums(lines.next()?)?;
-            if v.len() != 3 {
-                return None;
-            }
-            d1.push([v[0], v[1], v[2]]);
-        }
-        (n >= 2).then_some((Lut { n1: n, d1, n3: 0, d3: vec![], dmin: [0.0; 3], dmax: [1.0; 3] }, shaper))
-    }
-}
-
-fn shape(curve: &[(f32, f32)], x: f32) -> f32 {
-    if curve.len() < 2 {
-        return x;
-    }
-    let i = curve.partition_point(|p| p.0 < x).clamp(1, curve.len() - 1);
-    let (a, b) = (curve[i - 1], curve[i]);
-    let t = ((x - a.0) / (b.0 - a.0).max(1e-12)).clamp(0.0, 1.0);
-    a.1 + (b.1 - a.1) * t
-}
-
-fn shape_inv(curve: &[(f32, f32)], y: f32) -> f32 {
-    let flipped: Vec<(f32, f32)> = curve.iter().map(|&(a, b)| (b, a)).collect();
-    shape(&flipped, y)
-}
-
-/// Parse transform text by its format (detected from `ext` or the content).
-pub fn parse_file(text: &str, ext: &str) -> Option<FileXform> {
-    let ext = ext.to_ascii_lowercase();
-    if ext == "cc" || ext == "ccc" || ext == "cdl" || text.contains("<ColorCorrection") {
-        let v = parse_cdl_xml(text);
-        return (!v.is_empty()).then_some(FileXform::Cdl(v));
-    }
-    if ext == "csp" || text.trim_start().starts_with("CSPLUTV100") {
-        return parse_csp(text).map(|(lut, s)| FileXform::Lut { lut, shaper: Some(s) });
-    }
-    if ext == "spimtx" {
-        return parse_spimtx(text);
-    }
-    if ext == "spi1d" || text.trim_start().starts_with("Version") {
-        return parse_spi1d(text).map(|lut| FileXform::Lut { lut, shaper: None });
-    }
-    if ext == "spi3d" || text.trim_start().starts_with("SPILUT") {
-        return parse_spi3d(text).map(|lut| FileXform::Lut { lut, shaper: None });
-    }
-    if ext == "cube" || text.contains("LUT_3D_SIZE") || text.contains("LUT_1D_SIZE") {
-        return parse_cube(text).map(|lut| FileXform::Lut { lut, shaper: None });
-    }
-    parse_3dl(text).map(|lut| FileXform::Lut { lut, shaper: None })
-}
-
-type FileCache = Mutex<HashMap<String, Option<Arc<FileXform>>>>;
-
-/// Load (and cache) a transform from a file path or inline content.
-pub fn load_file(src: &str) -> Option<Arc<FileXform>> {
-    let src_t = src.trim();
-    if src_t.is_empty() {
-        return None;
-    }
-    static CACHE: OnceLock<FileCache> = OnceLock::new();
-    let cache = CACHE.get_or_init(|| Mutex::new(HashMap::new()));
-    if let Ok(m) = cache.lock()
-        && let Some(v) = m.get(src)
-    {
-        return v.clone();
-    }
-    let inline = src.contains('\n');
-    let parsed = if inline {
-        parse_file(src, "")
-    } else {
-        let ext = std::path::Path::new(src_t).extension().and_then(|e| e.to_str()).unwrap_or("");
-        std::fs::read_to_string(src_t).ok().and_then(|t| parse_file(&t, ext))
-    }
-    .map(Arc::new);
-    if let Ok(mut m) = cache.lock() {
-        m.insert(src.to_string(), parsed.clone());
-    }
-    parsed
-}
-
-impl FileXform {
-    pub fn apply(&self, c: [f32; 3], interp: u32, inverse: bool, ccc_id: &str) -> [f32; 3] {
-        match self {
-            FileXform::Cdl(list) => {
-                let cdl = list.iter().find(|(id, _)| !ccc_id.is_empty() && id == ccc_id).or(list.first()).map(|(_, c)| *c).unwrap_or_default();
-                let c64 = c.map(|v| v as f64);
-                let o = if inverse { cdl.invert(c64, true) } else { cdl.apply(c64, true) };
-                o.map(|v| v as f32)
-            }
-            FileXform::Matrix { m, offset } => crate::ocio_config::matrix_apply(m, offset, c.map(|v| v as f64), inverse).map(|v| v as f32),
-            FileXform::Lut { lut, shaper } => {
-                let fwd = |c: [f32; 3]| {
-                    let c = match shaper {
-                        Some(s) => [shape(&s[0], c[0]), shape(&s[1], c[1]), shape(&s[2], c[2])],
-                        None => c,
-                    };
-                    lut.apply_interp(c, interp)
-                };
-                if !inverse {
-                    return fwd(c);
-                }
-                if lut.n3 == 0 {
-                    // 1D: invert each channel exactly through the (monotone) tables.
-                    let mut x = c;
-                    if lut.n1 > 1 {
-                        x = [0, 1, 2].map(|i| {
-                            let curve: Vec<(f32, f32)> =
-                                (0..lut.n1).map(|k| (lut.d1[k][i], lut.dmin[i] + (lut.dmax[i] - lut.dmin[i]) * k as f32 / (lut.n1 - 1) as f32)).collect();
-                            shape(&curve, c[i])
-                        });
-                    }
-                    if let Some(s) = shaper {
-                        x = [shape_inv(&s[0], x[0]), shape_inv(&s[1], x[1]), shape_inv(&s[2], x[2])];
-                    }
-                    return x;
-                }
-                // 3D: damped fixed-point (Newton with an identity Jacobian) from the target.
-                let mut x = c;
-                for _ in 0..40 {
-                    let y = fwd(x);
-                    let e = [c[0] - y[0], c[1] - y[1], c[2] - y[2]];
-                    if e.iter().all(|v| v.abs() < 1e-6) {
-                        break;
-                    }
-                    x = [x[0] + e[0], x[1] + e[1], x[2] + e[2]];
-                }
-                x
-            }
-        }
-    }
-}
-
-// ---------------------------------------------------------------- displays, views and looks
-
-/// Displays of the built-in config: (name, display primaries/white, encoding).
-pub const DISPLAYS: &[(&str, [[f64; 2]; 3], Tf)] =
-    &[("sRGB", REC709, Tf::Srgb), ("Rec.1886 Rec.709", REC709, Tf::Gamma(2.4)), ("Display P3", P3, Tf::Srgb), ("Rec.2100-PQ", REC2020, Tf::Pq)];
-
-pub const VIEWS: &[&str] = &["Standard", "Tone Mapped", "Raw"];
-
-/// Configuration popup: the built-in config, or a custom `.ocio` file (Config File: a path or
-/// the config's text; spaces chosen by name, see [`crate::ocio_config`]).
-pub const CONFIGS: &[&str] = &["Built-in (EffectCraft minimal)", "Custom (.ocio file)"];
-
-/// Built-in looks: CDLs applied in ACEScct.
-pub fn looks() -> Vec<(&'static str, Cdl)> {
-    let grey = 0.413_588_402_492_442_1; // ACEScct of 0.18
-    let c = |slope: [f64; 3], offset: [f64; 3], sat: f64| Cdl { slope, offset, power: [1.0; 3], sat };
-    vec![
-        ("Warm", c([1.04, 1.0, 0.94], [0.0; 3], 1.0)),
-        ("Cool", c([0.95, 1.0, 1.06], [0.0; 3], 1.0)),
-        ("High Contrast", c([1.25; 3], [grey * (1.0 - 1.25); 3], 1.0)),
-        ("Low Contrast", c([0.8; 3], [grey * (1.0 - 0.8); 3], 1.0)),
-        ("Desaturated", c([1.0; 3], [0.0; 3], 0.6)),
-        ("Vivid", c([1.0; 3], [0.0; 3], 1.3)),
-    ]
-}
-
-/// Extended Reinhard roll-off (white point 16): maps 0..∞ into 0..1, ≈ identity near 0.
-fn tonemap(v: f64) -> f64 {
-    let w2 = 256.0;
-    if v <= 0.0 { v } else { v * (1.0 + v / w2) / (1.0 + v) }
-}
-
-fn tonemap_inv(y: f64) -> f64 {
-    if y <= 0.0 {
-        return y;
-    }
-    // Solve v² / w² + v (1 − y) − y = 0.
-    let (a, b, c) = (1.0 / 256.0, 1.0 - y, -y);
-    (-b + (b * b - 4.0 * a * c).sqrt()) / (2.0 * a)
-}
-
-/// Display transform of an input-space colour (`inverse`: display code values → input space).
-pub fn display_xform(input: &Space, display: usize, view: usize, inverse: bool) -> impl Fn([f32; 3]) -> [f32; 3] + Sync {
-    let (_, prims, tf) = DISPLAYS[display.min(DISPLAYS.len() - 1)];
-    let disp = Space { name: "display", prims: Some((prims, D65)), tf: Tf::Linear, raw: false };
-    let raw = view == 2 || input.raw;
-    let m_in = Xform::new(&Space { tf: Tf::Linear, ..*input }, &disp);
-    let m_out = Xform::new(&disp, &Space { tf: Tf::Linear, ..*input });
-    let in_tf = input.tf;
-    move |c: [f32; 3]| {
-        if raw {
-            return c;
-        }
-        if !inverse {
-            let lin = c.map(|v| in_tf.decode(v as f64) as f32);
-            let d = m_in.apply(lin);
-            d.map(|v| {
-                let v = v as f64;
-                let v = if view == 1 { tonemap(v) } else { v };
-                tf.encode(v) as f32
-            })
-        } else {
-            let d = c.map(|v| {
-                let l = tf.decode(v as f64);
-                (if view == 1 { tonemap_inv(l) } else { l }) as f32
-            });
-            m_out.apply(d).map(|v| in_tf.encode(v as f64) as f32)
-        }
-    }
-}
-
-// ---------------------------------------------------------------- effects
-
-fn spec(id: &'static str, name: &'static str, cat: &'static str, params: Vec<crate::ParamSpec>, render: crate::RenderFn) -> EffectSpec {
-    EffectSpec { id, name, category: cat, params, render, gpu: false, float: true }
-}
-
-fn space_param(id: &'static str, name: &'static str, default: u32) -> crate::ParamSpec {
-    p(id, name, Value::Enum(default), popup(&space_names()))
-}
-
-fn direction() -> crate::ParamSpec {
-    p("direction", "Direction", Value::Enum(0), popup(&["Forward", "Inverse"]))
-}
-
-fn map_px(b: &mut Buf, f: impl Fn([f32; 3]) -> [f32; 3] + Sync) {
-    b.img.data.par_iter_mut().for_each(|px| {
-        let (c, a) = unpremul(*px);
-        if a <= 0.0 {
-            return;
-        }
-        let o = f(c);
-        *px = [o[0] * a, o[1] * a, o[2] * a, a];
-    });
-}
-
-fn space_at(i: u32) -> &'static Space {
-    &SPACES[(i as usize).min(SPACES.len() - 1)]
-}
-
-/// The effects that take Configuration ▸ Custom (a `.ocio` file).
-pub(crate) const CUSTOM_CONFIG_FX: [&str; 2] = ["ec.color.ociocolorspace", "ec.color.ociodisplay"];
-
-/// Effect `id`'s transform under Configuration ▸ Custom: the config's conversion from the source
-/// space to the destination space (Color Space Transform) or through a display's view (Display
-/// Transform), see [`crate::ocio_config`]. `Ok(None)` with the built-in configuration; an error
-/// (the pixels pass through) when the config can't be read or has no such colour space.
-fn custom_xf(id: &str, pr: &crate::Params) -> Result<Option<crate::ocio_config::Xf>, String> {
-    use crate::ocio_config::Xf;
-    if !CUSTOM_CONFIG_FX.contains(&id) || pr.e("config") != 1 {
-        return Ok(None);
-    }
-    let cfg = crate::ocio_config::load_config(pr.s("configFile")).map_err(|e| format!("Can't read the OCIO config: {e}"))?;
-    // A space by its typed name, else by the built-in popup's name.
-    let space = |name: &str, popup: u32| {
-        let name = if name.trim().is_empty() { space_at(popup).name } else { name.trim() };
-        cfg.space(name).ok_or_else(|| format!("The OCIO config has no color space `{name}`"))
-    };
-    let a = space(pr.s("sourceName"), pr.e("source"))?;
-    let inverse = pr.e("direction") == 1;
-    if id == "ec.color.ociodisplay" {
-        let (dn, vn) = display_view_names(pr);
-        let xf = cfg.display_path(a, dn, vn);
-        return Ok(Some(if inverse { Xf::Inverse(Box::new(xf)) } else { xf }));
-    }
-    let z = space(pr.s("destinationName"), pr.e("destination"))?;
-    // Inverse: the conversion the other way (OCIO's inverse ColorSpaceTransform).
-    Ok(Some(if inverse { cfg.path(z, a) } else { cfg.path(a, z) }))
-}
-
-/// The display and view a Display Transform names: the typed names, else the popups'.
-fn display_view_names(pr: &crate::Params) -> (&str, &str) {
-    let display = DISPLAYS.get(pr.e("display") as usize).map_or("", |d| d.0);
-    let view = VIEWS.get(pr.e("view") as usize).copied().unwrap_or("");
-    let typed = |k: &str, popup| if pr.s(k).trim().is_empty() { popup } else { pr.s(k).trim() };
-    (typed("displayName", display), typed("viewName", view))
-}
-
-/// Effect Controls' warning for effect `id`: a custom OCIO configuration that can't be read, has
-/// no such colour space, display or view, or uses transforms EffectCraft can't apply (colours
-/// pass through those steps, #410). `None` when the effect renders as asked.
-pub fn warning(id: &str, pr: &crate::Params) -> Option<String> {
-    let xf = match custom_xf(id, pr) {
-        Ok(x) => x?,
-        Err(e) => return Some(format!("{e}: the colors pass through.")),
-    };
-    let mut notes = vec![];
-    if id == "ec.color.ociodisplay"
-        && let Ok(cfg) = crate::ocio_config::load_config(pr.s("configFile"))
-    {
-        let (dn, vn) = display_view_names(pr);
-        if let Some((d, v)) = cfg.view(dn, vn)
-            && (!d.eq_ignore_ascii_case(dn) || !v.name.eq_ignore_ascii_case(vn))
-        {
-            notes.push(format!("The OCIO config has no display `{dn}` with a view `{vn}`: showing {d} / {}.", v.name));
-        }
-    }
-    let missing = xf.unsupported_list();
-    if !missing.is_empty() {
-        notes.push(format!("Not supported, the colors pass through: {}.", missing.join(", ")));
-    }
-    (!notes.is_empty()).then(|| notes.join(" "))
-}
-
-/// Configuration ▸ Custom: render through the config's transform. `false` with the built-in
-/// configuration (the caller renders it).
-fn custom_render(id: &str, ctx: &EffectCtx, b: &mut Buf) -> bool {
-    match custom_xf(id, ctx.params) {
-        Ok(None) => false,
-        Ok(Some(xf)) => {
-            map_px(b, |c| xf.apply(c.map(|v| v as f64), false).map(|v| v as f32));
-            true
-        }
-        // A config that can't be read, or an unknown space: the pixels pass through.
-        Err(_) => true,
-    }
-}
-
-fn ocio_cst(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    if custom_render("ec.color.ociocolorspace", ctx, &mut b) {
-        return b;
-    }
-    let (a, z) = (space_at(ctx.params.e("source")), space_at(ctx.params.e("destination")));
-    let (a, z) = if ctx.params.e("direction") == 1 { (z, a) } else { (a, z) };
-    if a.name == z.name {
-        return b;
-    }
-    let x = Xform::new(a, z);
-    map_px(&mut b, |c| x.apply(c));
-    b
-}
-
-fn cdl_from_params(pr: &crate::Params) -> Cdl {
-    Cdl {
-        slope: [pr.f("slopeRed"), pr.f("slopeGreen"), pr.f("slopeBlue")],
-        offset: [pr.f("offsetRed"), pr.f("offsetGreen"), pr.f("offsetBlue")],
-        power: [pr.f("powerRed").max(0.0), pr.f("powerGreen").max(0.0), pr.f("powerBlue").max(0.0)],
-        sat: pr.f("saturation").max(0.0),
-    }
-}
-
-fn ocio_cdl(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let cdl = cdl_from_params(ctx.params);
-    if cdl == Cdl::default() {
-        return b;
-    }
-    let clamp = ctx.params.e("style") == 0;
-    let inv = ctx.params.e("direction") == 1;
-    map_px(&mut b, |c| {
-        let c = c.map(|v| v as f64);
-        let o = if inv { cdl.invert(c, clamp) } else { cdl.apply(c, clamp) };
-        o.map(|v| v as f32)
-    });
-    b
-}
-
-fn ocio_display(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    if custom_render("ec.color.ociodisplay", ctx, &mut b) {
-        return b;
-    }
-    let input = space_at(ctx.params.e("source"));
-    let f = display_xform(input, ctx.params.e("display") as usize, ctx.params.e("view") as usize, ctx.params.e("direction") == 1);
-    map_px(&mut b, f);
-    b
-}
-
-fn ocio_file(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let Some(x) = load_file(ctx.params.s("file")) else { return b };
-    let interp = match ctx.params.e("interpolation") {
-        0 => 0,
-        1 => 1,
-        _ => 2,
-    };
-    let inv = ctx.params.e("direction") == 1;
-    let id = ctx.params.s("cccId").to_string();
-    map_px(&mut b, |c| x.apply(c, interp, inv, &id));
-    b
-}
-
-/// Parse a looks string: comma/space separated names, `-Name` = inverse.
-pub fn parse_looks(s: &str) -> Vec<(Cdl, bool)> {
-    let all = looks();
-    s.split([',', ':'])
-        .map(str::trim)
-        .filter(|t| !t.is_empty())
-        .filter_map(|t| {
-            let (inv, n) = match t.strip_prefix('-') {
-                Some(r) => (true, r.trim()),
-                None => (false, t.trim_start_matches('+').trim()),
-            };
-            all.iter().find(|(name, _)| name.eq_ignore_ascii_case(n)).map(|(_, c)| (*c, inv))
-        })
-        .collect()
-}
-
-fn ocio_look(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let mut list = parse_looks(ctx.params.s("looks"));
-    let pick = ctx.params.e("look");
-    if pick > 0
-        && let Some((_, c)) = looks().get(pick as usize - 1)
-    {
-        list.insert(0, (*c, false));
-    }
-    if list.is_empty() {
-        return b;
-    }
-    let (src, dst) = (space_at(ctx.params.e("source")), space_at(ctx.params.e("destination")));
-    let inv = ctx.params.e("direction") == 1;
-    let cct = &ACES_CCT;
-    let (a, z) = if inv { (dst, src) } else { (src, dst) };
-    let to_p = Xform::new(a, cct);
-    let from_p = Xform::new(cct, z);
-    if inv {
-        list.reverse();
-    }
-    map_px(&mut b, |c| {
-        let mut v = to_p.apply(c).map(|x| x as f64);
-        for (cdl, li) in &list {
-            v = if *li != inv { cdl.invert(v, false) } else { cdl.apply(v, false) };
-        }
-        from_p.apply(v.map(|x| x as f32))
-    });
-    b
-}
-
-// ---- Color Profile Converter (Utility)
-
-pub const PROFILES: &[&str] = &["Project Working Space", "sRGB IEC61966-2.1", "HDTV (Rec. 709)", "Rec. 2020", "Display P3", "ACEScg", "ACES2065-1"];
-
-fn profile(ctx: &EffectCtx, i: u32) -> (Space, bool) {
-    let ws = |cs: ColorSpace| match cs {
-        ColorSpace::Srgb => sp("sRGB", REC709, D65, Tf::Srgb),
-        ColorSpace::Rec709 => sp("Rec.709", REC709, D65, Tf::Gamma(2.4)),
-        ColorSpace::Rec2020 => sp("Rec.2020", REC2020, D65, Tf::Gamma(2.4)),
-        ColorSpace::DisplayP3 => sp("Display P3", P3, D65, Tf::Srgb),
-        ColorSpace::AcesCg => ACES_CG,
-        ColorSpace::Aces2065 => ACES2065_1,
-        // HDR encodings are output spaces, never a working space.
-        ColorSpace::Rec2100Pq | ColorSpace::Rec2100Hlg => sp("Rec.2020", REC2020, D65, Tf::Gamma(2.4)),
-    };
-    match i {
-        0 => (ws(ctx.env.working_space.unwrap_or(ColorSpace::Srgb)), ctx.env.working_linear),
-        1 => (ws(ColorSpace::Srgb), false),
-        2 => (ws(ColorSpace::Rec709), false),
-        3 => (ws(ColorSpace::Rec2020), false),
-        4 => (ws(ColorSpace::DisplayP3), false),
-        5 => (ACES_CG, true),
-        _ => (ACES2065_1, true),
-    }
-}
-
-/// Gamut compression for the perceptual intent: pull out-of-gamut (negative) colours toward
-/// their luminance just enough to bring every channel to ≥ 0, rolling off smoothly.
-fn compress_gamut(c: [f64; 3], luma: [f64; 3]) -> [f64; 3] {
-    let l = c[0] * luma[0] + c[1] * luma[1] + c[2] * luma[2];
-    if l <= 0.0 {
-        return c.map(|v| v.max(0.0));
-    }
-    let mn = c.iter().cloned().fold(f64::INFINITY, f64::min);
-    if mn >= 0.0 {
-        return c;
-    }
-    // Fraction of the way toward grey that reaches zero on the most negative channel.
-    let t = (l / (l - mn)).clamp(0.0, 1.0);
-    c.map(|v| l + (v - l) * t)
-}
-
-fn profile_converter(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let (inp, in_lin_default) = profile(ctx, ctx.params.e("inputProfile"));
-    let (out, out_lin_default) = profile(ctx, ctx.params.e("outputProfile"));
-    let in_lin = ctx.params.b("linearizeInputProfile") || in_lin_default && ctx.params.e("inputProfile") == 0;
-    let out_lin = ctx.params.b("linearizeOutputProfile") || out_lin_default && ctx.params.e("outputProfile") == 0;
-    let intent = ctx.params.e("intent");
-    let dec = if in_lin { Tf::Linear } else { inp.tf };
-    let enc = if out_lin { Tf::Linear } else { out.tf };
-    // Absolute colorimetric keeps the source white (no adaptation); the others adapt.
-    let m = if intent == 3 { mul(&invert(&out.to_ref(false)), &inp.to_ref(false)) } else { matrix(&inp, &out) };
-    let identity = dec == enc && (0..3).all(|i| (0..3).all(|j| (m[i][j] - IDENTITY[i][j]).abs() < 1e-9));
-    if identity {
-        return b;
-    }
-    let out_luma = out.to_ref(true)[1];
-    map_px(&mut b, |c| {
-        let l = c.map(|v| dec.decode(v as f64));
-        let mut o = mul_vec(&m, l);
-        match intent {
-            0 => o = compress_gamut(o, out_luma),
-            2 => o = o.map(|v| v.max(0.0)),
-            _ => {}
-        }
-        o.map(|v| enc.encode(v) as f32)
-    });
-    b
-}
-
-// ---- Colour programs (the GPU compositor's colour-management kernels)
-
-/// One per-pixel step of a colour transform, in the order the CPU effect applies them (see
-/// [`color_program`]).
-#[derive(Clone, Debug)]
-pub enum ColorOp {
-    /// Transfer function, encoded → linear.
-    Decode(Tf),
-    /// Transfer function, linear → encoded.
-    Encode(Tf),
-    /// Linear-RGB matrix.
-    Matrix([[f32; 3]; 3]),
-    /// ASC CDL (forward or exact inverse; `clamp` = the v1.2 style).
-    Cdl { cdl: Cdl, clamp: bool, inverse: bool },
-    /// The Tone Mapped view's roll-off (or its inverse).
-    Tonemap { inverse: bool },
-    /// Color Profile Converter's perceptual gamut compression toward luminance `luma`.
-    Gamut([f64; 3]),
-    /// Negative channels to 0 (the saturation intent).
-    Max0,
-    /// A LUT (0 nearest, 1 trilinear, 2 tetrahedral) with an optional per-channel shaper, forward
-    /// or inverse (as [`FileXform::apply`]).
-    Lut { lut: Arc<Lut>, shaper: Option<Arc<[Vec<(f32, f32)>; 3]>>, interp: u32, inverse: bool },
-    /// `m × (c + pre) + post` (a custom config's MatrixTransform and RangeTransform).
-    Affine { m: [[f32; 3]; 3], pre: [f32; 3], post: [f32; 3] },
-    /// `max(c, 0) ^ p` per channel (ExponentTransform).
-    Pow([f32; 3]),
-    /// LogTransform / LogAffineTransform, forward or inverse (as `ocio_config::Xf::apply`).
-    LogAffine { base: f32, log_slope: [f32; 3], log_offset: [f32; 3], lin_slope: [f32; 3], lin_offset: [f32; 3], inverse: bool },
-    /// ExponentWithLinearTransform, forward (decode) or inverse (as
-    /// [`crate::ocio_config::moncurve`]).
-    MonCurve { gamma: [f32; 3], offset: [f32; 3], inverse: bool, mirror: bool },
-    /// Clamp each channel to `lo..=hi` (a clamping RangeTransform; ±`f32::MAX` = unbounded).
-    Clamp { lo: [f32; 3], hi: [f32; 3] },
-}
-
-/// The ops of a matrix-and-offset transform (MatrixTransform, `.spimtx`), forward or inverse
-/// (as [`crate::ocio_config::matrix_apply`]).
-fn matrix_ops(m: &[f64; 16], offset: &[f64; 4], inverse: bool, ops: &mut Vec<ColorOp>) {
-    if !inverse {
-        let m = [0, 1, 2].map(|r| [m[r * 4] as f32, m[r * 4 + 1] as f32, m[r * 4 + 2] as f32]);
-        ops.push(ColorOp::Affine { m, pre: [0.0; 3], post: [offset[0] as f32, offset[1] as f32, offset[2] as f32] });
-    } else if let Some(inv) = crate::ocio_config::mat3_inverse(m) {
-        let m = inv.map(|r| r.map(|v| v as f32));
-        ops.push(ColorOp::Affine { m, pre: [-offset[0] as f32, -offset[1] as f32, -offset[2] as f32], post: [0.0; 3] });
-    }
-}
-
-/// The ops of a LUT / CDL / matrix file transform (as [`FileXform::apply`]).
-fn file_ops(x: &FileXform, interp: u32, inverse: bool, ccc_id: &str, ops: &mut Vec<ColorOp>) {
-    match x {
-        FileXform::Cdl(list) => {
-            let cdl = list.iter().find(|(i, _)| !ccc_id.is_empty() && i == ccc_id).or(list.first()).map(|(_, c)| *c).unwrap_or_default();
-            ops.push(ColorOp::Cdl { cdl, clamp: true, inverse });
-        }
-        FileXform::Lut { lut, shaper } => {
-            ops.push(ColorOp::Lut { lut: Arc::new(lut.clone()), shaper: shaper.clone().map(Arc::new), interp, inverse });
-        }
-        FileXform::Matrix { m, offset } => matrix_ops(m, offset, inverse, ops),
-    }
-}
-
-/// The ops of a custom config's transform `x` (as `Xf::apply`).
-fn config_xf_ops(x: &crate::ocio_config::Xf, inverse: bool, ops: &mut Vec<ColorOp>) {
-    use crate::ocio_config::Xf;
-    let f3 = |v: &[f64; 3]| v.map(|x| x as f32);
-    match x {
-        Xf::Inverse(x) => config_xf_ops(x, !inverse, ops),
-        Xf::Matrix { m, offset } => matrix_ops(m, offset, inverse, ops),
-        Xf::File { xf: Some(x), interp, ccc, .. } => file_ops(x, *interp, inverse, ccc, ops),
-        Xf::ExponentLinear { gamma, offset, mirror } => ops.push(ColorOp::MonCurve { gamma: f3(gamma), offset: f3(offset), inverse, mirror: *mirror }),
-        // A BuiltinTransform's curve: forward decodes.
-        Xf::Curve(tf) => ops.push(if inverse { ColorOp::Encode(*tf) } else { ColorOp::Decode(*tf) }),
-        Xf::Named(_) => {}
-        Xf::File { xf: None, .. } | Xf::Unsupported(_) => {}
-        Xf::Exponent(e) => ops.push(ColorOp::Pow([0, 1, 2].map(|k| (if inverse { 1.0 / e[k].max(1e-9) } else { e[k] }) as f32))),
-        Xf::Log { base } => {
-            ops.push(ColorOp::LogAffine { base: *base as f32, log_slope: [1.0; 3], log_offset: [0.0; 3], lin_slope: [1.0; 3], lin_offset: [0.0; 3], inverse })
-        }
-        Xf::LogAffine { base, log_slope, log_offset, lin_slope, lin_offset } => ops.push(ColorOp::LogAffine {
-            base: *base as f32,
-            log_slope: f3(log_slope),
-            log_offset: f3(log_offset),
-            lin_slope: f3(lin_slope),
-            lin_offset: f3(lin_offset),
-            inverse,
-        }),
-        Xf::Cdl(cdl) => ops.push(ColorOp::Cdl { cdl: *cdl, clamp: true, inverse }),
-        Xf::Range(r) => {
-            let (k, off, lo, hi) = r.parts(inverse);
-            let k = k as f32;
-            ops.push(ColorOp::Affine { m: [[k, 0.0, 0.0], [0.0, k, 0.0], [0.0, 0.0, k]], pre: [0.0; 3], post: [off as f32; 3] });
-            if lo.is_finite() || hi.is_finite() {
-                let bound = |v: f64| (v as f32).clamp(-f32::MAX, f32::MAX);
-                ops.push(ColorOp::Clamp { lo: [bound(lo); 3], hi: [bound(hi); 3] });
-            }
-        }
-        Xf::Group(list) => {
-            if inverse {
-                list.iter().rev().for_each(|x| config_xf_ops(x, true, ops));
-            } else {
-                list.iter().for_each(|x| config_xf_ops(x, false, ops));
-            }
-        }
-    }
-}
-
-/// How a colour program meets premultiplied pixels.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Straight {
-    /// `unpremul` (colour 0 below alpha 1e-6); fully transparent pixels untouched (OCIO effects).
-    Unpremul,
-    /// Colour ÷ alpha; fully transparent pixels untouched (`Image::map_straight`, Apply Color LUT).
-    Divide,
-}
-
-fn xform_ops(x: &Xform, ops: &mut Vec<ColorOp>) {
-    if x.dec != Tf::Linear {
-        ops.push(ColorOp::Decode(x.dec));
-    }
-    if !x.ident {
-        ops.push(ColorOp::Matrix(x.m));
-    }
-    if x.enc != Tf::Linear {
-        ops.push(ColorOp::Encode(x.enc));
-    }
-}
-
-/// Effect `id`'s per-pixel transform as a list of [`ColorOp`]s that reproduces the CPU effect
-/// (empty = the layer passes through; custom OCIO configs compile their transforms too). `None`
-/// for another effect.
-pub fn color_program(id: &str, ctx: &EffectCtx) -> Option<(Vec<ColorOp>, Straight)> {
-    let pr = ctx.params;
-    let mut ops = vec![];
-    // Configuration ▸ Custom compiles the config's transforms (a config that can't be read, or
-    // names unknown spaces, passes the pixels through).
-    match custom_xf(id, pr) {
-        Ok(None) => {}
-        Ok(Some(xf)) => {
-            config_xf_ops(&xf, false, &mut ops);
-            return Some((ops, Straight::Unpremul));
-        }
-        Err(_) => return Some((ops, Straight::Unpremul)),
-    }
-    match id {
-        "ec.utility.applylut" => {
-            if let Some(lut) = crate::utility::load_lut(pr.s("lut")) {
-                ops.push(ColorOp::Lut { lut, shaper: None, interp: 2, inverse: false });
-            }
-            return Some((ops, Straight::Divide));
-        }
-        "ec.color.ociocolorspace" => {
-            let (a, z) = (space_at(pr.e("source")), space_at(pr.e("destination")));
-            let (a, z) = if pr.e("direction") == 1 { (z, a) } else { (a, z) };
-            if a.name != z.name {
-                xform_ops(&Xform::new(a, z), &mut ops);
-            }
-        }
-        "ec.color.ociocdl" => {
-            let cdl = cdl_from_params(pr);
-            if cdl != Cdl::default() {
-                ops.push(ColorOp::Cdl { cdl, clamp: pr.e("style") == 0, inverse: pr.e("direction") == 1 });
-            }
-        }
-        "ec.color.ociodisplay" => {
-            let input = space_at(pr.e("source"));
-            let (display, view, inverse) = (pr.e("display") as usize, pr.e("view") as usize, pr.e("direction") == 1);
-            let (_, prims, tf) = DISPLAYS[display.min(DISPLAYS.len() - 1)];
-            if view != 2 && !input.raw {
-                let disp = Space { name: "display", prims: Some((prims, D65)), tf: Tf::Linear, raw: false };
-                let lin = Space { tf: Tf::Linear, ..*input };
-                if !inverse {
-                    ops.push(ColorOp::Decode(input.tf));
-                    xform_ops(&Xform::new(&lin, &disp), &mut ops);
-                    if view == 1 {
-                        ops.push(ColorOp::Tonemap { inverse: false });
-                    }
-                    ops.push(ColorOp::Encode(tf));
-                } else {
-                    ops.push(ColorOp::Decode(tf));
-                    if view == 1 {
-                        ops.push(ColorOp::Tonemap { inverse: true });
-                    }
-                    xform_ops(&Xform::new(&disp, &lin), &mut ops);
-                    ops.push(ColorOp::Encode(input.tf));
-                }
-            }
-        }
-        "ec.color.ociofile" => {
-            if let Some(x) = load_file(pr.s("file")) {
-                let interp = match pr.e("interpolation") {
-                    0 => 0,
-                    1 => 1,
-                    _ => 2,
-                };
-                file_ops(&x, interp, pr.e("direction") == 1, pr.s("cccId"), &mut ops);
-            }
-        }
-        "ec.color.ociolook" => {
-            let mut list = parse_looks(pr.s("looks"));
-            let pick = pr.e("look");
-            if pick > 0
-                && let Some((_, c)) = looks().get(pick as usize - 1)
-            {
-                list.insert(0, (*c, false));
-            }
-            if !list.is_empty() {
-                let (src, dst) = (space_at(pr.e("source")), space_at(pr.e("destination")));
-                let inv = pr.e("direction") == 1;
-                let cct = &ACES_CCT;
-                let (a, z) = if inv { (dst, src) } else { (src, dst) };
-                if inv {
-                    list.reverse();
-                }
-                xform_ops(&Xform::new(a, cct), &mut ops);
-                for (cdl, li) in &list {
-                    ops.push(ColorOp::Cdl { cdl: *cdl, clamp: false, inverse: *li != inv });
-                }
-                xform_ops(&Xform::new(cct, z), &mut ops);
-            }
-        }
-        "ec.utility.colorprofileconverter" => {
-            let (inp, in_lin_default) = profile(ctx, pr.e("inputProfile"));
-            let (out, out_lin_default) = profile(ctx, pr.e("outputProfile"));
-            let in_lin = pr.b("linearizeInputProfile") || in_lin_default && pr.e("inputProfile") == 0;
-            let out_lin = pr.b("linearizeOutputProfile") || out_lin_default && pr.e("outputProfile") == 0;
-            let intent = pr.e("intent");
-            let dec = if in_lin { Tf::Linear } else { inp.tf };
-            let enc = if out_lin { Tf::Linear } else { out.tf };
-            let m = if intent == 3 { mul(&invert(&out.to_ref(false)), &inp.to_ref(false)) } else { matrix(&inp, &out) };
-            let identity = dec == enc && (0..3).all(|i| (0..3).all(|j| (m[i][j] - IDENTITY[i][j]).abs() < 1e-9));
-            if !identity {
-                ops.push(ColorOp::Decode(dec));
-                ops.push(ColorOp::Matrix(m.map(|r| r.map(|v| v as f32))));
-                match intent {
-                    0 => ops.push(ColorOp::Gamut(out.to_ref(true)[1])),
-                    2 => ops.push(ColorOp::Max0),
-                    _ => {}
-                }
-                ops.push(ColorOp::Encode(enc));
-            }
-        }
-        _ => return None,
-    }
-    Some((ops, Straight::Unpremul))
-}
-
-// ---- Color Stabilizer
-
-/// Mean straight colour of a square (half-size `r` layer pixels) around layer point `pt`.
-fn sample_mean(b: &Buf, pt: [f64; 2], r: f64) -> [f64; 3] {
-    let (cx, cy) = b.to_px(pt);
-    let rr = (r * b.scale).max(0.5);
-    let (x0, x1) = ((cx - rr).floor().max(0.0) as i64, ((cx + rr).ceil() as i64).min(b.img.width as i64));
-    let (y0, y1) = ((cy - rr).floor().max(0.0) as i64, ((cy + rr).ceil() as i64).min(b.img.height as i64));
-    let mut acc = [0.0f64; 4];
-    for y in y0..y1 {
-        for x in x0..x1 {
-            let p = b.img.get(x, y);
-            for k in 0..4 {
-                acc[k] += p[k] as f64;
-            }
-        }
-    }
-    if acc[3] <= 1e-9 {
-        return [0.0; 3];
-    }
-    [acc[0] / acc[3], acc[1] / acc[3], acc[2] / acc[3]]
-}
-
-/// Monotone piecewise-quadratic curve through (0,0), three samples and (1,1) (linear between
-/// them is enough for a stabiliser and stays monotone).
-fn curve3(xs: [f64; 3], ys: [f64; 3], v: f64) -> f64 {
-    let mut pts = vec![(0.0, 0.0)];
-    let mut pairs: Vec<(f64, f64)> = xs.iter().cloned().zip(ys.iter().cloned()).collect();
-    pairs.sort_by(|a, b| a.0.total_cmp(&b.0));
-    for (x, y) in pairs {
-        if pts.last().is_some_and(|l| x > l.0 + 1e-4) && x < 1.0 - 1e-4 {
-            pts.push((x, y));
-        }
-    }
-    pts.push((1.0, 1.0));
-    let i = pts.partition_point(|p| p.0 < v).clamp(1, pts.len() - 1);
-    let (a, c) = (pts[i - 1], pts[i]);
-    a.1 + (c.1 - a.1) * (v - a.0) / (c.0 - a.0).max(1e-9)
-}
-
-/// Color Stabilizer's correction of buffer `b` as one piecewise-linear map per channel (points
-/// with increasing x; the end segments extend), the same maps [`color_stabilizer`] applies.
-/// `None` without a host or reference frame (the layer passes through). (The GPU effect.)
-pub fn color_stabilizer_maps(ctx: &EffectCtx, b: &Buf) -> Option<[Vec<(f64, f64)>; 3]> {
-    let reference = ctx.env.host?.self_at(ctx.params.f("referenceFrame"), ctx.env.effect_index)?;
-    let r = ctx.params.f("sampleSize").max(0.5);
-    let pts = [ctx.params.v2("blackPoint"), ctx.params.v2("midPoint"), ctx.params.v2("whitePoint")];
-    let cur = pts.map(|pt| sample_mean(b, pt, r));
-    let refv = pts.map(|pt| sample_mean(&reference, pt, r));
-    let mode = ctx.params.e("stabilize");
-    Some([0, 1, 2].map(|k| {
-        let offset = |c0: f64, r0: f64| vec![(0.0, r0 - c0), (1.0, 1.0 + r0 - c0)];
-        match mode {
-            0 => offset(cur[0][k], refv[0][k]),
-            1 => {
-                let (c0, c1, r0, r1) = (cur[0][k], cur[2][k], refv[0][k], refv[2][k]);
-                if (c1 - c0).abs() < 1e-6 {
-                    offset(c0, r0)
-                } else if c0 < c1 {
-                    vec![(c0, r0), (c1, r1)]
-                } else {
-                    vec![(c1, r1), (c0, r0)]
-                }
-            }
-            _ => {
-                let mut v = vec![(0.0, 0.0)];
-                let mut pairs: Vec<(f64, f64)> = (0..3).map(|i| (cur[i][k], refv[i][k])).collect();
-                pairs.sort_by(|a, b| a.0.total_cmp(&b.0));
-                for (x, y) in pairs {
-                    if v.last().is_some_and(|l| x > l.0 + 1e-4) && x < 1.0 - 1e-4 {
-                        v.push((x, y));
-                    }
-                }
-                v.push((1.0, 1.0));
-                v
-            }
-        }
-    }))
-}
-
-fn color_stabilizer(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let Some(host) = ctx.env.host else { return b };
-    let Some(reference) = host.self_at(ctx.params.f("referenceFrame"), ctx.env.effect_index) else { return b };
-    let r = ctx.params.f("sampleSize").max(0.5);
-    let pts = [ctx.params.v2("blackPoint"), ctx.params.v2("midPoint"), ctx.params.v2("whitePoint")];
-    let cur = pts.map(|pt| sample_mean(&b, pt, r));
-    let refv = pts.map(|pt| sample_mean(&reference, pt, r));
-    let mode = ctx.params.e("stabilize");
-    map_px(&mut b, |c| {
-        [0, 1, 2].map(|k| {
-            let v = c[k] as f64;
-            let o = match mode {
-                // Brightness: one sample (black point) — offset each channel.
-                0 => v + refv[0][k] - cur[0][k],
-                // Levels: black and white samples — linear map per channel.
-                1 => {
-                    let (c0, c1, r0, r1) = (cur[0][k], cur[2][k], refv[0][k], refv[2][k]);
-                    if (c1 - c0).abs() < 1e-6 { v + r0 - c0 } else { r0 + (v - c0) * (r1 - r0) / (c1 - c0) }
-                }
-                // Curves: three samples — a curve through them per channel.
-                _ => curve3([cur[0][k], cur[1][k], cur[2][k]], [refv[0][k], refv[1][k], refv[2][k]], v),
-            };
-            o as f32
-        })
-    });
-    b
-}
-
-fn sl(lo: f64, hi: f64, smin: f64, smax: f64) -> ParamUi {
-    slider(lo, hi, smin, smax, 3)
-}
-
-pub fn specs() -> Vec<EffectSpec> {
-    let cc = "Color Correction";
-    let srgb = SPACES.iter().position(|s| s.name == "sRGB").unwrap_or(0) as u32;
-    let lin709 = SPACES.iter().position(|s| s.name == "Linear Rec.709 (sRGB)").unwrap_or(0) as u32;
-    let acescg = SPACES.iter().position(|s| s.name == "ACEScg").unwrap_or(0) as u32;
-    let mut look_opts = vec!["None"];
-    look_opts.extend(looks().iter().map(|(n, _)| *n));
-    vec![
-        spec(
-            "ec.color.ociocdl",
-            "OCIO CDL Transform",
-            cc,
-            vec![
-                p("slopeRed", "Slope Red", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("slopeGreen", "Slope Green", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("slopeBlue", "Slope Blue", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("offsetRed", "Offset Red", num(0.0), sl(-100.0, 100.0, -1.0, 1.0)),
-                p("offsetGreen", "Offset Green", num(0.0), sl(-100.0, 100.0, -1.0, 1.0)),
-                p("offsetBlue", "Offset Blue", num(0.0), sl(-100.0, 100.0, -1.0, 1.0)),
-                p("powerRed", "Power Red", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("powerGreen", "Power Green", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("powerBlue", "Power Blue", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("saturation", "Saturation", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
-                p("style", "Style", Value::Enum(0), popup(&["ASC CDL v1.2", "No Clamp"])),
-                direction(),
-            ],
-            ocio_cdl,
-        ),
-        spec(
-            "ec.color.ociocolorspace",
-            "OCIO Color Space Transform",
-            cc,
-            vec![
-                p("config", "Configuration", Value::Enum(0), popup(CONFIGS)),
-                p("configFile", "Config File (.ocio)", Value::Str(String::new()), crate::file_ui(&["ocio"])),
-                space_param("source", "Source", lin709),
-                p("sourceName", "Source (config name)", Value::Str(String::new()), ParamUi::Text),
-                space_param("destination", "Destination", srgb),
-                p("destinationName", "Destination (config name)", Value::Str(String::new()), ParamUi::Text),
-                direction(),
-            ],
-            ocio_cst,
-        ),
-        spec(
-            "ec.color.ociodisplay",
-            "OCIO Display Transform",
-            cc,
-            vec![
-                p("config", "Configuration", Value::Enum(0), popup(CONFIGS)),
-                p("configFile", "Config File (.ocio)", Value::Str(String::new()), crate::file_ui(&["ocio"])),
-                space_param("source", "Input Color Space", lin709),
-                p("sourceName", "Source (config name)", Value::Str(String::new()), ParamUi::Text),
-                p("display", "Display Device", Value::Enum(0), popup(&DISPLAYS.iter().map(|d| d.0).collect::<Vec<_>>())),
-                p("displayName", "Display (config name)", Value::Str(String::new()), ParamUi::Text),
-                p("view", "View Transform", Value::Enum(0), popup(VIEWS)),
-                p("viewName", "View (config name)", Value::Str(String::new()), ParamUi::Text),
-                direction(),
-            ],
-            ocio_display,
-        ),
-        // `file`: a path to a .cube/.3dl/.csp/.cc/.ccc/.cdl file, or the file's text itself.
-        spec(
-            "ec.color.ociofile",
-            "OCIO File Transform",
-            cc,
-            vec![
-                p("file", "File", Value::Str(String::new()), crate::file_ui(&["cube", "3dl", "csp", "cc", "ccc", "cdl", "spi1d", "spi3d", "spimtx"])),
-                p("cccId", "CCC ID", Value::Str(String::new()), ParamUi::Text),
-                p("interpolation", "Interpolation", Value::Enum(3), popup(&["Nearest", "Linear", "Tetrahedral", "Best"])),
-                direction(),
-            ],
-            ocio_file,
-        ),
-        spec(
-            "ec.color.ociolook",
-            "OCIO Look Transform",
-            cc,
-            vec![
-                p("config", "Configuration", Value::Enum(0), popup(&["Built-in (EffectCraft minimal)"])),
-                space_param("source", "Source", acescg),
-                space_param("destination", "Destination", acescg),
-                p("look", "Look", Value::Enum(0), popup(&look_opts)),
-                p("looks", "Looks", Value::Str(String::new()), ParamUi::Text),
-                direction(),
-            ],
-            ocio_look,
-        ),
-        spec(
-            "ec.color.colorstabilizer",
-            "Color Stabilizer",
-            cc,
-            vec![
-                // The pivot frame (After Effects' Set Frame button stores it).
-                p("referenceFrame", "Reference Frame (s)", num(0.0), slider(-100000.0, 100000.0, 0.0, 60.0, 2)),
-                p("stabilize", "Stabilize", Value::Enum(0), popup(&["Brightness", "Levels", "Curves"])),
-                p("blackPoint", "Black Point", Value::Vec2([0.25, 0.75]), ParamUi::Point),
-                p("midPoint", "Mid Point", Value::Vec2([0.5, 0.5]), ParamUi::Point),
-                p("whitePoint", "White Point", Value::Vec2([0.75, 0.25]), ParamUi::Point),
-                p("sampleSize", "Sample Size", num(5.0), slider(1.0, 100.0, 1.0, 50.0, 0)),
-            ],
-            color_stabilizer,
-        ),
-        spec(
-            "ec.utility.colorprofileconverter",
-            "Color Profile Converter",
-            "Utility",
-            vec![
-                p("inputProfile", "Input Profile", Value::Enum(0), popup(PROFILES)),
-                p("linearizeInputProfile", "Linearize Input Profile", Value::Bool(false), ParamUi::Checkbox),
-                p("outputProfile", "Output Profile", Value::Enum(1), popup(PROFILES)),
-                p("linearizeOutputProfile", "Linearize Output Profile", Value::Bool(false), ParamUi::Checkbox),
-                p("intent", "Intent", Value::Enum(1), popup(&["Perceptual", "Relative Colorimetric", "Saturation", "Absolute Colorimetric"])),
-                // Our built-in profiles share a zero black point and none is scene-referred, so
-                // these two are kept for compatibility and do not change the result.
-                p("useBlackPointCompensation", "Use Black Point Compensation", Value::Bool(true), ParamUi::Checkbox),
-                p("sceneRefCompensation", "Scene-ref. Profile Compensation", Value::Enum(2), popup(&["On", "Off", "Use Project Setting"])),
-            ],
-            profile_converter,
-        ),
-    ]
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, EffectHost, Image, LayerPixels, run_fx};
-
-    fn close(a: M3, b: M3, tol: f64) {
-        for i in 0..3 {
-            for j in 0..3 {
-                assert!((a[i][j] - b[i][j]).abs() < tol, "{a:?} vs {b:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn aces_matrices_match_published_values() {
-        let ap0 = space_by_name("ACES2065-1").unwrap();
-        let ap1 = space_by_name("ACEScg").unwrap();
-        // Academy S-2014-004 AP0 → AP1.
-        close(
-            matrix(ap0, ap1),
-            [
-                [1.451_439_316_1, -0.236_510_746_9, -0.214_928_569_3],
-                [-0.076_553_773_4, 1.176_229_699_8, -0.099_675_926_4],
-                [0.008_316_148_4, -0.006_032_449_8, 0.997_716_301_4],
-            ],
-            2e-4,
-        );
-        // ACEScg → linear Rec.709 with Bradford adaptation (published ACES config value).
-        let lin = space_by_name("Linear Rec.709 (sRGB)").unwrap();
-        close(matrix(ap1, lin), [[1.705_05, -0.621_79, -0.083_26], [-0.130_26, 1.140_80, -0.010_55], [-0.024_00, -0.128_97, 1.152_97]], 2e-3);
-        // White maps to white.
-        let w = mul_vec(&matrix(ap1, lin), [1.0, 1.0, 1.0]);
-        assert!(w.iter().all(|v| (v - 1.0).abs() < 1e-3), "{w:?}");
-    }
-
-    #[test]
-    fn transfer_functions_round_trip() {
-        for tf in [Tf::Srgb, Tf::Gamma(2.4), Tf::AcesCct, Tf::Pq] {
-            for v in [0.0, 0.001, 0.18, 0.5, 1.0, 4.0] {
-                let r = tf.decode(tf.encode(v));
-                assert!((r - v).abs() < 1e-6 * v.max(1.0), "{tf:?} {v} {r}");
-            }
-        }
-        // ACEScct of 18 % grey (S-2016-001).
-        assert!((Tf::AcesCct.encode(0.18) - 0.413_588).abs() < 1e-5);
-        // PQ: 100 nits (1.0) encodes to ≈ 0.508.
-        assert!((Tf::Pq.encode(1.0) - 0.508).abs() < 1e-3);
-    }
-
-    #[test]
-    fn color_space_transform_effect_round_trips() {
-        let img = Image::filled(4, 4, [0.2, 0.5, 0.7, 1.0]);
-        let srgb = SPACES.iter().position(|s| s.name == "sRGB").unwrap() as u32;
-        let cg = SPACES.iter().position(|s| s.name == "ACEScg").unwrap() as u32;
-        let a = run_fx("ec.color.ociocolorspace", &[("source", Value::Enum(srgb)), ("destination", Value::Enum(cg))], img.clone(), 0.0, EffectEnv::default());
-        assert_ne!(a.img.data, img.data);
-        let b = run_fx("ec.color.ociocolorspace", &[("source", Value::Enum(cg)), ("destination", Value::Enum(srgb))], a.img.clone(), 0.0, EffectEnv::default());
-        let c = run_fx(
-            "ec.color.ociocolorspace",
-            &[("source", Value::Enum(srgb)), ("destination", Value::Enum(cg)), ("direction", Value::Enum(1))],
-            a.img,
-            0.0,
-            EffectEnv::default(),
-        );
-        for (x, y) in b.img.data.iter().zip(&img.data).chain(c.img.data.iter().zip(&img.data)) {
-            assert!((0..4).all(|k| (x[k] - y[k]).abs() < 1e-4), "{x:?} {y:?}");
-        }
-    }
-
-    #[test]
-    fn cdl_math() {
-        let cdl = Cdl { slope: [1.2, 1.0, 0.8], offset: [0.05, 0.0, -0.02], power: [1.1, 1.0, 0.9], sat: 0.8 };
-        let c = [0.3, 0.5, 0.7];
-        // Hand computation of the v1.2 formula.
-        let sop = [(0.3f64 * 1.2 + 0.05).powf(1.1), 0.5, (0.7f64 * 0.8 - 0.02).powf(0.9)];
-        let l = sop[0] * 0.2126 + sop[1] * 0.7152 + sop[2] * 0.0722;
-        let want = sop.map(|v| l + 0.8 * (v - l));
-        let got = cdl.apply(c, true);
-        for k in 0..3 {
-            assert!((got[k] - want[k]).abs() < 1e-12);
-        }
-        let back = cdl.invert(got, true);
-        for k in 0..3 {
-            assert!((back[k] - c[k]).abs() < 1e-9);
-        }
-        // v1.2 clamps, No Clamp keeps negatives.
-        let neg = Cdl { offset: [-0.5; 3], ..Cdl::default() };
-        assert_eq!(neg.apply([0.2; 3], true), [0.0; 3]);
-        assert!((neg.apply([0.2; 3], false)[0] + 0.3).abs() < 1e-12);
-        let img = Image::filled(2, 2, [0.3, 0.5, 0.7, 1.0]);
-        let out = run_fx("ec.color.ociocdl", &[("slopeRed", num(1.2)), ("offsetRed", num(0.05)), ("powerRed", num(1.1))], img, 0.0, EffectEnv::default());
-        let r = (0.3f64 * 1.2 + 0.05).powf(1.1);
-        assert!((out.img.get(0, 0)[0] as f64 - r).abs() < 1e-5);
-    }
-
-    fn identity_lattice(n: usize, f: impl Fn([f32; 3]) -> [f32; 3]) -> Vec<[f32; 3]> {
-        let mut v = vec![];
-        for b in 0..n {
-            for g in 0..n {
-                for r in 0..n {
-                    let s = (n - 1) as f32;
-                    v.push(f([r as f32 / s, g as f32 / s, b as f32 / s]));
-                }
-            }
-        }
-        v
-    }
-
-    /// Sony Imageworks `.spi1d`, `.spi3d` and `.spimtx` (Blender's configs use them, #410), and
-    /// malformed ones rejected without panicking.
-    #[test]
-    fn spi_files_parse() {
-        let spi1d = "Version 1\nFrom 0.0 2.0\nLength 3\nComponents 1\n{\n0.0\n0.25\n1.0\n}\n";
-        let x = parse_file(spi1d, "spi1d").unwrap();
-        let o = x.apply([1.0, 0.5, 2.0], 1, false, "");
-        assert!((o[0] - 0.25).abs() < 1e-6 && (o[1] - 0.125).abs() < 1e-6 && (o[2] - 1.0).abs() < 1e-6, "{o:?}");
-        let back = x.apply(o, 1, true, "");
-        assert!((back[0] - 1.0).abs() < 1e-5 && (back[2] - 2.0).abs() < 1e-5, "{back:?}");
-        let three = parse_spi1d("Version 1\nFrom 0 1\nLength 2\nComponents 3\n{\n0 0 0\n1 0.5 2\n}\n").unwrap();
-        assert_eq!(three.d1, vec![[0.0; 3], [1.0, 0.5, 2.0]]);
-        let mut spi3d = String::from("SPILUT 1.0\n3 3\n2 2 2\n");
-        for (r, g, b) in (0..8).map(|i| (i & 1, (i >> 1) & 1, i >> 2)) {
-            spi3d += &format!("{r} {g} {b} {} {} {}\n", r as f32 * 0.5, g, b);
-        }
-        let x = parse_file(&spi3d, "spi3d").unwrap();
-        let o = x.apply([1.0, 0.5, 0.25], 1, false, "");
-        assert!((o[0] - 0.5).abs() < 1e-6 && (o[1] - 0.5).abs() < 1e-6 && (o[2] - 0.25).abs() < 1e-6, "{o:?}");
-        let m = parse_file("2 0 0 6553.5\n0 1 0 0\n0 0 1 0\n", "spimtx").unwrap();
-        let o = m.apply([0.25, 0.5, 1.0], 1, false, "");
-        assert!((o[0] - 0.6).abs() < 1e-6 && o[1] == 0.5 && o[2] == 1.0, "{o:?}");
-        assert!((m.apply(o, 1, true, "")[0] - 0.25).abs() < 1e-6);
-        for bad in [
-            "Version 1\nFrom 0 1\nLength 99999999999\nComponents 1\n{\n0\n}\n",
-            "Version 1\nFrom 1 0\nLength 2\nComponents 1\n{\n0\n1\n}\n",
-            "Version 1\nFrom 0 1\nLength 3\nComponents 1\n{\n0\n1\n}\n",
-            "Version 1\nFrom 0 1\nLength 2\nComponents 2\n{\n0 0\n1 1\n}\n",
-        ] {
-            assert!(parse_spi1d(bad).is_none(), "{bad}");
-        }
-        assert!(parse_spi3d("SPILUT 1.0\n3 3\n4000 4000 4000\n").is_none());
-        assert!(parse_spi3d("SPILUT 1.0\n3 3\n2 2 2\n9 0 0 1 1 1\n").is_none());
-        assert!(parse_spi3d("SPILUT 1.0\n3 3\n2 2 2\n0 0 0 1 1 1\n").is_none(), "incomplete lattice");
-        assert!(parse_spimtx("1 0 0\n0 1 0\n").is_none());
-        assert!(parse_spimtx("NaN 0 0 0 0 1 0 0 0 0 1 0").is_none());
-    }
-
-    #[test]
-    fn lut_files_parse_and_interpolate() {
-        // .cube with a non-linear lattice: trilinear between lattice points.
-        let f = |c: [f32; 3]| [c[0] * c[0], c[1], 1.0 - c[2]];
-        let mut cube = String::from("LUT_3D_SIZE 3\n");
-        for r in identity_lattice(3, f) {
-            cube += &format!("{} {} {}\n", r[0], r[1], r[2]);
-        }
-        let Some(FileXform::Lut { lut, .. }) = parse_file(&cube, "cube") else { panic!() };
-        // Trilinear between 0.5 (0.25) and 1.0 (1.0) at 0.75 → 0.625.
-        let o = lut.apply_interp([0.75, 0.3, 0.2], 1);
-        assert!((o[0] - 0.625).abs() < 1e-6 && (o[1] - 0.3).abs() < 1e-6 && (o[2] - 0.8).abs() < 1e-6, "{o:?}");
-        // Nearest snaps.
-        assert_eq!(lut.apply_interp([0.74, 0.0, 0.0], 0)[0], 0.25);
-        // .3dl (blue fastest, 10-bit integers, mesh line).
-        let mut tdl = String::from("0 511 1023\n");
-        for r in 0..3 {
-            for g in 0..3 {
-                for b in 0..3 {
-                    let v = [r, g, b].map(|i| i as f64 * 511.5);
-                    tdl += &format!("{} {} {}\n", v[0].round(), v[1].round(), (1023.0 - v[2]).round());
-                }
-            }
-        }
-        let Some(FileXform::Lut { lut, .. }) = parse_file(&tdl, "3dl") else { panic!() };
-        let o = lut.apply_interp([0.25, 0.5, 0.25], 1);
-        assert!((o[0] - 0.25).abs() < 2e-3 && (o[1] - 0.5).abs() < 2e-3 && (o[2] - 0.75).abs() < 2e-3, "{o:?}");
-        // .csp with a squaring pre-LUT on red and an identity 2³ lattice.
-        let mut csp = String::from("CSPLUTV100\n3D\n\n3\n0 0.5 1\n0 0.25 1\n2\n0 1\n0 1\n2\n0 1\n0 1\n\n2 2 2\n");
-        for r in identity_lattice(2, |c| c) {
-            csp += &format!("{} {} {}\n", r[0], r[1], r[2]);
-        }
-        let x = parse_file(&csp, "csp").unwrap();
-        let o = x.apply([0.5, 0.4, 0.6], 2, false, "");
-        assert!((o[0] - 0.25).abs() < 1e-6 && (o[1] - 0.4).abs() < 1e-6, "{o:?}");
-        let inv = x.apply(o, 2, true, "");
-        assert!((inv[0] - 0.5).abs() < 1e-4, "{inv:?}");
-        // CDL collection: pick by id.
-        let ccc = r#"<ColorCorrectionCollection><ColorCorrection id="a"><SOPNode><Slope>2 2 2</Slope><Offset>0 0 0</Offset><Power>1 1 1</Power></SOPNode></ColorCorrection>
-            <ColorCorrection id='b'><SOPNode><Slope>0.5 0.5 0.5</Slope></SOPNode><SatNode><Saturation>1</Saturation></SatNode></ColorCorrection></ColorCorrectionCollection>"#;
-        let x = parse_file(ccc, "ccc").unwrap();
-        assert!((x.apply([0.4; 3], 2, false, "b")[0] - 0.2).abs() < 1e-6);
-        assert!((x.apply([0.4; 3], 2, false, "a")[0] - 0.8).abs() < 1e-6);
-        assert!((x.apply([0.4; 3], 2, false, "")[0] - 0.8).abs() < 1e-6);
-        // Effect with inline content; inverse of a 3D lattice.
-        let img = Image::filled(2, 2, [0.6, 0.3, 0.2, 1.0]);
-        let out = run_fx("ec.color.ociofile", &[("file", Value::Str(cube.clone()))], img.clone(), 0.0, EffectEnv::default());
-        let back = run_fx("ec.color.ociofile", &[("file", Value::Str(cube)), ("direction", Value::Enum(1))], out.img, 0.0, EffectEnv::default());
-        assert!((back.img.get(0, 0)[0] - 0.6).abs() < 1e-3, "{:?}", back.img.get(0, 0));
-        assert!(parse_file("garbage", "3dl").is_none());
-    }
-
-    #[test]
-    fn display_and_look_transforms() {
-        // Linear 0.18 through the sRGB display / Standard view = sRGB encoding of 0.18.
-        let img = Image::filled(2, 2, [0.18, 0.18, 0.18, 1.0]);
-        let out = run_fx("ec.color.ociodisplay", &[], img.clone(), 0.0, EffectEnv::default());
-        assert!((out.img.get(0, 0)[0] as f64 - Tf::Srgb.encode(0.18)).abs() < 1e-5);
-        let back = run_fx("ec.color.ociodisplay", &[("direction", Value::Enum(1))], out.img, 0.0, EffectEnv::default());
-        assert!((back.img.get(0, 0)[0] - 0.18).abs() < 1e-5);
-        // Tone mapped view keeps highlights below 1.
-        let hot = Image::filled(1, 1, [8.0, 8.0, 8.0, 1.0]);
-        let tm = run_fx("ec.color.ociodisplay", &[("view", Value::Enum(1))], hot, 0.0, EffectEnv::default());
-        assert!(tm.img.get(0, 0)[0] < 1.0);
-        assert!((tonemap_inv(tonemap(3.0)) - 3.0).abs() < 1e-9);
-        // Looks: Warm raises red over blue; its inverse undoes it.
-        let grey = Image::filled(1, 1, [0.18, 0.18, 0.18, 1.0]);
-        let w = run_fx("ec.color.ociolook", &[("looks", Value::Str("Warm".into()))], grey.clone(), 0.0, EffectEnv::default());
-        let px = w.img.get(0, 0);
-        assert!(px[0] > px[2]);
-        let u = run_fx("ec.color.ociolook", &[("looks", Value::Str("-Warm".into()))], w.img, 0.0, EffectEnv::default());
-        assert!((u.img.get(0, 0)[0] - 0.18).abs() < 1e-4 && (u.img.get(0, 0)[2] - 0.18).abs() < 1e-4);
-        assert_eq!(parse_looks("Warm, -Cool, nope").len(), 2);
-    }
-
-    #[test]
-    fn profile_converter_converts_and_round_trips() {
-        let img = Image::filled(2, 2, [0.8, 0.4, 0.1, 1.0]);
-        // sRGB → Rec. 2020 (relative), then back.
-        let a = run_fx(
-            "ec.utility.colorprofileconverter",
-            &[("inputProfile", Value::Enum(1)), ("outputProfile", Value::Enum(3))],
-            img.clone(),
-            0.0,
-            EffectEnv::default(),
-        );
-        assert_ne!(a.img.data, img.data);
-        let b = run_fx(
-            "ec.utility.colorprofileconverter",
-            &[("inputProfile", Value::Enum(3)), ("outputProfile", Value::Enum(1))],
-            a.img,
-            0.0,
-            EffectEnv::default(),
-        );
-        assert!((0..3).all(|k| (b.img.get(0, 0)[k] - img.get(0, 0)[k]).abs() < 1e-4));
-        // Same profile both sides: identity. Working space defaults to sRGB.
-        let c = run_fx(
-            "ec.utility.colorprofileconverter",
-            &[("inputProfile", Value::Enum(0)), ("outputProfile", Value::Enum(1))],
-            img.clone(),
-            0.0,
-            EffectEnv::default(),
-        );
-        assert_eq!(c.img.data, img.data);
-        // Perceptual pulls out-of-gamut colours inside: saturated Rec.2020 green into sRGB.
-        let g = Image::filled(1, 1, [0.0, 1.0, 0.0, 1.0]);
-        let rel = run_fx(
-            "ec.utility.colorprofileconverter",
-            &[("inputProfile", Value::Enum(3)), ("outputProfile", Value::Enum(1))],
-            g.clone(),
-            0.0,
-            EffectEnv::default(),
-        );
-        assert!(rel.img.get(0, 0)[0] < 0.0);
-        let per = run_fx(
-            "ec.utility.colorprofileconverter",
-            &[("inputProfile", Value::Enum(3)), ("outputProfile", Value::Enum(1)), ("intent", Value::Enum(0))],
-            g,
-            0.0,
-            EffectEnv::default(),
-        );
-        assert!(per.img.get(0, 0).iter().all(|v| *v >= -1e-6));
-    }
-
-    struct RefHost(Image);
-    impl EffectHost for RefHost {
-        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
-            None
-        }
-        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-            None
-        }
-        fn self_at(&self, _: f64, _: usize) -> Option<Buf> {
-            Some(Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 })
-        }
-    }
-
-    #[test]
-    fn color_stabilizer_matches_the_reference_frame() {
-        let mk = |k: f32, o: f32| {
-            let mut img = Image::new(40, 40);
-            for y in 0..40 {
-                for x in 0..40 {
-                    let v = (x as f32 / 40.0) * k + o;
-                    img.set(x, y, [v, v * 0.9, v * 0.8, 1.0]);
-                }
-            }
-            img
-        };
-        let reference = mk(1.0, 0.0);
-        let flicker = mk(0.8, 0.1);
-        let host = RefHost(reference.clone());
-        let env = EffectEnv { host: Some(&host), ..Default::default() };
-        let pts = [("blackPoint", Value::Vec2([5.0, 20.0])), ("midPoint", Value::Vec2([20.0, 20.0])), ("whitePoint", Value::Vec2([35.0, 20.0]))];
-        let mut vals: Vec<(&str, Value)> = pts.to_vec();
-        vals.push(("stabilize", Value::Enum(1)));
-        vals.push(("sampleSize", num(1.0)));
-        let out = run_fx("ec.color.colorstabilizer", &vals, flicker.clone(), 0.0, env);
-        for x in [5i64, 20, 35] {
-            let (o, r) = (out.img.get(x, 20), reference.get(x, 20));
-            assert!((o[0] - r[0]).abs() < 0.01, "x {x}: {o:?} vs {r:?}");
-        }
-        // Deterministic, and a no-op without a host.
-        let again = run_fx("ec.color.colorstabilizer", &vals, flicker.clone(), 0.0, env);
-        assert_eq!(out.img.data, again.img.data);
-        let none = run_fx("ec.color.colorstabilizer", &vals, flicker.clone(), 0.0, EffectEnv::default());
-        assert_eq!(none.img.data, flicker.data);
-        // Brightness mode corrects an offset at the black point.
-        let lifted = mk(1.0, 0.1);
-        let mut vals2: Vec<(&str, Value)> = pts.to_vec();
-        vals2.push(("sampleSize", num(1.0)));
-        let b = run_fx("ec.color.colorstabilizer", &vals2, lifted, 0.0, env);
-        assert!((b.img.get(5, 20)[0] - reference.get(5, 20)[0]).abs() < 0.01);
-    }
-}
+mod tests;
diff --git a/crates/effects/src/ocio/cdl.rs b/crates/effects/src/ocio/cdl.rs
new file mode 100644
index 000000000..dba8c68fe
--- /dev/null
+++ b/crates/effects/src/ocio/cdl.rs
@@ -0,0 +1,115 @@
+use super::{ParamUi, slider};
+
+// ---------------------------------------------------------------- ASC CDL
+
+/// An ASC Colour Decision List correction.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Cdl {
+    pub slope: [f64; 3],
+    pub offset: [f64; 3],
+    pub power: [f64; 3],
+    pub sat: f64,
+}
+
+impl Default for Cdl {
+    fn default() -> Self {
+        Cdl { slope: [1.0; 3], offset: [0.0; 3], power: [1.0; 3], sat: 1.0 }
+    }
+}
+
+const LUMA: [f64; 3] = [0.2126, 0.7152, 0.0722];
+
+impl Cdl {
+    /// Forward CDL. `clamp` = the v1.2 style (results clamped to 0..1 after SOP and saturation).
+    pub fn apply(&self, c: [f64; 3], clamp: bool) -> [f64; 3] {
+        let mut o = [0.0; 3];
+        for i in 0..3 {
+            let v = c[i] * self.slope[i] + self.offset[i];
+            o[i] = if clamp {
+                v.clamp(0.0, 1.0).powf(self.power[i])
+            } else if v >= 0.0 {
+                v.powf(self.power[i])
+            } else {
+                v
+            };
+        }
+        let l = o[0] * LUMA[0] + o[1] * LUMA[1] + o[2] * LUMA[2];
+        let o = o.map(|v| l + self.sat * (v - l));
+        if clamp { o.map(|v| v.clamp(0.0, 1.0)) } else { o }
+    }
+    /// Exact inverse of [`Cdl::apply`] (inside the clamped range).
+    pub fn invert(&self, c: [f64; 3], clamp: bool) -> [f64; 3] {
+        let c = if clamp { c.map(|v| v.clamp(0.0, 1.0)) } else { c };
+        let l = c[0] * LUMA[0] + c[1] * LUMA[1] + c[2] * LUMA[2];
+        let s = if self.sat.abs() < 1e-9 { 1e-9 } else { self.sat };
+        let o = c.map(|v| l + (v - l) / s);
+        let mut r = [0.0; 3];
+        for i in 0..3 {
+            let v = if clamp { o[i].clamp(0.0, 1.0) } else { o[i] };
+            let pw = self.power[i].max(1e-9);
+            let u = if v >= 0.0 { v.powf(1.0 / pw) } else { v };
+            let sl = if self.slope[i].abs() < 1e-9 { 1e-9 } else { self.slope[i] };
+            r[i] = (u - self.offset[i]) / sl;
+        }
+        if clamp { r.map(|v| v.clamp(0.0, 1.0)) } else { r }
+    }
+}
+
+fn tag<'a>(xml: &'a str, name: &str) -> Option<&'a str> {
+    let open = xml.find(&format!("<{name}"))?;
+    let gt = open + xml[open..].find('>')?;
+    if xml[..gt].ends_with('/') {
+        return Some("");
+    }
+    let close = xml[gt..].find(&format!("</{name}>"))? + gt;
+    Some(&xml[gt + 1..close])
+}
+
+fn nums3(s: &str) -> Option<[f64; 3]> {
+    let v: Vec<f64> = s.split_whitespace().filter_map(|t| t.parse().ok()).collect();
+    (v.len() >= 3).then(|| [v[0], v[1], v[2]])
+}
+
+fn parse_cc(block: &str) -> Cdl {
+    let mut c = Cdl::default();
+    if let Some(s) = tag(block, "Slope").and_then(nums3) {
+        c.slope = s;
+    }
+    if let Some(s) = tag(block, "Offset").and_then(nums3) {
+        c.offset = s;
+    }
+    if let Some(s) = tag(block, "Power").and_then(nums3) {
+        c.power = s;
+    }
+    if let Some(s) = tag(block, "Saturation").and_then(|t| t.trim().parse().ok()) {
+        c.sat = s;
+    }
+    c
+}
+
+/// Parse ASC CDL XML (`.cc`, `.ccc`, `.cdl`): every `<ColorCorrection>` with its `id`.
+pub fn parse_cdl_xml(xml: &str) -> Vec<(String, Cdl)> {
+    let mut out = vec![];
+    let mut rest = xml;
+    while let Some(i) = rest.find("<ColorCorrection") {
+        let after = &rest[i..];
+        let head_end = after.find('>').unwrap_or(after.len());
+        let head = &after[..head_end];
+        let id = head
+            .find("id=")
+            .and_then(|k| {
+                let q = head[k + 3..].chars().next()?;
+                let s = &head[k + 4..];
+                s.find(q).map(|e| s[..e].to_string())
+            })
+            .unwrap_or_default();
+        let end = after.find("</ColorCorrection>").map(|e| e + "</ColorCorrection>".len()).unwrap_or(after.len());
+        out.push((id, parse_cc(&after[..end])));
+        rest = &after[end..];
+    }
+    out
+}
+
+pub(super) fn sl(lo: f64, hi: f64, smin: f64, smax: f64) -> ParamUi {
+    slider(lo, hi, smin, smax, 3)
+}
diff --git a/crates/effects/src/ocio/effects.rs b/crates/effects/src/ocio/effects.rs
new file mode 100644
index 000000000..0eb7bd330
--- /dev/null
+++ b/crates/effects/src/ocio/effects.rs
@@ -0,0 +1,485 @@
+use super::cdl::Cdl;
+use super::lut::load_file;
+use super::space::{ACES_CCT, ACES_CG, ACES2065_1, D65, IDENTITY, P3, REC709, REC2020, SPACES, Space, Tf, Xform, matrix, sp, space_names};
+use super::{Buf, ColorSpace, EffectCtx, EffectSpec, IntoParallelRefMutIterator, ParallelIterator, Value, invert, mul, mul_vec, p, popup, unpremul};
+
+// ---------------------------------------------------------------- displays, views and looks
+
+/// Displays of the built-in config: (name, display primaries/white, encoding).
+pub const DISPLAYS: &[(&str, [[f64; 2]; 3], Tf)] =
+    &[("sRGB", REC709, Tf::Srgb), ("Rec.1886 Rec.709", REC709, Tf::Gamma(2.4)), ("Display P3", P3, Tf::Srgb), ("Rec.2100-PQ", REC2020, Tf::Pq)];
+
+pub const VIEWS: &[&str] = &["Standard", "Tone Mapped", "Raw"];
+
+/// Configuration popup: the built-in config, or a custom `.ocio` file (Config File: a path or
+/// the config's text; spaces chosen by name, see [`crate::ocio_config`]).
+pub const CONFIGS: &[&str] = &["Built-in (EffectCraft minimal)", "Custom (.ocio file)"];
+
+/// Built-in looks: CDLs applied in ACEScct.
+pub fn looks() -> Vec<(&'static str, Cdl)> {
+    let grey = 0.413_588_402_492_442_1; // ACEScct of 0.18
+    let c = |slope: [f64; 3], offset: [f64; 3], sat: f64| Cdl { slope, offset, power: [1.0; 3], sat };
+    vec![
+        ("Warm", c([1.04, 1.0, 0.94], [0.0; 3], 1.0)),
+        ("Cool", c([0.95, 1.0, 1.06], [0.0; 3], 1.0)),
+        ("High Contrast", c([1.25; 3], [grey * (1.0 - 1.25); 3], 1.0)),
+        ("Low Contrast", c([0.8; 3], [grey * (1.0 - 0.8); 3], 1.0)),
+        ("Desaturated", c([1.0; 3], [0.0; 3], 0.6)),
+        ("Vivid", c([1.0; 3], [0.0; 3], 1.3)),
+    ]
+}
+
+/// Extended Reinhard roll-off (white point 16): maps 0..∞ into 0..1, ≈ identity near 0.
+pub(super) fn tonemap(v: f64) -> f64 {
+    let w2 = 256.0;
+    if v <= 0.0 { v } else { v * (1.0 + v / w2) / (1.0 + v) }
+}
+
+pub(super) fn tonemap_inv(y: f64) -> f64 {
+    if y <= 0.0 {
+        return y;
+    }
+    // Solve v² / w² + v (1 − y) − y = 0.
+    let (a, b, c) = (1.0 / 256.0, 1.0 - y, -y);
+    (-b + (b * b - 4.0 * a * c).sqrt()) / (2.0 * a)
+}
+
+/// Display transform of an input-space colour (`inverse`: display code values → input space).
+pub fn display_xform(input: &Space, display: usize, view: usize, inverse: bool) -> impl Fn([f32; 3]) -> [f32; 3] + Sync {
+    let (_, prims, tf) = DISPLAYS[display.min(DISPLAYS.len() - 1)];
+    let disp = Space { name: "display", prims: Some((prims, D65)), tf: Tf::Linear, raw: false };
+    let raw = view == 2 || input.raw;
+    let m_in = Xform::new(&Space { tf: Tf::Linear, ..*input }, &disp);
+    let m_out = Xform::new(&disp, &Space { tf: Tf::Linear, ..*input });
+    let in_tf = input.tf;
+    move |c: [f32; 3]| {
+        if raw {
+            return c;
+        }
+        if !inverse {
+            let lin = c.map(|v| in_tf.decode(v as f64) as f32);
+            let d = m_in.apply(lin);
+            d.map(|v| {
+                let v = v as f64;
+                let v = if view == 1 { tonemap(v) } else { v };
+                tf.encode(v) as f32
+            })
+        } else {
+            let d = c.map(|v| {
+                let l = tf.decode(v as f64);
+                (if view == 1 { tonemap_inv(l) } else { l }) as f32
+            });
+            m_out.apply(d).map(|v| in_tf.encode(v as f64) as f32)
+        }
+    }
+}
+
+// ---------------------------------------------------------------- effects
+
+pub(super) fn spec(id: &'static str, name: &'static str, cat: &'static str, params: Vec<crate::ParamSpec>, render: crate::RenderFn) -> EffectSpec {
+    EffectSpec { id, name, category: cat, params, render, gpu: false, float: true }
+}
+
+pub(super) fn space_param(id: &'static str, name: &'static str, default: u32) -> crate::ParamSpec {
+    p(id, name, Value::Enum(default), popup(&space_names()))
+}
+
+pub(super) fn direction() -> crate::ParamSpec {
+    p("direction", "Direction", Value::Enum(0), popup(&["Forward", "Inverse"]))
+}
+
+fn map_px(b: &mut Buf, f: impl Fn([f32; 3]) -> [f32; 3] + Sync) {
+    b.img.data.par_iter_mut().for_each(|px| {
+        let (c, a) = unpremul(*px);
+        if a <= 0.0 {
+            return;
+        }
+        let o = f(c);
+        *px = [o[0] * a, o[1] * a, o[2] * a, a];
+    });
+}
+
+pub(super) fn space_at(i: u32) -> &'static Space {
+    &SPACES[(i as usize).min(SPACES.len() - 1)]
+}
+
+/// The effects that take Configuration ▸ Custom (a `.ocio` file).
+pub(crate) const CUSTOM_CONFIG_FX: [&str; 2] = ["ec.color.ociocolorspace", "ec.color.ociodisplay"];
+
+/// Effect `id`'s transform under Configuration ▸ Custom: the config's conversion from the source
+/// space to the destination space (Color Space Transform) or through a display's view (Display
+/// Transform), see [`crate::ocio_config`]. `Ok(None)` with the built-in configuration; an error
+/// (the pixels pass through) when the config can't be read or has no such colour space.
+pub(super) fn custom_xf(id: &str, pr: &crate::Params) -> Result<Option<crate::ocio_config::Xf>, String> {
+    use crate::ocio_config::Xf;
+    if !CUSTOM_CONFIG_FX.contains(&id) || pr.e("config") != 1 {
+        return Ok(None);
+    }
+    let cfg = crate::ocio_config::load_config(pr.s("configFile")).map_err(|e| format!("Can't read the OCIO config: {e}"))?;
+    // A space by its typed name, else by the built-in popup's name.
+    let space = |name: &str, popup: u32| {
+        let name = if name.trim().is_empty() { space_at(popup).name } else { name.trim() };
+        cfg.space(name).ok_or_else(|| format!("The OCIO config has no color space `{name}`"))
+    };
+    let a = space(pr.s("sourceName"), pr.e("source"))?;
+    let inverse = pr.e("direction") == 1;
+    if id == "ec.color.ociodisplay" {
+        let (dn, vn) = display_view_names(pr);
+        let xf = cfg.display_path(a, dn, vn);
+        return Ok(Some(if inverse { Xf::Inverse(Box::new(xf)) } else { xf }));
+    }
+    let z = space(pr.s("destinationName"), pr.e("destination"))?;
+    // Inverse: the conversion the other way (OCIO's inverse ColorSpaceTransform).
+    Ok(Some(if inverse { cfg.path(z, a) } else { cfg.path(a, z) }))
+}
+
+/// The display and view a Display Transform names: the typed names, else the popups'.
+fn display_view_names(pr: &crate::Params) -> (&str, &str) {
+    let display = DISPLAYS.get(pr.e("display") as usize).map_or("", |d| d.0);
+    let view = VIEWS.get(pr.e("view") as usize).copied().unwrap_or("");
+    let typed = |k: &str, popup| if pr.s(k).trim().is_empty() { popup } else { pr.s(k).trim() };
+    (typed("displayName", display), typed("viewName", view))
+}
+
+/// Effect Controls' warning for effect `id`: a custom OCIO configuration that can't be read, has
+/// no such colour space, display or view, or uses transforms EffectCraft can't apply (colours
+/// pass through those steps, #410). `None` when the effect renders as asked.
+pub fn warning(id: &str, pr: &crate::Params) -> Option<String> {
+    let xf = match custom_xf(id, pr) {
+        Ok(x) => x?,
+        Err(e) => return Some(format!("{e}: the colors pass through.")),
+    };
+    let mut notes = vec![];
+    if id == "ec.color.ociodisplay"
+        && let Ok(cfg) = crate::ocio_config::load_config(pr.s("configFile"))
+    {
+        let (dn, vn) = display_view_names(pr);
+        if let Some((d, v)) = cfg.view(dn, vn)
+            && (!d.eq_ignore_ascii_case(dn) || !v.name.eq_ignore_ascii_case(vn))
+        {
+            notes.push(format!("The OCIO config has no display `{dn}` with a view `{vn}`: showing {d} / {}.", v.name));
+        }
+    }
+    let missing = xf.unsupported_list();
+    if !missing.is_empty() {
+        notes.push(format!("Not supported, the colors pass through: {}.", missing.join(", ")));
+    }
+    (!notes.is_empty()).then(|| notes.join(" "))
+}
+
+/// Configuration ▸ Custom: render through the config's transform. `false` with the built-in
+/// configuration (the caller renders it).
+fn custom_render(id: &str, ctx: &EffectCtx, b: &mut Buf) -> bool {
+    match custom_xf(id, ctx.params) {
+        Ok(None) => false,
+        Ok(Some(xf)) => {
+            map_px(b, |c| xf.apply(c.map(|v| v as f64), false).map(|v| v as f32));
+            true
+        }
+        // A config that can't be read, or an unknown space: the pixels pass through.
+        Err(_) => true,
+    }
+}
+
+pub(super) fn ocio_cst(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    if custom_render("ec.color.ociocolorspace", ctx, &mut b) {
+        return b;
+    }
+    let (a, z) = (space_at(ctx.params.e("source")), space_at(ctx.params.e("destination")));
+    let (a, z) = if ctx.params.e("direction") == 1 { (z, a) } else { (a, z) };
+    if a.name == z.name {
+        return b;
+    }
+    let x = Xform::new(a, z);
+    map_px(&mut b, |c| x.apply(c));
+    b
+}
+
+pub(super) fn cdl_from_params(pr: &crate::Params) -> Cdl {
+    Cdl {
+        slope: [pr.f("slopeRed"), pr.f("slopeGreen"), pr.f("slopeBlue")],
+        offset: [pr.f("offsetRed"), pr.f("offsetGreen"), pr.f("offsetBlue")],
+        power: [pr.f("powerRed").max(0.0), pr.f("powerGreen").max(0.0), pr.f("powerBlue").max(0.0)],
+        sat: pr.f("saturation").max(0.0),
+    }
+}
+
+pub(super) fn ocio_cdl(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let cdl = cdl_from_params(ctx.params);
+    if cdl == Cdl::default() {
+        return b;
+    }
+    let clamp = ctx.params.e("style") == 0;
+    let inv = ctx.params.e("direction") == 1;
+    map_px(&mut b, |c| {
+        let c = c.map(|v| v as f64);
+        let o = if inv { cdl.invert(c, clamp) } else { cdl.apply(c, clamp) };
+        o.map(|v| v as f32)
+    });
+    b
+}
+
+pub(super) fn ocio_display(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    if custom_render("ec.color.ociodisplay", ctx, &mut b) {
+        return b;
+    }
+    let input = space_at(ctx.params.e("source"));
+    let f = display_xform(input, ctx.params.e("display") as usize, ctx.params.e("view") as usize, ctx.params.e("direction") == 1);
+    map_px(&mut b, f);
+    b
+}
+
+pub(super) fn ocio_file(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let Some(x) = load_file(ctx.params.s("file")) else { return b };
+    let interp = match ctx.params.e("interpolation") {
+        0 => 0,
+        1 => 1,
+        _ => 2,
+    };
+    let inv = ctx.params.e("direction") == 1;
+    let id = ctx.params.s("cccId").to_string();
+    map_px(&mut b, |c| x.apply(c, interp, inv, &id));
+    b
+}
+
+/// Parse a looks string: comma/space separated names, `-Name` = inverse.
+pub fn parse_looks(s: &str) -> Vec<(Cdl, bool)> {
+    let all = looks();
+    s.split([',', ':'])
+        .map(str::trim)
+        .filter(|t| !t.is_empty())
+        .filter_map(|t| {
+            let (inv, n) = match t.strip_prefix('-') {
+                Some(r) => (true, r.trim()),
+                None => (false, t.trim_start_matches('+').trim()),
+            };
+            all.iter().find(|(name, _)| name.eq_ignore_ascii_case(n)).map(|(_, c)| (*c, inv))
+        })
+        .collect()
+}
+
+pub(super) fn ocio_look(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let mut list = parse_looks(ctx.params.s("looks"));
+    let pick = ctx.params.e("look");
+    if pick > 0
+        && let Some((_, c)) = looks().get(pick as usize - 1)
+    {
+        list.insert(0, (*c, false));
+    }
+    if list.is_empty() {
+        return b;
+    }
+    let (src, dst) = (space_at(ctx.params.e("source")), space_at(ctx.params.e("destination")));
+    let inv = ctx.params.e("direction") == 1;
+    let cct = &ACES_CCT;
+    let (a, z) = if inv { (dst, src) } else { (src, dst) };
+    let to_p = Xform::new(a, cct);
+    let from_p = Xform::new(cct, z);
+    if inv {
+        list.reverse();
+    }
+    map_px(&mut b, |c| {
+        let mut v = to_p.apply(c).map(|x| x as f64);
+        for (cdl, li) in &list {
+            v = if *li != inv { cdl.invert(v, false) } else { cdl.apply(v, false) };
+        }
+        from_p.apply(v.map(|x| x as f32))
+    });
+    b
+}
+
+// ---- Color Profile Converter (Utility)
+
+pub const PROFILES: &[&str] = &["Project Working Space", "sRGB IEC61966-2.1", "HDTV (Rec. 709)", "Rec. 2020", "Display P3", "ACEScg", "ACES2065-1"];
+
+pub(super) fn profile(ctx: &EffectCtx, i: u32) -> (Space, bool) {
+    let ws = |cs: ColorSpace| match cs {
+        ColorSpace::Srgb => sp("sRGB", REC709, D65, Tf::Srgb),
+        ColorSpace::Rec709 => sp("Rec.709", REC709, D65, Tf::Gamma(2.4)),
+        ColorSpace::Rec2020 => sp("Rec.2020", REC2020, D65, Tf::Gamma(2.4)),
+        ColorSpace::DisplayP3 => sp("Display P3", P3, D65, Tf::Srgb),
+        ColorSpace::AcesCg => ACES_CG,
+        ColorSpace::Aces2065 => ACES2065_1,
+        // HDR encodings are output spaces, never a working space.
+        ColorSpace::Rec2100Pq | ColorSpace::Rec2100Hlg => sp("Rec.2020", REC2020, D65, Tf::Gamma(2.4)),
+    };
+    match i {
+        0 => (ws(ctx.env.working_space.unwrap_or(ColorSpace::Srgb)), ctx.env.working_linear),
+        1 => (ws(ColorSpace::Srgb), false),
+        2 => (ws(ColorSpace::Rec709), false),
+        3 => (ws(ColorSpace::Rec2020), false),
+        4 => (ws(ColorSpace::DisplayP3), false),
+        5 => (ACES_CG, true),
+        _ => (ACES2065_1, true),
+    }
+}
+
+/// Gamut compression for the perceptual intent: pull out-of-gamut (negative) colours toward
+/// their luminance just enough to bring every channel to ≥ 0, rolling off smoothly.
+fn compress_gamut(c: [f64; 3], luma: [f64; 3]) -> [f64; 3] {
+    let l = c[0] * luma[0] + c[1] * luma[1] + c[2] * luma[2];
+    if l <= 0.0 {
+        return c.map(|v| v.max(0.0));
+    }
+    let mn = c.iter().cloned().fold(f64::INFINITY, f64::min);
+    if mn >= 0.0 {
+        return c;
+    }
+    // Fraction of the way toward grey that reaches zero on the most negative channel.
+    let t = (l / (l - mn)).clamp(0.0, 1.0);
+    c.map(|v| l + (v - l) * t)
+}
+
+pub(super) fn profile_converter(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let (inp, in_lin_default) = profile(ctx, ctx.params.e("inputProfile"));
+    let (out, out_lin_default) = profile(ctx, ctx.params.e("outputProfile"));
+    let in_lin = ctx.params.b("linearizeInputProfile") || in_lin_default && ctx.params.e("inputProfile") == 0;
+    let out_lin = ctx.params.b("linearizeOutputProfile") || out_lin_default && ctx.params.e("outputProfile") == 0;
+    let intent = ctx.params.e("intent");
+    let dec = if in_lin { Tf::Linear } else { inp.tf };
+    let enc = if out_lin { Tf::Linear } else { out.tf };
+    // Absolute colorimetric keeps the source white (no adaptation); the others adapt.
+    let m = if intent == 3 { mul(&invert(&out.to_ref(false)), &inp.to_ref(false)) } else { matrix(&inp, &out) };
+    let identity = dec == enc && (0..3).all(|i| (0..3).all(|j| (m[i][j] - IDENTITY[i][j]).abs() < 1e-9));
+    if identity {
+        return b;
+    }
+    let out_luma = out.to_ref(true)[1];
+    map_px(&mut b, |c| {
+        let l = c.map(|v| dec.decode(v as f64));
+        let mut o = mul_vec(&m, l);
+        match intent {
+            0 => o = compress_gamut(o, out_luma),
+            2 => o = o.map(|v| v.max(0.0)),
+            _ => {}
+        }
+        o.map(|v| enc.encode(v) as f32)
+    });
+    b
+}
+
+// ---- Color Stabilizer
+
+/// Mean straight colour of a square (half-size `r` layer pixels) around layer point `pt`.
+fn sample_mean(b: &Buf, pt: [f64; 2], r: f64) -> [f64; 3] {
+    let (cx, cy) = b.to_px(pt);
+    let rr = (r * b.scale).max(0.5);
+    let (x0, x1) = ((cx - rr).floor().max(0.0) as i64, ((cx + rr).ceil() as i64).min(b.img.width as i64));
+    let (y0, y1) = ((cy - rr).floor().max(0.0) as i64, ((cy + rr).ceil() as i64).min(b.img.height as i64));
+    let mut acc = [0.0f64; 4];
+    for y in y0..y1 {
+        for x in x0..x1 {
+            let p = b.img.get(x, y);
+            for k in 0..4 {
+                acc[k] += p[k] as f64;
+            }
+        }
+    }
+    if acc[3] <= 1e-9 {
+        return [0.0; 3];
+    }
+    [acc[0] / acc[3], acc[1] / acc[3], acc[2] / acc[3]]
+}
+
+/// Monotone piecewise-quadratic curve through (0,0), three samples and (1,1) (linear between
+/// them is enough for a stabiliser and stays monotone).
+fn curve3(xs: [f64; 3], ys: [f64; 3], v: f64) -> f64 {
+    let mut pts = vec![(0.0, 0.0)];
+    let mut pairs: Vec<(f64, f64)> = xs.iter().cloned().zip(ys.iter().cloned()).collect();
+    pairs.sort_by(|a, b| a.0.total_cmp(&b.0));
+    for (x, y) in pairs {
+        if pts.last().is_some_and(|l| x > l.0 + 1e-4) && x < 1.0 - 1e-4 {
+            pts.push((x, y));
+        }
+    }
+    pts.push((1.0, 1.0));
+    let i = pts.partition_point(|p| p.0 < v).clamp(1, pts.len() - 1);
+    let (a, c) = (pts[i - 1], pts[i]);
+    a.1 + (c.1 - a.1) * (v - a.0) / (c.0 - a.0).max(1e-9)
+}
+
+/// The Black, Mid and White Point parameters.
+const STABILIZER_POINTS: [&str; 3] = ["blackPoint", "midPoint", "whitePoint"];
+
+/// Color Stabilizer's samples: the current frame's means at the points' current positions and
+/// the reference frame's means at the positions the points had at the reference time (After
+/// Effects samples the reference where the points were when it was set: with keyframed points a
+/// static picture is corrected, #3125). The points fall back to their current positions when
+/// the host can't evaluate them at the reference time. `None` without a host or reference frame.
+fn stabilizer_samples(ctx: &EffectCtx, b: &Buf) -> Option<([[f64; 3]; 3], [[f64; 3]; 3])> {
+    let host = ctx.env.host?;
+    let t_ref = ctx.params.f("referenceFrame");
+    let reference = host.self_at(t_ref, ctx.env.effect_index)?;
+    let r = ctx.params.f("sampleSize").max(0.5);
+    let pts = STABILIZER_POINTS.map(|id| ctx.params.v2(id));
+    let ref_params = host.params_at(t_ref);
+    let ref_pts = match &ref_params {
+        Some(p) => STABILIZER_POINTS.map(|id| p.v2(id)),
+        None => pts,
+    };
+    let cur = pts.map(|pt| sample_mean(b, pt, r));
+    let mut refv = [[0.0; 3]; 3];
+    for (o, pt) in refv.iter_mut().zip(ref_pts) {
+        *o = sample_mean(&reference, pt, r);
+    }
+    Some((cur, refv))
+}
+
+/// Color Stabilizer's correction of buffer `b` as one piecewise-linear map per channel (points
+/// with increasing x; the end segments extend), the same maps `color_stabilizer` applies.
+/// `None` without a host or reference frame (the layer passes through). (The GPU effect.)
+pub fn color_stabilizer_maps(ctx: &EffectCtx, b: &Buf) -> Option<[Vec<(f64, f64)>; 3]> {
+    let (cur, refv) = stabilizer_samples(ctx, b)?;
+    let mode = ctx.params.e("stabilize");
+    Some([0, 1, 2].map(|k| {
+        let offset = |c0: f64, r0: f64| vec![(0.0, r0 - c0), (1.0, 1.0 + r0 - c0)];
+        match mode {
+            0 => offset(cur[0][k], refv[0][k]),
+            1 => {
+                let (c0, c1, r0, r1) = (cur[0][k], cur[2][k], refv[0][k], refv[2][k]);
+                if (c1 - c0).abs() < 1e-6 {
+                    offset(c0, r0)
+                } else if c0 < c1 {
+                    vec![(c0, r0), (c1, r1)]
+                } else {
+                    vec![(c1, r1), (c0, r0)]
+                }
+            }
+            _ => {
+                let mut v = vec![(0.0, 0.0)];
+                let mut pairs: Vec<(f64, f64)> = (0..3).map(|i| (cur[i][k], refv[i][k])).collect();
+                pairs.sort_by(|a, b| a.0.total_cmp(&b.0));
+                for (x, y) in pairs {
+                    if v.last().is_some_and(|l| x > l.0 + 1e-4) && x < 1.0 - 1e-4 {
+                        v.push((x, y));
+                    }
+                }
+                v.push((1.0, 1.0));
+                v
+            }
+        }
+    }))
+}
+
+pub(super) fn color_stabilizer(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let Some((cur, refv)) = stabilizer_samples(ctx, &b) else { return b };
+    let mode = ctx.params.e("stabilize");
+    map_px(&mut b, |c| {
+        [0, 1, 2].map(|k| {
+            let v = c[k] as f64;
+            let o = match mode {
+                // Brightness: one sample (black point) — offset each channel.
+                0 => v + refv[0][k] - cur[0][k],
+                // Levels: black and white samples — linear map per channel.
+                1 => {
+                    let (c0, c1, r0, r1) = (cur[0][k], cur[2][k], refv[0][k], refv[2][k]);
+                    if (c1 - c0).abs() < 1e-6 { v + r0 - c0 } else { r0 + (v - c0) * (r1 - r0) / (c1 - c0) }
+                }
+                // Curves: three samples — a curve through them per channel.
+                _ => curve3([cur[0][k], cur[1][k], cur[2][k]], [refv[0][k], refv[1][k], refv[2][k]], v),
+            };
+            o as f32
+        })
+    });
+    b
+}
diff --git a/crates/effects/src/ocio/lut.rs b/crates/effects/src/ocio/lut.rs
new file mode 100644
index 000000000..de931a411
--- /dev/null
+++ b/crates/effects/src/ocio/lut.rs
@@ -0,0 +1,346 @@
+use super::cdl::{Cdl, parse_cdl_xml};
+use super::{Arc, HashMap, Lut, Mutex, OnceLock, parse_cube};
+
+// ---------------------------------------------------------------- LUT files
+
+/// A loaded transform file.
+#[derive(Clone, Debug)]
+pub enum FileXform {
+    /// A lattice/1D LUT with an optional per-channel piecewise-linear shaper (cineSpace pre-LUT).
+    Lut { lut: Lut, shaper: Option<[Vec<(f32, f32)>; 3]> },
+    /// CDL corrections by id (in file order).
+    Cdl(Vec<(String, Cdl)>),
+    /// A matrix with offset (Sony Imageworks `.spimtx`), as a MatrixTransform's.
+    Matrix { m: [f64; 16], offset: [f64; 4] },
+}
+
+/// Parse a Sony Imageworks `.spimtx` matrix: three rows of four numbers, three matrix columns
+/// and an offset in 16-bit code values (÷ 65535).
+pub fn parse_spimtx(text: &str) -> Option<FileXform> {
+    let v: Vec<f64> = text.split_whitespace().map(|t| t.parse().ok()).collect::<Option<_>>()?;
+    if v.len() != 12 || v.iter().any(|x| !x.is_finite()) {
+        return None;
+    }
+    let mut m = [0.0; 16];
+    let mut offset = [0.0; 4];
+    for (r, row) in v.as_chunks::<4>().0.iter().enumerate() {
+        m[r * 4..r * 4 + 3].copy_from_slice(&row[..3]);
+        offset[r] = row[3] / 65535.0;
+    }
+    m[15] = 1.0;
+    Some(FileXform::Matrix { m, offset })
+}
+
+/// Parse a Sony Imageworks `.spi1d` 1D LUT: `From <min> <max>`, `Length <n>`, `Components
+/// <1 | 3>`, then `{` the values `}`.
+pub fn parse_spi1d(text: &str) -> Option<Lut> {
+    let (mut from, mut len, mut comps) = ([0.0f32, 1.0], 0usize, 1usize);
+    let mut values: Vec<f32> = vec![];
+    let mut body = false;
+    for line in text.lines().map(str::trim).filter(|l| !l.is_empty()) {
+        if body {
+            if line.starts_with('}') {
+                break;
+            }
+            for t in line.split_whitespace() {
+                values.push(t.parse().ok()?);
+            }
+            continue;
+        }
+        let mut t = line.split_whitespace();
+        match t.next()? {
+            "{" => body = true,
+            "From" => from = [t.next()?.parse().ok()?, t.next()?.parse().ok()?],
+            "Length" => len = t.next()?.parse().ok()?,
+            "Components" => comps = t.next()?.parse().ok()?,
+            _ => {}
+        }
+    }
+    // A 1D table is interpolated by index, so cap it like the lattices (2²⁴ entries).
+    if !(2..=MAX_1D).contains(&len)
+        || !matches!(comps, 1 | 3)
+        || values.len() != len.checked_mul(comps)?
+        || from[1] <= from[0]
+        || from.iter().any(|v| !v.is_finite())
+    {
+        return None;
+    }
+    let d1 = values.chunks_exact(comps).map(|c| if comps == 3 { [c[0], c[1], c[2]] } else { [c[0]; 3] }).collect();
+    Some(Lut { n1: len, d1, n3: 0, d3: vec![], dmin: [from[0]; 3], dmax: [from[1]; 3] })
+}
+
+/// Parse a Sony Imageworks `.spi3d` lattice: `SPILUT 1.0`, `3 3`, the sizes, then one
+/// `r g b  R G B` line per lattice point (indices, then the colour).
+pub fn parse_spi3d(text: &str) -> Option<Lut> {
+    let mut lines = text.lines().map(str::trim).filter(|l| !l.is_empty());
+    if !lines.next()?.starts_with("SPILUT") {
+        return None;
+    }
+    lines.next()?;
+    let size: Vec<usize> = lines.next()?.split_whitespace().map(|t| t.parse().ok()).collect::<Option<_>>()?;
+    let n = *size.first()?;
+    if size.len() != 3 || size.iter().any(|s| *s != n) || !(2..=MAX_LATTICE).contains(&n) {
+        return None;
+    }
+    let mut d3 = vec![[0.0f32; 3]; n * n * n];
+    let mut seen = 0usize;
+    for line in lines {
+        let v: Vec<&str> = line.split_whitespace().collect();
+        let [r, g, b, cr, cg, cb] = v.as_slice() else { return None };
+        let (r, g, b): (usize, usize, usize) = (r.parse().ok()?, g.parse().ok()?, b.parse().ok()?);
+        if r >= n || g >= n || b >= n {
+            return None;
+        }
+        // Our lattice is red fastest.
+        *d3.get_mut(r + g * n + b * n * n)? = [cr.parse().ok()?, cg.parse().ok()?, cb.parse().ok()?];
+        seen += 1;
+    }
+    (seen == n * n * n).then_some(Lut { n1: 0, d1: vec![], n3: n, d3, dmin: [0.0; 3], dmax: [1.0; 3] })
+}
+
+/// Parse an Autodesk `.3dl` lattice (integers, blue fastest; an optional input-mesh line).
+pub fn parse_3dl(text: &str) -> Option<Lut> {
+    let mut mesh: Option<Vec<f64>> = None;
+    let mut rows: Vec<[f64; 3]> = vec![];
+    let mut out_bits: Option<u32> = None;
+    for line in text.lines() {
+        let l = line.trim();
+        if l.is_empty() || l.starts_with('#') || l.starts_with('<') {
+            continue;
+        }
+        if l.starts_with(|c: char| c.is_ascii_alphabetic()) {
+            // "Mesh <in bits> <out bits>" (Lustre header); other keywords are ignored.
+            let t: Vec<&str> = l.split_whitespace().collect();
+            if t[0].eq_ignore_ascii_case("mesh") && t.len() >= 3 {
+                out_bits = t[2].parse().ok();
+            }
+            continue;
+        }
+        let v: Vec<f64> = l.split_whitespace().filter_map(|t| t.parse().ok()).collect();
+        if v.len() > 3 && mesh.is_none() && rows.is_empty() {
+            mesh = Some(v);
+        } else if v.len() == 3 {
+            rows.push([v[0], v[1], v[2]]);
+        } else {
+            return None;
+        }
+    }
+    let is_cube = |k: usize| {
+        let n = (k as f64).cbrt().round() as usize;
+        n * n * n == k
+    };
+    // A 3-entry input mesh (3³ lattice) looks like a data row: tell them apart by the count.
+    if mesh.is_none() && !is_cube(rows.len()) && rows.len() == 28 {
+        mesh = Some(rows.remove(0).to_vec());
+    }
+    let n = match &mesh {
+        Some(m) => m.len(),
+        None => (rows.len() as f64).cbrt().round() as usize,
+    };
+    if n < 2 || rows.len() != n * n * n {
+        return None;
+    }
+    let maxv = rows.iter().flat_map(|r| r.iter()).fold(0.0f64, |m, &v| m.max(v));
+    let out_max = match out_bits {
+        Some(b) if b > 0 && b < 32 => (1u64 << b) as f64 - 1.0,
+        _ => [255.0, 1023.0, 4095.0, 65535.0].into_iter().find(|&m| maxv <= m).unwrap_or(maxv.max(1.0)),
+    };
+    // .3dl rows: red slowest, blue fastest. Our lattice is red fastest.
+    let mut d3 = vec![[0.0f32; 3]; n * n * n];
+    for (k, r) in rows.iter().enumerate() {
+        let (ri, gi, bi) = (k / (n * n), (k / n) % n, k % n);
+        d3[ri + gi * n + bi * n * n] = r.map(|v| (v / out_max) as f32);
+    }
+    Some(Lut { n1: 0, d1: vec![], n3: n, d3, dmin: [0.0; 3], dmax: [1.0; 3] })
+}
+
+/// Largest lattice side the lattice readers accept (`.spi3d`, `.csp`).
+const MAX_LATTICE: usize = 129;
+/// Most entries of a 1D table (interpolated by index, so capped like the lattices: 2²⁴).
+const MAX_1D: usize = 1 << 24;
+
+/// Parse a cineSpace `.csp` LUT (1D or 3D, with its three pre-LUT shapers).
+pub fn parse_csp(text: &str) -> Option<(Lut, [Vec<(f32, f32)>; 3])> {
+    let mut lines = text.lines().map(str::trim).filter(|l| !l.is_empty());
+    if !lines.next()?.starts_with("CSPLUTV100") {
+        return None;
+    }
+    let kind = lines.next()?;
+    let mut lines = lines.peekable();
+    if lines.peek().is_some_and(|l| l.starts_with("BEGIN METADATA")) {
+        for l in lines.by_ref() {
+            if l.starts_with("END METADATA") {
+                break;
+            }
+        }
+    }
+    let nums = |l: &str| -> Option<Vec<f32>> { l.split_whitespace().map(|t| t.parse().ok()).collect() };
+    let mut shaper: [Vec<(f32, f32)>; 3] = Default::default();
+    for ch in shaper.iter_mut() {
+        let n: usize = lines.next()?.parse().ok()?;
+        let ins = nums(lines.next()?)?;
+        let outs = nums(lines.next()?)?;
+        if ins.len() != n || outs.len() != n || n < 2 {
+            return None;
+        }
+        *ch = ins.into_iter().zip(outs).collect();
+    }
+    if kind.starts_with("3D") {
+        let sz = nums(lines.next()?)?;
+        if sz.len() != 3 || sz[0] != sz[1] || sz[1] != sz[2] {
+            return None;
+        }
+        // The size comes from the file: an integer lattice size the other lattice readers accept
+        // (2..=129), checked before anything is allocated. Rows are read before they are stored,
+        // so a short file never reserves the table it claims.
+        let n = sz[0];
+        if n.fract() != 0.0 || !(2.0..=MAX_LATTICE as f32).contains(&n) {
+            return None;
+        }
+        let n = n as usize;
+        let mut d3 = Vec::new();
+        for _ in 0..n * n * n {
+            let v = nums(lines.next()?)?;
+            if v.len() != 3 {
+                return None;
+            }
+            d3.push([v[0], v[1], v[2]]);
+        }
+        Some((Lut { n1: 0, d1: vec![], n3: n, d3, dmin: [0.0; 3], dmax: [1.0; 3] }, shaper))
+    } else {
+        let n: usize = lines.next()?.parse().ok()?;
+        if !(2..=MAX_1D).contains(&n) {
+            return None;
+        }
+        let mut d1 = Vec::new();
+        for _ in 0..n {
+            let v = nums(lines.next()?)?;
+            if v.len() != 3 {
+                return None;
+            }
+            d1.push([v[0], v[1], v[2]]);
+        }
+        Some((Lut { n1: n, d1, n3: 0, d3: vec![], dmin: [0.0; 3], dmax: [1.0; 3] }, shaper))
+    }
+}
+
+fn shape(curve: &[(f32, f32)], x: f32) -> f32 {
+    if curve.len() < 2 {
+        return x;
+    }
+    let i = curve.partition_point(|p| p.0 < x).clamp(1, curve.len() - 1);
+    let (a, b) = (curve[i - 1], curve[i]);
+    let t = ((x - a.0) / (b.0 - a.0).max(1e-12)).clamp(0.0, 1.0);
+    a.1 + (b.1 - a.1) * t
+}
+
+fn shape_inv(curve: &[(f32, f32)], y: f32) -> f32 {
+    let flipped: Vec<(f32, f32)> = curve.iter().map(|&(a, b)| (b, a)).collect();
+    shape(&flipped, y)
+}
+
+/// Parse transform text by its format (detected from `ext` or the content).
+pub fn parse_file(text: &str, ext: &str) -> Option<FileXform> {
+    let ext = ext.to_ascii_lowercase();
+    if ext == "cc" || ext == "ccc" || ext == "cdl" || text.contains("<ColorCorrection") {
+        let v = parse_cdl_xml(text);
+        return (!v.is_empty()).then_some(FileXform::Cdl(v));
+    }
+    if ext == "csp" || text.trim_start().starts_with("CSPLUTV100") {
+        return parse_csp(text).map(|(lut, s)| FileXform::Lut { lut, shaper: Some(s) });
+    }
+    if ext == "spimtx" {
+        return parse_spimtx(text);
+    }
+    if ext == "spi1d" || text.trim_start().starts_with("Version") {
+        return parse_spi1d(text).map(|lut| FileXform::Lut { lut, shaper: None });
+    }
+    if ext == "spi3d" || text.trim_start().starts_with("SPILUT") {
+        return parse_spi3d(text).map(|lut| FileXform::Lut { lut, shaper: None });
+    }
+    if ext == "cube" || text.contains("LUT_3D_SIZE") || text.contains("LUT_1D_SIZE") {
+        return parse_cube(text).map(|lut| FileXform::Lut { lut, shaper: None });
+    }
+    parse_3dl(text).map(|lut| FileXform::Lut { lut, shaper: None })
+}
+
+type FileCache = Mutex<HashMap<String, Option<Arc<FileXform>>>>;
+
+/// Load (and cache) a transform from a file path or inline content.
+pub fn load_file(src: &str) -> Option<Arc<FileXform>> {
+    let src_t = src.trim();
+    if src_t.is_empty() {
+        return None;
+    }
+    static CACHE: OnceLock<FileCache> = OnceLock::new();
+    let cache = CACHE.get_or_init(|| Mutex::new(HashMap::new()));
+    if let Ok(m) = cache.lock()
+        && let Some(v) = m.get(src)
+    {
+        return v.clone();
+    }
+    let inline = src.contains('\n');
+    let parsed = if inline {
+        parse_file(src, "")
+    } else {
+        let ext = std::path::Path::new(src_t).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("");
+        std::fs::read_to_string(src_t).ok().and_then(|t| parse_file(&t, ext))
+    }
+    .map(Arc::new);
+    if let Ok(mut m) = cache.lock() {
+        m.insert(src.to_string(), parsed.clone());
+    }
+    parsed
+}
+
+impl FileXform {
+    pub fn apply(&self, c: [f32; 3], interp: u32, inverse: bool, ccc_id: &str) -> [f32; 3] {
+        match self {
+            FileXform::Cdl(list) => {
+                let cdl = list.iter().find(|(id, _)| !ccc_id.is_empty() && id == ccc_id).or(list.first()).map(|(_, c)| *c).unwrap_or_default();
+                let c64 = c.map(|v| v as f64);
+                let o = if inverse { cdl.invert(c64, true) } else { cdl.apply(c64, true) };
+                o.map(|v| v as f32)
+            }
+            FileXform::Matrix { m, offset } => crate::ocio_config::matrix_apply(m, offset, c.map(|v| v as f64), inverse).map(|v| v as f32),
+            FileXform::Lut { lut, shaper } => {
+                let fwd = |c: [f32; 3]| {
+                    let c = match shaper {
+                        Some(s) => [shape(&s[0], c[0]), shape(&s[1], c[1]), shape(&s[2], c[2])],
+                        None => c,
+                    };
+                    lut.apply_interp(c, interp)
+                };
+                if !inverse {
+                    return fwd(c);
+                }
+                if lut.n3 == 0 {
+                    // 1D: invert each channel exactly through the (monotone) tables.
+                    let mut x = c;
+                    if lut.n1 > 1 {
+                        x = [0, 1, 2].map(|i| {
+                            let curve: Vec<(f32, f32)> =
+                                (0..lut.n1).map(|k| (lut.d1[k][i], lut.dmin[i] + (lut.dmax[i] - lut.dmin[i]) * k as f32 / (lut.n1 - 1) as f32)).collect();
+                            shape(&curve, c[i])
+                        });
+                    }
+                    if let Some(s) = shaper {
+                        x = [shape_inv(&s[0], x[0]), shape_inv(&s[1], x[1]), shape_inv(&s[2], x[2])];
+                    }
+                    return x;
+                }
+                // 3D: damped fixed-point (Newton with an identity Jacobian) from the target.
+                let mut x = c;
+                for _ in 0..40 {
+                    let y = fwd(x);
+                    let e = [c[0] - y[0], c[1] - y[1], c[2] - y[2]];
+                    if e.iter().all(|v| v.abs() < 1e-6) {
+                        break;
+                    }
+                    x = [x[0] + e[0], x[1] + e[1], x[2] + e[2]];
+                }
+                x
+            }
+        }
+    }
+}
diff --git a/crates/effects/src/ocio/program.rs b/crates/effects/src/ocio/program.rs
new file mode 100644
index 000000000..a223dc7b4
--- /dev/null
+++ b/crates/effects/src/ocio/program.rs
@@ -0,0 +1,252 @@
+use super::cdl::Cdl;
+use super::effects::{DISPLAYS, cdl_from_params, custom_xf, looks, parse_looks, profile, space_at};
+use super::lut::{FileXform, load_file};
+use super::space::{ACES_CCT, D65, IDENTITY, Space, Tf, Xform, matrix};
+use super::{Arc, EffectCtx, Lut, invert, mul};
+
+// ---- Colour programs (the GPU compositor's colour-management kernels)
+
+/// One per-pixel step of a colour transform, in the order the CPU effect applies them (see
+/// [`color_program`]).
+#[derive(Clone, Debug)]
+pub enum ColorOp {
+    /// Transfer function, encoded → linear.
+    Decode(Tf),
+    /// Transfer function, linear → encoded.
+    Encode(Tf),
+    /// Linear-RGB matrix.
+    Matrix([[f32; 3]; 3]),
+    /// ASC CDL (forward or exact inverse; `clamp` = the v1.2 style).
+    Cdl { cdl: Cdl, clamp: bool, inverse: bool },
+    /// The Tone Mapped view's roll-off (or its inverse).
+    Tonemap { inverse: bool },
+    /// Color Profile Converter's perceptual gamut compression toward luminance `luma`.
+    Gamut([f64; 3]),
+    /// Negative channels to 0 (the saturation intent).
+    Max0,
+    /// A LUT (0 nearest, 1 trilinear, 2 tetrahedral) with an optional per-channel shaper, forward
+    /// or inverse (as `FileXform::apply`).
+    Lut { lut: Arc<Lut>, shaper: Option<Arc<[Vec<(f32, f32)>; 3]>>, interp: u32, inverse: bool },
+    /// `m × (c + pre) + post` (a custom config's MatrixTransform and RangeTransform).
+    Affine { m: [[f32; 3]; 3], pre: [f32; 3], post: [f32; 3] },
+    /// `max(c, 0) ^ p` per channel (ExponentTransform).
+    Pow([f32; 3]),
+    /// LogTransform / LogAffineTransform, forward or inverse (as `ocio_config::Xf::apply`).
+    LogAffine { base: f32, log_slope: [f32; 3], log_offset: [f32; 3], lin_slope: [f32; 3], lin_offset: [f32; 3], inverse: bool },
+    /// ExponentWithLinearTransform, forward (decode) or inverse (as
+    /// [`crate::ocio_config::moncurve`]).
+    MonCurve { gamma: [f32; 3], offset: [f32; 3], inverse: bool, mirror: bool },
+    /// Clamp each channel to `lo..=hi` (a clamping RangeTransform; ±`f32::MAX` = unbounded).
+    Clamp { lo: [f32; 3], hi: [f32; 3] },
+}
+
+/// The ops of a matrix-and-offset transform (MatrixTransform, `.spimtx`), forward or inverse
+/// (as [`crate::ocio_config::matrix_apply`]).
+fn matrix_ops(m: &[f64; 16], offset: &[f64; 4], inverse: bool, ops: &mut Vec<ColorOp>) {
+    if !inverse {
+        let m = [0, 1, 2].map(|r| [m[r * 4] as f32, m[r * 4 + 1] as f32, m[r * 4 + 2] as f32]);
+        ops.push(ColorOp::Affine { m, pre: [0.0; 3], post: [offset[0] as f32, offset[1] as f32, offset[2] as f32] });
+    } else if let Some(inv) = crate::ocio_config::mat3_inverse(m) {
+        let m = inv.map(|r| r.map(|v| v as f32));
+        ops.push(ColorOp::Affine { m, pre: [-offset[0] as f32, -offset[1] as f32, -offset[2] as f32], post: [0.0; 3] });
+    }
+}
+
+/// The ops of a LUT / CDL / matrix file transform (as [`FileXform::apply`]).
+fn file_ops(x: &FileXform, interp: u32, inverse: bool, ccc_id: &str, ops: &mut Vec<ColorOp>) {
+    match x {
+        FileXform::Cdl(list) => {
+            let cdl = list.iter().find(|(i, _)| !ccc_id.is_empty() && i == ccc_id).or(list.first()).map(|(_, c)| *c).unwrap_or_default();
+            ops.push(ColorOp::Cdl { cdl, clamp: true, inverse });
+        }
+        FileXform::Lut { lut, shaper } => {
+            ops.push(ColorOp::Lut { lut: Arc::new(lut.clone()), shaper: shaper.clone().map(Arc::new), interp, inverse });
+        }
+        FileXform::Matrix { m, offset } => matrix_ops(m, offset, inverse, ops),
+    }
+}
+
+/// The ops of a custom config's transform `x` (as `Xf::apply`).
+fn config_xf_ops(x: &crate::ocio_config::Xf, inverse: bool, ops: &mut Vec<ColorOp>) {
+    use crate::ocio_config::Xf;
+    let f3 = |v: &[f64; 3]| v.map(|x| x as f32);
+    match x {
+        Xf::Inverse(x) => config_xf_ops(x, !inverse, ops),
+        Xf::Matrix { m, offset } => matrix_ops(m, offset, inverse, ops),
+        Xf::File { xf: Some(x), interp, ccc, .. } => file_ops(x, *interp, inverse, ccc, ops),
+        Xf::ExponentLinear { gamma, offset, mirror } => ops.push(ColorOp::MonCurve { gamma: f3(gamma), offset: f3(offset), inverse, mirror: *mirror }),
+        // A BuiltinTransform's curve: forward decodes.
+        Xf::Curve(tf) => ops.push(if inverse { ColorOp::Encode(*tf) } else { ColorOp::Decode(*tf) }),
+        Xf::Named(_) => {}
+        Xf::File { xf: None, .. } | Xf::Unsupported(_) => {}
+        Xf::Exponent(e) => ops.push(ColorOp::Pow([0, 1, 2].map(|k| (if inverse { 1.0 / e[k].max(1e-9) } else { e[k] }) as f32))),
+        Xf::Log { base } => {
+            ops.push(ColorOp::LogAffine { base: *base as f32, log_slope: [1.0; 3], log_offset: [0.0; 3], lin_slope: [1.0; 3], lin_offset: [0.0; 3], inverse })
+        }
+        Xf::LogAffine { base, log_slope, log_offset, lin_slope, lin_offset } => ops.push(ColorOp::LogAffine {
+            base: *base as f32,
+            log_slope: f3(log_slope),
+            log_offset: f3(log_offset),
+            lin_slope: f3(lin_slope),
+            lin_offset: f3(lin_offset),
+            inverse,
+        }),
+        Xf::Cdl(cdl) => ops.push(ColorOp::Cdl { cdl: *cdl, clamp: true, inverse }),
+        Xf::Range(r) => {
+            let (k, off, lo, hi) = r.parts(inverse);
+            let k = k as f32;
+            ops.push(ColorOp::Affine { m: [[k, 0.0, 0.0], [0.0, k, 0.0], [0.0, 0.0, k]], pre: [0.0; 3], post: [off as f32; 3] });
+            if lo.is_finite() || hi.is_finite() {
+                let bound = |v: f64| (v as f32).clamp(-f32::MAX, f32::MAX);
+                ops.push(ColorOp::Clamp { lo: [bound(lo); 3], hi: [bound(hi); 3] });
+            }
+        }
+        Xf::Group(list) => {
+            if inverse {
+                list.iter().rev().for_each(|x| config_xf_ops(x, true, ops));
+            } else {
+                list.iter().for_each(|x| config_xf_ops(x, false, ops));
+            }
+        }
+    }
+}
+
+/// How a colour program meets premultiplied pixels.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Straight {
+    /// `unpremul` (colour 0 below alpha 1e-6); fully transparent pixels untouched (OCIO effects).
+    Unpremul,
+    /// Colour ÷ alpha; fully transparent pixels untouched (`Image::map_straight`, Apply Color LUT).
+    Divide,
+}
+
+fn xform_ops(x: &Xform, ops: &mut Vec<ColorOp>) {
+    if x.dec != Tf::Linear {
+        ops.push(ColorOp::Decode(x.dec));
+    }
+    if !x.ident {
+        ops.push(ColorOp::Matrix(x.m));
+    }
+    if x.enc != Tf::Linear {
+        ops.push(ColorOp::Encode(x.enc));
+    }
+}
+
+/// Effect `id`'s per-pixel transform as a list of [`ColorOp`]s that reproduces the CPU effect
+/// (empty = the layer passes through; custom OCIO configs compile their transforms too). `None`
+/// for another effect.
+pub fn color_program(id: &str, ctx: &EffectCtx) -> Option<(Vec<ColorOp>, Straight)> {
+    let pr = ctx.params;
+    let mut ops = vec![];
+    // Configuration ▸ Custom compiles the config's transforms (a config that can't be read, or
+    // names unknown spaces, passes the pixels through).
+    match custom_xf(id, pr) {
+        Ok(None) => {}
+        Ok(Some(xf)) => {
+            config_xf_ops(&xf, false, &mut ops);
+            return Some((ops, Straight::Unpremul));
+        }
+        Err(_) => return Some((ops, Straight::Unpremul)),
+    }
+    match id {
+        "ec.utility.applylut" => {
+            if let Some(lut) = crate::utility::load_lut(pr.s("lut")) {
+                ops.push(ColorOp::Lut { lut, shaper: None, interp: 2, inverse: false });
+            }
+            return Some((ops, Straight::Divide));
+        }
+        "ec.color.ociocolorspace" => {
+            let (a, z) = (space_at(pr.e("source")), space_at(pr.e("destination")));
+            let (a, z) = if pr.e("direction") == 1 { (z, a) } else { (a, z) };
+            if a.name != z.name {
+                xform_ops(&Xform::new(a, z), &mut ops);
+            }
+        }
+        "ec.color.ociocdl" => {
+            let cdl = cdl_from_params(pr);
+            if cdl != Cdl::default() {
+                ops.push(ColorOp::Cdl { cdl, clamp: pr.e("style") == 0, inverse: pr.e("direction") == 1 });
+            }
+        }
+        "ec.color.ociodisplay" => {
+            let input = space_at(pr.e("source"));
+            let (display, view, inverse) = (pr.e("display") as usize, pr.e("view") as usize, pr.e("direction") == 1);
+            let (_, prims, tf) = DISPLAYS[display.min(DISPLAYS.len() - 1)];
+            if view != 2 && !input.raw {
+                let disp = Space { name: "display", prims: Some((prims, D65)), tf: Tf::Linear, raw: false };
+                let lin = Space { tf: Tf::Linear, ..*input };
+                if !inverse {
+                    ops.push(ColorOp::Decode(input.tf));
+                    xform_ops(&Xform::new(&lin, &disp), &mut ops);
+                    if view == 1 {
+                        ops.push(ColorOp::Tonemap { inverse: false });
+                    }
+                    ops.push(ColorOp::Encode(tf));
+                } else {
+                    ops.push(ColorOp::Decode(tf));
+                    if view == 1 {
+                        ops.push(ColorOp::Tonemap { inverse: true });
+                    }
+                    xform_ops(&Xform::new(&disp, &lin), &mut ops);
+                    ops.push(ColorOp::Encode(input.tf));
+                }
+            }
+        }
+        "ec.color.ociofile" => {
+            if let Some(x) = load_file(pr.s("file")) {
+                let interp = match pr.e("interpolation") {
+                    0 => 0,
+                    1 => 1,
+                    _ => 2,
+                };
+                file_ops(&x, interp, pr.e("direction") == 1, pr.s("cccId"), &mut ops);
+            }
+        }
+        "ec.color.ociolook" => {
+            let mut list = parse_looks(pr.s("looks"));
+            let pick = pr.e("look");
+            if pick > 0
+                && let Some((_, c)) = looks().get(pick as usize - 1)
+            {
+                list.insert(0, (*c, false));
+            }
+            if !list.is_empty() {
+                let (src, dst) = (space_at(pr.e("source")), space_at(pr.e("destination")));
+                let inv = pr.e("direction") == 1;
+                let cct = &ACES_CCT;
+                let (a, z) = if inv { (dst, src) } else { (src, dst) };
+                if inv {
+                    list.reverse();
+                }
+                xform_ops(&Xform::new(a, cct), &mut ops);
+                for (cdl, li) in &list {
+                    ops.push(ColorOp::Cdl { cdl: *cdl, clamp: false, inverse: *li != inv });
+                }
+                xform_ops(&Xform::new(cct, z), &mut ops);
+            }
+        }
+        "ec.utility.colorprofileconverter" => {
+            let (inp, in_lin_default) = profile(ctx, pr.e("inputProfile"));
+            let (out, out_lin_default) = profile(ctx, pr.e("outputProfile"));
+            let in_lin = pr.b("linearizeInputProfile") || in_lin_default && pr.e("inputProfile") == 0;
+            let out_lin = pr.b("linearizeOutputProfile") || out_lin_default && pr.e("outputProfile") == 0;
+            let intent = pr.e("intent");
+            let dec = if in_lin { Tf::Linear } else { inp.tf };
+            let enc = if out_lin { Tf::Linear } else { out.tf };
+            let m = if intent == 3 { mul(&invert(&out.to_ref(false)), &inp.to_ref(false)) } else { matrix(&inp, &out) };
+            let identity = dec == enc && (0..3).all(|i| (0..3).all(|j| (m[i][j] - IDENTITY[i][j]).abs() < 1e-9));
+            if !identity {
+                ops.push(ColorOp::Decode(dec));
+                ops.push(ColorOp::Matrix(m.map(|r| r.map(|v| v as f32))));
+                match intent {
+                    0 => ops.push(ColorOp::Gamut(out.to_ref(true)[1])),
+                    2 => ops.push(ColorOp::Max0),
+                    _ => {}
+                }
+                ops.push(ColorOp::Encode(enc));
+            }
+        }
+        _ => return None,
+    }
+    Some((ops, Straight::Unpremul))
+}
diff --git a/crates/effects/src/ocio/registry.rs b/crates/effects/src/ocio/registry.rs
new file mode 100644
index 000000000..cd3bd02a7
--- /dev/null
+++ b/crates/effects/src/ocio/registry.rs
@@ -0,0 +1,129 @@
+use super::cdl::sl;
+use super::effects::{
+    CONFIGS, DISPLAYS, PROFILES, VIEWS, color_stabilizer, direction, looks, ocio_cdl, ocio_cst, ocio_display, ocio_file, ocio_look, profile_converter,
+    space_param, spec,
+};
+use super::space::SPACES;
+use super::{EffectSpec, ParamUi, Value, num, p, popup, slider};
+
+pub fn specs() -> Vec<EffectSpec> {
+    let cc = "Color Correction";
+    let srgb = SPACES.iter().position(|s| s.name == "sRGB").unwrap_or(0) as u32;
+    let lin709 = SPACES.iter().position(|s| s.name == "Linear Rec.709 (sRGB)").unwrap_or(0) as u32;
+    let acescg = SPACES.iter().position(|s| s.name == "ACEScg").unwrap_or(0) as u32;
+    let mut look_opts = vec!["None"];
+    look_opts.extend(looks().iter().map(|(n, _)| *n));
+    vec![
+        spec(
+            "ec.color.ociocdl",
+            "OCIO CDL Transform",
+            cc,
+            vec![
+                p("slopeRed", "Slope Red", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("slopeGreen", "Slope Green", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("slopeBlue", "Slope Blue", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("offsetRed", "Offset Red", num(0.0), sl(-100.0, 100.0, -1.0, 1.0)),
+                p("offsetGreen", "Offset Green", num(0.0), sl(-100.0, 100.0, -1.0, 1.0)),
+                p("offsetBlue", "Offset Blue", num(0.0), sl(-100.0, 100.0, -1.0, 1.0)),
+                p("powerRed", "Power Red", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("powerGreen", "Power Green", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("powerBlue", "Power Blue", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("saturation", "Saturation", num(1.0), sl(0.0, 100.0, 0.0, 4.0)),
+                p("style", "Style", Value::Enum(0), popup(&["ASC CDL v1.2", "No Clamp"])),
+                direction(),
+            ],
+            ocio_cdl,
+        ),
+        spec(
+            "ec.color.ociocolorspace",
+            "OCIO Color Space Transform",
+            cc,
+            vec![
+                p("config", "Configuration", Value::Enum(0), popup(CONFIGS)),
+                p("configFile", "Config File (.ocio)", Value::Str(String::new()), crate::file_ui(&["ocio"])),
+                space_param("source", "Source", lin709),
+                p("sourceName", "Source (config name)", Value::Str(String::new()), ParamUi::Text),
+                space_param("destination", "Destination", srgb),
+                p("destinationName", "Destination (config name)", Value::Str(String::new()), ParamUi::Text),
+                direction(),
+            ],
+            ocio_cst,
+        ),
+        spec(
+            "ec.color.ociodisplay",
+            "OCIO Display Transform",
+            cc,
+            vec![
+                p("config", "Configuration", Value::Enum(0), popup(CONFIGS)),
+                p("configFile", "Config File (.ocio)", Value::Str(String::new()), crate::file_ui(&["ocio"])),
+                space_param("source", "Input Color Space", lin709),
+                p("sourceName", "Source (config name)", Value::Str(String::new()), ParamUi::Text),
+                p("display", "Display Device", Value::Enum(0), popup(&DISPLAYS.iter().map(|d| d.0).collect::<Vec<_>>())),
+                p("displayName", "Display (config name)", Value::Str(String::new()), ParamUi::Text),
+                p("view", "View Transform", Value::Enum(0), popup(VIEWS)),
+                p("viewName", "View (config name)", Value::Str(String::new()), ParamUi::Text),
+                direction(),
+            ],
+            ocio_display,
+        ),
+        // `file`: a path to a .cube/.3dl/.csp/.cc/.ccc/.cdl file, or the file's text itself.
+        spec(
+            "ec.color.ociofile",
+            "OCIO File Transform",
+            cc,
+            vec![
+                p("file", "File", Value::Str(String::new()), crate::file_ui(&["cube", "3dl", "csp", "cc", "ccc", "cdl", "spi1d", "spi3d", "spimtx"])),
+                p("cccId", "CCC ID", Value::Str(String::new()), ParamUi::Text),
+                p("interpolation", "Interpolation", Value::Enum(3), popup(&["Nearest", "Linear", "Tetrahedral", "Best"])),
+                direction(),
+            ],
+            ocio_file,
+        ),
+        spec(
+            "ec.color.ociolook",
+            "OCIO Look Transform",
+            cc,
+            vec![
+                p("config", "Configuration", Value::Enum(0), popup(&["Built-in (EffectCraft minimal)"])),
+                space_param("source", "Source", acescg),
+                space_param("destination", "Destination", acescg),
+                p("look", "Look", Value::Enum(0), popup(&look_opts)),
+                p("looks", "Looks", Value::Str(String::new()), ParamUi::Text),
+                direction(),
+            ],
+            ocio_look,
+        ),
+        spec(
+            "ec.color.colorstabilizer",
+            "Color Stabilizer",
+            cc,
+            vec![
+                // The pivot frame (After Effects' Set Frame button stores it).
+                p("referenceFrame", "Reference Frame (s)", num(0.0), slider(-100000.0, 100000.0, 0.0, 60.0, 2)),
+                p("stabilize", "Stabilize", Value::Enum(0), popup(&["Brightness", "Levels", "Curves"])),
+                p("blackPoint", "Black Point", Value::Vec2([0.25, 0.75]), ParamUi::Point),
+                p("midPoint", "Mid Point", Value::Vec2([0.5, 0.5]), ParamUi::Point),
+                p("whitePoint", "White Point", Value::Vec2([0.75, 0.25]), ParamUi::Point),
+                p("sampleSize", "Sample Size", num(5.0), slider(1.0, 100.0, 1.0, 50.0, 0)),
+            ],
+            color_stabilizer,
+        ),
+        spec(
+            "ec.utility.colorprofileconverter",
+            "Color Profile Converter",
+            "Utility",
+            vec![
+                p("inputProfile", "Input Profile", Value::Enum(0), popup(PROFILES)),
+                p("linearizeInputProfile", "Linearize Input Profile", Value::Bool(false), ParamUi::Checkbox),
+                p("outputProfile", "Output Profile", Value::Enum(1), popup(PROFILES)),
+                p("linearizeOutputProfile", "Linearize Output Profile", Value::Bool(false), ParamUi::Checkbox),
+                p("intent", "Intent", Value::Enum(1), popup(&["Perceptual", "Relative Colorimetric", "Saturation", "Absolute Colorimetric"])),
+                // Our built-in profiles share a zero black point and none is scene-referred, so
+                // these two are kept for compatibility and do not change the result.
+                p("useBlackPointCompensation", "Use Black Point Compensation", Value::Bool(true), ParamUi::Checkbox),
+                p("sceneRefCompensation", "Scene-ref. Profile Compensation", Value::Enum(2), popup(&["On", "Off", "Use Project Setting"])),
+            ],
+            profile_converter,
+        ),
+    ]
+}
diff --git a/crates/effects/src/ocio/space.rs b/crates/effects/src/ocio/space.rs
new file mode 100644
index 000000000..1a1d8f69b
--- /dev/null
+++ b/crates/effects/src/ocio/space.rs
@@ -0,0 +1,214 @@
+use super::{invert, mul, mul_vec, rgb_to_xyz};
+
+pub(super) type M3 = [[f64; 3]; 3];
+
+pub(crate) const D65: [f64; 2] = [0.3127, 0.3290];
+
+const ACES_WHITE: [f64; 2] = [0.32168, 0.33767];
+
+const AP0: [[f64; 2]; 3] = [[0.7347, 0.2653], [0.0, 1.0], [0.0001, -0.0770]];
+
+const AP1: [[f64; 2]; 3] = [[0.713, 0.293], [0.165, 0.830], [0.128, 0.044]];
+
+pub(crate) const REC709: [[f64; 2]; 3] = [[0.640, 0.330], [0.300, 0.600], [0.150, 0.060]];
+
+pub(crate) const REC2020: [[f64; 2]; 3] = [[0.708, 0.292], [0.170, 0.797], [0.131, 0.046]];
+
+pub(crate) const P3: [[f64; 2]; 3] = [[0.680, 0.320], [0.265, 0.690], [0.150, 0.060]];
+
+pub(super) const IDENTITY: M3 = [[1.0, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]];
+
+/// Transfer functions (encoded ↔ linear).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Tf {
+    Linear,
+    Srgb,
+    Gamma(f64),
+    AcesCct,
+    /// ACEScc (Academy S-2014-003), the pure-log grading encoding.
+    AcesCc,
+    /// SMPTE ST 2084 with 1.0 = 100 cd/m².
+    Pq,
+}
+
+/// ACEScc: the lowest code value (linear 0 and below) and the end of its toe (linear 2⁻¹⁵).
+const ACESCC_MIN: f64 = (-16.0 + 9.72) / 17.52;
+
+const ACESCC_TOE: f64 = (-15.0 + 9.72) / 17.52;
+
+impl Tf {
+    pub fn decode(self, v: f64) -> f64 {
+        match self {
+            Tf::Linear => v,
+            Tf::Srgb => {
+                let a = v.abs();
+                let l = if a <= 0.04045 { a / 12.92 } else { ((a + 0.055) / 1.055).powf(2.4) };
+                l.copysign(v)
+            }
+            Tf::Gamma(g) => v.abs().powf(g).copysign(v),
+            Tf::AcesCct => {
+                if v <= 0.155_251_141_552_511 {
+                    (v - 0.072_905_534_195_835_5) / 10.540_237_741_654_5
+                } else if v < (65504f64.log2() + 9.72) / 17.52 {
+                    2f64.powf(v * 17.52 - 9.72)
+                } else {
+                    65504.0
+                }
+            }
+            Tf::AcesCc => {
+                if v < ACESCC_TOE {
+                    (2f64.powf(v * 17.52 - 9.72) - 2f64.powi(-16)) * 2.0
+                } else if v < (65504f64.log2() + 9.72) / 17.52 {
+                    2f64.powf(v * 17.52 - 9.72)
+                } else {
+                    65504.0
+                }
+            }
+            Tf::Pq => {
+                let (m1, m2, c1, c2, c3) = pq_consts();
+                let e = v.max(0.0).powf(1.0 / m2);
+                let l = ((e - c1).max(0.0) / (c2 - c3 * e)).powf(1.0 / m1);
+                l * 100.0
+            }
+        }
+    }
+    pub fn encode(self, v: f64) -> f64 {
+        match self {
+            Tf::Linear => v,
+            Tf::Srgb => {
+                let a = v.abs();
+                let e = if a <= 0.003_130_8 { a * 12.92 } else { 1.055 * a.powf(1.0 / 2.4) - 0.055 };
+                e.copysign(v)
+            }
+            Tf::Gamma(g) => v.abs().powf(1.0 / g).copysign(v),
+            Tf::AcesCct => {
+                if v <= 0.007_812_5 {
+                    10.540_237_741_654_5 * v + 0.072_905_534_195_835_5
+                } else {
+                    (v.log2() + 9.72) / 17.52
+                }
+            }
+            Tf::AcesCc => {
+                if v <= 0.0 {
+                    ACESCC_MIN
+                } else if v < 2f64.powi(-15) {
+                    ((2f64.powi(-16) + v * 0.5).log2() + 9.72) / 17.52
+                } else {
+                    (v.log2() + 9.72) / 17.52
+                }
+            }
+            Tf::Pq => {
+                let (m1, m2, c1, c2, c3) = pq_consts();
+                let y = (v / 100.0).max(0.0).powf(m1);
+                ((c1 + c2 * y) / (1.0 + c3 * y)).powf(m2)
+            }
+        }
+    }
+}
+
+fn pq_consts() -> (f64, f64, f64, f64, f64) {
+    (2610.0 / 16384.0, 2523.0 / 4096.0 * 128.0, 3424.0 / 4096.0, 2413.0 / 4096.0 * 32.0, 2392.0 / 4096.0 * 32.0)
+}
+
+/// A colour space of the built-in config.
+#[derive(Clone, Copy, Debug)]
+pub struct Space {
+    pub name: &'static str,
+    /// Primaries and white (None = CIE XYZ itself).
+    pub prims: Option<([[f64; 2]; 3], [f64; 2])>,
+    pub tf: Tf,
+    /// Passes data through untouched.
+    pub raw: bool,
+}
+
+pub(crate) const fn sp(name: &'static str, prims: [[f64; 2]; 3], white: [f64; 2], tf: Tf) -> Space {
+    Space { name, prims: Some((prims, white)), tf, raw: false }
+}
+
+/// The built-in configuration's colour spaces, in popup order.
+pub(crate) const ACES2065_1: Space = sp("ACES2065-1", AP0, ACES_WHITE, Tf::Linear);
+
+pub(crate) const ACES_CG: Space = sp("ACEScg", AP1, ACES_WHITE, Tf::Linear);
+
+pub(super) const ACES_CCT: Space = sp("ACEScct", AP1, ACES_WHITE, Tf::AcesCct);
+
+pub const SPACES: &[Space] = &[
+    ACES2065_1,
+    ACES_CG,
+    ACES_CCT,
+    sp("Linear Rec.709 (sRGB)", REC709, D65, Tf::Linear),
+    sp("sRGB", REC709, D65, Tf::Srgb),
+    sp("Gamma 2.4 Rec.709", REC709, D65, Tf::Gamma(2.4)),
+    sp("Linear Rec.2020", REC2020, D65, Tf::Linear),
+    sp("Gamma 2.4 Rec.2020", REC2020, D65, Tf::Gamma(2.4)),
+    sp("Linear P3-D65", P3, D65, Tf::Linear),
+    sp("Display P3", P3, D65, Tf::Srgb),
+    Space { name: "CIE-XYZ-D65", prims: None, tf: Tf::Linear, raw: false },
+    Space { name: "Raw", prims: None, tf: Tf::Linear, raw: true },
+];
+
+pub fn space_names() -> Vec<&'static str> {
+    SPACES.iter().map(|s| s.name).collect()
+}
+
+#[cfg(test)]
+pub fn space_by_name(n: &str) -> Option<&'static Space> {
+    SPACES.iter().find(|s| s.name.eq_ignore_ascii_case(n))
+}
+
+/// Bradford chromatic adaptation from white `src` to white `dst` (xy).
+pub fn bradford(src: [f64; 2], dst: [f64; 2]) -> M3 {
+    if src == dst {
+        return IDENTITY;
+    }
+    const MB: M3 = [[0.8951, 0.2664, -0.1614], [-0.7502, 1.7135, 0.0367], [0.0389, -0.0685, 1.0296]];
+    let xyz = |c: [f64; 2]| [c[0] / c[1], 1.0, (1.0 - c[0] - c[1]) / c[1]];
+    let s = mul_vec(&MB, xyz(src));
+    let d = mul_vec(&MB, xyz(dst));
+    let diag = [[d[0] / s[0], 0.0, 0.0], [0.0, d[1] / s[1], 0.0], [0.0, 0.0, d[2] / s[2]]];
+    mul(&invert(&MB), &mul(&diag, &MB))
+}
+
+impl Space {
+    /// Linear RGB → XYZ D65 (Bradford-adapted when `adapt`, else the space's own white).
+    pub fn to_ref(self, adapt: bool) -> M3 {
+        match self.prims {
+            None => IDENTITY,
+            Some((p, w)) => {
+                let m = rgb_to_xyz(p, w);
+                if adapt { mul(&bradford(w, D65), &m) } else { m }
+            }
+        }
+    }
+}
+
+/// Linear-RGB matrix from space `a` to space `b`.
+pub fn matrix(a: &Space, b: &Space) -> M3 {
+    mul(&invert(&b.to_ref(true)), &a.to_ref(true))
+}
+
+/// A compiled colour-space conversion.
+#[derive(Clone, Copy, Debug)]
+pub struct Xform {
+    pub(super) dec: Tf,
+    pub(super) m: [[f32; 3]; 3],
+    pub(super) ident: bool,
+    pub(super) enc: Tf,
+}
+
+impl Xform {
+    pub fn new(a: &Space, b: &Space) -> Xform {
+        if a.raw || b.raw {
+            return Xform { dec: Tf::Linear, m: IDENTITY.map(|r| r.map(|v| v as f32)), ident: true, enc: Tf::Linear };
+        }
+        let m = matrix(a, b);
+        let ident = (0..3).all(|i| (0..3).all(|j| (m[i][j] - IDENTITY[i][j]).abs() < 1e-12));
+        Xform { dec: a.tf, m: m.map(|r| r.map(|v| v as f32)), ident, enc: b.tf }
+    }
+    #[inline]
+    pub fn apply(&self, c: [f32; 3]) -> [f32; 3] {
+        let l = c.map(|v| self.dec.decode(v as f64) as f32);
+        let l = if self.ident { l } else { [0, 1, 2].map(|i| self.m[i][0] * l[0] + self.m[i][1] * l[1] + self.m[i][2] * l[2]) };
+        l.map(|v| self.enc.encode(v as f64) as f32)
+    }
+}
diff --git a/crates/effects/src/ocio/tests.rs b/crates/effects/src/ocio/tests.rs
new file mode 100644
index 000000000..fe93dd25a
--- /dev/null
+++ b/crates/effects/src/ocio/tests.rs
@@ -0,0 +1,398 @@
+use super::*;
+use crate::{EffectEnv, EffectHost, Image, LayerPixels, run_fx};
+
+fn close(a: M3, b: M3, tol: f64) {
+    for i in 0..3 {
+        for j in 0..3 {
+            assert!((a[i][j] - b[i][j]).abs() < tol, "{a:?} vs {b:?}");
+        }
+    }
+}
+
+#[test]
+fn aces_matrices_match_published_values() {
+    let ap0 = space_by_name("ACES2065-1").unwrap();
+    let ap1 = space_by_name("ACEScg").unwrap();
+    // Academy S-2014-004 AP0 → AP1.
+    close(
+        matrix(ap0, ap1),
+        [
+            [1.451_439_316_1, -0.236_510_746_9, -0.214_928_569_3],
+            [-0.076_553_773_4, 1.176_229_699_8, -0.099_675_926_4],
+            [0.008_316_148_4, -0.006_032_449_8, 0.997_716_301_4],
+        ],
+        2e-4,
+    );
+    // ACEScg → linear Rec.709 with Bradford adaptation (published ACES config value).
+    let lin = space_by_name("Linear Rec.709 (sRGB)").unwrap();
+    close(matrix(ap1, lin), [[1.705_05, -0.621_79, -0.083_26], [-0.130_26, 1.140_80, -0.010_55], [-0.024_00, -0.128_97, 1.152_97]], 2e-3);
+    // White maps to white.
+    let w = mul_vec(&matrix(ap1, lin), [1.0, 1.0, 1.0]);
+    assert!(w.iter().all(|v| (v - 1.0).abs() < 1e-3), "{w:?}");
+}
+
+#[test]
+fn transfer_functions_round_trip() {
+    for tf in [Tf::Srgb, Tf::Gamma(2.4), Tf::AcesCct, Tf::Pq] {
+        for v in [0.0, 0.001, 0.18, 0.5, 1.0, 4.0] {
+            let r = tf.decode(tf.encode(v));
+            assert!((r - v).abs() < 1e-6 * v.max(1.0), "{tf:?} {v} {r}");
+        }
+    }
+    // ACEScct of 18 % grey (S-2016-001).
+    assert!((Tf::AcesCct.encode(0.18) - 0.413_588).abs() < 1e-5);
+    // PQ: 100 nits (1.0) encodes to ≈ 0.508.
+    assert!((Tf::Pq.encode(1.0) - 0.508).abs() < 1e-3);
+}
+
+#[test]
+fn color_space_transform_effect_round_trips() {
+    let img = Image::filled(4, 4, [0.2, 0.5, 0.7, 1.0]);
+    let srgb = SPACES.iter().position(|s| s.name == "sRGB").unwrap() as u32;
+    let cg = SPACES.iter().position(|s| s.name == "ACEScg").unwrap() as u32;
+    let a = run_fx("ec.color.ociocolorspace", &[("source", Value::Enum(srgb)), ("destination", Value::Enum(cg))], img.clone(), 0.0, EffectEnv::default());
+    assert_ne!(a.img.data, img.data);
+    let b = run_fx("ec.color.ociocolorspace", &[("source", Value::Enum(cg)), ("destination", Value::Enum(srgb))], a.img.clone(), 0.0, EffectEnv::default());
+    let c = run_fx(
+        "ec.color.ociocolorspace",
+        &[("source", Value::Enum(srgb)), ("destination", Value::Enum(cg)), ("direction", Value::Enum(1))],
+        a.img,
+        0.0,
+        EffectEnv::default(),
+    );
+    for (x, y) in b.img.data.iter().zip(&img.data).chain(c.img.data.iter().zip(&img.data)) {
+        assert!((0..4).all(|k| (x[k] - y[k]).abs() < 1e-4), "{x:?} {y:?}");
+    }
+}
+
+#[test]
+fn cdl_math() {
+    let cdl = Cdl { slope: [1.2, 1.0, 0.8], offset: [0.05, 0.0, -0.02], power: [1.1, 1.0, 0.9], sat: 0.8 };
+    let c = [0.3, 0.5, 0.7];
+    // Hand computation of the v1.2 formula.
+    let sop = [(0.3f64 * 1.2 + 0.05).powf(1.1), 0.5, (0.7f64 * 0.8 - 0.02).powf(0.9)];
+    let l = sop[0] * 0.2126 + sop[1] * 0.7152 + sop[2] * 0.0722;
+    let want = sop.map(|v| l + 0.8 * (v - l));
+    let got = cdl.apply(c, true);
+    for k in 0..3 {
+        assert!((got[k] - want[k]).abs() < 1e-12);
+    }
+    let back = cdl.invert(got, true);
+    for k in 0..3 {
+        assert!((back[k] - c[k]).abs() < 1e-9);
+    }
+    // v1.2 clamps, No Clamp keeps negatives.
+    let neg = Cdl { offset: [-0.5; 3], ..Cdl::default() };
+    assert_eq!(neg.apply([0.2; 3], true), [0.0; 3]);
+    assert!((neg.apply([0.2; 3], false)[0] + 0.3).abs() < 1e-12);
+    let img = Image::filled(2, 2, [0.3, 0.5, 0.7, 1.0]);
+    let out = run_fx("ec.color.ociocdl", &[("slopeRed", num(1.2)), ("offsetRed", num(0.05)), ("powerRed", num(1.1))], img, 0.0, EffectEnv::default());
+    let r = (0.3f64 * 1.2 + 0.05).powf(1.1);
+    assert!((out.img.get(0, 0)[0] as f64 - r).abs() < 1e-5);
+}
+
+fn identity_lattice(n: usize, f: impl Fn([f32; 3]) -> [f32; 3]) -> Vec<[f32; 3]> {
+    let mut v = vec![];
+    for b in 0..n {
+        for g in 0..n {
+            for r in 0..n {
+                let s = (n - 1) as f32;
+                v.push(f([r as f32 / s, g as f32 / s, b as f32 / s]));
+            }
+        }
+    }
+    v
+}
+
+/// Sony Imageworks `.spi1d`, `.spi3d` and `.spimtx` (Blender's configs use them, #410), and
+/// malformed ones rejected without panicking.
+#[test]
+fn spi_files_parse() {
+    let spi1d = "Version 1\nFrom 0.0 2.0\nLength 3\nComponents 1\n{\n0.0\n0.25\n1.0\n}\n";
+    let x = parse_file(spi1d, "spi1d").unwrap();
+    let o = x.apply([1.0, 0.5, 2.0], 1, false, "");
+    assert!((o[0] - 0.25).abs() < 1e-6 && (o[1] - 0.125).abs() < 1e-6 && (o[2] - 1.0).abs() < 1e-6, "{o:?}");
+    let back = x.apply(o, 1, true, "");
+    assert!((back[0] - 1.0).abs() < 1e-5 && (back[2] - 2.0).abs() < 1e-5, "{back:?}");
+    let three = parse_spi1d("Version 1\nFrom 0 1\nLength 2\nComponents 3\n{\n0 0 0\n1 0.5 2\n}\n").unwrap();
+    assert_eq!(three.d1, vec![[0.0; 3], [1.0, 0.5, 2.0]]);
+    let mut spi3d = String::from("SPILUT 1.0\n3 3\n2 2 2\n");
+    for (r, g, b) in (0..8).map(|i| (i & 1, (i >> 1) & 1, i >> 2)) {
+        spi3d += &format!("{r} {g} {b} {} {} {}\n", r as f32 * 0.5, g, b);
+    }
+    let x = parse_file(&spi3d, "spi3d").unwrap();
+    let o = x.apply([1.0, 0.5, 0.25], 1, false, "");
+    assert!((o[0] - 0.5).abs() < 1e-6 && (o[1] - 0.5).abs() < 1e-6 && (o[2] - 0.25).abs() < 1e-6, "{o:?}");
+    let m = parse_file("2 0 0 6553.5\n0 1 0 0\n0 0 1 0\n", "spimtx").unwrap();
+    let o = m.apply([0.25, 0.5, 1.0], 1, false, "");
+    assert!((o[0] - 0.6).abs() < 1e-6 && o[1] == 0.5 && o[2] == 1.0, "{o:?}");
+    assert!((m.apply(o, 1, true, "")[0] - 0.25).abs() < 1e-6);
+    for bad in [
+        "Version 1\nFrom 0 1\nLength 99999999999\nComponents 1\n{\n0\n}\n",
+        "Version 1\nFrom 1 0\nLength 2\nComponents 1\n{\n0\n1\n}\n",
+        "Version 1\nFrom 0 1\nLength 3\nComponents 1\n{\n0\n1\n}\n",
+        "Version 1\nFrom 0 1\nLength 2\nComponents 2\n{\n0 0\n1 1\n}\n",
+    ] {
+        assert!(parse_spi1d(bad).is_none(), "{bad}");
+    }
+    assert!(parse_spi3d("SPILUT 1.0\n3 3\n4000 4000 4000\n").is_none());
+    assert!(parse_spi3d("SPILUT 1.0\n3 3\n2 2 2\n9 0 0 1 1 1\n").is_none());
+    assert!(parse_spi3d("SPILUT 1.0\n3 3\n2 2 2\n0 0 0 1 1 1\n").is_none(), "incomplete lattice");
+    assert!(parse_spimtx("1 0 0\n0 1 0\n").is_none());
+    assert!(parse_spimtx("NaN 0 0 0 0 1 0 0 0 0 1 0").is_none());
+}
+
+#[test]
+fn lut_files_parse_and_interpolate() {
+    // .cube with a non-linear lattice: trilinear between lattice points.
+    let f = |c: [f32; 3]| [c[0] * c[0], c[1], 1.0 - c[2]];
+    let mut cube = String::from("LUT_3D_SIZE 3\n");
+    for r in identity_lattice(3, f) {
+        cube += &format!("{} {} {}\n", r[0], r[1], r[2]);
+    }
+    let Some(FileXform::Lut { lut, .. }) = parse_file(&cube, "cube") else { panic!() };
+    // Trilinear between 0.5 (0.25) and 1.0 (1.0) at 0.75 → 0.625.
+    let o = lut.apply_interp([0.75, 0.3, 0.2], 1);
+    assert!((o[0] - 0.625).abs() < 1e-6 && (o[1] - 0.3).abs() < 1e-6 && (o[2] - 0.8).abs() < 1e-6, "{o:?}");
+    // Nearest snaps.
+    assert_eq!(lut.apply_interp([0.74, 0.0, 0.0], 0)[0], 0.25);
+    // .3dl (blue fastest, 10-bit integers, mesh line).
+    let mut tdl = String::from("0 511 1023\n");
+    for r in 0..3 {
+        for g in 0..3 {
+            for b in 0..3 {
+                let v = [r, g, b].map(|i| i as f64 * 511.5);
+                tdl += &format!("{} {} {}\n", v[0].round(), v[1].round(), (1023.0 - v[2]).round());
+            }
+        }
+    }
+    let Some(FileXform::Lut { lut, .. }) = parse_file(&tdl, "3dl") else { panic!() };
+    let o = lut.apply_interp([0.25, 0.5, 0.25], 1);
+    assert!((o[0] - 0.25).abs() < 2e-3 && (o[1] - 0.5).abs() < 2e-3 && (o[2] - 0.75).abs() < 2e-3, "{o:?}");
+    // .csp with a squaring pre-LUT on red and an identity 2³ lattice.
+    let mut csp = String::from("CSPLUTV100\n3D\n\n3\n0 0.5 1\n0 0.25 1\n2\n0 1\n0 1\n2\n0 1\n0 1\n\n2 2 2\n");
+    for r in identity_lattice(2, |c| c) {
+        csp += &format!("{} {} {}\n", r[0], r[1], r[2]);
+    }
+    let x = parse_file(&csp, "csp").unwrap();
+    let o = x.apply([0.5, 0.4, 0.6], 2, false, "");
+    assert!((o[0] - 0.25).abs() < 1e-6 && (o[1] - 0.4).abs() < 1e-6, "{o:?}");
+    let inv = x.apply(o, 2, true, "");
+    assert!((inv[0] - 0.5).abs() < 1e-4, "{inv:?}");
+    // A .csp whose header claims a huge or fractional table is refused before anything is reserved.
+    let head = "CSPLUTV100\n{k}\n\n2\n0 1\n0 1\n2\n0 1\n0 1\n2\n0 1\n0 1\n\n";
+    for (k, size) in [("3D", "100000 100000 100000"), ("3D", "130 130 130"), ("3D", "2.5 2.5 2.5"), ("1D", "4000000000000")] {
+        let text = head.replace("{k}", k) + size + "\n0 0 0\n";
+        assert!(parse_file(&text, "csp").is_none(), "{k} {size}");
+    }
+    // A short file that claims a valid size is refused once its rows run out.
+    assert!(parse_file(&(head.replace("{k}", "3D") + "129 129 129\n0 0 0\n"), "csp").is_none());
+    // CDL collection: pick by id.
+    let ccc = r#"<ColorCorrectionCollection><ColorCorrection id="a"><SOPNode><Slope>2 2 2</Slope><Offset>0 0 0</Offset><Power>1 1 1</Power></SOPNode></ColorCorrection>
+            <ColorCorrection id='b'><SOPNode><Slope>0.5 0.5 0.5</Slope></SOPNode><SatNode><Saturation>1</Saturation></SatNode></ColorCorrection></ColorCorrectionCollection>"#;
+    let x = parse_file(ccc, "ccc").unwrap();
+    assert!((x.apply([0.4; 3], 2, false, "b")[0] - 0.2).abs() < 1e-6);
+    assert!((x.apply([0.4; 3], 2, false, "a")[0] - 0.8).abs() < 1e-6);
+    assert!((x.apply([0.4; 3], 2, false, "")[0] - 0.8).abs() < 1e-6);
+    // Effect with inline content; inverse of a 3D lattice.
+    let img = Image::filled(2, 2, [0.6, 0.3, 0.2, 1.0]);
+    let out = run_fx("ec.color.ociofile", &[("file", Value::Str(cube.clone()))], img.clone(), 0.0, EffectEnv::default());
+    let back = run_fx("ec.color.ociofile", &[("file", Value::Str(cube)), ("direction", Value::Enum(1))], out.img, 0.0, EffectEnv::default());
+    assert!((back.img.get(0, 0)[0] - 0.6).abs() < 1e-3, "{:?}", back.img.get(0, 0));
+    assert!(parse_file("garbage", "3dl").is_none());
+}
+
+#[test]
+fn display_and_look_transforms() {
+    // Linear 0.18 through the sRGB display / Standard view = sRGB encoding of 0.18.
+    let img = Image::filled(2, 2, [0.18, 0.18, 0.18, 1.0]);
+    let out = run_fx("ec.color.ociodisplay", &[], img.clone(), 0.0, EffectEnv::default());
+    assert!((out.img.get(0, 0)[0] as f64 - Tf::Srgb.encode(0.18)).abs() < 1e-5);
+    let back = run_fx("ec.color.ociodisplay", &[("direction", Value::Enum(1))], out.img, 0.0, EffectEnv::default());
+    assert!((back.img.get(0, 0)[0] - 0.18).abs() < 1e-5);
+    // Tone mapped view keeps highlights below 1.
+    let hot = Image::filled(1, 1, [8.0, 8.0, 8.0, 1.0]);
+    let tm = run_fx("ec.color.ociodisplay", &[("view", Value::Enum(1))], hot, 0.0, EffectEnv::default());
+    assert!(tm.img.get(0, 0)[0] < 1.0);
+    assert!((tonemap_inv(tonemap(3.0)) - 3.0).abs() < 1e-9);
+    // Looks: Warm raises red over blue; its inverse undoes it.
+    let grey = Image::filled(1, 1, [0.18, 0.18, 0.18, 1.0]);
+    let w = run_fx("ec.color.ociolook", &[("looks", Value::Str("Warm".into()))], grey.clone(), 0.0, EffectEnv::default());
+    let px = w.img.get(0, 0);
+    assert!(px[0] > px[2]);
+    let u = run_fx("ec.color.ociolook", &[("looks", Value::Str("-Warm".into()))], w.img, 0.0, EffectEnv::default());
+    assert!((u.img.get(0, 0)[0] - 0.18).abs() < 1e-4 && (u.img.get(0, 0)[2] - 0.18).abs() < 1e-4);
+    assert_eq!(parse_looks("Warm, -Cool, nope").len(), 2);
+}
+
+#[test]
+fn profile_converter_converts_and_round_trips() {
+    let img = Image::filled(2, 2, [0.8, 0.4, 0.1, 1.0]);
+    // sRGB → Rec. 2020 (relative), then back.
+    let a = run_fx(
+        "ec.utility.colorprofileconverter",
+        &[("inputProfile", Value::Enum(1)), ("outputProfile", Value::Enum(3))],
+        img.clone(),
+        0.0,
+        EffectEnv::default(),
+    );
+    assert_ne!(a.img.data, img.data);
+    let b =
+        run_fx("ec.utility.colorprofileconverter", &[("inputProfile", Value::Enum(3)), ("outputProfile", Value::Enum(1))], a.img, 0.0, EffectEnv::default());
+    assert!((0..3).all(|k| (b.img.get(0, 0)[k] - img.get(0, 0)[k]).abs() < 1e-4));
+    // Same profile both sides: identity. Working space defaults to sRGB.
+    let c = run_fx(
+        "ec.utility.colorprofileconverter",
+        &[("inputProfile", Value::Enum(0)), ("outputProfile", Value::Enum(1))],
+        img.clone(),
+        0.0,
+        EffectEnv::default(),
+    );
+    assert_eq!(c.img.data, img.data);
+    // Perceptual pulls out-of-gamut colours inside: saturated Rec.2020 green into sRGB.
+    let g = Image::filled(1, 1, [0.0, 1.0, 0.0, 1.0]);
+    let rel = run_fx(
+        "ec.utility.colorprofileconverter",
+        &[("inputProfile", Value::Enum(3)), ("outputProfile", Value::Enum(1))],
+        g.clone(),
+        0.0,
+        EffectEnv::default(),
+    );
+    assert!(rel.img.get(0, 0)[0] < 0.0);
+    let per = run_fx(
+        "ec.utility.colorprofileconverter",
+        &[("inputProfile", Value::Enum(3)), ("outputProfile", Value::Enum(1)), ("intent", Value::Enum(0))],
+        g,
+        0.0,
+        EffectEnv::default(),
+    );
+    assert!(per.img.get(0, 0).iter().all(|v| *v >= -1e-6));
+}
+
+struct RefHost(Image);
+impl EffectHost for RefHost {
+    fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+        None
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn self_at(&self, _: f64, _: usize) -> Option<Buf> {
+        Some(Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 })
+    }
+}
+
+#[test]
+fn color_stabilizer_matches_the_reference_frame() {
+    let mk = |k: f32, o: f32| {
+        let mut img = Image::new(40, 40);
+        for y in 0..40 {
+            for x in 0..40 {
+                let v = (x as f32 / 40.0) * k + o;
+                img.set(x, y, [v, v * 0.9, v * 0.8, 1.0]);
+            }
+        }
+        img
+    };
+    let reference = mk(1.0, 0.0);
+    let flicker = mk(0.8, 0.1);
+    let host = RefHost(reference.clone());
+    let env = EffectEnv { host: Some(&host), ..Default::default() };
+    let pts = [("blackPoint", Value::Vec2([5.0, 20.0])), ("midPoint", Value::Vec2([20.0, 20.0])), ("whitePoint", Value::Vec2([35.0, 20.0]))];
+    let mut vals: Vec<(&str, Value)> = pts.to_vec();
+    vals.push(("stabilize", Value::Enum(1)));
+    vals.push(("sampleSize", num(1.0)));
+    let out = run_fx("ec.color.colorstabilizer", &vals, flicker.clone(), 0.0, env);
+    for x in [5i64, 20, 35] {
+        let (o, r) = (out.img.get(x, 20), reference.get(x, 20));
+        assert!((o[0] - r[0]).abs() < 0.01, "x {x}: {o:?} vs {r:?}");
+    }
+    // Deterministic, and a no-op without a host.
+    let again = run_fx("ec.color.colorstabilizer", &vals, flicker.clone(), 0.0, env);
+    assert_eq!(out.img.data, again.img.data);
+    let none = run_fx("ec.color.colorstabilizer", &vals, flicker.clone(), 0.0, EffectEnv::default());
+    assert_eq!(none.img.data, flicker.data);
+    // Brightness mode corrects an offset at the black point.
+    let lifted = mk(1.0, 0.1);
+    let mut vals2: Vec<(&str, Value)> = pts.to_vec();
+    vals2.push(("sampleSize", num(1.0)));
+    let b = run_fx("ec.color.colorstabilizer", &vals2, lifted, 0.0, env);
+    assert!((b.img.get(5, 20)[0] - reference.get(5, 20)[0]).abs() < 0.01);
+}
+
+/// After Effects 2026's 320 × 180 test card from our importer samples (2026-11-05): a black to
+/// white ramp across, six 40 px colour squares at y 45 and a white 30 px square moving from
+/// x 20 to 300 at y 130 over 2 s.
+fn stabilizer_card(t: f64) -> Image {
+    let mut img = Image::new(320, 180);
+    let cols = [[1.0, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0], [1.0, 1.0, 0.0], [0.0, 1.0, 1.0], [1.0, 0.0, 1.0]];
+    let mover = 20.0 + 140.0 * t;
+    for y in 0..180 {
+        for x in 0..320 {
+            let (cx, cy) = (x as f64 + 0.5, y as f64 + 0.5);
+            let mut c = [(cx / 320.0) as f32; 3];
+            for (i, col) in cols.iter().enumerate() {
+                if (cx - (30.0 + 52.0 * i as f64)).abs() < 20.0 && (cy - 45.0).abs() < 20.0 {
+                    c = col.map(|v| v as f32);
+                }
+            }
+            if (cx - mover).abs() < 15.0 && (cy - 130.0).abs() < 15.0 {
+                c = [1.0; 3];
+            }
+            img.set(x, y, [c[0], c[1], c[2], 1.0]);
+        }
+    }
+    img
+}
+
+/// The sample's keyframed points: Black Point (64, 90) → (151, 99) and Mid Point (160, 90) →
+/// (188, 122) over the first second, White Point at (256, 90), Stabilize Levels.
+struct KeyedCard;
+impl EffectHost for KeyedCard {
+    fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+        None
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn self_at(&self, t: f64, _: usize) -> Option<Buf> {
+        Some(Buf { img: stabilizer_card(t), offset: [0.0; 2], scale: 1.0 })
+    }
+    fn params_at(&self, t: f64) -> Option<crate::Params> {
+        let mut p = crate::Params { values: Default::default() };
+        let k = t.clamp(0.0, 1.0);
+        let lerp = |a: [f64; 2], b: [f64; 2]| Value::Vec2([a[0] + (b[0] - a[0]) * k, a[1] + (b[1] - a[1]) * k]);
+        p.values.insert("blackPoint".into(), lerp([64.0, 90.0], [151.0, 99.0]));
+        p.values.insert("midPoint".into(), lerp([160.0, 90.0], [188.0, 122.0]));
+        p.values.insert("whitePoint".into(), Value::Vec2([256.0, 90.0]));
+        Some(p)
+    }
+}
+
+/// #3125: with keyframed sample points After Effects samples the reference frame where the
+/// points were at the reference time, so a static card is corrected. Its render at 0.5 s (Black
+/// Point at (107.5, 94.5)) is a Levels map of the ramp: `out = a + b·v` with b 1.2935..1.2965
+/// and a −0.2365..−0.2350 (fitted on our 26-level export). EffectCraft sampled both frames at
+/// the current points and left the card unchanged.
+#[test]
+fn color_stabilizer_samples_the_reference_at_the_points_reference_positions() {
+    let host = KeyedCard;
+    let env = EffectEnv { host: Some(&host), ..Default::default() };
+    let p = host.params_at(0.5).unwrap();
+    let mut vals: Vec<(&str, Value)> = ["blackPoint", "midPoint", "whitePoint"].iter().map(|id| (*id, p.values[*id].clone())).collect();
+    vals.push(("stabilize", Value::Enum(1)));
+    vals.push(("sampleSize", num(3.0)));
+    vals.push(("referenceFrame", num(0.0)));
+    let out = run_fx("ec.color.colorstabilizer", &vals, stabilizer_card(0.5), 0.5, env);
+    // The ramp row between the squares: fit out = a + b·v from two far-apart pixels.
+    let v = |x: i64| (x as f64 + 0.5) / 320.0;
+    let o = |x: i64| out.img.get(x, 90)[0] as f64;
+    let b = (o(240) - o(80)) / (v(240) - v(80));
+    let a = o(80) - b * v(80);
+    assert!((b - 1.295).abs() < 0.005, "slope {b}");
+    assert!((a + 0.2357).abs() < 0.005, "offset {a}");
+    // Every ramp pixel of that row follows the line (no clamping in 32 bpc).
+    for x in (0..320).step_by(7) {
+        assert!((o(x) - (a + b * v(x))).abs() < 1e-3, "x {x}");
+    }
+}
diff --git a/crates/effects/src/ocio_config.rs b/crates/effects/src/ocio_config.rs
index 5ea844414..e31281ede 100644
--- a/crates/effects/src/ocio_config.rs
+++ b/crates/effects/src/ocio_config.rs
@@ -20,7 +20,7 @@
 //! * `looks` (`name`, `process_space`, `transform`, `inverse_transform`) and look strings
 //!   (`+A, -B`, `A | B` = the first one the config has);
 //! * transforms: `MatrixTransform` (`matrix` 4×4 row-major, `offset`), `FileTransform` (the LUT,
-//!   CDL and matrix files [`super::ocio::parse_file`] reads; `interpolation`, `ccc_id`),
+//!   CDL and matrix files `super::ocio::parse_file` reads; `interpolation`, `ccc_id`),
 //!   `ExponentTransform` (`value`), `ExponentWithLinearTransform` (`gamma`, `offset`, `style:
 //!   mirror`; the power curve with a linear toe that the Academy CLF specification calls
 //!   "moncurve"), `LogTransform` (`base`), `LogAffineTransform` (`base`, `logSideSlope`,
@@ -168,19 +168,29 @@ fn split_key(s: &str) -> Option<(String, &str)> {
     None
 }
 
-/// Bracket balance of a flow fragment (outside quotes).
-fn balance(s: &str) -> i32 {
-    let (mut sq, mut dq, mut d) = (false, false, 0i32);
-    for c in s.chars() {
-        match c {
-            '\'' if !dq => sq = !sq,
-            '"' if !sq => dq = !dq,
-            '{' | '[' if !sq && !dq => d = d.saturating_add(1),
-            '}' | ']' if !sq && !dq => d = d.saturating_sub(1),
-            _ => {}
+/// Bracket balance of a flow fragment (outside quotes), kept as lines are appended so each
+/// character is looked at once however many lines a collection spans.
+#[derive(Default)]
+struct Balance {
+    sq: bool,
+    dq: bool,
+    d: i32,
+}
+
+impl Balance {
+    /// Takes in the next piece of the fragment and returns the balance so far.
+    fn feed(&mut self, s: &str) -> i32 {
+        for c in s.chars() {
+            match c {
+                '\'' if !self.dq => self.sq = !self.sq,
+                '"' if !self.sq => self.dq = !self.dq,
+                '{' | '[' if !self.sq && !self.dq => self.d = self.d.saturating_add(1),
+                '}' | ']' if !self.sq && !self.dq => self.d = self.d.saturating_sub(1),
+                _ => {}
+            }
         }
+        self.d
     }
-    d
 }
 
 struct Flow<'a> {
@@ -223,12 +233,19 @@ impl Flow<'_> {
                             self.i += 1;
                             break;
                         }
+                        // A `]` cannot close a mapping: the text is malformed, so the rest is
+                        // skipped (as past the depth limit) instead of read again and again.
+                        Some(b']') => {
+                            self.i = self.s.len();
+                            break;
+                        }
                         Some(b',') => {
                             self.i += 1;
                             continue;
                         }
                         _ => {}
                     }
+                    let start = self.i;
                     let k = self.scalar(true);
                     self.ws();
                     if self.peek() == Some(b':') {
@@ -236,6 +253,11 @@ impl Flow<'_> {
                     }
                     let v = self.nested();
                     m.push((unquote(&k), v));
+                    // Every entry consumes text; one that did not would repeat forever.
+                    if self.i == start {
+                        self.i = self.s.len();
+                        break;
+                    }
                 }
                 Yaml::Map(m)
             }
@@ -250,11 +272,23 @@ impl Flow<'_> {
                             self.i += 1;
                             break;
                         }
+                        // A `}` cannot close a sequence: skip the malformed rest (see above).
+                        Some(b'}') => {
+                            self.i = self.s.len();
+                            break;
+                        }
                         Some(b',') => {
                             self.i += 1;
                             continue;
                         }
-                        _ => v.push(self.nested()),
+                        _ => {
+                            let start = self.i;
+                            v.push(self.nested());
+                            if self.i == start {
+                                self.i = self.s.len();
+                                break;
+                            }
+                        }
                     }
                 }
                 Yaml::Seq(v)
@@ -364,11 +398,14 @@ impl Lines {
         if rest.starts_with('{') || rest.starts_with('[') || (rest.starts_with('!') && (rest.contains('{') || rest.contains('['))) {
             // Flow collections may continue on the next lines.
             let mut text = rest.to_string();
-            while balance(&text) > 0
+            let mut bal = Balance::default();
+            let mut open = bal.feed(&text);
+            while open > 0
                 && let Some((_, next)) = self.v.get(*i)
             {
                 text.push(' ');
                 text.push_str(next);
+                open = bal.feed(next);
                 *i += 1;
             }
             return flow(&text, depth);
@@ -1331,401 +1368,4 @@ pub fn load_config(src: &str) -> Result<Arc<Config>, String> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    const CONFIG: &str = r#"
-ocio_profile_version: 2
-
-name: Test Config   # a comment
-search_path: "luts:other"
-roles:
-  scene_linear: lin
-  color_timing: "log2"
-
-displays:
-  sRGB:
-    - !<View> {name: Standard, colorspace: gamma22}
-    - !<View> {name: Raw, colorspace: raw}
-
-colorspaces:
-  - !<ColorSpace>
-    name: lin
-    family: ""
-    description: |
-      The reference.
-      Linear.
-    isdata: false
-
-  - !<ColorSpace>
-    name: gamma22
-    aliases: [g22, "gamma 2.2"]
-    to_scene_reference: !<ExponentTransform> {value: [2.2, 2.2, 2.2, 1]}
-
-  - !<ColorSpace>
-    name: half
-    from_reference: !<MatrixTransform> {matrix: [0.5, 0, 0, 0,
-                                                0, 0.5, 0, 0,
-                                                0, 0, 0.5, 0,
-                                                0, 0, 0, 1], offset: [0.1, 0.1, 0.1, 0]}
-
-  - !<ColorSpace>
-    name: log2
-    from_reference: !<GroupTransform>
-      children:
-        - !<MatrixTransform> {matrix: [2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 1]}
-        - !<LogTransform> {base: 2}
-
-  - !<ColorSpace>
-    name: affine
-    to_reference: !<LogAffineTransform> {base: 10, logSideSlope: 0.5, logSideOffset: 0.2, linSideSlope: 2, linSideOffset: 0.01, direction: inverse}
-
-  - !<ColorSpace>
-    name: lut
-    to_reference: !<FileTransform> {src: double.cube, interpolation: linear}
-
-  - !<ColorSpace>
-    name: raw
-    isdata: true
-
-  - !<ColorSpace>
-    name: weird
-    to_reference: !<ExposureContrastTransform> {exposure: 1}
-"#;
-
-    fn close(a: [f64; 3], b: [f64; 3], tol: f64) -> bool {
-        (0..3).all(|i| (a[i] - b[i]).abs() < tol)
-    }
-
-    fn temp_dir(name: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("ec-ocio-{name}-{}", std::process::id()));
-        std::fs::create_dir_all(dir.join("luts")).unwrap();
-        dir
-    }
-
-    #[test]
-    fn yaml_subset() {
-        let y = parse_yaml("a: 1\nb:\n  - x\n  - {k: [1, 2], s: 'q: r'}\nc: !<T> {v: 3}\nd:\n- 4\n- 5\n");
-        assert_eq!(y.get("a").and_then(Yaml::str), Some("1"));
-        assert_eq!(y.get("b").unwrap().seq().len(), 2);
-        assert_eq!(y.get("b").unwrap().seq()[1].get("k").unwrap().nums(), vec![1.0, 2.0]);
-        assert_eq!(y.get("b").unwrap().seq()[1].get("s").and_then(Yaml::str), Some("q: r"));
-        assert_eq!(y.get("c").unwrap().tag(), Some("T"));
-        assert_eq!(y.get("c").unwrap().get("v").and_then(Yaml::str), Some("3"));
-        assert_eq!(y.get("d").unwrap().seq().len(), 2, "a sequence at the key's indent");
-    }
-
-    /// Hostile nesting (flow brackets and block indentation) is cut off instead of exhausting
-    /// the stack.
-    #[test]
-    fn yaml_nesting_is_bounded() {
-        let flow = format!("a: {}\nb: 1\n", "[".repeat(200_000));
-        assert!(matches!(parse_yaml(&flow), Yaml::Map(_)));
-        let block: String = (0..2_000).map(|i| format!("{}k{i}:\n", " ".repeat(i))).collect();
-        assert!(matches!(parse_yaml(&block), Yaml::Map(_)));
-        let dashes: String = (0..2_000).map(|i| format!("{}- x{i}:\n", " ".repeat(2 * i))).collect();
-        let _ = parse_yaml(&dashes);
-        assert!(Config::parse(&flow, Path::new(".")).is_err());
-    }
-
-    #[test]
-    fn parses_spaces_roles_displays_and_converts() {
-        let dir = temp_dir("basic");
-        // A 1D LUT that doubles (0..1 → 0..2).
-        std::fs::write(dir.join("luts/double.cube"), "LUT_1D_SIZE 2\nDOMAIN_MIN 0 0 0\nDOMAIN_MAX 1 1 1\n0 0 0\n2 2 2\n").unwrap();
-        let c = Config::parse(CONFIG, &dir).unwrap();
-        assert_eq!(c.name, "Test Config");
-        assert_eq!(c.search_path, vec!["luts", "other"]);
-        assert_eq!(c.space_names(), vec!["lin", "gamma22", "half", "log2", "affine", "lut", "raw", "weird"]);
-        // Roles and aliases resolve.
-        assert_eq!(c.space("scene_linear").unwrap().name, "lin");
-        assert_eq!(c.space("G22").unwrap().name, "gamma22");
-        assert_eq!(c.space("gamma 2.2").unwrap().name, "gamma22");
-        assert_eq!(c.view("sRGB", "Standard").unwrap().1.colorspace, "gamma22");
-        let sp = |n: &str| c.space(n).unwrap();
-        // gamma22 → lin: decode with the exponent.
-        let g = c.convert(sp("gamma22"), sp("lin"), [0.5, 0.25, 1.0]);
-        assert!(close(g, [0.5f64.powf(2.2), 0.25f64.powf(2.2), 1.0], 1e-9), "{g:?}");
-        // lin → gamma22: the inverse (only to_reference given).
-        let back = c.convert(sp("lin"), sp("gamma22"), g);
-        assert!(close(back, [0.5, 0.25, 1.0], 1e-9), "{back:?}");
-        // The display's view is that conversion.
-        assert!(close(c.display_path(sp("lin"), "sRGB", "Standard").apply(g, false), [0.5, 0.25, 1.0], 1e-9));
-        // lin → half: matrix and offset; and back through the inverse matrix.
-        let h = c.convert(sp("lin"), sp("half"), [0.4, 0.6, 1.0]);
-        assert!(close(h, [0.3, 0.4, 0.6], 1e-9), "{h:?}");
-        assert!(close(c.convert(sp("half"), sp("lin"), h), [0.4, 0.6, 1.0], 1e-9));
-        // lin → log2: a group (×2 then log2): 0.5 → 0; 2 → 2.
-        let l = c.convert(sp("lin"), sp("log2"), [0.5, 2.0, 4.0]);
-        assert!(close(l, [0.0, 2.0, 3.0], 1e-9), "{l:?}");
-        assert!(close(c.convert(sp("log2"), sp("lin"), l), [0.5, 2.0, 4.0], 1e-9));
-        // LogAffine (inverse direction as to_reference) round-trips.
-        let a = c.convert(sp("lin"), sp("affine"), [0.18, 0.5, 1.0]);
-        let expect = [0.18f64, 0.5, 1.0].map(|v| 0.5 * (2.0 * v + 0.01).log10() + 0.2);
-        assert!(close(a, expect, 1e-9), "{a:?} vs {expect:?}");
-        assert!(close(c.convert(sp("affine"), sp("lin"), a), [0.18, 0.5, 1.0], 1e-9));
-        // FileTransform found on the search path.
-        let f = c.convert(sp("lut"), sp("lin"), [0.25, 0.5, 0.0]);
-        assert!(close(f, [0.5, 1.0, 0.0], 1e-6), "{f:?}");
-        // Data spaces pass through; unsupported transforms are reported.
-        assert_eq!(c.convert(sp("raw"), sp("gamma22"), [0.3, 0.3, 0.3]), [0.3, 0.3, 0.3]);
-        assert_eq!(c.unsupported(), vec!["ExposureContrastTransform".to_string()]);
-        assert_eq!(c.path(sp("lin"), sp("weird")).unsupported_list(), vec!["ExposureContrastTransform".to_string()]);
-        assert!(c.path(sp("lin"), sp("half")).unsupported_list().is_empty());
-        // Loading from a file path (cached), and errors.
-        std::fs::write(dir.join("config.ocio"), CONFIG).unwrap();
-        let loaded = load_config(&dir.join("config.ocio").to_string_lossy()).unwrap();
-        assert_eq!(loaded.spaces.len(), 8);
-        assert!(load_config("/no/such/config.ocio").is_err());
-        assert!(Config::parse("just: text\n", &dir).is_err());
-    }
-
-    /// The OCIO Color Space and Display Transform effects with Configuration ▸ Custom.
-    #[test]
-    fn effects_use_a_custom_config() {
-        use effectcraft_keyframe::Value;
-        let cfg = "ocio_profile_version: 1\nroles:\n  default: lin\ndisplays:\n  Monitor:\n    - !<View> {name: Video, colorspace: g2}\ncolorspaces:\n  - !<ColorSpace>\n    name: lin\n  - !<ColorSpace>\n    name: g2\n    to_reference: !<ExponentTransform> {value: [2, 2, 2, 1]}\n";
-        let img = crate::Image::filled(2, 2, [0.5, 0.25, 1.0, 1.0]);
-        let fx = |id: &str, extra: &[(&str, Value)]| {
-            let mut v = vec![("config", Value::Enum(1)), ("configFile", Value::Str(cfg.into()))];
-            v.extend(extra.iter().cloned());
-            crate::run_fx(id, &v, img.clone(), 0.0, crate::EffectEnv::default()).img.data[0]
-        };
-        let o = fx("ec.color.ociocolorspace", &[("sourceName", Value::Str("g2".into())), ("destinationName", Value::Str("default".into()))]);
-        assert!((o[0] - 0.25).abs() < 1e-6 && (o[1] - 0.0625).abs() < 1e-6 && (o[2] - 1.0).abs() < 1e-6, "{o:?}");
-        // Inverse direction.
-        let o = fx(
-            "ec.color.ociocolorspace",
-            &[("sourceName", Value::Str("g2".into())), ("destinationName", Value::Str("lin".into())), ("direction", Value::Enum(1))],
-        );
-        assert!((o[0] - 0.5f32.sqrt()).abs() < 1e-6, "{o:?}");
-        // Display ▸ view → its colour space.
-        let o = fx(
-            "ec.color.ociodisplay",
-            &[("sourceName", Value::Str("lin".into())), ("displayName", Value::Str("Monitor".into())), ("viewName", Value::Str("Video".into()))],
-        );
-        assert!((o[0] - 0.5f32.sqrt()).abs() < 1e-6, "{o:?}");
-        // An unreadable config leaves pixels alone.
-        let o = crate::run_fx(
-            "ec.color.ociocolorspace",
-            &[("config", Value::Enum(1)), ("configFile", Value::Str("/missing.ocio".into()))],
-            img.clone(),
-            0.0,
-            crate::EffectEnv::default(),
-        );
-        assert_eq!(o.img.data, img.data);
-    }
-
-    /// A config laid out like Blender 4.x / 5.x's (written for this test): the reference space is
-    /// CIE XYZ with the E white, the D65 spaces adapt through a `.spimtx` matrix, sRGB is a
-    /// ColorSpaceTransform plus an ExponentWithLinearTransform, the display-referred spaces meet
-    /// the scene through the default view transform, and a log space uses an
-    /// AllocationTransform.
-    fn blender_like(dir: &Path) -> Config {
-        use effectcraft_color::space::{invert, rgb_to_xyz};
-        let e_to_d65 = crate::ocio::bradford([1.0 / 3.0, 1.0 / 3.0], D65);
-        let rows = |m: [[f64; 3]; 3], sep: &str, end: &str| m.iter().map(|r| format!("{}{sep}{}{sep}{}{end}", r[0], r[1], r[2])).collect::<Vec<_>>();
-        std::fs::write(dir.join("luts/e_to_d65.spimtx"), rows(e_to_d65, " ", " 0\n").concat()).unwrap();
-        let xyz_to_709 = rows(invert(&rgb_to_xyz(REC709, D65)), ", ", ", 0").join(", ");
-        let text = format!(
-            r#"ocio_profile_version: 2.4
-search_path: luts
-roles:
-  reference: Linear CIE-XYZ E
-  scene_linear: Linear Rec.709
-  cie_xyz_d65_interchange: XYZ D65 Display
-default_view_transform: Standard
-view_transforms:
-  - !<ViewTransform>
-    name: Standard
-    from_scene_reference: !<FileTransform> {{src: e_to_d65.spimtx, interpolation: linear}}
-displays:
-  sRGB:
-    - !<View> {{name: Standard, colorspace: sRGB}}
-    - !<View> {{name: Display, view_transform: Standard, display_colorspace: sRGB Display}}
-    - !<View> {{name: Log, colorspace: Log Encoding}}
-    - !<View> {{name: Log Brighter, colorspace: Log Encoding, looks: +Brighter}}
-    - !<View> {{name: Log Darker, colorspace: Log Encoding, looks: "-Brighter, Missing"}}
-    - !<View> {{name: Raw, colorspace: Non-Color}}
-display_colorspaces:
-  - !<ColorSpace>
-    name: XYZ D65 Display
-    isdata: false
-  - !<ColorSpace>
-    name: sRGB Display
-    from_display_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: cie_xyz_d65_interchange, dst: Linear Rec.709}}
-        - !<ExponentWithLinearTransform> {{gamma: 2.4, offset: 0.055, direction: inverse}}
-colorspaces:
-  - !<ColorSpace>
-    name: Linear CIE-XYZ E
-    aliases: [Linear CIE-XYZ I-E]
-  - !<ColorSpace>
-    name: Linear CIE-XYZ D65
-    from_scene_reference: !<FileTransform> {{src: e_to_d65.spimtx, interpolation: linear}}
-  - !<ColorSpace>
-    name: Linear Rec.709
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ I-E, dst: Linear CIE-XYZ D65}}
-        - !<MatrixTransform> {{matrix: [{xyz_to_709}, 0, 0, 0, 1]}}
-  - !<ColorSpace>
-    name: sRGB
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
-        - !<ExponentWithLinearTransform> {{gamma: 2.4, offset: 0.055, direction: inverse}}
-  - !<ColorSpace>
-    name: Log Encoding
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
-        - !<AllocationTransform> {{allocation: lg2, vars: [-12, 12]}}
-  - !<ColorSpace>
-    name: ACEScg
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear CIE-XYZ D65}}
-        - !<BuiltinTransform> {{style: "UTILITY - ACES-AP1_to_CIE-XYZ-D65_BFD", direction: inverse}}
-  - !<ColorSpace>
-    name: Clipped
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
-        - !<RangeTransform> {{min_in_value: 0, min_out_value: 0}}
-  - !<ColorSpace>
-    name: Graded
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
-        - !<GradingToneTransform>
-         shadows: {{rgb: [0.2, 0.2, 0.2], master: 0.35, start: 0.4, pivot: 0.1}}
-  - !<ColorSpace>
-    name: Loop
-    from_scene_reference: !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Loop}}
-  - !<ColorSpace>
-    name: Fan
-    from_scene_reference: !<GroupTransform>
-      children:
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Fan}}
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Fan}}
-        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Fan}}
-  - !<ColorSpace>
-    name: Non-Color
-    isdata: true
-looks:
-  - !<Look>
-    name: Brighter
-    process_space: Log Encoding
-    transform: !<CDLTransform> {{offset: [0.05, 0.05, 0.05]}}
-"#
-        );
-        Config::parse(&text, dir).unwrap()
-    }
-
-    /// The sRGB encoding (IEC 61966-2-1).
-    fn srgb(v: f64) -> f64 {
-        if v <= 0.003_130_8 { v * 12.92 } else { 1.055 * v.powf(1.0 / 2.4) - 0.055 }
-    }
-
-    /// #410: with Blender's config, Linear Rec.709 → sRGB got no sRGB curve and a blue cast:
-    /// ColorSpaceTransform and ExponentWithLinearTransform passed colours through, so the
-    /// colours stayed in the E-white XYZ reference. Every route to sRGB now encodes greys to
-    /// neutral sRGB values (0.18 → 0.4614).
-    #[test]
-    fn blender_like_config_converts_linear_rec709_to_srgb() {
-        let dir = temp_dir("blender");
-        let c = blender_like(&dir);
-        assert!(c.unsupported().iter().all(|t| t == "GradingToneTransform"), "{:?}", c.unsupported());
-        let sp = |n: &str| c.space(n).unwrap();
-        let lin = sp("scene_linear");
-        let routes = [
-            ("Color Space Transform", c.path(lin, sp("sRGB"))),
-            ("display-referred sRGB", c.path(lin, sp("sRGB Display"))),
-            ("v1 view", c.display_path(lin, "sRGB", "Standard")),
-            ("v2 view", c.display_path(lin, "sRGB", "Display")),
-        ];
-        for (route, x) in &routes {
-            assert!(x.unsupported_list().is_empty(), "{route}: {:?}", x.unsupported_list());
-            for v in [0.0, 0.001, 0.18, 0.5, 1.0, 4.0] {
-                let o = x.apply([v; 3], false);
-                assert!(close(o, [srgb(v); 3], 2e-5), "{route}: {v} → {o:?}, want {}", srgb(v));
-            }
-            let red = x.apply([1.0, 0.0, 0.0], false);
-            assert!(close(red, [1.0, 0.0, 0.0], 1e-4), "{route}: red {red:?}");
-            // And back.
-            assert!(close(x.apply([srgb(0.18); 3], true), [0.18; 3], 1e-6), "{route}");
-        }
-        // AllocationTransform lg2 and a look in its process space; data passes through.
-        let log = |v: f64| (v.log2() + 12.0) / 24.0;
-        let o = c.display_path(lin, "sRGB", "Log").apply([0.18; 3], false);
-        assert!(close(o, [log(0.18); 3], 1e-6), "{o:?}");
-        let o = c.display_path(lin, "sRGB", "Log Brighter").apply([0.18; 3], false);
-        assert!(close(o, [log(0.18) + 0.05; 3], 1e-6), "{o:?}");
-        let darker = c.display_path(lin, "sRGB", "Log Darker");
-        assert!(close(darker.apply([0.18; 3], false), [log(0.18) - 0.05; 3], 1e-6));
-        assert_eq!(darker.unsupported_list(), vec!["Look `Missing` (not in the config)".to_string()]);
-        assert_eq!(c.display_path(lin, "sRGB", "Raw").apply([0.3, 2.0, -1.0], false), [0.3, 2.0, -1.0]);
-        // BuiltinTransform: the built-in config's Linear Rec.709 → ACEScg.
-        let want = crate::ocio::Xform::new(&sp_builtin("Linear Rec.709 (sRGB)"), &sp_builtin("ACEScg")).apply([1.0, 0.25, 0.0]);
-        let got = c.convert(lin, sp("ACEScg"), [1.0, 0.25, 0.0]);
-        assert!(close(got, want.map(f64::from), 1e-4), "{got:?} vs {want:?}");
-        // RangeTransform with only a minimum clamps below and shifts nothing.
-        let o = c.convert(lin, sp("Clipped"), [-0.5, 0.5, 2.0]);
-        assert!(close(o, [0.0, 0.5, 2.0], 1e-6), "{o:?}");
-        // Unsupported steps are listed (and pass through); loops stop.
-        assert_eq!(c.path(lin, sp("Graded")).unsupported_list(), vec!["GradingToneTransform".to_string()]);
-        assert!(c.path(lin, sp("Loop")).unsupported_list()[0].contains("nested"));
-        let fan = c.path(lin, sp("Fan"));
-        assert!(!fan.unsupported_list().is_empty());
-        assert!(matches!(&fan, Xf::Group(v) if v.len() <= MAX_OPS + 1));
-    }
-
-    fn sp_builtin(name: &str) -> Space {
-        *crate::ocio::SPACES.iter().find(|s| s.name == name).unwrap()
-    }
-
-    /// ExponentWithLinearTransform is the sRGB curve at gamma 2.4 / offset 0.055, continuous at
-    /// its break point and inverted exactly; mirror mirrors negatives.
-    #[test]
-    fn moncurve_matches_srgb_and_inverts() {
-        for v in [-0.2, 0.0, 0.002, 0.039, 0.0393, 0.2, 0.5, 1.0, 3.0] {
-            let lin = moncurve(v, 2.4, 0.055, false, false);
-            assert!((moncurve(lin, 2.4, 0.055, true, false) - v).abs() < 1e-12, "{v}");
-            if v >= 0.0 {
-                assert!((moncurve(srgb(v), 2.4, 0.055, false, false) - v).abs() < 2e-5, "{v}");
-            }
-        }
-        let xb = 0.055 / 1.4;
-        assert!((moncurve(xb - 1e-12, 2.4, 0.055, false, false) - moncurve(xb + 1e-12, 2.4, 0.055, false, false)).abs() < 1e-9);
-        assert_eq!(moncurve(-0.5, 2.4, 0.055, false, true), -moncurve(0.5, 2.4, 0.055, false, false));
-        assert_eq!(moncurve(-0.5, 1.0, 0.0, false, false), 0.0);
-    }
-
-    #[test]
-    fn builtin_styles() {
-        for style in ["IDENTITY", "DISPLAY - CIE-XYZ-D65_to_sRGB", "display - cie-xyz-d65_to_rec.2100-pq", "ACEScc_to_ACES2065-1", "ACEScct_to_ACES2065-1"] {
-            assert!(builtin(style).is_some(), "{style}");
-        }
-        assert!(builtin("ACES-OUTPUT - ACES2065-1_to_CIE-XYZ-D65 - SDR-VIDEO_1.0").is_none());
-        // D65 white in XYZ is display white.
-        let xyz = rgb_white_xyz();
-        for style in ["DISPLAY - CIE-XYZ-D65_to_sRGB", "DISPLAY - CIE-XYZ-D65_to_REC.1886-REC.709", "DISPLAY - CIE-XYZ-D65_to_DisplayP3"] {
-            let o = builtin(style).unwrap().apply(xyz, false);
-            assert!(close(o, [1.0; 3], 1e-6), "{style}: {o:?}");
-        }
-        // PQ: 1.0 = 100 nits → code value ≈ 0.508.
-        let pq = builtin("DISPLAY - CIE-XYZ-D65_to_REC.2100-PQ").unwrap().apply(xyz, false);
-        assert!((pq[0] - 0.508).abs() < 1e-3, "{pq:?}");
-        // ACEScc and ACEScct of 0.18 (ACES2065-1 grey stays grey).
-        for (style, code) in [("ACEScc_to_ACES2065-1", 0.413_588_402_492_442_1), ("ACEScct_to_ACES2065-1", 0.413_588_402_492_442_1)] {
-            let o = builtin(style).unwrap().apply([code; 3], false);
-            assert!(close(o, [0.18; 3], 1e-6), "{style}: {o:?}");
-        }
-    }
-
-    fn rgb_white_xyz() -> [f64; 3] {
-        [D65[0] / D65[1], 1.0, (1.0 - D65[0] - D65[1]) / D65[1]]
-    }
-}
+mod tests;
diff --git a/crates/effects/src/ocio_config/tests.rs b/crates/effects/src/ocio_config/tests.rs
new file mode 100644
index 000000000..b616e6263
--- /dev/null
+++ b/crates/effects/src/ocio_config/tests.rs
@@ -0,0 +1,412 @@
+use super::*;
+
+const CONFIG: &str = r#"
+ocio_profile_version: 2
+
+name: Test Config   # a comment
+search_path: "luts:other"
+roles:
+  scene_linear: lin
+  color_timing: "log2"
+
+displays:
+  sRGB:
+    - !<View> {name: Standard, colorspace: gamma22}
+    - !<View> {name: Raw, colorspace: raw}
+
+colorspaces:
+  - !<ColorSpace>
+    name: lin
+    family: ""
+    description: |
+      The reference.
+      Linear.
+    isdata: false
+
+  - !<ColorSpace>
+    name: gamma22
+    aliases: [g22, "gamma 2.2"]
+    to_scene_reference: !<ExponentTransform> {value: [2.2, 2.2, 2.2, 1]}
+
+  - !<ColorSpace>
+    name: half
+    from_reference: !<MatrixTransform> {matrix: [0.5, 0, 0, 0,
+                                                0, 0.5, 0, 0,
+                                                0, 0, 0.5, 0,
+                                                0, 0, 0, 1], offset: [0.1, 0.1, 0.1, 0]}
+
+  - !<ColorSpace>
+    name: log2
+    from_reference: !<GroupTransform>
+      children:
+        - !<MatrixTransform> {matrix: [2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 1]}
+        - !<LogTransform> {base: 2}
+
+  - !<ColorSpace>
+    name: affine
+    to_reference: !<LogAffineTransform> {base: 10, logSideSlope: 0.5, logSideOffset: 0.2, linSideSlope: 2, linSideOffset: 0.01, direction: inverse}
+
+  - !<ColorSpace>
+    name: lut
+    to_reference: !<FileTransform> {src: double.cube, interpolation: linear}
+
+  - !<ColorSpace>
+    name: raw
+    isdata: true
+
+  - !<ColorSpace>
+    name: weird
+    to_reference: !<ExposureContrastTransform> {exposure: 1}
+"#;
+
+fn close(a: [f64; 3], b: [f64; 3], tol: f64) -> bool {
+    (0..3).all(|i| (a[i] - b[i]).abs() < tol)
+}
+
+fn temp_dir(name: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("ec-ocio-{name}-{}", std::process::id()));
+    std::fs::create_dir_all(dir.join("luts")).unwrap();
+    dir
+}
+
+#[test]
+fn yaml_subset() {
+    let y = parse_yaml("a: 1\nb:\n  - x\n  - {k: [1, 2], s: 'q: r'}\nc: !<T> {v: 3}\nd:\n- 4\n- 5\n");
+    assert_eq!(y.get("a").and_then(Yaml::str), Some("1"));
+    assert_eq!(y.get("b").unwrap().seq().len(), 2);
+    assert_eq!(y.get("b").unwrap().seq()[1].get("k").unwrap().nums(), vec![1.0, 2.0]);
+    assert_eq!(y.get("b").unwrap().seq()[1].get("s").and_then(Yaml::str), Some("q: r"));
+    assert_eq!(y.get("c").unwrap().tag(), Some("T"));
+    assert_eq!(y.get("c").unwrap().get("v").and_then(Yaml::str), Some("3"));
+    assert_eq!(y.get("d").unwrap().seq().len(), 2, "a sequence at the key's indent");
+}
+
+/// Hostile nesting (flow brackets and block indentation) is cut off instead of exhausting
+/// the stack.
+#[test]
+fn yaml_nesting_is_bounded() {
+    let flow = format!("a: {}\nb: 1\n", "[".repeat(200_000));
+    assert!(matches!(parse_yaml(&flow), Yaml::Map(_)));
+    let block: String = (0..2_000).map(|i| format!("{}k{i}:\n", " ".repeat(i))).collect();
+    assert!(matches!(parse_yaml(&block), Yaml::Map(_)));
+    let dashes: String = (0..2_000).map(|i| format!("{}- x{i}:\n", " ".repeat(2 * i))).collect();
+    let _ = parse_yaml(&dashes);
+    assert!(Config::parse(&flow, Path::new(".")).is_err());
+}
+
+/// A closing bracket of the wrong kind ends the collection instead of being read forever, and a
+/// flow collection spread over many lines is assembled in linear time.
+#[test]
+fn yaml_malformed_flow_is_bounded() {
+    for text in ["a: {x: ]\nb: 1\n", "a: [x, }\nb: 1\n", "a: [{k: ], 1]\n", "a: {[}: ]}\n"] {
+        let _ = parse_yaml(text);
+    }
+    assert!(matches!(parse_yaml("a: {x: ]\n"), Yaml::Map(_)));
+    let mut many = String::from("a: [\n");
+    for _ in 0..200_000 {
+        many.push_str("  1,\n");
+    }
+    many.push_str("]\nb: 2\n");
+    let y = parse_yaml(&many);
+    assert_eq!(y.get("a").map(|a| a.seq().len()), Some(200_000));
+    assert_eq!(y.get("b").and_then(Yaml::str), Some("2"));
+}
+
+#[test]
+fn parses_spaces_roles_displays_and_converts() {
+    let dir = temp_dir("basic");
+    // A 1D LUT that doubles (0..1 → 0..2).
+    std::fs::write(dir.join("luts/double.cube"), "LUT_1D_SIZE 2\nDOMAIN_MIN 0 0 0\nDOMAIN_MAX 1 1 1\n0 0 0\n2 2 2\n").unwrap();
+    let c = Config::parse(CONFIG, &dir).unwrap();
+    assert_eq!(c.name, "Test Config");
+    assert_eq!(c.search_path, vec!["luts", "other"]);
+    assert_eq!(c.space_names(), vec!["lin", "gamma22", "half", "log2", "affine", "lut", "raw", "weird"]);
+    // Roles and aliases resolve.
+    assert_eq!(c.space("scene_linear").unwrap().name, "lin");
+    assert_eq!(c.space("G22").unwrap().name, "gamma22");
+    assert_eq!(c.space("gamma 2.2").unwrap().name, "gamma22");
+    assert_eq!(c.view("sRGB", "Standard").unwrap().1.colorspace, "gamma22");
+    let sp = |n: &str| c.space(n).unwrap();
+    // gamma22 → lin: decode with the exponent.
+    let g = c.convert(sp("gamma22"), sp("lin"), [0.5, 0.25, 1.0]);
+    assert!(close(g, [0.5f64.powf(2.2), 0.25f64.powf(2.2), 1.0], 1e-9), "{g:?}");
+    // lin → gamma22: the inverse (only to_reference given).
+    let back = c.convert(sp("lin"), sp("gamma22"), g);
+    assert!(close(back, [0.5, 0.25, 1.0], 1e-9), "{back:?}");
+    // The display's view is that conversion.
+    assert!(close(c.display_path(sp("lin"), "sRGB", "Standard").apply(g, false), [0.5, 0.25, 1.0], 1e-9));
+    // lin → half: matrix and offset; and back through the inverse matrix.
+    let h = c.convert(sp("lin"), sp("half"), [0.4, 0.6, 1.0]);
+    assert!(close(h, [0.3, 0.4, 0.6], 1e-9), "{h:?}");
+    assert!(close(c.convert(sp("half"), sp("lin"), h), [0.4, 0.6, 1.0], 1e-9));
+    // lin → log2: a group (×2 then log2): 0.5 → 0; 2 → 2.
+    let l = c.convert(sp("lin"), sp("log2"), [0.5, 2.0, 4.0]);
+    assert!(close(l, [0.0, 2.0, 3.0], 1e-9), "{l:?}");
+    assert!(close(c.convert(sp("log2"), sp("lin"), l), [0.5, 2.0, 4.0], 1e-9));
+    // LogAffine (inverse direction as to_reference) round-trips.
+    let a = c.convert(sp("lin"), sp("affine"), [0.18, 0.5, 1.0]);
+    let expect = [0.18f64, 0.5, 1.0].map(|v| 0.5 * (2.0 * v + 0.01).log10() + 0.2);
+    assert!(close(a, expect, 1e-9), "{a:?} vs {expect:?}");
+    assert!(close(c.convert(sp("affine"), sp("lin"), a), [0.18, 0.5, 1.0], 1e-9));
+    // FileTransform found on the search path.
+    let f = c.convert(sp("lut"), sp("lin"), [0.25, 0.5, 0.0]);
+    assert!(close(f, [0.5, 1.0, 0.0], 1e-6), "{f:?}");
+    // Data spaces pass through; unsupported transforms are reported.
+    assert_eq!(c.convert(sp("raw"), sp("gamma22"), [0.3, 0.3, 0.3]), [0.3, 0.3, 0.3]);
+    assert_eq!(c.unsupported(), vec!["ExposureContrastTransform".to_string()]);
+    assert_eq!(c.path(sp("lin"), sp("weird")).unsupported_list(), vec!["ExposureContrastTransform".to_string()]);
+    assert!(c.path(sp("lin"), sp("half")).unsupported_list().is_empty());
+    // Loading from a file path (cached), and errors.
+    std::fs::write(dir.join("config.ocio"), CONFIG).unwrap();
+    let loaded = load_config(&dir.join("config.ocio").to_string_lossy()).unwrap();
+    assert_eq!(loaded.spaces.len(), 8);
+    assert!(load_config("/no/such/config.ocio").is_err());
+    assert!(Config::parse("just: text\n", &dir).is_err());
+}
+
+/// The OCIO Color Space and Display Transform effects with Configuration ▸ Custom.
+#[test]
+fn effects_use_a_custom_config() {
+    use effectcraft_keyframe::Value;
+    let cfg = "ocio_profile_version: 1\nroles:\n  default: lin\ndisplays:\n  Monitor:\n    - !<View> {name: Video, colorspace: g2}\ncolorspaces:\n  - !<ColorSpace>\n    name: lin\n  - !<ColorSpace>\n    name: g2\n    to_reference: !<ExponentTransform> {value: [2, 2, 2, 1]}\n";
+    let img = crate::Image::filled(2, 2, [0.5, 0.25, 1.0, 1.0]);
+    let fx = |id: &str, extra: &[(&str, Value)]| {
+        let mut v = vec![("config", Value::Enum(1)), ("configFile", Value::Str(cfg.into()))];
+        v.extend(extra.iter().cloned());
+        crate::run_fx(id, &v, img.clone(), 0.0, crate::EffectEnv::default()).img.data[0]
+    };
+    let o = fx("ec.color.ociocolorspace", &[("sourceName", Value::Str("g2".into())), ("destinationName", Value::Str("default".into()))]);
+    assert!((o[0] - 0.25).abs() < 1e-6 && (o[1] - 0.0625).abs() < 1e-6 && (o[2] - 1.0).abs() < 1e-6, "{o:?}");
+    // Inverse direction.
+    let o =
+        fx("ec.color.ociocolorspace", &[("sourceName", Value::Str("g2".into())), ("destinationName", Value::Str("lin".into())), ("direction", Value::Enum(1))]);
+    assert!((o[0] - 0.5f32.sqrt()).abs() < 1e-6, "{o:?}");
+    // Display ▸ view → its colour space.
+    let o = fx(
+        "ec.color.ociodisplay",
+        &[("sourceName", Value::Str("lin".into())), ("displayName", Value::Str("Monitor".into())), ("viewName", Value::Str("Video".into()))],
+    );
+    assert!((o[0] - 0.5f32.sqrt()).abs() < 1e-6, "{o:?}");
+    // An unreadable config leaves pixels alone.
+    let o = crate::run_fx(
+        "ec.color.ociocolorspace",
+        &[("config", Value::Enum(1)), ("configFile", Value::Str("/missing.ocio".into()))],
+        img.clone(),
+        0.0,
+        crate::EffectEnv::default(),
+    );
+    assert_eq!(o.img.data, img.data);
+}
+
+/// A config laid out like Blender 4.x / 5.x's (written for this test): the reference space is
+/// CIE XYZ with the E white, the D65 spaces adapt through a `.spimtx` matrix, sRGB is a
+/// ColorSpaceTransform plus an ExponentWithLinearTransform, the display-referred spaces meet
+/// the scene through the default view transform, and a log space uses an
+/// AllocationTransform.
+fn blender_like(dir: &Path) -> Config {
+    use effectcraft_color::space::{invert, rgb_to_xyz};
+    let e_to_d65 = crate::ocio::bradford([1.0 / 3.0, 1.0 / 3.0], D65);
+    let rows = |m: [[f64; 3]; 3], sep: &str, end: &str| m.iter().map(|r| format!("{}{sep}{}{sep}{}{end}", r[0], r[1], r[2])).collect::<Vec<_>>();
+    std::fs::write(dir.join("luts/e_to_d65.spimtx"), rows(e_to_d65, " ", " 0\n").concat()).unwrap();
+    let xyz_to_709 = rows(invert(&rgb_to_xyz(REC709, D65)), ", ", ", 0").join(", ");
+    let text = format!(
+        r#"ocio_profile_version: 2.4
+search_path: luts
+roles:
+  reference: Linear CIE-XYZ E
+  scene_linear: Linear Rec.709
+  cie_xyz_d65_interchange: XYZ D65 Display
+default_view_transform: Standard
+view_transforms:
+  - !<ViewTransform>
+    name: Standard
+    from_scene_reference: !<FileTransform> {{src: e_to_d65.spimtx, interpolation: linear}}
+displays:
+  sRGB:
+    - !<View> {{name: Standard, colorspace: sRGB}}
+    - !<View> {{name: Display, view_transform: Standard, display_colorspace: sRGB Display}}
+    - !<View> {{name: Log, colorspace: Log Encoding}}
+    - !<View> {{name: Log Brighter, colorspace: Log Encoding, looks: +Brighter}}
+    - !<View> {{name: Log Darker, colorspace: Log Encoding, looks: "-Brighter, Missing"}}
+    - !<View> {{name: Raw, colorspace: Non-Color}}
+display_colorspaces:
+  - !<ColorSpace>
+    name: XYZ D65 Display
+    isdata: false
+  - !<ColorSpace>
+    name: sRGB Display
+    from_display_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: cie_xyz_d65_interchange, dst: Linear Rec.709}}
+        - !<ExponentWithLinearTransform> {{gamma: 2.4, offset: 0.055, direction: inverse}}
+colorspaces:
+  - !<ColorSpace>
+    name: Linear CIE-XYZ E
+    aliases: [Linear CIE-XYZ I-E]
+  - !<ColorSpace>
+    name: Linear CIE-XYZ D65
+    from_scene_reference: !<FileTransform> {{src: e_to_d65.spimtx, interpolation: linear}}
+  - !<ColorSpace>
+    name: Linear Rec.709
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ I-E, dst: Linear CIE-XYZ D65}}
+        - !<MatrixTransform> {{matrix: [{xyz_to_709}, 0, 0, 0, 1]}}
+  - !<ColorSpace>
+    name: sRGB
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
+        - !<ExponentWithLinearTransform> {{gamma: 2.4, offset: 0.055, direction: inverse}}
+  - !<ColorSpace>
+    name: Log Encoding
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
+        - !<AllocationTransform> {{allocation: lg2, vars: [-12, 12]}}
+  - !<ColorSpace>
+    name: ACEScg
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear CIE-XYZ D65}}
+        - !<BuiltinTransform> {{style: "UTILITY - ACES-AP1_to_CIE-XYZ-D65_BFD", direction: inverse}}
+  - !<ColorSpace>
+    name: Clipped
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
+        - !<RangeTransform> {{min_in_value: 0, min_out_value: 0}}
+  - !<ColorSpace>
+    name: Graded
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Linear Rec.709}}
+        - !<GradingToneTransform>
+         shadows: {{rgb: [0.2, 0.2, 0.2], master: 0.35, start: 0.4, pivot: 0.1}}
+  - !<ColorSpace>
+    name: Loop
+    from_scene_reference: !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Loop}}
+  - !<ColorSpace>
+    name: Fan
+    from_scene_reference: !<GroupTransform>
+      children:
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Fan}}
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Fan}}
+        - !<ColorSpaceTransform> {{src: Linear CIE-XYZ E, dst: Fan}}
+  - !<ColorSpace>
+    name: Non-Color
+    isdata: true
+looks:
+  - !<Look>
+    name: Brighter
+    process_space: Log Encoding
+    transform: !<CDLTransform> {{offset: [0.05, 0.05, 0.05]}}
+"#
+    );
+    Config::parse(&text, dir).unwrap()
+}
+
+/// The sRGB encoding (IEC 61966-2-1).
+fn srgb(v: f64) -> f64 {
+    if v <= 0.003_130_8 { v * 12.92 } else { 1.055 * v.powf(1.0 / 2.4) - 0.055 }
+}
+
+/// #410: with Blender's config, Linear Rec.709 → sRGB got no sRGB curve and a blue cast:
+/// ColorSpaceTransform and ExponentWithLinearTransform passed colours through, so the
+/// colours stayed in the E-white XYZ reference. Every route to sRGB now encodes greys to
+/// neutral sRGB values (0.18 → 0.4614).
+#[test]
+fn blender_like_config_converts_linear_rec709_to_srgb() {
+    let dir = temp_dir("blender");
+    let c = blender_like(&dir);
+    assert!(c.unsupported().iter().all(|t| t == "GradingToneTransform"), "{:?}", c.unsupported());
+    let sp = |n: &str| c.space(n).unwrap();
+    let lin = sp("scene_linear");
+    let routes = [
+        ("Color Space Transform", c.path(lin, sp("sRGB"))),
+        ("display-referred sRGB", c.path(lin, sp("sRGB Display"))),
+        ("v1 view", c.display_path(lin, "sRGB", "Standard")),
+        ("v2 view", c.display_path(lin, "sRGB", "Display")),
+    ];
+    for (route, x) in &routes {
+        assert!(x.unsupported_list().is_empty(), "{route}: {:?}", x.unsupported_list());
+        for v in [0.0, 0.001, 0.18, 0.5, 1.0, 4.0] {
+            let o = x.apply([v; 3], false);
+            assert!(close(o, [srgb(v); 3], 2e-5), "{route}: {v} → {o:?}, want {}", srgb(v));
+        }
+        let red = x.apply([1.0, 0.0, 0.0], false);
+        assert!(close(red, [1.0, 0.0, 0.0], 1e-4), "{route}: red {red:?}");
+        // And back.
+        assert!(close(x.apply([srgb(0.18); 3], true), [0.18; 3], 1e-6), "{route}");
+    }
+    // AllocationTransform lg2 and a look in its process space; data passes through.
+    let log = |v: f64| (v.log2() + 12.0) / 24.0;
+    let o = c.display_path(lin, "sRGB", "Log").apply([0.18; 3], false);
+    assert!(close(o, [log(0.18); 3], 1e-6), "{o:?}");
+    let o = c.display_path(lin, "sRGB", "Log Brighter").apply([0.18; 3], false);
+    assert!(close(o, [log(0.18) + 0.05; 3], 1e-6), "{o:?}");
+    let darker = c.display_path(lin, "sRGB", "Log Darker");
+    assert!(close(darker.apply([0.18; 3], false), [log(0.18) - 0.05; 3], 1e-6));
+    assert_eq!(darker.unsupported_list(), vec!["Look `Missing` (not in the config)".to_string()]);
+    assert_eq!(c.display_path(lin, "sRGB", "Raw").apply([0.3, 2.0, -1.0], false), [0.3, 2.0, -1.0]);
+    // BuiltinTransform: the built-in config's Linear Rec.709 → ACEScg.
+    let want = crate::ocio::Xform::new(&sp_builtin("Linear Rec.709 (sRGB)"), &sp_builtin("ACEScg")).apply([1.0, 0.25, 0.0]);
+    let got = c.convert(lin, sp("ACEScg"), [1.0, 0.25, 0.0]);
+    assert!(close(got, want.map(f64::from), 1e-4), "{got:?} vs {want:?}");
+    // RangeTransform with only a minimum clamps below and shifts nothing.
+    let o = c.convert(lin, sp("Clipped"), [-0.5, 0.5, 2.0]);
+    assert!(close(o, [0.0, 0.5, 2.0], 1e-6), "{o:?}");
+    // Unsupported steps are listed (and pass through); loops stop.
+    assert_eq!(c.path(lin, sp("Graded")).unsupported_list(), vec!["GradingToneTransform".to_string()]);
+    assert!(c.path(lin, sp("Loop")).unsupported_list()[0].contains("nested"));
+    let fan = c.path(lin, sp("Fan"));
+    assert!(!fan.unsupported_list().is_empty());
+    assert!(matches!(&fan, Xf::Group(v) if v.len() <= MAX_OPS + 1));
+}
+
+fn sp_builtin(name: &str) -> Space {
+    *crate::ocio::SPACES.iter().find(|s| s.name == name).unwrap()
+}
+
+/// ExponentWithLinearTransform is the sRGB curve at gamma 2.4 / offset 0.055, continuous at
+/// its break point and inverted exactly; mirror mirrors negatives.
+#[test]
+fn moncurve_matches_srgb_and_inverts() {
+    for v in [-0.2, 0.0, 0.002, 0.039, 0.0393, 0.2, 0.5, 1.0, 3.0] {
+        let lin = moncurve(v, 2.4, 0.055, false, false);
+        assert!((moncurve(lin, 2.4, 0.055, true, false) - v).abs() < 1e-12, "{v}");
+        if v >= 0.0 {
+            assert!((moncurve(srgb(v), 2.4, 0.055, false, false) - v).abs() < 2e-5, "{v}");
+        }
+    }
+    let xb = 0.055 / 1.4;
+    assert!((moncurve(xb - 1e-12, 2.4, 0.055, false, false) - moncurve(xb + 1e-12, 2.4, 0.055, false, false)).abs() < 1e-9);
+    assert_eq!(moncurve(-0.5, 2.4, 0.055, false, true), -moncurve(0.5, 2.4, 0.055, false, false));
+    assert_eq!(moncurve(-0.5, 1.0, 0.0, false, false), 0.0);
+}
+
+#[test]
+fn builtin_styles() {
+    for style in ["IDENTITY", "DISPLAY - CIE-XYZ-D65_to_sRGB", "display - cie-xyz-d65_to_rec.2100-pq", "ACEScc_to_ACES2065-1", "ACEScct_to_ACES2065-1"] {
+        assert!(builtin(style).is_some(), "{style}");
+    }
+    assert!(builtin("ACES-OUTPUT - ACES2065-1_to_CIE-XYZ-D65 - SDR-VIDEO_1.0").is_none());
+    // D65 white in XYZ is display white.
+    let xyz = rgb_white_xyz();
+    for style in ["DISPLAY - CIE-XYZ-D65_to_sRGB", "DISPLAY - CIE-XYZ-D65_to_REC.1886-REC.709", "DISPLAY - CIE-XYZ-D65_to_DisplayP3"] {
+        let o = builtin(style).unwrap().apply(xyz, false);
+        assert!(close(o, [1.0; 3], 1e-6), "{style}: {o:?}");
+    }
+    // PQ: 1.0 = 100 nits → code value ≈ 0.508.
+    let pq = builtin("DISPLAY - CIE-XYZ-D65_to_REC.2100-PQ").unwrap().apply(xyz, false);
+    assert!((pq[0] - 0.508).abs() < 1e-3, "{pq:?}");
+    // ACEScc and ACEScct of 0.18 (ACES2065-1 grey stays grey).
+    for (style, code) in [("ACEScc_to_ACES2065-1", 0.413_588_402_492_442_1), ("ACEScct_to_ACES2065-1", 0.413_588_402_492_442_1)] {
+        let o = builtin(style).unwrap().apply([code; 3], false);
+        assert!(close(o, [0.18; 3], 1e-6), "{style}: {o:?}");
+    }
+}
+
+fn rgb_white_xyz() -> [f64; 3] {
+    [D65[0] / D65[1], 1.0, (1.0 - D65[0] - D65[1]) / D65[1]]
+}
diff --git a/crates/effects/src/perspective.rs b/crates/effects/src/perspective.rs
index 24c561ecd..69c63caf9 100644
--- a/crates/effects/src/perspective.rs
+++ b/crates/effects/src/perspective.rs
@@ -1,5 +1,5 @@
-//! Perspective effects (batch 2): Bevel Alpha, Bevel Edges, Radial Shadow, CC Cylinder,
-//! CC Sphere and CC Spotlight.
+//! Perspective effects (batch 2): Bevel Alpha, Bevel Edges, Radial Shadow, Cylinder Wrap,
+//! Sphere Wrap and Surface Spotlight.
 //!
 //! Angles follow the convention used by Drop Shadow: measured clockwise from "up", so a light
 //! angle `a` sits in the direction `(sin a, -cos a)` (y grows downwards). 3D vectors use x right,
@@ -158,7 +158,7 @@ fn radial_shadow(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-/// Phong-style shading shared by CC Cylinder and CC Sphere.
+/// Phong-style shading shared by Cylinder Wrap and Sphere Wrap.
 struct Shading {
     l: [f64; 3],
     color: [f32; 4],
@@ -451,11 +451,11 @@ pub fn specs() -> Vec<EffectSpec> {
             ],
             radial_shadow,
         ),
-        spec("ec.perspective.cccylinder", "CC Cylinder", cyl, cylinder),
-        spec("ec.perspective.ccsphere", "CC Sphere", sph, sphere),
+        spec("ec.perspective.cccylinder", "Cylinder Wrap", cyl, cylinder),
+        spec("ec.perspective.ccsphere", "Sphere Wrap", sph, sphere),
         spec(
             "ec.perspective.ccspotlight",
-            "CC Spotlight",
+            "Surface Spotlight",
             vec![
                 p("from", "From", pt(0.3, 0.2), ParamUi::Point),
                 p("to", "To", pt(0.5, 0.5), ParamUi::Point),
diff --git a/crates/effects/src/perspective2.rs b/crates/effects/src/perspective2.rs
index 13846607f..2bc7e3e7e 100644
--- a/crates/effects/src/perspective2.rs
+++ b/crates/effects/src/perspective2.rs
@@ -1,4 +1,4 @@
-//! Perspective effects, batch 2: CC Environment (reflection mapping of an environment layer
+//! Perspective effects, batch 2: Environment Map (reflection mapping of an environment layer
 //! onto the layer's luminance/alpha relief) and 3D Glasses (stereo pairs and anaglyphs from a
 //! left and right view layer).
 
@@ -17,7 +17,7 @@ fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, ren
     EffectSpec { id, name, category: "Perspective", params, render, gpu: false, float: true }
 }
 
-// ---------------------------------------------------------------- CC Environment
+// ---------------------------------------------------------------- Environment Map
 
 /// Environment direction (x right, y down, z towards the viewer) → normalised map coordinates.
 fn env_uv(mapping: u32, r: [f64; 3]) -> (f64, f64) {
@@ -194,7 +194,7 @@ pub fn specs() -> Vec<EffectSpec> {
     vec![
         spec(
             "ec.perspective.ccenvironment",
-            "CC Environment",
+            "Environment Map",
             vec![
                 p("environment", "Environment", Value::Layer(None), ParamUi::Layer),
                 p("mapping", "Mapping", Value::Enum(0), popup(&["Spherical", "Probe", "Vertical Cross"])),
diff --git a/crates/effects/src/plugin.rs b/crates/effects/src/plugin.rs
index 874050f43..8bbe17856 100644
--- a/crates/effects/src/plugin.rs
+++ b/crates/effects/src/plugin.rs
@@ -13,14 +13,23 @@
 //!
 //! The contract (stable within an API version):
 //! * pixels are premultiplied RGBA `f32` (0–1, may exceed 1 in 32 bpc projects), row-major,
-//!   in the layer's buffer, which may be scaled (preview resolution) and padded;
+//!   row 0 on top, in the layer's buffer, which may be scaled (preview resolution) and padded;
 //! * parameters are flattened to `f64`s in declaration order: slider / angle / checkbox (0 or 1)
 //!   / popup (0-based index) take one value, point two (**frame pixels**, already mapped to the
-//!   buffer), colour four (RGBA 0–1);
+//!   buffer), colour four (RGBA 0–1); API 2 adds point3 (x, y mapped like a point, z as is),
+//!   layer (one value: the layer id, -1 for none), and text / hidden strings, which take no
+//!   slot and are read with [`PluginParams::text`];
 //! * `time` is layer time in seconds; `scale` is the buffer's pixels per layer pixel (scale
 //!   pixel distances like blur radii by it);
 //! * rendering must be deterministic (same inputs, same output) and may run on several threads
 //!   at once.
+//!
+//! API 2 (native plug-ins) adds [`EffectPlugin::padding`] and [`EffectPlugin::render_v2`], which
+//! gets a [`PluginHost`] to read the effect's input or other layers at other times, and the extra
+//! parameter kinds. External effect helpers (`effectcraft-helper-host`) are built on it.
+//!
+//! The WebAssembly ABI is versioned separately ([`WASM_API_VERSION`]): ABI 1 is `ec_render`;
+//! ABI 2 adds `ec_render2`, which receives the layer's previous and next frames.
 
 use std::sync::{Arc, OnceLock, RwLock};
 
@@ -28,13 +37,22 @@ use effectcraft_keyframe::Value;
 use effectcraft_project::ParamUi;
 use serde::{Deserialize, Serialize};
 
-use crate::{Buf, EffectCtx, EffectSpec, ParamSpec, RenderFn};
+use crate::{Buf, EffectCtx, EffectSpec, ParamSpec, Params, RenderFn};
 
-/// The plug-in API version this build implements.
-pub const PLUGIN_API_VERSION: u32 = 1;
+/// The plug-in API version this build implements (manifests with API 1 or 2 are accepted).
+pub const PLUGIN_API_VERSION: u32 = 2;
+/// The newest WebAssembly ABI this build implements (a module's `ec_api_version`). ABI 1 is
+/// `ec_render`; ABI 2 adds `ec_render2` and the layer's neighbouring frames. This is separate
+/// from the plug-in API version: a module's manifest `api` stays 1 or 2.
+pub const WASM_API_VERSION: u32 = 2;
+/// The oldest WebAssembly ABI this build still loads.
+pub const MIN_WASM_API_VERSION: u32 = 1;
 
-/// The most plug-in effects one process can register.
-pub const MAX_PLUGINS: usize = 64;
+/// The most plug-in effects one process can register (commercial effect suites register a few hundred each).
+pub const MAX_PLUGINS: usize = 1024;
+
+/// The most transparent pixels a plug-in may ask [`EffectPlugin::padding`] to add per side.
+const MAX_PADDING: u32 = 4096;
 
 /// A plug-in parameter's kind, default and range.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -53,6 +71,9 @@ pub enum PluginParamKind {
         slider_max: Option<f64>,
         #[serde(default = "two")]
         decimals: u8,
+        /// Whole numbers (API 2; integer parameters): shown with 0 decimals.
+        #[serde(default)]
+        integer: bool,
     },
     Angle {
         #[serde(default)]
@@ -78,6 +99,24 @@ pub enum PluginParamKind {
         #[serde(default = "white")]
         default: [f64; 4],
     },
+    /// API 2: a 3D point (x, y in frame pixels like [`PluginParamKind::Point`], z as is). The
+    /// default is in layer pixels (not fractions).
+    Point3 {
+        #[serde(default)]
+        default: [f64; 3],
+    },
+    /// API 2: another layer of the composition (flattens to its id, -1 for none).
+    Layer,
+    /// API 2: a string, shown as a text field; read with [`PluginParams::text`].
+    Text {
+        #[serde(default)]
+        default: String,
+    },
+    /// API 2: a string that is not shown (opaque plug-in data); read with [`PluginParams::text`].
+    Hidden {
+        #[serde(default)]
+        default: String,
+    },
 }
 
 fn hundred() -> f64 {
@@ -98,10 +137,21 @@ impl PluginParamKind {
     pub fn width(&self) -> usize {
         match self {
             PluginParamKind::Point { .. } => 2,
+            PluginParamKind::Point3 { .. } => 3,
             PluginParamKind::Color { .. } => 4,
+            PluginParamKind::Text { .. } | PluginParamKind::Hidden { .. } => 0,
             _ => 1,
         }
     }
+    /// Whether the parameter holds a string (it flattens to no `f64`s but one entry of
+    /// [`PluginParams::texts`]).
+    pub fn is_text(&self) -> bool {
+        matches!(self, PluginParamKind::Text { .. } | PluginParamKind::Hidden { .. })
+    }
+    /// Whether the kind needs plug-in API 2 (WebAssembly plug-ins can't carry it).
+    pub fn needs_v2(&self) -> bool {
+        matches!(self, PluginParamKind::Point3 { .. } | PluginParamKind::Layer | PluginParamKind::Text { .. } | PluginParamKind::Hidden { .. })
+    }
 }
 
 /// One parameter of a plug-in effect.
@@ -110,6 +160,10 @@ pub struct PluginParam {
     /// Stable id (the property's match name; letters, digits, `_`).
     pub id: String,
     pub name: String,
+    /// API 2: the group / page path the parameter belongs to (`Advanced/Edges`). Hosts may
+    /// ignore it.
+    #[serde(default)]
+    pub group: String,
     #[serde(flatten)]
     pub kind: PluginParamKind,
 }
@@ -117,7 +171,7 @@ pub struct PluginParam {
 /// What a plug-in declares about itself.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct PluginManifest {
-    /// The plug-in API version it was written for (must be [`PLUGIN_API_VERSION`]).
+    /// The plug-in API version it was written for (1, or 2 up to [`PLUGIN_API_VERSION`]).
     pub api: u32,
     /// Stable, reverse-domain effect id (`org.example.posterize`); `ec.` is reserved.
     pub id: String,
@@ -137,9 +191,12 @@ pub struct PluginManifest {
 impl PluginManifest {
     /// Check the manifest against this API version.
     pub fn validate(&self) -> Result<(), String> {
-        const MAX_PARAMS: usize = 256;
-        if self.api != PLUGIN_API_VERSION {
-            return Err(format!("plug-in `{}` targets plug-in API {} but this build implements API {PLUGIN_API_VERSION}", self.id, self.api));
+        // API 2 effects from large third-party suites can declare far more parameters.
+        let max_params: usize = if self.api >= 2 { 1024 } else { 256 };
+        // Opaque plug-in data can be large (some effects keep look-up tables of a few MB).
+        const MAX_TEXT: usize = 64 << 20;
+        if !(1..=PLUGIN_API_VERSION).contains(&self.api) {
+            return Err(format!("plug-in `{}` targets plug-in API {} but this build implements API 1 to {PLUGIN_API_VERSION}", self.id, self.api));
         }
         let ok_id = |s: &str| !s.is_empty() && s.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-'));
         if !ok_id(&self.id) || self.id.starts_with("ec.") {
@@ -148,8 +205,8 @@ impl PluginManifest {
         if self.name.trim().is_empty() || self.category.trim().is_empty() {
             return Err(format!("plug-in `{}` needs a name and a category", self.id));
         }
-        if self.params.len() > MAX_PARAMS {
-            return Err(format!("plug-in `{}` has {} parameters (at most {MAX_PARAMS})", self.id, self.params.len()));
+        if self.params.len() > max_params {
+            return Err(format!("plug-in `{}` has {} parameters (at most {max_params})", self.id, self.params.len()));
         }
         let mut seen = std::collections::HashSet::new();
         for p in &self.params {
@@ -161,6 +218,16 @@ impl PluginManifest {
             {
                 return Err(format!("plug-in `{}`: popup `{}` needs options and a default index in range", self.id, p.id));
             }
+            if let PluginParamKind::Point3 { default } = &p.kind
+                && default.iter().any(|v| !v.is_finite())
+            {
+                return Err(format!("plug-in `{}`: point3 `{}` needs a finite default", self.id, p.id));
+            }
+            if let PluginParamKind::Text { default } | PluginParamKind::Hidden { default } = &p.kind
+                && default.len() > MAX_TEXT
+            {
+                return Err(format!("plug-in `{}`: the default of `{}` is longer than {MAX_TEXT} bytes", self.id, p.id));
+            }
             if let PluginParamKind::Slider { default, min, max, slider_min, slider_max, .. } = &p.kind {
                 let (lo, hi) = (slider_min.unwrap_or(*min), slider_max.unwrap_or(*max));
                 if [*default, *min, *max, lo, hi].iter().any(|v| !v.is_finite()) || min > max || lo > hi || default < min || default > max {
@@ -181,16 +248,94 @@ impl PluginManifest {
 pub struct PluginFrame<'a> {
     pub width: u32,
     pub height: u32,
-    /// Premultiplied RGBA, row-major, `width * height` pixels.
+    /// Premultiplied RGBA, row-major (row 0 = top), `width * height` pixels.
     pub pixels: &'a mut [[f32; 4]],
     /// Buffer pixels per layer pixel (preview resolution).
     pub scale: f64,
+    /// API 2: buffer-pixel position of layer pixel (0, 0) ([`Buf::offset`]; padding shifts it).
+    pub origin: [f64; 2],
+    /// API 2: the layer's bounds in layer pixels.
+    pub layer_size: [f64; 2],
+}
+
+/// An image the host hands an API 2 plug-in (the input at another time, or another layer).
+/// Same layout as [`PluginFrame`]: premultiplied RGBA, row 0 = top, `origin` = buffer pixels of
+/// layer pixel (0, 0) in this image.
+#[derive(Clone, Debug, Default)]
+pub struct PluginImage {
+    pub width: u32,
+    pub height: u32,
+    pub pixels: Vec<[f32; 4]>,
+    pub origin: [f64; 2],
+    pub scale: f64,
+}
+
+impl PluginImage {
+    fn from_buf(b: Buf) -> PluginImage {
+        PluginImage { width: b.img.width, height: b.img.height, pixels: b.img.data, origin: b.offset, scale: b.scale }
+    }
+
+    /// This image resampled onto a `width × height` buffer grid at `origin`/`scale` (the current
+    /// frame's); the pixels unchanged when the grids already match.
+    pub fn on_grid(&self, width: u32, height: u32, origin: [f64; 2], scale: f64) -> Vec<[f32; 4]> {
+        if self.width == width && self.height == height && self.origin == origin && self.scale == scale {
+            return self.pixels.clone();
+        }
+        let k = self.scale / scale.max(1e-9);
+        let src = crate::Image { width: self.width, height: self.height, data: self.pixels.clone() };
+        crate::util::gen_image(width, height, |x, y| {
+            let lx = (x as f64 + 0.5 - origin[0]) * k + self.origin[0];
+            let ly = (y as f64 + 0.5 - origin[1]) * k + self.origin[1];
+            src.sample_bilinear(lx, ly)
+        })
+        .data
+    }
+}
+
+/// Services available during an API 2 render ([`EffectPlugin::render_v2`]).
+pub trait PluginHost {
+    /// This effect's input (its layer with masks and the effects above this one) at another
+    /// **layer time** in seconds, in its own extent (see [`PluginImage::origin`]; it is not
+    /// padded). `None` when unavailable (adjustment layers, no host).
+    fn input_at(&self, layer_time: f64) -> Option<PluginImage>;
+    /// The layer chosen in Layer parameter `param_id` at **layer time** `layer_time` (converted
+    /// to composition time), effects and masks applied, resampled into this layer's buffer
+    /// (same size, origin and scale as the frame, centred when the layers differ in size).
+    /// `None` when unset or unavailable.
+    fn layer_input(&self, param_id: &str, layer_time: f64) -> Option<PluginImage>;
+    /// All flattened parameter values (and texts) at another layer time.
+    fn params_at(&self, layer_time: f64) -> Option<(Vec<f64>, Vec<String>)>;
+    /// Composition frame rate (30 when unknown).
+    fn frame_rate(&self) -> f64;
+    /// Layer time of the current render, seconds.
+    fn time(&self) -> f64;
+    /// A stable id of the applied effect instance: the same on every frame of one effect on one
+    /// layer, different for every layer and every application of the effect. Plug-ins that keep
+    /// state between frames pool their native instances by it. 0 when unknown.
+    fn instance_key(&self) -> u64 {
+        0
+    }
+    /// The layer's source time range in **layer time** seconds as (first, end): the first source
+    /// frame starts at `first` and the source ends at `end` (see [`crate::EffectEnv::layer_span`]).
+    /// `None` when the source has no duration or the host does not know it (retimers then
+    /// assume an unbounded range).
+    fn frame_range(&self) -> Option<(f64, f64)> {
+        None
+    }
+}
+
+/// The [`PluginHost::instance_key`] of the effect `ctx` renders: its instance seed (stable per
+/// effect instance), offset so it is never 0.
+pub fn ctx_instance_key(ctx: &EffectCtx) -> u64 {
+    (1u64 << 32) | u64::from(ctx.seed)
 }
 
 /// Parameter values for one render, flattened (see the module docs) with typed accessors.
 pub struct PluginParams<'a> {
     pub manifest: &'a PluginManifest,
     pub flat: &'a [f64],
+    /// One string per text / hidden parameter, in declaration order.
+    pub texts: &'a [String],
 }
 
 impl PluginParams<'_> {
@@ -214,10 +359,31 @@ impl PluginParams<'_> {
     }
     /// Point in frame pixels.
     pub fn point(&self, id: &str) -> [f64; 2] {
-        self.slot(id).map(|s| [s[0], s[1]]).unwrap_or([0.0; 2])
+        self.slot(id).and_then(|s| Some([*s.first()?, *s.get(1)?])).unwrap_or([0.0; 2])
+    }
+    /// 3D point: x, y in frame pixels, z as is.
+    pub fn point3(&self, id: &str) -> [f64; 3] {
+        self.slot(id).and_then(|s| Some([*s.first()?, *s.get(1)?, *s.get(2)?])).unwrap_or([0.0; 3])
     }
     pub fn color(&self, id: &str) -> [f64; 4] {
-        self.slot(id).map(|s| [s[0], s[1], s[2], s[3]]).unwrap_or([1.0; 4])
+        self.slot(id).and_then(|s| Some([*s.first()?, *s.get(1)?, *s.get(2)?, *s.get(3)?])).unwrap_or([1.0; 4])
+    }
+    /// The layer chosen in a layer parameter.
+    pub fn layer(&self, id: &str) -> Option<u64> {
+        self.slot(id).and_then(|s| s.first().copied()).filter(|v| *v >= 0.0).map(|v| v as u64)
+    }
+    /// A text / hidden parameter's string (empty for other ids).
+    pub fn text(&self, id: &str) -> &str {
+        let mut at = 0;
+        for p in &self.manifest.params {
+            if p.kind.is_text() {
+                if p.id == id {
+                    return self.texts.get(at).map(String::as_str).unwrap_or("");
+                }
+                at += 1;
+            }
+        }
+        ""
     }
 }
 
@@ -231,6 +397,24 @@ pub trait EffectPlugin: Send + Sync {
     fn source(&self) -> String {
         "built-in".into()
     }
+    /// API 2: transparent pixels to add on every side of the buffer before rendering (glows,
+    /// blurs, regions of definition larger than the input), in buffer pixels. `layer_size` is
+    /// the layer's size in layer pixels (the frame's [`PluginFrame::layer_size`]; 0 when unknown)
+    /// and `instance_key` the [`PluginHost::instance_key`] this render will have.
+    fn padding(&self, _params: &PluginParams, _time: f64, _scale: f64, _layer_size: [f64; 2], _instance_key: u64) -> u32 {
+        0
+    }
+    /// API 2: [`EffectPlugin::render`] with host services. The default calls `render`. May be
+    /// called from several threads at once.
+    fn render_v2(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64, _host: &dyn PluginHost) -> Result<(), String> {
+        self.render(frame, params, time)
+    }
+    /// Whether rendering reads the layer at other times (its neighbouring frames). Default
+    /// false; the render cache keys a layer with such an effect on its layer time. WebAssembly
+    /// ABI 2 plug-ins return true.
+    fn reads_other_times(&self) -> bool {
+        false
+    }
 }
 
 static SLOTS: [OnceLock<Arc<dyn EffectPlugin>>; MAX_PLUGINS] = [const { OnceLock::new() }; MAX_PLUGINS];
@@ -246,26 +430,66 @@ pub fn plugins() -> Vec<&'static EffectSpec> {
     plugin_specs().read().map(|v| v.clone()).unwrap_or_default()
 }
 
+/// The last render error of each plug-in effect (cleared by its next good render), so the UI can
+/// show it on the effect.
+fn render_errors() -> &'static RwLock<std::collections::HashMap<String, String>> {
+    static E: OnceLock<RwLock<std::collections::HashMap<String, String>>> = OnceLock::new();
+    E.get_or_init(Default::default)
+}
+
+/// Why the last render of plug-in effect `id` failed, if it did (the frame was left as it was).
+pub fn plugin_error(id: &str) -> Option<String> {
+    render_errors().read().ok()?.get(id).cloned()
+}
+
+fn set_plugin_error(id: &str, error: Option<String>) {
+    let Ok(mut m) = render_errors().write() else { return };
+    match error {
+        Some(e) => {
+            m.insert(id.to_string(), e);
+        }
+        None => {
+            m.remove(id);
+        }
+    }
+}
+
 /// The plug-in behind a registered effect id.
 pub fn plugin(id: &str) -> Option<Arc<dyn EffectPlugin>> {
     SLOTS.iter().filter_map(|s| s.get()).find(|p| p.manifest().id == id).cloned()
 }
 
+/// Whether the registered plug-in `id` reads the layer at other times (its neighbouring frames),
+/// so the render cache must key its layer on the layer time.
+pub fn reads_other_times(id: &str) -> bool {
+    SLOTS.iter().filter_map(|s| s.get()).any(|p| p.manifest().id == id && p.reads_other_times())
+}
+
 fn leak(s: &str) -> &'static str {
     Box::leak(s.to_string().into_boxed_str())
 }
 
 fn param_spec(p: &PluginParam) -> ParamSpec {
     let (default, ui) = match &p.kind {
-        PluginParamKind::Slider { default, min, max, slider_min, slider_max, decimals } => (
+        PluginParamKind::Slider { default, min, max, slider_min, slider_max, decimals, integer } => (
             Value::Scalar(*default),
-            ParamUi::Slider { min: *min, max: *max, slider_min: slider_min.unwrap_or(*min), slider_max: slider_max.unwrap_or(*max), decimals: *decimals },
+            ParamUi::Slider {
+                min: *min,
+                max: *max,
+                slider_min: slider_min.unwrap_or(*min),
+                slider_max: slider_max.unwrap_or(*max),
+                decimals: if *integer { 0 } else { *decimals },
+            },
         ),
         PluginParamKind::Angle { default } => (Value::Scalar(*default), ParamUi::Angle),
         PluginParamKind::Checkbox { default } => (Value::Bool(*default), ParamUi::Checkbox),
         PluginParamKind::Popup { options, default } => (Value::Enum(*default), ParamUi::Popup { options: options.clone() }),
         PluginParamKind::Point { default } => (Value::Vec2(*default), ParamUi::Point),
         PluginParamKind::Color { default } => (Value::Color(*default), ParamUi::Color),
+        PluginParamKind::Point3 { default } => (Value::Vec3(*default), ParamUi::Point3),
+        PluginParamKind::Layer => (Value::Layer(None), ParamUi::Layer),
+        PluginParamKind::Text { default } => (Value::Str(default.clone()), ParamUi::Text),
+        PluginParamKind::Hidden { default } => (Value::Str(default.clone()), ParamUi::Hidden),
     };
     ParamSpec { id: leak(&p.id), name: leak(&p.name), default, ui }
 }
@@ -280,7 +504,10 @@ pub fn register_plugin(plugin: Arc<dyn EffectPlugin>) -> Result<&'static EffectS
     if crate::registry().iter().any(|s| s.id == m.id) || specs.iter().any(|s| s.id == m.id) {
         return Err(format!("an effect with id `{}` is already registered", m.id));
     }
-    let slot = SLOTS.iter().position(|s| s.get().is_none()).ok_or_else(|| format!("too many plug-ins (at most {MAX_PLUGINS})"))?;
+    let slot = SLOTS
+        .iter()
+        .position(|s| s.get().is_none())
+        .ok_or_else(|| format!("too many plug-in effects: a session registers at most {MAX_PLUGINS}; remove some plug-ins and restart EffectCraft"))?;
     SLOTS[slot].set(plugin).map_err(|_| "plug-in slot taken".to_string())?;
     let spec: &'static EffectSpec = Box::leak(Box::new(EffectSpec {
         id: leak(&m.id),
@@ -300,49 +527,200 @@ fn trampoline<const I: usize>(ctx: &EffectCtx, buf: Buf) -> Buf {
     run_slot(I, ctx, buf)
 }
 
-macro_rules! trampolines {
-    ($($i:literal)*) => { [$(trampoline::<$i> as RenderFn),*] };
+/// Concatenate `A` runs of `B` render functions (`N` = `A * B`), for the table below.
+const fn concat<const A: usize, const B: usize, const N: usize>(parts: [[RenderFn; B]; A]) -> [RenderFn; N] {
+    let mut out = [trampoline::<0> as RenderFn; N];
+    let mut i = 0;
+    while i < N {
+        out[i] = parts[i / B][i % B];
+        i += 1;
+    }
+    out
 }
 
-const TRAMPOLINES: [RenderFn; MAX_PLUGINS] = trampolines!(
-    0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
-    32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
-);
+/// 16 trampolines `base ..= base + 15`.
+macro_rules! t16 {
+    ($b:expr) => {
+        [
+            trampoline::<{ $b }> as RenderFn,
+            trampoline::<{ $b + 1 }> as RenderFn,
+            trampoline::<{ $b + 2 }> as RenderFn,
+            trampoline::<{ $b + 3 }> as RenderFn,
+            trampoline::<{ $b + 4 }> as RenderFn,
+            trampoline::<{ $b + 5 }> as RenderFn,
+            trampoline::<{ $b + 6 }> as RenderFn,
+            trampoline::<{ $b + 7 }> as RenderFn,
+            trampoline::<{ $b + 8 }> as RenderFn,
+            trampoline::<{ $b + 9 }> as RenderFn,
+            trampoline::<{ $b + 10 }> as RenderFn,
+            trampoline::<{ $b + 11 }> as RenderFn,
+            trampoline::<{ $b + 12 }> as RenderFn,
+            trampoline::<{ $b + 13 }> as RenderFn,
+            trampoline::<{ $b + 14 }> as RenderFn,
+            trampoline::<{ $b + 15 }> as RenderFn,
+        ]
+    };
+}
+
+/// Four runs of `$inner` (each `$n` long, starting `$n` apart) from `$b`: `$total` trampolines.
+macro_rules! x4 {
+    ($inner:ident, $b:expr, $n:literal, $total:literal) => {
+        concat::<4, $n, $total>([$inner!($b), $inner!($b + $n), $inner!($b + 2 * $n), $inner!($b + 3 * $n)])
+    };
+}
+macro_rules! t64 {
+    ($b:expr) => {
+        x4!(t16, $b, 16, 64)
+    };
+}
+macro_rules! t256 {
+    ($b:expr) => {
+        x4!(t64, $b, 64, 256)
+    };
+}
+macro_rules! t1024 {
+    ($b:expr) => {
+        x4!(t256, $b, 256, 1024)
+    };
+}
+
+const TRAMPOLINES: [RenderFn; MAX_PLUGINS] = t1024!(0);
 
 /// Flatten an instance's evaluated parameters for the plug-in (points mapped to frame pixels).
 pub fn flatten(m: &PluginManifest, ctx: &EffectCtx, buf: &Buf) -> Vec<f64> {
+    flatten_params(m, ctx.params, buf.offset, buf.scale)
+}
+
+/// [`flatten`] for any evaluated parameters, with points mapped by buffer `offset` and `scale`.
+pub fn flatten_params(m: &PluginManifest, params: &Params, offset: [f64; 2], scale: f64) -> Vec<f64> {
+    let to_px = |q: [f64; 2]| (q[0] * scale + offset[0], q[1] * scale + offset[1]);
     let mut out = Vec::with_capacity(m.flat_len());
     for p in &m.params {
-        let v = ctx.params.get(&p.id);
+        let v = params.get(&p.id);
         match &p.kind {
             PluginParamKind::Point { .. } => {
-                let q = v.map(Value::as_vec2).unwrap_or([0.0; 2]);
-                let (x, y) = buf.to_px(q);
+                let (x, y) = to_px(v.map(Value::as_vec2).unwrap_or([0.0; 2]));
                 out.extend([x, y]);
             }
+            PluginParamKind::Point3 { default } => {
+                let q = v.map(Value::as_vec3).unwrap_or(*default);
+                let (x, y) = to_px([q[0], q[1]]);
+                out.extend([x, y, q[2]]);
+            }
             PluginParamKind::Color { .. } => {
                 let c = v.map(Value::as_color).unwrap_or([1.0; 4]);
                 out.extend(c.iter().map(|x| *x as f64));
             }
             PluginParamKind::Checkbox { .. } => out.push(if v.map(Value::as_bool).unwrap_or(false) { 1.0 } else { 0.0 }),
             PluginParamKind::Popup { .. } => out.push(v.map(Value::as_enum).unwrap_or(0) as f64),
+            PluginParamKind::Layer => out.push(v.and_then(Value::as_layer).map(|l| l as f64).unwrap_or(-1.0)),
+            PluginParamKind::Text { .. } | PluginParamKind::Hidden { .. } => {}
             _ => out.push(v.map(Value::as_f64).unwrap_or(0.0)),
         }
     }
     out
 }
 
+/// The strings of an instance's text / hidden parameters, in declaration order.
+pub fn flatten_texts(m: &PluginManifest, params: &Params) -> Vec<String> {
+    m.params
+        .iter()
+        .filter_map(|p| match &p.kind {
+            PluginParamKind::Text { default } | PluginParamKind::Hidden { default } => Some(match params.get(&p.id) {
+                Some(Value::Str(s)) => s.clone(),
+                _ => default.clone(),
+            }),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The host services of one render, on top of the effect context and the (padded) buffer.
+struct RenderHost<'a, 'b> {
+    ctx: &'a EffectCtx<'b>,
+    manifest: &'a PluginManifest,
+    width: u32,
+    height: u32,
+    offset: [f64; 2],
+    scale: f64,
+}
+
+impl RenderHost<'_, '_> {
+    /// The frame's pixel grid without pixels (what [`crate::util::fit_layer`] measures).
+    fn grid(&self) -> Buf {
+        Buf { img: crate::Image { width: self.width, height: self.height, data: vec![] }, offset: self.offset, scale: self.scale }
+    }
+}
+
+impl PluginHost for RenderHost<'_, '_> {
+    fn input_at(&self, layer_time: f64) -> Option<PluginImage> {
+        let host = self.ctx.env.host?;
+        host.self_at(layer_time, self.ctx.env.effect_index).map(PluginImage::from_buf)
+    }
+
+    fn layer_input(&self, param_id: &str, layer_time: f64) -> Option<PluginImage> {
+        let ctx = self.ctx;
+        let lid = ctx.params.get(param_id)?.as_layer()?;
+        let other = if (layer_time - ctx.time).abs() < 1e-9 {
+            ctx.layer_param(param_id, true)?
+        } else {
+            let host = ctx.env.host?;
+            // Source / Masks show no effects; the default (Effects & Masks) does.
+            let with_effects = !matches!(ctx.params.get(&crate::layer_source_id(param_id)).map(Value::as_enum), Some(0 | 1));
+            host.layer_at(lid, ctx.env.comp_time + (layer_time - ctx.time), with_effects)?
+        };
+        let img = crate::util::fit_layer(ctx, &self.grid(), &other, false);
+        Some(PluginImage { width: img.width, height: img.height, pixels: img.data, origin: self.offset, scale: self.scale })
+    }
+
+    fn params_at(&self, layer_time: f64) -> Option<(Vec<f64>, Vec<String>)> {
+        let p = self.ctx.env.host?.params_at(layer_time)?;
+        Some((flatten_params(self.manifest, &p, self.offset, self.scale), flatten_texts(self.manifest, &p)))
+    }
+
+    fn frame_rate(&self) -> f64 {
+        self.ctx.fps()
+    }
+
+    fn time(&self) -> f64 {
+        self.ctx.time
+    }
+
+    fn instance_key(&self) -> u64 {
+        ctx_instance_key(self.ctx)
+    }
+
+    fn frame_range(&self) -> Option<(f64, f64)> {
+        self.ctx.env.layer_span
+    }
+}
+
 fn run_slot(slot: usize, ctx: &EffectCtx, mut buf: Buf) -> Buf {
     let Some(plugin) = SLOTS[slot].get() else { return buf };
     let m = plugin.manifest();
+    let texts = flatten_texts(m, ctx.params);
     let flat = flatten(m, ctx, &buf);
-    let params = PluginParams { manifest: m, flat: &flat };
-    let (width, height) = (buf.img.width, buf.img.height);
-    let before = buf.img.data.clone();
-    let mut frame = PluginFrame { width, height, pixels: &mut buf.img.data, scale: buf.scale };
-    if let Err(e) = plugin.render(&mut frame, &params, ctx.time) {
+    let key = ctx_instance_key(ctx);
+    let pad = plugin.padding(&PluginParams { manifest: m, flat: &flat, texts: &texts }, ctx.time, buf.scale, ctx.layer_size, key).min(MAX_PADDING);
+    let before = buf.clone();
+    // Padding moves the layer origin, which points are measured from.
+    let flat = if pad > 0 {
+        buf.pad(pad);
+        flatten(m, ctx, &buf)
+    } else {
+        flat
+    };
+    let params = PluginParams { manifest: m, flat: &flat, texts: &texts };
+    let (width, height, offset, scale) = (buf.img.width, buf.img.height, buf.offset, buf.scale);
+    let host = RenderHost { ctx, manifest: m, width, height, offset, scale };
+    let mut frame = PluginFrame { width, height, pixels: &mut buf.img.data, scale, origin: offset, layer_size: ctx.layer_size };
+    if let Err(e) = plugin.render_v2(&mut frame, &params, ctx.time, &host) {
         log::warn!("plug-in `{}`: {e}", m.id);
-        buf.img.data = before;
+        set_plugin_error(&m.id, Some(e));
+        return before;
+    }
+    if plugin_error(&m.id).is_some() {
+        set_plugin_error(&m.id, None);
     }
     buf
 }
diff --git a/crates/effects/src/psim.rs b/crates/effects/src/psim.rs
index aabbcdce8..5716a2dcb 100644
--- a/crates/effects/src/psim.rs
+++ b/crates/effects/src/psim.rs
@@ -85,21 +85,27 @@ pub trait ParticleSim: Send + Sync {
 /// (the CPU step's `carry` arithmetic, exactly). `None` when more than `cap` would be born (the
 /// CPU drops births at its live-particle cap, which an independent simulation can't know).
 pub fn births(rate: f64, steps: u64, cap: usize) -> Option<Vec<u32>> {
-    let per = rate / SPS;
-    if per * steps as f64 > cap as f64 + 2.0 {
+    if rate / SPS * steps as f64 > cap as f64 + 2.0 {
         return None;
     }
+    births_at(steps, cap, |_| rate)
+}
+
+/// [`births`] with the rate of each step, `rate(i)` particles per second during step `i` (a
+/// keyframed Birth Rate, #1373).
+pub fn births_at(steps: u64, cap: usize, rate: impl Fn(u64) -> f64) -> Option<Vec<u32>> {
     let mut out = Vec::new();
     let mut carry = 0.0f64;
     for i in 0..steps {
-        carry += per;
+        carry += rate(i) / SPS;
         let n = carry.floor() as u32;
         carry -= n as f64;
-        for _ in 0..n {
-            out.push(i as u32);
+        if n as usize > cap.saturating_sub(out.len()) {
+            return None;
         }
+        out.extend(std::iter::repeat_n(i as u32, n as usize));
     }
-    (out.len() <= cap).then_some(out)
+    Some(out)
 }
 
 /// Steps per second of the stepped simulations.
diff --git a/crates/effects/src/puppet/mod.rs b/crates/effects/src/puppet.rs
similarity index 100%
rename from crates/effects/src/puppet/mod.rs
rename to crates/effects/src/puppet.rs
diff --git a/crates/effects/src/roto.rs b/crates/effects/src/roto.rs
index a6c80e742..f9c26f417 100644
--- a/crates/effects/src/roto.rs
+++ b/crates/effects/src/roto.rs
@@ -9,7 +9,8 @@
 //! neighbouring frames with [`crate::EffectHost::self_at`]). Undo, redo and reopening a project
 //! therefore never see stale mattes. Behind the memory cache an optional [`SegStore`] (the
 //! persistent disk cache, set by the engine) keeps computed segmentations across restarts. **Freeze** stores the final mattes in the hidden **Frozen**
-//! parameter ([`FrozenCache`]); they are used while their key still matches.
+//! parameter ([`FrozenCache`]); they are used while their key still matches, whichever model the
+//! session has (a session without the model that froze them uses them as they are).
 //!
 //! Rendering: binary segmentation → Roto Brush Matte (Shift Edge, Reduce Chatter, Feather,
 //! Contrast) → Refine Edge matting inside the Refine Edge band (guided filter + closed-form
@@ -29,9 +30,9 @@ use std::sync::{Arc, Mutex, OnceLock, RwLock, Weak};
 use effectcraft_keyframe::Value;
 use effectcraft_project::ParamUi;
 use effectcraft_raster::Image;
-use effectcraft_segment::MaskModel;
+use effectcraft_segment::{ClipFrame, MaskModel, TrackRequest};
 use effectcraft_track::roto::refine::{self, MatteParams};
-use effectcraft_track::roto::{self as rb, RotoData, SegOpts, rle};
+use effectcraft_track::roto::{self as rb, Gmm, RotoData, SegOpts, rle};
 use rayon::prelude::*;
 use serde::{Deserialize, Serialize};
 
@@ -40,12 +41,16 @@ use crate::{Buf, EffectCtx, EffectSpec, Params, num, p, popup, slider};
 
 pub use effectcraft_track::roto::{FrameSeg, Stroke, StrokeKind};
 
+mod pending;
+
 /// The effect's id.
 pub const ID: &str = "ec.matte.rotobrush";
 /// Hidden parameters.
 pub const STROKES: &str = "strokes";
 pub const INPUT_KEY: &str = "inputKey";
 pub const FROZEN: &str = "frozen";
+/// The saved tracking (see [`TrackCache`]).
+pub const TRACKED: &str = "tracked";
 
 /// Default segmentation span each side of the base frame (frames).
 pub const DEFAULT_SPAN: i64 = 20;
@@ -78,6 +83,7 @@ pub fn specs() -> Vec<EffectSpec> {
             p("rotoBrushMatte/contrast", "Contrast", num(0.0), slider(0.0, 100.0, 0.0, 100.0, 0)),
             p("rotoBrushMatte/shiftEdge", "Shift Edge", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 0)),
             p("rotoBrushMatte/reduceChatter", "Reduce Chatter", num(0.0), slider(0.0, 100.0, 0.0, 100.0, 0)),
+            p("rotoBrushMatte/object", "Show Object", num(0.0), slider(0.0, 32.0, 0.0, 32.0, 0)),
             p("refineEdgeMatte/smooth", "Smooth", num(1.0), slider(0.0, 100.0, 0.0, 10.0, 1)),
             p("refineEdgeMatte/feather", "Feather", num(0.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
             p("refineEdgeMatte/contrast", "Contrast", num(0.0), slider(0.0, 100.0, 0.0, 100.0, 0)),
@@ -95,6 +101,7 @@ pub fn specs() -> Vec<EffectSpec> {
             p(STROKES, "Strokes", Value::Str(String::new()), ParamUi::Hidden),
             p(INPUT_KEY, "Input Key", Value::Str(String::new()), ParamUi::Hidden),
             p(FROZEN, "Frozen", Value::Str(String::new()), ParamUi::Hidden),
+            p(TRACKED, "Tracked", Value::Str(String::new()), ParamUi::Hidden),
         ],
         render,
         gpu: false,
@@ -191,9 +198,15 @@ pub fn set_model(m: Option<Arc<dyn MaskModel>>) {
     }
 }
 
+/// Whether an instance with `params` segments with the model Settings chose: Roto Brush 2.0 and
+/// 3.0 do, 1.0 is the classic engine.
+pub fn uses_model(params: &Params) -> bool {
+    e(params, "version") != 0
+}
+
 /// The model an instance segments with: its version's choice of the installed one.
 pub fn model_for(params: &Params) -> Option<Arc<dyn MaskModel>> {
-    if e(params, "version") == 0 {
+    if !uses_model(params) {
         return None;
     }
     installed_model()
@@ -208,6 +221,11 @@ pub fn installed_model() -> Option<Arc<dyn MaskModel>> {
 /// Seed of the chain keys: what the frames are (the engine-maintained Input Key), the layer
 /// size, the frame rate, the segmentation settings and the model.
 pub fn seed(params: &Params, layer_size: [f64; 2], fps: f64) -> u64 {
+    seed_with(params, layer_size, fps, model_for(params).map_or(effectcraft_segment::CLASSICAL, |m| m.info().id))
+}
+
+/// [`seed`] with the segmenting model named by its id (saved tracking names the one that made it).
+fn seed_with(params: &Params, layer_size: [f64; 2], fps: f64, model: &str) -> u64 {
     let mut h = 0xcbf2_9ce4_8422_2325;
     fnv(&mut h, s(params, INPUT_KEY).as_bytes());
     for v in [
@@ -221,10 +239,15 @@ pub fn seed(params: &Params, layer_size: [f64; 2], fps: f64) -> u64 {
         fnv(&mut h, &v.to_bits().to_le_bytes());
     }
     fnv(&mut h, &[e(params, "quality") as u8, e(params, "version") as u8]);
-    fnv(&mut h, model_for(params).map_or(effectcraft_segment::CLASSICAL, |m| m.info().id).as_bytes());
+    fnv(&mut h, model.as_bytes());
     h
 }
 
+/// Show Object: 0 shows every object, N object N alone.
+fn show_object_of(params: &Params) -> u32 {
+    f(params, "rotoBrushMatte/object").round().clamp(0.0, 32.0) as u32
+}
+
 /// The layer frame shown at layer time `t` seconds.
 pub fn frame_of(t: f64, fps: f64) -> i64 {
     (t * fps + 1e-6).floor() as i64
@@ -298,9 +321,44 @@ fn from_store(key: u64, scale: f64) -> Option<Arc<FrameSeg>> {
     Some(seg)
 }
 
+/// Tracker results live under the chain key mixed with this, so a frame the tracker followed and
+/// one the classic engine computed never share a cache slot.
+const TRACK_SALT: u64 = 0x7472_6163_6b65_7231;
+
+fn tracked_key(key: u64) -> u64 {
+    key.rotate_left(17) ^ TRACK_SALT
+}
+
+/// Where one object's matte of a tracked frame lives (kept only when the instance has several objects).
+fn object_key(key: u64, object: u32) -> u64 {
+    tracked_key(key).wrapping_add(0x9e37_79b9_7f4a_7c15u64.wrapping_mul(u64::from(object) + 1))
+}
+
+/// How far to trust a frame the tracker followed.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct FrameTrust {
+    /// 0–1, from the tracker's own object score and mask quality.
+    pub confidence: f32,
+    /// The object is not in this frame (an empty matte).
+    pub occluded: bool,
+}
+
+fn trust_cache() -> &'static Mutex<HashMap<u64, FrameTrust>> {
+    static T: OnceLock<Mutex<HashMap<u64, FrameTrust>>> = OnceLock::new();
+    T.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+/// The tracker's confidence in the frame with chain key `key`, if the tracker followed it.
+pub fn trust(key: u64) -> Option<FrameTrust> {
+    trust_cache().lock().unwrap_or_else(|e| e.into_inner()).get(&tracked_key(key)).copied()
+}
+
 /// Drop the cached segmentations of these chain keys (every scale).
 pub fn forget(keys: impl IntoIterator<Item = u64>) {
-    let keys: std::collections::HashSet<u64> = keys.into_iter().collect();
+    let mut trusts = trust_cache().lock().unwrap_or_else(|e| e.into_inner());
+    let keys: std::collections::HashSet<u64> = keys.into_iter().flat_map(|k| [k, tracked_key(k)]).collect();
+    trusts.retain(|k, _| !keys.contains(k));
+    drop(trusts);
     let mut c = cache().lock().unwrap_or_else(|e| e.into_inner());
     let gone: Vec<(u64, u64)> = c.map.keys().filter(|k| keys.contains(&k.0)).copied().collect();
     for k in gone {
@@ -313,6 +371,7 @@ pub fn forget(keys: impl IntoIterator<Item = u64>) {
 
 /// Drop every cached segmentation (Edit ▸ Purge).
 pub fn purge() {
+    trust_cache().lock().unwrap_or_else(|e| e.into_inner()).clear();
     let mut c = cache().lock().unwrap_or_else(|e| e.into_inner());
     c.map.clear();
     c.order.clear();
@@ -333,6 +392,16 @@ pub fn layer_grid(buf: &Buf, layer_size: [f64; 2]) -> Image {
     img
 }
 
+/// What a tracking pass found.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct TrackSummary {
+    pub frames: usize,
+    /// Frames where the object was absent.
+    pub occluded: usize,
+    pub min_confidence: f32,
+}
+
 /// Everything needed to compute an instance's segmentations.
 pub struct Chain {
     pub data: Arc<RotoData>,
@@ -341,13 +410,113 @@ pub struct Chain {
     pub refine_radius: f64,
     /// The trained model (Version 2.0 / 3.0 with one installed).
     pub model: Option<Arc<dyn MaskModel>>,
+    /// The saved tracking, while it applies (see [`TrackCache`]).
+    pub(crate) saved: Option<SavedTracking>,
+    /// Show Object: the matte of this object only (its id plus one; 0 shows all of them together).
+    pub show_object: u32,
 }
 
 impl Chain {
     pub fn new(params: &Params, layer_size: [f64; 2], fps: f64, scale: f64) -> Chain {
         let data = data(params);
         let keys = data.chain_keys(seed(params, layer_size, fps));
-        Chain { refine_radius: data.refine_radius(), data, keys, opts: seg_opts(params, scale), model: model_for(params) }
+        let saved = saved_for(params, &data, layer_size, fps);
+        let show_object = show_object_of(params);
+        Chain { refine_radius: data.refine_radius(), data, keys, opts: seg_opts(params, scale), model: model_for(params), saved, show_object }
+    }
+
+    /// Frame `f`'s segmentation at `scale` from the saved tracking or the caches; computes nothing.
+    pub fn cached_seg(&self, f: i64, scale: f64) -> Option<Arc<FrameSeg>> {
+        self.saved_seg(f, scale).or_else(|| self.keys.get(&f).and_then(|k| cached(*k, scale)))
+    }
+
+    /// Object `o`'s matte of frame `f` at this chain's scale (saved tracking, else this session's), when the instance
+    /// has several objects and the tracker followed them there; computes nothing.
+    pub fn object_seg(&self, f: i64, o: u32) -> Option<Arc<FrameSeg>> {
+        let sc = self.opts.scale;
+        // A frame the saved tracking has is read from it, under the keys it was made with: the model chosen now
+        // may not be the one that tracked it, and its own cache must not hold another model's matte.
+        let saved = self.saved.as_ref().filter(|t| t.cache.frames.contains_key(&f)).and_then(|t| t.keys.get(&f).map(|k| (t, *k)));
+        let k = match saved {
+            Some((_, saved_key)) => saved_key,
+            None => *self.keys.get(&f)?,
+        };
+        let ok = object_key(k, o);
+        if let Some(s) = cached(ok, sc) {
+            return Some(s);
+        }
+        let full = match cached(ok, 1.0) {
+            Some(s) => s,
+            None => {
+                let (t, _) = saved?;
+                let s = Arc::new(decode_object(&t.cache, f, o)?);
+                store(ok, 1.0, s.clone());
+                s
+            }
+        };
+        if sc == 1.0 {
+            return Some(full);
+        }
+        let s = Arc::new(downscale(&full, sc));
+        store(ok, sc, s.clone());
+        Some(s)
+    }
+
+    /// What Show Object asks for at frame `f`: `None` shows the whole matte (all objects, a single object, or a frame
+    /// the tracker did not follow); a missing object on a tracked frame shows nothing.
+    fn shown_object(&self, f: i64) -> Option<Arc<FrameSeg>> {
+        let o = self.show_object.checked_sub(1)?;
+        let objects = self.data.objects();
+        if objects.len() < 2 {
+            return None;
+        }
+        if objects.contains(&o)
+            && let Some(seg) = self.object_seg(f, o)
+        {
+            return Some(seg);
+        }
+        let sc = self.opts.scale;
+        let tracked = self.saved_seg(f, sc).or_else(|| {
+            let key = tracked_key(*self.keys.get(&f)?);
+            cached(key, sc).or_else(|| cached(key, 1.0).map(|seg| Arc::new(downscale(&seg, sc))))
+        })?;
+        Some(Arc::new(FrameSeg::empty(tracked.w, tracked.h)))
+    }
+
+    /// The tracker's trust in frame `f`: from the saved tracking, else from this session's tracking.
+    pub fn trust_at(&self, f: i64) -> Option<FrameTrust> {
+        if let Some(fr) = self.saved.as_ref().and_then(|t| t.cache.frames.get(&f)) {
+            return Some(FrameTrust { confidence: fr.c, occluded: fr.o });
+        }
+        trust(*self.keys.get(&f)?)
+    }
+
+    /// The model the saved tracking was made with, while it applies.
+    pub fn saved_model(&self) -> Option<&str> {
+        self.saved.as_ref().map(|t| t.cache.model.as_str())
+    }
+
+    /// Frame `f` of the saved tracking at `scale` (decoded once, then cached).
+    fn saved_seg(&self, f: i64, scale: f64) -> Option<Arc<FrameSeg>> {
+        let t = self.saved.as_ref()?;
+        let k = tracked_key(*t.keys.get(&f)?);
+        if let Some(s) = cached(k, scale) {
+            return Some(s);
+        }
+        let full = match cached(k, 1.0) {
+            Some(s) => s,
+            None => {
+                let s = Arc::new(decode_tracked(&t.cache, f)?);
+                store(k, 1.0, s.clone());
+                s
+            }
+        };
+        if scale == 1.0 {
+            return Some(full);
+        }
+        let s = Arc::new(downscale(&full, scale));
+        store(k, scale, s.clone());
+        Some(s)
     }
 
     /// Frame `f`'s segmentation at this chain's scale: cached, or computed from the nearest
@@ -356,37 +525,98 @@ impl Chain {
     pub fn ensure(&self, f: i64, frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>, cancel: &dyn Fn() -> bool) -> Option<Arc<FrameSeg>> {
         let sc = self.opts.scale;
         let lookup = |g: i64| -> Option<Arc<FrameSeg>> {
+            // Show Object: one object's matte, where the tracker followed the objects.
+            if let Some(s) = self.shown_object(g) {
+                return Some(s);
+            }
+            // A frame the tracker followed wins over the classic engine's: the saved tracking, else
+            // this session's.
+            if let Some(s) = self.saved_seg(g, sc) {
+                return Some(s);
+            }
             let k = *self.keys.get(&g)?;
+            if let Some(s) = cached(tracked_key(k), sc) {
+                return Some(s);
+            }
             if let Some(s) = cached(k, sc).or_else(|| from_store(k, sc)) {
                 return Some(s);
             }
             if sc != 1.0 {
-                let full = cached(k, 1.0).or_else(|| from_store(k, 1.0))?;
+                let full = cached(tracked_key(k), 1.0).or_else(|| cached(k, 1.0)).or_else(|| from_store(k, 1.0))?;
                 let s = Arc::new(downscale(&full, sc));
                 store(k, sc, s.clone());
                 return Some(s);
             }
             None
         };
+        self.carry(f, None, frame, cancel, &lookup, &mut |g, seg| {
+            let k = *self.keys.get(&g)?;
+            store(k, sc, seg.clone());
+            if let Some(st) = seg_store() {
+                st.put_seg(k, sc, seg);
+            }
+            Some(())
+        })
+    }
+
+    /// [`Chain::ensure`]'s walk: the matte carried to `f` from the nearest frame towards the base that `lookup` has,
+    /// else from the root cut afresh from its strokes. `object: None` carries every stroke from the base frame (the shown
+    /// matte); `Some(o)` carries only `o`'s, from its foreground-stroked frame nearest the base on the way. `keep`
+    /// gets every frame made on the way.
+    fn carry(
+        &self,
+        f: i64,
+        object: Option<u32>,
+        frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>,
+        cancel: &dyn Fn() -> bool,
+        lookup: &dyn Fn(i64) -> Option<Arc<FrameSeg>>,
+        keep: &mut dyn FnMut(i64, &Arc<FrameSeg>) -> Option<()>,
+    ) -> Option<Arc<FrameSeg>> {
+        let strokes = |g: i64| match object {
+            Some(o) => self.data.strokes_of(g, o),
+            None => self.data.strokes_at(g),
+        };
         if let Some(s) = lookup(f) {
             return Some(s);
         }
         let base = self.data.base?;
+        let root = match object {
+            Some(o) => {
+                // one pass over the strokes, not one per frame on the way
+                let on_the_way = |g: i64| (g == base || g.cmp(&base) == f.cmp(&base)) && g.abs_diff(base) <= f.abs_diff(base);
+                let fg = self.data.strokes.iter().filter(|s| s.object == o && s.kind == StrokeKind::Fg && on_the_way(s.frame));
+                fg.map(|s| s.frame).min_by_key(|g| g.abs_diff(base)).unwrap_or(f)
+            }
+            None => base,
+        };
         if !self.data.in_span(f) {
             return None;
         }
-        // Walk towards the base to the nearest available frame.
+        // A new first stroke can still have a valid tracked matte nearer the base. Look for it
+        // without reading those frames; without one, start afresh at the object's first stroke.
         let mut path = vec![f];
+        let mut untracked_len = 1;
         let mut g = f;
         let mut start: Option<Arc<FrameSeg>> = None;
-        while let Some(src) = self.data.source_of(g) {
+        while g != base
+            && let Some(src) = self.data.source_of(g)
+        {
+            if cancel() {
+                return None;
+            }
             if let Some(s) = lookup(src) {
                 start = Some(s);
                 break;
             }
             path.push(src);
+            if src == root {
+                untracked_len = path.len();
+            }
             g = src;
         }
+        if start.is_none() {
+            path.truncate(untracked_len);
+        }
         path.reverse();
         let mut prev_img: Option<Arc<Image>> = None;
         let mut cur = start;
@@ -395,8 +625,8 @@ impl Chain {
                 return None;
             }
             let img = frame(g)?;
-            let strokes = self.data.strokes_at(g);
-            let seg = match (&cur, g == base) {
+            let strokes = strokes(g);
+            let seg = match (&cur, object.is_none() && g == root) {
                 (_, true) | (None, _) => rb::segment_with(&img, &strokes, None, &self.opts, self.refine_radius, self.model.as_deref()),
                 (Some(p), false) => {
                     let src = self.data.source_of(g)?;
@@ -407,25 +637,256 @@ impl Chain {
                     if pimg.width != img.width || pimg.height != img.height {
                         return None;
                     }
-                    rb::propagate_with(&pimg, p, &img, &strokes, &self.opts, self.refine_radius, self.model.as_deref())
+                    // A tracker is too slow to prompt on every frame (its pass is `track`); the classic flow carries the rest.
+                    rb::propagate_with(&pimg, p, &img, &strokes, &self.opts, self.refine_radius, if self.has_tracker() { None } else { self.model.as_deref() })
                 }
             };
             let seg = Arc::new(seg);
-            let k = *self.keys.get(&g)?;
-            store(k, sc, seg.clone());
-            if let Some(st) = seg_store() {
-                st.put_seg(k, sc, &seg);
-            }
+            keep(g, &seg)?;
             cur = Some(seg);
             prev_img = Some(img);
         }
         cur
     }
 
-    /// Whether frame `f` is computed (at full resolution or at `scale`).
+    /// Whether frame `f` is computed (at full resolution or at `scale`): in this session's caches,
+    /// or in the tracking saved with the project, which needs no work to be used even before it has
+    /// been decoded (and whichever model Settings choose now).
     pub fn is_cached(&self, f: i64, scale: f64) -> bool {
-        self.keys.get(&f).is_some_and(|k| cached(*k, 1.0).is_some() || cached(*k, scale).is_some())
+        self.keys.get(&f).is_some_and(|k| [*k, tracked_key(*k)].iter().any(|k| cached(*k, 1.0).is_some() || cached(*k, scale).is_some()))
+            || self.saved.as_ref().is_some_and(|t| t.cache.frames.contains_key(&f) && t.keys.contains_key(&f))
     }
+
+    /// Whether the tracking saved with the project has frame `f` (and applies to this chain).
+    pub fn saved_has(&self, f: i64) -> bool {
+        self.saved.as_ref().is_some_and(|t| t.cache.frames.contains_key(&f) && t.keys.contains_key(&f))
+    }
+
+    /// Whether the chosen model can follow an object through a clip (SAM 2).
+    pub fn has_tracker(&self) -> bool {
+        self.model.as_ref().is_some_and(|m| m.tracker().is_some())
+    }
+
+    /// Explicit propagation replaces tracking made by another model. Rendering and Freeze keep
+    /// using saved mattes even when that model is unavailable, so this is only called for Propagate.
+    pub fn prepare_propagation(&mut self) {
+        if self.saved_model().is_some_and(|saved| self.model.as_ref().is_none_or(|model| model.info().id != saved)) {
+            self.saved = None;
+        }
+    }
+
+    /// Discard a failed track completely before falling back to the classic engine.
+    pub fn forget_tracking(&mut self) {
+        let mut objects = self.data.objects();
+        if let Some(saved) = &self.saved {
+            objects.extend(saved.cache.objects.keys().copied());
+            objects.sort_unstable();
+            objects.dedup();
+        }
+        let keys = self.keys.values().chain(self.saved.iter().flat_map(|saved| saved.keys.values())).copied();
+        forget(keys.flat_map(|key| std::iter::once(key).chain(objects.iter().copied().map(move |object| object_key(key, object)))));
+        self.saved = None;
+        self.model = None;
+    }
+
+    /// Follow the object through the span with the model's tracker, from the strokes on their
+    /// frames (only the frames without a tracked result yet: after a correction stroke, the frames it
+    /// changes, tracked on from the nearest prompted frame), and cache every frame's segmentation (under the tracker's keys, with its
+    /// confidence). The strokes stay hard constraints and the edges are refined at full
+    /// resolution; frames the tracker can't give are left to [`Chain::ensure`]'s classic engine.
+    /// `progress` gets the number of frames finished. `Ok(None)`: no tracker, nothing done.
+    pub fn track(
+        &self,
+        frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>,
+        cancel: &dyn Fn() -> bool,
+        progress: &mut dyn FnMut(usize),
+    ) -> Result<Option<TrackSummary>, String> {
+        self.track_frames(None, frame, cancel, progress)
+    }
+
+    /// [`Chain::track`] limited to `wanted` frames (a one-direction Propagate): the window, the work and the
+    /// progress count cover only those frames of the span.
+    pub fn track_frames(
+        &self,
+        wanted: Option<&[i64]>,
+        frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>,
+        cancel: &dyn Fn() -> bool,
+        progress: &mut dyn FnMut(usize),
+    ) -> Result<Option<TrackSummary>, String> {
+        self.track_with_pending_limit(wanted, frame, cancel, progress, pending::MAX_PENDING_BYTES)
+    }
+
+    fn track_with_pending_limit(
+        &self,
+        wanted: Option<&[i64]>,
+        frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>,
+        cancel: &dyn Fn() -> bool,
+        progress: &mut dyn FnMut(usize),
+        max_pending_bytes: usize,
+    ) -> Result<Option<TrackSummary>, String> {
+        let Some(tracker) = self.model.as_ref().and_then(|m| m.tracker()) else { return Ok(None) };
+        let (Some(base), true) = (self.data.base, self.data.span[1] >= self.data.span[0]) else { return Err("no base frame".into()) };
+        // Frames of the span that already have a tracked result (this session's, or the saved
+        // tracking) are kept: only the rest is tracked. A correction stroke changes the keys of the
+        // frames from it on (both directions), so only those come back here.
+        let (lo_span, hi_span) = (self.data.span[0], self.data.span[1]);
+        let needed: Vec<i64> = (lo_span..=hi_span)
+            .filter(|f| wanted.is_none_or(|w| w.contains(f)))
+            .filter(|f| self.keys.get(f).is_some_and(|k| self.saved_seg(*f, self.opts.scale).is_none() && cached(tracked_key(*k), self.opts.scale).is_none()))
+            .collect();
+        let (Some(&need_lo), Some(&need_hi)) = (needed.first(), needed.last()) else {
+            return Ok(Some(TrackSummary::default()));
+        };
+        // Each object has its own prompts: a few clicks from its strokes and a box saying how far it reaches (clicks
+        // alone pick a part of the object). SAM 2 fills the box it is given, so the box surrounds the object's matte
+        // on that frame: the one shown for a lone object; with several, each object's own, carried with its own strokes
+        // as the shown one is (from its first prompted frame, or the nearest tracked or prompted frame), so a correction stroke on
+        // part of an object still boxes all of it. Those per-object mattes are not cached: their keys mean tracked results.
+        let objects = self.data.objects();
+        let several = objects.len() > 1;
+        let mut by_object: Vec<Vec<(i64, effectcraft_segment::Prompt)>> = vec![];
+        for &obj in &objects {
+            let mut prompts = vec![];
+            let mut carried: Option<(i64, Arc<FrameSeg>)> = None;
+            // from the base outwards on each side, so each carry goes on from the one before
+            let mut frames: Vec<i64> = self.data.stroke_frames().into_iter().filter(|f| self.data.in_span(*f)).collect();
+            frames.sort_by_key(|f| (*f < base, f.abs_diff(base)));
+            for f in frames {
+                let strokes = self.data.strokes_of(f, obj);
+                if !strokes.iter().any(|s| s.kind == StrokeKind::Fg) {
+                    continue;
+                }
+                let own = if several {
+                    // a later correction frame carries on from the one before it (only the last can be on its way)
+                    let lookup = |g| self.object_seg(g, obj).or_else(|| carried.as_ref().filter(|(k, _)| *k == g).map(|(_, s)| s.clone()));
+                    let own = self.carry(f, Some(obj), &mut *frame, cancel, &lookup, &mut |_, _| Some(()));
+                    carried = own.clone().map(|s| (f, s));
+                    own
+                } else {
+                    self.ensure(f, &mut *frame, cancel)
+                };
+                let matte = match own {
+                    Some(own) => own,
+                    None if cancel() => return Err("tracking cancelled".into()),
+                    None => match frame(f) {
+                        Some(img) => Arc::new(rb::segment_with(&img, &strokes, None, &self.opts, self.refine_radius, self.model.as_deref())),
+                        None => return Err(format!("cannot read Roto Brush prompt frame {f}")),
+                    },
+                };
+                let p = rb::tracker_prompt_boxed(&strokes, self.opts.scale, &matte);
+                if p.points.iter().any(|(_, fg)| *fg) {
+                    prompts.push((f, p));
+                }
+            }
+            prompts.sort_by_key(|q| q.0);
+            by_object.push(prompts);
+        }
+        // objects without a foreground prompt cannot be followed
+        let followed: Vec<(u32, Vec<(i64, effectcraft_segment::Prompt)>)> = objects.into_iter().zip(by_object).filter(|(_, p)| !p.is_empty()).collect();
+        if followed.is_empty() {
+            return Err("no foreground strokes to follow".into());
+        }
+        // The window to track: every object restarts at the nearest of its prompted frames at or before the first
+        // frame needed (a correction restarts the object there), so the window starts at the earliest restart; it
+        // ends at the last frame needed, reaching the farthest first prompt when an object's needed frames lie
+        // before its prompt.
+        let lo = followed.iter().map(|(_, p)| p.iter().map(|q| q.0).filter(|f| *f <= need_lo).max().unwrap_or(need_lo)).min().unwrap_or(need_lo);
+        let first_prompt = followed.iter().filter_map(|(_, p)| p.first().map(|q| q.0)).max().unwrap_or(need_hi);
+        let hi = need_hi.max(first_prompt);
+        let objects: Vec<u32> = followed.iter().map(|(o, _)| *o).collect();
+        let prompts: Vec<Vec<(i64, effectcraft_segment::Prompt)>> =
+            followed.into_iter().map(|(_, p)| p.into_iter().filter(|q| q.0 >= lo && q.0 <= hi).collect()).collect();
+        let req = TrackRequest { first: lo, count: (hi - lo + 1) as usize, objects: prompts };
+        let frame = std::cell::RefCell::new(frame);
+        let mut summary = TrackSummary::default();
+        // A frame is finished when every object has reported it (the objects' mattes are united).
+        let mut pending = pending::PendingMasks::new(objects.len(), max_pending_bytes);
+        let finish = |g: i64, parts: Vec<Option<effectcraft_segment::TrackedFrame>>, summary: &mut TrackSummary, progress: &mut dyn FnMut(usize)| {
+            if !wanted.is_none_or(|w| w.contains(&g)) {
+                return;
+            }
+            let (Some(key), Some(img)) = (self.keys.get(&g).copied(), (frame.borrow_mut())(g)) else { return };
+            let mut segs: Vec<(u32, effectcraft_track::roto::FrameSeg)> = vec![];
+            let (mut confidence, mut present) = (f32::INFINITY, false);
+            let mut worst = f32::INFINITY;
+            for (obj, t) in objects.iter().zip(parts) {
+                let Some(t) = t else { continue };
+                let strokes = self.data.strokes_of(g, *obj);
+                segs.push((*obj, rb::segment_tracked(&img, &strokes, t.prob, t.occluded, &self.opts, self.refine_radius)));
+                worst = worst.min(t.confidence);
+                if !t.occluded {
+                    present = true;
+                    confidence = confidence.min(t.confidence);
+                }
+            }
+            if segs.is_empty() {
+                return;
+            }
+            // a frame is occluded when every object is absent; otherwise the doubtful object sets the confidence
+            let (occluded, confidence) = (!present, if present { confidence } else { worst });
+            // with several objects each keeps its own matte too (Show Object, the per-object overlay)
+            let mut parts = Vec::with_capacity(segs.len());
+            for (obj, seg) in segs {
+                if several {
+                    store(object_key(key, obj), self.opts.scale, Arc::new(seg.clone()));
+                }
+                parts.push(seg);
+            }
+            store(tracked_key(key), self.opts.scale, Arc::new(effectcraft_track::roto::FrameSeg::union(parts)));
+            trust_cache().lock().unwrap_or_else(|e| e.into_inner()).insert(tracked_key(key), FrameTrust { confidence, occluded });
+            summary.frames += 1;
+            summary.occluded += usize::from(occluded);
+            summary.min_confidence = if summary.frames == 1 { confidence } else { summary.min_confidence.min(confidence) };
+            progress(summary.frames);
+        };
+        let pending_failed = std::cell::Cell::new(false);
+        let mut pending_error = None;
+        let result = tracker.track(
+            &req,
+            &mut |g| {
+                let img = (frame.borrow_mut())(g)?;
+                Some(Arc::new(ClipFrame { rgb: rb::rgb_of(&img), w: img.width as usize, h: img.height as usize }))
+            },
+            &|| cancel() || pending_failed.get(),
+            &mut |o, g, t| {
+                // A tracker that reports object-by-object can otherwise retain a full clip of
+                // probability maps. Stop buffering immediately, even if it ignores cancellation.
+                if pending_failed.get() {
+                    return;
+                }
+                match pending.insert(o, g, t) {
+                    Ok(Some(parts)) => finish(g, parts, &mut summary, progress),
+                    Ok(None) => {}
+                    Err(e) => {
+                        pending_error = Some(e);
+                        pending_failed.set(true);
+                    }
+                }
+            },
+        );
+        if let Some(e) = pending_error {
+            return Err(e);
+        }
+        result?;
+        // frames some object never reported (it was not followed there): united from the rest
+        for (g, parts) in pending.into_incomplete() {
+            finish(g, parts, &mut summary, progress);
+        }
+        Ok(Some(summary))
+    }
+}
+
+/// Each tracked object's matte of layer frame `f` in a multi-object instance (full resolution; computes
+/// nothing). Show Object limits it to the one chosen. Empty with fewer than two objects in the instance.
+pub fn object_mattes(params: &Params, layer_size: [f64; 2], fps: f64, f: i64) -> Vec<(u32, Arc<FrameSeg>)> {
+    let mut chain = Chain::new(params, layer_size, fps, 1.0);
+    let objects = chain.data.objects();
+    if objects.len() < 2 || !chain.data.in_span(f) {
+        return vec![];
+    }
+    let shown = chain.show_object.checked_sub(1);
+    chain.show_object = 0;
+    objects.into_iter().filter(|o| shown.is_none_or(|s| s == *o)).filter_map(|o| chain.object_seg(f, o).map(|s| (o, s))).collect()
 }
 
 /// Nearest-neighbour resampling of a segmentation to another scale.
@@ -434,7 +895,7 @@ pub fn downscale(s: &FrameSeg, scale: f64) -> FrameSeg {
     resample(s, w, h)
 }
 
-pub(crate) fn resample(s: &FrameSeg, w: usize, h: usize) -> FrameSeg {
+pub fn resample(s: &FrameSeg, w: usize, h: usize) -> FrameSeg {
     if s.w == w && s.h == h {
         return s.clone();
     }
@@ -474,7 +935,8 @@ fn needs_neighbours(mp: &MatteParams) -> bool {
 // ------------------------------------------------------------------ Freeze
 
 /// Frozen mattes (Freeze): the final 8-bit alpha and the Refine Edge band of every frame of
-/// the span at full resolution, valid while `key` matches [`frozen_key`].
+/// the span at full resolution, valid while `key` matches [`frozen_key`] under the session's model or
+/// any other Roto Brush model.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
 pub struct FrozenCache {
@@ -504,18 +966,35 @@ impl FrozenCache {
     }
 }
 
-/// What frozen mattes depend on: every chain key and the matte settings.
+/// What frozen mattes depend on: every chain key (the session's model is in their seed) and the matte settings.
 pub fn frozen_key(params: &Params, layer_size: [f64; 2], fps: f64) -> String {
-    let ch = Chain::new(params, layer_size, fps, 1.0);
+    frozen_key_with(params, layer_size, fps, model_for(params).map_or(effectcraft_segment::CLASSICAL, |m| m.info().id))
+}
+
+/// [`frozen_key`] for the model with id `model` ([`effectcraft_segment::CLASSICAL`]: none).
+fn frozen_key_with(params: &Params, layer_size: [f64; 2], fps: f64, model: &str) -> String {
     let mut h = 0xcbf2_9ce4_8422_2325;
-    for (f, k) in &ch.keys {
+    for (f, k) in &data(params).chain_keys(seed_with(params, layer_size, fps, model)) {
         fnv(&mut h, &f.to_le_bytes());
         fnv(&mut h, &k.to_le_bytes());
     }
     fnv(&mut h, format!("{:?}", matte_params(params)).as_bytes());
+    let show_object = show_object_of(params);
+    if show_object != 0 {
+        fnv(&mut h, &show_object.to_le_bytes());
+    }
     format!("{h:016x}")
 }
 
+/// Whether frozen mattes still apply: their key matches under the session's model, or under the model that froze
+/// them, which this session may not have loaded (a fresh headless render). Frozen mattes need no segmentation.
+fn frozen_applies(fc: &FrozenCache, params: &Params, layer_size: [f64; 2], fps: f64) -> bool {
+    fc.key == frozen_key(params, layer_size, fps)
+        || std::iter::once(effectcraft_segment::CLASSICAL)
+            .chain(effectcraft_segment::MODELS.iter().filter(|m| m.task == effectcraft_segment::Task::Mask).map(|m| m.id))
+            .any(|id| fc.key == frozen_key_with(params, layer_size, fps, id))
+}
+
 /// Whether the instance is frozen (has frozen mattes).
 pub fn is_frozen(params: &Params) -> bool {
     !s(params, FROZEN).is_empty()
@@ -544,6 +1023,183 @@ fn frozen(params: &Params) -> Option<Arc<FrozenCache>> {
     Some(d)
 }
 
+// ------------------------------------------------------------------ saved tracking
+
+/// The tracker's frames of an instance, saved with the project (the hidden [`TRACKED`] parameter,
+/// as [`FrozenCache`] is). They apply while `key` matches the instance's inputs ([`tracks_key`]),
+/// whichever model Settings choose: a stroke or span change makes them stale, and the next Propagate
+/// replaces them (with the classic engine, that leaves none).
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct TrackCache {
+    /// What the frames were tracked from ([`tracks_key`]).
+    pub key: String,
+    /// The tracker's model id.
+    pub model: String,
+    /// The mattes' width and height (the layer's size).
+    pub size: [usize; 2],
+    pub frames: BTreeMap<i64, TrackFrame>,
+    /// With several objects: each one's matte of every tracked frame (object id, then frame).
+    #[serde(skip_serializing_if = "BTreeMap::is_empty")]
+    pub objects: BTreeMap<u32, BTreeMap<i64, ObjectFrame>>,
+}
+
+/// One object's matte and Refine Edge band of a tracked frame (RLE, base64).
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ObjectFrame {
+    pub m: String,
+    pub r: String,
+}
+
+/// One tracked frame: its matte and Refine Edge band (RLE, base64), its colour models and the
+/// tracker's trust in it.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct TrackFrame {
+    /// Matte (RLE, base64).
+    pub m: String,
+    /// Refine Edge band (RLE, base64).
+    pub r: String,
+    pub fg: Gmm,
+    pub bg: Gmm,
+    /// 0–1: the tracker's confidence.
+    pub c: f32,
+    /// The object is not in the frame.
+    pub o: bool,
+}
+
+impl TrackCache {
+    pub fn from_json(s: &str) -> Option<TrackCache> {
+        if s.trim().is_empty() {
+            return None;
+        }
+        serde_json::from_str(s).ok()
+    }
+    pub fn to_json(&self) -> String {
+        serde_json::to_string(self).unwrap_or_default()
+    }
+}
+
+/// What saved tracking depends on: the chain keys of its frames (the inputs and the model).
+pub fn tracks_key(keys: &BTreeMap<i64, u64>) -> String {
+    let mut h = 0xcbf2_9ce4_8422_2325;
+    for (f, k) in keys {
+        fnv(&mut h, &f.to_le_bytes());
+        fnv(&mut h, &k.to_le_bytes());
+    }
+    format!("{h:016x}")
+}
+
+/// The saved tracking of `params`, parsed once per content.
+fn saved_tracks(params: &Params) -> Option<Arc<TrackCache>> {
+    static C: OnceLock<Mutex<HashMap<u64, Arc<TrackCache>>>> = OnceLock::new();
+    let j = s(params, TRACKED);
+    if j.is_empty() {
+        return None;
+    }
+    let mut h = 0xcbf2_9ce4_8422_2325;
+    fnv(&mut h, j.as_bytes());
+    let c = C.get_or_init(Default::default);
+    if let Some(d) = c.lock().unwrap_or_else(|e| e.into_inner()).get(&h) {
+        return Some(d.clone());
+    }
+    let d = Arc::new(TrackCache::from_json(j)?);
+    let mut m = c.lock().unwrap_or_else(|e| e.into_inner());
+    if m.len() > 8 {
+        m.clear();
+    }
+    m.insert(h, d.clone());
+    Some(d)
+}
+
+/// A saved tracking that applies to a chain: its frames, keyed under the model that made them.
+pub(crate) struct SavedTracking {
+    cache: Arc<TrackCache>,
+    keys: BTreeMap<i64, u64>,
+}
+
+/// The saved tracking of `params` if it applies: the inputs are the instance's now. It does not depend
+/// on which model Settings choose or has loaded, so a project renders the same anywhere.
+fn saved_for(params: &Params, data: &RotoData, layer_size: [f64; 2], fps: f64) -> Option<SavedTracking> {
+    let cache = saved_tracks(params)?;
+    let keys = data.chain_keys(seed_with(params, layer_size, fps, &cache.model));
+    (tracks_key(&keys) == cache.key).then_some(SavedTracking { cache, keys })
+}
+
+/// Decode a tracked frame of saved tracking (full resolution).
+fn decode_tracked(cache: &TrackCache, f: i64) -> Option<FrameSeg> {
+    let fr = cache.frames.get(&f)?;
+    // The size comes from the project file: checked, so a corrupt one is ignored rather than overflowing.
+    let [w, h] = cache.size;
+    let n = w.checked_mul(h)?;
+    if n == 0 || n > rle::MAX_PLANE_BYTES {
+        return None;
+    }
+    let matte = rle::decode_bounded(&fr.m, n)?;
+    let refine = rle::decode_bounded(&fr.r, n)?;
+    (matte.len() == n && refine.len() == n).then(|| FrameSeg { w, h, matte, refine, fg: fr.fg.clone(), bg: fr.bg.clone() })
+}
+
+/// Object `o`'s matte of a tracked frame of saved tracking (full resolution).
+fn decode_object(cache: &TrackCache, f: i64, o: u32) -> Option<FrameSeg> {
+    let fr = cache.objects.get(&o)?.get(&f)?;
+    let [w, h] = cache.size;
+    let n = w.checked_mul(h)?;
+    if n == 0 || n > rle::MAX_PLANE_BYTES {
+        return None;
+    }
+    let matte = rle::decode_bounded(&fr.m, n)?;
+    let refine = rle::decode_bounded(&fr.r, n)?;
+    (matte.len() == n && refine.len() == n).then(|| FrameSeg { w, h, matte, refine, ..Default::default() })
+}
+
+/// The tracking a chain has just made, to save with its instance: every frame of its span that the
+/// tracker followed, at full resolution, with its trust. `None` when it followed none.
+pub fn tracks_of(ch: &Chain) -> Option<TrackCache> {
+    let model = ch.model.as_ref()?.info().id;
+    // The saved tracking applies to this chain's frames when the same model made it: what it has and this session did
+    // not track again stays (a project reopened and propagated with nothing new to track must keep its tracking).
+    let saved = ch.saved.as_ref().filter(|t| t.cache.model == model);
+    let mut size = saved.map(|t| t.cache.size);
+    let mut frames = BTreeMap::new();
+    for (f, k) in &ch.keys {
+        if let (Some(seg), Some(t)) = (cached(tracked_key(*k), 1.0), trust(*k)) {
+            size.get_or_insert([seg.w, seg.h]);
+            frames.insert(
+                *f,
+                TrackFrame { m: rle::encode(&seg.matte), r: rle::encode(&seg.refine), fg: seg.fg.clone(), bg: seg.bg.clone(), c: t.confidence, o: t.occluded },
+            );
+        } else if let Some(kept) = saved.filter(|t| t.keys.get(f) == Some(k)).and_then(|t| t.cache.frames.get(f)) {
+            frames.insert(*f, kept.clone());
+        }
+    }
+    let mut objects: BTreeMap<u32, BTreeMap<i64, ObjectFrame>> = BTreeMap::new();
+    let ids = ch.data.objects();
+    if ids.len() > 1 {
+        for (f, k) in &ch.keys {
+            if !frames.contains_key(f) {
+                continue;
+            }
+            for o in &ids {
+                if let Some(seg) = cached(object_key(*k, *o), 1.0) {
+                    objects.entry(*o).or_default().insert(*f, ObjectFrame { m: rle::encode(&seg.matte), r: rle::encode(&seg.refine) });
+                } else if let Some(kept) = saved.filter(|t| t.keys.get(f) == Some(k)).and_then(|t| t.cache.objects.get(o)).and_then(|m| m.get(f)) {
+                    objects.entry(*o).or_default().insert(*f, kept.clone());
+                }
+            }
+        }
+    }
+    let cache = TrackCache { key: tracks_key(&ch.keys), model: model.to_string(), size: size?, frames, objects };
+    (!cache.frames.is_empty()).then_some(cache)
+}
+
+/// Whether the tracking saved with `params` covers every one of `frames`: they need no model to be read.
+pub fn saved_covers(params: &Params, layer_size: [f64; 2], fps: f64, frames: &[i64]) -> bool {
+    let chain = Chain::new(params, layer_size, fps, 1.0);
+    !frames.is_empty() && frames.iter().all(|f| chain.saved_has(*f))
+}
+
 /// Encode one frame for [`FrozenCache`].
 pub fn freeze_frame(alpha: &[f32], band: &[u8]) -> FrozenFrame {
     let a: Vec<u8> = alpha.iter().map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8).collect();
@@ -557,13 +1213,17 @@ fn matte_for(ctx: &EffectCtx, f: i64, img: &Arc<Image>, scale: f64) -> Option<(V
     let (w, h) = (img.width as usize, img.height as usize);
     // Frozen mattes.
     if let Some(fc) = frozen(ctx.params)
-        && fc.key == frozen_key(ctx.params, ctx.layer_size, ctx.fps())
+        && frozen_applies(&fc, ctx.params, ctx.layer_size, ctx.fps())
         && let Some(fr) = fc.frames.get(&f)
     {
-        let a = rle::decode(&fr.a)?;
-        let bnd = rle::decode(&fr.b)?;
         let [fw, fh] = fc.size;
-        if a.len() == fw * fh && bnd.len() == fw * fh {
+        let expected = fw.checked_mul(fh)?;
+        if fw == 0 || fh == 0 || expected > rle::MAX_PLANE_BYTES {
+            return None;
+        }
+        let a = rle::decode_bounded(&fr.a, expected)?;
+        let bnd = rle::decode_bounded(&fr.b, expected)?;
+        if a.len() == expected && bnd.len() == expected {
             let af: Vec<f32> = a.iter().map(|v| *v as f32 / 255.0).collect();
             let (alpha, band) = if fw == w && fh == h {
                 (af, bnd)
@@ -630,7 +1290,7 @@ fn render(ctx: &EffectCtx, buf: Buf) -> Buf {
     let (w, h) = (img.width as usize, img.height as usize);
     let mp = matte_params(ctx.params);
     let mut rgb = rb::rgb_of(&img);
-    let map = refine::decontaminate(&mut rgb, &alpha, &band, w, h, &mp, rr * sc, sc);
+    let map = refine::decontaminate(&mut rgb, &alpha, &band, (w, h), &mp, rr * sc, sc);
     let view_map = b(ctx.params, "refineEdgeMatte/decontamination/viewDecontaminationMap");
     let (ox, oy) = (buf.offset[0].round() as i64, buf.offset[1].round() as i64);
     for y in 0..h {
@@ -656,17 +1316,23 @@ fn render(ctx: &EffectCtx, buf: Buf) -> Buf {
 
 /// The final matte of the effect at layer frame `f` on the full-resolution layer grid of
 /// `input` (the effect's input buffer at scale 1), computing what is missing. For Freeze and
-/// the Layer panel overlays.
+/// the Layer panel overlays. A frame of `frozen` (the instance's frozen mattes, from
+/// [`applying_frozen`]) keeps its frozen matte, so freezing again in a session without the model
+/// that froze it does not replace that model's matte.
 pub fn frame_matte(
     params: &Params,
     layer_size: [f64; 2],
     fps: f64,
     f: i64,
+    frozen: Option<&FrozenCache>,
     frame: &mut dyn FnMut(i64) -> Option<Arc<Image>>,
     cancel: &dyn Fn() -> bool,
 ) -> Option<(Vec<f32>, Vec<u8>)> {
     let chain = Chain::new(params, layer_size, fps, 1.0);
     let img = frame(f)?;
+    if let Some(kept) = frozen.and_then(|fc| frozen_frame_matte(fc, f, img.width as usize, img.height as usize)) {
+        return Some(kept);
+    }
     let seg = chain.ensure(f, frame, cancel)?;
     let mp = matte_params(params);
     let (mut prev, mut next) = (None, None);
@@ -682,6 +1348,25 @@ pub fn frame_matte(
     Some((alpha, seg.refine.clone()))
 }
 
+/// The instance's frozen mattes while they apply ([`frozen_applies`]): the frames a second Freeze keeps. A Freeze job
+/// resolves them once, since this hashes the whole frozen cache.
+pub fn applying_frozen(params: &Params, layer_size: [f64; 2], fps: f64) -> Option<Arc<FrozenCache>> {
+    let fc = frozen(params)?;
+    frozen_applies(&fc, params, layer_size, fps).then_some(fc)
+}
+
+/// Frame `f`'s alpha and band in `fc` on a `w`×`h` grid, when it was frozen at that size.
+fn frozen_frame_matte(fc: &FrozenCache, f: i64, w: usize, h: usize) -> Option<(Vec<f32>, Vec<u8>)> {
+    let fr = fc.frames.get(&f)?;
+    if fc.size != [w, h] {
+        return None;
+    }
+    let n = w.checked_mul(h).filter(|n| *n > 0 && *n <= rle::MAX_PLANE_BYTES)?;
+    let alpha = rle::decode_bounded(&fr.a, n).filter(|a| a.len() == n)?;
+    let band = rle::decode_bounded(&fr.b, n).filter(|b| b.len() == n)?;
+    Some((alpha.iter().map(|v| f32::from(*v) / 255.0).collect(), band))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -727,8 +1412,8 @@ mod tests {
     #[test]
     fn renders_the_segmented_disk_on_demand() {
         let mut d = RotoData::default();
-        d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[35.0, 40.0], [45.0, 40.0]] }, 20, [0, 24]);
-        d.add(Stroke { kind: StrokeKind::Bg, frame: 0, radius: 3.0, points: vec![[5.0, 5.0], [95.0, 5.0], [95.0, 75.0]] }, 20, [0, 24]);
+        d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[35.0, 40.0], [45.0, 40.0]], object: 0 }, 20, [0, 24]);
+        d.add(Stroke { kind: StrokeKind::Bg, frame: 0, radius: 3.0, points: vec![[5.0, 5.0], [95.0, 5.0], [95.0, 75.0]], object: 0 }, 20, [0, 24]);
         let params = params_with(&d);
         let host = Seq;
         let run = |t: f64| {
@@ -772,6 +1457,694 @@ mod tests {
         assert!(o.data.iter().all(|p| p[3] == 0.0));
     }
 
+    /// Mattes frozen with a model render as frozen in a session that has another model or none (a fresh headless
+    /// render), instead of being segmented again with the classic engine.
+    #[test]
+    fn frozen_mattes_survive_a_session_without_their_model() {
+        let mut d = RotoData::default();
+        d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[35.0, 40.0], [45.0, 40.0]], object: 0 }, 2, [0, 5]);
+        let mut params = params_with(&d);
+        params.values.insert(INPUT_KEY.into(), Value::Str("frozen-without-the-model".into()));
+        let size = [100.0, 80.0];
+        assert!(model_for(&params).is_none(), "this session has no model");
+        // the frozen matte is the left half of the layer: no segmentation of the disk gives it
+        let alpha: Vec<f32> = (0..100 * 80).map(|i| f32::from(u8::from(i % 100 < 50))).collect();
+        let mut fc = FrozenCache { key: frozen_key_with(&params, size, 25.0, effectcraft_segment::SAM2_TINY.id), size: [100, 80], ..Default::default() };
+        fc.frames.insert(0, freeze_frame(&alpha, &[0; 100 * 80]));
+        assert_ne!(fc.key, frozen_key(&params, size, 25.0));
+        params.values.insert(FROZEN.into(), Value::Str(fc.to_json()));
+        let host = Seq;
+        let ctx = EffectCtx {
+            params: &params,
+            time: 0.001,
+            layer_size: size,
+            seed: 1,
+            adjustment: false,
+            env: EffectEnv { host: Some(&host), frame_rate: 25.0, ..Default::default() },
+        };
+        let out = crate::apply(&specs()[0], &ctx, Buf { img: frame(0.0), offset: [0.0; 2], scale: 1.0 }).img;
+        let a = |x: usize, y: usize| out.data[y * 100 + x][3];
+        assert!(a(10, 70) > 0.99 && a(90, 10) < 0.01, "the frozen matte is used: {} at (10, 70), {} at (90, 10)", a(10, 70), a(90, 10));
+        // freezing again in this session keeps the frozen matte instead of segmenting with the classic engine
+        let mut get = |g: i64| Some(Arc::new(frame(g as f64 / 25.0)));
+        let kept = applying_frozen(&params, size, 25.0).expect("the frozen mattes apply");
+        let (matte, band) = frame_matte(&params, size, 25.0, 0, Some(&kept), &mut get, &|| false).expect("frame 0's matte");
+        assert_eq!((matte, band.len()), (alpha.clone(), 100 * 80), "a second Freeze keeps the frozen frame");
+        let segmented = frame_matte(&params, size, 25.0, 1, Some(&kept), &mut get, &|| false);
+        assert!(segmented.is_some_and(|(a, _)| a[40 * 100 + 10] < 0.01), "a frame with none is segmented");
+        // a stroke edited after the freeze still makes it stale, whatever the model
+        let mut moved = d.clone();
+        moved.strokes[0].points[0] = [36.0, 40.0];
+        let mut edited = params.clone();
+        edited.values.insert(STROKES.into(), Value::Str(moved.to_json()));
+        assert!(!frozen_applies(&fc, &edited, size, 25.0));
+        assert!(applying_frozen(&edited, size, 25.0).is_none(), "a second Freeze then segments every frame");
+    }
+
+    /// A stand-in tracker for two objects: object 0 is the moving disk, object 1 a fixed square. It records how many
+    /// objects (and prompts per object) it was asked for.
+    struct TwoObjects(std::sync::Mutex<Vec<Vec<usize>>>);
+    impl effectcraft_segment::MaskModel for TwoObjects {
+        fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Err("no weights".into())
+        }
+        fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+            Some(self)
+        }
+    }
+    impl effectcraft_segment::ObjectTracker for TwoObjects {
+        fn track(
+            &self,
+            req: &effectcraft_segment::TrackRequest,
+            frame: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+            _: &dyn Fn() -> bool,
+            out: &mut dyn FnMut(usize, i64, effectcraft_segment::TrackedFrame),
+        ) -> effectcraft_segment::Result<()> {
+            self.0.lock().unwrap().push(req.objects.iter().map(Vec::len).collect());
+            for g in req.first..req.first + req.count as i64 {
+                let img = frame(g).ok_or("no frame")?;
+                let c = [40.0 + 2.0 * g as f64, 40.0];
+                // the objects report in reverse order on odd frames: the union must not depend on it
+                let order: Vec<usize> = if g % 2 == 1 { (0..req.objects.len()).rev().collect() } else { (0..req.objects.len()).collect() };
+                for o in order {
+                    let prob = (0..img.w * img.h)
+                        .map(|i| {
+                            let (x, y) = ((i % img.w) as f64 + 0.5, (i / img.w) as f64 + 0.5);
+                            let inside = if o == 0 { (x - c[0]).hypot(y - c[1]) <= 15.0 } else { (8.0..22.0).contains(&x) && (8.0..22.0).contains(&y) };
+                            f32::from(inside)
+                        })
+                        .collect();
+                    out(o, g, effectcraft_segment::TrackedFrame { prob, w: img.w, h: img.h, confidence: if o == 0 { 0.9 } else { 0.4 }, occluded: false });
+                }
+            }
+            Ok(())
+        }
+    }
+
+    /// The ordering SAM 2 uses when objects are first prompted on different frames: each object
+    /// reports its entire span before the next. No weights or large allocations are needed.
+    #[derive(Default)]
+    struct SeparatePasses {
+        emitted: std::sync::atomic::AtomicUsize,
+        cancelled: std::sync::atomic::AtomicBool,
+    }
+
+    impl effectcraft_segment::MaskModel for SeparatePasses {
+        fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Err("no weights".into())
+        }
+        fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+            Some(self)
+        }
+    }
+
+    impl effectcraft_segment::ObjectTracker for SeparatePasses {
+        fn track(
+            &self,
+            req: &effectcraft_segment::TrackRequest,
+            frames: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+            cancel: &dyn Fn() -> bool,
+            out: &mut dyn FnMut(usize, i64, effectcraft_segment::TrackedFrame),
+        ) -> effectcraft_segment::Result<()> {
+            use std::sync::atomic::Ordering::Relaxed;
+            assert_ne!(req.objects[0][0].0, req.objects[1][0].0);
+            for o in 0..req.objects.len() {
+                for g in req.first..req.first + req.count as i64 {
+                    if cancel() {
+                        self.cancelled.store(true, Relaxed);
+                        return Err("tracking cancelled".into());
+                    }
+                    let img = frames(g).ok_or("no frame")?;
+                    self.emitted.fetch_add(1, Relaxed);
+                    out(o, g, effectcraft_segment::TrackedFrame { prob: vec![0.5; img.w * img.h], w: img.w, h: img.h, confidence: 0.9, occluded: false });
+                }
+            }
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn a_single_followed_object_keeps_its_matte_in_a_multi_object_instance() {
+        for outside_span in [false, true] {
+            let mut data = RotoData::default();
+            data.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[35.0, 40.0]], object: 0 }, 2, [0, 5]);
+            data.add(Stroke { kind: StrokeKind::Fg, frame: if outside_span { 5 } else { 0 }, radius: 3.0, points: vec![[85.0, 70.0]], object: 1 }, 2, [0, 5]);
+            if !outside_span {
+                data.add(Stroke { kind: StrokeKind::Bg, frame: 0, radius: 8.0, points: vec![[85.0, 70.0]], object: 1 }, 2, [0, 5]);
+            }
+            data.span = [0, 2];
+            assert_eq!(data.objects(), [0, 1]);
+            let mut params = params_with(&data);
+            params.values.insert(INPUT_KEY.into(), Value::Str(format!("one-followed-object-{outside_span}")));
+            let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+            chain.model = Some(Arc::new(TwoObjects(Default::default())));
+            chain.keys = data.chain_keys(seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id));
+            let mut get = |f: i64| Some(Arc::new(frame(f as f64 / 25.0)));
+            assert_eq!(chain.track(&mut get, &|| false, &mut |_| {}).unwrap().unwrap().frames, 3);
+            let matte = chain.object_seg(1, 0).expect("the followed object keeps its own matte");
+            assert!(matte.area() > 0);
+            assert!(chain.object_seg(1, 1).is_none(), "the unprompted object has no invented matte");
+            chain.show_object = 1;
+            assert_eq!(chain.ensure(1, &mut get, &|| false).unwrap().matte, matte.matte);
+            let saved = tracks_of(&chain).unwrap();
+            assert_eq!(saved.objects.get(&0).unwrap().len(), 3);
+            assert!(!saved.objects.contains_key(&1));
+            params.values.insert(TRACKED.into(), Value::Str(saved.to_json()));
+            params.values.insert("rotoBrushMatte/object".into(), Value::Scalar(1.0));
+            forget(chain.keys.values().map(|key| object_key(*key, 0)));
+            let reopened = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+            assert_eq!(reopened.object_seg(1, 0).unwrap().matte, matte.matte);
+            assert_eq!(reopened.ensure(1, &mut |_| None, &|| false).unwrap().matte, matte.matte);
+            let overlays = object_mattes(&params, [100.0, 80.0], 25.0, 1);
+            assert_eq!(overlays.len(), 1);
+            assert_eq!((overlays[0].0, overlays[0].1.area()), (0, matte.area()));
+        }
+    }
+
+    /// A model that sees only the left part of the disk, and records the tracker's box prompts.
+    #[derive(Default)]
+    struct LeftPart(std::sync::Mutex<Vec<(i64, Option<[f32; 4]>)>>);
+    impl effectcraft_segment::MaskModel for LeftPart {
+        fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], w: usize, h: usize, _: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Ok((0..w * h).map(|i| f32::from((26..36).contains(&(i % w)) && (30..50).contains(&(i / w)))).collect())
+        }
+        fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+            Some(self)
+        }
+    }
+    impl effectcraft_segment::ObjectTracker for LeftPart {
+        fn track(
+            &self,
+            req: &effectcraft_segment::TrackRequest,
+            _: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+            _: &dyn Fn() -> bool,
+            _: &mut dyn FnMut(usize, i64, effectcraft_segment::TrackedFrame),
+        ) -> effectcraft_segment::Result<()> {
+            *self.0.lock().unwrap() = req.objects.iter().flatten().map(|(f, p)| (*f, p.bbox)).collect();
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn the_tracker_box_surrounds_the_matte_shown_on_each_stroked_frame() {
+        let mut data = RotoData::default();
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[30.0, 40.0]], object: 0 }, 3, [0, 3]);
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 2, radius: 3.0, points: vec![[50.0, 40.0]], object: 0 }, 3, [0, 3]);
+        data.span = [0, 3];
+        let mut params = params_with(&data);
+        params.values.insert(INPUT_KEY.into(), Value::Str("tracker-box-from-shown-matte".into()));
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        let fake = Arc::new(LeftPart::default());
+        chain.model = Some(fake.clone());
+        chain.keys = data.chain_keys(seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id));
+        let mut get = |f: i64| Some(Arc::new(frame(f as f64 / 25.0)));
+        let expected: Vec<(i64, Option<[f32; 4]>)> = [0, 2]
+            .into_iter()
+            .map(|f| (f, rb::tracker_prompt_boxed(&data.strokes_of(f, 0), 1.0, &chain.ensure(f, &mut get, &|| false).expect("a shown matte")).bbox))
+            .collect();
+        assert!(expected.iter().all(|(_, b)| b.is_some()));
+        assert!(expected[0].1.unwrap()[2] < 44.0, "the base frame shows the model's part of the disk: {expected:?}");
+        chain.track(&mut get, &|| false, &mut |_| {}).unwrap();
+        assert_eq!(*fake.0.lock().unwrap(), expected, "the base frame and the correction frame are boxed around what they show");
+    }
+
+    /// A model that cuts only a small square around each foreground click, and records every object's box prompts.
+    #[derive(Default)]
+    struct ClickSquares(std::sync::Mutex<Vec<Vec<(i64, Option<[f32; 4]>)>>>);
+    impl effectcraft_segment::MaskModel for ClickSquares {
+        fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], w: usize, h: usize, p: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            let near = |x: f32, y: f32| p.points.iter().any(|(c, fg)| *fg && (c[0] - x).abs() <= 4.0 && (c[1] - y).abs() <= 4.0);
+            Ok((0..w * h).map(|i| f32::from(near((i % w) as f32 + 0.5, (i / w) as f32 + 0.5))).collect())
+        }
+        fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+            Some(self)
+        }
+    }
+    impl effectcraft_segment::ObjectTracker for ClickSquares {
+        fn track(
+            &self,
+            req: &effectcraft_segment::TrackRequest,
+            _: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+            _: &dyn Fn() -> bool,
+            _: &mut dyn FnMut(usize, i64, effectcraft_segment::TrackedFrame),
+        ) -> effectcraft_segment::Result<()> {
+            *self.0.lock().unwrap() = req.objects.iter().map(|o| o.iter().map(|(f, p)| (*f, p.bbox)).collect()).collect();
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn a_correction_stroke_on_part_of_one_of_several_objects_boxes_the_whole_object() {
+        let mut data = RotoData::default();
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[30.0, 40.0], [50.0, 40.0]], object: 0 }, 3, [0, 3]);
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[88.0, 72.0]], object: 1 }, 3, [0, 3]);
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 2, radius: 2.0, points: vec![[54.0, 40.0]], object: 0 }, 3, [0, 3]);
+        data.span = [0, 3];
+        let mut params = params_with(&data);
+        params.values.insert(INPUT_KEY.into(), Value::Str("object-correction-box".into()));
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        let fake = Arc::new(ClickSquares::default());
+        chain.model = Some(fake.clone());
+        chain.keys = data.chain_keys(seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id));
+        chain.track(&mut |f| Some(Arc::new(frame(f as f64 / 25.0))), &|| false, &mut |_| {}).unwrap();
+        let boxes = fake.0.lock().unwrap().clone();
+        let box_of = |o: usize, f: i64| boxes[o].iter().find(|(g, _)| *g == f).and_then(|(_, b)| *b).expect("a box prompt");
+        let (base, correction, other) = (box_of(0, 0), box_of(0, 2), box_of(1, 0));
+        assert!(correction[0] <= base[0] + 6.0, "the correction frame boxes the object carried from frame 0 {base:?}, not only the stroke: {correction:?}");
+        assert!(correction[2] >= 54.0 && correction[2] - correction[0] >= base[2] - base[0], "the box holds the whole object and the stroke: {correction:?}");
+        assert!(correction[2] < other[0], "object 1 {other:?} stays out of object 0's box {correction:?}");
+    }
+
+    #[test]
+    fn a_correction_after_propagate_carries_each_object_on_from_its_tracked_matte() {
+        let mut data = RotoData::default();
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[30.0, 40.0]], object: 0 }, 3, [0, 3]);
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[15.0, 15.0]], object: 1 }, 3, [0, 3]);
+        data.span = [0, 3];
+        let mut params = params_with(&data);
+        params.values.insert(INPUT_KEY.into(), Value::Str("object-correction-after-propagate".into()));
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        chain.model = Some(Arc::new(TwoObjects(Default::default())));
+        chain.keys = data.chain_keys(seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id));
+        assert_eq!(chain.track(&mut |f| Some(Arc::new(frame(f as f64 / 25.0))), &|| false, &mut |_| {}).unwrap().unwrap().frames, 4);
+        data.add(Stroke { kind: StrokeKind::Fg, frame: 2, radius: 2.0, points: vec![[56.0, 40.0]], object: 0 }, 3, [0, 3]);
+        chain.data = Arc::new(data.clone());
+        chain.keys = data.chain_keys(seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id));
+        let fake = Arc::new(ClickSquares::default());
+        chain.model = Some(fake.clone());
+        let mut prompt_reads = vec![];
+        let mut get = |f: i64| {
+            if fake.0.lock().unwrap().is_empty() {
+                prompt_reads.push(f);
+            }
+            Some(Arc::new(frame(f as f64 / 25.0)))
+        };
+        chain.track(&mut get, &|| false, &mut |_| {}).unwrap();
+        assert_eq!(prompt_reads, [2, 1], "frame 2 carries on from the tracked frame 1; tracked frame 0 boxes both objects as it is");
+        let boxes = fake.0.lock().unwrap().clone();
+        let correction = boxes[0].iter().find(|(g, _)| *g == 2).and_then(|(_, b)| *b).expect("a box prompt");
+        // the tracked disk carried to frame 2 spans x 29..59
+        assert!(correction[0] <= 29.0 && correction[2] >= 59.0, "the box holds the whole disk: {correction:?}");
+    }
+
+    #[test]
+    fn a_correction_before_an_objects_first_stroke_keeps_its_tracked_matte() {
+        for base in [0, 4] {
+            let first = if base == 0 { 3 } else { 1 };
+            let prior = if base == 0 { 1 } else { 3 };
+            let mut data = RotoData::default();
+            data.add(Stroke { kind: StrokeKind::Fg, frame: base, radius: 3.0, points: vec![[40.0, 40.0]], object: 0 }, 4, [0, 4]);
+            data.add(Stroke { kind: StrokeKind::Fg, frame: first, radius: 3.0, points: vec![[15.0, 15.0]], object: 1 }, 4, [0, 4]);
+            data.span = [0, 4];
+            let mut params = params_with(&data);
+            params.values.insert(INPUT_KEY.into(), Value::Str(format!("earlier-object-correction-{base}")));
+            let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+            chain.model = Some(Arc::new(TwoObjects(Default::default())));
+            let seed = seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id);
+            chain.keys = data.chain_keys(seed);
+            let image = |f: i64| {
+                let mut img = frame(f as f64 / 25.0);
+                // Match the second object's tracked square, so the carry has a real image edge.
+                for y in 8..22 {
+                    for x in 8..22 {
+                        img.set(x, y, [0.95, 0.9, 0.1, 1.0]);
+                    }
+                }
+                Arc::new(img)
+            };
+            assert_eq!(chain.track(&mut |f| Some(image(f)), &|| false, &mut |_| {}).unwrap().unwrap().frames, 5);
+            let prior_key = chain.keys[&prior];
+            assert!(chain.object_seg(prior, 1).is_some());
+            data.add(Stroke { kind: StrokeKind::Fg, frame: 2, radius: 1.0, points: vec![[19.0, 15.0]], object: 1 }, 4, [0, 4]);
+            chain.data = Arc::new(data.clone());
+            chain.keys = data.chain_keys(seed);
+            assert_eq!(chain.keys[&prior], prior_key, "the nearer tracked frame is still valid");
+            let fake = Arc::new(ClickSquares::default());
+            chain.model = Some(fake.clone());
+            let mut prompt_reads = vec![];
+            let mut get = |f: i64| {
+                if fake.0.lock().unwrap().is_empty() {
+                    prompt_reads.push(f);
+                }
+                Some(image(f))
+            };
+            chain.track(&mut get, &|| false, &mut |_| {}).unwrap();
+            assert_eq!(prompt_reads, [2, prior, first, 2], "corrections carry from the valid tracked matte in either direction");
+            let boxes = fake.0.lock().unwrap().clone();
+            let correction = boxes[1].iter().find(|(g, _)| *g == 2).and_then(|(_, b)| *b).expect("a correction box");
+            assert!(correction[0] <= 10.0 && correction[2] >= 22.0, "the box keeps the whole tracked square, not only the correction: {correction:?}");
+            assert!(correction[2] < 30.0, "the other object's disk stays outside this box: {correction:?}");
+        }
+    }
+
+    #[test]
+    fn corrections_before_the_base_carry_on_from_each_other() {
+        let mut data = RotoData::default();
+        for (frame, object) in [(3, 0), (3, 1), (2, 0), (1, 0)] {
+            data.add(Stroke { kind: StrokeKind::Fg, frame, radius: 3.0, points: vec![[35.0, 40.0]], object }, 3, [0, 3]);
+        }
+        data.span = [0, 3];
+        assert_eq!(data.base, Some(3));
+        let mut params = params_with(&data);
+        params.values.insert(INPUT_KEY.into(), Value::Str("corrections-before-the-base".into()));
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        let fake = Arc::new(ClickSquares::default());
+        chain.model = Some(fake.clone());
+        chain.keys = data.chain_keys(seed_with(&params, [100.0, 80.0], 25.0, effectcraft_segment::SAM2_TINY.id));
+        let mut prompt_reads = vec![];
+        let mut get = |f: i64| {
+            if fake.0.lock().unwrap().is_empty() {
+                prompt_reads.push(f);
+            }
+            Some(Arc::new(frame(f as f64 / 25.0)))
+        };
+        chain.track(&mut get, &|| false, &mut |_| {}).unwrap();
+        assert_eq!(prompt_reads, [3, 2, 3, 1, 2, 3], "object 0: the base, then 2 from 3, then 1 from 2; object 1: the base");
+        let frames: Vec<Vec<i64>> = fake.0.lock().unwrap().iter().map(|o| o.iter().map(|q| q.0).collect()).collect();
+        assert_eq!(frames, [vec![1, 2, 3], vec![3]], "prompts reach the tracker in frame order");
+    }
+
+    #[test]
+    fn prompt_segmentation_reads_only_frames_with_that_objects_foreground() {
+        let mut data = RotoData::default();
+        for (kind, frame, object) in [(StrokeKind::Fg, 0, 0), (StrokeKind::Refine, 1, 0), (StrokeKind::Fg, 2, 1)] {
+            data.add(Stroke { kind, frame, radius: 3.0, points: vec![[35.0, 40.0]], object }, 2, [0, 2]);
+        }
+        data.span = [0, 2];
+        let mut params = params_with(&data);
+        params.values.insert(INPUT_KEY.into(), Value::Str("foreground-only-prompts".into()));
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        let fake = Arc::new(TwoObjects(Default::default()));
+        chain.model = Some(fake.clone());
+        let mut prompt_reads = vec![];
+        let mut get = |f: i64| {
+            if fake.0.lock().unwrap().is_empty() {
+                prompt_reads.push(f);
+            }
+            Some(Arc::new(frame(f as f64 / 25.0)))
+        };
+        assert_eq!(chain.track(&mut get, &|| false, &mut |_| {}).unwrap().unwrap().frames, 3);
+        assert_eq!(prompt_reads, [0, 2], "shared Refine Edge and other objects' frames need no prompt graph cut");
+        assert_eq!(fake.0.lock().unwrap()[0], [1, 1]);
+    }
+
+    #[test]
+    fn separate_object_passes_cancel_at_the_pending_mask_budget() {
+        use std::sync::atomic::Ordering::Relaxed;
+        let mut d = RotoData::default();
+        for object in 0..2 {
+            d.add(Stroke { kind: StrokeKind::Fg, frame: i64::from(object), radius: 3.0, points: vec![[35.0, 40.0]], object }, 8, [0, 24]);
+        }
+        let mut params = params_with(&d);
+        params.values.insert(INPUT_KEY.into(), Value::Str("pending-budget-regression".into()));
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        let fake = Arc::new(SeparatePasses::default());
+        chain.model = Some(fake.clone());
+        let mut get = |f: i64| Some(Arc::new(frame(f as f64 / 25.0)));
+        let mut completed = 0;
+        // Each map takes 32,000 bytes; two incomplete frames exceed this small test budget.
+        let error = chain.track_with_pending_limit(None, &mut get, &|| false, &mut |n| completed = n, 64_000).unwrap_err();
+        assert!(error.contains("pending object masks") && error.contains("memory budget"), "{error}");
+        assert!(fake.cancelled.load(Relaxed), "the model must see cancellation before allocating the rest of the clip");
+        assert_eq!(fake.emitted.load(Relaxed), 2);
+        assert_eq!(completed, 0, "partial objects are not complete tracked frames");
+    }
+
+    /// A cold chain with saved tracking and the same model keeps the saved frames when asked what to save (nothing
+    /// was tracked this session), and Show Object reads a frame the saved tracking has under its own keys.
+    #[test]
+    fn saved_tracking_is_kept_and_its_objects_stay_out_of_another_models_keys() {
+        let mut d = RotoData::default();
+        d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[35.0, 40.0]], object: 0 }, 2, [0, 24]);
+        let mut params = params_with(&d);
+        params.values.insert(INPUT_KEY.into(), Value::Str("keep-saved-and-objects".into()));
+        let size = [100.0, 80.0];
+        let model = effectcraft_segment::SAM2_TINY.id;
+        let keys = d.chain_keys(seed_with(&params, size, 25.0, model));
+        let (matte, empty) = (vec![1u8; 100 * 80], vec![0u8; 100 * 80]);
+        let frame = TrackFrame { m: rle::encode(&matte), r: rle::encode(&empty), c: 0.9, ..Default::default() };
+        let object = ObjectFrame { m: rle::encode(&matte), r: rle::encode(&empty) };
+        let saved = TrackCache {
+            key: tracks_key(&keys),
+            model: model.into(),
+            size: [100, 80],
+            frames: keys.keys().map(|f| (*f, frame.clone())).collect(),
+            objects: [(1, keys.keys().map(|f| (*f, object.clone())).collect())].into_iter().collect(),
+        };
+        params.values.insert(TRACKED.into(), Value::Str(saved.to_json()));
+        let mut chain = Chain::new(&params, size, 25.0, 1.0);
+        chain.model = Some(Arc::new(TwoObjects(Default::default())));
+        chain.keys = keys.clone();
+        let kept = tracks_of(&chain).expect("the saved tracking is kept");
+        assert_eq!(kept.frames.keys().collect::<Vec<_>>(), saved.frames.keys().collect::<Vec<_>>());
+        assert_eq!(kept.frames.get(&1), saved.frames.get(&1));
+        // another model is chosen now: its keys differ, and the saved object matte is not stored under them
+        let other = d.chain_keys(seed_with(&params, size, 25.0, effectcraft_segment::SAM2_SMALL.id));
+        chain.keys = other.clone();
+        let seg = chain.object_seg(1, 1).expect("the saved object matte");
+        assert_eq!(seg.matte.len(), 100 * 80);
+        assert!(cached(object_key(other[&1], 1), 1.0).is_none(), "the other model's cache holds none of it");
+        for key in [keys[&1], other[&1]] {
+            for scale in [1.0, 0.5] {
+                store(tracked_key(key), scale, seg.clone());
+                store(object_key(key, 1), scale, seg.clone());
+            }
+            trust_cache().lock().unwrap().insert(tracked_key(key), FrameTrust { confidence: 0.9, occluded: false });
+        }
+        chain.forget_tracking();
+        assert!(chain.model.is_none());
+        assert!(!chain.saved_has(1));
+        for key in [keys[&1], other[&1]] {
+            for scale in [1.0, 0.5] {
+                assert!(cached(tracked_key(key), scale).is_none());
+                assert!(cached(object_key(key, 1), scale).is_none());
+            }
+            assert!(trust(key).is_none());
+        }
+        assert!(chain.ensure(1, &mut |_| None, &|| false).is_none(), "neither saved nor in-memory tracking survives fallback");
+    }
+
+    #[test]
+    fn showing_a_missing_tracked_object_never_falls_back_to_other_objects() {
+        let mut d = RotoData::default();
+        for object in 0..2 {
+            d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 1.0, points: vec![[1.0, 1.0]], object }, 1, [0, 1]);
+        }
+        let union = Arc::new(FrameSeg { w: 4, h: 2, matte: vec![255; 8], refine: vec![0; 8], ..Default::default() });
+        for saved in [false, true] {
+            for scale in [1.0, 0.5] {
+                let mut params = params_with(&d);
+                params.values.insert("version".into(), Value::Scalar(0.0));
+                params.values.insert(INPUT_KEY.into(), Value::Str(format!("missing-object-{saved}-{scale}")));
+                let keys = d.chain_keys(seed(&params, [4.0, 2.0], 25.0));
+                if saved {
+                    let matte = rle::encode(&union.matte);
+                    let refine = rle::encode(&union.refine);
+                    let cache = TrackCache {
+                        key: tracks_key(&keys),
+                        model: effectcraft_segment::CLASSICAL.into(),
+                        size: [4, 2],
+                        frames: [(0, TrackFrame { m: matte.clone(), r: refine.clone(), ..Default::default() })].into_iter().collect(),
+                        objects: [(0, [(0, ObjectFrame { m: matte, r: refine })].into_iter().collect())].into_iter().collect(),
+                    };
+                    params.values.insert(TRACKED.into(), Value::Str(cache.to_json()));
+                } else {
+                    store(tracked_key(keys[&0]), 1.0, union.clone());
+                    store(object_key(keys[&0], 0), 1.0, union.clone());
+                }
+                let mut chain = Chain::new(&params, [4.0, 2.0], 25.0, scale);
+                let expected = downscale(&union, scale);
+                for object in [2, 7] {
+                    chain.show_object = object;
+                    let shown = chain.ensure(0, &mut |_| None, &|| false).expect("tracked frame");
+                    assert_eq!((shown.w, shown.h, shown.area()), (expected.w, expected.h, 0), "saved={saved}, scale={scale}, object={object}");
+                }
+                assert!(chain.shown_object(1).is_none(), "untracked frames keep their existing fallback");
+                for object in [0, 1] {
+                    chain.show_object = object;
+                    assert_eq!(chain.ensure(0, &mut |_| None, &|| false).unwrap().matte, expected.matte);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn saved_tracking_decoders_validate_dimensions_and_plane_lengths() {
+        let valid = rle::encode(&[255, 0, 255, 0]);
+        let mut cache = TrackCache {
+            size: [2, 2],
+            frames: [(0, TrackFrame { m: valid.clone(), r: valid.clone(), ..Default::default() })].into_iter().collect(),
+            objects: [(1, [(0, ObjectFrame { m: valid.clone(), r: valid.clone() })].into_iter().collect())].into_iter().collect(),
+            ..Default::default()
+        };
+        assert_eq!(decode_tracked(&cache, 0).unwrap().matte, [255, 0, 255, 0]);
+        assert_eq!(decode_object(&cache, 0, 1).unwrap().refine, [255, 0, 255, 0]);
+        for (size, matte, refine) in [
+            ([0, 2], rle::encode(&[]), rle::encode(&[])),
+            ([2, 0], rle::encode(&[]), rle::encode(&[])),
+            ([usize::MAX, 2], valid.clone(), valid.clone()),
+            ([rle::MAX_PLANE_BYTES + 1, 1], valid.clone(), valid.clone()),
+            ([2, 2], rle::encode(&[0; 5]), valid.clone()),
+            ([2, 2], valid.clone(), rle::encode(&[0; 5])),
+            ([2, 2], rle::encode(&[0; 3]), valid.clone()),
+            ([2, 2], valid, rle::encode(&[0; 3])),
+        ] {
+            cache.size = size;
+            cache.frames.insert(0, TrackFrame { m: matte.clone(), r: refine.clone(), ..Default::default() });
+            cache.objects.insert(1, [(0, ObjectFrame { m: matte, r: refine })].into_iter().collect());
+            assert!(decode_tracked(&cache, 0).is_none(), "tracked plane {size:?}");
+            assert!(decode_object(&cache, 0, 1).is_none(), "object plane {size:?}");
+        }
+    }
+
+    #[test]
+    fn a_one_direction_pass_tracks_and_reports_only_its_frames() {
+        let mut d = RotoData::default();
+        d.add(Stroke { kind: StrokeKind::Fg, frame: 12, radius: 3.0, points: vec![[35.0, 40.0]], object: 0 }, 12, [0, 24]);
+        let params = params_with(&d);
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        chain.model = Some(Arc::new(TwoObjects(Default::default())));
+        let mut get = |f: i64| Some(Arc::new(frame(f as f64 / 25.0)));
+        let forward: Vec<i64> = (12..=24).collect();
+        let mut last = 0;
+        let summary = chain.track_frames(Some(&forward), &mut get, &|| false, &mut |n| last = n).unwrap().unwrap();
+        assert_eq!((summary.frames, last), (forward.len(), forward.len()), "progress never exceeds the frames asked for");
+        let _ = chain.ensure(5, &mut get, &|| false);
+        assert!(tracks_of(&chain).is_none_or(|t| t.frames.keys().all(|f| *f >= 12)), "earlier frames were not tracked");
+    }
+
+    #[test]
+    fn propagation_replaces_saved_tracking_from_a_different_model() {
+        let mut d = RotoData::default();
+        d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[35.0, 40.0]], object: 0 }, 2, [0, 24]);
+        let mut params = params_with(&d);
+        params.values.insert(INPUT_KEY.into(), Value::Str("replace-saved-tracking-model".into()));
+        let size = [100.0, 80.0];
+        let old_model = effectcraft_segment::SAM2_SMALL.id;
+        let old_keys = d.chain_keys(seed_with(&params, size, 25.0, old_model));
+        let empty = vec![0; 100 * 80];
+        let old_frame = TrackFrame { m: rle::encode(&empty), r: rle::encode(&empty), c: 0.2, ..Default::default() };
+        let saved = TrackCache {
+            key: tracks_key(&old_keys),
+            model: old_model.into(),
+            size: [100, 80],
+            frames: old_keys.keys().map(|f| (*f, old_frame.clone())).collect(),
+            ..Default::default()
+        };
+        params.values.insert(TRACKED.into(), Value::Str(saved.to_json()));
+        let mut chain = Chain::new(&params, size, 25.0, 1.0);
+        let fake = Arc::new(TwoObjects(Default::default()));
+        chain.model = Some(fake.clone());
+        chain.keys = d.chain_keys(seed_with(&params, size, 25.0, fake.info().id));
+        let mut get = |f: i64| Some(Arc::new(frame(f as f64 / 25.0)));
+        assert_eq!(chain.saved_model(), Some(old_model));
+        assert_eq!(chain.ensure(0, &mut get, &|| false).unwrap().area(), 0, "rendering keeps the saved matte until propagation");
+        chain.prepare_propagation();
+        assert_eq!(chain.saved_model(), None);
+        assert_eq!(chain.track(&mut get, &|| false, &mut |_| {}).unwrap().unwrap().frames, 3);
+        assert_eq!(fake.0.lock().unwrap().len(), 1, "the newly selected tracker must actually run");
+        assert!(chain.ensure(0, &mut get, &|| false).unwrap().area() > 0);
+        let replacement = tracks_of(&chain).expect("new tracking is saved");
+        assert_eq!(replacement.model, effectcraft_segment::SAM2_TINY.id);
+        assert_eq!(replacement.frames.len(), 3);
+        params.values.insert(TRACKED.into(), Value::Str(replacement.to_json()));
+        let mut reopened = Chain::new(&params, size, 25.0, 1.0);
+        assert_eq!(reopened.saved_model(), Some(effectcraft_segment::SAM2_TINY.id));
+        assert!(reopened.ensure(0, &mut get, &|| false).unwrap().area() > 0, "reopening uses the replacement without loading its model");
+        reopened.model = Some(fake.clone());
+        reopened.keys = chain.keys.clone();
+        reopened.prepare_propagation();
+        assert_eq!(reopened.saved_model(), Some(effectcraft_segment::SAM2_TINY.id));
+        assert_eq!(reopened.track(&mut get, &|| false, &mut |_| {}).unwrap().unwrap().frames, 0, "matching saved tracking is reused");
+        assert_eq!(fake.0.lock().unwrap().len(), 1);
+        let mut classic = Chain::new(&params, size, 25.0, 1.0);
+        classic.model = None;
+        classic.prepare_propagation();
+        assert_eq!(classic.saved_model(), None, "Classic propagation also replaces saved model tracking");
+    }
+
+    #[test]
+    fn objects_are_followed_in_one_pass_and_their_mattes_united() {
+        let mut d = RotoData::default();
+        let stroke = |kind, points: Vec<[f64; 2]>, object| Stroke { kind, frame: 0, radius: 3.0, points, object };
+        d.add(stroke(StrokeKind::Fg, vec![[35.0, 40.0], [45.0, 40.0]], 0), 8, [0, 24]);
+        d.add(stroke(StrokeKind::Fg, vec![[12.0, 15.0], [18.0, 15.0]], 1), 8, [0, 24]);
+        d.add(stroke(StrokeKind::Bg, vec![[85.0, 70.0], [95.0, 70.0]], 0), 8, [0, 24]);
+        assert_eq!(d.objects(), vec![0, 1]);
+        // the Refine Edge strokes belong to every object; the others only to their own
+        assert_eq!(d.strokes_of(0, 1).len(), 1);
+        assert_eq!(d.strokes_of(0, 0).len(), 2);
+        let params = params_with(&d);
+        let mut chain = Chain::new(&params, [100.0, 80.0], 25.0, 1.0);
+        let fake = Arc::new(TwoObjects(Default::default()));
+        chain.model = Some(fake.clone());
+        // the clip: the moving disk and a fixed yellow square
+        let mut get = |f: i64| {
+            let mut img = frame(f as f64 / 25.0 + 0.001);
+            for y in 8..22 {
+                for x in 8..22 {
+                    img.set(x, y, [0.95, 0.9, 0.1 + ((x * 3 + y * 5) % 7) as f32 / 70.0, 1.0]);
+                }
+            }
+            Some(Arc::new(img))
+        };
+        let mut seen = 0;
+        let summary = chain.track(&mut get, &|| false, &mut |n| seen = n).unwrap().unwrap();
+        // one request for both objects; object 0 has its foreground and background prompt on the frame, object 1 its own
+        assert_eq!(fake.0.lock().unwrap().len(), 1);
+        assert_eq!(fake.0.lock().unwrap()[0], vec![1, 1]);
+        assert_eq!(summary.frames, 9);
+        assert_eq!(seen, 9);
+        // the least sure object sets the frame's confidence
+        assert!((summary.min_confidence - 0.4).abs() < 1e-6, "{}", summary.min_confidence);
+        assert_eq!(summary.occluded, 0);
+        let seg = cached(tracked_key(chain.keys[&3]), 1.0).expect("frame 3 is tracked");
+        let at = |x: usize, y: usize| seg.matte[y * 100 + x];
+        assert!(at(46, 40) != 0, "the moving disk (frame 3 centre x = 46)");
+        assert!(at(15, 15) != 0, "the fixed square");
+        assert_eq!(at(60, 70), 0, "nothing elsewhere");
+
+        // each object keeps its own matte
+        let (disk, square) = (chain.object_seg(3, 0).expect("object 0"), chain.object_seg(3, 1).expect("object 1"));
+        assert!(disk.matte[40 * 100 + 46] != 0 && disk.matte[15 * 100 + 15] == 0);
+        assert!(square.matte[15 * 100 + 15] != 0 && square.matte[40 * 100 + 46] == 0);
+        // Show Object picks one (its id plus one); an object the instance does not have shows nothing; 0 shows all
+        let mut shown = |c: &Chain| c.ensure(3, &mut get, &|| false).expect("frame 3");
+        chain.show_object = 2;
+        let one = shown(&chain);
+        assert!(one.matte[15 * 100 + 15] != 0 && one.matte[40 * 100 + 46] == 0, "only the square");
+        chain.show_object = 1;
+        let zero = shown(&chain);
+        assert!(zero.matte[40 * 100 + 46] != 0 && zero.matte[15 * 100 + 15] == 0, "only the disk");
+        chain.show_object = 7;
+        assert_eq!(shown(&chain).area(), 0, "no such object");
+        chain.show_object = 0;
+        assert!(shown(&chain).matte[15 * 100 + 15] != 0, "all together");
+
+        // the objects are saved with the tracking and come back from the project file
+        let saved = tracks_of(&chain).expect("tracking to save");
+        assert_eq!(saved.objects.keys().copied().collect::<Vec<_>>(), vec![0, 1]);
+        assert_eq!(saved.objects.get(&1).map(|f| f.len()), Some(9));
+        assert_eq!(TrackCache::from_json(&saved.to_json()), Some(saved.clone()));
+        // a tracking saved before objects existed has none
+        let old = TrackCache { objects: Default::default(), ..saved.clone() };
+        assert!(!old.to_json().contains("objects"));
+        let rt = decode_object(&saved, 3, 1).expect("decoded");
+        assert!(rt.matte[15 * 100 + 15] != 0 && rt.matte[40 * 100 + 46] == 0);
+    }
+
     /// Instances saved before the propagation controls got their own twirl-down (and motion
     /// blur / decontamination their nested ones) load with their values in the new places.
     #[test]
diff --git a/crates/effects/src/roto/pending.rs b/crates/effects/src/roto/pending.rs
new file mode 100644
index 000000000..256789ee9
--- /dev/null
+++ b/crates/effects/src/roto/pending.rs
@@ -0,0 +1,138 @@
+//! Bounded assembly of the objects a tracker reports separately for each frame.
+
+use std::collections::BTreeMap;
+use std::mem::size_of;
+
+use effectcraft_segment::TrackedFrame;
+
+/// Separate from the model's memory banks: probability maps are full-resolution and can otherwise
+/// grow with the entire clip when objects start on different frames.
+pub(super) const MAX_PENDING_BYTES: usize = 256 << 20;
+
+pub(super) struct PendingMasks {
+    frames: BTreeMap<i64, Vec<Option<TrackedFrame>>>,
+    objects: usize,
+    bytes: usize,
+    limit: usize,
+}
+
+impl PendingMasks {
+    pub(super) fn new(objects: usize, limit: usize) -> Self {
+        Self { frames: BTreeMap::new(), objects, bytes: 0, limit }
+    }
+
+    /// Probability allocation plus a conservative allowance for the map node and object slots.
+    fn frame_bytes(&self) -> usize {
+        self.objects.saturating_mul(size_of::<Option<TrackedFrame>>()).saturating_add(256)
+    }
+
+    fn mask_bytes(mask: &TrackedFrame) -> usize {
+        mask.prob.capacity().saturating_mul(size_of::<f32>())
+    }
+
+    /// Complete frames leave immediately; incomplete frames may never exceed the budget. A rejected
+    /// insertion leaves the buffer unchanged, including when it replaces an object's previous result.
+    pub(super) fn insert(&mut self, object: usize, frame: i64, mask: TrackedFrame) -> Result<Option<Vec<Option<TrackedFrame>>>, String> {
+        if object >= self.objects {
+            return Err("tracker reported an unknown object".into());
+        }
+        if self.objects == 1 {
+            return Ok(Some(vec![Some(mask)]));
+        }
+        let existing = self.frames.get(&frame);
+        let old_bytes = existing.and_then(|p| p.get(object)).and_then(Option::as_ref).map_or(0, Self::mask_bytes);
+        let added = Self::mask_bytes(&mask).saturating_add(if existing.is_none() { self.frame_bytes() } else { 0 });
+        let bytes = self.bytes.saturating_sub(old_bytes).checked_add(added);
+        let Some(bytes) = bytes.filter(|n| *n <= self.limit) else {
+            return Err(format!("pending object masks exceed their {} MiB memory budget", self.limit >> 20));
+        };
+        let parts = self.frames.entry(frame).or_insert_with(|| vec![None; self.objects]);
+        if let Some(slot) = parts.get_mut(object) {
+            *slot = Some(mask);
+        }
+        self.bytes = bytes;
+        if parts.iter().all(Option::is_some) {
+            let parts = self.frames.remove(&frame).unwrap_or_default();
+            let used = parts.iter().flatten().fold(self.frame_bytes(), |n, m| n.saturating_add(Self::mask_bytes(m)));
+            self.bytes = self.bytes.saturating_sub(used);
+            return Ok(Some(parts));
+        }
+        Ok(None)
+    }
+
+    pub(super) fn into_incomplete(self) -> BTreeMap<i64, Vec<Option<TrackedFrame>>> {
+        self.frames
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mask(value: f32) -> TrackedFrame {
+        TrackedFrame { prob: vec![value; 16], w: 4, h: 4, confidence: value, occluded: false }
+    }
+
+    #[test]
+    fn different_start_passes_stop_before_buffering_the_whole_clip() {
+        let mut pending = PendingMasks::new(2, 2048);
+        let mut accepted = 0;
+        // SAM 2 can report all of object 0 before starting object 1. A long clip must stop
+        // at the memory limit even though no frame has received all its objects yet.
+        for frame in 0..10_000 {
+            match pending.insert(0, frame, mask(0.9)) {
+                Ok(None) => accepted += 1,
+                Ok(Some(_)) => panic!("no frame is complete yet"),
+                Err(e) => {
+                    assert!(e.contains("memory budget"), "{e}");
+                    break;
+                }
+            }
+        }
+        assert!(accepted > 0 && accepted < 10_000);
+        assert_eq!(pending.frames.len(), accepted);
+        assert!(pending.bytes <= pending.limit);
+        let before = pending.bytes;
+        assert!(pending.insert(0, 10_001, mask(0.8)).is_err());
+        assert_eq!(pending.bytes, before, "rejection must not retain the new map");
+    }
+
+    #[test]
+    fn interleaved_objects_release_the_budget_and_keep_their_masks() {
+        let mut pending = PendingMasks::new(2, 2048);
+        for frame in 0..10_000 {
+            let first = (frame % 2) as usize;
+            assert!(pending.insert(first, frame, mask(first as f32)).unwrap().is_none());
+            let parts = pending.insert(1 - first, frame, mask((1 - first) as f32)).unwrap().unwrap();
+            assert_eq!(parts[0].as_ref().unwrap().prob, vec![0.0; 16]);
+            assert_eq!(parts[1].as_ref().unwrap().prob, vec![1.0; 16]);
+            assert!(pending.frames.is_empty());
+            assert_eq!(pending.bytes, 0);
+        }
+    }
+
+    #[test]
+    fn replacements_charge_capacity_and_partial_frames_are_preserved() {
+        let mut pending = PendingMasks::new(2, 2048);
+        pending.insert(0, 7, mask(0.1)).unwrap();
+        let before = pending.bytes;
+        pending.insert(0, 7, mask(0.2)).unwrap();
+        assert_eq!(pending.bytes, before, "a duplicate replaces rather than accumulates");
+        let mut oversized = mask(0.3);
+        oversized.prob.reserve(2048);
+        assert!(pending.insert(0, 7, oversized).is_err(), "capacity, not length, owns the memory");
+        assert_eq!(pending.bytes, before);
+        let frames = pending.into_incomplete();
+        assert_eq!(frames[&7][0].as_ref().unwrap().prob, vec![0.2; 16]);
+        assert!(frames[&7][1].is_none());
+    }
+
+    #[test]
+    fn single_objects_need_no_pending_budget_and_unknown_objects_are_rejected() {
+        let mut pending = PendingMasks::new(1, 0);
+        assert!(pending.insert(0, 0, mask(0.9)).unwrap().is_some());
+        assert_eq!(pending.bytes, 0);
+        assert!(pending.insert(1, 0, mask(0.9)).is_err());
+        assert!(pending.frames.is_empty());
+    }
+}
diff --git a/crates/effects/src/sim.rs b/crates/effects/src/sim.rs
index 14146a9f4..ca5bc5126 100644
--- a/crates/effects/src/sim.rs
+++ b/crates/effects/src/sim.rs
@@ -15,2019 +15,31 @@ use effectcraft_raster::{Image, Px};
 use rayon::prelude::*;
 
 use crate::generate::value_noise;
-use crate::util::{SimCache, hash1, params_key, params_key_except, unpremul};
+use crate::util::{SimCache, hash1, params_key_except, unpremul};
 use crate::{Buf, EffectCtx, EffectSpec, col, num, p, popup, slider};
 
-pub(crate) fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, render: crate::RenderFn) -> EffectSpec {
-    EffectSpec { id, name, category: "Simulation", params, render, gpu: false, float: true }
-}
-
-pub(crate) fn pt(x: f64, y: f64) -> Value {
-    Value::Vec2([x, y])
-}
-
-pub(crate) fn pct() -> ParamUi {
-    slider(0.0, 100.0, 0.0, 100.0, 1)
-}
-
-/// Deterministic hash → [0, 1).
-#[inline]
-pub(crate) fn h(i: u32, k: u32, seed: u32) -> f32 {
-    hash1(i, k, seed)
-}
-
-/// Signed hash → [-1, 1).
-#[inline]
-pub(crate) fn hs(i: u32, k: u32, seed: u32) -> f32 {
-    hash1(i, k, seed) * 2.0 - 1.0
-}
-
-// ------------------------------------------------------------------ band rasteriser
-
-const BAND: usize = 16;
-
-/// How rasterised items combine with what is already in the target.
-#[derive(Clone, Copy, PartialEq, Eq, Debug)]
-pub enum Acc {
-    /// Premultiplied "over" (later items on top).
-    Over,
-    /// Additive (glows, light).
-    Add,
-}
-
-/// Rasterise many small items into `img` (buffer pixels). `bbox` gives an item's pixel bounds
-/// `[x0, y0, x1, y1]` (or `None` to skip), `shade` its premultiplied colour at a pixel centre.
-/// Items are bucketed into horizontal bands rendered in parallel; within a band they are drawn
-/// in slice order.
-pub(crate) fn raster<T: Sync>(
-    img: &mut Image,
-    items: &[T],
-    bbox: impl Fn(&T) -> Option<[f32; 4]> + Sync,
-    shade: impl Fn(&T, f32, f32) -> Option<Px> + Sync,
-    acc: Acc,
-) {
-    let (w, hgt) = (img.width as usize, img.height as usize);
-    if w == 0 || hgt == 0 || items.is_empty() {
-        return;
-    }
-    let nb = hgt.div_ceil(BAND);
-    let boxes: Vec<Option<[i32; 4]>> = items
-        .par_iter()
-        .map(|it| {
-            let b = bbox(it)?;
-            if !(b[0].is_finite() && b[1].is_finite() && b[2].is_finite() && b[3].is_finite()) {
-                return None;
-            }
-            let x0 = b[0].floor().max(0.0) as i32;
-            let y0 = b[1].floor().max(0.0) as i32;
-            let x1 = (b[2].ceil() as i32).min(w as i32 - 1);
-            let y1 = (b[3].ceil() as i32).min(hgt as i32 - 1);
-            if x1 < x0 || y1 < y0 || b[2] < 0.0 || b[3] < 0.0 {
-                return None;
-            }
-            Some([x0, y0, x1, y1])
-        })
-        .collect();
-    let mut buckets: Vec<Vec<u32>> = vec![Vec::new(); nb];
-    for (i, b) in boxes.iter().enumerate() {
-        if let Some(b) = b {
-            for band in (b[1] as usize / BAND)..=(b[3] as usize / BAND).min(nb - 1) {
-                buckets[band].push(i as u32);
-            }
-        }
-    }
-    img.data.par_chunks_mut(w * BAND).enumerate().for_each(|(band, chunk)| {
-        let by0 = band * BAND;
-        let rows = chunk.len() / w;
-        for &i in &buckets[band] {
-            let Some(b) = boxes[i as usize] else { continue };
-            let it = &items[i as usize];
-            let ya = (b[1] as usize).max(by0);
-            let yb = (b[3] as usize).min(by0 + rows - 1);
-            for y in ya..=yb {
-                let row = &mut chunk[(y - by0) * w..(y - by0 + 1) * w];
-                for x in b[0] as usize..=b[2] as usize {
-                    if let Some(c) = shade(it, x as f32 + 0.5, y as f32 + 0.5) {
-                        let d = &mut row[x];
-                        match acc {
-                            Acc::Over => {
-                                let k = 1.0 - c[3];
-                                *d = [c[0] + d[0] * k, c[1] + d[1] * k, c[2] + d[2] * k, c[3] + d[3] * k];
-                            }
-                            Acc::Add => {
-                                *d = [d[0] + c[0], d[1] + c[1], d[2] + c[2], (d[3] + c[3]).min(1.0)];
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    });
-}
-
-// ------------------------------------------------------------------ sprites
-
-#[derive(Clone, Copy, PartialEq, Debug)]
-pub enum Shape {
-    /// Soft round dot (Gaussian-like falloff).
-    Soft,
-    /// Hard anti-aliased disc.
-    Disc,
-    /// Lit sphere (upper-left light, specular).
-    Sphere,
-    /// Disc fading linearly to its rim.
-    Faded,
-    /// Thin ring with a highlight.
-    Bubble,
-    /// Four-point star.
-    Star,
-    /// Rotated square (angle in `rot`).
-    Square,
-    /// Triangle (angle in `rot`).
-    Tri,
-    /// Segment from (x, y) by (dx, dy), half-width `r`.
-    Line { dx: f32, dy: f32 },
-}
-
-/// A particle sprite in buffer pixels; `c` is straight colour + opacity.
-#[derive(Clone, Copy, Debug)]
-pub struct Sprite {
-    pub x: f32,
-    pub y: f32,
-    pub r: f32,
-    pub c: [f32; 4],
-    pub shape: Shape,
-    pub rot: f32,
-}
-
-impl Sprite {
-    pub(crate) fn new(x: f32, y: f32, r: f32, c: [f32; 4], shape: Shape) -> Sprite {
-        Sprite { x, y, r, c, shape, rot: 0.0 }
-    }
-}
-
-/// Where a sprite's colour comes from when it depends on the layer's pixels (resolved by
-/// [`SpritePlan::resolve`] on the CPU, per pixel by the GPU compositor). Positions are buffer
-/// pixels.
-#[derive(Clone, Copy, Debug)]
-pub enum Tint {
-    /// The sprite's own colour.
-    Fixed,
-    /// CC Rainfall's refracting drops: where the layer shows (alpha > 0), colour × (layer
-    /// colour × 0.6 + 0.5) sampled at (x, y).
-    Refract { x: f64, y: f64 },
-    /// CC Star Burst: the layer's colour at (x, y), opacity × its alpha (none where clear).
-    Source { x: f64, y: f64 },
-    /// CC Hair: the root's colour at (x, y) mixed with the hair colour (`inherit` = 1 keeps the
-    /// root's), × `shade`, + `spec`; no strand where the root's alpha is below ½.
-    Root { x: f64, y: f64, hair: [f32; 3], inherit: f32, shade: f32, spec: f32 },
-}
-
-/// How a sprite layer meets the original layer.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Post {
-    /// [`combine`] with this mode (0 Composite … 5 sprites only).
-    Combine(u32),
-    /// The sprites alone.
-    Replace,
-    /// The sprites, mixed toward the original by this fraction.
-    Lerp(f32),
-    /// The sprites over opaque black.
-    OverBlack,
-}
-
-/// What a sprite-drawing effect draws this frame: built on the CPU (closed-form or from the
-/// simulation state), rasterised by [`SpritePlan::finish`] or the GPU compositor.
-#[derive(Clone, Debug)]
-pub struct SpritePlan {
-    pub sprites: Vec<Sprite>,
-    /// Per sprite (empty = all [`Tint::Fixed`]).
-    pub tints: Vec<Tint>,
-    pub acc: Acc,
-    pub post: Post,
-}
-
-impl SpritePlan {
-    /// Resolve layer-dependent colours against the layer `src`.
-    pub fn resolve(&mut self, src: &Image) {
-        let tints = std::mem::take(&mut self.tints);
-        self.sprites.par_iter_mut().zip(tints.par_iter()).for_each(|(sp, t)| match *t {
-            Tint::Fixed => {}
-            Tint::Refract { x, y } => {
-                let (sc, sa) = unpremul(src.sample_bilinear(x, y));
-                if sa > 0.0 {
-                    let c = sp.c;
-                    sp.c = [(sc[0] * 0.6 + 0.5) * c[0], (sc[1] * 0.6 + 0.5) * c[1], (sc[2] * 0.6 + 0.5) * c[2], c[3]];
-                }
-            }
-            Tint::Source { x, y } => {
-                let (c, a) = unpremul(src.sample_bilinear(x, y));
-                sp.c = if a <= 0.0 { [0.0; 4] } else { [c[0], c[1], c[2], a * sp.c[3]] };
-            }
-            Tint::Root { x, y, hair, inherit, shade, spec } => {
-                let root = src.sample_bilinear(x, y);
-                if root[3] < 0.5 {
-                    sp.c = [0.0; 4];
-                    return;
-                }
-                let (rc, _) = unpremul(root);
-                let base: [f32; 3] = std::array::from_fn(|k| rc[k] + (hair[k] - rc[k]) * (1.0 - inherit));
-                sp.c = [base[0] * shade + spec, base[1] * shade + spec, base[2] * shade + spec, sp.c[3]];
-            }
-        });
-    }
-
-    /// Rasterise (after [`SpritePlan::resolve`]) and meet the original layer `b`.
-    pub fn finish(&self, b: Buf) -> Buf {
-        let fx = splat(b.img.width, b.img.height, &self.sprites, self.acc);
-        self.finish_with(b, fx)
-    }
-
-    /// [`finish`](Self::finish) with a prepared sprite image (the motion-blurred average of
-    /// several frames, #1195).
-    pub fn finish_with(&self, b: Buf, fx: Image) -> Buf {
-        self.post.apply(b, fx)
-    }
-}
-
-impl Post {
-    /// Meet the sprite image `fx` with the original layer `b` (see [`SpritePlan::finish`]).
-    fn apply(self, mut b: Buf, fx: Image) -> Buf {
-        b.img = match self {
-            Post::Combine(m) => combine(&b.img, &fx, m),
-            Post::Replace => fx,
-            Post::Lerp(t) => {
-                let mut o = fx;
-                o.data.par_iter_mut().zip(b.img.data.par_iter()).for_each(|(o, s0)| *o = crate::util::lerp4(*o, *s0, t));
-                o
-            }
-            Post::OverBlack => combine(&Image::filled(b.img.width, b.img.height, [0.0, 0.0, 0.0, 1.0]), &fx, 0),
-        };
-        b
-    }
-}
-
-/// The sprite plan of a sprite-drawing simulation effect for buffer geometry `b` (its pixels
-/// are not read), `None` for other effects or settings drawn otherwise (the GPU compositor's
-/// render pass).
-pub fn sprite_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
-    match id {
-        "ec.sim.ccrainfall" => Some(rainfall_plan(ctx, b)),
-        "ec.sim.ccsnowfall" => Some(snowfall_plan(ctx, b)),
-        "ec.sim.ccstarburst" => Some(star_burst_plan(ctx, b)),
-        "ec.sim.cchair" => crate::sim3::hair_plan(ctx, b),
-        "ec.sim.waveworld" => crate::sim2::wave_world_plan(ctx, b).and_then(|p| match p {
-            crate::sim2::WavePlan::Wire(sp) => Some(sp),
-            crate::sim2::WavePlan::Height { .. } => None,
-        }),
-        "ec.sim.foam" => crate::sim2::foam_plan(ctx, b),
-        "ec.sim.ccparticleworld" => particle_world_plan(ctx, b),
-        "ec.sim.ccparticlesystems2" => Some(particle_systems2_plan(ctx, b)),
-        _ => None,
-    }
-}
-
-fn sprite_bbox(s: &Sprite) -> Option<[f32; 4]> {
-    if s.c[3] <= 1e-5 || s.r <= 0.0 {
-        return None;
-    }
-    let r = s.r.max(0.5) + 1.0;
-    Some(match s.shape {
-        Shape::Line { dx, dy } => [s.x.min(s.x + dx) - r, s.y.min(s.y + dy) - r, s.x.max(s.x + dx) + r, s.y.max(s.y + dy) + r],
-        Shape::Star => [s.x - r * 2.0, s.y - r * 2.0, s.x + r * 2.0, s.y + r * 2.0],
-        _ => [s.x - r, s.y - r, s.x + r, s.y + r],
-    })
-}
-
-#[inline]
-fn aa(edge: f32) -> f32 {
-    (edge + 0.5).clamp(0.0, 1.0)
-}
-
-fn sprite_shade(s: &Sprite, x: f32, y: f32) -> Option<Px> {
-    // Sub-pixel sprites keep their energy: draw at radius 0.5 with reduced opacity.
-    let (r, fade) = if s.r < 0.5 { (0.5, s.r / 0.5) } else { (s.r, 1.0) };
-    let (dx, dy) = (x - s.x, y - s.y);
-    let mut rgb = [s.c[0], s.c[1], s.c[2]];
-    let cov = match s.shape {
-        Shape::Soft => {
-            let d2 = (dx * dx + dy * dy) / (r * r);
-            if d2 >= 1.0 {
-                return None;
-            }
-            let q = 1.0 - d2;
-            q * q
-        }
-        Shape::Disc => aa(r - (dx * dx + dy * dy).sqrt()),
-        Shape::Faded => {
-            let d = (dx * dx + dy * dy).sqrt() / r;
-            (1.0 - d).max(0.0).powf(1.5)
-        }
-        Shape::Sphere => {
-            let d = (dx * dx + dy * dy).sqrt();
-            let cv = aa(r - d);
-            if cv <= 0.0 {
-                return None;
-            }
-            let (nx, ny) = (dx / r, dy / r);
-            let nz = (1.0 - nx * nx - ny * ny).max(0.0).sqrt();
-            let (lx, ly, lz) = (-0.48, -0.58, 0.66);
-            let diff = (nx * lx + ny * ly + nz * lz).max(0.0);
-            let rz = 2.0 * diff * nz - lz;
-            let spec = rz.max(0.0).powi(20) * 0.6;
-            let k = 0.2 + 0.8 * diff;
-            rgb = [rgb[0] * k + spec, rgb[1] * k + spec, rgb[2] * k + spec];
-            cv
-        }
-        Shape::Bubble => {
-            let d = (dx * dx + dy * dy).sqrt() / r;
-            if d > 1.0 + 1.0 / r {
-                return None;
-            }
-            let ring = (1.0 - ((d - 0.9) / 0.12).powi(2)).max(0.0);
-            let hl = (1.0 - (((dx / r) + 0.4).powi(2) + ((dy / r) + 0.4).powi(2)) / 0.04).max(0.0);
-            (0.12 * (d <= 1.0) as u8 as f32 + ring * 0.8 + hl).min(1.0)
-        }
-        Shape::Star => {
-            let (sn, cs) = s.rot.sin_cos();
-            let (ux, uy) = ((dx * cs + dy * sn) / r, (-dx * sn + dy * cs) / r);
-            let d = (ux * ux + uy * uy).sqrt();
-            let core = (1.0 - d).max(0.0).powi(2);
-            let sx = (1.0 - ux.abs() / 2.0).max(0.0) * (1.0 - (uy.abs() * 6.0)).max(0.0);
-            let sy = (1.0 - uy.abs() / 2.0).max(0.0) * (1.0 - (ux.abs() * 6.0)).max(0.0);
-            (core + sx + sy).min(1.0)
-        }
-        Shape::Square => {
-            let (sn, cs) = s.rot.sin_cos();
-            let (ux, uy) = (dx * cs + dy * sn, -dx * sn + dy * cs);
-            let e = r * 0.75;
-            aa(e - ux.abs()) * aa(e - uy.abs())
-        }
-        Shape::Tri => {
-            let (sn, cs) = s.rot.sin_cos();
-            let (ux, uy) = (dx * cs + dy * sn, -dx * sn + dy * cs);
-            // Equilateral triangle with circumradius r: three half-planes.
-            let e = r * 0.5;
-            let mut m = f32::INFINITY;
-            for k in 0..3 {
-                let a = std::f32::consts::FRAC_PI_2 + k as f32 * std::f32::consts::TAU / 3.0;
-                let (ns, nc) = a.sin_cos();
-                m = m.min(e - (ux * nc + uy * ns));
-            }
-            aa(m)
-        }
-        Shape::Line { dx: lx, dy: ly } => {
-            let l2 = lx * lx + ly * ly;
-            let t = if l2 > 0.0 { ((dx * lx + dy * ly) / l2).clamp(0.0, 1.0) } else { 0.0 };
-            let (px, py) = (dx - lx * t, dy - ly * t);
-            aa(r - (px * px + py * py).sqrt())
-        }
-    };
-    let a = cov * s.c[3] * fade;
-    if a <= 1e-6 {
-        return None;
-    }
-    Some([rgb[0] * a, rgb[1] * a, rgb[2] * a, a])
-}
-
-/// Draw sprites into a new transparent image of `w`×`h`.
-pub(crate) fn splat(w: u32, hgt: u32, sprites: &[Sprite], acc: Acc) -> Image {
-    let mut img = Image::new(w, hgt);
-    raster(&mut img, sprites, sprite_bbox, sprite_shade, acc);
-    img
-}
-
-/// Combine an effect layer `fx` with the original `src` (both premultiplied, same size):
-/// 0 Composite (fx over src), 1 Screen, 2 Add, 3 Lighten, 4 Darken, 5 fx only.
-pub(crate) fn combine(src: &Image, fx: &Image, mode: u32) -> Image {
-    let mut out = fx.clone();
-    out.data.par_iter_mut().zip(src.data.par_iter()).for_each(|(o, s)| {
-        let f = *o;
-        *o = match mode {
-            0 => {
-                let k = 1.0 - f[3];
-                [f[0] + s[0] * k, f[1] + s[1] * k, f[2] + s[2] * k, f[3] + s[3] * k]
-            }
-            1 => [s[0] + f[0] - s[0] * f[0], s[1] + f[1] - s[1] * f[1], s[2] + f[2] - s[2] * f[2], s[3] + f[3] - s[3] * f[3]],
-            2 => [s[0] + f[0], s[1] + f[1], s[2] + f[2], (s[3] + f[3]).min(1.0)],
-            3 => [s[0].max(f[0]), s[1].max(f[1]), s[2].max(f[2]), s[3] + f[3] - s[3] * f[3]],
-            4 => {
-                let (fc, fa) = unpremul(f);
-                let m = |c: f32, k: usize| c - (c - c.min(fc[k] * s[3])) * fa;
-                [m(s[0], 0), m(s[1], 1), m(s[2], 2), s[3]]
-            }
-            _ => f,
-        };
-    });
-    out
-}
-
-// ------------------------------------------------------------------ CC Rainfall / CC Snowfall
-
-/// Shared weather layout: per-item depth factor `k` in (0, 1] (1 = nearest) from Scene Depth.
-#[inline]
-fn depth_k(z: f32, scene_depth: f32) -> f32 {
-    1.0 / (1.0 + z * scene_depth / 2500.0)
-}
-
-/// Wrap `v` into `[lo, lo + span)`.
-#[inline]
-fn wrap(v: f32, lo: f32, span: f32) -> f32 {
-    if span <= 0.0 { v } else { lo + (v - lo).rem_euclid(span) }
-}
-
-fn rainfall(ctx: &EffectCtx, b: Buf) -> Buf {
-    let mut plan = rainfall_plan(ctx, &b);
-    plan.resolve(&b.img);
-    plan.finish(b)
-}
-
-fn rainfall_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
-    let pr = ctx.params;
-    let n = pr.f("drops").clamp(0.0, 100_000.0) as u32;
-    let size = pr.f("size").max(0.0) as f32;
-    let depth = pr.f("sceneDepth").max(0.0) as f32;
-    let speed = pr.f("speed") as f32;
-    let wind = pr.f("wind") as f32;
-    let wvar = pr.f("windVariation") as f32 / 100.0;
-    let spread = pr.f("spread") as f32;
-    let color = pr.color("color");
-    let opacity = pr.f("opacity") as f32 / 100.0;
-    let mode = pr.e("transferMode");
-    let with_orig = pr.b("compositeWithOriginal");
-    let refract = pr.e("extras/appearance") == 0;
-    let off = pr.v2("extras/offset");
-    let seed = pr.f("extras/randomSeed") as u32 ^ ctx.seed.wrapping_mul(0x9e37);
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let s = b.scale as f32;
-    let t = ctx.time as f32;
-    let (ox, oy) = (off[0] as f32 - lw * 0.5, off[1] as f32 - lh * 0.5);
-    let (sprites, tints): (Vec<Sprite>, Vec<Tint>) = (0..n)
-        .into_par_iter()
-        .map(|i| {
-            let z = h(i, 1, seed);
-            let k = depth_k(z, depth);
-            let vy = speed / 4000.0 * lh * 2.2 * k;
-            let w = wind / 1000.0 * lh * (1.0 + wvar * hs(i, 2, seed)) * k + spread * hs(i, 7, seed) * k;
-            let len = (vy * 0.04 * size.max(0.2)).max(1.0);
-            let lenx = w * 0.04 * size.max(0.2);
-            let margin = len + lenx.abs() + 4.0;
-            let y = wrap(h(i, 3, seed) * (lh + 2.0 * margin) + vy * t + oy, -margin, lh + 2.0 * margin);
-            let x = wrap(h(i, 4, seed) * (lw + 2.0 * margin) + w * t + ox, -margin, lw + 2.0 * margin);
-            let (bx, by) = b.to_px([x as f64, y as f64]);
-            let c = [color[0], color[1], color[2], opacity * (0.35 + 0.65 * k)];
-            // Refracting drops show the scene behind them, brightened and offset.
-            let tint = if refract { Tint::Refract { x: bx + 2.0 * s as f64, y: by } } else { Tint::Fixed };
-            let r = (size * 0.6 * k * s).max(0.25);
-            (Sprite::new(bx as f32, by as f32, r, c, Shape::Line { dx: -lenx * s, dy: -len * s }), tint)
-        })
-        .unzip();
-    SpritePlan { sprites, tints, acc: Acc::Over, post: weather_post(mode, with_orig) }
-}
-
-fn weather_post(mode: u32, with_orig: bool) -> Post {
-    if with_orig { Post::Combine(if mode == 1 { 3 } else { 0 }) } else { Post::Replace }
-}
-
-fn snowfall(ctx: &EffectCtx, b: Buf) -> Buf {
-    snowfall_plan(ctx, &b).finish(b)
-}
-
-fn snowfall_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
-    let pr = ctx.params;
-    let n = pr.f("flakes").clamp(0.0, 200_000.0) as u32;
-    let size = pr.f("size").max(0.0) as f32;
-    let svar = pr.f("sizeVariation") as f32 / 100.0;
-    let depth = pr.f("sceneDepth").max(0.0) as f32;
-    let speed = pr.f("speed") as f32;
-    let spvar = pr.f("speedVariation") as f32 / 100.0;
-    let wind = pr.f("wind") as f32;
-    let wvar = pr.f("windVariation") as f32 / 100.0;
-    let spread = pr.f("spread") as f32;
-    let wig = pr.f("wiggle/wiggleAmount") as f32;
-    let wigvar = pr.f("wiggle/wiggleAmountVariation") as f32 / 100.0;
-    let wfreq = pr.f("wiggle/wiggleFrequency") as f32;
-    let wfvar = pr.f("wiggle/wiggleFrequencyVariation") as f32 / 100.0;
-    let color = pr.color("color");
-    let opacity = pr.f("opacity") as f32 / 100.0;
-    let mode = pr.e("transferMode");
-    let with_orig = pr.b("compositeWithOriginal");
-    let off = pr.v2("extras/offset");
-    let seed = pr.f("extras/randomSeed") as u32 ^ ctx.seed.wrapping_mul(0x85eb);
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let s = b.scale as f32;
-    let t = ctx.time as f32;
-    let (ox, oy) = (off[0] as f32 - lw * 0.5, off[1] as f32 - lh * 0.5);
-    let sprites: Vec<Sprite> = (0..n)
-        .into_par_iter()
-        .map(|i| {
-            let z = h(i, 1, seed);
-            let k = depth_k(z, depth);
-            let r = (size * 0.5 * k * (1.0 + svar * hs(i, 2, seed))).max(0.05);
-            let vy = speed * (lh / 600.0) * k * (1.0 + spvar * hs(i, 3, seed));
-            let vx = wind * (lh / 1200.0) * k * (1.0 + wvar * hs(i, 4, seed)) + spread * hs(i, 8, seed) * k;
-            let amp = wig * 2.0 * k * (1.0 + wigvar * hs(i, 5, seed));
-            let fr = wfreq * (1.0 + wfvar * hs(i, 6, seed));
-            let ph = h(i, 9, seed) * std::f32::consts::TAU;
-            let margin = r + amp.abs() + 2.0;
-            let y = wrap(h(i, 10, seed) * (lh + 2.0 * margin) + vy * t + oy, -margin, lh + 2.0 * margin);
-            let x = wrap(h(i, 11, seed) * (lw + 2.0 * margin) + vx * t + ox, -margin, lw + 2.0 * margin) + amp * (fr * t * std::f32::consts::TAU + ph).sin();
-            let (bx, by) = b.to_px([x as f64, y as f64]);
-            Sprite::new(bx as f32, by as f32, r * s, [color[0], color[1], color[2], opacity * (0.4 + 0.6 * k)], Shape::Soft)
-        })
-        .collect();
-    SpritePlan { sprites, tints: vec![], acc: Acc::Over, post: weather_post(mode, with_orig) }
-}
-
-// ------------------------------------------------------------------ CC Bubbles
-
-/// A CC Bubbles bubble in buffer pixels.
-#[derive(Clone, Copy, Debug)]
-pub struct Bubble {
-    pub x: f32,
-    pub y: f32,
-    pub r: f32,
-    /// Source sample centre (buffer px).
-    pub sx: f32,
-    pub sy: f32,
-}
-
-/// CC Bubbles' bubbles this frame (closed-form in time) for buffer geometry `b`.
-pub fn bubble_list(ctx: &EffectCtx, b: &Buf) -> Vec<Bubble> {
-    let pr = ctx.params;
-    let n = pr.f("bubbleAmount").clamp(0.0, 10_000.0) as u32;
-    let speed = pr.f("bubbleSpeed") as f32;
-    let wamp = pr.f("wobbleAmplitude") as f32;
-    let wfreq = pr.f("wobbleFrequency") as f32;
-    let bsize = pr.f("bubbleSize").max(0.0) as f32;
-    let seed = ctx.seed.wrapping_mul(0x27d4);
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let s = b.scale as f32;
-    let t = ctx.time as f32;
-    let base = lw.min(lh) * 0.035 * bsize;
-    (0..n)
-        .map(|i| {
-            let r = base * (0.5 + h(i, 1, seed));
-            let travel = lh + 2.0 * r;
-            let v = speed * lh * 0.3 * (0.6 + 0.8 * h(i, 2, seed));
-            let y = lh + r - (h(i, 3, seed) * travel + v * t).rem_euclid(travel);
-            let x0 = h(i, 4, seed) * lw;
-            let x = x0 + wamp * (r / base.max(1e-3)) * (t * wfreq * std::f32::consts::TAU + h(i, 5, seed) * std::f32::consts::TAU).sin();
-            let (bx, by) = b.to_px([x as f64, y as f64]);
-            let (sx, sy) = b.to_px([x0 as f64, y as f64]);
-            Bubble { x: bx as f32, y: by as f32, r: r * s, sx: sx as f32, sy: sy as f32 }
-        })
-        .collect()
-}
-
-fn bubbles(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let metal = pr.e("reflectionType") == 1;
-    let shading = pr.e("shadingType");
-    let list = bubble_list(ctx, &b);
-    let src = b.img.clone();
-    let mut out = Image::new(src.width, src.height);
-    raster(
-        &mut out,
-        &list,
-        |q| Some([q.x - q.r - 1.0, q.y - q.r - 1.0, q.x + q.r + 1.0, q.y + q.r + 1.0]),
-        |q, x, y| {
-            let (dx, dy) = ((x - q.x) / q.r.max(0.5), (y - q.y) / q.r.max(0.5));
-            let d2 = dx * dx + dy * dy;
-            let d = d2.sqrt();
-            let cov = aa((1.0 - d) * q.r);
-            if cov <= 0.0 {
-                return None;
-            }
-            // Liquid refracts (inverted, magnified), metal reflects (wide-angle mirror).
-            let k = if metal { 1.6 } else { -0.7 };
-            let nz = (1.0 - d2).max(0.0).sqrt();
-            let p = src.sample_bilinear((q.sx + dx * q.r * k) as f64, (q.sy + dy * q.r * k) as f64);
-            let (c, sa) = unpremul(p);
-            let mut c = if sa <= 0.0 { [0.6, 0.7, 0.8] } else { c };
-            let mut a = cov;
-            match shading {
-                1 => c = c.map(|v| v * 0.7 + 0.3 * (1.0 - nz)),
-                2 => c = c.map(|v| v * (0.5 + 0.5 * nz)),
-                3 => a *= nz.powf(0.5),
-                4 => a *= 1.0 - nz * 0.8,
-                _ => {}
-            }
-            let hl = (1.0 - ((dx + 0.35).powi(2) + (dy + 0.35).powi(2)) / 0.05).max(0.0) * 0.8;
-            let c = c.map(|v| v + hl);
-            Some([c[0] * a, c[1] * a, c[2] * a, a])
-        },
-        Acc::Over,
-    );
-    b.img = out;
-    b
-}
-
-// ------------------------------------------------------------------ CC Drizzle
-
-/// CC Drizzle's live drops this frame (buffer px: centre x, y, ring radius, amplitude);
-/// `None` = no drops yet (the layer passes through).
-pub fn drizzle_drops(ctx: &EffectCtx, b: &Buf) -> Option<Vec<[f32; 4]>> {
-    let pr = ctx.params;
-    let rate = pr.f("dripRate").max(0.0);
-    let life = pr.f("longevity").max(0.01);
-    let spreading = pr.f("spreading") as f32;
-    let height = pr.f("rippleHeight") as f32 / 100.0;
-    let seed = ctx.seed.wrapping_mul(0x165667b1);
-    let t = ctx.time;
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let s = b.scale as f32;
-    if rate <= 0.0 || t < 0.0 {
-        return None;
-    }
-    // Drops born at k / rate with hashed positions; alive while younger than the longevity.
-    let k0 = ((t - life) * rate).floor().max(0.0) as u32;
-    let k1 = (t * rate).floor() as u32;
-    let mut drops = Vec::new();
-    for k in k0..=k1 {
-        let born = k as f64 / rate;
-        let age = (t - born) as f32;
-        if age < 0.0 || age as f64 >= life {
-            continue;
-        }
-        let (x, y) = b.to_px([(h(k, 1, seed) * lw) as f64, (h(k, 2, seed) * lh) as f64]);
-        let radius = spreading * age * lh / 400.0 * s;
-        let amp = height * (1.0 - age / life as f32) * (0.6 + 0.4 * h(k, 3, seed));
-        drops.push([x as f32, y as f32, radius, amp]);
-    }
-    Some(drops)
-}
-
-fn drizzle(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let Some(drops) = drizzle_drops(ctx, &b) else { return b };
-    let rippling = (pr.f("rippling") / 360.0).max(0.05) as f32;
-    let disp = pr.f("displacement") as f32;
-    let li = pr.f("light/lightIntensity") as f32 / 100.0;
-    let lc = pr.color("light/lightColor");
-    let lheight = pr.f("light/lightHeight") as f32 / 100.0;
-    let ldir = (pr.f("light/lightDirection") as f32).to_radians();
-    let ambient = pr.f("shading/ambient") as f32 / 100.0;
-    let diffuse = pr.f("shading/diffuse") as f32 / 100.0;
-    let specular = pr.f("shading/specular") as f32 / 100.0;
-    let rough = pr.f("shading/roughness").max(0.001) as f32;
-    let lh = ctx.layer_size[1] as f32;
-    let s = b.scale as f32;
-    let wavelen = (lh * 0.04 * s).max(2.0) / rippling.clamp(0.25, 4.0);
-    let width = wavelen * (1.0 + rippling * 2.0);
-    let field = |x: f32, y: f32| -> f32 {
-        let mut v = 0.0;
-        for &[dx, dy, r, a] in &drops {
-            let d = ((x - dx).powi(2) + (y - dy).powi(2)).sqrt();
-            let u = (d - r) / width;
-            if u.abs() < 1.0 {
-                let env = 0.5 + 0.5 * (u * std::f32::consts::PI).cos();
-                v += a * env * ((d - r) / wavelen * std::f32::consts::TAU).cos();
-            }
-        }
-        v
-    };
-    let src = b.img.clone();
-    let (ls, lcs) = ldir.sin_cos();
-    let l = {
-        let v = [lcs, ls, lheight.max(0.05)];
-        let n = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
-        [v[0] / n, v[1] / n, v[2] / n]
-    };
-    b.img.rows_mut().for_each(|(y, row)| {
-        for (x, px) in row.iter_mut().enumerate() {
-            let (fx, fy) = (x as f32 + 0.5, y as f32 + 0.5);
-            let gx = field(fx + 1.0, fy) - field(fx - 1.0, fy);
-            let gy = field(fx, fy + 1.0) - field(fx, fy - 1.0);
-            if gx == 0.0 && gy == 0.0 {
-                continue;
-            }
-            let p = src.sample_bilinear_clamped((fx - gx * disp * s * 4.0) as f64, (fy - gy * disp * s * 4.0) as f64);
-            let n = {
-                let v = [-gx * 6.0, -gy * 6.0, 1.0];
-                let m = (v[0] * v[0] + v[1] * v[1] + 1.0).sqrt();
-                [v[0] / m, v[1] / m, v[2] / m]
-            };
-            let nl = (n[0] * l[0] + n[1] * l[1] + n[2] * l[2]).max(0.0);
-            let hz = (l[2] + 1.0) * 0.5;
-            let hv = {
-                let v = [l[0] * 0.5, l[1] * 0.5, hz];
-                let m = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
-                [v[0] / m, v[1] / m, v[2] / m]
-            };
-            let sp = (n[0] * hv[0] + n[1] * hv[1] + n[2] * hv[2]).max(0.0).powf(1.0 / rough) * specular * li;
-            let shade = 1.0 + (ambient + diffuse * nl - diffuse * l[2]) * li;
-            let a = p[3];
-            *px = [p[0] * shade + sp * lc[0] * a, p[1] * shade + sp * lc[1] * a, p[2] * shade + sp * lc[2] * a, a];
-        }
-    });
-    b
-}
-
-// ------------------------------------------------------------------ CC Star Burst
-
-fn star_burst(ctx: &EffectCtx, b: Buf) -> Buf {
-    let mut plan = star_burst_plan(ctx, &b);
-    plan.resolve(&b.img);
-    plan.finish(b)
-}
-
-fn star_burst_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
-    let pr = ctx.params;
-    let scatter = pr.f("scatter") as f32;
-    let speed = pr.f("speed") as f32;
-    let phase = pr.f("phase") as f32 / 360.0;
-    let spacing = pr.f("gridSpacing").max(1.0) as f32;
-    let size = pr.f("size") as f32 / 100.0;
-    let blend = pr.f("blendWithOriginal") as f32 / 100.0;
-    let seed = ctx.seed.wrapping_mul(0x3c6e);
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let s = b.scale as f32;
-    let t = ctx.time as f32;
-    let nx = (lw / spacing).ceil().max(1.0) as u32;
-    let ny = (lh / spacing).ceil().max(1.0) as u32;
-    let (cx, cy) = (lw * 0.5, lh * 0.5);
-    let mut list: Vec<(f32, Sprite, Tint)> = (0..nx * ny)
-        .into_par_iter()
-        .map(|i| {
-            let (gx, gy) = ((i % nx) as f32 * spacing + spacing * 0.5, (i / nx) as f32 * spacing + spacing * 0.5);
-            let (sx, sy) = b.to_px([gx as f64, gy as f64]);
-            // Depth cycles towards the viewer: z in [0, 1), perspective 1 / (1 - 0.9 z).
-            let z = (h(i, 1, seed) + t * speed * 0.25 + phase).rem_euclid(1.0);
-            let persp = 1.0 / (1.0 - 0.9 * z);
-            let jx = hs(i, 2, seed) * scatter * 0.01 * lw * 0.5;
-            let jy = hs(i, 3, seed) * scatter * 0.01 * lh * 0.5;
-            let x = cx + (gx - cx + jx) * persp;
-            let y = cy + (gy - cy + jy) * persp;
-            let (bx, by) = b.to_px([x as f64, y as f64]);
-            let r = spacing * 0.5 * size * persp * s;
-            let fade = (z * 8.0).min(1.0) * ((1.0 - z) * 6.0).min(1.0);
-            // The layer's colour at the grid point (none where it is clear).
-            (z, Sprite::new(bx as f32, by as f32, r, [0.0, 0.0, 0.0, fade], Shape::Disc), Tint::Source { x: sx, y: sy })
-        })
-        .collect();
-    list.sort_by(|a, b| a.0.total_cmp(&b.0));
-    let (sprites, tints) = list.into_iter().map(|(_, s, t)| (s, t)).unzip();
-    SpritePlan { sprites, tints, acc: Acc::Over, post: if blend > 0.0 { Post::Lerp(blend) } else { Post::Replace } }
-}
-
-// ------------------------------------------------------------------ particle engine
-
-/// Steps per second of the stepped particle simulations.
-pub(crate) const SPS: f64 = 60.0;
-
-/// Number of whole steps reached at layer time `t`.
-pub(crate) fn steps_at(t: f64) -> u64 {
-    if t <= 0.0 { 0 } else { (t * SPS + 1e-6).floor() as u64 }
-}
-
-#[derive(Clone, Debug)]
-pub(crate) struct Particle {
-    pub p: [f32; 3],
-    pub v: [f32; 3],
-    pub age: f32,
-    pub life: f32,
-    /// Per-particle random in [0, 1) (size variation, colour jitter…).
-    pub rnd: f32,
-    pub id: u32,
-}
-
-#[derive(Clone, Debug, Default)]
-pub(crate) struct PState {
-    pub parts: Vec<Particle>,
-    pub carry: f64,
-    pub next_id: u32,
-}
-
-/// Physics configuration (world units; y down).
-#[derive(Clone, Copy, Debug)]
-pub(crate) struct Phys {
-    /// Particles per second.
-    pub rate: f64,
-    pub life: f32,
-    pub producer: [f32; 3],
-    pub radius: [f32; 3],
-    pub anim: u32,
-    pub speed: f32,
-    pub gravity: [f32; 3],
-    pub resistance: f32,
-    pub axis: [f32; 3],
-    pub extra: f32,
-    pub extra_angle: f32,
-    pub seed: u32,
-    pub max: usize,
-    /// 2D systems keep z = 0.
-    pub flat: bool,
-}
-
-pub(crate) const PW_ANIMS: &[&str] =
-    &["Explosive", "Direction Axis", "Cone Axis", "Viscouse", "Twirly", "Vortex", "Fire", "Jet Sideways", "Fractal Omni", "Fractal Uni"];
-
-fn norm3(v: [f32; 3]) -> [f32; 3] {
-    let l = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
-    if l > 1e-9 { [v[0] / l, v[1] / l, v[2] / l] } else { [0.0, -1.0, 0.0] }
-}
-
-fn rand_dir(i: u32, k: u32, seed: u32, flat: bool) -> [f32; 3] {
-    if flat {
-        let a = h(i, k, seed) * std::f32::consts::TAU;
-        return [a.cos(), a.sin(), 0.0];
-    }
-    let z = hs(i, k, seed);
-    let a = h(i, k + 1, seed) * std::f32::consts::TAU;
-    let r = (1.0 - z * z).max(0.0).sqrt();
-    [r * a.cos(), r * a.sin(), z]
-}
-
-impl Phys {
-    fn spawn(&self, id: u32) -> Particle {
-        let seed = self.seed;
-        let mut p = [0.0f32; 3];
-        // Uniform in the producer ellipsoid.
-        let u = rand_dir(id, 1, seed, self.flat);
-        let rr = h(id, 3, seed).powf(if self.flat { 0.5 } else { 1.0 / 3.0 });
-        for k in 0..3 {
-            p[k] = self.producer[k] + u[k] * self.radius[k] * rr;
-        }
-        if self.flat {
-            p[2] = 0.0;
-        }
-        let ax = norm3(self.axis);
-        let jitter = rand_dir(id, 5, seed, self.flat);
-        let dir = match self.anim {
-            1 | 9 => norm3([ax[0] + jitter[0] * 0.08, ax[1] + jitter[1] * 0.08, ax[2] + jitter[2] * 0.08]),
-            2 => {
-                let k = (self.extra_angle.to_radians() * 0.5).tan().abs().min(20.0);
-                norm3([ax[0] + jitter[0] * k * h(id, 8, seed), ax[1] + jitter[1] * k * h(id, 8, seed), ax[2] + jitter[2] * k * h(id, 8, seed)])
-            }
-            5 => [jitter[0], 0.0, if self.flat { 0.0 } else { jitter[2] }],
-            6 => norm3([jitter[0] * 0.25, -1.0, jitter[2] * 0.25]),
-            7 => norm3([1.0, jitter[1] * 0.05, jitter[2] * 0.05]),
-            _ => jitter,
-        };
-        let sp = self.speed * (0.5 + 0.5 * h(id, 9, seed));
-        let mut v = [dir[0] * sp, dir[1] * sp, dir[2] * sp];
-        if self.flat {
-            v[2] = 0.0;
-        }
-        let life = self.life * (0.8 + 0.4 * h(id, 10, seed));
-        Particle { p, v, age: 0.0, life, rnd: h(id, 11, seed), id }
-    }
-
-    pub(crate) fn step(&self, st: &mut PState, step: u64) {
-        let dt = (1.0 / SPS) as f32;
-        let t = step as f32 * dt;
-        let mut drag = self.resistance;
-        if self.anim == 3 {
-            drag += 3.0 * self.extra.max(0.1);
-        }
-        let damp = (-drag * dt).exp();
-        let seed = self.seed;
-        st.parts.par_iter_mut().for_each(|q| {
-            let mut a = self.gravity;
-            match self.anim {
-                4 => {
-                    // Twirly: swirl around the vertical axis through the producer.
-                    let (dx, dz) = (q.p[0] - self.producer[0], q.p[2] - self.producer[2]);
-                    let k = 4.0 * self.extra;
-                    a[0] += -dz * k;
-                    a[2] += dx * k;
-                    if self.flat {
-                        let dy = q.p[1] - self.producer[1];
-                        a[0] += -dy * k;
-                        a[1] += dx * k;
-                    }
-                }
-                5 => {
-                    // Vortex: strong tangential + inward pull.
-                    let (dx, dy) = (q.p[0] - self.producer[0], q.p[1] - self.producer[1]);
-                    let k = 6.0 * self.extra;
-                    a[0] += -dy * k - dx * 2.0;
-                    a[1] += dx * k - dy * 2.0;
-                }
-                6 => {
-                    // Fire: buoyant, flickering turbulence.
-                    let n = value_noise(q.p[0] * 8.0, q.p[1] * 8.0, t * 3.0, seed) - 0.5;
-                    a[0] += n * 4.0 * self.extra;
-                    a[1] -= self.gravity[1] * 1.5 + 0.3 * self.extra;
-                }
-                8 | 9 => {
-                    let f = 6.0 * self.extra;
-                    a[0] += (value_noise(q.p[0] * 5.0, q.p[1] * 5.0, q.p[2] * 5.0 + t, seed) - 0.5) * f;
-                    a[1] += (value_noise(q.p[0] * 5.0 + 17.0, q.p[1] * 5.0, q.p[2] * 5.0 + t, seed) - 0.5) * f;
-                    if !self.flat {
-                        a[2] += (value_noise(q.p[0] * 5.0, q.p[1] * 5.0 + 31.0, q.p[2] * 5.0 + t, seed) - 0.5) * f;
-                    }
-                }
-                _ => {}
-            }
-            for k in 0..3 {
-                q.v[k] = (q.v[k] + a[k] * dt) * damp;
-                q.p[k] += q.v[k] * dt;
-            }
-            if self.flat {
-                q.p[2] = 0.0;
-                q.v[2] = 0.0;
-            }
-            q.age += dt;
-        });
-        st.parts.retain(|q| q.age < q.life);
-        st.carry += self.rate / SPS;
-        let n = st.carry.floor() as u32;
-        st.carry -= n as f64;
-        for _ in 0..n {
-            if st.parts.len() >= self.max {
-                break;
-            }
-            let id = st.next_id;
-            st.next_id = st.next_id.wrapping_add(1);
-            // Sub-step birth offset keeps continuous streams smooth.
-            let mut q = self.spawn(id);
-            let frac = h(id, 12, seed) * dt;
-            for k in 0..3 {
-                q.p[k] += q.v[k] * frac;
-            }
-            q.age = frac;
-            st.parts.push(q);
-        }
-    }
-}
-
-impl Phys {
-    /// The backend description (per-step and per-spawn constants evaluated here, in f32).
-    pub(crate) fn desc(&self) -> crate::psim::EngineDesc {
-        let mut drag = self.resistance;
-        if self.anim == 3 {
-            drag += 3.0 * self.extra.max(0.1);
-        }
-        let dt = (1.0 / SPS) as f32;
-        crate::psim::EngineDesc {
-            life: self.life,
-            producer: self.producer,
-            radius: self.radius,
-            anim: self.anim,
-            speed: self.speed,
-            gravity: self.gravity,
-            axis: norm3(self.axis),
-            extra: self.extra,
-            cone: (self.extra_angle.to_radians() * 0.5).tan().abs().min(20.0),
-            damp: (-drag * dt).exp(),
-            seed: self.seed,
-            flat: self.flat,
-        }
-    }
-}
-
-/// The state at layer time `ctx.time` from the host's particle backend (GPU particles), or
-/// `None` (simulate on the CPU).
-fn accelerated(ctx: &EffectCtx, key: u64, phys: &Phys) -> Option<std::sync::Arc<PState>> {
-    let backend = ctx.env.host?.particles()?;
-    let steps = steps_at(ctx.time);
-    let births = crate::psim::births(phys.rate, steps, phys.max)?;
-    let req = crate::psim::SimRequest { key, steps, births: &births, system: crate::psim::ParticleSystem::Engine(phys.desc()) };
-    let parts = backend.simulate(&req)?;
-    Some(std::sync::Arc::new(PState {
-        parts: parts.into_iter().map(|q| Particle { p: q.p, v: q.v, age: q.age, life: q.life, rnd: q.rnd, id: q.id }).collect(),
-        carry: 0.0,
-        next_id: births.len() as u32,
-    }))
-}
-
-/// The live particles of a stepped particle effect (`ec.sim.ccparticleworld`,
-/// `ec.sim.ccparticlesystems2`) at `ctx.time`: from the host's particle backend when it has
-/// one (GPU particles), else from the CPU simulation. For comparing the two.
-pub fn particle_state(id: &str, ctx: &EffectCtx) -> Option<Vec<crate::psim::SimParticle>> {
-    let (phys, cache, salt) = match id {
-        "ec.sim.ccparticleworld" => (pw_phys(ctx), &PW_CACHE, 1),
-        "ec.sim.ccparticlesystems2" => (ps2_phys(ctx), &PS2_CACHE, 2),
-        _ => return None,
-    };
-    let key = sim_key(ctx, salt);
-    let st = accelerated(ctx, key, &phys).unwrap_or_else(|| simulate(cache, key, ctx.time, &phys));
-    Some(st.parts.iter().map(|q| crate::psim::SimParticle { p: q.p, v: q.v, age: q.age, life: q.life, rnd: q.rnd, id: q.id }).collect())
-}
-
-/// The simulation cache key of a stepped particle effect: every parameter but CC Particle World's
-/// Effect Camera, which only changes how the particles are seen (animating it doesn't restart
-/// the simulation).
-fn sim_key(ctx: &EffectCtx, salt: u64) -> u64 {
-    params_key_except(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, salt, &[PW_EFFECT_CAMERA])
-}
-
-/// Run a particle system to layer time `t` through `cache`.
-pub(crate) fn simulate(cache: &SimCache<PState>, key: u64, t: f64, phys: &Phys) -> std::sync::Arc<PState> {
-    cache.run(key, steps_at(t), PState::default, |st, i| phys.step(st, i))
-}
-
-pub(crate) const PARTICLE_TYPES: &[&str] =
-    &["Line", "Shaded Sphere", "Faded Sphere", "Bubble", "Star", "Motion Polygon", "Tri-Polygon", "Cube", "Textured Square"];
-
-/// Colour/size/opacity of a particle at its age.
-fn particle_look(q: &Particle, birth: [f32; 4], death: [f32; 4], bsize: f32, dsize: f32, svar: f32, max_op: f32) -> ([f32; 4], f32) {
-    let u = (q.age / q.life.max(1e-4)).clamp(0.0, 1.0);
-    let size = (bsize + (dsize - bsize) * u) * (1.0 + svar * (q.rnd * 2.0 - 1.0));
-    let fade = (u * 20.0).min(1.0) * ((1.0 - u) * 5.0).min(1.0);
-    let c = [birth[0] + (death[0] - birth[0]) * u, birth[1] + (death[1] - birth[1]) * u, birth[2] + (death[2] - birth[2]) * u, max_op * fade];
-    (c, size.max(0.0))
-}
-
-fn type_sprite(kind: u32, x: f32, y: f32, r: f32, c: [f32; 4], vx: f32, vy: f32, rot: f32) -> Sprite {
-    let vl = (vx * vx + vy * vy).sqrt().max(1e-6);
-    let shape = match kind {
-        0 => Shape::Line { dx: -vx / vl * r * 2.0, dy: -vy / vl * r * 2.0 },
-        1 => Shape::Sphere,
-        2 => Shape::Faded,
-        3 => Shape::Bubble,
-        4 => Shape::Star,
-        5 => Shape::Line { dx: -vx * 0.05, dy: -vy * 0.05 },
-        6 => Shape::Tri,
-        _ => Shape::Square,
-    };
-    let rr = match kind {
-        0 => (r * 0.08).max(0.5),
-        5 => r * 0.5,
-        _ => r,
-    };
-    Sprite { x, y, r: rr, c, shape, rot }
-}
-
-// ------------------------------------------------------------------ CC Particle World
-
-static PW_CACHE: SimCache<PState> = SimCache::new(6);
-
-/// CC Particle World's physics.
-fn pw_phys(ctx: &EffectCtx) -> Phys {
-    let pr = ctx.params;
-    Phys {
-        rate: pr.f("birthRate").max(0.0) * 120.0,
-        life: pr.f("longevity").max(0.0) as f32,
-        producer: [pr.f("producer/producerX") as f32, pr.f("producer/producerY") as f32, pr.f("producer/producerZ") as f32],
-        radius: [pr.f("producer/radiusX").max(0.0) as f32, pr.f("producer/radiusY").max(0.0) as f32, pr.f("producer/radiusZ").max(0.0) as f32],
-        anim: pr.e("physics/animation"),
-        speed: pr.f("physics/velocity") as f32 * 0.5,
-        gravity: {
-            let g = pr.f("physics/gravity") as f32;
-            let gv =
-                [pr.f("physics/gravityVector/gravityX") as f32, pr.f("physics/gravityVector/gravityY") as f32, pr.f("physics/gravityVector/gravityZ") as f32];
-            [gv[0] * g, gv[1] * g, gv[2] * g]
-        },
-        resistance: pr.f("physics/resistance").max(0.0) as f32,
-        axis: [pr.f("physics/directionAxis/axisX") as f32, pr.f("physics/directionAxis/axisY") as f32, pr.f("physics/directionAxis/axisZ") as f32],
-        extra: pr.f("physics/extra") as f32,
-        extra_angle: pr.f("physics/extraAngle") as f32,
-        seed: (pr.f("extras/randomSeed") as u32).wrapping_mul(0x9e3779b9) ^ ctx.seed,
-        max: 40_000,
-        flat: false,
-    }
-}
-
-fn particle_world(ctx: &EffectCtx, b: Buf) -> Buf {
-    // #1195: with the comp's motion-blur shutter open, particles draw as motion trails: the
-    // sprite fields of samples across the shutter are averaged, as Transform averages its
-    // matrix samples. (The GPU compositor runs this case on the CPU: catalog::gpu_supported.)
-    if let Some((angle, phase, n)) = ctx.env.shutter.filter(|(a, _, _)| *a > 0.0) {
-        let n = (n.clamp(2, 64) as usize).max(2);
-        let fd = 1.0 / ctx.fps().max(0.001);
-        let mut acc = Image::new(b.img.width, b.img.height);
-        let mut post: Option<Post> = None;
-        for k in 0..n {
-            let t = ctx.time + (phase + angle * k as f64 / (n - 1) as f64) / 360.0 * fd;
-            let sub = EffectCtx { params: ctx.params, time: t, layer_size: ctx.layer_size, seed: ctx.seed, adjustment: ctx.adjustment, env: ctx.env };
-            if let Some(plan) = particle_world_plan(&sub, &b) {
-                let fx = splat(b.img.width, b.img.height, &plan.sprites, plan.acc);
-                acc.data.iter_mut().zip(&fx.data).for_each(|(a, o)| (0..4).for_each(|c| a[c] += o[c]));
-                post.get_or_insert(plan.post);
-            }
-        }
-        acc.data.iter_mut().for_each(|p| p.iter_mut().for_each(|v| *v /= n as f32));
-        return match post {
-            Some(p) => p.apply(b, acc),
-            None => b,
-        };
-    }
-    match particle_world_plan(ctx, &b) {
-        Some(plan) => plan.finish(b),
-        None => b,
-    }
-}
-
-/// CC Particle World's Extras ▸ Effect Camera parameters (id prefix).
-const PW_EFFECT_CAMERA: &str = "extras/effectCamera/";
-/// Effect Camera ▸ FOV's default (degrees).
-const PW_FOV: f64 = 50.0;
-
-/// What CC Particle World sees its particles through.
-enum PwCamera {
-    /// Extras ▸ Effect Camera, in world units (layer widths): `dist` from the world origin (the
-    /// layer centre) along −z, the world turned by `rot` (`None` = not turned) about the origin,
-    /// `focal` the scale at unit depth; particles nearer than `near` aren't drawn.
-    Effect { rot: Option<[[f32; 3]; 3]>, dist: f32, focal: f32, near: f32 },
-    /// The comp's active camera layer, on buffer-world points (After Effects then ignores the
-    /// Effect Camera).
-    Comp(crate::card3d::Proj),
-}
-
-/// A particle as the camera sees it: depth (larger is farther), buffer pixel, size scale `k`
-/// (buffer pixels per world unit = `k · layer width · buffer scale`) and velocity in world units
-/// on screen (× the same factor for buffer pixels).
-struct PwSeen {
-    depth: f32,
-    x: f32,
-    y: f32,
-    k: f32,
-    v: [f32; 2],
-}
-
-impl PwCamera {
-    fn new(ctx: &EffectCtx, b: &Buf) -> PwCamera {
-        let [lw, lh] = ctx.layer_size;
-        if let Some(cam) = ctx.env.host.and_then(|h| h.comp_scene()).filter(|sc| sc.camera_layer).and_then(|sc| sc.camera) {
-            let c = [b.offset[0] + lw * 0.5 * b.scale, b.offset[1] + lh * 0.5 * b.scale];
-            return PwCamera::Comp(crate::card3d::comp_proj(&cam, c, b));
-        }
-        let f = |id: &str, d: f64| ctx.params.get(&format!("{PW_EFFECT_CAMERA}{id}")).map(Value::as_f64).filter(|v| v.is_finite()).unwrap_or(d);
-        // The camera keeps the origin's plane at the scale Distance gives it as FOV changes
-        // (moving in for a wider view), so FOV sets how strong the perspective is. Distance 2
-        // shows the origin's plane at the layer's own scale.
-        let half = |fov: f64| (fov.clamp(1.0, 179.0).to_radians() * 0.5).tan();
-        let zoom = half(PW_FOV) / half(f("fov", PW_FOV));
-        let dist = f("distance", 2.0).max(0.01) * zoom;
-        let a = [f("rotationX", 0.0), f("rotationY", 0.0), f("rotationZ", 0.0)];
-        let rot = (a != [0.0; 3]).then(|| {
-            let r = crate::card3d::rot_ordered(a[0].to_radians(), a[1].to_radians(), a[2].to_radians(), 0);
-            r.map(|row| row.map(|v| v as f32))
-        });
-        PwCamera::Effect { rot, dist: dist as f32, focal: (2.0 * zoom) as f32, near: (0.025 * dist) as f32 }
-    }
-
-    /// How the camera sees world point `p` moving at `v`; `None` behind or too close to it.
-    fn see(&self, p: [f32; 3], v: [f32; 3], lw: f32, lh: f32, b: &Buf) -> Option<PwSeen> {
-        match self {
-            PwCamera::Effect { rot, dist, focal, near } => {
-                let turn = |r: &[[f32; 3]; 3], q: [f32; 3]| r.map(|row| row[0] * q[0] + row[1] * q[1] + row[2] * q[2]);
-                let (p, v) = match rot {
-                    Some(r) => (turn(r, p), turn(r, v)),
-                    None => (p, v),
-                };
-                let zc = dist + p[2];
-                if zc.is_nan() || zc <= *near {
-                    return None;
-                }
-                let k = focal / zc;
-                let (x, y) = b.to_px([(lw * 0.5 + p[0] * lw * k) as f64, (lh * 0.5 + p[1] * lw * k) as f64]);
-                Some(PwSeen { depth: zc, x: x as f32, y: y as f32, k, v: [v[0], v[1]] })
-            }
-            PwCamera::Comp(proj) => {
-                let (s, lw, lh) = (b.scale, lw as f64, lh as f64);
-                let u = lw * s;
-                let at = [b.offset[0] + lw * 0.5 * s + p[0] as f64 * u, b.offset[1] + lh * 0.5 * s + p[1] as f64 * u, p[2] as f64 * u];
-                let seen = proj.view(at, [v[0] as f64, v[1] as f64, v[2] as f64])?;
-                let k = seen.scale;
-                Some(PwSeen {
-                    depth: seen.depth as f32,
-                    x: seen.at[0] as f32,
-                    y: seen.at[1] as f32,
-                    k: k as f32,
-                    v: [(seen.vel[0] / k) as f32, (seen.vel[1] / k) as f32],
-                })
-            }
-        }
-    }
-}
-
-/// CC Particle World's sprites (far to near), `None` before anything is born.
-fn particle_world_plan(ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
-    let pr = ctx.params;
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let phys = pw_phys(ctx);
-    if phys.rate <= 0.0 && ctx.time <= 0.0 {
-        return None;
-    }
-    let key = sim_key(ctx, 1);
-    let st = accelerated(ctx, key, &phys).unwrap_or_else(|| simulate(&PW_CACHE, key, ctx.time, &phys));
-    let kind = pr.e("particle/particleType");
-    let birth = pr.color("particle/birthColor");
-    let death = pr.color("particle/deathColor");
-    let (bs, ds) = (pr.f("particle/birthSize") as f32, pr.f("particle/deathSize") as f32);
-    let svar = pr.f("particle/sizeVariation") as f32 / 100.0;
-    let max_op = pr.f("particle/maxOpacity") as f32 / 100.0;
-    let s = b.scale as f32;
-    let cam = PwCamera::new(ctx, b);
-    let mut list: Vec<(f32, Sprite)> = st
-        .parts
-        .par_iter()
-        .filter_map(|q| {
-            let PwSeen { depth, x, y, k, v } = cam.see(q.p, q.v, lw, lh, b)?;
-            let (c, size) = particle_look(q, birth, death, bs, ds, svar, max_op);
-            let r = size * 0.5 * lw * k * s * 0.25;
-            let sp = type_sprite(kind, x, y, r, c, v[0] * lw * k * s, v[1] * lw * k * s, (q.id % 628) as f32 * 0.01 + q.age * 2.0);
-            Some((depth, sp))
-        })
-        .collect();
-    list.sort_by(|a, b| b.0.total_cmp(&a.0));
-    let sprites: Vec<Sprite> = list.into_iter().map(|(_, s)| s).collect();
-    Some(particle_sprites(sprites, pr.e("particle/transferMode")))
-}
-
-/// The CC particle systems' sprites with their Transfer Mode (Composite, Screen, Add, Black
-/// Background).
-fn particle_sprites(sprites: Vec<Sprite>, mode: u32) -> SpritePlan {
-    // The particles replace the layer (After Effects shows no trace of the source in any
-    // Transfer Mode, which sets how the particles meet each other).
-    SpritePlan { sprites, tints: vec![], acc: if mode == 2 { Acc::Add } else { Acc::Over }, post: Post::Replace }
-}
-
-// ------------------------------------------------------------------ CC Particle Systems II
-
-static PS2_CACHE: SimCache<PState> = SimCache::new(6);
-
-/// CC Particle Systems II's physics.
-fn ps2_phys(ctx: &EffectCtx) -> Phys {
-    let pr = ctx.params;
-    let lh = ctx.layer_size[1] as f32;
-    let unit = lh.max(1.0);
-    let pos = pr.v2("producer/position");
-    let dir = (pr.f("physics/direction") as f32).to_radians();
-    Phys {
-        rate: pr.f("birthRate").max(0.0) * 60.0,
-        life: pr.f("longevity").max(0.0) as f32,
-        producer: [pos[0] as f32 / unit, pos[1] as f32 / unit, 0.0],
-        radius: [pr.f("producer/radiusX").max(0.0) as f32 / unit, pr.f("producer/radiusY").max(0.0) as f32 / unit, 0.0],
-        anim: [0u32, 1, 2, 3, 4, 5, 6, 7, 8, 9][pr.e("physics/animation").min(9) as usize],
-        speed: pr.f("physics/velocity") as f32 * 0.25,
-        gravity: [0.0, pr.f("physics/gravity") as f32 * 0.5, 0.0],
-        resistance: pr.f("physics/resistance").max(0.0) as f32,
-        // AE angles: 0° = up, clockwise.
-        axis: [dir.sin(), -dir.cos(), 0.0],
-        extra: pr.f("physics/extra") as f32,
-        extra_angle: 45.0 * pr.f("physics/extra") as f32,
-        seed: (pr.f("randomSeed") as u32).wrapping_mul(0x85ebca6b) ^ ctx.seed,
-        max: 40_000,
-        flat: true,
-    }
-}
-
-fn particle_systems2(ctx: &EffectCtx, b: Buf) -> Buf {
-    particle_systems2_plan(ctx, &b).finish(b)
-}
-
-/// CC Particle Systems II's sprites.
-fn particle_systems2_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
-    let pr = ctx.params;
-    let lh = ctx.layer_size[1] as f32;
-    let unit = lh.max(1.0);
-    let phys = ps2_phys(ctx);
-    let key = sim_key(ctx, 2);
-    let st = accelerated(ctx, key, &phys).unwrap_or_else(|| simulate(&PS2_CACHE, key, ctx.time, &phys));
-    let kind = pr.e("particle/particleType");
-    let birth = pr.color("particle/birthColor");
-    let death = pr.color("particle/deathColor");
-    let (bs, ds) = (pr.f("particle/birthSize") as f32, pr.f("particle/deathSize") as f32);
-    let svar = pr.f("particle/sizeVariation") as f32 / 100.0;
-    let max_op = pr.f("particle/maxOpacity") as f32 / 100.0;
-    let s = b.scale as f32;
-    let sprites: Vec<Sprite> = st
-        .parts
-        .iter()
-        .map(|q| {
-            let (bx, by) = b.to_px([(q.p[0] * unit) as f64, (q.p[1] * unit) as f64]);
-            let (c, size) = particle_look(q, birth, death, bs, ds, svar, max_op);
-            let r = size * unit * 0.02 * s;
-            type_sprite(kind, bx as f32, by as f32, r, c, q.v[0] * unit * s, q.v[1] * unit * s, (q.id % 628) as f32 * 0.01 + q.age * 2.0)
-        })
-        .collect();
-    particle_sprites(sprites, pr.e("particle/transferMode"))
-}
-
-// ------------------------------------------------------------------ CC Mr. Mercury
-
-static MERCURY_CACHE: SimCache<PState> = SimCache::new(6);
-
-/// A CC Mr. Mercury blob (buffer px).
-#[derive(Clone, Copy, Debug)]
-pub struct Blob {
-    pub x: f32,
-    pub y: f32,
-    pub r: f32,
-}
-
-/// CC Mr. Mercury's blobs this frame, from its particle simulation (for buffer geometry `b`).
-pub fn mercury_blobs(ctx: &EffectCtx, b: &Buf) -> Vec<Blob> {
-    let pr = ctx.params;
-    let lh = ctx.layer_size[1] as f32;
-    let unit = lh.max(1.0);
-    let pos = pr.v2("producer");
-    let dir = (pr.f("direction") as f32).to_radians();
-    let phys = Phys {
-        rate: pr.f("birthRate").max(0.0) * 10.0,
-        life: pr.f("longevity").max(0.0) as f32,
-        producer: [pos[0] as f32 / unit, pos[1] as f32 / unit, 0.0],
-        radius: [pr.f("radiusX").max(0.0) as f32 / unit, pr.f("radiusY").max(0.0) as f32 / unit, 0.0],
-        anim: [0u32, 1, 2, 3, 4, 5, 6, 7, 8, 9][pr.e("animation").min(9) as usize],
-        speed: pr.f("velocity") as f32 * 0.3,
-        gravity: [0.0, pr.f("gravity") as f32 * 0.5, 0.0],
-        resistance: pr.f("resistance").max(0.0) as f32,
-        axis: [dir.sin(), -dir.cos(), 0.0],
-        extra: pr.f("extra") as f32,
-        extra_angle: 45.0 * pr.f("extra") as f32,
-        seed: ctx.seed.wrapping_mul(0xc2b2ae35),
-        max: 4_000,
-        flat: true,
-    };
-    let st = simulate(&MERCURY_CACHE, params_key(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, 3), ctx.time, &phys);
-    let (bs, ds) = (pr.f("blobBirthSize") as f32, pr.f("blobDeathSize") as f32);
-    let s = b.scale as f32;
-    st.parts
-        .iter()
-        .map(|q| {
-            let u = (q.age / q.life.max(1e-4)).clamp(0.0, 1.0);
-            let size = bs + (ds - bs) * u;
-            let (bx, by) = b.to_px([(q.p[0] * unit) as f64, (q.p[1] * unit) as f64]);
-            Blob { x: bx as f32, y: by as f32, r: (size * unit * 0.08 * s).max(0.0) }
-        })
-        .filter(|q| q.r > 0.1)
-        .collect()
-}
-
-fn mr_mercury(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let pr = ctx.params;
-    let blobs = mercury_blobs(ctx, &b);
-    let influence = pr.f("blobInfluence") as f32 / 100.0;
-    let s = b.scale as f32;
-    let (w, hh) = (b.img.width, b.img.height);
-    // Field and gradient accumulate additively: [f, gx, gy, _].
-    let mut field = Image::new(w, hh);
-    let infl = 1.0 + influence;
-    raster(
-        &mut field,
-        &blobs,
-        |q| {
-            let e = q.r * 2.0 * infl;
-            Some([q.x - e, q.y - e, q.x + e, q.y + e])
-        },
-        |q, x, y| {
-            let (dx, dy) = (x - q.x, y - q.y);
-            let rr = q.r * 2.0 * infl;
-            let d2 = (dx * dx + dy * dy) / (rr * rr);
-            if d2 >= 1.0 {
-                return None;
-            }
-            let k = 1.0 - d2;
-            let f = k * k * k;
-            let g = -6.0 * k * k / (rr * rr);
-            Some([f, g * dx, g * dy, 0.0])
-        },
-        Acc::Add,
-    );
-    let thr = 0.35f32;
-    let ambient = pr.f("shading/ambient") as f32 / 100.0;
-    let diffuse = pr.f("shading/diffuse") as f32 / 100.0;
-    let specular = pr.f("shading/specular") as f32 / 100.0;
-    let rough = pr.f("shading/roughness").max(0.001) as f32;
-    let metal = pr.f("shading/metal") as f32 / 100.0;
-    let li = pr.f("light/lightIntensity") as f32 / 100.0;
-    let lc = pr.color("light/lightColor");
-    let ldir = (pr.f("light/lightDirection") as f32).to_radians();
-    let lheight = pr.f("light/lightHeight") as f32 / 100.0;
-    let l = norm3([ldir.sin(), -ldir.cos(), lheight.max(0.05)]);
-    let src = b.img.clone();
-    let mut out = Image::new(w, hh);
-    out.rows_mut().for_each(|(y, row)| {
-        for (x, px) in row.iter_mut().enumerate() {
-            let fv = field.data[y * w as usize + x];
-            let f = fv[0];
-            if f <= thr * 0.8 {
-                continue;
-            }
-            let cov = ((f - thr * 0.8) / (thr * 0.4)).clamp(0.0, 1.0);
-            let n = norm3([fv[1] * 3.0, fv[2] * 3.0, 1.0 / (1.0 + f)]);
-            // Refract the layer through the blob.
-            let sp = src.sample_bilinear_clamped(x as f64 + 0.5 - n[0] as f64 * 12.0 * s as f64, y as f64 + 0.5 - n[1] as f64 * 12.0 * s as f64);
-            let (c, sa) = unpremul(sp);
-            let base = if sa > 0.0 { c } else { [0.7, 0.7, 0.75] };
-            let nl = (n[0] * l[0] + n[1] * l[1] + n[2] * l[2]).max(0.0);
-            let hv = norm3([l[0], l[1], l[2] + 1.0]);
-            let spec = (n[0] * hv[0] + n[1] * hv[1] + n[2] * hv[2]).max(0.0).powf(1.0 / rough) * specular * li;
-            let shade = ambient + diffuse * nl * li;
-            let cc: [f32; 3] = std::array::from_fn(|k| base[k] * shade + spec * (lc[k] * (1.0 - metal) + base[k] * metal));
-            *px = [cc[0] * cov, cc[1] * cov, cc[2] * cov, cov];
-        }
-    });
-    b.img = out;
-    b
-}
-
-// ------------------------------------------------------------------ specs
-
-pub fn specs() -> Vec<EffectSpec> {
-    let transfer = || popup(&["Composite", "Lighten"]);
-    vec![
-        spec(
-            "ec.sim.ccrainfall",
-            "CC Rainfall",
-            vec![
-                p("drops", "Drops", num(5000.0), slider(0.0, 100_000.0, 0.0, 20_000.0, 0)),
-                p("size", "Size", num(1.0), slider(0.0, 50.0, 0.0, 10.0, 2)),
-                p("sceneDepth", "Scene Depth", num(5000.0), slider(0.0, 20_000.0, 0.0, 10_000.0, 0)),
-                p("speed", "Speed", num(4000.0), slider(0.0, 20_000.0, 0.0, 10_000.0, 0)),
-                p("wind", "Wind", num(0.0), slider(-10_000.0, 10_000.0, -2000.0, 2000.0, 1)),
-                p("windVariation", "Variation % (Wind)", num(0.0), pct()),
-                p("spread", "Spread", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
-                p("color", "Color", col(0.8, 0.8, 0.8), ParamUi::Color),
-                p("opacity", "Opacity", num(25.0), pct()),
-                p("transferMode", "Transfer Mode", Value::Enum(1), transfer()),
-                p("compositeWithOriginal", "Composite With Original", Value::Bool(true), ParamUi::Checkbox),
-                p("extras/appearance", "Appearance", Value::Enum(0), popup(&["Refracting", "Soft Solid"])),
-                p("extras/offset", "Offset", pt(0.5, 0.5), ParamUi::Point),
-                p("extras/randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
-            ],
-            rainfall,
-        ),
-        spec(
-            "ec.sim.ccsnowfall",
-            "CC Snowfall",
-            vec![
-                p("flakes", "Flakes", num(10_000.0), slider(0.0, 200_000.0, 0.0, 50_000.0, 0)),
-                p("size", "Size", num(3.0), slider(0.0, 50.0, 0.0, 20.0, 2)),
-                p("sizeVariation", "Variation % (Size)", num(50.0), pct()),
-                p("sceneDepth", "Scene Depth", num(5000.0), slider(0.0, 20_000.0, 0.0, 10_000.0, 0)),
-                p("speed", "Speed", num(100.0), slider(0.0, 5000.0, 0.0, 1000.0, 1)),
-                p("speedVariation", "Variation % (Speed)", num(50.0), pct()),
-                p("wind", "Wind", num(25.0), slider(-5000.0, 5000.0, -500.0, 500.0, 1)),
-                p("windVariation", "Variation % (Wind)", num(50.0), pct()),
-                p("spread", "Spread", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
-                p("wiggle/wiggleAmount", "Amount", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
-                p("wiggle/wiggleAmountVariation", "Variation % (Amount)", num(50.0), pct()),
-                p("wiggle/wiggleFrequency", "Frequency", num(1.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("wiggle/wiggleFrequencyVariation", "Variation % (Frequency)", num(50.0), pct()),
-                p("color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("opacity", "Opacity", num(100.0), pct()),
-                p("transferMode", "Transfer Mode", Value::Enum(0), transfer()),
-                p("compositeWithOriginal", "Composite With Original", Value::Bool(true), ParamUi::Checkbox),
-                p("extras/offset", "Offset", pt(0.5, 0.5), ParamUi::Point),
-                p("extras/randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
-            ],
-            snowfall,
-        ),
-        spec(
-            "ec.sim.ccbubbles",
-            "CC Bubbles",
-            vec![
-                p("bubbleAmount", "Bubble Amount", num(100.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
-                p("bubbleSpeed", "Bubble Speed", num(0.5), slider(-10.0, 10.0, -2.0, 2.0, 2)),
-                p("wobbleAmplitude", "Wobble Amplitude", num(5.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
-                p("wobbleFrequency", "Wobble Frequency", num(1.0), slider(0.0, 50.0, 0.0, 10.0, 2)),
-                p("bubbleSize", "Bubble Size", num(1.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("reflectionType", "Reflection Type", Value::Enum(0), popup(&["Liquid", "Metal"])),
-                p("shadingType", "Shading Type", Value::Enum(0), popup(&["None", "Lighten", "Darken", "Fade Inwards", "Fade Outwards"])),
-            ],
-            bubbles,
-        ),
-        spec(
-            "ec.sim.ccdrizzle",
-            "CC Drizzle",
-            vec![
-                p("dripRate", "Drip Rate", num(10.0), slider(0.0, 200.0, 0.0, 50.0, 2)),
-                p("longevity", "Longevity (sec)", num(1.0), slider(0.0, 30.0, 0.0, 5.0, 2)),
-                p("rippling", "Rippling", num(360.0), ParamUi::Angle),
-                p("displacement", "Displacement", num(5.0), slider(0.0, 100.0, 0.0, 30.0, 2)),
-                p("rippleHeight", "Ripple Height", num(30.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("spreading", "Spreading", num(100.0), slider(0.0, 1000.0, 0.0, 300.0, 1)),
-                p("light/lightIntensity", "Light Intensity", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
-                p("light/lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("light/lightHeight", "Light Height", num(25.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
-                p("light/lightDirection", "Light Direction", num(-45.0), ParamUi::Angle),
-                p("shading/ambient", "Ambient", num(0.0), slider(-200.0, 200.0, -100.0, 100.0, 1)),
-                p("shading/diffuse", "Diffuse", num(0.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("shading/specular", "Specular", num(20.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("shading/roughness", "Roughness", num(0.05), slider(0.001, 1.0, 0.001, 0.5, 3)),
-            ],
-            drizzle,
-        ),
-        spec(
-            "ec.sim.ccstarburst",
-            "CC Star Burst",
-            vec![
-                p("scatter", "Scatter", num(100.0), slider(0.0, 1000.0, 0.0, 300.0, 1)),
-                p("speed", "Speed", num(1.0), slider(-10.0, 10.0, -4.0, 4.0, 2)),
-                p("phase", "Phase", num(0.0), ParamUi::Angle),
-                p("gridSpacing", "Grid Spacing", num(2.0), slider(1.0, 100.0, 1.0, 20.0, 0)),
-                p("size", "Size", num(100.0), slider(0.0, 1000.0, 0.0, 300.0, 1)),
-                p("blendWithOriginal", "Blend w. Original", num(0.0), pct()),
-            ],
-            star_burst,
-        ),
-        spec(
-            "ec.sim.ccparticleworld",
-            "CC Particle World",
-            vec![
-                p("birthRate", "Birth Rate", num(0.5), slider(0.0, 100.0, 0.0, 10.0, 2)),
-                p("longevity", "Longevity (sec)", num(1.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
-                p("producer/producerX", "Position X", num(0.0), slider(-10.0, 10.0, -1.0, 1.0, 2)),
-                p("producer/producerY", "Position Y", num(0.0), slider(-10.0, 10.0, -1.0, 1.0, 2)),
-                p("producer/producerZ", "Position Z", num(0.0), slider(-10.0, 10.0, -1.0, 1.0, 2)),
-                p("producer/radiusX", "Radius X", num(0.025), slider(0.0, 10.0, 0.0, 1.0, 3)),
-                p("producer/radiusY", "Radius Y", num(0.025), slider(0.0, 10.0, 0.0, 1.0, 3)),
-                p("producer/radiusZ", "Radius Z", num(0.025), slider(0.0, 10.0, 0.0, 1.0, 3)),
-                p("physics/animation", "Animation", Value::Enum(0), popup(PW_ANIMS)),
-                p("physics/velocity", "Velocity", num(1.0), slider(-10.0, 10.0, 0.0, 5.0, 2)),
-                p("physics/inheritVelocity", "Inherit Velocity %", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
-                p("physics/gravity", "Gravity", num(0.5), slider(-10.0, 10.0, -2.0, 2.0, 3)),
-                p("physics/resistance", "Resistance", num(0.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("physics/extra", "Extra", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 2)),
-                p("physics/extraAngle", "Extra Angle", num(360.0), ParamUi::Angle),
-                p("physics/directionAxis/axisX", "Axis X", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
-                p("physics/directionAxis/axisY", "Axis Y", num(-1.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
-                p("physics/directionAxis/axisZ", "Axis Z", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
-                p("physics/gravityVector/gravityX", "Gravity X", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
-                p("physics/gravityVector/gravityY", "Gravity Y", num(1.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
-                p("physics/gravityVector/gravityZ", "Gravity Z", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
-                p("particle/particleType", "Particle Type", Value::Enum(0), popup(PARTICLE_TYPES)),
-                p("particle/birthSize", "Birth Size", num(0.2), slider(0.0, 10.0, 0.0, 1.0, 3)),
-                p("particle/deathSize", "Death Size", num(0.2), slider(0.0, 10.0, 0.0, 1.0, 3)),
-                p("particle/sizeVariation", "Size Variation", num(0.0), pct()),
-                p("particle/maxOpacity", "Max Opacity", num(75.0), pct()),
-                p("particle/birthColor", "Birth Color", col(1.0, 1.0, 0.0), ParamUi::Color),
-                p("particle/deathColor", "Death Color", col(0.6, 0.0, 0.0), ParamUi::Color),
-                p("particle/transferMode", "Transfer Mode", Value::Enum(0), popup(&["Composite", "Screen", "Add", "Black Matte"])),
-                p("extras/effectCamera/distance", "Distance", num(2.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
-                p("extras/effectCamera/rotationX", "Rotation X", num(0.0), ParamUi::Angle),
-                p("extras/effectCamera/rotationY", "Rotation Y", num(0.0), ParamUi::Angle),
-                p("extras/effectCamera/rotationZ", "Rotation Z", num(0.0), ParamUi::Angle),
-                p("extras/effectCamera/fov", "FOV", num(PW_FOV), slider(1.0, 179.0, 10.0, 120.0, 1)),
-                p("extras/randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
-            ],
-            particle_world,
-        ),
-        spec(
-            "ec.sim.ccparticlesystems2",
-            "CC Particle Systems II",
-            vec![
-                p("birthRate", "Birth Rate", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
-                p("longevity", "Longevity (sec)", num(1.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
-                p("producer/position", "Position", pt(0.5, 0.5), ParamUi::Point),
-                p("producer/radiusX", "Radius X", num(0.0), slider(0.0, 2000.0, 0.0, 200.0, 1)),
-                p("producer/radiusY", "Radius Y", num(0.0), slider(0.0, 2000.0, 0.0, 200.0, 1)),
-                p("physics/animation", "Animation", Value::Enum(0), popup(PW_ANIMS)),
-                p("physics/velocity", "Velocity", num(2.0), slider(-20.0, 20.0, 0.0, 10.0, 2)),
-                p("physics/inheritVelocity", "Inherit Velocity %", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
-                p("physics/gravity", "Gravity", num(1.0), slider(-20.0, 20.0, -5.0, 5.0, 2)),
-                p("physics/resistance", "Resistance", num(0.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("physics/direction", "Direction", num(0.0), ParamUi::Angle),
-                p("physics/extra", "Extra", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 2)),
-                p("particle/particleType", "Particle Type", Value::Enum(0), popup(PARTICLE_TYPES)),
-                p("particle/birthSize", "Birth Size", num(0.5), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("particle/deathSize", "Death Size", num(1.5), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("particle/sizeVariation", "Size Variation", num(0.0), pct()),
-                p("particle/maxOpacity", "Max Opacity", num(75.0), pct()),
-                p("particle/birthColor", "Birth Color", col(1.0, 1.0, 0.0), ParamUi::Color),
-                p("particle/deathColor", "Death Color", col(0.6, 0.0, 0.0), ParamUi::Color),
-                p("particle/transferMode", "Transfer Mode", Value::Enum(0), popup(&["Composite", "Screen", "Add", "Black Matte"])),
-                p("randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
-            ],
-            particle_systems2,
-        ),
-        spec(
-            "ec.sim.ccmrmercury",
-            "CC Mr. Mercury",
-            vec![
-                p("radiusX", "Radius X", num(50.0), slider(0.0, 2000.0, 0.0, 300.0, 1)),
-                p("radiusY", "Radius Y", num(50.0), slider(0.0, 2000.0, 0.0, 300.0, 1)),
-                p("producer", "Producer", pt(0.5, 0.5), ParamUi::Point),
-                p("direction", "Direction", num(0.0), ParamUi::Angle),
-                p("velocity", "Velocity", num(1.0), slider(-20.0, 20.0, 0.0, 5.0, 2)),
-                p("birthRate", "Birth Rate", num(1.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("longevity", "Longevity (sec)", num(2.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
-                p("gravity", "Gravity", num(0.5), slider(-20.0, 20.0, -5.0, 5.0, 2)),
-                p("resistance", "Resistance", num(0.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
-                p("extra", "Extra", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 2)),
-                p("animation", "Animation", Value::Enum(0), popup(PW_ANIMS)),
-                p("blobInfluence", "Blob Influence", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
-                p("blobBirthSize", "Blob Birth Size", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 2)),
-                p("blobDeathSize", "Blob Death Size", num(0.25), slider(0.0, 10.0, 0.0, 2.0, 2)),
-                p("light/lightIntensity", "Light Intensity", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
-                p("light/lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("light/lightHeight", "Light Height", num(50.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
-                p("light/lightDirection", "Light Direction", num(-45.0), ParamUi::Angle),
-                p("shading/ambient", "Ambient", num(0.0), slider(-200.0, 200.0, -100.0, 100.0, 1)),
-                p("shading/diffuse", "Diffuse", num(75.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("shading/specular", "Specular", num(50.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
-                p("shading/roughness", "Roughness", num(0.05), slider(0.001, 1.0, 0.001, 0.5, 3)),
-                p("shading/metal", "Metal", num(100.0), pct()),
-            ],
-            mr_mercury,
-        ),
-    ]
-}
+mod common;
+mod engine;
+mod particle_fx;
+mod registry;
+mod sprites;
+mod weather;
+
+pub(crate) use common::{h, hs, pct, pt, spec};
+pub use engine::particle_state;
+#[cfg(test)]
+use engine::{MERCURY, PS2, PW_EFFECT_CAMERA, Stepped, rate_history, sim_key, simulate_rates};
+#[cfg(test)]
+pub(crate) use engine::{PState, PW_ANIMS, Phys, simulate};
+pub(crate) use engine::{SPS, steps_at};
+pub(crate) use particle_fx::particle_world_textured;
+pub use particle_fx::{Blob, mercury_blobs};
+#[cfg(test)]
+use particle_fx::{PW_RATE, mercury_phys, ps2_phys, pw_phys};
+pub use registry::{specs, sprite_plan};
+pub use sprites::{Acc, Post, Shape, Sprite, SpritePlan, Tint};
+pub(crate) use sprites::{combine, raster, splat};
+pub use weather::{Bubble, bubble_list, bubble_sample_bounds, drizzle_drops};
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, run_fx};
-
-    fn grey(w: u32, hh: u32) -> Image {
-        Image::filled(w, hh, [0.2, 0.2, 0.2, 1.0])
-    }
-
-    fn ramp(w: u32, hh: u32) -> Image {
-        let mut img = Image::new(w, hh);
-        for y in 0..hh {
-            for x in 0..w {
-                img.set(x, y, [x as f32 / w as f32, y as f32 / hh as f32, 0.4, 1.0]);
-            }
-        }
-        img
-    }
-
-    fn run(id: &str, vals: &[(&str, Value)], img: Image, t: f64) -> Image {
-        run_fx(id, vals, img, t, EffectEnv::default()).img
-    }
-
-    fn diff(a: &Image, b: &Image) -> f32 {
-        a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|k| (p[k] - q[k]).abs()).sum::<f32>()).sum()
-    }
-
-    /// Centre of mass (luminance-weighted difference from `base`), `[-1, -1]` when equal.
-    fn mass(img: &Image, base: &Image) -> [f32; 2] {
-        let (mut m, mut sx, mut sy) = (0.0, 0.0, 0.0);
-        for y in 0..img.height {
-            for x in 0..img.width {
-                let i = img.idx(x, y);
-                let d: f32 = (0..3).map(|k| (img.data[i][k] - base.data[i][k]).abs()).sum();
-                m += d;
-                sx += d * x as f32;
-                sy += d * y as f32;
-            }
-        }
-        if m > 0.0 { [sx / m, sy / m] } else { [-1.0; 2] }
-    }
-
-    /// [`mass`] in y.
-    fn mass_y(img: &Image, base: &Image) -> f32 {
-        mass(img, base)[1]
-    }
-
-    #[test]
-    fn rasteriser_over_and_add() {
-        let s = [Sprite::new(5.0, 5.0, 2.0, [1.0, 0.0, 0.0, 1.0], Shape::Disc)];
-        let img = splat(10, 40, &s, Acc::Over);
-        assert!(img.get(5, 5)[0] > 0.99 && img.get(9, 30)[3] == 0.0);
-        let two = [s[0], s[0]];
-        let add = splat(10, 40, &two, Acc::Add);
-        assert!(add.get(5, 5)[0] > 1.9);
-        // Items spanning band boundaries are drawn in every band.
-        let tall = [Sprite::new(5.0, 16.0, 6.0, [0.0, 1.0, 0.0, 1.0], Shape::Square)];
-        let t = splat(10, 40, &tall, Acc::Over);
-        assert!(t.get(5, 13)[1] > 0.9 && t.get(5, 18)[1] > 0.9);
-    }
-
-    #[test]
-    fn rainfall_deterministic_and_falls() {
-        let vals = [("drops", num(200.0)), ("opacity", num(100.0)), ("extras/appearance", Value::Enum(1)), ("color", col(1.0, 1.0, 1.0))];
-        let a = run("ec.sim.ccrainfall", &vals, grey(40, 40), 0.5);
-        let b = run("ec.sim.ccrainfall", &vals, grey(40, 40), 0.5);
-        assert_eq!(a, b);
-        assert!(diff(&a, &grey(40, 40)) > 1.0, "drops visible");
-        let none = run("ec.sim.ccrainfall", &[("drops", num(0.0))], grey(40, 40), 0.5);
-        assert_eq!(none, grey(40, 40));
-        let later = run("ec.sim.ccrainfall", &vals, grey(40, 40), 0.52);
-        assert!(diff(&a, &later) > 0.1, "rain moves");
-    }
-
-    #[test]
-    fn snowfall_deterministic_and_moves() {
-        let vals = [("flakes", num(300.0))];
-        let a = run("ec.sim.ccsnowfall", &vals, grey(40, 40), 1.0);
-        assert_eq!(a, run("ec.sim.ccsnowfall", &vals, grey(40, 40), 1.0));
-        assert!(diff(&a, &grey(40, 40)) > 1.0);
-        assert!(diff(&a, &run("ec.sim.ccsnowfall", &vals, grey(40, 40), 1.2)) > 0.1);
-        let off = run("ec.sim.ccsnowfall", &[("flakes", num(300.0)), ("compositeWithOriginal", Value::Bool(false))], grey(40, 40), 1.0);
-        assert!(off.data.iter().any(|p| p[3] == 0.0), "without original the background is transparent");
-    }
-
-    #[test]
-    fn bubbles_rise() {
-        let vals = [("bubbleAmount", num(30.0)), ("bubbleSize", num(3.0))];
-        let a = run("ec.sim.ccbubbles", &vals, ramp(40, 40), 0.3);
-        assert_eq!(a, run("ec.sim.ccbubbles", &vals, ramp(40, 40), 0.3));
-        assert!(a.data.iter().any(|p| p[3] > 0.5));
-        let none = run("ec.sim.ccbubbles", &[("bubbleAmount", num(0.0))], ramp(40, 40), 0.3);
-        assert!(none.data.iter().all(|p| p[3] == 0.0), "bubbles replace the layer");
-        // A single slow bubble moves up over a short time.
-        let one = [("bubbleAmount", num(1.0)), ("bubbleSize", num(4.0)), ("wobbleAmplitude", num(0.0)), ("bubbleSpeed", num(0.2))];
-        let blank = Image::new(40, 40);
-        let y0 = mass_y(&run("ec.sim.ccbubbles", &one, ramp(40, 40), 0.0), &blank);
-        let y1 = mass_y(&run("ec.sim.ccbubbles", &one, ramp(40, 40), 0.1), &blank);
-        assert!(y0 >= 0.0 && y1 >= 0.0 && (y1 < y0 || y0 < 8.0), "{y0} -> {y1}");
-    }
-
-    #[test]
-    fn drizzle_ripples() {
-        let a = run("ec.sim.ccdrizzle", &[], ramp(48, 48), 0.6);
-        assert_eq!(a, run("ec.sim.ccdrizzle", &[], ramp(48, 48), 0.6));
-        assert!(diff(&a, &ramp(48, 48)) > 0.1);
-        let none = run("ec.sim.ccdrizzle", &[("dripRate", num(0.0))], ramp(48, 48), 0.6);
-        assert_eq!(none, ramp(48, 48));
-    }
-
-    #[test]
-    fn star_burst_moves_stars() {
-        let a = run("ec.sim.ccstarburst", &[("gridSpacing", num(4.0))], ramp(40, 40), 0.5);
-        assert_eq!(a, run("ec.sim.ccstarburst", &[("gridSpacing", num(4.0))], ramp(40, 40), 0.5));
-        assert!(a.data.iter().any(|p| p[3] > 0.0));
-        let b = run("ec.sim.ccstarburst", &[("gridSpacing", num(4.0))], ramp(40, 40), 0.9);
-        assert!(diff(&a, &b) > 0.5);
-        let full = run("ec.sim.ccstarburst", &[("blendWithOriginal", num(100.0))], ramp(40, 40), 0.5);
-        assert!(diff(&full, &ramp(40, 40)) < 1e-3);
-    }
-
-    fn pw_vals(seed: f64) -> Vec<(&'static str, Value)> {
-        vec![
-            ("birthRate", num(1.0)),
-            ("extras/randomSeed", num(seed)),
-            ("particle/particleType", Value::Enum(2)),
-            ("particle/birthSize", num(0.3)),
-            ("particle/deathSize", num(0.3)),
-        ]
-    }
-
-    /// #1195: with the comp's shutter open, the particles smear across it: the average of the
-    /// sampled sprite fields differs from the sharp frame, touches more pixels and keeps the
-    /// alpha energy.
-    #[test]
-    fn particle_world_motion_blur_trails() {
-        let v = pw_vals(21.0);
-        let blank = Image::new(40, 40);
-        let sharp = run("ec.sim.ccparticleworld", &v, blank.clone(), 2.0);
-        let blurred = crate::run_fx(
-            "ec.sim.ccparticleworld",
-            &v,
-            blank.clone(),
-            2.0,
-            EffectEnv { frame_rate: 10.0, shutter: Some((360.0, -180.0, 8)), ..Default::default() },
-        )
-        .img;
-        assert!(sharp.data.iter().any(|p| p[3] > 0.0), "sharp frame has particles");
-        assert_ne!(sharp.data, blurred.data, "the shutter smears the particles");
-        let lit = |img: &Image| img.data.iter().filter(|p| p[3] > 0.005).count();
-        let sum = |img: &Image| img.data.iter().map(|p| p[3]).sum::<f32>();
-        assert!(lit(&blurred) > lit(&sharp), "trails light more pixels: {} vs {}", lit(&blurred), lit(&sharp));
-        let (sa, ba) = (sum(&sharp), sum(&blurred));
-        assert!((ba - sa).abs() < sa * 0.6 + 1.0, "alpha energy roughly kept: {ba} vs {sa}");
-    }
-
-    #[test]
-    fn particle_world_seek_consistent() {
-        let v = pw_vals(11.0);
-        let direct = run("ec.sim.ccparticleworld", &v, Image::new(40, 40), 2.0);
-        let v2 = pw_vals(12.0);
-        let _ = run("ec.sim.ccparticleworld", &v2, Image::new(40, 40), 1.0);
-        let stepped = run("ec.sim.ccparticleworld", &v2, Image::new(40, 40), 2.0);
-        let direct2 = run("ec.sim.ccparticleworld", &v2, Image::new(40, 40), 2.0);
-        assert_eq!(stepped, direct2);
-        assert!(direct.data.iter().any(|p| p[3] > 0.0), "particles alive");
-        // Before birth nothing is drawn.
-        let t0 = run("ec.sim.ccparticleworld", &v, Image::new(40, 40), 0.0);
-        assert!(t0.data.iter().all(|p| p[3] == 0.0));
-    }
-
-    #[test]
-    fn engine_resume_equals_from_scratch() {
-        for anim in 0..PW_ANIMS.len() as u32 {
-            let phys = Phys {
-                rate: 90.0,
-                life: 1.5,
-                producer: [0.0; 3],
-                radius: [0.05; 3],
-                anim,
-                speed: 0.5,
-                gravity: [0.0, 0.5, 0.0],
-                resistance: 0.2,
-                axis: [0.0, -1.0, 0.0],
-                extra: 1.0,
-                extra_angle: 60.0,
-                seed: 9,
-                max: 10_000,
-                flat: anim % 2 == 0,
-            };
-            let a: SimCache<PState> = SimCache::new(2);
-            let b: SimCache<PState> = SimCache::new(2);
-            let direct = simulate(&a, 1, 2.0, &phys);
-            let _ = simulate(&b, 1, 1.0, &phys);
-            let _ = simulate(&b, 1, 0.37, &phys);
-            let resumed = simulate(&b, 1, 2.0, &phys);
-            assert_eq!(direct.parts.len(), resumed.parts.len(), "anim {anim}");
-            assert!(direct.parts.iter().zip(&resumed.parts).all(|(p, q)| p.p == q.p && p.v == q.v && p.id == q.id), "anim {anim}");
-            assert!(!direct.parts.is_empty());
-        }
-    }
-
-    #[test]
-    fn particle_world_gravity_pulls_down() {
-        let base = |g: f64| {
-            vec![
-                ("birthRate", num(2.0)),
-                ("physics/velocity", num(0.2)),
-                ("physics/gravity", num(g)),
-                ("particle/particleType", Value::Enum(2)),
-                ("particle/birthSize", num(0.2)),
-                ("particle/deathSize", num(0.2)),
-                ("longevity", num(3.0)),
-            ]
-        };
-        let blank = Image::new(48, 48);
-        let up = mass_y(&run("ec.sim.ccparticleworld", &base(0.0), blank.clone(), 1.0), &blank);
-        let down = mass_y(&run("ec.sim.ccparticleworld", &base(2.0), blank.clone(), 1.0), &blank);
-        assert!(down > up + 2.0, "{up} {down}");
-    }
-
-    /// A comp whose camera is `camera` ([`crate::CompScene::camera`]); `layer`: a camera layer
-    /// (else the comp's default view).
-    struct Comp {
-        camera: [[f64; 4]; 3],
-        layer: bool,
-    }
-    impl crate::EffectHost for Comp {
-        fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
-            None
-        }
-        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-            None
-        }
-        fn comp_scene(&self) -> Option<crate::CompScene> {
-            Some(crate::CompScene { camera: Some(self.camera), camera_layer: self.layer, light: None })
-        }
-    }
-
-    /// A camera `d` px in front of layer point `c` looking at it, moved right by `dx` px and
-    /// zoomed by `zoom` (1 = identity on the layer plane): `c + zoom·d·(p − c − dx) / (z + d)`.
-    fn cam(c: [f64; 2], d: f64, dx: f64, zoom: f64) -> [[f64; 4]; 3] {
-        let k = zoom * d;
-        [[k, 0.0, c[0], d * c[0] - k * (c[0] + dx)], [0.0, k, c[1], d * c[1] - k * c[1]], [0.0, 0.0, 1.0, d]]
-    }
-
-    fn pw_in(comp: &Comp, vals: &[(&str, Value)]) -> Image {
-        run_fx("ec.sim.ccparticleworld", vals, Image::new(48, 48), 1.0, EffectEnv { host: Some(comp), ..Default::default() }).img
-    }
-
-    fn finite(img: &Image) -> bool {
-        img.data.iter().all(|p| p.iter().all(|c| c.is_finite()))
-    }
-
-    /// #397: with a camera layer in the comp, the particles are seen through it.
-    #[test]
-    fn particle_world_follows_the_comp_camera() {
-        let v = pw_vals(3.0);
-        let blank = Image::new(48, 48);
-        let here = Comp { camera: cam([24.0, 24.0], 96.0, 0.0, 1.0), layer: true };
-        let base = pw_in(&here, &v);
-        assert!(base.data.iter().any(|p| p[3] > 0.0), "particles alive");
-        // Moving the camera right moves the particles left.
-        let moved = pw_in(&Comp { camera: cam([24.0, 24.0], 96.0, 8.0, 1.0), ..here }, &v);
-        let (a, b) = (mass(&base, &blank), mass(&moved, &blank));
-        assert!(b[0] < a[0] - 4.0 && (b[1] - a[1]).abs() < 2.0, "{a:?} -> {b:?}");
-        // Zooming in spreads them out.
-        let zoomed = pw_in(&Comp { camera: cam([24.0, 24.0], 96.0, 0.0, 2.0), ..here }, &v);
-        let cover = |i: &Image| i.data.iter().filter(|p| p[3] > 0.01).count();
-        assert!(cover(&zoomed) > cover(&base), "{} {}", cover(&zoomed), cover(&base));
-        // The Effect Camera is ignored then.
-        let mut turned = v.clone();
-        turned.push(("extras/effectCamera/rotationY", num(60.0)));
-        assert_eq!(pw_in(&here, &turned), base);
-        // The comp's default view (no camera layer) leaves it to the Effect Camera.
-        let default_view = Comp { layer: false, ..here };
-        assert_eq!(pw_in(&default_view, &v), run("ec.sim.ccparticleworld", &v, blank.clone(), 1.0));
-        // A camera facing away, or a degenerate one, draws nothing and never NaN.
-        for camera in [[[96.0, 0.0, 24.0, 0.0], [0.0, 96.0, 24.0, 0.0], [0.0, 0.0, -1.0, -96.0]], [[0.0; 4]; 3], [[f64::NAN; 4]; 3]] {
-            assert_eq!(pw_in(&Comp { camera, layer: true }, &v), blank);
-        }
-        // A camera among the particles draws the ones in front of it.
-        let inside = pw_in(&Comp { camera: cam([24.0, 24.0], 1.0, 0.0, 1.0), ..here }, &v);
-        assert!(finite(&inside));
-    }
-
-    /// Extras ▸ Effect Camera: the defaults are the fixed camera Particle World always had.
-    #[test]
-    fn particle_world_effect_camera() {
-        let v = pw_vals(5.0);
-        let base = run("ec.sim.ccparticleworld", &v, Image::new(48, 48), 1.0);
-        let with = |extra: &[(&'static str, Value)]| {
-            let mut w = v.clone();
-            w.extend_from_slice(extra);
-            run("ec.sim.ccparticleworld", &w, Image::new(48, 48), 1.0)
-        };
-        // Missing parameters (projects saved before) read as the defaults.
-        let spec = crate::find("ec.sim.ccparticleworld").unwrap();
-        let mut params = crate::Params { values: spec.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        params.values.retain(|k, _| !k.starts_with(PW_EFFECT_CAMERA));
-        for (k, val) in &v {
-            params.values.insert(k.to_string(), val.clone());
-        }
-        let ctx = EffectCtx { params: &params, time: 1.0, layer_size: [48.0, 48.0], seed: 1, adjustment: false, env: EffectEnv::default() };
-        assert_eq!(crate::apply(spec, &ctx, Buf { img: Image::new(48, 48), offset: [0.0; 2], scale: 1.0 }).img, base);
-        assert_eq!(with(&[("extras/effectCamera/fov", num(f64::NAN))]), base);
-        // Turning or pulling back the camera changes the view.
-        let turned = with(&[("extras/effectCamera/rotationY", num(60.0))]);
-        assert!(diff(&turned, &base) > 1.0);
-        let cover = |i: &Image| i.data.iter().filter(|p| p[3] > 0.01).count();
-        let far = with(&[("extras/effectCamera/distance", num(4.0))]);
-        assert!(cover(&far) < cover(&base), "{} {}", cover(&far), cover(&base));
-        assert!(diff(&with(&[("extras/effectCamera/fov", num(120.0))]), &base) > 0.1);
-        // Extremes never panic or produce NaN.
-        for extra in [
-            ("extras/effectCamera/distance", num(0.0)),
-            ("extras/effectCamera/distance", num(-5.0)),
-            ("extras/effectCamera/fov", num(0.0)),
-            ("extras/effectCamera/fov", num(180.0)),
-            ("extras/effectCamera/rotationX", num(1e12)),
-        ] {
-            assert!(finite(&with(std::slice::from_ref(&extra))), "{extra:?}");
-        }
-        // Moving the camera doesn't restart the simulation.
-        let key = |pr: &crate::Params| {
-            sim_key(&EffectCtx { params: pr, time: 1.0, layer_size: [48.0, 48.0], seed: 1, adjustment: false, env: EffectEnv::default() }, 1)
-        };
-        let mut moved = params.clone();
-        moved.values.insert("extras/effectCamera/rotationZ".into(), num(30.0));
-        assert_eq!(key(&params), key(&moved));
-        moved.values.insert("extras/randomSeed".into(), num(9.0));
-        assert_ne!(key(&params), key(&moved));
-    }
-
-    #[test]
-    fn particle_systems2_seek_and_direction() {
-        let v = vec![
-            ("producer/position", pt(24.0, 24.0)),
-            ("birthRate", num(3.0)),
-            ("physics/gravity", num(0.0)),
-            ("physics/velocity", num(1.0)),
-            ("physics/animation", Value::Enum(1)),
-        ];
-        let _ = run("ec.sim.ccparticlesystems2", &v, Image::new(48, 48), 0.5);
-        let a = run("ec.sim.ccparticlesystems2", &v, Image::new(48, 48), 1.0);
-        let mut v2 = v.clone();
-        v2.push(("randomSeed", num(0.0)));
-        assert_eq!(a, run("ec.sim.ccparticlesystems2", &v2, Image::new(48, 48), 1.0));
-        // Direction 0° (up): particles above the producer.
-        let blank = Image::new(48, 48);
-        let y = mass_y(&a, &blank);
-        assert!((0.0..24.0).contains(&y), "{y}");
-        // The particles replace the layer: with none born it is empty.
-        let none = run("ec.sim.ccparticlesystems2", &[("birthRate", num(0.0))], grey(20, 20), 1.0);
-        assert_eq!(none, Image::new(20, 20));
-    }
-
-    /// CC Particle World and CC Particle Systems II replace their layer with the particles, in
-    /// every Transfer Mode (which only sets how particles meet each other). SceneYard frames from
-    /// After Effects 2026 show no trace of the source solid: "Task Preparation UI" (black solids
-    /// under fireworks hid a white page), "Burnout matchstick" (a red rectangle around the
-    /// flame), "Documentary Man Falling" (a black block over the light).
-    #[test]
-    fn cc_particles_replace_their_layer() {
-        let red = || {
-            let mut img = Image::new(48, 48);
-            img.data.iter_mut().for_each(|p| *p = [0.7, 0.1, 0.1, 1.0]);
-            img
-        };
-        for id in ["ec.sim.ccparticlesystems2", "ec.sim.ccparticleworld"] {
-            for mode in 0..4 {
-                let v = vec![("birthRate", num(3.0)), ("particle/transferMode", Value::Enum(mode))];
-                let _ = run(id, &v, red(), 0.5);
-                let out = run(id, &v, red(), 1.0);
-                // No source left: the corners, far from the producer, are clear.
-                for (x, y) in [(0, 0), (47, 0), (0, 47), (47, 47)] {
-                    assert!(out.get(x, y)[3] < 1e-6, "{id} mode {mode} ({x},{y}): {:?}", out.get(x, y));
-                }
-                assert!(out.data.iter().any(|p| p[3] > 0.05), "{id} mode {mode}: particles drawn");
-            }
-        }
-    }
-
-    #[test]
-    fn mercury_blobs_and_seek() {
-        let v = vec![("producer", pt(24.0, 16.0)), ("radiusX", num(5.0)), ("radiusY", num(5.0)), ("birthRate", num(3.0))];
-        let _ = run("ec.sim.ccmrmercury", &v, ramp(48, 48), 0.7);
-        let a = run("ec.sim.ccmrmercury", &v, ramp(48, 48), 1.4);
-        let mut v2 = v.clone();
-        v2.push(("shading/metal", num(100.0)));
-        let b = run("ec.sim.ccmrmercury", &v2, ramp(48, 48), 1.4);
-        assert_eq!(a, b);
-        assert!(a.data.iter().any(|p| p[3] > 0.5), "blobs visible");
-        let none = run("ec.sim.ccmrmercury", &[("birthRate", num(0.0))], ramp(48, 48), 1.4);
-        assert!(none.data.iter().all(|p| p[3] == 0.0));
-    }
-
-    #[test]
-    fn half_resolution_scales_sprites() {
-        // Downsampled buffers render the same layout at half size.
-        let s = crate::find("ec.sim.ccsnowfall").unwrap();
-        let mut params = crate::Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
-        params.values.insert("flakes".into(), num(50.0));
-        params.values.insert("offset".into(), pt(20.0, 20.0));
-        let ctx = EffectCtx { params: &params, time: 0.5, layer_size: [40.0, 40.0], seed: 1, adjustment: false, env: EffectEnv::default() };
-        let full = crate::apply(s, &ctx, Buf { img: grey(40, 40), offset: [0.0; 2], scale: 1.0 });
-        let half = crate::apply(s, &ctx, Buf { img: grey(20, 20), offset: [0.0; 2], scale: 0.5 });
-        let sum = |i: &Image| i.data.iter().map(|p| p[0]).sum::<f32>() / i.data.len() as f32;
-        assert!((sum(&full.img) - sum(&half.img)).abs() < 0.05, "{} {}", sum(&full.img), sum(&half.img));
-    }
-}
+mod tests;
diff --git a/crates/effects/src/sim/common.rs b/crates/effects/src/sim/common.rs
new file mode 100644
index 000000000..294d787f1
--- /dev/null
+++ b/crates/effects/src/sim/common.rs
@@ -0,0 +1,25 @@
+use super::{EffectSpec, ParamUi, Value, hash1, slider};
+
+pub(crate) fn spec(id: &'static str, name: &'static str, params: Vec<crate::ParamSpec>, render: crate::RenderFn) -> EffectSpec {
+    EffectSpec { id, name, category: "Simulation", params, render, gpu: false, float: true }
+}
+
+pub(crate) fn pt(x: f64, y: f64) -> Value {
+    Value::Vec2([x, y])
+}
+
+pub(crate) fn pct() -> ParamUi {
+    slider(0.0, 100.0, 0.0, 100.0, 1)
+}
+
+/// Deterministic hash → [0, 1).
+#[inline]
+pub(crate) fn h(i: u32, k: u32, seed: u32) -> f32 {
+    hash1(i, k, seed)
+}
+
+/// Signed hash → [-1, 1).
+#[inline]
+pub(crate) fn hs(i: u32, k: u32, seed: u32) -> f32 {
+    hash1(i, k, seed) * 2.0 - 1.0
+}
diff --git a/crates/effects/src/sim/engine.rs b/crates/effects/src/sim/engine.rs
new file mode 100644
index 000000000..beda8c318
--- /dev/null
+++ b/crates/effects/src/sim/engine.rs
@@ -0,0 +1,374 @@
+use super::common::{h, hs};
+use super::particle_fx::{MERCURY_CACHE, MERCURY_RATE, PS2_CACHE, PS2_RATE, PW_CACHE, PW_RATE, ps2_phys, pw_phys};
+use super::sprites::{Shape, Sprite};
+use super::{Buf, EffectCtx, Image, IntoParallelRefMutIterator, ParallelIterator, SimCache, params_key_except, value_noise};
+
+// ------------------------------------------------------------------ particle engine
+
+/// Steps per second of the stepped particle simulations.
+pub(crate) const SPS: f64 = 60.0;
+
+/// Number of whole steps reached at layer time `t`.
+pub(crate) fn steps_at(t: f64) -> u64 {
+    if t <= 0.0 { 0 } else { (t * SPS + 1e-6).floor() as u64 }
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct Particle {
+    pub p: [f32; 3],
+    pub v: [f32; 3],
+    pub age: f32,
+    pub life: f32,
+    /// Per-particle random in [0, 1) (size variation, colour jitter…).
+    pub rnd: f32,
+    pub id: u32,
+}
+
+#[derive(Clone, Debug, Default)]
+pub(crate) struct PState {
+    pub parts: Vec<Particle>,
+    pub carry: f64,
+    pub next_id: u32,
+    /// The birth rates of the steps so far (see [`rates_hash`]): a checkpoint is only resumed
+    /// from with the same history.
+    pub hist: u64,
+}
+
+/// `hist` after one more step at `rate` particles per second.
+fn rates_hash(hist: u64, rate: f64) -> u64 {
+    (hist ^ rate.to_bits()).wrapping_mul(0x0100_0000_01b3).rotate_left(5)
+}
+
+/// Physics configuration (world units; y down).
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Phys {
+    /// Particles per second.
+    pub rate: f64,
+    pub life: f32,
+    pub producer: [f32; 3],
+    pub radius: [f32; 3],
+    pub anim: u32,
+    pub speed: f32,
+    pub gravity: [f32; 3],
+    pub resistance: f32,
+    pub axis: [f32; 3],
+    pub extra: f32,
+    pub extra_angle: f32,
+    pub seed: u32,
+    pub max: usize,
+    /// 2D systems keep z = 0.
+    pub flat: bool,
+}
+
+pub(crate) const PW_ANIMS: &[&str] =
+    &["Explosive", "Direction Axis", "Cone Axis", "Viscouse", "Twirly", "Vortex", "Fire", "Jet Sideways", "Fractal Omni", "Fractal Uni"];
+
+pub(super) fn norm3(v: [f32; 3]) -> [f32; 3] {
+    let l = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
+    if l > 1e-9 { [v[0] / l, v[1] / l, v[2] / l] } else { [0.0, -1.0, 0.0] }
+}
+
+fn rand_dir(i: u32, k: u32, seed: u32, flat: bool) -> [f32; 3] {
+    if flat {
+        let a = h(i, k, seed) * std::f32::consts::TAU;
+        return [a.cos(), a.sin(), 0.0];
+    }
+    let z = hs(i, k, seed);
+    let a = h(i, k + 1, seed) * std::f32::consts::TAU;
+    let r = (1.0 - z * z).max(0.0).sqrt();
+    [r * a.cos(), r * a.sin(), z]
+}
+
+impl Phys {
+    fn spawn(&self, id: u32) -> Particle {
+        let seed = self.seed;
+        let mut p = [0.0f32; 3];
+        // Uniform in the producer ellipsoid.
+        let u = rand_dir(id, 1, seed, self.flat);
+        let rr = h(id, 3, seed).powf(if self.flat { 0.5 } else { 1.0 / 3.0 });
+        for k in 0..3 {
+            p[k] = self.producer[k] + u[k] * self.radius[k] * rr;
+        }
+        if self.flat {
+            p[2] = 0.0;
+        }
+        let ax = norm3(self.axis);
+        let jitter = rand_dir(id, 5, seed, self.flat);
+        let dir = match self.anim {
+            1 | 9 => norm3([ax[0] + jitter[0] * 0.08, ax[1] + jitter[1] * 0.08, ax[2] + jitter[2] * 0.08]),
+            2 => {
+                let k = (self.extra_angle.to_radians() * 0.5).tan().abs().min(20.0);
+                norm3([ax[0] + jitter[0] * k * h(id, 8, seed), ax[1] + jitter[1] * k * h(id, 8, seed), ax[2] + jitter[2] * k * h(id, 8, seed)])
+            }
+            5 => [jitter[0], 0.0, if self.flat { 0.0 } else { jitter[2] }],
+            6 => norm3([jitter[0] * 0.25, -1.0, jitter[2] * 0.25]),
+            7 => norm3([1.0, jitter[1] * 0.05, jitter[2] * 0.05]),
+            _ => jitter,
+        };
+        let sp = self.speed * (0.5 + 0.5 * h(id, 9, seed));
+        let mut v = [dir[0] * sp, dir[1] * sp, dir[2] * sp];
+        if self.flat {
+            v[2] = 0.0;
+        }
+        let life = self.life * (0.8 + 0.4 * h(id, 10, seed));
+        Particle { p, v, age: 0.0, life, rnd: h(id, 11, seed), id }
+    }
+
+    /// One step at the constant [`Phys::rate`] (the tests' reference).
+    #[cfg(test)]
+    pub(crate) fn step(&self, st: &mut PState, step: u64) {
+        self.step_at_rate(st, step, self.rate);
+    }
+
+    /// One step with `rate` particles per second born during it (rather than [`Phys::rate`]):
+    /// the rate only decides the births, particles already alive move and age as ever.
+    pub(crate) fn step_at_rate(&self, st: &mut PState, step: u64, rate: f64) {
+        let dt = (1.0 / SPS) as f32;
+        let t = step as f32 * dt;
+        let mut drag = self.resistance;
+        if self.anim == 3 {
+            drag += 3.0 * self.extra.max(0.1);
+        }
+        let damp = (-drag * dt).exp();
+        let seed = self.seed;
+        st.parts.par_iter_mut().for_each(|q| {
+            let mut a = self.gravity;
+            match self.anim {
+                4 => {
+                    // Twirly: swirl around the vertical axis through the producer.
+                    let (dx, dz) = (q.p[0] - self.producer[0], q.p[2] - self.producer[2]);
+                    let k = 4.0 * self.extra;
+                    a[0] += -dz * k;
+                    a[2] += dx * k;
+                    if self.flat {
+                        let dy = q.p[1] - self.producer[1];
+                        a[0] += -dy * k;
+                        a[1] += dx * k;
+                    }
+                }
+                5 => {
+                    // Vortex: strong tangential + inward pull.
+                    let (dx, dy) = (q.p[0] - self.producer[0], q.p[1] - self.producer[1]);
+                    let k = 6.0 * self.extra;
+                    a[0] += -dy * k - dx * 2.0;
+                    a[1] += dx * k - dy * 2.0;
+                }
+                6 => {
+                    // Fire: buoyant, flickering turbulence.
+                    let n = value_noise(q.p[0] * 8.0, q.p[1] * 8.0, t * 3.0, seed) - 0.5;
+                    a[0] += n * 4.0 * self.extra;
+                    a[1] -= self.gravity[1] * 1.5 + 0.3 * self.extra;
+                }
+                8 | 9 => {
+                    let f = 6.0 * self.extra;
+                    a[0] += (value_noise(q.p[0] * 5.0, q.p[1] * 5.0, q.p[2] * 5.0 + t, seed) - 0.5) * f;
+                    a[1] += (value_noise(q.p[0] * 5.0 + 17.0, q.p[1] * 5.0, q.p[2] * 5.0 + t, seed) - 0.5) * f;
+                    if !self.flat {
+                        a[2] += (value_noise(q.p[0] * 5.0, q.p[1] * 5.0 + 31.0, q.p[2] * 5.0 + t, seed) - 0.5) * f;
+                    }
+                }
+                _ => {}
+            }
+            for k in 0..3 {
+                q.v[k] = (q.v[k] + a[k] * dt) * damp;
+                q.p[k] += q.v[k] * dt;
+            }
+            if self.flat {
+                q.p[2] = 0.0;
+                q.v[2] = 0.0;
+            }
+            q.age += dt;
+        });
+        st.parts.retain(|q| q.age < q.life);
+        st.hist = rates_hash(st.hist, rate);
+        st.carry += rate / SPS;
+        let n = st.carry.floor() as u32;
+        st.carry -= n as f64;
+        for _ in 0..n {
+            if st.parts.len() >= self.max {
+                break;
+            }
+            let id = st.next_id;
+            st.next_id = st.next_id.wrapping_add(1);
+            // Sub-step birth offset keeps continuous streams smooth.
+            let mut q = self.spawn(id);
+            let frac = h(id, 12, seed) * dt;
+            for k in 0..3 {
+                q.p[k] += q.v[k] * frac;
+            }
+            q.age = frac;
+            st.parts.push(q);
+        }
+    }
+}
+
+impl Phys {
+    /// The backend description (per-step and per-spawn constants evaluated here, in f32).
+    pub(crate) fn desc(&self) -> crate::psim::EngineDesc {
+        let mut drag = self.resistance;
+        if self.anim == 3 {
+            drag += 3.0 * self.extra.max(0.1);
+        }
+        let dt = (1.0 / SPS) as f32;
+        crate::psim::EngineDesc {
+            life: self.life,
+            producer: self.producer,
+            radius: self.radius,
+            anim: self.anim,
+            speed: self.speed,
+            gravity: self.gravity,
+            axis: norm3(self.axis),
+            extra: self.extra,
+            cone: (self.extra_angle.to_radians() * 0.5).tan().abs().min(20.0),
+            damp: (-drag * dt).exp(),
+            seed: self.seed,
+            flat: self.flat,
+        }
+    }
+}
+
+/// The state at layer time `ctx.time` from the host's particle backend (GPU particles), or
+/// `None` (simulate on the CPU). `rates`: the birth rate of each step, when it changes over time
+/// (else [`Phys::rate`]).
+pub(super) fn accelerated(ctx: &EffectCtx, key: u64, phys: &Phys, rates: Option<&[f64]>) -> Option<std::sync::Arc<PState>> {
+    let backend = ctx.env.host?.particles()?;
+    let steps = steps_at(ctx.time);
+    let births = match rates {
+        Some(r) => crate::psim::births_at(steps, phys.max, |i| r.get(i as usize).copied().unwrap_or(0.0))?,
+        None => crate::psim::births(phys.rate, steps, phys.max)?,
+    };
+    let req = crate::psim::SimRequest { key, steps, births: &births, system: crate::psim::ParticleSystem::Engine(phys.desc()) };
+    let parts = backend.simulate(&req)?;
+    Some(std::sync::Arc::new(PState {
+        parts: parts.into_iter().map(|q| Particle { p: q.p, v: q.v, age: q.age, life: q.life, rnd: q.rnd, id: q.id }).collect(),
+        carry: 0.0,
+        next_id: births.len() as u32,
+        hist: 0,
+    }))
+}
+
+/// The birth rate (particles per second) of each step up to layer time `ctx.time`: parameter
+/// `id` × `k`, sampled where the step starts (a keyframed or expression-driven Birth Rate only
+/// decides the births of its own time, #1373). Without a host that evaluates the effect at
+/// other times, the current value for every step.
+pub(super) fn rate_history(ctx: &EffectCtx, id: &str, k: f64) -> Vec<f64> {
+    let now = ctx.params.f(id);
+    // A rate without keyframes or an expression is the same at every step.
+    let host = ctx.env.host.filter(|h| !h.param_is_static(ctx.env.effect_index, id));
+    (0..steps_at(ctx.time))
+        .map(|i| {
+            let v = host.and_then(|h| h.param_at(ctx.env.effect_index, id, i as f64 / SPS)).map_or(now, |v| v.as_f64());
+            if v.is_finite() { v.max(0.0) * k } else { 0.0 }
+        })
+        .collect()
+}
+
+/// Run a particle system through `rates` (one birth rate per step, see [`rate_history`]) with
+/// `cache`, resuming only from checkpoints reached with the same rates.
+pub(super) fn simulate_rates(cache: &SimCache<PState>, key: u64, phys: &Phys, rates: &[f64]) -> std::sync::Arc<PState> {
+    // `hist` of the state after each number of steps.
+    let mut prefix = Vec::with_capacity(rates.len() + 1);
+    prefix.push(0u64);
+    for r in rates {
+        prefix.push(rates_hash(prefix.last().copied().unwrap_or(0), *r));
+    }
+    let rate = |i: u64| rates.get(i as usize).copied().unwrap_or(0.0);
+    cache.run_where(key, rates.len() as u64, PState::default, |st, i| phys.step_at_rate(st, i, rate(i)), |s, st| prefix.get(s as usize) == Some(&st.hist))
+}
+
+/// A stepped particle system's particles at `ctx.time`, born at the Birth Rate of their own
+/// time (`birthRate` × `k` particles per second, see [`rate_history`]). The cache key is every
+/// parameter but Birth Rate (its history is checked through `PState::hist`) and those under
+/// `skip`, with `salt`. `gpu`: the host's particle backend may simulate it.
+pub(super) struct Stepped<'a> {
+    pub(super) cache: &'a SimCache<PState>,
+    pub(super) salt: u64,
+    pub(super) skip: &'a [&'a str],
+    pub(super) k: f64,
+    pub(super) gpu: bool,
+}
+
+impl Stepped<'_> {
+    pub(super) fn state(&self, ctx: &EffectCtx, phys: &Phys) -> std::sync::Arc<PState> {
+        let rates = rate_history(ctx, "birthRate", self.k);
+        let mut skip = self.skip.to_vec();
+        skip.push("birthRate");
+        let key = params_key_except(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, self.salt, &skip);
+        let gpu = if self.gpu { accelerated(ctx, key, phys, Some(&rates)) } else { None };
+        gpu.unwrap_or_else(|| simulate_rates(self.cache, key, phys, &rates))
+    }
+}
+
+/// CC Particle World.
+const PW: Stepped = Stepped { cache: &PW_CACHE, salt: 1, skip: &[PW_EFFECT_CAMERA], k: PW_RATE, gpu: true };
+/// CC Particle Systems II.
+pub(super) const PS2: Stepped = Stepped { cache: &PS2_CACHE, salt: 2, skip: &[], k: PS2_RATE, gpu: true };
+/// CC Mr. Mercury (its blobs are simulated on the CPU).
+pub(super) const MERCURY: Stepped = Stepped { cache: &MERCURY_CACHE, salt: 3, skip: &[], k: MERCURY_RATE, gpu: false };
+
+/// CC Particle World's particles at `ctx.time`, born at the Birth Rate of their own time.
+pub(super) fn pw_state(ctx: &EffectCtx, phys: &Phys) -> std::sync::Arc<PState> {
+    PW.state(ctx, phys)
+}
+
+/// The live particles of a stepped particle effect (`ec.sim.ccparticleworld`,
+/// `ec.sim.ccparticlesystems2`) at `ctx.time`: from the host's particle backend when it has
+/// one (GPU particles), else from the CPU simulation. For comparing the two.
+pub fn particle_state(id: &str, ctx: &EffectCtx) -> Option<Vec<crate::psim::SimParticle>> {
+    let st = match id {
+        "ec.sim.ccparticleworld" => pw_state(ctx, &pw_phys(ctx)),
+        "ec.sim.ccparticlesystems2" => PS2.state(ctx, &ps2_phys(ctx)),
+        _ => return None,
+    };
+    Some(st.parts.iter().map(|q| crate::psim::SimParticle { p: q.p, v: q.v, age: q.age, life: q.life, rnd: q.rnd, id: q.id }).collect())
+}
+
+/// The simulation cache key of a stepped particle effect at a constant Birth Rate (the tests'
+/// reference): every parameter but CC Particle World's Effect Camera.
+#[cfg(test)]
+pub(super) fn sim_key(ctx: &EffectCtx, salt: u64) -> u64 {
+    params_key_except(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, salt, &[PW_EFFECT_CAMERA])
+}
+
+/// Run a particle system at its constant [`Phys::rate`] to layer time `t` through `cache` (the
+/// tests' reference).
+#[cfg(test)]
+pub(crate) fn simulate(cache: &SimCache<PState>, key: u64, t: f64, phys: &Phys) -> std::sync::Arc<PState> {
+    cache.run(key, steps_at(t), PState::default, |st, i| phys.step(st, i))
+}
+
+pub(crate) const PARTICLE_TYPES: &[&str] =
+    &["Line", "Shaded Sphere", "Faded Sphere", "Bubble", "Star", "Motion Polygon", "Tri-Polygon", "Cube", "Textured Square"];
+
+/// Colour/size/opacity of a particle at its age.
+pub(super) fn particle_look(q: &Particle, birth: [f32; 4], death: [f32; 4], bsize: f32, dsize: f32, svar: f32, max_op: f32) -> ([f32; 4], f32) {
+    let u = (q.age / q.life.max(1e-4)).clamp(0.0, 1.0);
+    let size = (bsize + (dsize - bsize) * u) * (1.0 + svar * (q.rnd * 2.0 - 1.0));
+    let fade = (u * 20.0).min(1.0) * ((1.0 - u) * 5.0).min(1.0);
+    let c = [birth[0] + (death[0] - birth[0]) * u, birth[1] + (death[1] - birth[1]) * u, birth[2] + (death[2] - birth[2]) * u, max_op * fade];
+    (c, size.max(0.0))
+}
+
+pub(super) fn type_sprite(kind: u32, x: f32, y: f32, r: f32, c: [f32; 4], velocity: [f32; 2], rot: f32) -> Sprite {
+    let [vx, vy] = velocity;
+    let vl = (vx * vx + vy * vy).sqrt().max(1e-6);
+    let shape = match kind {
+        0 => Shape::Line { dx: -vx / vl * r * 2.0, dy: -vy / vl * r * 2.0 },
+        1 => Shape::Sphere,
+        2 => Shape::Faded,
+        3 => Shape::Bubble,
+        4 => Shape::Star,
+        5 => Shape::Line { dx: -vx * 0.05, dy: -vy * 0.05 },
+        6 => Shape::Tri,
+        _ => Shape::Square,
+    };
+    let rr = match kind {
+        0 => (r * 0.08).max(0.5),
+        5 => r * 0.5,
+        _ => r,
+    };
+    Sprite { x, y, r: rr, c, shape, rot }
+}
+
+/// CC Particle World's Extras ▸ Effect Camera parameters (id prefix).
+pub(super) const PW_EFFECT_CAMERA: &str = "extras/effectCamera/";
diff --git a/crates/effects/src/sim/particle_fx.rs b/crates/effects/src/sim/particle_fx.rs
new file mode 100644
index 000000000..c2f493ab5
--- /dev/null
+++ b/crates/effects/src/sim/particle_fx.rs
@@ -0,0 +1,430 @@
+use super::engine::{MERCURY, PS2, PState, PW_EFFECT_CAMERA, Phys, norm3, particle_look, pw_state, type_sprite};
+use super::sprites::{Acc, Post, Sprite, SpritePlan, aa, raster, splat, sprite_bbox};
+use super::{Buf, EffectCtx, Image, IntoParallelRefIterator, ParallelIterator, SimCache, Value, unpremul};
+
+// ------------------------------------------------------------------ CC Particle World
+
+pub(super) static PW_CACHE: SimCache<PState> = SimCache::new(6);
+
+/// Particles per second per unit of CC Particle World's Birth Rate.
+pub(super) const PW_RATE: f64 = 120.0;
+
+/// CC Particle World's physics.
+pub(super) fn pw_phys(ctx: &EffectCtx) -> Phys {
+    let pr = ctx.params;
+    Phys {
+        rate: pr.f("birthRate").max(0.0) * PW_RATE,
+        life: pr.f("longevity").max(0.0) as f32,
+        producer: [pr.f("producer/producerX") as f32, pr.f("producer/producerY") as f32, pr.f("producer/producerZ") as f32],
+        radius: [pr.f("producer/radiusX").max(0.0) as f32, pr.f("producer/radiusY").max(0.0) as f32, pr.f("producer/radiusZ").max(0.0) as f32],
+        anim: pr.e("physics/animation"),
+        speed: pr.f("physics/velocity") as f32 * 0.5,
+        gravity: {
+            let g = pr.f("physics/gravity") as f32;
+            let gv =
+                [pr.f("physics/gravityVector/gravityX") as f32, pr.f("physics/gravityVector/gravityY") as f32, pr.f("physics/gravityVector/gravityZ") as f32];
+            [gv[0] * g, gv[1] * g, gv[2] * g]
+        },
+        resistance: pr.f("physics/resistance").max(0.0) as f32,
+        axis: [pr.f("physics/directionAxis/axisX") as f32, pr.f("physics/directionAxis/axisY") as f32, pr.f("physics/directionAxis/axisZ") as f32],
+        extra: pr.f("physics/extra") as f32,
+        extra_angle: pr.f("physics/extraAngle") as f32,
+        seed: (pr.f("extras/randomSeed") as u32).wrapping_mul(0x9e3779b9) ^ ctx.seed,
+        max: 40_000,
+        flat: false,
+    }
+}
+
+/// CC Particle World's Particle Type ▸ Textured Square.
+const PW_TEXTURED_SQUARE: u32 = 8;
+/// CC Particle World's Particle ▸ Texture ▸ Texture Layer.
+pub(super) const PW_TEXTURE_LAYER: &str = "particle/texture/textureLayer";
+
+/// Whether CC Particle World draws its Texture Layer on the particles (Textured Square with a
+/// layer chosen). Only the CPU does: `catalog::gpu_supported` keeps this case off the GPU.
+pub(crate) fn particle_world_textured(ctx: &EffectCtx) -> bool {
+    ctx.params.e("particle/particleType") == PW_TEXTURED_SQUARE && ctx.params.get(PW_TEXTURE_LAYER).and_then(Value::as_layer).is_some()
+}
+
+pub(super) fn particle_world(ctx: &EffectCtx, b: Buf) -> Buf {
+    // The texture at the current comp time, shared by every shutter sample. A layer the host
+    // can't give (the effect's own layer with its effects, a reference cycle) leaves the
+    // squares in the particle colour. Authored buffers (text, shapes) span only their content:
+    // covering the whole layer keeps the clamped sampling from stretching their edge pixels.
+    let tex = particle_world_textured(ctx).then(|| ctx.layer_param(PW_TEXTURE_LAYER, true)).flatten().map(|mut t| {
+        t.buf.cover(t.size);
+        t
+    });
+    let (w, h) = (b.img.width, b.img.height);
+    let draw = |plan: &SpritePlan| match &tex {
+        Some(t) => splat_textured(w, h, &plan.sprites, plan.acc, t),
+        None => splat(w, h, &plan.sprites, plan.acc),
+    };
+    // #1195: with the comp's motion-blur shutter open, particles draw as motion trails: the
+    // sprite fields of samples across the shutter are averaged, as Transform averages its
+    // matrix samples. (The GPU compositor runs this case on the CPU: catalog::gpu_supported.)
+    if let Some((angle, phase, n)) = ctx.env.shutter.filter(|(a, _, _)| *a > 0.0) {
+        let n = (n.clamp(2, 64) as usize).max(2);
+        let fd = 1.0 / ctx.fps().max(0.001);
+        let mut acc = Image::new(w, h);
+        let mut post: Option<Post> = None;
+        for k in 0..n {
+            let t = ctx.time + (phase + angle * k as f64 / (n - 1) as f64) / 360.0 * fd;
+            let sub = EffectCtx { params: ctx.params, time: t, layer_size: ctx.layer_size, seed: ctx.seed, adjustment: ctx.adjustment, env: ctx.env };
+            if let Some(plan) = particle_world_plan(&sub, &b) {
+                let fx = draw(&plan);
+                acc.data.iter_mut().zip(&fx.data).for_each(|(a, o)| (0..4).for_each(|c| a[c] += o[c]));
+                post.get_or_insert(plan.post);
+            }
+        }
+        acc.data.iter_mut().for_each(|p| p.iter_mut().for_each(|v| *v /= n as f32));
+        return match post {
+            Some(p) => p.apply(b, acc),
+            None => b,
+        };
+    }
+    match particle_world_plan(ctx, &b) {
+        Some(plan) => {
+            let fx = draw(&plan);
+            plan.finish_with(b, fx)
+        }
+        None => b,
+    }
+}
+
+/// Draw square sprites into a new transparent image of `w`×`h`, each showing the layer `tex`
+/// stretched over the square (turned with it) at the sprite's opacity.
+fn splat_textured(w: u32, hgt: u32, sprites: &[Sprite], acc: Acc, tex: &crate::LayerPixels) -> Image {
+    let mut img = Image::new(w, hgt);
+    let (tw, th) = (tex.size[0], tex.size[1]);
+    let shade = |s: &Sprite, x: f32, y: f32| {
+        // As [`sprite_shade`]'s Square, sub-pixel sprites included.
+        let (r, fade) = if s.r < 0.5 { (0.5, s.r / 0.5) } else { (s.r, 1.0) };
+        let (sn, cs) = s.rot.sin_cos();
+        let (dx, dy) = (x - s.x, y - s.y);
+        let (ux, uy) = (dx * cs + dy * sn, -dx * sn + dy * cs);
+        let e = r * 0.75;
+        let a = aa(e - ux.abs()) * aa(e - uy.abs()) * s.c[3] * fade;
+        if a <= 1e-6 {
+            return None;
+        }
+        let (u, v) = (((ux / e + 1.0) * 0.5).clamp(0.0, 1.0) as f64, ((uy / e + 1.0) * 0.5).clamp(0.0, 1.0) as f64);
+        let (px, py) = tex.buf.to_px([u * tw, v * th]);
+        Some(tex.buf.img.sample_bilinear_clamped(px, py).map(|c| c * a))
+    };
+    raster(&mut img, sprites, sprite_bbox, shade, acc);
+    img
+}
+
+/// Effect Camera ▸ FOV's default (degrees).
+pub(super) const PW_FOV: f64 = 50.0;
+
+/// What CC Particle World sees its particles through.
+enum PwCamera {
+    /// Extras ▸ Effect Camera, in world units (layer widths): `dist` from the world origin (the
+    /// layer centre) along −z, the world turned by `rot` (`None` = not turned) about the origin,
+    /// `focal` the scale at unit depth; particles nearer than `near` aren't drawn.
+    Effect { rot: Option<[[f32; 3]; 3]>, dist: f32, focal: f32, near: f32 },
+    /// The comp's active camera layer, on buffer-world points (After Effects then ignores the
+    /// Effect Camera).
+    Comp(crate::card3d::Proj),
+}
+
+/// A particle as the camera sees it: depth (larger is farther), buffer pixel, size scale `k`
+/// (buffer pixels per world unit = `k · layer width · buffer scale`) and velocity in world units
+/// on screen (× the same factor for buffer pixels).
+struct PwSeen {
+    depth: f32,
+    x: f32,
+    y: f32,
+    k: f32,
+    v: [f32; 2],
+}
+
+impl PwCamera {
+    fn new(ctx: &EffectCtx, b: &Buf) -> PwCamera {
+        let [lw, lh] = ctx.layer_size;
+        if let Some(cam) = ctx.env.host.and_then(|h| h.comp_scene()).filter(|sc| sc.camera_layer).and_then(|sc| sc.camera) {
+            let c = [b.offset[0] + lw * 0.5 * b.scale, b.offset[1] + lh * 0.5 * b.scale];
+            return PwCamera::Comp(crate::card3d::comp_proj(&cam, c, b));
+        }
+        let f = |id: &str, d: f64| ctx.params.get(&format!("{PW_EFFECT_CAMERA}{id}")).map(Value::as_f64).filter(|v| v.is_finite()).unwrap_or(d);
+        // The camera keeps the origin's plane at the scale Distance gives it as FOV changes
+        // (moving in for a wider view), so FOV sets how strong the perspective is. Distance 2
+        // shows the origin's plane at the layer's own scale.
+        let half = |fov: f64| (fov.clamp(1.0, 179.0).to_radians() * 0.5).tan();
+        let zoom = half(PW_FOV) / half(f("fov", PW_FOV));
+        let dist = f("distance", 2.0).max(0.01) * zoom;
+        let a = [f("rotationX", 0.0), f("rotationY", 0.0), f("rotationZ", 0.0)];
+        let rot = (a != [0.0; 3]).then(|| {
+            let r = crate::card3d::rot_ordered(a[0].to_radians(), a[1].to_radians(), a[2].to_radians(), 0);
+            r.map(|row| row.map(|v| v as f32))
+        });
+        PwCamera::Effect { rot, dist: dist as f32, focal: (2.0 * zoom) as f32, near: (0.025 * dist) as f32 }
+    }
+
+    /// How the camera sees world point `p` moving at `v`; `None` behind or too close to it.
+    fn see(&self, p: [f32; 3], v: [f32; 3], lw: f32, lh: f32, b: &Buf) -> Option<PwSeen> {
+        match self {
+            PwCamera::Effect { rot, dist, focal, near } => {
+                let turn = |r: &[[f32; 3]; 3], q: [f32; 3]| r.map(|row| row[0] * q[0] + row[1] * q[1] + row[2] * q[2]);
+                let (p, v) = match rot {
+                    Some(r) => (turn(r, p), turn(r, v)),
+                    None => (p, v),
+                };
+                let zc = dist + p[2];
+                if zc.is_nan() || zc <= *near {
+                    return None;
+                }
+                let k = focal / zc;
+                let (x, y) = b.to_px([(lw * 0.5 + p[0] * lw * k) as f64, (lh * 0.5 + p[1] * lw * k) as f64]);
+                Some(PwSeen { depth: zc, x: x as f32, y: y as f32, k, v: [v[0], v[1]] })
+            }
+            PwCamera::Comp(proj) => {
+                let (s, lw, lh) = (b.scale, lw as f64, lh as f64);
+                let u = lw * s;
+                let at = [b.offset[0] + lw * 0.5 * s + p[0] as f64 * u, b.offset[1] + lh * 0.5 * s + p[1] as f64 * u, p[2] as f64 * u];
+                let seen = proj.view(at, [v[0] as f64, v[1] as f64, v[2] as f64])?;
+                let k = seen.scale;
+                Some(PwSeen {
+                    depth: seen.depth as f32,
+                    x: seen.at[0] as f32,
+                    y: seen.at[1] as f32,
+                    k: k as f32,
+                    v: [(seen.vel[0] / k) as f32, (seen.vel[1] / k) as f32],
+                })
+            }
+        }
+    }
+}
+
+/// CC Particle World's sprites (far to near), `None` before anything is born.
+pub(super) fn particle_world_plan(ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
+    let pr = ctx.params;
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let phys = pw_phys(ctx);
+    if phys.rate <= 0.0 && ctx.time <= 0.0 {
+        return None;
+    }
+    let st = pw_state(ctx, &phys);
+    let kind = pr.e("particle/particleType");
+    let birth = pr.color("particle/birthColor");
+    let death = pr.color("particle/deathColor");
+    let (bs, ds) = (pr.f("particle/birthSize") as f32, pr.f("particle/deathSize") as f32);
+    let svar = pr.f("particle/sizeVariation") as f32 / 100.0;
+    let max_op = pr.f("particle/maxOpacity") as f32 / 100.0;
+    let s = b.scale as f32;
+    let cam = PwCamera::new(ctx, b);
+    let mut list: Vec<(f32, Sprite)> = st
+        .parts
+        .par_iter()
+        .filter_map(|q| {
+            let PwSeen { depth, x, y, k, v } = cam.see(q.p, q.v, lw, lh, b)?;
+            let (c, size) = particle_look(q, birth, death, bs, ds, svar, max_op);
+            let r = size * 0.5 * lw * k * s * 0.25;
+            let sp = type_sprite(kind, x, y, r, c, [v[0] * lw * k * s, v[1] * lw * k * s], (q.id % 628) as f32 * 0.01 + q.age * 2.0);
+            Some((depth, sp))
+        })
+        .collect();
+    list.sort_by(|a, b| b.0.total_cmp(&a.0));
+    let sprites: Vec<Sprite> = list.into_iter().map(|(_, s)| s).collect();
+    Some(particle_sprites(sprites, pr.e("particle/transferMode")))
+}
+
+/// The CC particle systems' sprites with their Transfer Mode (Composite, Screen, Add, Black
+/// Background).
+fn particle_sprites(sprites: Vec<Sprite>, mode: u32) -> SpritePlan {
+    // The particles replace the layer (After Effects shows no trace of the source in any
+    // Transfer Mode, which sets how the particles meet each other).
+    SpritePlan { sprites, tints: vec![], acc: if mode == 2 { Acc::Add } else { Acc::Over }, post: Post::Replace }
+}
+
+// ------------------------------------------------------------------ CC Particle Systems II
+
+pub(super) static PS2_CACHE: SimCache<PState> = SimCache::new(6);
+
+/// Particles per second per unit of CC Particle Systems II's Birth Rate.
+pub(super) const PS2_RATE: f64 = 60.0;
+
+/// CC Particle Systems II's physics.
+pub(super) fn ps2_phys(ctx: &EffectCtx) -> Phys {
+    let pr = ctx.params;
+    let lh = ctx.layer_size[1] as f32;
+    let unit = lh.max(1.0);
+    let pos = pr.v2("producer/position");
+    let dir = (pr.f("physics/direction") as f32).to_radians();
+    Phys {
+        rate: pr.f("birthRate").max(0.0) * PS2_RATE,
+        life: pr.f("longevity").max(0.0) as f32,
+        producer: [pos[0] as f32 / unit, pos[1] as f32 / unit, 0.0],
+        radius: [pr.f("producer/radiusX").max(0.0) as f32 / unit, pr.f("producer/radiusY").max(0.0) as f32 / unit, 0.0],
+        anim: [0u32, 1, 2, 3, 4, 5, 6, 7, 8, 9][pr.e("physics/animation").min(9) as usize],
+        speed: pr.f("physics/velocity") as f32 * 0.25,
+        gravity: [0.0, pr.f("physics/gravity") as f32 * 0.5, 0.0],
+        resistance: pr.f("physics/resistance").max(0.0) as f32,
+        // AE angles: 0° = up, clockwise.
+        axis: [dir.sin(), -dir.cos(), 0.0],
+        extra: pr.f("physics/extra") as f32,
+        extra_angle: 45.0 * pr.f("physics/extra") as f32,
+        seed: (pr.f("randomSeed") as u32).wrapping_mul(0x85ebca6b) ^ ctx.seed,
+        max: 40_000,
+        flat: true,
+    }
+}
+
+pub(super) fn particle_systems2(ctx: &EffectCtx, b: Buf) -> Buf {
+    particle_systems2_plan(ctx, &b).finish(b)
+}
+
+/// CC Particle Systems II's sprites.
+pub(super) fn particle_systems2_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
+    let pr = ctx.params;
+    let lh = ctx.layer_size[1] as f32;
+    let unit = lh.max(1.0);
+    let st = PS2.state(ctx, &ps2_phys(ctx));
+    let kind = pr.e("particle/particleType");
+    let birth = pr.color("particle/birthColor");
+    let death = pr.color("particle/deathColor");
+    let (bs, ds) = (pr.f("particle/birthSize") as f32, pr.f("particle/deathSize") as f32);
+    let svar = pr.f("particle/sizeVariation") as f32 / 100.0;
+    let max_op = pr.f("particle/maxOpacity") as f32 / 100.0;
+    let s = b.scale as f32;
+    let sprites: Vec<Sprite> = st
+        .parts
+        .iter()
+        .map(|q| {
+            let (bx, by) = b.to_px([(q.p[0] * unit) as f64, (q.p[1] * unit) as f64]);
+            let (c, size) = particle_look(q, birth, death, bs, ds, svar, max_op);
+            let r = size * unit * 0.02 * s;
+            type_sprite(kind, bx as f32, by as f32, r, c, [q.v[0] * unit * s, q.v[1] * unit * s], (q.id % 628) as f32 * 0.01 + q.age * 2.0)
+        })
+        .collect();
+    particle_sprites(sprites, pr.e("particle/transferMode"))
+}
+
+// ------------------------------------------------------------------ CC Mr. Mercury
+
+pub(super) static MERCURY_CACHE: SimCache<PState> = SimCache::new(6);
+
+/// Blobs per second per unit of CC Mr. Mercury's Birth Rate.
+pub(super) const MERCURY_RATE: f64 = 10.0;
+
+/// A CC Mr. Mercury blob (buffer px).
+#[derive(Clone, Copy, Debug)]
+pub struct Blob {
+    pub x: f32,
+    pub y: f32,
+    pub r: f32,
+}
+
+/// CC Mr. Mercury's physics.
+pub(super) fn mercury_phys(ctx: &EffectCtx) -> Phys {
+    let pr = ctx.params;
+    let unit = (ctx.layer_size[1] as f32).max(1.0);
+    let pos = pr.v2("producer");
+    let dir = (pr.f("direction") as f32).to_radians();
+    Phys {
+        rate: pr.f("birthRate").max(0.0) * MERCURY_RATE,
+        life: pr.f("longevity").max(0.0) as f32,
+        producer: [pos[0] as f32 / unit, pos[1] as f32 / unit, 0.0],
+        radius: [pr.f("radiusX").max(0.0) as f32 / unit, pr.f("radiusY").max(0.0) as f32 / unit, 0.0],
+        anim: [0u32, 1, 2, 3, 4, 5, 6, 7, 8, 9][pr.e("animation").min(9) as usize],
+        speed: pr.f("velocity") as f32 * 0.3,
+        gravity: [0.0, pr.f("gravity") as f32 * 0.5, 0.0],
+        resistance: pr.f("resistance").max(0.0) as f32,
+        axis: [dir.sin(), -dir.cos(), 0.0],
+        extra: pr.f("extra") as f32,
+        extra_angle: 45.0 * pr.f("extra") as f32,
+        seed: ctx.seed.wrapping_mul(0xc2b2ae35),
+        max: 4_000,
+        flat: true,
+    }
+}
+
+/// CC Mr. Mercury's blobs this frame, from its particle simulation (for buffer geometry `b`).
+pub fn mercury_blobs(ctx: &EffectCtx, b: &Buf) -> Vec<Blob> {
+    let pr = ctx.params;
+    let unit = (ctx.layer_size[1] as f32).max(1.0);
+    let phys = mercury_phys(ctx);
+    let st = MERCURY.state(ctx, &phys);
+    let (bs, ds) = (pr.f("blobBirthSize") as f32, pr.f("blobDeathSize") as f32);
+    let s = b.scale as f32;
+    st.parts
+        .iter()
+        .map(|q| {
+            let u = (q.age / q.life.max(1e-4)).clamp(0.0, 1.0);
+            let size = bs + (ds - bs) * u;
+            let (bx, by) = b.to_px([(q.p[0] * unit) as f64, (q.p[1] * unit) as f64]);
+            Blob { x: bx as f32, y: by as f32, r: (size * unit * 0.08 * s).max(0.0) }
+        })
+        .filter(|q| q.r > 0.1)
+        .collect()
+}
+
+pub(super) fn mr_mercury(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let blobs = mercury_blobs(ctx, &b);
+    let influence = pr.f("blobInfluence") as f32 / 100.0;
+    let s = b.scale as f32;
+    let (w, hh) = (b.img.width, b.img.height);
+    // Field and gradient accumulate additively: [f, gx, gy, _].
+    let mut field = Image::new(w, hh);
+    let infl = 1.0 + influence;
+    raster(
+        &mut field,
+        &blobs,
+        |q| {
+            let e = q.r * 2.0 * infl;
+            Some([q.x - e, q.y - e, q.x + e, q.y + e])
+        },
+        |q, x, y| {
+            let (dx, dy) = (x - q.x, y - q.y);
+            let rr = q.r * 2.0 * infl;
+            let d2 = (dx * dx + dy * dy) / (rr * rr);
+            if d2 >= 1.0 {
+                return None;
+            }
+            let k = 1.0 - d2;
+            let f = k * k * k;
+            let g = -6.0 * k * k / (rr * rr);
+            Some([f, g * dx, g * dy, 0.0])
+        },
+        Acc::Add,
+    );
+    let thr = 0.35f32;
+    let ambient = pr.f("shading/ambient") as f32 / 100.0;
+    let diffuse = pr.f("shading/diffuse") as f32 / 100.0;
+    let specular = pr.f("shading/specular") as f32 / 100.0;
+    let rough = pr.f("shading/roughness").max(0.001) as f32;
+    let metal = pr.f("shading/metal") as f32 / 100.0;
+    let li = pr.f("light/lightIntensity") as f32 / 100.0;
+    let lc = pr.color("light/lightColor");
+    let ldir = (pr.f("light/lightDirection") as f32).to_radians();
+    let lheight = pr.f("light/lightHeight") as f32 / 100.0;
+    let l = norm3([ldir.sin(), -ldir.cos(), lheight.max(0.05)]);
+    let src = b.img.clone();
+    let mut out = Image::new(w, hh);
+    out.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let fv = field.data[y * w as usize + x];
+            let f = fv[0];
+            if f <= thr * 0.8 {
+                continue;
+            }
+            let cov = ((f - thr * 0.8) / (thr * 0.4)).clamp(0.0, 1.0);
+            let n = norm3([fv[1] * 3.0, fv[2] * 3.0, 1.0 / (1.0 + f)]);
+            // Refract the layer through the blob.
+            let sp = src.sample_bilinear_clamped(x as f64 + 0.5 - n[0] as f64 * 12.0 * s as f64, y as f64 + 0.5 - n[1] as f64 * 12.0 * s as f64);
+            let (c, sa) = unpremul(sp);
+            let base = if sa > 0.0 { c } else { [0.7, 0.7, 0.75] };
+            let nl = (n[0] * l[0] + n[1] * l[1] + n[2] * l[2]).max(0.0);
+            let hv = norm3([l[0], l[1], l[2] + 1.0]);
+            let spec = (n[0] * hv[0] + n[1] * hv[1] + n[2] * hv[2]).max(0.0).powf(1.0 / rough) * specular * li;
+            let shade = ambient + diffuse * nl * li;
+            let cc: [f32; 3] = std::array::from_fn(|k| base[k] * shade + spec * (lc[k] * (1.0 - metal) + base[k] * metal));
+            *px = [cc[0] * cov, cc[1] * cov, cc[2] * cov, cov];
+        }
+    });
+    b.img = out;
+    b
+}
diff --git a/crates/effects/src/sim/registry.rs b/crates/effects/src/sim/registry.rs
new file mode 100644
index 000000000..4df07c50a
--- /dev/null
+++ b/crates/effects/src/sim/registry.rs
@@ -0,0 +1,230 @@
+use super::common::{pct, pt, spec};
+use super::engine::{PARTICLE_TYPES, PW_ANIMS};
+use super::particle_fx::{PW_FOV, PW_TEXTURE_LAYER, mr_mercury, particle_systems2, particle_systems2_plan, particle_world, particle_world_plan};
+use super::sprites::SpritePlan;
+use super::weather::{bubbles, drizzle, rainfall, rainfall_plan, snowfall, snowfall_plan, star_burst, star_burst_plan};
+use super::{Buf, EffectCtx, EffectSpec, ParamUi, Value, col, num, p, popup, slider};
+
+/// The sprite plan of a sprite-drawing simulation effect for buffer geometry `b` (its pixels
+/// are not read), `None` for other effects or settings drawn otherwise (the GPU compositor's
+/// render pass).
+pub fn sprite_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
+    match id {
+        "ec.sim.ccrainfall" => Some(rainfall_plan(ctx, b)),
+        "ec.sim.ccsnowfall" => Some(snowfall_plan(ctx, b)),
+        "ec.sim.ccstarburst" => Some(star_burst_plan(ctx, b)),
+        "ec.sim.cchair" => crate::sim3::hair_plan(ctx, b),
+        "ec.sim.waveworld" => crate::sim2::wave_world_plan(ctx, b).and_then(|p| match p {
+            crate::sim2::WavePlan::Wire(sp) => Some(sp),
+            crate::sim2::WavePlan::Height { .. } => None,
+        }),
+        "ec.sim.foam" => crate::sim2::foam_plan(ctx, b),
+        "ec.sim.ccparticleworld" => particle_world_plan(ctx, b),
+        "ec.sim.ccparticlesystems2" => Some(particle_systems2_plan(ctx, b)),
+        _ => None,
+    }
+}
+
+// ------------------------------------------------------------------ specs
+
+pub fn specs() -> Vec<EffectSpec> {
+    let transfer = || popup(&["Composite", "Lighten"]);
+    vec![
+        spec(
+            "ec.sim.ccrainfall",
+            "Rainfall",
+            vec![
+                p("drops", "Drops", num(5000.0), slider(0.0, 100_000.0, 0.0, 20_000.0, 0)),
+                p("size", "Size", num(1.0), slider(0.0, 50.0, 0.0, 10.0, 2)),
+                p("sceneDepth", "Scene Depth", num(5000.0), slider(0.0, 20_000.0, 0.0, 10_000.0, 0)),
+                p("speed", "Speed", num(4000.0), slider(0.0, 20_000.0, 0.0, 10_000.0, 0)),
+                p("wind", "Wind", num(0.0), slider(-10_000.0, 10_000.0, -2000.0, 2000.0, 1)),
+                p("windVariation", "Variation % (Wind)", num(0.0), pct()),
+                p("spread", "Spread", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
+                p("color", "Color", col(0.8, 0.8, 0.8), ParamUi::Color),
+                p("opacity", "Opacity", num(25.0), pct()),
+                p("transferMode", "Transfer Mode", Value::Enum(1), transfer()),
+                p("compositeWithOriginal", "Composite With Original", Value::Bool(true), ParamUi::Checkbox),
+                p("extras/appearance", "Appearance", Value::Enum(0), popup(&["Refracting", "Soft Solid"])),
+                p("extras/offset", "Offset", pt(0.5, 0.5), ParamUi::Point),
+                p("extras/randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
+            ],
+            rainfall,
+        ),
+        spec(
+            "ec.sim.ccsnowfall",
+            "Snowfall",
+            vec![
+                p("flakes", "Flakes", num(10_000.0), slider(0.0, 200_000.0, 0.0, 50_000.0, 0)),
+                p("size", "Size", num(3.0), slider(0.0, 50.0, 0.0, 20.0, 2)),
+                p("sizeVariation", "Variation % (Size)", num(50.0), pct()),
+                p("sceneDepth", "Scene Depth", num(5000.0), slider(0.0, 20_000.0, 0.0, 10_000.0, 0)),
+                p("speed", "Speed", num(100.0), slider(0.0, 5000.0, 0.0, 1000.0, 1)),
+                p("speedVariation", "Variation % (Speed)", num(50.0), pct()),
+                p("wind", "Wind", num(25.0), slider(-5000.0, 5000.0, -500.0, 500.0, 1)),
+                p("windVariation", "Variation % (Wind)", num(50.0), pct()),
+                p("spread", "Spread", num(0.0), slider(0.0, 1000.0, 0.0, 100.0, 1)),
+                p("wiggle/wiggleAmount", "Amount", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
+                p("wiggle/wiggleAmountVariation", "Variation % (Amount)", num(50.0), pct()),
+                p("wiggle/wiggleFrequency", "Frequency", num(1.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("wiggle/wiggleFrequencyVariation", "Variation % (Frequency)", num(50.0), pct()),
+                p("color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("opacity", "Opacity", num(100.0), pct()),
+                p("transferMode", "Transfer Mode", Value::Enum(0), transfer()),
+                p("compositeWithOriginal", "Composite With Original", Value::Bool(true), ParamUi::Checkbox),
+                p("extras/offset", "Offset", pt(0.5, 0.5), ParamUi::Point),
+                p("extras/randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
+            ],
+            snowfall,
+        ),
+        spec(
+            "ec.sim.ccbubbles",
+            "Bubbles",
+            vec![
+                p("bubbleAmount", "Bubble Amount", num(100.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
+                p("bubbleSpeed", "Bubble Speed", num(0.5), slider(-10.0, 10.0, -2.0, 2.0, 2)),
+                p("wobbleAmplitude", "Wobble Amplitude", num(5.0), slider(0.0, 500.0, 0.0, 100.0, 1)),
+                p("wobbleFrequency", "Wobble Frequency", num(1.0), slider(0.0, 50.0, 0.0, 10.0, 2)),
+                p("bubbleSize", "Bubble Size", num(1.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("reflectionType", "Reflection Type", Value::Enum(0), popup(&["Liquid", "Metal"])),
+                p("shadingType", "Shading Type", Value::Enum(0), popup(&["None", "Lighten", "Darken", "Fade Inwards", "Fade Outwards"])),
+            ],
+            bubbles,
+        ),
+        spec(
+            "ec.sim.ccdrizzle",
+            "Water Ripples",
+            vec![
+                p("dripRate", "Drip Rate", num(10.0), slider(0.0, 200.0, 0.0, 50.0, 2)),
+                p("longevity", "Longevity (sec)", num(1.0), slider(0.0, 30.0, 0.0, 5.0, 2)),
+                p("rippling", "Rippling", num(360.0), ParamUi::Angle),
+                p("displacement", "Displacement", num(5.0), slider(0.0, 100.0, 0.0, 30.0, 2)),
+                p("rippleHeight", "Ripple Height", num(30.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("spreading", "Spreading", num(100.0), slider(0.0, 1000.0, 0.0, 300.0, 1)),
+                p("light/lightIntensity", "Light Intensity", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
+                p("light/lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("light/lightHeight", "Light Height", num(25.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
+                p("light/lightDirection", "Light Direction", num(-45.0), ParamUi::Angle),
+                p("shading/ambient", "Ambient", num(0.0), slider(-200.0, 200.0, -100.0, 100.0, 1)),
+                p("shading/diffuse", "Diffuse", num(0.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("shading/specular", "Specular", num(20.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("shading/roughness", "Roughness", num(0.05), slider(0.001, 1.0, 0.001, 0.5, 3)),
+            ],
+            drizzle,
+        ),
+        spec(
+            "ec.sim.ccstarburst",
+            "Starfield",
+            vec![
+                p("scatter", "Scatter", num(100.0), slider(0.0, 1000.0, 0.0, 300.0, 1)),
+                p("speed", "Speed", num(1.0), slider(-10.0, 10.0, -4.0, 4.0, 2)),
+                p("phase", "Phase", num(0.0), ParamUi::Angle),
+                p("gridSpacing", "Grid Spacing", num(2.0), slider(1.0, 100.0, 1.0, 20.0, 0)),
+                p("size", "Size", num(100.0), slider(0.0, 1000.0, 0.0, 300.0, 1)),
+                p("blendWithOriginal", "Blend w. Original", num(0.0), pct()),
+            ],
+            star_burst,
+        ),
+        spec(
+            "ec.sim.ccparticleworld",
+            "Particle Emitter 3D",
+            vec![
+                p("birthRate", "Birth Rate", num(0.5), slider(0.0, 100.0, 0.0, 10.0, 2)),
+                p("longevity", "Longevity (sec)", num(1.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
+                p("producer/producerX", "Position X", num(0.0), slider(-10.0, 10.0, -1.0, 1.0, 2)),
+                p("producer/producerY", "Position Y", num(0.0), slider(-10.0, 10.0, -1.0, 1.0, 2)),
+                p("producer/producerZ", "Position Z", num(0.0), slider(-10.0, 10.0, -1.0, 1.0, 2)),
+                p("producer/radiusX", "Radius X", num(0.025), slider(0.0, 10.0, 0.0, 1.0, 3)),
+                p("producer/radiusY", "Radius Y", num(0.025), slider(0.0, 10.0, 0.0, 1.0, 3)),
+                p("producer/radiusZ", "Radius Z", num(0.025), slider(0.0, 10.0, 0.0, 1.0, 3)),
+                p("physics/animation", "Animation", Value::Enum(0), popup(PW_ANIMS)),
+                p("physics/velocity", "Velocity", num(1.0), slider(-10.0, 10.0, 0.0, 5.0, 2)),
+                p("physics/inheritVelocity", "Inherit Velocity %", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
+                p("physics/gravity", "Gravity", num(0.5), slider(-10.0, 10.0, -2.0, 2.0, 3)),
+                p("physics/resistance", "Resistance", num(0.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("physics/extra", "Extra", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 2)),
+                p("physics/extraAngle", "Extra Angle", num(360.0), ParamUi::Angle),
+                p("physics/directionAxis/axisX", "Axis X", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
+                p("physics/directionAxis/axisY", "Axis Y", num(-1.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
+                p("physics/directionAxis/axisZ", "Axis Z", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
+                p("physics/gravityVector/gravityX", "Gravity X", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
+                p("physics/gravityVector/gravityY", "Gravity Y", num(1.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
+                p("physics/gravityVector/gravityZ", "Gravity Z", num(0.0), slider(-1.0, 1.0, -1.0, 1.0, 2)),
+                p("particle/particleType", "Particle Type", Value::Enum(0), popup(PARTICLE_TYPES)),
+                p(PW_TEXTURE_LAYER, "Texture Layer", Value::Layer(None), ParamUi::Layer),
+                p("particle/birthSize", "Birth Size", num(0.2), slider(0.0, 10.0, 0.0, 1.0, 3)),
+                p("particle/deathSize", "Death Size", num(0.2), slider(0.0, 10.0, 0.0, 1.0, 3)),
+                p("particle/sizeVariation", "Size Variation", num(0.0), pct()),
+                p("particle/maxOpacity", "Max Opacity", num(75.0), pct()),
+                p("particle/birthColor", "Birth Color", col(1.0, 1.0, 0.0), ParamUi::Color),
+                p("particle/deathColor", "Death Color", col(0.6, 0.0, 0.0), ParamUi::Color),
+                p("particle/transferMode", "Transfer Mode", Value::Enum(0), popup(&["Composite", "Screen", "Add", "Black Matte"])),
+                p("extras/effectCamera/distance", "Distance", num(2.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
+                p("extras/effectCamera/rotationX", "Rotation X", num(0.0), ParamUi::Angle),
+                p("extras/effectCamera/rotationY", "Rotation Y", num(0.0), ParamUi::Angle),
+                p("extras/effectCamera/rotationZ", "Rotation Z", num(0.0), ParamUi::Angle),
+                p("extras/effectCamera/fov", "FOV", num(PW_FOV), slider(1.0, 179.0, 10.0, 120.0, 1)),
+                p("extras/randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
+            ],
+            particle_world,
+        ),
+        spec(
+            "ec.sim.ccparticlesystems2",
+            "Particle Emitter 2D",
+            vec![
+                p("birthRate", "Birth Rate", num(2.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
+                p("longevity", "Longevity (sec)", num(1.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
+                p("producer/position", "Position", pt(0.5, 0.5), ParamUi::Point),
+                p("producer/radiusX", "Radius X", num(0.0), slider(0.0, 2000.0, 0.0, 200.0, 1)),
+                p("producer/radiusY", "Radius Y", num(0.0), slider(0.0, 2000.0, 0.0, 200.0, 1)),
+                p("physics/animation", "Animation", Value::Enum(0), popup(PW_ANIMS)),
+                p("physics/velocity", "Velocity", num(2.0), slider(-20.0, 20.0, 0.0, 10.0, 2)),
+                p("physics/inheritVelocity", "Inherit Velocity %", num(0.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
+                p("physics/gravity", "Gravity", num(1.0), slider(-20.0, 20.0, -5.0, 5.0, 2)),
+                p("physics/resistance", "Resistance", num(0.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("physics/direction", "Direction", num(0.0), ParamUi::Angle),
+                p("physics/extra", "Extra", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 2)),
+                p("particle/particleType", "Particle Type", Value::Enum(0), popup(PARTICLE_TYPES)),
+                p("particle/birthSize", "Birth Size", num(0.5), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("particle/deathSize", "Death Size", num(1.5), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("particle/sizeVariation", "Size Variation", num(0.0), pct()),
+                p("particle/maxOpacity", "Max Opacity", num(75.0), pct()),
+                p("particle/birthColor", "Birth Color", col(1.0, 1.0, 0.0), ParamUi::Color),
+                p("particle/deathColor", "Death Color", col(0.6, 0.0, 0.0), ParamUi::Color),
+                p("particle/transferMode", "Transfer Mode", Value::Enum(0), popup(&["Composite", "Screen", "Add", "Black Matte"])),
+                p("randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
+            ],
+            particle_systems2,
+        ),
+        spec(
+            "ec.sim.ccmrmercury",
+            "Liquid Particles",
+            vec![
+                p("radiusX", "Radius X", num(50.0), slider(0.0, 2000.0, 0.0, 300.0, 1)),
+                p("radiusY", "Radius Y", num(50.0), slider(0.0, 2000.0, 0.0, 300.0, 1)),
+                p("producer", "Producer", pt(0.5, 0.5), ParamUi::Point),
+                p("direction", "Direction", num(0.0), ParamUi::Angle),
+                p("velocity", "Velocity", num(1.0), slider(-20.0, 20.0, 0.0, 5.0, 2)),
+                p("birthRate", "Birth Rate", num(1.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("longevity", "Longevity (sec)", num(2.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
+                p("gravity", "Gravity", num(0.5), slider(-20.0, 20.0, -5.0, 5.0, 2)),
+                p("resistance", "Resistance", num(0.0), slider(0.0, 20.0, 0.0, 5.0, 2)),
+                p("extra", "Extra", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 2)),
+                p("animation", "Animation", Value::Enum(0), popup(PW_ANIMS)),
+                p("blobInfluence", "Blob Influence", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
+                p("blobBirthSize", "Blob Birth Size", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 2)),
+                p("blobDeathSize", "Blob Death Size", num(0.25), slider(0.0, 10.0, 0.0, 2.0, 2)),
+                p("light/lightIntensity", "Light Intensity", num(100.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
+                p("light/lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("light/lightHeight", "Light Height", num(50.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
+                p("light/lightDirection", "Light Direction", num(-45.0), ParamUi::Angle),
+                p("shading/ambient", "Ambient", num(0.0), slider(-200.0, 200.0, -100.0, 100.0, 1)),
+                p("shading/diffuse", "Diffuse", num(75.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("shading/specular", "Specular", num(50.0), slider(0.0, 200.0, 0.0, 100.0, 1)),
+                p("shading/roughness", "Roughness", num(0.05), slider(0.001, 1.0, 0.001, 0.5, 3)),
+                p("shading/metal", "Metal", num(100.0), pct()),
+            ],
+            mr_mercury,
+        ),
+    ]
+}
diff --git a/crates/effects/src/sim/sprites.rs b/crates/effects/src/sim/sprites.rs
new file mode 100644
index 000000000..55ba594b4
--- /dev/null
+++ b/crates/effects/src/sim/sprites.rs
@@ -0,0 +1,361 @@
+use super::{Buf, Image, IndexedParallelIterator, IntoParallelRefIterator, IntoParallelRefMutIterator, ParallelIterator, ParallelSliceMut, Px, unpremul};
+
+// ------------------------------------------------------------------ band rasteriser
+
+const BAND: usize = 16;
+
+/// How rasterised items combine with what is already in the target.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Acc {
+    /// Premultiplied "over" (later items on top).
+    Over,
+    /// Additive (glows, light).
+    Add,
+}
+
+/// Rasterise many small items into `img` (buffer pixels). `bbox` gives an item's pixel bounds
+/// `[x0, y0, x1, y1]` (or `None` to skip), `shade` its premultiplied colour at a pixel centre.
+/// Items are bucketed into horizontal bands rendered in parallel; within a band they are drawn
+/// in slice order.
+pub(crate) fn raster<T: Sync>(
+    img: &mut Image,
+    items: &[T],
+    bbox: impl Fn(&T) -> Option<[f32; 4]> + Sync,
+    shade: impl Fn(&T, f32, f32) -> Option<Px> + Sync,
+    acc: Acc,
+) {
+    let (w, hgt) = (img.width as usize, img.height as usize);
+    if w == 0 || hgt == 0 || items.is_empty() {
+        return;
+    }
+    let nb = hgt.div_ceil(BAND);
+    let boxes: Vec<Option<[i32; 4]>> = items
+        .par_iter()
+        .map(|it| {
+            let b = bbox(it)?;
+            if !(b[0].is_finite() && b[1].is_finite() && b[2].is_finite() && b[3].is_finite()) {
+                return None;
+            }
+            let x0 = b[0].floor().max(0.0) as i32;
+            let y0 = b[1].floor().max(0.0) as i32;
+            let x1 = (b[2].ceil() as i32).min(w as i32 - 1);
+            let y1 = (b[3].ceil() as i32).min(hgt as i32 - 1);
+            if x1 < x0 || y1 < y0 || b[2] < 0.0 || b[3] < 0.0 {
+                return None;
+            }
+            Some([x0, y0, x1, y1])
+        })
+        .collect();
+    let mut buckets: Vec<Vec<u32>> = vec![Vec::new(); nb];
+    for (i, b) in boxes.iter().enumerate() {
+        if let Some(b) = b {
+            for band in (b[1] as usize / BAND)..=(b[3] as usize / BAND).min(nb - 1) {
+                buckets[band].push(i as u32);
+            }
+        }
+    }
+    img.data.par_chunks_mut(w * BAND).enumerate().for_each(|(band, chunk)| {
+        let by0 = band * BAND;
+        let rows = chunk.len() / w;
+        for &i in &buckets[band] {
+            let Some(b) = boxes[i as usize] else { continue };
+            let it = &items[i as usize];
+            let ya = (b[1] as usize).max(by0);
+            let yb = (b[3] as usize).min(by0 + rows - 1);
+            for y in ya..=yb {
+                let row = &mut chunk[(y - by0) * w..(y - by0 + 1) * w];
+                for x in b[0] as usize..=b[2] as usize {
+                    if let Some(c) = shade(it, x as f32 + 0.5, y as f32 + 0.5) {
+                        let d = &mut row[x];
+                        match acc {
+                            Acc::Over => {
+                                let k = 1.0 - c[3];
+                                *d = [c[0] + d[0] * k, c[1] + d[1] * k, c[2] + d[2] * k, c[3] + d[3] * k];
+                            }
+                            Acc::Add => {
+                                *d = [d[0] + c[0], d[1] + c[1], d[2] + c[2], (d[3] + c[3]).min(1.0)];
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    });
+}
+
+// ------------------------------------------------------------------ sprites
+
+#[derive(Clone, Copy, PartialEq, Debug)]
+pub enum Shape {
+    /// Soft round dot (Gaussian-like falloff).
+    Soft,
+    /// Hard anti-aliased disc.
+    Disc,
+    /// Lit sphere (upper-left light, specular).
+    Sphere,
+    /// Disc fading linearly to its rim.
+    Faded,
+    /// Thin ring with a highlight.
+    Bubble,
+    /// Four-point star.
+    Star,
+    /// Rotated square (angle in `rot`).
+    Square,
+    /// Triangle (angle in `rot`).
+    Tri,
+    /// Segment from (x, y) by (dx, dy), half-width `r`.
+    Line { dx: f32, dy: f32 },
+}
+
+/// A particle sprite in buffer pixels; `c` is straight colour + opacity.
+#[derive(Clone, Copy, Debug)]
+pub struct Sprite {
+    pub x: f32,
+    pub y: f32,
+    pub r: f32,
+    pub c: [f32; 4],
+    pub shape: Shape,
+    pub rot: f32,
+}
+
+impl Sprite {
+    pub(crate) fn new(x: f32, y: f32, r: f32, c: [f32; 4], shape: Shape) -> Sprite {
+        Sprite { x, y, r, c, shape, rot: 0.0 }
+    }
+}
+
+/// Where a sprite's colour comes from when it depends on the layer's pixels (resolved by
+/// [`SpritePlan::resolve`] on the CPU, per pixel by the GPU compositor). Positions are buffer
+/// pixels.
+#[derive(Clone, Copy, Debug)]
+pub enum Tint {
+    /// The sprite's own colour.
+    Fixed,
+    /// CC Rainfall's refracting drops: where the layer shows (alpha > 0), colour × (layer
+    /// colour × 0.6 + 0.5) sampled at (x, y).
+    Refract { x: f64, y: f64 },
+    /// CC Star Burst: the layer's colour at (x, y), opacity × its alpha (none where clear).
+    Source { x: f64, y: f64 },
+    /// CC Hair: the root's colour at (x, y) mixed with the hair colour (`inherit` = 1 keeps the
+    /// root's), × `shade`, + `spec`; no strand where the root's alpha is below ½.
+    Root { x: f64, y: f64, hair: [f32; 3], inherit: f32, shade: f32, spec: f32 },
+}
+
+/// How a sprite layer meets the original layer.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Post {
+    /// `combine` with this mode (0 Composite … 5 sprites only).
+    Combine(u32),
+    /// The sprites alone.
+    Replace,
+    /// The sprites, mixed toward the original by this fraction.
+    Lerp(f32),
+    /// The sprites over opaque black.
+    OverBlack,
+}
+
+/// What a sprite-drawing effect draws this frame: built on the CPU (closed-form or from the
+/// simulation state), rasterised by [`SpritePlan::finish`] or the GPU compositor.
+#[derive(Clone, Debug)]
+pub struct SpritePlan {
+    pub sprites: Vec<Sprite>,
+    /// Per sprite (empty = all [`Tint::Fixed`]).
+    pub tints: Vec<Tint>,
+    pub acc: Acc,
+    pub post: Post,
+}
+
+impl SpritePlan {
+    /// Resolve layer-dependent colours against the layer `src`.
+    pub fn resolve(&mut self, src: &Image) {
+        let tints = std::mem::take(&mut self.tints);
+        self.sprites.par_iter_mut().zip(tints.par_iter()).for_each(|(sp, t)| match *t {
+            Tint::Fixed => {}
+            Tint::Refract { x, y } => {
+                let (sc, sa) = unpremul(src.sample_bilinear(x, y));
+                if sa > 0.0 {
+                    let c = sp.c;
+                    sp.c = [(sc[0] * 0.6 + 0.5) * c[0], (sc[1] * 0.6 + 0.5) * c[1], (sc[2] * 0.6 + 0.5) * c[2], c[3]];
+                }
+            }
+            Tint::Source { x, y } => {
+                let (c, a) = unpremul(src.sample_bilinear(x, y));
+                sp.c = if a <= 0.0 { [0.0; 4] } else { [c[0], c[1], c[2], a * sp.c[3]] };
+            }
+            Tint::Root { x, y, hair, inherit, shade, spec } => {
+                let root = src.sample_bilinear(x, y);
+                if root[3] < 0.5 {
+                    sp.c = [0.0; 4];
+                    return;
+                }
+                let (rc, _) = unpremul(root);
+                let base: [f32; 3] = std::array::from_fn(|k| rc[k] + (hair[k] - rc[k]) * (1.0 - inherit));
+                sp.c = [base[0] * shade + spec, base[1] * shade + spec, base[2] * shade + spec, sp.c[3]];
+            }
+        });
+    }
+
+    /// Rasterise (after [`SpritePlan::resolve`]) and meet the original layer `b`.
+    pub fn finish(&self, b: Buf) -> Buf {
+        let fx = splat(b.img.width, b.img.height, &self.sprites, self.acc);
+        self.finish_with(b, fx)
+    }
+
+    /// [`finish`](Self::finish) with a prepared sprite image (the motion-blurred average of
+    /// several frames, #1195).
+    pub fn finish_with(&self, b: Buf, fx: Image) -> Buf {
+        self.post.apply(b, fx)
+    }
+}
+
+impl Post {
+    /// Meet the sprite image `fx` with the original layer `b` (see [`SpritePlan::finish`]).
+    pub(super) fn apply(self, mut b: Buf, fx: Image) -> Buf {
+        b.img = match self {
+            Post::Combine(m) => combine(&b.img, &fx, m),
+            Post::Replace => fx,
+            Post::Lerp(t) => {
+                let mut o = fx;
+                o.data.par_iter_mut().zip(b.img.data.par_iter()).for_each(|(o, s0)| *o = crate::util::lerp4(*o, *s0, t));
+                o
+            }
+            Post::OverBlack => combine(&Image::filled(b.img.width, b.img.height, [0.0, 0.0, 0.0, 1.0]), &fx, 0),
+        };
+        b
+    }
+}
+
+pub(super) fn sprite_bbox(s: &Sprite) -> Option<[f32; 4]> {
+    if s.c[3] <= 1e-5 || s.r <= 0.0 {
+        return None;
+    }
+    let r = s.r.max(0.5) + 1.0;
+    Some(match s.shape {
+        Shape::Line { dx, dy } => [s.x.min(s.x + dx) - r, s.y.min(s.y + dy) - r, s.x.max(s.x + dx) + r, s.y.max(s.y + dy) + r],
+        Shape::Star => [s.x - r * 2.0, s.y - r * 2.0, s.x + r * 2.0, s.y + r * 2.0],
+        _ => [s.x - r, s.y - r, s.x + r, s.y + r],
+    })
+}
+
+#[inline]
+pub(super) fn aa(edge: f32) -> f32 {
+    (edge + 0.5).clamp(0.0, 1.0)
+}
+
+fn sprite_shade(s: &Sprite, x: f32, y: f32) -> Option<Px> {
+    // Sub-pixel sprites keep their energy: draw at radius 0.5 with reduced opacity.
+    let (r, fade) = if s.r < 0.5 { (0.5, s.r / 0.5) } else { (s.r, 1.0) };
+    let (dx, dy) = (x - s.x, y - s.y);
+    let mut rgb = [s.c[0], s.c[1], s.c[2]];
+    let cov = match s.shape {
+        Shape::Soft => {
+            let d2 = (dx * dx + dy * dy) / (r * r);
+            if d2 >= 1.0 {
+                return None;
+            }
+            let q = 1.0 - d2;
+            q * q
+        }
+        Shape::Disc => aa(r - (dx * dx + dy * dy).sqrt()),
+        Shape::Faded => {
+            let d = (dx * dx + dy * dy).sqrt() / r;
+            (1.0 - d).max(0.0).powf(1.5)
+        }
+        Shape::Sphere => {
+            let d = (dx * dx + dy * dy).sqrt();
+            let cv = aa(r - d);
+            if cv <= 0.0 {
+                return None;
+            }
+            let (nx, ny) = (dx / r, dy / r);
+            let nz = (1.0 - nx * nx - ny * ny).max(0.0).sqrt();
+            let (lx, ly, lz) = (-0.48, -0.58, 0.66);
+            let diff = (nx * lx + ny * ly + nz * lz).max(0.0);
+            let rz = 2.0 * diff * nz - lz;
+            let spec = rz.max(0.0).powi(20) * 0.6;
+            let k = 0.2 + 0.8 * diff;
+            rgb = [rgb[0] * k + spec, rgb[1] * k + spec, rgb[2] * k + spec];
+            cv
+        }
+        Shape::Bubble => {
+            let d = (dx * dx + dy * dy).sqrt() / r;
+            if d > 1.0 + 1.0 / r {
+                return None;
+            }
+            let ring = (1.0 - ((d - 0.9) / 0.12).powi(2)).max(0.0);
+            let hl = (1.0 - (((dx / r) + 0.4).powi(2) + ((dy / r) + 0.4).powi(2)) / 0.04).max(0.0);
+            (0.12 * (d <= 1.0) as u8 as f32 + ring * 0.8 + hl).min(1.0)
+        }
+        Shape::Star => {
+            let (sn, cs) = s.rot.sin_cos();
+            let (ux, uy) = ((dx * cs + dy * sn) / r, (-dx * sn + dy * cs) / r);
+            let d = (ux * ux + uy * uy).sqrt();
+            let core = (1.0 - d).max(0.0).powi(2);
+            let sx = (1.0 - ux.abs() / 2.0).max(0.0) * (1.0 - (uy.abs() * 6.0)).max(0.0);
+            let sy = (1.0 - uy.abs() / 2.0).max(0.0) * (1.0 - (ux.abs() * 6.0)).max(0.0);
+            (core + sx + sy).min(1.0)
+        }
+        Shape::Square => {
+            let (sn, cs) = s.rot.sin_cos();
+            let (ux, uy) = (dx * cs + dy * sn, -dx * sn + dy * cs);
+            let e = r * 0.75;
+            aa(e - ux.abs()) * aa(e - uy.abs())
+        }
+        Shape::Tri => {
+            let (sn, cs) = s.rot.sin_cos();
+            let (ux, uy) = (dx * cs + dy * sn, -dx * sn + dy * cs);
+            // Equilateral triangle with circumradius r: three half-planes.
+            let e = r * 0.5;
+            let mut m = f32::INFINITY;
+            for k in 0..3 {
+                let a = std::f32::consts::FRAC_PI_2 + k as f32 * std::f32::consts::TAU / 3.0;
+                let (ns, nc) = a.sin_cos();
+                m = m.min(e - (ux * nc + uy * ns));
+            }
+            aa(m)
+        }
+        Shape::Line { dx: lx, dy: ly } => {
+            let l2 = lx * lx + ly * ly;
+            let t = if l2 > 0.0 { ((dx * lx + dy * ly) / l2).clamp(0.0, 1.0) } else { 0.0 };
+            let (px, py) = (dx - lx * t, dy - ly * t);
+            aa(r - (px * px + py * py).sqrt())
+        }
+    };
+    let a = cov * s.c[3] * fade;
+    if a <= 1e-6 {
+        return None;
+    }
+    Some([rgb[0] * a, rgb[1] * a, rgb[2] * a, a])
+}
+
+/// Draw sprites into a new transparent image of `w`×`h`.
+pub(crate) fn splat(w: u32, hgt: u32, sprites: &[Sprite], acc: Acc) -> Image {
+    let mut img = Image::new(w, hgt);
+    raster(&mut img, sprites, sprite_bbox, sprite_shade, acc);
+    img
+}
+
+/// Combine an effect layer `fx` with the original `src` (both premultiplied, same size):
+/// 0 Composite (fx over src), 1 Screen, 2 Add, 3 Lighten, 4 Darken, 5 fx only.
+pub(crate) fn combine(src: &Image, fx: &Image, mode: u32) -> Image {
+    let mut out = fx.clone();
+    out.data.par_iter_mut().zip(src.data.par_iter()).for_each(|(o, s)| {
+        let f = *o;
+        *o = match mode {
+            0 => {
+                let k = 1.0 - f[3];
+                [f[0] + s[0] * k, f[1] + s[1] * k, f[2] + s[2] * k, f[3] + s[3] * k]
+            }
+            1 => [s[0] + f[0] - s[0] * f[0], s[1] + f[1] - s[1] * f[1], s[2] + f[2] - s[2] * f[2], s[3] + f[3] - s[3] * f[3]],
+            2 => [s[0] + f[0], s[1] + f[1], s[2] + f[2], (s[3] + f[3]).min(1.0)],
+            3 => [s[0].max(f[0]), s[1].max(f[1]), s[2].max(f[2]), s[3] + f[3] - s[3] * f[3]],
+            4 => {
+                let (fc, fa) = unpremul(f);
+                let m = |c: f32, k: usize| c - (c - c.min(fc[k] * s[3])) * fa;
+                [m(s[0], 0), m(s[1], 1), m(s[2], 2), s[3]]
+            }
+            _ => f,
+        };
+    });
+    out
+}
diff --git a/crates/effects/src/sim/tests.rs b/crates/effects/src/sim/tests.rs
new file mode 100644
index 000000000..4c708dae4
--- /dev/null
+++ b/crates/effects/src/sim/tests.rs
@@ -0,0 +1,828 @@
+use super::*;
+use crate::{EffectEnv, run_fx};
+
+fn grey(w: u32, hh: u32) -> Image {
+    Image::filled(w, hh, [0.2, 0.2, 0.2, 1.0])
+}
+
+fn ramp(w: u32, hh: u32) -> Image {
+    let mut img = Image::new(w, hh);
+    for y in 0..hh {
+        for x in 0..w {
+            img.set(x, y, [x as f32 / w as f32, y as f32 / hh as f32, 0.4, 1.0]);
+        }
+    }
+    img
+}
+
+fn run(id: &str, vals: &[(&str, Value)], img: Image, t: f64) -> Image {
+    run_fx(id, vals, img, t, EffectEnv::default()).img
+}
+
+fn diff(a: &Image, b: &Image) -> f32 {
+    a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|k| (p[k] - q[k]).abs()).sum::<f32>()).sum()
+}
+
+/// Centre of mass (luminance-weighted difference from `base`), `[-1, -1]` when equal.
+fn mass(img: &Image, base: &Image) -> [f32; 2] {
+    let (mut m, mut sx, mut sy) = (0.0, 0.0, 0.0);
+    for y in 0..img.height {
+        for x in 0..img.width {
+            let i = img.idx(x, y);
+            let d: f32 = (0..3).map(|k| (img.data[i][k] - base.data[i][k]).abs()).sum();
+            m += d;
+            sx += d * x as f32;
+            sy += d * y as f32;
+        }
+    }
+    if m > 0.0 { [sx / m, sy / m] } else { [-1.0; 2] }
+}
+
+/// [`mass`] in y.
+fn mass_y(img: &Image, base: &Image) -> f32 {
+    mass(img, base)[1]
+}
+
+#[test]
+fn rasteriser_over_and_add() {
+    let s = [Sprite::new(5.0, 5.0, 2.0, [1.0, 0.0, 0.0, 1.0], Shape::Disc)];
+    let img = splat(10, 40, &s, Acc::Over);
+    assert!(img.get(5, 5)[0] > 0.99 && img.get(9, 30)[3] == 0.0);
+    let two = [s[0], s[0]];
+    let add = splat(10, 40, &two, Acc::Add);
+    assert!(add.get(5, 5)[0] > 1.9);
+    // Items spanning band boundaries are drawn in every band.
+    let tall = [Sprite::new(5.0, 16.0, 6.0, [0.0, 1.0, 0.0, 1.0], Shape::Square)];
+    let t = splat(10, 40, &tall, Acc::Over);
+    assert!(t.get(5, 13)[1] > 0.9 && t.get(5, 18)[1] > 0.9);
+}
+
+#[test]
+fn rainfall_deterministic_and_falls() {
+    let vals = [("drops", num(200.0)), ("opacity", num(100.0)), ("extras/appearance", Value::Enum(1)), ("color", col(1.0, 1.0, 1.0))];
+    let a = run("ec.sim.ccrainfall", &vals, grey(40, 40), 0.5);
+    let b = run("ec.sim.ccrainfall", &vals, grey(40, 40), 0.5);
+    assert_eq!(a, b);
+    assert!(diff(&a, &grey(40, 40)) > 1.0, "drops visible");
+    let none = run("ec.sim.ccrainfall", &[("drops", num(0.0))], grey(40, 40), 0.5);
+    assert_eq!(none, grey(40, 40));
+    let later = run("ec.sim.ccrainfall", &vals, grey(40, 40), 0.52);
+    assert!(diff(&a, &later) > 0.1, "rain moves");
+}
+
+#[test]
+fn snowfall_deterministic_and_moves() {
+    let vals = [("flakes", num(300.0))];
+    let a = run("ec.sim.ccsnowfall", &vals, grey(40, 40), 1.0);
+    assert_eq!(a, run("ec.sim.ccsnowfall", &vals, grey(40, 40), 1.0));
+    assert!(diff(&a, &grey(40, 40)) > 1.0);
+    assert!(diff(&a, &run("ec.sim.ccsnowfall", &vals, grey(40, 40), 1.2)) > 0.1);
+    let off = run("ec.sim.ccsnowfall", &[("flakes", num(300.0)), ("compositeWithOriginal", Value::Bool(false))], grey(40, 40), 1.0);
+    assert!(off.data.iter().any(|p| p[3] == 0.0), "without original the background is transparent");
+}
+
+#[test]
+fn bubbles_rise() {
+    let vals = [("bubbleAmount", num(30.0)), ("bubbleSize", num(3.0))];
+    let a = run("ec.sim.ccbubbles", &vals, ramp(40, 40), 0.3);
+    assert_eq!(a, run("ec.sim.ccbubbles", &vals, ramp(40, 40), 0.3));
+    assert!(a.data.iter().any(|p| p[3] > 0.5));
+    let none = run("ec.sim.ccbubbles", &[("bubbleAmount", num(0.0))], ramp(40, 40), 0.3);
+    assert!(none.data.iter().all(|p| p[3] == 0.0), "bubbles replace the layer");
+    // A single slow bubble moves up over a short time.
+    let one = [("bubbleAmount", num(1.0)), ("bubbleSize", num(4.0)), ("wobbleAmplitude", num(0.0)), ("bubbleSpeed", num(0.2))];
+    let blank = Image::new(40, 40);
+    let y0 = mass_y(&run("ec.sim.ccbubbles", &one, ramp(40, 40), 0.0), &blank);
+    let y1 = mass_y(&run("ec.sim.ccbubbles", &one, ramp(40, 40), 0.1), &blank);
+    assert!(y0 >= 0.0 && y1 >= 0.0 && (y1 < y0 || y0 < 8.0), "{y0} -> {y1}");
+}
+
+/// #2024: bubbles near the layer's edges show its edge pixels, not the pale colour that stands
+/// in for transparent ones.
+#[test]
+fn bubbles_near_edges_show_the_layer() {
+    let blue = Image::filled(40, 40, [0.0, 0.0, 1.0, 1.0]);
+    let pale = [0, 1].map(|reflection| {
+        let vals = [("bubbleAmount", num(200.0)), ("bubbleSize", num(3.0)), ("reflectionType", Value::Enum(reflection))];
+        let a = run("ec.sim.ccbubbles", &vals, blue.clone(), 0.3);
+        assert!(a.data.iter().any(|p| p[3] > 0.5), "bubbles drawn");
+        // Blue plus the white highlight keeps blue − red = alpha; the pale colour leaves 0.2 · alpha.
+        a.data.iter().filter(|p| (p[2] - p[0] - p[3]).abs() > 1e-4).count()
+    });
+    assert_eq!(pale, [0, 0], "pale bubble pixels (liquid, metal)");
+}
+
+/// CC Bubbles on a 40 × 40 layer `img` at `scale`, in a buffer padded by 6 transparent pixels
+/// (a half-resolution preview's layout).
+fn padded_bubbles(img: Image, scale: f64, reflection: u32) -> Image {
+    let size = 40.0;
+    let s = crate::find("ec.sim.ccbubbles").unwrap();
+    let mut params = crate::Params { values: s.params.iter().map(|p| (p.id.to_string(), crate::default_value(p, [size; 2]))).collect() };
+    for (k, v) in [("bubbleAmount", num(200.0)), ("bubbleSize", num(3.0)), ("reflectionType", Value::Enum(reflection))] {
+        params.values.insert(k.into(), v);
+    }
+    let ctx = EffectCtx { params: &params, time: 0.3, layer_size: [size; 2], seed: 1, adjustment: false, env: EffectEnv::default() };
+    let mut b = Buf { img, offset: [0.0; 2], scale };
+    b.pad(6);
+    crate::apply(s, &ctx, b).img
+}
+
+/// #2024: the same when the buffer has transparent padding around the layer: samples past the
+/// layer's edges repeat its edge pixels, not the padding, and a clear hole inside the layer is
+/// still refracted as the pale colour.
+#[test]
+fn bubbles_near_padded_edges_show_the_layer() {
+    let blue = |side| Image::filled(side, side, [0.0, 0.0, 1.0, 1.0]);
+    let pale = |img: &Image| img.data.iter().filter(|p| (p[2] - p[0] - p[3]).abs() > 1e-4).count();
+    for (scale, side) in [(1.0, 40), (0.5, 20)] {
+        let counts = [0, 1].map(|reflection| {
+            let a = padded_bubbles(blue(side), scale, reflection);
+            assert!(a.data.iter().any(|p| p[3] > 0.5), "bubbles drawn");
+            pale(&a)
+        });
+        assert_eq!(counts, [0, 0], "pale bubble pixels at scale {scale} (liquid, metal)");
+    }
+    let mut holed = blue(40);
+    for y in 12..28 {
+        for x in 12..28 {
+            holed.set(x, y, [0.0; 4]);
+        }
+    }
+    assert!(pale(&padded_bubbles(holed, 1.0, 0)) > 0, "the hole refracts as the pale colour");
+}
+
+#[test]
+fn drizzle_ripples() {
+    let a = run("ec.sim.ccdrizzle", &[], ramp(48, 48), 0.6);
+    assert_eq!(a, run("ec.sim.ccdrizzle", &[], ramp(48, 48), 0.6));
+    assert!(diff(&a, &ramp(48, 48)) > 0.1);
+    let none = run("ec.sim.ccdrizzle", &[("dripRate", num(0.0))], ramp(48, 48), 0.6);
+    assert_eq!(none, ramp(48, 48));
+}
+
+#[test]
+fn star_burst_moves_stars() {
+    let a = run("ec.sim.ccstarburst", &[("gridSpacing", num(4.0))], ramp(40, 40), 0.5);
+    assert_eq!(a, run("ec.sim.ccstarburst", &[("gridSpacing", num(4.0))], ramp(40, 40), 0.5));
+    assert!(a.data.iter().any(|p| p[3] > 0.0));
+    let b = run("ec.sim.ccstarburst", &[("gridSpacing", num(4.0))], ramp(40, 40), 0.9);
+    assert!(diff(&a, &b) > 0.5);
+    let full = run("ec.sim.ccstarburst", &[("blendWithOriginal", num(100.0))], ramp(40, 40), 0.5);
+    assert!(diff(&full, &ramp(40, 40)) < 1e-3);
+}
+
+fn pw_vals(seed: f64) -> Vec<(&'static str, Value)> {
+    vec![
+        ("birthRate", num(1.0)),
+        ("extras/randomSeed", num(seed)),
+        ("particle/particleType", Value::Enum(2)),
+        ("particle/birthSize", num(0.3)),
+        ("particle/deathSize", num(0.3)),
+    ]
+}
+
+/// #1195: with the comp's shutter open, the particles smear across it: the average of the
+/// sampled sprite fields differs from the sharp frame, touches more pixels and keeps the
+/// alpha energy.
+#[test]
+fn particle_world_motion_blur_trails() {
+    let v = pw_vals(21.0);
+    let blank = Image::new(40, 40);
+    let sharp = run("ec.sim.ccparticleworld", &v, blank.clone(), 2.0);
+    let blurred = crate::run_fx(
+        "ec.sim.ccparticleworld",
+        &v,
+        blank.clone(),
+        2.0,
+        EffectEnv { frame_rate: 10.0, shutter: Some((360.0, -180.0, 8)), ..Default::default() },
+    )
+    .img;
+    assert!(sharp.data.iter().any(|p| p[3] > 0.0), "sharp frame has particles");
+    assert_ne!(sharp.data, blurred.data, "the shutter smears the particles");
+    let lit = |img: &Image| img.data.iter().filter(|p| p[3] > 0.005).count();
+    let sum = |img: &Image| img.data.iter().map(|p| p[3]).sum::<f32>();
+    assert!(lit(&blurred) > lit(&sharp), "trails light more pixels: {} vs {}", lit(&blurred), lit(&sharp));
+    let (sa, ba) = (sum(&sharp), sum(&blurred));
+    assert!((ba - sa).abs() < sa * 0.6 + 1.0, "alpha energy roughly kept: {ba} vs {sa}");
+}
+
+#[test]
+fn particle_world_seek_consistent() {
+    let v = pw_vals(11.0);
+    let direct = run("ec.sim.ccparticleworld", &v, Image::new(40, 40), 2.0);
+    let v2 = pw_vals(12.0);
+    let _ = run("ec.sim.ccparticleworld", &v2, Image::new(40, 40), 1.0);
+    let stepped = run("ec.sim.ccparticleworld", &v2, Image::new(40, 40), 2.0);
+    let direct2 = run("ec.sim.ccparticleworld", &v2, Image::new(40, 40), 2.0);
+    assert_eq!(stepped, direct2);
+    assert!(direct.data.iter().any(|p| p[3] > 0.0), "particles alive");
+    // Before birth nothing is drawn.
+    let t0 = run("ec.sim.ccparticleworld", &v, Image::new(40, 40), 0.0);
+    assert!(t0.data.iter().all(|p| p[3] == 0.0));
+}
+
+#[test]
+fn engine_resume_equals_from_scratch() {
+    for anim in 0..PW_ANIMS.len() as u32 {
+        let phys = Phys {
+            rate: 90.0,
+            life: 1.5,
+            producer: [0.0; 3],
+            radius: [0.05; 3],
+            anim,
+            speed: 0.5,
+            gravity: [0.0, 0.5, 0.0],
+            resistance: 0.2,
+            axis: [0.0, -1.0, 0.0],
+            extra: 1.0,
+            extra_angle: 60.0,
+            seed: 9,
+            max: 10_000,
+            flat: anim % 2 == 0,
+        };
+        let a: SimCache<PState> = SimCache::new(2);
+        let b: SimCache<PState> = SimCache::new(2);
+        let direct = simulate(&a, 1, 2.0, &phys);
+        let _ = simulate(&b, 1, 1.0, &phys);
+        let _ = simulate(&b, 1, 0.37, &phys);
+        let resumed = simulate(&b, 1, 2.0, &phys);
+        assert_eq!(direct.parts.len(), resumed.parts.len(), "anim {anim}");
+        assert!(direct.parts.iter().zip(&resumed.parts).all(|(p, q)| p.p == q.p && p.v == q.v && p.id == q.id), "anim {anim}");
+        assert!(!direct.parts.is_empty());
+    }
+}
+
+#[test]
+fn particle_world_gravity_pulls_down() {
+    let base = |g: f64| {
+        vec![
+            ("birthRate", num(2.0)),
+            ("physics/velocity", num(0.2)),
+            ("physics/gravity", num(g)),
+            ("particle/particleType", Value::Enum(2)),
+            ("particle/birthSize", num(0.2)),
+            ("particle/deathSize", num(0.2)),
+            ("longevity", num(3.0)),
+        ]
+    };
+    let blank = Image::new(48, 48);
+    let up = mass_y(&run("ec.sim.ccparticleworld", &base(0.0), blank.clone(), 1.0), &blank);
+    let down = mass_y(&run("ec.sim.ccparticleworld", &base(2.0), blank.clone(), 1.0), &blank);
+    assert!(down > up + 2.0, "{up} {down}");
+}
+
+/// A comp whose camera is `camera` ([`crate::CompScene::camera`]); `layer`: a camera layer
+/// (else the comp's default view).
+struct Comp {
+    camera: [[f64; 4]; 3],
+    layer: bool,
+}
+impl crate::EffectHost for Comp {
+    fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+        None
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn comp_scene(&self) -> Option<crate::CompScene> {
+        Some(crate::CompScene { camera: Some(self.camera), camera_layer: self.layer, light: None })
+    }
+}
+
+/// A camera `d` px in front of layer point `c` looking at it, moved right by `dx` px and
+/// zoomed by `zoom` (1 = identity on the layer plane): `c + zoom·d·(p − c − dx) / (z + d)`.
+fn cam(c: [f64; 2], d: f64, dx: f64, zoom: f64) -> [[f64; 4]; 3] {
+    let k = zoom * d;
+    [[k, 0.0, c[0], d * c[0] - k * (c[0] + dx)], [0.0, k, c[1], d * c[1] - k * c[1]], [0.0, 0.0, 1.0, d]]
+}
+
+fn pw_in(comp: &Comp, vals: &[(&str, Value)]) -> Image {
+    run_fx("ec.sim.ccparticleworld", vals, Image::new(48, 48), 1.0, EffectEnv { host: Some(comp), ..Default::default() }).img
+}
+
+fn finite(img: &Image) -> bool {
+    img.data.iter().all(|p| p.iter().all(|c| c.is_finite()))
+}
+
+/// #397: with a camera layer in the comp, the particles are seen through it.
+#[test]
+fn particle_world_follows_the_comp_camera() {
+    let v = pw_vals(3.0);
+    let blank = Image::new(48, 48);
+    let here = Comp { camera: cam([24.0, 24.0], 96.0, 0.0, 1.0), layer: true };
+    let base = pw_in(&here, &v);
+    assert!(base.data.iter().any(|p| p[3] > 0.0), "particles alive");
+    // Moving the camera right moves the particles left.
+    let moved = pw_in(&Comp { camera: cam([24.0, 24.0], 96.0, 8.0, 1.0), ..here }, &v);
+    let (a, b) = (mass(&base, &blank), mass(&moved, &blank));
+    assert!(b[0] < a[0] - 4.0 && (b[1] - a[1]).abs() < 2.0, "{a:?} -> {b:?}");
+    // Zooming in spreads them out.
+    let zoomed = pw_in(&Comp { camera: cam([24.0, 24.0], 96.0, 0.0, 2.0), ..here }, &v);
+    let cover = |i: &Image| i.data.iter().filter(|p| p[3] > 0.01).count();
+    assert!(cover(&zoomed) > cover(&base), "{} {}", cover(&zoomed), cover(&base));
+    // The Effect Camera is ignored then.
+    let mut turned = v.clone();
+    turned.push(("extras/effectCamera/rotationY", num(60.0)));
+    assert_eq!(pw_in(&here, &turned), base);
+    // The comp's default view (no camera layer) leaves it to the Effect Camera.
+    let default_view = Comp { layer: false, ..here };
+    assert_eq!(pw_in(&default_view, &v), run("ec.sim.ccparticleworld", &v, blank.clone(), 1.0));
+    // A camera facing away, or a degenerate one, draws nothing and never NaN.
+    for camera in [[[96.0, 0.0, 24.0, 0.0], [0.0, 96.0, 24.0, 0.0], [0.0, 0.0, -1.0, -96.0]], [[0.0; 4]; 3], [[f64::NAN; 4]; 3]] {
+        assert_eq!(pw_in(&Comp { camera, layer: true }, &v), blank);
+    }
+    // A camera among the particles draws the ones in front of it.
+    let inside = pw_in(&Comp { camera: cam([24.0, 24.0], 1.0, 0.0, 1.0), ..here }, &v);
+    assert!(finite(&inside));
+}
+
+/// Extras ▸ Effect Camera: the defaults are the fixed camera Particle World always had.
+#[test]
+fn particle_world_effect_camera() {
+    let v = pw_vals(5.0);
+    let base = run("ec.sim.ccparticleworld", &v, Image::new(48, 48), 1.0);
+    let with = |extra: &[(&'static str, Value)]| {
+        let mut w = v.clone();
+        w.extend_from_slice(extra);
+        run("ec.sim.ccparticleworld", &w, Image::new(48, 48), 1.0)
+    };
+    // Missing parameters (projects saved before) read as the defaults.
+    let spec = crate::find("ec.sim.ccparticleworld").unwrap();
+    let mut params = crate::Params { values: spec.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    params.values.retain(|k, _| !k.starts_with(PW_EFFECT_CAMERA));
+    for (k, val) in &v {
+        params.values.insert(k.to_string(), val.clone());
+    }
+    let ctx = EffectCtx { params: &params, time: 1.0, layer_size: [48.0, 48.0], seed: 1, adjustment: false, env: EffectEnv::default() };
+    assert_eq!(crate::apply(spec, &ctx, Buf { img: Image::new(48, 48), offset: [0.0; 2], scale: 1.0 }).img, base);
+    assert_eq!(with(&[("extras/effectCamera/fov", num(f64::NAN))]), base);
+    // Turning or pulling back the camera changes the view.
+    let turned = with(&[("extras/effectCamera/rotationY", num(60.0))]);
+    assert!(diff(&turned, &base) > 1.0);
+    let cover = |i: &Image| i.data.iter().filter(|p| p[3] > 0.01).count();
+    let far = with(&[("extras/effectCamera/distance", num(4.0))]);
+    assert!(cover(&far) < cover(&base), "{} {}", cover(&far), cover(&base));
+    assert!(diff(&with(&[("extras/effectCamera/fov", num(120.0))]), &base) > 0.1);
+    // Extremes never panic or produce NaN.
+    for extra in [
+        ("extras/effectCamera/distance", num(0.0)),
+        ("extras/effectCamera/distance", num(-5.0)),
+        ("extras/effectCamera/fov", num(0.0)),
+        ("extras/effectCamera/fov", num(180.0)),
+        ("extras/effectCamera/rotationX", num(1e12)),
+    ] {
+        assert!(finite(&with(std::slice::from_ref(&extra))), "{extra:?}");
+    }
+    // Moving the camera doesn't restart the simulation.
+    let key =
+        |pr: &crate::Params| sim_key(&EffectCtx { params: pr, time: 1.0, layer_size: [48.0, 48.0], seed: 1, adjustment: false, env: EffectEnv::default() }, 1);
+    let mut moved = params.clone();
+    moved.values.insert("extras/effectCamera/rotationZ".into(), num(30.0));
+    assert_eq!(key(&params), key(&moved));
+    moved.values.insert("extras/randomSeed".into(), num(9.0));
+    assert_ne!(key(&params), key(&moved));
+}
+
+/// A host whose every layer is `img`.
+struct TexHost(Image);
+impl crate::EffectHost for TexHost {
+    fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+        let s = [self.0.width as f64, self.0.height as f64];
+        Some(crate::LayerPixels { buf: Buf { img: self.0.clone(), offset: [0.0; 2], scale: 1.0 }, size: s })
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+}
+
+/// A texture whose left half is green and right half blue.
+fn two_tone_tex() -> Image {
+    let mut tex = Image::new(8, 8);
+    for y in 0..8 {
+        for x in 0..8 {
+            tex.set(x, y, if x < 4 { [0.0, 1.0, 0.0, 1.0] } else { [0.0, 0.0, 1.0, 1.0] });
+        }
+    }
+    tex
+}
+
+/// CC Particle World drawing red Textured Squares with Texture Layer `layer`.
+fn pw_textured_vals(layer: Option<u64>) -> Vec<(&'static str, Value)> {
+    vec![
+        ("birthRate", num(1.0)),
+        ("extras/randomSeed", num(4.0)),
+        ("particle/particleType", Value::Enum(8)),
+        ("particle/texture/textureLayer", Value::Layer(layer)),
+        ("particle/birthSize", num(1.0)),
+        ("particle/deathSize", num(1.0)),
+        ("particle/birthColor", col(1.0, 0.0, 0.0)),
+        ("particle/deathColor", col(1.0, 0.0, 0.0)),
+    ]
+}
+
+/// #1465: Textured Square draws the Texture Layer on each particle, not the particle colour.
+#[test]
+fn particle_world_textured_square_draws_the_texture_layer() {
+    let host = TexHost(two_tone_tex());
+    let vals = pw_textured_vals;
+    let env = EffectEnv { host: Some(&host), ..Default::default() };
+    let out = run_fx("ec.sim.ccparticleworld", &vals(Some(1)), Image::new(48, 48), 1.0, env).img;
+    let seen: Vec<_> = out.data.iter().filter(|p| p[3] > 0.05).collect();
+    assert!(!seen.is_empty(), "particles drawn");
+    assert!(seen.iter().all(|p| p[0] < 0.02 * p[3]), "no particle colour: {:?}", seen.iter().find(|p| p[0] >= 0.02 * p[3]));
+    // Both halves of the texture show: it is mapped across the square, not sampled once.
+    assert!(seen.iter().any(|p| p[1] > 2.0 * p[2]) && seen.iter().any(|p| p[2] > 2.0 * p[1]), "both texture halves");
+    // Without a texture layer the squares keep the particle colour.
+    let plain = run_fx("ec.sim.ccparticleworld", &vals(None), Image::new(48, 48), 1.0, env).img;
+    assert!(plain.data.iter().any(|p| p[3] > 0.05 && p[0] > 0.9 * p[3]));
+}
+
+/// #1465 with #1195's motion trails: with the shutter open the averaged samples still show
+/// the Texture Layer, not the particle colour.
+#[test]
+fn particle_world_textured_square_motion_trails_draw_the_texture_layer() {
+    let host = TexHost(two_tone_tex());
+    let env = EffectEnv { host: Some(&host), frame_rate: 10.0, shutter: Some((360.0, -180.0, 8)), ..Default::default() };
+    let blurred = run_fx("ec.sim.ccparticleworld", &pw_textured_vals(Some(1)), Image::new(48, 48), 1.0, env).img;
+    let sharp = run_fx("ec.sim.ccparticleworld", &pw_textured_vals(Some(1)), Image::new(48, 48), 1.0, EffectEnv { shutter: None, ..env }).img;
+    assert_ne!(sharp.data, blurred.data, "the shutter smears the particles");
+    let seen: Vec<_> = blurred.data.iter().filter(|p| p[3] > 0.02).collect();
+    assert!(!seen.is_empty(), "particles drawn");
+    assert!(seen.iter().all(|p| p[0] < 0.02 * p[3]), "no particle colour: {:?}", seen.iter().find(|p| p[0] >= 0.02 * p[3]));
+    assert!(seen.iter().any(|p| p[1] > 2.0 * p[2]) && seen.iter().any(|p| p[2] > 2.0 * p[1]), "both texture halves");
+}
+
+/// A host whose every layer is `0` as given (a buffer that may span only its content).
+struct PixelsHost(crate::LayerPixels);
+impl crate::EffectHost for PixelsHost {
+    fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+        Some(self.0.clone())
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+}
+
+/// #1465: a Texture Layer whose buffer spans only its content (text, shapes) is mapped as
+/// the whole layer, transparent around the content, not with its edge pixels stretched.
+#[test]
+fn particle_world_texture_layer_with_a_content_sized_buffer() {
+    // An 8×8 layer with a green 4×4 square in the middle: once as the full layer, once as
+    // just the square's pixels.
+    let mut full = Image::new(8, 8);
+    for y in 2..6 {
+        for x in 2..6 {
+            full.set(x, y, [0.0, 1.0, 0.0, 1.0]);
+        }
+    }
+    let content = Image::filled(4, 4, [0.0, 1.0, 0.0, 1.0]);
+    let render = |buf: Buf| {
+        let host = PixelsHost(crate::LayerPixels { buf, size: [8.0, 8.0] });
+        let env = EffectEnv { host: Some(&host), ..Default::default() };
+        run_fx("ec.sim.ccparticleworld", &pw_textured_vals(Some(1)), Image::new(48, 48), 1.0, env).img
+    };
+    let want = render(Buf { img: full, offset: [0.0; 2], scale: 1.0 });
+    let got = render(Buf { img: content, offset: [-2.0, -2.0], scale: 1.0 });
+    assert!(want.data.iter().any(|p| p[3] > 0.05), "particles drawn");
+    assert_eq!(want.data, got.data, "the content-sized buffer draws as the full layer");
+}
+
+#[test]
+fn particle_systems2_seek_and_direction() {
+    let v = vec![
+        ("producer/position", pt(24.0, 24.0)),
+        ("birthRate", num(3.0)),
+        ("physics/gravity", num(0.0)),
+        ("physics/velocity", num(1.0)),
+        ("physics/animation", Value::Enum(1)),
+    ];
+    let _ = run("ec.sim.ccparticlesystems2", &v, Image::new(48, 48), 0.5);
+    let a = run("ec.sim.ccparticlesystems2", &v, Image::new(48, 48), 1.0);
+    let mut v2 = v.clone();
+    v2.push(("randomSeed", num(0.0)));
+    assert_eq!(a, run("ec.sim.ccparticlesystems2", &v2, Image::new(48, 48), 1.0));
+    // Direction 0° (up): particles above the producer.
+    let blank = Image::new(48, 48);
+    let y = mass_y(&a, &blank);
+    assert!((0.0..24.0).contains(&y), "{y}");
+    // The particles replace the layer: with none born it is empty.
+    let none = run("ec.sim.ccparticlesystems2", &[("birthRate", num(0.0))], grey(20, 20), 1.0);
+    assert_eq!(none, Image::new(20, 20));
+}
+
+/// CC Particle World and CC Particle Systems II replace their layer with the particles, in
+/// every Transfer Mode (which only sets how particles meet each other). SceneYard frames from
+/// After Effects 2026 show no trace of the source solid: "Task Preparation UI" (black solids
+/// under fireworks hid a white page), "Burnout matchstick" (a red rectangle around the
+/// flame), "Documentary Man Falling" (a black block over the light).
+#[test]
+fn cc_particles_replace_their_layer() {
+    let red = || {
+        let mut img = Image::new(48, 48);
+        img.data.iter_mut().for_each(|p| *p = [0.7, 0.1, 0.1, 1.0]);
+        img
+    };
+    for id in ["ec.sim.ccparticlesystems2", "ec.sim.ccparticleworld"] {
+        for mode in 0..4 {
+            let v = vec![("birthRate", num(3.0)), ("particle/transferMode", Value::Enum(mode))];
+            let _ = run(id, &v, red(), 0.5);
+            let out = run(id, &v, red(), 1.0);
+            // No source left: the corners, far from the producer, are clear.
+            for (x, y) in [(0, 0), (47, 0), (0, 47), (47, 47)] {
+                assert!(out.get(x, y)[3] < 1e-6, "{id} mode {mode} ({x},{y}): {:?}", out.get(x, y));
+            }
+            assert!(out.data.iter().any(|p| p[3] > 0.05), "{id} mode {mode}: particles drawn");
+        }
+    }
+}
+
+#[test]
+fn mercury_blobs_and_seek() {
+    let v = vec![("producer", pt(24.0, 16.0)), ("radiusX", num(5.0)), ("radiusY", num(5.0)), ("birthRate", num(3.0))];
+    let _ = run("ec.sim.ccmrmercury", &v, ramp(48, 48), 0.7);
+    let a = run("ec.sim.ccmrmercury", &v, ramp(48, 48), 1.4);
+    let mut v2 = v.clone();
+    v2.push(("shading/metal", num(100.0)));
+    let b = run("ec.sim.ccmrmercury", &v2, ramp(48, 48), 1.4);
+    assert_eq!(a, b);
+    assert!(a.data.iter().any(|p| p[3] > 0.5), "blobs visible");
+    let none = run("ec.sim.ccmrmercury", &[("birthRate", num(0.0))], ramp(48, 48), 1.4);
+    assert!(none.data.iter().all(|p| p[3] == 0.0));
+}
+
+#[test]
+fn half_resolution_scales_sprites() {
+    // Downsampled buffers render the same layout at half size.
+    let s = crate::find("ec.sim.ccsnowfall").unwrap();
+    let mut params = crate::Params { values: s.params.iter().map(|p| (p.id.to_string(), p.default.clone())).collect() };
+    params.values.insert("flakes".into(), num(50.0));
+    params.values.insert("offset".into(), pt(20.0, 20.0));
+    let ctx = EffectCtx { params: &params, time: 0.5, layer_size: [40.0, 40.0], seed: 1, adjustment: false, env: EffectEnv::default() };
+    let full = crate::apply(s, &ctx, Buf { img: grey(40, 40), offset: [0.0; 2], scale: 1.0 });
+    let half = crate::apply(s, &ctx, Buf { img: grey(20, 20), offset: [0.0; 2], scale: 0.5 });
+    let sum = |i: &Image| i.data.iter().map(|p| p[0]).sum::<f32>() / i.data.len() as f32;
+    assert!((sum(&full.img) - sum(&half.img)).abs() < 0.05, "{} {}", sum(&full.img), sum(&half.img));
+}
+
+// ---------------------------------------------------------- Birth Rate over time (#1373)
+
+/// A host that evaluates effect `index`'s Birth Rate at other layer times as `rate(t)`.
+struct Rate {
+    index: usize,
+    rate: fn(f64) -> f64,
+}
+impl crate::EffectHost for Rate {
+    fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+        None
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn param_at(&self, effect_index: usize, id: &str, t: f64) -> Option<Value> {
+        (effect_index == self.index && id == "birthRate").then(|| num((self.rate)(t)))
+    }
+}
+
+/// Birth Rate 3 until 0.5 s, then 0 (the issue's one-shot burst).
+fn burst(t: f64) -> f64 {
+    if t < 0.5 { 3.0 } else { 0.0 }
+}
+
+/// The same burst, cut at 0.25 s (an earlier key moved).
+fn short_burst(t: f64) -> f64 {
+    if t < 0.25 { 3.0 } else { 0.0 }
+}
+
+/// Birth Rate falling linearly from 3 at 0 s to 0 at 0.5 s.
+fn falling(t: f64) -> f64 {
+    (3.0 * (1.0 - t / 0.5)).max(0.0)
+}
+
+/// CC Particle World's parameters: random seed `seed`, Birth Rate `now` (its value at the
+/// rendered time), Longevity 1 s.
+fn pw_params(seed: f64, now: f64) -> crate::Params {
+    let spec = crate::find("ec.sim.ccparticleworld").unwrap();
+    let mut p = crate::Params { values: spec.params.iter().map(|ps| (ps.id.to_string(), crate::default_value(ps, [100.0, 100.0]))).collect() };
+    for (k, v) in [("birthRate", num(now)), ("extras/randomSeed", num(seed)), ("longevity", num(1.0))] {
+        p.values.insert(k.to_string(), v);
+    }
+    p
+}
+
+fn pw_ctx<'a>(p: &'a crate::Params, t: f64, host: Option<&'a Rate>, index: usize) -> EffectCtx<'a> {
+    let env = EffectEnv { host: host.map(|h| h as &dyn crate::EffectHost), effect_index: index, ..Default::default() };
+    EffectCtx { params: p, time: t, layer_size: [100.0, 100.0], seed: 1, adjustment: false, env }
+}
+
+/// The live particles at layer time `t` with Birth Rate `now` there and `host`'s history.
+fn pw_at(seed: f64, now: f64, t: f64, host: Option<&Rate>) -> Vec<crate::psim::SimParticle> {
+    let p = pw_params(seed, now);
+    particle_state("ec.sim.ccparticleworld", &pw_ctx(&p, t, host, host.map_or(0, |h| h.index))).unwrap()
+}
+
+/// The same, simulated from layer time 0 with a cache of its own (the reference).
+fn pw_fresh(seed: f64, now: f64, t: f64, host: &Rate) -> Vec<crate::psim::SimParticle> {
+    let p = pw_params(seed, now);
+    let ctx = pw_ctx(&p, t, Some(host), host.index);
+    let key = params_key_except(&ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, 1, &[PW_EFFECT_CAMERA, "birthRate"]);
+    let st = simulate_rates(&SimCache::new(1), key, &pw_phys(&ctx), &rate_history(&ctx, "birthRate", PW_RATE));
+    st.parts.iter().map(|q| crate::psim::SimParticle { p: q.p, v: q.v, age: q.age, life: q.life, rnd: q.rnd, id: q.id }).collect()
+}
+
+/// Particles born in the first `t` seconds of `rate`.
+fn born_by(rate: fn(f64) -> f64, t: f64) -> usize {
+    crate::psim::births_at(steps_at(t), 40_000, |i| rate(i as f64 / SPS) * PW_RATE).unwrap().len()
+}
+
+/// #1373: Birth Rate only decides the births of its own time. After a burst stops, the
+/// particles born in it live on (moving and ageing) until their Longevity runs out, rather
+/// than vanishing because the rate is now 0.
+#[test]
+fn a_burst_lives_on_after_birth_rate_drops_to_zero() {
+    let host = Rate { index: 2, rate: burst };
+    // During the burst: as a constant Birth Rate of 3.
+    assert_eq!(pw_at(101.0, 3.0, 0.4, Some(&host)), pw_at(101.0, 3.0, 0.4, None));
+    // After it: the burst's particles, none newer.
+    let late = pw_at(101.0, 0.0, 0.9, Some(&host));
+    let n = born_by(burst, 0.5);
+    assert!(late.len() > n / 2 && late.iter().all(|q| (q.id as usize) < n), "{} live of {n} born", late.len());
+    assert!(pw_at(101.0, 0.0, 0.9, None).is_empty(), "a constant Birth Rate of 0 never bore any");
+    // They keep moving.
+    let early = pw_at(101.0, 0.0, 0.7, Some(&host));
+    let q0 = early.iter().find(|q| q.id == late[0].id).unwrap();
+    assert!(q0.p != late[0].p && late[0].age > q0.age + 0.19, "{q0:?} -> {:?}", late[0]);
+    // Longevity 1 s (± 20 %): all gone by 1.8 s.
+    assert!(pw_at(101.0, 0.0, 1.8, Some(&host)).is_empty());
+    // The effect asks for its own index: another effect's history isn't its own.
+    let p = pw_params(101.0, 0.0);
+    assert!(particle_state("ec.sim.ccparticleworld", &pw_ctx(&p, 0.9, Some(&host), 0)).unwrap().is_empty());
+}
+
+/// A Birth Rate ramping down isn't simulated as if its current value had always applied.
+#[test]
+fn a_ramped_birth_rate_bears_what_each_moment_asked_for() {
+    let host = Rate { index: 0, rate: falling };
+    let ramped = pw_at(102.0, falling(0.25), 0.25, Some(&host));
+    let constant = pw_at(102.0, falling(0.25), 0.25, None);
+    assert_eq!(ramped.len(), born_by(falling, 0.25), "every particle born so far is alive");
+    assert_eq!(constant.len(), born_by(|_| 1.5, 0.25));
+    assert!(ramped.len() > constant.len() + 10, "{} vs {}", ramped.len(), constant.len());
+}
+
+/// Seeking backward, forward and to the same time again gives the state simulated from 0.
+#[test]
+fn seeking_through_a_birth_rate_history_matches_simulating_from_zero() {
+    let host = Rate { index: 0, rate: burst };
+    for t in [1.4, 0.6, 0.9, 0.3, 0.9, 1.1] {
+        let now = burst(t);
+        assert_eq!(pw_at(103.0, now, t, Some(&host)), pw_fresh(103.0, now, t, &host), "at {t}");
+    }
+}
+
+/// The simulation cache key leaves Birth Rate out (so an animated rate keeps its checkpoints),
+/// but a checkpoint is only resumed with the history that reached it: after an earlier key
+/// moves, the same current rate (0) gives the new history's particles.
+#[test]
+fn an_earlier_birth_rate_change_is_not_served_from_stale_checkpoints() {
+    let (long, short) = (Rate { index: 0, rate: burst }, Rate { index: 0, rate: short_burst });
+    let a = pw_at(104.0, 0.0, 0.9, Some(&long));
+    let b = pw_at(104.0, 0.0, 0.9, Some(&short));
+    assert_eq!(b, pw_fresh(104.0, 0.0, 0.9, &short));
+    assert!(b.len() < a.len() && !b.is_empty(), "{} vs {}", b.len(), a.len());
+    assert_eq!(pw_at(104.0, 0.0, 1.0, Some(&long)), pw_fresh(104.0, 0.0, 1.0, &long));
+}
+
+/// A constant Birth Rate gives exactly the particles it did before the history was sampled.
+#[test]
+fn a_constant_birth_rate_is_unchanged() {
+    let host = Rate { index: 0, rate: |_| 2.0 };
+    let p = pw_params(105.0, 2.0);
+    let ctx = pw_ctx(&p, 1.3, None, 0);
+    let phys = pw_phys(&ctx);
+    let before = simulate(&SimCache::new(1), sim_key(&ctx, 1), 1.3, &phys);
+    let now = pw_at(105.0, 2.0, 1.3, Some(&host));
+    assert_eq!(now.len(), before.parts.len());
+    assert!(now.iter().zip(&before.parts).all(|(a, b)| a.id == b.id && a.p == b.p && a.v == b.v && a.age == b.age));
+    assert_eq!(crate::psim::births_at(78, 40_000, |_| phys.rate), crate::psim::births(phys.rate, 78, 40_000));
+}
+
+/// The GPU's birth schedule for a rate history is the CPU's: the ids born are the ids the
+/// CPU simulation numbers.
+#[test]
+fn the_birth_schedule_follows_the_rate_history() {
+    let host = Rate { index: 0, rate: falling };
+    let p = pw_params(106.0, 0.0);
+    let ctx = pw_ctx(&p, 0.7, Some(&host), 0);
+    let rates = rate_history(&ctx, "birthRate", PW_RATE);
+    let st = simulate_rates(&SimCache::new(1), 9, &pw_phys(&ctx), &rates);
+    let births = crate::psim::births_at(rates.len() as u64, 40_000, |i| rates[i as usize]).unwrap();
+    assert_eq!(st.next_id as usize, births.len());
+    assert!(births.iter().all(|&b| f64::from(b) / SPS < 0.5), "nothing born once the ramp reaches 0");
+}
+
+// ------------------------- CC Particle Systems II and CC Mr. Mercury's Birth Rate over time
+
+/// A stepped particle effect: its id, physics and simulation.
+struct System {
+    id: &'static str,
+    phys: fn(&EffectCtx) -> Phys,
+    stepped: Stepped<'static>,
+}
+
+const SYSTEMS: [System; 2] =
+    [System { id: "ec.sim.ccparticlesystems2", phys: ps2_phys, stepped: PS2 }, System { id: "ec.sim.ccmrmercury", phys: mercury_phys, stepped: MERCURY }];
+
+/// `id`'s parameters with Birth Rate `now` and Longevity 1 s.
+fn sys_params(id: &str, now: f64) -> crate::Params {
+    let spec = crate::find(id).unwrap();
+    let mut p = crate::Params { values: spec.params.iter().map(|ps| (ps.id.to_string(), crate::default_value(ps, [100.0, 100.0]))).collect() };
+    for (k, v) in [("birthRate", num(now)), ("longevity", num(1.0))] {
+        assert!(p.values.contains_key(k), "{id}: no {k}");
+        p.values.insert(k.to_string(), v);
+    }
+    p
+}
+
+/// The context at layer time `t` (`seed` keeps each test's simulations apart).
+fn sys_ctx<'a>(p: &'a crate::Params, t: f64, host: Option<&'a Rate>, seed: u32) -> EffectCtx<'a> {
+    let env = EffectEnv { host: host.map(|h| h as &dyn crate::EffectHost), effect_index: host.map_or(0, |h| h.index), ..Default::default() };
+    EffectCtx { params: p, time: t, layer_size: [100.0, 100.0], seed, adjustment: false, env }
+}
+
+/// The live particles (id, position, age) of `sys` at `t` through its simulation.
+fn sys_at(sys: &System, seed: u32, now: f64, t: f64, host: Option<&Rate>) -> Vec<(u32, [f32; 3], f32)> {
+    let p = sys_params(sys.id, now);
+    let ctx = sys_ctx(&p, t, host, seed);
+    sys.stepped.state(&ctx, &(sys.phys)(&ctx)).parts.iter().map(|q| (q.id, q.p, q.age)).collect()
+}
+
+/// The same, simulated from layer time 0 with a cache of its own (the reference).
+fn sys_fresh(sys: &System, seed: u32, now: f64, t: f64, host: &Rate) -> Vec<(u32, [f32; 3], f32)> {
+    let p = sys_params(sys.id, now);
+    let ctx = sys_ctx(&p, t, Some(host), seed);
+    let mut skip = sys.stepped.skip.to_vec();
+    skip.push("birthRate");
+    let key = params_key_except(&ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, sys.stepped.salt, &skip);
+    let st = simulate_rates(&SimCache::new(1), key, &(sys.phys)(&ctx), &rate_history(&ctx, "birthRate", sys.stepped.k));
+    st.parts.iter().map(|q| (q.id, q.p, q.age)).collect()
+}
+
+/// What `sys` draws at `t`: CC Particle Systems II's particles, CC Mr. Mercury's blobs.
+fn sys_drawn(sys: &System, seed: u32, now: f64, t: f64, host: Option<&Rate>) -> usize {
+    let p = sys_params(sys.id, now);
+    let ctx = sys_ctx(&p, t, host, seed);
+    match sys.id {
+        "ec.sim.ccmrmercury" => mercury_blobs(&ctx, &Buf { img: Image::new(100, 100), offset: [0.0; 2], scale: 1.0 }).len(),
+        id => particle_state(id, &ctx).unwrap().len(),
+    }
+}
+
+/// #1373 for CC Particle Systems II and CC Mr. Mercury: a burst lives on after Birth Rate
+/// drops to 0 (what they draw too), moving and ageing, and is gone after its Longevity.
+#[test]
+fn particle_systems_ii_and_mr_mercury_keep_a_burst_after_birth_rate_drops() {
+    let host = Rate { index: 1, rate: burst };
+    for sys in &SYSTEMS {
+        let born = crate::psim::births_at(steps_at(0.5), 40_000, |i| burst(i as f64 / SPS) * sys.stepped.k).unwrap().len();
+        assert_eq!(sys_at(sys, 201, 3.0, 0.4, Some(&host)), sys_at(sys, 201, 3.0, 0.4, None), "{}: during the burst", sys.id);
+        let late = sys_at(sys, 201, 0.0, 0.9, Some(&host));
+        assert!(late.len() > born / 2 && late.iter().all(|q| (q.0 as usize) < born), "{}: {} live of {born}", sys.id, late.len());
+        assert!(sys_drawn(sys, 201, 0.0, 0.9, Some(&host)) > 0, "{}: drawn", sys.id);
+        assert_eq!(sys_drawn(sys, 201, 0.0, 0.9, None), 0, "{}: a constant 0 bore none", sys.id);
+        let early = sys_at(sys, 201, 0.0, 0.7, Some(&host));
+        let q0 = early.iter().find(|q| q.0 == late[0].0).unwrap();
+        assert!(q0.1 != late[0].1 && late[0].2 > q0.2 + 0.19, "{}: {q0:?} -> {:?}", sys.id, late[0]);
+        assert!(sys_at(sys, 201, 0.0, 1.8, Some(&host)).is_empty(), "{}: gone after Longevity", sys.id);
+    }
+}
+
+/// Seeking matches a simulation from 0, and moving an earlier key (same current rate, same
+/// cache key) isn't served from the old history's checkpoints.
+#[test]
+fn particle_systems_ii_and_mr_mercury_seek_and_drop_stale_checkpoints() {
+    let (long, short) = (Rate { index: 0, rate: burst }, Rate { index: 0, rate: short_burst });
+    for sys in &SYSTEMS {
+        for t in [1.4, 0.6, 0.9, 0.3, 0.9, 1.1] {
+            let now = burst(t);
+            assert_eq!(sys_at(sys, 202, now, t, Some(&long)), sys_fresh(sys, 202, now, t, &long), "{} at {t}", sys.id);
+        }
+        let b = sys_at(sys, 202, 0.0, 0.9, Some(&short));
+        assert_eq!(b, sys_fresh(sys, 202, 0.0, 0.9, &short), "{}: the moved key", sys.id);
+        assert!(!b.is_empty() && b.len() < sys_at(sys, 202, 0.0, 0.9, Some(&long)).len(), "{}", sys.id);
+    }
+}
+
+/// A constant Birth Rate gives exactly the particles the constant-rate simulation did.
+#[test]
+fn particle_systems_ii_and_mr_mercury_are_unchanged_at_a_constant_rate() {
+    let host = Rate { index: 0, rate: |_| 2.0 };
+    for sys in &SYSTEMS {
+        let p = sys_params(sys.id, 2.0);
+        let ctx = sys_ctx(&p, 1.3, None, 203);
+        let before = simulate(&SimCache::new(1), 1, 1.3, &(sys.phys)(&ctx));
+        let before: Vec<_> = before.parts.iter().map(|q| (q.id, q.p, q.age)).collect();
+        assert!(!before.is_empty());
+        assert_eq!(sys_at(sys, 203, 2.0, 1.3, Some(&host)), before, "{}: keyed to a constant", sys.id);
+        assert_eq!(sys_at(sys, 203, 2.0, 1.3, None), before, "{}: no host", sys.id);
+    }
+}
diff --git a/crates/effects/src/sim/weather.rs b/crates/effects/src/sim/weather.rs
new file mode 100644
index 000000000..347ab4939
--- /dev/null
+++ b/crates/effects/src/sim/weather.rs
@@ -0,0 +1,364 @@
+use super::common::{h, hs};
+use super::sprites::{Acc, Post, Shape, Sprite, SpritePlan, Tint, aa, raster};
+use super::{Buf, EffectCtx, Image, IntoParallelIterator, ParallelIterator, unpremul};
+use crate::util::layer_rect_at;
+
+// ------------------------------------------------------------------ CC Rainfall / CC Snowfall
+
+/// Shared weather layout: per-item depth factor `k` in (0, 1] (1 = nearest) from Scene Depth.
+#[inline]
+fn depth_k(z: f32, scene_depth: f32) -> f32 {
+    1.0 / (1.0 + z * scene_depth / 2500.0)
+}
+
+/// Wrap `v` into `[lo, lo + span)`.
+#[inline]
+fn wrap(v: f32, lo: f32, span: f32) -> f32 {
+    if span <= 0.0 { v } else { lo + (v - lo).rem_euclid(span) }
+}
+
+pub(super) fn rainfall(ctx: &EffectCtx, b: Buf) -> Buf {
+    let mut plan = rainfall_plan(ctx, &b);
+    plan.resolve(&b.img);
+    plan.finish(b)
+}
+
+pub(super) fn rainfall_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
+    let pr = ctx.params;
+    let n = pr.f("drops").clamp(0.0, 100_000.0) as u32;
+    let size = pr.f("size").max(0.0) as f32;
+    let depth = pr.f("sceneDepth").max(0.0) as f32;
+    let speed = pr.f("speed") as f32;
+    let wind = pr.f("wind") as f32;
+    let wvar = pr.f("windVariation") as f32 / 100.0;
+    let spread = pr.f("spread") as f32;
+    let color = pr.color("color");
+    let opacity = pr.f("opacity") as f32 / 100.0;
+    let mode = pr.e("transferMode");
+    let with_orig = pr.b("compositeWithOriginal");
+    let refract = pr.e("extras/appearance") == 0;
+    let off = pr.v2("extras/offset");
+    let seed = pr.f("extras/randomSeed") as u32 ^ ctx.seed.wrapping_mul(0x9e37);
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let s = b.scale as f32;
+    let t = ctx.time as f32;
+    let (ox, oy) = (off[0] as f32 - lw * 0.5, off[1] as f32 - lh * 0.5);
+    let (sprites, tints): (Vec<Sprite>, Vec<Tint>) = (0..n)
+        .into_par_iter()
+        .map(|i| {
+            let z = h(i, 1, seed);
+            let k = depth_k(z, depth);
+            let vy = speed / 4000.0 * lh * 2.2 * k;
+            let w = wind / 1000.0 * lh * (1.0 + wvar * hs(i, 2, seed)) * k + spread * hs(i, 7, seed) * k;
+            let len = (vy * 0.04 * size.max(0.2)).max(1.0);
+            let lenx = w * 0.04 * size.max(0.2);
+            let margin = len + lenx.abs() + 4.0;
+            let y = wrap(h(i, 3, seed) * (lh + 2.0 * margin) + vy * t + oy, -margin, lh + 2.0 * margin);
+            let x = wrap(h(i, 4, seed) * (lw + 2.0 * margin) + w * t + ox, -margin, lw + 2.0 * margin);
+            let (bx, by) = b.to_px([x as f64, y as f64]);
+            let c = [color[0], color[1], color[2], opacity * (0.35 + 0.65 * k)];
+            // Refracting drops show the scene behind them, brightened and offset.
+            let tint = if refract { Tint::Refract { x: bx + 2.0 * s as f64, y: by } } else { Tint::Fixed };
+            let r = (size * 0.6 * k * s).max(0.25);
+            (Sprite::new(bx as f32, by as f32, r, c, Shape::Line { dx: -lenx * s, dy: -len * s }), tint)
+        })
+        .unzip();
+    SpritePlan { sprites, tints, acc: Acc::Over, post: weather_post(mode, with_orig) }
+}
+
+fn weather_post(mode: u32, with_orig: bool) -> Post {
+    if with_orig { Post::Combine(if mode == 1 { 3 } else { 0 }) } else { Post::Replace }
+}
+
+pub(super) fn snowfall(ctx: &EffectCtx, b: Buf) -> Buf {
+    snowfall_plan(ctx, &b).finish(b)
+}
+
+pub(super) fn snowfall_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
+    let pr = ctx.params;
+    let n = pr.f("flakes").clamp(0.0, 200_000.0) as u32;
+    let size = pr.f("size").max(0.0) as f32;
+    let svar = pr.f("sizeVariation") as f32 / 100.0;
+    let depth = pr.f("sceneDepth").max(0.0) as f32;
+    let speed = pr.f("speed") as f32;
+    let spvar = pr.f("speedVariation") as f32 / 100.0;
+    let wind = pr.f("wind") as f32;
+    let wvar = pr.f("windVariation") as f32 / 100.0;
+    let spread = pr.f("spread") as f32;
+    let wig = pr.f("wiggle/wiggleAmount") as f32;
+    let wigvar = pr.f("wiggle/wiggleAmountVariation") as f32 / 100.0;
+    let wfreq = pr.f("wiggle/wiggleFrequency") as f32;
+    let wfvar = pr.f("wiggle/wiggleFrequencyVariation") as f32 / 100.0;
+    let color = pr.color("color");
+    let opacity = pr.f("opacity") as f32 / 100.0;
+    let mode = pr.e("transferMode");
+    let with_orig = pr.b("compositeWithOriginal");
+    let off = pr.v2("extras/offset");
+    let seed = pr.f("extras/randomSeed") as u32 ^ ctx.seed.wrapping_mul(0x85eb);
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let s = b.scale as f32;
+    let t = ctx.time as f32;
+    let (ox, oy) = (off[0] as f32 - lw * 0.5, off[1] as f32 - lh * 0.5);
+    let sprites: Vec<Sprite> = (0..n)
+        .into_par_iter()
+        .map(|i| {
+            let z = h(i, 1, seed);
+            let k = depth_k(z, depth);
+            let r = (size * 0.5 * k * (1.0 + svar * hs(i, 2, seed))).max(0.05);
+            let vy = speed * (lh / 600.0) * k * (1.0 + spvar * hs(i, 3, seed));
+            let vx = wind * (lh / 1200.0) * k * (1.0 + wvar * hs(i, 4, seed)) + spread * hs(i, 8, seed) * k;
+            let amp = wig * 2.0 * k * (1.0 + wigvar * hs(i, 5, seed));
+            let fr = wfreq * (1.0 + wfvar * hs(i, 6, seed));
+            let ph = h(i, 9, seed) * std::f32::consts::TAU;
+            let margin = r + amp.abs() + 2.0;
+            let y = wrap(h(i, 10, seed) * (lh + 2.0 * margin) + vy * t + oy, -margin, lh + 2.0 * margin);
+            let x = wrap(h(i, 11, seed) * (lw + 2.0 * margin) + vx * t + ox, -margin, lw + 2.0 * margin) + amp * (fr * t * std::f32::consts::TAU + ph).sin();
+            let (bx, by) = b.to_px([x as f64, y as f64]);
+            Sprite::new(bx as f32, by as f32, r * s, [color[0], color[1], color[2], opacity * (0.4 + 0.6 * k)], Shape::Soft)
+        })
+        .collect();
+    SpritePlan { sprites, tints: vec![], acc: Acc::Over, post: weather_post(mode, with_orig) }
+}
+
+// ------------------------------------------------------------------ CC Bubbles
+
+/// A CC Bubbles bubble in buffer pixels.
+#[derive(Clone, Copy, Debug)]
+pub struct Bubble {
+    pub x: f32,
+    pub y: f32,
+    pub r: f32,
+    /// Source sample centre (buffer px).
+    pub sx: f32,
+    pub sy: f32,
+}
+
+/// CC Bubbles' bubbles this frame (closed-form in time) for buffer geometry `b`.
+pub fn bubble_list(ctx: &EffectCtx, b: &Buf) -> Vec<Bubble> {
+    let pr = ctx.params;
+    let n = pr.f("bubbleAmount").clamp(0.0, 10_000.0) as u32;
+    let speed = pr.f("bubbleSpeed") as f32;
+    let wamp = pr.f("wobbleAmplitude") as f32;
+    let wfreq = pr.f("wobbleFrequency") as f32;
+    let bsize = pr.f("bubbleSize").max(0.0) as f32;
+    let seed = ctx.seed.wrapping_mul(0x27d4);
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let s = b.scale as f32;
+    let t = ctx.time as f32;
+    let base = lw.min(lh) * 0.035 * bsize;
+    (0..n)
+        .map(|i| {
+            let r = base * (0.5 + h(i, 1, seed));
+            let travel = lh + 2.0 * r;
+            let v = speed * lh * 0.3 * (0.6 + 0.8 * h(i, 2, seed));
+            let y = lh + r - (h(i, 3, seed) * travel + v * t).rem_euclid(travel);
+            let x0 = h(i, 4, seed) * lw;
+            let x = x0 + wamp * (r / base.max(1e-3)) * (t * wfreq * std::f32::consts::TAU + h(i, 5, seed) * std::f32::consts::TAU).sin();
+            let (bx, by) = b.to_px([x as f64, y as f64]);
+            let (sx, sy) = b.to_px([x0 as f64, y as f64]);
+            Bubble { x: bx as f32, y: by as f32, r: r * s, sx: sx as f32, sy: sy as f32 }
+        })
+        .collect()
+}
+
+/// CC Bubbles' refraction sample bounds in the pixels of a buffer with `offset` and `scale`: the
+/// layer rectangle's first and last pixel centres (x0, y0, x1, y1). Samples clamped to them repeat
+/// the layer's edge pixels instead of reaching transparent padding around it (#2024).
+pub fn bubble_sample_bounds(ctx: &EffectCtx, offset: [f64; 2], scale: f64) -> [f32; 4] {
+    let (lx, ly, lw, lh) = layer_rect_at(ctx, offset, scale);
+    let (x0, y0) = (lx + 0.5, ly + 0.5);
+    [x0 as f32, y0 as f32, (lx + lw - 0.5).max(x0) as f32, (ly + lh - 0.5).max(y0) as f32]
+}
+
+pub(super) fn bubbles(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let metal = pr.e("reflectionType") == 1;
+    let shading = pr.e("shadingType");
+    let list = bubble_list(ctx, &b);
+    let [x0, y0, x1, y1] = bubble_sample_bounds(ctx, b.offset, b.scale);
+    let src = b.img.clone();
+    let mut out = Image::new(src.width, src.height);
+    raster(
+        &mut out,
+        &list,
+        |q| Some([q.x - q.r - 1.0, q.y - q.r - 1.0, q.x + q.r + 1.0, q.y + q.r + 1.0]),
+        |q, x, y| {
+            let (dx, dy) = ((x - q.x) / q.r.max(0.5), (y - q.y) / q.r.max(0.5));
+            let d2 = dx * dx + dy * dy;
+            let d = d2.sqrt();
+            let cov = aa((1.0 - d) * q.r);
+            if cov <= 0.0 {
+                return None;
+            }
+            // Liquid refracts (inverted, magnified), metal reflects (wide-angle mirror).
+            let k = if metal { 1.6 } else { -0.7 };
+            let nz = (1.0 - d2).max(0.0).sqrt();
+            let (sx, sy) = ((q.sx + dx * q.r * k).max(x0).min(x1), (q.sy + dy * q.r * k).max(y0).min(y1));
+            let p = src.sample_bilinear_clamped(sx as f64, sy as f64);
+            let (c, sa) = unpremul(p);
+            let mut c = if sa <= 0.0 { [0.6, 0.7, 0.8] } else { c };
+            let mut a = cov;
+            match shading {
+                1 => c = c.map(|v| v * 0.7 + 0.3 * (1.0 - nz)),
+                2 => c = c.map(|v| v * (0.5 + 0.5 * nz)),
+                3 => a *= nz.powf(0.5),
+                4 => a *= 1.0 - nz * 0.8,
+                _ => {}
+            }
+            let hl = (1.0 - ((dx + 0.35).powi(2) + (dy + 0.35).powi(2)) / 0.05).max(0.0) * 0.8;
+            let c = c.map(|v| v + hl);
+            Some([c[0] * a, c[1] * a, c[2] * a, a])
+        },
+        Acc::Over,
+    );
+    b.img = out;
+    b
+}
+
+// ------------------------------------------------------------------ CC Drizzle
+
+/// CC Drizzle's live drops this frame (buffer px: centre x, y, ring radius, amplitude);
+/// `None` = no drops yet (the layer passes through).
+pub fn drizzle_drops(ctx: &EffectCtx, b: &Buf) -> Option<Vec<[f32; 4]>> {
+    let pr = ctx.params;
+    let rate = pr.f("dripRate").max(0.0);
+    let life = pr.f("longevity").max(0.01);
+    let spreading = pr.f("spreading") as f32;
+    let height = pr.f("rippleHeight") as f32 / 100.0;
+    let seed = ctx.seed.wrapping_mul(0x165667b1);
+    let t = ctx.time;
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let s = b.scale as f32;
+    if rate <= 0.0 || t < 0.0 {
+        return None;
+    }
+    // Drops born at k / rate with hashed positions; alive while younger than the longevity.
+    let k0 = ((t - life) * rate).floor().max(0.0) as u32;
+    let k1 = (t * rate).floor() as u32;
+    let mut drops = Vec::new();
+    for k in k0..=k1 {
+        let born = k as f64 / rate;
+        let age = (t - born) as f32;
+        if age < 0.0 || age as f64 >= life {
+            continue;
+        }
+        let (x, y) = b.to_px([(h(k, 1, seed) * lw) as f64, (h(k, 2, seed) * lh) as f64]);
+        let radius = spreading * age * lh / 400.0 * s;
+        let amp = height * (1.0 - age / life as f32) * (0.6 + 0.4 * h(k, 3, seed));
+        drops.push([x as f32, y as f32, radius, amp]);
+    }
+    Some(drops)
+}
+
+pub(super) fn drizzle(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let pr = ctx.params;
+    let Some(drops) = drizzle_drops(ctx, &b) else { return b };
+    let rippling = (pr.f("rippling") / 360.0).max(0.05) as f32;
+    let disp = pr.f("displacement") as f32;
+    let li = pr.f("light/lightIntensity") as f32 / 100.0;
+    let lc = pr.color("light/lightColor");
+    let lheight = pr.f("light/lightHeight") as f32 / 100.0;
+    let ldir = (pr.f("light/lightDirection") as f32).to_radians();
+    let ambient = pr.f("shading/ambient") as f32 / 100.0;
+    let diffuse = pr.f("shading/diffuse") as f32 / 100.0;
+    let specular = pr.f("shading/specular") as f32 / 100.0;
+    let rough = pr.f("shading/roughness").max(0.001) as f32;
+    let lh = ctx.layer_size[1] as f32;
+    let s = b.scale as f32;
+    let wavelen = (lh * 0.04 * s).max(2.0) / rippling.clamp(0.25, 4.0);
+    let width = wavelen * (1.0 + rippling * 2.0);
+    let field = |x: f32, y: f32| -> f32 {
+        let mut v = 0.0;
+        for &[dx, dy, r, a] in &drops {
+            let d = ((x - dx).powi(2) + (y - dy).powi(2)).sqrt();
+            let u = (d - r) / width;
+            if u.abs() < 1.0 {
+                let env = 0.5 + 0.5 * (u * std::f32::consts::PI).cos();
+                v += a * env * ((d - r) / wavelen * std::f32::consts::TAU).cos();
+            }
+        }
+        v
+    };
+    let src = b.img.clone();
+    let (ls, lcs) = ldir.sin_cos();
+    let l = {
+        let v = [lcs, ls, lheight.max(0.05)];
+        let n = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
+        [v[0] / n, v[1] / n, v[2] / n]
+    };
+    b.img.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let (fx, fy) = (x as f32 + 0.5, y as f32 + 0.5);
+            let gx = field(fx + 1.0, fy) - field(fx - 1.0, fy);
+            let gy = field(fx, fy + 1.0) - field(fx, fy - 1.0);
+            if gx == 0.0 && gy == 0.0 {
+                continue;
+            }
+            let p = src.sample_bilinear_clamped((fx - gx * disp * s * 4.0) as f64, (fy - gy * disp * s * 4.0) as f64);
+            let n = {
+                let v = [-gx * 6.0, -gy * 6.0, 1.0];
+                let m = (v[0] * v[0] + v[1] * v[1] + 1.0).sqrt();
+                [v[0] / m, v[1] / m, v[2] / m]
+            };
+            let nl = (n[0] * l[0] + n[1] * l[1] + n[2] * l[2]).max(0.0);
+            let hz = (l[2] + 1.0) * 0.5;
+            let hv = {
+                let v = [l[0] * 0.5, l[1] * 0.5, hz];
+                let m = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
+                [v[0] / m, v[1] / m, v[2] / m]
+            };
+            let sp = (n[0] * hv[0] + n[1] * hv[1] + n[2] * hv[2]).max(0.0).powf(1.0 / rough) * specular * li;
+            let shade = 1.0 + (ambient + diffuse * nl - diffuse * l[2]) * li;
+            let a = p[3];
+            *px = [p[0] * shade + sp * lc[0] * a, p[1] * shade + sp * lc[1] * a, p[2] * shade + sp * lc[2] * a, a];
+        }
+    });
+    b
+}
+
+// ------------------------------------------------------------------ CC Star Burst
+
+pub(super) fn star_burst(ctx: &EffectCtx, b: Buf) -> Buf {
+    let mut plan = star_burst_plan(ctx, &b);
+    plan.resolve(&b.img);
+    plan.finish(b)
+}
+
+pub(super) fn star_burst_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
+    let pr = ctx.params;
+    let scatter = pr.f("scatter") as f32;
+    let speed = pr.f("speed") as f32;
+    let phase = pr.f("phase") as f32 / 360.0;
+    let spacing = pr.f("gridSpacing").max(1.0) as f32;
+    let size = pr.f("size") as f32 / 100.0;
+    let blend = pr.f("blendWithOriginal") as f32 / 100.0;
+    let seed = ctx.seed.wrapping_mul(0x3c6e);
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let s = b.scale as f32;
+    let t = ctx.time as f32;
+    let nx = (lw / spacing).ceil().max(1.0) as u32;
+    let ny = (lh / spacing).ceil().max(1.0) as u32;
+    let (cx, cy) = (lw * 0.5, lh * 0.5);
+    let mut list: Vec<(f32, Sprite, Tint)> = (0..nx * ny)
+        .into_par_iter()
+        .map(|i| {
+            let (gx, gy) = ((i % nx) as f32 * spacing + spacing * 0.5, (i / nx) as f32 * spacing + spacing * 0.5);
+            let (sx, sy) = b.to_px([gx as f64, gy as f64]);
+            // Depth cycles towards the viewer: z in [0, 1), perspective 1 / (1 - 0.9 z).
+            let z = (h(i, 1, seed) + t * speed * 0.25 + phase).rem_euclid(1.0);
+            let persp = 1.0 / (1.0 - 0.9 * z);
+            let jx = hs(i, 2, seed) * scatter * 0.01 * lw * 0.5;
+            let jy = hs(i, 3, seed) * scatter * 0.01 * lh * 0.5;
+            let x = cx + (gx - cx + jx) * persp;
+            let y = cy + (gy - cy + jy) * persp;
+            let (bx, by) = b.to_px([x as f64, y as f64]);
+            let r = spacing * 0.5 * size * persp * s;
+            let fade = (z * 8.0).min(1.0) * ((1.0 - z) * 6.0).min(1.0);
+            // The layer's colour at the grid point (none where it is clear).
+            (z, Sprite::new(bx as f32, by as f32, r, [0.0, 0.0, 0.0, fade], Shape::Disc), Tint::Source { x: sx, y: sy })
+        })
+        .collect();
+    list.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let (sprites, tints) = list.into_iter().map(|(_, s, t)| (s, t)).unzip();
+    SpritePlan { sprites, tints, acc: Acc::Over, post: if blend > 0.0 { Post::Lerp(blend) } else { Post::Replace } }
+}
diff --git a/crates/effects/src/sim2.rs b/crates/effects/src/sim2.rs
index cf7322bda..497b60f16 100644
--- a/crates/effects/src/sim2.rs
+++ b/crates/effects/src/sim2.rs
@@ -16,2683 +16,28 @@ use crate::sim::{Acc, Post, Shape, Sprite, SpritePlan, h, hs, pct, pt, raster, s
 use crate::util::{Plane, SimCache, gauss_plane, layer_or_self, params_key, unpremul};
 use crate::{Buf, EffectCtx, EffectSpec, col, num, p, popup, slider};
 
-// ------------------------------------------------------------------ 3D pieces
-
-pub(crate) type M3 = [[f64; 3]; 3];
-
-fn mat_mul(a: &M3, b: &M3) -> M3 {
-    std::array::from_fn(|i| std::array::from_fn(|j| (0..3).map(|k| a[i][k] * b[k][j]).sum()))
-}
-
-/// Rotation from Euler angles (radians), applied X then Y then Z.
-fn rot_xyz(x: f64, y: f64, z: f64) -> M3 {
-    let (sx, cx) = x.sin_cos();
-    let (sy, cy) = y.sin_cos();
-    let (sz, cz) = z.sin_cos();
-    let rx = [[1.0, 0.0, 0.0], [0.0, cx, -sx], [0.0, sx, cx]];
-    let ry = [[cy, 0.0, sy], [0.0, 1.0, 0.0], [-sy, 0.0, cy]];
-    let rz = [[cz, -sz, 0.0], [sz, cz, 0.0], [0.0, 0.0, 1.0]];
-    mat_mul(&rz, &mat_mul(&ry, &rx))
-}
-
-/// Rotation by `angle` about unit `axis` (Rodrigues).
-pub(crate) fn rot_axis(axis: [f64; 3], angle: f64) -> M3 {
-    let l = (axis[0] * axis[0] + axis[1] * axis[1] + axis[2] * axis[2]).sqrt();
-    if l < 1e-12 || angle == 0.0 {
-        return [[1.0, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]];
-    }
-    let (x, y, z) = (axis[0] / l, axis[1] / l, axis[2] / l);
-    let (s, c) = angle.sin_cos();
-    let t = 1.0 - c;
-    [
-        [t * x * x + c, t * x * y - s * z, t * x * z + s * y],
-        [t * x * y + s * z, t * y * y + c, t * y * z - s * x],
-        [t * x * z - s * y, t * y * z + s * x, t * z * z + c],
-    ]
-}
-
-fn inv3(m: &M3) -> Option<M3> {
-    let det = m[0][0] * (m[1][1] * m[2][2] - m[1][2] * m[2][1]) - m[0][1] * (m[1][0] * m[2][2] - m[1][2] * m[2][0])
-        + m[0][2] * (m[1][0] * m[2][1] - m[1][1] * m[2][0]);
-    if det.abs() < 1e-12 {
-        return None;
-    }
-    let d = 1.0 / det;
-    Some([
-        [(m[1][1] * m[2][2] - m[1][2] * m[2][1]) * d, (m[0][2] * m[2][1] - m[0][1] * m[2][2]) * d, (m[0][1] * m[1][2] - m[0][2] * m[1][1]) * d],
-        [(m[1][2] * m[2][0] - m[1][0] * m[2][2]) * d, (m[0][0] * m[2][2] - m[0][2] * m[2][0]) * d, (m[0][2] * m[1][0] - m[0][0] * m[1][2]) * d],
-        [(m[1][0] * m[2][1] - m[1][1] * m[2][0]) * d, (m[0][1] * m[2][0] - m[0][0] * m[2][1]) * d, (m[0][0] * m[1][1] - m[0][1] * m[1][0]) * d],
-    ])
-}
-
-/// Perspective camera looking down +z at the layer plane z = 0, `d` pixels away, centred on
-/// `c` (buffer pixels): screen = c + (P - c) · d / (d + z).
-#[derive(Clone, Copy)]
-struct Cam {
-    c: [f64; 2],
-    d: f64,
-}
-
-impl Cam {
-    fn proj(self) -> Proj {
-        Proj::simple(self.c, self.d)
-    }
-}
-
-/// A planar textured piece ready to draw.
-#[derive(Clone, Copy, Debug)]
-pub struct Piece {
-    /// Screen (buffer px, homogeneous) → piece-local (a, b, w).
-    pub inv: [[f64; 3]; 3],
-    /// Rest centre of the piece in texture pixels.
-    pub c0: [f32; 2],
-    /// Convex polygon (texture pixels), counter-clockwise in y-down space.
-    pub poly: [[f32; 2]; 6],
-    pub n: u8,
-    pub bbox: [f32; 4],
-    pub shade: f32,
-    /// Lighting: colour multiplier and additive specular highlight.
-    pub tint: [f32; 3],
-    pub spec: [f32; 3],
-    pub alpha: f32,
-    /// Flat straight colour instead of the texture.
-    pub flat: Option<[f32; 3]>,
-    /// Facing away from the camera (draw the back texture).
-    pub back: bool,
-    /// Back faces sample their texture mirrored about the piece centre: 0 no, 1 vertically
-    /// (flipped about the X axis), 2 horizontally (about the Y axis).
-    pub back_mirror: u8,
-    depth: f64,
-}
-
-/// A piece texture: the layer itself or another image (buffer-aligned).
-#[derive(Clone, Debug)]
-pub enum PieceTex {
-    Layer,
-    Image(Image),
-}
-
-/// What a piece-drawing effect (Card Dance, Shatter, Card Wipe) draws this frame: pieces sorted
-/// far to near over a transparent frame, textured by `front` (and `back` for pieces facing
-/// away; none = they take `front`).
-#[derive(Clone, Debug)]
-pub struct PiecePlan {
-    pub pieces: Vec<Piece>,
-    pub front: PieceTex,
-    pub back: Option<PieceTex>,
-}
-
-impl PiecePlan {
-    /// Rasterise over a transparent frame of the layer `b`'s size.
-    pub fn finish(&self, mut b: Buf) -> Buf {
-        let mut out = Image::new(b.img.width, b.img.height);
-        let front = match &self.front {
-            PieceTex::Layer => &b.img,
-            PieceTex::Image(i) => i,
-        };
-        let back = self.back.as_ref().map(|t| match t {
-            PieceTex::Layer => &b.img,
-            PieceTex::Image(i) => i,
-        });
-        draw_pieces(&mut out, &self.pieces, front, back);
-        b.img = out;
-        b
-    }
-}
-
-/// The piece plan of Card Dance, Shatter (Rendered view) or Card Wipe for layer `b` (its pixels
-/// may be read: gradient maps and textures default to the layer), `None` for other effects or
-/// views drawn otherwise.
-pub fn piece_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<PiecePlan> {
-    match id {
-        "ec.sim.carddance" => Some(card_dance_plan(ctx, b)),
-        "ec.sim.shatter" if ctx.params.e("view") == 0 => match shatter_impl(ctx, b) {
-            ShatterPlan::Pieces(plan) => Some(plan),
-            ShatterPlan::Wire(_) => None,
-        },
-        "ec.transition.cardwipe" => crate::transition::card_wipe_plan(ctx, b),
-        _ => None,
-    }
-}
-
-impl Piece {
-    /// Place polygon `poly` (texture px, around rest centre `c0`) with rotation `r` and its
-    /// centre at 3D `pos` (buffer px; z away from the camera), seen through `cam`.
-    pub(crate) fn new(poly: &[[f32; 2]], c0: [f32; 2], r: &M3, pos: [f64; 3], cam: impl Into<Proj>) -> Option<Piece> {
-        let cam: Proj = cam.into();
-        let n = poly.len().min(6);
-        if n < 3 {
-            return None;
-        }
-        let m = &cam.m;
-        let row = |i: usize| -> [f64; 3] {
-            [
-                m[i][0] * r[0][0] + m[i][1] * r[1][0] + m[i][2] * r[2][0],
-                m[i][0] * r[0][1] + m[i][1] * r[1][1] + m[i][2] * r[2][1],
-                m[i][0] * pos[0] + m[i][1] * pos[1] + m[i][2] * pos[2] + m[i][3],
-            ]
-        };
-        let hm: M3 = [row(0), row(1), row(2)];
-        let mut bb = [f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY];
-        for v in &poly[..n] {
-            let (a, b) = ((v[0] - c0[0]) as f64, (v[1] - c0[1]) as f64);
-            let w = hm[2][0] * a + hm[2][1] * b + hm[2][2];
-            if w < cam.near {
-                return None;
-            }
-            let sx = ((hm[0][0] * a + hm[0][1] * b + hm[0][2]) / w) as f32;
-            let sy = ((hm[1][0] * a + hm[1][1] * b + hm[1][2]) / w) as f32;
-            bb = [bb[0].min(sx), bb[1].min(sy), bb[2].max(sx), bb[3].max(sy)];
-        }
-        let inv = inv3(&hm)?;
-        let mut pp = [[0.0f32; 2]; 6];
-        pp[..n].copy_from_slice(&poly[..n]);
-        // Normalise winding so "inside" is cross >= 0 for every edge.
-        let area: f32 = (0..n).map(|i| pp[i][0] * pp[(i + 1) % n][1] - pp[(i + 1) % n][0] * pp[i][1]).sum();
-        if area < 0.0 {
-            pp[..n].reverse();
-        }
-        // The front faces -z at rest; it faces the camera when its normal points at the eye.
-        let eye = cam.eye();
-        let nrm = [-r[0][2], -r[1][2], -r[2][2]];
-        let to_eye = [eye[0] - pos[0], eye[1] - pos[1], eye[2] - pos[2]];
-        let facing = nrm[0] * to_eye[0] + nrm[1] * to_eye[1] + nrm[2] * to_eye[2];
-        let depth = hm[2][2];
-        Some(Piece {
-            inv,
-            c0,
-            poly: pp,
-            n: n as u8,
-            bbox: [bb[0] - 1.0, bb[1] - 1.0, bb[2] + 1.0, bb[3] + 1.0],
-            shade: 1.0,
-            tint: [1.0; 3],
-            spec: [0.0; 3],
-            alpha: 1.0,
-            flat: None,
-            back: facing < 0.0,
-            back_mirror: 0,
-            depth,
-        })
-    }
-
-    /// Lambert factor of the piece normal against a light shining along +z.
-    fn facing(r: &M3) -> f32 {
-        r[2][2].abs() as f32
-    }
-
-    /// Light the piece (rotation `r`, centre `pos`) with Lighting / Material.
-    pub(crate) fn light(&mut self, l: &Lighting, r: &M3, pos: [f64; 3], eye: [f64; 3]) {
-        let (t, s) = l.shade([-r[0][2], -r[1][2], -r[2][2]], pos, eye);
-        self.tint = t;
-        self.spec = s;
-    }
-}
-
-impl From<Cam> for Proj {
-    fn from(c: Cam) -> Proj {
-        c.proj()
-    }
-}
-
-/// Draw pieces (already sorted far → near) over `out`.
-pub(crate) fn draw_pieces(out: &mut Image, pieces: &[Piece], front: &Image, back: Option<&Image>) {
-    raster(
-        out,
-        pieces,
-        |q| Some(q.bbox),
-        |q, x, y| {
-            let (xf, yf) = (x as f64, y as f64);
-            let m = &q.inv;
-            let w = m[2][0] * xf + m[2][1] * yf + m[2][2];
-            if w.abs() < 1e-12 {
-                return None;
-            }
-            let u = ((m[0][0] * xf + m[0][1] * yf + m[0][2]) / w) as f32 + q.c0[0];
-            let v = ((m[1][0] * xf + m[1][1] * yf + m[1][2]) / w) as f32 + q.c0[1];
-            let n = q.n as usize;
-            let mut md = f32::INFINITY;
-            for i in 0..n {
-                let a = q.poly[i];
-                let b = q.poly[(i + 1) % n];
-                let (ex, ey) = (b[0] - a[0], b[1] - a[1]);
-                let l = (ex * ex + ey * ey).sqrt().max(1e-6);
-                md = md.min((ex * (v - a[1]) - ey * (u - a[0])) / l);
-            }
-            // Coverage extends half a pixel past the edge so abutting pieces leave no seams.
-            let cov = (md + 1.0).clamp(0.0, 1.0);
-            if cov <= 0.0 {
-                return None;
-            }
-            let (c, a) = match q.flat {
-                Some(c) => (c, 1.0),
-                None => {
-                    let tex = if q.back { back.unwrap_or(front) } else { front };
-                    let (u, v) = match (q.back, q.back_mirror) {
-                        (true, 1) => (u, 2.0 * q.c0[1] - v),
-                        (true, 2) => (2.0 * q.c0[0] - u, v),
-                        _ => (u, v),
-                    };
-                    unpremul(tex.sample_bilinear(u as f64, v as f64))
-                }
-            };
-            let a = a * cov * q.alpha;
-            if a <= 1e-6 {
-                return None;
-            }
-            let k = q.shade;
-            let o: [f32; 3] = std::array::from_fn(|i| c[i] * k * q.tint[i] + q.spec[i]);
-            Some([o[0] * a, o[1] * a, o[2] * a, a])
-        },
-        Acc::Over,
-    );
-}
-
-pub(crate) fn sort_far_first(pieces: &mut [Piece]) {
-    pieces.sort_by(|a, b| b.depth.total_cmp(&a.depth));
-}
-
-// ------------------------------------------------------------------ CC Ball Action
-
-fn ball_action(ctx: &EffectCtx, b: Buf) -> Buf {
-    ball_action_plan(ctx, &b).finish(b)
-}
-
-/// CC Ball Action's balls (far to near), coloured by the layer's pixels.
-fn ball_action_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
-    let pr = ctx.params;
-    let scatter = pr.f("scatter") as f32;
-    let axis = pr.e("rotationAxis");
-    let rot = pr.f("rotation").to_radians();
-    let twist_prop = pr.e("twistProperty");
-    let twist = pr.f("twistAngle").to_radians();
-    let spacing = pr.f("gridSpacing").max(1.0) as f32;
-    let size = pr.f("ballSize") as f32 / 100.0;
-    let instab = pr.f("instabilityState").to_radians() as f32;
-    let seed = ctx.seed.wrapping_mul(0x2545f491);
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let s = b.scale as f32;
-    let nx = (lw / spacing).ceil().max(1.0) as u32;
-    let ny = (lh / spacing).ceil().max(1.0) as u32;
-    let d = 2.0 * lw.max(lh) as f64;
-    let (cx, cy) = (lw as f64 * 0.5, lh as f64 * 0.5);
-    let src = &b.img;
-    let ax: [f64; 3] = match axis {
-        0 => [1.0, 0.0, 0.0],
-        1 => [0.0, 1.0, 0.0],
-        2 => [0.0, 0.0, 1.0],
-        3 => [1.0, 1.0, 0.0],
-        4 => [1.0, 0.0, 1.0],
-        5 => [0.0, 1.0, 1.0],
-        _ => [1.0, 1.0, 1.0],
-    };
-    let maxr = ((lw * lw + lh * lh).sqrt() * 0.5).max(1.0);
-    let mut balls: Vec<(f64, Sprite)> = (0..nx * ny)
-        .into_par_iter()
-        .filter_map(|i| {
-            let gx = (i % nx) as f32 * spacing + spacing * 0.5;
-            let gy = (i / nx) as f32 * spacing + spacing * 0.5;
-            let (sx, sy) = b.to_px([gx as f64, gy as f64]);
-            let (c, a) = unpremul(src.sample_bilinear(sx, sy));
-            if a <= 0.0 || size <= 0.0 {
-                return None;
-            }
-            let tp = match twist_prop {
-                0 => gx / lw.max(1.0),
-                1 => gy / lh.max(1.0),
-                2 => ((gx - cx as f32).hypot(gy - cy as f32)) / maxr,
-                _ => crate::util::rgb3([c[0], c[1], c[2], 0.0]).iter().sum::<f32>() / 3.0,
-            } as f64;
-            let ang = rot + twist * tp;
-            // Scatter: random 3D offsets whose direction drifts with the instability state.
-            let ph = h(i, 1, seed) * std::f32::consts::TAU + instab;
-            let sc = scatter * h(i, 2, seed);
-            let off = [(sc * ph.cos()) as f64, (sc * ph.sin()) as f64, (scatter * hs(i, 3, seed)) as f64];
-            let p0 = [gx as f64 - cx + off[0], gy as f64 - cy + off[1], off[2]];
-            let m = rot_axis(ax, ang);
-            let q: [f64; 3] = std::array::from_fn(|k| m[k][0] * p0[0] + m[k][1] * p0[1] + m[k][2] * p0[2]);
-            if d + q[2] <= d * 0.05 {
-                return None;
-            }
-            let persp = d / (d + q[2]);
-            let (bx, by) = b.to_px([cx + q[0] * persp, cy + q[1] * persp]);
-            let r = spacing * 0.5 * size * persp as f32 * s;
-            Some((q[2], Sprite::new(bx as f32, by as f32, r, [c[0], c[1], c[2], a], Shape::Sphere)))
-        })
-        .collect();
-    balls.sort_by(|a, b| b.0.total_cmp(&a.0));
-    let sprites: Vec<Sprite> = balls.into_iter().map(|(_, s)| s).collect();
-    SpritePlan { sprites, tints: vec![], acc: Acc::Over, post: Post::Replace }
-}
-
-// ------------------------------------------------------------------ CC Pixel Polly
-
-fn pixel_polly(ctx: &EffectCtx, b: Buf) -> Buf {
-    match pixel_polly_plan(ctx, &b) {
-        Some(plan) => plan.finish(b),
-        None => b,
-    }
-}
-
-/// CC Pixel Polly's pieces, `None` before Start Time (the layer as is).
-fn pixel_polly_plan(ctx: &EffectCtx, b: &Buf) -> Option<PiecePlan> {
-    let pr = ctx.params;
-    let t = ctx.time - pr.f("startTime");
-    if t <= 0.0 {
-        return None;
-    }
-    let force = pr.f("force");
-    let gravity = pr.f("gravity");
-    let spin = pr.f("spinning").to_radians();
-    let fc = pr.v2("forceCenter");
-    let dir_rand = pr.f("directionRandomness") / 100.0;
-    let spd_rand = pr.f("speedRandomness") / 100.0;
-    let g = pr.f("gridSpacing").max(1.0);
-    let object = pr.e("object");
-    let depth_sort = pr.b("enableDepthSort");
-    let seed = ctx.seed.wrapping_mul(0x632be5ab);
-    let [lw, lh] = ctx.layer_size;
-    let s = b.scale;
-    let cam = Cam { c: [b.offset[0] + lw * 0.5 * s, b.offset[1] + lh * 0.5 * s], d: 2.0 * lw.max(lh) * s };
-    let nx = (lw / g).ceil().max(1.0) as u32;
-    let ny = (lh / g).ceil().max(1.0) as u32;
-    let tri = object <= 1;
-    let textured = object == 1 || object == 3;
-    let maxd = lw.max(lh);
-    let src = &b.img;
-    let per = if tri { 2 } else { 1 };
-    let mut pieces: Vec<Piece> = (0..nx * ny * per)
-        .into_par_iter()
-        .filter_map(|i| {
-            let cell = i / per;
-            let (x0, y0) = ((cell % nx) as f64 * g, (cell / nx) as f64 * g);
-            let poly: Vec<[f64; 2]> = if !tri {
-                vec![[x0, y0], [x0 + g, y0], [x0 + g, y0 + g], [x0, y0 + g]]
-            } else if i % 2 == 0 {
-                vec![[x0, y0], [x0 + g, y0], [x0, y0 + g]]
-            } else {
-                vec![[x0 + g, y0], [x0 + g, y0 + g], [x0, y0 + g]]
-            };
-            let c = [poly.iter().map(|v| v[0]).sum::<f64>() / poly.len() as f64, poly.iter().map(|v| v[1]).sum::<f64>() / poly.len() as f64];
-            let (dx, dy) = (c[0] - fc[0], c[1] - fc[1]);
-            let dist = (dx * dx + dy * dy).sqrt().max(1e-6);
-            let ang = dy.atan2(dx) + dir_rand * std::f64::consts::PI * hs(i, 1, seed) as f64;
-            let speed = force / 100.0 * 0.6 * maxd / (1.0 + dist / (0.5 * maxd)) * (1.0 + spd_rand * hs(i, 2, seed) as f64);
-            let vz = -speed * 0.5 * h(i, 3, seed) as f64;
-            let pos = [c[0] + ang.cos() * speed * t, c[1] + ang.sin() * speed * t + 0.5 * gravity * 0.5 * lh * t * t, vz * t];
-            let axis = [hs(i, 4, seed) as f64, hs(i, 5, seed) as f64, hs(i, 6, seed) as f64];
-            let r = rot_axis(axis, t * (std::f64::consts::PI * h(i, 7, seed) as f64 + spin));
-            let tex: Vec<[f32; 2]> = poly.iter().map(|v| [(v[0] * s + b.offset[0]) as f32, (v[1] * s + b.offset[1]) as f32]).collect();
-            let c0 = [(c[0] * s + b.offset[0]) as f32, (c[1] * s + b.offset[1]) as f32];
-            let posb = [pos[0] * s + b.offset[0], pos[1] * s + b.offset[1], pos[2] * s];
-            let mut pc = Piece::new(&tex, c0, &r, posb, cam)?;
-            pc.shade = 0.35 + 0.65 * Piece::facing(&r);
-            if !textured {
-                let (cc, a) = unpremul(src.sample_bilinear(c0[0] as f64, c0[1] as f64));
-                if a <= 0.0 {
-                    return None;
-                }
-                pc.flat = Some(cc);
-                pc.alpha = a;
-            }
-            Some(pc)
-        })
-        .collect();
-    if depth_sort {
-        sort_far_first(&mut pieces);
-    }
-    Some(PiecePlan { pieces, front: PieceTex::Layer, back: None })
-}
-
-// ------------------------------------------------------------------ CC Scatterize
-
-fn scatterize(ctx: &EffectCtx, b: Buf) -> Buf {
-    match scatterize_plan(ctx, &b) {
-        Some(plan) => plan.finish(b),
-        None => b,
-    }
-}
-
-/// CC Scatterize's pixel dots, `None` when nothing moves (the layer as is).
-fn scatterize_plan(ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
-    let pr = ctx.params;
-    let scatter = pr.f("scatter") as f32;
-    let right = pr.f("rightTwist").to_radians();
-    let left = pr.f("leftTwist").to_radians();
-    if scatter == 0.0 && right == 0.0 && left == 0.0 {
-        return None;
-    }
-    let add = pr.e("transferMode") == 1;
-    let seed = ctx.seed.wrapping_mul(0x7feb352d);
-    let s = b.scale;
-    let (w, hh) = (b.img.width, b.img.height);
-    let (cx, cy) = (b.offset[0] + ctx.layer_size[0] * 0.5 * s, b.offset[1] + ctx.layer_size[1] * 0.5 * s);
-    let half = (ctx.layer_size[0] * 0.5 * s).max(1.0);
-    let d = 2.0 * ctx.layer_size[0].max(ctx.layer_size[1]) * s;
-    let src = &b.img;
-    let sprites: Vec<Sprite> = (0..w * hh)
-        .into_par_iter()
-        .filter_map(|i| {
-            let px = src.data[i as usize];
-            if px[3] <= 0.0 {
-                return None;
-            }
-            let (x, y) = ((i % w) as f64 + 0.5, (i / w) as f64 + 0.5);
-            // Twist about the horizontal axis through the centre, growing towards each side.
-            let k = ((x - cx) / half).abs().min(1.0);
-            let ang = if x < cx { left } else { right } * k;
-            let (sa, ca) = ang.sin_cos();
-            let (yy, zz) = ((y - cy) * ca, (y - cy) * sa);
-            let persp = d / (d + zz).max(d * 0.05);
-            let jx = hs(i, 1, seed) * scatter * s as f32;
-            let jy = hs(i, 2, seed) * scatter * s as f32;
-            let sx = cx + (x - cx) * persp + jx as f64;
-            let sy = cy + yy * persp + jy as f64;
-            let (c, a) = unpremul(px);
-            Some(Sprite::new(sx as f32, sy as f32, 0.6 * persp as f32, [c[0], c[1], c[2], a], Shape::Disc))
-        })
-        .collect();
-    Some(SpritePlan { sprites, tints: vec![], acc: if add { Acc::Add } else { Acc::Over }, post: Post::Replace })
-}
-
-/// What a particle effect that reads the layer's pixels draws this frame (CC Ball Action, CC
-/// Pixel Polly, CC Scatterize, Shatter's wireframe views), for layer `b`; `None` for other
-/// effects or a frame showing the layer as is.
-pub enum PixelPlan {
-    Sprites(SpritePlan),
-    Pieces(PiecePlan),
-}
-
-/// The [`PixelPlan`] of effect `id` for layer `b` (its pixels are read).
-pub fn pixel_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<PixelPlan> {
-    match id {
-        "ec.sim.ccballaction" => Some(PixelPlan::Sprites(ball_action_plan(ctx, b))),
-        "ec.sim.ccpixelpolly" => pixel_polly_plan(ctx, b).map(PixelPlan::Pieces),
-        "ec.sim.ccscatterize" => scatterize_plan(ctx, b).map(PixelPlan::Sprites),
-        "ec.sim.shatter" => Some(match shatter_impl(ctx, b) {
-            ShatterPlan::Pieces(plan) => PixelPlan::Pieces(plan),
-            ShatterPlan::Wire(plan) => PixelPlan::Sprites(plan),
-        }),
-        _ => None,
-    }
-}
-
-// ------------------------------------------------------------------ Card Dance
-
-const CD_SOURCES: &[&str] = &["None", "Intensity 1", "Red 1", "Green 1", "Blue 1", "Alpha 1", "Intensity 2", "Red 2", "Green 2", "Blue 2", "Alpha 2"];
-/// (param id prefix, twirl-down group match id) per transformed card property.
-const CD_PROPS: [(&str, &str); 8] = [
-    ("xPos", "xPosition"),
-    ("yPos", "yPosition"),
-    ("zPos", "zPosition"),
-    ("xRot", "xRotation"),
-    ("yRot", "yRotation"),
-    ("zRot", "zRotation"),
-    ("xScale", "xScale"),
-    ("yScale", "yScale"),
-];
-
-fn card_source(src: u32, g1: [f32; 4], g2: [f32; 4]) -> f32 {
-    let (c1, a1) = unpremul(g1);
-    let (c2, a2) = unpremul(g2);
-    let lum = |c: [f32; 3]| effectcraft_color::luminance(c[0], c[1], c[2]);
-    match src {
-        1 => lum(c1),
-        2 => c1[0],
-        3 => c1[1],
-        4 => c1[2],
-        5 => a1,
-        6 => lum(c2),
-        7 => c2[0],
-        8 => c2[1],
-        9 => c2[2],
-        10 => a2,
-        _ => 0.0,
-    }
-}
-
-fn card_dance(ctx: &EffectCtx, b: Buf) -> Buf {
-    card_dance_plan(ctx, &b).finish(b)
-}
-
-fn card_dance_plan(ctx: &EffectCtx, b: &Buf) -> PiecePlan {
-    let pr = ctx.params;
-    let rows = pr.f("rows").clamp(1.0, 1000.0) as u32;
-    let cols = if pr.e("rowsColumns") == 1 { rows } else { pr.f("columns").clamp(1.0, 1000.0) as u32 };
-    let g1 = layer_or_self(ctx, b, "gradientLayer1", true, true);
-    let g2 = layer_or_self(ctx, b, "gradientLayer2", true, true);
-    let back = ctx.layer_param("backLayer", true).map(|o| crate::util::fit_layer(ctx, b, &o, true));
-    let [lw, lh] = ctx.layer_size;
-    let s = b.scale;
-    let (cw, ch) = (lw / cols as f64, lh / rows as f64);
-    let cam = crate::card3d::projection(ctx, b);
-    let eye = cam.eye();
-    let light = Lighting::from(ctx, b);
-    let props: Vec<(u32, f64, f64)> =
-        CD_PROPS.iter().map(|(id, g)| (pr.e(&format!("{g}/{id}Source")), pr.f(&format!("{g}/{id}Multiplier")), pr.f(&format!("{g}/{id}Offset")))).collect();
-    let mut pieces: Vec<Piece> = (0..rows * cols)
-        .into_par_iter()
-        .filter_map(|i| {
-            let (cx0, cy0) = ((i % cols) as f64 * cw, (i / cols) as f64 * ch);
-            let c = [cx0 + cw * 0.5, cy0 + ch * 0.5];
-            let (bx, by) = (c[0] * s + b.offset[0], c[1] * s + b.offset[1]);
-            let (gp1, gp2) = (g1.sample_bilinear(bx, by), g2.sample_bilinear(bx, by));
-            let val = |k: usize| {
-                let (sr, m, o) = props[k];
-                o + m * card_source(sr, gp1, gp2) as f64
-            };
-            let (sx, sy) = (val(6), val(7));
-            let r = rot_xyz(val(3).to_radians(), val(4).to_radians(), val(5).to_radians());
-            let rs: M3 = std::array::from_fn(|k| [r[k][0] * sx, r[k][1] * sy, r[k][2]]);
-            let pos = [bx + val(0) * cw * s, by + val(1) * ch * s, val(2) * cw.max(ch) * s];
-            let (tx0, ty0) = ((cx0 * s + b.offset[0]) as f32, (cy0 * s + b.offset[1]) as f32);
-            let (tw, th) = ((cw * s) as f32, (ch * s) as f32);
-            let poly = [[tx0, ty0], [tx0 + tw, ty0], [tx0 + tw, ty0 + th], [tx0, ty0 + th]];
-            let mut pc = Piece::new(&poly, [bx as f32, by as f32], &rs, pos, cam)?;
-            pc.light(&light, &r, pos, eye);
-            Some(pc)
-        })
-        .collect();
-    sort_far_first(&mut pieces);
-    PiecePlan { pieces, front: PieceTex::Layer, back: back.map(PieceTex::Image) }
-}
-
-// ------------------------------------------------------------------ Shatter
-
-/// Shatter's Pattern options; the last, Custom, takes its pieces from Custom Shatter Map.
-const SHATTER_PATTERNS: &[&str] = &["Bricks", "Glass", "Hexagons", "Squares", "Triangles", "Custom"];
-
-/// Pattern cells (polygons in pattern space, before rotation) covering `[x0, x1]×[y0, y1]`.
-fn pattern_cells(kind: u32, cell: f64, x0: f64, y0: f64, x1: f64, y1: f64, seed: u32) -> Vec<Vec<[f64; 2]>> {
-    let mut out = Vec::new();
-    let i0 = (x0 / cell).floor() as i64 - 1;
-    let i1 = (x1 / cell).ceil() as i64 + 1;
-    let j0 = (y0 / cell).floor() as i64 - 1;
-    let j1 = (y1 / cell).ceil() as i64 + 1;
-    match kind {
-        0 => {
-            let bh = cell * 0.5;
-            let r0 = (y0 / bh).floor() as i64 - 1;
-            let r1 = (y1 / bh).ceil() as i64 + 1;
-            for r in r0..=r1 {
-                let sh = if r.rem_euclid(2) == 1 { cell * 0.5 } else { 0.0 };
-                for i in i0..=i1 {
-                    let (x, y) = (i as f64 * cell + sh, r as f64 * bh);
-                    out.push(vec![[x, y], [x + cell, y], [x + cell, y + bh], [x, y + bh]]);
-                }
-            }
-        }
-        1 => {
-            // Jittered lattice split into triangles along a random diagonal.
-            let jit = |i: i64, j: i64| -> [f64; 2] {
-                let (a, b) = (i as u32, j as u32);
-                [i as f64 * cell + hs(a, b.wrapping_add(17), seed) as f64 * cell * 0.35, j as f64 * cell + hs(a, b.wrapping_add(91), seed) as f64 * cell * 0.35]
-            };
-            for j in j0..=j1 {
-                for i in i0..=i1 {
-                    let (p00, p10, p11, p01) = (jit(i, j), jit(i + 1, j), jit(i + 1, j + 1), jit(i, j + 1));
-                    if h(i as u32, j as u32, seed ^ 0x55) < 0.5 {
-                        out.push(vec![p00, p10, p11]);
-                        out.push(vec![p00, p11, p01]);
-                    } else {
-                        out.push(vec![p00, p10, p01]);
-                        out.push(vec![p10, p11, p01]);
-                    }
-                }
-            }
-        }
-        2 => {
-            let r = cell / 3f64.sqrt();
-            let dx = 1.5 * r;
-            let dy = 3f64.sqrt() * r;
-            let c0 = (x0 / dx).floor() as i64 - 1;
-            let c1 = (x1 / dx).ceil() as i64 + 1;
-            let rr0 = (y0 / dy).floor() as i64 - 1;
-            let rr1 = (y1 / dy).ceil() as i64 + 1;
-            for ci in c0..=c1 {
-                for rj in rr0..=rr1 {
-                    let cx = ci as f64 * dx;
-                    let cy = (rj as f64 + if ci.rem_euclid(2) == 1 { 0.5 } else { 0.0 }) * dy;
-                    out.push(
-                        (0..6)
-                            .map(|k| {
-                                let a = k as f64 * std::f64::consts::PI / 3.0;
-                                [cx + r * a.cos(), cy + r * a.sin()]
-                            })
-                            .collect(),
-                    );
-                }
-            }
-        }
-        3 => {
-            for j in j0..=j1 {
-                for i in i0..=i1 {
-                    let (x, y) = (i as f64 * cell, j as f64 * cell);
-                    out.push(vec![[x, y], [x + cell, y], [x + cell, y + cell], [x, y + cell]]);
-                }
-            }
-        }
-        _ => {
-            for j in j0..=j1 {
-                for i in i0..=i1 {
-                    let (x, y) = (i as f64 * cell, j as f64 * cell);
-                    if (i + j).rem_euclid(2) == 0 {
-                        out.push(vec![[x, y], [x + cell, y], [x, y + cell]]);
-                        out.push(vec![[x + cell, y], [x + cell, y + cell], [x, y + cell]]);
-                    } else {
-                        out.push(vec![[x, y], [x + cell, y], [x + cell, y + cell]]);
-                        out.push(vec![[x, y], [x + cell, y + cell], [x, y + cell]]);
-                    }
-                }
-            }
-        }
-    }
-    out
-}
-
-/// `∫0^t e^{-ks} ds` and `∫0^t ∫0^u e^{-ks} ds du` (drag-damped ballistic factors).
-fn drag_factors(k: f64, t: f64) -> (f64, f64) {
-    if k < 1e-6 {
-        (t, 0.5 * t * t)
-    } else {
-        let e = (-k * t).exp();
-        ((1.0 - e) / k, t / k - (1.0 - e) / (k * k))
-    }
-}
-/// Shatter's Front / Side / Back Mode options.
-const SHATTER_TEXTURE_MODES: [&str; 3] = ["Color", "Layer", "Tinted Layer"];
-
-/// One face's texture: a flat colour, a layer, or a layer tinted by the Textures colour.
-struct Face {
-    mode: u32,
-    img: Option<Image>,
-}
-
-impl Face {
-    fn from(ctx: &EffectCtx, b: &Buf, mode: &str, layer: &str, default_mode: u32) -> Face {
-        let mode = ctx.params.get(mode).map(|v| v.as_enum()).unwrap_or(default_mode);
-        // A face layer of None is the effect's own layer.
-        let img = (mode != 0).then(|| layer_or_self(ctx, b, layer, true, true));
-        Face { mode, img }
-    }
-}
-
-/// Group key of a Custom Shatter Map colour (pieces of one colour break as one).
-fn map_key(c: [f32; 4]) -> u32 {
-    let (c, a) = unpremul(c);
-    if a < 0.5 {
-        return u32::MAX;
-    }
-    let q = |v: f32| ((v.clamp(0.0, 1.0) * 15.0).round() as u32) & 15;
-    q(c[0]) << 8 | q(c[1]) << 4 | q(c[2])
-}
-
-fn shatter(ctx: &EffectCtx, b: Buf) -> Buf {
-    match shatter_impl(ctx, &b) {
-        ShatterPlan::Pieces(plan) => plan.finish(b),
-        ShatterPlan::Wire(plan) => plan.finish(b),
-    }
-}
-
-/// What Shatter draws: the pieces (Rendered view) or the wireframe lines.
-enum ShatterPlan {
-    Pieces(PiecePlan),
-    Wire(SpritePlan),
-}
-
-fn shatter_impl(ctx: &EffectCtx, b: &Buf) -> ShatterPlan {
-    let pr = ctx.params;
-    let view = pr.e("view");
-    let render = pr.e("render");
-    let kind = pr.e("shape/pattern");
-    let custom = kind as usize == SHATTER_PATTERNS.len() - 1;
-    let reps = pr.f("shape/repetitions").clamp(1.0, 500.0);
-    let dir = pr.f("shape/direction").to_radians();
-    let origin = pr.v2("shape/origin");
-    let forces = [
-        (pr.v2("force1/force1Position"), pr.f("force1/force1Depth"), pr.f("force1/force1Radius"), pr.f("force1/force1Strength")),
-        (pr.v2("force2/force2Position"), pr.f("force2/force2Depth"), pr.f("force2/force2Radius"), pr.f("force2/force2Strength")),
-    ];
-    let rot_speed = pr.f("physics/rotationSpeed");
-    let tumble = pr.e("physics/tumbleAxis");
-    let randomness = pr.f("physics/randomness");
-    let k = pr.f("physics/viscosity").max(0.0) * 5.0;
-    let mass_var = pr.f("physics/massVariance") / 100.0;
-    let gravity = pr.f("physics/gravity");
-    let gdir = pr.f("physics/gravityDirection").to_radians();
-    let ginc = pr.f("physics/gravityInclination").to_radians();
-    let seed = (pr.f("randomSeed") as u32).wrapping_mul(0x9e3779b1) ^ ctx.seed;
-    let [lw, lh] = ctx.layer_size;
-    let s = b.scale;
-    let t = ctx.time.max(0.0);
-    let unit = lw * 0.1;
-    let cell = lw / reps;
-    let extrude = pr.f("shape/extrusionDepth").max(0.0) * cell * s;
-    let cam = crate::card3d::projection(ctx, b);
-    let eye = cam.eye();
-    let light = Lighting::from(ctx, b);
-    // Gradient: with a gradient layer only pieces at least as bright as 1 − Shatter Threshold
-    // (Invert Gradient: as dark) break.
-    let gradient = ctx.layer_param("gradient/gradientLayer", true).map(|o| crate::util::fit_layer(ctx, b, &o, true));
-    let threshold = pr.get("gradient/shatterThreshold").map(Value::as_f64).unwrap_or(0.0) / 100.0;
-    let invert_gradient = pr.b("gradient/invertGradient");
-    // Textures.
-    let tex_color = pr.get("textures/color").map(|v| v.as_color()).unwrap_or([1.0; 4]);
-    let tex_opacity = pr.get("textures/opacity").map(Value::as_f64).unwrap_or(1.0).clamp(0.0, 1.0) as f32;
-    let front = Face::from(ctx, b, "textures/frontMode", "textures/frontLayer", 1);
-    let side = Face::from(ctx, b, "textures/sideMode", "textures/sideLayer", 0);
-    let backf = Face::from(ctx, b, "textures/backMode", "textures/backLayer", 1);
-    let custom_map = custom.then(|| layer_or_self(ctx, b, "shape/customShatterMap", true, true));
-    let white_fixed = pr.b("shape/whiteTilesFixed");
-    let (sd, cd) = dir.sin_cos();
-    let to_layer = |q: [f64; 2]| [origin[0] + q[0] * cd - q[1] * sd, origin[1] + q[0] * sd + q[1] * cd];
-    // Pattern-space bounds of the layer rectangle.
-    let corners = [[0.0, 0.0], [lw, 0.0], [lw, lh], [0.0, lh]].map(|c: [f64; 2]| {
-        let (dx, dy) = (c[0] - origin[0], c[1] - origin[1]);
-        [dx * cd + dy * sd, -dx * sd + dy * cd]
-    });
-    let (px0, px1) = (corners.iter().map(|c| c[0]).fold(f64::INFINITY, f64::min), corners.iter().map(|c| c[0]).fold(f64::NEG_INFINITY, f64::max));
-    let (py0, py1) = (corners.iter().map(|c| c[1]).fold(f64::INFINITY, f64::min), corners.iter().map(|c| c[1]).fold(f64::NEG_INFINITY, f64::max));
-    // Custom Shatter Map: square cells grouped by the map's colour.
-    let cells = pattern_cells(if custom { 3 } else { kind }, cell, px0, py0, px1, py1, seed);
-    let polys: Vec<Vec<[f64; 2]>> = cells.iter().map(|poly| poly.iter().map(|&q| to_layer(q)).collect()).collect();
-    let centre = |lp: &[[f64; 2]]| [lp.iter().map(|v| v[0]).sum::<f64>() / lp.len() as f64, lp.iter().map(|v| v[1]).sum::<f64>() / lp.len() as f64];
-    let keys: Vec<u32> = match &custom_map {
-        Some(m) => polys
-            .iter()
-            .map(|lp| {
-                let c = centre(lp);
-                map_key(m.sample_bilinear(c[0] * s + b.offset[0], c[1] * s + b.offset[1]))
-            })
-            .collect(),
-        None => (0..polys.len() as u32).collect(),
-    };
-    // Group centres (custom map) — each group moves as one rigid piece.
-    let mut groups: std::collections::HashMap<u32, ([f64; 2], f64)> = std::collections::HashMap::new();
-    for (lp, &key) in polys.iter().zip(&keys) {
-        let c = centre(lp);
-        let e = groups.entry(key).or_insert(([0.0; 2], 0.0));
-        e.0[0] += c[0];
-        e.0[1] += c[1];
-        e.1 += 1.0;
-    }
-    let g3 = [gdir.sin() * ginc.cos() * gravity * unit, -gdir.cos() * ginc.cos() * gravity * unit, ginc.sin() * gravity * unit];
-    let mut pieces: Vec<Piece> = polys
-        .par_iter()
-        .zip(keys.par_iter())
-        .flat_map_iter(|(lp, &key)| {
-            let mut out: Vec<Piece> = vec![];
-            let (mnx, mxx) = (lp.iter().map(|v| v[0]).fold(f64::INFINITY, f64::min), lp.iter().map(|v| v[0]).fold(f64::NEG_INFINITY, f64::max));
-            let (mny, mxy) = (lp.iter().map(|v| v[1]).fold(f64::INFINITY, f64::min), lp.iter().map(|v| v[1]).fold(f64::NEG_INFINITY, f64::max));
-            if mxx < 0.0 || mxy < 0.0 || mnx > lw || mny > lh || key == u32::MAX {
-                return out.into_iter();
-            }
-            let pc_c = centre(lp);
-            let (gsum, gn) = groups[&key];
-            let gc = [gsum[0] / gn, gsum[1] / gn];
-            let i = key;
-            // Broken when inside a force sphere (centred `depth` in front of the layer).
-            let mut v = [0.0f64; 3];
-            let mut broken = false;
-            for (fp, fd, fr, fs) in forces {
-                let rad = fr * lw;
-                if rad <= 0.0 {
-                    continue;
-                }
-                let dv = [gc[0] - fp[0], gc[1] - fp[1], fd * lw];
-                let dist = (dv[0] * dv[0] + dv[1] * dv[1] + dv[2] * dv[2]).sqrt();
-                if dist < rad {
-                    broken = true;
-                    let f = fs * (1.0 - dist / rad) * unit / dist.max(1e-6);
-                    for q in 0..3 {
-                        v[q] += dv[q] * f;
-                    }
-                }
-            }
-            if broken && let Some(g) = &gradient {
-                let (c, _) = unpremul(g.sample_bilinear(gc[0] * s + b.offset[0], gc[1] * s + b.offset[1]));
-                let mut l = effectcraft_color::luminance(c[0], c[1], c[2]).clamp(0.0, 1.0) as f64;
-                if invert_gradient {
-                    l = 1.0 - l;
-                }
-                broken = threshold > 0.0 && l >= 1.0 - threshold;
-            }
-            if broken && custom && white_fixed && key == 0xfff {
-                broken = false;
-            }
-            if (broken && render == 1) || (!broken && render == 2) {
-                return out.into_iter();
-            }
-            let mut gpos = [gc[0], gc[1], 0.0];
-            let mut r = rot_axis([1.0, 0.0, 0.0], 0.0);
-            let moving = broken && t > 0.0;
-            if moving {
-                let mass = 1.0 + mass_var * hs(i, 1, seed) as f64;
-                for q in 0..3 {
-                    v[q] = v[q] / mass + randomness * unit * hs(i, 2 + q as u32, seed) as f64 * 2.0;
-                }
-                let (f1, f2) = drag_factors(k, t);
-                for q in 0..3 {
-                    gpos[q] += v[q] * f1 + g3[q] * f2;
-                }
-                let axis = match tumble {
-                    1 => [0.0, 0.0, 0.0],
-                    2 => [1.0, 0.0, 0.0],
-                    3 => [0.0, 1.0, 0.0],
-                    4 => [0.0, 0.0, 1.0],
-                    5 => [hs(i, 6, seed) as f64, hs(i, 7, seed) as f64, 0.0],
-                    6 => [hs(i, 6, seed) as f64, 0.0, hs(i, 8, seed) as f64],
-                    7 => [0.0, hs(i, 7, seed) as f64, hs(i, 8, seed) as f64],
-                    _ => [hs(i, 6, seed) as f64, hs(i, 7, seed) as f64, hs(i, 8, seed) as f64],
-                };
-                let speed = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt() / unit;
-                let omega = rot_speed * std::f64::consts::TAU * (0.5 + h(i, 9, seed) as f64) * speed.min(10.0);
-                r = rot_axis(axis, omega * f1);
-            }
-            // The piece's centre: its offset from the group centre, rotated with the group.
-            let off = [pc_c[0] - gc[0], pc_c[1] - gc[1], 0.0];
-            let pos: [f64; 3] = std::array::from_fn(|q| gpos[q] + (0..3).map(|k| r[q][k] * off[k]).sum::<f64>());
-            let tex: Vec<[f32; 2]> = lp.iter().map(|v| [(v[0] * s + b.offset[0]) as f32, (v[1] * s + b.offset[1]) as f32]).collect();
-            let c0 = [(pc_c[0] * s + b.offset[0]) as f32, (pc_c[1] * s + b.offset[1]) as f32];
-            let posb = [pos[0] * s + b.offset[0], pos[1] * s + b.offset[1], pos[2] * s];
-            let Some(mut pc) = Piece::new(&tex, c0, &r, posb, cam) else { return out.into_iter() };
-            pc.light(&light, &r, posb, eye);
-            pc.alpha = tex_opacity;
-            let face = if pc.back { &backf } else { &front };
-            if face.mode == 0 {
-                pc.flat = Some([tex_color[0], tex_color[1], tex_color[2]]);
-            } else if face.mode == 2 {
-                pc.tint = std::array::from_fn(|q| pc.tint[q] * tex_color[q]);
-            }
-            // Extrusion: the sides of a moving piece, from its front outline back by the depth.
-            if moving && extrude > 0.0 {
-                let nb = [r[0][2], r[1][2], r[2][2]];
-                let n = tex.len();
-                for e in 0..n {
-                    let (a, bv) = (tex[e], tex[(e + 1) % n]);
-                    let ed = [(bv[0] - a[0]) as f64, (bv[1] - a[1]) as f64];
-                    let len = (ed[0] * ed[0] + ed[1] * ed[1]).sqrt();
-                    if len < 1e-6 {
-                        continue;
-                    }
-                    let ew: [f64; 3] = std::array::from_fn(|q| (r[q][0] * ed[0] + r[q][1] * ed[1]) / len);
-                    let third = [ew[1] * nb[2] - ew[2] * nb[1], ew[2] * nb[0] - ew[0] * nb[2], ew[0] * nb[1] - ew[1] * nb[0]];
-                    let rs: M3 = std::array::from_fn(|q| [ew[q], nb[q], third[q]]);
-                    // Side centre in world: edge midpoint (world) plus half the depth backwards.
-                    let mid = [((a[0] + bv[0]) * 0.5 - c0[0]) as f64, ((a[1] + bv[1]) * 0.5 - c0[1]) as f64];
-                    let mw: [f64; 3] = std::array::from_fn(|q| posb[q] + r[q][0] * mid[0] + r[q][1] * mid[1] + nb[q] * extrude * 0.5);
-                    let (hl, hd) = ((len * 0.5) as f32, (extrude * 0.5) as f32);
-                    let cs = [(a[0] + bv[0]) * 0.5, (a[1] + bv[1]) * 0.5];
-                    let quad = [[cs[0] - hl, cs[1] - hd], [cs[0] + hl, cs[1] - hd], [cs[0] + hl, cs[1] + hd], [cs[0] - hl, cs[1] + hd]];
-                    if let Some(mut sp) = Piece::new(&quad, cs, &rs, mw, cam) {
-                        sp.light(&light, &rs, mw, eye);
-                        sp.alpha = tex_opacity;
-                        let colour = match (&side.img, side.mode) {
-                            (Some(img), m) if m != 0 => {
-                                let (c, _) = unpremul(img.sample_bilinear(cs[0] as f64, cs[1] as f64));
-                                if m == 2 { std::array::from_fn(|q| c[q] * tex_color[q]) } else { c }
-                            }
-                            _ => [tex_color[0], tex_color[1], tex_color[2]],
-                        };
-                        sp.flat = Some(colour);
-                        out.push(sp);
-                    }
-                }
-            }
-            out.push(pc);
-            out.into_iter()
-        })
-        .collect();
-    sort_far_first(&mut pieces);
-    if view == 0 {
-        let tex = |i: &Option<Image>| i.clone().map(PieceTex::Image);
-        let front_t = tex(&front.img).unwrap_or(PieceTex::Layer);
-        let back_t = tex(&backf.img).unwrap_or_else(|| front_t.clone());
-        return ShatterPlan::Pieces(PiecePlan { pieces, front: front_t, back: Some(back_t) });
-    }
-    {
-        // Wireframes: piece outlines (front view: at rest; otherwise animated), plus forces.
-        let animated = view == 2 || view == 4;
-        let mut lines = Vec::new();
-        for pc in &pieces {
-            let n = pc.n as usize;
-            let pts: Vec<[f32; 2]> = if animated {
-                let fw = inv3(&pc.inv);
-                match fw {
-                    Some(m) => pc.poly[..n]
-                        .iter()
-                        .map(|v| {
-                            let (a, bb) = ((v[0] - pc.c0[0]) as f64, (v[1] - pc.c0[1]) as f64);
-                            let w = m[2][0] * a + m[2][1] * bb + m[2][2];
-                            [((m[0][0] * a + m[0][1] * bb + m[0][2]) / w) as f32, ((m[1][0] * a + m[1][1] * bb + m[1][2]) / w) as f32]
-                        })
-                        .collect(),
-                    None => continue,
-                }
-            } else {
-                pc.poly[..n].to_vec()
-            };
-            for e in 0..n {
-                let (a, c) = (pts[e], pts[(e + 1) % n]);
-                lines.push(Sprite::new(a[0], a[1], 0.5, [0.75, 0.85, 1.0, 1.0], Shape::Line { dx: c[0] - a[0], dy: c[1] - a[1] }));
-            }
-        }
-        if view >= 3 {
-            for (fp, _, fr, _) in forces {
-                let (fx, fy) = b.to_px(fp);
-                let rad = fr * lw * s;
-                for k in 0..64 {
-                    let (a0, a1) = (k as f64 / 64.0 * std::f64::consts::TAU, (k + 1) as f64 / 64.0 * std::f64::consts::TAU);
-                    let (x0, y0) = (fx + rad * a0.cos(), fy + rad * a0.sin());
-                    let (x1, y1) = (fx + rad * a1.cos(), fy + rad * a1.sin());
-                    lines.push(Sprite::new(x0 as f32, y0 as f32, 0.5, [1.0, 0.3, 0.3, 1.0], Shape::Line { dx: (x1 - x0) as f32, dy: (y1 - y0) as f32 }));
-                }
-            }
-        }
-        ShatterPlan::Wire(SpritePlan { sprites: lines, tints: vec![], acc: Acc::Over, post: Post::Replace })
-    }
-}
-
-// ------------------------------------------------------------------ Caustics
-
-/// Sample with repeat mode: 0 Once (transparent outside), 1 Tiled, 2 Reflected.
-fn sample_repeat(img: &Image, x: f64, y: f64, mode: u32) -> Px {
-    let (w, hh) = (img.width as f64, img.height as f64);
-    match mode {
-        1 => img.sample_bilinear_clamped(x.rem_euclid(w), y.rem_euclid(hh)),
-        2 => {
-            let m = |v: f64, n: f64| {
-                let r = v.rem_euclid(2.0 * n);
-                if r > n { 2.0 * n - r } else { r }
-            };
-            img.sample_bilinear_clamped(m(x, w), m(y, hh))
-        }
-        _ => img.sample_bilinear(x, y),
-    }
-}
-
-/// Everything Caustics' per-pixel pass needs, prepared on the CPU (the other layers it reads
-/// and the parameter conversions); the layer's own pixels are not read.
-pub struct CausticsSetup {
-    /// The Bottom layer fitted to the buffer, `None` = the layer itself.
-    pub bottom: Option<Image>,
-    /// Gaussian σ (buffer px) blurring the bottom (transparent edges), 0 = none.
-    pub bottom_sigma: f64,
-    /// The water surface's height field (smoothed luminance), `None` = flat.
-    pub height: Option<Plane>,
-    /// The Sky layer fitted to the buffer.
-    pub sky: Option<Image>,
-    pub scaling: f64,
-    pub repeat: u32,
-    pub wave_h: f64,
-    /// Displacement per unit of height gradient.
-    pub k: f64,
-    /// Layer centre (buffer px).
-    pub cx: f64,
-    pub cy: f64,
-    /// Layer width (buffer px).
-    pub lw: f64,
-    pub surf: [f32; 4],
-    pub surf_op: f32,
-    pub cstr: f32,
-    pub lc: [f32; 4],
-    pub li: f32,
-    /// Light position (buffer px) and height (layer widths); `point` = from the position to
-    /// each pixel, else one direction from above the layer centre.
-    pub lx: f64,
-    pub ly: f64,
-    pub lheight: f64,
-    pub point: bool,
-    pub ambient: f32,
-    pub diffuse: f32,
-    pub specular: f32,
-    pub sharp: f32,
-    pub sky_scaling: f64,
-    pub sky_repeat: u32,
-    pub sky_int: f32,
-    pub convergence: f64,
-}
-
-/// Caustics' setup for layer geometry `b` (see [`CausticsSetup`]).
-pub fn caustics_setup(ctx: &EffectCtx, b: &Buf) -> CausticsSetup {
-    let pr = ctx.params;
-    let s = b.scale;
-    let bottom = ctx.layer_param("bottom/bottom", true).map(|o| crate::util::fit_layer(ctx, b, &o, pr.e("bottom/bottomSizeDiffers") == 1));
-    let blur = pr.f("bottom/blur") * s;
-    let wave_h = pr.f("water/waveHeight");
-    let smoothing = pr.f("water/smoothing") * s;
-    let depth = pr.f("water/waterDepth");
-    let ior = pr.f("water/refractiveIndex").max(1.0);
-    let lpos = pr.v2("lighting/lightPosition");
-    // Height field of the water surface (luminance of the chosen layer; none = flat).
-    let height = ctx.layer_param("water/waterSurface", true).map(|o| {
-        let img = crate::util::fit_layer(ctx, b, &o, true);
-        let pl = Plane::luma(&img);
-        if smoothing > 0.05 { gauss_plane(&pl, smoothing * 0.5, smoothing * 0.5) } else { pl }
-    });
-    let lw = ctx.layer_size[0] * s;
-    let k = wave_h * depth * (1.0 - 1.0 / ior) * lw * 2.0;
-    let (cx, cy) = (b.offset[0] + ctx.layer_size[0] * 0.5 * s, b.offset[1] + ctx.layer_size[1] * 0.5 * s);
-    let (lx, ly) = b.to_px(lpos);
-    let (lc, li, lheight) = (pr.color("lighting/lightColor"), pr.f("lighting/lightIntensity") as f32, pr.f("lighting/lightHeight").max(0.01));
-    // Light Type: Distant Source (one direction, from the light position above the layer
-    // centre), Point Source (from the light position to each pixel) or First Comp Light.
-    let light_type = pr.e("lighting/lightType");
-    let comp_light = if light_type == 2 { ctx.env.host.and_then(|h| h.comp_scene()).and_then(|sc| sc.light) } else { None };
-    let (lc, li, lx, ly, lheight, point) = match (light_type, comp_light) {
-        (2, Some(l)) => {
-            let c = [l.color[0], l.color[1], l.color[2], 1.0];
-            // Comp space: z away from the viewer; the light above the water is at −z.
-            let (px, py) = (l.pos[0] * s + b.offset[0], l.pos[1] * s + b.offset[1]);
-            (c, li, px, py, (-l.pos[2] / ctx.layer_size[0].max(1.0)).max(0.01), l.kind == 1)
-        }
-        (2, None) => (lc, 0.0, lx, ly, lheight, false),
-        (1, _) => (lc, li, lx, ly, lheight, true),
-        _ => (lc, li, lx, ly, lheight, false),
-    };
-    // Sky: the layer the water surface reflects (Surface Opacity 1 = a mirror of it).
-    let sky = ctx.layer_param("sky/sky", true).map(|o| crate::util::fit_layer(ctx, b, &o, pr.e("sky/skySizeDiffers") == 1));
-    CausticsSetup {
-        bottom,
-        bottom_sigma: if blur > 0.05 { blur * 0.5 } else { 0.0 },
-        height,
-        sky,
-        scaling: pr.f("bottom/scaling").max(0.01),
-        repeat: pr.e("bottom/repeatMode"),
-        wave_h,
-        k,
-        cx,
-        cy,
-        lw,
-        surf: pr.color("water/surfaceColor"),
-        surf_op: pr.f("water/surfaceOpacity") as f32,
-        cstr: pr.f("water/causticsStrength") as f32,
-        lc,
-        li,
-        lx,
-        ly,
-        lheight,
-        point,
-        ambient: pr.f("lighting/ambientLight") as f32,
-        diffuse: pr.f("material/diffuse") as f32,
-        specular: pr.f("material/specular") as f32,
-        sharp: pr.f("material/highlightSharpness").max(1.0) as f32,
-        sky_scaling: pr.get("sky/scaling").map(Value::as_f64).unwrap_or(1.0).max(0.01),
-        sky_repeat: pr.e("sky/repeatMode"),
-        sky_int: pr.get("sky/intensity").map(Value::as_f64).unwrap_or(0.3) as f32,
-        convergence: pr.get("sky/convergence").map(Value::as_f64).unwrap_or(0.5).clamp(0.0, 1.0),
-    }
-}
-
-fn caustics(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let st = caustics_setup(ctx, &b);
-    let mut bottom = st.bottom.clone().unwrap_or_else(|| b.img.clone());
-    if st.bottom_sigma > 0.0 {
-        bottom = effectcraft_raster::gaussian_blur(&bottom, st.bottom_sigma, st.bottom_sigma, false);
-    }
-    let CausticsSetup {
-        scaling,
-        repeat,
-        wave_h,
-        k,
-        cx,
-        cy,
-        lw,
-        surf,
-        surf_op,
-        cstr,
-        lc,
-        li,
-        lx,
-        ly,
-        lheight,
-        point,
-        ambient,
-        diffuse,
-        specular,
-        sharp,
-        sky_scaling,
-        sky_repeat,
-        sky_int,
-        convergence,
-        ..
-    } = st;
-    let (height, sky) = (&st.height, &st.sky);
-    let (w, hh) = (b.img.width as usize, b.img.height as usize);
-    let norm3 = |v: [f64; 3]| {
-        let n = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt().max(1e-12);
-        [(v[0] / n) as f32, (v[1] / n) as f32, (v[2] / n) as f32]
-    };
-    let lv_at = |x: f64, y: f64| {
-        if point {
-            norm3([(lx - x) / lw.max(1.0), (ly - y) / lw.max(1.0), lheight])
-        } else {
-            norm3([(lx - cx) / lw.max(1.0), (ly - cy) / lw.max(1.0), lheight])
-        }
-    };
-    let grad = |x: usize, y: usize| -> (f64, f64) {
-        match height {
-            Some(pl) => {
-                let gx = (pl.get_clamped(x as i64 + 1, y as i64) - pl.get_clamped(x as i64 - 1, y as i64)) as f64 * 0.5;
-                let gy = (pl.get_clamped(x as i64, y as i64 + 1) - pl.get_clamped(x as i64, y as i64 - 1)) as f64 * 0.5;
-                (gx, gy)
-            }
-            None => (0.0, 0.0),
-        }
-    };
-    // Displacement and its Jacobian (caustic focusing) per pixel.
-    let disp: Vec<(f64, f64)> = (0..w * hh)
-        .into_par_iter()
-        .map(|i| {
-            let (gx, gy) = grad(i % w, i / w);
-            (-gx * k, -gy * k)
-        })
-        .collect();
-    b.img.rows_mut().for_each(|(y, row)| {
-        for (x, px) in row.iter_mut().enumerate() {
-            let i = y * w + x;
-            let (dx, dy) = disp[i];
-            let d = |xx: usize, yy: usize| disp[yy.min(hh - 1) * w + xx.min(w - 1)];
-            let (dxr, _) = d(x + 1, y);
-            let (_, dyd) = d(x, y + 1);
-            let (dxl, _) = d(x.saturating_sub(1), y);
-            let (_, dyu) = d(x, y.saturating_sub(1));
-            let jac = (1.0 + (dxr - dxl) * 0.5) * (1.0 + (dyd - dyu) * 0.5);
-            let focus = ((1.0 / jac.abs().max(0.2)) as f32 - 1.0).clamp(-1.0, 4.0);
-            let sx = cx + (x as f64 + 0.5 + dx - cx) / scaling;
-            let sy = cy + (y as f64 + 0.5 + dy - cy) / scaling;
-            let p = sample_repeat(&bottom, sx, sy, repeat);
-            let (c, a) = unpremul(p);
-            let (gx, gy) = grad(x, y);
-            let n = {
-                let v = [-gx * wave_h * 20.0, -gy * wave_h * 20.0, 1.0];
-                let m = (v[0] * v[0] + v[1] * v[1] + 1.0).sqrt();
-                [(v[0] / m) as f32, (v[1] / m) as f32, (v[2] / m) as f32]
-            };
-            let lv = lv_at(x as f64 + 0.5, y as f64 + 0.5);
-            let nl = (n[0] * lv[0] + n[1] * lv[1] + n[2] * lv[2]).max(0.0);
-            let hv = {
-                let v = [lv[0], lv[1], lv[2] + 1.0];
-                let m = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
-                [v[0] / m, v[1] / m, v[2] / m]
-            };
-            let spec = (n[0] * hv[0] + n[1] * hv[1] + n[2] * hv[2]).max(0.0).powf(sharp) * specular * li;
-            let light = ambient + diffuse * li * nl + cstr * focus * li;
-            // The surface: its colour lit like the water, or the sky it reflects (sampled along
-            // the surface normal; Convergence pulls the reflection towards the pixel itself).
-            let surface: [f32; 3] = match &sky {
-                Some(sk) => {
-                    let reach = (1.0 - convergence) * lw * 0.5;
-                    let (rx, ry) = (x as f64 + 0.5 + n[0] as f64 * reach, y as f64 + 0.5 + n[1] as f64 * reach);
-                    let (rx, ry) = (cx + (rx - cx) / sky_scaling, cy + (ry - cy) / sky_scaling);
-                    let (sc, _) = unpremul(sample_repeat(sk, rx, ry, sky_repeat));
-                    std::array::from_fn(|q| sc[q] * sky_int * 3.0 * surf[q])
-                }
-                None => std::array::from_fn(|q| surf[q] * (ambient + diffuse * li * nl)),
-            };
-            let cc: [f32; 3] = std::array::from_fn(|q| {
-                let base = c[q] * light * lc[q];
-                base * (1.0 - surf_op) + surface[q] * surf_op + spec * lc[q]
-            });
-            let a = (a + surf_op * (1.0 - a)).min(1.0);
-            *px = [cc[0] * a, cc[1] * a, cc[2] * a, a];
-        }
-    });
-    b
-}
-
-// ------------------------------------------------------------------ Wave World
-
-/// Wave World's simulated surface: an `nx` × `ny` grid of heights `u` and velocities `v`.
-#[derive(Clone, Debug)]
-pub struct Waves {
-    pub nx: usize,
-    pub ny: usize,
-    pub u: Vec<f32>,
-    pub v: Vec<f32>,
-}
-
-struct Producer {
-    ring: bool,
-    pos: [f32; 2],
-    len: f32,
-    width: f32,
-    angle: f32,
-    amp: f32,
-    freq: f32,
-    phase: f32,
-}
-
-impl Producer {
-    /// Weight of a grid point (layer-fraction coordinates, x in widths, y in widths).
-    fn weight(&self, x: f32, y: f32) -> f32 {
-        let (dx, dy) = (x - self.pos[0], y - self.pos[1]);
-        let (sa, ca) = self.angle.sin_cos();
-        let (u, v) = (dx * ca + dy * sa, -dx * sa + dy * ca);
-        let d = if self.ring {
-            let (a, bb) = ((self.len * 0.5).max(1e-3), (self.width * 0.5).max(1e-3));
-            ((u / a).powi(2) + (v / bb).powi(2)).sqrt()
-        } else {
-            let l = (self.len * 0.5).max(1e-3);
-            let wd = (self.width * 0.5).max(1e-3);
-            (u.abs() / l).max(v.abs() / wd)
-        };
-        (1.0 - d).clamp(0.0, 1.0).min(1.0)
-    }
-}
-
-static WAVE_CACHE: SimCache<Waves> = SimCache::new(4);
-
-/// What Wave World draws: the Height Map view of the simulated surface (grid heights and,
-/// with a ground layer, water depths per grid point), or the wireframe preview's lines.
-pub enum WavePlan {
-    Height { st: std::sync::Arc<Waves>, depth: Option<Vec<f32>> },
-    Wire(crate::sim::SpritePlan),
-}
-
-fn wave_world(ctx: &EffectCtx, b: Buf) -> Buf {
-    match wave_world_impl(ctx, &b, false) {
-        Ok(img) => Buf { img, ..b },
-        Err(WavePlan::Wire(plan)) => plan.finish(b),
-        Err(WavePlan::Height { .. }) => b,
-    }
-}
-
-/// Wave World's simulation state for the frame, as a [`WavePlan`] (its pixels are not read).
-pub fn wave_world_plan(ctx: &EffectCtx, b: &Buf) -> Option<WavePlan> {
-    wave_world_impl(ctx, b, true).err()
-}
-
-fn wave_world_impl(ctx: &EffectCtx, b: &Buf, plan_only: bool) -> Result<Image, WavePlan> {
-    let pr = ctx.params;
-    let [lw, lh] = ctx.layer_size;
-    let res = pr.f("simulation/gridResolution").clamp(1.0, 400.0) as usize;
-    let res = if pr.b("simulation/gridResDownsamples") { ((res as f64) * b.scale).round().max(1.0) as usize } else { res };
-    let nx = res.max(2) + 1;
-    let ny = ((res as f64 * lh / lw.max(1.0)).round() as usize).max(2) + 1;
-    let speed = pr.f("simulation/waveSpeed").max(0.0) as f32;
-    let damping = pr.f("simulation/damping").max(0.0) as f32;
-    let reflect = pr.e("simulation/reflectEdges");
-    let preroll = pr.f("simulation/preRoll").max(0.0);
-    let prods: Vec<Producer> = [1, 2]
-        .iter()
-        .map(|k| {
-            let pos = pr.v2(&format!("producer{k}/producer{k}Position"));
-            Producer {
-                ring: pr.e(&format!("producer{k}/producer{k}Type")) == 0,
-                pos: [(pos[0] / lw.max(1.0)) as f32, (pos[1] / lw.max(1.0)) as f32],
-                len: pr.f(&format!("producer{k}/producer{k}Length")) as f32,
-                width: pr.f(&format!("producer{k}/producer{k}Width")) as f32,
-                angle: (pr.f(&format!("producer{k}/producer{k}Angle")) as f32).to_radians(),
-                amp: pr.f(&format!("producer{k}/producer{k}Amplitude")) as f32,
-                freq: pr.f(&format!("producer{k}/producer{k}Frequency")) as f32,
-                phase: (pr.f(&format!("producer{k}/producer{k}Phase")) as f32).to_radians(),
-            }
-        })
-        .collect();
-    let sps = crate::sim::SPS as f32;
-    // Wave speed in layer widths per second → cells per second; sub-steps keep it stable.
-    let cps = speed * (nx - 1) as f32;
-    let sub = ((cps * 2.0 / sps).ceil() as usize).clamp(1, 64);
-    let dt = 1.0 / (sps * sub as f32);
-    let cell = 1.0 / (nx - 1) as f32;
-    let weights: Vec<Vec<f32>> = prods.iter().map(|p| (0..nx * ny).map(|i| p.weight((i % nx) as f32 * cell, (i / nx) as f32 * cell)).collect()).collect();
-    // Ground: the ground layer's first frame, its luminance an elevation (× Steepness). Where
-    // it rises above Height the grid is dry (a wall the waves reflect from); shallow water
-    // slows the waves by Wave Strength.
-    let ground = pr.get("ground/ground").and_then(Value::as_layer).and_then(|id| {
-        let host = ctx.env.host?;
-        host.layer_at(id, ctx.env.comp_time - ctx.time, true)
-    });
-    let steep = pr.get("ground/steepness").map(Value::as_f64).unwrap_or(0.25) as f32;
-    let level = pr.get("ground/height").map(Value::as_f64).unwrap_or(0.25) as f32;
-    let wave_strength = pr.f("ground/waveStrength").clamp(0.0, 1.0) as f32;
-    // Water depth per grid point (None without ground: deep everywhere).
-    let depth: Option<Vec<f32>> = ground.as_ref().map(|lp| {
-        let (gw, gh) = (lp.size[0].max(1.0), lp.size[1].max(1.0));
-        (0..nx * ny)
-            .map(|i| {
-                let (fx, fy) = ((i % nx) as f64 / (nx - 1) as f64, (i / nx) as f64 / (ny - 1) as f64);
-                let (c, a) = unpremul(lp.buf.img.sample_bilinear_clamped(fx * gw * lp.buf.scale + lp.buf.offset[0], fy * gh * lp.buf.scale + lp.buf.offset[1]));
-                level - steep * effectcraft_color::luminance(c[0], c[1], c[2]) * a
-            })
-            .collect()
-    });
-    let speed_k: Vec<f32> = match &depth {
-        Some(d) => d.iter().map(|&v| if v <= 0.0 { 0.0 } else { 1.0 - wave_strength * (1.0 - (v / level.max(1e-3)).clamp(0.0, 1.0).sqrt()) }).collect(),
-        None => vec![1.0; nx * ny],
-    };
-    let mut key =
-        params_key(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: if pr.b("simulation/gridResDownsamples") { b.scale } else { 1.0 } }, 4);
-    if let Some(d) = &depth {
-        key ^= d.iter().fold(0u64, |a, v| a.rotate_left(3) ^ v.to_bits() as u64);
-    }
-    let steps = crate::sim::steps_at(ctx.time + preroll);
-    let st = WAVE_CACHE.run(
-        key,
-        steps,
-        || Waves { nx, ny, u: vec![0.0; nx * ny], v: vec![0.0; nx * ny] },
-        |w, step| {
-            for k in 0..sub {
-                let t = (step as f32 + k as f32 / sub as f32) / sps - preroll as f32;
-                let c2 = cps * cps;
-                let mut acc = vec![0.0f32; nx * ny];
-                for y in 0..ny {
-                    for x in 0..nx {
-                        let i = y * nx + x;
-                        let g = |xx: usize, yy: usize| w.u[yy * nx + xx];
-                        let l = g(x.saturating_sub(1), y) + g((x + 1).min(nx - 1), y) + g(x, y.saturating_sub(1)) + g(x, (y + 1).min(ny - 1)) - 4.0 * w.u[i];
-                        acc[i] = c2 * speed_k[i] * speed_k[i] * l - damping * 4.0 * w.v[i];
-                    }
-                }
-                for i in 0..nx * ny {
-                    w.v[i] += acc[i] * dt;
-                    w.u[i] += w.v[i] * dt;
-                }
-                // Producers drive the surface.
-                for (p, wt) in prods.iter().zip(&weights) {
-                    if p.amp == 0.0 {
-                        continue;
-                    }
-                    let target = p.amp * (std::f32::consts::TAU * p.freq * t + p.phase).sin();
-                    for i in 0..nx * ny {
-                        if wt[i] > 0.0 {
-                            w.u[i] += (target - w.u[i]) * wt[i];
-                            w.v[i] *= 1.0 - wt[i];
-                        }
-                    }
-                }
-                // Dry ground holds the surface flat.
-                for i in 0..nx * ny {
-                    if speed_k[i] <= 0.0 {
-                        w.u[i] = 0.0;
-                        w.v[i] = 0.0;
-                    }
-                }
-                // Edges: reflective ones mirror; the others absorb in a thin sponge layer.
-                let refl = |side: u32| reflect == 5 || reflect == side;
-                let sponge = 4usize.min(nx / 4).max(1);
-                for y in 0..ny {
-                    for x in 0..nx {
-                        let i = y * nx + x;
-                        let mut f = 1.0f32;
-                        if !refl(1) && x < sponge {
-                            f = f.min(x as f32 / sponge as f32);
-                        }
-                        if !refl(3) && nx - 1 - x < sponge {
-                            f = f.min((nx - 1 - x) as f32 / sponge as f32);
-                        }
-                        if !refl(2) && y < sponge {
-                            f = f.min(y as f32 / sponge as f32);
-                        }
-                        if !refl(4) && ny - 1 - y < sponge {
-                            f = f.min((ny - 1 - y) as f32 / sponge as f32);
-                        }
-                        if f < 1.0 {
-                            let k = 0.85 + 0.15 * f;
-                            w.u[i] *= k;
-                            w.v[i] *= k;
-                        }
-                    }
-                }
-            }
-        },
-    );
-    let s = b.scale;
-    let (bw, bh) = (b.img.width, b.img.height);
-    let sample = |x: f64, y: f64| -> f32 {
-        let gx = (x / lw.max(1.0) * (st.nx - 1) as f64).clamp(0.0, (st.nx - 1) as f64);
-        let gy = (y / lw.max(1.0) * (st.nx - 1) as f64).clamp(0.0, (st.ny - 1) as f64);
-        let (x0, y0) = (gx.floor() as usize, gy.floor() as usize);
-        let (x1, y1) = ((x0 + 1).min(st.nx - 1), (y0 + 1).min(st.ny - 1));
-        let (tx, ty) = ((gx - x0 as f64) as f32, (gy - y0 as f64) as f32);
-        let g = |xx: usize, yy: usize| st.u[yy * st.nx + xx];
-        let a = g(x0, y0) + (g(x1, y0) - g(x0, y0)) * tx;
-        let c = g(x0, y1) + (g(x1, y1) - g(x0, y1)) * tx;
-        a + (c - a) * ty
-    };
-    if plan_only && pr.e("view") == 1 {
-        return Err(WavePlan::Height { st, depth });
-    }
-    if pr.e("view") == 1 {
-        let mut img = Image::new(bw, bh);
-        let bright = pr.f("heightMapControls/brightness") as f32;
-        let contrast = pr.f("heightMapControls/contrast") as f32;
-        let gamma = pr.f("heightMapControls/gamma").max(0.01) as f32;
-        let alpha = 1.0 - pr.f("heightMapControls/transparency") as f32;
-        let dry_transparent = pr.e("heightMapControls/renderDryAreasAs") == 1;
-        let dry_at = |x: f64, y: f64| -> bool {
-            let Some(d) = &depth else { return false };
-            let gx = (x / lw.max(1.0) * (st.nx - 1) as f64).round().clamp(0.0, (st.nx - 1) as f64) as usize;
-            let gy = (y / lw.max(1.0) * (st.nx - 1) as f64).round().clamp(0.0, (st.ny - 1) as f64) as usize;
-            d[gy * st.nx + gx] <= 0.0
-        };
-        img.rows_mut().for_each(|(y, row)| {
-            for (x, px) in row.iter_mut().enumerate() {
-                let lx = (x as f64 + 0.5 - b.offset[0]) / s;
-                let ly = (y as f64 + 0.5 - b.offset[1]) / s;
-                let v = (bright + contrast * sample(lx, ly)).clamp(0.0, 1.0).powf(1.0 / gamma);
-                let al = if dry_transparent && dry_at(lx, ly) { 0.0 } else { alpha };
-                *px = [v * al, v * al, v * al, al];
-            }
-        });
-        Ok(img)
-    } else {
-        // Wireframe preview: the grid turned by Horizontal Rotation about the vertical axis,
-        // tilted by Vertical Rotation, heights scaled by Vertical Scale.
-        let hr = pr.f("wireframeControls/horizontalRotation").to_radians();
-        let vr = pr.get("wireframeControls/verticalRotation").map(Value::as_f64).unwrap_or(53.0).to_radians();
-        let vs = pr.get("wireframeControls/verticalScale").map(Value::as_f64).unwrap_or(0.5);
-        let (sh, ch) = hr.sin_cos();
-        let (sv, cv) = vr.sin_cos();
-        let to = |x: usize, y: usize| -> [f32; 2] {
-            // Grid point relative to the layer centre (layer px), height in layer px.
-            let gx = x as f64 / (st.nx - 1) as f64 * lw - lw * 0.5;
-            let gy = y as f64 / (st.nx - 1) as f64 * lw - (st.ny - 1) as f64 / (st.nx - 1) as f64 * lw * 0.5;
-            let hgt = st.u[y * st.nx + x] as f64 * vs * lh * 0.5;
-            let (rx, ry) = (gx * ch - gy * sh, gx * sh + gy * ch);
-            let (px, py) = b.to_px([lw * 0.5 + rx, lh * 0.5 + ry * cv - hgt * sv]);
-            [px as f32, py as f32]
-        };
-        let mut lines = Vec::new();
-        for y in 0..st.ny {
-            for x in 0..st.nx {
-                let a = to(x, y);
-                if x + 1 < st.nx {
-                    let c = to(x + 1, y);
-                    lines.push(Sprite::new(a[0], a[1], 0.4, [0.4, 0.9, 0.4, 1.0], Shape::Line { dx: c[0] - a[0], dy: c[1] - a[1] }));
-                }
-                if y + 1 < st.ny {
-                    let c = to(x, y + 1);
-                    lines.push(Sprite::new(a[0], a[1], 0.4, [0.4, 0.9, 0.4, 1.0], Shape::Line { dx: c[0] - a[0], dy: c[1] - a[1] }));
-                }
-            }
-        }
-        let plan = crate::sim::SpritePlan { sprites: lines, tints: vec![], acc: Acc::Over, post: crate::sim::Post::OverBlack };
-        if plan_only {
-            return Err(WavePlan::Wire(plan));
-        }
-        Ok(plan.finish(Buf { img: Image::new(bw, bh), offset: b.offset, scale: b.scale }).img)
-    }
-}
-
-// ------------------------------------------------------------------ Foam
-
-#[derive(Clone, Debug)]
-struct FoamBubble {
-    p: [f32; 2],
-    v: [f32; 2],
-    age: f32,
-    size: f32,
-    /// Spin (radians) for Physical Orientation.
-    spin: f32,
-    id: u32,
-}
-
-#[derive(Clone, Debug, Default)]
-struct FoamState {
-    b: Vec<FoamBubble>,
-    carry: f32,
-    next: u32,
-}
-
-static FOAM_CACHE: SimCache<FoamState> = SimCache::new(4);
-
-/// Foam steps once per frame at 30 frames per second.
-const FOAM_FPS: f64 = 30.0;
-
-/// Foam's Bubble Texture options (the last uses Bubble Texture Layer).
-const FOAM_TEXTURES: [&str; 6] = ["Default Bubble", "Spit", "Bubblegum", "Dishwater", "Milky", "User Defined"];
-
-/// Age (in simulation steps) at which bubble `id` pops: its lifespan, shortened at random for
-/// frail bubbles (`frailty` 0 = every bubble reaches `lifespan`, 1 = uniformly early).
-fn foam_pop_age(id: u32, lifespan: f32, frailty: f32, seed: u32) -> f32 {
-    lifespan * (1.0 - frailty * (hs(id, 11, seed) * 0.5 + 0.5))
-}
-
-/// Foam: bubbles born in the producer rectangle grow to their size, drift with the wind,
-/// turbulence and the Flow Map (bubbles run downhill on its luminance), repel and stick to each
-/// other, wobble, and pop at the end of their (Strength-shortened) lifespan, pushing their
-/// neighbours away at Pop Velocity. Rendered bubbles use a built-in texture or the Bubble
-/// Texture Layer, oriented by Bubble Orientation, and reflect the Environment Map.
-fn foam(ctx: &EffectCtx, b: Buf) -> Buf {
-    foam_full_plan(ctx, &b).finish(b)
-}
-
-/// Foam's bubbles as sprites, `None` when it draws more than sprites (a User Defined bubble
-/// texture, an Environment Map reflection or the Draft + Flow Map view's flow map).
-pub(crate) fn foam_plan(ctx: &EffectCtx, b: &Buf) -> Option<crate::sim::SpritePlan> {
-    let plan = foam_full_plan(ctx, b);
-    (plan.user.is_none() && plan.env.is_none() && plan.flow.is_none()).then_some(plan.sprites)
-}
-
-/// A bubble disc filled by Foam's User Defined texture (buffer px; `rot` radians).
-#[derive(Clone, Copy, Debug)]
-pub struct FoamDisc {
-    pub x: f64,
-    pub y: f64,
-    pub r: f32,
-    pub rot: f32,
-    pub fade: f32,
-}
-
-/// Foam's Environment Map reflection: the map fitted to the buffer, Reflection Convergence and
-/// Strength, and the bubble discs reflecting it (`rot` and `fade` unused).
-pub struct FoamEnv {
-    pub img: Image,
-    pub conv: f64,
-    pub strength: f32,
-    pub discs: Vec<FoamDisc>,
-}
-
-/// What Foam draws this frame over a transparent frame of the layer's size: the bubble sprites,
-/// then the User Defined texture's discs, the Environment Map's reflections and (Draft + Flow
-/// Map) the flow map under it all, each [`foam_disc`]-composited in bubble order.
-pub struct FoamPlan {
-    pub sprites: crate::sim::SpritePlan,
-    pub user: Option<(crate::LayerPixels, Vec<FoamDisc>)>,
-    pub env: Option<FoamEnv>,
-    /// The flow map fitted to the buffer.
-    pub flow: Option<Image>,
-}
-
-impl FoamPlan {
-    pub fn finish(&self, b: Buf) -> Buf {
-        let mut out = splat(b.img.width, b.img.height, &self.sprites.sprites, self.sprites.acc);
-        // User Defined: the texture layer fills each bubble's disc.
-        if let Some((tex, discs)) = &self.user {
-            for d in discs {
-                let (rot, fade) = (d.rot, d.fade);
-                foam_disc(&mut out, d.x, d.y, d.r as f64, |u, v| {
-                    // u, v in −1..1 across the bubble, rotated into the texture.
-                    let (sr, cr) = rot.sin_cos();
-                    let (tu, tv) = (u as f32 * cr + v as f32 * sr, -u as f32 * sr + v as f32 * cr);
-                    let (x, y) = ((tu as f64 * 0.5 + 0.5) * tex.size[0], (tv as f64 * 0.5 + 0.5) * tex.size[1]);
-                    let px = tex.buf.img.sample_bilinear(x * tex.buf.scale + tex.buf.offset[0], y * tex.buf.scale + tex.buf.offset[1]);
-                    px.map(|c| c * fade)
-                });
-            }
-        }
-        // Environment Map: each bubble reflects the map along its sphere normal (Reflection
-        // Convergence pulls the reflection towards the bubble's own spot of the map).
-        if let Some(env) = &self.env {
-            let (conv, strength) = (env.conv, env.strength);
-            let (w, h) = (b.img.width as f64, b.img.height as f64);
-            for d in &env.discs {
-                let (bx, by) = (d.x, d.y);
-                foam_disc(&mut out, bx, by, d.r as f64, |u, v| {
-                    // Sphere normal; the reflection looks across the whole map, or (convergence 1)
-                    // just behind the bubble.
-                    let (ex, ey) =
-                        if conv >= 1.0 { (bx, by) } else { (bx * conv + (u * 0.5 + 0.5) * w * (1.0 - conv), by * conv + (v * 0.5 + 0.5) * h * (1.0 - conv)) };
-                    let e = env.img.sample_bilinear(ex, ey);
-                    let rim = ((u * u + v * v) as f32).min(1.0);
-                    let k = strength * (0.3 + 0.7 * rim);
-                    [e[0] * k, e[1] * k, e[2] * k, 0.0]
-                });
-            }
-        }
-        // Draft + Flow Map shows the flow map under the bubbles.
-        if let Some(fm) = &self.flow {
-            out.data.par_iter_mut().zip(fm.data.par_iter()).for_each(|(o, f)| {
-                let k = 1.0 - o[3];
-                for c in 0..4 {
-                    o[c] += f[c] * 0.5 * k;
-                }
-            });
-        }
-        Buf { img: out, ..b }
-    }
-}
-
-/// Foam's [`FoamPlan`] for layer geometry `b` (its size; its pixels are not read).
-pub fn foam_full_plan(ctx: &EffectCtx, b: &Buf) -> FoamPlan {
-    let pr = ctx.params;
-    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
-    let unit = lw * 0.01;
-    let prod = pr.v2("producer/producerPoint");
-    let (psx, psy) = (pr.f("producer/producerXSize") as f32 * lw, pr.f("producer/producerYSize") as f32 * lh);
-    let porient = (pr.f("producer/producerOrientation") as f32).to_radians();
-    let rate = pr.f("producer/productionRate").max(0.0) as f32;
-    let size = pr.f("bubbles/size").max(0.0) as f32;
-    let size_var = pr.f("bubbles/sizeVariance") as f32;
-    let lifespan = pr.f("bubbles/lifespan").max(1.0) as f32;
-    let growth = pr.f("bubbles/growthSpeed").max(0.0001) as f32;
-    // Strength: weaker bubbles tend to pop before their lifespan (at 20 or more every bubble
-    // lives the full lifespan); each bubble gets its own pop age.
-    let frailty = 1.0 - (pr.f("bubbles/strength") as f32 / 20.0).clamp(0.0, 1.0);
-    let init_speed = pr.f("physics/initialSpeed") as f32;
-    let init_dir = (pr.f("physics/initialDirection") as f32).to_radians();
-    let wind = pr.f("physics/windSpeed") as f32;
-    let wind_dir = (pr.f("physics/windDirection") as f32).to_radians();
-    let turb = pr.f("physics/turbulence") as f32;
-    let wobble = pr.f("physics/wobbleAmount").max(0.0) as f32;
-    let repulsion = pr.f("physics/repulsion") as f32;
-    let pop_velocity = pr.f("physics/popVelocity") as f32;
-    let viscosity = pr.f("physics/viscosity").clamp(0.0, 1.0) as f32;
-    let sticky = pr.f("physics/stickiness").clamp(0.0, 1.0) as f32;
-    let universe = pr.f("universeSize").max(0.01) as f32;
-    let seed = (pr.f("randomSeed") as u32).wrapping_mul(0x68e31da4) ^ ctx.seed;
-    let wvec = [wind_dir.sin() * wind * unit, -wind_dir.cos() * wind * unit];
-    // Flow Map: the map layer's first frame, its luminance a height field (Fits the layer or
-    // the whole universe).
-    let flow = pr.get("flowMap/flowMap").and_then(Value::as_layer).and_then(|id| {
-        let host = ctx.env.host?;
-        let me = pr.get(&crate::layer_source_id("flowMap/flowMap")).is_none_or(|v| v.as_enum() != 0);
-        host.layer_at(id, ctx.env.comp_time - ctx.time, me)
-    });
-    let steep = pr.f("flowMap/flowMapSteepness") as f32;
-    let fits_universe = pr.e("flowMap/flowMapFits") == 1;
-    let substeps = match pr.e("flowMap/simulationQuality") {
-        1 => 2,
-        2 => 4,
-        _ => 1,
-    };
-    let height = flow.as_ref().map(|lp| {
-        let img = &lp.buf.img;
-        let pl = Plane::from_image(img, |px| {
-            let (c, a) = unpremul(px);
-            effectcraft_color::luminance(c[0], c[1], c[2]) * a
-        });
-        (pl, lp.buf.scale, lp.buf.offset, lp.size)
-    });
-    let (ux0, uy0) = (-(universe - 1.0) * 0.5 * lw, -(universe - 1.0) * 0.5 * lh);
-    let (ux1, uy1) = (lw - ux0, lh - uy0);
-    // Height at a layer point (0..1).
-    let h_at = |x: f32, y: f32| -> f32 {
-        let Some((pl, s, off, size)) = &height else { return 0.0 };
-        let (fx, fy) = if fits_universe { ((x - ux0) / (ux1 - ux0), (y - uy0) / (uy1 - uy0)) } else { (x / lw, y / lh) };
-        pl.sample(fx as f64 * size[0] * s + off[0], fy as f64 * size[1] * s + off[1])
-    };
-    let mut key = params_key(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, 5);
-    if let Some((pl, ..)) = &height {
-        key ^= pl.data.iter().step_by(5).fold(0u64, |a, v| a.rotate_left(3) ^ v.to_bits() as u64);
-    }
-    let steps = if ctx.time <= 0.0 { 0 } else { (ctx.time * FOAM_FPS + 1e-6).floor() as u64 };
-    let rad = |q: &FoamBubble| q.size * unit * 3.0 * (q.age * growth).min(1.0);
-    let st = FOAM_CACHE.run(key, steps, FoamState::default, |st, step| {
-        let t = step as f32 / FOAM_FPS as f32;
-        // Births.
-        st.carry += rate;
-        let n = st.carry.floor() as u32;
-        st.carry -= n as f32;
-        for _ in 0..n {
-            if st.b.len() >= 3000 {
-                break;
-            }
-            let id = st.next;
-            st.next = st.next.wrapping_add(1);
-            let (ux, uy) = (hs(id, 1, seed) * 0.5 * psx, hs(id, 2, seed) * 0.5 * psy);
-            let (so, co) = porient.sin_cos();
-            let p = [prod[0] as f32 + ux * co - uy * so, prod[1] as f32 + ux * so + uy * co];
-            let v = [init_dir.sin() * init_speed * unit, -init_dir.cos() * init_speed * unit];
-            let sz = (size * (1.0 + size_var * hs(id, 3, seed))).max(0.01);
-            st.b.push(FoamBubble { p, v, age: 0.0, size: sz, spin: hs(id, 12, seed) * std::f32::consts::PI, id });
-        }
-        for _ in 0..substeps {
-            let k = 1.0 / substeps as f32;
-            // Forces: drift towards the wind, turbulence, viscosity, the flow map's slope.
-            for q in st.b.iter_mut() {
-                let n1 = value_noise(q.p[0] / (lw * 0.15), q.p[1] / (lw * 0.15), t * 0.5, seed) - 0.5;
-                let n2 = value_noise(q.p[0] / (lw * 0.15) + 19.0, q.p[1] / (lw * 0.15), t * 0.5, seed) - 0.5;
-                for c in 0..2 {
-                    q.v[c] += (wvec[c] - q.v[c]) * 0.1 * k;
-                    q.v[c] *= 1.0 - viscosity * 0.5 * k;
-                }
-                q.v[0] += n1 * turb * unit * k;
-                q.v[1] += n2 * turb * unit * k;
-                if height.is_some() && steep != 0.0 {
-                    let e = unit.max(1.0);
-                    let gx = (h_at(q.p[0] + e, q.p[1]) - h_at(q.p[0] - e, q.p[1])) / (2.0 * e);
-                    let gy = (h_at(q.p[0], q.p[1] + e) - h_at(q.p[0], q.p[1] - e)) / (2.0 * e);
-                    // Downhill: from light (high) to dark (low).
-                    q.v[0] -= gx * steep * lw * 0.5 * k;
-                    q.v[1] -= gy * steep * lw * 0.5 * k;
-                }
-                // Physical Orientation: bubbles roll with their sideways motion.
-                q.spin += q.v[0] / (rad(q).max(0.5)) * k;
-            }
-            // Repulsion between overlapping bubbles (grid hashed, deterministic order).
-            if repulsion > 0.0 && st.b.len() > 1 {
-                let maxr = st.b.iter().map(rad).fold(0.0f32, f32::max).max(1.0);
-                let cs = maxr * 2.0;
-                let mut grid: std::collections::HashMap<(i32, i32), Vec<usize>> = std::collections::HashMap::new();
-                for (i, q) in st.b.iter().enumerate() {
-                    grid.entry(((q.p[0] / cs).floor() as i32, (q.p[1] / cs).floor() as i32)).or_default().push(i);
-                }
-                let mut push = vec![[0.0f32; 2]; st.b.len()];
-                for (i, q) in st.b.iter().enumerate() {
-                    let (gx, gy) = ((q.p[0] / cs).floor() as i32, (q.p[1] / cs).floor() as i32);
-                    for dy in -1..=1 {
-                        for dx in -1..=1 {
-                            let Some(list) = grid.get(&(gx + dx, gy + dy)) else { continue };
-                            for &j in list {
-                                if j <= i {
-                                    continue;
-                                }
-                                let o = &st.b[j];
-                                let (ddx, ddy) = (o.p[0] - q.p[0], o.p[1] - q.p[1]);
-                                let d = (ddx * ddx + ddy * ddy).sqrt().max(1e-4);
-                                let overlap = rad(q) + rad(o) - d;
-                                if overlap > 0.0 {
-                                    let f = overlap * 0.5 * repulsion.min(4.0) * (1.0 - sticky * 0.5) / d * k;
-                                    push[i][0] -= ddx * f;
-                                    push[i][1] -= ddy * f;
-                                    push[j][0] += ddx * f;
-                                    push[j][1] += ddy * f;
-                                }
-                            }
-                        }
-                    }
-                }
-                for (q, d) in st.b.iter_mut().zip(&push) {
-                    q.p[0] += d[0].clamp(-maxr, maxr);
-                    q.p[1] += d[1].clamp(-maxr, maxr);
-                }
-            }
-            for q in st.b.iter_mut() {
-                q.p[0] += q.v[0] * k;
-                q.p[1] += q.v[1] * k;
-            }
-        }
-        for q in st.b.iter_mut() {
-            q.age += 1.0;
-        }
-        // Pops: bubbles past their pop age burst, pushing their neighbours away.
-        let popped: Vec<([f32; 2], f32)> = st.b.iter().filter(|q| q.age >= foam_pop_age(q.id, lifespan, frailty, seed)).map(|q| (q.p, rad(q))).collect();
-        if pop_velocity != 0.0 {
-            for (pp, pr_) in &popped {
-                let reach = (pr_ * 3.0).max(unit);
-                for q in st.b.iter_mut() {
-                    let (dx, dy) = (q.p[0] - pp[0], q.p[1] - pp[1]);
-                    let d = (dx * dx + dy * dy).sqrt();
-                    if d > 1e-4 && d < reach {
-                        let f = pop_velocity * unit * (1.0 - d / reach) / d;
-                        q.v[0] += dx * f;
-                        q.v[1] += dy * f;
-                    }
-                }
-            }
-        }
-        st.b.retain(|q| q.age < foam_pop_age(q.id, lifespan, frailty, seed) && q.p[0] > ux0 && q.p[0] < ux1 && q.p[1] > uy0 && q.p[1] < uy1);
-    });
-    let view = pr.e("view");
-    let zoom = pr.f("zoom").max(0.01) as f32;
-    let zoom_producer = pr.b("producer/zoomProducerPoint");
-    let texture = pr.e("rendering/bubbleTexture");
-    let orient = pr.e("rendering/bubbleOrientation");
-    let blend = pr.e("rendering/blendMode");
-    let s = b.scale as f32;
-    // Zoom centres on the layer, or on the producer with Zoom Producer Point.
-    let (cx, cy) = if zoom_producer { (prod[0] as f32, prod[1] as f32) } else { (lw * 0.5, lh * 0.5) };
-    let mut order: Vec<&FoamBubble> = st.b.iter().collect();
-    if blend == 2 {
-        // Solid New on Top: oldest first.
-        order.sort_by(|a, c| c.age.total_cmp(&a.age).then(a.id.cmp(&c.id)));
-    } else if blend == 1 {
-        order.sort_by(|a, c| a.age.total_cmp(&c.age).then(a.id.cmp(&c.id)));
-    }
-    // Where a bubble is drawn: buffer centre, radius, rotation (radians).
-    let place = |q: &FoamBubble| {
-        let wob = if wobble > 0.0 { 1.0 + wobble * 0.15 * ((q.age * 0.35) + hs(q.id, 13, seed) * 6.0).sin() } else { 1.0 };
-        let r = rad(q) * wob * zoom * s;
-        let (bx, by) = b.to_px([(cx + (q.p[0] - cx) * zoom) as f64, (cy + (q.p[1] - cy) * zoom) as f64]);
-        let rot = match orient {
-            1 => q.spin,
-            2 => q.v[1].atan2(q.v[0]),
-            _ => 0.0,
-        };
-        (bx, by, r, rot)
-    };
-    let user_tex = (view == 2 && texture == 5).then(|| ctx.layer_param("rendering/bubbleTextureLayer", true)).flatten();
-    let sprites: Vec<Sprite> = order
-        .iter()
-        .filter(|_| user_tex.is_none())
-        .map(|q| {
-            let (bx, by, r, rot) = place(q);
-            let fade = ((foam_pop_age(q.id, lifespan, frailty, seed) - q.age) / 5.0).clamp(0.0, 1.0);
-            // Draft and Draft + Flow Map show the wireframe-style bubbles.
-            let mut sp = if view != 2 {
-                Sprite::new(bx as f32, by as f32, r, [0.55, 0.75, 1.0, fade], Shape::Bubble)
-            } else {
-                let (c, shape) = match texture {
-                    1 => ([0.95, 0.95, 0.92], Shape::Faded),
-                    2 => ([1.0, 0.6, 0.8], Shape::Bubble),
-                    3 => ([0.8, 0.85, 0.75], Shape::Bubble),
-                    4 => ([0.97, 0.97, 0.95], Shape::Sphere),
-                    _ => ([1.0, 1.0, 1.0], Shape::Bubble),
-                };
-                Sprite::new(bx as f32, by as f32, r, [c[0], c[1], c[2], fade], shape)
-            };
-            sp.rot = rot;
-            sp
-        })
-        .collect();
-    let acc = if blend == 0 && view == 2 { Acc::Add } else { Acc::Over };
-    let disc = |q: &&FoamBubble| {
-        let (x, y, r, rot) = place(q);
-        let fade = ((foam_pop_age(q.id, lifespan, frailty, seed) - q.age) / 5.0).clamp(0.0, 1.0);
-        FoamDisc { x, y, r, rot, fade }
-    };
-    let user = user_tex.map(|tex| (tex, order.iter().map(disc).collect()));
-    let strength = pr.f("rendering/reflectionStrength").clamp(0.0, 1.0) as f32;
-    let env = if view == 2
-        && strength > 0.0
-        && let Some(env) = ctx.layer_param("rendering/environmentMap", true)
-    {
-        Some(FoamEnv {
-            img: crate::util::fit_layer(ctx, b, &env, true),
-            conv: pr.f("rendering/reflectionConvergence").clamp(0.0, 1.0),
-            strength,
-            discs: order.iter().map(disc).collect(),
-        })
-    } else {
-        None
-    };
-    let flow = if view == 1
-        && let Some(lp) = &flow
-    {
-        Some(crate::util::fit_layer(ctx, b, lp, true))
-    } else {
-        None
-    };
-    FoamPlan { sprites: crate::sim::SpritePlan { sprites, tints: vec![], acc, post: crate::sim::Post::Replace }, user, env, flow }
-}
-
-/// Add `f(u, v)` (premultiplied; u, v ∈ −1..1 across the disc) over the disc of radius `r` at
-/// (`x`, `y`) with anti-aliased edges ("over" for opaque texels, additive for alpha 0).
-fn foam_disc(out: &mut Image, x: f64, y: f64, r: f64, f: impl Fn(f64, f64) -> Px) {
-    if r <= 0.0 {
-        return;
-    }
-    let (x0, x1) = ((x - r - 1.0).floor().max(0.0) as i64, (x + r + 1.0).ceil().min(out.width as f64) as i64);
-    let (y0, y1) = ((y - r - 1.0).floor().max(0.0) as i64, (y + r + 1.0).ceil().min(out.height as f64) as i64);
-    for py in y0..y1 {
-        for px in x0..x1 {
-            let (u, v) = ((px as f64 + 0.5 - x) / r, (py as f64 + 0.5 - y) / r);
-            let d = (u * u + v * v).sqrt();
-            let cov = ((1.0 - d) * r + 0.5).clamp(0.0, 1.0) as f32;
-            if cov <= 0.0 {
-                continue;
-            }
-            let s = f(u.clamp(-1.0, 1.0), v.clamp(-1.0, 1.0)).map(|c| c * cov);
-            let o = out.get(px, py);
-            let k = 1.0 - s[3];
-            out.set(px as u32, py as u32, [s[0] + o[0] * k, s[1] + o[1] * k, s[2] + o[2] * k, (s[3] + o[3] * k).min(1.0)]);
-        }
-    }
-}
-
-// ------------------------------------------------------------------ specs
-
-fn producer_params(k: u32, amp: f64, pos: (f64, f64)) -> Vec<crate::ParamSpec> {
-    let ids: [&'static str; 8] = match k {
-        1 => [
-            "producer1/producer1Type",
-            "producer1/producer1Position",
-            "producer1/producer1Length",
-            "producer1/producer1Width",
-            "producer1/producer1Angle",
-            "producer1/producer1Amplitude",
-            "producer1/producer1Frequency",
-            "producer1/producer1Phase",
-        ],
-        _ => [
-            "producer2/producer2Type",
-            "producer2/producer2Position",
-            "producer2/producer2Length",
-            "producer2/producer2Width",
-            "producer2/producer2Angle",
-            "producer2/producer2Amplitude",
-            "producer2/producer2Frequency",
-            "producer2/producer2Phase",
-        ],
-    };
-    vec![
-        p(ids[0], "Type", Value::Enum(0), popup(&["Ring", "Line"])),
-        p(ids[1], "Position", pt(pos.0, pos.1), ParamUi::Point),
-        p(ids[2], "Height/Length", num(0.1), slider(0.0, 2.0, 0.0, 1.0, 3)),
-        p(ids[3], "Width", num(0.1), slider(0.0, 2.0, 0.0, 1.0, 3)),
-        p(ids[4], "Angle", num(0.0), ParamUi::Angle),
-        p(ids[5], "Amplitude", num(amp), slider(-5.0, 5.0, -1.0, 1.0, 3)),
-        p(ids[6], "Frequency", num(1.0), slider(0.0, 30.0, 0.0, 5.0, 3)),
-        p(ids[7], "Phase", num(0.0), ParamUi::Angle),
-    ]
-}
-
-fn card_dance_params() -> Vec<crate::ParamSpec> {
-    let mut v = vec![
-        p("rowsColumns", "Rows & Columns", Value::Enum(0), popup(&["Independent", "Columns Follows Rows"])),
-        p("rows", "Rows", num(10.0), slider(1.0, 1000.0, 1.0, 100.0, 0)),
-        p("columns", "Columns", num(10.0), slider(1.0, 1000.0, 1.0, 100.0, 0)),
-        p("backLayer", "Back Layer", Value::Layer(None), ParamUi::Layer),
-        p("gradientLayer1", "Gradient Layer 1", Value::Layer(None), ParamUi::Layer),
-        p("gradientLayer2", "Gradient Layer 2", Value::Layer(None), ParamUi::Layer),
-    ];
-    let names: [[&'static str; 4]; 8] = [
-        ["xPosition/xPosSource", "xPosition/xPosMultiplier", "xPosition/xPosOffset", "X Position"],
-        ["yPosition/yPosSource", "yPosition/yPosMultiplier", "yPosition/yPosOffset", "Y Position"],
-        ["zPosition/zPosSource", "zPosition/zPosMultiplier", "zPosition/zPosOffset", "Z Position"],
-        ["xRotation/xRotSource", "xRotation/xRotMultiplier", "xRotation/xRotOffset", "X Rotation"],
-        ["yRotation/yRotSource", "yRotation/yRotMultiplier", "yRotation/yRotOffset", "Y Rotation"],
-        ["zRotation/zRotSource", "zRotation/zRotMultiplier", "zRotation/zRotOffset", "Z Rotation"],
-        ["xScale/xScaleSource", "xScale/xScaleMultiplier", "xScale/xScaleOffset", "X Scale"],
-        ["yScale/yScaleSource", "yScale/yScaleMultiplier", "yScale/yScaleOffset", "Y Scale"],
-    ];
-    debug_assert_eq!(names.len(), CD_PROPS.len());
-    for (i, n) in names.iter().enumerate() {
-        let rot = (3..6).contains(&i);
-        let scale = i >= 6;
-        let (lo, hi) = if rot { (-3600.0, 3600.0) } else { (-100.0, 100.0) };
-        v.push(p(n[0], "Source", Value::Enum(0), popup(CD_SOURCES)));
-        v.push(p(n[1], "Multiplier", num(0.0), slider(lo, hi, if rot { -360.0 } else { -10.0 }, if rot { 360.0 } else { 10.0 }, 2)));
-        v.push(p(n[2], "Offset", num(if scale { 1.0 } else { 0.0 }), slider(lo, hi, if rot { -360.0 } else { -10.0 }, if rot { 360.0 } else { 10.0 }, 2)));
-    }
-    v.extend(crate::card3d::camera_params(2.0));
-    v.extend(crate::card3d::lighting_params(1.0, 0.25));
-    v.extend(crate::card3d::material_params(0.75));
-    v
-}
-
-pub fn specs() -> Vec<EffectSpec> {
-    vec![
-        spec(
-            "ec.sim.ccballaction",
-            "CC Ball Action",
-            vec![
-                p("scatter", "Scatter", num(0.0), slider(0.0, 2000.0, 0.0, 300.0, 1)),
-                p("rotationAxis", "Rotation Axis", Value::Enum(0), popup(&["X Axis", "Y Axis", "Z Axis", "XY Axis", "XZ Axis", "YZ Axis", "XYZ Axis"])),
-                p("rotation", "Rotation", num(0.0), ParamUi::Angle),
-                p("twistProperty", "Twist Property", Value::Enum(0), popup(&["X Axis", "Y Axis", "Radius", "Brightness"])),
-                p("twistAngle", "Twist Angle", num(0.0), ParamUi::Angle),
-                p("gridSpacing", "Grid Spacing", num(4.0), slider(1.0, 200.0, 1.0, 50.0, 0)),
-                p("ballSize", "Ball Size", num(40.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
-                p("instabilityState", "Instability State", num(0.0), ParamUi::Angle),
-            ],
-            ball_action,
-        ),
-        spec(
-            "ec.sim.ccpixelpolly",
-            "CC Pixel Polly",
-            vec![
-                p("force", "Force", num(100.0), slider(-1000.0, 1000.0, -300.0, 300.0, 1)),
-                p("gravity", "Gravity", num(1.0), slider(-20.0, 20.0, -5.0, 5.0, 2)),
-                p("spinning", "Spinning", num(0.0), ParamUi::Angle),
-                p("forceCenter", "Force Center", pt(0.5, 0.5), ParamUi::Point),
-                p("directionRandomness", "Direction Randomness", num(10.0), pct()),
-                p("speedRandomness", "Speed Randomness", num(10.0), pct()),
-                p("gridSpacing", "Grid Spacing", num(10.0), slider(1.0, 500.0, 2.0, 100.0, 0)),
-                p("object", "Object", Value::Enum(0), popup(&["Polygon", "Textured Polygon", "Square", "Textured Square"])),
-                p("enableDepthSort", "Enable Depth Sort", Value::Bool(true), ParamUi::Checkbox),
-                p("startTime", "Start Time (sec)", num(0.0), slider(-1000.0, 1000.0, 0.0, 10.0, 2)),
-            ],
-            pixel_polly,
-        ),
-        spec(
-            "ec.sim.ccscatterize",
-            "CC Scatterize",
-            vec![
-                p("scatter", "Scatter", num(0.0), slider(0.0, 1000.0, 0.0, 200.0, 1)),
-                p("rightTwist", "Right Twist", num(0.0), ParamUi::Angle),
-                p("leftTwist", "Left Twist", num(0.0), ParamUi::Angle),
-                p("transferMode", "Transfer Mode", Value::Enum(0), popup(&["Composite", "Add"])),
-            ],
-            scatterize,
-        ),
-        spec("ec.sim.carddance", "Card Dance", card_dance_params(), card_dance),
-        spec(
-            "ec.sim.caustics",
-            "Caustics",
-            vec![
-                p("bottom/bottom", "Bottom", Value::Layer(None), ParamUi::Layer),
-                p("bottom/scaling", "Scaling", num(1.0), slider(0.01, 10.0, 0.1, 3.0, 3)),
-                p("bottom/repeatMode", "Repeat Mode", Value::Enum(2), popup(&["Once", "Tiled", "Reflected"])),
-                p("bottom/bottomSizeDiffers", "If Layer Size Differs", Value::Enum(1), popup(&["Center", "Stretch to Fit"])),
-                p("bottom/blur", "Blur", num(0.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
-                p("water/waterSurface", "Water Surface", Value::Layer(None), ParamUi::Layer),
-                p("water/waveHeight", "Wave Height", num(0.2), slider(-1.0, 1.0, -1.0, 1.0, 3)),
-                p("water/smoothing", "Smoothing", num(5.0), slider(0.0, 100.0, 0.0, 50.0, 1)),
-                p("water/waterDepth", "Water Depth", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("water/refractiveIndex", "Refractive Index", num(1.2), slider(1.0, 3.0, 1.0, 2.0, 3)),
-                p("water/surfaceColor", "Surface Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("water/surfaceOpacity", "Surface Opacity", num(0.3), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("water/causticsStrength", "Caustics Strength", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("sky/sky", "Sky", Value::Layer(None), ParamUi::Layer),
-                p("sky/scaling", "Scaling", num(1.0), slider(0.01, 10.0, 0.1, 3.0, 3)),
-                p("sky/repeatMode", "Repeat Mode", Value::Enum(2), popup(&["Once", "Tiled", "Reflected"])),
-                p("sky/skySizeDiffers", "If Layer Size Differs", Value::Enum(1), popup(&["Center", "Stretch to Fit"])),
-                p("sky/intensity", "Intensity", num(0.3), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("sky/convergence", "Convergence", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("lighting/lightType", "Light Type", Value::Enum(0), popup(&crate::card3d::LIGHT_TYPES)),
-                p("lighting/lightIntensity", "Light Intensity", num(1.0), slider(0.0, 4.0, 0.0, 2.0, 2)),
-                p("lighting/lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("lighting/lightPosition", "Light Position", pt(0.0, 0.0), ParamUi::Point),
-                p("lighting/lightHeight", "Light Height", num(1.0), slider(0.0, 10.0, 0.0, 4.0, 2)),
-                p("lighting/ambientLight", "Ambient Light", num(0.35), slider(0.0, 2.0, 0.0, 1.0, 2)),
-                p("material/diffuse", "Diffuse Reflection", num(0.75), slider(0.0, 2.0, 0.0, 1.0, 2)),
-                p("material/specular", "Specular Reflection", num(0.2), slider(0.0, 2.0, 0.0, 1.0, 2)),
-                p("material/highlightSharpness", "Highlight Sharpness", num(15.0), slider(1.0, 100.0, 1.0, 100.0, 1)),
-            ],
-            caustics,
-        ),
-        spec(
-            "ec.sim.waveworld",
-            "Wave World",
-            {
-                let mut v = vec![
-                    p("view", "View", Value::Enum(0), popup(&["Wireframe Preview", "Height Map"])),
-                    p("wireframeControls/horizontalRotation", "Horizontal Rotation", num(0.0), ParamUi::Angle),
-                    p("wireframeControls/verticalRotation", "Vertical Rotation", num(53.0), slider(0.0, 90.0, 0.0, 90.0, 1)),
-                    p("wireframeControls/verticalScale", "Vertical Scale", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 3)),
-                    p("heightMapControls/brightness", "Brightness", num(0.5), slider(-1.0, 2.0, 0.0, 1.0, 3)),
-                    p("heightMapControls/contrast", "Contrast", num(0.75), slider(0.0, 4.0, 0.0, 2.0, 3)),
-                    p("heightMapControls/gamma", "Gamma Adjustment", num(1.0), slider(0.01, 10.0, 0.2, 5.0, 3)),
-                    p("heightMapControls/renderDryAreasAs", "Render Dry Areas As", Value::Enum(0), popup(&["Solid", "Transparent"])),
-                    p("heightMapControls/transparency", "Transparency", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                    p("simulation/gridResolution", "Grid Resolution", num(60.0), slider(1.0, 400.0, 1.0, 200.0, 0)),
-                    p("simulation/gridResDownsamples", "Grid Res Downsamples", Value::Bool(false), ParamUi::Checkbox),
-                    p("simulation/waveSpeed", "Wave Speed", num(0.2), slider(0.0, 5.0, 0.0, 1.0, 3)),
-                    p("simulation/damping", "Damping", num(0.05), slider(0.0, 5.0, 0.0, 1.0, 3)),
-                    p("simulation/reflectEdges", "Reflect Edges", Value::Enum(0), popup(&["None", "Left", "Top", "Right", "Bottom", "All"])),
-                    p("simulation/preRoll", "Pre-roll (seconds)", num(0.0), slider(0.0, 30.0, 0.0, 10.0, 2)),
-                    p("ground/ground", "Ground", Value::Layer(None), ParamUi::Layer),
-                    p("ground/steepness", "Steepness", num(0.25), slider(0.0, 2.0, 0.0, 1.0, 3)),
-                    p("ground/height", "Height", num(0.25), slider(0.0, 2.0, 0.0, 1.0, 3)),
-                    p("ground/waveStrength", "Wave Strength", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                ];
-                v.extend(producer_params(1, 0.5, (0.5, 0.5)));
-                v.extend(producer_params(2, 0.0, (0.25, 0.25)));
-                v
-            },
-            wave_world,
-        ),
-        spec(
-            "ec.sim.shatter",
-            "Shatter",
-            vec![
-                p(
-                    "view",
-                    "View",
-                    Value::Enum(1),
-                    popup(&["Rendered", "Wireframe Front View", "Wireframe", "Wireframe Front View + Forces", "Wireframe + Forces"]),
-                ),
-                p("render", "Render", Value::Enum(0), popup(&["All", "Layer", "Pieces"])),
-                p("shape/pattern", "Pattern", Value::Enum(0), popup(SHATTER_PATTERNS)),
-                p("shape/repetitions", "Repetitions", num(10.0), slider(1.0, 500.0, 1.0, 100.0, 2)),
-                p("shape/direction", "Direction", num(0.0), ParamUi::Angle),
-                p("shape/origin", "Origin", pt(0.5, 0.5), ParamUi::Point),
-                p("shape/customShatterMap", "Custom Shatter Map", Value::Layer(None), ParamUi::Layer),
-                p("shape/whiteTilesFixed", "White Tiles Fixed", Value::Bool(false), ParamUi::Checkbox),
-                p("shape/extrusionDepth", "Extrusion Depth", num(0.05), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("force1/force1Position", "Position", pt(0.5, 0.5), ParamUi::Point),
-                p("force1/force1Depth", "Depth", num(0.1), slider(-1.0, 1.0, -1.0, 1.0, 3)),
-                p("force1/force1Radius", "Radius", num(0.4), slider(0.0, 4.0, 0.0, 2.0, 3)),
-                p("force1/force1Strength", "Strength", num(5.0), slider(-20.0, 20.0, -10.0, 10.0, 2)),
-                p("force2/force2Position", "Position", pt(0.25, 0.25), ParamUi::Point),
-                p("force2/force2Depth", "Depth", num(0.1), slider(-1.0, 1.0, -1.0, 1.0, 3)),
-                p("force2/force2Radius", "Radius", num(0.0), slider(0.0, 4.0, 0.0, 2.0, 3)),
-                p("force2/force2Strength", "Strength", num(5.0), slider(-20.0, 20.0, -10.0, 10.0, 2)),
-                p("physics/rotationSpeed", "Rotation Speed", num(0.2), slider(0.0, 5.0, 0.0, 1.0, 3)),
-                p("physics/tumbleAxis", "Tumble Axis", Value::Enum(0), popup(&["Free", "None", "X", "Y", "Z", "XY", "XZ", "YZ"])),
-                p("physics/randomness", "Randomness", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("physics/viscosity", "Viscosity", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("physics/massVariance", "Mass Variance", num(30.0), pct()),
-                p("physics/gravity", "Gravity", num(3.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
-                p("physics/gravityDirection", "Gravity Direction", num(180.0), ParamUi::Angle),
-                p("physics/gravityInclination", "Gravity Inclination", num(0.0), slider(-90.0, 90.0, -90.0, 90.0, 1)),
-                p("gradient/shatterThreshold", "Shatter Threshold", num(0.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
-                p("gradient/gradientLayer", "Gradient Layer", Value::Layer(None), ParamUi::Layer),
-                p("gradient/invertGradient", "Invert Gradient", Value::Bool(false), ParamUi::Checkbox),
-                p("textures/color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
-                p("textures/opacity", "Opacity", num(1.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("textures/frontMode", "Front Mode", Value::Enum(1), popup(&SHATTER_TEXTURE_MODES)),
-                p("textures/sideMode", "Side Mode", Value::Enum(0), popup(&SHATTER_TEXTURE_MODES)),
-                p("textures/backMode", "Back Mode", Value::Enum(1), popup(&SHATTER_TEXTURE_MODES)),
-                p("textures/frontLayer", "Front Layer", Value::Layer(None), ParamUi::Layer),
-                p("textures/sideLayer", "Side Layer", Value::Layer(None), ParamUi::Layer),
-                p("textures/backLayer", "Back Layer", Value::Layer(None), ParamUi::Layer),
-            ]
-            .into_iter()
-            .chain(crate::card3d::camera_params(4.0))
-            .chain(crate::card3d::lighting_params(1.0, 0.25))
-            .chain(crate::card3d::material_params(0.75))
-            .chain([p("randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0))])
-            .collect(),
-            shatter,
-        ),
-        spec(
-            "ec.sim.foam",
-            "Foam",
-            vec![
-                p("view", "View", Value::Enum(0), popup(&["Draft", "Draft + Flow Map", "Rendered"])),
-                p("producer/producerPoint", "Producer Point", pt(0.5, 0.5), ParamUi::Point),
-                p("producer/producerXSize", "Producer X Size", num(0.05), slider(0.0, 2.0, 0.0, 1.0, 3)),
-                p("producer/producerYSize", "Producer Y Size", num(0.05), slider(0.0, 2.0, 0.0, 1.0, 3)),
-                p("producer/producerOrientation", "Producer Orientation", num(0.0), ParamUi::Angle),
-                p("producer/zoomProducerPoint", "Zoom Producer Point", Value::Bool(false), ParamUi::Checkbox),
-                p("producer/productionRate", "Production Rate", num(1.0), slider(0.0, 50.0, 0.0, 10.0, 3)),
-                p("bubbles/size", "Size", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 3)),
-                p("bubbles/sizeVariance", "Size Variance", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("bubbles/lifespan", "Lifespan", num(300.0), slider(1.0, 30_000.0, 1.0, 1000.0, 1)),
-                p("bubbles/growthSpeed", "Bubble Growth Speed", num(0.1), slider(0.0001, 10.0, 0.0001, 1.0, 3)),
-                p("bubbles/strength", "Strength", num(10.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
-                p("physics/initialSpeed", "Initial Speed", num(0.0), slider(-100.0, 100.0, -10.0, 10.0, 3)),
-                p("physics/initialDirection", "Initial Direction", num(0.0), ParamUi::Angle),
-                p("physics/windSpeed", "Wind Speed", num(0.5), slider(-100.0, 100.0, -10.0, 10.0, 3)),
-                p("physics/windDirection", "Wind Direction", num(90.0), ParamUi::Angle),
-                p("physics/turbulence", "Turbulence", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 3)),
-                p("physics/wobbleAmount", "Wobble Amount", num(0.05), slider(0.0, 10.0, 0.0, 2.0, 3)),
-                p("physics/repulsion", "Repulsion", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 3)),
-                p("physics/popVelocity", "Pop Velocity", num(1.0), slider(-100.0, 100.0, -10.0, 10.0, 3)),
-                p("physics/viscosity", "Viscosity", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("physics/stickiness", "Stickiness", num(0.75), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("zoom", "Zoom", num(1.0), slider(0.01, 50.0, 0.1, 5.0, 3)),
-                p("universeSize", "Universe Size", num(1.0), slider(0.01, 10.0, 0.5, 3.0, 3)),
-                p("rendering/blendMode", "Blend Mode", Value::Enum(0), popup(&["Transparent", "Solid Old on Top", "Solid New on Top"])),
-                p("rendering/bubbleTexture", "Bubble Texture", Value::Enum(0), popup(&FOAM_TEXTURES)),
-                p("rendering/bubbleTextureLayer", "Bubble Texture Layer", Value::Layer(None), ParamUi::Layer),
-                p("rendering/bubbleOrientation", "Bubble Orientation", Value::Enum(0), popup(&["Fixed", "Physical Orientation", "Bubble Velocity"])),
-                p("rendering/environmentMap", "Environment Map", Value::Layer(None), ParamUi::Layer),
-                p("rendering/reflectionStrength", "Reflection Strength", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("rendering/reflectionConvergence", "Reflection Convergence", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
-                p("flowMap/flowMap", "Flow Map", Value::Layer(None), ParamUi::Layer),
-                p("flowMap/flowMapSteepness", "Flow Map Steepness", num(0.05), slider(-100.0, 100.0, -1.0, 1.0, 3)),
-                p("flowMap/flowMapFits", "Flow Map Fits", Value::Enum(0), popup(&["Background", "Universe"])),
-                p("flowMap/simulationQuality", "Simulation Quality", Value::Enum(0), popup(&["Normal", "High", "Intense"])),
-                p("randomSeed", "Random Seed", num(1.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
-            ],
-            foam,
-        ),
-    ]
-}
+mod foam;
+mod pieces;
+mod pixels;
+mod registry;
+mod shatter;
+mod surfaces;
+
+pub(crate) use foam::foam_plan;
+#[cfg(test)]
+use foam::foam_pop_age;
+pub use foam::{FoamDisc, FoamEnv, FoamPlan, foam_full_plan};
+#[cfg(test)]
+use pieces::Cam;
+#[cfg(test)]
+pub(crate) use pieces::draw_pieces;
+pub use pieces::{Piece, PiecePlan, PieceTex, piece_plan};
+pub(crate) use pieces::{rot_axis, sort_far_first};
+pub use pixels::{PixelPlan, pixel_plan};
+pub use registry::specs;
+#[cfg(test)]
+use shatter::SHATTER_PATTERNS;
+pub use surfaces::{CausticsSetup, WavePlan, Waves, caustics_setup, wave_world_plan};
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, run_fx};
-
-    fn ramp(w: u32, hh: u32) -> Image {
-        let mut img = Image::new(w, hh);
-        for y in 0..hh {
-            for x in 0..w {
-                img.set(x, y, [x as f32 / w as f32, y as f32 / hh as f32, 0.4, 1.0]);
-            }
-        }
-        img
-    }
-
-    fn run(id: &str, vals: &[(&str, Value)], img: Image, t: f64) -> Image {
-        run_fx(id, vals, img, t, EffectEnv::default()).img
-    }
-
-    fn max_diff(a: &Image, b: &Image) -> f32 {
-        a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|k| (p[k] - q[k]).abs()).fold(0.0, f32::max)).fold(0.0, f32::max)
-    }
-
-    fn sum_diff(a: &Image, b: &Image) -> f32 {
-        a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|k| (p[k] - q[k]).abs()).sum::<f32>()).sum()
-    }
-
-    #[test]
-    fn piece_at_rest_is_identity() {
-        let src = ramp(16, 16);
-        let cam = Cam { c: [8.0, 8.0], d: 64.0 };
-        let id = rot_axis([1.0, 0.0, 0.0], 0.0);
-        let pc = Piece::new(&[[0.0, 0.0], [16.0, 0.0], [16.0, 16.0], [0.0, 16.0]], [8.0, 8.0], &id, [8.0, 8.0, 0.0], cam).unwrap();
-        let mut out = Image::new(16, 16);
-        draw_pieces(&mut out, &[pc], &src, None);
-        assert!(max_diff(&out, &src) < 1e-4);
-    }
-
-    #[test]
-    fn ball_action_draws_balls() {
-        let v = [("ballSize", num(80.0))];
-        let a = run("ec.sim.ccballaction", &v, ramp(32, 32), 0.0);
-        assert_eq!(a, run("ec.sim.ccballaction", &v, ramp(32, 32), 0.0));
-        assert!(a.data.iter().any(|p| p[3] > 0.9) && a.data.iter().any(|p| p[3] == 0.0), "balls with gaps");
-        let none = run("ec.sim.ccballaction", &[("ballSize", num(0.0))], ramp(32, 32), 0.0);
-        assert!(none.data.iter().all(|p| p[3] == 0.0));
-        let sc = run("ec.sim.ccballaction", &[("ballSize", num(80.0)), ("scatter", num(20.0))], ramp(32, 32), 0.0);
-        assert!(sum_diff(&a, &sc) > 1.0);
-    }
-
-    #[test]
-    fn pixel_polly_breaks_after_start() {
-        let v = [("forceCenter", pt(16.0, 16.0)), ("gridSpacing", num(4.0))];
-        let before = run("ec.sim.ccpixelpolly", &v, ramp(32, 32), 0.0);
-        assert_eq!(before, ramp(32, 32), "intact before the start time");
-        let a = run("ec.sim.ccpixelpolly", &v, ramp(32, 32), 0.5);
-        assert_eq!(a, run("ec.sim.ccpixelpolly", &v, ramp(32, 32), 0.5));
-        assert!(sum_diff(&a, &ramp(32, 32)) > 10.0);
-        let tex = run("ec.sim.ccpixelpolly", &[("forceCenter", pt(16.0, 16.0)), ("gridSpacing", num(4.0)), ("object", Value::Enum(3))], ramp(32, 32), 0.5);
-        assert!(sum_diff(&a, &tex) > 0.1);
-    }
-
-    #[test]
-    fn scatterize_identity_and_scatter() {
-        assert_eq!(run("ec.sim.ccscatterize", &[], ramp(24, 24), 0.0), ramp(24, 24));
-        let a = run("ec.sim.ccscatterize", &[("scatter", num(5.0))], ramp(24, 24), 0.0);
-        assert_eq!(a, run("ec.sim.ccscatterize", &[("scatter", num(5.0))], ramp(24, 24), 0.0));
-        assert!(sum_diff(&a, &ramp(24, 24)) > 1.0);
-        let tw = run("ec.sim.ccscatterize", &[("leftTwist", num(80.0)), ("rightTwist", num(80.0))], ramp(24, 24), 0.0);
-        assert!(sum_diff(&tw, &ramp(24, 24)) > 1.0);
-    }
-
-    #[test]
-    fn card_dance_identity_and_rotation() {
-        let src = ramp(30, 20);
-        let a = run("ec.sim.carddance", &[], src.clone(), 0.0);
-        assert!(max_diff(&a, &src) < 0.02, "flat cards reproduce the layer: {}", max_diff(&a, &src));
-        let r = run("ec.sim.carddance", &[("yRotation/yRotSource", Value::Enum(1)), ("yRotation/yRotMultiplier", num(90.0))], src.clone(), 0.0);
-        assert_eq!(r, run("ec.sim.carddance", &[("yRotation/yRotSource", Value::Enum(1)), ("yRotation/yRotMultiplier", num(90.0))], src.clone(), 0.0));
-        assert!(sum_diff(&r, &src) > 5.0);
-        let z = run("ec.sim.carddance", &[("zPosition/zPosOffset", num(-1.0))], src.clone(), 0.0);
-        assert!(sum_diff(&z, &src) > 5.0, "cards pulled towards the camera grow");
-    }
-
-    #[test]
-    fn shatter_at_rest_then_breaks() {
-        let v = [("view", Value::Enum(0)), ("force1/force1Position", pt(16.0, 16.0)), ("shape/origin", pt(16.0, 16.0))];
-        let src = ramp(32, 32);
-        let t0 = run("ec.sim.shatter", &v, src.clone(), 0.0);
-        assert!(max_diff(&t0, &src) < 0.03, "{}", max_diff(&t0, &src));
-        let t1 = run("ec.sim.shatter", &v, src.clone(), 0.5);
-        assert_eq!(t1, run("ec.sim.shatter", &v, src.clone(), 0.5));
-        assert!(sum_diff(&t1, &src) > 10.0);
-        for pat in 0..SHATTER_PATTERNS.len() as u32 {
-            let vv =
-                [("view", Value::Enum(0)), ("shape/pattern", Value::Enum(pat)), ("force1/force1Position", pt(16.0, 16.0)), ("shape/origin", pt(16.0, 16.0))];
-            let r = run("ec.sim.shatter", &vv, src.clone(), 0.0);
-            assert!(max_diff(&r, &src) < 0.05, "pattern {pat} tiles the layer: {}", max_diff(&r, &src));
-        }
-        let wire = run("ec.sim.shatter", &[("shape/repetitions", num(3.0))], src.clone(), 0.0);
-        assert!(wire.data.iter().any(|p| p[3] > 0.5) && wire.data.iter().any(|p| p[3] == 0.0));
-        let layer_only =
-            run("ec.sim.shatter", &[("view", Value::Enum(0)), ("render", Value::Enum(1)), ("force1/force1Position", pt(16.0, 16.0))], src.clone(), 0.5);
-        assert!(layer_only.get(16, 16)[3] == 0.0, "broken centre removed");
-    }
-
-    #[test]
-    fn caustics_flat_water() {
-        let src = ramp(24, 24);
-        let a = run(
-            "ec.sim.caustics",
-            &[
-                ("water/surfaceOpacity", num(0.0)),
-                ("lighting/ambientLight", num(0.0)),
-                ("material/diffuse", num(1.0)),
-                ("lighting/lightHeight", num(1000.0)),
-                ("material/specular", num(0.0)),
-            ],
-            src.clone(),
-            0.0,
-        );
-        assert!(max_diff(&a, &src) < 0.01, "flat water, light overhead = bottom: {}", max_diff(&a, &src));
-        let b = run("ec.sim.caustics", &[], src.clone(), 0.0);
-        assert_eq!(b, run("ec.sim.caustics", &[], src.clone(), 0.0));
-        assert!(sum_diff(&b, &src) > 0.1);
-    }
-
-    #[test]
-    fn caustics_sky_and_light_types() {
-        let src = Image::filled(32, 32, [0.5, 0.5, 0.5, 1.0]);
-        let env = EffectEnv { host: Some(&FoamHost), ..Default::default() };
-        let run_h = |vals: &[(&str, Value)]| run_fx("ec.sim.caustics", vals, src.clone(), 0.0, env).img;
-        // A mirror-like surface shows the (green) sky.
-        let mirror = [("water/surfaceOpacity", num(1.0)), ("sky/sky", Value::Layer(Some(2))), ("sky/intensity", num(1.0))];
-        let p = run_h(&mirror).get(16, 16);
-        assert!(p[1] > p[0] + 0.3 && p[1] > p[2] + 0.3, "{p:?}");
-        // Point Source lights pixels by their own direction to the light: the image is no
-        // longer uniform; Distant Source lights the flat water evenly.
-        let lit = |t: u32| {
-            run_h(&[
-                ("lighting/lightType", Value::Enum(t)),
-                ("lighting/lightPosition", pt(0.0, 0.0)),
-                ("lighting/lightHeight", num(0.2)),
-                ("water/surfaceOpacity", num(0.0)),
-            ])
-        };
-        let (distant, point) = (lit(0), lit(1));
-        assert!((distant.get(2, 2)[0] - distant.get(30, 30)[0]).abs() < 1e-5);
-        assert!(point.get(2, 2)[0] > point.get(30, 30)[0] + 0.02, "{:?} {:?}", point.get(2, 2), point.get(30, 30));
-        // First Comp Light without a comp light: ambient only.
-        let none = run_h(&[("lighting/lightType", Value::Enum(2)), ("water/surfaceOpacity", num(0.0))]);
-        assert!(none.get(16, 16)[0] < distant.get(16, 16)[0]);
-    }
-
-    #[test]
-    fn wave_world_wireframe_controls_ground_and_dry_areas() {
-        let base = [("producer1/producer1Position", pt(8.0, 16.0)), ("simulation/gridResolution", num(24.0))];
-        let wire = |extra: &[(&str, Value)]| run("ec.sim.waveworld", &[base.as_slice(), extra].concat(), Image::new(32, 32), 0.5);
-        assert_ne!(wire(&[]), wire(&[("wireframeControls/horizontalRotation", num(40.0))]));
-        assert_ne!(wire(&[]), wire(&[("wireframeControls/verticalScale", num(3.0))]));
-        // Ground (left dark, right light): the light side rises above the water and is dry.
-        let env = EffectEnv { host: Some(&FoamHost), ..Default::default() };
-        let hm = |extra: &[(&str, Value)]| {
-            let mut v: Vec<(&str, Value)> = base.to_vec();
-            v.extend([("view", Value::Enum(1)), ("ground/ground", Value::Layer(Some(1))), ("ground/steepness", num(0.5)), ("ground/height", num(0.25))]);
-            v.extend_from_slice(extra);
-            run_fx("ec.sim.waveworld", &v, Image::new(32, 32), 1.0, env).img
-        };
-        let solid = hm(&[]);
-        let clear = hm(&[("heightMapControls/renderDryAreasAs", Value::Enum(1))]);
-        assert!(solid.get(30, 16)[3] > 0.99 && clear.get(30, 16)[3] == 0.0);
-        assert!(clear.get(4, 16)[3] > 0.99, "wet side stays");
-        // Dry ground stays flat: mid grey (brightness 0.5) there.
-        assert!((solid.get(30, 16)[0] - 0.5).abs() < 1e-4);
-        // Wave Strength slows waves over shallow water: the surface differs.
-        assert_ne!(hm(&[]), hm(&[("ground/waveStrength", num(1.0))]));
-    }
-
-    #[test]
-    fn wave_world_seek_and_waves() {
-        let v = vec![("view", Value::Enum(1)), ("producer1/producer1Position", pt(16.0, 16.0)), ("simulation/gridResolution", num(24.0))];
-        let _ = run("ec.sim.waveworld", &v, Image::new(32, 32), 0.5);
-        let a = run("ec.sim.waveworld", &v, Image::new(32, 32), 1.0);
-        let mut v2 = v.clone();
-        v2.push(("heightMapControls/transparency", num(0.0)));
-        assert_eq!(a, run("ec.sim.waveworld", &v2, Image::new(32, 32), 1.0));
-        // Waves spread: some pixels differ from the flat-water grey.
-        assert!(a.data.iter().any(|p| (p[0] - 0.5).abs() > 0.05), "waves");
-        let flat = run("ec.sim.waveworld", &[("view", Value::Enum(1)), ("producer1/producer1Amplitude", num(0.0))], Image::new(32, 32), 1.0);
-        assert!(flat.data.iter().all(|p| (p[0] - 0.5).abs() < 1e-5));
-        let wire =
-            run("ec.sim.waveworld", &[("producer1/producer1Position", pt(16.0, 16.0)), ("simulation/gridResolution", num(10.0))], Image::new(32, 32), 0.3);
-        assert!(wire.data.iter().any(|p| p[1] > 0.3));
-    }
-
-    #[test]
-    fn wave_world_steps_match_direct() {
-        // Fresh caches: resumed simulation equals simulation from scratch.
-        let v = vec![
-            ("view", Value::Enum(1)),
-            ("producer1/producer1Position", pt(16.0, 16.0)),
-            ("simulation/gridResolution", num(20.0)),
-            ("simulation/damping", num(0.07)),
-        ];
-        let a = run("ec.sim.waveworld", &v, Image::new(32, 32), 1.3);
-        let mut v2 = v.clone();
-        v2.push(("simulation/damping", num(0.07000001)));
-        // Different key: computed from scratch at 1.3 directly vs via 0.4 (both fresh keys).
-        let _ = run("ec.sim.waveworld", &v2, Image::new(32, 32), 0.4);
-        let b = run("ec.sim.waveworld", &v2, Image::new(32, 32), 1.3);
-        assert!(max_diff(&a, &b) < 1e-3, "{}", max_diff(&a, &b));
-    }
-
-    #[test]
-    fn foam_bubbles_drift_and_seek() {
-        let v = vec![("producer/producerPoint", pt(16.0, 16.0)), ("view", Value::Enum(2)), ("producer/productionRate", num(2.0))];
-        let none = run("ec.sim.foam", &v, Image::new(32, 32), 0.0);
-        assert!(none.data.iter().all(|p| p[3] == 0.0));
-        let _ = run("ec.sim.foam", &v, Image::new(32, 32), 0.6);
-        let a = run("ec.sim.foam", &v, Image::new(32, 32), 1.2);
-        let mut v2 = v.clone();
-        v2.push(("randomSeed", num(1.0)));
-        assert_eq!(a, run("ec.sim.foam", &v2, Image::new(32, 32), 1.2));
-        assert!(a.data.iter().any(|p| p[3] > 0.05), "bubbles");
-        let draft = run("ec.sim.foam", &[("producer/producerPoint", pt(16.0, 16.0)), ("producer/productionRate", num(2.0))], Image::new(32, 32), 1.0);
-        assert!(draft.data.iter().any(|p| p[3] > 0.05));
-    }
-
-    #[test]
-    fn foam_strength_controls_early_popping() {
-        // Strong bubbles all live their full lifespan; weak ones pop at random earlier.
-        assert_eq!(foam_pop_age(7, 300.0, 0.0, 1), 300.0);
-        let early = (0..200).filter(|&id| foam_pop_age(id, 300.0, 1.0, 1) < 150.0).count();
-        assert!(early > 60 && early < 140, "{early}");
-        let count = |strength: f64| {
-            let v = vec![
-                ("producer/producerPoint", pt(16.0, 16.0)),
-                ("producer/productionRate", num(3.0)),
-                ("bubbles/lifespan", num(40.0)),
-                ("bubbles/strength", num(strength)),
-                ("physics/windSpeed", num(0.0)),
-            ];
-            run("ec.sim.foam", &v, Image::new(32, 32), 1.5).data.iter().map(|p| p[3]).sum::<f32>()
-        };
-        assert!(count(0.0) < count(20.0) * 0.9, "{} vs {}", count(0.0), count(20.0));
-    }
-
-    /// A host with a comp camera (identity, or tilted) and a first comp light.
-    struct Scene {
-        camera: Option<[[f64; 4]; 3]>,
-        light: Option<crate::CompLight>,
-        layer: Option<Image>,
-    }
-    impl crate::EffectHost for Scene {
-        fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
-            let img = self.layer.clone()?;
-            let size = [img.width as f64, img.height as f64];
-            Some(crate::LayerPixels { buf: Buf { img, offset: [0.0; 2], scale: 1.0 }, size })
-        }
-        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-            None
-        }
-        fn comp_scene(&self) -> Option<crate::CompScene> {
-            Some(crate::CompScene { camera: self.camera, camera_layer: true, light: self.light })
-        }
-    }
-
-    fn run_env(id: &str, vals: &[(&str, Value)], img: Image, t: f64, host: &Scene) -> Image {
-        run_fx(id, vals, img, t, EffectEnv { host: Some(host), ..Default::default() }).img
-    }
-
-    #[test]
-    fn card_dance_camera_systems() {
-        let src = ramp(40, 30);
-        // Camera Position: rotating the camera changes the view; zero rotation is the layer.
-        let r = run("ec.sim.carddance", &[("cameraPosition/yRotation", num(30.0))], src.clone(), 0.0);
-        assert!(sum_diff(&r, &src) > 10.0);
-        let order = run("ec.sim.carddance", &[("cameraPosition/yRotation", num(30.0)), ("cameraPosition/xRotation", num(30.0))], src.clone(), 0.0);
-        let order2 = run(
-            "ec.sim.carddance",
-            &[("cameraPosition/yRotation", num(30.0)), ("cameraPosition/xRotation", num(30.0)), ("cameraPosition/transformOrder", Value::Enum(5))],
-            src.clone(),
-            0.0,
-        );
-        assert!(sum_diff(&order, &order2) > 1.0, "Transform Order matters");
-        // X, Y Position moves the view: the layer shifts by the offset.
-        let moved = run("ec.sim.carddance", &[("cameraPosition/xyPosition", pt(30.0, 15.0))], src.clone(), 0.0);
-        assert!((moved.get(25, 10)[0] - src.get(15, 10)[0]).abs() < 0.03, "{:?} {:?}", moved.get(25, 10), src.get(15, 10));
-        // Corner Pins: the layer's corners land on the pins.
-        let pins = [
-            ("cameraSystem", Value::Enum(1)),
-            ("cornerPins/upperLeftCorner", pt(10.0, 5.0)),
-            ("cornerPins/upperRightCorner", pt(30.0, 5.0)),
-            ("cornerPins/lowerLeftCorner", pt(10.0, 25.0)),
-            ("cornerPins/lowerRightCorner", pt(30.0, 25.0)),
-        ];
-        let cp = run("ec.sim.carddance", &pins, src.clone(), 0.0);
-        assert_eq!(cp.get(3, 3)[3], 0.0, "outside the pinned quad");
-        assert!(cp.get(20, 15)[3] > 0.99);
-        assert!((cp.get(20, 15)[0] - src.get(20, 15)[0]).abs() < 0.05, "centre maps to centre");
-        // Comp Camera: the identity camera reproduces the layer; a camera that doubles x moves it.
-        let ident = Scene { camera: Some([[1.0, 0.0, 0.0, 0.0], [0.0, 1.0, 0.0, 0.0], [0.0, 0.0, 0.002, 1.0]]), light: None, layer: None };
-        let cc = run_env("ec.sim.carddance", &[("cameraSystem", Value::Enum(2))], src.clone(), 0.0, &ident);
-        assert!(max_diff(&cc, &src) < 0.02, "{}", max_diff(&cc, &src));
-        let half = Scene { camera: Some([[0.5, 0.0, 0.0, 0.0], [0.0, 0.5, 0.0, 0.0], [0.0, 0.0, 0.002, 1.0]]), ..ident };
-        let cc = run_env("ec.sim.carddance", &[("cameraSystem", Value::Enum(2))], src.clone(), 0.0, &half);
-        assert_eq!(cc.get(35, 25)[3], 0.0, "half-size view leaves the far corner empty");
-    }
-
-    #[test]
-    fn card_dance_lighting_and_material() {
-        let src = Image::filled(40, 30, [0.5, 0.5, 0.5, 1.0]);
-        let tilt = [("rows", num(1.0)), ("columns", num(1.0)), ("yRotation/yRotSource", Value::Enum(0)), ("yRotation/yRotOffset", num(60.0))];
-        let lit = |extra: &[(&str, Value)]| {
-            let mut v: Vec<(&str, Value)> = tilt.to_vec();
-            v.extend_from_slice(extra);
-            run("ec.sim.carddance", &v, src.clone(), 0.0).get(20, 15)
-        };
-        let base = lit(&[]);
-        // Tilted cards facing away from a frontal light get darker than flat ones.
-        assert!(base[0] < 0.45, "{base:?}");
-        // Light colour tints; intensity brightens; ambient alone lights evenly.
-        let red = lit(&[("lighting/lightColor", col(1.0, 0.0, 0.0))]);
-        assert!(red[0] > red[1] + 0.05);
-        assert!(lit(&[("lighting/lightIntensity", num(2.0))])[0] > base[0]);
-        let amb = lit(&[("lighting/ambientLight", num(1.0)), ("material/diffuse", num(0.0))]);
-        assert!((amb[0] - 0.5).abs() < 1e-3);
-        // A light placed to the side (Point Source) changes the shading of the tilted card.
-        let side = lit(&[("lighting/lightType", Value::Enum(1)), ("lighting/lightPosition", pt(200.0, 15.0)), ("lighting/lightDepth", num(0.2))]);
-        assert!((side[0] - base[0]).abs() > 0.02, "{side:?} vs {base:?}");
-        // Specular adds a highlight on flat, frontally lit cards.
-        let flat = run("ec.sim.carddance", &[("material/specular", num(0.5))], src.clone(), 0.0).get(20, 15);
-        assert!(flat[0] > 0.9, "{flat:?}");
-        // First Comp Light: no light in the comp → ambient only; a light from the host is used.
-        let none = Scene { camera: None, light: None, layer: None };
-        let a = run_env("ec.sim.carddance", &[("lighting/lightType", Value::Enum(2))], src.clone(), 0.0, &none).get(20, 15);
-        assert!((a[0] - 0.5 * (0.25 + 0.75)).abs() < 1e-3, "{a:?}");
-        let blue = Scene { light: Some(crate::CompLight { pos: [20.0, 15.0, -100.0], dir: [0.0, 0.0, 1.0], color: [0.0, 0.0, 1.0], kind: 0 }), ..none };
-        let a = run_env("ec.sim.carddance", &[("lighting/lightType", Value::Enum(2))], src.clone(), 0.0, &blue).get(20, 15);
-        assert!(a[2] > a[0] + 0.2, "{a:?}");
-    }
-
-    #[test]
-    fn shatter_custom_map_gradient_textures_and_extrusion() {
-        let src = ramp(32, 32);
-        let base = [("view", Value::Enum(0)), ("force1/force1Position", pt(16.0, 16.0)), ("force1/force1Radius", num(2.0)), ("shape/origin", pt(16.0, 16.0))];
-        let with = |extra: &[(&str, Value)], t: f64, host: Option<&Scene>| {
-            let mut v: Vec<(&str, Value)> = base.to_vec();
-            v.extend_from_slice(extra);
-            match host {
-                Some(h) => run_env("ec.sim.shatter", &v, src.clone(), t, h),
-                None => run("ec.sim.shatter", &v, src.clone(), t),
-            }
-        };
-        // Custom Shatter Map: a map white on the left and black on the right; with White Tiles
-        // Fixed the left half stays put while the right half breaks away.
-        let mut map = Image::new(32, 32);
-        for y in 0..32 {
-            for x in 0..32 {
-                map.set(x, y, if x < 16 { [1.0; 4] } else { [0.0, 0.0, 0.0, 1.0] });
-            }
-        }
-        let host = Scene { camera: None, light: None, layer: Some(map) };
-        let custom = [("shape/pattern", Value::Enum(5)), ("shape/customShatterMap", Value::Layer(Some(1))), ("shape/whiteTilesFixed", Value::Bool(true))];
-        let at_rest = with(&custom, 0.0, Some(&host));
-        assert!(max_diff(&at_rest, &src) < 0.05, "custom pieces tile the layer: {}", max_diff(&at_rest, &src));
-        let broke = with(&custom, 1.0, Some(&host));
-        assert!(max_diff_region(&broke, &src, 0..12) < 0.05, "white tiles fixed");
-        assert!(sum_diff_region(&broke, &src, 20..32) > 5.0, "black group moved");
-        // Gradient: a black gradient layer with threshold 50 % keeps everything together.
-        let black = Scene { camera: None, light: None, layer: Some(Image::filled(32, 32, [0.0, 0.0, 0.0, 1.0])) };
-        let g = with(&[("gradient/gradientLayer", Value::Layer(Some(1))), ("gradient/shatterThreshold", num(50.0))], 1.0, Some(&black));
-        assert!(max_diff(&g, &src) < 0.05);
-        let gi = with(
-            &[("gradient/gradientLayer", Value::Layer(Some(1))), ("gradient/shatterThreshold", num(50.0)), ("gradient/invertGradient", Value::Bool(true))],
-            1.0,
-            Some(&black),
-        );
-        assert!(sum_diff(&gi, &src) > 10.0);
-        // Textures: Front Mode Color paints the pieces flat; Opacity fades them.
-        let flat = with(&[("textures/frontMode", Value::Enum(0)), ("textures/color", col(0.0, 1.0, 0.0))], 0.0, None);
-        let p = flat.get(16, 16);
-        assert!(p[1] > 0.95 && p[0] < 0.05, "{p:?}");
-        let half = with(&[("textures/opacity", num(0.5)), ("shape/repetitions", num(2.0))], 0.0, None);
-        assert!((half.get(8, 4)[3] - 0.5).abs() < 0.02, "{:?}", half.get(8, 4));
-        // Extrusion: thicker pieces cover more once they tumble.
-        let cover = |d: f64| {
-            with(&[("shape/extrusionDepth", num(d)), ("textures/sideMode", Value::Enum(0)), ("textures/color", col(1.0, 1.0, 1.0))], 0.6, None)
-                .data
-                .iter()
-                .map(|p| p[3])
-                .sum::<f32>()
-        };
-        assert!(cover(1.0) > cover(0.0) + 1.0, "{} vs {}", cover(1.0), cover(0.0));
-        // Deterministic and seek-consistent.
-        assert_eq!(with(&custom, 0.7, Some(&host)), with(&custom, 0.7, Some(&host)));
-    }
-
-    fn max_diff_region(a: &Image, b: &Image, xs: std::ops::Range<u32>) -> f32 {
-        let mut m = 0.0f32;
-        for y in 0..a.height {
-            for x in xs.clone() {
-                let (p, q) = (a.get(x as i64, y as i64), b.get(x as i64, y as i64));
-                m = (0..4).map(|k| (p[k] - q[k]).abs()).fold(m, f32::max);
-            }
-        }
-        m
-    }
-
-    fn sum_diff_region(a: &Image, b: &Image, xs: std::ops::Range<u32>) -> f32 {
-        let mut s = 0.0;
-        for y in 0..a.height {
-            for x in xs.clone() {
-                let (p, q) = (a.get(x as i64, y as i64), b.get(x as i64, y as i64));
-                s += (0..4).map(|k| (p[k] - q[k]).abs()).sum::<f32>();
-            }
-        }
-        s
-    }
-
-    /// Layer 1 = a left-dark, right-light ramp; layer 2 = solid green.
-    struct FoamHost;
-    impl crate::EffectHost for FoamHost {
-        fn layer(&self, id: u64, _: bool) -> Option<crate::LayerPixels> {
-            let img = if id == 1 { ramp(32, 32) } else { Image::filled(32, 32, [0.0, 1.0, 0.0, 1.0]) };
-            Some(crate::LayerPixels { buf: Buf { img, offset: [0.0; 2], scale: 1.0 }, size: [32.0, 32.0] })
-        }
-        fn layer_at(&self, id: u64, _: f64, me: bool) -> Option<crate::LayerPixels> {
-            self.layer(id, me)
-        }
-        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-            None
-        }
-    }
-
-    #[test]
-    fn foam_flow_map_pop_velocity_wobble_textures_and_reflection() {
-        let base = vec![
-            ("producer/producerPoint", pt(16.0, 16.0)),
-            ("producer/productionRate", num(2.0)),
-            ("physics/windSpeed", num(0.0)),
-            ("physics/turbulence", num(0.0)),
-            ("view", Value::Enum(2)),
-        ];
-        let with = |extra: &[(&str, Value)], t: f64| {
-            let mut v = base.clone();
-            v.extend_from_slice(extra);
-            run_fx("ec.sim.foam", &v, Image::new(32, 32), t, EffectEnv { host: Some(&FoamHost), ..Default::default() }).img
-        };
-        let cx = |img: &Image| {
-            let (mut s, mut n) = (0.0, 0.0);
-            for y in 0..32 {
-                for x in 0..32 {
-                    let a = img.get(x, y)[3];
-                    s += a * x as f32;
-                    n += a;
-                }
-            }
-            s / n.max(1e-6)
-        };
-        // Flow map: bubbles run downhill (towards the dark left side).
-        let still = with(&[], 1.0);
-        let flowing = with(&[("flowMap/flowMap", Value::Layer(Some(1))), ("flowMap/flowMapSteepness", num(1.0))], 1.0);
-        assert!(cx(&flowing) < cx(&still) - 1.0, "{} vs {}", cx(&flowing), cx(&still));
-        let hq =
-            with(&[("flowMap/flowMap", Value::Layer(Some(1))), ("flowMap/flowMapSteepness", num(1.0)), ("flowMap/simulationQuality", Value::Enum(2))], 1.0);
-        assert_eq!(
-            hq,
-            with(&[("flowMap/flowMap", Value::Layer(Some(1))), ("flowMap/flowMapSteepness", num(1.0)), ("flowMap/simulationQuality", Value::Enum(2))], 1.0)
-        );
-        // Pop velocity scatters the survivors when short-lived bubbles pop.
-        let short = [("bubbles/lifespan", num(8.0)), ("bubbles/strength", num(0.0))];
-        let a = with(&[short.as_slice(), &[("physics/popVelocity", num(0.0))]].concat(), 1.0);
-        let b2 = with(&[short.as_slice(), &[("physics/popVelocity", num(20.0))]].concat(), 1.0);
-        assert_ne!(a, b2);
-        // Wobble changes the drawn bubbles.
-        assert_ne!(with(&[("physics/wobbleAmount", num(0.0))], 1.0), with(&[("physics/wobbleAmount", num(3.0))], 1.0));
-        // User Defined texture: bubbles show the texture layer (green).
-        let tex = with(&[("rendering/bubbleTexture", Value::Enum(5)), ("rendering/bubbleTextureLayer", Value::Layer(Some(2)))], 1.0);
-        assert!(tex.data.iter().any(|p| p[1] > 0.5 && p[0] < 0.1));
-        // Environment map: reflections tint the bubbles.
-        let refl = with(&[("rendering/environmentMap", Value::Layer(Some(2))), ("rendering/reflectionStrength", num(1.0))], 1.0);
-        let g = |i: &Image| i.data.iter().map(|p| p[1] - p[0]).sum::<f32>();
-        assert!(g(&refl) > g(&still) + 1.0);
-        // Zoom Producer Point zooms about the producer instead of the layer centre.
-        let off = [("producer/producerPoint", pt(8.0, 8.0)), ("zoom", num(2.0))];
-        let z1 = with(&off, 1.0);
-        let z2 = with(&[off.as_slice(), &[("producer/zoomProducerPoint", Value::Bool(true))]].concat(), 1.0);
-        assert!((cx(&z2) - 8.0).abs() < 2.0 && cx(&z1) < 4.0, "{} vs {}", cx(&z2), cx(&z1));
-    }
-}
+mod tests;
diff --git a/crates/effects/src/sim2/foam.rs b/crates/effects/src/sim2/foam.rs
new file mode 100644
index 000000000..fc187d191
--- /dev/null
+++ b/crates/effects/src/sim2/foam.rs
@@ -0,0 +1,411 @@
+use super::{
+    Acc, Buf, EffectCtx, Image, IndexedParallelIterator, IntoParallelRefIterator, IntoParallelRefMutIterator, ParallelIterator, Plane, Px, Shape, SimCache,
+    Sprite, Value, hs, params_key, splat, unpremul, value_noise,
+};
+
+// ------------------------------------------------------------------ Foam
+
+#[derive(Clone, Debug)]
+struct FoamBubble {
+    p: [f32; 2],
+    v: [f32; 2],
+    age: f32,
+    size: f32,
+    /// Spin (radians) for Physical Orientation.
+    spin: f32,
+    id: u32,
+}
+
+#[derive(Clone, Debug, Default)]
+struct FoamState {
+    b: Vec<FoamBubble>,
+    carry: f32,
+    next: u32,
+}
+
+static FOAM_CACHE: SimCache<FoamState> = SimCache::new(4);
+
+/// Foam steps once per frame at 30 frames per second.
+const FOAM_FPS: f64 = 30.0;
+
+/// Foam's Bubble Texture options (the last uses Bubble Texture Layer).
+pub(super) const FOAM_TEXTURES: [&str; 6] = ["Default Bubble", "Spit", "Bubblegum", "Dishwater", "Milky", "User Defined"];
+
+/// Age (in simulation steps) at which bubble `id` pops: its lifespan, shortened at random for
+/// frail bubbles (`frailty` 0 = every bubble reaches `lifespan`, 1 = uniformly early).
+pub(super) fn foam_pop_age(id: u32, lifespan: f32, frailty: f32, seed: u32) -> f32 {
+    lifespan * (1.0 - frailty * (hs(id, 11, seed) * 0.5 + 0.5))
+}
+
+/// Foam: bubbles born in the producer rectangle grow to their size, drift with the wind,
+/// turbulence and the Flow Map (bubbles run downhill on its luminance), repel and stick to each
+/// other, wobble, and pop at the end of their (Strength-shortened) lifespan, pushing their
+/// neighbours away at Pop Velocity. Rendered bubbles use a built-in texture or the Bubble
+/// Texture Layer, oriented by Bubble Orientation, and reflect the Environment Map.
+pub(super) fn foam(ctx: &EffectCtx, b: Buf) -> Buf {
+    foam_full_plan(ctx, &b).finish(b)
+}
+
+/// Foam's bubbles as sprites, `None` when it draws more than sprites (a User Defined bubble
+/// texture, an Environment Map reflection or the Draft + Flow Map view's flow map).
+pub(crate) fn foam_plan(ctx: &EffectCtx, b: &Buf) -> Option<crate::sim::SpritePlan> {
+    let plan = foam_full_plan(ctx, b);
+    (plan.user.is_none() && plan.env.is_none() && plan.flow.is_none()).then_some(plan.sprites)
+}
+
+/// A bubble disc filled by Foam's User Defined texture (buffer px; `rot` radians).
+#[derive(Clone, Copy, Debug)]
+pub struct FoamDisc {
+    pub x: f64,
+    pub y: f64,
+    pub r: f32,
+    pub rot: f32,
+    pub fade: f32,
+}
+
+/// Foam's Environment Map reflection: the map fitted to the buffer, Reflection Convergence and
+/// Strength, and the bubble discs reflecting it (`rot` and `fade` unused).
+pub struct FoamEnv {
+    pub img: Image,
+    pub conv: f64,
+    pub strength: f32,
+    pub discs: Vec<FoamDisc>,
+}
+
+/// What Foam draws this frame over a transparent frame of the layer's size: the bubble sprites,
+/// then the User Defined texture's discs, the Environment Map's reflections and (Draft + Flow
+/// Map) the flow map under it all, each `foam_disc`-composited in bubble order.
+pub struct FoamPlan {
+    pub sprites: crate::sim::SpritePlan,
+    pub user: Option<(crate::LayerPixels, Vec<FoamDisc>)>,
+    pub env: Option<FoamEnv>,
+    /// The flow map fitted to the buffer.
+    pub flow: Option<Image>,
+}
+
+impl FoamPlan {
+    pub fn finish(&self, b: Buf) -> Buf {
+        let mut out = splat(b.img.width, b.img.height, &self.sprites.sprites, self.sprites.acc);
+        // User Defined: the texture layer fills each bubble's disc.
+        if let Some((tex, discs)) = &self.user {
+            for d in discs {
+                let (rot, fade) = (d.rot, d.fade);
+                foam_disc(&mut out, d.x, d.y, d.r as f64, |u, v| {
+                    // u, v in −1..1 across the bubble, rotated into the texture.
+                    let (sr, cr) = rot.sin_cos();
+                    let (tu, tv) = (u as f32 * cr + v as f32 * sr, -u as f32 * sr + v as f32 * cr);
+                    let (x, y) = ((tu as f64 * 0.5 + 0.5) * tex.size[0], (tv as f64 * 0.5 + 0.5) * tex.size[1]);
+                    let px = tex.buf.img.sample_bilinear(x * tex.buf.scale + tex.buf.offset[0], y * tex.buf.scale + tex.buf.offset[1]);
+                    px.map(|c| c * fade)
+                });
+            }
+        }
+        // Environment Map: each bubble reflects the map along its sphere normal (Reflection
+        // Convergence pulls the reflection towards the bubble's own spot of the map).
+        if let Some(env) = &self.env {
+            let (conv, strength) = (env.conv, env.strength);
+            let (w, h) = (b.img.width as f64, b.img.height as f64);
+            for d in &env.discs {
+                let (bx, by) = (d.x, d.y);
+                foam_disc(&mut out, bx, by, d.r as f64, |u, v| {
+                    // Sphere normal; the reflection looks across the whole map, or (convergence 1)
+                    // just behind the bubble.
+                    let (ex, ey) =
+                        if conv >= 1.0 { (bx, by) } else { (bx * conv + (u * 0.5 + 0.5) * w * (1.0 - conv), by * conv + (v * 0.5 + 0.5) * h * (1.0 - conv)) };
+                    let e = env.img.sample_bilinear(ex, ey);
+                    let rim = ((u * u + v * v) as f32).min(1.0);
+                    let k = strength * (0.3 + 0.7 * rim);
+                    [e[0] * k, e[1] * k, e[2] * k, 0.0]
+                });
+            }
+        }
+        // Draft + Flow Map shows the flow map under the bubbles.
+        if let Some(fm) = &self.flow {
+            out.data.par_iter_mut().zip(fm.data.par_iter()).for_each(|(o, f)| {
+                let k = 1.0 - o[3];
+                for c in 0..4 {
+                    o[c] += f[c] * 0.5 * k;
+                }
+            });
+        }
+        Buf { img: out, ..b }
+    }
+}
+
+/// Foam's [`FoamPlan`] for layer geometry `b` (its size; its pixels are not read).
+pub fn foam_full_plan(ctx: &EffectCtx, b: &Buf) -> FoamPlan {
+    let pr = ctx.params;
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let unit = lw * 0.01;
+    let prod = pr.v2("producer/producerPoint");
+    let (psx, psy) = (pr.f("producer/producerXSize") as f32 * lw, pr.f("producer/producerYSize") as f32 * lh);
+    let porient = (pr.f("producer/producerOrientation") as f32).to_radians();
+    let rate = pr.f("producer/productionRate").max(0.0) as f32;
+    let size = pr.f("bubbles/size").max(0.0) as f32;
+    let size_var = pr.f("bubbles/sizeVariance") as f32;
+    let lifespan = pr.f("bubbles/lifespan").max(1.0) as f32;
+    let growth = pr.f("bubbles/growthSpeed").max(0.0001) as f32;
+    // Strength: weaker bubbles tend to pop before their lifespan (at 20 or more every bubble
+    // lives the full lifespan); each bubble gets its own pop age.
+    let frailty = 1.0 - (pr.f("bubbles/strength") as f32 / 20.0).clamp(0.0, 1.0);
+    let init_speed = pr.f("physics/initialSpeed") as f32;
+    let init_dir = (pr.f("physics/initialDirection") as f32).to_radians();
+    let wind = pr.f("physics/windSpeed") as f32;
+    let wind_dir = (pr.f("physics/windDirection") as f32).to_radians();
+    let turb = pr.f("physics/turbulence") as f32;
+    let wobble = pr.f("physics/wobbleAmount").max(0.0) as f32;
+    let repulsion = pr.f("physics/repulsion") as f32;
+    let pop_velocity = pr.f("physics/popVelocity") as f32;
+    let viscosity = pr.f("physics/viscosity").clamp(0.0, 1.0) as f32;
+    let sticky = pr.f("physics/stickiness").clamp(0.0, 1.0) as f32;
+    let universe = pr.f("universeSize").max(0.01) as f32;
+    let seed = (pr.f("randomSeed") as u32).wrapping_mul(0x68e31da4) ^ ctx.seed;
+    let wvec = [wind_dir.sin() * wind * unit, -wind_dir.cos() * wind * unit];
+    // Flow Map: the map layer's first frame, its luminance a height field (Fits the layer or
+    // the whole universe).
+    let flow = pr.get("flowMap/flowMap").and_then(Value::as_layer).and_then(|id| {
+        let host = ctx.env.host?;
+        let me = pr.get(&crate::layer_source_id("flowMap/flowMap")).is_none_or(|v| v.as_enum() != 0);
+        host.layer_at(id, ctx.env.comp_time - ctx.time, me)
+    });
+    let steep = pr.f("flowMap/flowMapSteepness") as f32;
+    let fits_universe = pr.e("flowMap/flowMapFits") == 1;
+    let substeps = match pr.e("flowMap/simulationQuality") {
+        1 => 2,
+        2 => 4,
+        _ => 1,
+    };
+    let height = flow.as_ref().map(|lp| {
+        let img = &lp.buf.img;
+        let pl = Plane::from_image(img, |px| {
+            let (c, a) = unpremul(px);
+            effectcraft_color::luminance(c[0], c[1], c[2]) * a
+        });
+        (pl, lp.buf.scale, lp.buf.offset, lp.size)
+    });
+    let (ux0, uy0) = (-(universe - 1.0) * 0.5 * lw, -(universe - 1.0) * 0.5 * lh);
+    let (ux1, uy1) = (lw - ux0, lh - uy0);
+    // Height at a layer point (0..1).
+    let h_at = |x: f32, y: f32| -> f32 {
+        let Some((pl, s, off, size)) = &height else { return 0.0 };
+        let (fx, fy) = if fits_universe { ((x - ux0) / (ux1 - ux0), (y - uy0) / (uy1 - uy0)) } else { (x / lw, y / lh) };
+        pl.sample(fx as f64 * size[0] * s + off[0], fy as f64 * size[1] * s + off[1])
+    };
+    let mut key = params_key(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: 1.0 }, 5);
+    if let Some((pl, ..)) = &height {
+        key ^= pl.data.iter().step_by(5).fold(0u64, |a, v| a.rotate_left(3) ^ v.to_bits() as u64);
+    }
+    let steps = if ctx.time <= 0.0 { 0 } else { (ctx.time * FOAM_FPS + 1e-6).floor() as u64 };
+    let rad = |q: &FoamBubble| q.size * unit * 3.0 * (q.age * growth).min(1.0);
+    let st = FOAM_CACHE.run(key, steps, FoamState::default, |st, step| {
+        let t = step as f32 / FOAM_FPS as f32;
+        // Births.
+        st.carry += rate;
+        let n = st.carry.floor() as u32;
+        st.carry -= n as f32;
+        for _ in 0..n {
+            if st.b.len() >= 3000 {
+                break;
+            }
+            let id = st.next;
+            st.next = st.next.wrapping_add(1);
+            let (ux, uy) = (hs(id, 1, seed) * 0.5 * psx, hs(id, 2, seed) * 0.5 * psy);
+            let (so, co) = porient.sin_cos();
+            let p = [prod[0] as f32 + ux * co - uy * so, prod[1] as f32 + ux * so + uy * co];
+            let v = [init_dir.sin() * init_speed * unit, -init_dir.cos() * init_speed * unit];
+            let sz = (size * (1.0 + size_var * hs(id, 3, seed))).max(0.01);
+            st.b.push(FoamBubble { p, v, age: 0.0, size: sz, spin: hs(id, 12, seed) * std::f32::consts::PI, id });
+        }
+        for _ in 0..substeps {
+            let k = 1.0 / substeps as f32;
+            // Forces: drift towards the wind, turbulence, viscosity, the flow map's slope.
+            for q in st.b.iter_mut() {
+                let n1 = value_noise(q.p[0] / (lw * 0.15), q.p[1] / (lw * 0.15), t * 0.5, seed) - 0.5;
+                let n2 = value_noise(q.p[0] / (lw * 0.15) + 19.0, q.p[1] / (lw * 0.15), t * 0.5, seed) - 0.5;
+                for c in 0..2 {
+                    q.v[c] += (wvec[c] - q.v[c]) * 0.1 * k;
+                    q.v[c] *= 1.0 - viscosity * 0.5 * k;
+                }
+                q.v[0] += n1 * turb * unit * k;
+                q.v[1] += n2 * turb * unit * k;
+                if height.is_some() && steep != 0.0 {
+                    let e = unit.max(1.0);
+                    let gx = (h_at(q.p[0] + e, q.p[1]) - h_at(q.p[0] - e, q.p[1])) / (2.0 * e);
+                    let gy = (h_at(q.p[0], q.p[1] + e) - h_at(q.p[0], q.p[1] - e)) / (2.0 * e);
+                    // Downhill: from light (high) to dark (low).
+                    q.v[0] -= gx * steep * lw * 0.5 * k;
+                    q.v[1] -= gy * steep * lw * 0.5 * k;
+                }
+                // Physical Orientation: bubbles roll with their sideways motion.
+                q.spin += q.v[0] / (rad(q).max(0.5)) * k;
+            }
+            // Repulsion between overlapping bubbles (grid hashed, deterministic order).
+            if repulsion > 0.0 && st.b.len() > 1 {
+                let maxr = st.b.iter().map(rad).fold(0.0f32, f32::max).max(1.0);
+                let cs = maxr * 2.0;
+                let mut grid: std::collections::HashMap<(i32, i32), Vec<usize>> = std::collections::HashMap::new();
+                for (i, q) in st.b.iter().enumerate() {
+                    grid.entry(((q.p[0] / cs).floor() as i32, (q.p[1] / cs).floor() as i32)).or_default().push(i);
+                }
+                let mut push = vec![[0.0f32; 2]; st.b.len()];
+                for (i, q) in st.b.iter().enumerate() {
+                    let (gx, gy) = ((q.p[0] / cs).floor() as i32, (q.p[1] / cs).floor() as i32);
+                    for dy in -1..=1 {
+                        for dx in -1..=1 {
+                            let Some(list) = grid.get(&(gx + dx, gy + dy)) else { continue };
+                            for &j in list {
+                                if j <= i {
+                                    continue;
+                                }
+                                let o = &st.b[j];
+                                let (ddx, ddy) = (o.p[0] - q.p[0], o.p[1] - q.p[1]);
+                                let d = (ddx * ddx + ddy * ddy).sqrt().max(1e-4);
+                                let overlap = rad(q) + rad(o) - d;
+                                if overlap > 0.0 {
+                                    let f = overlap * 0.5 * repulsion.min(4.0) * (1.0 - sticky * 0.5) / d * k;
+                                    push[i][0] -= ddx * f;
+                                    push[i][1] -= ddy * f;
+                                    push[j][0] += ddx * f;
+                                    push[j][1] += ddy * f;
+                                }
+                            }
+                        }
+                    }
+                }
+                for (q, d) in st.b.iter_mut().zip(&push) {
+                    q.p[0] += d[0].clamp(-maxr, maxr);
+                    q.p[1] += d[1].clamp(-maxr, maxr);
+                }
+            }
+            for q in st.b.iter_mut() {
+                q.p[0] += q.v[0] * k;
+                q.p[1] += q.v[1] * k;
+            }
+        }
+        for q in st.b.iter_mut() {
+            q.age += 1.0;
+        }
+        // Pops: bubbles past their pop age burst, pushing their neighbours away.
+        let popped: Vec<([f32; 2], f32)> = st.b.iter().filter(|q| q.age >= foam_pop_age(q.id, lifespan, frailty, seed)).map(|q| (q.p, rad(q))).collect();
+        if pop_velocity != 0.0 {
+            for (pp, pr_) in &popped {
+                let reach = (pr_ * 3.0).max(unit);
+                for q in st.b.iter_mut() {
+                    let (dx, dy) = (q.p[0] - pp[0], q.p[1] - pp[1]);
+                    let d = (dx * dx + dy * dy).sqrt();
+                    if d > 1e-4 && d < reach {
+                        let f = pop_velocity * unit * (1.0 - d / reach) / d;
+                        q.v[0] += dx * f;
+                        q.v[1] += dy * f;
+                    }
+                }
+            }
+        }
+        st.b.retain(|q| q.age < foam_pop_age(q.id, lifespan, frailty, seed) && q.p[0] > ux0 && q.p[0] < ux1 && q.p[1] > uy0 && q.p[1] < uy1);
+    });
+    let view = pr.e("view");
+    let zoom = pr.f("zoom").max(0.01) as f32;
+    let zoom_producer = pr.b("producer/zoomProducerPoint");
+    let texture = pr.e("rendering/bubbleTexture");
+    let orient = pr.e("rendering/bubbleOrientation");
+    let blend = pr.e("rendering/blendMode");
+    let s = b.scale as f32;
+    // Zoom centres on the layer, or on the producer with Zoom Producer Point.
+    let (cx, cy) = if zoom_producer { (prod[0] as f32, prod[1] as f32) } else { (lw * 0.5, lh * 0.5) };
+    let mut order: Vec<&FoamBubble> = st.b.iter().collect();
+    if blend == 2 {
+        // Solid New on Top: oldest first.
+        order.sort_by(|a, c| c.age.total_cmp(&a.age).then(a.id.cmp(&c.id)));
+    } else if blend == 1 {
+        order.sort_by(|a, c| a.age.total_cmp(&c.age).then(a.id.cmp(&c.id)));
+    }
+    // Where a bubble is drawn: buffer centre, radius, rotation (radians).
+    let place = |q: &FoamBubble| {
+        let wob = if wobble > 0.0 { 1.0 + wobble * 0.15 * ((q.age * 0.35) + hs(q.id, 13, seed) * 6.0).sin() } else { 1.0 };
+        let r = rad(q) * wob * zoom * s;
+        let (bx, by) = b.to_px([(cx + (q.p[0] - cx) * zoom) as f64, (cy + (q.p[1] - cy) * zoom) as f64]);
+        let rot = match orient {
+            1 => q.spin,
+            2 => q.v[1].atan2(q.v[0]),
+            _ => 0.0,
+        };
+        (bx, by, r, rot)
+    };
+    let user_tex = (view == 2 && texture == 5).then(|| ctx.layer_param("rendering/bubbleTextureLayer", true)).flatten();
+    let sprites: Vec<Sprite> = order
+        .iter()
+        .filter(|_| user_tex.is_none())
+        .map(|q| {
+            let (bx, by, r, rot) = place(q);
+            let fade = ((foam_pop_age(q.id, lifespan, frailty, seed) - q.age) / 5.0).clamp(0.0, 1.0);
+            // Draft and Draft + Flow Map show the wireframe-style bubbles.
+            let mut sp = if view != 2 {
+                Sprite::new(bx as f32, by as f32, r, [0.55, 0.75, 1.0, fade], Shape::Bubble)
+            } else {
+                let (c, shape) = match texture {
+                    1 => ([0.95, 0.95, 0.92], Shape::Faded),
+                    2 => ([1.0, 0.6, 0.8], Shape::Bubble),
+                    3 => ([0.8, 0.85, 0.75], Shape::Bubble),
+                    4 => ([0.97, 0.97, 0.95], Shape::Sphere),
+                    _ => ([1.0, 1.0, 1.0], Shape::Bubble),
+                };
+                Sprite::new(bx as f32, by as f32, r, [c[0], c[1], c[2], fade], shape)
+            };
+            sp.rot = rot;
+            sp
+        })
+        .collect();
+    let acc = if blend == 0 && view == 2 { Acc::Add } else { Acc::Over };
+    let disc = |q: &&FoamBubble| {
+        let (x, y, r, rot) = place(q);
+        let fade = ((foam_pop_age(q.id, lifespan, frailty, seed) - q.age) / 5.0).clamp(0.0, 1.0);
+        FoamDisc { x, y, r, rot, fade }
+    };
+    let user = user_tex.map(|tex| (tex, order.iter().map(disc).collect()));
+    let strength = pr.f("rendering/reflectionStrength").clamp(0.0, 1.0) as f32;
+    let env = if view == 2
+        && strength > 0.0
+        && let Some(env) = ctx.layer_param("rendering/environmentMap", true)
+    {
+        Some(FoamEnv {
+            img: crate::util::fit_layer(ctx, b, &env, true),
+            conv: pr.f("rendering/reflectionConvergence").clamp(0.0, 1.0),
+            strength,
+            discs: order.iter().map(disc).collect(),
+        })
+    } else {
+        None
+    };
+    let flow = if view == 1
+        && let Some(lp) = &flow
+    {
+        Some(crate::util::fit_layer(ctx, b, lp, true))
+    } else {
+        None
+    };
+    FoamPlan { sprites: crate::sim::SpritePlan { sprites, tints: vec![], acc, post: crate::sim::Post::Replace }, user, env, flow }
+}
+
+/// Add `f(u, v)` (premultiplied; u, v ∈ −1..1 across the disc) over the disc of radius `r` at
+/// (`x`, `y`) with anti-aliased edges ("over" for opaque texels, additive for alpha 0).
+fn foam_disc(out: &mut Image, x: f64, y: f64, r: f64, f: impl Fn(f64, f64) -> Px) {
+    if r <= 0.0 {
+        return;
+    }
+    let (x0, x1) = ((x - r - 1.0).floor().max(0.0) as i64, (x + r + 1.0).ceil().min(out.width as f64) as i64);
+    let (y0, y1) = ((y - r - 1.0).floor().max(0.0) as i64, (y + r + 1.0).ceil().min(out.height as f64) as i64);
+    for py in y0..y1 {
+        for px in x0..x1 {
+            let (u, v) = ((px as f64 + 0.5 - x) / r, (py as f64 + 0.5 - y) / r);
+            let d = (u * u + v * v).sqrt();
+            let cov = ((1.0 - d) * r + 0.5).clamp(0.0, 1.0) as f32;
+            if cov <= 0.0 {
+                continue;
+            }
+            let s = f(u.clamp(-1.0, 1.0), v.clamp(-1.0, 1.0)).map(|c| c * cov);
+            let o = out.get(px, py);
+            let k = 1.0 - s[3];
+            out.set(px as u32, py as u32, [s[0] + o[0] * k, s[1] + o[1] * k, s[2] + o[2] * k, (s[3] + o[3] * k).min(1.0)]);
+        }
+    }
+}
diff --git a/crates/effects/src/sim2/pieces.rs b/crates/effects/src/sim2/pieces.rs
new file mode 100644
index 000000000..bff5943c0
--- /dev/null
+++ b/crates/effects/src/sim2/pieces.rs
@@ -0,0 +1,277 @@
+use super::shatter::{ShatterPlan, card_dance_plan, shatter_impl};
+use super::{Acc, Buf, EffectCtx, Image, Lighting, Proj, raster, unpremul};
+
+// ------------------------------------------------------------------ 3D pieces
+
+pub(crate) type M3 = [[f64; 3]; 3];
+
+fn mat_mul(a: &M3, b: &M3) -> M3 {
+    std::array::from_fn(|i| std::array::from_fn(|j| (0..3).map(|k| a[i][k] * b[k][j]).sum()))
+}
+
+/// Rotation from Euler angles (radians), applied X then Y then Z.
+pub(super) fn rot_xyz(x: f64, y: f64, z: f64) -> M3 {
+    let (sx, cx) = x.sin_cos();
+    let (sy, cy) = y.sin_cos();
+    let (sz, cz) = z.sin_cos();
+    let rx = [[1.0, 0.0, 0.0], [0.0, cx, -sx], [0.0, sx, cx]];
+    let ry = [[cy, 0.0, sy], [0.0, 1.0, 0.0], [-sy, 0.0, cy]];
+    let rz = [[cz, -sz, 0.0], [sz, cz, 0.0], [0.0, 0.0, 1.0]];
+    mat_mul(&rz, &mat_mul(&ry, &rx))
+}
+
+/// Rotation by `angle` about unit `axis` (Rodrigues).
+pub(crate) fn rot_axis(axis: [f64; 3], angle: f64) -> M3 {
+    let l = (axis[0] * axis[0] + axis[1] * axis[1] + axis[2] * axis[2]).sqrt();
+    if l < 1e-12 || angle == 0.0 {
+        return [[1.0, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]];
+    }
+    let (x, y, z) = (axis[0] / l, axis[1] / l, axis[2] / l);
+    let (s, c) = angle.sin_cos();
+    let t = 1.0 - c;
+    [
+        [t * x * x + c, t * x * y - s * z, t * x * z + s * y],
+        [t * x * y + s * z, t * y * y + c, t * y * z - s * x],
+        [t * x * z - s * y, t * y * z + s * x, t * z * z + c],
+    ]
+}
+
+pub(super) fn inv3(m: &M3) -> Option<M3> {
+    let det = m[0][0] * (m[1][1] * m[2][2] - m[1][2] * m[2][1]) - m[0][1] * (m[1][0] * m[2][2] - m[1][2] * m[2][0])
+        + m[0][2] * (m[1][0] * m[2][1] - m[1][1] * m[2][0]);
+    if det.abs() < 1e-12 {
+        return None;
+    }
+    let d = 1.0 / det;
+    Some([
+        [(m[1][1] * m[2][2] - m[1][2] * m[2][1]) * d, (m[0][2] * m[2][1] - m[0][1] * m[2][2]) * d, (m[0][1] * m[1][2] - m[0][2] * m[1][1]) * d],
+        [(m[1][2] * m[2][0] - m[1][0] * m[2][2]) * d, (m[0][0] * m[2][2] - m[0][2] * m[2][0]) * d, (m[0][2] * m[1][0] - m[0][0] * m[1][2]) * d],
+        [(m[1][0] * m[2][1] - m[1][1] * m[2][0]) * d, (m[0][1] * m[2][0] - m[0][0] * m[2][1]) * d, (m[0][0] * m[1][1] - m[0][1] * m[1][0]) * d],
+    ])
+}
+
+/// Perspective camera looking down +z at the layer plane z = 0, `d` pixels away, centred on
+/// `c` (buffer pixels): screen = c + (P - c) · d / (d + z).
+#[derive(Clone, Copy)]
+pub(super) struct Cam {
+    pub(super) c: [f64; 2],
+    pub(super) d: f64,
+}
+
+impl Cam {
+    fn proj(self) -> Proj {
+        Proj::simple(self.c, self.d)
+    }
+}
+
+/// A planar textured piece ready to draw.
+#[derive(Clone, Copy, Debug)]
+pub struct Piece {
+    /// Screen (buffer px, homogeneous) → piece-local (a, b, w).
+    pub inv: [[f64; 3]; 3],
+    /// Rest centre of the piece in texture pixels.
+    pub c0: [f32; 2],
+    /// Convex polygon (texture pixels), counter-clockwise in y-down space.
+    pub poly: [[f32; 2]; 6],
+    pub n: u8,
+    pub bbox: [f32; 4],
+    pub shade: f32,
+    /// Lighting: colour multiplier and additive specular highlight.
+    pub tint: [f32; 3],
+    pub spec: [f32; 3],
+    pub alpha: f32,
+    /// Flat straight colour instead of the texture.
+    pub flat: Option<[f32; 3]>,
+    /// Facing away from the camera (draw the back texture).
+    pub back: bool,
+    /// Back faces sample their texture mirrored about the piece centre: 0 no, 1 vertically
+    /// (flipped about the X axis), 2 horizontally (about the Y axis).
+    pub back_mirror: u8,
+    depth: f64,
+}
+
+/// A piece texture: the layer itself or another image (buffer-aligned).
+#[derive(Clone, Debug)]
+pub enum PieceTex {
+    Layer,
+    Image(Image),
+}
+
+/// What a piece-drawing effect (Card Dance, Shatter, Card Wipe) draws this frame: pieces sorted
+/// far to near over a transparent frame, textured by `front` (and `back` for pieces facing
+/// away; none = they take `front`).
+#[derive(Clone, Debug)]
+pub struct PiecePlan {
+    pub pieces: Vec<Piece>,
+    pub front: PieceTex,
+    pub back: Option<PieceTex>,
+}
+
+impl PiecePlan {
+    /// Rasterise over a transparent frame of the layer `b`'s size.
+    pub fn finish(&self, mut b: Buf) -> Buf {
+        let mut out = Image::new(b.img.width, b.img.height);
+        let front = match &self.front {
+            PieceTex::Layer => &b.img,
+            PieceTex::Image(i) => i,
+        };
+        let back = self.back.as_ref().map(|t| match t {
+            PieceTex::Layer => &b.img,
+            PieceTex::Image(i) => i,
+        });
+        draw_pieces(&mut out, &self.pieces, front, back);
+        b.img = out;
+        b
+    }
+}
+
+/// The piece plan of Card Dance, Shatter (Rendered view) or Card Wipe for layer `b` (its pixels
+/// may be read: gradient maps and textures default to the layer), `None` for other effects or
+/// views drawn otherwise.
+pub fn piece_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<PiecePlan> {
+    match id {
+        "ec.sim.carddance" => Some(card_dance_plan(ctx, b)),
+        "ec.sim.shatter" if ctx.params.e("view") == 0 => match shatter_impl(ctx, b) {
+            ShatterPlan::Pieces(plan) => Some(plan),
+            ShatterPlan::Wire(_) => None,
+        },
+        "ec.transition.cardwipe" => crate::transition::card_wipe_plan(ctx, b),
+        _ => None,
+    }
+}
+
+impl Piece {
+    /// Place polygon `poly` (texture px, around rest centre `c0`) with rotation `r` and its
+    /// centre at 3D `pos` (buffer px; z away from the camera), seen through `cam`.
+    pub(crate) fn new(poly: &[[f32; 2]], c0: [f32; 2], r: &M3, pos: [f64; 3], cam: impl Into<Proj>) -> Option<Piece> {
+        let cam: Proj = cam.into();
+        let n = poly.len().min(6);
+        if n < 3 {
+            return None;
+        }
+        let m = &cam.m;
+        let row = |i: usize| -> [f64; 3] {
+            [
+                m[i][0] * r[0][0] + m[i][1] * r[1][0] + m[i][2] * r[2][0],
+                m[i][0] * r[0][1] + m[i][1] * r[1][1] + m[i][2] * r[2][1],
+                m[i][0] * pos[0] + m[i][1] * pos[1] + m[i][2] * pos[2] + m[i][3],
+            ]
+        };
+        let hm: M3 = [row(0), row(1), row(2)];
+        let mut bb = [f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY];
+        for v in &poly[..n] {
+            let (a, b) = ((v[0] - c0[0]) as f64, (v[1] - c0[1]) as f64);
+            let w = hm[2][0] * a + hm[2][1] * b + hm[2][2];
+            if w < cam.near {
+                return None;
+            }
+            let sx = ((hm[0][0] * a + hm[0][1] * b + hm[0][2]) / w) as f32;
+            let sy = ((hm[1][0] * a + hm[1][1] * b + hm[1][2]) / w) as f32;
+            bb = [bb[0].min(sx), bb[1].min(sy), bb[2].max(sx), bb[3].max(sy)];
+        }
+        let inv = inv3(&hm)?;
+        let mut pp = [[0.0f32; 2]; 6];
+        pp[..n].copy_from_slice(&poly[..n]);
+        // Normalise winding so "inside" is cross >= 0 for every edge.
+        let area: f32 = (0..n).map(|i| pp[i][0] * pp[(i + 1) % n][1] - pp[(i + 1) % n][0] * pp[i][1]).sum();
+        if area < 0.0 {
+            pp[..n].reverse();
+        }
+        // The front faces -z at rest; it faces the camera when its normal points at the eye.
+        let eye = cam.eye();
+        let nrm = [-r[0][2], -r[1][2], -r[2][2]];
+        let to_eye = [eye[0] - pos[0], eye[1] - pos[1], eye[2] - pos[2]];
+        let facing = nrm[0] * to_eye[0] + nrm[1] * to_eye[1] + nrm[2] * to_eye[2];
+        let depth = hm[2][2];
+        Some(Piece {
+            inv,
+            c0,
+            poly: pp,
+            n: n as u8,
+            bbox: [bb[0] - 1.0, bb[1] - 1.0, bb[2] + 1.0, bb[3] + 1.0],
+            shade: 1.0,
+            tint: [1.0; 3],
+            spec: [0.0; 3],
+            alpha: 1.0,
+            flat: None,
+            back: facing < 0.0,
+            back_mirror: 0,
+            depth,
+        })
+    }
+
+    /// Lambert factor of the piece normal against a light shining along +z.
+    pub(super) fn facing(r: &M3) -> f32 {
+        r[2][2].abs() as f32
+    }
+
+    /// Light the piece (rotation `r`, centre `pos`) with Lighting / Material.
+    pub(crate) fn light(&mut self, l: &Lighting, r: &M3, pos: [f64; 3], eye: [f64; 3]) {
+        let (t, s) = l.shade([-r[0][2], -r[1][2], -r[2][2]], pos, eye);
+        self.tint = t;
+        self.spec = s;
+    }
+}
+
+impl From<Cam> for Proj {
+    fn from(c: Cam) -> Proj {
+        c.proj()
+    }
+}
+
+/// Draw pieces (already sorted far → near) over `out`.
+pub(crate) fn draw_pieces(out: &mut Image, pieces: &[Piece], front: &Image, back: Option<&Image>) {
+    raster(
+        out,
+        pieces,
+        |q| Some(q.bbox),
+        |q, x, y| {
+            let (xf, yf) = (x as f64, y as f64);
+            let m = &q.inv;
+            let w = m[2][0] * xf + m[2][1] * yf + m[2][2];
+            if w.abs() < 1e-12 {
+                return None;
+            }
+            let u = ((m[0][0] * xf + m[0][1] * yf + m[0][2]) / w) as f32 + q.c0[0];
+            let v = ((m[1][0] * xf + m[1][1] * yf + m[1][2]) / w) as f32 + q.c0[1];
+            let n = q.n as usize;
+            let mut md = f32::INFINITY;
+            for i in 0..n {
+                let a = q.poly[i];
+                let b = q.poly[(i + 1) % n];
+                let (ex, ey) = (b[0] - a[0], b[1] - a[1]);
+                let l = (ex * ex + ey * ey).sqrt().max(1e-6);
+                md = md.min((ex * (v - a[1]) - ey * (u - a[0])) / l);
+            }
+            // Coverage extends half a pixel past the edge so abutting pieces leave no seams.
+            let cov = (md + 1.0).clamp(0.0, 1.0);
+            if cov <= 0.0 {
+                return None;
+            }
+            let (c, a) = match q.flat {
+                Some(c) => (c, 1.0),
+                None => {
+                    let tex = if q.back { back.unwrap_or(front) } else { front };
+                    let (u, v) = match (q.back, q.back_mirror) {
+                        (true, 1) => (u, 2.0 * q.c0[1] - v),
+                        (true, 2) => (2.0 * q.c0[0] - u, v),
+                        _ => (u, v),
+                    };
+                    unpremul(tex.sample_bilinear(u as f64, v as f64))
+                }
+            };
+            let a = a * cov * q.alpha;
+            if a <= 1e-6 {
+                return None;
+            }
+            let k = q.shade;
+            let o: [f32; 3] = std::array::from_fn(|i| c[i] * k * q.tint[i] + q.spec[i]);
+            Some([o[0] * a, o[1] * a, o[2] * a, a])
+        },
+        Acc::Over,
+    );
+}
+
+pub(crate) fn sort_far_first(pieces: &mut [Piece]) {
+    pieces.sort_by(|a, b| b.depth.total_cmp(&a.depth));
+}
diff --git a/crates/effects/src/sim2/pixels.rs b/crates/effects/src/sim2/pixels.rs
new file mode 100644
index 000000000..2cda428db
--- /dev/null
+++ b/crates/effects/src/sim2/pixels.rs
@@ -0,0 +1,228 @@
+use super::pieces::{Cam, Piece, PiecePlan, PieceTex, rot_axis, sort_far_first};
+use super::shatter::{ShatterPlan, shatter_impl};
+use super::{Acc, Buf, EffectCtx, IntoParallelIterator, ParallelIterator, Post, Shape, Sprite, SpritePlan, h, hs, unpremul};
+
+// ------------------------------------------------------------------ CC Ball Action
+
+pub(super) fn ball_action(ctx: &EffectCtx, b: Buf) -> Buf {
+    ball_action_plan(ctx, &b).finish(b)
+}
+
+/// CC Ball Action's balls (far to near), coloured by the layer's pixels.
+fn ball_action_plan(ctx: &EffectCtx, b: &Buf) -> SpritePlan {
+    let pr = ctx.params;
+    let scatter = pr.f("scatter") as f32;
+    let axis = pr.e("rotationAxis");
+    let rot = pr.f("rotation").to_radians();
+    let twist_prop = pr.e("twistProperty");
+    let twist = pr.f("twistAngle").to_radians();
+    let spacing = pr.f("gridSpacing").max(1.0) as f32;
+    let size = pr.f("ballSize") as f32 / 100.0;
+    let instab = pr.f("instabilityState").to_radians() as f32;
+    let seed = ctx.seed.wrapping_mul(0x2545f491);
+    let (lw, lh) = (ctx.layer_size[0] as f32, ctx.layer_size[1] as f32);
+    let s = b.scale as f32;
+    let nx = (lw / spacing).ceil().max(1.0) as u32;
+    let ny = (lh / spacing).ceil().max(1.0) as u32;
+    let d = 2.0 * lw.max(lh) as f64;
+    let (cx, cy) = (lw as f64 * 0.5, lh as f64 * 0.5);
+    let src = &b.img;
+    let ax: [f64; 3] = match axis {
+        0 => [1.0, 0.0, 0.0],
+        1 => [0.0, 1.0, 0.0],
+        2 => [0.0, 0.0, 1.0],
+        3 => [1.0, 1.0, 0.0],
+        4 => [1.0, 0.0, 1.0],
+        5 => [0.0, 1.0, 1.0],
+        _ => [1.0, 1.0, 1.0],
+    };
+    let maxr = ((lw * lw + lh * lh).sqrt() * 0.5).max(1.0);
+    let mut balls: Vec<(f64, Sprite)> = (0..nx * ny)
+        .into_par_iter()
+        .filter_map(|i| {
+            let gx = (i % nx) as f32 * spacing + spacing * 0.5;
+            let gy = (i / nx) as f32 * spacing + spacing * 0.5;
+            let (sx, sy) = b.to_px([gx as f64, gy as f64]);
+            let (c, a) = unpremul(src.sample_bilinear(sx, sy));
+            if a <= 0.0 || size <= 0.0 {
+                return None;
+            }
+            let tp = match twist_prop {
+                0 => gx / lw.max(1.0),
+                1 => gy / lh.max(1.0),
+                2 => ((gx - cx as f32).hypot(gy - cy as f32)) / maxr,
+                _ => crate::util::rgb3([c[0], c[1], c[2], 0.0]).iter().sum::<f32>() / 3.0,
+            } as f64;
+            let ang = rot + twist * tp;
+            // Scatter: random 3D offsets whose direction drifts with the instability state.
+            let ph = h(i, 1, seed) * std::f32::consts::TAU + instab;
+            let sc = scatter * h(i, 2, seed);
+            let off = [(sc * ph.cos()) as f64, (sc * ph.sin()) as f64, (scatter * hs(i, 3, seed)) as f64];
+            let p0 = [gx as f64 - cx + off[0], gy as f64 - cy + off[1], off[2]];
+            let m = rot_axis(ax, ang);
+            let q: [f64; 3] = std::array::from_fn(|k| m[k][0] * p0[0] + m[k][1] * p0[1] + m[k][2] * p0[2]);
+            if d + q[2] <= d * 0.05 {
+                return None;
+            }
+            let persp = d / (d + q[2]);
+            let (bx, by) = b.to_px([cx + q[0] * persp, cy + q[1] * persp]);
+            let r = spacing * 0.5 * size * persp as f32 * s;
+            Some((q[2], Sprite::new(bx as f32, by as f32, r, [c[0], c[1], c[2], a], Shape::Sphere)))
+        })
+        .collect();
+    balls.sort_by(|a, b| b.0.total_cmp(&a.0));
+    let sprites: Vec<Sprite> = balls.into_iter().map(|(_, s)| s).collect();
+    SpritePlan { sprites, tints: vec![], acc: Acc::Over, post: Post::Replace }
+}
+
+// ------------------------------------------------------------------ CC Pixel Polly
+
+pub(super) fn pixel_polly(ctx: &EffectCtx, b: Buf) -> Buf {
+    match pixel_polly_plan(ctx, &b) {
+        Some(plan) => plan.finish(b),
+        None => b,
+    }
+}
+
+/// CC Pixel Polly's pieces, `None` before Start Time (the layer as is).
+fn pixel_polly_plan(ctx: &EffectCtx, b: &Buf) -> Option<PiecePlan> {
+    let pr = ctx.params;
+    let t = ctx.time - pr.f("startTime");
+    if t <= 0.0 {
+        return None;
+    }
+    let force = pr.f("force");
+    let gravity = pr.f("gravity");
+    let spin = pr.f("spinning").to_radians();
+    let fc = pr.v2("forceCenter");
+    let dir_rand = pr.f("directionRandomness") / 100.0;
+    let spd_rand = pr.f("speedRandomness") / 100.0;
+    let g = pr.f("gridSpacing").max(1.0);
+    let object = pr.e("object");
+    let depth_sort = pr.b("enableDepthSort");
+    let seed = ctx.seed.wrapping_mul(0x632be5ab);
+    let [lw, lh] = ctx.layer_size;
+    let s = b.scale;
+    let cam = Cam { c: [b.offset[0] + lw * 0.5 * s, b.offset[1] + lh * 0.5 * s], d: 2.0 * lw.max(lh) * s };
+    let nx = (lw / g).ceil().max(1.0) as u32;
+    let ny = (lh / g).ceil().max(1.0) as u32;
+    let tri = object <= 1;
+    let textured = object == 1 || object == 3;
+    let maxd = lw.max(lh);
+    let src = &b.img;
+    let per = if tri { 2 } else { 1 };
+    let mut pieces: Vec<Piece> = (0..nx * ny * per)
+        .into_par_iter()
+        .filter_map(|i| {
+            let cell = i / per;
+            let (x0, y0) = ((cell % nx) as f64 * g, (cell / nx) as f64 * g);
+            let poly: Vec<[f64; 2]> = if !tri {
+                vec![[x0, y0], [x0 + g, y0], [x0 + g, y0 + g], [x0, y0 + g]]
+            } else if i % 2 == 0 {
+                vec![[x0, y0], [x0 + g, y0], [x0, y0 + g]]
+            } else {
+                vec![[x0 + g, y0], [x0 + g, y0 + g], [x0, y0 + g]]
+            };
+            let c = [poly.iter().map(|v| v[0]).sum::<f64>() / poly.len() as f64, poly.iter().map(|v| v[1]).sum::<f64>() / poly.len() as f64];
+            let (dx, dy) = (c[0] - fc[0], c[1] - fc[1]);
+            let dist = (dx * dx + dy * dy).sqrt().max(1e-6);
+            let ang = dy.atan2(dx) + dir_rand * std::f64::consts::PI * hs(i, 1, seed) as f64;
+            let speed = force / 100.0 * 0.6 * maxd / (1.0 + dist / (0.5 * maxd)) * (1.0 + spd_rand * hs(i, 2, seed) as f64);
+            let vz = -speed * 0.5 * h(i, 3, seed) as f64;
+            let pos = [c[0] + ang.cos() * speed * t, c[1] + ang.sin() * speed * t + 0.5 * gravity * 0.5 * lh * t * t, vz * t];
+            let axis = [hs(i, 4, seed) as f64, hs(i, 5, seed) as f64, hs(i, 6, seed) as f64];
+            let r = rot_axis(axis, t * (std::f64::consts::PI * h(i, 7, seed) as f64 + spin));
+            let tex: Vec<[f32; 2]> = poly.iter().map(|v| [(v[0] * s + b.offset[0]) as f32, (v[1] * s + b.offset[1]) as f32]).collect();
+            let c0 = [(c[0] * s + b.offset[0]) as f32, (c[1] * s + b.offset[1]) as f32];
+            let posb = [pos[0] * s + b.offset[0], pos[1] * s + b.offset[1], pos[2] * s];
+            let mut pc = Piece::new(&tex, c0, &r, posb, cam)?;
+            pc.shade = 0.35 + 0.65 * Piece::facing(&r);
+            if !textured {
+                let (cc, a) = unpremul(src.sample_bilinear(c0[0] as f64, c0[1] as f64));
+                if a <= 0.0 {
+                    return None;
+                }
+                pc.flat = Some(cc);
+                pc.alpha = a;
+            }
+            Some(pc)
+        })
+        .collect();
+    if depth_sort {
+        sort_far_first(&mut pieces);
+    }
+    Some(PiecePlan { pieces, front: PieceTex::Layer, back: None })
+}
+
+// ------------------------------------------------------------------ CC Scatterize
+
+pub(super) fn scatterize(ctx: &EffectCtx, b: Buf) -> Buf {
+    match scatterize_plan(ctx, &b) {
+        Some(plan) => plan.finish(b),
+        None => b,
+    }
+}
+
+/// CC Scatterize's pixel dots, `None` when nothing moves (the layer as is).
+fn scatterize_plan(ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
+    let pr = ctx.params;
+    let scatter = pr.f("scatter") as f32;
+    let right = pr.f("rightTwist").to_radians();
+    let left = pr.f("leftTwist").to_radians();
+    if scatter == 0.0 && right == 0.0 && left == 0.0 {
+        return None;
+    }
+    let add = pr.e("transferMode") == 1;
+    let seed = ctx.seed.wrapping_mul(0x7feb352d);
+    let s = b.scale;
+    let (w, hh) = (b.img.width, b.img.height);
+    let (cx, cy) = (b.offset[0] + ctx.layer_size[0] * 0.5 * s, b.offset[1] + ctx.layer_size[1] * 0.5 * s);
+    let half = (ctx.layer_size[0] * 0.5 * s).max(1.0);
+    let d = 2.0 * ctx.layer_size[0].max(ctx.layer_size[1]) * s;
+    let src = &b.img;
+    let sprites: Vec<Sprite> = (0..w * hh)
+        .into_par_iter()
+        .filter_map(|i| {
+            let px = src.data[i as usize];
+            if px[3] <= 0.0 {
+                return None;
+            }
+            let (x, y) = ((i % w) as f64 + 0.5, (i / w) as f64 + 0.5);
+            // Twist about the horizontal axis through the centre, growing towards each side.
+            let k = ((x - cx) / half).abs().min(1.0);
+            let ang = if x < cx { left } else { right } * k;
+            let (sa, ca) = ang.sin_cos();
+            let (yy, zz) = ((y - cy) * ca, (y - cy) * sa);
+            let persp = d / (d + zz).max(d * 0.05);
+            let jx = hs(i, 1, seed) * scatter * s as f32;
+            let jy = hs(i, 2, seed) * scatter * s as f32;
+            let sx = cx + (x - cx) * persp + jx as f64;
+            let sy = cy + yy * persp + jy as f64;
+            let (c, a) = unpremul(px);
+            Some(Sprite::new(sx as f32, sy as f32, 0.6 * persp as f32, [c[0], c[1], c[2], a], Shape::Disc))
+        })
+        .collect();
+    Some(SpritePlan { sprites, tints: vec![], acc: if add { Acc::Add } else { Acc::Over }, post: Post::Replace })
+}
+
+/// What a particle effect that reads the layer's pixels draws this frame (CC Ball Action, CC
+/// Pixel Polly, CC Scatterize, Shatter's wireframe views), for layer `b`; `None` for other
+/// effects or a frame showing the layer as is.
+pub enum PixelPlan {
+    Sprites(SpritePlan),
+    Pieces(PiecePlan),
+}
+
+/// The [`PixelPlan`] of effect `id` for layer `b` (its pixels are read).
+pub fn pixel_plan(id: &str, ctx: &EffectCtx, b: &Buf) -> Option<PixelPlan> {
+    match id {
+        "ec.sim.ccballaction" => Some(PixelPlan::Sprites(ball_action_plan(ctx, b))),
+        "ec.sim.ccpixelpolly" => pixel_polly_plan(ctx, b).map(PixelPlan::Pieces),
+        "ec.sim.ccscatterize" => scatterize_plan(ctx, b).map(PixelPlan::Sprites),
+        "ec.sim.shatter" => Some(match shatter_impl(ctx, b) {
+            ShatterPlan::Pieces(plan) => PixelPlan::Pieces(plan),
+            ShatterPlan::Wire(plan) => PixelPlan::Sprites(plan),
+        }),
+        _ => None,
+    }
+}
diff --git a/crates/effects/src/sim2/registry.rs b/crates/effects/src/sim2/registry.rs
new file mode 100644
index 000000000..dc64b7097
--- /dev/null
+++ b/crates/effects/src/sim2/registry.rs
@@ -0,0 +1,288 @@
+use super::foam::{FOAM_TEXTURES, foam};
+use super::pixels::{ball_action, pixel_polly, scatterize};
+use super::shatter::{CD_PROPS, CD_SOURCES, SHATTER_PATTERNS, SHATTER_TEXTURE_MODES, card_dance, shatter};
+use super::surfaces::{caustics, wave_world};
+use super::{EffectSpec, ParamUi, Value, col, num, p, pct, popup, pt, slider, spec};
+
+// ------------------------------------------------------------------ specs
+
+fn producer_params(k: u32, amp: f64, pos: (f64, f64)) -> Vec<crate::ParamSpec> {
+    let ids: [&'static str; 8] = match k {
+        1 => [
+            "producer1/producer1Type",
+            "producer1/producer1Position",
+            "producer1/producer1Length",
+            "producer1/producer1Width",
+            "producer1/producer1Angle",
+            "producer1/producer1Amplitude",
+            "producer1/producer1Frequency",
+            "producer1/producer1Phase",
+        ],
+        _ => [
+            "producer2/producer2Type",
+            "producer2/producer2Position",
+            "producer2/producer2Length",
+            "producer2/producer2Width",
+            "producer2/producer2Angle",
+            "producer2/producer2Amplitude",
+            "producer2/producer2Frequency",
+            "producer2/producer2Phase",
+        ],
+    };
+    vec![
+        p(ids[0], "Type", Value::Enum(0), popup(&["Ring", "Line"])),
+        p(ids[1], "Position", pt(pos.0, pos.1), ParamUi::Point),
+        p(ids[2], "Height/Length", num(0.1), slider(0.0, 2.0, 0.0, 1.0, 3)),
+        p(ids[3], "Width", num(0.1), slider(0.0, 2.0, 0.0, 1.0, 3)),
+        p(ids[4], "Angle", num(0.0), ParamUi::Angle),
+        p(ids[5], "Amplitude", num(amp), slider(-5.0, 5.0, -1.0, 1.0, 3)),
+        p(ids[6], "Frequency", num(1.0), slider(0.0, 30.0, 0.0, 5.0, 3)),
+        p(ids[7], "Phase", num(0.0), ParamUi::Angle),
+    ]
+}
+
+fn card_dance_params() -> Vec<crate::ParamSpec> {
+    let mut v = vec![
+        p("rowsColumns", "Rows & Columns", Value::Enum(0), popup(&["Independent", "Columns Follows Rows"])),
+        p("rows", "Rows", num(10.0), slider(1.0, 1000.0, 1.0, 100.0, 0)),
+        p("columns", "Columns", num(10.0), slider(1.0, 1000.0, 1.0, 100.0, 0)),
+        p("backLayer", "Back Layer", Value::Layer(None), ParamUi::Layer),
+        p("gradientLayer1", "Gradient Layer 1", Value::Layer(None), ParamUi::Layer),
+        p("gradientLayer2", "Gradient Layer 2", Value::Layer(None), ParamUi::Layer),
+    ];
+    let names: [[&'static str; 4]; 8] = [
+        ["xPosition/xPosSource", "xPosition/xPosMultiplier", "xPosition/xPosOffset", "X Position"],
+        ["yPosition/yPosSource", "yPosition/yPosMultiplier", "yPosition/yPosOffset", "Y Position"],
+        ["zPosition/zPosSource", "zPosition/zPosMultiplier", "zPosition/zPosOffset", "Z Position"],
+        ["xRotation/xRotSource", "xRotation/xRotMultiplier", "xRotation/xRotOffset", "X Rotation"],
+        ["yRotation/yRotSource", "yRotation/yRotMultiplier", "yRotation/yRotOffset", "Y Rotation"],
+        ["zRotation/zRotSource", "zRotation/zRotMultiplier", "zRotation/zRotOffset", "Z Rotation"],
+        ["xScale/xScaleSource", "xScale/xScaleMultiplier", "xScale/xScaleOffset", "X Scale"],
+        ["yScale/yScaleSource", "yScale/yScaleMultiplier", "yScale/yScaleOffset", "Y Scale"],
+    ];
+    debug_assert_eq!(names.len(), CD_PROPS.len());
+    for (i, n) in names.iter().enumerate() {
+        let rot = (3..6).contains(&i);
+        let scale = i >= 6;
+        let (lo, hi) = if rot { (-3600.0, 3600.0) } else { (-100.0, 100.0) };
+        v.push(p(n[0], "Source", Value::Enum(0), popup(CD_SOURCES)));
+        v.push(p(n[1], "Multiplier", num(0.0), slider(lo, hi, if rot { -360.0 } else { -10.0 }, if rot { 360.0 } else { 10.0 }, 2)));
+        v.push(p(n[2], "Offset", num(if scale { 1.0 } else { 0.0 }), slider(lo, hi, if rot { -360.0 } else { -10.0 }, if rot { 360.0 } else { 10.0 }, 2)));
+    }
+    v.extend(crate::card3d::camera_params(2.0));
+    v.extend(crate::card3d::lighting_params(1.0, 0.25));
+    v.extend(crate::card3d::material_params(0.75));
+    v
+}
+
+pub fn specs() -> Vec<EffectSpec> {
+    vec![
+        spec(
+            "ec.sim.ccballaction",
+            "Ball Grid",
+            vec![
+                p("scatter", "Scatter", num(0.0), slider(0.0, 2000.0, 0.0, 300.0, 1)),
+                p("rotationAxis", "Rotation Axis", Value::Enum(0), popup(&["X Axis", "Y Axis", "Z Axis", "XY Axis", "XZ Axis", "YZ Axis", "XYZ Axis"])),
+                p("rotation", "Rotation", num(0.0), ParamUi::Angle),
+                p("twistProperty", "Twist Property", Value::Enum(0), popup(&["X Axis", "Y Axis", "Radius", "Brightness"])),
+                p("twistAngle", "Twist Angle", num(0.0), ParamUi::Angle),
+                p("gridSpacing", "Grid Spacing", num(4.0), slider(1.0, 200.0, 1.0, 50.0, 0)),
+                p("ballSize", "Ball Size", num(40.0), slider(0.0, 400.0, 0.0, 200.0, 1)),
+                p("instabilityState", "Instability State", num(0.0), ParamUi::Angle),
+            ],
+            ball_action,
+        ),
+        spec(
+            "ec.sim.ccpixelpolly",
+            "Pixel Shatter",
+            vec![
+                p("force", "Force", num(100.0), slider(-1000.0, 1000.0, -300.0, 300.0, 1)),
+                p("gravity", "Gravity", num(1.0), slider(-20.0, 20.0, -5.0, 5.0, 2)),
+                p("spinning", "Spinning", num(0.0), ParamUi::Angle),
+                p("forceCenter", "Force Center", pt(0.5, 0.5), ParamUi::Point),
+                p("directionRandomness", "Direction Randomness", num(10.0), pct()),
+                p("speedRandomness", "Speed Randomness", num(10.0), pct()),
+                p("gridSpacing", "Grid Spacing", num(10.0), slider(1.0, 500.0, 2.0, 100.0, 0)),
+                p("object", "Object", Value::Enum(0), popup(&["Polygon", "Textured Polygon", "Square", "Textured Square"])),
+                p("enableDepthSort", "Enable Depth Sort", Value::Bool(true), ParamUi::Checkbox),
+                p("startTime", "Start Time (sec)", num(0.0), slider(-1000.0, 1000.0, 0.0, 10.0, 2)),
+            ],
+            pixel_polly,
+        ),
+        spec(
+            "ec.sim.ccscatterize",
+            "Pixel Scatter",
+            vec![
+                p("scatter", "Scatter", num(0.0), slider(0.0, 1000.0, 0.0, 200.0, 1)),
+                p("rightTwist", "Right Twist", num(0.0), ParamUi::Angle),
+                p("leftTwist", "Left Twist", num(0.0), ParamUi::Angle),
+                p("transferMode", "Transfer Mode", Value::Enum(0), popup(&["Composite", "Add"])),
+            ],
+            scatterize,
+        ),
+        spec("ec.sim.carddance", "Card Dance", card_dance_params(), card_dance),
+        spec(
+            "ec.sim.caustics",
+            "Caustics",
+            vec![
+                p("bottom/bottom", "Bottom", Value::Layer(None), ParamUi::Layer),
+                p("bottom/scaling", "Scaling", num(1.0), slider(0.01, 10.0, 0.1, 3.0, 3)),
+                p("bottom/repeatMode", "Repeat Mode", Value::Enum(2), popup(&["Once", "Tiled", "Reflected"])),
+                p("bottom/bottomSizeDiffers", "If Layer Size Differs", Value::Enum(1), popup(&["Center", "Stretch to Fit"])),
+                p("bottom/blur", "Blur", num(0.0), slider(0.0, 100.0, 0.0, 20.0, 1)),
+                p("water/waterSurface", "Water Surface", Value::Layer(None), ParamUi::Layer),
+                p("water/waveHeight", "Wave Height", num(0.2), slider(-1.0, 1.0, -1.0, 1.0, 3)),
+                p("water/smoothing", "Smoothing", num(5.0), slider(0.0, 100.0, 0.0, 50.0, 1)),
+                p("water/waterDepth", "Water Depth", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("water/refractiveIndex", "Refractive Index", num(1.2), slider(1.0, 3.0, 1.0, 2.0, 3)),
+                p("water/surfaceColor", "Surface Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("water/surfaceOpacity", "Surface Opacity", num(0.3), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("water/causticsStrength", "Caustics Strength", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("sky/sky", "Sky", Value::Layer(None), ParamUi::Layer),
+                p("sky/scaling", "Scaling", num(1.0), slider(0.01, 10.0, 0.1, 3.0, 3)),
+                p("sky/repeatMode", "Repeat Mode", Value::Enum(2), popup(&["Once", "Tiled", "Reflected"])),
+                p("sky/skySizeDiffers", "If Layer Size Differs", Value::Enum(1), popup(&["Center", "Stretch to Fit"])),
+                p("sky/intensity", "Intensity", num(0.3), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("sky/convergence", "Convergence", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("lighting/lightType", "Light Type", Value::Enum(0), popup(&crate::card3d::LIGHT_TYPES)),
+                p("lighting/lightIntensity", "Light Intensity", num(1.0), slider(0.0, 4.0, 0.0, 2.0, 2)),
+                p("lighting/lightColor", "Light Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("lighting/lightPosition", "Light Position", pt(0.0, 0.0), ParamUi::Point),
+                p("lighting/lightHeight", "Light Height", num(1.0), slider(0.0, 10.0, 0.0, 4.0, 2)),
+                p("lighting/ambientLight", "Ambient Light", num(0.35), slider(0.0, 2.0, 0.0, 1.0, 2)),
+                p("material/diffuse", "Diffuse Reflection", num(0.75), slider(0.0, 2.0, 0.0, 1.0, 2)),
+                p("material/specular", "Specular Reflection", num(0.2), slider(0.0, 2.0, 0.0, 1.0, 2)),
+                p("material/highlightSharpness", "Highlight Sharpness", num(15.0), slider(1.0, 100.0, 1.0, 100.0, 1)),
+            ],
+            caustics,
+        ),
+        spec(
+            "ec.sim.waveworld",
+            "Wave World",
+            {
+                let mut v = vec![
+                    p("view", "View", Value::Enum(0), popup(&["Wireframe Preview", "Height Map"])),
+                    p("wireframeControls/horizontalRotation", "Horizontal Rotation", num(0.0), ParamUi::Angle),
+                    p("wireframeControls/verticalRotation", "Vertical Rotation", num(53.0), slider(0.0, 90.0, 0.0, 90.0, 1)),
+                    p("wireframeControls/verticalScale", "Vertical Scale", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 3)),
+                    p("heightMapControls/brightness", "Brightness", num(0.5), slider(-1.0, 2.0, 0.0, 1.0, 3)),
+                    p("heightMapControls/contrast", "Contrast", num(0.75), slider(0.0, 4.0, 0.0, 2.0, 3)),
+                    p("heightMapControls/gamma", "Gamma Adjustment", num(1.0), slider(0.01, 10.0, 0.2, 5.0, 3)),
+                    p("heightMapControls/renderDryAreasAs", "Render Dry Areas As", Value::Enum(0), popup(&["Solid", "Transparent"])),
+                    p("heightMapControls/transparency", "Transparency", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                    p("simulation/gridResolution", "Grid Resolution", num(60.0), slider(1.0, 400.0, 1.0, 200.0, 0)),
+                    p("simulation/gridResDownsamples", "Grid Res Downsamples", Value::Bool(false), ParamUi::Checkbox),
+                    p("simulation/waveSpeed", "Wave Speed", num(0.2), slider(0.0, 5.0, 0.0, 1.0, 3)),
+                    p("simulation/damping", "Damping", num(0.05), slider(0.0, 5.0, 0.0, 1.0, 3)),
+                    p("simulation/reflectEdges", "Reflect Edges", Value::Enum(0), popup(&["None", "Left", "Top", "Right", "Bottom", "All"])),
+                    p("simulation/preRoll", "Pre-roll (seconds)", num(0.0), slider(0.0, 30.0, 0.0, 10.0, 2)),
+                    p("ground/ground", "Ground", Value::Layer(None), ParamUi::Layer),
+                    p("ground/steepness", "Steepness", num(0.25), slider(0.0, 2.0, 0.0, 1.0, 3)),
+                    p("ground/height", "Height", num(0.25), slider(0.0, 2.0, 0.0, 1.0, 3)),
+                    p("ground/waveStrength", "Wave Strength", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                ];
+                v.extend(producer_params(1, 0.5, (0.5, 0.5)));
+                v.extend(producer_params(2, 0.0, (0.25, 0.25)));
+                v
+            },
+            wave_world,
+        ),
+        spec(
+            "ec.sim.shatter",
+            "Shatter",
+            vec![
+                p(
+                    "view",
+                    "View",
+                    Value::Enum(1),
+                    popup(&["Rendered", "Wireframe Front View", "Wireframe", "Wireframe Front View + Forces", "Wireframe + Forces"]),
+                ),
+                p("render", "Render", Value::Enum(0), popup(&["All", "Layer", "Pieces"])),
+                p("shape/pattern", "Pattern", Value::Enum(0), popup(SHATTER_PATTERNS)),
+                p("shape/repetitions", "Repetitions", num(10.0), slider(1.0, 500.0, 1.0, 100.0, 2)),
+                p("shape/direction", "Direction", num(0.0), ParamUi::Angle),
+                p("shape/origin", "Origin", pt(0.5, 0.5), ParamUi::Point),
+                p("shape/customShatterMap", "Custom Shatter Map", Value::Layer(None), ParamUi::Layer),
+                p("shape/whiteTilesFixed", "White Tiles Fixed", Value::Bool(false), ParamUi::Checkbox),
+                p("shape/extrusionDepth", "Extrusion Depth", num(0.05), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("force1/force1Position", "Position", pt(0.5, 0.5), ParamUi::Point),
+                p("force1/force1Depth", "Depth", num(0.1), slider(-1.0, 1.0, -1.0, 1.0, 3)),
+                p("force1/force1Radius", "Radius", num(0.4), slider(0.0, 4.0, 0.0, 2.0, 3)),
+                p("force1/force1Strength", "Strength", num(5.0), slider(-20.0, 20.0, -10.0, 10.0, 2)),
+                p("force2/force2Position", "Position", pt(0.25, 0.25), ParamUi::Point),
+                p("force2/force2Depth", "Depth", num(0.1), slider(-1.0, 1.0, -1.0, 1.0, 3)),
+                p("force2/force2Radius", "Radius", num(0.0), slider(0.0, 4.0, 0.0, 2.0, 3)),
+                p("force2/force2Strength", "Strength", num(5.0), slider(-20.0, 20.0, -10.0, 10.0, 2)),
+                p("physics/rotationSpeed", "Rotation Speed", num(0.2), slider(0.0, 5.0, 0.0, 1.0, 3)),
+                p("physics/tumbleAxis", "Tumble Axis", Value::Enum(0), popup(&["Free", "None", "X", "Y", "Z", "XY", "XZ", "YZ"])),
+                p("physics/randomness", "Randomness", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("physics/viscosity", "Viscosity", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("physics/massVariance", "Mass Variance", num(30.0), pct()),
+                p("physics/gravity", "Gravity", num(3.0), slider(0.0, 100.0, 0.0, 10.0, 2)),
+                p("physics/gravityDirection", "Gravity Direction", num(180.0), ParamUi::Angle),
+                p("physics/gravityInclination", "Gravity Inclination", num(0.0), slider(-90.0, 90.0, -90.0, 90.0, 1)),
+                p("gradient/shatterThreshold", "Shatter Threshold", num(0.0), slider(0.0, 100.0, 0.0, 100.0, 1)),
+                p("gradient/gradientLayer", "Gradient Layer", Value::Layer(None), ParamUi::Layer),
+                p("gradient/invertGradient", "Invert Gradient", Value::Bool(false), ParamUi::Checkbox),
+                p("textures/color", "Color", col(1.0, 1.0, 1.0), ParamUi::Color),
+                p("textures/opacity", "Opacity", num(1.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("textures/frontMode", "Front Mode", Value::Enum(1), popup(&SHATTER_TEXTURE_MODES)),
+                p("textures/sideMode", "Side Mode", Value::Enum(0), popup(&SHATTER_TEXTURE_MODES)),
+                p("textures/backMode", "Back Mode", Value::Enum(1), popup(&SHATTER_TEXTURE_MODES)),
+                p("textures/frontLayer", "Front Layer", Value::Layer(None), ParamUi::Layer),
+                p("textures/sideLayer", "Side Layer", Value::Layer(None), ParamUi::Layer),
+                p("textures/backLayer", "Back Layer", Value::Layer(None), ParamUi::Layer),
+            ]
+            .into_iter()
+            .chain(crate::card3d::camera_params(4.0))
+            .chain(crate::card3d::lighting_params(1.0, 0.25))
+            .chain(crate::card3d::material_params(0.75))
+            .chain([p("randomSeed", "Random Seed", num(0.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0))])
+            .collect(),
+            shatter,
+        ),
+        spec(
+            "ec.sim.foam",
+            "Foam",
+            vec![
+                p("view", "View", Value::Enum(0), popup(&["Draft", "Draft + Flow Map", "Rendered"])),
+                p("producer/producerPoint", "Producer Point", pt(0.5, 0.5), ParamUi::Point),
+                p("producer/producerXSize", "Producer X Size", num(0.05), slider(0.0, 2.0, 0.0, 1.0, 3)),
+                p("producer/producerYSize", "Producer Y Size", num(0.05), slider(0.0, 2.0, 0.0, 1.0, 3)),
+                p("producer/producerOrientation", "Producer Orientation", num(0.0), ParamUi::Angle),
+                p("producer/zoomProducerPoint", "Zoom Producer Point", Value::Bool(false), ParamUi::Checkbox),
+                p("producer/productionRate", "Production Rate", num(1.0), slider(0.0, 50.0, 0.0, 10.0, 3)),
+                p("bubbles/size", "Size", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 3)),
+                p("bubbles/sizeVariance", "Size Variance", num(0.5), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("bubbles/lifespan", "Lifespan", num(300.0), slider(1.0, 30_000.0, 1.0, 1000.0, 1)),
+                p("bubbles/growthSpeed", "Bubble Growth Speed", num(0.1), slider(0.0001, 10.0, 0.0001, 1.0, 3)),
+                p("bubbles/strength", "Strength", num(10.0), slider(0.0, 100.0, 0.0, 20.0, 2)),
+                p("physics/initialSpeed", "Initial Speed", num(0.0), slider(-100.0, 100.0, -10.0, 10.0, 3)),
+                p("physics/initialDirection", "Initial Direction", num(0.0), ParamUi::Angle),
+                p("physics/windSpeed", "Wind Speed", num(0.5), slider(-100.0, 100.0, -10.0, 10.0, 3)),
+                p("physics/windDirection", "Wind Direction", num(90.0), ParamUi::Angle),
+                p("physics/turbulence", "Turbulence", num(0.5), slider(0.0, 10.0, 0.0, 2.0, 3)),
+                p("physics/wobbleAmount", "Wobble Amount", num(0.05), slider(0.0, 10.0, 0.0, 2.0, 3)),
+                p("physics/repulsion", "Repulsion", num(1.0), slider(0.0, 10.0, 0.0, 2.0, 3)),
+                p("physics/popVelocity", "Pop Velocity", num(1.0), slider(-100.0, 100.0, -10.0, 10.0, 3)),
+                p("physics/viscosity", "Viscosity", num(0.1), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("physics/stickiness", "Stickiness", num(0.75), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("zoom", "Zoom", num(1.0), slider(0.01, 50.0, 0.1, 5.0, 3)),
+                p("universeSize", "Universe Size", num(1.0), slider(0.01, 10.0, 0.5, 3.0, 3)),
+                p("rendering/blendMode", "Blend Mode", Value::Enum(0), popup(&["Transparent", "Solid Old on Top", "Solid New on Top"])),
+                p("rendering/bubbleTexture", "Bubble Texture", Value::Enum(0), popup(&FOAM_TEXTURES)),
+                p("rendering/bubbleTextureLayer", "Bubble Texture Layer", Value::Layer(None), ParamUi::Layer),
+                p("rendering/bubbleOrientation", "Bubble Orientation", Value::Enum(0), popup(&["Fixed", "Physical Orientation", "Bubble Velocity"])),
+                p("rendering/environmentMap", "Environment Map", Value::Layer(None), ParamUi::Layer),
+                p("rendering/reflectionStrength", "Reflection Strength", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("rendering/reflectionConvergence", "Reflection Convergence", num(0.0), slider(0.0, 1.0, 0.0, 1.0, 3)),
+                p("flowMap/flowMap", "Flow Map", Value::Layer(None), ParamUi::Layer),
+                p("flowMap/flowMapSteepness", "Flow Map Steepness", num(0.05), slider(-100.0, 100.0, -1.0, 1.0, 3)),
+                p("flowMap/flowMapFits", "Flow Map Fits", Value::Enum(0), popup(&["Background", "Universe"])),
+                p("flowMap/simulationQuality", "Simulation Quality", Value::Enum(0), popup(&["Normal", "High", "Intense"])),
+                p("randomSeed", "Random Seed", num(1.0), slider(0.0, 10_000.0, 0.0, 1000.0, 0)),
+            ],
+            foam,
+        ),
+    ]
+}
diff --git a/crates/effects/src/sim2/shatter.rs b/crates/effects/src/sim2/shatter.rs
new file mode 100644
index 000000000..844fbb4b3
--- /dev/null
+++ b/crates/effects/src/sim2/shatter.rs
@@ -0,0 +1,484 @@
+use super::pieces::{M3, Piece, PiecePlan, PieceTex, inv3, rot_axis, rot_xyz, sort_far_first};
+use super::{
+    Acc, Buf, EffectCtx, Image, IndexedParallelIterator, IntoParallelIterator, IntoParallelRefIterator, Lighting, ParallelIterator, Post, Shape, Sprite,
+    SpritePlan, Value, h, hs, layer_or_self, unpremul,
+};
+
+// ------------------------------------------------------------------ Card Dance
+
+pub(super) const CD_SOURCES: &[&str] =
+    &["None", "Intensity 1", "Red 1", "Green 1", "Blue 1", "Alpha 1", "Intensity 2", "Red 2", "Green 2", "Blue 2", "Alpha 2"];
+
+/// (param id prefix, twirl-down group match id) per transformed card property.
+pub(super) const CD_PROPS: [(&str, &str); 8] = [
+    ("xPos", "xPosition"),
+    ("yPos", "yPosition"),
+    ("zPos", "zPosition"),
+    ("xRot", "xRotation"),
+    ("yRot", "yRotation"),
+    ("zRot", "zRotation"),
+    ("xScale", "xScale"),
+    ("yScale", "yScale"),
+];
+
+fn card_source(src: u32, g1: [f32; 4], g2: [f32; 4]) -> f32 {
+    let (c1, a1) = unpremul(g1);
+    let (c2, a2) = unpremul(g2);
+    let lum = |c: [f32; 3]| effectcraft_color::luminance(c[0], c[1], c[2]);
+    match src {
+        1 => lum(c1),
+        2 => c1[0],
+        3 => c1[1],
+        4 => c1[2],
+        5 => a1,
+        6 => lum(c2),
+        7 => c2[0],
+        8 => c2[1],
+        9 => c2[2],
+        10 => a2,
+        _ => 0.0,
+    }
+}
+
+pub(super) fn card_dance(ctx: &EffectCtx, b: Buf) -> Buf {
+    card_dance_plan(ctx, &b).finish(b)
+}
+
+pub(super) fn card_dance_plan(ctx: &EffectCtx, b: &Buf) -> PiecePlan {
+    let pr = ctx.params;
+    let rows = pr.f("rows").clamp(1.0, 1000.0) as u32;
+    let cols = if pr.e("rowsColumns") == 1 { rows } else { pr.f("columns").clamp(1.0, 1000.0) as u32 };
+    let g1 = layer_or_self(ctx, b, "gradientLayer1", true, true);
+    let g2 = layer_or_self(ctx, b, "gradientLayer2", true, true);
+    let back = ctx.layer_param("backLayer", true).map(|o| crate::util::fit_layer(ctx, b, &o, true));
+    let [lw, lh] = ctx.layer_size;
+    let s = b.scale;
+    let (cw, ch) = (lw / cols as f64, lh / rows as f64);
+    let cam = crate::card3d::projection(ctx, b);
+    let eye = cam.eye();
+    let light = Lighting::from(ctx, b);
+    let props: Vec<(u32, f64, f64)> =
+        CD_PROPS.iter().map(|(id, g)| (pr.e(&format!("{g}/{id}Source")), pr.f(&format!("{g}/{id}Multiplier")), pr.f(&format!("{g}/{id}Offset")))).collect();
+    let mut pieces: Vec<Piece> = (0..rows * cols)
+        .into_par_iter()
+        .filter_map(|i| {
+            let (cx0, cy0) = ((i % cols) as f64 * cw, (i / cols) as f64 * ch);
+            let c = [cx0 + cw * 0.5, cy0 + ch * 0.5];
+            let (bx, by) = (c[0] * s + b.offset[0], c[1] * s + b.offset[1]);
+            let (gp1, gp2) = (g1.sample_bilinear(bx, by), g2.sample_bilinear(bx, by));
+            let val = |k: usize| {
+                let (sr, m, o) = props[k];
+                o + m * card_source(sr, gp1, gp2) as f64
+            };
+            let (sx, sy) = (val(6), val(7));
+            let r = rot_xyz(val(3).to_radians(), val(4).to_radians(), val(5).to_radians());
+            let rs: M3 = std::array::from_fn(|k| [r[k][0] * sx, r[k][1] * sy, r[k][2]]);
+            let pos = [bx + val(0) * cw * s, by + val(1) * ch * s, val(2) * cw.max(ch) * s];
+            let (tx0, ty0) = ((cx0 * s + b.offset[0]) as f32, (cy0 * s + b.offset[1]) as f32);
+            let (tw, th) = ((cw * s) as f32, (ch * s) as f32);
+            let poly = [[tx0, ty0], [tx0 + tw, ty0], [tx0 + tw, ty0 + th], [tx0, ty0 + th]];
+            let mut pc = Piece::new(&poly, [bx as f32, by as f32], &rs, pos, cam)?;
+            pc.light(&light, &r, pos, eye);
+            Some(pc)
+        })
+        .collect();
+    sort_far_first(&mut pieces);
+    PiecePlan { pieces, front: PieceTex::Layer, back: back.map(PieceTex::Image) }
+}
+
+// ------------------------------------------------------------------ Shatter
+
+/// Shatter's Pattern options; the last, Custom, takes its pieces from Custom Shatter Map.
+pub(super) const SHATTER_PATTERNS: &[&str] = &["Bricks", "Glass", "Hexagons", "Squares", "Triangles", "Custom"];
+
+/// Pattern cells (polygons in pattern space, before rotation) covering `[x0, x1]×[y0, y1]`.
+fn pattern_cells(kind: u32, cell: f64, x0: f64, y0: f64, x1: f64, y1: f64, seed: u32) -> Vec<Vec<[f64; 2]>> {
+    let mut out = Vec::new();
+    let i0 = (x0 / cell).floor() as i64 - 1;
+    let i1 = (x1 / cell).ceil() as i64 + 1;
+    let j0 = (y0 / cell).floor() as i64 - 1;
+    let j1 = (y1 / cell).ceil() as i64 + 1;
+    match kind {
+        0 => {
+            let bh = cell * 0.5;
+            let r0 = (y0 / bh).floor() as i64 - 1;
+            let r1 = (y1 / bh).ceil() as i64 + 1;
+            for r in r0..=r1 {
+                let sh = if r.rem_euclid(2) == 1 { cell * 0.5 } else { 0.0 };
+                for i in i0..=i1 {
+                    let (x, y) = (i as f64 * cell + sh, r as f64 * bh);
+                    out.push(vec![[x, y], [x + cell, y], [x + cell, y + bh], [x, y + bh]]);
+                }
+            }
+        }
+        1 => {
+            // Jittered lattice split into triangles along a random diagonal.
+            let jit = |i: i64, j: i64| -> [f64; 2] {
+                let (a, b) = (i as u32, j as u32);
+                [i as f64 * cell + hs(a, b.wrapping_add(17), seed) as f64 * cell * 0.35, j as f64 * cell + hs(a, b.wrapping_add(91), seed) as f64 * cell * 0.35]
+            };
+            for j in j0..=j1 {
+                for i in i0..=i1 {
+                    let (p00, p10, p11, p01) = (jit(i, j), jit(i + 1, j), jit(i + 1, j + 1), jit(i, j + 1));
+                    if h(i as u32, j as u32, seed ^ 0x55) < 0.5 {
+                        out.push(vec![p00, p10, p11]);
+                        out.push(vec![p00, p11, p01]);
+                    } else {
+                        out.push(vec![p00, p10, p01]);
+                        out.push(vec![p10, p11, p01]);
+                    }
+                }
+            }
+        }
+        2 => {
+            let r = cell / 3f64.sqrt();
+            let dx = 1.5 * r;
+            let dy = 3f64.sqrt() * r;
+            let c0 = (x0 / dx).floor() as i64 - 1;
+            let c1 = (x1 / dx).ceil() as i64 + 1;
+            let rr0 = (y0 / dy).floor() as i64 - 1;
+            let rr1 = (y1 / dy).ceil() as i64 + 1;
+            for ci in c0..=c1 {
+                for rj in rr0..=rr1 {
+                    let cx = ci as f64 * dx;
+                    let cy = (rj as f64 + if ci.rem_euclid(2) == 1 { 0.5 } else { 0.0 }) * dy;
+                    out.push(
+                        (0..6)
+                            .map(|k| {
+                                let a = k as f64 * std::f64::consts::PI / 3.0;
+                                [cx + r * a.cos(), cy + r * a.sin()]
+                            })
+                            .collect(),
+                    );
+                }
+            }
+        }
+        3 => {
+            for j in j0..=j1 {
+                for i in i0..=i1 {
+                    let (x, y) = (i as f64 * cell, j as f64 * cell);
+                    out.push(vec![[x, y], [x + cell, y], [x + cell, y + cell], [x, y + cell]]);
+                }
+            }
+        }
+        _ => {
+            for j in j0..=j1 {
+                for i in i0..=i1 {
+                    let (x, y) = (i as f64 * cell, j as f64 * cell);
+                    if (i + j).rem_euclid(2) == 0 {
+                        out.push(vec![[x, y], [x + cell, y], [x, y + cell]]);
+                        out.push(vec![[x + cell, y], [x + cell, y + cell], [x, y + cell]]);
+                    } else {
+                        out.push(vec![[x, y], [x + cell, y], [x + cell, y + cell]]);
+                        out.push(vec![[x, y], [x + cell, y + cell], [x, y + cell]]);
+                    }
+                }
+            }
+        }
+    }
+    out
+}
+
+/// `∫0^t e^{-ks} ds` and `∫0^t ∫0^u e^{-ks} ds du` (drag-damped ballistic factors).
+fn drag_factors(k: f64, t: f64) -> (f64, f64) {
+    if k < 1e-6 {
+        (t, 0.5 * t * t)
+    } else {
+        let e = (-k * t).exp();
+        ((1.0 - e) / k, t / k - (1.0 - e) / (k * k))
+    }
+}
+
+/// Shatter's Front / Side / Back Mode options.
+pub(super) const SHATTER_TEXTURE_MODES: [&str; 3] = ["Color", "Layer", "Tinted Layer"];
+
+/// One face's texture: a flat colour, a layer, or a layer tinted by the Textures colour.
+struct Face {
+    mode: u32,
+    img: Option<Image>,
+}
+
+impl Face {
+    fn from(ctx: &EffectCtx, b: &Buf, mode: &str, layer: &str, default_mode: u32) -> Face {
+        let mode = ctx.params.get(mode).map(|v| v.as_enum()).unwrap_or(default_mode);
+        // A face layer of None is the effect's own layer.
+        let img = (mode != 0).then(|| layer_or_self(ctx, b, layer, true, true));
+        Face { mode, img }
+    }
+}
+
+/// Group key of a Custom Shatter Map colour (pieces of one colour break as one).
+fn map_key(c: [f32; 4]) -> u32 {
+    let (c, a) = unpremul(c);
+    if a < 0.5 {
+        return u32::MAX;
+    }
+    let q = |v: f32| ((v.clamp(0.0, 1.0) * 15.0).round() as u32) & 15;
+    q(c[0]) << 8 | q(c[1]) << 4 | q(c[2])
+}
+
+pub(super) fn shatter(ctx: &EffectCtx, b: Buf) -> Buf {
+    match shatter_impl(ctx, &b) {
+        ShatterPlan::Pieces(plan) => plan.finish(b),
+        ShatterPlan::Wire(plan) => plan.finish(b),
+    }
+}
+
+/// What Shatter draws: the pieces (Rendered view) or the wireframe lines.
+pub(super) enum ShatterPlan {
+    Pieces(PiecePlan),
+    Wire(SpritePlan),
+}
+
+pub(super) fn shatter_impl(ctx: &EffectCtx, b: &Buf) -> ShatterPlan {
+    let pr = ctx.params;
+    let view = pr.e("view");
+    let render = pr.e("render");
+    let kind = pr.e("shape/pattern");
+    let custom = kind as usize == SHATTER_PATTERNS.len() - 1;
+    let reps = pr.f("shape/repetitions").clamp(1.0, 500.0);
+    let dir = pr.f("shape/direction").to_radians();
+    let origin = pr.v2("shape/origin");
+    let forces = [
+        (pr.v2("force1/force1Position"), pr.f("force1/force1Depth"), pr.f("force1/force1Radius"), pr.f("force1/force1Strength")),
+        (pr.v2("force2/force2Position"), pr.f("force2/force2Depth"), pr.f("force2/force2Radius"), pr.f("force2/force2Strength")),
+    ];
+    let rot_speed = pr.f("physics/rotationSpeed");
+    let tumble = pr.e("physics/tumbleAxis");
+    let randomness = pr.f("physics/randomness");
+    let k = pr.f("physics/viscosity").max(0.0) * 5.0;
+    let mass_var = pr.f("physics/massVariance") / 100.0;
+    let gravity = pr.f("physics/gravity");
+    let gdir = pr.f("physics/gravityDirection").to_radians();
+    let ginc = pr.f("physics/gravityInclination").to_radians();
+    let seed = (pr.f("randomSeed") as u32).wrapping_mul(0x9e3779b1) ^ ctx.seed;
+    let [lw, lh] = ctx.layer_size;
+    let s = b.scale;
+    let t = ctx.time.max(0.0);
+    let unit = lw * 0.1;
+    let cell = lw / reps;
+    let extrude = pr.f("shape/extrusionDepth").max(0.0) * cell * s;
+    let cam = crate::card3d::projection(ctx, b);
+    let eye = cam.eye();
+    let light = Lighting::from(ctx, b);
+    // Gradient: with a gradient layer only pieces at least as bright as 1 − Shatter Threshold
+    // (Invert Gradient: as dark) break.
+    let gradient = ctx.layer_param("gradient/gradientLayer", true).map(|o| crate::util::fit_layer(ctx, b, &o, true));
+    let threshold = pr.get("gradient/shatterThreshold").map(Value::as_f64).unwrap_or(0.0) / 100.0;
+    let invert_gradient = pr.b("gradient/invertGradient");
+    // Textures.
+    let tex_color = pr.get("textures/color").map(|v| v.as_color()).unwrap_or([1.0; 4]);
+    let tex_opacity = pr.get("textures/opacity").map(Value::as_f64).unwrap_or(1.0).clamp(0.0, 1.0) as f32;
+    let front = Face::from(ctx, b, "textures/frontMode", "textures/frontLayer", 1);
+    let side = Face::from(ctx, b, "textures/sideMode", "textures/sideLayer", 0);
+    let backf = Face::from(ctx, b, "textures/backMode", "textures/backLayer", 1);
+    let custom_map = custom.then(|| layer_or_self(ctx, b, "shape/customShatterMap", true, true));
+    let white_fixed = pr.b("shape/whiteTilesFixed");
+    let (sd, cd) = dir.sin_cos();
+    let to_layer = |q: [f64; 2]| [origin[0] + q[0] * cd - q[1] * sd, origin[1] + q[0] * sd + q[1] * cd];
+    // Pattern-space bounds of the layer rectangle.
+    let corners = [[0.0, 0.0], [lw, 0.0], [lw, lh], [0.0, lh]].map(|c: [f64; 2]| {
+        let (dx, dy) = (c[0] - origin[0], c[1] - origin[1]);
+        [dx * cd + dy * sd, -dx * sd + dy * cd]
+    });
+    let (px0, px1) = (corners.iter().map(|c| c[0]).fold(f64::INFINITY, f64::min), corners.iter().map(|c| c[0]).fold(f64::NEG_INFINITY, f64::max));
+    let (py0, py1) = (corners.iter().map(|c| c[1]).fold(f64::INFINITY, f64::min), corners.iter().map(|c| c[1]).fold(f64::NEG_INFINITY, f64::max));
+    // Custom Shatter Map: square cells grouped by the map's colour.
+    let cells = pattern_cells(if custom { 3 } else { kind }, cell, px0, py0, px1, py1, seed);
+    let polys: Vec<Vec<[f64; 2]>> = cells.iter().map(|poly| poly.iter().map(|&q| to_layer(q)).collect()).collect();
+    let centre = |lp: &[[f64; 2]]| [lp.iter().map(|v| v[0]).sum::<f64>() / lp.len() as f64, lp.iter().map(|v| v[1]).sum::<f64>() / lp.len() as f64];
+    let keys: Vec<u32> = match &custom_map {
+        Some(m) => polys
+            .iter()
+            .map(|lp| {
+                let c = centre(lp);
+                map_key(m.sample_bilinear(c[0] * s + b.offset[0], c[1] * s + b.offset[1]))
+            })
+            .collect(),
+        None => (0..polys.len() as u32).collect(),
+    };
+    // Group centres (custom map) — each group moves as one rigid piece.
+    let mut groups: std::collections::HashMap<u32, ([f64; 2], f64)> = std::collections::HashMap::new();
+    for (lp, &key) in polys.iter().zip(&keys) {
+        let c = centre(lp);
+        let e = groups.entry(key).or_insert(([0.0; 2], 0.0));
+        e.0[0] += c[0];
+        e.0[1] += c[1];
+        e.1 += 1.0;
+    }
+    let g3 = [gdir.sin() * ginc.cos() * gravity * unit, -gdir.cos() * ginc.cos() * gravity * unit, ginc.sin() * gravity * unit];
+    let mut pieces: Vec<Piece> = polys
+        .par_iter()
+        .zip(keys.par_iter())
+        .flat_map_iter(|(lp, &key)| {
+            let mut out: Vec<Piece> = vec![];
+            let (mnx, mxx) = (lp.iter().map(|v| v[0]).fold(f64::INFINITY, f64::min), lp.iter().map(|v| v[0]).fold(f64::NEG_INFINITY, f64::max));
+            let (mny, mxy) = (lp.iter().map(|v| v[1]).fold(f64::INFINITY, f64::min), lp.iter().map(|v| v[1]).fold(f64::NEG_INFINITY, f64::max));
+            if mxx < 0.0 || mxy < 0.0 || mnx > lw || mny > lh || key == u32::MAX {
+                return out.into_iter();
+            }
+            let pc_c = centre(lp);
+            let (gsum, gn) = groups[&key];
+            let gc = [gsum[0] / gn, gsum[1] / gn];
+            let i = key;
+            // Broken when inside a force sphere (centred `depth` in front of the layer).
+            let mut v = [0.0f64; 3];
+            let mut broken = false;
+            for (fp, fd, fr, fs) in forces {
+                let rad = fr * lw;
+                if rad <= 0.0 {
+                    continue;
+                }
+                let dv = [gc[0] - fp[0], gc[1] - fp[1], fd * lw];
+                let dist = (dv[0] * dv[0] + dv[1] * dv[1] + dv[2] * dv[2]).sqrt();
+                if dist < rad {
+                    broken = true;
+                    let f = fs * (1.0 - dist / rad) * unit / dist.max(1e-6);
+                    for q in 0..3 {
+                        v[q] += dv[q] * f;
+                    }
+                }
+            }
+            if broken && let Some(g) = &gradient {
+                let (c, _) = unpremul(g.sample_bilinear(gc[0] * s + b.offset[0], gc[1] * s + b.offset[1]));
+                let mut l = effectcraft_color::luminance(c[0], c[1], c[2]).clamp(0.0, 1.0) as f64;
+                if invert_gradient {
+                    l = 1.0 - l;
+                }
+                broken = threshold > 0.0 && l >= 1.0 - threshold;
+            }
+            if broken && custom && white_fixed && key == 0xfff {
+                broken = false;
+            }
+            if (broken && render == 1) || (!broken && render == 2) {
+                return out.into_iter();
+            }
+            let mut gpos = [gc[0], gc[1], 0.0];
+            let mut r = rot_axis([1.0, 0.0, 0.0], 0.0);
+            let moving = broken && t > 0.0;
+            if moving {
+                let mass = 1.0 + mass_var * hs(i, 1, seed) as f64;
+                for q in 0..3 {
+                    v[q] = v[q] / mass + randomness * unit * hs(i, 2 + q as u32, seed) as f64 * 2.0;
+                }
+                let (f1, f2) = drag_factors(k, t);
+                for q in 0..3 {
+                    gpos[q] += v[q] * f1 + g3[q] * f2;
+                }
+                let axis = match tumble {
+                    1 => [0.0, 0.0, 0.0],
+                    2 => [1.0, 0.0, 0.0],
+                    3 => [0.0, 1.0, 0.0],
+                    4 => [0.0, 0.0, 1.0],
+                    5 => [hs(i, 6, seed) as f64, hs(i, 7, seed) as f64, 0.0],
+                    6 => [hs(i, 6, seed) as f64, 0.0, hs(i, 8, seed) as f64],
+                    7 => [0.0, hs(i, 7, seed) as f64, hs(i, 8, seed) as f64],
+                    _ => [hs(i, 6, seed) as f64, hs(i, 7, seed) as f64, hs(i, 8, seed) as f64],
+                };
+                let speed = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt() / unit;
+                let omega = rot_speed * std::f64::consts::TAU * (0.5 + h(i, 9, seed) as f64) * speed.min(10.0);
+                r = rot_axis(axis, omega * f1);
+            }
+            // The piece's centre: its offset from the group centre, rotated with the group.
+            let off = [pc_c[0] - gc[0], pc_c[1] - gc[1], 0.0];
+            let pos: [f64; 3] = std::array::from_fn(|q| gpos[q] + (0..3).map(|k| r[q][k] * off[k]).sum::<f64>());
+            let tex: Vec<[f32; 2]> = lp.iter().map(|v| [(v[0] * s + b.offset[0]) as f32, (v[1] * s + b.offset[1]) as f32]).collect();
+            let c0 = [(pc_c[0] * s + b.offset[0]) as f32, (pc_c[1] * s + b.offset[1]) as f32];
+            let posb = [pos[0] * s + b.offset[0], pos[1] * s + b.offset[1], pos[2] * s];
+            let Some(mut pc) = Piece::new(&tex, c0, &r, posb, cam) else { return out.into_iter() };
+            pc.light(&light, &r, posb, eye);
+            pc.alpha = tex_opacity;
+            let face = if pc.back { &backf } else { &front };
+            if face.mode == 0 {
+                pc.flat = Some([tex_color[0], tex_color[1], tex_color[2]]);
+            } else if face.mode == 2 {
+                pc.tint = std::array::from_fn(|q| pc.tint[q] * tex_color[q]);
+            }
+            // Extrusion: the sides of a moving piece, from its front outline back by the depth.
+            if moving && extrude > 0.0 {
+                let nb = [r[0][2], r[1][2], r[2][2]];
+                let n = tex.len();
+                for e in 0..n {
+                    let (a, bv) = (tex[e], tex[(e + 1) % n]);
+                    let ed = [(bv[0] - a[0]) as f64, (bv[1] - a[1]) as f64];
+                    let len = (ed[0] * ed[0] + ed[1] * ed[1]).sqrt();
+                    if len < 1e-6 {
+                        continue;
+                    }
+                    let ew: [f64; 3] = std::array::from_fn(|q| (r[q][0] * ed[0] + r[q][1] * ed[1]) / len);
+                    let third = [ew[1] * nb[2] - ew[2] * nb[1], ew[2] * nb[0] - ew[0] * nb[2], ew[0] * nb[1] - ew[1] * nb[0]];
+                    let rs: M3 = std::array::from_fn(|q| [ew[q], nb[q], third[q]]);
+                    // Side centre in world: edge midpoint (world) plus half the depth backwards.
+                    let mid = [((a[0] + bv[0]) * 0.5 - c0[0]) as f64, ((a[1] + bv[1]) * 0.5 - c0[1]) as f64];
+                    let mw: [f64; 3] = std::array::from_fn(|q| posb[q] + r[q][0] * mid[0] + r[q][1] * mid[1] + nb[q] * extrude * 0.5);
+                    let (hl, hd) = ((len * 0.5) as f32, (extrude * 0.5) as f32);
+                    let cs = [(a[0] + bv[0]) * 0.5, (a[1] + bv[1]) * 0.5];
+                    let quad = [[cs[0] - hl, cs[1] - hd], [cs[0] + hl, cs[1] - hd], [cs[0] + hl, cs[1] + hd], [cs[0] - hl, cs[1] + hd]];
+                    if let Some(mut sp) = Piece::new(&quad, cs, &rs, mw, cam) {
+                        sp.light(&light, &rs, mw, eye);
+                        sp.alpha = tex_opacity;
+                        let colour = match (&side.img, side.mode) {
+                            (Some(img), m) if m != 0 => {
+                                let (c, _) = unpremul(img.sample_bilinear(cs[0] as f64, cs[1] as f64));
+                                if m == 2 { std::array::from_fn(|q| c[q] * tex_color[q]) } else { c }
+                            }
+                            _ => [tex_color[0], tex_color[1], tex_color[2]],
+                        };
+                        sp.flat = Some(colour);
+                        out.push(sp);
+                    }
+                }
+            }
+            out.push(pc);
+            out.into_iter()
+        })
+        .collect();
+    sort_far_first(&mut pieces);
+    if view == 0 {
+        let tex = |i: &Option<Image>| i.clone().map(PieceTex::Image);
+        let front_t = tex(&front.img).unwrap_or(PieceTex::Layer);
+        let back_t = tex(&backf.img).unwrap_or_else(|| front_t.clone());
+        return ShatterPlan::Pieces(PiecePlan { pieces, front: front_t, back: Some(back_t) });
+    }
+    {
+        // Wireframes: piece outlines (front view: at rest; otherwise animated), plus forces.
+        let animated = view == 2 || view == 4;
+        let mut lines = Vec::new();
+        for pc in &pieces {
+            let n = pc.n as usize;
+            let pts: Vec<[f32; 2]> = if animated {
+                let fw = inv3(&pc.inv);
+                match fw {
+                    Some(m) => pc.poly[..n]
+                        .iter()
+                        .map(|v| {
+                            let (a, bb) = ((v[0] - pc.c0[0]) as f64, (v[1] - pc.c0[1]) as f64);
+                            let w = m[2][0] * a + m[2][1] * bb + m[2][2];
+                            [((m[0][0] * a + m[0][1] * bb + m[0][2]) / w) as f32, ((m[1][0] * a + m[1][1] * bb + m[1][2]) / w) as f32]
+                        })
+                        .collect(),
+                    None => continue,
+                }
+            } else {
+                pc.poly[..n].to_vec()
+            };
+            for e in 0..n {
+                let (a, c) = (pts[e], pts[(e + 1) % n]);
+                lines.push(Sprite::new(a[0], a[1], 0.5, [0.75, 0.85, 1.0, 1.0], Shape::Line { dx: c[0] - a[0], dy: c[1] - a[1] }));
+            }
+        }
+        if view >= 3 {
+            for (fp, _, fr, _) in forces {
+                let (fx, fy) = b.to_px(fp);
+                let rad = fr * lw * s;
+                for k in 0..64 {
+                    let (a0, a1) = (k as f64 / 64.0 * std::f64::consts::TAU, (k + 1) as f64 / 64.0 * std::f64::consts::TAU);
+                    let (x0, y0) = (fx + rad * a0.cos(), fy + rad * a0.sin());
+                    let (x1, y1) = (fx + rad * a1.cos(), fy + rad * a1.sin());
+                    lines.push(Sprite::new(x0 as f32, y0 as f32, 0.5, [1.0, 0.3, 0.3, 1.0], Shape::Line { dx: (x1 - x0) as f32, dy: (y1 - y0) as f32 }));
+                }
+            }
+        }
+        ShatterPlan::Wire(SpritePlan { sprites: lines, tints: vec![], acc: Acc::Over, post: Post::Replace })
+    }
+}
diff --git a/crates/effects/src/sim2/surfaces.rs b/crates/effects/src/sim2/surfaces.rs
new file mode 100644
index 000000000..7c3c032f0
--- /dev/null
+++ b/crates/effects/src/sim2/surfaces.rs
@@ -0,0 +1,524 @@
+use super::{Acc, Buf, EffectCtx, Image, IntoParallelIterator, ParallelIterator, Plane, Px, Shape, SimCache, Sprite, Value, gauss_plane, params_key, unpremul};
+
+// ------------------------------------------------------------------ Caustics
+
+/// Sample with repeat mode: 0 Once (transparent outside), 1 Tiled, 2 Reflected.
+fn sample_repeat(img: &Image, x: f64, y: f64, mode: u32) -> Px {
+    let (w, hh) = (img.width as f64, img.height as f64);
+    match mode {
+        1 => img.sample_bilinear_clamped(x.rem_euclid(w), y.rem_euclid(hh)),
+        2 => {
+            let m = |v: f64, n: f64| {
+                let r = v.rem_euclid(2.0 * n);
+                if r > n { 2.0 * n - r } else { r }
+            };
+            img.sample_bilinear_clamped(m(x, w), m(y, hh))
+        }
+        _ => img.sample_bilinear(x, y),
+    }
+}
+
+/// Everything Caustics' per-pixel pass needs, prepared on the CPU (the other layers it reads
+/// and the parameter conversions); the layer's own pixels are not read.
+pub struct CausticsSetup {
+    /// The Bottom layer fitted to the buffer, `None` = the layer itself.
+    pub bottom: Option<Image>,
+    /// Gaussian σ (buffer px) blurring the bottom (transparent edges), 0 = none.
+    pub bottom_sigma: f64,
+    /// The water surface's height field (smoothed luminance), `None` = flat.
+    pub height: Option<Plane>,
+    /// The Sky layer fitted to the buffer.
+    pub sky: Option<Image>,
+    pub scaling: f64,
+    pub repeat: u32,
+    pub wave_h: f64,
+    /// Displacement per unit of height gradient.
+    pub k: f64,
+    /// Layer centre (buffer px).
+    pub cx: f64,
+    pub cy: f64,
+    /// Layer width (buffer px).
+    pub lw: f64,
+    pub surf: [f32; 4],
+    pub surf_op: f32,
+    pub cstr: f32,
+    pub lc: [f32; 4],
+    pub li: f32,
+    /// Light position (buffer px) and height (layer widths); `point` = from the position to
+    /// each pixel, else one direction from above the layer centre.
+    pub lx: f64,
+    pub ly: f64,
+    pub lheight: f64,
+    pub point: bool,
+    pub ambient: f32,
+    pub diffuse: f32,
+    pub specular: f32,
+    pub sharp: f32,
+    pub sky_scaling: f64,
+    pub sky_repeat: u32,
+    pub sky_int: f32,
+    pub convergence: f64,
+}
+
+/// Caustics' setup for layer geometry `b` (see [`CausticsSetup`]).
+pub fn caustics_setup(ctx: &EffectCtx, b: &Buf) -> CausticsSetup {
+    let pr = ctx.params;
+    let s = b.scale;
+    let bottom = ctx.layer_param("bottom/bottom", true).map(|o| crate::util::fit_layer(ctx, b, &o, pr.e("bottom/bottomSizeDiffers") == 1));
+    let blur = pr.f("bottom/blur") * s;
+    let wave_h = pr.f("water/waveHeight");
+    let smoothing = pr.f("water/smoothing") * s;
+    let depth = pr.f("water/waterDepth");
+    let ior = pr.f("water/refractiveIndex").max(1.0);
+    let lpos = pr.v2("lighting/lightPosition");
+    // Height field of the water surface (luminance of the chosen layer; none = flat).
+    let height = ctx.layer_param("water/waterSurface", true).map(|o| {
+        let img = crate::util::fit_layer(ctx, b, &o, true);
+        let pl = Plane::luma(&img);
+        if smoothing > 0.05 { gauss_plane(&pl, smoothing * 0.5, smoothing * 0.5) } else { pl }
+    });
+    let lw = ctx.layer_size[0] * s;
+    let k = wave_h * depth * (1.0 - 1.0 / ior) * lw * 2.0;
+    let (cx, cy) = (b.offset[0] + ctx.layer_size[0] * 0.5 * s, b.offset[1] + ctx.layer_size[1] * 0.5 * s);
+    let (lx, ly) = b.to_px(lpos);
+    let (lc, li, lheight) = (pr.color("lighting/lightColor"), pr.f("lighting/lightIntensity") as f32, pr.f("lighting/lightHeight").max(0.01));
+    // Light Type: Distant Source (one direction, from the light position above the layer
+    // centre), Point Source (from the light position to each pixel) or First Comp Light.
+    let light_type = pr.e("lighting/lightType");
+    let comp_light = if light_type == 2 { ctx.env.host.and_then(|h| h.comp_scene()).and_then(|sc| sc.light) } else { None };
+    let (lc, li, lx, ly, lheight, point) = match (light_type, comp_light) {
+        (2, Some(l)) => {
+            let c = [l.color[0], l.color[1], l.color[2], 1.0];
+            // Comp space: z away from the viewer; the light above the water is at −z.
+            let (px, py) = (l.pos[0] * s + b.offset[0], l.pos[1] * s + b.offset[1]);
+            (c, li, px, py, (-l.pos[2] / ctx.layer_size[0].max(1.0)).max(0.01), l.kind == 1)
+        }
+        (2, None) => (lc, 0.0, lx, ly, lheight, false),
+        (1, _) => (lc, li, lx, ly, lheight, true),
+        _ => (lc, li, lx, ly, lheight, false),
+    };
+    // Sky: the layer the water surface reflects (Surface Opacity 1 = a mirror of it).
+    let sky = ctx.layer_param("sky/sky", true).map(|o| crate::util::fit_layer(ctx, b, &o, pr.e("sky/skySizeDiffers") == 1));
+    CausticsSetup {
+        bottom,
+        bottom_sigma: if blur > 0.05 { blur * 0.5 } else { 0.0 },
+        height,
+        sky,
+        scaling: pr.f("bottom/scaling").max(0.01),
+        repeat: pr.e("bottom/repeatMode"),
+        wave_h,
+        k,
+        cx,
+        cy,
+        lw,
+        surf: pr.color("water/surfaceColor"),
+        surf_op: pr.f("water/surfaceOpacity") as f32,
+        cstr: pr.f("water/causticsStrength") as f32,
+        lc,
+        li,
+        lx,
+        ly,
+        lheight,
+        point,
+        ambient: pr.f("lighting/ambientLight") as f32,
+        diffuse: pr.f("material/diffuse") as f32,
+        specular: pr.f("material/specular") as f32,
+        sharp: pr.f("material/highlightSharpness").max(1.0) as f32,
+        sky_scaling: pr.get("sky/scaling").map(Value::as_f64).unwrap_or(1.0).max(0.01),
+        sky_repeat: pr.e("sky/repeatMode"),
+        sky_int: pr.get("sky/intensity").map(Value::as_f64).unwrap_or(0.3) as f32,
+        convergence: pr.get("sky/convergence").map(Value::as_f64).unwrap_or(0.5).clamp(0.0, 1.0),
+    }
+}
+
+pub(super) fn caustics(ctx: &EffectCtx, mut b: Buf) -> Buf {
+    let st = caustics_setup(ctx, &b);
+    let mut bottom = st.bottom.clone().unwrap_or_else(|| b.img.clone());
+    if st.bottom_sigma > 0.0 {
+        bottom = effectcraft_raster::gaussian_blur(&bottom, st.bottom_sigma, st.bottom_sigma, false);
+    }
+    let CausticsSetup {
+        scaling,
+        repeat,
+        wave_h,
+        k,
+        cx,
+        cy,
+        lw,
+        surf,
+        surf_op,
+        cstr,
+        lc,
+        li,
+        lx,
+        ly,
+        lheight,
+        point,
+        ambient,
+        diffuse,
+        specular,
+        sharp,
+        sky_scaling,
+        sky_repeat,
+        sky_int,
+        convergence,
+        ..
+    } = st;
+    let (height, sky) = (&st.height, &st.sky);
+    let (w, hh) = (b.img.width as usize, b.img.height as usize);
+    let norm3 = |v: [f64; 3]| {
+        let n = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt().max(1e-12);
+        [(v[0] / n) as f32, (v[1] / n) as f32, (v[2] / n) as f32]
+    };
+    let lv_at = |x: f64, y: f64| {
+        if point {
+            norm3([(lx - x) / lw.max(1.0), (ly - y) / lw.max(1.0), lheight])
+        } else {
+            norm3([(lx - cx) / lw.max(1.0), (ly - cy) / lw.max(1.0), lheight])
+        }
+    };
+    let grad = |x: usize, y: usize| -> (f64, f64) {
+        match height {
+            Some(pl) => {
+                let gx = (pl.get_clamped(x as i64 + 1, y as i64) - pl.get_clamped(x as i64 - 1, y as i64)) as f64 * 0.5;
+                let gy = (pl.get_clamped(x as i64, y as i64 + 1) - pl.get_clamped(x as i64, y as i64 - 1)) as f64 * 0.5;
+                (gx, gy)
+            }
+            None => (0.0, 0.0),
+        }
+    };
+    // Displacement and its Jacobian (caustic focusing) per pixel.
+    let disp: Vec<(f64, f64)> = (0..w * hh)
+        .into_par_iter()
+        .map(|i| {
+            let (gx, gy) = grad(i % w, i / w);
+            (-gx * k, -gy * k)
+        })
+        .collect();
+    b.img.rows_mut().for_each(|(y, row)| {
+        for (x, px) in row.iter_mut().enumerate() {
+            let i = y * w + x;
+            let (dx, dy) = disp[i];
+            let d = |xx: usize, yy: usize| disp[yy.min(hh - 1) * w + xx.min(w - 1)];
+            let (dxr, _) = d(x + 1, y);
+            let (_, dyd) = d(x, y + 1);
+            let (dxl, _) = d(x.saturating_sub(1), y);
+            let (_, dyu) = d(x, y.saturating_sub(1));
+            let jac = (1.0 + (dxr - dxl) * 0.5) * (1.0 + (dyd - dyu) * 0.5);
+            let focus = ((1.0 / jac.abs().max(0.2)) as f32 - 1.0).clamp(-1.0, 4.0);
+            let sx = cx + (x as f64 + 0.5 + dx - cx) / scaling;
+            let sy = cy + (y as f64 + 0.5 + dy - cy) / scaling;
+            let p = sample_repeat(&bottom, sx, sy, repeat);
+            let (c, a) = unpremul(p);
+            let (gx, gy) = grad(x, y);
+            let n = {
+                let v = [-gx * wave_h * 20.0, -gy * wave_h * 20.0, 1.0];
+                let m = (v[0] * v[0] + v[1] * v[1] + 1.0).sqrt();
+                [(v[0] / m) as f32, (v[1] / m) as f32, (v[2] / m) as f32]
+            };
+            let lv = lv_at(x as f64 + 0.5, y as f64 + 0.5);
+            let nl = (n[0] * lv[0] + n[1] * lv[1] + n[2] * lv[2]).max(0.0);
+            let hv = {
+                let v = [lv[0], lv[1], lv[2] + 1.0];
+                let m = (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt();
+                [v[0] / m, v[1] / m, v[2] / m]
+            };
+            let spec = (n[0] * hv[0] + n[1] * hv[1] + n[2] * hv[2]).max(0.0).powf(sharp) * specular * li;
+            let light = ambient + diffuse * li * nl + cstr * focus * li;
+            // The surface: its colour lit like the water, or the sky it reflects (sampled along
+            // the surface normal; Convergence pulls the reflection towards the pixel itself).
+            let surface: [f32; 3] = match &sky {
+                Some(sk) => {
+                    let reach = (1.0 - convergence) * lw * 0.5;
+                    let (rx, ry) = (x as f64 + 0.5 + n[0] as f64 * reach, y as f64 + 0.5 + n[1] as f64 * reach);
+                    let (rx, ry) = (cx + (rx - cx) / sky_scaling, cy + (ry - cy) / sky_scaling);
+                    let (sc, _) = unpremul(sample_repeat(sk, rx, ry, sky_repeat));
+                    std::array::from_fn(|q| sc[q] * sky_int * 3.0 * surf[q])
+                }
+                None => std::array::from_fn(|q| surf[q] * (ambient + diffuse * li * nl)),
+            };
+            let cc: [f32; 3] = std::array::from_fn(|q| {
+                let base = c[q] * light * lc[q];
+                base * (1.0 - surf_op) + surface[q] * surf_op + spec * lc[q]
+            });
+            let a = (a + surf_op * (1.0 - a)).min(1.0);
+            *px = [cc[0] * a, cc[1] * a, cc[2] * a, a];
+        }
+    });
+    b
+}
+
+// ------------------------------------------------------------------ Wave World
+
+/// Wave World's simulated surface: an `nx` × `ny` grid of heights `u` and velocities `v`.
+#[derive(Clone, Debug)]
+pub struct Waves {
+    pub nx: usize,
+    pub ny: usize,
+    pub u: Vec<f32>,
+    pub v: Vec<f32>,
+}
+
+struct Producer {
+    ring: bool,
+    pos: [f32; 2],
+    len: f32,
+    width: f32,
+    angle: f32,
+    amp: f32,
+    freq: f32,
+    phase: f32,
+}
+
+impl Producer {
+    /// Weight of a grid point (layer-fraction coordinates, x in widths, y in widths).
+    fn weight(&self, x: f32, y: f32) -> f32 {
+        let (dx, dy) = (x - self.pos[0], y - self.pos[1]);
+        let (sa, ca) = self.angle.sin_cos();
+        let (u, v) = (dx * ca + dy * sa, -dx * sa + dy * ca);
+        let d = if self.ring {
+            let (a, bb) = ((self.len * 0.5).max(1e-3), (self.width * 0.5).max(1e-3));
+            ((u / a).powi(2) + (v / bb).powi(2)).sqrt()
+        } else {
+            let l = (self.len * 0.5).max(1e-3);
+            let wd = (self.width * 0.5).max(1e-3);
+            (u.abs() / l).max(v.abs() / wd)
+        };
+        (1.0 - d).clamp(0.0, 1.0).min(1.0)
+    }
+}
+
+static WAVE_CACHE: SimCache<Waves> = SimCache::new(4);
+
+/// What Wave World draws: the Height Map view of the simulated surface (grid heights and,
+/// with a ground layer, water depths per grid point), or the wireframe preview's lines.
+pub enum WavePlan {
+    Height { st: std::sync::Arc<Waves>, depth: Option<Vec<f32>> },
+    Wire(crate::sim::SpritePlan),
+}
+
+pub(super) fn wave_world(ctx: &EffectCtx, b: Buf) -> Buf {
+    match wave_world_impl(ctx, &b, false) {
+        Ok(img) => Buf { img, ..b },
+        Err(WavePlan::Wire(plan)) => plan.finish(b),
+        Err(WavePlan::Height { .. }) => b,
+    }
+}
+
+/// Wave World's simulation state for the frame, as a [`WavePlan`] (its pixels are not read).
+pub fn wave_world_plan(ctx: &EffectCtx, b: &Buf) -> Option<WavePlan> {
+    wave_world_impl(ctx, b, true).err()
+}
+
+fn wave_world_impl(ctx: &EffectCtx, b: &Buf, plan_only: bool) -> Result<Image, WavePlan> {
+    let pr = ctx.params;
+    let [lw, lh] = ctx.layer_size;
+    let res = pr.f("simulation/gridResolution").clamp(1.0, 400.0) as usize;
+    let res = if pr.b("simulation/gridResDownsamples") { ((res as f64) * b.scale).round().max(1.0) as usize } else { res };
+    let nx = res.max(2) + 1;
+    let ny = ((res as f64 * lh / lw.max(1.0)).round() as usize).max(2) + 1;
+    let speed = pr.f("simulation/waveSpeed").max(0.0) as f32;
+    let damping = pr.f("simulation/damping").max(0.0) as f32;
+    let reflect = pr.e("simulation/reflectEdges");
+    let preroll = pr.f("simulation/preRoll").max(0.0);
+    let prods: Vec<Producer> = [1, 2]
+        .iter()
+        .map(|k| {
+            let pos = pr.v2(&format!("producer{k}/producer{k}Position"));
+            Producer {
+                ring: pr.e(&format!("producer{k}/producer{k}Type")) == 0,
+                pos: [(pos[0] / lw.max(1.0)) as f32, (pos[1] / lw.max(1.0)) as f32],
+                len: pr.f(&format!("producer{k}/producer{k}Length")) as f32,
+                width: pr.f(&format!("producer{k}/producer{k}Width")) as f32,
+                angle: (pr.f(&format!("producer{k}/producer{k}Angle")) as f32).to_radians(),
+                amp: pr.f(&format!("producer{k}/producer{k}Amplitude")) as f32,
+                freq: pr.f(&format!("producer{k}/producer{k}Frequency")) as f32,
+                phase: (pr.f(&format!("producer{k}/producer{k}Phase")) as f32).to_radians(),
+            }
+        })
+        .collect();
+    let sps = crate::sim::SPS as f32;
+    // Wave speed in layer widths per second → cells per second; sub-steps keep it stable.
+    let cps = speed * (nx - 1) as f32;
+    let sub = ((cps * 2.0 / sps).ceil() as usize).clamp(1, 64);
+    let dt = 1.0 / (sps * sub as f32);
+    let cell = 1.0 / (nx - 1) as f32;
+    let weights: Vec<Vec<f32>> = prods.iter().map(|p| (0..nx * ny).map(|i| p.weight((i % nx) as f32 * cell, (i / nx) as f32 * cell)).collect()).collect();
+    // Ground: the ground layer's first frame, its luminance an elevation (× Steepness). Where
+    // it rises above Height the grid is dry (a wall the waves reflect from); shallow water
+    // slows the waves by Wave Strength.
+    let ground = pr.get("ground/ground").and_then(Value::as_layer).and_then(|id| {
+        let host = ctx.env.host?;
+        host.layer_at(id, ctx.env.comp_time - ctx.time, true)
+    });
+    let steep = pr.get("ground/steepness").map(Value::as_f64).unwrap_or(0.25) as f32;
+    let level = pr.get("ground/height").map(Value::as_f64).unwrap_or(0.25) as f32;
+    let wave_strength = pr.f("ground/waveStrength").clamp(0.0, 1.0) as f32;
+    // Water depth per grid point (None without ground: deep everywhere).
+    let depth: Option<Vec<f32>> = ground.as_ref().map(|lp| {
+        let (gw, gh) = (lp.size[0].max(1.0), lp.size[1].max(1.0));
+        (0..nx * ny)
+            .map(|i| {
+                let (fx, fy) = ((i % nx) as f64 / (nx - 1) as f64, (i / nx) as f64 / (ny - 1) as f64);
+                let (c, a) = unpremul(lp.buf.img.sample_bilinear_clamped(fx * gw * lp.buf.scale + lp.buf.offset[0], fy * gh * lp.buf.scale + lp.buf.offset[1]));
+                level - steep * effectcraft_color::luminance(c[0], c[1], c[2]) * a
+            })
+            .collect()
+    });
+    let speed_k: Vec<f32> = match &depth {
+        Some(d) => d.iter().map(|&v| if v <= 0.0 { 0.0 } else { 1.0 - wave_strength * (1.0 - (v / level.max(1e-3)).clamp(0.0, 1.0).sqrt()) }).collect(),
+        None => vec![1.0; nx * ny],
+    };
+    let mut key =
+        params_key(ctx, &Buf { img: Image::new(0, 0), offset: [0.0; 2], scale: if pr.b("simulation/gridResDownsamples") { b.scale } else { 1.0 } }, 4);
+    if let Some(d) = &depth {
+        key ^= d.iter().fold(0u64, |a, v| a.rotate_left(3) ^ v.to_bits() as u64);
+    }
+    let steps = crate::sim::steps_at(ctx.time + preroll);
+    let st = WAVE_CACHE.run(
+        key,
+        steps,
+        || Waves { nx, ny, u: vec![0.0; nx * ny], v: vec![0.0; nx * ny] },
+        |w, step| {
+            for k in 0..sub {
+                let t = (step as f32 + k as f32 / sub as f32) / sps - preroll as f32;
+                let c2 = cps * cps;
+                let mut acc = vec![0.0f32; nx * ny];
+                for y in 0..ny {
+                    for x in 0..nx {
+                        let i = y * nx + x;
+                        let g = |xx: usize, yy: usize| w.u[yy * nx + xx];
+                        let l = g(x.saturating_sub(1), y) + g((x + 1).min(nx - 1), y) + g(x, y.saturating_sub(1)) + g(x, (y + 1).min(ny - 1)) - 4.0 * w.u[i];
+                        acc[i] = c2 * speed_k[i] * speed_k[i] * l - damping * 4.0 * w.v[i];
+                    }
+                }
+                for i in 0..nx * ny {
+                    w.v[i] += acc[i] * dt;
+                    w.u[i] += w.v[i] * dt;
+                }
+                // Producers drive the surface.
+                for (p, wt) in prods.iter().zip(&weights) {
+                    if p.amp == 0.0 {
+                        continue;
+                    }
+                    let target = p.amp * (std::f32::consts::TAU * p.freq * t + p.phase).sin();
+                    for i in 0..nx * ny {
+                        if wt[i] > 0.0 {
+                            w.u[i] += (target - w.u[i]) * wt[i];
+                            w.v[i] *= 1.0 - wt[i];
+                        }
+                    }
+                }
+                // Dry ground holds the surface flat.
+                for i in 0..nx * ny {
+                    if speed_k[i] <= 0.0 {
+                        w.u[i] = 0.0;
+                        w.v[i] = 0.0;
+                    }
+                }
+                // Edges: reflective ones mirror; the others absorb in a thin sponge layer.
+                let refl = |side: u32| reflect == 5 || reflect == side;
+                let sponge = 4usize.min(nx / 4).max(1);
+                for y in 0..ny {
+                    for x in 0..nx {
+                        let i = y * nx + x;
+                        let mut f = 1.0f32;
+                        if !refl(1) && x < sponge {
+                            f = f.min(x as f32 / sponge as f32);
+                        }
+                        if !refl(3) && nx - 1 - x < sponge {
+                            f = f.min((nx - 1 - x) as f32 / sponge as f32);
+                        }
+                        if !refl(2) && y < sponge {
+                            f = f.min(y as f32 / sponge as f32);
+                        }
+                        if !refl(4) && ny - 1 - y < sponge {
+                            f = f.min((ny - 1 - y) as f32 / sponge as f32);
+                        }
+                        if f < 1.0 {
+                            let k = 0.85 + 0.15 * f;
+                            w.u[i] *= k;
+                            w.v[i] *= k;
+                        }
+                    }
+                }
+            }
+        },
+    );
+    let s = b.scale;
+    let (bw, bh) = (b.img.width, b.img.height);
+    let sample = |x: f64, y: f64| -> f32 {
+        let gx = (x / lw.max(1.0) * (st.nx - 1) as f64).clamp(0.0, (st.nx - 1) as f64);
+        let gy = (y / lw.max(1.0) * (st.nx - 1) as f64).clamp(0.0, (st.ny - 1) as f64);
+        let (x0, y0) = (gx.floor() as usize, gy.floor() as usize);
+        let (x1, y1) = ((x0 + 1).min(st.nx - 1), (y0 + 1).min(st.ny - 1));
+        let (tx, ty) = ((gx - x0 as f64) as f32, (gy - y0 as f64) as f32);
+        let g = |xx: usize, yy: usize| st.u[yy * st.nx + xx];
+        let a = g(x0, y0) + (g(x1, y0) - g(x0, y0)) * tx;
+        let c = g(x0, y1) + (g(x1, y1) - g(x0, y1)) * tx;
+        a + (c - a) * ty
+    };
+    if plan_only && pr.e("view") == 1 {
+        return Err(WavePlan::Height { st, depth });
+    }
+    if pr.e("view") == 1 {
+        let mut img = Image::new(bw, bh);
+        let bright = pr.f("heightMapControls/brightness") as f32;
+        let contrast = pr.f("heightMapControls/contrast") as f32;
+        let gamma = pr.f("heightMapControls/gamma").max(0.01) as f32;
+        let alpha = 1.0 - pr.f("heightMapControls/transparency") as f32;
+        let dry_transparent = pr.e("heightMapControls/renderDryAreasAs") == 1;
+        let dry_at = |x: f64, y: f64| -> bool {
+            let Some(d) = &depth else { return false };
+            let gx = (x / lw.max(1.0) * (st.nx - 1) as f64).round().clamp(0.0, (st.nx - 1) as f64) as usize;
+            let gy = (y / lw.max(1.0) * (st.nx - 1) as f64).round().clamp(0.0, (st.ny - 1) as f64) as usize;
+            d[gy * st.nx + gx] <= 0.0
+        };
+        img.rows_mut().for_each(|(y, row)| {
+            for (x, px) in row.iter_mut().enumerate() {
+                let lx = (x as f64 + 0.5 - b.offset[0]) / s;
+                let ly = (y as f64 + 0.5 - b.offset[1]) / s;
+                let v = (bright + contrast * sample(lx, ly)).clamp(0.0, 1.0).powf(1.0 / gamma);
+                let al = if dry_transparent && dry_at(lx, ly) { 0.0 } else { alpha };
+                *px = [v * al, v * al, v * al, al];
+            }
+        });
+        Ok(img)
+    } else {
+        // Wireframe preview: the grid turned by Horizontal Rotation about the vertical axis,
+        // tilted by Vertical Rotation, heights scaled by Vertical Scale.
+        let hr = pr.f("wireframeControls/horizontalRotation").to_radians();
+        let vr = pr.get("wireframeControls/verticalRotation").map(Value::as_f64).unwrap_or(53.0).to_radians();
+        let vs = pr.get("wireframeControls/verticalScale").map(Value::as_f64).unwrap_or(0.5);
+        let (sh, ch) = hr.sin_cos();
+        let (sv, cv) = vr.sin_cos();
+        let to = |x: usize, y: usize| -> [f32; 2] {
+            // Grid point relative to the layer centre (layer px), height in layer px.
+            let gx = x as f64 / (st.nx - 1) as f64 * lw - lw * 0.5;
+            let gy = y as f64 / (st.nx - 1) as f64 * lw - (st.ny - 1) as f64 / (st.nx - 1) as f64 * lw * 0.5;
+            let hgt = st.u[y * st.nx + x] as f64 * vs * lh * 0.5;
+            let (rx, ry) = (gx * ch - gy * sh, gx * sh + gy * ch);
+            let (px, py) = b.to_px([lw * 0.5 + rx, lh * 0.5 + ry * cv - hgt * sv]);
+            [px as f32, py as f32]
+        };
+        let mut lines = Vec::new();
+        for y in 0..st.ny {
+            for x in 0..st.nx {
+                let a = to(x, y);
+                if x + 1 < st.nx {
+                    let c = to(x + 1, y);
+                    lines.push(Sprite::new(a[0], a[1], 0.4, [0.4, 0.9, 0.4, 1.0], Shape::Line { dx: c[0] - a[0], dy: c[1] - a[1] }));
+                }
+                if y + 1 < st.ny {
+                    let c = to(x, y + 1);
+                    lines.push(Sprite::new(a[0], a[1], 0.4, [0.4, 0.9, 0.4, 1.0], Shape::Line { dx: c[0] - a[0], dy: c[1] - a[1] }));
+                }
+            }
+        }
+        let plan = crate::sim::SpritePlan { sprites: lines, tints: vec![], acc: Acc::Over, post: crate::sim::Post::OverBlack };
+        if plan_only {
+            return Err(WavePlan::Wire(plan));
+        }
+        Ok(plan.finish(Buf { img: Image::new(bw, bh), offset: b.offset, scale: b.scale }).img)
+    }
+}
diff --git a/crates/effects/src/sim2/tests.rs b/crates/effects/src/sim2/tests.rs
new file mode 100644
index 000000000..2ef35b122
--- /dev/null
+++ b/crates/effects/src/sim2/tests.rs
@@ -0,0 +1,485 @@
+use super::*;
+use crate::{EffectEnv, run_fx};
+
+fn ramp(w: u32, hh: u32) -> Image {
+    let mut img = Image::new(w, hh);
+    for y in 0..hh {
+        for x in 0..w {
+            img.set(x, y, [x as f32 / w as f32, y as f32 / hh as f32, 0.4, 1.0]);
+        }
+    }
+    img
+}
+
+fn run(id: &str, vals: &[(&str, Value)], img: Image, t: f64) -> Image {
+    run_fx(id, vals, img, t, EffectEnv::default()).img
+}
+
+fn max_diff(a: &Image, b: &Image) -> f32 {
+    a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|k| (p[k] - q[k]).abs()).fold(0.0, f32::max)).fold(0.0, f32::max)
+}
+
+fn sum_diff(a: &Image, b: &Image) -> f32 {
+    a.data.iter().zip(&b.data).map(|(p, q)| (0..4).map(|k| (p[k] - q[k]).abs()).sum::<f32>()).sum()
+}
+
+#[test]
+fn piece_at_rest_is_identity() {
+    let src = ramp(16, 16);
+    let cam = Cam { c: [8.0, 8.0], d: 64.0 };
+    let id = rot_axis([1.0, 0.0, 0.0], 0.0);
+    let pc = Piece::new(&[[0.0, 0.0], [16.0, 0.0], [16.0, 16.0], [0.0, 16.0]], [8.0, 8.0], &id, [8.0, 8.0, 0.0], cam).unwrap();
+    let mut out = Image::new(16, 16);
+    draw_pieces(&mut out, &[pc], &src, None);
+    assert!(max_diff(&out, &src) < 1e-4);
+}
+
+#[test]
+fn ball_action_draws_balls() {
+    let v = [("ballSize", num(80.0))];
+    let a = run("ec.sim.ccballaction", &v, ramp(32, 32), 0.0);
+    assert_eq!(a, run("ec.sim.ccballaction", &v, ramp(32, 32), 0.0));
+    assert!(a.data.iter().any(|p| p[3] > 0.9) && a.data.iter().any(|p| p[3] == 0.0), "balls with gaps");
+    let none = run("ec.sim.ccballaction", &[("ballSize", num(0.0))], ramp(32, 32), 0.0);
+    assert!(none.data.iter().all(|p| p[3] == 0.0));
+    let sc = run("ec.sim.ccballaction", &[("ballSize", num(80.0)), ("scatter", num(20.0))], ramp(32, 32), 0.0);
+    assert!(sum_diff(&a, &sc) > 1.0);
+}
+
+#[test]
+fn pixel_polly_breaks_after_start() {
+    let v = [("forceCenter", pt(16.0, 16.0)), ("gridSpacing", num(4.0))];
+    let before = run("ec.sim.ccpixelpolly", &v, ramp(32, 32), 0.0);
+    assert_eq!(before, ramp(32, 32), "intact before the start time");
+    let a = run("ec.sim.ccpixelpolly", &v, ramp(32, 32), 0.5);
+    assert_eq!(a, run("ec.sim.ccpixelpolly", &v, ramp(32, 32), 0.5));
+    assert!(sum_diff(&a, &ramp(32, 32)) > 10.0);
+    let tex = run("ec.sim.ccpixelpolly", &[("forceCenter", pt(16.0, 16.0)), ("gridSpacing", num(4.0)), ("object", Value::Enum(3))], ramp(32, 32), 0.5);
+    assert!(sum_diff(&a, &tex) > 0.1);
+}
+
+#[test]
+fn scatterize_identity_and_scatter() {
+    assert_eq!(run("ec.sim.ccscatterize", &[], ramp(24, 24), 0.0), ramp(24, 24));
+    let a = run("ec.sim.ccscatterize", &[("scatter", num(5.0))], ramp(24, 24), 0.0);
+    assert_eq!(a, run("ec.sim.ccscatterize", &[("scatter", num(5.0))], ramp(24, 24), 0.0));
+    assert!(sum_diff(&a, &ramp(24, 24)) > 1.0);
+    let tw = run("ec.sim.ccscatterize", &[("leftTwist", num(80.0)), ("rightTwist", num(80.0))], ramp(24, 24), 0.0);
+    assert!(sum_diff(&tw, &ramp(24, 24)) > 1.0);
+}
+
+#[test]
+fn card_dance_identity_and_rotation() {
+    let src = ramp(30, 20);
+    let a = run("ec.sim.carddance", &[], src.clone(), 0.0);
+    assert!(max_diff(&a, &src) < 0.02, "flat cards reproduce the layer: {}", max_diff(&a, &src));
+    let r = run("ec.sim.carddance", &[("yRotation/yRotSource", Value::Enum(1)), ("yRotation/yRotMultiplier", num(90.0))], src.clone(), 0.0);
+    assert_eq!(r, run("ec.sim.carddance", &[("yRotation/yRotSource", Value::Enum(1)), ("yRotation/yRotMultiplier", num(90.0))], src.clone(), 0.0));
+    assert!(sum_diff(&r, &src) > 5.0);
+    let z = run("ec.sim.carddance", &[("zPosition/zPosOffset", num(-1.0))], src.clone(), 0.0);
+    assert!(sum_diff(&z, &src) > 5.0, "cards pulled towards the camera grow");
+}
+
+#[test]
+fn shatter_at_rest_then_breaks() {
+    let v = [("view", Value::Enum(0)), ("force1/force1Position", pt(16.0, 16.0)), ("shape/origin", pt(16.0, 16.0))];
+    let src = ramp(32, 32);
+    let t0 = run("ec.sim.shatter", &v, src.clone(), 0.0);
+    assert!(max_diff(&t0, &src) < 0.03, "{}", max_diff(&t0, &src));
+    let t1 = run("ec.sim.shatter", &v, src.clone(), 0.5);
+    assert_eq!(t1, run("ec.sim.shatter", &v, src.clone(), 0.5));
+    assert!(sum_diff(&t1, &src) > 10.0);
+    for pat in 0..SHATTER_PATTERNS.len() as u32 {
+        let vv = [("view", Value::Enum(0)), ("shape/pattern", Value::Enum(pat)), ("force1/force1Position", pt(16.0, 16.0)), ("shape/origin", pt(16.0, 16.0))];
+        let r = run("ec.sim.shatter", &vv, src.clone(), 0.0);
+        assert!(max_diff(&r, &src) < 0.05, "pattern {pat} tiles the layer: {}", max_diff(&r, &src));
+    }
+    let wire = run("ec.sim.shatter", &[("shape/repetitions", num(3.0))], src.clone(), 0.0);
+    assert!(wire.data.iter().any(|p| p[3] > 0.5) && wire.data.iter().any(|p| p[3] == 0.0));
+    let layer_only =
+        run("ec.sim.shatter", &[("view", Value::Enum(0)), ("render", Value::Enum(1)), ("force1/force1Position", pt(16.0, 16.0))], src.clone(), 0.5);
+    assert!(layer_only.get(16, 16)[3] == 0.0, "broken centre removed");
+}
+
+#[test]
+fn caustics_flat_water() {
+    let src = ramp(24, 24);
+    let a = run(
+        "ec.sim.caustics",
+        &[
+            ("water/surfaceOpacity", num(0.0)),
+            ("lighting/ambientLight", num(0.0)),
+            ("material/diffuse", num(1.0)),
+            ("lighting/lightHeight", num(1000.0)),
+            ("material/specular", num(0.0)),
+        ],
+        src.clone(),
+        0.0,
+    );
+    assert!(max_diff(&a, &src) < 0.01, "flat water, light overhead = bottom: {}", max_diff(&a, &src));
+    let b = run("ec.sim.caustics", &[], src.clone(), 0.0);
+    assert_eq!(b, run("ec.sim.caustics", &[], src.clone(), 0.0));
+    assert!(sum_diff(&b, &src) > 0.1);
+}
+
+#[test]
+fn caustics_sky_and_light_types() {
+    let src = Image::filled(32, 32, [0.5, 0.5, 0.5, 1.0]);
+    let env = EffectEnv { host: Some(&FoamHost), ..Default::default() };
+    let run_h = |vals: &[(&str, Value)]| run_fx("ec.sim.caustics", vals, src.clone(), 0.0, env).img;
+    // A mirror-like surface shows the (green) sky.
+    let mirror = [("water/surfaceOpacity", num(1.0)), ("sky/sky", Value::Layer(Some(2))), ("sky/intensity", num(1.0))];
+    let p = run_h(&mirror).get(16, 16);
+    assert!(p[1] > p[0] + 0.3 && p[1] > p[2] + 0.3, "{p:?}");
+    // Point Source lights pixels by their own direction to the light: the image is no
+    // longer uniform; Distant Source lights the flat water evenly.
+    let lit = |t: u32| {
+        run_h(&[
+            ("lighting/lightType", Value::Enum(t)),
+            ("lighting/lightPosition", pt(0.0, 0.0)),
+            ("lighting/lightHeight", num(0.2)),
+            ("water/surfaceOpacity", num(0.0)),
+        ])
+    };
+    let (distant, point) = (lit(0), lit(1));
+    assert!((distant.get(2, 2)[0] - distant.get(30, 30)[0]).abs() < 1e-5);
+    assert!(point.get(2, 2)[0] > point.get(30, 30)[0] + 0.02, "{:?} {:?}", point.get(2, 2), point.get(30, 30));
+    // First Comp Light without a comp light: ambient only.
+    let none = run_h(&[("lighting/lightType", Value::Enum(2)), ("water/surfaceOpacity", num(0.0))]);
+    assert!(none.get(16, 16)[0] < distant.get(16, 16)[0]);
+}
+
+#[test]
+fn wave_world_wireframe_controls_ground_and_dry_areas() {
+    let base = [("producer1/producer1Position", pt(8.0, 16.0)), ("simulation/gridResolution", num(24.0))];
+    let wire = |extra: &[(&str, Value)]| run("ec.sim.waveworld", &[base.as_slice(), extra].concat(), Image::new(32, 32), 0.5);
+    assert_ne!(wire(&[]), wire(&[("wireframeControls/horizontalRotation", num(40.0))]));
+    assert_ne!(wire(&[]), wire(&[("wireframeControls/verticalScale", num(3.0))]));
+    // Ground (left dark, right light): the light side rises above the water and is dry.
+    let env = EffectEnv { host: Some(&FoamHost), ..Default::default() };
+    let hm = |extra: &[(&str, Value)]| {
+        let mut v: Vec<(&str, Value)> = base.to_vec();
+        v.extend([("view", Value::Enum(1)), ("ground/ground", Value::Layer(Some(1))), ("ground/steepness", num(0.5)), ("ground/height", num(0.25))]);
+        v.extend_from_slice(extra);
+        run_fx("ec.sim.waveworld", &v, Image::new(32, 32), 1.0, env).img
+    };
+    let solid = hm(&[]);
+    let clear = hm(&[("heightMapControls/renderDryAreasAs", Value::Enum(1))]);
+    assert!(solid.get(30, 16)[3] > 0.99 && clear.get(30, 16)[3] == 0.0);
+    assert!(clear.get(4, 16)[3] > 0.99, "wet side stays");
+    // Dry ground stays flat: mid grey (brightness 0.5) there.
+    assert!((solid.get(30, 16)[0] - 0.5).abs() < 1e-4);
+    // Wave Strength slows waves over shallow water: the surface differs.
+    assert_ne!(hm(&[]), hm(&[("ground/waveStrength", num(1.0))]));
+}
+
+#[test]
+fn wave_world_seek_and_waves() {
+    let v = vec![("view", Value::Enum(1)), ("producer1/producer1Position", pt(16.0, 16.0)), ("simulation/gridResolution", num(24.0))];
+    let _ = run("ec.sim.waveworld", &v, Image::new(32, 32), 0.5);
+    let a = run("ec.sim.waveworld", &v, Image::new(32, 32), 1.0);
+    let mut v2 = v.clone();
+    v2.push(("heightMapControls/transparency", num(0.0)));
+    assert_eq!(a, run("ec.sim.waveworld", &v2, Image::new(32, 32), 1.0));
+    // Waves spread: some pixels differ from the flat-water grey.
+    assert!(a.data.iter().any(|p| (p[0] - 0.5).abs() > 0.05), "waves");
+    let flat = run("ec.sim.waveworld", &[("view", Value::Enum(1)), ("producer1/producer1Amplitude", num(0.0))], Image::new(32, 32), 1.0);
+    assert!(flat.data.iter().all(|p| (p[0] - 0.5).abs() < 1e-5));
+    let wire = run("ec.sim.waveworld", &[("producer1/producer1Position", pt(16.0, 16.0)), ("simulation/gridResolution", num(10.0))], Image::new(32, 32), 0.3);
+    assert!(wire.data.iter().any(|p| p[1] > 0.3));
+}
+
+#[test]
+fn wave_world_steps_match_direct() {
+    // Fresh caches: resumed simulation equals simulation from scratch.
+    let v = vec![
+        ("view", Value::Enum(1)),
+        ("producer1/producer1Position", pt(16.0, 16.0)),
+        ("simulation/gridResolution", num(20.0)),
+        ("simulation/damping", num(0.07)),
+    ];
+    let a = run("ec.sim.waveworld", &v, Image::new(32, 32), 1.3);
+    let mut v2 = v.clone();
+    v2.push(("simulation/damping", num(0.07000001)));
+    // Different key: computed from scratch at 1.3 directly vs via 0.4 (both fresh keys).
+    let _ = run("ec.sim.waveworld", &v2, Image::new(32, 32), 0.4);
+    let b = run("ec.sim.waveworld", &v2, Image::new(32, 32), 1.3);
+    assert!(max_diff(&a, &b) < 1e-3, "{}", max_diff(&a, &b));
+}
+
+#[test]
+fn foam_bubbles_drift_and_seek() {
+    let v = vec![("producer/producerPoint", pt(16.0, 16.0)), ("view", Value::Enum(2)), ("producer/productionRate", num(2.0))];
+    let none = run("ec.sim.foam", &v, Image::new(32, 32), 0.0);
+    assert!(none.data.iter().all(|p| p[3] == 0.0));
+    let _ = run("ec.sim.foam", &v, Image::new(32, 32), 0.6);
+    let a = run("ec.sim.foam", &v, Image::new(32, 32), 1.2);
+    let mut v2 = v.clone();
+    v2.push(("randomSeed", num(1.0)));
+    assert_eq!(a, run("ec.sim.foam", &v2, Image::new(32, 32), 1.2));
+    assert!(a.data.iter().any(|p| p[3] > 0.05), "bubbles");
+    let draft = run("ec.sim.foam", &[("producer/producerPoint", pt(16.0, 16.0)), ("producer/productionRate", num(2.0))], Image::new(32, 32), 1.0);
+    assert!(draft.data.iter().any(|p| p[3] > 0.05));
+}
+
+#[test]
+fn foam_strength_controls_early_popping() {
+    // Strong bubbles all live their full lifespan; weak ones pop at random earlier.
+    assert_eq!(foam_pop_age(7, 300.0, 0.0, 1), 300.0);
+    let early = (0..200).filter(|&id| foam_pop_age(id, 300.0, 1.0, 1) < 150.0).count();
+    assert!(early > 60 && early < 140, "{early}");
+    let count = |strength: f64| {
+        let v = vec![
+            ("producer/producerPoint", pt(16.0, 16.0)),
+            ("producer/productionRate", num(3.0)),
+            ("bubbles/lifespan", num(40.0)),
+            ("bubbles/strength", num(strength)),
+            ("physics/windSpeed", num(0.0)),
+        ];
+        run("ec.sim.foam", &v, Image::new(32, 32), 1.5).data.iter().map(|p| p[3]).sum::<f32>()
+    };
+    assert!(count(0.0) < count(20.0) * 0.9, "{} vs {}", count(0.0), count(20.0));
+}
+
+/// A host with a comp camera (identity, or tilted) and a first comp light.
+struct Scene {
+    camera: Option<[[f64; 4]; 3]>,
+    light: Option<crate::CompLight>,
+    layer: Option<Image>,
+}
+impl crate::EffectHost for Scene {
+    fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+        let img = self.layer.clone()?;
+        let size = [img.width as f64, img.height as f64];
+        Some(crate::LayerPixels { buf: Buf { img, offset: [0.0; 2], scale: 1.0 }, size })
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn comp_scene(&self) -> Option<crate::CompScene> {
+        Some(crate::CompScene { camera: self.camera, camera_layer: true, light: self.light })
+    }
+}
+
+fn run_env(id: &str, vals: &[(&str, Value)], img: Image, t: f64, host: &Scene) -> Image {
+    run_fx(id, vals, img, t, EffectEnv { host: Some(host), ..Default::default() }).img
+}
+
+#[test]
+fn card_dance_camera_systems() {
+    let src = ramp(40, 30);
+    // Camera Position: rotating the camera changes the view; zero rotation is the layer.
+    let r = run("ec.sim.carddance", &[("cameraPosition/yRotation", num(30.0))], src.clone(), 0.0);
+    assert!(sum_diff(&r, &src) > 10.0);
+    let order = run("ec.sim.carddance", &[("cameraPosition/yRotation", num(30.0)), ("cameraPosition/xRotation", num(30.0))], src.clone(), 0.0);
+    let order2 = run(
+        "ec.sim.carddance",
+        &[("cameraPosition/yRotation", num(30.0)), ("cameraPosition/xRotation", num(30.0)), ("cameraPosition/transformOrder", Value::Enum(5))],
+        src.clone(),
+        0.0,
+    );
+    assert!(sum_diff(&order, &order2) > 1.0, "Transform Order matters");
+    // X, Y Position moves the view: the layer shifts by the offset.
+    let moved = run("ec.sim.carddance", &[("cameraPosition/xyPosition", pt(30.0, 15.0))], src.clone(), 0.0);
+    assert!((moved.get(25, 10)[0] - src.get(15, 10)[0]).abs() < 0.03, "{:?} {:?}", moved.get(25, 10), src.get(15, 10));
+    // Corner Pins: the layer's corners land on the pins.
+    let pins = [
+        ("cameraSystem", Value::Enum(1)),
+        ("cornerPins/upperLeftCorner", pt(10.0, 5.0)),
+        ("cornerPins/upperRightCorner", pt(30.0, 5.0)),
+        ("cornerPins/lowerLeftCorner", pt(10.0, 25.0)),
+        ("cornerPins/lowerRightCorner", pt(30.0, 25.0)),
+    ];
+    let cp = run("ec.sim.carddance", &pins, src.clone(), 0.0);
+    assert_eq!(cp.get(3, 3)[3], 0.0, "outside the pinned quad");
+    assert!(cp.get(20, 15)[3] > 0.99);
+    assert!((cp.get(20, 15)[0] - src.get(20, 15)[0]).abs() < 0.05, "centre maps to centre");
+    // Comp Camera: the identity camera reproduces the layer; a camera that doubles x moves it.
+    let ident = Scene { camera: Some([[1.0, 0.0, 0.0, 0.0], [0.0, 1.0, 0.0, 0.0], [0.0, 0.0, 0.002, 1.0]]), light: None, layer: None };
+    let cc = run_env("ec.sim.carddance", &[("cameraSystem", Value::Enum(2))], src.clone(), 0.0, &ident);
+    assert!(max_diff(&cc, &src) < 0.02, "{}", max_diff(&cc, &src));
+    let half = Scene { camera: Some([[0.5, 0.0, 0.0, 0.0], [0.0, 0.5, 0.0, 0.0], [0.0, 0.0, 0.002, 1.0]]), ..ident };
+    let cc = run_env("ec.sim.carddance", &[("cameraSystem", Value::Enum(2))], src.clone(), 0.0, &half);
+    assert_eq!(cc.get(35, 25)[3], 0.0, "half-size view leaves the far corner empty");
+}
+
+#[test]
+fn card_dance_lighting_and_material() {
+    let src = Image::filled(40, 30, [0.5, 0.5, 0.5, 1.0]);
+    let tilt = [("rows", num(1.0)), ("columns", num(1.0)), ("yRotation/yRotSource", Value::Enum(0)), ("yRotation/yRotOffset", num(60.0))];
+    let lit = |extra: &[(&str, Value)]| {
+        let mut v: Vec<(&str, Value)> = tilt.to_vec();
+        v.extend_from_slice(extra);
+        run("ec.sim.carddance", &v, src.clone(), 0.0).get(20, 15)
+    };
+    let base = lit(&[]);
+    // Tilted cards facing away from a frontal light get darker than flat ones.
+    assert!(base[0] < 0.45, "{base:?}");
+    // Light colour tints; intensity brightens; ambient alone lights evenly.
+    let red = lit(&[("lighting/lightColor", col(1.0, 0.0, 0.0))]);
+    assert!(red[0] > red[1] + 0.05);
+    assert!(lit(&[("lighting/lightIntensity", num(2.0))])[0] > base[0]);
+    let amb = lit(&[("lighting/ambientLight", num(1.0)), ("material/diffuse", num(0.0))]);
+    assert!((amb[0] - 0.5).abs() < 1e-3);
+    // A light placed to the side (Point Source) changes the shading of the tilted card.
+    let side = lit(&[("lighting/lightType", Value::Enum(1)), ("lighting/lightPosition", pt(200.0, 15.0)), ("lighting/lightDepth", num(0.2))]);
+    assert!((side[0] - base[0]).abs() > 0.02, "{side:?} vs {base:?}");
+    // Specular adds a highlight on flat, frontally lit cards.
+    let flat = run("ec.sim.carddance", &[("material/specular", num(0.5))], src.clone(), 0.0).get(20, 15);
+    assert!(flat[0] > 0.9, "{flat:?}");
+    // First Comp Light: no light in the comp → ambient only; a light from the host is used.
+    let none = Scene { camera: None, light: None, layer: None };
+    let a = run_env("ec.sim.carddance", &[("lighting/lightType", Value::Enum(2))], src.clone(), 0.0, &none).get(20, 15);
+    assert!((a[0] - 0.5 * (0.25 + 0.75)).abs() < 1e-3, "{a:?}");
+    let blue = Scene { light: Some(crate::CompLight { pos: [20.0, 15.0, -100.0], dir: [0.0, 0.0, 1.0], color: [0.0, 0.0, 1.0], kind: 0 }), ..none };
+    let a = run_env("ec.sim.carddance", &[("lighting/lightType", Value::Enum(2))], src.clone(), 0.0, &blue).get(20, 15);
+    assert!(a[2] > a[0] + 0.2, "{a:?}");
+}
+
+#[test]
+fn shatter_custom_map_gradient_textures_and_extrusion() {
+    let src = ramp(32, 32);
+    let base = [("view", Value::Enum(0)), ("force1/force1Position", pt(16.0, 16.0)), ("force1/force1Radius", num(2.0)), ("shape/origin", pt(16.0, 16.0))];
+    let with = |extra: &[(&str, Value)], t: f64, host: Option<&Scene>| {
+        let mut v: Vec<(&str, Value)> = base.to_vec();
+        v.extend_from_slice(extra);
+        match host {
+            Some(h) => run_env("ec.sim.shatter", &v, src.clone(), t, h),
+            None => run("ec.sim.shatter", &v, src.clone(), t),
+        }
+    };
+    // Custom Shatter Map: a map white on the left and black on the right; with White Tiles
+    // Fixed the left half stays put while the right half breaks away.
+    let mut map = Image::new(32, 32);
+    for y in 0..32 {
+        for x in 0..32 {
+            map.set(x, y, if x < 16 { [1.0; 4] } else { [0.0, 0.0, 0.0, 1.0] });
+        }
+    }
+    let host = Scene { camera: None, light: None, layer: Some(map) };
+    let custom = [("shape/pattern", Value::Enum(5)), ("shape/customShatterMap", Value::Layer(Some(1))), ("shape/whiteTilesFixed", Value::Bool(true))];
+    let at_rest = with(&custom, 0.0, Some(&host));
+    assert!(max_diff(&at_rest, &src) < 0.05, "custom pieces tile the layer: {}", max_diff(&at_rest, &src));
+    let broke = with(&custom, 1.0, Some(&host));
+    assert!(max_diff_region(&broke, &src, 0..12) < 0.05, "white tiles fixed");
+    assert!(sum_diff_region(&broke, &src, 20..32) > 5.0, "black group moved");
+    // Gradient: a black gradient layer with threshold 50 % keeps everything together.
+    let black = Scene { camera: None, light: None, layer: Some(Image::filled(32, 32, [0.0, 0.0, 0.0, 1.0])) };
+    let g = with(&[("gradient/gradientLayer", Value::Layer(Some(1))), ("gradient/shatterThreshold", num(50.0))], 1.0, Some(&black));
+    assert!(max_diff(&g, &src) < 0.05);
+    let gi = with(
+        &[("gradient/gradientLayer", Value::Layer(Some(1))), ("gradient/shatterThreshold", num(50.0)), ("gradient/invertGradient", Value::Bool(true))],
+        1.0,
+        Some(&black),
+    );
+    assert!(sum_diff(&gi, &src) > 10.0);
+    // Textures: Front Mode Color paints the pieces flat; Opacity fades them.
+    let flat = with(&[("textures/frontMode", Value::Enum(0)), ("textures/color", col(0.0, 1.0, 0.0))], 0.0, None);
+    let p = flat.get(16, 16);
+    assert!(p[1] > 0.95 && p[0] < 0.05, "{p:?}");
+    let half = with(&[("textures/opacity", num(0.5)), ("shape/repetitions", num(2.0))], 0.0, None);
+    assert!((half.get(8, 4)[3] - 0.5).abs() < 0.02, "{:?}", half.get(8, 4));
+    // Extrusion: thicker pieces cover more once they tumble.
+    let cover = |d: f64| {
+        with(&[("shape/extrusionDepth", num(d)), ("textures/sideMode", Value::Enum(0)), ("textures/color", col(1.0, 1.0, 1.0))], 0.6, None)
+            .data
+            .iter()
+            .map(|p| p[3])
+            .sum::<f32>()
+    };
+    assert!(cover(1.0) > cover(0.0) + 1.0, "{} vs {}", cover(1.0), cover(0.0));
+    // Deterministic and seek-consistent.
+    assert_eq!(with(&custom, 0.7, Some(&host)), with(&custom, 0.7, Some(&host)));
+}
+
+fn max_diff_region(a: &Image, b: &Image, xs: std::ops::Range<u32>) -> f32 {
+    let mut m = 0.0f32;
+    for y in 0..a.height {
+        for x in xs.clone() {
+            let (p, q) = (a.get(x as i64, y as i64), b.get(x as i64, y as i64));
+            m = (0..4).map(|k| (p[k] - q[k]).abs()).fold(m, f32::max);
+        }
+    }
+    m
+}
+
+fn sum_diff_region(a: &Image, b: &Image, xs: std::ops::Range<u32>) -> f32 {
+    let mut s = 0.0;
+    for y in 0..a.height {
+        for x in xs.clone() {
+            let (p, q) = (a.get(x as i64, y as i64), b.get(x as i64, y as i64));
+            s += (0..4).map(|k| (p[k] - q[k]).abs()).sum::<f32>();
+        }
+    }
+    s
+}
+
+/// Layer 1 = a left-dark, right-light ramp; layer 2 = solid green.
+struct FoamHost;
+impl crate::EffectHost for FoamHost {
+    fn layer(&self, id: u64, _: bool) -> Option<crate::LayerPixels> {
+        let img = if id == 1 { ramp(32, 32) } else { Image::filled(32, 32, [0.0, 1.0, 0.0, 1.0]) };
+        Some(crate::LayerPixels { buf: Buf { img, offset: [0.0; 2], scale: 1.0 }, size: [32.0, 32.0] })
+    }
+    fn layer_at(&self, id: u64, _: f64, me: bool) -> Option<crate::LayerPixels> {
+        self.layer(id, me)
+    }
+    fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+        None
+    }
+}
+
+#[test]
+fn foam_flow_map_pop_velocity_wobble_textures_and_reflection() {
+    let base = vec![
+        ("producer/producerPoint", pt(16.0, 16.0)),
+        ("producer/productionRate", num(2.0)),
+        ("physics/windSpeed", num(0.0)),
+        ("physics/turbulence", num(0.0)),
+        ("view", Value::Enum(2)),
+    ];
+    let with = |extra: &[(&str, Value)], t: f64| {
+        let mut v = base.clone();
+        v.extend_from_slice(extra);
+        run_fx("ec.sim.foam", &v, Image::new(32, 32), t, EffectEnv { host: Some(&FoamHost), ..Default::default() }).img
+    };
+    let cx = |img: &Image| {
+        let (mut s, mut n) = (0.0, 0.0);
+        for y in 0..32 {
+            for x in 0..32 {
+                let a = img.get(x, y)[3];
+                s += a * x as f32;
+                n += a;
+            }
+        }
+        s / n.max(1e-6)
+    };
+    // Flow map: bubbles run downhill (towards the dark left side).
+    let still = with(&[], 1.0);
+    let flowing = with(&[("flowMap/flowMap", Value::Layer(Some(1))), ("flowMap/flowMapSteepness", num(1.0))], 1.0);
+    assert!(cx(&flowing) < cx(&still) - 1.0, "{} vs {}", cx(&flowing), cx(&still));
+    let hq = with(&[("flowMap/flowMap", Value::Layer(Some(1))), ("flowMap/flowMapSteepness", num(1.0)), ("flowMap/simulationQuality", Value::Enum(2))], 1.0);
+    assert_eq!(
+        hq,
+        with(&[("flowMap/flowMap", Value::Layer(Some(1))), ("flowMap/flowMapSteepness", num(1.0)), ("flowMap/simulationQuality", Value::Enum(2))], 1.0)
+    );
+    // Pop velocity scatters the survivors when short-lived bubbles pop.
+    let short = [("bubbles/lifespan", num(8.0)), ("bubbles/strength", num(0.0))];
+    let a = with(&[short.as_slice(), &[("physics/popVelocity", num(0.0))]].concat(), 1.0);
+    let b2 = with(&[short.as_slice(), &[("physics/popVelocity", num(20.0))]].concat(), 1.0);
+    assert_ne!(a, b2);
+    // Wobble changes the drawn bubbles.
+    assert_ne!(with(&[("physics/wobbleAmount", num(0.0))], 1.0), with(&[("physics/wobbleAmount", num(3.0))], 1.0));
+    // User Defined texture: bubbles show the texture layer (green).
+    let tex = with(&[("rendering/bubbleTexture", Value::Enum(5)), ("rendering/bubbleTextureLayer", Value::Layer(Some(2)))], 1.0);
+    assert!(tex.data.iter().any(|p| p[1] > 0.5 && p[0] < 0.1));
+    // Environment map: reflections tint the bubbles.
+    let refl = with(&[("rendering/environmentMap", Value::Layer(Some(2))), ("rendering/reflectionStrength", num(1.0))], 1.0);
+    let g = |i: &Image| i.data.iter().map(|p| p[1] - p[0]).sum::<f32>();
+    assert!(g(&refl) > g(&still) + 1.0);
+    // Zoom Producer Point zooms about the producer instead of the layer centre.
+    let off = [("producer/producerPoint", pt(8.0, 8.0)), ("zoom", num(2.0))];
+    let z1 = with(&off, 1.0);
+    let z2 = with(&[off.as_slice(), &[("producer/zoomProducerPoint", Value::Bool(true))]].concat(), 1.0);
+    assert!((cx(&z2) - 8.0).abs() < 2.0 && cx(&z1) < 4.0, "{} vs {}", cx(&z2), cx(&z1));
+}
diff --git a/crates/effects/src/sim3.rs b/crates/effects/src/sim3.rs
index 35c758faa..c2a286390 100644
--- a/crates/effects/src/sim3.rs
+++ b/crates/effects/src/sim3.rs
@@ -1,4 +1,4 @@
-//! Simulation: Particle Playground and CC Hair.
+//! Simulation: Particle Playground and Surface Fibers.
 //!
 //! **Particle Playground** is a deterministic 2D particle system stepped from layer time 0 at
 //! [`SPS`] steps per second through [`SimCache`] (seeking anywhere gives the same frame as
@@ -17,7 +17,7 @@
 //! being rendered (their pixels are part of the cache key). Particles replace the layer's own
 //! pixels, as in After Effects.
 //!
-//! **CC Hair** grows strands from the layer's opaque pixels (Density per 1 000 px²), each a
+//! **Surface Fibers** grows strands from the layer's opaque pixels (Density per 1 000 px²), each a
 //! quadratic curve of Length that droops with Weight, optionally steered and scaled by a hairfall
 //! map layer (luminance → length, horizontal/vertical gradient → lean), and shades them with a
 //! Kajiya–Kay-style strand model (diffuse ∝ sin(tangent, light), specular from the half vector).
@@ -575,7 +575,8 @@ fn mapper_from(ctx: &EffectCtx, group: &str, ephemeral: bool) -> Option<Mapper>
 
 /// Draw a map layer frame as a particle: centred on (x, y) buffer px, rotated `angle` degrees
 /// and scaled, over `out`.
-fn blit_layer(out: &mut Image, lp: &crate::LayerPixels, x: f64, y: f64, angle: f64, scale: [f64; 2], buf_scale: f64, alpha: f32) {
+fn blit_layer(out: &mut Image, lp: &crate::LayerPixels, position: [f64; 2], angle: f64, scale: [f64; 2], buf_scale: f64, alpha: f32) {
+    let [x, y] = position;
     let (w, h) = (lp.size[0] * scale[0].abs() * buf_scale, lp.size[1] * scale[1].abs() * buf_scale);
     let r = (w * w + h * h).sqrt() * 0.5 + 1.0;
     let (x0, x1) = ((x - r).floor().max(0.0) as i64, (x + r).ceil().min(out.width as f64) as i64);
@@ -925,7 +926,7 @@ impl PgPlan {
     pub fn finish(&self, mut b: Buf) -> Buf {
         let mut fx = splat(b.img.width, b.img.height, &self.sprites.sprites, self.sprites.acc);
         for q in &self.blits {
-            blit_layer(&mut fx, &self.frames[q.frame], q.x, q.y, q.angle, q.scale, b.scale, q.alpha);
+            blit_layer(&mut fx, &self.frames[q.frame], [q.x, q.y], q.angle, q.scale, b.scale, q.alpha);
         }
         // Particles replace the layer's own pixels.
         b.img = combine(&b.img, &fx, 5);
@@ -933,7 +934,7 @@ impl PgPlan {
     }
 }
 
-// ---------------------------------------------------------------- CC Hair
+// ---------------------------------------------------------------- Surface Fibers
 
 fn cc_hair(ctx: &EffectCtx, b: Buf) -> Buf {
     let Some(mut plan) = hair_plan(ctx, &b) else { return b };
@@ -941,7 +942,7 @@ fn cc_hair(ctx: &EffectCtx, b: Buf) -> Buf {
     plan.finish(b)
 }
 
-/// CC Hair's strands as line sprites (each coloured from its root, see [`Tint::Root`]);
+/// Surface Fibers's strands as line sprites (each coloured from its root, see [`Tint::Root`]);
 /// `None` = no hair (the layer passes through).
 pub(crate) fn hair_plan(ctx: &EffectCtx, b: &Buf) -> Option<SpritePlan> {
     let pr = ctx.params;
@@ -1143,7 +1144,7 @@ pub fn specs() -> Vec<EffectSpec> {
         spec("ec.sim.particleplayground", "Particle Playground", pg, particle_playground),
         spec(
             "ec.sim.cchair",
-            "CC Hair",
+            "Surface Fibers",
             vec![
                 sp("length", "Length", px(30.0, 200.0)),
                 p("thickness", "Thickness", num(1.0), slider(0.05, 20.0, 0.1, 5.0, 2)),
@@ -1176,379 +1177,4 @@ pub fn specs() -> Vec<EffectSpec> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{EffectEnv, MaskShape, run_fx};
-
-    fn run(vals: &[(&str, Value)], t: f64) -> Image {
-        run_fx("ec.sim.particleplayground", vals, Image::filled(80, 60, [0.2, 0.2, 0.2, 1.0]), t, EffectEnv::default()).img
-    }
-
-    fn cannon(t: f64) -> Image {
-        run(&[("cannon/cannonPosition", Value::Vec2([40.0, 50.0])), ("cannon/velocity", num(60.0)), ("gravity/gravityForce", num(30.0))], t)
-    }
-
-    #[test]
-    fn cannon_stream_is_seek_consistent() {
-        let a = cannon(1.0);
-        // Particles replace the layer: some coverage, mostly transparent, red.
-        let cov: f32 = a.data.iter().map(|p| p[3]).sum();
-        assert!(cov > 5.0, "{cov}");
-        assert!(a.data.iter().any(|p| p[3] > 0.5 && p[0] > 0.5 && p[1] < 0.1));
-        // Seek back and forth: the same frame every time.
-        let _ = cannon(2.0);
-        let b = cannon(1.0);
-        assert_eq!(a.data, b.data);
-        let c = cannon(0.5);
-        assert_ne!(a.data, c.data);
-        // Nothing has been fired at time 0.
-        let z = cannon(0.0);
-        assert!(z.data.iter().all(|p| p[3] == 0.0));
-    }
-
-    #[test]
-    fn grid_falls_with_gravity_and_bounces_off_a_wall() {
-        let grid = |t: f64, env: EffectEnv| {
-            run_fx(
-                "ec.sim.particleplayground",
-                &[
-                    ("cannonEnabled", Value::Bool(false)),
-                    ("grid/gridPosition", Value::Vec2([40.0, 10.0])),
-                    ("grid/gridWidth", num(40.0)),
-                    ("grid/gridHeight", num(0.0)),
-                    ("grid/particlesAcross", num(5.0)),
-                    ("grid/particlesDown", num(1.0)),
-                    ("gravity/gravityForce", num(100.0)),
-                    ("wall/wallBoundary", num(1.0)),
-                ],
-                Image::new(80, 60),
-                t,
-                env,
-            )
-            .img
-        };
-        // Alpha-weighted mean height of the particles.
-        let row_of = |img: &Image| {
-            let (mut s, mut n) = (0.0f64, 0.0f64);
-            for y in 0..60 {
-                for x in 0..80 {
-                    let a = img.get(x, y)[3] as f64;
-                    s += (y as f64 + 0.5) * a;
-                    n += a;
-                }
-            }
-            (s / n.max(1e-9)).round() as i64
-        };
-        let t0 = grid(0.0, EffectEnv::default());
-        let t1 = grid(0.5, EffectEnv::default());
-        assert_eq!(row_of(&t0), 10);
-        // ½ g t² = 12.5 px.
-        assert!((row_of(&t1) - 22).abs() <= 2, "{}", row_of(&t1));
-        // A wall (mask 1) whose floor is at y = 15 keeps them above it.
-        let masks = [MaskShape { name: "w".into(), points: vec![[0.0, 0.0], [80.0, 0.0], [80.0, 15.0], [0.0, 15.0]], closed: true, inverted: false }];
-        let env = EffectEnv { masks: &masks, ..Default::default() };
-        let w = grid(1.5, env);
-        assert!(row_of(&w) <= 16, "{}", row_of(&w));
-    }
-
-    #[test]
-    fn repel_spreads_particles() {
-        let spread = |force: f64| {
-            let img = run(
-                &[
-                    ("cannonEnabled", Value::Bool(false)),
-                    ("grid/gridPosition", Value::Vec2([40.0, 30.0])),
-                    ("grid/gridWidth", num(6.0)),
-                    ("grid/gridHeight", num(6.0)),
-                    ("grid/particlesAcross", num(3.0)),
-                    ("grid/particlesDown", num(3.0)),
-                    ("gravity/gravityForce", num(0.0)),
-                    ("repel/repelForce", num(force)),
-                    ("repel/repelForceRadius", num(20.0)),
-                ],
-                0.5,
-            );
-            let (mut x0, mut x1) = (80, 0);
-            for y in 0..60 {
-                for x in 0..80 {
-                    if img.get(x, y)[3] > 0.3 {
-                        x0 = x0.min(x);
-                        x1 = x1.max(x);
-                    }
-                }
-            }
-            x1 - x0
-        };
-        assert!(spread(0.2) > spread(0.0) + 4, "{} vs {}", spread(0.2), spread(0.0));
-    }
-
-    #[test]
-    fn property_mapper_and_layer_map_read_layers() {
-        // Without a host, the layer-based features are inert (deterministic output).
-        let a = run(
-            &[
-                ("persistentPropertyMapper/mapRedTo", Value::Enum(8)),
-                ("persistentPropertyMapper/redMin", num(-50.0)),
-                ("persistentPropertyMapper/redMax", num(50.0)),
-            ],
-            0.7,
-        );
-        let b = run(
-            &[
-                ("persistentPropertyMapper/mapRedTo", Value::Enum(8)),
-                ("persistentPropertyMapper/redMin", num(-50.0)),
-                ("persistentPropertyMapper/redMax", num(50.0)),
-            ],
-            0.7,
-        );
-        assert_eq!(a.data, b.data);
-        let st =
-            Pg { persistent: Some(mapper(Image::filled(4, 4, [1.0, 0.0, 0.5, 1.0]), [(15, 0, 0.0, 120.0), (0, 0, 0.0, 1.0), (9, 0, 0.0, 2.0)])), ..bare(1) };
-        let mut s = PgState::default();
-        s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
-        st.step(&mut s);
-        // Red 1 → X speed 120 px/s; blue 0.5 → scale 1.
-        assert!((s.parts[0].v[0] - 120.0).abs() < 1e-3);
-        assert!((s.parts[0].scale[0] - 1.0).abs() < 1e-3);
-    }
-
-    /// A Pg with nothing switched on.
-    fn bare(seed: u32) -> Pg {
-        Pg {
-            cannon: false,
-            pos: [0.0; 2],
-            barrel_angle: 0.0,
-            barrel_radius: 0.0,
-            rate: 0.0,
-            dir_spread: 0.0,
-            vel: 0.0,
-            vel_spread: 0.0,
-            color: [1.0; 4],
-            radius: 2.0,
-            cannon_text: vec![],
-            pex_radius: 0.0,
-            pex_dispersion: 0.0,
-            pex_affects: Affects::default(),
-            gravity: [0.0; 2],
-            grav_spread: 0.0,
-            grav_affects: Affects::default(),
-            repel: 0.0,
-            repel_radius: 0.0,
-            repel_affects: Affects::default(),
-            wall: None,
-            wall_affects: Affects::default(),
-            persistent: None,
-            ephemeral: None,
-            seed,
-            bounds: [-1e6, -1e6, 1e6, 1e6],
-        }
-    }
-
-    fn mapper(img: Image, chans: [(u32, u32, f32, f32); 3]) -> Mapper {
-        Mapper { map: MapImg { img, k: [1.0; 2], o: [0.0; 2] }, chans, affects: Affects::default() }
-    }
-
-    #[test]
-    fn barrel_radius_square_or_disc() {
-        let pg = |r: f32| Pg { cannon: true, barrel_radius: r, ..bare(3) };
-        let (sq, disc) = (pg(10.0), pg(-10.0));
-        let mut corner = false;
-        for id in 0..400 {
-            let a = sq.spawn(id).p;
-            assert!(a[0].abs() <= 10.0 && a[1].abs() <= 10.0);
-            // A square barrel fills its corners (both offsets in use, not a line).
-            corner |= a[0].abs() > 7.5 && a[1].abs() > 7.5;
-            let b = disc.spawn(id).p;
-            assert!(b[0].hypot(b[1]) <= 10.0 + 1e-4);
-        }
-        assert!(corner);
-        // Radius 0: every particle starts at the cannon position.
-        assert_eq!(pg(0.0).spawn(5).p, [0.0, 0.0]);
-    }
-
-    #[test]
-    fn mapper_drives_position_and_opacity_in_ae_order() {
-        let st =
-            Pg { persistent: Some(mapper(Image::filled(4, 4, [1.0, 0.5, 0.25, 1.0]), [(12, 0, 0.0, 30.0), (20, 0, 0.0, 1.0), (4, 0, 0.0, 1.0)])), ..bare(1) };
-        assert_eq!(MAP_TARGETS[12], "X");
-        assert_eq!(MAP_TARGETS[20], "Opacity");
-        assert_eq!(MAP_TARGETS[26], "Scale Speed");
-        let mut s = PgState::default();
-        s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
-        st.step(&mut s);
-        assert!((s.parts[0].p[0] - 30.0).abs() < 1e-3, "{:?}", s.parts[0].p);
-        assert!((s.parts[0].c[3] - 0.5).abs() < 1e-3);
-        assert!((s.parts[0].friction - 0.25).abs() < 1e-3);
-    }
-
-    #[test]
-    fn ephemeral_mapper_holds_for_one_step_with_operators() {
-        // Ephemeral X Speed = 60 px/s (Set): the particle moves, but keeps no velocity.
-        let st = Pg { ephemeral: Some(mapper(Image::filled(4, 4, [1.0, 1.0, 1.0, 1.0]), [(15, 0, 0.0, 60.0), (0, 0, 0.0, 1.0), (0, 0, 0.0, 1.0)])), ..bare(1) };
-        let mut s = PgState::default();
-        s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
-        st.step(&mut s);
-        assert!((s.parts[0].p[0] - 2.0).abs() < 1e-4, "{:?}", s.parts[0].p);
-        assert!(s.parts[0].v[0].abs() < 1e-4);
-        // Operators: Add / Multiply / Max on the particle's own value.
-        let op = |o: u32, cur: f32| {
-            let m = mapper(Image::filled(4, 4, [1.0, 1.0, 1.0, 1.0]), [(21, o, 0.0, 3.0), (0, 0, 0.0, 1.0), (0, 0, 0.0, 1.0)]);
-            let mut q = PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID);
-            q.mass = cur;
-            m.apply(&mut q);
-            q.mass
-        };
-        assert_eq!(MAP_OPERATORS[1], "Add");
-        assert!((op(1, 2.0) - 5.0).abs() < 1e-5);
-        assert!((op(4, 2.0) - 6.0).abs() < 1e-5);
-        assert!((op(6, 5.0) - 5.0).abs() < 1e-5);
-        assert!((op(2, 5.0) - 2.0).abs() < 1e-5, "Difference");
-    }
-
-    #[test]
-    fn affects_select_by_source_age_and_characters() {
-        let mut q = PgParticle::new([0.0; 2], [0.0; 2], [1.0; 4], 2.0, 0, SRC_CANNON);
-        let a = Affects { from: 2, ..Default::default() };
-        assert_eq!(a.weight(&q), 0.0, "grid only");
-        q.src = SRC_GRID;
-        assert_eq!(a.weight(&q), 1.0);
-        let older = Affects { age: 1.0, ..Default::default() };
-        q.age = 0.5;
-        assert_eq!(older.weight(&q), 0.0);
-        q.age = 1.5;
-        assert_eq!(older.weight(&q), 1.0);
-        let younger = Affects { age: -1.0, feather: 1.0, ..Default::default() };
-        q.age = 1.0;
-        assert!((younger.weight(&q) - 0.5).abs() < 1e-5, "feathered");
-        let chars = Affects { chars: vec!['A', 'B'], ..Default::default() };
-        q.ch = 'B' as u32;
-        assert_eq!(chars.weight(&q), 1.0);
-        q.ch = 'C' as u32;
-        assert_eq!(chars.weight(&q), 0.0);
-        // Gravity restricted to the cannon leaves grid particles in place.
-        let st = Pg { gravity: [0.0, 100.0], grav_affects: Affects { from: 1, ..Default::default() }, ..bare(1) };
-        let mut s = PgState::default();
-        s.parts.push(PgParticle::new([5.0, 5.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
-        s.parts.push(PgParticle::new([5.0, 5.0], [0.0; 2], [1.0; 4], 2.0, 1, SRC_CANNON));
-        for _ in 0..10 {
-            st.step(&mut s);
-        }
-        assert_eq!(s.parts[0].p, [5.0, 5.0]);
-        assert!(s.parts[1].p[1] > 5.0);
-    }
-
-    #[test]
-    fn particle_exploder_bursts_big_particles() {
-        let st = Pg { pex_radius: 2.0, pex_dispersion: 30.0, ..bare(1) };
-        let mut s = PgState::default();
-        s.parts.push(PgParticle::new([50.0, 50.0], [0.0; 2], [1.0; 4], 6.0, 0, SRC_GRID));
-        s.next_id = 1;
-        st.step(&mut s);
-        assert_eq!(s.parts.len(), 9, "(6/2)² new particles");
-        assert!(s.parts.iter().all(|q| q.r == 2.0 && q.src == SRC_PARTICLE_EXPLODER));
-        st.step(&mut s);
-        assert_eq!(s.parts.len(), 9, "new particles do not burst again");
-        // Lifespan from a mapper removes particles once they are older.
-        let life = Pg { persistent: Some(mapper(Image::filled(4, 4, [1.0; 4]), [(22, 0, 0.0, 0.05), (0, 0, 0.0, 1.0), (0, 0, 0.0, 1.0)])), ..bare(1) };
-        let mut s = PgState::default();
-        s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
-        for _ in 0..2 {
-            life.step(&mut s);
-        }
-        assert_eq!(s.parts.len(), 1);
-        for _ in 0..3 {
-            life.step(&mut s);
-        }
-        assert!(s.parts.is_empty());
-    }
-
-    #[test]
-    fn text_particles_draw_characters() {
-        let grid = |text: &str| {
-            run(
-                &[
-                    ("cannonEnabled", Value::Bool(false)),
-                    ("grid/gridPosition", Value::Vec2([40.0, 30.0])),
-                    ("grid/gridWidth", num(40.0)),
-                    ("grid/gridHeight", num(0.0)),
-                    ("grid/particlesAcross", num(3.0)),
-                    ("grid/particlesDown", num(1.0)),
-                    ("grid/gridParticleRadius", num(16.0)),
-                    ("gravity/gravityForce", num(0.0)),
-                    ("options/gridText", Value::Str(text.into())),
-                ],
-                0.1,
-            )
-        };
-        let dots = grid("");
-        let text = grid("I-O");
-        assert_ne!(dots.data, text.data);
-        // "I" is a vertical bar: ink above and below the grid point, not a round dot.
-        assert!(text.get(20, 26)[3] > 0.3 && text.get(20, 34)[3] > 0.3, "{:?}", text.get(20, 26));
-        // A space leaves its grid point empty.
-        let gap = grid("I O");
-        assert!(gap.get(40, 30)[3] < 0.05);
-        // Cannon text: particles carry the characters in order.
-        let pg = Pg { cannon_text: vec!['A', 'B'], ..bare(1) };
-        assert_eq!(pg.spawn(0).ch, 'A' as u32);
-        assert_eq!(pg.spawn(3).ch, 'B' as u32);
-    }
-
-    #[test]
-    fn layer_map_shows_the_map_layer_at_its_time_offset() {
-        /// A 6×6 map layer whose colour encodes the comp time it was fetched at.
-        struct Clock;
-        impl crate::EffectHost for Clock {
-            fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
-                None
-            }
-            fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
-                None
-            }
-            fn layer_at(&self, _: u64, t: f64, _: bool) -> Option<crate::LayerPixels> {
-                let v = (t as f32 / 4.0).clamp(0.0, 1.0);
-                Some(crate::LayerPixels { buf: Buf { img: Image::filled(6, 6, [v, 0.0, 1.0 - v, 1.0]), offset: [0.0; 2], scale: 1.0 }, size: [6.0, 6.0] })
-            }
-        }
-        let render = |kind: u32, offset: f64| {
-            let vals = [
-                ("cannonEnabled", Value::Bool(false)),
-                ("grid/gridPosition", Value::Vec2([40.0, 30.0])),
-                ("grid/particlesAcross", num(1.0)),
-                ("grid/particlesDown", num(1.0)),
-                ("gravity/gravityForce", num(0.0)),
-                ("layerMap/layerMapLayer", Value::Layer(Some(9))),
-                ("layerMap/timeOffsetType", Value::Enum(kind)),
-                ("layerMap/timeOffset", num(offset)),
-            ];
-            let env = EffectEnv { host: Some(&Clock), comp_time: 1.0, frame_rate: 10.0, ..Default::default() };
-            run_fx("ec.sim.particleplayground", &vals, Image::filled(80, 60, [0.2, 0.2, 0.2, 1.0]), 1.0, env).img
-        };
-        // The particle is a 6×6 copy of the map layer.
-        let rel = render(0, 1.0);
-        assert!(rel.get(40, 30)[3] > 0.99 && rel.get(46, 30)[3] < 0.01);
-        assert!((rel.get(40, 30)[0] - 0.5).abs() < 1e-3, "relative: now + 1 s = 2 s");
-        let abs = render(1, 3.0);
-        assert!((abs.get(40, 30)[0] - 0.75).abs() < 1e-3, "absolute: 3 s");
-    }
-
-    #[test]
-    fn cc_hair_grows_from_opaque_pixels() {
-        let mut img = Image::new(60, 60);
-        for y in 20..40 {
-            for x in 20..40 {
-                img.set(x, y, [0.8, 0.6, 0.4, 1.0]);
-            }
-        }
-        let out = run_fx("ec.sim.cchair", &[("length", num(12.0)), ("density", num(300.0))], img.clone(), 0.0, EffectEnv::default());
-        // Hair reaches beyond the square (above it: hair leans up, then droops).
-        let outside: f32 = (0..60).flat_map(|x| (0..20).map(move |y| (x, y))).map(|(x, y)| out.img.get(x, y)[3]).sum();
-        assert!(outside > 1.0, "{outside}");
-        // Nothing grows from transparent areas far away.
-        assert_eq!(out.img.get(2, 58)[3], 0.0);
-        let again = run_fx("ec.sim.cchair", &[("length", num(12.0)), ("density", num(300.0))], img.clone(), 3.0, EffectEnv::default());
-        assert_eq!(out.img.data, again.img.data);
-        let none = run_fx("ec.sim.cchair", &[("length", num(0.0))], img.clone(), 0.0, EffectEnv::default());
-        assert_eq!(none.img.data, img.data);
-    }
-}
+mod tests;
diff --git a/crates/effects/src/sim3/tests.rs b/crates/effects/src/sim3/tests.rs
new file mode 100644
index 000000000..ffce0ae6d
--- /dev/null
+++ b/crates/effects/src/sim3/tests.rs
@@ -0,0 +1,372 @@
+use super::*;
+use crate::{EffectEnv, MaskShape, run_fx};
+
+fn run(vals: &[(&str, Value)], t: f64) -> Image {
+    run_fx("ec.sim.particleplayground", vals, Image::filled(80, 60, [0.2, 0.2, 0.2, 1.0]), t, EffectEnv::default()).img
+}
+
+fn cannon(t: f64) -> Image {
+    run(&[("cannon/cannonPosition", Value::Vec2([40.0, 50.0])), ("cannon/velocity", num(60.0)), ("gravity/gravityForce", num(30.0))], t)
+}
+
+#[test]
+fn cannon_stream_is_seek_consistent() {
+    let a = cannon(1.0);
+    // Particles replace the layer: some coverage, mostly transparent, red.
+    let cov: f32 = a.data.iter().map(|p| p[3]).sum();
+    assert!(cov > 5.0, "{cov}");
+    assert!(a.data.iter().any(|p| p[3] > 0.5 && p[0] > 0.5 && p[1] < 0.1));
+    // Seek back and forth: the same frame every time.
+    let _ = cannon(2.0);
+    let b = cannon(1.0);
+    assert_eq!(a.data, b.data);
+    let c = cannon(0.5);
+    assert_ne!(a.data, c.data);
+    // Nothing has been fired at time 0.
+    let z = cannon(0.0);
+    assert!(z.data.iter().all(|p| p[3] == 0.0));
+}
+
+#[test]
+fn grid_falls_with_gravity_and_bounces_off_a_wall() {
+    let grid = |t: f64, env: EffectEnv| {
+        run_fx(
+            "ec.sim.particleplayground",
+            &[
+                ("cannonEnabled", Value::Bool(false)),
+                ("grid/gridPosition", Value::Vec2([40.0, 10.0])),
+                ("grid/gridWidth", num(40.0)),
+                ("grid/gridHeight", num(0.0)),
+                ("grid/particlesAcross", num(5.0)),
+                ("grid/particlesDown", num(1.0)),
+                ("gravity/gravityForce", num(100.0)),
+                ("wall/wallBoundary", num(1.0)),
+            ],
+            Image::new(80, 60),
+            t,
+            env,
+        )
+        .img
+    };
+    // Alpha-weighted mean height of the particles.
+    let row_of = |img: &Image| {
+        let (mut s, mut n) = (0.0f64, 0.0f64);
+        for y in 0..60 {
+            for x in 0..80 {
+                let a = img.get(x, y)[3] as f64;
+                s += (y as f64 + 0.5) * a;
+                n += a;
+            }
+        }
+        (s / n.max(1e-9)).round() as i64
+    };
+    let t0 = grid(0.0, EffectEnv::default());
+    let t1 = grid(0.5, EffectEnv::default());
+    assert_eq!(row_of(&t0), 10);
+    // ½ g t² = 12.5 px.
+    assert!((row_of(&t1) - 22).abs() <= 2, "{}", row_of(&t1));
+    // A wall (mask 1) whose floor is at y = 15 keeps them above it.
+    let masks = [MaskShape { name: "w".into(), points: vec![[0.0, 0.0], [80.0, 0.0], [80.0, 15.0], [0.0, 15.0]], closed: true, inverted: false }];
+    let env = EffectEnv { masks: &masks, ..Default::default() };
+    let w = grid(1.5, env);
+    assert!(row_of(&w) <= 16, "{}", row_of(&w));
+}
+
+#[test]
+fn repel_spreads_particles() {
+    let spread = |force: f64| {
+        let img = run(
+            &[
+                ("cannonEnabled", Value::Bool(false)),
+                ("grid/gridPosition", Value::Vec2([40.0, 30.0])),
+                ("grid/gridWidth", num(6.0)),
+                ("grid/gridHeight", num(6.0)),
+                ("grid/particlesAcross", num(3.0)),
+                ("grid/particlesDown", num(3.0)),
+                ("gravity/gravityForce", num(0.0)),
+                ("repel/repelForce", num(force)),
+                ("repel/repelForceRadius", num(20.0)),
+            ],
+            0.5,
+        );
+        let (mut x0, mut x1) = (80, 0);
+        for y in 0..60 {
+            for x in 0..80 {
+                if img.get(x, y)[3] > 0.3 {
+                    x0 = x0.min(x);
+                    x1 = x1.max(x);
+                }
+            }
+        }
+        x1 - x0
+    };
+    assert!(spread(0.2) > spread(0.0) + 4, "{} vs {}", spread(0.2), spread(0.0));
+}
+
+#[test]
+fn property_mapper_and_layer_map_read_layers() {
+    // Without a host, the layer-based features are inert (deterministic output).
+    let a = run(
+        &[
+            ("persistentPropertyMapper/mapRedTo", Value::Enum(8)),
+            ("persistentPropertyMapper/redMin", num(-50.0)),
+            ("persistentPropertyMapper/redMax", num(50.0)),
+        ],
+        0.7,
+    );
+    let b = run(
+        &[
+            ("persistentPropertyMapper/mapRedTo", Value::Enum(8)),
+            ("persistentPropertyMapper/redMin", num(-50.0)),
+            ("persistentPropertyMapper/redMax", num(50.0)),
+        ],
+        0.7,
+    );
+    assert_eq!(a.data, b.data);
+    let st = Pg { persistent: Some(mapper(Image::filled(4, 4, [1.0, 0.0, 0.5, 1.0]), [(15, 0, 0.0, 120.0), (0, 0, 0.0, 1.0), (9, 0, 0.0, 2.0)])), ..bare(1) };
+    let mut s = PgState::default();
+    s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
+    st.step(&mut s);
+    // Red 1 → X speed 120 px/s; blue 0.5 → scale 1.
+    assert!((s.parts[0].v[0] - 120.0).abs() < 1e-3);
+    assert!((s.parts[0].scale[0] - 1.0).abs() < 1e-3);
+}
+
+/// A Pg with nothing switched on.
+fn bare(seed: u32) -> Pg {
+    Pg {
+        cannon: false,
+        pos: [0.0; 2],
+        barrel_angle: 0.0,
+        barrel_radius: 0.0,
+        rate: 0.0,
+        dir_spread: 0.0,
+        vel: 0.0,
+        vel_spread: 0.0,
+        color: [1.0; 4],
+        radius: 2.0,
+        cannon_text: vec![],
+        pex_radius: 0.0,
+        pex_dispersion: 0.0,
+        pex_affects: Affects::default(),
+        gravity: [0.0; 2],
+        grav_spread: 0.0,
+        grav_affects: Affects::default(),
+        repel: 0.0,
+        repel_radius: 0.0,
+        repel_affects: Affects::default(),
+        wall: None,
+        wall_affects: Affects::default(),
+        persistent: None,
+        ephemeral: None,
+        seed,
+        bounds: [-1e6, -1e6, 1e6, 1e6],
+    }
+}
+
+fn mapper(img: Image, chans: [(u32, u32, f32, f32); 3]) -> Mapper {
+    Mapper { map: MapImg { img, k: [1.0; 2], o: [0.0; 2] }, chans, affects: Affects::default() }
+}
+
+#[test]
+fn barrel_radius_square_or_disc() {
+    let pg = |r: f32| Pg { cannon: true, barrel_radius: r, ..bare(3) };
+    let (sq, disc) = (pg(10.0), pg(-10.0));
+    let mut corner = false;
+    for id in 0..400 {
+        let a = sq.spawn(id).p;
+        assert!(a[0].abs() <= 10.0 && a[1].abs() <= 10.0);
+        // A square barrel fills its corners (both offsets in use, not a line).
+        corner |= a[0].abs() > 7.5 && a[1].abs() > 7.5;
+        let b = disc.spawn(id).p;
+        assert!(b[0].hypot(b[1]) <= 10.0 + 1e-4);
+    }
+    assert!(corner);
+    // Radius 0: every particle starts at the cannon position.
+    assert_eq!(pg(0.0).spawn(5).p, [0.0, 0.0]);
+}
+
+#[test]
+fn mapper_drives_position_and_opacity_in_ae_order() {
+    let st = Pg { persistent: Some(mapper(Image::filled(4, 4, [1.0, 0.5, 0.25, 1.0]), [(12, 0, 0.0, 30.0), (20, 0, 0.0, 1.0), (4, 0, 0.0, 1.0)])), ..bare(1) };
+    assert_eq!(MAP_TARGETS[12], "X");
+    assert_eq!(MAP_TARGETS[20], "Opacity");
+    assert_eq!(MAP_TARGETS[26], "Scale Speed");
+    let mut s = PgState::default();
+    s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
+    st.step(&mut s);
+    assert!((s.parts[0].p[0] - 30.0).abs() < 1e-3, "{:?}", s.parts[0].p);
+    assert!((s.parts[0].c[3] - 0.5).abs() < 1e-3);
+    assert!((s.parts[0].friction - 0.25).abs() < 1e-3);
+}
+
+#[test]
+fn ephemeral_mapper_holds_for_one_step_with_operators() {
+    // Ephemeral X Speed = 60 px/s (Set): the particle moves, but keeps no velocity.
+    let st = Pg { ephemeral: Some(mapper(Image::filled(4, 4, [1.0, 1.0, 1.0, 1.0]), [(15, 0, 0.0, 60.0), (0, 0, 0.0, 1.0), (0, 0, 0.0, 1.0)])), ..bare(1) };
+    let mut s = PgState::default();
+    s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
+    st.step(&mut s);
+    assert!((s.parts[0].p[0] - 2.0).abs() < 1e-4, "{:?}", s.parts[0].p);
+    assert!(s.parts[0].v[0].abs() < 1e-4);
+    // Operators: Add / Multiply / Max on the particle's own value.
+    let op = |o: u32, cur: f32| {
+        let m = mapper(Image::filled(4, 4, [1.0, 1.0, 1.0, 1.0]), [(21, o, 0.0, 3.0), (0, 0, 0.0, 1.0), (0, 0, 0.0, 1.0)]);
+        let mut q = PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID);
+        q.mass = cur;
+        m.apply(&mut q);
+        q.mass
+    };
+    assert_eq!(MAP_OPERATORS[1], "Add");
+    assert!((op(1, 2.0) - 5.0).abs() < 1e-5);
+    assert!((op(4, 2.0) - 6.0).abs() < 1e-5);
+    assert!((op(6, 5.0) - 5.0).abs() < 1e-5);
+    assert!((op(2, 5.0) - 2.0).abs() < 1e-5, "Difference");
+}
+
+#[test]
+fn affects_select_by_source_age_and_characters() {
+    let mut q = PgParticle::new([0.0; 2], [0.0; 2], [1.0; 4], 2.0, 0, SRC_CANNON);
+    let a = Affects { from: 2, ..Default::default() };
+    assert_eq!(a.weight(&q), 0.0, "grid only");
+    q.src = SRC_GRID;
+    assert_eq!(a.weight(&q), 1.0);
+    let older = Affects { age: 1.0, ..Default::default() };
+    q.age = 0.5;
+    assert_eq!(older.weight(&q), 0.0);
+    q.age = 1.5;
+    assert_eq!(older.weight(&q), 1.0);
+    let younger = Affects { age: -1.0, feather: 1.0, ..Default::default() };
+    q.age = 1.0;
+    assert!((younger.weight(&q) - 0.5).abs() < 1e-5, "feathered");
+    let chars = Affects { chars: vec!['A', 'B'], ..Default::default() };
+    q.ch = 'B' as u32;
+    assert_eq!(chars.weight(&q), 1.0);
+    q.ch = 'C' as u32;
+    assert_eq!(chars.weight(&q), 0.0);
+    // Gravity restricted to the cannon leaves grid particles in place.
+    let st = Pg { gravity: [0.0, 100.0], grav_affects: Affects { from: 1, ..Default::default() }, ..bare(1) };
+    let mut s = PgState::default();
+    s.parts.push(PgParticle::new([5.0, 5.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
+    s.parts.push(PgParticle::new([5.0, 5.0], [0.0; 2], [1.0; 4], 2.0, 1, SRC_CANNON));
+    for _ in 0..10 {
+        st.step(&mut s);
+    }
+    assert_eq!(s.parts[0].p, [5.0, 5.0]);
+    assert!(s.parts[1].p[1] > 5.0);
+}
+
+#[test]
+fn particle_exploder_bursts_big_particles() {
+    let st = Pg { pex_radius: 2.0, pex_dispersion: 30.0, ..bare(1) };
+    let mut s = PgState::default();
+    s.parts.push(PgParticle::new([50.0, 50.0], [0.0; 2], [1.0; 4], 6.0, 0, SRC_GRID));
+    s.next_id = 1;
+    st.step(&mut s);
+    assert_eq!(s.parts.len(), 9, "(6/2)² new particles");
+    assert!(s.parts.iter().all(|q| q.r == 2.0 && q.src == SRC_PARTICLE_EXPLODER));
+    st.step(&mut s);
+    assert_eq!(s.parts.len(), 9, "new particles do not burst again");
+    // Lifespan from a mapper removes particles once they are older.
+    let life = Pg { persistent: Some(mapper(Image::filled(4, 4, [1.0; 4]), [(22, 0, 0.0, 0.05), (0, 0, 0.0, 1.0), (0, 0, 0.0, 1.0)])), ..bare(1) };
+    let mut s = PgState::default();
+    s.parts.push(PgParticle::new([1.0, 1.0], [0.0; 2], [1.0; 4], 2.0, 0, SRC_GRID));
+    for _ in 0..2 {
+        life.step(&mut s);
+    }
+    assert_eq!(s.parts.len(), 1);
+    for _ in 0..3 {
+        life.step(&mut s);
+    }
+    assert!(s.parts.is_empty());
+}
+
+#[test]
+fn text_particles_draw_characters() {
+    let grid = |text: &str| {
+        run(
+            &[
+                ("cannonEnabled", Value::Bool(false)),
+                ("grid/gridPosition", Value::Vec2([40.0, 30.0])),
+                ("grid/gridWidth", num(40.0)),
+                ("grid/gridHeight", num(0.0)),
+                ("grid/particlesAcross", num(3.0)),
+                ("grid/particlesDown", num(1.0)),
+                ("grid/gridParticleRadius", num(16.0)),
+                ("gravity/gravityForce", num(0.0)),
+                ("options/gridText", Value::Str(text.into())),
+            ],
+            0.1,
+        )
+    };
+    let dots = grid("");
+    let text = grid("I-O");
+    assert_ne!(dots.data, text.data);
+    // "I" is a vertical bar: ink above and below the grid point, not a round dot.
+    assert!(text.get(20, 26)[3] > 0.3 && text.get(20, 34)[3] > 0.3, "{:?}", text.get(20, 26));
+    // A space leaves its grid point empty.
+    let gap = grid("I O");
+    assert!(gap.get(40, 30)[3] < 0.05);
+    // Cannon text: particles carry the characters in order.
+    let pg = Pg { cannon_text: vec!['A', 'B'], ..bare(1) };
+    assert_eq!(pg.spawn(0).ch, 'A' as u32);
+    assert_eq!(pg.spawn(3).ch, 'B' as u32);
+}
+
+#[test]
+fn layer_map_shows_the_map_layer_at_its_time_offset() {
+    /// A 6×6 map layer whose colour encodes the comp time it was fetched at.
+    struct Clock;
+    impl crate::EffectHost for Clock {
+        fn layer(&self, _: u64, _: bool) -> Option<crate::LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn layer_at(&self, _: u64, t: f64, _: bool) -> Option<crate::LayerPixels> {
+            let v = (t as f32 / 4.0).clamp(0.0, 1.0);
+            Some(crate::LayerPixels { buf: Buf { img: Image::filled(6, 6, [v, 0.0, 1.0 - v, 1.0]), offset: [0.0; 2], scale: 1.0 }, size: [6.0, 6.0] })
+        }
+    }
+    let render = |kind: u32, offset: f64| {
+        let vals = [
+            ("cannonEnabled", Value::Bool(false)),
+            ("grid/gridPosition", Value::Vec2([40.0, 30.0])),
+            ("grid/particlesAcross", num(1.0)),
+            ("grid/particlesDown", num(1.0)),
+            ("gravity/gravityForce", num(0.0)),
+            ("layerMap/layerMapLayer", Value::Layer(Some(9))),
+            ("layerMap/timeOffsetType", Value::Enum(kind)),
+            ("layerMap/timeOffset", num(offset)),
+        ];
+        let env = EffectEnv { host: Some(&Clock), comp_time: 1.0, frame_rate: 10.0, ..Default::default() };
+        run_fx("ec.sim.particleplayground", &vals, Image::filled(80, 60, [0.2, 0.2, 0.2, 1.0]), 1.0, env).img
+    };
+    // The particle is a 6×6 copy of the map layer.
+    let rel = render(0, 1.0);
+    assert!(rel.get(40, 30)[3] > 0.99 && rel.get(46, 30)[3] < 0.01);
+    assert!((rel.get(40, 30)[0] - 0.5).abs() < 1e-3, "relative: now + 1 s = 2 s");
+    let abs = render(1, 3.0);
+    assert!((abs.get(40, 30)[0] - 0.75).abs() < 1e-3, "absolute: 3 s");
+}
+
+#[test]
+fn cc_hair_grows_from_opaque_pixels() {
+    let mut img = Image::new(60, 60);
+    for y in 20..40 {
+        for x in 20..40 {
+            img.set(x, y, [0.8, 0.6, 0.4, 1.0]);
+        }
+    }
+    let out = run_fx("ec.sim.cchair", &[("length", num(12.0)), ("density", num(300.0))], img.clone(), 0.0, EffectEnv::default());
+    // Hair reaches beyond the square (above it: hair leans up, then droops).
+    let outside: f32 = (0..60).flat_map(|x| (0..20).map(move |y| (x, y))).map(|(x, y)| out.img.get(x, y)[3]).sum();
+    assert!(outside > 1.0, "{outside}");
+    // Nothing grows from transparent areas far away.
+    assert_eq!(out.img.get(2, 58)[3], 0.0);
+    let again = run_fx("ec.sim.cchair", &[("length", num(12.0)), ("density", num(300.0))], img.clone(), 3.0, EffectEnv::default());
+    assert_eq!(out.img.data, again.img.data);
+    let none = run_fx("ec.sim.cchair", &[("length", num(0.0))], img.clone(), 0.0, EffectEnv::default());
+    assert_eq!(none.img.data, img.data);
+}
diff --git a/crates/effects/src/stylize2.rs b/crates/effects/src/stylize2.rs
index b957b4e41..247854352 100644
--- a/crates/effects/src/stylize2.rs
+++ b/crates/effects/src/stylize2.rs
@@ -343,7 +343,7 @@ fn brush_strokes(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---- CC Kaleida ----
+// ---- Kaleidoscope ----
 
 fn kaleida(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = b.to_px(ctx.params.v2("center"));
@@ -368,7 +368,7 @@ fn kaleida(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---- CC RepeTile ----
+// ---- Edge Tile Repeat ----
 
 #[inline]
 fn tile_coord(v: f64, size: f64) -> (i64, f64) {
@@ -433,13 +433,7 @@ fn motion_tile(ctx: &EffectCtx, b: Buf) -> Buf {
     let mirror = ctx.params.b("mirrorEdges");
     let phase = ctx.params.f("phase") / 360.0;
     let hshift = ctx.params.b("horizontalPhaseShift");
-    let (nw, nh, noff) = if ctx.adjustment {
-        (b.img.width, b.img.height, b.offset)
-    } else {
-        let ow = (lw * ctx.params.f("outputWidth") / 100.0).max(1.0 / s);
-        let oh = (lh * ctx.params.f("outputHeight") / 100.0).max(1.0 / s);
-        ((ow * s).round().max(1.0) as u32, (oh * s).round().max(1.0) as u32, [(ow - lw) * 0.5 * s, (oh - lh) * 0.5 * s])
-    };
+    let (nw, nh, noff) = crate::motion_tile_frame(ctx, b.offset, (b.img.width, b.img.height), s);
     let mut out = Image::new(nw, nh);
     let src = &b.img;
     out.rows_mut().for_each(|(y, row)| {
@@ -463,7 +457,11 @@ fn motion_tile(ctx: &EffectCtx, b: Buf) -> Buf {
                     fy = 1.0 - fy;
                 }
             }
-            *px = src.sample_bilinear(fx * lw * s + b.offset[0], fy * lh * s + b.offset[1]);
+            // Clamped: a tile edge lands exactly on a pixel centre whenever the boundary does
+            // (#2820's animated Tile Center walks it across the grid), and the plain sampler
+            // would mix in the transparent outside at the source's geometric edge, leaving a
+            // half-faded seam pixel along the fold.
+            *px = src.sample_bilinear_clamped(fx * lw * s + b.offset[0], fy * lh * s + b.offset[1]);
         }
     });
     Buf { img: out, offset: noff, scale: s }
@@ -493,7 +491,7 @@ fn color_emboss(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---- CC Vignette ----
+// ---- Vignette ----
 
 fn vignette(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let amt = ctx.params.f("amount") as f32 / 100.0;
@@ -525,7 +523,7 @@ fn vignette(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ---- CC Threshold / CC Threshold RGB ----
+// ---- Channel Threshold / RGB Threshold ----
 
 fn cc_threshold(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let t = ctx.params.f("threshold") as f32 / 255.0;
@@ -671,7 +669,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.cckaleida",
-            "CC Kaleida",
+            "Kaleidoscope",
             vec![
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
                 p("size", "Size", num(100.0), slider(1.0, 1000.0, 1.0, 400.0, 1)),
@@ -682,7 +680,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.ccrepetile",
-            "CC RepeTile",
+            "Edge Tile Repeat",
             vec![
                 p("expandRight", "Expand Right", num(0.0), slider(0.0, 4000.0, 0.0, 500.0, 0)),
                 p("expandLeft", "Expand Left", num(0.0), slider(0.0, 4000.0, 0.0, 500.0, 0)),
@@ -720,7 +718,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.ccvignette",
-            "CC Vignette",
+            "Vignette",
             vec![
                 p("amount", "Amount", num(50.0), slider(-100.0, 100.0, -100.0, 100.0, 1)),
                 p("angleOfView", "Angle of View", num(60.0), slider(0.0, 179.0, 0.0, 179.0, 1)),
@@ -731,7 +729,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.ccthreshold",
-            "CC Threshold",
+            "Channel Threshold",
             vec![
                 p("threshold", "Threshold", num(127.0), thr()),
                 p("channel", "Channel", Value::Enum(0), popup(&["Luminance", "RGB", "Saturation", "Alpha"])),
@@ -742,7 +740,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.ccthresholdrgb",
-            "CC Threshold RGB",
+            "RGB Threshold",
             vec![
                 p("redThreshold", "Red Threshold", num(127.0), thr()),
                 p("greenThreshold", "Green Threshold", num(127.0), thr()),
@@ -814,6 +812,37 @@ mod tests {
         }
     }
 
+    #[test]
+    fn motion_tile_mirror_folds_stay_opaque() {
+        // A fold that lands exactly on a pixel centre samples the source's geometric edge, where
+        // the plain bilinear tap reaches half a texel into the transparent outside — a faint
+        // seam line on the mirrored boundary that sweeps the tile while Tile Center animates
+        // (#2820). The fold must repeat the edge texel instead: opaque, and exactly the pixel
+        // it mirrors.
+        let img = ramp(10, 8);
+        let out = run_at(
+            "ec.stylize.motiontile",
+            &[("tileCenter", Value::Vec2([5.0, 4.0])), ("tileWidth", num(50.0)), ("mirrorEdges", Value::Bool(true))],
+            img.clone(),
+            0.0,
+        );
+        assert_eq!((out.img.width, out.img.height), (10, 8));
+        for (x, mirrored) in [(2i64, 0i64), (7, 9)] {
+            for y in 0..i64::from(out.img.height) {
+                let a = out.img.get(x, y);
+                assert!((a[3] - 1.0).abs() < 1e-5, "fold x={x},y={y} faded to alpha {}", a[3]);
+                let b = img.get(mirrored, y);
+                for c in 0..4 {
+                    assert!((a[c] - b[c]).abs() < 1e-5, "fold x={x},y={y} channel {c}");
+                }
+            }
+        }
+        // And no pixel anywhere in the tile faded either.
+        for px in out.img.data.iter() {
+            assert!((px[3] - 1.0).abs() < 1e-5, "tile pixel faded to alpha {}", px[3]);
+        }
+    }
+
     #[test]
     fn strobe_by_time() {
         assert!(strobe_on(0.02, 0.05, 1.0, 0.0, 1));
diff --git a/crates/effects/src/stylize3.rs b/crates/effects/src/stylize3.rs
index 403c325cd..1121f737b 100644
--- a/crates/effects/src/stylize3.rs
+++ b/crates/effects/src/stylize3.rs
@@ -1,5 +1,5 @@
-//! Stylize effects, batch 3: CC Block Load, CC Burn Film, CC Glass, CC HexTile, CC Mr. Smoothie
-//! and CC Plastic.
+//! Stylize effects, batch 3: Block Reveal, Film Burn, Glass Relief, Hexagonal Tiles, Palette Map
+//! and Plastic Shading.
 //!
 //! Written from the public descriptions of what these effects do (progressive block loading,
 //! burning film, bump-mapped glass / plastic surfaces lit by an effect light, hexagonal tiling,
@@ -27,7 +27,7 @@ fn pt(x: f64, y: f64) -> Value {
     Value::Vec2([x, y])
 }
 
-// ------------------------------------------------------------------ CC Block Load
+// ------------------------------------------------------------------ Block Reveal
 
 /// Mean colour of every `s`×`s` block (grid of `ceil(w/s)`×`ceil(h/s)`).
 fn block_means(img: &Image, s: usize) -> (usize, usize, Vec<Px>) {
@@ -135,7 +135,7 @@ fn block_load(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC Burn Film
+// ------------------------------------------------------------------ Film Burn
 
 fn burn_film(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let burn = (ctx.params.f("burn") / 100.0).clamp(0.0, 1.0) as f32;
@@ -180,7 +180,7 @@ fn burn_film(ctx: &EffectCtx, mut b: Buf) -> Buf {
 
 const BUMP_PROPS: [&str; 6] = ["Red", "Green", "Blue", "Alpha", "Luminance", "Lightness"];
 
-/// The bump-map layer parameter: CC Glass's Bump Map, CC Plastic's Bump Layer.
+/// The bump-map layer parameter: Glass Relief's Bump Map, Plastic Shading's Bump Layer.
 pub fn bump_layer_id(ctx: &EffectCtx) -> &'static str {
     if ctx.params.get("bumpLayer").is_some() { "bumpLayer" } else { "bumpMap" }
 }
@@ -208,7 +208,7 @@ fn height_field(ctx: &EffectCtx, b: &Buf) -> Plane {
     pl
 }
 
-/// The effect light and surface of CC Glass / CC Plastic (shared with the GPU compositor).
+/// The effect light and surface of Glass Relief / Plastic Shading (shared with the GPU compositor).
 pub struct BumpLight {
     pub intensity: f32,
     pub color: [f32; 3],
@@ -342,7 +342,7 @@ fn plastic(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC HexTile
+// ------------------------------------------------------------------ Hexagonal Tiles
 
 /// Axial hex cell (pointy-top) containing (x, y) for circumradius `r`; returns the cell centre
 /// and integer cell coordinates.
@@ -351,7 +351,7 @@ fn hex_cell(x: f64, y: f64, r: f64) -> ((f64, f64), (i64, i64)) {
     let rr = (2.0 / 3.0 * y) / r;
     // Cube rounding.
     let (cx, cz) = (q, rr);
-    let cy = -cx - cz;
+    let cy = (-3f64.sqrt() / 3.0 * x - y / 3.0) / r;
     let (mut rx, ry, mut rz) = (cx.round(), cy.round(), cz.round());
     let (dx, dy, dz) = ((rx - cx).abs(), (ry - cy).abs(), (rz - cz).abs());
     if dx > dy && dx > dz {
@@ -364,39 +364,61 @@ fn hex_cell(x: f64, y: f64, r: f64) -> ((f64, f64), (i64, i64)) {
     ((px, py), (rx as i64, rz as i64))
 }
 
+/// Stable f64 hex-cell selection and source geometry for CPU and GPU renders.
+pub struct HexTile {
+    r: f64,
+    c: (f64, f64),
+    sn: f64,
+    cs: f64,
+    smear: f64,
+    mode: u32,
+}
+impl HexTile {
+    /// No image pixels are read; only buffer geometry and parameters are used.
+    pub fn new(ctx: &EffectCtx, b: &Buf) -> Self {
+        let r = (ctx.params.f("radius") * b.scale).max(0.5);
+        let c = b.to_px(ctx.params.v2("center"));
+        let rot = ctx.params.f("rotate").to_radians();
+        let (sn, cs) = rot.sin_cos();
+        let smear = (ctx.params.f("smearing") / 100.0).clamp(0.0, 1.0);
+        let mode = ctx.params.e("render");
+        Self { r, c, sn, cs, smear, mode }
+    }
+    /// Bilinear source position at a buffer pixel centre.
+    pub fn source_at(&self, x: u32, y: u32) -> (f64, f64) {
+        let Self { r, c: (cx, cy), sn, cs, smear, mode } = *self;
+        let (dx, dy) = (x as f64 + 0.5 - cx, y as f64 + 0.5 - cy);
+        // Into the rotated tiling frame.
+        let (u, v) = (dx * cs + dy * sn, -dx * sn + dy * cs);
+        let ((hx, hy), (qi, ri)) = hex_cell(u, v, r);
+        let (mut lu, lv) = (u - hx, v - hy);
+        let odd = (qi + ri).rem_euclid(2) == 1;
+        match mode {
+            1 if odd => lu = -lu,
+            2 if odd => lu = -lu,
+            _ => {}
+        }
+        let lv = if mode == 2 && odd { -lv } else { lv };
+        // Every tile shows the hexagon around the centre point.
+        let (ox, oy) = (lu * cs - lv * sn, lu * sn + lv * cs);
+        let (tx, ty) = (cx + ox, cy + oy);
+        let (sx, sy) = (tx + (x as f64 + 0.5 - tx) * smear, ty + (y as f64 + 0.5 - ty) * smear);
+        (sx, sy)
+    }
+}
 fn hextile(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let r = (ctx.params.f("radius") * b.scale).max(0.5);
-    let (cx, cy) = b.to_px(ctx.params.v2("center"));
-    let rot = ctx.params.f("rotate").to_radians();
-    let (sn, cs) = rot.sin_cos();
-    let smear = (ctx.params.f("smearing") / 100.0).clamp(0.0, 1.0);
-    let mode = ctx.params.e("render");
+    let geometry = HexTile::new(ctx, &b);
     let src = b.img.clone();
     b.img.rows_mut().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
-            let (dx, dy) = (x as f64 + 0.5 - cx, y as f64 + 0.5 - cy);
-            // Into the rotated tiling frame.
-            let (u, v) = (dx * cs + dy * sn, -dx * sn + dy * cs);
-            let ((hx, hy), (qi, ri)) = hex_cell(u, v, r);
-            let (mut lu, lv) = (u - hx, v - hy);
-            let odd = (qi + ri).rem_euclid(2) == 1;
-            match mode {
-                1 if odd => lu = -lu,
-                2 if odd => lu = -lu,
-                _ => {}
-            }
-            let lv = if mode == 2 && odd { -lv } else { lv };
-            // Every tile shows the hexagon around the centre point.
-            let (ox, oy) = (lu * cs - lv * sn, lu * sn + lv * cs);
-            let (tx, ty) = (cx + ox, cy + oy);
-            let (sx, sy) = (tx + (x as f64 + 0.5 - tx) * smear, ty + (y as f64 + 0.5 - ty) * smear);
+            let (sx, sy) = geometry.source_at(x as u32, y as u32);
             *px = src.sample_bilinear_clamped(sx, sy);
         }
     });
     b
 }
 
-// ------------------------------------------------------------------ CC Mr. Smoothie
+// ------------------------------------------------------------------ Palette Map
 
 const SMOOTHIE_PROPS: [&str; 8] = ["Red", "Green", "Blue", "Alpha", "Luminance", "Lightness", "Hue", "Saturation"];
 
@@ -496,7 +518,7 @@ pub fn specs() -> Vec<EffectSpec> {
     vec![
         spec(
             "ec.stylize.ccblockload",
-            "CC Block Load",
+            "Block Reveal",
             vec![
                 p("completion", "Completion", num(0.0), pct()),
                 p("scanlines", "Scanlines", Value::Bool(true), ParamUi::Checkbox),
@@ -508,7 +530,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.ccburnfilm",
-            "CC Burn Film",
+            "Film Burn",
             vec![
                 p("burn", "Burn", num(0.0), pct()),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
@@ -516,10 +538,10 @@ pub fn specs() -> Vec<EffectSpec> {
             ],
             burn_film,
         ),
-        spec("ec.stylize.ccglass", "CC Glass", glass_p, glass),
+        spec("ec.stylize.ccglass", "Glass Relief", glass_p, glass),
         spec(
             "ec.stylize.cchextile",
-            "CC HexTile",
+            "Hexagonal Tiles",
             vec![
                 p("render", "Render", Value::Enum(0), popup(&["Normal", "Mirrored", "Rotated"])),
                 p("radius", "Radius", num(50.0), slider(1.0, 4000.0, 2.0, 500.0, 1)),
@@ -531,7 +553,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.stylize.ccmrsmoothie",
-            "CC Mr. Smoothie",
+            "Palette Map",
             vec![
                 p("flowLayer", "Flow Layer", Value::Layer(None), ParamUi::Layer),
                 p("property", "Property", Value::Enum(4), popup(&SMOOTHIE_PROPS)),
@@ -543,7 +565,7 @@ pub fn specs() -> Vec<EffectSpec> {
             ],
             smoothie,
         ),
-        spec("ec.stylize.ccplastic", "CC Plastic", plastic_p, plastic),
+        spec("ec.stylize.ccplastic", "Plastic Shading", plastic_p, plastic),
     ]
 }
 
diff --git a/crates/effects/src/textfx.rs b/crates/effects/src/textfx.rs
index 34282c272..cb172dfc5 100644
--- a/crates/effects/src/textfx.rs
+++ b/crates/effects/src/textfx.rs
@@ -288,20 +288,39 @@ fn look_from(ctx: &EffectCtx, b: &Buf, on_original_id: &str) -> TextLook {
 const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
 const DAYS: [&str; 7] = ["Saturday", "Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday"];
 
-/// Proleptic Gregorian date from a day count since 2000-01-01 (a Saturday).
+/// `num_days_from_ce` of 2000-01-01: the day count since 2000-01-01 (Numbers' date epoch, a
+/// Saturday) rebased so that chrono's `num_days_from_ce` (0001-01-01 is day 1) can convert it.
+const CE_FROM_2000: i64 = 730_120;
+
+/// Days in one 400-year Gregorian cycle; the proleptic calendar repeats after it.
+const DAYS_PER_400_YEARS: i64 = 146_097;
+
+/// Proleptic Gregorian date (year, month, day, Saturday-indexed weekday) from a day count since
+/// 2000-01-01 (a Saturday), for any `i64` count.
+///
+/// chrono's `NaiveDate` stops near ±262143, but Numbers' `value` slider is a plain scalar with
+/// no range guard, so a keyframed count can run past that. The calendar repeats every 400 years,
+/// so chrono converts the day within one cycle and the whole cycles are added back as years (via
+/// i128 so `i64::MIN`/`MAX` can't overflow); the result matches the pre-chrono count for every
+/// year. The weekday comes from the same resolved date, so it can never disagree with it.
 fn date_from_days(days: i64) -> (i64, u32, u32, usize) {
-    // Days since 0000-03-01 based civil calendar conversion.
-    let z = days + 730_425; // 2000-01-01 relative to 0000-03-01
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let y = yoe + era * 400;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = (doy - (153 * mp + 2) / 5 + 1) as u32;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32;
-    let y = if m <= 2 { y + 1 } else { y };
-    (y, m, d, days.rem_euclid(7) as usize)
+    use chrono::Datelike;
+    let from_ce = i128::from(days) + i128::from(CE_FROM_2000);
+    let (cycles, rest) = (from_ce.div_euclid(i128::from(DAYS_PER_400_YEARS)), from_ce.rem_euclid(i128::from(DAYS_PER_400_YEARS)));
+    // `rest` is 0..146_097, so it is always a valid `num_days_from_ce` day inside chrono's range.
+    let date = i32::try_from(rest).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    // Unreachable fallback: every `rest` in 0..146_097 converts. 2000-01-01 keeps the epoch's date.
+    let (y, m, d, wd) = match date {
+        Some(date) => {
+            let year = i128::from(date.year()) + cycles * 400;
+            let year = i64::try_from(year).unwrap_or(if year < 0 { i64::MIN } else { i64::MAX });
+            // DAYS is Saturday-indexed; chrono counts from Sunday.
+            let wd = (date.weekday().num_days_from_sunday() as usize + 1) % 7;
+            (year, date.month(), date.day(), wd)
+        }
+        None => (2000, 1, 1, 0),
+    };
+    (y, m, d, wd)
 }
 
 fn timecode(frames: i64, fps: f64) -> String {
@@ -1123,6 +1142,10 @@ mod tests {
         assert_eq!(txt(&[("value", num(255.0)), ("type", Value::Enum(9))], 0.0), "FF");
         assert_eq!(txt(&[("value", num(0.0)), ("type", Value::Enum(6))], 0.0), "01/01/00");
         assert_eq!(txt(&[("value", num(60.0)), ("type", Value::Enum(8))], 0.0), "Wednesday, March 1, 2000");
+        // A keyframed date count past chrono's ±262143 range still renders its real date and a
+        // matching weekday (275790-09-13 is a Monday), not an epoch-derived stand-in.
+        assert_eq!(txt(&[("value", num(100_000_000.0)), ("type", Value::Enum(8))], 0.0), "Monday, September 13, 275790");
+        assert_eq!(txt(&[("value", num(-100_000_000.0)), ("type", Value::Enum(7))], 0.0), "Apr 20, -271791");
         assert_eq!(txt(&[("value", num(1.0)), ("currentTimeDate", Value::Bool(true)), ("decimalPlaces", num(1.0))], 2.0), "3.0");
         assert_ne!(
             txt(&[("value", num(100.0)), ("randomValues", Value::Bool(true))], 0.0),
@@ -1130,6 +1153,28 @@ mod tests {
         );
     }
 
+    #[test]
+    fn date_from_days_past_chrono_range() {
+        // chrono's NaiveDate stops near ±262143, but Numbers' `value` has no range guard, so a
+        // keyframed day count can run past it. The 400-year cycle keeps the real date (and a
+        // matching weekday) for every count; values from the pre-chrono formula, both directions,
+        // both sides of the 2000-01-01 epoch.
+        for (days, date, day) in [
+            (0_i64, (2000, 1, 1), "Saturday"),
+            (60, (2000, 3, 1), "Wednesday"),
+            (95_015_644, (262143, 12, 31), "Tuesday"), // chrono's last representable date
+            (100_000_000, (275790, 9, 13), "Monday"),  // past it: used to read as the epoch
+            (-96_476_616, (-262145, 12, 31), "Monday"),
+            (-100_000_000, (-271791, 4, 20), "Thursday"),
+        ] {
+            let (y, m, d, wd) = super::date_from_days(days);
+            assert_eq!((y, m, d), date, "days={days}");
+            assert_eq!(super::DAYS[wd], day, "days={days}");
+        }
+        // Extremes don't overflow (i128 intermediates).
+        let _ = (super::date_from_days(i64::MAX), super::date_from_days(i64::MIN));
+    }
+
     #[test]
     fn numbers_draws_glyph_at_position() {
         let img = Image::new(80, 60);
diff --git a/crates/effects/src/time_fx.rs b/crates/effects/src/time_fx.rs
index 27d2264e5..b9d20e2a7 100644
--- a/crates/effects/src/time_fx.rs
+++ b/crates/effects/src/time_fx.rs
@@ -1,11 +1,13 @@
 //! Time effects (Effect > Time): Echo, Posterize Time, Time Difference, Time Displacement,
-//! Timewarp, CC Force Motion Blur, CC Wide Time and Pixel Motion Blur.
+//! Timewarp, Temporal Motion Blur, Temporal Blend and Pixel Motion Blur.
 //!
 //! These read the layer at *other* layer times through [`EffectHost::self_at`]: its source with
 //! its masks and the effects applied before them, as After Effects renders them (SceneYard:
-//! Echo after CC Particle Systems II echoes the fireworks, not the black solid under them;
-//! Posterize Time after Turbulent Displace steps the displacement). Without a host (tests,
-//! thumbnails) they pass their input through.
+//! Echo after Particle Emitter 2D echoes the fireworks, not the black solid under them;
+//! Posterize Time after Turbulent Displace steps the displacement). Timewarp is the exception:
+//! it retimes the layer's source with its masks and ignores the effects above it (After
+//! Effects 2026: a red solid with a Gradient Ramp and then Timewarp shows the red solid).
+//! Without a host (tests, thumbnails) they pass their input through.
 //!
 //! Timewarp's Pixel Motion estimates block-matching optical flow between neighbouring frames
 //! ([`effectcraft_raster::flow`]); Pixel Motion Blur averages sub-frame samples.
@@ -121,7 +123,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.time.ccforcemotionblur",
-            "CC Force Motion Blur",
+            "Temporal Motion Blur",
             vec![
                 p("motionBlurLevels", "Motion Blur Levels", num(8.0), slider(2.0, 64.0, 2.0, 32.0, 0)),
                 p("overrideShutterAngle", "Override Shutter Angle", Value::Bool(true), ParamUi::Checkbox),
@@ -132,7 +134,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.time.ccwidetime",
-            "CC Wide Time",
+            "Temporal Blend",
             vec![
                 p("forwardSteps", "Forward Steps", num(3.0), slider(0.0, 45.0, 0.0, 15.0, 0)),
                 p("backwardSteps", "Backward Steps", num(3.0), slider(0.0, 45.0, 0.0, 15.0, 0)),
@@ -163,15 +165,21 @@ struct Frames {
     imgs: Vec<Image>,
 }
 
-/// Fetch the layer (source + masks) at layer times `times`. `None` without a host.
+/// Fetch the layer (source + masks + the effects before this one) at layer times `times`.
+/// `None` without a host.
 fn fetch(ctx: &EffectCtx, times: &[f64]) -> Option<Frames> {
+    fetch_with(ctx, times, usize::MAX)
+}
+
+/// [`fetch`] with the first `effects` effects of the stack only (0: source and masks).
+fn fetch_with(ctx: &EffectCtx, times: &[f64], effects: usize) -> Option<Frames> {
     let host = ctx.env.host?;
     // Dedupe times (sub-microsecond differences are the same frame).
     let mut uniq: Vec<i64> = times.iter().map(|t| (t * 1e6).round() as i64).collect();
     uniq.sort_unstable();
     uniq.dedup();
     // Every effect before this one (the host bounds the count to them).
-    let bufs: Vec<(i64, Option<Buf>)> = uniq.iter().map(|&k| (k, host.self_at(k as f64 / 1e6, usize::MAX))).collect();
+    let bufs: Vec<(i64, Option<Buf>)> = uniq.iter().map(|&k| (k, host.self_at(k as f64 / 1e6, effects))).collect();
     let first = bufs.iter().find_map(|(_, b)| b.as_ref())?;
     let scale = first.scale;
     // Union of every frame's extent in layer pixels (offset = where layer (0,0) sits).
@@ -261,6 +269,9 @@ fn mean_of(ctx: &EffectCtx, b: Buf, times: &[f64]) -> Buf {
 
 // ---------------------------------------------------------------- Echo
 
+/// Echo: the layer at the current time and `numberOfEchoes` earlier (or later) times
+/// `echoTime` apart, each weighted Starting Intensity × Decay^i and combined by the Echo Operator
+/// (Add, Maximum, Minimum, Screen, Composite In Back, Composite In Front, Blend).
 fn echo(ctx: &EffectCtx, b: Buf) -> Buf {
     let n = ctx.params.f("numberOfEchoes").round().clamp(0.0, 255.0) as usize;
     let dt = ctx.params.f("echoTime");
@@ -270,7 +281,6 @@ fn echo(ctx: &EffectCtx, b: Buf) -> Buf {
     let times: Vec<f64> = (0..=n).map(|i| ctx.time + i as f64 * dt).collect();
     let Some(fr) = fetch(ctx, &times) else { return b };
     let weights: Vec<f32> = (0..=n).map(|i| start * decay.powi(i as i32)).collect();
-    let count = (n + 1) as f32;
     let w = fr.grid.img.width;
     let h = fr.grid.img.height;
     let mut out = Image::new(w, h);
@@ -289,23 +299,26 @@ fn echo(ctx: &EffectCtx, b: Buf) -> Buf {
                 2 => (0..4).for_each(|c| acc[c] = acc[c].min(q[c])),
                 // Screen
                 3 => (0..4).for_each(|c| acc[c] = acc[c] + q[c] - acc[c] * q[c]),
-                // Composite In Back: each later echo goes behind what is there.
+                // Composite In Back: the layer goes in back, each echo is composited over what
+                // is there, the oldest on top, with its weight as opacity (After Effects 2026,
+                // opaque layer, one and three echoes). Whether the weight scales the alpha of a
+                // transparent layer's echo or fades it is not measured.
                 4 => {
-                    let ia = 1.0 - acc[3];
-                    (0..4).for_each(|c| acc[c] += q[c] * ia);
-                }
-                // Composite In Front: each later echo goes on top.
-                5 => {
                     let ia = 1.0 - q[3];
                     (0..4).for_each(|c| acc[c] = q[c] + acc[c] * ia);
                 }
-                // Blend (average) and Add
+                // Composite In Front: the layer stays in front, each echo goes behind what is
+                // there (After Effects 2026: an opaque layer hides its echo).
+                5 => {
+                    let ia = 1.0 - acc[3];
+                    (0..4).for_each(|c| acc[c] += q[c] * ia);
+                }
+                // Add, and Blend: After Effects 2026 sums the weighted frames for Blend as well,
+                // with no normalisation (3 echoes at intensity 1 give 4x the layer; intensity
+                // 0.5, decay 0.5 and 2 echoes give alpha 0.875).
                 _ => (0..4).for_each(|c| acc[c] += q[c]),
             }
         }
-        if op == 6 {
-            acc.iter_mut().for_each(|c| *c /= count);
-        }
         if op == 2 && acc[0] == f32::MAX {
             acc = [0.0; 4];
         }
@@ -451,11 +464,76 @@ fn time_displacement(ctx: &EffectCtx, b: Buf) -> Buf {
 
 // ---------------------------------------------------------------- Timewarp
 
-/// Source layer time Timewarp shows at layer time `t`.
+/// Source layer time Timewarp shows at layer time `t` when Speed is the same at every time:
+/// Source Frame maps directly, Speed (a rate in %) gives `t × speed / 100`. An animated Speed
+/// is integrated instead (see [`timewarp_integrate_speed`]).
 pub fn timewarp_source_time(t: f64, by_frame: bool, speed: f64, source_frame: f64, fps: f64) -> f64 {
     if by_frame { source_frame / fps } else { t * speed / 100.0 }
 }
 
+/// Speed samples per composition frame when integrating an animated Speed.
+const TW_SPEED_SAMPLES_PER_FRAME: f64 = 2.0;
+/// Most Speed samples one integration takes (longer spans widen the step instead).
+const TW_SPEED_MAX_SAMPLES: f64 = 50_000.0;
+
+/// Source layer time of Adjust Time By = Speed at layer time `t` with an animated Speed: Speed
+/// is a rate (100 % = real time), so the source time is the integral of `speed / 100` over layer
+/// time from 0 to `t` (toward 0 with the sign for negative `t`). `speed_at(lt)` is Speed at layer
+/// time `lt`; a missing or non-finite sample counts as `now` (the current Speed), or 0 when that
+/// is not finite either. Midpoint rule on a fixed grid from 0, [`TW_SPEED_SAMPLES_PER_FRAME`]
+/// samples per frame at `fps`, at most [`TW_SPEED_MAX_SAMPLES`] samples. A non-finite result falls back to
+/// `t × now / 100`, then to 0.
+pub fn timewarp_integrate_speed(t: f64, fps: f64, now: f64, speed_at: impl Fn(f64) -> Option<f64>) -> f64 {
+    let flat = t * now / 100.0;
+    let fallback = |v: f64| {
+        if v.is_finite() {
+            v
+        } else if flat.is_finite() {
+            flat
+        } else {
+            0.0
+        }
+    };
+    if !t.is_finite() || t == 0.0 {
+        return fallback(flat);
+    }
+    let fps = if fps.is_finite() && fps > 0.0 { fps } else { 30.0 };
+    let span = t.abs();
+    // Cells of a fixed step anchored at 0 (whole cells plus a partial last one), so successive
+    // frames share their samples and a Hold key's jump lands the same way on every frame; only a
+    // span past the sample budget widens the step.
+    let mut h = 1.0 / (fps * TW_SPEED_SAMPLES_PER_FRAME);
+    if !(span / h).is_finite() || span / h >= TW_SPEED_MAX_SAMPLES {
+        h = span / TW_SPEED_MAX_SAMPLES;
+    }
+    if !h.is_finite() || h <= 0.0 {
+        return fallback(flat);
+    }
+    let whole = (span / h).floor().clamp(0.0, TW_SPEED_MAX_SAMPLES);
+    let rest = (span - whole * h).max(0.0);
+    let sign = t.signum();
+    let held = if now.is_finite() { now } else { 0.0 };
+    let sample = |lt: f64| speed_at(sign * lt).filter(|v| v.is_finite()).unwrap_or(held);
+    // `whole` is a whole number in 0..=TW_SPEED_MAX_SAMPLES, so the count is exact.
+    let full: f64 = (0..whole as u64).map(|i| sample((i as f64 + 0.5) * h)).sum::<f64>() * h;
+    let part = if rest > 0.0 { sample(whole * h + rest * 0.5) * rest } else { 0.0 };
+    fallback(sign * (full + part) / 100.0)
+}
+
+/// Source layer time Timewarp shows at the frame: [`timewarp_source_time`], except that an
+/// animated Speed (keyframes or an expression, read through the effect host) is integrated
+/// from layer time 0 ([`timewarp_integrate_speed`]), so a speed ramp plays on from where the
+/// footage is instead of jumping to another segment.
+fn timewarp_source(ctx: &EffectCtx, by_frame: bool, speed: f64, fps: f64) -> f64 {
+    let direct = timewarp_source_time(ctx.time, by_frame, speed, ctx.params.f("sourceFrame"), fps);
+    if by_frame {
+        return direct;
+    }
+    let idx = ctx.env.effect_index;
+    let Some(host) = ctx.env.host.filter(|h| !h.param_is_static(idx, "speed")) else { return direct };
+    timewarp_integrate_speed(ctx.time, fps, speed, |lt| host.param_at(idx, "speed", lt).map(|v| v.as_f64()))
+}
+
 /// Timewarp's Pixel Motion settings (the Tuning group and Source Crops).
 #[derive(Clone, Copy, Debug)]
 pub struct PixelMotion {
@@ -747,7 +825,7 @@ fn timewarp_instants(ctx: &EffectCtx) -> (Vec<(f64, f32)>, Vec<f64>, f64) {
     let fps = ctx.fps();
     let by_frame = ctx.params.e("adjustTimeBy") == 1;
     let speed = ctx.params.f("speed");
-    let src = timewarp_source_time(ctx.time, by_frame, speed, ctx.params.f("sourceFrame"), fps);
+    let src = timewarp_source(ctx, by_frame, speed, fps);
     let mut instants: Vec<(f64, f32)> = vec![];
     if ctx.params.b("motionBlur/enableMotionBlur") {
         let angle = if ctx.params.e("motionBlur/shutterControl") == 1 { ctx.params.f("motionBlur/shutterAngle") } else { 180.0 };
@@ -786,7 +864,8 @@ pub fn timewarp_plan(ctx: &EffectCtx) -> Option<TimewarpPlan> {
     let (instants, times, fps) = timewarp_instants(ctx);
     let method = ctx.params.e("method");
     let one = method > 0 && ctx.params.b("tuning/buildFromOneImage");
-    let fr = fetch(ctx, &times)?;
+    // The source with its masks, without the effects above Timewarp.
+    let fr = fetch_with(ctx, &times, 0)?;
     let pm = PixelMotion::from(ctx, fr.grid.scale);
     let mattes = fetch_layer(ctx, "matteLayer", &times, &fr.grid);
     let warps = fetch_layer(ctx, "warpLayer", &times, &fr.grid);
@@ -879,7 +958,8 @@ pub fn timewarp_plan(ctx: &EffectCtx) -> Option<TimewarpPlan> {
 /// vectors (block-matching optical flow, [`effectcraft_raster::flow`]) tuned by the Tuning
 /// group. A Matte Layer splits foreground and background so each moves on its own vectors; a
 /// Warp Layer supplies the motion instead of the layer itself. Motion Blur averages Shutter
-/// Samples instants across the shutter.
+/// Samples instants across the shutter. Adjust Time By = Speed treats Speed as a rate
+/// integrated from layer time 0 (keyframing it ramps the playback speed).
 fn timewarp(ctx: &EffectCtx, b: Buf) -> Buf {
     match timewarp_plan(ctx) {
         Some(plan) => plan.render_cpu(),
@@ -914,7 +994,7 @@ fn matte_image(m: &[f32], like: &Image) -> Image {
     out
 }
 
-// ---------------------------------------------------------------- CC Force Motion Blur / CC Wide Time / Pixel Motion Blur
+// ---------------------------------------------------------------- Temporal Motion Blur / Temporal Blend / Pixel Motion Blur
 
 fn force_motion_blur(ctx: &EffectCtx, b: Buf) -> Buf {
     let n = ctx.params.f("motionBlurLevels").round().clamp(2.0, 64.0) as usize;
@@ -1016,8 +1096,8 @@ mod tests {
             None
         }
         fn self_at(&self, t: f64, effects: usize) -> Option<Buf> {
-            // Time effects see every effect before them.
-            assert_eq!(effects, usize::MAX);
+            // Time effects see every effect before them; Timewarp only the source and masks.
+            assert!(effects == usize::MAX || effects == 0, "{effects}");
             let v = if self.static_layer { 0.4 } else { t as f32 };
             Some(Buf { img: Image::filled(6, 4, [v, v, v, 1.0]), offset: [0.0; 2], scale: 1.0 })
         }
@@ -1028,6 +1108,32 @@ mod tests {
         run_fx(id, vals, Image::filled(6, 4, [0.9, 0.0, 0.0, 1.0]), t, env)
     }
 
+    /// After Effects 2026: Timewarp retimes the layer's source (with masks) and ignores the
+    /// effects above it; Echo keeps them.
+    #[test]
+    fn timewarp_reads_the_source_without_the_effects_above_it() {
+        struct Asked(std::sync::Mutex<Vec<usize>>);
+        impl EffectHost for Asked {
+            fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+                None
+            }
+            fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+                None
+            }
+            fn self_at(&self, _: f64, effects: usize) -> Option<Buf> {
+                self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(effects);
+                // The source (effects 0) is red, the layer with its effects green.
+                let c = if effects == 0 { [1.0, 0.0, 0.0, 1.0] } else { [0.0, 1.0, 0.0, 1.0] };
+                Some(Buf { img: Image::filled(6, 4, c), offset: [0.0; 2], scale: 1.0 })
+            }
+        }
+        let host = Asked(std::sync::Mutex::new(vec![]));
+        let env = EffectEnv { host: Some(&host), frame_rate: 10.0, comp_time: 1.0, ..Default::default() };
+        let out = run_fx("ec.time.timewarp", &[("speed", num(25.0))], Image::filled(6, 4, [0.0, 1.0, 0.0, 1.0]), 1.0, env);
+        assert_eq!(out.img.get(2, 2), [1.0, 0.0, 0.0, 1.0]);
+        assert!(host.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).iter().all(|&e| e == 0));
+    }
+
     #[test]
     fn posterize_time_holds_frames() {
         let h = Clock { static_layer: false };
@@ -1046,7 +1152,7 @@ mod tests {
         let want = 0.8 + 0.5 * 0.7 + 0.25 * 0.6;
         assert!((out.img.data[0][0] - want as f32).abs() < 1e-4, "{}", out.img.data[0][0]);
         assert_eq!(out.img.data[0][3], 1.0);
-        // Maximum picks the brightest weighted frame; Blend averages.
+        // Maximum picks the brightest weighted frame; Blend sums like Add (#3124).
         let mut v = vals.to_vec();
         v.push(("echoOperator", Value::Enum(1)));
         let out = run("ec.time.echo", &v, 0.8, &h);
@@ -1054,7 +1160,136 @@ mod tests {
         v.pop();
         v.push(("echoOperator", Value::Enum(6)));
         let out = run("ec.time.echo", &v, 0.8, &h);
-        assert!((out.img.data[0][0] - want as f32 / 3.0).abs() < 1e-4);
+        assert!((out.img.data[0][0] - want as f32).abs() < 1e-4, "{}", out.img.data[0][0]);
+    }
+
+    /// Row y = 130, x = 60..111 of the importer sample's SRC test card (#3124): a black-to-white
+    /// ramp across 320 px under an opaque white 30 px square whose centre moves from x = 20 at
+    /// 0 s to x = 300 at 2 s.
+    struct MovingSquare;
+    impl EffectHost for MovingSquare {
+        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn self_at(&self, t: f64, _: usize) -> Option<Buf> {
+            let centre = 20.0 + 140.0 * t;
+            let (s0, s1) = (centre - 15.0, centre + 15.0);
+            let mut img = Image::new(52, 1);
+            for (i, px) in img.data.iter_mut().enumerate() {
+                let x = 60.0 + i as f64;
+                let cover = ((x + 1.0).min(s1) - x.max(s0)).clamp(0.0, 1.0) as f32;
+                let ramp = ((x + 0.5) / 320.0) as f32;
+                let v = cover + (1.0 - cover) * ramp;
+                *px = [v, v, v, 1.0];
+            }
+            Some(Buf { img, offset: [0.0; 2], scale: 1.0 })
+        }
+    }
+
+    /// After Effects 2026 renders of that row at 0.5 s, Echo Time −1/30 s, one echo, Starting
+    /// Intensity 1, Decay 1 (renders/echo-00 ... echo-10 of the 2026-11-05 importer sample, 32 bpc,
+    /// saved as 8-bit PNGs that hold floor(value × 25.5)).
+    #[rustfmt::skip]
+    const AE_ECHO_ROW: [(u32, &str, [u8; 52]); 6] = [
+        (0, "Add", [9, 9, 9, 10, 10, 10, 10, 10, 10, 11, 24, 31, 31, 31, 31, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 39, 33, 33, 33, 33, 16, 16, 17, 17, 17, 17, 17]),
+        (1, "Maximum", [4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 18, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 8, 8, 8, 8, 8, 8, 8]),
+        (2, "Minimum", [4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 13, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8]),
+        (3, "Screen", [8, 8, 8, 9, 9, 9, 9, 9, 9, 9, 20, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 14, 14, 14, 14, 14, 14, 14]),
+        (4, "Composite In Back", [4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 18, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 13, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8]),
+        (5, "Composite In Front", [4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 8, 8, 8, 8, 8, 8, 8]),
+    ];
+
+    /// #3124: every operator but Blend against the After Effects row. Composite In Back puts
+    /// the echo over the layer (the trailing echo hides the square's leading edge), In Front
+    /// keeps the layer on top (the output is the current frame).
+    #[test]
+    fn echo_operators_match_after_effects_at_the_moving_edge() {
+        let h = MovingSquare;
+        for (op, name, ae) in AE_ECHO_ROW {
+            let vals = [("echoTime", num(-1.0 / 30.0)), ("numberOfEchoes", num(1.0)), ("echoOperator", Value::Enum(op))];
+            let env = EffectEnv { host: Some(&h), frame_rate: 25.0, comp_time: 0.5, ..Default::default() };
+            let out = run_fx("ec.time.echo", &vals, Image::new(52, 1), 0.5, env);
+            for (x, want) in ae.iter().enumerate() {
+                let got = (out.img.data[x][0] * 25.5).floor();
+                assert!((got - f32::from(*want)).abs() <= 1.0, "{name}: x = {} got {got}, After Effects {want}", 60 + x);
+                assert_eq!(out.img.data[x][3], 1.0, "{name}: alpha at x = {}", 60 + x);
+            }
+        }
+    }
+
+    /// Row y = 130, x = 36..111 of the same test card as read back from 16-bit renders: there the
+    /// ramp is x / 320 at the pixel's left edge (the 8-bit row above cannot tell that apart).
+    struct MovingSquareRow16;
+    impl EffectHost for MovingSquareRow16 {
+        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn self_at(&self, t: f64, _: usize) -> Option<Buf> {
+            let centre = 20.0 + 140.0 * t;
+            let (s0, s1) = (centre - 15.0, centre + 15.0);
+            let mut img = Image::new(76, 1);
+            for (i, px) in img.data.iter_mut().enumerate() {
+                let x = 36.0 + i as f64;
+                let cover = ((x + 1.0).min(s1) - x.max(s0)).clamp(0.0, 1.0);
+                let v = (cover + (1.0 - cover) * x / 320.0) as f32;
+                *px = [v, v, v, 1.0];
+            }
+            Some(Buf { img, offset: [0.0; 2], scale: 1.0 })
+        }
+    }
+
+    /// After Effects 2026 renders of that row at 0.5 s (renders/echo-13 ... echo-16 of the
+    /// 2026-11-05 importer sample, group 1110-extra, 32 bpc, 16-bit PNGs holding value × 6553.5):
+    /// operator, Echo Time, Number Of Echoes, Starting Intensity, Decay, alpha code, row codes.
+    #[rustfmt::skip]
+    const AE_ECHO_ROW16: [(u32, f64, f64, f64, f64, u16, [u16; 76]); 4] = [
+        (6, -1.0 / 30.0, 3.0, 1.0, 1.0, 65535, [2949, 3031, 3111, 3193, 3275, 3357, 3439, 3521, 3603, 3685, 3767, 3849, 3931, 4013, 4095, 4177, 4259, 4341, 4423, 4505, 4587, 4669, 4751, 4833, 4915, 10301, 10361, 10423, 10485, 12293, 15809, 15851, 15891, 15933, 19369, 21113, 21135, 21155, 21175, 26205, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 26213, 21523, 21543, 21565, 21585, 20063, 17039, 17079, 17121, 17161, 14215, 12759, 12819, 12881, 12943, 8607, 8683, 8765, 8847, 8929, 9011, 9093]),
+        (6, -1.0 / 30.0, 2.0, 0.5, 0.5, 57343, [643, 661, 679, 697, 715, 733, 751, 769, 787, 805, 823, 839, 859, 877, 895, 911, 929, 949, 965, 983, 1001, 1021, 1037, 1055, 1073, 1091, 1109, 1127, 1145, 1381, 1831, 1847, 1861, 1877, 2743, 3183, 3193, 3203, 3213, 5727, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5733, 5541, 5159, 5163, 5165, 5167, 4423, 4051, 4059, 4065, 4073, 1883, 1897, 1917, 1933, 1951, 1969, 1987]),
+        (4, -0.08, 3.0, 1.0, 0.5, 65535, [737, 757, 777, 797, 819, 1267, 1571, 1589, 1607, 1625, 1643, 1661, 1679, 1697, 1715, 1733, 2229, 2965, 2977, 2991, 3005, 3017, 3031, 3045, 3059, 3071, 3085, 3443, 4833, 4839, 4845, 4853, 4859, 4865, 4873, 4497, 4251, 4261, 4269, 5923, 5927, 5931, 5933, 5935, 5939, 5941, 5517, 4885, 4891, 4899, 4905, 4913, 4919, 4927, 4933, 4941, 4947, 4649, 3443, 3457, 3471, 3485, 3497, 3511, 3525, 3539, 3553, 3567, 3581, 2151, 2169, 2191, 2211, 2231, 2251, 2273]),
+        (5, -0.08, 3.0, 1.0, 0.5, 65535, [737, 757, 777, 797, 819, 839, 859, 879, 901, 921, 941, 961, 983, 1003, 1023, 1043, 1063, 1085, 1105, 1125, 1145, 1167, 1187, 1207, 1227, 1249, 1269, 1289, 1309, 1331, 1351, 1371, 1391, 1413, 1433, 1453, 1473, 1495, 1515, 6545, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 6553, 2157, 2169, 2191, 2211, 2231, 2251, 2273]),
+    ];
+
+    /// #3124: Blend sums the weighted frames like Add (no normalisation, Starting Intensity weights
+    /// the current frame too), and with three echoes Composite In Back stacks the oldest echo on
+    /// top while In Front leaves the opaque current frame alone. The alpha is checked as measured.
+    /// The RGB comparison of the half-transparent Blend row reads the PNG as premultiplied colour
+    /// (`saveFrameToPng` does not document which it writes); the opaque rows do not depend on it.
+    #[test]
+    fn echo_blend_and_three_echo_composites_match_after_effects() {
+        let h = MovingSquareRow16;
+        for (op, dt, n, start, decay, alpha, ae) in AE_ECHO_ROW16 {
+            let vals = [
+                ("echoTime", num(dt)),
+                ("numberOfEchoes", num(n)),
+                ("startingIntensity", num(start)),
+                ("decay", num(decay)),
+                ("echoOperator", Value::Enum(op)),
+            ];
+            let env = EffectEnv { host: Some(&h), frame_rate: 25.0, comp_time: 0.5, ..Default::default() };
+            let out = run_fx("ec.time.echo", &vals, Image::new(76, 1), 0.5, env);
+            // Pixels a square edge passes through: After Effects anti-aliases the card's square a
+            // little differently from the box coverage above, so they get 24 codes (0.4 %).
+            let edges: Vec<f64> = (0..=n as usize)
+                .flat_map(|i| {
+                    let c = 20.0 + 140.0 * (0.5 + i as f64 * dt);
+                    [(c - 15.0).floor(), (c + 15.0).floor()]
+                })
+                .collect();
+            for (x, want) in ae.iter().enumerate() {
+                let px = out.img.data[x];
+                let got = px[0] * 6553.5;
+                let tol = if edges.contains(&(36.0 + x as f64)) { 24.0 } else { 4.0 };
+                assert!((got - f32::from(*want)).abs() <= tol, "op {op}, n {n}: x = {} got {got}, After Effects {want}", 36 + x);
+                let a = px[3] * 65535.0;
+                assert!((a - f32::from(alpha)).abs() <= 2.0, "op {op}, n {n}: alpha at x = {} got {a}, After Effects {alpha}", 36 + x);
+            }
+        }
     }
 
     #[test]
@@ -1188,6 +1423,88 @@ mod tests {
         assert!(out.img.data[0][0] > 1.0);
     }
 
+    /// [`Clock`] whose Timewarp (effect 2) Speed is animated: `speed(lt)` at layer time `lt`.
+    struct Ramp {
+        speed: fn(f64) -> f64,
+    }
+    impl EffectHost for Ramp {
+        fn layer(&self, _: u64, _: bool) -> Option<LayerPixels> {
+            None
+        }
+        fn audio(&self, _: u64, _: f64, _: usize, _: u32) -> Option<Vec<f32>> {
+            None
+        }
+        fn self_at(&self, t: f64, _: usize) -> Option<Buf> {
+            let v = t as f32;
+            Some(Buf { img: Image::filled(6, 4, [v, v, v, 1.0]), offset: [0.0; 2], scale: 1.0 })
+        }
+        /// Timewarp's (effect 2) Speed follows `speed`; every other parameter is unknown.
+        fn param_at(&self, effect_index: usize, id: &str, lt: f64) -> Option<Value> {
+            (effect_index == 2 && id == "speed").then(|| num((self.speed)(lt)))
+        }
+        /// Only Timewarp's (effect 2) Speed is animated.
+        fn param_is_static(&self, effect_index: usize, id: &str) -> bool {
+            !(effect_index == 2 && id == "speed")
+        }
+    }
+
+    fn run_ramp(vals: &[(&str, Value)], t: f64, host: &Ramp) -> Buf {
+        let env = EffectEnv { host: Some(host), frame_rate: 10.0, comp_time: t, effect_index: 2, ..Default::default() };
+        run_fx("ec.time.timewarp", vals, Image::filled(6, 4, [0.9, 0.0, 0.0, 1.0]), t, env)
+    }
+
+    /// #2803: an animated Speed is a rate integrated from layer time 0, so a speed ramp plays on
+    /// from where the footage is instead of jumping to another segment.
+    #[test]
+    fn timewarp_integrates_animated_speed() {
+        // Speed 100 % for the first second, then 50 %: at t = 2 s the source is 1 + 0.5 = 1.5 s
+        // (`t × speed` would jump back to 1.0 s).
+        let h = Ramp { speed: |lt| if lt < 1.0 { 100.0 } else { 50.0 } };
+        let vals = [("method", Value::Enum(0)), ("speed", num(50.0))];
+        let out = run_ramp(&vals, 2.0, &h);
+        assert!((out.img.data[0][0] - 1.5).abs() < 1e-4, "{}", out.img.data[0][0]);
+        // Continuous across the change: just past 1 s the source is just past 1 s.
+        let out = run_ramp(&vals, 1.2, &h);
+        assert!((out.img.data[0][0] - 1.1).abs() < 1e-4, "{}", out.img.data[0][0]);
+        // Negative layer time integrates toward 0.
+        let src = timewarp_integrate_speed(-2.0, 10.0, 50.0, |lt| Some(if lt > -1.0 { 100.0 } else { 50.0 }));
+        assert!((src + 1.5).abs() < 1e-9, "{src}");
+        // A Hold key between samples (1.03 s) lands the same way on every frame: past it, each
+        // 0.1 s frame advances the source by exactly 50 % of a frame.
+        let hold = |lt: f64| Some(if lt < 1.03 { 100.0 } else { 50.0 });
+        let at = |t: f64| timewarp_integrate_speed(t, 10.0, 50.0, hold);
+        for k in 12..40 {
+            let (a, b) = (at((k - 1) as f64 / 10.0), at(k as f64 / 10.0));
+            assert!((b - a - 0.05).abs() < 1e-9, "k={k}: {}", b - a);
+        }
+        // A static Speed keeps `t × speed / 100` exactly.
+        assert_eq!(timewarp_source_time(2.0, false, 37.0, 0.0, 10.0), 2.0 * 37.0 / 100.0);
+        // Source Frame mode ignores Speed.
+        let out = run_ramp(&[("method", Value::Enum(0)), ("adjustTimeBy", Value::Enum(1)), ("sourceFrame", num(3.0))], 2.0, &h);
+        assert!((out.img.data[0][0] - 0.3).abs() < 1e-5);
+    }
+
+    /// Never crash: non-finite or huge Speeds, times and frame rates give finite source times
+    /// and pixels.
+    #[test]
+    fn timewarp_animated_speed_survives_bad_values() {
+        // Non-finite samples count as the current Speed (or 0); the result is always finite.
+        for t in [0.0, 1.0, -3.0, 1e9, f64::MAX, f64::INFINITY, f64::NAN] {
+            for now in [50.0, f64::NAN, f64::INFINITY, 1e308] {
+                let src = timewarp_integrate_speed(t, 10.0, now, |lt| Some(if lt < 0.5 { f64::NAN } else { 1e308 }));
+                assert!(src.is_finite(), "t={t} now={now}: {src}");
+                let src = timewarp_integrate_speed(t, f64::NAN, now, |_| None);
+                assert!(src.is_finite(), "t={t} now={now}: {src}");
+            }
+        }
+        let h = Ramp { speed: |lt| if lt < 1.0 { f64::NAN } else { f64::INFINITY } };
+        let out = run_ramp(&[("method", Value::Enum(2)), ("speed", num(50.0)), ("motionBlur/enableMotionBlur", Value::Bool(true))], 2.0, &h);
+        assert!(out.img.data.iter().all(|p| p.iter().all(|c| c.is_finite())));
+        let h = Ramp { speed: |_| 1e308 };
+        let out = run_ramp(&[("method", Value::Enum(1)), ("speed", num(1e308))], 2.0, &h);
+        assert!(out.img.data.iter().all(|p| p.iter().all(|c| c.is_finite())));
+    }
+
     #[test]
     fn time_displacement_uses_luma_as_offset() {
         // Static map from a bright self frame: luminance 1.0 → +max seconds.
diff --git a/crates/effects/src/transition.rs b/crates/effects/src/transition.rs
index 23e54bb6b..da3e85694 100644
--- a/crates/effects/src/transition.rs
+++ b/crates/effects/src/transition.rs
@@ -1,5 +1,5 @@
 //! Transition effects (batch 2): Block Dissolve, Gradient Wipe (gradient layer or self), Iris Wipe, Card
-//! Wipe (3D cards with camera, lighting and jitter), CC Grid Wipe, CC Radial ScaleWipe, CC Scale Wipe and CC Light Wipe.
+//! Wipe (3D cards with camera, lighting and jitter), Grid Wipe, Radial Scale Wipe, Scale Wipe and Light Wipe.
 //!
 //! Every transition is the identity at 0 % completion. Angles are clockwise from "up".
 
@@ -314,53 +314,86 @@ pub(crate) fn card_wipe_plan(ctx: &EffectCtx, b: &Buf) -> Option<PiecePlan> {
     Some(PiecePlan { pieces, front: PieceTex::Layer, back })
 }
 
+/// Double-precision grid geometry, shared with the GPU mask upload. A tiny
+/// rounding error at a tile boundary can otherwise flip a fully opaque pixel.
+pub struct GridWipe {
+    c: (f64, f64),
+    s: f64,
+    co: f64,
+    cs: f64,
+    maxd: f64,
+    shape: u32,
+    reverse: bool,
+    done: f64,
+    border: f64,
+}
+
+impl GridWipe {
+    /// Construct from buffer geometry; no pixel data is accessed.
+    pub fn new(ctx: &EffectCtx, b: &Buf) -> Self {
+        let done = completion(ctx);
+        let c = b.to_px(ctx.params.v2("center"));
+        let rot = ctx.params.f("rotation").to_radians();
+        let border = ctx.params.f("border").max(0.0) * b.scale;
+        let tiles = ctx.params.f("tiles").round().clamp(1.0, 500.0);
+        let shape = ctx.params.e("shape");
+        let reverse = ctx.params.b("reverse");
+        let (_, _, w, _) = layer_rect(ctx, b);
+        let cs = (w / tiles).max(1.0);
+        let (s, co) = rot.sin_cos();
+        let metric = |dx: f64, dy: f64| match shape {
+            0 => dx.abs(),
+            2 => dx.abs().max(dy.abs()),
+            _ => dx.hypot(dy),
+        };
+        let maxd = max_corner_dist(b, c, |dx, dy| {
+            let (qx, qy) = (dx * co + dy * s, -dx * s + dy * co);
+            metric(qx, qy)
+        });
+        GridWipe { c, s, co, cs, maxd, shape, reverse, done, border }
+    }
+
+    /// Alpha multiplier at a buffer pixel centre.
+    pub fn coverage(&self, x: u32, y: u32) -> f32 {
+        let Self { c, s, co, cs, maxd, shape, reverse, done, border } = *self;
+        let metric = |dx: f64, dy: f64| match shape {
+            0 => dx.abs(),
+            2 => dx.abs().max(dy.abs()),
+            _ => dx.hypot(dy),
+        };
+        let spread = 0.25;
+        let (dx, dy) = (x as f64 + 0.5 - c.0, y as f64 + 0.5 - c.1);
+        let (qx, qy) = (dx * co + dy * s, -dx * s + dy * co);
+        let (cx, cy) = (((qx / cs).floor() + 0.5) * cs, ((qy / cs).floor() + 0.5) * cs);
+        let mut o = (metric(cx, cy) / maxd).clamp(0.0, 1.0);
+        if reverse {
+            o = 1.0 - o;
+        }
+        let p = ((done * (1.0 + spread) - o) / spread).clamp(0.0, 1.0);
+        if p <= 0.0 {
+            return 1.0;
+        }
+        let half = cs * 0.5 * (1.0 - p);
+        let m = (qx - cx).abs().max((qy - cy).abs());
+        let k = if border > 0.0 {
+            ((half - m) / border + 0.5).clamp(0.0, 1.0)
+        } else if m < half {
+            1.0
+        } else {
+            0.0
+        };
+        k as f32
+    }
+}
+
 fn grid_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
-    let done = completion(ctx);
-    if done <= 0.0 {
+    if completion(ctx) <= 0.0 {
         return b;
     }
-    let c = b.to_px(ctx.params.v2("center"));
-    let rot = ctx.params.f("rotation").to_radians();
-    let border = ctx.params.f("border").max(0.0) * b.scale;
-    let tiles = ctx.params.f("tiles").round().clamp(1.0, 500.0);
-    let shape = ctx.params.e("shape");
-    let reverse = ctx.params.b("reverse");
-    let (_, _, w, _) = layer_rect(ctx, &b);
-    let cs = (w / tiles).max(1.0);
-    let (s, co) = rot.sin_cos();
-    let metric = |dx: f64, dy: f64| match shape {
-        0 => dx.abs(),
-        2 => dx.abs().max(dy.abs()),
-        _ => dx.hypot(dy),
-    };
-    let maxd = max_corner_dist(&b, c, |dx, dy| {
-        let (qx, qy) = (dx * co + dy * s, -dx * s + dy * co);
-        metric(qx, qy)
-    });
-    let spread = 0.25;
+    let grid = GridWipe::new(ctx, &b);
     b.img.rows_mut().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
-            let (dx, dy) = (x as f64 + 0.5 - c.0, y as f64 + 0.5 - c.1);
-            let (qx, qy) = (dx * co + dy * s, -dx * s + dy * co);
-            let (cx, cy) = (((qx / cs).floor() + 0.5) * cs, ((qy / cs).floor() + 0.5) * cs);
-            let mut o = (metric(cx, cy) / maxd).clamp(0.0, 1.0);
-            if reverse {
-                o = 1.0 - o;
-            }
-            let p = ((done * (1.0 + spread) - o) / spread).clamp(0.0, 1.0);
-            if p <= 0.0 {
-                continue;
-            }
-            let half = cs * 0.5 * (1.0 - p);
-            let m = (qx - cx).abs().max((qy - cy).abs());
-            let k = if border > 0.0 {
-                ((half - m) / border + 0.5).clamp(0.0, 1.0)
-            } else if m < half {
-                1.0
-            } else {
-                0.0
-            };
-            scale_px(px, k as f32);
+            scale_px(px, grid.coverage(x as u32, y as u32));
         }
     });
     b
@@ -562,7 +595,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.ccgridwipe",
-            "CC Grid Wipe",
+            "Grid Wipe",
             vec![
                 cc_done(),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
@@ -576,13 +609,13 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.ccradialscalewipe",
-            "CC Radial ScaleWipe",
+            "Radial Scale Wipe",
             vec![cc_done(), p("center", "Center", pt(0.5, 0.5), ParamUi::Point), p("reverse", "Reverse Transition", Value::Bool(false), ParamUi::Checkbox)],
             radial_scale_wipe,
         ),
         spec(
             "ec.transition.ccscalewipe",
-            "CC Scale Wipe",
+            "Scale Wipe",
             vec![
                 p("stretch", "Stretch", num(0.0), slider(0.0, 1000.0, 0.0, 50.0, 2)),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
@@ -592,7 +625,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.cclightwipe",
-            "CC Light Wipe",
+            "Light Wipe",
             vec![
                 cc_done(),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
diff --git a/crates/effects/src/transition2.rs b/crates/effects/src/transition2.rs
index 2e1738b28..6f19a660b 100644
--- a/crates/effects/src/transition2.rs
+++ b/crates/effects/src/transition2.rs
@@ -1,5 +1,5 @@
-//! Transition effects, batch 2: CC Glass Wipe, CC Image Wipe, CC Jaws, CC Line Sweep,
-//! CC Twister and CC WarpoMatic.
+//! Transition effects, batch 2: Glass Wipe, Luminance Image Wipe, Serrated Wipe, Line Sweep,
+//! Twist Wipe and Warp Dissolve.
 //!
 //! Written from the public descriptions of these transitions (gradient-driven wipes with glass
 //! refraction or warping, jagged "jaws" opening, staggered line sweeps, a ribbon twist that
@@ -68,7 +68,7 @@ fn grad(pl: &Plane, x: usize, y: usize) -> (f32, f32) {
     ((pl.get_clamped(xi + 1, yi) - pl.get_clamped(xi - 1, yi)) * 0.5, (pl.get_clamped(xi, yi + 1) - pl.get_clamped(xi, yi - 1)) * 0.5)
 }
 
-// ------------------------------------------------------------------ CC Glass Wipe
+// ------------------------------------------------------------------ Glass Wipe
 
 fn glass_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = completion(ctx);
@@ -105,7 +105,7 @@ fn glass_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC Image Wipe
+// ------------------------------------------------------------------ Luminance Image Wipe
 
 fn image_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = completion(ctx);
@@ -132,7 +132,7 @@ fn image_wipe(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC Jaws
+// ------------------------------------------------------------------ Serrated Wipe
 
 fn jaws(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = completion(ctx) as f64;
@@ -193,7 +193,7 @@ fn jaws(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC Line Sweep
+// ------------------------------------------------------------------ Line Sweep
 
 fn line_sweep(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = completion(ctx) as f64;
@@ -235,7 +235,7 @@ fn line_sweep(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC Twister
+// ------------------------------------------------------------------ Twist Wipe
 
 fn twister(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = completion(ctx) as f64;
@@ -283,7 +283,7 @@ fn twister(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-// ------------------------------------------------------------------ CC WarpoMatic
+// ------------------------------------------------------------------ Warp Dissolve
 
 fn warpomatic(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let c = completion(ctx);
@@ -350,7 +350,7 @@ pub fn specs() -> Vec<EffectSpec> {
     vec![
         spec(
             "ec.transition.ccglasswipe",
-            "CC Glass Wipe",
+            "Glass Wipe",
             vec![
                 done(),
                 p("layerToReveal", "Layer to Reveal", Value::Layer(None), ParamUi::Layer),
@@ -362,7 +362,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.ccimagewipe",
-            "CC Image Wipe",
+            "Luminance Image Wipe",
             vec![
                 done(),
                 p("borderSoftness", "Border Softness", num(0.0), pct()),
@@ -376,7 +376,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.ccjaws",
-            "CC Jaws",
+            "Serrated Wipe",
             vec![
                 done(),
                 p("center", "Center", pt(0.5, 0.5), ParamUi::Point),
@@ -389,7 +389,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.cclinesweep",
-            "CC Line Sweep",
+            "Line Sweep",
             vec![
                 done(),
                 p("direction", "Direction", num(0.0), ParamUi::Angle),
@@ -401,7 +401,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.cctwister",
-            "CC Twister",
+            "Twist Wipe",
             vec![
                 done(),
                 p("backside", "Backside", Value::Layer(None), ParamUi::Layer),
@@ -413,7 +413,7 @@ pub fn specs() -> Vec<EffectSpec> {
         ),
         spec(
             "ec.transition.ccwarpomatic",
-            "CC WarpoMatic",
+            "Warp Dissolve",
             vec![
                 done(),
                 p("layerToReveal", "Layer to Reveal", Value::Layer(None), ParamUi::Layer),
diff --git a/crates/effects/src/util.rs b/crates/effects/src/util.rs
index 1527e221f..9c81dab10 100644
--- a/crates/effects/src/util.rs
+++ b/crates/effects/src/util.rs
@@ -6,6 +6,10 @@ use effectcraft_color::{luminance, rgb_to_hsl};
 use effectcraft_raster::{Image, Px};
 use rayon::prelude::*;
 
+/// Below this many pixels, `Plane::transpose` and `Plane::map_rows` run on the calling thread:
+/// the rayon dispatch costs more than the work on small crops (the Match Grain sample boxes).
+const PAR_MIN: usize = 4096;
+
 /// A single-channel `f32` image (row-major).
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Plane {
@@ -62,6 +66,15 @@ impl Plane {
     pub fn transpose(&self) -> Plane {
         let (w, h) = (self.w, self.h);
         let mut out = Plane::new(h, w);
+        if w.saturating_mul(h) < PAR_MIN {
+            // Small planes: the rayon dispatch costs more than the copy itself.
+            for (x, col) in out.data.chunks_mut(h.max(1)).enumerate() {
+                for y in 0..h {
+                    col[y] = self.data[y * w + x];
+                }
+            }
+            return out;
+        }
         out.data.par_chunks_mut(h.max(1)).enumerate().for_each(|(x, col)| {
             for y in 0..h {
                 col[y] = self.data[y * w + x];
@@ -75,6 +88,11 @@ impl Plane {
         if self.w == 0 {
             return out;
         }
+        if self.w.saturating_mul(self.h) < PAR_MIN {
+            // Small planes: the rayon dispatch costs more than the rows themselves.
+            out.data.chunks_mut(self.w).zip(self.data.chunks(self.w)).for_each(|(o, s)| f(s, o));
+            return out;
+        }
         out.data.par_chunks_mut(self.w).zip(self.data.par_chunks(self.w)).for_each(|(o, s)| f(s, o));
         out
     }
@@ -534,14 +552,29 @@ impl<S: Clone> SimCache<S> {
 
     /// State after `target` steps. `init` builds step 0; `step(state, i)` advances from step
     /// `i` to `i + 1`.
-    pub fn run(&self, key: u64, target: u64, init: impl FnOnce() -> S, mut step: impl FnMut(&mut S, u64)) -> std::sync::Arc<S> {
+    pub fn run(&self, key: u64, target: u64, init: impl FnOnce() -> S, step: impl FnMut(&mut S, u64)) -> std::sync::Arc<S> {
+        self.run_where(key, target, init, step, |_, _| true)
+    }
+
+    /// [`SimCache::run`] for a simulation whose steps also depend on inputs outside `key` (a
+    /// parameter's values over time): a checkpoint after `s` steps is only resumed from when
+    /// `valid(s, state)` says it was reached with the same inputs. Fresh checkpoints replace
+    /// those at the same step.
+    pub fn run_where(
+        &self,
+        key: u64,
+        target: u64,
+        init: impl FnOnce() -> S,
+        mut step: impl FnMut(&mut S, u64),
+        valid: impl Fn(u64, &S) -> bool,
+    ) -> std::sync::Arc<S> {
         use std::sync::Arc;
         let start = {
-            let mut g = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+            let mut g = self.inner.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             let tick = g.iter().map(|e| e.used).max().unwrap_or(0) + 1;
             g.iter_mut().find(|e| e.key == key).and_then(|e| {
                 e.used = tick;
-                e.checkpoints.iter().filter(|(s, _)| *s <= target).max_by_key(|(s, _)| *s).map(|(s, st)| (*s, st.clone()))
+                e.checkpoints.iter().filter(|(s, st)| *s <= target && valid(*s, st)).max_by_key(|(s, _)| *s).map(|(s, st)| (*s, st.clone()))
             })
         };
         let had_start = start.is_some();
@@ -563,7 +596,7 @@ impl<S: Clone> SimCache<S> {
         }
         let out = Arc::new(st);
         fresh.push((target, out.clone()));
-        let mut g = self.inner.lock().unwrap_or_else(|e| e.into_inner());
+        let mut g = self.inner.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         let tick = g.iter().map(|e| e.used).max().unwrap_or(0) + 1;
         let idx = match g.iter().position(|e| e.key == key) {
             Some(ix) => ix,
@@ -579,9 +612,8 @@ impl<S: Clone> SimCache<S> {
         let e = &mut g[idx];
         e.used = tick;
         for (s, st) in fresh {
-            if !e.checkpoints.iter().any(|(c, _)| *c == s) {
-                e.checkpoints.push((s, st));
-            }
+            e.checkpoints.retain(|(c, _)| *c != s);
+            e.checkpoints.push((s, st));
         }
         // Keep memory bounded: drop unaligned (exact-target) checkpoints first, then thin.
         if e.checkpoints.len() > 256 {
diff --git a/crates/effects/src/utility.rs b/crates/effects/src/utility.rs
index 1d3b3ee4a..fca9d607e 100644
--- a/crates/effects/src/utility.rs
+++ b/crates/effects/src/utility.rs
@@ -55,29 +55,42 @@ fn overbrights(ctx: &EffectCtx, mut b: Buf) -> Buf {
     b
 }
 
-/// Soft-knee, hue-preserving compression of the brightest channel into [0, 1).
-fn hdr_compress_value(m: f32, knee: f32) -> f32 {
-    if m <= knee {
-        return m;
-    }
-    let w = 1.0 - knee;
-    knee + w * (m - knee) / ((m - knee) + w)
+/// Luma weights HDR Highlight Compression divides by (measured against After Effects 2026).
+const HDR_LUMA: [f32; 3] = [0.30, 0.59, 0.11];
+/// Exponent of the domain the Amount blend happens in (out^0.4 is mixed linearly).
+const HDR_BLEND_GAMMA: f32 = 0.4;
+
+/// `v^e` with the sign of `v` kept (negative input stays negative, as on the GPU).
+#[inline]
+fn hdr_spow(v: f32, e: f32) -> f32 {
+    v.signum() * v.abs().powf(e)
 }
 
+/// One straight-colour pixel through HDR Highlight Compression at blend `t` (Amount / 100, > 0).
+///
+/// Measured behaviour (16-bit renders of a 0–4 HDR ramp and coloured patches at Amount 100,
+/// 90, 84, 75, 50 and 25): every channel is divided by `1 + Y` (`Y` = 0.30 R + 0.59 G + 0.11 B, so a grey
+/// value `x` lands on `x / (1 + x)`), clipped at 1, then mixed with the input as `x^0.4` values.
+fn hdr_compress_pixel(c: [f32; 3], t: f32) -> [f32; 3] {
+    let y = (HDR_LUMA[0] * c[0] + HDR_LUMA[1] * c[1] + HDR_LUMA[2] * c[2]).max(0.0);
+    let s = 1.0 / (1.0 + y);
+    let g = HDR_BLEND_GAMMA;
+    c.map(|x| {
+        let comp = (x * s).min(1.0);
+        let mixed = (1.0 - t) * hdr_spow(x, g) + t * hdr_spow(comp, g);
+        let o = hdr_spow(mixed, 1.0 / g);
+        if o.is_finite() { o } else { x }
+    })
+}
+
+/// HDR Highlight Compression: every straight-colour pixel through [`hdr_compress_pixel`] at
+/// Amount / 100; Amount 0 or NaN returns the layer unchanged.
 fn hdr_compression(ctx: &EffectCtx, mut b: Buf) -> Buf {
     let t = (ctx.params.f("amount") / 100.0).clamp(0.0, 1.0) as f32;
-    if t <= 0.0 {
+    if t <= 0.0 || !t.is_finite() {
         return b;
     }
-    let knee = 1.0 - 0.5 * t;
-    b.img.map_straight(|c| {
-        let m = c[0].max(c[1]).max(c[2]);
-        if m <= knee {
-            return c;
-        }
-        let k = hdr_compress_value(m, knee) / m;
-        c.map(|v| v * k)
-    });
+    b.img.map_straight(|c| hdr_compress_pixel(c, t));
     b
 }
 
@@ -100,17 +113,11 @@ impl Cineon {
     fn knee(&self) -> f32 {
         1.0 - (self.rolloff / 100.0).clamp(0.0, 0.99)
     }
-    /// Normalised code value (code / 1023) → linear.
+    /// Normalized code value (code / 1023) → linear, raised to `1.7 / gamma`
+    /// ([`effectcraft_project::cineon_log_to_lin`], which Interpret Footage ▸ Cineon Settings
+    /// also uses with `1 / gamma`).
     pub fn log_to_lin(&self, v: f32) -> f32 {
-        let off = self.offset();
-        let code = v * 1023.0;
-        let mut lin = (10f32.powf((code - self.white) * 0.002 / 0.6) - off) / (1.0 - off).max(1e-6);
-        lin = lin.max(0.0).powf(1.7 / self.gamma.max(0.01));
-        let k = self.knee();
-        if k < 1.0 && lin > k {
-            let w = 1.0 - k;
-            lin = k + w * (1.0 - (-(lin - k) / w).exp());
-        }
+        let lin = effectcraft_project::cineon_log_to_lin(v, self.black, self.white, 1.7, self.gamma, self.rolloff);
         self.ib + (self.iw - self.ib) * lin
     }
     /// Linear → normalised code value.
@@ -358,7 +365,7 @@ pub fn specs() -> Vec<EffectSpec> {
         spec("ec.utility.growbounds", "Grow Bounds", vec![p("pixels", "Pixels", num(0.0), slider(0.0, 4000.0, 0.0, 500.0, 0))], grow_bounds),
         spec(
             "ec.utility.ccoverbrights",
-            "CC Overbrights",
+            "Out-of-Range Display",
             vec![
                 p("channel", "Channel", Value::Enum(0), popup(&["Max RGB", "Red", "Green", "Blue", "Alpha", "Luminance"])),
                 p("highlightColor", "Highlight Color", col(1.0, 0.0, 0.0), ParamUi::Color),
@@ -495,15 +502,154 @@ mod tests {
         assert!(c.log_to_lin(95.0 / 1023.0).abs() < 1e-4);
     }
 
+    /// Interpret Footage ▸ Cineon Settings and the Cineon Converter's Log to Linear give the same
+    /// values for the same points and Highlight Rolloff when the converter's Gamma is 1.7 times
+    /// Cineon Settings' Gamma: the converter's default 1.7 and Cineon Settings' Gamma 1 both give
+    /// linear light (code 400 is 0.10251).
+    #[test]
+    fn cineon_converter_matches_interpret_footage() {
+        let codes = [0.0f32, 95.0, 250.0, 400.0, 560.0, 685.0, 800.0, 1023.0];
+        for (gamma, rolloff) in [(1.0, 20.0), (1.0, 0.0), (1.7, 50.0), (2.4, 50.0)] {
+            let mut img = Image::new(codes.len() as u32, 1);
+            for (x, code) in codes.iter().enumerate() {
+                let v = code / 1023.0;
+                img.set(x as u32, 0, [v, v, v, 1.0]);
+            }
+            let vals = [("conversionType", Value::Enum(1)), ("gamma", num(gamma * 1.7)), ("highlightRolloff", num(rolloff))];
+            let out = run("ec.utility.cineon", &vals, img);
+            let settings = effectcraft_project::CineonSettings { log_conversion: true, gamma: gamma as f32, rolloff: rolloff as f32, ..Default::default() };
+            for (x, code) in codes.iter().enumerate() {
+                let footage = settings.convert(code / 1023.0);
+                let effect = out.img.data[x][0];
+                assert!((footage - effect).abs() < 1e-6, "gamma {gamma}, rolloff {rolloff}, code {code}: {footage} vs {effect}");
+            }
+        }
+        let linear = effectcraft_project::CineonSettings { gamma: 1.0, rolloff: 0.0, ..Default::default() };
+        assert!((linear.convert(400.0 / 1023.0) - 0.10251).abs() < 1e-4);
+    }
+
+    /// The Cineon Converter gives the same values as before Cineon Settings shared its
+    /// log-to-linear function, at the default Gamma (1.7) and at Gamma 2.4, for all three
+    /// conversion types.
+    #[test]
+    fn cineon_converter_output_is_unchanged() {
+        fn log_to_lin(v: f32, gamma: f32, rolloff: f32, black: f32, white: f32) -> f32 {
+            let off = 10f32.powf((black - white) * 0.002 / 0.6);
+            let mut lin = (10f32.powf((v * 1023.0 - white) * 0.002 / 0.6) - off) / (1.0 - off).max(1e-6);
+            lin = lin.max(0.0).powf(1.7 / gamma.max(0.01));
+            let k = 1.0 - (rolloff / 100.0).clamp(0.0, 0.99);
+            if k < 1.0 && lin > k {
+                let w = 1.0 - k;
+                lin = k + w * (1.0 - (-(lin - k) / w).exp());
+            }
+            lin
+        }
+        fn lin_to_log(v: f32, gamma: f32, rolloff: f32, black: f32, white: f32) -> f32 {
+            let off = 10f32.powf((black - white) * 0.002 / 0.6);
+            let mut lin = v;
+            let k = 1.0 - (rolloff / 100.0).clamp(0.0, 0.99);
+            if k < 1.0 && lin > k {
+                let w = 1.0 - k;
+                lin = k - w * (1.0 - (lin - k) / w).max(1e-6).ln();
+            }
+            lin = lin.max(0.0).powf(gamma.max(0.01) / 1.7);
+            (white + (lin * (1.0 - off) + off).max(1e-9).log10() * 0.6 / 0.002) / 1023.0
+        }
+        let codes = [0.0f32, 95.0, 250.0, 400.0, 560.0, 685.0, 800.0, 1023.0];
+        for gamma in [None, Some(2.4)] {
+            for kind in 0..3 {
+                let mut img = Image::new(codes.len() as u32, 1);
+                for (x, code) in codes.iter().enumerate() {
+                    let v = code / 1023.0;
+                    img.set(x as u32, 0, [v, v, v, 1.0]);
+                }
+                let mut vals = vec![("conversionType", Value::Enum(kind))];
+                if let Some(g) = gamma {
+                    vals.push(("gamma", num(g)));
+                }
+                let out = run("ec.utility.cineon", &vals, img);
+                let g = gamma.unwrap_or(1.7) as f32;
+                for (x, code) in codes.iter().enumerate() {
+                    let v = code / 1023.0;
+                    let want = match kind {
+                        0 => lin_to_log(v, g, 20.0, 95.0, 685.0),
+                        1 => log_to_lin(v, g, 20.0, 95.0, 685.0),
+                        _ => lin_to_log(log_to_lin(v, g, 20.0, 95.0, 685.0), 1.7, 20.0, 95.0, 685.0),
+                    };
+                    let got = out.img.data[x][0];
+                    assert!((want - got).abs() < 1e-6, "gamma {g}, type {kind}, code {code}: {want} vs {got}");
+                }
+            }
+        }
+    }
+
     #[test]
     fn hdr_compression_behaviour() {
         let mut img = Image::new(2, 1);
         img.set(0, 0, [0.2, 0.3, 0.4, 1.0]);
         img.set(1, 0, [4.0, 2.0, 1.0, 1.0]);
+        let out = run("ec.utility.hdrcompression", &[("amount", num(0.0))], img.clone());
+        assert_eq!(out.img.data, img.data, "Amount 0 leaves the image alone");
         let out = run("ec.utility.hdrcompression", &[], img);
-        assert_eq!(out.img.data[0], [0.2, 0.3, 0.4, 1.0]);
-        let o = out.img.data[1];
-        assert!(o[0] <= 1.0 && o[0] > 0.5 && (o[0] / o[1] - 2.0).abs() < 1e-4, "{o:?}");
+        for o in &out.img.data {
+            assert!(o.iter().all(|v| v.is_finite() && *v <= 1.0), "{o:?}");
+        }
+        // Negative and huge input stays finite.
+        let mut img = Image::new(2, 1);
+        img.set(0, 0, [-0.5, 0.2, 3.0, 1.0]);
+        img.set(1, 0, [1e30, -1e30, 0.0, 1.0]);
+        let out = run("ec.utility.hdrcompression", &[("amount", num(50.0))], img);
+        assert!(out.img.data.iter().flatten().all(|v| v.is_finite()), "{:?}", out.img.data);
+    }
+
+    /// A linear value up to 1 as a code of After Effects' 16-bit PNG renders: the sRGB curve × 6553.5.
+    fn png_code(x: f32) -> f32 {
+        (if x <= 0.003_130_8 { 12.92 * x } else { 1.055 * x.powf(1.0 / 2.4) - 0.055 }) * 6553.5
+    }
+
+    /// Our own measurements of After Effects 2026 (32 bpc, no working space; 16-bit PNG renders
+    /// decoded back to linear): input pixel, then the output at Amount 100, 90, 84, 75, 50 and 25.
+    #[test]
+    fn hdr_compression_matches_measured_reference() {
+        const AMOUNTS: [f64; 6] = [100.0, 90.0, 84.0, 75.0, 50.0, 25.0];
+        #[rustfmt::skip]
+        let table: [([f32; 3], [[f32; 3]; 6]); 9] = [
+            ([0.18005371; 3], [[0.1524; 3], [0.1550; 3], [0.1566; 3], [0.1590; 3], [0.1660; 3], [0.1729; 3]]),
+            ([0.49365234; 3], [[0.3302; 3], [0.3450; 3], [0.3540; 3], [0.3674; 3], [0.4073; 3], [0.4492; 3]]),
+            ([1.0058594; 3], [[0.5014; 3], [0.5427; 3], [0.5683; 3], [0.6085; 3], [0.7280; 3], [0.8602; 3]]),
+            ([2.0058594; 3], [[0.6673; 3], [0.7637; 3], [0.8256; 3], [0.9232; 3], [1.2292; 3], [1.5892; 3]]),
+            ([2.9941406; 3], [[0.7496; 3], [0.8962; 3], [0.9922; 3], [1.1465; 3], [1.6475; 3], [2.2604; 3]]),
+            ([3.9941406; 3], [[0.7998; 3], [0.9929; 3], [1.1213; 3], [1.3303; 3], [2.0312; 3], [2.9141; 3]]),
+            ([0.7998047, 0.099975586, 0.099975586], [
+                [0.6101, 0.0762, 0.0762], [0.6279, 0.0784, 0.0784], [0.6386, 0.0798, 0.0798],
+                [0.6547, 0.0817, 0.0817], [0.7012, 0.0877, 0.0877], [0.7496, 0.0937, 0.0937],
+            ]),
+            ([0.099975586, 0.7001953, 0.19995117], [
+                [0.0681, 0.4776, 0.1363], [0.0711, 0.4976, 0.1420], [0.0727, 0.5097, 0.1456],
+                [0.0754, 0.5287, 0.1508], [0.0832, 0.5829, 0.1662], [0.0912, 0.6397, 0.1825],
+            ]),
+            ([0.30004883, 0.5, 2.5], [
+                [0.1807, 0.3012, 0.9998], [0.1911, 0.3184, 1.1147], [0.1972, 0.3288, 1.1860],
+                [0.2071, 0.3453, 1.2995], [0.2359, 0.3931, 1.6484], [0.2669, 0.4444, 2.0482],
+            ]),
+        ];
+        let mut img = Image::new(table.len() as u32, 1);
+        for (x, (c, _)) in table.iter().enumerate() {
+            img.set(x as u32, 0, [c[0], c[1], c[2], 1.0]);
+        }
+        for (i, amount) in AMOUNTS.into_iter().enumerate() {
+            let out = run("ec.utility.hdrcompression", &[("amount", num(amount))], img.clone());
+            for (x, (input, want)) in table.iter().enumerate() {
+                let got = out.img.data[x];
+                for c in 0..3 {
+                    let w = want[i][c];
+                    // Up to 1: within 20 codes of the 16-bit PNG (the sRGB curve × 6553.5) the
+                    // renders were read from. Above 1 the PNG's lookup table is not known: 0.1 %.
+                    let ok = if w <= 1.0 { (png_code(got[c]) - png_code(w)).abs() <= 20.0 } else { (got[c] - w).abs() <= w * 1e-3 };
+                    assert!(ok, "amount {amount}, input {input:?}, channel {c}: {} vs AE {w}", got[c]);
+                }
+            }
+        }
     }
 
     #[test]
diff --git a/crates/effects/src/warp_stab.rs b/crates/effects/src/warp_stab.rs
index 595cb5200..8d9fe6f0e 100644
--- a/crates/effects/src/warp_stab.rs
+++ b/crates/effects/src/warp_stab.rs
@@ -152,15 +152,6 @@ pub fn settings(params: &Params, fps: f64) -> StabSettings {
     }
 }
 
-fn fnv(bytes: &[u8]) -> u64 {
-    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
-    for b in bytes {
-        h ^= *b as u64;
-        h = h.wrapping_mul(0x0100_0000_01b3);
-    }
-    h
-}
-
 struct KeyHasher(u64);
 impl Hasher for KeyHasher {
     fn finish(&self) -> u64 {
@@ -183,24 +174,12 @@ fn settings_key(s: &StabSettings) -> u64 {
     h.finish()
 }
 
-type AnalysisCache = Mutex<HashMap<u64, Arc<WarpAnalysis>>>;
 type PlanCache = Mutex<HashMap<(u64, u64), Arc<Plan>>>;
 
-/// Parsed analyses by content hash (parsing a long clip's JSON every frame would dominate).
+/// Parsed analyses and their content keys; cache hits compare source text without rehashing.
 fn analysis_cached(json: &str) -> Option<(u64, Arc<WarpAnalysis>)> {
-    static C: OnceLock<AnalysisCache> = OnceLock::new();
-    let key = fnv(json.as_bytes());
-    let c = C.get_or_init(Default::default);
-    if let Some(a) = c.lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
-        return Some((key, a.clone()));
-    }
-    let a = Arc::new(WarpAnalysis::from_json(json)?);
-    let mut m = c.lock().unwrap_or_else(|e| e.into_inner());
-    if m.len() > 8 {
-        m.clear();
-    }
-    m.insert(key, a.clone());
-    Some((key, a))
+    static C: crate::analysis_cache::AnalysisCache<WarpAnalysis> = crate::analysis_cache::AnalysisCache::new();
+    C.get(json, WarpAnalysis::from_json)
 }
 
 fn plans() -> &'static PlanCache {
@@ -223,6 +202,19 @@ fn plan_cached(akey: u64, a: &WarpAnalysis, s: &StabSettings) -> Arc<Plan> {
     p
 }
 
+/// Validate and cache the default stabilization plan after analysis. Use the serialized
+/// analysis so the cached plan has exactly the same inputs as the first render, including
+/// any floating-point round trip through JSON. Other settings still get their own plan.
+pub fn prepare_default_plan(json: &str) -> bool {
+    let Some((key, a)) = analysis_cached(json) else { return false };
+    if a.is_empty() {
+        return false;
+    }
+    let fps = if a.frame_duration > 0.0 { 1.0 / a.frame_duration } else { 30.0 };
+    let p = plan_cached(key, &a, &StabSettings { fps, ..Default::default() });
+    p.warps.len() == a.frames.len() && p.warps.iter().all(|h| h.0.iter().flatten().all(|v| v.is_finite()))
+}
+
 /// The stored analysis of an instance (`None` when not analysed).
 pub fn analysis(params: &Params) -> Option<Arc<WarpAnalysis>> {
     let j = s(params, ANALYSIS);
@@ -294,7 +286,7 @@ pub fn store_summary(key: [u64; 2], summary: PlanSummary) {
 }
 
 fn keep_summary(key: (u64, u64), summary: Arc<PlanSummary>) {
-    let mut m = summaries().lock().unwrap_or_else(|e| e.into_inner());
+    let mut m = summaries().lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if m.len() > 32 {
         m.clear();
     }
@@ -305,7 +297,7 @@ fn keep_summary(key: (u64, u64), summary: Arc<PlanSummary>) {
 /// cached (seconds for a long Subspace Warp clip). `None` when not analysed.
 pub fn summary(params: &Params) -> Option<([u64; 2], Arc<PlanSummary>)> {
     let (key, a, st) = plan_key(params)?;
-    let cached = summaries().lock().unwrap_or_else(|e| e.into_inner()).get(&key).cloned();
+    let cached = summaries().lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&key).cloned();
     let sum = match cached {
         Some(s) => s,
         None => {
@@ -333,7 +325,7 @@ pub fn summary_at(params: &Params, time: f64) -> Option<(usize, Arc<PlanSummary>
 pub fn cached_summary_at(params: &Params, time: f64) -> Option<(usize, Arc<PlanSummary>)> {
     let (key, a, _) = plan_key(params)?;
     let k = a.frame_at(time)?;
-    let sum = summaries().lock().unwrap_or_else(|e| e.into_inner()).get(&key).cloned();
+    let sum = summaries().lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&key).cloned();
     let sum = match sum {
         Some(s) => s,
         None => {
@@ -445,15 +437,15 @@ fn render(ctx: &EffectCtx, buf: Buf) -> Buf {
             }
         }
         if !local.is_empty() {
-            let mut n = need_m.lock().unwrap_or_else(|e| e.into_inner());
+            let mut n = need_m.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             for (x, w) in local {
                 n[y * ow as usize + x] = w;
             }
         }
     });
-    let need = need_m.into_inner().unwrap_or_else(|e| e.into_inner());
+    let need = need_m.into_inner().unwrap_or_else(std::sync::PoisonError::into_inner);
     if synth && need.iter().any(|w| *w > 0.0) {
-        synthesize(ctx, &a, k, &src_of, &crop, sc, &mut out, &need);
+        synthesize(ctx, &a, k, &SynthesisGrid { src_of: &src_of, crop: &crop, scale: sc }, &mut out, &need);
     }
     if b(ctx.params, "advanced/showTrackPoints") {
         let r = (2.5 * f(ctx.params, "advanced/trackPointSize") / 100.0 * sc).max(0.5);
@@ -465,19 +457,16 @@ fn render(ctx: &EffectCtx, buf: Buf) -> Buf {
     Buf { img: out, offset: [0.0; 2], scale: sc }
 }
 
-/// Fill the pixels flagged in `need` (weight = how much synthesized content they take) from
-/// neighbouring frames, nearest first.
-#[allow(clippy::too_many_arguments)]
-fn synthesize(
-    ctx: &EffectCtx,
-    a: &WarpAnalysis,
-    k: usize,
-    src_of: &(dyn Fn([f64; 2]) -> [f64; 2] + Sync),
-    crop: &[f64; 4],
-    sc: f64,
-    out: &mut Image,
-    need: &[f32],
-) {
+/// Maps an output sample into the uncropped source grid shared by neighbouring frames.
+struct SynthesisGrid<'a> {
+    src_of: &'a (dyn Fn([f64; 2]) -> [f64; 2] + Sync),
+    crop: &'a [f64; 4],
+    scale: f64,
+}
+
+/// Fill the pixels flagged in `need` from neighbouring frames, nearest first.
+fn synthesize(ctx: &EffectCtx, a: &WarpAnalysis, k: usize, grid: &SynthesisGrid<'_>, out: &mut Image, need: &[f32]) {
+    let SynthesisGrid { src_of, crop, scale: sc } = *grid;
     let Some(host) = ctx.env.host else { return };
     let n = a.frames.len();
     let range = ((f(ctx.params, "advanced/synthesizeInputRange").max(0.0) / a.frame_duration.max(1e-6)).round() as usize).min(60);
@@ -534,6 +523,7 @@ fn dot(img: &mut Image, c: [f64; 2], r: f64, col: Px) {
 mod tests {
     use super::*;
     use crate::EffectEnv;
+    use crate::analysis_cache::fnv;
     use effectcraft_track::stabilize::FrameMotion;
 
     fn analysis_json(n: usize, w: f64, h: f64, shift: impl Fn(usize) -> [f64; 2]) -> String {
@@ -604,6 +594,61 @@ mod tests {
         assert_eq!(render(&ctx, Buf { img: img.clone(), offset: [0.0; 2], scale: 1.0 }).img.data, img.data);
     }
 
+    #[test]
+    fn prepared_default_plan_preserves_first_render_and_is_reused() {
+        let json = analysis_json(25, 64.0, 48.0, |k| [((k * 7) % 5) as f64 - 2.0, k as f64 * 0.1]);
+        let mut a = WarpAnalysis::from_json(&json).unwrap();
+        a.start = 0.012345678901234567;
+        a.tracks = (0..24)
+            .map(|id| effectcraft_track::camtrack::Track2D {
+                id,
+                start: 0,
+                pts: (0..25).map(|k| [8.0 + (id % 6) as f32 * 8.0 + ((k * 7) % 5) as f32, 8.0 + (id / 6) as f32 * 8.0 + k as f32 * 0.1]).collect(),
+            })
+            .collect();
+        let json = a.to_json();
+        let ps = params(&json, 2, 0);
+        let ctx = EffectCtx { params: &ps, time: a.start, layer_size: a.size, seed: 1, adjustment: false, env: EffectEnv::default() };
+        let input = Buf { img: frame([30.0, 22.0]), offset: [0.0; 2], scale: 1.0 };
+        // Original flow: validate, discard the plan, then render from the stored analysis.
+        let _discarded = plan(&a, &StabSettings { fps: 25.0, ..Default::default() });
+        let before = render(&ctx, input.clone());
+        let key = (fnv(json.as_bytes()), settings_key(&settings(&ps, 25.0)));
+        plans().lock().unwrap().remove(&key);
+        assert!(prepare_default_plan(&json));
+        let prepared = plans().lock().unwrap().get(&key).unwrap().clone();
+        assert!(!prepared.meshes.is_empty(), "exercise the Subspace Warp plan");
+        let after = render(&ctx, input);
+        let (_, _, rendered) = plan_at(&ps, a.start).unwrap();
+        assert!(Arc::ptr_eq(&prepared, &rendered));
+        assert_eq!(before.offset, after.offset);
+        assert_eq!(before.scale.to_bits(), after.scale.to_bits());
+        for (a, b) in before.img.data.iter().flatten().zip(after.img.data.iter().flatten()) {
+            assert_eq!(a.to_bits(), b.to_bits());
+        }
+        assert!(!prepare_default_plan("invalid"));
+        assert!(!prepare_default_plan(&WarpAnalysis::default().to_json()));
+    }
+
+    #[test]
+    fn changing_analysis_changes_the_plan_key() {
+        let json = analysis_json(10, 64.0, 48.0, |k| [k as f64 * 0.1, 0.0]);
+        let mut ps = params(&json, 2, 0);
+        let before = summary_key(&ps).unwrap();
+        assert_eq!(before[0], fnv(json.as_bytes()));
+        let mut a = WarpAnalysis::from_json(&json).unwrap();
+        a.start = 1.0;
+        ps.values.insert(ANALYSIS.into(), Value::Str(a.to_json()));
+        let after = summary_key(&ps).unwrap();
+        assert_ne!(before[0], after[0]);
+        assert_eq!(before[1], after[1]);
+        assert_eq!(*analysis(&ps).unwrap(), a);
+        ps.values.insert(ANALYSIS.into(), Value::Str(json));
+        assert_eq!(summary_key(&ps).unwrap(), before);
+        ps.values.insert(ANALYSIS.into(), Value::Str(String::new()));
+        assert!(analysis(&ps).is_none());
+    }
+
     #[test]
     fn nested_param_lookup() {
         let mut p = Params::default();
diff --git a/crates/effects/tests/gen_golden.rs b/crates/effects/tests/it/gen_golden.rs
similarity index 100%
rename from crates/effects/tests/gen_golden.rs
rename to crates/effects/tests/it/gen_golden.rs
diff --git a/crates/effects/tests/it/main.rs b/crates/effects/tests/it/main.rs
new file mode 100644
index 000000000..7b12e25c6
--- /dev/null
+++ b/crates/effects/tests/it/main.rs
@@ -0,0 +1,6 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod gen_golden;
+mod particle_golden;
+mod sim_golden;
+mod timewarp_golden;
diff --git a/crates/effects/tests/particle_golden.rs b/crates/effects/tests/it/particle_golden.rs
similarity index 100%
rename from crates/effects/tests/particle_golden.rs
rename to crates/effects/tests/it/particle_golden.rs
diff --git a/crates/effects/tests/sim_golden.rs b/crates/effects/tests/it/sim_golden.rs
similarity index 96%
rename from crates/effects/tests/sim_golden.rs
rename to crates/effects/tests/it/sim_golden.rs
index 2a3a7c724..388790901 100644
--- a/crates/effects/tests/sim_golden.rs
+++ b/crates/effects/tests/it/sim_golden.rs
@@ -433,26 +433,26 @@ const GOLDEN: &[(&str, u64)] = &[
     ("ec.sim.ccstarburst/1/32bpc/t1.5", 0x5c39f8b1bd0e9e43),
     ("ec.sim.ccstarburst/1/32bpc/t0.8", 0xdf20aa9dcf4b3e22),
     ("ec.sim.ccstarburst/1/32bpc/t2.2", 0x4fa441737bfcb64d),
-    ("ec.sim.ccbubbles/0/8bpc/t0.5", 0xdcd187e75eeb2fae),
-    ("ec.sim.ccbubbles/0/8bpc/t1.5", 0x835ca088747736ed),
-    ("ec.sim.ccbubbles/0/8bpc/t0.8", 0x5cbb1a6fbb77b41d),
-    ("ec.sim.ccbubbles/0/8bpc/t2.2", 0x3b168068f5bfa533),
-    ("ec.sim.ccbubbles/0/32bpc/t0.5", 0x524b84d14edd77e2),
-    ("ec.sim.ccbubbles/0/32bpc/t1.5", 0xfd7a17f0d40f2a27),
-    ("ec.sim.ccbubbles/0/32bpc/t0.8", 0x70dd2b2b4ff0f7ce),
-    ("ec.sim.ccbubbles/0/32bpc/t2.2", 0xae21dd5cc2c2c07c),
-    ("ec.sim.ccbubbles/0/8bpc/half/t0.5", 0x931b4ca707604220),
-    ("ec.sim.ccbubbles/0/8bpc/half/t1.5", 0x21c25d4555abebe9),
-    ("ec.sim.ccbubbles/0/8bpc/half/t0.8", 0x7e05972683359632),
-    ("ec.sim.ccbubbles/0/8bpc/half/t2.2", 0xadc4f7219dab4921),
-    ("ec.sim.ccbubbles/1/8bpc/t0.5", 0x89d27a2fe2011067),
-    ("ec.sim.ccbubbles/1/8bpc/t1.5", 0x2bbfee897bf5bf6e),
-    ("ec.sim.ccbubbles/1/8bpc/t0.8", 0x26cc704e7b06fffc),
-    ("ec.sim.ccbubbles/1/8bpc/t2.2", 0x959d331545d96479),
-    ("ec.sim.ccbubbles/1/32bpc/t0.5", 0xaf486cebfcbf4641),
-    ("ec.sim.ccbubbles/1/32bpc/t1.5", 0xe150e9fdb558036f),
-    ("ec.sim.ccbubbles/1/32bpc/t0.8", 0x6395f3967cb24284),
-    ("ec.sim.ccbubbles/1/32bpc/t2.2", 0x68a55894d86ffb9e),
+    ("ec.sim.ccbubbles/0/8bpc/t0.5", 0x6cb63df0c062fdf4),
+    ("ec.sim.ccbubbles/0/8bpc/t1.5", 0x5bb1350114234ac3),
+    ("ec.sim.ccbubbles/0/8bpc/t0.8", 0xaa824d49f12c4156),
+    ("ec.sim.ccbubbles/0/8bpc/t2.2", 0x3528577358c4fc90),
+    ("ec.sim.ccbubbles/0/32bpc/t0.5", 0xdcd8e71222c13a9a),
+    ("ec.sim.ccbubbles/0/32bpc/t1.5", 0xd09565e124d8f5db),
+    ("ec.sim.ccbubbles/0/32bpc/t0.8", 0x91242f8e1fd0ad84),
+    ("ec.sim.ccbubbles/0/32bpc/t2.2", 0x1f9782131e62149d),
+    ("ec.sim.ccbubbles/0/8bpc/half/t0.5", 0x020755e48bdf8f43),
+    ("ec.sim.ccbubbles/0/8bpc/half/t1.5", 0x4aac0f1332e6001e),
+    ("ec.sim.ccbubbles/0/8bpc/half/t0.8", 0xdc2ab5e04c4a95a2),
+    ("ec.sim.ccbubbles/0/8bpc/half/t2.2", 0x30f78adc5d1dd715),
+    ("ec.sim.ccbubbles/1/8bpc/t0.5", 0x2f5415c679ff0980),
+    ("ec.sim.ccbubbles/1/8bpc/t1.5", 0xfcfc354dcd22e6d0),
+    ("ec.sim.ccbubbles/1/8bpc/t0.8", 0xdf90fd57c217019c),
+    ("ec.sim.ccbubbles/1/8bpc/t2.2", 0xd365c88c12219802),
+    ("ec.sim.ccbubbles/1/32bpc/t0.5", 0x50f20497f40bb46d),
+    ("ec.sim.ccbubbles/1/32bpc/t1.5", 0x74760599ffba220a),
+    ("ec.sim.ccbubbles/1/32bpc/t0.8", 0x028de52900ed8618),
+    ("ec.sim.ccbubbles/1/32bpc/t2.2", 0xaf0e21d9a7f625fe),
     ("ec.sim.ccdrizzle/0/8bpc/t0.5", 0x2bdfbc17d92b65b5),
     ("ec.sim.ccdrizzle/0/8bpc/t1.5", 0x8c354c46f99e35d3),
     ("ec.sim.ccdrizzle/0/8bpc/t0.8", 0x891f331ba47ee557),
diff --git a/crates/effects/tests/timewarp_golden.rs b/crates/effects/tests/it/timewarp_golden.rs
similarity index 100%
rename from crates/effects/tests/timewarp_golden.rs
rename to crates/effects/tests/it/timewarp_golden.rs
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 0e26cca58..aa5956ebe 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -27,6 +27,7 @@ effectcraft-model = { workspace = true }
 effectcraft-lottie = { workspace = true }
 effectcraft-interchange = { workspace = true }
 effectcraft-psd = { workspace = true }
+effectcraft-aep = { workspace = true }
 kurbo = { workspace = true }
 effectcraft-svg = { workspace = true }
 effectcraft-pdf = { workspace = true }
@@ -34,7 +35,14 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 rayon = { workspace = true }
 image = { workspace = true }
 web-time = { workspace = true }
 exr = { workspace = true }
+
+# Native file identity and SAM 2 inference; browsers keep the built-in engines.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+same-file = { workspace = true }
+tempfile = { workspace = true }
+effectcraft-sam2 = { workspace = true }
diff --git a/crates/engine/presets/behaviors.json b/crates/engine/presets/behaviors.json
new file mode 100644
index 000000000..71e87db52
--- /dev/null
+++ b/crates/engine/presets/behaviors.json
@@ -0,0 +1,248 @@
+{
+  "format": "effectcraft.animationPresets/1",
+  "notes": "Original EffectCraft behavior presets (MIT OR Apache-2.0), written from scratch. Each one drives a transform property or opacity with a time-based expression built on the property's own value, so the motion runs for the layer's whole duration and still follows the property's keyframes. Apply to any layer; no effects are added.",
+  "presets": [
+    {
+      "id": "wiggleSoft",
+      "name": "Soft Wiggle",
+      "category": "Behaviors",
+      "description": "The layer wanders gently around its position.",
+      "layer": {
+        "expr": {
+          "transform/position": "var w = wiggle(1.2, 30); [w[0], w[1]]"
+        }
+      }
+    },
+    {
+      "id": "shake",
+      "name": "Shake",
+      "category": "Behaviors",
+      "description": "A fast, tight shake of the layer's position.",
+      "layer": {
+        "expr": {
+          "transform/position": "var w = wiggle(14, 12); [w[0], w[1]]"
+        }
+      }
+    },
+    {
+      "id": "floatUpDown",
+      "name": "Float",
+      "category": "Behaviors",
+      "description": "The layer bobs up and down like it floats on water.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(0), value[1]+(Math.sin(time*2)*18)]"
+        }
+      }
+    },
+    {
+      "id": "sway",
+      "name": "Sway",
+      "category": "Behaviors",
+      "description": "The layer sways left and right.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(Math.sin(time*1.6)*40), value[1]+(0)]"
+        }
+      }
+    },
+    {
+      "id": "orbit",
+      "name": "Orbit",
+      "category": "Behaviors",
+      "description": "The layer travels round a circle around its position.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(Math.cos(time*2)*80), value[1]+(Math.sin(time*2)*80)]"
+        }
+      }
+    },
+    {
+      "id": "figureEight",
+      "name": "Figure Eight",
+      "category": "Behaviors",
+      "description": "The layer traces a figure eight around its position.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(Math.sin(time*1.5)*100), value[1]+(Math.sin(time*3)*45)]"
+        }
+      }
+    },
+    {
+      "id": "bouncingBall",
+      "name": "Bouncing Ball",
+      "category": "Behaviors",
+      "description": "The layer bounces up from its position again and again.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(0), value[1]+(-Math.abs(Math.sin(time*3.2))*140)]"
+        }
+      }
+    },
+    {
+      "id": "driftRight",
+      "name": "Drift Right",
+      "category": "Behaviors",
+      "description": "The layer drifts steadily to the right.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(time*40), value[1]+(0)]"
+        }
+      }
+    },
+    {
+      "id": "driftDiagonal",
+      "name": "Drift Diagonal",
+      "category": "Behaviors",
+      "description": "The layer drifts slowly down and to the right.",
+      "layer": {
+        "expr": {
+          "transform/position": "[value[0]+(time*30), value[1]+(time*18)]"
+        }
+      }
+    },
+    {
+      "id": "pendulum",
+      "name": "Pendulum",
+      "category": "Behaviors",
+      "description": "The layer swings like a pendulum.",
+      "layer": {
+        "expr": {
+          "transform/rotation": "value + Math.sin(time*2.4)*25"
+        }
+      }
+    },
+    {
+      "id": "wobble",
+      "name": "Wobble",
+      "category": "Behaviors",
+      "description": "The layer rotates with an irregular wobble.",
+      "layer": {
+        "expr": {
+          "transform/rotation": "wiggle(2, 10)"
+        }
+      }
+    },
+    {
+      "id": "spinSlow",
+      "name": "Spin Slow",
+      "category": "Behaviors",
+      "description": "The layer rotates once every ten seconds.",
+      "layer": {
+        "expr": {
+          "transform/rotation": "value + time*36"
+        }
+      }
+    },
+    {
+      "id": "spinFast",
+      "name": "Spin Fast",
+      "category": "Behaviors",
+      "description": "The layer rotates twice a second.",
+      "layer": {
+        "expr": {
+          "transform/rotation": "value + time*720"
+        }
+      }
+    },
+    {
+      "id": "pulse",
+      "name": "Pulse",
+      "category": "Behaviors",
+      "description": "The layer swells and shrinks smoothly.",
+      "layer": {
+        "expr": {
+          "transform/scale": "[value[0]*(1+0.12*Math.sin(time*4)), value[1]*(1+0.12*Math.sin(time*4))]"
+        }
+      }
+    },
+    {
+      "id": "heartbeat",
+      "name": "Heartbeat",
+      "category": "Behaviors",
+      "description": "Two quick beats, then a rest, repeating every second.",
+      "layer": {
+        "expr": {
+          "transform/scale": "var t = time % 1; var b = t < 0.3 ? Math.sin(t/0.3*Math.PI) : (t < 0.6 ? 0.7*Math.sin((t-0.3)/0.3*Math.PI) : 0); var k = 1 + 0.2*b; [value[0]*k, value[1]*k]"
+        }
+      }
+    },
+    {
+      "id": "breathe",
+      "name": "Breathe",
+      "category": "Behaviors",
+      "description": "The layer slowly grows and settles back.",
+      "layer": {
+        "expr": {
+          "transform/scale": "[value[0]*(1+0.06*Math.sin(time*1.1)), value[1]*(1+0.06*Math.sin(time*1.1))]"
+        }
+      }
+    },
+    {
+      "id": "rubberBand",
+      "name": "Rubber Band",
+      "category": "Behaviors",
+      "description": "Width and height stretch against each other.",
+      "layer": {
+        "expr": {
+          "transform/scale": "[value[0]*(1+0.15*Math.sin(time*5)), value[1]*(1-0.15*Math.sin(time*5))]"
+        }
+      }
+    },
+    {
+      "id": "jitterScale",
+      "name": "Jitter Scale",
+      "category": "Behaviors",
+      "description": "The layer's size jitters randomly.",
+      "layer": {
+        "expr": {
+          "transform/scale": "var w = wiggle(8, 6); [w[0], w[1]]"
+        }
+      }
+    },
+    {
+      "id": "blink",
+      "name": "Blink",
+      "category": "Behaviors",
+      "description": "The layer switches on and off twice a second.",
+      "layer": {
+        "expr": {
+          "transform/opacity": "(Math.floor(time*4) % 2 === 0) ? value : 0"
+        }
+      }
+    },
+    {
+      "id": "strobe",
+      "name": "Strobe",
+      "category": "Behaviors",
+      "description": "The layer flashes on for a few frames each beat.",
+      "layer": {
+        "expr": {
+          "transform/opacity": "((time*6) % 1 < 0.25) ? value : 0"
+        }
+      }
+    },
+    {
+      "id": "flicker",
+      "name": "Flicker",
+      "category": "Behaviors",
+      "description": "The layer's opacity flickers like a failing lamp.",
+      "layer": {
+        "expr": {
+          "transform/opacity": "var w = wiggle(14, 45); Math.max(0, Math.min(100, w))"
+        }
+      }
+    },
+    {
+      "id": "fadePulse",
+      "name": "Fade Pulse",
+      "category": "Behaviors",
+      "description": "Opacity breathes between full and a third.",
+      "layer": {
+        "expr": {
+          "transform/opacity": "value*(0.67+0.33*Math.sin(time*2.5))"
+        }
+      }
+    }
+  ]
+}
diff --git a/crates/engine/presets/behaviors.json.attribution b/crates/engine/presets/behaviors.json.attribution
new file mode 100644
index 000000000..7c71c62e8
--- /dev/null
+++ b/crates/engine/presets/behaviors.json.attribution
@@ -0,0 +1,7 @@
+asset:        behaviors.json
+title:        EffectCraft Behaviors animation presets (Soft Wiggle, Shake, Float, Sway, Orbit, Figure Eight, Bouncing Ball, Drift Right, Drift Diagonal, Pendulum, Wobble, Spin Slow, Spin Fast, Pulse, Heartbeat, Breathe, Rubber Band, Jitter Scale, Blink, Strobe, Flicker, Fade Pulse)
+author:       EffectCraft contributors
+source:       original work
+license:      MIT OR Apache-2.0
+added:        2026-10-15 by vangel76 (Claude Code agent, gap 7, #1510)
+notes:        Expressions and values written from scratch for EffectCraft on its own transform properties and expression engine; not derived from any Adobe preset (.ffx) or its values.
diff --git a/crates/engine/presets/text_animators.json b/crates/engine/presets/text_animators.json
index 20e142268..e82707a52 100644
--- a/crates/engine/presets/text_animators.json
+++ b/crates/engine/presets/text_animators.json
@@ -77,7 +77,7 @@
           "name": "Tracking In",
           "properties": { "tracking": 0, "opacity": 100 },
           "keys": {
-            "tracking": [[0, 400], [1.6, 0]],
+            "tracking": [[0, 40], [1.6, 0]],
             "opacity": [[0, 0], [0.8, 100]]
           },
           "ease": true,
diff --git a/crates/engine/src/analysis.rs b/crates/engine/src/analysis.rs
new file mode 100644
index 000000000..fa2b8b4ec
--- /dev/null
+++ b/crates/engine/src/analysis.rs
@@ -0,0 +1,6 @@
+pub mod camera_track;
+pub mod mask_track;
+pub mod models;
+pub mod roto;
+pub mod tracking;
+pub mod warp;
diff --git a/crates/engine/src/camera_track.rs b/crates/engine/src/analysis/camera_track.rs
similarity index 99%
rename from crates/engine/src/camera_track.rs
rename to crates/engine/src/analysis/camera_track.rs
index adc5aee69..29961f533 100644
--- a/crates/engine/src/camera_track.rs
+++ b/crates/engine/src/analysis/camera_track.rs
@@ -7,7 +7,7 @@
 //! camera"). When only the solve settings changed (Shot Type, Angle of View, Solve Method,
 //! deleted points) the stored tracks are re-solved without re-tracking. Results are written into
 //! the effect's hidden parameters as one undo step; edits that change the layer's frames clear
-//! them and queue the effect again ([`invalidate`], run after every edit), like After Effects.
+//! them and queue the effect again (`invalidate`, run after every edit), like After Effects.
 //!
 //! Composition space: the solve's canonical frame maps to comp world by
 //! [`CameraSolve::world`] with the zoom of the first solved frame (focal length × the layer's
diff --git a/crates/engine/src/mask_track.rs b/crates/engine/src/analysis/mask_track.rs
similarity index 98%
rename from crates/engine/src/mask_track.rs
rename to crates/engine/src/analysis/mask_track.rs
index f85ba6b70..79c2b4643 100644
--- a/crates/engine/src/mask_track.rs
+++ b/crates/engine/src/analysis/mask_track.rs
@@ -80,10 +80,10 @@ impl MaskMethod {
         }
     }
     pub fn from_name(s: &str) -> Option<MaskMethod> {
-        let n: String = s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase();
+        let n: String = s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase();
         MaskMethod::ALL
             .into_iter()
-            .find(|m| m.id().to_ascii_lowercase() == n || m.label().chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase() == n)
+            .find(|m| m.id().to_ascii_lowercase() == n || m.label().chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase() == n)
     }
     pub fn model(self) -> Model {
         match self {
diff --git a/crates/engine/src/analysis/models.rs b/crates/engine/src/analysis/models.rs
new file mode 100644
index 000000000..63550545a
--- /dev/null
+++ b/crates/engine/src/analysis/models.rs
@@ -0,0 +1,1010 @@
+//! Trained models (Settings ▸ Roto Brush and Settings ▸ Face Tracking; `roto.model*` and
+//! `face.model*` commands): which models the registry offers (`effectcraft_segment::MODELS`, all
+//! open source), which are installed (in the `models` folder), installing one from a file or
+//! downloading the official weights (verified against the registry's SHA-256 either way, and kept
+//! with a notice naming their authors and licence), choosing one per task, and loading it in the
+//! background: into the Roto Brush effect (`effects::roto::set_model`) or the face tracker
+//! ([`Models::face`]).
+//!
+//! Weights are never bundled: the install stays small and nothing is fetched unless asked for.
+//! Downloads use the system's `curl` (shipped with Windows 10+, macOS and most Linux systems),
+//! so no networking code is linked into EffectCraft; without it, the file can be downloaded in a
+//! browser and installed with Install from File. The browser build uses the built-in engines
+//! only, for now.
+
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use effectcraft_segment::face::FaceModel;
+use effectcraft_segment::{self as seg, Loaded, ModelInfo, Task};
+use serde_json::{Value, json};
+use web_time::Instant;
+
+use crate::commands::{CommandSpec, always, b_p, bad, str_p};
+use crate::{EngineError, Result, Session, cmd, query};
+
+/// What a task's background worker reports.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Status {
+    /// What is happening now ("Downloading MobileSAM…").
+    pub busy: Option<String>,
+    /// Model whose load/download owns this lane, for selection-specific waits.
+    pub busy_model: Option<&'static str>,
+    /// The model in use.
+    pub active: Option<String>,
+    /// The last failure, for the Settings page.
+    pub error: Option<String>,
+    /// Model whose operation failed, so Roto status does not report another model's download.
+    pub error_model: Option<&'static str>,
+    /// Failure of the selected model's load; downloads cannot block or retry that load.
+    pub load_error: Option<String>,
+    /// A finished job's message and whether it failed, for a toast (taken by
+    /// [`Session::poll_models`]).
+    pub done: Option<(String, bool)>,
+    /// Counts selection and selected-weight changes: an older load is stale and its model is discarded.
+    pub generation: u64,
+}
+
+/// The session's trained models: per task, the worker's status; and the face model in use.
+#[derive(Default)]
+pub struct Models {
+    roto: Arc<Mutex<Status>>,
+    face: Arc<Mutex<Status>>,
+    face_model: FaceSlot,
+}
+
+impl Models {
+    fn lane(&self, task: Task) -> &Arc<Mutex<Status>> {
+        match task {
+            Task::Mask => &self.roto,
+            Task::Face => &self.face,
+        }
+    }
+
+    pub fn status(&self, task: Task) -> Status {
+        self.lane(task).lock().map(|s| s.clone()).unwrap_or_default()
+    }
+
+    /// The face model face tracking uses (`None`: the classic tracker).
+    pub fn face(&self) -> Option<Arc<dyn FaceModel>> {
+        self.face_model.lock().ok().and_then(|m| m.clone())
+    }
+
+    /// Activate a model that finished loading for the choice counted as `generation`; `false` (and the model is
+    /// dropped) when the choice changed meanwhile.
+    #[cfg(test)]
+    pub(crate) fn set_active_if_current(&self, task: Task, model: Loaded, generation: u64) -> bool {
+        activate_if_current(self.lane(task), &self.face_model, task, model, generation)
+    }
+
+    pub(crate) fn set_active(&self, task: Task, model: Option<Loaded>) {
+        activate(self.lane(task), &self.face_model, task, model);
+    }
+}
+
+type FaceSlot = Arc<Mutex<Option<Arc<dyn FaceModel>>>>;
+
+/// Put a loaded model to use (or drop `task`'s): Roto Brush's lives in the effect, the face
+/// tracker's in `face`.
+fn activate(lane: &Arc<Mutex<Status>>, face: &FaceSlot, task: Task, model: Option<Loaded>) {
+    let id = model.as_ref().map(|m| match m {
+        Loaded::Mask(m) => m.info().id.to_string(),
+        Loaded::Face(m) => m.info().id.to_string(),
+    });
+    match (task, model) {
+        (Task::Mask, Some(Loaded::Mask(m))) => crate::effects::roto::set_model(Some(m)),
+        (Task::Mask, _) => crate::effects::roto::set_model(None),
+        (Task::Face, m) => {
+            if let Ok(mut slot) = face.lock() {
+                *slot = match m {
+                    Some(Loaded::Face(f)) => Some(f),
+                    _ => None,
+                };
+            }
+        }
+    }
+    set(lane, |s| s.active = id);
+}
+
+/// [`activate`] a freshly loaded model unless the choice changed since the load started (`generation`); whether it
+/// was activated. The check and the activation happen under the lane's lock, so a selection can't slip between them.
+fn activate_if_current(lane: &Arc<Mutex<Status>>, face: &FaceSlot, task: Task, model: Loaded, generation: u64) -> bool {
+    let Ok(mut s) = lane.lock() else { return false };
+    if s.generation != generation {
+        return false;
+    }
+    let id = match &model {
+        Loaded::Mask(m) => m.info().id.to_string(),
+        Loaded::Face(m) => m.info().id.to_string(),
+    };
+    match (task, model) {
+        (Task::Mask, Loaded::Mask(m)) => crate::effects::roto::set_model(Some(m)),
+        (Task::Face, Loaded::Face(f)) => {
+            if let Ok(mut slot) = face.lock() {
+                *slot = Some(f);
+            }
+        }
+        _ => return false,
+    }
+    s.active = Some(id);
+    true
+}
+
+fn set(status: &Arc<Mutex<Status>>, f: impl FnOnce(&mut Status)) {
+    if let Ok(mut s) = status.lock() {
+        f(&mut s);
+    }
+}
+
+/// How a task shows in Settings, toasts and the command list.
+struct Kind {
+    /// Command prefix and settings key section.
+    prefix: &'static str,
+    label: &'static str,
+    classic_name: &'static str,
+    classic_description: &'static str,
+}
+
+const ROTO: Kind = Kind {
+    prefix: "roto",
+    label: "Roto Brush",
+    classic_name: "Classic (graph cut)",
+    classic_description: "Built in: colour models and graph cuts, propagated by optical flow. Always available.",
+};
+
+const FACE: Kind = Kind {
+    prefix: "face",
+    label: "Face Tracking",
+    classic_name: "Classic (shape model)",
+    classic_description: "Built in: a skin colour model, facial feature shapes and a fitted face shape model. Best on front-facing, evenly lit faces. Always available.",
+};
+
+fn kind(task: Task) -> &'static Kind {
+    match task {
+        Task::Mask => &ROTO,
+        Task::Face => &FACE,
+    }
+}
+
+/// How long a Roto Brush model may sit unused before its memory is freed.
+const ROTO_MODEL_IDLE: Duration = Duration::from_secs(600);
+
+/// How long a job that needs the Roto Brush model waits for it to load (or download) before it
+/// gives up. A worker that never reports back must not hang the command.
+const ROTO_MODEL_WAIT: Duration = Duration::from_secs(600);
+
+impl Session {
+    /// The folder installed models live in: the host's, else `models` next to the settings.
+    pub fn models_dir(&self) -> Option<PathBuf> {
+        self.models_dir.clone().or_else(|| Some(self.config.as_ref()?.dir()?.join("models")))
+    }
+
+    /// Where `m` is installed, if it is (a file of the published size).
+    pub fn model_path(&self, m: &ModelInfo) -> Option<PathBuf> {
+        let p = self.models_dir()?.join(m.file_name);
+        std::fs::metadata(&p).ok().filter(|md| md.len() == m.size).map(|_| p)
+    }
+
+    /// The model chosen for `task` (Settings).
+    pub fn chosen_model(&self, task: Task) -> &str {
+        match task {
+            Task::Mask => &self.prefs.roto.model,
+            Task::Face => &self.prefs.face.model,
+        }
+    }
+
+    fn choose_model(&mut self, task: Task, id: &str) {
+        let slot = match task {
+            Task::Mask => &mut self.prefs.roto.model,
+            Task::Face => &mut self.prefs.face.model,
+        };
+        let changed = slot != id;
+        if changed {
+            *slot = id.to_string();
+        }
+        set(self.models.lane(task), |s| {
+            // A load still running for the previous choice must not activate or report an error.
+            if changed {
+                s.generation = s.generation.wrapping_add(1);
+            }
+            // Selecting the same model explicitly retries a failed load.
+            s.error = None;
+            s.error_model = None;
+            s.load_error = None;
+        });
+    }
+
+    /// Load (or drop) the models Settings chooses; called whenever settings change.
+    pub fn apply_models(&mut self) {
+        for task in [Task::Mask, Task::Face] {
+            self.apply_model(task, false);
+        }
+    }
+
+    /// Load (or drop) `task`'s chosen model; `wait`: before returning (scripts and agents).
+    fn apply_model(&mut self, task: Task, wait: bool) {
+        let want = self.chosen_model(task).to_string();
+        let lane = self.models.lane(task).clone();
+        let st = self.models.status(task);
+        let info = seg::info(&want).filter(|m| m.task == task);
+        let Some(info) = info else {
+            if st.active.is_some() {
+                self.models.set_active(task, None);
+            }
+            return;
+        };
+        if st.active.as_deref() == Some(info.id) || st.busy.is_some() || st.load_error.is_some() {
+            return;
+        }
+        let Some(path) = self.model_path(info) else {
+            self.models.set_active(task, None);
+            return;
+        };
+        let (face_slot, label) = (self.models.face_model.clone(), kind(task).label);
+        let generation = st.generation;
+        spawn(&lane, label, format!("Loading {}…", info.name), wait, Some(generation), info.id, move |status| {
+            let m = load_file(&path, info.id)?;
+            // the choice changed while this loaded: drop the model, `poll_models` loads the new choice
+            if !activate_if_current(status, &face_slot, task, m, generation) {
+                return Ok(String::new());
+            }
+            Ok(format!("{label}: {} loaded", info.name))
+        });
+    }
+
+    /// The Roto Brush model in use (`None`: the classic engine).
+    pub fn models_roto_active(&self) -> Option<String> {
+        self.models.status(Task::Mask).active
+    }
+
+    /// Only installing the chosen model is a retry of that model's failed load.
+    fn retry_installed_model(&mut self, task: Task, id: &str, wait: bool) -> std::result::Result<bool, String> {
+        if self.chosen_model(task) != id {
+            return Ok(false);
+        }
+        set(self.models.lane(task), |s| {
+            s.error = None;
+            s.error_model = None;
+            s.load_error = None;
+            // A load that read the old file must not report failure after these weights replaced it.
+            s.generation = s.generation.wrapping_add(1);
+        });
+        if self.models.status(task).active.as_deref() == Some(id) {
+            return Ok(true);
+        }
+        if wait {
+            self.wait_model_worker(task, id)?;
+        }
+        self.apply_model(task, wait);
+        if wait {
+            let status = self.models.status(task);
+            if status.active.as_deref() != Some(id) {
+                return Err(status.load_error.unwrap_or_else(|| format!("{id} is not loaded: try again when the model worker is ready")));
+            }
+        }
+        Ok(true)
+    }
+
+    fn wait_model_worker(&self, task: Task, id: &str) -> std::result::Result<(), String> {
+        let started = Instant::now();
+        loop {
+            let status = self.models.status(task);
+            let Some(operation) = status.busy else { return Ok(()) };
+            if status.busy_model != Some(id) {
+                return Err(format!("{id} cannot load while another model operation is running ({operation}): try again when it is ready"));
+            }
+            if started.elapsed() >= ROTO_MODEL_WAIT {
+                return Err(format!("{} is still loading after {} minutes", self.chosen_model(task), ROTO_MODEL_WAIT.as_secs() / 60));
+            }
+            std::thread::sleep(Duration::from_millis(5));
+        }
+    }
+
+    /// The Roto Brush model Settings chose, when it is one (not the classic engine).
+    fn roto_model_info(&self) -> Option<&'static ModelInfo> {
+        seg::info(self.chosen_model(Task::Mask)).filter(|m| m.task == Task::Mask)
+    }
+
+    /// Whether the chosen Roto Brush model is still loading or downloading.
+    pub fn roto_model_loading(&self) -> bool {
+        let status = self.models.status(Task::Mask);
+        let chosen = self.chosen_model(Task::Mask);
+        status.active.as_deref() != Some(chosen) && status.busy.is_some() && status.busy_model == Some(chosen)
+    }
+
+    /// The Roto Brush model Settings chose and its state (`roto.status`).
+    pub fn roto_model(&self) -> Value {
+        let st = self.models.status(Task::Mask);
+        json!({
+            "selected": self.chosen_model(Task::Mask),
+            "installed": self.roto_model_info().is_none_or(|m| self.model_path(m).is_some()),
+            "active": st.active,
+            "loading": self.roto_model_loading(),
+            "error": st.load_error.or(st.error.filter(|_| st.error_model == Some(self.chosen_model(Task::Mask)))),
+        })
+    }
+
+    /// What `roto.status` says when the chosen model is not the one in use for this layer (`None`:
+    /// nothing to say). `uses_model`: the layer segments with a model at all (Roto Brush 1.0 does not).
+    pub fn roto_model_notice(&self, uses_model: bool) -> Option<String> {
+        let info = self.roto_model_info()?;
+        if !uses_model {
+            return Some(format!("{} is selected, but this layer is Roto Brush 1.0: it segments with the classic engine", info.name));
+        }
+        let st = self.models.status(Task::Mask);
+        if st.active.as_deref() == Some(info.id) {
+            None
+        } else if self.model_path(info).is_none() {
+            Some(format!("{} is selected but not installed: propagate refuses until it is installed or Classic is chosen", info.name))
+        } else if let Some(e) = st.load_error {
+            Some(format!("{} is selected but failed to load ({e}): propagate refuses until it is selected again", info.name))
+        } else {
+            Some(format!("{} is selected but not loaded yet: propagate loads it first with wait: true, and refuses without it", info.name))
+        }
+    }
+
+    /// What `roto.status` says when the saved tracking applies but Settings choose another model (`None`:
+    /// they agree, or nothing is saved).
+    pub fn saved_tracking_notice(&self, saved: Option<&str>) -> Option<String> {
+        let saved = saved?;
+        let chosen = self.chosen_model(Task::Mask);
+        if saved == chosen {
+            return None;
+        }
+        let name = |id: &str| seg::info(id).map_or(ROTO.classic_name, |m| m.name);
+        Some(format!("The saved tracking was made with {}; {} is chosen: Propagate again to replace it", name(saved), name(chosen)))
+    }
+
+    /// Make sure the Roto Brush model Settings chose is in use before a job that segments with it
+    /// starts, so the job never runs on the classic engine without saying so. With `wait`, a load
+    /// under way is waited for and one not started is loaded here; without it, a model that is not
+    /// ready is refused (and starts loading). A model that is not installed, or failed to load, is
+    /// refused either way. The classic engine needs nothing.
+    pub fn ensure_roto_model(&mut self, wait: bool) -> std::result::Result<(), String> {
+        let Some(info) = self.roto_model_info() else { return Ok(()) };
+        if self.models.status(Task::Mask).active.as_deref() == Some(info.id) {
+            return Ok(());
+        }
+        // A download or load under way (from Settings, or `select` without `wait`) finishes first.
+        // Nothing is in flight in the browser build, so this never sleeps there.
+        if wait {
+            self.wait_model_worker(Task::Mask, info.id)?;
+        }
+        if self.model_path(info).is_none() {
+            if self.models.status(Task::Mask).busy.is_some() {
+                return Err(format!("{} is still downloading: try again when it is ready, or pass wait: true", info.name));
+            }
+            return Err(format!("{} is selected for Roto Brush but not installed: install or download it, or choose {}", info.name, ROTO.classic_name));
+        }
+        let st = self.models.status(Task::Mask);
+        if st.active.as_deref() != Some(info.id) && st.busy.is_none() && st.load_error.is_none() {
+            self.apply_model(Task::Mask, wait);
+        }
+        let st = self.models.status(Task::Mask);
+        if st.active.as_deref() == Some(info.id) {
+            return Ok(());
+        }
+        if let Some(e) = st.load_error {
+            return Err(format!("{} failed to load: {e}", info.name));
+        }
+        Err(format!("{} is still loading: try again when it is ready, or pass wait: true", info.name))
+    }
+
+    /// Free a Roto Brush model that has been idle for [`ROTO_MODEL_IDLE`] (and is not under a job). The
+    /// choice stays: it loads again when a job or a stroke needs it.
+    fn unload_idle_roto_model(&mut self) {
+        if self.is_roto_running() || self.models.status(Task::Mask).busy.is_some() {
+            return;
+        }
+        let Some(m) = crate::effects::roto::installed_model() else { return };
+        if m.idle_secs().is_some_and(|s| s >= ROTO_MODEL_IDLE.as_secs_f64()) {
+            let name = m.info().name;
+            drop(m);
+            self.models.set_active(Task::Mask, None);
+            self.events.push(crate::Event::Toast {
+                message: format!("{name} unloaded after {} minutes idle; it loads again when it is used", ROTO_MODEL_IDLE.as_secs() / 60),
+                error: false,
+            });
+        }
+    }
+
+    /// Start loading the chosen Roto Brush model again if it was unloaded for being idle (before a stroke uses it).
+    /// The load runs on the model worker, so the stroke is never blocked on it (the classic engine segments it
+    /// meanwhile and `poll_models` installs the model when it arrives), and a model that already failed to load is
+    /// not retried on every stroke: choosing it again clears the error.
+    pub fn reload_roto_model(&mut self) {
+        let chosen = self.chosen_model(Task::Mask).to_string();
+        let st = self.models.status(Task::Mask);
+        if chosen != seg::CLASSICAL && st.active.is_none() && st.busy.is_none() && st.load_error.is_none() {
+            self.apply_model(Task::Mask, false);
+        }
+    }
+
+    /// Finish what the model workers did: a toast, and loading a model that just arrived.
+    pub fn poll_models(&mut self) {
+        self.unload_idle_roto_model();
+        for task in [Task::Mask, Task::Face] {
+            let done = self.models.lane(task).lock().ok().and_then(|mut s| s.done.take());
+            if let Some((message, error)) = done {
+                // a discarded (stale) load has no message
+                if !message.is_empty() {
+                    self.events.push(crate::Event::Toast { message, error });
+                }
+                self.apply_model(task, false);
+            }
+        }
+    }
+}
+
+fn load_file(path: &Path, id: &str) -> std::result::Result<Loaded, String> {
+    let bytes = std::fs::read(path).map_err(|e| format!("cannot read {}: {e}", path.display()))?;
+    // SAM 2 runs on candle and is native only; every other model loads through the registry.
+    #[cfg(not(target_arch = "wasm32"))]
+    if effectcraft_sam2::mask::SIZES.iter().any(|m| m.id == id) {
+        return effectcraft_sam2::mask::load(&bytes).map(|m| Loaded::Mask(m));
+    }
+    seg::load(id, &bytes)
+}
+
+/// Run `job` on a worker thread (`wait`: right here), reporting through `status` (desktop; the
+/// browser build has no trained models yet).
+fn spawn(
+    status: &Arc<Mutex<Status>>,
+    label: &'static str,
+    what: String,
+    wait: bool,
+    generation: Option<u64>,
+    model: &'static str,
+    job: impl FnOnce(&Arc<Mutex<Status>>) -> std::result::Result<String, String> + Send + 'static,
+) {
+    if cfg!(target_arch = "wasm32") {
+        set(status, |s| {
+            let message = "trained models are available in the desktop app".to_string();
+            if generation.is_some() {
+                s.load_error = Some(message.clone());
+            }
+            s.error = Some(message);
+            s.error_model = Some(model);
+        });
+        return;
+    }
+    set(status, |s| {
+        s.busy = Some(what);
+        s.busy_model = Some(model);
+        s.error = None;
+        s.error_model = None;
+    });
+    let st = status.clone();
+    let run = move || {
+        let r = job(&st);
+        set(&st, |s| {
+            s.busy = None;
+            s.busy_model = None;
+            if generation.is_some_and(|g| g != s.generation) {
+                // Keep a completion marker so polling starts the newly selected model.
+                s.done = Some((String::new(), false));
+                return;
+            }
+            match r {
+                Ok(msg) => s.done = Some((msg, false)),
+                Err(e) => {
+                    s.done = Some((format!("{label} model: {e}"), true));
+                    if generation.is_some() {
+                        s.load_error = Some(e.clone());
+                    }
+                    s.error = Some(e);
+                    s.error_model = Some(model);
+                }
+            }
+        });
+    };
+    if wait {
+        run();
+    } else if let Err(e) = std::thread::Builder::new().name("ec-model".into()).spawn(run) {
+        set(status, |s| {
+            s.busy = None;
+            s.busy_model = None;
+            let message = format!("cannot start: {e}");
+            if generation.is_some() {
+                s.load_error = Some(message.clone());
+            }
+            s.error = Some(message);
+            s.error_model = Some(model);
+        });
+    }
+}
+
+/// The notice kept next to `m`'s weights.
+fn notice_path(dir: &Path, m: &ModelInfo) -> PathBuf {
+    dir.join(format!("{}.NOTICE.txt", m.file_name))
+}
+
+/// Copy verified weights into the models folder (atomically), with their notice.
+fn install_bytes(dir: &Path, m: &ModelInfo, bytes: &[u8]) -> std::result::Result<PathBuf, String> {
+    if bytes.len() as u64 != m.size || seg::sha256::hex(bytes) != m.sha256 {
+        return Err(format!("this is not the published {} file (size or SHA-256 differs)", m.name));
+    }
+    use crate::config::FileOps;
+    let path = dir.join(m.file_name);
+    let files = crate::config::StdFiles;
+    files.write(&path, bytes).map_err(|e| format!("cannot write {}: {e}", path.display()))?;
+    files.write(&notice_path(dir, m), seg::notice(m).as_bytes()).map_err(|e| format!("cannot write the notice: {e}"))?;
+    Ok(path)
+}
+
+fn models_for_platform(task: Task, wasm: bool) -> impl Iterator<Item = &'static ModelInfo> {
+    seg::models(task).filter(move |m| !wasm || !m.id.starts_with("sam2.1-hiera-"))
+}
+
+fn target_models(task: Task) -> impl Iterator<Item = &'static ModelInfo> {
+    models_for_platform(task, cfg!(target_arch = "wasm32"))
+}
+
+fn model_p(p: &Value, cmd: &str, task: Task) -> Result<&'static ModelInfo> {
+    let id = str_p(p, "id").ok_or_else(|| bad(cmd, "missing `id`"))?;
+    target_models(task).find(|m| m.id == id).ok_or_else(|| bad(cmd, format!("unknown model `{id}` (see {}.models)", kind(task).prefix)))
+}
+
+fn list(s: &mut Session, task: Task) -> Result<Value> {
+    let k = kind(task);
+    let st = s.models.status(task);
+    let chosen = s.chosen_model(task).to_string();
+    let mut v = vec![json!({
+        "id": seg::CLASSICAL,
+        "name": k.classic_name,
+        "description": k.classic_description,
+        "licence": "MIT OR Apache-2.0",
+        "installed": true,
+        "selected": chosen == seg::CLASSICAL,
+        "active": st.active.is_none(),
+    })];
+    for m in target_models(task) {
+        #[cfg(not(target_arch = "wasm32"))]
+        let (recommended, hint) = (effectcraft_sam2::mask::recommended().id == m.id, effectcraft_sam2::mask::hint(m.id));
+        #[cfg(target_arch = "wasm32")]
+        let (recommended, hint) = (false, None::<String>);
+        v.push(json!({
+            "recommended": recommended,
+            "hint": hint,
+            "id": m.id,
+            "name": m.name,
+            "description": m.description,
+            "authors": m.authors,
+            "licence": m.licence,
+            "licenceUrl": m.licence_url,
+            "homepage": m.homepage,
+            "url": m.url,
+            "source": m.source,
+            "sourceFile": m.source.rsplit('/').next().unwrap_or(m.file_name),
+            "size": m.size,
+            "sha256": m.sha256,
+            "installed": s.model_path(m).is_some(),
+            "selected": chosen == m.id,
+            "active": st.active.as_deref() == Some(m.id),
+        }));
+    }
+    Ok(json!({"models": v, "busy": st.busy, "error": st.error, "folder": s.models_dir().map(|d| d.display().to_string())}))
+}
+
+/// After a `wait`: the job's failure, as the command's.
+fn waited(s: &Session, task: Task, cmd: &str) -> Result<()> {
+    match s.models.status(task).error {
+        Some(e) => Err(bad(cmd, e)),
+        None => Ok(()),
+    }
+}
+
+fn select(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
+    let cmd = format!("{}.model.select", kind(task).prefix);
+    let id = str_p(p, "id").ok_or_else(|| bad(&cmd, "missing `id`"))?;
+    if id != seg::CLASSICAL {
+        model_p(p, &cmd, task)?;
+    }
+    let wait = b_p(p, "wait").unwrap_or(false);
+    if wait && id != seg::CLASSICAL && s.models.status(task).active.as_deref() != Some(id) {
+        s.wait_model_worker(task, id).map_err(|error| bad(&cmd, error))?;
+    }
+    s.choose_model(task, id);
+    if wait {
+        s.apply_model(task, true);
+        waited(s, task, &cmd)?;
+    }
+    s.save_prefs();
+    s.prefs_changed();
+    Ok(json!({"model": id, "active": s.models.status(task).active}))
+}
+
+fn install(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
+    let cmd = format!("{}.model.install", kind(task).prefix);
+    let path = str_p(p, "path").ok_or_else(|| bad(&cmd, "missing `path` (the downloaded weights file)"))?;
+    let dir = s.models_dir().ok_or_else(|| bad(&cmd, "no settings folder to install into"))?;
+    let bytes = std::fs::read(path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
+    // Which model it is: the one asked for, or the one whose checksum it has.
+    let m = match str_p(p, "id") {
+        Some(_) => model_p(p, &cmd, task)?,
+        None => {
+            let h = seg::sha256::hex(&bytes);
+            target_models(task)
+                .find(|m| m.sha256 == h)
+                .ok_or_else(|| bad(&cmd, "this file is not a supported published model in the registry (SHA-256 differs)"))?
+        }
+    };
+    let dest = install_bytes(&dir, m, &bytes).map_err(|e| bad(&cmd, e))?;
+    let wait = b_p(p, "wait").unwrap_or(false);
+    s.retry_installed_model(task, m.id, wait).map_err(|error| bad(&cmd, error))?;
+    Ok(json!({"id": m.id, "path": dest.display().to_string()}))
+}
+
+fn download(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
+    let k = kind(task);
+    let cmd = format!("{}.model.download", k.prefix);
+    let m = model_p(p, &cmd, task)?;
+    if m.url.is_empty() {
+        return Err(bad(&cmd, format!("{} has no app download available: use Install from File with the SHA-256-verified weights", m.name)));
+    }
+    let dir = s.models_dir().ok_or_else(|| bad(&cmd, "no settings folder to install into"))?;
+    if s.models.status(task).busy.is_some() {
+        return Err(bad(&cmd, "a model is already downloading or loading"));
+    }
+    let size = if m.size >= 10_000_000 { format!("{} MB", m.size / 1_000_000) } else { format!("{:.1} MB", m.size as f64 / 1e6) };
+    let wait = b_p(p, "wait").unwrap_or(false);
+    spawn(s.models.lane(task), k.label, format!("Downloading {} ({size})…", m.name), wait, None, m.id, move |_| {
+        std::fs::create_dir_all(&dir).map_err(|e| format!("cannot create {}: {e}", dir.display()))?;
+        let tmp = dir.join(format!("{}.part", m.file_name));
+        let out = std::process::Command::new("curl")
+            .args(["-fsSL", "--retry", "2", "--connect-timeout", "20", "-o"])
+            .arg(&tmp)
+            .arg(m.url)
+            .output()
+            .map_err(|e| format!("downloading needs curl ({e}); or download {} in a browser and use Install from File", m.url))?;
+        if !out.status.success() {
+            let _ = std::fs::remove_file(&tmp);
+            return Err(format!("download failed: {}", String::from_utf8_lossy(&out.stderr).trim()));
+        }
+        let bytes = std::fs::read(&tmp).map_err(|e| format!("cannot read the download: {e}"))?;
+        let _ = std::fs::remove_file(&tmp);
+        install_bytes(&dir, m, &bytes)?;
+        Ok(format!("{}: {} downloaded and verified", k.label, m.name))
+    });
+    if wait {
+        waited(s, task, &cmd)?;
+        s.apply_model(task, true);
+        waited(s, task, &cmd)?;
+        return Ok(json!({"id": m.id, "installed": true}));
+    }
+    Ok(json!({"id": m.id, "downloading": true}))
+}
+
+fn remove(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
+    let m = model_p(p, &format!("{}.model.remove", kind(task).prefix), task)?;
+    let Some(path) = s.model_path(m) else { return Ok(json!({"removed": false})) };
+    if s.models.status(task).active.as_deref() == Some(m.id) {
+        s.models.set_active(task, None);
+    }
+    std::fs::remove_file(&path).map_err(|e| EngineError::Other(format!("cannot remove {}: {e}", path.display())))?;
+    if let Some(dir) = path.parent() {
+        let _ = std::fs::remove_file(notice_path(dir, m));
+    }
+    Ok(json!({"removed": true}))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        query!("roto.models", "Roto Brush Models", "{}", |s, _| list(s, Task::Mask)),
+        cmd!(
+            "roto.model.select",
+            "Use Roto Brush Model",
+            [],
+            None,
+            "{id: classical|mobilesam|sam2.1-hiera-tiny|sam2.1-hiera-small|sam2.1-hiera-base-plus|sam2.1-hiera-large, wait?} (Roto Brush 2.0 / 3.0 use it; wait: loaded before returning)",
+            always,
+            |s, p| select(s, p, Task::Mask)
+        ),
+        cmd!(
+            "roto.model.install",
+            "Install Roto Brush Model",
+            [],
+            None,
+            "{path: weights file, id?, wait?} — verified against the registry's SHA-256",
+            always,
+            |s, p| install(s, p, Task::Mask)
+        ),
+        cmd!(
+            "roto.model.download",
+            "Download Roto Brush Model",
+            [],
+            None,
+            "{id, wait?} — the official weights, verified (desktop; uses the system curl)",
+            always,
+            |s, p| download(s, p, Task::Mask)
+        ),
+        cmd!("roto.model.remove", "Remove Roto Brush Model", [], None, "{id}", always, |s, p| remove(s, p, Task::Mask)),
+        query!("face.models", "Face Tracking Models", "{}", |s, _| list(s, Task::Face)),
+        cmd!(
+            "face.model.select",
+            "Use Face Tracking Model",
+            [],
+            None,
+            "{id: classical|mediapipe-face, wait?} (face tracking uses it; wait: loaded before returning)",
+            always,
+            |s, p| select(s, p, Task::Face)
+        ),
+        cmd!(
+            "face.model.install",
+            "Install Face Tracking Model",
+            [],
+            None,
+            "{path: model file, id?, wait?} — verified against the registry's SHA-256",
+            always,
+            |s, p| install(s, p, Task::Face)
+        ),
+        cmd!(
+            "face.model.download",
+            "Download Face Tracking Model",
+            [],
+            None,
+            "{id, wait?} — the official model, verified (desktop; uses the system curl)",
+            always,
+            |s, p| download(s, p, Task::Face)
+        ),
+        cmd!("face.model.remove", "Remove Face Tracking Model", [], None, "{id}", always, |s, p| remove(s, p, Task::Face)),
+    ]
+}
+
+#[cfg(test)]
+mod availability_tests {
+    use super::*;
+
+    /// SAM 2 cannot start a network operation; file installation still verifies the published hash.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn sam2_is_install_from_file_only() {
+        let mut session = Session::default();
+        let listed = session.execute("roto.models", json!({})).unwrap();
+        for model in [seg::SAM2_TINY, seg::SAM2_SMALL, seg::SAM2_BASE_PLUS, seg::SAM2_LARGE] {
+            let error = session.execute("roto.model.download", json!({"id": model.id})).unwrap_err();
+            assert!(error.to_string().contains("Install from File"));
+            assert!(session.models.status(Task::Mask).busy.is_none());
+            assert!(install_bytes(Path::new("unused"), &model, b"invalid weights").unwrap_err().contains("SHA-256 differs"));
+            let row = listed["models"].as_array().unwrap().iter().find(|row| row["id"] == model.id).unwrap();
+            assert_eq!(row["source"], model.source);
+            assert_eq!(row["sourceFile"], "model.safetensors");
+        }
+    }
+
+    /// A waiting selection cannot claim completion while unrelated work prevents its model loading.
+    #[test]
+    fn waiting_selection_refuses_an_unrelated_worker_unless_the_model_is_active() {
+        crate::tests::roto::hold_roto_cache_test_lock();
+        for active in [false, true] {
+            let mut session = Session::default();
+            session.choose_model(Task::Mask, if active { "mobilesam" } else { seg::CLASSICAL });
+            set(session.models.lane(Task::Mask), |status| {
+                status.active = active.then(|| "mobilesam".into());
+                status.busy = Some("Downloading SAM 2".into());
+                status.busy_model = Some("sam2.1-hiera-tiny");
+            });
+            let result = session.execute("roto.model.select", json!({"id": "mobilesam", "wait": true}));
+            if active {
+                assert_eq!(result.unwrap()["active"], "mobilesam");
+            } else {
+                assert!(result.unwrap_err().to_string().contains("another model operation"));
+                assert_eq!(session.chosen_model(Task::Mask), seg::CLASSICAL, "a refused selection must not change settings");
+            }
+            assert!(session.models.status(Task::Mask).busy.is_some());
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn stale_model_worker_completions_do_not_poison_the_current_choice() {
+        for failure in [false, true] {
+            let lane = Arc::new(Mutex::new(Status::default()));
+            spawn(&lane, "Roto Brush", "Loading old choice".into(), true, Some(0), "mobilesam", move |status| {
+                set(status, |s| s.generation += 1);
+                if failure { Err("old choice failed".into()) } else { Ok("old choice loaded".into()) }
+            });
+            let status = lane.lock().unwrap();
+            assert!(status.busy.is_none());
+            assert!(status.error.is_none(), "an obsolete worker must not block the current model");
+            assert!(status.load_error.is_none());
+            assert_eq!(status.done, Some((String::new(), false)), "polling must still retry the current choice");
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn current_load_and_download_failures_remain_actionable() {
+        for generation in [Some(0), None] {
+            let lane = Arc::new(Mutex::new(Status::default()));
+            spawn(&lane, "Roto Brush", "Working".into(), true, generation, "mobilesam", move |status| {
+                if generation.is_none() {
+                    set(status, |s| s.generation += 1);
+                }
+                Err("current operation failed".into())
+            });
+            let status = lane.lock().unwrap();
+            assert!(status.busy.is_none());
+            assert_eq!(status.error.as_deref(), Some("current operation failed"));
+            assert_eq!(status.load_error.as_deref(), generation.map(|_| "current operation failed"));
+            assert_eq!(status.done, Some(("Roto Brush model: current operation failed".into(), true)));
+        }
+    }
+
+    #[test]
+    fn choosing_a_model_clears_its_previous_load_error_even_on_retry() {
+        let mut session = Session::default();
+        for id in ["mobilesam", "mobilesam", seg::CLASSICAL] {
+            let previous = session.chosen_model(Task::Mask).to_string();
+            let generation = session.models.status(Task::Mask).generation;
+            set(session.models.lane(Task::Mask), |s| {
+                s.error = Some("previous load failed".into());
+                s.load_error = s.error.clone();
+            });
+            session.choose_model(Task::Mask, id);
+            let status = session.models.status(Task::Mask);
+            assert!(status.error.is_none());
+            assert!(status.load_error.is_none());
+            assert_eq!(status.generation, generation + u64::from(previous != id));
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn selected_active_model_is_ready_despite_an_unrelated_download_error() {
+        let dir = std::env::temp_dir().join(format!("ec-model-ready-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let info = seg::info("mobilesam").unwrap();
+        let file = std::fs::File::create(dir.join(info.file_name)).unwrap();
+        file.set_len(info.size).unwrap();
+        drop(file);
+        let mut session = Session { models_dir: Some(dir.clone()), ..Default::default() };
+        session.choose_model(Task::Mask, info.id);
+        set(session.models.lane(Task::Mask), |s| {
+            s.active = Some(info.id.into());
+            s.error = Some("another model could not be downloaded".into());
+        });
+        assert_eq!(session.ensure_roto_model(false), Ok(()));
+        assert!(session.roto_model()["error"].is_null());
+        set(session.models.lane(Task::Mask), |status| {
+            status.error_model = Some("mobilesam");
+            status.error = Some("selected model download failed".into());
+        });
+        assert_eq!(session.roto_model()["error"], "selected model download failed");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn an_active_model_and_selected_install_do_not_wait_for_other_downloads() {
+        crate::tests::roto::hold_roto_cache_test_lock();
+        let mut session = Session::default();
+        session.choose_model(Task::Mask, "mobilesam");
+        set(session.models.lane(Task::Mask), |status| {
+            status.active = Some("mobilesam".into());
+            status.busy = Some("Downloading SAM 2".into());
+            status.busy_model = Some("sam2.1-hiera-tiny");
+        });
+        assert_eq!(session.ensure_roto_model(true), Ok(()));
+        assert_eq!(session.retry_installed_model(Task::Mask, "mobilesam", true), Ok(true));
+        let status = session.models.status(Task::Mask);
+        assert!(status.busy.is_some(), "the unrelated operation must still be running");
+        assert!(!session.roto_model_loading());
+        assert_eq!(session.roto_model()["loading"], false);
+    }
+
+    #[test]
+    fn waiting_on_an_inactive_model_refuses_unrelated_work_without_waiting() {
+        crate::tests::roto::hold_roto_cache_test_lock();
+        let mut session = Session::default();
+        session.choose_model(Task::Mask, "mobilesam");
+        set(session.models.lane(Task::Mask), |status| {
+            status.busy = Some("Downloading SAM 2".into());
+            status.busy_model = Some("sam2.1-hiera-tiny");
+        });
+        assert!(session.ensure_roto_model(true).unwrap_err().contains("another model operation"));
+        assert!(session.retry_installed_model(Task::Mask, "mobilesam", true).unwrap_err().contains("another model operation"));
+        assert!(session.models.status(Task::Mask).busy.is_some());
+        assert!(!session.roto_model_loading());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn downloads_do_not_block_an_inactive_model_or_retry_a_failed_load() {
+        crate::tests::roto::hold_roto_cache_test_lock();
+        let dir = std::env::temp_dir().join(format!("ec-model-download-state-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let info = seg::info("mobilesam").unwrap();
+        std::fs::File::create(dir.join(info.file_name)).unwrap().set_len(info.size).unwrap();
+        let mut session = Session { models_dir: Some(dir.clone()), ..Default::default() };
+        session.choose_model(Task::Mask, info.id);
+        let lane = session.models.lane(Task::Mask).clone();
+        spawn(&lane, "Roto Brush", "Downloading another model".into(), true, None, "sam2.1-hiera-tiny", |_| Err("download failed".into()));
+        assert_eq!(session.models.status(Task::Mask).error.as_deref(), Some("download failed"));
+        assert!(session.models.status(Task::Mask).load_error.is_none());
+        let error = session.ensure_roto_model(true).unwrap_err();
+        assert!(!error.contains("download failed"), "the installed model must be loaded despite a download failure");
+        let failure = session.models.status(Task::Mask).load_error;
+        assert!(failure.is_some(), "the synthetic weights were actually loaded and rejected");
+        for download_failed in [true, false] {
+            spawn(&lane, "Roto Brush", "Downloading another model".into(), true, None, "sam2.1-hiera-tiny", move |_| {
+                if download_failed { Err("download failed".into()) } else { Ok("downloaded".into()) }
+            });
+            session.poll_models();
+            session.reload_roto_model();
+            let status = session.models.status(Task::Mask);
+            assert_eq!(status.load_error, failure, "a download must not clear the selected model's load failure");
+            assert!(status.busy.is_none(), "polling and strokes must not retry a failed model");
+            assert!(session.ensure_roto_model(true).unwrap_err().contains(failure.as_deref().unwrap()));
+            assert!(session.roto_model_notice(true).unwrap().contains(failure.as_deref().unwrap()));
+        }
+        crate::effects::roto::set_model(None);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn installing_an_unselected_model_keeps_the_selected_models_load_failure() {
+        crate::tests::roto::hold_roto_cache_test_lock();
+        let mut session = Session::default();
+        session.choose_model(Task::Mask, "mobilesam");
+        set(session.models.lane(Task::Mask), |s| {
+            s.error = Some("selected model failed".into());
+            s.load_error = s.error.clone();
+        });
+        let before = session.models.status(Task::Mask);
+        for wait in [false, true] {
+            assert!(!session.retry_installed_model(Task::Mask, "sam2.1-hiera-tiny", wait).unwrap());
+            assert_eq!(session.models.status(Task::Mask), before);
+        }
+        // Installing the selected weights is an explicit retry, even if the installed path
+        // has since gone away (no load is started from this session's missing model folder).
+        assert!(session.retry_installed_model(Task::Mask, "mobilesam", false).unwrap());
+        assert!(session.models.status(Task::Mask).load_error.is_none());
+        assert!(session.models.status(Task::Mask).error.is_none());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn installing_selected_weights_with_wait_finishes_the_replacement_load() {
+        crate::tests::roto::hold_roto_cache_test_lock();
+        let dir = std::env::temp_dir().join(format!("ec-model-install-running-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let info = seg::info("mobilesam").unwrap();
+        std::fs::File::create(dir.join(info.file_name)).unwrap().set_len(info.size).unwrap();
+        let mut session = Session { models_dir: Some(dir.clone()), ..Default::default() };
+        session.choose_model(Task::Mask, info.id);
+        let generation = session.models.status(Task::Mask).generation;
+        let lane = session.models.lane(Task::Mask).clone();
+        spawn(&lane, "Roto Brush", "Loading the previous file".into(), false, Some(generation), info.id, move |status| {
+            let started = Instant::now();
+            while status.lock().unwrap().generation == generation {
+                if started.elapsed() > Duration::from_secs(3) {
+                    return Err("test did not start the replacement".into());
+                }
+                std::thread::sleep(Duration::from_millis(1));
+            }
+            Err("previous file failed".into())
+        });
+        assert!(session.retry_installed_model(Task::Mask, info.id, true).unwrap_err().contains("SHA-256"));
+        let status = session.models.status(Task::Mask);
+        assert!(status.busy.is_none());
+        assert!(
+            status.load_error.as_ref().is_some_and(|error| error.contains("SHA-256")),
+            "wait must finish loading the replacement weights and report their actual validation error"
+        );
+        assert_ne!(status.error.as_deref(), Some("previous file failed"));
+        crate::effects::roto::set_model(None);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn browser_models_exclude_native_trackers_and_keep_portable_models() {
+        let browser: Vec<_> = models_for_platform(Task::Mask, true).map(|m| m.id).collect();
+        assert_eq!(browser, ["mobilesam"]);
+        let desktop: Vec<_> = models_for_platform(Task::Mask, false).map(|m| m.id).collect();
+        assert_eq!(desktop, ["mobilesam", "sam2.1-hiera-tiny", "sam2.1-hiera-small", "sam2.1-hiera-base-plus", "sam2.1-hiera-large"]);
+        for wasm in [false, true] {
+            assert_eq!(models_for_platform(Task::Face, wasm).map(|m| m.id).collect::<Vec<_>>(), ["mediapipe-face"]);
+        }
+    }
+}
diff --git a/crates/engine/src/roto.rs b/crates/engine/src/analysis/roto.rs
similarity index 80%
rename from crates/engine/src/roto.rs
rename to crates/engine/src/analysis/roto.rs
index 49f53d39b..3fe049e20 100644
--- a/crates/engine/src/roto.rs
+++ b/crates/engine/src/analysis/roto.rs
@@ -6,7 +6,7 @@
 //! `wait`; in the browser the background is a Web Worker whose segmentations stream back,
 //! [`crate::offload`]), frame by frame outward from the base frame, rendering the effect's input
 //! (`Renderer::layer_input`, source → masks → the effects above it). `roto.freeze` runs the same
-//! pass and stores the final mattes in the effect (one undo step). [`sync`], run after every
+//! pass and stores the final mattes in the effect (one undo step). `sync`, run after every
 //! edit, keeps each instance's hidden Input Key equal to a signature of what its frames are made
 //! of (the layer's source and timing, its masks and the effects above it) and drops frozen
 //! mattes made from other frames.
@@ -22,7 +22,7 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex};
 
 use effectcraft_effects::object_matte as om;
-use effectcraft_effects::roto::{self as fx, FROZEN, FrozenCache, INPUT_KEY};
+use effectcraft_effects::roto::{self as fx, FROZEN, FrozenCache, INPUT_KEY, TRACKED};
 use effectcraft_effects::{Params, flatten_params};
 use effectcraft_keyframe::Value;
 use effectcraft_project::{GroupKind, ItemId, ItemKind, Layer, LayerId, Project, PropGroup, Uid};
@@ -51,6 +51,9 @@ pub struct RotoOptions {
     pub boundary_color: [f64; 3],
     /// Start propagating in the background after each stroke.
     pub auto_propagate: bool,
+    /// The object new strokes belong to (0 is the first). With a tracker every object is followed on its own
+    /// and their mattes are united; the classic engine treats all foreground strokes as one object.
+    pub object: u32,
 }
 
 impl Default for RotoOptions {
@@ -63,10 +66,14 @@ impl Default for RotoOptions {
             overlay_opacity: 50.0,
             boundary_color: [1.0, 0.25, 0.75],
             auto_propagate: true,
+            object: 0,
         }
     }
 }
 
+/// The highest object id (SAM 2 follows up to 32 objects in one pass).
+pub const MAX_OBJECT_ID: u32 = 31;
+
 pub const VIEWS: [&str; 4] = ["alphaBoundary", "alpha", "alphaOverlay", "none"];
 
 /// What a job does.
@@ -112,6 +119,10 @@ pub struct RotoProgress {
     pub error: Option<String>,
     /// The job works on an Object Matte (else a Roto Brush & Refine Edge).
     pub object_matte: bool,
+    /// What the model's tracker found, when one followed the object (SAM 2).
+    pub tracked: Option<fx::TrackSummary>,
+    /// Why the tracker was not used, when a tracking model was chosen but the classic engine ran.
+    pub tracker_note: Option<String>,
 }
 
 impl RotoProgress {
@@ -131,6 +142,8 @@ pub struct RotoShared {
     pub cancel: AtomicBool,
     pub state: Mutex<RotoProgress>,
     frozen: Mutex<Option<FrozenCache>>,
+    /// The tracker's frames, as the saved tracking (JSON) to store with the instance.
+    saved: Mutex<Option<String>>,
 }
 
 pub struct RotoJob {
@@ -249,6 +262,7 @@ pub(crate) fn sync(before: &Project, after: &mut Project) -> Vec<(ItemId, LayerI
             set_str(g, INPUT_KEY, key);
             if had {
                 set_str(g, FROZEN, String::new());
+                set_str(g, TRACKED, String::new());
             }
         }
     }
@@ -279,7 +293,7 @@ pub(crate) fn params_at(p: &Project, cid: ItemId, layer: &Layer, g: &PropGroup,
 }
 
 /// The layer's source size (layer pixels).
-pub(crate) fn layer_size(p: &Project, comp: &effectcraft_project::Comp, layer: &Layer) -> [f64; 2] {
+pub fn layer_size(p: &Project, comp: &effectcraft_project::Comp, layer: &Layer) -> [f64; 2] {
     effectcraft_render::effect_bounds(p, comp, layer).0
 }
 
@@ -432,10 +446,51 @@ async fn run_work(w: Work, shared: &RotoShared) {
         s.object_matte = w.object_matte;
     }
     let cancel = || shared.cancel.load(Ordering::Relaxed);
-    let chain = fx::Chain::new(&w.params, w.size, w.fps, 1.0);
+    let mut chain = fx::Chain::new(&w.params, w.size, w.fps, 1.0);
+    if w.task == RotoTask::Propagate && !w.object_matte {
+        chain.prepare_propagation();
+    }
     let model = fx::installed_model();
     let key = if w.object_matte { om::frozen_key(&w.params, w.size, w.fps, model.as_deref()) } else { fx::frozen_key(&w.params, w.size, w.fps) };
     let mut frozen = FrozenCache { key, ..Default::default() };
+    // A tracking model (SAM 2) follows the object through the whole span in one pass; the loop
+    // below then finds every frame cached. Without one (or if it fails) nothing changes: the
+    // classic engine runs frame by frame.
+    if w.task == RotoTask::Propagate && !w.object_matte && chain.has_tracker() {
+        let mut get = |g: i64| src.get(g);
+        let mut report = |n: usize| {
+            let mut s = lock(&shared.state);
+            s.done = n as u64;
+            s.elapsed = t0.elapsed().as_secs_f64();
+            s.fps = if s.elapsed > 0.0 { s.done as f64 / s.elapsed } else { 0.0 };
+            crate::offload::report(s.done, s.total);
+        };
+        let result = chain.track_frames(Some(&w.frames), &mut get, &cancel, &mut report);
+        if cancel() {
+            let mut s = lock(&shared.state);
+            s.cancelled = true;
+            s.finished = true;
+            return;
+        }
+        // The frames it followed replace the saved tracking (see `poll_roto_job`): none if it failed.
+        *lock(&shared.saved) = Some(match &result {
+            Ok(_) => fx::tracks_of(&chain).map(|t| t.to_json()).unwrap_or_default(),
+            Err(_) => String::new(),
+        });
+        if result.is_err() {
+            chain.forget_tracking();
+        }
+        let mut s = lock(&shared.state);
+        match result {
+            Ok(summary) => s.tracked = summary,
+            Err(e) => s.tracker_note = Some(format!("tracker unavailable, classic engine used: {e}")),
+        }
+    } else if w.task == RotoTask::Propagate && !w.object_matte {
+        // With the classic engine, Propagate leaves no saved tracking behind.
+        *lock(&shared.saved) = Some(String::new());
+    }
+    // Freezing again keeps the frames frozen already (resolved once: it reads the whole frozen cache).
+    let kept = if w.task == RotoTask::Freeze && !w.object_matte { fx::applying_frozen(&w.params, w.size, w.fps) } else { None };
     for (k, f) in w.frames.iter().enumerate() {
         if cancel() {
             let mut s = lock(&shared.state);
@@ -450,7 +505,18 @@ async fn run_work(w: Work, shared: &RotoShared) {
             (RotoTask::Propagate, true) => om::ensure(&w.params, w.size, w.fps, *f, model.clone(), &mut get, &cancel).is_some(),
             (RotoTask::Freeze, true) => {
                 let img = get(*f);
-                match img.map(|img| (om::frame_matte(&w.params, w.size, w.fps, *f, 1.0, &img, model.clone(), &mut get, &cancel), img)) {
+                match img.map(|img| {
+                    (
+                        om::frame_matte(
+                            &w.params,
+                            &om::MatteFrame { layer_size: w.size, fps: w.fps, frame: *f, scale: 1.0, img: &img },
+                            model.clone(),
+                            &mut get,
+                            &cancel,
+                        ),
+                        img,
+                    )
+                }) {
                     Some((om::FrameMatte::Alpha(a), img)) => {
                         frozen.size = [img.width as usize, img.height as usize];
                         frozen.frames.insert(*f, fx::freeze_frame(&a, &[]));
@@ -460,7 +526,7 @@ async fn run_work(w: Work, shared: &RotoShared) {
                 }
             }
             (RotoTask::Propagate, false) => chain.ensure(*f, &mut get, &cancel).is_some(),
-            (RotoTask::Freeze, false) => match fx::frame_matte(&w.params, w.size, w.fps, *f, &mut get, &cancel) {
+            (RotoTask::Freeze, false) => match fx::frame_matte(&w.params, w.size, w.fps, *f, kept.as_deref(), &mut get, &cancel) {
                 Some((a, b)) => {
                     if let Some(img) = src.get(*f) {
                         frozen.size = [img.width as usize, img.height as usize];
@@ -581,9 +647,37 @@ impl Session {
         }
     }
 
+    /// Whether the tracking saved with Roto Brush `effect` covers every frame a Freeze would write.
+    fn freeze_is_saved(&self, comp: ItemId, layer: LayerId, effect: Uid) -> bool {
+        let Some(c) = self.project.comp(comp) else { return false };
+        let Some(l) = c.layer(layer) else { return false };
+        let Some(g) = l.effects().and_then(|f| f.groups().find(|g| g.uid == effect)).filter(|g| is_roto(g)) else { return false };
+        let pstat = params_static(g);
+        let d = fx::data(&pstat);
+        if d.is_empty() {
+            return false;
+        }
+        let t = comp_time_of(c, l, d.base.unwrap_or(0));
+        let params = params_at(&self.project, comp, l, g, t, self.expr.as_deref());
+        fx::saved_covers(&params, layer_size(&self.project, c, l), c.frame_rate.as_f64(), &job_frames(&d, Direction::Both))
+    }
+
+    /// Whether `effect` on `layer` segments with the model Settings chose: Object Matte always,
+    /// Roto Brush unless it is version 1.0 (the classic engine).
+    pub(crate) fn uses_roto_model(&self, comp: ItemId, layer: LayerId, effect: Uid) -> bool {
+        let g = self.project.comp(comp).and_then(|c| c.layer(layer)).and_then(|l| l.effects()).and_then(|f| f.groups().find(|g| g.uid == effect));
+        g.is_some_and(|g| is_object_matte(g) || fx::uses_model(&params_static(g)))
+    }
+
     /// Start propagating (or freezing) Roto Brush `effect` on `layer`. `wait`: block until done
     /// (wasm32 always does). Returns the number of frames.
     pub fn start_roto(&mut self, comp: ItemId, layer: LayerId, effect: Uid, task: RotoTask, dir: Direction, wait: bool) -> Result<usize, String> {
+        // The model must be in use before the job starts: otherwise it would run on the classic
+        // engine without saying so.
+        // A Freeze whose frames all have saved tracking reads them without the model.
+        if self.uses_roto_model(comp, layer, effect) && !(task == RotoTask::Freeze && self.freeze_is_saved(comp, layer, effect)) {
+            self.ensure_roto_model(wait)?;
+        }
         if self.is_roto_running() {
             if !wait {
                 return Err("a Roto Brush job is already running".into());
@@ -686,6 +780,17 @@ impl Session {
         Ok(n)
     }
 
+    /// Save the tracker's frames in the instance, unless its strokes changed while it tracked. No undo
+    /// step: the frames are a cache of the strokes and the span (a stale copy is ignored).
+    fn save_tracks(&mut self, cid: ItemId, lid: LayerId, uid: Uid, strokes: &str, json: String) {
+        let p = Arc::make_mut(&mut self.project);
+        if let Some(g) = p.comp_mut(cid).and_then(|c| c.layer_mut(lid)).and_then(|l| l.props.find_group_mut(uid))
+            && guard_of(g) == strokes
+        {
+            set_str(g, TRACKED, json);
+        }
+    }
+
     /// Finish a done job: Freeze writes the frozen mattes (one undo step).
     fn poll_roto_job(&mut self) -> bool {
         let Some(job) = &self.roto_job else { return false };
@@ -712,6 +817,10 @@ impl Session {
             RotoTask::Propagate => {
                 let verb = if job.object_matte { "tracked" } else { "propagated" };
                 self.events.push(Event::Toast { message: format!("{name}: {verb} {} frame(s) in {:.1} s", st.done, st.elapsed), error: false });
+                // The frames the tracker followed are saved with the instance.
+                if let Some(json) = lock(&job.shared.saved).take() {
+                    self.save_tracks(job.comp, job.layer, job.effect, &job.strokes, json);
+                }
                 // Rendered frames depend on the cache: redraw.
                 self.bump();
             }
@@ -745,18 +854,41 @@ impl Session {
     /// instances in the background.
     pub fn poll_roto(&mut self, auto: bool) -> bool {
         self.poll_models();
+        self.poll_library();
         let changed = self.poll_roto_job();
-        if auto && self.roto_job.is_none() && self.offloaded_roto().is_none() && self.state.roto.auto_propagate {
+        // Edited instances stay pending while the model they will segment with is still loading.
+        let loading = self.roto_model_loading();
+        if auto && self.roto_job.is_none() && self.offloaded_roto().is_none() && self.state.roto.auto_propagate && !loading {
             while let Some((c, l, e)) = self.roto_pending.first().copied() {
                 self.roto_pending.remove(0);
-                if self.start_roto(c, l, e, RotoTask::Propagate, Direction::Both, false).is_ok() {
-                    return true;
+                match self.start_roto(c, l, e, RotoTask::Propagate, Direction::Both, false) {
+                    Ok(_) => return true,
+                    Err(message) => self.events.push(Event::Toast { message, error: true }),
                 }
             }
         }
         changed
     }
 
+    /// How far to trust the frames a tracker followed (SAM 2), by layer frame: its confidence and
+    /// whether the object was absent. Frames the classic engine made have no entry.
+    pub fn roto_trust(&self, comp: ItemId, layer: LayerId, effect: Uid) -> BTreeMap<i64, fx::FrameTrust> {
+        let mut out = BTreeMap::new();
+        let Some(c) = self.project.comp(comp) else { return out };
+        let Some(l) = c.layer(layer) else { return out };
+        let Some(g) = l.props.find_group(effect) else { return out };
+        if is_object_matte(g) {
+            return out;
+        }
+        let ch = fx::Chain::new(&params_static(g), layer_size(&self.project, c, l), c.frame_rate.as_f64(), 1.0);
+        for f in ch.keys.keys() {
+            if let Some(t) = ch.trust_at(*f) {
+                out.insert(*f, t);
+            }
+        }
+        out
+    }
+
     /// The computed frames of an instance (full resolution), by layer frame.
     pub fn roto_computed(&self, comp: ItemId, layer: LayerId, effect: Uid) -> BTreeMap<i64, bool> {
         let mut out = BTreeMap::new();
diff --git a/crates/engine/src/tracking.rs b/crates/engine/src/analysis/tracking.rs
similarity index 98%
rename from crates/engine/src/tracking.rs
rename to crates/engine/src/analysis/tracking.rs
index cfdd12441..912a8adfe 100644
--- a/crates/engine/src/tracking.rs
+++ b/crates/engine/src/analysis/tracking.rs
@@ -157,7 +157,7 @@ pub struct TrackShared {
 }
 
 pub(crate) fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
-    m.lock().unwrap_or_else(|e| e.into_inner())
+    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }
 
 /// A running (or finished, not yet polled) analysis.
@@ -197,7 +197,8 @@ pub(crate) struct Work {
 }
 
 /// The layer's source frame at comp time `t` at 100 % (layer pixels + offset = image pixels).
-/// Footage at its native size is used straight from the footage source (no copy).
+/// Footage at its native size is used straight from the footage source (no copy unless its
+/// Cineon Settings convert it).
 pub(crate) fn source_frame(
     r: &Renderer,
     project: &Project,
@@ -207,7 +208,7 @@ pub(crate) fn source_frame(
     t: Tick,
     expr: Option<&dyn ExprHost>,
 ) -> Option<(Arc<Image>, [f64; 2])> {
-    let ctx = EvalCtx { project, comp_id: cid, comp, time: t, expr, footage: None };
+    let ctx = EvalCtx { project, comp_id: cid, comp, time: t, expr, footage: None, property_overrides: &[], media_overrides: &[], reads: None };
     if let effectcraft_project::LayerSource::Footage { item } = &layer.source
         && let Some(effectcraft_project::ItemKind::Footage(f)) = project.item(*item).map(|i| &i.kind)
         && f.has_video
@@ -215,7 +216,7 @@ pub(crate) fn source_frame(
         && img.width == f.width
         && img.height == f.height
     {
-        return Some((img, [0.0; 2]));
+        return Some((effectcraft_render::cineon_frame(img, f), [0.0; 2]));
     }
     let buf = r.layer_source(&ctx, layer)?;
     if (buf.scale - 1.0).abs() > 1e-9 && buf.scale > 0.0 {
diff --git a/crates/engine/src/warp.rs b/crates/engine/src/analysis/warp.rs
similarity index 96%
rename from crates/engine/src/warp.rs
rename to crates/engine/src/analysis/warp.rs
index 7928a5cab..71ee45ee6 100644
--- a/crates/engine/src/warp.rs
+++ b/crates/engine/src/analysis/warp.rs
@@ -4,10 +4,10 @@
 //! the Warp Stabilizer, `Renderer::layer_input`) for every frame between the layer's In and Out
 //! points on a background thread, and feeds the frames to `effectcraft_track::stabilize`'s
 //! analyzer (step 1 of 2, "Analyzing in background"); step 2 ("Stabilizing") derives the
-//! stabilization plan once to validate the result. When the job finishes, the analysis is
+//! stabilization plan once to validate and cache the result. When the job finishes, the analysis is
 //! written into the effect's hidden Analysis parameter as one undo step, together with a key of
 //! what it was made from (the layer's source, In/Out, start, stretch and Time Remap). Edits that
-//! change those clear the analysis ([`invalidate`], run after every edit) and queue the effect
+//! change those clear the analysis (`invalidate`, run after every edit) and queue the effect
 //! for re-analysis, which frontends start with [`Session::poll_warp`] (After Effects re-analyses
 //! automatically too).
 
@@ -21,7 +21,7 @@ use effectcraft_project::{GroupKind, ItemId, ItemKind, Layer, LayerId, LayerSour
 use effectcraft_raster::Image;
 use effectcraft_render::{EvalCtx, ExprHost, FootageSource, LayerCache, Renderer};
 use effectcraft_time::Tick;
-use effectcraft_track::stabilize::{AnalyzeOpts, Analyzer, StabSettings, WarpAnalysis};
+use effectcraft_track::stabilize::{AnalyzeOpts, Analyzer, WarpAnalysis};
 use serde::Serialize;
 
 use crate::tracking::lock;
@@ -245,9 +245,8 @@ async fn run_work(w: WarpWork, shared: &WarpShared) {
     let lt0 = layer.layer_time(w.times[0]).seconds();
     let fd = if w.times.len() > 1 { layer.layer_time(w.times[1]).seconds() - lt0 } else { comp.frame_duration().seconds() };
     let a = an.finish(lt0, fd);
-    // Step 2: derive a plan once (validates the motion and warms nothing else up).
-    let plan = effectcraft_track::stabilize::plan(&a, &StabSettings { fps: if fd > 0.0 { 1.0 / fd } else { 30.0 }, ..Default::default() });
-    if plan.warps.len() != a.frames.len() || plan.warps.iter().any(|h| h.0.iter().flatten().any(|v| !v.is_finite())) {
+    // Plan from the stored JSON, exactly as rendering does, and retain it for the first render.
+    if !warp_stab::prepare_default_plan(&a.to_json()) {
         return fail("the stabilization could not be computed");
     }
     *lock(&shared.result) = Some(a);
diff --git a/crates/engine/src/background.rs b/crates/engine/src/background.rs
new file mode 100644
index 000000000..d4d404d95
--- /dev/null
+++ b/crates/engine/src/background.rs
@@ -0,0 +1,3 @@
+pub mod jobs;
+pub mod offload;
+pub mod remote;
diff --git a/crates/engine/src/jobs.rs b/crates/engine/src/background/jobs.rs
similarity index 100%
rename from crates/engine/src/jobs.rs
rename to crates/engine/src/background/jobs.rs
diff --git a/crates/engine/src/offload.rs b/crates/engine/src/background/offload.rs
similarity index 72%
rename from crates/engine/src/offload.rs
rename to crates/engine/src/background/offload.rs
index ad2c0cde0..b28527f02 100644
--- a/crates/engine/src/offload.rs
+++ b/crates/engine/src/background/offload.rs
@@ -289,10 +289,10 @@ pub struct Inbox(Mutex<Vec<WorkerReply>>);
 
 impl Inbox {
     pub fn push(&self, r: WorkerReply) {
-        self.0.lock().unwrap_or_else(|e| e.into_inner()).push(r);
+        self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(r);
     }
     pub fn take(&self) -> Vec<WorkerReply> {
-        std::mem::take(&mut *self.0.lock().unwrap_or_else(|e| e.into_inner()))
+        std::mem::take(&mut *self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner))
     }
 }
 
@@ -375,7 +375,7 @@ pub(crate) fn job_accel() -> Option<Arc<dyn Accelerator>> {
 }
 
 /// Render options of an analysis's input frames: 100 %; with an accelerator, the project's
-/// renderer (Mercury GPU Acceleration: its GPU effects on the device; Software Only: the CPU).
+/// renderer (GPU Acceleration: its GPU effects on the device; Software Only: the CPU).
 pub(crate) fn analysis_opts(accel: Option<&dyn Accelerator>) -> RenderOpts {
     RenderOpts { scale: 1.0, backend: if accel.is_some() { Backend::Auto } else { Backend::Cpu }, ..Default::default() }
 }
@@ -558,6 +558,7 @@ async fn fill(s: &mut Session, plan: crate::commands::content_fill::FillPlan, po
         true
     };
     let accel = job_accel();
+    let fill = accel.as_deref().and_then(|a| a.inpaint());
     let files = crate::commands::content_fill::run_plan(
         &plan,
         &s.project,
@@ -566,6 +567,7 @@ async fn fill(s: &mut Session, plan: crate::commands::content_fill::FillPlan, po
         &s.layer_cache,
         s.services.as_ref(),
         accel.as_deref(),
+        fill,
         &mut progress,
         &mut |_| {},
     )
@@ -992,317 +994,4 @@ pub(crate) fn merge_group(base: &PropGroup, live: &PropGroup, result: &PropGroup
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn round<T: Serialize + for<'de> Deserialize<'de>>(v: &T) -> String {
-        let a = serde_json::to_string(v).unwrap();
-        let back: T = serde_json::from_str(&a).unwrap();
-        let b = serde_json::to_string(&back).unwrap();
-        assert_eq!(a, b);
-        a
-    }
-
-    /// A group with properties `a` (uid 2) and `b` (uid 3) and a sub-group (uid 4) holding `c`
-    /// (uid 5).
-    fn group() -> PropGroup {
-        use effectcraft_keyframe::Value as KV;
-        use effectcraft_project::{Node, Property};
-        let mut sub = PropGroup::new(4, "sub", "Sub");
-        sub.children.push(Node::Prop(Property::new(5, "c", "C", KV::Scalar(0.0))));
-        let mut g = PropGroup::new(1, "fx", "Effect");
-        g.children.push(Node::Prop(Property::new(2, "a", "A", KV::Scalar(0.0))));
-        g.children.push(Node::Prop(Property::new(3, "b", "B", KV::Scalar(0.0))));
-        g.children.push(Node::Group(sub));
-        g
-    }
-
-    fn set(g: &mut PropGroup, uid: Uid, v: f64) {
-        g.find_mut(uid).unwrap().value = effectcraft_keyframe::Value::Scalar(v);
-    }
-
-    fn get(g: &PropGroup, uid: Uid) -> f64 {
-        match g.find(uid).unwrap().value {
-            effectcraft_keyframe::Value::Scalar(v) => v,
-            ref v => panic!("{v:?}"),
-        }
-    }
-
-    #[test]
-    fn analysis_results_merge_with_edits_made_meanwhile() {
-        use effectcraft_project::Node;
-        let base = group();
-        // The user changes `a` and switches the effect off; the analysis writes `b` and `c`.
-        let mut live = base.clone();
-        set(&mut live, 2, 1.0);
-        live.enabled = false;
-        let mut result = base.clone();
-        set(&mut result, 3, 2.0);
-        set(&mut result, 5, 3.0);
-        let m = merge_group(&base, &live, &result).unwrap();
-        assert_eq!((get(&m, 2), get(&m, 3), get(&m, 5), m.enabled), (1.0, 2.0, 3.0, false));
-        // Unchanged on either side: the other side wins whole.
-        assert_eq!(merge_group(&base, &base, &result).unwrap(), result);
-        assert_eq!(merge_group(&base, &live, &base).unwrap(), live);
-        // Both changed `b`, differently: a conflict (nothing is applied). The same way: fine.
-        let mut both = live.clone();
-        set(&mut both, 3, 9.0);
-        assert!(merge_group(&base, &both, &result).is_none());
-        set(&mut both, 3, 2.0);
-        assert_eq!(get(&merge_group(&base, &both, &result).unwrap(), 3), 2.0);
-        // The analysis adds a child (a result group) while the user edits `a`: both kept.
-        let mut added = result.clone();
-        added.children.push(Node::Group(PropGroup::new(6, "out", "Output")));
-        let m = merge_group(&base, &live, &added).unwrap();
-        assert!(m.find_group(6).is_some() && get(&m, 2) == 1.0);
-        // The analysis drops the sub-group the user didn't touch: dropped.
-        let mut dropped = result.clone();
-        dropped.children.retain(|n| !matches!(n, Node::Group(g) if g.uid == 4));
-        let m = merge_group(&base, &live, &dropped).unwrap();
-        assert!(m.find_group(4).is_none() && get(&m, 2) == 1.0);
-        // …but if the user changed something in it, that's a conflict.
-        let mut touched = live.clone();
-        set(&mut touched, 5, 7.0);
-        assert!(merge_group(&base, &touched, &dropped).is_none());
-    }
-
-    #[test]
-    fn protocol_round_trips() {
-        let mut s = Session::default();
-        s.execute("file.openDemoProject", serde_json::json!({})).unwrap();
-        let comp = s.active_comp_id().unwrap();
-        s.execute("renderQueue.add", serde_json::json!({})).unwrap();
-        let item = s.project.render_queue[0].clone();
-        let reqs = [
-            WorkerJob::Render { items: vec![vec![(item.clone(), "/out.gif".into())]] },
-            WorkerJob::Warp { comp, layer: LayerId(3), effect: 9 },
-            WorkerJob::WarpPlan { comp, layer: LayerId(3), effect: 9, time: Tick::from_seconds_f64(0.5) },
-            WorkerJob::RotoFreeze { comp, layer: LayerId(3), effect: 9 },
-            WorkerJob::Camera { comp, layer: LayerId(3), effect: 9 },
-            WorkerJob::RotoPropagate { comp, layer: LayerId(3), effect: 9, direction: crate::roto::Direction::Forward },
-            WorkerJob::Track {
-                comp,
-                layer: LayerId(1),
-                tracker: 4,
-                direction: crate::tracking::Direction::Backward,
-                settings: TrackerSettings::default(),
-                points: vec![PointValues {
-                    uid: 5,
-                    spec: effectcraft_track::PointSpec { center: [1.0, 2.0], feature_size: [3.0, 4.0], search_offset: [0.5, 0.0], search_size: [9.0, 9.0] },
-                    attach_offset: [0.25, -1.0],
-                }],
-                times: vec![Tick::ZERO, Tick::from_seconds_f64(0.5)],
-            },
-            WorkerJob::MaskTrack {
-                comp,
-                layer: LayerId(2),
-                mask: 7,
-                direction: crate::tracking::Direction::Forward,
-                path: ShapePath::ellipse([10.0, 20.0], 5.0, 6.0),
-                method: MaskMethod::Perspective,
-                times: vec![Tick::from_seconds_f64(1.0)],
-            },
-            WorkerJob::ContentFill {
-                plan: Box::new(crate::commands::content_fill::FillPlan {
-                    comp,
-                    layer: LayerId(2),
-                    name: "Clip".into(),
-                    width: 4,
-                    height: 3,
-                    times: vec![Tick::ZERO],
-                    method: "object".into(),
-                    lighting: 0.5,
-                    expand: 1,
-                    reference: Some((LayerId(1), Tick::ZERO)),
-                    dir: "/Fill/Clip_Fill_1".into(),
-                }),
-            },
-        ];
-        for job in reqs {
-            let kind = job.kind();
-            let req = WorkerRequest { id: 42, project: s.project.to_json(), files: footage_files(&s.project), job };
-            let t = round(&req);
-            assert!(t.contains("\"kind\":"), "{kind:?}");
-            let back: WorkerRequest = serde_json::from_str(&t).unwrap();
-            assert_eq!(back.job.kind(), kind);
-            assert_eq!(Project::from_json(&back.project).unwrap(), *s.project);
-        }
-        let g = s.active_comp().unwrap().layers[0].props.clone();
-        for r in [
-            WorkerReply::Render { state: JobState { current: Some(3), done: 4, total: 10, items_total: 1, ..Default::default() } },
-            WorkerReply::Item { update: ItemUpdate::Started { id: 3, unix: 1_700_000_000 } },
-            WorkerReply::Item { update: ItemUpdate::Finished { id: 3, status: RenderStatus::Failed("x".into()), seconds: 1.5, output: Some("/a.gif".into()) } },
-            WorkerReply::Progress { done: 1, total: 2 },
-            WorkerReply::WarpPlan {
-                key: [1, u64::MAX],
-                summary: Box::new(effectcraft_effects::warp_stab::PlanSummary {
-                    warps: vec![[[1.0, 0.0, 2.5], [0.0, 1.0, -1.0], [0.0, 0.0, 1.0]]],
-                    auto_scale: 1.08,
-                    crop: Some([1.0, 2.0, 300.0, 200.0]),
-                    valid_fraction: 0.9,
-                }),
-            },
-            WorkerReply::Group { comp, layer: LayerId(1), group: Box::new(g), message: "ok".into() },
-            WorkerReply::Segs { segs: vec![SegData::new(5, &effectcraft_track::roto::FrameSeg::empty(4, 3))] },
-            WorkerReply::Fill {
-                plan: Box::new(crate::commands::content_fill::FillPlan {
-                    comp,
-                    layer: LayerId(2),
-                    name: "Clip".into(),
-                    width: 4,
-                    height: 3,
-                    times: vec![Tick::ZERO],
-                    method: "object".into(),
-                    lighting: 0.5,
-                    expand: 1,
-                    reference: Some((LayerId(1), Tick::ZERO)),
-                    dir: "/Fill/Clip_Fill_1".into(),
-                }),
-                files: vec!["/Fill/Clip_Fill_1/fill_00000.png".into()],
-            },
-            WorkerReply::Failed { error: "boom".into() },
-            WorkerReply::Done,
-        ] {
-            let t = round(&r);
-            assert!(t.starts_with("{\"type\":"), "{t}");
-        }
-    }
-
-    /// An [`Offload`] that runs the job right away in a second session, through JSON (what a
-    /// Web Worker does, minus the threads).
-    struct Inline;
-    impl Offload for Inline {
-        fn start(&self, req: WorkerRequest, inbox: Arc<Inbox>) -> Result<(), String> {
-            let req: WorkerRequest = serde_json::from_str(&serde_json::to_string(&req).unwrap()).unwrap();
-            let mut w = Session { exporter: Some(Arc::new(crate::rq_tests::MockExporter { log: Default::default() })), ..Default::default() };
-            let post: Post = Rc::new(move |r| inbox.push(serde_json::from_str(&serde_json::to_string(&r).unwrap()).unwrap()));
-            run_request(&mut w, req, &post);
-            Ok(())
-        }
-        fn cancel(&self, _: u64) {}
-    }
-
-    #[test]
-    fn render_runs_through_the_offload() {
-        let mut s = Session {
-            exporter: Some(Arc::new(crate::rq_tests::MockExporter { log: Default::default() })),
-            offload: Some(Arc::new(Inline)),
-            ..Default::default()
-        };
-        s.execute("file.openDemoProject", serde_json::json!({})).unwrap();
-        s.execute("renderQueue.add", serde_json::json!({"output": "/x.gif"})).unwrap();
-        let ids = s.start_render(false).unwrap();
-        // (the inline offload has replied already; replies are applied when polled)
-        s.poll_render();
-        assert!(s.render_job.is_none());
-        let it = s.project.render_queue.iter().find(|i| i.id == ids[0]).unwrap();
-        assert_eq!(it.status, RenderStatus::Done, "{:?}", it.status);
-        assert!(it.last_output.as_deref().is_some_and(|o| o.ends_with("x.gif")));
-        // `wait` renders inline.
-        s.execute("renderQueue.add", serde_json::json!({"output": "/y.gif"})).unwrap();
-        s.start_render(true).unwrap();
-        assert!(s.render_job.is_none() || s.render_job.as_ref().unwrap().remote.is_none());
-    }
-
-    /// Runs jobs in a session sharing `footage` (the synthetic clip of the tracking tests).
-    struct InlineWith(Arc<dyn effectcraft_render::FootageSource>);
-    impl Offload for InlineWith {
-        fn start(&self, req: WorkerRequest, inbox: Arc<Inbox>) -> Result<(), String> {
-            let req: WorkerRequest = serde_json::from_str(&serde_json::to_string(&req).unwrap()).unwrap();
-            let mut w = Session { footage: self.0.clone(), ..Default::default() };
-            let post: Post = Rc::new(move |r| inbox.push(serde_json::from_str(&serde_json::to_string(&r).unwrap()).unwrap()));
-            run_request(&mut w, req, &post);
-            Ok(())
-        }
-        fn cancel(&self, _: u64) {}
-    }
-
-    /// Never replies (a job still running); records cancellations.
-    #[derive(Default)]
-    struct Hanging(Mutex<Vec<u64>>);
-    impl Offload for Hanging {
-        fn start(&self, _: WorkerRequest, _: Arc<Inbox>) -> Result<(), String> {
-            Ok(())
-        }
-        fn cancel(&self, id: u64) {
-            self.0.lock().unwrap().push(id);
-        }
-    }
-
-    fn pose(f: u32) -> ([f64; 2], f64, f64) {
-        ([150.0 + 2.0 * f as f64, 110.0 + 1.0 * f as f64], 0.0, 1.0)
-    }
-
-    #[test]
-    fn track_analysis_runs_through_the_offload_as_one_undo_step() {
-        let (mut s, clip, _) = crate::tests_track::setup(crate::tests_track::patch_frames(pose));
-        s.offload = Some(Arc::new(InlineWith(s.footage.clone())));
-        s.execute("track.motion", serde_json::json!({})).unwrap();
-        s.execute("track.setPoint", serde_json::json!({"point": 1, "center": pose(0).0, "featureSize": [36, 36], "searchSize": [80, 80]})).unwrap();
-        let undo = s.history.undo.len();
-        s.execute("track.analyze", serde_json::json!({"direction": "forward"})).unwrap();
-        assert!(s.is_tracking() && s.track_job.is_none(), "offloaded, not on a thread");
-        assert!(s.track_progress().is_some());
-        assert!(s.poll_offload());
-        assert!(!s.is_tracking() && s.offloaded.is_empty());
-        let l = s.active_comp().unwrap().layer(clip).unwrap();
-        let tp = l.trackers().next().unwrap().0.track_points().next().unwrap().clone();
-        let fc = tp.get("featureCenter").unwrap();
-        assert_eq!(fc.keys.len(), 25);
-        let v = fc.value_at(crate::tests_track::frame_time(12)).as_vec2();
-        assert!((v[0] - pose(12).0[0]).abs() < 0.3 && (v[1] - pose(12).0[1]).abs() < 0.3, "{v:?}");
-        assert_eq!(s.history.undo.len(), undo + 1);
-        assert_eq!(s.history.undo.last().unwrap().0, "Analyze Track");
-        assert!(s.events.iter().any(|e| matches!(e, Event::Toast { message, error: false } if message.starts_with("Tracked"))));
-        assert!(s.undo());
-        let l = s.active_comp().unwrap().layer(clip).unwrap();
-        assert!(l.trackers().next().unwrap().0.track_points().next().unwrap().get("featureCenter").unwrap().keys.is_empty());
-        // `wait` runs inline.
-        s.redo();
-        s.execute("track.analyze", serde_json::json!({"direction": "forward", "wait": true})).ok();
-        assert!(s.offloaded.is_empty());
-    }
-
-    #[test]
-    fn cancelling_offloaded_jobs() {
-        let (mut s, _, _) = crate::tests_track::setup(crate::tests_track::patch_frames(pose));
-        let off = Arc::new(Hanging::default());
-        s.offload = Some(off.clone());
-        s.exporter = Some(Arc::new(crate::rq_tests::MockExporter { log: Default::default() }));
-        // Analysis: stopping drops the job, nothing is written.
-        s.execute("track.motion", serde_json::json!({})).unwrap();
-        let rev = s.revision;
-        s.execute("track.analyze", serde_json::json!({})).unwrap();
-        assert!(s.is_tracking());
-        assert!(s.execute("track.analyze", serde_json::json!({})).is_err(), "one at a time");
-        assert!(s.stop_track());
-        s.poll_offload();
-        assert!(!s.is_tracking());
-        assert_eq!(off.0.lock().unwrap().len(), 1);
-        assert!(s.events.iter().any(|e| matches!(e, Event::Toast { message, .. } if message.contains("stopped"))));
-        assert!(s.revision > rev);
-        // Render: the queued items become User Stopped.
-        s.execute("renderQueue.add", serde_json::json!({"output": "/a.gif"})).unwrap();
-        let ids = s.start_render(false).unwrap();
-        assert!(s.is_rendering());
-        assert!(s.stop_render());
-        s.poll_render();
-        assert!(!s.is_rendering());
-        assert_eq!(off.0.lock().unwrap().len(), 2);
-        let it = s.project.render_queue.iter().find(|i| i.id == ids[0]).unwrap();
-        assert_eq!(it.status, RenderStatus::UserStopped);
-    }
-
-    #[test]
-    fn progress_hook_is_scoped() {
-        report(1, 2); // no hook: nothing happens
-        let seen = Rc::new(RefCell::new(vec![]));
-        let s2 = seen.clone();
-        effectcraft_render::passes::block_on(with_hook(Box::new(move |d, t| s2.borrow_mut().push((d, t))), async {
-            report(1, 3);
-            report(2, 3);
-        }));
-        report(3, 3);
-        assert_eq!(*seen.borrow(), vec![(1, 3), (2, 3)]);
-    }
-}
+mod tests;
diff --git a/crates/engine/src/background/offload/tests.rs b/crates/engine/src/background/offload/tests.rs
new file mode 100644
index 000000000..c08623189
--- /dev/null
+++ b/crates/engine/src/background/offload/tests.rs
@@ -0,0 +1,309 @@
+use super::*;
+
+fn round<T: Serialize + for<'de> Deserialize<'de>>(v: &T) -> String {
+    let a = serde_json::to_string(v).unwrap();
+    let back: T = serde_json::from_str(&a).unwrap();
+    let b = serde_json::to_string(&back).unwrap();
+    assert_eq!(a, b);
+    a
+}
+
+/// A group with properties `a` (uid 2) and `b` (uid 3) and a sub-group (uid 4) holding `c`
+/// (uid 5).
+fn group() -> PropGroup {
+    use effectcraft_keyframe::Value as KV;
+    use effectcraft_project::{Node, Property};
+    let mut sub = PropGroup::new(4, "sub", "Sub");
+    sub.children.push(Node::Prop(Property::new(5, "c", "C", KV::Scalar(0.0))));
+    let mut g = PropGroup::new(1, "fx", "Effect");
+    g.children.push(Node::Prop(Property::new(2, "a", "A", KV::Scalar(0.0))));
+    g.children.push(Node::Prop(Property::new(3, "b", "B", KV::Scalar(0.0))));
+    g.children.push(Node::Group(sub));
+    g
+}
+
+fn set(g: &mut PropGroup, uid: Uid, v: f64) {
+    g.find_mut(uid).unwrap().value = effectcraft_keyframe::Value::Scalar(v);
+}
+
+fn get(g: &PropGroup, uid: Uid) -> f64 {
+    match g.find(uid).unwrap().value {
+        effectcraft_keyframe::Value::Scalar(v) => v,
+        ref v => panic!("{v:?}"),
+    }
+}
+
+#[test]
+fn analysis_results_merge_with_edits_made_meanwhile() {
+    use effectcraft_project::Node;
+    let base = group();
+    // The user changes `a` and switches the effect off; the analysis writes `b` and `c`.
+    let mut live = base.clone();
+    set(&mut live, 2, 1.0);
+    live.enabled = false;
+    let mut result = base.clone();
+    set(&mut result, 3, 2.0);
+    set(&mut result, 5, 3.0);
+    let m = merge_group(&base, &live, &result).unwrap();
+    assert_eq!((get(&m, 2), get(&m, 3), get(&m, 5), m.enabled), (1.0, 2.0, 3.0, false));
+    // Unchanged on either side: the other side wins whole.
+    assert_eq!(merge_group(&base, &base, &result).unwrap(), result);
+    assert_eq!(merge_group(&base, &live, &base).unwrap(), live);
+    // Both changed `b`, differently: a conflict (nothing is applied). The same way: fine.
+    let mut both = live.clone();
+    set(&mut both, 3, 9.0);
+    assert!(merge_group(&base, &both, &result).is_none());
+    set(&mut both, 3, 2.0);
+    assert_eq!(get(&merge_group(&base, &both, &result).unwrap(), 3), 2.0);
+    // The analysis adds a child (a result group) while the user edits `a`: both kept.
+    let mut added = result.clone();
+    added.children.push(Node::Group(PropGroup::new(6, "out", "Output")));
+    let m = merge_group(&base, &live, &added).unwrap();
+    assert!(m.find_group(6).is_some() && get(&m, 2) == 1.0);
+    // The analysis drops the sub-group the user didn't touch: dropped.
+    let mut dropped = result.clone();
+    dropped.children.retain(|n| !matches!(n, Node::Group(g) if g.uid == 4));
+    let m = merge_group(&base, &live, &dropped).unwrap();
+    assert!(m.find_group(4).is_none() && get(&m, 2) == 1.0);
+    // …but if the user changed something in it, that's a conflict.
+    let mut touched = live.clone();
+    set(&mut touched, 5, 7.0);
+    assert!(merge_group(&base, &touched, &dropped).is_none());
+}
+
+#[test]
+fn protocol_round_trips() {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", serde_json::json!({})).unwrap();
+    let comp = s.active_comp_id().unwrap();
+    s.execute("renderQueue.add", serde_json::json!({})).unwrap();
+    let item = s.project.render_queue[0].clone();
+    let reqs = [
+        WorkerJob::Render { items: vec![vec![(item.clone(), "/out.gif".into())]] },
+        WorkerJob::Warp { comp, layer: LayerId(3), effect: 9 },
+        WorkerJob::WarpPlan { comp, layer: LayerId(3), effect: 9, time: Tick::from_seconds_f64(0.5) },
+        WorkerJob::RotoFreeze { comp, layer: LayerId(3), effect: 9 },
+        WorkerJob::Camera { comp, layer: LayerId(3), effect: 9 },
+        WorkerJob::RotoPropagate { comp, layer: LayerId(3), effect: 9, direction: crate::roto::Direction::Forward },
+        WorkerJob::Track {
+            comp,
+            layer: LayerId(1),
+            tracker: 4,
+            direction: crate::tracking::Direction::Backward,
+            settings: TrackerSettings::default(),
+            points: vec![PointValues {
+                uid: 5,
+                spec: effectcraft_track::PointSpec { center: [1.0, 2.0], feature_size: [3.0, 4.0], search_offset: [0.5, 0.0], search_size: [9.0, 9.0] },
+                attach_offset: [0.25, -1.0],
+            }],
+            times: vec![Tick::ZERO, Tick::from_seconds_f64(0.5)],
+        },
+        WorkerJob::MaskTrack {
+            comp,
+            layer: LayerId(2),
+            mask: 7,
+            direction: crate::tracking::Direction::Forward,
+            path: ShapePath::ellipse([10.0, 20.0], 5.0, 6.0),
+            method: MaskMethod::Perspective,
+            times: vec![Tick::from_seconds_f64(1.0)],
+        },
+        WorkerJob::ContentFill {
+            plan: Box::new(crate::commands::content_fill::FillPlan {
+                comp,
+                layer: LayerId(2),
+                name: "Clip".into(),
+                width: 4,
+                height: 3,
+                times: vec![Tick::ZERO],
+                method: "object".into(),
+                lighting: 0.5,
+                expand: 1,
+                reference: Some((LayerId(1), Tick::ZERO)),
+                dir: "/Fill/Clip_Fill_1".into(),
+            }),
+        },
+    ];
+    for job in reqs {
+        let kind = job.kind();
+        let req = WorkerRequest { id: 42, project: s.project.to_json(), files: footage_files(&s.project), job };
+        let t = round(&req);
+        assert!(t.contains("\"kind\":"), "{kind:?}");
+        let back: WorkerRequest = serde_json::from_str(&t).unwrap();
+        assert_eq!(back.job.kind(), kind);
+        assert_eq!(Project::from_json(&back.project).unwrap(), *s.project);
+    }
+    let g = s.active_comp().unwrap().layers[0].props.clone();
+    for r in [
+        WorkerReply::Render { state: JobState { current: Some(3), done: 4, total: 10, items_total: 1, ..Default::default() } },
+        WorkerReply::Item { update: ItemUpdate::Started { id: 3, unix: 1_700_000_000 } },
+        WorkerReply::Item { update: ItemUpdate::Finished { id: 3, status: RenderStatus::Failed("x".into()), seconds: 1.5, output: Some("/a.gif".into()) } },
+        WorkerReply::Progress { done: 1, total: 2 },
+        WorkerReply::WarpPlan {
+            key: [1, u64::MAX],
+            summary: Box::new(effectcraft_effects::warp_stab::PlanSummary {
+                warps: vec![[[1.0, 0.0, 2.5], [0.0, 1.0, -1.0], [0.0, 0.0, 1.0]]],
+                auto_scale: 1.08,
+                crop: Some([1.0, 2.0, 300.0, 200.0]),
+                valid_fraction: 0.9,
+            }),
+        },
+        WorkerReply::Group { comp, layer: LayerId(1), group: Box::new(g), message: "ok".into() },
+        WorkerReply::Segs { segs: vec![SegData::new(5, &effectcraft_track::roto::FrameSeg::empty(4, 3))] },
+        WorkerReply::Fill {
+            plan: Box::new(crate::commands::content_fill::FillPlan {
+                comp,
+                layer: LayerId(2),
+                name: "Clip".into(),
+                width: 4,
+                height: 3,
+                times: vec![Tick::ZERO],
+                method: "object".into(),
+                lighting: 0.5,
+                expand: 1,
+                reference: Some((LayerId(1), Tick::ZERO)),
+                dir: "/Fill/Clip_Fill_1".into(),
+            }),
+            files: vec!["/Fill/Clip_Fill_1/fill_00000.png".into()],
+        },
+        WorkerReply::Failed { error: "boom".into() },
+        WorkerReply::Done,
+    ] {
+        let t = round(&r);
+        assert!(t.starts_with("{\"type\":"), "{t}");
+    }
+}
+
+/// An [`Offload`] that runs the job right away in a second session, through JSON (what a
+/// Web Worker does, minus the threads).
+struct Inline;
+impl Offload for Inline {
+    fn start(&self, req: WorkerRequest, inbox: Arc<Inbox>) -> Result<(), String> {
+        let req: WorkerRequest = serde_json::from_str(&serde_json::to_string(&req).unwrap()).unwrap();
+        let mut w = Session { exporter: Some(Arc::new(crate::rq_tests::MockExporter { log: Default::default() })), ..Default::default() };
+        let post: Post = Rc::new(move |r| inbox.push(serde_json::from_str(&serde_json::to_string(&r).unwrap()).unwrap()));
+        run_request(&mut w, req, &post);
+        Ok(())
+    }
+    fn cancel(&self, _: u64) {}
+}
+
+#[test]
+fn render_runs_through_the_offload() {
+    let mut s =
+        Session { exporter: Some(Arc::new(crate::rq_tests::MockExporter { log: Default::default() })), offload: Some(Arc::new(Inline)), ..Default::default() };
+    s.execute("file.openDemoProject", serde_json::json!({})).unwrap();
+    s.execute("renderQueue.add", serde_json::json!({"output": "/x.gif"})).unwrap();
+    let ids = s.start_render(false).unwrap();
+    // (the inline offload has replied already; replies are applied when polled)
+    s.poll_render();
+    assert!(s.render_job.is_none());
+    let it = s.project.render_queue.iter().find(|i| i.id == ids[0]).unwrap();
+    assert_eq!(it.status, RenderStatus::Done, "{:?}", it.status);
+    assert!(it.last_output.as_deref().is_some_and(|o| o.ends_with("x.gif")));
+    // `wait` renders inline.
+    s.execute("renderQueue.add", serde_json::json!({"output": "/y.gif"})).unwrap();
+    s.start_render(true).unwrap();
+    assert!(s.render_job.is_none() || s.render_job.as_ref().unwrap().remote.is_none());
+}
+
+/// Runs jobs in a session sharing `footage` (the synthetic clip of the tracking tests).
+struct InlineWith(Arc<dyn effectcraft_render::FootageSource>);
+impl Offload for InlineWith {
+    fn start(&self, req: WorkerRequest, inbox: Arc<Inbox>) -> Result<(), String> {
+        let req: WorkerRequest = serde_json::from_str(&serde_json::to_string(&req).unwrap()).unwrap();
+        let mut w = Session { footage: self.0.clone(), ..Default::default() };
+        let post: Post = Rc::new(move |r| inbox.push(serde_json::from_str(&serde_json::to_string(&r).unwrap()).unwrap()));
+        run_request(&mut w, req, &post);
+        Ok(())
+    }
+    fn cancel(&self, _: u64) {}
+}
+
+/// Never replies (a job still running); records cancellations.
+#[derive(Default)]
+struct Hanging(Mutex<Vec<u64>>);
+impl Offload for Hanging {
+    fn start(&self, _: WorkerRequest, _: Arc<Inbox>) -> Result<(), String> {
+        Ok(())
+    }
+    fn cancel(&self, id: u64) {
+        self.0.lock().unwrap().push(id);
+    }
+}
+
+fn pose(f: u32) -> ([f64; 2], f64, f64) {
+    ([150.0 + 2.0 * f as f64, 110.0 + 1.0 * f as f64], 0.0, 1.0)
+}
+
+#[test]
+fn track_analysis_runs_through_the_offload_as_one_undo_step() {
+    let (mut s, clip, _) = crate::tests::track::setup(crate::tests::track::patch_frames(pose));
+    s.offload = Some(Arc::new(InlineWith(s.footage.clone())));
+    s.execute("track.motion", serde_json::json!({})).unwrap();
+    s.execute("track.setPoint", serde_json::json!({"point": 1, "center": pose(0).0, "featureSize": [36, 36], "searchSize": [80, 80]})).unwrap();
+    let undo = s.history.undo.len();
+    s.execute("track.analyze", serde_json::json!({"direction": "forward"})).unwrap();
+    assert!(s.is_tracking() && s.track_job.is_none(), "offloaded, not on a thread");
+    assert!(s.track_progress().is_some());
+    assert!(s.poll_offload());
+    assert!(!s.is_tracking() && s.offloaded.is_empty());
+    let l = s.active_comp().unwrap().layer(clip).unwrap();
+    let tp = l.trackers().next().unwrap().0.track_points().next().unwrap().clone();
+    let fc = tp.get("featureCenter").unwrap();
+    assert_eq!(fc.keys.len(), 25);
+    let v = fc.value_at(crate::tests::track::frame_time(12)).as_vec2();
+    assert!((v[0] - pose(12).0[0]).abs() < 0.3 && (v[1] - pose(12).0[1]).abs() < 0.3, "{v:?}");
+    assert_eq!(s.history.undo.len(), undo + 1);
+    assert_eq!(s.history.undo.last().unwrap().0, "Analyze Track");
+    assert!(s.events.iter().any(|e| matches!(e, Event::Toast { message, error: false } if message.starts_with("Tracked"))));
+    assert!(s.undo());
+    let l = s.active_comp().unwrap().layer(clip).unwrap();
+    assert!(l.trackers().next().unwrap().0.track_points().next().unwrap().get("featureCenter").unwrap().keys.is_empty());
+    // `wait` runs inline.
+    s.redo();
+    s.execute("track.analyze", serde_json::json!({"direction": "forward", "wait": true})).ok();
+    assert!(s.offloaded.is_empty());
+}
+
+#[test]
+fn cancelling_offloaded_jobs() {
+    let (mut s, _, _) = crate::tests::track::setup(crate::tests::track::patch_frames(pose));
+    let off = Arc::new(Hanging::default());
+    s.offload = Some(off.clone());
+    s.exporter = Some(Arc::new(crate::rq_tests::MockExporter { log: Default::default() }));
+    // Analysis: stopping drops the job, nothing is written.
+    s.execute("track.motion", serde_json::json!({})).unwrap();
+    let rev = s.revision;
+    s.execute("track.analyze", serde_json::json!({})).unwrap();
+    assert!(s.is_tracking());
+    assert!(s.execute("track.analyze", serde_json::json!({})).is_err(), "one at a time");
+    assert!(s.stop_track());
+    s.poll_offload();
+    assert!(!s.is_tracking());
+    assert_eq!(off.0.lock().unwrap().len(), 1);
+    assert!(s.events.iter().any(|e| matches!(e, Event::Toast { message, .. } if message.contains("stopped"))));
+    assert!(s.revision > rev);
+    // Render: the queued items become User Stopped.
+    s.execute("renderQueue.add", serde_json::json!({"output": "/a.gif"})).unwrap();
+    let ids = s.start_render(false).unwrap();
+    assert!(s.is_rendering());
+    assert!(s.stop_render());
+    s.poll_render();
+    assert!(!s.is_rendering());
+    assert_eq!(off.0.lock().unwrap().len(), 2);
+    let it = s.project.render_queue.iter().find(|i| i.id == ids[0]).unwrap();
+    assert_eq!(it.status, RenderStatus::UserStopped);
+}
+
+#[test]
+fn progress_hook_is_scoped() {
+    report(1, 2); // no hook: nothing happens
+    let seen = Rc::new(RefCell::new(vec![]));
+    let s2 = seen.clone();
+    effectcraft_render::passes::block_on(with_hook(Box::new(move |d, t| s2.borrow_mut().push((d, t))), async {
+        report(1, 3);
+        report(2, 3);
+    }));
+    report(3, 3);
+    assert_eq!(*seen.borrow(), vec![(1, 3), (2, 3)]);
+}
diff --git a/crates/engine/src/remote.rs b/crates/engine/src/background/remote.rs
similarity index 52%
rename from crates/engine/src/remote.rs
rename to crates/engine/src/background/remote.rs
index 207367b07..aea210ec5 100644
--- a/crates/engine/src/remote.rs
+++ b/crates/engine/src/background/remote.rs
@@ -9,7 +9,7 @@
 //!   added, changed or removed; arrays element-wise when their length is unchanged, else
 //!   replaced). Lossless (unlike JSON Merge Patch, `null` values survive).
 //! - [`Mirror`] (page side): what the worker holds; turns the next project revision into a
-//!   [`FrameMsg::Sync`] (a full project the first time, a diff afterwards).
+//!   [`FrameMsg::Project`] the first time and [`FrameMsg::Patch`] for subsequent diffs.
 //! - [`FrameServer`] (worker side): applies syncs, relayed Roto Brush segmentations and render
 //!   requests, and renders frames as premultiplied RGBA8 ([`rgba8_premultiplied`]).
 //!
@@ -20,13 +20,16 @@
 //!   calls [`FrameServer::resume`] for the next. Backend Auto picks CPU or GPU per comp from
 //!   the frames' total times ([`effectcraft_render::AutoPick`]).
 //! - Disk cache: a render request may carry the frame's disk-cache key ([`FrameMsg::Render`]
-//!   `disk`); the transport stores the finished frame under it (the browser: in the Origin
-//!   Private File System) and reports [`FrameReply::Stored`].
+//!   `disk`); the transport stores the finished frame under it with the source files it read
+//!   ([`FrameServer::take_files`], `disk_cache::frame_entry`; the browser: in the Origin Private
+//!   File System) and reports [`FrameReply::Stored`]. A frame whose files can't all be named is
+//!   not stored. The page checks an entry's files before it uses it (#3184).
 //! - Layer buffers on disk: with `layers`, the server's layer cache is backed by a
 //!   [`PrefetchStore`] ([`FrameServer::set_layer_store`]): before the request the transport
 //!   fetches the entries named in `prefetch` (recent misses that are on disk, chosen by the
-//!   page, `disk_cache::LayerPrefetch`), so the lookups in the middle of the render find them;
-//!   the reply lists the layer keys that missed and those served from the store
+//!   page, `disk_cache::LayerPrefetch`), so the lookups in the middle of the render find them
+//!   (each entry keeps the source files its buffer was made of and is used only while they are
+//!   unchanged, #3184); the reply lists the layer keys that missed and those served from the store
 //!   ([`FrameReply::Frame`] `layer_misses` / `layer_hits`), and slow buffers queue up for the
 //!   transport to write after the frame ([`PrefetchStore::take_writes`], reported as
 //!   [`FrameReply::Stored`] with `layer`).
@@ -37,6 +40,7 @@
 use std::sync::Arc;
 
 use effectcraft_project::{ItemId, Project};
+use effectcraft_render::reads::{ReadFiles, ReadLog};
 use effectcraft_render::{Accelerator, AutoKey, Backend, ExprHost, FootageSource, Image, LayerCache, LayerStore, PrefetchStore, RenderOpts, Renderer};
 use effectcraft_time::Tick;
 use serde::{Deserialize, Serialize};
@@ -177,7 +181,7 @@ pub enum FrameReply {
         passes: u32,
         #[serde(default)]
         gpu: bool,
-        /// Layer-cache lookups that missed the store (salted keys, 32 hex digits).
+        /// Layer-cache lookups that missed the store (disk keys, 32 hex digits).
         #[serde(default, rename = "layerMisses", skip_serializing_if = "Vec::is_empty")]
         layer_misses: Vec<String>,
         /// Layer buffers served from the store (fetched from disk).
@@ -260,9 +264,12 @@ pub struct FrameServer {
     revision: Option<u64>,
     /// The frame being rendered in passes.
     pending: Option<Pending>,
-    /// The disk cache's layer buffers (see the module docs) and the project's salt.
+    /// The disk cache's layer buffers (see the module docs).
     layer_store: Option<Arc<PrefetchStore>>,
-    salt: u64,
+    /// Size and content hash for footage paths with no native metadata (the browser file table).
+    virtual_id: Option<Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>>,
+    /// The source files the last finished frame read ([`FrameServer::take_files`]).
+    files: Option<ReadFiles>,
 }
 
 /// A frame whose readbacks are in flight.
@@ -282,6 +289,7 @@ struct Pending {
 pub const MAX_PASSES: u32 = 24;
 
 impl FrameServer {
+    /// A frame server over `footage` and the optional expression host, with an empty layer cache.
     pub fn new(footage: Arc<dyn FootageSource>, expr: Option<Arc<dyn ExprHost>>) -> FrameServer {
         FrameServer {
             footage,
@@ -293,10 +301,30 @@ impl FrameServer {
             revision: None,
             pending: None,
             layer_store: None,
-            salt: 0,
+            virtual_id: None,
+            files: None,
         }
     }
 
+    /// Identity of virtual footage files, used when native metadata cannot describe the path:
+    /// what the disk entries of frames and layer buffers keep for them and are checked against.
+    pub fn set_virtual_id(&mut self, id: Option<Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>>) {
+        self.cache.set_virtual_id(id.clone());
+        self.virtual_id = id;
+    }
+
+    /// The source files the frame of the last [`FrameReply::Frame`] read, with their identities
+    /// as read: what its disk entry keeps (`disk_cache::frame_entry`). Taken once.
+    pub fn take_files(&mut self) -> Option<ReadFiles> {
+        self.files.take()
+    }
+
+    /// The identity of footage paths with no native metadata (the browser file table), to store
+    /// with a frame's disk entry.
+    pub fn virtual_id(&self) -> Option<&Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>> {
+        self.virtual_id.as_ref()
+    }
+
     /// The store behind the layer cache when a request asks for `layers` (the browser: the
     /// disk cache's layer buffers, fetched before the request).
     pub fn set_layer_store(&mut self, store: Option<Arc<PrefetchStore>>) {
@@ -307,11 +335,6 @@ impl FrameServer {
         self.layer_store.as_ref()
     }
 
-    /// The salt of the replica's layer keys on disk (keys are `(salt, key)`).
-    pub fn salt(&self) -> u64 {
-        self.salt
-    }
-
     /// Render with `accel` when the request's backend asks for it (the worker's GPU). Its miss
     /// gate keeps placeholder buffers of unfinished passes out of the layer cache.
     pub fn set_accel(&mut self, accel: Option<Arc<dyn Accelerator>>) {
@@ -338,8 +361,6 @@ impl FrameServer {
 
     fn load(&mut self, revision: u64) -> Result<(), String> {
         let p = Project::from_json(&self.doc.to_string()).map_err(|e| e.to_string())?;
-        self.salt = effectcraft_render::disk_cache::footage_salt(&p);
-        self.cache.set_store_salt(self.salt);
         self.project = Some(Arc::new(p));
         self.revision = Some(revision);
         Ok(())
@@ -383,7 +404,7 @@ impl FrameServer {
             }
             FrameMsg::Render { id, revision, comp, time, opts, layers, .. } => {
                 let store = self.layer_store.clone().filter(|_| layers);
-                self.cache.set_store(store.map(|s| (s as Arc<dyn LayerStore>, self.salt)));
+                self.cache.set_store(store.map(|s| s as Arc<dyn LayerStore>));
                 let fail = |error: String, stale: bool| vec![(FrameReply::Failed { id, error, stale }, None)];
                 if self.revision != Some(revision) {
                     return fail(format!("the replica is at {:?}, not {revision}", self.revision), true);
@@ -408,6 +429,10 @@ impl FrameServer {
                             auto = Some((key, gpu));
                         }
                     }
+                    // A frame still waiting for readbacks is replaced: end it, so every `frame_begin` has its `frame_end`.
+                    if self.pending.take().is_some() {
+                        a.frame_end();
+                    }
                     a.frame_begin();
                 }
                 self.pending = Some(Pending { id, project: p, comp, time, opts, t0: web_time::Instant::now(), passes: 0, auto });
@@ -419,12 +444,16 @@ impl FrameServer {
     /// Run the next pass of the frame in progress; its reply once it is done.
     pub fn resume(&mut self) -> Vec<(FrameReply, Option<Vec<u8>>)> {
         let Some(mut pr) = self.pending.take() else { return vec![] };
+        self.files = None;
         pr.passes += 1;
         let accel = self.accel.clone().filter(|_| pr.opts.backend != Backend::Cpu);
         let give_up = pr.passes > MAX_PASSES;
+        // (each pass renders the whole frame: the last one's files are the frame's)
+        let reads = ReadLog::new();
         let mut r = Renderer::new(&pr.project, self.footage.as_ref(), pr.opts);
         r.expr = self.expr.as_deref();
         r.cache = Some(&self.cache);
+        r.reads = Some(&reads);
         if !give_up {
             r.accel = accel.as_deref();
         }
@@ -438,6 +467,7 @@ impl FrameServer {
         }
         let ms = pr.t0.elapsed().as_secs_f64() * 1000.0;
         let gpu = r.accel.is_some() && r.active_accel().is_some();
+        self.files = Some(reads.files());
         let hex = |v: Vec<u128>| v.into_iter().map(|k| format!("{k:032x}")).collect::<Vec<_>>();
         let (layer_misses, layer_hits) = match &self.layer_store {
             Some(st) => (hex(st.take_misses()), hex(st.take_hits())),
@@ -448,6 +478,10 @@ impl FrameServer {
         {
             pick.record(key, chose, ms);
         }
+        // The frame is done (its `frame_begin` ran in `handle`): the GPU pool ages its sizes.
+        if let Some(a) = &self.accel {
+            a.frame_end();
+        }
         vec![(
             FrameReply::Frame { id: pr.id, width: img.width, height: img.height, ms, passes: pr.passes, gpu, layer_misses, layer_hits },
             Some(rgba8_premultiplied(&img)),
@@ -463,331 +497,4 @@ impl FrameServer {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::Session;
-    use serde_json::json;
-
-    fn round<T: Serialize + for<'de> Deserialize<'de>>(v: &T) -> T {
-        serde_json::from_str(&serde_json::to_string(v).unwrap()).unwrap()
-    }
-
-    #[test]
-    fn diff_and_patch_round_trip() {
-        let a = json!({"a": 1, "b": [1, 2, {"c": null}], "d": {"e": "x", "f": [1]}, "g": null});
-        let b = json!({"a": 2, "b": [1, 3, {"c": 4}], "d": {"f": [1, 2]}, "g": null, "h": {"i": null}});
-        let ops = diff(&a, &b);
-        assert!(!ops.is_empty());
-        let mut x = a.clone();
-        patch(&mut x, &round(&ops)).unwrap();
-        assert_eq!(x, b);
-        // Removal and the reverse direction.
-        let mut y = b.clone();
-        patch(&mut y, &diff(&b, &a)).unwrap();
-        assert_eq!(y, a);
-        assert!(diff(&a, &a).is_empty());
-        // A whole-document change.
-        let mut z = json!(1);
-        patch(&mut z, &diff(&json!(1), &json!([1]))).unwrap();
-        assert_eq!(z, json!([1]));
-        // A patch for another document fails cleanly.
-        assert!(patch(&mut json!(3), &diff(&a, &b)).is_err());
-    }
-
-    fn server(s: &Session) -> FrameServer {
-        FrameServer::new(s.footage.clone(), s.expr.clone())
-    }
-
-    /// Pixels the page itself would render.
-    fn local(s: &Session, comp: ItemId, t: Tick, opts: RenderOpts) -> Vec<u8> {
-        let mut r = Renderer::new(&s.project, s.footage.as_ref(), opts);
-        r.expr = s.expr.as_deref();
-        rgba8_premultiplied(&r.comp_frame(comp, t))
-    }
-
-    /// Layer buffers through the disk store: a worker's slow buffers queue up as entries; the
-    /// page plans what another worker fetches before its frame (recent misses on disk); that
-    /// worker's mid-render lookups find them and the pixels match.
-    #[test]
-    fn layer_buffers_go_through_the_disk_store() {
-        use effectcraft_render::disk_cache::{DiskIndex, Kind, LayerPrefetch};
-        let mut s = Session::default();
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        let comp = s.active_comp_id().unwrap();
-        let opts = RenderOpts { scale: 0.25, ..Default::default() };
-        let t = Tick::from_seconds_f64(1.0);
-        let req = |id: u64, layers: bool, prefetch: Vec<String>| {
-            round(&FrameMsg::Render { id, revision: s.revision, comp, time: t, opts: Box::new(opts), disk: None, layers, prefetch })
-        };
-        let worker = || {
-            let mut w = server(&s);
-            let store = Arc::new(PrefetchStore::new(64 << 20).with_min_ms(0));
-            w.set_layer_store(Some(store.clone()));
-            let mut m = Mirror::default();
-            assert!(w.handle(round(&m.sync(s.revision, &s.project).unwrap())).is_empty());
-            (w, store)
-        };
-        let unhex = |v: &[String]| v.iter().map(|k| u128::from_str_radix(k, 16).unwrap()).collect::<Vec<u128>>();
-        // Worker A: everything misses; its buffers queue up for the disk.
-        let (mut a, store_a) = worker();
-        let out = a.handle(req(1, true, vec![]));
-        let (FrameReply::Frame { layer_misses, layer_hits, .. }, Some(px_a)) = &out[0] else { panic!("{:?}", out[0].0) };
-        assert!(!layer_misses.is_empty() && layer_hits.is_empty());
-        let writes = store_a.take_writes();
-        assert!(!writes.is_empty());
-        assert!(writes.iter().all(|(k, _)| (*k >> 64) as u64 == a.salt()), "keys are salted per project");
-        let mut index = DiskIndex::default();
-        let mut disk = std::collections::HashMap::new();
-        for (k, e) in writes {
-            index.insert(Kind::Layer, k, e.len() as u64);
-            disk.insert(k, e);
-        }
-        index.insert(Kind::Frame, 1, 10);
-        // The page: recent misses that are on disk, most recent first.
-        let mut plan = LayerPrefetch::default();
-        plan.note_misses(unhex(layer_misses));
-        let keys = plan.plan(&index, 64);
-        assert!(!keys.is_empty() && keys.len() <= index.len());
-        // Worker B fetches them before its first frame: its lookups hit.
-        let (mut b, store_b) = worker();
-        for k in &keys {
-            assert!(store_b.provide(*k, &disk[k]));
-        }
-        assert!(!store_b.provide(1, b"damaged"));
-        let out = b.handle(req(1, true, keys.iter().map(|k| format!("{k:032x}")).collect()));
-        let (FrameReply::Frame { layer_misses: mb, layer_hits: hb, .. }, Some(px_b)) = &out[0] else { panic!("{:?}", out[0].0) };
-        assert_eq!(unhex(hb).len(), keys.len(), "every fetched buffer was used");
-        assert!(mb.len() < layer_misses.len());
-        assert_eq!(px_a, px_b);
-        assert_eq!(*px_b, local(&s, comp, t, opts));
-        // Nothing new to write: what B rendered itself was rendered by A too.
-        assert!(store_b.take_writes().iter().all(|(k, _)| disk.contains_key(k)));
-        // Without `layers` the store is not consulted.
-        let (mut c, store_c) = worker();
-        c.handle(req(1, false, vec![]));
-        assert!(store_c.take_misses().is_empty() && store_c.take_writes().is_empty());
-        // Purge empties the store.
-        b.handle(round(&FrameMsg::Purge));
-        assert!(!store_b.has(keys[0]));
-        // LRU across frames and layers in the shared index: a touched layer outlives the frame.
-        index.touch(Kind::Layer, keys[0]);
-        let order = index.lru_order();
-        assert_eq!(order.last(), Some(&(Kind::Layer, keys[0])));
-        assert!(order.iter().position(|e| *e == (Kind::Frame, 1)).unwrap() < order.len() - 1);
-    }
-
-    #[test]
-    fn replica_follows_edits_through_diffs_and_renders_the_same_frames() {
-        let mut s = Session::default();
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        let comp = s.active_comp_id().unwrap();
-        let opts = RenderOpts { scale: 0.25, guides: true, ..Default::default() };
-        let mut m = Mirror::default();
-        let mut w = server(&s);
-        let send = |m: FrameMsg, w: &mut FrameServer| w.handle(round(&m));
-        // First sync: the whole project.
-        let first = m.sync(s.revision, &s.project).unwrap();
-        assert!(matches!(first, FrameMsg::Project { .. }));
-        assert!(send(first, &mut w).is_empty());
-        assert!(m.sync(s.revision, &s.project).is_none(), "nothing new");
-        let t = Tick::from_seconds_f64(1.0);
-        let render = |w: &mut FrameServer, rev: u64, id: u64| {
-            w.handle(round(&FrameMsg::Render { id, revision: rev, comp, time: t, opts: Box::new(opts), disk: None, layers: false, prefetch: vec![] }))
-        };
-        let out = render(&mut w, s.revision, 1);
-        let (FrameReply::Frame { id, width, height, .. }, Some(px)) = &out[0] else { panic!("{:?}", out[0].0) };
-        assert_eq!((*id, *width as usize * *height as usize * 4), (1, px.len()));
-        assert_eq!(*px, local(&s, comp, t, opts));
-        // An edit travels as a small diff; the replica renders the edited frame.
-        s.execute("layer.newSolid", json!({"color": "#ff8800", "name": "Orange"})).unwrap();
-        let msg = m.sync(s.revision, &s.project).unwrap();
-        let FrameMsg::Patch { ops, .. } = &msg else { panic!("expected a patch") };
-        assert!(!ops.is_empty() && serde_json::to_string(ops).unwrap().len() < s.project.to_json().len() / 2);
-        assert!(send(msg, &mut w).is_empty());
-        assert_eq!(**w.project().unwrap(), *s.project);
-        let out = render(&mut w, s.revision, 2);
-        assert_eq!(out[0].1.as_deref(), Some(&local(&s, comp, t, opts)[..]));
-        // A request for another revision is refused as stale.
-        let out = render(&mut w, s.revision + 7, 3);
-        assert!(matches!(out[0].0, FrameReply::Failed { id: 3, stale: true, .. }));
-        // A patch from the wrong base asks for a resync; the mirror then sends the project.
-        let bad = FrameMsg::Patch { from: 999, revision: 1000, ops: vec![] };
-        assert!(matches!(send(bad, &mut w)[0].0, FrameReply::Resync { .. }));
-        m.reset();
-        assert!(matches!(m.sync(s.revision, &s.project), Some(FrameMsg::Project { .. })));
-    }
-
-    #[test]
-    fn frame_messages_round_trip() {
-        for m in [
-            FrameMsg::Purge,
-            FrameMsg::Segs { segs: vec![SegData { key: 7, data: "AAAA".into() }] },
-            FrameMsg::Render {
-                id: 3,
-                revision: 4,
-                comp: ItemId(2),
-                time: Tick::from_seconds_f64(0.5),
-                opts: Box::new(RenderOpts { scale: 0.5, draft: true, roi: Some([1.0, 2.0, 3.0, 4.0]), ..Default::default() }),
-                disk: Some(format!("{:032x}", 0xabcdu128)),
-                layers: true,
-                prefetch: vec![format!("{:032x}", 7u128)],
-            },
-        ] {
-            let a = serde_json::to_string(&m).unwrap();
-            assert_eq!(serde_json::to_string(&round(&m)).unwrap(), a);
-            assert!(a.starts_with("{\"type\":"), "{a}");
-        }
-        for r in [
-            FrameReply::Frame { id: 1, width: 2, height: 3, ms: 4.5, passes: 2, gpu: true, layer_misses: vec!["0a".into()], layer_hits: vec![] },
-            FrameReply::Stored { key: "00ff".into(), bytes: 9, layer: false },
-            FrameReply::Stored { key: "00fe".into(), bytes: 8, layer: true },
-            FrameReply::Info { gpu: Some("Adapter (BrowserWebGpu)".into()), error: None },
-            FrameReply::Failed { id: 1, error: "x".into(), stale: true },
-            FrameReply::Resync { error: "y".into() },
-        ] {
-            assert_eq!(round(&r), r);
-        }
-    }
-
-    /// An accelerator with deferred readbacks: a GPU effect chain is "read back" one
-    /// [`Deferred::settle`] after it was first asked for (computed with the CPU effects, so the
-    /// finished frame equals the CPU render); until then it misses and returns its input.
-    #[derive(Default)]
-    struct Deferred {
-        ready: std::sync::Mutex<std::collections::HashSet<u64>>,
-        asked: std::sync::Mutex<std::collections::HashSet<u64>>,
-        gate: Arc<std::sync::atomic::AtomicBool>,
-        chains: std::sync::atomic::AtomicUsize,
-        auto: effectcraft_render::AutoPick,
-    }
-
-    impl Deferred {
-        fn settle(&self) {
-            let asked: Vec<u64> = self.asked.lock().unwrap().drain().collect();
-            self.ready.lock().unwrap().extend(asked);
-        }
-    }
-
-    impl Accelerator for Deferred {
-        fn name(&self) -> String {
-            "deferred".into()
-        }
-        fn comp_frame(&self, _: &Renderer, _: ItemId, _: Tick) -> Option<Image> {
-            None
-        }
-        fn supports_effect(&self, id: &str) -> bool {
-            effectcraft_effects::GPU_EFFECTS.contains(&id)
-        }
-        fn effects(&self, chain: &[effectcraft_render::FxStep], buf: &effectcraft_effects::Buf, levels: Option<f32>) -> Option<effectcraft_effects::Buf> {
-            use std::hash::{Hash, Hasher};
-            let mut h = std::collections::hash_map::DefaultHasher::new();
-            for s in chain {
-                s.spec.id.hash(&mut h);
-                s.ctx.time.to_bits().hash(&mut h);
-            }
-            (buf.img.width, buf.img.height).hash(&mut h);
-            for p in &buf.img.data {
-                for c in p {
-                    c.to_bits().hash(&mut h);
-                }
-            }
-            let key = h.finish();
-            if !self.ready.lock().unwrap().contains(&key) {
-                self.asked.lock().unwrap().insert(key);
-                self.gate.store(true, std::sync::atomic::Ordering::Relaxed);
-                return Some(buf.clone());
-            }
-            self.chains.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-            let mut b = buf.clone();
-            for s in chain {
-                b = effectcraft_effects::apply(s.spec, &s.ctx, b);
-                if let Some(l) = levels {
-                    effectcraft_render::color::quantize(&mut b.img, l);
-                }
-            }
-            Some(b)
-        }
-        fn auto_pick(&self) -> Option<&effectcraft_render::AutoPick> {
-            Some(&self.auto)
-        }
-        fn frame_begin(&self) {
-            self.ready.lock().unwrap().clear();
-        }
-        fn pass_begin(&self) {
-            self.gate.store(false, std::sync::atomic::Ordering::Relaxed);
-        }
-        fn pass_missed(&self) -> bool {
-            self.gate.load(std::sync::atomic::Ordering::Relaxed)
-        }
-        fn miss_gate(&self) -> Option<Arc<std::sync::atomic::AtomicBool>> {
-            Some(self.gate.clone())
-        }
-    }
-
-    #[test]
-    fn deferred_readbacks_render_in_passes() {
-        let mut s = Session::default();
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        let comp = s.active_comp_id().unwrap();
-        s.execute("layer.newSolid", json!({"color": "#3388ff", "name": "Blue", "width": 200, "height": 120})).unwrap();
-        s.execute("effect.apply", json!({"effect": "ec.blur.gaussian"})).unwrap();
-        s.execute("effect.apply", json!({"effect": "ec.stylize.glow"})).unwrap();
-        s.execute("layer.newSolid", json!({"color": "#ffcc00", "name": "Yellow", "width": 80, "height": 80})).unwrap();
-        s.execute("effect.apply", json!({"effect": "ec.color.levels"})).unwrap();
-        let opts = RenderOpts { scale: 0.25, backend: Backend::Gpu, ..Default::default() };
-        let t = Tick::from_seconds_f64(1.0);
-        let mut w = server(&s);
-        let acc = Arc::new(Deferred::default());
-        w.set_accel(Some(acc.clone()));
-        let mut m = Mirror::default();
-        w.handle(round(&m.sync(s.revision, &s.project).unwrap()));
-        let req = |id| round(&FrameMsg::Render { id, revision: s.revision, comp, time: t, opts: Box::new(opts), disk: None, layers: false, prefetch: vec![] });
-        assert!(w.handle(req(1)).is_empty() && w.waiting(), "the first pass misses");
-        let mut out = vec![];
-        for _ in 0..10 {
-            acc.settle();
-            out = w.resume();
-            if !w.waiting() {
-                break;
-            }
-        }
-        let (FrameReply::Frame { id: 1, passes, gpu: true, .. }, Some(px)) = &out[0] else { panic!("{:?}", out.first().map(|o| &o.0)) };
-        assert!(*passes >= 2, "{passes}");
-        assert!(acc.chains.load(std::sync::atomic::Ordering::Relaxed) >= 2);
-        // The same pixels as the CPU: no placeholder survived, in the frame or the layer cache.
-        assert_eq!(*px, local(&s, comp, t, RenderOpts { backend: Backend::Cpu, ..opts }));
-        let out = w.handle(req(2));
-        let out = if out.is_empty() {
-            acc.settle();
-            w.resume()
-        } else {
-            out
-        };
-        assert_eq!(out[0].1.as_deref(), Some(&px[..]));
-        // CPU requests never touch the accelerator; Auto times whole frames.
-        let cpu = RenderOpts { backend: Backend::Cpu, ..opts };
-        let out =
-            w.handle(round(&FrameMsg::Render { id: 3, revision: s.revision, comp, time: t, opts: Box::new(cpu), disk: None, layers: false, prefetch: vec![] }));
-        assert!(matches!(out[0].0, FrameReply::Frame { id: 3, passes: 1, gpu: false, .. }));
-        for id in 4..12 {
-            let auto = RenderOpts { backend: Backend::Auto, ..opts };
-            let mut out = w.handle(round(&FrameMsg::Render {
-                id,
-                revision: s.revision,
-                comp,
-                time: t,
-                opts: Box::new(auto),
-                disk: None,
-                layers: false,
-                prefetch: vec![],
-            }));
-            while w.waiting() {
-                acc.settle();
-                out = w.resume();
-            }
-            assert_eq!(out[0].1.as_deref(), Some(&px[..]), "frame {id}");
-        }
-        let st = acc.auto.stats(effectcraft_render::AutoKey::new(comp, opts.scale, false)).unwrap();
-        assert!(st.cpu_frames > 0 && st.gpu_frames > 0, "{st:?}");
-    }
-}
+mod tests;
diff --git a/crates/engine/src/background/remote/tests.rs b/crates/engine/src/background/remote/tests.rs
new file mode 100644
index 000000000..e6d797f9d
--- /dev/null
+++ b/crates/engine/src/background/remote/tests.rs
@@ -0,0 +1,513 @@
+use super::*;
+use crate::Session;
+use serde_json::json;
+
+fn round<T: Serialize + for<'de> Deserialize<'de>>(v: &T) -> T {
+    serde_json::from_str(&serde_json::to_string(v).unwrap()).unwrap()
+}
+
+#[test]
+fn diff_and_patch_round_trip() {
+    let a = json!({"a": 1, "b": [1, 2, {"c": null}], "d": {"e": "x", "f": [1]}, "g": null});
+    let b = json!({"a": 2, "b": [1, 3, {"c": 4}], "d": {"f": [1, 2]}, "g": null, "h": {"i": null}});
+    let ops = diff(&a, &b);
+    assert!(!ops.is_empty());
+    let mut x = a.clone();
+    patch(&mut x, &round(&ops)).unwrap();
+    assert_eq!(x, b);
+    // Removal and the reverse direction.
+    let mut y = b.clone();
+    patch(&mut y, &diff(&b, &a)).unwrap();
+    assert_eq!(y, a);
+    assert!(diff(&a, &a).is_empty());
+    // A whole-document change.
+    let mut z = json!(1);
+    patch(&mut z, &diff(&json!(1), &json!([1]))).unwrap();
+    assert_eq!(z, json!([1]));
+    // A patch for another document fails cleanly.
+    assert!(patch(&mut json!(3), &diff(&a, &b)).is_err());
+}
+
+fn server(s: &Session) -> FrameServer {
+    FrameServer::new(s.footage.clone(), s.expr.clone())
+}
+
+/// Pixels the page itself would render.
+fn local(s: &Session, comp: ItemId, t: Tick, opts: RenderOpts) -> Vec<u8> {
+    let mut r = Renderer::new(&s.project, s.footage.as_ref(), opts);
+    r.expr = s.expr.as_deref();
+    rgba8_premultiplied(&r.comp_frame(comp, t))
+}
+
+/// Layer buffers through the disk store: a worker's slow buffers queue up as entries; the
+/// page plans what another worker fetches before its frame (recent misses on disk); that
+/// worker's mid-render lookups find them and the pixels match.
+#[test]
+fn layer_buffers_go_through_the_disk_store() {
+    use effectcraft_render::disk_cache::{DiskIndex, Kind, LayerPrefetch};
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let comp = s.active_comp_id().unwrap();
+    let opts = RenderOpts { scale: 0.25, ..Default::default() };
+    let t = Tick::from_seconds_f64(1.0);
+    let req = |id: u64, layers: bool, prefetch: Vec<String>| {
+        round(&FrameMsg::Render { id, revision: s.revision, comp, time: t, opts: Box::new(opts), disk: None, layers, prefetch })
+    };
+    let worker = || {
+        let mut w = server(&s);
+        let store = Arc::new(PrefetchStore::new(64 << 20).with_min_ms(0));
+        w.set_layer_store(Some(store.clone()));
+        let mut m = Mirror::default();
+        assert!(w.handle(round(&m.sync(s.revision, &s.project).unwrap())).is_empty());
+        (w, store)
+    };
+    let unhex = |v: &[String]| v.iter().map(|k| u128::from_str_radix(k, 16).unwrap()).collect::<Vec<u128>>();
+    // Worker A: everything misses; its buffers queue up for the disk.
+    let (mut a, store_a) = worker();
+    let out = a.handle(req(1, true, vec![]));
+    let (FrameReply::Frame { layer_misses, layer_hits, .. }, Some(px_a)) = &out[0] else { panic!("{:?}", out[0].0) };
+    assert!(!layer_misses.is_empty() && layer_hits.is_empty());
+    let writes = store_a.take_writes();
+    assert!(!writes.is_empty());
+    // Sealed with the files each buffer was made of (none here: the demo reads no footage).
+    assert!(writes.iter().all(|(_, e)| effectcraft_render::disk_cache::read_layer_entry(e).is_some_and(|(_, f)| f.is_empty())));
+    let mut index = DiskIndex::default();
+    let mut disk = std::collections::HashMap::new();
+    for (k, e) in writes {
+        index.insert(Kind::Layer, k, e.len() as u64);
+        disk.insert(k, e);
+    }
+    index.insert(Kind::Frame, 1, 10);
+    // The page: recent misses that are on disk, most recent first.
+    let mut plan = LayerPrefetch::default();
+    plan.note_misses(unhex(layer_misses));
+    let keys = plan.plan(&index, 64);
+    assert!(!keys.is_empty() && keys.len() <= index.len());
+    // Worker B fetches them before its first frame: its lookups hit.
+    let (mut b, store_b) = worker();
+    for k in &keys {
+        assert!(store_b.provide(*k, &disk[k]));
+    }
+    assert!(!store_b.provide(1, b"damaged"));
+    let out = b.handle(req(1, true, keys.iter().map(|k| format!("{k:032x}")).collect()));
+    let (FrameReply::Frame { layer_misses: mb, layer_hits: hb, .. }, Some(px_b)) = &out[0] else { panic!("{:?}", out[0].0) };
+    assert_eq!(unhex(hb).len(), keys.len(), "every fetched buffer was used");
+    assert!(mb.len() < layer_misses.len());
+    assert_eq!(px_a, px_b);
+    assert_eq!(*px_b, local(&s, comp, t, opts));
+    // Nothing new to write: what B rendered itself was rendered by A too.
+    assert!(store_b.take_writes().iter().all(|(k, _)| disk.contains_key(k)));
+    // Without `layers` the store is not consulted.
+    let (mut c, store_c) = worker();
+    c.handle(req(1, false, vec![]));
+    assert!(store_c.take_misses().is_empty() && store_c.take_writes().is_empty());
+    // Purge empties the store.
+    b.handle(round(&FrameMsg::Purge));
+    assert!(!store_b.has(keys[0]));
+    // LRU across frames and layers in the shared index: a touched layer outlives the frame.
+    index.touch(Kind::Layer, keys[0]);
+    let order = index.lru_order();
+    assert_eq!(order.last(), Some(&(Kind::Layer, keys[0])));
+    assert!(order.iter().position(|e| *e == (Kind::Frame, 1)).unwrap() < order.len() - 1);
+}
+
+#[test]
+fn replica_follows_edits_through_diffs_and_renders_the_same_frames() {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let comp = s.active_comp_id().unwrap();
+    let opts = RenderOpts { scale: 0.25, guides: true, ..Default::default() };
+    let mut m = Mirror::default();
+    let mut w = server(&s);
+    let send = |m: FrameMsg, w: &mut FrameServer| w.handle(round(&m));
+    // First sync: the whole project.
+    let first = m.sync(s.revision, &s.project).unwrap();
+    assert!(matches!(first, FrameMsg::Project { .. }));
+    assert!(send(first, &mut w).is_empty());
+    assert!(m.sync(s.revision, &s.project).is_none(), "nothing new");
+    let t = Tick::from_seconds_f64(1.0);
+    let render = |w: &mut FrameServer, rev: u64, id: u64| {
+        w.handle(round(&FrameMsg::Render { id, revision: rev, comp, time: t, opts: Box::new(opts), disk: None, layers: false, prefetch: vec![] }))
+    };
+    let out = render(&mut w, s.revision, 1);
+    let (FrameReply::Frame { id, width, height, .. }, Some(px)) = &out[0] else { panic!("{:?}", out[0].0) };
+    assert_eq!((*id, *width as usize * *height as usize * 4), (1, px.len()));
+    assert_eq!(*px, local(&s, comp, t, opts));
+    // An edit travels as a small diff; the replica renders the edited frame.
+    s.execute("layer.newSolid", json!({"color": "#ff8800", "name": "Orange"})).unwrap();
+    let msg = m.sync(s.revision, &s.project).unwrap();
+    let FrameMsg::Patch { ops, .. } = &msg else { panic!("expected a patch") };
+    assert!(!ops.is_empty() && serde_json::to_string(ops).unwrap().len() < s.project.to_json().len() / 2);
+    assert!(send(msg, &mut w).is_empty());
+    assert_eq!(**w.project().unwrap(), *s.project);
+    let out = render(&mut w, s.revision, 2);
+    assert_eq!(out[0].1.as_deref(), Some(&local(&s, comp, t, opts)[..]));
+    // A request for another revision is refused as stale.
+    let out = render(&mut w, s.revision + 7, 3);
+    assert!(matches!(out[0].0, FrameReply::Failed { id: 3, stale: true, .. }));
+    // A patch from the wrong base asks for a resync; the mirror then sends the project.
+    let bad = FrameMsg::Patch { from: 999, revision: 1000, ops: vec![] };
+    assert!(matches!(send(bad, &mut w)[0].0, FrameReply::Resync { .. }));
+    m.reset();
+    assert!(matches!(m.sync(s.revision, &s.project), Some(FrameMsg::Project { .. })));
+}
+
+#[test]
+fn frame_messages_round_trip() {
+    for m in [
+        FrameMsg::Purge,
+        FrameMsg::Segs { segs: vec![SegData { key: 7, data: "AAAA".into() }] },
+        FrameMsg::Render {
+            id: 3,
+            revision: 4,
+            comp: ItemId(2),
+            time: Tick::from_seconds_f64(0.5),
+            opts: Box::new(RenderOpts { scale: 0.5, draft: true, roi: Some([1.0, 2.0, 3.0, 4.0]), ..Default::default() }),
+            disk: Some(format!("{:032x}", 0xabcdu128)),
+            layers: true,
+            prefetch: vec![format!("{:032x}", 7u128)],
+        },
+    ] {
+        let a = serde_json::to_string(&m).unwrap();
+        assert_eq!(serde_json::to_string(&round(&m)).unwrap(), a);
+        assert!(a.starts_with("{\"type\":"), "{a}");
+    }
+    for r in [
+        FrameReply::Frame { id: 1, width: 2, height: 3, ms: 4.5, passes: 2, gpu: true, layer_misses: vec!["0a".into()], layer_hits: vec![] },
+        FrameReply::Stored { key: "00ff".into(), bytes: 9, layer: false },
+        FrameReply::Stored { key: "00fe".into(), bytes: 8, layer: true },
+        FrameReply::Info { gpu: Some("Adapter (BrowserWebGpu)".into()), error: None },
+        FrameReply::Failed { id: 1, error: "x".into(), stale: true },
+        FrameReply::Resync { error: "y".into() },
+    ] {
+        assert_eq!(round(&r), r);
+    }
+}
+
+/// An accelerator with deferred readbacks: a GPU effect chain is "read back" one
+/// [`Deferred::settle`] after it was first asked for (computed with the CPU effects, so the
+/// finished frame equals the CPU render); until then it misses and returns its input.
+#[derive(Default)]
+struct Deferred {
+    ready: std::sync::Mutex<std::collections::HashSet<u64>>,
+    asked: std::sync::Mutex<std::collections::HashSet<u64>>,
+    gate: Arc<std::sync::atomic::AtomicBool>,
+    chains: std::sync::atomic::AtomicUsize,
+    begins: std::sync::atomic::AtomicUsize,
+    ends: std::sync::atomic::AtomicUsize,
+    auto: effectcraft_render::AutoPick,
+}
+
+impl Deferred {
+    fn settle(&self) {
+        let asked: Vec<u64> = self.asked.lock().unwrap().drain().collect();
+        self.ready.lock().unwrap().extend(asked);
+    }
+}
+
+impl Accelerator for Deferred {
+    fn name(&self) -> String {
+        "deferred".into()
+    }
+    fn comp_frame(&self, _: &Renderer, _: ItemId, _: Tick) -> Option<Image> {
+        None
+    }
+    fn supports_effect(&self, id: &str) -> bool {
+        effectcraft_effects::GPU_EFFECTS.contains(&id)
+    }
+    fn effects(&self, chain: &[effectcraft_render::FxStep], buf: &effectcraft_effects::Buf, levels: Option<f32>) -> Option<effectcraft_effects::Buf> {
+        use std::hash::{Hash, Hasher};
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        for s in chain {
+            s.spec.id.hash(&mut h);
+            s.ctx.time.to_bits().hash(&mut h);
+        }
+        (buf.img.width, buf.img.height).hash(&mut h);
+        for p in &buf.img.data {
+            for c in p {
+                c.to_bits().hash(&mut h);
+            }
+        }
+        let key = h.finish();
+        if !self.ready.lock().unwrap().contains(&key) {
+            self.asked.lock().unwrap().insert(key);
+            self.gate.store(true, std::sync::atomic::Ordering::Relaxed);
+            return Some(buf.clone());
+        }
+        self.chains.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let mut b = buf.clone();
+        for s in chain {
+            b = effectcraft_effects::apply(s.spec, &s.ctx, b);
+            if let Some(l) = levels {
+                effectcraft_render::color::quantize(&mut b.img, l);
+            }
+        }
+        Some(b)
+    }
+    fn auto_pick(&self) -> Option<&effectcraft_render::AutoPick> {
+        Some(&self.auto)
+    }
+    fn frame_begin(&self) {
+        self.begins.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        self.ready.lock().unwrap().clear();
+    }
+    fn frame_end(&self) {
+        self.ends.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    }
+    fn pass_begin(&self) {
+        self.gate.store(false, std::sync::atomic::Ordering::Relaxed);
+    }
+    fn pass_missed(&self) -> bool {
+        self.gate.load(std::sync::atomic::Ordering::Relaxed)
+    }
+    fn miss_gate(&self) -> Option<Arc<std::sync::atomic::AtomicBool>> {
+        Some(self.gate.clone())
+    }
+}
+
+#[test]
+fn deferred_readbacks_render_in_passes() {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let comp = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#3388ff", "name": "Blue", "width": 200, "height": 120})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.blur.gaussian"})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.stylize.glow"})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ffcc00", "name": "Yellow", "width": 80, "height": 80})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.color.levels"})).unwrap();
+    let opts = RenderOpts { scale: 0.25, backend: Backend::Gpu, ..Default::default() };
+    let t = Tick::from_seconds_f64(1.0);
+    let mut w = server(&s);
+    let acc = Arc::new(Deferred::default());
+    w.set_accel(Some(acc.clone()));
+    let mut m = Mirror::default();
+    w.handle(round(&m.sync(s.revision, &s.project).unwrap()));
+    let req = |id| round(&FrameMsg::Render { id, revision: s.revision, comp, time: t, opts: Box::new(opts), disk: None, layers: false, prefetch: vec![] });
+    assert!(w.handle(req(1)).is_empty() && w.waiting(), "the first pass misses");
+    let mut out = vec![];
+    for _ in 0..10 {
+        acc.settle();
+        out = w.resume();
+        if !w.waiting() {
+            break;
+        }
+    }
+    let (FrameReply::Frame { id: 1, passes, gpu: true, .. }, Some(px)) = &out[0] else { panic!("{:?}", out.first().map(|o| &o.0)) };
+    assert!(*passes >= 2, "{passes}");
+    assert!(acc.chains.load(std::sync::atomic::Ordering::Relaxed) >= 2);
+    // The same pixels as the CPU: no placeholder survived, in the frame or the layer cache.
+    assert_eq!(*px, local(&s, comp, t, RenderOpts { backend: Backend::Cpu, ..opts }));
+    let out = w.handle(req(2));
+    let out = if out.is_empty() {
+        acc.settle();
+        w.resume()
+    } else {
+        out
+    };
+    assert_eq!(out[0].1.as_deref(), Some(&px[..]));
+    // CPU requests never touch the accelerator; Auto times whole frames.
+    let cpu = RenderOpts { backend: Backend::Cpu, ..opts };
+    let out =
+        w.handle(round(&FrameMsg::Render { id: 3, revision: s.revision, comp, time: t, opts: Box::new(cpu), disk: None, layers: false, prefetch: vec![] }));
+    assert!(matches!(out[0].0, FrameReply::Frame { id: 3, passes: 1, gpu: false, .. }));
+    for id in 4..12 {
+        let auto = RenderOpts { backend: Backend::Auto, ..opts };
+        let mut out =
+            w.handle(round(&FrameMsg::Render { id, revision: s.revision, comp, time: t, opts: Box::new(auto), disk: None, layers: false, prefetch: vec![] }));
+        while w.waiting() {
+            acc.settle();
+            out = w.resume();
+        }
+        assert_eq!(out[0].1.as_deref(), Some(&px[..]), "frame {id}");
+    }
+    let st = acc.auto.stats(effectcraft_render::AutoKey::new(comp, opts.scale, false)).unwrap();
+    assert!(st.cpu_frames > 0 && st.gpu_frames > 0, "{st:?}");
+}
+
+/// `frame_begin` and `frame_end` stay paired: early fails (before `frame_begin`), a pending frame replaced by a new render, a finished multi-pass frame, and a CPU frame.
+#[test]
+fn every_frame_begin_has_a_frame_end() {
+    use std::sync::atomic::Ordering::Relaxed;
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let comp = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#3388ff", "name": "Blue", "width": 200, "height": 120})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.blur.gaussian"})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.stylize.glow"})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ffcc00", "name": "Yellow", "width": 80, "height": 80})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.color.levels"})).unwrap();
+    let opts = RenderOpts { scale: 0.25, backend: Backend::Gpu, ..Default::default() };
+    let t = Tick::from_seconds_f64(1.0);
+    let mut w = server(&s);
+    let acc = Arc::new(Deferred::default());
+    w.set_accel(Some(acc.clone()));
+    let mut m = Mirror::default();
+    w.handle(round(&m.sync(s.revision, &s.project).unwrap()));
+    let req = |id, revision, comp, opts: RenderOpts| {
+        round(&FrameMsg::Render { id, revision, comp, time: t, opts: Box::new(opts), disk: None, layers: false, prefetch: vec![] })
+    };
+    let load = || (acc.begins.load(Relaxed), acc.ends.load(Relaxed));
+    // Early fails never touch the frame clock.
+    assert!(matches!(w.handle(req(1, s.revision + 1, comp, opts))[0].0, FrameReply::Failed { .. }));
+    assert!(matches!(w.handle(req(2, s.revision, ItemId(999_999), opts))[0].0, FrameReply::Failed { .. }));
+    assert_eq!(load(), (0, 0));
+    // First GPU pass misses and leaves the frame pending.
+    assert!(w.handle(req(3, s.revision, comp, opts)).is_empty() && w.waiting());
+    assert_eq!(load(), (1, 0));
+    // A fail while pending leaves the frame and the counters alone.
+    assert!(matches!(w.handle(req(4, s.revision + 1, comp, opts))[0].0, FrameReply::Failed { .. }));
+    assert!(w.waiting());
+    assert_eq!(load(), (1, 0));
+    // A new valid render replaces the pending frame (ends the old one).
+    assert!(w.handle(req(5, s.revision, comp, opts)).is_empty() && w.waiting());
+    assert_eq!(load(), (2, 1));
+    let mut out = vec![];
+    for _ in 0..10 {
+        acc.settle();
+        out = w.resume();
+        if !w.waiting() {
+            break;
+        }
+    }
+    assert!(matches!(out[0].0, FrameReply::Frame { id: 5, .. }));
+    assert_eq!(load(), (2, 2));
+    // CPU still pairs begin/end on the accelerator.
+    let cpu = RenderOpts { backend: Backend::Cpu, ..opts };
+    assert!(matches!(w.handle(req(6, s.revision, comp, cpu))[0].0, FrameReply::Frame { id: 6, .. }));
+    assert_eq!(load(), (3, 3));
+}
+
+/// Footage that reads one file from memory (the browser's file table) for every frame.
+struct OneVirtualFile {
+    /// Tell which files it reads (else every render's list is incomplete).
+    records: bool,
+}
+
+impl FootageSource for OneVirtualFile {
+    fn frame(&self, _: ItemId, _: &effectcraft_project::Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::filled(4, 4, [1.0, 0.5, 0.0, 1.0])))
+    }
+    fn recording(&self, reads: &ReadLog, f: &mut dyn FnMut()) {
+        if self.records {
+            reads.note(effectcraft_render::reads::ReadFile::new("/clip.png", effectcraft_render::reads::FileStamp::Virtual));
+        } else {
+            reads.mark_incomplete();
+        }
+        f()
+    }
+}
+
+/// The worker hands the transport the files each frame read, so its disk entry keeps them; the
+/// page reads the entry back only while those files are unchanged. A frame whose files can't
+/// all be named is not stored (#3184).
+#[test]
+fn the_worker_reports_the_files_of_each_frame_for_its_disk_entry() {
+    use effectcraft_project::{Comp, Footage, ItemKind, LayerSource, Project, build};
+    use effectcraft_render::disk_cache::{frame_entry, read_frame_entry};
+    use effectcraft_time::FrameRate;
+    let mut p = Project::default();
+    let f = Footage { path: "/clip.png".into(), width: 4, height: 4, duration: Tick::from_seconds_f64(1.0), has_video: true, ..Default::default() };
+    let fid = p.add_item("clip.png", effectcraft_color::Label::None, None, ItemKind::Footage(f));
+    let mut comp = Comp::new(4, 4, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    comp.layers = vec![build::layer(&mut p, &comp, "clip", LayerSource::Footage { item: fid }, (4, 4), None)].into();
+    let cid = p.add_item("C", effectcraft_color::Label::None, None, ItemKind::Comp(comp.into()));
+    let id = |mark: u64| move |path: &str| (path == "/clip.png").then_some((10, mark));
+    let (one, two) = (id(1), id(2));
+    for records in [true, false] {
+        let mut w = FrameServer::new(Arc::new(OneVirtualFile { records }), None);
+        w.set_virtual_id(Some(Arc::new(one)));
+        let mut m = Mirror::default();
+        assert!(w.handle(round(&m.sync(1, &p).unwrap())).is_empty());
+        assert!(w.take_files().is_none(), "no frame yet");
+        let out = w.handle(round(&FrameMsg::Render {
+            id: 1,
+            revision: 1,
+            comp: cid,
+            time: Tick::ZERO,
+            opts: Box::default(),
+            disk: Some(format!("{:032x}", 5u128)),
+            layers: false,
+            prefetch: vec![],
+        }));
+        let (FrameReply::Frame { width, height, .. }, Some(px)) = &out[0] else { panic!("{:?}", out[0].0) };
+        let files = w.take_files().expect("the frame's files");
+        assert!(w.take_files().is_none(), "taken once");
+        let vid = w.virtual_id().cloned();
+        let entry = frame_entry(*width, *height, px, &files, vid.as_deref());
+        if !records {
+            assert!(!files.is_complete() && entry.is_none(), "an incomplete list is not stored");
+            continue;
+        }
+        assert_eq!(files.files().iter().map(|f| &*f.path).collect::<Vec<_>>(), ["/clip.png"]);
+        let entry = entry.expect("stored");
+        assert_eq!(read_frame_entry(&entry, Some(&one)).map(|f| f.rgba), Some(px.clone()));
+        assert!(read_frame_entry(&entry, Some(&two)).is_none(), "the file was replaced: a miss");
+    }
+}
+
+/// No salt work at all (#3184, replacing the background salt of #3106): syncing a project with a
+/// large image sequence nobody shows, patching it and rendering with the layer store never asks
+/// the file hook about the sequence (the salt asked about every file at every sync). Only the
+/// file the rendered buffer reads is asked about: to store its entry and, in another worker, to
+/// check it before the buffer from the store is used.
+#[test]
+fn the_worker_asks_only_about_the_files_its_buffers_read() {
+    use effectcraft_project::{Comp, Footage, FootageKind, ItemKind, LayerSource, Project, build};
+    use effectcraft_time::FrameRate;
+    use std::sync::Mutex;
+    let mut p = Project::default();
+    let f = Footage { path: "/clip.png".into(), width: 4, height: 4, has_video: true, ..Default::default() };
+    let fid = p.add_item("clip.png", effectcraft_color::Label::None, None, ItemKind::Footage(f));
+    let seq = Footage {
+        kind: FootageKind::Sequence,
+        path: "/seq/f_00000.png".into(),
+        sequence: (0..5000).map(|i| format!("/seq/f_{i:05}.png")).collect(),
+        width: 4,
+        height: 4,
+        has_video: true,
+        ..Default::default()
+    };
+    p.add_item("seq", effectcraft_color::Label::None, None, ItemKind::Footage(seq));
+    let mut comp = Comp::new(4, 4, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    comp.layers = vec![build::layer(&mut p, &comp, "clip", LayerSource::Footage { item: fid }, (4, 4), None)].into();
+    let cid = p.add_item("C", effectcraft_color::Label::None, None, ItemKind::Comp(comp.into()));
+    let asked: Arc<Mutex<Vec<String>>> = Arc::default();
+    let worker = || {
+        let mut w = FrameServer::new(Arc::new(OneVirtualFile { records: true }), None);
+        let seen = asked.clone();
+        w.set_virtual_id(Some(Arc::new(move |path: &str| {
+            seen.lock().unwrap().push(path.to_string());
+            (path == "/clip.png").then_some((10, 1))
+        })));
+        let store = Arc::new(PrefetchStore::new(1 << 20).with_min_ms(0));
+        w.set_layer_store(Some(store.clone()));
+        (w, store)
+    };
+    let render = |w: &mut FrameServer, revision: u64, prefetch: Vec<String>| {
+        let out = w.handle(round(&FrameMsg::Render { id: 1, revision, comp: cid, time: Tick::ZERO, opts: Box::default(), disk: None, layers: true, prefetch }));
+        let FrameReply::Frame { layer_hits, .. } = &out[0].0 else { panic!("{:?}", out[0].0) };
+        layer_hits.len()
+    };
+    // Worker A: synced, patched, rendered; its buffer is queued with its file.
+    let (mut a, store_a) = worker();
+    let mut m = Mirror::default();
+    assert!(a.handle(round(&m.sync(1, &p).unwrap())).is_empty());
+    let mut edited = p.clone();
+    edited.item_mut(cid).unwrap().name = "Renamed".into();
+    assert!(a.handle(round(&m.sync(2, &edited).unwrap())).is_empty());
+    assert!(asked.lock().unwrap().is_empty(), "syncing looks at no file");
+    assert_eq!(render(&mut a, 2, vec![]), 0);
+    let writes = store_a.take_writes();
+    assert!(!writes.is_empty(), "the clip's buffer is stored");
+    // Worker B: fetched before its frame, checked, used.
+    let (mut b, store_b) = worker();
+    let mut m = Mirror::default();
+    assert!(b.handle(round(&m.sync(2, &edited).unwrap())).is_empty());
+    for (k, e) in &writes {
+        assert!(store_b.provide(*k, e));
+    }
+    assert!(render(&mut b, 2, writes.iter().map(|(k, _)| format!("{k:032x}")).collect()) > 0, "served from the store");
+    let asked = asked.lock().unwrap();
+    assert!(!asked.is_empty(), "the hook names the buffer's file");
+    assert!(asked.iter().all(|p| p == "/clip.png"), "only the file the buffer read: {:?}", &asked[..asked.len().min(5)]);
+}
diff --git a/crates/engine/src/cmd.rs b/crates/engine/src/cmd.rs
new file mode 100644
index 000000000..076be70ec
--- /dev/null
+++ b/crates/engine/src/cmd.rs
@@ -0,0 +1,300 @@
+//! The command registry. Ids follow After Effects' menu structure; every menu item, panel button,
+//! shortcut and viewer/timeline gesture maps to one of these.
+
+mod aep;
+mod align;
+mod align_data;
+mod anim;
+mod anim_presets;
+pub mod anim_tools;
+mod animation;
+pub(crate) mod app_more;
+mod autotrace;
+mod batch;
+mod blender;
+mod camera_cmds;
+mod comp;
+pub(crate) mod comp_more;
+pub mod content_fill;
+mod create;
+mod edit;
+mod effect;
+pub use effect::{CryptoCoverage, CryptoProbeJob, PLUGINS_DIR};
+pub(crate) use effect::{CryptoProbeSlot, crypto_coverage, crypto_probe_job, crypto_probe_ready, keep_crypto_probe, kept_crypto_probe};
+pub mod essential;
+pub mod expr_tools;
+mod file;
+pub(crate) mod file_more;
+mod focus;
+pub mod footage_panel;
+pub(crate) mod frame_export;
+mod frontend;
+mod help;
+mod import_project;
+mod key_labels;
+mod key_transform;
+mod keys_more;
+mod layer;
+mod layer_menu;
+mod layer_time;
+pub(crate) mod link;
+mod liquify;
+mod lottie;
+pub mod markers;
+mod mask;
+pub mod mask_interp;
+pub(crate) mod model3d;
+mod nav_more;
+pub mod paint;
+pub mod panels_cmds;
+pub(crate) mod path_nulls;
+mod paths;
+mod project_items;
+pub(crate) mod prop;
+mod prop_groups;
+mod proxy;
+pub mod puppet;
+mod query;
+mod quick_offset;
+mod relink;
+pub(crate) mod relink_moved;
+mod render_queue;
+pub(crate) mod rig3d;
+pub mod roto_cmds;
+mod scene_detect;
+pub mod scripts;
+mod settings;
+pub mod shape_stroke;
+pub mod shape_tool;
+mod stubs;
+mod styles;
+mod text_anim;
+pub mod text_edit;
+mod three_d;
+pub mod time;
+mod timeline;
+mod track;
+mod view;
+pub mod viewer_cmds;
+pub(crate) mod vpe;
+pub(crate) mod vr_editor;
+mod warp_cmds;
+pub(crate) mod watch_folder;
+#[cfg(test)]
+pub(crate) use app_more::report_text as report_text_for_tests;
+pub(crate) use app_more::view_command;
+#[cfg(test)]
+pub(crate) use file::open as open_for_tests;
+#[cfg(test)]
+pub(crate) use keys_more::amplitudes as amplitudes_for_tests;
+#[cfg(test)]
+pub(crate) use mask::split_segment as split_segment_for_tests;
+
+use std::sync::OnceLock;
+
+use effectcraft_project::{Comp, ItemId, Layer, LayerId};
+use effectcraft_time::Tick;
+use serde_json::Value;
+
+use crate::{EngineError, Result, Session};
+
+pub type Run = fn(&mut Session, &Value) -> Result<Value>;
+pub type Enabled = fn(&Session) -> std::result::Result<(), String>;
+
+/// Metadata + implementation for one command.
+pub struct CommandSpec {
+    pub id: &'static str,
+    pub label: &'static str,
+    /// Menu placement, e.g. `["Layer", "New"]`. Empty = not in menus.
+    pub menu: &'static [&'static str],
+    /// Default shortcut (egui-style names, `Cmd` = ⌘ on macOS / Ctrl elsewhere).
+    pub shortcut: Option<&'static str>,
+    /// Further default shortcuts (the menus and tooltips show `shortcut`).
+    pub alt_shortcuts: &'static [&'static str],
+    /// Parameter description for agents and the MCP schema.
+    pub params: &'static str,
+    pub enabled: Enabled,
+    pub run: Run,
+    /// Record in the journal (false for pure queries).
+    pub journal: bool,
+}
+
+#[macro_export]
+macro_rules! cmd {
+    // Several default shortcuts: `["PageDown", "Cmd+ArrowRight"]`.
+    ($id:literal, $label:literal, [$($m:literal),*], [$sc:literal, $($alt:literal),+], $params:literal, $en:expr, $run:expr) => {
+        $crate::commands::CommandSpec { alt_shortcuts: &[$($alt),+], ..$crate::cmd!($id, $label, [$($m),*], Some($sc), $params, $en, $run) }
+    };
+    ($id:literal, $label:literal, [$($m:literal),*], $sc:expr, $params:literal, $en:expr, $run:expr) => {
+        $crate::commands::CommandSpec {
+            id: $id,
+            label: $label,
+            menu: &[$($m),*],
+            shortcut: $sc,
+            alt_shortcuts: &[],
+            params: $params,
+            enabled: $en,
+            run: $run,
+            journal: true,
+        }
+    };
+}
+#[macro_export]
+macro_rules! query {
+    ($id:literal, $label:literal, $params:literal, $run:expr) => {
+        $crate::commands::CommandSpec {
+            id: $id,
+            label: $label,
+            menu: &[],
+            shortcut: None,
+            alt_shortcuts: &[],
+            params: $params,
+            enabled: $crate::commands::always,
+            run: $run,
+            journal: false,
+        }
+    };
+}
+
+mod enabled;
+mod params;
+mod schema;
+
+use super::commands;
+pub use enabled::always;
+pub(crate) use enabled::{has_comp, has_keys, has_layers, has_project_selection, not_yet, not_yet_run};
+pub use params::match_path_of;
+pub(crate) use params::{
+    b_p, bad, comp_id, f_p, frontend, layer_mut, layer_p, layers_or, layers_p, merge_p, popup_options, resolve_effect_path, resolve_layer, selectable,
+    selected_leaf_props, str_p, time_p, unlocked, visible_p,
+};
+pub use schema::{accepted_params, check_params, params_schema};
+
+pub fn command_specs() -> &'static [CommandSpec] {
+    static SPECS: OnceLock<Vec<CommandSpec>> = OnceLock::new();
+    SPECS.get_or_init(|| {
+        let mut v = Vec::new();
+        v.extend(file::specs());
+        v.extend(crate::models::specs());
+        v.extend(crate::library::specs());
+        v.extend(edit::specs());
+        v.extend(comp::specs());
+        v.extend(layer::specs());
+        v.extend(styles::specs());
+        v.extend(three_d::specs());
+        v.extend(model3d::specs());
+        v.extend(rig3d::specs());
+        v.extend(text_anim::specs());
+        v.extend(text_edit::specs());
+        v.extend(layer_time::specs());
+        v.extend(prop::specs());
+        v.extend(prop_groups::specs());
+        v.extend(project_items::specs());
+        v.extend(anim::specs());
+        v.extend(anim_tools::specs());
+        v.extend(link::specs());
+        v.extend(markers::specs());
+        v.extend(mask::specs());
+        v.extend(paths::specs());
+        v.extend(effect::specs());
+        v.extend(time::specs());
+        v.extend(nav_more::specs());
+        v.extend(render_queue::specs());
+        v.extend(help::specs());
+        v.extend(query::specs());
+        v.extend(batch::specs());
+        v.extend(layer_menu::specs());
+        v.extend(create::specs());
+        v.extend(animation::specs());
+        v.extend(anim_presets::specs());
+        v.extend(view::specs());
+        v.extend(viewer_cmds::specs());
+        v.extend(shape_stroke::specs());
+        v.extend(shape_tool::specs());
+        v.extend(focus::specs());
+        v.extend(key_labels::specs());
+        v.extend(key_transform::specs());
+        v.extend(quick_offset::specs());
+        v.extend(file_more::specs());
+        v.extend(relink::specs());
+        v.extend(relink_moved::specs());
+        v.extend(lottie::specs());
+        v.extend(aep::specs());
+        v.extend(import_project::specs());
+        v.extend(timeline::specs());
+        v.extend(comp_more::specs());
+        v.extend(frame_export::specs());
+        v.extend(watch_folder::specs());
+        v.extend(vpe::specs());
+        v.extend(path_nulls::specs());
+        v.extend(vr_editor::specs());
+        v.extend(frontend::specs());
+        v.extend(track::specs());
+        v.extend(mask_interp::specs());
+        v.extend(warp_cmds::specs());
+        v.extend(camera_cmds::specs());
+        v.extend(roto_cmds::specs());
+        v.extend(paint::specs());
+        v.extend(puppet::specs());
+        v.extend(liquify::specs());
+        v.extend(settings::specs());
+        v.extend(app_more::specs());
+        v.extend(keys_more::specs());
+        v.extend(essential::specs());
+        v.extend(expr_tools::specs());
+        v.extend(proxy::specs());
+        v.extend(scripts::specs());
+        v.extend(panels_cmds::specs());
+        v.extend(footage_panel::specs());
+        v.extend(autotrace::specs());
+        v.extend(scene_detect::specs());
+        v.extend(align_data::specs());
+        v.extend(align::specs());
+        v.extend(content_fill::specs());
+        v.extend(stubs::specs());
+        v.extend(crate::storage::specs());
+        v.extend(crate::learn::specs());
+        v.extend(crate::templates::specs());
+        v.extend(crate::preview::specs());
+        v
+    })
+}
+
+/// Set `footage` as the proxy of `item` (File ▸ Create Proxy's post-render action).
+pub(crate) fn proxy_set(s: &mut Session, item: ItemId, footage: effectcraft_project::Footage) -> Result<()> {
+    proxy::set_proxy_footage(s, &[item], footage)
+}
+
+/// (id, name) of the text animation presets.
+pub fn text_preset_list() -> Vec<(String, String)> {
+    text_anim::preset_names()
+}
+
+/// (id, name, category) of the built-in animation presets (Transitions…).
+pub fn builtin_preset_list() -> Vec<(String, String, String)> {
+    anim_presets::preset_names()
+}
+
+pub fn find(id: &str) -> Option<&'static CommandSpec> {
+    // Every command execution looks its spec up: index the ~2,000 ids once.
+    static INDEX: OnceLock<std::collections::HashMap<&'static str, usize>> = OnceLock::new();
+    let index = INDEX.get_or_init(|| {
+        let mut m = std::collections::HashMap::new();
+        for (i, c) in command_specs().iter().enumerate() {
+            m.entry(c.id).or_insert(i);
+        }
+        m
+    });
+    index.get(id).map(|&i| &command_specs()[i])
+}
+
+/// Font families available to text layers (bundled + scanned system fonts).
+/// Text animation presets: (id, name), for menus.
+pub fn text_presets() -> Vec<(String, String)> {
+    commands::text_preset_list()
+}
+
+/// Built-in animation presets (Effects & Presets ▸ * Animation Presets): (id, name, category).
+pub fn animation_presets() -> Vec<(String, String, String)> {
+    commands::builtin_preset_list()
+}
diff --git a/crates/engine/src/cmd/aep.rs b/crates/engine/src/cmd/aep.rs
new file mode 100644
index 000000000..575171f89
--- /dev/null
+++ b/crates/engine/src/cmd/aep.rs
@@ -0,0 +1,150 @@
+//! File ▸ Import ▸ After Effects Project… (`effectcraft_aep::import`) and File ▸ Export ▸ After Effects
+//! Project… (`effectcraft_aep::export`).
+//!
+//! Adds the items of an `.aep` (or its XML form, `.aepx`) to the project in a folder named after
+//! the file (`docs/aep-import.md` lists what arrives). What the importer cannot bring over (effects
+//! outside its table, undecoded text and style settings, …) is returned in the report; with losses and without
+//! `allowLosses` the import is refused and changes nothing. Fonts that are not installed are listed
+//! in the report's `missingFonts` (not a loss: the text keeps the font name and is drawn with the
+//! fallback font).
+
+use effectcraft_aep::export::{AepExportError, ExportOptions};
+use effectcraft_aep::import::{AepImportError, ImportOptions};
+use effectcraft_project::{FootageKind, ItemKind};
+use serde_json::{Value, json};
+
+use super::{CommandSpec, always, b_p, bad, str_p};
+use crate::{EngineError, Result, Session, cmd};
+
+fn import_aep(s: &mut Session, p: &Value) -> Result<Value> {
+    let path = str_p(p, "path").ok_or_else(|| bad("file.importAep", "missing `path`"))?.to_string();
+    let allow_losses = b_p(p, "allowLosses").unwrap_or(false);
+    let dry_run = b_p(p, "dryRun").unwrap_or(false);
+    let bytes = s.services.read_file(&path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
+    // Footage paths stored in the file reach the file system only through the document-path policy
+    // (`doc_path`): relative ones are taken from the file's folder, paths to other computers are
+    // never looked at (the footage arrives missing).
+    let services = s.services.clone();
+    let doc = path.clone();
+    let exists = move |f: &str| crate::doc_path::resolve(f, Some(&doc)).ok().and_then(|p| p.to_str().map(|p| services.exists(p))).unwrap_or(false);
+    // The renderer's own font lookup (family, full or PostScript name); a miss falls back.
+    let has_font = |font: &str| !effectcraft_text::resolve(font, "Regular").missing;
+    let name = std::path::Path::new(&path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "After Effects Project".into());
+    // Into a project without compositions the file's settings come along (it is opened as a
+    // project); into one with compositions only when asked (`applySettings`). Settings that are not
+    // taken over cannot be lost, so the dry run and the refusal leave them out.
+    let apply = b_p(p, "applySettings").unwrap_or_else(|| s.project.comps().next().is_none());
+    let options = ImportOptions { allow_losses, exists: &exists, has_font: &has_font, folder_name: &name, settings: apply };
+    if dry_run {
+        let report = effectcraft_aep::import::analyze_with(&bytes, &options).map_err(|e| EngineError::Other(format!("cannot import {path}: {e}")))?;
+        return Ok(json!({"dryRun": true, "report": report}));
+    }
+    let importer = s.importer.clone();
+    let res = s.edit("Import After Effects Project", None, |proj, st| {
+        let r = effectcraft_aep::import::import(proj, &bytes, &options).map_err(|e| match e {
+            AepImportError::Refused(_) => {
+                EngineError::Other(format!("{e} (nothing was imported: pass `allowLosses` to import anyway, or `dryRun` for the full report)"))
+            }
+            other => EngineError::Other(format!("cannot import {path}: {other}")),
+        })?;
+        if apply {
+            proj.settings = r.settings.clone();
+        }
+        // The new footage keeps the file as its origin: resolved against it, a refused path missing.
+        let created: std::collections::HashSet<_> = r.items.iter().copied().collect();
+        crate::doc_path::resolve_footage_of(proj, |id| created.contains(&id), Some(&path));
+        // A video file that is there says whether it carries sound, and it is right when the
+        // project file's stored sample rate is not (the file changed since, or the project is not
+        // After Effects's own). The path is the one the document-path policy resolved above; a
+        // refused or missing one is not read and keeps what the project file says.
+        if let Some(importer) = &importer {
+            for item in proj.items.values_mut().filter(|i| created.contains(&i.id)) {
+                if let ItemKind::Footage(f) = &mut item.kind
+                    && f.kind == FootageKind::Video
+                    && !f.missing
+                    && let Ok(probed) = importer.probe(&f.path)
+                {
+                    f.has_audio = probed.has_audio;
+                }
+            }
+        }
+        st.project_selection = vec![r.folder];
+        Ok(r)
+    })?;
+    let created: std::collections::HashSet<_> = res.items.iter().copied().collect();
+    s.stored_paths.add_items(&s.project, |id| created.contains(&id), Some(&path));
+    if let Some(first) = res.comps.first() {
+        s.open_comp(*first);
+    }
+    let losses = res.report.total_losses();
+    s.toast(if losses == 0 {
+        format!("Imported {name}")
+    } else {
+        format!("Imported {name} ({losses} unsupported item{} not imported)", if losses == 1 { "" } else { "s" })
+    });
+    Ok(json!({
+        "folder": res.folder.0,
+        "comps": res.comps.iter().map(|c| c.0).collect::<Vec<_>>(),
+        "items": res.items.iter().map(|i| i.0).collect::<Vec<_>>(),
+        "report": res.report,
+    }))
+}
+
+fn export_aep(s: &mut Session, p: &Value) -> Result<Value> {
+    let path = str_p(p, "path").ok_or_else(|| bad("file.exportAep", "missing `path`"))?.to_string();
+    let allow_losses = b_p(p, "allowLosses").unwrap_or(false);
+    let dry_run = b_p(p, "dryRun").unwrap_or(false);
+    if dry_run {
+        return Ok(json!({"dryRun": true, "report": effectcraft_aep::export::analyze(&s.project)}));
+    }
+    // Image-sequence folders keep their stored numbering in After Effects only with their actual
+    // modification time (otherwise it rescans them and warns about every gap on open). The folder
+    // is looked at only when the sequence's file passes the document-path policy (a path that came
+    // from a document is followed as import followed it; a refused one leaves the time unset).
+    let services = s.services.clone();
+    let stored = s.stored_paths.clone();
+    let folder_time = move |file: &str| {
+        let file = stored.follow(file).ok()?;
+        let file = file.to_str()?;
+        // Either separator, as the exporter splits the alias (a Windows path on another system).
+        let dir = file.get(..file.rfind(['/', '\\'])?).filter(|d| !d.is_empty())?;
+        services.stamp(dir).and_then(|(_, ns)| u64::try_from(ns / 1_000_000_000).ok())
+    };
+    let res = effectcraft_aep::export::export_with(&s.project, &ExportOptions { allow_losses }, &folder_time).map_err(|e| match e {
+        AepExportError::Refused(_) => {
+            EngineError::Other(format!("{e} (nothing was written: pass `allowLosses` to export anyway, or `dryRun` for the full report)"))
+        }
+        other => EngineError::Other(format!("cannot export {path}: {other}")),
+    })?;
+    s.services.write_file(&path, &res.bytes).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    let losses = res.report.total_losses();
+    s.toast(if losses == 0 {
+        format!("Exported After Effects project to {path}")
+    } else {
+        format!("Exported After Effects project to {path} ({losses} unsupported item{} not exported)", if losses == 1 { "" } else { "s" })
+    });
+    Ok(json!({"path": path, "bytes": res.bytes.len(), "report": res.report}))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            "file.importAep",
+            "After Effects Project...",
+            ["File", "Import"],
+            None,
+            "{path (.aep or .aepx), allowLosses?: bool (import although parts cannot be imported), dryRun?: bool (only return the report), applySettings?: bool (take over the file's project settings; default: when the project has no compositions)}",
+            always,
+            import_aep
+        ),
+        cmd!(
+            "file.exportAep",
+            "After Effects Project...",
+            ["File", "Export"],
+            None,
+            "{path (.aep), allowLosses?: bool (export although parts cannot be exported), dryRun?: bool (only return the report)}",
+            always,
+            export_aep
+        ),
+    ]
+}
diff --git a/crates/engine/src/commands/align.rs b/crates/engine/src/cmd/align.rs
similarity index 100%
rename from crates/engine/src/commands/align.rs
rename to crates/engine/src/cmd/align.rs
diff --git a/crates/engine/src/commands/align_data.rs b/crates/engine/src/cmd/align_data.rs
similarity index 90%
rename from crates/engine/src/commands/align_data.rs
rename to crates/engine/src/cmd/align_data.rs
index 097bddc22..99ed3d113 100644
--- a/crates/engine/src/commands/align_data.rs
+++ b/crates/engine/src/cmd/align_data.rs
@@ -33,14 +33,16 @@ pub struct Stamp {
     pub dated: bool,
 }
 
-fn days_from_civil(y: i64, m: i64, d: i64) -> i64 {
-    let y = if m <= 2 { y - 1 } else { y };
-    let era = y.div_euclid(400);
-    let yoe = y - era * 400;
-    let mp = (m + 9) % 12;
-    let doy = (153 * mp + 2) / 5 + d - 1;
-    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
-    era * 146_097 + doe - 719_468
+/// Days since 1970-01-01 of the proleptic-Gregorian date `(y, m, d)`. `d` is added linearly (as
+/// the previous hand-rolled `days_from_civil` did), so a day past the month's end rolls over;
+/// `None` when the year/month is out of chrono's range. `m` must be 1..=12.
+fn days_from_civil(y: i64, m: i64, d: i64) -> Option<i64> {
+    let year = i32::try_from(y).ok()?;
+    let month = u32::try_from(m).ok()?;
+    let first = chrono::NaiveDate::from_ymd_opt(year, month, 1)?;
+    // Days since the Unix epoch: `num_days_from_ce` counts from 0001-01-01; 719_162 days precede 1970-01-01.
+    use chrono::Datelike;
+    i64::from(first.num_days_from_ce()).checked_sub(719_163)?.checked_add(d.checked_sub(1)?)
 }
 
 /// `hh:mm:ss(.fff)` or timecode `hh:mm:ss:ff` / `hh:mm:ss;ff` → seconds.
@@ -70,9 +72,9 @@ pub fn parse_stamp(v: &Value, fps: f64) -> Option<Stamp> {
             }
             // ISO 8601: date [T| ] time [zone].
             if s.len() >= 10 && s.as_bytes()[4] == b'-' && s.as_bytes()[7] == b'-' {
-                let (y, m, d) = (s[0..4].parse::<i64>().ok()?, s[5..7].parse::<i64>().ok()?, s[8..10].parse::<i64>().ok()?);
-                let mut secs = days_from_civil(y, m, d) as f64 * 86_400.0;
-                let rest = s[10..].trim_start_matches(['T', 't', ' ']);
+                let (y, m, d) = (s.get(0..4)?.parse::<i64>().ok()?, s.get(5..7)?.parse::<i64>().ok()?, s.get(8..10)?.parse::<i64>().ok()?);
+                let mut secs = days_from_civil(y, m, d)? as f64 * 86_400.0;
+                let rest = s.get(10..)?.trim_start_matches(['T', 't', ' ']);
                 if !rest.is_empty() {
                     // Zone: Z or ±hh:mm / ±hhmm.
                     let (time, zone) = match rest.find(['Z', 'z', '+']).or_else(|| rest.rfind('-')) {
@@ -227,6 +229,12 @@ pub fn specs() -> Vec<CommandSpec> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn multibyte_date_is_rejected() {
+        assert_eq!(parse_stamp(&json!("2026-05-0é"), 25.0), None);
+        assert_eq!(parse_stamp(&json!("2026-05-01é"), 25.0), None);
+    }
+
     #[test]
     fn parses_timestamps() {
         let p = |v: Value| parse_stamp(&v, 25.0).unwrap();
diff --git a/crates/engine/src/commands/anim.rs b/crates/engine/src/cmd/anim.rs
similarity index 93%
rename from crates/engine/src/commands/anim.rs
rename to crates/engine/src/cmd/anim.rs
index 325845115..e23fc736f 100644
--- a/crates/engine/src/commands/anim.rs
+++ b/crates/engine/src/cmd/anim.rs
@@ -45,6 +45,7 @@ fn copy(s: &mut Session, _: &Value) -> Result<Value> {
         clip.push(KeyClip { layer: lid, path, keys });
     }
     let n: usize = clip.iter().map(|c| c.keys.len()).sum();
+    s.state.keyframe_text = crate::keyframe_text::text(&s.project, comp, &s.state.selected_keys, &[]);
     s.state.key_clipboard = clip;
     s.state.clip_is_keys = true;
     Ok(json!(n))
@@ -55,6 +56,10 @@ fn compatible(a: &Property, b: &effectcraft_keyframe::Value) -> bool {
     a.value.kind_name() == b.kind_name() && a.value.components().len() == b.components().len()
 }
 
+pub(crate) fn locked_selection(comp: &effectcraft_project::Comp, selected: &[KeyRef]) -> Vec<KeyRef> {
+    selected.iter().filter(|k| comp.layer(k.layer).is_some_and(|l| l.switches.locked)).copied().collect()
+}
+
 /// Paste copied keyframes at the current time into the target layers' properties.
 fn paste(s: &mut Session, p: &Value) -> Result<Value> {
     let clip = s.state.key_clipboard.clone();
@@ -89,6 +94,9 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
     let mut plan: Vec<(LayerId, Uid, usize)> = vec![];
     for (ti, lid) in targets.iter().enumerate() {
         let Some(l) = comp.layer(*lid) else { continue };
+        if l.switches.locked {
+            continue;
+        }
         for (ci, c) in clip.iter().enumerate() {
             if paired && sources.get(ti) != Some(&c.layer) {
                 continue;
@@ -110,11 +118,12 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
         }
     }
     if plan.is_empty() {
-        return Err(bad("keys.paste", "no compatible property to paste into (select a property of the same type)"));
+        return Err(bad("keys.paste", "no compatible unlocked property to paste into (unlock the target or select a property of the same type)"));
     }
     s.edit("Paste Keyframes", merge_p(p), |proj, st| {
         let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        let mut sel = vec![];
+        let mut sel = locked_selection(comp, &st.selected_keys);
+        let retained = sel.len();
         for (lid, uid, ci) in &plan {
             let Some(l) = comp.layer_mut(*lid) else { continue };
             let times: Vec<Tick> = clip[*ci].keys.iter().map(|k| l.layer_time(t + k.time)).collect();
@@ -136,8 +145,9 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
             }
             retime_roving(&mut pr.keys, pr.spatial);
         }
+        let pasted = sel.len().saturating_sub(retained);
         st.selected_keys = sel;
-        Ok(json!(st.selected_keys.len()))
+        Ok(json!(pasted))
     })
 }
 
@@ -175,6 +185,9 @@ pub(super) fn paste_path(s: &mut Session, p: &Value, (cid, lid, uid): (ItemId, L
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let t = time_p(s, p, Some(comp));
     let target = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    if target.switches.locked {
+        return Err(bad("keys.paste", "the target layer is locked"));
+    }
     let mut order: Vec<usize> = (0..path.vertices.len()).collect();
     if path.closed && !order.is_empty() {
         order.push(0);
@@ -202,6 +215,9 @@ pub(super) fn paste_path(s: &mut Session, p: &Value, (cid, lid, uid): (ItemId, L
         })
         .collect();
     s.edit("Paste Keyframes", merge_p(p), |proj, st| {
+        let comp = proj.comp(cid).ok_or(EngineError::NoComp)?;
+        let mut selected = locked_selection(comp, &st.selected_keys);
+        let retained = selected.len();
         let l = super::layer_mut(proj, cid, lid)?;
         let pr = l.props.find_mut(uid).ok_or_else(|| bad("keys.paste", "no property"))?;
         let mut sel = vec![];
@@ -216,8 +232,10 @@ pub(super) fn paste_path(s: &mut Session, p: &Value, (cid, lid, uid): (ItemId, L
         // Re-timing keeps the keys' order, so the pasted keys are found again by index.
         let pasted: Vec<usize> = pr.keys.iter().enumerate().filter(|(_, k)| sel.contains(&k.time)).map(|(i, _)| i).collect();
         retime_roving(&mut pr.keys, pr.spatial);
-        st.selected_keys = pasted.iter().filter_map(|&i| pr.keys.get(i)).map(|k| KeyRef { layer: lid, prop: uid, time: k.time }).collect();
-        Ok(json!(st.selected_keys.len()))
+        selected.extend(pasted.iter().filter_map(|&i| pr.keys.get(i)).map(|k| KeyRef { layer: lid, prop: uid, time: k.time }));
+        let count = selected.len().saturating_sub(retained);
+        st.selected_keys = selected;
+        Ok(json!(count))
     })
 }
 
@@ -296,6 +314,9 @@ fn set_key(s: &mut Session, p: &Value) -> Result<Value> {
     let base = KeyTimeBase::from_params(p, "keys.set")?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    if layer.switches.locked {
+        return Err(bad("keys.set", "the layer is locked"));
+    }
     let t = key_time(layer, comp.frame_rate, p, "time", base, "keys.set", false)?.ok_or_else(|| bad("keys.set", "missing `time` (layer time by default)"))?;
     let new_t = key_time(layer, comp.frame_rate, p, "newTime", base, "keys.set", true)?;
     let value = p.get("value").cloned();
@@ -349,6 +370,9 @@ fn set_ease(s: &mut Session, p: &Value) -> Result<Value> {
     let influence = f_p(p, "influence").map(|v| (v / 100.0).clamp(0.001, 1.0));
     s.edit("Keyframe Velocity", merge_p(p), |proj, _| {
         let l = super::layer_mut(proj, cid, lid)?;
+        if l.switches.locked {
+            return Err(bad("keys.setEase", "the layer is locked"));
+        }
         let pr = l.props.find_mut(uid).ok_or_else(|| bad("keys.setEase", "no property"))?;
         let i = nearest_key(&pr.keys, t).ok_or_else(|| bad("keys.setEase", "no keyframes"))?;
         let spatial = pr.spatial;
@@ -495,7 +519,13 @@ fn time_reverse(s: &mut Session, _: &Value) -> Result<Value> {
         }
         let mut new_sel = vec![];
         for ((lid, uid), times) in groups {
-            let Some(pr) = comp.layer_mut(lid).and_then(|l| l.props.find_mut(uid)) else { continue };
+            let Some(layer) = comp.layer_mut(lid) else { continue };
+            // A locked layer's keys stay as they are, and stay selected.
+            if layer.switches.locked {
+                new_sel.extend(times.iter().map(|time| KeyRef { layer: lid, prop: uid, time: *time }));
+                continue;
+            }
+            let Some(pr) = layer.props.find_mut(uid) else { continue };
             let (mut picked, rest): (Vec<Keyframe>, Vec<Keyframe>) = pr.keys.drain(..).partition(|k| times.contains(&k.time));
             effectcraft_keyframe::time_reverse(&mut picked);
             new_sel.extend(picked.iter().map(|k| KeyRef { layer: lid, prop: uid, time: k.time }));
diff --git a/crates/engine/src/commands/anim_presets.rs b/crates/engine/src/cmd/anim_presets.rs
similarity index 95%
rename from crates/engine/src/commands/anim_presets.rs
rename to crates/engine/src/cmd/anim_presets.rs
index fc3f95143..88022a0e3 100644
--- a/crates/engine/src/commands/anim_presets.rs
+++ b/crates/engine/src/cmd/anim_presets.rs
@@ -1,6 +1,7 @@
 //! EffectCraft's own animation preset library (Effects & Presets ▸ * Animation Presets): the
 //! Transitions category (original presets built on our Transition effects and layer opacity) and
-//! the Backgrounds category (generators, noise and colour effects driven by expressions).
+//! the Backgrounds category (generators, noise and colour effects driven by expressions) and the
+//! Behaviors category (transform and opacity driven by expressions, no effects).
 //!
 //! Each preset adds effects (with values and keyframes) and/or keys layer properties, starting
 //! at the current time, on every selected layer. The library is data
@@ -26,13 +27,17 @@ pub const TRANSITIONS_JSON: &str = include_str!("../../presets/transitions.json"
 /// The original background presets (`presets/backgrounds.json`).
 pub const BACKGROUNDS_JSON: &str = include_str!("../../presets/backgrounds.json");
 
+/// The original behavior presets (`presets/behaviors.json`): expression-driven motion on a layer's
+/// transform and opacity, no effects.
+pub const BEHAVIORS_JSON: &str = include_str!("../../presets/behaviors.json");
+
 /// Keys per animated property, so a hostile inline preset can't allocate without bound.
 const MAX_KEYS: usize = 256;
 /// Longest expression text an inline preset may carry.
 const MAX_EXPR: usize = 4096;
 
 fn presets() -> Vec<Value> {
-    [TRANSITIONS_JSON, BACKGROUNDS_JSON]
+    [TRANSITIONS_JSON, BACKGROUNDS_JSON, BEHAVIORS_JSON]
         .iter()
         .flat_map(|src| serde_json::from_str::<Value>(src).ok().and_then(|v| v.get("presets").and_then(Value::as_array).cloned()).unwrap_or_default())
         .collect()
diff --git a/crates/engine/src/commands/anim_tools.rs b/crates/engine/src/cmd/anim_tools.rs
similarity index 98%
rename from crates/engine/src/commands/anim_tools.rs
rename to crates/engine/src/cmd/anim_tools.rs
index 06e0d341b..33ee39ae2 100644
--- a/crates/engine/src/commands/anim_tools.rs
+++ b/crates/engine/src/cmd/anim_tools.rs
@@ -213,7 +213,8 @@ fn sample_curve(
 
 fn grouped_selection(s: &Session) -> std::collections::BTreeMap<(LayerId, Uid), Vec<Tick>> {
     let mut g: std::collections::BTreeMap<(LayerId, Uid), Vec<Tick>> = Default::default();
-    for k in &s.state.selected_keys {
+    let Some(comp) = s.active_comp() else { return g };
+    for k in super::prop::editable_keys(comp, &s.state.selected_keys) {
         g.entry((k.layer, k.prop)).or_default().push(k.time);
     }
     for v in g.values_mut() {
@@ -273,7 +274,7 @@ fn run_on_selection(
     s.edit(label, None, |proj, st| {
         let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
         let fr = comp.frame_rate;
-        let mut sel = vec![];
+        let mut sel = super::anim::locked_selection(comp, &st.selected_keys);
         for ((lid, uid), times) in groups {
             let Some(l) = comp.layer_mut(lid) else { continue };
             let lc = l.clone();
diff --git a/crates/engine/src/commands/animation.rs b/crates/engine/src/cmd/animation.rs
similarity index 83%
rename from crates/engine/src/commands/animation.rs
rename to crates/engine/src/cmd/animation.rs
index 1bdf3fed7..4cfaa26ed 100644
--- a/crates/engine/src/commands/animation.rs
+++ b/crates/engine/src/cmd/animation.rs
@@ -10,11 +10,16 @@ use effectcraft_project::{GroupKind, Layer, LayerId, LayerSource, Node, Project,
 use effectcraft_time::Tick;
 use serde_json::{Value, json};
 
+use super::effect::{effect_time_error, retime_effect};
 use super::{CommandSpec, bad, frontend, has_comp, has_keys, has_layers, layer_mut, layers_p, match_path_of, resolve_effect_path, selected_leaf_props, str_p};
 use crate::{EngineError, KeyRef, Result, Session, cmd};
 
 /// Preset file format version tag (`*.ecpreset`, JSON).
 pub const PRESET_TAG: &str = "effectcraftAnimationPreset";
+/// The preset format version that `anim.savePreset` writes.
+pub const PRESET_VERSION: u64 = 2;
+/// The first preset version that stores effect keys relative to the earliest key (#1971).
+const RELATIVE_EFFECT_KEYS: u64 = 2;
 
 fn has_selected_props(s: &Session) -> std::result::Result<(), String> {
     has_comp(s)?;
@@ -45,13 +50,27 @@ fn selected_effects(s: &Session) -> Vec<(LayerId, PropGroup)> {
         .collect()
 }
 
+/// The earliest key anywhere in `groups`, nested controls included.
+fn earliest_key<'a>(groups: impl IntoIterator<Item = &'a PropGroup>) -> Option<Tick> {
+    let mut first: Option<Tick> = None;
+    for g in groups {
+        g.walk("", &mut |_, pr| {
+            if let Some(t) = pr.keys.iter().map(|k| k.time).min() {
+                first = Some(first.map_or(t, |f| f.min(t)));
+            }
+        });
+    }
+    first
+}
+
 // ---------------------------------------------------------------- presets
 
 fn save_preset(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_p(p, "path").ok_or_else(|| bad("anim.savePreset", "missing `path`"))?.to_string();
+    s.refuse_export(&path)?;
     let comp = s.active_comp().ok_or(EngineError::NoComp)?;
     let t = s.time();
-    let effects: Vec<(LayerId, PropGroup)> = selected_effects(s);
+    let mut effects: Vec<(LayerId, PropGroup)> = selected_effects(s);
     let effect_uids: Vec<Uid> = effects.iter().map(|(_, g)| g.uid).collect();
     let mut props = vec![];
     for (lid, uid) in selected_leaf_props(s) {
@@ -67,7 +86,11 @@ fn save_preset(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad("anim.savePreset", "select properties or effects to save"));
     }
     // Key times are stored relative to the earliest key so the preset applies at the CTI.
-    let first = props.iter().flat_map(|(_, _, pr)| pr.keys.iter().map(|k| k.time)).min().unwrap_or(Tick::ZERO);
+    let first =
+        props.iter().flat_map(|(_, _, pr)| pr.keys.iter().map(|k| k.time)).chain(earliest_key(effects.iter().map(|(_, g)| g))).min().unwrap_or(Tick::ZERO);
+    for (_, g) in &mut effects {
+        retime_effect(g, 1.0, "anim.savePreset", |t| Ok(Tick(t.0.checked_sub(first.0).ok_or_else(|| effect_time_error("anim.savePreset"))?)))?;
+    }
     let props_json: Vec<Value> = props
         .iter()
         .map(|(_, mp, pr)| {
@@ -82,12 +105,27 @@ fn save_preset(s: &mut Session, p: &Value) -> Result<Value> {
     let name = str_p(p, "name")
         .map(str::to_string)
         .unwrap_or_else(|| std::path::Path::new(&path).file_stem().map(|s| s.to_string_lossy().to_string()).unwrap_or_default());
-    let doc = json!({PRESET_TAG: 1, "name": name, "properties": props_json, "effects": fx_json});
+    let doc = json!({PRESET_TAG: PRESET_VERSION, "name": name, "properties": props_json, "effects": fx_json});
     let text = serde_json::to_string_pretty(&doc).unwrap_or_default();
-    s.services.write_file(&path, text.as_bytes()).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(&path, text.as_bytes())?;
     Ok(json!({"path": path, "properties": props.len(), "effects": effects.len()}))
 }
 
+/// Rewrite an effect property path in a preset (`effects/<effect id>[#n]/<param>`) to the current
+/// parameter id when it names a parameter that the effect has since renamed or moved into a
+/// twirl-down group. Any other path comes back unchanged.
+fn upgrade_effect_path(path: &str) -> String {
+    let Some((seg, tail)) = path.strip_prefix("effects/").and_then(|r| r.split_once('/')) else { return path.to_string() };
+    let effect = match seg.rsplit_once('#') {
+        Some((m, n)) if !m.is_empty() && n.parse::<usize>().is_ok() => m,
+        _ => seg,
+    };
+    match effectcraft_effects::find(effect).and_then(|spec| effectcraft_effects::migrate::current_param_id(spec, tail)) {
+        Some(id) if id != tail => format!("effects/{seg}/{id}"),
+        _ => path.to_string(),
+    }
+}
+
 fn apply_preset(s: &mut Session, p: &Value) -> Result<Value> {
     let doc: Value = match (p.get("preset"), str_p(p, "path")) {
         (Some(v), _) => v.clone(),
@@ -110,14 +148,22 @@ fn apply_preset(s: &mut Session, p: &Value) -> Result<Value> {
         s.save_prefs();
         s.prefs_revision += 1;
     }
-    let effects: Vec<PropGroup> =
+    let mut effects: Vec<PropGroup> =
         doc["effects"].as_array().map(|a| a.iter().filter_map(|v| serde_json::from_value(v.clone()).ok()).collect()).unwrap_or_default();
+    // Older presets stored effect keys at the source layer's times.
+    if doc[PRESET_TAG].as_u64().unwrap_or(1) < RELATIVE_EFFECT_KEYS
+        && let Some(first) = earliest_key(&effects)
+    {
+        for g in &mut effects {
+            retime_effect(g, 1.0, "anim.applyPreset", |t| Ok(Tick(t.0.checked_sub(first.0).ok_or_else(|| effect_time_error("anim.applyPreset"))?)))?;
+        }
+    }
     let props: Vec<(String, Property)> = doc["properties"]
         .as_array()
         .map(|a| {
             a.iter()
                 .filter_map(|v| {
-                    let path = v["path"].as_str()?.to_string();
+                    let path = upgrade_effect_path(v["path"].as_str()?);
                     let value: KV = serde_json::from_value(v["value"].clone()).ok()?;
                     let keys: Vec<Keyframe> = serde_json::from_value(v["keys"].clone()).unwrap_or_default();
                     let expr = serde_json::from_value(v["expression"].clone()).ok().flatten();
@@ -130,16 +176,30 @@ fn apply_preset(s: &mut Session, p: &Value) -> Result<Value> {
         })
         .unwrap_or_default();
     let t = s.time();
+    // Effect bounds per layer size the point defaults of parameters added since the preset was saved.
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let sizes: BTreeMap<LayerId, [f64; 2]> =
+        ids.iter().filter_map(|lid| comp.layer(*lid).map(|l| (*lid, effectcraft_render::effect_bounds(&s.project, comp, l).0))).collect();
     let mut applied = 0;
     let mut skipped = vec![];
     s.edit("Apply Animation Preset", None, |proj, _| {
         let mut next = proj.next_id;
         for lid in &ids {
+            let size = sizes.get(lid).copied().unwrap_or([100.0, 100.0]);
             let l = layer_mut(proj, cid, *lid)?;
             let lt = l.layer_time(t);
             if let Some(fx) = l.props.sub_mut("effects") {
                 for g in &effects {
                     let mut g = g.clone();
+                    // Effects saved by an earlier version get the upgrade a project gets on open.
+                    let spec = match &g.kind {
+                        GroupKind::Effect { effect } => effectcraft_effects::find(effect),
+                        _ => None,
+                    };
+                    if let Some(spec) = spec {
+                        effectcraft_effects::migrate::upgrade_instance(spec, &mut g, &mut Ids(&mut next), size);
+                    }
+                    retime_effect(&mut g, 1.0, "anim.applyPreset", |t| Ok(Tick(t.0.checked_add(lt.0).ok_or_else(|| effect_time_error("anim.applyPreset"))?)))?;
                     g.reassign_uids(&mut next);
                     next += 1;
                     fx.children.push(Node::Group(g));
@@ -184,7 +244,7 @@ fn add_keyframe(s: &mut Session, _: &Value) -> Result<Value> {
     }
     let cid = s.active_comp_id().ok_or(EngineError::NoComp)?;
     let t = s.time();
-    let n = s.edit("Add Keyframe", None, |proj, _| {
+    let n = s.edit("Add Keyframe", None, |proj, state| {
         let mut n = 0;
         for (lid, uid) in &targets {
             let l = layer_mut(proj, cid, *lid)?;
@@ -200,6 +260,9 @@ fn add_keyframe(s: &mut Session, _: &Value) -> Result<Value> {
                 pr.set_value_at(lt, v);
             }
             n += 1;
+            if pr.match_id == "type" {
+                super::prop::sync_polystar_property(proj, state, cid, *lid, *uid, t)?;
+            }
         }
         Ok(n)
     })?;
@@ -209,7 +272,8 @@ fn add_keyframe(s: &mut Session, _: &Value) -> Result<Value> {
 /// Selected keys grouped by (layer, property).
 fn keys_by_prop(s: &Session) -> BTreeMap<(LayerId, Uid), Vec<Tick>> {
     let mut m: BTreeMap<(LayerId, Uid), Vec<Tick>> = BTreeMap::new();
-    for k in &s.state.selected_keys {
+    let Some(comp) = s.active_comp() else { return m };
+    for k in super::prop::editable_keys(comp, &s.state.selected_keys) {
         m.entry((k.layer, k.prop)).or_default().push(k.time);
     }
     m
@@ -491,7 +555,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_keys,
             exponential_scale
         ),
-        cmd!("text.addSelector", "Add Text Selector", [], None, "{layer?, animator?: uid|index, kind: range|wiggly|expression}", has_text_layer, add_selector),
+        cmd!(
+            "text.addSelector",
+            "Add Text Selector",
+            [],
+            None,
+            "{layer?, animator?: uid|index (1-based; a uid match wins over an index), kind: range|wiggly|expression}",
+            has_text_layer,
+            add_selector
+        ),
         cmd!("text.removeAllAnimators", "Remove All Text Animators", ["Animation"], None, "{layers?}", has_text_layer, remove_all_animators),
         cmd!("anim.reveal", "Reveal Properties", [], None, "{kind: keyframes|animation|modified}", has_comp, reveal),
     ]
diff --git a/crates/engine/src/commands/app_more.rs b/crates/engine/src/cmd/app_more.rs
similarity index 89%
rename from crates/engine/src/commands/app_more.rs
rename to crates/engine/src/cmd/app_more.rs
index 1bb94952f..ea4230852 100644
--- a/crates/engine/src/commands/app_more.rs
+++ b/crates/engine/src/cmd/app_more.rs
@@ -13,14 +13,23 @@ use super::{CommandSpec, always, b_p, bad, comp_id, has_comp, has_layers, has_pr
 use crate::{EngineError, Event, Result, Session, cmd, query};
 
 /// Run `f` (which may run several undoable commands) as one undo step named `label`; on error
-/// the project is restored.
+/// the project, editor state and undo history are restored.
+///
+/// Front-end events emitted by a failed `f` are discarded with the state. Pending-analysis
+/// queues and the journal are not part of this rollback and keep their existing behaviour.
 pub(crate) fn grouped<T>(s: &mut Session, label: &str, f: impl FnOnce(&mut Session) -> Result<T>) -> Result<T> {
     // The steps `f` records go to an empty stack (so the undo limit can't drop the snapshot
-    // taken before them), then become one step on the real one.
+    // taken before them), then become one step on the real one. Keep the complete pre-`f`
+    // history and editor state for a failure: rollback must not leave a partially retargeted
+    // editor or a `f`-recorded redo/branch behind.
+    let saved_history = s.history.clone();
     let saved = std::mem::take(&mut s.history.undo);
     let before = s.project.clone();
+    let before_state = s.state.clone();
+    let event_mark = s.events.len();
     let r = f(s);
     let changed = !s.history.undo.is_empty();
+    let interim_revision = s.ime_revision;
     s.history.undo = saved;
     s.history.merge_key = None;
     match r {
@@ -36,9 +45,22 @@ pub(crate) fn grouped<T>(s: &mut Session, label: &str, f: impl FnOnce(&mut Sessi
             Ok(v)
         }
         Err(e) => {
+            // Snapshot the failing editor before restoring the pre-`f` state: an intermediate
+            // text.edit / text change / comp switch must invalidate the pre-`f` editor token
+            // instead of reviving it.
+            let edited = super::text_edit::active_editor_snapshot(s);
+            s.project = before;
+            s.state = before_state;
+            s.history = saved_history;
+            s.history.merge_key = None;
+            // A failed intermediate comp switch must not reach the front end through an
+            // `OpenComp` event while its state has been rolled back.
+            s.events.truncate(event_mark);
+            s.sanitize_after_replacement(edited.as_ref());
+            // As in the batch rollback, the IME revision is a high-water mark: leave the highest
+            // intermediate stamp rather than rewinding to before `f`.
+            s.ime_revision = s.ime_revision.max(interim_revision);
             if changed {
-                s.project = before;
-                s.sanitize_state();
                 s.bump();
             }
             Err(e)
@@ -130,8 +152,9 @@ fn clear_recent_presets(s: &mut Session, _: &Value) -> Result<Value> {
 
 fn save_copy_xml(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_p(p, "path").ok_or_else(|| bad("file.saveCopyAsXml", "missing `path` (.ecprojx)"))?;
-    let xml = crate::xml_project::to_xml(&s.project.to_file_json_with_view(&s.saved_view())?).map_err(EngineError::Other)?;
-    s.services.write_file(path, xml.as_bytes()).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.refuse_export(path)?;
+    let xml = crate::xml_project::to_xml(&s.project.to_file_json_with_view(&s.saved_view(), false)?).map_err(EngineError::Other)?;
+    s.write_output(path, xml.as_bytes())?;
     s.toast(format!("Saved an XML copy to {path}"));
     Ok(json!({"path": path, "bytes": xml.len()}))
 }
@@ -218,7 +241,7 @@ fn replace_with_precomp(s: &mut Session, p: &Value) -> Result<Value> {
             let ids: Vec<ItemId> = proj.items.keys().copied().filter(|c| *c != comp).collect();
             for cid in ids {
                 if let Some(c) = proj.comp_mut(cid) {
-                    for l in c.layers.iter_mut().filter(|l| is_user(l)) {
+                    for l in c.layers.iter_mut_where(|l| is_user(l)) {
                         l.source = LayerSource::Comp { item: comp };
                         n += 1;
                     }
@@ -332,7 +355,7 @@ fn assign_view_shortcut(s: &mut Session, p: &Value) -> Result<Value> {
     reassign(s, view_command(cur), &slot, "view.assign3dShortcut")
 }
 
-/// Window ▸ Assign Shortcut to "<workspace>" Workspace: Shift+F10, Shift+F11 or Shift+F12.
+/// Window ▸ Assign Shortcut to `"<workspace>"` Workspace: Shift+F10, Shift+F11 or Shift+F12.
 /// The frontend fills in the current workspace.
 fn assign_workspace_shortcut(s: &mut Session, p: &Value) -> Result<Value> {
     let slot = slot_p(p, "window.assignWorkspaceShortcut", true)?;
@@ -646,6 +669,9 @@ fn extract_cubemap(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(r)
 }
 
+/// The specs for the commands in this module: history steps, recent footage and presets, Save
+/// a Copy As XML, footage replacement and Execute File, 3D-view and workspace shortcuts,
+/// logging and the system report, VR environment/cubemap creation and System Information.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!("edit.history", "History", [], None, "{steps?: n (undo n steps), redo?: n}", has_history, history),
@@ -704,6 +730,36 @@ pub fn specs() -> Vec<CommandSpec> {
 mod tests {
     use serde_json::json;
 
+    #[test]
+    fn grouped_rollback_restores_the_editor_state_and_history_after_a_transient_text_change() {
+        let mut s = crate::Session::default();
+        s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 1})).unwrap();
+        let lid = s.execute("layer.newText", json!({"text": "abcdef"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("text.edit", json!({"layer": lid, "caret": 3})).unwrap();
+        let original_comp = s.active_comp_id().unwrap();
+        let owner = s.state.text_edit.as_ref().unwrap().session;
+        let other =
+            s.execute("comp.new", json!({"name": "Other", "width": 160, "height": 90, "duration": 1, "open": false})).unwrap()["comp"].as_u64().unwrap();
+        let undo = s.history.undo.len();
+        s.drain_events();
+
+        let r = super::grouped(&mut s, "Rollback", |s| -> crate::Result<()> {
+            // An intermediate document edit and state switch, both undone by the error path.
+            s.execute("layer.setText", json!({"layer": lid, "text": "ab"}))?;
+            s.execute("comp.open", json!({"comp": other}))?;
+            Err(crate::EngineError::Other("stop".into()))
+        });
+        assert!(r.is_err());
+        assert_eq!(s.active_comp_id(), Some(original_comp), "the pre-group comp is restored");
+        assert_eq!(super::super::text_edit::layer_doc(&s, effectcraft_project::LayerId(lid)).unwrap().text, "abcdef", "the document is restored");
+        assert_eq!(s.history.undo.len(), undo, "the partial grouped steps are not left in history");
+        assert_ne!(s.state.text_edit.as_ref().unwrap().session, owner, "a transient replacement does not revive the old IME token");
+        assert!(
+            !s.drain_events().iter().any(|e| matches!(e, crate::Event::OpenComp(_))),
+            "the failed intermediate comp switch is not published to the front end"
+        );
+    }
+
     /// `File.execute()` opens the file as a well-formed `file://` URL (spaces, `#`, `%`).
     #[test]
     fn execute_file_opens_an_encoded_file_url() {
diff --git a/crates/engine/src/commands/autotrace.rs b/crates/engine/src/cmd/autotrace.rs
similarity index 86%
rename from crates/engine/src/commands/autotrace.rs
rename to crates/engine/src/cmd/autotrace.rs
index 7f33fcdf7..8dabfd013 100644
--- a/crates/engine/src/commands/autotrace.rs
+++ b/crates/engine/src/cmd/autotrace.rs
@@ -64,8 +64,9 @@ fn trace_frame(img: &Image, offset: [f64; 2], ch: Channel, invert: bool, blur: f
     let mut out = trace(&field, img.width as usize, img.height as usize, o);
     for t in &mut out {
         for v in &mut t.path.vertices {
-            v[0] += offset[0];
-            v[1] += offset[1];
+            // Source buffers are layer pixels + offset: subtract it to get back to layer space.
+            v[0] -= offset[0];
+            v[1] -= offset[1];
         }
     }
     out
@@ -211,3 +212,33 @@ pub fn specs() -> Vec<CommandSpec> {
         run
     )]
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn trace_frame_converts_image_pixels_back_to_layer_space() {
+        // A synthetic cropped source avoids any dependency on installed fonts.
+        let mut img = Image::new(32, 32);
+        for y in 8..24 {
+            for x in 8..24 {
+                img.set(x, y, [1.0; 4]);
+            }
+        }
+        let opts = TraceOpts { corner_roundness: 0.0, ..Default::default() };
+        for offset in [[0.0, 0.0], [2.0, 58.0], [-12.5, 7.25]] {
+            let outlines = trace_frame(&img, offset, Channel::Alpha, false, 0.0, &opts);
+            assert_eq!(outlines.len(), 1);
+            let vertices = &outlines[0].path.vertices;
+            for axis in 0..2 {
+                // image = layer + offset, so the known image bounds map back
+                // to [8 - offset, 24 - offset] in layer space.
+                let lo = vertices.iter().map(|v| v[axis]).fold(f64::INFINITY, f64::min);
+                let hi = vertices.iter().map(|v| v[axis]).fold(f64::NEG_INFINITY, f64::max);
+                assert!((lo - (8.0 - offset[axis])).abs() < 0.01, "{offset:?}: {lo}");
+                assert!((hi - (24.0 - offset[axis])).abs() < 0.01, "{offset:?}: {hi}");
+            }
+        }
+    }
+}
diff --git a/crates/engine/src/commands/batch.rs b/crates/engine/src/cmd/batch.rs
similarity index 67%
rename from crates/engine/src/commands/batch.rs
rename to crates/engine/src/cmd/batch.rs
index 4bfd2b2b1..5931fe09d 100644
--- a/crates/engine/src/commands/batch.rs
+++ b/crates/engine/src/cmd/batch.rs
@@ -9,8 +9,9 @@ use serde_json::{Value, json};
 use super::{CommandSpec, always, bad, str_p};
 use crate::{EngineError, Result, Session};
 
-/// Commands that can't run inside a batch (they replace the project or nest batches).
-const NOT_IN_BATCH: &[&str] = &["engine.batch", "file.runScript", "script.run"];
+/// Commands that can't run inside a batch (they nest batches), besides the commands that run
+/// scripts ([`super::scripts::RUNS_SCRIPTS`]).
+const NOT_IN_BATCH: &[&str] = &["engine.batch"];
 
 /// Resolve a `$N` / `$N.key.0.key` reference against the results so far.
 fn reference(s: &str, results: &[Value]) -> Option<Result<Value>> {
@@ -51,11 +52,25 @@ fn substitute(v: &Value, results: &[Value]) -> Result<Value> {
     })
 }
 
+/// `engine.batch`: runs `steps` (`[{command|id, params?}]`) as engine commands, substituting
+/// `$N` / `$N.key.0` strings in each step's params with earlier results, and returns
+/// `{steps, results}`.
+///
+/// `engine.batch`, `file.runScript` and `script.run` are refused inside a batch. Successful
+/// steps are folded into one undo step named `label` (default "Batch"). With the default
+/// `atomic: true`, a failing step restores the project, history and editor state, drops the
+/// events the batch published, sanitizes the editor against the failing intermediate state (so
+/// no pre-batch IME token is revived) and keeps the higher process IME revision; with
+/// `atomic: false` the steps before the failure stay applied. Either way the error names the
+/// failing step and command.
 fn batch(s: &mut Session, p: &Value) -> Result<Value> {
     let steps = p.get("steps").and_then(Value::as_array).ok_or_else(|| bad("engine.batch", "missing `steps`: [{command, params?}, …]"))?.clone();
     let label = str_p(p, "label").unwrap_or("Batch").to_string();
     let atomic = p.get("atomic").and_then(Value::as_bool).unwrap_or(true);
     let (project, history, state) = (s.project.clone(), s.history.clone(), s.state.clone());
+    // Rolled-back steps may have queued events (an `OpenComp`, a Toast) for the state that is
+    // about to be dropped: the UI must not act on them.
+    let event_mark = s.events.len();
     let mut results: Vec<Value> = Vec::with_capacity(steps.len());
     for (i, step) in steps.iter().enumerate() {
         let run = |s: &mut Session, results: &[Value]| -> Result<Value> {
@@ -64,7 +79,7 @@ fn batch(s: &mut Session, p: &Value) -> Result<Value> {
                 .or_else(|| step.get("id"))
                 .and_then(Value::as_str)
                 .ok_or_else(|| bad("engine.batch", "each step needs `command` (a command id)"))?;
-            if NOT_IN_BATCH.contains(&id) {
+            if NOT_IN_BATCH.contains(&id) || super::scripts::RUNS_SCRIPTS.contains(&id) {
                 return Err(bad("engine.batch", format!("`{id}` can't run inside a batch")));
             }
             let params = substitute(step.get("params").unwrap_or(&json!({})), results)?;
@@ -75,10 +90,21 @@ fn batch(s: &mut Session, p: &Value) -> Result<Value> {
             Err(e) => {
                 let id = step.get("command").or_else(|| step.get("id")).and_then(Value::as_str).unwrap_or("?");
                 let note = if atomic {
+                    // The snapshot is the intermediate state the failing step left: comparing it
+                    // with the restored editor detects a restart or cross-comp switch inside the
+                    // batch, so the pre-batch token is never revived. Do not restore
+                    // `ime_revision`: a transient text edit inside the batch already advanced
+                    // this process-monotonic high-water mark, and rewinding it would reuse a
+                    // stamp (letting a wide-selection composition look current). An unrelated
+                    // failed batch did not advance it, so its value stays exactly as it was.
+                    let edited = crate::commands::text_edit::active_editor_snapshot(s);
+                    let interim_revision = s.ime_revision;
                     s.project = project;
                     s.history = history;
                     s.state = state;
-                    s.sanitize_state();
+                    s.events.truncate(event_mark);
+                    s.sanitize_after_replacement(edited.as_ref());
+                    s.ime_revision = s.ime_revision.max(interim_revision);
                     s.bump();
                     "; the batch was rolled back (nothing changed)".to_string()
                 } else {
@@ -124,6 +150,32 @@ mod tests {
 
     use crate::Session;
 
+    /// Failed atomic steps discard their UI events while preserving events queued beforehand.
+    #[test]
+    fn atomic_batch_event_rollback_preserves_prior_events() {
+        for atomic in [true, false] {
+            let mut s = Session::default();
+            s.execute("comp.new", json!({"name": "First", "width": 100, "height": 100})).unwrap();
+            let first = s.active_comp_id().unwrap();
+            s.execute("comp.new", json!({"name": "Second", "width": 100, "height": 100})).unwrap();
+            let second = s.active_comp_id().unwrap();
+            s.drain_events();
+            s.execute("comp.open", json!({"comp": first.0})).unwrap();
+            let result = s.execute_checked(
+                "engine.batch",
+                json!({"atomic": atomic, "steps": [
+                    {"command": "comp.open", "params": {"comp": second.0}},
+                    {"command": "no.suchCommand", "params": {}}
+                ]}),
+            );
+            assert!(result.is_err());
+            assert_eq!(s.active_comp_id(), Some(if atomic { first } else { second }));
+            let opened: Vec<_> =
+                s.drain_events().into_iter().filter_map(|event| if let crate::Event::OpenComp(id) = event { Some(id) } else { None }).collect();
+            assert_eq!(opened, if atomic { vec![first] } else { vec![first, second] });
+        }
+    }
+
     #[test]
     fn batch_refs_one_undo_step_and_rollback() {
         let mut s = Session::default();
diff --git a/crates/engine/src/cmd/blender.rs b/crates/engine/src/cmd/blender.rs
new file mode 100644
index 000000000..e6c678101
--- /dev/null
+++ b/crates/engine/src/cmd/blender.rs
@@ -0,0 +1,295 @@
+//! Camera-solve interchange through Blender's public Python API. The generated script is
+//! original MIT OR Apache-2.0 code; no Blender implementation is read or embedded.
+
+use std::path::Path;
+
+use effectcraft_effects::camera_tracker as ct;
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, Layer, LayerId, LayerSource, Uid};
+use effectcraft_render::EvalCtx;
+use effectcraft_time::Tick;
+use effectcraft_track::camtrack::{CameraSolve, linalg};
+use serde_json::{Value, json};
+
+mod validate;
+
+use super::{b_p, bad, f_p, str_p};
+use crate::{EngineError, Result, Session};
+
+const CMD: &str = "camera.exportBlender";
+const MAX_FRAMES: usize = 100_000;
+const MAX_POINTS: usize = 100_000;
+const MAX_JSON: usize = 64 * 1024 * 1024;
+const MAX_FRAME: i64 = 1_048_574;
+
+fn number(p: &Value, key: &str, default: f64, min: f64, max: f64) -> Result<f64> {
+    let v = match p.get(key) {
+        None => default,
+        Some(_) => f_p(p, key).ok_or_else(|| bad(CMD, format!("{key}: expected a number")))?,
+    };
+    if !v.is_finite() || !(min..=max).contains(&v) {
+        return Err(bad(CMD, format!("{key}: expected {min}..{max}")));
+    }
+    Ok(v)
+}
+
+fn finite(values: impl IntoIterator<Item = f64>) -> Result<()> {
+    if values.into_iter().any(|v| !v.is_finite() || v.abs() > 1e12) {
+        return Err(bad(CMD, "invalid or excessive numeric camera/scene data; re-analyze the tracker"));
+    }
+    Ok(())
+}
+
+/// Right-handed EffectCraft world (right, down, forward) → Blender (right, forward, up).
+fn position(p: [f64; 3], scale: f64) -> [f64; 3] {
+    [p[0] * scale, p[2] * scale, -p[1] * scale]
+}
+
+fn media_path(s: &Session, path: &str) -> Result<String> {
+    if path.is_empty() || path.contains('\0') {
+        return Err(bad(CMD, "the source footage has no valid file path; relink it before exporting"));
+    }
+    let path = Path::new(path);
+    if path.is_absolute() || cfg!(target_arch = "wasm32") {
+        return Ok(path.to_string_lossy().into_owned());
+    }
+    let cwd = std::env::current_dir().map_err(|e| bad(CMD, format!("cannot resolve footage path: {e}")))?;
+    let base = s.path.as_deref().and_then(|p| Path::new(p).parent()).map(|p| cwd.join(p)).unwrap_or(cwd);
+    Ok(base.join(path).to_string_lossy().into_owned())
+}
+
+pub(super) fn export(s: &mut Session, p: &Value, cid: ItemId, lid: LayerId, uid: Uid) -> Result<Value> {
+    if s.running_for_script() && !s.prefs.scripting.allow_scripts_write_files {
+        return Err(bad(CMD, "scripts can't export files unless Settings ▸ Scripting & Expressions ▸ Allow Scripts to Write Files and Access Network is on"));
+    }
+    let options = Options::parse(p)?;
+    let Options { path, sensor, units, start, include_points } = options;
+    if s.camera_target().is_some_and(|(c, l, u)| (c, l, u) == (cid, lid, uid)) && s.is_camera_analyzing() || s.camera_pending.contains(&(cid, lid, uid)) {
+        return Err(bad(CMD, "wait for this tracker's analysis to finish before exporting"));
+    }
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let layer = comp.layer(lid).ok_or_else(|| bad(CMD, "tracked layer missing"))?;
+    let g = layer.props.find_group(uid).ok_or_else(|| bad(CMD, "tracker missing"))?;
+    for name in [ct::SOLVE, ct::TRACKS] {
+        if g.prop(name).is_some_and(|p| matches!(&p.value, effectcraft_keyframe::Value::Str(v) if v.len() > MAX_JSON)) {
+            return Err(bad(CMD, "tracking data exceeds the 64 MiB export limit"));
+        }
+    }
+    let params = crate::camera_track::static_params(g);
+    let solve = ct::solve(&params).ok_or_else(|| bad(CMD, "the camera is not solved yet; analyze the tracker first"))?;
+    let (lo, end) = validate::timing(comp, layer, &solve, start)?;
+    let Source { footage, path: source_path, fps: source_fps, count: source_count } = source(s, layer, &solve, path)?;
+    validate::geometry(&solve, sensor)?;
+    let camera = params
+        .get(ct::CAMERA)
+        .map(|v| v.as_f64())
+        .filter(|v| v.is_finite() && *v > 0.0 && *v <= u64::MAX as f64)
+        .and_then(|id| comp.layer(LayerId(id as u64)))
+        .filter(|l| l.is_camera());
+    let warnings = scene_warnings(camera, &solve, footage);
+    let ctx = EvalCtx { expr: s.expr.as_deref(), ..EvalCtx::new(&s.project, cid, comp, lo) };
+    let (frames, world) = bake_frames(&ctx, layer, &solve, camera, &options, footage, source_count)?;
+    let mut points = Vec::new();
+    for point in &solve.points {
+        finite(point.pos.into_iter().chain([point.error as f64]))?;
+        if point.first > point.last || point.last as usize >= solve.frames.len() {
+            return Err(bad(CMD, "invalid solved point frame range; re-analyze the tracker"));
+        }
+        let location = position(world.apply(point.pos), units);
+        finite(location)?;
+        if include_points {
+            points.push(json!({"id": point.id, "location": location, "error": point.error,
+                "first": start.saturating_add(point.first as i64), "last": start.saturating_add(point.last as i64)}));
+        }
+    }
+    let tracks = ct::tracks(&params);
+    if tracks.as_ref().is_some_and(|t| t.tracks.len() > MAX_POINTS || t.tracks.iter().any(|t| t.pts.len() > MAX_FRAMES)) {
+        return Err(bad(CMD, "2D tracks exceed export limits"));
+    }
+    let markers: Vec<Value> = comp
+        .markers
+        .iter()
+        .filter_map(|m| {
+            let frame = start.saturating_add(comp.frame_rate.frame_at(m.time).saturating_sub(comp.frame_rate.frame_at(lo)));
+            if (start..=end).contains(&frame) { Some(json!({"name": m.comment, "frame": frame})) } else { None }
+        })
+        .collect();
+    let payload = json!({"version": 1, "name": format!("{} — {}", s.project.item(cid).map(|i| i.name.as_str()).unwrap_or("Shot"), layer.name),
+        "resolution": solve.size, "fpsNumerator": comp.frame_rate.num, "fpsDenominator": comp.frame_rate.den,
+        "startFrame": start, "endFrame": end, "sensorWidth": sensor, "unitScale": units,
+        "media": {"path": source_path, "kind": if footage.kind == FootageKind::Still {"FILE"} else {"MOVIE"},
+            "fps": source_fps, "nativeRate": footage.native_rate, "pixelAspect": footage.pixel_aspect, "timecode": footage.start_timecode,
+            "frameCount": source_count, "loopCount": footage.loop_count},
+        "frames": frames, "points": points, "markers": markers, "ground": solve.ground.is_some(),
+        "groundSize": world.s * units, "shutter": comp.shutter_angle / 360.0, "shutterPhase": comp.shutter_phase,
+        "solve": solve, "tracks": if include_points { tracks.as_deref() } else { None },
+        "warnings": warnings});
+    let data = serde_json::to_string(&payload).map_err(|e| bad(CMD, format!("cannot serialize scene: {e}")))?;
+    if data.len() > MAX_JSON {
+        return Err(bad(CMD, "scene exceeds the 64 MiB script limit; disable includePoints or split the shot"));
+    }
+    let quoted = serde_json::to_string(&data).map_err(|e| bad(CMD, format!("cannot encode scene: {e}")))?;
+    let script = include_str!("blender_scene.py").replace("__EFFECTCRAFT_DATA__", &quoted);
+    s.services.write_file(path, script.as_bytes()).map_err(|e| bad(CMD, format!("cannot write {path}: {e}")))?;
+    Ok(json!({"path": path, "bytes": script.len(), "frames": frames.len(), "points": points.len(), "warnings": warnings}))
+}
+
+struct Options<'a> {
+    path: &'a str,
+    sensor: f64,
+    units: f64,
+    start: i64,
+    include_points: bool,
+}
+
+impl<'a> Options<'a> {
+    fn parse(p: &'a Value) -> Result<Self> {
+        let path = str_p(p, "path").filter(|p| !p.is_empty() && !p.contains('\0')).ok_or_else(|| bad(CMD, "missing `path` (.py)"))?;
+        if !Path::new(path).extension().is_some_and(|e| e.eq_ignore_ascii_case("py")) {
+            return Err(bad(CMD, "the export path must end in .py"));
+        }
+        let sensor = number(p, "sensorWidth", 36.0, 1.0, 1000.0)?;
+        let units = number(p, "unitScale", 0.01, 0.000_001, 1000.0)?;
+        let start = match p.get("startFrame") {
+            None => 1,
+            Some(v) => v.as_i64().filter(|n| (1..=MAX_FRAME).contains(n)).ok_or_else(|| bad(CMD, "startFrame: expected a positive Blender frame number"))?,
+        };
+        let include_points = match p.get("includePoints") {
+            Some(v) if !v.is_boolean() => return Err(bad(CMD, "includePoints: expected a boolean")),
+            _ => b_p(p, "includePoints").unwrap_or(true),
+        };
+        Ok(Self { path, sensor, units, start, include_points })
+    }
+}
+
+struct Source<'a> {
+    footage: &'a Footage,
+    path: String,
+    fps: f64,
+    count: i64,
+}
+
+fn source<'a>(s: &'a Session, layer: &Layer, solve: &CameraSolve, path: &str) -> Result<Source<'a>> {
+    let footage = match layer.source {
+        LayerSource::Footage { item } => s.project.item(item).and_then(|i| match &i.kind {
+            ItemKind::Footage(f) => Some(f),
+            _ => None,
+        }),
+        _ => None,
+    }
+    .filter(|f| f.has_video && matches!(f.kind, FootageKind::Video | FootageKind::Still));
+    let footage = footage
+        .ok_or_else(|| bad(CMD, "Blender background export needs a video or still-footage layer; render precomps/sequences to a video and track that video"))?;
+    let source_path = media_path(s, &footage.path)?;
+    if Path::new(path) == Path::new(&source_path) {
+        return Err(bad(CMD, "the export path must differ from the source footage"));
+    }
+    if footage.width as f64 != solve.size[0] || footage.height as f64 != solve.size[1] {
+        return Err(bad(CMD, "the analysis image differs from the original footage dimensions; render the tracker's input to a video and track that video"));
+    }
+    let source_fps = footage.frame_rate.as_f64();
+    if footage.frame_rate.num <= 0 || footage.frame_rate.den <= 0 || !source_fps.is_finite() || source_fps <= 0.0 {
+        return Err(bad(CMD, "invalid source footage frame rate"));
+    }
+    // Same frame selection as the media pool: interpreted FPS, rounded per-loop frame count,
+    // clamp to the total loop range, then wrap. Native FPS does not change the frame index.
+    let divisor = (effectcraft_time::TICKS_PER_SECOND as i128).saturating_mul(footage.frame_rate.den as i128);
+    let source_count = (footage.duration.0 as i128).saturating_mul(footage.frame_rate.num as i128).saturating_add(divisor / 2) / divisor;
+    let source_count = if footage.kind == FootageKind::Still { 1 } else { source_count };
+    if !(1..=MAX_FRAME as i128).contains(&source_count) {
+        return Err(bad(CMD, "invalid footage duration or footage exceeds Blender's frame range; trim/render the source video first"));
+    }
+    let source_count = source_count as i64;
+    Ok(Source { footage, path: source_path, fps: source_fps, count: source_count })
+}
+
+fn scene_warnings(camera: Option<&Layer>, solve: &CameraSolve, footage: &Footage) -> Vec<String> {
+    let mut warnings = vec![
+        "Sensor width is assumed (36 mm by default); monocular tracking cannot recover physical sensor size or absolute scene scale.".to_string(),
+        "The original footage is referenced, not embedded or rendered: masks and effects before the tracker are not baked. Relink the video if moving this script.".to_string(),
+    ];
+    if camera.is_none() {
+        warnings
+            .push("No linked tracker camera: focus uses the default scene depth, DOF is off; optical focus cannot be recovered from feature tracks.".into());
+    } else {
+        warnings.push("Focus/iris settings are sampled from the linked camera; pose and lens come from the tracker solve. Blender's physical DOF is an approximation of EffectCraft's blur model.".into());
+    }
+    if solve.distortion.is_some_and(|d| !d.is_none()) {
+        warnings.push("Radial distortion is preserved as metadata (Brown k1/k2, half-diagonal normalization), not applied to Blender's pinhole camera. Use an undistorted plate for exact alignment.".into());
+    }
+    if (footage.pixel_aspect - 1.0).abs() > 1e-6 {
+        warnings.push("The tracker solves square pixels: export uses square pixels; original footage pixel aspect is retained in metadata.".into());
+    }
+    warnings
+}
+
+/// Bake the solved camera and the linked camera's optical settings at exact composition ticks.
+fn bake_frames(
+    ctx0: &EvalCtx<'_>,
+    layer: &Layer,
+    solve: &CameraSolve,
+    camera: Option<&Layer>,
+    options: &Options<'_>,
+    footage: &Footage,
+    source_count: i64,
+) -> Result<(Vec<Value>, linalg::Similarity)> {
+    let comp = ctx0.comp;
+    let lo = ctx0.time;
+    let fd = comp.frame_duration();
+    let sensor = options.sensor;
+    let units = options.units;
+    let start = options.start;
+    let first = solve.frames.first().ok_or_else(|| bad(CMD, "the camera solve is empty"))?;
+    let m = ctx0.world_matrix(layer).0;
+    let layer_scale = m[0][0].hypot(m[1][0]);
+    finite([layer_scale])?;
+    if layer_scale <= 1e-9 {
+        return Err(bad(CMD, "the tracked layer has zero scale"));
+    }
+    let world = solve.world([comp.width as f64, comp.height as f64], first.focal * layer_scale);
+    finite([world.s * units])?;
+    let mut frames = Vec::with_capacity(solve.frames.len());
+    for (i, frame) in solve.frames.iter().enumerate() {
+        let time = Tick(lo.0.saturating_add(fd.0.saturating_mul(i as i64)));
+        let ctx = ctx0.at(time);
+        let pose = linalg::mm(&world.r, &linalg::mt(&frame.r()));
+        let right = position(linalg::mv(&pose, [1.0, 0.0, 0.0]), 1.0);
+        let up = position(linalg::mv(&pose, [0.0, -1.0, 0.0]), 1.0);
+        let back = position(linalg::mv(&pose, [0.0, 0.0, -1.0]), 1.0);
+        let location = position(world.apply(frame.center), units);
+        let lens = frame.focal * sensor / solve.size[0];
+        let opts = camera.and_then(|l| l.props.sub("cameraOptions").map(|g| (l, g)));
+        let value = |key: &str, fallback: f64| opts.map(|(l, g)| ctx.f(l, g, key, fallback)).unwrap_or(fallback);
+        let focus = value("focusDistance", world.s) * units;
+        let aperture = value("aperture", 0.0);
+        let zoom = value("zoom", frame.focal * layer_scale);
+        // Match Camera Settings' f-stop conversion: focal_for_zoom uses a 36 mm film width,
+        // and the aperture UI is mm scaled by comp_width / 1920 (not a world-space diameter).
+        let aperture_mm = aperture * 1920.0 / comp.width as f64;
+        let fstop = if aperture_mm > 0.0 { (zoom * 36.0 / comp.width as f64) / aperture_mm } else { 2.8 };
+        let rotation = value("irisRotation", 0.0).to_radians();
+        let ratio = value("irisAspectRatio", 1.0);
+        let shape = opts.map(|(l, g)| ctx.e(l, g, "irisShape")).unwrap_or(0);
+        let blades = match shape {
+            0 => 4,
+            1..=8 => shape.saturating_add(2),
+            _ => return Err(bad(CMD, "invalid iris shape")),
+        };
+        let dof = opts.is_some_and(|(l, g)| ctx.b(l, g, "dof")) && aperture > 0.0 && value("blurLevel", 100.0) > 0.0;
+        let source_time = ctx.source_time(layer);
+        let source_frame = if footage.kind == FootageKind::Still {
+            0
+        } else {
+            footage.frame_rate.frame_at(source_time).clamp(0, source_count.saturating_mul(footage.loop_count.max(1) as i64).saturating_sub(1)) % source_count
+        };
+        finite(location.into_iter().chain([focus, aperture, zoom, fstop, rotation, ratio, value("blurLevel", 100.0), value("irisRoundness", 0.0)]))?;
+        if focus <= 0.0 || !(0.01..=100.0).contains(&ratio) || !(0.01..=1e6).contains(&fstop) {
+            return Err(bad(CMD, "focus, f-stop or iris aspect is outside Blender's supported range"));
+        }
+        frames.push(json!({"frame": start + i as i64, "timeTicks": time.0, "sourceFrame": source_frame,
+            "location": location, "rotation": [right, up, back], "lens": lens, "focus": focus, "dof": dof,
+            "fstop": fstop, "blades": blades, "irisRotation": rotation, "irisRatio": ratio,
+            "sourceAperture": aperture, "sourceZoom": zoom,
+            "blurLevel": value("blurLevel", 100.0), "irisRoundness": value("irisRoundness", 0.0)}));
+    }
+    Ok((frames, world))
+}
diff --git a/crates/engine/src/cmd/blender/validate.rs b/crates/engine/src/cmd/blender/validate.rs
new file mode 100644
index 000000000..a9454861f
--- /dev/null
+++ b/crates/engine/src/cmd/blender/validate.rs
@@ -0,0 +1,71 @@
+//! Validate solved geometry and its correspondence to the current layer timing.
+
+use effectcraft_project::{Comp, Layer};
+use effectcraft_time::Tick;
+use effectcraft_track::camtrack::{CameraSolve, linalg};
+
+use super::{CMD, MAX_FRAME, MAX_FRAMES, MAX_POINTS, bad, finite};
+use crate::Result;
+
+pub(super) fn timing(comp: &Comp, layer: &Layer, solve: &CameraSolve, start: i64) -> Result<(Tick, i64)> {
+    if solve.frames.len() > MAX_FRAMES || solve.points.len() > MAX_POINTS {
+        return Err(bad(CMD, "export is limited to 100,000 frames and 100,000 points; split the shot"));
+    }
+    if solve.size.iter().any(|v| !v.is_finite() || *v < 4.0 || *v > 65_536.0 || v.fract() != 0.0) {
+        return Err(bad(CMD, "invalid tracking resolution (expected 4..65536 whole pixels)"));
+    }
+    let fps = comp.frame_rate.as_f64();
+    if comp.frame_rate.num <= 0 || comp.frame_rate.den <= 0 || !fps.is_finite() || !(1.0..=1000.0).contains(&fps) {
+        return Err(bad(CMD, "invalid composition frame rate (expected 1..1000 fps)"));
+    }
+    let end = start
+        .checked_add(solve.frames.len() as i64)
+        .and_then(|n| n.checked_sub(1))
+        .filter(|n| *n <= MAX_FRAME)
+        .ok_or_else(|| bad(CMD, "the baked animation exceeds Blender's frame range"))?;
+    finite([solve.start, solve.frame_duration, solve.average_error, layer.stretch, comp.shutter_angle, comp.shutter_phase])?;
+    if layer.stretch == 0.0 || comp.width == 0 || comp.height == 0 {
+        return Err(bad(CMD, "invalid composition dimensions or zero layer stretch"));
+    }
+    let lo = comp.frame_rate.snap_nearest(layer.in_point.max(Tick::ZERO));
+    let hi = layer.out_point.min(comp.duration);
+    let fd = comp.frame_duration();
+    if fd.0 <= 0 || lo >= hi {
+        return Err(bad(CMD, "the tracked layer has no active frames"));
+    }
+    let expected = ((hi.0 as i128 - lo.0 as i128 + fd.0 as i128 - 1) / fd.0 as i128) as u128;
+    if expected != solve.frames.len() as u128 {
+        return Err(bad(CMD, "the solve no longer matches the layer's frame range; re-analyze the tracker"));
+    }
+    let dt = (layer.layer_time(lo + fd) - layer.layer_time(lo)).seconds();
+    if (solve.start - layer.layer_time(lo).seconds()).abs() > 1e-6 || solve.frames.len() > 1 && (solve.frame_duration - dt).abs() > 1e-6 {
+        return Err(bad(CMD, "the solve no longer matches the layer's timing; re-analyze the tracker"));
+    }
+    Ok((lo, end))
+}
+
+pub(super) fn geometry(solve: &CameraSolve, sensor: f64) -> Result<()> {
+    for frame in &solve.frames {
+        finite(frame.rot.into_iter().chain(frame.center).chain([frame.focal]))?;
+        if !frame.solved || frame.focal <= 0.0 {
+            return Err(bad(CMD, "the solve contains unsolved frames or invalid focal lengths; re-analyze the tracker"));
+        }
+        let mm = sensor * frame.focal / solve.size[0];
+        if !(1.0..=5000.0).contains(&mm) {
+            return Err(bad(CMD, "lens outside Blender's 1..5000 mm range; choose another sensorWidth"));
+        }
+    }
+    if let Some(ground) = &solve.ground {
+        finite(ground.origin.into_iter().chain(ground.normal).chain(ground.x_axis))?;
+        if (linalg::norm(ground.normal) - 1.0).abs() > 1e-4
+            || (linalg::norm(ground.x_axis) - 1.0).abs() > 1e-4
+            || linalg::dot(ground.normal, ground.x_axis).abs() > 1e-4
+        {
+            return Err(bad(CMD, "invalid ground-plane basis; set the ground plane again"));
+        }
+    }
+    if let Some(d) = &solve.distortion {
+        finite([d.k1, d.k2, d.radius])?;
+    }
+    Ok(())
+}
diff --git a/crates/engine/src/cmd/blender_scene.py b/crates/engine/src/cmd/blender_scene.py
new file mode 100644
index 000000000..0a9700a00
--- /dev/null
+++ b/crates/engine/src/cmd/blender_scene.py
@@ -0,0 +1,204 @@
+# EffectCraft camera tracker → Blender, original code under MIT OR Apache-2.0.
+# Run in Blender's Scripting workspace (Open, Run Script), or:
+# blender --background --python "Tracked Scene.py"
+# Creates a NEW scene; existing scenes and objects are preserved. Save the .blend yourself.
+# Public API types: bpy.types.Camera, bpy.types.ImageUser
+import json
+import math
+import os
+
+import bpy
+from mathutils import Matrix
+
+DATA = json.loads(__EFFECTCRAFT_DATA__)
+
+
+def _curves(owner):
+    """Blender 4.0–4.3 legacy actions and 4.4+/5.x layered actions."""
+    anim = owner.animation_data
+    if anim is None or anim.action is None:
+        return
+    action = anim.action
+    if getattr(action, "is_action_layered", False):
+        for layer in action.layers:
+            for strip in layer.strips:
+                if strip.type == 'KEYFRAME':
+                    bag = strip.channelbag(anim.action_slot)
+                    if bag is not None:
+                        yield from bag.fcurves
+    else:
+        yield from action.fcurves
+
+
+def _interpolation(owner):
+    for curve in _curves(owner):
+        # Footage indices and discrete switches must never interpolate between frames.
+        stepped = ("frame_offset" in curve.data_path or "use_dof" in curve.data_path
+                   or "aperture_blades" in curve.data_path)
+        for key in curve.keyframe_points:
+            key.interpolation = 'CONSTANT' if stepped else 'LINEAR'
+
+
+def _media_path():
+    original = DATA["media"]["path"]
+    candidates = [original]
+    # When sharing, place the video alongside the script or the .blend and run again.
+    script_path = globals().get("__file__", "")
+    if script_path:
+        candidates.append(os.path.join(os.path.dirname(os.path.abspath(script_path)),
+                                       os.path.basename(original)))
+    if bpy.data.filepath:
+        candidates.append(os.path.join(os.path.dirname(bpy.data.filepath),
+                                       os.path.basename(original)))
+    return next((p for p in candidates if os.path.isfile(p)), None)
+
+
+def import_scene():
+    if bpy.app.version < (4, 0, 0):
+        raise RuntimeError("EffectCraft scene import requires Blender 4.0 or newer")
+    scene = bpy.data.scenes.new(DATA["name"])
+    scene.frame_start = DATA["startFrame"]
+    scene.frame_end = DATA["endFrame"]
+    fps = DATA["fpsNumerator"] / DATA["fpsDenominator"]
+    scene.render.fps = max(1, round(fps))
+    scene.render.fps_base = scene.render.fps / fps
+    scene.render.resolution_x, scene.render.resolution_y = map(int, DATA["resolution"])
+    scene.render.resolution_percentage = 100
+    # The tracker assumes square pixels, regardless of the source's interpretation metadata.
+    scene.render.pixel_aspect_x = scene.render.pixel_aspect_y = 1.0
+    scene.render.film_transparent = True
+    scene.render.motion_blur_shutter = max(0.0, min(2.0, DATA["shutter"]))
+    scene.unit_settings.system = 'METRIC'
+    scene.unit_settings.scale_length = 1.0
+    scene["effectcraft_unit_scale"] = DATA["unitScale"]
+    scene["effectcraft_scale_is_arbitrary"] = True
+    scene["effectcraft_shutter_phase_degrees"] = DATA["shutterPhase"]
+
+    collection = bpy.data.collections.new("EffectCraft Tracking")
+    scene.collection.children.link(collection)
+    camera_data = bpy.data.cameras.new("3D Tracker Camera")
+    camera = bpy.data.objects.new("3D Tracker Camera", camera_data)
+    collection.objects.link(camera)
+    scene.camera = camera
+    camera.rotation_mode = 'QUATERNION'
+    camera_data.type = 'PERSP'
+    camera_data.sensor_fit = 'HORIZONTAL'
+    camera_data.sensor_width = DATA["sensorWidth"]
+    camera_data.sensor_height = (DATA["sensorWidth"] * DATA["resolution"][1]
+                                 / DATA["resolution"][0])
+    camera_data.show_background_images = True
+    camera_data.show_limits = True
+    extent = max([DATA["groundSize"], 1.0]
+                 + [math.dist(p["location"], f["location"])
+                    for p in DATA["points"][::max(1, len(DATA["points"]) // 100)]
+                    for f in DATA["frames"][::max(1, len(DATA["frames"]) // 10)]])
+    camera_data.clip_start = max(0.00001, min(0.1, extent / 10000.0))
+    camera_data.clip_end = max(1000.0, extent * 10.0)
+
+    previous = None
+    for sample in DATA["frames"]:
+        frame = sample["frame"]
+        camera.location = sample["location"]
+        # Exported right/up/back vectors are COLUMNS of Blender's local → world basis.
+        quaternion = Matrix(sample["rotation"]).transposed().to_quaternion()
+        if previous is not None and previous.dot(quaternion) < 0:
+            quaternion.negate()
+        camera.rotation_quaternion = quaternion
+        previous = quaternion.copy()
+        camera.keyframe_insert(data_path="location", frame=frame)
+        camera.keyframe_insert(data_path="rotation_quaternion", frame=frame)
+        camera_data.lens = sample["lens"]
+        camera_data.keyframe_insert(data_path="lens", frame=frame)
+        camera_data.dof.use_dof = sample["dof"]
+        camera_data.dof.focus_distance = sample["focus"]
+        camera_data.dof.aperture_fstop = sample["fstop"]
+        camera_data.dof.aperture_blades = sample["blades"]
+        camera_data.dof.aperture_rotation = (sample["irisRotation"] + math.pi) % math.tau - math.pi
+        camera_data.dof.aperture_ratio = sample["irisRatio"]
+        for prop in ("use_dof", "focus_distance", "aperture_fstop", "aperture_blades",
+                     "aperture_rotation", "aperture_ratio"):
+            camera_data.keyframe_insert(data_path="dof." + prop, frame=frame)
+
+    path = _media_path()
+    if path is not None:
+        try:
+            image = bpy.data.images.load(path, check_existing=False)
+            image.source = DATA["media"]["kind"]
+            background = camera_data.background_images.new()
+            background.source = 'IMAGE'
+            background.image = image
+            background.alpha = 1.0
+            background.display_depth = 'BACK'
+            background.frame_method = 'STRETCH'
+            user = background.image_user
+            user.use_auto_refresh = True
+            user.use_cyclic = False
+            user.frame_start = DATA["startFrame"]
+            user.frame_duration = max(1, min(1048574, image.frame_duration))
+            if image.source == 'MOVIE':
+                for sample in DATA["frames"]:
+                    # Blender uses 1-based image frames; sourceFrame is 0-based.
+                    user.frame_offset = sample["sourceFrame"] - (sample["frame"] - user.frame_start)
+                    camera_data.keyframe_insert(
+                        data_path="background_images[0].image_user.frame_offset",
+                        frame=sample["frame"])
+        except (RuntimeError, ValueError, OSError) as error:
+            DATA["warnings"].append("Blender could not load the background video: " + str(error))
+    else:
+        DATA["warnings"].append("Video not found: " + DATA["media"]["path"]
+                                + ". Place it beside this script or relink the camera background.")
+
+    if DATA["points"]:
+        mesh = bpy.data.meshes.new("Solved Track Points")
+        mesh.from_pydata([p["location"] for p in DATA["points"]], [], [])
+        mesh.update()
+        cloud = bpy.data.objects.new("Solved Track Points", mesh)
+        collection.objects.link(cloud)
+        cloud.show_in_front = True
+        cloud.hide_render = True
+        for name, kind, key in (("track_id", 'INT', "id"), ("reprojection_error", 'FLOAT', "error"),
+                                ("first_frame", 'INT', "first"), ("last_frame", 'INT', "last")):
+            attr = mesh.attributes.new(name=name, type=kind, domain='POINT')
+            for dest, point in zip(attr.data, DATA["points"]):
+                # Track IDs are u32 in EffectCraft; keep the full IDs in the JSON text too.
+                dest.value = point[key] if kind == 'FLOAT' else min(2147483647, point[key])
+
+    if DATA["ground"]:
+        size = DATA["groundSize"]
+        mesh = bpy.data.meshes.new("Solved Ground Plane")
+        mesh.from_pydata([(-size, -size, 0), (size, -size, 0),
+                          (size, size, 0), (-size, size, 0)], [], [(0, 1, 2, 3)])
+        mesh.update()
+        ground = bpy.data.objects.new("Solved Ground Plane", mesh)
+        collection.objects.link(ground)
+        ground.display_type = 'WIRE'
+        ground.hide_render = True
+    for marker in DATA["markers"]:
+        scene.timeline_markers.new(marker["name"], frame=marker["frame"])
+
+    _interpolation(camera)
+    _interpolation(camera_data)
+    metadata = bpy.data.texts.new("EffectCraft Tracking Metadata.json")
+    metadata.write(json.dumps(DATA, ensure_ascii=False, indent=2))
+    scene["effectcraft_metadata_text"] = metadata.name
+    camera_data["effectcraft_average_error_pixels"] = DATA["solve"]["averageError"]
+    camera_data["effectcraft_solve_method"] = DATA["solve"]["methodUsed"]
+    camera_data["effectcraft_focus_source"] = "See warnings in " + metadata.name
+    distortion = DATA["solve"].get("distortion")
+    if distortion:
+        for key in ("k1", "k2", "radius"):
+            camera_data["effectcraft_distortion_" + key] = distortion[key]
+    if bpy.context.window is not None:
+        bpy.context.window.scene = scene
+        for area in bpy.context.window.screen.areas:
+            if area.type == 'VIEW_3D':
+                area.spaces.active.region_3d.view_perspective = 'CAMERA'
+    scene.frame_set(scene.frame_start)
+    for warning in DATA["warnings"]:
+        print("EffectCraft: " + warning)
+    print("EffectCraft: imported", len(DATA["frames"]), "baked camera frames into", scene.name)
+    return scene
+
+
+if __name__ == "__main__":
+    EFFECTCRAFT_SCENE = import_scene()
diff --git a/crates/engine/src/commands/camera_cmds.rs b/crates/engine/src/cmd/camera_cmds.rs
similarity index 96%
rename from crates/engine/src/commands/camera_cmds.rs
rename to crates/engine/src/cmd/camera_cmds.rs
index 68cd14fb9..7f93730f8 100644
--- a/crates/engine/src/commands/camera_cmds.rs
+++ b/crates/engine/src/cmd/camera_cmds.rs
@@ -42,11 +42,25 @@ pub fn specs() -> Vec<CommandSpec> {
             create_from_solve
         ),
         cmd!("camera.create", "Create Camera", [], None, "{layer?, effect?}", has_comp, |s, p| create_from_solve(s, &with_kind(p, "camera"))),
+        cmd!(
+            "camera.exportBlender",
+            "Export Scene to Blender...",
+            [],
+            None,
+            "{path: .py, comp?, layer?, effect?, sensorWidth?: mm (default 36), unitScale?: Blender units per comp pixel (default 0.01), startFrame?: positive integer (default 1), includePoints?: true}",
+            has_comp,
+            export_blender
+        ),
         cmd!("camera.setGroundPlane", "Set Ground Plane and Origin", [], None, "{points?: [id] (default: selected), layer?, effect?}", has_comp, set_ground),
         cmd!("camera.deletePoints", "Delete Selected Points", [], None, "{points?: [id] (default: selected), layer?, effect?, wait?}", has_comp, delete_points),
     ]
 }
 
+fn export_blender(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid, uid) = ct_p(s, p, "camera.exportBlender")?;
+    super::blender::export(s, p, cid, lid, uid)
+}
+
 fn with_kind(p: &Value, kind: &str) -> Value {
     let mut q = p.clone();
     if !q.is_object() {
@@ -232,13 +246,18 @@ fn status(s: &mut Session, p: &Value) -> Result<Value> {
     out["deleted"] = json!(settings.deleted.len());
     out["lensDistortionSolved"] = json!(settings.lens_distortion);
     let solve = ct::solve(&params);
-    out["solved"] = json!(solve.is_some());
+    // The solver interpolates the frames it could not solve: only a solve of every frame is
+    // `solved` (what `camera.exportBlender` needs); one with gaps is `partial`.
+    let solved_frames = solve.as_ref().map_or(0, |sv| sv.frames.iter().filter(|c| c.solved).count());
+    let complete = solve.as_ref().is_some_and(|sv| solved_frames == sv.frames.len());
+    out["solved"] = json!(complete);
+    out["partial"] = json!(solve.is_some() && !complete);
     if let Some(sv) = &solve {
         let f = sv.focal();
         out["methodUsed"] = json!(sv.method_used.label());
         out["averageError"] = json!(sv.average_error);
         out["points"] = json!(sv.points.len());
-        out["solvedFrames"] = json!(sv.frames.iter().filter(|c| c.solved).count());
+        out["solvedFrames"] = json!(solved_frames);
         out["focalLength"] = json!(f);
         out["horizontalAngleOfView"] = json!(sv.hfov(f));
         out["groundPlane"] = json!(sv.ground.is_some());
diff --git a/crates/engine/src/commands/comp.rs b/crates/engine/src/cmd/comp.rs
similarity index 95%
rename from crates/engine/src/commands/comp.rs
rename to crates/engine/src/cmd/comp.rs
index 6648a7426..8f44ebd3d 100644
--- a/crates/engine/src/commands/comp.rs
+++ b/crates/engine/src/cmd/comp.rs
@@ -35,7 +35,7 @@ fn apply_settings(c: &mut Comp, p: &Value) {
         let dx = (c.width as f64 - ow as f64) * (a % 3) as f64 / 2.0;
         let dy = (c.height as f64 - oh as f64) * (a / 3) as f64 / 2.0;
         if dx != 0.0 || dy != 0.0 {
-            for l in c.layers.iter_mut().filter(|l| l.parent.is_none()) {
+            for l in c.layers.iter_mut_where(|l| l.parent.is_none()) {
                 if let Some(tr) = l.transform_mut() {
                     super::layer::offset_position(tr, dx, dy);
                 }
@@ -272,6 +272,20 @@ fn poster(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(Value::Null)
 }
 
+fn delete_all_markers(s: &mut Session, p: &Value) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    s.edit("Delete All Markers", None, |proj, _| {
+        proj.comp_mut(cid).ok_or(EngineError::NoComp)?.markers.clear();
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+fn has_comp_markers(s: &Session) -> std::result::Result<(), String> {
+    let c = s.active_comp().ok_or("no composition")?;
+    if !c.markers.is_empty() { Ok(()) } else { Err("the composition has no markers".into()) }
+}
+
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!(
@@ -299,5 +313,6 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("comp.workArea", "Set Work Area", [], None, "{start?, end?, set?: begin|end (at CTI)}", has_comp, work_area),
         cmd!("comp.setSwitch", "Composition Switch", [], None, "{switch: hideShy|motionBlur|frameBlending|draft3d, value?}", has_comp, comp_switch),
         cmd!("comp.addMarker", "Add Marker", [], Some("Num*"), "{time?, comment?}", has_comp, add_marker),
+        cmd!("comp.deleteAllMarkers", "Delete All Markers", [], None, "{comp?}", has_comp_markers, delete_all_markers),
     ]
 }
diff --git a/crates/engine/src/commands/comp_more.rs b/crates/engine/src/cmd/comp_more.rs
similarity index 57%
rename from crates/engine/src/commands/comp_more.rs
rename to crates/engine/src/cmd/comp_more.rs
index d6de320ec..8b8340e78 100644
--- a/crates/engine/src/commands/comp_more.rs
+++ b/crates/engine/src/cmd/comp_more.rs
@@ -1,11 +1,11 @@
-//! Composition menu, part two: crop to region of interest / layer bounds, Save Frame As ▸ File,
-//! Copy Frame to Clipboard, Responsive Design — Time.
+//! Composition menu, part two: crop to region of interest / layer bounds, Scale Composition, Save
+//! Frame As ▸ File, Copy Frame to Clipboard, Responsive Design — Time.
 
 use effectcraft_project::Marker;
 use effectcraft_time::Tick;
 use serde_json::{Value, json};
 
-use super::{CommandSpec, always, bad, comp_id, f_p, has_comp, has_layers, layers_p, str_p};
+use super::{CommandSpec, always, b_p, bad, comp_id, f_p, has_comp, has_layers, layers_p, str_p};
 use crate::prefs::CompPreset;
 use crate::{EngineError, Result, Session, cmd, query};
 
@@ -25,7 +25,7 @@ fn crop(s: &mut Session, cid: effectcraft_project::ItemId, r: [f64; 4], label: &
         let (old_w, old_h) = (c.width, c.height);
         c.width = w;
         c.height = h;
-        for l in c.layers.iter_mut().filter(|l| l.parent.is_none()) {
+        for l in c.layers.iter_mut_where(|l| l.parent.is_none()) {
             if let Some(tr) = l.transform_mut() {
                 super::layer::offset_position(tr, -x, -y);
             }
@@ -71,6 +71,164 @@ fn crop_to_layers(s: &mut Session, p: &Value) -> Result<Value> {
     crop(s, cid, [x0, y0, b[2].ceil() - x0, b[3].ceil() - y0], "Crop Comp to Selected Layer(s) Bounds")
 }
 
+/// Multiply a property's value, every key, its spatial tangents and its speeds by `f`.
+fn scale_prop(pr: &mut effectcraft_project::Property, f: f64) {
+    use effectcraft_keyframe::Value as KV;
+    let mul = |v: &KV| match v {
+        KV::Scalar(x) => KV::Scalar(x * f),
+        KV::Vec2(a) => KV::Vec2(a.map(|x| x * f)),
+        KV::Vec3(a) => KV::Vec3(a.map(|x| x * f)),
+        other => other.clone(),
+    };
+    pr.value = mul(&pr.value);
+    for k in &mut pr.keys {
+        k.value = mul(&k.value);
+        k.spatial_in = k.spatial_in.map(|x| x * f);
+        k.spatial_out = k.spatial_out.map(|x| x * f);
+        for e in k.in_ease.iter_mut().chain(&mut k.out_ease) {
+            e.speed *= f;
+        }
+    }
+}
+
+/// Multiply only the Z of a 3D value (and of its keys and spatial tangents) by `f`. Speeds follow:
+/// a spatial side's speed by how much the path's direction there stretches, so the ease keeps
+/// its shape; a per-dimension one (Scale) by `f` for Z only.
+fn scale_prop_z(pr: &mut effectcraft_project::Property, f: f64) {
+    use effectcraft_keyframe::Value as KV;
+    let stretch = |v: [f64; 3]| {
+        let n = v[0].hypot(v[1]).hypot(v[2]);
+        if n > 1e-12 && n.is_finite() { v[0].hypot(v[1]).hypot(v[2] * f) / n } else { 1.0 }
+    };
+    let pos = |k: &effectcraft_project::Keyframe| k.value.as_vec3();
+    let sub = |a: [f64; 3], b: [f64; 3]| [a[0] - b[0], a[1] - b[1], a[2] - b[2]];
+    let is_zero = |v: [f64; 3]| v.iter().all(|x| x.abs() <= 1e-12);
+    // Read every side's direction before anything changes (auto tangents come from the neighbours).
+    let sides: Vec<(f64, f64)> = (0..pr.keys.len())
+        .map(|i| {
+            let (tin, tout) = effectcraft_keyframe::spatial_tangents(&pr.keys, i);
+            let here = pr.keys.get(i).map(pos).unwrap_or_default();
+            let chord = |j: Option<usize>| j.and_then(|j| pr.keys.get(j)).map(|k| sub(pos(k), here)).unwrap_or_default();
+            let tin = if is_zero(tin) { chord(i.checked_sub(1)) } else { tin };
+            let tout = if is_zero(tout) { chord(Some(i + 1)) } else { tout };
+            (stretch(tin), stretch(tout))
+        })
+        .collect();
+    let spatial = pr.spatial;
+    let mul = |v: &mut KV| {
+        if let KV::Vec3(a) = v {
+            a[2] *= f;
+        }
+    };
+    mul(&mut pr.value);
+    for (k, (s_in, s_out)) in pr.keys.iter_mut().zip(sides) {
+        mul(&mut k.value);
+        k.spatial_in[2] *= f;
+        k.spatial_out[2] *= f;
+        if spatial {
+            k.in_ease.iter_mut().for_each(|e| e.speed *= s_in);
+            k.out_ease.iter_mut().for_each(|e| e.speed *= s_out);
+        } else {
+            // A shorter list lends its first ease to Z (`effective_ease`): give Z its own.
+            for list in [&mut k.in_ease, &mut k.out_ease] {
+                if let Some(&first) = list.first() {
+                    list.resize(list.len().max(3), first);
+                }
+                if let Some(e) = list.get_mut(2) {
+                    e.speed *= f;
+                }
+            }
+        }
+    }
+}
+
+/// Scale Composition (After Effects ships it as File ▸ Scripts ▸ Scale Composition.jsx): the comp
+/// and its contents grow or shrink by one factor, keys included, in one undo step. Layers whose
+/// parent has a Scale follow that parent; everything else scales its Position (and Point of
+/// Interest) and Scale. Anchor Point, masks, shapes and effects live in layer space and follow the
+/// layer's Scale. Cameras scale their Zoom so 3D layers keep their place in the frame; a 2D parent
+/// carries no depth, so its 3D children scale their Z themselves.
+fn scale_comp(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "comp.scale";
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let (ow, oh) = (f64::from(comp.width), f64::from(comp.height));
+    // The three are alternatives: with two, one would be ignored without a word.
+    if ["factor", "width", "height"].iter().filter(|k| f_p(p, k).is_some()).count() > 1 {
+        return Err(bad(C, "pass only one of `factor`, `width` or `height`"));
+    }
+    let f = match (f_p(p, "factor"), f_p(p, "width"), f_p(p, "height")) {
+        (Some(f), ..) => f,
+        (None, Some(w), _) => w / ow,
+        (None, None, Some(h)) => h / oh,
+        _ => return Err(bad(C, "pass `factor`, `width` or `height`")),
+    };
+    let (w, h) = ((ow * f).round(), (oh * f).round());
+    let max = f64::from(effectcraft_project::limits::MAX_SIZE);
+    if !f.is_finite() || f <= 0.0 || !(4.0..=max).contains(&w) || !(4.0..=max).contains(&h) {
+        return Err(bad(C, format!("the composition would be {w}×{h}: width and height run from 4 to 30,000 px")));
+    }
+    let (w, h) = (w as u32, h as u32);
+    let active = s.active_comp_id() == Some(cid);
+    s.edit("Scale Composition", None, |proj, st| {
+        let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        // An ancestor's Scale carries its descendants (X and Y only when that ancestor is 2D),
+        // through cameras and lights too: the renderer applies every ancestor's transform.
+        let chain: std::collections::HashMap<_, _> =
+            c.layers.iter().map(|l| (l.id, (l.transform().is_some_and(|tr| tr.get("scale").is_some()), l.is_3d(), l.parent))).collect();
+        // (X and Y carried, Z carried); bounded, as parent chains in a file can loop.
+        let carried = |mut cur: Option<effectcraft_project::LayerId>| {
+            let (mut xy, mut z) = (false, false);
+            for _ in 0..64 {
+                let Some(&(has_scale, three_d, up)) = cur.and_then(|id| chain.get(&id)) else { break };
+                xy |= has_scale;
+                z |= has_scale && three_d;
+                cur = up;
+            }
+            (xy, z)
+        };
+        for l in &mut c.layers {
+            let (xy_carried, z_carried) = carried(l.parent);
+            let three_d = l.is_3d();
+            let Some(tr) = l.transform_mut() else { continue };
+            if !xy_carried {
+                for name in ["position", "positionX", "positionY", "positionZ", "poi", "scale"] {
+                    if let Some(pr) = tr.get_mut(name) {
+                        scale_prop(pr, f);
+                    }
+                }
+            } else if three_d && !z_carried {
+                if let Some(pr) = tr.get_mut("positionZ") {
+                    scale_prop(pr, f);
+                }
+                for name in ["position", "poi", "scale"] {
+                    if let Some(pr) = tr.get_mut(name) {
+                        scale_prop_z(pr, f);
+                    }
+                }
+            }
+            if let Some(cam) = l.props.sub_mut("cameraOptions") {
+                for name in ["zoom", "focusDistance", "aperture"] {
+                    if let Some(pr) = cam.get_mut(name) {
+                        scale_prop(pr, f);
+                    }
+                }
+            }
+        }
+        // Percentage guides keep their percent.
+        for g in c.guides.iter_mut().filter(|g| !g.percent) {
+            g.position *= f;
+        }
+        c.width = w;
+        c.height = h;
+        if active && let Some(r) = &mut st.region_of_interest {
+            *r = r.map(|v| v * f);
+        }
+        Ok(())
+    })?;
+    Ok(json!({"width": w, "height": h, "factor": f}))
+}
+
 /// Encode straight 8-bit RGBA as PNG.
 pub(crate) fn encode_png(rgba: &[u8], w: u32, h: u32) -> std::result::Result<Vec<u8>, String> {
     use image::ImageEncoder;
@@ -82,7 +240,7 @@ pub(crate) fn encode_png(rgba: &[u8], w: u32, h: u32) -> std::result::Result<Vec
 /// Save Frame As ▸ File with `queue`: a Render Queue item for the current frame, from the Frame
 /// Default templates (Edit ▸ Templates).
 fn queue_frame(s: &mut Session, p: &Value) -> Result<Value> {
-    use effectcraft_project::render_queue::{RenderQueueItem, TimeSpan};
+    use effectcraft_project::render_queue::{Channels, RenderQueueItem, TimeSpan};
     use effectcraft_project::render_templates::TemplateSlot;
     let cid = comp_id(s, p)?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
@@ -91,10 +249,16 @@ fn queue_frame(s: &mut Session, p: &Value) -> Result<Value> {
     it.settings = s.project.render_templates.default_render_settings(TemplateSlot::Still);
     it.settings.time_span = TimeSpan::Custom { start: t, end: t + comp.frame_duration() };
     it.output = s.project.render_templates.default_output_module(TemplateSlot::Still);
+    if b_p(p, "transparent") == Some(false) {
+        it.output.channels = Channels::Rgb;
+    }
     if let Some(path) = str_p(p, "path") {
         it.output.output = path.to_string();
-    } else if !it.output.format.is_sequence() {
-        it.output.output = "[compName]_frame.[fileExtension]".into();
+    } else {
+        if !it.output.format.is_sequence() {
+            it.output.output = "[compName]_frame.[fileExtension]".into();
+        }
+        s.avoid_sources(&mut it);
     }
     let id = s.edit("Save Frame As", None, |proj, _| {
         it.id = proj.render_queue.iter().map(|i| i.id).max().unwrap_or(0) + 1;
@@ -107,19 +271,20 @@ fn queue_frame(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn save_frame(s: &mut Session, p: &Value) -> Result<Value> {
-    if p.get("queue").and_then(Value::as_bool) == Some(true) {
+    if b_p(p, "queue") == Some(true) {
         return queue_frame(s, p);
     }
     let path = str_p(p, "path").ok_or_else(|| bad("comp.saveFrameAs", "missing `path` (.png)"))?.to_string();
+    s.refuse_export(&path)?;
     let cid = comp_id(s, p)?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let t = f_p(p, "time").map(Tick::from_seconds_f64).unwrap_or(s.time());
     let scale = f_p(p, "scale").unwrap_or(1.0).clamp(0.01, 4.0);
     let bg = comp.background;
     let img = s.render(cid, t, effectcraft_render::RenderOpts { scale, backend: effectcraft_render::Backend::Auto, ..Default::default() });
-    let rgba = img.to_rgba8_over(bg);
+    let rgba = if b_p(p, "transparent") == Some(false) { img.to_rgba8_over(bg) } else { img.to_rgba8() };
     let png = encode_png(&rgba, img.width, img.height).map_err(|e| EngineError::Other(format!("PNG encoding failed: {e}")))?;
-    s.services.write_file(&path, &png).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(&path, &png)?;
     s.toast(format!("Saved frame to {path}"));
     Ok(json!({"path": path, "width": img.width, "height": img.height, "time": t.seconds()}))
 }
@@ -230,12 +395,21 @@ pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!("comp.cropToRegionOfInterest", "Crop Comp to Region of Interest", ["Composition"], None, "{comp?}", has_roi, crop_to_roi),
         cmd!("comp.cropToLayerBounds", "Crop Comp to Selected Layer(s) Bounds", ["Composition"], None, "{layers?}", has_layers, crop_to_layers),
+        cmd!(
+            "comp.scale",
+            "Scale Composition",
+            [],
+            None,
+            "{comp?, factor? (2 = twice the size) | width? | height? (the other side keeps the aspect ratio)}",
+            has_comp,
+            scale_comp
+        ),
         cmd!(
             "comp.saveFrameAs",
             "File...",
             ["Composition", "Save Frame As"],
             Some("Cmd+Alt+S"),
-            "{path (.png; with queue: an output path or template), time?, scale?, queue?: bool (add a Render Queue item from the Frame Default templates instead of writing now)}",
+            "{path (.png; with queue: an output path or template), time?, scale?, queue?: bool (add a Render Queue item from the Frame Default templates instead of writing now), transparent?: bool (default true)}",
             has_comp,
             save_frame
         ),
diff --git a/crates/engine/src/cmd/content_fill.rs b/crates/engine/src/cmd/content_fill.rs
new file mode 100644
index 000000000..720e780b9
--- /dev/null
+++ b/crates/engine/src/cmd/content_fill.rs
@@ -0,0 +1,808 @@
+//! Content-Aware Fill (Window ▸ Content-Aware Fill, Layer ▸ New ▸ Content-Aware Fill Layer):
+//! fill the transparent area of a layer (what its masks cut away) across the work area or the
+//! whole layer, render the result as a PNG sequence and add it as a "Fill" layer above the
+//! source, like After Effects. The algorithms are `effectcraft_raster::inpaint` (Object:
+//! flow-guided propagation + PatchMatch; Surface: propagation + one synthesised fill carried by
+//! the flow; Edge Blend: membrane fill). It runs as a background job (Window ▸ Progress); in
+//! the browser the job goes to a job worker ([`FillPlan`], `offload::WorkerJob::ContentFill`),
+//! whose own WebGPU device renders the layer's frames in passes, and the files come back to
+//! browser storage.
+
+use std::sync::Arc;
+
+use effectcraft_color::Label;
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, LayerId, LayerSource, build};
+use effectcraft_raster::Image;
+#[cfg(not(target_arch = "wasm32"))]
+use effectcraft_raster::inpaint::SpillHandle;
+use effectcraft_raster::inpaint::{FillInput, FillMethod, FillOpts, Frames, HoleMask, dilate};
+use effectcraft_render::{Accelerator, EvalCtx, ExprHost, FootageSource, LayerCache, Renderer};
+use effectcraft_time::Tick;
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+use super::scene_detect::LayerFrames;
+use super::{CommandSpec, always, b_p, bad, f_p, has_layers, layer_p, str_p};
+use crate::jobs::Apply;
+use crate::{EngineError, Result, Session, cmd};
+
+/// Content-Aware Fill panel settings (serde, in [`crate::EditorState`]).
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct FillSettings {
+    /// `object`, `surface` or `edgeBlend`.
+    pub method: String,
+    /// `workArea` or `entire` (the layer's duration).
+    pub range: String,
+    /// Grow the fill area by this many pixels.
+    pub alpha_expansion: f64,
+    /// `none`, `subtle`, `moderate`, `strong`.
+    pub lighting_correction: String,
+    /// Reference frame: a layer of the comp and the comp time of the frame to use.
+    pub reference_layer: Option<LayerId>,
+    pub reference_time: Option<f64>,
+}
+
+impl Default for FillSettings {
+    fn default() -> Self {
+        FillSettings {
+            method: "object".into(),
+            range: "workArea".into(),
+            alpha_expansion: 0.0,
+            lighting_correction: "none".into(),
+            reference_layer: None,
+            reference_time: None,
+        }
+    }
+}
+
+fn lighting(s: &str) -> Option<f32> {
+    Some(match s {
+        "none" | "off" => 0.0,
+        "subtle" => 0.35,
+        "moderate" => 0.65,
+        "strong" => 1.0,
+        _ => return None,
+    })
+}
+
+fn set(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "contentFill.set";
+    let mut st = s.state.content_fill.clone();
+    if let Some(m) = str_p(p, "method") {
+        st.method = FillMethod::from_name(m).ok_or_else(|| bad(c, "method: object|surface|edgeBlend"))?.name().into();
+    }
+    if let Some(r) = str_p(p, "range") {
+        st.range = match r {
+            "workArea" | "work area" => "workArea".into(),
+            "entire" | "entireDuration" | "layer" => "entire".into(),
+            _ => return Err(bad(c, "range: workArea|entire")),
+        };
+    }
+    if let Some(a) = f_p(p, "alphaExpansion") {
+        st.alpha_expansion = a.clamp(0.0, 100.0);
+    }
+    if let Some(l) = str_p(p, "lightingCorrection") {
+        lighting(l).ok_or_else(|| bad(c, "lightingCorrection: none|subtle|moderate|strong"))?;
+        st.lighting_correction = l.into();
+    }
+    match p.get("referenceLayer") {
+        Some(Value::Null) => st.reference_layer = None,
+        Some(v) => {
+            let comp = s.active_comp().ok_or(EngineError::NoComp)?;
+            st.reference_layer = Some(super::resolve_layer(comp, v).ok_or_else(|| bad(c, format!("no layer {v}")))?);
+            st.reference_time = Some(f_p(p, "referenceTime").unwrap_or(s.time().seconds()));
+        }
+        None => {
+            if let Some(t) = f_p(p, "referenceTime") {
+                st.reference_time = Some(t);
+            }
+        }
+    }
+    s.state.content_fill = st.clone();
+    Ok(serde_json::to_value(st).unwrap_or_default())
+}
+
+/// A layer's masked source at comp time `t` on a `w × h` canvas in layer pixels (straight colour
+/// with alpha 1 where kept), and the hole (`true` where the alpha is under one half).
+fn masked_frame(r: &Renderer, ctx: &EvalCtx, layer: &effectcraft_project::Layer, w: u32, h: u32) -> (Image, Vec<bool>) {
+    let mut img = Image::new(w, h);
+    let mut hole = vec![true; (w * h) as usize];
+    if let Some(buf) = r.layer_input(ctx, layer, 0) {
+        let sc = if buf.scale > 0.0 { buf.scale } else { 1.0 };
+        for y in 0..h {
+            for x in 0..w {
+                let (bx, by) = ((x as f64 + 0.5) * sc - buf.offset[0], (y as f64 + 0.5) * sc - buf.offset[1]);
+                let p = if (sc - 1.0).abs() < 1e-9 { buf.img.get(bx.floor() as i64, by.floor() as i64) } else { buf.img.sample_bilinear(bx, by) };
+                let i = (y * w + x) as usize;
+                if p[3] >= 0.5 {
+                    img.data[i] = [p[0] / p[3], p[1] / p[3], p[2] / p[3], 1.0];
+                    hole[i] = false;
+                }
+            }
+        }
+    }
+    (img, hole)
+}
+
+/// Encode a straight-alpha frame (alpha 1) as 8-bit PNG.
+fn png(img: &Image) -> std::result::Result<Vec<u8>, String> {
+    let rgba: Vec<u8> = img.data.iter().flat_map(|p| [p[0], p[1], p[2], p[3]].map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8)).collect();
+    super::comp_more::encode_png(&rgba, img.width, img.height)
+}
+
+fn default_dir(s: &Session, name: &str) -> String {
+    let base = s.path.as_deref().and_then(|p| std::path::Path::new(p).parent().map(|d| d.join("Fill"))).unwrap_or_else(|| {
+        // (the browser has no temporary folder: its storage)
+        if cfg!(target_arch = "wasm32") { std::path::PathBuf::from("/Fill") } else { std::env::temp_dir().join("effectcraft-fill") }
+    });
+    let safe: String = name.chars().map(|c| if c.is_alphanumeric() || c == '-' || c == '_' { c } else { '_' }).collect();
+    let mut k = 1;
+    loop {
+        let d = base.join(format!("{safe}_Fill_{k}"));
+        let ds = d.to_string_lossy().to_string();
+        if !s.services.exists(&ds) && !s.services.exists(&format!("{ds}/fill_00000.png")) {
+            return ds;
+        }
+        k += 1;
+    }
+}
+
+/// A fill job, detached from the session (it also travels to a browser job worker).
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FillPlan {
+    pub comp: ItemId,
+    pub layer: LayerId,
+    /// The source layer's name.
+    pub name: String,
+    /// The layer's size (the frames' size).
+    pub width: u32,
+    pub height: u32,
+    /// Comp times of the filled frames.
+    pub times: Vec<Tick>,
+    /// `object`, `surface` or `edgeBlend`.
+    pub method: String,
+    pub lighting: f32,
+    /// Alpha expansion (px).
+    pub expand: usize,
+    /// Reference frame: (layer, comp time).
+    pub reference: Option<(LayerId, Tick)>,
+    /// Folder of the PNG sequence.
+    pub dir: String,
+}
+
+/// Transient full frames one parallel stage holds per worker: the membrane reads a frame and
+/// returns a copy, the flow stage holds the neighbouring pair plus the luma pyramids, and
+/// Lighting Correction adds the mismatch ring (`diff`, its mask) on top.
+///
+/// Measured with `measure_peak_rss_of_a_fill` (90 frames, 640×360, Surface): peak RSS grows by
+/// ~7 frames a rayon worker at the top of its run-to-run spread, and Lighting Correction stays
+/// below the flow stage's peak, so 8 (9 with lighting) is a conservative constant (#2570).
+fn per_worker_frames(lighting: bool) -> u64 {
+    if lighting { 9 } else { 8 }
+}
+
+/// The sequential synthesis stage: the stored frame, the PatchMatch pyramid and its
+/// coarse-to-fine copies, the warped previous frame, and the sink's prepared copy.
+const SYNTH_FRAMES: u64 = 6;
+
+/// Workers a range of `frames` can keep busy (rayon never runs more tasks than frames). The
+/// scratch estimate must follow the pool that actually runs the parallel stages: a synchronous
+/// fill stays in the caller's pool, while an asynchronous one runs on `spawn_task`'s own OS
+/// thread and so uses the global pool, whatever pool the command was called from (#2570).
+fn fill_workers(frames: usize, wait: bool) -> u64 {
+    let pool = if wait { rayon::current_num_threads() as u64 } else { global_pool_threads() };
+    pool.min(frames.max(1) as u64)
+}
+
+/// The global Rayon pool's thread count, read from a thread outside every pool:
+/// `rayon::current_num_threads()` answers for the caller's pool, not the one the background
+/// task uses. Falls back to the current pool when the probe thread cannot start.
+fn global_pool_threads() -> u64 {
+    let (tx, rx) = std::sync::mpsc::channel();
+    match std::thread::Builder::new().name("fill-pool-probe".into()).spawn(move || {
+        let _ = tx.send(rayon::current_num_threads());
+    }) {
+        Ok(handle) => {
+            let n = rx.recv().map(|n| n as u64).unwrap_or_else(|_| rayon::current_num_threads() as u64);
+            let _ = handle.join();
+            n
+        }
+        Err(_) => rayon::current_num_threads() as u64,
+    }
+}
+
+/// Native builds spill the input, the membrane-filled neighbours and the propagated copies, and
+/// pack the holes to one bit per pixel, so only the two packed masks and the two flow fields
+/// (~1/2 byte a pixel a frame) plus the workers' scratch stay resident (#2570). wasm has no
+/// spill and keeps the input and the working copies in RAM (~32 bytes a pixel a frame). When
+/// even that peak is more than `available`, report it up front instead of running out of memory
+/// partway through (#1789, #2570 review).
+#[cfg(test)]
+fn memory_shortfall(frames: usize, w: u32, h: u32, available: u64) -> Option<String> {
+    memory_shortfall_with(frames, w, h, available, fill_workers(frames, true), false, 0)
+}
+
+/// `workers` and `lighting` are parameters so the budget is testable: the scratch term used to
+/// be a fixed 8 frames, which under-counted a wide machine by several times (#2570 review).
+/// `resident` adds storage that would otherwise be spill: when the spill volume is RAM-backed,
+/// its files use the same memory as the working set (#2570 review).
+fn memory_shortfall_with(frames: usize, w: u32, h: u32, available: u64, workers: u64, lighting: bool, resident: u64) -> Option<String> {
+    let px = u64::from(w).saturating_mul(u64::from(h));
+    let per_frame = (frames as u64).saturating_mul(px);
+    // `holes` and the leftover propagation masks, packed to a bit a pixel each.
+    let masks = per_frame / 4;
+    // The forward and backward flow fields, ~0.125 byte a pixel each.
+    let flows = per_frame / 4;
+    // wasm keeps the input and one working copy in RAM at every stage; a RAM-backed spill
+    // volume counts there too.
+    let resident = resident.saturating_add(if cfg!(target_arch = "wasm32") { per_frame.saturating_mul(32) } else { 0 });
+    // The synthesis stage is sequential; every parallel stage holds a few frames a worker.
+    let scratch_frames = SYNTH_FRAMES.saturating_add(per_worker_frames(lighting).saturating_mul(workers));
+    let scratch = px.saturating_mul(16).saturating_mul(scratch_frames);
+    let need = masks.saturating_add(flows).saturating_add(resident).saturating_add(scratch);
+    (need > available).then(|| {
+        let gb = |b: u64| b as f64 / 1e9;
+        format!(
+            "Content-Aware Fill of {frames} frames at {w}×{h} needs at least {:.1} GB of memory, and {:.1} GB is free: fill a shorter range (set the work area and choose Work Area) or close other applications",
+            gb(need),
+            gb(available)
+        )
+    })
+}
+
+/// Scratch floor for a native fill: the input, membrane-filled and propagated frames are each
+/// spilled as f32 RGBA (16 bytes a pixel a frame), but the membrane spill is closed before the
+/// propagated one is made, so at most two copies exist at once (2 × 16 bytes a pixel a frame),
+/// plus a tenth for the PNG output.
+#[cfg(not(target_arch = "wasm32"))]
+fn scratch_need(frames: usize, w: u32, h: u32) -> u64 {
+    let bytes = (frames as u64).saturating_mul(u64::from(w)).saturating_mul(u64::from(h)).saturating_mul(32);
+    bytes.saturating_add(bytes / 10)
+}
+
+/// Refuse up front when the output volume cannot hold the fill's scratch. The folder may not
+/// exist yet (the spill creates it), so query the nearest existing ancestor. `None` when the
+/// volume cannot be read; the write itself still reports a real error then (#2570 review).
+#[cfg(not(target_arch = "wasm32"))]
+fn scratch_shortfall(frames: usize, w: u32, h: u32, dir: &std::path::Path) -> Option<String> {
+    let need = scratch_need(frames, w, h);
+    // Resolve a relative output folder against the process directory; `parent()` of a bare
+    // name is empty, which would otherwise skip the check.
+    let base = if dir.is_absolute() { dir.to_path_buf() } else { std::env::current_dir().ok()?.join(dir) };
+    let mut probe = base.as_path();
+    while !probe.exists() {
+        probe = probe.parent()?;
+    }
+    let (_, free) = crate::sysinfo::disk_space(probe)?;
+    (need > free).then(|| {
+        let gb = |b: u64| b as f64 / 1e9;
+        format!(
+            "Content-Aware Fill of {frames} frames at {w}×{h} needs up to {:.1} GB of scratch space beside the output, and {:.1} GB is free there: fill a shorter range (set the work area and choose Work Area) or choose an output folder on a larger disk",
+            gb(need),
+            gb(free)
+        )
+    })
+}
+
+/// The status line shown while the frames are filled. Edge Blend calls only the membrane, which
+/// the device backend leaves to the CPU reference, so it is not a device fill even when a `fill`
+/// backend is present; Object and Surface run the flow and PatchMatch on the device.
+fn filling_status(on_device: bool, method: FillMethod) -> &'static str {
+    if on_device && method != FillMethod::EdgeBlend { "Filling (GPU)" } else { "Filling" }
+}
+
+/// The PNGs a fill has written so far. Unless the fill finishes ([`OutputFiles::keep`]), dropping
+/// it deletes the ones it created, and the output folder too when the fill made it and nothing
+/// else is in it, so a failed or stopped fill leaves no partial sequence behind (#2570 review). A
+/// file that was already there (an `outputDir` holding an earlier sequence) is never deleted.
+struct OutputFiles {
+    dir: std::path::PathBuf,
+    /// The folder was missing before the fill (the spill creates it).
+    made_dir: bool,
+    paths: Vec<String>,
+    /// Paths among `paths` that existed before the fill wrote them: not the fill's to delete.
+    spare: Vec<String>,
+    kept: bool,
+}
+
+impl OutputFiles {
+    /// The fill finished: keep its files.
+    fn keep(mut self) -> Vec<String> {
+        self.kept = true;
+        std::mem::take(&mut self.paths)
+    }
+}
+
+impl Drop for OutputFiles {
+    fn drop(&mut self) {
+        if self.kept {
+            return;
+        }
+        for path in self.paths.iter().filter(|p| !self.spare.contains(p)) {
+            let _ = std::fs::remove_file(path);
+        }
+        // `remove_dir` leaves a folder that still holds anything else.
+        if self.made_dir {
+            let _ = std::fs::remove_dir(&self.dir);
+        }
+    }
+}
+
+/// Run a fill: the layer's frames (rendered in passes with a job worker's GPU), the fill, the
+/// PNG sequence written into `plan.dir` (`Services::store_file`). Returns the files.
+///
+/// `accel` renders the frames (a job worker's GPU, as for every analysis: `None` on the
+/// desktop, whose analysis threads render on the CPU by design); `fill` is the fill's own
+/// backend ([`effectcraft_raster::inpaint::FillBackend`]), which is what makes Content-Aware
+/// Fill itself run on the GPU. They are separate on purpose: a desktop fill can run on the GPU
+/// while its input frames are composited on the CPU.
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn run_plan(
+    plan: &FillPlan,
+    project: &effectcraft_project::Project,
+    footage: &dyn FootageSource,
+    expr: Option<&dyn ExprHost>,
+    cache: &LayerCache,
+    services: &dyn crate::Services,
+    accel: Option<&dyn Accelerator>,
+    fill: Option<&dyn effectcraft_raster::inpaint::FillBackend>,
+    progress: &mut dyn FnMut(u64, u64) -> bool,
+    message: &mut dyn FnMut(&str),
+) -> std::result::Result<Vec<String>, String> {
+    message("Reading frames");
+    let (cid, w, h) = (plan.comp, plan.width, plan.height);
+    let comp = project.comp(cid).ok_or("composition missing")?;
+    let layer = comp.layer(plan.layer).ok_or("layer missing")?;
+    let mut r = Renderer::new(project, footage, crate::offload::analysis_opts(accel));
+    r.expr = expr;
+    r.cache = Some(cache);
+    let r = &r;
+    let ctx0 = EvalCtx { expr, ..EvalCtx::new(project, cid, comp, Tick::ZERO) };
+    let times = &plan.times;
+    let n = times.len() as u64;
+    let mut holes = Vec::with_capacity(times.len());
+    #[cfg(target_arch = "wasm32")]
+    let mut frames = Vec::with_capacity(times.len());
+    // Declared before the spill, so on an early return the spill is closed first and the folder
+    // it was made in can be removed.
+    let dir = std::path::Path::new(&plan.dir);
+    let mut written = OutputFiles { dir: dir.to_path_buf(), made_dir: !dir.exists(), paths: Vec::with_capacity(times.len()), spare: Vec::new(), kept: false };
+    // Spill 32-bit floats whatever the project depth: the old in-memory path kept f32 all the
+    // way through, so quantising here would change the fill (#2570, "no quality loss"). Scratch
+    // lives beside the output when one is set; the default temp folder may be RAM-backed, which
+    // the memory preflight accounts for when it chooses the spill folder.
+    #[cfg(not(target_arch = "wasm32"))]
+    let spill = SpillHandle::create_in(Some(dir), w as usize, h as usize, times.len(), 32)
+        .map_err(|e| format!("spill: cannot make the scratch file in {}: {e}", plan.dir))?;
+    #[cfg(not(target_arch = "wasm32"))]
+    let spill_probe = spill.clone();
+    for (k, t) in times.iter().enumerate() {
+        let (img, hole) = crate::offload::in_passes(accel, |a| masked_frame(&r.with_accel(a), &ctx0.at(*t), layer, w, h)).await;
+        holes.push(HoleMask::from_vec(&dilate(&hole, w as usize, h as usize, plan.expand)));
+        #[cfg(target_arch = "wasm32")]
+        frames.push(img);
+        #[cfg(not(target_arch = "wasm32"))]
+        spill.write_frame(k, &img)?;
+        if !progress(k as u64 + 1, n * 3) {
+            return Err(crate::render_queue::CANCELLED.into());
+        }
+    }
+    if !holes.iter().any(|h| h.any()) {
+        return Err("the layer has no transparent area to fill: draw a mask (Subtract) around what to remove".into());
+    }
+    let mut references = vec![];
+    if let Some((rl, rt)) = plan.reference
+        && let Some(l) = comp.layer(rl)
+    {
+        let (img, hole) = crate::offload::in_passes(accel, |a| masked_frame(&r.with_accel(a), &ctx0.at(rt), l, w, h)).await;
+        if hole.iter().all(|b| !*b) {
+            let k = times.iter().enumerate().min_by_key(|(_, t)| (t.0 - rt.0).abs()).map(|(k, _)| k).unwrap_or(0);
+            references.push((k, img));
+        }
+    }
+    let opts = FillOpts { method: FillMethod::from_name(&plan.method).unwrap_or_default(), lighting: plan.lighting, ..Default::default() };
+    message(filling_status(fill.is_some(), opts.method));
+    #[cfg(target_arch = "wasm32")]
+    let input_frames = Frames::Memory(frames);
+    #[cfg(not(target_arch = "wasm32"))]
+    let input_frames = Frames::Spilled(spill);
+    let input = FillInput { frames: input_frames, holes, references };
+    let cpu = effectcraft_raster::inpaint::CpuFill;
+    let backend: &dyn effectcraft_raster::inpaint::FillBackend = fill.unwrap_or(&cpu);
+    let progress = std::rc::Rc::new(std::cell::RefCell::new(progress));
+    // The fill and the sink both advance the bar: a streamed frame reports ahead of the fill's own
+    // progress, so both report a shared high-water mark and the bar never moves backwards.
+    let high = std::cell::Cell::new(0u64);
+    let report = |done: u64| -> bool {
+        let done = done.max(high.get());
+        high.set(done);
+        (progress.borrow_mut())(done, n * 3)
+    };
+    let paths: Vec<String> = (0..n as usize).map(|k| dir.join(format!("fill_{k:05}.png")).to_string_lossy().to_string()).collect();
+    let mut sink_error: Option<String> = None;
+    let mut sink = |idx: usize, img: &Image| -> std::result::Result<(), String> {
+        let r = (|| -> std::result::Result<(), String> {
+            // A failed spilled read returns a black fallback frame; never publish it (#2570
+            // review).
+            #[cfg(not(target_arch = "wasm32"))]
+            if spill_probe.has_error() {
+                return Err(spill_probe.take_error().unwrap_or_else(|| "spill: read failed".to_string()));
+            }
+            let existed = services.exists(&paths[idx]);
+            services.store_file(&paths[idx], &png(img)?).map_err(|e| format!("{}: {e}", paths[idx]))?;
+            written.paths.push(paths[idx].clone());
+            if existed {
+                written.spare.push(paths[idx].clone());
+            }
+            if !report(2 * n + idx as u64 + 1) {
+                return Err(crate::render_queue::CANCELLED.to_string());
+            }
+            Ok(())
+        })();
+        if let Err(e) = &r
+            && sink_error.is_none()
+        {
+            sink_error = Some(e.clone());
+        }
+        r
+    };
+    let produced =
+        effectcraft_raster::inpaint::fill_sequence_with(input, &opts, backend, &mut |d, t| report(n + (d as u64 * n / t.max(1) as u64)), Some(&mut sink));
+    #[cfg(not(target_arch = "wasm32"))]
+    if let Some(e) = spill_probe.take_error() {
+        return Err(e);
+    }
+    if produced.is_none() {
+        if let Some(e) = sink_error.take() {
+            return Err(e);
+        }
+        return Err(crate::render_queue::CANCELLED.into());
+    }
+    let produced = produced.unwrap_or_default();
+    // Non-streaming fallback (tests): write any retained images.
+    if !produced.is_empty() {
+        for (k, img) in produced.iter().enumerate() {
+            let path = paths[k].clone();
+            services.store_file(&path, &png(img)?).map_err(|e| format!("{path}: {e}"))?;
+            if written.paths.len() <= k {
+                written.paths.push(path);
+            }
+            if !report(2 * n + k as u64 + 1) {
+                return Err(crate::render_queue::CANCELLED.to_string());
+            }
+        }
+    }
+    // Every frame must have a file: the fill layer is built on the first one, and a short
+    // sequence would play the wrong frames.
+    if written.paths.len() != times.len() {
+        return Err(format!("Content-Aware Fill wrote {} of {} frames", written.paths.len(), times.len()));
+    }
+    Ok(written.keep())
+}
+
+/// Add the fill layer of a finished plan (one undo step).
+/// The plan comes back from a job worker, so an empty range is an error, not a crash.
+pub(crate) fn apply_plan(s: &mut Session, plan: &FillPlan, paths: Vec<String>) -> Result<Value> {
+    let importer = s.importer.clone();
+    let start = plan.times.first().copied().ok_or_else(|| bad("contentFill.generate", "the fill has no frames"))?;
+    add_fill_layer(s, plan.comp, plan.layer, &plan.name, paths, (plan.width, plan.height), start, plan.times.len(), importer)
+}
+
+/// `contentFill.generate`: validate the layer and range, refuse a fill that cannot fit in
+/// memory or scratch space, then run it (in the background unless `wait` is set).
+fn generate(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "contentFill.generate";
+    let (cid, lid) = layer_p(s, p, c)?;
+    // Parameters override the panel settings.
+    let mut st = s.state.content_fill.clone();
+    {
+        let saved = s.state.content_fill.clone();
+        let mut q = p.clone();
+        if let Some(o) = q.as_object_mut() {
+            o.retain(|k, _| ["method", "range", "alphaExpansion", "lightingCorrection", "referenceLayer", "referenceTime"].contains(&k.as_str()));
+        }
+        set(s, &q)?;
+        std::mem::swap(&mut st, &mut s.state.content_fill);
+        s.state.content_fill = saved;
+    }
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?.clone();
+    if !layer.source.is_av() || layer.source.item().is_none() {
+        return Err(bad(c, "Content-Aware Fill needs a footage, solid or precomp layer"));
+    }
+    let (w, h) = effectcraft_render::source_size(&s.project, &layer);
+    if w == 0 || h == 0 {
+        return Err(bad(c, "the layer has no pixels"));
+    }
+    let fr = comp.frame_rate;
+    let (a, b) =
+        if st.range == "entire" { (layer.in_point, layer.out_point) } else { (comp.work_area.0.max(layer.in_point), comp.work_area.1.min(layer.out_point)) };
+    let (a, b) = (a.max(Tick::ZERO), b.min(comp.duration));
+    if b <= a {
+        return Err(bad(c, "the range doesn't overlap the layer"));
+    }
+    let (fa, fb) = (fr.frame_at(fr.snap_nearest(a)), fr.frame_at(b - Tick(1)));
+    let times: Vec<Tick> = (fa..=fb).map(|f| fr.tick_of(f)).collect();
+    let opts = FillOpts {
+        method: FillMethod::from_name(&st.method).unwrap_or_default(),
+        lighting: lighting(&st.lighting_correction).unwrap_or(0.0),
+        ..Default::default()
+    };
+    let dir = str_p(p, "outputDir").map(str::to_string).unwrap_or_else(|| default_dir(s, &layer.name));
+    // The spill lives beside the output. On a RAM-backed volume (`tmpfs`/`ramfs`, where the
+    // default temp dir may live) its files use the same memory as the working set, so the
+    // memory preflight counts them; disk-backed volumes get the space check below instead.
+    #[cfg(not(target_arch = "wasm32"))]
+    let ram_spill = if crate::sysinfo::is_memory_backed(std::path::Path::new(&dir)) { scratch_need(times.len(), w, h) } else { 0 };
+    #[cfg(target_arch = "wasm32")]
+    let ram_spill = 0;
+    let wait = b_p(p, "wait").unwrap_or(false);
+    // `spawn_task` runs a fill inline on wasm, and `runs_inline` selects the pool it will use.
+    let runs_inline = wait || cfg!(target_arch = "wasm32");
+    if let Some(e) = crate::sysinfo::memory()
+        .and_then(|m| memory_shortfall_with(times.len(), w, h, m.available, fill_workers(times.len(), runs_inline), opts.lighting > 0.0, ram_spill))
+    {
+        return Err(bad(c, e));
+    }
+    let expand = st.alpha_expansion.round().max(0.0) as usize;
+    let reference = st.reference_layer.filter(|r| comp.layer(*r).is_some()).map(|r| (r, Tick::from_seconds_f64(st.reference_time.unwrap_or(0.0))));
+    // Native fills keep up to two f32 copies of the range in scratch beside the output; a volume
+    // that cannot hold them is refused before any frame is rendered (#2570 review).
+    #[cfg(not(target_arch = "wasm32"))]
+    if let Some(e) = scratch_shortfall(times.len(), w, h, std::path::Path::new(&dir)) {
+        return Err(bad(c, e));
+    }
+    let plan = FillPlan {
+        comp: cid,
+        layer: lid,
+        name: layer.name.clone(),
+        width: w,
+        height: h,
+        times,
+        method: opts.method.name().to_string(),
+        lighting: opts.lighting,
+        expand,
+        reference,
+        dir,
+    };
+    // The browser: a job worker (its own GPU), the page keeps running.
+    if !wait && s.offloads() {
+        s.offload_analysis(crate::offload::WorkerJob::ContentFill { plan: Box::new(plan) }).map_err(EngineError::Other)?;
+        return Ok(json!({"job": "contentFill", "started": true, "worker": true}));
+    }
+    let lf = LayerFrames::new(s, cid, lid);
+    let services = s.services.clone();
+    let importer = s.importer.clone();
+    let name = layer.name.clone();
+    // The fill's own GPU backend (Mercury GPU Acceleration; none under Software Only or
+    // without a compositor). The frames themselves still render on the CPU here, as for every
+    // desktop analysis (`offload::job_accel`): only the fill's own work moves to the device.
+    let accel = if s.project.settings.gpu_acceleration { s.accel.clone() } else { None };
+    s.spawn_task("contentFill", format!("Content-Aware Fill: {name}"), wait, move |ctl| {
+        let fill = accel.as_deref().and_then(|a| a.inpaint());
+        let paths = effectcraft_render::passes::block_on(run_plan(
+            &plan,
+            &lf.project,
+            lf.footage.as_ref(),
+            lf.expr.as_deref(),
+            &lf.cache,
+            services.as_ref(),
+            None,
+            fill,
+            &mut |d, t| ctl.progress(d, t),
+            &mut |m| ctl.message(m),
+        ))?;
+        let apply: Apply = Box::new(move |s: &mut Session| add_fill_layer(s, cid, lid, &name, paths, (w, h), plan.times[0], plan.times.len(), importer));
+        Ok(apply)
+    })
+}
+
+/// Import the rendered sequence and put it in a layer above the source.
+#[allow(clippy::too_many_arguments)]
+fn add_fill_layer(
+    s: &mut Session,
+    cid: ItemId,
+    lid: LayerId,
+    name: &str,
+    paths: Vec<String>,
+    size: (u32, u32),
+    start: Tick,
+    count: usize,
+    importer: Option<Arc<dyn crate::Importer>>,
+) -> Result<Value> {
+    let first = paths.first().cloned().ok_or_else(|| bad("contentFill.generate", "the fill wrote no frames"))?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let src = comp.layer(lid).ok_or_else(|| bad("contentFill.generate", "the source layer is gone"))?.clone();
+    let fr = comp.frame_rate;
+    let dur = fr.tick_of(count as i64);
+    let mut footage = importer.and_then(|i| i.probe(&first).ok()).filter(|f| f.has_video).unwrap_or_else(|| Footage {
+        path: first.clone(),
+        kind: FootageKind::Sequence,
+        width: size.0,
+        height: size.1,
+        has_video: true,
+        codec: "PNG".into(),
+        ..Default::default()
+    });
+    footage.kind = FootageKind::Sequence;
+    footage.sequence = paths.clone();
+    footage.frame_rate = fr;
+    footage.duration = dur;
+    let (lname, item, layer) = s.edit("Content-Aware Fill", None, |proj, st| {
+        let folder = proj.folder_named("Fill").unwrap_or_else(|| proj.add_item("Fill", Label::Yellow, None, ItemKind::Folder));
+        let n = proj.items.values().filter(|i| i.parent == Some(folder)).count() + 1;
+        let lname = format!("Fill {n} [{name}]");
+        let iid = proj.add_item(&lname, Label::Lavender, Some(folder), ItemKind::Footage(footage));
+        let mut l = build::layer(proj, &comp, &lname, LayerSource::Footage { item: iid }, size, Some(dur));
+        l.start_time = start;
+        l.in_point = start;
+        l.out_point = (start + dur).min(comp.duration);
+        l.parent = src.parent;
+        l.switches.three_d = src.switches.three_d;
+        if let (Some(dst), Some(t)) = (l.props.sub_mut("transform"), src.transform()) {
+            let mut tr = t.clone();
+            tr.reassign_uids(&mut proj.next_id);
+            *dst = tr;
+        }
+        let id = l.id;
+        let cm = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        let at = cm.layers.iter().position(|x| x.id == lid).unwrap_or(0);
+        cm.layers.insert(at, l);
+        st.selected_layers = vec![id];
+        Ok((lname, iid, id))
+    })?;
+    Ok(json!({"layer": layer.0, "item": item.0, "name": lname, "frames": count, "files": paths}))
+}
+
+fn open_panel(s: &mut Session, p: &Value) -> Result<Value> {
+    // Parameters given: generate straight away (agents); else show the panel.
+    if p.as_object().is_some_and(|o| !o.is_empty()) {
+        return generate(s, p);
+    }
+    s.events.push(crate::Event::Frontend { command: "window.panel".into(), params: json!({"panel": "contentAwareFill"}) });
+    Ok(json!({"frontend": "window.panel"}))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    const P: &str = "{layer?, method?: object|surface|edgeBlend, range?: workArea|entire, alphaExpansion? (px), lightingCorrection?: none|subtle|moderate|strong, referenceLayer?, referenceTime? (s), outputDir?, wait?: bool}";
+    vec![
+        cmd!(
+            "contentFill.set",
+            "Content-Aware Fill Settings",
+            [],
+            None,
+            "{method?: object|surface|edgeBlend, range?: workArea|entire, alphaExpansion? (px), lightingCorrection?: none|subtle|moderate|strong, referenceLayer?: layer|null, referenceTime? (s)}",
+            always,
+            set
+        ),
+        CommandSpec {
+            id: "contentFill.generate",
+            label: "Generate Fill Layer",
+            menu: &[],
+            shortcut: None,
+            alt_shortcuts: &[],
+            params: P,
+            enabled: has_layers,
+            run: generate,
+            journal: true,
+        },
+        CommandSpec {
+            id: "layer.newContentAwareFill",
+            label: "Content-Aware Fill Layer...",
+            menu: &["Layer", "New"],
+            shortcut: None,
+            alt_shortcuts: &[],
+            params: P,
+            enabled: always,
+            run: open_panel,
+            journal: true,
+        },
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    #[cfg(not(target_arch = "wasm32"))]
+    use super::scratch_need;
+    #[cfg(not(target_arch = "wasm32"))]
+    use super::scratch_shortfall;
+    use super::{filling_status, memory_shortfall, memory_shortfall_with};
+
+    /// Edge Blend fills with the membrane, which the device backend leaves to the CPU reference:
+    /// it must not claim a GPU fill just because a backend is available.
+    #[test]
+    fn edge_blend_is_not_reported_as_a_device_fill() {
+        use effectcraft_raster::inpaint::FillMethod;
+        assert_eq!(filling_status(true, FillMethod::Object), "Filling (GPU)");
+        assert_eq!(filling_status(true, FillMethod::Surface), "Filling (GPU)");
+        assert_eq!(filling_status(true, FillMethod::EdgeBlend), "Filling");
+        assert_eq!(filling_status(false, FillMethod::Object), "Filling");
+    }
+
+    /// #1789 / #2570: a range that cannot fit is refused up front instead of OOM-ing. The
+    /// scratch term scales with the workers and Lighting Correction, not a fixed frame count.
+    #[test]
+    fn a_fill_that_cannot_fit_in_memory_is_refused_up_front() {
+        let e = memory_shortfall_with(300, 1920, 1080, 1_000_000, 8, false, 0).expect("refused");
+        assert!(e.contains("300 frames") && e.contains("Work Area"), "{e}");
+        // Four workers, no lighting: the packed masks and flows plus ~38 scratch frames fit.
+        assert_eq!(memory_shortfall_with(30, 1920, 1080, 4_000_000_000, 4, false, 0), None);
+        assert_eq!(memory_shortfall_with(300, 1920, 1080, 2_000_000_000, 4, false, 0), None);
+        // A wide machine with Lighting Correction holds nine frames a worker: 300 frames no
+        // longer fit in 5 GB, which the old fixed 8-frame scratch term missed (#2570 review).
+        assert!(memory_shortfall_with(300, 1920, 1080, 1_000_000_000, 16, true, 0).is_some());
+        assert!(memory_shortfall_with(300, 1920, 1080, 5_000_000_000, 16, true, 0).is_some());
+        assert_eq!(memory_shortfall_with(300, 1920, 1080, 6_000_000_000, 16, true, 0), None);
+        // The two packed masks still grow with the range: a very long 1080p range cannot fit.
+        assert!(memory_shortfall_with(1000, 1920, 1080, 500_000_000, 8, false, 0).is_some());
+        // A RAM-backed spill volume counts its bytes as resident, so the same range that fit on
+        // a disk-backed volume is refused (#2570 review).
+        assert_eq!(memory_shortfall_with(30, 1920, 1080, 2_500_000_000, 4, false, 0), None);
+        assert!(memory_shortfall_with(30, 1920, 1080, 2_500_000_000, 4, false, 2_000_000_000).is_some());
+        // Hostile sizes saturate instead of overflowing.
+        assert!(memory_shortfall(usize::MAX, u32::MAX, u32::MAX, 0).is_some());
+    }
+
+    /// The native spill holds at most two f32 copies of the range beside the output at once (the
+    /// membrane spill is gone before the propagated one is made), plus the PNGs.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn scratch_space_is_checked_before_a_fill() {
+        let copies = 300u64 * 1920 * 1080 * 32;
+        assert_eq!(scratch_need(300, 1920, 1080), copies + copies / 10);
+        let tmp = std::env::temp_dir();
+        // A range that cannot possibly fit on the volume is refused up front.
+        assert!(scratch_shortfall(usize::MAX, u32::MAX, u32::MAX, &tmp).is_some());
+        // A relative folder that does not exist is resolved against the process directory.
+        assert!(scratch_shortfall(usize::MAX, u32::MAX, u32::MAX, std::path::Path::new("effectcraft-missing-fill-folder")).is_some());
+        // A tiny fill fits.
+        assert_eq!(scratch_shortfall(1, 16, 16, &tmp), None);
+    }
+
+    /// A fill that fails or is stopped after some frames were written deletes them, and the
+    /// output folder it made; a finished fill keeps its files (#2570 review).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_stopped_fill_removes_its_partial_output() {
+        use super::OutputFiles;
+        let root = tempfile::tempdir().unwrap();
+        let write = |dir: &std::path::Path, made_dir: bool| {
+            std::fs::create_dir_all(dir).unwrap();
+            let paths: Vec<String> = (0..2).map(|k| dir.join(format!("fill_{k:05}.png")).to_string_lossy().to_string()).collect();
+            for p in &paths {
+                std::fs::write(p, b"png").unwrap();
+            }
+            OutputFiles { dir: dir.to_path_buf(), made_dir, paths, spare: Vec::new(), kept: false }
+        };
+        // The fill made the folder: the files and the folder go.
+        let made = root.path().join("made");
+        drop(write(&made, true));
+        assert!(!made.exists(), "the partial sequence and its folder are removed");
+        // The folder was already there: only the fill's own files go.
+        let existing = root.path().join("existing");
+        drop(write(&existing, false));
+        assert!(existing.exists());
+        assert_eq!(std::fs::read_dir(&existing).unwrap().count(), 0);
+        // Something else in a folder the fill made keeps the folder.
+        let shared = root.path().join("shared");
+        let files = write(&shared, true);
+        std::fs::write(shared.join("notes.txt"), b"keep").unwrap();
+        drop(files);
+        assert_eq!(std::fs::read_dir(&shared).unwrap().count(), 1);
+        // A file that was there before the fill wrote over it (an earlier sequence in a given
+        // `outputDir`) is not the fill's to delete.
+        let earlier = root.path().join("earlier");
+        let mut files = write(&earlier, false);
+        files.spare.push(files.paths[0].clone());
+        drop(files);
+        assert!(earlier.join("fill_00000.png").exists(), "an earlier fill's frame stays");
+        assert!(!earlier.join("fill_00001.png").exists(), "the fill's own frame goes");
+        // A finished fill keeps its files.
+        let done = root.path().join("done");
+        let kept = write(&done, true).keep();
+        assert_eq!(kept.len(), 2);
+        assert!(kept.iter().all(|p| std::path::Path::new(p).exists()));
+    }
+}
diff --git a/crates/engine/src/commands/create.rs b/crates/engine/src/cmd/create.rs
similarity index 63%
rename from crates/engine/src/commands/create.rs
rename to crates/engine/src/cmd/create.rs
index 850d38ada..250ca836d 100644
--- a/crates/engine/src/commands/create.rs
+++ b/crates/engine/src/cmd/create.rs
@@ -1,15 +1,20 @@
 //! Layer ▸ Create: Convert to Editable Text (Photoshop type layers), Create Shapes from Text,
-//! Create Masks from Text and Create Shapes from Vector Layer (SVG footage).
+//! Create Masks from Text, Create Shapes from Vector Layer (SVG footage) and Create 3D Layer
+//! Instance (a 2D copy of a 3D model layer that 2D effects can be applied to).
 
 use effectcraft_color::Label;
-use effectcraft_project::{ItemKind, LayerSource, Solid};
+use effectcraft_keyframe::Value as KV;
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{ItemKind, LayerSource, MatteKind, Solid, TrackMatte};
 use serde_json::{Value, json};
 
 use super::{CommandSpec, bad, has_layers, layers_p, str_p};
 use crate::{EngineError, Result, Session, cmd};
 
-const OPS: &str = "editableText|shapesFromText|masksFromText|shapesFromVector";
+const OPS: &str = "editableText|shapesFromText|masksFromText|shapesFromVector|instance3d";
 
+/// Layer ▸ Create (`layer.create`): the `op` ([`OPS`]) on the given or selected layers; returns
+/// the created layer ids and what was skipped.
 fn create(s: &mut Session, p: &Value) -> Result<Value> {
     let op = str_p(p, "op").ok_or_else(|| bad("layer.create", format!("missing `op` ({OPS})")))?;
     let (cid, lids) = layers_p(s, p)?;
@@ -19,6 +24,69 @@ fn create(s: &mut Session, p: &Value) -> Result<Value> {
     let time = s.time();
     let mut created = vec![];
     let mut skipped = vec![];
+    // All the selected models in one edit: one undo (or redo) removes (or restores) every
+    // instance at once, as one command in the History panel.
+    if op == "instance3d" {
+        // After Effects' Create 3D Layer Instance (Layer ▸ Create): 3D model layers take
+        // no masks or effects, so a comp-sized solid goes at the top of the layer stack
+        // with a 3D Layer Instance effect referencing the model — a 2D copy of its render,
+        // through the comp's camera, that 2D effects can be applied to. The model is switched
+        // off, as After Effects does (back on to keep its shadow).
+        let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+        let mut eligible = vec![];
+        for lid in &lids {
+            match comp.layer(*lid) {
+                Some(src) if src.source.is_model() => eligible.push((*lid, src.clone())),
+                Some(src) => skipped.push(format!("{}: not a 3D model layer", src.name)),
+                None => {}
+            }
+        }
+        if !eligible.is_empty() {
+            let ids = s.edit("Create 3D Layer Instance", None, |proj, st| {
+                let mut ids = vec![];
+                for (lid, src) in &eligible {
+                    let name = proj.comp(cid).ok_or(EngineError::NoComp)?.unique_layer_name(&format!("{} Instance", src.name));
+                    let folder = proj.folder_named("Solids").unwrap_or_else(|| proj.add_item("Solids", Label::Yellow, None, ItemKind::Folder));
+                    let sid = proj.add_item(
+                        &name,
+                        src.label,
+                        Some(folder),
+                        ItemKind::Solid(Solid { color: [1.0, 1.0, 1.0], width: comp.width, height: comp.height, pixel_aspect: 1.0 }),
+                    );
+                    let mut l = build::layer(proj, &comp, &name, LayerSource::Solid { item: sid }, (comp.width, comp.height), None);
+                    // A soloed source keeps its Solo switch with video off, and any_solo hides
+                    // the non-soloed copy: the copy takes the Solo over to stay visible.
+                    l.switches.solo = src.switches.solo;
+                    // A 3D Layer Instance effect referencing the 3D layer: the solid shows its
+                    // render (the 2D copy).
+                    let fx = effectcraft_effects::find("ec.3d.instance3d").ok_or_else(|| bad("layer.create", "the 3D Layer Instance effect is missing"))?;
+                    let mut g = effectcraft_effects::instantiate(fx, &mut Ids(&mut proj.next_id), fx.name, [comp.width as f64, comp.height as f64]);
+                    if let Some(pr) = g.get_mut("layer") {
+                        pr.value = KV::Layer(Some(lid.0));
+                    }
+                    if let Some(fxg) = l.props.sub_mut("effects") {
+                        fxg.children.push(g.into());
+                    }
+                    // The model is switched off (After Effects turns the referenced layer off);
+                    // the copies go at the top of the stack, selected.
+                    let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+                    if let Some(m) = c.layers.iter_mut().find(|x| x.id == *lid) {
+                        m.switches.video = false;
+                    }
+                    let id = l.id;
+                    c.layers.insert(0, l);
+                    ids.push(id);
+                }
+                st.selected_layers = ids.clone();
+                Ok(ids)
+            })?;
+            created.extend(ids.iter().map(|i| i.0));
+        }
+        if created.is_empty() && !skipped.is_empty() {
+            return Err(bad("layer.create", skipped.join("; ")));
+        }
+        return Ok(json!({"layers": created, "skipped": skipped}));
+    }
     for lid in lids {
         let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
         let Some(src) = comp.layer(lid).cloned() else { continue };
@@ -33,8 +101,11 @@ fn create(s: &mut Session, p: &Value) -> Result<Value> {
                     continue;
                 };
                 let bytes = s.services.read_file(&f.path).map_err(|e| EngineError::Other(format!("cannot read {}: {e}", f.path)))?;
-                let doc = crate::vector::vector_doc(&f.path, &bytes, f.layer.as_ref(), f.page)
+                // In the source layer's pixels, as the footage is drawn (a placed page of an After
+                // Effects project fills the stored size, #3099).
+                let doc = crate::vector::footage_doc(&f, &bytes)
                     .unwrap_or_else(|| Err(format!("{}: not a vector file", f.path)))
+                    .map(|d| crate::vector::fitted_to_footage(d, &f))
                     .map_err(EngineError::Other)?;
                 // Images become footage layers (PNG files written next to the source and
                 // imported), parented to the shape layer below it.
@@ -57,7 +128,7 @@ fn create(s: &mut Session, p: &Value) -> Result<Value> {
                     // Without images: one shape layer. With images: the shapes between them
                     // in layers of their own, so the stack keeps the document's paint order.
                     let segments = if image_items.is_empty() { vec![doc.clone()] } else { crate::vector::split_at_images(&doc) };
-                    let top = crate::vector::shapes_from_vector(proj, &comp, &src, segments.last().unwrap_or(&doc));
+                    let mut top = crate::vector::shapes_from_vector(proj, &comp, &src, segments.last().unwrap_or(&doc));
                     // Top to bottom: the last segment, image n, segment n − 1, … image 1, segment 0.
                     let mut stack = vec![];
                     for k in (0..segments.len().saturating_sub(1)).rev() {
@@ -74,9 +145,25 @@ fn create(s: &mut Session, p: &Value) -> Result<Value> {
                         sl.name = format!("{} {}", top.name, k + 1);
                         stack.push(sl);
                     }
+                    // A placed page shows only its frame (the footage's raster ends there): every
+                    // layer made from it takes a hidden frame layer as its track matte (#3099).
+                    let matte = crate::vector::frame_matte(proj, &comp, &src, &f);
+                    if let Some(m) = &matte {
+                        let tm = Some(TrackMatte { layer: m.id, kind: MatteKind::Alpha });
+                        top.track_matte = tm;
+                        for l in &mut stack {
+                            l.track_matte = tm;
+                        }
+                    }
                     let mut ids = vec![top.id];
                     ids.extend(stack.iter().filter(|l| matches!(l.source, LayerSource::Shape)).map(|l| l.id));
-                    // Each directly above the source: the top layer first.
+                    // The frame matte is made too (last: the selection stays on the top layer).
+                    ids.extend(matte.as_ref().map(|m| m.id));
+                    // Each directly above the source: the frame matte (when there is one) above
+                    // all, then the top layer first.
+                    if let Some(m) = matte {
+                        insert_above(proj, cid, lid, m, true)?;
+                    }
                     insert_above(proj, cid, lid, top, true)?;
                     for l in stack {
                         insert_above(proj, cid, lid, l, true)?;
@@ -198,5 +285,5 @@ fn insert_above(
 }
 
 pub fn specs() -> Vec<CommandSpec> {
-    vec![cmd!("layer.create", "Create", [], None, "{op: editableText|shapesFromText|masksFromText|shapesFromVector, layers?}", has_layers, create)]
+    vec![cmd!("layer.create", "Create", [], None, "{op: editableText|shapesFromText|masksFromText|shapesFromVector|instance3d, layers?}", has_layers, create)]
 }
diff --git a/crates/engine/src/commands/edit.rs b/crates/engine/src/cmd/edit.rs
similarity index 85%
rename from crates/engine/src/commands/edit.rs
rename to crates/engine/src/cmd/edit.rs
index 019d56d1d..c2ecb838d 100644
--- a/crates/engine/src/commands/edit.rs
+++ b/crates/engine/src/cmd/edit.rs
@@ -1,11 +1,12 @@
 //! Edit menu.
 
 use effectcraft_color::Label;
-use effectcraft_project::{Comp, Expression, ItemKind, Layer, LayerId, LayerSource, TrackMatte};
+use effectcraft_keyframe::Value as KV;
+use effectcraft_project::{Comp, Expression, ItemId, ItemKind, Layer, LayerId, LayerSource, TrackMatte};
 use effectcraft_time::Tick;
 use serde_json::{Value, json};
 
-use super::{CommandSpec, has_comp, has_layers, layers_p, match_path_of, selected_leaf_props, str_p};
+use super::{CommandSpec, has_comp, has_layers, layers_or, layers_p, match_path_of, merge_p, selected_leaf_props, str_p};
 use crate::{EngineError, KeyRef, LinkClip, Result, Session, cmd};
 
 fn can_undo(s: &Session) -> std::result::Result<(), String> {
@@ -24,6 +25,7 @@ fn has_clip(s: &Session) -> std::result::Result<(), String> {
         && s.state.key_clipboard.is_empty()
         && s.state.effect_clipboard.is_empty()
         && s.state.contents_clipboard.is_empty()
+        && s.state.mask_clipboard.is_empty()
         && s.state.link_clipboard.is_none()
         && s.state.value_clipboard.is_empty()
     {
@@ -73,6 +75,10 @@ fn select_all(s: &mut Session, _: &Value) -> Result<Value> {
     Ok(json!(s.state.selected_layers.len()))
 }
 fn deselect_all(s: &mut Session, _: &Value) -> Result<Value> {
+    // A deselected layer never keeps an open text edit: commit it first, exactly as `text.endEdit`,
+    // so every route — menu, shortcut, script, MCP — leaves one final state. An empty Type-tool
+    // layer survives, as it does in After Effects.
+    super::text_edit::end_edit(s, &Value::Null)?;
     s.state.selected_layers.clear();
     s.state.selected_props.clear();
     s.state.selected_keys.clear();
@@ -85,7 +91,7 @@ fn deselect_all(s: &mut Session, _: &Value) -> Result<Value> {
 fn relink_copies(comp: &mut Comp, map: &[(LayerId, LayerId)]) {
     let present: Vec<LayerId> = comp.layers.iter().map(|l| l.id).collect();
     let link = |id: LayerId| map.iter().find(|(o, _)| *o == id).map(|(_, c)| *c).or(present.contains(&id).then_some(id));
-    for l in comp.layers.iter_mut().filter(|l| map.iter().any(|(_, c)| *c == l.id)) {
+    for l in comp.layers.iter_mut_where(|l| map.iter().any(|(_, c)| *c == l.id)) {
         l.parent = l.parent.and_then(link);
         l.track_matte = l.track_matte.and_then(|m| link(m.layer).map(|layer| TrackMatte { layer, ..m }));
     }
@@ -99,9 +105,16 @@ pub(crate) fn reid(layer: &mut Layer, next: &mut u64) {
     *next += 1;
 }
 
+/// `edit.duplicate`: copies the targets in place. Without `layers` the targets are, in order:
+/// during a text edit the edited layer (the edit is committed first, as `text.endEdit` does),
+/// else the selected effects, shape items or text animators, else the selected layers. Layer
+/// copies are selected and their ids returned; the other paths return their delegated result.
 fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
-    // Effects selected → duplicate them (Edit ▸ Duplicate in Effect Controls).
-    if p.get("layers").is_none() {
+    let editing = s.state.text_edit.is_some();
+    // Effects selected → duplicate them (Edit ▸ Duplicate in Effect Controls). An open text edit
+    // comes first, as it does for Clear: opening the editor keeps the property selection, but
+    // while typing, Duplicate means the edited layer, not an effect or item selected before.
+    if p.get("layers").is_none() && !editing {
         let fx = super::effect::selected_effects(s);
         if !fx.is_empty() {
             let mut out = vec![];
@@ -121,8 +134,19 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
             return super::prop_groups::duplicate_contents(s, &items);
         }
     }
-    let (cid, ids) = layers_p(s, p)?;
-    let new = s.edit("Duplicate", None, |proj, st| {
+    // A deselected layer never keeps an open text edit (#2226): the copies take the selection, so
+    // commit an open edit first, exactly as `text.endEdit` and Deselect All do — one call on the
+    // command path so every route (menu, shortcut, palette, MCP, script) ends the edit and leaves
+    // the same final state. Unnamed, the target is the edited layer even when an engine route
+    // selected another one meanwhile.
+    let edited = s.state.text_edit.as_ref().map(|e| e.layer);
+    super::text_edit::end_edit(s, &Value::Null)?;
+    let (cid, ids) = match edited {
+        Some(layer) => layers_or(s, p, &[layer])?,
+        None => layers_p(s, p)?,
+    };
+    // `merge` folds the copy and the drag that follows it (Alt-drag in the viewer) into one undo step.
+    let new = s.edit("Duplicate", merge_p(p), |proj, st| {
         let mut next = proj.next_id;
         let comp = proj.comp_mut(cid).ok_or(crate::EngineError::NoComp)?;
         let mut created = vec![];
@@ -138,52 +162,86 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
         }
         relink_copies(comp, &map);
         proj.next_id = next;
-        st.selected_layers = created.clone();
+        // The property, keyframe and mask-vertex selection the edit kept belongs to the originals;
+        // left in place, the next Duplicate or Clear would act on it, not on the copies. So during
+        // an edit the copies take the selection the way a click on them would.
+        if editing {
+            super::layer::select_only(st, created.clone());
+        } else {
+            st.selected_layers = created.clone();
+        }
         Ok(created)
     })?;
     Ok(json!(new.iter().map(|l| l.0).collect::<Vec<_>>()))
 }
 
+/// `edit.clear`: delegates to `text.delete` while editing text (deleting the selection or
+/// preceding character/word), then handles selected Time Remap (turning remapping off), keyframes, loose mask
+/// vertices, puppet pins, effects, masks/shape items/text animators/trackers, and finally the
+/// selected (or given) unlocked layers. Layer and selected-property-group paths return the number
+/// removed; text, Time Remap, keyframe, loose-vertex, puppet-pin and effect paths return their
+/// delegated command's result.
+///
+/// Layer removal also unparents surviving children in place, clears track mattes that pointed
+/// at a removed layer and rewrites layer-reference values and keys to `None` in the same undo
+/// step; the text-edit session is then sanitized so a removed layer's editor is not reused.
 fn delete(s: &mut Session, p: &Value) -> Result<Value> {
-    if s.state.text_edit.is_some() && p.get("layers").is_none() {
-        return s.execute("text.delete", json!({}));
+    if let Some(done) = delete_selection(s, p)? {
+        return Ok(done);
+    }
+    let (cid, ids) = layers_p(s, p)?;
+    let ids = super::unlocked(s, cid, ids, "edit.clear")?;
+    clear_layers(s, cid, &ids)?;
+    // A removed layer may have been the edited one: end that session before another command
+    // can reuse it. Undo restores a layer as a new editor, never by reviving the old IME session.
+    s.sanitize_state();
+    Ok(json!(ids.len()))
+}
+
+/// Deletes the selected things that are not layers. `None` when the layers are deleted
+/// instead (nothing else is selected, or the command names its layers).
+fn delete_selection(s: &mut Session, p: &Value) -> Result<Option<Value>> {
+    let no_layers = p.get("layers").is_none();
+    if s.state.text_edit.is_some() && no_layers {
+        return Ok(Some(s.execute("text.delete", json!({}))?));
     }
     // Time Remap selected (its name, which selects all its keys) → time remapping off, not the
     // layer (After Effects).
-    if p.get("layers").is_none() {
+    if no_layers {
         let remapped = super::layer_time::selected_time_remap(s);
         if !remapped.is_empty() {
-            return super::layer_time::disable_time_remap(s, &remapped);
+            return Ok(Some(super::layer_time::disable_time_remap(s, &remapped)?));
         }
     }
     // Keyframes selected → delete keys; mask vertices → delete them; else layers.
-    if !s.state.selected_keys.is_empty() && p.get("layers").is_none() {
-        return s.execute("keys.delete", json!({}));
+    if !s.state.selected_keys.is_empty() && no_layers {
+        return Ok(Some(s.execute("keys.delete", json!({}))?));
     }
     // (Points selected with their mask, which selecting a mask does: the mask goes, below.)
     let comp = s.active_comp();
     let loose = s.state.selected_vertices.iter().any(|v| {
         !s.state.selected_props.contains(&(v.layer, v.mask)) && comp.and_then(|c| c.layer(v.layer)).is_some_and(|l| l.props.find_group(v.mask).is_some())
     });
-    if loose && p.get("layers").is_none() {
-        return s.execute("mask.deleteVertices", json!({}));
+    if loose && no_layers {
+        return Ok(Some(s.execute("mask.deleteVertices", json!({}))?));
     }
     // Puppet pins selected → delete the pins (not their layer).
-    if p.get("layers").is_none() && !super::puppet::selected_pins(s).is_empty() {
-        return s.execute("puppet.removePin", json!({}));
+    if no_layers && !super::puppet::selected_pins(s).is_empty() {
+        return Ok(Some(s.execute("puppet.removePin", json!({}))?));
     }
     // Effects selected → remove them.
-    if p.get("layers").is_none() && !super::effect::selected_effects(s).is_empty() {
-        return s.execute("effect.remove", json!({}));
+    if no_layers && !super::effect::selected_effects(s).is_empty() {
+        return Ok(Some(s.execute("effect.remove", json!({}))?));
     }
     // Masks, shape items, text animators or trackers selected → remove them.
-    if p.get("layers").is_none()
-        && let Some(n) = super::prop_groups::remove_selected(s)?
-    {
-        return Ok(n);
+    if no_layers && let Some(n) = super::prop_groups::remove_selected(s)? {
+        return Ok(Some(n));
     }
-    let (cid, ids) = layers_p(s, p)?;
-    let ids = super::unlocked(s, cid, ids, "edit.clear")?;
+    Ok(None)
+}
+
+/// Removes layers `ids` from comp `cid` in one undoable step, and clears what referred to them.
+fn clear_layers(s: &mut Session, cid: ItemId, ids: &[LayerId]) -> Result<()> {
     // Children of deleted layers are unparented where they are (like After Effects).
     let comp = s.project.comp(cid).ok_or(crate::EngineError::NoComp)?;
     let orphans: Vec<LayerId> = comp.layers.iter().filter(|l| !ids.contains(&l.id) && l.parent.is_some_and(|p| ids.contains(&p))).map(|l| l.id).collect();
@@ -201,13 +259,27 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
             if l.track_matte.is_some_and(|m| ids.contains(&m.layer)) {
                 l.track_matte = None;
             }
+            // A layer-reference property (an Environment light's Source, an effect's Clone Source,
+            // Back Layer…) must read as None once its layer is gone, in this same history step: a
+            // dead id renders as nothing while the UI shows "None", which means "fall back to the
+            // comp's Environment Layer" (#2153). Keys carry the same value kind as the property.
+            l.props.walk_mut(&mut |p| {
+                let dead = |v: &KV| matches!(v, KV::Layer(Some(id)) if ids.contains(&LayerId(*id)));
+                if dead(&p.value) {
+                    p.value = KV::Layer(None);
+                }
+                for k in &mut p.keys {
+                    if dead(&k.value) {
+                        k.value = KV::Layer(None);
+                    }
+                }
+            });
         }
         st.selected_layers.clear();
         st.selected_props.clear();
         st.selected_keys.clear();
         Ok(())
-    })?;
-    Ok(json!(ids.len()))
+    })
 }
 
 fn clear_clipboards(s: &mut Session) {
@@ -215,8 +287,10 @@ fn clear_clipboards(s: &mut Session) {
     s.state.key_clipboard.clear();
     s.state.effect_clipboard.clear();
     s.state.contents_clipboard.clear();
+    s.state.mask_clipboard.clear();
     s.state.link_clipboard = None;
     s.state.value_clipboard.clear();
+    s.state.keyframe_text = None;
     s.state.clip_is_keys = false;
 }
 
@@ -240,6 +314,16 @@ fn copy(s: &mut Session, p: &Value) -> Result<Value> {
     if p.get("layers").is_none() && !super::effect::selected_effects(s).is_empty() {
         return s.execute("effect.copy", json!({}));
     }
+    // Masks selected → copy them (not their layer), for Paste onto other layers (#2091), unless
+    // a layer is named explicitly.
+    if p.get("layers").is_none() && p.get("layer").is_none_or(Value::is_null) {
+        let masks = super::prop_groups::copy_masks(s);
+        if !masks.is_empty() {
+            clear_clipboards(s);
+            s.state.mask_clipboard = masks;
+            return Ok(json!({"masks": s.state.mask_clipboard.len()}));
+        }
+    }
     // Shape items selected in a shape layer's Contents → copy them (not their layer).
     if p.get("layers").is_none() {
         let items = super::prop_groups::copy_contents(s);
@@ -283,10 +367,12 @@ fn copy_properties(s: &mut Session) -> Result<Option<Value>> {
     }
     let mut keys = s.state.selected_keys.clone();
     let mut values = vec![];
+    let mut statics = vec![];
     for (lid, uid) in &leaves {
         let Some(l) = comp.layer(*lid) else { continue };
         let Some(pr) = l.props.find(*uid) else { continue };
         if pr.keys.is_empty() {
+            statics.push((*lid, *uid));
             if let Some(path) = l.props.match_path_of(*uid)
                 && !values.iter().any(|(p, _)| *p == path)
             {
@@ -296,6 +382,7 @@ fn copy_properties(s: &mut Session) -> Result<Option<Value>> {
             keys.extend(pr.keys.iter().map(|k| KeyRef { layer: *lid, prop: *uid, time: k.time }));
         }
     }
+    let text = crate::keyframe_text::text(&s.project, comp, &keys, &statics);
     clear_clipboards(s);
     let mut n = 0;
     if !keys.is_empty() {
@@ -304,6 +391,7 @@ fn copy_properties(s: &mut Session) -> Result<Option<Value>> {
         s.state.selected_keys = selected;
         n = r?.as_u64().unwrap_or(0);
     }
+    s.state.keyframe_text = text;
     let v = values.len();
     s.state.value_clipboard = values;
     // Keys alone answer as `keys.copy` does (their count).
@@ -522,6 +610,9 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
     if !s.state.contents_clipboard.is_empty() {
         return super::prop_groups::paste_contents(s, p);
     }
+    if !s.state.mask_clipboard.is_empty() {
+        return super::prop_groups::paste_masks(s, p);
+    }
     let cid = super::comp_id(s, p)?;
     let clip = s.state.clipboard.clone();
     let new = s.edit("Paste", None, |proj, st| {
@@ -629,7 +720,7 @@ fn label(s: &mut Session, p: &Value) -> Result<Value> {
             }
         }
         if let Some(comp) = proj.comp_mut(cid) {
-            for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+            for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
                 l.label = lab;
             }
         }
@@ -801,10 +892,12 @@ pub(crate) fn disk_stats(s: &mut Session, _: &Value) -> Result<Value> {
         "layers": dc.keys(effectcraft_render::disk_cache::Kind::Layer).len(),
         "bytes": st.bytes,
         "maxBytes": st.max_bytes,
+        "limitBytes": st.limit_bytes,
         "hits": st.hits,
         "misses": st.misses,
         "writes": st.writes,
         "evictions": st.evictions,
+        "failed": st.failed,
     }))
 }
 
@@ -827,7 +920,7 @@ fn original_path(s: &Session) -> Option<String> {
 /// importer takes. Anything else (a folder or app bundle, a script, a shortcut) is refused.
 pub(crate) fn openable_original(path: &str) -> std::result::Result<(), String> {
     let media = |p: &std::path::Path| {
-        let ext = p.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).unwrap_or_default();
+        let ext = p.extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).unwrap_or_default();
         crate::media_browser::kind_of(&p.to_string_lossy()).is_some_and(|k| k != "project") || matches!(ext.as_str(), "pdf" | "ai" | "eps")
     };
     let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
@@ -910,7 +1003,15 @@ pub fn specs() -> Vec<CommandSpec> {
             paste_reversed
         ),
         cmd!("edit.clear", "Clear", ["Edit"], Some("Delete"), "{layers?}", layers_or_keys, delete),
-        cmd!("edit.duplicate", "Duplicate", ["Edit"], Some("Cmd+D"), "{layers?} (effects or shape items when they are selected)", has_layers, duplicate),
+        cmd!(
+            "edit.duplicate",
+            "Duplicate",
+            ["Edit"],
+            Some("Cmd+D"),
+            "{layers?, merge?} (without layers: during a text edit the edited layer, else the selected effects, shape items or text animators, else the selected layers)",
+            layers_or_text_edit,
+            duplicate
+        ),
         cmd!("edit.splitLayer", "Split Layer", ["Edit"], Some("Cmd+Shift+D"), "{layers?}", has_layers, split),
         cmd!("edit.liftWorkArea", "Lift Work Area", ["Edit"], None, "{layers?}", has_comp, lift),
         cmd!("edit.extractWorkArea", "Extract Work Area", ["Edit"], None, "{layers?}", has_comp, extract),
@@ -980,6 +1081,11 @@ fn layers_or_keys(s: &Session) -> std::result::Result<(), String> {
     if !s.state.selected_keys.is_empty() || !s.state.selected_vertices.is_empty() { super::has_comp(s) } else { has_layers(s) }
 }
 
+/// Duplicate's unnamed target: the edited layer during a text edit, else the selection.
+fn layers_or_text_edit(s: &Session) -> std::result::Result<(), String> {
+    if s.state.text_edit.is_some() { super::has_comp(s) } else { has_layers(s) }
+}
+
 fn always_ok(_: &Session) -> std::result::Result<(), String> {
     Ok(())
 }
diff --git a/crates/engine/src/cmd/effect.rs b/crates/engine/src/cmd/effect.rs
new file mode 100644
index 000000000..1ee132955
--- /dev/null
+++ b/crates/engine/src/cmd/effect.rs
@@ -0,0 +1,1426 @@
+//! Effect menu and Effect Controls gestures.
+
+use effectcraft_project::build::Ids;
+use effectcraft_project::{GroupKind, Layer, LayerId, PropGroup, Uid};
+use effectcraft_time::Tick;
+use serde_json::{Value, json};
+
+use super::{CommandSpec, b_p, bad, f_p, has_layers, layer_mut, layers_p, str_p};
+use crate::{EngineError, Result, Session, cmd};
+
+/// `effect.plugins.list`: the registered plug-in effects (WebAssembly or Rust).
+fn plugins_list(s: &mut Session, _: &Value) -> Result<Value> {
+    use effectcraft_effects::plugin;
+    let list: Vec<Value> = plugin::plugins()
+        .into_iter()
+        .map(|spec| {
+            let p = plugin::plugin(spec.id);
+            let m = p.as_ref().map(|p| p.manifest().clone());
+            json!({
+                "id": spec.id,
+                "name": spec.name,
+                "category": spec.category,
+                "version": m.as_ref().map(|m| m.version.clone()),
+                "author": m.as_ref().map(|m| m.author.clone()),
+                "description": m.as_ref().map(|m| m.description.clone()),
+                "source": p.map(|p| p.source()),
+                "error": plugin::plugin_error(spec.id),
+                "params": spec.params.iter().map(|p| p.id).collect::<Vec<_>>(),
+            })
+        })
+        .collect();
+    Ok(json!({"api": plugin::PLUGIN_API_VERSION, "wasm": s.plugin_loader.is_some(), "helpers": s.helpers.is_some(), "plugins": list}))
+}
+
+/// `effect.plugins.load`: load WebAssembly effect plug-ins (a file, or every `.wasm` in a
+/// folder) through the host's loader ([`Session::plugin_loader`]).
+fn plugins_load(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "effect.plugins.load";
+    let loader = s.plugin_loader.ok_or_else(|| EngineError::Other("WebAssembly effect plug-ins are not available in this build".into()))?;
+    let files: Vec<String> = match (str_p(p, "path"), str_p(p, "folder")) {
+        (Some(path), _) => vec![path.to_string()],
+        (None, Some(dir)) => {
+            let mut v: Vec<String> = std::fs::read_dir(dir)
+                .map_err(|e| bad(c, format!("cannot list {dir}: {e}")))?
+                .flatten()
+                .map(|e| e.path())
+                .filter(|p| p.extension().is_some_and(|x| x.eq_ignore_ascii_case("wasm")))
+                .map(|p| p.to_string_lossy().to_string())
+                .collect();
+            v.sort();
+            v
+        }
+        _ => return Err(bad(c, "give `path` or `folder`")),
+    };
+    let (mut loaded, mut errors) = (vec![], vec![]);
+    for f in &files {
+        let r = s.services.read_file(f).map_err(|e| format!("cannot read {f}: {e}")).and_then(|bytes| loader(&bytes, f));
+        match r {
+            Ok(v) => loaded.push(v),
+            Err(e) => errors.push(json!({"path": f, "error": e})),
+        }
+    }
+    if str_p(p, "path").is_some()
+        && let Some(e) = errors.first()
+    {
+        return Err(EngineError::Other(format!("{}: {}", files[0], e["error"].as_str().unwrap_or("failed"))));
+    }
+    if !loaded.is_empty() {
+        s.toast(format!("Loaded {} effect plug-in(s)", loaded.len()));
+    }
+    Ok(json!({"loaded": loaded, "errors": errors}))
+}
+
+/// The settings-folder name the desktop app scans for WebAssembly effect plug-ins on start.
+/// The scan uses this constant ([`apps/effectcraft/src/main.rs`]), so the two cannot drift.
+pub const PLUGINS_DIR: &str = "Plug-ins";
+
+/// The most one installed file may be: a plug-in is a compiled effect, a panel is script text.
+/// Above this the install refuses rather than reading an unbounded file into memory and copying
+/// it into a folder the app loads at every start.
+const MAX_INSTALL_BYTES: u64 = 64 << 20;
+
+/// `effect.plugins.install`: install WebAssembly effect plug-ins so they load on every start,
+/// not only in this session (Load Effect Plug-in keeps the file where it is and just loads it).
+/// `path` installs one `.wasm`; `folder` installs a bundle in one go: every `.wasm` at its top
+/// level is copied into the Plug-ins folder and every `.jsx` becomes a ScriptUI panel. What
+/// installs also loads in this session at once, so the effect menu has it immediately. A `.wasm`
+/// that fails to load is not copied: a broken plug-in must not fail every start.
+fn plugins_install(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "effect.plugins.install";
+    let loader = s.plugin_loader.ok_or_else(|| EngineError::Other("WebAssembly effect plug-ins are not available in this build".into()))?;
+    let cfg = s.config.clone().ok_or_else(|| EngineError::Other("this session has no settings folder to install plug-ins into".into()))?;
+    let root = cfg.dir().ok_or_else(|| EngineError::Other("this session has no settings folder to install plug-ins into".into()))?;
+    // The folder the Plug-in Library installs next to (`Session::plugins_dir`: the host's, else
+    // `Plug-ins` next to the settings), so both kinds of install live in one place.
+    let plug_dir = s.plugins_dir().unwrap_or_else(|| root.join(PLUGINS_DIR));
+    let single = str_p(p, "path").is_some();
+    let mut listing_errors: Vec<Value> = Vec::new();
+    let sources: Vec<std::path::PathBuf> = match (str_p(p, "path"), str_p(p, "folder")) {
+        (Some(path), _) => vec![std::path::PathBuf::from(path)],
+        (None, Some(dir)) => {
+            let read = std::fs::read_dir(dir).map_err(|e| bad(c, format!("cannot list {dir}: {e}")))?;
+            let mut v = Vec::new();
+            for entry in read {
+                match entry {
+                    Ok(e) => match e.path().metadata() {
+                        Ok(m) if m.is_file() => v.push(e.path()),
+                        // A vanished or unreadable entry is a bundle problem: report it rather
+                        // than installing a bundle that silently misses files. (`is_file()`
+                        // alone would treat unreadable metadata as "not a file" and skip it.)
+                        Err(e) => listing_errors.push(json!({"error": format!("cannot read the bundle folder: {e}")})),
+                        Ok(_) => {}
+                    },
+                    Err(e) => listing_errors.push(json!({"error": format!("cannot read the bundle folder: {e}")})),
+                }
+            }
+            v.sort();
+            v
+        }
+        _ => return Err(bad(c, "give `path` (a .wasm plug-in) or `folder` (a plug-in bundle)")),
+    };
+    let mut errors = listing_errors;
+    let mut installed = Vec::new();
+    let mut loaded = Vec::new();
+    let mut panels = Vec::new();
+    for src in &sources {
+        let name = src.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
+        if name.is_empty() || name.starts_with('.') {
+            // A bundle's hidden files (`.DS_Store`, `._x.wasm` resource forks) are skipped; a
+            // single install must not report success for a file it skipped.
+            if single {
+                return Err(bad(c, format!("`{}` is not a plug-in file name (hidden files are not installed)", src.display())));
+            }
+            continue;
+        }
+        let is_wasm = src.extension().is_some_and(|x| x.eq_ignore_ascii_case("wasm"));
+        let is_panel = src.extension().is_some_and(|x| x.eq_ignore_ascii_case("jsx"));
+        if single {
+            if !is_wasm {
+                return Err(bad(c, "an effect plug-in install is a `.wasm` file"));
+            }
+        } else if !is_wasm && !is_panel {
+            continue; // a bundle may carry readmes, manifests and source: skip them
+        }
+        let body: std::result::Result<(), String> = (|| {
+            // The name the installed file gets, so it must be one the Scripts menu lists and
+            // `file.uninstallScript` accepts (like `file.installScript`'s): one bare component,
+            // and on Windows not a device name or one Windows rewrites.
+            if !super::scripts::is_bare_name(&name) || (cfg!(windows) && super::scripts::windows_unsafe_name(&name)) {
+                return Err(format!("`{name}` is not a file name that can be installed"));
+            }
+            // Never silently replace an installed file: a name collision is either a re-install
+            // the user did not ask to overwrite or a bundle that would shadow a working plug-in,
+            // and the update path is explicit (remove the old one first).
+            if is_panel {
+                let key = format!("{}/{name}", super::scripts::PANELS_DIR);
+                // Listed, not read: an existing panel whose text cannot be read is still a panel
+                // and must not be replaced (reading it would report it as absent). Compared
+                // ignoring case and checked on disk too: on Windows and macOS `my panel.jsx` is
+                // `My Panel.jsx`, and writing it would replace that panel.
+                let lower = name.to_lowercase();
+                if cfg.list(super::scripts::PANELS_DIR).iter().any(|n| n.to_lowercase() == lower) || cfg.files().is_file(&root.join(&key)) {
+                    return Err(format!("{name} is already installed as a ScriptUI panel; remove it from the Scripts/ScriptUI Panels folder first to update"));
+                }
+                let bytes = s.services.read_file_bounded(&src.to_string_lossy(), MAX_INSTALL_BYTES).map_err(|e| format!("cannot read it: {e}"))?;
+                let code = String::from_utf8(bytes).map_err(|_| "panels are UTF-8 text (.jsx)".to_string())?;
+                cfg.write(&key, &code).map_err(|e| format!("cannot install panel: {e}"))?;
+                panels.push(json!(name));
+                return Ok(());
+            }
+            let target = plug_dir.join(&name);
+            if cfg.files().is_file(&target) {
+                return Err(format!("{name} is already installed; remove it from the Plug-ins folder first to update"));
+            }
+            let bytes = s.services.read_file_bounded(&src.to_string_lossy(), MAX_INSTALL_BYTES).map_err(|e| format!("cannot read it: {e}"))?;
+            cfg.files().write(&target, &bytes).map_err(|e| format!("cannot write into the Plug-ins folder: {e}"))?;
+            // Load in-session now: a plug-in that cannot load is rolled back, so a broken
+            // plug-in never makes every start fail.
+            // Its source is the installed copy (what `effect.plugins.list` shows and the next
+            // start loads), not the file it was installed from.
+            match loader(&bytes, &target.to_string_lossy()) {
+                Ok(v) => {
+                    loaded.push(v);
+                    installed.push(json!(name));
+                    Ok(())
+                }
+                Err(e) => match cfg.files().remove(&target) {
+                    Ok(()) => Err(format!("it does not load, nothing was installed: {e}")),
+                    // Never say "nothing was installed" when the invalid copy is still there:
+                    // every start would report it and a re-install would say "already installed".
+                    Err(re) => Err(format!(
+                        "it does not load and its copy could not be removed from the Plug-ins folder ({re}): delete `{name}` there, or every start reports it; {e}"
+                    )),
+                },
+            }
+        })();
+        match body {
+            Ok(()) => {}
+            Err(e) => {
+                if single {
+                    return Err(bad(c, format!("{name}: {e}")));
+                }
+                errors.push(json!({"file": name, "error": e}));
+            }
+        }
+    }
+    if !panels.is_empty() {
+        s.scripts_changed();
+    }
+    if !installed.is_empty() || !panels.is_empty() {
+        let mut toast = format!("Installed {} effect plug-in(s)", installed.len());
+        if !panels.is_empty() {
+            toast.push_str(&format!(" and {} ScriptUI panel(s)", panels.len()));
+        }
+        toast.push_str(": they load on every start");
+        s.toast(toast);
+    }
+    Ok(json!({"installed": installed, "panels": panels, "loaded": loaded, "errors": errors}))
+}
+
+/// External effect helpers need a host that runs them.
+fn has_helpers(s: &Session) -> std::result::Result<(), String> {
+    if s.helpers.is_some() { Ok(()) } else { Err("effect helpers are not available in this build".into()) }
+}
+
+/// The host's helper hooks, for the commands that start helpers. Helpers run native code, so a
+/// script may start them only with Allow Scripts to Write Files and Access Network on (as for
+/// File.execute()).
+fn helper_hooks(s: &Session, c: &str) -> Result<crate::HelperHooks> {
+    if s.running_for_script() && !s.prefs.scripting.allow_scripts_write_files {
+        return Err(bad(
+            c,
+            "scripts can't start effect helpers unless Settings ▸ Scripting & Expressions ▸ Allow Scripts to Write Files and Access Network is on",
+        ));
+    }
+    s.helpers.ok_or_else(|| EngineError::Other("effect helpers are not available in this build".into()))
+}
+
+/// `effect.helpers.list`: the external effect helpers and their state.
+fn helpers_list(s: &mut Session, _: &Value) -> Result<Value> {
+    Ok(match s.helpers {
+        Some(h) => (h.list)(),
+        None => json!({"helpers": [], "blocked": [], "available": false}),
+    })
+}
+
+/// `effect.helpers.scan`: start the installed helpers that aren't running and register their
+/// effects. One bad helper doesn't stop the rest; `retry: true` turns blocked effects back on.
+fn helpers_scan(s: &mut Session, p: &Value) -> Result<Value> {
+    let h = helper_hooks(s, "effect.helpers.scan")?;
+    let r = (h.scan)(b_p(p, "retry").unwrap_or(false));
+    let n = r["loaded"].as_array().map_or(0, Vec::len);
+    if n > 0 {
+        s.toast(format!("{n} effect(s) from effect helpers"));
+    }
+    Ok(r)
+}
+
+/// `effect.helpers.load`: load a file or folder through the helpers that accept it (an OpenFX
+/// helper takes `.ofx` plug-ins, for example).
+fn helpers_load(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "effect.helpers.load";
+    let h = helper_hooks(s, c)?;
+    let path = str_p(p, "path").ok_or_else(|| bad(c, "missing `path`"))?;
+    let r = (h.load)(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let n = r["loaded"].as_array().map_or(0, Vec::len);
+    if n > 0 {
+        s.toast(format!("Loaded {n} effect(s) through a helper"));
+    }
+    Ok(r)
+}
+
+fn apply(s: &mut Session, p: &Value) -> Result<Value> {
+    let name = str_p(p, "effect").ok_or_else(|| bad("effect.apply", "missing `effect` (id or name)"))?;
+    let spec = effectcraft_effects::lookup(name).ok_or_else(|| bad("effect.apply", format!("unknown effect `{name}`")))?;
+    let (cid, ids) = layers_p(s, p)?;
+    if ids.is_empty() {
+        return Err(bad("effect.apply", "no layer"));
+    }
+    let sizes: Vec<_> = {
+        let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+        ids.iter().filter_map(|id| comp.layer(*id)).map(|l| (l.id, effectcraft_render::effect_bounds(&s.project, comp, l).0)).collect()
+    };
+    let uids = s.edit(&format!("Apply {}", spec.name), None, |proj, st| {
+        let mut out = vec![];
+        for (lid, size) in &sizes {
+            let mut next = proj.next_id;
+            let l = layer_mut(proj, cid, *lid)?;
+            let fx = l.props.sub_mut("effects").ok_or_else(|| bad("effect.apply", "this layer type has no effects"))?;
+            let same = fx.groups().filter(|g| g.match_id == spec.id).count();
+            let name = if same == 0 { spec.name.to_string() } else { format!("{} {}", spec.name, same + 1) };
+            let g = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), &name, *size);
+            out.push(g.uid);
+            fx.children.push(g.into());
+            proj.next_id = next;
+            st.selected_props = vec![(*lid, *out.last().unwrap_or(&0))];
+        }
+        st.last_effect = Some(spec.id.to_string());
+        Ok(out)
+    })?;
+    // Each instance's property path prefix (`effects/#2`), ready for prop.set paths.
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let paths: Vec<Value> = sizes
+        .iter()
+        .zip(&uids)
+        .map(|((lid, _), uid)| {
+            let n = comp.layer(*lid).and_then(|l| l.props.group("effects")).and_then(|fx| fx.children.iter().position(|c| c.uid() == *uid));
+            json!(n.map(|n| format!("effects/#{}", n + 1)))
+        })
+        .collect();
+    Ok(json!({"effects": uids, "paths": paths, "effect": spec.id}))
+}
+
+fn find_fx(s: &Session, p: &Value, cmd: &str) -> Result<(effectcraft_project::ItemId, effectcraft_project::LayerId, Uid)> {
+    let (cid, lid) = super::layer_p(s, p, cmd)?;
+    let layer = s.project.comp(cid).and_then(|c| c.layer(lid)).ok_or(EngineError::NoComp)?;
+    let fx = layer.effects().ok_or_else(|| bad(cmd, "no effects"))?;
+    let g = match p.get("effect") {
+        Some(Value::Number(n)) => {
+            let n = n.as_u64().unwrap_or(0);
+            fx.groups().find(|g| g.uid == n).or_else(|| usize::try_from(n.saturating_sub(1)).ok().and_then(|i| fx.groups().nth(i)))
+        }
+        Some(Value::String(name)) => fx.groups().find(|g| &g.name == name || g.match_id == *name),
+        _ => s.state.selected_props.iter().find_map(|(l, u)| (*l == lid).then(|| fx.groups().find(|g| g.uid == *u)).flatten()),
+    }
+    .ok_or_else(|| bad(cmd, "no such effect"))?;
+    Ok((cid, lid, g.uid))
+}
+
+/// `effect.warning`: what Effect Controls warns about an effect (a custom OCIO config it can't
+/// read, or transforms it passes through), `null` when it renders as asked.
+fn warning(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "effect.warning";
+    let (cid, lid, uid) = find_fx(s, p, cmd)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    let g = layer.effects().and_then(|fx| fx.groups().find(|g| g.uid == uid)).ok_or_else(|| bad(cmd, "no such effect"))?;
+    let t = super::time_p(s, p, Some(comp));
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    Ok(json!({"effect": uid, "warning": effectcraft_effects::warning(g, &mut |pr| ctx.value(layer, pr))}))
+}
+
+/// A colour parameter's eyedropper on a keyer (Effect Controls): the colour of the effect's input
+/// (the layer's pixels before this effect, so a keyed screen can still be picked) at a
+/// layer-space point, set on the parameter. `average` takes the 5 × 5 pixels around it.
+fn pick_color(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "effect.pickColor";
+    let (cid, lid, fx_uid) = find_fx(s, p, cmd)?;
+    let (Some(x), Some(y)) = (f_p(p, "x"), f_p(p, "y")) else { return Err(bad(cmd, "missing `x` / `y` (layer pixels)")) };
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    let fx = layer.effects().ok_or_else(|| bad(cmd, "no effects"))?;
+    let index = fx.groups().position(|g| g.uid == fx_uid).ok_or_else(|| bad(cmd, "no such effect"))?;
+    let g = fx.groups().nth(index).ok_or_else(|| bad(cmd, "no such effect"))?;
+    let prop = match (p.get("prop").and_then(Value::as_u64), str_p(p, "param")) {
+        (Some(uid), _) => g.find(uid),
+        (None, Some(path)) => g.prop(path),
+        _ => return Err(bad(cmd, "missing `param` (e.g. `screenColour`) or `prop` (uid)")),
+    }
+    .filter(|pr| pr.ui == effectcraft_project::ParamUi::Color)
+    .ok_or_else(|| bad(cmd, "not a colour parameter of this effect"))?;
+    let t = super::time_p(s, p, Some(comp));
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let mut r = effectcraft_render::Renderer::new(&s.project, &*s.footage, effectcraft_render::RenderOpts::default());
+    r.expr = s.expr.as_deref();
+    r.cache = Some(&s.layer_cache);
+    let buf = r.layer_input(&ctx, layer, index).ok_or_else(|| bad(cmd, "this layer has no pixels"))?;
+    let (px, py) = buf.to_px([x, y]);
+    let (cx, cy) = (px.floor() as i64, py.floor() as i64);
+    let rad = if b_p(p, "average") == Some(true) { 2 } else { 0 };
+    let mut sum = [0.0f32; 4];
+    for yy in cy.saturating_sub(rad)..=cy.saturating_add(rad) {
+        for xx in cx.saturating_sub(rad)..=cx.saturating_add(rad) {
+            // Outside the layer reads as transparent.
+            let c = buf.img.get(xx, yy);
+            (0..4).for_each(|i| sum[i] += c[i]);
+        }
+    }
+    if sum[3] <= 1e-6 {
+        return Err(bad(cmd, "nothing to sample there (transparent or outside the layer)"));
+    }
+    // Straight colour of the (averaged) premultiplied pixels.
+    let color: Vec<f64> = (0..3).map(|i| (sum[i] / sum[3]).clamp(0.0, 1.0) as f64).chain([1.0]).collect();
+    let uid = prop.uid;
+    s.execute("prop.set", json!({"comp": cid.0, "layer": lid.0, "prop": uid, "value": color}))?;
+    Ok(json!({"prop": uid, "color": color}))
+}
+
+/// What a Cryptomatte effect has at a layer-space point: the ID with the most coverage in its
+/// Cryptomatte layer, with the aux channels (for the manifest) and the effect's Selection.
+struct CryptoHit {
+    at: (effectcraft_project::ItemId, LayerId, Tick),
+    probe: std::sync::Arc<CryptoProbe>,
+    aux: std::sync::Arc<effectcraft_raster::AuxChannels>,
+    layer: String,
+    hash: u32,
+    selection: String,
+    prop: Uid,
+    /// The Selection has an expression: setting its value wouldn't change what it reads.
+    driven: bool,
+}
+
+impl CryptoHit {
+    fn manifest(&self) -> Option<&[(String, u32)]> {
+        self.aux.manifests.iter().find(|(l, _)| *l == self.layer).map(|(_, m)| m.as_slice())
+    }
+    fn reply(&self, sel: &str) -> Value {
+        let selected = effectcraft_effects::selection_hashes(sel, self.manifest()).contains(&self.hash);
+        let name = self.aux.manifest_name(&self.layer, self.hash);
+        json!({"name": name, "hash": format!("{:08x}", self.hash), "layer": self.layer, "selected": selected})
+    }
+}
+
+/// What a pick at one frame needs besides the point: the aux channels the Cryptomatte effect
+/// reads, its layer, and the effect's input buffer grid (scale, offset). Building it can render
+/// (a precomp's ID pass, the effects before the Cryptomatte effect); a point lookup in it is a
+/// few array reads. The session keeps the last one (see [`Session::crypto_probe_job`]).
+pub struct CryptoProbe {
+    key: ProbeKey,
+    grid: std::result::Result<ProbeGrid, String>,
+}
+
+#[derive(Clone)]
+struct ProbeGrid {
+    aux: std::sync::Arc<effectcraft_raster::AuxChannels>,
+    layer: String,
+    scale: f64,
+    offset: [f64; 2],
+}
+
+/// What a probe depends on: the project revision, the effect (and its index), the frame, the
+/// scale and the render prefs ([`Session::render_opts`]: nested switches, draft shadows).
+#[derive(Clone, Copy, PartialEq, Debug)]
+struct ProbeKey {
+    revision: u64,
+    at: (effectcraft_project::ItemId, LayerId, Uid, usize),
+    frame: ProbeFrame,
+    scale: f64,
+    prefs: (bool, bool),
+}
+
+/// The frame a probe reads. On footage whose masks and effects up to the Cryptomatte effect
+/// don't change over time, its source frame: a still has one, held or remapped frames share
+/// theirs. Otherwise the comp time.
+#[derive(Clone, Copy, PartialEq, Debug)]
+enum ProbeFrame {
+    Source(i64),
+    Comp(Tick),
+}
+
+/// The session's kept probe, and the generation of the latest request: a build stores its
+/// result only while no newer request or edit came since.
+#[derive(Default)]
+pub struct CryptoProbeSlot {
+    probe: Option<std::sync::Arc<CryptoProbe>>,
+    want: Option<ProbeKey>,
+    generation: u64,
+    /// Jobs run (each on its thread), and those that built (not cancelled before they began).
+    jobs: u64,
+    builds: u64,
+}
+
+impl CryptoProbeSlot {
+    /// Drop the kept probe and cancel builds in flight.
+    pub(crate) fn clear(&mut self) {
+        (self.probe, self.want) = (None, None);
+        self.generation += 1;
+    }
+    pub(crate) fn kept(&self) -> bool {
+        self.probe.is_some()
+    }
+    pub(crate) fn builds(&self) -> (u64, u64) {
+        (self.jobs, self.builds)
+    }
+}
+
+/// A probe built off the UI thread into the session's slot.
+pub type CryptoProbeJob = Box<dyn FnOnce() + Send>;
+
+const NO_CRYPTO: &str = "this layer has no Cryptomatte channels (a multi-layer OpenEXR with Cryptomatte, or a 3D precomp)";
+
+impl CryptoProbe {
+    /// `None` when `live` turns false between its stages (a newer request or an edit since):
+    /// a cancelled build stops early and lets go of what it read.
+    fn build(r: &effectcraft_render::Renderer, key: ProbeKey, time: Tick, live: &dyn Fn() -> bool) -> Option<CryptoProbe> {
+        let (cid, lid, _, pos) = key.at;
+        let build = || -> std::result::Result<Option<ProbeGrid>, String> {
+            let comp = r.project.comp(cid).ok_or("no composition")?;
+            let layer = comp.layer(lid).ok_or("no such layer")?;
+            let g = layer.effects().and_then(|fx| fx.groups().nth(pos)).ok_or("no such effect")?;
+            let ctx = effectcraft_render::EvalCtx {
+                project: r.project,
+                comp_id: cid,
+                comp,
+                time,
+                expr: r.expr,
+                footage: None,
+                property_overrides: &[],
+                media_overrides: &[],
+                reads: None,
+            };
+            let params = effectcraft_effects::flatten_params(g, &mut |pr| ctx.value(layer, pr));
+            let aux = r.layer_aux(&ctx, layer).ok_or(NO_CRYPTO)?;
+            if !live() {
+                return Ok(None);
+            }
+            let layer_name = effectcraft_effects::crypto_layer_named(&aux, params.s("layerName"), params.e("layer") as usize).ok_or(NO_CRYPTO)?;
+            // The grid of the effect's input buffer (footage keeps native pixels from 3/4 scale
+            // up, proxies have their own size, earlier effects can pad it), rendered and cached.
+            if !live() {
+                return Ok(None);
+            }
+            let b = r.layer_input(&ctx, layer, pos).ok_or("this layer has no pixels")?;
+            Ok(Some(ProbeGrid { aux, layer: layer_name, scale: b.scale, offset: b.offset }))
+        };
+        // On another thread no command guard runs: a panic becomes the probe's error.
+        let grid = crate::guard::guarded("Reading the Cryptomatte IDs", || Ok(build())).unwrap_or_else(|e| Err(e.to_string()));
+        Some(CryptoProbe { key, grid: grid.transpose()? })
+    }
+}
+
+/// Whether a property in `g` other than `skip` changes over time (keyframes or an expression).
+fn moves(g: &PropGroup, skip: Option<Uid>) -> bool {
+    g.children.iter().any(|c| match c {
+        effectcraft_project::Node::Prop(p) => Some(p.uid) != skip && (p.is_animated() || p.has_expression()),
+        effectcraft_project::Node::Group(g) => moves(g, skip),
+    })
+}
+
+/// [`ProbeFrame`] of the effect at index `pos` of `layer`.
+fn probe_frame(ctx: &effectcraft_render::EvalCtx, layer: &Layer, pos: usize) -> ProbeFrame {
+    let comp = ProbeFrame::Comp(ctx.time);
+    let effectcraft_project::LayerSource::Footage { item } = layer.source else { return comp };
+    let Some(effectcraft_project::ItemKind::Footage(f)) = ctx.project.item(item).map(|i| &i.kind) else { return comp };
+    let fx = layer.effects().into_iter().flat_map(|fx| fx.groups().take(pos + 1));
+    let time_fx = |g: &PropGroup| matches!(&g.kind, GroupKind::Effect { effect } if effect.starts_with("ec.time."));
+    let still = f.kind == effectcraft_project::FootageKind::Still;
+    let blend = !still && ctx.comp.enable_frame_blending && layer.switches.frame_blend != effectcraft_project::FrameBlend::Off;
+    // The Cryptomatte effect's own Selection isn't read by the probe: animated, it keeps it.
+    let own = |i: usize, g: &PropGroup| if i == pos { g.prop("selection").map(|p| p.uid) } else { None };
+    if blend || layer.masks().is_some_and(|m| moves(m, None)) || fx.enumerate().any(|(i, g)| moves(g, own(i, g)) || time_fx(g)) {
+        return comp;
+    }
+    ProbeFrame::Source(if still { 0 } else { effectcraft_render::frame_position(ctx.source_time(layer), f.frame_rate).0 })
+}
+
+/// The Cryptomatte effect `{layer?, effect?, scale?, time?}` names: its probe key, the comp
+/// time, its layer, group and Selection property.
+#[allow(clippy::type_complexity)]
+fn probe_key<'a>(s: &'a Session, p: &Value, cmd: &str) -> Result<(ProbeKey, Tick, &'a Layer, &'a PropGroup, &'a effectcraft_project::Property)> {
+    let (cid, lid, fx_uid) = find_fx(s, p, cmd)?;
+    let scale = f_p(p, "scale").unwrap_or(1.0);
+    if !(scale.is_finite() && scale > 0.0 && scale <= 1.0) {
+        return Err(bad(cmd, "`scale` is the preview's resolution factor, above 0 and at most 1"));
+    }
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    let fx = layer.effects().ok_or_else(|| bad(cmd, "no effects"))?;
+    let pos = fx.groups().position(|g| g.uid == fx_uid).ok_or_else(|| bad(cmd, "no such effect"))?;
+    let g = fx.groups().nth(pos).ok_or_else(|| bad(cmd, "no such effect"))?;
+    let prop = g.prop("selection").filter(|_| g.match_id == "ec.3d.cryptomatte").ok_or_else(|| bad(cmd, "not a Cryptomatte effect"))?;
+    let time = super::time_p(s, p, Some(comp));
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let frame = probe_frame(&ctx, layer, pos);
+    let o = s.render_opts(Default::default());
+    let prefs = (o.nested_switches, o.draft_shadows);
+    Ok((ProbeKey { revision: s.revision, at: (cid, lid, fx_uid, pos), frame, scale, prefs }, time, layer, g, prop))
+}
+
+/// The kept probe if it answers for the current revision, for [`keep_crypto_probe`] (taken
+/// before an undo, redo or history jump).
+pub(crate) fn kept_crypto_probe(s: &Session) -> Option<std::sync::Arc<CryptoProbe>> {
+    s.crypto_probe.lock().ok()?.probe.clone().filter(|p| p.key.revision == s.revision)
+}
+
+/// After an undo, redo or history jump from `before` (which dropped the probe): `kept`, the
+/// probe from before, still answers when only Cryptomatte Selections changed, which the probe
+/// doesn't read (undoing a pick, as the pick itself keeps it).
+pub(crate) fn keep_crypto_probe(s: &Session, kept: Option<std::sync::Arc<CryptoProbe>>, before: &effectcraft_project::Project) {
+    let Some(p) = kept else { return };
+    if !only_crypto_selections_differ(before, &s.project) {
+        return;
+    }
+    if let Ok(mut slot) = s.crypto_probe.lock()
+        && slot.probe.is_none()
+    {
+        slot.probe = Some(std::sync::Arc::new(CryptoProbe { key: ProbeKey { revision: s.revision, ..p.key }, grid: p.grid.clone() }));
+    }
+}
+
+/// Whether projects `a` and `b` differ at most in the Selections of Cryptomatte effects.
+fn only_crypto_selections_differ(a: &effectcraft_project::Project, b: &effectcraft_project::Project) -> bool {
+    let mut x = a.clone();
+    for (cid, it) in x.items.iter_mut() {
+        let effectcraft_project::ItemKind::Comp(c) = &mut it.kind else { continue };
+        let sels: Vec<(LayerId, Uid)> = c
+            .layers
+            .iter()
+            .flat_map(|l| {
+                l.effects()
+                    .into_iter()
+                    .flat_map(|fx| fx.groups())
+                    .filter(|g| g.match_id == "ec.3d.cryptomatte")
+                    .filter_map(move |g| g.get("selection").map(|p| (l.id, p.uid)))
+            })
+            .collect();
+        if sels.is_empty() {
+            continue;
+        }
+        let Some(bc) = b.comp(*cid) else { return false };
+        let c = std::sync::Arc::make_mut(c);
+        for (lid, uid) in sels {
+            let Some(src) = bc.layer(lid).and_then(|l| l.props.find(uid)) else { return false };
+            if let Some(dst) = c.layer_mut(lid).and_then(|l| l.props.find_mut(uid)) {
+                *dst = src.clone();
+            }
+        }
+    }
+    x.same_content(b)
+}
+
+/// The session's probe when it has `key`'s.
+fn cached_probe(s: &Session, key: ProbeKey) -> Option<std::sync::Arc<CryptoProbe>> {
+    s.crypto_probe.lock().ok()?.probe.clone().filter(|p| p.key == key)
+}
+
+/// [`Session::crypto_probe_ready`].
+pub(crate) fn crypto_probe_ready(s: &Session, p: &Value) -> Result<bool> {
+    let (key, ..) = probe_key(s, p, "effect.cryptomatteAt")?;
+    Ok(cached_probe(s, key).is_some())
+}
+
+/// [`Session::crypto_probe_job`].
+pub(crate) fn crypto_probe_job(s: &Session, p: &Value) -> Result<Option<CryptoProbeJob>> {
+    let (key, time, ..) = probe_key(s, p, "effect.cryptomatteAt")?;
+    let generation = {
+        let mut slot = s.crypto_probe.lock().map_err(|_| EngineError::Other("the Cryptomatte probe is unavailable".into()))?;
+        if slot.probe.as_ref().is_some_and(|p| p.key == key) {
+            return Ok(None);
+        }
+        // A request for another probe cancels the one in flight.
+        if slot.want != Some(key) {
+            (slot.want, slot.generation) = (Some(key), slot.generation + 1);
+        }
+        slot.generation
+    };
+    let (project, footage, expr, cache, accel, slot) =
+        (s.project.clone(), s.footage.clone(), s.expr.clone(), s.layer_cache.clone(), s.accel.clone(), s.crypto_probe.clone());
+    let opts = s.render_opts(effectcraft_render::RenderOpts { scale: key.scale, ..Default::default() });
+    // The slot while this is still the newest request.
+    fn current(slot: &std::sync::Mutex<CryptoProbeSlot>, generation: u64) -> Option<std::sync::MutexGuard<'_, CryptoProbeSlot>> {
+        slot.lock().ok().filter(|s| s.generation == generation)
+    }
+    Ok(Some(Box::new(move || {
+        match slot.lock() {
+            Ok(mut s) if s.generation == generation => (s.jobs, s.builds) = (s.jobs + 1, s.builds + 1),
+            Ok(mut s) => return s.jobs += 1,
+            Err(_) => return,
+        }
+        let mut r = effectcraft_render::Renderer::new(&project, footage.as_ref(), opts);
+        r.expr = expr.as_deref();
+        r.cache = Some(&cache);
+        r.accel = accel.as_deref();
+        // Checked between its stages too: a superseded build stops at the next one.
+        let Some(probe) = CryptoProbe::build(&r, key, time, &|| current(&slot, generation).is_some()) else { return };
+        let probe = std::sync::Arc::new(probe);
+        // Only the newest request's result, and never over a newer probe.
+        if let Some(mut s) = current(&slot, generation)
+            && s.probe.as_ref().is_none_or(|p| p.key.revision <= key.revision)
+        {
+            s.probe = Some(probe);
+        }
+    })))
+}
+
+/// [`Session::crypto_coverage`].
+pub(crate) fn crypto_coverage(s: &Session, p: &Value, hash: u32, max_side: usize) -> Option<CryptoCoverage> {
+    let (key, ..) = probe_key(s, p, "effect.cryptomatteAt").ok()?;
+    let probe = cached_probe(s, key)?;
+    let b = probe.grid.as_ref().ok()?;
+    let (aw, ah) = (b.aux.width as usize, b.aux.height as usize);
+    if aw == 0 || ah == 0 {
+        return None;
+    }
+    let step = aw.max(ah).div_ceil(max_side.max(1)).max(1);
+    let (w, h) = (aw.div_ceil(step), ah.div_ceil(step));
+    let planes = b.aux.crypto_rank_planes(&b.layer);
+    let sample = |j: usize| {
+        planes.iter().filter(|(id, _)| id.get(j).is_some_and(|v| v.to_bits() == hash)).map(|(_, c)| c.get(j).map_or(0.0, |c| c.max(0.0))).sum::<f32>().min(1.0)
+    };
+    // Each sample at the centre of its step × step cell; the last cells are cut by the layer.
+    let at = |x: usize, y: usize| sample((y * step + step / 2).min(ah - 1) * aw + (x * step + step / 2).min(aw - 1));
+    let coverage = (0..w * h).map(|i| at(i % w, i / w)).collect();
+    let (size, uv) = ([aw as f64 / b.aux.scale, ah as f64 / b.aux.scale], [aw as f64 / (w * step) as f64, ah as f64 / (h * step) as f64]);
+    Some(CryptoCoverage { width: w, height: h, coverage, size, uv })
+}
+
+/// An ID's coverage over a layer, for the eyedropper's hover highlight: `width` × `height`
+/// samples (row-major, 0..1). The layer, `size` effect-space pixels from its origin, shows the
+/// texture from (0, 0) to `uv`.
+pub struct CryptoCoverage {
+    pub width: usize,
+    pub height: usize,
+    pub coverage: Vec<f32>,
+    pub size: [f64; 2],
+    pub uv: [f64; 2],
+}
+
+/// What a pick finds at a point.
+enum Hit {
+    /// `probeOnly` and the probe isn't built yet.
+    Pending,
+    Nothing,
+    Id(CryptoHit),
+}
+
+/// The ID under `{x, y}` (effect space, which is layer space on footage and precomp layers) for
+/// the Cryptomatte effect `{layer?, effect?}`, from the aux channels its render reads. The point
+/// snaps to the centre of the pixel the effect's input buffer samples in a render at `scale`
+/// (the viewer's resolution). Without a kept probe it builds one, unless `probeOnly`.
+fn crypto_hit(s: &Session, p: &Value, cmd: &str) -> Result<Hit> {
+    let (key, time, layer, g, prop) = probe_key(s, p, cmd)?;
+    let (Some(x), Some(y)) = (f_p(p, "x"), f_p(p, "y")) else { return Err(bad(cmd, "missing `x` / `y` (layer pixels)")) };
+    let probe = match cached_probe(s, key) {
+        Some(probe) => probe,
+        None if b_p(p, "probeOnly").unwrap_or(false) => return Ok(Hit::Pending),
+        None => {
+            let r = s.renderer(effectcraft_render::RenderOpts { scale: key.scale, ..Default::default() });
+            if let Ok(mut slot) = s.crypto_probe.lock() {
+                slot.clear();
+                slot.builds += 1;
+            }
+            // (Never cancelled here: nothing else runs on this thread.)
+            let Some(probe) = CryptoProbe::build(&r, key, time, &|| true).map(std::sync::Arc::new) else { return Ok(Hit::Pending) };
+            if let Ok(mut slot) = s.crypto_probe.lock() {
+                slot.probe = Some(probe.clone());
+            }
+            probe
+        }
+    };
+    let b = probe.grid.as_ref().map_err(|e| bad(cmd, e.clone()))?;
+    let (bs, o) = (b.scale, b.offset);
+    // The centre of its pixel under the point, at the aux point the effect reads there.
+    let [ax, ay] = effectcraft_effects::aux_point(bs, o, [(x * bs + o[0]).floor() + 0.5, (y * bs + o[1]).floor() + 0.5]);
+    let Some(hash) = b.aux.index_at(ax, ay).and_then(|i| b.aux.crypto_id_at(&b.layer, i)) else { return Ok(Hit::Nothing) };
+    let (cid, lid, ..) = key.at;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let selection = effectcraft_effects::flatten_params(g, &mut |pr| ctx.value(layer, pr)).s("selection").to_string();
+    let driven = prop.expr.as_ref().is_some_and(|e| e.enabled);
+    let (aux, layer_name) = (b.aux.clone(), b.layer.clone());
+    Ok(Hit::Id(CryptoHit { at: (cid, lid, time), probe: probe.clone(), aux, layer: layer_name, hash, selection, prop: prop.uid, driven }))
+}
+
+/// `effect.cryptomatteAt`: the ID under a point, for the viewer's hover hint. The first call per
+/// frame renders the effect's input to learn its pixel grid (kept afterwards); with `probeOnly`
+/// it answers `{pending: true}` instead.
+fn crypto_at(s: &mut Session, p: &Value) -> Result<Value> {
+    Ok(match crypto_hit(s, p, "effect.cryptomatteAt")? {
+        Hit::Pending => json!({"pending": true}),
+        Hit::Nothing => Value::Null,
+        Hit::Id(h) => h.reply(&h.selection),
+    })
+}
+
+/// The Cryptomatte eyedropper: replace the effect's Selection with the ID under a point, add it
+/// or remove it, in one undo step at the time it was read (none when its meaning stays).
+fn pick_crypto(s: &mut Session, p: &Value) -> Result<Value> {
+    use effectcraft_effects::crypto_select::{PickMode, edit_selection, token_for};
+    let cmd = "effect.pickCryptomatte";
+    let mode = match str_p(p, "mode").unwrap_or("replace") {
+        "replace" => PickMode::Replace,
+        "add" => PickMode::Add,
+        "remove" => PickMode::Remove,
+        m => return Err(bad(cmd, format!("unknown `mode` {m:?} (replace, add or remove)"))),
+    };
+    let h = match crypto_hit(s, p, cmd)? {
+        Hit::Id(h) => h,
+        Hit::Pending => return Ok(json!({"pending": true, "changed": false})),
+        Hit::Nothing => return Err(bad(cmd, "no Cryptomatte ID there (empty or outside the layer)")),
+    };
+    if h.driven {
+        return Err(bad(cmd, "the Selection is driven by an expression; disable it to pick"));
+    }
+    let m = h.manifest();
+    let sel = edit_selection(&h.selection, &token_for(h.aux.manifest_name(&h.layer, h.hash), h.hash, m), h.hash, mode, m);
+    let changed = sel != h.selection;
+    if changed {
+        let (cid, lid, t) = h.at;
+        s.execute("prop.set", json!({"comp": cid.0, "layer": lid.0, "prop": h.prop, "value": sel, "time": t.seconds(), "timeBase": "comp"}))?;
+        // The step says what made it (Edit ▸ Undo Pick Cryptomatte, the History panel), not
+        // "Change Property" like any other edit. (A changed Selection is always a new step.)
+        if let Some(step) = s.history.undo.last_mut() {
+            step.0 = "Pick Cryptomatte".into();
+        }
+        // Only the Selection changed, which the probe doesn't read: the next hover keeps it.
+        // (The edit dropped it; a probe built since is newer.)
+        if let Ok(mut slot) = s.crypto_probe.lock()
+            && slot.probe.is_none()
+        {
+            let key = ProbeKey { revision: s.revision, ..h.probe.key };
+            slot.probe = Some(std::sync::Arc::new(CryptoProbe { key, grid: h.probe.grid.clone() }));
+        }
+    }
+    let mut out = h.reply(&sel);
+    out["selection"] = json!(sel);
+    out["changed"] = json!(changed);
+    Ok(out)
+}
+
+fn remove(s: &mut Session, p: &Value) -> Result<Value> {
+    let cid = super::comp_id(s, p)?;
+    let fx = effects_p(s, p, "effect.remove")?;
+    let label = if fx.len() == 1 { "Remove Effect" } else { "Remove Effects" };
+    s.edit(label, None, |proj, st| {
+        for (lid, uid) in &fx {
+            let l = layer_mut(proj, cid, *lid)?;
+            if let Some(fx) = l.props.sub_mut("effects") {
+                fx.children.retain(|c| c.uid() != *uid);
+            }
+            st.selected_props.retain(|(_, u)| u != uid);
+        }
+        Ok(())
+    })?;
+    Ok(json!(fx.len()))
+}
+
+fn remove_all(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    s.edit("Remove All Effects", None, |proj, _| {
+        for lid in &ids {
+            if let Some(fx) = layer_mut(proj, cid, *lid)?.props.sub_mut("effects") {
+                fx.children.clear();
+            }
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+fn toggle(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid, uid) = find_fx(s, p, "effect.toggle")?;
+    let v = b_p(p, "value");
+    let r = s.edit("Toggle Effect", None, |proj, _| {
+        let l = layer_mut(proj, cid, lid)?;
+        let g = l.props.find_group_mut(uid).ok_or_else(|| bad("effect.toggle", "gone"))?;
+        g.enabled = v.unwrap_or(!g.enabled);
+        Ok(g.enabled)
+    })?;
+    Ok(json!(r))
+}
+
+/// `effect.setLabel`: the effect's colour label (None clears it).
+fn set_label(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "effect.setLabel";
+    let (cid, lid, uid) = find_fx(s, p, c)?;
+    let lab = match p.get("label") {
+        Some(Value::Number(n)) => n.as_u64().and_then(|i| effectcraft_color::Label::ALL.get(usize::try_from(i).ok()?).copied()),
+        Some(Value::String(name)) => s.prefs.label_from_name(name),
+        _ => None,
+    }
+    .ok_or_else(|| bad(c, "missing or unknown `label` (name or index 0-16; 0 / None clears it)"))?;
+    s.edit("Effect Label", None, |proj, _| {
+        let l = layer_mut(proj, cid, lid)?;
+        let g = l.props.find_group_mut(uid).ok_or_else(|| bad(c, "gone"))?;
+        g.label = (lab != effectcraft_color::Label::None).then_some(lab);
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+fn reorder(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid, uid) = find_fx(s, p, "effect.reorder")?;
+    let to = p.get("index").and_then(Value::as_u64).ok_or_else(|| bad("effect.reorder", "missing `index` (1-based)"))? as usize;
+    s.edit("Reorder Effect", None, |proj, _| {
+        let fx = layer_mut(proj, cid, lid)?.props.sub_mut("effects").ok_or_else(|| bad("effect.reorder", "no effects"))?;
+        let Some(i) = fx.children.iter().position(|c| c.uid() == uid) else { return Ok(()) };
+        let g = fx.children.remove(i);
+        let to = to.saturating_sub(1).min(fx.children.len());
+        fx.children.insert(to, g);
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid, uid) = find_fx(s, p, "effect.duplicate")?;
+    let r = s.edit("Duplicate Effect", None, |proj, st| {
+        let mut next = proj.next_id;
+        let fx = layer_mut(proj, cid, lid)?.props.sub_mut("effects").ok_or_else(|| bad("effect.duplicate", "no effects"))?;
+        let Some(i) = fx.children.iter().position(|c| c.uid() == uid) else { return Ok(0) };
+        let mut g = fx.children[i].as_group().cloned().ok_or_else(|| bad("effect.duplicate", "not a group"))?;
+        g.reassign_uids(&mut next);
+        g.name = unique_name(fx, &g.name);
+        let u = g.uid;
+        fx.children.insert(i + 1, g.into());
+        proj.next_id = next + 1;
+        st.selected_props = vec![(lid, u)];
+        Ok(u)
+    })?;
+    Ok(json!(r))
+}
+
+/// Effect groups selected in Effect Controls / the timeline: (layer, effect uid), in stack order.
+pub(crate) fn selected_effects(s: &Session) -> Vec<(LayerId, Uid)> {
+    let Some(c) = s.active_comp() else { return vec![] };
+    let mut out = vec![];
+    for l in &c.layers {
+        let Some(fx) = l.effects() else { continue };
+        for g in fx.groups() {
+            if s.state.selected_props.iter().any(|(sl, u)| *sl == l.id && *u == g.uid) {
+                out.push((l.id, g.uid));
+            }
+        }
+    }
+    out
+}
+
+/// Effects named by `effect` / `effects` (uids, names or 1-based indexes), else the selection.
+fn effects_p(s: &Session, p: &Value, cmd: &str) -> Result<Vec<(LayerId, Uid)>> {
+    if p.get("effect").is_some() {
+        let (_, lid, uid) = find_fx(s, p, cmd)?;
+        return Ok(vec![(lid, uid)]);
+    }
+    if let Some(Value::Array(a)) = p.get("effects") {
+        let mut out = vec![];
+        for v in a {
+            let mut q = p.clone();
+            if let Some(o) = q.as_object_mut() {
+                o.remove("effects");
+                o.insert("effect".into(), v.clone());
+            }
+            let (_, lid, uid) = find_fx(s, &q, cmd)?;
+            out.push((lid, uid));
+        }
+        return Ok(out);
+    }
+    let sel = selected_effects(s);
+    if sel.is_empty() {
+        return Err(bad(cmd, "no effect selected"));
+    }
+    Ok(sel)
+}
+
+pub(crate) fn effect_time_error(cmd: &str) -> EngineError {
+    bad(cmd, "an effect keyframe converts outside the supported time range")
+}
+
+/// Validate before Layer's saturating conversions, so a bad stretch or time never silently
+/// moves a copied key to another frame. Normal-speed layers keep their exact integer ticks.
+fn effect_time(layer: &Layer, time: Tick, to_comp: bool, cmd: &str) -> Result<Tick> {
+    if !layer.stretch.is_finite() || layer.stretch == 0.0 {
+        return Err(bad(cmd, "the layer has an invalid time stretch"));
+    }
+    let in_range = |t: i64| (Tick::MIN.0..=Tick::MAX.0).contains(&t);
+    if !in_range(time.0) {
+        return Err(effect_time_error(cmd));
+    }
+    let offset = if to_comp { time.0 } else { time.0.checked_sub(layer.start_time.0).ok_or_else(|| effect_time_error(cmd))? };
+    let scaled = if (layer.stretch - 100.0).abs() < 1e-9 {
+        offset
+    } else {
+        let scaled = if to_comp { offset as f64 * layer.stretch / 100.0 } else { offset as f64 * 100.0 / layer.stretch };
+        if !scaled.is_finite() || scaled < Tick::MIN.0 as f64 || scaled > Tick::MAX.0 as f64 {
+            return Err(effect_time_error(cmd));
+        }
+        scaled as i64
+    };
+    if !in_range(scaled) {
+        return Err(effect_time_error(cmd));
+    }
+    let time = if to_comp { layer.start_time.0.checked_add(scaled).ok_or_else(|| effect_time_error(cmd))? } else { scaled };
+    if !in_range(time) {
+        return Err(effect_time_error(cmd));
+    }
+    Ok(Tick(time))
+}
+
+/// Change the key time coordinate system throughout an effect, including nested controls.
+/// Ease speeds are per second in that coordinate system; reversed time swaps the key sides.
+pub(crate) fn retime_effect(group: &mut PropGroup, scale: f64, cmd: &str, mut time: impl FnMut(Tick) -> Result<Tick>) -> Result<()> {
+    let mut result = Ok(());
+    group.walk_mut(&mut |pr| {
+        if result.is_err() {
+            return;
+        }
+        for key in &mut pr.keys {
+            let mapped = time(key.time).and_then(|t| {
+                if !scale.is_finite() || scale == 0.0 {
+                    return Err(effect_time_error(cmd));
+                }
+                // Spatial paths and non-numeric values ease along positive progress;
+                // numeric components instead store a signed value derivative.
+                let speed_scale = if pr.spatial || key.value.dims() == 0 { scale.abs() } else { scale };
+                for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
+                    ease.speed /= speed_scale;
+                    if !ease.speed.is_finite() {
+                        return Err(bad(cmd, "an effect keyframe ease converts outside the supported range"));
+                    }
+                }
+                if scale < 0.0 {
+                    std::mem::swap(&mut key.in_interp, &mut key.out_interp);
+                    std::mem::swap(&mut key.in_ease, &mut key.out_ease);
+                    std::mem::swap(&mut key.spatial_in, &mut key.spatial_out);
+                }
+                Ok(t)
+            });
+            match mapped {
+                Ok(t) => key.time = t,
+                Err(e) => {
+                    result = Err(e);
+                    return;
+                }
+            }
+        }
+        pr.keys.sort_by_key(|key| key.time);
+        if pr.keys.windows(2).any(|pair| pair[0].time == pair[1].time) {
+            result = Err(bad(cmd, "the layer's time stretch maps effect keyframes to the same tick"));
+        }
+    });
+    result
+}
+
+/// Edit ▸ Copy with effects selected: times on the clipboard are comp-time offsets from the
+/// earliest copied key, shared by all copied effects and their parameters (#989).
+fn copy(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "effect.copy";
+    let fx = effects_p(s, p, "effect.copy")?;
+    let comp = s.active_comp().ok_or(EngineError::NoComp)?;
+    let mut groups = Vec::new();
+    let mut earliest: Option<Tick> = None;
+    for (lid, uid) in fx {
+        let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+        let mut group = layer.effects().and_then(|fx| fx.groups().find(|g| g.uid == uid)).cloned().ok_or_else(|| bad(CMD, "the effect no longer exists"))?;
+        retime_effect(&mut group, layer.stretch / 100.0, CMD, |t| {
+            let t = effect_time(layer, t, true, CMD)?;
+            earliest = Some(earliest.map_or(t, |first| first.min(t)));
+            Ok(t)
+        })?;
+        groups.push(group);
+    }
+    if let Some(first) = earliest {
+        for group in &mut groups {
+            retime_effect(group, 1.0, CMD, |t| Ok(Tick(t.0.checked_sub(first.0).ok_or_else(|| effect_time_error(CMD))?)))?;
+        }
+    }
+    s.state.clipboard.clear();
+    s.state.key_clipboard.clear();
+    s.state.keyframe_text = None;
+    s.state.contents_clipboard.clear();
+    s.state.mask_clipboard.clear();
+    s.state.link_clipboard = None;
+    s.state.clip_is_keys = false;
+    let n = groups.len();
+    s.state.effect_clipboard = groups;
+    Ok(json!({"effects": n}))
+}
+
+/// A unique instance name among `fx`'s effects (`Gaussian Blur`, `Gaussian Blur 2`…).
+pub(crate) fn unique_name(fx: &PropGroup, base: &str) -> String {
+    if !fx.groups().any(|g| g.name == base) {
+        return base.to_string();
+    }
+    let stem = base.rsplit_once(' ').filter(|(_, n)| n.parse::<u32>().is_ok()).map(|(s, _)| s).unwrap_or(base);
+    (2..).map(|i| format!("{stem} {i}")).find(|n| !fx.groups().any(|g| &g.name == n)).unwrap_or_else(|| base.to_string())
+}
+
+/// Edit ▸ Paste with effects on the clipboard: adds copies to every target layer, after the
+/// layer's selected effect when it has one, else at the end of its stack. The earliest copied
+/// key lands at the destination comp's CTI; all other keys keep their comp-time offsets.
+fn paste(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "effect.paste";
+    let clip = s.state.effect_clipboard.clone();
+    if clip.is_empty() {
+        return Err(bad("effect.paste", "no effects on the clipboard"));
+    }
+    let (cid, ids) = layers_p(s, p)?;
+    if ids.is_empty() {
+        return Err(bad("effect.paste", "select a layer to paste effects onto"));
+    }
+    let sel = selected_effects(s);
+    let cti = s.time_of(cid);
+    let label = if clip.len() == 1 { format!("Paste {}", clip[0].name) } else { "Paste Effects".to_string() };
+    let uids = s.edit(&label, None, |proj, st| {
+        let mut out = vec![];
+        let mut next = proj.next_id;
+        let mut new_sel = vec![];
+        for lid in &ids {
+            let l = layer_mut(proj, cid, *lid)?;
+            let mut groups = clip.clone();
+            for group in &mut groups {
+                retime_effect(group, 100.0 / l.stretch, CMD, |offset| {
+                    let t = Tick(cti.0.checked_add(offset.0).ok_or_else(|| effect_time_error(CMD))?);
+                    effect_time(l, t, false, CMD)
+                })?;
+            }
+            let Some(fx) = l.props.sub_mut("effects") else { continue };
+            let at = sel
+                .iter()
+                .filter(|(sl, _)| sl == lid)
+                .filter_map(|(_, u)| fx.children.iter().position(|c| c.uid() == *u))
+                .max()
+                .map(|i| i + 1)
+                .unwrap_or(fx.children.len());
+            for (k, mut g) in groups.into_iter().enumerate() {
+                g.reassign_uids(&mut next);
+                g.name = unique_name(fx, &g.name);
+                out.push(g.uid);
+                new_sel.push((*lid, g.uid));
+                fx.children.insert(at + k, g.into());
+            }
+        }
+        proj.next_id = next + 1;
+        st.selected_props = new_sel;
+        Ok(out)
+    })?;
+    Ok(json!({"effects": uids}))
+}
+
+/// Effect Controls' Reset: every parameter back to its default. Animated parameters get a
+/// keyframe at the current time with the default value (as in After Effects); static ones
+/// change their value.
+fn reset(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid, uid) = find_fx(s, p, "effect.reset")?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    let size = effectcraft_render::effect_bounds(&s.project, comp, layer).0;
+    let lt = layer.layer_time(s.time());
+    let g = layer.effects().and_then(|fx| fx.groups().find(|g| g.uid == uid)).ok_or_else(|| bad("effect.reset", "gone"))?;
+    let spec = match &g.kind {
+        GroupKind::Effect { effect } => effectcraft_effects::find(effect),
+        _ => None,
+    }
+    .ok_or_else(|| bad("effect.reset", "unknown effect"))?;
+    let name = g.name.clone();
+    s.edit(&format!("Reset {name}"), None, |proj, _| {
+        let g = layer_mut(proj, cid, lid)?.props.find_group_mut(uid).ok_or_else(|| bad("effect.reset", "gone"))?;
+        for ps in &spec.params {
+            // (`group/param` ids live in twirl-down groups.)
+            if let Some(pr) = g.prop_mut(ps.id) {
+                pr.set_value_at(lt, effectcraft_effects::default_value(ps, size));
+            }
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// Tint's Swap Colors button edits both swatches at the CTI in one undo step. Like Reset,
+/// it keys animated parameters without moving their existing keys or replacing expressions.
+fn swap_tint_colors(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "effect.swapTintColors";
+    if !p.is_object() || p.get("effect").is_some_and(|v| !v.is_string() && v.as_u64().is_none_or(|n| n == 0)) {
+        return Err(bad(cmd, "effect must be a positive index, uid or name"));
+    }
+    let (cid, lid, uid) = find_fx(s, p, cmd)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    let g = layer.props.find_group(uid).filter(|g| g.match_id == "ec.color.tint").ok_or_else(|| bad(cmd, "not a Tint effect"))?;
+    let lt = layer.layer_time(s.time_of(cid));
+    let color = |id| {
+        g.prop(id)
+            .map(|pr| pr.value_at(lt))
+            .filter(|v| matches!(v, effectcraft_keyframe::Value::Color(_)))
+            .ok_or_else(|| bad(cmd, "Tint is missing a colour parameter"))
+    };
+    let (black, white) = (color("black")?, color("white")?);
+    s.edit("Swap Tint Colors", None, |proj, _| {
+        let g = layer_mut(proj, cid, lid)?.props.find_group_mut(uid).ok_or_else(|| bad(cmd, "effect gone"))?;
+        for (id, value) in [("black", white), ("white", black)] {
+            g.prop_mut(id).ok_or_else(|| bad(cmd, "Tint is missing a colour parameter"))?.set_value_at(lt, value);
+        }
+        Ok(())
+    })?;
+    Ok(json!({"effect": uid}))
+}
+
+fn last(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = s.state.last_effect.clone().ok_or_else(|| bad("effect.applyLast", "no effect applied yet"))?;
+    let mut q = p.clone();
+    if let Some(o) = q.as_object_mut() {
+        o.insert("effect".into(), json!(id));
+    } else {
+        q = json!({"effect": id});
+    }
+    apply(s, &q)
+}
+
+fn list(_: &mut Session, p: &Value) -> Result<Value> {
+    let filter = str_p(p, "filter").map(str::to_lowercase);
+    let v: Vec<Value> = effectcraft_effects::all()
+        .into_iter()
+        .filter(|e| {
+            filter.as_ref().is_none_or(|f| effectcraft_effects::name_matches(e, f) || e.id.contains(f.as_str()) || e.category.to_ascii_lowercase().contains(f))
+        })
+        .map(|e| {
+            json!({"id": e.id, "name": e.name, "category": e.category, "gpu": e.gpu, "float": e.float, "params": e.params.iter().map(|p| {
+                let mut out = json!({"id": p.id, "name": p.name, "type": p.default.kind_name(), "default": p.default.to_json()});
+                match &p.ui {
+                    effectcraft_project::ParamUi::Popup { options } => {
+                        out["options"] = super::popup_options(options);
+                    }
+                    effectcraft_project::ParamUi::Slider { min, max, slider_min, slider_max, decimals } => {
+                        out["min"] = json!(min);
+                        out["max"] = json!(max);
+                        out["sliderMin"] = json!(slider_min);
+                        out["sliderMax"] = json!(slider_max);
+                        out["decimals"] = json!(decimals);
+                    }
+                    _ => {}
+                }
+                out
+            }).collect::<Vec<_>>()})
+        })
+        .collect();
+    Ok(json!(v))
+}
+
+impl Session {
+    /// The named channels of layer `lid` in the active comp at the current time: its
+    /// multi-layer OpenEXR footage's layers and channels (`diffuse.R`, `depth.Z`, …), which
+    /// EXtractoR and the 3D Channel effects read. `None` for other layers.
+    pub fn layer_channels(&self, lid: LayerId) -> Option<std::sync::Arc<effectcraft_raster::AuxChannels>> {
+        let layer = self.active_comp()?.layer(lid)?;
+        let effectcraft_project::LayerSource::Footage { item } = layer.source else { return None };
+        let effectcraft_project::ItemKind::Footage(f) = &self.project.item(item)?.kind else { return None };
+        self.footage.aux(item, f, layer.layer_time(self.time()))
+    }
+}
+
+/// `layer.channels`: the layers and channels of a layer's multi-layer OpenEXR footage, and
+/// what each layer shows in red, green, blue and alpha (EXtractoR's popups).
+fn channels(s: &mut Session, p: &Value) -> Result<Value> {
+    let (_, lid) = super::layer_p(s, p, "layer.channels")?;
+    let Some(aux) = s.layer_channels(lid) else { return Ok(json!({"channels": [], "layers": []})) };
+    let layers: Vec<Value> = aux.layers().into_iter().map(|l| json!({"name": l, "rgba": aux.layer_rgba(l)})).collect();
+    Ok(json!({"channels": aux.names(), "layers": layers}))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!("effect.apply", "Apply Effect", [], None, "{effect: id|name (e.g. Gaussian Blur), layers?}", has_layers, apply),
+        crate::query!(
+            "layer.channels",
+            "Layer Channels",
+            "{layer?} → {channels: [name], layers: [{name, rgba: [r, g, b, a channel]}]} — a multi-layer OpenEXR layer's channels (EXtractoR's red / green / blue / alpha take these names)",
+            channels
+        ),
+        cmd!(
+            "effect.pickColor",
+            "Pick Effect Colour",
+            [],
+            None,
+            "{layer?, effect?: index|uid|name, param: id (e.g. screenColour) | prop: uid, x, y (effect space), average?: bool (5×5), time?} — the colour of the effect's input there",
+            has_layers,
+            pick_color
+        ),
+        cmd!(
+            "effect.pickCryptomatte",
+            "Pick Cryptomatte",
+            [],
+            None,
+            "{layer?, effect?: index|uid|name, x, y (effect space), mode?: replace|add|remove (default replace), scale? (preview resolution, default 1), time?, probeOnly?} → {name, hash, layer, selection, changed, selected} | {pending} — edits the Cryptomatte effect's Selection with the ID under the point",
+            has_layers,
+            pick_crypto
+        ),
+        crate::query!(
+            "effect.cryptomatteAt",
+            "Cryptomatte At",
+            "{layer?, effect?: index|uid|name, x, y (effect space), scale?, time?, probeOnly?: bool (don't build the probe)} → {name, hash, layer, selected} | {pending} | null — the Cryptomatte ID under the point",
+            crypto_at
+        ),
+        cmd!("effect.applyLast", "Last Effect", ["Effect"], Some("Cmd+Alt+Shift+E"), "{layers?}", has_layers, last),
+        cmd!("effect.removeAll", "Remove All", ["Effect"], Some("Cmd+Shift+E"), "{layers?}", has_layers, remove_all),
+        cmd!("effect.remove", "Remove Effect", [], None, "{layer?, effect: index|uid|name}", has_layers, remove),
+        cmd!("effect.toggle", "Toggle Effect", [], None, "{layer?, effect, value?}", has_layers, toggle),
+        cmd!("effect.setLabel", "Effect Label", [], None, "{layer?, effect, label: name|index 0-16 (None clears)}", has_layers, set_label),
+        cmd!("effect.reorder", "Reorder Effect", [], None, "{layer?, effect, index}", has_layers, reorder),
+        cmd!("effect.duplicate", "Duplicate Effect", [], None, "{layer?, effect}", has_layers, duplicate),
+        cmd!("effect.copy", "Copy Effects", [], None, "{layer?, effect? | effects?: [uid|name|index]} (default: the selected effects)", has_layers, copy),
+        cmd!("effect.paste", "Paste Effects", [], None, "{layers?} — adds the copied effects to the layers", has_layers, paste),
+        cmd!("effect.reset", "Reset Effect", [], None, "{layer?, effect}", has_layers, reset),
+        cmd!(
+            "effect.swapTintColors",
+            "Swap Tint Colors",
+            [],
+            None,
+            "{comp?, layer?, effect?: index|uid|name} — swaps Tint's Map Black To and Map White To at the current layer time in one undo step",
+            has_layers,
+            swap_tint_colors
+        ),
+        crate::query!(
+            "effect.list",
+            "List Effects",
+            "{filter?} → [{params: [{id, name, type, default, options?, min?, max?, sliderMin?, sliderMax?, decimals?}]}]; popup indices are zero-based (JSX uses one-based values)",
+            list
+        ),
+        crate::query!(
+            "effect.warning",
+            "Effect Warning",
+            "{layer?, effect?: index|uid|name (default: the selected effect), time?} → {effect, warning: string|null} — what Effect Controls warns about (an OCIO config it can't read, transforms it passes through)",
+            warning
+        ),
+        crate::query!(
+            "effect.plugins.list",
+            "List Effect Plug-ins",
+            "{} → {api, wasm, helpers, plugins: [{id, name, category, version, author, source, params, error}]}",
+            plugins_list
+        ),
+        cmd!(
+            "effect.plugins.load",
+            "Load Effect Plug-in...",
+            [],
+            None,
+            "{path (.wasm / .wat plug-in, WebAssembly ABI 1 or 2) | folder (loads every .wasm in it)}",
+            super::always,
+            plugins_load
+        ),
+        cmd!(
+            "effect.plugins.install",
+            "Install Effect Plug-in...",
+            [],
+            None,
+            "{path (.wasm plug-in: copied into the Plug-ins folder and loaded on every start) | folder (a plug-in bundle: every .wasm goes into the Plug-ins folder and every .jsx becomes a ScriptUI panel), bundle? (the menu: ask for a folder)}",
+            super::always,
+            plugins_install
+        ),
+        crate::query!(
+            "effect.helpers.list",
+            "List Effect Helpers",
+            "{} → {helpers: [{program, name, version, loads, running, effects, restarts, error}], blocked: [effect ids]}",
+            helpers_list
+        ),
+        cmd!(
+            "effect.helpers.scan",
+            "Scan for Effect Helpers",
+            [],
+            None,
+            "{retry?} → {paths, helpers, loaded, errors}: starts the effect helpers installed in helpers/ next to the app, helpers/ in the settings folder and EFFECTCRAFT_HELPER_PATH, and adds their effects; retry turns effects that kept stopping their helper back on",
+            has_helpers,
+            helpers_scan
+        ),
+        cmd!(
+            "effect.helpers.load",
+            "Load Plug-ins Through Helper...",
+            [],
+            None,
+            "{path (a file or folder an installed helper accepts, e.g. a folder of .ofx plug-ins for an OpenFX helper; the menu asks for a folder)} → {loaded: [{id, name, category, helper}], errors}",
+            has_helpers,
+            helpers_load
+        ),
+    ]
+}
+
+#[cfg(test)]
+mod list_metadata_tests {
+    use super::*;
+
+    #[test]
+    fn effect_list_exposes_popup_labels_and_numeric_slider_limits() {
+        let mut s = Session::default();
+        let menus = s.execute("effect.list", json!({"filter": "ec.control.dropdown"})).unwrap();
+        assert_eq!(menus.as_array().map(Vec::len), Some(1));
+        let menu = &menus[0]["params"][0];
+        assert_eq!(menu["type"], "enum");
+        assert_eq!(menu["default"], 0);
+        assert_eq!(
+            menu["options"],
+            json!([
+                {"value": 0, "label": "Item 1"},
+                {"value": 1, "label": "Item 2"},
+                {"value": 2, "label": "Item 3"}
+            ])
+        );
+        let sliders = s.execute("effect.list", json!({"filter": "ec.control.slider"})).unwrap();
+        assert_eq!(sliders.as_array().map(Vec::len), Some(1));
+        let slider = &sliders[0]["params"][0];
+        assert_eq!(slider["type"], "scalar");
+        assert_eq!(slider["min"], -1_000_000.0);
+        assert_eq!(slider["max"], 1_000_000.0);
+        assert_eq!(slider["sliderMin"], 0.0);
+        assert_eq!(slider["sliderMax"], 100.0);
+        assert_eq!(slider["decimals"], 2);
+        assert!(slider["options"].is_null());
+    }
+}
diff --git a/crates/engine/src/cmd/enabled.rs b/crates/engine/src/cmd/enabled.rs
new file mode 100644
index 000000000..fb28b60c4
--- /dev/null
+++ b/crates/engine/src/cmd/enabled.rs
@@ -0,0 +1,38 @@
+use super::{EngineError, Result, Session, Value};
+
+// ---------- enablement ----------
+
+pub fn always(_: &Session) -> std::result::Result<(), String> {
+    Ok(())
+}
+
+pub(crate) fn has_comp(s: &Session) -> std::result::Result<(), String> {
+    s.active_comp().map(|_| ()).ok_or_else(|| "no composition is open".into())
+}
+
+pub(crate) fn has_layers(s: &Session) -> std::result::Result<(), String> {
+    has_comp(s)?;
+    if s.state.selected_layers.is_empty() { Err("select a layer first".into()) } else { Ok(()) }
+}
+
+pub(crate) fn has_keys(s: &Session) -> std::result::Result<(), String> {
+    has_comp(s)?;
+    if s.state.selected_keys.is_empty() { Err("select keyframes first".into()) } else { Ok(()) }
+}
+
+pub(crate) fn has_project_selection(s: &Session) -> std::result::Result<(), String> {
+    if s.state.project_selection.is_empty() { Err("select an item in the Project panel first".into()) } else { Ok(()) }
+}
+
+/// Disabled-command enablement (menu entries whose implementation lands with another milestone;
+/// none are left, kept for future stubs).
+#[allow(dead_code)]
+pub(crate) fn not_yet(_: &Session) -> std::result::Result<(), String> {
+    Err("not available yet in EffectCraft".into())
+}
+
+/// `run` of a not-yet-available command.
+#[allow(dead_code)]
+pub(crate) fn not_yet_run(_: &mut Session, _: &Value) -> Result<Value> {
+    Err(EngineError::Other("not available yet in EffectCraft".into()))
+}
diff --git a/crates/engine/src/commands/essential.rs b/crates/engine/src/cmd/essential.rs
similarity index 99%
rename from crates/engine/src/commands/essential.rs
rename to crates/engine/src/cmd/essential.rs
index cb6702660..419bd7316 100644
--- a/crates/engine/src/commands/essential.rs
+++ b/crates/engine/src/cmd/essential.rs
@@ -807,6 +807,7 @@ fn export_template(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "essential.exportTemplate";
     let cid = eg_comp(s, p)?;
     let path = str_p(p, "path").ok_or_else(|| bad(C, "missing `path` (.ectemplate)"))?.to_string();
+    s.refuse_export(&path)?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
     let eg = comp.essential.clone().filter(|e| !e.controls.is_empty()).ok_or_else(|| bad(C, "the composition has no Essential Graphics controls"))?;
     let comp_name = s.project.item(cid).map(|i| i.name.clone()).unwrap_or_default();
@@ -868,7 +869,7 @@ fn export_template(s: &mut Session, p: &Value) -> Result<Value> {
     entries.insert(0, ("project.ecproj".into(), sub.to_json().into_bytes()));
     entries.insert(0, ("manifest.json".into(), serde_json::to_vec_pretty(&manifest).unwrap_or_default()));
     let bytes = effectcraft_lottie::zip::store(&entries);
-    s.services.write_file(&path, &bytes).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(&path, &bytes)?;
     s.toast(format!("Exported template “{name}” to {path}"));
     Ok(json!({"path": path, "name": name, "bytes": bytes.len(), "controls": eg.flat().len(), "items": deps.len()}))
 }
diff --git a/crates/engine/src/commands/expr_tools.rs b/crates/engine/src/cmd/expr_tools.rs
similarity index 98%
rename from crates/engine/src/commands/expr_tools.rs
rename to crates/engine/src/cmd/expr_tools.rs
index fae74a5b5..cb39077af 100644
--- a/crates/engine/src/commands/expr_tools.rs
+++ b/crates/engine/src/cmd/expr_tools.rs
@@ -163,6 +163,8 @@ pub fn language_menu() -> Vec<(&'static str, Vec<(&'static str, &'static str)>)>
                 ("easeIn(t, tMin, tMax, value1, value2)", "easeIn(t, tMin, tMax, value1, value2)"),
                 ("easeOut(t, value1, value2)", "easeOut(t, value1, value2)"),
                 ("easeOut(t, tMin, tMax, value1, value2)", "easeOut(t, tMin, tMax, value1, value2)"),
+                ("bezier(t, value1, value2, [x1, y1, x2, y2])", "bezier(t, value1, value2, [x1, y1, x2, y2])"),
+                ("bezier(t, tMin, tMax, value1, value2, [x1, y1, x2, y2])", "bezier(t, tMin, tMax, value1, value2, [x1, y1, x2, y2])"),
             ],
         ),
         (
diff --git a/crates/engine/src/commands/file.rs b/crates/engine/src/cmd/file.rs
similarity index 88%
rename from crates/engine/src/commands/file.rs
rename to crates/engine/src/cmd/file.rs
index 8c4c384ea..8129759c5 100644
--- a/crates/engine/src/commands/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -87,7 +87,8 @@ pub(crate) fn open(s: &mut Session, p: &Value) -> Result<Value> {
 /// project opened from an XML copy saves as XML again). Fails, writing nothing, when the project
 /// wouldn't read back.
 pub(crate) fn file_text(s: &Session, path: &str) -> Result<String> {
-    let json = s.project.to_file_json_with_view(&s.saved_view())?;
+    let compact = s.prefs.project.compact_project_files && !crate::xml_project::is_xml_path(path);
+    let json = s.project.to_file_json_with_view(&s.saved_view(), compact)?;
     if crate::xml_project::is_xml_path(path) { crate::xml_project::to_xml(&json).map_err(EngineError::Other) } else { Ok(json) }
 }
 
@@ -124,7 +125,8 @@ fn revert(s: &mut Session, _: &Value) -> Result<Value> {
 }
 
 /// File ▸ Import; with `addToComp` (files dropped on the Timeline or the Composition viewer) they
-/// also become layers of the active comp ([`add_to_comp`]).
+/// also become layers of the active comp ([`add_to_comp`]); with `newComp` (the empty viewer's
+/// New Composition From Footage) they become one new composition instead ([`new_comp`]).
 ///
 /// With `background` (files dropped on the window or picked in the Import dialog) the files are
 /// probed on a background thread, so decoding a slow video doesn't freeze the app: the job shows
@@ -174,10 +176,10 @@ fn import_cmd(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(r)
 }
 
-/// After an import (its result `r`): with `addToComp`, the new items become layers of `target`;
-/// what couldn't be added joins the result's errors.
+/// After an import (its result `r`): with `newComp`, the new items become one new composition;
+/// otherwise with `addToComp`, layers of `target`. What couldn't be added joins the result's errors.
 fn finish_import(s: &mut Session, r: &mut Value, target: Option<ItemId>, p: &Value) {
-    let errors = add_to_comp(s, r, target, p);
+    let errors = if b_p(p, "newComp").unwrap_or(false) { new_comp(s, r) } else { add_to_comp(s, r, target, p) };
     if !errors.is_empty()
         && let Some(e) = r.get_mut("errors").and_then(Value::as_array_mut)
     {
@@ -191,18 +193,7 @@ fn finish_import(s: &mut Session, r: &mut Value, target: Option<ItemId>, p: &Val
 /// Project panel) and the other footage. `target` stays open. Returns what couldn't be added.
 pub(crate) fn add_to_comp(s: &mut Session, r: &Value, target: Option<ItemId>, p: &Value) -> Vec<String> {
     let Some(cid) = target.filter(|_| p.get("addToComp").and_then(Value::as_bool).unwrap_or(false)) else { return vec![] };
-    let ids = |k: &str| r.get(k).and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_u64).collect::<Vec<u64>>();
-    let comps = ids("comps");
-    let in_comps: std::collections::HashSet<u64> = comps
-        .iter()
-        .filter_map(|c| s.project.comp(ItemId(*c)))
-        .flat_map(|c| c.layers.iter())
-        .filter_map(|l| match l.source {
-            LayerSource::Footage { item } | LayerSource::Comp { item } | LayerSource::Solid { item } => Some(item.0),
-            _ => None,
-        })
-        .collect();
-    let add: Vec<u64> = comps.iter().copied().chain(ids("items").into_iter().filter(|i| !in_comps.contains(i))).collect();
+    let add = imported(s, r);
     let mut errors = vec![];
     for (k, item) in add.into_iter().enumerate() {
         let mut params = json!({"comp": cid.0, "item": item, "time": p.get("time"), "position": p.get("position")});
@@ -219,6 +210,55 @@ pub(crate) fn add_to_comp(s: &mut Session, r: &Value, target: Option<ItemId>, p:
     errors
 }
 
+/// What an import (its result `r`) made that belongs in a comp: the comps of layered files
+/// (their layers' footage, in their precomps too, stays in the Project panel), then the other items,
+/// without those comps again or the files' folders.
+fn imported(s: &Session, r: &Value) -> Vec<u64> {
+    let ids = |k: &str| r.get(k).and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_u64).collect::<Vec<u64>>();
+    let comps = ids("comps");
+    let mut in_comps = std::collections::HashSet::new();
+    let mut todo = comps.clone();
+    while let Some(c) = todo.pop() {
+        for l in s.project.comp(ItemId(c)).into_iter().flat_map(|c| c.layers.iter()) {
+            match l.source {
+                LayerSource::Comp { item } if in_comps.insert(item.0) => todo.push(item.0),
+                LayerSource::Footage { item } | LayerSource::Solid { item } => {
+                    in_comps.insert(item.0);
+                }
+                _ => {}
+            }
+        }
+    }
+    let rest = ids("items").into_iter().filter(|i| !in_comps.contains(i) && !comps.contains(i) && !s.project.item(ItemId(*i)).is_some_and(|it| it.is_folder()));
+    comps.iter().copied().chain(rest).collect()
+}
+
+/// With `newComp`, make one composition of the footage and solids an import (its result `r`)
+/// made, as New Comp from Selection does with `single` (first item on top, its settings). A comp
+/// the import made (a layered file) already is the composition, so it stays out, as does data
+/// footage; none left, no new comp. Returns what went wrong.
+fn new_comp(s: &mut Session, r: &Value) -> Vec<String> {
+    let items: Vec<ItemId> = imported(s, r)
+        .into_iter()
+        .map(ItemId)
+        .filter(|i| {
+            s.project.item(*i).is_some_and(|it| match &it.kind {
+                ItemKind::Footage(f) => f.kind != FootageKind::Data,
+                ItemKind::Solid(_) => true,
+                ItemKind::Comp(_) | ItemKind::Folder => false,
+            })
+        })
+        .collect();
+    if items.is_empty() {
+        return vec![];
+    }
+    s.state.project_selection = items;
+    match s.execute("file.newCompFromSelection", json!({"single": true})) {
+        Ok(_) => vec![],
+        Err(e) => vec![e.to_string()],
+    }
+}
+
 /// File ▸ Import, all in one go (scripts and commands built on it); see [`import_cmd`].
 pub(crate) fn import(s: &mut Session, p: &Value) -> Result<Value> {
     let pending = prepare_import(s, p)?;
@@ -287,7 +327,7 @@ impl Prober {
             && self.report_missing_frames
             && let Some(gaps) = crate::sequence::missing_report(&f.sequence)
         {
-            warning = Some(format!("{name}: {gaps} (shown as placeholders)"));
+            warning = Some(format!("{name}: {gaps} (the previous frame is held)"));
         }
         // Settings ▸ Import ▸ Interpret Unlabeled Alpha As: images only (a 3D model renders its
         // own alpha, and audio and data have none).
@@ -560,7 +600,7 @@ pub const DATA_EXTENSIONS: &[&str] = &["json", "csv", "tsv"];
 
 /// A data footage item for `path` (JSON / CSV / TSV), `None` for other files.
 pub(crate) fn data_footage(services: &dyn crate::Services, path: &str) -> Option<std::result::Result<effectcraft_project::Footage, String>> {
-    let ext = std::path::Path::new(path).extension().and_then(|e| e.to_str()).unwrap_or("").to_ascii_lowercase();
+    let ext = std::path::Path::new(path).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("").to_ascii_lowercase();
     if !DATA_EXTENSIONS.contains(&ext.as_str()) {
         return None;
     }
@@ -665,13 +705,22 @@ fn project_settings(s: &mut Session, p: &Value) -> Result<Value> {
             proj.settings.time_display = effectcraft_project::TimeDisplayStyle::parse(t)
                 .ok_or_else(|| bad("file.projectSettings", format!("timeDisplay: timecode|frames|feet35|feet16, not `{t}`")))?;
         }
+        if let Some(f) = p.get("frameStart") {
+            // Frame Count: After Effects offers Start at 0 and Start at 1 only. Scripts and dialog
+            // number fields may send `1.0`.
+            proj.settings.frame_start = match f.as_f64() {
+                Some(0.0) => 0,
+                Some(1.0) => 1,
+                _ => return Err(bad(cmd, format!("frameStart: 0|1, not `{f}`"))),
+            };
+        }
         Ok(())
     })?;
     Ok(serde_json::to_value(&s.project.settings).unwrap_or_default())
 }
 
-/// Video Rendering and Effects: report or set the renderer (Mercury GPU Acceleration when a GPU
-/// adapter exists, else Mercury Software Only).
+/// Video Rendering and Effects: report or set the renderer (GPU Acceleration when a GPU
+/// adapter exists, else Software Rendering).
 fn render_backend(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(b) = p.get("backend").or_else(|| p.get("renderer")) {
         let gpu = match b {
@@ -699,14 +748,14 @@ pub fn backend_status(s: &Session) -> Value {
     let gpu = s.project.settings.gpu_acceleration;
     // Why it renders on the CPU (#262).
     let why = if !gpu {
-        Some("the project's renderer is Mercury Software Only".to_string())
+        Some("the project's renderer is Software Rendering".to_string())
     } else if adapter.is_none() {
         Some(s.accel_note.clone().unwrap_or_else(|| "no GPU compositor is attached".into()))
     } else {
         None
     };
     json!({
-        "renderer": if gpu { "Mercury GPU Acceleration" } else { "Mercury Software Only" },
+        "renderer": if gpu { "GPU Acceleration" } else { "Software Rendering" },
         "gpuAcceleration": gpu,
         "adapter": adapter,
         "active": if gpu && adapter.is_some() { "gpu" } else { "cpu" },
@@ -736,7 +785,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "File...",
             ["File", "Import"],
             Some("Cmd+I"),
-            "{paths: [string] (files or folders), sequence?: bool (the Sequence checkbox: true imports numbered stills of one run as one image sequence, one picked file bringing its whole run and several picked files that range; default: a numbered still brings its run, except dropped files (drag), which import as stills as in After Effects; folders' runs import as sequences; false imports stills and a folder's files individually), alphabetical?: bool (Force Alphabetical Order: every image of that type in the folder, by name), frameRate?: fps (image sequences; default Settings ▸ Import ▸ Sequence Footage), importAs?: footage|composition|compositionLayerSizes (Photoshop, PDF, Illustrator and EPS files), layer?: name|index (footage of one Photoshop layer), page?: number from 1 (PDF / Illustrator page), drag?: bool (dropped files: Settings ▸ Import ▸ Default Drag Import As; files import as stills unless sequence), addToComp?: bool (also add them to the active comp, at time?, index?, position? as in layer.addItem), background?: bool (probe the files in a background job, jobs.list / jobs.wait; returns {job})}",
+            "{paths: [string] (files or folders), sequence?: bool (the Sequence checkbox: true imports numbered stills of one run as one image sequence, one picked file bringing its whole run and several picked files that range; default false: picked or dropped files import as stills, as in After Effects; folders' runs import as sequences; false imports stills and a folder's files individually), alphabetical?: bool (Force Alphabetical Order: every image of that type in the folder, by name), frameRate?: fps (image sequences; default Settings ▸ Import ▸ Sequence Footage), importAs?: footage|composition|compositionLayerSizes (Photoshop, PDF, Illustrator and EPS files), layer?: name|index (footage of one Photoshop layer), page?: number from 1 (PDF / Illustrator page), drag?: bool (dropped files: Settings ▸ Import ▸ Default Drag Import As; files import as stills unless sequence), addToComp?: bool (also add them to the active comp, at time?, index?, position? as in layer.addItem), newComp?: bool (make one new composition of the footage and solids imported, as file.newCompFromSelection with single; a layered file imported as a composition is that composition and gets no other; takes precedence over addToComp), background?: bool (probe the files in a background job, jobs.list / jobs.wait; returns {job})}",
             always,
             import_cmd
         ),
@@ -745,7 +794,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Project Settings...",
             ["File"],
             Some("Cmd+Alt+Shift+K"),
-            "{bitDepth?: 8|16|32, colorEngine?: adobe|ocio, workingSpace?: none|srgb|rec709|rec2020|p3|acescg|aces2065, workingGamma?: 2.2|2.4 (with no working space), linearize?, blendLinear?, hdr?: clip|compand|toneMap, outputSpace?: srgb|rec709|rec2020|p3|rec2100pq|rec2100hlg, renderer?: gpu|software, timeDisplay?: timecode|frames|feet35|feet16}",
+            "{bitDepth?: 8|16|32, colorEngine?: adobe|ocio, workingSpace?: none|srgb|rec709|rec2020|p3|acescg|aces2065, workingGamma?: 2.2|2.4 (with no working space), linearize?, blendLinear?, hdr?: clip|compand|toneMap, outputSpace?: srgb|rec709|rec2020|p3|rec2100pq|rec2100hlg, renderer?: gpu|software, timeDisplay?: timecode|frames|feet35|feet16, frameStart?: 0|1 (Frame Count: Start at 0 / Start at 1)}",
             always,
             project_settings
         ),
diff --git a/crates/engine/src/commands/file_more.rs b/crates/engine/src/cmd/file_more.rs
similarity index 77%
rename from crates/engine/src/commands/file_more.rs
rename to crates/engine/src/cmd/file_more.rs
index 74a86e1d8..168529c47 100644
--- a/crates/engine/src/commands/file_more.rs
+++ b/crates/engine/src/cmd/file_more.rs
@@ -5,13 +5,13 @@
 use std::collections::{BTreeMap, BTreeSet};
 
 use effectcraft_color::Label;
-use effectcraft_project::{AlphaMode, Comp, Footage, FootageKind, ItemId, ItemKind, LayerSource, Project, Solid, limits};
+use effectcraft_project::{AlphaMode, CineonSettings, CineonUnits, Comp, Footage, FootageKind, ItemId, ItemKind, LayerSource, Project, Solid, limits};
 use effectcraft_time::{FrameRate, Tick};
 use serde_json::{Value, json};
 
 use super::{CommandSpec, always, b_p, bad, f_p, has_comp, has_project_selection, str_p};
 use crate::sequence::SequenceOptions;
-use crate::{EngineError, Result, Session, cmd};
+use crate::{EngineError, Result, Session, cmd, query};
 
 fn has_footage_selection(s: &Session) -> std::result::Result<(), String> {
     if selected_footage(s).is_empty() { Err("select footage in the Project panel".into()) } else { Ok(()) }
@@ -78,11 +78,19 @@ fn close_project(s: &mut Session, _: &Value) -> Result<Value> {
 
 fn save_copy(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_p(p, "path").ok_or_else(|| bad("file.saveCopy", "missing `path`"))?;
+    s.refuse_export(path)?;
     let json = super::file::file_text(s, path)?;
-    s.services.write_file(path, json.as_bytes()).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(path, json.as_bytes())?;
     Ok(json!({"path": path, "bytes": json.len()}))
 }
 
+/// `file.checkOutput {path}`: the commands that write to a path never replace footage, a proxy
+/// or the project file; this says beforehand, for callers that write the file themselves.
+fn check_output(s: &mut Session, p: &Value) -> Result<Value> {
+    let path = str_p(p, "path").ok_or_else(|| bad("file.checkOutput", "missing `path`"))?;
+    Ok(s.output_status(path))
+}
+
 fn rate_of(p: &Value) -> FrameRate {
     f_p(p, "frameRate").map(|f| limits::frame_rate(FrameRate::from_f64(f), FrameRate::FPS_29_97)).unwrap_or(FrameRate::FPS_29_97)
 }
@@ -376,41 +384,6 @@ fn find_missing(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn collect_files(s: &mut Session, p: &Value) -> Result<Value> {
     let folder = str_p(p, "folder").ok_or_else(|| bad("file.collectFiles", "missing `folder`"))?.trim_end_matches('/').to_string();
-    // Collect Files makes its folder (and the footage folder inside it).
-    #[cfg(not(target_arch = "wasm32"))]
-    std::fs::create_dir_all(format!("{folder}/(Footage)")).map_err(|e| EngineError::Other(format!("cannot create {folder}: {e}")))?;
-    let mut proj = (*s.project).clone();
-    let mut copied = 0;
-    let mut errors = vec![];
-    let mut used_names = BTreeSet::new();
-    for it in proj.items.values_mut() {
-        let ItemKind::Footage(f) = &mut it.kind else { continue };
-        if f.path.is_empty() {
-            continue;
-        }
-        let files: Vec<String> = if f.sequence.is_empty() { vec![f.path.clone()] } else { f.sequence.clone() };
-        let mut new_paths = vec![];
-        for src in &files {
-            let mut name = std::path::Path::new(src).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "footage".into());
-            let mut k = 2;
-            while !used_names.insert(name.clone()) {
-                name = format!("{k}_{name}");
-                k += 1;
-            }
-            let dst = format!("{folder}/(Footage)/{name}");
-            match s.services.read_file(src).and_then(|bytes| s.services.write_file(&dst, &bytes)) {
-                Ok(()) => copied += 1,
-                Err(e) => errors.push(format!("{src}: {e}")),
-            }
-            new_paths.push(dst);
-        }
-        if f.sequence.is_empty() {
-            f.path = new_paths.remove(0);
-        } else {
-            f.path = new_paths.first().cloned().unwrap_or_default();
-            f.sequence = new_paths;
-        }
-    }
     let stem = s
         .path
         .as_deref()
@@ -418,7 +391,67 @@ fn collect_files(s: &mut Session, p: &Value) -> Result<Value> {
         .map(|n| n.to_string_lossy().to_string())
         .unwrap_or_else(|| "Untitled Project".into());
     let out = format!("{folder}/{stem}.ecproj");
-    s.services.write_file(&out, proj.to_json().as_bytes()).map_err(|e| EngineError::Other(format!("cannot write {out}: {e}")))?;
+    // Where every copy goes, before anything is made: a copy never lands on a file the project
+    // reads (other footage, a proxy, the project file itself), and then nothing is written.
+    let protected = s.protected_files();
+    let mut used_names = BTreeSet::new();
+    let mut plan: Vec<(ItemId, Vec<(String, String)>)> = vec![];
+    for it in s.project.items.values() {
+        let ItemKind::Footage(f) = &it.kind else { continue };
+        if f.path.is_empty() {
+            continue;
+        }
+        let files: Vec<&String> = if f.sequence.is_empty() { vec![&f.path] } else { f.sequence.iter().collect() };
+        let mut pairs = vec![];
+        for src in files {
+            let mut name = std::path::Path::new(src).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "footage".into());
+            let mut k = 2;
+            while !used_names.insert(name.clone()) {
+                name = format!("{k}_{name}");
+                k += 1;
+            }
+            let dst = format!("{folder}/(Footage)/{name}");
+            // A file that is already where its copy goes stays (it is not copied onto itself).
+            if !crate::output_guard::same_file(std::path::Path::new(src), std::path::Path::new(&dst))
+                && let Some(source) = protected.find(std::path::Path::new(&dst))
+            {
+                return Err(EngineError::Other(format!("Nothing was collected. {}", source.refusal(&dst, crate::output_guard::Use::Export))));
+            }
+            pairs.push((src.clone(), dst));
+        }
+        plan.push((it.id, pairs));
+    }
+    if let Some(source) = protected.find(std::path::Path::new(&out)) {
+        return Err(EngineError::Other(format!("Nothing was collected. {}", source.refusal(&out, crate::output_guard::Use::Export))));
+    }
+    // Collect Files makes its folder (and the footage folder inside it).
+    #[cfg(not(target_arch = "wasm32"))]
+    std::fs::create_dir_all(format!("{folder}/(Footage)")).map_err(|e| EngineError::Other(format!("cannot create {folder}: {e}")))?;
+    let mut proj = (*s.project).clone();
+    let mut copied = 0;
+    let mut errors = vec![];
+    for (id, pairs) in plan {
+        let mut new_paths = vec![];
+        for (src, dst) in &pairs {
+            if crate::output_guard::same_file(std::path::Path::new(src), std::path::Path::new(dst)) {
+                copied += 1;
+            } else {
+                match s.services.read_file(src).and_then(|bytes| s.write_output_with(&protected, dst, &bytes).map_err(std::io::Error::other)) {
+                    Ok(()) => copied += 1,
+                    Err(e) => errors.push(format!("{src}: {e}")),
+                }
+            }
+            new_paths.push(dst.clone());
+        }
+        let Some(ItemKind::Footage(f)) = proj.items.get_mut(&id).map(|it| &mut it.kind) else { continue };
+        if f.sequence.is_empty() {
+            f.path = new_paths.pop().unwrap_or_default();
+        } else {
+            f.path = new_paths.first().cloned().unwrap_or_default();
+            f.sequence = new_paths;
+        }
+    }
+    s.write_output_with(&protected, &out, proj.to_json().as_bytes())?;
     s.toast(format!("Collected {copied} file(s) into {folder}"));
     Ok(json!({"project": out, "copied": copied, "errors": errors}))
 }
@@ -430,6 +463,20 @@ fn collect_files(s: &mut Session, p: &Value) -> Result<Value> {
 /// array or JSON lines of `{"command": id, "params": {…}}` (also accepts the control channel's
 /// `{"method": "engine.execute", "params": {"id", "params"}}`).
 fn run_script(s: &mut Session, p: &Value) -> Result<Value> {
+    // File ▸ Scripts ▸ Recent Script Files ▸ <script> (0 is the most recent).
+    if let Some(i) = p.get("recent") {
+        let i = i.as_u64().ok_or_else(|| bad("file.runScript", format!("`recent` must be an index, not {i}")))?;
+        let script = match s.prefs.recent_scripts.get(usize::try_from(i).unwrap_or(usize::MAX)) {
+            Some(x) => x.clone(),
+            None if s.prefs.recent_scripts.is_empty() => return Err(bad("file.runScript", "no recent script files")),
+            None => return Err(bad("file.runScript", format!("no recent script file #{i}"))),
+        };
+        let q = match script {
+            crate::prefs::RecentScript::Path(path) => json!({"path": path}),
+            crate::prefs::RecentScript::Name(name) => json!({"name": name}),
+        };
+        return run_script(s, &q);
+    }
     // File ▸ Scripts ▸ <installed or sample script>.
     if let Some(name) = str_p(p, "name")
         && p.get("path").is_none()
@@ -446,15 +493,22 @@ fn run_script(s: &mut Session, p: &Value) -> Result<Value> {
             return Err(bad("file.runScript", JSXBIN));
         }
         let bytes = s.services.read_file(path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
+        let full = s.services.full_path(path);
         let code = String::from_utf8_lossy(&bytes).to_string();
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
         let out = run_js(s, &code, path, false)?;
-        return report_js(s, &name, out);
+        let result = report_js(s, &name, out)?;
+        if let Some(full) = full {
+            remember_script(s, crate::prefs::RecentScript::Path(full));
+        }
+        return Ok(result);
     }
+    let mut script_path = None;
     let steps: Vec<Value> = match (p.get("steps"), str_p(p, "path")) {
         (Some(Value::Array(a)), _) => a.clone(),
         (_, Some(path)) => {
             let bytes = s.services.read_file(path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
+            script_path = s.services.full_path(path);
             let text = String::from_utf8_lossy(&bytes).to_string();
             match serde_json::from_str::<Value>(&text) {
                 Ok(Value::Array(a)) => a,
@@ -480,16 +534,26 @@ fn run_script(s: &mut Session, p: &Value) -> Result<Value> {
             }
             _ => return Err(bad("file.runScript", format!("step {}: needs `command`", i + 1))),
         };
-        if id == "file.runScript" || id == "script.run" {
+        if super::scripts::RUNS_SCRIPTS.contains(&id.as_str()) {
             return Err(bad("file.runScript", "scripts can't run scripts"));
         }
         let r = if from_file { s.execute_for_script(&id, params) } else { s.execute(&id, params) };
         let r = r.map_err(|e| EngineError::Other(format!("step {} ({id}): {e}", i + 1)))?;
         results.push(r);
     }
+    if let Some(path) = script_path {
+        remember_script(s, crate::prefs::RecentScript::Path(path));
+    }
     Ok(json!({"steps": results.len(), "results": results}))
 }
 
+/// Remember a script that runs for File ▸ Scripts ▸ Recent Script Files.
+pub(super) fn remember_script(s: &mut Session, script: crate::prefs::RecentScript) {
+    s.prefs.push_recent_script(script);
+    s.save_prefs();
+    s.prefs_revision += 1;
+}
+
 /// `.jsx` / `.js` (and `.jsxbin`, rejected) are JavaScript; `.json` / `.jsonl` / other files are
 /// command scripts.
 fn is_js_script(path: &str) -> bool {
@@ -505,7 +569,7 @@ fn is_jsxbin(name: &str) -> bool {
 }
 
 /// A script error becomes a toast and a command error.
-fn report_js(s: &mut Session, name: &str, out: Value) -> Result<Value> {
+pub(crate) fn report_js(s: &mut Session, name: &str, out: Value) -> Result<Value> {
     if let Some(e) = out.get("error").filter(|e| !e.is_null()) {
         let line = e.get("line").and_then(Value::as_u64).map(|l| format!(" (line {l})")).unwrap_or_default();
         let msg = e.get("message").and_then(Value::as_str).unwrap_or("script error");
@@ -521,6 +585,13 @@ pub(crate) fn run_js_named(s: &mut Session, code: &str, name: &str) -> Result<Va
     report_js(s, name, out)
 }
 
+/// Run the code of the script file at `path` (its `#include`s and `$.fileName` use that path),
+/// reported under its file name `name` (Startup and Shutdown scripts).
+pub(crate) fn run_js_file(s: &mut Session, code: &str, path: &str, name: &str) -> Result<Value> {
+    let out = run_js(s, code, path, false)?;
+    report_js(s, name, out)
+}
+
 /// Run JavaScript through the session's scripting engine.
 fn run_js(s: &mut Session, code: &str, name: &str, console: bool) -> Result<Value> {
     let runner = s.script.ok_or_else(|| EngineError::Other("JavaScript scripting is not available in this build".into()))?;
@@ -563,6 +634,131 @@ pub(crate) struct Interpretation {
     preserve_rgb: Option<bool>,
     /// Start Timecode.
     start: Option<StartTimecode>,
+    /// Cineon Settings (DPX and Cineon footage).
+    cineon: CineonEdit,
+}
+
+/// Interpret Footage ▸ Cineon Settings parsed from command parameters (every field optional).
+#[derive(Clone, Debug, Default)]
+struct CineonEdit {
+    /// Logarithmic Conversion.
+    log: Option<bool>,
+    units: Option<CineonUnits>,
+    /// The units the Converted Black and White Points are given in (`pointUnits`, else `cineonUnits`,
+    /// else the footage's own Units).
+    point_units: Option<CineonUnits>,
+    converted_black: Option<f64>,
+    converted_white: Option<f64>,
+    /// 10 Bit Black and White Points.
+    black: Option<f64>,
+    white: Option<f64>,
+    gamma: Option<f64>,
+    rolloff: Option<f64>,
+}
+
+impl CineonEdit {
+    fn parse(p: &Value, cmd: &str) -> Result<CineonEdit> {
+        let units = |key: &str| -> Result<Option<CineonUnits>> {
+            match str_p(p, key) {
+                None => Ok(None),
+                Some(u) => CineonUnits::parse(u).map(Some).ok_or_else(|| bad(cmd, format!("{key}: 10bit|8bit|float, not `{u}`"))),
+            }
+        };
+        let num = |key: &str, lo: f64, hi: f64| -> Result<Option<f64>> {
+            match p.get(key) {
+                None | Some(Value::Null) => Ok(None),
+                Some(v) => v
+                    .as_f64()
+                    .filter(|x| x.is_finite() && (lo..=hi).contains(x))
+                    .map(Some)
+                    .ok_or_else(|| bad(cmd, format!("{key}: a number from {lo} to {hi}"))),
+            }
+        };
+        let units_now = units("cineonUnits")?;
+        Ok(CineonEdit {
+            log: b_p(p, "logConversion"),
+            units: units_now,
+            point_units: units("pointUnits")?.or(units_now),
+            // Range-checked once their units are known (`settings_for`).
+            converted_black: num("convertedBlack", f64::MIN, f64::MAX)?,
+            converted_white: num("convertedWhite", f64::MIN, f64::MAX)?,
+            black: num("tenBitBlack", 0.0, 1023.0)?,
+            white: num("tenBitWhite", 0.0, 1023.0)?,
+            gamma: num("currentGamma", 0.1, 10.0)?,
+            rolloff: num("highlightRolloff", 0.0, 100.0)?,
+        })
+    }
+
+    fn is_empty(&self) -> bool {
+        self.log.is_none()
+            && self.units.is_none()
+            && self.converted_black.is_none()
+            && self.converted_white.is_none()
+            && self.black.is_none()
+            && self.white.is_none()
+            && self.gamma.is_none()
+            && self.rolloff.is_none()
+    }
+
+    /// Footage `f`'s Cineon Settings after this edit; `None` when nothing changes them (no Cineon
+    /// parameters, or `f` is not a DPX or Cineon file).
+    fn settings_for(&self, f: &Footage, cmd: &str) -> Result<Option<CineonSettings>> {
+        if self.is_empty() || !f.is_cineon_file() {
+            return Ok(None);
+        }
+        let mut c = f.cineon;
+        let units = self.point_units.unwrap_or(c.units);
+        let point = |v: f64| -> Result<f32> {
+            let ten = units.to_ten_bit(v);
+            let max = units.from_ten_bit(f64::from(CineonSettings::MAX));
+            if (0.0..=f64::from(CineonSettings::MAX)).contains(&ten) {
+                Ok(ten as f32)
+            } else {
+                Err(bad(cmd, format!("converted points: 0 to {max} in {} units", units.label())))
+            }
+        };
+        if let Some(v) = self.converted_black {
+            c.converted_black = point(v)?;
+        }
+        if let Some(v) = self.converted_white {
+            c.converted_white = point(v)?;
+        }
+        if let Some(v) = self.log {
+            c.log_conversion = v;
+        }
+        if let Some(u) = self.units {
+            c.units = u;
+        }
+        if let Some(v) = self.black {
+            c.black = v as f32;
+        }
+        if let Some(v) = self.white {
+            c.white = v as f32;
+        }
+        if let Some(v) = self.gamma {
+            c.gamma = v as f32;
+        }
+        if let Some(v) = self.rolloff {
+            c.rolloff = v as f32;
+        }
+        if c.black >= c.white {
+            return Err(bad(cmd, "the 10 Bit Black Point must be below the 10 Bit White Point"));
+        }
+        Ok(Some(c))
+    }
+}
+
+/// Footage `f`'s Cineon Settings as commands report them (`null` for files they don't apply to).
+fn cineon_json(f: &Footage) -> Value {
+    if !f.is_cineon_file() {
+        return Value::Null;
+    }
+    let c = &f.cineon;
+    json!({
+        "logConversion": c.log_conversion, "units": c.units.id(),
+        "convertedBlack": c.units.from_ten_bit(f64::from(c.converted_black)), "convertedWhite": c.units.from_ten_bit(f64::from(c.converted_white)),
+        "tenBitBlack": c.black, "tenBitWhite": c.white, "currentGamma": c.gamma, "highlightRolloff": c.rolloff,
+    })
 }
 
 /// Interpret Footage ▸ Start Timecode.
@@ -656,9 +852,23 @@ impl Interpretation {
                 v.as_f64().filter(|x| x.is_finite() && (0.0..=StartTimecode::MAX as f64).contains(x)).map(|x| x.round() as i64).ok_or_else(start_err)?,
             )),
         };
+        it.cineon = CineonEdit::parse(p, cmd)?;
         Ok(it)
     }
 
+    /// Check the Cineon Settings this interpretation gives each of `footage`: an error names a
+    /// value out of range, or Cineon parameters when none of the footage is DPX or Cineon.
+    pub(crate) fn check<'a>(&self, footage: impl IntoIterator<Item = &'a Footage>, cmd: &str) -> Result<()> {
+        if self.cineon.is_empty() {
+            return Ok(());
+        }
+        let mut any = false;
+        for f in footage {
+            any |= self.cineon.settings_for(f, cmd)?.is_some();
+        }
+        if any { Ok(()) } else { Err(bad(cmd, "Cineon Settings apply to DPX and Cineon footage only")) }
+    }
+
     pub(crate) fn apply(&self, f: &mut Footage, guessed: Option<(AlphaMode, [f32; 3])>) {
         let before = f.frame_rate;
         self.apply_settings(f, guessed);
@@ -718,6 +928,10 @@ impl Interpretation {
         if let Some(v) = self.preserve_rgb {
             f.preserve_rgb = v;
         }
+        // Checked before the edit (`Interpretation::check`).
+        if let Ok(Some(c)) = self.cineon.settings_for(f, "file.interpretFootage") {
+            f.cineon = c;
+        }
         // After the frame rate: timecode is read at the footage's rate.
         if let Some(start) = self.start.as_ref().and_then(|t| t.frame(f.frame_rate)) {
             f.start_timecode = start;
@@ -764,6 +978,11 @@ fn interpret(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad("file.interpretFootage", "select footage"));
     }
     let it = Interpretation::parse(p, "file.interpretFootage")?;
+    let footage = items.iter().filter_map(|i| match s.project.item(*i).map(|x| &x.kind) {
+        Some(ItemKind::Footage(f)) => Some(f),
+        _ => None,
+    });
+    it.check(footage, "file.interpretFootage")?;
     let guesses: Vec<Option<(AlphaMode, [f32; 3])>> = items
         .iter()
         .map(|i| match (it.guess, s.project.item(*i).map(|x| &x.kind)) {
@@ -799,7 +1018,7 @@ fn interpret(s: &mut Session, p: &Value) -> Result<Value> {
                 "item": i.0, "alpha": format!("{:?}", f.alpha), "matteColor": f.premul_color, "invertAlpha": f.invert_alpha,
                 "fields": f.fields.label(), "pixelAspect": f.pixel_aspect, "loop": f.loop_count, "frameRate": f.frame_rate.as_f64(),
                 "linearLight": f.linear_light, "preserveRgb": f.preserve_rgb, "startTimecode": f.timecode(0), "overrideStart": f.start_timecode.is_some(),
-                "frames": f.sequence_frames(),
+                "frames": f.sequence_frames(), "cineon": cineon_json(f),
             })),
             _ => None,
         })
@@ -830,6 +1049,9 @@ fn apply_interpretation(s: &mut Session, p: &Value) -> Result<Value> {
                 f.linear_light = src.linear_light;
                 f.preserve_rgb = src.preserve_rgb;
                 f.color_profile = src.color_profile;
+                if f.is_cineon_file() && src.is_cineon_file() {
+                    f.cineon = src.cineon;
+                }
                 if src.native_rate.is_some() {
                     if f.native_rate.is_none() {
                         f.native_rate = Some(f.frame_rate);
@@ -847,10 +1069,34 @@ fn replace_footage(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_p(p, "path").ok_or_else(|| bad("file.replaceFootage", "missing `path`"))?.to_string();
     let item = *items_p(s, p).first().ok_or_else(|| bad("file.replaceFootage", "select footage"))?;
     let importer = s.importer.clone().ok_or_else(|| EngineError::Other("media import is not available in this build".into()))?;
-    // A numbered still brings its image sequence, as on import (`sequence: false` for one frame).
-    let opts = SequenceOptions::from_params(p);
+    // Replacing a still keeps it a still; replacing a sequence keeps bringing the new file's run.
+    // `sequence`/`alphabetical` override that (#2073).
+    let previous = match s.project.item(item).map(|it| &it.kind) {
+        Some(ItemKind::Footage(f)) if f.kind == FootageKind::Sequence => (true, true, f.alphabetical),
+        _ => (false, false, false),
+    };
+    // Only `sequence` decides whether the item keeps its kind; `alphabetical` is a sequence
+    // modifier, not a request to make one.
+    let inherited = b_p(p, "sequence").is_none();
+    let mut opts = SequenceOptions::from_params(p);
+    if inherited {
+        (opts.sequence, opts.folders) = (previous.0, previous.1);
+        if previous.0 && b_p(p, "alphabetical").is_none() {
+            opts.alphabetical = previous.2;
+        }
+    }
     let src = crate::sequence::source_of(s.services.as_ref(), &path, opts);
-    let f = crate::sequence::probe(importer.as_ref(), &src, s.sequence_rate()).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let mut f = crate::sequence::probe(importer.as_ref(), &src, s.sequence_rate()).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    // A single-file source comes back as a still; an inherited sequence kind keeps it a
+    // one-frame sequence, so a later default replacement still brings numbered runs (#2073).
+    if inherited && previous.0 && matches!(src, crate::sequence::Source::File(_)) && f.kind == FootageKind::Still {
+        f.kind = FootageKind::Sequence;
+        f.sequence = vec![f.path.clone()];
+        f.alphabetical = opts.alphabetical;
+        f.frame_rate = s.sequence_rate();
+        f.native_rate = None;
+        f.sync_sequence_duration();
+    }
     let name = src.name();
     // Replacing a missing file relinks the other missing files that moved with it (as After Effects
     // does when you locate one).
@@ -960,6 +1206,12 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("file.close", "Close", ["File"], Some("Cmd+W"), "{comp?}", has_comp, close),
         cmd!("file.closeProject", "Close Project", ["File"], None, "{}", always, close_project),
         cmd!("file.saveCopy", "Save a Copy...", ["File", "Save As"], None, "{path}", always, save_copy),
+        query!(
+            "file.checkOutput",
+            "Check Output File",
+            "{path} → {path, blocked, source?: footage|proxy|project, reason?}: whether an export may be written to path (it may not replace a file the project reads)",
+            check_output
+        ),
         cmd!("file.importMultiple", "Multiple Files...", ["File", "Import"], Some("Cmd+Alt+I"), "{paths: [string]}", always, |s, p| s
             .execute("file.import", p.clone())),
         cmd!(
@@ -1017,7 +1269,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Run Script File...",
             ["File", "Scripts"],
             None,
-            "{path (.jsx/.js JavaScript, or a .jsonl/.json command script) | name (an installed or sample script, see file.scripts.list) | steps: [{command, params}]}",
+            "{path (.jsx/.js JavaScript, or a .jsonl/.json command script) | name (an installed or sample script, see file.scripts.list) | recent: index (File ▸ Scripts ▸ Recent Script Files, 0 = the most recent) | steps: [{command, params}]}",
             always,
             run_script
         ),
@@ -1035,7 +1287,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Main...",
             ["File", "Interpret Footage"],
             Some("Cmd+Alt+G"),
-            "{items?, frameRate?: fps|\"file\", alpha?: straight|premultiplied|ignore|guess, guessAlpha?, matteColor?, invertAlpha?, loop?, pixelAspect?, fields?: off|upper|lower, colorProfile?: srgb|rec709|rec2020|p3|auto, linearLight?, preserveRgb? (the file's values unconverted), overrideStart?: bool (false: Use Source File Timecode), startTimecode?: timecode|frame (Override Start)}",
+            "{items?|item?, frameRate?: fps|\"file\", alpha?: straight|premultiplied|ignore|guess, guessAlpha?, matteColor?|premulColor?, invertAlpha?, loop?, pixelAspect?, fields?: off|upper|lower, colorProfile?: srgb|rec709|rec2020|p3|auto, linearLight?, preserveRgb? (the file's values unconverted), overrideStart?: bool (false: Use Source File Timecode), startTimecode?: timecode|frame (Override Start), logConversion? (Cineon Settings of DPX and Cineon files), cineonUnits?: 10bit|8bit|float, convertedBlack?, convertedWhite?, pointUnits?: 10bit|8bit|float (the units of convertedBlack and convertedWhite; default cineonUnits, else the footage's Units), tenBitBlack?, tenBitWhite? (0..1023), currentGamma? (0.1..10), highlightRolloff? (0..100)}",
             has_footage_selection,
             interpret
         ),
@@ -1053,7 +1305,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Apply Interpretation",
             ["File", "Interpret Footage"],
             Some("Cmd+Alt+V"),
-            "{items?}",
+            "{items?|item?}",
             has_interpretation,
             apply_interpretation
         ),
@@ -1062,7 +1314,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "File...",
             ["File", "Replace Footage"],
             Some("Cmd+H"),
-            "{path, item?, sequence?: bool (default true: a numbered still brings its image sequence), alphabetical?: bool}",
+            "{path, item?, sequence?: bool (a numbered still brings its image sequence; default: the item keeps its kind, so a still stays a still and a sequence stays a sequence), alphabetical?: bool}",
             has_footage_selection,
             replace_footage
         ),
@@ -1084,7 +1336,7 @@ pub fn specs() -> Vec<CommandSpec> {
             has_footage_selection,
             replace_with_solid
         ),
-        cmd!("file.reloadFootage", "Reload Footage", ["File"], Some("Cmd+Alt+L"), "{items?}", has_footage_selection, reload),
+        cmd!("file.reloadFootage", "Reload Footage", ["File"], Some("Cmd+Alt+L"), "{items?|item?}", has_footage_selection, reload),
         cmd!("file.revealInFinder", "Reveal in Finder", ["File"], None, "{item?}", has_footage_selection, reveal_in_finder),
     ]
 }
diff --git a/crates/engine/src/commands/focus.rs b/crates/engine/src/cmd/focus.rs
similarity index 93%
rename from crates/engine/src/commands/focus.rs
rename to crates/engine/src/cmd/focus.rs
index 013672a38..356ce1a07 100644
--- a/crates/engine/src/commands/focus.rs
+++ b/crates/engine/src/cmd/focus.rs
@@ -78,6 +78,12 @@ fn set_to_layer(s: &mut Session, p: &Value) -> Result<Value> {
     let c = "camera.setFocusToLayer";
     let (cid, cam, target) = refs(s, p, c, true)?;
     let d = focus_depth(s, cid, cam, target.ok_or_else(|| bad(c, "no layer"))?).ok_or_else(|| bad(c, "can't evaluate the layers"))?;
+    // Only a finite depth can be stored: JSON has no infinity or NaN, so the project could no
+    // longer be saved. Extreme but finite positions can still produce one, and `d <= 0.0` is
+    // false for NaN.
+    if !d.is_finite() {
+        return Err(bad(c, "can't measure the distance to the layer (the camera or layer position is out of range)"));
+    }
     if d <= 0.0 {
         return Err(bad(c, "the layer is behind the camera"));
     }
diff --git a/crates/engine/src/commands/footage_panel.rs b/crates/engine/src/cmd/footage_panel.rs
similarity index 96%
rename from crates/engine/src/commands/footage_panel.rs
rename to crates/engine/src/cmd/footage_panel.rs
index 1bd0d2236..2ec9f4be2 100644
--- a/crates/engine/src/commands/footage_panel.rs
+++ b/crates/engine/src/cmd/footage_panel.rs
@@ -56,6 +56,12 @@ pub fn timecode(item: Option<&effectcraft_project::Item>, fr: effectcraft_time::
     }
 }
 
+/// The frame the Footage panel shows: footage `f` at source time `t`, with its Cineon Settings
+/// applied.
+pub fn frame(s: &Session, item: ItemId, f: &effectcraft_project::Footage, t: Tick) -> Option<std::sync::Arc<effectcraft_raster::Image>> {
+    s.footage.frame(item, f, t).map(|img| effectcraft_render::cineon_frame(img, f))
+}
+
 fn source_time(s: &Session, p: &Value, item: ItemId) -> Option<Tick> {
     let (_, fr) = source_timing(s, item);
     if let Some(t) = f_p(p, "time") {
@@ -207,10 +213,7 @@ fn info(s: &mut Session, _: &Value) -> Result<Value> {
     let item = s.project.item(v.item);
     let name = item.map(|i| i.name.clone()).unwrap_or_default();
     let frame = fr.frame_at(v.time);
-    let problem = match item.map(|i| &i.kind) {
-        Some(ItemKind::Footage(f)) => s.footage.problem(f),
-        _ => None,
-    };
+    let problem = item.and_then(|i| s.footage.item_problem(i));
     Ok(
         json!({"item": v.item.0, "name": name, "time": v.time.seconds(), "frame": frame, "timecode": timecode(item, fr, frame), "in": v.in_point.map(|t| t.seconds()), "out": v.out_point.map(|t| t.seconds()), "duration": dur.map(|d| d.seconds()), "frameRate": fr.as_f64(), "problem": problem}),
     )
diff --git a/crates/engine/src/commands/frame_export.rs b/crates/engine/src/cmd/frame_export.rs
similarity index 86%
rename from crates/engine/src/commands/frame_export.rs
rename to crates/engine/src/cmd/frame_export.rs
index baad9b6ef..d6f491fb0 100644
--- a/crates/engine/src/commands/frame_export.rs
+++ b/crates/engine/src/cmd/frame_export.rs
@@ -27,12 +27,14 @@ struct Isolated {
     image: Image,
 }
 
-fn render_with(s: &Session, project: &Project, comp: ItemId, t: Tick, scale: f64) -> Image {
+/// `skip_hdr_step`: no HDR step, for a float output (ProEXR; [`RenderOpts::skip_hdr_step`]).
+fn render_with(s: &Session, project: &Project, comp: ItemId, t: Tick, scale: f64, skip_hdr_step: bool) -> Image {
     let opts = RenderOpts {
         scale,
         backend: Backend::Auto,
         nested_switches: s.prefs.general.switches_affect_nested_comps,
         draft_shadows: s.prefs.three_d.realtime_shadows,
+        skip_hdr_step,
         ..Default::default()
     };
     let mut r = Renderer::new(project, s.footage.as_ref(), opts);
@@ -41,10 +43,11 @@ fn render_with(s: &Session, project: &Project, comp: ItemId, t: Tick, scale: f64
     r.comp_frame(comp, t)
 }
 
-/// The comp frame and each visible layer rendered alone (top layer first).
-fn isolate(s: &Session, cid: ItemId, t: Tick, scale: f64) -> Result<(Image, Vec<Isolated>)> {
+/// The comp frame and each visible layer rendered alone (top layer first). `skip_hdr_step`: as
+/// [`render_with`].
+fn isolate(s: &Session, cid: ItemId, t: Tick, scale: f64, skip_hdr_step: bool) -> Result<(Image, Vec<Isolated>)> {
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let full = render_with(s, &s.project, cid, t, scale);
+    let full = render_with(s, &s.project, cid, t, scale, skip_hdr_step);
     let any_solo = comp.layers.iter().any(|l| l.switches.solo && l.has_video());
     let ids: Vec<LayerId> = comp
         .layers
@@ -72,7 +75,7 @@ fn isolate(s: &Session, cid: ItemId, t: Tick, scale: f64) -> Result<(Image, Vec<
             }
         }
         let Some((name, blend, opacity)) = info else { continue };
-        let image = render_with(s, &p, cid, t, scale);
+        let image = render_with(s, &p, cid, t, scale, skip_hdr_step);
         out.push(Isolated { name, blend, opacity, image });
     }
     Ok((full, out))
@@ -111,7 +114,7 @@ fn alpha_bounds(img: &Image) -> Option<(u32, u32, u32, u32)> {
 pub fn layered_psd(s: &Session, cid: ItemId, t: Tick, scale: f64) -> Result<(Vec<u8>, usize, u32, u32)> {
     use effectcraft_psd::Rect;
     use effectcraft_psd::write::{WDoc, WLayer, write};
-    let (full, layers) = isolate(s, cid, t, scale)?;
+    let (full, layers) = isolate(s, cid, t, scale, false)?;
     let mut doc = WDoc::new(full.width, full.height);
     let n = layers.len();
     // File order is bottom first.
@@ -136,10 +139,6 @@ pub fn layered_psd(s: &Session, cid: ItemId, t: Tick, scale: f64) -> Result<(Vec
     Ok((write(&doc), n, full.width, full.height))
 }
 
-fn srgb_to_linear(c: f32) -> f32 {
-    if c <= 0.04045 { c / 12.92 } else { ((c + 0.055) / 1.055).powf(2.4) }
-}
-
 /// A unique EXR layer name (no dots: they separate the layer from the channel). Printable ASCII only:
 /// the `exr` crate panics on characters it cannot store in a channel name (#1702).
 fn exr_name(name: &str, used: &mut Vec<String>) -> String {
@@ -158,15 +157,20 @@ fn exr_name(name: &str, used: &mut Vec<String>) -> String {
 /// The multi-layer EXR bytes of a frame and the channel names.
 pub fn layered_exr(s: &Session, cid: ItemId, t: Tick, scale: f64) -> Result<(Vec<u8>, Vec<String>, u32, u32)> {
     use exr::prelude::*;
-    let (full, layers) = isolate(s, cid, t, scale)?;
+    // The composite and every layer without the HDR step, decoded with the output space's
+    // curve (linear light in the output space's primaries).
+    let (full, layers) = isolate(s, cid, t, scale, true)?;
+    let pipe = effectcraft_render::color::Pipe::of(&s.project.settings);
+    let dec = pipe.output_linear();
     let (w, h) = (full.width as usize, full.height as usize);
     let planes = |img: &effectcraft_raster::Image| -> [Vec<f32>; 4] {
         let mut out: [Vec<f32>; 4] = Default::default();
         for p in &img.data {
             let sp = straight(*p);
             let a = sp[3];
+            let lin = dec.apply([sp[0].max(0.0), sp[1].max(0.0), sp[2].max(0.0)]);
             for c in 0..3 {
-                out[c].push(srgb_to_linear(sp[c].max(0.0)) * a);
+                out[c].push(lin[c] * a);
             }
             out[3].push(a);
         }
@@ -189,12 +193,17 @@ pub fn layered_exr(s: &Session, cid: ItemId, t: Tick, scale: f64) -> Result<(Vec
     }
     let layer = Layer::new((w, h), LayerAttributes::default(), Encoding::SMALL_LOSSLESS, AnyChannels::sort(channels.into()));
     let mut buf = std::io::Cursor::new(Vec::new());
-    Image::from_layer(layer).write().to_buffered(&mut buf).map_err(|e| EngineError::Other(format!("EXR encoding failed: {e}")))?;
+    let mut image = Image::from_layer(layer);
+    // The primaries and white the values are in (the output space's), for Nuke, AE and Blender.
+    let [red, green, blue, white] = pipe.output_linear_space().exr_chromaticities().map(|[x, y]| Vec2(x, y));
+    image.attributes.chromaticities = Some(exr::meta::attribute::Chromaticities { red, green, blue, white });
+    image.write().to_buffered(&mut buf).map_err(|e| EngineError::Other(format!("EXR encoding failed: {e}")))?;
     Ok((buf.into_inner(), names, full.width, full.height))
 }
 
 fn frame_args(s: &Session, p: &Value, cmd: &str, ext: &str) -> Result<(String, ItemId, Tick, f64)> {
     let path = str_p(p, "path").ok_or_else(|| bad(cmd, format!("missing `path` (.{ext})")))?.to_string();
+    s.refuse_export(&path)?;
     let cid = comp_id(s, p)?;
     let t = f_p(p, "time").map(Tick::from_seconds_f64).unwrap_or(s.time());
     let scale = f_p(p, "scale").unwrap_or(1.0).clamp(0.01, 4.0);
@@ -204,7 +213,7 @@ fn frame_args(s: &Session, p: &Value, cmd: &str, ext: &str) -> Result<(String, I
 fn save_psd(s: &mut Session, p: &Value) -> Result<Value> {
     let (path, cid, t, scale) = frame_args(s, p, "comp.saveFrameAsPsd", "psd")?;
     let (bytes, n, w, h) = layered_psd(s, cid, t, scale)?;
-    s.services.write_file(&path, &bytes).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(&path, &bytes)?;
     s.toast(format!("Saved {n} layers to {path}"));
     Ok(json!({"path": path, "layers": n, "width": w, "height": h, "time": t.seconds()}))
 }
@@ -212,7 +221,7 @@ fn save_psd(s: &mut Session, p: &Value) -> Result<Value> {
 fn save_exr(s: &mut Session, p: &Value) -> Result<Value> {
     let (path, cid, t, scale) = frame_args(s, p, "comp.saveFrameAsExr", "exr")?;
     let (bytes, channels, w, h) = layered_exr(s, cid, t, scale)?;
-    s.services.write_file(&path, &bytes).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(&path, &bytes)?;
     s.toast(format!("Saved a multi-layer EXR to {path}"));
     Ok(json!({"path": path, "channels": channels, "width": w, "height": h, "time": t.seconds()}))
 }
diff --git a/crates/engine/src/commands/frontend.rs b/crates/engine/src/cmd/frontend.rs
similarity index 97%
rename from crates/engine/src/commands/frontend.rs
rename to crates/engine/src/cmd/frontend.rs
index 74468e081..765476a90 100644
--- a/crates/engine/src/commands/frontend.rs
+++ b/crates/engine/src/cmd/frontend.rs
@@ -36,7 +36,7 @@ pub fn specs() -> Vec<CommandSpec> {
         fe!("app.commandPalette", "Quick Apply...", ["Edit"], Some("Cmd+Shift+Space"), "{query?}", always),
         fe!("app.keyboardShortcuts", "Keyboard Shortcuts", ["Edit"], Some("Cmd+Alt+'"), "{}", always),
         fe!("app.templates", "Templates", [], None, "{kind: renderSettings|outputModule}", always),
-        fe!("app.find", "Find", ["File"], Some("Cmd+F"), "{query?}", always),
+        fe!("app.find", "Find", ["File"], Some("Cmd+F"), "{query?: string, status?: all|available|missing}", always),
         fe!("effects.copyPresetsFolderPath", "Copy Presets Folder Path", [], None, "{}", always),
         // Preview.
         fe!(
@@ -106,6 +106,7 @@ pub fn specs() -> Vec<CommandSpec> {
         fe!("layer.openLayer", "Open Layer", ["Layer"], None, "{layer?}", has_layers),
         fe!("effect.manage", "Manage Effects...", ["Effect"], None, "{}", always),
         fe!("anim.browsePresets", "Browse Presets...", ["Animation"], None, "{}", always),
+        fe!("timeline.revealMask", "Reveal Created Mask", [], None, "{comp, layer, mask, projectEpoch} — engine-supplied creation identity", has_comp),
         // Project panel: delete the selected items without the prompt that Delete shows when
         // compositions use them. The UI runs `project.delete` (agents can run it directly).
         fe!(
diff --git a/crates/engine/src/commands/help.rs b/crates/engine/src/cmd/help.rs
similarity index 93%
rename from crates/engine/src/commands/help.rs
rename to crates/engine/src/cmd/help.rs
index c6f315f30..996817ce3 100644
--- a/crates/engine/src/commands/help.rs
+++ b/crates/engine/src/cmd/help.rs
@@ -20,7 +20,8 @@ fn sibling(s: &mut Session, p: &Value) -> Result<Value> {
 fn docs(s: &mut Session, p: &Value) -> Result<Value> {
     let page = match str_p(p, "page").unwrap_or("help") {
         "scripting" => "docs/control-protocol.md",
-        "expressions" => "docs/expressions.md",
+        // The reader-facing expression reference is not written yet: the closest page is the parity notes.
+        "expressions" => "docs/scripting-parity.md",
         "effects" => "docs/effects.md",
         "agents" => "docs/agents.md",
         _ => "README.md",
diff --git a/crates/engine/src/commands/import_project.rs b/crates/engine/src/cmd/import_project.rs
similarity index 100%
rename from crates/engine/src/commands/import_project.rs
rename to crates/engine/src/cmd/import_project.rs
diff --git a/crates/engine/src/commands/key_labels.rs b/crates/engine/src/cmd/key_labels.rs
similarity index 100%
rename from crates/engine/src/commands/key_labels.rs
rename to crates/engine/src/cmd/key_labels.rs
diff --git a/crates/engine/src/commands/key_transform.rs b/crates/engine/src/cmd/key_transform.rs
similarity index 96%
rename from crates/engine/src/commands/key_transform.rs
rename to crates/engine/src/cmd/key_transform.rs
index b78439266..397db4de5 100644
--- a/crates/engine/src/commands/key_transform.rs
+++ b/crates/engine/src/cmd/key_transform.rs
@@ -72,6 +72,10 @@ fn transform(s: &mut Session, p: &Value) -> Result<Value> {
         let mut new_sel = vec![];
         for ((lid, uid), times) in groups {
             let Some(layer) = comp.layer_mut(lid) else { continue };
+            if layer.switches.locked {
+                new_sel.extend(times.into_iter().map(|time| KeyRef { layer: lid, prop: uid, time }));
+                continue;
+            }
             let (start, stretch) = (layer.start_time, layer.stretch);
             let to_comp = |lt: Tick| if (stretch - 100.0).abs() < 1e-9 { start + lt } else { start + Tick((lt.0 as f64 * stretch / 100.0) as i64) };
             let to_layer = |ct: Tick| {
@@ -122,6 +126,9 @@ fn spatial_tangents(s: &mut Session, p: &Value) -> Result<Value> {
     let brk = b_p(p, "break").unwrap_or(false);
     s.edit("Edit Spatial Tangents", merge_p(p), |proj, _| {
         let l = super::layer_mut(proj, cid, lid)?;
+        if l.switches.locked {
+            return Err(bad("keys.setSpatialTangents", "the layer is locked"));
+        }
         let pr = l.props.find_mut(uid).ok_or_else(|| bad("keys.setSpatialTangents", "no property"))?;
         if !pr.spatial {
             return Err(bad("keys.setSpatialTangents", "not a spatial property"));
diff --git a/crates/engine/src/commands/keys_more.rs b/crates/engine/src/cmd/keys_more.rs
similarity index 99%
rename from crates/engine/src/commands/keys_more.rs
rename to crates/engine/src/cmd/keys_more.rs
index c7785d08c..4edef885a 100644
--- a/crates/engine/src/commands/keys_more.rs
+++ b/crates/engine/src/cmd/keys_more.rs
@@ -37,6 +37,8 @@ pub(crate) fn label_keys(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad("keys.label", "select keyframes first"));
     }
     let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let keys = super::prop::editable_keys(comp, &keys);
     let n = s.edit("Keyframe Label", None, |proj, _| {
         let mut n = 0;
         for k in &keys {
diff --git a/crates/engine/src/cmd/layer.rs b/crates/engine/src/cmd/layer.rs
new file mode 100644
index 000000000..f48fa26f8
--- /dev/null
+++ b/crates/engine/src/cmd/layer.rs
@@ -0,0 +1,238 @@
+//! Layer menu.
+
+use effectcraft_color::{BlendMode, Label};
+use effectcraft_keyframe::{Justify, TextDoc, Value as KV};
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{
+    Comp, FootageKind, FrameBlend, GroupKind, ItemId, ItemKind, Layer, LayerId, LayerSource, MaskMode, MatteKind, Node, Project, PropGroup, Quality, Solid,
+    TrackMatte, limits,
+};
+use effectcraft_time::Tick;
+use serde_json::{Value, json};
+
+use super::{CommandSpec, b_p, bad, comp_id, f_p, has_comp, has_layers, layer_mut, layer_p, layers_p, merge_p, resolve_layer, str_p, unlocked};
+use crate::{EngineError, Result, Session, cmd};
+
+mod contents;
+mod create;
+mod parent;
+mod replace;
+mod select;
+mod switches;
+mod timing;
+mod transform;
+
+use contents::{add_mask, add_shape_item, mask_props, set_text};
+use create::{add_item, new_adjustment, new_null, new_shape, new_solid, new_text};
+pub(crate) use create::{color_p, index_p, insert_layer, insert_layer_at, place, position_p};
+pub(crate) use parent::parent_fixes;
+use parent::set_parent;
+use replace::{has_replace_source, replace_source};
+pub(crate) use select::select_only;
+use select::{select, select_next, select_prev, select_step};
+use switches::{blend, rename, set_comment, set_switch, track_matte};
+use timing::{arrange, move_frames, precompose, slip, timing, unprecompose};
+use transform::{has_layer_settings, layer_settings, transform_op};
+pub(crate) use transform::{offset_position, transform_default, update_position};
+
+/// `p` with `key` set.
+fn with(p: &Value, key: &str, v: Value) -> Value {
+    let mut p = if p.is_object() { p.clone() } else { json!({}) };
+    p[key] = v;
+    p
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            "layer.newText",
+            "Text",
+            ["Layer", "New"],
+            Some("Cmd+Alt+Shift+T"),
+            "{text?, name? (layer name; default the text, which the name then follows; a given name stays), position? [x,y], box? [x,y,w,h] (paragraph text, comp space), vertical?, edit? (start editing), font?, style?, size?, fill?, stroke?, applyFill?, applyStroke?, strokeWidth?, tracking?, leading?, baselineShift?, hScale?, vScale?, tsume?, fauxBold?, fauxItalic?, allCaps?, smallCaps?, baseline?, superscript?, subscript?, kerning?, ligatures?, justify?, indentLeft?, indentRight?, indentFirst?, spaceBefore?, spaceAfter?, direction?, composer?, hangingPunctuation?, strokeOverFill?, lineJoin?} (attributes as layer.setText)",
+            has_comp,
+            new_text
+        ),
+        cmd!("layer.newSolid", "Solid...", ["Layer", "New"], Some("Cmd+Y"), "{name?, color? #hex|[r,g,b], width?, height?, pixelAspect?}", has_comp, new_solid),
+        cmd!("layer.newNull", "Null Object", ["Layer", "New"], Some("Cmd+Alt+Shift+Y"), "{name?}", has_comp, new_null),
+        cmd!(
+            "layer.newShape",
+            "Shape Layer",
+            ["Layer", "New"],
+            None,
+            "{kind?: rect|rounded|ellipse|star|polygon|none, name?, size?, fill?, fillType?, fillBlend?, fillOpacity?, stroke?, strokeType?, strokeBlend?, strokeOpacity?, strokeWidth?, position?}",
+            has_comp,
+            new_shape
+        ),
+        cmd!("layer.newAdjustment", "Adjustment Layer", ["Layer", "New"], Some("Cmd+Alt+Y"), "{name?}", has_comp, new_adjustment),
+        cmd!(
+            "layer.settings",
+            "Layer Settings...",
+            ["Layer"],
+            Some("Cmd+Shift+Y"),
+            "{layer?, name? (an empty name makes a text layer's name follow its text again), color?, width?, height?, pixelAspect?, affectAll?: bool (default true; false gives this layer its own copy of a solid other layers use)} → {layer, solid?}",
+            has_layer_settings,
+            layer_settings
+        ),
+        cmd!(
+            "layer.addItem",
+            "Add Footage to Comp",
+            ["File"],
+            Some("Cmd+/"),
+            "{item: id|name, time? (s, where the layer starts), index? (1-based stack position; default above the selected layer), position? ([x, y] comp px; default the centre), duration? (s, for a still), in? (s, the In point in comp time; default the start), out? (s, the Out point; default the end of the footage or the comp; in must be before out), anchor? ([x, y] layer px; default the centre)}",
+            has_comp,
+            add_item
+        ),
+        cmd!(
+            "layer.replaceSource",
+            "Replace Layer Source",
+            [],
+            Some("Cmd+Alt+/"),
+            "{comp?, layers?, layer?, item?: id|name (default the Project panel selection), fixExpressions?: bool (accepted for After Effects compatibility)} → {layers, item}",
+            has_replace_source,
+            replace_source
+        ),
+        cmd!("layer.select", "Select Layers", [], None, "{layers: [id|name|#n], add?, toggle?}", has_comp, select),
+        cmd!("layer.selectNext", "Select Next Layer", [], Some("Cmd+ArrowDown"), "{add?}", has_comp, select_next),
+        cmd!("layer.selectPrevious", "Select Previous Layer", [], Some("Cmd+ArrowUp"), "{add?}", has_comp, select_prev),
+        cmd!("layer.extendSelectionNext", "Extend Selection to Next Layer", [], Some("Cmd+Shift+ArrowDown"), "{}", has_comp, |s, _| select_step(
+            s,
+            &json!({"add": true}),
+            1
+        )),
+        cmd!("layer.extendSelectionPrevious", "Extend Selection to Previous Layer", [], Some("Cmd+Shift+ArrowUp"), "{}", has_comp, |s, _| select_step(
+            s,
+            &json!({"add": true}),
+            -1
+        )),
+        cmd!(
+            "layer.setSwitch",
+            "Layer Switch",
+            [],
+            None,
+            "{layers?, switch: video|audio|solo|lock|shy|collapse|quality|fx|frameBlend|motionBlur|adjustment|threeD|guide|preserveTransparency, value?, merge?, others? (the named layers alone: the other layers get the opposite state, or come back)}",
+            has_layers,
+            set_switch
+        ),
+        cmd!(
+            "layer.rename",
+            "Rename",
+            [],
+            Some("Enter"),
+            "{layer?, name} — a text layer's name follows its text until renamed; an empty name follows it again",
+            has_layers,
+            rename
+        ),
+        cmd!("layer.setComment", "Layer Comment", [], None, "{layers?, comment}", has_layers, set_comment),
+        cmd!("layer.setBlendMode", "Blending Mode", [], None, "{layers?, mode?: Normal|Multiply|Screen|…, step?: ±1}", has_layers, blend),
+        cmd!(
+            "layer.setTrackMatte",
+            "Track Matte",
+            [],
+            None,
+            "{layers? | layer?, matte: layer|null, kind?: alpha|alphaInverted|luma|lumaInverted|preserve}",
+            has_layers,
+            track_matte
+        ),
+        cmd!("layer.setParent", "Parent", [], None, "{layers?, parent: layer|null, compensate?: bool}", has_layers, set_parent),
+        cmd!(
+            "layer.timing",
+            "Layer Timing",
+            [],
+            None,
+            "{layers?, op?: moveInToTime|moveOutToTime|moveInToStart|moveOutToEnd|trimInToTime|trimOutToTime, delta?, start?, in?, out?, inDelta?, outDelta? (seconds, per layer), merge?}",
+            has_layers,
+            timing
+        ),
+        cmd!("layer.moveInToStart", "Move Layer In Point to Beginning of Comp", [], Some("Alt+Home"), "{layers?}", has_layers, |s, p| timing(
+            s,
+            &with(p, "op", json!("moveInToStart"))
+        )),
+        cmd!("layer.moveOutToEnd", "Move Layer Out Point to End of Comp", [], Some("Alt+End"), "{layers?}", has_layers, |s, p| timing(
+            s,
+            &with(p, "op", json!("moveOutToEnd"))
+        )),
+        cmd!("layer.moveEarlier", "Move Layers 1 Frame Earlier", [], Some("Alt+PageUp"), "{layers?}", has_layers, |s, p| move_frames(s, p, -1)),
+        cmd!("layer.moveLater", "Move Layers 1 Frame Later", [], Some("Alt+PageDown"), "{layers?}", has_layers, |s, p| move_frames(s, p, 1)),
+        cmd!("layer.moveEarlier10", "Move Layers 10 Frames Earlier", [], Some("Alt+Shift+PageUp"), "{layers?}", has_layers, |s, p| move_frames(s, p, -10)),
+        cmd!("layer.moveLater10", "Move Layers 10 Frames Later", [], Some("Alt+Shift+PageDown"), "{layers?}", has_layers, |s, p| move_frames(s, p, 10)),
+        cmd!(
+            "layer.slip",
+            "Slip Edit",
+            [],
+            None,
+            "{layers?, delta? (seconds) | frames?, merge?} → {requested, slipped: [{layer, delta, clamped}]}",
+            has_layers,
+            slip
+        ),
+        cmd!("layer.slipBack", "Slip Edit 1 Frame Earlier", [], None, "{layers?}", has_layers, |s, p| {
+            let mut p = p.clone();
+            p["frames"] = json!(-1);
+            slip(s, &p)
+        }),
+        cmd!("layer.slipForward", "Slip Edit 1 Frame Later", [], None, "{layers?}", has_layers, |s, p| {
+            let mut p = p.clone();
+            p["frames"] = json!(1);
+            slip(s, &p)
+        }),
+        cmd!("layer.arrange", "Arrange", ["Layer", "Arrange"], None, "{layers?, to: front|forward|backward|back, index?, above?: layer}", has_layers, arrange),
+        cmd!(
+            "layer.precompose",
+            "Pre-compose...",
+            ["Layer"],
+            Some("Cmd+Shift+C"),
+            "{layers?, name?, mode?: move|leave, adjustDuration?, open?}",
+            has_layers,
+            precompose
+        ),
+        cmd!(
+            "layer.unprecompose",
+            "Un-precompose",
+            ["Layer"],
+            None,
+            "{layer?, force?, dryRun?} → {layers, warnings}: expands the selected pre-comp layer into its composition's layers (copies, in order, with timing and position carried over). A locked pre-comp layer is refused, changing nothing. What would change the picture (the pre-comp layer has a parent, matte, effects, masks, layer styles, a non-default Scale/Rotation/Opacity, an animated transform, time remap/stretch, a blending mode, Video/Audio off, Solo/Guide on, is 3D/collapsing/adjustment, is used by another layer or named in another layer's expression; or the nested comp has cameras, lights, adjustment, 3D, collapsing, soloed or blend-mode / Preserve Transparency layers, preserves another frame rate, has another motion-blur shutter, or has Position expressions the move can't reach) is an error listing the reasons, changing nothing, unless `force`: then it unpacks anyway in one undo step, drops what the pre-comp layer carried, removes other layers' parent/matte/property links to it and lists the reasons as `warnings`. `dryRun` returns {dryRun, warnings} and changes nothing",
+            has_layers,
+            unprecompose
+        ),
+        cmd!(
+            "layer.addMask",
+            "New Mask",
+            ["Layer", "Mask"],
+            Some("Cmd+Shift+N"),
+            "{layer?, shape?: rect|ellipse|rounded|polygon|star, rect? [x,y,w,h] (layer space; a polygon or star fits its width), roundness? (a rounded rectangle's corner radius in px; default 20), mode?}",
+            has_layers,
+            add_mask
+        ),
+        cmd!("layer.setMask", "Mask Mode", [], None, "{layer?, mask: index|uid|name, mode?, inverted?}", has_layers, mask_props),
+        cmd!(
+            "layer.addShapeItem",
+            "Add (Shape)",
+            [],
+            None,
+            "{layer?, kind: group|rect|ellipse|star|polygon|path|fill|stroke|gfill|gstroke|trim|repeater|round|offset|pucker|twist|zigzag|wiggle|wiggler|merge|frontColor|bevelColor|sideColor|backColor, group?: uid|path} → {uid, path} (frontColor…backColor: the group's Front / Bevel / Side / Back item, which colours that surface of every extruded paint in the group in Advanced 3D)",
+            has_layers,
+            add_shape_item
+        ),
+        cmd!(
+            "layer.setText",
+            "Edit Text",
+            [],
+            None,
+            "{layer?, range?: [start, end] (characters; default all), text? (also renames a text layer whose name still follows its text), font?, style?, size?, fill?, stroke?, applyFill?, applyStroke?, strokeWidth?, tracking?, leading?: px|\"auto\", baselineShift? px, hScale? %, vScale? %, tsume? %, fauxBold?, fauxItalic?, allCaps?, smallCaps?, baseline?: normal|superscript|subscript, superscript?, subscript?, kerning?: metrics|optical|number, ligatures?, discretionaryLigatures? (OpenType), contextualAlternates?, stylisticAlternates?, stylisticSets?: [1–20], ss01?, ss02?, ss03?, ss04?, ss05?, ss06?, ss07?, ss08?, ss09?, ss10?, ss11?, ss12?, ss13?, ss14?, ss15?, ss16?, ss17?, ss18?, ss19?, ss20?, swash?, titling?, ordinals?, fractions?, allSmallCaps?, figureStyle?: default|lining|oldStyle, figureWidth?: default|proportional|tabular, figures?, variations?: {tag: value} (variable font axes; null resets), justify?: left|center|right|justifyLeft|justifyCenter|justifyRight|justifyAll, indentLeft?, indentRight?, indentFirst?, spaceBefore?, spaceAfter?, direction?: ltr|rtl, composer?: everyLine|singleLine, hangingPunctuation?, strokeOverFill?, lineJoin?: miter|round|bevel, box?: [x,y,w,h]|null (layer space), vertical?}",
+            has_layers,
+            set_text
+        ),
+        cmd!(
+            "layer.transform",
+            "Transform",
+            ["Layer", "Transform"],
+            None,
+            "{layers?, op: reset|center|fit|fitWidth|fitHeight|flipH|flipV}",
+            has_layers,
+            transform_op
+        ),
+    ]
+}
+
+#[allow(dead_code)]
+fn unused(_: &Comp) {}
diff --git a/crates/engine/src/cmd/layer/contents.rs b/crates/engine/src/cmd/layer/contents.rs
new file mode 100644
index 000000000..3015f4ecf
--- /dev/null
+++ b/crates/engine/src/cmd/layer/contents.rs
@@ -0,0 +1,222 @@
+use super::create::{apply_text_params, text_range_p};
+use super::{
+    EngineError, GroupKind, Ids, ItemId, KV, LayerId, MaskMode, Node, Project, PropGroup, Result, Session, TextDoc, Value, b_p, bad, build, json, layer_mut,
+    layer_p, merge_p, str_p,
+};
+
+/// Add a tool-shaped mask in one document edit, then request its Timeline controls separately.
+pub(super) fn add_mask(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid) = layer_p(s, p, "layer.addMask")?;
+    let layer = s.project.comp(cid).and_then(|c| c.layer(lid)).ok_or(EngineError::NoComp)?.clone();
+    let (w, h) = effectcraft_render::source_size(&s.project, &layer);
+    let (w, h) = if w == 0 { (400.0, 300.0) } else { (w as f64, h as f64) };
+    let shape = str_p(p, "shape").unwrap_or("rect");
+    let r = p.get("rect").and_then(Value::as_array).map(|a| [0, 1, 2, 3].map(|i| a.get(i).and_then(Value::as_f64).unwrap_or(0.0)));
+    let (cx, cy, rw, rh) = match r {
+        Some([x, y, rw, rh]) => (x + rw / 2.0, y + rh / 2.0, rw, rh),
+        None => (if w > 0.0 { w / 2.0 } else { 0.0 }, h / 2.0, w * 0.6, h * 0.6),
+    };
+    // The shape tools' masks: rectangle, ellipse, rounded rectangle, polygon or star.
+    let radius = match p.get("roundness").filter(|v| !v.is_null()) {
+        None => None,
+        Some(v) => {
+            Some(v.as_f64().filter(|r| r.is_finite() && *r >= 0.0).ok_or_else(|| bad("layer.addMask", "`roundness` is a corner radius in pixels, 0 or more"))?)
+        }
+    };
+    let path = crate::cmd::shape_tool::mask_path_rounded(shape, [cx, cy], [rw, rh], radius)
+        .ok_or_else(|| bad("layer.addMask", format!("unknown shape `{shape}`; one of rect, ellipse, rounded, polygon, star")))?;
+    if radius.is_some() && !matches!(shape, "rounded" | "roundedRect") {
+        return Err(bad("layer.addMask", "`roundness` only applies to shapes `rounded` and `roundedRect`"));
+    }
+    let mode = str_p(p, "mode").and_then(MaskMode::from_name).unwrap_or(MaskMode::Add);
+    let cycle = s.prefs.appearance.cycle_mask_colors;
+    let uid = s.edit("New Mask", None, |proj, _| {
+        let mut next = proj.next_id;
+        let l = layer_mut(proj, cid, lid)?;
+        let masks = l.props.sub_mut("masks").ok_or_else(|| bad("layer.addMask", "this layer can't have masks"))?;
+        let n = masks.children.len();
+        let g = build::mask(&mut Ids(&mut next), &format!("Mask {}", n + 1), path, mode, crate::prefs::mask_color(cycle, n));
+        let uid = g.uid;
+        masks.children.push(g.into());
+        proj.next_id = next;
+        Ok(uid)
+    })?;
+    s.events.push(crate::Event::Frontend {
+        command: "timeline.revealMask".into(),
+        params: json!({"comp": cid.0, "layer": lid.0, "mask": uid, "projectEpoch": s.script_ui.project_epoch}),
+    });
+    Ok(json!({"mask": uid}))
+}
+
+pub(super) fn mask_props(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid) = layer_p(s, p, "layer.setMask")?;
+    let target = p.get("mask").cloned().unwrap_or(json!(1));
+    let mode = str_p(p, "mode").and_then(MaskMode::from_name);
+    let inverted = b_p(p, "inverted");
+    s.edit("Mask Settings", None, |proj, _| {
+        let l = layer_mut(proj, cid, lid)?;
+        let masks = l.props.sub_mut("masks").ok_or_else(|| bad("layer.setMask", "the layer has no masks (add one with layer.addMask)"))?;
+        let g = match &target {
+            Value::Number(n) => {
+                let n = n.as_u64().unwrap_or(1);
+                if let Some(i) = masks.children.iter().position(|c| c.uid() == n) {
+                    masks.children[i].as_group_mut()
+                } else {
+                    masks.children.get_mut(n.saturating_sub(1) as usize).and_then(|c| c.as_group_mut())
+                }
+            }
+            Value::String(name) => masks.children.iter_mut().find(|c| c.name() == name).and_then(|c| c.as_group_mut()),
+            _ => None,
+        }
+        .ok_or_else(|| bad("layer.setMask", "no such mask"))?;
+        if let GroupKind::Mask { mode: m, inverted: inv, .. } = &mut g.kind {
+            if let Some(mm) = mode {
+                *m = mm;
+            }
+            if let Some(i) = inverted {
+                *inv = i;
+            }
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+pub(super) fn add_shape_item(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid) = layer_p(s, p, "layer.addShapeItem")?;
+    let kind = str_p(p, "kind").ok_or_else(|| bad("layer.addShapeItem", "missing `kind`"))?.to_string();
+    // `group`: a uid or a property path (`contents/group`).
+    let group_uid = match p.get("group") {
+        Some(Value::String(path)) => Some(
+            s.project
+                .comp(cid)
+                .and_then(|c| c.layer(lid))
+                .and_then(|l| l.props.group(path))
+                .map(|g| g.uid)
+                .ok_or_else(|| bad("layer.addShapeItem", format!("no group `{path}`")))?,
+        ),
+        v => v.and_then(Value::as_u64),
+    };
+    let uid = s.edit("Add Shape Item", None, |proj, _| {
+        let mut next = proj.next_id;
+        let mut ids = Ids(&mut next);
+        // Front / Bevel / Side / Back ▸ property: into the group's surface item (one per group).
+        if let Some((surface, prop)) = build::shape_surface_kind(&kind) {
+            let target = shape_item_target(proj, cid, lid, group_uid)?;
+            let item = match target.children.iter().position(|c| matches!(c, Node::Group(g) if g.match_id == surface)) {
+                Some(i) => i,
+                None => {
+                    let g = build::shape_surface(&mut ids, surface).ok_or_else(|| bad("layer.addShapeItem", format!("unknown kind `{kind}`")))?;
+                    target.children.push(g.into());
+                    target.children.len() - 1
+                }
+            };
+            let Some(Node::Group(g)) = target.children.get_mut(item) else { return Err(bad("layer.addShapeItem", "no such group")) };
+            if g.get(prop).is_none() {
+                let p = build::shape_surface_prop(&mut ids, prop).ok_or_else(|| bad("layer.addShapeItem", format!("unknown kind `{kind}`")))?;
+                g.children.push(p.into());
+            }
+            let uid = g.uid;
+            proj.next_id = next;
+            return Ok(uid);
+        }
+        let g = match kind.as_str() {
+            "group" => build::shape_group(&mut ids, "Group 1", vec![]),
+            "rect" | "rectangle" => build::shape_rect(&mut ids, [200.0, 200.0], [0.0, 0.0], 0.0),
+            "ellipse" => build::shape_ellipse(&mut ids, [200.0, 200.0], [0.0, 0.0]),
+            "star" => build::shape_star(&mut ids, true, 5.0, [0.0, 0.0], 100.0, 50.0),
+            "polygon" => build::shape_star(&mut ids, false, 5.0, [0.0, 0.0], 100.0, 0.0),
+            "fill" => build::shape_fill(&mut ids, [1.0, 0.0, 0.0, 1.0]),
+            "stroke" => build::shape_stroke(&mut ids, [1.0, 1.0, 1.0, 1.0], 2.0),
+            "path" => build::shape_path(&mut ids, Default::default()),
+            "gfill" | "gradientFill" => build::shape_gradient_fill(&mut ids, false, [-100.0, 0.0], [100.0, 0.0], Default::default()),
+            "gstroke" | "gradientStroke" => build::shape_gradient_stroke(&mut ids, false, [-100.0, 0.0], [100.0, 0.0], Default::default(), 2.0),
+            "trim" | "trimPaths" => build::shape_trim(&mut ids, 0.0, 100.0, 0.0),
+            "repeater" => build::shape_repeater(&mut ids, 3.0, [100.0, 0.0]),
+            k => build::shape_simple_op(&mut ids, k).ok_or_else(|| bad("layer.addShapeItem", format!("unknown kind `{k}`")))?,
+        };
+        let uid = g.uid;
+        proj.next_id = next;
+        shape_item_target(proj, cid, lid, group_uid)?.children.push(g.into());
+        Ok(uid)
+    })?;
+    // The new item's property path, ready for prop.set / add_keyframe (`contents/trim#2/end`).
+    let path = s.project.comp(cid).and_then(|c| c.layer(lid)).and_then(|l| l.props.match_path_of(uid));
+    Ok(json!({"uid": uid, "path": path}))
+}
+
+/// The contents a new shape item goes into: the shape group `group_uid` (its Contents), else the
+/// layer's Contents.
+fn shape_item_target(proj: &mut Project, cid: ItemId, lid: LayerId, group_uid: Option<u64>) -> Result<&mut PropGroup> {
+    let l = layer_mut(proj, cid, lid)?;
+    let contents = l.props.sub_mut("contents").ok_or_else(|| bad("layer.addShapeItem", "not a shape layer"))?;
+    Ok(match group_uid {
+        Some(u) => contents
+            .find_group_mut(u)
+            .and_then(|g| if g.match_id == "contents" { Some(g) } else { g.sub_mut("contents") })
+            .ok_or_else(|| bad("layer.addShapeItem", "no such group"))?,
+        None => contents,
+    })
+}
+
+/// `layer.setText`: sets a text layer's Source Text and/or character attributes at the CTI.
+///
+/// A `font` name is also added to the recent fonts and the preferences saved. With an empty
+/// `range` and no `text`, while that layer is being edited and its document is non-empty,
+/// recognised character attributes are also staged in the pending insertion style without
+/// changing existing characters. Paragraph/document attributes still apply through the edit;
+/// the session is bumped whenever this branch runs. Document changes use [`Session::edit`],
+/// merged by `merge_p`. With `text` given, a layer whose name is empty or starts with `Text`
+/// takes the new first line (up to 40 characters) when that line is non-empty. Replies `null`.
+pub(super) fn set_text(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid) = layer_p(s, p, "layer.setText")?;
+    // The Character panel's recent fonts (Settings ▸ Type ▸ Number of Recent Fonts to Display).
+    if let Some(f) = str_p(p, "font") {
+        s.prefs.push_recent_font(f);
+        s.save_prefs();
+    }
+    let t = s.time();
+    let range = text_range_p(p);
+    // Character attributes with only a caret (no selected text) set the insertion style.
+    if let Some(r) = range.clone().filter(|r| r.is_empty() && str_p(p, "text").is_none())
+        && s.state.text_edit.as_ref().is_some_and(|e| e.layer == lid)
+        && let Some(doc) = crate::cmd::text_edit::layer_doc(s, lid)
+        && doc.char_len() > 0
+        && let Some(obj) = p.as_object()
+        && let Some(e) = s.state.text_edit.as_mut()
+    {
+        let mut st = e.pending.clone().unwrap_or_else(|| doc.insertion_style(r.start));
+        let mut any = false;
+        for (k, v) in obj {
+            any |= effectcraft_keyframe::text_doc::apply_char_attr(&mut st, k, v).map_err(|m| bad("layer.setText", m))?;
+        }
+        if any {
+            e.pending = Some(st);
+        }
+        s.bump();
+    }
+    // A changed Source Text is handled by `Session::edit`: its boundary clamps the selection and
+    // starts a new IME epoch only when the CTI document actually changed, so an identical text
+    // write stays a no-op and keeps the editor's owner.
+    s.edit("Edit Text", merge_p(p), |proj, _| {
+        let l = layer_mut(proj, cid, lid)?;
+        let lt = l.layer_time(t);
+        let pr = l.props.prop_mut("text/sourceText").ok_or_else(|| bad("layer.setText", "not a text layer"))?;
+        let mut doc = match pr.value_at(lt) {
+            KV::Text(d) => *d,
+            KV::Str(t) => TextDoc::plain(&t),
+            _ => TextDoc::default(),
+        };
+        let before = effectcraft_project::text_layer_name(&doc.text);
+        apply_text_params("layer.setText", p, &mut doc, range.clone())?;
+        pr.set_value_at(lt, KV::Text(Box::new(doc.clone())));
+        // Text layers are named after their text until renamed (#3233).
+        let after = effectcraft_project::text_layer_name(&doc.text);
+        if str_p(p, "text").is_some() && !after.is_empty() && l.name_follows_text(&before) {
+            l.name = after;
+            l.name_follows_text = Some(true);
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
diff --git a/crates/engine/src/cmd/layer/create.rs b/crates/engine/src/cmd/layer/create.rs
new file mode 100644
index 000000000..0196b5aee
--- /dev/null
+++ b/crates/engine/src/cmd/layer/create.rs
@@ -0,0 +1,379 @@
+use super::{
+    EngineError, Ids, ItemId, ItemKind, Justify, KV, Label, Layer, LayerId, LayerSource, Project, Result, Session, Solid, TextDoc, Tick, Value, b_p, bad,
+    build, comp_id, f_p, json, limits, str_p,
+};
+
+pub(crate) fn color_p(p: &Value, k: &str) -> Option<[f32; 3]> {
+    match p.get(k)? {
+        Value::String(s) => effectcraft_color::Rgba::from_hex(s).map(|c| [c.r, c.g, c.b]),
+        Value::Array(a) => {
+            let g = |i: usize| a.get(i).and_then(Value::as_f64).unwrap_or(0.0) as f32;
+            Some([g(0), g(1), g(2)])
+        }
+        _ => None,
+    }
+}
+
+/// Insert a new layer above the selection (or at the top) and select it.
+pub(crate) fn insert_layer(proj: &mut Project, st: &mut crate::EditorState, cid: ItemId, layer: Layer) -> Result<LayerId> {
+    insert_layer_at(proj, st, cid, layer, None)
+}
+
+/// `index`: an `index` parameter, the layer's 1-based place in the stack (1 = top; past the
+/// bottom = the bottom), as 0-based.
+pub(crate) fn index_p(p: &Value, cmd: &str) -> Result<Option<usize>> {
+    match p.get("index") {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => {
+            v.as_u64().filter(|i| *i >= 1).map(|i| Some(usize::try_from(i - 1).unwrap_or(usize::MAX))).ok_or_else(|| bad(cmd, "index: 1-based stack position"))
+        }
+    }
+}
+
+/// A `position` parameter: `[x, y]` in comp pixels (finite).
+pub(crate) fn position_p(p: &Value, cmd: &str) -> Result<Option<[f64; 2]>> {
+    match p.get("position") {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v
+            .as_array()
+            .and_then(|a| Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?]))
+            .filter(|c| c.iter().all(|x| x.is_finite()))
+            .map(Some)
+            .ok_or_else(|| bad(cmd, "position: [x, y] in comp pixels")),
+    }
+}
+
+/// Put a new layer's Position at `pos` (comp pixels).
+pub(crate) fn place(l: &mut Layer, pos: Option<[f64; 2]>) {
+    if let Some([x, y]) = pos
+        && let Some(pr) = l.props.prop_mut("transform/position")
+    {
+        let z = match pr.value {
+            KV::Vec3(v) => v[2],
+            _ => 0.0,
+        };
+        pr.value = KV::Vec3([x, y, z]);
+    }
+}
+
+/// [`insert_layer`] at stack position `at` (0 = top) instead of above the selected layer.
+pub(crate) fn insert_layer_at(proj: &mut Project, st: &mut crate::EditorState, cid: ItemId, mut layer: Layer, at: Option<usize>) -> Result<LayerId> {
+    // Text and shape layers in Advanced 3D comps get Geometry Options (extrusion, bevels).
+    if proj.comp(cid).is_some_and(|c| c.renderer == effectcraft_project::Renderer::Advanced3D) {
+        crate::cmd::model3d::add_geometry_options(&mut proj.next_id, &mut layer);
+    }
+    let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+    let at = match at {
+        Some(i) => i.min(comp.layers.len()),
+        None => st.selected_layers.first().and_then(|id| comp.layers.iter().position(|l| l.id == *id)).unwrap_or(0),
+    };
+    let id = layer.id;
+    comp.layers.insert(at, layer);
+    st.selected_layers = vec![id];
+    st.selected_props.clear();
+    st.selected_keys.clear();
+    Ok(id)
+}
+
+fn solids_folder(proj: &mut Project) -> ItemId {
+    proj.folder_named("Solids").unwrap_or_else(|| proj.add_item("Solids", Label::Yellow, None, ItemKind::Folder))
+}
+
+fn new_solid_like(s: &mut Session, p: &Value, adjustment: bool) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let color = color_p(p, "color").unwrap_or(if adjustment { [1.0, 1.0, 1.0] } else { [0.85, 0.2, 0.2] });
+    // 1 to 30,000 px a side (#788): the layer is sized from the same numbers as its solid.
+    let w = p.get("width").and_then(Value::as_u64).map(limits::size).unwrap_or(comp.width);
+    let h = p.get("height").and_then(Value::as_u64).map(limits::size).unwrap_or(comp.height);
+    let pixel_aspect = pixel_aspect_p(p)?.unwrap_or(comp.pixel_aspect);
+    let default_name = if adjustment { "Adjustment Layer 1".to_string() } else { "Solid 1".to_string() };
+    let name = str_p(p, "name").map(str::to_string).unwrap_or(default_name);
+    let id = s.edit(if adjustment { "New Adjustment Layer" } else { "New Solid" }, None, |proj, st| {
+        let folder = solids_folder(proj);
+        let sid = proj.add_item(&name, Label::Red, Some(folder), ItemKind::Solid(Solid { color, width: w, height: h, pixel_aspect }));
+        let mut l = build::layer(proj, &comp, &name, LayerSource::Solid { item: sid }, (w, h), None);
+        if adjustment {
+            l.switches.adjustment = true;
+            l.label = Label::Purple;
+        }
+        insert_layer(proj, st, cid, l)
+    })?;
+    Ok(json!({"layer": id.0}))
+}
+
+/// `pixelAspect` (a positive number), when given.
+pub(super) fn pixel_aspect_p(p: &Value) -> Result<Option<f64>> {
+    match p.get("pixelAspect").and_then(Value::as_f64) {
+        Some(v) if !(v.is_finite() && v > 0.0) => Err(bad("layer.settings", "`pixelAspect` must be a positive number")),
+        v => Ok(v.map(limits::pixel_aspect)),
+    }
+}
+
+pub(super) fn new_solid(s: &mut Session, p: &Value) -> Result<Value> {
+    new_solid_like(s, p, false)
+}
+
+pub(super) fn new_adjustment(s: &mut Session, p: &Value) -> Result<Value> {
+    new_solid_like(s, p, true)
+}
+
+/// Parameters of `layer.setText` / `layer.newText` that aren't text attributes.
+const NOT_ATTRS: &[&str] = &["layer", "layers", "comp", "merge", "text", "range", "position", "edit"];
+
+/// Apply `layer.setText` keys to `d`: `text` replaces characters `r` (or everything), then each
+/// character / paragraph / document attribute applies to `r` (or everything).
+pub(super) fn apply_text_params(cmd: &str, p: &Value, d: &mut TextDoc, r: Option<std::ops::Range<usize>>) -> Result<()> {
+    let mut r = r;
+    if let Some(t) = str_p(p, "text") {
+        match r.clone() {
+            Some(rr) => {
+                d.replace_range(rr.clone(), t, None);
+                r = Some(rr.start..rr.start + t.chars().count());
+            }
+            None => d.set_text(t),
+        }
+    }
+    let Some(obj) = p.as_object() else { return Ok(()) };
+    for (k, v) in obj {
+        if NOT_ATTRS.contains(&k.as_str()) {
+            continue;
+        }
+        if !d.set_attr(k, v, r.clone()).map_err(|e| bad(cmd, e))? {
+            return Err(bad(cmd, format!("unknown text attribute {k}")));
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn text_range_p(p: &Value) -> Option<std::ops::Range<usize>> {
+    let a = p.get("range")?.as_array()?;
+    let g = |i: usize| a.get(i).and_then(Value::as_u64).map(|x| x as usize);
+    let (x, y) = (g(0)?, g(1).or(g(0))?);
+    Some(x.min(y)..x.max(y))
+}
+
+/// `layer.newText`: adds a Text layer to the comp at the CTI and returns `{layer}`.
+///
+/// The document starts as centre-justified "Text", with the optional text parameters applied.
+/// With `box` `[x, y, w, h]`, `(x, y)` is the paragraph box's top-left in comp space. Its width
+/// and height are `w.abs().max(1.0)` and `h.abs().max(1.0)`; the layer position is the box centre.
+/// It is left justified unless `justify` is given. The layer is named by `name`, else the first 40
+/// characters of the first text line, else "Text". `edit: true` also opens a new editing
+/// session with anchor `0` and the caret after the text, selecting all initial text so the next
+/// insertion replaces it. The session has `created: true`; leaving it empty keeps the layer, as After Effects does.
+pub(super) fn new_text(s: &mut Session, p: &Value) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let mut doc = TextDoc { text: "Text".into(), justify: Justify::Center, ..Default::default() };
+    // A paragraph box given in comp space: the layer sits at its centre.
+    let bx = p.get("box").and_then(Value::as_array).map(|a| [0, 1, 2, 3].map(|i| a.get(i).and_then(Value::as_f64).unwrap_or(0.0)));
+    let mut q = p.clone();
+    if let Some(o) = q.as_object_mut() {
+        o.remove("box");
+        o.remove("name");
+    }
+    let layer_name = str_p(p, "name").map(str::to_string);
+    apply_text_params("layer.newText", &q, &mut doc, None)?;
+    let mut pos = position_p(p, "layer.newText")?;
+    if let Some([x, y, w, h]) = bx {
+        let (w, h) = (w.abs().max(1.0), h.abs().max(1.0));
+        doc.box_size = Some([w, h]);
+        doc.box_pos = [-w / 2.0, -h / 2.0];
+        pos = Some([x + w / 2.0, y + h / 2.0]);
+        if p.get("justify").is_none() {
+            doc.set_attr("justify", &json!("left"), None).map_err(|e| bad("layer.newText", e))?;
+        }
+    }
+    let edit = b_p(p, "edit").unwrap_or(false);
+    let id = s.edit("New Text Layer", None, |proj, st| {
+        let name: String = layer_name.clone().unwrap_or_else(|| effectcraft_project::text_layer_name(&doc.text));
+        let mut l = build::layer(proj, &comp, if name.is_empty() { "Text" } else { &name }, LayerSource::Text, (comp.width, comp.height), None);
+        // Named after its text, the name follows the text until renamed; a given name does not.
+        l.name_follows_text = Some(layer_name.as_deref().is_none_or(str::is_empty));
+        if let Some(pr) = l.props.prop_mut("text/sourceText") {
+            pr.value = KV::Text(Box::new(doc.clone()));
+        }
+        if let Some(pos) = pos
+            && let Some(pr) = l.props.prop_mut("transform/position")
+        {
+            pr.value = KV::Vec3([pos[0], pos[1], 0.0]);
+        }
+        let n = doc.char_len();
+        let id = insert_layer(proj, st, cid, l)?;
+        if edit {
+            st.text_edit = Some(crate::cmd::text_edit::TextEdit {
+                layer: id,
+                anchor: 0,
+                caret: n,
+                created: true,
+                session: crate::cmd::text_edit::next_edit_session(),
+                ..Default::default()
+            });
+        }
+        Ok(id)
+    })?;
+    Ok(json!({"layer": id.0}))
+}
+
+pub(super) fn new_shape(s: &mut Session, p: &Value) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let kind = str_p(p, "kind").unwrap_or("none").to_string();
+    let size = p
+        .get("size")
+        .and_then(Value::as_array)
+        .map(|a| [a.first().and_then(Value::as_f64).unwrap_or(200.0), a.get(1).and_then(Value::as_f64).unwrap_or(200.0)])
+        .unwrap_or([300.0, 300.0]);
+    // A fill, and a stroke only with a width (not the Tools bar's paint).
+    let paint = crate::cmd::shape_tool::paint_p(p, &Default::default(), "layer.newShape")?;
+    let pos = p
+        .get("position")
+        .and_then(|v| v.as_array())
+        .map(|a| [a.first().and_then(Value::as_f64).unwrap_or(0.0), a.get(1).and_then(Value::as_f64).unwrap_or(0.0)]);
+    let name = str_p(p, "name").unwrap_or("Shape Layer 1").to_string();
+    let id = s.edit("New Shape Layer", None, |proj, st| {
+        let lid = crate::cmd::shape_tool::new_shape_layer(proj, st, &comp, cid, Some(&name), pos)?;
+        let mut next = proj.next_id;
+        let g = crate::cmd::shape_tool::shape_group(&mut Ids(&mut next), &kind, size, &paint);
+        proj.next_id = next;
+        if let Some(g) = g {
+            crate::cmd::shape_tool::add_to_contents(proj, cid, lid, g, [0.0, 0.0], "layer.newShape")?;
+        }
+        Ok(lid)
+    })?;
+    Ok(json!({"layer": id.0}))
+}
+
+fn new_simple(s: &mut Session, p: &Value, src: LayerSource, name: &str, label: &str) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let name = str_p(p, "name").unwrap_or(name).to_string();
+    let id = s.edit(label, None, |proj, st| {
+        let l = build::layer(proj, &comp, &name, src, (comp.width, comp.height), None);
+        insert_layer(proj, st, cid, l)
+    })?;
+    Ok(json!({"layer": id.0}))
+}
+
+pub(super) fn new_null(s: &mut Session, p: &Value) -> Result<Value> {
+    new_simple(s, p, LayerSource::Null, "Null 1", "New Null Object")
+}
+
+/// Largest `in` / `out` (s) and `anchor` coordinate (px) a command accepts.
+const MAX_PLACEMENT: f64 = 1.0e6;
+
+/// An `in` / `out` parameter: comp time in seconds, finite and within `0..=MAX_PLACEMENT`.
+fn time_param(p: &Value, key: &str, cmd: &str) -> Result<Option<Tick>> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v
+            .as_f64()
+            .filter(|t| t.is_finite() && (0.0..=MAX_PLACEMENT).contains(t))
+            .map(|t| Some(Tick::from_seconds_f64(t)))
+            .ok_or_else(|| bad(cmd, format!("{key}: seconds in the composition, 0 to {MAX_PLACEMENT}"))),
+    }
+}
+
+/// An `anchor` parameter: `[x, y]` in layer pixels (finite, within `MAX_PLACEMENT`).
+fn anchor_param(p: &Value, cmd: &str) -> Result<Option<[f64; 2]>> {
+    match p.get("anchor") {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v
+            .as_array()
+            .filter(|a| a.len() == 2)
+            .and_then(|a| Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?]))
+            .filter(|c| c.iter().all(|x| x.is_finite() && x.abs() <= MAX_PLACEMENT))
+            .map(Some)
+            .ok_or_else(|| bad(cmd, "anchor: [x, y] in layer pixels")),
+    }
+}
+
+/// Put a new layer's Anchor Point at `pos` (layer pixels), keeping its z.
+fn set_anchor(l: &mut Layer, pos: Option<[f64; 2]>) {
+    if let Some([x, y]) = pos
+        && let Some(pr) = l.props.prop_mut("transform/anchor")
+    {
+        let z = match pr.value {
+            KV::Vec3(v) => v[2],
+            _ => 0.0,
+        };
+        pr.value = KV::Vec3([x, y, z]);
+    }
+}
+
+pub(super) fn add_item(s: &mut Session, p: &Value) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    let item = match p.get("item") {
+        Some(Value::Number(n)) => ItemId(n.as_u64().unwrap_or(0)),
+        Some(Value::String(name)) => s.project.find_by_name(name).map(|i| i.id).ok_or_else(|| bad("layer.addItem", format!("no item `{name}`")))?,
+        _ => *s.state.project_selection.first().ok_or_else(|| bad("layer.addItem", "missing `item`"))?,
+    };
+    if s.project.comp_contains(item, cid) {
+        return Err(bad("layer.addItem", "a composition can't contain itself"));
+    }
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let it = s.project.item(item).ok_or_else(|| bad("layer.addItem", "no such item"))?.clone();
+    let (in_p, out_p) = (time_param(p, "in", "layer.addItem")?, time_param(p, "out", "layer.addItem")?);
+    if let (Some(i), Some(o)) = (in_p, out_p)
+        && i >= o
+    {
+        return Err(bad("layer.addItem", "in must be before out"));
+    }
+    let anchor = anchor_param(p, "layer.addItem")?;
+    let (src, size, dur) = match &it.kind {
+        ItemKind::Comp(c) => (LayerSource::Comp { item }, (c.width, c.height), Some(c.duration)),
+        ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Still => {
+            // `duration`, else Settings ▸ Import ▸ Still Footage: length of the composition or a
+            // duration.
+            let d = f_p(p, "duration")
+                .filter(|d| d.is_finite() && *d > 0.0)
+                .or((s.prefs.import.still_footage == "seconds").then_some(s.prefs.import.still_seconds))
+                .map(Tick::from_seconds_f64);
+            (LayerSource::Footage { item }, (f.width, f.height), d)
+        }
+        ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Data => {
+            return Err(bad("layer.addItem", "data files can't be layers; read them in expressions with footage(\"name\").sourceData"));
+        }
+        ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Model => {
+            if in_p.is_some() || out_p.is_some() || anchor.is_some() {
+                return Err(bad("layer.addItem", "in, out and anchor aren't supported for 3D models"));
+            }
+            return crate::cmd::model3d::new_model(
+                s,
+                &serde_json::json!({"comp": cid.0, "item": item.0, "time": f_p(p, "time"), "index": p.get("index"), "position": p.get("position")}),
+            );
+        }
+        ItemKind::Footage(f) => (LayerSource::Footage { item }, (f.width, f.height), Some(f.looped_duration())),
+        ItemKind::Solid(so) => (LayerSource::Solid { item }, (so.width, so.height), None),
+        ItemKind::Folder => return Err(bad("layer.addItem", "folders can't be layers")),
+    };
+    let index = index_p(p, "layer.addItem")?;
+    let position = position_p(p, "layer.addItem")?;
+    let fr = comp.frame_rate;
+    // Settings ▸ General ▸ Create Layers at Composition Start Time (off: at the current time).
+    let default_start = if s.prefs.general.create_layers_at_comp_start || s.active_comp_id() != Some(cid) { Tick::ZERO } else { s.time() };
+    let start = fr.snap_nearest(f_p(p, "time").map(Tick::from_seconds_f64).unwrap_or(default_start));
+    let id = s.edit("Add Footage to Comp", None, |proj, st| {
+        let mut l = build::layer(proj, &comp, &it.name, src, size, dur);
+        l.start_time = start;
+        l.in_point = start;
+        // Footage and precomps keep their full length past the comp's end (After Effects); items
+        // without a duration (solids, comp-length stills) end with the comp.
+        let end = dur.map_or((start + comp.duration).min(comp.duration), |d| start + d);
+        l.out_point = fr.snap_nearest(end).max(start + fr.frame_duration());
+        // `in` / `out` are comp times like `layer.timing`'s; each keeps at least one frame.
+        let fd = fr.frame_duration();
+        // In first, as `layer.timing` does, so an `out` before the layer's start still lands.
+        if let Some(i) = in_p {
+            l.in_point = fr.snap_nearest(i).min(l.out_point - fd);
+        }
+        if let Some(o) = out_p {
+            l.out_point = fr.snap_nearest(o).max(l.in_point + fd);
+        }
+        place(&mut l, position);
+        set_anchor(&mut l, anchor);
+        insert_layer_at(proj, st, cid, l, index)
+    })?;
+    Ok(json!({"layer": id.0}))
+}
diff --git a/crates/engine/src/cmd/layer/parent.rs b/crates/engine/src/cmd/layer/parent.rs
new file mode 100644
index 000000000..cd923c950
--- /dev/null
+++ b/crates/engine/src/cmd/layer/parent.rs
@@ -0,0 +1,535 @@
+use super::{Comp, EngineError, ItemId, KV, Layer, LayerId, PropGroup, Result, Session, Tick, Value, b_p, bad, layers_p, resolve_layer, unlocked};
+
+/// Re-express a layer in its new parent space without moving its anchor.
+pub(crate) struct ParentFix {
+    pub layer: LayerId,
+    /// Maps Position from the old parent's space into the new one's.
+    m: effectcraft_geom::Mat3,
+    /// Added to Rotation.
+    rotation: f64,
+    /// Multiply Scale.
+    scale: [f64; 2],
+    /// 3D AV layers retain their world-space anchor, including Z. Cameras and lights also
+    /// re-express their Point of Interest.
+    position_3d: Option<effectcraft_geom::Mat4>,
+    /// A uniform relative parent transform re-expresses static Orientation and Scale.
+    pose_3d: Option<Pose3d>,
+}
+
+/// A uniform relative parent transform, as it applies to a 3D layer's Orientation and Scale.
+#[derive(Clone, Copy)]
+struct Pose3d {
+    /// Rotation that Orientation is re-expressed under: `Orientation' = correction * Orientation`.
+    correction: effectcraft_geom::Mat4,
+    /// Uniform scale factor, multiplied into Scale (negative for a mirrored parent).
+    factor: f64,
+}
+
+impl ParentFix {
+    /// Re-express the layer's Position, Rotation and Scale (every key) in the new parent's space.
+    pub fn apply(&self, l: &mut Layer) {
+        let Some(tr) = l.props.sub_mut("transform") else { return };
+        if let Some(m) = self.position_3d {
+            // Spatial Position speed measures distance along its path. Its parent-space
+            // unit changes even when the child's Orientation cannot be re-expressed.
+            let position_speed = uniform_rotation(m).map(|(_, factor)| factor.abs());
+            let map_position = |v: &KV| {
+                let q = m.apply(effectcraft_geom::Vec3::from(v.as_vec3()));
+                KV::Vec3([q.x, q.y, q.z])
+            };
+            // Read all separated axes before writing any of them.
+            let names = ["positionX", "positionY", "positionZ"];
+            if tr.get("positionX").is_some() {
+                let axes = names.map(|name| tr.get(name).cloned());
+                let current = axes.each_ref().map(|pr| pr.as_ref().map(|pr| pr.value.as_f64()).unwrap_or(0.0));
+                let q = m.apply(effectcraft_geom::Vec3::from(current));
+                for (i, name) in names.into_iter().enumerate() {
+                    if let Some(pr) = tr.get_mut(name) {
+                        pr.value = KV::Scalar([q.x, q.y, q.z].get(i).copied().unwrap_or(0.0));
+                        for key in &mut pr.keys {
+                            let p = axes.each_ref().map(|axis| axis.as_ref().map(|axis| axis.value_at(key.time).as_f64()).unwrap_or(0.0));
+                            let q = m.apply(effectcraft_geom::Vec3::from(p));
+                            key.value = KV::Scalar([q.x, q.y, q.z].get(i).copied().unwrap_or(0.0));
+                        }
+                    }
+                }
+            }
+            // Position and a camera's or light's Point of Interest are both points in the parent's space.
+            let map_point = |pr: &mut effectcraft_project::Property| {
+                pr.value = map_position(&pr.value);
+                for key in &mut pr.keys {
+                    key.value = map_position(&key.value);
+                    // Spatial tangents are vectors, so the parent's translation is excluded.
+                    for tangent in [&mut key.spatial_in, &mut key.spatial_out] {
+                        let v = m.apply_vec(effectcraft_geom::Vec3::from(*tangent));
+                        *tangent = [v.x, v.y, v.z];
+                    }
+                }
+                if let Some(factor) = position_speed
+                    .filter(|_| pr.spatial)
+                    .filter(|factor| pr.keys.iter().flat_map(|key| key.in_ease.iter().chain(&key.out_ease)).all(|ease| (ease.speed * *factor).is_finite()))
+                {
+                    for key in &mut pr.keys {
+                        for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
+                            ease.speed *= factor;
+                        }
+                    }
+                }
+            };
+            if let Some(pr) = tr.get_mut("position") {
+                map_point(pr);
+            }
+            if let Some(pr) = tr.get_mut("poi") {
+                map_point(pr);
+            }
+            if let Some(pose) = self.pose_3d {
+                if let Some(pr) = tr.get_mut("orientation") {
+                    reexpress_orientation(pose.correction, pr);
+                }
+                if let Some(pr) = tr.get_mut("scale") {
+                    let factor = pose.factor;
+                    let scaled = |value: &KV| KV::Vec3(value.as_vec3().map(|v| v * factor));
+                    pr.value = scaled(&pr.value);
+                    for key in &mut pr.keys {
+                        key.value = scaled(&key.value);
+                        // Scale's temporal speeds use the same units as its values.
+                        for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
+                            ease.speed *= factor;
+                        }
+                    }
+                }
+            }
+            return;
+        }
+        let map = |pr: &mut effectcraft_project::Property, f: &dyn Fn(&KV) -> KV| {
+            pr.value = f(&pr.value);
+            for key in &mut pr.keys {
+                key.value = f(&key.value);
+            }
+        };
+        let m = self.m;
+        if tr.get("positionX").is_some() {
+            // Separated dimensions: X and Y move together, key by key at the same times.
+            // Everything is read before anything is written.
+            let [x, y] = [tr.get("positionX"), tr.get("positionY")].map(|p| p.map(|p| p.value.as_f64()).unwrap_or(0.0));
+            let q = m.apply(effectcraft_geom::vec2(x, y));
+            let keys_x: Vec<(Tick, f64)> = tr.get("positionX").map(|p| p.keys.iter().map(|k| (k.time, k.value.as_f64())).collect()).unwrap_or_default();
+            let keys_y: Vec<(Tick, f64)> = tr.get("positionY").map(|p| p.keys.iter().map(|k| (k.time, k.value.as_f64())).collect()).unwrap_or_default();
+            let at = |keys: &[(Tick, f64)], name: &str, t: Tick, tr: &PropGroup| {
+                keys.iter().find(|k| k.0 == t).map(|k| k.1).unwrap_or_else(|| tr.get(name).map(|p| p.value_at(t).as_f64()).unwrap_or(0.0))
+            };
+            let (xs, ys): (Vec<f64>, Vec<f64>) = (
+                keys_x.iter().map(|&(t, x)| m.apply(effectcraft_geom::vec2(x, at(&keys_y, "positionY", t, tr))).x).collect(),
+                keys_y.iter().map(|&(t, y)| m.apply(effectcraft_geom::vec2(at(&keys_x, "positionX", t, tr), y)).y).collect(),
+            );
+            for (name, value, vals) in [("positionX", q.x, xs), ("positionY", q.y, ys)] {
+                if let Some(pr) = tr.get_mut(name) {
+                    pr.value = KV::Scalar(value);
+                    for (k, v) in pr.keys.iter_mut().zip(vals) {
+                        k.value = KV::Scalar(v);
+                    }
+                }
+            }
+        } else if let Some(pr) = tr.get_mut("position") {
+            map(pr, &|v| {
+                let c = v.as_vec3();
+                let q = m.apply(effectcraft_geom::vec2(c[0], c[1]));
+                KV::Vec3([q.x, q.y, c[2]])
+            });
+        }
+        let (dr, k) = (self.rotation, self.scale);
+        if let Some(pr) = tr.get_mut("rotation") {
+            map(pr, &|v| KV::Scalar(v.as_f64() + dr));
+        }
+        if let Some(pr) = tr.get_mut("scale") {
+            map(pr, &|v| {
+                let c = v.as_vec3();
+                KV::Vec3([c[0] * k[0], c[1] * k[1], c[2]])
+            });
+        }
+    }
+}
+
+/// The rotation and signed scale factor of a uniform parent transform's linear part (negative for a
+/// mirrored parent). `None` for a non-uniform or degenerate transform.
+fn uniform_rotation(m: effectcraft_geom::Mat4) -> Option<(effectcraft_geom::Mat4, f64)> {
+    use effectcraft_geom::{Mat4, vec3};
+    let a = m.0;
+    let columns = [vec3(a[0][0], a[1][0], a[2][0]), vec3(a[0][1], a[1][1], a[2][1]), vec3(a[0][2], a[1][2], a[2][2])];
+    let magnitude = columns[0].x.hypot(columns[0].y).hypot(columns[0].z);
+    if !magnitude.is_finite() || magnitude <= 0.0 {
+        return None;
+    }
+    let c = columns.map(|c| c / magnitude);
+    if c.iter().any(|c| (c.dot(*c) - 1.0).abs() > 1e-9) || c[0].dot(c[1]).abs() > 1e-9 || c[0].dot(c[2]).abs() > 1e-9 || c[1].dot(c[2]).abs() > 1e-9 {
+        return None;
+    }
+    let cross = vec3(c[1].y * c[2].z - c[1].z * c[2].y, c[1].z * c[2].x - c[1].x * c[2].z, c[1].x * c[2].y - c[1].y * c[2].x);
+    let factor = if c[0].dot(cross) < 0.0 { -magnitude } else { magnitude };
+    let mut rotation = Mat4::IDENTITY;
+    for row in 0..3 {
+        for col in 0..3 {
+            rotation.0[row][col] = a[row][col] / factor;
+        }
+    }
+    Some((rotation, factor))
+}
+
+/// The equivalent XYZ Euler triple nearest `reference`: each axis moved by whole turns, or the
+/// `(x + 180, 180 - y, z + 180)` form when that is nearer.
+fn nearest_euler(euler: [f64; 3], reference: [f64; 3]) -> [f64; 3] {
+    let near = |v: [f64; 3]| -> [f64; 3] { std::array::from_fn(|i| v[i] + ((reference[i] - v[i]) / 360.0).round() * 360.0) };
+    let natural = near(euler);
+    let flipped = near([euler[0] + 180.0, 180.0 - euler[1], euler[2] + 180.0]);
+    let distance = |v: [f64; 3]| v.iter().zip(reference.iter()).map(|(a, b)| (a - b).powi(2)).sum::<f64>();
+    if distance(flipped) < distance(natural) { flipped } else { natural }
+}
+
+/// The Euler Orientation of `correction * Orientation(o)`, in the form nearest `reference`.
+fn reexpress_euler(correction: effectcraft_geom::Mat4, o: [f64; 3], reference: [f64; 3]) -> [f64; 3] {
+    let world = correction * effectcraft_geom::Mat4::orientation(effectcraft_geom::Vec3::from(o));
+    let angles = world.orientation_angles();
+    nearest_euler([angles.x, angles.y, angles.z], reference)
+}
+
+/// Re-express Orientation as `correction * Orientation`, retaining authored keys and easing.
+/// Orientation interpolates along quaternion arcs: a constant left rotation preserves those arcs
+/// and their angular speeds, so converting the endpoints preserves the entire eased animation.
+fn reexpress_orientation(correction: effectcraft_geom::Mat4, pr: &mut effectcraft_project::Property) {
+    if (0..3).all(|row| (0..3).all(|col| (correction.0[row][col] - if row == col { 1.0 } else { 0.0 }).abs() < 1e-12)) {
+        return;
+    }
+    let value = pr.value.as_vec3();
+    pr.value = KV::Vec3(reexpress_euler(correction, value, value));
+    let mut prev: Option<([f64; 3], [f64; 3])> = None;
+    for key in &mut pr.keys {
+        let o = key.value.as_vec3();
+        let reference = match prev {
+            Some((before, after)) => [after[0] + o[0] - before[0], after[1] + o[1] - before[1], after[2] + o[2] - before[2]],
+            None => o,
+        };
+        let n = reexpress_euler(correction, o, reference);
+        key.value = KV::Vec3(n);
+        prev = Some((o, n));
+    }
+}
+
+/// Correction for a two-node rig's Orientation: after a uniform parent change its aim is
+/// `rotation * aim`, so the roll is re-expressed against that aim. `None` for a degenerate aim.
+fn aim_correction(rotation: effectcraft_geom::Mat4, aim: [f64; 3]) -> Option<effectcraft_geom::Mat4> {
+    use effectcraft_geom::vec3;
+    use effectcraft_render::three_d::camera::basis_rotation;
+    let [x, y, z] = aim;
+    let length = (x * x + y * y + z * z).sqrt();
+    if !length.is_finite() || length <= 1e-9 {
+        return None;
+    }
+    let dir = vec3(x / length, y / length, z / length);
+    let turned = rotation.apply_vec(dir);
+    // A view along the up axis has no roll to keep, and its basis is undefined.
+    if 1.0 - dir.y * dir.y < 1e-12 || 1.0 - turned.y * turned.y < 1e-12 {
+        return None;
+    }
+    let up = vec3(0.0, 1.0, 0.0);
+    Some(basis_rotation(turned, up).transpose() * rotation * basis_rotation(dir, up))
+}
+
+/// A parent change retains 2D transforms and the world-space anchor of 3D layers (Position,
+/// and Point of Interest for two-node cameras and lights). Position is
+/// re-expressed in the new parent's space (`None`: the composition), evaluated at the current
+/// time.
+pub(crate) fn parent_fixes(s: &Session, cid: ItemId, ids: &[LayerId], parent: Option<LayerId>) -> Vec<ParentFix> {
+    let Some(comp) = s.project.comp(cid) else { return vec![] };
+    let ectx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: s.time(),
+        expr: s.expr.as_deref(),
+        footage: Some(s.footage.as_ref()),
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let space = |id: Option<LayerId>| -> effectcraft_geom::Mat3 {
+        id.and_then(|i| comp.layer(i)).filter(|l| !l.is_3d()).map(|l| ectx.layer_to_comp(l).0).unwrap_or(effectcraft_geom::Mat3::IDENTITY)
+    };
+    let decompose = |m: &effectcraft_geom::Mat3| {
+        let a = m.0;
+        let sx = (a[0][0] * a[0][0] + a[1][0] * a[1][0]).sqrt();
+        let det = a[0][0] * a[1][1] - a[0][1] * a[1][0];
+        (a[1][0].atan2(a[0][0]).to_degrees(), sx, if sx > 1e-12 { det / sx } else { 0.0 })
+    };
+    let new_m = space(parent);
+    let Some(inv) = new_m.inverse() else { return vec![] };
+    let (rn, sxn, syn) = decompose(&new_m);
+    let mut fixes: Vec<_> = comp
+        .layers
+        .iter()
+        .filter(|l| ids.contains(&l.id) && !l.is_3d() && l.parent != parent)
+        .map(|l| {
+            let old_m = space(l.parent);
+            let (ro, sxo, syo) = decompose(&old_m);
+            let scale = [if sxn.abs() > 1e-12 { sxo / sxn } else { 1.0 }, if syn.abs() > 1e-12 { syo / syn } else { 1.0 }];
+            ParentFix { layer: l.id, m: inv * old_m, rotation: ro - rn, scale, position_3d: None, pose_3d: None }
+        })
+        .collect();
+    let space_3d = |id: Option<LayerId>| {
+        id.and_then(|id| comp.layer(id)).map_or(effectcraft_geom::Mat4::IDENTITY, |layer| {
+            // Parent transforms do not inherit the parent's source pixel-aspect stretch.
+            let world = ectx.world_matrix(layer);
+            let par = ectx.par_ratio(layer);
+            let a = layer.transform().map(|tr| ectx.v3(layer, tr, "anchor", [0.0; 3])).unwrap_or([0.0; 3]);
+            let anchor = effectcraft_geom::vec3(a[0], a[1], if layer.is_3d() { a[2] } else { 0.0 });
+            world
+                * effectcraft_geom::Mat4::translate(anchor)
+                * effectcraft_geom::Mat4::scale(effectcraft_geom::vec3(1.0 / par, 1.0, 1.0))
+                * effectcraft_geom::Mat4::translate(-anchor)
+        })
+    };
+    if let Some(inv) = space_3d(parent).inverse().filter(|m| m.0.iter().flatten().all(|v| v.is_finite())) {
+        for layer in comp.layers.iter().filter(|l| ids.contains(&l.id) && l.is_3d() && l.parent != parent) {
+            let m = inv * space_3d(layer.parent);
+            // A one-node camera or light has no Scale to carry a mirror, and its frame (forward and
+            // down) would come out reversed: compensate none of it, so Position and Orientation stay
+            // as authored instead of half-following the parent.
+            let rig = layer.is_camera() || layer.is_light();
+            if rig && !effectcraft_render::three_d::camera::is_two_node(layer) && uniform_rotation(m).is_some_and(|(_, factor)| factor <= 0.0) {
+                continue;
+            }
+            if m.0.iter().flatten().all(|v| v.is_finite()) {
+                let pose_3d = layer.transform().and_then(|tr| {
+                    let orientation = tr.get("orientation")?;
+                    // Cameras and lights have no Scale; their Orientation is re-expressed alone.
+                    let scale = tr.get("scale");
+                    // Expression-driven values stay authored. Auto-orient replaces Orientation, except
+                    // a two-node rig, whose roll is re-expressed against its new aim.
+                    let two_node = (layer.is_camera() || layer.is_light()) && effectcraft_render::three_d::camera::is_two_node(layer);
+                    if orientation.expr.is_some()
+                        || scale.is_some_and(|scale| scale.expr.is_some())
+                        || (layer.auto_orient != effectcraft_project::AutoOrient::Off && !two_node)
+                    {
+                        return None;
+                    }
+                    let (rotation, factor) = uniform_rotation(m)?;
+                    let correction = if two_node {
+                        // A mirrored parent flips the aim, which this correction does not model.
+                        if factor <= 0.0 {
+                            return None;
+                        }
+                        let (w, h) = (comp.width as f64, comp.height as f64);
+                        let pos = ectx.v3(layer, tr, "position", [w / 2.0, h / 2.0, -1000.0]);
+                        let poi = ectx.v3(layer, tr, "poi", [w / 2.0, h / 2.0, 0.0]);
+                        aim_correction(rotation, [poi[0] - pos[0], poi[1] - pos[1], poi[2] - pos[2]])?
+                    } else {
+                        rotation
+                    };
+                    let orientation_finite = std::iter::once(&orientation.value)
+                        .chain(orientation.keys.iter().map(|key| &key.value))
+                        .all(|value| value.as_vec3().iter().all(|v| v.is_finite()));
+                    if !correction.0.iter().flatten().all(|v| v.is_finite()) || !orientation_finite {
+                        return None;
+                    }
+                    if let Some(scale) = scale {
+                        let values_finite = std::iter::once(&scale.value)
+                            .chain(scale.keys.iter().map(|key| &key.value))
+                            .all(|value| value.as_vec3().iter().all(|v| (v * factor).is_finite()));
+                        let speeds_finite = scale.keys.iter().all(|key| key.in_ease.iter().chain(&key.out_ease).all(|ease| (ease.speed * factor).is_finite()));
+                        if !values_finite || !speeds_finite {
+                            return None;
+                        }
+                    }
+                    Some(Pose3d { correction, factor })
+                });
+                fixes.push(ParentFix { layer: layer.id, m: effectcraft_geom::Mat3::IDENTITY, rotation: 0.0, scale: [1.0; 2], position_3d: Some(m), pose_3d });
+            }
+        }
+    }
+    fixes
+}
+
+/// Validate the proposed ancestor chain before any authored edit, including when compensation
+/// is disabled. Bound both unique ancestors and linear lookup/selection work on loaded graphs.
+fn check_parent_chain(comp: &Comp, ids: &[LayerId], parent: Option<LayerId>, max_visits: usize, max_work: usize) -> Result<()> {
+    let mut seen = std::collections::HashSet::new();
+    let mut work = 0usize;
+    let mut cur = parent;
+    while let Some(id) = cur {
+        if seen.len() >= max_visits {
+            return Err(bad("layer.setParent", "parent chain exceeds the safety visit limit"));
+        }
+        if !seen.insert(id) {
+            return Err(bad("layer.setParent", "parent chain contains an existing cycle"));
+        }
+        for selected in ids {
+            if work >= max_work {
+                return Err(bad("layer.setParent", "parent chain exceeds the safety work limit"));
+            }
+            work += 1;
+            if *selected == id {
+                return Err(bad("layer.setParent", "parenting would create a cycle"));
+            }
+        }
+        let mut ancestor = None;
+        for layer in &comp.layers {
+            if work >= max_work {
+                return Err(bad("layer.setParent", "parent chain exceeds the safety work limit"));
+            }
+            work += 1;
+            if layer.id == id {
+                ancestor = Some(layer);
+                break;
+            }
+        }
+        let layer = ancestor.ok_or_else(|| bad("layer.setParent", "parent chain refers to a missing layer"))?;
+        cur = layer.parent;
+    }
+    Ok(())
+}
+
+pub(super) fn set_parent(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    // Locked layers keep their parent (several at once: the others are parented).
+    let ids = unlocked(s, cid, ids, "layer.setParent")?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let parent = match p.get("parent") {
+        None | Some(Value::Null) => None,
+        Some(v) => Some(resolve_layer(comp, v).ok_or_else(|| bad("layer.setParent", "no such parent layer"))?),
+    };
+    // A loaded cycle need not include a selected child. Validate before compensation or edit;
+    // do not impose the renderer's 64-ancestor truncation as a new ordinary hierarchy limit.
+    check_parent_chain(comp, &ids, parent, 4096, 1_048_576)?;
+    // Like AE's pick-whip, parenting keeps the layer where it is: its transform is re-expressed
+    // in the new parent's space (Position, Rotation, Scale), unless `compensate: false`.
+    let compensate = b_p(p, "compensate").unwrap_or(true);
+    let fixes = if compensate { parent_fixes(s, cid, &ids, parent) } else { vec![] };
+    s.edit("Parent", None, |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
+            l.parent = parent;
+            if let Some(f) = fixes.iter().find(|f| f.layer == l.id) {
+                f.apply(l);
+            }
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+#[cfg(test)]
+mod parent_chain_tests {
+    use super::super::json;
+    use super::*;
+    use std::sync::Arc;
+
+    fn fixture() -> (Session, u64, u64, u64) {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name":"Parent safety","width":16,"height":16,"duration":1})).unwrap();
+        let a = s.execute("layer.newSolid", json!({"name":"A"})).unwrap()["layer"].as_u64().unwrap();
+        let b = s.execute("layer.newSolid", json!({"name":"B"})).unwrap()["layer"].as_u64().unwrap();
+        let c = s.execute("layer.newSolid", json!({"name":"C"})).unwrap()["layer"].as_u64().unwrap();
+        for id in [a, b, c] {
+            s.execute("prop.set", json!({"layer":id,"path":"transform/anchor","value":[0,0,0]})).unwrap();
+        }
+        s.execute("prop.set", json!({"layer":a,"path":"transform/position","value":[100,200,0]})).unwrap();
+        s.execute("prop.set", json!({"layer":c,"path":"transform/position","value":[10,20,0]})).unwrap();
+        s.history.undo.clear();
+        (s, a, b, c)
+    }
+    fn malformed_parent(s: &mut Session, child: u64, parent: u64) {
+        let cid = s.active_comp_id().unwrap();
+        Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(LayerId(child)).unwrap().parent = Some(LayerId(parent));
+    }
+    fn assert_atomic_error(s: &mut Session, child: u64, parent: u64, compensate: bool, message: &str) {
+        let before = s.project.clone();
+        let revision = s.revision;
+        let undo = s.history.undo.len();
+        let err = s.execute("layer.setParent", json!({"layers":[child],"parent":parent,"compensate":compensate})).unwrap_err();
+        assert!(err.to_string().contains(message), "{err}");
+        assert!(Arc::ptr_eq(&before, &s.project));
+        assert_eq!(s.revision, revision);
+        assert_eq!(s.history.undo.len(), undo);
+    }
+    #[test]
+    fn loaded_cycle_excluding_selected_child_is_rejected_atomically() {
+        for compensate in [true, false] {
+            let (mut s, a, b, c) = fixture();
+            // Simulate a malformed loaded project. Never execute this on the unguarded baseline.
+            malformed_parent(&mut s, a, b);
+            malformed_parent(&mut s, b, a);
+            assert_atomic_error(&mut s, c, a, compensate, "existing cycle");
+        }
+    }
+    #[test]
+    fn dangling_loaded_parent_is_rejected_atomically() {
+        for compensate in [true, false] {
+            let (mut s, a, _, c) = fixture();
+            malformed_parent(&mut s, a, u64::MAX);
+            assert_atomic_error(&mut s, c, a, compensate, "missing layer");
+        }
+    }
+    #[test]
+    fn selected_descendant_and_direct_self_are_rejected() {
+        let (mut s, a, _, c) = fixture();
+        assert_atomic_error(&mut s, c, c, false, "create a cycle");
+        s.execute("layer.setParent", json!({"layers":[a],"parent":c,"compensate":false})).unwrap();
+        assert_atomic_error(&mut s, c, a, true, "create a cycle");
+    }
+    #[test]
+    fn ordinary_parent_and_unparent_keep_explicit_false_and_undo_semantics() {
+        for compensate in [true, false] {
+            let (mut s, a, _, c) = fixture();
+            let old = s.project.clone();
+            let world = |s: &Session| {
+                let cid = s.active_comp_id().unwrap();
+                let comp = s.active_comp().unwrap();
+                let ctx = effectcraft_render::EvalCtx::new(&s.project, cid, comp, s.time());
+                ctx.world_matrix(comp.layer(LayerId(c)).unwrap()).apply(effectcraft_geom::Vec3::ZERO)
+            };
+            let before = world(&s);
+            s.execute("layer.setParent", json!({"layers":[c],"parent":a,"compensate":compensate})).unwrap();
+            let expected = if compensate { before } else { before + effectcraft_geom::vec3(100.0, 200.0, 0.0) };
+            assert!((world(&s) - expected).length() < 1e-9);
+            assert_eq!(s.active_comp().unwrap().layer(LayerId(c)).unwrap().parent, Some(LayerId(a)));
+            assert_eq!(s.history.undo.len(), 1);
+            let parented = s.project.clone();
+            assert!(s.undo());
+            assert!(Arc::ptr_eq(&s.project, &old));
+            assert!(s.redo());
+            assert!(Arc::ptr_eq(&s.project, &parented));
+            s.execute("layer.setParent", json!({"layers":[c],"parent":null,"compensate":compensate})).unwrap();
+            assert_eq!(s.active_comp().unwrap().layer(LayerId(c)).unwrap().parent, None);
+            assert!(s.undo());
+            assert!(Arc::ptr_eq(&s.project, &parented));
+        }
+    }
+    #[test]
+    fn ancestor_and_lookup_work_budgets_fail_closed() {
+        let (mut s, a, b, c) = fixture();
+        malformed_parent(&mut s, a, b);
+        let comp = s.active_comp().unwrap();
+        // New solids are inserted above the selection: C,B,A. Walking A->B scans
+        // three then two layers, and compares the one selected child twice: seven work units.
+        assert_eq!(comp.layers.iter().map(|l| l.id).collect::<Vec<_>>(), vec![LayerId(c), LayerId(b), LayerId(a)]);
+        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 7).is_ok());
+        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 6).unwrap_err().to_string().contains("work limit"));
+        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 256).is_ok());
+        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 1, 256).unwrap_err().to_string().contains("visit limit"));
+        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 1).unwrap_err().to_string().contains("work limit"));
+        assert!(check_parent_chain(comp, &[LayerId(c)], None, 0, 0).is_ok(), "unparenting does not traverse ancestors");
+    }
+
+    #[test]
+    fn well_formed_chain_beyond_renderer_depth_is_not_unnecessarily_rejected() {
+        let (s, _, _, c) = fixture();
+        let mut comp = s.active_comp().unwrap().clone();
+        let template = comp.layers.first().unwrap().clone();
+        for n in 0..80 {
+            let mut layer = template.clone();
+            layer.id = LayerId(10_000 + n);
+            layer.parent = (n < 79).then_some(LayerId(10_001 + n));
+            comp.layers.push(layer);
+        }
+        assert!(check_parent_chain(&comp, &[LayerId(c)], Some(LayerId(10_000)), 4096, 1_048_576).is_ok());
+    }
+}
diff --git a/crates/engine/src/cmd/layer/replace.rs b/crates/engine/src/cmd/layer/replace.rs
new file mode 100644
index 000000000..80e5be807
--- /dev/null
+++ b/crates/engine/src/cmd/layer/replace.rs
@@ -0,0 +1,101 @@
+use super::{
+    EngineError, FootageKind, Ids, ItemId, ItemKind, Layer, LayerSource, Project, Result, Session, Value, bad, build, has_comp, json, layer_mut, layers_p,
+    unlocked,
+};
+
+/// A layer whose source is an item (footage, precomposition or solid), as in After Effects'
+/// Replace Source. Text, shape, null, camera, light and 3D model layers have no AVItem source to
+/// replace.
+fn replaceable_layer(l: &Layer) -> bool {
+    matches!(l.source, LayerSource::Footage { .. } | LayerSource::Comp { .. } | LayerSource::Solid { .. })
+}
+
+/// The source a Project item gives a layer, or why it can't replace one.
+fn replacement_source(item: ItemId, it: &effectcraft_project::Item) -> Result<LayerSource> {
+    const CMD: &str = "layer.replaceSource";
+    match &it.kind {
+        ItemKind::Comp(_) => Ok(LayerSource::Comp { item }),
+        ItemKind::Footage(f) if f.kind == FootageKind::Data => {
+            Err(bad(CMD, "data files can't be layer sources; read them in expressions with footage(\"name\").sourceData"))
+        }
+        ItemKind::Footage(f) if f.kind == FootageKind::Model => Err(bad(CMD, "3D model items can't replace a 2D layer source; add them as 3D layers")),
+        ItemKind::Footage(_) => Ok(LayerSource::Footage { item }),
+        ItemKind::Solid(_) => Ok(LayerSource::Solid { item }),
+        ItemKind::Folder => Err(bad(CMD, "folders can't be layer sources")),
+    }
+}
+
+/// Whether a source brings audio properties (precompositions always can; footage when it has an
+/// audio stream).
+fn source_has_audio(project: &Project, source: &LayerSource) -> bool {
+    match source {
+        LayerSource::Comp { .. } => true,
+        LayerSource::Footage { item } => project.item(*item).is_some_and(|i| matches!(&i.kind, ItemKind::Footage(f) if f.has_audio)),
+        _ => false,
+    }
+}
+
+pub(super) fn has_replace_source(s: &Session) -> std::result::Result<(), String> {
+    has_comp(s)?;
+    let c = s.active_comp().ok_or("no composition")?;
+    if !s.state.selected_layers.iter().filter_map(|l| c.layer(*l)).any(replaceable_layer) {
+        return Err("select a footage, composition or solid layer".into());
+    }
+    if s.state.project_selection.is_empty() {
+        return Err("select a footage item, a composition or a solid in the Project panel".into());
+    }
+    Ok(())
+}
+
+/// Replace the source of the selected (or `layers`) AV layers with a Project item, as After
+/// Effects' Alt-drag and Ctrl+Alt+/ do. The layer keeps every property: name, timing, transforms,
+/// keyframes, expressions, effects, masks, switches, parenting and track matte. Only its source
+/// changes; precompositions bring their Essential Properties group through `sync_project`, and a
+/// source with audio adds an Audio group when the layer has none.
+pub(super) fn replace_source(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "layer.replaceSource";
+    let (cid, ids) = layers_p(s, p)?;
+    let ids = unlocked(s, cid, ids, CMD)?;
+    if ids.is_empty() {
+        return Err(bad(CMD, "select a layer first"));
+    }
+    let item = match p.get("item") {
+        Some(Value::Number(n)) => ItemId(n.as_u64().ok_or_else(|| bad(CMD, "item: a project item id"))?),
+        Some(Value::String(name)) => s.project.find_by_name(name).map(|i| i.id).ok_or_else(|| bad(CMD, format!("no item `{name}`")))?,
+        _ => *s.state.project_selection.first().ok_or_else(|| bad(CMD, "select a footage item, a composition or a solid in the Project panel"))?,
+    };
+    let it = s.project.item(item).ok_or_else(|| bad(CMD, format!("no item {}", item.0)))?;
+    let source = replacement_source(item, it)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    for lid in &ids {
+        let l = comp.layer(*lid).ok_or_else(|| bad(CMD, "no such layer"))?;
+        if !replaceable_layer(l) {
+            return Err(bad(CMD, format!("“{}” has no source item to replace", l.name)));
+        }
+    }
+    if let LayerSource::Comp { item: new } = &source
+        && s.project.comp_contains(*new, cid)
+    {
+        return Err(bad(CMD, "a composition can't contain itself"));
+    }
+    let has_audio = source_has_audio(&s.project, &source);
+    let source_for_edit = source.clone();
+    s.edit("Replace Layer Source", None, |proj, _| {
+        for lid in &ids {
+            let needs_audio = has_audio && proj.comp(cid).and_then(|c| c.layer(*lid)).is_some_and(|l| l.props.sub("audio").is_none());
+            let audio = if needs_audio {
+                let mut next = Ids(&mut proj.next_id);
+                Some(build::audio(&mut next))
+            } else {
+                None
+            };
+            let l = layer_mut(proj, cid, *lid)?;
+            l.source = source_for_edit.clone();
+            if let Some(audio) = audio {
+                l.props.children.push(audio.into());
+            }
+        }
+        Ok(())
+    })?;
+    Ok(json!({"layers": ids.iter().map(|l| l.0).collect::<Vec<_>>(), "item": item.0}))
+}
diff --git a/crates/engine/src/cmd/layer/select.rs b/crates/engine/src/cmd/layer/select.rs
new file mode 100644
index 000000000..efe038a0a
--- /dev/null
+++ b/crates/engine/src/cmd/layer/select.rs
@@ -0,0 +1,79 @@
+use super::{EngineError, LayerId, Result, Session, Value, b_p, comp_id, json, resolve_layer};
+
+pub(super) fn select(s: &mut Session, p: &Value) -> Result<Value> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let ids: Vec<LayerId> = match p.get("layers").or(p.get("layer")) {
+        Some(Value::Array(a)) => a.iter().filter_map(|v| resolve_layer(comp, v)).collect(),
+        Some(v) => resolve_layer(comp, v).into_iter().collect(),
+        None => vec![],
+    };
+    let add = b_p(p, "add").unwrap_or(false);
+    let toggle = b_p(p, "toggle").unwrap_or(false);
+    if toggle {
+        for id in ids {
+            if let Some(i) = s.state.selected_layers.iter().position(|l| *l == id) {
+                s.state.selected_layers.remove(i);
+            } else {
+                s.state.selected_layers.push(id);
+            }
+        }
+    } else if add {
+        for id in ids {
+            if !s.state.selected_layers.contains(&id) {
+                s.state.selected_layers.push(id);
+            }
+        }
+    } else {
+        select_only(&mut s.state, ids);
+    }
+    Ok(json!(s.state.selected_layers.iter().map(|l| l.0).collect::<Vec<_>>()))
+}
+
+/// Make `ids` the whole layer selection, as a plain click on them does: no property or keyframe
+/// stays selected, and mask vertices stay selected only on layers that are still selected.
+pub(crate) fn select_only(st: &mut crate::EditorState, ids: Vec<LayerId>) {
+    st.selected_layers = ids;
+    st.selected_props.clear();
+    st.selected_keys.clear();
+    let keep = st.selected_layers.clone();
+    st.selected_vertices.retain(|v| keep.contains(&v.layer));
+}
+
+pub(super) fn select_step(s: &mut Session, p: &Value, dir: i64) -> Result<Value> {
+    let comp = s.active_comp().ok_or(EngineError::NoComp)?;
+    if comp.layers.is_empty() {
+        return Ok(Value::Null);
+    }
+    let cur = s.state.selected_layers.first().and_then(|id| comp.layers.iter().position(|l| l.id == *id));
+    let n = comp.layers.len() as i64;
+    // The next layer that can be selected (locked and hidden shy layers are stepped over); at
+    // the end of the stack the selection stays.
+    let start = match cur {
+        Some(i) => i as i64 + dir,
+        None if dir > 0 => 0,
+        None => n - 1,
+    };
+    let next = std::iter::successors(Some(start), |i| Some(i + dir))
+        .take_while(|i| (0..n).contains(i))
+        .find(|i| crate::cmd::selectable(comp, &comp.layers[*i as usize]));
+    let Some(i) = next.or(cur.map(|i| i as i64)) else { return Ok(Value::Null) };
+    let id = comp.layers[i as usize].id;
+    let add = b_p(p, "add").unwrap_or(false);
+    if add {
+        if !s.state.selected_layers.contains(&id) {
+            s.state.selected_layers.insert(0, id);
+        }
+    } else {
+        s.state.selected_layers = vec![id];
+    }
+    Ok(json!(id.0))
+}
+
+pub(super) fn select_next(s: &mut Session, p: &Value) -> Result<Value> {
+    select_step(s, p, 1)
+}
+
+pub(super) fn select_prev(s: &mut Session, p: &Value) -> Result<Value> {
+    select_step(s, p, -1)
+}
diff --git a/crates/engine/src/cmd/layer/switches.rs b/crates/engine/src/cmd/layer/switches.rs
new file mode 100644
index 000000000..afee522c6
--- /dev/null
+++ b/crates/engine/src/cmd/layer/switches.rs
@@ -0,0 +1,326 @@
+use super::{
+    BlendMode, EngineError, FrameBlend, ItemId, KV, Layer, LayerId, MatteKind, Quality, Result, Session, TrackMatte, Value, b_p, bad, json, layer_mut, layer_p,
+    layers_p, merge_p, resolve_layer, str_p, unlocked,
+};
+
+pub(super) fn set_switch(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let name = str_p(p, "switch").ok_or_else(|| bad("layer.setSwitch", "missing `switch`"))?.to_string();
+    let v = b_p(p, "value");
+    let label = format!("Layer Switch ({name})");
+    if b_p(p, "others") == Some(true) {
+        return set_switch_others(s, cid, &ids, &name, v, &label);
+    }
+    // `merge`: a switch dragged over several layers in the Timeline is one undo step.
+    let r = s.edit(&label, merge_p(p), |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        let mut last = false;
+        // Toggle relative to the first layer so a multi-selection ends up consistent.
+        let first = comp.layers.iter().find(|l| ids.contains(&l.id)).map(|l| switch_value(l, &name)).unwrap_or(Some(false));
+        let Some(first) = first else { return Err(bad("layer.setSwitch", format!("unknown switch `{name}`"))) };
+        let target = v.unwrap_or(!first);
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
+            set_switch_value(l, &name, target);
+            last = target;
+        }
+        Ok(last)
+    })?;
+    Ok(json!(r))
+}
+
+/// `layer.setSwitch {others: true}` (Alt-click on an A/V feature in the Timeline): the named
+/// layers stand alone, shown / heard / soloed / unlocked while every other layer the switch
+/// applies to is the opposite; when they already do, the other layers come back. `value` sets
+/// the other layers directly.
+fn set_switch_others(s: &mut Session, cid: ItemId, ids: &[LayerId], name: &str, value: Option<bool>, label: &str) -> Result<Value> {
+    let r = s.edit(label, None, |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        // The state that sets a layer apart: unlocked for Lock, on for the rest.
+        let active = !matches!(name, "lock" | "locked");
+        // Track mattes keep their video off by design.
+        let mattes: Vec<LayerId> =
+            if matches!(name, "video" | "eye") { comp.layers.iter().filter_map(|l| l.track_matte.map(|m| m.layer)).collect() } else { Vec::new() };
+        let applies = |l: &Layer| match name {
+            "audio" => l.props.sub("audio").is_some(),
+            "lock" | "locked" => true,
+            // Every layer has a Video switch (it hides a null's outline in the viewer and turns a
+            // camera or light off), as the Timeline's eye cell shows; track mattes keep theirs off
+            // by design.
+            "video" | "eye" => !mattes.contains(&l.id),
+            _ => l.source.is_av() && !mattes.contains(&l.id),
+        };
+        let mut alone = true;
+        for l in comp.layers.iter().filter(|l| applies(l)) {
+            let Some(on) = switch_value(l, name) else { return Err(bad("layer.setSwitch", format!("unknown switch `{name}`"))) };
+            alone &= on == (ids.contains(&l.id) == active);
+        }
+        let others = value.unwrap_or(alone == active);
+        for l in comp.layers.iter_mut_where(|l| applies(l)) {
+            let v = if ids.contains(&l.id) { active } else { others };
+            set_switch_value(l, name, v);
+        }
+        Ok(others)
+    })?;
+    Ok(json!(r))
+}
+
+fn switch_value(l: &Layer, name: &str) -> Option<bool> {
+    let sw = &l.switches;
+    Some(match name {
+        "video" | "eye" => sw.video,
+        "audio" => sw.audio,
+        "solo" => sw.solo,
+        "lock" | "locked" => sw.locked,
+        "shy" => sw.shy,
+        "collapse" => sw.collapse,
+        "quality" => sw.quality == Quality::Best,
+        "fx" | "effects" => sw.effects,
+        "frameBlend" => sw.frame_blend != FrameBlend::Off,
+        "motionBlur" => sw.motion_blur,
+        "adjustment" => sw.adjustment,
+        "threeD" | "3d" | "3D" => sw.three_d,
+        "guide" => sw.guide,
+        "preserveTransparency" => l.preserve_transparency,
+        _ => return None,
+    })
+}
+
+fn set_switch_value(l: &mut Layer, name: &str, v: bool) {
+    let sw = &mut l.switches;
+    match name {
+        "video" | "eye" => sw.video = v,
+        "audio" => sw.audio = v,
+        "solo" => sw.solo = v,
+        "lock" | "locked" => sw.locked = v,
+        "shy" => sw.shy = v,
+        "collapse" => sw.collapse = v,
+        "quality" => sw.quality = if v { Quality::Best } else { Quality::Draft },
+        "fx" | "effects" => sw.effects = v,
+        "frameBlend" => sw.frame_blend = if v { FrameBlend::FrameMix } else { FrameBlend::Off },
+        "motionBlur" => sw.motion_blur = v,
+        "adjustment" => sw.adjustment = v,
+        "threeD" | "3d" | "3D" => {
+            if sw.three_d && !v {
+                drop_3d_values(l);
+            }
+            l.switches.three_d = v;
+        }
+        "guide" => sw.guide = v,
+        "preserveTransparency" => l.preserve_transparency = v,
+        _ => {}
+    }
+}
+
+/// Turning the 3D switch off discards Z values, Orientation and X/Y Rotation (as in AE).
+fn drop_3d_values(l: &mut Layer) {
+    let Some(tr) = l.transform_mut() else { return };
+    for (m, keep) in [("position", 0.0), ("anchor", 0.0), ("scale", 100.0)] {
+        if let Some(pr) = tr.get_mut(m) {
+            let flat = |v: &mut KV| {
+                if let KV::Vec3(a) = v {
+                    a[2] = keep;
+                }
+            };
+            flat(&mut pr.value);
+            for k in &mut pr.keys {
+                flat(&mut k.value);
+            }
+        }
+    }
+    for (m, zero) in [("orientation", KV::Vec3([0.0; 3])), ("rotationX", KV::Scalar(0.0)), ("rotationY", KV::Scalar(0.0))] {
+        if let Some(pr) = tr.get_mut(m) {
+            pr.keys.clear();
+            pr.expr = None;
+            pr.value = zero;
+        }
+    }
+}
+
+pub(super) fn rename(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid) = layer_p(s, p, "layer.rename")?;
+    let name = str_p(p, "name").ok_or_else(|| bad("layer.rename", "missing `name`"))?.to_string();
+    let t = s.time();
+    s.edit("Rename Layer", None, |proj, _| {
+        set_layer_name(layer_mut(proj, cid, lid)?, &name, t);
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// Give layer `l` the name `name` the user typed (comp time `t` picks the text). A text layer's
+/// name follows its text until the user renames it; an empty name makes it follow the text again
+/// (After Effects, #3233). Committing the unchanged name changes nothing.
+pub(super) fn set_layer_name(l: &mut Layer, name: &str, t: effectcraft_time::Tick) {
+    let text_name =
+        l.props.prop("text/sourceText").filter(|_| matches!(l.source, effectcraft_project::LayerSource::Text)).map(|pr| match pr.value_at(l.layer_time(t)) {
+            KV::Text(d) => effectcraft_project::text_layer_name(&d.text),
+            KV::Str(txt) => effectcraft_project::text_layer_name(&txt),
+            _ => String::new(),
+        });
+    match text_name {
+        Some(first) if name.trim().is_empty() => {
+            l.name = if first.is_empty() { "Text".to_string() } else { first };
+            l.name_follows_text = Some(true);
+        }
+        Some(_) if name != l.name => {
+            l.name = name.to_string();
+            l.name_follows_text = Some(false);
+        }
+        _ => l.name = name.to_string(),
+    }
+}
+
+/// The Timeline's Comment column.
+pub(super) fn set_comment(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let text = str_p(p, "comment").ok_or_else(|| bad("layer.setComment", "missing `comment`"))?.to_string();
+    s.edit("Layer Comment", None, |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
+            l.comment = text.clone();
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+pub(super) fn blend(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let mode = str_p(p, "mode").and_then(BlendMode::from_name);
+    let step = p.get("step").and_then(Value::as_i64).unwrap_or(0);
+    if mode.is_none() && step == 0 {
+        return Err(bad("layer.setBlendMode", "need `mode` (e.g. Multiply) or `step` ±1"));
+    }
+    s.edit("Blending Mode", None, |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
+            l.blend_mode = match mode {
+                Some(m) => m,
+                None if step > 0 => l.blend_mode.next(),
+                None => l.blend_mode.previous(),
+            };
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// `layer.setTrackMatte`: `layers` (or `layer`, else the first selected layer; locked ones left
+/// as they are) use `matte` as their track matte (none when null), in one undo step. `kind` sets the mode; `preserve` keeps
+/// each layer's own (Alpha for a layer without a matte), so changing the matte of several layers
+/// at once keeps their modes.
+pub(super) fn track_matte(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = match p.get("layers") {
+        Some(_) => layers_p(s, p)?,
+        None => layer_p(s, p, "layer.setTrackMatte").map(|(c, l)| (c, vec![l]))?,
+    };
+    // Locked layers keep their matte (several at once: the others get it).
+    let ids = unlocked(s, cid, ids, "layer.setTrackMatte")?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let matte = match p.get("matte") {
+        None | Some(Value::Null) => None,
+        Some(v) => Some(resolve_layer(comp, v).ok_or_else(|| bad("layer.setTrackMatte", "no such matte layer"))?),
+    };
+    if ids.is_empty() {
+        return Err(bad("layer.setTrackMatte", "no layers"));
+    }
+    if matte.is_some_and(|m| ids.contains(&m)) {
+        return Err(bad("layer.setTrackMatte", "a layer can't be its own matte"));
+    }
+    // None: each layer keeps its own mode.
+    let kind = match str_p(p, "kind").map(|k| k.to_ascii_lowercase().replace([' ', '_', '-'], "")) {
+        Some(k) if k == "preserve" => None,
+        Some(k) => Some(match k.as_str() {
+            "alphainverted" | "alphainv" => MatteKind::AlphaInverted,
+            "luma" => MatteKind::Luma,
+            "lumainverted" | "lumainv" => MatteKind::LumaInverted,
+            _ => MatteKind::Alpha,
+        }),
+        None => Some(MatteKind::Alpha),
+    };
+    s.edit("Track Matte", None, |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        if let Some(ml) = matte.and_then(|m| comp.layer_mut(m)) {
+            ml.switches.video = false;
+        }
+        for lid in &ids {
+            let l = comp.layer_mut(*lid).ok_or(EngineError::NoComp)?;
+            let kind = kind.unwrap_or_else(|| l.track_matte.map(|m| m.kind).unwrap_or_default());
+            l.track_matte = matte.map(|layer| TrackMatte { layer, kind });
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+#[cfg(test)]
+mod track_matte_batch_tests {
+    use super::*;
+    use std::sync::Arc;
+
+    fn matte_of(s: &Session, id: u64) -> Option<(u64, MatteKind)> {
+        s.active_comp().unwrap().layer(LayerId(id)).unwrap().track_matte.map(|m| (m.layer.0, m.kind))
+    }
+
+    /// #1260: several layers take one matte layer at once, in one undo step; `kind: "preserve"`
+    /// keeps each one's mode; refused calls change nothing; one `layer` still works.
+    #[test]
+    fn several_layers_take_one_matte_and_keep_their_modes() {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name":"Mattes","width":16,"height":16,"duration":1})).unwrap();
+        let [a, b, c, x, y] = ["A", "B", "C", "X", "Y"].map(|n| s.execute("layer.newSolid", json!({"name": n})).unwrap()["layer"].as_u64().unwrap());
+        s.execute("layer.setTrackMatte", json!({"layer": a, "matte": x, "kind": "luma"})).unwrap();
+        s.execute("layer.setTrackMatte", json!({"layer": b, "matte": x})).unwrap();
+        assert_eq!((matte_of(&s, a), matte_of(&s, b)), (Some((x, MatteKind::Luma)), Some((x, MatteKind::Alpha))), "one layer, as before");
+        let (before, undo) = (s.project.clone(), s.history.undo.len());
+        s.execute("layer.setTrackMatte", json!({"layers": [a, b, c], "matte": y, "kind": "preserve"})).unwrap();
+        assert_eq!(
+            [matte_of(&s, a), matte_of(&s, b), matte_of(&s, c)],
+            [Some((y, MatteKind::Luma)), Some((y, MatteKind::Alpha)), Some((y, MatteKind::Alpha))],
+            "each keeps its mode (Alpha without one)"
+        );
+        assert!(!s.active_comp().unwrap().layer(LayerId(y)).unwrap().switches.video, "the matte is hidden");
+        assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(s.project.same_content(&before));
+        // Refused: a layer as its own matte, an unknown layer, no layers. Nothing changes.
+        for p in [
+            json!({"layers": [a, y], "matte": y}),
+            json!({"layers": [a, 9999], "matte": y}),
+            json!({"layers": [], "matte": y}),
+            json!({"layers": [a], "matte": 9999}),
+        ] {
+            let (project, revision) = (s.project.clone(), s.revision);
+            assert!(s.execute("layer.setTrackMatte", p.clone()).is_err(), "{p}");
+            assert!(Arc::ptr_eq(&project, &s.project) && s.revision == revision, "{p} changed nothing");
+        }
+        s.execute("layer.setTrackMatte", json!({"layers": [a, b], "matte": null})).unwrap();
+        assert_eq!((matte_of(&s, a), matte_of(&s, b)), (None, None), "both lose it");
+    }
+
+    /// Locked layers keep their parent and matte when they are among several (the others change),
+    /// and alone they are an error that changes nothing.
+    #[test]
+    fn locked_layers_keep_their_parent_and_matte() {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name":"Locks","width":16,"height":16,"duration":1})).unwrap();
+        let [a, b, p, m] = ["A", "B", "P", "M"].map(|n| s.execute("layer.newSolid", json!({"name": n})).unwrap()["layer"].as_u64().unwrap());
+        s.execute("layer.setSwitch", json!({"layers": [b], "switch": "lock", "value": true})).unwrap();
+        let layer = |s: &Session, id: u64| s.active_comp().unwrap().layer(LayerId(id)).unwrap().clone();
+        s.execute("layer.setParent", json!({"layers": [a, b], "parent": p})).unwrap();
+        s.execute("layer.setTrackMatte", json!({"layers": [a, b], "matte": m, "kind": "preserve"})).unwrap();
+        s.execute("layer.trackMatte", json!({"layers": [a, b], "op": "luma"})).unwrap();
+        assert_eq!((layer(&s, a).parent, matte_of(&s, a)), (Some(LayerId(p)), Some((m, MatteKind::Luma))));
+        assert_eq!((layer(&s, b).parent, matte_of(&s, b)), (None, None), "the locked layer is left as it was");
+        for (cmd, p) in [
+            ("layer.setParent", json!({"layers": [b], "parent": p})),
+            ("layer.setTrackMatte", json!({"layers": [b], "matte": m})),
+            ("layer.trackMatte", json!({"layers": [b], "op": "alpha"})),
+        ] {
+            let (project, revision) = (s.project.clone(), s.revision);
+            let err = s.execute(cmd, p).unwrap_err();
+            assert!(err.to_string().contains("is locked"), "{cmd}: {err}");
+            assert!(Arc::ptr_eq(&project, &s.project) && s.revision == revision, "{cmd} changed nothing");
+        }
+    }
+}
diff --git a/crates/engine/src/cmd/layer/timing.rs b/crates/engine/src/cmd/layer/timing.rs
new file mode 100644
index 000000000..9fe85ac83
--- /dev/null
+++ b/crates/engine/src/cmd/layer/timing.rs
@@ -0,0 +1,625 @@
+use effectcraft_project::TrackMatte;
+
+use super::{
+    EngineError, ItemKind, Label, Layer, LayerId, LayerSource, Result, Session, Tick, Value, b_p, bad, build, f_p, json, layer_mut, layers_p, merge_p,
+    resolve_layer, str_p, unlocked, with,
+};
+
+pub(super) fn timing(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let t = s.time();
+    let op = str_p(p, "op").unwrap_or("set").to_string();
+    // Layer times stay on frame boundaries of the comp (as in AE).
+    let fr = s.project.comp(cid).ok_or(EngineError::NoComp)?.frame_rate;
+    let snap = |k: &str| f_p(p, k).map(|v| fr.snap_nearest(Tick::from_seconds_f64(v)));
+    let (delta, start, inp, outp) = (snap("delta"), snap("start"), snap("in"), snap("out"));
+    // Relative trims: each layer moves its own in/out point by the same amount, so dragging an
+    // edge of several selected layers trims them all together (as in AE).
+    let (in_delta, out_delta) = (snap("inDelta"), snap("outDelta"));
+    s.edit("Layer Timing", merge_p(p), |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        let fd = comp.frame_duration();
+        let comp_dur = comp.duration;
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
+            let shift = |l: &mut Layer, d: Tick| {
+                l.start_time += d;
+                l.in_point += d;
+                l.out_point += d;
+            };
+            match op.as_str() {
+                "moveInToTime" => {
+                    let d = t - l.in_point;
+                    shift(l, d);
+                }
+                "moveOutToTime" => {
+                    let d = t - l.out_point;
+                    shift(l, d);
+                }
+                "moveInToStart" => {
+                    let d = Tick::ZERO - l.in_point;
+                    shift(l, d);
+                }
+                "moveOutToEnd" => {
+                    let d = comp_dur - l.out_point;
+                    shift(l, d);
+                }
+                "trimInToTime" => l.in_point = t.min(l.out_point - fd),
+                // Alt+]: the Out edge lands one frame after the playhead, so its frame stays the
+                // layer's last visible one (as in After Effects), never before the In point.
+                "trimOutToTime" => l.out_point = t.max(l.in_point) + fd,
+                _ => {
+                    if let Some(d) = delta {
+                        shift(l, d);
+                    }
+                    if let Some(st) = start {
+                        let d = st - l.start_time;
+                        shift(l, d);
+                    }
+                    if let Some(i) = inp {
+                        l.in_point = i.min(l.out_point - fd);
+                    }
+                    if let Some(o) = outp {
+                        l.out_point = o.max(l.in_point + fd);
+                    }
+                    // Stops at the comp start/end (a point already past it doesn't jump onto
+                    // it), keeping at least one frame of layer.
+                    if let Some(d) = in_delta {
+                        l.in_point = (l.in_point + d).max(Tick::ZERO.min(l.in_point)).min(l.out_point - fd);
+                    }
+                    if let Some(d) = out_delta {
+                        l.out_point = (l.out_point + d).min(comp_dur.max(l.out_point)).max(l.in_point + fd);
+                    }
+                }
+            }
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// Move the layers `frames` frames in time (Alt+Page Up / Page Down, with Shift ten frames).
+pub(super) fn move_frames(s: &mut Session, p: &Value, frames: i64) -> Result<Value> {
+    let (cid, _) = layers_p(s, p)?;
+    let delta = s.project.comp(cid).ok_or(EngineError::NoComp)?.frame_rate.tick_of(frames).seconds();
+    timing(s, &with(p, "delta", json!(delta)))
+}
+
+/// Slip edit: move a layer's source (footage or precomp) under its fixed in and out points, like
+/// dragging the source-duration bar in After Effects. `delta` in seconds or `frames`; positive
+/// moves the source later. Clamped so the source still covers the in–out span: the result gives
+/// the `requested` shift and, per layer, the `delta` applied and whether it was `clamped` (#2371).
+/// Keyframes and layer markers are in layer time, so they travel with the source.
+pub(super) fn slip(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let fr = comp.frame_rate;
+    let delta = match (p.get("frames").and_then(Value::as_i64), f_p(p, "delta")) {
+        (Some(f), _) => fr.tick_of(f),
+        (None, Some(d)) => fr.snap_nearest(Tick::from_seconds_f64(d)),
+        _ => return Err(bad("layer.slip", "delta (seconds) or frames required")),
+    };
+    // Allowed shift per layer: the source span [lo, hi] in comp time must keep covering in..out.
+    let mut shifts: Vec<(LayerId, Tick)> = Vec::new();
+    for l in comp.layers.iter().filter(|l| ids.contains(&l.id)) {
+        if l.props.get("timeRemap").is_some() {
+            continue;
+        }
+        let dur = match &l.source {
+            LayerSource::Footage { item } => match s.project.item(*item).map(|i| &i.kind) {
+                Some(ItemKind::Footage(f)) if f.kind != effectcraft_project::FootageKind::Still => Some(f.looped_duration()),
+                _ => None,
+            },
+            LayerSource::Comp { item } => s.project.comp(*item).map(|c| c.duration),
+            _ => None,
+        };
+        let Some(dur) = dur else { continue };
+        let (a, b) = (l.comp_time(Tick::ZERO), l.comp_time(dur));
+        let (lo, hi) = (a.min(b), a.max(b));
+        let (min_d, max_d) = (l.out_point - hi, l.in_point - lo);
+        if min_d > max_d {
+            continue;
+        }
+        shifts.push((l.id, delta.max(min_d).min(max_d)));
+    }
+    if shifts.is_empty() {
+        return Err(bad("layer.slip", "select a footage or precomp layer (without time remapping)"));
+    }
+    s.edit("Slip Edit", merge_p(p), |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        for (id, d) in &shifts {
+            if let Some(l) = comp.layer_mut(*id) {
+                l.start_time += *d;
+            }
+        }
+        Ok(())
+    })?;
+    Ok(json!({
+        "requested": delta.seconds(),
+        "slipped": shifts.iter().map(|(id, d)| json!({"layer": id.0, "delta": d.seconds(), "clamped": *d != delta})).collect::<Vec<_>>(),
+    }))
+}
+
+pub(super) fn arrange(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let ids = unlocked(s, cid, ids, "layer.arrange")?;
+    let how = str_p(p, "to").unwrap_or("front").to_string();
+    let index = p.get("index").and_then(Value::as_u64).map(|i| i as usize);
+    // `above`: put the layers right above that one (the timeline's drag to reorder).
+    let above = match p.get("above") {
+        Some(v) => {
+            let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+            let a = resolve_layer(comp, v).ok_or_else(|| bad("layer.arrange", "no such layer for `above`"))?;
+            if ids.contains(&a) {
+                return Err(bad("layer.arrange", "`above` must be a layer that isn't being moved"));
+            }
+            Some(a)
+        }
+        None => None,
+    };
+    s.edit("Arrange Layers", None, |proj, _| {
+        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        // Bring Forward / Send Backward move each layer one step past the next layer that isn't
+        // moving (a run of selected layers moves as one; one already at the end stays).
+        if above.is_none() && index.is_none() && matches!(how.as_str(), "forward" | "backward") {
+            let picked = |l: &Layer| ids.contains(&l.id);
+            let n = comp.layers.len();
+            if how == "forward" {
+                for i in 1..n {
+                    if picked(&comp.layers[i]) && !picked(&comp.layers[i - 1]) {
+                        let run_end = (i..n).find(|j| !picked(&comp.layers[*j])).unwrap_or(n);
+                        comp.layers.rotate_range_left(i - 1..run_end, 1);
+                    }
+                }
+            } else {
+                for i in (0..n.saturating_sub(1)).rev() {
+                    if picked(&comp.layers[i]) && !picked(&comp.layers[i + 1]) {
+                        let run_start = (0..=i).rev().find(|j| !picked(&comp.layers[*j])).map_or(0, |j| j + 1);
+                        comp.layers.rotate_range_right(run_start..=i + 1, 1);
+                    }
+                }
+            }
+            return Ok(());
+        }
+        let mut picked: Vec<Layer> = Vec::new();
+        comp.layers.retain(|l| {
+            if ids.contains(&l.id) {
+                picked.push(l.clone());
+                false
+            } else {
+                true
+            }
+        });
+        let at = match (how.as_str(), index) {
+            _ if above.is_some() => comp.layers.iter().position(|l| Some(l.id) == above).unwrap_or(comp.layers.len()),
+            (_, Some(i)) => i.saturating_sub(1).min(comp.layers.len()),
+            ("back", _) => comp.layers.len(),
+            _ => 0,
+        };
+        for (k, l) in picked.into_iter().enumerate() {
+            comp.layers.insert((at + k).min(comp.layers.len()), l);
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// "Pre-comp N" with the lowest N no item already uses.
+fn unused_precomp_name(proj: &effectcraft_project::Project) -> String {
+    (1u32..).map(|n| format!("Pre-comp {n}")).find(|n| !proj.items.values().any(|i| &i.name == n)).unwrap_or_else(|| "Pre-comp".to_string())
+}
+
+/// Layer ▸ Pre-compose. `mode: move` (default; "Move all attributes into the new composition")
+/// nests the selected layers as they are; `mode: leave` ("Leave all attributes in", one footage,
+/// solid or precomp layer) nests only the layer's source, sized to it, and keeps the layer's
+/// transform, masks, effects and timing in the current comp. `adjustDuration` (move) trims the
+/// new comp to the selected layers' span; `open` opens the new comp.
+pub(super) fn precompose(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "layer.precompose";
+    let (cid, ids) = layers_p(s, p)?;
+    if ids.is_empty() {
+        return Err(bad(c, "no layers"));
+    }
+    let name = match str_p(p, "name") {
+        Some(n) => n.to_string(),
+        None => unused_precomp_name(&s.project),
+    };
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let leave = match str_p(p, "mode").unwrap_or("move") {
+        "move" => false,
+        "leave" => true,
+        x => return Err(bad(c, format!("mode: move|leave, got `{x}`"))),
+    };
+    let adjust = b_p(p, "adjustDuration").unwrap_or(false);
+    if leave {
+        let [lid] = ids[..] else { return Err(bad(c, "\"Leave all attributes\" needs exactly one layer")) };
+        let layer = comp.layer(lid).ok_or(EngineError::NoComp)?.clone();
+        let Some(src_item) = layer.source.item() else {
+            return Err(bad(c, "\"Leave all attributes\" is available for footage, solid and precomp layers only"));
+        };
+        let (w, h) = effectcraft_render::source_size(&s.project, &layer);
+        let (w, h) = if w == 0 || h == 0 { (comp.width, comp.height) } else { (w, h) };
+        let dur = match s.project.item(src_item).map(|i| &i.kind) {
+            Some(ItemKind::Comp(nc)) => nc.duration,
+            Some(ItemKind::Footage(f)) if f.duration > Tick(0) => f.duration,
+            _ => comp.duration,
+        };
+        let new = s.edit("Pre-compose", None, |proj, st| {
+            let mut inner = comp.nested_like(w, h, dur);
+            let mut il = build::layer(proj, &inner, &layer.name, layer.source.clone(), (w, h), Some(dur));
+            il.name = layer.name.clone();
+            inner.layers.push(il);
+            let iid = proj.add_item(&name, Label::Sandstone, None, ItemKind::Comp(inner.into()));
+            let l = layer_mut(proj, cid, lid)?;
+            l.source = LayerSource::Comp { item: iid };
+            l.name = name.clone();
+            st.selected_layers = vec![lid];
+            Ok((iid, lid))
+        })?;
+        if b_p(p, "open").unwrap_or(false) {
+            s.open_comp(new.0);
+        }
+        return Ok(json!({"comp": new.0.0, "layer": new.1.0}));
+    }
+    let span = {
+        let sel: Vec<&effectcraft_project::Layer> = comp.layers.iter().filter(|l| ids.contains(&l.id)).collect();
+        let a = sel.iter().map(|l| l.in_point).min().unwrap_or(Tick(0)).max(Tick(0));
+        let b = sel.iter().map(|l| l.out_point).max().unwrap_or(comp.duration).min(comp.duration);
+        (a, b)
+    };
+    let (offset, dur) = if adjust && span.1 > span.0 { (span.0, span.1 - span.0) } else { (Tick(0), comp.duration) };
+    let new = s.edit("Pre-compose", None, |proj, st| {
+        let mut inner = comp.nested_like(comp.width, comp.height, dur);
+        inner.layers = comp.layers.iter().filter(|l| ids.contains(&l.id)).cloned().collect();
+        for l in &mut inner.layers {
+            if l.parent.is_some_and(|p| !ids.contains(&p)) {
+                l.parent = None;
+            }
+            if l.track_matte.is_some_and(|m| !ids.contains(&m.layer)) {
+                l.track_matte = None;
+            }
+            l.start_time -= offset;
+            l.in_point -= offset;
+            l.out_point -= offset;
+        }
+        let iid = proj.add_item(&name, Label::Sandstone, None, ItemKind::Comp(inner.into()));
+        let mut l = build::layer(proj, &comp, &name, LayerSource::Comp { item: iid }, (comp.width, comp.height), Some(dur));
+        l.name = name.clone();
+        l.start_time = offset;
+        l.in_point = offset;
+        l.out_point = offset + dur;
+        let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        let at = c.layers.iter().position(|l| ids.contains(&l.id)).unwrap_or(0);
+        c.layers.retain(|l| !ids.contains(&l.id));
+        // Layers left behind must not keep pointing at layers that moved into the new comp.
+        for l in &mut c.layers {
+            if l.parent.is_some_and(|p| ids.contains(&p)) {
+                l.parent = None;
+            }
+            if l.track_matte.as_ref().is_some_and(|m| ids.contains(&m.layer)) {
+                l.track_matte = None;
+            }
+        }
+        let lid = l.id;
+        c.layers.insert(at.min(c.layers.len()), l);
+        st.selected_layers = vec![lid];
+        Ok((iid, lid))
+    })?;
+    if b_p(p, "open").unwrap_or(false) {
+        s.open_comp(new.0);
+    }
+    Ok(json!({"comp": new.0.0, "layer": new.1.0}))
+}
+
+/// Why expanding a pre-comp layer in place would change the picture or drop something, one entry
+/// per cause. Un-precompose keeps the picture exactly for a pre-comp layer that only places the
+/// nested composition (Position/Anchor Point, timing); anything the layer itself adds to the look,
+/// and what only holds inside the nested comp, is listed. These are warnings: `force` unpacks
+/// anyway and drops it. A lock is not listed here: it always refuses.
+fn unprecompose_warnings(comp: &effectcraft_project::Comp, layer: &Layer, nested: &effectcraft_project::Comp) -> Vec<String> {
+    let mut why = vec![];
+    if layer.parent.is_some() {
+        why.push("the layer has a parent".to_string());
+    }
+    if layer.track_matte.is_some() {
+        why.push("the layer has a track matte".to_string());
+    }
+    if comp.layers.iter().any(|o| o.id != layer.id && (o.parent == Some(layer.id) || o.track_matte.is_some_and(|m| m.layer == layer.id))) {
+        why.push("another layer uses it as its parent or track matte (that link is removed)".to_string());
+    }
+    if layer.is_3d() || layer.switches.collapse || layer.switches.adjustment || layer.preserve_transparency {
+        why.push("the layer is 3D, collapses transformations, is an adjustment layer or preserves transparency".to_string());
+    }
+    if !layer.switches.video || !layer.switches.audio {
+        why.push("the layer's Video or Audio switch is off".to_string());
+    }
+    if layer.switches.solo || layer.switches.guide {
+        // Solo hides the comp's other layers and a guide layer is left out of renders; the
+        // expanded copies would carry neither, so the picture would change.
+        why.push("the layer's Solo or Guide switch is on".to_string());
+    }
+    if comp.layers.iter().any(|o| o.id != layer.id && refers_to(&o.props, layer.id)) {
+        why.push("a property of another layer refers to it (that reference is cleared)".to_string());
+    }
+    why.extend(expression_warnings(comp, layer, nested.layers.len()));
+    if layer.blend_mode != effectcraft_color::BlendMode::default() {
+        why.push("the layer has a blending mode".to_string());
+    }
+    if layer.stretch != 100.0 || layer.props.prop("timeRemap").is_some() {
+        why.push("the layer is time-stretched or time-remapped".to_string());
+    }
+    if layer.effects().is_some_and(|e| !e.children.is_empty()) {
+        why.push("the layer has effects".to_string());
+    }
+    if layer.masks().is_some_and(|m| !m.children.is_empty()) {
+        why.push("the layer has masks".to_string());
+    }
+    if layer.styles_change_pixels() {
+        why.push("the layer has layer styles".to_string());
+    }
+    if let Some(tr) = layer.transform() {
+        let at = |m: &str, d: [f64; 3]| tr.get(m).map(|p| p.value.as_vec3()).unwrap_or(d);
+        let animated = tr.props().any(|p| !p.keys.is_empty() || p.expr.is_some());
+        let separated = tr.get("positionX").is_some();
+        if animated || separated {
+            why.push("its transform is animated, has an expression or has separated dimensions".to_string());
+        } else {
+            let (sc, rot, ori) = (at("scale", [100.0; 3]), at("rotation", [0.0; 3]), at("orientation", [0.0; 3]));
+            let op = tr.get("opacity").map(|p| p.value.as_f64()).unwrap_or(100.0);
+            if sc[0] != 100.0 || sc[1] != 100.0 || rot[0] != 0.0 || ori != [0.0; 3] || op != 100.0 {
+                why.push("its Scale, Rotation or Opacity is not at its default".to_string());
+            }
+        }
+    }
+    if nested.layers.iter().any(|l| l.is_camera() || l.is_light()) {
+        why.push("the composition has a camera or light".to_string());
+    }
+    // Inside the nested comp these composite against the nested stack only; in the parent they
+    // would act on everything below.
+    if nested.layers.iter().any(|l| {
+        l.switches.adjustment || l.switches.collapse || l.is_3d() || l.preserve_transparency || l.blend_mode != effectcraft_color::BlendMode::default()
+    }) {
+        why.push("the composition has adjustment, 3D or collapsing layers or layers with a blending mode or Preserve Transparency".to_string());
+    }
+    // A solo hides only the nested comp's other layers; a soloed copy would hide the parent's.
+    if nested.layers.iter().any(|l| l.switches.solo) {
+        why.push("the composition has a soloed layer".to_string());
+    }
+    why.extend(sampling_warnings(comp, nested));
+    why.extend(position_expression_warnings(layer, nested));
+    why
+}
+
+/// What the nested comp's own frame sampling does that the expanded layers lose: a preserved
+/// frame rate other than the parent's (its layers then change only on its own frames), and
+/// motion blur with a shutter other than the parent's.
+fn sampling_warnings(comp: &effectcraft_project::Comp, nested: &effectcraft_project::Comp) -> Vec<String> {
+    let mut why = vec![];
+    if nested.preserve_frame_rate && nested.frame_rate != comp.frame_rate {
+        why.push("the composition preserves a frame rate other than this one's (its layers would be sampled at this comp's frames)".to_string());
+    }
+    let shutter = nested.shutter_angle != comp.shutter_angle || nested.shutter_phase != comp.shutter_phase;
+    if shutter && nested.layers.iter().any(|l| l.switches.motion_blur) {
+        why.push("the composition's motion blur shutter differs from this one's".to_string());
+    }
+    why
+}
+
+/// The move from the pre-comp layer's Position against its Anchor Point, which expansion adds to
+/// the Position of the nested comp's unparented layers.
+fn placement_offset(layer: &Layer) -> (f64, f64) {
+    let tr = layer.transform();
+    let at = |m: &str| tr.and_then(|t| t.get(m)).map(|p| p.value.as_vec3()).unwrap_or([0.0; 3]);
+    let (anchor, position) = (at("anchor"), at("position"));
+    (position[0] - anchor[0], position[1] - anchor[1])
+}
+
+/// Unparented nested layers whose Position (or a separated axis) has an expression: the move from
+/// [`placement_offset`] is added to the stored value and keys, which an expression can ignore.
+fn position_expression_warnings(layer: &Layer, nested: &effectcraft_project::Comp) -> Vec<String> {
+    let (dx, dy) = placement_offset(layer);
+    if dx == 0.0 && dy == 0.0 {
+        return vec![];
+    }
+    nested
+        .layers
+        .iter()
+        .filter(|l| l.parent.is_none())
+        .filter(|l| l.transform().is_some_and(|tr| ["position", "positionX", "positionY"].iter().any(|m| tr.get(m).is_some_and(|p| p.expr.is_some()))))
+        .map(|l| format!("layer “{}” has a Position expression, so the move to the pre-comp layer's Position may not apply to it", l.name))
+        .collect()
+}
+
+/// One warning per property of another layer in `comp` whose expression names `layer`: by its
+/// name in quotes, or as `layer(<index>)` with its 1-based index (not on another comp's
+/// `comp("…").layer(…)`), and one per expression naming a layer by a number below it while the
+/// `added` layers replacing it renumber those. Detection is by text; the expressions are left as
+/// they are.
+fn expression_warnings(comp: &effectcraft_project::Comp, layer: &Layer, added: usize) -> Vec<String> {
+    let index = comp.layers.iter().position(|l| l.id == layer.id).map(|i| i.saturating_add(1));
+    let quoted = [format!("\"{}\"", layer.name), format!("'{}'", layer.name)];
+    let names_it = |text: &str| quoted.iter().any(|q| text.contains(q.as_str())) || index.is_some_and(|i| indexed_layers(text).contains(&i));
+    let renumbered = |text: &str| added != 1 && index.is_some_and(|i| indexed_layers(text).iter().any(|n| *n > i));
+    let mut out = vec![];
+    for o in comp.layers.iter().filter(|o| o.id != layer.id) {
+        o.props.walk("", &mut |_, p| {
+            if p.expr.as_ref().is_some_and(|e| !names_it(&e.text) && renumbered(&e.text)) {
+                out.push(format!("layer “{}” {} names a layer by number, and the layers below “{}” are renumbered", o.name, p.name, layer.name));
+            }
+            if p.expr.as_ref().is_some_and(|e| names_it(&e.text)) {
+                out.push(format!("layer “{}” {} has an expression that refers to “{}” (it will no longer find it)", o.name, p.name, layer.name));
+            }
+        });
+    }
+    out
+}
+
+/// The indexes expression `text` calls `layer(<index>)` with (spaces allowed) on this comp: bare,
+/// `thisComp.layer(…)`, not `comp("Other").layer(…)` or `thisLayer(…)`.
+fn indexed_layers(text: &str) -> Vec<usize> {
+    text.match_indices("layer(")
+        .filter_map(|(at, _)| {
+            let before = text.get(..at).unwrap_or("");
+            let on_other = before.ends_with(").") || before.chars().next_back().is_some_and(|c| c.is_alphanumeric() || c == '_');
+            if on_other && !before.ends_with("thisComp.") {
+                return None;
+            }
+            let rest = text.get(at + "layer(".len()..).unwrap_or("").trim_start();
+            let digits: String = rest.chars().take_while(char::is_ascii_digit).collect();
+            let after = rest.get(digits.len()..).unwrap_or("").trim_start();
+            digits.parse::<usize>().ok().filter(|_| after.starts_with(')'))
+        })
+        .collect()
+}
+
+/// Whether any property (value or key) in `props` holds a reference to layer `id`.
+fn refers_to(props: &effectcraft_project::PropGroup, id: LayerId) -> bool {
+    let is = |v: &effectcraft_keyframe::Value| matches!(v, effectcraft_keyframe::Value::Layer(Some(l)) if *l == id.0);
+    props.children.iter().any(|c| match c {
+        effectcraft_project::Node::Prop(p) => is(&p.value) || p.keys.iter().any(|k| is(&k.value)),
+        effectcraft_project::Node::Group(g) => refers_to(g, id),
+    })
+}
+
+/// Clear every reference to layer `id` (`Value::Layer`, value or key) in `props`; references to
+/// other layers stay.
+fn clear_layer_refs(props: &mut effectcraft_project::PropGroup, id: LayerId) {
+    let fix = |v: &mut effectcraft_keyframe::Value| {
+        if matches!(v, effectcraft_keyframe::Value::Layer(Some(l)) if *l == id.0) {
+            *v = effectcraft_keyframe::Value::Layer(None);
+        }
+    };
+    for c in &mut props.children {
+        match c {
+            effectcraft_project::Node::Prop(p) => {
+                fix(&mut p.value);
+                for k in &mut p.keys {
+                    fix(&mut k.value);
+                }
+            }
+            effectcraft_project::Node::Group(g) => clear_layer_refs(g, id),
+        }
+    }
+}
+
+/// The layers of `comp` other than `id` let go of it: parent, track matte and property references
+/// to it are removed, so nothing points at a layer that is gone.
+fn detach_from(comp: &mut effectcraft_project::Comp, id: LayerId) {
+    for l in comp.layers.iter_mut().filter(|l| l.id != id) {
+        if l.parent == Some(id) {
+            l.parent = None;
+        }
+        if l.track_matte.is_some_and(|m| m.layer == id) {
+            l.track_matte = None;
+        }
+        clear_layer_refs(&mut l.props, id);
+    }
+}
+
+/// Replace layer references (`Value::Layer`) found in `props` by `map` (old id → new id), the
+/// way copies of a set of layers keep pointing at each other. A reference to a layer outside the
+/// set is cleared: it named a layer of the nested comp that is no longer there.
+fn remap_layer_values(props: &mut effectcraft_project::PropGroup, map: &[(LayerId, LayerId)]) {
+    let fix = |v: &mut effectcraft_keyframe::Value| {
+        if let effectcraft_keyframe::Value::Layer(Some(id)) = v {
+            *v = effectcraft_keyframe::Value::Layer(map.iter().find(|(o, _)| o.0 == *id).map(|(_, n)| n.0));
+        }
+    };
+    for c in &mut props.children {
+        match c {
+            effectcraft_project::Node::Prop(p) => {
+                fix(&mut p.value);
+                for k in &mut p.keys {
+                    fix(&mut k.value);
+                }
+            }
+            effectcraft_project::Node::Group(g) => remap_layer_values(g, map),
+        }
+    }
+}
+
+/// Layer ▸ Un-precompose: expand a selected pre-comp layer back into its composition. The nested
+/// comp's layers become copies in this comp at the pre-comp layer's place, in their order and
+/// with their keyframes, effects, masks, parenting, mattes, markers and audio; their timing is
+/// moved by the pre-comp layer's Start and trimmed to the span it showed, and an Anchor Point
+/// different from Position moves the unparented ones by the difference. The nested comp stays in
+/// the project. The nested comp's frame no longer clips what the layers draw outside it.
+///
+/// A locked pre-comp layer is refused, changing nothing. Anything else that would change the
+/// picture or drop something (see [`unprecompose_warnings`]) is an error listing the reasons unless
+/// `force` is set; with `force` the layer is expanded the same way, what the pre-comp layer itself
+/// carried (effects, masks, styles, transform beyond Position, time remap, blending mode, switches,
+/// parent, matte) goes with it, and the other layers' parent, matte and property links to it are
+/// removed. The result lists the reasons as `warnings`; `dryRun` only lists them.
+pub(super) fn unprecompose(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "layer.unprecompose";
+    let (cid, ids) = layers_p(s, p)?;
+    let [lid] = ids[..] else { return Err(bad(c, "select exactly one pre-comp layer")) };
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?.clone();
+    let LayerSource::Comp { item } = layer.source else { return Err(bad(c, format!("“{}” is not a pre-comp layer", layer.name))) };
+    if layer.switches.locked {
+        return Err(bad(c, format!("can't un-precompose “{}”: the layer is locked (unlock it first)", layer.name)));
+    }
+    let nested = s.project.comp(item).ok_or_else(|| bad(c, "the layer's composition is missing"))?.clone();
+    let warnings = unprecompose_warnings(&comp, &layer, &nested);
+    if b_p(p, "dryRun").unwrap_or(false) {
+        return Ok(json!({"dryRun": true, "warnings": warnings}));
+    }
+    if !warnings.is_empty() && !b_p(p, "force").unwrap_or(false) {
+        let why = warnings.join("; ");
+        return Err(bad(
+            c,
+            format!(
+                "can't un-precompose “{}” without changing it: {why} (nothing changed: pass `force` to unpack anyway, or `dryRun` to list the reasons)",
+                layer.name
+            ),
+        ));
+    }
+    let (dx, dy) = placement_offset(&layer);
+    let shown = (layer.in_point.max(layer.start_time), layer.out_point.min(layer.start_time + nested.duration));
+    let new = s.edit("Un-precompose", None, |proj, st| {
+        let mut next = proj.next_id;
+        let mut copies: Vec<Layer> = nested.layers.iter().cloned().collect();
+        let mut map = vec![];
+        for l in &mut copies {
+            let old = l.id;
+            crate::cmd::edit::reid(l, &mut next);
+            map.push((old, l.id));
+        }
+        let link = |id: LayerId| map.iter().find(|(o, _)| *o == id).map(|(_, n)| *n);
+        for l in &mut copies {
+            l.parent = l.parent.and_then(link);
+            l.track_matte = l.track_matte.and_then(|m| link(m.layer).map(|layer| TrackMatte { layer, ..m }));
+            remap_layer_values(&mut l.props, &map);
+            l.start_time += layer.start_time;
+            l.in_point = (l.in_point + layer.start_time).clamp(shown.0, shown.1.max(shown.0));
+            l.out_point = (l.out_point + layer.start_time).clamp(l.in_point, shown.1.max(l.in_point));
+            if l.parent.is_none()
+                && let Some(tr) = l.transform_mut()
+            {
+                super::offset_position(tr, dx, dy);
+            }
+        }
+        proj.next_id = next;
+        let target = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
+        detach_from(target, lid);
+        let at = target.layers.iter().position(|l| l.id == lid).unwrap_or(0);
+        target.layers.retain(|l| l.id != lid);
+        let mut made = vec![];
+        for (k, mut l) in copies.into_iter().enumerate() {
+            l.name = target.unique_layer_name(&l.name);
+            made.push(l.id);
+            target.layers.insert((at + k).min(target.layers.len()), l);
+        }
+        for m in &nested.markers {
+            let mut m = m.clone();
+            m.time += layer.start_time;
+            target.markers.push(m);
+        }
+        // Comp markers are kept in time order (`thisComp.marker.key(n)`, next/previous marker).
+        target.markers.sort_by_key(|m| m.time);
+        st.selected_layers = made.clone();
+        Ok(made)
+    })?;
+    Ok(json!({"layers": new.iter().map(|l| l.0).collect::<Vec<_>>(), "warnings": warnings}))
+}
diff --git a/crates/engine/src/cmd/layer/transform.rs b/crates/engine/src/cmd/layer/transform.rs
new file mode 100644
index 000000000..acccfc7df
--- /dev/null
+++ b/crates/engine/src/cmd/layer/transform.rs
@@ -0,0 +1,230 @@
+use super::create::{color_p, pixel_aspect_p};
+use super::{
+    EngineError, ItemKind, KV, LayerId, LayerSource, PropGroup, Result, Session, Tick, Value, bad, has_layers, json, layer_mut, layer_p, layers_p, limits,
+    str_p, unlocked,
+};
+
+/// Move Position by `(dx, dy)`, including every key. Separated dimensions move X and Y as well
+/// as the combined property the channels were split from.
+pub(crate) fn offset_position(tr: &mut PropGroup, dx: f64, dy: f64) {
+    if dx == 0.0 && dy == 0.0 {
+        return;
+    }
+    if tr.get("positionX").is_some() {
+        for (name, d) in [("positionX", dx), ("positionY", dy)] {
+            if let Some(pr) = tr.get_mut(name) {
+                pr.value = KV::Scalar(pr.value.as_f64() + d);
+                for k in &mut pr.keys {
+                    k.value = KV::Scalar(k.value.as_f64() + d);
+                }
+            }
+        }
+    }
+    if let Some(pr) = tr.get_mut("position") {
+        let shift = |v: &KV| match v {
+            KV::Vec2(a) => KV::Vec2([a[0] + dx, a[1] + dy]),
+            other => {
+                let a = other.as_vec3();
+                KV::Vec3([a[0] + dx, a[1] + dy, a[2]])
+            }
+        };
+        pr.value = shift(&pr.value);
+        for k in &mut pr.keys {
+            k.value = shift(&k.value);
+        }
+    }
+}
+
+/// Set a layer's Position at layer time `lt` to `f(current)`: X/Y/Z Position when its dimensions
+/// are separated.
+pub(crate) fn update_position(tr: &mut PropGroup, lt: Tick, f: impl Fn([f64; 3]) -> [f64; 3]) {
+    const SEPARATE: [&str; 3] = ["positionX", "positionY", "positionZ"];
+    if tr.get("positionX").is_some() {
+        let v = f(SEPARATE.map(|m| tr.get(m).map(|p| p.value_at(lt).as_f64()).unwrap_or(0.0)));
+        for (m, x) in SEPARATE.iter().zip(v) {
+            if let Some(pr) = tr.get_mut(m) {
+                pr.set_value_at(lt, KV::Scalar(x));
+            }
+        }
+    } else if let Some(pr) = tr.get_mut("position") {
+        let v = f(pr.value_at(lt).as_vec3());
+        pr.set_value_at(lt, KV::Vec3(v));
+    }
+}
+
+/// A Transform property's default (Reset) by match id: the anchor at the centre of the source
+/// (`w`×`h`), the position at the comp's (`cw`×`ch`), 100% scale and opacity, no rotation.
+pub(crate) fn transform_default(m: &str, (w, h): (f64, f64), (cw, ch): (f64, f64)) -> Option<KV> {
+    Some(match m {
+        "anchor" => KV::Vec3([w / 2.0, h / 2.0, 0.0]),
+        "position" => KV::Vec3([cw / 2.0, ch / 2.0, 0.0]),
+        "positionX" => KV::Scalar(cw / 2.0),
+        "positionY" => KV::Scalar(ch / 2.0),
+        "positionZ" | "rotation" | "rotationX" | "rotationY" => KV::Scalar(0.0),
+        "scale" => KV::Vec3([100.0; 3]),
+        "orientation" => KV::Vec3([0.0; 3]),
+        "opacity" => KV::Scalar(100.0),
+        _ => return None,
+    })
+}
+
+pub(super) fn transform_op(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, ids) = layers_p(s, p)?;
+    let ids = unlocked(s, cid, ids, "layer.transform")?;
+    let op = str_p(p, "op").unwrap_or("reset").to_string();
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
+    let t = s.time();
+    // A shape or text layer has no source item, so source_size is (0, 0): the fit ops size it by
+    // its painted bounds at the current time instead, and anchor at the bounds' centre — content
+    // bounds live in layer space, where a shape is centred on the origin and text sits above its
+    // baseline, so (w/2, h/2) would push it off-centre (#2198). Reset and the other ops keep the
+    // source size.
+    let ectx = effectcraft_render::EvalCtx {
+        expr: s.expr.as_deref(),
+        footage: Some(s.footage.as_ref()),
+        ..effectcraft_render::EvalCtx::new(&s.project, cid, &comp, t)
+    };
+    let fitting = matches!(op.as_str(), "fit" | "fitWidth" | "fitHeight");
+    let sizes: Vec<(LayerId, [f64; 2], [f64; 2])> = comp
+        .layers
+        .iter()
+        .filter(|l| ids.contains(&l.id))
+        .map(|l| {
+            let (w, h) = effectcraft_render::source_size(&s.project, l);
+            if fitting && (w == 0 || h == 0) {
+                match effectcraft_render::content_bounds(&ectx, l).filter(|b| b.iter().all(|v| v.is_finite()) && b[2] > b[0] && b[3] > b[1]) {
+                    Some(b) => (l.id, [b[2] - b[0], b[3] - b[1]], [(b[0] + b[2]) / 2.0, (b[1] + b[3]) / 2.0]),
+                    None => (l.id, [0.0; 2], [0.0; 2]),
+                }
+            } else {
+                (l.id, [w as f64, h as f64], [w as f64 / 2.0, h as f64 / 2.0])
+            }
+        })
+        .collect();
+    s.edit("Transform", None, |proj, _| {
+        for (lid, size, anchor) in &sizes {
+            let l = layer_mut(proj, cid, *lid)?;
+            let lt = l.layer_time(t);
+            let (cw, ch) = (comp.width as f64, comp.height as f64);
+            let (w, h) = (size[0], size[1]);
+            let Some(tr) = l.transform_mut() else { continue };
+            let set = |tr: &mut PropGroup, m: &str, v: KV| {
+                if let Some(pr) = tr.get_mut(m) {
+                    pr.set_value_at(lt, v);
+                }
+            };
+            match op.as_str() {
+                "reset" => {
+                    for m in ["anchor", "scale", "rotation", "rotationX", "rotationY", "orientation", "opacity"] {
+                        if let Some(v) = transform_default(m, (w, h), (cw, ch)) {
+                            set(tr, m, v);
+                        }
+                    }
+                    update_position(tr, lt, |_| [cw / 2.0, ch / 2.0, 0.0]);
+                }
+                // Centred in the frame; a 3D layer keeps its depth.
+                "center" => update_position(tr, lt, |p| [cw / 2.0, ch / 2.0, p[2]]),
+                "fit" | "fitWidth" | "fitHeight" if w > 0.0 && h > 0.0 => {
+                    let (sx, sy) = match op.as_str() {
+                        "fitWidth" => (cw / w, cw / w),
+                        "fitHeight" => (ch / h, ch / h),
+                        _ => (cw / w, ch / h),
+                    };
+                    // A tiny shape's bounds can overflow the scale; refuse rather than write infinity.
+                    if !(sx * 100.0).is_finite() || !(sy * 100.0).is_finite() {
+                        return Err(EngineError::Other(format!("layer {} is too small to fit to the composition", lid.0)));
+                    }
+                    let z = |m: &str, d: f64| tr.get(m).map(|p| p.value_at(lt).as_vec3()[2]).unwrap_or(d);
+                    let (sz, az) = (z("scale", 100.0), z("anchor", 0.0));
+                    set(tr, "scale", KV::Vec3([sx * 100.0, sy * 100.0, sz]));
+                    update_position(tr, lt, |p| [cw / 2.0, ch / 2.0, p[2]]);
+                    set(tr, "anchor", KV::Vec3([anchor[0], anchor[1], az]));
+                }
+                "flipH" | "flipV" => {
+                    let cur = tr.get("scale").map(|p| p.value_at(lt).as_vec3()).unwrap_or([100.0; 3]);
+                    let v = if op == "flipH" { [-cur[0], cur[1], cur[2]] } else { [cur[0], -cur[1], cur[2]] };
+                    set(tr, "scale", KV::Vec3(v));
+                }
+                _ => {}
+            }
+        }
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// Layer ▸ Layer Settings: cameras and lights open their own settings; solids (and adjustment
+/// layers, which are solids) edit their Solid Settings. With `affectAll: false`, a solid other
+/// layers also use is copied into a new solid for this layer instead of being changed for all of
+/// them (After Effects' "Affect all layers that use this solid"). `name` renames the layer and
+/// its solid; an empty one makes a text layer's name follow its text again.
+pub(super) fn layer_settings(s: &mut Session, p: &Value) -> Result<Value> {
+    let (cid, lid) = layer_p(s, p, "layer.settings")?;
+    // Cameras and lights open their own settings (Camera Settings / Light Settings).
+    match s.project.comp(cid).and_then(|c| c.layer(lid)).map(|l| l.source.clone()) {
+        Some(LayerSource::Camera) => return s.execute("layer.cameraSettings", with_layer(p, lid)),
+        Some(LayerSource::Light { .. }) => return s.execute("layer.lightSettings", with_layer(p, lid)),
+        _ => {}
+    }
+    let color = color_p(p, "color");
+    let w = p.get("width").and_then(Value::as_u64).map(limits::size);
+    let h = p.get("height").and_then(Value::as_u64).map(limits::size);
+    let pixel_aspect = pixel_aspect_p(p)?;
+    let name = str_p(p, "name").map(str::trim).filter(|n| !n.is_empty()).map(str::to_string);
+    // An empty name gives a text layer its text's name again, as `layer.rename` does (#3233);
+    // other layers keep theirs.
+    let follow_text = str_p(p, "name").is_some_and(|n| n.trim().is_empty());
+    let affect_all = p.get("affectAll").and_then(Value::as_bool).unwrap_or(true);
+    let t = s.time();
+    let solid = s.edit("Layer Settings", None, |proj, _| {
+        let src = layer_mut(proj, cid, lid)?.source.clone();
+        if let Some(n) = &name {
+            // A user name: a text layer's name stops following its text (#3233).
+            super::switches::set_layer_name(layer_mut(proj, cid, lid)?, n, t);
+        } else if follow_text && matches!(src, LayerSource::Text) {
+            super::switches::set_layer_name(layer_mut(proj, cid, lid)?, "", t);
+        }
+        let LayerSource::Solid { item } = src else { return Ok(None) };
+        let shared = proj.comps().flat_map(|(_, c)| &c.layers).filter(|l| l.source == src).count() > 1;
+        let target = if shared && !affect_all {
+            // This layer gets its own copy of the solid.
+            let it = proj.item(item).ok_or_else(|| bad("layer.settings", "the layer's solid is missing"))?.clone();
+            let copy = proj.add_item(name.as_deref().unwrap_or(&it.name), it.label, it.parent, it.kind);
+            layer_mut(proj, cid, lid)?.source = LayerSource::Solid { item: copy };
+            copy
+        } else {
+            item
+        };
+        let it = proj.item_mut(target).ok_or_else(|| bad("layer.settings", "the layer's solid is missing"))?;
+        if let Some(n) = &name {
+            it.name = n.clone();
+        }
+        if let ItemKind::Solid(so) = &mut it.kind {
+            so.color = color.unwrap_or(so.color);
+            so.width = w.unwrap_or(so.width);
+            so.height = h.unwrap_or(so.height);
+            so.pixel_aspect = pixel_aspect.unwrap_or(so.pixel_aspect);
+        }
+        Ok(Some(target))
+    })?;
+    Ok(match solid {
+        Some(item) => json!({"layer": lid.0, "solid": item.0}),
+        None => json!({"layer": lid.0}),
+    })
+}
+
+/// Layer Settings applies to solids (and adjustment layers), nulls, cameras and lights.
+pub(super) fn has_layer_settings(s: &Session) -> std::result::Result<(), String> {
+    has_layers(s)?;
+    let l = s.active_comp().zip(s.state.selected_layers.first()).and_then(|(c, l)| c.layer(*l)).ok_or("select a layer first")?;
+    match l.source {
+        LayerSource::Solid { .. } | LayerSource::Null | LayerSource::Camera | LayerSource::Light { .. } => Ok(()),
+        _ => Err("this kind of layer has no settings".into()),
+    }
+}
+
+fn with_layer(p: &Value, lid: LayerId) -> Value {
+    let mut p = if p.is_object() { p.clone() } else { json!({}) };
+    p["layer"] = json!(lid.0);
+    p
+}
diff --git a/crates/engine/src/commands/layer_menu.rs b/crates/engine/src/cmd/layer_menu.rs
similarity index 85%
rename from crates/engine/src/commands/layer_menu.rs
rename to crates/engine/src/cmd/layer_menu.rs
index 9cac80412..11a5a3665 100644
--- a/crates/engine/src/commands/layer_menu.rs
+++ b/crates/engine/src/cmd/layer_menu.rs
@@ -61,7 +61,7 @@ fn quality(s: &mut Session, p: &Value) -> Result<Value> {
         q => return Err(bad("layer.quality", format!("quality must be best|draft|wireframe, not `{q}`"))),
     };
     s.edit("Layer Quality", None, |proj, _| {
-        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             l.switches.quality = q;
         }
         Ok(())
@@ -84,7 +84,7 @@ fn sampling(s: &mut Session, p: &Value) -> Result<Value> {
         q => q,
     };
     s.edit("Layer Sampling", None, |proj, _| {
-        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             l.switches.sampling = q;
         }
         Ok(())
@@ -101,7 +101,7 @@ fn frame_blending(s: &mut Session, p: &Value) -> Result<Value> {
         m => return Err(bad("layer.frameBlending", format!("mode must be off|frameMix|pixelMotion, not `{m}`"))),
     };
     s.edit("Frame Blending", None, |proj, _| {
-        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             l.switches.frame_blend = m;
         }
         Ok(())
@@ -114,10 +114,10 @@ fn frame_blending(s: &mut Session, p: &Value) -> Result<Value> {
 fn hide_other_video(s: &mut Session, p: &Value) -> Result<Value> {
     let (cid, ids) = layers_p(s, p)?;
     s.edit("Hide Other Video", None, |proj, _| {
-        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut() {
-            if !ids.contains(&l.id) && (l.source.is_av() || matches!(l.source, LayerSource::Null)) {
-                l.switches.video = false;
-            }
+        // Every layer has a Video switch (nulls, cameras and lights included, as the Timeline's
+        // eye cell shows): the selection stays shown.
+        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut_where(|l| !ids.contains(&l.id)) {
+            l.switches.video = false;
         }
         Ok(())
     })?;
@@ -130,7 +130,7 @@ fn show_all_video(s: &mut Session, p: &Value) -> Result<Value> {
         let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
         // Track mattes stay hidden (their video switch is off by design).
         let mattes: Vec<LayerId> = c.layers.iter().filter_map(|l| l.track_matte.map(|m| m.layer)).collect();
-        for l in c.layers.iter_mut().filter(|l| !mattes.contains(&l.id)) {
+        for l in c.layers.iter_mut_where(|l| !mattes.contains(&l.id)) {
             l.switches.video = true;
         }
         Ok(())
@@ -154,7 +154,7 @@ fn expressions(s: &mut Session, p: &Value) -> Result<Value> {
     let on = b_p(p, "enabled").unwrap_or(true);
     let n = s.edit(if on { "Enable Expressions" } else { "Disable Expressions" }, None, |proj, _| {
         let mut n = 0;
-        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             l.props.walk_mut(&mut |pr| {
                 if let Some(e) = &mut pr.expr {
                     e.enabled = on;
@@ -243,17 +243,80 @@ fn set_transform(s: &mut Session, p: &Value) -> Result<Value> {
 fn center_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     let (cid, ids) = layers_p(s, p)?;
     let ids = super::unlocked(s, cid, ids, "layer.centerAnchor")?;
+    move_anchor(s, cid, &ids, "Center Anchor Point", false, |[x0, y0, x1, y1]| [(x0 + x1) / 2.0, (y0 + y1) / 2.0])
+}
+
+/// The nine points Quick Set Anchor offers, as `(name, column, row)`: column 0 is the left edge
+/// of the layer's content, 2 the right; row 0 the top, 2 the bottom.
+const ANCHOR_POINTS: [(&str, u8, u8); 9] = [
+    ("topLeft", 0, 0),
+    ("top", 1, 0),
+    ("topRight", 2, 0),
+    ("left", 0, 1),
+    ("center", 1, 1),
+    ("right", 2, 1),
+    ("bottomLeft", 0, 2),
+    ("bottom", 1, 2),
+    ("bottomRight", 2, 2),
+];
+
+/// `layer.quickSetAnchor {point, layers?}`: move the Anchor Point of the 2D layers to one of the
+/// nine points of their content (corners, edge midpoints, centre) and shift Position, and every
+/// Position key, so nothing moves on screen. 3D and locked layers, and layers with an animated
+/// (or expression-driven) Anchor Point, Scale or Rotation, an expression on Position, or Auto-Orient
+/// along the path, are skipped; an error when no layer is left or none has content bounds.
+fn quick_set_anchor(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "layer.quickSetAnchor";
+    let name = str_p(p, "point").ok_or_else(|| bad(c, "missing `point`"))?;
+    let (_, col, row) = ANCHOR_POINTS
+        .iter()
+        .copied()
+        .find(|(n, ..)| *n == name)
+        .ok_or_else(|| bad(c, format!("unknown point `{name}`; one of {}", ANCHOR_POINTS.map(|(n, ..)| n).join(", "))))?;
+    let (cid, ids) = layers_p(s, p)?;
+    let ids = super::unlocked(s, cid, ids, c)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    // The anchor is set at the current time and the Position shift is worked out from the current
+    // Anchor Point, Scale and Rotation, so a layer where any of them changes over time would move
+    // at other frames: it is skipped like a 3D one. So is a layer whose Position is expression-
+    // driven (the expression would override the shifted value and the layer would jump), and one
+    // that orients itself along its path (the renderer adds the path direction to Rotation).
+    let changes = |l: &effectcraft_project::Layer| {
+        let Some(tr) = l.transform() else { return false };
+        let moving = ["anchor", "scale", "rotation"].iter().any(|m| tr.get(m).is_some_and(|p| p.is_animated() || p.has_expression()));
+        let driven = ["position", "positionX", "positionY"].iter().any(|m| tr.get(m).is_some_and(|p| p.has_expression()));
+        moving || driven || l.auto_orient == effectcraft_project::AutoOrient::AlongPath
+    };
+    let flat: Vec<LayerId> = ids.into_iter().filter(|id| comp.layer(*id).is_some_and(|l| !l.is_3d() && !changes(l))).collect();
+    if flat.is_empty() {
+        return Err(bad(
+            c,
+            "Quick Set Anchor works on 2D layers whose Anchor Point, Scale and Rotation are not animated, whose Position has no expression and that do not auto-orient along a path",
+        ));
+    }
+    let at = |lo: f64, hi: f64, i: u8| lo + (hi - lo) * f64::from(i) / 2.0;
+    move_anchor(s, cid, &flat, "Quick Set Anchor", true, |[x0, y0, x1, y1]| [at(x0, x1, col), at(y0, y1, row)])
+}
+
+/// Move each layer's Anchor Point to `target(content bounds)` (layer space) and offset Position
+/// by the matching amount, so the layer stays put over its whole animation. Layers without content
+/// bounds (an empty text or shape layer) are left alone; with `strict` it is an error when none of
+/// the layers has any, so the command does not report success for a no-op.
+fn move_anchor(s: &mut Session, cid: ItemId, ids: &[LayerId], label: &str, strict: bool, target: impl Fn([f64; 4]) -> [f64; 2]) -> Result<Value> {
     let t = s.time();
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let ctx = effectcraft_render::EvalCtx::new(&s.project, cid, comp, t);
     let mut centers = vec![];
-    for lid in &ids {
+    for lid in ids {
         let Some(l) = comp.layer(*lid) else { continue };
-        if let Some([x0, y0, x1, y1]) = effectcraft_render::content_bounds(&ctx, l) {
-            centers.push((*lid, [(x0 + x1) / 2.0, (y0 + y1) / 2.0]));
+        if let Some(b) = effectcraft_render::content_bounds(&ctx, l) {
+            centers.push((*lid, target(b)));
         }
     }
-    s.edit("Center Anchor Point", None, |proj, _| {
+    if strict && centers.is_empty() {
+        return Err(bad("layer.quickSetAnchor", "none of the layers has content to anchor to (empty text or shape layers have no bounds)"));
+    }
+    s.edit(label, None, |proj, _| {
         for (lid, c) in &centers {
             let l = layer_mut(proj, cid, *lid)?;
             let lt = l.layer_time(t);
@@ -586,7 +649,7 @@ fn markers_lock(s: &mut Session, p: &Value) -> Result<Value> {
     let r = s.edit("Lock Markers", None, |proj, _| {
         let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
         let target = v.unwrap_or_else(|| !c.layers.iter().find(|l| ids.contains(&l.id)).is_some_and(|l| l.markers_locked));
-        for l in c.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in c.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             l.markers_locked = target;
         }
         Ok(target)
@@ -597,7 +660,7 @@ fn markers_lock(s: &mut Session, p: &Value) -> Result<Value> {
 fn delete_all_markers(s: &mut Session, p: &Value) -> Result<Value> {
     let (cid, ids) = layers_p(s, p)?;
     s.edit("Delete All Markers", None, |proj, _| {
-        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut().filter(|l| ids.contains(&l.id) && !l.markers_locked) {
+        for l in proj.comp_mut(cid).ok_or(EngineError::NoComp)?.layers.iter_mut_where(|l| ids.contains(&l.id) && !l.markers_locked) {
             l.markers.clear();
         }
         Ok(())
@@ -609,6 +672,7 @@ fn delete_all_markers(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn track_matte_op(s: &mut Session, p: &Value) -> Result<Value> {
     let (cid, ids) = layers_p(s, p)?;
+    let ids = super::unlocked(s, cid, ids, "layer.trackMatte")?;
     let op = str_p(p, "op").ok_or_else(|| bad("layer.trackMatte", "missing `op`"))?.to_string();
     let kind = match op.as_str() {
         "alpha" => Some(MatteKind::Alpha),
@@ -708,7 +772,7 @@ const BUNDLE_EXTENSIONS: &[&str] = &[
 /// Whether the system file manager would open folder `dir` as something other than a folder: a
 /// bundle (`Tool.app`), or a Windows folder with a `{CLSID}` extension.
 fn opens_as_bundle(dir: &std::path::Path) -> bool {
-    let ext = dir.extension().and_then(|e| e.to_str()).unwrap_or_default().to_ascii_lowercase();
+    let ext = dir.extension().and_then(std::ffi::OsStr::to_str).unwrap_or_default().to_ascii_lowercase();
     ext.starts_with('{') || BUNDLE_EXTENSIONS.contains(&ext.as_str())
 }
 
@@ -717,6 +781,9 @@ fn opens_as_bundle(dir: &std::path::Path) -> bool {
 /// plain folder after following links, is refused.
 pub(crate) fn reveal_url(s: &Session, stored: &str) -> std::result::Result<String, String> {
     let path = s.stored_path(stored).map_err(|why| crate::doc_path::refusal(stored, why))?;
+    if !s.services.exists(&path.to_string_lossy()) {
+        return Err(format!("Missing footage: {stored}. Use File ▸ Dependencies ▸ Relink Missing Footage or Replace Footage."));
+    }
     let dir = path.parent().filter(|d| !d.as_os_str().is_empty()).ok_or_else(|| format!("{stored} is not in a folder"))?;
     let real = std::fs::canonicalize(dir).map_err(|e| format!("cannot show the folder of {stored}: {e}"))?;
     if !real.is_dir() || opens_as_bundle(dir) || opens_as_bundle(&real) {
@@ -754,17 +821,33 @@ fn reveal_in_finder(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn reveal_source(s: &mut Session, p: &Value) -> Result<Value> {
-    let item = source_item(s, p, "layer.revealSource")?;
-    s.state.project_selection = vec![item];
-    frontend(s, "window.panel", &json!({"panel": "project"}))?;
-    Ok(json!({"item": item.0}))
+    let (cid, ids) = layers_p(s, p)?;
+    let mut items: Vec<ItemId> = Vec::new();
+    {
+        let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+        for layer in ids.iter().filter_map(|id| comp.layer(*id)) {
+            if let Some(item) = layer.source.item()
+                && s.project.item(item).is_some()
+                && !items.contains(&item)
+            {
+                items.push(item);
+            }
+        }
+    }
+    if items.is_empty() {
+        return Err(bad("layer.revealSource", "the selected layers have no source item"));
+    }
+    s.state.project_selection = items.clone();
+    let raw: Vec<u64> = items.iter().map(|item| item.0).collect();
+    frontend(s, "project.reveal", &json!({"items": raw}))?;
+    Ok(json!({"item": items[0].0, "items": raw}))
 }
 
 fn reveal_comp(s: &mut Session, p: &Value) -> Result<Value> {
     let cid = comp_id(s, p)?;
     s.state.project_selection = vec![cid];
-    frontend(s, "window.panel", &json!({"panel": "project"}))?;
-    Ok(json!({"item": cid.0}))
+    frontend(s, "project.reveal", &json!({"items": [cid.0]}))?;
+    Ok(json!({"item": cid.0, "items": [cid.0]}))
 }
 
 impl Session {
@@ -885,6 +968,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_layers,
             center_anchor
         ),
+        cmd!(
+            "layer.quickSetAnchor",
+            "Quick Set Anchor",
+            ["Layer", "Transform", "Quick Set Anchor"],
+            None,
+            "{point: topLeft|top|topRight|left|center|right|bottomLeft|bottom|bottomRight, layers?} → {layers}: moves the Anchor Point of 2D layers to that point of their content and compensates Position (and its keys); skips 3D and locked layers and those with an animated Anchor Point, Scale or Rotation",
+            has_layers,
+            quick_set_anchor
+        ),
         cmd!(
             "layer.mask.shape",
             "Mask Shape...",
@@ -909,7 +1001,7 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("layer.trackMatte", "Track Matte", [], None, "{layers?, op: none|alpha|alphaInverted|luma|lumaInverted|above|below}", has_layers, track_matte_op),
         cmd!("layer.openSource", "Open Layer Source", ["Layer"], None, "{layer?}", has_source_item, open_source),
         cmd!("layer.revealInFinder", "Reveal in Finder", ["Layer"], None, "{layer?}", has_footage_layer, reveal_in_finder),
-        cmd!("layer.revealSource", "Reveal Layer Source in Project", ["Layer", "Reveal"], None, "{layer?}", has_source_item, reveal_source),
+        cmd!("layer.revealSource", "Reveal Layer Source in Project", ["Layer", "Reveal"], None, "{layers?}", has_source_item, reveal_source),
         cmd!("comp.revealInProject", "Reveal Composition in Project", ["Layer", "Reveal"], None, "{comp?}", has_comp, reveal_comp),
         cmd!("layer.revealExpressionErrors", "Reveal Expression Errors", ["Layer", "Reveal"], None, "{comp?}", has_comp, reveal_expression_errors),
         cmd!(
@@ -949,6 +1041,7 @@ mod tests {
         let _ = std::fs::remove_dir_all(&d);
         for f in ["Clips", "Tool.app", "Shell.{20D04FE0-3AEA-1069-A2D8-08002B30309D}"] {
             std::fs::create_dir_all(d.join(f)).unwrap();
+            std::fs::write(d.join(f).join("a.mov"), b"fixture").unwrap();
         }
         let s = crate::Session::default();
         let reveal = |folder: &str| super::reveal_url(&s, &d.join(folder).join("a.mov").to_string_lossy());
diff --git a/crates/engine/src/commands/layer_time.rs b/crates/engine/src/cmd/layer_time.rs
similarity index 93%
rename from crates/engine/src/commands/layer_time.rs
rename to crates/engine/src/cmd/layer_time.rs
index d98bfdea7..b9aef8019 100644
--- a/crates/engine/src/commands/layer_time.rs
+++ b/crates/engine/src/cmd/layer_time.rs
@@ -34,7 +34,7 @@ fn time_stretch(s: &mut Session, p: &Value) -> Result<Value> {
     let fd = comp_rate.frame_duration();
     s.edit(if reverse { "Time-Reverse Layer" } else { "Time Stretch" }, None, |proj, _| {
         let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             let old = l.stretch;
             if reverse {
                 // Keep the in/out points; play the visible span backwards.
@@ -59,9 +59,16 @@ fn time_stretch(s: &mut Session, p: &Value) -> Result<Value> {
                 (None, Some(d)) if span > 0.0 => old * d / span,
                 _ => old,
             };
+            if !new.is_finite() {
+                return Err(bad("layer.timeStretch", "the stretch factor must be a number"));
+            }
             if new.abs() < 1.0 {
                 return Err(bad("layer.timeStretch", "the stretch factor must be at least 1 %"));
             }
+            // After Effects' largest stretch; a project file holds no more either (#3247).
+            if new.abs() > effectcraft_project::limits::MAX_STRETCH {
+                return Err(bad("layer.timeStretch", "the stretch factor must be at most 9900 %"));
+            }
             // The hold point keeps showing the same layer time.
             let h = match hold {
                 "current" => cti,
@@ -109,7 +116,7 @@ fn enable_time_remap(s: &mut Session, p: &Value) -> Result<Value> {
         let mut next = proj.next_id;
         let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
         let mut on = false;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id) && remappable(l)) {
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id) && remappable(l)) {
             let has = l.props.get("timeRemap").is_some();
             let target = want.unwrap_or(!has);
             on |= target;
@@ -185,7 +192,17 @@ fn freeze(s: &mut Session, p: &Value, last: bool) -> Result<Value> {
         return Err(bad("layer.freezeFrame", "freezing needs a footage or composition layer"));
     }
     // What each layer shows now (honouring an existing remap) — evaluated before the edit.
-    let ectx = effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp, time: cti, expr: s.expr.as_deref(), footage: Some(s.footage.as_ref()) };
+    let ectx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: cti,
+        expr: s.expr.as_deref(),
+        footage: Some(s.footage.as_ref()),
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let now: Vec<(effectcraft_project::LayerId, f64)> = comp
         .layers
         .iter()
diff --git a/crates/engine/src/commands/link.rs b/crates/engine/src/cmd/link.rs
similarity index 80%
rename from crates/engine/src/commands/link.rs
rename to crates/engine/src/cmd/link.rs
index 2eeb7c5a0..66145f17e 100644
--- a/crates/engine/src/commands/link.rs
+++ b/crates/engine/src/cmd/link.rs
@@ -102,11 +102,39 @@ fn quote(s: &str) -> String {
 
 /// The AE expression reference to property `uid` of `target` as seen from a property of `from`.
 pub(crate) fn reference(comp: &Comp, from: &Layer, target: &Layer, uid: Uid, compact: bool) -> Option<String> {
+    reference_with(comp, from, target, uid, compact, false)
+}
+
+/// [`reference`], with the properties inside an effect selected by their index (`by_index`, an
+/// Alt pick whip in After Effects): `effect("Color Control")(1)` rather than `("Color")`. The
+/// effect keeps its name. An index is the property's place among its group's children, as an
+/// expression's `(1)` reads it: it follows a renamed parameter, not one moved to another place.
+pub(crate) fn reference_with(comp: &Comp, from: &Layer, target: &Layer, uid: Uid, compact: bool, by_index: bool) -> Option<String> {
     let chain = target.props.node_chain(uid)?;
+    // Each node's one-based index among its group's children, and whether it lies inside an
+    // effect (below the effect itself): those are selected by index with `by_index`.
+    let mut parent = &target.props;
+    let mut depth_in_effects: Option<usize> = None;
+    let mut by_number: Vec<Option<usize>> = vec![];
+    for n in &chain {
+        let at = parent.children.iter().position(|c| c.uid() == n.uid()).map(|i| i + 1);
+        by_number.push(at.filter(|_| by_index && depth_in_effects.is_some_and(|d| d >= 1)));
+        depth_in_effects = match depth_in_effects {
+            Some(d) => Some(d + 1),
+            None => (n.match_id() == "effects").then_some(0),
+        };
+        if let Node::Group(g) = n {
+            parent = g;
+        }
+    }
+    let selector = |i: usize, label: &str| match by_number.get(i).copied().flatten() {
+        Some(at) => format!("({at})"),
+        None => format!("({})", quote(label)),
+    };
     let mut parts: Vec<String> = vec![];
     let mut pending: Option<&str> = None;
     let mut in_effect = false;
-    for n in chain {
+    for (i, n) in chain.iter().copied().enumerate() {
         if let Some(f) = pending.take() {
             parts.push(format!("{f}({})", quote(n.name())));
             in_effect |= f == "effect";
@@ -119,7 +147,7 @@ pub(crate) fn reference(comp: &Comp, from: &Layer, target: &Layer, uid: Uid, com
             (Node::Group(_), "transform") if !in_effect => parts.push("transform".into()),
             (Node::Group(_), "text") if !in_effect => parts.push("text".into()),
             (Node::Prop(_), "sourceText") => parts.push("sourceText".into()),
-            _ if in_effect => parts.push(format!("({})", quote(n.name()))),
+            _ if in_effect => parts.push(selector(i, n.name())),
             _ => parts.push(camel(n.name())),
         }
     }
@@ -127,10 +155,9 @@ pub(crate) fn reference(comp: &Comp, from: &Layer, target: &Layer, uid: Uid, com
     let _ = comp;
     if !compact {
         // Match names: language-independent, like After Effects with Compact English off.
-        let chain = target.props.node_chain(uid)?;
         let mut out = if from.id == target.id { "thisLayer".to_string() } else { format!("thisComp.layer({})", quote(&target.name)) };
-        for n in chain {
-            out.push_str(&format!("({})", quote(n.match_id())));
+        for (i, n) in chain.iter().copied().enumerate() {
+            out.push_str(&selector(i, n.match_id()));
         }
         return Some(out);
     }
@@ -161,7 +188,9 @@ fn pick_whip(s: &mut Session, p: &Value) -> Result<Value> {
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let from = comp.layer(lid).ok_or(EngineError::NoComp)?;
     let target = comp.layer(tl).ok_or(EngineError::NoComp)?;
-    let r = reference(comp, from, target, tu, s.prefs.general.expression_pick_whip_compact).ok_or_else(|| bad("prop.pickWhip", "no such target property"))?;
+    let by_index = b_p(p, "byIndex").unwrap_or(false);
+    let r = reference_with(comp, from, target, tu, s.prefs.general.expression_pick_whip_compact, by_index)
+        .ok_or_else(|| bad("prop.pickWhip", "no such target property"))?;
     let (me, them) = (from.props.find(uid).ok_or(EngineError::NoComp)?, target.props.find(tu).ok_or(EngineError::NoComp)?);
     let (dm, dt) = (dims(from, me), dims(target, them));
     // Dropped on one of the target's values: that dimension (`position[0]`), as in After Effects.
@@ -206,7 +235,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Pick Whip (Link Property)",
             [],
             None,
-            "{layer?, path|prop, target: {layer, path|prop, dimension?}, expression?, range?: [start, end]} → sets an AE reference expression (`dimension`: one of the target's values, `position[0]`; with `expression`: inserts it there, replacing the characters in `range`, default the end)",
+            "{layer?, path|prop, target: {layer, path|prop, dimension?}, expression?, range?: [start, end], byIndex?: bool} → sets an AE reference expression (`dimension`: one of the target's values, `position[0]`; with `expression`: inserts it there, replacing the characters in `range`, default the end; `byIndex`: an effect's properties by their index, `effect(\"Color Control\")(1)`, as an Alt pick whip does)",
             has_layers,
             pick_whip
         ),
diff --git a/crates/engine/src/commands/liquify.rs b/crates/engine/src/cmd/liquify.rs
similarity index 100%
rename from crates/engine/src/commands/liquify.rs
rename to crates/engine/src/cmd/liquify.rs
diff --git a/crates/engine/src/commands/lottie.rs b/crates/engine/src/cmd/lottie.rs
similarity index 96%
rename from crates/engine/src/commands/lottie.rs
rename to crates/engine/src/cmd/lottie.rs
index 03a99b994..288d2e56e 100644
--- a/crates/engine/src/commands/lottie.rs
+++ b/crates/engine/src/cmd/lottie.rs
@@ -8,6 +8,7 @@ use crate::{EngineError, Result, Session, cmd};
 
 fn export_lottie(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_p(p, "path").ok_or_else(|| bad("file.exportLottie", "missing `path`"))?.to_string();
+    s.refuse_export(&path)?;
     let cid = comp_id(s, p)?;
     let opts = ExportOptions { include_expressions: b_p(p, "includeExpressions").unwrap_or(false), text_as_shapes: b_p(p, "textAsShapes").unwrap_or(false) };
     let services = s.services.clone();
@@ -20,7 +21,7 @@ fn export_lottie(s: &mut Session, p: &Value) -> Result<Value> {
     } else {
         res.to_string_compact().into_bytes()
     };
-    s.services.write_file(&path, &bytes).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(&path, &bytes)?;
     let n = res.warnings.len();
     s.toast(if n == 0 { format!("Exported Lottie to {path}") } else { format!("Exported Lottie to {path} ({n} warning{})", if n == 1 { "" } else { "s" }) });
     Ok(json!({"path": path, "bytes": bytes.len(), "warnings": res.warnings}))
diff --git a/crates/engine/src/commands/markers.rs b/crates/engine/src/cmd/markers.rs
similarity index 94%
rename from crates/engine/src/commands/markers.rs
rename to crates/engine/src/cmd/markers.rs
index 4c979619e..3530eaa4b 100644
--- a/crates/engine/src/commands/markers.rs
+++ b/crates/engine/src/cmd/markers.rs
@@ -296,8 +296,9 @@ fn convert(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(Value::Null)
 }
 
-/// Layer ▸ Markers ▸ Update Markers From Source: copy a precomp's composition markers onto the
-/// layer (layer time is the nested comp's time), skipping ones already there.
+/// Layer ▸ Markers ▸ Update Markers From Source: copy a precomp's composition markers, or the
+/// markers a footage file carries (a WAV's cue points), onto the layer (layer time is the source's
+/// time), skipping ones already there.
 fn update_from_source(s: &mut Session, p: &Value) -> Result<Value> {
     let (cid, ids) = layers_p(s, p)?;
     let src: Vec<(LayerId, Vec<Marker>)> = {
@@ -307,13 +308,17 @@ fn update_from_source(s: &mut Session, p: &Value) -> Result<Value> {
                 let l = comp.layer(*id)?;
                 match &l.source {
                     LayerSource::Comp { item } => Some((*id, s.project.comp(*item)?.markers.clone())),
+                    LayerSource::Footage { item } => match &s.project.item(*item)?.kind {
+                        effectcraft_project::ItemKind::Footage(f) => Some((*id, f.markers.clone())),
+                        _ => None,
+                    },
                     _ => None,
                 }
             })
             .collect()
     };
     if src.is_empty() {
-        return Err(bad("layer.updateMarkersFromSource", "select a precomposition layer"));
+        return Err(bad("layer.updateMarkersFromSource", "select a precomposition or footage layer"));
     }
     let n = s.edit("Update Markers From Source", None, |proj, _| {
         let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
@@ -323,8 +328,11 @@ fn update_from_source(s: &mut Session, p: &Value) -> Result<Value> {
             if l.markers_locked {
                 continue;
             }
+            // One set of the times already on the layer: a file with thousands of markers must not
+            // scan the layer's list for each of them.
+            let mut times: std::collections::HashSet<_> = l.markers.iter().map(|x| x.time).collect();
             for m in ms {
-                if !l.markers.iter().any(|x| x.time == m.time) {
+                if times.insert(m.time) {
                     l.markers.push(m.clone());
                     n += 1;
                 }
@@ -339,10 +347,10 @@ fn update_from_source(s: &mut Session, p: &Value) -> Result<Value> {
 fn has_precomp_layer(s: &Session) -> std::result::Result<(), String> {
     has_layers(s)?;
     let c = s.active_comp().ok_or("no composition")?;
-    if s.state.selected_layers.iter().filter_map(|l| c.layer(*l)).any(|l| matches!(l.source, LayerSource::Comp { .. })) {
+    if s.state.selected_layers.iter().filter_map(|l| c.layer(*l)).any(|l| matches!(l.source, LayerSource::Comp { .. } | LayerSource::Footage { .. })) {
         Ok(())
     } else {
-        Err("select a precomposition layer".into())
+        Err("select a precomposition or footage layer".into())
     }
 }
 
diff --git a/crates/engine/src/commands/mask.rs b/crates/engine/src/cmd/mask.rs
similarity index 82%
rename from crates/engine/src/commands/mask.rs
rename to crates/engine/src/cmd/mask.rs
index 778dfb54c..3e4a8a9e4 100644
--- a/crates/engine/src/commands/mask.rs
+++ b/crates/engine/src/cmd/mask.rs
@@ -174,6 +174,10 @@ fn new_mask(s: &mut Session, p: &Value) -> Result<Value> {
         st.selected_vertices = vec![VertexRef { layer: lid, mask: uid, index: n - 1 }];
         Ok(uid)
     })?;
+    s.events.push(crate::Event::Frontend {
+        command: "timeline.revealMask".into(),
+        params: json!({"comp": cid.0, "layer": lid.0, "mask": uid, "projectEpoch": s.script_ui.project_epoch}),
+    });
     Ok(json!({"mask": uid}))
 }
 
@@ -225,6 +229,120 @@ fn set_closed(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!(c))
 }
 
+/// Rebuild a rectangular mask or shape path with corner radius `radius` (layer pixels; 0 gives
+/// square corners). The rectangle is the path's bounding box. Only a plain rectangle (four
+/// corner vertices, straight sides) or a rounded one (eight vertices, straight sides alternating
+/// with circular corners) is reshaped; anything else (an ellipse, a star) is refused. The new path
+/// keeps the old one's start vertex and direction, so the feather points and the other keys of an
+/// animated path still line up; a change between square and rounded corners changes the vertex
+/// count, which is refused when the path is keyed or has feather points.
+fn set_roundness(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "mask.setRoundness";
+    let radius = p.get("roundness").and_then(Value::as_f64).filter(|r| r.is_finite() && *r >= 0.0);
+    let radius = radius.ok_or_else(|| bad(c, "need `roundness`: a corner radius in pixels, 0 or more"))?;
+    let (cid, lid) = layer_p(s, p, c)?;
+    let key = p.get("mask").cloned().ok_or_else(|| bad(c, "missing `mask` (uid, index or name)"))?;
+    let t = s.time();
+    s.edit(c, merge_p(p), |proj, _| {
+        let l = layer_mut(proj, cid, lid)?;
+        let lt = l.layer_time(t);
+        let g = path_group(&mut l.props, &key).ok_or_else(|| bad(c, "no such mask or shape path"))?;
+        let roto = super::paths::is_roto(g);
+        let pr = g.get_mut("path").ok_or_else(|| bad(c, "mask has no path"))?;
+        let KV::Path(mut sp) = pr.value_at(lt) else { return Err(bad(c, "not a path")) };
+        sp.fit_tangents();
+        let (lo, hi) = rect_box(&sp).ok_or_else(|| bad(c, "the path is not a closed rectangle or rounded rectangle"))?;
+        let size = [hi[0] - lo[0], hi[1] - lo[1]];
+        let bez = effectcraft_path::rect(size, [(lo[0] + hi[0]) / 2.0, (lo[1] + hi[1]) / 2.0], radius);
+        let mut new = effectcraft_path::from_kurbo(&bez).into_iter().next().ok_or_else(|| bad(c, "could not rebuild the path"))?;
+        if new.vertices.len() != sp.vertices.len() {
+            if !pr.keys.is_empty() {
+                return Err(bad(c, "the path is keyed: changing between square and rounded corners would change its vertex count"));
+            }
+            if !sp.feather.is_empty() {
+                return Err(bad(c, "the path has feather points: changing between square and rounded corners would change its vertex count"));
+            }
+        }
+        align_like(&mut new, &sp);
+        new.feather = std::mem::take(&mut sp.feather);
+        if roto {
+            super::paths::roto_smooth(&mut new);
+        }
+        pr.set_value_at(lt, KV::Path(new));
+        Ok(())
+    })?;
+    Ok(Value::Null)
+}
+
+/// The bounding box of `sp` when it is a closed plain rectangle (four corner vertices, straight
+/// sides) or rounded rectangle (eight vertices on the box's edges, straight sides along the edges
+/// alternating with circular corners whose two ends are as far apart across as down).
+fn rect_box(sp: &ShapePath) -> Option<([f64; 2], [f64; 2])> {
+    let first = *sp.vertices.first()?;
+    let (mut lo, mut hi) = (first, first);
+    for v in &sp.vertices {
+        lo = [lo[0].min(v[0]), lo[1].min(v[1])];
+        hi = [hi[0].max(v[0]), hi[1].max(v[1])];
+    }
+    let n = sp.vertices.len();
+    if !sp.closed || !(n == 4 || n == 8) || hi[0] <= lo[0] || hi[1] <= lo[1] {
+        return None;
+    }
+    let eps = 1e-9 * (hi[0] - lo[0]).max(hi[1] - lo[1]).max(1.0);
+    let x_edge = |v: [f64; 2]| v[0] == lo[0] || v[0] == hi[0];
+    let y_edge = |v: [f64; 2]| v[1] == lo[1] || v[1] == hi[1];
+    let zero = |t: Option<&[f64; 2]>| t.is_none_or(|t| *t == [0.0, 0.0]);
+    let seg = |i: usize| (sp.vertices[i], sp.vertices[(i + 1) % n]);
+    let straight = |i: usize| {
+        let (a, b) = seg(i);
+        zero(sp.out_tangents.get(i)) && zero(sp.in_tangents.get((i + 1) % n)) && ((a[0] == b[0] && x_edge(a)) || (a[1] == b[1] && y_edge(a)))
+    };
+    let corner = |i: usize| {
+        let (a, b) = seg(i);
+        let (dx, dy) = ((b[0] - a[0]).abs(), (b[1] - a[1]).abs());
+        dx > eps && (dx - dy).abs() <= eps.max(dx * 1e-9) && ((x_edge(a) && y_edge(b)) || (y_edge(a) && x_edge(b)))
+    };
+    let ok = if n == 4 {
+        sp.vertices.iter().all(|v| x_edge(*v) && y_edge(*v)) && (0..n).all(straight)
+    } else {
+        sp.vertices.iter().all(|v| x_edge(*v) || y_edge(*v)) && (0..2).any(|k| (0..n).all(|i| if i % 2 == k { straight(i) } else { corner(i) }))
+    };
+    ok.then_some((lo, hi))
+}
+
+/// Turn the rebuilt closed path `new` so it runs the same way round as `old` and starts at the
+/// vertex nearest `old`'s first one, keeping vertex correspondence for keys and feather points.
+fn align_like(new: &mut ShapePath, old: &ShapePath) {
+    let area = |sp: &ShapePath| {
+        let n = sp.vertices.len();
+        (0..n)
+            .map(|i| {
+                let (a, b) = (sp.vertices[i], sp.vertices[(i + 1) % n]);
+                a[0] * b[1] - b[0] * a[1]
+            })
+            .sum::<f64>()
+    };
+    if (area(new) > 0.0) != (area(old) > 0.0) {
+        // Reverse: vertex order flips and each vertex's in and out tangents swap; keep vertex 0.
+        new.vertices.reverse();
+        std::mem::swap(&mut new.in_tangents, &mut new.out_tangents);
+        new.in_tangents.reverse();
+        new.out_tangents.reverse();
+        let n = new.vertices.len();
+        if n > 0 {
+            new.vertices.rotate_right(1);
+            new.in_tangents.rotate_right(1);
+            new.out_tangents.rotate_right(1);
+        }
+    }
+    let Some(o) = old.vertices.first() else { return };
+    let d = |v: &[f64; 2]| (v[0] - o[0]).powi(2) + (v[1] - o[1]).powi(2);
+    let start = new.vertices.iter().enumerate().min_by(|a, b| d(a.1).total_cmp(&d(b.1))).map_or(0, |(i, _)| i);
+    new.vertices.rotate_left(start);
+    new.in_tangents.rotate_left(start);
+    new.out_tangents.rotate_left(start);
+}
+
 /// Selected (or given) vertices grouped per (layer, mask).
 fn vertex_groups(s: &Session, p: &Value) -> Result<std::collections::BTreeMap<(u64, Uid), Vec<usize>>> {
     let comp = s.active_comp().ok_or(EngineError::NoComp)?;
@@ -645,6 +763,7 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("mask.addVertex", "Add Mask Vertex", [], None, "{layer?, mask, point: [x,y], in?, out?, index?}", has_layers, add_vertex),
         cmd!("mask.setVertex", "Set Mask Vertex", [], None, "{layer?, mask, index, point?, in?, out?, merge?}", has_layers, set_vertex),
         cmd!("mask.setClosed", "Closed", ["Layer", "Mask and Shape Path"], None, "{layer?, mask, closed?}", has_layers, set_closed),
+        cmd!("mask.setRoundness", "Set Mask Roundness", [], None, "{layer?, mask, roundness (corner radius in px; 0 = square)}", has_layers, set_roundness),
         cmd!("mask.selectVertices", "Select Mask Vertices", [], None, "{vertices: [{layer, mask, index}], add?, toggle?}", has_comp, select_vertices),
         cmd!("mask.moveVertices", "Move Mask Vertices", [], None, "{vertices?: [{layer, mask, index}], delta: [dx,dy], merge?}", has_vertices, move_vertices),
         cmd!("mask.deleteVertices", "Delete Mask Vertices", [], None, "{vertices?}", has_vertices, delete_vertices),
diff --git a/crates/engine/src/commands/mask_interp.rs b/crates/engine/src/cmd/mask_interp.rs
similarity index 97%
rename from crates/engine/src/commands/mask_interp.rs
rename to crates/engine/src/cmd/mask_interp.rs
index 982468c8e..ed7ed5190 100644
--- a/crates/engine/src/commands/mask_interp.rs
+++ b/crates/engine/src/cmd/mask_interp.rs
@@ -289,6 +289,7 @@ fn extract_face(s: &mut Session, p: &Value) -> Result<Value> {
         clip.push(crate::KeyClip { layer: lid, path, keys });
     }
     s.state.key_clipboard = clip;
+    s.state.keyframe_text = None;
     s.state.clip_is_keys = true;
     // The same data as text (tab-separated, one row per frame) for other applications.
     let mut text = String::from("EffectCraft Face Measurements\n\nFrame\tTime");
@@ -437,20 +438,22 @@ fn interpolate(s: &mut Session, p: &Value) -> Result<Value> {
     // The layer: given, else the layer of selected Mask Path keys, else the selection.
     let cid = super::comp_id(s, p)?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let selected = super::prop::editable_keys(comp, &s.state.selected_keys);
     let lid = match p.get("layer") {
         Some(v) => super::resolve_layer(comp, v).ok_or_else(|| bad(CMD, format!("no layer {v}")))?,
-        None => match s.state.selected_keys.iter().find(|k| comp.layer(k.layer).is_some_and(|l| l.masks().is_some_and(|m| m.find(k.prop).is_some()))) {
+        None => match selected.iter().find(|k| comp.layer(k.layer).is_some_and(|l| l.masks().is_some_and(|m| m.find(k.prop).is_some()))) {
             Some(k) => k.layer,
             None => layer_p(s, p, CMD)?.1,
         },
     };
     let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
+    if !super::prop::key_layer_editable(comp, lid) {
+        return Err(bad(CMD, "the layer is locked"));
+    }
     let masks = layer.masks().ok_or_else(|| bad(CMD, "the layer has no masks"))?;
     let uid = match p.get("mask") {
         Some(_) => mask_uid(s, layer, p),
-        None => s
-            .state
-            .selected_keys
+        None => selected
             .iter()
             .filter(|k| k.layer == lid)
             .find_map(|k| masks.groups().find(|g| g.get("path").is_some_and(|pr| pr.uid == k.prop)).map(|g| g.uid))
@@ -465,7 +468,7 @@ fn interpolate(s: &mut Session, p: &Value) -> Result<Value> {
             let ts: Vec<Tick> = a.iter().filter_map(Value::as_f64).map(|t| layer.layer_time(comp.frame_rate.snap_nearest(Tick::from_seconds_f64(t)))).collect();
             ts.into_iter().filter_map(|t| path_prop.keys.iter().find(|k| (k.time.0 - t.0).abs() <= comp.frame_duration().0 / 2).map(|k| k.time)).collect()
         }
-        None => s.state.selected_keys.iter().filter(|k| k.layer == lid && k.prop == path_prop.uid).map(|k| k.time).collect(),
+        None => selected.iter().filter(|k| k.layer == lid && k.prop == path_prop.uid).map(|k| k.time).collect(),
     };
     times.sort();
     times.dedup();
diff --git a/crates/engine/src/commands/model3d.rs b/crates/engine/src/cmd/model3d.rs
similarity index 79%
rename from crates/engine/src/commands/model3d.rs
rename to crates/engine/src/cmd/model3d.rs
index 28b7274ef..37a70db00 100644
--- a/crates/engine/src/commands/model3d.rs
+++ b/crates/engine/src/cmd/model3d.rs
@@ -64,6 +64,12 @@ fn comp_renderer(s: &mut Session, p: &Value) -> Result<Value> {
     if r == Renderer::Classic3D && s.project.comp(cid).is_some_and(|c| c.layers.iter().any(|l| l.source.is_model())) {
         s.toast("Classic 3D doesn't draw 3D model layers: they show with the Advanced 3D renderer");
     }
+    if r == Renderer::Classic3D {
+        let env = |l: &Layer| matches!(l.source, LayerSource::Light { kind: effectcraft_project::LightKind::Environment });
+        if s.project.comp(cid).is_some_and(|c| c.layers.iter().any(env)) {
+            s.toast("Classic 3D doesn't light Environment light layers: they light with the Advanced 3D renderer");
+        }
+    }
     Ok(json!({"renderer": renderer_id(r)}))
 }
 
@@ -77,7 +83,7 @@ fn renderer_id(r: Renderer) -> &'static str {
 /// Only the Advanced 3D renderer draws model and primitive layers, so adding one switches a
 /// Classic 3D comp to it, like After Effects (inside the adding edit: one undo step). Whether
 /// the renderer changed.
-fn use_advanced_3d(proj: &mut effectcraft_project::Project, cid: ItemId) -> Result<bool> {
+pub(crate) fn use_advanced_3d(proj: &mut effectcraft_project::Project, cid: ItemId) -> Result<bool> {
     let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
     let switched = c.renderer != Renderer::Advanced3D;
     c.renderer = Renderer::Advanced3D;
@@ -86,10 +92,10 @@ fn use_advanced_3d(proj: &mut effectcraft_project::Project, cid: ItemId) -> Resu
 }
 
 /// Tell the user when [`use_advanced_3d`] changed the comp's renderer.
-fn report_switch(s: &mut Session, cid: ItemId, switched: bool) {
+pub(crate) fn report_switch(s: &mut Session, cid: ItemId, switched: bool, why: &str) {
     if switched {
         let name = s.project.item(cid).map_or("the composition", |i| i.name.as_str()).to_string();
-        s.toast(format!("\"{name}\" now uses the Advanced 3D renderer, which draws 3D models"));
+        s.toast(format!("\"{name}\" now uses the Advanced 3D renderer, {why}"));
     }
 }
 
@@ -156,7 +162,7 @@ pub(crate) fn new_model(s: &mut Session, p: &Value) -> Result<Value> {
         let id = insert_layer_at(proj, st, cid, l, index)?;
         Ok((id, use_advanced_3d(proj, cid)?))
     })?;
-    report_switch(s, cid, switched);
+    report_switch(s, cid, switched, "which draws 3D models");
     Ok(json!({"layer": id.0, "item": item.0, "advanced3d": true}))
 }
 
@@ -165,9 +171,29 @@ fn kind_p(p: &Value, cmd: &str) -> Result<PrimitiveKind> {
     PrimitiveKind::parse(k).ok_or_else(|| bad(cmd, format!("kind: cube|sphere|plane|torus|cone|cylinder, not `{k}`")))
 }
 
-/// Parse Material Options parameters onto a layer at comp time `t`.
-fn apply_material(l: &mut Layer, p: &Value, t: Tick, cmd: &str) -> Result<usize> {
-    let mut n = 0;
+/// The Material Options parameters [`apply_material`] reads. Which ones a layer has depends on
+/// its kind (see [`material_mismatch`]).
+const MATERIAL_PARAMS: [&str; 14] = [
+    "castsShadows",
+    "acceptsShadows",
+    "acceptsLights",
+    "appearsInReflections",
+    "baseColor",
+    "metallic",
+    "roughness",
+    "emissive",
+    "lightTransmission",
+    "ambient",
+    "diffuse",
+    "specularIntensity",
+    "specularShininess",
+    "metal",
+];
+
+/// Parse Material Options parameters onto a layer at comp time `t`. The parameters the layer
+/// had a property for.
+fn apply_material(l: &mut Layer, p: &Value, t: Tick, cmd: &str) -> Result<Vec<&'static str>> {
+    let mut set = Vec::new();
     let tri = |v: &Value| -> Option<u32> {
         match v {
             Value::Bool(b) => Some(*b as u32),
@@ -181,28 +207,55 @@ fn apply_material(l: &mut Layer, p: &Value, t: Tick, cmd: &str) -> Result<usize>
             _ => None,
         }
     };
+    let mut put = |l: &mut Layer, k: &'static str, v: KV| {
+        if set_at(l, &format!("materialOptions/{k}"), t, v) {
+            set.push(k);
+        }
+    };
     for k in ["castsShadows", "acceptsShadows"] {
         if let Some(v) = p.get(k) {
             let e = tri(v).ok_or_else(|| bad(cmd, format!("{k}: off|on|only")))?;
-            n += set_at(l, &format!("materialOptions/{k}"), t, KV::Enum(e)) as usize;
+            put(l, k, KV::Enum(e));
         }
     }
+    // A value of the wrong type is an error, not a parameter left out.
     for k in ["acceptsLights", "appearsInReflections"] {
-        if let Some(v) = b_p(p, k) {
-            n += set_at(l, &format!("materialOptions/{k}"), t, KV::Bool(v)) as usize;
+        if p.get(k).is_some() {
+            let v = b_p(p, k).ok_or_else(|| bad(cmd, format!("{k}: true|false")))?;
+            put(l, k, KV::Bool(v));
         }
     }
     for k in ["lightTransmission", "ambient", "diffuse", "specularIntensity", "specularShininess", "metal", "metallic", "roughness"] {
-        if let Some(v) = f_p(p, k) {
-            n += set_at(l, &format!("materialOptions/{k}"), t, KV::Scalar(v)) as usize;
+        if p.get(k).is_some() {
+            let v = f_p(p, k).ok_or_else(|| bad(cmd, format!("{k}: a number")))?;
+            put(l, k, KV::Scalar(v));
         }
     }
     for k in ["baseColor", "emissive"] {
-        if let Some(c) = color_p(p, k) {
-            n += set_at(l, &format!("materialOptions/{k}"), t, KV::Color([c[0] as f64, c[1] as f64, c[2] as f64, 1.0])) as usize;
+        if p.get(k).is_some() {
+            let c = color_p(p, k).ok_or_else(|| bad(cmd, format!("{k}: \"#rrggbb\" or [r, g, b]")))?;
+            put(l, k, KV::Color([c[0] as f64, c[1] as f64, c[2] as f64, 1.0]));
         }
     }
-    Ok(n)
+    Ok(set)
+}
+
+/// The error for Material Options parameters `missing` that none of the layers has: what the
+/// first layer has instead, and which layers the missing ones belong to.
+fn material_mismatch(l: Option<&Layer>, missing: &[&str]) -> EngineError {
+    let names = missing.iter().map(|k| format!("`{k}`")).collect::<Vec<_>>().join(", ");
+    let Some(l) = l else { return bad("material.set", format!("no layer has {names}")) };
+    let Some(g) = l.props.sub("materialOptions") else { return bad("material.set", format!("`{}` has no Material Options, so it has no {names}", l.name)) };
+    let has: Vec<&str> = g.children.iter().map(|c| c.match_id()).collect();
+    let why = if matches!(l.source, LayerSource::Model { .. }) { ": a 3D model layer keeps its model file's materials" } else { "" };
+    bad(
+        "material.set",
+        format!(
+            "`{}` has no {names}{why}. Its Material Options: {}. baseColor, metallic, roughness and emissive are for 3D primitive layers; lightTransmission, ambient, diffuse, specularIntensity, specularShininess and metal for footage, solid, text, shape and precomp layers",
+            l.name,
+            has.join(", ")
+        ),
+    )
 }
 
 fn new_primitive(s: &mut Session, p: &Value) -> Result<Value> {
@@ -226,7 +279,7 @@ fn new_primitive(s: &mut Session, p: &Value) -> Result<Value> {
         let id = insert_layer(proj, st, cid, l)?;
         Ok((id, use_advanced_3d(proj, cid)?))
     })?;
-    report_switch(s, cid, switched);
+    report_switch(s, cid, switched, "which draws 3D models");
     Ok(json!({"layer": id.0, "kind": kind.label(), "advanced3d": true}))
 }
 
@@ -267,19 +320,22 @@ fn material_set(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
     let t = super::time_p(s, p, Some(&comp));
-    let n = s.edit("Material Options", None, |proj, _| {
-        let mut n = 0;
-        for id in &ids {
-            n += apply_material(layer_mut(proj, cid, *id)?, p, t, "material.set")?;
-        }
-        Ok(n)
-    })?;
-    if n == 0 {
-        return Err(bad(
-            "material.set",
-            "no Material Options property matched (castsShadows, acceptsShadows, acceptsLights, baseColor, metallic, roughness, …)",
-        ));
+    if !MATERIAL_PARAMS.iter().any(|k| p.get(*k).is_some()) {
+        return Err(bad("material.set", format!("no Material Options parameter given ({})", MATERIAL_PARAMS.join(", "))));
     }
+    // A parameter none of the layers has fails the whole command (the edit is dropped), so
+    // it is never skipped without a word.
+    let n = s.edit("Material Options", None, |proj, _| {
+        let mut set = Vec::new();
+        for id in &ids {
+            set.extend(apply_material(layer_mut(proj, cid, *id)?, p, t, "material.set")?);
+        }
+        let missing: Vec<&str> = MATERIAL_PARAMS.into_iter().filter(|k| p.get(*k).is_some() && !set.contains(k)).collect();
+        if !missing.is_empty() {
+            return Err(material_mismatch(ids.first().and_then(|id| proj.comp(cid)?.layer(*id)), &missing));
+        }
+        Ok(set.len())
+    })?;
     Ok(json!({"set": n}))
 }
 
@@ -405,7 +461,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Material Options",
             [],
             None,
-            "{layers?, castsShadows?: off|on|only, acceptsShadows?: off|on|only, acceptsLights?, appearsInReflections?, lightTransmission?, ambient?, diffuse?, specularIntensity?, specularShininess?, metal?, baseColor?, metallic?, roughness?, emissive?, time?}",
+            "{layers?, time?, castsShadows?: off|on|only, acceptsShadows?: off|on|only, acceptsLights?, appearsInReflections? (model and primitive layers), baseColor?, metallic?, roughness?, emissive? (primitive layers; a model layer keeps its file's materials), lightTransmission?, ambient?, diffuse?, specularIntensity?, specularShininess?, metal? (footage, solid, text, shape and precomp layers)}; a parameter none of the layers has is an error",
             has_layers,
             material_set
         ),
diff --git a/crates/engine/src/commands/nav_more.rs b/crates/engine/src/cmd/nav_more.rs
similarity index 92%
rename from crates/engine/src/commands/nav_more.rs
rename to crates/engine/src/cmd/nav_more.rs
index d008d1ef6..18165bf48 100644
--- a/crates/engine/src/commands/nav_more.rs
+++ b/crates/engine/src/cmd/nav_more.rs
@@ -39,6 +39,18 @@ fn deselect_keys(s: &mut Session, _: &Value) -> Result<Value> {
     Ok(Value::Null)
 }
 
+impl Session {
+    /// The selected mask (its group, or a property inside it) of a selected layer, the first
+    /// one: (layer, mask group).
+    pub fn selected_mask(&self) -> Option<(effectcraft_project::LayerId, effectcraft_project::Uid)> {
+        let comp = self.active_comp()?;
+        self.state.selected_props.iter().find_map(|(lid, uid)| {
+            let masks = comp.layer(*lid)?.masks()?;
+            masks.groups().find(|g| g.uid == *uid || g.find_group(*uid).is_some() || g.find(*uid).is_some()).map(|g| (*lid, g.uid))
+        })
+    }
+}
+
 /// Alt+` / Alt+Shift+`: select the next (previous) mask of the layer, wrapping around; the first
 /// (last) one when none is selected.
 fn step_mask(s: &mut Session, p: &Value, dir: i64) -> Result<Value> {
diff --git a/crates/engine/src/commands/paint.rs b/crates/engine/src/cmd/paint.rs
similarity index 99%
rename from crates/engine/src/commands/paint.rs
rename to crates/engine/src/cmd/paint.rs
index 73f600b56..c02a1849d 100644
--- a/crates/engine/src/commands/paint.rs
+++ b/crates/engine/src/cmd/paint.rs
@@ -107,7 +107,7 @@ impl Default for PaintOptions {
 }
 
 fn norm(s: &str) -> String {
-    s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase()
+    s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase()
 }
 
 /// Index of `v` in `names` (by number or case/space-insensitive name).
diff --git a/crates/engine/src/commands/panels_cmds.rs b/crates/engine/src/cmd/panels_cmds.rs
similarity index 98%
rename from crates/engine/src/commands/panels_cmds.rs
rename to crates/engine/src/cmd/panels_cmds.rs
index 40241e6f4..95bc57c3c 100644
--- a/crates/engine/src/commands/panels_cmds.rs
+++ b/crates/engine/src/cmd/panels_cmds.rs
@@ -1,4 +1,4 @@
-//! Commands behind the Progress, Media Browser, Metadata and Lumetri Scopes panels.
+//! Commands behind the Progress, Media Browser, Metadata and Video Scopes panels.
 
 use effectcraft_project::ItemId;
 use effectcraft_raster::Image;
@@ -159,7 +159,7 @@ fn project_comment(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(Value::Null)
 }
 
-// ---------------------------------------------------------------- Lumetri Scopes
+// ---------------------------------------------------------------- Video Scopes
 
 /// The comp frame the scopes read (the viewer's image: over the comp background), at most
 /// `max_side` pixels on the long side.
@@ -257,7 +257,7 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("project.setProjectComment", "Project Comment", [], None, "{comment}", always, project_comment),
         query!(
             "scopes.analyze",
-            "Lumetri Scopes",
+            "Video Scopes",
             "{comp?, time?|frame?, scope?: waveformRgb|waveformLuma|waveformYc|vectorscopeYuv|vectorscopeHls|histogram|paradeRgb|paradeYuv, standard?: rec601|rec709|rec2020, float?, clamp?, size?}",
             scopes_analyze
         ),
diff --git a/crates/engine/src/cmd/params.rs b/crates/engine/src/cmd/params.rs
new file mode 100644
index 000000000..2929d3347
--- /dev/null
+++ b/crates/engine/src/cmd/params.rs
@@ -0,0 +1,210 @@
+use super::{Comp, EngineError, ItemId, Layer, LayerId, Result, Session, Tick, Value};
+
+/// Hand a frontend-only command to the UI ([`crate::Event::Frontend`]).
+pub(crate) fn frontend(s: &mut Session, id: &str, p: &Value) -> Result<Value> {
+    s.events.push(crate::Event::Frontend { command: id.to_string(), params: p.clone() });
+    Ok(serde_json::json!({"frontend": id}))
+}
+
+/// Match path of a node (`transform/position`, `effects/#2/blurriness` style with `match#n`
+/// occurrences) so it can be found again on another layer.
+pub fn match_path_of(g: &effectcraft_project::PropGroup, uid: effectcraft_project::Uid) -> Option<String> {
+    for c in &g.children {
+        let nth = g.children.iter().take_while(|x| !std::ptr::eq(*x, c)).filter(|x| x.match_id() == c.match_id()).count() + 1;
+        let seg = if nth == 1 { c.match_id().to_string() } else { format!("{}#{nth}", c.match_id()) };
+        if c.uid() == uid {
+            return Some(seg);
+        }
+        if let effectcraft_project::Node::Group(sub) = c
+            && let Some(rest) = match_path_of(sub, uid)
+        {
+            return Some(format!("{seg}/{rest}"));
+        }
+    }
+    None
+}
+
+/// Turn `effects/<match name>[#n]/<property>` (as [`match_path_of`] writes it) into a uid path on
+/// `l`. Path parsing splits on `.`, which would cut a match name like `ec.control.slider` apart.
+/// Any other path, or an effect that is not on the layer, comes back unchanged.
+pub(crate) fn resolve_effect_path(l: &Layer, path: &str) -> String {
+    let Some((seg, tail)) = path.strip_prefix("effects/").and_then(|r| r.split_once('/')) else { return path.to_string() };
+    let (match_id, nth) = match seg.rsplit_once('#') {
+        Some((m, n)) if !m.is_empty() => match n.parse::<usize>() {
+            Ok(n) if n >= 1 => (m, n),
+            _ => (seg, 1),
+        },
+        _ => (seg, 1),
+    };
+    match l.effects().and_then(|fx| fx.groups().filter(|g| g.match_id == match_id).nth(nth - 1)) {
+        Some(g) => format!("effects/@{}/{tail}", g.uid),
+        None => path.to_string(),
+    }
+}
+
+/// Selected properties (leaves) of the active comp as (layer, uid); selected groups expand to
+/// their properties.
+pub(crate) fn selected_leaf_props(s: &Session) -> Vec<(LayerId, effectcraft_project::Uid)> {
+    let Some(comp) = s.active_comp() else { return vec![] };
+    let mut out = vec![];
+    for (lid, uid) in &s.state.selected_props {
+        let Some(l) = comp.layer(*lid) else { continue };
+        if l.props.find(*uid).is_some() {
+            out.push((*lid, *uid));
+        } else if let Some(g) = l.props.find_group(*uid) {
+            g.walk("", &mut |_, p| out.push((*lid, p.uid)));
+        }
+    }
+    out
+}
+
+/// A popup's `[{value, label}]`, as `effect.list`, `prop.get` and `layer.tree` report it.
+/// Engine/MCP popup values are zero-based; JSX exposes one-based values.
+pub(crate) fn popup_options(options: &[String]) -> Value {
+    serde_json::json!(options.iter().enumerate().map(|(value, label)| serde_json::json!({"value": value, "label": label})).collect::<Vec<_>>())
+}
+
+// ---------- params ----------
+
+pub(crate) fn bad(cmd: &str, msg: impl Into<String>) -> EngineError {
+    EngineError::BadParams { cmd: cmd.into(), msg: msg.into() }
+}
+
+pub(crate) fn str_p<'a>(p: &'a Value, k: &str) -> Option<&'a str> {
+    p.get(k).and_then(Value::as_str)
+}
+
+pub(crate) fn f_p(p: &Value, k: &str) -> Option<f64> {
+    p.get(k).and_then(Value::as_f64)
+}
+
+pub(crate) fn b_p(p: &Value, k: &str) -> Option<bool> {
+    p.get(k).and_then(Value::as_bool)
+}
+
+pub(crate) fn merge_p(p: &Value) -> Option<&str> {
+    str_p(p, "merge")
+}
+
+/// `comp`: item id or name (an all-digit string that names no comp is taken as an id, as MCP
+/// clients often send numbers as strings); default the active comp.
+pub(crate) fn comp_id(s: &Session, p: &Value) -> Result<ItemId> {
+    let missing = |v: &Value| EngineError::NoSuchComp(v.to_string());
+    match p.get("comp") {
+        Some(v @ Value::Number(n)) => n.as_u64().map(ItemId).filter(|id| s.project.comp(*id).is_some()).ok_or_else(|| missing(v)),
+        Some(v @ Value::String(name)) => s
+            .project
+            .items
+            .values()
+            .find(|i| &i.name == name && i.as_comp().is_some())
+            .map(|i| i.id)
+            .or_else(|| digits_id(name).map(ItemId).filter(|id| s.project.comp(*id).is_some()))
+            .ok_or_else(|| missing(v)),
+        _ => s.active_comp_id().ok_or(EngineError::NoComp),
+    }
+}
+
+/// An all-ASCII-digit string as a number (`"98"` -> 98); anything else (names, `#n`, signs) is `None`.
+fn digits_id(s: &str) -> Option<u64> {
+    if s.is_empty() || !s.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    s.parse().ok()
+}
+
+/// Resolve a layer reference: id (number), `#n` / index (1-based), or name. An all-digit string
+/// that names no layer is resolved as the number it spells.
+pub(crate) fn resolve_layer(comp: &Comp, v: &Value) -> Option<LayerId> {
+    match v {
+        Value::Number(n) => {
+            let id = n.as_u64()?;
+            if comp.layer(LayerId(id)).is_some() { Some(LayerId(id)) } else { comp.layers.get((id as usize).checked_sub(1)?).map(|l| l.id) }
+        }
+        Value::String(s) => {
+            if let Some(i) = s.strip_prefix('#').and_then(|i| i.parse::<usize>().ok()) {
+                return comp.layers.get(i.checked_sub(1)?).map(|l| l.id);
+            }
+            comp.layers.iter().find(|l| &l.name == s).map(|l| l.id).or_else(|| digits_id(s).and_then(|id| resolve_layer(comp, &Value::from(id))))
+        }
+        _ => None,
+    }
+}
+
+/// `layer` param or the first selected layer.
+pub(crate) fn layer_p(s: &Session, p: &Value, cmd: &str) -> Result<(ItemId, LayerId)> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    if let Some(v) = p.get("layer") {
+        return resolve_layer(comp, v).map(|l| (cid, l)).ok_or_else(|| bad(cmd, format!("no layer {v}")));
+    }
+    s.state
+        .selected_layers
+        .first()
+        .copied()
+        .filter(|l| comp.layer(*l).is_some())
+        .map(|l| (cid, l))
+        .ok_or_else(|| bad(cmd, "no `layer` given and no layer selected"))
+}
+
+/// `layers` param (array) or the selection.
+pub(crate) fn layers_p(s: &Session, p: &Value) -> Result<(ItemId, Vec<LayerId>)> {
+    layers_or(s, p, &s.state.selected_layers)
+}
+
+/// `layers` param (array), else `layer`, else those of `fallback` still in the comp.
+pub(crate) fn layers_or(s: &Session, p: &Value, fallback: &[LayerId]) -> Result<(ItemId, Vec<LayerId>)> {
+    let cid = comp_id(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    // Explicit references that match no layer are an error (agents otherwise get a silent no-op).
+    let resolve =
+        |v: &Value| resolve_layer(comp, v).ok_or_else(|| EngineError::Other(format!("no layer {v} (use a layer id, \"#n\" or a name from comp.info)")));
+    if let Some(Value::Array(a)) = p.get("layers") {
+        return Ok((cid, a.iter().map(resolve).collect::<Result<_>>()?));
+    }
+    if let Some(v) = p.get("layer").filter(|v| !v.is_null()) {
+        return Ok((cid, vec![resolve(v)?]));
+    }
+    Ok((cid, fallback.iter().copied().filter(|l| comp.layer(*l).is_some()).collect()))
+}
+
+/// Whether a layer can be picked by the user (Select All, Ctrl+Up/Down, a Timeline click): not
+/// locked, and not hidden by the composition's Hide Shy Layers.
+pub(crate) fn selectable(comp: &Comp, l: &Layer) -> bool {
+    !(l.switches.locked || (comp.hide_shy && l.switches.shy))
+}
+
+/// The layers of `ids` a command may edit: locked layers are left alone, as in After Effects.
+/// An error when every one of them is locked.
+pub(crate) fn unlocked(s: &Session, cid: ItemId, ids: Vec<LayerId>, cmd: &str) -> Result<Vec<LayerId>> {
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let locked = |id: &LayerId| comp.layer(*id).is_some_and(|l| l.switches.locked);
+    match ids.iter().find(|id| locked(id)) {
+        Some(first) if ids.iter().all(locked) => {
+            let name = comp.layer(*first).map(|l| l.name.clone()).unwrap_or_default();
+            Err(bad(cmd, format!("“{name}” is locked (Layer ▸ Switches ▸ Unlock All Layers)")))
+        }
+        _ => Ok(ids.into_iter().filter(|id| !locked(id)).collect()),
+    }
+}
+
+/// `visible: [{layer, prop}]`: the properties the Timeline shows (J / K and Select All
+/// Keyframes use only those, as in After Effects). `None` when not given.
+pub(crate) fn visible_p(p: &Value) -> Option<Vec<(LayerId, effectcraft_project::Uid)>> {
+    let a = p.get("visible")?.as_array()?;
+    Some(a.iter().filter_map(|v| Some((LayerId(v.get("layer")?.as_u64()?), v.get("prop")?.as_u64()?))).collect())
+}
+
+/// `time` (seconds) or `frame` param, else the CTI.
+pub(crate) fn time_p(s: &Session, p: &Value, comp: Option<&Comp>) -> Tick {
+    if let Some(t) = f_p(p, "time") {
+        return Tick::from_seconds_f64(t);
+    }
+    if let (Some(f), Some(c)) = (p.get("frame").and_then(Value::as_i64), comp) {
+        return c.frame_rate.tick_of(f);
+    }
+    s.time()
+}
+
+pub(crate) fn layer_mut(p: &mut effectcraft_project::Project, cid: ItemId, lid: LayerId) -> Result<&mut Layer> {
+    p.comp_mut(cid).ok_or(EngineError::NoComp)?.layer_mut(lid).ok_or(EngineError::Project(effectcraft_project::ProjectError::NoLayer(lid)))
+}
diff --git a/crates/engine/src/commands/path_nulls.rs b/crates/engine/src/cmd/path_nulls.rs
similarity index 94%
rename from crates/engine/src/commands/path_nulls.rs
rename to crates/engine/src/cmd/path_nulls.rs
index bb74ee77c..6da43afde 100644
--- a/crates/engine/src/commands/path_nulls.rs
+++ b/crates/engine/src/cmd/path_nulls.rs
@@ -73,12 +73,24 @@ struct PathInfo {
     span: (f64, f64),
 }
 
+/// Reads a mask or shape path at the current time and returns its comp-space vertices, value, expression reference and layer name.
+/// Errors when the property is missing, is not a path or has no vertices.
 fn info(s: &Session, cid: ItemId, lid: LayerId, uid: Uid, cmd: &str) -> Result<PathInfo> {
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
     let pr = layer.props.find(uid).ok_or_else(|| bad(cmd, "no such property"))?;
     let t = s.time();
-    let ctx = effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp, time: t, expr: s.expr.as_deref(), footage: Some(s.footage.as_ref()) };
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: s.expr.as_deref(),
+        footage: Some(s.footage.as_ref()),
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let KV::Path(path) = ctx.value(layer, pr) else { return Err(bad(cmd, "that property is not a path")) };
     if path.vertices.is_empty() {
         return Err(bad(cmd, "the path has no vertices"));
@@ -147,8 +159,17 @@ fn pin_targets(s: &Session, p: &Value, cmd: &str) -> Result<Option<(ItemId, Vec<
     };
     let cid = pins.first().map(|x| x.0).ok_or_else(|| bad(cmd, "no puppet pins"))?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let ctx =
-        effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp, time: s.time(), expr: s.expr.as_deref(), footage: Some(s.footage.as_ref()) };
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: s.time(),
+        expr: s.expr.as_deref(),
+        footage: Some(s.footage.as_ref()),
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let mut out = vec![];
     for (_, lid, uid) in pins {
         let Some(layer) = comp.layer(lid) else { continue };
diff --git a/crates/engine/src/commands/paths.rs b/crates/engine/src/cmd/paths.rs
similarity index 88%
rename from crates/engine/src/commands/paths.rs
rename to crates/engine/src/cmd/paths.rs
index 96767d967..8364f67ec 100644
--- a/crates/engine/src/commands/paths.rs
+++ b/crates/engine/src/cmd/paths.rs
@@ -5,10 +5,11 @@
 use effectcraft_keyframe::{ShapePath, Value as KV};
 use effectcraft_project::build::{self, Ids};
 use effectcraft_project::{FeatherFalloff, GroupKind, ItemId, LayerId, LayerSource, MaskMotionBlur, Node, PropGroup, Uid};
+use effectcraft_render::EvalCtx;
 use serde_json::{Value, json};
 
 use super::layer_menu::target_masks;
-use super::{CommandSpec, b_p, bad, f_p, has_comp, has_layers, layer_mut, layer_p, str_p};
+use super::{CommandSpec, b_p, bad, f_p, has_comp, has_layers, layer_mut, layer_p, merge_p, str_p};
 use crate::{EngineError, Result, Session, VertexRef, cmd};
 
 // ---------------------------------------------------------------- RotoBezier
@@ -111,26 +112,38 @@ fn roto_bezier(s: &mut Session, p: &Value) -> Result<Value> {
 /// The parametric shape paths that Convert To Bezier Path replaces with an editable path.
 const PARAMETRIC: [&str; 3] = ["rect", "ellipse", "star"];
 
-/// The path a parametric shape group draws, in the group's own space, read at `lt`. This is the
-/// geometry the renderer builds from the same values (`render::shapes::collect`), so the converted
-/// path is the shape that was on screen rather than an approximation of it; the defaults match
-/// that code for a property a group doesn't carry (a polygon has no inner radius or roundness).
-fn parametric_path(g: &PropGroup, lt: effectcraft_time::Tick) -> Option<ShapePath> {
-    let f = |id: &str, d: f64| g.prop(id).map_or(d, |pr| pr.value_at(lt).as_f64());
-    let v2 = |id: &str, d: [f64; 2]| g.prop(id).map_or(d, |pr| pr.value_at(lt).as_vec2());
+/// The path a parametric shape group draws, in the group's own space. This is the geometry the
+/// renderer builds from the same values (`render::shapes::collect`), expressions included, so the
+/// converted path is the shape that was on screen rather than an approximation of it; the defaults
+/// match that code for a property a group doesn't carry (a polygon has no inner radius or
+/// roundness).
+fn parametric_path(ctx: &EvalCtx, layer: &effectcraft_project::Layer, g: &PropGroup) -> Option<ShapePath> {
+    let f = |id: &str, d: f64| ctx.f(layer, g, id, d);
+    let v2 = |id: &str, d: [f64; 2]| ctx.v2(layer, g, id, d);
     let path = match g.match_id.as_str() {
-        "rect" => effectcraft_path::rect(v2("size", [100.0; 2]), v2("position", [0.0; 2]), f("roundness", 0.0)),
+        "rect" => {
+            let (size, pos) = (v2("size", [100.0; 2]), v2("position", [0.0; 2]));
+            if ctx.b(layer, g, "perCorner") {
+                effectcraft_path::rect_radii(
+                    size,
+                    pos,
+                    [f("topLeftRoundness", 0.0), f("topRightRoundness", 0.0), f("bottomRightRoundness", 0.0), f("bottomLeftRoundness", 0.0)],
+                )
+            } else {
+                effectcraft_path::rect(size, pos, f("roundness", 0.0))
+            }
+        }
         "ellipse" => effectcraft_path::ellipse(v2("size", [100.0; 2]), v2("position", [0.0; 2])),
-        "star" => effectcraft_path::polystar(
-            g.prop("type").map_or(0, |pr| pr.value_at(lt).as_enum()) == 0,
-            f("points", 5.0),
-            v2("position", [0.0; 2]),
-            f("rotation", 0.0),
-            f("innerRadius", 50.0),
-            f("outerRadius", 100.0),
-            f("innerRoundness", 0.0),
-            f("outerRoundness", 0.0),
-        ),
+        "star" => effectcraft_path::polystar(effectcraft_path::Polystar {
+            star: ctx.e(layer, g, "type") == 0,
+            points: f("points", 5.0),
+            pos: v2("position", [0.0; 2]),
+            rotation: f("rotation", 0.0),
+            inner: f("innerRadius", 50.0),
+            outer: f("outerRadius", 100.0),
+            inner_round: f("innerRoundness", 0.0),
+            outer_round: f("outerRoundness", 0.0),
+        }),
         _ => return None,
     };
     // A closed parametric shape is one subpath; anything else would not be this shape.
@@ -160,28 +173,38 @@ fn convert_to_bezier(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let t = s.time();
     let n = shapes.len();
+    // Read the geometry before editing, with the same expression-aware context the renderer
+    // uses: an expression-driven corner radius, size or position must convert to what is on
+    // screen, not to the property's underlying value.
+    let prepared = {
+        let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+        let ctx = EvalCtx { expr: s.expr.as_deref(), ..EvalCtx::new(&s.project, cid, comp, t) };
+        let mut prepared = Vec::new();
+        for (lid, uid) in &shapes {
+            let Some(l) = comp.layer(*lid) else { continue };
+            let Some(old) = l.props.sub("contents").and_then(|c| c.find_group(*uid)) else { continue };
+            let Some(path) = parametric_path(&ctx, l, old) else { continue };
+            // Path Direction is the shape's own, not a default: reversing is a separate command.
+            prepared.push((*lid, *uid, path, ctx.e(l, old, "direction"), old.enabled));
+        }
+        prepared
+    };
     let made = s.edit("Convert To Bezier Path", None, |proj, st| {
         let mut next = proj.next_id;
         let mut made = Vec::new();
-        for (lid, uid) in &shapes {
-            let l = layer_mut(proj, cid, *lid)?;
-            let lt = l.layer_time(t);
+        for (lid, uid, path, direction, enabled) in prepared {
+            let l = layer_mut(proj, cid, lid)?;
             let contents = l.props.sub_mut("contents").ok_or_else(|| bad("path.convertToBezier", "not a shape layer"))?;
-            let Some(old) = contents.find_group(*uid) else { continue };
-            let Some(path) = parametric_path(old, lt) else { continue };
-            // Path Direction is the shape's own, not a default: reversing is a separate command.
-            let direction = old.prop("direction").map_or(0, |pr| pr.value_at(lt).as_enum());
-            let enabled = old.enabled;
             let mut g = build::shape_path(&mut Ids(&mut next), path);
             if let Some(pr) = g.prop_mut("direction") {
                 pr.value = KV::Enum(direction);
             }
             g.enabled = enabled;
             let new_uid = g.uid;
-            let parent = contents.parent_of_mut(*uid).ok_or_else(|| bad("path.convertToBezier", "no such shape item"))?;
-            let Some(at) = parent.children.iter().position(|c| c.uid() == *uid) else { continue };
+            let parent = contents.parent_of_mut(uid).ok_or_else(|| bad("path.convertToBezier", "no such shape item"))?;
+            let Some(at) = parent.children.iter().position(|c| c.uid() == uid) else { continue };
             parent.children[at] = Node::Group(g);
-            made.push((*lid, new_uid));
+            made.push((lid, new_uid));
         }
         proj.next_id = next;
         // The new paths are what is selected, so the vertices can be edited straight away.
@@ -308,7 +331,7 @@ fn free_transform(s: &mut Session, p: &Value) -> Result<Value> {
         let y = v[1] * scale[1];
         [x * c - y * sn, x * sn + y * c]
     };
-    let n = s.edit("Free Transform Points", None, |proj, _| {
+    let n = s.edit("Free Transform Points", merge_p(p), |proj, _| {
         let mut n = 0;
         for (lid, uid) in &targets {
             let l = layer_mut(proj, cid, *lid)?;
@@ -360,7 +383,7 @@ fn free_transform(s: &mut Session, p: &Value) -> Result<Value> {
 
 const SHAPE_ITEMS: &[&str] = &[
     "group", "rect", "ellipse", "star", "path", "fill", "stroke", "gfill", "gstroke", "trim", "repeater", "round", "offset", "pucker", "twist", "zigzag",
-    "wiggle", "merge", "front", "bevel", "side", "back",
+    "wiggle", "wiggler", "merge", "front", "bevel", "side", "back",
 ];
 
 /// Selected shape items (contents entries) of shape layers: (layer, uid).
@@ -542,7 +565,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Free Transform Points",
             ["Layer", "Mask and Shape Path"],
             None,
-            "{layer?, mask?, scale?: % | [x%, y%], rotation?: deg, offset?: [dx, dy], anchor?: [x, y]}",
+            "{layer?, mask?, scale?: % | [x%, y%], rotation?: deg, offset?: [dx, dy], anchor?: [x, y], merge?: string}",
             has_layers,
             free_transform
         ),
diff --git a/crates/engine/src/commands/project_items.rs b/crates/engine/src/cmd/project_items.rs
similarity index 100%
rename from crates/engine/src/commands/project_items.rs
rename to crates/engine/src/cmd/project_items.rs
diff --git a/crates/engine/src/commands/prop.rs b/crates/engine/src/cmd/prop.rs
similarity index 89%
rename from crates/engine/src/commands/prop.rs
rename to crates/engine/src/cmd/prop.rs
index 3af877d34..b23e73575 100644
--- a/crates/engine/src/commands/prop.rs
+++ b/crates/engine/src/cmd/prop.rs
@@ -22,8 +22,11 @@ pub(crate) fn prop_ref(s: &Session, p: &Value, cmd: &str) -> Result<(ItemId, Lay
         });
     }
     let path = str_p(p, "path").ok_or_else(|| bad(cmd, "missing `path` (e.g. transform/position) or `prop` uid"))?;
-    let pr = layer.props.prop(path).ok_or_else(|| {
-        let group = layer.props.group(path).or_else(|| path.trim().strip_prefix('@')?.parse().ok().and_then(|uid| layer.props.find_group(uid)));
+    // `effects/<match name>[#n]/<property>` is how `essential.list`, presets and Copy write an
+    // effect property; turn it into the uid path `PropGroup::prop` parses (#2064).
+    let resolved = super::resolve_effect_path(layer, path);
+    let pr = layer.props.prop(&resolved).ok_or_else(|| {
+        let group = layer.props.group(&resolved).or_else(|| path.trim().strip_prefix('@')?.parse().ok().and_then(|uid| layer.props.find_group(uid)));
         if group.is_some() {
             bad(cmd, format!("`{path}` is a property group; use layer.tree (MCP: get_layer) to inspect its children, then select a leaf property"))
         } else {
@@ -45,7 +48,6 @@ fn with_prop<T>(
     let t = s.time_of(cid);
     let linear = s.prefs.general.default_spatial_linear;
     s.edit(label, merge, |proj, state| {
-        let mut next = proj.next_id;
         let l = layer_mut(proj, cid, lid)?;
         let lt = l.layer_time(t);
         let pr = l.props.find_mut(uid).ok_or_else(|| bad("prop", "property vanished"))?;
@@ -61,17 +63,37 @@ fn with_prop<T>(
             }
         }
         if pr.match_id == "type" {
-            let removed = sync_polystar_type(l, uid, lt, &mut next)?;
-            if !removed.is_empty() {
-                state.selected_props.retain(|(layer, prop)| *layer != lid || !removed.contains(prop));
-                state.selected_keys.retain(|key| key.layer != lid || !removed.contains(&key.prop));
-            }
+            sync_polystar_property(proj, state, cid, lid, uid, t)?;
         }
-        proj.next_id = next;
         Ok(r)
     })
 }
 
+/// Keep Polystar controls and their selection references in the property's edit transaction.
+pub(super) fn sync_polystar_property(
+    proj: &mut effectcraft_project::Project,
+    state: &mut crate::EditorState,
+    cid: ItemId,
+    lid: LayerId,
+    uid: Uid,
+    time: Tick,
+) -> Result<()> {
+    let mut next = proj.next_id;
+    let layer = layer_mut(proj, cid, lid)?;
+    let removed = sync_polystar_type(layer, uid, layer.layer_time(time), &mut next)?;
+    if !removed.is_empty() {
+        if state.active_comp == Some(cid) {
+            state.selected_props.retain(|(layer, prop)| *layer != lid || !removed.contains(prop));
+            state.selected_keys.retain(|key| key.layer != lid || !removed.contains(&key.prop));
+        } else if let Some(selection) = state.comp_selections.get_mut(&cid) {
+            selection.props.retain(|(layer, prop)| *layer != lid || !removed.contains(prop));
+            selection.keys.retain(|key| key.layer != lid || !removed.contains(&key.prop));
+        }
+    }
+    proj.next_id = next;
+    Ok(())
+}
+
 /// A static Polygon has no inner controls; switching to Star creates them in schema order
 /// with AE's switch defaults (#1685). Animated/expression-driven types need the controls at
 /// every time, including when the current value is Polygon.
@@ -179,7 +201,9 @@ pub(crate) fn key_time(layer: &Layer, frame_rate: FrameRate, p: &Value, param: &
 pub(crate) fn key_timing(layer: &Layer, t: Tick) -> Value {
     let ct = layer.comp_time(t);
     let mut out = json!({"time": t.seconds(), "layerTime": t.seconds(), "compTime": ct.seconds()});
-    if !layer.is_active_at(ct) {
+    // A key exactly on the out point ends a fade normally: it is outside the half-open visible
+    // range, but it is not a caller mistake, so it does not warn (#2084).
+    if ct < layer.in_point || ct > layer.out_point {
         out["warning"] = json!(format!(
             "Keyframe at comp time {} s is outside the layer's active range [{} s, {} s).",
             ct.seconds(),
@@ -223,7 +247,8 @@ fn property_reply(p: &Value, layer: &Layer, pr: &Property, time: Tick, value: Va
 /// property (by match path, `transform/position`, `effects/<effect>#n/<param>`) of every other
 /// selected, unlocked layer of the comp whose value is of the same kind, as (layer, uid). Empty
 /// when `selected` is not set or the edited layer isn't selected. After Effects applies a value
-/// edit, the stopwatch and the keyframe button to all selected layers (#355, #491).
+/// edit, the stopwatch and the keyframe button to all selected layers (#355, #491). A parameter
+/// of a selected Puppet pin also reaches the same parameter of the other selected pins (#1751).
 fn selected_twins(s: &Session, p: &Value, cmd: &str) -> Result<Vec<(LayerId, Uid)>> {
     if b_p(p, "selected") != Some(true) {
         return Ok(vec![]);
@@ -236,14 +261,31 @@ fn selected_twins(s: &Session, p: &Value, cmd: &str) -> Result<Vec<(LayerId, Uid
         return Ok(vec![]);
     }
     let kind = (pr.value.kind_name(), pr.value.components().len());
-    Ok(s.state
+    let same_kind = |q: &&Property| (q.value.kind_name(), q.value.components().len()) == kind;
+    let mut twins: Vec<(LayerId, Uid)> = s
+        .state
         .selected_layers
         .iter()
         .filter(|o| **o != lid)
         .filter_map(|o| comp.layer(*o))
         .filter(|l| !l.switches.locked)
-        .filter_map(|l| l.props.prop(&path).filter(|q| (q.value.kind_name(), q.value.components().len()) == kind).map(|q| (l.id, q.uid)))
-        .collect())
+        .filter_map(|l| l.props.prop(&path).filter(same_kind).map(|q| (l.id, q.uid)))
+        .collect();
+    // A parameter of a selected Puppet pin: the same parameter of every other selected pin, on
+    // this layer too, so several pins move or key together (#1751).
+    let pin = super::puppet::layer_pins(layer).find(|g| g.props().any(|q| q.uid == uid)).map(|g| g.uid);
+    if let Some(pin) = pin
+        && s.state.selected_props.contains(&(lid, pin))
+    {
+        for (ol, ou) in &s.state.selected_props {
+            let Some(other) = comp.layer(*ol).filter(|l| !l.switches.locked) else { continue };
+            let Some(q) = super::puppet::layer_pins(other).find(|g| g.uid == *ou).and_then(|g| g.get(&pr.match_id)).filter(same_kind) else { continue };
+            if (*ol, q.uid) != (lid, uid) && !twins.contains(&(*ol, q.uid)) {
+                twins.push((*ol, q.uid));
+            }
+        }
+    }
+    Ok(twins)
 }
 
 /// `p` aimed at property `uid` of layer `lid` instead.
@@ -262,8 +304,13 @@ fn twin_params(p: &Value, lid: LayerId, uid: Uid) -> Value {
 /// The value of property `uid` of `lid` at the CTI as numbers (Position with Separate
 /// Dimensions: its X / Y / Z Position).
 fn current_components(s: &Session, cid: ItemId, lid: LayerId, uid: Uid) -> Option<Vec<f64>> {
+    components_at(s, cid, lid, uid, None)
+}
+
+/// [`current_components`] at layer time `at` (the CTI when `None`).
+fn components_at(s: &Session, cid: ItemId, lid: LayerId, uid: Uid, at: Option<Tick>) -> Option<Vec<f64>> {
     let l = s.project.comp(cid)?.layer(lid)?;
-    let lt = l.layer_time(s.time_of(cid));
+    let lt = at.unwrap_or_else(|| l.layer_time(s.time_of(cid)));
     if let Some(tr) = l.transform()
         && tr.get("position").is_some_and(|q| q.uid == uid)
         && tr.get("positionX").is_some()
@@ -295,7 +342,9 @@ pub(crate) fn proportional_share(index: usize, count: usize) -> f64 {
 /// `prop.set`; with `selected`, also on the other selected layers: the same value, or with
 /// `offset` (a scrub) the same change from each layer's own value. A typed value with `dims`
 /// (the components edited, e.g. `[2]` for Z) sets only those components on the other layers,
-/// which keep the rest of their own value (#1434). With `offset` and
+/// which keep the rest of their own value (#1434); `follow` components move on each layer by the
+/// change its first typed component takes (linked Audio Levels keep each layer's balance, #2485).
+/// With `offset` and
 /// `proportional` (Proportional Scrubbing) each layer takes [`proportional_share`] of the change
 /// by its place in the selection order, the scrubbed layer too. One undo step (with `merge`,
 /// one that a continuing scrub keeps folding into).
@@ -320,10 +369,19 @@ fn set_selected(s: &mut Session, p: &Value) -> Result<Value> {
         (None, Some(a), Some(_)) if !scalar => Some(a.iter().filter_map(Value::as_u64).filter_map(|d| usize::try_from(d).ok()).collect()),
         _ => None,
     };
+    let follow: Vec<usize> =
+        p.get("follow").and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_u64).filter_map(|d| usize::try_from(d).ok()).collect();
+    // Each layer's own value where `set` writes it (a `time` other than the CTI keys there).
     let typed = |s: &Session, q: &mut Value, olid: LayerId, ouid: Uid| {
         if let (Some(dims), Some(n)) = (&dims, &new)
-            && let Some(mut c) = current_components(s, cid, olid, ouid)
+            && let Some(mut c) = components_at(s, cid, olid, ouid, snapped_key_time(s, cid, olid, q, "prop.set").ok().flatten())
         {
+            let change = dims.first().and_then(|&d| Some(n.get(d)? - c.get(d)?)).unwrap_or(0.0);
+            for &d in &follow {
+                if let Some(slot) = c.get_mut(d) {
+                    *slot += change;
+                }
+            }
             for &d in dims {
                 if let (Some(slot), Some(v)) = (c.get_mut(d), n.get(d)) {
                     *slot = *v;
@@ -486,6 +544,9 @@ fn get(s: &mut Session, p: &Value) -> Result<Value> {
         "time": t.seconds(), "value": raw.to_json(), "animated": !pr.keys.is_empty(),
         "keys": keys, "expression": pr.expr.as_ref().map(|e| e.text.clone()),
     });
+    if let Some(o) = l.popup_options(pr) {
+        out["options"] = super::popup_options(&o);
+    }
     // With an expression, `value` is the keyframed (pre-expression) value; also report what the
     // expression makes of it (what renders), or why it fails. A disabled one renders `value`; one
     // disabled by its syntax error (prop.setExpression) reports that error.
@@ -656,12 +717,21 @@ fn set_expr(s: &mut Session, p: &Value) -> Result<Value> {
             s.project.comp(*cid).and_then(|c| c.layer(*lid).and_then(|l| super::link::reference(c, l, l, *uid, true))).unwrap_or_else(|| "value".into())
         })
         .collect();
-    let results = s.edit("Expression", merge_p(p), |proj, _| {
+    let times: Vec<_> = targets.iter().map(|(cid, _, _)| s.time_of(*cid)).collect();
+    let results = s.edit("Expression", merge_p(p), |proj, state| {
         let mut out = vec![];
-        for ((cid, lid, uid), def) in targets.iter().zip(&defs) {
+        let mut changed_types = vec![];
+        for (((cid, lid, uid), def), time) in targets.iter().zip(&defs).zip(&times) {
             let pr = layer_mut(proj, *cid, *lid)?.props.find_mut(*uid).ok_or_else(|| bad(C, "property vanished"))?;
             apply_expr(pr, &text, enabled, def);
             out.push(json!(pr.expr.as_ref().map(|e| e.text.clone())));
+            if pr.match_id == "type" {
+                changed_types.push((*cid, *lid, *uid, *time));
+            }
+        }
+        // All selected targets must be edited before a Type change can remove inner controls.
+        for (cid, lid, uid, time) in changed_types {
+            sync_polystar_property(proj, state, cid, lid, uid, time)?;
         }
         Ok(out)
     })?;
@@ -724,6 +794,8 @@ fn select_prop(s: &mut Session, p: &Value) -> Result<Value> {
     if !add {
         s.state.selected_props.clear();
         s.state.selected_vertices.clear();
+        // Groups (masks, effects) have no keys of their own: don't leave the old selection's behind.
+        s.state.selected_keys.clear();
     }
     if !s.state.selected_layers.contains(&lid) {
         s.state.selected_layers = vec![lid];
@@ -741,9 +813,6 @@ fn select_prop(s: &mut Session, p: &Value) -> Result<Value> {
         && let Some(pr) = s.active_comp().and_then(|c| c.layer(lid)).and_then(|l| l.props.find(uid))
     {
         let keys: Vec<KeyRef> = pr.keys.iter().map(|k| KeyRef { layer: lid, prop: uid, time: k.time }).collect();
-        if !add {
-            s.state.selected_keys.clear();
-        }
         s.state.selected_keys.extend(keys);
     }
     Ok(Value::Null)
@@ -878,6 +947,15 @@ fn select_keys(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(out)
 }
 
+/// References that can be edited, including explicit key lists supplied by commands.
+pub(crate) fn editable_keys(comp: &effectcraft_project::Comp, selected: &[KeyRef]) -> Vec<KeyRef> {
+    selected.iter().filter(|key| key_layer_editable(comp, key.layer)).copied().collect()
+}
+
+pub(crate) fn key_layer_editable(comp: &effectcraft_project::Comp, layer: LayerId) -> bool {
+    comp.layer(layer).is_some_and(|layer| !layer.switches.locked)
+}
+
 /// Apply `f` to every selected key; keeps the selection pointing at moved keys.
 pub(crate) fn edit_keys(s: &mut Session, label: &str, merge: Option<&str>, f: impl Fn(&mut Vec<Keyframe>, usize, &mut Tick) -> bool) -> Result<Value> {
     let cid = s.active_comp_id().ok_or(EngineError::NoComp)?;
@@ -890,7 +968,16 @@ pub(crate) fn edit_keys(s: &mut Session, label: &str, merge: Option<&str>, f: im
             groups.entry((k.layer, k.prop)).or_default().push(k.time);
         }
         for ((lid, uid), times) in groups {
-            let Some(pr) = comp.layer_mut(lid).and_then(|l| l.props.find_mut(uid)) else { continue };
+            let Some(layer) = comp.layer_mut(lid) else { continue };
+            // A locked layer's keys stay as they are, and stay selected.
+            if layer.switches.locked {
+                for time in times {
+                    let r = KeyRef { layer: lid, prop: uid, time };
+                    remapped.insert(r, r);
+                }
+                continue;
+            }
+            let Some(pr) = layer.props.find_mut(uid) else { continue };
             // Process each stored key once, in an order that avoids collisions when moving.
             let mut idx: Vec<(usize, Tick)> = times.iter().filter_map(|t| key_at(&pr.keys, *t).map(|i| (i, *t))).collect();
             idx.sort_by_key(|x| x.0);
@@ -1037,10 +1124,16 @@ fn move_keys(s: &mut Session, p: &Value) -> Result<Value> {
 fn delete_keys(s: &mut Session, _: &Value) -> Result<Value> {
     let cid = s.active_comp_id().ok_or(EngineError::NoComp)?;
     let sel = s.state.selected_keys.clone();
+    let time = s.time();
     s.edit("Delete Keyframes", None, |proj, st| {
         let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
         let mut removed = 0usize;
+        let mut changed = std::collections::BTreeSet::new();
         for k in &sel {
+            // A layer locked after its keys were selected keeps them (the selection stays too).
+            if comp.layer(k.layer).is_some_and(|l| l.switches.locked) {
+                continue;
+            }
             if let Some(pr) = comp.layer_mut(k.layer).and_then(|l| l.props.find_mut(k.prop))
                 && let Some(i) = key_at(&pr.keys, k.time)
             {
@@ -1049,9 +1142,15 @@ fn delete_keys(s: &mut Session, _: &Value) -> Result<Value> {
                 }
                 pr.keys.remove(i);
                 removed += 1;
+                if pr.match_id == "type" {
+                    changed.insert((k.layer, k.prop));
+                }
             }
         }
-        st.selected_keys.clear();
+        st.selected_keys.retain(|k| comp.layer(k.layer).is_some_and(|l| l.switches.locked));
+        for (layer, prop) in changed {
+            sync_polystar_property(proj, st, cid, layer, prop, time)?;
+        }
         // The keys actually removed: a selected key that is gone (or listed twice) isn't counted,
         // so a caller can tell that a delete changed nothing.
         Ok(json!(removed))
@@ -1184,6 +1283,15 @@ fn toggle_hold(s: &mut Session, _: &Value) -> Result<Value> {
     })
 }
 
+fn set_muted(s: &mut Session, p: &Value) -> Result<Value> {
+    let muted = b_p(p, "muted").unwrap_or(true);
+    let label = if muted { "Mute Keyframes" } else { "Unmute Keyframes" };
+    edit_keys(s, label, None, move |keys, i, _| {
+        keys[i].muted = muted;
+        false
+    })
+}
+
 /// A number or a per-dimension array of numbers.
 fn nums_p(p: &Value, k: &str, scale: f64) -> Option<Vec<f64>> {
     match p.get(k)? {
@@ -1272,6 +1380,8 @@ fn convert_expr_to_keys(s: &mut Session, p: &Value) -> Result<Value> {
     convert_one_expr(s, cid, lid, uid)
 }
 
+/// Replaces the expression on one property with keyframes sampled from its evaluated values.
+/// Returns the number of properties converted.
 fn convert_one_expr(s: &mut Session, cid: ItemId, lid: LayerId, uid: Uid) -> Result<Value> {
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
     let layer = comp.layer(lid).ok_or(EngineError::NoComp)?.clone();
@@ -1280,8 +1390,17 @@ fn convert_one_expr(s: &mut Session, cid: ItemId, lid: LayerId, uid: Uid) -> Res
     let fd = comp.frame_duration();
     let mut t = layer.in_point;
     while t < layer.out_point {
-        let ctx =
-            effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp: &comp, time: t, expr: s.expr.as_deref(), footage: Some(s.footage.as_ref()) };
+        let ctx = effectcraft_render::EvalCtx {
+            project: &s.project,
+            comp_id: cid,
+            comp: &comp,
+            time: t,
+            expr: s.expr.as_deref(),
+            footage: Some(s.footage.as_ref()),
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: None,
+        };
         keys.push(Keyframe::new(layer.layer_time(t), ctx.value(&layer, &pr)));
         t += fd;
     }
@@ -1305,7 +1424,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Set Property Value",
             [],
             None,
-            "{layer?, path|prop, value, time? (layer s by default), timeBase?: layer|comp, merge?, selected? (also the other selected layers), offset? (them by the same change), proportional? (with offset: Proportional Scrubbing, each layer by its share in selection order, the first none, the last all), dims? (with selected, a typed value: the components edited, e.g. [2] for Z; the other layers keep the rest of their own value)}",
+            "{layer?, path|prop, value, time? (layer s by default), timeBase?: layer|comp, merge?, selected? (also the other selected layers), offset? (them by the same change), proportional? (with offset: Proportional Scrubbing, each layer by its share in selection order, the first none, the last all), dims? (with selected, a typed value: the components edited, e.g. [2] for Z; the other layers keep the rest of their own value), follow? (with dims: components that move on each other layer by the change its first typed component takes)}",
             has_layers,
             set_selected
         ),
@@ -1368,6 +1487,7 @@ pub fn specs() -> Vec<CommandSpec> {
             &json!({"which": "out"})
         )),
         cmd!("keys.toggleHold", "Toggle Hold Keyframe", ["Animation"], Some("Cmd+Alt+H"), "{}", has_keys, toggle_hold),
+        cmd!("keys.setMuted", "Mute Keyframes", ["Animation"], None, "{muted?: bool (default true)}", has_keys, set_muted),
         cmd!(
             "keys.interpolation",
             "Keyframe Interpolation...",
diff --git a/crates/engine/src/commands/prop_groups.rs b/crates/engine/src/cmd/prop_groups.rs
similarity index 84%
rename from crates/engine/src/commands/prop_groups.rs
rename to crates/engine/src/cmd/prop_groups.rs
index 6f7d74aef..b3e9baf14 100644
--- a/crates/engine/src/commands/prop_groups.rs
+++ b/crates/engine/src/cmd/prop_groups.rs
@@ -135,6 +135,61 @@ pub(crate) fn copy_contents(s: &Session) -> Vec<PropGroup> {
     selected_contents(s).into_iter().filter_map(|(lid, uid)| c.layer(lid)?.props.find_group(uid).cloned()).collect()
 }
 
+/// Masks selected on the active comp's layers, top to bottom (#2091).
+pub(crate) fn selected_masks(s: &Session) -> Vec<(LayerId, Uid)> {
+    let Some(c) = s.active_comp().filter(|_| !s.state.selected_props.is_empty()) else { return vec![] };
+    c.layers
+        .iter()
+        .flat_map(|l| {
+            let masks = l.masks().into_iter().flat_map(|m| m.groups());
+            masks.filter(|m| s.state.selected_props.contains(&(l.id, m.uid))).map(|m| (l.id, m.uid))
+        })
+        .collect()
+}
+
+/// Copies of the selected masks (Edit ▸ Copy), top to bottom.
+pub(crate) fn copy_masks(s: &Session) -> Vec<PropGroup> {
+    let Some(c) = s.active_comp() else { return vec![] };
+    selected_masks(s).into_iter().filter_map(|(lid, uid)| c.layer(lid)?.props.find_group(uid).cloned()).collect()
+}
+
+/// Edit ▸ Paste with masks on the clipboard: each is added, with a unique name, below the masks of
+/// every selected unlocked layer that can have masks, and the copies are selected (#2091).
+pub(crate) fn paste_masks(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "edit.paste";
+    let clip = s.state.mask_clipboard.clone();
+    let (cid, ids) = layers_p(s, p)?;
+    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
+    let targets: Vec<LayerId> = ids.into_iter().filter(|l| comp.layer(*l).is_some_and(|l| l.masks().is_some() && !l.switches.locked)).collect();
+    if targets.is_empty() {
+        return Err(bad(c, "select an unlocked layer that can have masks to paste masks into"));
+    }
+    let label = match clip.as_slice() {
+        [g] => format!("Paste {}", g.name),
+        _ => "Paste".to_string(),
+    };
+    let pasted = s.edit(&label, None, |proj, st| {
+        let mut next = proj.next_id;
+        let mut out = vec![];
+        for lid in &targets {
+            let masks = layer_mut(proj, cid, *lid)?.props.sub_mut("masks").ok_or_else(|| bad(c, "the layer can't have masks"))?;
+            for g in &clip {
+                let mut g = g.clone();
+                g.reassign_uids(&mut next);
+                g.name = super::effect::unique_name(masks, &g.name);
+                out.push((*lid, g.uid));
+                masks.children.push(g.into());
+            }
+        }
+        proj.next_id = next + 1;
+        st.selected_props = out.clone();
+        // The source mask's points (selected with it) must not outlive its selection.
+        st.selected_vertices.clear();
+        Ok(out)
+    })?;
+    Ok(json!({"masks": pasted.iter().map(|(_, u)| *u).collect::<Vec<_>>()}))
+}
+
 /// Edit ▸ Cut's removal of the selected shape items (once copied).
 pub(crate) fn cut_contents(s: &mut Session, items: &[(LayerId, Uid)]) -> Result<Value> {
     let cid = s.active_comp_id().ok_or(EngineError::NoComp)?;
diff --git a/crates/engine/src/commands/proxy.rs b/crates/engine/src/cmd/proxy.rs
similarity index 94%
rename from crates/engine/src/commands/proxy.rs
rename to crates/engine/src/cmd/proxy.rs
index b7d644b94..42633b913 100644
--- a/crates/engine/src/commands/proxy.rs
+++ b/crates/engine/src/cmd/proxy.rs
@@ -53,6 +53,7 @@ fn probe(s: &Session, path: &str, cmd: &str) -> Result<Footage> {
 
 /// Attach `footage` as the proxy of `items` (Use Proxy on). One undo step.
 pub(crate) fn set_proxy_footage(s: &mut Session, items: &[ItemId], footage: Footage) -> Result<()> {
+    s.stored_paths.allow(&footage);
     s.edit("Set Proxy", None, |proj, _| {
         for i in items {
             if let Some(it) = proj.item_mut(*i) {
@@ -117,6 +118,7 @@ fn interpret_proxy(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "the selected items have no proxy"));
     }
     let it = super::file_more::Interpretation::parse(p, C)?;
+    it.check(items.iter().filter_map(|i| s.project.item(*i).and_then(|x| x.proxy.as_ref()).map(|px| &px.footage)), C)?;
     let guesses: Vec<_> = items
         .iter()
         .map(|i| {
@@ -190,6 +192,8 @@ fn create_proxy(s: &mut Session, p: &Value) -> Result<Value> {
     it.output.channels = Channels::Rgba;
     if let Some(o) = str_p(p, "path").or(str_p(p, "output")) {
         it.output.output = o.to_string();
+    } else {
+        s.avoid_sources(&mut it);
     }
     it.post_render = PostRenderAction::SetProxy;
     let id = s.edit("Create Proxy", None, |proj, _| {
@@ -229,7 +233,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Proxy...",
             ["File", "Interpret Footage"],
             None,
-            "{items?|item?, alpha?, matteColor?, invertAlpha?, frameRate?, loop?, pixelAspect?, fields?, colorProfile?, linearLight?}",
+            "{items?|item?, alpha?, guessAlpha?, matteColor?|premulColor?, invertAlpha?, frameRate?, loop?, pixelAspect?, fields?, colorProfile?, linearLight?, preserveRgb?, overrideStart?, startTimecode? (as file.interpretFootage), logConversion?, cineonUnits?, convertedBlack?, convertedWhite?, pointUnits?, tenBitBlack?, tenBitWhite?, currentGamma?, highlightRolloff? (Cineon Settings of DPX and Cineon proxies)}",
             has_proxy,
             interpret_proxy
         ),
diff --git a/crates/engine/src/commands/puppet.rs b/crates/engine/src/cmd/puppet.rs
similarity index 94%
rename from crates/engine/src/commands/puppet.rs
rename to crates/engine/src/cmd/puppet.rs
index 320e1d415..bd20bd885 100644
--- a/crates/engine/src/commands/puppet.rs
+++ b/crates/engine/src/cmd/puppet.rs
@@ -7,7 +7,8 @@
 //!
 //! Pin positions are in effect space. A new pin is attached to the mesh under it: the click is
 //! mapped back through the current deformation to the rest mesh (its hidden rest position), and
-//! Position / Advanced pins get a Position keyframe at the current time, as in After Effects.
+//! Position / Advanced pins get a Position keyframe at the current time, as in After Effects. Off
+//! every mesh a pin starts a new mesh, unless its art already has one (#2865).
 
 use effectcraft_effects::puppet::{self, MeshOpts, PinKind};
 use effectcraft_effects::{Buf, Params};
@@ -38,7 +39,17 @@ pub fn puppet_eval(s: &Session, cid: ItemId, lid: LayerId, fx_uid: Uid, t: Tick)
     let fx = layer.effects()?;
     let index = fx.groups().position(|g| g.uid == fx_uid)?;
     let g = fx.groups().nth(index)?;
-    let ctx = EvalCtx { project: &s.project, comp_id: cid, comp, time: t, expr: s.expr.as_deref(), footage: None };
+    let ctx = EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let mut r = Renderer::new(&s.project, &*s.footage, RenderOpts::default());
     r.expr = s.expr.as_deref();
     r.cache = Some(&s.layer_cache);
@@ -61,6 +72,32 @@ fn layer_time(s: &Session, cid: ItemId, lid: LayerId, t: Tick) -> Result<Tick> {
     Ok(l.layer_time(t))
 }
 
+/// Whether a pin at `at` (effect space) goes on this mesh as `def` deforms it: on it or beside it.
+fn on_mesh(mesh: &puppet::Mesh, def: &[[f64; 2]], at: [f64; 2]) -> bool {
+    !mesh.tris.is_empty() && (puppet::contains(mesh, def, at) || def.iter().map(|v| (v[0] - at[0]).hypot(v[1] - at[1])).fold(f64::MAX, f64::min) < 12.0)
+}
+
+/// Whether a new mesh at `at` (effect space) would repeat a mesh of `params`: the art it would
+/// outline is that mesh's own, even if a deformation has carried the mesh off it (#2865).
+fn repeats_mesh(buf: &Buf, params: &Params, at: [f64; 2]) -> bool {
+    let (w, h) = (buf.img.width as usize, buf.img.height as usize);
+    let alpha: Vec<f32> = buf.img.data.iter().map(|p| p[3]).collect();
+    puppet::parse(params).iter().any(|m| {
+        let mut outline = puppet::mesh::outline(&alpha, w, h, buf.scale.max(1e-9), buf.offset, at, m.opts.expansion);
+        // As `triangulate` winds it.
+        if puppet::mesh::signed_area(&outline) < 0.0 {
+            outline.reverse();
+        }
+        puppet::mesh_for(buf, m).outline == outline
+    })
+}
+
+/// Whether `puppet.addPin` at `at` (effect space) places a pin on a layer with a Puppet effect.
+pub fn places_pin(s: &Session, cid: ItemId, lid: LayerId, at: [f64; 2], t: Tick) -> bool {
+    let Some((buf, params)) = find_puppet(s, cid, lid).and_then(|fu| puppet_eval(s, cid, lid, fu, t)) else { return true };
+    !repeats_mesh(&buf, &params, at) || puppet::overlay(&buf, &params).iter().any(|(_, mesh, def, _)| on_mesh(mesh, def, at))
+}
+
 fn add_pin(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "puppet.addPin";
     let (cid, lid) = layer_p(s, p, cmd)?;
@@ -92,9 +129,7 @@ fn add_pin(s: &mut Session, p: &Value) -> Result<Value> {
             if want_mesh.is_some_and(|w| w != *uid) || mesh.tris.is_empty() {
                 continue;
             }
-            let inside = puppet::contains(mesh, def, at);
-            let near = def.iter().map(|v| (v[0] - at[0]).hypot(v[1] - at[1])).fold(f64::MAX, f64::min) < 12.0;
-            if inside || near || want_mesh.is_some() {
+            if on_mesh(mesh, def, at) || want_mesh.is_some() {
                 let rest = puppet::unmap(mesh, def, at);
                 // A moving pin holds its nearest mesh vertex at `position + (vertex - rest)`
                 // (puppet::solve). Choose the position that keeps that vertex where it is now, so
@@ -119,6 +154,9 @@ fn add_pin(s: &mut Session, p: &Value) -> Result<Value> {
         {
             return Err(bad(cmd, format!("no mesh {w}")));
         }
+        if target.is_none() && repeats_mesh(&buf, &params, at) {
+            return Ok(json!({"pin": null, "changed": false}));
+        }
     }
     let opts = MeshOpts {
         density: f_p(p, "density").unwrap_or(s.state.puppet.density),
diff --git a/crates/engine/src/commands/query.rs b/crates/engine/src/cmd/query.rs
similarity index 95%
rename from crates/engine/src/commands/query.rs
rename to crates/engine/src/cmd/query.rs
index 2ea8048fa..dd1581733 100644
--- a/crates/engine/src/commands/query.rs
+++ b/crates/engine/src/cmd/query.rs
@@ -46,11 +46,9 @@ fn summary(s: &mut Session, _: &Value) -> Result<Value> {
                 o["layers"] = json!(c.layers.len());
                 o["frameRate"] = json!(c.frame_rate.as_f64());
             }
-            // Footage that shows no picture although its file is there (a codec or profile the
-            // decoders lack): why, so an agent can tell the user.
-            if let ItemKind::Footage(f) = &i.kind
-                && let Some(why) = s.footage.problem(f)
-            {
+            // Include offline originals and unused proxies in the inventory reported to agents.
+            o["missing"] = json!(i.has_missing_footage());
+            if let Some(why) = s.footage.item_problem(i).or_else(|| crate::render::missing_item_problem(i)) {
                 o["problem"] = json!(why);
             }
             o
@@ -129,6 +127,9 @@ fn group_json(g: &PropGroup, path: &str, l: &Layer, t: effectcraft_time::Tick, d
                         if let Some(e) = &p.expr {
                             o["expression"] = json!(e.text);
                         }
+                        if let Some(opts) = l.popup_options(p) {
+                            o["options"] = super::popup_options(&opts);
+                        }
                         o
                     }
                     Node::Group(g) => group_json(g, &cpath, l, t, depth + 1, max_depth),
diff --git a/crates/engine/src/commands/quick_offset.rs b/crates/engine/src/cmd/quick_offset.rs
similarity index 100%
rename from crates/engine/src/commands/quick_offset.rs
rename to crates/engine/src/cmd/quick_offset.rs
diff --git a/crates/engine/src/commands/relink.rs b/crates/engine/src/cmd/relink.rs
similarity index 99%
rename from crates/engine/src/commands/relink.rs
rename to crates/engine/src/cmd/relink.rs
index 2d7c2ea13..d899decbe 100644
--- a/crates/engine/src/commands/relink.rs
+++ b/crates/engine/src/cmd/relink.rs
@@ -103,7 +103,7 @@ fn run(s: &mut Session, p: &Value) -> Result<Value> {
             }
             let supported = matches!(old.kind, FootageKind::Still | FootageKind::Sequence | FootageKind::Video | FootageKind::Audio)
                 && old.layer.is_none() && old.page == 0;
-            let name = Path::new(&old.path).file_name().and_then(|n| n.to_str()).unwrap_or("");
+            let name = Path::new(&old.path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("");
             let paths = index.get(name).cloned().unwrap_or_default();
             let mut candidates = vec![];
             let mut accepted = vec![];
diff --git a/crates/engine/src/commands/relink_moved.rs b/crates/engine/src/cmd/relink_moved.rs
similarity index 100%
rename from crates/engine/src/commands/relink_moved.rs
rename to crates/engine/src/cmd/relink_moved.rs
diff --git a/crates/engine/src/commands/render_queue.rs b/crates/engine/src/cmd/render_queue.rs
similarity index 90%
rename from crates/engine/src/commands/render_queue.rs
rename to crates/engine/src/cmd/render_queue.rs
index 09a7c7d2f..6ca5b9ba0 100644
--- a/crates/engine/src/commands/render_queue.rs
+++ b/crates/engine/src/cmd/render_queue.rs
@@ -6,9 +6,9 @@
 //! `index` (1-based, the # column).
 
 use effectcraft_project::render_queue::{
-    AlphaMode, AudioFormat, AudioOutput, Channels, ColorDepth, CurrentOrOff, DEFAULT_SEQUENCE_TEMPLATE, DEFAULT_TEMPLATE, EffectsMode, FieldRender,
-    OutputFormat, OutputModule, PostRenderAction, ProResProfile, Pulldown, RESIZE_PRESETS, RenderLog, RenderQuality, RenderQueueItem, RenderSettings,
-    RenderStatus, ResizeQuality, SwitchOverride, TimeSpan, post_render_parse, without_project_extension,
+    AlphaMode, AudioFormat, AudioOutput, Channels, ColorDepth, CurrentOrOff, DEFAULT_SEQUENCE_TEMPLATE, DEFAULT_TEMPLATE, EffectsMode, ExrBitDepth,
+    ExrCompression, FieldRender, OutputFormat, OutputModule, PostRenderAction, ProResProfile, Pulldown, RESIZE_PRESETS, RenderLog, RenderQuality,
+    RenderQueueItem, RenderSettings, RenderStatus, ResizeQuality, SwitchOverride, TimeSpan, post_render_parse, without_project_extension,
 };
 use effectcraft_project::render_templates::{RenderTemplates, TemplateKind, TemplateSlot};
 use effectcraft_time::{FrameRate, Tick};
@@ -202,26 +202,14 @@ fn apply_om_template(om: &mut OutputModule, t: &OutputModule) {
     om.name = t.name.clone();
 }
 
-/// The `format` parameter's values.
-const FORMATS: &str = "format: h264|hevc|av1|prores|uncompressed|webm|png|jpeg|tiff|exr|gif|wav|aiff";
+/// The `exrCompression` parameter's values.
+const EXR_COMPRESSIONS: &str = "none|rle|zips|zip|piz|pxr24|b44|b44a|dwaa|dwab";
 
-/// Apply Output Module parameters (`template` first). `roi`: the viewer's region of interest
-/// (captured by `crop.useRoi`).
-fn apply_output(om: &mut OutputModule, templates: &RenderTemplates, roi: Option<[f64; 4]>, p: &Value, cmd: &str) -> Result<bool> {
-    let mut any = false;
-    if let Some(t) = str_p(p, "template") {
-        let t = templates.output_module(t).ok_or_else(|| bad(cmd, format!("no Output Module template “{t}”")))?;
-        apply_om_template(om, &t);
-        any = true;
-    }
-    let before = om.clone();
-    if let Some(f) = str_p(p, "format") {
-        let f = OutputFormat::from_name(f).ok_or_else(|| bad(cmd, FORMATS))?;
-        om.set_format(f);
-    }
-    // Before Channels: the WebM codec decides whether alpha can be written, so an explicit
-    // `channels: rgba` with `webmCodec: av1` is refused rather than dropped (#166).
-    any |= apply_codec_options(om, p, cmd)?;
+/// The `format` parameter's values.
+const FORMATS: &str = "format: h264|hevc|av1|prores|uncompressed|webm|png|jpeg|tiff|exr|tga|gif|wav|aiff";
+
+/// `channels` (refusing RGBA where the format has no alpha) and `color`/`alphaMode`.
+fn apply_channels_and_alpha(om: &mut OutputModule, p: &Value, cmd: &str) -> Result<()> {
     if let Some(c) = str_p(p, "channels") {
         om.channels = match c.to_ascii_lowercase().replace([' ', '+'], "").as_str() {
             "rgb" => Channels::Rgb,
@@ -244,21 +232,11 @@ fn apply_output(om: &mut OutputModule, templates: &RenderTemplates, roi: Option<
             _ => return Err(bad(cmd, "color: straight|premultiplied")),
         };
     }
-    if let Some(q) = f_p(p, "quality") {
-        om.quality = q.clamp(1.0, 100.0) as u8;
-    }
-    if let Some(b) = f_p(p, "bitrate") {
-        om.bitrate_kbps = b.clamp(50.0, 500_000.0) as u32;
-    }
-    if let Some(b) = b_p(p, "webmBitrate") {
-        om.webm_bitrate = b;
-    }
-    if let Some(k) = p.get("keyframeInterval").and_then(Value::as_u64) {
-        om.keyframe_interval = k.min(100_000) as u32;
-    }
-    if let Some(pp) = str_p(p, "proresProfile") {
-        om.prores_profile = ProResProfile::from_name(pp).ok_or_else(|| bad(cmd, "proresProfile: proxy|lt|standard|hq|4444|4444xq"))?;
-    }
+    Ok(())
+}
+
+/// `crop` plus the flat dialog keys (`cropTop`… and `resizeWidth`/`resizeHeight`).
+fn apply_crop(om: &mut OutputModule, roi: Option<[f64; 4]>, p: &Value, cmd: &str) -> Result<()> {
     match p.get("crop") {
         Some(Value::Bool(b)) => om.crop.enabled = *b,
         Some(Value::Object(c)) => {
@@ -298,6 +276,11 @@ fn apply_output(om: &mut OutputModule, templates: &RenderTemplates, roi: Option<
             om.resize.enabled = true;
         }
     }
+    Ok(())
+}
+
+/// `resize` (bool or object).
+fn apply_resize(om: &mut OutputModule, p: &Value, cmd: &str) -> Result<()> {
     match p.get("resize") {
         Some(Value::Bool(b)) => om.resize.enabled = *b,
         Some(Value::Object(r)) => {
@@ -328,6 +311,56 @@ fn apply_output(om: &mut OutputModule, templates: &RenderTemplates, roi: Option<
         Some(Value::Null) | None => {}
         Some(_) => return Err(bad(cmd, "resize: bool or {enabled?, preset?, width?, height?, lockAspect?, quality?: low|high}")),
     }
+    Ok(())
+}
+
+/// OpenEXR `exrCompression` and `exrBitDepth`.
+fn apply_exr(om: &mut OutputModule, p: &Value, cmd: &str) -> Result<()> {
+    if let Some(c) = enum_p(p, "exrCompression", cmd, ExrCompression::from_name, EXR_COMPRESSIONS)? {
+        om.exr_compression = c;
+    }
+    if let Some(d) = enum_p(p, "exrBitDepth", cmd, ExrBitDepth::from_name, "half|float")? {
+        om.exr_bit_depth = d;
+    }
+    Ok(())
+}
+
+/// Apply Output Module parameters (`template` first). `roi`: the viewer's region of interest
+/// (captured by `crop.useRoi`).
+fn apply_output(om: &mut OutputModule, templates: &RenderTemplates, roi: Option<[f64; 4]>, p: &Value, cmd: &str) -> Result<bool> {
+    let mut any = false;
+    if let Some(t) = str_p(p, "template") {
+        let t = templates.output_module(t).ok_or_else(|| bad(cmd, format!("no Output Module template “{t}”")))?;
+        apply_om_template(om, &t);
+        any = true;
+    }
+    let before = om.clone();
+    if let Some(f) = str_p(p, "format") {
+        let f = OutputFormat::from_name(f).ok_or_else(|| bad(cmd, FORMATS))?;
+        om.set_format(f);
+    }
+    // Before Channels: the WebM codec decides whether alpha can be written, so an explicit
+    // `channels: rgba` with `webmCodec: av1` is refused rather than dropped (#166).
+    any |= apply_codec_options(om, p, cmd)?;
+    apply_channels_and_alpha(om, p, cmd)?;
+    if let Some(q) = f_p(p, "quality") {
+        om.quality = q.clamp(1.0, 100.0) as u8;
+    }
+    if let Some(b) = f_p(p, "bitrate") {
+        om.bitrate_kbps = b.clamp(50.0, 500_000.0) as u32;
+    }
+    if let Some(b) = b_p(p, "webmBitrate") {
+        om.webm_bitrate = b;
+    }
+    if let Some(k) = p.get("keyframeInterval").and_then(Value::as_u64) {
+        om.keyframe_interval = k.min(100_000) as u32;
+    }
+    if let Some(pp) = str_p(p, "proresProfile") {
+        om.prores_profile = ProResProfile::from_name(pp).ok_or_else(|| bad(cmd, "proresProfile: proxy|lt|standard|hq|4444|4444xq"))?;
+    }
+    apply_exr(om, p, cmd)?;
+    apply_crop(om, roi, p, cmd)?;
+    apply_resize(om, p, cmd)?;
     if let Some(a) = p.get("audio") {
         om.audio = match a {
             Value::Bool(true) => AudioOutput::On,
@@ -532,6 +565,9 @@ fn add(s: &mut Session, p: &Value) -> Result<Value> {
         object.remove("template");
     }
     apply_output(&mut it.output, &templates, s.state.region_of_interest, &output_params, "renderQueue.add")?;
+    if str_p(p, "output").or(str_p(p, "path")).is_none() {
+        s.avoid_sources(&mut it);
+    }
     if let Some(l) = enum_p(p, "log", "renderQueue.add", RenderLog::parse, "errorsOnly|plusSettings|plusPerFrameInfo")? {
         it.log = l;
     }
@@ -601,7 +637,7 @@ fn set_output_module(s: &mut Session, p: &Value) -> Result<Value> {
         let (w, h) = item.settings.output_size(comp);
         let mut crop_only = om.clone();
         crop_only.resize.enabled = false;
-        let (cw, ch) = crop_only.frame_size(w, h, item.settings.resolution.clamp(0.01, 4.0));
+        let (cw, ch) = crop_only.frame_size(w, h, item.settings.effective_scale(comp));
         om.resize.width = ((om.resize.height as f64 * cw as f64 / ch as f64).round() as u32).clamp(1, 30_000);
     }
     let post = match str_p(p, "postRenderAction") {
@@ -678,8 +714,18 @@ fn render(s: &mut Session, p: &Value) -> Result<Value> {
     {
         log::warn!("{e}");
     }
+    let queued: std::collections::HashSet<u64> = s.project.render_queue.iter().filter(|i| i.is_queued()).map(|i| i.id).collect();
     let ids = s.start_render(wait).map_err(EngineError::Other)?;
-    let items: Vec<Value> = s.project.render_queue.iter().enumerate().filter(|(_, i)| ids.contains(&i.id)).map(|(k, i)| item_json(s, i, k)).collect();
+    // Source refusals fail before the exporter starts. Report them just like encoding
+    // failures, so CLI/MCP callers do not mistake a partly refused queue for full success.
+    let items: Vec<Value> = s
+        .project
+        .render_queue
+        .iter()
+        .enumerate()
+        .filter(|(_, i)| ids.contains(&i.id) || (queued.contains(&i.id) && matches!(i.status, RenderStatus::Failed(_))))
+        .map(|(k, i)| item_json(s, i, k))
+        .collect();
     Ok(json!({"rendering": s.is_rendering(), "items": items}))
 }
 
@@ -688,7 +734,11 @@ fn stop(s: &mut Session, _: &Value) -> Result<Value> {
 }
 
 fn list(s: &mut Session, _: &Value) -> Result<Value> {
-    s.poll_render();
+    // The suspended script's frontend applies post-render edits before resuming it. A
+    // control inspection must not apply those edits while the undo-group guard is active.
+    if s.script_ui.render_host.is_none() {
+        s.poll_render();
+    }
     let items: Vec<Value> = s.project.render_queue.iter().enumerate().map(|(k, i)| item_json(s, i, k)).collect();
     Ok(json!({"items": items, "rendering": s.is_rendering(), "progress": s.render_progress()}))
 }
@@ -714,6 +764,8 @@ fn formats(s: &mut Session, _: &Value) -> Result<Value> {
     Ok(json!({
         "formats": v,
         "proresProfiles": ProResProfile::ALL.iter().map(|p| p.label()).collect::<Vec<_>>(),
+        "exrCompressions": ExrCompression::ALL.iter().map(|c| json!({"id": c.name(), "label": c.label(), "lossyHalf": c.is_lossy(ExrBitDepth::Half), "lossyFloat": c.is_lossy(ExrBitDepth::Float)})).collect::<Vec<_>>(),
+        "exrBitDepths": ExrBitDepth::ALL.iter().map(|d| d.name()).collect::<Vec<_>>(),
         "codecProfiles": CodecProfile::ALL.iter().map(|p| p.label()).collect::<Vec<_>>(),
         "hevcLevels": VideoCodecOptions::HEVC_LEVELS.iter().map(level).collect::<Vec<_>>(),
         "av1Levels": VideoCodecOptions::AV1_LEVELS.iter().map(level).collect::<Vec<_>>(),
@@ -770,6 +822,9 @@ fn pre_render(s: &mut Session, p: &Value) -> Result<Value> {
     it.output = templates.default_output_module(TemplateSlot::PreRender);
     it.output.output = "[compName]_prerender.[fileExtension]".into();
     apply_output(&mut it.output, &templates, s.state.region_of_interest, p, "render.preRender")?;
+    if str_p(p, "output").or(str_p(p, "path")).is_none() {
+        s.avoid_sources(&mut it);
+    }
     it.post_render = PostRenderAction::ImportAndReplace;
     let id = s.edit("Pre-render", None, |proj, _| {
         it.id = proj.render_queue.iter().map(|i| i.id).max().unwrap_or(0) + 1;
@@ -795,6 +850,9 @@ fn save_current_preview(s: &mut Session, p: &Value) -> Result<Value> {
     let mut item = RenderQueueItem::new(0, cid);
     item.output = OutputModule::for_format(format);
     item.output.output = path.clone();
+    if let Some(refusal) = s.check_outputs(&[vec![(item.clone(), path.clone())]]).first() {
+        return Err(EngineError::Other(refusal.reason.clone()));
+    }
     let job = crate::ExportJob {
         project: &s.project,
         footage: s.footage.as_ref(),
@@ -999,7 +1057,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add to Render Queue",
             ["Composition"],
             ["Cmd+M", "Cmd+Shift+/"],
-            "{comp?: id|name, template?: Render Settings template, format?: h264|hevc|av1|prores|uncompressed|webm|png|jpeg|tiff|exr|gif|wav|aiff, output?: path|template, log?: errorsOnly|plusSettings|plusPerFrameInfo, quality?: best|draft|1-100 (jpeg, webm), resolution?: full|half|third|quarter|scale, proxyUse?, effects?, solo?, guideLayers?, colorDepth?, frameBlending?, fieldRender?, pulldown?, motionBlur?, timeSpan?: workArea|comp|custom, start?: s, end?: s, duration?: s, frameRate?: fps|null, skipExisting?: bool, storageOverflow?: bool, channels?: rgb|rgba|alpha, color?, bitrate?: kbps, webmBitrate?, keyframeInterval?, proresProfile?, profile?, level?, rateControl?, webmCodec?, audioBitrate?, opusApplication?, crop?, resize?, includeProjectLink?, audio?: auto|on|off, sampleRate?, audioChannels?, audioFormat?, loop?: bool (values as in setRenderSettings / setOutputModule)}",
+            "{comp?: id|name, template?: Render Settings template, format?: h264|hevc|av1|prores|uncompressed|webm|png|jpeg|tiff|exr|tga|gif|wav|aiff, output?: path|template, log?: errorsOnly|plusSettings|plusPerFrameInfo, quality?: best|draft|1-100 (jpeg, webm), resolution?: full|half|third|quarter|scale, proxyUse?, effects?, solo?, guideLayers?, colorDepth?, frameBlending?, fieldRender?, pulldown?, motionBlur?, timeSpan?: workArea|comp|custom, start?: s, end?: s, duration?: s, frameRate?: fps|null, skipExisting?: bool, storageOverflow?: bool, channels?: rgb|rgba|alpha, color?, bitrate?: kbps, webmBitrate?, keyframeInterval?, proresProfile?, exrCompression?, exrBitDepth?, profile?, level?, rateControl?, webmCodec?, audioBitrate?, opusApplication?, crop?, resize?, includeProjectLink?, audio?: auto|on|off, sampleRate?, audioChannels?, audioFormat?, loop?: bool (values as in setRenderSettings / setOutputModule)}",
             can_add,
             add
         ),
@@ -1019,7 +1077,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Output Module Settings...",
             [],
             None,
-            "{item?|index?, module?: n (1 = first), template?: name, format?: h264|hevc|av1|prores|uncompressed|webm|png|jpeg|tiff|exr|gif|wav|aiff, channels?: rgb|rgba|alpha, color?: straight|premultiplied, quality?: 1-100, bitrate?: kbps, webmBitrate?: bool, keyframeInterval?: frames (0 = auto), proresProfile?: proxy|lt|standard|hq|4444|4444xq, profile?: main|main10 (HEVC/AV1), level?: auto|4.1, rateControl?: bitrate|quality, webmCodec?: vp9|av1, audioBitrate?: Opus kbps, opusApplication?: audio|voice, crop?: bool|{useRoi?, roi?, top?, left?, bottom?, right?}, cropTop?, cropLeft?, cropBottom?, cropRight?, resize?: bool|{preset?, width?, height?, lockAspect?, quality?: low|high}, resizeWidth?, resizeHeight?, postRenderAction?: none|import|importAndReplace|setProxy, includeProjectLink?: bool, audio?: auto|on|off, sampleRate?, audioChannels?: mono|stereo, audioFormat?: 16|24|32, loop?: bool, output?}",
+            "{item?|index?, module?: n (1 = first), template?: name, format?: h264|hevc|av1|prores|uncompressed|webm|png|jpeg|tiff|exr|tga|gif|wav|aiff, channels?: rgb|rgba|alpha, color?: straight|premultiplied, quality?: 1-100, bitrate?: kbps, webmBitrate?: bool, keyframeInterval?: frames (0 = auto), proresProfile?: proxy|lt|standard|hq|4444|4444xq, exrCompression?: none|rle|zips|zip|piz|pxr24|b44|b44a|dwaa|dwab (OpenEXR, scan lines; default zip; lossy: pxr24 on float, b44/b44a on half, dwaa/dwab), exrBitDepth?: half|float (OpenEXR; default float), profile?: main|main10 (HEVC/AV1), level?: auto|4.1, rateControl?: bitrate|quality, webmCodec?: vp9|av1, audioBitrate?: Opus kbps, opusApplication?: audio|voice, crop?: bool|{useRoi?, roi?, top?, left?, bottom?, right?}, cropTop?, cropLeft?, cropBottom?, cropRight?, resize?: bool|{preset?, width?, height?, lockAspect?, quality?: low|high}, resizeWidth?, resizeHeight?, postRenderAction?: none|import|importAndReplace|setProxy, includeProjectLink?: bool, audio?: auto|on|off, sampleRate?, audioChannels?: mono|stereo, audioFormat?: 16|24|32, loop?: bool, output?}",
             has_items,
             set_output_module
         ),
@@ -1037,7 +1095,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Output Module",
             ["Composition"],
             None,
-            "{item?|index? (default: the last item), format?, output?, channels?, quality?, bitrate?, proresProfile?, audio?}",
+            "{item?|index? (default: the last item), format?, output?, channels?, quality?, bitrate?, proresProfile?, exrCompression?, exrBitDepth?, audio?}",
             has_items,
             add_output_module
         ),
diff --git a/crates/engine/src/commands/rig3d.rs b/crates/engine/src/cmd/rig3d.rs
similarity index 98%
rename from crates/engine/src/commands/rig3d.rs
rename to crates/engine/src/cmd/rig3d.rs
index f034fa641..58a4281a8 100644
--- a/crates/engine/src/commands/rig3d.rs
+++ b/crates/engine/src/cmd/rig3d.rs
@@ -47,8 +47,19 @@ impl Env {
     fn of(s: &Session, cid: ItemId) -> Env {
         Env { time: s.time_of(cid), expr: s.expr.clone(), footage: s.footage.clone() }
     }
+    /// The evaluation context of `comp` in `proj` at the session's current time.
     fn ctx<'a>(&'a self, proj: &'a Project, cid: ItemId, comp: &'a Comp) -> EvalCtx<'a> {
-        EvalCtx { project: proj, comp_id: cid, comp, time: self.time, expr: self.expr.as_deref(), footage: Some(self.footage.as_ref()) }
+        EvalCtx {
+            project: proj,
+            comp_id: cid,
+            comp,
+            time: self.time,
+            expr: self.expr.as_deref(),
+            footage: Some(self.footage.as_ref()),
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: None,
+        }
     }
 }
 
@@ -268,7 +279,7 @@ fn stereo_rig(s: &mut Session, p: &Value) -> Result<Value> {
             set_expr(&mut cam, "cameraOptions/zoom", ze);
             cam.auto_orient = AutoOrient::TowardsPointOfInterest;
             let comp = proj.comp_mut(eid).ok_or(EngineError::NoComp)?;
-            comp.layers = vec![cam, nest];
+            comp.layers = vec![cam, nest].into();
             eye_comps.push(eid);
         }
         // The output comp: both eyes through 3D Glasses.
@@ -291,7 +302,7 @@ fn stereo_rig(s: &mut Session, p: &Value) -> Result<Value> {
             fxg.children.push(g.into());
         }
         let (lid, rid) = (left.id, right.id);
-        proj.comp_mut(oid).ok_or(EngineError::NoComp)?.layers = vec![left, right];
+        proj.comp_mut(oid).ok_or(EngineError::NoComp)?.layers = vec![left, right].into();
         st.project_selection = vec![oid];
         Ok(json!({
             "controls": ctl_id.0,
diff --git a/crates/engine/src/commands/roto_cmds.rs b/crates/engine/src/cmd/roto_cmds.rs
similarity index 90%
rename from crates/engine/src/commands/roto_cmds.rs
rename to crates/engine/src/cmd/roto_cmds.rs
index a6d389ca1..792c60019 100644
--- a/crates/engine/src/commands/roto_cmds.rs
+++ b/crates/engine/src/cmd/roto_cmds.rs
@@ -27,7 +27,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Roto Brush Stroke",
             [],
             None,
-            "{layer?, kind?: fg|bg|refine|refineErase, points: [[x, y], …] (layer pixels), frame? (layer frame; default current), radius? (layer px; default the tool's diameter / 2), effect?}",
+            "{layer?, kind?: fg|bg|refine|refineErase, points: [[x, y], …] (layer pixels), frame? (layer frame; default current), radius? (layer px; default the tool's diameter / 2), effect?, object? (0–31; default the current object: with a tracker each object is followed on its own and the mattes are united)}",
             has_comp,
             stroke
         ),
@@ -43,14 +43,22 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("roto.span", "Set Segmentation Span", [], None, "{layer?, effect?, start?, end? (layer frames)}", has_comp, span),
         cmd!("roto.freeze", "Freeze", [], None, "{layer?, effect?, wait?}", has_comp, freeze),
         cmd!("roto.unfreeze", "Unfreeze", [], None, "{layer?, effect?}", has_comp, unfreeze),
-        cmd!("roto.clearStrokes", "Remove Roto Brush Strokes", [], None, "{layer?, effect?, frame? (only this layer frame), kind?}", has_comp, clear_strokes),
+        cmd!(
+            "roto.clearStrokes",
+            "Remove Roto Brush Strokes",
+            [],
+            None,
+            "{layer?, effect?, frame? (only this layer frame), kind?, object? (only this object's strokes)}",
+            has_comp,
+            clear_strokes
+        ),
         cmd!("roto.cancel", "Stop Roto Brush", [], None, "{}", is_running, |s, _| Ok(json!({"stopped": s.stop_roto()}))),
         cmd!(
             "roto.options",
             "Roto Brush Options",
             [],
             None,
-            "{diameter?, refineDiameter?, view?: alphaBoundary|alpha|alphaOverlay|none, overlayColor?: [r,g,b], overlayOpacity?, boundaryColor?: [r,g,b], autoPropagate?}",
+            "{diameter?, refineDiameter?, view?: alphaBoundary|alpha|alphaOverlay|none, overlayColor?: [r,g,b], overlayOpacity?, boundaryColor?: [r,g,b], autoPropagate?, object? (the object new strokes belong to, 0–31)}",
             always,
             options
         ),
@@ -196,6 +204,8 @@ fn points_p(p: &Value, cmd: &str) -> Result<Vec<[f64; 2]>> {
 
 fn stroke(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "roto.stroke";
+    // A model unloaded for being idle comes back before the stroke is segmented with it.
+    s.reload_roto_model();
     let (cid, lid) = match roto_p(s, p, cmd) {
         Ok((c, l, _)) => (c, l),
         Err(_) => layer_p(s, p, cmd)?,
@@ -230,7 +240,8 @@ fn stroke(s: &mut Session, p: &Value) -> Result<Value> {
     if existing.is_none() && !kind.is_segmentation() {
         return Err(bad(cmd, "draw a foreground stroke with the Roto Brush tool first"));
     }
-    let st = Stroke { kind, frame, radius, points };
+    let object = f_p(p, "object").map_or(s.state.roto.object, |v| v.clamp(0.0, rt::MAX_OBJECT_ID as f64).round() as u32);
+    let st = Stroke { kind, frame, radius, points, object };
     let label = if kind.is_segmentation() { "Roto Brush Stroke" } else { "Refine Edge Stroke" };
     let (uid, d) = s.edit(label, None, |proj, _| {
         let mut next = proj.next_id;
@@ -261,7 +272,7 @@ fn stroke(s: &mut Session, p: &Value) -> Result<Value> {
         s.state.selected_layers = vec![lid];
     }
     Ok(json!({
-        "layer": lid.0, "effect": uid, "frame": frame, "kind": kind, "radius": radius,
+        "layer": lid.0, "effect": uid, "frame": frame, "kind": kind, "radius": radius, "object": object,
         "base": d.base, "span": d.span, "strokes": d.strokes.len(),
     }))
 }
@@ -367,8 +378,20 @@ fn clear_strokes(s: &mut Session, p: &Value) -> Result<Value> {
         Some(k) => Some(StrokeKind::from_name(k).ok_or_else(|| bad(cmd, format!("unknown kind `{k}`")))?),
         None => None,
     };
+    let object = match p.get("object") {
+        None => None,
+        Some(value) => {
+            let value = value
+                .as_f64()
+                .filter(|v| v.is_finite() && (0.0..=rt::MAX_OBJECT_ID as f64).contains(v))
+                .ok_or_else(|| bad(cmd, format!("`object` is 0–{}", rt::MAX_OBJECT_ID)))?;
+            Some(value.round() as u32)
+        }
+    };
     let n0 = d.strokes.len();
-    d.strokes.retain(|st| !(frame.is_none_or(|f| st.frame == f) && kind.is_none_or(|k| st.kind == k)));
+    d.strokes.retain(|st| {
+        !(frame.is_none_or(|f| st.frame == f) && kind.is_none_or(|k| st.kind == k) && object.is_none_or(|o| st.kind.is_segmentation() && st.object == o))
+    });
     if d.strokes.iter().all(|s| !s.kind.is_segmentation()) {
         d.base = None;
     } else if d.base.is_some_and(|b| !d.strokes.iter().any(|s| s.frame == b && s.kind.is_segmentation())) {
@@ -410,6 +433,9 @@ fn options(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(b) = b_p(p, "autoPropagate") {
         o.auto_propagate = b;
     }
+    if let Some(v) = f_p(p, "object") {
+        o.object = v.clamp(0.0, rt::MAX_OBJECT_ID as f64).round() as u32;
+    }
     s.state.roto = o.clone();
     Ok(serde_json::to_value(o).unwrap_or(Value::Null))
 }
@@ -428,9 +454,13 @@ fn status(s: &mut Session, p: &Value) -> Result<Value> {
     out["base"] = json!(d.base);
     out["span"] = json!(d.span);
     out["strokes"] = json!(d.strokes.len());
+    out["objects"] = json!(d.objects().iter().map(|o| json!({"id": o, "strokes": d.strokes.iter().filter(|s| s.object == *o).count()})).collect::<Vec<_>>());
+    out["currentObject"] = json!(s.state.roto.object);
     out["strokeFrames"] = json!(d.stroke_frames());
     out["frozen"] = json!(frozen_of(&g));
     out["pending"] = json!(s.roto_pending.contains(&(cid, lid, uid)));
+    // The model Settings chose and whether this layer segments with it (propagate refuses or waits otherwise).
+    out["model"] = s.roto_model();
     out["limits"] = json!(rt::frame_limits(&comp, &layer));
     let frame = frame_p(s, p, cid, &layer);
     out["frame"] = json!(frame);
@@ -441,7 +471,7 @@ fn status(s: &mut Session, p: &Value) -> Result<Value> {
         let fps = comp.frame_rate.as_f64();
         let ps = params_static(&g);
         let chain = fx::Chain::new(&ps, size, fps, 1.0);
-        let seg = match chain.keys.get(&frame).and_then(|k| fx::cached(*k, 1.0)) {
+        let seg = match chain.cached_seg(frame, 1.0) {
             Some(sg) => Some(sg),
             None if compute => {
                 let index = layer.effects().and_then(|f| f.groups().position(|x| x.uid == uid)).unwrap_or(0);
@@ -463,6 +493,28 @@ fn status(s: &mut Session, p: &Value) -> Result<Value> {
             }
         }
     }
+    // Where each frame's matte came from, and how far to trust it: frames a tracker followed
+    // report its confidence and whether the object was absent; frames the model segmented on
+    // their own report "model"; the rest came from the classic engine.
+    {
+        let size = rt::layer_size(&s.project, &comp, &layer);
+        let chain = fx::Chain::new(&params_static(&g), size, comp.frame_rate.as_f64(), 1.0);
+        let tracked: serde_json::Map<String, Value> = chain
+            .keys
+            .keys()
+            .filter_map(|f| chain.trust_at(*f).map(|t| (f.to_string(), json!({"confidence": t.confidence, "occluded": t.occluded}))))
+            .collect();
+        out["tracker"] = json!({"model": s.models_roto_active(), "device": fx::installed_model().and_then(|m| m.device_name()), "saved": chain.saved_model(), "frames": tracked});
+        let notice = s.roto_model_notice(s.uses_roto_model(cid, lid, uid)).or_else(|| s.saved_tracking_notice(chain.saved_model()));
+        out["notice"] = json!(notice);
+        out["source"] = json!(if tracked.contains_key(&frame.to_string()) {
+            "tracker"
+        } else if chain.model.is_some() {
+            "model"
+        } else {
+            "classical"
+        });
+    }
     let computed = s.roto_computed(cid, lid, uid);
     out["computed"] = json!(computed.iter().filter(|(_, c)| **c).map(|(f, _)| *f).collect::<Vec<_>>());
     Ok(out)
diff --git a/crates/engine/src/commands/scene_detect.rs b/crates/engine/src/cmd/scene_detect.rs
similarity index 100%
rename from crates/engine/src/commands/scene_detect.rs
rename to crates/engine/src/cmd/scene_detect.rs
diff --git a/crates/engine/src/cmd/schema.rs b/crates/engine/src/cmd/schema.rs
new file mode 100644
index 000000000..c74ab277e
--- /dev/null
+++ b/crates/engine/src/cmd/schema.rs
@@ -0,0 +1,119 @@
+use super::params::bad;
+use super::{CommandSpec, Result, Value};
+
+// ---------- parameter validation (agents) ----------
+
+/// Top-level keys accepted by a params doc such as `{layers: [id|name|#n], add?, toggle?}` or
+/// `{time? (s) | frame? | timecode?}`; `None` when the doc isn't a `{…}` key list.
+pub fn accepted_params(doc: &str) -> Option<Vec<String>> {
+    let body = doc.trim().strip_prefix('{')?;
+    // Top-level pieces up to the matching close brace, split at `,` and `|`; `:` starts a value.
+    let (mut keys, mut cur, mut depth, mut in_value) = (Vec::new(), String::new(), 0i32, false);
+    let push = |cur: &mut String, keys: &mut Vec<String>| {
+        let k: String = cur.trim().chars().take_while(|c| c.is_ascii_alphanumeric() || *c == '_').collect();
+        if !k.is_empty() && !keys.contains(&k) {
+            keys.push(k);
+        }
+        cur.clear();
+    };
+    for c in body.chars() {
+        match c {
+            '{' | '[' | '(' => depth += 1,
+            ']' | ')' => depth -= 1,
+            '}' if depth == 0 => {
+                push(&mut cur, &mut keys);
+                return Some(keys);
+            }
+            '}' => depth -= 1,
+            ',' if depth == 0 => {
+                push(&mut cur, &mut keys);
+                in_value = false;
+            }
+            '|' if depth == 0 && !in_value => push(&mut cur, &mut keys),
+            ':' if depth == 0 => {
+                push(&mut cur, &mut keys);
+                in_value = true;
+            }
+            _ if depth == 0 && !in_value => cur.push(c),
+            _ => {}
+        }
+    }
+    None
+}
+
+/// Top-level pieces of a params doc (split at depth-0 commas), e.g. `{layer?, path|prop, value}`
+/// → `["layer?", "path|prop", "value"]`.
+fn doc_pieces(doc: &str) -> Option<Vec<String>> {
+    let body = doc.trim().strip_prefix('{')?;
+    let (mut out, mut cur, mut depth) = (Vec::new(), String::new(), 0i32);
+    for c in body.chars() {
+        match c {
+            '{' | '[' | '(' => depth += 1,
+            ']' | ')' => depth -= 1,
+            '}' if depth == 0 => {
+                if !cur.trim().is_empty() {
+                    out.push(cur.trim().to_string());
+                }
+                return Some(out);
+            }
+            '}' => depth -= 1,
+            ',' if depth == 0 => {
+                if !cur.trim().is_empty() {
+                    out.push(cur.trim().to_string());
+                }
+                cur.clear();
+                continue;
+            }
+            _ => {}
+        }
+        cur.push(c);
+    }
+    None
+}
+
+/// The JSON Schema of a command's parameters, derived from its params doc: one property per
+/// accepted key (described by its piece of the doc), no others. MCP `describe_command` and
+/// `list_commands {schemas: true}` serve it.
+pub fn params_schema(spec: &CommandSpec) -> Value {
+    let mut props = serde_json::Map::new();
+    let mut required = vec![];
+    for piece in doc_pieces(spec.params).unwrap_or_default() {
+        let keys = accepted_params(&format!("{{{piece}}}")).unwrap_or_default();
+        let alternatives = keys.len() > 1;
+        for k in keys {
+            // `key?` is optional; so is any key with alternatives (`path|prop`).
+            let optional = alternatives || piece.contains(&format!("{k}?"));
+            if !optional && !required.contains(&k) {
+                required.push(k.clone());
+            }
+            props.insert(k, serde_json::json!({"description": piece}));
+        }
+    }
+    serde_json::json!({
+        "type": "object",
+        "description": spec.params,
+        "properties": props,
+        "required": required,
+        "additionalProperties": accepted_params(spec.params).is_none(),
+    })
+}
+
+/// Keys every command understands (comp targeting, gesture merging) and accepted aliases.
+const ALWAYS_OK: &[&str] = &["comp", "merge"];
+
+const ALIASES: &[(&str, &str)] = &[("layers", "layer"), ("layer", "layers"), ("time", "frame"), ("frameRate", "fps"), ("properties", "property")];
+
+/// Reject unknown top-level parameters (typos, guessed names) with the list of accepted keys.
+pub fn check_params(spec: &CommandSpec, params: &Value) -> Result<()> {
+    let (Some(obj), Some(accepted)) = (params.as_object(), accepted_params(spec.params)) else { return Ok(()) };
+    let ok = |k: &str| ALWAYS_OK.contains(&k) || accepted.iter().any(|a| a == k || ALIASES.iter().any(|(doc, alias)| doc == a && *alias == k));
+    let unknown: Vec<&str> = obj.keys().map(String::as_str).filter(|k| !ok(k)).collect();
+    if unknown.is_empty() {
+        return Ok(());
+    }
+    let list = if accepted.is_empty() { "none".to_string() } else { accepted.join(", ") };
+    Err(bad(
+        spec.id,
+        format!("unknown parameter(s) {}; accepted: {list} (doc: {})", unknown.iter().map(|k| format!("`{k}`")).collect::<Vec<_>>().join(", "), spec.params),
+    ))
+}
diff --git a/crates/engine/src/cmd/scripts.rs b/crates/engine/src/cmd/scripts.rs
new file mode 100644
index 000000000..8c14e03ec
--- /dev/null
+++ b/crates/engine/src/cmd/scripts.rs
@@ -0,0 +1,1134 @@
+//! File ▸ Scripts and ScriptUI.
+//!
+//! * **Installed scripts** live in the settings store under `Scripts/` (File ▸ Scripts ▸ Install
+//!   Script File…) and `Scripts/ScriptUI Panels/` (Install ScriptUI Panel…), next to the
+//!   settings on the desktop, so dropping `.jsx` files in those folders works too. File ▸ Scripts
+//!   lists them with the bundled sample scripts and extensions ([`BUNDLED`]) and runs them by name; ScriptUI
+//!   panels appear at the bottom of the Window menu and open as dockable panels
+//!   (`window.scriptPanel`), running with `this` = the panel as in After Effects. A subfolder of
+//!   either folder (one level) is a submenu named after it; its scripts are named `Folder/File.jsx`.
+//! * **Startup and Shutdown scripts** in `Scripts/Startup/` and `Scripts/Shutdown/` run by
+//!   themselves, in alphabetical order: at launch (`file.runStartupScripts`) and as EffectCraft
+//!   quits, after the project is closed (`file.runShutdownScripts`).
+//! * **ScriptUI windows** (`scriptui.*`): list the open script windows, read their control
+//!   trees, click buttons and set values like a user, close them (see [`crate::scriptui`]).
+//! * **Script settings** (`script.settings.*`): After Effects' `app.settings`, string values by
+//!   section and key that last between runs ([`SCRIPT_SETTINGS_FILE`]).
+
+use std::collections::BTreeMap;
+
+use serde::Serialize;
+use serde_json::{Value, json};
+
+use super::{CommandSpec, always, bad, str_p};
+use crate::{EngineError, Event, Result, Session, cmd, scriptui};
+
+/// The settings-store folders of installed scripts.
+pub const SCRIPTS_DIR: &str = "Scripts";
+pub const PANELS_DIR: &str = "Scripts/ScriptUI Panels";
+/// The settings-store folders whose scripts run at launch and as EffectCraft quits.
+pub const STARTUP_DIR: &str = "Scripts/Startup";
+pub const SHUTDOWN_DIR: &str = "Scripts/Shutdown";
+/// Commands that run script files or script code (a ScriptUI panel runs its script when it
+/// opens). Scripts and batches can't run them, and confined automation sessions refuse them.
+pub const RUNS_SCRIPTS: &[&str] =
+    &["script.run", "file.runScript", "file.runStartupScripts", "file.runShutdownScripts", "window.scriptPanel", "window.restoreScriptPanels"];
+/// Largest script file the Startup and Shutdown folders run (bytes), as `#include` and
+/// `$.evalFile` allow.
+const MAX_SCRIPT_BYTES: usize = 16 << 20;
+/// Modal dialogs a Shutdown script may open one after another; each closes as if canceled.
+const MAX_SHUTDOWN_DIALOGS: usize = 64;
+/// [`PANELS_DIR`]'s name in [`SCRIPTS_DIR`]: it holds the panels, so it is not a folder of scripts.
+const PANELS_FOLDER: &str = "ScriptUI Panels";
+/// Subfolders of Scripts that hold scripts the app runs itself (panels; launch and quit, as in
+/// After Effects): never listed as File ▸ Scripts submenus.
+const RESERVED_FOLDERS: [&str; 3] = [PANELS_FOLDER, "Startup", "Shutdown"];
+/// The ScriptUI panels open when EffectCraft last quit (settings store), reopened at launch.
+pub const OPEN_PANELS_FILE: &str = "scriptui_panels.json";
+/// Scripts' `app.settings` in the settings store: `{section: {key: value}}`, as After Effects
+/// keeps them in its preferences.
+pub const SCRIPT_SETTINGS_FILE: &str = "script_settings.json";
+/// User presets of the core Ease Presets panel of v0.6.0 (#254) and where the Ease Presets
+/// ScriptUI panel that replaced it keeps them: (file, section, key). The file's text moves there
+/// unchanged (the panel reads the same JSON) the first time settings load.
+const LEGACY_EASE_PRESETS: (&str, &str, &str) = ("ease_presets.json", "Ease Presets", "userPresets");
+/// Longest section, key and value a script may store (characters / bytes).
+const MAX_SETTING_NAME: usize = 256;
+const MAX_SETTING_VALUE: usize = 1 << 20;
+
+/// Scripts' `app.settings`: values by section and key.
+pub type ScriptSettings = BTreeMap<String, BTreeMap<String, String>>;
+
+/// Load scripts' settings from the settings store (a corrupt file gives none), moving user ease
+/// presets saved before Ease Presets became a ScriptUI panel into its section.
+pub(crate) fn load_script_settings(s: &mut Session) {
+    let Some(cfg) = s.config.clone() else { return };
+    s.script_settings = cfg
+        .read(SCRIPT_SETTINGS_FILE)
+        .and_then(|t| serde_json::from_str(&t).map_err(|e| log::warn!("{SCRIPT_SETTINGS_FILE} is not valid ({e}); scripts start without their settings")).ok())
+        .unwrap_or_default();
+    let (file, section, key) = LEGACY_EASE_PRESETS;
+    if let Some(text) = cfg.read(file)
+        && !s.script_settings.get(section).is_some_and(|m| m.contains_key(key))
+    {
+        s.script_settings.entry(section.into()).or_default().insert(key.into(), text);
+        if let Err(e) = store_script_settings(s) {
+            log::warn!("cannot move {file} into the Ease Presets panel's settings: {e}");
+        }
+    }
+}
+
+fn store_script_settings(s: &Session) -> Result<()> {
+    let Some(cfg) = &s.config else { return Ok(()) };
+    let text = serde_json::to_string_pretty(&s.script_settings).map_err(|e| EngineError::Other(format!("script settings: {e}")))?;
+    cfg.write(SCRIPT_SETTINGS_FILE, &text).map_err(|e| EngineError::Other(format!("cannot save script settings: {e}")))
+}
+
+fn setting_name<'a>(p: &'a Value, k: &str, c: &str) -> Result<&'a str> {
+    let v = str_p(p, k).ok_or_else(|| bad(c, format!("missing `{k}`")))?;
+    if v.chars().count() > MAX_SETTING_NAME {
+        return Err(bad(c, format!("`{k}` is longer than {MAX_SETTING_NAME} characters")));
+    }
+    Ok(v)
+}
+
+/// `script.settings.get {section, key}` → `{have, value}` (`value` "" when there is none).
+fn settings_get(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "script.settings.get";
+    let (section, key) = (setting_name(p, "section", C)?, setting_name(p, "key", C)?);
+    let v = s.script_settings.get(section).and_then(|m| m.get(key));
+    Ok(json!({"have": v.is_some(), "value": v.cloned().unwrap_or_default()}))
+}
+
+/// `script.settings.save {section, key, value}`: kept in the settings store.
+fn settings_save(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "script.settings.save";
+    let (section, key) = (setting_name(p, "section", C)?, setting_name(p, "key", C)?);
+    let value = match p.get("value") {
+        Some(Value::String(v)) => v.clone(),
+        Some(v) if !v.is_null() => v.to_string(),
+        _ => return Err(bad(C, "missing `value`")),
+    };
+    if value.len() > MAX_SETTING_VALUE {
+        return Err(bad(C, format!("`value` is larger than {MAX_SETTING_VALUE} bytes")));
+    }
+    s.script_settings.entry(section.into()).or_default().insert(key.into(), value);
+    store_script_settings(s)?;
+    Ok(Value::Null)
+}
+
+/// Scripts that ship with EffectCraft (original work): (file name, ScriptUI panel, source, code).
+/// `sample`s show how to script EffectCraft; `extension`s (in `extensions/`) are optional tools
+/// built on the public scripting API, outside the core, like third-party scripts in After Effects.
+pub const BUNDLED: &[(&str, bool, &str, &str)] = &[
+    ("Create Null at Selected Layers.jsx", false, "sample", include_str!("../../scripts/Create Null at Selected Layers.jsx")),
+    ("Rename Layers.jsx", false, "sample", include_str!("../../scripts/Rename Layers.jsx")),
+    ("Render Queue Batch.jsx", false, "sample", include_str!("../../scripts/Render Queue Batch.jsx")),
+    ("Sort Layers by In Point.jsx", false, "sample", include_str!("../../scripts/Sort Layers by In Point.jsx")),
+    ("Layer Tools.jsx", true, "sample", include_str!("../../scripts/ScriptUI Panels/Layer Tools.jsx")),
+    ("Ease Presets.jsx", true, "extension", include_str!("../../../../extensions/scriptui-panels/Ease Presets.jsx")),
+];
+
+/// A script File ▸ Scripts (or the Window menu, for panels) offers.
+#[derive(Clone, Debug, PartialEq, Serialize)]
+pub struct ScriptEntry {
+    /// File name (`Rename Layers.jsx`), or `Folder/File.jsx` in a subfolder: what commands take.
+    pub name: String,
+    /// In the ScriptUI Panels folder: opens as a dockable panel.
+    pub panel: bool,
+    /// `installed`, `sample` or `extension` (bundled, see [`BUNDLED`]).
+    pub source: &'static str,
+}
+
+/// Whether `name` ends in `.jsx` or `.js` (any letter case).
+fn is_script(name: &str) -> bool {
+    let l = name.to_ascii_lowercase();
+    l.ends_with(".jsx") || l.ends_with(".js")
+}
+
+/// Whether `name` can name an installed script: a file name, or `Folder/File` for one in a
+/// subfolder of a Scripts folder (one level, and not one of [`RESERVED_FOLDERS`]: `ScriptUI
+/// Panels/…`, `Startup/…`, `Shutdown/…`). Each part is a bare name, never a path (names are joined onto the Scripts folders of
+/// the settings store, which takes them as relative paths), and on Windows none of the names
+/// [`windows_unsafe_name`] lists.
+fn is_script_name(name: &str) -> bool {
+    let part = |n: &str| is_bare_name(n) && !(cfg!(windows) && windows_unsafe_name(n));
+    match name.split_once('/') {
+        Some((folder, file)) => part(folder) && part(file) && !RESERVED_FOLDERS.iter().any(|r| folder.eq_ignore_ascii_case(r)),
+        None => part(name),
+    }
+}
+
+/// One path component on every platform: not empty, `.` or `..`, and without `/`, `\` or NUL.
+pub(crate) fn is_bare_name(name: &str) -> bool {
+    !name.is_empty() && name != "." && name != ".." && !name.contains(['/', '\\', '\0'])
+}
+
+/// Names that are not ordinary file names on Windows (elsewhere they are): with `:` (a drive or a
+/// stream), ending in `.` or a space (Windows drops them), or a device name, which names a device
+/// in any folder and with any extension (`con.jsx`): `CON`, `PRN`, `AUX`, `NUL`, `CONIN$`,
+/// `CONOUT$`, `COM0`–`COM9` and `LPT0`–`LPT9` (also with `¹²³`).
+pub(crate) fn windows_unsafe_name(name: &str) -> bool {
+    let stem = name.split('.').next().unwrap_or_default().trim_end_matches(' ').to_ascii_uppercase();
+    let port = |p: &str| {
+        let mut n = stem.strip_prefix(p).unwrap_or_default().chars();
+        matches!((n.next(), n.next()), (Some('0'..='9' | '¹' | '²' | '³'), None))
+    };
+    let device = matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$") || port("COM") || port("LPT");
+    name.contains(':') || name.ends_with(['.', ' ']) || device
+}
+
+/// Installed scripts and panels, then the bundled ones not shadowed by an installed one, by name.
+pub fn scripts(s: &Session) -> Vec<ScriptEntry> {
+    let mut v: Vec<ScriptEntry> = vec![];
+    if let Some(cfg) = &s.config {
+        for (dir, panel) in [(SCRIPTS_DIR, false), (PANELS_DIR, true)] {
+            // The folder itself, then each subfolder, whose scripts are named `Folder/File.jsx`.
+            let subfolders = cfg.list_dirs(dir).into_iter().map(|f| (format!("{dir}/{f}"), format!("{f}/")));
+            for (folder, prefix) in std::iter::once((dir.to_string(), String::new())).chain(subfolders) {
+                let names = cfg.list(&folder).into_iter().map(|n| format!("{prefix}{n}"));
+                for n in names.filter(|n| is_script(n) && is_script_name(n)) {
+                    v.push(ScriptEntry { name: n, panel, source: "installed" });
+                }
+            }
+        }
+    }
+    for (name, panel, source, _) in BUNDLED {
+        if !v.iter().any(|e| e.name == *name && e.panel == *panel) {
+            v.push(ScriptEntry { name: name.to_string(), panel: *panel, source });
+        }
+    }
+    v.sort_by(|a, b| a.panel.cmp(&b.panel).then(a.name.to_lowercase().cmp(&b.name.to_lowercase())));
+    v
+}
+
+/// The code of an installed or bundled script / panel.
+pub fn script_code(s: &Session, name: &str, panel: Option<bool>) -> Option<(bool, String)> {
+    if !is_script(name) || !is_script_name(name) {
+        return None;
+    }
+    if let Some(cfg) = &s.config {
+        for (dir, is_panel) in [(SCRIPTS_DIR, false), (PANELS_DIR, true)] {
+            if panel.is_some_and(|p| p != is_panel) {
+                continue;
+            }
+            if let Some(code) = cfg.read(&format!("{dir}/{name}")) {
+                return Some((is_panel, code));
+            }
+        }
+    }
+    BUNDLED.iter().find(|(n, p, ..)| *n == name && panel.is_none_or(|w| w == *p)).map(|(_, p, _, c)| (*p, c.to_string()))
+}
+
+fn install(s: &mut Session, p: &Value, panel: bool) -> Result<Value> {
+    let c = if panel { "file.installScriptUIPanel" } else { "file.installScript" };
+    let path = str_p(p, "path").ok_or_else(|| bad(c, "missing `path` (a .jsx / .js script)"))?;
+    let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
+    if !is_script(&name) {
+        return Err(bad(c, "scripts are .jsx or .js files (.jsxbin is not supported)"));
+    }
+    // A name it could not be run or uninstalled by (`\` is a file-name character on Unix).
+    if !is_script_name(&name) {
+        return Err(bad(c, format!("`{name}` is not a script file name")));
+    }
+    let bytes = s.services.read_file(path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
+    let code = String::from_utf8(bytes).map_err(|_| bad(c, "the script is not UTF-8 text"))?;
+    let cfg = s.config.clone().ok_or_else(|| EngineError::Other("this session has no settings folder to install scripts into".into()))?;
+    let dir = if panel { PANELS_DIR } else { SCRIPTS_DIR };
+    cfg.write(&format!("{dir}/{name}"), &code).map_err(|e| EngineError::Other(format!("cannot install {name}: {e}")))?;
+    s.scripts_changed();
+    // After Effects asks for a restart; our menus pick it up at once.
+    s.toast(if panel {
+        format!("Installed ScriptUI panel {name}: find it at the bottom of the Window menu")
+    } else {
+        format!("Installed script {name}: find it in File ▸ Scripts")
+    });
+    Ok(json!({"name": name, "panel": panel}))
+}
+
+fn list(s: &mut Session, _: &Value) -> Result<Value> {
+    Ok(json!(scripts(s)))
+}
+
+/// `file.uninstallScript {name}`: delete an installed script or panel at the top of the Scripts
+/// folders.
+fn uninstall(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "file.uninstallScript";
+    let name = str_p(p, "name").ok_or_else(|| bad(c, "missing `name`"))?;
+    if !is_script(name) || !is_script_name(name) {
+        return Err(bad(c, format!("`{name}` is not a script file name")));
+    }
+    // A subfolder can be a link to files outside the settings folder (an extension's own
+    // folder), so only what Install puts at the top is removed, never a file through a folder.
+    if name.contains('/') {
+        return Err(bad(c, format!("`{name}` is in a subfolder: delete it there yourself (only scripts at the top of the Scripts folders are uninstalled)")));
+    }
+    let cfg = s.config.clone().ok_or_else(|| bad(c, "no settings folder"))?;
+    let mut removed = false;
+    for dir in [SCRIPTS_DIR, PANELS_DIR] {
+        let key = format!("{dir}/{name}");
+        if cfg.read(&key).is_some() {
+            cfg.remove(&key).map_err(|e| EngineError::Other(e.to_string()))?;
+            removed = true;
+        }
+    }
+    s.scripts_changed();
+    if removed { Ok(json!({"removed": name})) } else { Err(bad(c, format!("`{name}` is not installed"))) }
+}
+
+/// Run an installed or bundled script by name (File ▸ Scripts ▸ `<name>`). A ScriptUI panel run
+/// this way gets `this` = a floating palette-like panel window. A script listed under File ▸
+/// Scripts runs before a panel of the same name.
+pub(crate) fn run_named(s: &mut Session, name: &str) -> Result<Value> {
+    let found = script_code(s, name, Some(false)).or_else(|| script_code(s, name, None));
+    let (panel, code) = found.ok_or_else(|| bad("file.runScript", format!("no installed or bundled script `{name}`")))?;
+    if panel {
+        return open_panel(s, &json!({"name": name}));
+    }
+    let result = super::file_more::run_js_named(s, &code, name)?;
+    super::file_more::remember_script(s, crate::prefs::RecentScript::Name(name.to_string()));
+    Ok(result)
+}
+
+/// The code a ScriptUI panel runs with: `this` is a dockable Panel titled after the script.
+pub fn panel_wrapper(title: &str, code: &str) -> String {
+    // On one line, so line numbers in errors stay those of the file.
+    format!("(function () {{ {code}\n}}).call(__uiDockPanel({}));", Value::String(title.to_string()))
+}
+
+/// The ScriptUI panels open now (script names).
+pub(crate) fn open_panel_names(s: &Session) -> Vec<String> {
+    s.script_ui.windows.iter().filter(|w| w.kind == scriptui::WindowKind::Panel).map(|w| w.script.clone()).collect()
+}
+
+/// The panels open when EffectCraft last quit (`{"open": [names]}`); a missing or unreadable
+/// file is none.
+fn remembered_panels(s: &Session) -> Vec<String> {
+    let text = s.config.as_ref().and_then(|c| c.read(OPEN_PANELS_FILE)).unwrap_or_default();
+    let doc: Value = serde_json::from_str(&text).unwrap_or(Value::Null);
+    doc.get("open").and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_str).filter(|n| is_script(n)).map(str::to_string).collect()
+}
+
+/// Change the remembered panels with `f` (written only when it changed). The list is kept so
+/// the next launch reopens them, as After Effects reopens the panels of its workspace; quitting
+/// leaves it as it is.
+fn edit_remembered_panels(s: &Session, f: impl FnOnce(&mut Vec<String>)) {
+    let Some(cfg) = &s.config else { return };
+    let before = remembered_panels(s);
+    let mut list = before.clone();
+    f(&mut list);
+    if list != before
+        && let Err(e) = cfg.write(OPEN_PANELS_FILE, &json!({"open": list}).to_string())
+    {
+        log::warn!("cannot remember the open ScriptUI panels: {e}");
+    }
+}
+
+/// Forget the panels of `before` (open before a script window event) that are closed now.
+pub(crate) fn forget_closed_panels(s: &Session, before: &[String]) {
+    let now = open_panel_names(s);
+    let closed: Vec<&String> = before.iter().filter(|n| !now.contains(n)).collect();
+    if !closed.is_empty() {
+        edit_remembered_panels(s, |l| l.retain(|n| !closed.contains(&n)));
+    }
+}
+
+/// `window.restoreScriptPanels`: open the ScriptUI panels that were open when EffectCraft last
+/// quit (frontends call it once at launch). Panels whose script is gone or fails are reported
+/// and forgotten; the others still open.
+fn restore_panels(s: &mut Session, _: &Value) -> Result<Value> {
+    let (mut opened, mut failed) = (vec![], vec![]);
+    for name in remembered_panels(s) {
+        let r = match script_code(s, &name, Some(true)) {
+            Some(_) => open_panel(s, &json!({"name": name})).map_err(|e| e.to_string()),
+            None => Err("no such ScriptUI panel".to_string()),
+        };
+        match r {
+            Ok(_) => opened.push(name),
+            Err(error) => {
+                edit_remembered_panels(s, |l| l.retain(|n| *n != name));
+                failed.push(json!({"name": name, "error": error}));
+            }
+        }
+    }
+    Ok(json!({"opened": opened, "failed": failed}))
+}
+
+/// Run the scripts in `dir` of the settings store one after another, in alphabetical order (case
+/// ignored), as After Effects runs its Startup and Shutdown folders. A script that fails is
+/// reported in a toast and the log and listed in `failed`; the next one still runs. A script waiting in a
+/// modal dialog is listed in `waiting` and goes on when the dialog closes; the next one runs
+/// meanwhile. With `quitting`, no window is left to show a dialog in, so each dialog closes as
+/// if canceled (`show()` returns 2) and the script runs on.
+fn run_folder(s: &mut Session, dir: &str, quitting: bool) -> Value {
+    let mut names: Vec<String> = s.config.as_ref().map(|c| c.list(dir)).unwrap_or_default().into_iter().filter(|n| is_script(n) && is_script_name(n)).collect();
+    names.sort_by(|a, b| a.to_lowercase().cmp(&b.to_lowercase()).then_with(|| a.cmp(b)));
+    let (mut ran, mut waiting, mut failed) = (vec![], vec![], vec![]);
+    for name in names {
+        let code = match s.config.as_ref().map(|c| c.read_bounded(&format!("{dir}/{name}"), MAX_SCRIPT_BYTES)) {
+            Some(Ok(Some(code))) => code,
+            read => {
+                let why = match read {
+                    Some(Err(e)) => format!(": {e}"),
+                    _ => String::new(),
+                };
+                let error = format!("{name}: cannot read the script{why}");
+                log::warn!("{dir}: {error}");
+                s.events.push(Event::Toast { message: error.clone(), error: true });
+                failed.push(json!({"name": name, "error": error}));
+                continue;
+            }
+        };
+        let is_waiting = |r: &Result<Value>| r.as_ref().is_ok_and(|v| v.get("waiting").and_then(Value::as_bool) == Some(true));
+        // In a settings folder on disk, the script runs as its file, so `#include`, `$.fileName`
+        // and `$.evalFile` find the files beside it.
+        let path = s.config.as_ref().and_then(|c| c.dir()).map(|d| d.join(dir).join(&name).to_string_lossy().into_owned()).unwrap_or_else(|| name.clone());
+        // Windows open before this script runs belong to other scripts, perhaps of the same name.
+        let before: Vec<u32> = s.script_ui.windows.iter().map(|w| w.id).collect();
+        let hosts_before = s.script_ui.task_hosts.clone();
+        let mut r = super::file_more::run_js_file(s, &code, &path, &name);
+        if !quitting {
+            // The Startup script's context: the one that scheduled tasks or holds the windows it
+            // opened (a task scheduled after its dialog closes runs there too).
+            let tasks = s.script_ui.task_hosts.iter().filter(|h| !hosts_before.contains(h)).copied();
+            let windows = s.script_ui.windows.iter().filter(|w| !before.contains(&w.id)).map(|w| w.host);
+            let hosts: Vec<u32> = tasks.chain(windows).collect();
+            for h in hosts {
+                if !s.script_ui.startup_hosts.contains(&h) {
+                    s.script_ui.startup_hosts.push(h);
+                }
+            }
+        }
+        let mut closed = 0;
+        while quitting && closed < MAX_SHUTDOWN_DIALOGS && is_waiting(&r) {
+            let Some(id) = s.script_ui.windows.iter().rev().find(|w| w.modal && w.script == path && !before.contains(&w.id)).map(|w| w.id) else { break };
+            // report_js reports an error the script throws after its dialog closes, as it does for an
+            // error in the script's first run.
+            r = scriptui::close(s, &json!({"window": id})).and_then(|out| super::file_more::report_js(s, &name, out));
+            closed += 1;
+        }
+        match r {
+            Ok(_) if is_waiting(&r) => waiting.push(name),
+            Ok(_) => ran.push(name),
+            Err(e) => {
+                // Also in the log: no frame draws a Shutdown script's toast.
+                log::warn!("{dir}: {e}");
+                failed.push(json!({"name": name, "error": e.to_string()}));
+            }
+        }
+    }
+    json!({"ran": ran, "waiting": waiting, "failed": failed})
+}
+
+/// `file.runStartupScripts`: run the scripts in `Scripts/Startup` (frontends call it once at
+/// launch, before a project opens).
+fn run_startup(s: &mut Session, _: &Value) -> Result<Value> {
+    Ok(run_folder(s, STARTUP_DIR, false))
+}
+
+/// `file.runShutdownScripts`: close the project, then run the scripts in `Scripts/Shutdown`
+/// (frontends call it as the app quits, after the unsaved-changes prompt).
+fn run_shutdown(s: &mut Session, _: &Value) -> Result<Value> {
+    s.replace_project(effectcraft_project::Project::default(), None);
+    Ok(run_folder(s, SHUTDOWN_DIR, true))
+}
+
+/// Window ▸ `<ScriptUI panel>`: run the panel script (or bring its panel forward).
+fn open_panel(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "window.scriptPanel";
+    let name = str_p(p, "name").ok_or_else(|| bad(c, "missing `name` (a script in the ScriptUI Panels folder)"))?.to_string();
+    let file = name.rsplit_once('/').map_or(name.as_str(), |(_, f)| f);
+    let title = file.trim_end_matches(".jsx").trim_end_matches(".js").to_string();
+    if let Some(w) = s.script_ui.windows.iter().find(|w| w.kind == scriptui::WindowKind::Panel && w.script == name) {
+        let id = w.id;
+        s.events.push(Event::Frontend { command: c.into(), params: json!({"window": id}) });
+        return Ok(json!({"window": id, "open": true}));
+    }
+    // Only panels: a script opened as one would be remembered, then forgotten at the next launch.
+    let (_, code) = script_code(s, &name, Some(true)).ok_or_else(|| bad(c, format!("no ScriptUI panel `{name}`")))?;
+    let out = super::file_more::run_js_named(s, &panel_wrapper(&title, &code), &name)?;
+    let id = s.script_ui.windows.iter().rev().find(|w| w.kind == scriptui::WindowKind::Panel && w.script == name).map(|w| w.id);
+    if let Some(id) = id {
+        s.events.push(Event::Frontend { command: c.into(), params: json!({"window": id}) });
+    }
+    if id.is_some() {
+        edit_remembered_panels(s, |l| {
+            if !l.contains(&name) {
+                l.push(name.clone());
+            }
+        });
+    }
+    Ok(json!({"window": id, "result": out}))
+}
+
+/// The commands of File ▸ Scripts, ScriptUI panels and windows, and script settings.
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            "file.installScript",
+            "Install Script File...",
+            ["File", "Scripts"],
+            None,
+            "{path (.jsx / .js)} → copies it to the Scripts folder; it appears in File ▸ Scripts",
+            always,
+            |s, p| install(s, p, false)
+        ),
+        cmd!(
+            "file.installScriptUIPanel",
+            "Install ScriptUI Panel...",
+            ["File", "Scripts"],
+            None,
+            "{path (.jsx / .js)} → copies it to the ScriptUI Panels folder; it appears in the Window menu",
+            always,
+            |s, p| install(s, p, true)
+        ),
+        cmd!(
+            "file.uninstallScript",
+            "Uninstall Script",
+            [],
+            None,
+            "{name (a script at the top of a Scripts folder, not `Folder/File.jsx`)}",
+            always,
+            uninstall
+        ),
+        crate::query!("file.scripts.list", "List Scripts", "{} → [{name (`Folder/File.jsx` in a subfolder), panel, source: installed|sample|extension}]", list),
+        cmd!(
+            "window.scriptPanel",
+            "ScriptUI Panel",
+            [],
+            None,
+            "{name (a script in the ScriptUI Panels folder, e.g. `Layer Tools.jsx`, or `Folder/Panel.jsx` in a subfolder)} → opens it as a dockable panel",
+            always,
+            open_panel
+        ),
+        cmd!(
+            "window.restoreScriptPanels",
+            "Restore ScriptUI Panels",
+            [],
+            None,
+            "{} → reopens the ScriptUI panels open when EffectCraft last quit (frontends call it at launch) → {opened: [name], failed: [{name, error}]}",
+            always,
+            restore_panels
+        ),
+        cmd!(
+            "file.runStartupScripts",
+            "Run Startup Scripts",
+            [],
+            None,
+            "{} → runs the scripts in Scripts/Startup in alphabetical order (frontends call it at launch) → {ran: [name], waiting: [name] (in a modal dialog), failed: [{name, error}]}",
+            always,
+            run_startup
+        ),
+        cmd!(
+            "file.runShutdownScripts",
+            "Run Shutdown Scripts",
+            [],
+            None,
+            "{} → closes the project, then runs the scripts in Scripts/Shutdown in alphabetical order (frontends call it as the app quits; their modal dialogs close as if canceled) → {ran: [name], waiting: [name], failed: [{name, error}]}",
+            always,
+            run_shutdown
+        ),
+        crate::query!("script.settings.get", "Get Script Setting", "{section, key} → {have, value} (app.settings.haveSetting / getSetting)", settings_get),
+        cmd!(
+            "script.settings.save",
+            "Save Script Setting",
+            [],
+            None,
+            "{section, key, value (text)} → kept in the settings store (app.settings.saveSetting)",
+            always,
+            settings_save
+        ),
+        cmd!(
+            "script.runTasks",
+            "Run Scheduled Script Tasks",
+            [],
+            None,
+            "{} → runs the app.scheduleTask tasks that are due (frontends do it every frame) → {ran, output, errors, next (ms until the next task, or null)}",
+            always,
+            scriptui::run_tasks
+        ),
+        crate::query!("scriptui.list", "List Script Windows", "{} → [{window, title, kind: dialog|palette|window|panel, script, modal, size}]", scriptui::list),
+        crate::query!(
+            "scriptui.get",
+            "Script Window Controls",
+            "{window?: id | title} → {id, title, kind, root: {id, type, name, text, value, checked, items, selection, bounds, enabled, draw (onDraw paint list), children…}}",
+            scriptui::get
+        ),
+        cmd!(
+            "scriptui.click",
+            "Click Script Window Control",
+            [],
+            None,
+            "{window?: id | title, widget: id | \"#id\" | properties.name | text} (buttons, checkboxes, radio buttons, tabs)",
+            always,
+            scriptui::click
+        ),
+        cmd!(
+            "scriptui.set",
+            "Set Script Window Control",
+            [],
+            None,
+            "{window?, widget, value: text | number | bool | item index | item text, changing?: bool (a live update: each keystroke / slider step; fires onChanging only)} (edit text, sliders, checkboxes, lists) → fires onChanging / onChange",
+            always,
+            scriptui::set
+        ),
+        cmd!(
+            "scriptui.mouse",
+            "Mouse Event on Script Window Control",
+            [],
+            None,
+            "{window?, widget, type: mousedown | mouseup | mousemove | mouseover | mouseout | click (default), x?, y? (relative to the control; default its centre), button? (0 left, 1 middle, 2 right), buttons? (held: 1 left, 2 right, 4 middle), detail? (click count), screenX?, screenY?, altKey?, ctrlKey?, metaKey?, shiftKey?} → the script's addEventListener listeners on the control and its containers receive a MouseEvent",
+            always,
+            scriptui::mouse
+        ),
+        cmd!(
+            "scriptui.resize",
+            "Resize Script Window",
+            [],
+            None,
+            "{window?, size: [width, height] (pixels)} → the window takes the size, lays itself out again and its onResizing / onResize run (a docked ScriptUI panel gets its dock's size)",
+            always,
+            scriptui::resize
+        ),
+        cmd!(
+            "scriptui.close",
+            "Close Script Window",
+            [],
+            None,
+            "{window?, result? (a dialog's show() returns it; default 2 = Cancel)}",
+            always,
+            scriptui::close
+        ),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+    use std::sync::Arc;
+
+    use serde_json::{Value, json};
+
+    use super::{BUNDLED, PANELS_DIR, SCRIPTS_DIR, is_bare_name, is_script, is_script_name, script_code, windows_unsafe_name};
+    use crate::config::DirConfig;
+    use crate::{EngineError, Result, ScriptRequest, Session};
+
+    /// Stands in for the JavaScript runtime: reports the code it was asked to run.
+    fn echo(_: &mut Session, r: &ScriptRequest) -> Value {
+        json!({"ran": r.code})
+    }
+
+    /// A session whose settings store is a fresh `<root>/settings/` (with both Scripts folders, as
+    /// after installing a script and a panel), next to a script `<root>/outside.jsx`.
+    fn session_in_tmp(name: &str) -> (Session, PathBuf) {
+        use std::sync::atomic::{AtomicU32, Ordering};
+        static N: AtomicU32 = AtomicU32::new(0);
+        let root = std::env::temp_dir().join(format!("ec-scripts-{}-{}-{name}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let _ = std::fs::remove_dir_all(&root);
+        std::fs::create_dir_all(root.join("settings").join(PANELS_DIR)).unwrap();
+        std::fs::write(root.join("outside.jsx"), "outside").unwrap();
+        let s = Session { config: Some(Arc::new(DirConfig::new(root.join("settings")))), script: Some(echo), ..Default::default() };
+        (s, root)
+    }
+
+    fn bad_params(r: &Result<Value>) -> bool {
+        matches!(r, Err(EngineError::BadParams { .. }))
+    }
+
+    /// Paths, refused on every platform.
+    const PATHS: [&str; 10] = ["", ".", "..", "../x.jsx", "a/b.jsx", "/abs/x.jsx", "a\\b.jsx", "..\\x.jsx", "C:\\x.jsx", "a\0.jsx"];
+    /// Ordinary file names except on Windows.
+    const WINDOWS_ONLY: [&str; 8] = ["Step 1: Setup.jsx", "In:Out.jsx", "C:x.jsx", "x.jsx.", "x.jsx ", "Aux.Tools.jsx", "con.jsx", "COM1.jsx"];
+
+    #[test]
+    fn bare_names_are_one_path_component() {
+        for name in ["Rename Layers.jsx", "..jsx", "a..b.js", "Äpfel ✓.jsx"].into_iter().chain(WINDOWS_ONLY) {
+            assert!(is_bare_name(name), "{name:?}");
+        }
+        for name in PATHS {
+            assert!(!is_bare_name(name), "{name:?}");
+        }
+    }
+
+    #[test]
+    fn windows_unsafe_names_are_drives_streams_trailing_dots_and_devices() {
+        let devices = ["CON", "Con.tar.jsx", "CON .jsx", "PRN.js", "aux.jsx", "NUL.jsx", "CONIN$.jsx", "conout$.js"];
+        let ports = ["COM0.jsx", "com9.js", "LPT0.jsx", "lpt9.jsx", "COM¹.jsx", "LPT³.js"];
+        for name in WINDOWS_ONLY.into_iter().chain(devices).chain(ports) {
+            assert!(windows_unsafe_name(name), "{name:?}");
+        }
+        let fine = ["console.jsx", "Concert.jsx", "NULL.jsx", "CONIN.jsx", "COM10.jsx", "LPT.jsx", "x .jsx", "..jsx"];
+        for name in BUNDLED.iter().map(|b| b.0).chain(fine) {
+            assert!(!windows_unsafe_name(name), "{name:?}");
+        }
+    }
+
+    /// Bundled and ordinary script file names are accepted; paths are not.
+    #[test]
+    fn script_names_are_bare_file_names() {
+        let more = ["..jsx", "a..b.js", "Äpfel ✓.jsx", "console.jsx", "Concert.jsx", "NULL.jsx", "COM10.jsx", "LPT.jsx"];
+        for name in BUNDLED.iter().map(|b| b.0).chain(more) {
+            assert!(is_script(name) && is_script_name(name), "{name}");
+        }
+        // `a/b.jsx` is a script in a folder (see below).
+        for name in PATHS.into_iter().filter(|n| *n != "a/b.jsx") {
+            assert!(!is_script_name(name), "{name:?}");
+        }
+        for name in WINDOWS_ONLY {
+            assert_eq!(is_script_name(name), !cfg!(windows), "{name:?}");
+        }
+        // Install refuses a file name the script could not then be run or uninstalled by.
+        #[cfg(unix)]
+        {
+            let (mut s, root) = session_in_tmp("odd-name");
+            let odd = root.join("a\\b.jsx");
+            std::fs::write(&odd, "x").unwrap();
+            assert!(bad_params(&s.execute("file.installScript", json!({"path": odd.to_string_lossy()}))));
+            assert!(!root.join("settings").join(SCRIPTS_DIR).join("a\\b.jsx").exists());
+            let _ = std::fs::remove_dir_all(&root);
+        }
+    }
+
+    /// `Folder/File.jsx` is accepted; deeper, upward, absolute and `\` names are not.
+    #[test]
+    fn script_names_may_have_one_folder() {
+        for name in ["Motion Kit/Animate.jsx", "a/b.jsx", "Äpfel/✓.js", "..jsx/x.jsx"] {
+            assert!(is_script_name(name), "{name:?}");
+        }
+        // Deeper, up, absolute, an empty part, a `\` path, and the panels' own folder in `Scripts`.
+        let refused = ["a/b/c.jsx", "../x.jsx", "a/../x.jsx", "./x.jsx", "a/..", "/x.jsx", "a//x.jsx", "a/", "a\\b.jsx", "a/b\\c.jsx", "a\0/x.jsx"];
+        for name in refused.into_iter().chain(["ScriptUI Panels/x.jsx", "scriptui panels/x.jsx"]) {
+            assert!(!is_script_name(name), "{name:?}");
+        }
+        for name in ["In:Out/x.jsx", "con/x.jsx", "x/COM1.jsx", "x./y.jsx"] {
+            assert_eq!(is_script_name(name), !cfg!(windows), "{name:?}");
+        }
+    }
+
+    /// Writes `code` to `rel` in the settings folder of [`session_in_tmp`]'s `root`.
+    fn put(root: &std::path::Path, rel: &str, code: &str) {
+        let p = root.join("settings").join(rel);
+        std::fs::create_dir_all(p.parent().unwrap()).unwrap();
+        std::fs::write(p, code).unwrap();
+    }
+
+    /// Every script command takes `Folder/File.jsx` names and refuses names outside one folder level.
+    #[test]
+    fn scripts_in_a_subfolder_are_listed_run_and_opened_as_folder_and_file() {
+        let (mut s, root) = session_in_tmp("folders");
+        put(&root, "Scripts/Tools/Hello.jsx", "hello");
+        put(&root, "Scripts/ScriptUI Panels/Motion Kit/Animate.jsx", "animate");
+        put(&root, "Scripts/ScriptUI Panels/Top.jsx", "top");
+        // Two folders deep: neither listed nor run.
+        put(&root, "Scripts/a/b/c.jsx", "too deep");
+        put(&root, "Scripts/ScriptUI Panels/Motion Kit/sub/Deep.jsx", "too deep");
+        let list = s.execute("file.scripts.list", json!({})).unwrap();
+        let installed: Vec<(&str, bool)> =
+            list.as_array().unwrap().iter().filter(|e| e["source"] == "installed").map(|e| (e["name"].as_str().unwrap(), e["panel"] == true)).collect();
+        assert_eq!(installed, [("Tools/Hello.jsx", false), ("Motion Kit/Animate.jsx", true), ("Top.jsx", true)]);
+        assert_eq!(s.execute("file.runScript", json!({"name": "Tools/Hello.jsx"})).unwrap()["ran"], "hello");
+        // A panel in a folder is titled after its file.
+        let r = s.execute("window.scriptPanel", json!({"name": "Motion Kit/Animate.jsx"})).unwrap();
+        let ran = r["result"]["ran"].as_str().unwrap_or_default();
+        assert!(ran.contains("animate") && ran.contains(r#"__uiDockPanel("Animate")"#), "{r}");
+        assert_eq!(script_code(&s, "Motion Kit/Animate.jsx", Some(true)), Some((true, "animate".to_string())));
+        // A script that is not a panel doesn't open as one.
+        for name in ["Tools/Hello.jsx", "Rename Layers.jsx"] {
+            assert!(bad_params(&s.execute("window.scriptPanel", json!({"name": name}))), "{name}");
+        }
+        for name in [
+            "../x.jsx",
+            "a/b/c.jsx",
+            "a\\b.jsx",
+            "Motion Kit/sub/Deep.jsx",
+            "ScriptUI Panels/Top.jsx",
+            "Startup/Run.jsx",
+            "shutdown/Run.jsx",
+            "Tools/../../../outside.jsx",
+        ] {
+            assert_eq!(script_code(&s, name, None), None, "{name:?}");
+            for c in ["file.runScript", "window.scriptPanel", "file.uninstallScript"] {
+                let r = s.execute(c, json!({"name": name}));
+                assert!(bad_params(&r), "{c} `{name}`: {r:?}");
+            }
+        }
+        assert!(["Scripts/a/b/c.jsx", "Scripts/ScriptUI Panels/Top.jsx"].iter().all(|p| root.join("settings").join(p).is_file()));
+        assert!(root.join("outside.jsx").is_file());
+        // Uninstall removes only scripts at the top; one in a folder is deleted there by hand.
+        for name in ["Tools/Hello.jsx", "Motion Kit/Animate.jsx"] {
+            assert!(bad_params(&s.execute("file.uninstallScript", json!({"name": name}))), "{name}");
+        }
+        assert!(["Scripts/Tools/Hello.jsx", "Scripts/ScriptUI Panels/Motion Kit/Animate.jsx"].iter().all(|p| root.join("settings").join(p).is_file()));
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// A subfolder can be a link to an extension's own folder, outside the settings folder: its
+    /// scripts are listed and run from there, but uninstall never deletes through it.
+    #[cfg(unix)]
+    #[test]
+    fn uninstall_never_deletes_through_a_linked_subfolder() {
+        let (mut s, root) = session_in_tmp("linked");
+        std::fs::create_dir_all(root.join("extension")).unwrap();
+        std::fs::write(root.join("extension").join("Animate.jsx"), "animate").unwrap();
+        std::os::unix::fs::symlink(root.join("extension"), root.join("settings").join(PANELS_DIR).join("Motion Kit")).unwrap();
+        let list = s.execute("file.scripts.list", json!({})).unwrap();
+        assert!(list.as_array().unwrap().iter().any(|e| e["name"] == "Motion Kit/Animate.jsx" && e["panel"] == true), "{list}");
+        assert_eq!(script_code(&s, "Motion Kit/Animate.jsx", Some(true)), Some((true, "animate".to_string())));
+        let r = s.execute("file.uninstallScript", json!({"name": "Motion Kit/Animate.jsx"}));
+        assert!(bad_params(&r), "{r:?}");
+        assert!(root.join("extension").join("Animate.jsx").is_file(), "the extension's own file was deleted");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// Window ▸ Motion Kit ▸ Animate.jsx: a subfolder is a submenu named after it, where the folder
+    /// sorts; the entries outside folders stay as they were.
+    #[test]
+    fn a_subfolder_is_a_submenu() {
+        use crate::menus::{MenuNode, dynamic, dynamic_nodes};
+        let (s, root) = session_in_tmp("submenus");
+        put(&root, "Scripts/ScriptUI Panels/Motion Kit/Animate.jsx", "");
+        put(&root, "Scripts/ScriptUI Panels/Motion Kit/Rig.jsx", "");
+        put(&root, "Scripts/ScriptUI Panels/Top.jsx", "");
+        put(&root, "Scripts/Tools/Hello.jsx", "");
+        let cx = Default::default();
+        let item =
+            |label: &str, command: &str, name: &str| json!({"type": "item", "label": label, "command": command, "params": {"name": name}, "shortcut": null});
+        let menus = [
+            (
+                "scriptPanels",
+                json!({"type": "submenu", "label": "Motion Kit", "children": [
+                    item("Animate.jsx", "window.scriptPanel", "Motion Kit/Animate.jsx"),
+                    item("Rig.jsx", "window.scriptPanel", "Motion Kit/Rig.jsx"),
+                ]}),
+            ),
+            ("scripts", json!({"type": "submenu", "label": "Tools", "children": [item("Hello.jsx", "file.runScript", "Tools/Hello.jsx")]})),
+        ];
+        for (menu, folder) in menus {
+            let (nodes, _) = dynamic_nodes(&s, menu, &cx);
+            let (entries, _) = dynamic(&s, menu, &cx);
+            let items: Vec<_> = nodes.iter().filter_map(|n| if let MenuNode::Item(e) = n { Some(e) } else { None }).collect();
+            assert_eq!(items, entries.iter().filter(|e| !e.label.contains('/')).collect::<Vec<_>>(), "{menu}");
+            let folders: Vec<Value> = nodes.iter().filter(|n| matches!(n, MenuNode::Submenu { .. })).map(|n| serde_json::to_value(n).unwrap()).collect();
+            assert_eq!(folders, [folder], "{menu}");
+        }
+        let (panels, _) = dynamic_nodes(&s, "scriptPanels", &cx);
+        let labels: Vec<&str> = panels
+            .iter()
+            .filter_map(|n| match n {
+                MenuNode::Item(e) => Some(e.label.as_str()),
+                MenuNode::Submenu { label, .. } => Some(label),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(labels, ["Ease Presets.jsx", "Layer Tools.jsx", "Motion Kit", "Top.jsx"]);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn uninstall_takes_a_script_name_not_a_path() {
+        let (mut s, root) = session_in_tmp("uninstall");
+        let (outside, prefs) = (root.join("outside.jsx"), root.join("settings").join("prefs.json"));
+        std::fs::write(&prefs, "{}").unwrap();
+        // From `Scripts/`, `../../outside.jsx` is the script next to the settings folder and
+        // `../prefs.json` a settings file; an absolute path is not a script name either.
+        for name in ["../../outside.jsx".to_string(), "../prefs.json".into(), outside.to_string_lossy().into_owned()] {
+            let r = s.execute("file.uninstallScript", json!({"name": name}));
+            assert!(outside.is_file() && prefs.is_file(), "`{name}` deleted a file outside the Scripts folders: {r:?}");
+            assert!(bad_params(&r), "`{name}`: {r:?}");
+        }
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn scripts_run_by_name_come_from_the_scripts_folders() {
+        let (mut s, root) = session_in_tmp("run");
+        // `Scripts/../../outside.jsx` and `Scripts/ScriptUI Panels/../../../outside.jsx` are the
+        // script next to the settings folder.
+        let r = s.execute("file.runScript", json!({"name": "../../outside.jsx"}));
+        assert!(bad_params(&r), "{r:?}");
+        let r = s.execute("window.scriptPanel", json!({"name": "../../../outside.jsx"}));
+        assert!(bad_params(&r), "{r:?}");
+        assert_eq!(script_code(&s, "../../outside.jsx", None), None);
+        assert_eq!(script_code(&s, "../../../outside.jsx", Some(true)), None);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// File ▸ Scripts ▸ Recent Script Files: the ten scripts run last, newest first, kept in the
+    /// settings; Cmd+Alt+Shift+D runs the first one again.
+    #[test]
+    fn recent_script_files_run_again() {
+        use crate::prefs::{MAX_RECENT_SCRIPTS, PREFS_FILE, Prefs, RecentScript};
+        let (mut s, root) = session_in_tmp("recent");
+        assert_eq!(crate::menus::dynamic(&s, "recentScripts", &Default::default()), (vec![], Some("No Recent Script Files")));
+        assert!(bad_params(&s.execute("file.runScript", json!({"recent": 0}))));
+        assert_eq!(s.shortcuts().shortcut_of("file.runScript", &json!({"recent": 0})), Some("Cmd+Alt+Shift+D"));
+        let tool = root.join("Tool.jsx");
+        std::fs::write(&tool, "tool").unwrap();
+        let tool = tool.to_string_lossy().into_owned();
+        s.execute("file.runScript", json!({"path": tool})).unwrap();
+        s.execute("file.runScript", json!({"name": "Rename Layers.jsx"})).unwrap();
+        // A ScriptUI panel opened from File ▸ Scripts is not a recent script file.
+        std::fs::write(root.join("settings").join(PANELS_DIR).join("Panel.jsx"), "panel").unwrap();
+        s.execute("file.runScript", json!({"name": "Panel.jsx"})).unwrap();
+        let (path, name) = (RecentScript::Path(tool.clone()), RecentScript::Name("Rename Layers.jsx".into()));
+        assert_eq!(s.prefs.recent_scripts, [name.clone(), path.clone()]);
+        let (e, _) = crate::menus::dynamic(&s, "recentScripts", &Default::default());
+        assert_eq!(e.iter().map(|e| e.label.as_str()).collect::<Vec<_>>(), ["Rename Layers.jsx", "Tool.jsx"]);
+        assert_eq!((e[1].command.as_str(), &e[1].params), ("file.runScript", &json!({"recent": 1})));
+        // Running one again runs that file and moves it to the top.
+        assert_eq!(s.execute("file.runScript", json!({"recent": 1})).unwrap()["ran"], "tool");
+        assert_eq!(s.prefs.recent_scripts, [path.clone(), name.clone()]);
+        let sample = BUNDLED.iter().find(|b| b.0 == "Rename Layers.jsx").unwrap().3;
+        assert_eq!(s.execute("file.runScript", json!({"recent": 1})).unwrap()["ran"], sample);
+        assert!(bad_params(&s.execute("file.runScript", json!({"recent": 2}))));
+        assert!(bad_params(&s.execute("file.runScript", json!({"recent": "Tool.jsx"}))));
+        // A file named like a bundled script runs again as that file.
+        let local = root.join("Rename Layers.jsx");
+        std::fs::write(&local, "local").unwrap();
+        s.execute("file.runScript", json!({"path": local.to_string_lossy()})).unwrap();
+        assert_eq!(s.execute("file.runScript", json!({"recent": 0})).unwrap()["ran"], "local");
+        assert_eq!(s.execute("file.runScript", json!({"recent": 1})).unwrap()["ran"], sample);
+        // Ten at most, saved with the settings.
+        let mut last = String::new();
+        for i in 0..MAX_RECENT_SCRIPTS + 2 {
+            let f = root.join(format!("Step {i}.jsonl"));
+            std::fs::write(&f, "").unwrap();
+            last = f.to_string_lossy().into_owned();
+            s.execute("file.runScript", json!({"path": last})).unwrap();
+        }
+        assert_eq!(s.prefs.recent_scripts.len(), MAX_RECENT_SCRIPTS);
+        assert_eq!(s.prefs.recent_scripts[0], RecentScript::Path(last));
+        let saved = std::fs::read_to_string(root.join("settings").join(PREFS_FILE)).unwrap();
+        assert_eq!(Prefs::from_json(&saved).recent_scripts, s.prefs.recent_scripts);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn recent_script_history_uses_the_selected_script() {
+        let (mut s, root) = session_in_tmp("recent-panel-collision");
+        let name = "Rename Layers.jsx";
+        std::fs::write(root.join("settings").join(PANELS_DIR).join(name), "panel").unwrap();
+        assert!(super::scripts(&s).iter().any(|entry| entry.name == name && !entry.panel));
+        assert!(script_code(&s, name, None).unwrap().0);
+        let sample = BUNDLED.iter().find(|b| b.0 == name).unwrap().3;
+        assert_eq!(s.execute("file.runScript", json!({"name": name})).unwrap()["ran"], sample);
+        assert!(super::open_panel_names(&s).is_empty(), "the listed script runs instead of the panel");
+        assert_eq!(s.prefs.recent_scripts, [crate::prefs::RecentScript::Name(name.to_string())]);
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn recent_script_history_keeps_successful_entries_when_scripts_fail() {
+        fn fail_or_echo(_: &mut Session, request: &ScriptRequest) -> Value {
+            if request.code == "fail" { json!({"error": {"message": "script failed"}}) } else { json!({"ran": request.code}) }
+        }
+        let (mut s, root) = session_in_tmp("recent-failed");
+        s.script = Some(fail_or_echo);
+        let good = root.join("good.jsonl");
+        std::fs::write(&good, "[]").unwrap();
+        s.execute("file.runScript", json!({"path": good})).unwrap();
+        let remembered = s.prefs.recent_scripts.clone();
+        for (name, code) in [("parse.jsonl", "{"), ("step.jsonl", r#"{"command":"does.not.exist"}"#), ("missing-command.jsonl", "{}"), ("runtime.jsx", "fail")]
+        {
+            let path = root.join(name);
+            std::fs::write(&path, code).unwrap();
+            assert!(s.execute("file.runScript", json!({"path": path})).is_err(), "{name}");
+            assert_eq!(s.prefs.recent_scripts, remembered, "{name}");
+        }
+        std::fs::write(root.join("settings").join(SCRIPTS_DIR).join("Failed.jsx"), "fail").unwrap();
+        assert!(s.execute("file.runScript", json!({"name": "Failed.jsx"})).is_err());
+        assert_eq!(s.prefs.recent_scripts, remembered);
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    /// Reads relative paths from a working directory that a test can change.
+    struct InFolder(std::sync::Mutex<PathBuf>);
+
+    impl InFolder {
+        fn at(&self, path: &str) -> PathBuf {
+            self.0.lock().unwrap().join(path)
+        }
+    }
+
+    impl crate::Services for InFolder {
+        fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+            std::fs::read(self.at(path))
+        }
+        fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+            std::fs::write(self.at(path), data)
+        }
+        fn full_path(&self, path: &str) -> Option<String> {
+            Some(self.at(path).to_string_lossy().into_owned())
+        }
+    }
+
+    /// Reads from a folder but can't make paths absolute.
+    struct NoFullPath(PathBuf);
+
+    impl crate::Services for NoFullPath {
+        fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+            std::fs::read(self.0.join(path))
+        }
+        fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+            std::fs::write(self.0.join(path), data)
+        }
+        fn full_path(&self, _path: &str) -> Option<String> {
+            None
+        }
+    }
+
+    /// A script whose path can't be made absolute still runs, and Recent Script Files does not
+    /// keep its relative path.
+    #[test]
+    fn unresolved_script_paths_are_not_remembered() {
+        let (mut s, root) = session_in_tmp("recent-unresolved");
+        std::fs::write(root.join("Tool.jsx"), "a").unwrap();
+        std::fs::write(root.join("steps.jsonl"), "[]").unwrap();
+        s.services = Arc::new(NoFullPath(root.clone()));
+        assert_eq!(s.execute("file.runScript", json!({"path": "Tool.jsx"})).unwrap()["ran"], "a");
+        s.execute("file.runScript", json!({"path": "steps.jsonl"})).unwrap();
+        assert!(s.prefs.recent_scripts.is_empty(), "{:?}", s.prefs.recent_scripts);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// A script run from a relative path runs the same file again from Recent Script Files after
+    /// the working directory changes, and two scripts with the same file name show their paths.
+    #[test]
+    fn recent_script_files_keep_the_file_that_ran() {
+        let (mut s, root) = session_in_tmp("recent-relative");
+        let (a, b) = (root.join("a"), root.join("b"));
+        for (dir, code) in [(&a, "a"), (&b, "b")] {
+            std::fs::create_dir_all(dir).unwrap();
+            std::fs::write(dir.join("Tool.jsx"), code).unwrap();
+        }
+        let services = Arc::new(InFolder(std::sync::Mutex::new(a.clone())));
+        s.services = services.clone();
+        assert_eq!(s.execute("file.runScript", json!({"path": "Tool.jsx"})).unwrap()["ran"], "a");
+        *services.0.lock().unwrap() = b.clone();
+        assert_eq!(s.execute("file.runScript", json!({"recent": 0})).unwrap()["ran"], "a");
+        let (e, _) = crate::menus::dynamic(&s, "recentScripts", &Default::default());
+        assert_eq!(e.iter().map(|e| e.label.as_str()).collect::<Vec<_>>(), ["Tool.jsx"]);
+        assert_eq!(s.execute("file.runScript", json!({"path": "Tool.jsx"})).unwrap()["ran"], "b");
+        let (e, _) = crate::menus::dynamic(&s, "recentScripts", &Default::default());
+        let (a, b) = (a.join("Tool.jsx").to_string_lossy().into_owned(), b.join("Tool.jsx").to_string_lossy().into_owned());
+        assert_eq!(e.iter().map(|e| e.label.as_str()).collect::<Vec<_>>(), [b.as_str(), a.as_str()]);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// Native script paths are kept absolute.
+    #[test]
+    fn native_full_paths_are_absolute() {
+        use crate::Services;
+        assert!(crate::FsServices.full_path("Tool.jsx").is_some_and(|p| std::path::Path::new(&p).is_absolute()));
+    }
+
+    #[test]
+    fn only_scripts_are_read_or_removed() {
+        // A settings file in the Scripts folder that is not a script (.jsx / .js).
+        let (mut s, root) = session_in_tmp("not-a-script");
+        let notes = root.join("settings").join(SCRIPTS_DIR).join("notes.txt");
+        std::fs::write(&notes, "notes").unwrap();
+        assert_eq!(script_code(&s, "notes.txt", None), None);
+        let r = s.execute("file.uninstallScript", json!({"name": "notes.txt"}));
+        assert!(notes.is_file() && bad_params(&r), "{r:?}");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// On Unix `\` is a file-name character: a script dropped into the folder under such a name is
+    /// not offered, as it could not be run or uninstalled. Names only Windows refuses stay.
+    #[cfg(unix)]
+    #[test]
+    fn listing_skips_names_run_and_uninstall_refuse() {
+        let (mut s, root) = session_in_tmp("odd-names");
+        let scripts = root.join("settings").join(SCRIPTS_DIR);
+        std::fs::write(scripts.join("a\\b.jsx"), "x").unwrap();
+        std::fs::write(scripts.join("In:Out.jsx"), "in-out").unwrap();
+        let list = s.execute("file.scripts.list", json!({})).unwrap();
+        let listed = |n: &str| list.as_array().unwrap().iter().any(|e| e["name"] == n);
+        assert!(!listed("a\\b.jsx") && listed("In:Out.jsx"), "{list}");
+        assert_eq!(script_code(&s, "a\\b.jsx", None), None);
+        assert_eq!(script_code(&s, "In:Out.jsx", None), Some((false, "in-out".to_string())));
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn install_run_and_uninstall_by_name() {
+        let (mut s, root) = session_in_tmp("install");
+        let file = root.join("Hello.jsx");
+        std::fs::write(&file, "hello").unwrap();
+        s.execute("file.installScript", json!({"path": file.to_string_lossy()})).unwrap();
+        s.execute("file.installScriptUIPanel", json!({"path": file.to_string_lossy()})).unwrap();
+        let installed = [root.join("settings").join(SCRIPTS_DIR).join("Hello.jsx"), root.join("settings").join(PANELS_DIR).join("Hello.jsx")];
+        assert!(installed.iter().all(|p| p.is_file()));
+        assert_eq!(s.execute("file.runScript", json!({"name": "Hello.jsx"})).unwrap()["ran"], "hello");
+        let r = s.execute("window.scriptPanel", json!({"name": "Hello.jsx"})).unwrap();
+        assert!(r["result"]["ran"].as_str().is_some_and(|c| c.contains("hello")), "{r}");
+        // The bundled samples still run by name.
+        let sample = BUNDLED.iter().find(|b| b.0 == "Rename Layers.jsx").unwrap().3;
+        assert_eq!(s.execute("file.runScript", json!({"name": "Rename Layers.jsx"})).unwrap()["ran"], sample);
+        s.execute("file.uninstallScript", json!({"name": "Hello.jsx"})).unwrap();
+        assert!(installed.iter().all(|p| !p.exists()));
+        assert!(bad_params(&s.execute("file.uninstallScript", json!({"name": "Hello.jsx"}))), "no longer installed");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// Edit ▸ Keyboard Shortcuts lists the scripts File ▸ Scripts lists (not ScriptUI panels),
+    /// as soon as one is installed and until it is uninstalled; a key given to one is saved with
+    /// the preset.
+    #[test]
+    fn file_scripts_entries_take_keyboard_shortcuts() {
+        use crate::shortcuts::{Keymaps, SHORTCUTS_FILE, binding_key};
+        let (mut s, root) = session_in_tmp("shortcuts");
+        let (script, panel) = (root.join("Hello.jsx"), root.join("Hello Panel.jsx"));
+        std::fs::write(&script, "hello").unwrap();
+        std::fs::write(&panel, "panel").unwrap();
+        let listed = |s: &Session, name: &str| {
+            s.shortcuts().find(&binding_key("file.runScript", &json!({"name": name}))).map(|b| (b.label.clone(), b.path.join(" ▸ "), b.defaults.clone()))
+        };
+        assert_eq!(listed(&s, "Rename Layers.jsx"), Some(("Rename Layers.jsx".into(), "File ▸ Scripts".into(), vec![])), "the bundled samples");
+        assert_eq!(listed(&s, "Hello.jsx"), None);
+        s.execute("file.installScript", json!({"path": script.to_string_lossy()})).unwrap();
+        s.execute("file.installScriptUIPanel", json!({"path": panel.to_string_lossy()})).unwrap();
+        assert_eq!(listed(&s, "Hello.jsx"), Some(("Hello.jsx".into(), "File ▸ Scripts".into(), vec![])));
+        assert_eq!(listed(&s, "Hello Panel.jsx"), None, "panels are in the Window menu");
+        let r = s.execute("shortcuts.set", json!({"command": "file.runScript", "params": {"name": "Hello.jsx"}, "keys": "Cmd+Alt+Shift+F7"})).unwrap();
+        let key = binding_key("file.runScript", &json!({"name": "Hello.jsx"}));
+        assert_eq!((&r["command"], &r["keys"]), (&json!(key), &json!(["Cmd+Alt+Shift+F7"])), "{r}");
+        assert_eq!(s.shortcuts().shortcut_of("file.runScript", &json!({"name": "Hello.jsx"})), Some("Cmd+Alt+Shift+F7"));
+        let saved = Keymaps::from_json(&std::fs::read_to_string(root.join("settings").join(SHORTCUTS_FILE)).unwrap());
+        assert_eq!(saved.active_preset().and_then(|p| p.overrides.get(&key)), Some(&vec!["Cmd+Alt+Shift+F7".to_string()]));
+        s.execute("file.uninstallScript", json!({"name": "Hello.jsx"})).unwrap();
+        assert_eq!(listed(&s, "Hello.jsx"), None);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// `shortcuts.list` and `shortcuts.set` see a script copied into the Scripts folder by hand
+    /// after the shortcut table was built; a script the folder doesn't hold (never there, or
+    /// removed by hand) can't take a key, and Run Script File… keeps its own keys.
+    #[test]
+    fn shortcut_commands_find_scripts_copied_into_the_folder() {
+        let (mut s, root) = session_in_tmp("copied");
+        assert!(s.shortcuts().find("file.runScript").is_some(), "the table is built");
+        std::fs::create_dir_all(root.join("settings").join(SCRIPTS_DIR)).unwrap();
+        std::fs::write(root.join("settings").join(SCRIPTS_DIR).join("Copied.jsx"), "copied").unwrap();
+        let list = s.execute("shortcuts.list", json!({"query": "copied.jsx"})).unwrap();
+        assert_eq!(list["count"], 1, "{list}");
+        let r = s.execute("shortcuts.set", json!({"command": "file.runScript", "params": {"name": "Copied.jsx"}, "keys": "Cmd+Alt+Shift+F7"})).unwrap();
+        assert_eq!(r["command"], r#"file.runScript {"name":"Copied.jsx"}"#, "{r}");
+        let r = s.execute("shortcuts.set", json!({"command": "file.runScript", "params": {"name": "Missing.jsx"}, "keys": "Cmd+Alt+Shift+F8"}));
+        assert!(bad_params(&r), "{r:?}");
+        // The binding-key form finds a script copied in since the last lookup, too.
+        std::fs::write(root.join("settings").join(SCRIPTS_DIR).join("Second.jsx"), "second").unwrap();
+        let r = s.execute("shortcuts.set", json!({"command": r#"file.runScript {"name":"Second.jsx"}"#, "keys": "Cmd+Alt+Shift+F10"})).unwrap();
+        assert_eq!(r["command"], r#"file.runScript {"name":"Second.jsx"}"#, "{r}");
+        // Removed by hand: no longer in the folder.
+        std::fs::remove_file(root.join("settings").join(SCRIPTS_DIR).join("Copied.jsx")).unwrap();
+        std::fs::remove_file(root.join("settings").join(SCRIPTS_DIR).join("Second.jsx")).unwrap();
+        let r = s.execute("shortcuts.set", json!({"command": r#"file.runScript {"name":"Second.jsx"}"#, "keys": "Cmd+Alt+Shift+F11"}));
+        assert!(bad_params(&r), "{r:?}");
+        let r = s.execute("shortcuts.set", json!({"command": "file.runScript", "params": {"name": "Copied.jsx"}, "keys": "Cmd+Alt+Shift+F9"}));
+        assert!(bad_params(&r), "{r:?}");
+        assert_eq!(s.shortcuts().shortcut_of("file.runScript", &Value::Null), None, "Run Script File… has no key");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+}
diff --git a/crates/engine/src/commands/settings.rs b/crates/engine/src/cmd/settings.rs
similarity index 93%
rename from crates/engine/src/commands/settings.rs
rename to crates/engine/src/cmd/settings.rs
index a6621c3f4..3673a9550 100644
--- a/crates/engine/src/commands/settings.rs
+++ b/crates/engine/src/cmd/settings.rs
@@ -73,13 +73,21 @@ fn prefs_pages(_: &mut Session, _: &Value) -> Result<Value> {
 
 // ---------------------------------------------------------------- shortcuts
 
-/// The bindable named by `command` (+ `params`), or by a binding key (`app.settings {...}`).
-fn bindable(s: &Session, p: &Value, cmd: &str) -> Result<crate::shortcuts::Bindable> {
+/// The bindable named by `command` (+ `params`), or by a binding key (`app.settings {...}`). A
+/// File ▸ Scripts entry (`file.runScript {"name": …}`) is looked up in File ▸ Scripts' list as it
+/// is now (the Scripts folder and the bundled scripts), and a script it doesn't list is an error,
+/// not Run Script File….
+fn bindable(s: &mut Session, p: &Value, cmd: &str) -> Result<crate::shortcuts::Bindable> {
     let c = str_p(p, "command").ok_or_else(|| bad(cmd, "missing `command`"))?;
     let params = p.get("params").cloned().unwrap_or(Value::Null);
-    let t = s.shortcuts();
     let key = binding_key(c, &params);
-    t.find(&key).or_else(|| t.find(c)).cloned().ok_or_else(|| bad(cmd, format!("`{key}` can't have a shortcut (see shortcuts.list)")))
+    let script = (c == "file.runScript" && params.get("name").is_some()) || c.starts_with("file.runScript {");
+    if script {
+        s.scripts_changed();
+    }
+    let t = s.shortcuts();
+    let found = if script { t.find(&key) } else { t.find(&key).or_else(|| t.find(c)) };
+    found.cloned().ok_or_else(|| bad(cmd, format!("`{key}` can't have a shortcut (see shortcuts.list)")))
 }
 
 fn keys_param(p: &Value, cmd: &str) -> Result<Vec<String>> {
@@ -93,6 +101,8 @@ fn keys_param(p: &Value, cmd: &str) -> Result<Vec<String>> {
 }
 
 fn sc_list(s: &mut Session, p: &Value) -> Result<Value> {
+    // Scripts copied into the Scripts folder since the table was built are listed too.
+    s.scripts_changed();
     let q = str_p(p, "query").unwrap_or("").to_lowercase();
     let assigned = p.get("assigned").and_then(Value::as_bool).unwrap_or(false);
     let keys_q = str_p(p, "keys").and_then(normalize);
@@ -185,7 +195,7 @@ fn sc_export(s: &mut Session, p: &Value) -> Result<Value> {
     let doc = s.keymaps.export(str_p(p, "preset")).map_err(|e| bad("shortcuts.export", e))?;
     if let Some(path) = str_p(p, "path") {
         let text = serde_json::to_string_pretty(&doc).unwrap_or_default();
-        s.services.write_file(path, text.as_bytes()).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+        s.write_output(path, text.as_bytes())?;
         return Ok(json!({"path": path, "preset": doc["name"]}));
     }
     Ok(doc)
diff --git a/crates/engine/src/commands/shape_stroke.rs b/crates/engine/src/cmd/shape_stroke.rs
similarity index 98%
rename from crates/engine/src/commands/shape_stroke.rs
rename to crates/engine/src/cmd/shape_stroke.rs
index ecd3ed8e0..6bb09654b 100644
--- a/crates/engine/src/commands/shape_stroke.rs
+++ b/crates/engine/src/cmd/shape_stroke.rs
@@ -205,7 +205,8 @@ const PATHS: [&str; 4] = ["rect", "ellipse", "star", "path"];
 pub(crate) const MAX_DEPTH: usize = 64;
 
 /// The first Fill colour, Stroke colour and Stroke Width in `layer`'s contents at layer time
-/// `lt` (what the toolbar shows for a selected shape layer).
+/// `lt` (what the toolbar shows for a selected shape layer). Width comes from the first Stroke
+/// or Gradient Stroke, independently of the first solid stroke's colour.
 pub fn first_paint(layer: &Layer, lt: Tick) -> (Option<[f64; 4]>, Option<[f64; 4]>, Option<f64>) {
     let (mut fill, mut stroke, mut width) = (None, None, None);
     if let Some(c) = layer.props.sub("contents") {
@@ -216,10 +217,12 @@ pub fn first_paint(layer: &Layer, lt: Tick) -> (Option<[f64; 4]>, Option<[f64; 4
                 "fill" if fill.is_none() => fill = at("color").map(rgba),
                 "stroke" if stroke.is_none() => {
                     stroke = at("color").map(rgba);
-                    width = at("width").map(|v| v.as_f64());
                 }
                 _ => {}
             }
+            if width.is_none() && is_stroke(g) {
+                width = at("width").map(|v| v.as_f64());
+            }
         });
     }
     (fill, stroke, width)
diff --git a/crates/engine/src/commands/shape_tool.rs b/crates/engine/src/cmd/shape_tool.rs
similarity index 94%
rename from crates/engine/src/commands/shape_tool.rs
rename to crates/engine/src/cmd/shape_tool.rs
index a48c32b7f..57b22ba82 100644
--- a/crates/engine/src/commands/shape_tool.rs
+++ b/crates/engine/src/cmd/shape_tool.rs
@@ -180,16 +180,17 @@ fn rgba(c: [f32; 3]) -> [f64; 4] {
     [c[0] as f64, c[1] as f64, c[2] as f64, 1.0]
 }
 
-/// The Rounded Rectangle tool's corner roundness for `size`.
-fn roundness(size: [f64; 2]) -> f64 {
-    size[0].min(size[1]) * 0.15
+/// The Rounded Rectangle tool's corner roundness: a fixed default, as in After Effects
+/// (it does not grow with the drawn size).
+fn roundness() -> f64 {
+    20.0
 }
 
 /// The Polygon and Star tools' Polystar for `size`: (star, points, outer radius, inner radius).
 fn polystar_of(kind: &str, size: [f64; 2]) -> Option<(bool, f64, f64, f64)> {
     match kind {
         "star" => Some((true, 5.0, size[0] / 2.0, size[0] / 4.0)),
-        "polygon" => Some((false, 6.0, size[0] / 2.0, 0.0)),
+        "polygon" => Some((false, 5.0, size[0] / 2.0, 0.0)),
         _ => None,
     }
 }
@@ -199,7 +200,7 @@ fn polystar_of(kind: &str, size: [f64; 2]) -> Option<(bool, f64, f64, f64)> {
 pub(crate) fn shape_group(ids: &mut Ids, kind: &str, size: [f64; 2], paint: &ShapeTool) -> Option<PropGroup> {
     let (path, gname) = match kind {
         "rect" | "rectangle" => (build::shape_rect(ids, size, [0.0, 0.0], 0.0), "Rectangle 1"),
-        "rounded" | "roundedRect" => (build::shape_rect(ids, size, [0.0, 0.0], roundness(size)), "Rectangle 1"),
+        "rounded" | "roundedRect" => (build::shape_rect(ids, size, [0.0, 0.0], roundness()), "Rectangle 1"),
         "ellipse" => (build::shape_ellipse(ids, size, [0.0, 0.0]), "Ellipse 1"),
         k => {
             let (star, points, outer, inner) = polystar_of(k, size)?;
@@ -215,13 +216,28 @@ pub(crate) fn shape_group(ids: &mut Ids, kind: &str, size: [f64; 2], paint: &Sha
 /// of every one of the five kinds, so a caller that only wants to draw it (the viewer's
 /// drag ghost) cannot drift from what `shape.newShape` / `layer.addMask` commit.
 pub fn mask_path(kind: &str, centre: [f64; 2], size: [f64; 2]) -> Option<ShapePath> {
+    mask_path_rounded(kind, centre, size, None)
+}
+
+/// [`mask_path`] with the rounded rectangle's corner radius (layer pixels) given; `None` keeps
+/// the tool's default. Other kinds ignore it.
+pub fn mask_path_rounded(kind: &str, centre: [f64; 2], size: [f64; 2], radius: Option<f64>) -> Option<ShapePath> {
     let bez = match kind {
         "rect" | "rectangle" => return Some(ShapePath::rect(centre, size[0], size[1])),
         "ellipse" => return Some(ShapePath::ellipse(centre, size[0], size[1])),
-        "rounded" | "roundedRect" => effectcraft_path::rect(size, centre, roundness(size)),
+        "rounded" | "roundedRect" => effectcraft_path::rect(size, centre, radius.unwrap_or_else(roundness)),
         k => {
             let (star, points, outer, inner) = polystar_of(k, size)?;
-            effectcraft_path::polystar(star, points, centre, 0.0, inner, outer, 0.0, 0.0)
+            effectcraft_path::polystar(effectcraft_path::Polystar {
+                star,
+                points,
+                pos: centre,
+                rotation: 0.0,
+                inner,
+                outer,
+                inner_round: 0.0,
+                outer_round: 0.0,
+            })
         }
     };
     effectcraft_path::from_kurbo(&bez).into_iter().next()
diff --git a/crates/engine/src/commands/stubs.rs b/crates/engine/src/cmd/stubs.rs
similarity index 100%
rename from crates/engine/src/commands/stubs.rs
rename to crates/engine/src/cmd/stubs.rs
diff --git a/crates/engine/src/commands/styles.rs b/crates/engine/src/cmd/styles.rs
similarity index 91%
rename from crates/engine/src/commands/styles.rs
rename to crates/engine/src/cmd/styles.rs
index 82bbf5eba..4fcbcc83e 100644
--- a/crates/engine/src/commands/styles.rs
+++ b/crates/engine/src/cmd/styles.rs
@@ -25,13 +25,23 @@ fn add_styles(s: &mut Session, p: &Value, cmd: &str, styles: &[&str], enabled: b
     if ids.is_empty() {
         return Err(bad(cmd, "no layer that takes layer styles (footage, solid, precomp, text or shape layer)"));
     }
-    let uids = s.edit(label, None, |proj, state| {
+    let uids = s.edit(label, super::merge_p(p), |proj, state| {
         let gl = proj.comp(cid).ok_or(EngineError::NoComp)?.global_light.clone();
         let mut out = vec![];
         let mut sel = vec![];
         for lid in &ids {
             let mut next = proj.next_id;
             let l = layer_mut(proj, cid, *lid)?;
+            // No style: Blending Options alone (the Layer Style dialog's first change on a layer
+            // without styles).
+            if styles.is_empty() {
+                let uid = st::add_blending_options(l, &mut Ids(&mut next), &gl).ok_or_else(|| bad(cmd, "no Blending Options"))?;
+                if let Some(g) = l.props.sub_mut(GROUP) {
+                    g.enabled = true;
+                }
+                out.push(json!({"layer": lid.0, "style": st::BLENDING, "uid": uid}));
+                sel.push((*lid, uid));
+            }
             for id in styles {
                 let had = l.layer_styles().and_then(|g| g.sub(id)).is_some();
                 let uid = st::add_style(l, &mut Ids(&mut next), id, &gl, enabled).ok_or_else(|| bad(cmd, format!("unknown style `{id}`")))?;
@@ -58,6 +68,9 @@ fn add_styles(s: &mut Session, p: &Value, cmd: &str, styles: &[&str], enabled: b
 
 fn add(s: &mut Session, p: &Value) -> Result<Value> {
     let name = str_p(p, "style").ok_or_else(|| bad("layer.style.add", "missing `style` (e.g. dropShadow or \"Drop Shadow\")"))?;
+    if name.eq_ignore_ascii_case(st::BLENDING) || name.eq_ignore_ascii_case("Blending Options") {
+        return add_styles(s, p, "layer.style.add", &[], true, "Blending Options");
+    }
     let id = st::style_id(name)
         .ok_or_else(|| bad("layer.style.add", format!("unknown style `{name}`; one of {}", STYLES.iter().map(|s| s.0).collect::<Vec<_>>().join(", "))))?;
     let label = STYLES.iter().find(|s| s.0 == id).map(|s| s.1).unwrap_or(id);
@@ -139,8 +152,9 @@ fn remove(s: &mut Session, p: &Value) -> Result<Value> {
                 return Err(bad("layer.style.remove", "Blending Options can't be removed"));
             }
             g.children.retain(|c| c.uid() != uid);
-            // The last style gone removes the Layer Styles group, as in AE.
-            if g.children.iter().all(|c| c.match_id() == st::BLENDING) {
+            // The last style gone removes the Layer Styles group, as in AE, unless its Blending
+            // Options were changed (they can be edited with no style since #1389).
+            if g.children.iter().all(|c| c.match_id() == st::BLENDING) && g.sub(st::BLENDING).is_none_or(st::blending_is_default) {
                 l.props.children.retain(|c| c.match_id() != GROUP);
             }
         }
@@ -224,7 +238,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Layer Style",
             [],
             None,
-            "{style: dropShadow|innerShadow|outerGlow|innerGlow|bevelEmboss|satin|colorOverlay|gradientOverlay|stroke (or display name), layers?}",
+            "{style: dropShadow|innerShadow|outerGlow|innerGlow|bevelEmboss|satin|colorOverlay|gradientOverlay|stroke (or display name), or blendingOptions (the Layer Styles group with Blending Options only), layers?, merge?}",
             has_layers,
             add
         ),
diff --git a/crates/engine/src/commands/text_anim.rs b/crates/engine/src/cmd/text_anim.rs
similarity index 94%
rename from crates/engine/src/commands/text_anim.rs
rename to crates/engine/src/cmd/text_anim.rs
index 92ab23f17..ce9c1fe46 100644
--- a/crates/engine/src/commands/text_anim.rs
+++ b/crates/engine/src/cmd/text_anim.rs
@@ -49,8 +49,9 @@ fn per_char_on(l: &Layer) -> bool {
     l.props.prop("text/perChar3d").is_some_and(|p| p.value.as_bool())
 }
 
-/// The animator a command targets: `animator` (uid or 1-based index), else the animator holding
-/// a selected property, else the last one.
+/// The animator a command targets: `animator` (uid or 1-based index; a uid match wins, so an
+/// animator whose uid equals an index is picked over the one at that position), else the animator
+/// holding a selected property, else the last one.
 fn animator_uid(s: &Session, l: &Layer, p: &Value, cmd: &str) -> Result<u64> {
     let anims = l.props.group("text/animators").ok_or_else(|| bad(cmd, "not a text layer"))?;
     let list: Vec<&PropGroup> = anims.groups().collect();
@@ -59,7 +60,11 @@ fn animator_uid(s: &Session, l: &Layer, p: &Value, cmd: &str) -> Result<u64> {
         if let Some(g) = list.iter().find(|g| g.uid == n) {
             return Ok(g.uid);
         }
-        return list.get((n as usize).wrapping_sub(1)).map(|g| g.uid).ok_or_else(|| bad(cmd, format!("no animator {n}")));
+        let count = if list.len() == 1 { "1 animator".to_string() } else { format!("{} animators", list.len()) };
+        return list
+            .get((n as usize).wrapping_sub(1))
+            .map(|g| g.uid)
+            .ok_or_else(|| bad(cmd, format!("no animator {n}: `animator` is a uid or a 1-based index, and the layer has {count}")));
     }
     for (lid, uid) in &s.state.selected_props {
         if *lid != l.id {
@@ -142,6 +147,7 @@ fn add_animator_prop(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let layer = s.project.comp(cid).and_then(|c| c.layer(lid)).cloned().ok_or_else(|| bad(C, "no layer"))?;
     let auid = animator_uid(s, &layer, p, C)?;
+    let mut index = 0;
     s.edit("Add Text Animator Property", None, |proj, _| {
         let mut next = proj.next_id;
         let mut ids = Ids(&mut next);
@@ -151,10 +157,13 @@ fn add_animator_prop(s: &mut Session, p: &Value) -> Result<Value> {
         for k in &kinds {
             add_props(&mut ids, anim, k, three);
         }
+        // The requested property's 1-based position in the Properties group. A companion (such as
+        // Tracking Type) is added before it, so the first new child is not always the one asked for.
+        index = kinds.first().and_then(|k| anim.sub("properties")?.children.iter().position(|n| n.match_id() == k.as_str())).map_or(0, |i| i + 1);
         proj.next_id = next;
         Ok(())
     })?;
-    Ok(json!({"animator": auid}))
+    Ok(json!({"animator": auid, "index": index}))
 }
 
 pub(crate) fn add_selector(s: &mut Session, p: &Value) -> Result<Value> {
@@ -450,7 +459,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Property",
             [],
             None,
-            "{layer?, animator?: uid|index, property: (see layer.addTextAnimator)}",
+            "{layer?, animator?: uid|index (1-based; a uid match wins over an index), property: (see layer.addTextAnimator)}",
             has_animator,
             add_animator_prop
         ),
@@ -459,7 +468,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Text Selector",
             [],
             None,
-            "{layer?, animator?: uid|index, kind: range|wiggly|expression}",
+            "{layer?, animator?: uid|index (1-based; a uid match wins over an index), kind: range|wiggly|expression}",
             has_animator,
             add_selector
         ),
@@ -478,7 +487,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Variable Font Axes",
             ["Animation", "Animate Text"],
             None,
-            "{layer?, axis?: tag|name (omit to list the font's axes), animator?: uid|index}",
+            "{layer?, axis?: tag|name (omit to list the font's axes), animator?: uid|index (1-based; a uid match wins over an index)}",
             has_text_layer,
             font_axes
         ),
diff --git a/crates/engine/src/commands/text_edit.rs b/crates/engine/src/cmd/text_edit.rs
similarity index 53%
rename from crates/engine/src/commands/text_edit.rs
rename to crates/engine/src/cmd/text_edit.rs
index 5dcb6d09a..9240f0c1a 100644
--- a/crates/engine/src/commands/text_edit.rs
+++ b/crates/engine/src/cmd/text_edit.rs
@@ -6,15 +6,64 @@
 //! Positions are character indices. The selection is `anchor..caret` (either order).
 
 use effectcraft_keyframe::{CharStyle, TextDoc, Value as KV};
-use effectcraft_project::{LayerId, LayerSource};
+use effectcraft_project::{ItemId, LayerId, LayerSource, text_layer_name};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 
+/// Session tokens for the on-canvas editor, unique across the process (so a recreated session
+/// never reuses a live IME context). Exhaustion wraps; it cannot panic.
+static NEXT_EDIT_SESSION: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+
+/// Takes the next session token: returns the counter's current value and increments it, so
+/// successive tokens differ until the process-wide `u64` counter wraps.
+pub(super) fn next_edit_session() -> u64 {
+    NEXT_EDIT_SESSION.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+}
+
+/// Process-global checked high-water allocator for [`crate::Session::ime_revision`] stamps.
+///
+/// egui's unavailable-IME receipt identity must be process-monotonic. Allocating the stamp from
+/// one process-global counter means neither a second session nor a rollback can reuse a value.
+/// The counter fails closed at `u64::MAX`: it returns `None` without wrapping, and callers keep
+/// their existing stamp. An unavailable before/after pair then compares equal, so it earns no
+/// receipt rather than claiming a mutation with a reused revision.
+static NEXT_IME_REVISION: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
+/// Allocates a fresh process-wide IME revision, or `None` once the counter has nowhere left
+/// to advance; callers keep their existing stamp rather than reuse one.
+pub(crate) fn next_ime_revision() -> Option<u64> {
+    allocate_ime_revision(&NEXT_IME_REVISION)
+}
+
+/// Takes the next value of `counter` with a compare-exchange loop: `Some(current + 1)` after
+/// storing it, or `None` without storing when the counter is already `u64::MAX`.
+fn allocate_ime_revision(counter: &std::sync::atomic::AtomicU64) -> Option<u64> {
+    use std::sync::atomic::Ordering::Relaxed;
+    let mut current = counter.load(Relaxed);
+    loop {
+        let next = current.checked_add(1)?;
+        match counter.compare_exchange_weak(current, next, Relaxed, Relaxed) {
+            Ok(_) => return Some(next),
+            Err(observed) => current = observed,
+        }
+    }
+}
+
+#[test]
+fn ime_revision_allocation_stops_at_exhaustion_without_reusing_a_stamp() {
+    use std::sync::atomic::{AtomicU64, Ordering::Relaxed};
+    let counter = AtomicU64::new(u64::MAX - 1);
+    assert_eq!(allocate_ime_revision(&counter), Some(u64::MAX));
+    assert_eq!(allocate_ime_revision(&counter), None);
+    assert_eq!(allocate_ime_revision(&counter), None);
+    assert_eq!(counter.load(Relaxed), u64::MAX);
+}
+
 use super::{CommandSpec, b_p, bad, comp_id, layer_mut, resolve_layer, str_p};
 use crate::{EditorState, EngineError, Result, Session, cmd};
 
 /// An on-canvas text editing session.
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct TextEdit {
     pub layer: LayerId,
     pub anchor: usize,
@@ -22,12 +71,32 @@ pub struct TextEdit {
     /// Character panel changes made with only a caret: the style the next typed text takes.
     #[serde(default)]
     pub pending: Option<CharStyle>,
-    /// The layer was made by a Type tool click; leaving it empty deletes it.
+    /// The layer was made by a Type tool click. Kept when left empty, as After Effects does, so this
+    /// only records how the edit began.
     #[serde(default)]
     pub created: bool,
     /// Line position kept by repeated up / down moves (layout space).
     #[serde(default)]
     pub goal_x: Option<f64>,
+    /// This editing session's identity.
+    ///
+    /// It changes when the editor is started and when its layer or document is replaced, by
+    /// undo/redo, a history jump, a rollback, or a time change showing another document. A
+    /// restore that keeps the same composition, layer and byte/style-equal document (an opacity
+    /// undo while editing) keeps it, so an active IME composition survives an unrelated change.
+    /// It is deliberately not serialized: a saved token belongs to a previous process and
+    /// cannot identify a new target. The IME owner uses it as its replacement epoch, so an old
+    /// composition is never inherited by a recreated layer or a replaced document.
+    #[serde(skip, default = "next_edit_session")]
+    pub session: u64,
+}
+
+impl Default for TextEdit {
+    /// An empty, uncreated editing session on layer `0` with no selection, pending style or goal
+    /// column, and a fresh process-wide session token.
+    fn default() -> Self {
+        Self { layer: LayerId(0), anchor: 0, caret: 0, pending: None, created: false, goal_x: None, session: next_edit_session() }
+    }
 }
 
 impl TextEdit {
@@ -49,6 +118,139 @@ pub fn layer_doc(s: &Session, lid: LayerId) -> Option<TextDoc> {
     }
 }
 
+/// The largest committed-text window an IME observation copies.
+///
+/// This mirrors `egui::output::MAX_IME_SURROUNDING_TEXT_BYTES`: a selection wider than this is
+/// reported as unavailable rather than silently truncated.
+pub const MAX_IME_TEXT_BYTES: usize = 4000;
+
+/// The editor's committed-text revision for an IME receipt whose surrounding text is
+/// unavailable (a selection wider than [`MAX_IME_TEXT_BYTES`]).
+///
+/// Unlike [`Session::revision`], unrelated project edits (an opacity undo) do not advance it, so
+/// they cannot make an active composition look stale.
+pub fn ime_stamp_revision(s: &Session) -> u64 {
+    s.ime_revision
+}
+
+/// Bounded committed text around an IME selection, with UTF-8 byte offsets.
+///
+/// The Type tool keeps the input method's pre-edit in egui's temporary data, never in the
+/// layer's [`TextDoc`], so [`Self::text`] is committed text only.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ImeSurrounding {
+    /// At most [`MAX_IME_TEXT_BYTES`] bytes of the edited layer's text.
+    pub text: String,
+    /// The caret (primary selection end) as a UTF-8 byte offset in [`Self::text`].
+    pub cursor: usize,
+    /// The other selection end; larger than `cursor` for a reversed selection.
+    pub anchor: usize,
+}
+
+impl ImeSurrounding {
+    /// A bounded window of `text` around the selection `cursor`/`anchor`.
+    ///
+    /// Returns `None` when an offset is past the text or inside a character, or when the
+    /// selection itself is wider than [`MAX_IME_TEXT_BYTES`]: the caller then reports
+    /// surrounding text as unavailable instead of sending a truncated selection.
+    pub fn from_text(text: &str, cursor: usize, anchor: usize) -> Option<Self> {
+        if cursor > text.len() || anchor > text.len() || !text.is_char_boundary(cursor) || !text.is_char_boundary(anchor) {
+            return None;
+        }
+        let (start, end) = (cursor.min(anchor), cursor.max(anchor));
+        let selection = end - start;
+        if selection > MAX_IME_TEXT_BYTES {
+            return None;
+        }
+        // Spend the remaining budget on both sides of the selection, giving unused room on one
+        // side to the other. Only this bounded window is copied.
+        let budget = MAX_IME_TEXT_BYTES - selection;
+        let mut before = (budget / 2).min(start);
+        let mut after = (budget - before).min(text.len() - end);
+        before = (budget - after).min(start);
+        after = (budget - before).min(text.len() - end);
+        let mut window_start = start - before;
+        let mut window_end = end + after;
+        // Byte budgets can land inside a multi-byte character: shrink the window so it never
+        // splits one and the selection stays inside it.
+        while window_start < start && !text.is_char_boundary(window_start) {
+            window_start += 1;
+        }
+        while end < window_end && !text.is_char_boundary(window_end) {
+            window_end -= 1;
+        }
+        Some(Self {
+            text: text.get(window_start..window_end)?.to_owned(),
+            cursor: cursor.checked_sub(window_start)?,
+            anchor: anchor.checked_sub(window_start)?,
+        })
+    }
+}
+
+/// The edited layer's committed text around its selection, or `None` when there is no edit
+/// session, the layer is gone, or the selection is wider than [`MAX_IME_TEXT_BYTES`].
+///
+/// The caret and the anchor are converted to UTF-8 byte offsets separately, so a reversed
+/// selection stays reversed. A valid empty document is `Some` with empty text, never `None`.
+pub fn ime_surrounding(s: &Session) -> Option<ImeSurrounding> {
+    let e = s.state.text_edit.as_ref()?;
+    let comp = s.active_comp()?;
+    let layer = comp.layer(e.layer)?;
+    let prop = layer.props.prop("text/sourceText")?;
+    // A static Source Text (the normal case) is borrowed in place; only an animated one has to
+    // be evaluated into a temporary. Either way only the bounded window is copied.
+    if !prop.is_animated() {
+        return match &prop.value {
+            KV::Text(doc) => {
+                let (caret, anchor) = doc_bytes(doc, e.caret, e.anchor);
+                ImeSurrounding::from_text(&doc.text, caret, anchor)
+            }
+            KV::Str(text) => {
+                let (caret, anchor) = char_bytes(text, e.caret, e.anchor);
+                ImeSurrounding::from_text(text, caret, anchor)
+            }
+            _ => None,
+        };
+    }
+    match prop.value_at(layer.layer_time(s.time())) {
+        KV::Text(doc) => {
+            let (caret, anchor) = doc_bytes(&doc, e.caret, e.anchor);
+            ImeSurrounding::from_text(&doc.text, caret, anchor)
+        }
+        KV::Str(text) => {
+            let (caret, anchor) = char_bytes(&text, e.caret, e.anchor);
+            ImeSurrounding::from_text(&text, caret, anchor)
+        }
+        _ => None,
+    }
+}
+
+/// Byte offsets of two character positions in `text` (clamped to its end), scanning once.
+///
+/// The second position may be before the first; the returned pair keeps the caller's order.
+fn char_bytes(text: &str, first: usize, second: usize) -> (usize, usize) {
+    let (lo, hi) = if first <= second { (first, second) } else { (second, first) };
+    let mut lo_byte = if lo == 0 { 0 } else { text.len() };
+    let mut hi_byte = if hi == 0 { 0 } else { text.len() };
+    if hi != 0 {
+        for (i, (b, _)) in text.char_indices().enumerate() {
+            if i == lo {
+                lo_byte = b;
+            }
+            if i == hi {
+                hi_byte = b;
+                break;
+            }
+        }
+    }
+    if first <= second { (lo_byte, hi_byte) } else { (hi_byte, lo_byte) }
+}
+
+/// Byte offsets of the editor's caret and anchor in a document, in that order.
+fn doc_bytes(doc: &TextDoc, caret: usize, anchor: usize) -> (usize, usize) {
+    char_bytes(&doc.text, caret, anchor)
+}
+
 /// The text layer a text command targets: `layer`, the edited layer, or the selected text layer.
 fn target(s: &Session, p: &Value, cmd: &str) -> Result<LayerId> {
     let cid = comp_id(s, p)?;
@@ -78,7 +280,7 @@ fn session_on(s: &mut Session, lid: LayerId) -> TextEdit {
         Some(e) if e.layer == lid => e.clone(),
         _ => {
             let n = layer_doc(s, lid).map_or(0, |d| d.char_len());
-            let e = TextEdit { layer: lid, anchor: n, caret: n, ..Default::default() };
+            let e = TextEdit { layer: lid, anchor: n, caret: n, session: next_edit_session(), ..Default::default() };
             s.state.selected_layers = vec![lid];
             s.state.text_edit = Some(e.clone());
             e
@@ -86,10 +288,6 @@ fn session_on(s: &mut Session, lid: LayerId) -> TextEdit {
     }
 }
 
-fn first_line_name(text: &str) -> String {
-    text.lines().next().unwrap_or("").chars().take(40).collect()
-}
-
 /// Edit a layer's Source Text at the CTI (one undo step, or merged by `merge`), then set the
 /// session's selection.
 pub(crate) fn edit_doc(
@@ -101,7 +299,8 @@ pub(crate) fn edit_doc(
 ) -> Result<()> {
     let cid = s.active_comp_id().ok_or(EngineError::NoComp)?;
     let t = s.time();
-    s.edit(label, merge, |proj, st| {
+    let revision = s.revision;
+    s.edit_text_doc(label, merge, |proj, st| {
         let l = layer_mut(proj, cid, lid)?;
         let lt = l.layer_time(t);
         let pr = l.props.prop_mut("text/sourceText").ok_or_else(|| bad("text", "not a text layer"))?;
@@ -110,16 +309,29 @@ pub(crate) fn edit_doc(
             KV::Str(t) => TextDoc::plain(&t),
             _ => TextDoc::default(),
         };
-        let before = first_line_name(&doc.text);
+        let original = doc.clone();
         f(&mut doc, st)?;
-        let after = first_line_name(&doc.text);
-        pr.set_value_at(lt, KV::Text(Box::new(doc)));
-        // Text layers are named after their text until renamed.
-        if before != after && !after.is_empty() && (l.name == before || l.name.starts_with("Text") || l.name.is_empty()) {
-            l.name = after;
+        // A no-op (an IME deletion with nothing around the selection, a set to the value it
+        // already has) must not turn a static Str into Text or add a keyframe at the CTI: that
+        // would change the project and record an empty undo step.
+        if doc != original {
+            let before = text_layer_name(&original.text);
+            let after = text_layer_name(&doc.text);
+            pr.set_value_at(lt, KV::Text(Box::new(doc)));
+            // Text layers are named after their text until renamed (#3233).
+            if before != after && !after.is_empty() && l.name_follows_text(&before) {
+                l.name = after;
+                l.name_follows_text = Some(true);
+            }
         }
         Ok(())
-    })
+    })?;
+    // The editor's unavailable-text receipt identity follows only its own document: an edit to
+    // another text layer while this editor is open must not cancel the composition.
+    if s.revision != revision && s.state.text_edit.as_ref().is_some_and(|e| e.layer == lid) {
+        s.note_text_edit_change();
+    }
+    Ok(())
 }
 
 fn range_p(p: &Value) -> Option<std::ops::Range<usize>> {
@@ -153,23 +365,19 @@ fn edit(s: &mut Session, p: &Value) -> Result<Value> {
     };
     let created = b_p(p, "created").unwrap_or(false);
     s.state.selected_layers = vec![lid];
-    s.state.text_edit = Some(TextEdit { layer: lid, anchor, caret, created, ..Default::default() });
+    s.state.text_edit = Some(TextEdit { layer: lid, anchor, caret, created, session: next_edit_session(), ..Default::default() });
     s.bump();
     Ok(state_json(s))
 }
 
-/// `text.endEdit`: stop editing (a Type-tool layer left empty is deleted).
-fn end_edit(s: &mut Session, _: &Value) -> Result<Value> {
-    let Some(e) = s.state.text_edit.take() else { return Ok(Value::Null) };
-    if e.created && layer_doc(s, e.layer).is_some_and(|d| d.text.is_empty()) {
-        let cid = s.active_comp_id().ok_or(EngineError::NoComp)?;
-        s.edit("Delete Empty Text Layer", None, |proj, st| {
-            if let Some(c) = proj.comp_mut(cid) {
-                c.layers.retain(|l| l.id != e.layer);
-            }
-            st.selected_layers.retain(|l| *l != e.layer);
-            Ok(())
-        })?;
+/// `text.endEdit`: stop editing.
+///
+/// A Type-tool layer the user clicked away from without typing is **kept**: After Effects leaves it in
+/// the timeline as `<空白のテキストレイヤー>`, and the layer came from the user's click rather than from a
+/// mistake to clean up. Deleting it took away something they could still type into.
+pub(crate) fn end_edit(s: &mut Session, _: &Value) -> Result<Value> {
+    if s.state.text_edit.take().is_none() {
+        return Ok(Value::Null);
     }
     s.bump();
     Ok(Value::Null)
@@ -314,6 +522,78 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(state_json(s))
 }
 
+/// How many whole characters `before_bytes` / `after_bytes` cover around `r`.
+///
+/// This is the input method's own byte count, as winit reports it: a count that ends inside a
+/// UTF-8 character leaves that whole character (stock egui's `surrounding_bytes_to_chars`), so a
+/// malformed or platform-specific offset never splits or corrupts the document.
+fn surrounding_bytes_as_chars(text: &str, n: usize, r: std::ops::Range<usize>, before_bytes: usize, after_bytes: usize) -> (usize, usize) {
+    let r = r.start.min(n)..r.end.min(n);
+    let (start_byte, end_byte) = char_bytes(text, r.start, r.end);
+    let from = start_byte.saturating_sub(before_bytes);
+    let before = text.get(..start_byte).map_or(0, |head| head.char_indices().rev().take_while(|(i, _)| *i >= from).count());
+    let after = text.get(end_byte..).map_or(0, |tail| tail.char_indices().take_while(|(i, c)| i.saturating_add(c.len_utf8()) <= after_bytes).count());
+    (before.min(r.start), after.min(n.saturating_sub(r.end)))
+}
+
+/// Delete the text an input method marks for replacement around the selection
+/// (`DeleteSurrounding`, `DeleteSurroundingBytes`).
+///
+/// Unlike [`delete`] with an explicit range, the **selection stays**: the characters before its
+/// start and after its end are removed in two separate ranges, and the following `Commit`
+/// replaces the selected text. `bytes` counts UTF-8 bytes (`before`/`after` are characters
+/// otherwise); a count that ends inside a character leaves that character.
+///
+/// The counts are computed from the one document `edit_doc` already evaluated, so an animated
+/// Source Text and a large static document are not copied or evaluated again just to decide what
+/// the input method asked to replace.
+fn delete_surrounding(s: &mut Session, p: &Value) -> Result<Value> {
+    let lid = target(s, p, "text.deleteSurrounding")?;
+    // Only an open edit session has a selection to keep: without one there is nothing an input
+    // method could be replacing.
+    let e = match &s.state.text_edit {
+        Some(e) if e.layer == lid => e.clone(),
+        _ => return Err(bad("text.deleteSurrounding", "not editing this text layer")),
+    };
+    let count = |k: &str| p.get(k).and_then(Value::as_u64).map_or(0, |v| usize::try_from(v).unwrap_or(usize::MAX));
+    let (before_count, after_count) = (count("before"), count("after"));
+    let bytes = b_p(p, "bytes").unwrap_or(false);
+    let merge = str_p(p, "merge").map(str::to_string);
+    edit_doc(s, "Edit Text", merge.as_deref(), lid, |doc, st| {
+        let n = doc.char_len();
+        let r = e.range().start.min(n)..e.range().end.min(n);
+        let (before, after) = if bytes {
+            surrounding_bytes_as_chars(&doc.text, n, r.clone(), before_count, after_count)
+        } else {
+            (before_count.min(r.start), after_count.min(n.saturating_sub(r.end)))
+        };
+        let start = r.start.saturating_sub(before);
+        let end = r.end.saturating_add(after).min(n);
+        if start == r.start && end == r.end {
+            // Deletion-only batches with an empty count, or a document with nothing around the
+            // selection: no empty undo step.
+            return Ok(());
+        }
+        // The selection keeps its text: remove after it first, then before it, so the two ranges
+        // stay valid and the caret/selection shift by the characters before it.
+        if end > r.end {
+            doc.replace_range(r.end..end, "", None);
+        }
+        if r.start > start {
+            doc.replace_range(start..r.start, "", None);
+        }
+        if let Some(ed) = st.text_edit.as_mut().filter(|ed| ed.layer == lid) {
+            let shift = r.start.saturating_sub(start);
+            ed.anchor = ed.anchor.saturating_sub(shift);
+            ed.caret = ed.caret.saturating_sub(shift);
+            ed.pending = None;
+            ed.goal_x = None;
+        }
+        Ok(())
+    })?;
+    Ok(state_json(s))
+}
+
 /// Selected text (plain) of the session, and its formatted fragment.
 fn selection_doc(s: &Session) -> Option<TextDoc> {
     let e = s.state.text_edit.as_ref()?;
@@ -448,16 +728,111 @@ fn paste_formatting(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(state_json(s))
 }
 
-/// Keep the session valid after undo / external edits: clamp the selection, drop it when the
+/// Give the current editor a fresh replacement epoch after its document/layer was replaced.
+pub(crate) fn invalidate_session(s: &mut Session) {
+    let replaced = s.state.text_edit.is_some();
+    if let Some(e) = s.state.text_edit.as_mut() {
+        e.session = next_edit_session();
+    }
+    if replaced {
+        s.note_text_edit_change();
+    }
+}
+
+/// Clamp the editor selection and give it a fresh IME epoch after its document was replaced.
+///
+/// This is the one replacement path for document changes outside `edit_doc`:
+/// [`crate::Session::edit`] calls [`after_external_change`] after every edit, [`crate::Session::set_time`]
+/// and [`crate::Session::sync_related_times`] call it after moving the CTI, and
+/// [`crate::Session::sanitize_after_replacement`] calls it with the editor document snapshotted
+/// before a history restore or rollback.
+/// Clamping first means a shortened document leaves the caret in range, so the next Backspace
+/// deletes instead of being swallowed by an out-of-range selection.
+pub(crate) fn document_replaced(s: &mut Session) {
+    sanitize(s);
+    invalidate_session(s);
+}
+
+/// The identity and document of the active on-canvas editor at one moment.
+///
+/// The composition and the editor session are part of the identity: a restoration must not keep
+/// a composition alive when the snapshot came from another comp, or from an intermediate editor
+/// that was restarted during the operation being rolled back.
+#[derive(Clone, Debug, PartialEq)]
+pub struct EditorSnapshot {
+    /// The composition the editor was attached to.
+    pub comp: ItemId,
+    /// The edited layer.
+    pub layer: LayerId,
+    /// The editor session token, unique across the process.
+    pub session: u64,
+    /// The Source Text the editor was showing.
+    pub doc: TextDoc,
+}
+
+/// The identity and document the active on-canvas editor is showing.
+///
+/// [`crate::Session::edit`] and the time setters snapshot this before a change and compare it
+/// afterwards: only a change that actually replaces this document starts a new epoch, while a
+/// write to another property, layer or composition, a move to a time showing the same text, or a
+/// write that leaves the text as it was, keeps the editor's owner. With no editor open this is a
+/// single `Option` check, with no document copy.
+pub fn active_editor_snapshot(s: &Session) -> Option<EditorSnapshot> {
+    let e = s.state.text_edit.as_ref()?;
+    Some(EditorSnapshot { comp: s.active_comp_id()?, layer: e.layer, session: e.session, doc: layer_doc(s, e.layer)? })
+}
+
+/// Finish an edit outside the editor: if it replaced the document the editor owned, clamp the
+/// selection and start a new IME epoch.
+///
+/// An edit that itself moves or closes the editor owns the resulting session, so an identity
+/// mismatch is not a replacement here.
+pub(crate) fn after_external_change(s: &mut Session, before: Option<&EditorSnapshot>) {
+    let Some(before) = before else { return };
+    let Some(e) = s.state.text_edit.as_ref() else { return };
+    if s.state.active_comp != Some(before.comp) || e.layer != before.layer || e.session != before.session {
+        return;
+    }
+    if layer_doc(s, before.layer).as_ref() != Some(&before.doc) {
+        document_replaced(s);
+    }
+}
+
+/// Finish a project-state replacement (undo, redo, a history jump, a rollback): keep the editor
+/// only when the restored state still has the same composition, layer and editor session and
+/// shows byte/style-equal text.
+///
+/// The restored session token is the one saved in the replaced state, so an intermediate
+/// restart or cross-comp switch must be detected against the snapshot instead of being assumed
+/// to be the editor's own change.
+pub(crate) fn after_replacement(s: &mut Session, before: Option<&EditorSnapshot>) {
+    let Some(before) = before else {
+        // No editor was open when the snapshot was taken: a restored editor must not inherit a
+        // composition from the state the replacement replaced.
+        if s.state.text_edit.is_some() {
+            document_replaced(s);
+        }
+        return;
+    };
+    let same = s.state.text_edit.as_ref().is_some_and(|e| s.state.active_comp == Some(before.comp) && e.layer == before.layer && e.session == before.session);
+    if !same || layer_doc(s, before.layer).as_ref() != Some(&before.doc) {
+        document_replaced(s);
+    }
+}
+
+/// Keep the session valid after routine state cleanup: clamp the selection, drop it when the
 /// layer is gone or not in the active comp.
+///
+/// This is also called after project-item cleanup that leaves the edited document alone, so it
+/// must not advance [`TextEdit::session`]: that would make the viewer treat unrelated cleanup as
+/// a document replacement and interrupt the active IME composition. Replacement paths call
+/// [`document_replaced`] instead.
 pub(crate) fn sanitize(s: &mut Session) {
     let Some(e) = s.state.text_edit.clone() else { return };
     match layer_doc(s, e.layer) {
         Some(d) => {
             let n = d.char_len();
-            if (e.anchor > n || e.caret > n)
-                && let Some(ed) = s.state.text_edit.as_mut()
-            {
+            if let Some(ed) = s.state.text_edit.as_mut() {
                 ed.anchor = ed.anchor.min(n);
                 ed.caret = ed.caret.min(n);
             }
@@ -536,6 +911,8 @@ fn editing(s: &Session) -> std::result::Result<(), String> {
     if s.state.text_edit.is_some() { Ok(()) } else { Err("not editing text".into()) }
 }
 
+/// The command specs of this module: the `text.*` editing, selection and caret commands and
+/// the two `edit.pasteText*` commands, each with its parameter shape and enablement predicate.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!(
@@ -594,6 +971,15 @@ pub fn specs() -> Vec<CommandSpec> {
             editing_or_text_layer,
             delete
         ),
+        cmd!(
+            "text.deleteSurrounding",
+            "Delete Text Around Selection",
+            [],
+            None,
+            "{layer?, before?, after?, bytes?, merge?} (input-method replacement: the characters before and after the selection are deleted, the selection stays; bytes counts UTF-8 bytes)",
+            editing_or_text_layer,
+            delete_surrounding
+        ),
         cmd!(
             "edit.pasteTextMatchFormatting",
             "Paste Text and Match Formatting",
diff --git a/crates/engine/src/commands/three_d.rs b/crates/engine/src/cmd/three_d.rs
similarity index 92%
rename from crates/engine/src/commands/three_d.rs
rename to crates/engine/src/cmd/three_d.rs
index e143690d3..3355b68e3 100644
--- a/crates/engine/src/commands/three_d.rs
+++ b/crates/engine/src/cmd/three_d.rs
@@ -12,6 +12,7 @@ use effectcraft_time::Tick;
 use serde_json::{Value, json};
 
 use super::layer::{color_p, insert_layer};
+use super::model3d::{report_switch, use_advanced_3d};
 use super::{CommandSpec, b_p, bad, comp_id, f_p, has_comp, layer_mut, layer_p, merge_p, str_p, time_p};
 use crate::{EngineError, Result, Session, cmd, query};
 
@@ -227,12 +228,17 @@ fn new_light(s: &mut Session, p: &Value) -> Result<Value> {
     };
     let name = str_p(p, "name").unwrap_or("Light 1").to_string();
     let t = time_p(s, p, Some(&comp));
-    let id = s.edit("New Light", None, |proj, st| {
+    // Only the Advanced 3D renderer lights with Environment lights, so adding one switches a
+    // Classic 3D comp to it, like After Effects (inside the adding edit: one undo step).
+    let env = kind == LightKind::Environment;
+    let (id, switched) = s.edit("New Light", None, |proj, st| {
         let mut l = build::layer(proj, &comp, &name, LayerSource::Light { kind }, (comp.width, comp.height), None);
         apply_light(&mut l, p, t, "layer.newLight")?;
-        insert_layer(proj, st, cid, l)
+        let id = insert_layer(proj, st, cid, l)?;
+        Ok((id, if env { use_advanced_3d(proj, cid)? } else { false }))
     })?;
-    Ok(json!({"layer": id.0}))
+    report_switch(s, cid, switched, "which Environment lights need to light the scene");
+    Ok(json!({"layer": id.0, "advanced3d": env}))
 }
 
 fn light_settings(s: &mut Session, p: &Value) -> Result<Value> {
@@ -248,7 +254,7 @@ fn light_settings(s: &mut Session, p: &Value) -> Result<Value> {
         ),
         None => None,
     };
-    s.edit("Light Settings", None, |proj, _| {
+    let switched = s.edit("Light Settings", None, |proj, _| {
         let old = proj.comp(cid).and_then(|c| c.layer(lid)).cloned().ok_or(EngineError::NoComp)?;
         let mut l = old.clone();
         if let Some(k) = kind
@@ -288,9 +294,14 @@ fn light_settings(s: &mut Session, p: &Value) -> Result<Value> {
             l.name = n.clone();
         }
         apply_light(&mut l, p, t, "layer.lightSettings")?;
+        // A light that becomes an Environment light switches a Classic 3D comp to Advanced 3D,
+        // like adding one does; editing one that already is leaves the renderer to the user.
+        let was_env = matches!(old.source, LayerSource::Light { kind: LightKind::Environment });
+        let is_env = matches!(l.source, LayerSource::Light { kind: LightKind::Environment });
         *layer_mut(proj, cid, lid)? = l;
-        Ok(())
+        Ok(if !was_env && is_env { use_advanced_3d(proj, cid)? } else { false })
     })?;
+    report_switch(s, cid, switched, "which Environment lights need to light the scene");
     Ok(Value::Null)
 }
 
@@ -407,13 +418,24 @@ fn set_view_camera(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"view": v.id()}))
 }
 
+/// Returns the active comp's 3D view state, with the comp size, for the 3D view commands.
 fn get_3d(s: &mut Session, p: &Value) -> Result<Value> {
     let cid = comp_id(s, p)?;
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let (w, h) = (comp.width as f64, comp.height as f64);
     let vs = s.state.views3d.get(&cid).cloned().unwrap_or_default();
     let t = s.state.times.get(&cid).copied().unwrap_or(Tick::ZERO);
-    let ctx = EvalCtx { project: &s.project, comp_id: cid, comp, time: t, expr: s.expr.as_deref(), footage: None };
+    let ctx = EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let cam = vs.override_camera(w, h).unwrap_or_else(|| camera::active_camera(&ctx));
     let f = cam.forward();
     let lights: Vec<Value> = comp
@@ -480,7 +502,7 @@ fn camera_tool(s: &mut Session, p: &Value, op: ToolOp, cmd: &str, label: &str) -
         let poi = if two {
             Vec3::from(get_at(l, "transform/poi", t).map(|v| v.as_vec3()).unwrap_or([w / 2.0, h / 2.0, 0.0]))
         } else {
-            let fwd = (Mat4::orientation(Vec3::from(o)) * Mat4::rotate_y(ry) * Mat4::rotate_x(rx)).apply_vec(vec3(0.0, 0.0, 1.0));
+            let fwd = (Mat4::orientation(Vec3::from(o)) * Mat4::rotation_xyz(rx, ry, 0.0)).apply_vec(vec3(0.0, 0.0, 1.0));
             pos + fwd * zoom
         };
         let mut rig = Rig { eye: pos, poi, zoom, ortho: false };
@@ -532,7 +554,7 @@ fn auto_orient(s: &mut Session, p: &Value) -> Result<Value> {
     };
     s.edit("Auto-Orient", None, |proj, _| {
         let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
+        for l in comp.layers.iter_mut_where(|l| ids.contains(&l.id)) {
             let rig = l.is_camera() || l.is_light();
             let ok = match mode {
                 AutoOrient::Off | AutoOrient::AlongPath => true,
@@ -555,7 +577,17 @@ fn auto_orient(s: &mut Session, p: &Value) -> Result<Value> {
 /// through each layer's world matrix; cameras and lights contribute their position).
 fn layer_points(s: &Session, cid: ItemId, ids: &[LayerId], t: Tick) -> Vec<Vec3> {
     let Some(comp) = s.project.comp(cid) else { return vec![] };
-    let ctx = EvalCtx { project: &s.project, comp_id: cid, comp, time: t, expr: s.expr.as_deref(), footage: None };
+    let ctx = EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let mut out = vec![];
     for l in comp.layers.iter().filter(|l| ids.contains(&l.id)) {
         let m = ctx.world_matrix(l);
@@ -681,7 +713,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Light...",
             ["Layer", "New"],
             Some("Cmd+Alt+Shift+L"),
-            "{kind?: Parallel|Spot|Point|Ambient|Environment (default Spot; Environment lights and reflects from an equirectangular image layer: prop.set its lightOptions/source to that layer's id, or leave it empty for the comp's Environment Layer, see layer.environment), name?, color?, intensity?, coneAngle?, coneFeather?, falloff?: None|Smooth|Inverse Square Clamped, radius?, falloffDistance?, castsShadows?, shadowDarkness?, shadowDiffusion?, position? [x,y,z], poi? [x,y,z]}",
+            "{kind?: Parallel|Spot|Point|Ambient|Environment (default Spot; Environment lights and reflects from an equirectangular image layer: prop.set its lightOptions/source to that layer's id, or leave it empty for the comp's Environment Layer or a flat default environment of its colour and intensity, see layer.environment; an Environment light switches a Classic 3D comp to Advanced 3D), name?, color?, intensity?, coneAngle?, coneFeather?, falloff?: None|Smooth|Inverse Square Clamped, radius?, falloffDistance?, castsShadows?, shadowDarkness?, shadowDiffusion?, position? [x,y,z], poi? [x,y,z]}",
             has_comp,
             new_light
         ),
@@ -708,7 +740,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Light Settings...",
             [],
             None,
-            "{layer?, name?, kind?: Parallel|Spot|Point|Ambient|Environment, color?, intensity?, coneAngle?, coneFeather?, falloff?, radius?, falloffDistance?, castsShadows?, shadowDarkness?, shadowDiffusion?, position?, poi?}",
+            "{layer?, name?, kind?: Parallel|Spot|Point|Ambient|Environment (changing to Environment switches a Classic 3D comp to Advanced 3D), color?, intensity?, coneAngle?, coneFeather?, falloff?, radius?, falloffDistance?, castsShadows?, shadowDarkness?, shadowDiffusion?, position?, poi?}",
             has_comp,
             light_settings
         ),
diff --git a/crates/engine/src/commands/time.rs b/crates/engine/src/cmd/time.rs
similarity index 94%
rename from crates/engine/src/commands/time.rs
rename to crates/engine/src/cmd/time.rs
index 8cb3071bf..556c02bcb 100644
--- a/crates/engine/src/commands/time.rs
+++ b/crates/engine/src/cmd/time.rs
@@ -28,6 +28,20 @@ pub fn display_time(s: &Session, comp: &Comp, t: Tick) -> String {
     }
 }
 
+/// A length (a layer's Duration) in the project's Time Display Style: a count of frames, so
+/// neither Start Numbering Frames At nor the comp's Start Timecode moves it.
+pub fn display_duration(s: &Session, comp: &Comp, len: Tick) -> String {
+    let fr = comp.frame_rate;
+    let n = fr.frame_at(len);
+    match s.project.settings.time_display {
+        TimeDisplayStyle::Frames => format!("{n:05}"),
+        TimeDisplayStyle::Feet35 | TimeDisplayStyle::Feet16 => {
+            effectcraft_time::format_feet_frames(n, s.project.settings.time_display.frames_per_foot().unwrap_or(16))
+        }
+        TimeDisplayStyle::Timecode => effectcraft_time::format_timecode_ae(n, fr, false),
+    }
+}
+
 /// Parse a time typed in the project's Time Display Style (relative `+n`/`-n` from frame
 /// `current`) into a comp frame.
 pub fn parse_display_time(s: &Session, comp: &Comp, text: &str, current: i64) -> std::result::Result<i64, String> {
diff --git a/crates/engine/src/commands/timeline.rs b/crates/engine/src/cmd/timeline.rs
similarity index 66%
rename from crates/engine/src/commands/timeline.rs
rename to crates/engine/src/cmd/timeline.rs
index 633e73c5a..fbc11654f 100644
--- a/crates/engine/src/commands/timeline.rs
+++ b/crates/engine/src/cmd/timeline.rs
@@ -5,14 +5,18 @@
 //! The native `.prproj` format has no public specification and is not read or written.
 
 use std::collections::HashMap;
+use std::sync::Arc;
 
 use effectcraft_interchange::{ExportOptions, ImportOptions, PrecompMode, PrerenderMode, Prerendered, TimelineFormat};
 use effectcraft_project::render_queue::{AudioOutput, Channels, OutputFormat, OutputModule, ProResProfile, RenderQueueItem, TimeSpan};
 use effectcraft_project::{ItemId, LayerId, LayerSource, Project};
 use serde_json::{Value, json};
 
-use super::{CommandSpec, always, bad, comp_id, f_p, has_comp, str_p};
-use crate::{EngineError, Result, Session, cmd};
+use super::{CommandSpec, always, b_p, bad, comp_id, f_p, has_comp, str_p};
+use crate::jobs::TaskCtl;
+use crate::{EngineError, Exporter, Result, Session, cmd};
+
+mod staging;
 
 fn format_p(p: &Value, cmd: &str) -> Result<Option<TimelineFormat>> {
     match str_p(p, "format") {
@@ -95,18 +99,35 @@ fn isolate(project: &Project, cid: ItemId, lid: LayerId) -> Option<Project> {
     Some(q)
 }
 
-/// Render one layer to ProRes 4444 with alpha over its in–out span.
-fn prerender(s: &Session, cid: ItemId, lid: LayerId, path: &str) -> std::result::Result<Prerendered, String> {
-    let exporter = s.exporter.clone().ok_or("export is not available in this build")?;
+/// What a pre-render needs from the session, so it can run on a background thread.
+struct PrerenderCx {
+    protected: crate::output_guard::Protected,
+    exporter: Option<Arc<dyn Exporter>>,
+    footage: Arc<dyn effectcraft_render::FootageSource>,
+    expr: Option<Arc<dyn effectcraft_render::ExprHost>>,
+    accel: Option<Arc<dyn effectcraft_render::Accelerator>>,
+    nested_switches: bool,
+}
+
+/// Render one layer to ProRes 4444 with alpha over its in–out span; `progress` as the exporter's.
+fn prerender(
+    cx: &PrerenderCx,
+    project: &Project,
+    cid: ItemId,
+    lid: LayerId,
+    path: &str,
+    progress: &mut dyn FnMut(u64, u64) -> bool,
+) -> std::result::Result<Prerendered, String> {
+    let exporter = cx.exporter.as_ref().ok_or("export is not available in this build")?;
     if !exporter.formats().contains(&OutputFormat::ProRes) {
         return Err("ProRes export is not available in this build".into());
     }
-    let comp = s.project.comp(cid).ok_or("no composition")?;
+    let comp = project.comp(cid).ok_or("no composition")?;
     let l = comp.layer(lid).ok_or("no layer")?;
     let fd = comp.frame_duration();
     let start = comp.frame_rate.snap(l.in_point.max(effectcraft_time::Tick::ZERO));
     let end = l.out_point.min(comp.duration).max(start + fd);
-    let q = isolate(&s.project, cid, lid).ok_or("no composition")?;
+    let q = isolate(project, cid, lid).ok_or("no composition")?;
     let mut item = RenderQueueItem::new(0, cid);
     item.settings.time_span = TimeSpan::Custom { start, end };
     item.output = OutputModule::for_format(OutputFormat::ProRes);
@@ -116,16 +137,16 @@ fn prerender(s: &Session, cid: ItemId, lid: LayerId, path: &str) -> std::result:
     item.output.output = path.to_string();
     let job = crate::ExportJob {
         project: &q,
-        footage: s.footage.as_ref(),
-        expr: s.expr.as_deref(),
-        accel: s.accel.as_deref(),
+        footage: cx.footage.as_ref(),
+        expr: cx.expr.as_deref(),
+        accel: cx.accel.as_deref(),
         item: &item,
         path,
         storage: None,
         label: format!("Pre-render {}", l.name),
-        nested_switches: s.prefs.general.switches_affect_nested_comps,
+        nested_switches: cx.nested_switches,
     };
-    let r = exporter.export(&job, &mut |_, _| true)?;
+    let r = exporter.export(&job, progress)?;
     Ok(Prerendered { path: r.path, width: comp.width, height: comp.height, frame_rate: comp.frame_rate, duration: end - start })
 }
 
@@ -139,6 +160,7 @@ fn export_timeline(s: &mut Session, p: &Value) -> Result<Value> {
         }
         path = format!("{path}.{}", format.extension());
     }
+    s.refuse_export(&path)?;
     let cid = comp_id(s, p)?;
     let prerender_mode = match str_p(p, "prerender") {
         None => match p.get("prerender").and_then(Value::as_bool) {
@@ -157,33 +179,86 @@ fn export_timeline(s: &mut Session, p: &Value) -> Result<Value> {
     let stem = fp.file_stem().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "Timeline".into());
     let relative_to = Some(dir.to_string_lossy().to_string()).filter(|d| !d.is_empty());
     let opts = ExportOptions { format, prerender: prerender_mode, precomps, relative_to };
-    // Pre-render what the timeline can't represent.
+    let project = s.project.clone();
+    let cx = PrerenderCx {
+        protected: crate::output_guard::Protected::of(s),
+        exporter: s.exporter.clone(),
+        footage: s.footage.clone(),
+        expr: s.expr.clone(),
+        accel: s.accel.clone(),
+        nested_switches: s.prefs.general.switches_affect_nested_comps,
+    };
+    // The pre-renders can take minutes: with `background` (the export dialog) they run as a job
+    // in Window ▸ Progress instead of with the window waiting (#2269).
+    let wait = !b_p(p, "background").unwrap_or(false);
+    s.spawn_task("exportTimeline", format!("Export {}", format.label()), wait, move |ctl| {
+        let (bytes, mut result, staged) = export_timeline_work(&cx, &project, cid, &opts, &dir, &stem, ctl)?;
+        if let Some(source) = cx.protected.find(std::path::Path::new(&path)) {
+            return Err(source.refusal(&path, crate::output_guard::Use::Export));
+        }
+        result["path"] = json!(path);
+        result["toast"] = json!(match format {
+            TimelineFormat::Fcp7Xml => format!("Exported {path} (Final Cut Pro XML; import it in Premiere Pro with File ▸ Import)"),
+            _ => format!("Exported {path} ({})", format.label()),
+        });
+        Ok(Box::new(move |s: &mut Session| {
+            s.refuse_export(&path)?;
+            staging::commit(staged, s)?;
+            s.write_output(&path, &bytes)?;
+            Ok(result)
+        }))
+    })
+}
+
+/// Pre-render what the timeline can't represent, then build the timeline: its bytes and the
+/// command's result (without `path`).
+fn export_timeline_work(
+    cx: &PrerenderCx,
+    project: &Project,
+    cid: ItemId,
+    opts: &ExportOptions,
+    dir: &std::path::Path,
+    stem: &str,
+    ctl: &TaskCtl,
+) -> std::result::Result<(Vec<u8>, Value, Vec<staging::Movie>), String> {
     let mut pre: HashMap<(ItemId, LayerId), Prerendered> = HashMap::new();
     let mut rendered = vec![];
     let mut errors = vec![];
-    for (c, l) in effectcraft_interchange::plan_prerender(&s.project, cid, &opts) {
-        let comp_name = s.project.item(c).map(|i| i.name.clone()).unwrap_or_default();
-        let layer_name = s.project.comp(c).and_then(|cc| cc.layer(l)).map(|x| x.name.clone()).unwrap_or_default();
+    let mut staged = vec![];
+    let plan = effectcraft_interchange::plan_prerender(project, cid, opts);
+    if plan.len() > staging::MAX_MOVIES {
+        return Err(format!("too many pre-render movies (limit {})", staging::MAX_MOVIES));
+    }
+    let n = plan.len() as u64;
+    for (i, (c, l)) in (0u64..).zip(plan) {
+        let comp_name = project.item(c).map(|it| it.name.clone()).unwrap_or_default();
+        let layer_name = project.comp(c).and_then(|cc| cc.layer(l)).map(|x| x.name.clone()).unwrap_or_default();
+        ctl.message(format!("Pre-render {layer_name}"));
         let file = dir.join(format!("{stem}_{}_{}_{}.mov", safe(&comp_name), safe(&layer_name), l.0)).to_string_lossy().to_string();
-        match prerender(s, c, l, &file) {
-            Ok(r) => {
+        // The movies are outputs too: never over footage, a proxy or the project file.
+        if let Some(source) = cx.protected.find(std::path::Path::new(&file)) {
+            errors.push(format!("{comp_name} ▸ {layer_name}: {}", source.refusal(&file, crate::output_guard::Use::Export)));
+            continue;
+        }
+        // Progress over all the layers, each one's frames a share of it.
+        let mut progress = |done: u64, total: u64| ctl.progress(i * 1000 + done.saturating_mul(1000) / total.max(1), n * 1000);
+        let movie = staging::Movie::new(&file)?;
+        match prerender(cx, project, c, l, &movie.path, &mut progress) {
+            Ok(mut r) => {
+                r.path = file;
                 rendered.push(r.path.clone());
                 pre.insert((c, l), r);
+                staged.push(movie);
             }
+            Err(_) if ctl.cancelled() => return Err(crate::render_queue::CANCELLED.into()),
             Err(e) => errors.push(format!("{comp_name} ▸ {layer_name}: {e}")),
         }
     }
-    let out = effectcraft_interchange::export(&s.project, cid, &opts, &pre).map_err(|e| EngineError::Other(e.to_string()))?;
-    s.services.write_file(&path, &out.bytes).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    let out = effectcraft_interchange::export(project, cid, opts, &pre).map_err(|e| e.to_string())?;
     let mut warnings = out.warnings.clone();
     warnings.extend(errors.iter().map(|e| format!("pre-render failed: {e}")));
-    s.toast(match format {
-        TimelineFormat::Fcp7Xml => format!("Exported {path} (Final Cut Pro XML; import it in Premiere Pro with File ▸ Import)"),
-        _ => format!("Exported {path} ({})", format.label()),
-    });
-    Ok(json!({
-        "path": path,
-        "format": format.id(),
+    let result = json!({
+        "format": opts.format.id(),
         "bytes": out.bytes.len(),
         "sequences": out.sequences,
         "videoTracks": out.video_tracks,
@@ -191,7 +266,8 @@ fn export_timeline(s: &mut Session, p: &Value) -> Result<Value> {
         "clips": out.clips,
         "prerendered": rendered,
         "warnings": warnings,
-    }))
+    });
+    Ok((out.bytes, result, staged))
 }
 
 /// The formats, for agents and the export dialog.
@@ -220,7 +296,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Adobe Premiere Pro Project...",
             ["File", "Export"],
             None,
-            "{comp?, path (Final Cut Pro XML .xml for Premiere Pro or .fcpxml .otio .edl .aaf .omf), format?: xml|fcpxml|otio|edl|aaf|omf, prerender?: none|unsupported|all, precomps?: nest|prerender}",
+            "{comp?, path (Final Cut Pro XML .xml for Premiere Pro or .fcpxml .otio .edl .aaf .omf), format?: xml|fcpxml|otio|edl|aaf|omf, prerender?: none|unsupported|all, precomps?: nest|prerender, background?: bool (pre-render and write as a job, jobs.list / jobs.wait; returns {job})}",
             has_comp,
             export_timeline
         ),
diff --git a/crates/engine/src/cmd/timeline/staging.rs b/crates/engine/src/cmd/timeline/staging.rs
new file mode 100644
index 000000000..026b1200a
--- /dev/null
+++ b/crates/engine/src/cmd/timeline/staging.rs
@@ -0,0 +1,89 @@
+//! Native pre-render files stay private until the app can check the current project.
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::EngineError;
+use crate::Session;
+
+pub(super) const MAX_MOVIES: usize = 4096;
+
+pub(super) struct Movie {
+    pub path: String,
+    #[cfg(not(target_arch = "wasm32"))]
+    directory: tempfile::TempDir,
+    #[cfg(not(target_arch = "wasm32"))]
+    destination: std::path::PathBuf,
+}
+
+impl Movie {
+    pub fn new(path: &str) -> Result<Self, String> {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let path = std::path::Path::new(path);
+            let parent = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(std::path::Path::new("."));
+            std::fs::create_dir_all(parent).map_err(|e| format!("cannot create pre-render folder {}: {e}", parent.display()))?;
+            let directory =
+                tempfile::Builder::new().prefix(".effectcraft-prerender-").tempdir_in(parent).map_err(|e| format!("cannot stage pre-render: {e}"))?;
+            let name = path.file_name().ok_or_else(|| format!("pre-render has no file name: {}", path.display()))?;
+            let staged = directory.path().join(name).to_string_lossy().into_owned();
+            Ok(Self { path: staged, directory, destination: parent.to_path_buf() })
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            // spawn_task is synchronous on WASM, so session mutations cannot interleave.
+            Ok(Self { path: path.to_string() })
+        }
+    }
+}
+
+pub(super) fn commit(movies: Vec<Movie>, session: &Session) -> crate::Result<()> {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        const FILES_PER_MOVIE: usize = 8;
+        if movies.len() > MAX_MOVIES {
+            return Err(EngineError::Other("too many staged pre-render movies".into()));
+        }
+        let mut files = Vec::new();
+        let mut path_bytes = 0usize;
+        for movie in &movies {
+            let entries = std::fs::read_dir(movie.directory.path()).map_err(|e| EngineError::Other(format!("cannot read staged pre-render: {e}")))?;
+            for (index, entry) in entries.take(FILES_PER_MOVIE + 1).enumerate() {
+                if index == FILES_PER_MOVIE {
+                    return Err(EngineError::Other("too many files in a staged pre-render".into()));
+                }
+                let entry = entry.map_err(|e| EngineError::Other(format!("cannot read staged pre-render entry: {e}")))?;
+                let kind = entry.file_type().map_err(|e| EngineError::Other(format!("cannot inspect staged pre-render: {e}")))?;
+                if !kind.is_file() {
+                    return Err(EngineError::Other("a staged pre-render contains an unexpected directory or link".into()));
+                }
+                let source = entry.path();
+                let destination = movie.destination.join(entry.file_name());
+                path_bytes = path_bytes.saturating_add(source.as_os_str().len()).saturating_add(destination.as_os_str().len());
+                if path_bytes > 16 * 1024 * 1024 {
+                    return Err(EngineError::Other("staged pre-render paths exceed the 16 MiB limit".into()));
+                }
+                files.push((source, destination));
+            }
+        }
+        // If a user imported a private staging file, leave the staging folders intact.
+        let protected = session.protected_files();
+        if let Some((source, _)) = files.iter().find(|(source, _)| protected.find(source).is_some()) {
+            let source = source.display().to_string();
+            for movie in movies {
+                let _kept = movie.directory.keep();
+            }
+            return Err(EngineError::Other(format!("staged pre-render {source} is now used by the project; its temporary folder was kept")));
+        }
+        // Preflight every destination before replacing any output, including render logs.
+        for (_, destination) in &files {
+            if let Some(found) = protected.find(destination) {
+                return Err(EngineError::Other(found.refusal(&destination.to_string_lossy(), crate::output_guard::Use::Export)));
+            }
+        }
+        for (source, destination) in files {
+            std::fs::rename(&source, &destination).map_err(|e| EngineError::Other(format!("cannot publish pre-render {}: {e}", destination.display())))?;
+        }
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = (movies, session);
+    Ok(())
+}
diff --git a/crates/engine/src/commands/track.rs b/crates/engine/src/cmd/track.rs
similarity index 100%
rename from crates/engine/src/commands/track.rs
rename to crates/engine/src/cmd/track.rs
diff --git a/crates/engine/src/commands/view.rs b/crates/engine/src/cmd/view.rs
similarity index 98%
rename from crates/engine/src/commands/view.rs
rename to crates/engine/src/cmd/view.rs
index a36c53933..115da8667 100644
--- a/crates/engine/src/commands/view.rs
+++ b/crates/engine/src/cmd/view.rs
@@ -83,10 +83,11 @@ fn clear_guides(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn export_guides(s: &mut Session, p: &Value) -> Result<Value> {
     let path = str_p(p, "path").ok_or_else(|| bad("view.exportGuides", "missing `path`"))?;
+    s.refuse_export(path)?;
     let comp = s.project.comp(comp_id(s, p)?).ok_or(EngineError::NoComp)?;
     let doc = json!({"effectcraftGuides": 1, "width": comp.width, "height": comp.height, "guides": comp.guides});
     let text = serde_json::to_string_pretty(&doc).unwrap_or_default();
-    s.services.write_file(path, text.as_bytes()).map_err(|e| EngineError::Other(format!("cannot write {path}: {e}")))?;
+    s.write_output(path, text.as_bytes())?;
     Ok(json!({"path": path, "guides": comp.guides.len()}))
 }
 
diff --git a/crates/engine/src/commands/viewer_cmds.rs b/crates/engine/src/cmd/viewer_cmds.rs
similarity index 96%
rename from crates/engine/src/commands/viewer_cmds.rs
rename to crates/engine/src/cmd/viewer_cmds.rs
index cba8a418c..698a46f02 100644
--- a/crates/engine/src/commands/viewer_cmds.rs
+++ b/crates/engine/src/cmd/viewer_cmds.rs
@@ -159,9 +159,14 @@ fn take_snapshot(s: &mut Session, p: &Value) -> Result<Value> {
     let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
     let t = s.time_of(cid);
     let scale = f_p(p, "scale").unwrap_or(1.0).clamp(0.05, 1.0);
-    let img = s.render(cid, t, RenderOpts { scale, guides: true, view: s.view_camera(cid).filter(|_| comp.has_3d()), ..Default::default() });
+    // 32 bpc: without the HDR step, so viewer exposure reaches the over-range values (the
+    // display pass applies the step, as for viewer frames).
+    let skip_hdr_step = s.project.settings.bit_depth.levels().is_none();
+    let opts = RenderOpts { scale, guides: true, view: s.view_camera(cid).filter(|_| comp.has_3d()), skip_hdr_step, ..Default::default() };
+    let img = s.render(cid, t, opts);
     let (w, h) = (img.width, img.height);
-    s.snapshot = Some(Snapshot { comp: cid, time: t, scale, image: std::sync::Arc::new(img) });
+    let encoding = crate::viewer::FrameEncoding::of(&s.project.settings, skip_hdr_step);
+    s.snapshot = Some(Snapshot { comp: cid, time: t, scale, image: std::sync::Arc::new(img), encoding });
     s.events.push(crate::Event::ProjectChanged { revision: s.revision });
     Ok(json!({"width": w, "height": h, "time": t.seconds()}))
 }
@@ -298,15 +303,17 @@ fn new_path(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"layer": lid.0, "group": group, "path": path_uid}))
 }
 
-/// Snapshot image as straight 8-bit RGBA rows (for frontends / `--out`).
+/// Snapshot image as straight 8-bit RGBA rows (for frontends / `--out`), with the HDR step a
+/// 32 bpc snapshot was taken without.
 pub fn snapshot_rgba8(s: &Session) -> Option<(u32, u32, Vec<u8>)> {
     let snap = s.snapshot.as_ref()?;
     let img = &snap.image;
     let mut out = Vec::with_capacity(img.data.len() * 4);
     for p in &img.data {
         let a = p[3].clamp(0.0, 1.0);
-        let un = |c: f32| if a > 0.0 { (c / a).clamp(0.0, 1.0) } else { 0.0 };
-        out.extend([un(p[0]), un(p[1]), un(p[2]), a].map(|v| (v * 255.0 + 0.5) as u8));
+        let un = |c: f32| if a > 0.0 { c / a } else { 0.0 };
+        let c = snap.encoding.finish([un(p[0]), un(p[1]), un(p[2])]).map(|v| v.clamp(0.0, 1.0));
+        out.extend([c[0], c[1], c[2], a].map(|v| (v * 255.0 + 0.5) as u8));
     }
     Some((img.width, img.height, out))
 }
diff --git a/crates/engine/src/commands/vpe.rs b/crates/engine/src/cmd/vpe.rs
similarity index 100%
rename from crates/engine/src/commands/vpe.rs
rename to crates/engine/src/cmd/vpe.rs
diff --git a/crates/engine/src/commands/vr_editor.rs b/crates/engine/src/cmd/vr_editor.rs
similarity index 94%
rename from crates/engine/src/commands/vr_editor.rs
rename to crates/engine/src/cmd/vr_editor.rs
index e62281128..12ebcda5b 100644
--- a/crates/engine/src/commands/vr_editor.rs
+++ b/crates/engine/src/cmd/vr_editor.rs
@@ -79,12 +79,10 @@ fn norm(a: f64) -> f64 {
     (r * 1e6).round() / 1e6
 }
 
-/// Orientation angles (X, Y, Z degrees, applied X then Y then Z) of a rotation matrix.
+/// Orientation angles (X, Y, Z degrees, [`Mat4::orientation`] order) of a rotation matrix.
 pub fn euler(m: Mat4) -> [f64; 3] {
-    let m = m.0;
-    let y = (-m[2][0]).clamp(-1.0, 1.0).asin();
-    let (x, z) = if y.cos().abs() > 1e-6 { (m[2][1].atan2(m[2][2]), m[1][0].atan2(m[0][0])) } else { ((-m[1][2]).atan2(m[1][1]), 0.0) };
-    [norm(x.to_degrees()), norm(y.to_degrees()), norm(z.to_degrees())]
+    let o = m.orientation_angles();
+    [norm(o.x), norm(o.y), norm(o.z)]
 }
 
 /// The current view orientation of an environment (from its Front camera).
diff --git a/crates/engine/src/commands/warp_cmds.rs b/crates/engine/src/cmd/warp_cmds.rs
similarity index 100%
rename from crates/engine/src/commands/warp_cmds.rs
rename to crates/engine/src/cmd/warp_cmds.rs
diff --git a/crates/engine/src/commands/watch_folder.rs b/crates/engine/src/cmd/watch_folder.rs
similarity index 96%
rename from crates/engine/src/commands/watch_folder.rs
rename to crates/engine/src/cmd/watch_folder.rs
index fd41071ed..6e480a9e6 100644
--- a/crates/engine/src/commands/watch_folder.rs
+++ b/crates/engine/src/cmd/watch_folder.rs
@@ -88,6 +88,9 @@ fn render_project(host: &Session, path: &Path) -> Value {
         let failed = s.project.render_queue.iter().any(|i| matches!(i.status, RenderStatus::Failed(_)));
         Ok(json!({"state": if failed { "failed" } else { "done" }, "items": items}))
     })();
+    // The project shared `host`'s footage source and gave it its own set of footage effects read
+    // the channels of (#474): give back the host's.
+    host.footage.set_aux_footage(host.aux_footage.as_deref().unwrap_or(&[]));
     let mut v = match result {
         Ok(v) => v,
         Err(e) => json!({"state": "failed", "error": e, "items": []}),
diff --git a/crates/engine/src/commands/content_fill.rs b/crates/engine/src/commands/content_fill.rs
deleted file mode 100644
index 650df5e73..000000000
--- a/crates/engine/src/commands/content_fill.rs
+++ /dev/null
@@ -1,426 +0,0 @@
-//! Content-Aware Fill (Window ▸ Content-Aware Fill, Layer ▸ New ▸ Content-Aware Fill Layer):
-//! fill the transparent area of a layer (what its masks cut away) across the work area or the
-//! whole layer, render the result as a PNG sequence and add it as a "Fill" layer above the
-//! source, like After Effects. The algorithms are `effectcraft_raster::inpaint` (Object:
-//! flow-guided propagation + PatchMatch; Surface: propagation + one synthesised fill carried by
-//! the flow; Edge Blend: membrane fill). It runs as a background job (Window ▸ Progress); in
-//! the browser the job goes to a job worker ([`FillPlan`], `offload::WorkerJob::ContentFill`),
-//! whose own WebGPU device renders the layer's frames in passes, and the files come back to
-//! browser storage.
-
-use std::sync::Arc;
-
-use effectcraft_color::Label;
-use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, LayerId, LayerSource, build};
-use effectcraft_raster::Image;
-use effectcraft_raster::inpaint::{FillInput, FillMethod, FillOpts, dilate, fill_sequence};
-use effectcraft_render::{Accelerator, EvalCtx, ExprHost, FootageSource, LayerCache, Renderer};
-use effectcraft_time::Tick;
-use serde::{Deserialize, Serialize};
-use serde_json::{Value, json};
-
-use super::scene_detect::LayerFrames;
-use super::{CommandSpec, always, b_p, bad, f_p, has_layers, layer_p, str_p};
-use crate::jobs::Apply;
-use crate::{EngineError, Result, Session, cmd};
-
-/// Content-Aware Fill panel settings (serde, in [`crate::EditorState`]).
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase", default)]
-pub struct FillSettings {
-    /// `object`, `surface` or `edgeBlend`.
-    pub method: String,
-    /// `workArea` or `entire` (the layer's duration).
-    pub range: String,
-    /// Grow the fill area by this many pixels.
-    pub alpha_expansion: f64,
-    /// `none`, `subtle`, `moderate`, `strong`.
-    pub lighting_correction: String,
-    /// Reference frame: a layer of the comp and the comp time of the frame to use.
-    pub reference_layer: Option<LayerId>,
-    pub reference_time: Option<f64>,
-}
-
-impl Default for FillSettings {
-    fn default() -> Self {
-        FillSettings {
-            method: "object".into(),
-            range: "workArea".into(),
-            alpha_expansion: 0.0,
-            lighting_correction: "none".into(),
-            reference_layer: None,
-            reference_time: None,
-        }
-    }
-}
-
-fn lighting(s: &str) -> Option<f32> {
-    Some(match s {
-        "none" | "off" => 0.0,
-        "subtle" => 0.35,
-        "moderate" => 0.65,
-        "strong" => 1.0,
-        _ => return None,
-    })
-}
-
-fn set(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "contentFill.set";
-    let mut st = s.state.content_fill.clone();
-    if let Some(m) = str_p(p, "method") {
-        st.method = FillMethod::from_name(m).ok_or_else(|| bad(c, "method: object|surface|edgeBlend"))?.name().into();
-    }
-    if let Some(r) = str_p(p, "range") {
-        st.range = match r {
-            "workArea" | "work area" => "workArea".into(),
-            "entire" | "entireDuration" | "layer" => "entire".into(),
-            _ => return Err(bad(c, "range: workArea|entire")),
-        };
-    }
-    if let Some(a) = f_p(p, "alphaExpansion") {
-        st.alpha_expansion = a.clamp(0.0, 100.0);
-    }
-    if let Some(l) = str_p(p, "lightingCorrection") {
-        lighting(l).ok_or_else(|| bad(c, "lightingCorrection: none|subtle|moderate|strong"))?;
-        st.lighting_correction = l.into();
-    }
-    match p.get("referenceLayer") {
-        Some(Value::Null) => st.reference_layer = None,
-        Some(v) => {
-            let comp = s.active_comp().ok_or(EngineError::NoComp)?;
-            st.reference_layer = Some(super::resolve_layer(comp, v).ok_or_else(|| bad(c, format!("no layer {v}")))?);
-            st.reference_time = Some(f_p(p, "referenceTime").unwrap_or(s.time().seconds()));
-        }
-        None => {
-            if let Some(t) = f_p(p, "referenceTime") {
-                st.reference_time = Some(t);
-            }
-        }
-    }
-    s.state.content_fill = st.clone();
-    Ok(serde_json::to_value(st).unwrap_or_default())
-}
-
-/// A layer's masked source at comp time `t` on a `w × h` canvas in layer pixels (straight colour
-/// with alpha 1 where kept), and the hole (`true` where the alpha is under one half).
-fn masked_frame(r: &Renderer, ctx: &EvalCtx, layer: &effectcraft_project::Layer, w: u32, h: u32) -> (Image, Vec<bool>) {
-    let mut img = Image::new(w, h);
-    let mut hole = vec![true; (w * h) as usize];
-    if let Some(buf) = r.layer_input(ctx, layer, 0) {
-        let sc = if buf.scale > 0.0 { buf.scale } else { 1.0 };
-        for y in 0..h {
-            for x in 0..w {
-                let (bx, by) = ((x as f64 + 0.5) * sc - buf.offset[0], (y as f64 + 0.5) * sc - buf.offset[1]);
-                let p = if (sc - 1.0).abs() < 1e-9 { buf.img.get(bx.floor() as i64, by.floor() as i64) } else { buf.img.sample_bilinear(bx, by) };
-                let i = (y * w + x) as usize;
-                if p[3] >= 0.5 {
-                    img.data[i] = [p[0] / p[3], p[1] / p[3], p[2] / p[3], 1.0];
-                    hole[i] = false;
-                }
-            }
-        }
-    }
-    (img, hole)
-}
-
-/// Encode a straight-alpha frame (alpha 1) as 8-bit PNG.
-fn png(img: &Image) -> std::result::Result<Vec<u8>, String> {
-    let rgba: Vec<u8> = img.data.iter().flat_map(|p| [p[0], p[1], p[2], p[3]].map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8)).collect();
-    super::comp_more::encode_png(&rgba, img.width, img.height)
-}
-
-fn default_dir(s: &Session, name: &str) -> String {
-    let base = s.path.as_deref().and_then(|p| std::path::Path::new(p).parent().map(|d| d.join("Fill"))).unwrap_or_else(|| {
-        // (the browser has no temporary folder: its storage)
-        if cfg!(target_arch = "wasm32") { std::path::PathBuf::from("/Fill") } else { std::env::temp_dir().join("effectcraft-fill") }
-    });
-    let safe: String = name.chars().map(|c| if c.is_alphanumeric() || c == '-' || c == '_' { c } else { '_' }).collect();
-    let mut k = 1;
-    loop {
-        let d = base.join(format!("{safe}_Fill_{k}"));
-        let ds = d.to_string_lossy().to_string();
-        if !s.services.exists(&ds) && !s.services.exists(&format!("{ds}/fill_00000.png")) {
-            return ds;
-        }
-        k += 1;
-    }
-}
-
-/// A fill job, detached from the session (it also travels to a browser job worker).
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct FillPlan {
-    pub comp: ItemId,
-    pub layer: LayerId,
-    /// The source layer's name.
-    pub name: String,
-    /// The layer's size (the frames' size).
-    pub width: u32,
-    pub height: u32,
-    /// Comp times of the filled frames.
-    pub times: Vec<Tick>,
-    /// `object`, `surface` or `edgeBlend`.
-    pub method: String,
-    pub lighting: f32,
-    /// Alpha expansion (px).
-    pub expand: usize,
-    /// Reference frame: (layer, comp time).
-    pub reference: Option<(LayerId, Tick)>,
-    /// Folder of the PNG sequence.
-    pub dir: String,
-}
-
-/// Run a fill: the layer's frames (rendered in passes with a job worker's GPU), the fill, the
-/// PNG sequence written into `plan.dir` (`Services::store_file`). Returns the files.
-#[allow(clippy::too_many_arguments)]
-pub(crate) async fn run_plan(
-    plan: &FillPlan,
-    project: &effectcraft_project::Project,
-    footage: &dyn FootageSource,
-    expr: Option<&dyn ExprHost>,
-    cache: &LayerCache,
-    services: &dyn crate::Services,
-    accel: Option<&dyn Accelerator>,
-    progress: &mut dyn FnMut(u64, u64) -> bool,
-    message: &mut dyn FnMut(&str),
-) -> std::result::Result<Vec<String>, String> {
-    message("Reading frames");
-    let (cid, w, h) = (plan.comp, plan.width, plan.height);
-    let comp = project.comp(cid).ok_or("composition missing")?;
-    let layer = comp.layer(plan.layer).ok_or("layer missing")?;
-    let mut r = Renderer::new(project, footage, crate::offload::analysis_opts(accel));
-    r.expr = expr;
-    r.cache = Some(cache);
-    let r = &r;
-    let ctx0 = EvalCtx { expr, ..EvalCtx::new(project, cid, comp, Tick::ZERO) };
-    let times = &plan.times;
-    let n = times.len() as u64;
-    let mut frames = Vec::with_capacity(times.len());
-    let mut holes = Vec::with_capacity(times.len());
-    for (k, t) in times.iter().enumerate() {
-        let (img, hole) = crate::offload::in_passes(accel, |a| masked_frame(&r.with_accel(a), &ctx0.at(*t), layer, w, h)).await;
-        holes.push(dilate(&hole, w as usize, h as usize, plan.expand));
-        frames.push(img);
-        if !progress(k as u64 + 1, n * 3) {
-            return Err(crate::render_queue::CANCELLED.into());
-        }
-    }
-    if !holes.iter().any(|h| h.iter().any(|b| *b)) {
-        return Err("the layer has no transparent area to fill: draw a mask (Subtract) around what to remove".into());
-    }
-    let mut references = vec![];
-    if let Some((rl, rt)) = plan.reference
-        && let Some(l) = comp.layer(rl)
-    {
-        let (img, hole) = crate::offload::in_passes(accel, |a| masked_frame(&r.with_accel(a), &ctx0.at(rt), l, w, h)).await;
-        if hole.iter().all(|b| !*b) {
-            let k = times.iter().enumerate().min_by_key(|(_, t)| (t.0 - rt.0).abs()).map(|(k, _)| k).unwrap_or(0);
-            references.push((k, img));
-        }
-    }
-    message("Filling");
-    let opts = FillOpts { method: FillMethod::from_name(&plan.method).unwrap_or_default(), lighting: plan.lighting, ..Default::default() };
-    let input = FillInput { frames, holes, references };
-    let out = fill_sequence(&input, &opts, &mut |d, t| progress(n + (d as u64 * n / t.max(1) as u64), n * 3)).ok_or(crate::render_queue::CANCELLED)?;
-    message("Writing the fill layer");
-    let dir = &plan.dir;
-    let mut paths = vec![];
-    for (k, img) in out.iter().enumerate() {
-        let path = std::path::Path::new(dir).join(format!("fill_{k:05}.png")).to_string_lossy().to_string();
-        services.store_file(&path, &png(img)?).map_err(|e| format!("{path}: {e}"))?;
-        paths.push(path);
-        if !progress(2 * n + k as u64 + 1, n * 3) {
-            return Err(crate::render_queue::CANCELLED.into());
-        }
-    }
-    Ok(paths)
-}
-
-/// Add the fill layer of a finished plan (one undo step).
-pub(crate) fn apply_plan(s: &mut Session, plan: &FillPlan, paths: Vec<String>) -> Result<Value> {
-    let importer = s.importer.clone();
-    add_fill_layer(s, plan.comp, plan.layer, &plan.name, paths, (plan.width, plan.height), plan.times[0], plan.times.len(), importer)
-}
-
-fn generate(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "contentFill.generate";
-    let (cid, lid) = layer_p(s, p, c)?;
-    // Parameters override the panel settings.
-    let mut st = s.state.content_fill.clone();
-    {
-        let saved = s.state.content_fill.clone();
-        let mut q = p.clone();
-        if let Some(o) = q.as_object_mut() {
-            o.retain(|k, _| ["method", "range", "alphaExpansion", "lightingCorrection", "referenceLayer", "referenceTime"].contains(&k.as_str()));
-        }
-        set(s, &q)?;
-        std::mem::swap(&mut st, &mut s.state.content_fill);
-        s.state.content_fill = saved;
-    }
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?.clone();
-    if !layer.source.is_av() || layer.source.item().is_none() {
-        return Err(bad(c, "Content-Aware Fill needs a footage, solid or precomp layer"));
-    }
-    let (w, h) = effectcraft_render::source_size(&s.project, &layer);
-    if w == 0 || h == 0 {
-        return Err(bad(c, "the layer has no pixels"));
-    }
-    let fr = comp.frame_rate;
-    let (a, b) =
-        if st.range == "entire" { (layer.in_point, layer.out_point) } else { (comp.work_area.0.max(layer.in_point), comp.work_area.1.min(layer.out_point)) };
-    let (a, b) = (a.max(Tick::ZERO), b.min(comp.duration));
-    if b <= a {
-        return Err(bad(c, "the range doesn't overlap the layer"));
-    }
-    let (fa, fb) = (fr.frame_at(fr.snap_nearest(a)), fr.frame_at(b - Tick(1)));
-    let times: Vec<Tick> = (fa..=fb).map(|f| fr.tick_of(f)).collect();
-    let opts = FillOpts {
-        method: FillMethod::from_name(&st.method).unwrap_or_default(),
-        lighting: lighting(&st.lighting_correction).unwrap_or(0.0),
-        ..Default::default()
-    };
-    let expand = st.alpha_expansion.round().max(0.0) as usize;
-    let reference = st.reference_layer.filter(|r| comp.layer(*r).is_some()).map(|r| (r, Tick::from_seconds_f64(st.reference_time.unwrap_or(0.0))));
-    let dir = str_p(p, "outputDir").map(str::to_string).unwrap_or_else(|| default_dir(s, &layer.name));
-    let plan = FillPlan {
-        comp: cid,
-        layer: lid,
-        name: layer.name.clone(),
-        width: w,
-        height: h,
-        times,
-        method: opts.method.name().to_string(),
-        lighting: opts.lighting,
-        expand,
-        reference,
-        dir,
-    };
-    let wait = b_p(p, "wait").unwrap_or(false);
-    // The browser: a job worker (its own GPU), the page keeps running.
-    if !wait && s.offloads() {
-        s.offload_analysis(crate::offload::WorkerJob::ContentFill { plan: Box::new(plan) }).map_err(EngineError::Other)?;
-        return Ok(json!({"job": "contentFill", "started": true, "worker": true}));
-    }
-    let lf = LayerFrames::new(s, cid, lid);
-    let services = s.services.clone();
-    let importer = s.importer.clone();
-    let name = layer.name.clone();
-    s.spawn_task("contentFill", format!("Content-Aware Fill: {name}"), wait, move |ctl| {
-        let paths = effectcraft_render::passes::block_on(run_plan(
-            &plan,
-            &lf.project,
-            lf.footage.as_ref(),
-            lf.expr.as_deref(),
-            &lf.cache,
-            services.as_ref(),
-            None,
-            &mut |d, t| ctl.progress(d, t),
-            &mut |m| ctl.message(m),
-        ))?;
-        let apply: Apply = Box::new(move |s: &mut Session| add_fill_layer(s, cid, lid, &name, paths, (w, h), plan.times[0], plan.times.len(), importer));
-        Ok(apply)
-    })
-}
-
-/// Import the rendered sequence and put it in a layer above the source.
-#[allow(clippy::too_many_arguments)]
-fn add_fill_layer(
-    s: &mut Session,
-    cid: ItemId,
-    lid: LayerId,
-    name: &str,
-    paths: Vec<String>,
-    size: (u32, u32),
-    start: Tick,
-    count: usize,
-    importer: Option<Arc<dyn crate::Importer>>,
-) -> Result<Value> {
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let src = comp.layer(lid).ok_or_else(|| bad("contentFill.generate", "the source layer is gone"))?.clone();
-    let fr = comp.frame_rate;
-    let dur = fr.tick_of(count as i64);
-    let mut footage = importer.and_then(|i| i.probe(&paths[0]).ok()).filter(|f| f.has_video).unwrap_or_else(|| Footage {
-        path: paths[0].clone(),
-        kind: FootageKind::Sequence,
-        width: size.0,
-        height: size.1,
-        has_video: true,
-        codec: "PNG".into(),
-        ..Default::default()
-    });
-    footage.kind = FootageKind::Sequence;
-    footage.sequence = paths.clone();
-    footage.frame_rate = fr;
-    footage.duration = dur;
-    let (lname, item, layer) = s.edit("Content-Aware Fill", None, |proj, st| {
-        let folder = proj.folder_named("Fill").unwrap_or_else(|| proj.add_item("Fill", Label::Yellow, None, ItemKind::Folder));
-        let n = proj.items.values().filter(|i| i.parent == Some(folder)).count() + 1;
-        let lname = format!("Fill {n} [{name}]");
-        let iid = proj.add_item(&lname, Label::Lavender, Some(folder), ItemKind::Footage(footage));
-        let mut l = build::layer(proj, &comp, &lname, LayerSource::Footage { item: iid }, size, Some(dur));
-        l.start_time = start;
-        l.in_point = start;
-        l.out_point = (start + dur).min(comp.duration);
-        l.parent = src.parent;
-        l.switches.three_d = src.switches.three_d;
-        if let (Some(dst), Some(t)) = (l.props.sub_mut("transform"), src.transform()) {
-            let mut tr = t.clone();
-            tr.reassign_uids(&mut proj.next_id);
-            *dst = tr;
-        }
-        let id = l.id;
-        let cm = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        let at = cm.layers.iter().position(|x| x.id == lid).unwrap_or(0);
-        cm.layers.insert(at, l);
-        st.selected_layers = vec![id];
-        Ok((lname, iid, id))
-    })?;
-    Ok(json!({"layer": layer.0, "item": item.0, "name": lname, "frames": count, "files": paths}))
-}
-
-fn open_panel(s: &mut Session, p: &Value) -> Result<Value> {
-    // Parameters given: generate straight away (agents); else show the panel.
-    if p.as_object().is_some_and(|o| !o.is_empty()) {
-        return generate(s, p);
-    }
-    s.events.push(crate::Event::Frontend { command: "window.panel".into(), params: json!({"panel": "contentAwareFill"}) });
-    Ok(json!({"frontend": "window.panel"}))
-}
-
-pub fn specs() -> Vec<CommandSpec> {
-    const P: &str = "{layer?, method?: object|surface|edgeBlend, range?: workArea|entire, alphaExpansion? (px), lightingCorrection?: none|subtle|moderate|strong, referenceLayer?, referenceTime? (s), outputDir?, wait?: bool}";
-    vec![
-        cmd!(
-            "contentFill.set",
-            "Content-Aware Fill Settings",
-            [],
-            None,
-            "{method?: object|surface|edgeBlend, range?: workArea|entire, alphaExpansion? (px), lightingCorrection?: none|subtle|moderate|strong, referenceLayer?: layer|null, referenceTime? (s)}",
-            always,
-            set
-        ),
-        CommandSpec {
-            id: "contentFill.generate",
-            label: "Generate Fill Layer",
-            menu: &[],
-            shortcut: None,
-            alt_shortcuts: &[],
-            params: P,
-            enabled: has_layers,
-            run: generate,
-            journal: true,
-        },
-        CommandSpec {
-            id: "layer.newContentAwareFill",
-            label: "Content-Aware Fill Layer...",
-            menu: &["Layer", "New"],
-            shortcut: None,
-            alt_shortcuts: &[],
-            params: P,
-            enabled: always,
-            run: open_panel,
-            journal: true,
-        },
-    ]
-}
diff --git a/crates/engine/src/commands/effect.rs b/crates/engine/src/commands/effect.rs
deleted file mode 100644
index ce773e545..000000000
--- a/crates/engine/src/commands/effect.rs
+++ /dev/null
@@ -1,715 +0,0 @@
-//! Effect menu and Effect Controls gestures.
-
-use effectcraft_project::build::Ids;
-use effectcraft_project::{GroupKind, Layer, LayerId, PropGroup, Uid};
-use effectcraft_time::Tick;
-use serde_json::{Value, json};
-
-use super::{CommandSpec, b_p, bad, f_p, has_layers, layer_mut, layers_p, str_p};
-use crate::{EngineError, Result, Session, cmd};
-
-/// `effect.plugins.list`: the registered plug-in effects (WebAssembly or Rust).
-fn plugins_list(s: &mut Session, _: &Value) -> Result<Value> {
-    use effectcraft_effects::plugin;
-    let list: Vec<Value> = plugin::plugins()
-        .into_iter()
-        .map(|spec| {
-            let p = plugin::plugin(spec.id);
-            let m = p.as_ref().map(|p| p.manifest().clone());
-            json!({
-                "id": spec.id,
-                "name": spec.name,
-                "category": spec.category,
-                "version": m.as_ref().map(|m| m.version.clone()),
-                "author": m.as_ref().map(|m| m.author.clone()),
-                "description": m.as_ref().map(|m| m.description.clone()),
-                "source": p.map(|p| p.source()),
-                "params": spec.params.iter().map(|p| p.id).collect::<Vec<_>>(),
-            })
-        })
-        .collect();
-    Ok(json!({"api": plugin::PLUGIN_API_VERSION, "wasm": s.plugin_loader.is_some(), "plugins": list}))
-}
-
-/// `effect.plugins.load`: load WebAssembly effect plug-ins (a file, or every `.wasm` in a
-/// folder) through the host's loader ([`Session::plugin_loader`]).
-fn plugins_load(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "effect.plugins.load";
-    let loader = s.plugin_loader.ok_or_else(|| EngineError::Other("WebAssembly effect plug-ins are not available in this build".into()))?;
-    let files: Vec<String> = match (str_p(p, "path"), str_p(p, "folder")) {
-        (Some(path), _) => vec![path.to_string()],
-        (None, Some(dir)) => {
-            let mut v: Vec<String> = std::fs::read_dir(dir)
-                .map_err(|e| bad(c, format!("cannot list {dir}: {e}")))?
-                .flatten()
-                .map(|e| e.path())
-                .filter(|p| p.extension().is_some_and(|x| x.eq_ignore_ascii_case("wasm")))
-                .map(|p| p.to_string_lossy().to_string())
-                .collect();
-            v.sort();
-            v
-        }
-        _ => return Err(bad(c, "give `path` or `folder`")),
-    };
-    let (mut loaded, mut errors) = (vec![], vec![]);
-    for f in &files {
-        let r = s.services.read_file(f).map_err(|e| format!("cannot read {f}: {e}")).and_then(|bytes| loader(&bytes, f));
-        match r {
-            Ok(v) => loaded.push(v),
-            Err(e) => errors.push(json!({"path": f, "error": e})),
-        }
-    }
-    if str_p(p, "path").is_some()
-        && let Some(e) = errors.first()
-    {
-        return Err(EngineError::Other(format!("{}: {}", files[0], e["error"].as_str().unwrap_or("failed"))));
-    }
-    if !loaded.is_empty() {
-        s.toast(format!("Loaded {} effect plug-in(s)", loaded.len()));
-    }
-    Ok(json!({"loaded": loaded, "errors": errors}))
-}
-
-fn apply(s: &mut Session, p: &Value) -> Result<Value> {
-    let name = str_p(p, "effect").ok_or_else(|| bad("effect.apply", "missing `effect` (id or name)"))?;
-    let spec = effectcraft_effects::lookup(name).ok_or_else(|| bad("effect.apply", format!("unknown effect `{name}`")))?;
-    let (cid, ids) = layers_p(s, p)?;
-    if ids.is_empty() {
-        return Err(bad("effect.apply", "no layer"));
-    }
-    let sizes: Vec<_> = {
-        let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-        ids.iter().filter_map(|id| comp.layer(*id)).map(|l| (l.id, effectcraft_render::effect_bounds(&s.project, comp, l).0)).collect()
-    };
-    let uids = s.edit(&format!("Apply {}", spec.name), None, |proj, st| {
-        let mut out = vec![];
-        for (lid, size) in &sizes {
-            let mut next = proj.next_id;
-            let l = layer_mut(proj, cid, *lid)?;
-            let fx = l.props.sub_mut("effects").ok_or_else(|| bad("effect.apply", "this layer type has no effects"))?;
-            let same = fx.groups().filter(|g| g.match_id == spec.id).count();
-            let name = if same == 0 { spec.name.to_string() } else { format!("{} {}", spec.name, same + 1) };
-            let g = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), &name, *size);
-            out.push(g.uid);
-            fx.children.push(g.into());
-            proj.next_id = next;
-            st.selected_props = vec![(*lid, *out.last().unwrap_or(&0))];
-        }
-        st.last_effect = Some(spec.id.to_string());
-        Ok(out)
-    })?;
-    // Each instance's property path prefix (`effects/#2`), ready for prop.set paths.
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let paths: Vec<Value> = sizes
-        .iter()
-        .zip(&uids)
-        .map(|((lid, _), uid)| {
-            let n = comp.layer(*lid).and_then(|l| l.props.group("effects")).and_then(|fx| fx.children.iter().position(|c| c.uid() == *uid));
-            json!(n.map(|n| format!("effects/#{}", n + 1)))
-        })
-        .collect();
-    Ok(json!({"effects": uids, "paths": paths, "effect": spec.id}))
-}
-
-fn find_fx(s: &Session, p: &Value, cmd: &str) -> Result<(effectcraft_project::ItemId, effectcraft_project::LayerId, Uid)> {
-    let (cid, lid) = super::layer_p(s, p, cmd)?;
-    let layer = s.project.comp(cid).and_then(|c| c.layer(lid)).ok_or(EngineError::NoComp)?;
-    let fx = layer.effects().ok_or_else(|| bad(cmd, "no effects"))?;
-    let g = match p.get("effect") {
-        Some(Value::Number(n)) => {
-            let n = n.as_u64().unwrap_or(0);
-            fx.groups().find(|g| g.uid == n).or_else(|| usize::try_from(n.saturating_sub(1)).ok().and_then(|i| fx.groups().nth(i)))
-        }
-        Some(Value::String(name)) => fx.groups().find(|g| &g.name == name || g.match_id == *name),
-        _ => s.state.selected_props.iter().find_map(|(l, u)| (*l == lid).then(|| fx.groups().find(|g| g.uid == *u)).flatten()),
-    }
-    .ok_or_else(|| bad(cmd, "no such effect"))?;
-    Ok((cid, lid, g.uid))
-}
-
-/// `effect.warning`: what Effect Controls warns about an effect (a custom OCIO config it can't
-/// read, or transforms it passes through), `null` when it renders as asked.
-fn warning(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "effect.warning";
-    let (cid, lid, uid) = find_fx(s, p, cmd)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
-    let g = layer.effects().and_then(|fx| fx.groups().find(|g| g.uid == uid)).ok_or_else(|| bad(cmd, "no such effect"))?;
-    let t = super::time_p(s, p, Some(comp));
-    let ctx = effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp, time: t, expr: s.expr.as_deref(), footage: None };
-    Ok(json!({"effect": uid, "warning": effectcraft_effects::warning(g, &mut |pr| ctx.value(layer, pr))}))
-}
-
-/// A colour parameter's eyedropper on a keyer (Effect Controls): the colour of the effect's input
-/// (the layer's pixels before this effect, so a keyed screen can still be picked) at a
-/// layer-space point, set on the parameter. `average` takes the 5 × 5 pixels around it.
-fn pick_color(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "effect.pickColor";
-    let (cid, lid, fx_uid) = find_fx(s, p, cmd)?;
-    let (Some(x), Some(y)) = (f_p(p, "x"), f_p(p, "y")) else { return Err(bad(cmd, "missing `x` / `y` (layer pixels)")) };
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
-    let fx = layer.effects().ok_or_else(|| bad(cmd, "no effects"))?;
-    let index = fx.groups().position(|g| g.uid == fx_uid).ok_or_else(|| bad(cmd, "no such effect"))?;
-    let g = fx.groups().nth(index).ok_or_else(|| bad(cmd, "no such effect"))?;
-    let prop = match (p.get("prop").and_then(Value::as_u64), str_p(p, "param")) {
-        (Some(uid), _) => g.find(uid),
-        (None, Some(path)) => g.prop(path),
-        _ => return Err(bad(cmd, "missing `param` (e.g. `screenColour`) or `prop` (uid)")),
-    }
-    .filter(|pr| pr.ui == effectcraft_project::ParamUi::Color)
-    .ok_or_else(|| bad(cmd, "not a colour parameter of this effect"))?;
-    let t = super::time_p(s, p, Some(comp));
-    let ctx = effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp, time: t, expr: s.expr.as_deref(), footage: None };
-    let mut r = effectcraft_render::Renderer::new(&s.project, &*s.footage, effectcraft_render::RenderOpts::default());
-    r.expr = s.expr.as_deref();
-    r.cache = Some(&s.layer_cache);
-    let buf = r.layer_input(&ctx, layer, index).ok_or_else(|| bad(cmd, "this layer has no pixels"))?;
-    let (px, py) = buf.to_px([x, y]);
-    let (cx, cy) = (px.floor() as i64, py.floor() as i64);
-    let rad = if b_p(p, "average") == Some(true) { 2 } else { 0 };
-    let mut sum = [0.0f32; 4];
-    for yy in cy.saturating_sub(rad)..=cy.saturating_add(rad) {
-        for xx in cx.saturating_sub(rad)..=cx.saturating_add(rad) {
-            // Outside the layer reads as transparent.
-            let c = buf.img.get(xx, yy);
-            (0..4).for_each(|i| sum[i] += c[i]);
-        }
-    }
-    if sum[3] <= 1e-6 {
-        return Err(bad(cmd, "nothing to sample there (transparent or outside the layer)"));
-    }
-    // Straight colour of the (averaged) premultiplied pixels.
-    let color: Vec<f64> = (0..3).map(|i| (sum[i] / sum[3]).clamp(0.0, 1.0) as f64).chain([1.0]).collect();
-    let uid = prop.uid;
-    s.execute("prop.set", json!({"comp": cid.0, "layer": lid.0, "prop": uid, "value": color}))?;
-    Ok(json!({"prop": uid, "color": color}))
-}
-
-fn remove(s: &mut Session, p: &Value) -> Result<Value> {
-    let cid = super::comp_id(s, p)?;
-    let fx = effects_p(s, p, "effect.remove")?;
-    let label = if fx.len() == 1 { "Remove Effect" } else { "Remove Effects" };
-    s.edit(label, None, |proj, st| {
-        for (lid, uid) in &fx {
-            let l = layer_mut(proj, cid, *lid)?;
-            if let Some(fx) = l.props.sub_mut("effects") {
-                fx.children.retain(|c| c.uid() != *uid);
-            }
-            st.selected_props.retain(|(_, u)| u != uid);
-        }
-        Ok(())
-    })?;
-    Ok(json!(fx.len()))
-}
-
-fn remove_all(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    s.edit("Remove All Effects", None, |proj, _| {
-        for lid in &ids {
-            if let Some(fx) = layer_mut(proj, cid, *lid)?.props.sub_mut("effects") {
-                fx.children.clear();
-            }
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn toggle(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid, uid) = find_fx(s, p, "effect.toggle")?;
-    let v = b_p(p, "value");
-    let r = s.edit("Toggle Effect", None, |proj, _| {
-        let l = layer_mut(proj, cid, lid)?;
-        let g = l.props.find_group_mut(uid).ok_or_else(|| bad("effect.toggle", "gone"))?;
-        g.enabled = v.unwrap_or(!g.enabled);
-        Ok(g.enabled)
-    })?;
-    Ok(json!(r))
-}
-
-/// `effect.setLabel`: the effect's colour label (None clears it).
-fn set_label(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "effect.setLabel";
-    let (cid, lid, uid) = find_fx(s, p, c)?;
-    let lab = match p.get("label") {
-        Some(Value::Number(n)) => n.as_u64().and_then(|i| effectcraft_color::Label::ALL.get(usize::try_from(i).ok()?).copied()),
-        Some(Value::String(name)) => s.prefs.label_from_name(name),
-        _ => None,
-    }
-    .ok_or_else(|| bad(c, "missing or unknown `label` (name or index 0-16; 0 / None clears it)"))?;
-    s.edit("Effect Label", None, |proj, _| {
-        let l = layer_mut(proj, cid, lid)?;
-        let g = l.props.find_group_mut(uid).ok_or_else(|| bad(c, "gone"))?;
-        g.label = (lab != effectcraft_color::Label::None).then_some(lab);
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn reorder(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid, uid) = find_fx(s, p, "effect.reorder")?;
-    let to = p.get("index").and_then(Value::as_u64).ok_or_else(|| bad("effect.reorder", "missing `index` (1-based)"))? as usize;
-    s.edit("Reorder Effect", None, |proj, _| {
-        let fx = layer_mut(proj, cid, lid)?.props.sub_mut("effects").ok_or_else(|| bad("effect.reorder", "no effects"))?;
-        let Some(i) = fx.children.iter().position(|c| c.uid() == uid) else { return Ok(()) };
-        let g = fx.children.remove(i);
-        let to = to.saturating_sub(1).min(fx.children.len());
-        fx.children.insert(to, g);
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid, uid) = find_fx(s, p, "effect.duplicate")?;
-    let r = s.edit("Duplicate Effect", None, |proj, st| {
-        let mut next = proj.next_id;
-        let fx = layer_mut(proj, cid, lid)?.props.sub_mut("effects").ok_or_else(|| bad("effect.duplicate", "no effects"))?;
-        let Some(i) = fx.children.iter().position(|c| c.uid() == uid) else { return Ok(0) };
-        let mut g = fx.children[i].as_group().cloned().ok_or_else(|| bad("effect.duplicate", "not a group"))?;
-        g.reassign_uids(&mut next);
-        g.name = unique_name(fx, &g.name);
-        let u = g.uid;
-        fx.children.insert(i + 1, g.into());
-        proj.next_id = next + 1;
-        st.selected_props = vec![(lid, u)];
-        Ok(u)
-    })?;
-    Ok(json!(r))
-}
-
-/// Effect groups selected in Effect Controls / the timeline: (layer, effect uid), in stack order.
-pub(crate) fn selected_effects(s: &Session) -> Vec<(LayerId, Uid)> {
-    let Some(c) = s.active_comp() else { return vec![] };
-    let mut out = vec![];
-    for l in &c.layers {
-        let Some(fx) = l.effects() else { continue };
-        for g in fx.groups() {
-            if s.state.selected_props.iter().any(|(sl, u)| *sl == l.id && *u == g.uid) {
-                out.push((l.id, g.uid));
-            }
-        }
-    }
-    out
-}
-
-/// Effects named by `effect` / `effects` (uids, names or 1-based indexes), else the selection.
-fn effects_p(s: &Session, p: &Value, cmd: &str) -> Result<Vec<(LayerId, Uid)>> {
-    if p.get("effect").is_some() {
-        let (_, lid, uid) = find_fx(s, p, cmd)?;
-        return Ok(vec![(lid, uid)]);
-    }
-    if let Some(Value::Array(a)) = p.get("effects") {
-        let mut out = vec![];
-        for v in a {
-            let mut q = p.clone();
-            if let Some(o) = q.as_object_mut() {
-                o.remove("effects");
-                o.insert("effect".into(), v.clone());
-            }
-            let (_, lid, uid) = find_fx(s, &q, cmd)?;
-            out.push((lid, uid));
-        }
-        return Ok(out);
-    }
-    let sel = selected_effects(s);
-    if sel.is_empty() {
-        return Err(bad(cmd, "no effect selected"));
-    }
-    Ok(sel)
-}
-
-fn effect_time_error(cmd: &str) -> EngineError {
-    bad(cmd, "an effect keyframe converts outside the supported time range")
-}
-
-/// Validate before Layer's saturating conversions, so a bad stretch or time never silently
-/// moves a copied key to another frame. Normal-speed layers keep their exact integer ticks.
-fn effect_time(layer: &Layer, time: Tick, to_comp: bool, cmd: &str) -> Result<Tick> {
-    if !layer.stretch.is_finite() || layer.stretch == 0.0 {
-        return Err(bad(cmd, "the layer has an invalid time stretch"));
-    }
-    let in_range = |t: i64| (Tick::MIN.0..=Tick::MAX.0).contains(&t);
-    if !in_range(time.0) {
-        return Err(effect_time_error(cmd));
-    }
-    let offset = if to_comp { time.0 } else { time.0.checked_sub(layer.start_time.0).ok_or_else(|| effect_time_error(cmd))? };
-    let scaled = if (layer.stretch - 100.0).abs() < 1e-9 {
-        offset
-    } else {
-        let scaled = if to_comp { offset as f64 * layer.stretch / 100.0 } else { offset as f64 * 100.0 / layer.stretch };
-        if !scaled.is_finite() || scaled < Tick::MIN.0 as f64 || scaled > Tick::MAX.0 as f64 {
-            return Err(effect_time_error(cmd));
-        }
-        scaled as i64
-    };
-    if !in_range(scaled) {
-        return Err(effect_time_error(cmd));
-    }
-    let time = if to_comp { layer.start_time.0.checked_add(scaled).ok_or_else(|| effect_time_error(cmd))? } else { scaled };
-    if !in_range(time) {
-        return Err(effect_time_error(cmd));
-    }
-    Ok(Tick(time))
-}
-
-/// Change the key time coordinate system throughout an effect, including nested controls.
-/// Ease speeds are per second in that coordinate system; reversed time swaps the key sides.
-fn retime_effect(group: &mut PropGroup, scale: f64, cmd: &str, mut time: impl FnMut(Tick) -> Result<Tick>) -> Result<()> {
-    let mut result = Ok(());
-    group.walk_mut(&mut |pr| {
-        if result.is_err() {
-            return;
-        }
-        for key in &mut pr.keys {
-            let mapped = time(key.time).and_then(|t| {
-                if !scale.is_finite() || scale == 0.0 {
-                    return Err(effect_time_error(cmd));
-                }
-                // Spatial paths and non-numeric values ease along positive progress;
-                // numeric components instead store a signed value derivative.
-                let speed_scale = if pr.spatial || key.value.dims() == 0 { scale.abs() } else { scale };
-                for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
-                    ease.speed /= speed_scale;
-                    if !ease.speed.is_finite() {
-                        return Err(bad(cmd, "an effect keyframe ease converts outside the supported range"));
-                    }
-                }
-                if scale < 0.0 {
-                    std::mem::swap(&mut key.in_interp, &mut key.out_interp);
-                    std::mem::swap(&mut key.in_ease, &mut key.out_ease);
-                    std::mem::swap(&mut key.spatial_in, &mut key.spatial_out);
-                }
-                Ok(t)
-            });
-            match mapped {
-                Ok(t) => key.time = t,
-                Err(e) => {
-                    result = Err(e);
-                    return;
-                }
-            }
-        }
-        pr.keys.sort_by_key(|key| key.time);
-        if pr.keys.windows(2).any(|pair| pair[0].time == pair[1].time) {
-            result = Err(bad(cmd, "the layer's time stretch maps effect keyframes to the same tick"));
-        }
-    });
-    result
-}
-
-/// Edit ▸ Copy with effects selected: times on the clipboard are comp-time offsets from the
-/// earliest copied key, shared by all copied effects and their parameters (#989).
-fn copy(s: &mut Session, p: &Value) -> Result<Value> {
-    const CMD: &str = "effect.copy";
-    let fx = effects_p(s, p, "effect.copy")?;
-    let comp = s.active_comp().ok_or(EngineError::NoComp)?;
-    let mut groups = Vec::new();
-    let mut earliest: Option<Tick> = None;
-    for (lid, uid) in fx {
-        let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
-        let mut group = layer.effects().and_then(|fx| fx.groups().find(|g| g.uid == uid)).cloned().ok_or_else(|| bad(CMD, "the effect no longer exists"))?;
-        retime_effect(&mut group, layer.stretch / 100.0, CMD, |t| {
-            let t = effect_time(layer, t, true, CMD)?;
-            earliest = Some(earliest.map_or(t, |first| first.min(t)));
-            Ok(t)
-        })?;
-        groups.push(group);
-    }
-    if let Some(first) = earliest {
-        for group in &mut groups {
-            retime_effect(group, 1.0, CMD, |t| Ok(Tick(t.0.checked_sub(first.0).ok_or_else(|| effect_time_error(CMD))?)))?;
-        }
-    }
-    s.state.clipboard.clear();
-    s.state.key_clipboard.clear();
-    s.state.contents_clipboard.clear();
-    s.state.link_clipboard = None;
-    s.state.clip_is_keys = false;
-    let n = groups.len();
-    s.state.effect_clipboard = groups;
-    Ok(json!({"effects": n}))
-}
-
-/// A unique instance name among `fx`'s effects (`Gaussian Blur`, `Gaussian Blur 2`…).
-pub(crate) fn unique_name(fx: &PropGroup, base: &str) -> String {
-    if !fx.groups().any(|g| g.name == base) {
-        return base.to_string();
-    }
-    let stem = base.rsplit_once(' ').filter(|(_, n)| n.parse::<u32>().is_ok()).map(|(s, _)| s).unwrap_or(base);
-    (2..).map(|i| format!("{stem} {i}")).find(|n| !fx.groups().any(|g| &g.name == n)).unwrap_or_else(|| base.to_string())
-}
-
-/// Edit ▸ Paste with effects on the clipboard: adds copies to every target layer, after the
-/// layer's selected effect when it has one, else at the end of its stack. The earliest copied
-/// key lands at the destination comp's CTI; all other keys keep their comp-time offsets.
-fn paste(s: &mut Session, p: &Value) -> Result<Value> {
-    const CMD: &str = "effect.paste";
-    let clip = s.state.effect_clipboard.clone();
-    if clip.is_empty() {
-        return Err(bad("effect.paste", "no effects on the clipboard"));
-    }
-    let (cid, ids) = layers_p(s, p)?;
-    if ids.is_empty() {
-        return Err(bad("effect.paste", "select a layer to paste effects onto"));
-    }
-    let sel = selected_effects(s);
-    let cti = s.time_of(cid);
-    let label = if clip.len() == 1 { format!("Paste {}", clip[0].name) } else { "Paste Effects".to_string() };
-    let uids = s.edit(&label, None, |proj, st| {
-        let mut out = vec![];
-        let mut next = proj.next_id;
-        let mut new_sel = vec![];
-        for lid in &ids {
-            let l = layer_mut(proj, cid, *lid)?;
-            let mut groups = clip.clone();
-            for group in &mut groups {
-                retime_effect(group, 100.0 / l.stretch, CMD, |offset| {
-                    let t = Tick(cti.0.checked_add(offset.0).ok_or_else(|| effect_time_error(CMD))?);
-                    effect_time(l, t, false, CMD)
-                })?;
-            }
-            let Some(fx) = l.props.sub_mut("effects") else { continue };
-            let at = sel
-                .iter()
-                .filter(|(sl, _)| sl == lid)
-                .filter_map(|(_, u)| fx.children.iter().position(|c| c.uid() == *u))
-                .max()
-                .map(|i| i + 1)
-                .unwrap_or(fx.children.len());
-            for (k, mut g) in groups.into_iter().enumerate() {
-                g.reassign_uids(&mut next);
-                g.name = unique_name(fx, &g.name);
-                out.push(g.uid);
-                new_sel.push((*lid, g.uid));
-                fx.children.insert(at + k, g.into());
-            }
-        }
-        proj.next_id = next + 1;
-        st.selected_props = new_sel;
-        Ok(out)
-    })?;
-    Ok(json!({"effects": uids}))
-}
-
-/// Effect Controls' Reset: every parameter back to its default. Animated parameters get a
-/// keyframe at the current time with the default value (as in After Effects); static ones
-/// change their value.
-fn reset(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid, uid) = find_fx(s, p, "effect.reset")?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
-    let size = effectcraft_render::effect_bounds(&s.project, comp, layer).0;
-    let lt = layer.layer_time(s.time());
-    let g = layer.effects().and_then(|fx| fx.groups().find(|g| g.uid == uid)).ok_or_else(|| bad("effect.reset", "gone"))?;
-    let spec = match &g.kind {
-        GroupKind::Effect { effect } => effectcraft_effects::find(effect),
-        _ => None,
-    }
-    .ok_or_else(|| bad("effect.reset", "unknown effect"))?;
-    let name = g.name.clone();
-    s.edit(&format!("Reset {name}"), None, |proj, _| {
-        let g = layer_mut(proj, cid, lid)?.props.find_group_mut(uid).ok_or_else(|| bad("effect.reset", "gone"))?;
-        for ps in &spec.params {
-            // (`group/param` ids live in twirl-down groups.)
-            if let Some(pr) = g.prop_mut(ps.id) {
-                pr.set_value_at(lt, effectcraft_effects::default_value(ps, size));
-            }
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// Tint's Swap Colors button edits both swatches at the CTI in one undo step. Like Reset,
-/// it keys animated parameters without moving their existing keys or replacing expressions.
-fn swap_tint_colors(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "effect.swapTintColors";
-    if !p.is_object() || p.get("effect").is_some_and(|v| !v.is_string() && v.as_u64().is_none_or(|n| n == 0)) {
-        return Err(bad(cmd, "effect must be a positive index, uid or name"));
-    }
-    let (cid, lid, uid) = find_fx(s, p, cmd)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let layer = comp.layer(lid).ok_or(EngineError::NoComp)?;
-    let g = layer.props.find_group(uid).filter(|g| g.match_id == "ec.color.tint").ok_or_else(|| bad(cmd, "not a Tint effect"))?;
-    let lt = layer.layer_time(s.time_of(cid));
-    let color = |id| {
-        g.prop(id)
-            .map(|pr| pr.value_at(lt))
-            .filter(|v| matches!(v, effectcraft_keyframe::Value::Color(_)))
-            .ok_or_else(|| bad(cmd, "Tint is missing a colour parameter"))
-    };
-    let (black, white) = (color("black")?, color("white")?);
-    s.edit("Swap Tint Colors", None, |proj, _| {
-        let g = layer_mut(proj, cid, lid)?.props.find_group_mut(uid).ok_or_else(|| bad(cmd, "effect gone"))?;
-        for (id, value) in [("black", white), ("white", black)] {
-            g.prop_mut(id).ok_or_else(|| bad(cmd, "Tint is missing a colour parameter"))?.set_value_at(lt, value);
-        }
-        Ok(())
-    })?;
-    Ok(json!({"effect": uid}))
-}
-
-fn last(s: &mut Session, p: &Value) -> Result<Value> {
-    let id = s.state.last_effect.clone().ok_or_else(|| bad("effect.applyLast", "no effect applied yet"))?;
-    let mut q = p.clone();
-    if let Some(o) = q.as_object_mut() {
-        o.insert("effect".into(), json!(id));
-    } else {
-        q = json!({"effect": id});
-    }
-    apply(s, &q)
-}
-
-fn list(_: &mut Session, p: &Value) -> Result<Value> {
-    let filter = str_p(p, "filter").map(str::to_lowercase);
-    let v: Vec<Value> = effectcraft_effects::all()
-        .into_iter()
-        .filter(|e| {
-            filter.as_ref().is_none_or(|f| effectcraft_effects::name_matches(e, f) || e.id.contains(f.as_str()) || e.category.to_ascii_lowercase().contains(f))
-        })
-        .map(|e| {
-            json!({"id": e.id, "name": e.name, "category": e.category, "gpu": e.gpu, "float": e.float, "params": e.params.iter().map(|p| {
-                let mut out = json!({"id": p.id, "name": p.name, "type": p.default.kind_name(), "default": p.default.to_json()});
-                match &p.ui {
-                    effectcraft_project::ParamUi::Popup { options } => {
-                        // Engine/MCP popup values are zero-based; JSX exposes one-based values.
-                        out["options"] = json!(options.iter().enumerate().map(|(value, label)| json!({"value": value, "label": label})).collect::<Vec<_>>());
-                    }
-                    effectcraft_project::ParamUi::Slider { min, max, slider_min, slider_max, decimals } => {
-                        out["min"] = json!(min);
-                        out["max"] = json!(max);
-                        out["sliderMin"] = json!(slider_min);
-                        out["sliderMax"] = json!(slider_max);
-                        out["decimals"] = json!(decimals);
-                    }
-                    _ => {}
-                }
-                out
-            }).collect::<Vec<_>>()})
-        })
-        .collect();
-    Ok(json!(v))
-}
-
-impl Session {
-    /// The named channels of layer `lid` in the active comp at the current time: its
-    /// multi-layer OpenEXR footage's layers and channels (`diffuse.R`, `depth.Z`, …), which
-    /// EXtractoR and the 3D Channel effects read. `None` for other layers.
-    pub fn layer_channels(&self, lid: LayerId) -> Option<std::sync::Arc<effectcraft_raster::AuxChannels>> {
-        let layer = self.active_comp()?.layer(lid)?;
-        let effectcraft_project::LayerSource::Footage { item } = layer.source else { return None };
-        let effectcraft_project::ItemKind::Footage(f) = &self.project.item(item)?.kind else { return None };
-        self.footage.aux(item, f, layer.layer_time(self.time()))
-    }
-}
-
-/// `layer.channels`: the layers and channels of a layer's multi-layer OpenEXR footage, and
-/// what each layer shows in red, green, blue and alpha (EXtractoR's popups).
-fn channels(s: &mut Session, p: &Value) -> Result<Value> {
-    let (_, lid) = super::layer_p(s, p, "layer.channels")?;
-    let Some(aux) = s.layer_channels(lid) else { return Ok(json!({"channels": [], "layers": []})) };
-    let layers: Vec<Value> = aux.layers().into_iter().map(|l| json!({"name": l, "rgba": aux.layer_rgba(l)})).collect();
-    Ok(json!({"channels": aux.names(), "layers": layers}))
-}
-
-pub fn specs() -> Vec<CommandSpec> {
-    vec![
-        cmd!("effect.apply", "Apply Effect", [], None, "{effect: id|name (e.g. Gaussian Blur), layers?}", has_layers, apply),
-        crate::query!(
-            "layer.channels",
-            "Layer Channels",
-            "{layer?} → {channels: [name], layers: [{name, rgba: [r, g, b, a channel]}]} — a multi-layer OpenEXR layer's channels (EXtractoR's red / green / blue / alpha take these names)",
-            channels
-        ),
-        cmd!(
-            "effect.pickColor",
-            "Pick Effect Colour",
-            [],
-            None,
-            "{layer?, effect?: index|uid|name, param: id (e.g. screenColour) | prop: uid, x, y (effect space), average?: bool (5×5), time?} — the colour of the effect's input there",
-            has_layers,
-            pick_color
-        ),
-        cmd!("effect.applyLast", "Last Effect", ["Effect"], Some("Cmd+Alt+Shift+E"), "{layers?}", has_layers, last),
-        cmd!("effect.removeAll", "Remove All", ["Effect"], Some("Cmd+Shift+E"), "{layers?}", has_layers, remove_all),
-        cmd!("effect.remove", "Remove Effect", [], None, "{layer?, effect: index|uid|name}", has_layers, remove),
-        cmd!("effect.toggle", "Toggle Effect", [], None, "{layer?, effect, value?}", has_layers, toggle),
-        cmd!("effect.setLabel", "Effect Label", [], None, "{layer?, effect, label: name|index 0-16 (None clears)}", has_layers, set_label),
-        cmd!("effect.reorder", "Reorder Effect", [], None, "{layer?, effect, index}", has_layers, reorder),
-        cmd!("effect.duplicate", "Duplicate Effect", [], None, "{layer?, effect}", has_layers, duplicate),
-        cmd!("effect.copy", "Copy Effects", [], None, "{layer?, effect? | effects?: [uid|name|index]} (default: the selected effects)", has_layers, copy),
-        cmd!("effect.paste", "Paste Effects", [], None, "{layers?} — adds the copied effects to the layers", has_layers, paste),
-        cmd!("effect.reset", "Reset Effect", [], None, "{layer?, effect}", has_layers, reset),
-        cmd!(
-            "effect.swapTintColors",
-            "Swap Tint Colors",
-            [],
-            None,
-            "{comp?, layer?, effect?: index|uid|name} — swaps Tint's Map Black To and Map White To at the current layer time in one undo step",
-            has_layers,
-            swap_tint_colors
-        ),
-        crate::query!(
-            "effect.list",
-            "List Effects",
-            "{filter?} → [{params: [{id, name, type, default, options?, min?, max?, sliderMin?, sliderMax?, decimals?}]}]; popup indices are zero-based (JSX uses one-based values)",
-            list
-        ),
-        crate::query!(
-            "effect.warning",
-            "Effect Warning",
-            "{layer?, effect?: index|uid|name (default: the selected effect), time?} → {effect, warning: string|null} — what Effect Controls warns about (an OCIO config it can't read, transforms it passes through)",
-            warning
-        ),
-        crate::query!(
-            "effect.plugins.list",
-            "List Effect Plug-ins",
-            "{} → {api, wasm, plugins: [{id, name, category, version, author, source, params}]}",
-            plugins_list
-        ),
-        cmd!(
-            "effect.plugins.load",
-            "Load Effect Plug-in...",
-            [],
-            None,
-            "{path (.wasm / .wat plug-in, API v1) | folder (loads every .wasm in it)}",
-            super::always,
-            plugins_load
-        ),
-    ]
-}
-
-#[cfg(test)]
-mod list_metadata_tests {
-    use super::*;
-
-    #[test]
-    fn effect_list_exposes_popup_labels_and_numeric_slider_limits() {
-        let mut s = Session::default();
-        let menus = s.execute("effect.list", json!({"filter": "ec.control.dropdown"})).unwrap();
-        assert_eq!(menus.as_array().map(Vec::len), Some(1));
-        let menu = &menus[0]["params"][0];
-        assert_eq!(menu["type"], "enum");
-        assert_eq!(menu["default"], 0);
-        assert_eq!(
-            menu["options"],
-            json!([
-                {"value": 0, "label": "Item 1"},
-                {"value": 1, "label": "Item 2"},
-                {"value": 2, "label": "Item 3"}
-            ])
-        );
-        let sliders = s.execute("effect.list", json!({"filter": "ec.control.slider"})).unwrap();
-        assert_eq!(sliders.as_array().map(Vec::len), Some(1));
-        let slider = &sliders[0]["params"][0];
-        assert_eq!(slider["type"], "scalar");
-        assert_eq!(slider["min"], -1_000_000.0);
-        assert_eq!(slider["max"], 1_000_000.0);
-        assert_eq!(slider["sliderMin"], 0.0);
-        assert_eq!(slider["sliderMax"], 100.0);
-        assert_eq!(slider["decimals"], 2);
-        assert!(slider["options"].is_null());
-    }
-}
diff --git a/crates/engine/src/commands/layer.rs b/crates/engine/src/commands/layer.rs
deleted file mode 100644
index b798493b1..000000000
--- a/crates/engine/src/commands/layer.rs
+++ /dev/null
@@ -1,1866 +0,0 @@
-//! Layer menu.
-
-use effectcraft_color::{BlendMode, Label};
-use effectcraft_keyframe::{Justify, TextDoc, Value as KV};
-use effectcraft_project::build::{self, Ids};
-use effectcraft_project::{
-    Comp, FrameBlend, GroupKind, ItemId, ItemKind, Layer, LayerId, LayerSource, MaskMode, MatteKind, Node, Project, PropGroup, Quality, Solid, TrackMatte,
-    limits,
-};
-use effectcraft_time::Tick;
-use serde_json::{Value, json};
-
-use super::{CommandSpec, b_p, bad, comp_id, f_p, has_comp, has_layers, layer_mut, layer_p, layers_p, merge_p, resolve_layer, str_p, unlocked};
-use crate::{EngineError, Result, Session, cmd};
-
-pub(crate) fn color_p(p: &Value, k: &str) -> Option<[f32; 3]> {
-    match p.get(k)? {
-        Value::String(s) => effectcraft_color::Rgba::from_hex(s).map(|c| [c.r, c.g, c.b]),
-        Value::Array(a) => {
-            let g = |i: usize| a.get(i).and_then(Value::as_f64).unwrap_or(0.0) as f32;
-            Some([g(0), g(1), g(2)])
-        }
-        _ => None,
-    }
-}
-
-/// Insert a new layer above the selection (or at the top) and select it.
-pub(crate) fn insert_layer(proj: &mut Project, st: &mut crate::EditorState, cid: ItemId, layer: Layer) -> Result<LayerId> {
-    insert_layer_at(proj, st, cid, layer, None)
-}
-
-/// `index`: an `index` parameter, the layer's 1-based place in the stack (1 = top; past the
-/// bottom = the bottom), as 0-based.
-pub(crate) fn index_p(p: &Value, cmd: &str) -> Result<Option<usize>> {
-    match p.get("index") {
-        None | Some(Value::Null) => Ok(None),
-        Some(v) => {
-            v.as_u64().filter(|i| *i >= 1).map(|i| Some(usize::try_from(i - 1).unwrap_or(usize::MAX))).ok_or_else(|| bad(cmd, "index: 1-based stack position"))
-        }
-    }
-}
-
-/// A `position` parameter: `[x, y]` in comp pixels (finite).
-pub(crate) fn position_p(p: &Value, cmd: &str) -> Result<Option<[f64; 2]>> {
-    match p.get("position") {
-        None | Some(Value::Null) => Ok(None),
-        Some(v) => v
-            .as_array()
-            .and_then(|a| Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?]))
-            .filter(|c| c.iter().all(|x| x.is_finite()))
-            .map(Some)
-            .ok_or_else(|| bad(cmd, "position: [x, y] in comp pixels")),
-    }
-}
-
-/// Put a new layer's Position at `pos` (comp pixels).
-pub(crate) fn place(l: &mut Layer, pos: Option<[f64; 2]>) {
-    if let Some([x, y]) = pos
-        && let Some(pr) = l.props.prop_mut("transform/position")
-    {
-        let z = match pr.value {
-            KV::Vec3(v) => v[2],
-            _ => 0.0,
-        };
-        pr.value = KV::Vec3([x, y, z]);
-    }
-}
-
-/// [`insert_layer`] at stack position `at` (0 = top) instead of above the selected layer.
-pub(crate) fn insert_layer_at(proj: &mut Project, st: &mut crate::EditorState, cid: ItemId, mut layer: Layer, at: Option<usize>) -> Result<LayerId> {
-    // Text and shape layers in Advanced 3D comps get Geometry Options (extrusion, bevels).
-    if proj.comp(cid).is_some_and(|c| c.renderer == effectcraft_project::Renderer::Advanced3D) {
-        super::model3d::add_geometry_options(&mut proj.next_id, &mut layer);
-    }
-    let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-    let at = match at {
-        Some(i) => i.min(comp.layers.len()),
-        None => st.selected_layers.first().and_then(|id| comp.layers.iter().position(|l| l.id == *id)).unwrap_or(0),
-    };
-    let id = layer.id;
-    comp.layers.insert(at, layer);
-    st.selected_layers = vec![id];
-    st.selected_props.clear();
-    st.selected_keys.clear();
-    Ok(id)
-}
-
-fn solids_folder(proj: &mut Project) -> ItemId {
-    proj.folder_named("Solids").unwrap_or_else(|| proj.add_item("Solids", Label::Yellow, None, ItemKind::Folder))
-}
-
-fn new_solid_like(s: &mut Session, p: &Value, adjustment: bool) -> Result<Value> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let color = color_p(p, "color").unwrap_or(if adjustment { [1.0, 1.0, 1.0] } else { [0.85, 0.2, 0.2] });
-    // 1 to 30,000 px a side (#788): the layer is sized from the same numbers as its solid.
-    let w = p.get("width").and_then(Value::as_u64).map(limits::size).unwrap_or(comp.width);
-    let h = p.get("height").and_then(Value::as_u64).map(limits::size).unwrap_or(comp.height);
-    let pixel_aspect = pixel_aspect_p(p)?.unwrap_or(comp.pixel_aspect);
-    let default_name = if adjustment { "Adjustment Layer 1".to_string() } else { "Solid 1".to_string() };
-    let name = str_p(p, "name").map(str::to_string).unwrap_or(default_name);
-    let id = s.edit(if adjustment { "New Adjustment Layer" } else { "New Solid" }, None, |proj, st| {
-        let folder = solids_folder(proj);
-        let sid = proj.add_item(&name, Label::Red, Some(folder), ItemKind::Solid(Solid { color, width: w, height: h, pixel_aspect }));
-        let mut l = build::layer(proj, &comp, &name, LayerSource::Solid { item: sid }, (w, h), None);
-        if adjustment {
-            l.switches.adjustment = true;
-            l.label = Label::Purple;
-        }
-        insert_layer(proj, st, cid, l)
-    })?;
-    Ok(json!({"layer": id.0}))
-}
-
-/// `pixelAspect` (a positive number), when given.
-fn pixel_aspect_p(p: &Value) -> Result<Option<f64>> {
-    match p.get("pixelAspect").and_then(Value::as_f64) {
-        Some(v) if !(v.is_finite() && v > 0.0) => Err(bad("layer.settings", "`pixelAspect` must be a positive number")),
-        v => Ok(v.map(limits::pixel_aspect)),
-    }
-}
-
-fn new_solid(s: &mut Session, p: &Value) -> Result<Value> {
-    new_solid_like(s, p, false)
-}
-fn new_adjustment(s: &mut Session, p: &Value) -> Result<Value> {
-    new_solid_like(s, p, true)
-}
-
-/// Parameters of `layer.setText` / `layer.newText` that aren't text attributes.
-const NOT_ATTRS: &[&str] = &["layer", "layers", "comp", "merge", "text", "range", "position", "edit"];
-
-/// Apply `layer.setText` keys to `d`: `text` replaces characters `r` (or everything), then each
-/// character / paragraph / document attribute applies to `r` (or everything).
-fn apply_text_params(cmd: &str, p: &Value, d: &mut TextDoc, r: Option<std::ops::Range<usize>>) -> Result<()> {
-    let mut r = r;
-    if let Some(t) = str_p(p, "text") {
-        match r.clone() {
-            Some(rr) => {
-                d.replace_range(rr.clone(), t, None);
-                r = Some(rr.start..rr.start + t.chars().count());
-            }
-            None => d.set_text(t),
-        }
-    }
-    let Some(obj) = p.as_object() else { return Ok(()) };
-    for (k, v) in obj {
-        if NOT_ATTRS.contains(&k.as_str()) {
-            continue;
-        }
-        if !d.set_attr(k, v, r.clone()).map_err(|e| bad(cmd, e))? {
-            return Err(bad(cmd, format!("unknown text attribute {k}")));
-        }
-    }
-    Ok(())
-}
-
-fn text_range_p(p: &Value) -> Option<std::ops::Range<usize>> {
-    let a = p.get("range")?.as_array()?;
-    let g = |i: usize| a.get(i).and_then(Value::as_u64).map(|x| x as usize);
-    let (x, y) = (g(0)?, g(1).or(g(0))?);
-    Some(x.min(y)..x.max(y))
-}
-
-fn new_text(s: &mut Session, p: &Value) -> Result<Value> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let mut doc = TextDoc { text: "Text".into(), justify: Justify::Center, ..Default::default() };
-    // A paragraph box given in comp space: the layer sits at its centre.
-    let bx = p.get("box").and_then(Value::as_array).map(|a| [0, 1, 2, 3].map(|i| a.get(i).and_then(Value::as_f64).unwrap_or(0.0)));
-    let mut q = p.clone();
-    if let Some(o) = q.as_object_mut() {
-        o.remove("box");
-        o.remove("name");
-    }
-    let layer_name = str_p(p, "name").map(str::to_string);
-    apply_text_params("layer.newText", &q, &mut doc, None)?;
-    let mut pos = position_p(p, "layer.newText")?;
-    if let Some([x, y, w, h]) = bx {
-        let (w, h) = (w.abs().max(1.0), h.abs().max(1.0));
-        doc.box_size = Some([w, h]);
-        doc.box_pos = [-w / 2.0, -h / 2.0];
-        pos = Some([x + w / 2.0, y + h / 2.0]);
-        if p.get("justify").is_none() {
-            doc.set_attr("justify", &json!("left"), None).map_err(|e| bad("layer.newText", e))?;
-        }
-    }
-    let edit = b_p(p, "edit").unwrap_or(false);
-    let id = s.edit("New Text Layer", None, |proj, st| {
-        let name: String = layer_name.clone().unwrap_or_else(|| doc.text.lines().next().unwrap_or("").chars().take(40).collect());
-        let mut l = build::layer(proj, &comp, if name.is_empty() { "Text" } else { &name }, LayerSource::Text, (comp.width, comp.height), None);
-        if let Some(pr) = l.props.prop_mut("text/sourceText") {
-            pr.value = KV::Text(Box::new(doc.clone()));
-        }
-        if let Some(pos) = pos
-            && let Some(pr) = l.props.prop_mut("transform/position")
-        {
-            pr.value = KV::Vec3([pos[0], pos[1], 0.0]);
-        }
-        let n = doc.char_len();
-        let id = insert_layer(proj, st, cid, l)?;
-        if edit {
-            st.text_edit = Some(super::text_edit::TextEdit { layer: id, anchor: 0, caret: n, created: true, ..Default::default() });
-        }
-        Ok(id)
-    })?;
-    Ok(json!({"layer": id.0}))
-}
-
-fn new_shape(s: &mut Session, p: &Value) -> Result<Value> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let kind = str_p(p, "kind").unwrap_or("none").to_string();
-    let size = p
-        .get("size")
-        .and_then(Value::as_array)
-        .map(|a| [a.first().and_then(Value::as_f64).unwrap_or(200.0), a.get(1).and_then(Value::as_f64).unwrap_or(200.0)])
-        .unwrap_or([300.0, 300.0]);
-    // A fill, and a stroke only with a width (not the Tools bar's paint).
-    let paint = super::shape_tool::paint_p(p, &Default::default(), "layer.newShape")?;
-    let pos = p
-        .get("position")
-        .and_then(|v| v.as_array())
-        .map(|a| [a.first().and_then(Value::as_f64).unwrap_or(0.0), a.get(1).and_then(Value::as_f64).unwrap_or(0.0)]);
-    let name = str_p(p, "name").unwrap_or("Shape Layer 1").to_string();
-    let id = s.edit("New Shape Layer", None, |proj, st| {
-        let lid = super::shape_tool::new_shape_layer(proj, st, &comp, cid, Some(&name), pos)?;
-        let mut next = proj.next_id;
-        let g = super::shape_tool::shape_group(&mut Ids(&mut next), &kind, size, &paint);
-        proj.next_id = next;
-        if let Some(g) = g {
-            super::shape_tool::add_to_contents(proj, cid, lid, g, [0.0, 0.0], "layer.newShape")?;
-        }
-        Ok(lid)
-    })?;
-    Ok(json!({"layer": id.0}))
-}
-
-fn new_simple(s: &mut Session, p: &Value, src: LayerSource, name: &str, label: &str) -> Result<Value> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let name = str_p(p, "name").unwrap_or(name).to_string();
-    let id = s.edit(label, None, |proj, st| {
-        let l = build::layer(proj, &comp, &name, src, (comp.width, comp.height), None);
-        insert_layer(proj, st, cid, l)
-    })?;
-    Ok(json!({"layer": id.0}))
-}
-
-fn new_null(s: &mut Session, p: &Value) -> Result<Value> {
-    new_simple(s, p, LayerSource::Null, "Null 1", "New Null Object")
-}
-
-fn add_item(s: &mut Session, p: &Value) -> Result<Value> {
-    let cid = comp_id(s, p)?;
-    let item = match p.get("item") {
-        Some(Value::Number(n)) => ItemId(n.as_u64().unwrap_or(0)),
-        Some(Value::String(name)) => s.project.find_by_name(name).map(|i| i.id).ok_or_else(|| bad("layer.addItem", format!("no item `{name}`")))?,
-        _ => *s.state.project_selection.first().ok_or_else(|| bad("layer.addItem", "missing `item`"))?,
-    };
-    if s.project.comp_contains(item, cid) {
-        return Err(bad("layer.addItem", "a composition can't contain itself"));
-    }
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let it = s.project.item(item).ok_or_else(|| bad("layer.addItem", "no such item"))?.clone();
-    let (src, size, dur) = match &it.kind {
-        ItemKind::Comp(c) => (LayerSource::Comp { item }, (c.width, c.height), Some(c.duration)),
-        ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Still => {
-            // `duration`, else Settings ▸ Import ▸ Still Footage: length of the composition or a
-            // duration.
-            let d = f_p(p, "duration")
-                .filter(|d| d.is_finite() && *d > 0.0)
-                .or((s.prefs.import.still_footage == "seconds").then_some(s.prefs.import.still_seconds))
-                .map(Tick::from_seconds_f64);
-            (LayerSource::Footage { item }, (f.width, f.height), d)
-        }
-        ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Data => {
-            return Err(bad("layer.addItem", "data files can't be layers; read them in expressions with footage(\"name\").sourceData"));
-        }
-        ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Model => {
-            return super::model3d::new_model(
-                s,
-                &serde_json::json!({"comp": cid.0, "item": item.0, "time": f_p(p, "time"), "index": p.get("index"), "position": p.get("position")}),
-            );
-        }
-        ItemKind::Footage(f) => (LayerSource::Footage { item }, (f.width, f.height), Some(f.looped_duration())),
-        ItemKind::Solid(so) => (LayerSource::Solid { item }, (so.width, so.height), None),
-        ItemKind::Folder => return Err(bad("layer.addItem", "folders can't be layers")),
-    };
-    let index = index_p(p, "layer.addItem")?;
-    let position = position_p(p, "layer.addItem")?;
-    let fr = comp.frame_rate;
-    // Settings ▸ General ▸ Create Layers at Composition Start Time (off: at the current time).
-    let default_start = if s.prefs.general.create_layers_at_comp_start || s.active_comp_id() != Some(cid) { Tick::ZERO } else { s.time() };
-    let start = fr.snap_nearest(f_p(p, "time").map(Tick::from_seconds_f64).unwrap_or(default_start));
-    let id = s.edit("Add Footage to Comp", None, |proj, st| {
-        let mut l = build::layer(proj, &comp, &it.name, src, size, dur);
-        l.start_time = start;
-        l.in_point = start;
-        // Footage and precomps keep their full length past the comp's end (After Effects); items
-        // without a duration (solids, comp-length stills) end with the comp.
-        let end = dur.map_or((start + comp.duration).min(comp.duration), |d| start + d);
-        l.out_point = fr.snap_nearest(end).max(start + fr.frame_duration());
-        place(&mut l, position);
-        insert_layer_at(proj, st, cid, l, index)
-    })?;
-    Ok(json!({"layer": id.0}))
-}
-
-fn select(s: &mut Session, p: &Value) -> Result<Value> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let ids: Vec<LayerId> = match p.get("layers").or(p.get("layer")) {
-        Some(Value::Array(a)) => a.iter().filter_map(|v| resolve_layer(comp, v)).collect(),
-        Some(v) => resolve_layer(comp, v).into_iter().collect(),
-        None => vec![],
-    };
-    let add = b_p(p, "add").unwrap_or(false);
-    let toggle = b_p(p, "toggle").unwrap_or(false);
-    if toggle {
-        for id in ids {
-            if let Some(i) = s.state.selected_layers.iter().position(|l| *l == id) {
-                s.state.selected_layers.remove(i);
-            } else {
-                s.state.selected_layers.push(id);
-            }
-        }
-    } else if add {
-        for id in ids {
-            if !s.state.selected_layers.contains(&id) {
-                s.state.selected_layers.push(id);
-            }
-        }
-    } else {
-        s.state.selected_layers = ids;
-        s.state.selected_props.clear();
-        s.state.selected_keys.clear();
-        let keep = s.state.selected_layers.clone();
-        s.state.selected_vertices.retain(|v| keep.contains(&v.layer));
-    }
-    Ok(json!(s.state.selected_layers.iter().map(|l| l.0).collect::<Vec<_>>()))
-}
-
-fn select_step(s: &mut Session, p: &Value, dir: i64) -> Result<Value> {
-    let comp = s.active_comp().ok_or(EngineError::NoComp)?;
-    if comp.layers.is_empty() {
-        return Ok(Value::Null);
-    }
-    let cur = s.state.selected_layers.first().and_then(|id| comp.layers.iter().position(|l| l.id == *id));
-    let n = comp.layers.len() as i64;
-    // The next layer that can be selected (locked and hidden shy layers are stepped over); at
-    // the end of the stack the selection stays.
-    let start = match cur {
-        Some(i) => i as i64 + dir,
-        None if dir > 0 => 0,
-        None => n - 1,
-    };
-    let next =
-        std::iter::successors(Some(start), |i| Some(i + dir)).take_while(|i| (0..n).contains(i)).find(|i| super::selectable(comp, &comp.layers[*i as usize]));
-    let Some(i) = next.or(cur.map(|i| i as i64)) else { return Ok(Value::Null) };
-    let id = comp.layers[i as usize].id;
-    let add = b_p(p, "add").unwrap_or(false);
-    if add {
-        if !s.state.selected_layers.contains(&id) {
-            s.state.selected_layers.insert(0, id);
-        }
-    } else {
-        s.state.selected_layers = vec![id];
-    }
-    Ok(json!(id.0))
-}
-
-fn select_next(s: &mut Session, p: &Value) -> Result<Value> {
-    select_step(s, p, 1)
-}
-fn select_prev(s: &mut Session, p: &Value) -> Result<Value> {
-    select_step(s, p, -1)
-}
-
-fn set_switch(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let name = str_p(p, "switch").ok_or_else(|| bad("layer.setSwitch", "missing `switch`"))?.to_string();
-    let v = b_p(p, "value");
-    let label = format!("Layer Switch ({name})");
-    if b_p(p, "others") == Some(true) {
-        return set_switch_others(s, cid, &ids, &name, v, &label);
-    }
-    // `merge`: a switch dragged over several layers in the Timeline is one undo step.
-    let r = s.edit(&label, merge_p(p), |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        let mut last = false;
-        // Toggle relative to the first layer so a multi-selection ends up consistent.
-        let first = comp.layers.iter().find(|l| ids.contains(&l.id)).map(|l| switch_value(l, &name)).unwrap_or(Some(false));
-        let Some(first) = first else { return Err(bad("layer.setSwitch", format!("unknown switch `{name}`"))) };
-        let target = v.unwrap_or(!first);
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
-            set_switch_value(l, &name, target);
-            last = target;
-        }
-        Ok(last)
-    })?;
-    Ok(json!(r))
-}
-
-/// `layer.setSwitch {others: true}` (Alt-click on an A/V feature in the Timeline): the named
-/// layers stand alone, shown / heard / soloed / unlocked while every other layer the switch
-/// applies to is the opposite; when they already do, the other layers come back. `value` sets
-/// the other layers directly.
-fn set_switch_others(s: &mut Session, cid: ItemId, ids: &[LayerId], name: &str, value: Option<bool>, label: &str) -> Result<Value> {
-    let r = s.edit(label, None, |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        // The state that sets a layer apart: unlocked for Lock, on for the rest.
-        let active = !matches!(name, "lock" | "locked");
-        // Track mattes keep their video off by design.
-        let mattes: Vec<LayerId> =
-            if matches!(name, "video" | "eye") { comp.layers.iter().filter_map(|l| l.track_matte.map(|m| m.layer)).collect() } else { Vec::new() };
-        let applies = |l: &Layer| match name {
-            "audio" => l.props.sub("audio").is_some(),
-            "lock" | "locked" => true,
-            // Nulls have a Video switch too (it hides their outline in the viewer).
-            "video" | "eye" => (l.source.is_av() || matches!(l.source, LayerSource::Null)) && !mattes.contains(&l.id),
-            _ => l.source.is_av() && !mattes.contains(&l.id),
-        };
-        let mut alone = true;
-        for l in comp.layers.iter().filter(|l| applies(l)) {
-            let Some(on) = switch_value(l, name) else { return Err(bad("layer.setSwitch", format!("unknown switch `{name}`"))) };
-            alone &= on == (ids.contains(&l.id) == active);
-        }
-        let others = value.unwrap_or(alone == active);
-        for l in comp.layers.iter_mut().filter(|l| applies(l)) {
-            let v = if ids.contains(&l.id) { active } else { others };
-            set_switch_value(l, name, v);
-        }
-        Ok(others)
-    })?;
-    Ok(json!(r))
-}
-
-fn switch_value(l: &Layer, name: &str) -> Option<bool> {
-    let sw = &l.switches;
-    Some(match name {
-        "video" | "eye" => sw.video,
-        "audio" => sw.audio,
-        "solo" => sw.solo,
-        "lock" | "locked" => sw.locked,
-        "shy" => sw.shy,
-        "collapse" => sw.collapse,
-        "quality" => sw.quality == Quality::Best,
-        "fx" | "effects" => sw.effects,
-        "frameBlend" => sw.frame_blend != FrameBlend::Off,
-        "motionBlur" => sw.motion_blur,
-        "adjustment" => sw.adjustment,
-        "threeD" | "3d" | "3D" => sw.three_d,
-        "guide" => sw.guide,
-        "preserveTransparency" => l.preserve_transparency,
-        _ => return None,
-    })
-}
-
-fn set_switch_value(l: &mut Layer, name: &str, v: bool) {
-    let sw = &mut l.switches;
-    match name {
-        "video" | "eye" => sw.video = v,
-        "audio" => sw.audio = v,
-        "solo" => sw.solo = v,
-        "lock" | "locked" => sw.locked = v,
-        "shy" => sw.shy = v,
-        "collapse" => sw.collapse = v,
-        "quality" => sw.quality = if v { Quality::Best } else { Quality::Draft },
-        "fx" | "effects" => sw.effects = v,
-        "frameBlend" => sw.frame_blend = if v { FrameBlend::FrameMix } else { FrameBlend::Off },
-        "motionBlur" => sw.motion_blur = v,
-        "adjustment" => sw.adjustment = v,
-        "threeD" | "3d" | "3D" => {
-            if sw.three_d && !v {
-                drop_3d_values(l);
-            }
-            l.switches.three_d = v;
-        }
-        "guide" => sw.guide = v,
-        "preserveTransparency" => l.preserve_transparency = v,
-        _ => {}
-    }
-}
-
-/// Turning the 3D switch off discards Z values, Orientation and X/Y Rotation (as in AE).
-fn drop_3d_values(l: &mut Layer) {
-    let Some(tr) = l.transform_mut() else { return };
-    for (m, keep) in [("position", 0.0), ("anchor", 0.0), ("scale", 100.0)] {
-        if let Some(pr) = tr.get_mut(m) {
-            let flat = |v: &mut KV| {
-                if let KV::Vec3(a) = v {
-                    a[2] = keep;
-                }
-            };
-            flat(&mut pr.value);
-            for k in &mut pr.keys {
-                flat(&mut k.value);
-            }
-        }
-    }
-    for (m, zero) in [("orientation", KV::Vec3([0.0; 3])), ("rotationX", KV::Scalar(0.0)), ("rotationY", KV::Scalar(0.0))] {
-        if let Some(pr) = tr.get_mut(m) {
-            pr.keys.clear();
-            pr.expr = None;
-            pr.value = zero;
-        }
-    }
-}
-
-fn rename(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.rename")?;
-    let name = str_p(p, "name").ok_or_else(|| bad("layer.rename", "missing `name`"))?.to_string();
-    s.edit("Rename Layer", None, |proj, _| {
-        layer_mut(proj, cid, lid)?.name = name.clone();
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// The Timeline's Comment column.
-fn set_comment(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let text = str_p(p, "comment").ok_or_else(|| bad("layer.setComment", "missing `comment`"))?.to_string();
-    s.edit("Layer Comment", None, |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
-            l.comment = text.clone();
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn blend(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let mode = str_p(p, "mode").and_then(BlendMode::from_name);
-    let step = p.get("step").and_then(Value::as_i64).unwrap_or(0);
-    if mode.is_none() && step == 0 {
-        return Err(bad("layer.setBlendMode", "need `mode` (e.g. Multiply) or `step` ±1"));
-    }
-    s.edit("Blending Mode", None, |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
-            l.blend_mode = match mode {
-                Some(m) => m,
-                None if step > 0 => l.blend_mode.next(),
-                None => l.blend_mode.previous(),
-            };
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn track_matte(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.setTrackMatte")?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let matte = match p.get("matte") {
-        None | Some(Value::Null) => None,
-        Some(v) => Some(resolve_layer(comp, v).ok_or_else(|| bad("layer.setTrackMatte", "no such matte layer"))?),
-    };
-    let kind = str_p(p, "kind")
-        .map(|k| match k.to_ascii_lowercase().replace([' ', '_', '-'], "").as_str() {
-            "alphainverted" | "alphainv" => MatteKind::AlphaInverted,
-            "luma" => MatteKind::Luma,
-            "lumainverted" | "lumainv" => MatteKind::LumaInverted,
-            _ => MatteKind::Alpha,
-        })
-        .unwrap_or(MatteKind::Alpha);
-    s.edit("Track Matte", None, |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        if let Some(m) = matte {
-            if m == lid {
-                return Err(bad("layer.setTrackMatte", "a layer can't be its own matte"));
-            }
-            if let Some(ml) = comp.layer_mut(m) {
-                ml.switches.video = false;
-            }
-        }
-        comp.layer_mut(lid).ok_or(EngineError::NoComp)?.track_matte = matte.map(|layer| TrackMatte { layer, kind });
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// Re-express a layer in its new parent space without moving its anchor.
-pub(crate) struct ParentFix {
-    pub layer: LayerId,
-    /// Maps Position from the old parent's space into the new one's.
-    m: effectcraft_geom::Mat3,
-    /// Added to Rotation.
-    rotation: f64,
-    /// Multiply Scale.
-    scale: [f64; 2],
-    /// 3D AV layers retain their world-space anchor, including Z.
-    position_3d: Option<effectcraft_geom::Mat4>,
-    /// A uniform relative parent transform can preserve static Orientation and Scale.
-    pose_3d: Option<([f64; 3], f64)>,
-}
-
-impl ParentFix {
-    /// Re-express the layer's Position, Rotation and Scale (every key) in the new parent's space.
-    pub fn apply(&self, l: &mut Layer) {
-        let Some(tr) = l.props.sub_mut("transform") else { return };
-        if let Some(m) = self.position_3d {
-            // Spatial Position speed measures distance along its path. Its parent-space
-            // unit changes even when the child's Orientation cannot be re-expressed.
-            let position_speed = uniform_parent_pose(m, [0.0; 3]).map(|(_, factor)| factor.abs());
-            let map_position = |v: &KV| {
-                let q = m.apply(effectcraft_geom::Vec3::from(v.as_vec3()));
-                KV::Vec3([q.x, q.y, q.z])
-            };
-            // Read all separated axes before writing any of them.
-            let names = ["positionX", "positionY", "positionZ"];
-            if tr.get("positionX").is_some() {
-                let axes = names.map(|name| tr.get(name).cloned());
-                let current = axes.each_ref().map(|pr| pr.as_ref().map(|pr| pr.value.as_f64()).unwrap_or(0.0));
-                let q = m.apply(effectcraft_geom::Vec3::from(current));
-                for (i, name) in names.into_iter().enumerate() {
-                    if let Some(pr) = tr.get_mut(name) {
-                        pr.value = KV::Scalar([q.x, q.y, q.z].get(i).copied().unwrap_or(0.0));
-                        for key in &mut pr.keys {
-                            let p = axes.each_ref().map(|axis| axis.as_ref().map(|axis| axis.value_at(key.time).as_f64()).unwrap_or(0.0));
-                            let q = m.apply(effectcraft_geom::Vec3::from(p));
-                            key.value = KV::Scalar([q.x, q.y, q.z].get(i).copied().unwrap_or(0.0));
-                        }
-                    }
-                }
-            }
-            if let Some(pr) = tr.get_mut("position") {
-                pr.value = map_position(&pr.value);
-                for key in &mut pr.keys {
-                    key.value = map_position(&key.value);
-                    // Spatial tangents are vectors, so the parent's translation is excluded.
-                    for tangent in [&mut key.spatial_in, &mut key.spatial_out] {
-                        let v = m.apply_vec(effectcraft_geom::Vec3::from(*tangent));
-                        *tangent = [v.x, v.y, v.z];
-                    }
-                }
-                if let Some(factor) = position_speed
-                    .filter(|_| pr.spatial)
-                    .filter(|factor| pr.keys.iter().flat_map(|key| key.in_ease.iter().chain(&key.out_ease)).all(|ease| (ease.speed * *factor).is_finite()))
-                {
-                    for key in &mut pr.keys {
-                        for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
-                            ease.speed *= factor;
-                        }
-                    }
-                }
-            }
-            // Cameras and lights aim with Point of Interest: move it by the same parent-space
-            // change, so a two-node rig keeps its world frame (#1010, #1020).
-            if let Some(pr) = tr.get_mut("poi") {
-                pr.value = map_position(&pr.value);
-                for key in &mut pr.keys {
-                    key.value = map_position(&key.value);
-                    for tangent in [&mut key.spatial_in, &mut key.spatial_out] {
-                        let v = m.apply_vec(effectcraft_geom::Vec3::from(*tangent));
-                        *tangent = [v.x, v.y, v.z];
-                    }
-                }
-                if let Some(factor) = position_speed
-                    .filter(|_| pr.spatial)
-                    .filter(|factor| pr.keys.iter().flat_map(|key| key.in_ease.iter().chain(&key.out_ease)).all(|ease| (ease.speed * *factor).is_finite()))
-                {
-                    for key in &mut pr.keys {
-                        for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
-                            ease.speed *= factor;
-                        }
-                    }
-                }
-            }
-            if let Some((orientation, factor)) = self.pose_3d {
-                if let Some(pr) = tr.get_mut("orientation") {
-                    pr.value = KV::Vec3(orientation);
-                }
-                if let Some(pr) = tr.get_mut("scale") {
-                    let scaled = |value: &KV| KV::Vec3(value.as_vec3().map(|v| v * factor));
-                    pr.value = scaled(&pr.value);
-                    for key in &mut pr.keys {
-                        key.value = scaled(&key.value);
-                        // Scale's temporal speeds use the same units as its values.
-                        for ease in key.in_ease.iter_mut().chain(&mut key.out_ease) {
-                            ease.speed *= factor;
-                        }
-                    }
-                }
-            }
-            return;
-        }
-        let map = |pr: &mut effectcraft_project::Property, f: &dyn Fn(&KV) -> KV| {
-            pr.value = f(&pr.value);
-            for key in &mut pr.keys {
-                key.value = f(&key.value);
-            }
-        };
-        let m = self.m;
-        if tr.get("positionX").is_some() {
-            // Separated dimensions: X and Y move together, key by key at the same times.
-            // Everything is read before anything is written.
-            let [x, y] = [tr.get("positionX"), tr.get("positionY")].map(|p| p.map(|p| p.value.as_f64()).unwrap_or(0.0));
-            let q = m.apply(effectcraft_geom::vec2(x, y));
-            let keys_x: Vec<(Tick, f64)> = tr.get("positionX").map(|p| p.keys.iter().map(|k| (k.time, k.value.as_f64())).collect()).unwrap_or_default();
-            let keys_y: Vec<(Tick, f64)> = tr.get("positionY").map(|p| p.keys.iter().map(|k| (k.time, k.value.as_f64())).collect()).unwrap_or_default();
-            let at = |keys: &[(Tick, f64)], name: &str, t: Tick, tr: &PropGroup| {
-                keys.iter().find(|k| k.0 == t).map(|k| k.1).unwrap_or_else(|| tr.get(name).map(|p| p.value_at(t).as_f64()).unwrap_or(0.0))
-            };
-            let (xs, ys): (Vec<f64>, Vec<f64>) = (
-                keys_x.iter().map(|&(t, x)| m.apply(effectcraft_geom::vec2(x, at(&keys_y, "positionY", t, tr))).x).collect(),
-                keys_y.iter().map(|&(t, y)| m.apply(effectcraft_geom::vec2(at(&keys_x, "positionX", t, tr), y)).y).collect(),
-            );
-            for (name, value, vals) in [("positionX", q.x, xs), ("positionY", q.y, ys)] {
-                if let Some(pr) = tr.get_mut(name) {
-                    pr.value = KV::Scalar(value);
-                    for (k, v) in pr.keys.iter_mut().zip(vals) {
-                        k.value = KV::Scalar(v);
-                    }
-                }
-            }
-        } else if let Some(pr) = tr.get_mut("position") {
-            map(pr, &|v| {
-                let c = v.as_vec3();
-                let q = m.apply(effectcraft_geom::vec2(c[0], c[1]));
-                KV::Vec3([q.x, q.y, c[2]])
-            });
-        }
-        let (dr, k) = (self.rotation, self.scale);
-        if let Some(pr) = tr.get_mut("rotation") {
-            map(pr, &|v| KV::Scalar(v.as_f64() + dr));
-        }
-        if let Some(pr) = tr.get_mut("scale") {
-            map(pr, &|v| {
-                let c = v.as_vec3();
-                KV::Vec3([c[0] * k[0], c[1] * k[1], c[2]])
-            });
-        }
-    }
-}
-
-/// A uniform factor commutes with authored axis Rotation and Scale; prepend its orthogonal
-/// rotation to static Orientation using the existing Rz * Ry * Rx order.
-fn uniform_parent_pose(m: effectcraft_geom::Mat4, orientation: [f64; 3]) -> Option<([f64; 3], f64)> {
-    use effectcraft_geom::{Mat4, Vec3, vec3};
-    if !orientation.iter().all(|v| v.is_finite()) {
-        return None;
-    }
-    let a = m.0;
-    let columns = [vec3(a[0][0], a[1][0], a[2][0]), vec3(a[0][1], a[1][1], a[2][1]), vec3(a[0][2], a[1][2], a[2][2])];
-    let magnitude = columns[0].x.hypot(columns[0].y).hypot(columns[0].z);
-    if !magnitude.is_finite() || magnitude <= 0.0 {
-        return None;
-    }
-    let c = columns.map(|c| c / magnitude);
-    if c.iter().any(|c| (c.dot(*c) - 1.0).abs() > 1e-9) || c[0].dot(c[1]).abs() > 1e-9 || c[0].dot(c[2]).abs() > 1e-9 || c[1].dot(c[2]).abs() > 1e-9 {
-        return None;
-    }
-    let cross = vec3(c[1].y * c[2].z - c[1].z * c[2].y, c[1].z * c[2].x - c[1].x * c[2].z, c[1].x * c[2].y - c[1].y * c[2].x);
-    let factor = if c[0].dot(cross) < 0.0 { -magnitude } else { magnitude };
-    let mut rotation = Mat4::IDENTITY;
-    for row in 0..3 {
-        for col in 0..3 {
-            rotation.0[row][col] = a[row][col] / factor;
-        }
-    }
-    if (0..3).all(|row| (0..3).all(|col| (rotation.0[row][col] - if row == col { 1.0 } else { 0.0 }).abs() < 1e-12)) {
-        return Some((orientation, factor));
-    }
-    let r = (rotation * Mat4::orientation(Vec3::from(orientation))).0;
-    // atan2 rather than asin: near ±90 degrees asin loses precision, while cos(y) stays exact.
-    let cy = r[0][0].hypot(r[1][0]);
-    let y = (-r[2][0]).atan2(cy);
-    let (x, z) = if cy > 1e-9 { (r[2][1].atan2(r[2][2]), r[1][0].atan2(r[0][0])) } else { ((-r[1][2]).atan2(r[1][1]), 0.0) };
-    Some(([x.to_degrees(), y.to_degrees(), z.to_degrees()], factor))
-}
-
-/// A parent change retains 2D transforms and the world-space anchor of 3D layers (Position,
-/// and Point of Interest for two-node cameras and lights). Position is
-/// re-expressed in the new parent's space (`None`: the composition), evaluated at the current
-/// time.
-pub(crate) fn parent_fixes(s: &Session, cid: ItemId, ids: &[LayerId], parent: Option<LayerId>) -> Vec<ParentFix> {
-    let Some(comp) = s.project.comp(cid) else { return vec![] };
-    let ectx =
-        effectcraft_render::EvalCtx { project: &s.project, comp_id: cid, comp, time: s.time(), expr: s.expr.as_deref(), footage: Some(s.footage.as_ref()) };
-    let space = |id: Option<LayerId>| -> effectcraft_geom::Mat3 {
-        id.and_then(|i| comp.layer(i)).filter(|l| !l.is_3d()).map(|l| ectx.layer_to_comp(l).0).unwrap_or(effectcraft_geom::Mat3::IDENTITY)
-    };
-    let decompose = |m: &effectcraft_geom::Mat3| {
-        let a = m.0;
-        let sx = (a[0][0] * a[0][0] + a[1][0] * a[1][0]).sqrt();
-        let det = a[0][0] * a[1][1] - a[0][1] * a[1][0];
-        (a[1][0].atan2(a[0][0]).to_degrees(), sx, if sx > 1e-12 { det / sx } else { 0.0 })
-    };
-    let new_m = space(parent);
-    let Some(inv) = new_m.inverse() else { return vec![] };
-    let (rn, sxn, syn) = decompose(&new_m);
-    let mut fixes: Vec<_> = comp
-        .layers
-        .iter()
-        .filter(|l| ids.contains(&l.id) && !l.is_3d() && l.parent != parent)
-        .map(|l| {
-            let old_m = space(l.parent);
-            let (ro, sxo, syo) = decompose(&old_m);
-            let scale = [if sxn.abs() > 1e-12 { sxo / sxn } else { 1.0 }, if syn.abs() > 1e-12 { syo / syn } else { 1.0 }];
-            ParentFix { layer: l.id, m: inv * old_m, rotation: ro - rn, scale, position_3d: None, pose_3d: None }
-        })
-        .collect();
-    let space_3d = |id: Option<LayerId>| {
-        id.and_then(|id| comp.layer(id)).map_or(effectcraft_geom::Mat4::IDENTITY, |layer| {
-            // Parent transforms do not inherit the parent's source pixel-aspect stretch.
-            let world = ectx.world_matrix(layer);
-            let par = ectx.par_ratio(layer);
-            let a = layer.transform().map(|tr| ectx.v3(layer, tr, "anchor", [0.0; 3])).unwrap_or([0.0; 3]);
-            let anchor = effectcraft_geom::vec3(a[0], a[1], if layer.is_3d() { a[2] } else { 0.0 });
-            world
-                * effectcraft_geom::Mat4::translate(anchor)
-                * effectcraft_geom::Mat4::scale(effectcraft_geom::vec3(1.0 / par, 1.0, 1.0))
-                * effectcraft_geom::Mat4::translate(-anchor)
-        })
-    };
-    if let Some(inv) = space_3d(parent).inverse().filter(|m| m.0.iter().flatten().all(|v| v.is_finite())) {
-        // Cameras and lights compensate like 3D layers (Position, and Point of Interest for
-        // two-node rigs), so parenting keeps the world frame (#1010, #1020). They have no
-        // Scale, so `pose_3d` below stays `None` and Orientation is kept as authored.
-        for layer in comp.layers.iter().filter(|l| ids.contains(&l.id) && l.is_3d() && l.parent != parent) {
-            let m = inv * space_3d(layer.parent);
-            if m.0.iter().flatten().all(|v| v.is_finite()) {
-                let pose_3d = layer.transform().and_then(|tr| {
-                    let orientation = tr.get("orientation")?;
-                    let scale = tr.get("scale")?;
-                    // Animated Euler Orientation and auto-orient cannot be re-expressed by
-                    // prepending a constant Euler value. Expression-driven values stay authored.
-                    if !orientation.keys.is_empty()
-                        || orientation.expr.is_some()
-                        || scale.expr.is_some()
-                        || layer.auto_orient != effectcraft_project::AutoOrient::Off
-                    {
-                        return None;
-                    }
-                    let pose = uniform_parent_pose(m, orientation.value.as_vec3())?;
-                    let factor = pose.1;
-                    let values_finite = std::iter::once(&scale.value)
-                        .chain(scale.keys.iter().map(|key| &key.value))
-                        .all(|value| value.as_vec3().iter().all(|v| (v * factor).is_finite()));
-                    let speeds_finite = scale.keys.iter().flat_map(|key| key.in_ease.iter().chain(&key.out_ease)).all(|ease| (ease.speed * factor).is_finite());
-                    (values_finite && speeds_finite).then_some(pose)
-                });
-                fixes.push(ParentFix { layer: layer.id, m: effectcraft_geom::Mat3::IDENTITY, rotation: 0.0, scale: [1.0; 2], position_3d: Some(m), pose_3d });
-            }
-        }
-    }
-    fixes
-}
-
-/// Validate the proposed ancestor chain before any authored edit, including when compensation
-/// is disabled. Bound both unique ancestors and linear lookup/selection work on loaded graphs.
-fn check_parent_chain(comp: &Comp, ids: &[LayerId], parent: Option<LayerId>, max_visits: usize, max_work: usize) -> Result<()> {
-    let mut seen = std::collections::HashSet::new();
-    let mut work = 0usize;
-    let mut cur = parent;
-    while let Some(id) = cur {
-        if seen.len() >= max_visits {
-            return Err(bad("layer.setParent", "parent chain exceeds the safety visit limit"));
-        }
-        if !seen.insert(id) {
-            return Err(bad("layer.setParent", "parent chain contains an existing cycle"));
-        }
-        for selected in ids {
-            if work >= max_work {
-                return Err(bad("layer.setParent", "parent chain exceeds the safety work limit"));
-            }
-            work += 1;
-            if *selected == id {
-                return Err(bad("layer.setParent", "parenting would create a cycle"));
-            }
-        }
-        let mut ancestor = None;
-        for layer in &comp.layers {
-            if work >= max_work {
-                return Err(bad("layer.setParent", "parent chain exceeds the safety work limit"));
-            }
-            work += 1;
-            if layer.id == id {
-                ancestor = Some(layer);
-                break;
-            }
-        }
-        let layer = ancestor.ok_or_else(|| bad("layer.setParent", "parent chain refers to a missing layer"))?;
-        cur = layer.parent;
-    }
-    Ok(())
-}
-
-fn set_parent(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let parent = match p.get("parent") {
-        None | Some(Value::Null) => None,
-        Some(v) => Some(resolve_layer(comp, v).ok_or_else(|| bad("layer.setParent", "no such parent layer"))?),
-    };
-    // A loaded cycle need not include a selected child. Validate before compensation or edit;
-    // do not impose the renderer's 64-ancestor truncation as a new ordinary hierarchy limit.
-    check_parent_chain(comp, &ids, parent, 4096, 1_048_576)?;
-    // Like AE's pick-whip, parenting keeps the layer where it is: its transform is re-expressed
-    // in the new parent's space (Position, Rotation, Scale), unless `compensate: false`.
-    let compensate = b_p(p, "compensate").unwrap_or(true);
-    let fixes = if compensate { parent_fixes(s, cid, &ids, parent) } else { vec![] };
-    s.edit("Parent", None, |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
-            l.parent = parent;
-            if let Some(f) = fixes.iter().find(|f| f.layer == l.id) {
-                f.apply(l);
-            }
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn timing(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let t = s.time();
-    let op = str_p(p, "op").unwrap_or("set").to_string();
-    // Layer times stay on frame boundaries of the comp (as in AE).
-    let fr = s.project.comp(cid).ok_or(EngineError::NoComp)?.frame_rate;
-    let snap = |k: &str| f_p(p, k).map(|v| fr.snap_nearest(Tick::from_seconds_f64(v)));
-    let (delta, start, inp, outp) = (snap("delta"), snap("start"), snap("in"), snap("out"));
-    // Relative trims: each layer moves its own in/out point by the same amount, so dragging an
-    // edge of several selected layers trims them all together (as in AE).
-    let (in_delta, out_delta) = (snap("inDelta"), snap("outDelta"));
-    s.edit("Layer Timing", merge_p(p), |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        let fd = comp.frame_duration();
-        let comp_dur = comp.duration;
-        for l in comp.layers.iter_mut().filter(|l| ids.contains(&l.id)) {
-            let shift = |l: &mut Layer, d: Tick| {
-                l.start_time += d;
-                l.in_point += d;
-                l.out_point += d;
-            };
-            match op.as_str() {
-                "moveInToTime" => {
-                    let d = t - l.in_point;
-                    shift(l, d);
-                }
-                "moveOutToTime" => {
-                    let d = t - l.out_point;
-                    shift(l, d);
-                }
-                "moveInToStart" => {
-                    let d = Tick::ZERO - l.in_point;
-                    shift(l, d);
-                }
-                "moveOutToEnd" => {
-                    let d = comp_dur - l.out_point;
-                    shift(l, d);
-                }
-                "trimInToTime" => l.in_point = t.min(l.out_point - fd),
-                "trimOutToTime" => l.out_point = t.max(l.in_point + fd),
-                _ => {
-                    if let Some(d) = delta {
-                        shift(l, d);
-                    }
-                    if let Some(st) = start {
-                        let d = st - l.start_time;
-                        shift(l, d);
-                    }
-                    if let Some(i) = inp {
-                        l.in_point = i.min(l.out_point - fd);
-                    }
-                    if let Some(o) = outp {
-                        l.out_point = o.max(l.in_point + fd);
-                    }
-                    // Stops at the comp start/end (a point already past it doesn't jump onto
-                    // it), keeping at least one frame of layer.
-                    if let Some(d) = in_delta {
-                        l.in_point = (l.in_point + d).max(Tick::ZERO.min(l.in_point)).min(l.out_point - fd);
-                    }
-                    if let Some(d) = out_delta {
-                        l.out_point = (l.out_point + d).min(comp_dur.max(l.out_point)).max(l.in_point + fd);
-                    }
-                }
-            }
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// `p` with `key` set.
-fn with(p: &Value, key: &str, v: Value) -> Value {
-    let mut p = if p.is_object() { p.clone() } else { json!({}) };
-    p[key] = v;
-    p
-}
-
-/// Move the layers `frames` frames in time (Alt+Page Up / Page Down, with Shift ten frames).
-fn move_frames(s: &mut Session, p: &Value, frames: i64) -> Result<Value> {
-    let (cid, _) = layers_p(s, p)?;
-    let delta = s.project.comp(cid).ok_or(EngineError::NoComp)?.frame_rate.tick_of(frames).seconds();
-    timing(s, &with(p, "delta", json!(delta)))
-}
-
-/// Slip edit: move a layer's source (footage or precomp) under its fixed in and out points, like
-/// dragging the source-duration bar in After Effects. `delta` in seconds or `frames`; positive
-/// moves the source later. Clamped so the source still covers the in–out span. Keyframes and
-/// layer markers are in layer time, so they travel with the source.
-fn slip(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let fr = comp.frame_rate;
-    let delta = match (p.get("frames").and_then(Value::as_i64), f_p(p, "delta")) {
-        (Some(f), _) => fr.tick_of(f),
-        (None, Some(d)) => fr.snap_nearest(Tick::from_seconds_f64(d)),
-        _ => return Err(bad("layer.slip", "delta (seconds) or frames required")),
-    };
-    // Allowed shift per layer: the source span [lo, hi] in comp time must keep covering in..out.
-    let mut shifts: Vec<(LayerId, Tick)> = Vec::new();
-    for l in comp.layers.iter().filter(|l| ids.contains(&l.id)) {
-        if l.props.get("timeRemap").is_some() {
-            continue;
-        }
-        let dur = match &l.source {
-            LayerSource::Footage { item } => match s.project.item(*item).map(|i| &i.kind) {
-                Some(ItemKind::Footage(f)) if f.kind != effectcraft_project::FootageKind::Still => Some(f.looped_duration()),
-                _ => None,
-            },
-            LayerSource::Comp { item } => s.project.comp(*item).map(|c| c.duration),
-            _ => None,
-        };
-        let Some(dur) = dur else { continue };
-        let (a, b) = (l.comp_time(Tick::ZERO), l.comp_time(dur));
-        let (lo, hi) = (a.min(b), a.max(b));
-        let (min_d, max_d) = (l.out_point - hi, l.in_point - lo);
-        if min_d > max_d {
-            continue;
-        }
-        shifts.push((l.id, delta.max(min_d).min(max_d)));
-    }
-    if shifts.is_empty() {
-        return Err(bad("layer.slip", "select a footage or precomp layer (without time remapping)"));
-    }
-    s.edit("Slip Edit", merge_p(p), |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        for (id, d) in &shifts {
-            if let Some(l) = comp.layer_mut(*id) {
-                l.start_time += *d;
-            }
-        }
-        Ok(())
-    })?;
-    Ok(json!({"slipped": shifts.iter().map(|(id, d)| json!({"layer": id.0, "delta": d.seconds()})).collect::<Vec<_>>()}))
-}
-
-fn arrange(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let ids = unlocked(s, cid, ids, "layer.arrange")?;
-    let how = str_p(p, "to").unwrap_or("front").to_string();
-    let index = p.get("index").and_then(Value::as_u64).map(|i| i as usize);
-    // `above`: put the layers right above that one (the timeline's drag to reorder).
-    let above = match p.get("above") {
-        Some(v) => {
-            let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-            let a = resolve_layer(comp, v).ok_or_else(|| bad("layer.arrange", "no such layer for `above`"))?;
-            if ids.contains(&a) {
-                return Err(bad("layer.arrange", "`above` must be a layer that isn't being moved"));
-            }
-            Some(a)
-        }
-        None => None,
-    };
-    s.edit("Arrange Layers", None, |proj, _| {
-        let comp = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        // Bring Forward / Send Backward move each layer one step past the next layer that isn't
-        // moving (a run of selected layers moves as one; one already at the end stays).
-        if above.is_none() && index.is_none() && matches!(how.as_str(), "forward" | "backward") {
-            let picked = |l: &Layer| ids.contains(&l.id);
-            let n = comp.layers.len();
-            if how == "forward" {
-                for i in 1..n {
-                    if picked(&comp.layers[i]) && !picked(&comp.layers[i - 1]) {
-                        let run_end = (i..n).find(|j| !picked(&comp.layers[*j])).unwrap_or(n);
-                        comp.layers[i - 1..run_end].rotate_left(1);
-                    }
-                }
-            } else {
-                for i in (0..n.saturating_sub(1)).rev() {
-                    if picked(&comp.layers[i]) && !picked(&comp.layers[i + 1]) {
-                        let run_start = (0..=i).rev().find(|j| !picked(&comp.layers[*j])).map_or(0, |j| j + 1);
-                        comp.layers[run_start..=i + 1].rotate_right(1);
-                    }
-                }
-            }
-            return Ok(());
-        }
-        let mut picked: Vec<Layer> = Vec::new();
-        comp.layers.retain(|l| {
-            if ids.contains(&l.id) {
-                picked.push(l.clone());
-                false
-            } else {
-                true
-            }
-        });
-        let at = match (how.as_str(), index) {
-            _ if above.is_some() => comp.layers.iter().position(|l| Some(l.id) == above).unwrap_or(comp.layers.len()),
-            (_, Some(i)) => i.saturating_sub(1).min(comp.layers.len()),
-            ("back", _) => comp.layers.len(),
-            _ => 0,
-        };
-        for (k, l) in picked.into_iter().enumerate() {
-            comp.layers.insert((at + k).min(comp.layers.len()), l);
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// Layer ▸ Pre-compose. `mode: move` (default; "Move all attributes into the new composition")
-/// nests the selected layers as they are; `mode: leave` ("Leave all attributes in", one footage,
-/// solid or precomp layer) nests only the layer's source, sized to it, and keeps the layer's
-/// transform, masks, effects and timing in the current comp. `adjustDuration` (move) trims the
-/// new comp to the selected layers' span; `open` opens the new comp.
-fn precompose(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "layer.precompose";
-    let (cid, ids) = layers_p(s, p)?;
-    if ids.is_empty() {
-        return Err(bad(c, "no layers"));
-    }
-    let name = str_p(p, "name").unwrap_or("Pre-comp 1").to_string();
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let leave = match str_p(p, "mode").unwrap_or("move") {
-        "move" => false,
-        "leave" => true,
-        x => return Err(bad(c, format!("mode: move|leave, got `{x}`"))),
-    };
-    let adjust = b_p(p, "adjustDuration").unwrap_or(false);
-    if leave {
-        let [lid] = ids[..] else { return Err(bad(c, "\"Leave all attributes\" needs exactly one layer")) };
-        let layer = comp.layer(lid).ok_or(EngineError::NoComp)?.clone();
-        let Some(src_item) = layer.source.item() else {
-            return Err(bad(c, "\"Leave all attributes\" is available for footage, solid and precomp layers only"));
-        };
-        let (w, h) = effectcraft_render::source_size(&s.project, &layer);
-        let (w, h) = if w == 0 || h == 0 { (comp.width, comp.height) } else { (w, h) };
-        let dur = match s.project.item(src_item).map(|i| &i.kind) {
-            Some(ItemKind::Comp(nc)) => nc.duration,
-            Some(ItemKind::Footage(f)) if f.duration > Tick(0) => f.duration,
-            _ => comp.duration,
-        };
-        let new = s.edit("Pre-compose", None, |proj, st| {
-            let mut inner = comp.nested_like(w, h, dur);
-            let mut il = build::layer(proj, &inner, &layer.name, layer.source.clone(), (w, h), Some(dur));
-            il.name = layer.name.clone();
-            inner.layers.push(il);
-            let iid = proj.add_item(&name, Label::Sandstone, None, ItemKind::Comp(inner.into()));
-            let l = layer_mut(proj, cid, lid)?;
-            l.source = LayerSource::Comp { item: iid };
-            l.name = name.clone();
-            st.selected_layers = vec![lid];
-            Ok((iid, lid))
-        })?;
-        if b_p(p, "open").unwrap_or(false) {
-            s.open_comp(new.0);
-        }
-        return Ok(json!({"comp": new.0.0, "layer": new.1.0}));
-    }
-    let span = {
-        let sel: Vec<&effectcraft_project::Layer> = comp.layers.iter().filter(|l| ids.contains(&l.id)).collect();
-        let a = sel.iter().map(|l| l.in_point).min().unwrap_or(Tick(0)).max(Tick(0));
-        let b = sel.iter().map(|l| l.out_point).max().unwrap_or(comp.duration).min(comp.duration);
-        (a, b)
-    };
-    let (offset, dur) = if adjust && span.1 > span.0 { (span.0, span.1 - span.0) } else { (Tick(0), comp.duration) };
-    let new = s.edit("Pre-compose", None, |proj, st| {
-        let mut inner = comp.nested_like(comp.width, comp.height, dur);
-        inner.layers = comp.layers.iter().filter(|l| ids.contains(&l.id)).cloned().collect();
-        for l in &mut inner.layers {
-            if l.parent.is_some_and(|p| !ids.contains(&p)) {
-                l.parent = None;
-            }
-            if l.track_matte.is_some_and(|m| !ids.contains(&m.layer)) {
-                l.track_matte = None;
-            }
-            l.start_time -= offset;
-            l.in_point -= offset;
-            l.out_point -= offset;
-        }
-        let iid = proj.add_item(&name, Label::Sandstone, None, ItemKind::Comp(inner.into()));
-        let mut l = build::layer(proj, &comp, &name, LayerSource::Comp { item: iid }, (comp.width, comp.height), Some(dur));
-        l.name = name.clone();
-        l.start_time = offset;
-        l.in_point = offset;
-        l.out_point = offset + dur;
-        let c = proj.comp_mut(cid).ok_or(EngineError::NoComp)?;
-        let at = c.layers.iter().position(|l| ids.contains(&l.id)).unwrap_or(0);
-        c.layers.retain(|l| !ids.contains(&l.id));
-        let lid = l.id;
-        c.layers.insert(at.min(c.layers.len()), l);
-        st.selected_layers = vec![lid];
-        Ok((iid, lid))
-    })?;
-    if b_p(p, "open").unwrap_or(false) {
-        s.open_comp(new.0);
-    }
-    Ok(json!({"comp": new.0.0, "layer": new.1.0}))
-}
-
-fn add_mask(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.addMask")?;
-    let layer = s.project.comp(cid).and_then(|c| c.layer(lid)).ok_or(EngineError::NoComp)?.clone();
-    let (w, h) = effectcraft_render::source_size(&s.project, &layer);
-    let (w, h) = if w == 0 { (400.0, 300.0) } else { (w as f64, h as f64) };
-    let shape = str_p(p, "shape").unwrap_or("rect");
-    let r = p.get("rect").and_then(Value::as_array).map(|a| [0, 1, 2, 3].map(|i| a.get(i).and_then(Value::as_f64).unwrap_or(0.0)));
-    let (cx, cy, rw, rh) = match r {
-        Some([x, y, rw, rh]) => (x + rw / 2.0, y + rh / 2.0, rw, rh),
-        None => (if w > 0.0 { w / 2.0 } else { 0.0 }, h / 2.0, w * 0.6, h * 0.6),
-    };
-    // The shape tools' masks: rectangle, ellipse, rounded rectangle, polygon or star.
-    let path = super::shape_tool::mask_path(shape, [cx, cy], [rw, rh])
-        .ok_or_else(|| bad("layer.addMask", format!("unknown shape `{shape}`; one of rect, ellipse, rounded, polygon, star")))?;
-    let mode = str_p(p, "mode").and_then(MaskMode::from_name).unwrap_or(MaskMode::Add);
-    let cycle = s.prefs.appearance.cycle_mask_colors;
-    let uid = s.edit("New Mask", None, |proj, _| {
-        let mut next = proj.next_id;
-        let l = layer_mut(proj, cid, lid)?;
-        let masks = l.props.sub_mut("masks").ok_or_else(|| bad("layer.addMask", "this layer can't have masks"))?;
-        let n = masks.children.len();
-        let g = build::mask(&mut Ids(&mut next), &format!("Mask {}", n + 1), path, mode, crate::prefs::mask_color(cycle, n));
-        let uid = g.uid;
-        masks.children.push(g.into());
-        proj.next_id = next;
-        Ok(uid)
-    })?;
-    Ok(json!({"mask": uid}))
-}
-
-fn mask_props(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.setMask")?;
-    let target = p.get("mask").cloned().unwrap_or(json!(1));
-    let mode = str_p(p, "mode").and_then(MaskMode::from_name);
-    let inverted = b_p(p, "inverted");
-    s.edit("Mask Settings", None, |proj, _| {
-        let l = layer_mut(proj, cid, lid)?;
-        let masks = l.props.sub_mut("masks").ok_or_else(|| bad("layer.setMask", "the layer has no masks (add one with layer.addMask)"))?;
-        let g = match &target {
-            Value::Number(n) => {
-                let n = n.as_u64().unwrap_or(1);
-                if let Some(i) = masks.children.iter().position(|c| c.uid() == n) {
-                    masks.children[i].as_group_mut()
-                } else {
-                    masks.children.get_mut(n.saturating_sub(1) as usize).and_then(|c| c.as_group_mut())
-                }
-            }
-            Value::String(name) => masks.children.iter_mut().find(|c| c.name() == name).and_then(|c| c.as_group_mut()),
-            _ => None,
-        }
-        .ok_or_else(|| bad("layer.setMask", "no such mask"))?;
-        if let GroupKind::Mask { mode: m, inverted: inv, .. } = &mut g.kind {
-            if let Some(mm) = mode {
-                *m = mm;
-            }
-            if let Some(i) = inverted {
-                *inv = i;
-            }
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-fn add_shape_item(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.addShapeItem")?;
-    let kind = str_p(p, "kind").ok_or_else(|| bad("layer.addShapeItem", "missing `kind`"))?.to_string();
-    // `group`: a uid or a property path (`contents/group`).
-    let group_uid = match p.get("group") {
-        Some(Value::String(path)) => Some(
-            s.project
-                .comp(cid)
-                .and_then(|c| c.layer(lid))
-                .and_then(|l| l.props.group(path))
-                .map(|g| g.uid)
-                .ok_or_else(|| bad("layer.addShapeItem", format!("no group `{path}`")))?,
-        ),
-        v => v.and_then(Value::as_u64),
-    };
-    let uid = s.edit("Add Shape Item", None, |proj, _| {
-        let mut next = proj.next_id;
-        let mut ids = Ids(&mut next);
-        // Front / Bevel / Side / Back ▸ property: into the group's surface item (one per group).
-        if let Some((surface, prop)) = build::shape_surface_kind(&kind) {
-            let target = shape_item_target(proj, cid, lid, group_uid)?;
-            let item = match target.children.iter().position(|c| matches!(c, Node::Group(g) if g.match_id == surface)) {
-                Some(i) => i,
-                None => {
-                    let g = build::shape_surface(&mut ids, surface).ok_or_else(|| bad("layer.addShapeItem", format!("unknown kind `{kind}`")))?;
-                    target.children.push(g.into());
-                    target.children.len() - 1
-                }
-            };
-            let Some(Node::Group(g)) = target.children.get_mut(item) else { return Err(bad("layer.addShapeItem", "no such group")) };
-            if g.get(prop).is_none() {
-                let p = build::shape_surface_prop(&mut ids, prop).ok_or_else(|| bad("layer.addShapeItem", format!("unknown kind `{kind}`")))?;
-                g.children.push(p.into());
-            }
-            let uid = g.uid;
-            proj.next_id = next;
-            return Ok(uid);
-        }
-        let g = match kind.as_str() {
-            "group" => build::shape_group(&mut ids, "Group 1", vec![]),
-            "rect" | "rectangle" => build::shape_rect(&mut ids, [200.0, 200.0], [0.0, 0.0], 0.0),
-            "ellipse" => build::shape_ellipse(&mut ids, [200.0, 200.0], [0.0, 0.0]),
-            "star" => build::shape_star(&mut ids, true, 5.0, [0.0, 0.0], 100.0, 50.0),
-            "polygon" => build::shape_star(&mut ids, false, 5.0, [0.0, 0.0], 100.0, 0.0),
-            "fill" => build::shape_fill(&mut ids, [1.0, 0.0, 0.0, 1.0]),
-            "stroke" => build::shape_stroke(&mut ids, [1.0, 1.0, 1.0, 1.0], 2.0),
-            "path" => build::shape_path(&mut ids, Default::default()),
-            "gfill" | "gradientFill" => build::shape_gradient_fill(&mut ids, false, [-100.0, 0.0], [100.0, 0.0], Default::default()),
-            "gstroke" | "gradientStroke" => build::shape_gradient_stroke(&mut ids, false, [-100.0, 0.0], [100.0, 0.0], Default::default(), 2.0),
-            "trim" | "trimPaths" => build::shape_trim(&mut ids, 0.0, 100.0, 0.0),
-            "repeater" => build::shape_repeater(&mut ids, 3.0, [100.0, 0.0]),
-            k => build::shape_simple_op(&mut ids, k).ok_or_else(|| bad("layer.addShapeItem", format!("unknown kind `{k}`")))?,
-        };
-        let uid = g.uid;
-        proj.next_id = next;
-        shape_item_target(proj, cid, lid, group_uid)?.children.push(g.into());
-        Ok(uid)
-    })?;
-    // The new item's property path, ready for prop.set / add_keyframe (`contents/trim#2/end`).
-    let path = s.project.comp(cid).and_then(|c| c.layer(lid)).and_then(|l| l.props.match_path_of(uid));
-    Ok(json!({"uid": uid, "path": path}))
-}
-
-/// The contents a new shape item goes into: the shape group `group_uid` (its Contents), else the
-/// layer's Contents.
-fn shape_item_target(proj: &mut Project, cid: ItemId, lid: LayerId, group_uid: Option<u64>) -> Result<&mut PropGroup> {
-    let l = layer_mut(proj, cid, lid)?;
-    let contents = l.props.sub_mut("contents").ok_or_else(|| bad("layer.addShapeItem", "not a shape layer"))?;
-    Ok(match group_uid {
-        Some(u) => contents
-            .find_group_mut(u)
-            .and_then(|g| if g.match_id == "contents" { Some(g) } else { g.sub_mut("contents") })
-            .ok_or_else(|| bad("layer.addShapeItem", "no such group"))?,
-        None => contents,
-    })
-}
-
-fn set_text(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.setText")?;
-    // The Character panel's recent fonts (Settings ▸ Type ▸ Number of Recent Fonts to Display).
-    if let Some(f) = str_p(p, "font") {
-        s.prefs.push_recent_font(f);
-        s.save_prefs();
-    }
-    let t = s.time();
-    let range = text_range_p(p);
-    // Character attributes with only a caret (no selected text) set the insertion style.
-    if let Some(r) = range.clone().filter(|r| r.is_empty() && str_p(p, "text").is_none())
-        && s.state.text_edit.as_ref().is_some_and(|e| e.layer == lid)
-        && let Some(doc) = super::text_edit::layer_doc(s, lid)
-        && doc.char_len() > 0
-        && let Some(obj) = p.as_object()
-        && let Some(e) = s.state.text_edit.as_mut()
-    {
-        let mut st = e.pending.clone().unwrap_or_else(|| doc.insertion_style(r.start));
-        let mut any = false;
-        for (k, v) in obj {
-            any |= effectcraft_keyframe::text_doc::apply_char_attr(&mut st, k, v).map_err(|m| bad("layer.setText", m))?;
-        }
-        if any {
-            e.pending = Some(st);
-        }
-        s.bump();
-    }
-    s.edit("Edit Text", merge_p(p), |proj, _| {
-        let l = layer_mut(proj, cid, lid)?;
-        let lt = l.layer_time(t);
-        let pr = l.props.prop_mut("text/sourceText").ok_or_else(|| bad("layer.setText", "not a text layer"))?;
-        let mut doc = match pr.value_at(lt) {
-            KV::Text(d) => *d,
-            KV::Str(t) => TextDoc::plain(&t),
-            _ => TextDoc::default(),
-        };
-        apply_text_params("layer.setText", p, &mut doc, range.clone())?;
-        pr.set_value_at(lt, KV::Text(Box::new(doc.clone())));
-        if let Some(first) = doc.text.lines().next()
-            && str_p(p, "text").is_some()
-            && !first.is_empty()
-            && (l.name.starts_with("Text") || l.name.is_empty())
-        {
-            l.name = first.chars().take(40).collect();
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// Move Position by `(dx, dy)`, including every key. Separated dimensions move X and Y as well
-/// as the combined property the channels were split from.
-pub(crate) fn offset_position(tr: &mut PropGroup, dx: f64, dy: f64) {
-    if dx == 0.0 && dy == 0.0 {
-        return;
-    }
-    if tr.get("positionX").is_some() {
-        for (name, d) in [("positionX", dx), ("positionY", dy)] {
-            if let Some(pr) = tr.get_mut(name) {
-                pr.value = KV::Scalar(pr.value.as_f64() + d);
-                for k in &mut pr.keys {
-                    k.value = KV::Scalar(k.value.as_f64() + d);
-                }
-            }
-        }
-    }
-    if let Some(pr) = tr.get_mut("position") {
-        let shift = |v: &KV| match v {
-            KV::Vec2(a) => KV::Vec2([a[0] + dx, a[1] + dy]),
-            other => {
-                let a = other.as_vec3();
-                KV::Vec3([a[0] + dx, a[1] + dy, a[2]])
-            }
-        };
-        pr.value = shift(&pr.value);
-        for k in &mut pr.keys {
-            k.value = shift(&k.value);
-        }
-    }
-}
-
-/// Set a layer's Position at layer time `lt` to `f(current)`: X/Y/Z Position when its dimensions
-/// are separated.
-pub(crate) fn update_position(tr: &mut PropGroup, lt: Tick, f: impl Fn([f64; 3]) -> [f64; 3]) {
-    const SEPARATE: [&str; 3] = ["positionX", "positionY", "positionZ"];
-    if tr.get("positionX").is_some() {
-        let v = f(SEPARATE.map(|m| tr.get(m).map(|p| p.value_at(lt).as_f64()).unwrap_or(0.0)));
-        for (m, x) in SEPARATE.iter().zip(v) {
-            if let Some(pr) = tr.get_mut(m) {
-                pr.set_value_at(lt, KV::Scalar(x));
-            }
-        }
-    } else if let Some(pr) = tr.get_mut("position") {
-        let v = f(pr.value_at(lt).as_vec3());
-        pr.set_value_at(lt, KV::Vec3(v));
-    }
-}
-
-/// A Transform property's default (Reset) by match id: the anchor at the centre of the source
-/// (`w`×`h`), the position at the comp's (`cw`×`ch`), 100% scale and opacity, no rotation.
-pub(crate) fn transform_default(m: &str, (w, h): (f64, f64), (cw, ch): (f64, f64)) -> Option<KV> {
-    Some(match m {
-        "anchor" => KV::Vec3([w / 2.0, h / 2.0, 0.0]),
-        "position" => KV::Vec3([cw / 2.0, ch / 2.0, 0.0]),
-        "positionX" => KV::Scalar(cw / 2.0),
-        "positionY" => KV::Scalar(ch / 2.0),
-        "positionZ" | "rotation" | "rotationX" | "rotationY" => KV::Scalar(0.0),
-        "scale" => KV::Vec3([100.0; 3]),
-        "orientation" => KV::Vec3([0.0; 3]),
-        "opacity" => KV::Scalar(100.0),
-        _ => return None,
-    })
-}
-
-fn transform_op(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, ids) = layers_p(s, p)?;
-    let ids = unlocked(s, cid, ids, "layer.transform")?;
-    let op = str_p(p, "op").unwrap_or("reset").to_string();
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?.clone();
-    let t = s.time();
-    let sizes: Vec<(LayerId, (u32, u32))> =
-        comp.layers.iter().filter(|l| ids.contains(&l.id)).map(|l| (l.id, effectcraft_render::source_size(&s.project, l))).collect();
-    s.edit("Transform", None, |proj, _| {
-        for (lid, (w, h)) in &sizes {
-            let l = layer_mut(proj, cid, *lid)?;
-            let lt = l.layer_time(t);
-            let (cw, ch) = (comp.width as f64, comp.height as f64);
-            let (w, h) = (*w as f64, *h as f64);
-            let Some(tr) = l.transform_mut() else { continue };
-            let set = |tr: &mut PropGroup, m: &str, v: KV| {
-                if let Some(pr) = tr.get_mut(m) {
-                    pr.set_value_at(lt, v);
-                }
-            };
-            match op.as_str() {
-                "reset" => {
-                    for m in ["anchor", "scale", "rotation", "rotationX", "rotationY", "orientation", "opacity"] {
-                        if let Some(v) = transform_default(m, (w, h), (cw, ch)) {
-                            set(tr, m, v);
-                        }
-                    }
-                    update_position(tr, lt, |_| [cw / 2.0, ch / 2.0, 0.0]);
-                }
-                // Centred in the frame; a 3D layer keeps its depth.
-                "center" => update_position(tr, lt, |p| [cw / 2.0, ch / 2.0, p[2]]),
-                "fit" | "fitWidth" | "fitHeight" if w > 0.0 && h > 0.0 => {
-                    let (sx, sy) = match op.as_str() {
-                        "fitWidth" => (cw / w, cw / w),
-                        "fitHeight" => (ch / h, ch / h),
-                        _ => (cw / w, ch / h),
-                    };
-                    let z = |m: &str, d: f64| tr.get(m).map(|p| p.value_at(lt).as_vec3()[2]).unwrap_or(d);
-                    let (sz, az) = (z("scale", 100.0), z("anchor", 0.0));
-                    set(tr, "scale", KV::Vec3([sx * 100.0, sy * 100.0, sz]));
-                    update_position(tr, lt, |p| [cw / 2.0, ch / 2.0, p[2]]);
-                    set(tr, "anchor", KV::Vec3([w / 2.0, h / 2.0, az]));
-                }
-                "flipH" | "flipV" => {
-                    let cur = tr.get("scale").map(|p| p.value_at(lt).as_vec3()).unwrap_or([100.0; 3]);
-                    let v = if op == "flipH" { [-cur[0], cur[1], cur[2]] } else { [cur[0], -cur[1], cur[2]] };
-                    set(tr, "scale", KV::Vec3(v));
-                }
-                _ => {}
-            }
-        }
-        Ok(())
-    })?;
-    Ok(Value::Null)
-}
-
-/// Layer ▸ Layer Settings: cameras and lights open their own settings; solids (and adjustment
-/// layers, which are solids) edit their Solid Settings. With `affectAll: false`, a solid other
-/// layers also use is copied into a new solid for this layer instead of being changed for all of
-/// them (After Effects' "Affect all layers that use this solid"). `name` renames the layer and
-/// its solid.
-fn layer_settings(s: &mut Session, p: &Value) -> Result<Value> {
-    let (cid, lid) = layer_p(s, p, "layer.settings")?;
-    // Cameras and lights open their own settings (Camera Settings / Light Settings).
-    match s.project.comp(cid).and_then(|c| c.layer(lid)).map(|l| l.source.clone()) {
-        Some(LayerSource::Camera) => return s.execute("layer.cameraSettings", with_layer(p, lid)),
-        Some(LayerSource::Light { .. }) => return s.execute("layer.lightSettings", with_layer(p, lid)),
-        _ => {}
-    }
-    let color = color_p(p, "color");
-    let w = p.get("width").and_then(Value::as_u64).map(limits::size);
-    let h = p.get("height").and_then(Value::as_u64).map(limits::size);
-    let pixel_aspect = pixel_aspect_p(p)?;
-    let name = str_p(p, "name").map(str::trim).filter(|n| !n.is_empty()).map(str::to_string);
-    let affect_all = p.get("affectAll").and_then(Value::as_bool).unwrap_or(true);
-    let solid = s.edit("Layer Settings", None, |proj, _| {
-        let src = layer_mut(proj, cid, lid)?.source.clone();
-        if let Some(n) = &name {
-            layer_mut(proj, cid, lid)?.name = n.clone();
-        }
-        let LayerSource::Solid { item } = src else { return Ok(None) };
-        let shared = proj.comps().flat_map(|(_, c)| &c.layers).filter(|l| l.source == src).count() > 1;
-        let target = if shared && !affect_all {
-            // This layer gets its own copy of the solid.
-            let it = proj.item(item).ok_or_else(|| bad("layer.settings", "the layer's solid is missing"))?.clone();
-            let copy = proj.add_item(name.as_deref().unwrap_or(&it.name), it.label, it.parent, it.kind);
-            layer_mut(proj, cid, lid)?.source = LayerSource::Solid { item: copy };
-            copy
-        } else {
-            item
-        };
-        let it = proj.item_mut(target).ok_or_else(|| bad("layer.settings", "the layer's solid is missing"))?;
-        if let Some(n) = &name {
-            it.name = n.clone();
-        }
-        if let ItemKind::Solid(so) = &mut it.kind {
-            so.color = color.unwrap_or(so.color);
-            so.width = w.unwrap_or(so.width);
-            so.height = h.unwrap_or(so.height);
-            so.pixel_aspect = pixel_aspect.unwrap_or(so.pixel_aspect);
-        }
-        Ok(Some(target))
-    })?;
-    Ok(match solid {
-        Some(item) => json!({"layer": lid.0, "solid": item.0}),
-        None => json!({"layer": lid.0}),
-    })
-}
-
-/// Layer Settings applies to solids (and adjustment layers), nulls, cameras and lights.
-fn has_layer_settings(s: &Session) -> std::result::Result<(), String> {
-    has_layers(s)?;
-    let l = s.active_comp().zip(s.state.selected_layers.first()).and_then(|(c, l)| c.layer(*l)).ok_or("select a layer first")?;
-    match l.source {
-        LayerSource::Solid { .. } | LayerSource::Null | LayerSource::Camera | LayerSource::Light { .. } => Ok(()),
-        _ => Err("this kind of layer has no settings".into()),
-    }
-}
-
-fn with_layer(p: &Value, lid: LayerId) -> Value {
-    let mut p = if p.is_object() { p.clone() } else { json!({}) };
-    p["layer"] = json!(lid.0);
-    p
-}
-
-pub fn specs() -> Vec<CommandSpec> {
-    vec![
-        cmd!(
-            "layer.newText",
-            "Text",
-            ["Layer", "New"],
-            Some("Cmd+Alt+Shift+T"),
-            "{text?, name? (layer name; default the text), position? [x,y], box? [x,y,w,h] (paragraph text, comp space), vertical?, edit? (start editing), font?, style?, size?, fill?, stroke?, applyFill?, applyStroke?, strokeWidth?, tracking?, leading?, baselineShift?, hScale?, vScale?, tsume?, fauxBold?, fauxItalic?, allCaps?, smallCaps?, baseline?, superscript?, subscript?, kerning?, ligatures?, justify?, indentLeft?, indentRight?, indentFirst?, spaceBefore?, spaceAfter?, direction?, composer?, hangingPunctuation?, strokeOverFill?} (attributes as layer.setText)",
-            has_comp,
-            new_text
-        ),
-        cmd!("layer.newSolid", "Solid...", ["Layer", "New"], Some("Cmd+Y"), "{name?, color? #hex|[r,g,b], width?, height?, pixelAspect?}", has_comp, new_solid),
-        cmd!("layer.newNull", "Null Object", ["Layer", "New"], Some("Cmd+Alt+Shift+Y"), "{name?}", has_comp, new_null),
-        cmd!(
-            "layer.newShape",
-            "Shape Layer",
-            ["Layer", "New"],
-            None,
-            "{kind?: rect|rounded|ellipse|star|polygon|none, name?, size?, fill?, fillType?, fillBlend?, fillOpacity?, stroke?, strokeType?, strokeBlend?, strokeOpacity?, strokeWidth?, position?}",
-            has_comp,
-            new_shape
-        ),
-        cmd!("layer.newAdjustment", "Adjustment Layer", ["Layer", "New"], Some("Cmd+Alt+Y"), "{name?}", has_comp, new_adjustment),
-        cmd!(
-            "layer.settings",
-            "Layer Settings...",
-            ["Layer"],
-            Some("Cmd+Shift+Y"),
-            "{layer?, name?, color?, width?, height?, pixelAspect?, affectAll?: bool (default true; false gives this layer its own copy of a solid other layers use)} → {layer, solid?}",
-            has_layer_settings,
-            layer_settings
-        ),
-        cmd!(
-            "layer.addItem",
-            "Add Footage to Comp",
-            ["File"],
-            Some("Cmd+/"),
-            "{item: id|name, time? (s, the In point), index? (1-based stack position; default above the selected layer), position? ([x, y] comp px; default the centre), duration? (s, for a still)}",
-            has_comp,
-            add_item
-        ),
-        cmd!("layer.select", "Select Layers", [], None, "{layers: [id|name|#n], add?, toggle?}", has_comp, select),
-        cmd!("layer.selectNext", "Select Next Layer", [], Some("Cmd+ArrowDown"), "{add?}", has_comp, select_next),
-        cmd!("layer.selectPrevious", "Select Previous Layer", [], Some("Cmd+ArrowUp"), "{add?}", has_comp, select_prev),
-        cmd!("layer.extendSelectionNext", "Extend Selection to Next Layer", [], Some("Cmd+Shift+ArrowDown"), "{}", has_comp, |s, _| select_step(
-            s,
-            &json!({"add": true}),
-            1
-        )),
-        cmd!("layer.extendSelectionPrevious", "Extend Selection to Previous Layer", [], Some("Cmd+Shift+ArrowUp"), "{}", has_comp, |s, _| select_step(
-            s,
-            &json!({"add": true}),
-            -1
-        )),
-        cmd!(
-            "layer.setSwitch",
-            "Layer Switch",
-            [],
-            None,
-            "{layers?, switch: video|audio|solo|lock|shy|collapse|quality|fx|frameBlend|motionBlur|adjustment|threeD|guide|preserveTransparency, value?, merge?, others? (the named layers alone: the other layers get the opposite state, or come back)}",
-            has_layers,
-            set_switch
-        ),
-        cmd!("layer.rename", "Rename", [], Some("Enter"), "{layer?, name}", has_layers, rename),
-        cmd!("layer.setComment", "Layer Comment", [], None, "{layers?, comment}", has_layers, set_comment),
-        cmd!("layer.setBlendMode", "Blending Mode", [], None, "{layers?, mode?: Normal|Multiply|Screen|…, step?: ±1}", has_layers, blend),
-        cmd!(
-            "layer.setTrackMatte",
-            "Track Matte",
-            [],
-            None,
-            "{layer?, matte: layer|null, kind?: alpha|alphaInverted|luma|lumaInverted}",
-            has_layers,
-            track_matte
-        ),
-        cmd!("layer.setParent", "Parent", [], None, "{layers?, parent: layer|null, compensate?: bool}", has_layers, set_parent),
-        cmd!(
-            "layer.timing",
-            "Layer Timing",
-            [],
-            None,
-            "{layers?, op?: moveInToTime|moveOutToTime|moveInToStart|moveOutToEnd|trimInToTime|trimOutToTime, delta?, start?, in?, out?, inDelta?, outDelta? (seconds, per layer), merge?}",
-            has_layers,
-            timing
-        ),
-        cmd!("layer.moveInToStart", "Move Layer In Point to Beginning of Comp", [], Some("Alt+Home"), "{layers?}", has_layers, |s, p| timing(
-            s,
-            &with(p, "op", json!("moveInToStart"))
-        )),
-        cmd!("layer.moveOutToEnd", "Move Layer Out Point to End of Comp", [], Some("Alt+End"), "{layers?}", has_layers, |s, p| timing(
-            s,
-            &with(p, "op", json!("moveOutToEnd"))
-        )),
-        cmd!("layer.moveEarlier", "Move Layers 1 Frame Earlier", [], Some("Alt+PageUp"), "{layers?}", has_layers, |s, p| move_frames(s, p, -1)),
-        cmd!("layer.moveLater", "Move Layers 1 Frame Later", [], Some("Alt+PageDown"), "{layers?}", has_layers, |s, p| move_frames(s, p, 1)),
-        cmd!("layer.moveEarlier10", "Move Layers 10 Frames Earlier", [], Some("Alt+Shift+PageUp"), "{layers?}", has_layers, |s, p| move_frames(s, p, -10)),
-        cmd!("layer.moveLater10", "Move Layers 10 Frames Later", [], Some("Alt+Shift+PageDown"), "{layers?}", has_layers, |s, p| move_frames(s, p, 10)),
-        cmd!("layer.slip", "Slip Edit", [], None, "{layers?, delta? (seconds) | frames?, merge?}", has_layers, slip),
-        cmd!("layer.slipBack", "Slip Edit 1 Frame Earlier", [], None, "{layers?}", has_layers, |s, p| {
-            let mut p = p.clone();
-            p["frames"] = json!(-1);
-            slip(s, &p)
-        }),
-        cmd!("layer.slipForward", "Slip Edit 1 Frame Later", [], None, "{layers?}", has_layers, |s, p| {
-            let mut p = p.clone();
-            p["frames"] = json!(1);
-            slip(s, &p)
-        }),
-        cmd!("layer.arrange", "Arrange", ["Layer", "Arrange"], None, "{layers?, to: front|forward|backward|back, index?, above?: layer}", has_layers, arrange),
-        cmd!(
-            "layer.precompose",
-            "Pre-compose...",
-            ["Layer"],
-            Some("Cmd+Shift+C"),
-            "{layers?, name?, mode?: move|leave, adjustDuration?, open?}",
-            has_layers,
-            precompose
-        ),
-        cmd!(
-            "layer.addMask",
-            "New Mask",
-            ["Layer", "Mask"],
-            Some("Cmd+Shift+N"),
-            "{layer?, shape?: rect|ellipse|rounded|polygon|star, rect? [x,y,w,h] (layer space; a polygon or star fits its width), mode?}",
-            has_layers,
-            add_mask
-        ),
-        cmd!("layer.setMask", "Mask Mode", [], None, "{layer?, mask: index|uid|name, mode?, inverted?}", has_layers, mask_props),
-        cmd!(
-            "layer.addShapeItem",
-            "Add (Shape)",
-            [],
-            None,
-            "{layer?, kind: group|rect|ellipse|star|polygon|path|fill|stroke|gfill|gstroke|trim|repeater|round|offset|pucker|twist|zigzag|wiggle|merge|frontColor|bevelColor|sideColor|backColor, group?: uid|path} → {uid, path} (frontColor…backColor: the group's Front / Bevel / Side / Back item, which colours that surface of every extruded paint in the group in Advanced 3D)",
-            has_layers,
-            add_shape_item
-        ),
-        cmd!(
-            "layer.setText",
-            "Edit Text",
-            [],
-            None,
-            "{layer?, range?: [start, end] (characters; default all), text?, font?, style?, size?, fill?, stroke?, applyFill?, applyStroke?, strokeWidth?, tracking?, leading?: px|\"auto\", baselineShift? px, hScale? %, vScale? %, tsume? %, fauxBold?, fauxItalic?, allCaps?, smallCaps?, baseline?: normal|superscript|subscript, superscript?, subscript?, kerning?: metrics|optical|number, ligatures?, discretionaryLigatures? (OpenType), contextualAlternates?, stylisticAlternates?, stylisticSets?: [1–20], ss01?, ss02?, ss03?, ss04?, ss05?, ss06?, ss07?, ss08?, ss09?, ss10?, ss11?, ss12?, ss13?, ss14?, ss15?, ss16?, ss17?, ss18?, ss19?, ss20?, swash?, titling?, ordinals?, fractions?, allSmallCaps?, figureStyle?: default|lining|oldStyle, figureWidth?: default|proportional|tabular, figures?, variations?: {tag: value} (variable font axes; null resets), justify?: left|center|right|justifyLeft|justifyCenter|justifyRight|justifyAll, indentLeft?, indentRight?, indentFirst?, spaceBefore?, spaceAfter?, direction?: ltr|rtl, composer?: everyLine|singleLine, hangingPunctuation?, strokeOverFill?, box?: [x,y,w,h]|null (layer space), vertical?}",
-            has_layers,
-            set_text
-        ),
-        cmd!(
-            "layer.transform",
-            "Transform",
-            ["Layer", "Transform"],
-            None,
-            "{layers?, op: reset|center|fit|fitWidth|fitHeight|flipH|flipV}",
-            has_layers,
-            transform_op
-        ),
-    ]
-}
-
-#[allow(dead_code)]
-fn unused(_: &Comp) {}
-
-#[cfg(test)]
-mod parent_chain_tests {
-    use super::*;
-    use std::sync::Arc;
-
-    fn fixture() -> (Session, u64, u64, u64) {
-        let mut s = Session::default();
-        s.execute("comp.new", json!({"name":"Parent safety","width":16,"height":16,"duration":1})).unwrap();
-        let a = s.execute("layer.newSolid", json!({"name":"A"})).unwrap()["layer"].as_u64().unwrap();
-        let b = s.execute("layer.newSolid", json!({"name":"B"})).unwrap()["layer"].as_u64().unwrap();
-        let c = s.execute("layer.newSolid", json!({"name":"C"})).unwrap()["layer"].as_u64().unwrap();
-        for id in [a, b, c] {
-            s.execute("prop.set", json!({"layer":id,"path":"transform/anchor","value":[0,0,0]})).unwrap();
-        }
-        s.execute("prop.set", json!({"layer":a,"path":"transform/position","value":[100,200,0]})).unwrap();
-        s.execute("prop.set", json!({"layer":c,"path":"transform/position","value":[10,20,0]})).unwrap();
-        s.history.undo.clear();
-        (s, a, b, c)
-    }
-    fn malformed_parent(s: &mut Session, child: u64, parent: u64) {
-        let cid = s.active_comp_id().unwrap();
-        Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(LayerId(child)).unwrap().parent = Some(LayerId(parent));
-    }
-    fn assert_atomic_error(s: &mut Session, child: u64, parent: u64, compensate: bool, message: &str) {
-        let before = s.project.clone();
-        let revision = s.revision;
-        let undo = s.history.undo.len();
-        let err = s.execute("layer.setParent", json!({"layers":[child],"parent":parent,"compensate":compensate})).unwrap_err();
-        assert!(err.to_string().contains(message), "{err}");
-        assert!(Arc::ptr_eq(&before, &s.project));
-        assert_eq!(s.revision, revision);
-        assert_eq!(s.history.undo.len(), undo);
-    }
-    #[test]
-    fn loaded_cycle_excluding_selected_child_is_rejected_atomically() {
-        for compensate in [true, false] {
-            let (mut s, a, b, c) = fixture();
-            // Simulate a malformed loaded project. Never execute this on the unguarded baseline.
-            malformed_parent(&mut s, a, b);
-            malformed_parent(&mut s, b, a);
-            assert_atomic_error(&mut s, c, a, compensate, "existing cycle");
-        }
-    }
-    #[test]
-    fn dangling_loaded_parent_is_rejected_atomically() {
-        for compensate in [true, false] {
-            let (mut s, a, _, c) = fixture();
-            malformed_parent(&mut s, a, u64::MAX);
-            assert_atomic_error(&mut s, c, a, compensate, "missing layer");
-        }
-    }
-    #[test]
-    fn selected_descendant_and_direct_self_are_rejected() {
-        let (mut s, a, _, c) = fixture();
-        assert_atomic_error(&mut s, c, c, false, "create a cycle");
-        s.execute("layer.setParent", json!({"layers":[a],"parent":c,"compensate":false})).unwrap();
-        assert_atomic_error(&mut s, c, a, true, "create a cycle");
-    }
-    #[test]
-    fn ordinary_parent_and_unparent_keep_explicit_false_and_undo_semantics() {
-        for compensate in [true, false] {
-            let (mut s, a, _, c) = fixture();
-            let old = s.project.clone();
-            let world = |s: &Session| {
-                let cid = s.active_comp_id().unwrap();
-                let comp = s.active_comp().unwrap();
-                let ctx = effectcraft_render::EvalCtx::new(&s.project, cid, comp, s.time());
-                ctx.world_matrix(comp.layer(LayerId(c)).unwrap()).apply(effectcraft_geom::Vec3::ZERO)
-            };
-            let before = world(&s);
-            s.execute("layer.setParent", json!({"layers":[c],"parent":a,"compensate":compensate})).unwrap();
-            let expected = if compensate { before } else { before + effectcraft_geom::vec3(100.0, 200.0, 0.0) };
-            assert!((world(&s) - expected).length() < 1e-9);
-            assert_eq!(s.active_comp().unwrap().layer(LayerId(c)).unwrap().parent, Some(LayerId(a)));
-            assert_eq!(s.history.undo.len(), 1);
-            let parented = s.project.clone();
-            assert!(s.undo());
-            assert!(Arc::ptr_eq(&s.project, &old));
-            assert!(s.redo());
-            assert!(Arc::ptr_eq(&s.project, &parented));
-            s.execute("layer.setParent", json!({"layers":[c],"parent":null,"compensate":compensate})).unwrap();
-            assert_eq!(s.active_comp().unwrap().layer(LayerId(c)).unwrap().parent, None);
-            assert!(s.undo());
-            assert!(Arc::ptr_eq(&s.project, &parented));
-        }
-    }
-    #[test]
-    fn ancestor_and_lookup_work_budgets_fail_closed() {
-        let (mut s, a, b, c) = fixture();
-        malformed_parent(&mut s, a, b);
-        let comp = s.active_comp().unwrap();
-        // New solids are inserted above the selection: C,B,A. Walking A->B scans
-        // three then two layers, and compares the one selected child twice: seven work units.
-        assert_eq!(comp.layers.iter().map(|l| l.id).collect::<Vec<_>>(), vec![LayerId(c), LayerId(b), LayerId(a)]);
-        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 7).is_ok());
-        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 6).unwrap_err().to_string().contains("work limit"));
-        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 256).is_ok());
-        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 1, 256).unwrap_err().to_string().contains("visit limit"));
-        assert!(check_parent_chain(comp, &[LayerId(c)], Some(LayerId(a)), 2, 1).unwrap_err().to_string().contains("work limit"));
-        assert!(check_parent_chain(comp, &[LayerId(c)], None, 0, 0).is_ok(), "unparenting does not traverse ancestors");
-    }
-
-    #[test]
-    fn well_formed_chain_beyond_renderer_depth_is_not_unnecessarily_rejected() {
-        let (s, _, _, c) = fixture();
-        let mut comp = s.active_comp().unwrap().clone();
-        let template = comp.layers.first().unwrap().clone();
-        for n in 0..80 {
-            let mut layer = template.clone();
-            layer.id = LayerId(10_000 + n);
-            layer.parent = (n < 79).then_some(LayerId(10_001 + n));
-            comp.layers.push(layer);
-        }
-        assert!(check_parent_chain(&comp, &[LayerId(c)], Some(LayerId(10_000)), 4096, 1_048_576).is_ok());
-    }
-}
diff --git a/crates/engine/src/commands/mod.rs b/crates/engine/src/commands/mod.rs
deleted file mode 100644
index 23388594b..000000000
--- a/crates/engine/src/commands/mod.rs
+++ /dev/null
@@ -1,613 +0,0 @@
-//! The command registry. Ids follow After Effects' menu structure; every menu item, panel button,
-//! shortcut and viewer/timeline gesture maps to one of these.
-
-mod align;
-mod align_data;
-mod anim;
-mod anim_presets;
-pub mod anim_tools;
-mod animation;
-pub(crate) mod app_more;
-mod autotrace;
-mod batch;
-mod camera_cmds;
-mod comp;
-pub(crate) mod comp_more;
-pub mod content_fill;
-mod create;
-mod edit;
-mod effect;
-pub mod essential;
-pub mod expr_tools;
-mod file;
-pub(crate) mod file_more;
-mod focus;
-pub mod footage_panel;
-pub(crate) mod frame_export;
-mod frontend;
-mod help;
-mod import_project;
-mod key_labels;
-mod key_transform;
-mod keys_more;
-mod layer;
-mod layer_menu;
-mod layer_time;
-pub(crate) mod link;
-mod liquify;
-mod lottie;
-pub mod markers;
-mod mask;
-pub mod mask_interp;
-pub(crate) mod model3d;
-mod nav_more;
-pub mod paint;
-pub mod panels_cmds;
-pub(crate) mod path_nulls;
-mod paths;
-mod project_items;
-pub(crate) mod prop;
-mod prop_groups;
-mod proxy;
-pub mod puppet;
-mod query;
-mod quick_offset;
-mod relink;
-pub(crate) mod relink_moved;
-mod render_queue;
-pub(crate) mod rig3d;
-pub mod roto_cmds;
-mod scene_detect;
-pub mod scripts;
-mod settings;
-pub mod shape_stroke;
-pub mod shape_tool;
-mod stubs;
-mod styles;
-mod text_anim;
-pub mod text_edit;
-mod three_d;
-pub mod time;
-mod timeline;
-mod track;
-mod view;
-pub mod viewer_cmds;
-pub(crate) mod vpe;
-pub(crate) mod vr_editor;
-mod warp_cmds;
-pub(crate) mod watch_folder;
-#[cfg(test)]
-pub(crate) use app_more::report_text as report_text_for_tests;
-pub(crate) use app_more::view_command;
-#[cfg(test)]
-pub(crate) use file::open as open_for_tests;
-#[cfg(test)]
-pub(crate) use keys_more::amplitudes as amplitudes_for_tests;
-#[cfg(test)]
-pub(crate) use mask::split_segment as split_segment_for_tests;
-
-use std::sync::OnceLock;
-
-use effectcraft_project::{Comp, ItemId, Layer, LayerId};
-use effectcraft_time::Tick;
-use serde_json::Value;
-
-use crate::{EngineError, Result, Session};
-
-pub type Run = fn(&mut Session, &Value) -> Result<Value>;
-pub type Enabled = fn(&Session) -> std::result::Result<(), String>;
-
-/// Metadata + implementation for one command.
-pub struct CommandSpec {
-    pub id: &'static str,
-    pub label: &'static str,
-    /// Menu placement, e.g. `["Layer", "New"]`. Empty = not in menus.
-    pub menu: &'static [&'static str],
-    /// Default shortcut (egui-style names, `Cmd` = ⌘ on macOS / Ctrl elsewhere).
-    pub shortcut: Option<&'static str>,
-    /// Further default shortcuts (the menus and tooltips show `shortcut`).
-    pub alt_shortcuts: &'static [&'static str],
-    /// Parameter description for agents and the MCP schema.
-    pub params: &'static str,
-    pub enabled: Enabled,
-    pub run: Run,
-    /// Record in the journal (false for pure queries).
-    pub journal: bool,
-}
-
-#[macro_export]
-macro_rules! cmd {
-    // Several default shortcuts: `["PageDown", "Cmd+ArrowRight"]`.
-    ($id:literal, $label:literal, [$($m:literal),*], [$sc:literal, $($alt:literal),+], $params:literal, $en:expr, $run:expr) => {
-        $crate::commands::CommandSpec { alt_shortcuts: &[$($alt),+], ..$crate::cmd!($id, $label, [$($m),*], Some($sc), $params, $en, $run) }
-    };
-    ($id:literal, $label:literal, [$($m:literal),*], $sc:expr, $params:literal, $en:expr, $run:expr) => {
-        $crate::commands::CommandSpec {
-            id: $id,
-            label: $label,
-            menu: &[$($m),*],
-            shortcut: $sc,
-            alt_shortcuts: &[],
-            params: $params,
-            enabled: $en,
-            run: $run,
-            journal: true,
-        }
-    };
-}
-#[macro_export]
-macro_rules! query {
-    ($id:literal, $label:literal, $params:literal, $run:expr) => {
-        $crate::commands::CommandSpec {
-            id: $id,
-            label: $label,
-            menu: &[],
-            shortcut: None,
-            alt_shortcuts: &[],
-            params: $params,
-            enabled: $crate::commands::always,
-            run: $run,
-            journal: false,
-        }
-    };
-}
-
-pub fn command_specs() -> &'static [CommandSpec] {
-    static SPECS: OnceLock<Vec<CommandSpec>> = OnceLock::new();
-    SPECS.get_or_init(|| {
-        let mut v = Vec::new();
-        v.extend(file::specs());
-        v.extend(crate::models::specs());
-        v.extend(edit::specs());
-        v.extend(comp::specs());
-        v.extend(layer::specs());
-        v.extend(styles::specs());
-        v.extend(three_d::specs());
-        v.extend(model3d::specs());
-        v.extend(rig3d::specs());
-        v.extend(text_anim::specs());
-        v.extend(text_edit::specs());
-        v.extend(layer_time::specs());
-        v.extend(prop::specs());
-        v.extend(prop_groups::specs());
-        v.extend(project_items::specs());
-        v.extend(anim::specs());
-        v.extend(anim_tools::specs());
-        v.extend(link::specs());
-        v.extend(markers::specs());
-        v.extend(mask::specs());
-        v.extend(paths::specs());
-        v.extend(effect::specs());
-        v.extend(time::specs());
-        v.extend(nav_more::specs());
-        v.extend(render_queue::specs());
-        v.extend(help::specs());
-        v.extend(query::specs());
-        v.extend(batch::specs());
-        v.extend(layer_menu::specs());
-        v.extend(create::specs());
-        v.extend(animation::specs());
-        v.extend(anim_presets::specs());
-        v.extend(view::specs());
-        v.extend(viewer_cmds::specs());
-        v.extend(shape_stroke::specs());
-        v.extend(shape_tool::specs());
-        v.extend(focus::specs());
-        v.extend(key_labels::specs());
-        v.extend(key_transform::specs());
-        v.extend(quick_offset::specs());
-        v.extend(file_more::specs());
-        v.extend(relink::specs());
-        v.extend(relink_moved::specs());
-        v.extend(lottie::specs());
-        v.extend(import_project::specs());
-        v.extend(timeline::specs());
-        v.extend(comp_more::specs());
-        v.extend(frame_export::specs());
-        v.extend(watch_folder::specs());
-        v.extend(vpe::specs());
-        v.extend(path_nulls::specs());
-        v.extend(vr_editor::specs());
-        v.extend(frontend::specs());
-        v.extend(track::specs());
-        v.extend(mask_interp::specs());
-        v.extend(warp_cmds::specs());
-        v.extend(camera_cmds::specs());
-        v.extend(roto_cmds::specs());
-        v.extend(paint::specs());
-        v.extend(puppet::specs());
-        v.extend(liquify::specs());
-        v.extend(settings::specs());
-        v.extend(app_more::specs());
-        v.extend(keys_more::specs());
-        v.extend(essential::specs());
-        v.extend(expr_tools::specs());
-        v.extend(proxy::specs());
-        v.extend(scripts::specs());
-        v.extend(panels_cmds::specs());
-        v.extend(footage_panel::specs());
-        v.extend(autotrace::specs());
-        v.extend(scene_detect::specs());
-        v.extend(align_data::specs());
-        v.extend(align::specs());
-        v.extend(content_fill::specs());
-        v.extend(stubs::specs());
-        v.extend(crate::storage::specs());
-        v.extend(crate::learn::specs());
-        v.extend(crate::templates::specs());
-        v.extend(crate::preview::specs());
-        v
-    })
-}
-
-/// Set `footage` as the proxy of `item` (File ▸ Create Proxy's post-render action).
-pub(crate) fn proxy_set(s: &mut Session, item: ItemId, footage: effectcraft_project::Footage) -> Result<()> {
-    proxy::set_proxy_footage(s, &[item], footage)
-}
-
-/// (id, name) of the text animation presets.
-pub fn text_preset_list() -> Vec<(String, String)> {
-    text_anim::preset_names()
-}
-
-/// (id, name, category) of the built-in animation presets (Transitions…).
-pub fn builtin_preset_list() -> Vec<(String, String, String)> {
-    anim_presets::preset_names()
-}
-
-pub fn find(id: &str) -> Option<&'static CommandSpec> {
-    // Every command execution looks its spec up: index the ~2,000 ids once.
-    static INDEX: OnceLock<std::collections::HashMap<&'static str, usize>> = OnceLock::new();
-    let index = INDEX.get_or_init(|| {
-        let mut m = std::collections::HashMap::new();
-        for (i, c) in command_specs().iter().enumerate() {
-            m.entry(c.id).or_insert(i);
-        }
-        m
-    });
-    index.get(id).map(|&i| &command_specs()[i])
-}
-
-// ---------- parameter validation (agents) ----------
-
-/// Top-level keys accepted by a params doc such as `{layers: [id|name|#n], add?, toggle?}` or
-/// `{time? (s) | frame? | timecode?}`; `None` when the doc isn't a `{…}` key list.
-pub fn accepted_params(doc: &str) -> Option<Vec<String>> {
-    let body = doc.trim().strip_prefix('{')?;
-    // Top-level pieces up to the matching close brace, split at `,` and `|`; `:` starts a value.
-    let (mut keys, mut cur, mut depth, mut in_value) = (Vec::new(), String::new(), 0i32, false);
-    let push = |cur: &mut String, keys: &mut Vec<String>| {
-        let k: String = cur.trim().chars().take_while(|c| c.is_ascii_alphanumeric() || *c == '_').collect();
-        if !k.is_empty() && !keys.contains(&k) {
-            keys.push(k);
-        }
-        cur.clear();
-    };
-    for c in body.chars() {
-        match c {
-            '{' | '[' | '(' => depth += 1,
-            ']' | ')' => depth -= 1,
-            '}' if depth == 0 => {
-                push(&mut cur, &mut keys);
-                return Some(keys);
-            }
-            '}' => depth -= 1,
-            ',' if depth == 0 => {
-                push(&mut cur, &mut keys);
-                in_value = false;
-            }
-            '|' if depth == 0 && !in_value => push(&mut cur, &mut keys),
-            ':' if depth == 0 => {
-                push(&mut cur, &mut keys);
-                in_value = true;
-            }
-            _ if depth == 0 && !in_value => cur.push(c),
-            _ => {}
-        }
-    }
-    None
-}
-
-/// Top-level pieces of a params doc (split at depth-0 commas), e.g. `{layer?, path|prop, value}`
-/// → `["layer?", "path|prop", "value"]`.
-fn doc_pieces(doc: &str) -> Option<Vec<String>> {
-    let body = doc.trim().strip_prefix('{')?;
-    let (mut out, mut cur, mut depth) = (Vec::new(), String::new(), 0i32);
-    for c in body.chars() {
-        match c {
-            '{' | '[' | '(' => depth += 1,
-            ']' | ')' => depth -= 1,
-            '}' if depth == 0 => {
-                if !cur.trim().is_empty() {
-                    out.push(cur.trim().to_string());
-                }
-                return Some(out);
-            }
-            '}' => depth -= 1,
-            ',' if depth == 0 => {
-                if !cur.trim().is_empty() {
-                    out.push(cur.trim().to_string());
-                }
-                cur.clear();
-                continue;
-            }
-            _ => {}
-        }
-        cur.push(c);
-    }
-    None
-}
-
-/// The JSON Schema of a command's parameters, derived from its params doc: one property per
-/// accepted key (described by its piece of the doc), no others. MCP `describe_command` and
-/// `list_commands {schemas: true}` serve it.
-pub fn params_schema(spec: &CommandSpec) -> Value {
-    let mut props = serde_json::Map::new();
-    let mut required = vec![];
-    for piece in doc_pieces(spec.params).unwrap_or_default() {
-        let keys = accepted_params(&format!("{{{piece}}}")).unwrap_or_default();
-        let alternatives = keys.len() > 1;
-        for k in keys {
-            // `key?` is optional; so is any key with alternatives (`path|prop`).
-            let optional = alternatives || piece.contains(&format!("{k}?"));
-            if !optional && !required.contains(&k) {
-                required.push(k.clone());
-            }
-            props.insert(k, serde_json::json!({"description": piece}));
-        }
-    }
-    serde_json::json!({
-        "type": "object",
-        "description": spec.params,
-        "properties": props,
-        "required": required,
-        "additionalProperties": accepted_params(spec.params).is_none(),
-    })
-}
-
-/// Keys every command understands (comp targeting, gesture merging) and accepted aliases.
-const ALWAYS_OK: &[&str] = &["comp", "merge"];
-const ALIASES: &[(&str, &str)] = &[("layers", "layer"), ("layer", "layers"), ("time", "frame"), ("frameRate", "fps"), ("properties", "property")];
-
-/// Reject unknown top-level parameters (typos, guessed names) with the list of accepted keys.
-pub fn check_params(spec: &CommandSpec, params: &Value) -> Result<()> {
-    let (Some(obj), Some(accepted)) = (params.as_object(), accepted_params(spec.params)) else { return Ok(()) };
-    let ok = |k: &str| ALWAYS_OK.contains(&k) || accepted.iter().any(|a| a == k || ALIASES.iter().any(|(doc, alias)| doc == a && *alias == k));
-    let unknown: Vec<&str> = obj.keys().map(String::as_str).filter(|k| !ok(k)).collect();
-    if unknown.is_empty() {
-        return Ok(());
-    }
-    let list = if accepted.is_empty() { "none".to_string() } else { accepted.join(", ") };
-    Err(bad(
-        spec.id,
-        format!("unknown parameter(s) {}; accepted: {list} (doc: {})", unknown.iter().map(|k| format!("`{k}`")).collect::<Vec<_>>().join(", "), spec.params),
-    ))
-}
-
-// ---------- enablement ----------
-
-pub fn always(_: &Session) -> std::result::Result<(), String> {
-    Ok(())
-}
-pub(crate) fn has_comp(s: &Session) -> std::result::Result<(), String> {
-    s.active_comp().map(|_| ()).ok_or_else(|| "no composition is open".into())
-}
-pub(crate) fn has_layers(s: &Session) -> std::result::Result<(), String> {
-    has_comp(s)?;
-    if s.state.selected_layers.is_empty() { Err("select a layer first".into()) } else { Ok(()) }
-}
-pub(crate) fn has_keys(s: &Session) -> std::result::Result<(), String> {
-    has_comp(s)?;
-    if s.state.selected_keys.is_empty() { Err("select keyframes first".into()) } else { Ok(()) }
-}
-
-pub(crate) fn has_project_selection(s: &Session) -> std::result::Result<(), String> {
-    if s.state.project_selection.is_empty() { Err("select an item in the Project panel first".into()) } else { Ok(()) }
-}
-
-/// Disabled-command enablement (menu entries whose implementation lands with another milestone;
-/// none are left, kept for future stubs).
-#[allow(dead_code)]
-pub(crate) fn not_yet(_: &Session) -> std::result::Result<(), String> {
-    Err("not available yet in EffectCraft".into())
-}
-
-/// `run` of a not-yet-available command.
-#[allow(dead_code)]
-pub(crate) fn not_yet_run(_: &mut Session, _: &Value) -> Result<Value> {
-    Err(EngineError::Other("not available yet in EffectCraft".into()))
-}
-
-/// Hand a frontend-only command to the UI ([`crate::Event::Frontend`]).
-pub(crate) fn frontend(s: &mut Session, id: &str, p: &Value) -> Result<Value> {
-    s.events.push(crate::Event::Frontend { command: id.to_string(), params: p.clone() });
-    Ok(serde_json::json!({"frontend": id}))
-}
-
-/// Match path of a node (`transform/position`, `effects/#2/blurriness` style with `match#n`
-/// occurrences) so it can be found again on another layer.
-pub fn match_path_of(g: &effectcraft_project::PropGroup, uid: effectcraft_project::Uid) -> Option<String> {
-    for c in &g.children {
-        let nth = g.children.iter().take_while(|x| !std::ptr::eq(*x, c)).filter(|x| x.match_id() == c.match_id()).count() + 1;
-        let seg = if nth == 1 { c.match_id().to_string() } else { format!("{}#{nth}", c.match_id()) };
-        if c.uid() == uid {
-            return Some(seg);
-        }
-        if let effectcraft_project::Node::Group(sub) = c
-            && let Some(rest) = match_path_of(sub, uid)
-        {
-            return Some(format!("{seg}/{rest}"));
-        }
-    }
-    None
-}
-
-/// Turn `effects/<match name>[#n]/<property>` (as [`match_path_of`] writes it) into a uid path on
-/// `l`. Path parsing splits on `.`, which would cut a match name like `ec.control.slider` apart.
-/// Any other path, or an effect that is not on the layer, comes back unchanged.
-pub(crate) fn resolve_effect_path(l: &Layer, path: &str) -> String {
-    let Some((seg, tail)) = path.strip_prefix("effects/").and_then(|r| r.split_once('/')) else { return path.to_string() };
-    let (match_id, nth) = match seg.rsplit_once('#') {
-        Some((m, n)) if !m.is_empty() => match n.parse::<usize>() {
-            Ok(n) if n >= 1 => (m, n),
-            _ => (seg, 1),
-        },
-        _ => (seg, 1),
-    };
-    match l.effects().and_then(|fx| fx.groups().filter(|g| g.match_id == match_id).nth(nth - 1)) {
-        Some(g) => format!("effects/@{}/{tail}", g.uid),
-        None => path.to_string(),
-    }
-}
-
-/// Selected properties (leaves) of the active comp as (layer, uid); selected groups expand to
-/// their properties.
-pub(crate) fn selected_leaf_props(s: &Session) -> Vec<(LayerId, effectcraft_project::Uid)> {
-    let Some(comp) = s.active_comp() else { return vec![] };
-    let mut out = vec![];
-    for (lid, uid) in &s.state.selected_props {
-        let Some(l) = comp.layer(*lid) else { continue };
-        if l.props.find(*uid).is_some() {
-            out.push((*lid, *uid));
-        } else if let Some(g) = l.props.find_group(*uid) {
-            g.walk("", &mut |_, p| out.push((*lid, p.uid)));
-        }
-    }
-    out
-}
-
-// ---------- params ----------
-
-pub(crate) fn bad(cmd: &str, msg: impl Into<String>) -> EngineError {
-    EngineError::BadParams { cmd: cmd.into(), msg: msg.into() }
-}
-pub(crate) fn str_p<'a>(p: &'a Value, k: &str) -> Option<&'a str> {
-    p.get(k).and_then(Value::as_str)
-}
-pub(crate) fn f_p(p: &Value, k: &str) -> Option<f64> {
-    p.get(k).and_then(Value::as_f64)
-}
-pub(crate) fn b_p(p: &Value, k: &str) -> Option<bool> {
-    p.get(k).and_then(Value::as_bool)
-}
-pub(crate) fn merge_p(p: &Value) -> Option<&str> {
-    str_p(p, "merge")
-}
-
-/// `comp`: item id or name (an all-digit string that names no comp is taken as an id, as MCP
-/// clients often send numbers as strings); default the active comp.
-pub(crate) fn comp_id(s: &Session, p: &Value) -> Result<ItemId> {
-    let missing = |v: &Value| EngineError::NoSuchComp(v.to_string());
-    match p.get("comp") {
-        Some(v @ Value::Number(n)) => n.as_u64().map(ItemId).filter(|id| s.project.comp(*id).is_some()).ok_or_else(|| missing(v)),
-        Some(v @ Value::String(name)) => s
-            .project
-            .items
-            .values()
-            .find(|i| &i.name == name && i.as_comp().is_some())
-            .map(|i| i.id)
-            .or_else(|| digits_id(name).map(ItemId).filter(|id| s.project.comp(*id).is_some()))
-            .ok_or_else(|| missing(v)),
-        _ => s.active_comp_id().ok_or(EngineError::NoComp),
-    }
-}
-
-/// An all-ASCII-digit string as a number (`"98"` -> 98); anything else (names, `#n`, signs) is `None`.
-fn digits_id(s: &str) -> Option<u64> {
-    if s.is_empty() || !s.bytes().all(|b| b.is_ascii_digit()) {
-        return None;
-    }
-    s.parse().ok()
-}
-
-/// Resolve a layer reference: id (number), `#n` / index (1-based), or name. An all-digit string
-/// that names no layer is resolved as the number it spells.
-pub(crate) fn resolve_layer(comp: &Comp, v: &Value) -> Option<LayerId> {
-    match v {
-        Value::Number(n) => {
-            let id = n.as_u64()?;
-            if comp.layer(LayerId(id)).is_some() { Some(LayerId(id)) } else { comp.layers.get((id as usize).checked_sub(1)?).map(|l| l.id) }
-        }
-        Value::String(s) => {
-            if let Some(i) = s.strip_prefix('#').and_then(|i| i.parse::<usize>().ok()) {
-                return comp.layers.get(i.checked_sub(1)?).map(|l| l.id);
-            }
-            comp.layers.iter().find(|l| &l.name == s).map(|l| l.id).or_else(|| digits_id(s).and_then(|id| resolve_layer(comp, &Value::from(id))))
-        }
-        _ => None,
-    }
-}
-
-/// `layer` param or the first selected layer.
-pub(crate) fn layer_p(s: &Session, p: &Value, cmd: &str) -> Result<(ItemId, LayerId)> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    if let Some(v) = p.get("layer") {
-        return resolve_layer(comp, v).map(|l| (cid, l)).ok_or_else(|| bad(cmd, format!("no layer {v}")));
-    }
-    s.state
-        .selected_layers
-        .first()
-        .copied()
-        .filter(|l| comp.layer(*l).is_some())
-        .map(|l| (cid, l))
-        .ok_or_else(|| bad(cmd, "no `layer` given and no layer selected"))
-}
-
-/// `layers` param (array) or the selection.
-pub(crate) fn layers_p(s: &Session, p: &Value) -> Result<(ItemId, Vec<LayerId>)> {
-    let cid = comp_id(s, p)?;
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    // Explicit references that match no layer are an error (agents otherwise get a silent no-op).
-    let resolve =
-        |v: &Value| resolve_layer(comp, v).ok_or_else(|| EngineError::Other(format!("no layer {v} (use a layer id, \"#n\" or a name from comp.info)")));
-    if let Some(Value::Array(a)) = p.get("layers") {
-        return Ok((cid, a.iter().map(resolve).collect::<Result<_>>()?));
-    }
-    if let Some(v) = p.get("layer").filter(|v| !v.is_null()) {
-        return Ok((cid, vec![resolve(v)?]));
-    }
-    Ok((cid, s.state.selected_layers.iter().copied().filter(|l| comp.layer(*l).is_some()).collect()))
-}
-
-/// Whether a layer can be picked by the user (Select All, Ctrl+Up/Down, a Timeline click): not
-/// locked, and not hidden by the composition's Hide Shy Layers.
-pub(crate) fn selectable(comp: &Comp, l: &Layer) -> bool {
-    !(l.switches.locked || (comp.hide_shy && l.switches.shy))
-}
-
-/// The layers of `ids` a command may edit: locked layers are left alone, as in After Effects.
-/// An error when every one of them is locked.
-pub(crate) fn unlocked(s: &Session, cid: ItemId, ids: Vec<LayerId>, cmd: &str) -> Result<Vec<LayerId>> {
-    let comp = s.project.comp(cid).ok_or(EngineError::NoComp)?;
-    let locked = |id: &LayerId| comp.layer(*id).is_some_and(|l| l.switches.locked);
-    match ids.iter().find(|id| locked(id)) {
-        Some(first) if ids.iter().all(locked) => {
-            let name = comp.layer(*first).map(|l| l.name.clone()).unwrap_or_default();
-            Err(bad(cmd, format!("“{name}” is locked (Layer ▸ Switches ▸ Unlock All Layers)")))
-        }
-        _ => Ok(ids.into_iter().filter(|id| !locked(id)).collect()),
-    }
-}
-
-/// `visible: [{layer, prop}]`: the properties the Timeline shows (J / K and Select All
-/// Keyframes use only those, as in After Effects). `None` when not given.
-pub(crate) fn visible_p(p: &Value) -> Option<Vec<(LayerId, effectcraft_project::Uid)>> {
-    let a = p.get("visible")?.as_array()?;
-    Some(a.iter().filter_map(|v| Some((LayerId(v.get("layer")?.as_u64()?), v.get("prop")?.as_u64()?))).collect())
-}
-
-/// `time` (seconds) or `frame` param, else the CTI.
-pub(crate) fn time_p(s: &Session, p: &Value, comp: Option<&Comp>) -> Tick {
-    if let Some(t) = f_p(p, "time") {
-        return Tick::from_seconds_f64(t);
-    }
-    if let (Some(f), Some(c)) = (p.get("frame").and_then(Value::as_i64), comp) {
-        return c.frame_rate.tick_of(f);
-    }
-    s.time()
-}
-
-pub(crate) fn layer_mut(p: &mut effectcraft_project::Project, cid: ItemId, lid: LayerId) -> Result<&mut Layer> {
-    p.comp_mut(cid).ok_or(EngineError::NoComp)?.layer_mut(lid).ok_or(EngineError::Project(effectcraft_project::ProjectError::NoLayer(lid)))
-}
diff --git a/crates/engine/src/commands/scripts.rs b/crates/engine/src/commands/scripts.rs
deleted file mode 100644
index 24049459c..000000000
--- a/crates/engine/src/commands/scripts.rs
+++ /dev/null
@@ -1,605 +0,0 @@
-//! File ▸ Scripts and ScriptUI.
-//!
-//! * **Installed scripts** live in the settings store under `Scripts/` (File ▸ Scripts ▸ Install
-//!   Script File…) and `Scripts/ScriptUI Panels/` (Install ScriptUI Panel…), next to the
-//!   settings on the desktop, so dropping `.jsx` files in those folders works too. File ▸ Scripts
-//!   lists them with the bundled sample scripts and extensions ([`BUNDLED`]) and runs them by name; ScriptUI
-//!   panels appear at the bottom of the Window menu and open as dockable panels
-//!   (`window.scriptPanel`), running with `this` = the panel as in After Effects.
-//! * **ScriptUI windows** (`scriptui.*`): list the open script windows, read their control
-//!   trees, click buttons and set values like a user, close them (see [`crate::scriptui`]).
-//! * **Script settings** (`script.settings.*`): After Effects' `app.settings`, string values by
-//!   section and key that last between runs ([`SCRIPT_SETTINGS_FILE`]).
-
-use std::collections::BTreeMap;
-
-use serde::Serialize;
-use serde_json::{Value, json};
-
-use super::{CommandSpec, always, bad, str_p};
-use crate::{EngineError, Event, Result, Session, cmd, scriptui};
-
-/// The settings-store folders of installed scripts.
-pub const SCRIPTS_DIR: &str = "Scripts";
-pub const PANELS_DIR: &str = "Scripts/ScriptUI Panels";
-/// The ScriptUI panels open when EffectCraft last quit (settings store), reopened at launch.
-pub const OPEN_PANELS_FILE: &str = "scriptui_panels.json";
-/// Scripts' `app.settings` in the settings store: `{section: {key: value}}`, as After Effects
-/// keeps them in its preferences.
-pub const SCRIPT_SETTINGS_FILE: &str = "script_settings.json";
-/// User presets of the core Ease Presets panel of v0.6.0 (#254) and where the Ease Presets
-/// ScriptUI panel that replaced it keeps them: (file, section, key). The file's text moves there
-/// unchanged (the panel reads the same JSON) the first time settings load.
-const LEGACY_EASE_PRESETS: (&str, &str, &str) = ("ease_presets.json", "Ease Presets", "userPresets");
-/// Longest section, key and value a script may store (characters / bytes).
-const MAX_SETTING_NAME: usize = 256;
-const MAX_SETTING_VALUE: usize = 1 << 20;
-
-/// Scripts' `app.settings`: values by section and key.
-pub type ScriptSettings = BTreeMap<String, BTreeMap<String, String>>;
-
-/// Load scripts' settings from the settings store (a corrupt file gives none), moving user ease
-/// presets saved before Ease Presets became a ScriptUI panel into its section.
-pub(crate) fn load_script_settings(s: &mut Session) {
-    let Some(cfg) = s.config.clone() else { return };
-    s.script_settings = cfg
-        .read(SCRIPT_SETTINGS_FILE)
-        .and_then(|t| serde_json::from_str(&t).map_err(|e| log::warn!("{SCRIPT_SETTINGS_FILE} is not valid ({e}); scripts start without their settings")).ok())
-        .unwrap_or_default();
-    let (file, section, key) = LEGACY_EASE_PRESETS;
-    if let Some(text) = cfg.read(file)
-        && !s.script_settings.get(section).is_some_and(|m| m.contains_key(key))
-    {
-        s.script_settings.entry(section.into()).or_default().insert(key.into(), text);
-        if let Err(e) = store_script_settings(s) {
-            log::warn!("cannot move {file} into the Ease Presets panel's settings: {e}");
-        }
-    }
-}
-
-fn store_script_settings(s: &Session) -> Result<()> {
-    let Some(cfg) = &s.config else { return Ok(()) };
-    let text = serde_json::to_string_pretty(&s.script_settings).map_err(|e| EngineError::Other(format!("script settings: {e}")))?;
-    cfg.write(SCRIPT_SETTINGS_FILE, &text).map_err(|e| EngineError::Other(format!("cannot save script settings: {e}")))
-}
-
-fn setting_name<'a>(p: &'a Value, k: &str, c: &str) -> Result<&'a str> {
-    let v = str_p(p, k).ok_or_else(|| bad(c, format!("missing `{k}`")))?;
-    if v.chars().count() > MAX_SETTING_NAME {
-        return Err(bad(c, format!("`{k}` is longer than {MAX_SETTING_NAME} characters")));
-    }
-    Ok(v)
-}
-
-/// `script.settings.get {section, key}` → `{have, value}` (`value` "" when there is none).
-fn settings_get(s: &mut Session, p: &Value) -> Result<Value> {
-    const C: &str = "script.settings.get";
-    let (section, key) = (setting_name(p, "section", C)?, setting_name(p, "key", C)?);
-    let v = s.script_settings.get(section).and_then(|m| m.get(key));
-    Ok(json!({"have": v.is_some(), "value": v.cloned().unwrap_or_default()}))
-}
-
-/// `script.settings.save {section, key, value}`: kept in the settings store.
-fn settings_save(s: &mut Session, p: &Value) -> Result<Value> {
-    const C: &str = "script.settings.save";
-    let (section, key) = (setting_name(p, "section", C)?, setting_name(p, "key", C)?);
-    let value = match p.get("value") {
-        Some(Value::String(v)) => v.clone(),
-        Some(v) if !v.is_null() => v.to_string(),
-        _ => return Err(bad(C, "missing `value`")),
-    };
-    if value.len() > MAX_SETTING_VALUE {
-        return Err(bad(C, format!("`value` is larger than {MAX_SETTING_VALUE} bytes")));
-    }
-    s.script_settings.entry(section.into()).or_default().insert(key.into(), value);
-    store_script_settings(s)?;
-    Ok(Value::Null)
-}
-
-/// Scripts that ship with EffectCraft (original work): (file name, ScriptUI panel, source, code).
-/// `sample`s show how to script EffectCraft; `extension`s (in `extensions/`) are optional tools
-/// built on the public scripting API, outside the core, like third-party scripts in After Effects.
-pub const BUNDLED: &[(&str, bool, &str, &str)] = &[
-    ("Create Null at Selected Layers.jsx", false, "sample", include_str!("../../scripts/Create Null at Selected Layers.jsx")),
-    ("Rename Layers.jsx", false, "sample", include_str!("../../scripts/Rename Layers.jsx")),
-    ("Render Queue Batch.jsx", false, "sample", include_str!("../../scripts/Render Queue Batch.jsx")),
-    ("Sort Layers by In Point.jsx", false, "sample", include_str!("../../scripts/Sort Layers by In Point.jsx")),
-    ("Layer Tools.jsx", true, "sample", include_str!("../../scripts/ScriptUI Panels/Layer Tools.jsx")),
-    ("Ease Presets.jsx", true, "extension", include_str!("../../../../extensions/scriptui-panels/Ease Presets.jsx")),
-];
-
-/// A script File ▸ Scripts (or the Window menu, for panels) offers.
-#[derive(Clone, Debug, PartialEq, Serialize)]
-pub struct ScriptEntry {
-    /// File name (`Rename Layers.jsx`): what the menus show and commands take.
-    pub name: String,
-    /// In the ScriptUI Panels folder: opens as a dockable panel.
-    pub panel: bool,
-    /// `installed`, `sample` or `extension` (bundled, see [`BUNDLED`]).
-    pub source: &'static str,
-}
-
-fn is_script(name: &str) -> bool {
-    let l = name.to_ascii_lowercase();
-    l.ends_with(".jsx") || l.ends_with(".js")
-}
-
-/// Whether `name` can name an installed script: a bare file name, never a path (names are joined
-/// onto the Scripts folders of the settings store, which takes them as relative paths), and on
-/// Windows none of the names [`windows_unsafe_name`] lists.
-fn is_script_name(name: &str) -> bool {
-    is_bare_name(name) && !(cfg!(windows) && windows_unsafe_name(name))
-}
-
-/// One path component on every platform: not empty, `.` or `..`, and without `/`, `\` or NUL.
-pub(crate) fn is_bare_name(name: &str) -> bool {
-    !name.is_empty() && name != "." && name != ".." && !name.contains(['/', '\\', '\0'])
-}
-
-/// Names that are not ordinary file names on Windows (elsewhere they are): with `:` (a drive or a
-/// stream), ending in `.` or a space (Windows drops them), or a device name, which names a device
-/// in any folder and with any extension (`con.jsx`): `CON`, `PRN`, `AUX`, `NUL`, `CONIN$`,
-/// `CONOUT$`, `COM0`–`COM9` and `LPT0`–`LPT9` (also with `¹²³`).
-pub(crate) fn windows_unsafe_name(name: &str) -> bool {
-    let stem = name.split('.').next().unwrap_or_default().trim_end_matches(' ').to_ascii_uppercase();
-    let port = |p: &str| {
-        let mut n = stem.strip_prefix(p).unwrap_or_default().chars();
-        matches!((n.next(), n.next()), (Some('0'..='9' | '¹' | '²' | '³'), None))
-    };
-    let device = matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$") || port("COM") || port("LPT");
-    name.contains(':') || name.ends_with(['.', ' ']) || device
-}
-
-/// Installed scripts and panels, then the bundled ones not shadowed by an installed one, by name.
-pub fn scripts(s: &Session) -> Vec<ScriptEntry> {
-    let mut v: Vec<ScriptEntry> = vec![];
-    if let Some(cfg) = &s.config {
-        for (dir, panel) in [(SCRIPTS_DIR, false), (PANELS_DIR, true)] {
-            for n in cfg.list(dir).into_iter().filter(|n| is_script(n) && is_script_name(n)) {
-                v.push(ScriptEntry { name: n, panel, source: "installed" });
-            }
-        }
-    }
-    for (name, panel, source, _) in BUNDLED {
-        if !v.iter().any(|e| e.name == *name && e.panel == *panel) {
-            v.push(ScriptEntry { name: name.to_string(), panel: *panel, source });
-        }
-    }
-    v.sort_by(|a, b| a.panel.cmp(&b.panel).then(a.name.to_lowercase().cmp(&b.name.to_lowercase())));
-    v
-}
-
-/// The code of an installed or bundled script / panel.
-pub fn script_code(s: &Session, name: &str, panel: Option<bool>) -> Option<(bool, String)> {
-    if !is_script(name) || !is_script_name(name) {
-        return None;
-    }
-    if let Some(cfg) = &s.config {
-        for (dir, is_panel) in [(SCRIPTS_DIR, false), (PANELS_DIR, true)] {
-            if panel.is_some_and(|p| p != is_panel) {
-                continue;
-            }
-            if let Some(code) = cfg.read(&format!("{dir}/{name}")) {
-                return Some((is_panel, code));
-            }
-        }
-    }
-    BUNDLED.iter().find(|(n, p, ..)| *n == name && panel.is_none_or(|w| w == *p)).map(|(_, p, _, c)| (*p, c.to_string()))
-}
-
-fn install(s: &mut Session, p: &Value, panel: bool) -> Result<Value> {
-    let c = if panel { "file.installScriptUIPanel" } else { "file.installScript" };
-    let path = str_p(p, "path").ok_or_else(|| bad(c, "missing `path` (a .jsx / .js script)"))?;
-    let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
-    if !is_script(&name) {
-        return Err(bad(c, "scripts are .jsx or .js files (.jsxbin is not supported)"));
-    }
-    // A name it could not be run or uninstalled by (`\` is a file-name character on Unix).
-    if !is_script_name(&name) {
-        return Err(bad(c, format!("`{name}` is not a script file name")));
-    }
-    let bytes = s.services.read_file(path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
-    let code = String::from_utf8(bytes).map_err(|_| bad(c, "the script is not UTF-8 text"))?;
-    let cfg = s.config.clone().ok_or_else(|| EngineError::Other("this session has no settings folder to install scripts into".into()))?;
-    let dir = if panel { PANELS_DIR } else { SCRIPTS_DIR };
-    cfg.write(&format!("{dir}/{name}"), &code).map_err(|e| EngineError::Other(format!("cannot install {name}: {e}")))?;
-    // After Effects asks for a restart; our menus pick it up at once.
-    s.toast(if panel {
-        format!("Installed ScriptUI panel {name}: find it at the bottom of the Window menu")
-    } else {
-        format!("Installed script {name}: find it in File ▸ Scripts")
-    });
-    Ok(json!({"name": name, "panel": panel}))
-}
-
-fn list(s: &mut Session, _: &Value) -> Result<Value> {
-    Ok(json!(scripts(s)))
-}
-
-fn uninstall(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "file.uninstallScript";
-    let name = str_p(p, "name").ok_or_else(|| bad(c, "missing `name`"))?;
-    if !is_script(name) || !is_script_name(name) {
-        return Err(bad(c, format!("`{name}` is not a script file name")));
-    }
-    let cfg = s.config.clone().ok_or_else(|| bad(c, "no settings folder"))?;
-    let mut removed = false;
-    for dir in [SCRIPTS_DIR, PANELS_DIR] {
-        let key = format!("{dir}/{name}");
-        if cfg.read(&key).is_some() {
-            cfg.remove(&key).map_err(|e| EngineError::Other(e.to_string()))?;
-            removed = true;
-        }
-    }
-    if removed { Ok(json!({"removed": name})) } else { Err(bad(c, format!("`{name}` is not installed"))) }
-}
-
-/// Run an installed or bundled script by name (File ▸ Scripts ▸ <name>). A ScriptUI panel run
-/// this way gets `this` = a floating palette-like panel window.
-pub(crate) fn run_named(s: &mut Session, name: &str) -> Result<Value> {
-    let (panel, code) = script_code(s, name, None).ok_or_else(|| bad("file.runScript", format!("no installed or bundled script `{name}`")))?;
-    if panel {
-        return open_panel(s, &json!({"name": name}));
-    }
-    super::file_more::run_js_named(s, &code, name)
-}
-
-/// The code a ScriptUI panel runs with: `this` is a dockable Panel titled after the script.
-pub fn panel_wrapper(title: &str, code: &str) -> String {
-    // On one line, so line numbers in errors stay those of the file.
-    format!("(function () {{ {code}\n}}).call(__uiDockPanel({}));", Value::String(title.to_string()))
-}
-
-/// The ScriptUI panels open now (script names).
-pub(crate) fn open_panel_names(s: &Session) -> Vec<String> {
-    s.script_ui.windows.iter().filter(|w| w.kind == scriptui::WindowKind::Panel).map(|w| w.script.clone()).collect()
-}
-
-/// The panels open when EffectCraft last quit (`{"open": [names]}`); a missing or unreadable
-/// file is none.
-fn remembered_panels(s: &Session) -> Vec<String> {
-    let text = s.config.as_ref().and_then(|c| c.read(OPEN_PANELS_FILE)).unwrap_or_default();
-    let doc: Value = serde_json::from_str(&text).unwrap_or(Value::Null);
-    doc.get("open").and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_str).filter(|n| is_script(n)).map(str::to_string).collect()
-}
-
-/// Change the remembered panels with `f` (written only when it changed). The list is kept so
-/// the next launch reopens them, as After Effects reopens the panels of its workspace; quitting
-/// leaves it as it is.
-fn edit_remembered_panels(s: &Session, f: impl FnOnce(&mut Vec<String>)) {
-    let Some(cfg) = &s.config else { return };
-    let before = remembered_panels(s);
-    let mut list = before.clone();
-    f(&mut list);
-    if list != before
-        && let Err(e) = cfg.write(OPEN_PANELS_FILE, &json!({"open": list}).to_string())
-    {
-        log::warn!("cannot remember the open ScriptUI panels: {e}");
-    }
-}
-
-/// Forget the panels of `before` (open before a script window event) that are closed now.
-pub(crate) fn forget_closed_panels(s: &Session, before: &[String]) {
-    let now = open_panel_names(s);
-    let closed: Vec<&String> = before.iter().filter(|n| !now.contains(n)).collect();
-    if !closed.is_empty() {
-        edit_remembered_panels(s, |l| l.retain(|n| !closed.contains(&n)));
-    }
-}
-
-/// `window.restoreScriptPanels`: open the ScriptUI panels that were open when EffectCraft last
-/// quit (frontends call it once at launch). Panels whose script is gone or fails are reported
-/// and forgotten; the others still open.
-fn restore_panels(s: &mut Session, _: &Value) -> Result<Value> {
-    let (mut opened, mut failed) = (vec![], vec![]);
-    for name in remembered_panels(s) {
-        let r = match script_code(s, &name, Some(true)) {
-            Some(_) => open_panel(s, &json!({"name": name})).map_err(|e| e.to_string()),
-            None => Err("no such ScriptUI panel".to_string()),
-        };
-        match r {
-            Ok(_) => opened.push(name),
-            Err(error) => {
-                edit_remembered_panels(s, |l| l.retain(|n| *n != name));
-                failed.push(json!({"name": name, "error": error}));
-            }
-        }
-    }
-    Ok(json!({"opened": opened, "failed": failed}))
-}
-
-/// Window ▸ <ScriptUI panel>: run the panel script (or bring its panel forward).
-fn open_panel(s: &mut Session, p: &Value) -> Result<Value> {
-    let c = "window.scriptPanel";
-    let name = str_p(p, "name").ok_or_else(|| bad(c, "missing `name` (a script in the ScriptUI Panels folder)"))?.to_string();
-    let title = name.trim_end_matches(".jsx").trim_end_matches(".js").to_string();
-    if let Some(w) = s.script_ui.windows.iter().find(|w| w.kind == scriptui::WindowKind::Panel && w.script == name) {
-        let id = w.id;
-        s.events.push(Event::Frontend { command: c.into(), params: json!({"window": id}) });
-        return Ok(json!({"window": id, "open": true}));
-    }
-    let (_, code) = script_code(s, &name, Some(true)).or_else(|| script_code(s, &name, None)).ok_or_else(|| bad(c, format!("no ScriptUI panel `{name}`")))?;
-    let out = super::file_more::run_js_named(s, &panel_wrapper(&title, &code), &name)?;
-    let id = s.script_ui.windows.iter().rev().find(|w| w.kind == scriptui::WindowKind::Panel && w.script == name).map(|w| w.id);
-    if let Some(id) = id {
-        s.events.push(Event::Frontend { command: c.into(), params: json!({"window": id}) });
-    }
-    if id.is_some() {
-        edit_remembered_panels(s, |l| {
-            if !l.contains(&name) {
-                l.push(name.clone());
-            }
-        });
-    }
-    Ok(json!({"window": id, "result": out}))
-}
-
-pub fn specs() -> Vec<CommandSpec> {
-    vec![
-        cmd!(
-            "file.installScript",
-            "Install Script File...",
-            ["File", "Scripts"],
-            None,
-            "{path (.jsx / .js)} → copies it to the Scripts folder; it appears in File ▸ Scripts",
-            always,
-            |s, p| install(s, p, false)
-        ),
-        cmd!(
-            "file.installScriptUIPanel",
-            "Install ScriptUI Panel...",
-            ["File", "Scripts"],
-            None,
-            "{path (.jsx / .js)} → copies it to the ScriptUI Panels folder; it appears in the Window menu",
-            always,
-            |s, p| install(s, p, true)
-        ),
-        cmd!("file.uninstallScript", "Uninstall Script", [], None, "{name}", always, uninstall),
-        crate::query!("file.scripts.list", "List Scripts", "{} → [{name, panel, source: installed|sample|extension}]", list),
-        cmd!(
-            "window.scriptPanel",
-            "ScriptUI Panel",
-            [],
-            None,
-            "{name (a script in the ScriptUI Panels folder, e.g. `Layer Tools.jsx`)} → opens it as a dockable panel",
-            always,
-            open_panel
-        ),
-        cmd!(
-            "window.restoreScriptPanels",
-            "Restore ScriptUI Panels",
-            [],
-            None,
-            "{} → reopens the ScriptUI panels open when EffectCraft last quit (frontends call it at launch) → {opened: [name], failed: [{name, error}]}",
-            always,
-            restore_panels
-        ),
-        crate::query!("script.settings.get", "Get Script Setting", "{section, key} → {have, value} (app.settings.haveSetting / getSetting)", settings_get),
-        cmd!(
-            "script.settings.save",
-            "Save Script Setting",
-            [],
-            None,
-            "{section, key, value (text)} → kept in the settings store (app.settings.saveSetting)",
-            always,
-            settings_save
-        ),
-        cmd!(
-            "script.runTasks",
-            "Run Scheduled Script Tasks",
-            [],
-            None,
-            "{} → runs the app.scheduleTask tasks that are due (frontends do it every frame) → {ran, output, errors, next (ms until the next task, or null)}",
-            always,
-            scriptui::run_tasks
-        ),
-        crate::query!("scriptui.list", "List Script Windows", "{} → [{window, title, kind: dialog|palette|window|panel, script, modal, size}]", scriptui::list),
-        crate::query!(
-            "scriptui.get",
-            "Script Window Controls",
-            "{window?: id | title} → {id, title, kind, root: {id, type, name, text, value, checked, items, selection, bounds, enabled, draw (onDraw paint list), children…}}",
-            scriptui::get
-        ),
-        cmd!(
-            "scriptui.click",
-            "Click Script Window Control",
-            [],
-            None,
-            "{window?: id | title, widget: id | \"#id\" | properties.name | text} (buttons, checkboxes, radio buttons, tabs)",
-            always,
-            scriptui::click
-        ),
-        cmd!(
-            "scriptui.set",
-            "Set Script Window Control",
-            [],
-            None,
-            "{window?, widget, value: text | number | bool | item index | item text, changing?: bool (a live update: each keystroke / slider step; fires onChanging only)} (edit text, sliders, checkboxes, lists) → fires onChanging / onChange",
-            always,
-            scriptui::set
-        ),
-        cmd!(
-            "scriptui.mouse",
-            "Mouse Event on Script Window Control",
-            [],
-            None,
-            "{window?, widget, type: mousedown | mouseup | mousemove | mouseover | mouseout | click (default), x?, y? (relative to the control; default its centre), button? (0 left, 1 middle, 2 right), detail? (click count), screenX?, screenY?, altKey?, ctrlKey?, metaKey?, shiftKey?} → the script's addEventListener listeners on the control and its containers receive a MouseEvent",
-            always,
-            scriptui::mouse
-        ),
-        cmd!(
-            "scriptui.close",
-            "Close Script Window",
-            [],
-            None,
-            "{window?, result? (a dialog's show() returns it; default 2 = Cancel)}",
-            always,
-            scriptui::close
-        ),
-    ]
-}
-
-#[cfg(test)]
-mod tests {
-    use std::path::PathBuf;
-    use std::sync::Arc;
-
-    use serde_json::{Value, json};
-
-    use super::{BUNDLED, PANELS_DIR, SCRIPTS_DIR, is_bare_name, is_script, is_script_name, script_code, windows_unsafe_name};
-    use crate::config::DirConfig;
-    use crate::{EngineError, Result, ScriptRequest, Session};
-
-    /// Stands in for the JavaScript runtime: reports the code it was asked to run.
-    fn echo(_: &mut Session, r: &ScriptRequest) -> Value {
-        json!({"ran": r.code})
-    }
-
-    /// A session whose settings store is a fresh `<root>/settings/` (with both Scripts folders, as
-    /// after installing a script and a panel), next to a script `<root>/outside.jsx`.
-    fn session_in_tmp(name: &str) -> (Session, PathBuf) {
-        use std::sync::atomic::{AtomicU32, Ordering};
-        static N: AtomicU32 = AtomicU32::new(0);
-        let root = std::env::temp_dir().join(format!("ec-scripts-{}-{}-{name}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
-        let _ = std::fs::remove_dir_all(&root);
-        std::fs::create_dir_all(root.join("settings").join(PANELS_DIR)).unwrap();
-        std::fs::write(root.join("outside.jsx"), "outside").unwrap();
-        let s = Session { config: Some(Arc::new(DirConfig::new(root.join("settings")))), script: Some(echo), ..Default::default() };
-        (s, root)
-    }
-
-    fn bad_params(r: &Result<Value>) -> bool {
-        matches!(r, Err(EngineError::BadParams { .. }))
-    }
-
-    /// Paths, refused on every platform.
-    const PATHS: [&str; 10] = ["", ".", "..", "../x.jsx", "a/b.jsx", "/abs/x.jsx", "a\\b.jsx", "..\\x.jsx", "C:\\x.jsx", "a\0.jsx"];
-    /// Ordinary file names except on Windows.
-    const WINDOWS_ONLY: [&str; 8] = ["Step 1: Setup.jsx", "In:Out.jsx", "C:x.jsx", "x.jsx.", "x.jsx ", "Aux.Tools.jsx", "con.jsx", "COM1.jsx"];
-
-    #[test]
-    fn bare_names_are_one_path_component() {
-        for name in ["Rename Layers.jsx", "..jsx", "a..b.js", "Äpfel ✓.jsx"].into_iter().chain(WINDOWS_ONLY) {
-            assert!(is_bare_name(name), "{name:?}");
-        }
-        for name in PATHS {
-            assert!(!is_bare_name(name), "{name:?}");
-        }
-    }
-
-    #[test]
-    fn windows_unsafe_names_are_drives_streams_trailing_dots_and_devices() {
-        let devices = ["CON", "Con.tar.jsx", "CON .jsx", "PRN.js", "aux.jsx", "NUL.jsx", "CONIN$.jsx", "conout$.js"];
-        let ports = ["COM0.jsx", "com9.js", "LPT0.jsx", "lpt9.jsx", "COM¹.jsx", "LPT³.js"];
-        for name in WINDOWS_ONLY.into_iter().chain(devices).chain(ports) {
-            assert!(windows_unsafe_name(name), "{name:?}");
-        }
-        let fine = ["console.jsx", "Concert.jsx", "NULL.jsx", "CONIN.jsx", "COM10.jsx", "LPT.jsx", "x .jsx", "..jsx"];
-        for name in BUNDLED.iter().map(|b| b.0).chain(fine) {
-            assert!(!windows_unsafe_name(name), "{name:?}");
-        }
-    }
-
-    #[test]
-    fn script_names_are_bare_file_names() {
-        let more = ["..jsx", "a..b.js", "Äpfel ✓.jsx", "console.jsx", "Concert.jsx", "NULL.jsx", "COM10.jsx", "LPT.jsx"];
-        for name in BUNDLED.iter().map(|b| b.0).chain(more) {
-            assert!(is_script(name) && is_script_name(name), "{name}");
-        }
-        for name in PATHS {
-            assert!(!is_script_name(name), "{name:?}");
-        }
-        for name in WINDOWS_ONLY {
-            assert_eq!(is_script_name(name), !cfg!(windows), "{name:?}");
-        }
-        // Install refuses a file name the script could not then be run or uninstalled by.
-        #[cfg(unix)]
-        {
-            let (mut s, root) = session_in_tmp("odd-name");
-            let odd = root.join("a\\b.jsx");
-            std::fs::write(&odd, "x").unwrap();
-            assert!(bad_params(&s.execute("file.installScript", json!({"path": odd.to_string_lossy()}))));
-            assert!(!root.join("settings").join(SCRIPTS_DIR).join("a\\b.jsx").exists());
-            let _ = std::fs::remove_dir_all(&root);
-        }
-    }
-
-    #[test]
-    fn uninstall_takes_a_script_name_not_a_path() {
-        let (mut s, root) = session_in_tmp("uninstall");
-        let (outside, prefs) = (root.join("outside.jsx"), root.join("settings").join("prefs.json"));
-        std::fs::write(&prefs, "{}").unwrap();
-        // From `Scripts/`, `../../outside.jsx` is the script next to the settings folder and
-        // `../prefs.json` a settings file; an absolute path is not a script name either.
-        for name in ["../../outside.jsx".to_string(), "../prefs.json".into(), outside.to_string_lossy().into_owned()] {
-            let r = s.execute("file.uninstallScript", json!({"name": name}));
-            assert!(outside.is_file() && prefs.is_file(), "`{name}` deleted a file outside the Scripts folders: {r:?}");
-            assert!(bad_params(&r), "`{name}`: {r:?}");
-        }
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn scripts_run_by_name_come_from_the_scripts_folders() {
-        let (mut s, root) = session_in_tmp("run");
-        // `Scripts/../../outside.jsx` and `Scripts/ScriptUI Panels/../../../outside.jsx` are the
-        // script next to the settings folder.
-        let r = s.execute("file.runScript", json!({"name": "../../outside.jsx"}));
-        assert!(bad_params(&r), "{r:?}");
-        let r = s.execute("window.scriptPanel", json!({"name": "../../../outside.jsx"}));
-        assert!(bad_params(&r), "{r:?}");
-        assert_eq!(script_code(&s, "../../outside.jsx", None), None);
-        assert_eq!(script_code(&s, "../../../outside.jsx", Some(true)), None);
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn only_scripts_are_read_or_removed() {
-        // A settings file in the Scripts folder that is not a script (.jsx / .js).
-        let (mut s, root) = session_in_tmp("not-a-script");
-        let notes = root.join("settings").join(SCRIPTS_DIR).join("notes.txt");
-        std::fs::write(&notes, "notes").unwrap();
-        assert_eq!(script_code(&s, "notes.txt", None), None);
-        let r = s.execute("file.uninstallScript", json!({"name": "notes.txt"}));
-        assert!(notes.is_file() && bad_params(&r), "{r:?}");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    /// On Unix `\` is a file-name character: a script dropped into the folder under such a name is
-    /// not offered, as it could not be run or uninstalled. Names only Windows refuses stay.
-    #[cfg(unix)]
-    #[test]
-    fn listing_skips_names_run_and_uninstall_refuse() {
-        let (mut s, root) = session_in_tmp("odd-names");
-        let scripts = root.join("settings").join(SCRIPTS_DIR);
-        std::fs::write(scripts.join("a\\b.jsx"), "x").unwrap();
-        std::fs::write(scripts.join("In:Out.jsx"), "in-out").unwrap();
-        let list = s.execute("file.scripts.list", json!({})).unwrap();
-        let listed = |n: &str| list.as_array().unwrap().iter().any(|e| e["name"] == n);
-        assert!(!listed("a\\b.jsx") && listed("In:Out.jsx"), "{list}");
-        assert_eq!(script_code(&s, "a\\b.jsx", None), None);
-        assert_eq!(script_code(&s, "In:Out.jsx", None), Some((false, "in-out".to_string())));
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
-    #[test]
-    fn install_run_and_uninstall_by_name() {
-        let (mut s, root) = session_in_tmp("install");
-        let file = root.join("Hello.jsx");
-        std::fs::write(&file, "hello").unwrap();
-        s.execute("file.installScript", json!({"path": file.to_string_lossy()})).unwrap();
-        s.execute("file.installScriptUIPanel", json!({"path": file.to_string_lossy()})).unwrap();
-        let installed = [root.join("settings").join(SCRIPTS_DIR).join("Hello.jsx"), root.join("settings").join(PANELS_DIR).join("Hello.jsx")];
-        assert!(installed.iter().all(|p| p.is_file()));
-        assert_eq!(s.execute("file.runScript", json!({"name": "Hello.jsx"})).unwrap()["ran"], "hello");
-        let r = s.execute("window.scriptPanel", json!({"name": "Hello.jsx"})).unwrap();
-        assert!(r["result"]["ran"].as_str().is_some_and(|c| c.contains("hello")), "{r}");
-        // The bundled samples still run by name.
-        let sample = BUNDLED.iter().find(|b| b.0 == "Rename Layers.jsx").unwrap().3;
-        assert_eq!(s.execute("file.runScript", json!({"name": "Rename Layers.jsx"})).unwrap()["ran"], sample);
-        s.execute("file.uninstallScript", json!({"name": "Hello.jsx"})).unwrap();
-        assert!(installed.iter().all(|p| !p.exists()));
-        assert!(bad_params(&s.execute("file.uninstallScript", json!({"name": "Hello.jsx"}))), "no longer installed");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-}
diff --git a/crates/engine/src/doc_state.rs b/crates/engine/src/doc_state.rs
new file mode 100644
index 000000000..7b4889dba
--- /dev/null
+++ b/crates/engine/src/doc_state.rs
@@ -0,0 +1,204 @@
+use super::{Deserialize, ItemId, Layer, LayerId, Serialize, Tick, Uid, commands, mask_track, media_browser, roto, viewer};
+
+/// A keyframe reference: layer, property uid, key time (layer time).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct KeyRef {
+    pub layer: LayerId,
+    pub prop: Uid,
+    pub time: Tick,
+}
+
+/// A keyframe drag in progress (`keys.move` steps sharing a merge key): the selection it
+/// started from and the total offset so far, so every step is applied to the keys as they were
+/// before the drag. A key passed over on the way is never overwritten; only the drop position
+/// counts, as in After Effects.
+#[derive(Clone, Debug)]
+pub struct KeyMove {
+    pub merge: String,
+    pub from: Vec<KeyRef>,
+    pub total: Tick,
+}
+
+/// Keyframes of one property on the keyframe clipboard.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct KeyClip {
+    pub layer: LayerId,
+    /// Match-id path relative to the layer (`transform/position`), portable between layers.
+    pub path: String,
+    /// Keys with times relative to the earliest copied key (layer time).
+    pub keys: Vec<effectcraft_keyframe::Keyframe>,
+}
+
+/// A selected mask vertex: layer, mask group uid, vertex index.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct VertexRef {
+    pub layer: LayerId,
+    pub mask: Uid,
+    pub index: usize,
+}
+
+/// One composition's selection. The active comp's copy lives in [`EditorState::selected_layers`]
+/// (and the property, key, and vertex lists); every other comp keeps its own here (#1001).
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CompSelection {
+    pub layers: Vec<LayerId>,
+    pub props: Vec<(LayerId, Uid)>,
+    pub keys: Vec<KeyRef>,
+    pub vertices: Vec<VertexRef>,
+}
+
+impl CompSelection {
+    pub(crate) fn is_empty(&self) -> bool {
+        self.layers.is_empty() && self.props.is_empty() && self.keys.is_empty() && self.vertices.is_empty()
+    }
+}
+
+/// Editing state that commands depend on (headless-relevant, serde for agents).
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct EditorState {
+    pub active_comp: Option<ItemId>,
+    /// Open compositions (viewer/timeline tabs), in tab order.
+    pub open_comps: Vec<ItemId>,
+    /// Compositions that were active before the current one, most recent first (Shift+Esc).
+    #[serde(default)]
+    pub recent_comps: Vec<ItemId>,
+    /// Current time per comp (the CTI).
+    pub times: std::collections::BTreeMap<ItemId, Tick>,
+    /// Layer selection of the active comp. Other comps' selections are in [`Self::comp_selections`].
+    pub selected_layers: Vec<LayerId>,
+    /// Selections of comps that are not active, keyed by comp id (#1001).
+    #[serde(default)]
+    pub comp_selections: std::collections::BTreeMap<ItemId, CompSelection>,
+    /// Selected properties / groups (by uid) of selected layers.
+    pub selected_props: Vec<(LayerId, Uid)>,
+    pub selected_keys: Vec<KeyRef>,
+    pub project_selection: Vec<ItemId>,
+    /// Layer clipboard (serialized layers) and keyframe clipboard.
+    #[serde(skip)]
+    pub clipboard: Vec<Layer>,
+    /// Copied keyframes (times relative to the earliest copied key).
+    #[serde(skip)]
+    pub key_clipboard: Vec<KeyClip>,
+    /// The last copy was keyframes (Paste pastes keys at the CTI).
+    #[serde(skip)]
+    pub clip_is_keys: bool,
+    /// Values of selected unanimated properties (match path, value), copied with Edit ▸ Copy;
+    /// Paste sets the same properties of the selected layers.
+    #[serde(skip)]
+    pub value_clipboard: Vec<(String, effectcraft_keyframe::Value)>,
+    /// The copied keyframes and values as After Effects keyframe text (one layer's Transform
+    /// properties), for the system clipboard.
+    #[serde(skip)]
+    pub keyframe_text: Option<String>,
+    /// Copied effect instances, with comp-time key offsets from the earliest copied key.
+    /// Paste adds them to the selected layers at the destination comp's CTI.
+    #[serde(skip)]
+    pub effect_clipboard: Vec<effectcraft_project::PropGroup>,
+    /// Copied shape items (Edit ▸ Copy with groups, paths, paints or path operations selected in
+    /// a shape layer's Contents); Paste adds them to the selected shape layers.
+    #[serde(skip)]
+    pub contents_clipboard: Vec<effectcraft_project::PropGroup>,
+    /// Copied masks (Edit ▸ Copy with masks selected); Paste adds them to the selected layers.
+    #[serde(skip)]
+    pub mask_clipboard: Vec<effectcraft_project::PropGroup>,
+    /// Selected mask vertices (viewer Selection tool / pen).
+    #[serde(default)]
+    pub selected_vertices: Vec<VertexRef>,
+    pub snapping: bool,
+    /// Tools bar ▸ Snapping options (which features snap, Snap Edges Extended).
+    #[serde(default)]
+    pub snap_features: viewer::SnapFeatures,
+    /// Last applied effect id (Effect ▸ last effect).
+    pub last_effect: Option<String>,
+    /// Viewer region of interest `[x, y, w, h]` in comp pixels (Composition ▸ Crop Comp to Region
+    /// of Interest).
+    #[serde(default)]
+    pub region_of_interest: Option<[f64; 4]>,
+    /// Property-link clipboard (Edit ▸ Copy with Property Links / Copy Expression Only).
+    #[serde(skip)]
+    pub link_clipboard: Option<LinkClip>,
+    /// File ▸ Interpret Footage ▸ Remember Interpretation.
+    #[serde(skip)]
+    pub interpretation: Option<effectcraft_project::Footage>,
+    /// Viewer 3D view per comp (Active Camera / Front / … / Custom View 3 and edited view cameras).
+    #[serde(default)]
+    pub views3d: std::collections::BTreeMap<ItemId, effectcraft_render::three_d::Views3D>,
+    /// Tracker panel ▸ Current Track: (tracked layer, tracker group uid) in the active comp.
+    #[serde(default)]
+    pub current_track: Option<(LayerId, Uid)>,
+    /// Tracker panel ▸ Method in mask mode (Track Mask).
+    #[serde(default)]
+    pub mask_track_method: mask_track::MaskMethod,
+    /// 3D Camera Tracker: the selected track points (ids) in the viewer.
+    #[serde(default)]
+    pub camera_points: Vec<u32>,
+    /// Mask Interpolation panel options.
+    #[serde(default)]
+    pub mask_interp: commands::mask_interp::MaskInterpOptions,
+    /// Paint and Brushes panel options (Brush, Clone Stamp and Eraser tools).
+    #[serde(default)]
+    pub paint: commands::paint::PaintOptions,
+    /// Roto Brush and Refine Edge tool options.
+    #[serde(default)]
+    pub roto: roto::RotoOptions,
+    /// Puppet tool options for new meshes.
+    #[serde(default)]
+    pub puppet: commands::puppet::PuppetOptions,
+    /// The shape tools' and the Pen's options (Tool Creates Shape / Mask, Fill and Stroke).
+    #[serde(default)]
+    pub shape_tool: commands::shape_tool::ShapeTool,
+    /// View ▸ Switch View Layout: 1, 2 or 4 views side by side in the Composition viewer.
+    #[serde(default = "one_view")]
+    pub view_layout: u8,
+    /// View ▸ Switch View Layout ▸ Share View Options (grid, guides… in every view).
+    #[serde(default)]
+    pub share_view_options: bool,
+    /// Layer ▸ Mask ▸ Hide Locked Masks (viewer outlines).
+    #[serde(default)]
+    pub hide_locked_masks: bool,
+    /// On-canvas text editing (Type tool): the edited layer, selection and insertion style.
+    #[serde(default)]
+    pub text_edit: Option<commands::text_edit::TextEdit>,
+    /// Text copied while editing (with its formatting), for Paste / Paste Text Formatting Only.
+    #[serde(skip)]
+    pub text_clipboard: Option<effectcraft_keyframe::TextDoc>,
+    /// Composition viewer display options (Show Channel, exposure, snapshot, Fast Previews).
+    #[serde(default)]
+    pub viewer: commands::viewer_cmds::ViewOptions,
+    /// Essential Graphics panel ▸ Primary composition (`None` = the active comp).
+    #[serde(default)]
+    pub essential_primary: Option<ItemId>,
+    /// Essential Graphics panel ▸ Solo Supported Properties (the timeline shows only properties
+    /// Essential Graphics can expose).
+    #[serde(default)]
+    pub essential_solo: bool,
+    /// File ▸ Watch Folder: the folder being watched for projects to render (frontends call
+    /// `file.watchFolder.poll` periodically while it is set).
+    #[serde(default)]
+    pub watch_folder: Option<String>,
+    /// The Footage panel: the footage shown, its time and In/Out marks (source time).
+    #[serde(default)]
+    pub footage_panel: Option<commands::footage_panel::FootageView>,
+    /// Media Browser: the folder shown and the favourites.
+    #[serde(default)]
+    pub media_browser: media_browser::BrowserState,
+    /// Content-Aware Fill panel settings.
+    #[serde(default)]
+    pub content_fill: commands::content_fill::FillSettings,
+    /// View ▸ Split with New Locked Viewer: the second viewer's comp and 3D view.
+    #[serde(default)]
+    pub locked_viewer: Option<commands::viewer_cmds::LockedViewer>,
+}
+
+fn one_view() -> u8 {
+    1
+}
+
+/// What Copy with Property Links / Copy Expression Only put on the clipboard.
+#[derive(Clone, Debug, PartialEq)]
+pub enum LinkClip {
+    /// Expressions that link back to the source properties: (match path, expression text).
+    Links { relative: bool, links: Vec<(String, String)> },
+    /// Expressions only: (match path, expression).
+    Expressions(Vec<(String, effectcraft_project::Expression)>),
+}
diff --git a/crates/engine/src/error.rs b/crates/engine/src/error.rs
new file mode 100644
index 000000000..75e9e4467
--- /dev/null
+++ b/crates/engine/src/error.rs
@@ -0,0 +1,20 @@
+#[derive(Debug, thiserror::Error)]
+pub enum EngineError {
+    #[error("unknown command `{0}`")]
+    UnknownCommand(String),
+    #[error("command `{0}` is not available right now: {1}")]
+    Disabled(String, String),
+    #[error("invalid parameters for `{cmd}`: {msg}")]
+    BadParams { cmd: String, msg: String },
+    #[error("no active composition")]
+    NoComp,
+    /// A `comp` reference (name or id) that names no composition.
+    #[error("no composition {0}")]
+    NoSuchComp(String),
+    #[error("{0}")]
+    Project(#[from] effectcraft_project::ProjectError),
+    #[error("{0}")]
+    Other(String),
+}
+
+pub type Result<T> = std::result::Result<T, EngineError>;
diff --git a/crates/engine/src/event.rs b/crates/engine/src/event.rs
new file mode 100644
index 000000000..e1f5e0535
--- /dev/null
+++ b/crates/engine/src/event.rs
@@ -0,0 +1,32 @@
+use super::{ItemId, Serialize, Value};
+
+/// Events for frontends (drained each frame).
+#[derive(Clone, Debug, PartialEq, Serialize)]
+pub enum Event {
+    ProjectChanged {
+        revision: u64,
+    },
+    Toast {
+        message: String,
+        error: bool,
+    },
+    OpenComp(ItemId),
+    OpenUrl(String),
+    /// A frontend-only command (viewer zoom, panels, dialogs…) ran: the UI performs it. Headless
+    /// sessions ignore these.
+    Frontend {
+        command: String,
+        params: Value,
+    },
+    /// Drop cached frames / renders (Edit ▸ Purge).
+    PurgeCaches,
+    /// Put an image on the system clipboard (Composition ▸ Copy Frame to Clipboard): `rgba` is
+    /// `width` × `height` straight-alpha RGBA8 rows. Headless sessions ignore it; the pixels are
+    /// not serialized.
+    CopyImage {
+        width: u32,
+        height: u32,
+        #[serde(skip)]
+        rgba: Vec<u8>,
+    },
+}
diff --git a/crates/engine/src/fonts.rs b/crates/engine/src/fonts.rs
new file mode 100644
index 000000000..6b06d6f5b
--- /dev/null
+++ b/crates/engine/src/fonts.rs
@@ -0,0 +1,92 @@
+use super::prefs;
+
+pub fn text_families() -> Vec<String> {
+    effectcraft_text::families().into_iter().map(|(f, _)| f).collect()
+}
+
+/// The styles a family offers (its own faces, in weight order), for the style menus. A family
+/// that isn't installed offers the usual styles, which resolve to Inter's.
+pub fn font_styles(family: &str) -> Vec<String> {
+    effectcraft_text::families()
+        .into_iter()
+        .find(|(f, _)| f.eq_ignore_ascii_case(family))
+        .map(|(_, st)| st)
+        .filter(|st| !st.is_empty())
+        .unwrap_or_else(|| ["Regular", "Medium", "SemiBold", "Bold", "Italic"].iter().map(|s| s.to_string()).collect())
+}
+
+/// The OpenType feature tags (GSUB / GPOS) of the face a family + style resolves to.
+pub fn font_features(family: &str, style: &str) -> Vec<String> {
+    effectcraft_text::fonts::face(effectcraft_text::resolve(family, style).face).features()
+}
+
+/// One row of the Character panel's font menu.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FontRow {
+    /// The family to apply (empty for the separator after the recent fonts).
+    pub family: String,
+    /// What the menu shows: the English family name, or the font's own-language name when
+    /// Settings ▸ Type ▸ Show Font Names in English is off.
+    pub display: String,
+    pub recent: bool,
+    /// A variable font (the menu's Variable Fonts filter keeps only these).
+    pub variable: bool,
+}
+
+/// Outline polylines of "Sample" set in `family` at `size` px (baseline at y = 0, y down), for
+/// the font menu's preview (Settings ▸ Type ▸ Show Font Preview).
+pub fn font_preview(family: &str, size: f64) -> Vec<Vec<[f32; 2]>> {
+    use kurbo::PathEl;
+    let st = effectcraft_keyframe::text_doc::CharStyle { font: family.to_string(), size, ..Default::default() };
+    let mut out = vec![];
+    let mut x = 0.0;
+    for ch in "Sample".chars() {
+        let (path, adv) = effectcraft_text::char_glyph_style(&st, ch);
+        let mut cur: Vec<[f32; 2]> = vec![];
+        let pt = |p: kurbo::Point| [(p.x + x) as f32, p.y as f32];
+        kurbo::flatten(&path, 0.2, |el| match el {
+            PathEl::MoveTo(p) => {
+                if cur.len() > 1 {
+                    out.push(std::mem::take(&mut cur));
+                }
+                cur = vec![pt(p)];
+            }
+            PathEl::LineTo(p) => cur.push(pt(p)),
+            PathEl::ClosePath => {
+                if let Some(f) = cur.first().copied() {
+                    cur.push(f);
+                }
+                if cur.len() > 1 {
+                    out.push(std::mem::take(&mut cur));
+                }
+            }
+            _ => {}
+        });
+        if cur.len() > 1 {
+            out.push(cur);
+        }
+        x += adv;
+    }
+    out
+}
+
+/// The Character panel's font menu: the recent fonts (Settings ▸ Type ▸ Number of Recent Fonts
+/// to Display), a separator, then every family. Each row says whether the family is variable,
+/// for the menu's Variable Fonts filter.
+pub fn font_menu(prefs: &prefs::Prefs) -> Vec<FontRow> {
+    let all = text_families();
+    let native = if prefs.type_.font_names_in_english { Default::default() } else { effectcraft_text::fonts::native_families() };
+    let variable = effectcraft_text::fonts::variable_families();
+    let row = |f: &String, recent: bool| FontRow {
+        family: f.clone(),
+        display: native.get(f).cloned().unwrap_or_else(|| f.clone()),
+        recent,
+        variable: variable.contains(f),
+    };
+    let mut out: Vec<FontRow> = prefs.recent_fonts_shown().iter().filter(|f| all.contains(f)).map(|f| row(f, true)).collect();
+    if !out.is_empty() {
+        out.push(FontRow { family: String::new(), display: "-".into(), recent: false, variable: false });
+    }
+    out.extend(all.iter().map(|f| row(f, false)));
+    out
+}
diff --git a/crates/engine/src/footage.rs b/crates/engine/src/footage.rs
new file mode 100644
index 000000000..b921dd128
--- /dev/null
+++ b/crates/engine/src/footage.rs
@@ -0,0 +1,8 @@
+pub mod doc_path;
+pub mod footage_check;
+pub mod footage_reload;
+pub mod media_browser;
+pub mod media_cache;
+pub mod sequence;
+
+pub(crate) mod availability;
diff --git a/crates/engine/src/footage/availability.rs b/crates/engine/src/footage/availability.rs
new file mode 100644
index 000000000..75e2a1e1c
--- /dev/null
+++ b/crates/engine/src/footage/availability.rs
@@ -0,0 +1,497 @@
+//! Snapshot-based footage availability, shared by open-time checks and the disk watcher.
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::Arc;
+
+use crate::{Services, Session};
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, Project};
+
+#[derive(Clone, PartialEq)]
+pub(crate) struct Source {
+    pub id: ItemId,
+    pub proxy: bool,
+    pub footage: Footage,
+    paths: Vec<String>,
+    folder: Option<String>,
+}
+
+impl Source {
+    /// Find the same source settings in a newer project, ignoring only the disk-derived
+    /// missing flag so an overlapping check cannot invalidate moved-source recovery.
+    pub fn current<'a>(&self, project: &'a mut Project) -> Option<&'a mut Footage> {
+        let item = project.item_mut(self.id)?;
+        let f = if self.proxy {
+            &mut item.proxy.as_mut()?.footage
+        } else {
+            let ItemKind::Footage(f) = &mut item.kind else { return None };
+            f
+        };
+        // Availability is an observation, not a source edit. Another disk check must not
+        // invalidate an open-time probe or recovery of a source moved with the project.
+        let missing = std::mem::replace(&mut f.missing, self.footage.missing);
+        let same = *f == self.footage;
+        f.missing = missing;
+        same.then_some(f)
+    }
+}
+
+/// External originals and proxies that need availability checks. Embedded data and empty
+/// paths remain usable without an external file and are excluded from this inventory.
+fn entries(s: &Session) -> impl Iterator<Item = (ItemId, bool, &Footage)> {
+    s.project.items.values().flat_map(|item| {
+        let original = match &item.kind {
+            ItemKind::Footage(f) => Some(f),
+            _ => None,
+        };
+        original
+            .map(|f| (false, f))
+            .into_iter()
+            .chain(item.proxy.as_ref().map(|p| (true, &p.footage)))
+            .filter(|(_, f)| f.kind != FootageKind::Data && !f.path.is_empty())
+            .map(move |(proxy, f)| (item.id, proxy, f))
+    })
+}
+
+/// Check whether a snapshot can be reused without allocating new sequence path strings.
+pub(crate) fn sources_match(s: &Session, sources: &[Source]) -> bool {
+    let mut before = sources.iter();
+    for (id, proxy, footage) in entries(s) {
+        let Some(old) = before.next() else {
+            return false;
+        };
+        if old.id != id || old.proxy != proxy || old.footage != *footage {
+            return false;
+        }
+    }
+    before.next().is_none()
+}
+
+/// Resolve accepted paths once for the worker. Refused document paths retain an empty probe
+/// list, which reports missing without contacting the filesystem or a foreign share.
+pub(crate) fn sources(s: &Session) -> Vec<Source> {
+    let mut out = Vec::new();
+    for (id, proxy, f) in entries(s) {
+        let paths: Vec<String> = if s.stored_paths.check(f).is_ok() {
+            std::iter::once(&f.path).chain(&f.sequence).filter_map(|p| s.stored_path(p).ok()?.to_str().map(str::to_string)).collect()
+        } else {
+            Vec::new()
+        };
+        let folder = paths
+            .first()
+            .and_then(|p| std::path::Path::new(p).parent())
+            .filter(|dir| !dir.as_os_str().is_empty() && paths.iter().all(|p| std::path::Path::new(p).parent() == Some(*dir)))
+            .and_then(|p| p.to_str())
+            .map(str::to_string);
+        out.push(Source { id, proxy, footage: f.clone(), paths, folder });
+    }
+    out
+}
+
+/// Each unique file is checked at most once per pass. Sequences are available while any frame
+/// exists; when their common directory is offline, avoid probing thousands of absent frames.
+pub(crate) fn scan(sources: &[Source], services: &dyn Services) -> Vec<bool> {
+    let mut files = BTreeMap::new();
+    let mut folders = BTreeMap::new();
+    sources
+        .iter()
+        .map(|source| {
+            let mut paths = source.paths.iter();
+            let Some(first) = paths.next() else { return true };
+            let present = |p: &String, files: &mut BTreeMap<String, bool>| *files.entry(p.clone()).or_insert_with(|| services.exists(p));
+            if present(first, &mut files) {
+                return false;
+            }
+            if let Some(dir) = &source.folder
+                && !*folders.entry(dir.clone()).or_insert_with(|| services.is_dir(dir))
+            {
+                return true;
+            }
+            !paths.any(|p| present(p, &mut files))
+        })
+        .collect()
+}
+
+/// Maximum availability probes per automatic polling pass. Explicit checks may finish a full
+/// scan; automatic monitoring resumes partial sequence scans and keeps the last proven status.
+pub(crate) const PROBE_BUDGET: usize = 256;
+
+struct Progress {
+    next: usize,
+    absent: usize,
+    missing: bool,
+}
+
+#[derive(Default)]
+pub(crate) struct Scanner {
+    progress: Vec<Progress>,
+    source: usize,
+}
+
+impl Scanner {
+    /// Discard partial evidence after watched sources change, retaining their last known flags.
+    pub fn reset(&mut self, sources: &[Source]) {
+        self.progress = sources.iter().map(|s| Progress { next: 0, absent: 0, missing: s.footage.missing }).collect();
+        self.source = 0;
+    }
+
+    /// Spend at most PROBE_BUDGET file/folder probes and return one status per source.
+    /// Partial sequence scans retain the last proven status and resume on a later poll.
+    pub fn poll(&mut self, sources: &[Source], services: &dyn Services) -> Vec<bool> {
+        if self.progress.len() != sources.len() {
+            self.reset(sources);
+        }
+        if sources.is_empty() {
+            return Vec::new();
+        }
+        let mut remaining = PROBE_BUDGET;
+        let mut visited = 0usize;
+        let mut files = BTreeMap::new();
+        let mut folders = BTreeMap::new();
+        self.source %= sources.len();
+        let mut continuation = false;
+        while remaining > 0 {
+            if visited >= sources.len() {
+                if !self.progress.iter().any(|p| p.absent > 0) {
+                    break;
+                }
+                visited = 0;
+                continuation = true;
+            }
+            let Some(source) = sources.get(self.source) else {
+                break;
+            };
+            let Some(progress) = self.progress.get_mut(self.source) else {
+                break;
+            };
+            if continuation && progress.absent == 0 {
+                visited = visited.saturating_add(1);
+                self.source = self.source.saturating_add(1) % sources.len();
+                continue;
+            }
+            let quota = (remaining / sources.len().saturating_sub(visited).max(1)).max(2).min(remaining);
+            let mut used = 0usize;
+            let mut checked_folder = false;
+            if source.paths.is_empty() {
+                progress.missing = true;
+            }
+            while used < quota && !source.paths.is_empty() {
+                let Some(path) = source.paths.get(progress.next) else {
+                    progress.next = 0;
+                    break;
+                };
+                remaining = remaining.saturating_sub(1);
+                used = used.saturating_add(1);
+                if *files.entry(path.clone()).or_insert_with(|| services.exists(path)) {
+                    progress.missing = false;
+                    progress.absent = 0;
+                    // Reuse this witness next time rather than scan absent earlier frames.
+                    break;
+                }
+                progress.next = progress.next.saturating_add(1) % source.paths.len();
+                progress.absent = progress.absent.saturating_add(1);
+                if progress.absent >= source.paths.len() {
+                    progress.missing = true;
+                    progress.absent = 0;
+                    break;
+                }
+                if !checked_folder
+                    && used < quota
+                    && let Some(folder) = &source.folder
+                {
+                    remaining = remaining.saturating_sub(1);
+                    used = used.saturating_add(1);
+                    checked_folder = true;
+                    if !*folders.entry(folder.clone()).or_insert_with(|| services.is_dir(folder)) {
+                        progress.missing = true;
+                        progress.next = 0;
+                        progress.absent = 0;
+                        break;
+                    }
+                }
+            }
+            visited = visited.saturating_add(1);
+            self.source = self.source.saturating_add(1) % sources.len();
+        }
+        self.progress.iter().map(|p| p.missing).collect()
+    }
+}
+
+/// A disk observation prepared entirely by the existing worker. The UI only swaps a current
+/// snapshot (the disk cache needs nothing: its entries check their own files when read, #3184).
+pub(crate) struct Update {
+    before: Arc<Project>,
+    after: Arc<Project>,
+    paths: BTreeSet<String>,
+    newly_missing: usize,
+}
+
+/// Prepare a replacement only when availability changed. Project cloning belongs on the
+/// worker; apply later rejects an outdated project snapshot.
+pub(crate) fn prepare(project: &Arc<Project>, sources: &[Source], missing: &[bool]) -> Option<Update> {
+    let mut after = project.clone();
+    let mut paths = BTreeSet::new();
+    let mut newly_missing = 0;
+    for (source, missing) in sources.iter().zip(missing) {
+        if source.footage.missing == *missing {
+            continue;
+        }
+        let Some(current) = source.current(Arc::make_mut(&mut after)) else { continue };
+        current.missing = *missing;
+        newly_missing += usize::from(*missing);
+        paths.insert(source.footage.path.clone());
+        paths.extend(source.footage.sequence.iter().cloned());
+    }
+    if paths.is_empty() {
+        return None;
+    }
+    Some(Update { before: project.clone(), after, paths, newly_missing })
+}
+
+impl Update {
+    /// False means a newer project needs a fresh observation.
+    pub fn apply(self, s: &mut Session) -> bool {
+        if !Arc::ptr_eq(&s.project, &self.before) {
+            return false;
+        }
+        let dirty = s.is_dirty();
+        s.project = self.after;
+        s.bump();
+        if !dirty {
+            s.mark_saved();
+        }
+        super::footage_reload::forget_media(s, &self.paths);
+        if self.newly_missing > 0 {
+            s.toast(format!(
+                "{} footage source(s) offline. Use File ▸ Dependencies ▸ Relink Missing Footage, or Set Proxy for a missing proxy.",
+                self.newly_missing
+            ));
+        }
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use effectcraft_project::Proxy;
+    use serde_json::json;
+    use std::sync::{
+        Mutex,
+        atomic::{AtomicUsize, Ordering},
+    };
+
+    #[derive(Default)]
+    struct Disk {
+        files: Mutex<BTreeSet<String>>,
+        looks: AtomicUsize,
+        existing_dir: bool,
+    }
+    impl Disk {
+        fn set(&self, paths: &[&str]) {
+            *self.files.lock().unwrap() = paths.iter().map(|p| p.to_string()).collect();
+        }
+    }
+    impl Services for Disk {
+        fn read_file(&self, _: &str) -> std::io::Result<Vec<u8>> {
+            Err(std::io::ErrorKind::NotFound.into())
+        }
+        fn write_file(&self, _: &str, _: &[u8]) -> std::io::Result<()> {
+            Ok(())
+        }
+        fn exists(&self, path: &str) -> bool {
+            self.looks.fetch_add(1, Ordering::Relaxed);
+            self.files.lock().unwrap().contains(path)
+        }
+        fn is_dir(&self, path: &str) -> bool {
+            if self.existing_dir {
+                return true;
+            }
+            self.files.lock().unwrap().iter().any(|p| std::path::Path::new(p).parent() == Some(std::path::Path::new(path)))
+        }
+    }
+    fn session(disk: Arc<Disk>) -> (Session, ItemId) {
+        let mut s = Session { services: disk, ..Default::default() };
+        s.prefs.import.auto_reload_footage = "off".into();
+        let f = Footage { path: "/media/original.png".into(), width: 64, height: 32, has_video: true, ..Default::default() };
+        let id = Arc::make_mut(&mut s.project).add_item("Plate", Default::default(), None, ItemKind::Footage(f.clone()));
+        Arc::make_mut(&mut s.project).item_mut(id).unwrap().proxy =
+            Some(Box::new(Proxy { footage: Footage { path: "/media/proxy.png".into(), ..f }, enabled: false }));
+        s.mark_saved();
+        (s, id)
+    }
+    fn check(s: &mut Session) {
+        s.execute("footage.reloadChanged", json!({})).unwrap();
+    }
+
+    #[test]
+    fn disconnect_and_reconnect_update_original_and_unused_proxy_without_edits() {
+        let disk = Arc::new(Disk::default());
+        disk.set(&["/media/original.png", "/media/proxy.png"]);
+        let (mut s, id) = session(disk.clone());
+        check(&mut s);
+        assert!(!s.project.item(id).unwrap().has_missing_footage());
+        disk.set(&["/media/proxy.png"]);
+        check(&mut s);
+        let sum = s.execute("project.summary", json!({})).unwrap();
+        assert_eq!(sum["items"][0]["missing"], true);
+        assert!(sum["items"][0]["problem"].as_str().unwrap().contains("/media/original.png"));
+        disk.set(&["/media/original.png"]);
+        check(&mut s);
+        let item = s.project.item(id).unwrap();
+        assert!(matches!(&item.kind, ItemKind::Footage(f) if !f.missing));
+        assert!(item.proxy.as_ref().unwrap().footage.missing);
+        disk.set(&["/media/original.png", "/media/proxy.png"]);
+        check(&mut s);
+        assert!(!s.project.item(id).unwrap().has_missing_footage());
+        assert!(!s.is_dirty());
+        assert!(s.history.undo.is_empty());
+        let revision = s.revision;
+        check(&mut s);
+        assert_eq!(s.revision, revision, "unchanged observations are idempotent");
+    }
+
+    #[test]
+    fn open_time_check_includes_proxies() {
+        let disk = Arc::new(Disk::default());
+        disk.set(&["/media/original.png"]);
+        let (mut s, id) = session(disk);
+        let r = s.execute("footage.check", json!({"wait": true})).unwrap();
+        assert_eq!(r, json!({"checked": 2, "missing": 1, "probed": 0}));
+        assert!(s.project.item(id).unwrap().proxy.as_ref().unwrap().footage.missing);
+        assert!(!s.is_dirty());
+    }
+
+    #[test]
+    fn stale_observation_cannot_mark_a_replacement_missing() {
+        let (mut s, id) = session(Arc::new(Disk::default()));
+        let old = sources(&s);
+        let update = prepare(&s.project, &old, &[true, true]).unwrap();
+        if let ItemKind::Footage(f) = &mut Arc::make_mut(&mut s.project).item_mut(id).unwrap().kind {
+            f.path = "/new.png".into();
+        }
+        assert!(!update.apply(&mut s));
+        assert!(matches!(&s.project.item(id).unwrap().kind, ItemKind::Footage(f) if !f.missing));
+    }
+
+    #[test]
+    fn sequences_short_circuit_and_offline_folders_do_not_probe_every_frame() {
+        let disk = Arc::new(Disk::default());
+        disk.set(&["/media/frame1.png"]);
+        let (mut s, id) = session(disk.clone());
+        if let ItemKind::Footage(f) = &mut Arc::make_mut(&mut s.project).item_mut(id).unwrap().kind {
+            f.kind = FootageKind::Sequence;
+            f.path = "/media/frame0.png".into();
+            f.sequence = (0..10_000).map(|n| format!("/media/frame{n}.png")).collect();
+        }
+        let source = sources(&s);
+        assert_eq!(scan(&source, disk.as_ref()), [false, true], "a later frame keeps the sequence available");
+        assert!(disk.looks.load(Ordering::Relaxed) < 5);
+        disk.set(&[]);
+        disk.looks.store(0, Ordering::Relaxed);
+        assert_eq!(scan(&source, disk.as_ref()), [true, true]);
+        assert_eq!(disk.looks.load(Ordering::Relaxed), 2, "one file per source, no scan of an unmounted folder");
+    }
+
+    /// An availability change does no disk-cache work (#3184): the cache stays attached and
+    /// no file is looked at for it, on the worker or when the UI applies the observation (it
+    /// used to stamp every footage file for a new layer salt).
+    #[test]
+    fn applying_an_availability_change_does_no_disk_cache_work() {
+        let dir = std::env::temp_dir().join(format!("ec-availability-cache-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = dir.join("plate.png");
+        std::fs::write(&file, b"plate").unwrap();
+        let mut s = Session::default();
+        Arc::make_mut(&mut s.project).add_item(
+            "Plate",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { path: file.to_string_lossy().into_owned(), has_video: true, missing: true, ..Default::default() }),
+        );
+        let cache = crate::render::disk_cache::DiskCache::open(dir.join("cache"), 1 << 20).unwrap();
+        s.disk_cache = Some(cache.clone());
+        s.layer_cache.set_disk(Some(cache.clone()));
+        s.mark_saved();
+        let update = prepare(&s.project, &sources(&s), &[false]).unwrap();
+        std::fs::remove_file(file).unwrap();
+        assert!(update.apply(&mut s));
+        assert!(s.layer_cache.disk().is_some_and(|d| Arc::ptr_eq(&d, &cache)), "still attached");
+        assert_eq!(cache.file_checks(), 0, "no file looked at for the disk cache");
+        assert!(!s.is_dirty());
+        drop(s);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn automatic_sequence_checks_are_bounded_and_resume_without_starving_other_sources() {
+        let disk = Arc::new(Disk { existing_dir: true, ..Default::default() });
+        let (mut s, id) = session(disk.clone());
+        if let ItemKind::Footage(f) = &mut Arc::make_mut(&mut s.project).item_mut(id).unwrap().kind {
+            f.kind = FootageKind::Sequence;
+            f.path = "/media/frame0.png".into();
+            f.sequence = (0..10_000).map(|n| format!("/media/frame{n}.png")).collect();
+        }
+        let sources = sources(&s);
+        let mut scanner = Scanner::default();
+        let mut status = Vec::new();
+        for _ in 0..100 {
+            disk.looks.store(0, Ordering::Relaxed);
+            status = scanner.poll(&sources, disk.as_ref());
+            assert!(disk.looks.load(Ordering::Relaxed) <= PROBE_BUDGET);
+            assert!(status[1], "the single-file proxy is checked without waiting for the long sequence");
+            if status[0] {
+                break;
+            }
+        }
+        assert_eq!(status, [true, true], "a complete absent cycle proves the sequence missing");
+        disk.set(&["/media/frame9999.png"]);
+        for _ in 0..100 {
+            disk.looks.store(0, Ordering::Relaxed);
+            status = scanner.poll(&sources, disk.as_ref());
+            assert!(disk.looks.load(Ordering::Relaxed) <= PROBE_BUDGET);
+            if !status[0] {
+                break;
+            }
+        }
+        assert_eq!(status, [false, true], "a late frame is eventually found");
+        disk.looks.store(0, Ordering::Relaxed);
+        assert_eq!(scanner.poll(&sources, disk.as_ref()), [false, true]);
+        assert!(disk.looks.load(Ordering::Relaxed) <= 2, "keep the available late frame as a witness");
+    }
+
+    #[test]
+    fn save_disconnect_undo_redo_and_reconciliation_return_to_clean_saved_state() {
+        let disk = Arc::new(Disk::default());
+        disk.set(&["/media/original.png", "/media/proxy.png"]);
+        let (mut s, id) = session(disk.clone());
+        s.edit("Rename", None, |project, _| {
+            project.item_mut(id).unwrap().name = "Saved plate".into();
+            Ok(())
+        })
+        .unwrap();
+        s.mark_saved();
+        let history = s.history.undo.clone();
+        disk.set(&[]);
+        check(&mut s);
+        assert!(!s.is_dirty());
+        assert!(s.undo());
+        assert!(s.is_dirty());
+        check(&mut s);
+        assert!(s.redo());
+        check(&mut s);
+        assert!(!s.is_dirty(), "redo restores the saved observed snapshot retained by undo");
+        assert_eq!(s.project.item(id).unwrap().name, "Saved plate");
+        assert_eq!(s.history.undo.len(), history.len());
+        assert_eq!(s.history.undo[0].0, history[0].0);
+        assert!(s.history.redo.is_empty());
+    }
+
+    #[test]
+    fn duplicate_sources_share_one_file_probe() {
+        let disk = Arc::new(Disk::default());
+        disk.set(&["/media/original.png"]);
+        let (mut s, id) = session(disk.clone());
+        Arc::make_mut(&mut s.project).item_mut(id).unwrap().proxy.as_mut().unwrap().footage.path = "/media/original.png".into();
+        assert_eq!(scan(&sources(&s), disk.as_ref()), [false, false]);
+        assert_eq!(disk.looks.load(Ordering::Relaxed), 1);
+    }
+}
diff --git a/crates/engine/src/doc_path.rs b/crates/engine/src/footage/doc_path.rs
similarity index 69%
rename from crates/engine/src/doc_path.rs
rename to crates/engine/src/footage/doc_path.rs
index c7416a8ce..25ef9c09a 100644
--- a/crates/engine/src/doc_path.rs
+++ b/crates/engine/src/footage/doc_path.rs
@@ -3,7 +3,7 @@
 //! document's folder, and only local files, or files on the network share the document itself is
 //! on, are followed (see `craft_docpath`).
 //!
-//! Loading a document resolves its footage paths once ([`resolve_footage`]): followed paths are
+//! Loading a document resolves its footage paths once (`resolve_footage`): followed paths are
 //! replaced by the resolved path, and an item with a refused path is marked missing, so the media
 //! layer never reads it. The session then remembers which paths came from which document
 //! ([`StoredPaths`]); the footage check, the changed-on-disk scan, Reload Footage, Relink, Edit
@@ -46,13 +46,22 @@ pub fn resolve(stored: &str, project: Option<&str>) -> Result<PathBuf, NotFollow
         let p = Path::new(p);
         std::path::absolute(p).unwrap_or_else(|_| p.to_path_buf())
     });
-    let path = craft_docpath::resolve(stored, project.as_deref()).map_err(NotFollowed::Refused)?;
-    // A path that is still relative would be taken from the working directory, which the
-    // project does not choose.
-    if path.is_relative() {
-        return Err(NotFollowed::NoProjectFolder);
-    }
-    Ok(path)
+    craft_docpath::resolve_absolute(stored, project.as_deref()).map_err(|why| match why {
+        // Resolved, but still relative: it would be taken from the working directory, which the
+        // project does not choose. A Windows drive or share path (`C:\x`) stays invalid outside
+        // Windows even with a project.
+        Refused::Invalid if project.is_none() && craft_docpath::resolve(stored, None).is_ok_and(|p| cfg!(windows) || !is_windows_rooted(&p)) => {
+            NotFollowed::NoProjectFolder
+        }
+        why => NotFollowed::Refused(why),
+    })
+}
+
+/// Whether `p` is a Windows drive or share path, which a project cannot make absolute outside Windows.
+fn is_windows_rooted(p: &Path) -> bool {
+    let s = p.to_string_lossy();
+    let b = s.as_bytes();
+    (b.len() >= 2 && b[0].is_ascii_alphabetic() && b[1] == b':') || s.starts_with(r"\\") || s.starts_with("//")
 }
 
 /// The paths of `f` (its file and every frame of an image sequence) resolved against the document
@@ -73,16 +82,26 @@ fn paths_of(f: &Footage) -> impl Iterator<Item = &String> {
 
 /// Footage paths that came from a document, with the path of that document (`None`: one without
 /// a file). Any other path was chosen in this session and is followed as given.
-#[derive(Clone, Debug, Default)]
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct StoredPaths(Arc<HashMap<String, Option<String>>>);
 
 impl StoredPaths {
     /// Record the footage paths of `p`, loaded from the document at `document`. A path already
     /// recorded keeps the document it came from first.
     pub(crate) fn add(&mut self, p: &Project, document: Option<&str>) {
+        self.add_items(p, |_| true, document);
+    }
+
+    /// Record the footage paths of the items of `p` that `pick` selects, loaded from the document
+    /// at `document` (an imported file: the rest of the project keeps its own origin).
+    pub(crate) fn add_items(&mut self, p: &Project, pick: impl Fn(ItemId) -> bool, document: Option<&str>) {
         let map = Arc::make_mut(&mut self.0);
-        for item in p.items.values() {
-            if let ItemKind::Footage(f) = &item.kind {
+        for item in p.items.values().filter(|i| pick(i.id)) {
+            let original = match &item.kind {
+                ItemKind::Footage(f) => Some(f),
+                _ => None,
+            };
+            for f in original.into_iter().chain(item.proxy.as_ref().map(|p| &p.footage)) {
                 for q in paths_of(f) {
                     map.entry(q.clone()).or_insert_with(|| document.map(str::to_string));
                 }
@@ -125,17 +144,27 @@ impl StoredPaths {
 /// replaced by the file they resolve to, and an item with a path that is not followed is marked
 /// missing. Returns those items with the refused path and why.
 pub(crate) fn resolve_footage(p: &mut Project, project: Option<&str>) -> Vec<(ItemId, String, NotFollowed)> {
+    resolve_footage_of(p, |_| true, project)
+}
+
+/// [`resolve_footage`] for the items of `p` that `pick` selects (the ones an import added).
+pub(crate) fn resolve_footage_of(p: &mut Project, pick: impl Fn(ItemId) -> bool, project: Option<&str>) -> Vec<(ItemId, String, NotFollowed)> {
     let mut refused = vec![];
-    for item in p.items.values_mut() {
-        let ItemKind::Footage(f) = &mut item.kind else { continue };
-        match footage_paths(f, project) {
-            Ok((path, sequence)) => {
-                f.path = path;
-                f.sequence = sequence;
-            }
-            Err((path, why)) => {
-                f.missing = true;
-                refused.push((item.id, path, why));
+    for item in p.items.values_mut().filter(|i| pick(i.id)) {
+        let original = match &mut item.kind {
+            ItemKind::Footage(f) => Some(f),
+            _ => None,
+        };
+        for f in original.into_iter().chain(item.proxy.as_mut().map(|p| &mut p.footage)) {
+            match footage_paths(f, project) {
+                Ok((path, sequence)) => {
+                    f.path = path;
+                    f.sequence = sequence;
+                }
+                Err((path, why)) => {
+                    f.missing = true;
+                    refused.push((item.id, path, why));
+                }
             }
         }
     }
diff --git a/crates/engine/src/doc_path/tests.rs b/crates/engine/src/footage/doc_path/tests.rs
similarity index 68%
rename from crates/engine/src/doc_path/tests.rs
rename to crates/engine/src/footage/doc_path/tests.rs
index b8dcbc190..8ba2390c9 100644
--- a/crates/engine/src/doc_path/tests.rs
+++ b/crates/engine/src/footage/doc_path/tests.rs
@@ -34,9 +34,11 @@ impl Services for Recording {
     }
 }
 
-/// Probes every file as a still.
+/// Probes every file as a still. Only the Unix part of the test below imports files.
+#[cfg(unix)]
 struct Stills;
 
+#[cfg(unix)]
 impl crate::Importer for Stills {
     fn probe(&self, path: &str) -> Result<Footage, String> {
         if !std::path::Path::new(path).is_file() {
@@ -147,7 +149,66 @@ fn stored_paths_resolve_against_the_project() {
     let doc = doc.to_str().unwrap();
     assert_eq!(super::resolve("clip.mov", Some(doc)), Ok(std::env::temp_dir().join("art").join("clip.mov")));
     assert_eq!(super::resolve("clip.mov", None), Err(super::NotFollowed::NoProjectFolder));
+    assert_eq!(super::resolve("../logo.png", None), Err(super::NotFollowed::NoProjectFolder));
+    // A drive path is not a local file on Unix, with or without a project: it is not a missing project.
+    #[cfg(unix)]
+    for stored in [r"C:\x.mov", "C:x.mov"] {
+        assert_eq!(super::resolve(stored, None), Err(super::NotFollowed::Refused(super::Refused::Invalid)), "{stored}");
+    }
     assert_eq!(super::resolve(r"\\192.0.2.1\share\x.mov", Some(doc)), Err(super::NotFollowed::Refused(super::Refused::Network)));
+    assert_eq!(super::resolve("jar:clip.mov", Some(doc)), Err(super::NotFollowed::Refused(super::Refused::Url)));
+    // Windows reads a colon in a name as an alternate data stream; elsewhere it is a plain character.
+    if cfg!(windows) {
+        assert_eq!(super::resolve("shots/take:1.mov", Some(doc)), Err(super::NotFollowed::Refused(super::Refused::Invalid)));
+    } else {
+        assert_eq!(super::resolve("shots/take:1.mov", Some(doc)), Ok(std::env::temp_dir().join("art").join("shots").join("take:1.mov")));
+    }
+    // A Windows drive path names no file on other platforms.
+    #[cfg(unix)]
+    assert_eq!(super::resolve(r"C:\art\clip.mov", Some(doc)), Err(super::NotFollowed::Refused(super::Refused::Invalid)));
     #[cfg(windows)]
     assert!(super::resolve(r"\\server\share\x.mov", Some(r"\\SERVER\share\job\intro.ecproj")).is_ok());
 }
+
+#[test]
+fn reveal_deleted_file_in_existing_folder_offers_relink_guidance() {
+    let dir = std::env::temp_dir().join(format!("ec-reveal-offline-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut s = Session::default();
+    let file = dir.join("deleted.png");
+    let id = std::sync::Arc::make_mut(&mut s.project).add_item(
+        "Deleted",
+        Default::default(),
+        None,
+        ItemKind::Footage(Footage { path: file.to_string_lossy().into_owned(), ..Default::default() }),
+    );
+    let err = s.execute("file.revealInFinder", json!({"item": id.0})).unwrap_err().to_string();
+    assert!(err.contains("deleted.png") && err.contains("Relink Missing Footage"), "{err}");
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn relative_proxy_is_resolved_and_checked_next_to_the_project() {
+    let dir = std::env::temp_dir().join(format!("ec-proxy-path-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("proxy.png"), b"x").unwrap();
+    let mut s = Session::default();
+    let id = Arc::make_mut(&mut s.project).add_item(
+        "Plate",
+        Default::default(),
+        None,
+        ItemKind::Footage(Footage { path: dir.join("proxy.png").to_string_lossy().into_owned(), width: 64, height: 32, ..Default::default() }),
+    );
+    Arc::make_mut(&mut s.project).item_mut(id).unwrap().proxy = Some(Box::new(effectcraft_project::Proxy {
+        footage: Footage { path: "proxy.png".into(), width: 32, height: 16, ..Default::default() },
+        enabled: true,
+    }));
+    let project = dir.join("project.ecproj");
+    s.execute("file.saveAs", json!({"path": project})).unwrap();
+    let mut reopened = Session::default();
+    reopened.execute("file.open", json!({"path": project})).unwrap();
+    let result = reopened.execute("footage.check", json!({"wait": true})).unwrap();
+    assert_eq!(result, json!({"checked": 2, "missing": 0, "probed": 0}));
+    assert_eq!(std::path::Path::new(&reopened.project.item(id).unwrap().proxy.as_ref().unwrap().footage.path), dir.join("proxy.png"));
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/engine/src/footage_check.rs b/crates/engine/src/footage/footage_check.rs
similarity index 87%
rename from crates/engine/src/footage_check.rs
rename to crates/engine/src/footage/footage_check.rs
index 6bb803f0d..42401d195 100644
--- a/crates/engine/src/footage_check.rs
+++ b/crates/engine/src/footage/footage_check.rs
@@ -12,17 +12,13 @@
 //! starts it after every open ([`Session::check_footage_on_open`]); agents and the CLI run it
 //! with `wait: true`.
 
-use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind};
+#[cfg(test)]
+use effectcraft_project::ItemKind;
+use effectcraft_project::{Footage, FootageKind, ItemId};
 use serde_json::{Value, json};
 
 use crate::Session;
 
-/// One item to check.
-struct Job {
-    id: ItemId,
-    footage: Footage,
-}
-
 /// What the check found for one item.
 enum Found {
     Missing(bool),
@@ -34,16 +30,7 @@ enum Found {
 /// Start the check (all footage, or `items`). `wait` runs it to completion first (always on
 /// wasm32); the result is then `{checked, missing, probed}`.
 pub fn start(s: &mut Session, items: Option<Vec<ItemId>>, wait: bool) -> crate::Result<Value> {
-    let jobs: Vec<Job> = s
-        .project
-        .items
-        .values()
-        .filter(|i| items.as_ref().is_none_or(|v| v.contains(&i.id)))
-        .filter_map(|i| match &i.kind {
-            ItemKind::Footage(f) if f.kind != FootageKind::Data => Some(Job { id: i.id, footage: f.clone() }),
-            _ => None,
-        })
-        .collect();
+    let jobs: Vec<_> = super::availability::sources(s).into_iter().filter(|j| items.as_ref().is_none_or(|v| v.contains(&j.id))).collect();
     if jobs.is_empty() {
         return Ok(json!({"checked": 0, "missing": 0, "probed": 0}));
     }
@@ -54,7 +41,7 @@ pub fn start(s: &mut Session, items: Option<Vec<ItemId>>, wait: bool) -> crate::
     let project_dir = s.path.as_deref().and_then(crate::commands::relink_moved::project_dir);
     let n = jobs.len();
     s.spawn_task("footageCheck", format!("Checking footage ({n} items)"), wait, move |ctl| {
-        let mut found: Vec<(ItemId, Found)> = Vec::with_capacity(jobs.len());
+        let mut found: Vec<(super::availability::Source, Found)> = Vec::with_capacity(jobs.len());
         let total = jobs.len() as u64;
         for (k, j) in jobs.into_iter().enumerate() {
             if !ctl.progress(k as u64, total) {
@@ -74,10 +61,11 @@ pub fn start(s: &mut Session, items: Option<Vec<ItemId>>, wait: bool) -> crate::
                 };
             // Moved with the project: the same place under the project's folder.
             if !present
+                && !j.proxy
                 && let Some(dir) = &project_dir
                 && let Some(nf) = crate::commands::relink_moved::find_moved(services.as_ref(), dir, f)
             {
-                found.push((j.id, Found::Moved(Box::new(nf))));
+                found.push((j, Found::Moved(Box::new(nf))));
                 continue;
             }
             // Saved without metadata (a hand-written or converted project): probe it now.
@@ -102,9 +90,9 @@ pub fn start(s: &mut Session, items: Option<Vec<ItemId>>, wait: bool) -> crate::
                 Some(Ok(mut nf)) => {
                     nf.alpha = f.alpha;
                     nf.loop_count = f.loop_count;
-                    found.push((j.id, Found::Probed(Box::new(nf))));
+                    found.push((j, Found::Probed(Box::new(nf))));
                 }
-                _ => found.push((j.id, Found::Missing(!present))),
+                _ => found.push((j, Found::Missing(!present))),
             }
         }
         ctl.progress(total, total);
@@ -115,12 +103,11 @@ pub fn start(s: &mut Session, items: Option<Vec<ItemId>>, wait: bool) -> crate::
 
 /// Write the findings into the project. Not an undo step: it records the state of the disk,
 /// not an edit (the same as After Effects marking footage missing at open).
-fn apply(s: &mut Session, found: Vec<(ItemId, Found)>) -> Value {
+fn apply(s: &mut Session, found: Vec<(super::availability::Source, Found)>) -> Value {
     let checked = found.len();
     let (mut missing, mut probed, mut moved, mut changed) = (0, 0, 0, false);
-    let p = std::sync::Arc::make_mut(&mut s.project);
-    for (id, f) in found {
-        let Some(ItemKind::Footage(cur)) = p.item_mut(id).map(|i| &mut i.kind) else { continue };
+    for (source, f) in found {
+        let Some(cur) = source.current(std::sync::Arc::make_mut(&mut s.project)) else { continue };
         match f {
             Found::Missing(m) => {
                 missing += usize::from(m);
@@ -277,6 +264,24 @@ mod tests {
         let _ = std::fs::remove_dir_all(d);
     }
 
+    #[test]
+    fn moved_source_recovery_survives_a_watcher_status_update() {
+        let mut s = session_with(&["/old/project/plate.png"]);
+        s.mark_saved();
+        let source = super::super::availability::sources(&s).pop().unwrap();
+        let id = source.id;
+        let mut recovered = source.footage.clone();
+        recovered.path = "/new/project/plate.png".into();
+        let observed = super::super::availability::prepare(&s.project, std::slice::from_ref(&source), &[true]).unwrap();
+        assert!(observed.apply(&mut s));
+        assert!(matches!(&s.project.item(id).unwrap().kind, ItemKind::Footage(f) if f.missing));
+        let result = apply(&mut s, vec![(source, Found::Moved(Box::new(recovered)))]);
+        assert_eq!(result, json!({"checked": 1, "missing": 0, "probed": 0, "relinked": 1}));
+        assert!(matches!(&s.project.item(id).unwrap().kind, ItemKind::Footage(f) if !f.missing && f.path == "/new/project/plate.png"));
+        assert!(!s.is_dirty());
+        assert!(s.history.undo.is_empty());
+    }
+
     #[test]
     fn open_starts_the_check_when_asked() {
         let mut s = session_with(&["/nonexistent/ec/a.mov"]);
diff --git a/crates/engine/src/footage/footage_reload.rs b/crates/engine/src/footage/footage_reload.rs
new file mode 100644
index 000000000..5a0576f10
--- /dev/null
+++ b/crates/engine/src/footage/footage_reload.rs
@@ -0,0 +1,856 @@
+//! Footage that changed on disk: File ▸ Reload Footage (Cmd+Alt+L) and Settings ▸ Import ▸
+//! Reload Footage Changed on Disk.
+//!
+//! Reloading re-reads what the file decides (its size, a movie's duration, streams and frame
+//! rate, the codec, a data file's text) and keeps what the project decided: the Photoshop layer
+//! or PDF page an item shows and its interpretation (alpha, conformed frame rate, pixel aspect,
+//! fields, colour). A Photoshop layer is found again by name when layers were added or removed
+//! around it. The media layer then forgets the file and the layer cache is emptied, so the next
+//! render reads the new pixels; File ▸ Reload Footage also deletes the disk cache entries made of
+//! the file (#3184).
+//!
+//! The automatic part compares each footage file's size and modification time with what they
+//! were when the file was last seen. The desktop app keeps a [`Watcher`]: a worker thread that
+//! stamps the files every two seconds while the window is in front (every ten seconds while it
+//! is not, and at once when it comes back to the front) and wakes the interface only when a stamp
+//! changed, so a file on a slow network share never holds up the interface and an idle app never
+//! redraws for footage that didn't change; `footage.reloadChanged` takes the stamps on the spot
+//! (CLI, agents, tests). Like the footage check after File ▸ Open, an automatic reload records
+//! the state of the disk: it is not an undo step and doesn't modify the project.
+
+use std::collections::BTreeSet;
+
+use super::availability::{self, Source};
+use std::sync::mpsc::{Receiver, RecvTimeoutError, SyncSender};
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::Duration;
+
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, SourceLayer};
+use serde_json::{Value, json};
+
+use crate::{Services, Session};
+
+/// A file's size and modification time (see [`crate::Services::stamp`]).
+pub type Stamp = (u64, u128);
+
+/// The stamps of a set of files, in path order.
+pub type Stamps = Vec<(String, Option<Stamp>)>;
+
+/// The files footage items read: each item's file and every frame of an image sequence. Image
+/// sequences count only with Automatically Reload Footage set to All Footage (After Effects'
+/// default, Non-Sequence Footage, leaves them alone: thousands of frames on a share add up).
+/// Items with a stored path that is not followed ([`crate::doc_path`]) are not watched.
+fn reload_paths(s: &Session) -> BTreeSet<String> {
+    let sequences = s.prefs.import.auto_reload_footage == "all";
+    let mut paths = BTreeSet::new();
+    for it in s.project.items.values() {
+        if let ItemKind::Footage(f) = &it.kind {
+            if (!f.sequence.is_empty() && !sequences) || s.stored_paths.check(f).is_err() {
+                continue;
+            }
+            if !f.path.is_empty() {
+                paths.insert(f.path.clone());
+            }
+            paths.extend(f.sequence.iter().cloned());
+        }
+    }
+    paths
+}
+
+/// Automatic reload obeys Off; explicit Reload Changed still uses eligible non-sequence files.
+fn automatic_paths(s: &Session) -> BTreeSet<String> {
+    if s.prefs.import.auto_reload_footage == "off" { BTreeSet::new() } else { reload_paths(s) }
+}
+
+/// Embedded data is excluded from availability warnings, but its external file can still be
+/// reloaded. Compare these paths without cloning sequences during unrelated project edits.
+fn data_paths(project: &effectcraft_project::Project) -> impl Iterator<Item = (ItemId, &str, &[String])> {
+    project.items.values().filter_map(|item| match &item.kind {
+        ItemKind::Footage(f) if f.kind == FootageKind::Data => Some((item.id, f.path.as_str(), f.sequence.as_slice())),
+        _ => None,
+    })
+}
+
+/// Files and source identities watched by the single background disk worker.
+#[derive(Clone, Default)]
+pub struct Watched {
+    reload: BTreeSet<String>,
+    sources: Arc<Vec<Source>>,
+    project: Option<Arc<effectcraft_project::Project>>,
+    reload_mode: String,
+    stored_paths: crate::doc_path::StoredPaths,
+}
+
+impl PartialEq for Watched {
+    /// Compare watched inputs, excluding unrelated project edits whose latest Arc is refreshed
+    /// separately without waking the worker or restarting partial sequence scans.
+    fn eq(&self, other: &Self) -> bool {
+        self.stored_paths == other.stored_paths
+            && self.reload_mode == other.reload_mode
+            && self.reload == other.reload
+            && (Arc::ptr_eq(&self.sources, &other.sources) || self.sources == other.sources)
+    }
+}
+
+/// Capture the automatic reload policy and opted-in availability sources for a worker.
+/// Watcher::update reuses this source inventory when only unrelated project state changed.
+pub fn watched(s: &Session) -> Watched {
+    Watched {
+        reload: automatic_paths(s),
+        sources: Arc::new(if s.check_footage_on_open { availability::sources(s) } else { Vec::new() }),
+        project: Some(s.project.clone()),
+        reload_mode: s.prefs.import.auto_reload_footage.clone(),
+        stored_paths: s.stored_paths.clone(),
+    }
+}
+
+impl Watched {
+    /// A worker may sleep indefinitely only when neither content nor availability is watched.
+    fn is_empty(&self) -> bool {
+        self.reload.is_empty() && self.sources.is_empty()
+    }
+    /// Complete the synchronous pass used by explicit commands. Automatic availability uses
+    /// Scanner::poll instead, so long sequences cannot consume an unbounded polling pass.
+    fn scan(&self, services: &dyn Services) -> Observation {
+        Observation { stamps: self.reload.iter().map(|p| (p.clone(), services.stamp(p))).collect(), missing: availability::scan(&self.sources, services) }
+    }
+}
+
+#[derive(Clone, PartialEq)]
+struct Observation {
+    stamps: Stamps,
+    missing: Vec<bool>,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum ReloadPolicy {
+    Automatic,
+    Manual,
+}
+
+/// A complete disk observation paired with the sources that were actually checked.
+pub struct Scan {
+    watched: Watched,
+    observation: Observation,
+    update: Option<availability::Update>,
+    policy: ReloadPolicy,
+}
+
+impl Scan {
+    /// Prepare the availability change before the session applies the observation.
+    /// Automatic callers construct this result on the worker; explicit commands run inline.
+    fn new(watched: Watched, observation: Observation, policy: ReloadPolicy) -> Self {
+        let update = watched.project.as_ref().and_then(|p| availability::prepare(p, &watched.sources, &observation.missing));
+        Self { watched, observation, update, policy }
+    }
+
+    /// Apply a current observation, returning `stale: true` when its project needs rechecking.
+    /// Availability-only scans preserve manual reload stamps; eligible content changes still
+    /// follow the existing reload/probe path and return its contextual errors.
+    pub fn apply(self, s: &mut Session) -> crate::Result<Value> {
+        if let Some(update) = self.update
+            && !update.apply(s)
+        {
+            return Ok(json!({"files": 0, "reloaded": 0, "stale": true}));
+        }
+        // Availability-only scans must preserve the baseline used by the manual command.
+        // A scan captured before automatic reload was disabled must not reload stale paths.
+        if self.policy == ReloadPolicy::Automatic && (self.watched.reload_mode == "off" || s.prefs.import.auto_reload_footage == "off") {
+            return Ok(json!({"files": 0, "reloaded": 0}));
+        }
+        let current = match self.policy {
+            ReloadPolicy::Automatic => automatic_paths(s),
+            ReloadPolicy::Manual => reload_paths(s),
+        };
+        let stamps = self.observation.stamps.into_iter().filter(|(p, _)| current.contains(p)).collect();
+        apply_stamps(s, stamps)
+    }
+}
+
+/// Size and position in the stack of Photoshop layer `l` in the file at `path` now: the layer
+/// at its recorded index when the name still matches, else the first layer with its name.
+fn psd_layer(s: &Session, path: &str, l: &SourceLayer) -> Option<(u32, Option<(u32, u32)>)> {
+    let psd = effectcraft_psd::Psd::parse(s.services.read_file(path).ok()?).ok()?;
+    let found = psd.layers.get(l.index as usize).filter(|x| x.name == l.name).or_else(|| psd.layers.iter().find(|x| x.name == l.name))?;
+    let size = (!found.rect.is_empty()).then(|| (found.rect.width(), found.rect.height()));
+    Some((u32::try_from(found.index).ok()?, size))
+}
+
+/// The pixel size of vector footage `f` as its file is now (its page, framing and layer), or
+/// `None` when the file cannot be read or shows nothing.
+fn vector_size(s: &Session, f: &Footage) -> Option<(u32, u32)> {
+    let bytes = s.services.read_file(&f.path).ok()?;
+    let doc = crate::vector::footage_doc(f, &bytes)?.ok()?;
+    (!doc.root.children.is_empty()).then(|| doc.pixel_size())
+}
+
+/// Footage `f` as its file is now, given the importer's fresh look at the file (`probed`).
+fn refreshed(s: &Session, f: &Footage, probed: Footage) -> Footage {
+    let mut nf = f.clone();
+    nf.missing = false;
+    // An image sequence picks up frames added to (or removed from) its run; its frame rate and
+    // order are the interpretation's.
+    if f.kind == FootageKind::Sequence {
+        if probed.kind == FootageKind::Sequence {
+            (nf.sequence, nf.width, nf.height) = (probed.sequence, probed.width, probed.height);
+            nf.sync_sequence_duration();
+        }
+        return nf;
+    }
+    nf.codec = probed.codec;
+    nf.has_video = probed.has_video;
+    nf.has_audio = probed.has_audio;
+    // The markers the file carries now (a WAV's cue points), for Update Markers From Source.
+    nf.markers = probed.markers;
+    if matches!(f.kind, FootageKind::Video | FootageKind::Audio) {
+        nf.duration = probed.duration;
+        // Interpret Footage ▸ Conform to frame rate stays; the file's own rate is refreshed.
+        match f.native_rate {
+            Some(_) => nf.native_rate = Some(probed.native_rate.unwrap_or(probed.frame_rate)),
+            None => nf.frame_rate = probed.frame_rate,
+        }
+    }
+    if f.kind == FootageKind::Data {
+        nf.data = probed.data;
+    }
+    let (mut w, mut h) = (probed.width, probed.height);
+    match &f.layer {
+        // A smart object's size is its embedded file's, recorded at import.
+        Some(l) if l.embedded.is_some() => (w, h) = (f.width, f.height),
+        Some(_) if crate::vector::is_vector(f) => (w, h) = vector_size(s, f).unwrap_or((f.width, f.height)),
+        Some(l) => match psd_layer(s, &f.path, l) {
+            Some((index, size)) => {
+                if let Some(nl) = nf.layer.as_mut() {
+                    nl.index = index;
+                }
+                // Retain Layer Sizes: the layer's own bounds; otherwise the document's.
+                if l.layer_size {
+                    (w, h) = size.unwrap_or((f.width, f.height));
+                }
+            }
+            // The layer is gone from the file: keep the item as it was.
+            None => (w, h) = (f.width, f.height),
+        },
+        // A placed page of an After Effects project keeps the size After Effects stored: the
+        // layers' anchors and masks are measured against it, and the page is drawn to fill it
+        // (the probe would measure the page as a viewer frames it, #3099).
+        None if f.placed_page => (w, h) = (f.width, f.height),
+        // A later page of a PDF: the probe measures the first page.
+        None if f.page != 0 => (w, h) = (f.width, f.height),
+        None => {}
+    }
+    (nf.width, nf.height) = (w, h);
+    nf
+}
+
+/// Reload footage items `ids` from their files (File ▸ Reload Footage): an undo step; items
+/// whose file can't be read are marked missing. Returns how many items were reloaded.
+pub fn reload_items(s: &mut Session, ids: &[ItemId]) -> crate::Result<usize> {
+    Ok(reload(s, ids, true)?.0)
+}
+
+/// Reload items `ids`. `undoable` makes it an edit; otherwise it records the disk without
+/// modifying the project, and an item whose file can't be read now (another app is still
+/// writing it) is left as it was. Returns the number reloaded and the files that couldn't be read
+/// (only without `undoable`).
+fn reload(s: &mut Session, ids: &[ItemId], undoable: bool) -> crate::Result<(usize, BTreeSet<String>)> {
+    let Some(importer) = s.importer.clone() else {
+        return Err(crate::EngineError::Other("media import is not available in this build".into()));
+    };
+    let mut updates = vec![];
+    let mut paths = BTreeSet::new();
+    let mut failed = BTreeSet::new();
+    for i in ids {
+        if let Some(ItemKind::Footage(f)) = s.project.item(*i).map(|x| &x.kind) {
+            // A sequence is probed the way it imports by default, so its run is found again; any
+            // other item is its one file, not the run a numbered still sits in (#2074). A path
+            // that is not followed is not read.
+            let probed = s
+                .stored_paths
+                .check(f)
+                .map_err(|(p, why)| crate::doc_path::refusal(&p, why))
+                .and_then(|_| if f.kind == FootageKind::Sequence { s.probe_footage(&f.path) } else { importer.probe(&f.path) });
+            let nf = match probed {
+                Ok(p) => refreshed(s, f, p),
+                Err(_) if undoable => Footage { missing: true, ..f.clone() },
+                Err(_) => {
+                    failed.insert(f.path.clone());
+                    continue;
+                }
+            };
+            paths.insert(f.path.clone());
+            paths.extend(f.sequence.iter().chain(&nf.sequence).cloned());
+            updates.push((*i, nf));
+        }
+    }
+    let n = updates.len();
+    apply_reloads(s, updates, undoable)?;
+    forget_media(s, &paths);
+    // An explicit reload also reads files again that kept their size and time (the check on hit
+    // can't tell those apart): their entries in the disk cache go (#3184), when the cache is
+    // switched on if it is off now. An automatic one only follows a changed stamp, which the
+    // check catches.
+    if undoable {
+        match &s.disk_cache {
+            Some(dc) => dc.drop_files(paths.iter().map(String::as_str)),
+            None => s.pending_disk_drops.extend(paths),
+        }
+    }
+    Ok((n, failed))
+}
+
+/// Puts reloaded footage into the project: an undoable edit, or (not undoable) a disk change
+/// that leaves the project's dirty state as it was.
+fn apply_reloads(s: &mut Session, updates: Vec<(ItemId, Footage)>, undoable: bool) -> crate::Result<()> {
+    if undoable {
+        s.edit("Reload Footage", None, |proj, _| {
+            for (i, f) in updates {
+                if let Some(it) = proj.item_mut(i) {
+                    it.kind = ItemKind::Footage(f);
+                }
+            }
+            Ok(())
+        })?;
+    } else {
+        let p = Arc::make_mut(&mut s.project);
+        let mut changed = false;
+        for (i, f) in updates {
+            if let Some(it) = p.item_mut(i)
+                && !matches!(&it.kind, ItemKind::Footage(cur) if *cur == f)
+            {
+                it.kind = ItemKind::Footage(f);
+                changed = true;
+            }
+        }
+        if changed {
+            let dirty = s.is_dirty();
+            s.bump();
+            if !dirty {
+                // Only the disk changed: the project isn't modified.
+                s.mark_saved();
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Make the media layer and the layer cache let go of `paths`, so renders read them again. Disk
+/// cache entries check the files they were made of when read (#3184); File ▸ Reload Footage
+/// also drops the entries of its files ([`reload`]).
+pub(crate) fn forget_media(s: &mut Session, paths: &BTreeSet<String>) {
+    for p in paths {
+        s.footage.forget(p);
+    }
+    s.layer_cache.clear();
+    s.events.push(crate::Event::PurgeCaches);
+}
+
+/// Compare fresh stamps of the watched files with the ones last seen. A file seen for the first
+/// time is only remembered; one whose stamp moved is reloaded: the items reading it get their
+/// size and duration from it again and its pixels are read again. A file that can't be stamped
+/// right now (an app saving by delete and rename) keeps its last stamp, and one that can't be
+/// read (still being written) is tried again once it changes again; missing files are left to
+/// the footage check. Returns `{files, reloaded}`.
+pub fn apply_stamps(s: &mut Session, now: Vec<(String, Option<Stamp>)>) -> crate::Result<Value> {
+    let before = std::mem::take(&mut s.footage_stamps);
+    let mut changed = BTreeSet::new();
+    // Only what is watched now is remembered (files no longer used are dropped).
+    for (path, stamp) in now {
+        match (before.get(&path), stamp) {
+            (Some(old), None) => {
+                s.footage_stamps.insert(path, *old);
+            }
+            (old, Some(stamp)) => {
+                if old.is_some_and(|o| *o != stamp) {
+                    changed.insert(path.clone());
+                }
+                s.footage_stamps.insert(path, stamp);
+            }
+            (None, None) => {}
+        }
+    }
+    if changed.is_empty() {
+        return Ok(json!({"files": 0, "reloaded": 0}));
+    }
+    let ids: Vec<ItemId> = s.project.items.values().filter(|i| matches!(&i.kind, ItemKind::Footage(f) if changed.contains(&f.path))).map(|i| i.id).collect();
+    let (reloaded, failed) = if ids.is_empty() { (0, BTreeSet::new()) } else { reload(s, &ids, false)? };
+    // Not readable (still being written, or not a file the importer reads): its new stamp is kept,
+    // so it is tried again once it changes again, not on every look.
+    for p in &failed {
+        changed.remove(p);
+    }
+    if changed.is_empty() {
+        return Ok(json!({"files": 0, "reloaded": 0}));
+    }
+    // Changed frames of image sequences (their items keep their metadata).
+    forget_media(s, &changed);
+    let files = changed.len();
+    s.toast(if reloaded > 0 {
+        format!("Reloaded {reloaded} footage item(s) changed on disk")
+    } else {
+        format!("Reloaded {files} footage file(s) changed on disk")
+    });
+    Ok(json!({"files": files, "reloaded": reloaded}))
+}
+
+/// `footage.reloadChanged`: stamp the watched files now and reload the ones that changed.
+pub(crate) fn command(s: &mut Session, _: &Value) -> crate::Result<Value> {
+    let services = s.services.clone();
+    let watched = Watched {
+        reload: reload_paths(s),
+        sources: Arc::new(availability::sources(s)),
+        project: Some(s.project.clone()),
+        reload_mode: s.prefs.import.auto_reload_footage.clone(),
+        stored_paths: s.stored_paths.clone(),
+    };
+    let observation = watched.scan(services.as_ref());
+    Scan::new(watched, observation, ReloadPolicy::Manual).apply(s)
+}
+
+/// How often the watched files are stamped while the window is in front.
+pub const FOCUSED_INTERVAL: Duration = Duration::from_secs(2);
+/// How often they are stamped while another app has the front: a file saved there is noticed
+/// as soon as the window comes back, so this only covers a second screen.
+pub const UNFOCUSED_INTERVAL: Duration = Duration::from_secs(10);
+
+#[derive(Default)]
+struct Watch {
+    paths: Watched,
+    focused: bool,
+    recheck: bool,
+}
+
+/// The desktop app's footage watcher: a worker thread that stamps the watched files and hands
+/// the stamps over ([`Watcher::take`]) only when one of them changed since it last looked,
+/// waking the interface through the callback given to [`Watcher::start`]. The interface tells it
+/// what to watch and whether the window is in front; nothing watched means the thread sleeps.
+/// Dropping the watcher ends the thread.
+pub struct Watcher {
+    tx: SyncSender<()>,
+    pending: Arc<Mutex<Watch>>,
+    result: Arc<Mutex<Option<Scan>>>,
+    paths: Watched,
+    focused: Option<bool>,
+}
+
+impl Watcher {
+    /// Start the worker, stamping through `services`; `wake` runs on the worker whenever new
+    /// stamps are ready to [`Watcher::take`]. `None` where there are no threads (the web app,
+    /// whose footage lives in browser storage) or one couldn't be started.
+    pub fn start(services: Arc<dyn Services>, wake: impl Fn() + Send + Sync + 'static) -> Option<Watcher> {
+        Self::start_with(services, wake, FOCUSED_INTERVAL, UNFOCUSED_INTERVAL)
+    }
+
+    /// [`Watcher::start`] with its own stamping intervals (tests).
+    pub fn start_with(services: Arc<dyn Services>, wake: impl Fn() + Send + Sync + 'static, focused: Duration, unfocused: Duration) -> Option<Watcher> {
+        if cfg!(target_arch = "wasm32") {
+            return None;
+        }
+        let (tx, rx) = std::sync::mpsc::sync_channel(1);
+        let pending = Arc::new(Mutex::new(Watch { focused: true, ..Default::default() }));
+        let input = pending.clone();
+        let result: Arc<Mutex<Option<Scan>>> = Arc::default();
+        let out = Arc::clone(&result);
+        std::thread::Builder::new().name("footage-watch".into()).spawn(move || watch(&rx, &input, &*services, &out, &wake, focused, unfocused)).ok()?;
+        Some(Watcher { tx, pending, result, paths: Watched::default(), focused: None })
+    }
+
+    /// Refresh the project snapshot after an edit without rebuilding sequence paths or waking
+    /// the worker when the sources, path provenance and reload policy are unchanged.
+    pub fn update(&mut self, s: &Session) {
+        let same_sources = availability::sources_match(s, &self.paths.sources);
+        let same_data = self.paths.project.as_ref().is_some_and(|before| data_paths(before).eq(data_paths(&s.project)));
+        if same_sources && same_data && self.paths.stored_paths == s.stored_paths && self.paths.reload_mode == s.prefs.import.auto_reload_footage {
+            let project = Some(s.project.clone());
+            self.paths.project = project.clone();
+            self.pending.lock().unwrap_or_else(PoisonError::into_inner).paths.project = project;
+        } else {
+            self.set_watched(watched(s));
+        }
+    }
+
+    /// The files to watch ([`watched`]); a changed set is stamped at once.
+    pub fn set_watched(&mut self, paths: Watched) {
+        let changed = paths != self.paths;
+        self.paths = paths.clone();
+        self.pending.lock().unwrap_or_else(PoisonError::into_inner).paths = paths;
+        if changed {
+            let _ = self.tx.try_send(());
+        }
+    }
+
+    /// An observation raced with an edit: refresh from the latest snapshot, through the same
+    /// bounded queue. Unrelated edits update the snapshot without waking or rescanning.
+    pub fn recheck(&self) {
+        self.pending.lock().unwrap_or_else(PoisonError::into_inner).recheck = true;
+        let _ = self.tx.try_send(());
+    }
+
+    /// Whether the window is in front; coming back to the front stamps the files at once.
+    pub fn set_focused(&mut self, focused: bool) {
+        if self.focused != Some(focused) {
+            self.focused = Some(focused);
+            self.pending.lock().unwrap_or_else(PoisonError::into_inner).focused = focused;
+            let _ = self.tx.try_send(());
+        }
+    }
+
+    /// Stamps the worker found changed (or the first ones for a new set of files), once; for
+    /// [`apply_stamps`]. `None` while nothing changed.
+    pub fn take(&self) -> Option<Scan> {
+        self.result.lock().unwrap_or_else(PoisonError::into_inner).take().filter(|s| s.watched == self.paths)
+    }
+}
+
+/// The watcher's worker: wait for a message or the interval, stamp, report only changes.
+fn watch(
+    rx: &Receiver<()>,
+    pending: &Mutex<Watch>,
+    services: &dyn Services,
+    out: &Mutex<Option<Scan>>,
+    wake: &(dyn Fn() + Send + Sync),
+    focused_every: Duration,
+    unfocused_every: Duration,
+) {
+    let mut paths = Watched::default();
+    let mut focused = true;
+    let mut last: Option<Observation> = None;
+    let mut scanner = availability::Scanner::default();
+    loop {
+        let msg = if paths.is_empty() {
+            rx.recv().map_err(|_| RecvTimeoutError::Disconnected)
+        } else {
+            rx.recv_timeout(if focused { focused_every } else { unfocused_every })
+        };
+        if matches!(msg, Err(RecvTimeoutError::Disconnected)) {
+            return;
+        }
+        let mut next = pending.lock().unwrap_or_else(PoisonError::into_inner);
+        let changed = next.paths != paths;
+        let regained = next.focused && !focused;
+        focused = next.focused;
+        let recheck = std::mem::take(&mut next.recheck);
+        paths = next.paths.clone();
+        if changed {
+            scanner.reset(&paths.sources);
+        }
+        if changed || recheck {
+            last = None;
+        }
+        drop(next);
+        if msg.is_ok() && !changed && !regained && !recheck {
+            continue;
+        }
+        if paths.is_empty() {
+            continue;
+        }
+        let stamps =
+            Observation { stamps: paths.reload.iter().map(|p| (p.clone(), services.stamp(p))).collect(), missing: scanner.poll(&paths.sources, services) };
+        if last.as_ref() != Some(&stamps) {
+            last = Some(stamps.clone());
+            *out.lock().unwrap_or_else(PoisonError::into_inner) = Some(Scan::new(paths.clone(), stamps, ReloadPolicy::Automatic));
+            wake();
+        }
+    }
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod watcher_tests {
+    use std::collections::HashMap;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    use super::*;
+
+    /// Files whose stamps the test sets; counts how often they were stamped.
+    #[derive(Default)]
+    struct Disk {
+        stamps: Mutex<HashMap<String, Stamp>>,
+        looks: AtomicUsize,
+    }
+    impl Disk {
+        fn set(&self, path: &str, stamp: Stamp) {
+            self.stamps.lock().unwrap_or_else(PoisonError::into_inner).insert(path.into(), stamp);
+        }
+    }
+    impl Services for Disk {
+        fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+            Err(std::io::Error::new(std::io::ErrorKind::NotFound, path.to_string()))
+        }
+        fn write_file(&self, _: &str, _: &[u8]) -> std::io::Result<()> {
+            Err(std::io::Error::other("read-only"))
+        }
+        fn exists(&self, path: &str) -> bool {
+            self.stamp(path).is_some()
+        }
+        fn is_dir(&self, _: &str) -> bool {
+            true
+        }
+        fn stamp(&self, path: &str) -> Option<Stamp> {
+            self.looks.fetch_add(1, Ordering::SeqCst);
+            self.stamps.lock().unwrap_or_else(PoisonError::into_inner).get(path).copied()
+        }
+    }
+
+    const TICK: Duration = Duration::from_millis(20);
+    const LONG: Duration = Duration::from_secs(60);
+
+    fn wait_for(w: &Watcher, wakes: &AtomicUsize, n: usize) -> Stamps {
+        let t0 = std::time::Instant::now();
+        loop {
+            if wakes.load(Ordering::SeqCst) >= n
+                && let Some(s) = w.take()
+            {
+                return s.observation.stamps;
+            }
+            assert!(t0.elapsed() < Duration::from_secs(10), "no report {n} within 10 s");
+            std::thread::sleep(Duration::from_millis(5));
+        }
+    }
+
+    /// Wait (at most 10 s) until `ready`: a slow machine's worker gets there late, never early.
+    fn wait_until(what: &str, mut ready: impl FnMut() -> bool) {
+        let t0 = std::time::Instant::now();
+        while !ready() {
+            assert!(t0.elapsed() < Duration::from_secs(10), "{what} within 10 s");
+            std::thread::sleep(Duration::from_millis(5));
+        }
+    }
+
+    fn start(disk: &Arc<Disk>, focused: Duration, unfocused: Duration) -> Option<(Watcher, Arc<AtomicUsize>)> {
+        let wakes = Arc::new(AtomicUsize::new(0));
+        let counter = Arc::clone(&wakes);
+        let w = Watcher::start_with(
+            Arc::clone(disk) as Arc<dyn Services>,
+            move || {
+                counter.fetch_add(1, Ordering::SeqCst);
+            },
+            focused,
+            unfocused,
+        )?;
+        Some((w, wakes))
+    }
+
+    /// The interface is woken for the first stamps of a set and for every change, and for
+    /// nothing else: an unchanged file polled many times is no wakeup at all.
+    #[test]
+    fn the_watcher_wakes_the_interface_only_when_a_stamp_changes() {
+        let disk = Arc::new(Disk::default());
+        disk.set("/a.psd", (10, 1));
+        let (mut w, wakes) = start(&disk, TICK, LONG).unwrap();
+        w.set_focused(true);
+        w.set_watched(Watched { reload: ["/a.psd".to_string()].into(), ..Default::default() });
+        assert_eq!(wait_for(&w, &wakes, 1), vec![("/a.psd".to_string(), Some((10, 1)))]);
+        let looked = disk.looks.load(Ordering::SeqCst);
+        wait_until("it keeps stamping while the window is in front", || disk.looks.load(Ordering::SeqCst) > looked + 3);
+        assert_eq!(wakes.load(Ordering::SeqCst), 1, "an unchanged file is no wakeup");
+        assert!(w.take().is_none());
+        disk.set("/a.psd", (12, 2));
+        assert_eq!(wait_for(&w, &wakes, 2), vec![("/a.psd".to_string(), Some((12, 2)))]);
+        assert_eq!(wakes.load(Ordering::SeqCst), 2);
+    }
+
+    #[test]
+    fn watcher_detects_disconnect_and_return_even_when_automatic_reload_is_off() {
+        let disk = Arc::new(Disk::default());
+        disk.set("/live.png", (1, 1));
+        let mut s = Session { services: disk.clone(), check_footage_on_open: true, ..Default::default() };
+        s.prefs.import.auto_reload_footage = "off".into();
+        let id = Arc::make_mut(&mut s.project).add_item(
+            "Live",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { path: "/live.png".into(), width: 64, height: 32, ..Default::default() }),
+        );
+        s.mark_saved();
+        let (mut w, _) = start(&disk, TICK, TICK).unwrap();
+        w.set_watched(watched(&s));
+        disk.stamps.lock().unwrap().clear();
+        wait_until("offline warning", || {
+            if let Some(scan) = w.take() {
+                scan.apply(&mut s).unwrap();
+            }
+            s.project.item(id).unwrap().has_missing_footage()
+        });
+        disk.set("/live.png", (1, 1));
+        w.set_watched(watched(&s));
+        wait_until("reconnected file", || {
+            if let Some(scan) = w.take() {
+                scan.apply(&mut s).unwrap();
+            }
+            !s.project.item(id).unwrap().has_missing_footage()
+        });
+        assert!(!s.is_dirty());
+        assert!(s.history.undo.is_empty());
+    }
+
+    #[test]
+    fn unrelated_edits_reuse_source_snapshots_without_waking_the_worker() {
+        let disk = Arc::new(Disk::default());
+        disk.set("/plate.png", (1, 1));
+        let mut s = Session { services: disk.clone(), check_footage_on_open: true, ..Default::default() };
+        s.prefs.import.auto_reload_footage = "off".into();
+        let id = Arc::make_mut(&mut s.project).add_item(
+            "Plate",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { path: "/plate.png".into(), ..Default::default() }),
+        );
+        let (mut w, wakes) = start(&disk, LONG, LONG).unwrap();
+        w.update(&s);
+        wait_for(&w, &wakes, 1);
+        let sources = w.paths.sources.clone();
+        let looks = disk.looks.load(Ordering::SeqCst);
+        Arc::make_mut(&mut s.project).item_mut(id).unwrap().name = "Renamed".into();
+        w.update(&s);
+        assert!(Arc::ptr_eq(&sources, &w.paths.sources), "sequence snapshots are reused");
+        assert!(Arc::ptr_eq(w.pending.lock().unwrap().paths.project.as_ref().unwrap(), &s.project));
+        std::thread::sleep(TICK * 3);
+        assert_eq!(disk.looks.load(Ordering::SeqCst), looks);
+        assert_eq!(wakes.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn stale_availability_update_is_rechecked_against_the_latest_project() {
+        let disk = Arc::new(Disk::default());
+        let mut s = Session { services: disk.clone(), check_footage_on_open: true, ..Default::default() };
+        s.prefs.import.auto_reload_footage = "off".into();
+        let id = Arc::make_mut(&mut s.project).add_item(
+            "Plate",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { path: "/gone.png".into(), ..Default::default() }),
+        );
+        let (mut w, _) = start(&disk, LONG, LONG).unwrap();
+        w.update(&s);
+        let mut scan = None;
+        wait_until("first observation", || {
+            scan = w.take();
+            scan.is_some()
+        });
+        Arc::make_mut(&mut s.project).item_mut(id).unwrap().name = "Keep this edit".into();
+        assert_eq!(scan.unwrap().apply(&mut s).unwrap()["stale"], true);
+        w.update(&s);
+        w.recheck();
+        wait_until("fresh availability", || {
+            if let Some(scan) = w.take() {
+                scan.apply(&mut s).unwrap();
+            }
+            s.project.item(id).unwrap().has_missing_footage()
+        });
+        assert_eq!(s.project.item(id).unwrap().name, "Keep this edit");
+    }
+
+    #[test]
+    fn manual_reload_with_automatic_reload_off_keeps_its_baseline_and_reloads_changed_data() {
+        struct DataProbe(Arc<Disk>);
+        impl crate::Importer for DataProbe {
+            fn probe(&self, path: &str) -> std::result::Result<Footage, String> {
+                let data = if self.0.stamp(path) == Some((2, 2)) { "updated" } else { "original" };
+                Ok(Footage { path: path.into(), kind: FootageKind::Data, data: Some(data.into()), ..Default::default() })
+            }
+        }
+        let disk = Arc::new(Disk::default());
+        disk.set("/data.csv", (1, 1));
+        let mut s = Session { services: disk.clone(), importer: Some(Arc::new(DataProbe(disk.clone()))), ..Default::default() };
+        s.prefs.import.auto_reload_footage = "off".into();
+        let id = Arc::make_mut(&mut s.project).add_item(
+            "Data",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { path: "/data.csv".into(), kind: FootageKind::Data, data: Some("original".into()), ..Default::default() }),
+        );
+        assert_eq!(s.execute("footage.reloadChanged", json!({})).unwrap(), json!({"files": 0, "reloaded": 0}));
+        let baseline = s.footage_stamps.clone();
+        assert_eq!(baseline.get("/data.csv"), Some(&(1, 1)));
+        let off = watched(&s);
+        Scan::new(off.clone(), off.scan(disk.as_ref()), ReloadPolicy::Automatic).apply(&mut s).unwrap();
+        assert_eq!(s.footage_stamps, baseline, "availability-only scans retain the manual baseline");
+        s.prefs.import.auto_reload_footage = "nonSequence".into();
+        disk.set("/data.csv", (2, 2));
+        let old = watched(&s);
+        let pending = Scan::new(old.clone(), old.scan(disk.as_ref()), ReloadPolicy::Automatic);
+        s.prefs.import.auto_reload_footage = "off".into();
+        assert_eq!(pending.apply(&mut s).unwrap(), json!({"files": 0, "reloaded": 0}));
+        assert_eq!(s.footage_stamps, baseline, "a stale automatic result cannot reload or erase the baseline");
+        assert_eq!(s.execute("footage.reloadChanged", json!({})).unwrap(), json!({"files": 1, "reloaded": 1}));
+        assert!(matches!(&s.project.item(id).unwrap().kind, ItemKind::Footage(f) if f.data.as_deref() == Some("updated")));
+        assert!(s.history.undo.is_empty());
+    }
+
+    #[test]
+    fn watcher_updates_external_data_paths_after_import_relink_and_removal() {
+        let disk = Arc::new(Disk::default());
+        let mut s = Session { services: disk.clone(), check_footage_on_open: true, ..Default::default() };
+        s.prefs.import.auto_reload_footage = "all".into();
+        let (mut w, wakes) = start(&disk, LONG, LONG).unwrap();
+        w.update(&s);
+        disk.set("/first.csv", (1, 1));
+        let id = Arc::make_mut(&mut s.project).add_item(
+            "Data",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { path: "/first.csv".into(), kind: FootageKind::Data, ..Default::default() }),
+        );
+        w.update(&s);
+        assert_eq!(wait_for(&w, &wakes, 1), vec![("/first.csv".into(), Some((1, 1)))]);
+        disk.set("/second.csv", (2, 2));
+        if let ItemKind::Footage(f) = &mut Arc::make_mut(&mut s.project).item_mut(id).unwrap().kind {
+            f.path = "/second.csv".into();
+        }
+        w.update(&s);
+        assert_eq!(wait_for(&w, &wakes, 2), vec![("/second.csv".into(), Some((2, 2)))]);
+        Arc::make_mut(&mut s.project).items.remove(&id);
+        w.update(&s);
+        assert!(w.paths.reload.is_empty());
+        assert!(w.pending.lock().unwrap().paths.reload.is_empty());
+    }
+
+    /// Behind another app the files are stamped only at the slow interval; the window coming
+    /// back to the front stamps them at once.
+    #[test]
+    fn behind_another_app_the_watcher_rests_until_the_window_is_back() {
+        let disk = Arc::new(Disk::default());
+        disk.set("/b.psd", (1, 1));
+        let (mut w, wakes) = start(&disk, TICK, LONG).unwrap();
+        w.set_focused(false);
+        w.set_watched(Watched { reload: ["/b.psd".to_string()].into(), ..Default::default() });
+        wait_for(&w, &wakes, 1);
+        let looked = disk.looks.load(Ordering::SeqCst);
+        disk.set("/b.psd", (2, 2));
+        std::thread::sleep(TICK * 15);
+        assert_eq!(disk.looks.load(Ordering::SeqCst), looked, "no stamping at the front interval while behind");
+        assert_eq!(wakes.load(Ordering::SeqCst), 1);
+        w.set_focused(true);
+        assert_eq!(wait_for(&w, &wakes, 2), vec![("/b.psd".to_string(), Some((2, 2)))]);
+    }
+
+    /// Nothing to watch: the worker sleeps, stamping nothing; a new set is stamped at once and
+    /// reported whole, and dropping the watcher ends the worker.
+    #[test]
+    fn nothing_watched_is_nothing_stamped_and_a_new_set_is_reported_whole() {
+        let disk = Arc::new(Disk::default());
+        disk.set("/c.psd", (1, 1));
+        disk.set("/d.psd", (2, 2));
+        let (mut w, wakes) = start(&disk, TICK, TICK).unwrap();
+        w.set_focused(true);
+        std::thread::sleep(TICK * 10);
+        assert_eq!(disk.looks.load(Ordering::SeqCst), 0);
+        w.set_watched(Watched { reload: ["/c.psd".to_string(), "/d.psd".to_string()].into(), ..Default::default() });
+        assert_eq!(wait_for(&w, &wakes, 1), vec![("/c.psd".to_string(), Some((1, 1))), ("/d.psd".to_string(), Some((2, 2)))]);
+        w.set_watched(Watched { reload: ["/d.psd".to_string()].into(), ..Default::default() });
+        assert_eq!(wait_for(&w, &wakes, 2), vec![("/d.psd".to_string(), Some((2, 2)))], "the set is reported whole, so the session forgets /c.psd");
+        w.set_watched(Watched::default());
+        // The worker may already be past its wait with the old set: that one round of stamps
+        // (one file) can still come, and nothing after it.
+        let looked = disk.looks.load(Ordering::SeqCst);
+        std::thread::sleep(TICK * 10);
+        assert!(disk.looks.load(Ordering::SeqCst) <= looked + 1, "nothing watched, nothing stamped");
+        let result = Arc::downgrade(&w.result);
+        drop(w);
+        let t0 = std::time::Instant::now();
+        while result.upgrade().is_some() {
+            assert!(t0.elapsed() < Duration::from_secs(5), "the worker is still running");
+            std::thread::sleep(Duration::from_millis(5));
+        }
+    }
+}
diff --git a/crates/engine/src/media_browser.rs b/crates/engine/src/footage/media_browser.rs
similarity index 88%
rename from crates/engine/src/media_browser.rs
rename to crates/engine/src/footage/media_browser.rs
index d22875f17..2c40fcf20 100644
--- a/crates/engine/src/media_browser.rs
+++ b/crates/engine/src/footage/media_browser.rs
@@ -197,7 +197,6 @@ fn sort_entries(entries: &mut [Entry]) {
     entries.sort_by_cached_key(|e| (!e.is_dir, e.name.to_lowercase()));
 }
 
-const VIDEO: &[&str] = &["mp4", "m4v", "mov", "webm", "mkv", "avi", "mxf", "gif"];
 const IMAGE: &[&str] = &["png", "jpg", "jpeg", "tif", "tiff", "exr", "bmp", "webp", "psd", "psb", "svg", "tga", "dpx", "cin", "hdr"];
 const AUDIO: &[&str] = &["wav", "aif", "aiff", "mp3", "m4a", "aac", "flac", "ogg", "opus"];
 const DATA: &[&str] = &["json", "csv", "tsv", "mgjson"];
@@ -207,7 +206,8 @@ const MODEL: &[&str] = &["gltf", "glb", "obj", "stl", "fbx"];
 pub fn kind_of(path: &str) -> Option<&'static str> {
     let ext = std::path::Path::new(path).extension()?.to_str()?.to_ascii_lowercase();
     let e = ext.as_str();
-    if VIDEO.contains(&e) {
+    // (An animated GIF plays as a movie.)
+    if e == "gif" || effectcraft_project::VIDEO_EXTENSIONS.contains(&e) {
         Some("video")
     } else if IMAGE.contains(&e) {
         Some("image")
@@ -264,22 +264,33 @@ pub fn parent(dir: &str) -> Option<String> {
     std::path::Path::new(dir).parent().map(|p| p.to_string_lossy().to_string()).filter(|p| !p.is_empty())
 }
 
-/// Format seconds since the epoch as an ISO 8601 UTC date-time.
+/// Format seconds since the epoch as an ISO 8601 UTC date-time. Years far outside chrono's own
+/// range are preserved (the old hand-rolled conversion kept them) rather than collapsing to the epoch.
 pub fn iso_date(secs: u64) -> String {
-    let days = (secs / 86_400) as i64;
-    let rem = secs % 86_400;
-    // Civil-from-days (Howard Hinnant's algorithm).
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z - era * 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let y = yoe + era * 400;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = if m <= 2 { y + 1 } else { y };
-    format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}Z", rem / 3600, rem % 3600 / 60, rem % 60)
+    let (y, t) = utc_parts(secs);
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", t.format("%m-%dT%H:%M:%SZ"))
+}
+
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month, day and time of day come from chrono and only the year is carried, which keeps every
+/// input exact instead of collapsing out-of-range years to the epoch. `secs` is `u64`, so `days`
+/// always fits an `i64`.
+fn utc_parts(secs: u64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = ((secs / 86_400) as i64, (secs % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
 }
 
 /// File dates and size: (created, modified, size).
@@ -420,6 +431,15 @@ mod tests {
         std::fs::remove_dir_all(&dir).unwrap();
     }
 
+    /// Every movie type the importer reads lists as video, as an animated GIF does.
+    #[test]
+    fn movies_list_as_video() {
+        for ext in effectcraft_project::VIDEO_EXTENSIONS.iter().chain(&["gif"]) {
+            assert_eq!(kind_of(&format!("/clips/A.{}", ext.to_uppercase())), Some("video"), "{ext}");
+        }
+        assert_eq!(kind_of("/clips/capture.avi"), Some("video"));
+    }
+
     #[test]
     fn virtual_tree_lists_like_a_folder() {
         let mut t = VirtualTree::default();
@@ -506,5 +526,10 @@ mod tests {
         assert_eq!(iso_date(0), "1970-01-01T00:00:00Z");
         assert_eq!(iso_date(1_700_000_000), "2023-11-14T22:13:20Z");
         assert_eq!(iso_date(951_782_400), "2000-02-29T00:00:00Z");
+        // Years far outside chrono's own range are preserved (the old hand-rolled conversion kept
+        // them) rather than collapsing to the epoch.
+        assert_eq!(iso_date(253_402_300_800), "10000-01-01T00:00:00Z");
+        assert_eq!(iso_date(10_000_000_000_000), "318857-05-20T17:46:40Z");
+        assert_eq!(iso_date(u64::MAX), "584554051223-11-09T07:00:15Z");
     }
 }
diff --git a/crates/engine/src/media_cache.rs b/crates/engine/src/footage/media_cache.rs
similarity index 100%
rename from crates/engine/src/media_cache.rs
rename to crates/engine/src/footage/media_cache.rs
diff --git a/crates/engine/src/sequence.rs b/crates/engine/src/footage/sequence.rs
similarity index 97%
rename from crates/engine/src/sequence.rs
rename to crates/engine/src/footage/sequence.rs
index c98aba1d3..fc2dab2b0 100644
--- a/crates/engine/src/sequence.rs
+++ b/crates/engine/src/footage/sequence.rs
@@ -20,7 +20,7 @@ use crate::{Importer, Services};
 /// How an import treats numbered stills.
 #[derive(Clone, Copy, Debug)]
 pub struct SequenceOptions {
-    /// The "<format> Sequence" checkbox: picked numbered stills of one run import as a sequence.
+    /// The `"<format> Sequence"` checkbox: picked numbered stills of one run import as a sequence.
     pub sequence: bool,
     /// The numbered stills inside a picked or dropped folder import as sequences.
     pub folders: bool,
@@ -44,15 +44,14 @@ impl SequenceOptions {
 
     /// `file.import`'s options. Dropped files (`drag: true`) import as stills, as in After
     /// Effects, while a folder's numbered stills import as sequences unless `sequence: false`
-    /// (Alt-drag of a folder). The Import dialog passes its "<format> Sequence" checkbox (off
-    /// unless ticked) as `sequence`. Without `sequence` or `drag` (scripts, agents) a numbered
-    /// still brings its run, as it always has.
+    /// (Alt-drag of a folder). The Import dialog passes its `"<format> Sequence"` checkbox (off
+    /// unless ticked) as `sequence`. Without `sequence` (scripts, agents) a numbered still imports
+    /// as itself, as `ImportOptions.sequence` defaults to false in After Effects (#2018).
     pub fn for_import(p: &serde_json::Value) -> SequenceOptions {
         let flag = |k: &str| p.get(k).and_then(serde_json::Value::as_bool);
         let (sequence, alphabetical) = (flag("sequence"), flag("alphabetical").unwrap_or(false));
-        let dropped = flag("drag").unwrap_or(false);
         // Force Alphabetical Order is part of the Sequence option.
-        SequenceOptions { sequence: sequence.unwrap_or(alphabetical || !dropped), folders: sequence.unwrap_or(true), alphabetical }
+        SequenceOptions { sequence: sequence.unwrap_or(alphabetical), folders: sequence.unwrap_or(true), alphabetical }
     }
 }
 
diff --git a/crates/engine/src/footage_reload.rs b/crates/engine/src/footage_reload.rs
deleted file mode 100644
index fa12b27aa..000000000
--- a/crates/engine/src/footage_reload.rs
+++ /dev/null
@@ -1,281 +0,0 @@
-//! Footage that changed on disk: File ▸ Reload Footage (Cmd+Alt+L) and Settings ▸ Import ▸
-//! Reload Footage Changed on Disk.
-//!
-//! Reloading re-reads what the file decides (its size, a movie's duration, streams and frame
-//! rate, the codec, a data file's text) and keeps what the project decided: the Photoshop layer
-//! or PDF page an item shows and its interpretation (alpha, conformed frame rate, pixel aspect,
-//! fields, colour). A Photoshop layer is found again by name when layers were added or removed
-//! around it. The media layer then forgets the file and the layer cache is emptied, so the next
-//! render reads the new pixels.
-//!
-//! The automatic part compares each footage file's size and modification time with what they
-//! were when the file was last seen. The desktop app takes those stamps every two seconds (and
-//! when its window comes back to the front) on a worker thread, so a file on a slow network share
-//! never holds up the interface ([`start_scan`], [`poll_scan`]); `footage.reloadChanged` takes them
-//! on the spot (CLI, agents, tests). Like the footage check after File ▸ Open, an automatic reload
-//! records the state of the disk: it is not an undo step and doesn't modify the project.
-
-use std::collections::BTreeSet;
-use std::sync::{Arc, Mutex};
-
-use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, SourceLayer};
-use serde_json::{Value, json};
-
-use crate::Session;
-
-/// A file's size and modification time (see [`crate::Services::stamp`]).
-pub type Stamp = (u64, u128);
-
-/// Stamps taken on a worker thread, waiting for [`poll_scan`].
-pub type Scan = Arc<Mutex<Option<Vec<(String, Option<Stamp>)>>>>;
-
-/// The files footage items read: each item's file and every frame of an image sequence. Image
-/// sequences count only with Automatically Reload Footage set to All Footage (After Effects'
-/// default, Non-Sequence Footage, leaves them alone: thousands of frames on a share add up).
-/// Items with a stored path that is not followed ([`crate::doc_path`]) are not watched.
-fn watched(s: &Session) -> BTreeSet<String> {
-    let sequences = s.prefs.import.auto_reload_footage == "all";
-    let mut paths = BTreeSet::new();
-    for it in s.project.items.values() {
-        if let ItemKind::Footage(f) = &it.kind {
-            if (!f.sequence.is_empty() && !sequences) || s.stored_paths.check(f).is_err() {
-                continue;
-            }
-            if !f.path.is_empty() {
-                paths.insert(f.path.clone());
-            }
-            paths.extend(f.sequence.iter().cloned());
-        }
-    }
-    paths
-}
-
-/// Size and position in the stack of Photoshop layer `l` in the file at `path` now: the layer
-/// at its recorded index when the name still matches, else the first layer with its name.
-fn psd_layer(s: &Session, path: &str, l: &SourceLayer) -> Option<(u32, Option<(u32, u32)>)> {
-    let psd = effectcraft_psd::Psd::parse(s.services.read_file(path).ok()?).ok()?;
-    let found = psd.layers.get(l.index as usize).filter(|x| x.name == l.name).or_else(|| psd.layers.iter().find(|x| x.name == l.name))?;
-    let size = (!found.rect.is_empty()).then(|| (found.rect.width(), found.rect.height()));
-    Some((u32::try_from(found.index).ok()?, size))
-}
-
-fn vector_size(s: &Session, f: &Footage) -> Option<(u32, u32)> {
-    let bytes = s.services.read_file(&f.path).ok()?;
-    let doc = crate::vector::vector_doc(&f.path, &bytes, f.layer.as_ref(), f.page)?.ok()?;
-    (!doc.root.children.is_empty()).then(|| doc.pixel_size())
-}
-
-/// Footage `f` as its file is now, given the importer's fresh look at the file (`probed`).
-fn refreshed(s: &Session, f: &Footage, probed: Footage) -> Footage {
-    let mut nf = f.clone();
-    nf.missing = false;
-    // An image sequence picks up frames added to (or removed from) its run; its frame rate and
-    // order are the interpretation's.
-    if f.kind == FootageKind::Sequence {
-        if probed.kind == FootageKind::Sequence {
-            (nf.sequence, nf.width, nf.height) = (probed.sequence, probed.width, probed.height);
-            nf.sync_sequence_duration();
-        }
-        return nf;
-    }
-    nf.codec = probed.codec;
-    nf.has_video = probed.has_video;
-    nf.has_audio = probed.has_audio;
-    if matches!(f.kind, FootageKind::Video | FootageKind::Audio) {
-        nf.duration = probed.duration;
-        // Interpret Footage ▸ Conform to frame rate stays; the file's own rate is refreshed.
-        match f.native_rate {
-            Some(_) => nf.native_rate = Some(probed.native_rate.unwrap_or(probed.frame_rate)),
-            None => nf.frame_rate = probed.frame_rate,
-        }
-    }
-    if f.kind == FootageKind::Data {
-        nf.data = probed.data;
-    }
-    let (mut w, mut h) = (probed.width, probed.height);
-    match &f.layer {
-        // A smart object's size is its embedded file's, recorded at import.
-        Some(l) if l.embedded.is_some() => (w, h) = (f.width, f.height),
-        Some(_) if crate::vector::is_vector(f) => (w, h) = vector_size(s, f).unwrap_or((f.width, f.height)),
-        Some(l) => match psd_layer(s, &f.path, l) {
-            Some((index, size)) => {
-                if let Some(nl) = nf.layer.as_mut() {
-                    nl.index = index;
-                }
-                // Retain Layer Sizes: the layer's own bounds; otherwise the document's.
-                if l.layer_size {
-                    (w, h) = size.unwrap_or((f.width, f.height));
-                }
-            }
-            // The layer is gone from the file: keep the item as it was.
-            None => (w, h) = (f.width, f.height),
-        },
-        // A later page of a PDF: the probe measures the first page.
-        None if f.page != 0 => (w, h) = (f.width, f.height),
-        None => {}
-    }
-    (nf.width, nf.height) = (w, h);
-    nf
-}
-
-/// Reload footage items `ids` from their files (File ▸ Reload Footage): an undo step; items
-/// whose file can't be read are marked missing. Returns how many items were reloaded.
-pub fn reload_items(s: &mut Session, ids: &[ItemId]) -> crate::Result<usize> {
-    Ok(reload(s, ids, true)?.0)
-}
-
-/// Reload items `ids`. `undoable` makes it an edit; otherwise it records the disk without
-/// modifying the project, and an item whose file can't be read now (another app is still
-/// writing it) is left as it was. Returns the number reloaded and the files that couldn't be read
-/// (only without `undoable`).
-fn reload(s: &mut Session, ids: &[ItemId], undoable: bool) -> crate::Result<(usize, BTreeSet<String>)> {
-    if s.importer.is_none() {
-        return Err(crate::EngineError::Other("media import is not available in this build".into()));
-    }
-    let mut updates = vec![];
-    let mut paths = BTreeSet::new();
-    let mut failed = BTreeSet::new();
-    for i in ids {
-        if let Some(ItemKind::Footage(f)) = s.project.item(*i).map(|x| &x.kind) {
-            // Probed the way it imports by default, so a sequence is found as one. A path that
-            // is not followed is not read.
-            let probed = s.stored_paths.check(f).map_err(|(p, why)| crate::doc_path::refusal(&p, why)).and_then(|_| s.probe_footage(&f.path));
-            let nf = match probed {
-                Ok(p) => refreshed(s, f, p),
-                Err(_) if undoable => Footage { missing: true, ..f.clone() },
-                Err(_) => {
-                    failed.insert(f.path.clone());
-                    continue;
-                }
-            };
-            paths.insert(f.path.clone());
-            paths.extend(f.sequence.iter().chain(&nf.sequence).cloned());
-            updates.push((*i, nf));
-        }
-    }
-    let n = updates.len();
-    if undoable {
-        s.edit("Reload Footage", None, |proj, _| {
-            for (i, f) in updates {
-                if let Some(it) = proj.item_mut(i) {
-                    it.kind = ItemKind::Footage(f);
-                }
-            }
-            Ok(())
-        })?;
-    } else {
-        let p = Arc::make_mut(&mut s.project);
-        let mut changed = false;
-        for (i, f) in updates {
-            if let Some(it) = p.item_mut(i)
-                && !matches!(&it.kind, ItemKind::Footage(cur) if *cur == f)
-            {
-                it.kind = ItemKind::Footage(f);
-                changed = true;
-            }
-        }
-        if changed {
-            let dirty = s.is_dirty();
-            s.bump();
-            if !dirty {
-                // Only the disk changed: the project isn't modified.
-                s.mark_saved();
-            }
-        }
-    }
-    forget(s, &paths);
-    Ok((n, failed))
-}
-
-/// Make the media layer and the layer cache let go of `paths`, so renders read them again.
-fn forget(s: &mut Session, paths: &BTreeSet<String>) {
-    for p in paths {
-        s.footage.forget(p);
-    }
-    s.layer_cache.clear();
-    s.events.push(crate::Event::PurgeCaches);
-}
-
-/// Compare fresh stamps of the watched files with the ones last seen. A file seen for the first
-/// time is only remembered; one whose stamp moved is reloaded: the items reading it get their
-/// size and duration from it again and its pixels are read again. A file that can't be stamped
-/// right now (an app saving by delete and rename) keeps its last stamp, and one that can't be
-/// read (still being written) is tried again once it changes again; missing files are left to
-/// the footage check. Returns `{files, reloaded}`.
-pub fn apply_stamps(s: &mut Session, now: Vec<(String, Option<Stamp>)>) -> crate::Result<Value> {
-    let before = std::mem::take(&mut s.footage_stamps);
-    let mut changed = BTreeSet::new();
-    // Only what is watched now is remembered (files no longer used are dropped).
-    for (path, stamp) in now {
-        match (before.get(&path), stamp) {
-            (Some(old), None) => {
-                s.footage_stamps.insert(path, *old);
-            }
-            (old, Some(stamp)) => {
-                if old.is_some_and(|o| *o != stamp) {
-                    changed.insert(path.clone());
-                }
-                s.footage_stamps.insert(path, stamp);
-            }
-            (None, None) => {}
-        }
-    }
-    if changed.is_empty() {
-        return Ok(json!({"files": 0, "reloaded": 0}));
-    }
-    let ids: Vec<ItemId> = s.project.items.values().filter(|i| matches!(&i.kind, ItemKind::Footage(f) if changed.contains(&f.path))).map(|i| i.id).collect();
-    let (reloaded, failed) = if ids.is_empty() { (0, BTreeSet::new()) } else { reload(s, &ids, false)? };
-    // Not readable (still being written, or not a file the importer reads): its new stamp is kept,
-    // so it is tried again once it changes again, not on every look.
-    for p in &failed {
-        changed.remove(p);
-    }
-    if changed.is_empty() {
-        return Ok(json!({"files": 0, "reloaded": 0}));
-    }
-    // Changed frames of image sequences (their items keep their metadata).
-    forget(s, &changed);
-    let files = changed.len();
-    s.toast(if reloaded > 0 {
-        format!("Reloaded {reloaded} footage item(s) changed on disk")
-    } else {
-        format!("Reloaded {files} footage file(s) changed on disk")
-    });
-    Ok(json!({"files": files, "reloaded": reloaded}))
-}
-
-/// `footage.reloadChanged`: stamp the watched files now and reload the ones that changed.
-pub(crate) fn command(s: &mut Session, _: &Value) -> crate::Result<Value> {
-    let services = s.services.clone();
-    let now = watched(s).into_iter().map(|p| (p.clone(), services.stamp(&p))).collect();
-    apply_stamps(s, now)
-}
-
-/// Start stamping the watched files on a worker thread, unless a scan is still running (or the
-/// build has no threads: the web app, whose footage lives in browser storage).
-pub fn start_scan(s: &mut Session) {
-    if s.footage_scan.is_some() || cfg!(target_arch = "wasm32") {
-        return;
-    }
-    let paths = watched(s);
-    if paths.is_empty() {
-        return;
-    }
-    let services = s.services.clone();
-    let slot: Scan = Arc::default();
-    let out = slot.clone();
-    let spawned = std::thread::Builder::new().name("footage-watch".into()).spawn(move || {
-        let stamps = paths.into_iter().map(|p| (p.clone(), services.stamp(&p))).collect();
-        *out.lock().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(stamps);
-    });
-    if spawned.is_ok() {
-        s.footage_scan = Some(slot);
-    }
-}
-
-/// Apply a finished scan (`None` while there is none, or it is still running).
-pub fn poll_scan(s: &mut Session) -> Option<crate::Result<Value>> {
-    let stamps = s.footage_scan.as_ref()?.lock().unwrap_or_else(std::sync::PoisonError::into_inner).take()?;
-    s.footage_scan = None;
-    Some(apply_stamps(s, stamps))
-}
diff --git a/crates/engine/src/history.rs b/crates/engine/src/history.rs
index 8b178a05c..e007d5a72 100644
--- a/crates/engine/src/history.rs
+++ b/crates/engine/src/history.rs
@@ -293,6 +293,16 @@ impl Session {
             path.push(p);
         }
         path.reverse();
+        // Across branches, the same UID can name different masks on either side. Keep only
+        // pending reveals whose masks also existed at the shared ancestor.
+        let mut common = a.current;
+        while !path.contains(&common) {
+            let Some(parent) = a.parent.get(common).copied().flatten() else { break };
+            common = parent;
+        }
+        if let Some(project) = a.state.get(common) {
+            self.retain_mask_reveals_in(project);
+        }
         // Continue past the target: the working line where it runs on, else each branch's own
         // continuation (its first child).
         let mut new_line = path.clone();
@@ -314,6 +324,9 @@ impl Session {
         }
         // Every state off the new line goes into branches: a chain per first child, the other
         // children starting branches of their own.
+        /// Adds to `out` one [`Branch`] for the off-line subtree at `start`: it follows the first
+        /// child that is not on the new history line, and records every other such child as a further
+        /// branch from the state it forked at (`parent`).
         fn chain(a: &Arena, start: usize, parent: usize, in_new: &[bool], out: &mut Vec<Branch>) {
             let mut steps = vec![];
             let mut n = start;
@@ -341,14 +354,17 @@ impl Session {
         let k = new_line.iter().position(|&i| i == target).unwrap_or(0);
         let undo: Vec<(String, Arc<Project>)> = (0..k).map(|i| (a.label[new_line[i + 1]].clone(), a.state[new_line[i]].clone())).collect();
         let redo: Vec<(String, Arc<Project>)> = new_line[k + 1..].iter().rev().map(|&i| (a.label[i].clone(), a.state[i].clone())).collect();
+        let edited = crate::commands::text_edit::active_editor_snapshot(self);
+        let probe = crate::commands::kept_crypto_probe(self);
         let cur = std::mem::replace(&mut self.project, a.state[target].clone());
         self.keep_view_settings(&cur);
         self.history.undo = undo;
         self.history.redo = redo;
         self.history.branches = branches;
         self.history.merge_key = None;
-        self.sanitize_state();
+        self.sanitize_after_replacement(edited.as_ref());
         self.bump();
+        crate::commands::keep_crypto_probe(self, probe, &cur);
         true
     }
 }
diff --git a/crates/engine/src/home.rs b/crates/engine/src/home.rs
new file mode 100644
index 000000000..183461aa4
--- /dev/null
+++ b/crates/engine/src/home.rs
@@ -0,0 +1,4 @@
+pub mod demo;
+pub mod learn;
+pub mod links;
+pub mod templates;
diff --git a/crates/engine/src/demo.rs b/crates/engine/src/home/demo.rs
similarity index 94%
rename from crates/engine/src/demo.rs
rename to crates/engine/src/home/demo.rs
index df07f5204..ec1c353bc 100644
--- a/crates/engine/src/demo.rs
+++ b/crates/engine/src/home/demo.rs
@@ -121,7 +121,7 @@ fn lower_third(p: &mut Project) -> Comp {
         [440.0, 914.0],
     );
     anim(&mut title, "transform/opacity", keys(&[(0.4, Value::Scalar(0.0)), (0.9, Value::Scalar(100.0))]));
-    c.layers = vec![title, bar];
+    c.layers = vec![title, bar].into();
     c
 }
 
@@ -130,8 +130,20 @@ fn solid_sized(p: &mut Project, comp: &Comp, folder: ItemId, name: &str, color:
     build::layer(p, comp, name, LayerSource::Solid { item: sid }, (w, h), None)
 }
 
+/// What `card` draws: name, gradient end colors (hex), size, position and Y rotation.
+#[derive(Clone, Copy)]
+struct CardSpec<'a> {
+    name: &'a str,
+    a: &'a str,
+    b: &'a str,
+    size: (u32, u32),
+    pos: [f64; 3],
+    rot_y: f64,
+}
+
 /// A 3D card: a solid with a diagonal gradient and a thin border grid.
-fn card(p: &mut Project, comp: &Comp, folder: ItemId, name: &str, a: &str, b: &str, size: (u32, u32), pos: [f64; 3], rot_y: f64) -> Layer {
+fn card(p: &mut Project, comp: &Comp, folder: ItemId, spec: &CardSpec) -> Layer {
+    let CardSpec { name, a, b, size, pos, rot_y } = *spec;
     let mut l = solid_sized(p, comp, folder, name, [1.0, 1.0, 1.0], size.0, size.1);
     let (w, h) = (size.0 as f64, size.1 as f64);
     effect(
@@ -192,11 +204,11 @@ fn showcase_3d(p: &mut Project, solids: ItemId) -> Comp {
     set(&mut floor, "materialOptions/specularIntensity", Value::Scalar(10.0));
 
     // Cards at different depths and angles; the centre pair intersects.
-    let left = card(p, &c, solids, "Card Blue", "#2E7BF0", "#7A4DFF", (520, 340), [520.0, 560.0, 120.0], 28.0);
-    let right = card(p, &c, solids, "Card Coral", "#FF6A5C", "#FFB347", (520, 340), [1420.0, 560.0, 260.0], -32.0);
-    let mut x1 = card(p, &c, solids, "Cross A", "#1FD1A5", "#2E7BF0", (460, 460), [960.0, 470.0, 520.0], 40.0);
+    let left = card(p, &c, solids, &CardSpec { name: "Card Blue", a: "#2E7BF0", b: "#7A4DFF", size: (520, 340), pos: [520.0, 560.0, 120.0], rot_y: 28.0 });
+    let right = card(p, &c, solids, &CardSpec { name: "Card Coral", a: "#FF6A5C", b: "#FFB347", size: (520, 340), pos: [1420.0, 560.0, 260.0], rot_y: -32.0 });
+    let mut x1 = card(p, &c, solids, &CardSpec { name: "Cross A", a: "#1FD1A5", b: "#2E7BF0", size: (460, 460), pos: [960.0, 470.0, 520.0], rot_y: 40.0 });
     set(&mut x1, "materialOptions/lightTransmission", Value::Scalar(30.0));
-    let x2 = card(p, &c, solids, "Cross B", "#F0E14A", "#FF6A5C", (460, 460), [960.0, 470.0, 520.0], -40.0);
+    let x2 = card(p, &c, solids, &CardSpec { name: "Cross B", a: "#F0E14A", b: "#FF6A5C", size: (460, 460), pos: [960.0, 470.0, 520.0], rot_y: -40.0 });
     // Hero title in 3D space, gently turning.
     let mut title = text_layer(
         p,
@@ -226,7 +238,7 @@ fn showcase_3d(p: &mut Project, solids: ItemId) -> Comp {
     anim(&mut cam, "cameraOptions/focusDistance", keys(&[(0.0, Value::Scalar(1700.0)), (5.0, Value::Scalar(1900.0)), (10.0, Value::Scalar(1650.0))]));
 
     // Key light: warm spot casting soft shadows. Fill: cool ambient.
-    let mut key = build::layer(p, &c, "Key Light", LayerSource::Light { kind: effectcraft_project::LightKind::Spot }, (1920, 1080), None);
+    let mut key = build::layer(p, &c, "Screen Color Key", LayerSource::Light { kind: effectcraft_project::LightKind::Spot }, (1920, 1080), None);
     set(&mut key, "transform/position", Value::Vec3([500.0, -500.0, -700.0]));
     set(&mut key, "transform/poi", Value::Vec3([960.0, 600.0, 300.0]));
     set(&mut key, "lightOptions/intensity", Value::Scalar(150.0));
@@ -258,7 +270,7 @@ fn showcase_3d(p: &mut Project, solids: ItemId) -> Comp {
     );
     anim(&mut caption, "transform/opacity", keys(&[(0.3, Value::Scalar(0.0)), (1.2, Value::Scalar(100.0))]));
 
-    c.layers = vec![caption, cam, key, fill, title, left, right, x1, x2, floor];
+    c.layers = vec![caption, cam, key, fill, title, left, right, x1, x2, floor].into();
     c
 }
 
@@ -451,7 +463,7 @@ pub fn demo_project() -> Project {
     lower.out_point = t(9.5);
 
     // Stack: top first.
-    comp.layers = vec![lower, title, sub, line, burst, rings, null, bg];
+    comp.layers = vec![lower, title, sub, line, burst, rings, null, bg].into();
     for l in &mut comp.layers {
         if l.name == "Controller" {
             l.switches.video = false;
diff --git a/crates/engine/src/learn.rs b/crates/engine/src/home/learn.rs
similarity index 99%
rename from crates/engine/src/learn.rs
rename to crates/engine/src/home/learn.rs
index cea729368..9c89b2dbf 100644
--- a/crates/engine/src/learn.rs
+++ b/crates/engine/src/home/learn.rs
@@ -259,7 +259,7 @@ pub fn tutorials() -> Vec<Tutorial> {
                     target: Some("menu.Layer"),
                     accepts: &["layer.newLight"],
                     when: Value::Null,
-                    show: vec![("layer.newLight", json!({"kind": "Spot", "name": "Key Light"}))],
+                    show: vec![("layer.newLight", json!({"kind": "Spot", "name": "Screen Color Key"}))],
                 }),
                 step(S {
                     title: "Add a camera",
diff --git a/crates/engine/src/links.rs b/crates/engine/src/home/links.rs
similarity index 100%
rename from crates/engine/src/links.rs
rename to crates/engine/src/home/links.rs
diff --git a/crates/engine/src/templates.rs b/crates/engine/src/home/templates.rs
similarity index 91%
rename from crates/engine/src/templates.rs
rename to crates/engine/src/home/templates.rs
index a8009f476..0b15baaf5 100644
--- a/crates/engine/src/templates.rs
+++ b/crates/engine/src/home/templates.rs
@@ -486,10 +486,10 @@ pub fn encode_thumb(w: u32, h: u32, rgba: &[u8]) -> String {
 /// Decode a thumbnail to RGB bytes (THUMB_W×THUMB_H×3).
 pub fn decode_thumb(text: &str) -> Option<Vec<u8>> {
     let t = text.trim();
-    if t.len() != THUMB_W * THUMB_H * 6 {
+    if t.len() != THUMB_W * THUMB_H * 6 || !t.is_ascii() {
         return None;
     }
-    (0..t.len()).step_by(2).map(|i| u8::from_str_radix(&t[i..i + 2], 16).ok()).collect()
+    (0..t.len()).step_by(2).map(|i| u8::from_str_radix(t.get(i..i + 2)?, 16).ok()).collect()
 }
 
 /// Render a project's main comp at its poster time into a thumbnail.
@@ -645,6 +645,21 @@ fn base_name(path: &str) -> String {
     path.rsplit(['/', '\\']).next().filter(|n| !n.is_empty()).unwrap_or("footage").to_string()
 }
 
+/// A template entry's name, made safe to write inside a folder: a template is a file like any
+/// other and can name its entries anything. Nothing a platform reads as a separator, a drive or
+/// the folder above survives, and a name that leaves nothing usable becomes `footage` (#2123).
+fn safe_file_name(name: &str) -> String {
+    let name: String = name.chars().map(|c| if matches!(c, '/' | '\\' | ':' | '\0') { '_' } else { c }).collect();
+    // `.` and `..`, and names of dots and spaces alone (Windows drops the trailing ones).
+    if name.trim_matches(['.', ' ']).is_empty() { "footage".to_string() } else { name }
+}
+
+/// What two entry names must differ by to be sure of two files: a filesystem may ignore case, and
+/// Win32 ignores trailing dots and spaces.
+fn same_file_key(name: &str) -> String {
+    name.trim_end_matches(['.', ' ']).to_lowercase()
+}
+
 /// What [`embed_footage`] did.
 #[derive(Default)]
 struct Embedded {
@@ -738,9 +753,21 @@ fn extract_footage(s: &Session, proj: &mut Project, entries: &[(String, Vec<u8>)
     let mut used = std::collections::HashSet::new();
     for (k, v) in entries.iter().filter(|(k, _)| k.starts_with("media/")) {
         // `media/<item>/<file>` → one folder; a name another item took gets the item's id.
-        let file = base_name(k);
-        let item = k.trim_start_matches("media/").split('/').next().unwrap_or("0");
-        let name = if used.insert(file.clone()) { file } else { format!("{item}-{file}") };
+        let file = safe_file_name(&base_name(k));
+        // The item's id, and only that: it is written as one ([`embed_footage`]), but a template
+        // from elsewhere can hold anything there, and `..\` in it walks out of `dir` on Windows.
+        let item = k.trim_start_matches("media/").split('/').next().filter(|i| i.bytes().all(|b| b.is_ascii_digit())).unwrap_or("0");
+        // A name another entry has taken gets the item's id, and a number if that is taken too:
+        // the names an entry can ask for are not distinct, and two files must not become one.
+        // They are compared the way a filesystem might: `CLIP.png` is `clip.png` on a
+        // case-insensitive volume (Windows and macOS as they come), and Win32 drops a trailing
+        // dot or space, so `a.png.` is `a.png` there. The name written stays as it is.
+        let mut name = file.clone();
+        let mut n = 0usize;
+        while !used.insert(same_file_key(&name)) {
+            n += 1;
+            name = if n == 1 { format!("{item}-{file}") } else { format!("{item}-{n}-{file}") };
+        }
         let out = format!("{dir}/{name}");
         s.services.store_file(&out, v).map_err(|e| EngineError::Other(format!("cannot write {out}: {e}")))?;
         if let Some(imp) = &s.importer {
@@ -943,6 +970,12 @@ mod tests {
     use super::*;
     use crate::config::{DirConfig, MemoryConfig};
 
+    #[test]
+    fn non_ascii_thumbnail_is_rejected_without_panicking() {
+        let malformed = format!("aé{}", "0".repeat(THUMB_W * THUMB_H * 6 - 3));
+        assert!(decode_thumb(&malformed).is_none());
+    }
+
     #[test]
     fn every_builtin_builds_with_controls_and_renders() {
         let s = Session::default();
@@ -964,6 +997,57 @@ mod tests {
         assert_eq!(l.iter().find(|t| t.id == "lower-third").unwrap().controls, ["Name", "Title", "Bar Color"]);
     }
 
+    /// #2123: a template holds its footage as `media/<item id>/<file>` entries, but a template
+    /// from anywhere else can name them anything — and `..\\`, which only this platform reads as
+    /// a plain character, is a separator on Windows, so a second entry with a base name already
+    /// taken wrote `<dir>/..\\..\\..\\Startup\\x-evil.bat`. Whatever an entry is called, the file
+    /// lands in the footage folder.
+    #[test]
+    fn extracted_footage_stays_in_its_folder() {
+        let s = Session::default();
+        let mut proj = effectcraft_project::Project::default();
+        let dir = std::env::temp_dir().join(format!("ec-templates-media-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let ds = dir.to_string_lossy().into_owned();
+        let entry = |k: &str| (k.to_string(), b"x".to_vec());
+        let entries = [
+            entry("media/0/clip.mp4"),
+            // The base name is taken, so this one's "item id" is used — and it is not one.
+            entry("media/..\\..\\..\\Startup\\x/clip.mp4"),
+            entry("media/1/C:evil.bat"),
+            // Three that collide once the first is made safe: each still gets its own file.
+            entry("media/1/a:b.png"),
+            entry("media/2/a_b.png"),
+            entry("media/3/2-a_b.png"),
+            // The same file on a case-insensitive volume, and on Windows, which drops the dot.
+            entry("media/4/clip.png"),
+            entry("media/5/CLIP.png"),
+            entry("media/6/a.png"),
+            entry("media/7/a.png."),
+        ];
+        let written = extract_footage(&s, &mut proj, &entries, &ds).unwrap();
+        assert_eq!(written.len(), entries.len());
+        for w in &written {
+            let name = w.strip_prefix(&format!("{ds}/")).unwrap_or_else(|| panic!("{w} is outside {ds}"));
+            assert!(!name.contains(['/', '\\', ':']), "{w}");
+            assert!(!name.trim_matches(['.', ' ']).is_empty(), "{w}");
+        }
+        // One file each, all of them in the folder, none overwritten by the next.
+        assert_eq!(written.iter().collect::<std::collections::BTreeSet<_>>().len(), entries.len(), "{written:?}");
+        assert_eq!(std::fs::read_dir(&dir).map(|d| d.count()).unwrap_or(0), entries.len());
+        let _ = std::fs::remove_dir_all(&dir);
+        // And the names that would leave nothing to write.
+        for n in ["..", ".", " .. ", "...", ""] {
+            assert_eq!(safe_file_name(n), "footage", "{n:?}");
+        }
+        assert_eq!(safe_file_name("clip.mp4"), "clip.mp4");
+        assert_eq!(safe_file_name(".hidden.mp4"), ".hidden.mp4");
+        assert_eq!(safe_file_name("a/b\\c:d"), "a_b_c_d");
+        // Names a filesystem may not tell apart (only the case half of this shows on macOS).
+        assert_eq!(same_file_key("A.PNG. "), same_file_key("a.png"));
+        assert_ne!(same_file_key("a.png"), same_file_key("b.png"));
+    }
+
     #[test]
     fn create_opens_an_untitled_copy() {
         let mut s = Session::default();
diff --git a/crates/engine/src/interchange.rs b/crates/engine/src/interchange.rs
new file mode 100644
index 000000000..3b166b83e
--- /dev/null
+++ b/crates/engine/src/interchange.rs
@@ -0,0 +1,5 @@
+pub(crate) mod keyframe_text;
+pub(crate) mod keyframe_text_effects;
+pub mod psd_import;
+pub mod vector;
+pub mod xml_project;
diff --git a/crates/engine/src/interchange/keyframe_text.rs b/crates/engine/src/interchange/keyframe_text.rs
new file mode 100644
index 000000000..5f8ba9441
--- /dev/null
+++ b/crates/engine/src/interchange/keyframe_text.rs
@@ -0,0 +1,348 @@
+//! Copied keyframes as After Effects keyframe text, for the system clipboard (#1908). Other
+//! applications read this tab-separated format (AE2Blend brings it into Blender). Like After
+//! Effects it covers one layer: its copied properties, keyframed ones as one row per key (frame
+//! number in comp time, then the value) and static ones as a single row with no frame. Easing
+//! and tangents aren't part of the format; EffectCraft's own paste keeps them.
+
+use effectcraft_project::{AutoOrient, Comp, GroupKind, ItemKind, Layer, LayerId, LayerSource, Node, ParamUi, Project, PropGroup, Property, Uid};
+
+use crate::{KeyRef, keyframe_text_effects};
+
+/// Transform properties with the unit their columns are labelled with and, for vectors, the
+/// third component a 2D layer shows. X / Y / Z Position (Separate Dimensions) have no unit.
+const TRANSFORM: &[(&str, &str, Option<f64>)] = &[
+    ("poi", "pixels", Some(0.0)),
+    ("anchor", "pixels", Some(0.0)),
+    ("position", "pixels", Some(0.0)),
+    ("positionX", "", None),
+    ("positionY", "", None),
+    ("positionZ", "", None),
+    ("scale", "percent", Some(100.0)),
+    ("orientation", "degrees", None),
+    ("rotationX", "degrees", None),
+    ("rotationY", "degrees", None),
+    ("rotation", "degrees", None),
+    ("opacity", "percent", None),
+];
+
+/// How a copied property is written: its block's header line, column labels and values.
+struct Channel {
+    header: String,
+    labels: Vec<String>,
+    values: Values,
+}
+
+/// How a property's value becomes the numbers in a row.
+#[derive(Clone, Copy)]
+enum Values {
+    Plain,
+    /// A 2D layer's Transform vector: the third component is the one the layer shows (it may
+    /// keep another from pasted 3D keys).
+    Flat(f64),
+    /// RGBA 0–1 as alpha, red, green, blue 0–255.
+    Argb,
+    /// A popup's 0-based choice as After Effects' 1-based one.
+    OneBased,
+    Scale(f64),
+}
+
+impl Values {
+    fn row(self, mut v: Vec<f64>) -> Vec<f64> {
+        match (self, v.as_slice()) {
+            (Values::Flat(z), _) => {
+                if let Some(c) = v.get_mut(2) {
+                    *c = z;
+                }
+                v
+            }
+            (Values::Argb, [r, g, b, a]) => [a, r, g, b].map(|c| c * 255.0).to_vec(),
+            (Values::OneBased, _) => v.into_iter().map(|c| c + 1.0).collect(),
+            (Values::Scale(s), _) => v.into_iter().map(|c| c * s).collect(),
+            _ => v,
+        }
+    }
+}
+
+/// The text for copied keys (layer times) and unanimated properties. `None` unless they all come
+/// from one layer and at least one property can be written.
+pub(crate) fn text(project: &Project, comp: &Comp, keys: &[KeyRef], statics: &[(LayerId, Uid)]) -> Option<String> {
+    let lid = keys.first().map(|k| k.layer).or_else(|| statics.first().map(|s| s.0))?;
+    if keys.iter().any(|k| k.layer != lid) || statics.iter().any(|s| s.0 != lid) {
+        return None;
+    }
+    let layer = comp.layer(lid)?;
+    let fps = comp.frame_rate.as_f64();
+    let mut blocks = String::new();
+    layer.props.walk("", &mut |_, pr| {
+        let mut times: Vec<_> = keys.iter().filter(|k| k.prop == pr.uid).map(|k| k.time).collect();
+        times.sort();
+        times.dedup();
+        let rows: Vec<(String, Vec<f64>)> = if !times.is_empty() {
+            let frame = |t| num(layer.comp_time(t).seconds() * fps);
+            times.into_iter().filter_map(|t| Some((frame(t), pr.keys.iter().find(|k| k.time == t)?.value.components()))).collect()
+        } else if statics.iter().any(|s| s.1 == pr.uid) {
+            vec![(String::new(), pr.value.components())]
+        } else {
+            return;
+        };
+        let Some(ch) = channel(layer, pr).filter(|ch| !ch.labels.is_empty()) else { return };
+        if rows.iter().any(|(_, v)| v.is_empty()) {
+            return;
+        }
+        blocks.push_str(&format!("{}\n\tFrame\t{}\t\n", ch.header, ch.labels.join("\t")));
+        for (frame, values) in rows {
+            let values: Vec<String> = ch.values.row(values).into_iter().map(num).collect();
+            blocks.push_str(&format!("\t{frame}\t{}\t\n", values.join("\t")));
+        }
+        blocks.push('\n');
+    });
+    if blocks.is_empty() {
+        return None;
+    }
+    // After Effects writes a text layer's source as 1 × 1. Other layers without a source of
+    // their own (shapes, cameras) take the comp's size, and all of them its pixel aspect.
+    let (w, h) = match (&layer.source, effectcraft_render::eval::source_size(project, layer)) {
+        (LayerSource::Text, _) => (1, 1),
+        (_, (0, 0)) => (comp.width, comp.height),
+        (_, size) => size,
+    };
+    let par = match layer.source {
+        LayerSource::Footage { item } | LayerSource::Solid { item } | LayerSource::Comp { item } => match project.item(item).map(|i| &i.kind) {
+            Some(ItemKind::Footage(f)) => f.pixel_aspect,
+            Some(ItemKind::Solid(s)) => s.pixel_aspect,
+            Some(ItemKind::Comp(c)) => c.pixel_aspect,
+            _ => comp.pixel_aspect,
+        },
+        _ => comp.pixel_aspect,
+    };
+    // The layout of current After Effects: a `Layer` line before the layer's properties (parsers
+    // such as ae-keyframes reject properties without one), and a tab after every column.
+    Some(format!(
+        "Adobe After Effects 9.0 Keyframe Data\n\n\tUnits Per Second\t{}\n\tSource Width\t{w}\n\tSource Height\t{h}\n\tSource Pixel Aspect Ratio\t{}\n\tComp Pixel Aspect Ratio\t{}\n\nLayer\n{blocks}\nEnd of Keyframe Data\n",
+        num(fps),
+        num(par),
+        num(comp.pixel_aspect)
+    ))
+}
+
+/// How the layer's property `pr` is written, by where it sits in the layer: `None` for
+/// properties the text doesn't carry.
+fn channel(layer: &Layer, pr: &Property) -> Option<Channel> {
+    let chain = layer.props.node_chain(pr.uid)?;
+    match chain.first().and_then(|n| n.as_group()).map(|g| g.match_id.as_str()) {
+        None if pr.match_id == "timeRemap" => Some(Channel { header: "Time Remap".into(), labels: labels("seconds", 1), values: Values::Plain }),
+        Some("transform") => transform(layer, pr),
+        Some("effects") => effect(&chain, pr),
+        Some("masks" | "text" | "contents" | "cameraOptions" | "lightOptions" | "materialOptions") => nested(&chain, pr),
+        _ => None,
+    }
+}
+
+/// Indexed groups by match id, with the kind After Effects names them by: it writes them by kind
+/// and place (`Mask #2`, `Group #1`), not by name.
+const INSTANCES: &[(&str, &str)] = &[
+    ("mask", "Mask"),
+    ("animator", "Animator"),
+    ("rangeSelector", "Range Selector"),
+    ("wigglySelector", "Wiggly Selector"),
+    ("expressionSelector", "Expression Selector"),
+    ("group", "Group"),
+    ("rect", "Rectangle Path"),
+    ("ellipse", "Ellipse Path"),
+    ("star", "Polystar Path"),
+    ("path", "Path"),
+    ("fill", "Fill"),
+    ("stroke", "Stroke"),
+    ("gfill", "Gradient Fill"),
+    ("gstroke", "Gradient Stroke"),
+    ("trim", "Trim Paths"),
+    ("repeater", "Repeater"),
+    ("round", "Round Corners"),
+    ("offset", "Offset Paths"),
+    ("pucker", "Pucker & Bloat"),
+    ("twist", "Twist"),
+    ("zigzag", "Zig Zag"),
+    ("wiggle", "Wiggle Paths"),
+    ("merge", "Merge Paths"),
+];
+
+/// A property under Masks, Text, Contents or Camera / Light / Material Options: the group's
+/// name, then each group down to the property. Instances go by kind and place, and a text
+/// selector's own properties carry their place too (`Start #1`).
+fn nested(chain: &[&Node], pr: &Property) -> Option<Channel> {
+    let groups: Vec<&PropGroup> = chain.iter().filter_map(|n| n.as_group()).collect();
+    let parent = groups.last()?;
+    let (labels, values) = columns(&parent.match_id, &pr.match_id, pr, false)?;
+    let mut header = groups.first()?.name.clone();
+    for pair in groups.windows(2) {
+        let [outer, g] = pair else { continue };
+        match INSTANCES.iter().find(|(id, _)| *id == g.match_id).filter(|_| g.is_instance()) {
+            Some((_, kind)) => header.push_str(&format!("\t{kind} #{}", place(outer, g.uid)?)),
+            None => header.push_str(&format!("\t{}", g.name)),
+        }
+    }
+    if parent.match_id.ends_with("Selector") {
+        header.push_str(&format!("\t{} #{}", pr.name, place(parent, pr.uid)?));
+    } else {
+        header.push_str(&format!("\t{}", pr.name));
+    }
+    Some(Channel { header, labels, values })
+}
+
+/// An effect property: `Effects`, the effect's name (not a custom one) and place on the layer,
+/// then the property's name and After Effects index. Properties in twirl-down groups are
+/// written without their group, as After Effects does.
+fn effect(chain: &[&Node], pr: &Property) -> Option<Channel> {
+    let [Node::Group(effects), Node::Group(fx), ..] = chain else { return None };
+    let GroupKind::Effect { effect } = &fx.kind else { return None };
+    let name = effectcraft_effects::find(effect).map_or(fx.name.as_str(), |spec| spec.name);
+    let path: String = chain.iter().skip(2).filter_map(|n| n.as_group()).map(|g| format!("{}/", g.match_id)).chain([pr.match_id.clone()]).collect();
+    let (labels, values) = columns(effect, &path, pr, true)?;
+    let header = format!("Effects\t{name} #{}\t{} #{}", place(effects, fx.uid)?, pr.name, effect_index(effect, fx, pr.uid)?);
+    Some(Channel { header, labels, values })
+}
+
+/// After Effects' index of an effect property: the effect's hidden input layer is #1, and a
+/// twirl-down group takes an index where it opens and another where it closes. The hidden
+/// source choice EffectCraft keeps beside a layer parameter has none. Where After Effects
+/// numbers a parameter otherwise ([`keyframe_text_effects::INDICES`]), counting goes on from it.
+fn effect_index(effect: &str, fx: &PropGroup, uid: Uid) -> Option<usize> {
+    fn count(effect: &str, g: &PropGroup, prefix: &str, uid: Uid, n: &mut usize) -> bool {
+        for c in &g.children {
+            match c {
+                Node::Prop(p) if is_layer_source(g, p) => {}
+                Node::Prop(p) => {
+                    let path = format!("{prefix}{}", p.match_id);
+                    *n = keyframe_text_effects::INDICES.iter().find(|(e, q, _)| *e == effect && *q == path).map_or(*n + 1, |a| a.2);
+                    if p.uid == uid {
+                        return true;
+                    }
+                }
+                Node::Group(sub) => {
+                    *n += 1;
+                    if count(effect, sub, &format!("{prefix}{}/", sub.match_id), uid, n) {
+                        return true;
+                    }
+                    *n += 1;
+                }
+            }
+        }
+        false
+    }
+    let mut n = 1;
+    count(effect, fx, "", uid, &mut n).then_some(n)
+}
+
+fn is_layer_source(g: &PropGroup, p: &Property) -> bool {
+    p.ui == ParamUi::Hidden && g.props().any(|l| l.ui == ParamUi::Layer && effectcraft_effects::layer_source_id(&l.match_id) == p.match_id)
+}
+
+/// 1-based position of a child in its group.
+fn place(group: &PropGroup, uid: Uid) -> Option<usize> {
+    group.children.iter().position(|c| c.uid() == uid).map(|i| i + 1)
+}
+
+/// How After Effects writes a property differently from what its editor suggests ([`by_ui`]).
+#[derive(Clone, Copy)]
+enum Exception {
+    /// Not written.
+    Skip,
+    Unit(&'static str),
+    Values(Values),
+}
+
+/// Properties After Effects writes differently from what their editor suggests, by the effect
+/// or group they're directly in and their match id.
+const EXCEPTIONS: &[(&str, &str, Exception)] = &[
+    // Path Options' Path picks a mask, which After Effects doesn't write.
+    ("pathOptions", "path", Exception::Skip),
+    ("mask", "feather", Exception::Unit("pixels")),
+    ("mask", "expansion", Exception::Unit("pixels")),
+    ("cameraOptions", "zoom", Exception::Unit("pixels")),
+    ("cameraOptions", "focusDistance", Exception::Unit("pixels")),
+    ("cameraOptions", "aperture", Exception::Unit("pixels")),
+    ("cameraOptions", "highlightGain", Exception::Unit("")),
+    ("cameraOptions", "highlightSaturation", Exception::Unit("")),
+    // After Effects keeps the threshold as 0–1.
+    ("cameraOptions", "highlightThreshold", Exception::Values(Values::Scale(1.0 / 255.0))),
+    ("lightOptions", "shadowDiffusion", Exception::Unit("pixels")),
+    // Off, On, Only: written from 0.
+    ("materialOptions", "castsShadows", Exception::Values(Values::Plain)),
+    ("materialOptions", "acceptsShadows", Exception::Values(Values::Plain)),
+];
+
+/// Column labels and values for a property in `scope`, the effect (by id) or group (by match
+/// id) it's directly in, at `path` there (an effect property's groups, then its match id): [`by_ui`]
+/// unless [`EXCEPTIONS`] or, in effects, [`keyframe_text_effects::UNITS`] say otherwise.
+fn columns(scope: &str, path: &str, pr: &Property, in_effect: bool) -> Option<(Vec<String>, Values)> {
+    let (by_editor, values) = by_ui(pr, in_effect)?;
+    let exception = EXCEPTIONS.iter().find(|(s, id, _)| *s == scope && *id == path).map(|e| e.2);
+    let effect_unit = || keyframe_text_effects::UNITS.iter().find(|(e, p, _)| in_effect && *e == scope && *p == path).map(|u| Exception::Unit(u.2));
+    Some(match exception.or_else(effect_unit) {
+        None => (by_editor, values),
+        Some(Exception::Skip) => return None,
+        Some(Exception::Unit(unit)) => (labels(unit, pr.value.dims()), values),
+        Some(Exception::Values(values)) => (by_editor, values),
+    })
+}
+
+/// Column labels and values for a property, by how it's edited. After Effects labels most 0–100
+/// sliders (opacities) as percent, and ±100 ones too outside effects (text selector amounts),
+/// and other sliders, checkboxes and popups with no unit. [`keyframe_text_effects::UNITS`] lists
+/// the effect parameters After Effects labels otherwise.
+fn by_ui(pr: &Property, in_effect: bool) -> Option<(Vec<String>, Values)> {
+    let dims = pr.value.dims();
+    Some(match &pr.ui {
+        ParamUi::Color => (["alpha ", "red ", "green ", "blue "].map(String::from).to_vec(), Values::Argb),
+        ParamUi::Popup { .. } => (labels("", dims), Values::OneBased),
+        ParamUi::Slider { min, max, .. } if *max == 100.0 && (*min == 0.0 || (*min == -100.0 && !in_effect)) => (labels("percent", dims), Values::Plain),
+        ParamUi::Percent => (labels("percent", dims), Values::Plain),
+        ParamUi::Angle => (labels("degrees", dims), Values::Plain),
+        ParamUi::Point | ParamUi::Point3 => (labels("pixels", dims), Values::Plain),
+        ParamUi::Number | ParamUi::Slider { .. } | ParamUi::Pixels | ParamUi::Checkbox => (labels("", dims), Values::Plain),
+        _ => return None,
+    })
+}
+
+fn transform(layer: &Layer, pr: &Property) -> Option<Channel> {
+    let (id, unit, z) = TRANSFORM.iter().find(|(id, ..)| *id == pr.match_id)?;
+    if !active(layer, id) || (pr.three_d_only && !layer.is_3d()) {
+        return None;
+    }
+    // After Effects labels only the first of Orientation's three columns, and names Z Rotation
+    // plain Rotation (as AE2Blend expects).
+    let labels = if *id == "orientation" { vec![format!("X {unit}")] } else { labels(unit, pr.value.dims()) };
+    let values = match z {
+        Some(z) if !layer.is_3d() => Values::Flat(*z),
+        _ => Values::Plain,
+    };
+    Some(Channel { header: format!("Transform\t{}", pr.name), labels, values })
+}
+
+/// Column labels: the unit, or one per axis (`X pixels`, `Y pixels`; `X ` with no unit, as After
+/// Effects writes a shape's Size).
+fn labels(unit: &str, dims: usize) -> Vec<String> {
+    match dims {
+        0 => vec![],
+        1 => vec![unit.to_string()],
+        _ => ["X", "Y", "Z"].iter().take(dims).map(|axis| format!("{axis} {unit}")).collect(),
+    }
+}
+
+/// Whether the layer uses this Transform property: one-node cameras (and lights not aimed at
+/// it) have no Point of Interest, and Separate Dimensions replaces Position with X / Y / Z
+/// Position.
+fn active(layer: &Layer, id: &str) -> bool {
+    match id {
+        "poi" => !(layer.is_camera() || layer.is_light()) || layer.auto_orient == AutoOrient::TowardsPointOfInterest,
+        "position" => layer.transform().is_none_or(|tr| tr.get("positionX").is_none()),
+        _ => true,
+    }
+}
+
+/// A number with at most three decimals and no trailing zeros (`23.976`, `960`, `-0.5`).
+fn num(v: f64) -> String {
+    let s = format!("{:.3}", if v.is_finite() { v } else { 0.0 });
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" { "0".into() } else { s.into() }
+}
diff --git a/crates/engine/src/interchange/keyframe_text_effects.rs b/crates/engine/src/interchange/keyframe_text_effects.rs
new file mode 100644
index 000000000..83f5b6c20
--- /dev/null
+++ b/crates/engine/src/interchange/keyframe_text_effects.rs
@@ -0,0 +1,386 @@
+//! After Effects' index and unit for effect parameters where they differ from what
+//! [`crate::keyframe_text`]'s rules give, as After Effects 2019 writes them in its keyframe text.
+//! After Effects keeps an effect's parameter indices for good (projects store them), so they
+//! hold for later versions. Parameters After Effects lacks, or names differently and keeps
+//! elsewhere, aren't listed.
+
+/// Effect id, parameter path in the effect (its groups' match ids, then its own) and After
+/// Effects' index for it; the parameters after it count on from there. After Effects numbers
+/// legacy parameters it hides, so its indices skip ahead.
+pub(crate) const INDICES: &[(&str, &str, usize)] = &[
+    ("ec.3d.channelextract", "clampOutput", 6),
+    ("ec.3d.channelextract", "antialias", 5),
+    ("ec.3d.extractor", "blackPoint", 4),
+    ("ec.audio.parametriceq", "band1Enable", 3),
+    ("ec.blur.radial", "amount", 3),
+    ("ec.color.cccolorneutralizer", "midtonesUnbalance", 8),
+    ("ec.color.cccolorneutralizer", "highlightsUnbalance", 14),
+    ("ec.color.cccolorneutralizer", "pinning", 20),
+    ("ec.color.cckernel", "k1", 3),
+    ("ec.color.cckernel", "k4", 8),
+    ("ec.color.cckernel", "k7", 13),
+    ("ec.color.cckernel", "scale", 17),
+    ("ec.color.cckernel", "absolute", 18),
+    ("ec.color.colorstabilizer", "stabilize", 2),
+    ("ec.color.huesaturation", "hue", 4),
+    ("ec.color.huesaturation", "colorize", 7),
+    ("ec.color.levels", "inBlack", 4),
+    ("ec.color.levelsic", "rgb/rgbInBlack", 5),
+    ("ec.color.lumetri", "highDynamicRange", 3),
+    ("ec.color.lumetri", "basicCorrection/inputLut", 8),
+    ("ec.color.lumetri", "basicCorrection/whiteBalance/temperature", 12),
+    ("ec.color.lumetri", "basicCorrection/tone/hdrSpecular", 22),
+    ("ec.color.lumetri", "basicCorrection/saturation", 26),
+    ("ec.color.lumetri", "creative/look", 32),
+    ("ec.color.lumetri", "creative/lookIntensity", 33),
+    ("ec.color.lumetri", "creative/adjustments/tintBalance", 40),
+    ("ec.color.lumetri", "hslSecondary/key/showMask", 83),
+    ("ec.color.lumetri", "hslSecondary/refine/denoise", 90),
+    ("ec.color.lumetri", "hslSecondary/correction/temperature", 96),
+    ("ec.color.lumetri", "vignette/vignetteAmount", 105),
+    ("ec.color.selectivecolor", "details/reds/redsCyan", 10),
+    ("ec.color.videolimiter", "compressionBeforeClipping", 3),
+    ("ec.distort.ccflomotion", "knot1", 3),
+    ("ec.distort.ccpowerpin", "expandTop", 9),
+    ("ec.distort.upscale", "scale", 4),
+    ("ec.distort.puppet", "refinement", 3),
+    ("ec.control.stereo3d", "configuration", 3),
+    ("ec.control.stereo3d", "convergenceOf", 8),
+    ("ec.generate.advancedlightning", "turbulence", 17),
+    ("ec.generate.advancedlightning", "alphaObstacle", 16),
+    ("ec.generate.advancedlightning", "compositeOnOriginal", 21),
+    ("ec.generate.ccgluegun", "style", 9),
+    ("ec.generate.cclightburst", "setColor", 7),
+    ("ec.generate.cclightrays", "colorFromSource", 8),
+    ("ec.generate.cclightrays", "color", 10),
+    ("ec.generate.circle", "feather/feather", 7),
+    ("ec.generate.paintbucket", "color", 9),
+    ("ec.vr.blur", "frameLayout", 3),
+    ("ec.vr.blur", "blurriness", 6),
+    ("ec.vr.chromaticaberrations", "frameLayout", 3),
+    ("ec.vr.chromaticaberrations", "aberrationRed", 7),
+    ("ec.vr.colorgradients", "frameLayout", 3),
+    ("ec.vr.colorgradients", "point1", 10),
+    ("ec.vr.colorgradients", "point2", 12),
+    ("ec.vr.colorgradients", "point3", 14),
+    ("ec.vr.colorgradients", "point4", 16),
+    ("ec.vr.colorgradients", "point5", 18),
+    ("ec.vr.colorgradients", "blend", 7),
+    ("ec.vr.colorgradients", "opacity", 27),
+    ("ec.vr.denoise", "frameLayout", 3),
+    ("ec.vr.denoise", "noiseType", 6),
+    ("ec.vr.digitalglitch", "frameLayout", 3),
+    ("ec.vr.digitalglitch", "masterAmplitude", 9),
+    ("ec.vr.digitalglitch", "distortionRate", 16),
+    ("ec.vr.digitalglitch", "distortionComplexity", 15),
+    ("ec.vr.digitalglitch", "distortionEvolution", 17),
+    ("ec.vr.digitalglitch", "colorDistortion", 11),
+    ("ec.vr.digitalglitch", "randomSeed", 39),
+    ("ec.vr.fractalnoise", "frameLayout", 3),
+    ("ec.vr.fractalnoise", "fractalType", 6),
+    ("ec.vr.fractalnoise", "randomSeed", 25),
+    ("ec.vr.glow", "frameLayout", 3),
+    ("ec.vr.glow", "luminanceThreshold", 6),
+    ("ec.vr.planetosphere", "frameLayout", 3),
+    ("ec.vr.planetosphere", "scale", 6),
+    ("ec.vr.planetosphere", "feather", 8),
+    ("ec.vr.planetosphere", "tilt", 15),
+    ("ec.vr.rotatesphere", "frameLayout", 3),
+    ("ec.vr.rotatesphere", "invertRotation", 9),
+    ("ec.vr.rotatesphere", "tilt", 6),
+    ("ec.vr.sharpen", "frameLayout", 3),
+    ("ec.vr.sharpen", "sharpenAmount", 6),
+    ("ec.key.colordifference", "view", 3),
+    ("ec.key.colorrange", "fuzziness", 3),
+    ("ec.key.extract", "channel", 3),
+    ("ec.key.linearcolor", "view", 3),
+    ("ec.matte.refinehard", "feather", 2),
+    ("ec.matte.refinehard", "reduceChatter", 5),
+    ("ec.matte.refinehard", "decontaminationAmount", 14),
+    ("ec.matte.refinesoft", "reduceChatter", 10),
+    ("ec.matte.rotobrush", "rotoBrushPropagation/searchRadius", 3),
+    ("ec.matte.rotobrush", "rotoBrushMatte/feather", 13),
+    ("ec.matte.rotobrush", "refineEdgeMatte/smooth", 22),
+    ("ec.matte.rotobrush", "refineEdgeMatte/reduceChatter", 27),
+    ("ec.matte.rotobrush", "refineEdgeMatte/useMotionBlur", 29),
+    ("ec.noise.noisealpha", "noiseOptions/cycleNoise", 8),
+    ("ec.obsolete.basictext", "position", 2),
+    ("ec.key.spill", "suppression", 3),
+    ("ec.perspective.cameratracker", "shotType", 4),
+    ("ec.perspective.cameratracker", "advanced/solveMethod", 12),
+    ("ec.perspective.cameratracker", "advanced/detailedAnalysis", 17),
+    ("ec.perspective.cameratracker", "advanced/autoDeletePoints", 18),
+    ("ec.perspective.cccylinder", "rotationX", 9),
+    ("ec.perspective.cccylinder", "render", 13),
+    ("ec.perspective.cccylinder", "lightIntensity", 15),
+    ("ec.perspective.cccylinder", "ambient", 21),
+    ("ec.sim.ccdrizzle", "light/lightIntensity", 10),
+    ("ec.sim.ccdrizzle", "light/lightHeight", 13),
+    ("ec.sim.ccdrizzle", "light/lightDirection", 15),
+    ("ec.sim.ccmrmercury", "blobBirthSize", 15),
+    ("ec.sim.ccmrmercury", "light/lightIntensity", 19),
+    ("ec.sim.ccmrmercury", "light/lightHeight", 22),
+    ("ec.sim.ccmrmercury", "light/lightDirection", 24),
+    ("ec.sim.ccparticlesystems2", "particle/maxOpacity", 24),
+    ("ec.sim.ccparticlesystems2", "particle/birthColor", 27),
+    ("ec.sim.ccrainfall", "transferMode", 16),
+    ("ec.sim.ccrainfall", "extras/randomSeed", 23),
+    ("ec.sim.ccsnowfall", "color", 19),
+    ("ec.sim.ccsnowfall", "transferMode", 26),
+    ("ec.sim.ccsnowfall", "extras/randomSeed", 32),
+    ("ec.stylize.ccblockload", "startCleared", 4),
+    ("ec.stylize.cchextile", "rotate", 6),
+    ("ec.stylize.glow", "colorLooping", 9),
+    ("ec.text.timecode", "timeUnits", 5),
+    ("ec.text.timecode", "textPosition", 9),
+    ("ec.utility.facemeasurements", "headOrientationX", 9),
+    ("ec.utility.facemeasurements", "rightEyebrowRaise", 20),
+    ("ec.utility.facemeasurements", "mouthOffsetX", 26),
+    ("ec.utility.facetrackpoints", "leftEyebrowInner", 10),
+    ("ec.utility.facetrackpoints", "leftEyebrowMiddle", 12),
+    ("ec.utility.facetrackpoints", "leftEyebrowOuter", 14),
+    ("ec.utility.facetrackpoints", "rightEyebrowInner", 24),
+    ("ec.utility.facetrackpoints", "rightEyebrowMiddle", 26),
+    ("ec.utility.facetrackpoints", "rightEyebrowOuter", 28),
+    ("ec.utility.facetrackpoints", "leftEyeInner", 15),
+    ("ec.utility.facetrackpoints", "leftEyeOuter", 21),
+    ("ec.utility.facetrackpoints", "leftPupil", 20),
+    ("ec.utility.facetrackpoints", "rightEyeInner", 29),
+    ("ec.utility.facetrackpoints", "rightEyeOuter", 35),
+    ("ec.utility.facetrackpoints", "rightPupil", 34),
+    ("ec.utility.facetrackpoints", "noseTip", 41),
+    ("ec.utility.facetrackpoints", "leftNostril", 44),
+    ("ec.utility.facetrackpoints", "rightNostril", 46),
+    ("ec.utility.facetrackpoints", "mouthLeft", 49),
+    ("ec.utility.facetrackpoints", "mouthRight", 55),
+    ("ec.utility.facetrackpoints", "mouthTop", 52),
+    ("ec.utility.facetrackpoints", "mouthBottom", 58),
+    ("ec.utility.facetrackpoints", "chin", 84),
+];
+
+/// Effect id, parameter path and the unit After Effects labels the parameter's columns with.
+pub(crate) const UNITS: &[(&str, &str, &str)] = &[
+    ("ec.3d.depthoffield", "focalBias", ""),
+    ("ec.3d.idmatte", "feather", ""),
+    ("ec.audio.flangechorus", "voiceSeparationTime", ""),
+    ("ec.audio.flangechorus", "voicePhaseChange", ""),
+    ("ec.audio.modulator", "modulationRate", ""),
+    ("ec.audio.parametriceq", "band1BoostCut", "percent"),
+    ("ec.audio.parametriceq", "band2BoostCut", "percent"),
+    ("ec.audio.parametriceq", "band3BoostCut", "percent"),
+    ("ec.audio.stereomixer", "leftLevel", "percent"),
+    ("ec.audio.stereomixer", "rightLevel", "percent"),
+    ("ec.audio.stereomixer", "leftPan", "percent"),
+    ("ec.audio.stereomixer", "rightPan", "percent"),
+    ("ec.blur.bilateral", "threshold", ""),
+    ("ec.blur.ccradial", "amount", "pixels"),
+    ("ec.blur.ccradialfast", "amount", ""),
+    ("ec.blur.camerashakedeblur", "strength", "percent"),
+    ("ec.blur.radial", "amount", ""),
+    ("ec.blur.smart", "radius", ""),
+    ("ec.blur.smart", "threshold", ""),
+    ("ec.color.autocolor", "blackClip", "percent"),
+    ("ec.color.autocolor", "whiteClip", "percent"),
+    ("ec.color.autocontrast", "blackClip", "percent"),
+    ("ec.color.autocontrast", "whiteClip", "percent"),
+    ("ec.color.autolevels", "blackClip", "percent"),
+    ("ec.color.autolevels", "whiteClip", "percent"),
+    ("ec.color.brightnesscontrast", "contrast", "pixels"),
+    ("ec.color.cccolorneutralizer", "pinning", ""),
+    ("ec.color.cccolorneutralizer", "blendWOriginal", ""),
+    ("ec.color.changecolor", "lightnessTransform", "pixels"),
+    ("ec.color.changecolor", "saturationTransform", "pixels"),
+    ("ec.color.colorbalance", "shadowRed", "pixels"),
+    ("ec.color.colorbalance", "shadowGreen", "pixels"),
+    ("ec.color.colorbalance", "shadowBlue", "pixels"),
+    ("ec.color.colorbalance", "midRed", "pixels"),
+    ("ec.color.colorbalance", "midGreen", "pixels"),
+    ("ec.color.colorbalance", "midBlue", "pixels"),
+    ("ec.color.colorbalance", "hiRed", "pixels"),
+    ("ec.color.colorbalance", "hiGreen", "pixels"),
+    ("ec.color.colorbalance", "hiBlue", "pixels"),
+    ("ec.color.colorbalancehls", "lightness", "pixels"),
+    ("ec.color.colorbalancehls", "saturation", "pixels"),
+    ("ec.color.colorstabilizer", "sampleSize", "percent"),
+    ("ec.color.gammapedestalgain", "blackStretch", "percent"),
+    ("ec.color.huesaturation", "saturation", "pixels"),
+    ("ec.color.huesaturation", "lightness", "pixels"),
+    ("ec.color.huesaturation", "colorizeSaturation", ""),
+    ("ec.color.huesaturation", "colorizeLightness", "pixels"),
+    ("ec.color.lumetri", "creative/adjustments/fadedFilm", ""),
+    ("ec.color.lumetri", "hslSecondary/refine/denoise", ""),
+    ("ec.color.lumetri", "hslSecondary/refine/blur", ""),
+    ("ec.color.lumetri", "vignette/vignetteMidpoint", ""),
+    ("ec.color.lumetri", "vignette/vignetteFeather", ""),
+    ("ec.color.psarbitrarymap", "phase", "degrees"),
+    ("ec.color.selectivecolor", "details/reds/redsCyan", "percent"),
+    ("ec.color.selectivecolor", "details/reds/redsMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/reds/redsYellow", "percent"),
+    ("ec.color.selectivecolor", "details/reds/redsBlack", "percent"),
+    ("ec.color.selectivecolor", "details/yellows/yellowsCyan", "percent"),
+    ("ec.color.selectivecolor", "details/yellows/yellowsMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/yellows/yellowsYellow", "percent"),
+    ("ec.color.selectivecolor", "details/yellows/yellowsBlack", "percent"),
+    ("ec.color.selectivecolor", "details/greens/greensCyan", "percent"),
+    ("ec.color.selectivecolor", "details/greens/greensMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/greens/greensYellow", "percent"),
+    ("ec.color.selectivecolor", "details/greens/greensBlack", "percent"),
+    ("ec.color.selectivecolor", "details/cyans/cyansCyan", "percent"),
+    ("ec.color.selectivecolor", "details/cyans/cyansMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/cyans/cyansYellow", "percent"),
+    ("ec.color.selectivecolor", "details/cyans/cyansBlack", "percent"),
+    ("ec.color.selectivecolor", "details/blues/bluesCyan", "percent"),
+    ("ec.color.selectivecolor", "details/blues/bluesMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/blues/bluesYellow", "percent"),
+    ("ec.color.selectivecolor", "details/blues/bluesBlack", "percent"),
+    ("ec.color.selectivecolor", "details/magentas/magentasCyan", "percent"),
+    ("ec.color.selectivecolor", "details/magentas/magentasMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/magentas/magentasYellow", "percent"),
+    ("ec.color.selectivecolor", "details/magentas/magentasBlack", "percent"),
+    ("ec.color.selectivecolor", "details/whites/whitesCyan", "percent"),
+    ("ec.color.selectivecolor", "details/whites/whitesMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/whites/whitesYellow", "percent"),
+    ("ec.color.selectivecolor", "details/whites/whitesBlack", "percent"),
+    ("ec.color.selectivecolor", "details/neutrals/neutralsCyan", "percent"),
+    ("ec.color.selectivecolor", "details/neutrals/neutralsMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/neutrals/neutralsYellow", "percent"),
+    ("ec.color.selectivecolor", "details/neutrals/neutralsBlack", "percent"),
+    ("ec.color.selectivecolor", "details/blacks/blacksCyan", "percent"),
+    ("ec.color.selectivecolor", "details/blacks/blacksMagenta", "percent"),
+    ("ec.color.selectivecolor", "details/blacks/blacksYellow", "percent"),
+    ("ec.color.selectivecolor", "details/blacks/blacksBlack", "percent"),
+    ("ec.color.shadowhighlight", "shadowAmount", ""),
+    ("ec.color.shadowhighlight", "highlightAmount", ""),
+    ("ec.color.shadowhighlight", "moreOptions/shadowTonalWidth", ""),
+    ("ec.color.shadowhighlight", "moreOptions/highlightTonalWidth", ""),
+    ("ec.color.shadowhighlight", "moreOptions/blackClip", "percent"),
+    ("ec.color.shadowhighlight", "moreOptions/whiteClip", "percent"),
+    ("ec.distort.bulge", "height", "pixels"),
+    ("ec.distort.bulge", "taperRadius", ""),
+    ("ec.distort.ccbendit", "bend", "pixels"),
+    ("ec.distort.ccbender", "amount", "pixels"),
+    ("ec.distort.ccgriddler", "tileSize", "percent"),
+    ("ec.distort.cctiler", "scale", "percent"),
+    ("ec.distort.upscale", "scale", "percent"),
+    ("ec.distort.magnify", "magnification", "pixels"),
+    ("ec.distort.magnify", "size", "percent"),
+    ("ec.distort.puppet", "refinement", ""),
+    ("ec.distort.ripple", "radius", ""),
+    ("ec.distort.ripple", "speed", "percent"),
+    ("ec.distort.transform", "opacity", ""),
+    ("ec.distort.turbulentdisplace", "complexity", "percent"),
+    ("ec.distort.twirl", "radius", ""),
+    ("ec.distort.wavewarp", "width", "percent"),
+    ("ec.distort.wavewarp", "speed", "pixels"),
+    ("ec.generate.fourcolor", "blend", "percent"),
+    ("ec.generate.advancedlightning", "coreSettings/coreRadius", ""),
+    ("ec.generate.advancedlightning", "glowSettings/glowRadius", "percent"),
+    ("ec.generate.advancedlightning", "alphaObstacle", "pixels"),
+    ("ec.generate.ccgluegun", "reflection", ""),
+    ("ec.generate.cclightburst", "rayLength", ""),
+    ("ec.generate.cclightsweep", "edgeThickness", ""),
+    ("ec.generate.ccthreads", "coverage", ""),
+    ("ec.generate.ccthreads", "shadowing", ""),
+    ("ec.generate.ccthreads", "texture", ""),
+    ("ec.generate.checkerboard", "width", "percent"),
+    ("ec.generate.checkerboard", "height", "percent"),
+    ("ec.generate.grid", "width", "percent"),
+    ("ec.generate.grid", "height", "percent"),
+    ("ec.generate.lensflare", "flareBrightness", "percent"),
+    ("ec.vr.chromaticaberrations", "falloff", ""),
+    ("ec.vr.denoise", "noiseLevel", ""),
+    ("ec.vr.digitalglitch", "colorDistortion", ""),
+    ("ec.vr.fractalnoise", "subSettings/subInfluence", ""),
+    ("ec.vr.glow", "luminanceThreshold", ""),
+    ("ec.vr.planetosphere", "feather", ""),
+    ("ec.vr.sharpen", "sharpenAmount", ""),
+    ("ec.key.advancedspill", "suppression", "percent"),
+    ("ec.key.advancedspill", "ultraSettings/tolerance", ""),
+    ("ec.key.advancedspill", "ultraSettings/desaturate", ""),
+    ("ec.key.advancedspill", "ultraSettings/spillRange", ""),
+    ("ec.key.advancedspill", "ultraSettings/spillColorCorrection", ""),
+    ("ec.key.advancedspill", "ultraSettings/lumaCorrection", ""),
+    ("ec.key.ccsimplewireremoval", "thickness", ""),
+    ("ec.key.keycleaner", "additionalEdgeRadius", ""),
+    ("ec.key.keycleaner", "alphaContrast", "percent"),
+    ("ec.matte.refinehard", "feather", ""),
+    ("ec.matte.refinehard", "increaseDecontaminationRadius", ""),
+    ("ec.matte.refinesoft", "smooth", ""),
+    ("ec.matte.refinesoft", "feather", ""),
+    ("ec.matte.refinesoft", "shiftEdge", "percent"),
+    ("ec.matte.refinesoft", "decontamination/increaseDecontaminationRadius", ""),
+    ("ec.matte.rotobrush", "rotoBrushPropagation/searchRadius", ""),
+    ("ec.matte.rotobrush", "rotoBrushMatte/feather", ""),
+    ("ec.matte.rotobrush", "rotoBrushMatte/shiftEdge", "percent"),
+    ("ec.matte.rotobrush", "refineEdgeMatte/smooth", ""),
+    ("ec.matte.rotobrush", "refineEdgeMatte/feather", ""),
+    ("ec.matte.rotobrush", "refineEdgeMatte/shiftEdge", "percent"),
+    ("ec.matte.rotobrush", "refineEdgeMatte/decontamination/increaseDecontaminationRadius", ""),
+    ("ec.matte.simplechoker", "chokeMatte", "pixels"),
+    ("ec.noise.fractal", "transform/scale", "percent"),
+    ("ec.noise.fractal", "transform/scaleWidth", "percent"),
+    ("ec.noise.fractal", "transform/scaleHeight", "percent"),
+    ("ec.noise.fractal", "complexity", "percent"),
+    ("ec.noise.fractal", "subSettings/subInfluence", ""),
+    ("ec.noise.turbulent", "transform/scale", "percent"),
+    ("ec.noise.turbulent", "transform/scaleWidth", "percent"),
+    ("ec.noise.turbulent", "transform/scaleHeight", "percent"),
+    ("ec.noise.turbulent", "complexity", "percent"),
+    ("ec.noise.turbulent", "subSettings/subInfluence", ""),
+    ("ec.key.colorkey", "edgeFeather", ""),
+    ("ec.obsolete.lightning", "branchAngle", ""),
+    ("ec.key.luma", "edgeFeather", ""),
+    ("ec.blur.reduceflicker", "softness", ""),
+    ("ec.perspective.cameratracker", "trackPointSize", "percent"),
+    ("ec.perspective.cameratracker", "targetSize", "percent"),
+    ("ec.perspective.cccylinder", "lightHeight", "pixels"),
+    ("ec.sim.ccbubbles", "bubbleSize", "percent"),
+    ("ec.sim.ccdrizzle", "displacement", ""),
+    ("ec.sim.ccdrizzle", "light/lightHeight", "pixels"),
+    ("ec.sim.ccmrmercury", "longevity", ""),
+    ("ec.sim.ccmrmercury", "blobInfluence", "percent"),
+    ("ec.sim.ccmrmercury", "light/lightHeight", "pixels"),
+    ("ec.sim.ccmrmercury", "shading/metal", ""),
+    ("ec.sim.ccparticlesystems2", "birthRate", ""),
+    ("ec.sim.ccparticlesystems2", "longevity", ""),
+    ("ec.sim.ccparticlesystems2", "physics/gravity", "pixels"),
+    ("ec.sim.ccrainfall", "windVariation", ""),
+    ("ec.sim.ccrainfall", "opacity", ""),
+    ("ec.sim.ccsnowfall", "sizeVariation", ""),
+    ("ec.sim.ccsnowfall", "speedVariation", ""),
+    ("ec.sim.ccsnowfall", "windVariation", ""),
+    ("ec.sim.ccsnowfall", "wiggle/wiggleAmount", ""),
+    ("ec.sim.ccsnowfall", "wiggle/wiggleAmountVariation", ""),
+    ("ec.sim.ccsnowfall", "wiggle/wiggleFrequencyVariation", ""),
+    ("ec.sim.ccsnowfall", "opacity", ""),
+    ("ec.sim.ccstarburst", "speed", "percent"),
+    ("ec.sim.ccstarburst", "size", "pixels"),
+    ("ec.stylize.ccblockload", "completion", ""),
+    ("ec.stylize.ccburnfilm", "burn", ""),
+    ("ec.stylize.cchextile", "smearing", ""),
+    ("ec.stylize.cckaleida", "size", "percent"),
+    ("ec.stylize.ccvignette", "pinHighlights", ""),
+    ("ec.stylize.cartoon", "detailThreshold", ""),
+    ("ec.stylize.cartoon", "fill/shadingSmoothness", ""),
+    ("ec.stylize.cartoon", "edge/edgeSoftness", ""),
+    ("ec.stylize.cartoon", "advanced/edgeBlackLevel", ""),
+    ("ec.stylize.glow", "colorLoops", "percent"),
+    ("ec.stylize.roughenedges", "stretch", "pixels"),
+    ("ec.time.pixelmotionblur", "vectorDetail", ""),
+    ("ec.transition.blockdissolve", "blockWidth", "percent"),
+    ("ec.transition.blockdissolve", "blockHeight", "percent"),
+    ("ec.transition.ccgridwipe", "border", "pixels"),
+    ("ec.transition.ccgridwipe", "tiles", "percent"),
+    ("ec.transition.cclinesweep", "completion", ""),
+    ("ec.transition.ccscalewipe", "stretch", "pixels"),
+    ("ec.transition.venetian", "width", "percent"),
+    ("ec.transition.venetian", "feather", ""),
+    ("ec.utility.cineon", "highlightRolloff", ""),
+    ("ec.utility.facemeasurements", "headOrientationX", "degrees"),
+    ("ec.utility.facemeasurements", "headOrientationY", "degrees"),
+    ("ec.utility.facemeasurements", "headOrientationZ", "degrees"),
+    ("ec.utility.facemeasurements", "leftEyebrowRaise", "percent"),
+    ("ec.utility.facemeasurements", "rightEyebrowRaise", "percent"),
+    ("ec.utility.facemeasurements", "mouthOffsetX", "percent"),
+    ("ec.utility.facemeasurements", "mouthOffsetY", "percent"),
+];
diff --git a/crates/engine/src/psd_import.rs b/crates/engine/src/interchange/psd_import.rs
similarity index 100%
rename from crates/engine/src/psd_import.rs
rename to crates/engine/src/interchange/psd_import.rs
diff --git a/crates/engine/src/vector.rs b/crates/engine/src/interchange/vector.rs
similarity index 88%
rename from crates/engine/src/vector.rs
rename to crates/engine/src/interchange/vector.rs
index 3c349a7df..b52517cb3 100644
--- a/crates/engine/src/vector.rs
+++ b/crates/engine/src/interchange/vector.rs
@@ -160,7 +160,7 @@ fn clipped_items(ids: &mut Ids, s: &effectcraft_svg::Shape, m: Affine, clips: &[
 /// Blend Mode). Top of the paint order first.
 ///
 /// Clipping groups (PDF / Illustrator clipping masks): shapes inside them are intersected with
-/// the clip paths through Merge Paths ▸ Intersect (see [`clipped_items`]). Clips enclosing the
+/// the clip paths through Merge Paths ▸ Intersect (see `clipped_items`). Clips enclosing the
 /// whole document are layer masks instead ([`vector_clip_masks`], used by
 /// [`shapes_from_vector`]). Images are skipped (Layer ▸ Create makes them footage layers, see
 /// [`split_at_images`]); soft masks are not converted.
@@ -261,15 +261,73 @@ pub fn is_vector(f: &effectcraft_project::Footage) -> bool {
     effectcraft_render::is_vector_footage(f) || f.path.to_ascii_lowercase().ends_with(".svg")
 }
 
+/// `doc` (the document of footage `f`) in the footage's layer pixels, as the renderer draws it
+/// ([`effectcraft_render::vector_fit`]): a placed page of an After Effects project is scaled to
+/// fill the size stored for it; other footage is unchanged.
+pub fn fitted_to_footage(mut doc: Doc, f: &effectcraft_project::Footage) -> Doc {
+    let (_, [sx, sy]) = effectcraft_render::vector_fit(f, [doc.width, doc.height], doc.pixel_size(), 1.0);
+    if f.placed_page {
+        doc.root.transform = Affine::scale_non_uniform(sx, sy) * doc.root.transform;
+        (doc.width, doc.height) = (doc.width * sx, doc.height * sy);
+    }
+    doc
+}
+
+/// Create Shapes from Vector Layer on a placed page of an After Effects project: a hidden shape
+/// layer filling the frame the footage is drawn in (its `width` × `height` raster, in the layer
+/// pixels of [`fitted_to_footage`]'s document), to be the Alpha track matte of every layer made
+/// from the page, so bleed, art past the artboard and the page's background stay hidden as on
+/// the footage (#3099). `None` for other footage, whose shapes are converted whole as before.
+///
+/// A track matte is drawn at the composition's resolution, so its edge is the footage's raster
+/// edge on shape and image layers alike; a mask on an image layer would be drawn at the image's
+/// own resolution and blur its edge when the image is scaled up.
+pub fn frame_matte(proj: &mut Project, comp: &Comp, src: &Layer, f: &effectcraft_project::Footage) -> Option<Layer> {
+    if !f.placed_page || f.width == 0 || f.height == 0 {
+        return None;
+    }
+    let svg = format!(
+        r##"<svg xmlns="http://www.w3.org/2000/svg" width="{0}" height="{1}"><rect width="{0}" height="{1}" fill="#ffffff"/></svg>"##,
+        f.width, f.height
+    );
+    let doc = effectcraft_svg::parse(svg.as_bytes()).ok()?;
+    let mut l = build::layer(proj, comp, &format!("{} Frame", src.name), LayerSource::Shape, (0, 0), None);
+    add_doc_shapes(proj, &mut l, &doc);
+    copy_transform(proj, src, &mut l);
+    like_source(&mut l, src);
+    // The layers it mattes carry the source's opacity already.
+    if let Some(o) = l.props.prop_mut("transform/opacity") {
+        o.value = Value::Scalar(100.0);
+        o.keys.clear();
+        o.expr = None;
+    }
+    l.name = comp.unique_layer_name(&format!("{} Frame", src.name));
+    l.switches.video = false;
+    Some(l)
+}
+
+/// The vector document of footage `f` (its file read as `bytes`; `None` for other formats): its
+/// page, framed as [`effectcraft_project::Footage::placed_page`] says, restricted to its layer.
+pub fn footage_doc(f: &effectcraft_project::Footage, bytes: &[u8]) -> Option<Result<Doc, String>> {
+    let framing = if f.placed_page { effectcraft_pdf::Framing::Placed } else { effectcraft_pdf::Framing::Viewer };
+    vector_doc(&f.path, bytes, f.layer.as_ref(), f.page, framing)
+}
+
 /// The vector document of an SVG / PDF / AI / EPS file (`None` for other formats): page
-/// `page` of a PDF, restricted to one layer when `layer` names it.
-pub fn vector_doc(path: &str, bytes: &[u8], layer: Option<&effectcraft_project::SourceLayer>, page: u32) -> Option<Result<Doc, String>> {
+/// `page` of a PDF framed as `framing` says, restricted to one layer when `layer` names it.
+pub fn vector_doc(
+    path: &str,
+    bytes: &[u8],
+    layer: Option<&effectcraft_project::SourceLayer>,
+    page: u32,
+    framing: effectcraft_pdf::Framing,
+) -> Option<Result<Doc, String>> {
     if path.to_ascii_lowercase().ends_with(".svg") || effectcraft_svg::looks_like_svg(bytes) {
         return Some(effectcraft_svg::parse(bytes).map_err(|e| format!("{path}: {e}")));
     }
     effectcraft_pdf::sniff(bytes)?;
     Some(
-        effectcraft_pdf::parse_page(bytes, page as usize)
+        effectcraft_pdf::parse_page_framed(bytes, page as usize, framing)
             .map(|d| match layer {
                 Some(l) => effectcraft_pdf::layer_doc_with_sizes(&d, l.index as usize, l.layer_size).0,
                 None => d,
diff --git a/crates/engine/src/xml_project.rs b/crates/engine/src/interchange/xml_project.rs
similarity index 100%
rename from crates/engine/src/xml_project.rs
rename to crates/engine/src/interchange/xml_project.rs
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index cdfc7468e..599aba1b7 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -10,45 +10,21 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
-pub mod autosave;
-pub mod camera_track;
-pub mod commands;
-pub mod config;
-pub mod demo;
-pub mod doc_path;
-pub mod footage_check;
-pub mod footage_reload;
-pub mod guard;
+mod analysis;
+mod background;
+pub mod cmd;
+mod footage;
 pub mod history;
-pub mod jobs;
-pub mod learn;
-pub mod links;
-pub mod logging;
-pub mod mask_track;
-pub mod media_browser;
-pub mod media_cache;
+mod home;
+mod interchange;
 pub mod menus;
-pub mod models;
-pub mod offload;
-pub mod perf;
-pub mod prefs;
+mod output_guard;
 pub mod preview;
-pub mod psd_import;
-pub mod remote;
 pub mod render_queue;
-pub mod roto;
 pub mod scriptui;
-pub mod sequence;
-mod session_settings;
-pub mod shortcuts;
-pub mod storage;
-pub mod sysinfo;
-pub mod templates;
-pub mod tracking;
-pub mod vector;
+mod settings;
+mod system;
 pub mod viewer;
-pub mod warp;
-pub mod xml_project;
 
 use std::sync::Arc;
 
@@ -59,7 +35,17 @@ use effectcraft_time::Tick;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-pub use commands::{CommandSpec, command_specs, find as find_command};
+pub use analysis::camera_track;
+pub use analysis::mask_track;
+pub use analysis::models;
+pub use analysis::roto;
+pub use analysis::tracking;
+pub use analysis::warp;
+pub use background::jobs;
+pub use background::offload;
+pub use background::remote;
+pub use cmd as commands;
+pub use cmd::{CommandSpec, command_specs, find as find_command};
 pub use effectcraft_color as color;
 pub use effectcraft_effects as effects;
 pub use effectcraft_geom as geom;
@@ -71,329 +57,61 @@ pub use effectcraft_segment as segment;
 pub use effectcraft_text as text;
 pub use effectcraft_time as time;
 pub use effectcraft_track as track;
+pub use footage::doc_path;
+pub use footage::footage_check;
+pub use footage::footage_reload;
+pub use footage::media_browser;
+pub use footage::media_cache;
+pub use footage::sequence;
 pub use history::{Branch, History, HistoryNode};
+pub use home::demo;
+pub use home::learn;
+pub use home::links;
+pub use home::templates;
+pub use interchange::psd_import;
+pub use interchange::vector;
+pub use interchange::xml_project;
+use interchange::{keyframe_text, keyframe_text_effects};
 pub use render_queue::{ExportJob, ExportResult, Exporter, JobState};
+pub use settings::autosave;
+pub use settings::config;
+pub use settings::prefs;
+pub use settings::shortcuts;
+pub use system::guard;
+pub use system::library;
+pub use system::logging;
+pub use system::perf;
+pub use system::storage;
+pub use system::sysinfo;
 
-#[derive(Debug, thiserror::Error)]
-pub enum EngineError {
-    #[error("unknown command `{0}`")]
-    UnknownCommand(String),
-    #[error("command `{0}` is not available right now: {1}")]
-    Disabled(String, String),
-    #[error("invalid parameters for `{cmd}`: {msg}")]
-    BadParams { cmd: String, msg: String },
-    #[error("no active composition")]
-    NoComp,
-    /// A `comp` reference (name or id) that names no composition.
-    #[error("no composition {0}")]
-    NoSuchComp(String),
-    #[error("{0}")]
-    Project(#[from] effectcraft_project::ProjectError),
-    #[error("{0}")]
-    Other(String),
-}
+mod doc_state;
+mod error;
+mod event;
+mod fonts;
+mod services;
+mod session;
 
-pub type Result<T> = std::result::Result<T, EngineError>;
-
-/// Host services (file access) injected by the frontend.
-pub trait Services: Send + Sync {
-    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>>;
-    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()>;
-    /// Whether a file exists (the background footage check after open).
-    fn exists(&self, path: &str) -> bool {
-        std::path::Path::new(path).exists()
-    }
-    /// A file's size and modification time (nanoseconds since 1970), to notice that it changed
-    /// on disk (Settings ▸ Import ▸ Reload Footage Changed on Disk); `None` when it can't be read.
-    fn stamp(&self, path: &str) -> Option<(u64, u128)> {
-        let meta = std::fs::metadata(path).ok()?;
-        let modified = meta.modified().ok()?.duration_since(std::time::UNIX_EPOCH).ok()?;
-        Some((meta.len(), modified.as_nanos()))
-    }
-    /// Keep a file the app made for itself (footage extracted from a template): like
-    /// [`Services::write_file`], creating its folder, but never offered as a download (web: it
-    /// goes to browser storage only).
-    fn store_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
-        if let Some(d) = std::path::Path::new(path).parent().filter(|d| !d.as_os_str().is_empty()) {
-            let _ = std::fs::create_dir_all(d);
-        }
-        self.write_file(path, data)
-    }
-    /// The files in folder `dir` (full paths; no folders, no hidden files), for image-sequence
-    /// detection on import. Empty when it can't be read.
-    fn list_dir(&self, dir: &str) -> Vec<String> {
-        let Ok(rd) = std::fs::read_dir(if dir.is_empty() { "." } else { dir }) else { return vec![] };
-        rd.filter_map(|e| e.ok())
-            .filter(|e| e.file_type().is_ok_and(|t| t.is_file()) && !e.file_name().to_string_lossy().starts_with('.'))
-            .map(|e| e.path().to_string_lossy().to_string())
-            .collect()
-    }
-    /// Whether `path` is a folder (dropped or picked folders import their files).
-    fn is_dir(&self, path: &str) -> bool {
-        std::path::Path::new(path).is_dir()
-    }
-}
-
-/// Native filesystem.
-pub struct FsServices;
-impl Services for FsServices {
-    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
-        std::fs::read(path)
-    }
-    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
-        config::atomic_write(std::path::Path::new(path), data)
-    }
-}
-
-/// Imports media files into the project (implemented by the media layer).
-pub trait Importer: Send + Sync {
-    /// Probe one file and return footage metadata. Image sequences are the engine's
-    /// ([`sequence`]): it groups numbered stills and probes their first file here.
-    fn probe(&self, path: &str) -> std::result::Result<effectcraft_project::Footage, String>;
-    /// A footage file's bytes are now at `path` (extracted from a template): hosts whose media
-    /// layer reads from memory (the browser) register them; file-based ones need nothing.
-    fn register(&self, _path: &str, _data: &[u8]) {}
-    /// An image sequence's other frames (its first was probed) are footage now: hosts whose
-    /// media layer reads from memory (the browser) register them; file-based ones need nothing.
-    fn add_frames(&self, _paths: &[String]) {}
-}
-
-/// A keyframe reference: layer, property uid, key time (layer time).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct KeyRef {
-    pub layer: LayerId,
-    pub prop: Uid,
-    pub time: Tick,
-}
-
-/// A keyframe drag in progress (`keys.move` steps sharing a merge key): the selection it
-/// started from and the total offset so far, so every step is applied to the keys as they were
-/// before the drag. A key passed over on the way is never overwritten; only the drop position
-/// counts, as in After Effects.
-#[derive(Clone, Debug)]
-pub struct KeyMove {
-    pub merge: String,
-    pub from: Vec<KeyRef>,
-    pub total: Tick,
-}
-
-/// Keyframes of one property on the keyframe clipboard.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct KeyClip {
-    pub layer: LayerId,
-    /// Match-id path relative to the layer (`transform/position`), portable between layers.
-    pub path: String,
-    /// Keys with times relative to the earliest copied key (layer time).
-    pub keys: Vec<effectcraft_keyframe::Keyframe>,
-}
-
-/// A selected mask vertex: layer, mask group uid, vertex index.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct VertexRef {
-    pub layer: LayerId,
-    pub mask: Uid,
-    pub index: usize,
-}
-
-/// One composition's selection. The active comp's copy lives in [`EditorState::selected_layers`]
-/// (and the property, key, and vertex lists); every other comp keeps its own here (#1001).
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct CompSelection {
-    pub layers: Vec<LayerId>,
-    pub props: Vec<(LayerId, Uid)>,
-    pub keys: Vec<KeyRef>,
-    pub vertices: Vec<VertexRef>,
-}
-
-impl CompSelection {
-    fn is_empty(&self) -> bool {
-        self.layers.is_empty() && self.props.is_empty() && self.keys.is_empty() && self.vertices.is_empty()
-    }
-}
-
-/// Editing state that commands depend on (headless-relevant, serde for agents).
-#[derive(Clone, Debug, Default, Serialize, Deserialize)]
-pub struct EditorState {
-    pub active_comp: Option<ItemId>,
-    /// Open compositions (viewer/timeline tabs), in tab order.
-    pub open_comps: Vec<ItemId>,
-    /// Compositions that were active before the current one, most recent first (Shift+Esc).
-    #[serde(default)]
-    pub recent_comps: Vec<ItemId>,
-    /// Current time per comp (the CTI).
-    pub times: std::collections::BTreeMap<ItemId, Tick>,
-    /// Layer selection of the active comp. Other comps' selections are in [`Self::comp_selections`].
-    pub selected_layers: Vec<LayerId>,
-    /// Selections of comps that are not active, keyed by comp id (#1001).
-    #[serde(default)]
-    pub comp_selections: std::collections::BTreeMap<ItemId, CompSelection>,
-    /// Selected properties / groups (by uid) of selected layers.
-    pub selected_props: Vec<(LayerId, Uid)>,
-    pub selected_keys: Vec<KeyRef>,
-    pub project_selection: Vec<ItemId>,
-    /// Layer clipboard (serialized layers) and keyframe clipboard.
-    #[serde(skip)]
-    pub clipboard: Vec<Layer>,
-    /// Copied keyframes (times relative to the earliest copied key).
-    #[serde(skip)]
-    pub key_clipboard: Vec<KeyClip>,
-    /// The last copy was keyframes (Paste pastes keys at the CTI).
-    #[serde(skip)]
-    pub clip_is_keys: bool,
-    /// Values of selected unanimated properties (match path, value), copied with Edit ▸ Copy;
-    /// Paste sets the same properties of the selected layers.
-    #[serde(skip)]
-    pub value_clipboard: Vec<(String, effectcraft_keyframe::Value)>,
-    /// Copied effect instances, with comp-time key offsets from the earliest copied key.
-    /// Paste adds them to the selected layers at the destination comp's CTI.
-    #[serde(skip)]
-    pub effect_clipboard: Vec<effectcraft_project::PropGroup>,
-    /// Copied shape items (Edit ▸ Copy with groups, paths, paints or path operations selected in
-    /// a shape layer's Contents); Paste adds them to the selected shape layers.
-    #[serde(skip)]
-    pub contents_clipboard: Vec<effectcraft_project::PropGroup>,
-    /// Selected mask vertices (viewer Selection tool / pen).
-    #[serde(default)]
-    pub selected_vertices: Vec<VertexRef>,
-    pub snapping: bool,
-    /// Tools bar ▸ Snapping options (which features snap, Snap Edges Extended).
-    #[serde(default)]
-    pub snap_features: viewer::SnapFeatures,
-    /// Last applied effect id (Effect ▸ last effect).
-    pub last_effect: Option<String>,
-    /// Viewer region of interest `[x, y, w, h]` in comp pixels (Composition ▸ Crop Comp to Region
-    /// of Interest).
-    #[serde(default)]
-    pub region_of_interest: Option<[f64; 4]>,
-    /// Property-link clipboard (Edit ▸ Copy with Property Links / Copy Expression Only).
-    #[serde(skip)]
-    pub link_clipboard: Option<LinkClip>,
-    /// File ▸ Interpret Footage ▸ Remember Interpretation.
-    #[serde(skip)]
-    pub interpretation: Option<effectcraft_project::Footage>,
-    /// Viewer 3D view per comp (Active Camera / Front / … / Custom View 3 and edited view cameras).
-    #[serde(default)]
-    pub views3d: std::collections::BTreeMap<ItemId, effectcraft_render::three_d::Views3D>,
-    /// Tracker panel ▸ Current Track: (tracked layer, tracker group uid) in the active comp.
-    #[serde(default)]
-    pub current_track: Option<(LayerId, Uid)>,
-    /// Tracker panel ▸ Method in mask mode (Track Mask).
-    #[serde(default)]
-    pub mask_track_method: mask_track::MaskMethod,
-    /// 3D Camera Tracker: the selected track points (ids) in the viewer.
-    #[serde(default)]
-    pub camera_points: Vec<u32>,
-    /// Mask Interpolation panel options.
-    #[serde(default)]
-    pub mask_interp: commands::mask_interp::MaskInterpOptions,
-    /// Paint and Brushes panel options (Brush, Clone Stamp and Eraser tools).
-    #[serde(default)]
-    pub paint: commands::paint::PaintOptions,
-    /// Roto Brush and Refine Edge tool options.
-    #[serde(default)]
-    pub roto: roto::RotoOptions,
-    /// Puppet tool options for new meshes.
-    #[serde(default)]
-    pub puppet: commands::puppet::PuppetOptions,
-    /// The shape tools' and the Pen's options (Tool Creates Shape / Mask, Fill and Stroke).
-    #[serde(default)]
-    pub shape_tool: commands::shape_tool::ShapeTool,
-    /// View ▸ Switch View Layout: 1, 2 or 4 views side by side in the Composition viewer.
-    #[serde(default = "one_view")]
-    pub view_layout: u8,
-    /// View ▸ Switch View Layout ▸ Share View Options (grid, guides… in every view).
-    #[serde(default)]
-    pub share_view_options: bool,
-    /// Layer ▸ Mask ▸ Hide Locked Masks (viewer outlines).
-    #[serde(default)]
-    pub hide_locked_masks: bool,
-    /// On-canvas text editing (Type tool): the edited layer, selection and insertion style.
-    #[serde(default)]
-    pub text_edit: Option<commands::text_edit::TextEdit>,
-    /// Text copied while editing (with its formatting), for Paste / Paste Text Formatting Only.
-    #[serde(skip)]
-    pub text_clipboard: Option<effectcraft_keyframe::TextDoc>,
-    /// Composition viewer display options (Show Channel, exposure, snapshot, Fast Previews).
-    #[serde(default)]
-    pub viewer: commands::viewer_cmds::ViewOptions,
-    /// Essential Graphics panel ▸ Primary composition (`None` = the active comp).
-    #[serde(default)]
-    pub essential_primary: Option<ItemId>,
-    /// Essential Graphics panel ▸ Solo Supported Properties (the timeline shows only properties
-    /// Essential Graphics can expose).
-    #[serde(default)]
-    pub essential_solo: bool,
-    /// File ▸ Watch Folder: the folder being watched for projects to render (frontends call
-    /// `file.watchFolder.poll` periodically while it is set).
-    #[serde(default)]
-    pub watch_folder: Option<String>,
-    /// The Footage panel: the footage shown, its time and In/Out marks (source time).
-    #[serde(default)]
-    pub footage_panel: Option<commands::footage_panel::FootageView>,
-    /// Media Browser: the folder shown and the favourites.
-    #[serde(default)]
-    pub media_browser: media_browser::BrowserState,
-    /// Content-Aware Fill panel settings.
-    #[serde(default)]
-    pub content_fill: commands::content_fill::FillSettings,
-    /// View ▸ Split with New Locked Viewer: the second viewer's comp and 3D view.
-    #[serde(default)]
-    pub locked_viewer: Option<commands::viewer_cmds::LockedViewer>,
-}
-
-fn one_view() -> u8 {
-    1
-}
-
-/// `t` as a current time of `comp`: a frame within its duration.
-fn comp_frame_at(comp: &Comp, t: Tick) -> Tick {
-    comp.frame_rate.snap_nearest(t.min(comp.duration - comp.frame_duration()).max(Tick::ZERO))
-}
-
-/// What Copy with Property Links / Copy Expression Only put on the clipboard.
-#[derive(Clone, Debug, PartialEq)]
-pub enum LinkClip {
-    /// Expressions that link back to the source properties: (match path, expression text).
-    Links { relative: bool, links: Vec<(String, String)> },
-    /// Expressions only: (match path, expression).
-    Expressions(Vec<(String, effectcraft_project::Expression)>),
-}
-
-/// Events for frontends (drained each frame).
-#[derive(Clone, Debug, PartialEq, Serialize)]
-pub enum Event {
-    ProjectChanged {
-        revision: u64,
-    },
-    Toast {
-        message: String,
-        error: bool,
-    },
-    OpenComp(ItemId),
-    OpenUrl(String),
-    /// A frontend-only command (viewer zoom, panels, dialogs…) ran: the UI performs it. Headless
-    /// sessions ignore these.
-    Frontend {
-        command: String,
-        params: Value,
-    },
-    /// Drop cached frames / renders (Edit ▸ Purge).
-    PurgeCaches,
-    /// Put an image on the system clipboard (Composition ▸ Copy Frame to Clipboard): `rgba` is
-    /// `width` × `height` straight-alpha RGBA8 rows. Headless sessions ignore it; the pixels are
-    /// not serialized.
-    CopyImage {
-        width: u32,
-        height: u32,
-        #[serde(skip)]
-        rgba: Vec<u8>,
-    },
-}
+pub use cmd::{animation_presets, text_presets};
+pub use doc_state::{CompSelection, EditorState, KeyClip, KeyMove, KeyRef, LinkClip, VertexRef};
+pub use error::{EngineError, Result};
+pub use event::Event;
+pub use fonts::{FontRow, font_features, font_menu, font_preview, font_styles, text_families};
+pub use services::{FsServices, Importer, Services};
+pub use session::upgrade_effects;
 
 pub struct Session {
     pub project: Arc<Project>,
     pub history: History,
     pub revision: u64,
+    /// Process-unique monotonic revision of the on-canvas editor's committed text and session.
+    /// Unlike [`Session::revision`], unrelated project edits do not advance it; the IME receipt
+    /// uses it when surrounding text is unavailable. Read it with
+    /// [`commands::text_edit::ime_stamp_revision`].
+    ///
+    /// Stamps come from a process-global checked allocator and are never rewound: a failed
+    /// atomic batch keeps the highest intermediate stamp. On allocator exhaustion no stamp is
+    /// issued, so an unavailable receipt cannot be accepted with a reused revision.
+    pub ime_revision: u64,
     pub saved_revision: u64,
     /// The project as last opened or saved: the project is unmodified while it is this very
     /// snapshot, so undoing back to the saved state clears the modified mark.
@@ -447,8 +165,15 @@ pub struct Session {
     pub journal: Vec<(String, Value)>,
     /// Processed-layer pixels reused across frames and edits (content-keyed, never stale).
     pub layer_cache: Arc<LayerCache>,
+    /// The last Cryptomatte pick probe (see [`Session::crypto_probe_job`]). Public only so that
+    /// other crates can build a `Session { .. }`; its type is crate-private.
+    #[doc(hidden)]
+    pub crypto_probe: Arc<std::sync::Mutex<commands::CryptoProbeSlot>>,
     /// The persistent disk cache (Settings ▸ Media & Disk Cache), when enabled.
     pub disk_cache: Option<Arc<effectcraft_render::disk_cache::DiskCache>>,
+    /// Files File ▸ Reload Footage reloaded while the disk cache was off: their entries are
+    /// dropped when it is switched on ([`Session::configure_disk_cache`]), before it is used.
+    pub pending_disk_drops: std::collections::BTreeSet<String>,
     /// Settings (Preferences).
     pub prefs: prefs::Prefs,
     /// Bumped whenever settings change (frontends re-apply theme, labels…).
@@ -478,6 +203,16 @@ pub struct Session {
     /// Loads WebAssembly effect plug-ins (set by the host that links `effectcraft-plugin` with
     /// its runtime): `effect.plugins.load`.
     pub plugin_loader: Option<PluginLoader>,
+    /// External effect helpers (native hosts link `effectcraft-helper-host`):
+    /// `effect.helpers.list`, `effect.helpers.scan`, `effect.helpers.load`.
+    pub helpers: Option<HelperHooks>,
+    /// Renders a module without registering it (`library.preview`; set with `plugin_loader`).
+    pub plugin_previewer: Option<PluginPreviewer>,
+    /// Where effect plug-ins live (hosts set it; else `Plug-ins` next to the settings): the
+    /// Plug-in Library installs into its `Library` folder ([`library`]).
+    pub plugins_dir: Option<std::path::PathBuf>,
+    /// The Plug-in Library's catalog, worker status and the packages this session loaded.
+    pub library: library::Library,
     /// ScriptUI windows and panels opened by scripts (see [`scriptui`]).
     pub script_ui: scriptui::ScriptUi,
     /// The last physical-memory reading (Settings ▸ Memory & CPU budgets); `None` = unknown
@@ -487,6 +222,8 @@ pub struct Session {
     pub key_move: Option<KeyMove>,
     /// Reads the system's memory in the background for [`Session::memory_tick`].
     pub memory_watch: sysinfo::MemoryWatch,
+    /// Reads the disk cache's free disk space in the background for [`Session::memory_tick`].
+    pub disk_watch: sysinfo::DiskWatch,
     /// Switches Affect Nested Comps as last applied (a change empties the layer cache).
     pub applied_nested_switches: Option<bool>,
     /// Runs renders and analyses off the UI thread where there are no threads (the web app's
@@ -510,7 +247,8 @@ pub struct Session {
     pub next_task_id: u64,
     /// The running Learn tutorial (Home ▸ Learn), see [`learn`].
     pub learn: Option<learn::Progress>,
-    /// Check footage in the background after File ▸ Open ([`footage_check`]): frontends with an
+    /// Track footage availability automatically, after File ▸ Open ([`footage_check`]) and in
+    /// the desktop disk watcher. Frontends with an
     /// event loop (the desktop app) turn this on; headless sessions run `footage.check` when
     /// they want it.
     pub check_footage_on_open: bool,
@@ -519,8 +257,9 @@ pub struct Session {
     /// Each footage file's size and modification time when last seen (Settings ▸ Import ▸
     /// Reload Footage Changed on Disk, [`footage_reload`]).
     pub footage_stamps: std::collections::HashMap<String, footage_reload::Stamp>,
-    /// The stamps being taken on a worker thread ([`footage_reload::start_scan`]).
-    pub footage_scan: Option<footage_reload::Scan>,
+    /// The footage files effects read the channels of, as last given to the footage source
+    /// ([`Session::refresh_aux_footage`]); `None` = not given yet.
+    pub aux_footage: Option<Vec<String>>,
     /// How many script-issued commands are running ([`Session::execute_for_script`]): while one
     /// is, settings that guard what scripts may do can't change (see
     /// [`prefs::Scripting::same_permissions`]).
@@ -552,7 +291,28 @@ pub type ScriptRunner = fn(&mut Session, &ScriptRequest) -> Value;
 /// describes it (`{id, name, category, version, api, params}`).
 pub type PluginLoader = fn(&[u8], &str) -> std::result::Result<Value, String>;
 
+/// What a host that runs external effect helpers provides (`docs/external-helpers.md`).
+#[derive(Clone, Copy)]
+pub struct HelperHooks {
+    /// Start the helpers installed in the host's search paths and register their effects
+    /// (`retry` forgets the block list first) → `{paths, helpers, loaded, errors}`.
+    pub scan: fn(bool) -> Value,
+    /// Load a file or folder through the helpers that accept it → `{loaded, errors}`.
+    pub load: fn(&str) -> std::result::Result<Value, String>,
+    /// The helpers and their state → `{helpers, blocked}`.
+    pub list: fn() -> Value,
+}
+
+/// Renders one WebAssembly effect module without registering it (the Plug-in Library preview):
+/// `(bytes, width, height, premultiplied RGBA pixels, times in seconds)` → (manifest JSON, one frame
+/// per time).
+pub type PluginPreviewer = fn(&[u8], u32, u32, &[[f32; 4]], &[f64]) -> std::result::Result<(Value, Vec<Vec<[f32; 4]>>), String>;
+
 impl Default for Session {
+    /// A new unsaved session: a default project that is both current and saved, no path, no
+    /// active jobs, the plain `FsServices`/`NoFootage` defaults, default preferences and keymaps,
+    /// empty history, events and journal, and a fresh process-wide IME stamp (`u64::MAX` when the
+    /// allocator is exhausted).
     fn default() -> Self {
         let project = Arc::new(Project::default());
         Session {
@@ -560,6 +320,8 @@ impl Default for Session {
             project,
             history: History::default(),
             revision: 0,
+            // A fresh session gets its own process-monotonic stamp even before its first edit.
+            ime_revision: commands::text_edit::next_ime_revision().unwrap_or(u64::MAX),
             saved_revision: 0,
             path: None,
             state: EditorState { snapping: true, view_layout: 1, ..Default::default() },
@@ -587,7 +349,9 @@ impl Default for Session {
             events: vec![],
             journal: vec![],
             layer_cache: Arc::new(LayerCache::default()),
+            crypto_probe: Default::default(),
             disk_cache: None,
+            pending_disk_drops: Default::default(),
             prefs: prefs::Prefs::default(),
             prefs_revision: 0,
             config: None,
@@ -600,10 +364,15 @@ impl Default for Session {
             snapshot: None,
             script: None,
             plugin_loader: None,
+            helpers: None,
+            plugin_previewer: None,
+            plugins_dir: None,
+            library: Default::default(),
             script_ui: scriptui::ScriptUi::default(),
             sys_memory: None,
             key_move: None,
             memory_watch: Default::default(),
+            disk_watch: Default::default(),
             applied_nested_switches: None,
             offload: None,
             offloaded: vec![],
@@ -618,817 +387,13 @@ impl Default for Session {
             check_footage_on_open: false,
             stored_paths: Default::default(),
             footage_stamps: Default::default(),
-            footage_scan: None,
+            aux_footage: None,
             script_calls: ScriptCalls::default(),
         }
     }
 }
 
-impl Session {
-    pub fn new() -> Session {
-        Session::default()
-    }
-
-    /// Run a command by id.
-    pub fn execute(&mut self, id: &str, params: Value) -> Result<Value> {
-        let spec = commands::find(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
-        if let Err(why) = (spec.enabled)(self) {
-            // Explicit targets (agents, scripts) don't need a UI selection.
-            let explicit = (["layer", "layers", "prop", "keys"].iter().any(|k| params.get(k).is_some()) && commands::has_comp(self).is_ok())
-                || ["item", "items"].iter().any(|k| params.get(k).is_some())
-                // An explicit composition (the enablement looks at the active one).
-                || params.get("comp").is_some_and(|c| !c.is_null() && self.resolve_comp(Some(c)).is_ok());
-            if !explicit {
-                return Err(EngineError::Disabled(id.to_string(), why));
-            }
-        }
-        // Last-resort guard: a panicking command reports an error instead of crashing the app.
-        let r = guard::guarded(&format!("command `{id}`"), || (spec.run)(self, &params))?;
-        self.learn_observe(id, &params);
-        if spec.journal {
-            self.journal.push((id.to_string(), params));
-            if self.journal.len() > 10_000 {
-                self.journal.drain(..1000);
-            }
-        }
-        Ok(r)
-    }
-
-    /// [`Session::execute`] for agents and scripts (MCP, CLI, control channel): unknown top-level
-    /// parameters are rejected with the accepted keys instead of being silently ignored.
-    pub fn execute_checked(&mut self, id: &str, params: Value) -> Result<Value> {
-        let spec = commands::find(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
-        commands::check_params(spec, &params)?;
-        self.execute(id, params)
-    }
-
-    /// [`Session::execute`] for a command a script asked for (the JavaScript engine's
-    /// `app.run`, ScriptUI callbacks…). The command and everything it runs count as the script's:
-    /// it may not change the settings that limit scripts (Settings ▸ Scripting & Expressions ▸
-    /// Application Scripting), which only the user can, from the UI, CLI or control channel.
-    pub fn execute_for_script(&mut self, id: &str, params: Value) -> Result<Value> {
-        self.script_calls.0 = self.script_calls.0.saturating_add(1);
-        let r = self.execute(id, params);
-        self.script_calls.0 = self.script_calls.0.saturating_sub(1);
-        r
-    }
-
-    /// Whether the command running was issued by a script ([`Session::execute_for_script`]).
-    pub fn running_for_script(&self) -> bool {
-        self.script_calls.0 > 0
-    }
-
-    pub fn is_enabled(&self, id: &str) -> bool {
-        commands::find(id).is_some_and(|c| (c.enabled)(self).is_ok())
-    }
-
-    /// Apply an undoable edit. `merge`: consecutive edits with the same key fold into one step.
-    pub fn edit<T>(&mut self, label: &str, merge: Option<&str>, f: impl FnOnce(&mut Project, &mut EditorState) -> Result<T>) -> Result<T> {
-        let before = self.project.clone();
-        let mut p = (*self.project).clone();
-        let mut st = self.state.clone();
-        let r = f(&mut p, &mut st)?;
-        // Layer styles: one Global Light per comp, whichever layer edited it.
-        effectcraft_project::styles::sync_global_light(&before, &mut p);
-        // Essential Properties of precomp layers follow their comps' Essential Graphics.
-        effectcraft_project::essential::sync_project(&before, &mut p);
-        // Warp Stabilizer analyses made from other frames are cleared (and queued again).
-        for w in warp::invalidate(&before, &mut p) {
-            if !self.warp_pending.contains(&w) {
-                self.warp_pending.push(w);
-            }
-        }
-        // So are 3D Camera Tracker tracks (and solves made with other settings).
-        for w in camera_track::invalidate(&before, &mut p) {
-            if !self.camera_pending.contains(&w) {
-                self.camera_pending.push(w);
-            }
-        }
-        // Roto Brush Input Keys follow the frames; edited instances propagate again.
-        for r in roto::sync(&before, &mut p) {
-            if !self.roto_pending.contains(&r) {
-                self.roto_pending.push(r);
-            }
-        }
-        // Nothing changed (a value set to what it already was): no undo step, not modified.
-        if p.same_content(&before) {
-            self.state = st;
-            return Ok(r);
-        }
-        let same = merge.is_some() && merge.map(str::to_string) == self.history.merge_key;
-        if !same {
-            // Undone steps aren't lost: they stay in the History panel as a branch.
-            let levels = self.prefs.general.undo_levels.max(1) as usize;
-            self.history.record(label, before, levels);
-        } else {
-            self.history.abandon_redo(&before);
-        }
-        self.history.merge_key = merge.map(str::to_string);
-        self.project = Arc::new(p);
-        self.state = st;
-        self.bump();
-        Ok(r)
-    }
-
-    pub fn bump(&mut self) {
-        self.revision += 1;
-        // Back at the saved state (undo, redo, a history jump or a rolled-back batch).
-        if Arc::ptr_eq(&self.project, &self.saved_project) {
-            self.saved_revision = self.revision;
-        }
-        if self.disk_cache.is_some() {
-            self.layer_cache.set_disk_salt(effectcraft_render::disk_cache::footage_salt(&self.project));
-        }
-        self.events.push(Event::ProjectChanged { revision: self.revision });
-    }
-
-    /// Set a comp's Resolution. As in After Effects it is saved with the project (which becomes
-    /// modified) but is no undo step, and it changes no pixels: the comp's cached frames stay
-    /// valid ([`effectcraft_project::Comp::same_pixels`]).
-    pub fn set_resolution(&mut self, comp: ItemId, r: effectcraft_project::Resolution) -> Result<()> {
-        if self.project.comp(comp).ok_or(EngineError::NoComp)?.resolution == r {
-            return Ok(());
-        }
-        Arc::make_mut(&mut self.project).comp_mut(comp).ok_or(EngineError::NoComp)?.resolution = r;
-        self.bump();
-        Ok(())
-    }
-
-    /// Keep what lives outside the undo history (each comp's Resolution) as it is in `from`, the
-    /// project before undo, redo or a history jump restored another state.
-    pub(crate) fn keep_view_settings(&mut self, from: &Project) {
-        let keep: Vec<(ItemId, effectcraft_project::Resolution)> =
-            self.project.comps().filter_map(|(id, c)| from.comp(*id).map(|f| (*id, f.resolution)).filter(|(_, r)| *r != c.resolution)).collect();
-        if keep.is_empty() {
-            return;
-        }
-        let p = Arc::make_mut(&mut self.project);
-        for (id, r) in keep {
-            if let Some(c) = p.comp_mut(id) {
-                c.resolution = r;
-            }
-        }
-    }
-
-    pub fn undo(&mut self) -> bool {
-        let Some((label, p)) = self.history.undo.pop() else { return false };
-        let cur = std::mem::replace(&mut self.project, p);
-        self.keep_view_settings(&cur);
-        self.history.redo.push((label, cur));
-        self.history.merge_key = None;
-        self.sanitize_state();
-        self.bump();
-        true
-    }
-
-    pub fn redo(&mut self) -> bool {
-        let Some((label, p)) = self.history.redo.pop() else { return false };
-        let cur = std::mem::replace(&mut self.project, p);
-        self.keep_view_settings(&cur);
-        self.history.undo.push((label, cur));
-        self.history.merge_key = None;
-        self.sanitize_state();
-        self.bump();
-        true
-    }
-
-    /// Drop selections that no longer exist. Each comp keeps its own selection (#1001); a layer id
-    /// counts only inside the comp that owns it, so the active comp never sees another comp's layers.
-    pub fn sanitize_state(&mut self) {
-        let p = self.project.clone();
-        self.state.open_comps.retain(|c| p.comp(*c).is_some());
-        self.state.comp_selections.retain(|cid, sel| {
-            let Some(c) = p.comp(*cid) else { return false };
-            let ids: Vec<LayerId> = c.layers.iter().map(|l| l.id).collect();
-            sel.layers.retain(|l| ids.contains(l));
-            sel.props.retain(|(l, _)| ids.contains(l));
-            sel.keys.retain(|k| ids.contains(&k.layer));
-            sel.vertices.retain(|v| ids.contains(&v.layer));
-            !sel.is_empty()
-        });
-        if self.state.active_comp.is_some_and(|c| p.comp(c).is_none()) {
-            self.clear_live_selection();
-            self.state.active_comp = self.state.open_comps.first().copied();
-            if let Some(id) = self.state.active_comp {
-                self.recall_selection(id);
-            }
-        }
-        if let Some(c) = self.active_comp() {
-            let ids: Vec<LayerId> = c.layers.iter().map(|l| l.id).collect();
-            self.state.selected_layers.retain(|l| ids.contains(l));
-            self.state.selected_props.retain(|(l, _)| ids.contains(l));
-            self.state.selected_keys.retain(|k| ids.contains(&k.layer));
-            self.state.selected_vertices.retain(|v| ids.contains(&v.layer));
-        }
-        if let Some((l, t)) = self.state.current_track
-            && self.active_comp().and_then(|c| c.layer(l)).and_then(|l| l.tracker(t)).is_none()
-        {
-            self.state.current_track = None;
-        }
-        self.state.project_selection.retain(|i| p.item(*i).is_some());
-        commands::text_edit::sanitize(self);
-    }
-
-    pub fn is_dirty(&self) -> bool {
-        self.revision != self.saved_revision
-    }
-
-    /// The project as it is now is the saved one (after opening or saving it).
-    pub fn mark_saved(&mut self) {
-        self.saved_project = self.project.clone();
-        self.saved_revision = self.revision;
-    }
-
-    /// The project has changes its file doesn't (a session restored with unsaved changes): it
-    /// stays modified until it is saved, whatever is undone.
-    pub fn mark_unsaved(&mut self) {
-        self.saved_project = Arc::new(Project::default());
-        self.bump();
-    }
-
-    pub fn active_comp(&self) -> Option<&Comp> {
-        self.project.comp(self.state.active_comp?)
-    }
-    /// [`Session::active_comp`] as a shared snapshot (an `Arc` clone, not a deep copy).
-    pub fn active_comp_arc(&self) -> Option<std::sync::Arc<Comp>> {
-        self.project.comp_arc(self.state.active_comp?)
-    }
-    pub fn active_comp_id(&self) -> Option<ItemId> {
-        self.state.active_comp.filter(|c| self.project.comp(*c).is_some())
-    }
-
-    /// Current time of a comp.
-    pub fn time_of(&self, comp: ItemId) -> Tick {
-        self.state.times.get(&comp).copied().unwrap_or(Tick::ZERO)
-    }
-
-    /// Current time of the active comp.
-    pub fn time(&self) -> Tick {
-        self.state.active_comp.and_then(|c| self.state.times.get(&c).copied()).unwrap_or(Tick::ZERO)
-    }
-
-    pub fn set_time(&mut self, t: Tick) {
-        if let Some(c) = self.state.active_comp {
-            let t = self.project.comp(c).map_or(t, |comp| comp_frame_at(comp, t));
-            self.state.times.insert(c, t);
-            if self.prefs.general.sync_time_related_items {
-                self.sync_related_times(c, t);
-            }
-        }
-    }
-
-    /// Settings ▸ General ▸ Synchronize Time of All Related Items: moving the current time of
-    /// `comp` moves the current time of the comps nested in it (through their precomp layers'
-    /// timing) and of the comps it is nested in, so every related viewer shows the same moment.
-    pub fn sync_related_times(&mut self, comp: ItemId, t: Tick) {
-        let mut seen = std::collections::BTreeSet::from([comp]);
-        let mut todo = vec![(comp, t)];
-        let mut found = vec![];
-        while let Some((cid, ct)) = todo.pop() {
-            if cid != comp {
-                found.push((cid, ct));
-            }
-            let Some(c) = self.project.comp(cid) else { continue };
-            // Down: the comps this one nests.
-            for l in &c.layers {
-                if let effectcraft_project::LayerSource::Comp { item } = &l.source
-                    && seen.insert(*item)
-                {
-                    todo.push((*item, l.layer_time(ct)));
-                }
-            }
-            // Up: the comps nesting this one.
-            for iid in self.project.items.keys() {
-                if let Some(pc) = self.project.comp(*iid)
-                    && let Some(l) = pc.layers.iter().find(|l| matches!(&l.source, effectcraft_project::LayerSource::Comp { item } if *item == cid))
-                    && seen.insert(*iid)
-                {
-                    todo.push((*iid, l.comp_time(ct)));
-                }
-            }
-        }
-        for (cid, ct) in found {
-            if let Some(c) = self.project.comp(cid) {
-                let ct = c.frame_rate.snap_nearest(ct.clamp(Tick::ZERO, (c.duration - c.frame_duration()).max(Tick::ZERO)));
-                self.state.times.insert(cid, ct);
-            }
-        }
-    }
-
-    /// Make `id` the active comp, parking the previous comp's selection and restoring this one's.
-    pub fn activate_comp(&mut self, id: ItemId) {
-        if self.project.comp(id).is_none() || self.state.active_comp == Some(id) {
-            return;
-        }
-        self.remember_selection();
-        self.state.active_comp = Some(id);
-        self.recall_selection(id);
-        self.state.current_track = None;
-    }
-
-    /// Leave no comp active, keeping the one that was active in [`EditorState::comp_selections`].
-    pub fn activate_comp_none(&mut self) {
-        self.remember_selection();
-        self.state.active_comp = None;
-        self.clear_live_selection();
-        self.state.current_track = None;
-    }
-
-    fn remember_selection(&mut self) {
-        let Some(id) = self.state.active_comp else { return };
-        let sel = CompSelection {
-            layers: self.state.selected_layers.clone(),
-            props: self.state.selected_props.clone(),
-            keys: self.state.selected_keys.clone(),
-            vertices: self.state.selected_vertices.clone(),
-        };
-        if sel.is_empty() {
-            self.state.comp_selections.remove(&id);
-        } else {
-            self.state.comp_selections.insert(id, sel);
-        }
-    }
-
-    fn recall_selection(&mut self, id: ItemId) {
-        match self.state.comp_selections.remove(&id) {
-            Some(sel) => {
-                self.state.selected_layers = sel.layers;
-                self.state.selected_props = sel.props;
-                self.state.selected_keys = sel.keys;
-                self.state.selected_vertices = sel.vertices;
-            }
-            None => self.clear_live_selection(),
-        }
-    }
-
-    fn clear_live_selection(&mut self) {
-        self.state.selected_layers.clear();
-        self.state.selected_props.clear();
-        self.state.selected_keys.clear();
-        self.state.selected_vertices.clear();
-    }
-
-    /// Open a comp in the viewer/timeline and make it active.
-    pub fn open_comp(&mut self, id: ItemId) {
-        if self.project.comp(id).is_none() {
-            return;
-        }
-        if !self.state.open_comps.contains(&id) {
-            self.state.open_comps.push(id);
-        }
-        if self.state.active_comp != Some(id) {
-            let previous = self.state.active_comp;
-            self.state.recent_comps.retain(|c| *c != id && Some(*c) != previous);
-            if let Some(previous) = previous {
-                self.state.recent_comps.insert(0, previous);
-                self.state.recent_comps.truncate(32);
-            }
-        }
-        self.activate_comp(id);
-        self.events.push(Event::OpenComp(id));
-    }
-
-    /// The open compositions and their current times, as a project file records them
-    /// ([`effectcraft_project::SavedView`]).
-    pub fn saved_view(&self) -> effectcraft_project::SavedView {
-        let comp_times = self.state.times.iter().filter(|(id, _)| self.project.comp(**id).is_some()).map(|(id, t)| (*id, *t)).collect();
-        effectcraft_project::SavedView { active_comp: self.state.active_comp, open_comps: self.state.open_comps.clone(), comp_times }
-    }
-
-    /// Reopen the compositions a project file was saved with (#748), each at its saved current
-    /// time (#1714). Ids that no longer name a comp are skipped; with none left the project stays
-    /// on the comp [`Session::replace_project`] opened (its first), as files from before the view
-    /// was saved do.
-    pub fn restore_view(&mut self, view: &effectcraft_project::SavedView) {
-        for (id, t) in &view.comp_times {
-            if let Some(comp) = self.project.comp(*id) {
-                let t = comp_frame_at(comp, *t);
-                self.state.times.insert(*id, t);
-            }
-        }
-        let mut open: Vec<ItemId> = Vec::new();
-        for id in view.open_comps.iter().copied().filter(|id| self.project.comp(*id).is_some()) {
-            if !open.contains(&id) {
-                open.push(id);
-            }
-        }
-        let Some(active) = view.active_comp.filter(|id| self.project.comp(*id).is_some()).or_else(|| open.first().copied()) else { return };
-        self.state.open_comps = open;
-        self.open_comp(active);
-    }
-
-    pub fn toast(&mut self, msg: impl Into<String>) {
-        self.events.push(Event::Toast { message: msg.into(), error: false });
-    }
-
-    pub fn drain_events(&mut self) -> Vec<Event> {
-        std::mem::take(&mut self.events)
-    }
-
-    /// The 3D view camera of a comp's viewer (None = the active camera).
-    pub fn view_camera(&self, comp: ItemId) -> Option<effectcraft_render::three_d::CameraState> {
-        let c = self.project.comp(comp)?;
-        if !c.has_3d() {
-            return None;
-        }
-        self.state.views3d.get(&comp)?.override_camera(c.width as f64, c.height as f64)
-    }
-
-    /// Render a comp frame with the session's footage + expression hosts.
-    pub fn render(&self, comp: ItemId, t: Tick, opts: RenderOpts) -> Image {
-        let opts = RenderOpts { nested_switches: self.prefs.general.switches_affect_nested_comps, draft_shadows: self.prefs.three_d.realtime_shadows, ..opts };
-        let mut r = Renderer::new(&self.project, self.footage.as_ref(), opts);
-        r.expr = self.expr.as_deref();
-        r.cache = Some(&self.layer_cache);
-        r.accel = self.accel.as_deref();
-        r.comp_frame(comp, t)
-    }
-
-    /// Resolve a comp reference (item id number or name; `None`/null = the active comp).
-    pub fn resolve_comp(&self, comp: Option<&Value>) -> Result<ItemId> {
-        let p = match comp {
-            Some(v) if !v.is_null() => serde_json::json!({ "comp": v }),
-            _ => serde_json::json!({}),
-        };
-        commands::comp_id(self, &p)
-    }
-
-    /// Render a comp frame (comp time `t`) as opaque 8-bit RGBA over the comp background, scaled
-    /// so the longest side is at most `max_side` pixels (0 = full size). Returns (width, height, rgba).
-    pub fn render_rgba8(&self, comp: ItemId, t: Tick, max_side: u32) -> Result<(u32, u32, Vec<u8>)> {
-        let c = self.project.comp(comp).ok_or(EngineError::NoComp)?;
-        let long = c.width.max(c.height).max(1) as f64;
-        let scale = if max_side == 0 { 1.0 } else { (max_side as f64 / long).min(1.0) };
-        let img = self.render(comp, t, RenderOpts { scale, backend: effectcraft_render::Backend::Auto, ..Default::default() });
-        Ok((img.width, img.height, img.to_rgba8_over(c.background)))
-    }
-
-    /// A Project panel thumbnail of an item (a comp at `t`, footage at its first frame), longest
-    /// side at most `max_side`, as a job that owns everything it reads: frontends run it off the
-    /// UI thread (a big comp takes far longer than a frame). `None` for items without pixels.
-    pub fn thumbnail_job(&self, item: ItemId, t: Tick, max_side: u32) -> Option<ThumbnailJob> {
-        let it = self.project.item(item)?;
-        let footage = self.footage.clone();
-        match &it.kind {
-            effectcraft_project::ItemKind::Comp(c) => {
-                let (project, expr, cache) = (self.project.clone(), self.expr.clone(), self.layer_cache.clone());
-                let long = c.width.max(c.height).max(1) as f64;
-                let scale = if max_side == 0 { 1.0 } else { (max_side as f64 / long).min(1.0) };
-                let opts = RenderOpts {
-                    scale,
-                    nested_switches: self.prefs.general.switches_affect_nested_comps,
-                    draft_shadows: self.prefs.three_d.realtime_shadows,
-                    ..Default::default()
-                };
-                let bg = c.background;
-                Some(Box::new(move || {
-                    let mut r = Renderer::new(&project, footage.as_ref(), opts);
-                    r.expr = expr.as_deref();
-                    r.cache = Some(&cache);
-                    let img = r.comp_frame(item, t);
-                    Some((img.width, img.height, img.to_rgba8_over(bg)))
-                }))
-            }
-            effectcraft_project::ItemKind::Footage(f) if f.has_video => {
-                let f = f.clone();
-                Some(Box::new(move || {
-                    let img = footage.frame(item, &f, Tick(0))?;
-                    // Point-sample down to at most `max_side` on the long side.
-                    let step = (img.width.max(img.height) as f32 / max_side.max(1) as f32).ceil().max(1.0) as u32;
-                    let (w, h) = (img.width.div_ceil(step), img.height.div_ceil(step));
-                    let full = img.to_rgba8();
-                    let mut px = Vec::with_capacity((w * h * 4) as usize);
-                    for y in 0..h {
-                        for x in 0..w {
-                            let i = (((y * step) * img.width + x * step) * 4) as usize;
-                            px.extend_from_slice(&full[i..i + 4]);
-                        }
-                    }
-                    Some((w, h, px))
-                }))
-            }
-            _ => None,
-        }
-    }
-
-    /// [`Session::render_rgba8`], or with `transparent` the frame's own straight alpha (what a
-    /// render with RGB + Alpha channels writes) instead of compositing over the background.
-    pub fn render_rgba8_alpha(&self, comp: ItemId, t: Tick, max_side: u32, transparent: bool) -> Result<(u32, u32, Vec<u8>)> {
-        if !transparent {
-            return self.render_rgba8(comp, t, max_side);
-        }
-        let c = self.project.comp(comp).ok_or(EngineError::NoComp)?;
-        let long = c.width.max(c.height).max(1) as f64;
-        let scale = if max_side == 0 { 1.0 } else { (max_side as f64 / long).min(1.0) };
-        let img = self.render(comp, t, RenderOpts { scale, backend: effectcraft_render::Backend::Auto, ..Default::default() });
-        Ok((img.width, img.height, img.to_rgba8()))
-    }
-
-    /// Make the media layer and the layer cache let go of what they decoded from `footage`'s
-    /// files (it keys frames by path, so an overwritten file would keep showing its old pixels).
-    pub(crate) fn forget_decoded(&self, footage: &effectcraft_project::Footage) {
-        for p in std::iter::once(&footage.path).chain(&footage.sequence) {
-            self.footage.forget(p);
-        }
-        self.layer_cache.clear();
-    }
-
-    /// Replace the whole project (open/new), resetting history and state.
-    pub fn replace_project(&mut self, mut p: Project, path: Option<String>) {
-        if self.stop_render()
-            && let Some(mut job) = self.render_job.take()
-        {
-            // Let the worker notice the cancel; its updates refer to the old project.
-            job.wait();
-        }
-        self.render_job = None;
-        self.stored_paths = Default::default();
-        self.stop_track();
-        self.track_job = None;
-        self.stop_mask_track();
-        self.mask_job = None;
-        self.stop_warp();
-        self.warp_job = None;
-        self.warp_pending.clear();
-        self.stop_camera();
-        self.camera_job = None;
-        self.camera_pending.clear();
-        self.stop_roto();
-        self.roto_job = None;
-        self.roto_pending.clear();
-        self.drop_tasks();
-        self.script_ui.project_epoch = self.script_ui.project_epoch.wrapping_add(1);
-        p.fix_next_id();
-        upgrade_effects(&mut p);
-        // The media layer keys decoded frames by path: files of the new project may have changed
-        // since an earlier project decoded them (#1070).
-        for it in p.items.values() {
-            if let effectcraft_project::ItemKind::Footage(f) = &it.kind {
-                self.forget_decoded(f);
-            }
-        }
-        self.layer_cache.clear();
-        self.project = Arc::new(p);
-        self.history = History::default();
-        self.state = EditorState { snapping: true, view_layout: 1, ..Default::default() };
-        self.path = path;
-        self.bump();
-        self.mark_saved();
-        let first = self.project.comps().next().map(|(id, _)| *id);
-        if let Some(c) = first {
-            self.open_comp(c);
-        }
-    }
-}
-
-/// Bring effect instances saved by earlier versions up to date with the effect registry
-/// (renamed / regrouped / added parameters, reordered popups; see
-/// [`effectcraft_effects::migrate`]), and a project from before
-/// [`effectcraft_project::SCHEMA_EFFECT_SPACE`] into effect space
-/// ([`effectcraft_effects::migrate::to_effect_space`]). Stamps the current schema.
-pub fn upgrade_effects(p: &mut Project) {
-    let to_effect_space = p.schema < effectcraft_project::SCHEMA_EFFECT_SPACE;
-    // Effect bounds per layer: (size, top-left in layer coordinates).
-    let mut bounds = std::collections::HashMap::new();
-    for (cid, c) in p.comps() {
-        for l in &c.layers {
-            bounds.insert((*cid, l.id), effectcraft_render::effect_bounds(p, c, l));
-        }
-    }
-    let mut next = p.next_id;
-    for (cid, it) in p.items.iter_mut() {
-        let effectcraft_project::ItemKind::Comp(c) = &mut it.kind else { continue };
-        for l in &mut std::sync::Arc::make_mut(c).layers {
-            let (size, origin) = bounds.get(&(*cid, l.id)).copied().unwrap_or(([100.0, 100.0], [0.0; 2]));
-            // Effect space starts at the bounds' top-left: positions move by minus that corner.
-            // Adjustment layers run their effects on the comp below as it is: nothing moves.
-            let shift = |o: [f64; 2]| [-o[0], -o[1]];
-            let d = if l.switches.adjustment { [0.0; 2] } else { shift(origin) };
-            let clone_d = |src: Option<u64>| match src {
-                Some(id) => bounds.get(&(*cid, effectcraft_project::LayerId(id))).map_or([0.0; 2], |b| shift(b.1)),
-                None => d,
-            };
-            let Some(fx) = l.props.sub_mut("effects") else { continue };
-            for n in &mut fx.children {
-                let effectcraft_project::Node::Group(g) = n else { continue };
-                let effectcraft_project::GroupKind::Effect { effect } = &g.kind else { continue };
-                if let Some(spec) = effectcraft_effects::find(effect) {
-                    effectcraft_effects::migrate::upgrade_instance(spec, g, &mut effectcraft_project::build::Ids(&mut next), size);
-                    if to_effect_space {
-                        effectcraft_effects::migrate::to_effect_space(spec, g, size, d, &clone_d);
-                    }
-                }
-            }
-        }
-    }
-    p.next_id = next;
-    p.schema = effectcraft_project::SCHEMA_VERSION;
-}
-
 #[cfg(test)]
 mod rq_tests;
 #[cfg(test)]
 mod tests;
-#[cfg(test)]
-mod tests_3d;
-#[cfg(test)]
-mod tests_anim_presets;
-#[cfg(test)]
-mod tests_anim_tools;
-#[cfg(test)]
-mod tests_camera_track;
-#[cfg(test)]
-mod tests_codec_options;
-#[cfg(test)]
-mod tests_color_view;
-#[cfg(test)]
-mod tests_delete_keys;
-#[cfg(test)]
-mod tests_disk_cache;
-#[cfg(test)]
-mod tests_effects;
-#[cfg(test)]
-mod tests_essential;
-#[cfg(test)]
-mod tests_essential_more;
-#[cfg(test)]
-mod tests_face;
-#[cfg(test)]
-mod tests_fidelity;
-#[cfg(test)]
-mod tests_frame_export;
-#[cfg(test)]
-mod tests_fuzz_open;
-#[cfg(test)]
-mod tests_import_project;
-#[cfg(test)]
-mod tests_key_metadata_order;
-#[cfg(test)]
-mod tests_keylight;
-#[cfg(test)]
-mod tests_limits;
-#[cfg(test)]
-mod tests_lottie;
-#[cfg(test)]
-mod tests_m137;
-#[cfg(test)]
-mod tests_m145;
-#[cfg(test)]
-mod tests_markers;
-#[cfg(test)]
-mod tests_mask_warp;
-#[cfg(test)]
-mod tests_menu_cmds;
-#[cfg(test)]
-mod tests_model3d;
-#[cfg(test)]
-mod tests_motion_blur_depth;
-#[cfg(test)]
-mod tests_project_items;
-#[cfg(test)]
-mod tests_proxy;
-#[cfg(test)]
-mod tests_quick_offset;
-#[cfg(test)]
-mod tests_rig3d;
-#[cfg(test)]
-mod tests_sequence;
-#[cfg(test)]
-mod tests_settings;
-#[cfg(test)]
-mod tests_shortcut_cmds;
-#[cfg(test)]
-mod tests_stubs;
-#[cfg(test)]
-mod tests_styles;
-#[cfg(test)]
-mod tests_tail;
-#[cfg(test)]
-mod tests_text;
-#[cfg(test)]
-mod tests_text_edit;
-#[cfg(test)]
-mod tests_timeline;
-#[cfg(test)]
-mod tests_timeline_interchange;
-#[cfg(test)]
-mod tests_track;
-#[cfg(test)]
-mod tests_vector_import;
-#[cfg(test)]
-mod tests_viewer;
-
-/// Font families available to text layers (bundled + scanned system fonts).
-/// Text animation presets: (id, name), for menus.
-pub fn text_presets() -> Vec<(String, String)> {
-    commands::text_preset_list()
-}
-
-/// Built-in animation presets (Effects & Presets ▸ * Animation Presets): (id, name, category).
-pub fn animation_presets() -> Vec<(String, String, String)> {
-    commands::builtin_preset_list()
-}
-
-pub fn text_families() -> Vec<String> {
-    effectcraft_text::families().into_iter().map(|(f, _)| f).collect()
-}
-
-/// The styles a family offers (its own faces, in weight order), for the style menus. A family
-/// that isn't installed offers the usual styles, which resolve to Inter's.
-pub fn font_styles(family: &str) -> Vec<String> {
-    effectcraft_text::families()
-        .into_iter()
-        .find(|(f, _)| f.eq_ignore_ascii_case(family))
-        .map(|(_, st)| st)
-        .filter(|st| !st.is_empty())
-        .unwrap_or_else(|| ["Regular", "Medium", "SemiBold", "Bold", "Italic"].iter().map(|s| s.to_string()).collect())
-}
-
-/// The OpenType feature tags (GSUB / GPOS) of the face a family + style resolves to.
-pub fn font_features(family: &str, style: &str) -> Vec<String> {
-    effectcraft_text::fonts::face(effectcraft_text::resolve(family, style).face).features()
-}
-
-/// One row of the Character panel's font menu.
-#[derive(Clone, Debug, PartialEq)]
-pub struct FontRow {
-    /// The family to apply (empty for the separator after the recent fonts).
-    pub family: String,
-    /// What the menu shows: the English family name, or the font's own-language name when
-    /// Settings ▸ Type ▸ Show Font Names in English is off.
-    pub display: String,
-    pub recent: bool,
-    /// A variable font (the menu's Variable Fonts filter keeps only these).
-    pub variable: bool,
-}
-
-/// Outline polylines of "Sample" set in `family` at `size` px (baseline at y = 0, y down), for
-/// the font menu's preview (Settings ▸ Type ▸ Show Font Preview).
-pub fn font_preview(family: &str, size: f64) -> Vec<Vec<[f32; 2]>> {
-    use kurbo::PathEl;
-    let st = effectcraft_keyframe::text_doc::CharStyle { font: family.to_string(), size, ..Default::default() };
-    let mut out = vec![];
-    let mut x = 0.0;
-    for ch in "Sample".chars() {
-        let (path, adv) = effectcraft_text::char_glyph_style(&st, ch);
-        let mut cur: Vec<[f32; 2]> = vec![];
-        let pt = |p: kurbo::Point| [(p.x + x) as f32, p.y as f32];
-        kurbo::flatten(&path, 0.2, |el| match el {
-            PathEl::MoveTo(p) => {
-                if cur.len() > 1 {
-                    out.push(std::mem::take(&mut cur));
-                }
-                cur = vec![pt(p)];
-            }
-            PathEl::LineTo(p) => cur.push(pt(p)),
-            PathEl::ClosePath => {
-                if let Some(f) = cur.first().copied() {
-                    cur.push(f);
-                }
-                if cur.len() > 1 {
-                    out.push(std::mem::take(&mut cur));
-                }
-            }
-            _ => {}
-        });
-        if cur.len() > 1 {
-            out.push(cur);
-        }
-        x += adv;
-    }
-    out
-}
-
-/// The Character panel's font menu: the recent fonts (Settings ▸ Type ▸ Number of Recent Fonts
-/// to Display), a separator, then every family. Each row says whether the family is variable,
-/// for the menu's Variable Fonts filter.
-pub fn font_menu(prefs: &prefs::Prefs) -> Vec<FontRow> {
-    let all = text_families();
-    let native = if prefs.type_.font_names_in_english { Default::default() } else { effectcraft_text::fonts::native_families() };
-    let variable = effectcraft_text::fonts::variable_families();
-    let row = |f: &String, recent: bool| FontRow {
-        family: f.clone(),
-        display: native.get(f).cloned().unwrap_or_else(|| f.clone()),
-        recent,
-        variable: variable.contains(f),
-    };
-    let mut out: Vec<FontRow> = prefs.recent_fonts_shown().iter().filter(|f| all.contains(f)).map(|f| row(f, true)).collect();
-    if !out.is_empty() {
-        out.push(FontRow { family: String::new(), display: "-".into(), recent: false, variable: false });
-    }
-    out.extend(all.iter().map(|f| row(f, false)));
-    out
-}
-#[cfg(test)]
-mod tests_history;
-#[cfg(test)]
-mod tests_models;
-#[cfg(test)]
-mod tests_paint;
-#[cfg(test)]
-mod tests_panels;
-#[cfg(test)]
-mod tests_roto;
-
-#[cfg(test)]
-mod tests_key_time;
diff --git a/crates/engine/src/menus.rs b/crates/engine/src/menus.rs
index bc486a0c5..70acbd1fb 100644
--- a/crates/engine/src/menus.rs
+++ b/crates/engine/src/menus.rs
@@ -61,6 +61,12 @@ fn file_name(p: &str) -> String {
     std::path::Path::new(p).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| p.to_string())
 }
 
+/// The labels of a recent-files list: `names[i]`, or the whole of `full[i]` when another entry
+/// has the same name, so entries for two files named `Tool.jsx` tell them apart.
+fn distinct_labels(names: Vec<String>, full: &[String]) -> Vec<String> {
+    names.iter().zip(full).map(|(n, f)| if names.iter().filter(|m| *m == n).count() > 1 { f.clone() } else { n.clone() }).collect()
+}
+
 fn dyn_entry(label: String, command: &str, params: Value) -> MenuEntry {
     MenuEntry { label, command: command.into(), params, shortcut: None, alt_shortcuts: vec![] }
 }
@@ -72,26 +78,35 @@ fn holder_of(s: &Session, keys: &str) -> Option<String> {
 }
 
 /// The entries of a `@dynamic:<name>` node, and the disabled placeholder shown when there are
-/// none: `recentProjects`, `recentFootage`, `recentPresets`, `history` (undo steps, newest
+/// none: `recentProjects`, `recentFootage`, `recentPresets`, `recentScripts` (File ▸ Scripts ▸
+/// Recent Script Files), `history` (undo steps, newest
 /// first), `view3dShortcuts`, `workspaceShortcuts`, `savedWorkspaces` (Window ▸ Workspace) and
 /// `openViewers` (open compositions other than the active one), `scripts` (File ▸ Scripts) and
-/// `scriptPanels` (ScriptUI panels).
+/// `scriptPanels` (ScriptUI panels; a script in a subfolder is labelled `Folder/File.jsx` here,
+/// and [`dynamic_nodes`] puts it in the folder's submenu).
 pub fn dynamic(s: &Session, name: &str, cx: &DynCtx) -> (Vec<MenuEntry>, Option<&'static str>) {
     use serde_json::json;
     let indexed = |list: &[String], cmd: &str, stem: bool| -> Vec<MenuEntry> {
-        list.iter()
-            .enumerate()
-            .map(|(i, p)| {
-                let n =
-                    if stem { std::path::Path::new(p).file_stem().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| p.clone()) } else { file_name(p) };
-                dyn_entry(n, cmd, json!({"index": i}))
-            })
-            .collect()
+        let names = list
+            .iter()
+            .map(
+                |p| if stem { std::path::Path::new(p).file_stem().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| p.clone()) } else { file_name(p) },
+            )
+            .collect();
+        distinct_labels(names, list).into_iter().enumerate().map(|(i, n)| dyn_entry(n, cmd, json!({"index": i}))).collect()
     };
     match name {
         "recentProjects" => (indexed(&s.prefs.recent_projects, "file.openRecent", false), Some("No Recent Projects")),
         "recentFootage" => (indexed(&s.prefs.recent_footage, "file.importRecent", false), Some("No Recent Footage")),
         "recentPresets" => (indexed(&s.prefs.recent_presets, "anim.applyRecentPreset", true), Some("No Recent Presets")),
+        "recentScripts" => {
+            let full: Vec<String> = s.prefs.recent_scripts.iter().map(|r| r.text().to_string()).collect();
+            let names = full.iter().map(|p| file_name(p)).collect();
+            (
+                distinct_labels(names, &full).into_iter().enumerate().map(|(i, n)| dyn_entry(n, "file.runScript", json!({"recent": i}))).collect(),
+                Some("No Recent Script Files"),
+            )
+        }
         "history" => (
             s.history.undo.iter().rev().enumerate().map(|(i, (l, _))| dyn_entry(format!("Undo {l}"), "edit.history", json!({"steps": i + 1}))).collect(),
             Some("No History"),
@@ -153,6 +168,31 @@ pub fn dynamic(s: &Session, name: &str, cx: &DynCtx) -> (Vec<MenuEntry>, Option<
     }
 }
 
+/// [`dynamic`] as menu nodes, which is what frontends draw: scripts and panels in a subfolder
+/// (`Motion Kit/Animate.jsx`) go into a submenu named after the folder (`Motion Kit ▸
+/// Animate.jsx`), placed where the folder sorts among the other entries.
+pub fn dynamic_nodes(s: &Session, name: &str, cx: &DynCtx) -> (Vec<MenuNode>, Option<&'static str>) {
+    let (entries, empty) = dynamic(s, name, cx);
+    let scripts = matches!(name, "scripts" | "scriptPanels");
+    let mut out: Vec<MenuNode> = vec![];
+    for mut e in entries {
+        let Some((folder, file)) = e.label.split_once('/').filter(|_| scripts).map(|(d, f)| (d.to_string(), f.to_string())) else {
+            out.push(MenuNode::Item(e));
+            continue;
+        };
+        e.label = file;
+        let open = out.iter_mut().find_map(|n| match n {
+            MenuNode::Submenu { label, children } if *label == folder => Some(children),
+            _ => None,
+        });
+        match open {
+            Some(children) => children.push(MenuNode::Item(e)),
+            None => out.push(MenuNode::Submenu { label: folder, children: vec![MenuNode::Item(e)] }),
+        }
+    }
+    (out, empty)
+}
+
 /// Display label of a submenu (the "Assign Shortcut to …" submenus name the current view or
 /// workspace, like After Effects).
 pub fn submenu_label(s: &Session, label: &str, cx: &DynCtx) -> String {
@@ -541,6 +581,7 @@ File
     EffectCraft Project... | file.importProject
     Placeholder... | file.importPlaceholder
     Solid... | file.importSolid
+    After Effects Project... | file.importAep
     Lottie... | file.importLottie
     Vanishing Point (.vpe)... | file.importVanishingPoint
     Essential Graphics Template... | essential.importTemplate
@@ -551,6 +592,7 @@ File
   Export
     Add to Render Queue | renderQueue.add
     Adobe Premiere Pro Project... | file.exportTimeline
+    After Effects Project... | file.exportAep
     Lottie JSON... | file.exportLottie
     Essential Graphics Template... | essential.exportTemplate
   ---
@@ -576,6 +618,8 @@ File
     Install Script File... | file.installScript
     Install ScriptUI Panel... | file.installScriptUIPanel
     Run Script File... | file.runScript
+    Recent Script Files
+      @dynamic:recentScripts
   ---
   Create Proxy
     Still... | file.createProxy {"kind":"still"}
@@ -733,6 +777,7 @@ Layer
     Shape Layer | layer.newShape
     Adjustment Layer | layer.newAdjustment
     Content-Aware Fill Layer... | layer.newContentAwareFill
+    3D Primitive... | layer.newPrimitive
     Cube | layer.new3dPrimitive {"kind":"cube"}
     Sphere | layer.new3dPrimitive {"kind":"sphere"}
     Plane | layer.new3dPrimitive {"kind":"plane"}
@@ -817,6 +862,16 @@ Layer
     Flip Vertical | layer.transform {"op":"flipV"}
     Center In View | layer.transform {"op":"center"} | Cmd+Home
     Center Anchor Point in Layer Content | layer.centerAnchor
+    Quick Set Anchor
+      Top Left | layer.quickSetAnchor {"point":"topLeft"}
+      Top | layer.quickSetAnchor {"point":"top"}
+      Top Right | layer.quickSetAnchor {"point":"topRight"}
+      Left | layer.quickSetAnchor {"point":"left"}
+      Center | layer.quickSetAnchor {"point":"center"}
+      Right | layer.quickSetAnchor {"point":"right"}
+      Bottom Left | layer.quickSetAnchor {"point":"bottomLeft"}
+      Bottom | layer.quickSetAnchor {"point":"bottom"}
+      Bottom Right | layer.quickSetAnchor {"point":"bottomRight"}
     Fit to Comp | layer.transform {"op":"fit"} | Cmd+Alt+F
     Fit to Comp Width | layer.transform {"op":"fitWidth"} | Cmd+Alt+Shift+H
     Fit to Comp Height | layer.transform {"op":"fitHeight"} | Cmd+Alt+Shift+G
@@ -963,6 +1018,7 @@ Layer
     Duplicate and Assign Material | material.duplicateAssign
   Auto-trace... | layer.autoTrace
   Pre-compose... | layer.precompose
+  Un-precompose | layer.unprecompose
   Scene Edit Detection... | layer.sceneEditDetection
 Effect
   Effect Controls | window.panel {"panel":"effectControls"} | F3, Cmd+Shift+T
@@ -971,6 +1027,11 @@ Effect
   ---
   Manage Effects... | effect.manage
   Load Effect Plug-in... | effect.plugins.load
+  Install Effect Plug-in... | effect.plugins.install
+  Install Effect Plug-in Bundle (Folder)... | effect.plugins.install {"bundle": true}
+  Load Plug-ins Through Helper... | effect.helpers.load
+  Scan for Effect Helpers | effect.helpers.scan
+  Plug-in Library... | prefs.open {"page":"library"}
   ---
   @effects
 Animation
@@ -993,6 +1054,8 @@ Animation
   ---
   Add Keyframe | anim.addKeyframe
   Toggle Hold Keyframe | keys.toggleHold
+  Mute Keyframes | keys.setMuted
+  Unmute Keyframes | keys.setMuted {"muted":false}
   Keyframe Interpolation... | keys.interpolation
   Keyframe Velocity... | keys.velocity
   Keyframe Assistant
@@ -1200,7 +1263,7 @@ Window
   Essential Graphics | window.panel {"panel":"essentialGraphics"}
   Info | window.panel {"panel":"info"} | Cmd+2
   Learn | help.inAppTutorials
-  Lumetri Scopes | window.panel {"panel":"lumetriScopes"}
+  Video Scopes | window.panel {"panel":"lumetriScopes"}
   Mask Interpolation | window.panel {"panel":"maskInterpolation"}
   Media Browser | window.panel {"panel":"mediaBrowser"}
   Metadata | window.panel {"panel":"metadata"}
diff --git a/crates/engine/src/menus/tests.rs b/crates/engine/src/menus/tests.rs
index 913a0e92e..8de3cc6dc 100644
--- a/crates/engine/src/menus/tests.rs
+++ b/crates/engine/src/menus/tests.rs
@@ -23,6 +23,25 @@ fn platform_entries(mac: bool) -> Vec<(Vec<String>, MenuEntry)> {
     out
 }
 
+/// Guard the generated display tree, not command IDs, format tokens or dynamic user names.
+#[test]
+fn builtin_menu_labels_do_not_reintroduce_vendor_feature_names() {
+    for mac in [true, false] {
+        let entries = platform_entries(mac);
+        for (path, entry) in &entries {
+            for label in path.iter().chain(std::iter::once(&entry.label)) {
+                let folded = label.to_lowercase();
+                assert!(!folded.starts_with("cc "), "{label}");
+                for mark in ["lumetri", "mercury", "mocha", "keylight"] {
+                    assert!(!folded.contains(mark), "{label}");
+                }
+            }
+        }
+        let scopes = entries.iter().find(|(_, e)| e.command == "window.panel" && e.params["panel"] == "lumetriScopes").unwrap();
+        assert_eq!(scopes.1.label, "Video Scopes");
+    }
+}
+
 #[test]
 fn top_level_order_matches_after_effects() {
     let mac: Vec<String> =
diff --git a/crates/engine/src/models.rs b/crates/engine/src/models.rs
deleted file mode 100644
index b4ddab00d..000000000
--- a/crates/engine/src/models.rs
+++ /dev/null
@@ -1,463 +0,0 @@
-//! Trained models (Settings ▸ Roto Brush and Settings ▸ Face Tracking; `roto.model*` and
-//! `face.model*` commands): which models the registry offers (`effectcraft_segment::MODELS`, all
-//! open source), which are installed (in the `models` folder), installing one from a file or
-//! downloading the official weights (verified against the registry's SHA-256 either way, and kept
-//! with a notice naming their authors and licence), choosing one per task, and loading it in the
-//! background: into the Roto Brush effect (`effects::roto::set_model`) or the face tracker
-//! ([`Models::face`]).
-//!
-//! Weights are never bundled: the install stays small and nothing is fetched unless asked for.
-//! Downloads use the system's `curl` (shipped with Windows 10+, macOS and most Linux systems),
-//! so no networking code is linked into EffectCraft; without it, the file can be downloaded in a
-//! browser and installed with Install from File. The browser build uses the built-in engines
-//! only, for now.
-
-use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex};
-
-use effectcraft_segment::face::FaceModel;
-use effectcraft_segment::{self as seg, Loaded, ModelInfo, Task};
-use serde_json::{Value, json};
-
-use crate::commands::{CommandSpec, always, b_p, bad, str_p};
-use crate::{EngineError, Result, Session, cmd, query};
-
-/// What a task's background worker reports.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Status {
-    /// What is happening now ("Downloading MobileSAM…").
-    pub busy: Option<String>,
-    /// The model in use.
-    pub active: Option<String>,
-    /// The last failure, for the Settings page.
-    pub error: Option<String>,
-    /// A finished job's message and whether it failed, for a toast (taken by
-    /// [`Session::poll_models`]).
-    pub done: Option<(String, bool)>,
-}
-
-/// The session's trained models: per task, the worker's status; and the face model in use.
-#[derive(Default)]
-pub struct Models {
-    roto: Arc<Mutex<Status>>,
-    face: Arc<Mutex<Status>>,
-    face_model: FaceSlot,
-}
-
-impl Models {
-    fn lane(&self, task: Task) -> &Arc<Mutex<Status>> {
-        match task {
-            Task::Mask => &self.roto,
-            Task::Face => &self.face,
-        }
-    }
-
-    pub fn status(&self, task: Task) -> Status {
-        self.lane(task).lock().map(|s| s.clone()).unwrap_or_default()
-    }
-
-    /// The face model face tracking uses (`None`: the classic tracker).
-    pub fn face(&self) -> Option<Arc<dyn FaceModel>> {
-        self.face_model.lock().ok().and_then(|m| m.clone())
-    }
-
-    fn set_active(&self, task: Task, model: Option<Loaded>) {
-        activate(self.lane(task), &self.face_model, task, model);
-    }
-}
-
-type FaceSlot = Arc<Mutex<Option<Arc<dyn FaceModel>>>>;
-
-/// Put a loaded model to use (or drop `task`'s): Roto Brush's lives in the effect, the face
-/// tracker's in `face`.
-fn activate(lane: &Arc<Mutex<Status>>, face: &FaceSlot, task: Task, model: Option<Loaded>) {
-    let id = model.as_ref().map(|m| match m {
-        Loaded::Mask(m) => m.info().id.to_string(),
-        Loaded::Face(m) => m.info().id.to_string(),
-    });
-    match (task, model) {
-        (Task::Mask, Some(Loaded::Mask(m))) => crate::effects::roto::set_model(Some(m)),
-        (Task::Mask, _) => crate::effects::roto::set_model(None),
-        (Task::Face, m) => {
-            if let Ok(mut slot) = face.lock() {
-                *slot = match m {
-                    Some(Loaded::Face(f)) => Some(f),
-                    _ => None,
-                };
-            }
-        }
-    }
-    set(lane, |s| s.active = id);
-}
-
-fn set(status: &Arc<Mutex<Status>>, f: impl FnOnce(&mut Status)) {
-    if let Ok(mut s) = status.lock() {
-        f(&mut s);
-    }
-}
-
-/// How a task shows in Settings, toasts and the command list.
-struct Kind {
-    /// Command prefix and settings key section.
-    prefix: &'static str,
-    label: &'static str,
-    classic_name: &'static str,
-    classic_description: &'static str,
-}
-
-const ROTO: Kind = Kind {
-    prefix: "roto",
-    label: "Roto Brush",
-    classic_name: "Classic (graph cut)",
-    classic_description: "Built in: colour models and graph cuts, propagated by optical flow. Always available.",
-};
-
-const FACE: Kind = Kind {
-    prefix: "face",
-    label: "Face Tracking",
-    classic_name: "Classic (shape model)",
-    classic_description: "Built in: a skin colour model, facial feature shapes and a fitted face shape model. Best on front-facing, evenly lit faces. Always available.",
-};
-
-fn kind(task: Task) -> &'static Kind {
-    match task {
-        Task::Mask => &ROTO,
-        Task::Face => &FACE,
-    }
-}
-
-impl Session {
-    /// The folder installed models live in: the host's, else `models` next to the settings.
-    pub fn models_dir(&self) -> Option<PathBuf> {
-        self.models_dir.clone().or_else(|| Some(self.config.as_ref()?.dir()?.join("models")))
-    }
-
-    /// Where `m` is installed, if it is (a file of the published size).
-    pub fn model_path(&self, m: &ModelInfo) -> Option<PathBuf> {
-        let p = self.models_dir()?.join(m.file_name);
-        std::fs::metadata(&p).ok().filter(|md| md.len() == m.size).map(|_| p)
-    }
-
-    /// The model chosen for `task` (Settings).
-    pub fn chosen_model(&self, task: Task) -> &str {
-        match task {
-            Task::Mask => &self.prefs.roto.model,
-            Task::Face => &self.prefs.face.model,
-        }
-    }
-
-    fn choose_model(&mut self, task: Task, id: &str) {
-        let slot = match task {
-            Task::Mask => &mut self.prefs.roto.model,
-            Task::Face => &mut self.prefs.face.model,
-        };
-        *slot = id.to_string();
-    }
-
-    /// Load (or drop) the models Settings chooses; called whenever settings change.
-    pub fn apply_models(&mut self) {
-        for task in [Task::Mask, Task::Face] {
-            self.apply_model(task, false);
-        }
-    }
-
-    /// Load (or drop) `task`'s chosen model; `wait`: before returning (scripts and agents).
-    fn apply_model(&mut self, task: Task, wait: bool) {
-        let want = self.chosen_model(task).to_string();
-        let lane = self.models.lane(task).clone();
-        let st = self.models.status(task);
-        let info = seg::info(&want).filter(|m| m.task == task);
-        let Some(info) = info else {
-            if st.active.is_some() {
-                self.models.set_active(task, None);
-            }
-            return;
-        };
-        if st.active.as_deref() == Some(info.id) || st.busy.is_some() {
-            return;
-        }
-        let Some(path) = self.model_path(info) else {
-            self.models.set_active(task, None);
-            return;
-        };
-        let (face_slot, label) = (self.models.face_model.clone(), kind(task).label);
-        spawn(&lane, label, format!("Loading {}…", info.name), wait, move |status| {
-            let m = load_file(&path, info.id)?;
-            activate(status, &face_slot, task, Some(m));
-            Ok(format!("{label}: {} loaded", info.name))
-        });
-    }
-
-    /// Finish what the model workers did: a toast, and loading a model that just arrived.
-    pub fn poll_models(&mut self) {
-        for task in [Task::Mask, Task::Face] {
-            let done = self.models.lane(task).lock().ok().and_then(|mut s| s.done.take());
-            if let Some((message, error)) = done {
-                self.events.push(crate::Event::Toast { message, error });
-                self.apply_model(task, false);
-            }
-        }
-    }
-}
-
-fn load_file(path: &Path, id: &str) -> std::result::Result<Loaded, String> {
-    let bytes = std::fs::read(path).map_err(|e| format!("cannot read {}: {e}", path.display()))?;
-    seg::load(id, &bytes)
-}
-
-/// Run `job` on a worker thread (`wait`: right here), reporting through `status` (desktop; the
-/// browser build has no trained models yet).
-fn spawn(
-    status: &Arc<Mutex<Status>>,
-    label: &'static str,
-    what: String,
-    wait: bool,
-    job: impl FnOnce(&Arc<Mutex<Status>>) -> std::result::Result<String, String> + Send + 'static,
-) {
-    if cfg!(target_arch = "wasm32") {
-        set(status, |s| s.error = Some("trained models are available in the desktop app".into()));
-        return;
-    }
-    set(status, |s| {
-        s.busy = Some(what);
-        s.error = None;
-    });
-    let st = status.clone();
-    let run = move || {
-        let r = job(&st);
-        set(&st, |s| {
-            s.busy = None;
-            match r {
-                Ok(msg) => s.done = Some((msg, false)),
-                Err(e) => {
-                    s.done = Some((format!("{label} model: {e}"), true));
-                    s.error = Some(e);
-                }
-            }
-        });
-    };
-    if wait {
-        run();
-    } else if let Err(e) = std::thread::Builder::new().name("ec-model".into()).spawn(run) {
-        set(status, |s| {
-            s.busy = None;
-            s.error = Some(format!("cannot start: {e}"));
-        });
-    }
-}
-
-/// The notice kept next to `m`'s weights.
-fn notice_path(dir: &Path, m: &ModelInfo) -> PathBuf {
-    dir.join(format!("{}.NOTICE.txt", m.file_name))
-}
-
-/// Copy verified weights into the models folder (atomically), with their notice.
-fn install_bytes(dir: &Path, m: &ModelInfo, bytes: &[u8]) -> std::result::Result<PathBuf, String> {
-    if bytes.len() as u64 != m.size || seg::sha256::hex(bytes) != m.sha256 {
-        return Err(format!("this is not the published {} file (size or SHA-256 differs)", m.name));
-    }
-    use crate::config::FileOps;
-    let path = dir.join(m.file_name);
-    let files = crate::config::StdFiles;
-    files.write(&path, bytes).map_err(|e| format!("cannot write {}: {e}", path.display()))?;
-    files.write(&notice_path(dir, m), seg::notice(m).as_bytes()).map_err(|e| format!("cannot write the notice: {e}"))?;
-    Ok(path)
-}
-
-fn model_p(p: &Value, cmd: &str, task: Task) -> Result<&'static ModelInfo> {
-    let id = str_p(p, "id").ok_or_else(|| bad(cmd, "missing `id`"))?;
-    seg::info(id).filter(|m| m.task == task).ok_or_else(|| bad(cmd, format!("unknown model `{id}` (see {}.models)", kind(task).prefix)))
-}
-
-fn list(s: &mut Session, task: Task) -> Result<Value> {
-    let k = kind(task);
-    let st = s.models.status(task);
-    let chosen = s.chosen_model(task).to_string();
-    let mut v = vec![json!({
-        "id": seg::CLASSICAL,
-        "name": k.classic_name,
-        "description": k.classic_description,
-        "licence": "MIT OR Apache-2.0",
-        "installed": true,
-        "selected": chosen == seg::CLASSICAL,
-        "active": st.active.is_none(),
-    })];
-    for m in seg::models(task) {
-        v.push(json!({
-            "id": m.id,
-            "name": m.name,
-            "description": m.description,
-            "authors": m.authors,
-            "licence": m.licence,
-            "licenceUrl": m.licence_url,
-            "homepage": m.homepage,
-            "url": m.url,
-            "size": m.size,
-            "sha256": m.sha256,
-            "installed": s.model_path(m).is_some(),
-            "selected": chosen == m.id,
-            "active": st.active.as_deref() == Some(m.id),
-        }));
-    }
-    Ok(json!({"models": v, "busy": st.busy, "error": st.error, "folder": s.models_dir().map(|d| d.display().to_string())}))
-}
-
-/// After a `wait`: the job's failure, as the command's.
-fn waited(s: &Session, task: Task, cmd: &str) -> Result<()> {
-    match s.models.status(task).error {
-        Some(e) => Err(bad(cmd, e)),
-        None => Ok(()),
-    }
-}
-
-fn select(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
-    let cmd = format!("{}.model.select", kind(task).prefix);
-    let id = str_p(p, "id").ok_or_else(|| bad(&cmd, "missing `id`"))?;
-    if id != seg::CLASSICAL {
-        model_p(p, &cmd, task)?;
-    }
-    let wait = b_p(p, "wait").unwrap_or(false);
-    s.choose_model(task, id);
-    if wait {
-        s.apply_model(task, true);
-        waited(s, task, &cmd)?;
-    }
-    s.save_prefs();
-    s.prefs_changed();
-    Ok(json!({"model": id, "active": s.models.status(task).active}))
-}
-
-fn install(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
-    let cmd = format!("{}.model.install", kind(task).prefix);
-    let path = str_p(p, "path").ok_or_else(|| bad(&cmd, "missing `path` (the downloaded weights file)"))?;
-    let dir = s.models_dir().ok_or_else(|| bad(&cmd, "no settings folder to install into"))?;
-    let bytes = std::fs::read(path).map_err(|e| EngineError::Other(format!("cannot read {path}: {e}")))?;
-    // Which model it is: the one asked for, or the one whose checksum it has.
-    let m = match str_p(p, "id") {
-        Some(_) => model_p(p, &cmd, task)?,
-        None => {
-            let h = seg::sha256::hex(&bytes);
-            seg::models(task).find(|m| m.sha256 == h).ok_or_else(|| bad(&cmd, "this file is not a published model in the registry (SHA-256 differs)"))?
-        }
-    };
-    let dest = install_bytes(&dir, m, &bytes).map_err(|e| bad(&cmd, e))?;
-    let wait = b_p(p, "wait").unwrap_or(false);
-    s.apply_model(task, wait);
-    if wait {
-        waited(s, task, &cmd)?;
-    }
-    Ok(json!({"id": m.id, "path": dest.display().to_string()}))
-}
-
-fn download(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
-    let k = kind(task);
-    let cmd = format!("{}.model.download", k.prefix);
-    let m = model_p(p, &cmd, task)?;
-    let dir = s.models_dir().ok_or_else(|| bad(&cmd, "no settings folder to install into"))?;
-    if s.models.status(task).busy.is_some() {
-        return Err(bad(&cmd, "a model is already downloading or loading"));
-    }
-    let size = if m.size >= 10_000_000 { format!("{} MB", m.size / 1_000_000) } else { format!("{:.1} MB", m.size as f64 / 1e6) };
-    let wait = b_p(p, "wait").unwrap_or(false);
-    spawn(s.models.lane(task), k.label, format!("Downloading {} ({size})…", m.name), wait, move |_| {
-        std::fs::create_dir_all(&dir).map_err(|e| format!("cannot create {}: {e}", dir.display()))?;
-        let tmp = dir.join(format!("{}.part", m.file_name));
-        let out = std::process::Command::new("curl")
-            .args(["-fsSL", "--retry", "2", "--connect-timeout", "20", "-o"])
-            .arg(&tmp)
-            .arg(m.url)
-            .output()
-            .map_err(|e| format!("downloading needs curl ({e}); or download {} in a browser and use Install from File", m.url))?;
-        if !out.status.success() {
-            let _ = std::fs::remove_file(&tmp);
-            return Err(format!("download failed: {}", String::from_utf8_lossy(&out.stderr).trim()));
-        }
-        let bytes = std::fs::read(&tmp).map_err(|e| format!("cannot read the download: {e}"))?;
-        let _ = std::fs::remove_file(&tmp);
-        install_bytes(&dir, m, &bytes)?;
-        Ok(format!("{}: {} downloaded and verified", k.label, m.name))
-    });
-    if wait {
-        waited(s, task, &cmd)?;
-        s.apply_model(task, true);
-        waited(s, task, &cmd)?;
-        return Ok(json!({"id": m.id, "installed": true}));
-    }
-    Ok(json!({"id": m.id, "downloading": true}))
-}
-
-fn remove(s: &mut Session, p: &Value, task: Task) -> Result<Value> {
-    let m = model_p(p, &format!("{}.model.remove", kind(task).prefix), task)?;
-    let Some(path) = s.model_path(m) else { return Ok(json!({"removed": false})) };
-    if s.models.status(task).active.as_deref() == Some(m.id) {
-        s.models.set_active(task, None);
-    }
-    std::fs::remove_file(&path).map_err(|e| EngineError::Other(format!("cannot remove {}: {e}", path.display())))?;
-    if let Some(dir) = path.parent() {
-        let _ = std::fs::remove_file(notice_path(dir, m));
-    }
-    Ok(json!({"removed": true}))
-}
-
-pub fn specs() -> Vec<CommandSpec> {
-    vec![
-        query!("roto.models", "Roto Brush Models", "{}", |s, _| list(s, Task::Mask)),
-        cmd!(
-            "roto.model.select",
-            "Use Roto Brush Model",
-            [],
-            None,
-            "{id: classical|mobilesam, wait?} (Roto Brush 2.0 / 3.0 use it; wait: loaded before returning)",
-            always,
-            |s, p| select(s, p, Task::Mask)
-        ),
-        cmd!(
-            "roto.model.install",
-            "Install Roto Brush Model",
-            [],
-            None,
-            "{path: weights file, id?, wait?} — verified against the registry's SHA-256",
-            always,
-            |s, p| install(s, p, Task::Mask)
-        ),
-        cmd!(
-            "roto.model.download",
-            "Download Roto Brush Model",
-            [],
-            None,
-            "{id, wait?} — the official weights, verified (desktop; uses the system curl)",
-            always,
-            |s, p| download(s, p, Task::Mask)
-        ),
-        cmd!("roto.model.remove", "Remove Roto Brush Model", [], None, "{id}", always, |s, p| remove(s, p, Task::Mask)),
-        query!("face.models", "Face Tracking Models", "{}", |s, _| list(s, Task::Face)),
-        cmd!(
-            "face.model.select",
-            "Use Face Tracking Model",
-            [],
-            None,
-            "{id: classical|mediapipe-face, wait?} (face tracking uses it; wait: loaded before returning)",
-            always,
-            |s, p| select(s, p, Task::Face)
-        ),
-        cmd!(
-            "face.model.install",
-            "Install Face Tracking Model",
-            [],
-            None,
-            "{path: model file, id?, wait?} — verified against the registry's SHA-256",
-            always,
-            |s, p| install(s, p, Task::Face)
-        ),
-        cmd!(
-            "face.model.download",
-            "Download Face Tracking Model",
-            [],
-            None,
-            "{id, wait?} — the official model, verified (desktop; uses the system curl)",
-            always,
-            |s, p| download(s, p, Task::Face)
-        ),
-        cmd!("face.model.remove", "Remove Face Tracking Model", [], None, "{id}", always, |s, p| remove(s, p, Task::Face)),
-    ]
-}
diff --git a/crates/engine/src/output_guard.rs b/crates/engine/src/output_guard.rs
new file mode 100644
index 000000000..46c4356ed
--- /dev/null
+++ b/crates/engine/src/output_guard.rs
@@ -0,0 +1,1028 @@
+//! Protect files the project reads from render outputs (#1743).
+//!
+//! This guard is independent of replacement consent and export staging: it never authorizes
+//! overwriting ordinary outputs or opens a second confirmation flow. Those belong to the
+//! exporter. Existing aliases are compared by native file identity, including hard links.
+//! Missing sources remain protected by their normalized path. Checks happen before dispatch;
+//! filesystem changes between the check and the write require exporter-side revalidation.
+//!
+//! The commands that write to a path they are given (Save Frame As, Export Lottie, Save a Copy,
+//! Collect Files, Export Timeline…) never replace one of those files either, with no flag:
+//! they write through [`Session::write_output`], the one place that checks. Save and Save As
+//! write the project's own file and do not.
+//!
+//! Nor does a render write one file twice. When two outputs of one job name the same file (two
+//! items with one Output To, a duplicated item, output modules or segments that meet), the one
+//! rendered later replaces what the earlier one just wrote, and nothing is on disk to say so when
+//! the job starts. [`Session::duplicate_outputs`] lists them and the whole render is refused before
+//! anything is written: no answer makes a render replacing its own output right. A numbered sequence is compared by the frames
+//! it writes: two items of one pattern clash only where their frames do, and an item that skips
+//! existing frames leaves the earlier one's alone. A new item's default output name steps aside
+//! the same way it does for footage ([`Session::avoid_sources`]).
+//!
+
+use std::collections::{HashMap, HashSet};
+#[cfg(not(target_arch = "wasm32"))]
+use std::path::Component;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use effectcraft_project::render_queue::{RenderQueueItem, log_path, numbered_template, sequence_frame, sequence_parts, sequence_path};
+use effectcraft_project::{Footage, ItemKind};
+use serde_json::{Value, json};
+
+use crate::Session;
+
+/// Volumes on Windows and macOS ignore case unless they were set up not to.
+const IGNORES_CASE: bool = cfg!(any(windows, target_os = "macos"));
+
+/// How many frames are looked at one by one for a sequence whose folder cannot be read at once
+/// (its frame number is in a folder's name).
+const PROBE_LIMIT: u64 = 100_000;
+
+/// How far a default output name is numbered (`_1` … `_1000`) before it is left to the check at
+/// render time.
+const MAX_NUMBER: u32 = 1_000;
+
+/// What a file is written for, which words a refusal.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Use {
+    /// A Render Queue output (or a preview render): the fix is Output To.
+    Render,
+    /// Anything else written to a path: a frame, an export, a copy.
+    Export,
+}
+
+/// Stands for the frame number in the name a numbered sequence is compared by: a character no
+/// file is named with.
+const FRAME: char = '\u{e000}';
+
+/// What reads a file the project depends on.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum Source {
+    /// A footage item, by name.
+    Footage(Arc<str>),
+    /// An item's proxy, by the item's name.
+    Proxy(Arc<str>),
+    /// The project file.
+    Project,
+}
+
+impl Source {
+    /// `footage`, `proxy` or `project`: the `source` of a blocked output.
+    pub(crate) fn kind(&self) -> &'static str {
+        match self {
+            Source::Footage(_) => "footage",
+            Source::Proxy(_) => "proxy",
+            Source::Project => "project",
+        }
+    }
+
+    /// Why `path`, a file this reads, cannot be written for `used`.
+    pub(crate) fn refusal(&self, path: &str, used: Use) -> String {
+        match (used, self) {
+            (Use::Render, Source::Footage(name)) => {
+                format!("{path} is the footage “{name}” of this project, and a render never replaces footage; choose another Output To")
+            }
+            (Use::Render, Source::Proxy(name)) => format!("{path} is the proxy of “{name}”, and a render never replaces a proxy; choose another Output To"),
+            (Use::Render, Source::Project) => format!("{path} is this project's own file, and a render never replaces it; choose another Output To"),
+            (Use::Export, Source::Footage(name)) => {
+                format!("{path} is the footage “{name}” of this project, and footage is never written over; choose another file")
+            }
+            (Use::Export, Source::Proxy(name)) => format!("{path} is the proxy of “{name}”, and a proxy is never written over; choose another file"),
+            (Use::Export, Source::Project) => format!("{path} is this project's own file, which only Save writes; choose another file"),
+        }
+    }
+}
+
+/// The files the project reads: footage (every frame of a sequence), proxies and the project file.
+#[derive(Default)]
+pub(crate) struct Protected {
+    files: Vec<(PathBuf, Source)>,
+    by_path: HashMap<String, usize>,
+    /// Hashes of native identities, built once. Handles are closed after indexing so long
+    /// sequences do not exhaust the process's file descriptors. Hash hits are verified with
+    /// native handle equality; a hash collision cannot make another file a protected source.
+    #[cfg(not(target_arch = "wasm32"))]
+    by_identity: std::sync::OnceLock<HashMap<u64, Vec<usize>>>,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    identity_reads: std::sync::atomic::AtomicUsize,
+}
+
+impl Protected {
+    pub(crate) fn of(s: &Session) -> Protected {
+        let mut found = Protected::default();
+        for item in s.project.items.values() {
+            let name: Arc<str> = item.name.as_str().into();
+            if let ItemKind::Footage(f) = &item.kind {
+                found.add_footage(s, f, &Source::Footage(name.clone()));
+            }
+            if let Some(proxy) = &item.proxy {
+                found.add_footage(s, &proxy.footage, &Source::Proxy(name));
+            }
+        }
+        if let Some(path) = s.path.as_deref().filter(|p| !p.is_empty()) {
+            found.add(PathBuf::from(path), Source::Project);
+        }
+        found
+    }
+
+    fn add_footage(&mut self, s: &Session, f: &Footage, source: &Source) {
+        for stored in std::iter::once(&f.path).chain(&f.sequence).filter(|p| !p.is_empty()) {
+            // The file the media layer opens for the path the project stores.
+            let path = s.stored_path(stored).unwrap_or_else(|_| PathBuf::from(stored));
+            self.add(path, source.clone());
+        }
+    }
+
+    fn add(&mut self, path: PathBuf, source: Source) {
+        self.by_path.entry(key(&path)).or_insert(self.files.len());
+        self.files.push((path, source));
+    }
+
+    pub(crate) fn is_empty(&self) -> bool {
+        self.files.is_empty()
+    }
+
+    /// The source at this normalized path or native file identity. A new output only needs
+    /// its path lookup and one failed filesystem probe; existing outputs build the index once.
+    pub(crate) fn find(&self, path: &Path) -> Option<&Source> {
+        self.by_path.get(&key(path)).and_then(|i| self.files.get(*i)).map(|(_, source)| source).or_else(|| self.alias_of(path))
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn handle(&self, path: &Path) -> Option<same_file::Handle> {
+        #[cfg(test)]
+        self.identity_reads.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        // Opening a FIFO can wait for a writer. Only regular files can be protected media;
+        // preserve the old size-indexed lookup's exclusion of special files and directories.
+        if !std::fs::metadata(path).ok()?.is_file() {
+            return None;
+        }
+        same_file::Handle::from_path(path).ok()
+    }
+
+    /// Hashes narrow the search, while native handle equality also checks any hash collisions.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn alias_of(&self, path: &Path) -> Option<&Source> {
+        let output = self.handle(path)?;
+        let indexed = self.by_identity.get_or_init(|| {
+            let mut ids: HashMap<u64, Vec<usize>> = HashMap::new();
+            for (i, (known, _)) in self.files.iter().enumerate() {
+                if let Some(handle) = self.handle(known) {
+                    ids.entry(identity_hash(&handle)).or_default().push(i);
+                }
+            }
+            ids
+        });
+        indexed.get(&identity_hash(&output))?.iter().find_map(|i| {
+            let (known, source) = self.files.get(*i)?;
+            (self.handle(known)? == output).then_some(source)
+        })
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    fn alias_of(&self, _: &Path) -> Option<&Source> {
+        None
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn identity_hash(handle: &same_file::Handle) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut hash = std::collections::hash_map::DefaultHasher::new();
+    handle.hash(&mut hash);
+    hash.finish()
+}
+
+/// What an existing regular file is known by on its volume (links and hard links to one file give one),
+/// `None` when it does not exist, is not a regular file, or the volume has no such identity.
+fn identity(path: &Path) -> Option<String> {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        // Opening a FIFO can wait for a writer: only regular files are looked at.
+        if !std::fs::metadata(path).ok()?.is_file() {
+            return None;
+        }
+        same_file::Handle::from_path(path).ok().map(|handle| identity_hash(&handle).to_string())
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        let _ = path;
+        None
+    }
+}
+
+/// `path` made absolute, with `.` and `..` resolved by name alone (no file is looked at).
+#[cfg(not(target_arch = "wasm32"))]
+fn lexical(path: &Path) -> PathBuf {
+    let absolute = std::path::absolute(path).unwrap_or_else(|_| path.to_path_buf());
+    let mut out = PathBuf::new();
+    for part in absolute.components() {
+        match part {
+            Component::CurDir => {}
+            Component::ParentDir => match out.components().next_back() {
+                Some(Component::Normal(_)) => {
+                    out.pop();
+                }
+                Some(Component::RootDir | Component::Prefix(_)) => {}
+                _ => out.push(".."),
+            },
+            other => out.push(other.as_os_str()),
+        }
+    }
+    out
+}
+
+/// The name a path is compared by: absolute, resolved by name, without case where volumes ignore it.
+#[cfg(not(target_arch = "wasm32"))]
+fn key(path: &Path) -> String {
+    let parts: Vec<String> = lexical(path).components().map(|c| c.as_os_str().to_string_lossy().into_owned()).collect();
+    fold(&parts.join("/"))
+}
+
+#[cfg(target_arch = "wasm32")]
+fn key(path: &Path) -> String {
+    browser_key(path)
+}
+
+/// Match the browser file table: one optional leading slash, with literal case and dot segments.
+#[cfg(any(target_arch = "wasm32", test))]
+fn browser_key(path: &Path) -> String {
+    let path = path.to_string_lossy();
+    if path.starts_with('/') { path.into_owned() } else { format!("/{path}") }
+}
+
+fn fold(name: &str) -> String {
+    if IGNORES_CASE { name.to_lowercase() } else { name.to_string() }
+}
+
+/// Whether two paths are one file: the same name once resolved, or the same file on disk.
+pub(crate) fn same_file(a: &Path, b: &Path) -> bool {
+    if key(a) == key(b) {
+        return true;
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    return same_file::is_same_file(a, b).unwrap_or(false);
+    #[cfg(target_arch = "wasm32")]
+    false
+}
+
+/// Whether a file (or a link, even one leading nowhere) is at `path`.
+fn exists(path: &str) -> bool {
+    std::fs::symlink_metadata(path).is_ok_and(|m| !m.is_dir())
+}
+
+/// The files of a numbered sequence (`count` frames from `first`) that are on disk: its folder is
+/// read once, not asked about frame by frame.
+fn frames_on_disk(path: &str, first: i64, count: u64) -> Result<Vec<PathBuf>, String> {
+    let last = first.saturating_add(i64::try_from(count).unwrap_or(i64::MAX));
+    let p = Path::new(path);
+    let dir = p.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(Path::new("."));
+    let name = p.file_name().map(|n| n.to_string_lossy().into_owned());
+    let Some(name) = name.filter(|_| !dir.to_string_lossy().contains('#')) else {
+        // The frame number is in a folder's name: every frame has a folder of its own.
+        if count > PROBE_LIMIT {
+            return Err(format!(
+                "cannot safely check {count} output frames with a number in a folder name (limit {PROBE_LIMIT}); choose a fixed output folder or a shorter range"
+            ));
+        }
+        return Ok((0..count)
+            .map(|k| sequence_path(path, first.saturating_add(i64::try_from(k).unwrap_or(i64::MAX))))
+            .filter(|frame| exists(frame))
+            .map(PathBuf::from)
+            .collect());
+    };
+    let pattern = fold(&name);
+    let entries = match std::fs::read_dir(dir) {
+        Ok(entries) => entries,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(e) => return Err(format!("cannot check render output folder {}: {e}", dir.display())),
+    };
+    Ok(entries
+        .filter_map(Result::ok)
+        .filter(|e| sequence_frame(&pattern, &fold(&e.file_name().to_string_lossy())).is_some_and(|frame| (first..last).contains(&frame)))
+        .filter(|e| !e.file_type().is_ok_and(|t| t.is_dir()))
+        .map(|e| e.path())
+        .collect())
+}
+
+/// What an output writes, as far as a clash with another output goes.
+#[derive(Clone, Debug, PartialEq)]
+enum Target {
+    /// One file: known by its name and, when it exists, by what it is on its volume.
+    File { key: String, identity: Option<String> },
+    /// The numbered files `first..end` of a sequence: `key` is its pattern, with the width the
+    /// frame numbers are padded to.
+    Frames { key: String, width: usize, first: i64, end: i64 },
+}
+
+impl Target {
+    /// The file at `path`. `by_identity` also looks up what it is on its volume (a link to it
+    /// is it); that asks the file system, so it is left out where only names matter.
+    fn file(path: &Path, by_identity: bool) -> Target {
+        let identity = if by_identity { identity(path) } else { None };
+        Target::File { key: key(path), identity }
+    }
+
+    /// The `count` files of the sequence `path` (its frame-number pattern) from frame `first`.
+    fn frames(path: &str, first: i64, count: u64) -> Target {
+        let (before, width, after) = sequence_parts(path);
+        let key = key(Path::new(&format!("{before}{FRAME}{after}")));
+        Target::Frames { key, width, first, end: first.saturating_add(i64::try_from(count).unwrap_or(i64::MAX)) }
+    }
+}
+
+/// One output of a job.
+#[derive(Clone, Debug)]
+struct Write {
+    /// The queue item (`0`: one that is not in the queue yet).
+    item: u64,
+    /// The output path (a sequence's has its frame-number pattern).
+    path: String,
+    target: Target,
+    /// Skip Existing Files: a frame that is there already is left alone.
+    skips: bool,
+}
+
+/// What an output rendered later writes over.
+struct Clash<'a> {
+    /// The earlier output that writes it.
+    earlier: &'a Write,
+    /// How many files, and the first of them (its frame number, for a sequence).
+    files: u64,
+    first: i64,
+}
+
+/// The outputs of a job in the order they render, to find the one that writes what an earlier
+/// one does.
+#[derive(Default)]
+struct Writes {
+    all: Vec<Write>,
+    path_bytes: usize,
+    /// The first output to write a file, by name.
+    files: HashMap<String, usize>,
+    /// ... and by what the file is on its volume.
+    identities: HashMap<String, usize>,
+}
+
+/// The common range whose formatted numbers agree. Once the number (including a minus sign)
+/// fills the larger padding width, different widths produce the same file name.
+fn common_frames(first: i64, end: i64, from: i64, to: i64, width: usize, other_width: usize) -> Option<(u64, i64)> {
+    let (start, end) = (first.max(from), end.min(to));
+    let count = |a: i64, b: i64| u64::try_from(b.saturating_sub(a)).unwrap_or(0);
+    if width == other_width {
+        return (end > start).then(|| (count(start, end), start));
+    }
+    let width = width.max(other_width);
+    let power = |digits: usize| u32::try_from(digits).ok().and_then(|digits| 10i64.checked_pow(digits));
+    let negative = power(width.saturating_sub(2)).map(|n| end.min((-n).saturating_add(1))).filter(|to| *to > start);
+    let positive = power(width.saturating_sub(1)).map(|n| start.max(n)).filter(|from| *from < end);
+    let files = negative.map_or(0, |to| count(start, to)).saturating_add(positive.map_or(0, |from| count(from, end)));
+    (files > 0).then(|| (files, if negative.is_some() { start } else { positive.unwrap_or(start) }))
+}
+
+impl Writes {
+    fn is_empty(&self) -> bool {
+        self.all.is_empty()
+    }
+
+    /// The earliest output `later`, rendered after all of these, writes over.
+    fn clash(&self, later: &Write) -> Option<Clash<'_>> {
+        match &later.target {
+            Target::File { key, identity } => {
+                if let Some(at) = self.files.get(key).or_else(|| identity.as_ref().and_then(|id| self.identities.get(id))) {
+                    return Some(Clash { earlier: self.all.get(*at)?, files: 1, first: 0 });
+                }
+                self.all.iter().find_map(|earlier| {
+                    let Target::Frames { first, end, .. } = earlier.target else { return None };
+                    let frame = sequence_frame(&crate::output_guard::key(Path::new(&earlier.path)), key)?;
+                    (first..end).contains(&frame).then_some(Clash { earlier, files: 1, first: frame })
+                })
+            }
+            // A frame that is there already is left alone, so a later output that skips existing
+            // frames replaces none of an earlier one's.
+            Target::Frames { .. } if later.skips => None,
+            Target::Frames { key, width, first, end } => self.all.iter().find_map(|earlier| {
+                let (files, start) = match &earlier.target {
+                    Target::Frames { key: other, width: other_width, first: from, end: to } if key == other => {
+                        common_frames(*first, *end, *from, *to, *width, *other_width)?
+                    }
+                    Target::File { key, .. } => {
+                        let frame = sequence_frame(&crate::output_guard::key(Path::new(&later.path)), key)?;
+                        if !(*first..*end).contains(&frame) {
+                            return None;
+                        }
+                        (1, frame)
+                    }
+                    _ => return None,
+                };
+                Some(Clash { earlier, files, first: start })
+            }),
+        }
+    }
+
+    fn push(&mut self, write: Write) -> Result<(), String> {
+        let path_bytes = self.path_bytes.saturating_add(write.path.len());
+        if self.all.len() >= 65_536 || path_bytes > 16 * 1024 * 1024 {
+            return Err("render output plan exceeds 65536 paths or 16 MiB of path names; split the queue".into());
+        }
+        self.path_bytes = path_bytes;
+        let at = self.all.len();
+        match &write.target {
+            Target::File { key, identity } => {
+                self.files.entry(key.clone()).or_insert(at);
+                if let Some(identity) = identity {
+                    self.identities.entry(identity.clone()).or_insert(at);
+                }
+            }
+            Target::Frames { .. } => {}
+        }
+        self.all.push(write);
+        Ok(())
+    }
+}
+
+/// A queue item refused before any of its output modules are dispatched.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Refused {
+    pub item: u64,
+    pub reason: String,
+}
+
+/// An output that would write a file an earlier output of the same job writes.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct DuplicateOutput {
+    /// The queue item that would write over it (the later one), its place in the queue (1-based)
+    /// and its composition.
+    pub item: u64,
+    pub index: usize,
+    pub comp: String,
+    /// The file: a sequence's pattern, or the frame when it is one.
+    pub path: String,
+    /// How many files the two outputs have in common.
+    pub files: u64,
+    pub sequence: bool,
+    /// The queue item whose output is written first, and its place and composition.
+    pub with: u64,
+    pub with_index: usize,
+    pub with_comp: String,
+}
+
+impl DuplicateOutput {
+    /// Why the render is refused, naming the two items.
+    pub(crate) fn reason(&self) -> String {
+        let label = |index: usize, comp: &str| format!("#{index} “{comp}”");
+        let what = if self.sequence && self.files != 1 { format!("{} frames of {}", self.files, self.path) } else { self.path.clone() };
+        let rule = "and a render never writes one file twice; choose another Output To for one of them";
+        if self.item == self.with {
+            format!("{} would write {what} twice (two of its output modules), {rule}", label(self.index, &self.comp))
+        } else {
+            format!("{} and {} would both write {what}, {rule}", label(self.with_index, &self.with_comp), label(self.index, &self.comp))
+        }
+    }
+}
+
+/// Why a render is refused when outputs of the job write one file twice: it would replace its own output.
+pub(crate) fn duplicate_refusal(duplicates: &[DuplicateOutput]) -> Option<String> {
+    let first = duplicates.first()?;
+    let more = match duplicates.len().saturating_sub(1) {
+        0 => String::new(),
+        1 => "; 1 more output would write a file twice too".into(),
+        n => format!("; {n} more outputs would write a file twice too"),
+    };
+    Some(format!("{}. Nothing was rendered{more}", first.reason()))
+}
+
+impl Session {
+    /// The files the project reads.
+    pub(crate) fn protected_files(&self) -> Protected {
+        Protected::of(self)
+    }
+
+    /// What reads the file at `path`, if the project does.
+    fn blocking(&self, path: &str) -> Option<Source> {
+        self.protected_files().find(Path::new(path)).cloned()
+    }
+
+    /// `Err` when `path` is a file the project reads (footage, a proxy, the project file) and so
+    /// is not for an export to replace. For callers that write the file themselves; call it
+    /// before the work, not after it.
+    pub fn refuse_export(&self, path: &str) -> crate::Result<()> {
+        match self.blocking(path) {
+            Some(source) => Err(crate::EngineError::Other(source.refusal(path, Use::Export))),
+            None => Ok(()),
+        }
+    }
+
+    /// Write `bytes` to `path` through the host's services, unless the project reads the file
+    /// there ([`Session::refuse_export`]). Every command that writes to a path it is given
+    /// writes through this; Save and Save As (the project's own file) do not.
+    pub fn write_output(&self, path: &str, bytes: &[u8]) -> crate::Result<()> {
+        self.write_output_with(&self.protected_files(), path, bytes)
+    }
+
+    /// [`Session::write_output`] against files already found ([`Session::protected_files`]),
+    /// for a command that writes many.
+    pub(crate) fn write_output_with(&self, protected: &Protected, path: &str, bytes: &[u8]) -> crate::Result<()> {
+        if let Some(source) = protected.find(Path::new(path)) {
+            return Err(crate::EngineError::Other(source.refusal(path, Use::Export)));
+        }
+        self.services.write_file(path, bytes).map_err(|e| crate::EngineError::Other(format!("cannot write {path}: {e}")))
+    }
+
+    /// `file.checkOutput`'s reply for `path`.
+    pub(crate) fn output_status(&self, path: &str) -> Value {
+        match self.blocking(path) {
+            Some(source) => json!({"path": path, "blocked": true, "source": source.kind(), "reason": source.refusal(path, Use::Export)}),
+            None => json!({"path": path, "blocked": false}),
+        }
+    }
+
+    /// Reject protected outputs and ranges that cannot be checked completely. Ordinary-file
+    /// replacement consent is left to the exporter, independently of this source guard.
+    pub(crate) fn check_outputs(&self, items: &[Vec<(RenderQueueItem, String)>]) -> Vec<Refused> {
+        if cfg!(target_arch = "wasm32") {
+            return Vec::new();
+        }
+        let protected = self.protected_files();
+        let mut seen = HashSet::new();
+        let mut refused = Vec::new();
+        for (item, path) in items.iter().flatten() {
+            if seen.contains(&item.id) {
+                continue;
+            }
+            let reason = match self.write_paths(item, path) {
+                Ok(paths) => paths.iter().find_map(|path| match self.check_output(&protected, item, path) {
+                    Ok(reason) => reason,
+                    Err(reason) => Some(reason),
+                }),
+                Err(reason) => Some(reason),
+            };
+            if let Some(reason) = reason {
+                seen.insert(item.id);
+                refused.push(Refused { item: item.id, reason });
+            }
+        }
+        refused
+    }
+
+    /// What the job writes more than once. An item in `refused` writes nothing, so it takes no part.
+    pub(crate) fn duplicate_outputs(&self, items: &[Vec<(RenderQueueItem, String)>], refused: &[Refused]) -> Result<Vec<DuplicateOutput>, String> {
+        let skip: HashSet<u64> = refused.iter().map(|r| r.item).collect();
+        let mut writes = Writes::default();
+        let mut duplicates = Vec::new();
+        for (m, path) in items.iter().flatten().filter(|(m, _)| !skip.contains(&m.id)) {
+            let paths = self.write_paths(m, path)?;
+            // Alternative destinations of one output cannot collide with themselves.
+            for path in &paths {
+                let write = self.write_of(m, path, true);
+                if let Some(clash) = writes.clash(&write) {
+                    duplicates.push(self.duplicate_of(&write, &clash));
+                    break;
+                }
+            }
+            for path in paths {
+                writes.push(self.write_of(m, &path, true))?;
+            }
+        }
+        Ok(duplicates)
+    }
+
+    /// Every possible destination, since quota decisions can change during rendering.
+    fn write_paths<'a>(&self, item: &RenderQueueItem, path: &'a str) -> Result<Vec<std::borrow::Cow<'a, str>>, String> {
+        let overflow = &self.project.render_prefs.overflow_folders;
+        const PATH_BYTES: usize = 1024 * 1024;
+        if path.len() > PATH_BYTES {
+            return Err("render output destinations exceed 1 MiB of path names".into());
+        }
+        let mut paths = vec![std::borrow::Cow::Borrowed(path)];
+        let mut bytes = path.len();
+        if item.settings.storage_overflow && self.storage_quota.is_some() {
+            if overflow.len() > 256 {
+                return Err("render output planning supports at most 256 storage overflow folders".into());
+            }
+            if let Some(name) = Path::new(path).file_name() {
+                for folder in overflow {
+                    if bytes.saturating_add(folder.len()).saturating_add(name.len()).saturating_add(1) > PATH_BYTES {
+                        return Err("render output destinations exceed 1 MiB of path names".into());
+                    }
+                    let destination = Path::new(folder).join(name).to_string_lossy().into_owned();
+                    bytes = bytes.saturating_add(destination.len());
+                    if bytes > PATH_BYTES {
+                        return Err("render output destinations exceed 1 MiB of path names".into());
+                    }
+                    paths.push(std::borrow::Cow::Owned(destination));
+                }
+            }
+        }
+        Ok(paths)
+    }
+
+    /// What `path`, an output of `m`, writes. `by_identity`: see [`Target::file`].
+    fn write_of(&self, m: &RenderQueueItem, path: &str, by_identity: bool) -> Write {
+        let target = if m.output.format.is_sequence() {
+            let (first, count) = self.project.comp(m.comp).map_or((0, 0), |c| (m.settings.first_frame(c), m.settings.frame_count(c)));
+            Target::frames(path, first, count)
+        } else {
+            Target::file(Path::new(path), by_identity)
+        };
+        let skips = m.settings.skip_existing && self.exporter.as_ref().is_some_and(|exporter| exporter.supports_skip_existing(&m.settings));
+        Write { item: m.id, path: path.to_string(), target, skips }
+    }
+
+    /// The report of `later` writing over `clash`.
+    fn duplicate_of(&self, later: &Write, clash: &Clash) -> DuplicateOutput {
+        // Where a queue item stands, and what it renders.
+        let place = |id: u64| {
+            let index = self.project.render_queue.iter().position(|i| i.id == id);
+            let comp = index.and_then(|k| self.project.render_queue.get(k)).and_then(|i| self.project.item(i.comp)).map(|i| i.name.clone());
+            (index.map_or(0, |k| k + 1), comp.unwrap_or_default())
+        };
+        let sequence = matches!(later.target, Target::Frames { .. });
+        // One shared frame is named by its file, more by the pattern.
+        let path = if sequence && clash.files == 1 { sequence_path(&later.path, clash.first) } else { later.path.clone() };
+        let (index, comp) = place(later.item);
+        let (with_index, with_comp) = place(clash.earlier.item);
+        DuplicateOutput { item: later.item, index, comp, path, files: clash.files, sequence, with: clash.earlier.item, with_index, with_comp }
+    }
+
+    fn check_output(&self, protected: &Protected, item: &RenderQueueItem, path: &str) -> Result<Option<String>, String> {
+        if protected.is_empty() {
+            return Ok(None);
+        }
+        let sequence = item.output.format.is_sequence();
+        // Skip Existing Files leaves existing frames untouched, but not the render log.
+        let frames = if sequence && !item.settings.skip_existing {
+            match self.project.comp(item.comp) {
+                Some(comp) => frames_on_disk(path, item.settings.first_frame(comp), item.settings.frame_count(comp))?,
+                None => Vec::new(),
+            }
+        } else {
+            Vec::new()
+        };
+        let log = log_path(path);
+        let movie = (!sequence).then_some(Path::new(path));
+        Ok(frames
+            .iter()
+            .map(PathBuf::as_path)
+            .chain(movie)
+            .chain(Some(Path::new(&log)))
+            .find_map(|path| protected.find(path).map(|source| source.refusal(&path.to_string_lossy(), Use::Render))))
+    }
+
+    /// A new item's default output must not be a file the project reads, nor one another item of
+    /// the queue writes (any of its output modules, whether or not it is ticked): `[compName]_1`,
+    /// `[compName]_2`… take its place, as After Effects numbers a second item of the same
+    /// composition. An output nothing is in the way of keeps the composition's own name; the name
+    /// is stored in the item, so it stays as it is when the item it avoided goes away. One the
+    /// caller chose is not touched: rendering it is refused instead ([`Session::duplicate_outputs`]).
+    pub(crate) fn avoid_sources(&self, item: &mut RenderQueueItem) {
+        // Native source protection stays with its filesystem guard; virtual web outputs still
+        // need distinct queue names because the browser stores completed files by path.
+        let protected = if cfg!(target_arch = "wasm32") { Protected::default() } else { self.protected_files() };
+        let Ok(queue) = self.queue_writes() else { return };
+        if protected.is_empty() && queue.is_empty() {
+            return;
+        }
+        let template = item.output.output.clone();
+        for n in 0..=MAX_NUMBER {
+            item.output.output = if n == 0 { template.clone() } else { numbered_template(&template, n) };
+            let Ok(outputs) = self.outputs_of(item, None) else { break };
+            let mut in_the_way = false;
+            for (module, path) in &outputs {
+                let Ok(paths) = self.write_paths(module, path) else {
+                    item.output.output = template;
+                    return;
+                };
+                for destination in &paths {
+                    match self.check_output(&protected, module, destination) {
+                        Ok(Some(_)) => in_the_way = true,
+                        Err(_) => {
+                            item.output.output = template;
+                            return;
+                        }
+                        Ok(None) => {}
+                    }
+                }
+                in_the_way |= paths.iter().any(|path| queue.clash(&self.write_of(module, path, false)).is_some());
+            }
+            if !in_the_way {
+                return;
+            }
+        }
+        item.output.output = template;
+    }
+
+    /// What the items of the queue write (by name: a new item is not compared with what is on
+    /// disk).
+    fn queue_writes(&self) -> Result<Writes, String> {
+        let mut writes = Writes::default();
+        for outputs in self.project.render_queue.iter().filter_map(|it| self.outputs_of(it, None).ok()) {
+            for (m, path) in &outputs {
+                for path in self.write_paths(m, path)? {
+                    writes.push(self.write_of(m, &path, false))?;
+                }
+            }
+        }
+        Ok(writes)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    /// Portable path checks protect virtual outputs too; they do not need native file identity.
+    #[test]
+    fn duplicate_queue_paths_are_reported_without_native_files() {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Main", "width": 16, "height": 16})).unwrap();
+        for _ in 0..2 {
+            s.execute("renderQueue.add", json!({"format": "h264", "output": "/virtual/shared.mp4"})).unwrap();
+        }
+        let (outputs, _) = s.queued_outputs(&effectcraft_project::render_queue::OutputFormat::ALL);
+        let duplicates = s.duplicate_outputs(&outputs, &[]).unwrap();
+        assert_eq!(duplicates.len(), 1);
+        assert!(duplicates[0].path.ends_with("shared.mp4"));
+        let refused = [Refused { item: duplicates[0].item, reason: "already refused".into() }];
+        assert!(s.duplicate_outputs(&outputs, &refused).unwrap().is_empty());
+    }
+
+    /// An output of queue item `item` that is a file, known by its name alone.
+    fn movie(item: u64, path: &str) -> Write {
+        Write { item, path: path.into(), target: Target::file(Path::new(path), false), skips: false }
+    }
+
+    /// An output of queue item `item` that is `count` frames of a sequence from frame `first`.
+    fn frames(item: u64, pattern: &str, first: i64, count: u64) -> Write {
+        Write { item, path: pattern.into(), target: Target::frames(pattern, first, count), skips: false }
+    }
+
+    fn job_of(writes: impl IntoIterator<Item = Write>) -> Writes {
+        let mut job = Writes::default();
+        for write in writes {
+            job.push(write).unwrap();
+        }
+        job
+    }
+
+    #[test]
+    fn browser_output_names_match_the_virtual_file_table() {
+        assert_eq!(browser_key(Path::new("renders/a.png")), browser_key(Path::new("/renders/a.png")));
+        assert_ne!(browser_key(Path::new("renders/A.png")), browser_key(Path::new("renders/a.png")));
+        assert_ne!(browser_key(Path::new("renders/../a.png")), browser_key(Path::new("a.png")));
+        assert_ne!(browser_key(Path::new("//a.png")), browser_key(Path::new("/a.png")));
+    }
+
+    #[test]
+    fn output_plan_path_budget_returns_an_error() {
+        let mut job = Writes::default();
+        let path = "x".repeat(1024 * 1024);
+        for _ in 0..16 {
+            job.push(movie(1, &path)).unwrap();
+        }
+        assert!(job.push(movie(2, "one-too-many")).is_err());
+        assert_eq!(job.all.len(), 16);
+    }
+
+    /// The item an output replaces a file of, how many files, and the first.
+    fn clash(job: &Writes, later: &Write) -> Option<(u64, u64, i64)> {
+        job.clash(later).map(|c| (c.earlier.item, c.files, c.first))
+    }
+
+    #[test]
+    fn a_file_is_replaced_by_the_output_that_has_its_name() {
+        let job = job_of([movie(1, "out/a.mp4"), movie(2, "out/b.mp4"), movie(3, "out/b.mp4")]);
+        assert_eq!(clash(&job, &movie(9, "out/a.mp4")), Some((1, 1, 0)));
+        assert_eq!(clash(&job, &movie(9, "out/b.mp4")), Some((2, 1, 0)), "the first to write it is named");
+        assert_eq!(clash(&job, &movie(9, "out/x/../a.mp4")), Some((1, 1, 0)), "dot segments are resolved");
+        assert_eq!(clash(&job, &movie(9, "out/c.mp4")), None);
+        assert_eq!(clash(&job, &movie(9, "other/a.mp4")), None);
+        assert_eq!(clash(&job, &frames(9, "out/a.mp4", 0, 5)), None, "a sequence is not a movie");
+        assert!(Writes::default().is_empty() && !job.is_empty());
+    }
+
+    #[test]
+    fn two_names_of_one_file_on_disk_are_one_file() {
+        let on_disk = |item: u64, name: &str, id: Option<&str>| Write {
+            item,
+            path: name.into(),
+            target: Target::File { key: name.into(), identity: id.map(String::from) },
+            skips: false,
+        };
+        let job = job_of([on_disk(1, "/a/link.mp4", Some("7:1")), on_disk(2, "/a/nothing-yet.mp4", None)]);
+        assert_eq!(clash(&job, &on_disk(9, "/b/real.mp4", Some("7:1"))), Some((1, 1, 0)));
+        assert_eq!(clash(&job, &on_disk(9, "/b/real.mp4", Some("7:2"))), None);
+        assert_eq!(clash(&job, &on_disk(9, "/b/real.mp4", None)), None, "a file that is not there has no identity");
+        assert_eq!(clash(&job, &on_disk(9, "/a/nothing-yet.mp4", None)), Some((2, 1, 0)), "its name is all there is");
+    }
+
+    #[test]
+    fn sequences_clash_where_their_frames_do() {
+        let job = job_of([frames(1, "a_[#####].png", 0, 5)]); // frames 0-4
+        assert_eq!(clash(&job, &frames(2, "a_[#####].png", 5, 5)), None, "the five after it");
+        assert_eq!(clash(&job, &frames(2, "a_[#####].png", -3, 3)), None, "the three before it");
+        assert_eq!(clash(&job, &frames(2, "a_[#####].png", 4, 5)), Some((1, 1, 4)), "frame 4 only");
+        assert_eq!(clash(&job, &frames(2, "a_[#####].png", 2, 1)), Some((1, 1, 2)));
+        assert_eq!(clash(&job, &frames(2, "a_[#####].png", 1, 2)), Some((1, 2, 1)));
+        assert_eq!(clash(&job, &frames(2, "a_[#####].png", -3, 100)), Some((1, 5, 0)), "all five");
+        // The first of several that overlap is the one named.
+        let job = job_of([frames(1, "a_[#####].png", 0, 3), frames(2, "a_[#####].png", 3, 3)]);
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", 2, 3)), Some((1, 1, 2)));
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", 3, 3)), Some((2, 3, 3)));
+    }
+
+    #[test]
+    fn sequences_of_other_names_do_not_clash() {
+        let job = job_of([frames(1, "out/a_[#####].png", 0, 5)]);
+        for other in ["out/b_[#####].png", "out/a_[####].png", "out/a_[#####].jpg", "elsewhere/a_[#####].png", "out/a[#####].png", "out/a_[#####]/x.png"] {
+            assert_eq!(clash(&job, &frames(2, other, 0, 5)), None, "{other}");
+        }
+        // One name, however it is spelled: the run with or without brackets, none at all, dot segments.
+        for same in ["out/a_[#####].png", "out/a_#####.png", "out/a.png", "out/b/../a_[#####].png"] {
+            assert_eq!(clash(&job, &frames(2, same, 0, 5)), Some((1, 5, 0)), "{same}");
+        }
+        // A frame number that starts a folder's name is not a file name's.
+        let job = job_of([frames(1, "out/[##].png", 0, 5)]);
+        assert_eq!(clash(&job, &frames(2, "out[##].png", 0, 5)), None);
+        assert_eq!(clash(&job, &frames(2, "out/[##].png", 0, 5)), Some((1, 5, 0)));
+    }
+
+    #[test]
+    fn padding_widths_can_name_the_same_frame_and_files_can_name_sequence_frames() {
+        let job = job_of([frames(1, "out/a_[####].png", 9999, 3)]);
+        assert_eq!(clash(&job, &frames(2, "out/a_[#####].png", 9999, 3)), Some((1, 2, 10000)));
+        let job = job_of([frames(1, "out/a_[##].png", -12, 15)]);
+        assert_eq!(clash(&job, &frames(2, "out/a_[###].png", -12, 15)), Some((1, 3, -12)));
+        let job = job_of([frames(1, "out/a_[#####].png", 0, 5)]);
+        assert_eq!(clash(&job, &movie(2, "out/a_00002.png")), Some((1, 1, 2)));
+        let job = job_of([movie(1, "out/a_00002.png")]);
+        assert_eq!(clash(&job, &frames(2, "out/a_[#####].png", 0, 5)), Some((1, 1, 2)));
+        let mut skipping = frames(2, "out/a_[#####].png", 0, 5);
+        skipping.skips = true;
+        assert_eq!(clash(&job, &skipping), None);
+    }
+
+    /// Skip Existing Files leaves a frame that is there alone: it matters for the output that
+    /// comes second, and for sequences only.
+    #[test]
+    fn an_output_that_skips_existing_frames_replaces_none() {
+        let skipping = |mut write: Write| {
+            write.skips = true;
+            write
+        };
+        let job_of_one = job_of([frames(1, "a_[#####].png", 0, 5)]);
+        assert_eq!(clash(&job_of_one, &skipping(frames(2, "a_[#####].png", 0, 5))), None);
+        let job_of_one = job_of([skipping(frames(1, "a_[#####].png", 0, 5))]);
+        assert_eq!(clash(&job_of_one, &frames(2, "a_[#####].png", 3, 5)), Some((1, 2, 3)), "the earlier one's frames are replaced");
+        let job_of_one = job_of([movie(1, "a.mp4")]);
+        assert_eq!(clash(&job_of_one, &skipping(movie(2, "a.mp4"))), Some((1, 1, 0)), "a movie is written whole");
+    }
+
+    #[test]
+    fn frame_numbers_beyond_what_a_project_holds_do_not_panic() {
+        let top = i64::MAX - 1;
+        let job = job_of([frames(1, "a_[#####].png", top, u64::MAX), frames(2, "a_[#####].png", i64::MIN, u64::MAX)]);
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", top, u64::MAX)), Some((1, 1, top)));
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", -5, 3)), Some((2, 3, -5)));
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", 0, 5)), None, "between the two");
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", i64::MAX, 0)), None, "nothing written");
+        assert_eq!(clash(&job, &frames(9, "a_[#####].png", i64::MIN, 0)), None);
+    }
+
+    #[test]
+    fn the_reason_names_both_items_and_what_they_write() {
+        let both = DuplicateOutput {
+            item: 7,
+            index: 3,
+            comp: "Main".into(),
+            path: "/o/Main.mp4".into(),
+            files: 1,
+            sequence: false,
+            with: 4,
+            with_index: 1,
+            with_comp: "Intro".into(),
+        };
+        assert_eq!(
+            both.reason(),
+            "#1 “Intro” and #3 “Main” would both write /o/Main.mp4, and a render never writes one file twice; choose another Output To for one of them"
+        );
+        let sequence = DuplicateOutput { sequence: true, files: 12, path: "/o/Main_[#####].png".into(), ..both.clone() };
+        assert!(sequence.reason().contains("would both write 12 frames of /o/Main_[#####].png,"), "{}", sequence.reason());
+        let one = DuplicateOutput { files: 1, path: "/o/Main_00004.png".into(), ..sequence };
+        assert!(one.reason().contains("would both write /o/Main_00004.png,"), "{}", one.reason());
+        let itself = DuplicateOutput { with: 7, with_index: 3, with_comp: "Main".into(), ..both.clone() };
+        assert!(itself.reason().starts_with("#3 “Main” would write /o/Main.mp4 twice (two of its output modules), and a render never"), "{}", itself.reason());
+
+        let mut found = vec![];
+        assert_eq!(duplicate_refusal(&found), None);
+        found.push(both.clone());
+        assert_eq!(duplicate_refusal(&found), Some(format!("{}. Nothing was rendered", both.reason())));
+        found.push(both.clone());
+        assert!(duplicate_refusal(&found).is_some_and(|r| r.ends_with("Nothing was rendered; 1 more output would write a file twice too")));
+        found.push(both);
+        assert!(duplicate_refusal(&found).is_some_and(|r| r.ends_with("Nothing was rendered; 2 more outputs would write a file twice too")));
+    }
+
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn unrelated_same_size_frames_are_indexed_once() {
+        let dir = std::env::temp_dir().join(format!("effectcraft-identity-index-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let mut protected = Protected::default();
+        for i in 0..128 {
+            let source = dir.join(format!("source{i}")).join("plate.png");
+            let output = dir.join(format!("output{i}")).join("plate.png");
+            for path in [&source, &output] {
+                std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+                std::fs::write(path, b"same-size frame").unwrap();
+            }
+            protected.add(source, Source::Footage(format!("plate{i}").into()));
+        }
+        for i in 0..128 {
+            assert!(protected.find(&dir.join(format!("output{i}")).join("plate.png")).is_none());
+        }
+        assert_eq!(protected.identity_reads.load(std::sync::atomic::Ordering::Relaxed), 256, "one source-index pass plus one lookup per output");
+        let alias = dir.join("renamed.png");
+        std::fs::hard_link(dir.join("source64").join("plate.png"), &alias).unwrap();
+        assert_eq!(protected.find(&alias), Some(&Source::Footage("plate64".into())));
+        assert_eq!(protected.identity_reads.load(std::sync::atomic::Ordering::Relaxed), 258, "native equality verifies a matching identity");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn folder_numbered_sequences_are_never_partially_checked() {
+        let pattern = std::env::temp_dir().join("frames[######]").join("plate.png").to_string_lossy().into_owned();
+        let error = frames_on_disk(&pattern, 0, PROBE_LIMIT + 1).unwrap_err();
+        assert!(error.contains("cannot safely check") && error.contains("100000"), "{error}");
+        assert!(frames_on_disk(&pattern, 0, u64::MAX).is_err());
+    }
+
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn non_file_outputs_do_not_build_the_identity_index() {
+        let protected = Protected::default();
+        assert!(protected.find(&std::env::temp_dir()).is_none());
+        assert!(protected.by_identity.get().is_none());
+    }
+
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn paths_compare_by_name_once_resolved() {
+        let here = std::env::current_dir().unwrap();
+        assert_eq!(key(Path::new("a/b/../c.mp4")), key(Path::new("a/c.mp4")));
+        assert_eq!(key(Path::new("./a/c.mp4")), key(&here.join("a/c.mp4")));
+        assert_ne!(key(Path::new("a/c.mp4")), key(Path::new("b/c.mp4")));
+        assert_eq!(key(Path::new(&format!("{}x", "../".repeat(64)))), key(Path::new(&format!("{}x", "../".repeat(80)))), "past the root stays at the root");
+        assert_eq!(IGNORES_CASE, key(Path::new("A/C.MP4")) == key(Path::new("a/c.mp4")));
+    }
+
+    #[test]
+    fn a_file_is_the_same_file_under_every_spelling_the_volume_allows() {
+        let dir = std::env::temp_dir().join(format!("effectcraft-output-guard-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("sub")).unwrap();
+        std::fs::write(dir.join("clip.mov"), b"x").unwrap();
+        std::fs::write(dir.join("other.mov"), b"y").unwrap();
+        assert!(same_file(&dir.join("clip.mov"), &dir.join("sub").join("..").join("clip.mov")));
+        assert!(!same_file(&dir.join("clip.mov"), &dir.join("other.mov")));
+        // Nothing there yet: only the name decides.
+        assert!(same_file(&dir.join("gone.mov"), &dir.join("sub").join("..").join("gone.mov")));
+        assert!(!same_file(&dir.join("gone.mov"), &dir.join("clip.mov")));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_sequences_folder_is_read_once_for_its_frames() {
+        let dir = std::env::temp_dir().join(format!("effectcraft-output-frames-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("a_00003.png")).unwrap(); // a folder is not a frame
+        for name in ["a_00001.png", "a_00002.png", "a_0004.png", "a_00004.jpg", "b_00002.png", "a_00009.png"] {
+            std::fs::write(dir.join(name), b"x").unwrap();
+        }
+        let pattern = dir.join("a_[#####].png").to_string_lossy().into_owned();
+        let names = |frames: Vec<PathBuf>| {
+            let mut names: Vec<String> = frames.iter().filter_map(|f| f.file_name()).map(|n| n.to_string_lossy().into_owned()).collect();
+            names.sort();
+            names
+        };
+        assert_eq!(
+            names(frames_on_disk(&pattern, 0, 5).unwrap()),
+            ["a_00001.png", "a_00002.png"],
+            "frames 0-4: not the 4-digit one, the jpg, the folder or frame 9"
+        );
+        assert_eq!(names(frames_on_disk(&pattern, 2, 1).unwrap()), ["a_00002.png"]);
+        assert_eq!(names(frames_on_disk(&pattern, 9, 100).unwrap()), ["a_00009.png"]);
+        assert_eq!(names(frames_on_disk(&pattern, 0, u64::MAX).unwrap()), ["a_00001.png", "a_00002.png", "a_00009.png"], "a hostile frame count is not walked");
+        // A frame number in a folder's name: each frame has its own folder.
+        std::fs::create_dir_all(dir.join("f02")).unwrap();
+        std::fs::write(dir.join("f02").join("x.png"), b"x").unwrap();
+        let in_folder = dir.join("f[##]").join("x.png").to_string_lossy().into_owned();
+        assert_eq!(names(frames_on_disk(&in_folder, 0, 4).unwrap()), ["x.png"]);
+        // A folder that is not there holds nothing.
+        assert!(frames_on_disk(&dir.join("none").join("a_[#####].png").to_string_lossy(), 0, 5).unwrap().is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/engine/src/prefs.rs b/crates/engine/src/prefs.rs
deleted file mode 100644
index a2ce579ea..000000000
--- a/crates/engine/src/prefs.rs
+++ /dev/null
@@ -1,1514 +0,0 @@
-//! Settings (After Effects' Preferences): a versioned serde model, addressed by dotted keys
-//! (`general.undoLevels`, `autoSave.intervalMinutes`, `labels.3.name`), plus the page schema the
-//! Settings dialog and agents (`prefs.pages`) are built from.
-//!
-//! Settings are stored as JSON (`prefs.json`) through the session's [`crate::config::ConfigStore`].
-//! Loading is forgiving: missing keys take their defaults, unknown keys (written by a newer
-//! version) are kept and written back, and older layouts are migrated ([`migrate`]).
-//!
-//! Every setting in [`pages`] says whether it already changes behaviour (`live`). Settings that
-//! don't yet are still shown (After Effects parity of the dialog) and are listed in
-//! `docs/preferences.md`; a test keeps that list in step with the schema.
-
-use std::collections::BTreeMap;
-
-use effectcraft_color::Label;
-use effectcraft_time::Tick;
-use serde::{Deserialize, Serialize};
-use serde_json::{Map, Value, json};
-
-/// Current settings layout version.
-pub const PREFS_VERSION: u32 = 2;
-/// Settings file name in the config store.
-pub const PREFS_FILE: &str = "prefs.json";
-
-/// Settings ▸ General ▸ Language: (label, `general.language` value).
-pub const LANGUAGES: &[(&str, &str)] = &[
-    ("Match System", "system"),
-    ("English", "en"),
-    ("日本語", "ja"),
-    ("简体中文", "zh-hans"),
-    ("繁體中文", "zh-hant"),
-    ("Українська", "uk"),
-    ("Español", "es"),
-    ("Português (Brasil)", "pt-br"),
-    ("Русский", "ru"),
-    ("Français", "fr"),
-    ("Deutsch", "de"),
-    ("Čeština", "cs"),
-];
-
-/// Settings ▸ Startup & Repair ▸ Window Graphics: (label, `startup.windowGraphics` value).
-pub const WINDOW_GRAPHICS: &[(&str, &str)] = &[("Automatic", "auto"), ("OpenGL (compatibility)", "gl")];
-
-/// Settings ▸ Appearance ▸ Appearance Mode: (label, `appearance.appearanceMode` value). Auto
-/// follows the operating system's light or dark appearance.
-pub const APPEARANCE_MODES: &[(&str, &str)] = &[("Sync with System", "auto"), ("Dark", "dark"), ("Light", "light")];
-
-/// The dark family of themes: (label, `appearance.darkTheme` value).
-pub const DARK_THEMES: &[(&str, &str)] = &[("Dark", "dark"), ("Darker", "darker")];
-
-/// The light family of themes: (label, `appearance.lightTheme` value).
-pub const LIGHT_THEMES: &[(&str, &str)] = &[("Light", "light")];
-
-/// Every theme (the legacy single-theme `appearance.theme`).
-pub const THEMES: &[(&str, &str)] = &[("Dark", "dark"), ("Darker", "darker"), ("Light", "light")];
-
-/// The settings whose value must be one of their choices.
-fn choices(key: &str) -> Option<&'static [(&'static str, &'static str)]> {
-    match key {
-        "general.language" => Some(LANGUAGES),
-        "startup.windowGraphics" => Some(WINDOW_GRAPHICS),
-        "appearance.appearanceMode" => Some(APPEARANCE_MODES),
-        "appearance.darkTheme" => Some(DARK_THEMES),
-        "appearance.lightTheme" => Some(LIGHT_THEMES),
-        "appearance.theme" => Some(THEMES),
-        _ => None,
-    }
-}
-
-fn is_choice(choices: &[(&str, &str)], v: &str) -> bool {
-    choices.iter().any(|(_, c)| *c == v)
-}
-
-/// Unknown keys inside a page, kept so a newer version's settings survive a round trip.
-type Extra = BTreeMap<String, Value>;
-
-macro_rules! page {
-    ($(#[$m:meta])* $name:ident { $($(#[$fm:meta])* $f:ident : $t:ty = $d:expr),* $(,)? }) => {
-        $(#[$m])*
-        #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-        #[serde(default, rename_all = "camelCase")]
-        pub struct $name {
-            $($(#[$fm])* pub $f: $t,)*
-            #[serde(flatten)]
-            pub extra: Extra,
-        }
-        impl Default for $name {
-            fn default() -> Self {
-                $name { $($f: $d,)* extra: Extra::new() }
-            }
-        }
-    };
-}
-
-page!(General {
-    /// Interface language: `system` (the operating system's, where EffectCraft has it, else
-    /// English), or a language code from `LANGUAGES`.
-    language: String = "system".into(),
-    /// Levels of Undo (1–99).
-    undo_levels: u32 = 32,
-    /// Path Point and Handle Size (px).
-    path_point_size: u32 = 5,
-    show_tool_tips: bool = true,
-    /// Create New Layers at Composition Start Time (off: at the current time).
-    create_layers_at_comp_start: bool = true,
-    switches_affect_nested_comps: bool = true,
-    /// Default Spatial Interpolation to Linear.
-    default_spatial_linear: bool = false,
-    preserve_constant_vertex_count: bool = true,
-    /// Synchronize Time of All Related Items.
-    sync_time_related_items: bool = true,
-    expression_pick_whip_compact: bool = true,
-    create_split_layers_above: bool = false,
-    use_system_color_picker: bool = false,
-    /// Number of projects in File ▸ Open Recent.
-    recent_items: u32 = 10,
-});
-
-page!(Startup {
-    show_home_on_launch: bool = true,
-    show_home_on_open_project: bool = false,
-    /// After a crash, offer to open the most recent auto-save.
-    offer_crash_recovery: bool = true,
-    /// What the desktop window draws with, from the next launch: `auto` (the platform's best
-    /// graphics API) or `gl` (OpenGL, for drivers that crash with the others). A launch that
-    /// stops as its window opens switches it to `gl` (#243).
-    window_graphics: String = "auto".into(),
-});
-
-page!(ProjectPrefs {
-    /// Open a template project for File ▸ New ▸ New Project.
-    use_template: bool = false,
-    template_path: String = String::new(),
-});
-
-page!(AutoSave {
-    enabled: bool = true,
-    interval_minutes: u32 = 20,
-    max_versions: u32 = 5,
-    /// `nextToProject` (an "EffectCraft Auto-Save" folder beside the project) or `custom`.
-    location: String = "nextToProject".into(),
-    folder: String = String::new(),
-    save_on_render_start: bool = false,
-});
-
-page!(CompositionPrefs {
-    /// Motion path: `all`, `none`, `seconds`, `keyframes`.
-    motion_path: String = "keyframes".into(),
-    motion_path_seconds: f64 = 15.0,
-    motion_path_keyframes: u32 = 15,
-    show_rendering_progress: bool = true,
-    hardware_accelerate_panels: bool = true,
-});
-
-page!(Previews {
-    /// Largest downsampling while playing back: `1/2`, `1/4`, `1/8`.
-    adaptive_resolution_limit: String = "1/8".into(),
-    show_internal_wireframes: bool = false,
-    cache_frames_when_idle: bool = false,
-    fast_previews: bool = false,
-    /// `faster` or `moreAccurate`.
-    zoom_quality: String = "moreAccurate".into(),
-    show_gpu_info: bool = false,
-    /// The monitor's colour space for View ▸ Use Display Color Management: `srgb` or `p3`.
-    display_profile: String = "srgb".into(),
-});
-
-page!(Appearance {
-    /// The single theme before appearance modes (`dark`, `darker` or `light`), kept for older
-    /// settings files and automation: setting it picks its family's mode and theme. While the mode
-    /// is Dark or Light it mirrors the theme in use.
-    theme: String = "dark".into(),
-    /// `auto` (follow the operating system), `dark` or `light`. New installs stay Dark.
-    appearance_mode: String = "dark".into(),
-    /// The theme used in dark appearance: `dark` or `darker`.
-    dark_theme: String = "dark".into(),
-    /// The theme used in light appearance: `light`.
-    light_theme: String = "light".into(),
-    /// Theme shortcuts in the appearance context menu.
-    favorite_themes: Vec<String> = Vec::new(),
-    /// User interface brightness, -1 (darker) … 1 (lighter).
-    brightness: f64 = 0.0,
-    /// The size of the whole interface in percent (75–200), on top of the display's own scale.
-    ui_scale: u32 = 100,
-    use_label_color_for_handles: bool = true,
-    use_label_color_for_tabs: bool = true,
-    cycle_mask_colors: bool = true,
-    use_gradients: bool = true,
-    /// macOS: draw the menu bar inside the window instead of the system menu bar.
-    in_window_menu_bar_mac: bool = false,
-});
-
-page!(Grids {
-    grid_color: String = "#7a9cff".into(),
-    grid_spacing: f64 = 100.0,
-    grid_subdivisions: u32 = 4,
-    /// `lines`, `dashed` or `dots`.
-    grid_style: String = "lines".into(),
-    proportional_horizontal: u32 = 4,
-    proportional_vertical: u32 = 4,
-    guide_color: String = "#3cc8f0".into(),
-    guide_style: String = "lines".into(),
-    action_safe: f64 = 10.0,
-    title_safe: f64 = 20.0,
-});
-
-page!(TypePrefs {
-    /// `latin` or `southAsian` (South Asian and Middle Eastern).
-    text_engine: String = "latin".into(),
-    font_preview: bool = true,
-    recent_fonts: u32 = 10,
-    font_names_in_english: bool = false,
-});
-
-page!(Import {
-    /// Still footage duration: `compLength` or `seconds`.
-    still_footage: String = "compLength".into(),
-    still_seconds: f64 = 5.0,
-    sequence_fps: f64 = 30.0,
-    report_missing_frames: bool = true,
-    /// Automatically Reload Footage whose file another app changed (size or modification time),
-    /// checked every two seconds and when the window comes back to the front: `off`,
-    /// `nonSequence` (the default, as in After Effects: image sequences are left alone) or `all`.
-    auto_reload_footage: String = "nonSequence".into(),
-    /// Interpret unlabeled alpha as: `ask`, `guess`, `ignore`, `straight`, `premultiplied`.
-    unlabeled_alpha: String = "ask".into(),
-    /// Default drag import as: `footage`, `comp`, `compLayerSizes`.
-    drag_import_as: String = "footage".into(),
-});
-
-page!(Export {
-    default_output_folder: String = String::new(),
-    segment_sequences: bool = false,
-    segment_sequence_files: u32 = 700,
-    segment_movies: bool = false,
-    segment_movie_mb: u32 = 1024,
-    append_bits_to_name: bool = false,
-});
-
-page!(Audio {
-    /// Output device name (empty = the system default).
-    output_device: String = String::new(),
-    /// Output mapping: device channel for the left / right output (1-based).
-    output_left: u32 = 1,
-    output_right: u32 = 2,
-    preview_sample_rate: u32 = 48_000,
-});
-
-page!(Disk {
-    disk_cache_enabled: bool = true,
-    disk_cache_max_gb: u32 = 100,
-    disk_cache_folder: String = String::new(),
-    media_cache_folder: String = String::new(),
-    conformed_media_folder: String = String::new(),
-});
-
-page!(Memory {
-    ram_reserved_gb: u32 = 6,
-    /// Processed-layer cache budget (MB).
-    layer_cache_mb: u32 = 1024,
-    /// Decoded footage frame cache budget (MB).
-    media_cache_mb: u32 = 1024,
-    /// RAM preview (viewer frame) cache budget (MB).
-    preview_cache_mb: u32 = 3072,
-    reduce_cache_when_low: bool = true,
-});
-
-page!(Video {
-    enable_output: bool = false,
-    device: String = String::new(),
-    output_during_playback: bool = true,
-    mirror_on_monitor: bool = true,
-    disable_when_background: bool = false,
-});
-
-page!(ThreeD {
-    /// Default 3D renderer for new compositions: `classic` or `advanced`.
-    default_renderer: String = "classic".into(),
-    show_reference_axes: bool = true,
-    extended_viewer: bool = false,
-    realtime_shadows: bool = true,
-});
-
-page!(
-    /// Settings ▸ Roto Brush.
-    RotoPrefs {
-        /// The segmentation model Roto Brush 2.0 / 3.0 use: `classical` (built in) or a model id
-        /// from `effectcraft_segment::MODELS` (once installed).
-        model: String = "classical".into(),
-    }
-);
-
-page!(
-    /// Settings ▸ Face Tracking.
-    FacePrefs {
-        /// The model Track Mask ▸ Face Tracking uses: `classical` (built in) or a model id from
-        /// `effectcraft_segment::MODELS` (once installed).
-        model: String = "classical".into(),
-    }
-);
-
-page!(Scripting {
-    allow_scripts_write_files: bool = false,
-    warn_executing_files: bool = true,
-    enable_js_debugger: bool = false,
-    editor_font_size: u32 = 13,
-    syntax_highlighting: bool = true,
-    line_numbers: bool = true,
-    auto_complete: bool = true,
-    bracket_matching: bool = true,
-    word_wrap: bool = false,
-    error_banner: bool = true,
-});
-
-impl Scripting {
-    /// Whether `other` grants scripts the same as this: Application Scripting (file and network
-    /// access, the warning before executing files, the debugger). Scripts can't change these
-    /// ([`crate::Session::execute_for_script`]): a script could otherwise give itself the
-    /// access the user withheld.
-    pub fn same_permissions(&self, other: &Scripting) -> bool {
-        self.allow_scripts_write_files == other.allow_scripts_write_files
-            && self.warn_executing_files == other.warn_executing_files
-            && self.enable_js_debugger == other.enable_js_debugger
-    }
-
-    /// Take `from`'s Application Scripting settings (see [`Scripting::same_permissions`]).
-    pub fn keep_permissions(&mut self, from: &Scripting) {
-        self.allow_scripts_write_files = from.allow_scripts_write_files;
-        self.warn_executing_files = from.warn_executing_files;
-        self.enable_js_debugger = from.enable_js_debugger;
-    }
-}
-
-/// One editable label: name and `#rrggbb` colour.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct LabelPref {
-    pub name: String,
-    pub color: String,
-}
-
-/// A Composition Settings preset the user saved (Composition Settings ▸ Preset ▸ Save): the
-/// frame size, pixel aspect and frame rate, as in After Effects' own presets.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CompPreset {
-    pub name: String,
-    pub width: u32,
-    pub height: u32,
-    pub pixel_aspect: f64,
-    pub frame_rate: f64,
-}
-
-impl CompPreset {
-    /// Longest preset name kept.
-    pub const MAX_NAME: usize = 128;
-
-    /// Values a composition accepts (a hand-edited settings file can hold anything).
-    pub fn is_valid(&self) -> bool {
-        let size = 4..=30000;
-        !self.name.trim().is_empty()
-            && self.name.chars().count() <= Self::MAX_NAME
-            && size.contains(&self.width)
-            && size.contains(&self.height)
-            && self.pixel_aspect.is_finite()
-            && (0.01..=100.0).contains(&self.pixel_aspect)
-            && self.frame_rate.is_finite()
-            && (1.0..=999.0).contains(&self.frame_rate)
-    }
-}
-
-/// Saved composition presets, skipping entries that don't parse instead of losing the list.
-fn lenient_comp_presets<'de, D: serde::Deserializer<'de>>(d: D) -> Result<Vec<CompPreset>, D::Error> {
-    let v = Vec::<Value>::deserialize(d)?;
-    Ok(v.into_iter().filter_map(|x| serde_json::from_value(x).ok()).collect())
-}
-
-fn default_labels() -> Vec<LabelPref> {
-    Label::ALL.iter().skip(1).map(|l| LabelPref { name: l.name().to_string(), color: hex(l.rgb()) }).collect()
-}
-
-fn hex([r, g, b]: [u8; 3]) -> String {
-    format!("#{r:02x}{g:02x}{b:02x}")
-}
-
-fn parse_hex(s: &str) -> Option<[u8; 3]> {
-    let h = s.trim().trim_start_matches('#');
-    if h.len() != 6 {
-        return None;
-    }
-    let p = |i: usize| u8::from_str_radix(h.get(i..i + 2)?, 16).ok();
-    Some([p(0)?, p(2)?, p(4)?])
-}
-
-/// All settings.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct Prefs {
-    pub version: u32,
-    pub general: General,
-    pub startup: Startup,
-    pub project: ProjectPrefs,
-    pub auto_save: AutoSave,
-    pub composition: CompositionPrefs,
-    pub previews: Previews,
-    pub appearance: Appearance,
-    pub grids: Grids,
-    /// The 16 labels (Red … Dark Green), in order.
-    pub labels: Vec<LabelPref>,
-    #[serde(rename = "type")]
-    pub type_: TypePrefs,
-    pub import: Import,
-    pub export: Export,
-    pub audio: Audio,
-    pub disk: Disk,
-    pub memory: Memory,
-    pub video: Video,
-    #[serde(rename = "threeD")]
-    pub three_d: ThreeD,
-    pub scripting: Scripting,
-    pub roto: RotoPrefs,
-    pub face: FacePrefs,
-    /// File ▸ Open Recent, newest first.
-    pub recent_projects: Vec<String>,
-    /// File ▸ Import Recent Footage, newest first.
-    pub recent_footage: Vec<String>,
-    /// Animation ▸ Recent Animation Presets (`.ecpreset` paths or built-in preset ids), newest
-    /// first.
-    pub recent_presets: Vec<String>,
-    /// Character panel: recently used font families, newest first.
-    pub recent_fonts: Vec<String>,
-    /// Effects & Presets: the starred effects' ids, in the order starred.
-    pub effects_favorites: Vec<String>,
-    /// Preview panel: every shortcut's options.
-    pub preview: crate::preview::PreviewSettings,
-    /// View ▸ Simulate Output ▸ My Custom RGB.
-    pub custom_rgb: crate::viewer::CustomRgb,
-    /// Composition Settings presets the user saved, in the order saved.
-    #[serde(deserialize_with = "lenient_comp_presets")]
-    pub comp_presets: Vec<CompPreset>,
-    /// Top-level keys this version doesn't know (kept for newer versions).
-    #[serde(flatten)]
-    pub extra: Extra,
-}
-
-impl Default for Prefs {
-    fn default() -> Self {
-        Prefs {
-            version: PREFS_VERSION,
-            general: General::default(),
-            startup: Startup::default(),
-            project: ProjectPrefs::default(),
-            auto_save: AutoSave::default(),
-            composition: CompositionPrefs::default(),
-            previews: Previews::default(),
-            appearance: Appearance::default(),
-            grids: Grids::default(),
-            labels: default_labels(),
-            type_: TypePrefs::default(),
-            import: Import::default(),
-            export: Export::default(),
-            audio: Audio::default(),
-            disk: Disk::default(),
-            memory: Memory::default(),
-            video: Video::default(),
-            three_d: ThreeD::default(),
-            scripting: Scripting::default(),
-            roto: RotoPrefs::default(),
-            face: FacePrefs::default(),
-            recent_projects: vec![],
-            recent_footage: vec![],
-            recent_presets: vec![],
-            recent_fonts: vec![],
-            effects_favorites: vec![],
-            preview: crate::preview::PreviewSettings::default(),
-            custom_rgb: crate::viewer::CustomRgb::default(),
-            comp_presets: vec![],
-            extra: Extra::new(),
-        }
-    }
-}
-
-/// Bring an older settings document up to [`PREFS_VERSION`].
-///
-/// - version 0/1 (early builds) kept a flat object: `undoLevels`, `autoSaveEnabled`,
-///   `autoSaveMinutes`, `autoSaveVersions`, `labelNames` (array) and `theme` at the top level.
-pub fn migrate(mut v: Value) -> Value {
-    let Some(obj) = v.as_object_mut() else { return json!({}) };
-    let version = obj.get("version").and_then(Value::as_u64).unwrap_or(0);
-    if version < 2 {
-        let moved = |from: &str, page: &str, key: &str, obj: &mut Map<String, Value>| {
-            if let Some(x) = obj.remove(from) {
-                let p = obj.entry(page.to_string()).or_insert_with(|| json!({}));
-                if let Some(p) = p.as_object_mut() {
-                    p.entry(key.to_string()).or_insert(x);
-                }
-            }
-        };
-        moved("undoLevels", "general", "undoLevels", obj);
-        moved("autoSaveEnabled", "autoSave", "enabled", obj);
-        moved("autoSaveMinutes", "autoSave", "intervalMinutes", obj);
-        moved("autoSaveVersions", "autoSave", "maxVersions", obj);
-        moved("theme", "appearance", "theme", obj);
-        if let Some(Value::Array(names)) = obj.remove("labelNames") {
-            let mut labels = default_labels();
-            for (l, n) in labels.iter_mut().zip(names) {
-                if let Some(n) = n.as_str() {
-                    l.name = n.to_string();
-                }
-            }
-            obj.insert("labels".into(), serde_json::to_value(labels).unwrap_or_default());
-        }
-    }
-    // Settings saved before appearance modes had one theme: keep showing it, as a fixed Dark or
-    // Light mode, instead of switching established users to Auto.
-    if let Some(a) = obj.get_mut("appearance").and_then(Value::as_object_mut)
-        && !a.contains_key("appearanceMode")
-        && let Some(theme) = a.get("theme").and_then(Value::as_str).map(str::to_string)
-        && let Some((mode, slot)) = theme_family(&theme)
-    {
-        a.insert("appearanceMode".into(), json!(mode));
-        a.insert(slot.into(), json!(theme));
-    }
-    obj.insert("version".into(), json!(PREFS_VERSION));
-    v
-}
-
-/// The appearance mode and the per-mode setting a theme belongs to (`darker` → (`dark`,
-/// `darkTheme`)); `None` for an unknown theme.
-pub fn theme_family(theme: &str) -> Option<(&'static str, &'static str)> {
-    if is_choice(DARK_THEMES, theme) {
-        Some(("dark", "darkTheme"))
-    } else if is_choice(LIGHT_THEMES, theme) {
-        Some(("light", "lightTheme"))
-    } else {
-        None
-    }
-}
-
-impl Appearance {
-    /// Show the legacy single `theme`: fix the mode to its family and remember it as that
-    /// family's theme. An unknown theme changes nothing.
-    pub fn select_theme(&mut self) {
-        match theme_family(&self.theme) {
-            Some((mode, "darkTheme")) => {
-                self.appearance_mode = mode.into();
-                self.dark_theme = self.theme.clone();
-            }
-            Some((mode, _)) => {
-                self.appearance_mode = mode.into();
-                self.light_theme = self.theme.clone();
-            }
-            None => {}
-        }
-    }
-
-    /// The theme to show: the light or dark family's choice by the mode; Auto follows `system_light`
-    /// (`None` = the system said nothing: dark).
-    pub fn resolved_theme(&self, system_light: Option<bool>) -> &str {
-        let light = match self.appearance_mode.as_str() {
-            "light" => true,
-            "auto" => system_light == Some(true),
-            _ => false,
-        };
-        if light { &self.light_theme } else { &self.dark_theme }
-    }
-}
-
-impl Prefs {
-    /// Parse a settings document (migrating older layouts; unknown keys are kept, bad values
-    /// fall back to defaults).
-    pub fn from_json(text: &str) -> Prefs {
-        let v: Value = serde_json::from_str(text).unwrap_or_else(|_| json!({}));
-        let v = migrate(v);
-        let mut p: Prefs = match serde_json::from_value(v.clone()) {
-            Ok(p) => p,
-            // One bad value shouldn't lose everything: take each page that parses.
-            Err(_) => {
-                let mut base = serde_json::to_value(Prefs::default()).unwrap_or_default();
-                if let (Some(b), Some(o)) = (base.as_object_mut(), v.as_object()) {
-                    for (k, x) in o {
-                        let mut trial = b.clone();
-                        trial.insert(k.clone(), x.clone());
-                        if serde_json::from_value::<Prefs>(Value::Object(trial)).is_ok() {
-                            b.insert(k.clone(), x.clone());
-                        }
-                    }
-                }
-                serde_json::from_value(base).unwrap_or_default()
-            }
-        };
-        p.normalize();
-        p
-    }
-
-    pub fn to_json(&self) -> String {
-        serde_json::to_string_pretty(self).unwrap_or_default()
-    }
-
-    /// Clamp values into their valid ranges and fill missing labels.
-    pub fn normalize(&mut self) {
-        self.version = PREFS_VERSION;
-        self.comp_presets.retain(CompPreset::is_valid);
-        let mut seen = std::collections::HashSet::new();
-        self.effects_favorites.retain(|id| !id.is_empty() && seen.insert(id.clone()));
-        self.effects_favorites.truncate(MAX_EFFECTS_FAVORITES);
-        if !is_choice(WINDOW_GRAPHICS, &self.startup.window_graphics) {
-            self.startup.window_graphics = Startup::default().window_graphics;
-        }
-        let g = &mut self.general;
-        if !is_choice(LANGUAGES, &g.language) {
-            g.language = General::default().language;
-        }
-        g.undo_levels = g.undo_levels.clamp(1, 99);
-        g.path_point_size = g.path_point_size.clamp(3, 20);
-        g.recent_items = g.recent_items.clamp(1, 30);
-        let a = &mut self.auto_save;
-        a.interval_minutes = a.interval_minutes.clamp(1, 240);
-        a.max_versions = a.max_versions.clamp(1, 99);
-        let ap = &mut self.appearance;
-        let mut seen = std::collections::BTreeSet::new();
-        ap.favorite_themes.retain(|id| is_choice(THEMES, id) && seen.insert(id.clone()));
-        if !is_choice(APPEARANCE_MODES, &ap.appearance_mode) {
-            ap.appearance_mode = Appearance::default().appearance_mode;
-        }
-        if !is_choice(DARK_THEMES, &ap.dark_theme) {
-            ap.dark_theme = Appearance::default().dark_theme;
-        }
-        if !is_choice(LIGHT_THEMES, &ap.light_theme) {
-            ap.light_theme = Appearance::default().light_theme;
-        }
-        // The legacy single theme mirrors the theme a fixed mode shows (Auto depends on the
-        // system, so it keeps the last one).
-        match ap.appearance_mode.as_str() {
-            "dark" => ap.theme = ap.dark_theme.clone(),
-            "light" => ap.theme = ap.light_theme.clone(),
-            _ if !is_choice(THEMES, &ap.theme) => ap.theme = ap.dark_theme.clone(),
-            _ => {}
-        }
-        self.appearance.brightness = self.appearance.brightness.clamp(-1.0, 1.0);
-        self.appearance.ui_scale = self.appearance.ui_scale.clamp(75, 200);
-        let defaults = default_labels();
-        self.labels.truncate(defaults.len());
-        for d in defaults.iter().skip(self.labels.len()) {
-            self.labels.push(d.clone());
-        }
-        for (l, d) in self.labels.iter_mut().zip(&defaults) {
-            if parse_hex(&l.color).is_none() {
-                l.color = d.color.clone();
-            }
-        }
-        let m = &mut self.memory;
-        m.layer_cache_mb = m.layer_cache_mb.clamp(64, 1 << 20);
-        m.media_cache_mb = m.media_cache_mb.clamp(64, 1 << 20);
-        m.preview_cache_mb = m.preview_cache_mb.clamp(64, 1 << 20);
-        self.grids.grid_spacing = self.grids.grid_spacing.clamp(1.0, 10_000.0);
-        let n = self.general.recent_items as usize;
-        self.recent_projects.truncate(n);
-    }
-
-    /// The value at a dotted key (`general.undoLevels`, `labels.3.color`); `""` = everything.
-    pub fn get(&self, key: &str) -> Option<Value> {
-        let v = serde_json::to_value(self).ok()?;
-        if key.is_empty() {
-            return Some(v);
-        }
-        let ptr = format!("/{}", key.replace('.', "/"));
-        v.pointer(&ptr).cloned()
-    }
-
-    /// Set the value at a dotted key. The key must exist and the value must have its type.
-    pub fn set(&mut self, key: &str, value: Value) -> Result<(), String> {
-        if let Some(c) = choices(key)
-            && !value.as_str().is_some_and(|v| is_choice(c, v))
-        {
-            let all: Vec<&str> = c.iter().map(|(_, v)| *v).collect();
-            return Err(format!("`{key}` expects one of {}", all.join(", ")));
-        }
-        let favorites = if key == "appearance.favoriteThemes" {
-            Some(&value)
-        } else if key == "appearance" {
-            value.get("favoriteThemes")
-        } else {
-            None
-        };
-        if let Some(favorites) = favorites {
-            let values = favorites.as_array().ok_or("favorite themes must be a list")?;
-            let mut seen = std::collections::BTreeSet::new();
-            for value in values {
-                let id = value.as_str().ok_or("favorite theme must be a string")?;
-                if !is_choice(THEMES, id) || !seen.insert(id) {
-                    return Err("unknown or duplicate favorite theme".into());
-                }
-            }
-        }
-        // Older clients set the single theme (by key, or inside the page object): it still picks
-        // a visible theme, fixing the mode to its family.
-        let legacy_theme = key == "appearance.theme" || (key == "appearance" && value.get("theme").is_some() && value.get("appearanceMode").is_none());
-        let mut v = serde_json::to_value(&*self).map_err(|e| e.to_string())?;
-        let ptr = format!("/{}", key.replace('.', "/"));
-        let slot = v.pointer_mut(&ptr).ok_or_else(|| format!("unknown setting `{key}`"))?;
-        let value = coerce(slot, value).ok_or_else(|| format!("`{key}` expects a {}", kind_name(slot)))?;
-        *slot = value;
-        let mut next: Prefs = serde_json::from_value(v).map_err(|e| format!("`{key}`: {e}"))?;
-        let (a, b) = (&self.appearance, &next.appearance);
-        let only_theme_changed = a.theme != b.theme && a.appearance_mode == b.appearance_mode && a.dark_theme == b.dark_theme && a.light_theme == b.light_theme;
-        if legacy_theme || only_theme_changed {
-            next.appearance.select_theme();
-        }
-        next.normalize();
-        *self = next;
-        Ok(())
-    }
-
-    /// Reset one page (`general`, `labels`, `autoSave`…) or everything (`None`). Open Recent and
-    /// the saved composition presets are kept.
-    pub fn reset(&mut self, page: Option<&str>) -> Result<(), String> {
-        let d = Prefs::default();
-        let Some(page) = page else {
-            *self = Prefs {
-                recent_projects: std::mem::take(&mut self.recent_projects),
-                recent_footage: std::mem::take(&mut self.recent_footage),
-                recent_presets: std::mem::take(&mut self.recent_presets),
-                recent_fonts: std::mem::take(&mut self.recent_fonts),
-                effects_favorites: std::mem::take(&mut self.effects_favorites),
-                preview: std::mem::take(&mut self.preview),
-                comp_presets: std::mem::take(&mut self.comp_presets),
-                ..d
-            };
-            return Ok(());
-        };
-        let keys: Vec<&str> = match page {
-            "project" => vec!["project", "autoSave"],
-            p => vec![section_key(p).ok_or_else(|| format!("unknown settings page `{p}`"))?],
-        };
-        let dv = serde_json::to_value(&d).map_err(|e| e.to_string())?;
-        for k in keys {
-            if let Some(x) = dv.get(k) {
-                self.set(k, x.clone())?;
-            }
-        }
-        Ok(())
-    }
-
-    /// Display name of a label (Labels settings).
-    pub fn label_name(&self, l: Label) -> String {
-        match label_index(l) {
-            Some(i) => self.labels.get(i).map(|p| p.name.clone()).unwrap_or_else(|| l.name().to_string()),
-            None => l.name().to_string(),
-        }
-    }
-
-    /// sRGB colour of a label (Labels settings).
-    pub fn label_rgb(&self, l: Label) -> [u8; 3] {
-        label_index(l).and_then(|i| self.labels.get(i)).and_then(|p| parse_hex(&p.color)).unwrap_or(l.rgb())
-    }
-
-    /// A label by its built-in name or its (renamed) display name.
-    pub fn label_from_name(&self, s: &str) -> Option<Label> {
-        Label::from_name(s).or_else(|| Label::ALL.iter().skip(1).copied().find(|l| self.label_name(*l).eq_ignore_ascii_case(s)))
-    }
-
-    /// Remember a project in File ▸ Open Recent.
-    pub fn push_recent(&mut self, path: &str) {
-        self.recent_projects.retain(|p| p != path);
-        self.recent_projects.insert(0, path.to_string());
-        self.recent_projects.truncate(self.general.recent_items as usize);
-    }
-
-    /// Layer / media / preview cache budgets in bytes.
-    pub fn layer_cache_bytes(&self) -> usize {
-        (self.memory.layer_cache_mb as usize) << 20
-    }
-    pub fn media_cache_bytes(&self) -> usize {
-        (self.memory.media_cache_mb as usize) << 20
-    }
-    pub fn preview_cache_bytes(&self) -> usize {
-        (self.memory.preview_cache_mb as usize) << 20
-    }
-
-    /// The adaptive resolution limit as a render-scale floor (1/2 → 0.5).
-    pub fn adaptive_limit(&self) -> f64 {
-        match self.previews.adaptive_resolution_limit.as_str() {
-            "1/2" => 0.5,
-            "1/4" => 0.25,
-            _ => 0.125,
-        }
-    }
-
-    /// The Memory & CPU cache budgets in effect: the configured layer / footage / preview
-    /// budgets, scaled down so together they leave **RAM Reserved for Other Applications** free,
-    /// and halved while the system is low on memory when **Reduce Cache Size When System Is Low
-    /// on Memory** is on. `mem` = the system's memory (`None` = unknown: configured budgets).
-    /// In the browser the layer and footage caches also stay within [`WEB_LAYER_CACHE`] and
-    /// [`WEB_MEDIA_CACHE`].
-    pub fn cache_budgets(&self, mem: Option<crate::sysinfo::SysMemory>) -> CacheBudgets {
-        self.cache_budgets_in(mem, cfg!(target_arch = "wasm32"))
-    }
-
-    /// [`Prefs::cache_budgets`], in the browser's memory (`web`) or not.
-    pub(crate) fn cache_budgets_in(&self, mem: Option<crate::sysinfo::SysMemory>, web: bool) -> CacheBudgets {
-        let (mut l, mut m, mut p) = (self.layer_cache_bytes() as u64, self.media_cache_bytes() as u64, self.preview_cache_bytes() as u64);
-        if web {
-            (l, m) = (l.min(WEB_LAYER_CACHE), m.min(WEB_MEDIA_CACHE));
-        }
-        let floor = 64u64 << 20;
-        let mut capped = false;
-        let mut reduced = false;
-        if let Some(mem) = mem.filter(|m| m.total > 0) {
-            let reserved = (self.memory.ram_reserved_gb as u64) << 30;
-            let cap = mem.total.saturating_sub(reserved).max(3 * floor);
-            let sum = l + m + p;
-            if sum > cap {
-                let k = cap as f64 / sum as f64;
-                (l, m, p) = ((l as f64 * k) as u64, (m as f64 * k) as u64, (p as f64 * k) as u64);
-                capped = true;
-            }
-            if self.memory.reduce_cache_when_low && mem.is_low() {
-                (l, m, p) = (l / 2, m / 2, p / 2);
-                reduced = true;
-            }
-        }
-        CacheBudgets { layer: l.max(floor) as usize, media: m.max(floor) as usize, preview: p.max(floor) as usize, capped, reduced }
-    }
-
-    /// Composition ▸ Motion Path: the layer-time span of a motion path to draw around `now`
-    /// (layer time), for keyframes at `keys` (sorted). `None` = No Motion Path.
-    pub fn motion_path_span(&self, keys: &[Tick], now: Tick) -> Option<(Tick, Tick)> {
-        let (first, last) = (*keys.first()?, *keys.last()?);
-        let c = &self.composition;
-        match c.motion_path.as_str() {
-            "none" => None,
-            "seconds" => {
-                let half = Tick::from_seconds_f64(c.motion_path_seconds.max(0.0) / 2.0);
-                let (a, b) = ((now - half).max(first), (now + half).min(last));
-                (a < b).then_some((a, b))
-            }
-            "keyframes" => {
-                let n = (c.motion_path_keyframes.max(1) as usize).min(keys.len());
-                if n < 2 {
-                    return None;
-                }
-                // The n keyframes centred on the current time.
-                let at = keys.partition_point(|k| *k < now);
-                let start = at.saturating_sub(n / 2).min(keys.len() - n);
-                Some((keys[start], keys[start + n - 1]))
-            }
-            _ => Some((first, last)),
-        }
-    }
-
-    /// Previews ▸ Viewer Zoom Quality: smooth (bilinear) scaling of the viewer image, or nearest
-    /// neighbour ("Faster").
-    pub fn viewer_zoom_smooth(&self) -> bool {
-        self.previews.zoom_quality != "faster"
-    }
-
-    /// Import ▸ Interpret Unlabeled Alpha As, for footage whose file has an alpha channel that
-    /// doesn't state how it is stored. `None` = Ask User (keep straight and open Interpret
-    /// Footage); `guess` takes premultiplied for movies (codecs with alpha are usually written
-    /// premultiplied) and straight for stills.
-    pub fn unlabeled_alpha(&self, movie: bool) -> Option<effectcraft_project::AlphaMode> {
-        use effectcraft_project::AlphaMode::*;
-        Some(match self.import.unlabeled_alpha.as_str() {
-            "ignore" => Ignore,
-            "straight" => Straight,
-            "premultiplied" => Premultiplied,
-            "guess" if movie => Premultiplied,
-            "guess" => Straight,
-            _ => return None,
-        })
-    }
-
-    /// Import ▸ Default Drag Import As, as `file.import`'s `importAs`.
-    pub fn drag_import_as(&self) -> &'static str {
-        match self.import.drag_import_as.as_str() {
-            "comp" => "composition",
-            "compLayerSizes" => "compositionLayerSizes",
-            _ => "footage",
-        }
-    }
-
-    /// Export ▸ Append Bit Depth to File Name: `Comp 1.png` → `Comp 1_16bpc.png` (sequence frame
-    /// runs and folders are kept).
-    pub fn output_name(&self, path: &str, bits: u32) -> String {
-        if !self.export.append_bits_to_name {
-            return path.to_string();
-        }
-        let p = std::path::Path::new(path);
-        let (Some(stem), dir) = (p.file_stem().map(|s| s.to_string_lossy().to_string()), p.parent()) else { return path.to_string() };
-        let tag = format!("_{bits}bpc");
-        if stem.ends_with(&tag) {
-            return path.to_string();
-        }
-        let name = match p.extension() {
-            Some(e) => format!("{stem}{tag}.{}", e.to_string_lossy()),
-            None => format!("{stem}{tag}"),
-        };
-        match dir.filter(|d| !d.as_os_str().is_empty()) {
-            Some(d) => d.join(name).to_string_lossy().to_string(),
-            None => name,
-        }
-    }
-
-    /// Export ▸ Segment Sequences / Segment Movie Files: how many frames go in each segment of an
-    /// output of `frames` frames (`None` = one file / folder). Sequences split every Files per
-    /// Segment frames; movies every Segment Size MB at the output's data rate
-    /// (`bytes_per_frame`, estimated from the format's bitrate).
-    pub fn segment_frames(&self, frames: u64, sequence: bool, bytes_per_frame: f64) -> Option<u64> {
-        let e = &self.export;
-        let per = if sequence {
-            e.segment_sequences.then_some(e.segment_sequence_files.max(1) as u64)?
-        } else {
-            if !e.segment_movies || bytes_per_frame <= 0.0 {
-                return None;
-            }
-            (((e.segment_movie_mb.max(1) as f64) * 1_048_576.0 / bytes_per_frame).floor() as u64).max(1)
-        };
-        (per < frames).then_some(per)
-    }
-
-    /// Remember a font in the Character panel's recent fonts (Type ▸ Number of Recent Fonts).
-    pub fn push_recent_font(&mut self, family: &str) {
-        push_mru(&mut self.recent_fonts, family, 30);
-    }
-
-    /// Is effect `id` starred in Effects & Presets?
-    pub fn is_effect_favorite(&self, id: &str) -> bool {
-        self.effects_favorites.iter().any(|f| f == id)
-    }
-
-    /// Star effect `id` in Effects & Presets, or un-star it; true when it is starred now.
-    pub fn toggle_effect_favorite(&mut self, id: &str) -> bool {
-        if self.is_effect_favorite(id) {
-            self.effects_favorites.retain(|f| f != id);
-            false
-        } else {
-            self.effects_favorites.push(id.to_string());
-            self.effects_favorites.truncate(MAX_EFFECTS_FAVORITES);
-            self.is_effect_favorite(id)
-        }
-    }
-
-    /// The recent fonts the Character panel shows (at most Number of Recent Fonts to Display).
-    pub fn recent_fonts_shown(&self) -> &[String] {
-        let n = (self.type_.recent_fonts as usize).min(self.recent_fonts.len());
-        &self.recent_fonts[..n]
-    }
-
-    /// Remember imported footage for File ▸ Import Recent Footage.
-    pub fn push_recent_footage(&mut self, path: &str) {
-        push_mru(&mut self.recent_footage, path, self.general.recent_items as usize);
-    }
-
-    /// Remember an applied animation preset for Animation ▸ Recent Animation Presets.
-    pub fn push_recent_preset(&mut self, path: &str) {
-        push_mru(&mut self.recent_presets, path, self.general.recent_items as usize);
-    }
-}
-
-/// Most effects Effects & Presets keeps starred (a hand-edited settings file can hold more).
-const MAX_EFFECTS_FAVORITES: usize = 1000;
-
-fn push_mru(list: &mut Vec<String>, v: &str, max: usize) {
-    list.retain(|x| x != v);
-    list.insert(0, v.to_string());
-    list.truncate(max.max(1));
-}
-
-/// The most the layer cache holds in the browser. A wasm32 page addresses at most 4 GiB, which
-/// these caches share with the app and with the decoders' own decoded frames (FilmCraft keeps
-/// up to 384 MB per open movie): with the desktop's 1 GB defaults, eight stacked 1080p clips ran
-/// the page out of memory a few seconds into playback.
-pub const WEB_LAYER_CACHE: u64 = 512 << 20;
-
-/// The most the footage frame cache holds in the browser (see [`WEB_LAYER_CACHE`]).
-pub const WEB_MEDIA_CACHE: u64 = 256 << 20;
-
-/// Effective cache budgets in bytes (see [`Prefs::cache_budgets`]).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]
-pub struct CacheBudgets {
-    pub layer: usize,
-    pub media: usize,
-    pub preview: usize,
-    /// Scaled down to leave the reserved RAM free.
-    pub capped: bool,
-    /// Halved because the system is low on memory.
-    pub reduced: bool,
-}
-
-/// Colour of the `k`-th mask of a layer: Appearance ▸ Cycle Mask Colors cycles through the mask
-/// colours, otherwise every new mask takes the first one.
-pub fn mask_color(cycle: bool, k: usize) -> [u8; 3] {
-    use effectcraft_project::build::MASK_COLORS;
-    if cycle { MASK_COLORS[k % MASK_COLORS.len()] } else { MASK_COLORS[0] }
-}
-
-fn label_index(l: Label) -> Option<usize> {
-    Label::ALL.iter().position(|x| *x == l).and_then(|i| i.checked_sub(1))
-}
-
-/// Settings key of a page id (`3d` → `threeD`).
-pub fn section_key(page: &str) -> Option<&'static str> {
-    Some(match page {
-        "general" => "general",
-        "startup" => "startup",
-        "project" => "project",
-        "autoSave" | "autosave" => "autoSave",
-        "composition" | "display" => "composition",
-        "previews" => "previews",
-        "appearance" => "appearance",
-        "grids" => "grids",
-        "labels" => "labels",
-        "type" => "type",
-        "import" => "import",
-        "export" => "export",
-        "audio" => "audio",
-        "disk" => "disk",
-        "memory" => "memory",
-        "video" => "video",
-        "3d" | "threeD" => "threeD",
-        "scripting" => "scripting",
-        "roto" => "roto",
-        "face" => "face",
-        _ => return None,
-    })
-}
-
-/// Settings page id for a page name, including older After Effects page names
-/// (Auto-Save → Project, Media & Disk Cache → Disk, Memory & Performance → Memory & CPU…).
-pub fn page_id(name: &str) -> Option<&'static str> {
-    let n = name.to_ascii_lowercase().replace([' ', '&', '-', '_'], "");
-    let id = match n.as_str() {
-        "general" => "general",
-        "startup" | "startuprepair" => "startup",
-        "project" | "autosave" | "newproject" => "project",
-        "composition" | "display" => "composition",
-        "previews" | "preview" => "previews",
-        "appearance" => "appearance",
-        "grids" | "gridsguides" => "grids",
-        "labels" => "labels",
-        "type" => "type",
-        "import" => "import",
-        "export" | "output" => "export",
-        "audio" | "audiohardware" | "audiooutputmapping" => "audio",
-        "disk" | "mediadiskcache" | "mediacache" => "disk",
-        "memory" | "memorycpu" | "memoryperformance" => "memory",
-        "video" | "videopreview" => "video",
-        "3d" | "threed" => "3d",
-        "scripting" | "scriptingexpressions" => "scripting",
-        "roto" | "rotobrush" | "models" => "roto",
-        "face" | "facetracking" => "face",
-        _ => return None,
-    };
-    Some(id)
-}
-
-fn kind_name(v: &Value) -> &'static str {
-    match v {
-        Value::Bool(_) => "boolean",
-        Value::Number(_) => "number",
-        Value::String(_) => "string",
-        Value::Array(_) => "list",
-        Value::Object(_) => "object",
-        Value::Null => "value",
-    }
-}
-
-/// `value` converted to the type of `slot` (numbers from strings, booleans from 0/1…).
-fn coerce(slot: &Value, value: Value) -> Option<Value> {
-    Some(match (slot, value) {
-        (Value::Bool(_), Value::Bool(b)) => json!(b),
-        (Value::Bool(_), Value::Number(n)) => json!(n.as_f64()? != 0.0),
-        (Value::Bool(_), Value::String(s)) => json!(matches!(s.as_str(), "true" | "on" | "1" | "yes")),
-        (Value::Number(cur), v) => {
-            let f = match &v {
-                Value::Number(n) => n.as_f64()?,
-                Value::String(s) => s.trim().parse().ok()?,
-                _ => return None,
-            };
-            if cur.is_u64() || cur.is_i64() { json!(f.round().max(0.0) as u64) } else { json!(f) }
-        }
-        (Value::String(_), Value::String(s)) => json!(s),
-        (Value::String(_), Value::Number(n)) => json!(n.to_string()),
-        (Value::Array(_), v @ Value::Array(_)) => v,
-        (Value::Object(_), v @ Value::Object(_)) => v,
-        _ => return None,
-    })
-}
-
-// ---------------------------------------------------------------- schema (Settings dialog)
-
-/// What a setting row edits.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Kind {
-    Bool,
-    /// Integer with range and unit.
-    Int(i64, i64, &'static str),
-    /// Number with range and unit.
-    Float(f64, f64, &'static str),
-    /// One of (label, value).
-    Choice(&'static [(&'static str, &'static str)]),
-    Text,
-    /// A folder or file path (text + Choose…).
-    Path,
-    /// `#rrggbb`.
-    Color,
-    /// UI brightness slider.
-    Slider(f64, f64),
-}
-
-/// One row of a settings page.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Item {
-    Section(&'static str),
-    Setting {
-        key: &'static str,
-        label: &'static str,
-        kind: Kind,
-        /// Changes behaviour today (false = shown for parity, listed in docs/preferences.md).
-        live: bool,
-    },
-    /// A button running a command (`params` is JSON).
-    Button {
-        label: &'static str,
-        command: &'static str,
-        params: &'static str,
-    },
-    /// The 16 label names and colours.
-    Labels,
-    /// Output device picker (device list from the host).
-    AudioDevices {
-        key: &'static str,
-    },
-    /// Read-only information line.
-    Note(&'static str),
-    /// The browser's storage manager (web app only, `storage.*`): usage and quota, persistent
-    /// storage, Clear buttons. Not shown where there is no browser storage.
-    BrowserStorage,
-    /// A task's trained models (`roto.models`, `face.models`): authors, licence, size, install,
-    /// choose.
-    Models(effectcraft_segment::Task),
-}
-
-/// One page of the Settings dialog.
-#[derive(Clone, Debug)]
-pub struct Page {
-    pub id: &'static str,
-    pub title: &'static str,
-    pub items: Vec<Item>,
-}
-
-const fn s(key: &'static str, label: &'static str, kind: Kind, live: bool) -> Item {
-    Item::Setting { key, label, kind, live }
-}
-
-const B: Kind = Kind::Bool;
-const ON_OFF_RES: &[(&str, &str)] = &[("1/2", "1/2"), ("1/4", "1/4"), ("1/8", "1/8")];
-const STYLES: &[(&str, &str)] = &[("Lines", "lines"), ("Dashed Lines", "dashed"), ("Dots", "dots")];
-
-/// The Settings pages in After Effects 2026 order.
-pub fn pages() -> Vec<Page> {
-    use Item::*;
-    vec![
-        Page {
-            id: "general",
-            title: "General",
-            items: vec![
-                s("general.language", "Language", Kind::Choice(LANGUAGES), true),
-                s("general.undoLevels", "Levels of Undo", Kind::Int(1, 99, ""), true),
-                s("general.pathPointSize", "Path Point and Handle Size", Kind::Int(3, 20, "px"), true),
-                s("general.recentItems", "Recent Projects Shown", Kind::Int(1, 30, ""), true),
-                Section("Options"),
-                s("general.showToolTips", "Show Tool Tips", B, true),
-                s("general.createLayersAtCompStart", "Create Layers at Composition Start Time", B, true),
-                s("general.switchesAffectNestedComps", "Switches Affect Nested Comps", B, true),
-                s("general.defaultSpatialLinear", "Default Spatial Interpolation to Linear", B, true),
-                s("general.preserveConstantVertexCount", "Preserve Constant Vertex and Feather Point Count when Editing Masks", B, true),
-                s("general.syncTimeRelatedItems", "Synchronize Time of All Related Items", B, true),
-                s("general.expressionPickWhipCompact", "Expression Pick Whip Writes Compact English", B, true),
-                s("general.createSplitLayersAbove", "Create Split Layers Above Original Layer", B, true),
-                s("general.useSystemColorPicker", "Use System Color Picker", B, false),
-                Note("EffectCraft always uses its own colour picker (the same on every platform and the web)."),
-            ],
-        },
-        Page {
-            id: "startup",
-            title: "Startup & Repair",
-            items: vec![
-                s("startup.showHomeOnLaunch", "Show Home Screen When Launching", B, true),
-                s("startup.showHomeOnOpenProject", "Show Home Screen When Opening a Project", B, true),
-                s("startup.offerCrashRecovery", "Offer to Open the Latest Auto-Save After a Crash", B, true),
-                s("startup.windowGraphics", "Window Graphics", Kind::Choice(WINDOW_GRAPHICS), true),
-                Note(
-                    "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
-                ),
-                Section("Repair"),
-                Button { label: "Reset Settings", command: "prefs.reset", params: "{}" },
-                Button { label: "Reset Keyboard Shortcuts", command: "shortcuts.reset", params: "{}" },
-                Button { label: "Empty Disk Cache", command: "edit.purge", params: r#"{"what":"disk"}"# },
-            ],
-        },
-        Page {
-            id: "project",
-            title: "Project",
-            items: vec![
-                Section("New Project"),
-                s("project.useTemplate", "New Project Loads Template", B, true),
-                s("project.templatePath", "Template Project", Kind::Path, true),
-                Section("Auto-Save"),
-                s("autoSave.enabled", "Automatically Save Projects", B, true),
-                s("autoSave.intervalMinutes", "Save Every", Kind::Int(1, 240, "Minutes"), true),
-                s("autoSave.maxVersions", "Maximum Project Versions", Kind::Int(1, 99, ""), true),
-                s("autoSave.location", "Auto-Save Location", Kind::Choice(&[("Next to Project", "nextToProject"), ("Custom Location", "custom")]), true),
-                s("autoSave.folder", "Custom Location", Kind::Path, true),
-                s("autoSave.saveOnRenderStart", "Save When Starting Render Queue", B, true),
-                Button { label: "Save Now", command: "file.autoSave", params: "{}" },
-            ],
-        },
-        Page {
-            id: "composition",
-            title: "Composition",
-            items: vec![
-                Section("Motion Path"),
-                s(
-                    "composition.motionPath",
-                    "Motion Path",
-                    Kind::Choice(&[
-                        ("All Keyframes", "all"),
-                        ("No Motion Path", "none"),
-                        ("No More Than (Seconds)", "seconds"),
-                        ("No More Than (Keyframes)", "keyframes"),
-                    ]),
-                    true,
-                ),
-                s("composition.motionPathSeconds", "Seconds", Kind::Float(0.0, 3600.0, "s"), true),
-                s("composition.motionPathKeyframes", "Keyframes", Kind::Int(1, 10_000, ""), true),
-                Section("Display"),
-                s("composition.showRenderingProgress", "Show Rendering Progress in Info Panel and Flowchart", B, true),
-                s("composition.hardwareAcceleratePanels", "Hardware Accelerate Composition, Layer and Footage Panels", B, false),
-                Note("Panels are always drawn by the GPU (wgpu)."),
-            ],
-        },
-        Page {
-            id: "previews",
-            title: "Previews",
-            items: vec![
-                s("previews.adaptiveResolutionLimit", "Adaptive Resolution Limit", Kind::Choice(ON_OFF_RES), true),
-                s("previews.showInternalWireframes", "Show Internal Wireframes", B, true),
-                s("previews.cacheFramesWhenIdle", "Cache Frames When Idle", B, true),
-                s("previews.fastPreviews", "Fast Previews (Draft 3D, Faster Effects)", B, true),
-                s("previews.zoomQuality", "Viewer Zoom Quality", Kind::Choice(&[("Faster", "faster"), ("More Accurate", "moreAccurate")]), true),
-                s("previews.displayProfile", "Display Color Space", Kind::Choice(&[("sRGB", "srgb"), ("Display P3", "p3")]), true),
-                Button { label: "GPU Information...", command: "app.gpuInfo", params: "{}" },
-            ],
-        },
-        Page {
-            id: "appearance",
-            title: "Appearance",
-            items: vec![
-                s("appearance.appearanceMode", "Appearance Mode", Kind::Choice(APPEARANCE_MODES), true),
-                s("appearance.lightTheme", "Light Theme", Kind::Choice(LIGHT_THEMES), true),
-                s("appearance.darkTheme", "Dark Theme", Kind::Choice(DARK_THEMES), true),
-                s("appearance.brightness", "Brightness", Kind::Slider(-1.0, 1.0), true),
-                s("appearance.uiScale", "UI Scale", Kind::Int(75, 200, "%"), true),
-                Section("Labels and Colors"),
-                s("appearance.useLabelColorForHandles", "Use Label Color for Layer Handles and Paths", B, true),
-                s("appearance.useLabelColorForTabs", "Use Label Color for Related Tabs", B, true),
-                s("appearance.cycleMaskColors", "Cycle Mask Colors", B, true),
-                s("appearance.useGradients", "Use Gradients", B, true),
-                Section("Menu Bar"),
-                s("appearance.inWindowMenuBarMac", "Use In-Window Menu Bar on macOS", B, true),
-            ],
-        },
-        Page {
-            id: "grids",
-            title: "Grids & Guides",
-            items: vec![
-                Section("Grid"),
-                s("grids.gridColor", "Color", Kind::Color, true),
-                s("grids.gridSpacing", "Gridline Every", Kind::Float(1.0, 10_000.0, "px"), true),
-                s("grids.gridSubdivisions", "Subdivisions", Kind::Int(1, 100, ""), true),
-                s("grids.gridStyle", "Style", Kind::Choice(STYLES), true),
-                Section("Proportional Grid"),
-                s("grids.proportionalHorizontal", "Horizontal", Kind::Int(1, 100, ""), true),
-                s("grids.proportionalVertical", "Vertical", Kind::Int(1, 100, ""), true),
-                Section("Guides"),
-                s("grids.guideColor", "Color", Kind::Color, true),
-                s("grids.guideStyle", "Style", Kind::Choice(STYLES), true),
-                Section("Safe Margins"),
-                s("grids.actionSafe", "Action-safe", Kind::Float(0.0, 50.0, "%"), true),
-                s("grids.titleSafe", "Title-safe", Kind::Float(0.0, 50.0, "%"), true),
-            ],
-        },
-        Page { id: "labels", title: "Labels", items: vec![Labels] },
-        Page {
-            id: "type",
-            title: "Type",
-            items: vec![
-                s("type.textEngine", "Text Engine", Kind::Choice(&[("Latin", "latin"), ("South Asian and Middle Eastern", "southAsian")]), true),
-                s("type.fontPreview", "Show Font Preview", B, true),
-                s("type.recentFonts", "Number of Recent Fonts to Display", Kind::Int(0, 30, ""), true),
-                s("type.fontNamesInEnglish", "Show Font Names in English", B, true),
-            ],
-        },
-        Page {
-            id: "import",
-            title: "Import",
-            items: vec![
-                s("import.stillFootage", "Still Footage", Kind::Choice(&[("Length of Composition", "compLength"), ("Duration (Seconds)", "seconds")]), true),
-                s("import.stillSeconds", "Still Duration", Kind::Float(0.04, 86_400.0, "s"), true),
-                s("import.sequenceFps", "Sequence Footage", Kind::Float(1.0, 999.0, "frames per second"), true),
-                s("import.reportMissingFrames", "Report Missing Frames", B, true),
-                s(
-                    "import.autoReloadFootage",
-                    "Automatically Reload Footage",
-                    Kind::Choice(&[("Off", "off"), ("Non-Sequence Footage", "nonSequence"), ("All Footage", "all")]),
-                    true,
-                ),
-                s(
-                    "import.unlabeledAlpha",
-                    "Interpret Unlabeled Alpha As",
-                    Kind::Choice(&[
-                        ("Ask User", "ask"),
-                        ("Guess", "guess"),
-                        ("Ignore", "ignore"),
-                        ("Straight", "straight"),
-                        ("Premultiplied", "premultiplied"),
-                    ]),
-                    true,
-                ),
-                s(
-                    "import.dragImportAs",
-                    "Default Drag Import As",
-                    Kind::Choice(&[("Footage", "footage"), ("Composition", "comp"), ("Composition - Retain Layer Sizes", "compLayerSizes")]),
-                    true,
-                ),
-            ],
-        },
-        Page {
-            id: "export",
-            title: "Export",
-            items: vec![
-                s("export.defaultOutputFolder", "Default Output Folder", Kind::Path, true),
-                s("export.segmentSequences", "Segment Sequences", B, true),
-                s("export.segmentSequenceFiles", "Files per Segment", Kind::Int(1, 100_000, "files"), true),
-                s("export.segmentMovies", "Segment Movie Files", B, true),
-                s("export.segmentMovieMb", "Segment Size", Kind::Int(1, 1_000_000, "MB"), true),
-                s("export.appendBitsToName", "Append Bit Depth to File Name", B, true),
-            ],
-        },
-        Page {
-            id: "audio",
-            title: "Audio",
-            items: vec![
-                Section("Audio Hardware"),
-                AudioDevices { key: "audio.outputDevice" },
-                s("audio.previewSampleRate", "Preview Sample Rate", Kind::Int(8_000, 192_000, "Hz"), true),
-                Section("Audio Output Mapping"),
-                s("audio.outputLeft", "Left", Kind::Int(1, 64, "channel"), true),
-                s("audio.outputRight", "Right", Kind::Int(1, 64, "channel"), true),
-            ],
-        },
-        Page {
-            id: "disk",
-            title: "Disk",
-            items: vec![
-                Section("Disk Cache"),
-                s("disk.diskCacheEnabled", "Enable Disk Cache", B, true),
-                s("disk.diskCacheMaxGb", "Maximum Disk Cache Size", Kind::Int(1, 100_000, "GB"), true),
-                s("disk.diskCacheFolder", "Disk Cache Folder", Kind::Path, true),
-                Button { label: "Empty Disk Cache", command: "edit.purge", params: r#"{"what":"disk"}"# },
-                BrowserStorage,
-                Section("Media Cache"),
-                s("disk.mediaCacheFolder", "Database and Cache Folder", Kind::Path, true),
-                s("disk.conformedMediaFolder", "Conformed Audio Folder", Kind::Path, true),
-            ],
-        },
-        Page {
-            id: "memory",
-            title: "Memory & CPU",
-            items: vec![
-                s("memory.ramReservedGb", "RAM Reserved for Other Applications", Kind::Int(0, 1024, "GB"), true),
-                Section("Cache Budgets"),
-                s("memory.layerCacheMb", "Layer Cache", Kind::Int(64, 1 << 20, "MB"), true),
-                s("memory.mediaCacheMb", "Footage Frame Cache", Kind::Int(64, 1 << 20, "MB"), true),
-                s("memory.previewCacheMb", "Preview (RAM) Cache", Kind::Int(64, 1 << 20, "MB"), true),
-                s("memory.reduceCacheWhenLow", "Reduce Cache Size When System Is Low on Memory", B, true),
-            ],
-        },
-        Page {
-            id: "video",
-            title: "Video",
-            items: vec![
-                s("video.enableOutput", "Enable Video Preview Output", B, true),
-                s("video.device", "Video Device", Kind::Choice(&[("Floating Window", ""), ("Full Screen", "fullscreen")]), true),
-                s("video.outputDuringPlayback", "Video Output During Playback", B, true),
-                s("video.mirrorOnMonitor", "Mirror on Computer Monitor", B, true),
-                s("video.disableWhenBackground", "Disable Video Output When in Background", B, true),
-            ],
-        },
-        Page {
-            id: "3d",
-            title: "3D",
-            items: vec![
-                s("threeD.defaultRenderer", "Default 3D Renderer", Kind::Choice(&[("Classic 3D", "classic"), ("Advanced 3D", "advanced")]), true),
-                s("threeD.showReferenceAxes", "Show 3D Reference Axes", B, true),
-                s("threeD.extendedViewer", "Extended Viewer", B, true),
-                s("threeD.realtimeShadows", "Realtime Shadows in Draft", B, true),
-            ],
-        },
-        Page {
-            id: "scripting",
-            title: "Scripting & Expressions",
-            items: vec![
-                Section("Application Scripting"),
-                s("scripting.allowScriptsWriteFiles", "Allow Scripts to Write Files and Access Network", B, true),
-                s("scripting.warnExecutingFiles", "Warn User When Executing Files", B, true),
-                s("scripting.enableJsDebugger", "Enable JavaScript Debugger", B, false),
-                Section("Expressions Editor"),
-                s("scripting.editorFontSize", "Font Size", Kind::Int(8, 40, "pt"), true),
-                s("scripting.syntaxHighlighting", "Syntax Highlighting", B, true),
-                s("scripting.lineNumbers", "Line Numbers", B, true),
-                s("scripting.autoComplete", "Auto-complete", B, true),
-                s("scripting.bracketMatching", "Bracket Matching", B, true),
-                s("scripting.wordWrap", "Word Wrap", B, true),
-                s("scripting.errorBanner", "Show Expression Error Banner", B, true),
-                Note("Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger."),
-            ],
-        },
-        Page {
-            id: "roto",
-            title: "Roto Brush",
-            items: vec![
-                Section("Segmentation Model"),
-                Note(
-                    "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
-                ),
-                Models(effectcraft_segment::Task::Mask),
-            ],
-        },
-        Page {
-            id: "face",
-            title: "Face Tracking",
-            items: vec![
-                Section("Face Model"),
-                Note(
-                    "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
-                ),
-                Models(effectcraft_segment::Task::Face),
-            ],
-        },
-    ]
-}
-
-/// Keys of every setting that doesn't change behaviour yet (the TODO list in
-/// `docs/preferences.md`).
-pub fn todo_keys() -> Vec<&'static str> {
-    pages()
-        .into_iter()
-        .flat_map(|p| p.items)
-        .filter_map(|i| match i {
-            Item::Setting { key, live: false, .. } => Some(key),
-            _ => None,
-        })
-        .collect()
-}
-
-/// The schema as JSON (for `prefs.pages`).
-pub fn pages_json() -> Value {
-    let kind = |k: &Kind| -> Value {
-        match k {
-            Kind::Bool => json!({"type": "bool"}),
-            Kind::Int(a, b, u) => json!({"type": "int", "min": a, "max": b, "unit": u}),
-            Kind::Float(a, b, u) => json!({"type": "number", "min": a, "max": b, "unit": u}),
-            Kind::Choice(o) => json!({"type": "choice", "options": o.iter().map(|(l, v)| json!({"label": l, "value": v})).collect::<Vec<_>>()}),
-            Kind::Text => json!({"type": "text"}),
-            Kind::Path => json!({"type": "path"}),
-            Kind::Color => json!({"type": "color"}),
-            Kind::Slider(a, b) => json!({"type": "slider", "min": a, "max": b}),
-        }
-    };
-    let pages: Vec<Value> = pages()
-        .iter()
-        .map(|p| {
-            let items: Vec<Value> = p
-                .items
-                .iter()
-                .map(|i| match i {
-                    Item::Section(t) => json!({"section": t}),
-                    Item::Setting { key, label, kind: k, live } => {
-                        let mut o = kind(k);
-                        o["key"] = json!(key);
-                        o["label"] = json!(label);
-                        o["live"] = json!(live);
-                        o
-                    }
-                    Item::Button { label, command, params } => {
-                        json!({"button": label, "command": command, "params": serde_json::from_str::<Value>(params).unwrap_or_default()})
-                    }
-                    Item::Labels => json!({"labels": "labels.N.name / labels.N.color (N = 0..15)"}),
-                    Item::AudioDevices { key } => json!({"type": "device", "key": key, "label": "Default Output"}),
-                    Item::Note(t) => json!({"note": t}),
-                    Item::BrowserStorage => json!({"browserStorage": "storage.info / storage.persist / storage.clear (web app)"}),
-                    Item::Models(task) => {
-                        let p = if *task == effectcraft_segment::Task::Face { "face" } else { "roto" };
-                        json!({"models": format!("{p}.models / {p}.model.select / {p}.model.download / {p}.model.install / {p}.model.remove"), "key": format!("{p}.model")})
-                    }
-                })
-                .collect();
-            json!({"id": p.id, "title": p.title, "items": items})
-        })
-        .collect();
-    json!(pages)
-}
diff --git a/crates/engine/src/render_queue.rs b/crates/engine/src/render_queue.rs
index 74b333151..cc141f3fd 100644
--- a/crates/engine/src/render_queue.rs
+++ b/crates/engine/src/render_queue.rs
@@ -14,6 +14,7 @@ use effectcraft_project::render_queue::{OutputFormat, OutputModule, PostRenderAc
 use effectcraft_project::{ItemId, ItemKind, LayerSource, Project};
 use effectcraft_render::{ExprHost, FootageSource};
 use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
 
 use crate::{Event, Session};
 
@@ -57,6 +58,12 @@ pub struct ExportResult {
 pub trait Exporter: Send + Sync {
     /// Formats this build can write.
     fn formats(&self) -> Vec<OutputFormat>;
+    /// Whether Skip Existing Files preserves sequence frames written by earlier items. Exporters
+    /// without an existence check (such as memory sinks) must keep the conservative default.
+    /// The check must cover the final destination for these settings, including any overflow.
+    fn supports_skip_existing(&self, _settings: &effectcraft_project::render_queue::RenderSettings) -> bool {
+        false
+    }
     /// Render and write one item (blocking). `progress(done, total)` returns `false` to cancel;
     /// a cancelled export removes the files it opened for that output and returns `Err("cancelled")`.
     /// Completed earlier queue items and unrelated files must be preserved.
@@ -107,13 +114,63 @@ pub struct JobShared {
     pub cancel: AtomicBool,
     pub state: Mutex<JobState>,
     pub updates: Mutex<Vec<ItemUpdate>>,
+    /// A waiting control request retains its own items across requeue/removal/project edits.
+    reply: Mutex<Option<RenderReply>>,
+}
+
+#[derive(Default)]
+struct RenderReply {
+    items: Vec<Value>,
+    finished: bool,
 }
 
 pub(crate) fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
-    m.lock().unwrap_or_else(|e| e.into_inner())
+    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }
 
 impl JobShared {
+    /// Retain the requesting command's items before the UI can edit or replace the queue.
+    pub fn retain_reply_items(&self, items: Vec<Value>) {
+        *lock(&self.reply) = Some(RenderReply { items, finished: false });
+    }
+
+    /// Whether completion and post-render actions have been applied to this run.
+    pub fn reply_finished(&self) -> bool {
+        lock(&self.reply).as_ref().is_some_and(|reply| reply.finished)
+    }
+
+    /// Final items for this run, independent of the current project and any later render.
+    pub fn completed_items(&self) -> Option<Vec<Value>> {
+        lock(&self.reply).as_ref().filter(|reply| reply.finished).map(|reply| reply.items.clone())
+    }
+
+    fn update_reply(&self, updates: &[ItemUpdate]) {
+        let mut reply = lock(&self.reply);
+        let Some(reply) = reply.as_mut() else { return };
+        for update in updates {
+            let id = match update {
+                ItemUpdate::Started { id, .. } | ItemUpdate::Finished { id, .. } => *id,
+            };
+            let Some(item) = reply.items.iter_mut().find(|item| item["id"].as_u64() == Some(id)).and_then(Value::as_object_mut) else { continue };
+            match update {
+                ItemUpdate::Started { unix, .. } => {
+                    item.insert("status".into(), json!(RenderStatus::Rendering));
+                    item.insert("statusLabel".into(), json!(RenderStatus::Rendering.label()));
+                    item.insert("started".into(), json!(unix));
+                    item.insert("render_time".into(), Value::Null);
+                }
+                ItemUpdate::Finished { status, seconds, output, .. } => {
+                    item.insert("status".into(), json!(status));
+                    item.insert("statusLabel".into(), json!(status.label()));
+                    item.insert("render_time".into(), json!(seconds));
+                    if let Some(output) = output {
+                        item.insert("last_output".into(), json!(output));
+                    }
+                }
+            }
+        }
+    }
+
     pub fn snapshot(&self) -> JobState {
         lock(&self.state).clone()
     }
@@ -175,6 +232,8 @@ pub fn output_bits(format: OutputFormat, depth: effectcraft_project::BitDepth) -
         BitDepth::Bpc32 => 32,
     };
     match format {
+        // The default; a module's half float ([`OutputModule::exr_bit_depth`]) is read where the
+        // module is known.
         OutputFormat::ExrSequence => 32,
         OutputFormat::PngSequence | OutputFormat::TiffSequence => project.min(16),
         OutputFormat::ProRes => 10,
@@ -208,6 +267,16 @@ pub fn bytes_per_frame(om: &OutputModule, w: u32, h: u32, fps: f64) -> f64 {
             let bpp = if om.channels == effectcraft_project::render_queue::Channels::Rgba { 4 } else { 3 };
             ((w as u64 * bpp).next_multiple_of(2) * h as u64) as f64
         }
+        // An 18-byte header and 24-bit BGR, 32-bit BGRA or 8-bit grey (Alpha) pixels, uncompressed.
+        OutputFormat::TargaSequence => {
+            use effectcraft_project::render_queue::Channels;
+            let bpp = match om.channels {
+                Channels::Rgb => 3,
+                Channels::Rgba => 4,
+                Channels::Alpha => 1,
+            };
+            (18 + w as u64 * h as u64 * bpp) as f64
+        }
         OutputFormat::WebM => mbps(8.0) * px / fps,
         OutputFormat::Gif => w as f64 * h as f64 * 0.5,
         OutputFormat::Wav | OutputFormat::Aiff => om.audio_sample_rate as f64 * 4.0 / fps,
@@ -432,10 +501,47 @@ impl Session {
         self.render_job.as_ref().map(|j| j.shared.snapshot())
     }
 
-    /// Start rendering every queued item. `wait`: block until done (otherwise a background thread
-    /// renders, or the [`Session::offload`] worker; call [`Session::poll_render`] regularly).
-    /// Returns the ids being rendered. Without threads or an offload (wasm32) the render always
-    /// runs to completion before this returns.
+    /// The (item, resolved output path) of each output of `it`: one per output module and, with
+    /// Segment Sequences / Segment Movie Files, per segment. `formats`: the ones that can be
+    /// written (`None`: all). Fails with the status the item gets instead.
+    pub(crate) fn outputs_of(&self, it: &RenderQueueItem, formats: Option<&[OutputFormat]>) -> Result<Vec<(RenderQueueItem, String)>, RenderStatus> {
+        let mut modules = vec![];
+        for om in it.output_modules() {
+            let mut m = it.clone();
+            m.output = om.clone();
+            match self.resolve_output(&m) {
+                Some(p) if formats.is_none_or(|f| f.contains(&om.format)) => {
+                    // Settings ▸ Export: Append Bit Depth to File Name, Segment Sequences /
+                    // Movie Files.
+                    let bits =
+                        if om.format == OutputFormat::ExrSequence { om.exr_bit_depth.bits() } else { output_bits(om.format, self.project.settings.bit_depth) };
+                    let p = self.prefs.output_name(&p, bits);
+                    modules.extend(self.segments(&m, &p));
+                }
+                Some(_) => return Err(RenderStatus::Failed(format!("{} export is not available", om.format.label()))),
+                None if self.project.comp(it.comp).is_none() => return Err(RenderStatus::Failed("composition missing".into())),
+                None => return Err(RenderStatus::NeedsOutput),
+            }
+        }
+        Ok(modules)
+    }
+
+    /// What the next Render would write: for each queued item its [`Session::outputs_of`], and
+    /// the status of each queued item that has none.
+    pub(crate) fn queued_outputs(&self, formats: &[OutputFormat]) -> (Vec<Vec<(RenderQueueItem, String)>>, Vec<(u64, RenderStatus)>) {
+        let (mut items, mut problems) = (Vec::new(), Vec::new());
+        for it in self.project.render_queue.iter().filter(|i| i.is_queued()) {
+            match self.outputs_of(it, Some(formats)) {
+                Ok(modules) => items.push(modules),
+                Err(status) => problems.push((it.id, status)),
+            }
+        }
+        (items, problems)
+    }
+
+    /// Start rendering every queued item, refusing outputs that replace footage, proxies or
+    /// the project file. Other existing outputs keep the exporter's usual replacement policy.
+    /// `wait`: block until done, otherwise render in the background and poll regularly.
     pub fn start_render(&mut self, wait: bool) -> Result<Vec<u64>, String> {
         let offload = self.offload.clone().filter(|_| !wait);
         let wait = wait || (cfg!(target_arch = "wasm32") && offload.is_none());
@@ -445,46 +551,38 @@ impl Session {
         self.poll_render();
         let exporter = self.exporter.clone().ok_or("export is not available in this build")?;
         let formats = exporter.formats();
-        let mut items = Vec::new();
-        let mut needs_output = Vec::new();
-        for it in self.project.render_queue.iter().filter(|i| i.is_queued()) {
-            let mut modules = vec![];
-            let mut problem = None;
-            for om in it.output_modules() {
-                let mut m = it.clone();
-                m.output = om.clone();
-                match self.resolve_output(&m) {
-                    Some(p) if formats.contains(&om.format) => {
-                        // Settings ▸ Export: Append Bit Depth to File Name, Segment Sequences /
-                        // Movie Files.
-                        let bits = output_bits(om.format, self.project.settings.bit_depth);
-                        let p = self.prefs.output_name(&p, bits);
-                        modules.extend(self.segments(&m, &p));
-                    }
-                    Some(_) => problem = Some(RenderStatus::Failed(format!("{} export is not available", om.format.label()))),
-                    None if self.project.comp(it.comp).is_none() => problem = Some(RenderStatus::Failed("composition missing".into())),
-                    None => problem = Some(RenderStatus::NeedsOutput),
-                }
-                if problem.is_some() {
-                    break;
-                }
-            }
-            match problem {
-                Some(st) => needs_output.push((it.id, st)),
-                None => items.push(modules),
-            }
+        let (mut items, mut problems) = self.queued_outputs(&formats);
+        let refused = self.check_outputs(&items);
+        // Two outputs of this job on one file: the render would replace its own output, so it is
+        // refused before anything is written (the items refused above take no part).
+        if let Some(refusal) = crate::output_guard::duplicate_refusal(&self.duplicate_outputs(&items, &refused)?) {
+            return Err(refusal);
         }
-        if !needs_output.is_empty() {
+        items.retain(|modules| modules.first().is_none_or(|(it, _)| !refused.iter().any(|r| r.item == it.id)));
+        problems.extend(refused.iter().map(|r| (r.item, RenderStatus::Failed(r.reason.clone()))));
+        if !problems.is_empty() {
             let p = Arc::make_mut(&mut self.project);
-            for (id, st) in needs_output {
+            for (id, st) in problems {
                 if let Some(i) = p.render_queue.iter_mut().find(|i| i.id == id) {
                     i.status = st;
                 }
             }
             self.bump();
         }
+        if let Some(first) = refused.first() {
+            let message = if refused.len() == 1 {
+                format!("Not rendered: {}", first.reason)
+            } else {
+                format!("{} items were not rendered; first: {}", refused.len(), first.reason)
+            };
+            self.events.push(Event::Toast { message, error: true });
+        }
         if items.is_empty() {
-            return Err("nothing is queued: add a composition (Composition ▸ Add to Render Queue) and tick Render".into());
+            return Err(match refused.as_slice() {
+                [] => "nothing is queued: add a composition (Composition ▸ Add to Render Queue) and tick Render".into(),
+                [only] => only.reason.clone(),
+                [first, ..] => format!("{} items would replace files the project reads; first: {}", refused.len(), first.reason),
+            });
         }
         let ids: Vec<u64> = items.iter().filter_map(|m| m.first().map(|(i, _)| i.id)).collect();
         if let Some(off) = offload {
@@ -579,8 +677,11 @@ impl Session {
     pub fn poll_render(&mut self) -> bool {
         self.drain_remote_render();
         let Some(job) = &self.render_job else { return false };
-        let updates = std::mem::take(&mut *lock(&job.shared.updates));
+        // Observe completion before draining updates so a worker finishing between the two
+        // reads cannot leave its final item statuses behind when this job is removed.
         let finished = job.is_finished();
+        let updates = std::mem::take(&mut *lock(&job.shared.updates));
+        job.shared.update_reply(&updates);
         let changed = !updates.is_empty();
         let mut post: Vec<(u64, String)> = vec![];
         if changed {
@@ -612,6 +713,7 @@ impl Session {
             }
             self.bump();
         }
+        let mut completed = None;
         if finished && let Some(mut job) = self.render_job.take() {
             if let Some(t) = job.thread.take() {
                 let _ = t.join();
@@ -638,12 +740,18 @@ impl Session {
                 self.events.push(Event::Frontend { command: "renderQueue.notify".into(), params: serde_json::json!({"message": msg, "error": failed > 0}) });
             }
             self.events.push(Event::Toast { message: msg, error: failed > 0 });
+            completed = Some(job.shared);
         }
         for (id, path) in post {
             if let Err(e) = self.post_render_action(id, &path) {
                 self.events.push(Event::Toast { message: format!("Post-render action: {e}"), error: true });
             }
         }
+        if let Some(shared) = completed
+            && let Some(reply) = lock(&shared.reply).as_mut()
+        {
+            reply.finished = true;
+        }
         changed || finished
     }
 
@@ -676,7 +784,7 @@ impl Session {
                         continue;
                     }
                     if let Some(c) = proj.comp_mut(cid) {
-                        for l in c.layers.iter_mut().filter(|l| matches!(l.source, LayerSource::Comp { item } if item == comp)) {
+                        for l in c.layers.iter_mut_where(|l| matches!(l.source, LayerSource::Comp { item } if item == comp)) {
                             l.source = LayerSource::Footage { item: fid };
                         }
                     }
diff --git a/crates/engine/src/rq_tests.rs b/crates/engine/src/rq_tests.rs
index 81a187226..d6bb96831 100644
--- a/crates/engine/src/rq_tests.rs
+++ b/crates/engine/src/rq_tests.rs
@@ -67,11 +67,11 @@ fn add_configure_render() {
     let r = s.execute("renderQueue.setOutputModule", json!({"item": id, "format": "png", "channels": "rgba"})).unwrap();
     assert!(r["outputPath"].as_str().unwrap().ends_with("_[#####].png"), "{r}");
     assert!(s.execute("renderQueue.setOutputModule", json!({"item": id, "format": "jpeg", "channels": "rgba"})).is_err());
-    let r = s.execute("renderQueue.setOutput", json!({"item": id, "path": crate::tests_stubs::tmp_out("rq/out.mov")})).unwrap();
+    let r = s.execute("renderQueue.setOutput", json!({"item": id, "path": crate::tests::stubs::tmp_out("rq/out.mov")})).unwrap();
     assert_eq!(r["output"]["format"], "ProRes", "Output To with .mov switches to ProRes");
-    assert_eq!(std::path::Path::new(r["outputPath"].as_str().unwrap()), std::path::PathBuf::from(crate::tests_stubs::tmp_out("rq/out.mov")));
+    assert_eq!(std::path::Path::new(r["outputPath"].as_str().unwrap()), std::path::PathBuf::from(crate::tests::stubs::tmp_out("rq/out.mov")));
     // A second item that fails, a third that is unqueued.
-    let b = s.execute("renderQueue.add", json!({"format": "gif", "output": crate::tests_stubs::tmp_out("rq/fail.gif")})).unwrap();
+    let b = s.execute("renderQueue.add", json!({"format": "gif", "output": crate::tests::stubs::tmp_out("rq/fail.gif")})).unwrap();
     let c = s.execute("renderQueue.add", json!({"output": "/tmp/rq/skip.mp4"})).unwrap();
     s.execute("renderQueue.setRender", json!({"item": c["item"], "render": false})).unwrap();
     assert_eq!(s.project.render_queue[2].status.label(), "Unqueued");
@@ -79,12 +79,12 @@ fn add_configure_render() {
     assert_eq!(r["items"].as_array().unwrap().len(), 2);
     assert_eq!(
         ex.log.lock().unwrap().iter().map(std::path::PathBuf::from).collect::<Vec<_>>(),
-        [std::path::PathBuf::from(crate::tests_stubs::tmp_out("rq/out.mov")), std::path::PathBuf::from(crate::tests_stubs::tmp_out("rq/fail.gif"))]
+        [std::path::PathBuf::from(crate::tests::stubs::tmp_out("rq/out.mov")), std::path::PathBuf::from(crate::tests::stubs::tmp_out("rq/fail.gif"))]
     );
     let q = &s.project.render_queue;
     assert_eq!(q[0].status.label(), "Done");
     assert!(q[0].started.is_some() && q[0].render_time.is_some());
-    assert_eq!(std::path::Path::new(q[0].last_output.as_deref().unwrap()), std::path::PathBuf::from(crate::tests_stubs::tmp_out("rq/out.mov")));
+    assert_eq!(std::path::Path::new(q[0].last_output.as_deref().unwrap()), std::path::PathBuf::from(crate::tests::stubs::tmp_out("rq/out.mov")));
     assert_eq!(q[1].status, RenderStatus::Failed("boom".into()));
     assert_eq!(q[2].status.label(), "Unqueued");
     let events = s.drain_events();
@@ -116,6 +116,25 @@ fn persists_in_project_file() {
     assert!(effectcraft_project::Project::from_json(&old).unwrap().render_queue.is_empty());
 }
 
+#[test]
+fn targa_sequence_output_module() {
+    let (mut s, _) = rq_session();
+    let a = s.execute("renderQueue.add", json!({"format": "tga", "output": "/out/[compName]_[#####].tga", "channels": "rgba"})).unwrap();
+    let om = &s.project.render_queue[0].output;
+    assert_eq!((format!("{:?}", om.format), om.channels.label()), ("TargaSequence".to_string(), "RGB + Alpha"));
+    assert!(a["outputPath"].as_str().unwrap().ends_with("_[#####].tga"), "{a}");
+    // Uncompressed: an 18-byte header and 4 bytes a pixel with alpha, 3 without.
+    assert_eq!(crate::render_queue::bytes_per_frame(om, 7, 4, 10.0), 18.0 + 7.0 * 4.0 * 4.0);
+    s.execute("renderQueue.setOutputModule", json!({"index": 1, "channels": "rgb"})).unwrap();
+    assert_eq!(crate::render_queue::bytes_per_frame(&s.project.render_queue[0].output, 7, 4, 10.0), 18.0 + 7.0 * 4.0 * 3.0);
+    let f = s.execute("renderQueue.formats", json!({})).unwrap();
+    let tga = f["formats"].as_array().unwrap().iter().find(|f| f["id"] == "TargaSequence").cloned();
+    assert_eq!(
+        tga,
+        Some(json!({"id": "TargaSequence", "label": "Targa Sequence", "extension": "tga", "sequence": true, "alpha": true, "audio": false, "available": true}))
+    );
+}
+
 #[test]
 fn failure_toast_names_the_first_reason() {
     struct Failing;
@@ -130,8 +149,8 @@ fn failure_toast_names_the_first_reason() {
     }
     let mut s = demo();
     s.exporter = Some(Arc::new(Failing));
-    s.execute("renderQueue.add", json!({"format": "gif", "output": crate::tests_stubs::tmp_out("rq/first.gif")})).unwrap();
-    s.execute("renderQueue.add", json!({"format": "gif", "output": crate::tests_stubs::tmp_out("rq/second.gif")})).unwrap();
+    s.execute("renderQueue.add", json!({"format": "gif", "output": crate::tests::stubs::tmp_out("rq/first.gif")})).unwrap();
+    s.execute("renderQueue.add", json!({"format": "gif", "output": crate::tests::stubs::tmp_out("rq/second.gif")})).unwrap();
     s.execute("renderQueue.render", json!({})).unwrap();
     let events = s.drain_events();
     let toast = events.iter().find_map(|e| if let Event::Toast { message, error: true } = e { Some(message.as_str()) } else { None });
@@ -186,7 +205,7 @@ fn without_exporter() {
     s.execute("renderQueue.add", json!({})).unwrap();
     assert!(!s.is_enabled("renderQueue.render"));
     let f = s.execute("renderQueue.formats", json!({})).unwrap();
-    assert_eq!(f["formats"].as_array().unwrap().len(), 13);
+    assert_eq!(f["formats"].as_array().unwrap().len(), 14);
     assert_eq!(f["formats"][0]["available"], false);
 }
 
diff --git a/crates/engine/src/scriptui.rs b/crates/engine/src/scriptui.rs
index 6d218a7bb..6d36a2e7e 100644
--- a/crates/engine/src/scriptui.rs
+++ b/crates/engine/src/scriptui.rs
@@ -388,6 +388,18 @@ pub type ScriptUiDispatch = fn(&mut Session, &ScriptUiEvent) -> std::result::Res
 /// and updates [`Session::script_ui`]. Frontends call it every frame (see [`ScriptUi::run_tasks`]).
 pub type ScriptTaskRunner = fn(&mut Session) -> Value;
 
+/// Resume a suspended script once its Render Queue worker has finished. `None` means the
+/// script is still rendering; `Some` is its eventual result (or a real modal-dialog yield).
+pub type ScriptRenderPoll = fn(&mut Session) -> Option<Value>;
+
+pub const RENDER_WAIT_MESSAGE: &str = "A script is rendering. Stop the render or wait for it to finish before editing.";
+
+/// These inspections do not run callbacks or collect unrelated background edits. In
+/// particular, `journal: false` is not a read-only guarantee (`engine.batch`, `jobs.wait`).
+pub fn allowed_during_render(command: &str) -> bool {
+    matches!(command, "renderQueue.stop" | "renderQueue.list" | "editor.state" | "app.capabilities" | "command.list" | "scriptui.list" | "scriptui.get")
+}
+
 /// The open script windows.
 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 #[serde(default)]
@@ -401,13 +413,27 @@ pub struct ScriptUi {
     /// The scripting engine's scheduled-task runner (set with [`Session::script`]).
     #[serde(skip)]
     pub tasks: Option<ScriptTaskRunner>,
+    /// A frontend that services [`Self::poll_render`] may opt a script invocation into yielding
+    /// during a blocking Render Queue call. Headless and lifecycle scripts remain synchronous.
+    #[serde(skip)]
+    pub yield_renders: bool,
+    /// The script host suspended in a Render Queue call. While set, frontends must not allow
+    /// other edits or script callbacks to interleave with its open undo groups.
+    #[serde(skip)]
+    pub render_host: Option<u32>,
+    #[serde(skip)]
+    pub poll_render: Option<ScriptRenderPoll>,
     /// Bumped whenever the project is closed or replaced (New / Open / Close Project): repeating
-    /// tasks of scripts without an open window stop then.
+    /// tasks of scripts without an open window stop then, except those of Startup scripts.
     #[serde(skip)]
     pub project_epoch: u64,
     /// The script contexts of this session with scheduled tasks (kept by the scripting engine).
     #[serde(skip)]
     pub task_hosts: Vec<u32>,
+    /// The script contexts of Startup scripts: their tasks go on when the project is closed or
+    /// replaced, until EffectCraft quits.
+    #[serde(skip)]
+    pub startup_hosts: Vec<u32>,
 }
 
 impl ScriptUi {
@@ -755,6 +781,7 @@ pub(crate) fn mouse(s: &mut Session, p: &Value) -> Result<Value> {
         "screenX": num("screenX", -FAR, FAR, 0.0),
         "screenY": num("screenY", -FAR, FAR, 0.0),
         "button": num("button", 0.0, 2.0, 0.0).round(),
+        "buttons": num("buttons", 0.0, 7.0, 0.0).round(),
         "detail": num("detail", 0.0, 1000.0, clicks).round(),
         "altKey": flag("altKey"),
         "ctrlKey": flag("ctrlKey"),
@@ -764,6 +791,17 @@ pub(crate) fn mouse(s: &mut Session, p: &Value) -> Result<Value> {
     dispatch(s, ScriptUiEvent { window, widget, kind: (*ty).to_string(), value })
 }
 
+/// `scriptui.resize`: the host gave the window a new size (a docked panel's dock, #2585): the
+/// script's window takes it, lays itself out again and gets `onResizing` / `onResize`.
+pub(crate) fn resize(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "scriptui.resize";
+    let window = window_p(s, p, c)?;
+    let size = p.get("size").and_then(Value::as_array).ok_or_else(|| crate::commands::bad(c, "missing `size` [width, height]"))?;
+    let side = |i: usize| size.get(i).and_then(Value::as_f64).filter(|v| v.is_finite()).map(|v| v.round().clamp(1.0, 16384.0));
+    let (Some(w), Some(h)) = (side(0), side(1)) else { return Err(crate::commands::bad(c, "`size` must be [width, height] in pixels")) };
+    dispatch(s, ScriptUiEvent { window, widget: 0, kind: "resize".into(), value: json!([w, h]) })
+}
+
 /// `scriptui.close`: close a window (a dialog's `show()` returns `result`, default 2 = Cancel).
 pub(crate) fn close(s: &mut Session, p: &Value) -> Result<Value> {
     let window = window_p(s, p, "scriptui.close")?;
diff --git a/crates/engine/src/services.rs b/crates/engine/src/services.rs
new file mode 100644
index 000000000..5658df107
--- /dev/null
+++ b/crates/engine/src/services.rs
@@ -0,0 +1,146 @@
+use super::config;
+
+/// Host services (file access) injected by the frontend.
+pub trait Services: Send + Sync {
+    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>>;
+    /// [`Services::read_file`] for a copy that must not load an unbounded file: more than `max`
+    /// bytes is an error. The native one opens the file once, reads its size from that handle and
+    /// reads through a [`std::io::Read::take`] limit, so a file grown or swapped after the check
+    /// still cannot read past `max`.
+    fn read_file_bounded(&self, path: &str, max: u64) -> std::io::Result<Vec<u8>> {
+        let bytes = self.read_file(path)?;
+        if bytes.len() as u64 > max {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{path} is larger than the {max}-byte limit")));
+        }
+        Ok(bytes)
+    }
+    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()>;
+    /// Whether a file exists (the background footage check after open).
+    fn exists(&self, path: &str) -> bool {
+        std::path::Path::new(path).exists()
+    }
+    /// A file's size and modification time (nanoseconds since 1970), to notice that it changed
+    /// on disk (Settings ▸ Import ▸ Reload Footage Changed on Disk); `None` when it can't be read.
+    fn stamp(&self, path: &str) -> Option<(u64, u128)> {
+        let meta = std::fs::metadata(path).ok()?;
+        let modified = meta.modified().ok()?.duration_since(std::time::UNIX_EPOCH).ok()?;
+        Some((meta.len(), modified.as_nanos()))
+    }
+    /// Keep a file the app made for itself (footage extracted from a template): like
+    /// [`Services::write_file`], creating its folder, but never offered as a download (web: it
+    /// goes to browser storage only).
+    fn store_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        if let Some(d) = std::path::Path::new(path).parent().filter(|d| !d.as_os_str().is_empty()) {
+            let _ = std::fs::create_dir_all(d);
+        }
+        self.write_file(path, data)
+    }
+    /// The files in folder `dir` (full paths; no folders, no hidden files), for image-sequence
+    /// detection on import. Empty when it can't be read.
+    fn list_dir(&self, dir: &str) -> Vec<String> {
+        let Ok(rd) = std::fs::read_dir(if dir.is_empty() { "." } else { dir }) else { return vec![] };
+        rd.filter_map(|e| e.ok())
+            .filter(|e| e.file_type().is_ok_and(|t| t.is_file()) && !e.file_name().to_string_lossy().starts_with('.'))
+            .map(|e| e.path().to_string_lossy().to_string())
+            .collect()
+    }
+    /// Whether `path` is a folder (dropped or picked folders import their files).
+    fn is_dir(&self, path: &str) -> bool {
+        std::path::Path::new(path).is_dir()
+    }
+    /// `path` as a list of recent files keeps it (File ▸ Scripts ▸ Recent Script Files): a
+    /// relative path is made absolute against the working directory, so it opens the same file
+    /// after the working directory changes. `None` when the path can't be made absolute (the
+    /// working directory can't be read); the script is then not added to the list.
+    fn full_path(&self, path: &str) -> Option<String> {
+        std::path::absolute(path).ok().map(|p| p.to_string_lossy().into_owned())
+    }
+}
+
+/// Native filesystem.
+pub struct FsServices;
+
+impl Services for FsServices {
+    /// Refuses what isn't a regular file: a project can name `/dev/zero` or a FIFO, and reading
+    /// those never ends (#2134).
+    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+        use std::io::Read;
+        let mut file = std::fs::File::open(path)?;
+        let meta = file.metadata()?;
+        if !meta.is_file() {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, format!("{path} is not a file")));
+        }
+        let mut bytes = Vec::new();
+        // A sparse file can claim far more than memory: an error, not an abort.
+        bytes.try_reserve_exact(usize::try_from(meta.len()).unwrap_or(usize::MAX)).map_err(|e| std::io::Error::new(std::io::ErrorKind::OutOfMemory, e))?;
+        file.read_to_end(&mut bytes)?;
+        Ok(bytes)
+    }
+    fn read_file_bounded(&self, path: &str, max: u64) -> std::io::Result<Vec<u8>> {
+        use std::io::Read;
+        let file = std::fs::File::open(path)?;
+        let meta = file.metadata()?;
+        if !meta.is_file() {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, format!("{path} is not a file")));
+        }
+        if meta.len() > max {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{path} is larger than the {max}-byte limit")));
+        }
+        let mut bytes = Vec::new();
+        bytes.try_reserve_exact(usize::try_from(meta.len()).unwrap_or(usize::MAX)).map_err(|e| std::io::Error::new(std::io::ErrorKind::OutOfMemory, e))?;
+        // The size above came from this handle, and the read is capped too: a file that grows
+        // after the check still cannot read past `max`. Saturating, so `u64::MAX` cannot overflow.
+        file.take(max.saturating_add(1)).read_to_end(&mut bytes)?;
+        if bytes.len() as u64 > max {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{path} is larger than the {max}-byte limit")));
+        }
+        Ok(bytes)
+    }
+    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        config::atomic_write(std::path::Path::new(path), data)
+    }
+}
+
+/// Imports media files into the project (implemented by the media layer).
+pub trait Importer: Send + Sync {
+    /// Probe one file and return footage metadata. Image sequences are the engine's
+    /// ([`sequence`]): it groups numbered stills and probes their first file here.
+    fn probe(&self, path: &str) -> std::result::Result<effectcraft_project::Footage, String>;
+    /// A footage file's bytes are now at `path` (extracted from a template): hosts whose media
+    /// layer reads from memory (the browser) register them; file-based ones need nothing.
+    fn register(&self, _path: &str, _data: &[u8]) {}
+    /// An image sequence's other frames (its first was probed) are footage now: hosts whose
+    /// media layer reads from memory (the browser) register them; file-based ones need nothing.
+    fn add_frames(&self, _paths: &[String]) {}
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{FsServices, Services};
+
+    /// #2134: a project can name a folder, `/dev/zero` or a FIFO; reading those is an error.
+    #[test]
+    fn fs_services_read_only_regular_files() {
+        let dir = std::env::temp_dir();
+        assert!(FsServices.read_file(&dir.to_string_lossy()).is_err());
+        #[cfg(unix)]
+        assert!(FsServices.read_file("/dev/zero").is_err());
+        let f = dir.join(format!("ec-services-read-{}.txt", std::process::id()));
+        std::fs::write(&f, b"data").unwrap();
+        assert_eq!(FsServices.read_file(&f.to_string_lossy()).unwrap(), b"data");
+        let _ = std::fs::remove_file(f);
+    }
+
+    /// The limit is inclusive and cannot overflow: `u64::MAX` reads the file, one byte too many
+    /// is an error, and nothing past it is read.
+    #[test]
+    fn fs_services_bounded_read_stops_at_the_limit() {
+        let f = std::env::temp_dir().join(format!("ec-services-bounded-{}.txt", std::process::id()));
+        std::fs::write(&f, b"data").unwrap();
+        let p = f.to_string_lossy().to_string();
+        assert_eq!(FsServices.read_file_bounded(&p, u64::MAX).unwrap(), b"data");
+        assert_eq!(FsServices.read_file_bounded(&p, 4).unwrap(), b"data");
+        assert!(FsServices.read_file_bounded(&p, 3).is_err());
+        let _ = std::fs::remove_file(f);
+    }
+}
diff --git a/crates/engine/src/session.rs b/crates/engine/src/session.rs
new file mode 100644
index 000000000..18b0ff4cf
--- /dev/null
+++ b/crates/engine/src/session.rs
@@ -0,0 +1,13 @@
+use super::doc_state::{CompSelection, EditorState};
+use super::error::{EngineError, Result};
+use super::event::Event;
+use super::{
+    Arc, Comp, History, Image, ItemId, LayerId, Project, RenderOpts, Renderer, Session, ThumbnailJob, Tick, Value, camera_track, commands, guard, roto, warp,
+};
+
+mod comps;
+mod dispatch;
+mod edit;
+mod render;
+
+pub use edit::upgrade_effects;
diff --git a/crates/engine/src/session/comps.rs b/crates/engine/src/session/comps.rs
new file mode 100644
index 000000000..51d87e018
--- /dev/null
+++ b/crates/engine/src/session/comps.rs
@@ -0,0 +1,302 @@
+use super::{Comp, CompSelection, Event, ItemId, LayerId, Result, Session, Tick, Value, commands};
+
+/// `t` as a current time of `comp`: a frame within its duration.
+fn comp_frame_at(comp: &Comp, t: Tick) -> Tick {
+    comp.frame_rate.snap_nearest(t.min(comp.duration - comp.frame_duration()).max(Tick::ZERO))
+}
+
+impl Session {
+    /// Keep selections valid after the project was replaced by another state (undo, redo, a
+    /// history jump, a rollback): the same layer id can name a different document, so the
+    /// on-canvas editor gets a fresh IME epoch only when its own document changed.
+    ///
+    /// Normally `before` is [`commands::text_edit::active_editor_snapshot`] taken from the
+    /// state this call is about to replace. Atomic batch rollback is the exception: it has
+    /// already restored the pre-batch state and passes the snapshot of the failing intermediate
+    /// state, so a transient restart or component switch inside the batch still rejects reviving
+    /// the old composition. A restored state that still has the same composition, layer and
+    /// editor session and shows byte/style-equivalent text (an opacity or other property undo)
+    /// keeps the editor's owner and selection; a different document, comp, layer or session clamps the
+    /// selection and starts a new epoch. A closed editor stays closed, and a fallback comp's
+    /// matching layer id never inherits the old comp's session. `None` means no editor was open
+    /// when the snapshot was taken; if one is open after the replacement it is treated as an
+    /// unverified document replacement, so it never inherits an old composition.
+    pub fn sanitize_after_replacement(&mut self, before: Option<&commands::text_edit::EditorSnapshot>) {
+        let project = self.project.clone();
+        self.retain_mask_reveals_in(&project);
+        self.sanitize_state();
+        commands::text_edit::after_replacement(self, before);
+    }
+
+    /// Drop reveals for removed masks before the restored allocator can reuse their IDs.
+    pub(crate) fn retain_mask_reveals_in(&mut self, project: &crate::Project) {
+        self.events.retain(|event| {
+            let Event::Frontend { command, params } = event else { return true };
+            if command != "timeline.revealMask" {
+                return true;
+            }
+            let comp = params.get("comp").and_then(Value::as_u64).map(ItemId).and_then(|id| project.comp(id));
+            let layer = params.get("layer").and_then(Value::as_u64).map(LayerId).and_then(|id| comp.and_then(|c| c.layer(id)));
+            let mask = params.get("mask").and_then(Value::as_u64);
+            layer.and_then(|l| l.masks()).is_some_and(|m| m.groups().any(|g| Some(g.uid) == mask))
+        });
+    }
+
+    /// Drop selections that no longer exist. Each comp keeps its own selection (#1001); a layer id
+    /// counts only inside the comp that owns it, so the active comp never sees another comp's layers.
+    /// Validate property UIDs too: undo can remove a control and rewind the allocator, so keeping
+    /// its selection could silently select a different property when the UID is reused. Group
+    /// selections remain valid even though groups are not leaf properties.
+    pub fn sanitize_state(&mut self) {
+        let p = self.project.clone();
+        self.state.open_comps.retain(|c| p.comp(*c).is_some());
+        self.state.comp_selections.retain(|cid, sel| {
+            let Some(c) = p.comp(*cid) else { return false };
+            let ids: Vec<LayerId> = c.layers.iter().map(|l| l.id).collect();
+            sel.layers.retain(|l| ids.contains(l));
+            sel.props.retain(|(lid, uid)| c.layer(*lid).is_some_and(|l| l.props.find(*uid).is_some() || l.props.find_group(*uid).is_some()));
+            sel.keys.retain(|k| c.layer(k.layer).is_some_and(|l| l.props.find(k.prop).is_some()));
+            sel.vertices.retain(|v| ids.contains(&v.layer));
+            !sel.is_empty()
+        });
+        if self.state.active_comp.is_some_and(|c| p.comp(c).is_none()) {
+            self.clear_live_selection();
+            // A matching layer id in the fallback comp is not the document being edited.
+            self.state.text_edit = None;
+            self.state.active_comp = self.state.open_comps.first().copied();
+            if let Some(id) = self.state.active_comp {
+                self.recall_selection(id);
+            }
+        }
+        if let Some(c) = self.state.active_comp.and_then(|cid| p.comp(cid)) {
+            let ids: Vec<LayerId> = c.layers.iter().map(|l| l.id).collect();
+            self.state.selected_layers.retain(|l| ids.contains(l));
+            self.state.selected_props.retain(|(lid, uid)| c.layer(*lid).is_some_and(|l| l.props.find(*uid).is_some() || l.props.find_group(*uid).is_some()));
+            self.state.selected_keys.retain(|k| c.layer(k.layer).is_some_and(|l| l.props.find(k.prop).is_some()));
+            self.state.selected_vertices.retain(|v| ids.contains(&v.layer));
+        }
+        if let Some((l, t)) = self.state.current_track
+            && self.active_comp().and_then(|c| c.layer(l)).and_then(|l| l.tracker(t)).is_none()
+        {
+            self.state.current_track = None;
+        }
+        self.state.project_selection.retain(|i| p.item(*i).is_some());
+        commands::text_edit::sanitize(self);
+    }
+
+    pub fn active_comp(&self) -> Option<&Comp> {
+        self.project.comp(self.state.active_comp?)
+    }
+
+    /// [`Session::active_comp`] as a shared snapshot (an `Arc` clone, not a deep copy).
+    pub fn active_comp_arc(&self) -> Option<std::sync::Arc<Comp>> {
+        self.project.comp_arc(self.state.active_comp?)
+    }
+
+    pub fn active_comp_id(&self) -> Option<ItemId> {
+        self.state.active_comp.filter(|c| self.project.comp(*c).is_some())
+    }
+
+    /// Current time of a comp.
+    pub fn time_of(&self, comp: ItemId) -> Tick {
+        self.state.times.get(&comp).copied().unwrap_or(Tick::ZERO)
+    }
+
+    /// Current time of the active comp.
+    pub fn time(&self) -> Tick {
+        self.state.active_comp.and_then(|c| self.state.times.get(&c).copied()).unwrap_or(Tick::ZERO)
+    }
+
+    /// Move the active comp's current time.
+    ///
+    /// Time is an external boundary for the on-canvas text editor too: an animated Source Text
+    /// can show a different document at another time. The document is snapshotted only while an
+    /// editor is open, so playback with no text editor does no text copying.
+    pub fn set_time(&mut self, t: Tick) {
+        if let Some(c) = self.state.active_comp {
+            let t = self.project.comp(c).map_or(t, |comp| comp_frame_at(comp, t));
+            let edited = commands::text_edit::active_editor_snapshot(self);
+            self.state.times.insert(c, t);
+            if self.prefs.general.sync_time_related_items {
+                // Direct call: this `set_time` owns the editor snapshot for both time changes,
+                // so a synced move does not take a second snapshot or start a second epoch.
+                self.sync_related_times_inner(c, t);
+            }
+            commands::text_edit::after_external_change(self, edited.as_ref());
+        }
+    }
+
+    /// Settings ▸ General ▸ Synchronize Time of All Related Items: moving the current time of
+    /// `comp` moves the current time of the comps nested in it (through their precomp layers'
+    /// timing) and of the comps it is nested in, so every related viewer shows the same moment.
+    pub fn sync_related_times(&mut self, comp: ItemId, t: Tick) {
+        // Moving a related comp can move the active one, so the editor's document is checked
+        // here too; the snapshot is skipped entirely when no text editor is open.
+        let edited = commands::text_edit::active_editor_snapshot(self);
+        self.sync_related_times_inner(comp, t);
+        commands::text_edit::after_external_change(self, edited.as_ref());
+    }
+
+    /// Sets the time of every comp related to `comp` through precomp layers: down into the comps
+    /// it nests (through each layer's timing) and up into the comps nesting it. A seen-set keeps
+    /// cycles and diamonds finite; each found time is clamped to its comp's last frame, snapped to
+    /// the nearest frame and stored in `state.times`. The caller owns the text-editor boundary.
+    fn sync_related_times_inner(&mut self, comp: ItemId, t: Tick) {
+        let mut seen = std::collections::BTreeSet::from([comp]);
+        let mut todo = vec![(comp, t)];
+        let mut found = vec![];
+        while let Some((cid, ct)) = todo.pop() {
+            if cid != comp {
+                found.push((cid, ct));
+            }
+            let Some(c) = self.project.comp(cid) else { continue };
+            // Down: the comps this one nests.
+            for l in &c.layers {
+                if let effectcraft_project::LayerSource::Comp { item } = &l.source
+                    && seen.insert(*item)
+                {
+                    todo.push((*item, l.layer_time(ct)));
+                }
+            }
+            // Up: the comps nesting this one.
+            for iid in self.project.items.keys() {
+                if let Some(pc) = self.project.comp(*iid)
+                    && let Some(l) = pc.layers.iter().find(|l| matches!(&l.source, effectcraft_project::LayerSource::Comp { item } if *item == cid))
+                    && seen.insert(*iid)
+                {
+                    todo.push((*iid, l.comp_time(ct)));
+                }
+            }
+        }
+        for (cid, ct) in found {
+            if let Some(c) = self.project.comp(cid) {
+                let ct = c.frame_rate.snap_nearest(ct.clamp(Tick::ZERO, (c.duration - c.frame_duration()).max(Tick::ZERO)));
+                self.state.times.insert(cid, ct);
+            }
+        }
+    }
+
+    /// Make `id` the active comp, parking the previous comp's selection and restoring this one's.
+    pub fn activate_comp(&mut self, id: ItemId) {
+        if self.project.comp(id).is_none() || self.state.active_comp == Some(id) {
+            return;
+        }
+        self.remember_selection();
+        self.state.active_comp = Some(id);
+        self.recall_selection(id);
+        self.state.current_track = None;
+        // A text-edit session belongs to the comp that owned it. Switching comps ends it; even
+        // a same-numbered layer in the new comp must not inherit the old IME composition.
+        self.state.text_edit = None;
+    }
+
+    /// Leave no comp active, keeping the one that was active in [`EditorState::comp_selections`].
+    pub fn activate_comp_none(&mut self) {
+        self.remember_selection();
+        self.state.active_comp = None;
+        self.clear_live_selection();
+        self.state.current_track = None;
+        self.state.text_edit = None;
+    }
+
+    fn remember_selection(&mut self) {
+        let Some(id) = self.state.active_comp else { return };
+        let sel = CompSelection {
+            layers: self.state.selected_layers.clone(),
+            props: self.state.selected_props.clone(),
+            keys: self.state.selected_keys.clone(),
+            vertices: self.state.selected_vertices.clone(),
+        };
+        if sel.is_empty() {
+            self.state.comp_selections.remove(&id);
+        } else {
+            self.state.comp_selections.insert(id, sel);
+        }
+    }
+
+    fn recall_selection(&mut self, id: ItemId) {
+        match self.state.comp_selections.remove(&id) {
+            Some(sel) => {
+                self.state.selected_layers = sel.layers;
+                self.state.selected_props = sel.props;
+                self.state.selected_keys = sel.keys;
+                self.state.selected_vertices = sel.vertices;
+            }
+            None => self.clear_live_selection(),
+        }
+    }
+
+    fn clear_live_selection(&mut self) {
+        self.state.selected_layers.clear();
+        self.state.selected_props.clear();
+        self.state.selected_keys.clear();
+        self.state.selected_vertices.clear();
+    }
+
+    /// Open a comp in the viewer/timeline and make it active.
+    pub fn open_comp(&mut self, id: ItemId) {
+        if self.project.comp(id).is_none() {
+            return;
+        }
+        if !self.state.open_comps.contains(&id) {
+            self.state.open_comps.push(id);
+        }
+        if self.state.active_comp != Some(id) {
+            let previous = self.state.active_comp;
+            self.state.recent_comps.retain(|c| *c != id && Some(*c) != previous);
+            if let Some(previous) = previous {
+                self.state.recent_comps.insert(0, previous);
+                self.state.recent_comps.truncate(32);
+            }
+        }
+        self.activate_comp(id);
+        self.events.push(Event::OpenComp(id));
+    }
+
+    /// The open compositions and their current times, as a project file records them
+    /// ([`effectcraft_project::SavedView`]).
+    pub fn saved_view(&self) -> effectcraft_project::SavedView {
+        let comp_times = self.state.times.iter().filter(|(id, _)| self.project.comp(**id).is_some()).map(|(id, t)| (*id, *t)).collect();
+        effectcraft_project::SavedView { active_comp: self.state.active_comp, open_comps: self.state.open_comps.clone(), comp_times }
+    }
+
+    /// Reopen the compositions a project file was saved with (#748), each at its saved current
+    /// time (#1714). Ids that no longer name a comp are skipped; with none left the project stays
+    /// on the comp [`Session::replace_project`] opened (its first), as files from before the view
+    /// was saved do.
+    pub fn restore_view(&mut self, view: &effectcraft_project::SavedView) {
+        for (id, t) in &view.comp_times {
+            if let Some(comp) = self.project.comp(*id) {
+                let t = comp_frame_at(comp, *t);
+                self.state.times.insert(*id, t);
+            }
+        }
+        let mut open: Vec<ItemId> = Vec::new();
+        for id in view.open_comps.iter().copied().filter(|id| self.project.comp(*id).is_some()) {
+            if !open.contains(&id) {
+                open.push(id);
+            }
+        }
+        let Some(active) = view.active_comp.filter(|id| self.project.comp(*id).is_some()).or_else(|| open.first().copied()) else { return };
+        self.state.open_comps = open;
+        self.open_comp(active);
+    }
+
+    /// The 3D view camera of a comp's viewer (None = the active camera).
+    pub fn view_camera(&self, comp: ItemId) -> Option<effectcraft_render::three_d::CameraState> {
+        let c = self.project.comp(comp)?;
+        if !c.has_3d() {
+            return None;
+        }
+        self.state.views3d.get(&comp)?.override_camera(c.width as f64, c.height as f64)
+    }
+
+    /// Resolve a comp reference (item id number or name; `None`/null = the active comp).
+    pub fn resolve_comp(&self, comp: Option<&Value>) -> Result<ItemId> {
+        let p = match comp {
+            Some(v) if !v.is_null() => serde_json::json!({ "comp": v }),
+            _ => serde_json::json!({}),
+        };
+        commands::comp_id(self, &p)
+    }
+}
diff --git a/crates/engine/src/session/dispatch.rs b/crates/engine/src/session/dispatch.rs
new file mode 100644
index 000000000..aa83ac09f
--- /dev/null
+++ b/crates/engine/src/session/dispatch.rs
@@ -0,0 +1,76 @@
+use super::{EngineError, Event, Result, Session, Value, commands, guard};
+
+impl Session {
+    pub fn new() -> Session {
+        Session::default()
+    }
+
+    /// Run a command by id.
+    pub fn execute(&mut self, id: &str, params: Value) -> Result<Value> {
+        if self.script_ui.render_host.is_some() && !crate::scriptui::allowed_during_render(id) {
+            return Err(EngineError::Other(crate::scriptui::RENDER_WAIT_MESSAGE.into()));
+        }
+        let spec = commands::find(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
+        if let Err(why) = (spec.enabled)(self) {
+            // Explicit targets (agents, scripts) don't need a UI selection.
+            let explicit = (["layer", "layers", "prop", "keys"].iter().any(|k| params.get(k).is_some()) && commands::has_comp(self).is_ok())
+                || ["item", "items"].iter().any(|k| params.get(k).is_some())
+                // An explicit composition (the enablement looks at the active one).
+                || params.get("comp").is_some_and(|c| !c.is_null() && self.resolve_comp(Some(c)).is_ok());
+            if !explicit {
+                return Err(EngineError::Disabled(id.to_string(), why));
+            }
+        }
+        // Last-resort guard: a panicking command reports an error instead of crashing the app.
+        let r = guard::guarded(&format!("command `{id}`"), || (spec.run)(self, &params))?;
+        self.learn_observe(id, &params);
+        if spec.journal {
+            self.journal.push((id.to_string(), params));
+            if self.journal.len() > 10_000 {
+                self.journal.drain(..1000);
+            }
+        }
+        Ok(r)
+    }
+
+    /// [`Session::execute`] for agents and scripts (MCP, CLI, control channel): unknown top-level
+    /// parameters are rejected with the accepted keys instead of being silently ignored.
+    pub fn execute_checked(&mut self, id: &str, params: Value) -> Result<Value> {
+        let spec = commands::find(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
+        commands::check_params(spec, &params)?;
+        self.execute(id, params)
+    }
+
+    /// [`Session::execute`] for a command a script asked for (the JavaScript engine's
+    /// `app.run`, ScriptUI callbacks…). The command and everything it runs count as the script's:
+    /// it may not change the settings that limit scripts (Settings ▸ Scripting & Expressions ▸
+    /// Application Scripting), which only the user can, from the UI, CLI or control channel.
+    pub fn execute_for_script(&mut self, id: &str, params: Value) -> Result<Value> {
+        self.script_calls.0 = self.script_calls.0.saturating_add(1);
+        let r = self.execute(id, params);
+        self.script_calls.0 = self.script_calls.0.saturating_sub(1);
+        r
+    }
+
+    /// Whether the command running was issued by a script ([`Session::execute_for_script`]).
+    pub fn running_for_script(&self) -> bool {
+        self.script_calls.0 > 0
+    }
+
+    /// Whether `id` names a known command whose `enabled` predicate returns `Ok` for this session;
+    /// an unknown id or a predicate error reads as disabled.
+    pub fn is_enabled(&self, id: &str) -> bool {
+        if self.script_ui.render_host.is_some() && !crate::scriptui::allowed_during_render(id) {
+            return false;
+        }
+        commands::find(id).is_some_and(|c| (c.enabled)(self).is_ok())
+    }
+
+    pub fn toast(&mut self, msg: impl Into<String>) {
+        self.events.push(Event::Toast { message: msg.into(), error: false });
+    }
+
+    pub fn drain_events(&mut self) -> Vec<Event> {
+        std::mem::take(&mut self.events)
+    }
+}
diff --git a/crates/engine/src/session/edit.rs b/crates/engine/src/session/edit.rs
new file mode 100644
index 000000000..c35a5a13b
--- /dev/null
+++ b/crates/engine/src/session/edit.rs
@@ -0,0 +1,294 @@
+use super::{Arc, EditorState, EngineError, Event, History, ItemId, Project, Result, Session, camera_track, commands, roto, warp};
+
+impl Session {
+    /// Apply an undoable edit. `merge`: consecutive edits with the same key fold into one step.
+    ///
+    /// Every edit is an external boundary for the on-canvas text editor: if it replaced the
+    /// document the editor is showing, the selection is clamped and the editor gets a fresh IME
+    /// epoch. The editor's own typing goes through `edit_text_doc`, which owns that
+    /// document and must not treat its own keystrokes as a replacement.
+    pub fn edit<T>(&mut self, label: &str, merge: Option<&str>, f: impl FnOnce(&mut Project, &mut EditorState) -> Result<T>) -> Result<T> {
+        let edited = commands::text_edit::active_editor_snapshot(self);
+        let out = self.edit_inner(label, merge, f)?;
+        commands::text_edit::after_external_change(self, edited.as_ref());
+        Ok(out)
+    }
+
+    /// [`Session::edit`] for the on-canvas editor's own text changes. Its document is the one
+    /// the editor owns, so a change here is typing, not a replacement behind the IME's back.
+    pub(crate) fn edit_text_doc<T>(&mut self, label: &str, merge: Option<&str>, f: impl FnOnce(&mut Project, &mut EditorState) -> Result<T>) -> Result<T> {
+        self.edit_inner(label, merge, f)
+    }
+
+    /// The shared body of [`Session::edit`] and [`Session::edit_text_doc`].
+    ///
+    /// Runs `f` on a clone of the project and editor state, then synchronizes derived data (global
+    /// light and Essential Graphics), queues invalidated Warp Stabilizer/camera-tracker work and
+    /// Roto Brush instances needing re-propagation in the `*_pending` lists. If the clone has the same
+    /// content the project and history are left as they were (only editor-state changes from `f`
+    /// are kept) and no revision is bumped; otherwise the previous project is recorded as an
+    /// undo step under `label`, unless it merges with the current merge key (then the redo branch
+    /// is dropped). An `Err` from `f` propagates with the session unchanged.
+    fn edit_inner<T>(&mut self, label: &str, merge: Option<&str>, f: impl FnOnce(&mut Project, &mut EditorState) -> Result<T>) -> Result<T> {
+        if self.script_ui.render_host.is_some() {
+            return Err(EngineError::Other(crate::scriptui::RENDER_WAIT_MESSAGE.into()));
+        }
+        let before = self.project.clone();
+        let mut p = (*self.project).clone();
+        let mut st = self.state.clone();
+        let r = f(&mut p, &mut st)?;
+        // Layer styles: one Global Light per comp, whichever layer edited it.
+        effectcraft_project::styles::sync_global_light(&before, &mut p);
+        // Essential Properties of precomp layers follow their comps' Essential Graphics.
+        effectcraft_project::essential::sync_project(&before, &mut p);
+        // Warp Stabilizer analyses made from other frames are cleared (and queued again).
+        for w in warp::invalidate(&before, &mut p) {
+            if !self.warp_pending.contains(&w) {
+                self.warp_pending.push(w);
+            }
+        }
+        // So are 3D Camera Tracker tracks (and solves made with other settings).
+        for w in camera_track::invalidate(&before, &mut p) {
+            if !self.camera_pending.contains(&w) {
+                self.camera_pending.push(w);
+            }
+        }
+        // Roto Brush Input Keys follow the frames; edited instances propagate again.
+        for r in roto::sync(&before, &mut p) {
+            if !self.roto_pending.contains(&r) {
+                self.roto_pending.push(r);
+            }
+        }
+        // Nothing changed (a value set to what it already was): no undo step, not modified.
+        if p.same_content(&before) {
+            self.state = st;
+            return Ok(r);
+        }
+        let same = merge.is_some() && merge.map(str::to_string) == self.history.merge_key;
+        if !same {
+            // Undone steps aren't lost: they stay in the History panel as a branch.
+            let levels = self.prefs.general.undo_levels.max(1) as usize;
+            self.history.record(label, before, levels);
+        } else {
+            self.history.abandon_redo(&before);
+        }
+        self.history.merge_key = merge.map(str::to_string);
+        self.project = Arc::new(p);
+        self.state = st;
+        self.bump();
+        Ok(r)
+    }
+
+    /// Note a change to the on-canvas editor's committed text or session.
+    ///
+    /// Frontends compare this with [`commands::text_edit::ime_stamp_revision`]; an unrelated
+    /// project change must not advance it.
+    pub(crate) fn note_text_edit_change(&mut self) {
+        // Checked process-wide allocation: a stamp is never wrapped or reused. On exhaustion
+        // keep the previous value; an unavailable before/after pair then compares equal and
+        // earns no receipt instead of accepting a stale revision.
+        if let Some(revision) = commands::text_edit::next_ime_revision() {
+            self.ime_revision = self.ime_revision.max(revision);
+        }
+    }
+
+    pub fn bump(&mut self) {
+        self.revision += 1;
+        // A Cryptomatte probe is keyed by the revision: an older one never answers again.
+        self.drop_crypto_probe();
+        // Back at the saved state (undo, redo, a history jump or a rolled-back batch).
+        if Arc::ptr_eq(&self.project, &self.saved_project) {
+            self.saved_revision = self.revision;
+        }
+        self.refresh_aux_footage();
+        self.events.push(Event::ProjectChanged { revision: self.revision });
+    }
+
+    /// Set a comp's Resolution. As in After Effects it is saved with the project (which becomes
+    /// modified) but is no undo step, and it changes no pixels: the comp's cached frames stay
+    /// valid ([`effectcraft_project::Comp::same_pixels`]).
+    pub fn set_resolution(&mut self, comp: ItemId, r: effectcraft_project::Resolution) -> Result<()> {
+        if self.script_ui.render_host.is_some() {
+            return Err(EngineError::Other(crate::scriptui::RENDER_WAIT_MESSAGE.into()));
+        }
+        if self.project.comp(comp).ok_or(EngineError::NoComp)?.resolution == r {
+            return Ok(());
+        }
+        Arc::make_mut(&mut self.project).comp_mut(comp).ok_or(EngineError::NoComp)?.resolution = r;
+        self.bump();
+        Ok(())
+    }
+
+    /// Keep what lives outside the undo history (each comp's Resolution) as it is in `from`, the
+    /// project before undo, redo or a history jump restored another state.
+    pub(crate) fn keep_view_settings(&mut self, from: &Project) {
+        let keep: Vec<(ItemId, effectcraft_project::Resolution)> =
+            self.project.comps().filter_map(|(id, c)| from.comp(*id).map(|f| (*id, f.resolution)).filter(|(_, r)| *r != c.resolution)).collect();
+        if keep.is_empty() {
+            return;
+        }
+        let p = Arc::make_mut(&mut self.project);
+        for (id, r) in keep {
+            if let Some(c) = p.comp_mut(id) {
+                c.resolution = r;
+            }
+        }
+    }
+
+    /// Undoes one step: the current project goes onto the redo stack, per-comp Resolution is kept
+    /// as it was, the merge key is cleared, selections are sanitized for the replaced state (the
+    /// on-canvas editor gets a new IME epoch only when its own document changed) and the session is
+    /// bumped. Returns `false`, changing nothing, when there is nothing to undo.
+    pub fn undo(&mut self) -> bool {
+        if self.script_ui.render_host.is_some() {
+            return false;
+        }
+        let Some((label, p)) = self.history.undo.pop() else { return false };
+        let edited = commands::text_edit::active_editor_snapshot(self);
+        let probe = commands::kept_crypto_probe(self);
+        let cur = std::mem::replace(&mut self.project, p);
+        self.keep_view_settings(&cur);
+        self.history.merge_key = None;
+        self.sanitize_after_replacement(edited.as_ref());
+        self.bump();
+        commands::keep_crypto_probe(self, probe, &cur);
+        self.history.redo.push((label, cur));
+        true
+    }
+
+    /// Redoes one step: the current project goes back onto the undo stack, per-comp Resolution is
+    /// kept, the merge key is cleared, selections are sanitized for the replaced state (a changed
+    /// text document starts a new IME epoch) and the session is bumped. Returns `false`, changing
+    /// nothing, when there is nothing to redo.
+    pub fn redo(&mut self) -> bool {
+        if self.script_ui.render_host.is_some() {
+            return false;
+        }
+        let Some((label, p)) = self.history.redo.pop() else { return false };
+        let edited = commands::text_edit::active_editor_snapshot(self);
+        let probe = commands::kept_crypto_probe(self);
+        let cur = std::mem::replace(&mut self.project, p);
+        self.keep_view_settings(&cur);
+        self.history.merge_key = None;
+        self.sanitize_after_replacement(edited.as_ref());
+        self.bump();
+        commands::keep_crypto_probe(self, probe, &cur);
+        self.history.undo.push((label, cur));
+        true
+    }
+
+    pub fn is_dirty(&self) -> bool {
+        self.revision != self.saved_revision
+    }
+
+    /// The project as it is now is the saved one (after opening or saving it).
+    pub fn mark_saved(&mut self) {
+        self.saved_project = self.project.clone();
+        self.saved_revision = self.revision;
+    }
+
+    /// The project has changes its file doesn't (a session restored with unsaved changes): it
+    /// stays modified until it is saved, whatever is undone.
+    pub fn mark_unsaved(&mut self) {
+        self.saved_project = Arc::new(Project::default());
+        self.bump();
+    }
+
+    /// Replace the whole project (open/new), resetting history and state.
+    pub fn replace_project(&mut self, mut p: Project, path: Option<String>) {
+        if self.stop_render()
+            && let Some(mut job) = self.render_job.take()
+        {
+            // Let the worker notice the cancel; its updates refer to the old project.
+            job.wait();
+        }
+        self.render_job = None;
+        self.stored_paths = Default::default();
+        self.stop_track();
+        self.track_job = None;
+        self.stop_mask_track();
+        self.mask_job = None;
+        self.stop_warp();
+        self.warp_job = None;
+        self.warp_pending.clear();
+        self.stop_camera();
+        self.camera_job = None;
+        self.camera_pending.clear();
+        self.stop_roto();
+        self.roto_job = None;
+        self.roto_pending.clear();
+        self.drop_tasks();
+        self.script_ui.project_epoch = self.script_ui.project_epoch.wrapping_add(1);
+        p.fix_next_id();
+        upgrade_effects(&mut p);
+        // The media layer keys decoded frames by path: files of the new project may have changed
+        // since an earlier project decoded them (#1070).
+        for it in p.items.values() {
+            if let effectcraft_project::ItemKind::Footage(f) = &it.kind {
+                self.forget_decoded(f);
+            }
+        }
+        self.layer_cache.clear();
+        self.project = Arc::new(p);
+        // The set of footage effects read the channels of is sent again, even when it is empty.
+        self.aux_footage = None;
+        self.history = History::default();
+        self.state = EditorState { snapping: true, view_layout: 1, ..Default::default() };
+        self.path = path;
+        self.bump();
+        self.mark_saved();
+        let first = self.project.comps().next().map(|(id, _)| *id);
+        if let Some(c) = first {
+            self.open_comp(c);
+        }
+    }
+}
+
+/// Bring effect instances saved by earlier versions up to date with the effect registry
+/// (renamed / regrouped / added parameters, reordered popups; see
+/// [`effectcraft_effects::migrate`]), and a project from before
+/// [`effectcraft_project::SCHEMA_EFFECT_SPACE`] into effect space
+/// ([`effectcraft_effects::migrate::to_effect_space`]). Shape path operations get the
+/// properties added since ([`effectcraft_project::build::upgrade_shape_contents`]). Stamps the
+/// current schema.
+pub fn upgrade_effects(p: &mut Project) {
+    let to_effect_space = p.schema < effectcraft_project::SCHEMA_EFFECT_SPACE;
+    // Effect bounds per layer: (size, top-left in layer coordinates).
+    let mut bounds = std::collections::HashMap::new();
+    for (cid, c) in p.comps() {
+        for l in &c.layers {
+            bounds.insert((*cid, l.id), effectcraft_render::effect_bounds(p, c, l));
+        }
+    }
+    let mut next = p.next_id;
+    for (cid, it) in p.items.iter_mut() {
+        let effectcraft_project::ItemKind::Comp(c) = &mut it.kind else { continue };
+        for l in &mut std::sync::Arc::make_mut(c).layers {
+            let (size, origin) = bounds.get(&(*cid, l.id)).copied().unwrap_or(([100.0, 100.0], [0.0; 2]));
+            // Effect space starts at the bounds' top-left: positions move by minus that corner.
+            // Adjustment layers run their effects on the comp below as it is: nothing moves.
+            let shift = |o: [f64; 2]| [-o[0], -o[1]];
+            let d = if l.switches.adjustment { [0.0; 2] } else { shift(origin) };
+            let clone_d = |src: Option<u64>| match src {
+                Some(id) => bounds.get(&(*cid, effectcraft_project::LayerId(id))).map_or([0.0; 2], |b| shift(b.1)),
+                None => d,
+            };
+            if let Some(contents) = l.props.sub_mut("contents") {
+                effectcraft_project::build::upgrade_shape_contents(&mut effectcraft_project::build::Ids(&mut next), contents);
+            }
+            let Some(fx) = l.props.sub_mut("effects") else { continue };
+            for n in &mut fx.children {
+                let effectcraft_project::Node::Group(g) = n else { continue };
+                let effectcraft_project::GroupKind::Effect { effect } = &g.kind else { continue };
+                if let Some(spec) = effectcraft_effects::find(effect) {
+                    effectcraft_effects::migrate::upgrade_instance(spec, g, &mut effectcraft_project::build::Ids(&mut next), size);
+                    if to_effect_space {
+                        effectcraft_effects::migrate::to_effect_space(spec, g, size, d, &clone_d);
+                    }
+                }
+            }
+        }
+    }
+    p.next_id = next;
+    p.schema = effectcraft_project::SCHEMA_VERSION;
+}
diff --git a/crates/engine/src/session/render.rs b/crates/engine/src/session/render.rs
new file mode 100644
index 000000000..2dd8a3e7f
--- /dev/null
+++ b/crates/engine/src/session/render.rs
@@ -0,0 +1,186 @@
+use super::{EngineError, Image, ItemId, RenderOpts, Renderer, Result, Session, ThumbnailJob, Tick, Value, commands};
+
+impl Session {
+    /// Render a comp frame with the session's footage + expression hosts.
+    pub fn render(&self, comp: ItemId, t: Tick, opts: RenderOpts) -> Image {
+        self.renderer(opts).comp_frame(comp, t)
+    }
+
+    /// The renderer [`Session::render`] uses: the session's footage, expressions, layer cache and
+    /// accelerator, and the render prefs (nested switches, draft shadows) over `opts`.
+    pub fn renderer(&self, opts: RenderOpts) -> Renderer<'_> {
+        let mut r = Renderer::new(&self.project, self.footage.as_ref(), self.render_opts(opts));
+        r.expr = self.expr.as_deref();
+        r.cache = Some(&self.layer_cache);
+        r.accel = self.accel.as_deref();
+        r
+    }
+
+    /// `opts` with the render prefs (nested switches, draft shadows), as [`Session::renderer`].
+    pub fn render_opts(&self, opts: RenderOpts) -> RenderOpts {
+        RenderOpts { nested_switches: self.prefs.general.switches_affect_nested_comps, draft_shadows: self.prefs.three_d.realtime_shadows, ..opts }
+    }
+
+    /// Whether `effect.cryptomatteAt` with params `p` answers from the kept probe (a few array
+    /// reads; `probeOnly` queries answer `pending` until then). Changes nothing: ask it every
+    /// frame, and start [`Session::crypto_probe_job`] only when a build will actually run.
+    pub fn crypto_probe_ready(&self, p: &Value) -> Result<bool> {
+        commands::crypto_probe_ready(self, p)
+    }
+
+    /// For the Cryptomatte eyedropper: `None` when `effect.cryptomatteAt` with params `p` answers
+    /// from the kept probe, else a job that builds that probe (it may render a precomp's ID pass)
+    /// off the UI thread, for the next query to use. Asking for a job supersedes a build in
+    /// flight for another probe (it then stores nothing): ask only to run it.
+    pub fn crypto_probe_job(&self, p: &Value) -> Result<Option<commands::CryptoProbeJob>> {
+        commands::crypto_probe_job(self, p)
+    }
+
+    /// The coverage of Cryptomatte ID `hash` (as `effect.cryptomatteAt` reports it, parsed) over
+    /// the layer of params `p`, at most `max_side` samples on the long side, from the kept probe:
+    /// `None` until [`Session::crypto_probe_job`] has built it.
+    pub fn crypto_coverage(&self, p: &Value, hash: u32, max_side: usize) -> Option<commands::CryptoCoverage> {
+        commands::crypto_coverage(self, p, hash, max_side)
+    }
+
+    /// Let go of the kept Cryptomatte probe (and its aux channels), and cancel a build in
+    /// flight: the eyedropper was disarmed. Edits, footage changes and Open / New do it too.
+    pub fn drop_crypto_probe(&self) {
+        if let Ok(mut slot) = self.crypto_probe.lock() {
+            slot.clear();
+        }
+    }
+
+    /// Whether a Cryptomatte probe is kept, and how many were built so far (for tests).
+    #[doc(hidden)]
+    pub fn crypto_probe_stats(&self) -> (bool, u64) {
+        self.crypto_probe.lock().map_or((false, 0), |s| (s.kept(), s.builds().1))
+    }
+
+    /// How many probe jobs ran so far, built or cancelled before they began (for tests: each
+    /// is a thread in the eyedropper).
+    #[doc(hidden)]
+    pub fn crypto_probe_jobs(&self) -> u64 {
+        self.crypto_probe.lock().map_or(0, |s| s.builds().0)
+    }
+
+    /// Render a comp frame (comp time `t`) as opaque 8-bit RGBA over the comp background, scaled
+    /// so the longest side is at most `max_side` pixels (0 = full size). Returns (width, height, rgba).
+    pub fn render_rgba8(&self, comp: ItemId, t: Tick, max_side: u32) -> Result<(u32, u32, Vec<u8>)> {
+        let c = self.project.comp(comp).ok_or(EngineError::NoComp)?;
+        let long = c.width.max(c.height).max(1) as f64;
+        let scale = if max_side == 0 { 1.0 } else { (max_side as f64 / long).min(1.0) };
+        let img = self.render(comp, t, RenderOpts { scale, backend: effectcraft_render::Backend::Auto, ..Default::default() });
+        Ok((img.width, img.height, img.to_rgba8_over(c.background)))
+    }
+
+    /// A Project panel thumbnail of an item (a comp at `t`, footage at its first frame), longest
+    /// side at most `max_side`, as a job that owns everything it reads: frontends run it off the
+    /// UI thread (a big comp takes far longer than a frame). `None` for items without pixels.
+    pub fn thumbnail_job(&self, item: ItemId, t: Tick, max_side: u32) -> Option<ThumbnailJob> {
+        let it = self.project.item(item)?;
+        let footage = self.footage.clone();
+        match &it.kind {
+            effectcraft_project::ItemKind::Comp(c) => {
+                let (project, expr, cache) = (self.project.clone(), self.expr.clone(), self.layer_cache.clone());
+                let long = c.width.max(c.height).max(1) as f64;
+                let scale = if max_side == 0 { 1.0 } else { (max_side as f64 / long).min(1.0) };
+                let opts = RenderOpts {
+                    scale,
+                    nested_switches: self.prefs.general.switches_affect_nested_comps,
+                    draft_shadows: self.prefs.three_d.realtime_shadows,
+                    ..Default::default()
+                };
+                let bg = c.background;
+                Some(Box::new(move || {
+                    let mut r = Renderer::new(&project, footage.as_ref(), opts);
+                    r.expr = expr.as_deref();
+                    r.cache = Some(&cache);
+                    let img = r.comp_frame(item, t);
+                    Some((img.width, img.height, img.to_rgba8_over(bg)))
+                }))
+            }
+            effectcraft_project::ItemKind::Footage(f) if f.has_video => {
+                let f = f.clone();
+                Some(Box::new(move || {
+                    let img = effectcraft_render::cineon_frame(footage.frame(item, &f, Tick(0))?, &f);
+                    // Point-sample down to at most `max_side` on the long side.
+                    let step = (img.width.max(img.height) as f32 / max_side.max(1) as f32).ceil().max(1.0) as u32;
+                    let (w, h) = (img.width.div_ceil(step), img.height.div_ceil(step));
+                    let full = img.to_rgba8();
+                    let mut px = Vec::with_capacity((w * h * 4) as usize);
+                    for y in 0..h {
+                        for x in 0..w {
+                            let i = (((y * step) * img.width + x * step) * 4) as usize;
+                            px.extend_from_slice(&full[i..i + 4]);
+                        }
+                    }
+                    Some((w, h, px))
+                }))
+            }
+            _ => None,
+        }
+    }
+
+    /// [`Session::render_rgba8`], or with `transparent` the frame's own straight alpha (what a
+    /// render with RGB + Alpha channels writes) instead of compositing over the background.
+    pub fn render_rgba8_alpha(&self, comp: ItemId, t: Tick, max_side: u32, transparent: bool) -> Result<(u32, u32, Vec<u8>)> {
+        if !transparent {
+            return self.render_rgba8(comp, t, max_side);
+        }
+        let c = self.project.comp(comp).ok_or(EngineError::NoComp)?;
+        let long = c.width.max(c.height).max(1) as f64;
+        let scale = if max_side == 0 { 1.0 } else { (max_side as f64 / long).min(1.0) };
+        let img = self.render(comp, t, RenderOpts { scale, backend: effectcraft_render::Backend::Auto, ..Default::default() });
+        Ok((img.width, img.height, img.to_rgba8()))
+    }
+
+    /// Make the media layer and the layer cache let go of what they decoded from `footage`'s
+    /// files (it keys frames by path, so an overwritten file would keep showing its old pixels).
+    pub(crate) fn forget_decoded(&self, footage: &effectcraft_project::Footage) {
+        for p in std::iter::once(&footage.path).chain(&footage.sequence) {
+            self.footage.forget(p);
+        }
+        self.layer_cache.clear();
+        self.drop_crypto_probe();
+    }
+
+    /// Tell the footage source which files effects read the channels of ([`aux_footage`]), so
+    /// it can decode their pictures and channels at once from the first frame (#474). Called with
+    /// every project change ([`Session::bump`]); the set is only sent when it changed, or after
+    /// [`Session::replace_project`] cleared what was sent.
+    pub(crate) fn refresh_aux_footage(&mut self) {
+        let paths = aux_footage(&self.project);
+        if self.aux_footage.as_ref() != Some(&paths) {
+            self.footage.set_aux_footage(&paths);
+            self.aux_footage = Some(paths);
+        }
+    }
+}
+
+/// The files (each footage item's [`effectcraft_project::Footage::path`], sorted, once each) of
+/// the footage layers that have an enabled effect reading their channels
+/// ([`effectcraft_effects::reads_aux`]), with the layer's Effects switch on. Several items can
+/// use one file: it stays in while any of them is read.
+pub(crate) fn aux_footage(project: &effectcraft_project::Project) -> Vec<String> {
+    use effectcraft_project::{GroupKind, ItemKind, LayerSource};
+    let mut paths: Vec<String> = project
+        .comps()
+        .flat_map(|(_, c)| c.layers.iter())
+        .filter(|l| l.switches.effects)
+        .filter(|l| {
+            l.effects()
+                .is_some_and(|fx| fx.groups().any(|g| g.enabled && matches!(&g.kind, GroupKind::Effect { effect } if effectcraft_effects::reads_aux(effect))))
+        })
+        .filter_map(|l| match &l.source {
+            LayerSource::Footage { item } => match &project.item(*item)?.kind {
+                ItemKind::Footage(f) if !f.path.is_empty() => Some(f.path.clone()),
+                _ => None,
+            },
+            _ => None,
+        })
+        .collect();
+    paths.sort_unstable();
+    paths.dedup();
+    paths
+}
diff --git a/crates/engine/src/settings.rs b/crates/engine/src/settings.rs
new file mode 100644
index 000000000..5981d4591
--- /dev/null
+++ b/crates/engine/src/settings.rs
@@ -0,0 +1,5 @@
+pub mod autosave;
+pub mod config;
+pub mod prefs;
+pub(super) mod session_settings;
+pub mod shortcuts;
diff --git a/crates/engine/src/autosave.rs b/crates/engine/src/settings/autosave.rs
similarity index 99%
rename from crates/engine/src/autosave.rs
rename to crates/engine/src/settings/autosave.rs
index 37127ac56..e70e819fd 100644
--- a/crates/engine/src/autosave.rs
+++ b/crates/engine/src/settings/autosave.rs
@@ -143,7 +143,7 @@ pub fn write(prefs: &Prefs, project: Option<&str>, fallback: Option<&Path>, last
     write_in(&StdFiles, prefs, project, fallback, last_slot, json)
 }
 
-/// [`write`] through `fs`.
+/// [`write()`] through `fs`.
 pub fn write_in(
     fs: &dyn FileOps,
     prefs: &Prefs,
diff --git a/crates/engine/src/config.rs b/crates/engine/src/settings/config.rs
similarity index 88%
rename from crates/engine/src/config.rs
rename to crates/engine/src/settings/config.rs
index 00e7377b7..17d7c940a 100644
--- a/crates/engine/src/config.rs
+++ b/crates/engine/src/settings/config.rs
@@ -24,7 +24,9 @@ pub trait ConfigStore: Send + Sync {
         }
         Ok(text)
     }
+    /// Write entry `name`, replacing any earlier text.
     fn write(&self, name: &str, data: &str) -> std::io::Result<()>;
+    /// Remove entry `name`; a missing entry is no error.
     fn remove(&self, name: &str) -> std::io::Result<()>;
     /// Names of the entries directly in `dir` (a `/`-separated name prefix such as `Scripts`),
     /// sorted. Stores that can't list return nothing.
@@ -32,6 +34,11 @@ pub trait ConfigStore: Send + Sync {
         let _ = dir;
         vec![]
     }
+    /// Names of the folders directly in `dir`, sorted, like [`ConfigStore::list`].
+    fn list_dirs(&self, dir: &str) -> Vec<String> {
+        let _ = dir;
+        vec![]
+    }
     /// The folder next to the configuration (default Auto-Save folder for untitled projects),
     /// in the namespace of [`ConfigStore::files`]; `None` when there is none.
     fn dir(&self) -> Option<PathBuf> {
@@ -107,6 +114,15 @@ impl ConfigStore for MemoryConfig {
         let Ok(m) = self.files.lock() else { return vec![] };
         m.keys().filter_map(|k| k.strip_prefix(&pre)).filter(|n| !n.is_empty() && !n.contains('/')).map(str::to_string).collect()
     }
+    /// The first name part of the keys under `dir/`.
+    fn list_dirs(&self, dir: &str) -> Vec<String> {
+        let pre = format!("{}/", dir.trim_end_matches('/'));
+        let Ok(m) = self.files.lock() else { return vec![] };
+        let mut v: Vec<String> = m.keys().filter_map(|k| k.strip_prefix(&pre)?.split_once('/')).map(|(d, _)| d.to_string()).filter(|d| !d.is_empty()).collect();
+        v.sort();
+        v.dedup();
+        v
+    }
 }
 
 /// Files in one directory, written atomically.
@@ -153,6 +169,13 @@ impl ConfigStore for DirConfig {
         v.sort();
         v
     }
+    /// The folders in `dir`, following links like [`ConfigStore::list`] does for files.
+    fn list_dirs(&self, dir: &str) -> Vec<String> {
+        let Ok(rd) = std::fs::read_dir(self.dir.join(dir)) else { return vec![] };
+        let mut v: Vec<String> = rd.flatten().filter(|e| e.path().is_dir()).map(|e| e.file_name().to_string_lossy().to_string()).collect();
+        v.sort();
+        v
+    }
     fn remove(&self, name: &str) -> std::io::Result<()> {
         match std::fs::remove_file(self.dir.join(name)) {
             Err(e) if e.kind() != std::io::ErrorKind::NotFound => Err(e),
diff --git a/crates/engine/src/settings/prefs.rs b/crates/engine/src/settings/prefs.rs
new file mode 100644
index 000000000..94c90c3a3
--- /dev/null
+++ b/crates/engine/src/settings/prefs.rs
@@ -0,0 +1,132 @@
+//! Settings (After Effects' Preferences): a versioned serde model, addressed by dotted keys
+//! (`general.undoLevels`, `autoSave.intervalMinutes`, `labels.3.name`), plus the page schema the
+//! Settings dialog and agents (`prefs.pages`) are built from.
+//!
+//! Settings are stored as JSON (`prefs.json`) through the session's [`crate::config::ConfigStore`].
+//! Loading is forgiving: missing keys take their defaults, unknown keys (written by a newer
+//! version) are kept and written back, and older layouts are migrated ([`migrate`]).
+//!
+//! Every setting in [`pages`] says whether it already changes behaviour (`live`). Settings that
+//! don't yet are still shown (After Effects parity of the dialog) and are listed in
+//! `docs/preferences.md`; a test keeps that list in step with the schema.
+
+use std::collections::BTreeMap;
+
+use effectcraft_color::Label;
+use effectcraft_time::Tick;
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+
+mod choices;
+mod dialog;
+mod document;
+mod queries;
+mod recent;
+mod sections;
+
+pub use choices::{APPEARANCE_MODES, DARK_THEMES, LANGUAGES, LIGHT_THEMES, THEMES, WINDOW_GRAPHICS, theme_family};
+pub use dialog::{Item, Kind, Page, pages, pages_json, todo_keys};
+pub use document::{migrate, page_id, section_key};
+pub use queries::{CacheBudgets, WEB_LAYER_CACHE, WEB_MEDIA_CACHE, mask_color};
+pub use recent::{MAX_RECENT_SCRIPTS, RecentScript};
+pub use sections::{
+    Appearance, Audio, AutoSave, CompPreset, CompositionPrefs, Disk, Export, FacePrefs, General, Grids, Import, LabelPref, Memory, Previews, ProjectPrefs,
+    RotoPrefs, Scripting, Startup, ThreeD, TypePrefs, Video,
+};
+use sections::{Extra, default_labels, lenient_comp_presets};
+
+/// Current settings layout version.
+pub const PREFS_VERSION: u32 = 4;
+/// Settings file name in the config store.
+pub const PREFS_FILE: &str = "prefs.json";
+
+/// All settings.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct Prefs {
+    pub version: u32,
+    pub general: General,
+    pub startup: Startup,
+    pub project: ProjectPrefs,
+    pub auto_save: AutoSave,
+    pub composition: CompositionPrefs,
+    pub previews: Previews,
+    pub appearance: Appearance,
+    pub grids: Grids,
+    /// The 16 labels (Red … Dark Green), in order.
+    pub labels: Vec<LabelPref>,
+    #[serde(rename = "type")]
+    pub type_: TypePrefs,
+    pub import: Import,
+    pub export: Export,
+    pub audio: Audio,
+    pub disk: Disk,
+    pub memory: Memory,
+    pub video: Video,
+    #[serde(rename = "threeD")]
+    pub three_d: ThreeD,
+    pub scripting: Scripting,
+    pub roto: RotoPrefs,
+    pub face: FacePrefs,
+    /// File ▸ Open Recent, newest first.
+    pub recent_projects: Vec<String>,
+    /// File ▸ Import Recent Footage, newest first.
+    pub recent_footage: Vec<String>,
+    /// Animation ▸ Recent Animation Presets (`.ecpreset` paths or built-in preset ids), newest
+    /// first.
+    pub recent_presets: Vec<String>,
+    /// File ▸ Scripts ▸ Recent Script Files, newest first, at most [`MAX_RECENT_SCRIPTS`].
+    pub recent_scripts: Vec<RecentScript>,
+    /// Character panel: recently used font families, newest first.
+    pub recent_fonts: Vec<String>,
+    /// Effects & Presets: the starred effects' ids, in the order starred.
+    pub effects_favorites: Vec<String>,
+    /// Preview panel: every shortcut's options.
+    pub preview: crate::preview::PreviewSettings,
+    /// View ▸ Simulate Output ▸ My Custom RGB.
+    pub custom_rgb: crate::viewer::CustomRgb,
+    /// Composition Settings presets the user saved, in the order saved.
+    #[serde(deserialize_with = "lenient_comp_presets")]
+    pub comp_presets: Vec<CompPreset>,
+    /// Top-level keys this version doesn't know (kept for newer versions).
+    #[serde(flatten)]
+    pub extra: Extra,
+}
+
+impl Default for Prefs {
+    fn default() -> Self {
+        Prefs {
+            version: PREFS_VERSION,
+            general: General::default(),
+            startup: Startup::default(),
+            project: ProjectPrefs::default(),
+            auto_save: AutoSave::default(),
+            composition: CompositionPrefs::default(),
+            previews: Previews::default(),
+            appearance: Appearance::default(),
+            grids: Grids::default(),
+            labels: default_labels(),
+            type_: TypePrefs::default(),
+            import: Import::default(),
+            export: Export::default(),
+            audio: Audio::default(),
+            disk: Disk::default(),
+            memory: Memory::default(),
+            video: Video::default(),
+            three_d: ThreeD::default(),
+            scripting: Scripting::default(),
+            roto: RotoPrefs::default(),
+            face: FacePrefs::default(),
+            recent_projects: vec![],
+            recent_footage: vec![],
+            recent_presets: vec![],
+            recent_scripts: vec![],
+            recent_fonts: vec![],
+            effects_favorites: vec![],
+            preview: crate::preview::PreviewSettings::default(),
+            custom_rgb: crate::viewer::CustomRgb::default(),
+            comp_presets: vec![],
+            extra: Extra::new(),
+        }
+    }
+}
diff --git a/crates/engine/src/settings/prefs/choices.rs b/crates/engine/src/settings/prefs/choices.rs
new file mode 100644
index 000000000..20f7a482e
--- /dev/null
+++ b/crates/engine/src/settings/prefs/choices.rs
@@ -0,0 +1,65 @@
+/// Settings ▸ General ▸ Language: (label, `general.language` value).
+pub const LANGUAGES: &[(&str, &str)] = &[
+    ("Match System", "system"),
+    ("English", "en"),
+    // Alphabetical by the language's own name after English; Cyrillic, Georgian, then CJK names
+    // follow the Latin ones.
+    ("Čeština", "cs"),
+    ("Deutsch", "de"),
+    ("Español", "es"),
+    ("Français", "fr"),
+    ("Polski", "pl"),
+    ("Português (Brasil)", "pt-br"),
+    ("Svenska", "sv"),
+    ("Русский", "ru"),
+    ("Українська", "uk"),
+    ("ქართული", "ka"),
+    ("日本語", "ja"),
+    ("简体中文", "zh-hans"),
+    ("繁體中文", "zh-hant"),
+];
+
+/// Settings ▸ Startup & Repair ▸ Window Graphics: (label, `startup.windowGraphics` value).
+pub const WINDOW_GRAPHICS: &[(&str, &str)] = &[("Automatic", "auto"), ("OpenGL (compatibility)", "gl")];
+
+/// Settings ▸ Appearance ▸ Appearance Mode: (label, `appearance.appearanceMode` value). Auto
+/// follows the operating system's light or dark appearance.
+pub const APPEARANCE_MODES: &[(&str, &str)] = &[("Sync with System", "auto"), ("Dark", "dark"), ("Light", "light")];
+
+/// The dark family of themes: (label, `appearance.darkTheme` value).
+pub const DARK_THEMES: &[(&str, &str)] = &[("Dark", "dark"), ("Darker", "darker")];
+
+/// The light family of themes: (label, `appearance.lightTheme` value).
+pub const LIGHT_THEMES: &[(&str, &str)] = &[("Light", "light")];
+
+/// Every theme (the legacy single-theme `appearance.theme`).
+pub const THEMES: &[(&str, &str)] = &[("Dark", "dark"), ("Darker", "darker"), ("Light", "light")];
+
+/// The settings whose value must be one of their choices.
+pub(super) fn choices(key: &str) -> Option<&'static [(&'static str, &'static str)]> {
+    match key {
+        "general.language" => Some(LANGUAGES),
+        "startup.windowGraphics" => Some(WINDOW_GRAPHICS),
+        "appearance.appearanceMode" => Some(APPEARANCE_MODES),
+        "appearance.darkTheme" => Some(DARK_THEMES),
+        "appearance.lightTheme" => Some(LIGHT_THEMES),
+        "appearance.theme" => Some(THEMES),
+        _ => None,
+    }
+}
+
+pub(super) fn is_choice(choices: &[(&str, &str)], v: &str) -> bool {
+    choices.iter().any(|(_, c)| *c == v)
+}
+
+/// The appearance mode and the per-mode setting a theme belongs to (`darker` → (`dark`,
+/// `darkTheme`)); `None` for an unknown theme.
+pub fn theme_family(theme: &str) -> Option<(&'static str, &'static str)> {
+    if is_choice(DARK_THEMES, theme) {
+        Some(("dark", "darkTheme"))
+    } else if is_choice(LIGHT_THEMES, theme) {
+        Some(("light", "lightTheme"))
+    } else {
+        None
+    }
+}
diff --git a/crates/engine/src/settings/prefs/dialog.rs b/crates/engine/src/settings/prefs/dialog.rs
new file mode 100644
index 000000000..b00a69ed3
--- /dev/null
+++ b/crates/engine/src/settings/prefs/dialog.rs
@@ -0,0 +1,451 @@
+use super::choices::{APPEARANCE_MODES, DARK_THEMES, LANGUAGES, LIGHT_THEMES, WINDOW_GRAPHICS};
+use super::{Value, json};
+
+// ---------------------------------------------------------------- schema (Settings dialog)
+
+/// What a setting row edits.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Kind {
+    Bool,
+    /// Integer with range and unit.
+    Int(i64, i64, &'static str),
+    /// Number with range and unit.
+    Float(f64, f64, &'static str),
+    /// One of (label, value).
+    Choice(&'static [(&'static str, &'static str)]),
+    Text,
+    /// A folder or file path (text + Choose…).
+    Path,
+    /// `#rrggbb`.
+    Color,
+    /// UI brightness slider.
+    Slider(f64, f64),
+}
+
+/// One row of a settings page.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Item {
+    Section(&'static str),
+    Setting {
+        key: &'static str,
+        label: &'static str,
+        kind: Kind,
+        /// Changes behaviour today (false = shown for parity, listed in docs/preferences.md).
+        live: bool,
+    },
+    /// A button running a command (`params` is JSON).
+    Button {
+        label: &'static str,
+        command: &'static str,
+        params: &'static str,
+    },
+    /// The 16 label names and colours.
+    Labels,
+    /// Output device picker (device list from the host).
+    AudioDevices {
+        key: &'static str,
+    },
+    /// Read-only information line.
+    Note(&'static str),
+    /// The browser's storage manager (web app only, `storage.*`): usage and quota, persistent
+    /// storage, Clear buttons. Not shown where there is no browser storage.
+    BrowserStorage,
+    /// A task's trained models (`roto.models`, `face.models`): authors, licence, size, install,
+    /// choose.
+    Models(effectcraft_segment::Task),
+    /// The Plug-in Library (`library.*`): the community catalog's packages, installed ones,
+    /// install / update / remove.
+    PluginLibrary,
+}
+
+/// One page of the Settings dialog.
+#[derive(Clone, Debug)]
+pub struct Page {
+    pub id: &'static str,
+    pub title: &'static str,
+    pub items: Vec<Item>,
+}
+
+const fn s(key: &'static str, label: &'static str, kind: Kind, live: bool) -> Item {
+    Item::Setting { key, label, kind, live }
+}
+
+const B: Kind = Kind::Bool;
+
+const ON_OFF_RES: &[(&str, &str)] = &[("1/2", "1/2"), ("1/4", "1/4"), ("1/8", "1/8")];
+
+const STYLES: &[(&str, &str)] = &[("Lines", "lines"), ("Dashed Lines", "dashed"), ("Dots", "dots")];
+
+/// The Settings pages in After Effects 2026 order.
+pub fn pages() -> Vec<Page> {
+    use Item::*;
+    vec![
+        Page {
+            id: "general",
+            title: "General",
+            items: vec![
+                s("general.language", "Language", Kind::Choice(LANGUAGES), true),
+                s("general.undoLevels", "Levels of Undo", Kind::Int(1, 99, ""), true),
+                s("general.pathPointSize", "Path Point and Handle Size", Kind::Int(3, 20, "px"), true),
+                s("general.recentItems", "Recent Projects Shown", Kind::Int(1, 30, ""), true),
+                Section("Options"),
+                s("general.showToolTips", "Show Tool Tips", B, true),
+                s("general.viewerWheelScrubbing", "Scrub Composition Frames with Mouse Wheel", B, true),
+                s("general.createLayersAtCompStart", "Create Layers at Composition Start Time", B, true),
+                s("general.switchesAffectNestedComps", "Switches Affect Nested Comps", B, true),
+                s("general.defaultSpatialLinear", "Default Spatial Interpolation to Linear", B, true),
+                s("general.preserveConstantVertexCount", "Preserve Constant Vertex and Feather Point Count when Editing Masks", B, true),
+                s("general.syncTimeRelatedItems", "Synchronize Time of All Related Items", B, true),
+                s("general.expressionPickWhipCompact", "Expression Pick Whip Writes Compact English", B, true),
+                s("general.createSplitLayersAbove", "Create Split Layers Above Original Layer", B, true),
+                s("general.useSystemColorPicker", "Use System Color Picker", B, false),
+                Note("EffectCraft always uses its own colour picker (the same on every platform and the web)."),
+            ],
+        },
+        Page {
+            id: "startup",
+            title: "Startup & Repair",
+            items: vec![
+                s("startup.showHomeOnLaunch", "Show Home Screen When Launching", B, true),
+                s("startup.showHomeOnOpenProject", "Show Home Screen When Opening a Project", B, true),
+                s("startup.offerCrashRecovery", "Offer to Open the Latest Auto-Save After a Crash", B, true),
+                s("startup.windowGraphics", "Window Graphics", Kind::Choice(WINDOW_GRAPHICS), true),
+                Note(
+                    "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
+                ),
+                Section("Repair"),
+                Button { label: "Reset Settings", command: "prefs.reset", params: "{}" },
+                Button { label: "Reset Keyboard Shortcuts", command: "shortcuts.reset", params: "{}" },
+                Button { label: "Empty Disk Cache", command: "edit.purge", params: r#"{"what":"disk"}"# },
+            ],
+        },
+        Page {
+            id: "project",
+            title: "Project",
+            items: vec![
+                Section("New Project"),
+                s("project.useTemplate", "New Project Loads Template", B, true),
+                s("project.templatePath", "Template Project", Kind::Path, true),
+                Section("Project Files"),
+                s("project.compactProjectFiles", "Save Compact Project Files", B, true),
+                Note(
+                    "Saves .ecproj files as compact JSON on one line: smaller and faster to save and open, but hard to read or diff in version control. Off, they are indented, one value per line.",
+                ),
+                Section("Auto-Save"),
+                s("autoSave.enabled", "Automatically Save Projects", B, true),
+                s("autoSave.intervalMinutes", "Save Every", Kind::Int(1, 240, "Minutes"), true),
+                s("autoSave.maxVersions", "Maximum Project Versions", Kind::Int(1, 99, ""), true),
+                s("autoSave.location", "Auto-Save Location", Kind::Choice(&[("Next to Project", "nextToProject"), ("Custom Location", "custom")]), true),
+                s("autoSave.folder", "Custom Location", Kind::Path, true),
+                s("autoSave.saveOnRenderStart", "Save When Starting Render Queue", B, true),
+                Button { label: "Save Now", command: "file.autoSave", params: "{}" },
+            ],
+        },
+        Page {
+            id: "composition",
+            title: "Composition",
+            items: vec![
+                Section("Motion Path"),
+                s(
+                    "composition.motionPath",
+                    "Motion Path",
+                    Kind::Choice(&[
+                        ("All Keyframes", "all"),
+                        ("No Motion Path", "none"),
+                        ("No More Than (Seconds)", "seconds"),
+                        ("No More Than (Keyframes)", "keyframes"),
+                    ]),
+                    true,
+                ),
+                s("composition.motionPathSeconds", "Seconds", Kind::Float(0.0, 3600.0, "s"), true),
+                s("composition.motionPathKeyframes", "Keyframes", Kind::Int(1, 10_000, ""), true),
+                Section("Display"),
+                s("composition.showRenderingProgress", "Show Rendering Progress in Info Panel and Flowchart", B, true),
+                s("composition.hardwareAcceleratePanels", "Hardware Accelerate Composition, Layer and Footage Panels", B, false),
+                Note("Panels are always drawn by the GPU (wgpu)."),
+            ],
+        },
+        Page {
+            id: "previews",
+            title: "Previews",
+            items: vec![
+                s("previews.adaptiveResolutionLimit", "Adaptive Resolution Limit", Kind::Choice(ON_OFF_RES), true),
+                s("previews.showInternalWireframes", "Show Internal Wireframes", B, true),
+                s("previews.cacheFramesWhenIdle", "Cache Frames When Idle", B, true),
+                s("previews.fastPreviews", "Fast Previews (Draft 3D, Faster Effects)", B, true),
+                s("previews.zoomQuality", "Viewer Zoom Quality", Kind::Choice(&[("Faster", "faster"), ("More Accurate", "moreAccurate")]), true),
+                s("previews.displayProfile", "Display Color Space", Kind::Choice(&[("sRGB", "srgb"), ("Display P3", "p3")]), true),
+                Button { label: "GPU Information...", command: "app.gpuInfo", params: "{}" },
+            ],
+        },
+        Page {
+            id: "appearance",
+            title: "Appearance",
+            items: vec![
+                s("appearance.appearanceMode", "Appearance Mode", Kind::Choice(APPEARANCE_MODES), true),
+                s("appearance.lightTheme", "Light Theme", Kind::Choice(LIGHT_THEMES), true),
+                s("appearance.darkTheme", "Dark Theme", Kind::Choice(DARK_THEMES), true),
+                s("appearance.brightness", "Brightness", Kind::Slider(-1.0, 1.0), true),
+                s("appearance.uiScale", "UI Scale", Kind::Int(75, 200, "%"), true),
+                Section("Labels and Colors"),
+                s("appearance.useLabelColorForHandles", "Use Label Color for Layer Handles and Paths", B, true),
+                s("appearance.useLabelColorForTabs", "Use Label Color for Related Tabs", B, true),
+                s("appearance.cycleMaskColors", "Cycle Mask Colors", B, true),
+                s("appearance.useGradients", "Use Gradients", B, true),
+                Section("Menu Bar"),
+                s("appearance.inWindowMenuBarMac", "Use In-Window Menu Bar on macOS", B, true),
+            ],
+        },
+        Page {
+            id: "grids",
+            title: "Grids & Guides",
+            items: vec![
+                Section("Grid"),
+                s("grids.gridColor", "Color", Kind::Color, true),
+                s("grids.gridSpacing", "Gridline Every", Kind::Float(1.0, 10_000.0, "px"), true),
+                s("grids.gridSubdivisions", "Subdivisions", Kind::Int(1, 100, ""), true),
+                s("grids.gridStyle", "Style", Kind::Choice(STYLES), true),
+                Section("Proportional Grid"),
+                s("grids.proportionalHorizontal", "Horizontal", Kind::Int(1, 100, ""), true),
+                s("grids.proportionalVertical", "Vertical", Kind::Int(1, 100, ""), true),
+                Section("Guides"),
+                s("grids.guideColor", "Color", Kind::Color, true),
+                s("grids.guideStyle", "Style", Kind::Choice(STYLES), true),
+                Section("Safe Margins"),
+                s("grids.actionSafe", "Action-safe", Kind::Float(0.0, 50.0, "%"), true),
+                s("grids.titleSafe", "Title-safe", Kind::Float(0.0, 50.0, "%"), true),
+            ],
+        },
+        Page { id: "labels", title: "Labels", items: vec![Labels] },
+        Page {
+            id: "type",
+            title: "Type",
+            items: vec![
+                s("type.textEngine", "Text Engine", Kind::Choice(&[("Latin", "latin"), ("South Asian and Middle Eastern", "southAsian")]), true),
+                s("type.fontPreview", "Show Font Preview", B, true),
+                s("type.recentFonts", "Number of Recent Fonts to Display", Kind::Int(0, 30, ""), true),
+                s("type.fontNamesInEnglish", "Show Font Names in English", B, true),
+            ],
+        },
+        Page {
+            id: "import",
+            title: "Import",
+            items: vec![
+                s("import.stillFootage", "Still Footage", Kind::Choice(&[("Length of Composition", "compLength"), ("Duration (Seconds)", "seconds")]), true),
+                s("import.stillSeconds", "Still Duration", Kind::Float(0.04, 86_400.0, "s"), true),
+                s("import.sequenceFps", "Sequence Footage", Kind::Float(1.0, 999.0, "frames per second"), true),
+                s("import.reportMissingFrames", "Report Missing Frames", B, true),
+                s(
+                    "import.autoReloadFootage",
+                    "Automatically Reload Footage",
+                    Kind::Choice(&[("Off", "off"), ("Non-Sequence Footage", "nonSequence"), ("All Footage", "all")]),
+                    true,
+                ),
+                s(
+                    "import.unlabeledAlpha",
+                    "Interpret Unlabeled Alpha As",
+                    Kind::Choice(&[
+                        ("Ask User", "ask"),
+                        ("Guess", "guess"),
+                        ("Ignore", "ignore"),
+                        ("Straight", "straight"),
+                        ("Premultiplied", "premultiplied"),
+                    ]),
+                    true,
+                ),
+                s(
+                    "import.dragImportAs",
+                    "Default Drag Import As",
+                    Kind::Choice(&[("Footage", "footage"), ("Composition", "comp"), ("Composition - Retain Layer Sizes", "compLayerSizes")]),
+                    true,
+                ),
+            ],
+        },
+        Page {
+            id: "export",
+            title: "Export",
+            items: vec![
+                s("export.defaultOutputFolder", "Default Output Folder", Kind::Path, true),
+                s("export.segmentSequences", "Segment Sequences", B, true),
+                s("export.segmentSequenceFiles", "Files per Segment", Kind::Int(1, 100_000, "files"), true),
+                s("export.segmentMovies", "Segment Movie Files", B, true),
+                s("export.segmentMovieMb", "Segment Size", Kind::Int(1, 1_000_000, "MB"), true),
+                s("export.appendBitsToName", "Append Bit Depth to File Name", B, true),
+            ],
+        },
+        Page {
+            id: "audio",
+            title: "Audio",
+            items: vec![
+                Section("Audio Hardware"),
+                AudioDevices { key: "audio.outputDevice" },
+                s("audio.previewSampleRate", "Preview Sample Rate", Kind::Int(8_000, 192_000, "Hz"), true),
+                Section("Audio Output Mapping"),
+                s("audio.outputLeft", "Left", Kind::Int(1, 64, "channel"), true),
+                s("audio.outputRight", "Right", Kind::Int(1, 64, "channel"), true),
+            ],
+        },
+        Page {
+            id: "disk",
+            title: "Disk",
+            items: vec![
+                Section("Disk Cache"),
+                s("disk.diskCacheEnabled", "Enable Disk Cache", B, true),
+                s("disk.diskCacheMaxGb", "Maximum Disk Cache Size", Kind::Int(1, 100_000, "GB"), true),
+                s("disk.diskCacheFolder", "Disk Cache Folder", Kind::Path, true),
+                Button { label: "Empty Disk Cache", command: "edit.purge", params: r#"{"what":"disk"}"# },
+                BrowserStorage,
+                Section("Media Cache"),
+                s("disk.mediaCacheFolder", "Database and Cache Folder", Kind::Path, true),
+                s("disk.conformedMediaFolder", "Conformed Audio Folder", Kind::Path, true),
+            ],
+        },
+        Page {
+            id: "memory",
+            title: "Memory & CPU",
+            items: vec![
+                s("memory.ramReservedGb", "RAM Reserved for Other Applications", Kind::Int(0, 1024, "GB"), true),
+                Section("Cache Budgets"),
+                s("memory.layerCacheMb", "Layer Cache", Kind::Int(64, 1 << 20, "MB"), true),
+                s("memory.mediaCacheMb", "Footage Frame Cache", Kind::Int(64, 1 << 20, "MB"), true),
+                s("memory.previewCacheMb", "Preview (RAM) Cache", Kind::Int(64, 1 << 20, "MB"), true),
+                s("memory.reduceCacheWhenLow", "Reduce Cache Size When System Is Low on Memory", B, true),
+            ],
+        },
+        Page {
+            id: "video",
+            title: "Video",
+            items: vec![
+                s("video.enableOutput", "Enable Video Preview Output", B, true),
+                s("video.device", "Video Device", Kind::Choice(&[("Floating Window", ""), ("Full Screen", "fullscreen")]), true),
+                s("video.outputDuringPlayback", "Video Output During Playback", B, true),
+                s("video.mirrorOnMonitor", "Mirror on Computer Monitor", B, true),
+                s("video.disableWhenBackground", "Disable Video Output When in Background", B, true),
+            ],
+        },
+        Page {
+            id: "3d",
+            title: "3D",
+            items: vec![
+                s("threeD.defaultRenderer", "Default 3D Renderer", Kind::Choice(&[("Classic 3D", "classic"), ("Advanced 3D", "advanced")]), true),
+                s("threeD.showReferenceAxes", "Show 3D Reference Axes", B, true),
+                s("threeD.extendedViewer", "Extended Viewer", B, true),
+                s("threeD.realtimeShadows", "Realtime Shadows in Draft", B, true),
+            ],
+        },
+        Page {
+            id: "scripting",
+            title: "Scripting & Expressions",
+            items: vec![
+                Section("Application Scripting"),
+                s("scripting.allowScriptsWriteFiles", "Allow Scripts to Write Files and Access Network", B, true),
+                s("scripting.warnExecutingFiles", "Warn User When Executing Files", B, true),
+                s("scripting.enableJsDebugger", "Enable JavaScript Debugger", B, false),
+                Section("Expressions Editor"),
+                s("scripting.editorFontSize", "Font Size", Kind::Int(8, 40, "pt"), true),
+                s("scripting.syntaxHighlighting", "Syntax Highlighting", B, true),
+                s("scripting.lineNumbers", "Line Numbers", B, true),
+                s("scripting.autoComplete", "Auto-complete", B, true),
+                s("scripting.bracketMatching", "Bracket Matching", B, true),
+                s("scripting.wordWrap", "Word Wrap", B, true),
+                s("scripting.errorBanner", "Show Expression Error Banner", B, true),
+                Note("Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger."),
+            ],
+        },
+        Page {
+            id: "roto",
+            title: "Roto Brush",
+            items: vec![
+                Section("Segmentation Model"),
+                Note(
+                    "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+                ),
+                Models(effectcraft_segment::Task::Mask),
+            ],
+        },
+        Page {
+            id: "face",
+            title: "Face Tracking",
+            items: vec![
+                Section("Face Model"),
+                Note(
+                    "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+                ),
+                Models(effectcraft_segment::Task::Face),
+            ],
+        },
+        Page {
+            id: "library",
+            title: "Plug-in Library",
+            items: vec![
+                Section("Community Effect Plug-ins"),
+                Note(
+                    "Effect plug-ins published by the community and reviewed into one catalog. They are WebAssembly modules that run in a sandbox (no files, network or clock), downloaded only when you ask and checked against the catalog's SHA-256.",
+                ),
+                PluginLibrary,
+            ],
+        },
+    ]
+}
+
+/// Keys of every setting that doesn't change behaviour yet (the TODO list in
+/// `docs/preferences.md`).
+pub fn todo_keys() -> Vec<&'static str> {
+    pages()
+        .into_iter()
+        .flat_map(|p| p.items)
+        .filter_map(|i| match i {
+            Item::Setting { key, live: false, .. } => Some(key),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The schema as JSON (for `prefs.pages`).
+pub fn pages_json() -> Value {
+    let kind = |k: &Kind| -> Value {
+        match k {
+            Kind::Bool => json!({"type": "bool"}),
+            Kind::Int(a, b, u) => json!({"type": "int", "min": a, "max": b, "unit": u}),
+            Kind::Float(a, b, u) => json!({"type": "number", "min": a, "max": b, "unit": u}),
+            Kind::Choice(o) => json!({"type": "choice", "options": o.iter().map(|(l, v)| json!({"label": l, "value": v})).collect::<Vec<_>>()}),
+            Kind::Text => json!({"type": "text"}),
+            Kind::Path => json!({"type": "path"}),
+            Kind::Color => json!({"type": "color"}),
+            Kind::Slider(a, b) => json!({"type": "slider", "min": a, "max": b}),
+        }
+    };
+    let pages: Vec<Value> = pages()
+        .iter()
+        .map(|p| {
+            let items: Vec<Value> = p
+                .items
+                .iter()
+                .map(|i| match i {
+                    Item::Section(t) => json!({"section": t}),
+                    Item::Setting { key, label, kind: k, live } => {
+                        let mut o = kind(k);
+                        o["key"] = json!(key);
+                        o["label"] = json!(label);
+                        o["live"] = json!(live);
+                        o
+                    }
+                    Item::Button { label, command, params } => {
+                        json!({"button": label, "command": command, "params": serde_json::from_str::<Value>(params).unwrap_or_default()})
+                    }
+                    Item::Labels => json!({"labels": "labels.N.name / labels.N.color (N = 0..15)"}),
+                    Item::AudioDevices { key } => json!({"type": "device", "key": key, "label": "Default Output"}),
+                    Item::Note(t) => json!({"note": t}),
+                    Item::BrowserStorage => json!({"browserStorage": "storage.info / storage.persist / storage.clear (web app)"}),
+                    Item::PluginLibrary => json!({"pluginLibrary": "library.list / library.refresh / library.install / library.update / library.uninstall"}),
+                    Item::Models(task) => {
+                        let p = if *task == effectcraft_segment::Task::Face { "face" } else { "roto" };
+                        json!({"models": format!("{p}.models / {p}.model.select / {p}.model.download / {p}.model.install / {p}.model.remove"), "key": format!("{p}.model")})
+                    }
+                })
+                .collect();
+            json!({"id": p.id, "title": p.title, "items": items})
+        })
+        .collect();
+    json!(pages)
+}
diff --git a/crates/engine/src/settings/prefs/document.rs b/crates/engine/src/settings/prefs/document.rs
new file mode 100644
index 000000000..873e6fe33
--- /dev/null
+++ b/crates/engine/src/settings/prefs/document.rs
@@ -0,0 +1,342 @@
+use super::choices::{APPEARANCE_MODES, DARK_THEMES, LANGUAGES, LIGHT_THEMES, THEMES, WINDOW_GRAPHICS, choices, is_choice, theme_family};
+use super::recent::{MAX_EFFECTS_FAVORITES, MAX_RECENT_SCRIPTS};
+use super::sections::{CompPreset, default_labels, parse_hex};
+use super::{Appearance, General, Map, PREFS_VERSION, Prefs, Startup, Value, json};
+
+/// Bring an older settings document up to [`PREFS_VERSION`].
+///
+/// - version 0/1 (early builds) kept a flat object: `undoLevels`, `autoSaveEnabled`,
+///   `autoSaveMinutes`, `autoSaveVersions`, `labelNames` (array) and `theme` at the top level.
+/// - version 2 defaulted the disk cache to 100 GB, more than most laptops have free; the stored
+///   old default becomes the new one (a size the user chose is kept).
+/// - version 3 and earlier could still hold `createSplitLayersAbove: false`, the default before
+///   #2083 (every save kept it); it becomes After Effects' default, above (#2545).
+pub fn migrate(mut v: Value) -> Value {
+    let Some(obj) = v.as_object_mut() else { return json!({}) };
+    let version = obj.get("version").and_then(Value::as_u64).unwrap_or(0);
+    if version < 2 {
+        let moved = |from: &str, page: &str, key: &str, obj: &mut Map<String, Value>| {
+            if let Some(x) = obj.remove(from) {
+                let p = obj.entry(page.to_string()).or_insert_with(|| json!({}));
+                if let Some(p) = p.as_object_mut() {
+                    p.entry(key.to_string()).or_insert(x);
+                }
+            }
+        };
+        moved("undoLevels", "general", "undoLevels", obj);
+        moved("autoSaveEnabled", "autoSave", "enabled", obj);
+        moved("autoSaveMinutes", "autoSave", "intervalMinutes", obj);
+        moved("autoSaveVersions", "autoSave", "maxVersions", obj);
+        moved("theme", "appearance", "theme", obj);
+        if let Some(Value::Array(names)) = obj.remove("labelNames") {
+            let mut labels = default_labels();
+            for (l, n) in labels.iter_mut().zip(names) {
+                if let Some(n) = n.as_str() {
+                    l.name = n.to_string();
+                }
+            }
+            obj.insert("labels".into(), serde_json::to_value(labels).unwrap_or_default());
+        }
+    }
+    if version < 3
+        && let Some(d) = obj.get_mut("disk").and_then(Value::as_object_mut)
+        && d.get("diskCacheMaxGb").and_then(Value::as_u64) == Some(100)
+    {
+        d.insert("diskCacheMaxGb".into(), json!(20));
+    }
+    if version < 4
+        && let Some(g) = obj.get_mut("general").and_then(Value::as_object_mut)
+        && g.get("createSplitLayersAbove") == Some(&json!(false))
+    {
+        g.insert("createSplitLayersAbove".into(), json!(true));
+    }
+    // Settings saved before appearance modes had one theme: keep showing it, as a fixed Dark or
+    // Light mode, instead of switching established users to Auto.
+    if let Some(a) = obj.get_mut("appearance").and_then(Value::as_object_mut)
+        && !a.contains_key("appearanceMode")
+        && let Some(theme) = a.get("theme").and_then(Value::as_str).map(str::to_string)
+        && let Some((mode, slot)) = theme_family(&theme)
+    {
+        a.insert("appearanceMode".into(), json!(mode));
+        a.insert(slot.into(), json!(theme));
+    }
+    obj.insert("version".into(), json!(PREFS_VERSION));
+    v
+}
+
+impl Prefs {
+    /// Parse a settings document (migrating older layouts; unknown keys are kept, bad values
+    /// fall back to defaults).
+    pub fn from_json(text: &str) -> Prefs {
+        let v: Value = serde_json::from_str(text).unwrap_or_else(|_| json!({}));
+        let v = migrate(v);
+        let mut p: Prefs = match serde_json::from_value(v.clone()) {
+            Ok(p) => p,
+            // One bad value shouldn't lose everything: take each page that parses.
+            Err(_) => {
+                let mut base = serde_json::to_value(Prefs::default()).unwrap_or_default();
+                if let (Some(b), Some(o)) = (base.as_object_mut(), v.as_object()) {
+                    // Only the settings' own pages are tried one by one (each trial parses the
+                    // whole document): any other key is kept as it is, so a document of many
+                    // unknown keys costs one pass, not one parse per key.
+                    let pages: Vec<String> = b.keys().cloned().collect();
+                    for (k, x) in o {
+                        if !pages.contains(k) {
+                            b.insert(k.clone(), x.clone());
+                            continue;
+                        }
+                        let mut trial = b.clone();
+                        trial.insert(k.clone(), x.clone());
+                        if serde_json::from_value::<Prefs>(Value::Object(trial)).is_ok() {
+                            b.insert(k.clone(), x.clone());
+                        }
+                    }
+                }
+                serde_json::from_value(base).unwrap_or_default()
+            }
+        };
+        p.normalize();
+        p
+    }
+
+    pub fn to_json(&self) -> String {
+        serde_json::to_string_pretty(self).unwrap_or_default()
+    }
+
+    /// Clamp values into their valid ranges and fill missing labels.
+    pub fn normalize(&mut self) {
+        self.version = PREFS_VERSION;
+        self.comp_presets.retain(CompPreset::is_valid);
+        let mut seen = std::collections::HashSet::new();
+        self.effects_favorites.retain(|id| !id.is_empty() && seen.insert(id.clone()));
+        self.effects_favorites.truncate(MAX_EFFECTS_FAVORITES);
+        if !is_choice(WINDOW_GRAPHICS, &self.startup.window_graphics) {
+            self.startup.window_graphics = Startup::default().window_graphics;
+        }
+        let g = &mut self.general;
+        if !is_choice(LANGUAGES, &g.language) {
+            g.language = General::default().language;
+        }
+        g.undo_levels = g.undo_levels.clamp(1, 99);
+        g.path_point_size = g.path_point_size.clamp(3, 20);
+        g.recent_items = g.recent_items.clamp(1, 30);
+        let a = &mut self.auto_save;
+        a.interval_minutes = a.interval_minutes.clamp(1, 240);
+        a.max_versions = a.max_versions.clamp(1, 99);
+        let ap = &mut self.appearance;
+        let mut seen = std::collections::BTreeSet::new();
+        ap.favorite_themes.retain(|id| is_choice(THEMES, id) && seen.insert(id.clone()));
+        if !is_choice(APPEARANCE_MODES, &ap.appearance_mode) {
+            ap.appearance_mode = Appearance::default().appearance_mode;
+        }
+        if !is_choice(DARK_THEMES, &ap.dark_theme) {
+            ap.dark_theme = Appearance::default().dark_theme;
+        }
+        if !is_choice(LIGHT_THEMES, &ap.light_theme) {
+            ap.light_theme = Appearance::default().light_theme;
+        }
+        // The legacy single theme mirrors the theme a fixed mode shows (Auto depends on the
+        // system, so it keeps the last one).
+        match ap.appearance_mode.as_str() {
+            "dark" => ap.theme = ap.dark_theme.clone(),
+            "light" => ap.theme = ap.light_theme.clone(),
+            _ if !is_choice(THEMES, &ap.theme) => ap.theme = ap.dark_theme.clone(),
+            _ => {}
+        }
+        self.appearance.brightness = self.appearance.brightness.clamp(-1.0, 1.0);
+        self.appearance.ui_scale = self.appearance.ui_scale.clamp(75, 200);
+        let defaults = default_labels();
+        self.labels.truncate(defaults.len());
+        for d in defaults.iter().skip(self.labels.len()) {
+            self.labels.push(d.clone());
+        }
+        for (l, d) in self.labels.iter_mut().zip(&defaults) {
+            if parse_hex(&l.color).is_none() {
+                l.color = d.color.clone();
+            }
+        }
+        let m = &mut self.memory;
+        m.layer_cache_mb = m.layer_cache_mb.clamp(64, 1 << 20);
+        m.media_cache_mb = m.media_cache_mb.clamp(64, 1 << 20);
+        m.preview_cache_mb = m.preview_cache_mb.clamp(64, 1 << 20);
+        self.grids.grid_spacing = self.grids.grid_spacing.clamp(1.0, 10_000.0);
+        let n = self.general.recent_items as usize;
+        self.recent_projects.truncate(n);
+        self.recent_scripts.truncate(MAX_RECENT_SCRIPTS);
+    }
+
+    /// The value at a dotted key (`general.undoLevels`, `labels.3.color`); `""` = everything.
+    pub fn get(&self, key: &str) -> Option<Value> {
+        let v = serde_json::to_value(self).ok()?;
+        if key.is_empty() {
+            return Some(v);
+        }
+        let ptr = format!("/{}", key.replace('.', "/"));
+        v.pointer(&ptr).cloned()
+    }
+
+    /// Set the value at a dotted key. The key must exist and the value must have its type.
+    pub fn set(&mut self, key: &str, value: Value) -> Result<(), String> {
+        if let Some(c) = choices(key)
+            && !value.as_str().is_some_and(|v| is_choice(c, v))
+        {
+            let all: Vec<&str> = c.iter().map(|(_, v)| *v).collect();
+            return Err(format!("`{key}` expects one of {}", all.join(", ")));
+        }
+        let favorites = if key == "appearance.favoriteThemes" {
+            Some(&value)
+        } else if key == "appearance" {
+            value.get("favoriteThemes")
+        } else {
+            None
+        };
+        if let Some(favorites) = favorites {
+            let values = favorites.as_array().ok_or("favorite themes must be a list")?;
+            let mut seen = std::collections::BTreeSet::new();
+            for value in values {
+                let id = value.as_str().ok_or("favorite theme must be a string")?;
+                if !is_choice(THEMES, id) || !seen.insert(id) {
+                    return Err("unknown or duplicate favorite theme".into());
+                }
+            }
+        }
+        // Older clients set the single theme (by key, or inside the page object): it still picks
+        // a visible theme, fixing the mode to its family.
+        let legacy_theme = key == "appearance.theme" || (key == "appearance" && value.get("theme").is_some() && value.get("appearanceMode").is_none());
+        let mut v = serde_json::to_value(&*self).map_err(|e| e.to_string())?;
+        let ptr = format!("/{}", key.replace('.', "/"));
+        let slot = v.pointer_mut(&ptr).ok_or_else(|| format!("unknown setting `{key}`"))?;
+        let value = coerce(slot, value).ok_or_else(|| format!("`{key}` expects a {}", kind_name(slot)))?;
+        *slot = value;
+        let mut next: Prefs = serde_json::from_value(v).map_err(|e| format!("`{key}`: {e}"))?;
+        let (a, b) = (&self.appearance, &next.appearance);
+        let only_theme_changed = a.theme != b.theme && a.appearance_mode == b.appearance_mode && a.dark_theme == b.dark_theme && a.light_theme == b.light_theme;
+        if legacy_theme || only_theme_changed {
+            next.appearance.select_theme();
+        }
+        next.normalize();
+        *self = next;
+        Ok(())
+    }
+
+    /// Reset one page (`general`, `labels`, `autoSave`…) or everything (`None`). Open Recent and
+    /// the saved composition presets are kept.
+    pub fn reset(&mut self, page: Option<&str>) -> Result<(), String> {
+        let d = Prefs::default();
+        let Some(page) = page else {
+            *self = Prefs {
+                recent_projects: std::mem::take(&mut self.recent_projects),
+                recent_footage: std::mem::take(&mut self.recent_footage),
+                recent_presets: std::mem::take(&mut self.recent_presets),
+                recent_scripts: std::mem::take(&mut self.recent_scripts),
+                recent_fonts: std::mem::take(&mut self.recent_fonts),
+                effects_favorites: std::mem::take(&mut self.effects_favorites),
+                preview: std::mem::take(&mut self.preview),
+                comp_presets: std::mem::take(&mut self.comp_presets),
+                ..d
+            };
+            return Ok(());
+        };
+        let keys: Vec<&str> = match page {
+            "project" => vec!["project", "autoSave"],
+            p => vec![section_key(p).ok_or_else(|| format!("unknown settings page `{p}`"))?],
+        };
+        let dv = serde_json::to_value(&d).map_err(|e| e.to_string())?;
+        for k in keys {
+            if let Some(x) = dv.get(k) {
+                self.set(k, x.clone())?;
+            }
+        }
+        Ok(())
+    }
+}
+
+/// Settings key of a page id (`3d` → `threeD`).
+pub fn section_key(page: &str) -> Option<&'static str> {
+    Some(match page {
+        "general" => "general",
+        "startup" => "startup",
+        "project" => "project",
+        "autoSave" | "autosave" => "autoSave",
+        "composition" | "display" => "composition",
+        "previews" => "previews",
+        "appearance" => "appearance",
+        "grids" => "grids",
+        "labels" => "labels",
+        "type" => "type",
+        "import" => "import",
+        "export" => "export",
+        "audio" => "audio",
+        "disk" => "disk",
+        "memory" => "memory",
+        "video" => "video",
+        "3d" | "threeD" => "threeD",
+        "scripting" => "scripting",
+        "roto" => "roto",
+        "face" => "face",
+        _ => return None,
+    })
+}
+
+/// Settings page id for a page name, including older After Effects page names
+/// (Auto-Save → Project, Media & Disk Cache → Disk, Memory & Performance → Memory & CPU…).
+pub fn page_id(name: &str) -> Option<&'static str> {
+    let n = name.to_ascii_lowercase().replace([' ', '&', '-', '_'], "");
+    let id = match n.as_str() {
+        "general" => "general",
+        "startup" | "startuprepair" => "startup",
+        "project" | "autosave" | "newproject" => "project",
+        "composition" | "display" => "composition",
+        "previews" | "preview" => "previews",
+        "appearance" => "appearance",
+        "grids" | "gridsguides" => "grids",
+        "labels" => "labels",
+        "type" => "type",
+        "import" => "import",
+        "export" | "output" => "export",
+        "audio" | "audiohardware" | "audiooutputmapping" => "audio",
+        "disk" | "mediadiskcache" | "mediacache" => "disk",
+        "memory" | "memorycpu" | "memoryperformance" => "memory",
+        "video" | "videopreview" => "video",
+        "3d" | "threed" => "3d",
+        "scripting" | "scriptingexpressions" => "scripting",
+        "roto" | "rotobrush" | "models" => "roto",
+        "face" | "facetracking" => "face",
+        "library" | "pluginlibrary" | "plugins" | "plugin" => "library",
+        _ => return None,
+    };
+    Some(id)
+}
+
+fn kind_name(v: &Value) -> &'static str {
+    match v {
+        Value::Bool(_) => "boolean",
+        Value::Number(_) => "number",
+        Value::String(_) => "string",
+        Value::Array(_) => "list",
+        Value::Object(_) => "object",
+        Value::Null => "value",
+    }
+}
+
+/// `value` converted to the type of `slot` (numbers from strings, booleans from 0/1…).
+fn coerce(slot: &Value, value: Value) -> Option<Value> {
+    Some(match (slot, value) {
+        (Value::Bool(_), Value::Bool(b)) => json!(b),
+        (Value::Bool(_), Value::Number(n)) => json!(n.as_f64()? != 0.0),
+        (Value::Bool(_), Value::String(s)) => json!(matches!(s.as_str(), "true" | "on" | "1" | "yes")),
+        (Value::Number(cur), v) => {
+            let f = match &v {
+                Value::Number(n) => n.as_f64()?,
+                Value::String(s) => s.trim().parse().ok()?,
+                _ => return None,
+            };
+            if cur.is_u64() || cur.is_i64() { json!(f.round().max(0.0) as u64) } else { json!(f) }
+        }
+        (Value::String(_), Value::String(s)) => json!(s),
+        (Value::String(_), Value::Number(n)) => json!(n.to_string()),
+        (Value::Array(_), v @ Value::Array(_)) => v,
+        (Value::Object(_), v @ Value::Object(_)) => v,
+        _ => return None,
+    })
+}
diff --git a/crates/engine/src/settings/prefs/queries.rs b/crates/engine/src/settings/prefs/queries.rs
new file mode 100644
index 000000000..74be30f8f
--- /dev/null
+++ b/crates/engine/src/settings/prefs/queries.rs
@@ -0,0 +1,208 @@
+use super::sections::parse_hex;
+use super::{Label, Prefs, Serialize, Tick};
+
+impl Prefs {
+    /// Display name of a label (Labels settings).
+    pub fn label_name(&self, l: Label) -> String {
+        match label_index(l) {
+            Some(i) => self.labels.get(i).map(|p| p.name.clone()).unwrap_or_else(|| l.name().to_string()),
+            None => l.name().to_string(),
+        }
+    }
+
+    /// sRGB colour of a label (Labels settings).
+    pub fn label_rgb(&self, l: Label) -> [u8; 3] {
+        label_index(l).and_then(|i| self.labels.get(i)).and_then(|p| parse_hex(&p.color)).unwrap_or(l.rgb())
+    }
+
+    /// A label by its built-in name or its (renamed) display name.
+    pub fn label_from_name(&self, s: &str) -> Option<Label> {
+        Label::from_name(s).or_else(|| Label::ALL.iter().skip(1).copied().find(|l| self.label_name(*l).eq_ignore_ascii_case(s)))
+    }
+
+    /// Layer / media / preview cache budgets in bytes.
+    pub fn layer_cache_bytes(&self) -> usize {
+        (self.memory.layer_cache_mb as usize) << 20
+    }
+
+    pub fn media_cache_bytes(&self) -> usize {
+        (self.memory.media_cache_mb as usize) << 20
+    }
+
+    pub fn preview_cache_bytes(&self) -> usize {
+        (self.memory.preview_cache_mb as usize) << 20
+    }
+
+    /// The adaptive resolution limit as a render-scale floor (1/2 → 0.5).
+    pub fn adaptive_limit(&self) -> f64 {
+        match self.previews.adaptive_resolution_limit.as_str() {
+            "1/2" => 0.5,
+            "1/4" => 0.25,
+            _ => 0.125,
+        }
+    }
+
+    /// The Memory & CPU cache budgets in effect: the configured layer / footage / preview
+    /// budgets, scaled down so together they leave **RAM Reserved for Other Applications** free,
+    /// and halved while the system is low on memory when **Reduce Cache Size When System Is Low
+    /// on Memory** is on. `mem` = the system's memory (`None` = unknown: configured budgets).
+    /// In the browser the layer and footage caches also stay within [`WEB_LAYER_CACHE`] and
+    /// [`WEB_MEDIA_CACHE`].
+    pub fn cache_budgets(&self, mem: Option<crate::sysinfo::SysMemory>) -> CacheBudgets {
+        self.cache_budgets_in(mem, cfg!(target_arch = "wasm32"))
+    }
+
+    /// [`Prefs::cache_budgets`], in the browser's memory (`web`) or not.
+    pub(crate) fn cache_budgets_in(&self, mem: Option<crate::sysinfo::SysMemory>, web: bool) -> CacheBudgets {
+        let (mut l, mut m, mut p) = (self.layer_cache_bytes() as u64, self.media_cache_bytes() as u64, self.preview_cache_bytes() as u64);
+        if web {
+            (l, m) = (l.min(WEB_LAYER_CACHE), m.min(WEB_MEDIA_CACHE));
+        }
+        let floor = 64u64 << 20;
+        let mut capped = false;
+        let mut reduced = false;
+        if let Some(mem) = mem.filter(|m| m.total > 0) {
+            let reserved = (self.memory.ram_reserved_gb as u64) << 30;
+            let cap = mem.total.saturating_sub(reserved).max(3 * floor);
+            let sum = l + m + p;
+            if sum > cap {
+                let k = cap as f64 / sum as f64;
+                (l, m, p) = ((l as f64 * k) as u64, (m as f64 * k) as u64, (p as f64 * k) as u64);
+                capped = true;
+            }
+            if self.memory.reduce_cache_when_low && mem.is_low() {
+                (l, m, p) = (l / 2, m / 2, p / 2);
+                reduced = true;
+            }
+        }
+        CacheBudgets { layer: l.max(floor) as usize, media: m.max(floor) as usize, preview: p.max(floor) as usize, capped, reduced }
+    }
+
+    /// Composition ▸ Motion Path: the layer-time span of a motion path to draw around `now`
+    /// (layer time), for keyframes at `keys` (sorted). `None` = No Motion Path.
+    pub fn motion_path_span(&self, keys: &[Tick], now: Tick) -> Option<(Tick, Tick)> {
+        let (first, last) = (*keys.first()?, *keys.last()?);
+        let c = &self.composition;
+        match c.motion_path.as_str() {
+            "none" => None,
+            "seconds" => {
+                let half = Tick::from_seconds_f64(c.motion_path_seconds.max(0.0) / 2.0);
+                let (a, b) = ((now - half).max(first), (now + half).min(last));
+                (a < b).then_some((a, b))
+            }
+            "keyframes" => {
+                let n = (c.motion_path_keyframes.max(1) as usize).min(keys.len());
+                if n < 2 {
+                    return None;
+                }
+                // The n keyframes centred on the current time.
+                let at = keys.partition_point(|k| *k < now);
+                let start = at.saturating_sub(n / 2).min(keys.len() - n);
+                Some((keys[start], keys[start + n - 1]))
+            }
+            _ => Some((first, last)),
+        }
+    }
+
+    /// Previews ▸ Viewer Zoom Quality: smooth (bilinear) scaling of the viewer image, or nearest
+    /// neighbour ("Faster").
+    pub fn viewer_zoom_smooth(&self) -> bool {
+        self.previews.zoom_quality != "faster"
+    }
+
+    /// Import ▸ Interpret Unlabeled Alpha As, for footage whose file has an alpha channel that
+    /// doesn't state how it is stored. `None` = Ask User (keep straight and open Interpret
+    /// Footage); `guess` takes premultiplied for movies (codecs with alpha are usually written
+    /// premultiplied) and straight for stills.
+    pub fn unlabeled_alpha(&self, movie: bool) -> Option<effectcraft_project::AlphaMode> {
+        use effectcraft_project::AlphaMode::*;
+        Some(match self.import.unlabeled_alpha.as_str() {
+            "ignore" => Ignore,
+            "straight" => Straight,
+            "premultiplied" => Premultiplied,
+            "guess" if movie => Premultiplied,
+            "guess" => Straight,
+            _ => return None,
+        })
+    }
+
+    /// Import ▸ Default Drag Import As, as `file.import`'s `importAs`.
+    pub fn drag_import_as(&self) -> &'static str {
+        match self.import.drag_import_as.as_str() {
+            "comp" => "composition",
+            "compLayerSizes" => "compositionLayerSizes",
+            _ => "footage",
+        }
+    }
+
+    /// Export ▸ Append Bit Depth to File Name: `Comp 1.png` → `Comp 1_16bpc.png` (sequence frame
+    /// runs and folders are kept).
+    pub fn output_name(&self, path: &str, bits: u32) -> String {
+        if !self.export.append_bits_to_name {
+            return path.to_string();
+        }
+        let p = std::path::Path::new(path);
+        let (Some(stem), dir) = (p.file_stem().map(|s| s.to_string_lossy().to_string()), p.parent()) else { return path.to_string() };
+        let tag = format!("_{bits}bpc");
+        if stem.ends_with(&tag) {
+            return path.to_string();
+        }
+        let name = match p.extension() {
+            Some(e) => format!("{stem}{tag}.{}", e.to_string_lossy()),
+            None => format!("{stem}{tag}"),
+        };
+        match dir.filter(|d| !d.as_os_str().is_empty()) {
+            Some(d) => d.join(name).to_string_lossy().to_string(),
+            None => name,
+        }
+    }
+
+    /// Export ▸ Segment Sequences / Segment Movie Files: how many frames go in each segment of an
+    /// output of `frames` frames (`None` = one file / folder). Sequences split every Files per
+    /// Segment frames; movies every Segment Size MB at the output's data rate
+    /// (`bytes_per_frame`, estimated from the format's bitrate).
+    pub fn segment_frames(&self, frames: u64, sequence: bool, bytes_per_frame: f64) -> Option<u64> {
+        let e = &self.export;
+        let per = if sequence {
+            e.segment_sequences.then_some(e.segment_sequence_files.max(1) as u64)?
+        } else {
+            if !e.segment_movies || bytes_per_frame <= 0.0 {
+                return None;
+            }
+            (((e.segment_movie_mb.max(1) as f64) * 1_048_576.0 / bytes_per_frame).floor() as u64).max(1)
+        };
+        (per < frames).then_some(per)
+    }
+}
+
+/// The most the layer cache holds in the browser. A wasm32 page addresses at most 4 GiB, which
+/// these caches share with the app and with the decoders' own decoded frames (FilmCraft keeps
+/// up to 384 MB per open movie): with the desktop's 1 GB defaults, eight stacked 1080p clips ran
+/// the page out of memory a few seconds into playback.
+pub const WEB_LAYER_CACHE: u64 = 512 << 20;
+
+/// The most the footage frame cache holds in the browser (see [`WEB_LAYER_CACHE`]).
+pub const WEB_MEDIA_CACHE: u64 = 256 << 20;
+
+/// Effective cache budgets in bytes (see [`Prefs::cache_budgets`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]
+pub struct CacheBudgets {
+    pub layer: usize,
+    pub media: usize,
+    pub preview: usize,
+    /// Scaled down to leave the reserved RAM free.
+    pub capped: bool,
+    /// Halved because the system is low on memory.
+    pub reduced: bool,
+}
+
+/// Colour of the `k`-th mask of a layer: Appearance ▸ Cycle Mask Colors cycles through the mask
+/// colours, otherwise every new mask takes the first one.
+pub fn mask_color(cycle: bool, k: usize) -> [u8; 3] {
+    use effectcraft_project::build::MASK_COLORS;
+    if cycle { MASK_COLORS[k % MASK_COLORS.len()] } else { MASK_COLORS[0] }
+}
+
+fn label_index(l: Label) -> Option<usize> {
+    Label::ALL.iter().position(|x| *x == l).and_then(|i| i.checked_sub(1))
+}
diff --git a/crates/engine/src/settings/prefs/recent.rs b/crates/engine/src/settings/prefs/recent.rs
new file mode 100644
index 000000000..2b12499f4
--- /dev/null
+++ b/crates/engine/src/settings/prefs/recent.rs
@@ -0,0 +1,87 @@
+use serde::{Deserialize, Serialize};
+
+use super::Prefs;
+
+impl Prefs {
+    /// Remember a project in File ▸ Open Recent.
+    pub fn push_recent(&mut self, path: &str) {
+        self.recent_projects.retain(|p| p != path);
+        self.recent_projects.insert(0, path.to_string());
+        self.recent_projects.truncate(self.general.recent_items as usize);
+    }
+
+    /// Remember a font in the Character panel's recent fonts (Type ▸ Number of Recent Fonts).
+    pub fn push_recent_font(&mut self, family: &str) {
+        push_mru(&mut self.recent_fonts, family, 30);
+    }
+
+    /// Is effect `id` starred in Effects & Presets?
+    pub fn is_effect_favorite(&self, id: &str) -> bool {
+        self.effects_favorites.iter().any(|f| f == id)
+    }
+
+    /// Star effect `id` in Effects & Presets, or un-star it; true when it is starred now.
+    pub fn toggle_effect_favorite(&mut self, id: &str) -> bool {
+        if self.is_effect_favorite(id) {
+            self.effects_favorites.retain(|f| f != id);
+            false
+        } else {
+            self.effects_favorites.push(id.to_string());
+            self.effects_favorites.truncate(MAX_EFFECTS_FAVORITES);
+            self.is_effect_favorite(id)
+        }
+    }
+
+    /// The recent fonts the Character panel shows (at most Number of Recent Fonts to Display).
+    pub fn recent_fonts_shown(&self) -> &[String] {
+        let n = (self.type_.recent_fonts as usize).min(self.recent_fonts.len());
+        &self.recent_fonts[..n]
+    }
+
+    /// Remember imported footage for File ▸ Import Recent Footage.
+    pub fn push_recent_footage(&mut self, path: &str) {
+        push_mru(&mut self.recent_footage, path, self.general.recent_items as usize);
+    }
+
+    /// Remember an applied animation preset for Animation ▸ Recent Animation Presets.
+    pub fn push_recent_preset(&mut self, path: &str) {
+        push_mru(&mut self.recent_presets, path, self.general.recent_items as usize);
+    }
+
+    /// Remember a script that ran for File ▸ Scripts ▸ Recent Script Files.
+    pub fn push_recent_script(&mut self, script: RecentScript) {
+        self.recent_scripts.retain(|x| *x != script);
+        self.recent_scripts.insert(0, script);
+        self.recent_scripts.truncate(MAX_RECENT_SCRIPTS);
+    }
+}
+
+/// Most scripts File ▸ Scripts ▸ Recent Script Files lists.
+pub const MAX_RECENT_SCRIPTS: usize = 10;
+
+/// A File ▸ Scripts ▸ Recent Script Files entry, stored as the `file.runScript` parameter that
+/// ran it: `{"path": …}` for a script file, `{"name": …}` for an installed or bundled script.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum RecentScript {
+    Path(String),
+    Name(String),
+}
+
+impl RecentScript {
+    /// The file's path or the script's name.
+    pub fn text(&self) -> &str {
+        match self {
+            RecentScript::Path(s) | RecentScript::Name(s) => s,
+        }
+    }
+}
+
+/// Most effects Effects & Presets keeps starred (a hand-edited settings file can hold more).
+pub(super) const MAX_EFFECTS_FAVORITES: usize = 1000;
+
+fn push_mru(list: &mut Vec<String>, v: &str, max: usize) {
+    list.retain(|x| x != v);
+    list.insert(0, v.to_string());
+    list.truncate(max.max(1));
+}
diff --git a/crates/engine/src/settings/prefs/sections.rs b/crates/engine/src/settings/prefs/sections.rs
new file mode 100644
index 000000000..ac2fab1cc
--- /dev/null
+++ b/crates/engine/src/settings/prefs/sections.rs
@@ -0,0 +1,359 @@
+use super::choices::theme_family;
+use super::{BTreeMap, Deserialize, Label, Serialize, Value};
+
+/// Unknown keys inside a page, kept so a newer version's settings survive a round trip.
+pub(super) type Extra = BTreeMap<String, Value>;
+
+macro_rules! page {
+    ($(#[$m:meta])* $name:ident { $($(#[$fm:meta])* $f:ident : $t:ty = $d:expr),* $(,)? }) => {
+        $(#[$m])*
+        #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+        #[serde(default, rename_all = "camelCase")]
+        pub struct $name {
+            $($(#[$fm])* pub $f: $t,)*
+            #[serde(flatten)]
+            pub extra: Extra,
+        }
+        impl Default for $name {
+            fn default() -> Self {
+                $name { $($f: $d,)* extra: Extra::new() }
+            }
+        }
+    };
+}
+
+page!(General {
+    /// Interface language: `system` (the operating system's, where EffectCraft has it, else
+    /// English), or a language code from `LANGUAGES`.
+    language: String = "system".into(),
+    /// Levels of Undo (1–99).
+    undo_levels: u32 = 32,
+    /// Path Point and Handle Size (px).
+    path_point_size: u32 = 5,
+    show_tool_tips: bool = true,
+    /// Step frames with an unmodified mouse wheel over the Composition viewer.
+    /// Off: the wheel zooms, which is what current After Effects does.
+    viewer_wheel_scrubbing: bool = false,
+    /// Create New Layers at Composition Start Time (off: at the current time).
+    create_layers_at_comp_start: bool = true,
+    switches_affect_nested_comps: bool = true,
+    /// Default Spatial Interpolation to Linear.
+    default_spatial_linear: bool = false,
+    preserve_constant_vertex_count: bool = true,
+    /// Synchronize Time of All Related Items.
+    sync_time_related_items: bool = true,
+    expression_pick_whip_compact: bool = true,
+    /// Create Split Layers Above Original Layer (After Effects' default).
+    create_split_layers_above: bool = true,
+    use_system_color_picker: bool = false,
+    /// Number of projects in File ▸ Open Recent.
+    recent_items: u32 = 10,
+});
+
+page!(Startup {
+    show_home_on_launch: bool = true,
+    show_home_on_open_project: bool = false,
+    /// After a crash, offer to open the most recent auto-save.
+    offer_crash_recovery: bool = true,
+    /// What the desktop window draws with, from the next launch: `auto` (the platform's best
+    /// graphics API) or `gl` (OpenGL, for drivers that crash with the others). A launch that
+    /// stops as its window opens switches it to `gl` (#243).
+    window_graphics: String = "auto".into(),
+});
+
+page!(ProjectPrefs {
+    /// Open a template project for File ▸ New ▸ New Project.
+    use_template: bool = false,
+    template_path: String = String::new(),
+    /// Write `.ecproj` files as compact JSON on one line (smaller, faster to save and open). Off:
+    /// indented, one value per line, so they read and diff cleanly in version control.
+    compact_project_files: bool = false,
+});
+
+page!(AutoSave {
+    enabled: bool = true,
+    interval_minutes: u32 = 20,
+    max_versions: u32 = 5,
+    /// `nextToProject` (an "EffectCraft Auto-Save" folder beside the project) or `custom`.
+    location: String = "nextToProject".into(),
+    folder: String = String::new(),
+    save_on_render_start: bool = false,
+});
+
+page!(CompositionPrefs {
+    /// Motion path: `all`, `none`, `seconds`, `keyframes`.
+    motion_path: String = "keyframes".into(),
+    motion_path_seconds: f64 = 15.0,
+    motion_path_keyframes: u32 = 15,
+    show_rendering_progress: bool = true,
+    hardware_accelerate_panels: bool = true,
+});
+
+page!(Previews {
+    /// Largest downsampling while playing back: `1/2`, `1/4`, `1/8`.
+    adaptive_resolution_limit: String = "1/8".into(),
+    show_internal_wireframes: bool = false,
+    cache_frames_when_idle: bool = false,
+    fast_previews: bool = false,
+    /// `faster` or `moreAccurate`.
+    zoom_quality: String = "moreAccurate".into(),
+    show_gpu_info: bool = false,
+    /// The monitor's colour space for View ▸ Use Display Color Management: `srgb` or `p3`.
+    display_profile: String = "srgb".into(),
+});
+
+page!(Appearance {
+    /// The single theme before appearance modes (`dark`, `darker` or `light`), kept for older
+    /// settings files and automation: setting it picks its family's mode and theme. While the mode
+    /// is Dark or Light it mirrors the theme in use.
+    theme: String = "dark".into(),
+    /// `auto` (follow the operating system), `dark` or `light`. New installs stay Dark.
+    appearance_mode: String = "dark".into(),
+    /// The theme used in dark appearance: `dark` or `darker`.
+    dark_theme: String = "dark".into(),
+    /// The theme used in light appearance: `light`.
+    light_theme: String = "light".into(),
+    /// Theme shortcuts in the appearance context menu.
+    favorite_themes: Vec<String> = Vec::new(),
+    /// User interface brightness, -1 (darker) … 1 (lighter).
+    brightness: f64 = 0.0,
+    /// The size of the whole interface in percent (75–200), on top of the display's own scale.
+    ui_scale: u32 = 100,
+    use_label_color_for_handles: bool = true,
+    use_label_color_for_tabs: bool = true,
+    cycle_mask_colors: bool = true,
+    use_gradients: bool = true,
+    /// macOS: draw the menu bar inside the window instead of the system menu bar.
+    in_window_menu_bar_mac: bool = false,
+});
+
+page!(Grids {
+    grid_color: String = "#7a9cff".into(),
+    grid_spacing: f64 = 100.0,
+    grid_subdivisions: u32 = 4,
+    /// `lines`, `dashed` or `dots`.
+    grid_style: String = "lines".into(),
+    proportional_horizontal: u32 = 4,
+    proportional_vertical: u32 = 4,
+    guide_color: String = "#3cc8f0".into(),
+    guide_style: String = "lines".into(),
+    action_safe: f64 = 10.0,
+    title_safe: f64 = 20.0,
+});
+
+page!(TypePrefs {
+    /// `latin` or `southAsian` (South Asian and Middle Eastern).
+    text_engine: String = "latin".into(),
+    font_preview: bool = true,
+    recent_fonts: u32 = 10,
+    font_names_in_english: bool = false,
+});
+
+page!(Import {
+    /// Still footage duration: `compLength` or `seconds`.
+    still_footage: String = "compLength".into(),
+    still_seconds: f64 = 5.0,
+    sequence_fps: f64 = 30.0,
+    report_missing_frames: bool = true,
+    /// Automatically Reload Footage whose file another app changed (size or modification time),
+    /// checked every two seconds while the window is in front, every ten seconds while it is
+    /// not, and when it comes back to the front: `off`,
+    /// `nonSequence` (the default, as in After Effects: image sequences are left alone) or `all`.
+    auto_reload_footage: String = "nonSequence".into(),
+    /// Interpret unlabeled alpha as: `ask`, `guess`, `ignore`, `straight`, `premultiplied`.
+    unlabeled_alpha: String = "ask".into(),
+    /// Default drag import as: `footage`, `comp`, `compLayerSizes`.
+    drag_import_as: String = "footage".into(),
+});
+
+page!(Export {
+    default_output_folder: String = String::new(),
+    segment_sequences: bool = false,
+    segment_sequence_files: u32 = 700,
+    segment_movies: bool = false,
+    segment_movie_mb: u32 = 1024,
+    append_bits_to_name: bool = false,
+});
+
+page!(Audio {
+    /// Output device name (empty = the system default).
+    output_device: String = String::new(),
+    /// Output mapping: device channel for the left / right output (1-based).
+    output_left: u32 = 1,
+    output_right: u32 = 2,
+    preview_sample_rate: u32 = 48_000,
+});
+
+page!(Disk {
+    disk_cache_enabled: bool = true,
+    disk_cache_max_gb: u32 = 20,
+    disk_cache_folder: String = String::new(),
+    media_cache_folder: String = String::new(),
+    conformed_media_folder: String = String::new(),
+});
+
+page!(Memory {
+    ram_reserved_gb: u32 = 6,
+    /// Processed-layer cache budget (MB).
+    layer_cache_mb: u32 = 1024,
+    /// Decoded footage frame cache budget (MB).
+    media_cache_mb: u32 = 1024,
+    /// RAM preview (viewer frame) cache budget (MB).
+    preview_cache_mb: u32 = 3072,
+    reduce_cache_when_low: bool = true,
+});
+
+page!(Video {
+    enable_output: bool = false,
+    device: String = String::new(),
+    output_during_playback: bool = true,
+    mirror_on_monitor: bool = true,
+    disable_when_background: bool = false,
+});
+
+page!(ThreeD {
+    /// Default 3D renderer for new compositions: `classic` or `advanced`.
+    default_renderer: String = "classic".into(),
+    show_reference_axes: bool = true,
+    extended_viewer: bool = false,
+    realtime_shadows: bool = true,
+});
+
+page!(
+    /// Settings ▸ Roto Brush.
+    RotoPrefs {
+        /// The segmentation model Roto Brush 2.0 / 3.0 use: `classical` (built in) or a model id
+        /// from `effectcraft_segment::MODELS` (once installed).
+        model: String = "classical".into(),
+    }
+);
+
+page!(
+    /// Settings ▸ Face Tracking.
+    FacePrefs {
+        /// The model Track Mask ▸ Face Tracking uses: `classical` (built in) or a model id from
+        /// `effectcraft_segment::MODELS` (once installed).
+        model: String = "classical".into(),
+    }
+);
+
+page!(Scripting {
+    allow_scripts_write_files: bool = false,
+    warn_executing_files: bool = true,
+    enable_js_debugger: bool = false,
+    editor_font_size: u32 = 13,
+    syntax_highlighting: bool = true,
+    line_numbers: bool = true,
+    auto_complete: bool = true,
+    bracket_matching: bool = true,
+    word_wrap: bool = false,
+    error_banner: bool = true,
+});
+
+impl Scripting {
+    /// Whether `other` grants scripts the same as this: Application Scripting (file and network
+    /// access, the warning before executing files, the debugger). Scripts can't change these
+    /// ([`crate::Session::execute_for_script`]): a script could otherwise give itself the
+    /// access the user withheld.
+    pub fn same_permissions(&self, other: &Scripting) -> bool {
+        self.allow_scripts_write_files == other.allow_scripts_write_files
+            && self.warn_executing_files == other.warn_executing_files
+            && self.enable_js_debugger == other.enable_js_debugger
+    }
+
+    /// Take `from`'s Application Scripting settings (see [`Scripting::same_permissions`]).
+    pub fn keep_permissions(&mut self, from: &Scripting) {
+        self.allow_scripts_write_files = from.allow_scripts_write_files;
+        self.warn_executing_files = from.warn_executing_files;
+        self.enable_js_debugger = from.enable_js_debugger;
+    }
+}
+
+/// One editable label: name and `#rrggbb` colour.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct LabelPref {
+    pub name: String,
+    pub color: String,
+}
+
+/// A Composition Settings preset the user saved (Composition Settings ▸ Preset ▸ Save): the
+/// frame size, pixel aspect and frame rate, as in After Effects' own presets.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CompPreset {
+    pub name: String,
+    pub width: u32,
+    pub height: u32,
+    pub pixel_aspect: f64,
+    pub frame_rate: f64,
+}
+
+impl CompPreset {
+    /// Longest preset name kept.
+    pub const MAX_NAME: usize = 128;
+
+    /// Values a composition accepts (a hand-edited settings file can hold anything).
+    pub fn is_valid(&self) -> bool {
+        let size = 4..=30000;
+        !self.name.trim().is_empty()
+            && self.name.chars().count() <= Self::MAX_NAME
+            && size.contains(&self.width)
+            && size.contains(&self.height)
+            && self.pixel_aspect.is_finite()
+            && (0.01..=100.0).contains(&self.pixel_aspect)
+            && self.frame_rate.is_finite()
+            && (1.0..=999.0).contains(&self.frame_rate)
+    }
+}
+
+/// Saved composition presets, skipping entries that don't parse instead of losing the list.
+pub(super) fn lenient_comp_presets<'de, D: serde::Deserializer<'de>>(d: D) -> Result<Vec<CompPreset>, D::Error> {
+    let v = Vec::<Value>::deserialize(d)?;
+    Ok(v.into_iter().filter_map(|x| serde_json::from_value(x).ok()).collect())
+}
+
+pub(super) fn default_labels() -> Vec<LabelPref> {
+    Label::ALL.iter().skip(1).map(|l| LabelPref { name: l.name().to_string(), color: hex(l.rgb()) }).collect()
+}
+
+fn hex([r, g, b]: [u8; 3]) -> String {
+    format!("#{r:02x}{g:02x}{b:02x}")
+}
+
+pub(super) fn parse_hex(s: &str) -> Option<[u8; 3]> {
+    let h = s.trim().trim_start_matches('#');
+    if h.len() != 6 {
+        return None;
+    }
+    let p = |i: usize| u8::from_str_radix(h.get(i..i + 2)?, 16).ok();
+    Some([p(0)?, p(2)?, p(4)?])
+}
+
+impl Appearance {
+    /// Show the legacy single `theme`: fix the mode to its family and remember it as that
+    /// family's theme. An unknown theme changes nothing.
+    pub fn select_theme(&mut self) {
+        match theme_family(&self.theme) {
+            Some((mode, "darkTheme")) => {
+                self.appearance_mode = mode.into();
+                self.dark_theme = self.theme.clone();
+            }
+            Some((mode, _)) => {
+                self.appearance_mode = mode.into();
+                self.light_theme = self.theme.clone();
+            }
+            None => {}
+        }
+    }
+
+    /// The theme to show: the light or dark family's choice by the mode; Auto follows `system_light`
+    /// (`None` = the system said nothing: dark).
+    pub fn resolved_theme(&self, system_light: Option<bool>) -> &str {
+        let light = match self.appearance_mode.as_str() {
+            "light" => true,
+            "auto" => system_light == Some(true),
+            _ => false,
+        };
+        if light { &self.light_theme } else { &self.dark_theme }
+    }
+}
diff --git a/crates/engine/src/session_settings.rs b/crates/engine/src/settings/session_settings.rs
similarity index 84%
rename from crates/engine/src/session_settings.rs
rename to crates/engine/src/settings/session_settings.rs
index ef3e748a6..8ade9f8a3 100644
--- a/crates/engine/src/session_settings.rs
+++ b/crates/engine/src/settings/session_settings.rs
@@ -82,7 +82,9 @@ impl Session {
     /// Take the latest reading of the system's memory and start the next one in the background
     /// (desktop frontends call this every few seconds; it never waits for the system), then
     /// re-apply the cache budgets when the reading changes them. Returns the effective budgets.
+    /// The disk cache's free disk space is read the same way (it keeps a reserve free).
     pub fn memory_tick(&mut self) -> crate::prefs::CacheBudgets {
+        self.poll_disk_space();
         let before = self.prefs.cache_budgets(self.sys_memory);
         self.sys_memory = self.memory_watch.latest().or(self.sys_memory);
         self.memory_watch.poll();
@@ -98,11 +100,24 @@ impl Session {
         after
     }
 
+    /// Read the disk cache's free disk space in the background and apply it there (the reserve
+    /// it keeps free): the free space and the cache's size are taken at the same moment, and the
+    /// reader holds its own cache, so a reading never reaches another folder's.
+    fn poll_disk_space(&mut self) {
+        if let Some(dc) = &self.disk_cache {
+            let dc = dc.clone();
+            self.disk_watch.poll_with("ec-disk-space", move || {
+                dc.set_disk_space(crate::sysinfo::disk_space(dc.folder()));
+                Some(())
+            });
+        }
+    }
+
     /// Apply Settings ▸ Media & Disk Cache ▸ Disk Cache: open (or close) the persistent cache
     /// and attach it to the layer cache. Without a folder setting the platform cache folder is
     /// used, but only by frontends with a settings store (headless sessions stay off disk).
     pub fn configure_disk_cache(&mut self) {
-        use effectcraft_render::disk_cache::{DiskCache, default_folder, footage_salt};
+        use effectcraft_render::disk_cache::{DiskCache, default_folder};
         let d = &self.prefs.disk;
         let folder = if d.disk_cache_folder.trim().is_empty() {
             (self.config.is_some() && !cfg!(target_arch = "wasm32")).then(default_folder)
@@ -113,25 +128,47 @@ impl Session {
         // (no file system in the browser: the disk cache stays off there)
         let Some(folder) = folder.filter(|_| d.disk_cache_enabled && !cfg!(target_arch = "wasm32")) else {
             self.disk_cache = None;
+            self.disk_watch = Default::default();
             self.layer_cache.set_disk(None);
             return;
         };
+        // Tests: the Roto/Object Matte segment store below is one per process, so a test that
+        // opens a disk cache (often the platform folder, through a settings store) would take
+        // over the store of a roto test running beside it. Serialise them with the roto tests.
+        #[cfg(test)]
+        crate::tests::roto::hold_roto_cache_test_lock();
         let dc = match &self.disk_cache {
             Some(c) if c.folder() == folder.as_path() => {
                 c.set_max_bytes(max);
                 c.clone()
             }
+            // A new folder: the free-space reading was for the old one (a reader still running
+            // holds the old watcher's state, so it can't write into the new one).
             _ => match DiskCache::open(&folder, max) {
-                Ok(c) => c,
+                Ok(c) => {
+                    self.disk_watch = Default::default();
+                    c
+                }
                 Err(e) => {
                     log::warn!("disk cache at {}: {e}", folder.display());
                     self.disk_cache = None;
+                    self.disk_watch = Default::default();
                     self.layer_cache.set_disk(None);
                     return;
                 }
             },
         };
-        self.layer_cache.set_disk(Some((dc.clone(), footage_salt(&self.project))));
+        // Files reloaded while the cache was off: their entries go before anything is read from
+        // it (until the writer has deleted them they are misses, and no frame is linked).
+        if !self.pending_disk_drops.is_empty() {
+            dc.drop_files(std::mem::take(&mut self.pending_disk_drops));
+        }
+        self.disk_cache = Some(dc.clone());
+        // The reserve applies from the start (a new folder's watcher is idle).
+        self.poll_disk_space();
+        // Used at once (no file is looked at first: each entry checks the source files it lists
+        // when it is read, #3184).
+        self.layer_cache.set_disk(Some(dc.clone()));
         // Roto Brush / Object Matte segmentations persist there too (held weakly: switching the
         // disk cache off drops it).
         let store: std::sync::Arc<dyn effectcraft_effects::roto::SegStore> = dc.clone();
@@ -164,9 +201,19 @@ impl Session {
         self.shortcut_table = std::sync::OnceLock::new();
     }
 
-    /// The active shortcut preset resolved against every bindable command.
+    /// The scripts in the Scripts folder changed: list File ▸ Scripts' entries again in the
+    /// shortcut table.
+    pub fn scripts_changed(&mut self) {
+        self.shortcut_table = std::sync::OnceLock::new();
+    }
+
+    /// The active shortcut preset resolved against every bindable command, File ▸ Scripts'
+    /// entries included.
     pub fn shortcuts(&self) -> &ShortcutTable {
-        self.shortcut_table.get_or_init(|| ShortcutTable::build(&self.keymaps, &self.ui_commands))
+        self.shortcut_table.get_or_init(|| {
+            let scripts: Vec<String> = crate::commands::scripts::scripts(self).into_iter().filter(|e| !e.panel).map(|e| e.name).collect();
+            ShortcutTable::build_with_scripts(&self.keymaps, &self.ui_commands, &scripts)
+        })
     }
 
     /// Remember a project in File ▸ Open Recent and in the crash-recovery sentinel.
diff --git a/crates/engine/src/shortcuts.rs b/crates/engine/src/settings/shortcuts.rs
similarity index 67%
rename from crates/engine/src/shortcuts.rs
rename to crates/engine/src/settings/shortcuts.rs
index 3d4ab3661..44e2261a2 100644
--- a/crates/engine/src/shortcuts.rs
+++ b/crates/engine/src/settings/shortcuts.rs
@@ -1,6 +1,7 @@
 //! Keyboard shortcut presets (Edit ▸ Keyboard Shortcuts).
 //!
-//! Every menu entry, registry command and frontend command is *bindable*: it has a binding key
+//! Every menu entry, registry command and frontend command, and every script File ▸ Scripts
+//! lists, is *bindable*: it has a binding key
 //! (the command id, plus its bound parameters for entries such as `app.settings
 //! {"page":"general"}`), a scope (application-wide or a panel) and default keys. The built-in
 //! preset "EffectCraft Default" is After Effects' default keyboard layout and is read-only; custom
@@ -8,6 +9,11 @@
 //! (as After Effects asks you to "Save As" a custom set). The shortcut dispatcher and the menus
 //! read the active preset through [`ShortcutTable`].
 //!
+//! Scopes, narrowest first: a *context* ([`CONTEXT_SCOPES`]: a state of the app such as editing
+//! text; its shortcuts work only while it is active), a *panel* (`Project`, `Timeline`,
+//! `RenderQueue`…: the panel with the keyboard) and the application. One chord can be bound once
+//! per scope; the narrowest active scope runs it ([`scope_rank`]).
+//!
 //! Shortcut text is `Ctrl+Cmd+Alt+Shift+Key` (`Cmd` is ⌘ on macOS and Ctrl elsewhere).
 
 use std::collections::{BTreeMap, HashMap};
@@ -28,6 +34,97 @@ pub struct UiCommand {
     pub id: String,
     pub label: String,
     pub shortcut: Option<String>,
+    /// Its scope; none: from its id (`timeline.*` → Timeline, `view.*` → Composition).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub scope: Option<String>,
+}
+
+/// Scopes that are a state of the app rather than a panel: editing text in the viewer, a paint
+/// tool active, a mask selected, a camera tool active.
+pub const CONTEXT_SCOPES: &[&str] = &["TextEditing", "Paint", "Mask", "Camera"];
+
+/// Engine commands and menu entries whose shortcuts belong to one panel or context (binding key
+/// → scope). Every other one is application-wide; frontend commands state their own.
+const SCOPES: &[(&str, &str)] = &[
+    ("file.rememberInterpretation", "Project"),
+    ("file.applyInterpretation", "Project"),
+    ("project.deleteWithoutConfirmation", "Project"),
+    ("renderQueue.duplicate", "RenderQueue"),
+];
+
+/// Scope of an engine command or menu entry from its binding key.
+pub fn scope_of(key: &str) -> &'static str {
+    SCOPES.iter().find(|(k, _)| *k == key).map_or(APP_SCOPE, |(_, s)| s)
+}
+
+pub fn is_context(scope: &str) -> bool {
+    CONTEXT_SCOPES.contains(&scope)
+}
+
+/// The Timeline and the Composition panel show the same composition and share their shortcuts:
+/// the layer keys work with either one focused.
+pub fn panels_share(a: &str, b: &str) -> bool {
+    matches!((a, b), ("Timeline", "Composition") | ("Composition", "Timeline"))
+}
+
+/// A scope as shown to people (`RenderQueue` → `Render Queue`).
+pub fn scope_label(scope: &str) -> String {
+    let mut out = String::with_capacity(scope.len() + 2);
+    for (i, c) in scope.chars().enumerate() {
+        if i > 0 && c.is_uppercase() {
+            out.push(' ');
+        }
+        out.push(c);
+    }
+    out
+}
+
+/// How strongly a binding in `scope` claims a chord while the panel `focused` has the keyboard
+/// and `contexts` are active: lower wins, `None` doesn't run at all. An active context, then the
+/// focused panel, then the panel sharing its shortcuts, then the application. A shortcut of
+/// another panel still runs when nothing nearer claims the chord (the reveal keys work from the
+/// Effect Controls panel too); a context's shortcuts never run outside it. Two other panels (or
+/// two active contexts) can claim a chord at the same rank: [`pick`] runs neither.
+pub fn scope_rank(scope: &str, focused: &str, contexts: &[&str]) -> Option<u8> {
+    if is_context(scope) {
+        return contexts.contains(&scope).then_some(0);
+    }
+    Some(if scope == focused {
+        1
+    } else if panels_share(scope, focused) {
+        2
+    } else if scope == APP_SCOPE {
+        3
+    } else {
+        4
+    })
+}
+
+/// Which of the bindings matching one key press runs: `candidates` are (scope, physical,
+/// binding), in the dispatcher's order. The narrowest scope ([`scope_rank`]) wins; at the same
+/// rank an explicit physical-key binding wins, then the first one. `Err`: the best candidates
+/// belong to different scopes of the same rank (two other panels, or two active contexts), so
+/// none of them runs; it lists those scopes.
+pub fn pick<'a, T>(candidates: impl IntoIterator<Item = (&'a str, bool, T)>, focused: &str, contexts: &[&str]) -> Result<Option<T>, Vec<String>> {
+    let mut best: Option<((u8, bool), &str, T)> = None;
+    let mut tied: Vec<String> = vec![];
+    for (scope, physical, b) in candidates {
+        let Some(rank) = scope_rank(scope, focused, contexts) else { continue };
+        let at = (rank, !physical);
+        match &best {
+            Some((r, s, _)) if *r < at || (*r == at && *s == scope) => {}
+            Some((r, _, _)) if *r == at => {
+                if !tied.iter().any(|t| t == scope) {
+                    tied.push(scope.to_string());
+                }
+            }
+            _ => {
+                tied = vec![scope.to_string()];
+                best = Some((at, scope, b));
+            }
+        }
+    }
+    if tied.len() > 1 { Err(tied) } else { Ok(best.map(|(.., b)| b)) }
 }
 
 /// One thing a shortcut can run.
@@ -94,17 +191,32 @@ pub fn bindables(ui: &[UiCommand]) -> Vec<Bindable> {
             e.shortcut.as_deref().into_iter().chain(e.alt_shortcuts.iter().map(String::as_str)).chain(alt.iter().copied()).filter_map(normalize).collect();
         push(
             Bindable {
+                scope: scope_of(&key).into(),
                 key,
                 command: e.command.clone(),
                 params: e.params.clone(),
                 label: e.label.clone(),
                 path: path.clone(),
-                scope: APP_SCOPE.into(),
                 defaults,
             },
             &mut out,
         );
     }
+    // File ▸ Scripts ▸ Recent Script Files lists its scripts at run time; the first one, the most
+    // recent, has a key.
+    let recent = json!({"recent": 0});
+    push(
+        Bindable {
+            key: binding_key("file.runScript", &recent),
+            command: "file.runScript".into(),
+            params: recent,
+            label: "Run Most Recent Script File".into(),
+            path: vec!["File".into(), "Scripts".into(), "Recent Script Files".into()],
+            scope: APP_SCOPE.into(),
+            defaults: normalize("Cmd+Alt+Shift+D").into_iter().collect(),
+        },
+        &mut out,
+    );
     for c in crate::command_specs() {
         if !c.journal || entries.iter().any(|(_, e)| e.command == c.id) {
             continue;
@@ -117,22 +229,22 @@ pub fn bindables(ui: &[UiCommand]) -> Vec<Bindable> {
                 params: Value::Null,
                 label: c.label.to_string(),
                 path: vec!["Commands".into()],
-                scope: APP_SCOPE.into(),
+                scope: scope_of(c.id).into(),
                 defaults,
             },
             &mut out,
         );
     }
     for c in ui {
-        let scope = ui_scope(&c.id);
-        let cat = if scope == APP_SCOPE { "Tools & Panels" } else { scope };
+        let scope = c.scope.as_deref().unwrap_or_else(|| ui_scope(&c.id));
+        let cat = if scope == APP_SCOPE { "Tools & Panels".to_string() } else { scope_label(scope) };
         push(
             Bindable {
                 key: c.id.clone(),
                 command: c.id.clone(),
                 params: Value::Null,
                 label: c.label.clone(),
-                path: vec![cat.into()],
+                path: vec![cat],
                 scope: scope.into(),
                 defaults: c.shortcut.as_deref().and_then(normalize).into_iter().collect(),
             },
@@ -142,6 +254,27 @@ pub fn bindables(ui: &[UiCommand]) -> Vec<Bindable> {
     out
 }
 
+/// The File ▸ Scripts entries of the scripts `names` (file names, as the menu lists them), with
+/// no default keys. A key is bound to the script's name, so it stays with that script when
+/// scripts are added to or removed from the folder.
+pub fn script_bindables(names: &[String]) -> Vec<Bindable> {
+    names
+        .iter()
+        .map(|n| {
+            let params = json!({"name": n});
+            Bindable {
+                key: binding_key("file.runScript", &params),
+                command: "file.runScript".into(),
+                params,
+                label: n.clone(),
+                path: vec!["File".into(), "Scripts".into()],
+                scope: APP_SCOPE.into(),
+                defaults: vec![],
+            }
+        })
+        .collect()
+}
+
 /// Canonical shortcut text (`cmd+shift+k`, `Shift+Cmd+K`, `⌘⇧K` → `Cmd+Shift+K`); `None` if it
 /// has no key.
 pub fn normalize(s: &str) -> Option<String> {
@@ -253,10 +386,16 @@ pub struct Conflict {
     pub key: String,
     pub label: String,
     pub scope: String,
+    /// The two are in different scopes, so both keep working: the narrower one runs while its
+    /// panel or context is active and the other one everywhere else. `false`: the same scope,
+    /// where only one of them can run.
+    pub overrides: bool,
 }
 
+/// Whether shortcuts of these scopes can be active at once. Two different panels can't, except
+/// the pair sharing theirs; a context can be active in any panel.
 fn scopes_overlap(a: &str, b: &str) -> bool {
-    a == b || a == APP_SCOPE || b == APP_SCOPE
+    a == b || a == APP_SCOPE || b == APP_SCOPE || panels_share(a, b) || is_context(a) || is_context(b)
 }
 
 impl Keymaps {
@@ -421,7 +560,16 @@ pub struct ShortcutTable {
 
 impl ShortcutTable {
     pub fn build(maps: &Keymaps, ui: &[UiCommand]) -> ShortcutTable {
-        let bindables = bindables(ui);
+        Self::build_with_scripts(maps, ui, &[])
+    }
+
+    /// [`ShortcutTable::build`] with the File ▸ Scripts entries of the scripts `scripts`, listed
+    /// after the other File ▸ Scripts entries.
+    pub fn build_with_scripts(maps: &Keymaps, ui: &[UiCommand], scripts: &[String]) -> ShortcutTable {
+        let mut bindables = bindables(ui);
+        let at = bindables.iter().rposition(|b| b.path.starts_with(&["File".to_string(), "Scripts".to_string()])).map_or(bindables.len(), |i| i + 1);
+        let new: Vec<Bindable> = script_bindables(scripts).into_iter().filter(|s| !bindables.iter().any(|b| b.key == s.key)).collect();
+        bindables.splice(at..at, new);
         let keys = bindables.iter().map(|b| (b.key.clone(), maps.keys_of(b))).collect();
         ShortcutTable { bindables, keys }
     }
@@ -446,11 +594,19 @@ impl ShortcutTable {
         self.bindings()
             .into_iter()
             .filter(|(k, o)| *k == keys && o.key != b.key && scopes_overlap(&o.scope, &b.scope))
-            .map(|(k, o)| Conflict { keys: k.to_string(), key: o.key.clone(), label: o.label.clone(), scope: o.scope.clone() })
+            .map(|(k, o)| Conflict {
+                keys: k.to_string(),
+                key: o.key.clone(),
+                label: o.label.clone(),
+                scope: o.scope.clone(),
+                overrides: o.scope != b.scope && !(is_context(&o.scope) && is_context(&b.scope)),
+            })
             .collect()
     }
 
-    /// Every pair of commands sharing keys in an overlapping scope.
+    /// Every pair of commands sharing keys in the same scope, or in two contexts (which can be
+    /// active at once): only one of the two can run, or neither ([`pick`]). (Other pairs in
+    /// different scopes are intended, see [`Conflict::overrides`].)
     pub fn all_conflicts(&self) -> Vec<(String, Conflict)> {
         let mut by_keys: BTreeMap<&str, Vec<&Bindable>> = BTreeMap::new();
         for (k, b) in self.bindings() {
@@ -462,8 +618,11 @@ impl ShortcutTable {
         for (k, bs) in by_keys {
             for (i, a) in bs.iter().enumerate() {
                 for b in &bs[i + 1..] {
-                    if scopes_overlap(&a.scope, &b.scope) {
-                        out.push((a.key.clone(), Conflict { keys: k.to_string(), key: b.key.clone(), label: b.label.clone(), scope: b.scope.clone() }));
+                    if a.scope == b.scope || (is_context(&a.scope) && is_context(&b.scope)) {
+                        out.push((
+                            a.key.clone(),
+                            Conflict { keys: k.to_string(), key: b.key.clone(), label: b.label.clone(), scope: b.scope.clone(), overrides: false },
+                        ));
                     }
                 }
             }
diff --git a/crates/engine/src/sysinfo.rs b/crates/engine/src/sysinfo.rs
deleted file mode 100644
index de39974da..000000000
--- a/crates/engine/src/sysinfo.rs
+++ /dev/null
@@ -1,238 +0,0 @@
-//! Host information for Settings ▸ Memory & CPU (RAM reserved for other applications, reducing
-//! caches when the system is low on memory) and Help ▸ System Compatibility Report.
-//!
-//! Pure Rust and dependency-free: the values come from the operating system's own reporting
-//! (`/proc/meminfo` on Linux, `sysctl`/`vm_stat` on macOS, `wmic`/PowerShell on Windows). Every
-//! query may fail (sandboxes, the web): callers treat `None` as "unknown" and keep their
-//! configured budgets. The periodic reading behind the cache budgets runs on a background
-//! thread ([`MemoryWatch`]): on Windows it starts PowerShell, which takes about a second.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex, PoisonError};
-
-use serde::Serialize;
-
-/// Physical memory in bytes.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize)]
-pub struct SysMemory {
-    pub total: u64,
-    /// Memory the system can hand out without swapping (free + reclaimable caches).
-    pub available: u64,
-}
-
-impl SysMemory {
-    /// The system is low on memory: less than 10% (or less than 1 GB) is available.
-    pub fn is_low(&self) -> bool {
-        self.total > 0 && (self.available < self.total / 10 || self.available < 1 << 30)
-    }
-}
-
-/// The system's memory, read in the background: [`MemoryWatch::poll`] starts a reading (unless
-/// one is running) and [`MemoryWatch::latest`] returns the last one without waiting.
-#[derive(Clone, Default)]
-pub struct MemoryWatch {
-    latest: Arc<Mutex<Option<SysMemory>>>,
-    busy: Arc<AtomicBool>,
-}
-
-impl MemoryWatch {
-    /// Start a new reading in the background (no threads on the web: read inline, it is
-    /// unknown there anyway).
-    pub fn poll(&self) {
-        if self.busy.swap(true, Ordering::AcqRel) {
-            return;
-        }
-        let (latest, busy) = (self.latest.clone(), self.busy.clone());
-        let read = move || {
-            if let Some(m) = memory() {
-                *latest.lock().unwrap_or_else(PoisonError::into_inner) = Some(m);
-            }
-            busy.store(false, Ordering::Release);
-        };
-        #[cfg(not(target_arch = "wasm32"))]
-        if std::thread::Builder::new().name("ec-memory".into()).spawn(read).is_err() {
-            self.busy.store(false, Ordering::Release);
-        }
-        #[cfg(target_arch = "wasm32")]
-        read();
-    }
-
-    /// The last reading (`None` until one finished).
-    pub fn latest(&self) -> Option<SysMemory> {
-        *self.latest.lock().unwrap_or_else(PoisonError::into_inner)
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-#[allow(dead_code)]
-fn run(cmd: &str, args: &[&str]) -> Option<String> {
-    let mut c = std::process::Command::new(cmd);
-    c.args(args);
-    // A console program started from the windowed app would flash a console window.
-    #[cfg(target_os = "windows")]
-    std::os::windows::process::CommandExt::creation_flags(&mut c, 0x0800_0000); // CREATE_NO_WINDOW
-    let out = c.output().ok()?;
-    out.status.success().then(|| String::from_utf8_lossy(&out.stdout).to_string())
-}
-
-/// Parse `/proc/meminfo` (kB values).
-pub fn parse_meminfo(text: &str) -> Option<SysMemory> {
-    let field = |name: &str| -> Option<u64> {
-        let line = text.lines().find(|l| l.starts_with(name))?;
-        let kb: u64 = line.split_whitespace().nth(1)?.parse().ok()?;
-        Some(kb * 1024)
-    };
-    let total = field("MemTotal:")?;
-    let available = field("MemAvailable:").or_else(|| Some(field("MemFree:")? + field("Cached:").unwrap_or(0)))?;
-    Some(SysMemory { total, available })
-}
-
-/// Parse macOS `vm_stat` output: free + inactive + speculative + purgeable pages.
-pub fn parse_vm_stat(text: &str, total: u64) -> Option<SysMemory> {
-    let page: u64 = text.split("page size of ").nth(1)?.split_whitespace().next()?.parse().ok()?;
-    let pages = |name: &str| -> u64 {
-        text.lines()
-            .find(|l| l.starts_with(name))
-            .and_then(|l| l.rsplit(':').next())
-            .and_then(|v| v.trim().trim_end_matches('.').parse::<u64>().ok())
-            .unwrap_or(0)
-    };
-    let free = pages("Pages free") + pages("Pages inactive") + pages("Pages speculative") + pages("Pages purgeable");
-    Some(SysMemory { total, available: (free * page).min(total) })
-}
-
-/// Parse `sysctl -n hw.physmem hw.pagesize vm.stats.vm.v_free_count vm.stats.vm.v_inactive_count`
-/// (FreeBSD: one number per line, in that order).
-pub fn parse_freebsd_sysctl(text: &str) -> Option<SysMemory> {
-    let mut it = text.split_whitespace().map(|v| v.parse::<u64>().ok());
-    let total = it.next()??;
-    let page = it.next()??;
-    let free = it.next()??.saturating_add(it.next()??);
-    Some(SysMemory { total, available: free.saturating_mul(page).min(total) })
-}
-
-/// Total and available physical memory, when the system reports them.
-pub fn memory() -> Option<SysMemory> {
-    #[cfg(target_os = "linux")]
-    {
-        return parse_meminfo(&std::fs::read_to_string("/proc/meminfo").ok()?);
-    }
-    #[cfg(target_os = "macos")]
-    {
-        let total: u64 = run("sysctl", &["-n", "hw.memsize"])?.trim().parse().ok()?;
-        return parse_vm_stat(&run("vm_stat", &[])?, total).or(Some(SysMemory { total, available: total }));
-    }
-    #[cfg(target_os = "freebsd")]
-    {
-        return parse_freebsd_sysctl(&run("sysctl", &["-n", "hw.physmem", "hw.pagesize", "vm.stats.vm.v_free_count", "vm.stats.vm.v_inactive_count"])?);
-    }
-    #[cfg(target_os = "windows")]
-    {
-        let text = run(
-            "powershell",
-            &["-NoProfile", "-Command", "$o=Get-CimInstance Win32_OperatingSystem; \"$($o.TotalVisibleMemorySize) $($o.FreePhysicalMemory)\""],
-        )?;
-        let mut it = text.split_whitespace().filter_map(|v| v.parse::<u64>().ok());
-        return Some(SysMemory { total: it.next()? * 1024, available: it.next()? * 1024 });
-    }
-    #[allow(unreachable_code)]
-    None
-}
-
-/// CPU model name.
-pub fn cpu_name() -> Option<String> {
-    #[cfg(target_os = "linux")]
-    {
-        let t = std::fs::read_to_string("/proc/cpuinfo").ok()?;
-        return t.lines().find(|l| l.starts_with("model name")).and_then(|l| l.split(':').nth(1)).map(|s| s.trim().to_string());
-    }
-    #[cfg(target_os = "macos")]
-    {
-        return run("sysctl", &["-n", "machdep.cpu.brand_string"]).map(|s| s.trim().to_string()).filter(|s| !s.is_empty());
-    }
-    #[cfg(target_os = "freebsd")]
-    {
-        return run("sysctl", &["-n", "hw.model"]).map(|s| s.trim().to_string()).filter(|s| !s.is_empty());
-    }
-    #[cfg(target_os = "windows")]
-    {
-        return std::env::var("PROCESSOR_IDENTIFIER").ok();
-    }
-    #[allow(unreachable_code)]
-    None
-}
-
-/// Operating system name and version.
-pub fn os_version() -> String {
-    #[cfg(target_os = "macos")]
-    if let Some(v) = run("sw_vers", &["-productVersion"]) {
-        return format!("macOS {}", v.trim());
-    }
-    #[cfg(target_os = "linux")]
-    if let Ok(t) = std::fs::read_to_string("/etc/os-release")
-        && let Some(n) = t.lines().find_map(|l| l.strip_prefix("PRETTY_NAME="))
-    {
-        return n.trim_matches('"').to_string();
-    }
-    #[cfg(target_os = "freebsd")]
-    if let Some(v) = run("freebsd-version", &[]) {
-        return format!("FreeBSD {}", v.trim());
-    }
-    #[cfg(target_os = "windows")]
-    if let Some(v) = run("cmd", &["/C", "ver"]) {
-        return v.trim().to_string();
-    }
-    format!("{} ({})", std::env::consts::OS, std::env::consts::ARCH)
-}
-
-/// Logical CPU cores.
-pub fn cpu_cores() -> usize {
-    std::thread::available_parallelism().map(|n| n.get()).unwrap_or(1)
-}
-
-/// The graphics lines of Settings ▸ GPU Information and Help ▸ System Report: whether the GPU
-/// compositor runs (and on which adapter), else why compositing is on the CPU, and the adapter
-/// the window itself got. Without this a card the compositor couldn't use looked undetected (#596).
-pub fn gpu_summary(s: &crate::Session) -> String {
-    let mut text = match s.accel.as_ref().map(|a| a.name()) {
-        Some(name) => format!("Compositing: GPU, {name}.\n"),
-        None => {
-            let threads = std::thread::available_parallelism().map(|n| n.get()).unwrap_or(1);
-            let why = s.accel_note.as_deref().unwrap_or("no reason was recorded");
-            format!("Compositing: CPU, {threads} threads (pure Rust, rayon).\nGPU compositing is off: {why}\n")
-        }
-    };
-    match &s.window_adapter {
-        Some(adapter) => text.push_str(&format!("Window graphics: {adapter}\n")),
-        None => text.push_str("Window graphics: not known yet (the window has not drawn its first frame).\n"),
-    }
-    text
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn freebsd_sysctl_memory_parses() {
-        let m = parse_freebsd_sysctl("17179869184\n4096\n1000000\n500000\n").expect("parses");
-        assert_eq!(m.total, 17_179_869_184);
-        assert_eq!(m.available, 1_500_000 * 4096);
-        assert!(parse_freebsd_sysctl("17179869184\n4096\n").is_none());
-        assert!(parse_freebsd_sysctl("garbage").is_none());
-        // Available never exceeds total, even with nonsense counts.
-        let m = parse_freebsd_sysctl("1000\n4096\n999999999\n999999999").expect("parses");
-        assert_eq!(m.available, 1000);
-    }
-
-    #[test]
-    fn parses_proc_meminfo_and_vm_stat() {
-        let m = parse_meminfo("MemTotal:       16000000 kB\nMemFree:  1000 kB\nMemAvailable:    8000000 kB\n").unwrap();
-        assert_eq!(m, SysMemory { total: 16_000_000 * 1024, available: 8_000_000 * 1024 });
-        assert!(!m.is_low());
-        let vm = "Mach Virtual Memory Statistics: (page size of 16384 bytes)\nPages free:                               1000.\nPages active:  5.\nPages inactive:                           3000.\nPages speculative:                         100.\n";
-        let m = parse_vm_stat(vm, 8 << 30).unwrap();
-        assert_eq!(m.available, 4100 * 16384);
-        assert!(m.is_low());
-    }
-}
diff --git a/crates/engine/src/system.rs b/crates/engine/src/system.rs
new file mode 100644
index 000000000..8ba60f98e
--- /dev/null
+++ b/crates/engine/src/system.rs
@@ -0,0 +1,6 @@
+pub mod guard;
+pub mod library;
+pub mod logging;
+pub mod perf;
+pub mod storage;
+pub mod sysinfo;
diff --git a/crates/engine/src/guard.rs b/crates/engine/src/system/guard.rs
similarity index 100%
rename from crates/engine/src/guard.rs
rename to crates/engine/src/system/guard.rs
diff --git a/crates/engine/src/system/library.rs b/crates/engine/src/system/library.rs
new file mode 100644
index 000000000..5b7f63092
--- /dev/null
+++ b/crates/engine/src/system/library.rs
@@ -0,0 +1,1206 @@
+//! The Plug-in Library (Settings ▸ Plug-in Library; `library.*` commands): WebAssembly effect
+//! plug-ins published by the community, listed in one reviewed catalog (an `index.json` in a Git
+//! repository, see `docs/plugins.md#plug-in-library`), installed, updated and removed without
+//! bundling them into the app.
+//!
+//! * The catalog names, per package, its releases: version, plug-in API, oldest EffectCraft it
+//!   needs, the `.wasm` file's URL (a GitHub release asset) and its SHA-256. Nothing is compiled
+//!   here: the published file is downloaded, checked against the catalog's SHA-256 and loaded by
+//!   the host's [`PluginLoader`](crate::PluginLoader), so it runs in the same sandbox as any
+//!   plug-in (no imports, fuel and memory limits).
+//! * Installed packages live in `<Plug-ins>/Library/<id>/<version>/`, listed in
+//!   `<Plug-ins>/Library/installed.json` with the SHA-256 they were installed with; the app loads
+//!   them at start-up ([`load_installed`], `library.loadInstalled`). The catalog last fetched is
+//!   kept as `catalog.json` there, so the list works offline.
+//! * Effects can't be unregistered: removing or updating a package that is loaded takes effect
+//!   at the next start, and the list says so (`restartNeeded`).
+//! * Downloads use the system's `curl`, as trained models do ([`crate::models`]), so no
+//!   networking code is linked into EffectCraft. Only `https://` URLs on GitHub's hosts are
+//!   fetched, and a download whose redirects end anywhere else is refused; a local catalog (`file://`, for plug-in authors testing their entry) may also name
+//!   local files.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, PoisonError};
+
+use effectcraft_segment::sha256;
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+use crate::commands::{CommandSpec, always, b_p, bad, str_p};
+use crate::{PluginLoader, PluginPreviewer, Result, Session, cmd, query};
+
+/// The community catalog.
+pub const CATALOG_URL: &str = "https://raw.githubusercontent.com/storytold/effectcraft-plugins/main/index.json";
+/// The catalog format this build reads.
+pub const CATALOG_SCHEMA: u32 = 1;
+/// Hosts plug-ins and catalogs may be downloaded from (release assets redirect to the last two).
+const HOSTS: &[&str] = &["github.com", "raw.githubusercontent.com", "objects.githubusercontent.com", "release-assets.githubusercontent.com"];
+const MAX_CATALOG: u64 = 4 << 20;
+const MAX_MODULE: u64 = 64 << 20;
+const MAX_PACKAGES: usize = 10_000;
+const LIBRARY_DIR: &str = "Library";
+const INSTALLED_FILE: &str = "installed.json";
+const CACHE_FILE: &str = "catalog.json";
+
+/// The catalog (`index.json`).
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Catalog {
+    pub schema: u32,
+    #[serde(default)]
+    pub packages: Vec<Package>,
+}
+
+/// One plug-in package: one `.wasm` module per release.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Package {
+    pub id: String,
+    pub name: String,
+    #[serde(default)]
+    pub author: String,
+    #[serde(default)]
+    pub description: String,
+    #[serde(default)]
+    pub license: String,
+    /// The source repository.
+    #[serde(default)]
+    pub repo: String,
+    #[serde(default)]
+    pub tags: Vec<String>,
+    #[serde(default)]
+    pub versions: Vec<Release>,
+    /// The author's demo media.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub preview: Option<PackagePreview>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct PackagePreview {
+    /// An `https://` link to a short demo video (YouTube, Vimeo, GitHub…), opened in the browser.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub video: Option<String>,
+}
+
+/// A package's effect rendered on the sample frame (`library.preview`), as straight RGBA8.
+#[derive(Debug)]
+pub struct Preview {
+    pub id: String,
+    pub version: String,
+    pub width: u32,
+    pub height: u32,
+    pub fps: f64,
+    /// The sample frame.
+    pub before: Vec<u8>,
+    /// The effect at default settings, one frame per `1 / fps` from time 0.
+    pub frames: Vec<Vec<u8>>,
+    /// The module's manifest (`{id, name, category, description, params…}`).
+    pub manifest: Value,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Release {
+    /// Dotted numbers (`1.2.0`).
+    pub version: String,
+    /// The plug-in API it implements.
+    pub api: u32,
+    /// The oldest EffectCraft version it runs in.
+    #[serde(default, rename = "minApp", skip_serializing_if = "Option::is_none")]
+    pub min_app: Option<String>,
+    pub url: String,
+    /// Lower-case hex SHA-256 of the file at `url`.
+    pub sha256: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub size: Option<u64>,
+    /// The effect ids the module registers (`library.missing` finds packages by them).
+    #[serde(default)]
+    pub effects: Vec<String>,
+}
+
+/// `installed.json`: package id → what is installed.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Installed {
+    #[serde(default)]
+    pub packages: BTreeMap<String, InstalledPackage>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct InstalledPackage {
+    pub version: String,
+    /// The module, relative to the library folder (`<id>/<version>/<id>.wasm`).
+    pub file: String,
+    pub sha256: String,
+    #[serde(default)]
+    pub effects: Vec<String>,
+}
+
+/// `catalog.json`: the catalog last fetched, and from where.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+struct Cache {
+    url: String,
+    fetched: String,
+    catalog: Catalog,
+}
+
+/// What the library's worker reports, and what this session loaded.
+#[derive(Clone, Debug, Default)]
+pub struct Status {
+    /// What is happening now ("Downloading Glow Pack 1.2.0…").
+    pub busy: Option<String>,
+    /// The last failure.
+    pub error: Option<String>,
+    /// A finished job's message and whether it failed, for a toast ([`Session::poll_library`]).
+    pub done: Option<(String, bool)>,
+    /// The catalog in use and where it came from.
+    pub catalog: Option<(String, Arc<Catalog>)>,
+    /// When it was fetched (RFC 3339).
+    pub fetched: Option<String>,
+    /// Packages whose module this session loaded: id → version.
+    pub loaded: BTreeMap<String, String>,
+    /// Packages removed or updated after they loaded: the change applies at the next start.
+    pub restart: BTreeSet<String>,
+    /// The last package previewed.
+    pub preview: Option<Arc<Preview>>,
+}
+
+/// The session's Plug-in Library state (shared with its worker thread).
+#[derive(Default)]
+pub struct Library {
+    status: Arc<Mutex<Status>>,
+}
+
+impl Library {
+    /// A copy of the current status.
+    pub fn status(&self) -> Status {
+        self.status.lock().unwrap_or_else(PoisonError::into_inner).clone()
+    }
+}
+
+/// Change the shared status (a poisoned lock is still used, not a panic).
+fn set(status: &Arc<Mutex<Status>>, f: impl FnOnce(&mut Status)) {
+    f(&mut status.lock().unwrap_or_else(PoisonError::into_inner));
+}
+
+impl Session {
+    /// The effect plug-ins folder: the host's, else `Plug-ins` next to the settings.
+    pub fn plugins_dir(&self) -> Option<PathBuf> {
+        self.plugins_dir.clone().or_else(|| Some(self.config.as_ref()?.dir()?.join("Plug-ins")))
+    }
+
+    /// Where Plug-in Library packages are installed.
+    pub fn library_dir(&self) -> Option<PathBuf> {
+        self.plugins_dir().map(|d| d.join(LIBRARY_DIR))
+    }
+
+    /// Finish what the library's worker did: a toast.
+    pub fn poll_library(&mut self) {
+        let done = self.library.status.lock().ok().and_then(|mut s| s.done.take());
+        if let Some((message, error)) = done {
+            self.events.push(crate::Event::Toast { message, error });
+        }
+    }
+}
+
+// ---------------------------------------------------------------- catalog
+
+/// Dotted numbers as a comparable list (`None`: not a version).
+fn version_key(v: &str) -> Option<Vec<u64>> {
+    if v.is_empty() || v.len() > 32 {
+        return None;
+    }
+    let parts: Option<Vec<u64>> = v.split('.').map(|p| if p.is_empty() || !p.bytes().all(|b| b.is_ascii_digit()) { None } else { p.parse().ok() }).collect();
+    let mut parts = parts?;
+    while parts.len() > 1 && parts.last() == Some(&0) {
+        parts.pop();
+    }
+    Some(parts)
+}
+
+/// `a` is newer than `b`.
+fn newer(a: &str, b: &str) -> bool {
+    match (version_key(a), version_key(b)) {
+        (Some(a), Some(b)) => a > b,
+        _ => false,
+    }
+}
+
+/// A package id that is also a safe folder name: letters, digits, `.`, `-`, `_`; no leading or
+/// trailing dot (Windows drops a trailing one, so `a.` would share `a`'s folder).
+pub fn valid_id(id: &str) -> bool {
+    (1..=100).contains(&id.len())
+        && !id.starts_with('.')
+        && !id.ends_with('.')
+        && !id.contains("..")
+        && id.bytes().all(|b| b.is_ascii_alphanumeric() || b"._-".contains(&b))
+}
+
+/// 64 hex digits.
+fn valid_sha(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+/// Why a release can't be used, if it can't.
+fn release_problem(r: &Release) -> Option<String> {
+    if version_key(&r.version).is_none() {
+        return Some(format!("bad version `{}`", r.version));
+    }
+    if r.min_app.as_deref().is_some_and(|m| version_key(m).is_none()) {
+        return Some(format!("{}: bad minApp", r.version));
+    }
+    if !valid_sha(&r.sha256) {
+        return Some(format!("{}: bad sha256", r.version));
+    }
+    if r.url.is_empty() {
+        return Some(format!("{}: no url", r.version));
+    }
+    None
+}
+
+/// Read a catalog: packages and releases that are malformed are left out (and reported), so one
+/// bad entry doesn't hide the others.
+pub fn parse_catalog(bytes: &[u8]) -> std::result::Result<(Catalog, Vec<String>), String> {
+    if bytes.len() as u64 > MAX_CATALOG {
+        return Err(format!("the catalog is larger than {} MB", MAX_CATALOG >> 20));
+    }
+    let raw: Catalog = serde_json::from_slice(bytes).map_err(|e| format!("the catalog isn't valid: {e}"))?;
+    if raw.schema != CATALOG_SCHEMA {
+        return Err(format!("the catalog uses format {} and this EffectCraft reads format {CATALOG_SCHEMA}: update EffectCraft", raw.schema));
+    }
+    let mut warnings = vec![];
+    let mut seen = BTreeSet::new();
+    let mut packages = vec![];
+    for mut p in raw.packages.into_iter().take(MAX_PACKAGES) {
+        if !valid_id(&p.id) || p.name.trim().is_empty() {
+            warnings.push(format!("left out a package with a bad id or no name (`{}`)", p.id));
+            continue;
+        }
+        // Windows and macOS folders ignore case: `Org.X` and `org.x` would share one.
+        if !seen.insert(p.id.to_ascii_lowercase()) {
+            warnings.push(format!("left out a second package `{}`", p.id));
+            continue;
+        }
+        p.versions.retain(|r| match release_problem(r) {
+            Some(why) => {
+                warnings.push(format!("{}: {why}", p.id));
+                false
+            }
+            None => true,
+        });
+        for r in &mut p.versions {
+            r.sha256.make_ascii_lowercase();
+        }
+        if let Some(video) = p.preview.as_ref().and_then(|v| v.video.as_deref())
+            && !(video.starts_with("https://") && video.len() <= 500)
+        {
+            warnings.push(format!("{}: left out a preview video that isn't an https:// link", p.id));
+            p.preview = None;
+        }
+        packages.push(p);
+    }
+    Ok((Catalog { schema: CATALOG_SCHEMA, packages }, warnings))
+}
+
+/// This build loads the release's WebAssembly plug-in API ([`WASM_API_VERSION`](crate::effects::plugin::WASM_API_VERSION):
+/// the library lists `.wasm` modules only) and is at least its `minApp`.
+fn runs_here(r: &Release) -> bool {
+    // Without a pre-release suffix (`0.18.0-dev` is 0.18.0).
+    let app = env!("CARGO_PKG_VERSION").split(['-', '+']).next().unwrap_or_default();
+    (crate::effects::plugin::MIN_WASM_API_VERSION..=crate::effects::plugin::WASM_API_VERSION).contains(&r.api)
+        && r.min_app.as_deref().is_none_or(|m| !newer(m, app))
+}
+
+/// The newest release this build can run (plug-in API and minimum app version).
+pub fn latest_compatible(p: &Package) -> Option<&Release> {
+    p.versions.iter().filter(|r| runs_here(r)).fold(None, |best: Option<&Release>, r| match best {
+        Some(b) if !newer(&r.version, &b.version) => Some(b),
+        _ => Some(r),
+    })
+}
+
+// ---------------------------------------------------------------- fetching
+
+/// Where a URL may be read from.
+#[derive(Clone, Debug, PartialEq)]
+enum Source {
+    Https(String),
+    File(PathBuf),
+}
+
+/// `file:///C:/x` or `file:///home/x` as a path (percent-decoded; no remote hosts).
+fn file_url_path(url: &str) -> Option<PathBuf> {
+    let rest = url.strip_prefix("file://")?;
+    let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+    if !rest.starts_with('/') {
+        return None;
+    }
+    let b = rest.as_bytes();
+    // `/C:/…` on Windows.
+    let rest = if b.len() > 2 && b.get(2) == Some(&b':') { rest.get(1..)? } else { rest };
+    let mut out = Vec::with_capacity(rest.len());
+    let mut bytes = rest.bytes();
+    while let Some(c) = bytes.next() {
+        if c == b'%' {
+            let hex = [bytes.next()?, bytes.next()?];
+            out.push(u8::from_str_radix(std::str::from_utf8(&hex).ok()?, 16).ok()?);
+        } else {
+            out.push(c);
+        }
+    }
+    String::from_utf8(out).ok().map(PathBuf::from)
+}
+
+/// Check `url` against the rules: `https://` on GitHub's hosts; `file://` when the catalog
+/// (`catalog`, or `url` itself when it is the catalog) is local.
+fn source(url: &str, catalog: Option<&str>) -> std::result::Result<Source, String> {
+    if let Some(rest) = url.strip_prefix("https://") {
+        let host = rest.split(['/', '?', '#']).next().unwrap_or_default().to_ascii_lowercase();
+        if host.contains('@') || host.contains(':') || !HOSTS.contains(&host.as_str()) {
+            return Err(format!("`{url}` isn't on GitHub: the Plug-in Library only downloads from {}", HOSTS.join(", ")));
+        }
+        return Ok(Source::Https(url.to_string()));
+    }
+    let local_catalog = catalog.is_none_or(|c| c.starts_with("file://"));
+    if url.starts_with("file://") && local_catalog {
+        return file_url_path(url).map(Source::File).ok_or_else(|| format!("bad file URL `{url}`"));
+    }
+    Err(format!("`{url}` isn't an https:// URL"))
+}
+
+/// Read `src` (at most `max` bytes), downloading into `tmp_dir`.
+fn fetch(src: &Source, max: u64, tmp_dir: &Path) -> std::result::Result<Vec<u8>, String> {
+    match src {
+        Source::File(p) => {
+            let len = std::fs::metadata(p).map_err(|e| format!("cannot read {}: {e}", p.display()))?.len();
+            if len > max {
+                return Err(format!("{} is larger than {} MB", p.display(), max >> 20));
+            }
+            std::fs::read(p).map_err(|e| format!("cannot read {}: {e}", p.display()))
+        }
+        Source::Https(url) => {
+            std::fs::create_dir_all(tmp_dir).map_err(|e| format!("cannot create {}: {e}", tmp_dir.display()))?;
+            // Unique per download: sessions in one process may download at the same time.
+            static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+            let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            let tmp = tmp_dir.join(format!(".download-{}-{n}.part", std::process::id()));
+            // `-q` first: no ~/.curlrc; `--globoff`: `[]` and `{}` in a URL are literal.
+            let out = std::process::Command::new("curl")
+                .args([
+                    "-q",
+                    "--globoff",
+                    "-fsSL",
+                    "--proto",
+                    "=https",
+                    "--proto-redir",
+                    "=https",
+                    "--max-redirs",
+                    "5",
+                    "-w",
+                    "%{url_effective}",
+                    "--retry",
+                    "2",
+                    "--connect-timeout",
+                    "20",
+                    "--max-time",
+                    "900",
+                ])
+                .args(["--max-filesize", &max.to_string(), "-o"])
+                .arg(&tmp)
+                .arg(url)
+                .output()
+                .map_err(|e| format!("downloading needs curl ({e})"))?;
+            // The size is checked before reading: `--max-filesize` can't stop a stream of unknown length.
+            let too_big = std::fs::metadata(&tmp).is_ok_and(|m| m.len() > max);
+            let bytes = if too_big {
+                Err(format!("the download is larger than {} MB", max >> 20))
+            } else if out.status.success() {
+                // Redirects are followed, so check where the download ended up.
+                let end = String::from_utf8_lossy(&out.stdout).trim().to_string();
+                match source(&end, None) {
+                    Ok(Source::Https(_)) => std::fs::read(&tmp).map_err(|e| format!("cannot read the download: {e}")),
+                    _ => Err(format!("`{url}` redirected to `{end}`, which isn't on GitHub")),
+                }
+            } else {
+                Err(format!("download failed: {}", String::from_utf8_lossy(&out.stderr).trim()))
+            };
+            let _ = std::fs::remove_file(&tmp);
+            let bytes = bytes?;
+            if bytes.len() as u64 > max {
+                return Err(format!("the download is larger than {} MB", max >> 20));
+            }
+            Ok(bytes)
+        }
+    }
+}
+
+// ---------------------------------------------------------------- installed packages
+
+/// `installed.json`; missing or unreadable is an empty library.
+fn read_installed(dir: &Path) -> Installed {
+    std::fs::read(dir.join(INSTALLED_FILE)).ok().and_then(|b| serde_json::from_slice(&b).ok()).unwrap_or_default()
+}
+
+/// Write `installed.json`.
+fn write_installed(dir: &Path, inst: &Installed) -> std::result::Result<(), String> {
+    use crate::config::FileOps;
+    let text = serde_json::to_vec_pretty(inst).map_err(|e| e.to_string())?;
+    crate::config::StdFiles.write(&dir.join(INSTALLED_FILE), &text).map_err(|e| format!("cannot write {INSTALLED_FILE}: {e}"))
+}
+
+/// An installed module's path, if `file` stays inside the library folder.
+fn module_path(dir: &Path, file: &str) -> Option<PathBuf> {
+    let parts: Vec<&str> = file.split('/').collect();
+    let safe = parts.len() == 3 && parts.iter().all(|p| !p.is_empty() && *p != "." && *p != ".." && !p.contains(['\\', ':']));
+    safe.then(|| parts.iter().fold(dir.to_path_buf(), |d, p| d.join(p)))
+}
+
+/// Load every installed package's module (at start-up): each is checked against the SHA-256 it
+/// was installed with. Returns `{loaded: [{package, version, effect…}], errors: [{package, error}]}`.
+pub fn load_installed(s: &mut Session) -> Result<Value> {
+    let c = "library.loadInstalled";
+    let loader = s.plugin_loader.ok_or_else(|| bad(c, "WebAssembly effect plug-ins are not available in this build"))?;
+    let Some(dir) = s.library_dir() else { return Ok(json!({"loaded": [], "errors": []})) };
+    let inst = read_installed(&dir);
+    let (mut loaded, mut errors) = (vec![], vec![]);
+    for (id, p) in &inst.packages {
+        if s.library.status().loaded.contains_key(id) {
+            continue;
+        }
+        let r = module_path(&dir, &p.file)
+            .ok_or_else(|| format!("bad module path `{}`", p.file))
+            .and_then(|path| std::fs::read(&path).map_err(|e| format!("cannot read {}: {e}", path.display())).map(|b| (path, b)))
+            .and_then(|(path, bytes)| {
+                if sha256::hex(&bytes) != p.sha256 {
+                    return Err("the installed file changed since it was installed (SHA-256 differs): install it again".into());
+                }
+                loader(&bytes, &path.to_string_lossy())
+            });
+        match r {
+            Ok(mut v) => {
+                set(&s.library.status, |st| {
+                    st.loaded.insert(id.clone(), p.version.clone());
+                });
+                v["package"] = json!(id);
+                v["packageVersion"] = json!(p.version);
+                loaded.push(v);
+            }
+            Err(e) => {
+                log::warn!("plug-in library: {id} not loaded: {e}");
+                errors.push(json!({"package": id, "error": e}));
+            }
+        }
+    }
+    Ok(json!({"loaded": loaded, "errors": errors}))
+}
+
+/// Download `rel` of `pkg` (temporary files in `dir`) and check it against the catalog.
+fn download(dir: &Path, catalog_url: &str, pkg: &Package, rel: &Release) -> std::result::Result<Vec<u8>, String> {
+    let src = source(&rel.url, Some(catalog_url))?;
+    let bytes = fetch(&src, MAX_MODULE, dir)?;
+    if rel.size.is_some_and(|n| n != bytes.len() as u64) || sha256::hex(&bytes) != rel.sha256 {
+        return Err(format!("the downloaded file isn't the one the catalog lists for {} {} (size or SHA-256 differs)", pkg.name, rel.version));
+    }
+    Ok(bytes)
+}
+
+/// Download, check, write and load `rel` of `pkg` (the worker's job).
+fn install_job(
+    dir: &Path,
+    catalog_url: &str,
+    pkg: &Package,
+    rel: &Release,
+    loader: PluginLoader,
+    previewer: Option<PluginPreviewer>,
+    status: &Arc<Mutex<Status>>,
+) -> std::result::Result<String, String> {
+    let bytes = download(dir, catalog_url, pkg, rel)?;
+    let file = format!("{}/{}/{}.wasm", pkg.id, rel.version, pkg.id);
+    let path = module_path(dir, &file).ok_or_else(|| format!("bad package id `{}`", pkg.id))?;
+    let previous = status.lock().ok().and_then(|s| s.loaded.get(&pkg.id).cloned());
+    let restart = match previous {
+        // Its effects are registered already: the new version loads at the next start. It is
+        // still checked now (without registering it), so the version it replaces isn't deleted
+        // for one that won't load.
+        Some(v) => {
+            if let Some(check) = previewer {
+                check(&bytes, 1, 1, &[[0.0; 4]], &[]).map_err(|e| format!("{} {} didn't load: {e}", pkg.name, rel.version))?;
+            }
+            v != rel.version
+        }
+        // Loaded before anything is written, so a module that fails leaves the disk as it was.
+        None => {
+            loader(&bytes, &path.to_string_lossy()).map_err(|e| format!("{} {} didn't load: {e}", pkg.name, rel.version))?;
+            set(status, |s| {
+                s.loaded.insert(pkg.id.clone(), rel.version.clone());
+            });
+            false
+        }
+    };
+    {
+        use crate::config::FileOps;
+        crate::config::StdFiles.write(&path, &bytes).map_err(|e| format!("cannot write {}: {e}", path.display()))?;
+    }
+    let mut inst = read_installed(dir);
+    let old =
+        inst.packages.insert(pkg.id.clone(), InstalledPackage { version: rel.version.clone(), file, sha256: rel.sha256.clone(), effects: rel.effects.clone() });
+    write_installed(dir, &inst)?;
+    // `installed.json` may be hand-edited: only a real version names a folder to delete.
+    if let Some(old) = old.filter(|o| o.version != rel.version && version_key(&o.version).is_some()) {
+        let _ = std::fs::remove_dir_all(dir.join(&pkg.id).join(&old.version));
+    }
+    set(status, |s| {
+        if restart {
+            s.restart.insert(pkg.id.clone());
+        } else {
+            s.restart.remove(&pkg.id);
+        }
+    });
+    Ok(if restart {
+        format!("{} {} installed: restart EffectCraft to use it", pkg.name, rel.version)
+    } else {
+        format!("{} {} installed", pkg.name, rel.version)
+    })
+}
+
+/// Run `job` on a worker thread (`wait`: right here), reporting through `status`.
+fn spawn(status: &Arc<Mutex<Status>>, what: String, wait: bool, job: impl FnOnce(&Arc<Mutex<Status>>) -> std::result::Result<String, String> + Send + 'static) {
+    set(status, |s| {
+        s.busy = Some(what);
+        s.error = None;
+    });
+    let st = status.clone();
+    let run = move || {
+        // A panic in a job (a hostile module, say) must not leave the library busy for good.
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| job(&st))).unwrap_or_else(|_| Err("the job stopped unexpectedly".into()));
+        set(&st, |s| {
+            s.busy = None;
+            match r {
+                // An empty message: nothing to toast (the result shows where it was asked for).
+                Ok(msg) if msg.is_empty() => {}
+                Ok(msg) => s.done = Some((msg, false)),
+                Err(e) => {
+                    s.done = Some((format!("Plug-in Library: {e}"), true));
+                    s.error = Some(e);
+                }
+            }
+        });
+    };
+    if wait {
+        run();
+    } else if let Err(e) = std::thread::Builder::new().name("ec-library".into()).spawn(run) {
+        set(status, |s| {
+            s.busy = None;
+            s.error = Some(format!("cannot start: {e}"));
+        });
+    }
+}
+
+// ---------------------------------------------------------------- commands
+
+/// The library needs files and `curl`: not in the web build.
+fn desktop_only(c: &str) -> Result<()> {
+    if cfg!(target_arch = "wasm32") {
+        return Err(bad(c, "the Plug-in Library is available in the desktop app"));
+    }
+    Ok(())
+}
+
+/// Fails while the worker runs a job (it takes one at a time).
+fn idle(s: &Session, c: &str) -> Result<()> {
+    match s.library.status().busy {
+        Some(b) => Err(bad(c, format!("the Plug-in Library is busy ({b})"))),
+        None => Ok(()),
+    }
+}
+
+/// After a `wait`: the job's failure, as the command's.
+fn waited(s: &Session, c: &str) -> Result<()> {
+    match s.library.status().error {
+        Some(e) => Err(bad(c, e)),
+        None => Ok(()),
+    }
+}
+
+/// The catalog in memory, else the one cached on disk.
+fn catalog(s: &Session) -> Option<(String, Arc<Catalog>)> {
+    if let Some(c) = s.library.status().catalog {
+        return Some(c);
+    }
+    let dir = s.library_dir()?;
+    let cache: Cache = serde_json::from_slice(&std::fs::read(dir.join(CACHE_FILE)).ok()?).ok()?;
+    let (cat, _) = parse_catalog(&serde_json::to_vec(&cache.catalog).ok()?).ok()?;
+    let c = (cache.url, Arc::new(cat));
+    set(&s.library.status, |st| {
+        st.catalog = Some(c.clone());
+        st.fetched = Some(cache.fetched);
+    });
+    Some(c)
+}
+
+/// `library.refresh`: fetch the catalog (`catalog`, else the community one) and keep a copy for offline use.
+fn refresh(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "library.refresh";
+    desktop_only(c)?;
+    idle(s, c)?;
+    let url = str_p(p, "catalog").unwrap_or(CATALOG_URL).to_string();
+    let src = source(&url, None).map_err(|e| bad(c, e))?;
+    let dir = s.library_dir().ok_or_else(|| bad(c, "no settings folder for the Plug-in Library"))?;
+    let wait = b_p(p, "wait").unwrap_or(false);
+    spawn(&s.library.status, "Fetching the plug-in catalog…".into(), wait, move |st| {
+        let bytes = fetch(&src, MAX_CATALOG, &dir)?;
+        let (cat, warnings) = parse_catalog(&bytes)?;
+        for w in &warnings {
+            log::warn!("plug-in catalog: {w}");
+        }
+        let secs = web_time::SystemTime::now().duration_since(web_time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
+        let fetched = chrono::DateTime::from_timestamp(i64::try_from(secs).unwrap_or(0), 0).map(|t| t.to_rfc3339()).unwrap_or_default();
+        let cache = Cache { url: url.clone(), fetched: fetched.clone(), catalog: cat.clone() };
+        if let Ok(text) = serde_json::to_vec(&cache) {
+            use crate::config::FileOps;
+            if let Err(e) = crate::config::StdFiles.write(&dir.join(CACHE_FILE), &text) {
+                log::warn!("plug-in catalog: cannot keep a copy: {e}");
+            }
+        }
+        let n = cat.packages.len();
+        set(st, |s| {
+            s.catalog = Some((url, Arc::new(cat)));
+            s.fetched = Some(fetched);
+        });
+        Ok(format!("Plug-in catalog: {n} package(s)"))
+    });
+    if wait {
+        waited(s, c)?;
+        let n = s.library.status().catalog.map_or(0, |(_, c)| c.packages.len());
+        return Ok(json!({"packages": n}));
+    }
+    Ok(json!({"refreshing": true}))
+}
+
+/// `q` (case-insensitive) is in the package's id, name, author, description, tags or effect ids.
+fn matches(p: &Package, q: &str) -> bool {
+    let q = q.to_lowercase();
+    let latest = p.versions.iter().flat_map(|r| r.effects.iter());
+    [&p.id, &p.name, &p.author, &p.description].into_iter().chain(p.tags.iter()).chain(latest).any(|f| f.to_lowercase().contains(&q))
+}
+
+/// One package as `library.list` reports it.
+fn package_json(p: &Package, inst: Option<&InstalledPackage>, st: &Status) -> Value {
+    let latest = latest_compatible(p);
+    let newest_any = p.versions.iter().map(|r| r.version.as_str()).fold(None, |b: Option<&str>, v| if b.is_none_or(|b| newer(v, b)) { Some(v) } else { b });
+    json!({
+        "id": p.id,
+        "name": p.name,
+        "author": p.author,
+        "description": p.description,
+        "license": p.license,
+        "repo": p.repo,
+        "tags": p.tags,
+        "latest": latest.map(|r| r.version.clone()),
+        "size": latest.and_then(|r| r.size),
+        "effects": latest.map(|r| r.effects.clone()).unwrap_or_default(),
+        // A newer release this build can't run (it needs a newer EffectCraft or plug-in API).
+        "needsNewerApp": newest_any.is_some_and(|v| latest.is_none_or(|l| newer(v, &l.version))),
+        "installed": inst.map(|i| i.version.clone()),
+        "updateAvailable": matches!((inst, latest), (Some(i), Some(l)) if newer(&l.version, &i.version)),
+        "loaded": st.loaded.get(&p.id),
+        "restartNeeded": st.restart.contains(&p.id),
+        "video": p.preview.as_ref().and_then(|v| v.video.clone()),
+        // `library.preview` rendered it (this session).
+        "previewed": st.preview.as_ref().is_some_and(|v| v.id == p.id),
+    })
+}
+
+/// `library.list`: the catalog packages with their install state, filtered, and installed ones it no longer lists.
+fn list(s: &mut Session, p: &Value) -> Result<Value> {
+    let cat = catalog(s);
+    let st = s.library.status();
+    let dir = s.library_dir();
+    let inst = dir.as_deref().map(read_installed).unwrap_or_default();
+    let (query, tag, only_installed) = (str_p(p, "query").unwrap_or("").trim(), str_p(p, "tag"), b_p(p, "installed").unwrap_or(false));
+    let mut v = vec![];
+    let mut known = BTreeSet::new();
+    let mut tags = BTreeSet::new();
+    if let Some((_, c)) = &cat {
+        for pkg in &c.packages {
+            known.insert(pkg.id.as_str());
+            tags.extend(pkg.tags.iter().cloned());
+            let i = inst.packages.get(&pkg.id);
+            if (only_installed && i.is_none()) || (!query.is_empty() && !matches(pkg, query)) || tag.is_some_and(|t| !pkg.tags.iter().any(|x| x == t)) {
+                continue;
+            }
+            v.push(package_json(pkg, i, &st));
+        }
+    }
+    // Installed packages the catalog no longer lists (or no catalog yet).
+    for (id, i) in &inst.packages {
+        if known.contains(id.as_str()) || (!query.is_empty() && !id.to_lowercase().contains(&query.to_lowercase())) || tag.is_some() {
+            continue;
+        }
+        let pkg = Package { id: id.clone(), name: id.clone(), ..Default::default() };
+        let mut j = package_json(&pkg, Some(i), &st);
+        j["effects"] = json!(i.effects);
+        j["unlisted"] = json!(true);
+        v.push(j);
+    }
+    Ok(json!({
+        "catalog": cat.as_ref().map(|(u, _)| u.clone()),
+        "fetched": st.fetched,
+        "packages": v,
+        "tags": tags,
+        "busy": st.busy,
+        "error": st.error,
+        "folder": dir.map(|d| d.display().to_string()),
+        "available": !cfg!(target_arch = "wasm32") && s.plugin_loader.is_some(),
+    }))
+}
+
+/// `library.install`: download, check and load a release (`version`, else the newest compatible).
+fn install(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "library.install";
+    desktop_only(c)?;
+    idle(s, c)?;
+    let loader = s.plugin_loader.ok_or_else(|| bad(c, "WebAssembly effect plug-ins are not available in this build"))?;
+    let previewer = s.plugin_previewer;
+    let (url, pkg, rel) = pick(s, c, p)?;
+    let dir = s.library_dir().ok_or_else(|| bad(c, "no settings folder to install into"))?;
+    let wait = b_p(p, "wait").unwrap_or(false);
+    let what = format!("Installing {} {}…", pkg.name, rel.version);
+    let (pid, version) = (pkg.id.clone(), rel.version.clone());
+    spawn(&s.library.status, what, wait, move |st| install_job(&dir, &url, &pkg, &rel, loader, previewer, st));
+    if wait {
+        waited(s, c)?;
+        let st = s.library.status();
+        return Ok(json!({"id": pid, "version": version, "installed": true, "restartNeeded": st.restart.contains(&pid)}));
+    }
+    Ok(json!({"id": pid, "version": version, "installing": true}))
+}
+
+/// The catalog's URL, the package `id` names and its release: `version`, else the newest this
+/// build runs. The release's URL is checked against the rules here, so the command fails rather
+/// than the worker.
+fn pick(s: &Session, c: &str, p: &Value) -> Result<(String, Package, Release)> {
+    let id = str_p(p, "id").ok_or_else(|| bad(c, "missing `id` (a package in library.list)"))?;
+    let (url, cat) = catalog(s).ok_or_else(|| bad(c, "no plug-in catalog yet: run library.refresh"))?;
+    let pkg = cat.packages.iter().find(|x| x.id == id).cloned().ok_or_else(|| bad(c, format!("the catalog has no package `{id}`")))?;
+    let rel = match str_p(p, "version") {
+        Some(v) => pkg.versions.iter().find(|r| r.version == v).cloned().ok_or_else(|| bad(c, format!("{} has no version {v}", pkg.name)))?,
+        None => {
+            latest_compatible(&pkg).cloned().ok_or_else(|| bad(c, format!("{} has no release for this EffectCraft (plug-in API or app version)", pkg.name)))?
+        }
+    };
+    if !runs_here(&rel) {
+        return Err(bad(
+            c,
+            format!(
+                "{} {} needs WebAssembly ABI {} and EffectCraft {} or later; this is EffectCraft {} with WebAssembly ABI {} to {}",
+                pkg.name,
+                rel.version,
+                rel.api,
+                rel.min_app.as_deref().unwrap_or("(any)"),
+                env!("CARGO_PKG_VERSION"),
+                crate::effects::plugin::MIN_WASM_API_VERSION,
+                crate::effects::plugin::WASM_API_VERSION
+            ),
+        ));
+    }
+    source(&rel.url, Some(&url)).map_err(|e| bad(c, e))?;
+    Ok((url, pkg, rel))
+}
+
+const PREVIEW_W: u32 = 320;
+const PREVIEW_H: u32 = 180;
+const PREVIEW_FPS: f64 = 12.0;
+const PREVIEW_FRAMES: usize = 24;
+
+/// The preview's sample frame (opaque, premultiplied RGBA): a colour gradient with two discs and
+/// a band of fine stripes, so colour, blur, edge and distortion effects all show.
+fn sample_frame() -> Vec<[f32; 4]> {
+    let (w, h) = (PREVIEW_W as f32, PREVIEW_H as f32);
+    let mut px = Vec::with_capacity((PREVIEW_W * PREVIEW_H) as usize);
+    for y in 0..PREVIEW_H {
+        for x in 0..PREVIEW_W {
+            let (u, v) = (x as f32 / w, y as f32 / h);
+            let mut c = [0.15 + 0.7 * u, 0.2 + 0.5 * v, 0.85 - 0.6 * u];
+            for (cx, cy, r, col) in [(0.3, 0.42, 0.24, [1.0, 0.85, 0.2]), (0.68, 0.5, 0.18, [0.95, 0.25, 0.35])] {
+                // Coverage with a one-pixel soft edge.
+                let a = (r * h - ((u - cx) * w).hypot((v - cy) * h)).clamp(0.0, 1.0);
+                for (ch, k) in c.iter_mut().zip(col) {
+                    *ch += (k - *ch) * a;
+                }
+            }
+            if v > 0.82 {
+                let s = if (x / 4) % 2 == 0 { 0.95 } else { 0.05 };
+                c = [s; 3];
+            }
+            px.push([c[0], c[1], c[2], 1.0]);
+        }
+    }
+    px
+}
+
+/// Premultiplied float pixels as straight RGBA8.
+fn to_rgba8(px: &[[f32; 4]]) -> Vec<u8> {
+    let byte = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
+    px.iter()
+        .flat_map(|p| {
+            let a = p[3].clamp(0.0, 1.0);
+            let un = |c: f32| if a > 0.0 { c / a } else { 0.0 };
+            [byte(un(p[0])), byte(un(p[1])), byte(un(p[2])), byte(a)]
+        })
+        .collect()
+}
+
+/// `library.preview`'s reply: size, frame count, whether the effect changes anything, and the manifest.
+fn preview_json(v: &Preview) -> Value {
+    json!({
+        "id": v.id,
+        "version": v.version,
+        "width": v.width,
+        "height": v.height,
+        "fps": v.fps,
+        "frames": v.frames.len(),
+        // Whether the effect changes the sample frame at all, and over time.
+        "changes": v.frames.iter().any(|f| *f != v.before),
+        "animated": v.frames.windows(2).any(|w| w.first() != w.last()),
+        "effect": v.manifest,
+    })
+}
+
+/// Render a package's effect on the sample frame without installing it.
+fn preview(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "library.preview";
+    desktop_only(c)?;
+    let previewer = s.plugin_previewer.ok_or_else(|| bad(c, "WebAssembly effect plug-ins are not available in this build"))?;
+    let (url, pkg, rel) = pick(s, c, p)?;
+    let same = |v: &Preview| v.id == pkg.id && v.version == rel.version;
+    if let Some(v) = s.library.status().preview.filter(|v| same(v)) {
+        return Ok(preview_json(&v));
+    }
+    idle(s, c)?;
+    let dir = s.library_dir().ok_or_else(|| bad(c, "no settings folder for the Plug-in Library"))?;
+    let wait = b_p(p, "wait").unwrap_or(false);
+    let (pid, version) = (pkg.id.clone(), rel.version.clone());
+    spawn(&s.library.status, format!("Previewing {} {}…", pkg.name, rel.version), wait, move |st| {
+        let bytes = download(&dir, &url, &pkg, &rel)?;
+        let before = sample_frame();
+        let times: Vec<f64> = (0..PREVIEW_FRAMES).map(|i| i as f64 / PREVIEW_FPS).collect();
+        let (manifest, frames) =
+            previewer(&bytes, PREVIEW_W, PREVIEW_H, &before, &times).map_err(|e| format!("{} {} didn't render: {e}", pkg.name, rel.version))?;
+        let v = Preview {
+            id: pkg.id,
+            version: rel.version,
+            width: PREVIEW_W,
+            height: PREVIEW_H,
+            fps: PREVIEW_FPS,
+            before: to_rgba8(&before),
+            frames: frames.iter().map(|f| to_rgba8(f)).collect(),
+            manifest,
+        };
+        set(st, |s| s.preview = Some(Arc::new(v)));
+        Ok(String::new())
+    });
+    if wait {
+        waited(s, c)?;
+        if let Some(v) = s.library.status().preview.filter(|v| v.id == pid && v.version == version) {
+            return Ok(preview_json(&v));
+        }
+    }
+    Ok(json!({"id": pid, "version": version, "previewing": true}))
+}
+
+/// `library.update`: install the newest compatible release of every package (or `id`) with an update.
+fn update(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "library.update";
+    let list = list(s, &json!({"installed": true}))?;
+    let due: Vec<String> = list["packages"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .filter(|x| x["updateAvailable"].as_bool().unwrap_or(false))
+        .filter_map(|x| x["id"].as_str().map(str::to_string))
+        .filter(|x| str_p(p, "id").is_none_or(|want| want == x))
+        .collect();
+    if due.is_empty() {
+        return Ok(json!({"updating": []}));
+    }
+    desktop_only(c)?;
+    idle(s, c)?;
+    let loader = s.plugin_loader.ok_or_else(|| bad(c, "WebAssembly effect plug-ins are not available in this build"))?;
+    let previewer = s.plugin_previewer;
+    // A package that can't be updated doesn't hold back the others.
+    let (mut jobs, mut failed) = (vec![], vec![]);
+    for id in &due {
+        match pick(s, c, &json!({"id": id})) {
+            Ok(job) => jobs.push(job),
+            Err(e) => failed.push(e.to_string()),
+        }
+    }
+    let dir = s.library_dir().ok_or_else(|| bad(c, "no settings folder to install into"))?;
+    let wait = b_p(p, "wait").unwrap_or(false);
+    // One job for all of them: the worker runs one job at a time.
+    spawn(&s.library.status, format!("Updating {} plug-in(s)…", due.len()), wait, move |st| {
+        let mut done = vec![];
+        for (url, pkg, rel) in &jobs {
+            match install_job(&dir, url, pkg, rel, loader, previewer, st) {
+                Ok(msg) => done.push(msg),
+                Err(e) => failed.push(e),
+            }
+        }
+        match (done.is_empty(), failed.is_empty()) {
+            (_, true) => Ok(done.join("; ")),
+            (true, false) => Err(failed.join("; ")),
+            (false, false) => Err(format!("{}; not updated: {}", done.join("; "), failed.join("; "))),
+        }
+    });
+    if wait {
+        waited(s, c)?;
+    }
+    Ok(json!({"updating": due}))
+}
+
+/// `library.uninstall`: forget the package and delete its folder; loaded effects stay until restart.
+fn uninstall(s: &mut Session, p: &Value) -> Result<Value> {
+    let c = "library.uninstall";
+    idle(s, c)?;
+    let id = str_p(p, "id").ok_or_else(|| bad(c, "missing `id`"))?;
+    let dir = s.library_dir().ok_or_else(|| bad(c, "no settings folder"))?;
+    let mut inst = read_installed(&dir);
+    if inst.packages.remove(id).is_none() {
+        return Ok(json!({"removed": false}));
+    }
+    write_installed(&dir, &inst).map_err(|e| bad(c, e))?;
+    // It is uninstalled either way (it no longer loads); a folder left behind is only disk space.
+    if valid_id(id)
+        && let Err(e) = std::fs::remove_dir_all(dir.join(id))
+    {
+        log::warn!("plug-in library: cannot remove the folder of {id}: {e}");
+    }
+    let restart = s.library.status().loaded.contains_key(id);
+    set(&s.library.status, |st| {
+        if restart {
+            st.restart.insert(id.to_string());
+        }
+    });
+    s.toast(if restart { format!("Removed {id}: its effects stay until you restart EffectCraft") } else { format!("Removed {id}") });
+    Ok(json!({"removed": true, "restartNeeded": restart}))
+}
+
+/// Effects used in the project that aren't registered, with the catalog packages that provide them.
+fn missing(s: &mut Session, _: &Value) -> Result<Value> {
+    let mut effects = BTreeSet::new();
+    for (_, comp) in s.project.comps() {
+        for l in &comp.layers {
+            for g in l.effects().into_iter().flat_map(|fx| fx.groups()) {
+                if let effectcraft_project::GroupKind::Effect { effect } = &g.kind
+                    && crate::effects::find(effect).is_none()
+                {
+                    effects.insert(effect.clone());
+                }
+            }
+        }
+    }
+    let cat = catalog(s);
+    let found: Vec<Value> = effects
+        .iter()
+        .map(|e| {
+            let pkgs: Vec<&str> = cat
+                .iter()
+                .flat_map(|(_, c)| c.packages.iter())
+                .filter(|p| latest_compatible(p).is_some_and(|r| r.effects.iter().any(|x| x == e)))
+                .map(|p| p.id.as_str())
+                .collect();
+            json!({"effect": e, "packages": pkgs})
+        })
+        .collect();
+    Ok(json!({"effects": found}))
+}
+
+/// The `library.*` commands.
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        query!(
+            "library.list",
+            "Plug-in Library",
+            "{query?, tag?, installed?: bool} → {catalog, fetched, packages: [{id, name, author, description, license, repo, tags, latest, effects, installed, updateAvailable, needsNewerApp, loaded, restartNeeded, video, previewed, unlisted?}], tags, busy, error, folder, available}",
+            list
+        ),
+        query!(
+            "library.missing",
+            "Missing Effects in the Plug-in Library",
+            "{} → {effects: [{effect, packages: [package id]}]} — effects the project uses that aren't installed, and the catalog packages that provide them",
+            missing
+        ),
+        cmd!(
+            "library.refresh",
+            "Refresh Plug-in Catalog",
+            [],
+            None,
+            "{catalog?: https:// or file:// URL of an index.json (default: the community catalog), wait?}",
+            always,
+            refresh
+        ),
+        cmd!(
+            "library.preview",
+            "Preview Plug-in",
+            [],
+            None,
+            "{id, version?, wait?} → {id, version, width, height, fps, frames, changes, animated, effect: manifest} — downloads the release (checked like an install) and renders its effect on a sample frame at default settings, without installing it",
+            always,
+            preview
+        ),
+        cmd!(
+            "library.install",
+            "Install Plug-in",
+            [],
+            None,
+            "{id, version?, wait?} — downloads the release, checks its SHA-256 against the catalog, loads it",
+            always,
+            install
+        ),
+        cmd!("library.update", "Update Plug-ins", [], None, "{id? (default: every package with an update), wait?}", always, update),
+        cmd!("library.uninstall", "Remove Plug-in", [], None, "{id} — its effects stay registered until the next start", always, uninstall),
+        cmd!("library.loadInstalled", "Load Installed Plug-ins", [], None, "{} → {loaded, errors} (the app runs it at start-up)", always, |s, _| {
+            load_installed(s)
+        }),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A release of `version` for `api`, with a valid GitHub URL and checksum.
+    fn rel(version: &str, api: u32, min_app: Option<&str>) -> Release {
+        Release {
+            version: version.into(),
+            api,
+            min_app: min_app.map(Into::into),
+            url: "https://github.com/a/b/x.wasm".into(),
+            sha256: "a".repeat(64),
+            size: None,
+            effects: vec![],
+        }
+    }
+
+    #[test]
+    fn versions_compare_numerically() {
+        assert!(newer("1.10.0", "1.9.9"));
+        assert!(!newer("1.0", "1.0.0"));
+        assert!(!newer("1.0.0", "1.0"));
+        assert!(newer("2", "1.99"));
+        assert!(!newer("x", "1.0"));
+        assert_eq!(version_key("1..2"), None);
+        assert_eq!(version_key("-1"), None);
+        assert_eq!(version_key(&"9".repeat(40)), None);
+    }
+
+    #[test]
+    fn ids_are_safe_folder_names() {
+        for ok in ["org.example.glow", "a", "glow-pack_2"] {
+            assert!(valid_id(ok), "{ok}");
+        }
+        for no in ["", ".hidden", "a.", "a/../b", "a\\b", "..", "a..b", "c:", "x y", &"a".repeat(101)] {
+            assert!(!valid_id(no), "{no}");
+        }
+    }
+
+    #[test]
+    fn ids_that_differ_only_in_case_are_one_package() {
+        let pkg = |id: &str| json!({"id": id, "name": "Glow", "versions": []});
+        let bytes = serde_json::to_vec(&json!({"schema": 1, "packages": [pkg("Org.X.Glow"), pkg("org.x.glow")]})).unwrap();
+        let (cat, warnings) = parse_catalog(&bytes).unwrap();
+        assert_eq!(cat.packages.len(), 1);
+        assert_eq!(cat.packages[0].id, "Org.X.Glow");
+        assert!(warnings.iter().any(|w| w.contains("second package `org.x.glow`")), "{warnings:?}");
+    }
+
+    #[test]
+    fn the_newest_compatible_release_wins() {
+        let api = crate::effects::plugin::WASM_API_VERSION;
+        let p = Package {
+            versions: vec![
+                rel("1.0.0", api, None),
+                rel("1.2.0", api, Some("0.1")),
+                rel("1.1.0", api, None),
+                rel("9.0.0", api, Some("999.0")),
+                rel("3.0.0", api + 1, None),
+                rel("4.0.0", 0, None),
+            ],
+            ..Default::default()
+        };
+        assert_eq!(latest_compatible(&p).map(|r| r.version.as_str()), Some("1.2.0"));
+        assert!(runs_here(&rel("1.0.0", 1, None)), "ABI 1 modules still run on a build with a newer ABI");
+        assert!(runs_here(&rel("1.0.0", 2, None)), "ABI 2 modules run on this build");
+        assert!(!runs_here(&rel("1.0.0", 3, None)), "a WebAssembly ABI this build doesn't implement can't load");
+        let j = package_json(&p, None, &Status::default());
+        assert_eq!(j["needsNewerApp"], true);
+        assert!(latest_compatible(&Package::default()).is_none());
+    }
+
+    #[test]
+    fn catalogs_leave_out_bad_entries() {
+        let good = "a".repeat(64);
+        let text = json!({"schema": 1, "packages": [
+            {"id": "org.ok", "name": "Ok", "versions": [
+                {"version": "1.0.0", "api": 1, "url": "https://github.com/x", "sha256": good.to_uppercase()},
+                {"version": "nope", "api": 1, "url": "https://github.com/x", "sha256": good},
+                {"version": "1.1.0", "api": 1, "url": "https://github.com/x", "sha256": "short"}
+            ]},
+            {"id": "org.ok", "name": "Second"},
+            {"id": "../evil", "name": "Evil"},
+            {"id": "org.noname", "name": " "},
+            {"id": "org.extra", "name": "Extra", "unknownField": true}
+        ]});
+        let (c, warnings) = parse_catalog(text.to_string().as_bytes()).unwrap();
+        let ids: Vec<&str> = c.packages.iter().map(|p| p.id.as_str()).collect();
+        assert_eq!(ids, ["org.ok", "org.extra"]);
+        assert_eq!(c.packages[0].versions.len(), 1);
+        assert_eq!(c.packages[0].versions[0].sha256, good, "checksums are kept in lower case");
+        assert_eq!(warnings.len(), 5, "{warnings:?}");
+        assert!(parse_catalog(br#"{"schema": 2, "packages": []}"#).unwrap_err().contains("update EffectCraft"));
+        assert!(parse_catalog(b"not json").is_err());
+        assert!(parse_catalog(&vec![b' '; (MAX_CATALOG + 1) as usize]).unwrap_err().contains("larger"));
+    }
+
+    #[test]
+    fn only_github_https_and_local_catalog_files_are_fetched() {
+        assert!(matches!(source("https://github.com/a/b/releases/download/v1/x.wasm", Some(CATALOG_URL)), Ok(Source::Https(_))));
+        assert!(matches!(source("https://GitHub.com/a", Some(CATALOG_URL)), Ok(Source::Https(_))));
+        for no in [
+            "http://github.com/a",
+            "https://example.com/x.wasm",
+            "https://github.com.evil.com/x",
+            "https://user@github.com/x",
+            "https://github.com:8443/x",
+            "ftp://github.com/x",
+        ] {
+            assert!(source(no, Some(CATALOG_URL)).is_err(), "{no}");
+        }
+        // file:// only from a local catalog (or as the catalog).
+        assert!(source("file:///tmp/x.wasm", Some(CATALOG_URL)).is_err());
+        assert_eq!(source("file:///tmp/x.wasm", Some("file:///tmp/index.json")), Ok(Source::File(PathBuf::from("/tmp/x.wasm"))));
+        assert_eq!(source("file:///C:/p/x.wasm", None), Ok(Source::File(PathBuf::from("C:/p/x.wasm"))));
+        assert!(source("file://", None).is_err());
+        // Percent-decoded; no remote hosts.
+        assert_eq!(file_url_path("file:///C:/My%20Plug-ins/Jos%C3%A9%23.wasm"), Some(PathBuf::from("C:/My Plug-ins/José#.wasm")));
+        assert_eq!(file_url_path("file://localhost/home/x.wasm"), Some(PathBuf::from("/home/x.wasm")));
+        for no in ["file://server/share/x.wasm", "file:///bad%2", "file:///bad%zz"] {
+            assert_eq!(file_url_path(no), None, "{no}");
+        }
+    }
+
+    #[test]
+    fn the_sample_frame_round_trips_to_rgba8() {
+        let f = sample_frame();
+        assert_eq!(f.len(), (PREVIEW_W * PREVIEW_H) as usize);
+        assert!(f.iter().all(|p| p[3] == 1.0));
+        assert_eq!(to_rgba8(&[[0.5, 0.25, 0.0, 0.5], [1.0, 2.0, -1.0, 0.0]]), [255, 128, 0, 128, 0, 0, 0, 0]);
+    }
+
+    #[test]
+    fn module_paths_stay_in_the_library() {
+        let d = Path::new("lib");
+        assert_eq!(module_path(d, "a/1.0/a.wasm"), Some(d.join("a").join("1.0").join("a.wasm")));
+        for no in ["../x/a.wasm", "a/../a.wasm", "a/1/..", "a.wasm", "a/1/b/c.wasm", "a//a.wasm", "C:/x/a.wasm", "a\\..\\b/1/x"] {
+            assert_eq!(module_path(d, no), None, "{no}");
+        }
+    }
+}
diff --git a/crates/engine/src/logging.rs b/crates/engine/src/system/logging.rs
similarity index 80%
rename from crates/engine/src/logging.rs
rename to crates/engine/src/system/logging.rs
index 2c89466ae..857a3e90d 100644
--- a/crates/engine/src/logging.rs
+++ b/crates/engine/src/system/logging.rs
@@ -5,15 +5,15 @@
 //! terminal, so that file is what a bug report can attach. The last few hundred warnings and
 //! errors are also kept in memory for the System Compatibility Report.
 //!
-//! Levels: `info` for EffectCraft's own crates, `warn` for everything else (wgpu and naga are
-//! chatty). `RUST_LOG` replaces that (a level such as `debug`, or per target:
+//! Levels by default ([`DEFAULT_FILTER`]): `info` for EffectCraft's own crates, `warn` for
+//! everything else (wgpu and naga are chatty). `RUST_LOG` replaces that (a level such as `debug`, or per target:
 //! `effectcraft=debug,wgpu=warn`).
 //!
 //! Help ▸ Enable Logging ([`set_enabled`], the `help.enableLogging` command) additionally appends
 //! every EffectCraft record to `Logs/EffectCraft Log.txt`, across launches.
 //!
-//! Frontends call [`install`] once at startup and the desktop app [`attach_session_log`] once the
-//! settings folder is known; records logged before that are kept (up to [`MAX_PENDING`]) and
+//! Frontends call [`install`] (or [`install_with`] for another default, as the CLI does with `warn`)
+//! once at startup and the desktop app [`attach_session_log`] once the settings folder is known; records logged before that are kept (up to [`MAX_PENDING`]) and
 //! written first. Writing never panics: a file that can't be created or written leaves standard
 //! error as the only sink. Never log the control-channel token.
 
@@ -93,28 +93,34 @@ fn thread_name() -> String {
     return "main".to_string();
 }
 
-/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds) for `ms` milliseconds since 1970.
+/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds) for `ms` milliseconds since 1970. A clock set
+/// absurdly far ahead keeps its real year (preserved) instead of reading as the epoch.
 fn timestamp(ms: u64) -> String {
-    let secs = ms / 1000;
-    let (days, rem) = (secs / 86_400, secs % 86_400);
-    let (y, m, d) = civil_from_days(days);
-    format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, ms % 1000)
+    let (secs, millis) = (ms / 1000, (ms % 1000) as u32);
+    let (y, t) = utc_parts(secs, millis * 1_000_000);
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", t.format("%m-%dT%H:%M:%S%.3fZ"))
 }
 
-/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
-/// `civil_from_days`, unsigned since the clock is clamped at the epoch). `days` is at most
-/// `u64::MAX / 86_400_000`, so none of the arithmetic below can overflow.
-fn civil_from_days(days: u64) -> (u64, u64, u64) {
-    let z = days + 719_468;
-    let era = z / 146_097;
-    let doe = z % 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + u64::from(m <= 2);
-    (y, m, d)
+/// Unix seconds (+ nanos) → (proleptic Gregorian year, the same wall-clock instant moved into
+/// chrono's range by whole 400-year cycles). The Gregorian calendar repeats every 400 years
+/// (146_097 days), so month, day and time of day come from chrono and only the year is carried,
+/// which keeps every input exact instead of collapsing out-of-range years to the epoch. `secs` is
+/// `u64` (the clock is clamped at the epoch before 1970), so `days` always fits an `i64`.
+fn utc_parts(secs: u64, nanos: u32) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = ((secs / 86_400) as i64, (secs % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, nanos.min(999_999_999)));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
 }
 
 /// One log line (without the newline): `<timestamp> <LEVEL> [<thread>] <target>: <message>`.
@@ -125,11 +131,21 @@ fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message:
 
 /// Install the logger (once; later calls and other installed loggers are left alone).
 pub fn install() {
+    install_with(DEFAULT_FILTER);
+}
+
+/// The directive string: `RUST_LOG` when it is set and nonblank, otherwise `default`.
+fn filter_spec<'a>(rust_log: Option<&'a str>, default: &'a str) -> &'a str {
+    rust_log.filter(|s| !s.trim().is_empty()).unwrap_or(default)
+}
+
+/// [`install`] with `default` as the filter when `RUST_LOG` is unset or empty.
+pub fn install_with(default: &str) {
     static LOGGER: Logger = Logger;
     if log::set_logger(&LOGGER).is_ok() {
         let filter = FILTER.get_or_init(|| {
-            let spec = std::env::var("RUST_LOG").ok().filter(|s| !s.trim().is_empty());
-            parse_filter(spec.as_deref().unwrap_or(DEFAULT_FILTER))
+            let spec = std::env::var("RUST_LOG").ok();
+            parse_filter(filter_spec(spec.as_deref(), default))
         });
         log::set_max_level(filter.iter().map(|d| d.1).fold(LevelFilter::Info, Ord::max));
     }
@@ -351,6 +367,21 @@ mod tests {
         assert_eq!(level_for(&f, "naga"), LevelFilter::Warn);
     }
 
+    /// The CLI's default (`warn`): warnings from every crate, no info chatter on stderr,
+    /// while a nonblank `RUST_LOG` overrides `default`.
+    #[test]
+    fn the_cli_filter_shows_only_warnings() {
+        assert_eq!(filter_spec(None, "warn"), "warn");
+        assert_eq!(filter_spec(Some("  "), "warn"), "warn");
+        assert_eq!(filter_spec(Some("info"), "warn"), "info");
+        let f = parse_filter(filter_spec(None, "warn"));
+        assert_eq!(level_for(&f, "effectcraft_gpu::context"), LevelFilter::Warn);
+        assert_eq!(level_for(&f, "effectcraft_engine::render_queue"), LevelFilter::Warn);
+        assert_eq!(level_for(&f, "wgpu_core::device"), LevelFilter::Warn);
+        let over = parse_filter(filter_spec(Some("info"), "warn"));
+        assert_eq!(level_for(&over, "effectcraft_gpu::context"), LevelFilter::Info);
+    }
+
     #[test]
     fn timestamps_are_utc_with_milliseconds() {
         assert_eq!(timestamp(0), "1970-01-01T00:00:00.000Z");
@@ -358,7 +389,12 @@ mod tests {
         assert_eq!(timestamp(1_709_164_800_000), "2024-02-29T00:00:00.000Z");
         assert_eq!(timestamp(951_782_400_000), "2000-02-29T00:00:00.000Z");
         assert_eq!(timestamp(1_767_225_599_000), "2025-12-31T23:59:59.000Z");
-        let _ = timestamp(u64::MAX);
+        // Years past 9999 keep the plain zero-padded year (no `+`).
+        assert_eq!(timestamp(253_402_300_800_000), "10000-01-01T00:00:00.000Z");
+        // A clock absurdly far ahead keeps its real year (years far outside chrono's own range are
+        // preserved) instead of collapsing to the epoch (reviewer rule from the sibling PRs).
+        assert_eq!(timestamp(10_000_000_000_000_000), "318857-05-20T17:46:40.000Z");
+        assert_eq!(timestamp(u64::MAX), "584556019-04-03T14:25:51.615Z");
     }
 
     /// Each launch keeps the previous runs' logs, so the log of a run that crashed survives.
diff --git a/crates/engine/src/perf.rs b/crates/engine/src/system/perf.rs
similarity index 99%
rename from crates/engine/src/perf.rs
rename to crates/engine/src/system/perf.rs
index ab1723d9f..929726c95 100644
--- a/crates/engine/src/perf.rs
+++ b/crates/engine/src/system/perf.rs
@@ -180,7 +180,7 @@ pub fn large_project(spec: &LargeSpec) -> Project {
             *n += 1;
             layers.push(l);
         }
-        comp.layers = layers;
+        comp.layers = layers.into();
     };
     let others = spec.comps.saturating_sub(1);
     let depth = spec.nest_depth.min(others);
@@ -215,7 +215,7 @@ pub fn large_project(spec: &LargeSpec) -> Project {
         n += 1;
         layers.push(l);
     }
-    main.layers = layers;
+    main.layers = layers.into();
     p.add_item("Main", crate::color::Label::None, None, ItemKind::Comp(Arc::new(main)));
     // `Main` must be the first comp `replace_project` opens: give it the smallest id.
     let main_id = p.items.values().find(|i| i.name == "Main").map(|i| i.id).expect("main");
diff --git a/crates/engine/src/storage.rs b/crates/engine/src/system/storage.rs
similarity index 100%
rename from crates/engine/src/storage.rs
rename to crates/engine/src/system/storage.rs
diff --git a/crates/engine/src/system/sysinfo.rs b/crates/engine/src/system/sysinfo.rs
new file mode 100644
index 000000000..80b51b462
--- /dev/null
+++ b/crates/engine/src/system/sysinfo.rs
@@ -0,0 +1,449 @@
+//! Host information for Settings ▸ Memory & CPU (RAM reserved for other applications, reducing
+//! caches when the system is low on memory), the disk cache's free-space reserve and Help ▸
+//! System Compatibility Report.
+//!
+//! Pure Rust and dependency-free: the values come from the operating system's own reporting
+//! (`/proc/meminfo` on Linux, `sysctl`/`vm_stat` on macOS, `df` on Unix, `wmic`/PowerShell on
+//! Windows). Every query may fail (sandboxes, the web): callers treat `None` as "unknown" and
+//! keep their configured budgets. The periodic readings behind the cache budgets run on a
+//! background thread ([`Watch`]): on Windows they start PowerShell, which takes about a second.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex, PoisonError};
+
+use serde::Serialize;
+
+/// Physical memory in bytes.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize)]
+pub struct SysMemory {
+    pub total: u64,
+    /// Memory the system can hand out without swapping (free + reclaimable caches).
+    pub available: u64,
+}
+
+impl SysMemory {
+    /// The system is low on memory: less than 10% (or less than 1 GB) is available.
+    pub fn is_low(&self) -> bool {
+        self.total > 0 && (self.available < self.total / 10 || self.available < 1 << 30)
+    }
+}
+
+/// A system value read in the background: [`Watch::poll_with`] starts a reading (unless one is
+/// running) and [`Watch::latest`] returns the last one without waiting.
+#[derive(Clone)]
+pub struct Watch<T> {
+    latest: Arc<Mutex<Option<T>>>,
+    busy: Arc<AtomicBool>,
+}
+
+impl<T> Default for Watch<T> {
+    fn default() -> Self {
+        Watch { latest: Arc::new(Mutex::new(None)), busy: Arc::new(AtomicBool::new(false)) }
+    }
+}
+
+/// The system's memory ([`memory`]).
+pub type MemoryWatch = Watch<SysMemory>;
+/// The disk cache's free-space reading ([`disk_space`]): the reader applies it to its cache
+/// itself, so only the busy guard is used.
+pub type DiskWatch = Watch<()>;
+
+impl<T: Copy + Send + 'static> Watch<T> {
+    /// Start a new reading in the background on a thread called `name` (no threads on the web:
+    /// read inline, it is unknown there anyway).
+    pub fn poll_with(&self, name: &str, read: impl FnOnce() -> Option<T> + Send + 'static) {
+        if self.busy.swap(true, Ordering::AcqRel) {
+            return;
+        }
+        let (latest, busy) = (self.latest.clone(), self.busy.clone());
+        let read = move || {
+            // A failed reading clears the last one: a stale value is worse than none.
+            *latest.lock().unwrap_or_else(PoisonError::into_inner) = read();
+            busy.store(false, Ordering::Release);
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        if std::thread::Builder::new().name(name.into()).spawn(read).is_err() {
+            self.busy.store(false, Ordering::Release);
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            let _ = name;
+            read();
+        }
+    }
+
+    /// The last reading (`None` until one finished or when the last one failed).
+    pub fn latest(&self) -> Option<T> {
+        *self.latest.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+impl MemoryWatch {
+    /// Start a new reading of the system's memory in the background.
+    pub fn poll(&self) {
+        self.poll_with("ec-memory", memory);
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[allow(dead_code)]
+fn run(cmd: &str, args: &[&str]) -> Option<String> {
+    run_env(cmd, args, &[])
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[allow(dead_code)]
+fn run_env(cmd: &str, args: &[&str], env: &[(&str, &std::ffi::OsStr)]) -> Option<String> {
+    let mut c = std::process::Command::new(cmd);
+    c.args(args).envs(env.iter().copied());
+    // A console program started from the windowed app would flash a console window.
+    #[cfg(target_os = "windows")]
+    std::os::windows::process::CommandExt::creation_flags(&mut c, 0x0800_0000); // CREATE_NO_WINDOW
+    let out = c.output().ok()?;
+    out.status.success().then(|| String::from_utf8_lossy(&out.stdout).to_string())
+}
+
+/// Parse `/proc/meminfo` (kB values).
+pub fn parse_meminfo(text: &str) -> Option<SysMemory> {
+    let field = |name: &str| -> Option<u64> {
+        let line = text.lines().find(|l| l.starts_with(name))?;
+        let kb: u64 = line.split_whitespace().nth(1)?.parse().ok()?;
+        Some(kb * 1024)
+    };
+    let total = field("MemTotal:")?;
+    let available = field("MemAvailable:").or_else(|| Some(field("MemFree:")? + field("Cached:").unwrap_or(0)))?;
+    Some(SysMemory { total, available })
+}
+
+/// Parse macOS `vm_stat` output: free + inactive + speculative + purgeable pages.
+pub fn parse_vm_stat(text: &str, total: u64) -> Option<SysMemory> {
+    let page: u64 = text.split("page size of ").nth(1)?.split_whitespace().next()?.parse().ok()?;
+    let pages = |name: &str| -> u64 {
+        text.lines()
+            .find(|l| l.starts_with(name))
+            .and_then(|l| l.rsplit(':').next())
+            .and_then(|v| v.trim().trim_end_matches('.').parse::<u64>().ok())
+            .unwrap_or(0)
+    };
+    let free = pages("Pages free") + pages("Pages inactive") + pages("Pages speculative") + pages("Pages purgeable");
+    Some(SysMemory { total, available: (free * page).min(total) })
+}
+
+/// Parse `sysctl -n hw.physmem hw.pagesize vm.stats.vm.v_free_count vm.stats.vm.v_inactive_count`
+/// (FreeBSD: one number per line, in that order).
+pub fn parse_freebsd_sysctl(text: &str) -> Option<SysMemory> {
+    let mut it = text.split_whitespace().map(|v| v.parse::<u64>().ok());
+    let total = it.next()??;
+    let page = it.next()??;
+    let free = it.next()??.saturating_add(it.next()??);
+    Some(SysMemory { total, available: free.saturating_mul(page).min(total) })
+}
+
+/// Total and available physical memory, when the system reports them.
+pub fn memory() -> Option<SysMemory> {
+    #[cfg(target_os = "linux")]
+    {
+        return parse_meminfo(&std::fs::read_to_string("/proc/meminfo").ok()?);
+    }
+    #[cfg(target_os = "macos")]
+    {
+        let total: u64 = run("sysctl", &["-n", "hw.memsize"])?.trim().parse().ok()?;
+        return parse_vm_stat(&run("vm_stat", &[])?, total).or(Some(SysMemory { total, available: total }));
+    }
+    #[cfg(target_os = "freebsd")]
+    {
+        return parse_freebsd_sysctl(&run("sysctl", &["-n", "hw.physmem", "hw.pagesize", "vm.stats.vm.v_free_count", "vm.stats.vm.v_inactive_count"])?);
+    }
+    #[cfg(target_os = "windows")]
+    {
+        let text = run(
+            "powershell",
+            &["-NoProfile", "-Command", "$o=Get-CimInstance Win32_OperatingSystem; \"$($o.TotalVisibleMemorySize) $($o.FreePhysicalMemory)\""],
+        )?;
+        let mut it = text.split_whitespace().filter_map(|v| v.parse::<u64>().ok());
+        return Some(SysMemory { total: it.next()? * 1024, available: it.next()? * 1024 });
+    }
+    #[allow(unreachable_code)]
+    None
+}
+
+/// Parse `df -Pk` output: the disk's total and available bytes.
+pub fn parse_df(text: &str) -> Option<(u64, u64)> {
+    let line = text.lines().skip(1).find(|l| !l.trim().is_empty())?;
+    let f: Vec<&str> = line.split_whitespace().collect();
+    // A full disk into its root-reserved blocks reports negative numbers (Linux): none free.
+    let num = |v: &str| match v.strip_prefix('-') {
+        Some(d) => d.parse::<u64>().ok().map(|_| 0),
+        None => v.parse::<u64>().ok(),
+    };
+    // Size, used, available and capacity follow the device name (which may contain spaces).
+    let i = (0..f.len().saturating_sub(3))
+        .find(|&i| f.get(i + 3).is_some_and(|c| c.ends_with('%')) && f.get(i..i + 3).is_some_and(|n| n.iter().all(|v| num(v).is_some())))?;
+    let kb = |j: usize| f.get(j).and_then(|v| num(v)).map(|v| v.saturating_mul(1024));
+    Some((kb(i)?, kb(i + 2)?))
+}
+
+/// Total and available bytes of the disk holding `path`, when the system reports them.
+pub fn disk_space(path: &std::path::Path) -> Option<(u64, u64)> {
+    #[cfg(any(target_os = "linux", target_os = "macos", target_os = "freebsd"))]
+    {
+        return parse_df(&run("df", &["-Pk", &path.to_string_lossy()])?);
+    }
+    #[cfg(target_os = "windows")]
+    {
+        // The path goes through the environment: no quoting.
+        let text = run_env(
+            "powershell",
+            &["-NoProfile", "-Command", "$d=[IO.DriveInfo]::new($env:EC_DISK_PATH); \"$($d.TotalSize) $($d.AvailableFreeSpace)\""],
+            &[("EC_DISK_PATH", path.as_os_str())],
+        )?;
+        let mut it = text.split_whitespace().filter_map(|v| v.parse::<u64>().ok());
+        return Some((it.next()?, it.next()?));
+    }
+    #[allow(unreachable_code)]
+    {
+        let _ = path;
+        None
+    }
+}
+
+/// Whether `path` is on a RAM-backed filesystem (`tmpfs`/`ramfs`), where bytes written count
+/// against memory as well as space. Linux reads `/proc/self/mountinfo`; other systems report
+/// `false` (their temporary folders are disk-backed by default). `path` may not exist yet: its
+/// nearest existing ancestor decides, as when the fill creates its scratch folder.
+pub fn is_memory_backed(path: &std::path::Path) -> bool {
+    #[cfg(target_os = "linux")]
+    {
+        let Some(canonical) = canonical_ancestor(path) else { return false };
+        return std::fs::read_to_string("/proc/self/mountinfo").is_ok_and(|mountinfo| mountinfo_is_memory_backed(&mountinfo, &canonical));
+    }
+    #[allow(unreachable_code)]
+    {
+        let _ = path;
+        false
+    }
+}
+
+/// The canonical path of `path`'s nearest existing ancestor (or itself). Relative paths are
+/// resolved against the current directory first, so a new relative output folder still names
+/// the volume it will be created on.
+#[cfg(target_os = "linux")]
+fn canonical_ancestor(path: &std::path::Path) -> Option<std::path::PathBuf> {
+    let absolute = if path.is_absolute() { path.to_path_buf() } else { std::env::current_dir().ok()?.join(path) };
+    let mut p = absolute.as_path();
+    loop {
+        if let Ok(canonical) = std::fs::canonicalize(p) {
+            return Some(canonical);
+        }
+        p = p.parent()?;
+    }
+}
+
+/// Whether a `/proc/self/mountinfo` listing mounts `path` on `tmpfs` or `ramfs`; the deepest
+/// matching mount point wins, and a later entry at the same mount point is the visible one.
+#[cfg(target_os = "linux")]
+pub(crate) fn mountinfo_is_memory_backed(mountinfo: &str, path: &std::path::Path) -> bool {
+    let mut best: Option<(usize, &str)> = None;
+    for line in mountinfo.lines() {
+        let Some(mount) = line.split_whitespace().nth(4) else { continue };
+        let Some(fstype) = line.split(" - ").nth(1).and_then(|rest| rest.split_whitespace().next()) else { continue };
+        let mount = unescape_mount(mount);
+        if path.starts_with(&mount) && best.is_none_or(|(longest, _)| mount.len() >= longest) {
+            best = Some((mount.len(), fstype));
+        }
+    }
+    matches!(best, Some((_, "tmpfs" | "ramfs")))
+}
+
+/// Undo mountinfo's octal escapes (`\040` space, `\011` tab, `\012` newline, `\134` backslash).
+#[cfg(target_os = "linux")]
+fn unescape_mount(field: &str) -> String {
+    let mut out = String::with_capacity(field.len());
+    let mut chars = field.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c == '\\'
+            && chars.clone().take(3).count() == 3
+            && let Ok(code) = u8::from_str_radix(&chars.clone().take(3).collect::<String>(), 8)
+        {
+            for _ in 0..3 {
+                chars.next();
+            }
+            out.push(code as char);
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
+
+/// CPU model name.
+pub fn cpu_name() -> Option<String> {
+    #[cfg(target_os = "linux")]
+    {
+        let t = std::fs::read_to_string("/proc/cpuinfo").ok()?;
+        return t.lines().find(|l| l.starts_with("model name")).and_then(|l| l.split(':').nth(1)).map(|s| s.trim().to_string());
+    }
+    #[cfg(target_os = "macos")]
+    {
+        return run("sysctl", &["-n", "machdep.cpu.brand_string"]).map(|s| s.trim().to_string()).filter(|s| !s.is_empty());
+    }
+    #[cfg(target_os = "freebsd")]
+    {
+        return run("sysctl", &["-n", "hw.model"]).map(|s| s.trim().to_string()).filter(|s| !s.is_empty());
+    }
+    #[cfg(target_os = "windows")]
+    {
+        return std::env::var("PROCESSOR_IDENTIFIER").ok();
+    }
+    #[allow(unreachable_code)]
+    None
+}
+
+/// Operating system name and version.
+pub fn os_version() -> String {
+    #[cfg(target_os = "macos")]
+    if let Some(v) = run("sw_vers", &["-productVersion"]) {
+        return format!("macOS {}", v.trim());
+    }
+    #[cfg(target_os = "linux")]
+    if let Ok(t) = std::fs::read_to_string("/etc/os-release")
+        && let Some(n) = t.lines().find_map(|l| l.strip_prefix("PRETTY_NAME="))
+    {
+        return n.trim_matches('"').to_string();
+    }
+    #[cfg(target_os = "freebsd")]
+    if let Some(v) = run("freebsd-version", &[]) {
+        return format!("FreeBSD {}", v.trim());
+    }
+    #[cfg(target_os = "windows")]
+    if let Some(v) = run("cmd", &["/C", "ver"]) {
+        return v.trim().to_string();
+    }
+    format!("{} ({})", std::env::consts::OS, std::env::consts::ARCH)
+}
+
+/// Logical CPU cores.
+pub fn cpu_cores() -> usize {
+    std::thread::available_parallelism().map(|n| n.get()).unwrap_or(1)
+}
+
+/// The graphics lines of Settings ▸ GPU Information and Help ▸ System Report: whether the GPU
+/// compositor runs (and on which adapter), else why compositing is on the CPU, and the adapter
+/// the window itself got. Without this a card the compositor couldn't use looked undetected (#596).
+pub fn gpu_summary(s: &crate::Session) -> String {
+    let mut text = match s.accel.as_ref().map(|a| a.name()) {
+        Some(name) => format!("Compositing: GPU, {name}.\n"),
+        None => {
+            let threads = std::thread::available_parallelism().map(|n| n.get()).unwrap_or(1);
+            let why = s.accel_note.as_deref().unwrap_or("no reason was recorded");
+            format!("Compositing: CPU, {threads} threads (pure Rust, rayon).\nGPU compositing is off: {why}\n")
+        }
+    };
+    match &s.window_adapter {
+        Some(adapter) => text.push_str(&format!("Window graphics: {adapter}\n")),
+        None => text.push_str("Window graphics: not known yet (the window has not drawn its first frame).\n"),
+    }
+    text
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn freebsd_sysctl_memory_parses() {
+        let m = parse_freebsd_sysctl("17179869184\n4096\n1000000\n500000\n").expect("parses");
+        assert_eq!(m.total, 17_179_869_184);
+        assert_eq!(m.available, 1_500_000 * 4096);
+        assert!(parse_freebsd_sysctl("17179869184\n4096\n").is_none());
+        assert!(parse_freebsd_sysctl("garbage").is_none());
+        // Available never exceeds total, even with nonsense counts.
+        let m = parse_freebsd_sysctl("1000\n4096\n999999999\n999999999").expect("parses");
+        assert_eq!(m.available, 1000);
+    }
+
+    #[test]
+    fn a_failed_reading_clears_the_last_one() {
+        let w = Watch::<u64>::default();
+        let wait = || {
+            for _ in 0..500 {
+                if !w.busy.load(Ordering::Acquire) {
+                    return;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(2));
+            }
+            panic!("the reading never finished");
+        };
+        w.poll_with("ec-test", || Some(7));
+        wait();
+        assert_eq!(w.latest(), Some(7));
+        w.poll_with("ec-test", || None);
+        wait();
+        assert_eq!(w.latest(), None);
+    }
+
+    #[test]
+    fn parses_df() {
+        let linux = "Filesystem     1024-blocks      Used Available Capacity Mounted on\n/dev/nvme0n1p2   488281250 123456789 364824461      26% /\n";
+        assert_eq!(parse_df(linux), Some((488_281_250 * 1024, 364_824_461 * 1024)));
+        // macOS: a device name with spaces and a mount point with spaces.
+        let mac = "Filesystem 1024-blocks Used Available Capacity  Mounted on\nmap auto_home 0 0 0 100% /System/Volumes/Data/home\n";
+        assert_eq!(parse_df(mac), Some((0, 0)));
+        let spaced = "Filesystem 1024-blocks Used Available Capacity Mounted on\n//nas/My Share 1000 400 600 40% /Volumes/My Share\n";
+        assert_eq!(parse_df(spaced), Some((1000 * 1024, 600 * 1024)));
+        // A full disk into its reserved blocks: nothing available.
+        let full = "Filesystem 1024-blocks Used Available Capacity Mounted on\n/dev/sda2 1000 1010 -10 101% /\n";
+        assert_eq!(parse_df(full), Some((1000 * 1024, 0)));
+        assert_eq!(parse_df("Filesystem 1024-blocks\n"), None);
+        assert_eq!(parse_df(""), None);
+    }
+
+    #[test]
+    fn parses_proc_meminfo_and_vm_stat() {
+        let m = parse_meminfo("MemTotal:       16000000 kB\nMemFree:  1000 kB\nMemAvailable:    8000000 kB\n").unwrap();
+        assert_eq!(m, SysMemory { total: 16_000_000 * 1024, available: 8_000_000 * 1024 });
+        assert!(!m.is_low());
+        let vm = "Mach Virtual Memory Statistics: (page size of 16384 bytes)\nPages free:                               1000.\nPages active:  5.\nPages inactive:                           3000.\nPages speculative:                         100.\n";
+        let m = parse_vm_stat(vm, 8 << 30).unwrap();
+        assert_eq!(m.available, 4100 * 16384);
+        assert!(m.is_low());
+    }
+
+    /// The default temp folder may be a `tmpfs`; a nested disk mount under `/tmp` or a nested
+    /// `tmpfs` must be resolved to the deepest mount point.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn mountinfo_finds_memory_backed_storage() {
+        let mountinfo = "\
+25 1 0:22 / / rw,relatime - ext4 /dev/nvme0n1p2 rw
+26 25 0:23 / /tmp rw,nosuid - tmpfs tmpfs rw
+27 25 0:24 / /tmp/disk rw - ext4 /dev/sda1 rw
+28 25 0:25 / /mnt/ram rw - ramfs none rw
+29 25 0:26 / /media/My\\040Disk rw - ext4 /dev/sdb1 rw
+";
+        assert!(mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/tmp/effectcraft-fill")));
+        assert!(!mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/tmp/disk/fill")));
+        assert!(mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/mnt/ram/a")));
+        assert!(!mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/home/fill")));
+        assert!(!mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/")));
+        // A path that merely shares a prefix is not on that mount.
+        assert!(!mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/tmpdisk/fill")));
+        // Escaped spaces in a mount point decode before matching.
+        assert!(!mountinfo_is_memory_backed(mountinfo, std::path::Path::new("/media/My Disk/fill")));
+        assert_eq!(unescape_mount("/media/My\\040Disk"), "/media/My Disk");
+        // The later entry at the same mount point is the visible mount: a disk mount stacked on
+        // a tmpfs is disk-backed, and the reverse order is memory-backed (#2570 review).
+        let stacked_disk = "\
+30 25 0:30 / /tmp/stack rw - tmpfs tmpfs rw
+31 25 0:31 / /tmp/stack rw - ext4 /dev/sdb2 rw
+";
+        let stacked_ram = "\
+30 25 0:30 / /tmp/stack rw - ext4 /dev/sdb2 rw
+31 25 0:31 / /tmp/stack rw - tmpfs tmpfs rw
+";
+        assert!(!mountinfo_is_memory_backed(stacked_disk, std::path::Path::new("/tmp/stack/fill")));
+        assert!(mountinfo_is_memory_backed(stacked_ram, std::path::Path::new("/tmp/stack/fill")));
+        // A new relative folder resolves against the current directory before walking up.
+        assert!(canonical_ancestor(std::path::Path::new("no-such-relative-folder/fill")).is_some());
+    }
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index b3f0602b3..19953053e 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1,735 +1,66 @@
-use serde_json::json;
-
-use crate::Session;
-
-fn demo() -> Session {
-    let mut s = Session::default();
-    s.execute("file.openDemoProject", json!({})).unwrap();
-    s
-}
-
-#[test]
-fn demo_opens_and_renders() {
-    let s = demo();
-    let cid = s.active_comp_id().unwrap();
-    let img = s.render(cid, s.time(), effectcraft_render::RenderOpts { scale: 0.25, ..Default::default() });
-    assert_eq!((img.width, img.height), (480, 270));
-    let lit = img.data.iter().filter(|p| p[3] > 0.99).count();
-    assert!(lit > 100_000, "{lit}");
-}
-
-/// The session's layer cache never changes pixels: scrubbing the demo (including back and
-/// forth, and across an edit made through a command) matches cache-less renders exactly.
-#[test]
-fn demo_layer_cache_is_transparent() {
-    let mut s = demo();
-    let cid = s.active_comp_id().unwrap();
-    let opts = effectcraft_render::RenderOpts { scale: 0.25, ..Default::default() };
-    let uncached = |s: &Session, t: f64| {
-        let mut r = effectcraft_render::Renderer::new(&s.project, s.footage.as_ref(), opts);
-        r.expr = s.expr.as_deref();
-        r.comp_frame(cid, effectcraft_time::Tick::from_seconds_f64(t))
-    };
-    let check = |s: &Session, t: f64| {
-        let a = s.render(cid, effectcraft_time::Tick::from_seconds_f64(t), opts);
-        let b = uncached(s, t);
-        assert!(a.data.iter().zip(&b.data).all(|(p, q)| (0..4).all(|c| (p[c] - q[c]).abs() < 1e-6)), "t={t}");
-    };
-    for t in [0.5, 1.0, 3.0, 3.0334, 6.0, 3.0, 0.5] {
-        check(&s, t);
-    }
-    assert!(s.layer_cache.stats().hits > 0);
-    // Edit the title's glow through the command layer, then scrub again.
-    let title = s.project.comp(cid).unwrap().layers.iter().find(|l| l.name == "EFFECTCRAFT").map(|l| l.id.0).unwrap();
-    s.execute("prop.set", json!({"layer": title, "path": "effects/#1/radius", "value": 5.0})).unwrap();
-    for t in [3.0, 0.5] {
-        check(&s, t);
-    }
-}
-
-/// `layer.addItem` puts the layer at `index` (1-based) in the stack and starts it at `time`, as a
-/// drop in the Timeline does (#89).
-#[test]
-fn add_item_at_a_stack_index_and_time() {
-    let mut s = Session::default();
-    let clip = s.execute("comp.new", json!({"name": "Clip", "width": 16, "height": 16, "frameRate": 30, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
-    s.execute("comp.new", json!({"name": "Main", "width": 32, "height": 32, "frameRate": 30, "duration": 4})).unwrap();
-    for name in ["C", "B", "A"] {
-        s.execute("layer.newSolid", json!({"name": name})).unwrap();
-    }
-    let names = |s: &Session| s.active_comp().unwrap().layers.iter().map(|l| l.name.clone()).collect::<Vec<_>>();
-    s.execute("layer.addItem", json!({"item": clip, "index": 2, "time": 1.01})).unwrap();
-    assert_eq!(names(&s), ["A", "Clip", "B", "C"]);
-    let l = &s.active_comp().unwrap().layers[1];
-    assert_eq!(l.in_point, effectcraft_time::Tick::from_seconds_f64(1.0), "on the nearest frame");
-    // Past the bottom: the bottom.
-    s.execute("layer.addItem", json!({"item": clip, "index": 99})).unwrap();
-    assert_eq!(names(&s).last().map(String::as_str), Some("Clip 2"));
-    assert!(s.execute("layer.addItem", json!({"item": clip, "index": 0})).is_err(), "1-based");
-}
-
-/// Files dropped on the Timeline or the Composition viewer (`file.import {addToComp}`) become
-/// layers of the comp that was active, one under the other, where they were dropped (#85, #89).
-#[test]
-fn imported_files_go_into_the_comp_where_they_were_dropped() {
-    use effectcraft_project::{Footage, FootageKind};
-    struct Probe;
-    impl crate::Importer for Probe {
-        fn probe(&self, path: &str) -> Result<Footage, String> {
-            Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 64, height: 32, has_video: true, ..Default::default() })
-        }
-    }
-    let mut s = Session { importer: Some(std::sync::Arc::new(Probe)), ..Default::default() };
-    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
-    s.execute("layer.newSolid", json!({"name": "Bg"})).unwrap();
-    let params = json!({"paths": ["/drop/a.png", "/drop/b.png"], "addToComp": true, "position": [40.0, 50.0], "index": 1, "time": 1.0});
-    s.execute("file.import", params).unwrap();
-    let comp = s.active_comp().unwrap();
-    assert_eq!(comp.layers.iter().map(|l| l.name.as_str()).collect::<Vec<_>>(), ["a.png", "b.png", "Bg"]);
-    for l in &comp.layers[..2] {
-        assert_eq!(l.props.prop("transform/position").map(|p| p.value.clone()), Some(effectcraft_keyframe::Value::Vec3([40.0, 50.0, 0.0])));
-        assert_eq!(l.in_point, effectcraft_time::Tick::from_seconds_f64(1.0));
-    }
-    // Without `addToComp` they only import.
-    s.execute("file.import", json!({"paths": ["/drop/c.png"]})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers.len(), 3);
-    assert!(s.execute("layer.addItem", json!({"item": "a.png", "position": [1.0]})).is_err(), "position needs x and y");
-}
-
-/// #270: files dropped or picked in the Import dialog (`file.import {background}`) are probed in
-/// a background job that says which file it is reading and how many are left; then they arrive
-/// in one undo step, all selected, with a count. The same file imported again arrives again.
-#[test]
-fn background_imports_report_progress_and_select_what_arrived() {
-    use effectcraft_project::{Footage, FootageKind, ItemId};
-    use std::sync::Arc;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    /// Probes file k once `allow` > k (a slow video; 5 s at most, so an import that waits for it
-    /// fails the test instead of hanging it); `.xyz` files fail.
-    struct Gated {
-        started: AtomicUsize,
-        allow: Arc<AtomicUsize>,
-    }
-    impl crate::Importer for Gated {
-        fn probe(&self, path: &str) -> Result<Footage, String> {
-            let k = self.started.fetch_add(1, Ordering::SeqCst);
-            let until = std::time::Instant::now() + std::time::Duration::from_secs(5);
-            while self.allow.load(Ordering::SeqCst) <= k && std::time::Instant::now() < until {
-                std::thread::sleep(std::time::Duration::from_millis(1));
-            }
-            if path.ends_with(".xyz") {
-                return Err("unsupported file".into());
-            }
-            Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 64, height: 32, has_video: true, ..Default::default() })
-        }
-    }
-    let allow = Arc::new(AtomicUsize::new(1));
-    let mut s = Session { importer: Some(Arc::new(Gated { started: AtomicUsize::new(0), allow: allow.clone() })), ..Default::default() };
-    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
-    let undo = s.history.undo.len();
-    let r = s.execute("file.import", json!({"paths": ["/drop/a.png", "/drop/b.png", "/drop/a.png"], "background": true})).unwrap();
-    let job = r["job"].as_str().unwrap().to_string();
-    // The first file is through; the second is being read.
-    let running = |s: &mut Session| s.execute("jobs.list", json!({})).unwrap()["running"].as_array().unwrap().clone();
-    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
-    while running(&mut s)[0]["done"] != json!(1) && std::time::Instant::now() < deadline {
-        std::thread::sleep(std::time::Duration::from_millis(2));
-    }
-    let row = running(&mut s)[0].clone();
-    assert_eq!(row["id"], json!(job));
-    assert_eq!(row["label"], json!("Importing 3 files"));
-    assert_eq!(row["message"], json!("b.png (2 of 3)"));
-    assert_eq!((row["done"].as_u64(), row["total"].as_u64()), (Some(1), Some(3)));
-    assert!(s.project.items.values().all(|i| i.name != "a.png"), "nothing is added before the import finishes");
-    allow.store(usize::MAX, Ordering::SeqCst);
-    s.execute("jobs.wait", json!({})).unwrap();
-    let names = |s: &Session, ids: &[ItemId]| ids.iter().map(|i| s.project.item(*i).unwrap().name.clone()).collect::<Vec<_>>();
-    assert_eq!(names(&s, &s.state.project_selection), ["a.png", "b.png", "a.png"], "everything imported is selected, the same file twice too");
-    assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
-    let rec = s.job_log.last().unwrap();
-    assert_eq!((rec.status.as_str(), rec.message.as_str()), ("done", "Imported 3 items"));
-    assert!(s.drain_events().iter().any(|e| matches!(e, crate::Event::Toast { message, .. } if message == "Imported 3 items")));
-    // Dropped on the viewer: they become layers too; a file that can't be read is reported.
-    s.execute("file.import", json!({"paths": ["/drop/c.png", "/drop/d.xyz"], "background": true, "addToComp": true, "position": [10.0, 20.0]})).unwrap();
-    s.execute("jobs.wait", json!({})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers.iter().map(|l| l.name.as_str()).collect::<Vec<_>>(), ["c.png"]);
-    assert_eq!(s.job_log.last().unwrap().message, "Imported 1 item. /drop/d.xyz: unsupported file");
-    // Agents and scripts import at once by default.
-    let r = s.execute("file.import", json!({"paths": ["/drop/e.png"]})).unwrap();
-    assert_eq!(r["items"].as_array().map(Vec::len), Some(1));
-}
-
-/// Audio, Lock and Shy don't change pixels: toggling them keeps the cached layers (#103).
-#[test]
-fn audio_lock_and_shy_keep_cached_layers() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "C", "width": 160, "height": 90, "frameRate": 30, "duration": 1})).unwrap();
-    s.execute("layer.newSolid", json!({"color": "#3080ff", "width": 80, "height": 40})).unwrap();
-    s.execute("effect.apply", json!({"layer": "#1", "effect": "Gaussian Blur"})).unwrap();
-    s.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/blurriness", "value": 12})).unwrap();
-    let cid = s.active_comp_id().unwrap();
-    let t = s.time();
-    s.render(cid, t, Default::default());
-    let before = s.layer_cache.stats();
-    for sw in ["audio", "lock", "shy"] {
-        s.execute("layer.setSwitch", json!({"layers": ["#1"], "switch": sw, "value": sw != "audio"})).unwrap();
-    }
-    s.render(cid, t, Default::default());
-    let after = s.layer_cache.stats();
-    assert_eq!(after.misses, before.misses, "no layer rendered again");
-    assert!(after.hits > before.hits);
-}
-
-#[test]
-fn every_command_has_unique_id_and_runs_or_reports() {
-    let mut ids = std::collections::HashSet::new();
-    for c in crate::command_specs() {
-        assert!(ids.insert(c.id), "duplicate {}", c.id);
-    }
-    assert!(ids.len() >= 90, "{}", ids.len());
-}
-
-#[test]
-fn layer_workflow_with_undo() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Test", "width": 640, "height": 360, "frameRate": 30, "duration": 4})).unwrap();
-    let r = s.execute("layer.newSolid", json!({"color": "#336699"})).unwrap();
-    let lid = r["layer"].as_u64().unwrap();
-    s.execute("prop.set", json!({"layer": lid, "path": "transform/opacity", "value": 50})).unwrap();
-    let tree = s.execute("layer.tree", json!({"layer": lid})).unwrap();
-    assert!(tree.to_string().contains("\"value\":50.0"));
-    s.execute("prop.toggleAnimation", json!({"layer": lid, "path": "transform/position"})).unwrap();
-    s.execute("time.set", json!({"time": 2.0})).unwrap();
-    s.execute("prop.set", json!({"layer": lid, "path": "transform/position", "value": [100, 100]})).unwrap();
-    let comp = s.active_comp().unwrap();
-    let pos = comp.layers[0].props.prop("transform/position").unwrap();
-    assert_eq!(pos.keys.len(), 2);
-    s.execute("prop.select", json!({"layer": lid, "path": "transform/position"})).unwrap();
-    assert_eq!(s.state.selected_keys.len(), 2);
-    s.execute("keys.easyEase", json!({})).unwrap();
-    s.execute("keys.move", json!({"delta": 0.5})).unwrap();
-    let pos = s.active_comp().unwrap().layers[0].props.prop("transform/position").unwrap().clone();
-    assert!((pos.keys[0].time.seconds() - 0.5).abs() < 0.02);
-    assert_eq!(pos.keys[0].out_interp, effectcraft_keyframe::Interp::Bezier);
-    // undo back to before the move
-    s.execute("edit.undo", json!({})).unwrap();
-    let pos = s.active_comp().unwrap().layers[0].props.prop("transform/position").unwrap().clone();
-    assert!(pos.keys[0].time.seconds().abs() < 0.02);
-    s.execute("effect.apply", json!({"layer": lid, "effect": "Gaussian Blur"})).unwrap();
-    s.execute("prop.set", json!({"layer": lid, "path": "effects/#1/blurriness", "value": 12})).unwrap();
-    // Applying selects the new effect (Edit ▸ Duplicate would duplicate it); select the layer.
-    s.execute("layer.select", json!({"layers": [lid]})).unwrap();
-    s.execute("edit.duplicate", json!({})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers.len(), 2);
-    s.execute("layer.precompose", json!({"layers": [1, 2], "name": "Pre"})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers.len(), 1);
-}
-
-#[test]
-fn text_shape_mask_matte_parent() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"width": 800, "height": 450, "duration": 3})).unwrap();
-    let t = s.execute("layer.newText", json!({"text": "Hello", "size": 90})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("layer.addTextAnimator", json!({"layer": t, "properties": ["position", "opacity"]})).unwrap();
-    let sh = s.execute("layer.newShape", json!({"kind": "star", "fill": "#ffcc00"})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("layer.addShapeItem", json!({"layer": sh, "kind": "trim"})).unwrap();
-    s.execute("layer.addMask", json!({"layer": sh, "shape": "ellipse"})).unwrap();
-    s.execute("layer.setMask", json!({"layer": sh, "mask": 1, "mode": "Subtract", "inverted": true})).unwrap();
-    s.execute("layer.setTrackMatte", json!({"layer": sh, "matte": t, "kind": "luma"})).unwrap();
-    s.execute("layer.setParent", json!({"layers": [sh], "parent": t})).unwrap();
-    assert!(s.execute("layer.setParent", json!({"layers": [t], "parent": sh})).is_err());
-    s.execute("layer.setBlendMode", json!({"layers": [sh], "mode": "Screen"})).unwrap();
-    s.execute("layer.setSwitch", json!({"layers": [sh], "switch": "threeD"})).unwrap();
-    let cid = s.active_comp_id().unwrap();
-    let _ = s.render(cid, s.time(), Default::default());
-    let info = s.execute("comp.info", json!({})).unwrap();
-    assert_eq!(info["layers"].as_array().unwrap().len(), 2);
-}
-
-/// The toolbar's Fill / Stroke change a selected shape layer's paint (#205): a shape drawn
-/// without a stroke gets one, later edits change it, and the Contents "Add:" items (#206) include
-/// an empty Path and a Gradient Stroke that render.
-#[test]
-fn toolbar_fill_and_stroke_paint_selected_shape_layers() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
-    let sh = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
-    let paint = |s: &mut Session| s.execute("shape.fillStroke", json!({})).unwrap();
-    assert_eq!(paint(&mut s)["stroke"], serde_json::Value::Null, "drawn without a stroke");
-    s.execute("shape.fillStroke", json!({"stroke": "#00ff00", "strokeWidth": 6})).unwrap();
-    let p = paint(&mut s);
-    assert_eq!((p["stroke"][1].as_f64(), p["strokeWidth"].as_f64()), (Some(1.0), Some(6.0)), "{p}");
-    s.execute("shape.fillStroke", json!({"fill": "#0000ff", "strokeWidth": 3})).unwrap();
-    let p = paint(&mut s);
-    assert_eq!((p["fill"][2].as_f64(), p["strokeWidth"].as_f64()), (Some(1.0), Some(3.0)), "{p}");
-    // One stroke, before the fill (paths, stroke, fill), and each change is one undo step.
-    let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap().clone();
-    let group = l.props.group("contents/group").unwrap();
-    let order: Vec<&str> = group.sub("contents").unwrap().groups().map(|g| g.match_id.as_str()).collect();
-    assert_eq!(order, ["rect", "stroke", "fill"]);
-    s.execute("edit.undo", json!({})).unwrap();
-    assert_eq!(paint(&mut s)["strokeWidth"].as_f64(), Some(6.0));
-    // Only shape layers.
-    s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap();
-    assert!(s.execute("shape.fillStroke", json!({"fill": "#ffffff"})).is_err());
-    for kind in ["path", "gstroke"] {
-        let r = s.execute("layer.addShapeItem", json!({"layer": sh, "kind": kind})).unwrap();
-        assert!(r["path"].as_str().is_some_and(|p| p.starts_with("contents/")), "{r}");
-    }
-    let cid = s.active_comp_id().unwrap();
-    let _ = s.render(cid, s.time(), Default::default());
-}
-
-/// The toolbar's Fill Options / Stroke Options change a selected shape layer's paint kind (#732):
-/// None switches the fill off, a gradient turns the Fill into a Gradient Fill that keeps its
-/// opacity, Solid Color turns it back, and a Stroke kind adds a stroke where there is none.
-#[test]
-fn toolbar_fill_and_stroke_kinds_change_selected_shape_layers() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
-    let sh = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
-    let items = |s: &Session| -> Vec<(String, bool)> {
-        let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap();
-        l.props.group("contents/group/contents").unwrap().groups().map(|g| (g.match_id.clone(), g.enabled)).collect()
-    };
-    let kinds = |s: &mut Session| {
-        let p = s.execute("shape.fillStroke", json!({})).unwrap();
-        (p["fillType"].as_str().unwrap().to_string(), p["strokeType"].as_str().unwrap().to_string())
-    };
-    assert_eq!(kinds(&mut s), ("solid".into(), "none".into()));
-    let cid = s.active_comp_id().unwrap();
-    let centre = |s: &Session| s.render(cid, s.time(), Default::default()).get(200, 150);
-    let red = centre(&s);
-    // None switches the fill off: nothing is drawn, and the item stays.
-    s.execute("shape.fillStroke", json!({"fillType": "none"})).unwrap();
-    assert_eq!(items(&s), [("rect".into(), true), ("fill".into(), false)]);
-    assert_eq!(kinds(&mut s).0, "none");
-    assert_ne!(centre(&s), red, "the fill is off");
-    // A radial gradient: the Fill becomes a Gradient Fill (switched on) that keeps its opacity.
-    s.execute("shape.fillStroke", json!({"fillType": "solid", "fill": "#ff0000"})).unwrap();
-    assert_eq!(centre(&s), red);
-    let opacity = |s: &Session, m: &str| {
-        let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap();
-        l.props.group(&format!("contents/group/contents/{m}")).unwrap().get("opacity").unwrap().value.as_f64()
-    };
-    s.execute("prop.set", json!({"layer": sh, "path": "contents/group/contents/fill/opacity", "value": 40})).unwrap();
-    s.execute("shape.fillStroke", json!({"fillType": "radial"})).unwrap();
-    assert_eq!(items(&s), [("rect".into(), true), ("gfill".into(), true)]);
-    assert_eq!((kinds(&mut s).0.as_str(), opacity(&s, "gfill")), ("radial", 40.0));
-    s.execute("shape.fillStroke", json!({"fillType": "linear"})).unwrap();
-    assert_eq!(kinds(&mut s).0, "linear");
-    s.execute("shape.fillStroke", json!({"fillType": "solid", "fill": "#00ff00"})).unwrap();
-    assert_eq!(items(&s), [("rect".into(), true), ("fill".into(), true)]);
-    assert_eq!(opacity(&s, "fill"), 40.0);
-    // A Stroke kind adds a stroke (before the fill); None switches it off again; undo is per step.
-    s.execute("shape.fillStroke", json!({"strokeType": "linear"})).unwrap();
-    assert_eq!(items(&s), [("rect".into(), true), ("gstroke".into(), true), ("fill".into(), true)]);
-    s.execute("shape.fillStroke", json!({"strokeType": "none"})).unwrap();
-    assert_eq!(kinds(&mut s), ("solid".into(), "none".into()));
-    s.execute("edit.undo", json!({})).unwrap();
-    assert_eq!(kinds(&mut s), ("solid".into(), "linear".into()));
-    assert!(s.execute("shape.fillStroke", json!({"fillType": "plaid"})).is_err());
-}
-
-/// Selecting a mask in the Timeline (its row or its Mask Path) selects all of its points, so the
-/// viewer drags the whole mask (#203); a shape's Path item works the same way.
-#[test]
-fn selecting_a_mask_selects_its_points() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
-    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
-    let m1 = s.execute("layer.addMask", json!({"layer": l, "shape": "rect"})).unwrap()["mask"].as_u64().unwrap();
-    let m2 = s.execute("layer.addMask", json!({"layer": l, "shape": "ellipse"})).unwrap()["mask"].as_u64().unwrap();
-    let points = |s: &Session, m: u64| s.state.selected_vertices.iter().filter(|v| v.mask == m).count();
-    s.execute("prop.select", json!({"layer": l, "prop": m1, "selectKeys": false})).unwrap();
-    assert_eq!((points(&s, m1), s.state.selected_vertices.len()), (4, 4));
-    // Mask Path selects them too; Shift-adding another mask keeps the first.
-    let path = s.active_comp().unwrap().layer(effectcraft_project::LayerId(l)).unwrap().props.find_group(m2).unwrap().get("path").unwrap().uid;
-    s.execute("prop.select", json!({"layer": l, "prop": path, "add": true})).unwrap();
-    assert_eq!((points(&s, m1), points(&s, m2)), (4, 4));
-    // Another mask replaces them; another property deselects them.
-    s.execute("prop.select", json!({"layer": l, "prop": m2})).unwrap();
-    assert_eq!((points(&s, m1), points(&s, m2)), (0, 4));
-    // Delete removes the selected mask (not only its points).
-    s.execute("edit.clear", json!({})).unwrap();
-    let masks = |s: &Session| s.active_comp().unwrap().layer(effectcraft_project::LayerId(l)).unwrap().masks().unwrap().children.len();
-    assert_eq!(masks(&s), 1);
-    s.execute("prop.select", json!({"layer": l, "path": "transform/opacity"})).unwrap();
-    assert!(s.state.selected_vertices.is_empty());
-    let sh = s.execute("layer.newShape", json!({"kind": "star"})).unwrap()["layer"].as_u64().unwrap();
-    let star = s.execute("layer.addShapeItem", json!({"layer": sh, "kind": "path"})).unwrap()["uid"].as_u64().unwrap();
-    s.execute("prop.select", json!({"layer": sh, "prop": star})).unwrap();
-    assert_eq!(s.state.selected_vertices.len(), 0, "an empty Path has no points");
-}
-
-#[test]
-fn save_and_open_roundtrip() {
-    let mut s = demo();
-    let dir = std::env::temp_dir().join(format!("ec-test-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("demo.ecproj").to_string_lossy().to_string();
-    s.execute("file.saveAs", json!({"path": path})).unwrap();
-    let before = s.project.clone();
-    let mut s2 = Session::default();
-    s2.execute("file.open", json!({"path": path})).unwrap();
-    assert_eq!(*before, *s2.project);
-    let _ = std::fs::remove_dir_all(dir);
-}
-
-#[test]
-fn help_links_emit_urls() {
-    let mut s = Session::default();
-    let r = s.execute("help.discord", json!({})).unwrap();
-    assert_eq!(r["url"], "https://discord.gg/artcraft");
-    assert!(s.drain_events().iter().any(|e| matches!(e, crate::Event::OpenUrl(u) if u.contains("discord"))));
-    assert_eq!(s.execute("help.github", json!({})).unwrap()["url"], "https://github.com/storytold/effectcraft");
-}
-
-#[test]
-fn time_navigation() {
-    let mut s = demo();
-    s.execute("time.start", json!({})).unwrap();
-    let r = s.execute("time.nextKey", json!({})).unwrap();
-    assert!(r["time"].as_f64().unwrap() > 0.0);
-    s.execute("time.set", json!({"frame": 45})).unwrap();
-    assert_eq!(s.execute("time.step", json!({"frames": 5})).unwrap()["frame"], 50);
-}
-
-#[test]
-fn time_navigation_per_property() {
-    let mut s = demo();
-    // An animated property and the comp times of its keys.
-    let comp = s.active_comp().unwrap().clone();
-    let mut found = None;
-    for l in &comp.layers {
-        l.props.walk("", &mut |_, pr| {
-            if found.is_none() && pr.keys.len() >= 2 {
-                found = Some((pr.uid, pr.keys.iter().map(|k| l.comp_time(k.time)).collect::<Vec<_>>()));
-            }
-        });
-    }
-    let (uid, times) = found.expect("demo has an animated property");
-    s.set_time(effectcraft_time::Tick::ZERO);
-    let half = comp.frame_duration().0 / 2;
-    let expect = times.iter().copied().filter(|t| t.0 > half).min().unwrap();
-    s.execute("time.go", json!({"to": "nextKey", "prop": uid})).unwrap();
-    let snap = |t| comp.frame_rate.snap(t);
-    assert_eq!(s.time(), snap(expect));
-    // Going back from past the last key lands on the last key.
-    s.set_time(comp.duration);
-    s.execute("time.go", json!({"to": "prevKey", "prop": uid})).unwrap();
-    assert_eq!(s.time(), snap(*times.iter().max().unwrap()));
-}
-
-#[test]
-fn set_text_paragraph_fill_and_leading() {
-    use effectcraft_keyframe::{Justify, Value as KValue};
-    let mut s = demo();
-    let t = s.execute("layer.newText", json!({"text": "Hi"})).unwrap()["layer"].as_u64().unwrap();
-    let doc = |s: &Session| {
-        let l = s.active_comp().unwrap().layer(crate::project::LayerId(t)).unwrap().clone();
-        match &l.props.prop("text/sourceText").unwrap().value {
-            KValue::Text(d) => (**d).clone(),
-            v => panic!("{v:?}"),
-        }
-    };
-    for (key, j) in [
-        ("justifyLeft", Justify::JustifyLastLeft),
-        ("justifyCenter", Justify::JustifyLastCenter),
-        ("justifyRight", Justify::JustifyLastRight),
-        ("justifyAll", Justify::JustifyAll),
-        ("center", Justify::Center),
-    ] {
-        s.execute("layer.setText", json!({"layer": t, "justify": key})).unwrap();
-        assert_eq!(doc(&s).justify, j, "{key}");
-    }
-    s.execute("layer.setText", json!({"layer": t, "leading": 50, "applyFill": false, "applyStroke": true})).unwrap();
-    let d = doc(&s);
-    assert_eq!((d.leading, d.apply_fill, d.apply_stroke), (Some(50.0), false, true));
-    s.execute("layer.setText", json!({"layer": t, "leading": "auto"})).unwrap();
-    assert_eq!(doc(&s).leading, None);
-    s.execute("layer.setText", json!({"layer": t, "hScale": 120, "vScale": 80, "baselineShift": 4, "smallCaps": true, "strokeOverFill": true})).unwrap();
-    let d = doc(&s);
-    assert_eq!((d.h_scale, d.v_scale, d.baseline_shift, d.small_caps, d.stroke_over_fill), (120.0, 80.0, 4.0, true, true));
-}
-
-#[test]
-fn property_groups_report_actionable_errors() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "T"})).unwrap();
-    let l = s.execute("layer.newText", json!({"text": "Hi"})).unwrap()["layer"].as_u64().unwrap();
-    let uid = s.active_comp().unwrap().layer(crate::project::LayerId(l)).unwrap().props.group("text/pathOptions").unwrap().uid;
-    for selector in [json!({"path": "text"}), json!({"path": "text/pathOptions"}), json!({"path": format!("@{uid}")}), json!({"prop": uid})] {
-        let mut params = selector;
-        params["layer"] = json!(l);
-        for cmd in ["prop.get", "prop.set"] {
-            let err = s.execute(cmd, params.clone()).unwrap_err().to_string();
-            assert!(err.contains("is a property group"), "{cmd}: {err}");
-            assert!(err.contains("get_layer"), "{cmd}: {err}");
-        }
-    }
-    assert!(s.execute("prop.get", json!({"layer": l, "path": "text/sourceText"})).is_ok());
-    let err = s.execute("prop.get", json!({"layer": l, "path": "missing"})).unwrap_err().to_string();
-    assert!(err.contains("no property `missing`"), "{err}");
-}
-
-#[test]
-fn prop_get_and_render_rgba8() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "T", "width": 320, "height": 180, "duration": 2.0, "frameRate": 30})).unwrap();
-    let l = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": 0.0, "value": [0, 0]})).unwrap();
-    s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": 1.0, "value": [100, 50]})).unwrap();
-    let v = s.execute("prop.get", json!({"layer": l, "path": "transform/position", "time": 1.0})).unwrap();
-    assert_eq!(v["animated"], true);
-    assert_eq!(v["keys"].as_array().unwrap().len(), 2);
-    assert_eq!(v["value"][0].as_f64().unwrap(), 100.0);
-    let cid = s.resolve_comp(Some(&json!("T"))).unwrap();
-    let (w, h, rgba) = s.render_rgba8(cid, effectcraft_time::Tick::ZERO, 160).unwrap();
-    assert_eq!((w, h), (160, 90));
-    assert_eq!(rgba.len(), (w * h * 4) as usize);
-}
-
-#[test]
-fn params_docs_parse() {
-    use crate::commands::accepted_params;
-    let k = |d: &str| accepted_params(d).unwrap();
-    assert_eq!(k("{layers: [id|name|#n], add?, toggle?}"), ["layers", "add", "toggle"]);
-    assert_eq!(k("{time? (s) | frame? | timecode?}"), ["time", "frame", "timecode"]);
-    assert_eq!(k("{interpolation?|in?|out?: linear|bezier|hold, autoBezier?}"), ["interpolation", "in", "out", "autoBezier"]);
-    assert_eq!(k("{keys: [{layer, prop, time}], add?}"), ["keys", "add"]);
-    assert_eq!(k("{label: Red|Yellow|Aqua|…, layers?}"), ["label", "layers"]);
-    assert_eq!(k("{name?, background? [r,g,b]|#hex, open?}"), ["name", "background", "open"]);
-    assert!(k("{}").is_empty());
-    assert!(accepted_params("free text").is_none());
-    // Every registered command documents its params as a parseable key list.
-    for c in crate::command_specs() {
-        assert!(accepted_params(c.params).is_some(), "{}: {}", c.id, c.params);
-    }
-}
-
-#[test]
-fn execute_checked_rejects_unknown_params() {
-    let mut s = demo();
-    let e = s.execute_checked("layer.select", json!({"index": 2})).unwrap_err().to_string();
-    assert!(e.contains("`index`") && e.contains("layers, add, toggle"), "{e}");
-    s.execute_checked("layer.select", json!({"layers": ["#2"]})).unwrap();
-    assert_eq!(s.state.selected_layers.len(), 1);
-    // Aliases and always-accepted keys.
-    s.execute_checked("layer.select", json!({"layer": "#1", "comp": s.active_comp_id().unwrap().0})).unwrap();
-    s.execute_checked("time.set", json!({"frame": 3})).unwrap();
-    assert!(s.execute_checked("edit.undo", json!({"steps": 2})).is_err());
-    // Non-object params are not validated; the unchecked path stays lenient.
-    s.execute("layer.select", json!({"layers": ["#1"], "index": 2})).unwrap();
-}
-
-#[test]
-fn layer_tree_paths_resolve() {
-    let mut s = demo();
-    s.execute("effect.apply", json!({"layer": 1, "effect": "Gaussian Blur"})).unwrap();
-    let comp = s.execute("comp.info", json!({})).unwrap();
-    let mut checked = 0;
-    for l in comp["layers"].as_array().unwrap() {
-        let tree = s.execute("layer.tree", json!({"layer": l["id"]})).unwrap();
-        let mut stack = vec![tree["properties"].clone()];
-        while let Some(n) = stack.pop() {
-            if let Some(ch) = n["children"].as_array() {
-                stack.extend(ch.iter().cloned());
-                continue;
-            }
-            let path = n["path"].as_str().unwrap();
-            let got = s.execute("prop.get", json!({"layer": l["id"], "path": path})).unwrap();
-            assert_eq!(got["uid"], n["uid"], "path {path} on layer {}", l["name"]);
-            checked += 1;
-        }
-    }
-    assert!(checked > 20, "{checked}");
-}
-
-#[test]
-fn comp_settings_anchor_start_timecode_renderer() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "A", "width": 100, "height": 100, "duration": 2.0})).unwrap();
-    let l = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": 0.0, "value": [10, 20]})).unwrap();
-    let pos = |s: &Session| {
-        let pr = s.active_comp().unwrap().layer(crate::project::LayerId(l)).unwrap().props.prop("transform/position").unwrap().clone();
-        pr.keys[0].value.components()
-    };
-    // Center anchor: grow by 100x50 → shift by half.
-    s.execute("comp.settings", json!({"width": 200, "height": 150})).unwrap();
-    assert_eq!(pos(&s)[..2], [60.0, 45.0]);
-    // Top-left anchor: no shift. Bottom-right: full shift.
-    s.execute("comp.settings", json!({"width": 300, "anchor": 0})).unwrap();
-    assert_eq!(pos(&s)[..2], [60.0, 45.0]);
-    s.execute("comp.settings", json!({"width": 200, "height": 100, "anchor": 8})).unwrap();
-    assert_eq!(pos(&s)[..2], [-40.0, -5.0]);
-    s.execute("comp.settings", json!({"startTimecode": "0:00:01:00", "renderer": "advanced3D"})).unwrap();
-    let c = s.active_comp().unwrap();
-    assert_eq!(c.display_start, c.frame_rate.tick_of(30));
-    assert_eq!(c.renderer, crate::project::Renderer::Advanced3D);
-}
-
-/// `advanced3D` is a value of `renderer`, not a key: comp.new / comp.settings don't advertise it
-/// in their schemas and reject it as unknown instead of ignoring it (#177).
-#[test]
-fn renderer_values_are_not_parameter_keys() {
-    let mut s = Session::default();
-    for (id, p) in [("comp.new", json!({"name": "A"})), ("comp.settings", json!({}))] {
-        let spec = crate::command_specs().iter().find(|c| c.id == id).unwrap();
-        let keys = crate::commands::accepted_params(spec.params).unwrap();
-        assert!(keys.contains(&"renderer".to_string()) && !keys.contains(&"advanced3D".to_string()), "{id}: {keys:?}");
-        let mut bad = p.clone();
-        bad["advanced3D"] = json!(true);
-        let e = s.execute_checked(id, bad).unwrap_err().to_string();
-        assert!(e.contains("unknown parameter(s) `advanced3D`"), "{id}: {e}");
-        let mut good = p;
-        good["renderer"] = json!("advanced3D");
-        s.execute_checked(id, good).unwrap();
-        assert_eq!(s.active_comp().unwrap().renderer, crate::project::Renderer::Advanced3D, "{id}");
-        s.execute("comp.renderer", json!({"renderer": "classic3d"})).unwrap();
-    }
-}
-
-#[test]
-fn comp_rejects_zero_and_negative_frame_rates() {
-    let mut s = Session::default();
-    for fps in [0.0, -30.0, 0.0001] {
-        assert!(s.execute("comp.new", json!({"frameRate": fps})).is_err(), "{fps}");
-    }
-    s.execute("comp.new", json!({"frameRate": 30, "duration": 1})).unwrap();
-    assert!(s.execute("comp.settings", json!({"frameRate": 0})).is_err());
-    assert_eq!(s.active_comp().unwrap().frame_rate, crate::time::FrameRate::FPS_30);
-}
-
-#[test]
-fn render_queue_add_accepts_documented_settings_when_checked() {
-    let mut s = demo();
-    let r = s.execute_checked(
-        "renderQueue.add",
-        json!({"format": "gif", "output": "/tmp/x.gif", "resolution": "quarter", "timeSpan": "custom", "start": 0.0, "end": 0.5, "quality": "draft", "loop": true}),
-    );
-    // Without an exporter the add itself still succeeds (rendering is what needs one).
-    assert!(r.is_ok(), "{r:?}");
-    assert!(s.execute_checked("renderQueue.add", json!({"bogus": 1})).is_err());
-}
-
-#[test]
-fn new_text_rejects_malformed_positions_without_creating_a_layer() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 64, "duration": 1})).unwrap();
-    for position in [json!([]), json!([10]), json!(["x", 20]), json!([null, 20])] {
-        let err = s.execute("layer.newText", json!({"text": "Hello", "position": position})).unwrap_err();
-        assert!(err.to_string().contains("position: [x, y]"), "{err}");
-        assert!(s.active_comp().unwrap().layers.is_empty());
-    }
-    s.execute("layer.newText", json!({"name": "Valid", "text": "Hello", "position": [10, 20]})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers[0].props.prop("transform/position").unwrap().value, effectcraft_keyframe::Value::Vec3([10.0, 20.0, 0.0]));
-    s.execute("layer.newText", json!({"text": "No explicit position"})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers.len(), 2);
-}
-
-/// The active comp and the open comp tabs are saved with the project and restored on open (#748).
-#[test]
-fn reopening_a_project_restores_its_active_comp() {
-    use effectcraft_project::ItemId;
-    let dir = std::env::temp_dir().join(format!("ec-test-748-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("view.ecproj").to_string_lossy().to_string();
-    let mut s = Session::default();
-    let a = s.execute("comp.new", json!({"name": "CompA"})).unwrap()["comp"].as_u64().unwrap();
-    let b = s.execute("comp.new", json!({"name": "CompB"})).unwrap()["comp"].as_u64().unwrap();
-    let c = s.execute("comp.new", json!({"name": "CompC"})).unwrap()["comp"].as_u64().unwrap();
-    s.execute("comp.open", json!({"comp": "CompB"})).unwrap();
-    s.state.open_comps.retain(|id| id.0 != c);
-    s.execute("file.saveAs", json!({"path": path})).unwrap();
-    let mut s2 = Session::default();
-    s2.execute("file.open", json!({"path": path})).unwrap();
-    assert_eq!(s2.state.active_comp, Some(ItemId(b)));
-    assert_eq!(s2.state.open_comps, vec![ItemId(a), ItemId(b)]);
-    assert!(!s2.is_dirty());
-
-    // A file from before the view was saved opens on its first comp, as it always did.
-    let text = std::fs::read_to_string(&path).unwrap();
-    let mut old: serde_json::Value = serde_json::from_str(&text).unwrap();
-    let obj = old.as_object_mut().unwrap();
-    obj.remove("activeComp");
-    obj.remove("openComps");
-    std::fs::write(&path, serde_json::to_string_pretty(&old).unwrap()).unwrap();
-    let mut s3 = Session::default();
-    s3.execute("file.open", json!({"path": path})).unwrap();
-    assert_eq!((s3.state.active_comp, s3.state.open_comps.clone()), (Some(ItemId(a)), vec![ItemId(a)]));
-
-    // Ids that no longer name a comp (edited by hand, or written by another tool) fall back.
-    obj_set(&mut old, json!(999), json!([999, b, "x"]));
-    std::fs::write(&path, serde_json::to_string_pretty(&old).unwrap()).unwrap();
-    let mut s4 = Session::default();
-    s4.execute("file.open", json!({"path": path})).unwrap();
-    assert_eq!((s4.state.active_comp, s4.state.open_comps.clone()), (Some(ItemId(b)), vec![ItemId(b)]));
-    obj_set(&mut old, json!(999), json!([]));
-    std::fs::write(&path, serde_json::to_string_pretty(&old).unwrap()).unwrap();
-    let mut s5 = Session::default();
-    s5.execute("file.open", json!({"path": path})).unwrap();
-    assert_eq!((s5.state.active_comp, s5.state.open_comps.clone()), (Some(ItemId(a)), vec![ItemId(a)]));
-
-    // XML copies carry it too.
-    let xml = dir.join("view.ecprojx").to_string_lossy().to_string();
-    s.execute("file.saveAs", json!({"path": xml})).unwrap();
-    let mut s6 = Session::default();
-    s6.execute("file.open", json!({"path": xml})).unwrap();
-    assert_eq!(s6.state.active_comp, Some(ItemId(b)));
-    let _ = std::fs::remove_dir_all(dir);
-
-    fn obj_set(v: &mut serde_json::Value, active: serde_json::Value, open: serde_json::Value) {
-        let o = v.as_object_mut().unwrap();
-        o.insert("activeComp".into(), active);
-        o.insert("openComps".into(), open);
-    }
-}
-
-/// Layer times are saved as exact ticks and read back unchanged, and each comp reopens at the
-/// current time it was saved at, not at 0, where a layer starting later shows nothing (#1714).
-#[test]
-fn reopening_a_project_restores_layer_times_and_current_time() {
-    use effectcraft_project::ItemId;
-    use effectcraft_time::{FrameRate, Tick};
-    let dir = std::env::temp_dir().join(format!("ec-test-1714-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("times.ecproj").to_string_lossy().to_string();
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "C", "width": 108, "height": 192, "duration": 60})).unwrap();
-    s.execute("layer.newSolid", json!({"name": "crown"})).unwrap();
-    let cid = s.active_comp_id().unwrap();
-    let comp = std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap();
-    comp.frame_rate = FrameRate::FPS_59_94;
-    // The layer from the issue: 34f, 315f and 3033f at 59.94 fps.
-    let l = comp.layers.first_mut().unwrap();
-    (l.start_time, l.in_point, l.out_point) = (Tick(144_086_342_400), Tick(1_334_917_584_000), Tick(12_853_349_308_800));
-    s.execute("time.set", json!({"time": 6.0})).unwrap();
-    let t = s.time();
-    // A second comp keeps its own time.
-    let b = ItemId(s.execute("comp.new", json!({"name": "B"})).unwrap()["comp"].as_u64().unwrap());
-    s.execute("time.set", json!({"time": 2.0})).unwrap();
-    let tb = s.time();
-    s.execute("comp.open", json!({"comp": "C"})).unwrap();
-    s.execute("file.saveAs", json!({"path": path})).unwrap();
-
-    let mut s2 = Session::default();
-    s2.execute("file.open", json!({"path": path})).unwrap();
-    let l = s2.project.comp(cid).unwrap().layers.first().unwrap();
-    assert_eq!((l.start_time, l.in_point, l.out_point), (Tick(144_086_342_400), Tick(1_334_917_584_000), Tick(12_853_349_308_800)));
-    assert_eq!((s2.time(), s2.state.times.get(&b).copied()), (t, Some(tb)));
-    assert!(l.in_point <= s2.time() && s2.time() < l.out_point, "the layer shows at the reopened time");
-    assert!(!s2.is_dirty());
-
-    // Hand-edited times past the end or before the start land on the last or first frame.
-    let mut file: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
-    file["compTimes"] = json!({cid.0.to_string(): i64::MAX, b.0.to_string(): -5});
-    std::fs::write(&path, file.to_string()).unwrap();
-    let mut s3 = Session::default();
-    s3.execute("file.open", json!({"path": path})).unwrap();
-    let c = s3.project.comp(cid).unwrap();
-    assert_eq!(s3.time(), c.frame_rate.snap_nearest(c.duration - c.frame_duration()));
-    assert_eq!(s3.time(), c.frame_rate.snap_nearest(c.duration - c.frame_duration()));
-    assert_eq!(s3.state.times.get(&b).copied(), Some(Tick::ZERO));
-}
+mod add_item_options;
+mod aep_export;
+mod aep_import;
+mod anim_presets;
+mod anim_tools;
+mod aux_footage;
+mod blender;
+mod camera_track;
+mod codec_options;
+mod color_view;
+mod crypto_pick;
+mod delete_keys;
+mod disk_cache;
+mod display_pass;
+mod effects;
+mod essential;
+mod essential_more;
+mod export_overwrite;
+mod face;
+mod fidelity;
+mod frame_export;
+mod fuzz_open;
+mod history;
+mod import_project;
+mod instance3d;
+mod key_metadata_order;
+mod key_time;
+mod keyframe_text;
+mod keylight;
+mod limits;
+mod lottie;
+mod m137;
+mod m145;
+mod markers;
+mod mask_reveal;
+mod mask_warp;
+mod menu_cmds;
+mod model3d;
+mod models;
+mod motion_blur_depth;
+mod paint;
+mod panels;
+mod project_items;
+mod proxy;
+mod quick_offset;
+mod render_overwrite;
+mod replace_source;
+mod rig3d;
+pub(crate) mod roto;
+mod scale_comp;
+mod sequence;
+mod session;
+mod settings;
+mod shared_layers;
+mod shortcut_cmds;
+pub(crate) mod stubs;
+mod styles;
+mod tail;
+mod text;
+mod text_edit;
+mod three_d;
+mod timeline;
+mod timeline_interchange;
+pub(crate) mod track;
+mod vector_import;
+mod viewer;
diff --git a/crates/engine/src/tests/add_item_options.rs b/crates/engine/src/tests/add_item_options.rs
new file mode 100644
index 000000000..b21e863b0
--- /dev/null
+++ b/crates/engine/src/tests/add_item_options.rs
@@ -0,0 +1,93 @@
+//! `layer.addItem {in, out, anchor}` (#2026): place a layer's In / Out points and Anchor Point in
+//! the same call, so one command does what addItem + layer.timing + prop.set did.
+
+use effectcraft_project::{Layer, LayerId, LayerSource};
+use effectcraft_time::Tick;
+use serde_json::{Value, json};
+
+use crate::Session;
+
+/// A 10 s, 30 fps comp with a 100 x 50 solid item; returns the session, the item id and the solid's first layer.
+fn setup() -> (Session, u64, u64) {
+    let mut s = Session::default();
+    s.execute_checked("comp.new", json!({"width": 640, "height": 360, "frameRate": 30, "duration": 10})).unwrap();
+    let l = s.execute_checked("layer.newSolid", json!({"name": "S", "color": "#fff", "width": 100, "height": 50})).unwrap()["layer"].as_u64().unwrap();
+    let item = match &s.active_comp().unwrap().layer(LayerId(l)).unwrap().source {
+        LayerSource::Solid { item } => item.0,
+        other => panic!("not a solid: {other:?}"),
+    };
+    (s, item, l)
+}
+
+fn layer(s: &Session, id: u64) -> &Layer {
+    s.active_comp().unwrap().layer(LayerId(id)).unwrap()
+}
+
+fn anchor(s: &Session, id: u64) -> [f64; 3] {
+    layer(s, id).props.prop("transform/anchor").unwrap().value.as_vec3()
+}
+
+fn secs(t: Tick) -> f64 {
+    t.seconds()
+}
+
+#[test]
+fn in_out_and_anchor_in_one_call() {
+    let (mut s, item, _) = setup();
+    let id = s.execute_checked("layer.addItem", json!({"item": item, "time": 1.0, "in": 2.0, "out": 4.0, "anchor": [10.0, 20.0]})).unwrap()["layer"]
+        .as_u64()
+        .unwrap();
+    let l = layer(&s, id);
+    assert_eq!((secs(l.start_time), secs(l.in_point), secs(l.out_point)), (1.0, 2.0, 4.0));
+    assert_eq!(anchor(&s, id)[..2], [10.0, 20.0]);
+}
+
+#[test]
+fn only_in_or_only_out_keeps_the_other_default() {
+    let (mut s, item, _) = setup();
+    let a = s.execute_checked("layer.addItem", json!({"item": item, "in": 3.0})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!((secs(layer(&s, a).in_point), secs(layer(&s, a).out_point)), (3.0, 10.0));
+    let b = s.execute_checked("layer.addItem", json!({"item": item, "out": 5.0})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!((secs(layer(&s, b).in_point), secs(layer(&s, b).out_point)), (0.0, 5.0));
+}
+
+#[test]
+fn omitted_params_keep_the_default_placement() {
+    let (mut s, item, first) = setup();
+    let before = anchor(&s, first);
+    let id = s.execute_checked("layer.addItem", json!({"item": item})).unwrap()["layer"].as_u64().unwrap();
+    let l = layer(&s, id);
+    assert_eq!((secs(l.in_point), secs(l.out_point)), (0.0, 10.0));
+    assert_eq!(anchor(&s, id), before);
+}
+
+#[test]
+fn invalid_values_are_errors_and_change_nothing() {
+    let (mut s, item, _) = setup();
+    let n = s.active_comp().unwrap().layers.len();
+    let bad: [Value; 8] = [
+        json!({"in": 5.0, "out": 5.0}),
+        json!({"in": 6.0, "out": 2.0}),
+        json!({"in": -1.0}),
+        json!({"in": "soon"}),
+        json!({"out": 1e300}),
+        json!({"anchor": [1.0]}),
+        json!({"anchor": [1.0, "x"]}),
+        json!({"anchor": [1e300, 0.0]}),
+    ];
+    for extra in bad {
+        let mut p = json!({"item": item});
+        p.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+        assert!(s.execute("layer.addItem", p.clone()).is_err(), "{p}");
+    }
+    assert_eq!(s.active_comp().unwrap().layers.len(), n);
+}
+
+/// `in` applies before `out` (as `layer.timing`), so a range before the layer's start lands as asked.
+#[test]
+fn in_and_out_before_the_start_land_and_a_three_value_anchor_is_refused() {
+    let (mut s, item, _) = setup();
+    let id = s.execute_checked("layer.addItem", json!({"item": item, "time": 5.0, "in": 1.0, "out": 2.0})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!((secs(layer(&s, id).in_point), secs(layer(&s, id).out_point)), (1.0, 2.0));
+    assert!(s.execute_checked("layer.addItem", json!({"item": item, "anchor": [1.0, 2.0, 3.0]})).is_err());
+}
diff --git a/crates/engine/src/tests/aep_export.rs b/crates/engine/src/tests/aep_export.rs
new file mode 100644
index 000000000..41c2ebfee
--- /dev/null
+++ b/crates/engine/src/tests/aep_export.rs
@@ -0,0 +1,186 @@
+//! File ▸ Export ▸ After Effects Project… through the command registry.
+
+use serde_json::json;
+
+use crate::Session;
+
+/// A path `name` in a folder of its own that is removed with the returned guard.
+fn tmp(name: &str) -> (tempfile::TempDir, String) {
+    let d = tempfile::tempdir().unwrap();
+    let path = d.path().join(name).to_string_lossy().to_string();
+    (d, path)
+}
+
+fn session() -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 25, "duration": 2})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff8000", "width": 100, "height": 60})).unwrap();
+    s.execute("prop.addKey", json!({"layer": "#1", "path": "transform/opacity", "time": 0.0, "value": 0.0})).unwrap();
+    s.execute("prop.addKey", json!({"layer": "#1", "path": "transform/opacity", "time": 1.0, "value": 100.0})).unwrap();
+    s
+}
+
+#[test]
+fn export_aep_writes_a_file_that_imports_back() {
+    let mut s = session();
+    let (_dir, path) = tmp("main.aep");
+    let undo_before = s.history.undo.len();
+    let r = s.execute_checked("file.exportAep", json!({"path": path})).unwrap();
+    assert!(r["bytes"].as_u64().unwrap() > 1000);
+    assert_eq!(r["report"]["exported"]["compositions"], 1);
+    assert_eq!(r["report"]["exported"]["keyframes"], 2);
+    assert_eq!(r["report"]["losses"], json!([]));
+    let bytes = std::fs::read(&path).unwrap();
+    assert!(bytes.starts_with(b"RIFX"));
+    // Export does not change the project (no undo step).
+    assert_eq!(s.history.undo.len(), undo_before);
+    let back = s.execute_checked("file.importAep", json!({"path": path})).unwrap();
+    assert_eq!(back["report"]["imported"]["compositions"], 1);
+    assert_eq!(back["report"]["imported"]["keyframes"], 2);
+    assert_eq!(back["report"]["losses"], json!([]));
+}
+
+#[test]
+fn losses_are_refused_unless_allowed_and_a_dry_run_only_reports() {
+    let mut s = session();
+    s.execute("layer.newText", json!({})).ok();
+    // A parallel light is not written (no sampled case).
+    s.execute("layer.newLight", json!({"kind": "Parallel"})).ok();
+    let (_dir, path) = tmp("lossy.aep");
+    let _ = std::fs::remove_file(&path);
+    let err = s.execute_checked("file.exportAep", json!({"path": path})).unwrap_err().to_string();
+    assert!(err.contains("allowLosses"), "{err}");
+    assert!(!std::path::Path::new(&path).exists());
+    let r = s.execute_checked("file.exportAep", json!({"path": path, "dryRun": true})).unwrap();
+    assert_eq!(r["dryRun"], true);
+    assert!(!r["report"]["losses"].as_array().unwrap().is_empty());
+    assert!(!std::path::Path::new(&path).exists());
+    let r = s.execute_checked("file.exportAep", json!({"path": path, "allowLosses": true})).unwrap();
+    assert!(!r["report"]["losses"].as_array().unwrap().is_empty());
+    assert!(std::path::Path::new(&path).exists());
+}
+
+#[test]
+fn bad_input_is_an_error_not_a_crash() {
+    let mut s = session();
+    let (_dir, x) = tmp("x.aep");
+    assert!(s.execute_checked("file.exportAep", json!({})).is_err());
+    assert!(s.execute_checked("file.exportAep", json!({"path": x, "bogus": 1})).is_err());
+    assert!(s.execute_checked("file.exportAep", json!({"path": "/no/such/dir/at/all/x.aep"})).is_err());
+    // An empty project exports too.
+    let mut empty = Session::default();
+    let (_empty_dir, path) = tmp("empty.aep");
+    assert!(empty.execute_checked("file.exportAep", json!({"path": path})).is_ok());
+}
+
+#[test]
+fn aep_export_menu_entry_exists() {
+    let entries = crate::menus::entries();
+    let find = |cmd: &str| entries.iter().find(|(_, e)| e.command == cmd).map(|(p, e)| (p.join(" > "), e.label.clone()));
+    assert_eq!(find("file.exportAep"), Some(("File > Export".into(), "After Effects Project...".into())));
+}
+
+#[test]
+fn a_project_made_with_commands_exports_without_false_losses() {
+    // The export reports values it changes. What the commands make by default (effects added at
+    // the layer's bounds, masks with the cycled colours, also after one is removed) is not such a
+    // value.
+    let mut s = session();
+    for effect in ["ec.blur.fastbox", "ec.time.timewarp", "ec.color.tint", "ec.perspective.dropshadow"] {
+        s.execute_checked("effect.apply", json!({"layers": ["#1"], "effect": effect})).unwrap();
+    }
+    for _ in 0..3 {
+        s.execute_checked("mask.new", json!({"layer": "#1", "vertices": [[0, 0], [50, 0], [50, 40]]})).unwrap();
+    }
+    s.execute_checked("mask.remove", json!({"layer": "#1", "mask": "Mask 1"})).unwrap();
+    let (_dir, path) = tmp("commands.aep");
+    let r = s.execute_checked("file.exportAep", json!({"path": path, "dryRun": true})).unwrap();
+    assert_eq!(r["report"]["losses"], json!([]));
+    assert_eq!(r["report"]["exported"]["effects"], 4);
+    assert_eq!(r["report"]["exported"]["masks"], 2);
+}
+
+/// File access that records the folders it is asked the time of and gives each the same time.
+#[derive(Default)]
+struct Stamps(std::sync::Mutex<Vec<String>>);
+
+/// The time `Stamps` gives: 2026-10-19 03:51:22 UTC, stored as 0xe6fb443a (seconds since 1904).
+const FOLDER_SECONDS: u64 = 1_792_381_882;
+
+impl crate::Services for Stamps {
+    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+        std::fs::read(path)
+    }
+    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        std::fs::write(path, data)
+    }
+    fn stamp(&self, path: &str) -> Option<(u64, u128)> {
+        self.0.lock().unwrap().push(path.to_string());
+        Some((0, u128::from(FOLDER_SECONDS) * 1_000_000_000))
+    }
+}
+
+/// The stored folder time (`sspc@118`) of the sequence item of an exported project.
+fn sequence_folder_time(bytes: &[u8]) -> u32 {
+    let file = effectcraft_aep::parse(bytes).unwrap();
+    let view = effectcraft_aep::Project::new(&file).unwrap();
+    let item = view.all_items().into_iter().find(|i| i.footage().is_some_and(|f| f.is_sequence)).expect("sequence");
+    let sspc = item.chunk().child_list(b"Pin ").and_then(|pin| pin.child(b"sspc")).and_then(|c| c.bytes()).expect("sspc");
+    u32::from_be_bytes(sspc[118..122].try_into().unwrap())
+}
+
+/// A session whose project has one png sequence of three frames in `dir` (as `sep` joins them),
+/// recorded as stored in the document `document`.
+fn with_sequence(dir: &str, sep: &str, document: &str) -> (Session, std::sync::Arc<Stamps>) {
+    use effectcraft_project::{Footage, FootageKind, ItemKind};
+    let stamps = std::sync::Arc::new(Stamps::default());
+    let mut s = Session { services: stamps.clone(), ..Default::default() };
+    let files: Vec<String> = (1..=3).map(|k| format!("{dir}{sep}a_{k:04}.png")).collect();
+    let mut f = Footage {
+        path: files[0].clone(),
+        kind: FootageKind::Sequence,
+        frame_rate: effectcraft_time::FrameRate::new(25, 1),
+        sequence: files,
+        width: 64,
+        height: 48,
+        has_video: true,
+        ..Default::default()
+    };
+    f.sync_sequence_duration();
+    std::sync::Arc::make_mut(&mut s.project).add_item("a_[0001-0003].png", Default::default(), None, ItemKind::Footage(f));
+    s.stored_paths.add(&s.project, Some(document));
+    (s, stamps)
+}
+
+#[test]
+fn a_sequence_folder_is_looked_at_only_through_the_document_path_policy() {
+    let root = std::env::temp_dir().join(format!("ec-aep-export-folder-time-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(root.join("seq")).unwrap();
+    let document = root.join("job.aep").to_string_lossy().into_owned();
+    let out = root.join("out.aep").to_string_lossy().into_owned();
+    // A sequence on another computer, stored in an imported project: refused by the policy, so its
+    // folder is never asked about and the time stays unset (0).
+    let (mut s, stamps) = with_sequence(r"\\192.0.2.1\share\seq", r"\", &document);
+    let first = r"\\192.0.2.1\share\seq\a_0001.png";
+    assert!(matches!(s.stored_path(first), Err(crate::doc_path::NotFollowed::Refused(_))));
+    s.execute_checked("file.exportAep", json!({"path": out, "allowLosses": true})).unwrap();
+    assert_eq!(*stamps.0.lock().unwrap(), Vec::<String>::new());
+    assert_eq!(sequence_folder_time(&std::fs::read(&out).unwrap()), 0);
+    // Chosen in this session (imported or relinked by the user), the same path is followed as
+    // given, like every other footage access.
+    let f = s.project.items.values().find_map(|i| match &i.kind {
+        effectcraft_project::ItemKind::Footage(f) => Some(f.clone()),
+        _ => None,
+    });
+    s.stored_paths.allow(&f.unwrap());
+    s.execute_checked("file.exportAep", json!({"path": out, "allowLosses": true})).unwrap();
+    assert_eq!(stamps.0.lock().unwrap().len(), 1);
+    // A local sequence beside the document: its folder's time is written.
+    let local = root.join("seq").to_string_lossy().into_owned();
+    let (mut s, stamps) = with_sequence(&local, std::path::MAIN_SEPARATOR_STR, &document);
+    s.execute_checked("file.exportAep", json!({"path": out, "allowLosses": true})).unwrap();
+    assert_eq!(*stamps.0.lock().unwrap(), [local]);
+    assert_eq!(sequence_folder_time(&std::fs::read(&out).unwrap()), 0xe6fb_443a);
+    let _ = std::fs::remove_dir_all(&root);
+}
diff --git a/crates/engine/src/tests/aep_import.rs b/crates/engine/src/tests/aep_import.rs
new file mode 100644
index 000000000..8f09f1c0b
--- /dev/null
+++ b/crates/engine/src/tests/aep_import.rs
@@ -0,0 +1,321 @@
+//! File ▸ Import ▸ After Effects Project… through the command registry, with the synthetic
+//! fixtures of `effectcraft-aep`.
+
+use serde_json::json;
+
+use crate::Session;
+
+/// The test projects of `effectcraft-aep` and their cases.
+#[path = "../../../aep/tests/it/common/mod.rs"]
+mod common;
+
+/// The path of a test project of `effectcraft-aep` (in the folder named by
+/// `EFFECTCRAFT_AEP_FIXTURES`), or `None` after printing the skip line when it is missing. A case
+/// of a combined project is written as a project of its own (see `common`), named like the case,
+/// to a temporary folder.
+fn fixture_path(name: &str) -> Option<String> {
+    match common::locate(name)? {
+        common::Source::File(path) => Some(path.to_string_lossy().to_string()),
+        common::Source::Case { .. } => {
+            // Written once per test process: tests running in parallel read the same case, and a
+            // rewrite while another test reads it would hand that test a partial file.
+            static WRITTEN: std::sync::OnceLock<std::sync::Mutex<std::collections::HashMap<String, String>>> = std::sync::OnceLock::new();
+            let mut written = WRITTEN.get_or_init(Default::default).lock().unwrap_or_else(|e| e.into_inner());
+            if let Some(path) = written.get(name) {
+                return Some(path.clone());
+            }
+            let bytes = common::try_fixture(name)?;
+            let dir = std::env::temp_dir().join(format!("effectcraft-aep-cases-{}", std::process::id()));
+            std::fs::create_dir_all(&dir).unwrap();
+            let path = dir.join(name);
+            std::fs::write(&path, bytes).unwrap();
+            let path = path.to_string_lossy().to_string();
+            written.insert(name.to_string(), path.clone());
+            Some(path)
+        }
+    }
+}
+
+/// The path of a whole file of the fixture folder, or `None` after printing the skip line.
+fn file_path(name: &str) -> Option<String> {
+    let path = common::dir().map(|d| d.join(name));
+    if let Some(path) = path.filter(|p| p.is_file()) {
+        Some(path.to_string_lossy().to_string())
+    } else {
+        common::skipped(name);
+        None
+    }
+}
+/// [`fixture_path`]; returns from the calling test when the file is missing.
+macro_rules! fixture {
+    ($name:expr) => {
+        match fixture_path($name) {
+            Some(path) => path,
+            None => return,
+        }
+    };
+}
+
+#[test]
+fn import_aep_reads_the_xml_form_like_the_binary_one() {
+    // The pair holds cases 000, 058 (two Opacity keys), 060, 110 and 124 (with its precomposition),
+    // saved by After Effects as .aep and right after as .aepx.
+    let Some(xml) = file_path("aepx-pair.aepx") else { return };
+    let Some(bin) = file_path("aepx-pair.aep") else { return };
+    let mut s = Session::default();
+    let x = s.execute_checked("file.importAep", json!({"path": xml})).unwrap();
+    let mut t = Session::default();
+    let b = t.execute_checked("file.importAep", json!({"path": bin})).unwrap();
+    assert_eq!(x["report"], b["report"]);
+    assert_eq!(x["report"]["imported"]["keyframes"], 2);
+    let folder = effectcraft_project::ItemId(x["folder"].as_u64().unwrap());
+    assert_eq!(s.project.item(folder).unwrap().name, "aepx-pair.aepx");
+    let comps = |r: &serde_json::Value| r["comps"].as_array().unwrap().iter().map(|c| effectcraft_project::ItemId(c.as_u64().unwrap())).collect::<Vec<_>>();
+    let (cx, cb) = (comps(&x), comps(&b));
+    assert_eq!(cx.len(), 6);
+    assert_eq!(cx.len(), cb.len());
+    for (a, b) in cx.iter().zip(&cb) {
+        assert_eq!(s.project.item(*a).unwrap().name, t.project.item(*b).unwrap().name);
+        assert_eq!(s.project.comp(*a), t.project.comp(*b));
+    }
+}
+
+#[test]
+fn import_aep_creates_the_project_items_and_is_undoable() {
+    let mut s = Session::default();
+    let r = s.execute_checked("file.importAep", json!({"path": fixture!("055-key-position-3key-inserted-t2.5.aep")})).unwrap();
+    assert_eq!(r["report"]["imported"]["compositions"], 1);
+    assert_eq!(r["report"]["imported"]["keyframes"], 3);
+    assert_eq!(r["report"]["losses"], json!([]));
+    let cid = effectcraft_project::ItemId(r["comps"][0].as_u64().unwrap());
+    // The wrapper folder is named after the file; the comp opens.
+    let folder = effectcraft_project::ItemId(r["folder"].as_u64().unwrap());
+    assert_eq!(s.project.item(folder).unwrap().name, "055-key-position-3key-inserted-t2.5.aep");
+    assert_eq!(s.state.active_comp, Some(cid));
+    let c = s.project.comp(cid).unwrap();
+    assert_eq!((c.width, c.height, c.layers.len()), (1920, 1080, 1));
+    let pos = c.layers[0].props.prop("transform/position").unwrap();
+    assert_eq!(pos.keys.len(), 3);
+    assert_eq!(pos.value_at(effectcraft_time::Tick(effectcraft_time::TICKS_PER_SECOND)), effectcraft_keyframe::Value::Vec3([100.0, 0.0, 0.0]));
+
+    // One undo step removes everything the import added; redo brings it back.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.project.items.is_empty());
+    s.execute("edit.redo", json!({})).unwrap();
+    assert!(s.project.comp(cid).is_some());
+}
+
+#[test]
+fn losses_are_refused_unless_allowed() {
+    let mut s = Session::default();
+    let path = fixture!("077-fx-dropdown-default.aep");
+    let err = s.execute_checked("file.importAep", json!({"path": path})).unwrap_err().to_string();
+    assert!(err.contains("effects: 1") && err.contains("allowLosses"), "{err}");
+    assert!(s.project.items.is_empty());
+    assert!(s.history.undo.is_empty());
+
+    // A dry run reports without importing.
+    let r = s.execute_checked("file.importAep", json!({"path": path, "dryRun": true})).unwrap();
+    assert_eq!(r["dryRun"], true);
+    assert_eq!(r["report"]["losses"][0]["category"], "effects");
+    assert_eq!(r["report"]["losses"][0]["count"], 1);
+    assert!(s.project.items.is_empty());
+
+    let r = s.execute_checked("file.importAep", json!({"path": path, "allowLosses": true})).unwrap();
+    assert_eq!(r["report"]["losses"][0]["category"], "effects");
+    assert!(!s.project.items.is_empty());
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.project.items.is_empty());
+}
+
+#[test]
+fn bad_input_is_an_error_not_a_crash() {
+    let mut s = Session::default();
+    assert!(s.execute_checked("file.importAep", json!({})).is_err());
+    assert!(s.execute_checked("file.importAep", json!({"path": "does/not/exist.aep"})).is_err());
+    assert!(s.execute_checked("file.importAep", json!({"path": fixture!("000-base.aep"), "bogus": 1})).is_err());
+    let dir = std::env::temp_dir().join(format!("effectcraft-aep-tests-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let junk = dir.join("junk.aep");
+    std::fs::write(&junk, b"this is not an aep").unwrap();
+    let err = s.execute_checked("file.importAep", json!({"path": junk.to_string_lossy()})).unwrap_err().to_string();
+    assert!(err.contains("RIFX"), "{err}");
+    let cut = dir.join("cut.aep");
+    let bytes = std::fs::read(fixture!("000-base.aep")).unwrap();
+    std::fs::write(&cut, &bytes[..bytes.len() / 2]).unwrap();
+    assert!(s.execute_checked("file.importAep", json!({"path": cut.to_string_lossy(), "allowLosses": true})).is_err());
+    assert!(s.project.items.is_empty());
+}
+
+#[test]
+fn aep_menu_entry_exists() {
+    let entries = crate::menus::entries();
+    let find = |cmd: &str| entries.iter().find(|(_, e)| e.command == cmd).map(|(p, e)| (p.join(" > "), e.label.clone()));
+    assert_eq!(find("file.importAep"), Some(("File > Import".into(), "After Effects Project...".into())));
+}
+
+#[test]
+fn import_aep_takes_the_project_settings_into_an_empty_project_only() {
+    use effectcraft_project::{BitDepth, TimeDisplayStyle};
+    // The settings cases share files (one value per project): 621's file has 8 bits per channel,
+    // working space None and frames (with 623 and 629); 632's and 633's file has 32 bits and feet
+    // + frames 35mm.
+    let mut s = Session::default();
+    std::sync::Arc::make_mut(&mut s.project).settings.bit_depth = BitDepth::Bpc16;
+    s.execute_checked("file.importAep", json!({"path": fixture!("621-settings-bpc-8.aep")})).unwrap();
+    assert_eq!(s.project.settings.bit_depth, BitDepth::Bpc8);
+    assert_eq!(s.project.settings.working_space, None);
+    // A second file into a project with compositions leaves the settings alone ...
+    s.execute_checked("file.importAep", json!({"path": fixture!("632-settings-linearize-and-blend-linear.aep")})).unwrap();
+    assert_eq!((s.project.settings.bit_depth, s.project.settings.time_display), (BitDepth::Bpc8, TimeDisplayStyle::Frames));
+    // ... unless asked; and undo restores them.
+    s.execute_checked("file.importAep", json!({"path": fixture!("633-settings-feet-frames-35.aep"), "applySettings": true})).unwrap();
+    assert_eq!(s.project.settings.time_display, TimeDisplayStyle::Feet35);
+    assert_eq!(s.project.settings.bit_depth, BitDepth::Bpc32);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.project.settings.time_display, TimeDisplayStyle::Frames);
+    assert_eq!(s.project.settings.bit_depth, BitDepth::Bpc8);
+}
+
+/// File access that records every path it is asked about.
+#[derive(Default)]
+struct Recording(std::sync::Mutex<Vec<String>>);
+
+impl crate::Services for Recording {
+    fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
+        self.0.lock().unwrap().push(path.to_string());
+        std::fs::read(path)
+    }
+    fn write_file(&self, path: &str, data: &[u8]) -> std::io::Result<()> {
+        std::fs::write(path, data)
+    }
+    fn exists(&self, path: &str) -> bool {
+        self.0.lock().unwrap().push(path.to_string());
+        std::path::Path::new(path).exists()
+    }
+    fn stamp(&self, path: &str) -> Option<(u64, u128)> {
+        self.0.lock().unwrap().push(path.to_string());
+        None
+    }
+}
+
+/// `bytes` with the footage path of every file item (`Als2/alas`, key `fullpath`) set to `path`.
+fn with_footage_path(bytes: &[u8], path: &str) -> Vec<u8> {
+    fn set(chunks: &mut [effectcraft_aep::Chunk<'_>], value: &str, n: &mut usize) {
+        for c in chunks {
+            if c.id == *b"alas" {
+                let json = c.bytes().unwrap().to_vec();
+                let key = b"\"fullpath\":\"";
+                let at = json.windows(key.len()).position(|w| w == key).unwrap() + key.len();
+                let mut end = at;
+                while json[end] != b'"' {
+                    end += if json[end] == b'\\' { 2 } else { 1 };
+                }
+                let edited = [&json[..at], value.as_bytes(), &json[end..]].concat();
+                *c = effectcraft_aep::Chunk::data(*b"alas", edited);
+                *n += 1;
+            } else if let effectcraft_aep::Body::List { children, .. } | effectcraft_aep::Body::Chunks(children) = &mut c.body {
+                set(children, value, n);
+            }
+        }
+    }
+    let mut file = effectcraft_aep::parse(bytes).unwrap();
+    let quoted = serde_json::to_string(path).unwrap();
+    let mut n = 0;
+    set(&mut file.chunks, &quoted[1..quoted.len() - 1], &mut n);
+    assert!(n > 0, "no footage path");
+    effectcraft_aep::write(&file).unwrap()
+}
+
+#[test]
+fn stored_footage_paths_follow_the_document_path_policy() {
+    // An .aep whose footage points to another computer or to a file beside it, imported from a
+    // folder that is not the working directory: a foreign path is never looked at (not even by the
+    // dry run) and arrives missing, the relative one is taken from the .aep's folder.
+    use effectcraft_project::{Footage, ItemKind};
+    let Some(bytes) = common::try_fixture("126-footage-png-layer.aep") else { return };
+    let root = std::env::temp_dir().join(format!("ec-aep-doc-path-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&root);
+    let dir = root.join("job");
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("clip.png"), b"x").unwrap();
+    let local = root.to_string_lossy().into_owned();
+    for (name, stored) in [("unc", r"\\192.0.2.1\share\x.png"), ("url", "file://192.0.2.1/s/x.png"), ("beside", "clip.png")] {
+        let aep = dir.join(format!("{name}.aep"));
+        std::fs::write(&aep, with_footage_path(&bytes, stored)).unwrap();
+        let rec = std::sync::Arc::new(Recording::default());
+        let mut s = Session { services: rec.clone(), ..Default::default() };
+        s.execute("file.importAep", json!({"path": aep.to_string_lossy(), "allowLosses": true, "dryRun": true})).unwrap();
+        s.execute("file.importAep", json!({"path": aep.to_string_lossy(), "allowLosses": true})).unwrap();
+        let footage: Footage = s
+            .project
+            .items
+            .values()
+            .find_map(|i| match &i.kind {
+                ItemKind::Footage(f) => Some(f.clone()),
+                _ => None,
+            })
+            .unwrap_or_else(|| panic!("{name}: no footage"));
+        let beside = name == "beside";
+        assert_eq!(footage.missing, !beside, "{name}");
+        if beside {
+            assert_eq!(std::path::Path::new(&footage.path), dir.join("clip.png"));
+        } else {
+            // The session follows the imported path as stored in the .aep.
+            assert!(s.stored_path(&footage.path).is_err(), "{name}");
+        }
+        let r = s.execute("footage.check", json!({"wait": true})).unwrap();
+        assert_eq!(r["missing"].as_u64(), Some(u64::from(!beside)), "{name}: {r}");
+        for p in rec.0.lock().unwrap().iter() {
+            assert!(p.starts_with(&local), "{name}: looked at {p}");
+        }
+    }
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// An importer that finds sound in every video it probes.
+struct WithSound;
+
+impl crate::Importer for WithSound {
+    fn probe(&self, path: &str) -> Result<effectcraft_project::Footage, String> {
+        Ok(effectcraft_project::Footage {
+            path: path.into(),
+            kind: effectcraft_project::FootageKind::Video,
+            has_video: true,
+            has_audio: true,
+            ..Default::default()
+        })
+    }
+}
+
+#[test]
+fn a_video_with_sound_arrives_audible() {
+    // The clip of the 645 project stores no sample rate (it has no sound there); the file next to
+    // it is asked: with sound in it the imported footage has audio and its layer is part of the
+    // mix; a missing file is left as the project file says.
+    use effectcraft_project::{Footage, ItemKind};
+    let Some(bytes) = common::try_fixture("645-footage-mp4-conform-30.aep") else { return };
+    let root = std::env::temp_dir().join(format!("ec-aep-video-sound-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(&root).unwrap();
+    std::fs::write(root.join("clip.mp4"), b"x").unwrap();
+    for (name, stored) in [("beside", "clip.mp4"), ("absent", "gone.mp4")] {
+        let aep = root.join(format!("{name}.aep"));
+        std::fs::write(&aep, with_footage_path(&bytes, stored)).unwrap();
+        let mut s = Session { importer: Some(std::sync::Arc::new(WithSound)), ..Default::default() };
+        s.execute("file.importAep", json!({"path": aep.to_string_lossy(), "allowLosses": true})).unwrap();
+        let footage: Footage = s
+            .project
+            .items
+            .values()
+            .find_map(|i| match &i.kind {
+                ItemKind::Footage(f) if f.kind == effectcraft_project::FootageKind::Video => Some(f.clone()),
+                _ => None,
+            })
+            .unwrap_or_else(|| panic!("{name}: no video footage"));
+        assert_eq!((footage.missing, footage.has_audio), (name == "absent", name == "beside"), "{name}");
+        let audible = s.project.comps().any(|(id, _)| effectcraft_render::audio::comp_has_audio(&s.project, *id));
+        assert_eq!(audible, name == "beside", "{name}: audible mix");
+    }
+    let _ = std::fs::remove_dir_all(&root);
+}
diff --git a/crates/engine/src/tests_anim_presets.rs b/crates/engine/src/tests/anim_presets.rs
similarity index 80%
rename from crates/engine/src/tests_anim_presets.rs
rename to crates/engine/src/tests/anim_presets.rs
index b9f529c45..4d8b79e3f 100644
--- a/crates/engine/src/tests_anim_presets.rs
+++ b/crates/engine/src/tests/anim_presets.rs
@@ -78,7 +78,7 @@ fn transition_preset_by_name_and_bad_input() {
 #[test]
 fn preset_catalogue_is_unique_and_categorised() {
     let all = crate::animation_presets();
-    let known = ["Transitions", "Backgrounds"];
+    let known = ["Transitions", "Backgrounds", "Behaviors"];
     let mut ids = std::collections::HashSet::new();
     let mut names = std::collections::HashSet::new();
     for (id, name, cat) in &all {
@@ -90,7 +90,7 @@ fn preset_catalogue_is_unique_and_categorised() {
         assert!(!ids.contains(&id.to_lowercase()) && !names.contains(&name.to_lowercase()), "text preset {id} clashes");
     }
     let n = |c: &str| all.iter().filter(|(_, _, k)| k == c).count();
-    assert!(n("Backgrounds") >= 15 && n("Transitions") >= 20);
+    assert!(n("Backgrounds") >= 15 && n("Transitions") >= 20 && n("Behaviors") >= 20);
 }
 
 #[test]
@@ -126,3 +126,34 @@ fn preset_expressions_and_point_fractions() {
     assert_eq!(ramp.prop("end").unwrap().value, effectcraft_keyframe::Value::Vec2([80.0, 90.0]));
     assert_eq!(ramp.prop("startColor").unwrap().keys.len(), 2);
 }
+
+/// #1510: Behaviors presets add no effects; each puts an enabled expression on a transform
+/// property, and undo removes it again.
+#[test]
+fn every_behavior_preset_applies_and_undoes() {
+    let (mut s, solid) = session();
+    let list = s.execute("anim.builtinPresets", json!({"category": "Behaviors"})).unwrap();
+    let list = list.as_array().unwrap().clone();
+    assert!(list.len() >= 20, "{}", list.len());
+    let driven = |s: &Session| {
+        let l = &s.active_comp().unwrap().layers[0];
+        ["transform/position", "transform/scale", "transform/rotation", "transform/opacity"]
+            .iter()
+            .filter(|p| l.props.prop(p).is_some_and(|pr| pr.has_expression()))
+            .copied()
+            .collect::<Vec<_>>()
+    };
+    for p in &list {
+        let id = p["id"].as_str().unwrap();
+        let r = s.execute("anim.applyBuiltinPreset", json!({"layers": [solid], "preset": id})).unwrap();
+        assert_eq!(r["skipped"], json!([]), "{id}: every path and expression applies");
+        assert_eq!(r["effects"], json!([]), "{id}: behaviors add no effects");
+        let applied = driven(&s);
+        assert_eq!(applied.len(), 1, "{id}: exactly one property is driven");
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(driven(&s).is_empty(), "{id}: undo removes the expression");
+        s.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(driven(&s), applied, "{id}: redo restores the expression");
+        s.execute("edit.undo", json!({})).unwrap();
+    }
+}
diff --git a/crates/engine/src/tests_anim_tools.rs b/crates/engine/src/tests/anim_tools.rs
similarity index 61%
rename from crates/engine/src/tests_anim_tools.rs
rename to crates/engine/src/tests/anim_tools.rs
index 69b6afa06..96b861972 100644
--- a/crates/engine/src/tests_anim_tools.rs
+++ b/crates/engine/src/tests/anim_tools.rs
@@ -3,12 +3,86 @@
 use effectcraft_keyframe::evaluate;
 use serde_json::json;
 
-use crate::tests_timeline::{animate, prop, setup};
+use crate::tests::timeline::{animate, prop, setup};
 
 fn select(s: &mut crate::Session, layer: u64, path: &str) {
     s.execute("prop.select", json!({"layer": layer, "path": path})).unwrap();
 }
 
+fn selection_command_skips_locked_keys(command: &str, path: &str, values: [serde_json::Value; 3], mut params: serde_json::Value) {
+    let (mut s, locked) = setup();
+    let unlocked = s.execute("layer.newSolid", json!({"name": "Editable", "width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    for layer in [locked, unlocked] {
+        animate(&mut s, layer, path, &[(0.0, values[0].clone()), (0.5, values[1].clone()), (1.0, values[2].clone())]);
+    }
+    let before = prop(&s, locked, path).keys;
+    let selected: Vec<_> = [locked, unlocked]
+        .into_iter()
+        .flat_map(|layer| {
+            let pr = prop(&s, layer, path);
+            pr.keys.into_iter().map(move |key| crate::KeyRef { layer: effectcraft_project::LayerId(layer), prop: pr.uid, time: key.time })
+        })
+        .collect();
+    s.execute("layer.setSwitch", json!({"layers": [locked], "switch": "locked", "value": true})).unwrap();
+    s.state.selected_keys = selected.clone();
+    if params.get("keys").is_some() {
+        params["keys"] = serde_json::to_value(&selected).unwrap();
+    }
+    s.execute_checked(command, params.clone()).unwrap();
+    assert_eq!(prop(&s, locked, path).keys, before, "{command} changed a locked layer");
+    let after = prop(&s, unlocked, path).keys;
+    assert_ne!(after, before, "{command} must still edit unlocked keys");
+    let after_selection = s.state.selected_keys.clone();
+    assert!(selected.iter().filter(|k| k.layer.0 == locked).all(|key| after_selection.contains(key)));
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(prop(&s, unlocked, path).keys, before);
+    assert!(selected.iter().filter(|key| key.layer.0 == locked).all(|key| s.state.selected_keys.contains(key)));
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(prop(&s, unlocked, path).keys, after);
+    assert_eq!(s.state.selected_keys, after_selection);
+    // All-locked input must preserve the selection and document as well.
+    s.state.selected_keys.retain(|k| k.layer.0 == locked);
+    if params.get("keys").is_some() {
+        params["keys"] = serde_json::to_value(&s.state.selected_keys).unwrap();
+    }
+    let locked_selection = s.state.selected_keys.clone();
+    let project = serde_json::to_value(&*s.project).unwrap();
+    let _ = s.execute_checked(command, params);
+    assert_eq!(serde_json::to_value(&*s.project).unwrap(), project);
+    assert_eq!(s.state.selected_keys, locked_selection);
+}
+
+#[test]
+fn wiggler_preserves_locked_keys_in_mixed_selection() {
+    selection_command_skips_locked_keys(
+        "keys.wiggle",
+        "transform/opacity",
+        [json!(10), json!(90), json!(20)],
+        json!({"apply": "temporal", "frequency": 8, "magnitude": 10}),
+    );
+}
+
+#[test]
+fn smoother_preserves_locked_keys_in_mixed_selection() {
+    selection_command_skips_locked_keys("keys.smooth", "transform/opacity", [json!(10), json!(50), json!(90)], json!({"tolerance": 1}));
+}
+
+#[test]
+fn exponential_scale_preserves_locked_keys_in_mixed_selection() {
+    selection_command_skips_locked_keys(
+        "keys.exponentialScale",
+        "transform/scale",
+        [json!([100, 100, 100]), json!([150, 150, 150]), json!([400, 400, 400])],
+        json!({}),
+    );
+}
+
+#[test]
+fn edit_label_preserves_locked_keys_in_mixed_selection() {
+    selection_command_skips_locked_keys("edit.label", "transform/opacity", [json!(10), json!(50), json!(90)], json!({"label": "Red"}));
+    selection_command_skips_locked_keys("edit.label", "transform/opacity", [json!(10), json!(50), json!(90)], json!({"label": "Red", "keys": true}));
+}
+
 #[test]
 fn wiggle_adds_keys_at_frequency_within_magnitude() {
     let (mut s, l) = setup();
diff --git a/crates/engine/src/tests/aux_footage.rs b/crates/engine/src/tests/aux_footage.rs
new file mode 100644
index 000000000..01c3c1c96
--- /dev/null
+++ b/crates/engine/src/tests/aux_footage.rs
@@ -0,0 +1,200 @@
+//! The footage files effects read the channels of (#474): the session gives the footage source
+//! the whole set with every project change ([`Session::bump`]), so a multi-layer OpenEXR read by
+//! EXtractoR or Cryptomatte decodes its picture and channels at once from the first frame, and
+//! goes back to its picture alone once no effect reads it.
+
+use std::sync::{Arc, Mutex};
+
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, Project};
+use effectcraft_raster::Image;
+use effectcraft_time::{FrameRate, Tick};
+use serde_json::json;
+
+use crate::Session;
+use crate::render::{FootageSource, RenderOpts};
+
+/// Records every set it is given, and the set it had when it was first asked for a frame.
+#[derive(Default)]
+struct Recorder {
+    sets: Mutex<Vec<Vec<String>>>,
+    at_first_frame: Mutex<Option<Option<Vec<String>>>>,
+}
+
+impl Recorder {
+    fn last(&self) -> Option<Vec<String>> {
+        self.sets.lock().unwrap().last().cloned()
+    }
+    fn calls(&self) -> usize {
+        self.sets.lock().unwrap().len()
+    }
+}
+
+impl FootageSource for Recorder {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        self.at_first_frame.lock().unwrap().get_or_insert_with(|| self.last());
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn set_aux_footage(&self, paths: &[String]) {
+        self.sets.lock().unwrap().push(paths.to_vec());
+    }
+}
+
+struct Probe;
+impl crate::Importer for Probe {
+    fn probe(&self, path: &str) -> Result<Footage, String> {
+        Ok(Footage {
+            path: path.into(),
+            kind: FootageKind::Still,
+            width: 8,
+            height: 4,
+            has_video: true,
+            frame_rate: FrameRate::from_f64(24.0),
+            duration: Tick::from_seconds_f64(2.0),
+            ..Default::default()
+        })
+    }
+}
+
+fn session(rec: &Arc<Recorder>) -> Session {
+    let mut s = Session { footage: rec.clone(), importer: Some(Arc::new(Probe)), ..Default::default() };
+    s.execute("comp.new", json!({"name": "C", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+    s
+}
+
+fn import(s: &mut Session, path: &str) -> serde_json::Value {
+    s.execute("file.import", json!({"paths": [path]})).unwrap()["items"][0].clone()
+}
+
+/// Add a layer of `item` to the active comp; its layer id.
+fn add_layer(s: &mut Session, item: &serde_json::Value) -> u64 {
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    s.state.selected_layers[0].0
+}
+
+fn paths(v: &[&str]) -> Option<Vec<String>> {
+    Some(v.iter().map(|p| p.to_string()).collect())
+}
+
+/// Adding, disabling, removing an effect and undoing or redoing each change the set; edits that
+/// don't change it don't send it again.
+#[test]
+fn effect_edits_undo_and_redo_update_the_set() {
+    let rec = Arc::new(Recorder::default());
+    let mut s = session(&rec);
+    let item = import(&mut s, "/renders/a.exr");
+    let l = add_layer(&mut s, &item);
+    assert_eq!(rec.last(), paths(&[]), "no effect reads it yet");
+    s.execute_checked("effect.apply", json!({"effect": "Gaussian Blur", "layers": [l]})).unwrap();
+    assert_eq!(rec.last(), paths(&[]), "a blur doesn't read channels");
+    s.execute_checked("effect.apply", json!({"effect": "EXtractoR", "layers": [l]})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]));
+    assert!(s.undo());
+    assert_eq!(rec.last(), paths(&[]), "undoing the add");
+    assert!(s.redo());
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]), "redoing it");
+    let calls = rec.calls();
+    s.execute_checked("effect.toggle", json!({"layer": l, "effect": "Gaussian Blur", "value": false})).unwrap();
+    assert_eq!(rec.calls(), calls, "the set didn't change: it isn't sent again");
+    s.execute_checked("effect.toggle", json!({"layer": l, "effect": "EXtractoR", "value": false})).unwrap();
+    assert_eq!(rec.last(), paths(&[]), "a disabled effect reads nothing");
+    s.execute_checked("effect.toggle", json!({"layer": l, "effect": "EXtractoR", "value": true})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]));
+    s.execute_checked("effect.remove", json!({"layer": l, "effect": "EXtractoR"})).unwrap();
+    assert_eq!(rec.last(), paths(&[]), "removed");
+    assert!(s.undo());
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]), "undoing the removal");
+    assert!(s.redo());
+    assert_eq!(rec.last(), paths(&[]), "redoing it");
+    assert!(s.undo());
+    s.execute_checked("effect.duplicate", json!({"layer": l, "effect": "EXtractoR"})).unwrap();
+    s.execute_checked("effect.remove", json!({"layer": l, "effect": "EXtractoR"})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]), "the duplicate still reads it");
+}
+
+/// Opening a project gives the set before the first frame is rendered; opening another sends
+/// it again even when it is empty.
+#[test]
+fn opening_a_project_gives_the_set_before_the_first_frame() {
+    let made = Arc::new(Recorder::default());
+    let mut s = session(&made);
+    let item = import(&mut s, "/renders/crypto.exr");
+    let l = add_layer(&mut s, &item);
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte", "layers": [l]})).unwrap();
+    let project: Project = (*s.project).clone();
+    let comp = s.state.active_comp.unwrap();
+
+    let rec = Arc::new(Recorder::default());
+    let mut s = Session { footage: rec.clone(), ..Default::default() };
+    s.replace_project(project, None);
+    assert_eq!(rec.last(), paths(&["/renders/crypto.exr"]));
+    s.render(comp, Tick::ZERO, RenderOpts::default());
+    assert_eq!(*rec.at_first_frame.lock().unwrap(), Some(paths(&["/renders/crypto.exr"])), "given before the first frame");
+    s.replace_project(Project::default(), None);
+    assert_eq!(rec.last(), paths(&[]));
+    let calls = rec.calls();
+    s.replace_project(Project::default(), None);
+    assert_eq!(rec.calls(), calls + 1, "each opened project gets its set");
+}
+
+/// Two footage items of one file: the file stays in while an effect reads either of them.
+#[test]
+fn two_items_of_one_file() {
+    let rec = Arc::new(Recorder::default());
+    let mut s = session(&rec);
+    let a = import(&mut s, "/renders/shared.exr");
+    let f = match &s.project.item(ItemId(a.as_u64().unwrap())).unwrap().kind {
+        ItemKind::Footage(f) => f.clone(),
+        k => panic!("{k:?}"),
+    };
+    let b = s.edit("Add", None, |p, _| Ok(p.add_item("shared copy", crate::color::Label::None, None, ItemKind::Footage(f)))).unwrap();
+    let la = add_layer(&mut s, &a);
+    let lb = add_layer(&mut s, &json!(b.0));
+    s.execute_checked("effect.apply", json!({"effect": "EXtractoR", "layers": [la]})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "ID Matte", "layers": [lb]})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/shared.exr"]), "once");
+    s.execute_checked("effect.remove", json!({"layer": la, "effect": "EXtractoR"})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/shared.exr"]), "the other item still reads it");
+    s.execute_checked("effect.remove", json!({"layer": lb, "effect": "ID Matte"})).unwrap();
+    assert_eq!(rec.last(), paths(&[]));
+}
+
+/// Replacing a layer's source or an item's file moves the set to the new file.
+#[test]
+fn source_and_footage_replacement_follow() {
+    let rec = Arc::new(Recorder::default());
+    let mut s = session(&rec);
+    let a = import(&mut s, "/renders/a.exr");
+    let b = import(&mut s, "/renders/b.exr");
+    let l = add_layer(&mut s, &a);
+    s.execute_checked("effect.apply", json!({"effect": "Depth Matte", "layers": [l]})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]));
+    s.execute_checked("layer.replaceSource", json!({"layers": [l], "item": b})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/b.exr"]), "the layer's new source");
+    s.execute_checked("file.replaceFootage", json!({"item": b, "path": "/renders/c.exr"})).unwrap();
+    assert_eq!(rec.last(), paths(&["/renders/c.exr"]), "the item's new file");
+}
+
+/// A watch-folder render opens its project in a session sharing the host's footage source: the
+/// host's set is given back afterwards.
+#[test]
+fn a_watch_folder_render_gives_the_host_set_back() {
+    let dir = std::env::temp_dir().join(format!("ec-aux-footage-watch-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut other = Session::default();
+    other.execute("comp.new", json!({"name": "Idle", "width": 8, "height": 8, "duration": 1})).unwrap();
+    other.execute("file.saveAs", json!({"path": dir.join("idle.ecproj").to_string_lossy()})).unwrap();
+
+    let rec = Arc::new(Recorder::default());
+    let mut s = session(&rec);
+    let item = import(&mut s, "/renders/a.exr");
+    let l = add_layer(&mut s, &item);
+    s.execute_checked("effect.apply", json!({"effect": "EXtractoR", "layers": [l]})).unwrap();
+    let calls = rec.calls();
+    let r = s.execute("file.watchFolder", json!({"folder": dir.to_string_lossy()})).unwrap();
+    assert_eq!(r["rendered"].as_array().map(Vec::len), Some(1), "{r}");
+    assert!(rec.calls() > calls + 1, "the watched project gave its own set");
+    assert_eq!(rec.last(), paths(&["/renders/a.exr"]), "the host's set is back");
+    s.execute("file.watchFolder", json!({"stop": true})).unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/src/tests/blender.rs b/crates/engine/src/tests/blender.rs
new file mode 100644
index 000000000..b4e0a5c80
--- /dev/null
+++ b/crates/engine/src/tests/blender.rs
@@ -0,0 +1,278 @@
+//! Synthetic camera interchange: projection, timing, DOF and hostile inputs. Optional public
+//! Blender-API oracle: EFFECTCRAFT_BLENDER=/path/to/blender cargo test -p effectcraft-engine tests::blender -- --nocapture.
+
+use effectcraft_effects::camera_tracker as ct;
+use effectcraft_keyframe::Value as KV;
+use effectcraft_project::{Footage, FootageKind, ItemKind, LayerId, LayerSource, build};
+use effectcraft_time::{FrameRate, Tick};
+use effectcraft_track::camtrack::{CameraSolve, Distortion, Ground, ShotType, SolveMethod, SolvedFrame, SolvedPoint};
+use serde_json::{Value, json};
+
+use crate::Session;
+
+fn path(name: &str) -> String {
+    let dir = std::env::temp_dir().join(format!("effectcraft-blender-tests-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    dir.join(name).to_string_lossy().into_owned()
+}
+
+fn fixture(ground: bool) -> (Session, LayerId, u64) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Shot '\\ — câmera", "width": 640, "height": 360, "duration": 6})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let rate = FrameRate::new(30000, 1001);
+    let lid = s
+        .edit("fixture", None, |p, _| {
+            p.comp_mut(cid).unwrap().frame_rate = rate;
+            let item = p.add_item(
+                "Plate",
+                Default::default(),
+                None,
+                ItemKind::Footage(Footage {
+                    path: std::env::var("EFFECTCRAFT_BLENDER_PLATE").unwrap_or_else(|_| path("plate '\\ — vídeo.mp4")),
+                    width: 640,
+                    height: 360,
+                    frame_rate: FrameRate::FPS_30,
+                    duration: Tick::from_seconds_f64(6.0),
+                    kind: FootageKind::Video,
+                    has_video: true,
+                    ..Default::default()
+                }),
+            );
+            let comp = p.comp(cid).unwrap().clone();
+            let mut layer = build::layer(p, &comp, "Tracked Video", LayerSource::Footage { item }, (640, 360), None);
+            layer.in_point = rate.tick_of(60);
+            layer.out_point = rate.tick_of(63);
+            layer.start_time = rate.tick_of(30);
+            layer.stretch = 200.0;
+            let id = layer.id;
+            p.comp_mut(cid).unwrap().layers.push(layer);
+            Ok(id)
+        })
+        .unwrap();
+    let uid = s.execute("effect.apply", json!({"effect": ct::ID, "layers": [lid.0]})).unwrap()["effects"][0].as_u64().unwrap();
+    let solve = CameraSolve {
+        version: 1,
+        size: [640.0, 360.0],
+        start: rate.tick_of(30).seconds() / 2.0,
+        frame_duration: rate.frame_duration().seconds() / 2.0,
+        shot: ShotType::VariableZoom,
+        method_used: SolveMethod::Typical,
+        average_error: 0.12,
+        frames: (0..3)
+            .map(|i| SolvedFrame {
+                rot: [0.02 * i as f64, -0.03 * i as f64, 0.01 * i as f64],
+                center: [0.1 * i as f64, -0.01 * i as f64, 0.02 * i as f64],
+                focal: 600.0 + i as f64 * 25.0,
+                solved: true,
+            })
+            .collect(),
+        points: vec![
+            SolvedPoint { id: 7, pos: [0.1, 0.2, 2.0], error: 0.13, first: 0, last: 2 },
+            SolvedPoint { id: 9, pos: [-0.3, -0.1, 1.2], error: 0.11, first: 0, last: 1 },
+        ],
+        ground: ground.then_some(Ground { origin: [0.1, 0.2, 2.0], normal: [0.0, -1.0, 0.0], x_axis: [1.0, 0.0, 0.0] }),
+        distortion: ground.then_some(Distortion { k1: 0.01, k2: -0.002, radius: 320.0_f64.hypot(180.0) }),
+    };
+    // Directly install a deterministic solve; no analysis or decoder is needed by these tests.
+    s.execute("prop.set", json!({"layer": lid.0, "path": "effects/#1/solve", "value": solve.to_json()})).unwrap();
+    s.camera_pending.clear();
+    s.execute("layer.select", json!({"layers": [lid.0]})).unwrap();
+    (s, lid, uid)
+}
+
+fn data(script: &str) -> Value {
+    let line = script.lines().find_map(|l| l.strip_prefix("DATA = json.loads(")).unwrap().strip_suffix(')').unwrap();
+    let encoded: String = serde_json::from_str(line).unwrap();
+    serde_json::from_str(&encoded).unwrap()
+}
+
+#[test]
+fn blender_export_bakes_projection_focus_and_retimed_background() {
+    let (mut s, lid, uid) = fixture(true);
+    let result = s.execute("camera.create", json!({"layer": lid.0, "effect": uid})).unwrap();
+    let camera = result["camera"].as_u64().unwrap();
+    s.execute("layer.cameraSettings", json!({"layer": camera, "focusDistance": 800.0, "dof": true, "fStop": 4.0, "lockToZoom": false})).unwrap();
+    for (frame, value) in [(60, 800.0), (62, 1000.0)] {
+        let time = FrameRate::new(30000, 1001).tick_of(frame).seconds();
+        s.execute("prop.addKey", json!({"layer": camera, "path": "cameraOptions/focusDistance", "time": time, "value": value})).unwrap();
+    }
+    let camera_layer = s.active_comp().unwrap().layer(LayerId(camera)).unwrap();
+    assert!(camera_layer.props.prop("cameraOptions/dof").unwrap().value.as_bool());
+    let output = path("oracle-scene.py");
+    let before = s.project.to_json();
+    let r = s.execute_checked("camera.exportBlender", json!({"layer": lid.0, "effect": uid, "path": output, "startFrame": 101})).unwrap();
+    assert_eq!(s.project.to_json(), before, "export must not edit the document");
+    assert_eq!(r["frames"], 3);
+    assert_eq!(r["points"], 2);
+    let script = std::fs::read_to_string(&output).unwrap();
+    let d = data(&script);
+    assert_eq!(d["resolution"], json!([640.0, 360.0]));
+    assert_eq!(d["fpsNumerator"], 30000);
+    assert_eq!(d["fpsDenominator"], 1001);
+    assert_eq!(d["frames"][0]["sourceFrame"], 15, "trim + 200% stretch, not scene frame 101");
+    assert_eq!(d["frames"][2]["sourceFrame"], 16);
+    assert_eq!(d["frames"][0]["focus"], 8.0);
+    assert_eq!(d["frames"][2]["focus"], 10.0);
+    assert_eq!(d["frames"][0]["dof"], true);
+    assert!((d["frames"][0]["fstop"].as_f64().unwrap() - 4.0).abs() < 1e-6);
+    assert_eq!(d["frames"][0]["lens"], 33.75);
+    assert_eq!(d["frames"][2]["lens"], 36.5625);
+    assert_eq!(d["ground"], true);
+    assert_eq!(d["solve"]["distortion"]["k1"], 0.01);
+    assert_eq!(d["points"][0]["location"][2], 0.0, "ground point lies on Blender XY plane");
+
+    // Execute the actual exported artifact in a separately installed Blender, when requested.
+    if let Ok(blender) = std::env::var("EFFECTCRAFT_BLENDER") {
+        let oracle = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/blender_scene_oracle.py");
+        let output = std::process::Command::new(blender)
+            .args(["--background", "--factory-startup", "--python-exit-code", "1", "--python"])
+            .arg(oracle)
+            .arg("--")
+            .arg(&output)
+            .output()
+            .unwrap();
+        assert!(output.status.success(), "Blender oracle failed:\n{}\n{}", String::from_utf8_lossy(&output.stdout), String::from_utf8_lossy(&output.stderr));
+        assert!(String::from_utf8_lossy(&output.stdout).contains("EFFECTCRAFT_BLENDER_ORACLE_OK"));
+    }
+}
+
+#[test]
+fn blender_export_bakes_reverse_time_remap_and_footage_loops() {
+    let (mut s, lid, _) = fixture(false);
+    let cid = s.active_comp_id().unwrap();
+    let rate = FrameRate::new(30000, 1001);
+    s.edit("retimed fixture", None, |p, _| {
+        let layer = p.comp(cid).unwrap().layer(lid).unwrap();
+        let item = layer.source.item().unwrap();
+        let keys = [(60, 8.0), (61, 6.0), (62, -1.0)]
+            .map(|(frame, time)| effectcraft_keyframe::Keyframe::new(layer.layer_time(rate.tick_of(frame)), KV::Scalar(time)));
+        let mut remap = build::Ids(&mut p.next_id).prop("timeRemap", "Time Remap", KV::Scalar(8.0));
+        remap.keys = keys.to_vec();
+        p.comp_mut(cid).unwrap().layer_mut(lid).unwrap().props.children.push(remap.into());
+        if let ItemKind::Footage(f) = &mut p.item_mut(item).unwrap().kind {
+            f.loop_count = 2;
+        }
+        Ok(())
+    })
+    .unwrap();
+    let output = path("remap.py");
+    s.execute_checked("camera.exportBlender", json!({"layer": lid.0, "path": output})).unwrap();
+    let d = data(&std::fs::read_to_string(output).unwrap());
+    let indices: Vec<i64> = d["frames"].as_array().unwrap().iter().map(|f| f["sourceFrame"].as_i64().unwrap()).collect();
+    assert_eq!(indices, vec![60, 0, 0], "reverse remap wraps the 6-second video and clamps negative source time, as the media pool does");
+}
+
+#[test]
+fn blender_export_defaults_and_script_escaping() {
+    let (mut s, lid, _) = fixture(false);
+    let output = path("escaped.py");
+    let r = s
+        .execute_checked("camera.exportBlender", json!({"layer": lid.0, "path": output, "includePoints": false, "sensorWidth": 24.0, "unitScale": 0.1}))
+        .unwrap();
+    assert_eq!(r["points"], 0);
+    let script = std::fs::read_to_string(&output).unwrap();
+    let d = data(&script);
+    assert!(d["name"].as_str().unwrap().contains("'\\ — câmera"));
+    assert_eq!(d["frames"][0]["lens"], 22.5);
+    assert_eq!(d["frames"][0]["dof"], false);
+    assert!(r["warnings"].as_array().unwrap().iter().any(|w| w.as_str().unwrap().contains("cannot be recovered")));
+    match std::process::Command::new("python3").args(["-c", "import ast,sys; ast.parse(open(sys.argv[1], encoding='utf-8').read())", &output]).status() {
+        Ok(status) => assert!(status.success(), "generated script must parse even with quoted/Unicode paths"),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => eprintln!("Python AST oracle skipped: python3 is not installed"),
+        Err(e) => panic!("Python AST oracle failed: {e}"),
+    }
+}
+
+#[test]
+fn blender_export_rejects_invalid_arguments_and_write_failures() {
+    let (mut s, lid, _) = fixture(false);
+    for params in [
+        json!({"sensorWidth": 0}),
+        json!({"sensorWidth": "wide"}),
+        json!({"unitScale": -1}),
+        json!({"startFrame": -1}),
+        json!({"startFrame": 1.5}),
+        json!({"startFrame": 1048574}),
+        json!({"includePoints": "yes"}),
+        json!({"bogus": true}),
+        json!({"path": path("bad.blend")}),
+    ] {
+        let mut p = json!({"layer": lid.0, "path": path("invalid.py")});
+        p.as_object_mut().unwrap().extend(params.as_object().unwrap().clone());
+        assert!(s.execute_checked("camera.exportBlender", p.clone()).is_err(), "must reject {p}");
+    }
+    let blocker = path("blocker");
+    std::fs::write(&blocker, b"not a directory").unwrap();
+    let p = format!("{blocker}/scene.py");
+    assert!(s.execute_checked("camera.exportBlender", json!({"layer": lid.0, "path": p})).unwrap_err().to_string().contains("cannot write"));
+}
+
+#[test]
+fn blender_export_rejects_malformed_solves_without_panicking() {
+    for variant in ["empty", "unsolved", "zero-focal", "bad-ground", "huge-resolution", "mismatched-range"] {
+        let (mut s, lid, uid) = fixture(false);
+        let cid = s.active_comp_id().unwrap();
+        let mut solve = ct::solve(&crate::camera_track::static_params(s.active_comp().unwrap().layer(lid).unwrap().props.find_group(uid).unwrap()))
+            .unwrap()
+            .as_ref()
+            .clone();
+        match variant {
+            "empty" => solve.frames.clear(),
+            "unsolved" => solve.frames[0].solved = false,
+            "zero-focal" => solve.frames[0].focal = 0.0,
+            "bad-ground" => solve.ground = Some(Ground::default()),
+            "huge-resolution" => solve.size[0] = 1e10,
+            _ => {
+                solve.frames.pop();
+            }
+        }
+        s.edit("corrupt solve", None, |p, _| {
+            p.comp_mut(cid).unwrap().layer_mut(lid).unwrap().props.find_group_mut(uid).unwrap().prop_mut(ct::SOLVE).unwrap().value = KV::Str(solve.to_json());
+            Ok(())
+        })
+        .unwrap();
+        s.camera_pending.clear();
+        let result = s.execute_checked("camera.exportBlender", json!({"layer": lid.0, "path": path("corrupt.py")}));
+        assert!(result.is_err(), "must reject {variant}");
+    }
+}
+
+/// A solve with unsolved (interpolated) frames is partial, not solved, so the status agrees with
+/// the export, which refuses it.
+#[test]
+fn solve_status_reports_unsolved_frames_as_partial() {
+    let (mut s, lid, uid) = fixture(false);
+    let st = s.execute("camera.solveStatus", json!({"layer": lid.0})).unwrap();
+    assert_eq!((&st["solved"], &st["partial"], &st["solvedFrames"]), (&json!(true), &json!(false), &json!(3)), "{st}");
+    let mut solve =
+        ct::solve(&crate::camera_track::static_params(s.active_comp().unwrap().layer(lid).unwrap().props.find_group(uid).unwrap())).unwrap().as_ref().clone();
+    solve.frames[1].solved = false;
+    s.execute("prop.set", json!({"layer": lid.0, "path": "effects/#1/solve", "value": solve.to_json()})).unwrap();
+    s.camera_pending.clear();
+    let st = s.execute("camera.solveStatus", json!({"layer": lid.0})).unwrap();
+    assert_eq!((&st["solved"], &st["partial"], &st["solvedFrames"]), (&json!(false), &json!(true), &json!(2)), "{st}");
+    assert!(s.execute_checked("camera.exportBlender", json!({"layer": lid.0, "path": path("partial.py")})).is_err());
+}
+
+#[test]
+fn blender_export_respects_script_write_permission() {
+    let (mut s, lid, _) = fixture(false);
+    let output = path("script-permissions.py");
+    let params = json!({"layer": lid.0, "path": output});
+    for (from_script, allowed) in [(true, false), (true, true), (false, false), (false, true)] {
+        std::fs::write(&output, b"existing file").unwrap();
+        s.prefs.scripting.allow_scripts_write_files = allowed;
+        let result =
+            if from_script { s.execute_for_script("camera.exportBlender", params.clone()) } else { s.execute_checked("camera.exportBlender", params.clone()) };
+        assert!(!s.running_for_script(), "script origin must be restored after success or error");
+        let contents = std::fs::read_to_string(&output).unwrap();
+        if from_script && !allowed {
+            assert!(result.unwrap_err().to_string().contains("Allow Scripts to Write Files"));
+            assert_eq!(contents, "existing file", "blocked scripts must not replace an existing file");
+        } else {
+            assert_eq!(result.unwrap()["frames"], 3);
+            assert!(contents.contains("def import_scene():"));
+        }
+    }
+}
diff --git a/crates/engine/src/tests_camera_track.rs b/crates/engine/src/tests/camera_track.rs
similarity index 87%
rename from crates/engine/src/tests_camera_track.rs
rename to crates/engine/src/tests/camera_track.rs
index 5bd5539c1..3ca8578a9 100644
--- a/crates/engine/src/tests_camera_track.rs
+++ b/crates/engine/src/tests/camera_track.rs
@@ -3,7 +3,7 @@
 
 use effectcraft_effects::camera_tracker as ct;
 use effectcraft_geom::vec3;
-use effectcraft_project::LayerId;
+use effectcraft_project::{Comp, Layer, LayerId, PropGroup};
 use effectcraft_raster::Image;
 use effectcraft_render::EvalCtx;
 use effectcraft_render::three_d::camera::active_camera;
@@ -11,7 +11,8 @@ use effectcraft_track::camtrack::linalg::{self, M3, V3};
 use serde_json::{Value, json};
 
 use crate::Session;
-use crate::tests_track::{H, W, frame_time, setup, texture};
+use crate::camera_track::Placed;
+use crate::tests::track::{H, W, frame_time, setup, texture};
 
 const F: f64 = 260.0;
 
@@ -77,10 +78,9 @@ fn status(s: &mut Session) -> Value {
     s.execute("camera.solveStatus", json!({})).unwrap()
 }
 
-#[test]
-fn track_camera_solves_and_creates_layers_on_the_plane() {
-    let (mut s, clip) = tracked(json!({}));
-    let st = status(&mut s);
+/// Solved with a sane error and focal length; returns the Camera Tracker effect group.
+fn assert_solved(s: &mut Session, clip: LayerId) -> PropGroup {
+    let st = status(s);
     assert_eq!(st["solved"], true, "{st}");
     let err = st["averageError"].as_f64().unwrap();
     assert!(err < 0.5, "average error {err}");
@@ -90,9 +90,12 @@ fn track_camera_solves_and_creates_layers_on_the_plane() {
     // Method Used / Average Error are reported in the effect.
     let g = s.active_comp().unwrap().layer(clip).unwrap().effects().unwrap().groups().next().unwrap().clone();
     assert!(matches!(g.prop(ct::METHOD_USED).map(|p| &p.value), Some(effectcraft_keyframe::Value::Str(m)) if !m.is_empty()));
+    g
+}
 
-    // Pick floor points on frame 12 (their 3D positions lie on y = 1.5 in the true scene: the
-    // ones seen below the horizon at the bottom of the frame).
+/// Pick floor points on frame 12 (their 3D positions lie on y = 1.5 in the true scene: the
+/// ones seen below the horizon at the bottom of the frame).
+fn select_floor_points(s: &mut Session) -> Vec<u64> {
     s.execute("time.set", json!({"time": frame_time(12).seconds()})).unwrap();
     let pts = s.execute("camera.points", json!({})).unwrap();
     let list = pts["points"].as_array().unwrap();
@@ -101,32 +104,19 @@ fn track_camera_solves_and_creates_layers_on_the_plane() {
     assert!(floor.len() >= 3, "{floor:?}");
     s.execute("camera.selectPoints", json!({"points": floor})).unwrap();
     assert_eq!(s.state.camera_points.len(), floor.len());
+    floor
+}
 
-    // Create Solid and Camera: one undo step, camera + solid.
-    let r = s.execute_checked("camera.createFromSolve", json!({"kind": "solid"})).unwrap();
-    let cam = LayerId(r["camera"].as_u64().unwrap());
-    let solid = LayerId(r["layers"][0].as_u64().unwrap());
-    let comp = s.active_comp().unwrap().clone();
-    assert!(comp.layer(cam).unwrap().is_camera());
-    assert_eq!(comp.layer(cam).unwrap().name, "3D Tracker Camera");
-    assert_eq!(comp.layers[0].id, cam);
-    let sl = comp.layer(solid).unwrap();
-    assert!(sl.switches.three_d);
-    assert!(sl.name.starts_with("Track Solid"));
-    // The camera is keyed on every frame.
-    assert_eq!(comp.layer(cam).unwrap().props.prop("transform/position").unwrap().keys.len(), 25);
-
-    // Every solved point projects through the created camera exactly where the solve puts it,
-    // and onto its tracked position (the footage fills the comp, so layer pixels are comp
-    // pixels): within 1 px for 95 % of the observations (the rest are the solve's outliers:
-    // features on occlusion edges), 0.5 px on average.
+/// Every solved point projects through the created camera exactly where the solve puts it,
+/// and onto its tracked position (the footage fills the comp, so layer pixels are comp
+/// pixels): within 1 px for 95 % of the observations (the rest are the solve's outliers:
+/// features on occlusion edges), 0.5 px on average.
+fn assert_reprojection(s: &Session, comp: &Comp, pl: &Placed, g: &PropGroup) {
     let cid = s.active_comp_id().unwrap();
-    let uid = g.uid;
-    let pl = crate::camera_track::placed(&s.project, cid, clip, uid).unwrap();
-    let tracks = ct::tracks(&crate::camera_track::static_params(&g)).unwrap();
+    let tracks = ct::tracks(&crate::camera_track::static_params(g)).unwrap();
     let mut errs = vec![];
     for k in [0u32, 6, 12, 18, 24] {
-        let ctx = EvalCtx::new(&s.project, cid, &comp, frame_time(k));
+        let ctx = EvalCtx::new(&s.project, cid, comp, frame_time(k));
         let camst = active_camera(&ctx);
         for sp in pl.solve.visible(k as usize) {
             let Some(obs) = tracks.track(sp.id).and_then(|t| t.at(k)) else { continue };
@@ -142,34 +132,31 @@ fn track_camera_solves_and_creates_layers_on_the_plane() {
     let p95 = errs[errs.len() * 95 / 100];
     let mean = errs.iter().sum::<f64>() / errs.len() as f64;
     assert!(p95 < 1.0 && mean < 0.5, "p95 {p95} px, mean {mean} px");
+}
 
-    // The solid lies on the selected points' plane.
+/// The solid lies on the selected points' plane and faces the camera.
+fn assert_solid_on_plane(s: &Session, comp: &Comp, sl: &Layer, pl: &Placed, size: f64) {
+    let cid = s.active_comp_id().unwrap();
     let tr = sl.props.sub("transform").unwrap();
     let pos = tr.get("position").unwrap().value.as_vec3();
     let ori = tr.get("orientation").unwrap().value.as_vec3();
     let normal = linalg::mv(&linalg::from_euler_xyz(ori), [0.0, 0.0, -1.0]);
-    let size = r["target"]["size"].as_f64().unwrap();
     for id in &s.state.camera_points {
         let w = pl.to_world(pl.solve.point(*id).unwrap().pos);
         let d = linalg::dot(linalg::sub(w, pos), normal).abs();
         assert!(d < 0.05 * size.max(1.0) + 1.0, "point {id} is {d} px off the plane");
     }
-    // The solid faces the camera.
-    let ctx = EvalCtx::new(&s.project, cid, &comp, frame_time(12));
+    let ctx = EvalCtx::new(&s.project, cid, comp, frame_time(12));
     let eye = active_camera(&ctx).eye;
     assert!(linalg::dot(normal, linalg::sub([eye.x, eye.y, eye.z], pos)) > 0.0);
+}
 
-    // Undo removes both layers; redo brings them back.
-    let before = comp.layers.len();
-    assert!(s.undo());
-    assert_eq!(s.active_comp().unwrap().layers.len(), before - 2);
-    assert!(s.redo());
-    assert_eq!(s.active_comp().unwrap().layers.len(), before);
-
-    // A second create reuses the camera: Create Multiple Nulls and Camera.
+/// A second create reuses the camera (Create Multiple Nulls and Camera), then Text and
+/// Shadow Catcher (+ light).
+fn assert_create_kinds(s: &mut Session, cam: LayerId, n_floor: usize) {
     let r = s.execute_checked("camera.createFromSolve", json!({"kind": "null", "multiple": true})).unwrap();
     assert_eq!(r["camera"].as_u64().unwrap(), cam.0);
-    assert_eq!(r["layers"].as_array().unwrap().len(), floor.len());
+    assert_eq!(r["layers"].as_array().unwrap().len(), n_floor);
     // Text and Shadow Catcher (+ light).
     let r = s.execute_checked("camera.createFromSolve", json!({"kind": "text"})).unwrap();
     assert_eq!(r["layers"].as_array().unwrap().len(), 1);
@@ -180,11 +167,12 @@ fn track_camera_solves_and_creates_layers_on_the_plane() {
     assert_eq!(comp.layer(ids[0]).unwrap().props.prop("materialOptions/acceptsShadows").unwrap().value.as_enum(), 2);
     assert!(comp.layer(ids[1]).unwrap().is_light());
     assert!(s.execute_checked("camera.createFromSolve", json!({"kind": "teapot"})).is_err());
+}
 
-    // Set Ground Plane and Origin: the target becomes the origin; a null created there sits at
-    // (0, 0, 0) lying on the X-Z plane (its front facing up, −y).
+/// Set Ground Plane and Origin, then an explicit target.
+fn assert_ground_and_target(s: &mut Session) {
     s.execute_checked("camera.setGroundPlane", json!({})).unwrap();
-    assert_eq!(status(&mut s)["groundPlane"], true);
+    assert_eq!(status(s)["groundPlane"], true);
     let r = s.execute_checked("camera.createFromSolve", json!({"kind": "null"})).unwrap();
     let null = LayerId(r["layers"][0].as_u64().unwrap());
     let tr = s.active_comp().unwrap().layer(null).unwrap().props.sub("transform").unwrap().clone();
@@ -203,6 +191,44 @@ fn track_camera_solves_and_creates_layers_on_the_plane() {
     assert!(linalg::norm(linalg::sub(pos, [10.0, 0.0, 20.0])) < 1e-6, "{pos:?}");
     let front = linalg::mv(&linalg::from_euler_xyz(tr.get("orientation").unwrap().value.as_vec3()), [0.0, 0.0, -1.0]);
     assert!(linalg::norm(linalg::sub(front, [0.0, 0.0, -1.0])) < 1e-6, "{front:?}");
+}
+
+#[test]
+fn track_camera_solves_and_creates_layers_on_the_plane() {
+    let (mut s, clip) = tracked(json!({}));
+    let g = assert_solved(&mut s, clip);
+    let floor = select_floor_points(&mut s);
+
+    // Create Solid and Camera: one undo step, camera + solid.
+    let r = s.execute_checked("camera.createFromSolve", json!({"kind": "solid"})).unwrap();
+    let cam = LayerId(r["camera"].as_u64().unwrap());
+    let solid = LayerId(r["layers"][0].as_u64().unwrap());
+    let comp = s.active_comp().unwrap().clone();
+    assert!(comp.layer(cam).unwrap().is_camera());
+    assert_eq!(comp.layer(cam).unwrap().name, "3D Tracker Camera");
+    assert_eq!(comp.layers[0].id, cam);
+    let sl = comp.layer(solid).unwrap();
+    assert!(sl.switches.three_d);
+    assert!(sl.name.starts_with("Track Solid"));
+    // The camera is keyed on every frame.
+    assert_eq!(comp.layer(cam).unwrap().props.prop("transform/position").unwrap().keys.len(), 25);
+
+    let cid = s.active_comp_id().unwrap();
+    let uid = g.uid;
+    let pl = crate::camera_track::placed(&s.project, cid, clip, uid).unwrap();
+    assert_reprojection(&s, &comp, &pl, &g);
+    assert_solid_on_plane(&s, &comp, sl, &pl, r["target"]["size"].as_f64().unwrap());
+
+    // Undo removes both layers; redo brings them back.
+    let before = comp.layers.len();
+    assert!(s.undo());
+    assert_eq!(s.active_comp().unwrap().layers.len(), before - 2);
+    assert!(s.redo());
+    assert_eq!(s.active_comp().unwrap().layers.len(), before);
+
+    assert_create_kinds(&mut s, cam, floor.len());
+
+    assert_ground_and_target(&mut s);
 
     // Serde keeps the analysis.
     let back = effectcraft_project::Project::from_json(&s.project.to_json()).unwrap();
diff --git a/crates/engine/src/tests_codec_options.rs b/crates/engine/src/tests/codec_options.rs
similarity index 69%
rename from crates/engine/src/tests_codec_options.rs
rename to crates/engine/src/tests/codec_options.rs
index af7249329..e94dbb876 100644
--- a/crates/engine/src/tests_codec_options.rs
+++ b/crates/engine/src/tests/codec_options.rs
@@ -171,3 +171,70 @@ fn an_unknown_comp_is_named_in_the_error() {
         assert!(e.contains(&format!("no composition {name}")), "{cmd}: {e}");
     }
 }
+
+/// OpenEXR compression and bit depth over the command API (#2911): set on add, on an Output
+/// Module and on a second module, listed by `renderQueue.formats`, refused when unknown, and kept
+/// through a project save and load. A module that doesn't name them stays ZIP, 32-bit float.
+#[test]
+fn exr_compression_and_bit_depth_options() {
+    use effectcraft_project::render_queue::{ExrBitDepth, ExrCompression};
+    let mut s = session();
+    let a = s.execute("renderQueue.add", json!({"format": "exr"})).unwrap();
+    let om = &s.project.render_queue[0].output;
+    assert_eq!((om.format, om.exr_compression, om.exr_bit_depth), (OutputFormat::ExrSequence, ExrCompression::Zip, ExrBitDepth::Float));
+    let id = a["item"].clone();
+    s.execute("renderQueue.setOutputModule", json!({"item": id, "exrCompression": "piz", "exrBitDepth": "half"})).unwrap();
+    let om = &s.project.render_queue[0].output;
+    assert_eq!((om.exr_compression, om.exr_bit_depth, om.name.as_str()), (ExrCompression::Piz, ExrBitDepth::Half, "Custom"));
+    s.execute("renderQueue.setOutputModule", json!({"item": id, "exrCompression": "DWAB", "exrBitDepth": 32})).unwrap();
+    let om = &s.project.render_queue[0].output;
+    assert_eq!((om.exr_compression, om.exr_bit_depth), (ExrCompression::Dwab, ExrBitDepth::Float));
+    for bad in [json!({"exrCompression": "htj2k"}), json!({"exrBitDepth": "8"}), json!({"exrCompression": 3})] {
+        let mut p = bad.clone();
+        p["item"] = id.clone();
+        assert!(s.execute("renderQueue.setOutputModule", p).is_err(), "{bad}");
+    }
+    assert_eq!(s.project.render_queue[0].output.exr_compression, ExrCompression::Dwab, "a refused value changes nothing");
+    s.execute("render.addOutputModule", json!({"item": id, "format": "exr", "exrCompression": "b44a", "exrBitDepth": "half"})).unwrap();
+    let extra = &s.project.render_queue[0].extra_outputs[0];
+    assert_eq!((extra.exr_compression, extra.exr_bit_depth), (ExrCompression::B44a, ExrBitDepth::Half));
+    let b = s.execute("renderQueue.add", json!({"format": "exr", "exrCompression": "rle", "exrBitDepth": "16"})).unwrap();
+    assert_eq!(b["output"]["exr_compression"], "Rle", "{b}");
+    let log = s.project.render_queue[1].output.describe();
+    assert!(log.contains(&("Compression", "RLE".to_string())) && log.contains(&("Bit Depth", "16-bit Half Float".to_string())), "{log:?}");
+
+    let f = s.execute("renderQueue.formats", json!({})).unwrap();
+    let ids: Vec<&str> = f["exrCompressions"].as_array().unwrap().iter().filter_map(|c| c["id"].as_str()).collect();
+    assert_eq!(ids, ["none", "rle", "zips", "zip", "piz", "pxr24", "b44", "b44a", "dwaa", "dwab"]);
+    assert_eq!(f["exrBitDepths"], json!(["half", "float"]));
+
+    // Saved and opened again, the project keeps them.
+    let dir = std::env::temp_dir().join(format!("ec-exr-options-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("exr.ecproj");
+    std::fs::write(&path, s.project.to_file_json().unwrap()).unwrap();
+    let mut t = Session::default();
+    t.execute("file.open", json!({"path": path})).unwrap();
+    let q = &t.project.render_queue;
+    assert_eq!((q[0].output.exr_compression, q[0].output.exr_bit_depth), (ExrCompression::Dwab, ExrBitDepth::Float));
+    assert_eq!((q[0].extra_outputs[0].exr_compression, q[0].extra_outputs[0].exr_bit_depth), (ExrCompression::B44a, ExrBitDepth::Half));
+    assert_eq!((q[1].output.exr_compression, q[1].output.exr_bit_depth), (ExrCompression::Rle, ExrBitDepth::Half));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Settings ▸ Export ▸ Append Bit Depth to File Name names a half-float OpenEXR module's frames
+/// `_16bpc` and a 32-bit one's `_32bpc` (#2911).
+#[test]
+fn append_bit_depth_follows_the_exr_bit_depth() {
+    use effectcraft_project::render_queue::{ExrBitDepth, RenderQueueItem};
+    let mut s = session();
+    s.execute("prefs.set", json!({"values": {"export.appendBitsToName": true}})).unwrap();
+    let mut item = RenderQueueItem::new(1, s.active_comp_id().unwrap());
+    item.output = effectcraft_project::render_queue::OutputModule::for_format(OutputFormat::ExrSequence);
+    item.output.output = "/out/Main_[#####].exr".into();
+    for (depth, tag) in [(ExrBitDepth::Half, "_16bpc"), (ExrBitDepth::Float, "_32bpc")] {
+        item.output.exr_bit_depth = depth;
+        let outs = s.outputs_of(&item, None).unwrap();
+        assert!(outs.iter().all(|(_, p)| p.contains(tag)), "{depth:?}: {outs:?}");
+    }
+}
diff --git a/crates/engine/src/tests_color_view.rs b/crates/engine/src/tests/color_view.rs
similarity index 100%
rename from crates/engine/src/tests_color_view.rs
rename to crates/engine/src/tests/color_view.rs
diff --git a/crates/engine/src/tests/crypto_pick.rs b/crates/engine/src/tests/crypto_pick.rs
new file mode 100644
index 000000000..82fe21e71
--- /dev/null
+++ b/crates/engine/src/tests/crypto_pick.rs
@@ -0,0 +1,953 @@
+//! `effect.pickCryptomatte` / `effect.cryptomatteAt` (#473): the Cryptomatte eyedropper reads the
+//! aux channels the effect renders from (footage at its source time, a 3D precomp's generated
+//! pass) and edits the Selection text in one undo step.
+
+use std::sync::Arc;
+
+use effectcraft_project::{Footage, FootageKind, ItemId};
+use effectcraft_raster::channels3d::{crypto_float, crypto_hash};
+use effectcraft_raster::{AuxChannels, Image};
+use effectcraft_time::{FrameRate, Tick};
+use serde_json::{Value, json};
+
+use crate::Session;
+use crate::render::FootageSource;
+
+const COMMA: &str = "Green, \"Glossy\"";
+
+/// 8 × 4 footage with a 16 × 8 Cryptomatte (two aux pixels per layer pixel). Layer pixels in x:
+/// 0-1 `left` (0.6) over `right` (0.4); 2-3 `left` (0.3) under the comma name (0.7), ranks out of
+/// order; 4-5 `star*`; 6 an ID missing from the manifest; 7 a 0.5 / 0.5 tie of `left` and
+/// `right`. Rows 3+ are empty. From 1 s of source time `late` replaces columns 0-1.
+struct Crypto;
+
+fn aux_at(t: Tick) -> AuxChannels {
+    let (w, h) = (16usize, 8usize);
+    let mut planes = vec![vec![0.0f32; w * h]; 4];
+    for (i, x) in (0..w * h).map(|i| (i, i % w)).filter(|(i, _)| i / w < 6) {
+        let late = if t >= Tick::from_seconds_f64(1.0) { "late" } else { "left" };
+        let (a, ca, b, cb) = match x {
+            0..4 => (late, 0.6, "right", 0.4),
+            4..8 => ("left", 0.3, COMMA, 0.7),
+            8..12 => ("star*", 1.0, "", 0.0),
+            12..14 => ("ghost", 1.0, "", 0.0),
+            _ => ("left", 0.5, "right", 0.5),
+        };
+        for (k, v) in [crypto_float(crypto_hash(a)), ca, crypto_float(crypto_hash(b)), cb].into_iter().enumerate() {
+            planes[k][i] = v;
+        }
+    }
+    let mut aux = AuxChannels::new(w as u32, h as u32, 1.0);
+    for (k, c) in ["R", "G", "B", "A"].iter().enumerate() {
+        aux.channels.push((format!("CryptoObject00.{c}"), planes[k].clone()));
+    }
+    aux.manifests = vec![("CryptoObject".into(), ["left", "right", "late", COMMA, "star*"].iter().map(|n| (n.to_string(), crypto_hash(n))).collect())];
+    // A second view's layer of the same kind (`Z.CryptoObject`, stored Layer 3): "right" everywhere.
+    aux.channels.push(("Z.CryptoObject00.R".into(), vec![crypto_float(crypto_hash("right")); w * h]));
+    aux.channels.push(("Z.CryptoObject00.G".into(), vec![1.0; w * h]));
+    aux.manifests.push(("Z.CryptoObject".into(), vec![("right".into(), crypto_hash("right"))]));
+    aux
+}
+
+impl FootageSource for Crypto {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, t: Tick) -> Option<Arc<AuxChannels>> {
+        Some(Arc::new(aux_at(t)))
+    }
+}
+
+struct Probe;
+impl crate::Importer for Probe {
+    fn probe(&self, path: &str) -> Result<Footage, String> {
+        let duration = Tick::from_seconds_f64(2.0);
+        // A half-size proxy of the EXR.
+        let (width, height) = if path.contains("proxy") { (4, 2) } else { (8, 4) };
+        Ok(Footage {
+            path: path.into(),
+            kind: FootageKind::Video,
+            width,
+            height,
+            has_video: true,
+            frame_rate: FrameRate::from_f64(24.0),
+            duration,
+            ..Default::default()
+        })
+    }
+}
+
+fn session() -> Session {
+    let mut s = Session { footage: Arc::new(Crypto), importer: Some(Arc::new(Probe)), ..Default::default() };
+    let item = s.execute("file.import", json!({"paths": ["/renders/crypto.exr"]})).unwrap()["items"][0].clone();
+    s.execute("comp.new", json!({"name": "C", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    s
+}
+
+fn pick(s: &mut Session, x: f64, mode: &str) -> Value {
+    s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": x, "y": 1.5, "mode": mode})).unwrap()
+}
+
+fn selection(s: &Session) -> String {
+    let l = &s.active_comp().unwrap().layers[0];
+    let g = l.effects().unwrap().groups().next().unwrap();
+    match &g.prop("selection").unwrap().value {
+        effectcraft_keyframe::Value::Str(t) => t.clone(),
+        v => panic!("{v:?}"),
+    }
+}
+
+#[test]
+fn picks_replace_add_and_remove_in_one_undo_step_each() {
+    let mut s = session();
+    let steps = s.history.undo.len();
+    let r = pick(&mut s, 0.5, "replace");
+    assert_eq!((r["name"].as_str(), r["selection"].as_str(), r["changed"].as_bool()), (Some("left"), Some("left"), Some(true)), "{r}");
+    assert_eq!(r["hash"], format!("{:08x}", crypto_hash("left")));
+    assert_eq!(s.history.undo.len(), steps + 1);
+    // The highest coverage wins even when it is not rank 0; the name is quoted.
+    assert_eq!(pick(&mut s, 2.5, "add")["selection"], r#"left, "Green, \"Glossy\"""#);
+    // Adding it again changes nothing and leaves no undo step.
+    let again = pick(&mut s, 3.5, "add");
+    assert_eq!((again["changed"].as_bool(), s.history.undo.len()), (Some(false), steps + 2));
+    // A `*` name and an unnamed ID go in as hashes; a tie goes to rank 0.
+    pick(&mut s, 4.5, "add");
+    assert_eq!(pick(&mut s, 6.5, "add")["selection"], format!(r#"left, "Green, \"Glossy\"", <{:08x}>, <{:08x}>"#, crypto_hash("star*"), crypto_hash("ghost")));
+    assert_eq!(s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": 7.5, "y": 0.5})).unwrap()["name"], "left");
+    let r = pick(&mut s, 0.0, "remove");
+    assert_eq!(r["selection"], format!(r#""Green, \"Glossy\"", <{:08x}>, <{:08x}>"#, crypto_hash("star*"), crypto_hash("ghost")));
+    assert_eq!(r["selected"], false);
+    // The text parses back to exactly the picked IDs.
+    let manifest = aux_at(Tick::ZERO).manifests[0].1.clone();
+    let got = effectcraft_effects::selection_hashes(&selection(&s), Some(&manifest));
+    assert_eq!(got, [COMMA, "star*", "ghost"].map(crypto_hash));
+    assert_eq!(s.history.undo.len(), steps + 5);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(selection(&s).starts_with("left, "), "{}", selection(&s));
+    pick(&mut s, 2.0, "replace");
+    assert_eq!(selection(&s), r#""Green, \"Glossy\"""#);
+    // The same selection with other spacing: no change, no undo step.
+    s.execute_checked("prop.set", json!({"path": "effects/#1/selection", "value": " \"Green, \\\"Glossy\\\"\" "})).unwrap();
+    let n = s.history.undo.len();
+    assert_eq!((pick(&mut s, 2.0, "replace")["changed"].as_bool(), s.history.undo.len()), (Some(false), n));
+}
+
+/// A second layer that fits a standard slot (`Z.CryptoObject` beside `CryptoObject`) is picked by
+/// its own Layer value (3); Layer 0 still reads the first one.
+#[test]
+fn pick_reads_the_second_layer_of_a_kind() {
+    let mut s = session();
+    assert_eq!(pick(&mut s, 1.0, "replace")["name"], "left");
+    s.execute_checked("prop.set", json!({"path": "effects/#1/layer", "value": 3})).unwrap();
+    assert_eq!(pick(&mut s, 1.0, "replace")["name"], "right");
+    assert_eq!(s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": 1.0, "y": 1.5})).unwrap()["name"], "right");
+}
+
+#[test]
+fn bad_points_layers_and_modes_are_errors_and_change_nothing() {
+    let mut s = session();
+    let at = |s: &mut Session, x: f64, y: f64| s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": x, "y": y}));
+    for (x, y) in [(-0.1, 1.0), (8.0, 1.0), (1.0, 4.0), (1.0, 3.5), (1e300, -1e300)] {
+        assert!(at(&mut s, x, y).is_err(), "{x},{y}");
+        assert_eq!(s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": x, "y": y})).unwrap(), Value::Null);
+    }
+    assert!(s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 1, "y": 1, "mode": "toggle"})).is_err());
+    assert!(s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 1})).is_err());
+    for scale in [0.0, -1.0, 2.0] {
+        assert!(s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 1, "y": 1, "scale": scale})).is_err(), "{scale}");
+    }
+    s.execute_checked("effect.apply", json!({"effect": "Gaussian Blur"})).unwrap();
+    assert!(s.execute_checked("effect.pickCryptomatte", json!({"effect": 2, "x": 1, "y": 1})).is_err(), "not a Cryptomatte effect");
+    assert_eq!(selection(&s), "");
+    // A layer without aux channels.
+    s.execute("layer.newSolid", json!({"name": "S"})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let e = s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 1, "y": 1})).unwrap_err().to_string();
+    assert!(e.contains("no Cryptomatte channels"), "{e}");
+    // An expression-driven Selection would ignore the edit.
+    let mut s = session();
+    s.execute_checked("prop.setExpression", json!({"path": "effects/#1/selection", "expression": "\"right\""})).unwrap();
+    assert!(s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 1, "y": 1})).is_err());
+    assert_eq!(s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": 1, "y": 1})).unwrap()["selected"], false);
+}
+
+/// The pick reads the frame the render shows: Time Remap's source time, not the layer time.
+#[test]
+fn time_remap_picks_the_shown_source_frame() {
+    let mut s = session();
+    assert_eq!(pick(&mut s, 0.5, "replace")["name"], "left");
+    s.execute_checked("layer.enableTimeRemap", json!({})).unwrap();
+    s.execute_checked("prop.set", json!({"path": "timeRemap", "value": 1.5})).unwrap();
+    assert_eq!(pick(&mut s, 0.5, "replace")["name"], "late");
+}
+
+/// A precomp of a 3D comp: the generated CryptoObject pass names its layers.
+#[test]
+fn picks_on_a_precomp_of_a_3d_comp() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Outer", "width": 40, "height": 20, "frameRate": 24, "duration": 1})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"name": "Red, Ball", "width": 40, "height": 20})).unwrap()["layer"].clone();
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.precompose", json!({"layers": [l], "name": "Inner"})).unwrap();
+    s.execute("layer.select", json!({"layers": [s.active_comp().unwrap().layers[0].id.0]})).ok();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let r = s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 20, "y": 10})).unwrap();
+    assert_eq!((r["name"].as_str(), r["selection"].as_str()), (Some("Red, Ball"), Some("\"Red, Ball\"")), "{r}");
+}
+
+/// The matte the rendered Cryptomatte effect gives the picked ID at the buffer pixel under
+/// `{x, y}`: the pick has to name the ID the effect's own input buffer samples there.
+fn rendered_matte_of_pick(s: &mut Session, x: f64, y: f64, scale: f64) -> (String, f32) {
+    let r = s.execute_checked("effect.pickCryptomatte", json!({"effect": "Cryptomatte", "x": x, "y": y, "scale": scale, "mode": "replace"})).unwrap();
+    let fx = s.active_comp().unwrap().layers[0].effects().unwrap().groups().position(|g| g.match_id == "ec.3d.cryptomatte").unwrap() + 1;
+    s.execute_checked("prop.set", json!({"path": format!("effects/#{fx}/matteOnly"), "value": true})).unwrap();
+    let (cid, comp) = (s.active_comp_id().unwrap(), s.active_comp().unwrap());
+    let layer = &comp.layers[0];
+    let ctx = effectcraft_render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let buf = s.renderer(effectcraft_render::RenderOpts { scale, ..Default::default() }).content_buf(&ctx, layer).unwrap();
+    let (px, py) = buf.to_px([x, y]);
+    let m = buf.img.get(px.floor() as i64, py.floor() as i64)[0];
+    (r["name"].as_str().unwrap_or("?").to_string(), m)
+}
+
+/// Between 3/4 and full resolution footage keeps its native pixels: at 0.8 the effect samples
+/// layer pixel 2 (the comma name, 0.7) at x = 2.2, not the 0.8-grid pixel snapped back to 1.
+#[test]
+fn pick_at_scale_0_8_matches_the_native_buffer_the_effect_renders() {
+    let mut s = session();
+    let (name, m) = rendered_matte_of_pick(&mut s, 2.2, 1.5, 0.8);
+    assert!(m >= 0.5, "picked {name:?}, but the render gives it matte {m} there");
+    assert_eq!(name, COMMA);
+}
+
+/// A half-size proxy renders a buffer at 0.5 layer pixels per pixel even at full resolution:
+/// x = 6.5 lies in buffer pixel 3, which samples layer x = 7 (the `left` / `right` tie).
+#[test]
+fn pick_on_a_proxy_matches_the_proxy_sized_buffer() {
+    let mut s = session();
+    let item = *s.project.items.iter().find(|(_, i)| matches!(i.kind, effectcraft_project::ItemKind::Footage(_))).unwrap().0;
+    s.execute("file.setProxy", json!({"item": item.0, "path": "/renders/crypto_proxy.exr"})).unwrap();
+    let (name, m) = rendered_matte_of_pick(&mut s, 6.5, 1.5, 1.0);
+    assert!(m >= 0.5, "picked {name:?}, but the render gives it matte {m} there");
+    assert_eq!(name, "left");
+}
+
+/// 1920-px footage with `left` up to x = 120 and `right` after it, and a 104-px proxy.
+struct Edge;
+impl FootageSource for Edge {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<AuxChannels>> {
+        let (w, h) = (1920usize, 40usize);
+        let mut aux = AuxChannels::new(w as u32, h as u32, 1.0);
+        let ids = (0..w * h).map(|i| crypto_float(crypto_hash(if i % w < 120 { "left" } else { "right" }))).collect();
+        aux.channels = vec![("CryptoObject00.R".into(), ids), ("CryptoObject00.G".into(), vec![1.0; w * h])];
+        aux.manifests = vec![("CryptoObject".into(), ["left", "right"].iter().map(|n| (n.to_string(), crypto_hash(n))).collect())];
+        Some(Arc::new(aux))
+    }
+}
+
+/// Proxy buffer pixel 6's centre maps to layer x = 6.5 / (104 / 1920): 120.0 by division, but
+/// 119.99999999999999 by the reciprocal the effect multiplies with. The pick must agree.
+#[test]
+fn pick_maps_pixel_centres_bit_exactly_as_the_effect() {
+    let mut s = Session { footage: Arc::new(Edge), ..Default::default() };
+    let at = |path: &str, width| Footage {
+        path: path.into(),
+        kind: FootageKind::Video,
+        width,
+        height: 40,
+        has_video: true,
+        frame_rate: FrameRate::from_f64(24.0),
+        duration: Tick::from_seconds_f64(2.0),
+        ..Default::default()
+    };
+    s.importer = Some(Arc::new(EdgeProbe(at("/renders/edge.exr", 1920), at("/renders/edge_proxy.exr", 104))));
+    let item = s.execute("file.import", json!({"paths": ["/renders/edge.exr"]})).unwrap()["items"][0].clone();
+    s.execute("comp.new", json!({"name": "C", "width": 1920, "height": 40, "frameRate": 24, "duration": 2})).unwrap();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    s.execute("file.setProxy", json!({"item": item, "path": "/renders/edge_proxy.exr"})).unwrap();
+    let (name, m) = rendered_matte_of_pick(&mut s, 118.0, 5.0, 1.0);
+    assert_eq!((name.as_str(), m), ("left", 1.0));
+}
+
+struct EdgeProbe(Footage, Footage);
+impl crate::Importer for EdgeProbe {
+    fn probe(&self, path: &str) -> Result<Footage, String> {
+        Ok(if path.contains("proxy") { self.1.clone() } else { self.0.clone() })
+    }
+}
+
+/// Footage whose decoded frames are `num / den` of the probed size (a file re-rendered at another
+/// resolution, a relinked file): the render stretches them over the layer.
+struct OffNominal(u32, u32);
+impl FootageSource for OffNominal {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::new(f.width * self.0 / self.1, f.height * self.0 / self.1)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, t: Tick) -> Option<Arc<AuxChannels>> {
+        Some(Arc::new(aux_at(t)))
+    }
+}
+
+/// Points along rows `ys` where the picked ID isn't lit in the rendered matte under the point.
+fn mismatches(s: &mut Session, scales: &[f64], xs: impl Iterator<Item = f64> + Clone, ys: &[f64]) -> Vec<String> {
+    let mut bad = vec![];
+    for &scale in scales {
+        for (x, &y) in ys.iter().flat_map(|y| xs.clone().map(move |x| (x, y))) {
+            if s.execute("effect.cryptomatteAt", json!({"effect": "Cryptomatte", "x": x, "y": y, "scale": scale})).unwrap().is_null() {
+                continue;
+            }
+            let (name, m) = rendered_matte_of_pick(s, x, y, scale);
+            if m < 0.5 {
+                bad.push(format!("scale {scale} ({x:.2}, {y}): picked {name:?}, matte {m}"));
+            }
+        }
+    }
+    bad
+}
+
+const PREVIEW_SCALES: [f64; 7] = [1.0, 0.8, 0.75, 0.74, 0.5, 0.33, 0.25];
+
+/// The pick follows the decoded frame's real size, not the footage's nominal one.
+#[test]
+fn pick_matches_the_render_when_frames_decode_off_nominal_size() {
+    for (num, den) in [(2, 1), (1, 2), (3, 4)] {
+        let mut s = Session { footage: Arc::new(OffNominal(num, den)), importer: Some(Arc::new(Probe)), ..Default::default() };
+        let item = s.execute("file.import", json!({"paths": ["/renders/crypto.exr"]})).unwrap()["items"][0].clone();
+        s.execute("comp.new", json!({"name": "C", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+        s.execute("layer.addItem", json!({"item": item})).unwrap();
+        s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+        let bad = mismatches(&mut s, &PREVIEW_SCALES, (0..80).map(|i| i as f64 * 0.1 + 0.05), &[0.3, 1.7, 2.6]);
+        assert!(bad.is_empty(), "decode {num}/{den}: {} mismatches:\n{}", bad.len(), bad.join("\n"));
+    }
+}
+
+/// A precomp of a 3D comp, with and without Preserve Resolution (drawn at full size below full
+/// resolution), behind a disabled effect: the pick names the ID the rendered matte shows.
+#[test]
+fn pick_matches_the_render_on_precomps_with_and_without_preserve_resolution() {
+    for preserve in [false, true] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Outer", "width": 40, "height": 20, "frameRate": 24, "duration": 2})).unwrap();
+        let a = s.execute("layer.newSolid", json!({"name": "A", "width": 40, "height": 20})).unwrap()["layer"].clone();
+        let b = s.execute("layer.newSolid", json!({"name": "B", "width": 7, "height": 20})).unwrap()["layer"].clone();
+        s.execute_checked("prop.set", json!({"layer": b, "path": "transform/position", "value": [3.5, 10, -10]})).unwrap();
+        s.execute("layer.setSwitch", json!({"layers": [a, b], "switch": "threeD", "value": true})).unwrap();
+        s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap();
+        let inner = *s.project.items.iter().find(|(_, i)| i.name == "Inner").unwrap().0;
+        s.execute_checked("comp.settings", json!({"comp": inner.0, "preserveResolution": preserve})).unwrap();
+        s.execute("layer.select", json!({"layers": [s.active_comp().unwrap().layers[0].id.0]})).ok();
+        s.execute_checked("effect.apply", json!({"effect": "Gaussian Blur"})).unwrap();
+        s.execute_checked("effect.toggle", json!({"effect": 1, "value": false})).unwrap();
+        s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+        let bad = mismatches(&mut s, &PREVIEW_SCALES, (0..93).map(|i| i as f64 * 0.15 + 0.05), &[10.0]);
+        assert!(bad.is_empty(), "preserve {preserve}: {} mismatches:\n{}", bad.len(), bad.join("\n"));
+    }
+}
+
+/// `w` × `h` footage whose Cryptomatte has an ID per 37 × 29 px cell (`c<col>_<row>`, all in the
+/// manifest), one aux pixel per layer pixel. Built once, as the media pool keeps decoded aux.
+struct Cells(u32, u32, std::sync::OnceLock<Arc<AuxChannels>>);
+impl Cells {
+    fn name(x: usize, y: usize) -> String {
+        format!("c{}_{}", x / 37, y / 29)
+    }
+}
+impl FootageSource for Cells {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<AuxChannels>> {
+        Some(self.2.get_or_init(|| Arc::new(self.build())).clone())
+    }
+}
+impl Cells {
+    fn build(&self) -> AuxChannels {
+        let (w, h) = (self.0 as usize, self.1 as usize);
+        let ids = (0..w * h).map(|i| crypto_float(crypto_hash(&Cells::name(i % w, i / w)))).collect();
+        let mut aux = AuxChannels::new(w as u32, h as u32, 1.0);
+        aux.channels = vec![("CryptoObject00.R".into(), ids), ("CryptoObject00.G".into(), vec![1.0; w * h])];
+        let names = (0..w.div_ceil(37)).flat_map(|x| (0..h.div_ceil(29)).map(move |y| Cells::name(x * 37, y * 29)));
+        aux.manifests = vec![("CryptoObject".into(), names.map(|n| (n.clone(), crypto_hash(&n))).collect())];
+        aux
+    }
+}
+
+struct CellsProbe(u32, u32);
+impl crate::Importer for CellsProbe {
+    fn probe(&self, path: &str) -> Result<Footage, String> {
+        // `…_proxy` is a half-size proxy (rounded up); `…still…` a still image.
+        let (width, height) = if path.contains("proxy") { (self.0.div_ceil(2), self.1.div_ceil(2)) } else { (self.0, self.1) };
+        let (frame_rate, duration) = (FrameRate::from_f64(24.0), Tick::from_seconds_f64(2.0));
+        let kind = if path.contains("still") { FootageKind::Still } else { FootageKind::Video };
+        Ok(Footage { path: path.into(), kind, width, height, has_video: true, frame_rate, duration, ..Default::default() })
+    }
+}
+
+fn cells_session(w: u32, h: u32, blur: bool) -> Session {
+    cells_session_at(w, h, blur, "/renders/cells.exr")
+}
+
+fn cells_session_at(w: u32, h: u32, blur: bool, path: &str) -> Session {
+    let mut s = Session { footage: Arc::new(Cells(w, h, Default::default())), importer: Some(Arc::new(CellsProbe(w, h))), ..Default::default() };
+    let item = s.execute("file.import", json!({"paths": [path]})).unwrap()["items"][0].clone();
+    s.execute("comp.new", json!({"name": "C", "width": w, "height": h, "frameRate": 24, "duration": 2})).unwrap();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    if blur {
+        s.execute_checked("effect.apply", json!({"effect": "Gaussian Blur"})).unwrap();
+        s.execute_checked("prop.set", json!({"path": "effects/#1/blurriness", "value": 40.0})).unwrap();
+    }
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    s
+}
+
+/// Hover latency of `effect.cryptomatteAt` (dev profile): the first call after the viewer's frame
+/// and the next ones, on footage (1080p, 4K, 4K behind a blur) and a 1080p 3D precomp. Run with
+/// `--ignored --nocapture`; it measures, it doesn't assert.
+#[test]
+#[ignore]
+fn hover_latency() {
+    let mut cases: Vec<(&str, Session)> = vec![
+        ("footage 1920x1080", cells_session(1920, 1080, false)),
+        ("footage 3840x2160", cells_session(3840, 2160, false)),
+        ("footage 3840x2160 + blur 40", cells_session(3840, 2160, true)),
+    ];
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Outer", "width": 1920, "height": 1080, "frameRate": 24, "duration": 2})).unwrap();
+    let a = s.execute("layer.newSolid", json!({"name": "A", "width": 1920, "height": 1080})).unwrap()["layer"].clone();
+    let b = s.execute("layer.newSolid", json!({"name": "B", "width": 400, "height": 1080})).unwrap()["layer"].clone();
+    s.execute("layer.setSwitch", json!({"layers": [a, b], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap();
+    s.execute("layer.select", json!({"layers": [s.active_comp().unwrap().layers[0].id.0]})).ok();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    cases.push(("3D precomp 1920x1080", s));
+    for (name, mut s) in cases {
+        let cid = s.active_comp_id().unwrap();
+        let _ = s.render(cid, Tick::ZERO, effectcraft_render::RenderOpts::default());
+        let ms: Vec<String> = (0..6)
+            .map(|i| {
+                let t0 = std::time::Instant::now();
+                let r = s.execute("effect.cryptomatteAt", json!({"effect": "Cryptomatte", "x": 100.0 + 40.0 * i as f64, "y": 500.0})).unwrap();
+                assert!(!r.is_null(), "{name}");
+                format!("{:.3}", t0.elapsed().as_secs_f64() * 1e3)
+            })
+            .collect();
+        // The highlight of the hovered ID (built once per ID, at most 1024 samples wide).
+        let q = json!({"effect": "Cryptomatte", "x": 100.0, "y": 500.0});
+        let hash = u32::from_str_radix(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["hash"].as_str().unwrap(), 16).unwrap();
+        let t0 = std::time::Instant::now();
+        let c = s.crypto_coverage(&q, hash, 1024).unwrap();
+        let cov = t0.elapsed().as_secs_f64() * 1e3;
+        eprintln!("HOVER {name}: first {} ms, then {} ms; highlight {}x{} {cov:.2} ms", ms[0], ms[1..].join(" / "), c.width, c.height);
+    }
+}
+
+/// The hover's probe: built off the thread that asks, kept while only the Selection changes,
+/// rebuilt when anything it reads changes, and a job finished for an older state is not used.
+#[test]
+fn hover_probe_is_built_by_a_job_kept_across_picks_and_dropped_on_other_edits() {
+    let mut s = session();
+    let q = json!({"effect": 1, "x": 0.5, "y": 1.5});
+    let job = s.crypto_probe_job(&q).unwrap().expect("nothing built yet");
+    std::thread::spawn(job).join().unwrap();
+    assert!(s.crypto_probe_job(&q).unwrap().is_none(), "built");
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["name"], "left");
+    // Another scale or time is another probe.
+    assert!(s.crypto_probe_job(&json!({"effect": 1, "x": 0.5, "y": 1.5, "scale": 0.5})).unwrap().is_some());
+    assert!(s.crypto_probe_job(&json!({"effect": 1, "x": 0.5, "y": 1.5, "time": 1.0})).unwrap().is_some());
+    // A pick edits only the Selection: the probe stays.
+    pick(&mut s, 0.5, "replace");
+    assert!(s.crypto_probe_job(&q).unwrap().is_none(), "kept across the pick");
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["selected"], true);
+    // Other edits rebuild it, and the answer follows them.
+    s.execute_checked("layer.enableTimeRemap", json!({})).unwrap();
+    s.execute_checked("prop.set", json!({"path": "timeRemap", "value": 1.5})).unwrap();
+    let stale = s.crypto_probe_job(&q).unwrap().expect("time remap changed it");
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["name"], "late");
+    // A job that finishes after the next edit doesn't answer for it.
+    s.execute_checked("prop.set", json!({"path": "timeRemap", "value": 0.5})).unwrap();
+    stale();
+    assert!(s.crypto_probe_job(&q).unwrap().is_some(), "stale job result is not used");
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["name"], "left");
+    // Errors are kept too, and still errors.
+    s.execute("layer.newSolid", json!({"name": "S"})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let solid = json!({"effect": 1, "x": 1, "y": 1});
+    s.crypto_probe_job(&solid).unwrap().expect("solid")();
+    assert!(s.crypto_probe_job(&solid).unwrap().is_none());
+    assert!(s.execute("effect.cryptomatteAt", solid).unwrap_err().to_string().contains("no Cryptomatte channels"));
+}
+
+/// Picks on 1080p, 4K and odd-sized footage, at the viewer's resolutions and on a half-size proxy,
+/// name the ID the rendered matte shows under the point (points next to cell edges).
+#[test]
+fn picks_match_the_render_at_1080p_4k_odd_sizes_and_on_proxies() {
+    for (w, h) in [(1920, 1080), (3840, 2160), (1919, 1079)] {
+        let mut s = cells_session(w, h, false);
+        let (wl, hl) = (f64::from(w), f64::from(h));
+        let xs = [36.6, 37.2, 0.4, wl / 2.0 + 0.3, wl - 0.6, wl - 37.4];
+        let ys = [28.7, 29.1, hl - 0.5, hl / 3.0];
+        let mut bad = mismatches(&mut s, &[1.0, 0.5, 0.33, 0.25], xs.iter().copied(), &ys);
+        let item = *s.project.items.iter().find(|(_, i)| matches!(i.kind, effectcraft_project::ItemKind::Footage(_))).unwrap().0;
+        s.execute("file.setProxy", json!({"item": item.0, "path": "/renders/cells_proxy.exr"})).unwrap();
+        bad.extend(mismatches(&mut s, &[1.0, 0.5, 0.33, 0.25], xs.iter().copied(), &ys).into_iter().map(|b| format!("proxy {b}")));
+        assert!(bad.is_empty(), "{w}x{h}: {} mismatches:\n{}", bad.len(), bad.join("\n"));
+    }
+}
+
+/// The kept probe, and the aux channels it holds, go when the eyedropper is disarmed, when its
+/// layer or effect is deleted, on Open / New, and when its footage changes.
+#[test]
+fn hover_probe_is_released_on_disarm_delete_open_and_footage_changes() {
+    let q = json!({"effect": "Cryptomatte", "x": 100.0, "y": 100.0});
+    let ends: [(&str, fn(&mut Session)); 5] = [
+        ("disarm", |s| s.drop_crypto_probe()),
+        ("layer delete", |s| {
+            let lid = s.active_comp().unwrap().layers[0].id.0;
+            s.execute_checked("edit.clear", json!({"layers": [lid]})).unwrap();
+        }),
+        ("effect delete", |s| {
+            s.execute_checked("effect.remove", json!({"effect": "Cryptomatte"})).unwrap();
+        }),
+        ("open / new", |s| s.replace_project(effectcraft_project::Project::default(), None)),
+        ("footage change", |s| {
+            let f = s.project.items.values().find_map(|i| match &i.kind {
+                effectcraft_project::ItemKind::Footage(f) => Some(f.clone()),
+                _ => None,
+            });
+            s.forget_decoded(&f.unwrap());
+        }),
+    ];
+    for (what, end) in ends {
+        let mut s = cells_session(640, 360, false);
+        let aux = s.footage.aux(ItemId(0), &Footage::default(), Tick::ZERO).unwrap();
+        let unpinned = Arc::strong_count(&aux);
+        assert!(!s.execute("effect.cryptomatteAt", q.clone()).unwrap().is_null());
+        assert!(s.crypto_probe_stats().0 && Arc::strong_count(&aux) > unpinned, "{what}: kept");
+        end(&mut s);
+        assert!(!s.crypto_probe_stats().0, "{what}: the probe is gone");
+        assert_eq!(Arc::strong_count(&aux), unpinned, "{what}: its aux channels are let go");
+    }
+}
+
+/// A probe is keyed by the frame it reads: on a still, or footage held by Time Remap, every comp
+/// time shares one; each footage frame has its own, and so does each comp time once something
+/// before the Cryptomatte effect is animated.
+#[test]
+fn hover_probe_is_keyed_by_the_source_frame() {
+    let builds = |s: &mut Session, times: &[f64]| -> Vec<u64> {
+        let b = s.crypto_probe_stats().1;
+        times
+            .iter()
+            .map(|t| {
+                let r = s.execute("effect.cryptomatteAt", json!({"effect": "Cryptomatte", "x": 40.0, "y": 30.0, "time": t})).unwrap();
+                assert_eq!(r["name"], "c1_1");
+                s.crypto_probe_stats().1 - b
+            })
+            .collect()
+    };
+    let f = 1.0 / 24.0;
+    let mut s = cells_session_at(320, 180, false, "/renders/still.exr");
+    assert_eq!(builds(&mut s, &[0.0, f, 0.5, 1.9]), [1, 1, 1, 1], "a still: one probe");
+    let mut s = cells_session(320, 180, false);
+    assert_eq!(builds(&mut s, &[0.0, f * 0.4, f, f * 1.5, 0.0]), [1, 1, 2, 2, 3], "footage: a probe per frame");
+    s.execute_checked("layer.enableTimeRemap", json!({})).unwrap();
+    s.execute_checked("prop.toggleAnimation", json!({"path": "timeRemap", "value": false})).unwrap();
+    s.execute_checked("prop.set", json!({"path": "timeRemap", "value": 0.5})).unwrap();
+    assert_eq!(builds(&mut s, &[0.0, f, 1.2]), [1, 1, 1], "held by Time Remap: one source frame");
+    let mut s = cells_session_at(320, 180, true, "/renders/still.exr");
+    assert_eq!(builds(&mut s, &[0.0, f]), [1, 1], "a still blur");
+    s.execute_checked("prop.addKey", json!({"path": "effects/#1/blurriness", "time": 0.0, "value": 2.0})).unwrap();
+    s.execute_checked("prop.addKey", json!({"path": "effects/#1/blurriness", "time": 1.0, "value": 6.0})).unwrap();
+    assert_eq!(builds(&mut s, &[0.0, f, f]), [1, 2, 2], "an animated blur before it: per comp time");
+}
+
+/// Probes of two Cryptomatte effects (on two footage layers) at the same revision and frame
+/// don't answer for each other.
+#[test]
+fn hover_probes_are_per_layer_and_effect() {
+    /// `…late…` files have the IDs [`Crypto`] has from 1 s.
+    struct ByFile;
+    impl FootageSource for ByFile {
+        fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+            Some(Arc::new(Image::new(f.width, f.height)))
+        }
+        fn aux(&self, _: ItemId, f: &Footage, t: Tick) -> Option<Arc<AuxChannels>> {
+            Some(Arc::new(aux_at(if f.path.contains("late") { Tick::from_seconds_f64(1.0) } else { t })))
+        }
+    }
+    let mut s = Session { footage: Arc::new(ByFile), importer: Some(Arc::new(Probe)), ..Default::default() };
+    let items = s.execute("file.import", json!({"paths": ["/renders/crypto.exr", "/renders/late.exr"]})).unwrap()["items"].clone();
+    s.execute("comp.new", json!({"name": "C", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+    let layers: Vec<Value> = (0..2).map(|i| s.execute("layer.addItem", json!({"item": items[i]})).unwrap()["layer"].clone()).collect();
+    for l in &layers {
+        s.execute_checked("effect.apply", json!({"layers": [l], "effect": "Cryptomatte"})).unwrap();
+    }
+    let on = |l: &Value| json!({"layer": l, "effect": 1, "x": 0.5, "y": 1.5});
+    for (l, want) in [(&layers[0], "left"), (&layers[1], "late"), (&layers[0], "left")] {
+        assert_eq!(s.execute("effect.cryptomatteAt", on(l)).unwrap()["name"], want);
+    }
+}
+
+/// [`Crypto`]'s IDs, counting the reads, and holding them while `hold` is set (a build caught
+/// in the middle).
+#[derive(Default)]
+struct Gate {
+    reads: std::sync::atomic::AtomicUsize,
+    hold: std::sync::atomic::AtomicBool,
+    entered: std::sync::atomic::AtomicBool,
+    /// Picture frames read (the effect's input render).
+    frames: std::sync::atomic::AtomicUsize,
+}
+impl FootageSource for Gate {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        self.frames.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, t: Tick) -> Option<Arc<AuxChannels>> {
+        use std::sync::atomic::Ordering::SeqCst;
+        self.reads.fetch_add(1, SeqCst);
+        self.entered.store(true, SeqCst);
+        while self.hold.load(SeqCst) {
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+        Some(Arc::new(aux_at(t)))
+    }
+}
+
+/// Only the newest request's build is kept: a job that finishes late doesn't evict a newer probe,
+/// a job superseded before it runs doesn't build, one superseded (or outdated by an edit) while
+/// it builds stores nothing, and `probeOnly` never builds on the asking thread.
+#[test]
+fn hover_probe_builds_store_only_the_newest_and_never_build_for_probe_only() {
+    use std::sync::atomic::Ordering::SeqCst;
+    let gate = Arc::new(Gate::default());
+    let mut s = session();
+    s.footage = gate.clone();
+    let at = |t: f64| json!({"effect": 1, "x": 0.5, "y": 1.5, "time": t});
+    let reads = || gate.reads.load(SeqCst);
+    // A late job for another frame doesn't evict the probe built since.
+    let job0 = s.crypto_probe_job(&at(0.0)).unwrap().unwrap();
+    s.execute("effect.cryptomatteAt", at(1.0)).unwrap();
+    assert!(s.crypto_probe_job(&at(1.0)).unwrap().is_none());
+    job0();
+    assert!(s.crypto_probe_job(&at(1.0)).unwrap().is_none(), "the late job evicted the newer probe");
+    // A request for another probe cancels the earlier job: it doesn't even build.
+    let (old, new) = (s.crypto_probe_job(&at(0.5)).unwrap().unwrap(), s.crypto_probe_job(&at(0.25)).unwrap().unwrap());
+    let before = reads();
+    old();
+    assert_eq!(reads(), before, "a superseded job doesn't build");
+    new();
+    assert!(reads() > before);
+    assert!(s.crypto_probe_job(&at(0.25)).unwrap().is_none(), "the newest request's probe is kept");
+    // The same request again doesn't cancel the job in flight.
+    let (a, b) = (s.crypto_probe_job(&at(1.5)).unwrap().unwrap(), s.crypto_probe_job(&at(1.5)).unwrap().unwrap());
+    a();
+    drop(b);
+    assert!(s.crypto_probe_job(&at(1.5)).unwrap().is_none());
+    // Superseded, or outdated by an edit, while it builds: it stores nothing.
+    for edit in [false, true] {
+        let job = s.crypto_probe_job(&at(0.75)).unwrap().unwrap();
+        gate.hold.store(true, SeqCst);
+        gate.entered.store(false, SeqCst);
+        let run = std::thread::spawn(job);
+        while !gate.entered.load(SeqCst) {
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+        if edit {
+            s.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap();
+        } else {
+            drop(s.crypto_probe_job(&at(0.8)).unwrap());
+        }
+        gate.hold.store(false, SeqCst);
+        run.join().unwrap();
+        let stored = if edit { s.crypto_probe_stats().0 } else { s.crypto_probe_job(&at(0.75)).unwrap().is_none() };
+        assert!(!stored, "edit {edit}: the outdated build was stored");
+    }
+    // `probeOnly`: pending without a probe, and nothing built.
+    let before = reads();
+    let mut q = at(0.0);
+    q["probeOnly"] = json!(true);
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap(), json!({"pending": true}));
+    q["mode"] = json!("add");
+    assert_eq!(s.execute("effect.pickCryptomatte", q.clone()).unwrap()["pending"], true);
+    assert_eq!(reads(), before, "nothing built for probeOnly");
+    s.crypto_probe_job(&q).unwrap().unwrap()();
+    assert_eq!(s.execute("effect.pickCryptomatte", q.clone()).unwrap()["selection"], "left");
+}
+
+/// A build cancelled while it reads the IDs (a newer request, disarming, an edit, another
+/// project) stops before it renders the effect's input, so the next build isn't kept waiting.
+#[test]
+fn a_cancelled_build_stops_before_rendering_its_input() {
+    use std::sync::atomic::Ordering::SeqCst;
+    let cancels: [(&str, fn(&mut Session)); 4] = [
+        ("newer request", |s| drop(s.crypto_probe_job(&json!({"effect": 1, "x": 0.5, "y": 1.5, "time": 1.5})).unwrap())),
+        ("disarm", |s| s.drop_crypto_probe()),
+        ("edit", |s| drop(s.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap())),
+        ("project switch", |s| s.replace_project(effectcraft_project::Project::default(), None)),
+    ];
+    for (what, cancel) in [("not cancelled", None), ("newer request", Some(0)), ("disarm", Some(1)), ("edit", Some(2)), ("project switch", Some(3))] {
+        let gate = Arc::new(Gate::default());
+        let mut s = session();
+        s.footage = gate.clone();
+        let job = s.crypto_probe_job(&json!({"effect": 1, "x": 0.5, "y": 1.5, "time": 0.5})).unwrap().unwrap();
+        gate.hold.store(true, SeqCst);
+        let run = std::thread::spawn(job);
+        while !gate.entered.load(SeqCst) {
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+        if let Some(k) = cancel {
+            cancels[k].1(&mut s);
+        }
+        gate.hold.store(false, SeqCst);
+        run.join().unwrap();
+        let rendered = gate.frames.load(SeqCst) > 0;
+        assert_eq!(rendered, cancel.is_none(), "{what}: the input was rendered: {rendered}");
+    }
+}
+
+/// The probe doesn't read the Cryptomatte effect's own Selection: keyframed, a still keeps one
+/// probe for every comp time (an animated effect before it still makes one per time).
+#[test]
+fn an_animated_selection_keeps_one_probe_on_a_still() {
+    let mut s = cells_session_at(320, 180, false, "/renders/still.exr");
+    for (t, v) in [(0.0, "c1_1"), (1.0, "c2_2")] {
+        s.execute_checked("prop.addKey", json!({"path": "effects/#1/selection", "time": t, "value": v})).unwrap();
+    }
+    let b = s.crypto_probe_stats().1;
+    for t in [0.0, 1.0 / 24.0, 0.5, 1.5] {
+        assert_eq!(s.execute("effect.cryptomatteAt", json!({"effect": "Cryptomatte", "x": 40.0, "y": 30.0, "time": t})).unwrap()["name"], "c1_1");
+    }
+    assert_eq!(s.crypto_probe_stats().1 - b, 1, "one probe for the still");
+}
+
+/// A panic while a probe is built on another thread becomes the probe's error: the job returns,
+/// the hover reports it, and it isn't retried for that frame.
+#[test]
+fn a_panicking_probe_build_becomes_an_error() {
+    struct Broken;
+    impl FootageSource for Broken {
+        fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+            Some(Arc::new(Image::new(f.width, f.height)))
+        }
+        fn aux(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<AuxChannels>> {
+            panic!("a broken EXR reader")
+        }
+    }
+    let mut s = Session { footage: Arc::new(Broken), importer: Some(Arc::new(Probe)), ..Default::default() };
+    let item = s.execute("file.import", json!({"paths": ["/renders/crypto.exr"]})).unwrap()["items"][0].clone();
+    s.execute("comp.new", json!({"name": "C", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let q = json!({"effect": 1, "x": 0.5, "y": 1.5, "probeOnly": true});
+    let job = s.crypto_probe_job(&q).unwrap().unwrap();
+    assert!(std::thread::spawn(job).join().is_ok(), "the job caught the panic");
+    assert!(s.crypto_probe_job(&q).unwrap().is_none(), "the error is kept");
+    let e = s.execute("effect.cryptomatteAt", q).unwrap_err().to_string();
+    assert!(e.contains("Reading the Cryptomatte IDs failed") && e.contains("a broken EXR reader"), "{e}");
+}
+
+/// Asking whether the probe is built changes nothing: asked for other frames while a build runs
+/// (the eyedropper's hover while a click waits), it doesn't cancel that build.
+#[test]
+fn asking_whether_a_probe_is_ready_cancels_no_build() {
+    let s = session();
+    let at = |t: f64| json!({"effect": 1, "x": 0.5, "y": 1.5, "time": t, "probeOnly": true});
+    let job = s.crypto_probe_job(&at(0.0)).unwrap().unwrap();
+    for t in [1.0, 0.5, 1.0, 0.25] {
+        assert!(!s.crypto_probe_ready(&at(t)).unwrap());
+    }
+    job();
+    assert!(s.crypto_probe_ready(&at(0.0)).unwrap(), "the build was cancelled");
+    assert!(s.crypto_probe_job(&at(0.0)).unwrap().is_none());
+}
+
+/// The probe renders with the render prefs (nested switches, draft shadows): changing them asks
+/// for a new one.
+#[test]
+fn a_render_prefs_change_asks_for_a_new_probe() {
+    let mut s = session();
+    let q = json!({"effect": 1, "x": 0.5, "y": 1.5});
+    s.crypto_probe_job(&q).unwrap().unwrap()();
+    assert!(s.crypto_probe_ready(&q).unwrap());
+    s.prefs.three_d.realtime_shadows = !s.prefs.three_d.realtime_shadows;
+    assert!(!s.crypto_probe_ready(&q).unwrap(), "draft shadows changed");
+    s.crypto_probe_job(&q).unwrap().unwrap()();
+    s.prefs.general.switches_affect_nested_comps = !s.prefs.general.switches_affect_nested_comps;
+    assert!(!s.crypto_probe_ready(&q).unwrap(), "nested switches changed");
+}
+
+/// A pick is an undo step named for it, and undoing, redoing or jumping over picks keeps the
+/// probe (only the Selection changed); undoing any other edit doesn't.
+#[test]
+fn undoing_picks_keeps_the_probe_and_the_step_says_pick() {
+    let mut s = session();
+    let q = json!({"effect": 1, "x": 0.5, "y": 1.5, "probeOnly": true});
+    s.crypto_probe_job(&q).unwrap().unwrap()();
+    let before = crate::history::state_id(&s.project);
+    pick(&mut s, 0.5, "replace");
+    assert_eq!(s.history.undo.last().unwrap().0, "Pick Cryptomatte");
+    pick(&mut s, 4.5, "add");
+    for (what, cmd) in [("undo", "edit.undo"), ("undo", "edit.undo"), ("redo", "edit.redo")] {
+        s.execute_checked(cmd, json!({})).unwrap();
+        assert!(s.crypto_probe_ready(&q).unwrap(), "{what} {}: probe dropped", selection(&s));
+    }
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["selected"], true);
+    assert!(s.goto_history(&before) && selection(&s).is_empty());
+    assert!(s.crypto_probe_ready(&q).unwrap(), "history jump: probe dropped");
+    s.execute_checked("prop.set", json!({"path": "transform/opacity", "value": 50})).unwrap();
+    s.crypto_probe_job(&q).unwrap().unwrap()();
+    s.execute_checked("edit.undo", json!({})).unwrap();
+    assert!(!s.crypto_probe_ready(&q).unwrap(), "an undone opacity change needs a new probe");
+}
+
+/// The hover highlight: an ID's coverage from the kept probe, one sample at the centre of each
+/// cell of aux pixels, over the layer's extent (the last cells cut by it).
+#[test]
+fn coverage_of_an_id_from_the_kept_probe() {
+    let s = session();
+    let q = json!({"effect": 1, "x": 0.5, "y": 1.5});
+    let left = crypto_hash("left");
+    assert!(s.crypto_coverage(&q, left, 64).is_none(), "no coverage before the probe");
+    s.crypto_probe_job(&q).unwrap().unwrap()();
+    let c = s.crypto_coverage(&q, left, 64).unwrap();
+    assert_eq!((c.width, c.height, c.size, c.uv), (16, 8, [8.0, 4.0], [1.0, 1.0]), "the aux pixels over the layer");
+    assert!(c.coverage.iter().all(|v| (0.0..=1.0).contains(v)) && c.coverage.iter().any(|v| *v > 0.5) && c.coverage.contains(&0.0), "{:?}", c.coverage);
+    assert_eq!(c.coverage[0], 0.6, "left's coverage at the first aux pixel");
+    assert!(s.crypto_coverage(&q, crypto_hash("nobody"), 64).unwrap().coverage.iter().all(|v| *v == 0.0));
+    assert_eq!(s.crypto_coverage(&q, left, 2).map(|c| (c.width, c.height)), Some((2, 1)));
+    // An odd size: 2 × 2 cells, the last ones half outside the layer; samples at cell centres.
+    let mut s = cells_session(1919, 1079, false);
+    let q = json!({"effect": "Cryptomatte", "x": 40.0, "y": 10.0});
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["name"], "c1_0");
+    let c = s.crypto_coverage(&q, crypto_hash("c1_0"), 1024).unwrap();
+    assert_eq!((c.width, c.height, c.size), (960, 540, [1919.0, 1079.0]));
+    assert_eq!(c.uv, [1919.0 / 1920.0, 1079.0 / 1080.0]);
+    // Sample 18 covers pixels 36-37: its centre (37) is in c1_0, its corner (36) in c0_0.
+    assert_eq!((c.coverage[17], c.coverage[18], c.coverage[37]), (0.0, 1.0, 0.0));
+}
+
+struct Ranked(u32, u32, std::sync::OnceLock<Arc<AuxChannels>>);
+impl FootageSource for Ranked {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<AuxChannels>> {
+        Some(
+            self.2
+                .get_or_init(|| {
+                    let (w, h) = (self.0 as usize, self.1 as usize);
+                    let mut aux = AuxChannels::new(w as u32, h as u32, 1.0);
+                    for part in 0..3 {
+                        for (k, c) in ["R", "G", "B", "A"].iter().enumerate() {
+                            let rank = part * 2 + k / 2;
+                            let v: Vec<f32> = (0..w * h)
+                                .map(|i| if k % 2 == 0 { crypto_float(crypto_hash(&format!("r{rank}_{}", Cells::name(i % w, i / w)))) } else { 1.0 / 6.0 })
+                                .collect();
+                            aux.channels.push((format!("CryptoObject{part:02}.{c}"), v));
+                        }
+                    }
+                    Arc::new(aux)
+                })
+                .clone(),
+        )
+    }
+}
+
+fn rss_mb() -> f64 {
+    let s = std::fs::read_to_string("/proc/self/status").unwrap_or_default();
+    s.lines().find(|l| l.starts_with("VmRSS")).and_then(|l| l.split_whitespace().nth(1)).and_then(|v| v.parse::<f64>().ok()).unwrap_or(0.0) / 1024.0
+}
+
+/// Highlight cost with 6 ranks (Cryptomatte's default 3 parts) at 1080p, 4K and 8K, and the memory the
+/// probe pins. Run with `--ignored --nocapture`; it measures, it doesn't assert.
+#[test]
+#[ignore]
+fn highlight_cost_with_six_ranks() {
+    for (w, h) in [(1920u32, 1080u32), (3840, 2160), (7680, 4320)] {
+        let r0 = rss_mb();
+        let mut s = Session { footage: Arc::new(Ranked(w, h, Default::default())), importer: Some(Arc::new(CellsProbe(w, h))), ..Default::default() };
+        let item = s.execute("file.import", json!({"paths": ["/renders/ranked.exr"]})).unwrap()["items"][0].clone();
+        s.execute("comp.new", json!({"name": "C", "width": w, "height": h, "frameRate": 24, "duration": 2})).unwrap();
+        s.execute("layer.addItem", json!({"item": item})).unwrap();
+        s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+        let q = json!({"effect": "Cryptomatte", "x": 100.0, "y": 500.0});
+        let t0 = std::time::Instant::now();
+        let r = s.execute("effect.cryptomatteAt", q.clone()).unwrap();
+        let build = t0.elapsed().as_secs_f64() * 1e3;
+        let hash = u32::from_str_radix(r["hash"].as_str().unwrap(), 16).unwrap();
+        let mut ms = vec![];
+        for _ in 0..5 {
+            let t0 = std::time::Instant::now();
+            let c = s.crypto_coverage(&q, hash, 1024).unwrap();
+            ms.push(t0.elapsed().as_secs_f64() * 1e3);
+            assert!(c.coverage.iter().any(|v| *v > 0.0));
+        }
+        ms.sort_by(f64::total_cmp);
+        let aux = s.footage.aux(ItemId(0), &Footage::default(), Tick::ZERO).unwrap();
+        let bytes: usize = aux.channels.iter().map(|(_, v)| v.len() * 4).sum();
+        eprintln!(
+            "HIGHLIGHT 6 ranks {w}x{h}: aux {:.0} MB ({} planes), probe build {build:.1} ms, highlight median {:.2} ms (min {:.2}), RSS +{:.0} MB",
+            bytes as f64 / 1e6,
+            aux.channels.len(),
+            ms[2],
+            ms[0],
+            rss_mb() - r0
+        );
+    }
+}
+
+/// 8 × 4 footage whose Cryptomatte layers are `Mine` (`left` / `right` halves) and `CryptoMaterial`
+/// (the other way round).
+struct Layers;
+impl FootageSource for Layers {
+    fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+        Some(Arc::new(Image::new(f.width, f.height)))
+    }
+    fn aux(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<AuxChannels>> {
+        let mut aux = AuxChannels::new(8, 4, 1.0);
+        for (name, flip) in [("Mine", false), ("CryptoMaterial", true)] {
+            let ids = (0..32).map(|i| crypto_float(crypto_hash(if (i % 8 < 4) != flip { "left" } else { "right" }))).collect();
+            aux.channels.push((format!("{name}00.R"), ids));
+            aux.channels.push((format!("{name}00.G"), vec![1.0; 32]));
+        }
+        Some(Arc::new(aux))
+    }
+}
+
+/// #473: the probe reads the layer the Layer value names, as the effect does: 0 (a saved
+/// CryptoObject) on a file without it reads the file's first layer, 1 is CryptoMaterial, and 3
+/// is the file's other layer.
+#[test]
+fn pick_reads_the_layer_the_layer_value_names() {
+    let mut s = Session { footage: Arc::new(Layers), importer: Some(Arc::new(Probe)), ..Default::default() };
+    let item = s.execute("file.import", json!({"paths": ["/renders/layers.exr"]})).unwrap()["items"][0].clone();
+    s.execute("comp.new", json!({"name": "C", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let name_at = |s: &mut Session, layer: u32| {
+        s.execute_checked("prop.set", json!({"path": "effects/#1/layer", "value": layer})).unwrap();
+        let r = s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": 0.5, "y": 1.5})).unwrap();
+        (r["name"].clone(), r["layer"].clone())
+    };
+    // The files' layers sort as CryptoMaterial, Mine (no manifest here, so the IDs have no name).
+    assert_eq!(name_at(&mut s, 0).1, "CryptoMaterial", "a saved CryptoObject: the first layer");
+    assert_eq!(name_at(&mut s, 1).1, "CryptoMaterial");
+    assert_eq!(name_at(&mut s, 3).1, "Mine");
+}
diff --git a/crates/engine/src/tests/delete_keys.rs b/crates/engine/src/tests/delete_keys.rs
new file mode 100644
index 000000000..ec6ec888e
--- /dev/null
+++ b/crates/engine/src/tests/delete_keys.rs
@@ -0,0 +1,249 @@
+//! `keys.delete` reports the keys it removed, not the keys it was asked to remove.
+
+use effectcraft_project::LayerId;
+use serde_json::json;
+
+use crate::{KeyRef, Session};
+
+fn setup() -> (Session, u64, u64) {
+    let mut s = Session::default();
+    s.execute_checked("comp.new", json!({"width": 64, "height": 64, "frameRate": 30, "duration": 4})).unwrap();
+    let layer = s.execute_checked("layer.newSolid", json!({"name": "Box", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+    for t in 0..3 {
+        s.execute_checked("prop.addKey", json!({"layer": layer, "path": "transform/opacity", "time": t, "value": t * 25})).unwrap();
+    }
+    let prop = s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    (s, layer, prop)
+}
+
+fn keys_of(s: &Session, layer: u64, prop: u64) -> Vec<KeyRef> {
+    let keys = &s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find(prop).unwrap().keys;
+    keys.iter().map(|k| KeyRef { layer: LayerId(layer), prop, time: k.time }).collect()
+}
+
+#[test]
+fn delete_keys_counts_only_the_keys_it_removed() {
+    let (mut s, layer, prop) = setup();
+    let keys = keys_of(&s, layer, prop);
+    assert_eq!(keys.len(), 3);
+    // Two real keys, one of them listed twice, and a key of a property that does not exist.
+    let missing = KeyRef { layer: LayerId(layer), prop: u64::MAX, time: keys[1].time };
+    s.state.selected_keys = vec![keys[0], keys[2], keys[0], missing];
+    let removed = s.execute_checked("keys.delete", json!({})).unwrap();
+    assert_eq!(removed, json!(2));
+    assert_eq!(keys_of(&s, layer, prop), vec![keys[1]]);
+}
+
+#[test]
+fn delete_keys_reports_zero_when_no_selected_key_exists() {
+    let (mut s, layer, prop) = setup();
+    let keys = keys_of(&s, layer, prop);
+    s.state.selected_keys = vec![KeyRef { layer: LayerId(layer), prop: u64::MAX, time: keys[0].time }];
+    let removed = s.execute_checked("keys.delete", json!({})).unwrap();
+    assert_eq!(removed, json!(0));
+    assert_eq!(keys_of(&s, layer, prop), keys);
+}
+
+/// A layer locked after its keys were selected keeps them: Delete and Edit Value leave them alone.
+#[test]
+fn a_locked_layers_keys_cannot_be_deleted_or_edited() {
+    let (mut s, layer, prop) = setup();
+    let keys = keys_of(&s, layer, prop);
+    s.state.selected_keys = keys.clone();
+    s.execute_checked("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": true})).unwrap();
+    let removed = s.execute_checked("keys.delete", json!({})).unwrap();
+    assert_eq!(removed, json!(0));
+    assert_eq!(keys_of(&s, layer, prop), keys);
+    assert_eq!(s.state.selected_keys, keys, "the selection stays");
+    let e = s.execute("keys.set", json!({"layer": layer, "prop": prop, "time": 0, "value": 90})).unwrap_err().to_string();
+    assert!(e.contains("locked"), "{e}");
+    let value = s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find(prop).unwrap().keys[0].value.as_f64();
+    assert_eq!(value, 0.0);
+    // Unlocked again, both work.
+    s.execute_checked("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": false})).unwrap();
+    s.execute_checked("keys.set", json!({"layer": layer, "prop": prop, "time": 0, "value": 90})).unwrap();
+    assert_eq!(s.execute_checked("keys.delete", json!({})).unwrap(), json!(3));
+}
+
+/// Easy Ease, Toggle Hold and Time-Reverse leave a locked layer's keys as they are and keep them
+/// selected; unlocked, they change them.
+#[test]
+fn selection_based_key_edits_skip_a_locked_layer() {
+    let (mut s, layer, prop) = setup();
+    let keys = keys_of(&s, layer, prop);
+    let stored = |s: &Session| s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find(prop).unwrap().keys.clone();
+    let before = stored(&s);
+    s.state.selected_keys = keys.clone();
+    s.execute_checked("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": true})).unwrap();
+    for command in ["keys.easyEase", "keys.toggleHold", "keys.timeReverse"] {
+        s.execute_checked(command, json!({})).unwrap();
+        assert_eq!(stored(&s), before, "{command} changed a locked layer's keys");
+        assert_eq!(s.state.selected_keys, keys, "{command} dropped the selection of a locked layer's keys");
+    }
+    s.execute_checked("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": false})).unwrap();
+    s.execute_checked("keys.easyEase", json!({})).unwrap();
+    assert_ne!(stored(&s), before, "unlocked, Easy Ease changes the keys");
+}
+
+#[test]
+fn spatial_handles_cannot_edit_a_locked_layer() {
+    let (mut s, layer, _) = setup();
+    for (time, value) in [(0, [10, 20, 0]), (1, [80, 60, 0])] {
+        s.execute("prop.addKey", json!({"layer": layer, "path": "transform/position", "time": time, "value": value})).unwrap();
+    }
+    let prop = s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("transform/position").unwrap().uid;
+    s.execute("keys.select", json!({"keys": [{"layer": layer, "prop": prop, "time": 0}]})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": true})).unwrap();
+    let before = s.project.to_json();
+    let selected = s.state.selected_keys.clone();
+    let undo_len = s.history.undo.len();
+    let params = json!({"layer": layer, "prop": prop, "time": 0, "out": [15, 25, 0]});
+    let error = s.execute("keys.setSpatialTangents", params.clone()).unwrap_err().to_string();
+    assert!(error.contains("locked"), "{error}");
+    assert_eq!(s.project.to_json(), before);
+    assert_eq!(s.state.selected_keys, selected);
+    assert_eq!(s.history.undo.len(), undo_len);
+    s.execute("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": false})).unwrap();
+    let unlocked = s.project.to_json();
+    s.execute("keys.setSpatialTangents", params).unwrap();
+    let edited = s.project.to_json();
+    assert_ne!(edited, unlocked);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.project.to_json(), unlocked);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(s.project.to_json(), edited);
+}
+
+#[test]
+fn pasting_keys_or_motion_paths_cannot_edit_locked_targets() {
+    for path_clip in [false, true] {
+        for explicit in [false, true] {
+            let (mut s, layer, opacity) = setup();
+            let target_path = if path_clip { "transform/position" } else { "transform/opacity" };
+            let source = if path_clip {
+                s.execute("mask.new", json!({"layer": layer, "vertices": [[0, 0], [20, 10], [40, 0]], "closed": false})).unwrap();
+                s.execute("prop.toggleAnimation", json!({"layer": layer, "path": "masks/#1/path"})).unwrap();
+                s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("masks/#1/path").unwrap().uid
+            } else {
+                opacity
+            };
+            s.execute("keys.select", json!({"keys": [{"layer": layer, "prop": source, "time": 0}]})).unwrap();
+            s.execute("keys.copy", json!({})).unwrap();
+            s.execute("prop.select", json!({"layer": layer, "path": target_path})).unwrap();
+            s.execute("time.set", json!({"time": 3})).unwrap();
+            s.execute("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": true})).unwrap();
+            let params = if explicit { json!({"layer": layer, "path": target_path}) } else { json!({}) };
+            let before = s.project.to_json();
+            let selected = s.state.selected_keys.clone();
+            let undo_len = s.history.undo.len();
+            let result = s.execute("keys.paste", params.clone());
+            assert!(result.is_err(), "path={path_clip}, explicit={explicit}: {result:?}");
+            assert_eq!(s.project.to_json(), before);
+            assert_eq!(s.state.selected_keys, selected);
+            assert_eq!(s.history.undo.len(), undo_len);
+            s.execute("layer.setSwitch", json!({"layers": [layer], "switch": "locked", "value": false})).unwrap();
+            let unlocked = s.project.to_json();
+            s.execute("keys.paste", params).unwrap();
+            let pasted = s.project.to_json();
+            assert_ne!(pasted, unlocked);
+            s.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(s.project.to_json(), unlocked);
+            s.execute("edit.redo", json!({})).unwrap();
+            assert_eq!(s.project.to_json(), pasted);
+        }
+    }
+}
+
+#[test]
+fn key_paste_skips_locked_targets_without_changing_layer_pairing() {
+    let (mut s, locked, locked_prop) = setup();
+    let other = s.execute("layer.newSolid", json!({"name": "Other", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+    for (time, value) in [(0, 100), (1, 80), (2, 60)] {
+        s.execute("prop.addKey", json!({"layer": other, "path": "transform/opacity", "time": time, "value": value})).unwrap();
+    }
+    let other_prop = s.active_comp().unwrap().layer(LayerId(other)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    let locked_keys = keys_of(&s, locked, locked_prop);
+    s.state.selected_keys = locked_keys.iter().chain(keys_of(&s, other, other_prop).iter()).copied().collect();
+    s.execute("keys.copy", json!({})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [locked], "switch": "locked", "value": true})).unwrap();
+    s.execute("time.set", json!({"time": 3})).unwrap();
+    let before = s.project.to_json();
+    assert_eq!(s.execute("keys.paste", json!({"layers": [locked, other]})).unwrap(), json!(3), "only newly pasted keys are counted");
+    assert_eq!(keys_of(&s, locked, locked_prop), locked_keys);
+    assert!(locked_keys.iter().all(|k| s.state.selected_keys.contains(k)));
+    assert_eq!(s.state.selected_keys.len(), 6);
+    let keys = &s.active_comp().unwrap().layer(LayerId(other)).unwrap().props.find(other_prop).unwrap().keys;
+    assert_eq!(keys.iter().filter(|k| k.time.seconds() >= 3.0).map(|k| k.value.as_f64()).collect::<Vec<_>>(), [100.0, 80.0, 60.0]);
+    let pasted = s.project.to_json();
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.project.to_json(), before);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(s.project.to_json(), pasted);
+}
+
+#[test]
+fn motion_path_paste_preserves_locked_source_selection() {
+    for explicit in [false, true] {
+        let (mut s, source, _) = setup();
+        s.execute("mask.new", json!({"layer": source, "vertices": [[0, 0], [20, 10], [40, 0]], "closed": false})).unwrap();
+        s.execute("prop.toggleAnimation", json!({"layer": source, "path": "masks/#1/path"})).unwrap();
+        let uid = s.active_comp().unwrap().layer(LayerId(source)).unwrap().props.prop("masks/#1/path").unwrap().uid;
+        s.execute("keys.select", json!({"keys": [{"layer": source, "prop": uid, "time": 0}]})).unwrap();
+        s.execute("keys.copy", json!({})).unwrap();
+        let locked_keys = s.state.selected_keys.clone();
+        let target = s.execute("layer.newSolid", json!({"name": "Target", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("prop.select", json!({"layer": target, "path": "transform/position"})).unwrap();
+        s.execute("layer.setSwitch", json!({"layers": [source], "switch": "locked", "value": true})).unwrap();
+        s.state.selected_keys = locked_keys.clone();
+        let params = if explicit { json!({"layer": target, "path": "transform/position"}) } else { json!({}) };
+        let before = s.project.to_json();
+        assert_eq!(s.execute("keys.paste", params).unwrap(), json!(3));
+        assert!(locked_keys.iter().all(|k| s.state.selected_keys.contains(k)));
+        assert_eq!(s.state.selected_keys.len(), 4);
+        assert_eq!(s.state.selected_keys.iter().filter(|k| k.layer == LayerId(target)).count(), 3);
+        let pasted = s.project.to_json();
+        s.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(s.project.to_json(), before);
+        s.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(s.project.to_json(), pasted);
+    }
+}
+
+#[test]
+fn key_transform_preserves_locked_keys_in_a_mixed_selection() {
+    let (mut s, locked, locked_prop) = setup();
+    let unlocked = s.execute("layer.newSolid", json!({"name": "Unlocked", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+    for t in 0..3 {
+        s.execute("prop.addKey", json!({"layer": unlocked, "path": "transform/opacity", "time": t, "value": t * 25})).unwrap();
+    }
+    let unlocked_prop = s.active_comp().unwrap().layer(LayerId(unlocked)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    let locked_keys = keys_of(&s, locked, locked_prop);
+    s.state.selected_keys = locked_keys.iter().chain(keys_of(&s, unlocked, unlocked_prop).iter()).copied().collect();
+    s.execute("layer.setSwitch", json!({"layers": [locked], "switch": "locked", "value": true})).unwrap();
+    let stored = |s: &Session, layer, prop| s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find(prop).unwrap().keys.clone();
+    let before = stored(&s, locked, locked_prop);
+    let undo = s.history.undo.len();
+    for offset in [0.5, 1.0] {
+        s.execute("keys.transform", json!({"timeOffset": offset, "valueOffset": offset * 10.0, "merge": "mixed-transform", "fromStart": true})).unwrap();
+        assert_eq!(stored(&s, locked, locked_prop), before);
+        assert_eq!(s.state.selected_keys.len(), 6);
+        assert!(locked_keys.iter().all(|k| s.state.selected_keys.contains(k)), "locked selections stay at their original times");
+        assert!(keys_of(&s, unlocked, unlocked_prop).iter().all(|k| s.state.selected_keys.contains(k)), "unlocked selections follow the keys");
+        let moved = stored(&s, unlocked, unlocked_prop);
+        for (i, key) in moved.iter().enumerate() {
+            assert_eq!(key.time.seconds(), i as f64 + offset);
+            assert_eq!(key.value.as_f64(), i as f64 * 25.0 + offset * 10.0);
+        }
+    }
+    assert_eq!(s.history.undo.len(), undo + 1, "one merged drag");
+    let after = stored(&s, unlocked, unlocked_prop);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(stored(&s, locked, locked_prop), before);
+    assert_eq!(stored(&s, unlocked, unlocked_prop), before);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(stored(&s, locked, locked_prop), before);
+    assert_eq!(stored(&s, unlocked, unlocked_prop), after);
+    s.execute("layer.setSwitch", json!({"layers": [locked], "switch": "locked", "value": false})).unwrap();
+    s.execute("keys.transform", json!({"timeOffset": 0.5, "valueOffset": 10})).unwrap();
+    assert_ne!(stored(&s, locked, locked_prop), before, "unlocking makes the keys editable again");
+}
diff --git a/crates/engine/src/tests/disk_cache.rs b/crates/engine/src/tests/disk_cache.rs
new file mode 100644
index 000000000..4c610dceb
--- /dev/null
+++ b/crates/engine/src/tests/disk_cache.rs
@@ -0,0 +1,469 @@
+//! The persistent disk cache (PRV-2) through the session: settings, layer cache persistence
+//! across restarts, invalidation on edits, purging.
+
+use serde_json::json;
+
+use crate::Session;
+use crate::render::RenderOpts;
+
+fn folder(name: &str) -> String {
+    let d = std::env::temp_dir().join(format!("effectcraft-session-disk-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    d.to_string_lossy().to_string()
+}
+
+fn session(dir: &str) -> Session {
+    let mut s = Session::default();
+    s.execute_checked("prefs.set", json!({"values": {"disk.diskCacheFolder": dir, "disk.diskCacheEnabled": true}})).unwrap();
+    // Write every layer buffer, however quick to render.
+    s.disk_cache.as_ref().unwrap().set_min_layer_ms(0);
+    s
+}
+
+fn project(s: &mut Session) -> effectcraft_project::ItemId {
+    s.execute("comp.new", json!({"name": "D", "width": 160, "height": 90, "frameRate": 30, "duration": 1})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#3080ff", "width": 80, "height": 40})).unwrap();
+    s.execute("effect.apply", json!({"layer": "#1", "effect": "Gaussian Blur"})).unwrap();
+    s.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/blurriness", "value": 12})).unwrap();
+    s.active_comp_id().unwrap()
+}
+
+#[test]
+fn disk_cache_settings_persistence_and_invalidation() {
+    crate::tests::roto::hold_roto_cache_test_lock();
+    let dir = folder("persist");
+    let mut s = session(&dir);
+    let st = s.execute_checked("cache.diskStats", json!({})).unwrap();
+    assert_eq!(st["enabled"], json!(true));
+    assert_eq!(st["maxBytes"], json!(20u64 << 30));
+    let cid = project(&mut s);
+    let t = s.time();
+    let first = s.render(cid, t, RenderOpts::default());
+    let dc = s.disk_cache.clone().unwrap();
+    dc.flush();
+    let written = dc.stats().entries;
+    assert!(written > 0, "layer buffers written");
+    // "Restart": a new session on the same folder and project renders from disk.
+    let saved = s.project.clone();
+    drop(s);
+    let mut s2 = session(&dir);
+    s2.project = saved;
+    s2.bump();
+    s2.open_comp(cid);
+    let dc2 = s2.disk_cache.clone().unwrap();
+    assert_eq!(dc2.stats().entries, written);
+    let again = s2.render(cid, t, RenderOpts::default());
+    assert!(dc2.stats().hits > 0, "{:?}", dc2.stats());
+    assert_eq!(again.data, first.data, "disk-cached pixels are exact");
+    // An edit changes the keys: a miss, and new entries.
+    let hits = dc2.stats().hits;
+    s2.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/blurriness", "value": 20})).unwrap();
+    let edited = s2.render(cid, t, RenderOpts::default());
+    assert_ne!(edited.data, first.data);
+    assert_eq!(dc2.stats().hits, hits);
+    dc2.flush();
+    assert!(dc2.stats().entries > written);
+    // Purge ▸ All Disk Cache empties it; memory purge leaves the disk alone.
+    let r = s2.execute_checked("edit.purge", json!({"what": "memory"})).unwrap();
+    assert_eq!(r["diskEntries"], json!(0));
+    assert!(dc2.stats().entries > 0);
+    let r = s2.execute_checked("edit.purge", json!({"what": "disk"})).unwrap();
+    assert!(r["diskEntries"].as_u64().unwrap() > 0);
+    assert_eq!(dc2.stats().entries, 0);
+    // Disabling detaches it.
+    s2.execute_checked("prefs.set", json!({"key": "disk.diskCacheEnabled", "value": false})).unwrap();
+    assert!(s2.disk_cache.is_none());
+    assert!(s2.layer_cache.disk().is_none());
+}
+
+/// The comp key comes from the project in memory: a footage file that changes on disk doesn't
+/// change it (the entries check their own files, #3184); edits that change pixels do.
+#[test]
+fn comp_content_keys_come_from_memory() {
+    let dir = folder("keys");
+    let mut s = session(&dir);
+    let foot = std::env::temp_dir().join(format!("effectcraft-keys-{}.png", std::process::id()));
+    std::fs::write(&foot, b"one").unwrap();
+    s.edit("add", None, |p, _| {
+        let f = effectcraft_project::Footage {
+            path: foot.to_string_lossy().to_string(),
+            kind: effectcraft_project::FootageKind::Still,
+            width: 1,
+            height: 1,
+            pixel_aspect: 1.0,
+            frame_rate: effectcraft_time::FrameRate::FPS_30,
+            native_rate: None,
+            duration: effectcraft_time::Tick::ZERO,
+            has_video: true,
+            has_audio: false,
+            alpha: effectcraft_project::AlphaMode::Ignore,
+            premul_color: [0.0; 3],
+            loop_count: 1,
+            codec: "PNG".into(),
+            missing: false,
+            sequence: vec![],
+            color_profile: None,
+            layer: None,
+            ..Default::default()
+        };
+        p.add_item("f.png", effectcraft_color::Label::Lavender, None, effectcraft_project::ItemKind::Footage(f));
+        Ok(())
+    })
+    .unwrap();
+    let cid = project(&mut s);
+    let k1 = effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
+    std::fs::write(&foot, b"two, longer").unwrap();
+    assert_eq!(effectcraft_render::disk_cache::comp_content_key(&s.project, cid), k1, "no file is looked at");
+    s.execute("prop.set", json!({"layer": "#1", "path": "transform/opacity", "value": 50})).unwrap();
+    let k2 = effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
+    assert_ne!(k1, k2);
+    // Switches that don't change pixels (Audio, Lock, Shy, Hide Shy Layers) don't change it (#103).
+    for sw in ["audio", "lock", "shy"] {
+        s.execute("layer.setSwitch", json!({"layers": ["#1"], "switch": sw, "value": sw != "audio"})).unwrap();
+    }
+    s.execute("comp.setSwitch", json!({"switch": "hideShy", "value": true})).unwrap();
+    assert_eq!(effectcraft_render::disk_cache::comp_content_key(&s.project, cid), k2);
+    // Unrelated comps do not change it.
+    s.execute("comp.new", json!({"name": "Other", "width": 10, "height": 10, "frameRate": 30, "duration": 1})).unwrap();
+    assert_eq!(effectcraft_render::disk_cache::comp_content_key(&s.project, cid), k2);
+    // A proxy, and its Use Proxy switch, change the pixels.
+    let set_proxy = |s: &mut Session, enabled: bool| {
+        let it = std::sync::Arc::make_mut(&mut s.project).items.get_mut(&cid).unwrap();
+        it.proxy = Some(Box::new(effectcraft_project::Proxy { footage: effectcraft_project::Footage::default(), enabled }));
+        effectcraft_render::disk_cache::comp_content_key(&s.project, cid)
+    };
+    let k3 = set_proxy(&mut s, true);
+    assert_ne!(k3, k2);
+    assert_ne!(set_proxy(&mut s, false), k3);
+}
+
+/// No salt and no scan (#3184, replacing the background footage salt of #3106): the disk cache
+/// is attached to the layer cache as soon as it is switched on, and stays attached through
+/// edits that add footage (a large image sequence included), settings changes and opening a
+/// project, none of which looks at a single file for it. The first render may use it at once.
+#[test]
+fn the_disk_cache_is_attached_at_once_and_edits_do_no_file_work() {
+    let dir = folder("attach");
+    let mut s = session(&dir);
+    let dc = s.disk_cache.clone().unwrap();
+    let attached = |s: &Session| s.layer_cache.disk().is_some_and(|d| std::sync::Arc::ptr_eq(&d, &dc));
+    assert!(attached(&s), "attached at once");
+    // A sequence of 5000 frames that don't even exist.
+    let seq_dir = std::env::temp_dir().join(format!("effectcraft-no-scan-{}", std::process::id()));
+    let f = effectcraft_project::Footage {
+        path: seq_dir.join("f_00000.exr").to_string_lossy().to_string(),
+        kind: effectcraft_project::FootageKind::Sequence,
+        sequence: (0..5000).map(|i| seq_dir.join(format!("f_{i:05}.exr")).to_string_lossy().to_string()).collect(),
+        width: 8,
+        height: 8,
+        has_video: true,
+        ..Default::default()
+    };
+    s.edit("add", None, |p, _| {
+        p.add_item("seq", effectcraft_color::Label::None, None, effectcraft_project::ItemKind::Footage(f));
+        Ok(())
+    })
+    .unwrap();
+    assert!(attached(&s), "an import keeps it attached");
+    let cid = project(&mut s);
+    s.execute("prop.set", json!({"layer": "#1", "path": "transform/opacity", "value": 50})).unwrap();
+    s.execute_checked("prefs.set", json!({"key": "disk.diskCacheMaxGb", "value": 30})).unwrap();
+    assert!(attached(&s), "edits and other settings keep it attached");
+    let same = (*s.project).clone();
+    s.replace_project(same, None);
+    assert!(attached(&s), "opening a project keeps it attached");
+    // The first render uses it: a solid reads no file, so nothing is checked either.
+    s.render(cid, s.time(), RenderOpts::default());
+    dc.flush();
+    assert!(dc.stats().entries > 0, "written by the first render");
+    assert_eq!(dc.file_checks(), 0, "no file looked at for the disk cache");
+    // Switched off and on: attached again at once.
+    s.execute_checked("prefs.set", json!({"key": "disk.diskCacheEnabled", "value": false})).unwrap();
+    assert!(s.layer_cache.disk().is_none());
+    s.execute_checked("prefs.set", json!({"key": "disk.diskCacheEnabled", "value": true})).unwrap();
+    assert!(s.layer_cache.disk().is_some());
+}
+
+/// Marker edits keep the disk key (the sound of a playing preview must not wait for frames to
+/// render again, #1083); an expression that reads markers makes them count.
+#[test]
+fn markers_keep_the_content_key_unless_an_expression_reads_them() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "M", "width": 8, "height": 8, "frameRate": 30, "duration": 2})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let key = |s: &Session| effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
+    let k0 = key(&s);
+    s.execute("comp.addMarker", json!({"time": 0.5, "comment": "beat"})).unwrap();
+    s.execute("markers.set", json!({"layer": l, "new": true, "time": 0.25})).unwrap();
+    assert_eq!(key(&s), k0, "markers");
+    s.execute("prop.setExpression", json!({"layer": l, "path": "transform/opacity", "expression": "thisComp.marker.numKeys"})).unwrap();
+    let k1 = key(&s);
+    assert_ne!(k1, k0);
+    s.execute("comp.addMarker", json!({"time": 1.0})).unwrap();
+    assert_ne!(key(&s), k1, "a marker read by an expression");
+}
+
+/// A comp marker alone (no layer marker beside it) keeps the key too.
+#[test]
+fn a_lone_comp_marker_keeps_the_content_key() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "M", "width": 8, "height": 8, "frameRate": 30, "duration": 2})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    let key = |s: &Session| effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
+    let k0 = key(&s);
+    s.execute("comp.addMarker", json!({"time": 0.5, "comment": "beat"})).unwrap();
+    assert_eq!(key(&s), k0);
+}
+
+/// A protected marker with a duration retimes a stretched precomp layer (Responsive Design), so
+/// changing it changes the key of the comp that nests it; a plain marker beside it does not.
+#[test]
+fn protected_markers_with_a_duration_change_the_content_key() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Inner", "width": 8, "height": 8, "frameRate": 30, "duration": 4})).unwrap();
+    let inner = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "frameRate": 30, "duration": 10})).unwrap();
+    let outer = s.active_comp_id().unwrap();
+    let l = s.execute("layer.addItem", json!({"item": inner.0})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.select", json!({"layers": [l]})).unwrap();
+    s.execute("layer.timeStretch", json!({"percent": 200})).unwrap();
+    let key = |s: &Session| effectcraft_render::disk_cache::comp_content_key(&s.project, outer);
+    let k0 = key(&s);
+    s.execute("comp.addMarker", json!({"comp": inner.0, "time": 2.0, "comment": "beat"})).unwrap();
+    assert_eq!(key(&s), k0, "a plain marker");
+    s.execute("comp.addMarker", json!({"comp": inner.0, "time": 1.0})).unwrap();
+    let index = s.project.comp(inner).unwrap().markers.iter().position(|m| m.time.seconds() == 1.0).unwrap();
+    s.execute("markers.set", json!({"comp": inner.0, "index": index, "duration": 1.0, "protected": true})).unwrap();
+    let k1 = key(&s);
+    assert_ne!(k1, k0, "a protected marker with a duration");
+    s.execute("markers.set", json!({"comp": inner.0, "index": index, "duration": 2.0})).unwrap();
+    assert_ne!(key(&s), k1, "its duration");
+}
+
+/// With expressions the comp key covers what they can read, not the whole project (#3184,
+/// #1492): an expression reading only its own comp keeps the key through edits of another comp
+/// and of unused footage; `comp("Other")` makes "Other" count (and which comps have that name),
+/// not a third comp; a computed name counts every item.
+#[test]
+fn expressions_reach_only_what_they_name() {
+    let mut s = Session::default();
+    let comp = |s: &mut Session, name: &str| {
+        let c = s.execute("comp.new", json!({"name": name, "width": 8, "height": 8, "frameRate": 30, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+        let l = s.execute("layer.newSolid", json!({"comp": c, "color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+        (effectcraft_project::ItemId(c), (c, l))
+    };
+    let (main, ml) = comp(&mut s, "Main");
+    let (_, ol) = comp(&mut s, "Other");
+    let (third, tl) = comp(&mut s, "Third");
+    let unused = s.edit("add", None, |p, _| {
+        let f = effectcraft_project::Footage { path: "/nowhere/a.png".into(), has_video: true, ..Default::default() };
+        Ok(p.add_item("a.png", effectcraft_color::Label::None, None, effectcraft_project::ItemKind::Footage(f)))
+    });
+    let unused = unused.unwrap();
+    let key = |s: &Session| effectcraft_render::disk_cache::comp_content_key(&s.project, main);
+    let expr = |s: &mut Session, (comp, layer): (u64, u64), text: &str| {
+        s.execute("prop.setExpression", json!({"comp": comp, "layer": layer, "path": "transform/opacity", "expression": text})).unwrap();
+    };
+    let opacity = |s: &mut Session, (comp, layer): (u64, u64), v: f64| {
+        s.execute("prop.set", json!({"comp": comp, "layer": layer, "path": "transform/opacity", "value": v})).unwrap();
+    };
+    let repath = |s: &mut Session, path: &str| {
+        let path = path.to_string();
+        s.edit("repath", None, move |p, _| {
+            if let Some(effectcraft_project::ItemKind::Footage(f)) = p.item_mut(unused).map(|i| &mut i.kind) {
+                f.path = path;
+            }
+            Ok(())
+        })
+        .unwrap();
+    };
+    // Its own comp only.
+    expr(&mut s, ml, "thisComp.layer(1).transform.rotation + wiggle(1, 1)[0]");
+    expr(&mut s, ol, "wiggle(2, 10)");
+    let k0 = key(&s);
+    opacity(&mut s, ol, 40.0);
+    expr(&mut s, tl, "time * 10");
+    repath(&mut s, "/nowhere/b.png");
+    s.execute("comp.addMarker", json!({"comp": third.0, "time": 0.5})).unwrap();
+    assert_eq!(key(&s), k0, "edits elsewhere keep the key");
+    // An edit in the comp itself changes it.
+    opacity(&mut s, ml, 30.0);
+    assert_ne!(key(&s), k0);
+    // `comp("Other")`: Other counts, Third doesn't.
+    expr(&mut s, ml, "comp(\"Other\").layer(1).transform.opacity");
+    let k1 = key(&s);
+    expr(&mut s, ol, "wiggle(3, 10)");
+    let k2 = key(&s);
+    assert_ne!(k2, k1, "the comp it names");
+    opacity(&mut s, tl, 20.0);
+    repath(&mut s, "/nowhere/c.png");
+    assert_eq!(key(&s), k2, "a comp it doesn't name");
+    // Another comp taking the name changes what it may read.
+    s.edit("rename", None, |p, _| {
+        p.item_mut(third).unwrap().name = "Other".into();
+        Ok(())
+    })
+    .unwrap();
+    let k3 = key(&s);
+    assert_ne!(k3, k2, "a second comp named Other");
+    // A computed name reaches every item.
+    expr(&mut s, ml, "comp(\"Oth\" + \"er\").layer(1).transform.opacity");
+    let k4 = key(&s);
+    repath(&mut s, "/nowhere/d.png");
+    assert_ne!(key(&s), k4, "unused footage counts with a computed name");
+}
+
+/// Markers count only for the comps whose expressions can read them (#1083): an expression in
+/// another comp that reads markers leaves this comp's markers out of its key.
+#[test]
+fn markers_count_only_where_an_expression_can_read_them() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "M", "width": 8, "height": 8, "frameRate": 30, "duration": 2})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    let other = s.execute("comp.new", json!({"name": "N", "width": 8, "height": 8, "frameRate": 30, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    let ol = s.execute("layer.newSolid", json!({"comp": other, "color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.setExpression", json!({"comp": other, "layer": ol, "path": "transform/opacity", "expression": "thisComp.marker.numKeys"})).unwrap();
+    let key = |s: &Session| effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
+    let k0 = key(&s);
+    s.execute("comp.addMarker", json!({"comp": cid.0, "time": 0.5, "comment": "beat"})).unwrap();
+    assert_eq!(key(&s), k0, "no expression of M reads its markers");
+    s.execute("prop.setExpression", json!({"comp": other, "layer": ol, "path": "transform/opacity", "expression": "comp(\"M\").marker.numKeys"})).unwrap();
+    let other_key = |s: &Session| effectcraft_render::disk_cache::comp_content_key(&s.project, effectcraft_project::ItemId(other));
+    let n0 = other_key(&s);
+    s.execute("comp.addMarker", json!({"comp": cid.0, "time": 1.0})).unwrap();
+    assert_ne!(other_key(&s), n0, "N reads M's markers");
+    assert_eq!(key(&s), k0, "M itself still doesn't");
+}
+
+/// File ▸ Reload Footage drops the disk entries made of the item's files (#3184): a file
+/// replaced by one with the same size and modification time is read again (the check on hit
+/// can't tell), and entries of other files stay.
+#[test]
+fn reload_footage_drops_the_entries_of_its_files() {
+    use crate::render::reads::{FileStamp, ReadFile, ReadFiles};
+    struct Probe;
+    impl crate::Importer for Probe {
+        fn probe(&self, path: &str) -> std::result::Result<effectcraft_project::Footage, String> {
+            Ok(effectcraft_project::Footage {
+                path: path.into(),
+                kind: effectcraft_project::FootageKind::Still,
+                width: 1,
+                height: 1,
+                has_video: true,
+                ..Default::default()
+            })
+        }
+    }
+    let dir = folder("reload");
+    let mut s = Session { importer: Some(std::sync::Arc::new(Probe)), ..Default::default() };
+    s.execute_checked("prefs.set", json!({"values": {"disk.diskCacheFolder": &dir, "disk.diskCacheEnabled": true}})).unwrap();
+    let src = std::path::Path::new(&dir).join("src");
+    std::fs::create_dir_all(&src).unwrap();
+    let mut add = |name: &str| {
+        let p = src.join(name);
+        std::fs::write(&p, b"aa").unwrap();
+        let path = p.to_string_lossy().to_string();
+        let f = effectcraft_project::Footage {
+            path: path.clone(),
+            kind: effectcraft_project::FootageKind::Still,
+            width: 1,
+            height: 1,
+            has_video: true,
+            ..Default::default()
+        };
+        let id = s.edit("add", None, |p, _| Ok(p.add_item(name, effectcraft_color::Label::None, None, effectcraft_project::ItemKind::Footage(f)))).unwrap();
+        (id, path)
+    };
+    let (a, a_path) = add("a.png");
+    let (_, b_path) = add("b.png");
+    let dc = s.disk_cache.clone().unwrap();
+    let read = |p: &str| -> ReadFiles { [ReadFile::new(p, FileStamp::native(p).unwrap())].into_iter().collect() };
+    dc.put_frame_now(1, 1, 1, &[1; 4], &read(&a_path));
+    dc.put_frame_now(2, 1, 1, &[2; 4], &read(&b_path));
+    dc.put_layer_now(3, &effectcraft_effects::Buf { img: effectcraft_raster::Image::new(1, 1), offset: [0.0; 2], scale: 1.0 }, &read(&a_path));
+    // Other bytes, same size, the old time back.
+    let t = std::fs::metadata(&a_path).unwrap().modified().unwrap();
+    std::fs::write(&a_path, b"AA").unwrap();
+    std::fs::File::options().append(true).open(&a_path).unwrap().set_modified(t).unwrap();
+    assert!(dc.contains(crate::render::disk_cache::Kind::Frame, 1));
+    s.execute_checked("file.reloadFootage", json!({"item": a.0})).unwrap();
+    dc.flush();
+    assert!(dc.get_frame(1, None).is_none(), "the reloaded file's frame renders again");
+    assert!(dc.get_layer(3, None).is_none(), "and its layer buffer");
+    assert!(dc.get_frame(2, None).is_some(), "another file's frame stays");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Reload Footage while the disk cache is off (#3184): when it is switched on later in the
+/// session, the entries made of the reloaded files are dropped before anything is read from it
+/// (a file replaced by one with the same size and time would pass the check on hit); entries of
+/// other files stay.
+#[test]
+fn reload_footage_while_the_disk_cache_is_off_drops_its_entries_when_it_is_on() {
+    use crate::render::disk_cache::{DiskCache, Kind};
+    use crate::render::reads::{FileStamp, ReadFile, ReadFiles};
+    struct Probe;
+    impl crate::Importer for Probe {
+        fn probe(&self, path: &str) -> std::result::Result<effectcraft_project::Footage, String> {
+            Ok(effectcraft_project::Footage {
+                path: path.into(),
+                kind: effectcraft_project::FootageKind::Still,
+                width: 1,
+                height: 1,
+                has_video: true,
+                ..Default::default()
+            })
+        }
+    }
+    let dir = folder("reload-off");
+    let src = std::path::Path::new(&dir).join("src");
+    std::fs::create_dir_all(&src).unwrap();
+    let mut s = Session { importer: Some(std::sync::Arc::new(Probe)), ..Default::default() };
+    let mut add = |name: &str| {
+        let p = src.join(name);
+        std::fs::write(&p, b"aa").unwrap();
+        let path = p.to_string_lossy().to_string();
+        let f = effectcraft_project::Footage {
+            path: path.clone(),
+            kind: effectcraft_project::FootageKind::Still,
+            width: 1,
+            height: 1,
+            has_video: true,
+            ..Default::default()
+        };
+        let id = s.edit("add", None, |p, _| Ok(p.add_item(name, effectcraft_color::Label::None, None, effectcraft_project::ItemKind::Footage(f)))).unwrap();
+        (id, path)
+    };
+    let (a, a_path) = add("a.png");
+    let (_, b_path) = add("b.png");
+    // Entries from an earlier session in the cache folder.
+    let read = |p: &str| -> ReadFiles { [ReadFile::new(p, FileStamp::native(p).unwrap())].into_iter().collect() };
+    {
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        dc.put_frame_now(1, 1, 1, &[1; 4], &read(&a_path));
+        dc.put_frame_now(2, 1, 1, &[2; 4], &read(&b_path));
+        dc.put_layer_now(3, &effectcraft_effects::Buf { img: effectcraft_raster::Image::new(1, 1), offset: [0.0; 2], scale: 1.0 }, &read(&a_path));
+    }
+    // Other bytes, same size, the old time back; reloaded while the cache is off.
+    let t = std::fs::metadata(&a_path).unwrap().modified().unwrap();
+    std::fs::write(&a_path, b"AA").unwrap();
+    std::fs::File::options().append(true).open(&a_path).unwrap().set_modified(t).unwrap();
+    assert!(s.disk_cache.is_none());
+    s.execute_checked("file.reloadFootage", json!({"item": a.0})).unwrap();
+    // Switched on: the reloaded file's entries are misses from the start, and then gone.
+    s.execute_checked("prefs.set", json!({"values": {"disk.diskCacheFolder": &dir, "disk.diskCacheEnabled": true}})).unwrap();
+    let dc = s.disk_cache.clone().unwrap();
+    assert!(dc.get_frame(1, None).is_none(), "the reloaded file's frame renders again");
+    assert!(dc.get_layer(3, None).is_none(), "and its layer buffer");
+    dc.flush();
+    assert!(!dc.contains(Kind::Frame, 1) && !dc.contains(Kind::Layer, 3));
+    assert!(dc.get_frame(2, None).is_some(), "another file's frame stays");
+    assert!(s.pending_disk_drops.is_empty(), "applied once");
+    drop(dc);
+    drop(s);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/src/tests/display_pass.rs b/crates/engine/src/tests/display_pass.rs
new file mode 100644
index 000000000..8daeea136
--- /dev/null
+++ b/crates/engine/src/tests/display_pass.rs
@@ -0,0 +1,206 @@
+//! The viewer's display pass (`viewer::DisplayPass`): exposure on the float range of 32 bpc
+//! frames, the HDR step after exposure, the display colour after both, and the frame encodings.
+
+use effectcraft_color::{ColorSpace, linear_to_srgb};
+use effectcraft_project::HdrMode;
+use effectcraft_render::RenderOpts;
+use effectcraft_render::color::{compand, tone_map};
+use effectcraft_time::Tick;
+use serde_json::json;
+
+use crate::Session;
+use crate::viewer::{Channel, DisplayColor, DisplayPass, FrameEncoding, PassCurve, SimProfile, Simulation};
+
+const SRGB: FrameEncoding = FrameEncoding { curve: PassCurve::Srgb, hdr: HdrMode::Clip };
+
+fn rgb(encoding: FrameEncoding, stops: f32) -> DisplayPass {
+    DisplayPass::new(Channel::Rgb, false, stops, encoding, None)
+}
+
+/// An opaque grey of linear light `l`, sRGB-encoded as 32 bpc frames store it.
+fn grey(l: f32) -> [f32; 4] {
+    let e = PassCurve::Srgb.encode(l);
+    [e, e, e, 1.0]
+}
+
+fn q(v: f32) -> u8 {
+    (v.clamp(0.0, 1.0) * 255.0 + 0.5).floor() as u8
+}
+
+/// The issue's case: over-range values come back with negative exposure (4.0 at -2 EV is white)
+/// and 0.5 at +1 EV is white; values of the 8-bit range keep today's bytes.
+#[test]
+fn exposure_reaches_over_range_values() {
+    let table: [(f32, [u8; 5]); 6] = [
+        (0.25, [137, 99, 71, 34, 188]),
+        (0.5, [188, 137, 99, 49, 255]),
+        (1.0, [255, 188, 137, 71, 255]),
+        (2.0, [255, 255, 188, 99, 255]),
+        (4.0, [255, 255, 255, 137, 255]),
+        (16.0, [255, 255, 255, 255, 255]),
+    ];
+    for (l, want) in table {
+        for (stops, w) in [0.0, -1.0, -2.0, -4.0, 1.0].into_iter().zip(want) {
+            assert_eq!(rgb(SRGB, stops).pixel(grey(l))[0], w, "linear {l} at {stops} EV");
+        }
+    }
+    assert_eq!(rgb(SRGB, -2.0).pixel(grey(4.0)), [255, 255, 255, 255]);
+    assert_eq!(rgb(SRGB, 1.0).pixel(grey(0.5)), [255, 255, 255, 255]);
+    // Premultiplied: alpha stays, colour scales with it.
+    let e = PassCurve::Srgb.encode(4.0);
+    let half = rgb(SRGB, -2.0).pixel([e * 0.5, e * 0.5, e * 0.5, 0.5]);
+    assert!(half[3] == 128 && half[..3].iter().all(|c| (127..=128).contains(c)), "{half:?}");
+}
+
+/// Compand / Tone Map run after exposure: a value under the knee that exposure pushes over it
+/// is companded (not clipped), and highlights darkened by exposure are not companded first.
+#[test]
+fn the_hdr_step_runs_after_exposure() {
+    let compand_enc = FrameEncoding { curve: PassCurve::Srgb, hdr: HdrMode::Compand };
+    // 0.6 is below the 0.8 knee: unchanged at 0 EV, companded to about 0.97 at +1 EV.
+    assert_eq!(rgb(compand_enc, 0.0).pixel(grey(0.6))[0], q(linear_to_srgb(0.6)));
+    let up = rgb(compand_enc, 1.0).pixel(grey(0.6))[0];
+    assert_eq!(up, q(linear_to_srgb(compand(1.2))));
+    assert!(up < 255, "companded after exposure, not clipped: {up}");
+    // 3.0 at -2 EV is 0.75, under the knee: compand first would have made it 0.25.
+    let down = rgb(compand_enc, -2.0).pixel(grey(3.0))[0];
+    assert_eq!(down, q(linear_to_srgb(0.75)));
+    assert!(down > q(linear_to_srgb(compand(3.0) * 0.25)) + 50, "{down}");
+    // Tone Map (luminance): the same order.
+    let tm = FrameEncoding { curve: PassCurve::Srgb, hdr: HdrMode::ToneMap };
+    for (l, stops) in [(0.6f32, 1.0f32), (3.0, -2.0), (16.0, -1.0), (0.1, 0.0)] {
+        let k = 2f32.powf(stops);
+        let want = q(linear_to_srgb(tone_map([l * k; 3])[0]));
+        assert_eq!(rgb(tm, stops).pixel(grey(l))[0], want, "{l} at {stops}");
+    }
+}
+
+/// The display colour converts the exposed output numbers: exposure first, then the monitor
+/// conversion (before: the conversion of the 8-bit frame, then exposure).
+#[test]
+fn display_colour_follows_exposure() {
+    let dc =
+        DisplayColor::new(Some(ColorSpace::Srgb), false, ColorSpace::Srgb, true, ColorSpace::DisplayP3, Simulation::default(), &Default::default()).unwrap();
+    let pass = DisplayPass::new(Channel::Rgb, false, 1.0, SRGB, Some(&dc));
+    let red = [PassCurve::Srgb.encode(0.4), 0.0, 0.0, 1.0];
+    let exposed = [linear_to_srgb(0.8), 0.0, 0.0];
+    let want = dc.apply_straight(exposed).map(q);
+    assert_eq!(pass.pixel(red)[..3], want);
+    // The conversion is not applied to a single channel's view.
+    assert!(DisplayPass::new(Channel::Red, false, 0.0, SRGB, Some(&dc)).color.is_none());
+}
+
+/// The pass's display colour is `DisplayColor::apply_straight`: the same conversions in the same
+/// order (a few ULPs apart where the pass uses `f32` for PQ / HLG).
+#[test]
+fn pass_colour_matches_display_color() {
+    let custom = Default::default();
+    let mut cases = vec![];
+    for display in [ColorSpace::DisplayP3, ColorSpace::Rec709, ColorSpace::Rec2020, ColorSpace::Srgb] {
+        for profile in SimProfile::ALL {
+            for preserve_rgb in [false, true] {
+                let sim = Simulation { profile, preserve_rgb };
+                cases.extend(DisplayColor::new(Some(ColorSpace::Srgb), false, ColorSpace::Srgb, true, display, sim, &custom));
+            }
+        }
+        cases.extend(DisplayColor::new(Some(ColorSpace::Rec2020), true, ColorSpace::Srgb, false, display, Simulation::default(), &custom));
+    }
+    // A LUT-based profile (an uneven, channel-mixing grid).
+    cases.push(DisplayColor::from_lut(std::sync::Arc::new(test_lut())));
+    assert!(cases.len() > 40);
+    for dc in &cases {
+        let pass = dc.pass();
+        for i in 0..=20 {
+            for c in [[i as f32 / 20.0, 0.3, 0.9], [0.05, i as f32 / 20.0, 0.5], [1.0, 1.0, i as f32 / 20.0]] {
+                let (a, b) = (pass.apply(c), dc.apply_straight(c));
+                for k in 0..3 {
+                    // The simulation's 8-bit step can land either side of a tie.
+                    assert!((a[k] - b[k]).abs() < 1e-4 || ((a[k] - b[k]).abs() < 1.5 / 255.0 && c != [1.0; 3]), "{dc:?} {c:?}: {a:?} vs {b:?}");
+                }
+            }
+        }
+    }
+}
+
+/// A 17³ LUT that mixes channels and bends the curve (as an ICC profile's device does).
+pub(crate) fn test_lut() -> effectcraft_color::icc::Lut3d {
+    effectcraft_color::icc::Lut3d::bake(17, |c| [c[0].powf(1.3) * 0.9 + c[1] * 0.1, c[1] * 0.8 + c[2] * 0.2, (c[2] * 0.7 + c[0] * 0.3).sqrt()])
+}
+
+/// Frames keep their encoding: the output space's curve (the Working Gamma's when unmanaged) and
+/// the HDR step only when it was skipped and applies (managed, SDR output).
+#[test]
+fn frame_encodings() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 8, "height": 8, "duration": 1})).unwrap();
+    assert_eq!(FrameEncoding::of(&s.project.settings, true), SRGB, "unmanaged: sRGB at Working Gamma 2.2, no HDR step");
+    s.execute("file.projectSettings", json!({"bitDepth": 32, "workingSpace": "srgb", "hdr": "compand"})).unwrap();
+    let settings = s.project.settings.clone();
+    assert_eq!(FrameEncoding::of(&settings, true), FrameEncoding { curve: PassCurve::Srgb, hdr: HdrMode::Compand });
+    assert_eq!(FrameEncoding::of(&settings, false), SRGB, "rendered with the step: nothing pending");
+    s.execute("file.projectSettings", json!({"outputSpace": "rec2100pq"})).unwrap();
+    assert_eq!(FrameEncoding::of(&s.project.settings, true), FrameEncoding { curve: PassCurve::Pq, hdr: HdrMode::Clip }, "HDR outputs never tone map");
+    s.execute("file.projectSettings", json!({"outputSpace": "rec709"})).unwrap();
+    assert_eq!(FrameEncoding::of(&s.project.settings, true).curve, PassCurve::Gamma(2.4));
+}
+
+/// A 32 bpc Compand project with an over-range layer: `FrameEncoding::finish` on the frame
+/// rendered without the HDR step gives the frame rendered with it, and Take Snapshot (now taken
+/// without the step) exports the same bytes as before, within a rounding step.
+#[test]
+fn the_skipped_hdr_step_finishes_like_the_render() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 16, "height": 8, "duration": 1})).unwrap();
+    s.execute("file.projectSettings", json!({"bitDepth": 32, "workingSpace": "srgb", "hdr": "compand"})).unwrap();
+    let lid = s.execute("layer.newSolid", json!({"color": "#c08040", "width": 16, "height": 8})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layers": [lid], "effect": "Exposure"})).unwrap();
+    s.execute("prop.set", json!({"layer": lid, "path": "effects/#1/master/exposure", "value": 1.5})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let with = s.render(cid, Tick::ZERO, RenderOpts::default());
+    let without = s.render(cid, Tick::ZERO, RenderOpts { skip_hdr_step: true, ..Default::default() });
+    let enc = FrameEncoding::of(&s.project.settings, true);
+    assert_eq!(enc.hdr, HdrMode::Compand);
+    let (w, o) = (with.data[0], without.data[0]);
+    assert!(o[0] > 1.0 && w[0] < 1.0, "over range without the step, companded with it: {o:?} {w:?}");
+    let f = enc.finish([o[0], o[1], o[2]]);
+    for k in 0..3 {
+        assert!((f[k] - w[k]).abs() < 1e-4, "{f:?} vs {w:?}");
+    }
+    s.execute("view.takeSnapshot", json!({})).unwrap();
+    assert_eq!(s.snapshot.as_ref().unwrap().encoding, enc);
+    let (_, _, rgba) = crate::commands::viewer_cmds::snapshot_rgba8(&s).unwrap();
+    let before = w.map(|v| (v.clamp(0.0, 1.0) * 255.0 + 0.5) as u8);
+    for k in 0..4 {
+        assert!((rgba[k] as i32 - before[k] as i32).abs() <= 1, "{:?} vs {before:?}", &rgba[..4]);
+    }
+    // 8 bpc snapshots are rendered with the step, as before.
+    s.execute("file.projectSettings", json!({"bitDepth": 8})).unwrap();
+    s.execute("view.takeSnapshot", json!({})).unwrap();
+    assert_eq!(s.snapshot.as_ref().unwrap().encoding.hdr, HdrMode::Clip);
+}
+
+/// The 8-bit CPU path's tables give what the pass gives pixel by pixel: every value of every
+/// channel view, opaque and not, with and without exposure.
+#[test]
+fn the_8_bit_tables_are_the_pass() {
+    for (channel, colorized) in
+        [(Channel::Rgb, false), (Channel::RgbStraight, false), (Channel::Red, false), (Channel::Green, true), (Channel::Blue, false), (Channel::Alpha, false)]
+    {
+        for stops in [0.0f32, 1.0, -2.5] {
+            let pass = DisplayPass::new(channel, colorized, stops, SRGB, None);
+            let px: Vec<[u8; 4]> = (0..256 * 4)
+                .map(|i| {
+                    let v = (i % 256) as u8;
+                    let a = [255u8, 255, 128, 3][i / 256];
+                    let c = |k: u8| ((v as u32 * k as u32) % 256 * a as u32 / 255) as u8;
+                    [c(1), c(7), c(13), a]
+                })
+                .collect();
+            let mut got = px.clone();
+            pass.apply_rgba8(&mut got);
+            for (p, g) in px.iter().zip(&got) {
+                assert_eq!(*g, pass.pixel(p.map(|v| v as f32 / 255.0)), "{channel:?} {colorized} {stops}: {p:?}");
+            }
+        }
+    }
+}
diff --git a/crates/engine/src/tests_effects.rs b/crates/engine/src/tests/effects.rs
similarity index 82%
rename from crates/engine/src/tests_effects.rs
rename to crates/engine/src/tests/effects.rs
index 18fcc6f84..f5255c0a3 100644
--- a/crates/engine/src/tests_effects.rs
+++ b/crates/engine/src/tests/effects.rs
@@ -550,7 +550,7 @@ fn opening_an_old_project_upgrades_effect_instances() {
             effectcraft_project::ItemKind::Comp(c) => c,
             _ => panic!("not a composition"),
         });
-        let l = comp.layers.iter_mut().find(|l| l.id == LayerId(a)).unwrap();
+        let l = comp.layers.find_mut(|l| l.id == LayerId(a)).unwrap();
         for n in &mut l.props.sub_mut("effects").unwrap().children {
             let Node::Group(g) = n else { continue };
             if g.match_id == "ec.blur.gaussian" {
@@ -772,6 +772,153 @@ fn preset_round_trips_effect_properties_by_match_name() {
     }
 }
 
+/// An animation preset saved by an earlier version gets the upgrade a project gets on open: a
+/// Change to Color saved with its single Tolerance applies with the Tolerance group, that value
+/// as its Hue and the added parameters at their legacy defaults, and a lone property saved at the
+/// old id applies to the new one.
+#[test]
+fn applying_an_old_preset_upgrades_its_effects_and_property_paths() {
+    let (mut s, a, b) = comp_with_two_solids();
+    apply(&mut s, a, "Change to Color");
+    let mut old = layer(&s, a).effects().unwrap().groups().next().unwrap().clone();
+    old.children.retain(|c| c.match_id() != "toleranceGroup");
+    old.children.push(effectcraft_project::Property::new(0, "tolerance", "Tolerance", KV::Scalar(12.0)).into());
+    let preset = json!({"effectcraftAnimationPreset": 1, "name": "old", "properties": [], "effects": [old]});
+    let r = s.execute("anim.applyPreset", json!({"preset": preset, "layers": [b]})).unwrap();
+    assert_eq!(r["applied"], 1, "{r}");
+    let l = layer(&s, b);
+    let g = l.effects().unwrap().groups().next().unwrap();
+    assert!(g.get("tolerance").is_none(), "the old Tolerance is still there");
+    let tol = g.sub("toleranceGroup").expect("no Tolerance group");
+    assert_eq!(tol.get("hue").unwrap().value, KV::Scalar(12.0));
+    assert_eq!(tol.get("lightness").unwrap().value, KV::Scalar(100.0));
+    assert_eq!(tol.get("saturation").unwrap().value, KV::Scalar(100.0));
+    let path = "effects/ec.color.changetocolor/tolerance";
+    let preset = json!({"effectcraftAnimationPreset": 1, "name": "old", "properties": [{"path": path, "value": KV::Scalar(30.0), "keys": []}], "effects": []});
+    let r = s.execute("anim.applyPreset", json!({"preset": preset, "layers": [a]})).unwrap();
+    assert_eq!(r["applied"], 1, "{r}");
+    assert_eq!(r["skipped"], json!([]), "{r}");
+    let l = layer(&s, a);
+    let hue = l.effects().unwrap().groups().next().unwrap().sub("toleranceGroup").unwrap().get("hue").unwrap().value.clone();
+    assert_eq!(hue, KV::Scalar(30.0));
+}
+
+/// Save the selected effects and properties as a preset, then apply it to `target` at `at`.
+fn save_and_apply_preset(s: &mut Session, name: &str, selected: Vec<(LayerId, u64)>, target: u64, at: f64) -> serde_json::Value {
+    let path = std::env::temp_dir().join(format!("ec-1971-{name}-{}.ecpreset", std::process::id())).to_string_lossy().to_string();
+    s.state.selected_props = selected;
+    s.execute("anim.savePreset", json!({"path": path})).unwrap();
+    s.execute("time.set", json!({"time": at})).unwrap();
+    let r = s.execute("anim.applyPreset", json!({"path": path, "layers": [target]}));
+    let _ = std::fs::remove_file(&path);
+    r.unwrap()
+}
+
+/// The comp times of the keys at `path` on `lid`'s `n`th effect (0-based), or on the layer when
+/// `n` is `None`.
+fn key_times(s: &Session, lid: u64, n: Option<usize>, path: &str) -> Vec<f64> {
+    let l = layer(s, lid);
+    let group = match n {
+        Some(n) => l.effects().unwrap().groups().nth(n).unwrap().clone(),
+        None => l.props.clone(),
+    };
+    group.prop(path).unwrap().keys.iter().map(|k| l.comp_time(k.time).seconds()).collect()
+}
+
+/// #1971: a saved effect's keys start at the playhead of the layer it's applied to, as a saved
+/// property's do, nested controls included, an effect without keys still applies, and the whole
+/// apply is one undo step.
+#[test]
+fn preset_effect_keys_start_at_the_playhead() {
+    let (mut s, a, b) = comp_with_two_solids();
+    let blur = apply(&mut s, a, "Gaussian Blur");
+    let fractal = apply(&mut s, a, "Fractal");
+    let slider = apply(&mut s, a, "Slider Control");
+    animate_effect(&mut s, a, blur, "blurriness", &[(5.0, 10.0), (5.5, 30.0), (6.0, 10.0)]);
+    animate_effect(&mut s, a, fractal, "mandelbrot/mandelbrotX", &[(5.5, 1.25), (7.0, 2.5)]);
+    let before = layer(&s, b);
+    let undo = s.history.undo.len();
+    let r = save_and_apply_preset(&mut s, "effects", vec![(LayerId(a), blur), (LayerId(a), fractal), (LayerId(a), slider)], b, 0.5);
+    assert_eq!(r["applied"], 3, "{r}");
+    assert_eq!(key_times(&s, b, Some(0), "blurriness"), vec![0.5, 1.0, 1.5]);
+    assert_eq!(key_times(&s, b, Some(1), "mandelbrot/mandelbrotX"), vec![1.0, 2.5]);
+    assert_eq!(s.history.undo.len(), undo + 1, "the whole apply is one undo step");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(layer(&s, b), before);
+}
+
+/// #1971: effects and properties saved together keep their relative timing: the earliest key of
+/// either starts at the playhead.
+#[test]
+fn preset_effects_and_properties_share_one_anchor() {
+    let (mut s, a, b) = comp_with_two_solids();
+    let blur = apply(&mut s, a, "Gaussian Blur");
+    animate_effect(&mut s, a, blur, "blurriness", &[(5.0, 10.0), (6.0, 30.0)]);
+    for (time, value) in [(4.0, -12.0), (7.0, 12.0)] {
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/rotation", "time": time, "timeBase": "comp", "value": value})).unwrap();
+    }
+    let rotation = layer(&s, a).props.prop("transform/rotation").unwrap().uid;
+    save_and_apply_preset(&mut s, "mixed", vec![(LayerId(a), blur), (LayerId(a), rotation)], b, 1.0);
+    assert_eq!(key_times(&s, b, None, "transform/rotation"), vec![1.0, 4.0]);
+    assert_eq!(key_times(&s, b, Some(0), "blurriness"), vec![2.0, 3.0]);
+}
+
+/// #1971: on a stretched layer a saved effect's keys land where a saved property's keys do.
+#[test]
+fn preset_effect_keys_follow_a_stretched_layer_like_properties() {
+    let (mut s, a, b) = comp_with_two_solids();
+    let blur = apply(&mut s, a, "Gaussian Blur");
+    animate_effect(&mut s, a, blur, "blurriness", &[(5.0, 10.0), (6.0, 30.0)]);
+    for (time, value) in [(5.0, -12.0), (6.0, 12.0)] {
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/rotation", "time": time, "timeBase": "comp", "value": value})).unwrap();
+    }
+    let rotation = layer(&s, a).props.prop("transform/rotation").unwrap().uid;
+    set_layer_clock(&mut s, b, 1.0, 200.0);
+    save_and_apply_preset(&mut s, "stretched", vec![(LayerId(a), blur), (LayerId(a), rotation)], b, 2.0);
+    let property = key_times(&s, b, None, "transform/rotation");
+    assert_eq!(property.first(), Some(&2.0), "the property's keys start at the playhead");
+    assert_eq!(key_times(&s, b, Some(0), "blurriness"), property, "and the effect's keys land with them");
+}
+
+/// #1971: a preset saved before effect keys were stored relative to the earliest key (version 1)
+/// has its effects' keys at the source layer's times; they also start at the playhead.
+#[test]
+fn old_preset_effect_keys_start_at_the_playhead() {
+    let (mut s, a, b) = comp_with_two_solids();
+    let blur = apply(&mut s, a, "Gaussian Blur");
+    animate_effect(&mut s, a, blur, "blurriness", &[(5.0, 10.0), (6.0, 30.0)]);
+    let old = json!({
+        "effectcraftAnimationPreset": 1,
+        "name": "shake",
+        "properties": [],
+        "effects": [serde_json::to_value(effect_group(&s, a, blur)).unwrap()],
+    });
+    s.execute("time.set", json!({"time": 0.5})).unwrap();
+    s.execute("anim.applyPreset", json!({"preset": old, "layers": [b]})).unwrap();
+    assert_eq!(key_times(&s, b, Some(0), "blurriness"), vec![0.5, 1.5]);
+}
+
+/// #2064: `prop.addKey` accepts the `effects/<match name>[#n]/<property>` path that
+/// `essential.list` reports.
+#[test]
+fn add_key_resolves_effect_match_name_paths() {
+    let (mut s, a, _) = comp_with_two_solids();
+    apply(&mut s, a, "Slider Control");
+    apply(&mut s, a, "Slider Control");
+    let slider = |s: &Session, n: usize| match layer(s, a).effects().unwrap().groups().nth(n).unwrap().get("slider").unwrap().value {
+        KV::Scalar(v) => v,
+        ref other => panic!("not a scalar: {other:?}"),
+    };
+    for (path, n, value) in [("effects/ec.control.slider/slider", 0, 30.0), ("effects/ec.control.slider#2/slider", 1, 70.0)] {
+        let reply = s.execute("prop.addKey", json!({"layer": a, "path": path, "time": 0, "value": value})).unwrap();
+        assert_eq!(reply, json!(1), "{path}");
+        let got = s.execute("prop.get", json!({"layer": a, "path": path, "time": 0})).unwrap();
+        assert_eq!(got["value"], json!(value), "{path}");
+        assert_eq!(got["keys"].as_array().unwrap().len(), 1, "{path}");
+        assert_eq!(slider(&s, n), 0.0, "the static value stays put; the key carries {value}");
+    }
+}
+
 /// #1746: Edit ▸ Copy of an effect property writes the same `effects/ec.blur.gaussian/blurriness` path,
 /// and Paste (the value, or Copy Expression Only) sets that property of the other layer's effect.
 #[test]
@@ -794,3 +941,25 @@ fn copied_effect_property_pastes_onto_the_same_effect() {
     assert_eq!(r["expressions"], 1, "{r}");
     assert_eq!(layer(&s, b).props.prop("effects/#1/blurriness").unwrap().expr.as_ref().unwrap().text, "time * 10");
 }
+
+/// Effect helpers run native code: a script starts them only with Allow Scripts to Write Files
+/// and Access Network on (as for File.execute()); the user always can.
+#[test]
+fn scripts_start_effect_helpers_only_with_file_access() {
+    let mut s = Session {
+        helpers: Some(crate::HelperHooks {
+            scan: |_| json!({"paths": [], "helpers": [], "loaded": [], "errors": []}),
+            load: |_| Ok(json!({"loaded": [], "errors": []})),
+            list: || json!({"helpers": [], "blocked": []}),
+        }),
+        ..Default::default()
+    };
+    for (id, params) in [("effect.helpers.scan", json!({})), ("effect.helpers.load", json!({"path": "/plug-ins/x.ofx"}))] {
+        let e = s.execute_for_script(id, params.clone()).unwrap_err().to_string();
+        assert!(e.contains("Allow Scripts to Write Files"), "{id}: {e}");
+        assert!(s.execute(id, params).is_ok(), "{id}: the user starts helpers");
+    }
+    assert!(s.execute_for_script("effect.helpers.list", json!({})).is_ok(), "listing starts nothing");
+    s.execute("prefs.set", json!({"key": "scripting.allowScriptsWriteFiles", "value": true})).unwrap();
+    assert!(s.execute_for_script("effect.helpers.scan", json!({})).is_ok());
+}
diff --git a/crates/engine/src/tests_essential.rs b/crates/engine/src/tests/essential.rs
similarity index 75%
rename from crates/engine/src/tests_essential.rs
rename to crates/engine/src/tests/essential.rs
index 191416b9d..db5bf0751 100644
--- a/crates/engine/src/tests_essential.rs
+++ b/crates/engine/src/tests/essential.rs
@@ -367,6 +367,128 @@ fn media_replacement_swaps_footage_per_instance() {
     assert!(center(&s, main)[0] > 0.99);
 }
 
+/// #1747: a collapsed precomp with an Essential Property override must keep drawing its nested
+/// layers past the precomp's frame instead of falling back to a flattened, clipped frame.
+#[test]
+fn collapsed_precomp_applies_property_overrides_without_clipping() {
+    struct AddY;
+    impl effectcraft_render::ExprHost for AddY {
+        fn eval(
+            &self,
+            _: &effectcraft_render::EvalCtx,
+            _: &effectcraft_project::Layer,
+            _: &effectcraft_project::Property,
+            value: &effectcraft_keyframe::Value,
+        ) -> Result<effectcraft_keyframe::Value, String> {
+            Ok(match value {
+                effectcraft_keyframe::Value::Vec3([x, y, z]) => effectcraft_keyframe::Value::Vec3([*x, y + 100.0, *z]),
+                _ => value.clone(),
+            })
+        }
+    }
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Inner", "width": 400, "height": 300, "frameRate": 30, "duration": 2})).unwrap();
+    let inner = s.active_comp_id().unwrap();
+    let box_ = s.execute("layer.newSolid", json!({"name": "Box", "color": "#ffffff", "width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": box_, "path": "transform/position", "value": [200, 50, 0]})).unwrap();
+    // The source property's expression still runs after the instance override.
+    s.execute("prop.setExpression", json!({"layer": box_, "path": "transform/position", "expression": "value + [0, 100, 0]"})).unwrap();
+    let position = s.execute("essential.addProperty", json!({"layer": box_, "path": "transform/position"})).unwrap()["controls"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 400, "height": 600, "frameRate": 30, "duration": 2})).unwrap();
+    let outer = s.active_comp_id().unwrap();
+    let instance = s.execute("layer.addItem", json!({"item": inner.0})).unwrap()["layer"].as_u64().unwrap();
+    let other = s.execute("layer.addItem", json!({"item": inner.0})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [instance, other], "switch": "collapse", "value": true})).unwrap();
+    s.expr = Some(std::sync::Arc::new(AddY));
+    s.execute("layer.select", json!({"layers": [instance]})).unwrap();
+    s.execute("essential.set", json!({"layer": instance, "control": position, "value": [200, -120, 0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [other]})).unwrap();
+    s.execute("essential.set", json!({"layer": other, "control": position, "value": [200, 220, 0]})).unwrap();
+    let img = s.render(outer, Tick::ZERO, RenderOpts::default());
+    // The expression adds 100 px: the overrides give inner y = -20 and 320. The first maps to
+    // outer y = 130 (the precomp is centred at 300) and its 100 px box spans 80..179, 70 px above
+    // the instance's frame (150..449), where a flattened precomp would stop. The second maps to
+    // 470 and spans 420..519, past the bottom.
+    assert!(img.get(200, 100)[3] > 0.99, "the override draws above the nested frame: {:?}", img.get(200, 100));
+    assert!(img.get(200, 90)[3] > 0.99, "the box reaches the top of its overridden bounds");
+    assert!(img.get(200, 500)[3] > 0.99, "the other instance keeps its own override: {:?}", img.get(200, 500));
+    assert!(img.get(200, 200)[3] < 0.01, "nothing is left between the instances");
+}
+
+/// #1747: two collapsed instances of the same comp keep their own source-affecting property
+/// overrides in the layer cache (the nested layers' ids and static values are identical).
+#[test]
+fn collapsed_instances_keep_distinct_property_overrides_in_the_cache() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Card", "width": 64, "height": 64, "frameRate": 30, "duration": 2})).unwrap();
+    let card = s.active_comp_id().unwrap();
+    let solid = s.execute("layer.newSolid", json!({"name": "BG", "color": "#ffffff", "width": 64, "height": 64})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layer": solid, "effect": "Fill"})).unwrap();
+    let color = s.execute("essential.addProperty", json!({"layer": solid, "path": "effects/#1/color"})).unwrap()["controls"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 200, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
+    let main = s.active_comp_id().unwrap();
+    let a = s.execute("layer.addItem", json!({"item": card.0})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.addItem", json!({"item": card.0})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [a, b], "switch": "collapse", "value": true})).unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "transform/position", "value": [60, 50, 0]})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "transform/position", "value": [140, 50, 0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [a]})).unwrap();
+    s.execute("essential.set", json!({"layer": a, "control": color, "value": [1.0, 0.0, 0.0, 1.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [b]})).unwrap();
+    s.execute("essential.set", json!({"layer": b, "control": color, "value": [0.0, 0.0, 1.0, 1.0]})).unwrap();
+    let img = s.render(main, Tick::ZERO, RenderOpts::default());
+    let left = img.get(60, 50);
+    let right = img.get(140, 50);
+    assert!(left[0] > 0.99 && left[2] < 0.01, "left instance is red: {left:?}");
+    assert!(right[2] > 0.99 && right[0] < 0.01, "right instance is blue: {right:?}");
+}
+
+/// #1747 with Media Replacement: the replacement footage and the position override both apply
+/// while the precomp stays collapsed, so the box is blue and still draws above the frame.
+#[test]
+fn collapsed_precomp_applies_media_replacement_without_clipping() {
+    struct Colors;
+    impl crate::render::FootageSource for Colors {
+        fn frame(&self, _: ItemId, f: &effectcraft_project::Footage, _: Tick) -> Option<std::sync::Arc<effectcraft_raster::Image>> {
+            let c = if f.path.contains("blue") { [0.0, 0.0, 1.0, 1.0] } else { [1.0, 0.0, 0.0, 1.0] };
+            Some(std::sync::Arc::new(effectcraft_raster::Image::filled(100, 100, c)))
+        }
+    }
+    let mut s = Session { footage: std::sync::Arc::new(Colors), ..Default::default() };
+    let footage = |path: &str| effectcraft_project::Footage {
+        path: path.into(),
+        kind: effectcraft_project::FootageKind::Still,
+        width: 100,
+        height: 100,
+        has_video: true,
+        ..Default::default()
+    };
+    let (red, blue) = s
+        .edit("test", None, |proj, _| {
+            let red = proj.add_item("red.png", Default::default(), None, effectcraft_project::ItemKind::Footage(footage("red.png")));
+            let blue = proj.add_item("blue.png", Default::default(), None, effectcraft_project::ItemKind::Footage(footage("blue.png")));
+            Ok((red, blue))
+        })
+        .unwrap();
+    s.execute("comp.new", json!({"name": "Inner", "width": 400, "height": 300, "frameRate": 30, "duration": 2})).unwrap();
+    let inner = s.active_comp_id().unwrap();
+    let clip = s.execute("layer.addItem", json!({"item": red.0})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": clip, "path": "transform/position", "value": [200, 50, 0]})).unwrap();
+    let media = s.execute("essential.addMedia", json!({"layer": clip})).unwrap()["control"].as_u64().unwrap();
+    let position = s.execute("essential.addProperty", json!({"layer": clip, "path": "transform/position"})).unwrap()["controls"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 400, "height": 600, "frameRate": 30, "duration": 2})).unwrap();
+    let outer = s.active_comp_id().unwrap();
+    let instance = s.execute("layer.addItem", json!({"item": inner.0})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [instance], "switch": "collapse", "value": true})).unwrap();
+    s.execute("layer.select", json!({"layers": [instance]})).unwrap();
+    s.execute("essential.set", json!({"layer": instance, "control": position, "value": [200, -20, 0]})).unwrap();
+    s.execute("essential.set", json!({"layer": instance, "control": media, "item": blue.0})).unwrap();
+    let img = s.render(outer, Tick::ZERO, RenderOpts::default());
+    let above = img.get(200, 100);
+    assert!(above[2] > 0.99 && above[0] < 0.01, "the replacement media is blue above the frame: {above:?}");
+    assert!(img.get(200, 200)[3] < 0.01, "the collapsed box is not clipped at the nested frame");
+}
+
 /// Responsive Design — Time: stretching a precomp keeps its protected regions at their
 /// original speed; the unprotected parts absorb the stretch.
 #[test]
diff --git a/crates/engine/src/tests_essential_more.rs b/crates/engine/src/tests/essential_more.rs
similarity index 72%
rename from crates/engine/src/tests_essential_more.rs
rename to crates/engine/src/tests/essential_more.rs
index a8d8dc808..ea4aa42e5 100644
--- a/crates/engine/src/tests_essential_more.rs
+++ b/crates/engine/src/tests/essential_more.rs
@@ -2,6 +2,7 @@
 
 use effectcraft_keyframe::Value as KV;
 use effectcraft_project::essential::{self, ControlType};
+use effectcraft_time::Tick;
 use serde_json::json;
 
 use crate::{Event, Session};
@@ -102,3 +103,33 @@ fn open_in_essential_graphics_sets_the_primary_comp() {
     );
     assert_eq!(s.execute("essential.list", json!({})).unwrap()["name"], "A");
 }
+
+/// #1747: through a collapsed precomp, a Text override and a Font override of the same Source
+/// Text both apply: the Font merges into the overridden text, as `essential::with_overrides`
+/// does on the flattened path, instead of one entry replacing the other.
+#[test]
+fn collapsed_instance_merges_text_and_font_overrides() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Title", "width": 64, "height": 64, "frameRate": 30, "duration": 1})).unwrap();
+    let title = s.active_comp_id().unwrap();
+    let text = s.execute("layer.newText", json!({"text": "Hello"})).unwrap()["layer"].as_u64().unwrap();
+    let body = s.execute("essential.addProperty", json!({"layer": text, "path": "text/sourceText"})).unwrap()["controls"][0].as_u64().unwrap();
+    let font = s.execute("essential.addProperty", json!({"layer": text, "path": "text/sourceText", "as": "font"})).unwrap()["controls"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "frameRate": 30, "duration": 1})).unwrap();
+    let main = s.active_comp_id().unwrap();
+    let inst = s.execute("layer.addItem", json!({"item": title.0})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [inst], "switch": "collapse", "value": true})).unwrap();
+    s.execute("essential.set", json!({"layer": inst, "control": body, "value": "Bye"})).unwrap();
+    s.execute("essential.set", json!({"layer": inst, "control": font, "value": {"font": "Serif Test", "size": 40}})).unwrap();
+    // Evaluate the nested text in the collapsed instance's context, as the renderer does.
+    let r = effectcraft_render::Renderer::new(&s.project, &*s.footage, crate::render::RenderOpts::default());
+    let ctx = effectcraft_render::EvalCtx::new(&s.project, main, s.project.comp(main).unwrap(), Tick::ZERO);
+    let layer = ctx.comp.layer(effectcraft_project::LayerId(inst)).unwrap();
+    let collapsed = r.collapsed(&ctx, layer).expect("the instance collapses");
+    let (_, nctx) = r.collapse_into(&ctx, layer, &collapsed, 1.0).expect("a nested context");
+    let src = nctx.comp.layer(effectcraft_project::LayerId(text)).unwrap();
+    match nctx.value(src, src.props.prop("text/sourceText").unwrap()) {
+        KV::Text(d) => assert_eq!((d.text.as_str(), d.font.as_str(), d.size), ("Bye", "Serif Test", 40.0)),
+        o => panic!("{o:?}"),
+    }
+}
diff --git a/crates/engine/src/tests/export_overwrite.rs b/crates/engine/src/tests/export_overwrite.rs
new file mode 100644
index 000000000..5cc65b1d5
--- /dev/null
+++ b/crates/engine/src/tests/export_overwrite.rs
@@ -0,0 +1,333 @@
+//! The commands that write to a path they are given leave a file the project reads alone (#1743,
+//! beyond the Render Queue): footage, a proxy, a frame of an imported image sequence and the
+//! project file are refused with nothing changed, and any other path is written. Save and Save As
+//! write the project's own file and are not among them.
+
+use std::sync::Arc;
+
+use effectcraft_project::{Footage, FootageKind, ItemId, Proxy};
+use serde_json::{Value, json};
+
+use super::render_overwrite::{Fixture, SOURCE};
+
+/// Footage that is a file named `path`.
+fn video(path: String) -> Footage {
+    Footage { path, kind: FootageKind::Video, has_video: true, ..Default::default() }
+}
+
+/// `item` gets the file `file` of the project's folder as its proxy.
+fn give_proxy(f: &mut Fixture, item: ItemId, file: &str) {
+    f.write(file, SOURCE);
+    let footage = video(f.text(file));
+    Arc::make_mut(&mut f.s.project).item_mut(item).unwrap().proxy = Some(Box::new(Proxy { footage, enabled: true }));
+}
+
+/// A project, saved as `Project.ecproj`, that reads `clip.<ext>` (footage) with `proxy.<ext>` as
+/// its proxy and the frames `shot_00000.<ext>` to `shot_00004.<ext>` of an image sequence, all
+/// holding `SOURCE`. Its composition `Main` holds a red solid.
+fn reading(name: &str, ext: &str) -> Fixture {
+    let mut f = Fixture::new(name);
+    let clip = f.footage(&format!("clip.{ext}"));
+    give_proxy(&mut f, clip, &format!("proxy.{ext}"));
+    f.sequence_as("shot", ext, 0..5);
+    f.comp("Main");
+    f.s.execute("layer.newSolid", json!({"name": "Red", "color": "#ff0000"})).unwrap();
+    f
+}
+
+/// The names in `dir`, sorted.
+fn listing(dir: &std::path::Path) -> Vec<String> {
+    let mut names: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    names
+}
+
+/// A command that writes to a path.
+struct Case {
+    command: &'static str,
+    /// The extension of a path for it.
+    ext: &'static str,
+    /// What it needs beyond a composition holding a solid.
+    setup: fn(&mut Fixture),
+    /// Its parameters for `path`.
+    params: fn(&str) -> Value,
+}
+
+fn nothing(_: &mut Fixture) {}
+
+/// The first layer of the active composition.
+fn first_layer(f: &Fixture) -> u64 {
+    f.s.active_comp().unwrap().layers[0].id.0
+}
+
+/// The composition shows one control, for `essential.exportTemplate`.
+fn expose_opacity(f: &mut Fixture) {
+    let layer = first_layer(f);
+    f.s.execute("essential.addProperty", json!({"layer": layer, "path": "transform/opacity"})).unwrap();
+}
+
+/// A property is selected, for `anim.savePreset`.
+fn select_opacity(f: &mut Fixture) {
+    let layer = first_layer(f);
+    f.s.execute("prop.select", json!({"layer": layer, "path": "transform/opacity"})).unwrap();
+}
+
+/// The composition has a guide, for `view.exportGuides`.
+fn add_guide(f: &mut Fixture) {
+    f.s.execute("view.addGuide", json!({"orientation": "vertical"})).unwrap();
+}
+
+/// Run `case` on every file the project reads: each is refused, the project's folder is as it was
+/// and nothing was rendered; then on a free path, where it writes.
+fn never_replaces_what_the_project_reads(case: &Case) {
+    let ext = case.ext;
+    let mut f = reading(&format!("{}-{ext}", case.command), ext);
+    (case.setup)(&mut f);
+    let mut reads = vec![(format!("clip.{ext}"), "footage"), (format!("proxy.{ext}"), "proxy"), (format!("shot_00002.{ext}"), "footage")];
+    // (A timeline export adds its extension to `Project.ecproj`: it has a test of its own.)
+    if case.command != "file.exportTimeline" {
+        reads.push(("Project.ecproj".to_string(), "project"));
+    }
+    let before: Vec<Vec<u8>> = reads.iter().map(|(file, _)| f.read(file)).collect();
+    let listed = listing(&f.dir);
+    for ((file, source), bytes) in reads.iter().zip(&before) {
+        let path = f.text(file);
+        let e = f.s.execute(case.command, (case.params)(&path)).expect_err(&format!("{} wrote over {file}", case.command)).to_string();
+        assert!(e.contains(file.as_str()) && e.contains(source), "{}: {file}: {e}", case.command);
+        assert_eq!(&f.read(file), bytes, "{}: {file} is as it was", case.command);
+    }
+    assert_eq!(listing(&f.dir), listed, "{}: refusing changed nothing in the folder", case.command);
+    assert!(f.exported().is_empty(), "{}: nothing was rendered for it", case.command);
+
+    let free = format!("out.{ext}");
+    f.s.execute(case.command, (case.params)(&f.text(&free))).unwrap_or_else(|e| panic!("{}: {e}", case.command));
+    assert_ne!(f.read(&free), SOURCE, "{}: wrote its file", case.command);
+    for ((file, _), bytes) in reads.iter().zip(&before) {
+        assert_eq!(&f.read(file), bytes, "{}: {file} is still as it was", case.command);
+    }
+}
+
+macro_rules! never_replaces {
+    ($name:ident, $command:literal, $ext:literal, $setup:expr) => {
+        #[test]
+        fn $name() {
+            never_replaces_what_the_project_reads(&Case { command: $command, ext: $ext, setup: $setup, params: |path| json!({"path": path}) });
+        }
+    };
+}
+
+never_replaces!(save_frame_as_png, "comp.saveFrameAs", "png", nothing);
+never_replaces!(save_frame_as_photoshop_layers, "comp.saveFrameAsPsd", "psd", nothing);
+never_replaces!(save_frame_as_proexr, "comp.saveFrameAsExr", "exr", nothing);
+never_replaces!(export_lottie_json, "file.exportLottie", "json", nothing);
+never_replaces!(export_lottie_dotlottie, "file.exportLottie", "lottie", nothing);
+never_replaces!(save_a_copy, "file.saveCopy", "ecproj", nothing);
+never_replaces!(save_a_copy_as_xml, "file.saveCopyAsXml", "ecprojx", nothing);
+never_replaces!(export_timeline, "file.exportTimeline", "xml", nothing);
+never_replaces!(export_template, "essential.exportTemplate", "ectemplate", expose_opacity);
+never_replaces!(save_animation_preset, "anim.savePreset", "ecpreset", select_opacity);
+never_replaces!(export_guides, "view.exportGuides", "json", add_guide);
+never_replaces!(export_shortcuts, "shortcuts.export", "json", nothing);
+
+// ---------------------------------------------------------------- Collect Files
+
+/// A project reading the footage `in/<file>`, with an empty `out/(Footage)` where Collect Files
+/// would put its copy.
+fn collecting(name: &str, file: &str) -> Fixture {
+    let mut f = Fixture::new(name);
+    std::fs::create_dir_all(f.path("in")).unwrap();
+    std::fs::create_dir_all(f.path("out/(Footage)")).unwrap();
+    f.footage(&format!("in/{file}"));
+    f
+}
+
+/// Collect Files into the project folder's `out`.
+fn collect(f: &mut Fixture) -> crate::Result<Value> {
+    let folder = f.text("out");
+    f.s.execute("file.collectFiles", json!({"folder": folder}))
+}
+
+/// `there`, the place the copy of the footage `in/<original>` would go, is something the project
+/// reads (`source`): Collect Files is refused before it copies or writes anything.
+fn collect_is_refused(mut f: Fixture, original: &str, there: &str, source: &str) {
+    f.write(there, b"NOT TO BE REPLACED");
+    let listed = listing(&f.path("out/(Footage)"));
+    let e = collect(&mut f).unwrap_err().to_string();
+    assert!(e.contains(original) && e.contains(source), "{e}");
+    assert_eq!(f.read(there), b"NOT TO BE REPLACED", "the file the project reads is as it was");
+    assert_eq!(f.read(&format!("in/{original}")), SOURCE, "the original is as it was");
+    assert!(!f.path("out/Project.ecproj").exists(), "the collected project was not written");
+    assert_eq!(listing(&f.path("out/(Footage)")), listed, "nothing else was copied");
+}
+
+#[test]
+fn collect_files_does_not_copy_over_other_footage() {
+    let mut f = collecting("collect-footage", "a.mov");
+    f.footage("out/(Footage)/a.mov");
+    collect_is_refused(f, "a.mov", "out/(Footage)/a.mov", "footage");
+}
+
+#[test]
+fn collect_files_does_not_copy_over_a_proxy() {
+    let mut f = collecting("collect-proxy", "a.mov");
+    let a = f.s.project.items.keys().next().copied().unwrap();
+    give_proxy(&mut f, a, "out/(Footage)/a.mov");
+    collect_is_refused(f, "a.mov", "out/(Footage)/a.mov", "proxy");
+}
+
+#[test]
+fn collect_files_does_not_copy_over_a_sequence_frame() {
+    let mut f = collecting("collect-frame", "shot_00002.png");
+    f.sequence_as("out/(Footage)/shot", "png", 0..5);
+    collect_is_refused(f, "shot_00002.png", "out/(Footage)/shot_00002.png", "footage");
+}
+
+/// Collecting into the project's own folder would write the collected copy over the project.
+#[test]
+fn collect_files_does_not_write_over_the_project_file() {
+    let mut f = collecting("collect-project", "a.mov");
+    let project = f.read("Project.ecproj");
+    let folder = f.dir.to_string_lossy().into_owned();
+    let e = f.s.execute("file.collectFiles", json!({"folder": folder})).unwrap_err().to_string();
+    assert!(e.contains("Project.ecproj") && e.contains("project"), "{e}");
+    assert_eq!(f.read("Project.ecproj"), project, "the project file is as it was");
+    assert!(!f.path("(Footage)").exists(), "no folder was made, nothing was copied");
+}
+
+#[test]
+fn collect_files_copies_into_a_free_folder() {
+    let mut f = collecting("collect-free", "a.mov");
+    let r = collect(&mut f).unwrap();
+    assert_eq!((r["copied"].as_u64(), &r["errors"]), (Some(1), &json!([])), "{r}");
+    assert_eq!(f.read("out/(Footage)/a.mov"), SOURCE);
+    assert_eq!(f.read("in/a.mov"), SOURCE, "the original stays");
+    assert!(f.path("out/Project.ecproj").exists());
+}
+
+/// Footage that is where its copy would go is already collected: it is not copied onto itself.
+#[test]
+fn collect_files_leaves_footage_that_is_already_in_the_folder() {
+    let mut f = collecting("collect-in-place", "a.mov");
+    f.footage("out/(Footage)/c.mov");
+    f.write("out/(Footage)/c.mov", b"ALREADY COLLECTED");
+    let r = collect(&mut f).unwrap();
+    assert_eq!((r["copied"].as_u64(), &r["errors"]), (Some(2), &json!([])), "{r}");
+    assert_eq!(f.read("out/(Footage)/c.mov"), b"ALREADY COLLECTED");
+    assert_eq!(f.read("out/(Footage)/a.mov"), SOURCE);
+}
+
+// ---------------------------------------------------------------- the rest
+
+/// The movies a timeline export renders beside it are written like any other output.
+#[test]
+fn a_timeline_export_does_not_pre_render_over_footage() {
+    for background in [false, true] {
+        let mut f = Fixture::new(&format!("timeline-prerender-{background}"));
+        f.comp("Main");
+        f.s.execute("layer.newSolid", json!({"name": "Red", "color": "#ff0000"})).unwrap();
+        // OpenTimelineIO has no solids: the solid is rendered to a movie beside the document.
+        let params = json!({"path": f.text("Main.otio"), "prerender": "unsupported", "background": background});
+        let run = |s: &mut crate::Session, params: Value| {
+            let result = s.execute("file.exportTimeline", params).unwrap();
+            if background {
+                assert!(result["job"].is_string(), "{result}");
+                s.wait_jobs();
+                let done = s.job_log.last().unwrap();
+                assert_eq!(done.status, "done", "{}", done.message);
+                done.result.clone()
+            } else {
+                result
+            }
+        };
+        let r = run(&mut f.s, params.clone());
+        let movies = f.exported();
+        assert_eq!(movies.len(), 1, "{r}");
+        assert_eq!(r["prerendered"].as_array().map(Vec::len), Some(1), "{r}");
+        // That movie is footage now.
+        let movie = std::path::Path::new(&movies[0]).file_name().unwrap().to_string_lossy().into_owned();
+        f.footage(&movie);
+        let r = run(&mut f.s, params);
+        assert_eq!(f.read(&movie), SOURCE, "the footage is as it was");
+        assert_eq!(f.exported().len(), 1, "no second render was started");
+        assert_eq!(r["prerendered"], json!([]), "{r}");
+        let warnings = r["warnings"].as_array().unwrap().iter().filter_map(Value::as_str).collect::<Vec<_>>().join("\n");
+        assert!(warnings.contains(&movie) && warnings.contains("footage"), "the export says why: {r}");
+    }
+}
+
+/// `file.checkOutput` answers before anything is written. Its reply describes current state;
+/// callers still need a guarded write in the owning session, as CLI/MCP frame saves use.
+#[test]
+fn check_output_names_the_files_an_export_may_not_use() {
+    let mut f = reading("check-output", "png");
+    for (file, source) in [("clip.png", "footage"), ("proxy.png", "proxy"), ("shot_00003.png", "footage"), ("Project.ecproj", "project")] {
+        let r = f.s.execute("file.checkOutput", json!({"path": f.text(file)})).unwrap();
+        assert_eq!((r["blocked"].as_bool(), r["source"].as_str()), (Some(true), Some(source)), "{file}: {r}");
+        assert!(r["reason"].as_str().unwrap().contains(file), "{file}: {r}");
+        assert_eq!(r["path"], json!(f.text(file)), "{r}");
+    }
+    let r = f.s.execute("file.checkOutput", json!({"path": f.text("free.png")})).unwrap();
+    assert_eq!((r["blocked"].as_bool(), r["source"].is_null()), (Some(false), true), "{r}");
+    assert!(f.s.execute("file.checkOutput", json!({})).is_err(), "a path is needed");
+    assert!(!f.path("free.png").exists(), "it only looks");
+}
+
+/// A project saved under a timeline's name is not overwritten by the timeline.
+#[test]
+fn a_timeline_export_does_not_write_over_the_project_file() {
+    let mut f = Fixture::new("timeline-project");
+    f.comp("Main");
+    f.s.execute("file.saveAs", json!({"path": f.text("Edit.xml")})).unwrap();
+    let saved = f.read("Edit.xml");
+    let e = f.s.execute("file.exportTimeline", json!({"path": f.text("Edit.xml")})).unwrap_err().to_string();
+    assert!(e.contains("Edit.xml") && e.contains("project"), "{e}");
+    assert_eq!(f.read("Edit.xml"), saved);
+}
+
+#[test]
+fn a_background_timeline_export_rechecks_its_document_before_completion() {
+    let mut f = Fixture::new("timeline-current-project");
+    f.comp("Main");
+    let path = f.text("Pending.xml");
+    let job = f.s.execute("file.exportTimeline", json!({"path": path, "background": true, "prerender": "none"})).unwrap();
+    assert!(job["job"].is_string());
+    // The app may save the project while a background export is waiting to finish.
+    f.s.execute("file.saveAs", json!({"path": path})).unwrap();
+    let saved = f.read("Pending.xml");
+    f.s.wait_jobs();
+    let done = f.s.job_log.last().unwrap();
+    assert_eq!(done.status, "failed", "the destination became the project: {}", done.message);
+    assert!(done.message.contains("project"));
+    assert_eq!(f.read("Pending.xml"), saved);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn background_pre_render_movies_are_checked_again_before_publication() {
+    for source in ["footage", "project"] {
+        let mut f = Fixture::new(&format!("timeline-staged-{source}"));
+        f.comp("Main");
+        f.s.execute("layer.newSolid", json!({"name": "Red"})).unwrap();
+        let params = json!({"path": f.text("Main.otio"), "prerender": "unsupported"});
+        let first = f.s.execute("file.exportTimeline", params.clone()).unwrap();
+        let movie = first["prerendered"][0].as_str().unwrap().to_string();
+        let filename = std::path::Path::new(&movie).file_name().unwrap().to_string_lossy().into_owned();
+        let document = f.read("Main.otio");
+        let mut background = params;
+        background["background"] = json!(true);
+        f.s.execute("file.exportTimeline", background).unwrap();
+        if source == "footage" {
+            f.footage(&filename);
+        } else {
+            f.s.execute("file.saveAs", json!({"path": movie})).unwrap();
+        }
+        let protected = f.read(&filename);
+        f.s.wait_jobs();
+        let done = f.s.job_log.last().unwrap();
+        assert_eq!(done.status, "failed", "{}", done.message);
+        assert!(done.message.contains(source), "{}", done.message);
+        assert_eq!(f.read(&filename), protected);
+        assert_eq!(f.read("Main.otio"), document);
+        assert!(listing(&f.dir).iter().all(|name| !name.starts_with(".effectcraft-prerender-")));
+    }
+}
diff --git a/crates/engine/src/tests_face.rs b/crates/engine/src/tests/face.rs
similarity index 99%
rename from crates/engine/src/tests_face.rs
rename to crates/engine/src/tests/face.rs
index 9e713ff8b..2a45da98f 100644
--- a/crates/engine/src/tests_face.rs
+++ b/crates/engine/src/tests/face.rs
@@ -6,7 +6,7 @@ use effectcraft_track::face::{FaceParams, LANDMARKS, MEASUREMENTS, render_synthe
 use serde_json::json;
 
 use crate::mask_track::MaskMethod;
-use crate::tests_track::{H, W, frame_time, setup};
+use crate::tests::track::{H, W, frame_time, setup};
 
 fn face(f: u32) -> FaceParams {
     let t = f as f64;
diff --git a/crates/engine/src/tests_fidelity.rs b/crates/engine/src/tests/fidelity.rs
similarity index 93%
rename from crates/engine/src/tests_fidelity.rs
rename to crates/engine/src/tests/fidelity.rs
index ebe375601..4fd8a68b8 100644
--- a/crates/engine/src/tests_fidelity.rs
+++ b/crates/engine/src/tests/fidelity.rs
@@ -58,7 +58,8 @@ fn slip_moves_the_source_under_fixed_in_and_out() {
     let before = get(&s);
     assert_eq!((before.start_time, before.in_point.seconds(), before.out_point.seconds()), (Tick::ZERO, 1.0, 3.0));
     // Slip the source 0.5 s later: in/out stay, the source (start) moves.
-    s.execute("layer.slip", json!({"layers": [id], "delta": 0.5})).unwrap();
+    let r = s.execute("layer.slip", json!({"layers": [id], "delta": 0.5})).unwrap();
+    assert_eq!(r["slipped"][0]["clamped"], json!(false));
     let l = get(&s);
     assert_eq!((l.start_time.seconds(), l.in_point, l.out_point), (0.5, before.in_point, before.out_point));
     // The source time at comp 2 s is now 1.5 s.
@@ -67,6 +68,8 @@ fn slip_moves_the_source_under_fixed_in_and_out() {
     let r = s.execute("layer.slip", json!({"layers": [id], "delta": 5.0})).unwrap();
     assert_eq!(get(&s).start_time.seconds(), 1.0);
     assert_eq!(r["slipped"][0]["delta"], json!(0.5));
+    // The response says the 5 s asked for was cut short (#2371).
+    assert_eq!((r["requested"].clone(), r["slipped"][0]["clamped"].clone()), (json!(5.0), json!(true)));
     // Slip by a frame.
     s.execute("layer.slipBack", json!({"layers": [id]})).unwrap();
     assert!((get(&s).start_time.seconds() - (1.0 - 1.0 / 30.0)).abs() < 1e-9);
diff --git a/crates/engine/src/tests/frame_export.rs b/crates/engine/src/tests/frame_export.rs
new file mode 100644
index 000000000..e91e5716d
--- /dev/null
+++ b/crates/engine/src/tests/frame_export.rs
@@ -0,0 +1,385 @@
+//! Composition ▸ Save Frame As ▸ Photoshop Layers… / ProEXR…, and Copy Frame to Clipboard.
+
+use serde_json::json;
+
+use crate::Session;
+
+fn out_dir(name: &str) -> std::path::PathBuf {
+    let d = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out").join(name);
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+/// A 32×32 comp: a red full-frame solid under a 16×16 blue Multiply solid at 50%.
+fn frame() -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Frame", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Red", "color": "#ff0000"})).unwrap();
+    let blue = s.execute("layer.newSolid", json!({"name": "Blue.Box", "color": "#0000ff", "width": 16, "height": 16})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setBlendMode", json!({"layers": [blue], "mode": "Multiply"})).unwrap();
+    s.execute("prop.set", json!({"layer": blue, "path": "transform/opacity", "value": 50})).unwrap();
+    s
+}
+
+#[test]
+fn photoshop_layers_writes_one_psd_layer_per_comp_layer() {
+    let mut s = frame();
+    let dir = out_dir("frame-psd");
+    let path = dir.join("frame.psd").to_string_lossy().to_string();
+    let r = s.execute("comp.saveFrameAsPsd", json!({"path": path})).unwrap();
+    assert_eq!(r["layers"], 2);
+    let psd = effectcraft_psd::Psd::parse(std::fs::read(&path).unwrap()).unwrap();
+    assert_eq!((psd.width, psd.height), (32, 32));
+    let names: Vec<&str> = psd.layers.iter().map(|l| l.name.as_str()).collect();
+    assert_eq!(names, ["Red", "Blue.Box"], "bottom first");
+    let blue = &psd.layers[1];
+    assert_eq!(blue.blend_key(), "mul ");
+    assert_eq!(blue.opacity, 128);
+    // Cropped to its pixels (16×16, centred) and rendered at full opacity.
+    assert_eq!((blue.rect.left, blue.rect.top, blue.rect.width(), blue.rect.height()), (8, 8, 16, 16));
+    assert_eq!(psd.layers[0].blend_key(), "norm");
+    assert_eq!(psd.layers[0].opacity, 255);
+    // The merged image is the comp frame: red × (50% blue multiply) in the middle.
+    let m = psd.composite().unwrap();
+    let mid = m.data[16 * 32 + 16];
+    assert!(mid[0] > 0.4 && mid[0] < 0.6 && mid[2] < 0.05, "{mid:?}");
+    let corner = m.data[0];
+    assert!(corner[0] > 0.99 && corner[2] < 0.01, "{corner:?}");
+    // The menu has it.
+    assert!(crate::commands::find("comp.saveFrameAsPsd").is_some());
+}
+
+#[test]
+fn proexr_writes_layer_prefixed_channels_and_the_composite() {
+    use exr::prelude::*;
+    let mut s = frame();
+    let dir = out_dir("frame-exr");
+    let path = dir.join("frame.exr").to_string_lossy().to_string();
+    let r = s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+    let names: Vec<&str> = r["channels"].as_array().unwrap().iter().map(|c| c.as_str().unwrap()).collect();
+    assert_eq!(names.len(), 12);
+    assert!(names.contains(&"R") && names.contains(&"A") && names.contains(&"Red.R") && names.contains(&"Blue_Box.B"), "{names:?}");
+    let img = read().no_deep_data().largest_resolution_level().all_channels().all_layers().all_attributes().from_file(&path).unwrap();
+    let layer = &img.layer_data[0];
+    assert_eq!((layer.size.0, layer.size.1), (32, 32));
+    let ch = |n: &str| layer.channel_data.list.iter().find(|c| c.name.to_string() == n).unwrap_or_else(|| panic!("no channel {n}"));
+    let at = |n: &str, x: usize, y: usize| match &ch(n).sample_data {
+        FlatSamples::F32(v) => v[y * 32 + x],
+        o => panic!("{o:?}"),
+    };
+    // The blue layer alone: blue inside its box, transparent outside.
+    assert!((at("Blue_Box.B", 16, 16) - 1.0).abs() < 1e-3);
+    assert_eq!(at("Blue_Box.A", 0, 0), 0.0);
+    assert!((at("Red.R", 0, 0) - 1.0).abs() < 1e-3);
+    // Composite: opaque everywhere.
+    assert!((at("A", 16, 16) - 1.0).abs() < 1e-3);
+    assert!(at("R", 16, 16) < 0.5, "multiplied by 50% blue (linear)");
+}
+
+#[test]
+fn proexr_names_a_non_ascii_layer_with_underscores_instead_of_panicking() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Frame", "width": 8, "height": 8, "frameRate": 24, "duration": 1})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "你好", "color": "#ff0000"})).unwrap();
+    let dir = out_dir("frame-exr-non-ascii");
+    let path = dir.join("frame.exr").to_string_lossy().to_string();
+    let r = s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+    let names: Vec<&str> = r["channels"].as_array().unwrap().iter().map(|c| c.as_str().unwrap()).collect();
+    assert!(names.contains(&"__.R") && names.contains(&"__.A"), "{names:?}");
+    assert!(std::path::Path::new(&path).exists());
+}
+
+/// Save a 32×32 comp holding one opaque solid of `color` (an sRGB-encoded triple) as ProEXR and
+/// return the centre pixel of the composite and of the solid's own layer: `[R, G, B]` each.
+fn proexr_centre(color: [f64; 3], bit_depth: u64) -> ([f32; 3], [f32; 3]) {
+    use exr::prelude::*;
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Bright", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
+    s.execute("file.projectSettings", json!({"bitDepth": bit_depth})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bright", "color": color})).unwrap();
+    let dir = out_dir(&format!("frame-exr-over-{}", color[0]));
+    let path = dir.join(format!("frame{bit_depth}.exr")).to_string_lossy().to_string();
+    s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+    let img = read().no_deep_data().largest_resolution_level().all_channels().all_layers().all_attributes().from_file(&path).unwrap();
+    let layer = &img.layer_data[0];
+    let at = |n: &str| {
+        let c = layer.channel_data.list.iter().find(|c| c.name.to_string() == n).unwrap_or_else(|| panic!("no channel {n}"));
+        match &c.sample_data {
+            FlatSamples::F32(v) => v[16 * 32 + 16],
+            o => panic!("{o:?}"),
+        }
+    };
+    ([at("R"), at("G"), at("B")], [at("Bright.R"), at("Bright.G"), at("Bright.B")])
+}
+
+#[test]
+fn proexr_keeps_values_above_one_in_32_bpc() {
+    // Issue #339: over-range colour reaches the EXR in scene-linear light (sRGB decode, uncapped).
+    let src = [1.5, 1.25, 0.75];
+    let (comp, layer) = proexr_centre(src, 32);
+    for i in 0..3 {
+        let want = effectcraft_color::srgb_to_linear(src[i] as f32);
+        for got in [comp[i], layer[i]] {
+            assert!((got - want).abs() < 1e-3 * want.max(1.0), "channel {i}: got {got}, want {want} ({comp:?} / {layer:?})");
+        }
+    }
+    assert!(comp[0] > 1.5 && comp[1] > 1.25, "{comp:?}");
+}
+
+#[test]
+fn proexr_values_at_or_below_one_are_unchanged() {
+    let (comp, layer) = proexr_centre([1.0, 0.4, 0.0], 32);
+    for got in [comp, layer] {
+        assert!((got[0] - 1.0).abs() < 1e-4 && (got[1] - 0.1329).abs() < 1e-3 && got[2].abs() < 1e-6, "{got:?}");
+    }
+}
+
+/// Composition ▸ Copy Frame to Clipboard (After Effects 26.3): the frame, as Save Frame As
+/// renders it, goes to the frontend as an image for the system clipboard.
+#[test]
+fn copy_frame_hands_the_rendered_frame_to_the_frontend() {
+    let mut s = frame();
+    s.drain_events();
+    let r = s.execute("comp.copyFrame", json!({})).unwrap();
+    assert_eq!((r["width"].as_u64(), r["height"].as_u64()), (Some(32), Some(32)));
+    let events = s.drain_events();
+    let Some((width, height, rgba)) = events.iter().find_map(|e| match e {
+        crate::Event::CopyImage { width, height, rgba } => Some((*width, *height, rgba)),
+        _ => None,
+    }) else {
+        panic!("no CopyImage event in {events:?}")
+    };
+    assert_eq!((width, height, rgba.len()), (32, 32, 32 * 32 * 4));
+    // Red in the corner; red × (50% blue multiply) in the middle; opaque everywhere.
+    assert_eq!(&rgba[..4], &[255, 0, 0, 255]);
+    let mid = &rgba[(16 * 32 + 16) * 4..][..4];
+    assert!(mid[0] > 100 && mid[0] < 160 && mid[2] < 13 && mid[3] == 255, "{mid:?}");
+    assert!(rgba.chunks(4).all(|p| p[3] == 255));
+    // The pixels are not serialized into the event stream.
+    let json = serde_json::to_value(events.iter().find(|e| matches!(e, crate::Event::CopyImage { .. })).unwrap()).unwrap();
+    assert!(json["CopyImage"].get("rgba").is_none(), "{json}");
+    // Scaled, and refused without a composition.
+    assert_eq!(s.execute("comp.copyFrame", json!({"scale": 0.5})).unwrap()["width"], 16);
+    assert!(Session::default().execute("comp.copyFrame", json!({})).is_err());
+    assert!(crate::menus::entries().iter().any(|(path, e)| e.command == "comp.copyFrame" && path.first().map(String::as_str) == Some("Composition")));
+}
+
+#[test]
+fn save_frame_as_png_preserves_alpha_channel() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "AlphaComp", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
+    let red = s.execute("layer.newSolid", json!({"name": "Red", "color": "#ff0000", "width": 16, "height": 16})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": red, "path": "transform/position", "value": [8, 8, 0]})).unwrap();
+    let dir = out_dir("frame-png-alpha");
+    let path = dir.join("alpha.png").to_string_lossy().to_string();
+
+    s.execute("comp.saveFrameAs", json!({"path": path})).unwrap();
+    let img = image::load_from_memory(&std::fs::read(&path).unwrap()).unwrap().to_rgba8();
+    assert_eq!((img.width(), img.height()), (32, 32));
+    let solid_px = img.get_pixel(8, 8);
+    assert_eq!(solid_px[3], 255, "solid region must be opaque: {solid_px:?}");
+    assert_eq!(solid_px[0], 255);
+    let empty_px = img.get_pixel(24, 24);
+    assert_eq!(empty_px[3], 0, "outside solid region must have alpha 0: {empty_px:?}");
+
+    let flat_path = dir.join("flat.png").to_string_lossy().to_string();
+    s.execute_checked("comp.saveFrameAs", json!({"path": flat_path, "transparent": false})).unwrap();
+    let flat_img = image::load_from_memory(&std::fs::read(&flat_path).unwrap()).unwrap().to_rgba8();
+    let flat_empty_px = flat_img.get_pixel(24, 24);
+    assert_eq!(flat_empty_px[3], 255, "transparent: false must composite over background: {flat_empty_px:?}");
+}
+
+#[test]
+fn save_frame_as_queued_respects_frame_default_template() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Comp", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
+
+    // Default Still template is "PNG Sequence" (Channels::Rgb)
+    let r = s.execute_checked("comp.saveFrameAs", json!({"queue": true})).unwrap();
+    assert_eq!(r["queued"], true);
+    let it = s.project.render_queue.last().unwrap();
+    assert_eq!(it.output.name, "PNG Sequence");
+    assert_eq!(it.output.channels, effectcraft_project::render_queue::Channels::Rgb);
+
+    // Test undo and redo of queuing a frame
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.project.render_queue.is_empty());
+    s.execute("edit.redo", json!({})).unwrap();
+    let it = s.project.render_queue.last().unwrap();
+    assert_eq!(it.output.name, "PNG Sequence");
+
+    // Explicit transparent: false forces Channels::Rgb
+    s.execute_checked("comp.saveFrameAs", json!({"queue": true, "transparent": false})).unwrap();
+    let it = s.project.render_queue.last().unwrap();
+    assert_eq!(it.output.channels, effectcraft_project::render_queue::Channels::Rgb);
+
+    // When Frame Default is set to an RGBA template, it is respected
+    s.execute_checked("renderQueue.setTemplateDefault", json!({"kind": "outputModule", "slot": "still", "name": "PNG Sequence with Alpha"})).unwrap();
+    s.execute_checked("comp.saveFrameAs", json!({"queue": true})).unwrap();
+    let it = s.project.render_queue.last().unwrap();
+    assert_eq!(it.output.name, "PNG Sequence with Alpha");
+    assert_eq!(it.output.channels, effectcraft_project::render_queue::Channels::Rgba);
+
+    // Passing transparent: false forces Channels::Rgb even with an RGBA template
+    s.execute_checked("comp.saveFrameAs", json!({"queue": true, "transparent": false})).unwrap();
+    let it = s.project.render_queue.last().unwrap();
+    assert_eq!(it.output.channels, effectcraft_project::render_queue::Channels::Rgb);
+
+    // With JPEG Sequence as Frame Default (non-alpha format), queue succeeds without error
+    s.execute_checked("renderQueue.setTemplateDefault", json!({"kind": "outputModule", "slot": "still", "name": "JPEG Sequence"})).unwrap();
+    assert!(s.execute_checked("comp.saveFrameAs", json!({"queue": true})).is_ok());
+}
+
+fn fnv(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf2_9ce4_8422_2325u64, |h, b| (h ^ *b as u64).wrapping_mul(0x0100_0000_01b3))
+}
+
+/// A 32×32 comp in a managed project (sRGB working space, linearized): a full-frame over-range
+/// solid under a 16×16 in-range Multiply solid at 50%.
+fn hdr_frame(bit_depth: u64, hdr: &str) -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Frame", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
+    s.execute("file.projectSettings", json!({"bitDepth": bit_depth, "workingSpace": "srgb", "linearize": true, "hdr": hdr})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bright", "color": [4.0, 2.0, 0.5]})).unwrap();
+    let box_ = s.execute("layer.newSolid", json!({"name": "Box", "color": [0.85, 0.9, 0.2], "width": 16, "height": 16})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setBlendMode", json!({"layers": [box_], "mode": "Multiply"})).unwrap();
+    s.execute("prop.set", json!({"layer": box_, "path": "transform/opacity", "value": 50})).unwrap();
+    s
+}
+
+/// Photoshop Layers keeps the HDR step (it is a display-referred output): its bytes for each bit
+/// depth × HDR mode.
+#[test]
+fn photoshop_layers_bytes_are_unchanged() {
+    let dir = out_dir("frame-psd-golden");
+    let mut got = vec![];
+    for depth in [8, 16, 32] {
+        for hdr in ["clip", "compand", "toneMap"] {
+            let mut s = hdr_frame(depth, hdr);
+            let path = dir.join(format!("{depth}-{hdr}.psd")).to_string_lossy().to_string();
+            s.execute("comp.saveFrameAsPsd", json!({"path": path})).unwrap();
+            got.push(fnv(&std::fs::read(&path).unwrap()));
+        }
+    }
+    // The hashes before ProEXR skipped the HDR step.
+    let want: [u64; 9] = [
+        0x3b921d4d9fc3119f,
+        0x1886d026edf36a7f,
+        0x6b564aa7fb50139f,
+        0xabd585992079fc9f,
+        0x88ca38726eaa557f,
+        0xa3636606d7a4927f,
+        0x7385ed211e9815ff,
+        0x7385ed211e9815ff,
+        0xfb59fa3f3bdfac3f,
+    ];
+    assert_eq!(got, want);
+}
+
+/// Every sample of a ProEXR file, channels in name order.
+fn proexr_samples(path: &str) -> Vec<(String, Vec<f32>)> {
+    use exr::prelude::*;
+    let img = read().no_deep_data().largest_resolution_level().all_channels().all_layers().all_attributes().from_file(path).unwrap();
+    let mut out: Vec<(String, Vec<f32>)> = img.layer_data[0]
+        .channel_data
+        .list
+        .iter()
+        .map(|c| match &c.sample_data {
+            FlatSamples::F32(v) => (c.name.to_string(), v.clone()),
+            o => panic!("{o:?}"),
+        })
+        .collect();
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+/// ProEXR decodes with the output space's own curve. A Rec. 709 output has the sRGB working
+/// space's primaries but another curve, so the composite and the isolated layer must hold the
+/// solid's light (its sRGB working value decoded), not the sRGB decode of its Rec. 709 encoding.
+#[test]
+fn proexr_decodes_a_non_srgb_output_curve() {
+    let dir = out_dir("frame-exr-rec709");
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Frame", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
+    s.execute("file.projectSettings", json!({"bitDepth": 32, "workingSpace": "srgb", "linearize": true, "outputSpace": "rec709"})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Warm", "color": [0.8, 0.5, 0.2]})).unwrap();
+    let path = dir.join("rec709.exr").to_string_lossy().to_string();
+    s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+    let got = proexr_samples(&path);
+    let at = |n: &str| got.iter().find(|c| c.0 == n).unwrap_or_else(|| panic!("no {n}")).1[0];
+    let lin = effectcraft_color::srgb_to_linear;
+    for (n, want) in [("R", lin(0.8)), ("G", lin(0.5)), ("B", lin(0.2)), ("Warm.R", lin(0.8)), ("Warm.B", lin(0.2))] {
+        assert!((at(n) - want).abs() <= 1e-3 * want, "{n}: {} vs {want}", at(n));
+    }
+}
+
+/// ProEXR samples in Clip mode (sRGB output) for each bit depth.
+#[test]
+fn proexr_clip_samples_are_unchanged() {
+    let dir = out_dir("frame-exr-clip-golden");
+    let mut got = vec![];
+    for depth in [8, 16, 32] {
+        let mut s = hdr_frame(depth, "clip");
+        let path = dir.join(format!("{depth}.exr")).to_string_lossy().to_string();
+        s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+        let bytes: Vec<u8> =
+            proexr_samples(&path).iter().flat_map(|(n, v)| n.bytes().chain(v.iter().flat_map(|x| x.to_bits().to_le_bytes())).collect::<Vec<u8>>()).collect();
+        got.push(fnv(&bytes));
+    }
+    // The hashes before ProEXR skipped the HDR step.
+    let want: [u64; 3] = [0x4b9ecc87e6db7d03, 0xe06a35d302e71503, 0x694ca552f3efc903];
+    assert_eq!(got, want);
+}
+
+/// ProEXR ignores compand and tone mapping: the composite and every isolated layer hold the Clip
+/// mode's samples, and over-range values stay.
+#[test]
+fn proexr_layers_are_not_tone_mapped() {
+    let dir = out_dir("frame-exr-hdr");
+    let samples = |depth: u64, hdr: &str| {
+        let mut s = hdr_frame(depth, hdr);
+        let path = dir.join(format!("{depth}-{hdr}.exr")).to_string_lossy().to_string();
+        s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+        proexr_samples(&path)
+    };
+    for depth in [8, 16, 32] {
+        let clip = samples(depth, "clip");
+        assert!(clip.iter().any(|(n, _)| n == "Bright.R") && clip.iter().any(|(n, _)| n == "Box.R"), "{:?}", clip.iter().map(|c| &c.0).collect::<Vec<_>>());
+        for hdr in ["compand", "toneMap"] {
+            assert!(samples(depth, hdr) == clip, "{depth} bpc {hdr}");
+        }
+    }
+    let tone = samples(32, "toneMap");
+    let at = |n: &str| tone.iter().find(|c| c.0 == n).unwrap().1[0];
+    // The solid's colour is sRGB-encoded in the working space (4.0 is about 25.3 in linear light).
+    let lin = effectcraft_color::srgb_to_linear;
+    for (n, want) in [("Bright.R", lin(4.0)), ("Bright.G", lin(2.0)), ("Bright.B", lin(0.5)), ("R", lin(4.0))] {
+        assert!((at(n) - want).abs() <= 1e-4 * want, "{n}: {} vs {want}", at(n));
+    }
+}
+
+/// The `chromaticities` attribute of the ProEXR file `path`: red, green, blue, white (CIE xy).
+fn proexr_chromaticities(s: &mut Session, name: &str) -> Option<[[f32; 2]; 4]> {
+    let path = out_dir(name).join("frame.exr").to_string_lossy().to_string();
+    s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
+    let meta = exr::meta::MetaData::read_from_buffered(std::io::BufReader::new(std::fs::File::open(&path).unwrap()), false).unwrap();
+    meta.headers[0].shared_attributes.chromaticities.map(|c| [c.red, c.green, c.blue, c.white].map(|v| [v.0, v.1]))
+}
+
+/// ProEXR names the primaries and white of the output space (default: Rec. 709 / sRGB).
+#[test]
+fn proexr_writes_the_output_spaces_chromaticities() {
+    let d65 = [0.3127, 0.3290];
+    let mut s = frame();
+    assert_eq!(proexr_chromaticities(&mut s, "frame-exr-chroma-default"), Some([[0.64, 0.33], [0.30, 0.60], [0.15, 0.06], d65]));
+    s.execute("file.projectSettings", json!({"workingSpace": "srgb", "outputSpace": "p3"})).unwrap();
+    assert_eq!(proexr_chromaticities(&mut s, "frame-exr-chroma-p3"), Some([[0.680, 0.320], [0.265, 0.690], [0.150, 0.060], d65]));
+    s.execute("file.projectSettings", json!({"outputSpace": "rec2020"})).unwrap();
+    assert_eq!(proexr_chromaticities(&mut s, "frame-exr-chroma-2020"), Some([[0.708, 0.292], [0.170, 0.797], [0.131, 0.046], d65]));
+    s.execute("file.projectSettings", json!({"outputSpace": "rec2100pq"})).unwrap();
+    assert_eq!(proexr_chromaticities(&mut s, "frame-exr-chroma-pq"), Some([[0.708, 0.292], [0.170, 0.797], [0.131, 0.046], d65]));
+    // Unmanaged: the output space is ignored, the Working Gamma's curve (Rec. 709 primaries) decodes.
+    s.execute("file.projectSettings", json!({"workingSpace": "none", "outputSpace": "p3"})).unwrap();
+    assert_eq!(proexr_chromaticities(&mut s, "frame-exr-chroma-unmanaged"), Some([[0.64, 0.33], [0.30, 0.60], [0.15, 0.06], d65]));
+}
diff --git a/crates/engine/src/tests_fuzz_open.rs b/crates/engine/src/tests/fuzz_open.rs
similarity index 100%
rename from crates/engine/src/tests_fuzz_open.rs
rename to crates/engine/src/tests/fuzz_open.rs
diff --git a/crates/engine/src/tests_history.rs b/crates/engine/src/tests/history.rs
similarity index 100%
rename from crates/engine/src/tests_history.rs
rename to crates/engine/src/tests/history.rs
diff --git a/crates/engine/src/tests_import_project.rs b/crates/engine/src/tests/import_project.rs
similarity index 100%
rename from crates/engine/src/tests_import_project.rs
rename to crates/engine/src/tests/import_project.rs
diff --git a/crates/engine/src/tests/instance3d.rs b/crates/engine/src/tests/instance3d.rs
new file mode 100644
index 000000000..48f4b7730
--- /dev/null
+++ b/crates/engine/src/tests/instance3d.rs
@@ -0,0 +1,257 @@
+//! Create 3D Layer Instance (Layer ▸ Create): a comp-sized solid at the top of the layer stack
+//! with a 3D Layer Instance effect referencing the selected 3D model layer — a 2D copy of its
+//! render that 2D effects can be applied to (behaviour, pixels, undo/redo, serde).
+
+use std::sync::Arc;
+
+use effectcraft_keyframe::Value as KV;
+use effectcraft_project::{Footage, FootageKind, GroupKind, ItemId, Layer, LayerId, Project};
+use effectcraft_render::{FootageSource, RenderOpts};
+use effectcraft_time::{FrameRate, Tick};
+use serde_json::json;
+
+use crate::{Importer, Session};
+
+fn session() -> Session {
+    let mut s = Session { footage: Arc::new(DiskModels), importer: Some(Arc::new(ModelImporter)), ..Default::default() };
+    s.execute("comp.new", json!({"name": "Scene", "width": 640, "height": 360, "frameRate": 30, "duration": 2})).unwrap();
+    s
+}
+
+fn cid(s: &Session) -> ItemId {
+    s.active_comp_id().unwrap()
+}
+
+fn layer_in(s: &Session, comp: ItemId, id: u64) -> Layer {
+    s.project.comp(comp).unwrap().layer(LayerId(id)).unwrap().clone()
+}
+
+fn px(img: &effectcraft_raster::Image, x: u32, y: u32) -> [f32; 4] {
+    img.data[(y * img.width + x) as usize]
+}
+
+fn close(a: &effectcraft_raster::Image, b: &effectcraft_raster::Image, tol: f32) -> bool {
+    a.data.iter().zip(b.data.iter()).all(|(p, q)| p.iter().zip(q.iter()).all(|(x, y)| (x - y).abs() <= tol))
+}
+
+struct DiskModels;
+
+impl FootageSource for DiskModels {
+    fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<effectcraft_raster::Image>> {
+        None
+    }
+    fn model(&self, _: ItemId, f: &Footage) -> Option<Arc<effectcraft_model::Model>> {
+        let bytes = std::fs::read(&f.path).ok()?;
+        effectcraft_model::load(&f.path, &bytes, &|_| None).ok().map(Arc::new)
+    }
+}
+
+struct ModelImporter;
+
+impl Importer for ModelImporter {
+    fn probe(&self, path: &str) -> Result<Footage, String> {
+        effectcraft_model::format_of(path).ok_or("not a model")?;
+        Ok(Footage { path: path.into(), kind: FootageKind::Model, frame_rate: FrameRate::FPS_30, codec: "glTF".into(), ..Default::default() })
+    }
+}
+
+/// A red triangle in the Z = 0 plane (buffer embedded as a data URI).
+const TRIANGLE: &str = r#"{
+  "asset": {"version": "2.0"},
+  "scenes": [{"nodes": [0]}],
+  "nodes": [{"mesh": 0}],
+  "meshes": [{"primitives": [{"attributes": {"POSITION": 0, "NORMAL": 1}, "material": 0}]}],
+  "materials": [{"pbrMetallicRoughness": {"baseColorFactor": [1.0, 0.0, 0.0, 1.0]}}],
+  "buffers": [{"byteLength": 72, "uri": "data:application/octet-stream;base64,AACAvwAAgL8AAAAAAACAPwAAgL8AAAAAAAAAAAAAgD8AAAAAAAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/"}],
+  "bufferViews": [
+    {"buffer": 0, "byteOffset": 0, "byteLength": 36},
+    {"buffer": 0, "byteOffset": 36, "byteLength": 36}
+  ],
+  "accessors": [
+    {"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": 3, "min": [-1.0, -1.0, 0.0], "max": [1.0, 1.0, 0.0]},
+    {"bufferView": 1, "componentType": 5126, "type": "VEC3", "count": 3}
+  ]
+}"#;
+
+fn triangle_model(s: &mut Session) -> u64 {
+    let dir = std::env::temp_dir().join(format!("ec-instance3d-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("Triangle.gltf");
+    std::fs::write(&path, TRIANGLE).unwrap();
+    s.execute("layer.newModel", json!({"path": path.to_string_lossy(), "name": "Triangle"})).unwrap()["layer"].as_u64().unwrap()
+}
+
+#[test]
+fn instance3d_creates_a_2d_copy_of_the_model() {
+    let mut s = session();
+    let model = triangle_model(&mut s);
+    // The model renders through the comp's camera.
+    let before = s.render(cid(&s), Tick::ZERO, RenderOpts::default());
+    assert!(px(&before, 320, 180)[3] > 0.9, "the model covers the centre: {:?}", px(&before, 320, 180));
+    assert!(px(&before, 4, 4)[3] < 0.1, "the comp is transparent around it: {:?}", px(&before, 4, 4));
+    // Create 3D Layer Instance.
+    s.execute("layer.select", json!({"layers": [model]})).unwrap();
+    let r = s.execute("layer.create", json!({"op": "instance3d"})).unwrap();
+    let solid = r["layers"][0].as_u64().unwrap();
+    let comp = cid(&s);
+    let l = layer_in(&s, comp, solid);
+    assert_eq!(l.name, "Triangle Instance");
+    assert_eq!(s.active_comp().unwrap().layers[0].id.0, solid, "at the top of the layer stack");
+    // A 3D Layer Instance effect referencing the 3D layer.
+    let g = l.effects().unwrap().groups().next().unwrap().clone();
+    assert!(matches!(&g.kind, GroupKind::Effect { effect } if effect == "ec.3d.instance3d"), "{:?}", g.kind);
+    assert_eq!(g.get("layer").unwrap().value, KV::Layer(Some(model)));
+    // The model is switched off, the copy selected.
+    assert!(!layer_in(&s, comp, model).switches.video, "the referenced 3D layer is off, as After Effects does");
+    assert_eq!(s.state.selected_layers, vec![LayerId(solid)]);
+    // The comp renders the same through the copy: a 2D copy of the 3D layer, transparent
+    // around it.
+    let after = s.render(comp, Tick::ZERO, RenderOpts::default());
+    assert!(close(&before, &after, 2e-2), "the copy shows the model:\n{:?}\n{:?}", px(&before, 320, 180), px(&after, 320, 180));
+    assert!(px(&after, 320, 180)[3] > 0.9 && px(&after, 4, 4)[3] < 0.1, "{:?} {:?}", px(&after, 320, 180), px(&after, 4, 4));
+    // Undo removes the copy and switches the model back on; redo returns it.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.active_comp().unwrap().layer(LayerId(solid)).is_none());
+    assert!(layer_in(&s, comp, model).switches.video);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert!(s.active_comp().unwrap().layer(LayerId(solid)).is_some());
+    assert!(!layer_in(&s, comp, model).switches.video);
+    // Serde round-trips the layer parameter.
+    let j = serde_json::to_string(&*s.project).unwrap();
+    let back: Project = serde_json::from_str(&j).unwrap();
+    assert_eq!(back, *s.project);
+    // 2D effects can be applied to the copy (the model layer itself takes none): Fill in blue
+    // recolours the triangle.
+    s.execute("effect.apply", json!({"layer": solid, "effect": "ec.generate.fill"})).unwrap();
+    s.execute("prop.set", json!({"layer": solid, "path": "effects/#2/color", "value": [0.0, 0.0, 1.0, 1.0]})).unwrap();
+    let with_fx = s.render(comp, Tick::ZERO, RenderOpts::default());
+    let p = px(&with_fx, 320, 180);
+    assert!(p[2] > 0.9 && p[0] < 0.1, "the fill recolours the copy: {p:?}");
+}
+
+#[test]
+fn instance3d_also_takes_3d_primitives() {
+    let mut s = session();
+    let prim = s.execute("layer.new3dPrimitive", json!({"kind": "cube", "width": 200, "height": 200, "depth": 200})).unwrap()["layer"].as_u64().unwrap();
+    let before = s.render(cid(&s), Tick::ZERO, RenderOpts::default());
+    let r = s.execute("layer.create", json!({"op": "instance3d", "layers": [prim]})).unwrap();
+    let solid = r["layers"][0].as_u64().unwrap();
+    let l = layer_in(&s, cid(&s), solid);
+    assert_eq!(l.name, "Cube Instance");
+    assert!(!layer_in(&s, cid(&s), prim).switches.video);
+    let after = s.render(cid(&s), Tick::ZERO, RenderOpts::default());
+    assert!(close(&before, &after, 2e-2), "the copy shows the cube");
+}
+
+#[test]
+fn instance3d_needs_a_3d_layer() {
+    let mut s = session();
+    let solid = s.execute("layer.newSolid", json!({"color": "#808080", "width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    let err = s.execute_checked("layer.create", json!({"op": "instance3d", "layers": [solid]}));
+    assert!(err.is_err());
+    let text = s.execute("layer.newText", json!({"text": "hi"})).unwrap()["layer"].as_u64().unwrap();
+    assert!(s.execute_checked("layer.create", json!({"op": "instance3d", "layers": [text]})).is_err());
+    // A 3D-switched text layer is not a model layer either (it has 2D pixels of its own).
+    s.execute("layer.setSwitch", json!({"layers": [text], "switch": "threeD", "value": true})).unwrap();
+    assert!(s.execute_checked("layer.create", json!({"op": "instance3d", "layers": [text]})).is_err());
+}
+
+#[test]
+fn instance3d_creates_every_selected_copy_in_one_undo() {
+    let mut s = session();
+    let a = s.execute("layer.new3dPrimitive", json!({"kind": "cube", "width": 120, "height": 120, "depth": 120})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.new3dPrimitive", json!({"kind": "cube", "width": 120, "height": 120, "depth": 120})).unwrap()["layer"].as_u64().unwrap();
+    let r = s.execute("layer.create", json!({"op": "instance3d", "layers": [a, b]})).unwrap();
+    let copies = r["layers"].as_array().unwrap();
+    assert_eq!(copies.len(), 2);
+    let (ia, ib) = (copies[0].as_u64().unwrap(), copies[1].as_u64().unwrap());
+    let comp = cid(&s);
+    assert_ne!(ia, ib);
+    assert_ne!(layer_in(&s, comp, ia).name, layer_in(&s, comp, ib).name, "each copy has a name of its own");
+    // Both sources are off, both copies selected, above their sources in the stack.
+    assert!(!layer_in(&s, comp, a).switches.video && !layer_in(&s, comp, b).switches.video);
+    let mut sel = s.state.selected_layers.clone();
+    let mut want = vec![LayerId(ia), LayerId(ib)];
+    sel.sort_by_key(|l| l.0);
+    want.sort_by_key(|l| l.0);
+    assert_eq!(sel, want);
+    let c = s.active_comp().unwrap();
+    let pos = |id: u64| c.layers.iter().position(|l| l.id.0 == id).unwrap();
+    assert!(pos(ia) < pos(a) && pos(ib) < pos(b), "the copies sit above their sources");
+    // One undo removes both copies and switches both models back on; one redo returns them.
+    s.execute("edit.undo", json!({})).unwrap();
+    let c = s.active_comp().unwrap();
+    assert!(c.layer(LayerId(ia)).is_none() && c.layer(LayerId(ib)).is_none(), "one undo removes every instance");
+    assert!(layer_in(&s, comp, a).switches.video && layer_in(&s, comp, b).switches.video);
+    s.execute("edit.redo", json!({})).unwrap();
+    let c = s.active_comp().unwrap();
+    assert!(c.layer(LayerId(ia)).is_some() && c.layer(LayerId(ib)).is_some(), "one redo returns every instance");
+    assert!(!layer_in(&s, comp, a).switches.video && !layer_in(&s, comp, b).switches.video);
+}
+
+#[test]
+fn instance3d_in_a_mixed_selection_only_takes_the_models() {
+    let mut s = session();
+    let model = triangle_model(&mut s);
+    let solid = s.execute("layer.newSolid", json!({"color": "#808080", "width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    let r = s.execute("layer.create", json!({"op": "instance3d", "layers": [model, solid]})).unwrap();
+    let copies = r["layers"].as_array().unwrap();
+    assert_eq!(copies.len(), 1, "only the model gets a copy: {r}");
+    let copy = copies[0].as_u64().unwrap();
+    let comp = cid(&s);
+    assert!(!layer_in(&s, comp, model).switches.video, "the model is switched off");
+    assert!(layer_in(&s, comp, solid).switches.video, "the plain solid is untouched");
+    let skipped = r["skipped"].as_array().unwrap();
+    assert_eq!(skipped.len(), 1);
+    assert!(skipped[0].as_str().unwrap().contains("not a 3D model layer"), "{skipped:?}");
+    // The copy references the model, not the solid.
+    let l = layer_in(&s, comp, copy);
+    let g = l.effects().unwrap().groups().next().unwrap().clone();
+    assert_eq!(g.get("layer").unwrap().value, KV::Layer(Some(model)));
+}
+
+#[test]
+fn instance3d_shows_nothing_outside_the_source_layer_range() {
+    let mut s = session();
+    let model = triangle_model(&mut s);
+    // The model's range ends at 1 s; the comp runs to 2 s.
+    let comp = cid(&s);
+    s.edit("trim", None, |p, _| {
+        p.comp_mut(comp).unwrap().layer_mut(LayerId(model)).unwrap().out_point = Tick::from_seconds_f64(1.0);
+        Ok(())
+    })
+    .unwrap();
+    s.execute("layer.select", json!({"layers": [model]})).unwrap();
+    let r = s.execute("layer.create", json!({"op": "instance3d"})).unwrap();
+    let _copy = r["layers"][0].as_u64().unwrap();
+    // Inside the model's range the copy shows it, transparent around it.
+    let inside = s.render(comp, Tick::from_seconds_f64(0.5), RenderOpts::default());
+    assert!(px(&inside, 320, 180)[3] > 0.9, "the copy shows the model: {:?}", px(&inside, 320, 180));
+    // After its out point the source has nothing to read: the copy is transparent.
+    let outside = s.render(comp, Tick::from_seconds_f64(1.5), RenderOpts::default());
+    assert!(outside.data.iter().all(|p| p[3] < 1e-3), "transparent after the source's out point: {:?}", px(&outside, 320, 180));
+}
+
+#[test]
+fn instance3d_keeps_the_copy_visible_when_the_source_is_soloed() {
+    let mut s = session();
+    let model = triangle_model(&mut s);
+    let comp = cid(&s);
+    // Solo the model, then create the instance: any_solo hides non-soloed layers and the
+    // source's video goes off, so the copy has to take the Solo over.
+    s.edit("solo", None, |p, _| {
+        p.comp_mut(comp).unwrap().layer_mut(LayerId(model)).unwrap().switches.solo = true;
+        Ok(())
+    })
+    .unwrap();
+    let before = s.render(comp, Tick::ZERO, RenderOpts::default());
+    assert!(px(&before, 320, 180)[3] > 0.9, "the soloed model shows: {:?}", px(&before, 320, 180));
+    s.execute("layer.select", json!({"layers": [model]})).unwrap();
+    let r = s.execute("layer.create", json!({"op": "instance3d"})).unwrap();
+    let solid = r["layers"][0].as_u64().unwrap();
+    assert!(layer_in(&s, comp, solid).switches.solo, "the copy takes the source's Solo switch");
+    assert!(!layer_in(&s, comp, model).switches.video, "the source keeps its video off");
+    let after = s.render(comp, Tick::ZERO, RenderOpts::default());
+    assert!(px(&after, 320, 180)[3] > 0.9, "the soloed copy shows the model: {:?}", px(&after, 320, 180));
+    assert!(close(&before, &after, 2e-2), "the comp renders the same through the copy:\n{:?}\n{:?}", px(&before, 320, 180), px(&after, 320, 180));
+}
diff --git a/crates/engine/src/tests_key_metadata_order.rs b/crates/engine/src/tests/key_metadata_order.rs
similarity index 100%
rename from crates/engine/src/tests_key_metadata_order.rs
rename to crates/engine/src/tests/key_metadata_order.rs
diff --git a/crates/engine/src/tests_key_time.rs b/crates/engine/src/tests/key_time.rs
similarity index 95%
rename from crates/engine/src/tests_key_time.rs
rename to crates/engine/src/tests/key_time.rs
index 4d4ab367b..b5ec3a159 100644
--- a/crates/engine/src/tests_key_time.rs
+++ b/crates/engine/src/tests/key_time.rs
@@ -4,7 +4,7 @@ use effectcraft_project::LayerId;
 use effectcraft_time::Tick;
 use serde_json::{Value, json};
 
-use crate::{Session, tests_timeline::prop};
+use crate::{Session, tests::timeline::prop};
 
 fn offset_layer(start: f64, stretch: f64) -> (Session, u64) {
     let mut s = Session::default();
@@ -57,7 +57,10 @@ fn default_layer_times_are_preserved_and_outside_keys_warn() {
     assert!(selected.get("warning").is_some());
     let moved = s.execute("keys.set", json!({"layer": layer, "path": "transform/opacity", "time": 15.3, "newTime": 9.5, "timeBase": "layer"})).unwrap();
     assert_seconds(&moved["compTime"], 20.0);
-    assert!(moved.get("warning").is_some(), "out point is exclusive");
+    assert!(moved.get("warning").is_none(), "a key on the out point is accepted");
+    let past = s.execute("prop.addKey", json!({"layer": layer, "path": "transform/rotation", "time": 20.1, "timeBase": "comp", "value": 45})).unwrap();
+    assert_seconds(&past["compTime"], 20.1);
+    assert!(past.get("warning").is_some(), "a key past the out point warns");
 }
 
 #[test]
diff --git a/crates/engine/src/tests/keyframe_text.rs b/crates/engine/src/tests/keyframe_text.rs
new file mode 100644
index 000000000..30d3b436e
--- /dev/null
+++ b/crates/engine/src/tests/keyframe_text.rs
@@ -0,0 +1,482 @@
+//! Copied keyframes as After Effects keyframe text for other applications (#1908).
+
+use effectcraft_project::{LayerId, Uid};
+use effectcraft_time::Tick;
+use serde_json::json;
+
+use crate::{KeyRef, Session};
+
+/// A 1920×1080 23.976 fps comp with a 200×100 solid.
+fn session() -> (Session, LayerId) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 1920, "height": 1080, "frameRate": 23.976, "duration": 10})).unwrap();
+    let id = s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 200, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    (s, LayerId(id))
+}
+
+fn frame(s: &Session, n: i64) -> Tick {
+    Tick(s.active_comp().unwrap().frame_rate.frame_duration().0 * n)
+}
+
+fn uid(s: &Session, lid: LayerId, path: &str) -> Uid {
+    s.active_comp().unwrap().layer(lid).unwrap().props.prop(path).unwrap().uid
+}
+
+fn edit_layer(s: &mut Session, lid: LayerId, f: impl FnOnce(&mut effectcraft_project::Layer)) {
+    let cid = s.active_comp_id().unwrap();
+    f(std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(lid).unwrap());
+}
+
+fn add_key(s: &mut Session, lid: LayerId, path: &str, time: Tick, value: serde_json::Value) {
+    s.execute("prop.addKey", json!({"layer": lid.0, "path": path, "time": time.seconds(), "value": value})).unwrap();
+}
+
+#[test]
+fn copied_keys_are_after_effects_text_in_comp_frames() {
+    let (mut s, l) = session();
+    // The layer starts 10 frames in: its keys at layer frames 2, 5 and 9 are comp frames 12, 15 and 19.
+    let start = frame(&s, 10);
+    edit_layer(&mut s, l, |l| l.start_time = start);
+    for (n, v) in [(2, [960.0, 540.0]), (5, [1000.5, 520.25]), (9, [1100.0, 500.0])] {
+        let t = frame(&s, n);
+        add_key(&mut s, l, "transform/position", t, json!(v));
+    }
+    let t = frame(&s, 5);
+    add_key(&mut s, l, "transform/rotation", t, json!(-45));
+    let (position, rotation) = (uid(&s, l, "transform/position"), uid(&s, l, "transform/rotation"));
+    // A subset: two of the three Position keys and the Rotation key.
+    s.state.selected_keys = [(position, 2), (position, 9), (rotation, 5)].map(|(prop, n)| KeyRef { layer: l, prop, time: frame(&s, n) }).to_vec();
+    s.execute("keys.copy", json!({})).unwrap();
+    assert_eq!(
+        s.state.keyframe_text.as_deref(),
+        Some(
+            "Adobe After Effects 9.0 Keyframe Data\n\n\tUnits Per Second\t23.976\n\tSource Width\t200\n\tSource Height\t100\n\tSource Pixel Aspect Ratio\t1\n\tComp Pixel Aspect Ratio\t1\n\n\
+             Layer\n\
+             Transform\tPosition\n\tFrame\tX pixels\tY pixels\tZ pixels\t\n\t12\t960\t540\t0\t\n\t19\t1100\t500\t0\t\n\n\
+             Transform\tRotation\n\tFrame\tdegrees\t\n\t15\t-45\t\n\n\
+             \n\
+             End of Keyframe Data\n"
+        )
+    );
+    // The internal clipboard still has the keys themselves, relative to the earliest.
+    let times: Vec<Vec<Tick>> = s.state.key_clipboard.iter().map(|c| c.keys.iter().map(|k| k.time).collect()).collect();
+    assert_eq!(times, [vec![Tick::ZERO, frame(&s, 7)], vec![frame(&s, 3)]]);
+}
+
+#[test]
+fn a_stretched_layer_writes_the_frames_its_keys_show_at() {
+    let (mut s, l) = session();
+    edit_layer(&mut s, l, |l| l.stretch = 200.0);
+    let t = frame(&s, 6);
+    add_key(&mut s, l, "transform/opacity", Tick::ZERO, json!(0));
+    add_key(&mut s, l, "transform/opacity", t, json!(100));
+    s.execute("prop.select", json!({"layer": l.0, "path": "transform/opacity"})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    let text = s.state.keyframe_text.clone().unwrap();
+    assert!(text.contains("Transform\tOpacity\n\tFrame\tpercent\t\n\t0\t0\t\n\t12\t100\t\n\n"), "{text}");
+}
+
+#[test]
+fn copied_static_values_have_no_frame() {
+    let (mut s, l) = session();
+    s.execute("prop.set", json!({"layer": l.0, "path": "transform/position", "value": [100, 200]})).unwrap();
+    s.execute("prop.select", json!({"layer": l.0, "path": "transform/position"})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    let text = s.state.keyframe_text.clone().unwrap();
+    assert!(text.contains("Transform\tPosition\n\tFrame\tX pixels\tY pixels\tZ pixels\t\n\t\t100\t200\t0\t\n\n"), "{text}");
+    assert_eq!(s.state.value_clipboard.len(), 1, "the internal clipboard keeps the value");
+}
+
+#[test]
+fn a_copied_transform_group_lists_what_the_layer_shows() {
+    let (mut s, l) = session();
+    let t = frame(&s, 24);
+    add_key(&mut s, l, "transform/scale", Tick::ZERO, json!([50, 50, 100]));
+    add_key(&mut s, l, "transform/scale", t, json!([150, 150, 100]));
+    let transform = s.active_comp().unwrap().layer(l).unwrap().props.sub("transform").unwrap().uid;
+    s.execute("prop.select", json!({"layer": l.0, "prop": transform, "selectKeys": false})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    let text = s.state.keyframe_text.clone().unwrap();
+    let names: Vec<&str> = text.lines().filter_map(|line| line.strip_prefix("Transform\t")).collect();
+    assert_eq!(names, ["Anchor Point", "Position", "Scale", "Rotation", "Opacity"], "a 2D layer has no Orientation or X / Y Rotation");
+    assert!(text.contains("\tFrame\tX percent\tY percent\tZ percent\t\n\t0\t50\t50\t100\t\n\t24\t150\t150\t100\t\n"), "{text}");
+    // 3D: Orientation and X / Y Rotation. Z Rotation stays Rotation, and Orientation's three
+    // values sit under one label, as After Effects writes them.
+    edit_layer(&mut s, l, |l| l.switches.three_d = true);
+    s.execute("prop.select", json!({"layer": l.0, "prop": transform, "selectKeys": false})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    let text = s.state.keyframe_text.clone().unwrap();
+    let names: Vec<&str> = text.lines().filter_map(|line| line.strip_prefix("Transform\t")).collect();
+    assert_eq!(names, ["Anchor Point", "Position", "Scale", "Orientation", "X Rotation", "Y Rotation", "Rotation", "Opacity"]);
+    assert!(text.contains("Transform\tOrientation\n\tFrame\tX degrees\t\n\t\t0\t0\t0\t\n"), "{text}");
+}
+
+fn copy_transform(s: &mut Session, lid: LayerId) -> String {
+    let transform = s.active_comp().unwrap().layer(lid).unwrap().props.sub("transform").unwrap().uid;
+    s.execute("prop.select", json!({"layer": lid.0, "prop": transform, "selectKeys": false})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    s.state.keyframe_text.clone().unwrap()
+}
+
+fn names(text: &str) -> Vec<&str> {
+    text.lines().filter_map(|line| line.strip_prefix("Transform\t")).collect()
+}
+
+#[test]
+fn properties_the_layer_does_not_use_are_left_out() {
+    // Separate Dimensions: the old Position no longer moves the layer.
+    let (mut s, l) = session();
+    s.execute("prop.set", json!({"layer": l.0, "path": "transform/position", "value": [100, 200]})).unwrap();
+    s.execute("prop.separateDimensions", json!({"layer": l.0, "value": true})).unwrap();
+    s.execute("prop.set", json!({"layer": l.0, "path": "transform/positionX", "value": 321})).unwrap();
+    let text = copy_transform(&mut s, l);
+    assert!(!names(&text).contains(&"Position"), "{text}");
+    // A one-node camera has no Point of Interest; a two-node one does.
+    let cam = LayerId(s.execute("layer.newCamera", json!({"type": "oneNode"})).unwrap()["layer"].as_u64().unwrap());
+    let text = copy_transform(&mut s, cam);
+    assert!(!names(&text).contains(&"Point of Interest"), "{text}");
+    s.execute("layer.cameraSettings", json!({"layer": cam.0, "type": "twoNode"})).unwrap();
+    let text = copy_transform(&mut s, cam);
+    assert!(names(&text).contains(&"Point of Interest"), "{text}");
+}
+
+#[test]
+fn separated_position_writes_x_y_and_z_position() {
+    let (mut s, l) = session();
+    s.execute("prop.separateDimensions", json!({"layer": l.0, "value": true})).unwrap();
+    let t = frame(&s, 12);
+    add_key(&mut s, l, "transform/positionX", Tick::ZERO, json!(100));
+    add_key(&mut s, l, "transform/positionX", t, json!(321));
+    s.execute("prop.set", json!({"layer": l.0, "path": "transform/positionY", "value": 200})).unwrap();
+    let text = copy_transform(&mut s, l);
+    // After Effects labels their single column with no unit.
+    assert!(text.contains("Transform\tX Position\n\tFrame\t\t\n\t0\t100\t\n\t12\t321\t\n\nTransform\tY Position\n\tFrame\t\t\n\t\t200\t\n\n"), "{text}");
+    assert!(!names(&text).contains(&"Z Position"), "a 2D layer has no Z Position: {text}");
+    edit_layer(&mut s, l, |l| l.switches.three_d = true);
+    let text = copy_transform(&mut s, l);
+    assert!(text.contains("Transform\tZ Position\n\tFrame\t\t\n\t\t0\t\n"), "{text}");
+}
+
+#[test]
+fn time_remap_writes_source_seconds_at_comp_frames() {
+    let (mut s, l) = session();
+    let r = s.execute("layer.precompose", json!({"layers": [l.0], "name": "Inner"})).unwrap();
+    let l = LayerId(r["layer"].as_u64().unwrap());
+    s.execute("layer.select", json!({"layers": [l.0]})).unwrap();
+    s.execute("layer.enableTimeRemap", json!({})).unwrap();
+    let start = frame(&s, 10);
+    edit_layer(&mut s, l, |l| l.start_time = start);
+    let t = frame(&s, 6);
+    add_key(&mut s, l, "timeRemap", t, json!(2.5));
+    s.execute("prop.select", json!({"layer": l.0, "path": "timeRemap"})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    let text = s.state.keyframe_text.clone().unwrap();
+    // As After Effects writes it: the key at layer frame 6 of a layer starting at frame 10 is at 16.
+    assert!(text.contains("Layer\nTime Remap\n\tFrame\tseconds\t\n\t10\t0\t\n\t16\t2.5\t\n"), "{text}");
+}
+
+/// Selects the layer's properties at `paths` and copies them.
+fn copy_props(s: &mut Session, lid: LayerId, paths: &[&str]) -> String {
+    for (i, path) in paths.iter().enumerate() {
+        s.execute("prop.select", json!({"layer": lid.0, "path": path, "add": i > 0, "selectKeys": false})).unwrap();
+    }
+    s.execute("edit.copy", json!({})).unwrap();
+    s.state.keyframe_text.clone().unwrap()
+}
+
+#[test]
+fn effect_properties_are_written_as_after_effects_does() {
+    // The blocks After Effects 2019 wrote for the same effects and values (2019 has no Dropdown
+    // Menu Control: that block follows its other popups, written 1-based with no unit).
+    let (mut s, l) = session();
+    for fx in ["Fill", "Checkbox Control", "Dropdown Menu Control", "Slider Control", "Point Control"] {
+        s.execute("effect.apply", json!({"layer": l.0, "effect": fx})).unwrap();
+    }
+    let t = frame(&s, 12);
+    add_key(&mut s, l, "effects/#1/color", Tick::ZERO, json!([1, 0.5, 0.25, 1]));
+    add_key(&mut s, l, "effects/#1/color", t, json!([0, 0, 1, 1]));
+    add_key(&mut s, l, "effects/#2/checkbox", Tick::ZERO, json!(true));
+    add_key(&mut s, l, "effects/#2/checkbox", t, json!(false));
+    s.execute("prop.set", json!({"layer": l.0, "path": "effects/#3/menu", "value": 1})).unwrap();
+    s.execute("prop.set", json!({"layer": l.0, "path": "effects/#4/slider", "value": 20.5})).unwrap();
+    s.execute("prop.set", json!({"layer": l.0, "path": "effects/#5/point", "value": [10, 20]})).unwrap();
+    // After Effects writes a renamed effect under the effect's own name.
+    let slider = s.active_comp().unwrap().layer(l).unwrap().props.group("effects/#4").unwrap().uid;
+    s.execute("prop.renameGroup", json!({"layer": l.0, "prop": slider, "name": "My Slider"})).unwrap();
+    let text = copy_props(&mut s, l, &["effects/#1/color", "effects/#2/checkbox", "effects/#3/menu", "effects/#4/slider", "effects/#5/point"]);
+    assert!(
+        text.contains(
+            "Layer\n\
+             Effects\tFill #1\tColor #4\n\tFrame\talpha \tred \tgreen \tblue \t\n\t0\t255\t255\t127.5\t63.75\t\n\t12\t255\t0\t0\t255\t\n\n\
+             Effects\tCheckbox Control #2\tCheckbox #2\n\tFrame\t\t\n\t0\t1\t\n\t12\t0\t\n\n\
+             Effects\tDropdown Menu Control #3\tMenu #2\n\tFrame\t\t\n\t\t2\t\n\n\
+             Effects\tSlider Control #4\tSlider #2\n\tFrame\t\t\n\t\t20.5\t\n\n\
+             Effects\tPoint Control #5\tPoint #2\n\tFrame\tX pixels\tY pixels\t\n\t\t10\t20\t\n\n"
+        ),
+        "{text}"
+    );
+}
+
+#[test]
+fn effect_properties_have_after_effects_indices() {
+    // After Effects 2019 numbered Fractal Noise's Rotation (in the Transform group) #9,
+    // Complexity (after it) #17, Evolution #25, and Opacity (after Evolution Options) #31: a
+    // group takes an index where it opens and closes, and its properties are written without
+    // it. Set Matte's Use For Matte is #3: the layer parameter before it has no extra index for
+    // its source choice.
+    let (mut s, l) = session();
+    for fx in ["Fractal Noise", "Set Matte"] {
+        s.execute("effect.apply", json!({"layer": l.0, "effect": fx})).unwrap();
+    }
+    let text = copy_props(
+        &mut s,
+        l,
+        &[
+            "effects/#1/transform/rotation",
+            "effects/#1/complexity",
+            "effects/#1/evolution",
+            "effects/#1/opacity",
+            "effects/#1/blendingMode",
+            "effects/#2/takeMatteFrom",
+        ],
+    );
+    for header in [
+        "Effects\tFractal Noise #1\tRotation #9\n",
+        "Effects\tFractal Noise #1\tComplexity #17\n",
+        "Effects\tFractal Noise #1\tEvolution #25\n",
+        "Effects\tFractal Noise #1\tOpacity #31\n",
+        "Effects\tFractal Noise #1\tBlending Mode #32\n",
+        "Effects\tSet Matte #2\tUse For Matte #3\n",
+    ] {
+        assert!(text.contains(header), "{header}in\n{text}");
+    }
+}
+
+#[test]
+fn effect_parameters_after_effects_numbers_or_labels_otherwise_follow_it() {
+    // After Effects 2019: Radial Blur counts a hidden parameter before Amount, which has no
+    // unit; 3D Channel Extract lists Anti-alias before Clamp Output; Selective Color's per-color
+    // sliders start at #10 and are percent.
+    let (mut s, l) = session();
+    for fx in ["Radial Blur", "3D Channel Extract", "Selective Color"] {
+        s.execute("effect.apply", json!({"layer": l.0, "effect": fx})).unwrap();
+    }
+    let text = copy_props(
+        &mut s,
+        l,
+        &["effects/#1/amount", "effects/#1/center", "effects/#2/antialias", "effects/#2/invertDepthMap", "effects/#3/details/reds/redsCyan"],
+    );
+    for block in [
+        "Effects\tRadial Blur #1\tAmount #3\n\tFrame\t\t\n",
+        "Effects\tRadial Blur #1\tCenter #4\n\tFrame\tX pixels\tY pixels\t\n",
+        "Effects\t3D Channel Extract #2\tAnti-alias #5\n\tFrame\t\t\n",
+        "Effects\t3D Channel Extract #2\tInvert Depth Map #7\n\tFrame\t\t\n",
+        "Effects\tSelective Color #3\tReds Cyan #10\n\tFrame\tpercent\t\n",
+    ] {
+        assert!(text.contains(block), "{block}in\n{text}");
+    }
+}
+
+#[test]
+fn mask_properties_are_written_as_after_effects_does() {
+    // The blocks After Effects 2019 wrote for the same masks and values: masks go by place, not
+    // name, and Mask Path is left out.
+    let (mut s, l) = session();
+    for _ in 0..2 {
+        s.execute("mask.new", json!({"layer": l.0, "vertices": [[0, 0], [100, 0], [100, 100]], "closed": true})).unwrap();
+    }
+    let t = frame(&s, 12);
+    for (prop, a, b) in [("feather", json!([5, 5]), json!([10, 20])), ("opacity", json!(50), json!(75)), ("expansion", json!(3), json!(-4))] {
+        add_key(&mut s, l, &format!("masks/#1/{prop}"), Tick::ZERO, a);
+        add_key(&mut s, l, &format!("masks/#1/{prop}"), t, b);
+    }
+    s.execute("prop.set", json!({"layer": l.0, "path": "masks/#2/feather", "value": [7, 8]})).unwrap();
+    let second = s.active_comp().unwrap().layer(l).unwrap().props.group("masks/#2").unwrap().uid;
+    s.execute("prop.renameGroup", json!({"layer": l.0, "prop": second, "name": "Renamed Mask"})).unwrap();
+    let text = copy_props(&mut s, l, &["masks/#1/path", "masks/#1/feather", "masks/#1/opacity", "masks/#1/expansion", "masks/#2/feather"]);
+    assert!(
+        text.contains(
+            "Layer\n\
+             Masks\tMask #1\tMask Feather\n\tFrame\tX pixels\tY pixels\t\n\t0\t5\t5\t\n\t12\t10\t20\t\n\n\
+             Masks\tMask #1\tMask Opacity\n\tFrame\tpercent\t\n\t0\t50\t\n\t12\t75\t\n\n\
+             Masks\tMask #1\tMask Expansion\n\tFrame\tpixels\t\n\t0\t3\t\n\t12\t-4\t\n\n\
+             Masks\tMask #2\tMask Feather\n\tFrame\tX pixels\tY pixels\t\n\t\t7\t8\t\n\n\
+             \nEnd of Keyframe Data\n"
+        ),
+        "{text}"
+    );
+}
+
+#[test]
+fn text_properties_are_written_as_after_effects_does() {
+    // The blocks After Effects 2019 wrote for the same text properties and values.
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 1920, "height": 1080, "frameRate": 23.976})).unwrap();
+    let l = LayerId(s.execute("layer.newText", json!({"text": "Hello"})).unwrap()["layer"].as_u64().unwrap());
+    s.execute("layer.addTextAnimator", json!({"properties": ["position", "fillColor"]})).unwrap();
+    s.execute("layer.addTextAnimator", json!({"properties": ["opacity"]})).unwrap();
+    let second = s.active_comp().unwrap().layer(l).unwrap().props.group("text/animators/#2").unwrap().uid;
+    s.execute("prop.renameGroup", json!({"layer": l.0, "prop": second, "name": "Fade"})).unwrap();
+    let t = frame(&s, 12);
+    add_key(&mut s, l, "text/sourceText", Tick::ZERO, json!("Hello"));
+    add_key(&mut s, l, "text/pathOptions/firstMargin", Tick::ZERO, json!(0));
+    add_key(&mut s, l, "text/pathOptions/firstMargin", t, json!(50));
+    add_key(&mut s, l, "text/animators/#1/selectors/#1/start", Tick::ZERO, json!(0));
+    add_key(&mut s, l, "text/animators/#1/selectors/#1/start", t, json!(100));
+    add_key(&mut s, l, "text/animators/#1/properties/position", Tick::ZERO, json!([0, 0, 0]));
+    add_key(&mut s, l, "text/animators/#1/properties/position", t, json!([10, -20, 0]));
+    for (path, v) in [
+        ("text/animators/#1/selectors/#1/end", json!(80)),
+        ("text/animators/#1/selectors/#1/offset", json!(-10)),
+        ("text/animators/#1/properties/fillColor", json!([1, 0, 0, 1])),
+        ("text/moreOptions/groupingAlignment", json!([10, -20])),
+    ] {
+        s.execute("prop.set", json!({"layer": l.0, "path": path, "value": v})).unwrap();
+    }
+    let text = copy_props(
+        &mut s,
+        l,
+        &[
+            "text/sourceText",
+            "text/pathOptions/firstMargin",
+            "text/animators/#1/selectors/#1/start",
+            "text/animators/#1/selectors/#1/end",
+            "text/animators/#1/selectors/#1/offset",
+            "text/animators/#1/selectors/#1/advanced/amount",
+            "text/animators/#1/properties/position",
+            "text/animators/#1/properties/fillColor",
+            "text/animators/#2/properties/opacity",
+            "text/moreOptions/groupingAlignment",
+        ],
+    );
+    for block in [
+        "Text\tPath Options\tFirst Margin\n\tFrame\t\t\n\t0\t0\t\n\t12\t50\t\n\n",
+        "Text\tAnimators\tAnimator #1\tSelectors\tRange Selector #1\tStart #1\n\tFrame\tpercent\t\n\t0\t0\t\n\t12\t100\t\n\n",
+        "Text\tAnimators\tAnimator #1\tSelectors\tRange Selector #1\tEnd #2\n\tFrame\tpercent\t\n\t\t80\t\n\n",
+        "Text\tAnimators\tAnimator #1\tSelectors\tRange Selector #1\tOffset #3\n\tFrame\tpercent\t\n\t\t-10\t\n\n",
+        "Text\tAnimators\tAnimator #1\tProperties\tPosition\n\tFrame\tX pixels\tY pixels\tZ pixels\t\n\t0\t0\t0\t0\t\n\t12\t10\t-20\t0\t\n\n",
+        "Text\tAnimators\tAnimator #1\tProperties\tFill Color\n\tFrame\talpha \tred \tgreen \tblue \t\n\t\t255\t255\t0\t0\t\n\n",
+        "Text\tAnimators\tAnimator #2\tProperties\tOpacity\n\tFrame\tpercent\t\n\t\t100\t\n\n",
+        "Text\tAnimators\tAnimator #1\tSelectors\tRange Selector #1\tAdvanced\tAmount\n\tFrame\tpercent\t\n\t\t100\t\n\n",
+        "Text\tMore Options\tGrouping Alignment\n\tFrame\tX percent\tY percent\t\n\t\t10\t-20\t\n\n",
+    ] {
+        assert!(text.contains(block), "{block}\nin\n{text}");
+    }
+    assert!(!text.contains("Source Text"), "{text}");
+}
+
+#[test]
+fn a_2d_layer_writes_the_z_it_shows() {
+    // Keys pasted from a 3D layer keep their Z on a 2D one, which ignores it.
+    let (mut s, l) = session();
+    let src = LayerId(s.execute("layer.newSolid", json!({"color": "#00ff00", "width": 200, "height": 100})).unwrap()["layer"].as_u64().unwrap());
+    edit_layer(&mut s, src, |l| l.switches.three_d = true);
+    add_key(&mut s, src, "transform/position", Tick::ZERO, json!([100, 200, 300]));
+    add_key(&mut s, src, "transform/scale", Tick::ZERO, json!([50, 60, 70]));
+    s.state.selected_keys = ["transform/position", "transform/scale"].map(|p| KeyRef { layer: src, prop: uid(&s, src, p), time: Tick::ZERO }).to_vec();
+    s.execute("keys.copy", json!({})).unwrap();
+    s.execute("keys.paste", json!({"layers": [l.0], "time": 0})).unwrap();
+    let pasted = s.active_comp().unwrap().layer(l).unwrap().props.prop("transform/position").unwrap().keys[0].value.components();
+    assert_eq!(pasted, [100.0, 200.0, 300.0], "the 2D layer keeps the pasted Z");
+    s.state.selected_keys = ["transform/position", "transform/scale"].map(|p| KeyRef { layer: l, prop: uid(&s, l, p), time: Tick::ZERO }).to_vec();
+    s.execute("keys.copy", json!({})).unwrap();
+    let text = s.state.keyframe_text.clone().unwrap();
+    assert!(text.contains("Transform\tPosition\n\tFrame\tX pixels\tY pixels\tZ pixels\t\n\t0\t100\t200\t0\t\n"), "{text}");
+    assert!(text.contains("Transform\tScale\n\tFrame\tX percent\tY percent\tZ percent\t\n\t0\t50\t60\t100\t\n"), "{text}");
+}
+
+#[test]
+fn the_header_has_the_source_pixel_aspect() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 1920, "height": 1080, "frameRate": 24, "pixelAspect": 1.2})).unwrap();
+    let solid = LayerId(s.execute("layer.newSolid", json!({"width": 200, "height": 100, "pixelAspect": 1.5})).unwrap()["layer"].as_u64().unwrap());
+    let text = copy_transform(&mut s, solid);
+    assert!(text.contains("\tSource Pixel Aspect Ratio\t1.5\n\tComp Pixel Aspect Ratio\t1.2\n"), "{text}");
+    // A text layer: 1 × 1, as After Effects 2019 wrote it, with the comp's pixel aspect.
+    let t = LayerId(s.execute("layer.newText", json!({"text": "Hi"})).unwrap()["layer"].as_u64().unwrap());
+    let text = copy_transform(&mut s, t);
+    assert!(text.contains("\tSource Width\t1\n\tSource Height\t1\n\tSource Pixel Aspect Ratio\t1.2\n"), "{text}");
+    // A shape layer has no source of its own: the comp's size.
+    let shape = LayerId(s.execute("layer.newShape", json!({})).unwrap()["layer"].as_u64().unwrap());
+    let text = copy_transform(&mut s, shape);
+    assert!(text.contains("\tSource Width\t1920\n\tSource Height\t1080\n"), "{text}");
+}
+
+#[test]
+fn keys_from_two_layers_have_no_text() {
+    let (mut s, a) = session();
+    let b = LayerId(s.execute("layer.newSolid", json!({"color": "#00ff00", "width": 200, "height": 100})).unwrap()["layer"].as_u64().unwrap());
+    for l in [a, b] {
+        add_key(&mut s, l, "transform/opacity", Tick::ZERO, json!(50));
+    }
+    s.state.selected_keys = [a, b].map(|l| KeyRef { layer: l, prop: uid(&s, l, "transform/opacity"), time: Tick::ZERO }).to_vec();
+    s.execute("keys.copy", json!({})).unwrap();
+    assert_eq!(s.state.keyframe_text, None, "After Effects copies one layer's keys as text");
+    assert_eq!(s.state.key_clipboard.len(), 2, "EffectCraft's own clipboard has both");
+    // A copied layer leaves no text behind.
+    s.state.selected_keys = vec![KeyRef { layer: a, prop: uid(&s, a, "transform/opacity"), time: Tick::ZERO }];
+    s.execute("keys.copy", json!({})).unwrap();
+    assert!(s.state.keyframe_text.is_some());
+    s.state.selected_keys.clear();
+    s.execute("edit.copy", json!({"layers": [a.0]})).unwrap();
+    assert_eq!(s.state.keyframe_text, None);
+}
+
+#[test]
+fn shape_contents_are_written_as_after_effects_does() {
+    // Headers and labels After Effects 2019 wrote for the same shape items: items go by kind and
+    // place in their group, and a Size has no unit (`X `).
+    let (mut s, _) = session();
+    let sh = LayerId(s.execute("layer.newShape", json!({"kind": "none"})).unwrap()["layer"].as_u64().unwrap());
+    for (kind, group) in [("group", None), ("rectangle", Some("contents/#1")), ("fill", Some("contents/#1")), ("star", None), ("repeater", None)] {
+        let mut p = json!({"layer": sh.0, "kind": kind});
+        if let Some(g) = group {
+            p["group"] = json!(g);
+        }
+        s.execute("layer.addShapeItem", p).unwrap();
+    }
+    let text = copy_props(
+        &mut s,
+        sh,
+        &[
+            "contents/#1/contents/#1/size",
+            "contents/#1/contents/#2/color",
+            "contents/#1/transform/position",
+            "contents/#2/points",
+            "contents/#3/transform/startOpacity",
+        ],
+    );
+    for block in [
+        "Contents\tGroup #1\tContents\tRectangle Path #1\tSize\n\tFrame\tX \tY \t\n",
+        "Contents\tGroup #1\tContents\tFill #2\tColor\n\tFrame\talpha \tred \tgreen \tblue \t\n",
+        "Contents\tGroup #1\tTransform\tPosition\n\tFrame\tX pixels\tY pixels\t\n",
+        "Contents\tPolystar Path #2\tPoints\n\tFrame\t\t\n",
+        "Contents\tRepeater #3\tTransform\tStart Opacity\n\tFrame\tpercent\t\n",
+    ] {
+        assert!(text.contains(block), "{block}in\n{text}");
+    }
+}
+
+#[test]
+fn camera_light_and_material_options_are_written_as_after_effects_does() {
+    // Blocks After Effects 2019 wrote for these options, defaults included: Zoom and Shadow
+    // Diffusion in pixels, Highlight Threshold on 0–1, and the material's shadow choices from 0.
+    let (mut s, l) = session();
+    let cam = LayerId(s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap());
+    let text = copy_props(&mut s, cam, &["cameraOptions/zoom", "cameraOptions/highlightThreshold"]);
+    assert!(text.contains("Camera Options\tZoom\n\tFrame\tpixels\t\n"), "{text}");
+    assert!(text.contains("Camera Options\tHighlight Threshold\n\tFrame\t\t\n\t\t1\t\n"), "{text}");
+    let light = LayerId(s.execute("layer.newLight", json!({"type": "spot"})).unwrap()["layer"].as_u64().unwrap());
+    let text = copy_props(&mut s, light, &["lightOptions/intensity", "lightOptions/shadowDiffusion"]);
+    assert!(text.contains("Light Options\tIntensity\n\tFrame\tpercent\t\n\t\t100\t\n"), "{text}");
+    assert!(text.contains("Light Options\tShadow Diffusion\n\tFrame\tpixels\t\n\t\t0\t\n"), "{text}");
+    edit_layer(&mut s, l, |l| l.switches.three_d = true);
+    let text = copy_props(&mut s, l, &["materialOptions/castsShadows", "materialOptions/acceptsShadows", "materialOptions/diffuse"]);
+    for block in [
+        "Material Options\tCasts Shadows\n\tFrame\t\t\n\t\t0\t\n",
+        "Material Options\tAccepts Shadows\n\tFrame\t\t\n\t\t1\t\n",
+        "Material Options\tDiffuse\n\tFrame\tpercent\t\n\t\t50\t\n",
+    ] {
+        assert!(text.contains(block), "{block}in\n{text}");
+    }
+}
diff --git a/crates/engine/src/tests_keylight.rs b/crates/engine/src/tests/keylight.rs
similarity index 100%
rename from crates/engine/src/tests_keylight.rs
rename to crates/engine/src/tests/keylight.rs
diff --git a/crates/engine/src/tests_limits.rs b/crates/engine/src/tests/limits.rs
similarity index 67%
rename from crates/engine/src/tests_limits.rs
rename to crates/engine/src/tests/limits.rs
index 68f2c04c0..9c156c4f7 100644
--- a/crates/engine/src/tests_limits.rs
+++ b/crates/engine/src/tests/limits.rs
@@ -102,3 +102,56 @@ fn commands_cap_sizes_at_30000_px() {
     let f = s.project.items.values().find_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.clone()) } else { None }).unwrap();
     assert_eq!((f.width, f.height, f.frame_rate), (limits::MAX_SIZE, 8, FrameRate::FPS_29_97));
 }
+
+/// Time Stretch takes After Effects' range, ±1 % to ±9900 %: before, 1e300 % was set, and a
+/// project file holding it opened at 9900 % (#3247).
+#[test]
+fn time_stretch_refuses_more_than_9900_percent() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 32, "frameRate": 30, "duration": 2})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let stretch = |s: &Session| s.active_comp().unwrap().layers.iter().find(|l| l.id.0 == layer).unwrap().stretch;
+    for pct in [1e300, -1e300, 9900.5] {
+        assert!(s.execute("layer.timeStretch", json!({"layers": [layer], "percent": pct})).is_err(), "{pct}");
+        assert_eq!(stretch(&s), 100.0, "{pct}");
+    }
+    for pct in [limits::MAX_STRETCH, -limits::MAX_STRETCH] {
+        s.execute("layer.timeStretch", json!({"layers": [layer], "percent": pct})).unwrap();
+        assert_eq!(stretch(&s), pct);
+    }
+}
+
+#[test]
+fn a_project_with_a_precomp_cycle_opens_adds_and_renders_without_running_out_of_stack() {
+    // Comps A and B nest each other (a damaged file); C is unrelated. Checking whether A
+    // contains C walked the A ⇄ B cycle until the stack ran out (#1237).
+    let mut s = Session::default();
+    let mut ids = vec![];
+    for name in ["A", "B", "C"] {
+        s.execute("comp.new", json!({"name": name, "width": 32, "height": 32, "frameRate": 30, "duration": 1})).unwrap();
+        ids.push(s.active_comp_id().unwrap());
+    }
+    let (a, b, c) = (ids[0], ids[1], ids[2]);
+    {
+        let proj = std::sync::Arc::make_mut(&mut s.project);
+        for (outer, inner) in [(a, b), (b, a)] {
+            let comp = proj.comp(outer).unwrap().clone();
+            let l = effectcraft_project::build::layer(proj, &comp, "pre", effectcraft_project::LayerSource::Comp { item: inner }, (32, 32), None);
+            let ItemKind::Comp(cc) = &mut proj.item_mut(outer).unwrap().kind else { panic!("comp") };
+            std::sync::Arc::make_mut(cc).layers.push(l);
+        }
+    }
+    let path = tmp("cycle.ecproj");
+    std::fs::write(&path, s.project.to_file_json().unwrap()).unwrap();
+    let mut t = Session::default();
+    t.execute("file.open", json!({"path": path})).unwrap();
+    t.open_comp(c);
+    // Adding A into C asks whether A contains C: it doesn't, so the layer goes in.
+    let r = t.execute("layer.addItem", json!({"comp": c.0, "item": a.0})).unwrap();
+    assert!(r["layer"].as_u64().is_some(), "{r}");
+    // Adding C into A would nest C in itself through A: refused, as before.
+    assert!(t.execute("layer.addItem", json!({"comp": a.0, "item": c.0})).is_err());
+    // C renders: inside A the renderer skips B's copy of A instead of looping.
+    let img = t.render(c, Tick::ZERO, RenderOpts { scale: 1.0, ..Default::default() });
+    assert_eq!((img.width, img.height), (32, 32));
+}
diff --git a/crates/engine/src/tests_lottie.rs b/crates/engine/src/tests/lottie.rs
similarity index 100%
rename from crates/engine/src/tests_lottie.rs
rename to crates/engine/src/tests/lottie.rs
diff --git a/crates/engine/src/tests_m137.rs b/crates/engine/src/tests/m137.rs
similarity index 100%
rename from crates/engine/src/tests_m137.rs
rename to crates/engine/src/tests/m137.rs
diff --git a/crates/engine/src/tests_m145.rs b/crates/engine/src/tests/m145.rs
similarity index 98%
rename from crates/engine/src/tests_m145.rs
rename to crates/engine/src/tests/m145.rs
index fe0a16936..831a05ead 100644
--- a/crates/engine/src/tests_m145.rs
+++ b/crates/engine/src/tests/m145.rs
@@ -42,14 +42,14 @@ fn split_layers_go_above_or_below_the_original() {
     let mut s = session();
     let a = solid(&mut s, "#ff0000");
     s.execute("time.set", json!({"time": 1.0})).unwrap();
-    let below = s.execute("edit.splitLayer", json!({"layers": [a]})).unwrap()[0].as_u64().unwrap();
-    let order: Vec<u64> = s.active_comp().unwrap().layers.iter().map(|l| l.id.0).collect();
-    assert_eq!(order, vec![a, below], "off (default): the new part goes below");
-    s.execute("edit.undo", json!({})).unwrap();
-    s.execute("prefs.set", json!({"key": "general.createSplitLayersAbove", "value": true})).unwrap();
     let above = s.execute("edit.splitLayer", json!({"layers": [a]})).unwrap()[0].as_u64().unwrap();
     let order: Vec<u64> = s.active_comp().unwrap().layers.iter().map(|l| l.id.0).collect();
-    assert_eq!(order, vec![above, a]);
+    assert_eq!(order, vec![above, a], "on (default): the new part goes above");
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("prefs.set", json!({"key": "general.createSplitLayersAbove", "value": false})).unwrap();
+    let below = s.execute("edit.splitLayer", json!({"layers": [a]})).unwrap()[0].as_u64().unwrap();
+    let order: Vec<u64> = s.active_comp().unwrap().layers.iter().map(|l| l.id.0).collect();
+    assert_eq!(order, vec![a, below]);
 }
 
 #[test]
@@ -345,7 +345,7 @@ fn render_queue_uses_default_folder_bit_depth_names_and_segments() {
 fn every_wired_setting_is_live_and_display_only_ones_are_documented() {
     let todo = crate::prefs::todo_keys();
     assert_eq!(todo, ["general.useSystemColorPicker", "composition.hardwareAcceleratePanels", "scripting.enableJsDebugger"]);
-    let docs = include_str!("../../../docs/preferences.md");
+    let docs = include_str!("../../../../docs/preferences.md");
     assert!(docs.contains("### Display-only settings"));
     assert!(!docs.contains("Not wired yet"));
 }
@@ -708,6 +708,11 @@ fn dynamic_menus_and_window_viewer_labels() {
     s.prefs.push_recent("/p/One.ecproj");
     let (e, _) = crate::menus::dynamic(&s, "recentProjects", &Default::default());
     assert_eq!((e[0].label.as_str(), e[0].command.as_str()), ("One.ecproj", "file.openRecent"));
+    // Two projects with the same file name show their paths.
+    s.prefs.push_recent("/q/One.ecproj");
+    s.prefs.push_recent("/p/Two.ecproj");
+    let (e, _) = crate::menus::dynamic(&s, "recentProjects", &Default::default());
+    assert_eq!(e.iter().map(|e| e.label.as_str()).collect::<Vec<_>>(), ["Two.ecproj", "/q/One.ecproj", "/p/One.ecproj"]);
     assert_eq!(crate::menus::dynamic(&s, "history", &Default::default()).0.len(), s.history.undo.len());
     let a = solid(&mut s, "#ff0000");
     s.state.selected_layers = vec![LayerId(a)];
diff --git a/crates/engine/src/tests_markers.rs b/crates/engine/src/tests/markers.rs
similarity index 94%
rename from crates/engine/src/tests_markers.rs
rename to crates/engine/src/tests/markers.rs
index afe4b9890..40049d6e7 100644
--- a/crates/engine/src/tests_markers.rs
+++ b/crates/engine/src/tests/markers.rs
@@ -3,7 +3,7 @@
 
 use serde_json::json;
 
-use crate::tests_timeline::setup;
+use crate::tests::timeline::setup;
 
 #[test]
 fn comp_marker_dialog_fields_and_undo() {
@@ -194,3 +194,17 @@ fn layer_add_marker_without_selection_adds_comp_marker() {
     assert!((comp.markers[0].time.seconds() - 1.5).abs() < 1e-9);
     assert_eq!(comp.markers[0].comment, "timeline marker");
 }
+
+#[test]
+fn comp_delete_all_markers_with_undo() {
+    let (mut s, _) = setup();
+    s.execute("comp.addMarker", json!({"time": 1.0, "comment": "m1"})).unwrap();
+    s.execute("comp.addMarker", json!({"time": 2.0, "comment": "m2"})).unwrap();
+    assert_eq!(s.active_comp().unwrap().markers.len(), 2);
+    s.execute("comp.deleteAllMarkers", json!({})).unwrap();
+    assert!(s.active_comp().unwrap().markers.is_empty());
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().markers.len(), 2);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert!(s.active_comp().unwrap().markers.is_empty());
+}
diff --git a/crates/engine/src/tests/mask_reveal.rs b/crates/engine/src/tests/mask_reveal.rs
new file mode 100644
index 000000000..dea57015f
--- /dev/null
+++ b/crates/engine/src/tests/mask_reveal.rs
@@ -0,0 +1,80 @@
+use crate::{Event, Session};
+use effectcraft_project::{LayerId, Project};
+use serde_json::json;
+
+/// The frontend notification must remain separate from document history and saved mask values.
+#[test]
+fn mask_reveal_creation_notifies_once_and_keeps_one_undo_step() {
+    for (command, params) in [("layer.addMask", json!({})), ("mask.new", json!({"vertices": [[1, 2], [10, 2], [10, 12]], "closed": true}))] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"width": 64, "height": 36})).unwrap();
+        let layer = s.execute("layer.newSolid", json!({})).unwrap()["layer"].as_u64().unwrap();
+        let comp = s.active_comp_id().unwrap();
+        s.drain_events();
+        let before = s.project.to_json();
+        let mask = s.execute(command, params).unwrap()["mask"].as_u64().unwrap();
+        let notices: Vec<_> = s
+            .drain_events()
+            .into_iter()
+            .filter_map(|e| match e {
+                Event::Frontend { command, params } if command == "timeline.revealMask" => Some(params),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(notices, [json!({"comp": comp.0, "layer": layer, "mask": mask, "projectEpoch": s.script_ui.project_epoch})]);
+        s.execute("prop.set", json!({"layer": layer, "path": "masks/#1/feather", "value": [4, 6]})).unwrap();
+        let reopened = Project::from_json(&s.project.to_json()).unwrap();
+        assert_eq!(reopened.comp(comp).unwrap().layer(LayerId(layer)).unwrap().props.prop("masks/#1/feather").unwrap().value.components(), [4.0, 6.0]);
+        assert!(s.undo());
+        assert!(s.undo());
+        assert_eq!(s.project.to_json(), before);
+        assert!(s.redo());
+        assert_eq!(s.active_comp().unwrap().layer(LayerId(layer)).unwrap().masks().unwrap().groups().count(), 1);
+        s.drain_events();
+        s.execute("mask.addVertex", json!({"layer": layer, "mask": mask, "point": [5, 8]})).unwrap();
+        assert!(!s.drain_events().iter().any(|e| matches!(e, Event::Frontend { command, .. } if command == "timeline.revealMask")));
+    }
+}
+
+/// Invalid tool inputs must not leave either a partial mask or a queued reveal behind.
+#[test]
+fn mask_reveal_failed_creation_emits_no_notice_and_keeps_document() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 64, "height": 36})).unwrap();
+    s.execute("layer.newSolid", json!({})).unwrap();
+    s.drain_events();
+    let before = s.project.to_json();
+    for (command, params) in [("layer.addMask", json!({"shape": "invalid"})), ("mask.new", json!({"vertices": []}))] {
+        assert!(s.execute(command, params).is_err());
+        assert_eq!(s.project.to_json(), before);
+        assert!(s.drain_events().is_empty());
+    }
+}
+
+/// Mask creation must use the same notification contract for still and video footage.
+#[test]
+fn mask_reveal_image_and_video_layers_keep_their_source_and_mask() {
+    use effectcraft_project::{Footage, FootageKind, ItemKind, LayerSource};
+    for kind in [FootageKind::Still, FootageKind::Video] {
+        for command in ["layer.addMask", "mask.new"] {
+            let mut s = Session::default();
+            s.execute("comp.new", json!({"width": 64, "height": 36})).unwrap();
+            let layer = LayerId(s.execute("layer.newSolid", json!({})).unwrap()["layer"].as_u64().unwrap());
+            let comp = s.active_comp_id().unwrap();
+            let item = s
+                .edit("Synthetic footage", None, |project, _| {
+                    let item =
+                        project.add_item("Clip", Default::default(), None, ItemKind::Footage(Footage { kind, width: 64, height: 36, ..Default::default() }));
+                    project.comp_mut(comp).unwrap().layer_mut(layer).unwrap().source = LayerSource::Footage { item };
+                    Ok(item)
+                })
+                .unwrap();
+            s.drain_events();
+            let mask = s.execute(command, json!({"vertices": [[2, 3], [20, 3], [20, 12]]})).unwrap()["mask"].as_u64().unwrap();
+            let layer = s.active_comp().unwrap().layer(layer).unwrap();
+            assert_eq!(layer.source, LayerSource::Footage { item });
+            assert_eq!(layer.masks().unwrap().groups().map(|g| g.uid).collect::<Vec<_>>(), [mask]);
+            assert_eq!(s.drain_events().iter().filter(|e| matches!(e, Event::Frontend { command, .. } if command == "timeline.revealMask")).count(), 1);
+        }
+    }
+}
diff --git a/crates/engine/src/tests_mask_warp.rs b/crates/engine/src/tests/mask_warp.rs
similarity index 90%
rename from crates/engine/src/tests_mask_warp.rs
rename to crates/engine/src/tests/mask_warp.rs
index 137feb1cb..5387fe562 100644
--- a/crates/engine/src/tests_mask_warp.rs
+++ b/crates/engine/src/tests/mask_warp.rs
@@ -11,7 +11,7 @@ use effectcraft_track::Homography;
 use serde_json::json;
 
 use crate::Session;
-use crate::tests_track::{FPS, H, W, frame_time, patch_frames, rotating_pose, setup, texture};
+use crate::tests::track::{FPS, H, W, frame_time, patch_frames, rotating_pose, setup, texture};
 
 fn pose_h(f: u32) -> Homography {
     let (c, rot, sc) = rotating_pose(f);
@@ -184,6 +184,51 @@ fn mask_interpolation_creates_matching_keys() {
     assert!(s.execute_checked("mask.interpolate", json!({"matchingMethod": "magic", "times": [0, 0.8], "layer": clip.0})).is_err());
 }
 
+#[test]
+fn mask_interpolation_skips_locked_selection_and_rejects_explicit_locked_targets() {
+    let (mut s, locked, _) = setup(patch_frames(rotating_pose));
+    let unlocked = effectcraft_project::LayerId(s.execute("layer.newSolid", json!({"width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap());
+    let a = ShapePath::rect([20.0, 20.0], 10.0, 10.0);
+    let b = ShapePath::rect([40.0, 30.0], 20.0, 20.0);
+    let cid = s.active_comp_id().unwrap();
+    let mut selected = vec![];
+    let mut masks = vec![];
+    for layer in [locked, unlocked] {
+        let uid = new_mask(&mut s, layer, &a);
+        masks.push(uid);
+        s.edit("keys", None, |project, _| {
+            let pr = project.comp_mut(cid).unwrap().layer_mut(layer).unwrap().props.find_group_mut(uid).unwrap().get_mut("path").unwrap();
+            pr.keys = vec![Keyframe::new(frame_time(0), KV::Path(a.clone())), Keyframe::new(frame_time(20), KV::Path(b.clone()))];
+            selected.extend(pr.keys.iter().map(|key| crate::KeyRef { layer, prop: pr.uid, time: key.time }));
+            Ok(())
+        })
+        .unwrap();
+    }
+    s.execute("layer.setSwitch", json!({"layers": [locked.0], "switch": "locked", "value": true})).unwrap();
+    s.state.selected_keys = selected.clone();
+    let before = mask_path(&s, locked, masks[0]).keys;
+    let options = serde_json::to_value(&s.state.mask_interp).unwrap();
+    let project = serde_json::to_value(&*s.project).unwrap();
+    let error = s.execute_checked("mask.interpolate", json!({"layer": locked.0, "mask": masks[0], "times": [0.0, 0.8], "quality": 75})).unwrap_err();
+    assert!(error.to_string().contains("locked"), "{error}");
+    assert_eq!(serde_json::to_value(&*s.project).unwrap(), project);
+    assert_eq!(serde_json::to_value(&s.state.mask_interp).unwrap(), options);
+    assert_eq!(s.state.selected_keys, selected);
+    s.execute_checked("mask.interpolate", json!({})).unwrap();
+    assert_eq!(mask_path(&s, locked, masks[0]).keys, before);
+    assert_eq!(mask_path(&s, unlocked, masks[1]).keys.len(), 21);
+    assert_eq!(s.state.selected_keys, selected);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(mask_path(&s, unlocked, masks[1]).keys.len(), 2);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(mask_path(&s, unlocked, masks[1]).keys.len(), 21);
+    s.state.selected_keys.retain(|key| key.layer == locked);
+    let selection = s.state.selected_keys.clone();
+    assert!(s.execute_checked("mask.interpolate", json!({})).is_err());
+    assert_eq!(mask_path(&s, locked, masks[0]).keys, before);
+    assert_eq!(s.state.selected_keys, selection);
+}
+
 // ---------------------------------------------------------------- Warp Stabilizer
 
 /// Camera offset on frame `f`: a slow pan plus jitter.
@@ -239,6 +284,28 @@ fn set_param(s: &mut Session, layer: LayerId, path: &str, v: serde_json::Value)
     s.execute("prop.set", json!({"layer": layer.0, "path": format!("effects/#1/{path}"), "value": v})).unwrap();
 }
 
+/// Stabilize, Crop, Auto-scale (the default) hides the borders; Crop leaves an opaque centre.
+fn assert_crop_framing(s: &mut Session, clip: LayerId) {
+    set_param(s, clip, "borders/framing", json!(2));
+    let st = s.execute("warp.status", json!({})).unwrap();
+    assert!(st["autoScale"].as_f64().unwrap() > 100.5, "{st}");
+    for f in 0..25 {
+        assert_eq!(transparent(&render(s, f)), 0, "frame {f}");
+    }
+    set_param(s, clip, "borders/framing", json!(1));
+    let st = s.execute("warp.status", json!({})).unwrap();
+    let crop: [f64; 4] = serde_json::from_value(st["crop"].clone()).unwrap();
+    for f in [0, 9, 24] {
+        let img = render(s, f);
+        for y in (crop[1].ceil() as u32 + 1)..(crop[3].floor() as u32 - 1) {
+            for x in (crop[0].ceil() as u32 + 1)..(crop[2].floor() as u32 - 1) {
+                assert!(img.get(x as i64, y as i64)[3] > 0.99, "frame {f} ({x}, {y})");
+            }
+        }
+        assert!(img.get(0, 0)[3] < 0.01);
+    }
+}
+
 #[test]
 fn warp_stabilizer_analyzes_and_stabilizes() {
     let (mut s, clip, solid) = setup(shaky);
@@ -289,25 +356,7 @@ fn warp_stabilizer_analyzes_and_stabilizes() {
     }
     set_param(&mut s, clip, "stabilization/result", json!(0));
 
-    // Stabilize, Crop, Auto-scale (the default) hides the borders; Crop leaves an opaque centre.
-    set_param(&mut s, clip, "borders/framing", json!(2));
-    let st = s.execute("warp.status", json!({})).unwrap();
-    assert!(st["autoScale"].as_f64().unwrap() > 100.5, "{st}");
-    for f in 0..25 {
-        assert_eq!(transparent(&render(&s, f)), 0, "frame {f}");
-    }
-    set_param(&mut s, clip, "borders/framing", json!(1));
-    let st = s.execute("warp.status", json!({})).unwrap();
-    let crop: [f64; 4] = serde_json::from_value(st["crop"].clone()).unwrap();
-    for f in [0, 9, 24] {
-        let img = render(&s, f);
-        for y in (crop[1].ceil() as u32 + 1)..(crop[3].floor() as u32 - 1) {
-            for x in (crop[0].ceil() as u32 + 1)..(crop[2].floor() as u32 - 1) {
-                assert!(img.get(x as i64, y as i64)[3] > 0.99, "frame {f} ({x}, {y})");
-            }
-        }
-        assert!(img.get(0, 0)[3] < 0.01);
-    }
+    assert_crop_framing(&mut s, clip);
     // Synthesize Edges fills most of the borders from neighbouring frames.
     set_param(&mut s, clip, "borders/framing", json!(3));
     let synth: usize = (0..25).map(|f| transparent(&render(&s, f))).sum();
diff --git a/crates/engine/src/tests_menu_cmds.rs b/crates/engine/src/tests/menu_cmds.rs
similarity index 64%
rename from crates/engine/src/tests_menu_cmds.rs
rename to crates/engine/src/tests/menu_cmds.rs
index 6da07dd40..4cf0a4205 100644
--- a/crates/engine/src/tests_menu_cmds.rs
+++ b/crates/engine/src/tests/menu_cmds.rs
@@ -111,6 +111,29 @@ fn set_switch_others() {
     assert!(s.execute("layer.setSwitch", json!({"layers": [c], "switch": "nope", "others": true})).is_err());
 }
 
+/// The Video switch has a cell on every layer's row, cameras and lights included, so Alt-clicking
+/// it (and Hide Other Video) takes them along with the rest.
+#[test]
+fn video_others_takes_cameras_and_lights() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let light = s.execute("layer.newLight", json!({"kind": "Point"})).unwrap()["layer"].as_u64().unwrap();
+    let get = |s: &Session, f: fn(&effectcraft_project::Layer) -> bool| [a, cam, light].map(|l| f(&layer(s, l)));
+    // The camera and the light are hidden: Alt-click on the solid's eye brings them back, since
+    // they stand apart with it, and the next Alt-click hides them with every other layer.
+    s.execute("layer.setSwitch", json!({"layers": [cam, light], "switch": "video", "value": false})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [a], "switch": "video", "others": true})).unwrap();
+    assert_eq!(get(&s, |l| l.switches.video), [true; 3]);
+    s.execute("layer.setSwitch", json!({"layers": [a], "switch": "video", "others": true})).unwrap();
+    assert_eq!(get(&s, |l| l.switches.video), [true, false, false]);
+    // Hide Other Video takes them too.
+    s.execute("layer.showAllVideo", json!({})).unwrap();
+    assert_eq!(get(&s, |l| l.switches.video), [true; 3]);
+    s.execute("layer.hideOtherVideo", json!({"layers": [a]})).unwrap();
+    assert_eq!(get(&s, |l| l.switches.video), [true, false, false]);
+}
+
 /// A null's Video switch (the eye) works like any layer's, as in After Effects: it toggles,
 /// Alt-click and Hide Other Video take nulls along, and its children still follow it while it is
 /// hidden (parenting ignores the eye).
@@ -618,7 +641,7 @@ fn work_area_stays_ordered_when_the_start_passes_the_end() {
 
 #[test]
 fn label_group_purge_and_edit_original() {
-    crate::tests_roto::hold_roto_cache_test_lock();
+    crate::tests::roto::hold_roto_cache_test_lock();
     let mut s = comp();
     let a = solid(&mut s, "#ff0000");
     let b = solid(&mut s, "#00ff00");
@@ -725,6 +748,37 @@ fn reveal_properties() {
     assert!(frontend_events(&mut s).iter().all(|(c, _)| c == "timeline.revealProps"));
 }
 
+#[test]
+fn reveal_layer_source_selects_each_layers_source_item() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    let b = solid(&mut s, "#00ff00");
+    let ia = layer(&s, a).source.item().unwrap();
+    let ib = layer(&s, b).source.item().unwrap();
+    assert_ne!(ia, ib);
+    s.execute("layer.select", json!({"layers": [a, b]})).unwrap();
+    let r = s.execute("layer.revealSource", json!({})).unwrap();
+    assert_eq!(r["item"], ia.0);
+    assert_eq!(r["items"], json!([ia.0, ib.0]));
+    assert_eq!(s.state.project_selection, vec![ia, ib]);
+    assert_eq!(frontend_events(&mut s), vec![("project.reveal".to_string(), json!({"items": [ia.0, ib.0]}))]);
+    // A null has no source. Alone it is refused; in a mixed selection only the sources are revealed.
+    let n = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.select", json!({"layers": [n]})).unwrap();
+    assert!(s.execute("layer.revealSource", json!({})).is_err());
+    s.execute("layer.select", json!({"layers": [n, a]})).unwrap();
+    let r = s.execute("layer.revealSource", json!({})).unwrap();
+    assert_eq!(r["items"], json!([ia.0]));
+    assert_eq!(s.state.project_selection, vec![ia]);
+    // Reveal Composition in Project opens the same panel and folders.
+    let cid = s.active_comp_id().unwrap();
+    s.drain_events();
+    let r = s.execute("comp.revealInProject", json!({"comp": cid.0})).unwrap();
+    assert_eq!(r["item"], cid.0);
+    assert_eq!(s.state.project_selection, vec![cid]);
+    assert_eq!(frontend_events(&mut s), vec![("project.reveal".to_string(), json!({"items": [cid.0]}))]);
+}
+
 #[test]
 fn sequence_layers() {
     let mut s = comp();
@@ -1049,6 +1103,66 @@ fn transform_commands_keep_depth_and_follow_separated_dimensions() {
     assert_eq!(pos(&s, b)[..2], [200.0, 100.0], "the 200×100 solid's centre");
 }
 
+/// The layer's painted bounds mapped to comp space — what the viewer shows.
+fn seen_bounds(s: &Session, lid: u64) -> [f64; 4] {
+    let cid = s.active_comp_id().unwrap();
+    let comp = s.project.comp(cid).unwrap().clone();
+    let layer = comp.layer(effectcraft_project::LayerId(lid)).unwrap();
+    let ectx = effectcraft_render::EvalCtx::new(&s.project, cid, &comp, s.time());
+    let b = effectcraft_render::content_bounds(&ectx, layer).expect("painted bounds");
+    let m = ectx.layer_to_comp(layer).0;
+    let corners = [[b[0], b[1]], [b[2], b[1]], [b[2], b[3]], [b[0], b[3]]];
+    let pts: Vec<[f64; 2]> = corners
+        .iter()
+        .map(|p| {
+            let q = m.apply(effectcraft_geom::vec2(p[0], p[1]));
+            [q.x, q.y]
+        })
+        .collect();
+    let (mut x0, mut y0, mut x1, mut y1) = (f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY);
+    for p in &pts {
+        x0 = x0.min(p[0]);
+        y0 = y0.min(p[1]);
+        x1 = x1.max(p[0]);
+        y1 = y1.max(p[1]);
+    }
+    [x0, y0, x1, y1]
+}
+
+#[test]
+fn fit_to_comp_fills_the_comp_with_shape_and_text_bounds() {
+    let mut s = comp();
+    let close = |x: f64, y: f64| (x - y).abs() < 1e-6;
+    // A shape or text layer has no source item: fit sizes it by its painted bounds, anchored at
+    // the bounds' centre, so what the viewer shows fills the frame (#2198).
+    let a = s.execute("layer.newShape", json!({"kind": "rect", "size": [180, 80]})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.transform", json!({"layers": [a], "op": "fit"})).unwrap();
+    let seen = seen_bounds(&s, a);
+    assert!(close(seen[0], 0.0) && close(seen[1], 0.0) && close(seen[2], 640.0) && close(seen[3], 360.0), "the rect's painted bounds fill the comp: {seen:?}");
+
+    let t = s.execute("layer.newText", json!({"text": "Title", "size": 80})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.transform", json!({"layers": [t], "op": "fit"})).unwrap();
+    let seen = seen_bounds(&s, t);
+    assert!(close(seen[0], 0.0) && close(seen[1], 0.0) && close(seen[2], 640.0) && close(seen[3], 360.0), "the text's painted bounds fill the comp: {seen:?}");
+
+    // fitWidth spans the comp's width and centres vertically.
+    for lid in [a, t] {
+        s.execute("layer.transform", json!({"layers": [lid], "op": "fitWidth"})).unwrap();
+        let seen = seen_bounds(&s, lid);
+        assert!(close(seen[0], 0.0) && close(seen[2], 640.0), "fitWidth spans the comp width: {seen:?}");
+        assert!(close((seen[1] + seen[3]) / 2.0, 180.0), "fitWidth centres vertically: {seen:?}");
+    }
+}
+
+#[test]
+fn fit_to_comp_refuses_a_scale_that_overflows() {
+    let mut s = comp();
+    let a = s.execute("layer.newShape", json!({"kind": "rect", "size": [1e-305, 80]})).unwrap()["layer"].as_u64().unwrap();
+    let before = s.project.clone();
+    assert!(s.execute("layer.transform", json!({"layers": [a], "op": "fit"})).is_err(), "an infinite scale is refused");
+    assert_eq!(s.project, before, "nothing was written");
+}
+
 #[test]
 fn duplicated_and_pasted_layers_keep_their_links() {
     let mut s = comp();
@@ -1369,6 +1483,68 @@ fn key_selection_toggles_and_skips_locked_layers_and_hold_restores_bezier() {
     assert!(s.state.selected_keys.is_empty());
 }
 
+#[test]
+fn muting_keys_skips_them_in_the_timeline_value_and_undoes() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    for (t, v) in [(0.0, 0.0), (1.0, 100.0), (2.0, 300.0)] {
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/opacity", "time": t, "value": v})).unwrap();
+    }
+    let value_at = |s: &Session, t: f64| layer(s, a).props.prop("transform/opacity").unwrap().value_at(Tick::from_seconds_f64(t)).as_f64();
+    let select = |s: &mut Session| s.execute("keys.select", json!({"keys": [{"layer": a, "path": "transform/opacity", "time": 1.0}]})).unwrap();
+    select(&mut s);
+    let before = value_at(&s, 0.5);
+    s.execute("keys.setMuted", json!({"muted": true})).unwrap();
+    assert!(layer(&s, a).props.prop("transform/opacity").unwrap().keys[1].muted);
+    // The muted key no longer bends the 0 → 300 segment.
+    assert!((value_at(&s, 0.5) - 75.0).abs() < 1e-6);
+    assert!((value_at(&s, 1.5) - 225.0).abs() < 1e-6);
+    s.undo();
+    assert!(!layer(&s, a).props.prop("transform/opacity").unwrap().keys[1].muted);
+    assert!((value_at(&s, 0.5) - before).abs() < 1e-6);
+    // The same command unmutes.
+    select(&mut s);
+    s.execute("keys.setMuted", json!({"muted": true})).unwrap();
+    s.execute("keys.setMuted", json!({"muted": false})).unwrap();
+    assert!(!layer(&s, a).props.prop("transform/opacity").unwrap().keys[1].muted);
+}
+
+/// Both Animation-menu rows mute and unmute through `Session::execute`, and undo/redo work.
+#[test]
+fn mute_and_unmute_keyframes_menu_rows_work_and_undo() {
+    fn rows(nodes: &[crate::menus::MenuNode], out: &mut Vec<(String, Value)>) {
+        for n in nodes {
+            match n {
+                crate::menus::MenuNode::Item(e) if e.command == "keys.setMuted" => out.push((e.label.clone(), e.params.clone())),
+                crate::menus::MenuNode::Submenu { children, .. } => rows(children, out),
+                _ => {}
+            }
+        }
+    }
+    let mut menu = vec![];
+    rows(&crate::menus::parse(crate::menus::TREE, false).unwrap(), &mut menu);
+    assert_eq!(menu.iter().map(|(l, _)| l.as_str()).collect::<Vec<_>>(), ["Mute Keyframes", "Unmute Keyframes"], "{menu:?}");
+
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    for (t, v) in [(0.0, 0.0), (1.0, 100.0)] {
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/opacity", "time": t, "value": v})).unwrap();
+    }
+    let muted = |s: &Session| layer(s, a).props.prop("transform/opacity").unwrap().keys[1].muted;
+    s.execute("keys.select", json!({"keys": [{"layer": a, "path": "transform/opacity", "time": 1.0}]})).unwrap();
+    let run = |s: &mut Session, params: &Value| {
+        s.execute("keys.setMuted", if params.is_null() { json!({}) } else { params.clone() }).unwrap();
+    };
+    run(&mut s, &menu[0].1);
+    assert!(muted(&s));
+    s.undo();
+    assert!(!muted(&s));
+    s.redo();
+    assert!(muted(&s));
+    run(&mut s, &menu[1].1);
+    assert!(!muted(&s));
+}
+
 #[test]
 fn transform_drags_apply_their_whole_offset_to_the_keys_they_started_with() {
     let mut s = comp();
@@ -1767,3 +1943,785 @@ fn old_guides_load_as_pixel_guides_and_percent_round_trips() {
     // A zero-sized comp never divides by zero.
     assert!(g.px(0, 0).is_finite());
 }
+
+#[test]
+fn copy_paste_masks_between_layers() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    let b = solid(&mut s, "#00ff00");
+    let n = s.active_comp().unwrap().layers.len();
+    s.execute("layer.select", json!({"layers": [a]})).unwrap();
+    s.execute("layer.addMask", json!({})).unwrap();
+    s.execute("layer.addMask", json!({"shape": "ellipse"})).unwrap();
+    let names = |s: &Session, id: u64| layer(s, id).masks().unwrap().groups().map(|m| m.name.clone()).collect::<Vec<_>>();
+    let uids = |s: &Session, id: u64| layer(s, id).masks().unwrap().groups().map(|m| m.uid).collect::<Vec<_>>();
+    let first = uids(&s, a)[0];
+    s.execute("prop.select", json!({"layer": a, "prop": first})).unwrap();
+    // Copy the mask: it is the mask that is copied, not its layer.
+    assert_eq!(s.execute("edit.copy", json!({})).unwrap()["masks"], json!(1));
+    assert!(s.state.clipboard.is_empty(), "not the layer");
+    assert!(s.is_enabled("edit.paste"));
+    s.execute("layer.select", json!({"layers": [b]})).unwrap();
+    let r = s.execute("edit.paste", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), n, "no new layer");
+    assert_eq!(names(&s, b), ["Mask 1"]);
+    let pasted = r["masks"][0].as_u64().unwrap();
+    assert_eq!(uids(&s, b), [pasted]);
+    assert_ne!(pasted, first);
+    assert_eq!(s.state.selected_props, vec![(effectcraft_project::LayerId(b), pasted)]);
+    assert_eq!(names(&s, a), ["Mask 1", "Mask 2"], "the source keeps its masks");
+    // Pasting again onto the same layer keeps names unique.
+    s.execute("edit.paste", json!({})).unwrap();
+    assert_eq!(names(&s, b), ["Mask 1", "Mask 2"]);
+    // One undo step per paste.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(names(&s, b), ["Mask 1"]);
+}
+
+#[test]
+fn paste_masks_skips_locked_layers() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    let b = solid(&mut s, "#00ff00");
+    s.execute("layer.select", json!({"layers": [a]})).unwrap();
+    s.execute("layer.addMask", json!({})).unwrap();
+    let mask = layer(&s, a).masks().unwrap().groups().next().unwrap().uid;
+    s.execute("prop.select", json!({"layer": a, "prop": mask})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    s.execute("layer.select", json!({"layers": [b]})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [b], "switch": "lock", "value": true})).unwrap();
+    assert!(s.execute("edit.paste", json!({})).is_err());
+    assert_eq!(layer(&s, b).masks().unwrap().groups().count(), 0);
+}
+
+#[test]
+fn copy_with_an_explicit_layer_ignores_the_selected_mask() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    s.execute("layer.select", json!({"layers": [a]})).unwrap();
+    s.execute("layer.addMask", json!({})).unwrap();
+    let mask = layer(&s, a).masks().unwrap().groups().next().unwrap().uid;
+    s.execute("prop.select", json!({"layer": a, "prop": mask})).unwrap();
+    s.execute("edit.copy", json!({"layer": a})).unwrap();
+    assert_eq!(s.state.clipboard.len(), 1, "the named layer is copied");
+    assert!(s.state.mask_clipboard.is_empty());
+}
+
+#[test]
+fn selecting_a_mask_drops_stale_key_selection_so_copy_copies_the_mask() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    s.execute("layer.select", json!({"layers": [a]})).unwrap();
+    s.execute("layer.addMask", json!({})).unwrap();
+    let mask = layer(&s, a).masks().unwrap().groups().next().unwrap().uid;
+    s.state.selected_keys = vec![crate::KeyRef { layer: effectcraft_project::LayerId(a), prop: 1, time: Default::default() }];
+    s.execute("prop.select", json!({"layer": a, "prop": mask})).unwrap();
+    assert!(s.state.selected_keys.is_empty());
+    assert_eq!(s.execute("edit.copy", json!({})).unwrap()["masks"], json!(1));
+}
+
+#[test]
+fn pasting_a_mask_onto_its_own_layer_drops_the_source_vertex_selection() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    s.execute("layer.select", json!({"layers": [a]})).unwrap();
+    s.execute("layer.addMask", json!({})).unwrap();
+    let mask = layer(&s, a).masks().unwrap().groups().next().unwrap().uid;
+    s.execute("prop.select", json!({"layer": a, "prop": mask})).unwrap();
+    assert!(!s.state.selected_vertices.is_empty());
+    s.execute("edit.copy", json!({})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    assert!(s.state.selected_vertices.is_empty());
+    s.execute("edit.clear", json!({})).unwrap();
+    assert_eq!(layer(&s, a).masks().unwrap().groups().count(), 1, "the pasted mask goes, the source stays");
+}
+
+#[test]
+fn precompose_unlinks_layers_left_behind_and_numbers_default_names() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "frameRate": 30, "duration": 4})).unwrap();
+    let mk = |s: &mut Session, name: &str| {
+        s.execute("layer.newSolid", json!({"name": name, "color": "#fff", "width": 64, "height": 64})).unwrap()["layer"].as_u64().unwrap()
+    };
+    let (a, b, c, d) = (mk(&mut s, "A"), mk(&mut s, "B"), mk(&mut s, "C"), mk(&mut s, "D"));
+    s.execute("layer.setParent", json!({"layers": [c], "parent": a})).unwrap();
+    s.execute("layer.setTrackMatte", json!({"layers": [d], "matte": b, "kind": "alpha"})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    s.execute("layer.precompose", json!({"layers": [a, b]})).unwrap();
+    let comp = s.project.comp(cid).unwrap();
+    assert_eq!(comp.layers.len(), 3);
+    for l in &comp.layers {
+        assert!(l.parent.is_none_or(|p| comp.layer(p).is_some()), "{} has a dangling parent", l.name);
+        assert!(l.track_matte.as_ref().is_none_or(|m| comp.layer(m.layer).is_some()), "{} has a dangling matte", l.name);
+    }
+    s.execute("layer.precompose", json!({"layers": [c, d]})).unwrap();
+    let mut names: Vec<String> = s
+        .project
+        .items
+        .values()
+        .filter(|i| matches!(i.kind, effectcraft_project::ItemKind::Comp(_)) && i.name.starts_with("Pre-comp"))
+        .map(|i| i.name.clone())
+        .collect();
+    names.sort();
+    assert_eq!(names, ["Pre-comp 1", "Pre-comp 2"]);
+}
+
+fn id_named(s: &Session, name: &str) -> u64 {
+    s.active_comp().unwrap().layers.iter().find(|l| l.name == name).unwrap_or_else(|| panic!("no layer {name}")).id.0
+}
+
+/// A comp with solids A (keyed Position, parent of B), B and C.
+fn precomp_scene() -> Session {
+    let mut s = comp();
+    for (name, color, pos) in [("A", "#ff0000", [150.0, 100.0]), ("B", "#00ff00", [350.0, 220.0]), ("C", "#0000ff", [500.0, 100.0])] {
+        let l = solid(&mut s, color);
+        s.execute("layer.rename", json!({"layers": [l], "name": name})).unwrap();
+        s.execute("prop.set", json!({"layer": l, "path": "transform/position", "value": pos})).unwrap();
+    }
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    s.execute("prop.addKey", json!({"layer": a, "path": "transform/position", "time": 0, "value": [150, 100]})).unwrap();
+    s.execute("prop.addKey", json!({"layer": a, "path": "transform/position", "time": 1, "value": [300, 200]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [b], "parent": a})).unwrap();
+    s
+}
+
+/// Where A, B and C are drawn at a few times.
+fn scene_look(s: &mut Session) -> Vec<[f64; 4]> {
+    let mut out = vec![];
+    for t in [0.0, 0.5, 1.0, 2.0] {
+        s.execute("time.set", json!({"time": t})).unwrap();
+        for n in ["A", "B", "C"] {
+            let id = id_named(s, n);
+            out.push(seen_bounds(s, id));
+        }
+    }
+    out
+}
+
+/// Un-precompose (#2918) gives the picture back: precompose A and B, expand the pre-comp layer
+/// again, and every layer is drawn where it was at every time, parenting and stacking order are
+/// kept, as one undo step.
+#[test]
+fn unprecompose_restores_what_precompose_nested() {
+    let mut s = precomp_scene();
+    let before = scene_look(&mut s);
+    let order: Vec<String> = s.active_comp().unwrap().layers.iter().map(|l| l.name.clone()).collect();
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    let r = s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap();
+    let pre = r["layer"].as_u64().unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 2);
+    let undo = s.history.undo.len();
+    let r = s.execute("layer.unprecompose", json!({"layers": [pre]})).unwrap();
+    assert_eq!(r["layers"].as_array().unwrap().len(), 2);
+    assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
+    let after: Vec<String> = s.active_comp().unwrap().layers.iter().map(|l| l.name.clone()).collect();
+    assert_eq!(after, order, "the layers are back in their order");
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    assert_eq!(layer(&s, b).parent, Some(effectcraft_project::LayerId(a)), "B is still A's child");
+    for (w, g) in before.iter().zip(scene_look(&mut s)) {
+        assert!(w.iter().zip(g).all(|(x, y)| (x - y).abs() < 1e-6), "a layer moved: {w:?} → {g:?}");
+    }
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 2, "undo brings the pre-comp layer back");
+}
+
+/// A pre-comp layer that was moved or started later places the nested layers the same way after it
+/// is expanded: its Position (against the Anchor Point) and its Start carry over.
+#[test]
+fn unprecompose_carries_the_precomp_layers_position_and_start() {
+    let mut s = precomp_scene();
+    let before = scene_look(&mut s);
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    let pre = s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": pre, "path": "transform/position", "value": [360, 160]})).unwrap();
+    s.execute("layer.unprecompose", json!({"layers": [pre]})).unwrap();
+    // The pre-comp's Anchor Point sat at the comp centre (320, 180): everything moved by (+40, −20).
+    let after = scene_look(&mut s);
+    for (i, (w, g)) in before.iter().zip(after).enumerate() {
+        let n = i % 3;
+        let (dx, dy) = if n < 2 { (40.0, -20.0) } else { (0.0, 0.0) };
+        let want = [w[0] + dx, w[1] + dy, w[2] + dx, w[3] + dy];
+        assert!(want.iter().zip(g).all(|(x, y)| (x - y).abs() < 1e-6), "layer {n}: wanted {want:?}, drawn {g:?}");
+    }
+
+    // Starting later: the nested layers start later by as much, and are trimmed to the span shown.
+    let mut s = precomp_scene();
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    let pre = s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.timing", json!({"layers": [pre], "op": "set", "start": 2.0})).unwrap();
+    let start = layer(&s, pre).start_time;
+    s.execute("layer.unprecompose", json!({"layers": [pre]})).unwrap();
+    let a = layer(&s, id_named(&s, "A"));
+    assert_eq!(a.start_time, start, "the nested layer's time 0 sits at the pre-comp layer's Start");
+    assert!(a.in_point >= start, "and it doesn't show before it");
+}
+
+/// A pre-comp scene: the outer comp, the nested comp and the pre-comp layer (A and B nested).
+fn unprecompose_scene() -> (Session, effectcraft_project::ItemId, u64, u64) {
+    let mut s = precomp_scene();
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    let outer = s.active_comp_id().unwrap();
+    let r = s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap();
+    (s, outer, r["comp"].as_u64().unwrap(), r["layer"].as_u64().unwrap())
+}
+
+/// Everything un-precompose could change: every comp (layers and markers) and the item count.
+fn whole_project(s: &Session) -> (Vec<effectcraft_project::Comp>, usize) {
+    (s.project.comps().map(|(_, c)| c.clone()).collect(), s.project.items.len())
+}
+
+/// Without `force`, a reason is an error naming it that changes nothing (no undo step), and the
+/// dry run lists it; with `force` the layer is unpacked anyway in one undo step, the result lists
+/// the reason as a warning, and undo restores the exact project.
+fn warned_then_forced(s: &mut Session, pre: u64, what: &str) {
+    let undo = s.history.undo.len();
+    let before = whole_project(s);
+    let e = s.execute("layer.unprecompose", json!({"layers": [pre]})).expect_err(what).to_string();
+    assert!(e.contains(what) && e.contains("force"), "{what}: {e}");
+    assert!(whole_project(s) == before, "{what}: nothing changed");
+    assert_eq!(s.history.undo.len(), undo, "{what}: no undo step");
+    let dry = s.execute("layer.unprecompose", json!({"layers": [pre], "dryRun": true})).unwrap();
+    assert!(dry["warnings"].as_array().unwrap().iter().any(|w| w.as_str().unwrap().contains(what)), "{what}: {dry}");
+    assert!(whole_project(s) == before, "{what}: the dry run changed nothing");
+    let r = s.execute("layer.unprecompose", json!({"layers": [pre], "force": true})).expect(what);
+    assert!(r["warnings"].as_array().unwrap().iter().any(|w| w.as_str().unwrap().contains(what)), "{what}: {r}");
+    assert!(r["layers"].as_array().unwrap().len() >= 2, "{what}: A and B are back");
+    assert_eq!(s.history.undo.len(), undo + 1, "{what}: one undo step");
+    let comp = s.active_comp().unwrap();
+    assert!(comp.layers.iter().all(|l| l.id.0 != pre), "{what}: the pre-comp layer is gone");
+    for l in &comp.layers {
+        assert!(l.parent.is_none_or(|p| comp.layer(p).is_some()), "{what}: {} has a dangling parent", l.name);
+        assert!(l.track_matte.is_none_or(|m| comp.layer(m.layer).is_some()), "{what}: {} has a dangling matte", l.name);
+    }
+    scene_look(s);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(whole_project(s) == before, "{what}: undo restores the exact project");
+}
+
+/// What the pre-comp layer itself adds to the look is a warning (#2918): an error listing it
+/// without `force`, unpacked anyway with it.
+#[test]
+fn unprecompose_warns_about_what_the_precomp_layer_itself_adds() {
+    let fresh = unprecompose_scene;
+    let (mut s, _, _, pre) = fresh();
+    s.execute("prop.set", json!({"layer": pre, "path": "transform/opacity", "value": 50})).unwrap();
+    warned_then_forced(&mut s, pre, "Opacity");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("prop.set", json!({"layer": pre, "path": "transform/rotation", "value": 10})).unwrap();
+    warned_then_forced(&mut s, pre, "Rotation");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("prop.addKey", json!({"layer": pre, "path": "transform/scale", "time": 0, "value": [100, 100]})).unwrap();
+    warned_then_forced(&mut s, pre, "animated");
+    for switch in ["solo", "guide"] {
+        let (mut s, _, _, pre) = fresh();
+        s.execute("layer.setSwitch", json!({"layers": [pre], "switch": switch, "value": true})).unwrap();
+        warned_then_forced(&mut s, pre, "Solo or Guide");
+    }
+    for switch in ["video", "audio"] {
+        let (mut s, _, _, pre) = fresh();
+        s.execute("layer.setSwitch", json!({"layers": [pre], "switch": switch, "value": false})).unwrap();
+        warned_then_forced(&mut s, pre, "Video or Audio");
+    }
+    for switch in ["threeD", "collapse", "adjustment", "preserveTransparency"] {
+        let (mut s, _, _, pre) = fresh();
+        s.execute("layer.setSwitch", json!({"layers": [pre], "switch": switch, "value": true})).unwrap();
+        warned_then_forced(&mut s, pre, "3D, collapses");
+    }
+    let (mut s, _, _, pre) = fresh();
+    let c = id_named(&s, "C");
+    s.execute("layer.setParent", json!({"layers": [pre], "parent": c})).unwrap();
+    warned_then_forced(&mut s, pre, "has a parent");
+    let (mut s, _, _, pre) = fresh();
+    let c = id_named(&s, "C");
+    s.execute("layer.setTrackMatte", json!({"layer": pre, "matte": c})).unwrap();
+    warned_then_forced(&mut s, pre, "has a track matte");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("effect.apply", json!({"layers": [pre], "effect": "Gaussian Blur"})).unwrap();
+    warned_then_forced(&mut s, pre, "effects");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("layer.addMask", json!({"layer": pre})).unwrap();
+    warned_then_forced(&mut s, pre, "masks");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("layer.style.add", json!({"layers": [pre], "style": "dropShadow"})).unwrap();
+    warned_then_forced(&mut s, pre, "layer styles");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("layer.setBlendMode", json!({"layers": [pre], "mode": "Multiply"})).unwrap();
+    warned_then_forced(&mut s, pre, "blending mode");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("layer.timeStretch", json!({"layers": [pre], "percent": 200.0})).unwrap();
+    warned_then_forced(&mut s, pre, "time-stretched");
+    let (mut s, _, _, pre) = fresh();
+    s.execute("layer.enableTimeRemap", json!({"layers": [pre], "value": true})).unwrap();
+    warned_then_forced(&mut s, pre, "time-remapped");
+    // A layer that is not a pre-comp, and a selection of several, are refused, even forced.
+    let (mut s, _, _, pre) = fresh();
+    let c = id_named(&s, "C");
+    assert!(s.execute("layer.unprecompose", json!({"layers": [c], "force": true})).is_err());
+    assert!(s.execute("layer.unprecompose", json!({"layers": [pre, c], "force": true})).is_err());
+}
+
+/// What only holds inside the nested comp (a camera or light, a soloed, 3D, adjustment or
+/// Preserve Transparency layer) is a warning too.
+#[test]
+fn unprecompose_warns_about_what_only_holds_inside_the_nested_comp() {
+    let inside = |switch: &str, what: &str| {
+        let (mut s, outer, inner, pre) = unprecompose_scene();
+        s.execute("comp.open", json!({"comp": inner})).unwrap();
+        let a = id_named(&s, "A");
+        s.execute("layer.setSwitch", json!({"layers": [a], "switch": switch, "value": true})).unwrap();
+        s.execute("comp.open", json!({"comp": outer.0})).unwrap();
+        warned_then_forced(&mut s, pre, what);
+    };
+    inside("solo", "soloed layer");
+    inside("preserveTransparency", "Preserve Transparency");
+    inside("adjustment", "adjustment, 3D");
+    inside("threeD", "adjustment, 3D");
+    let (mut s, outer, inner, pre) = unprecompose_scene();
+    s.execute("comp.open", json!({"comp": inner})).unwrap();
+    s.execute("layer.newLight", json!({})).unwrap();
+    s.execute("comp.open", json!({"comp": outer.0})).unwrap();
+    warned_then_forced(&mut s, pre, "camera or light");
+}
+
+/// A locked pre-comp layer is the one hard stop: refused with and without `force`, and by the dry
+/// run, changing nothing.
+#[test]
+fn unprecompose_refuses_a_locked_layer_even_forced() {
+    let (mut s, _, _, pre) = unprecompose_scene();
+    s.execute("prop.set", json!({"layer": pre, "path": "transform/opacity", "value": 50})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [pre], "switch": "lock", "value": true})).unwrap();
+    let undo = s.history.undo.len();
+    let before = whole_project(&s);
+    for p in [json!({"layers": [pre]}), json!({"layers": [pre], "force": true}), json!({"layers": [pre], "dryRun": true})] {
+        let e = s.execute("layer.unprecompose", p.clone()).expect_err("locked").to_string();
+        assert!(e.contains("locked"), "{p}: {e}");
+        assert!(whole_project(&s) == before, "{p}: nothing changed");
+        assert_eq!(s.history.undo.len(), undo, "{p}: no undo step");
+    }
+    // A clean, locked pre-comp layer is refused too.
+    let (mut s, _, _, pre) = unprecompose_scene();
+    s.execute("layer.setSwitch", json!({"layers": [pre], "switch": "lock", "value": true})).unwrap();
+    assert!(s.execute("layer.unprecompose", json!({"layers": [pre]})).unwrap_err().to_string().contains("locked"));
+}
+
+/// Layers that use the pre-comp layer as parent, track matte or in a property lose that link when
+/// it is unpacked by force; links to other layers stay, and nothing dangles or crashes.
+#[test]
+fn unprecompose_forced_drops_the_links_other_layers_had_to_it() {
+    let (mut s, outer, _, pre) = unprecompose_scene();
+    let c = id_named(&s, "C");
+    let d = solid(&mut s, "#ffff00");
+    s.execute("layer.rename", json!({"layers": [d], "name": "D"})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [c], "parent": pre})).unwrap();
+    s.execute("layer.setTrackMatte", json!({"layer": d, "matte": pre})).unwrap();
+    s.execute("effect.apply", json!({"layers": [c], "effect": "Set Matte"})).unwrap();
+    s.execute("effect.apply", json!({"layers": [d], "effect": "Set Matte"})).unwrap();
+    {
+        let proj = std::sync::Arc::make_mut(&mut s.project);
+        let comp = proj.comp_mut(outer).unwrap();
+        let set = |comp: &mut effectcraft_project::Comp, on: u64, to: u64| {
+            let l = comp.layer_mut(effectcraft_project::LayerId(on)).unwrap();
+            l.props.walk_mut(&mut |p| {
+                if matches!(p.value, KV::Layer(_)) {
+                    p.value = KV::Layer(Some(to));
+                }
+            });
+        };
+        set(comp, c, pre);
+        set(comp, d, c);
+    }
+    let refs = |s: &Session, on: u64| {
+        let mut out = vec![];
+        layer(s, on).props.walk("", &mut |_, p| {
+            if let KV::Layer(v) = p.value {
+                out.push(v);
+            }
+        });
+        out
+    };
+    assert_eq!(refs(&s, c), vec![Some(pre)], "the test set C's reference");
+    let e = s.execute("layer.unprecompose", json!({"layers": [pre]})).expect_err("used by others").to_string();
+    assert!(e.contains("parent or track matte") && e.contains("refers to it"), "{e}");
+    let undo = s.history.undo.len();
+    let before = whole_project(&s);
+    let r = s.execute("layer.unprecompose", json!({"layers": [pre], "force": true})).unwrap();
+    let w = r["warnings"].to_string();
+    assert!(w.contains("link is removed") && w.contains("reference is cleared"), "{w}");
+    assert_eq!(layer(&s, c).parent, None, "C lost its parent");
+    assert!(layer(&s, d).track_matte.is_none(), "D lost its matte");
+    assert_eq!(refs(&s, c), vec![None], "C's reference to the pre-comp layer is cleared");
+    assert_eq!(refs(&s, d), vec![Some(c)], "D's reference to C stays");
+    scene_look(&mut s);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(whole_project(&s) == before, "undo restores the links");
+    assert_eq!(s.history.undo.len(), undo);
+}
+
+/// Expressions of other layers that name the pre-comp layer (in quotes, or by its index) would no
+/// longer find it: one warning per property; an expression naming another layer is not one. Forced,
+/// the expressions stay as they are and the comp still renders.
+#[test]
+fn unprecompose_warns_about_expressions_that_refer_to_it() {
+    let (mut s, _, _, pre) = unprecompose_scene();
+    let c = id_named(&s, "C");
+    let d = solid(&mut s, "#ffff00");
+    s.execute("layer.rename", json!({"layers": [d], "name": "D"})).unwrap();
+    let index = s.active_comp().unwrap().layers.iter().position(|l| l.id.0 == pre).unwrap() + 1;
+    let set = |s: &mut Session, on: u64, path: &str, text: &str| {
+        s.execute("prop.setExpression", json!({"layer": on, "path": path, "expression": text})).unwrap();
+    };
+    set(&mut s, c, "transform/position", "thisComp.layer(\"Inner\").transform.position");
+    set(&mut s, c, "transform/rotation", &format!("thisComp.layer( {index} ).transform.rotation"));
+    // Naming another layer, or another comp's layer at the same index, is no reference to it.
+    set(&mut s, d, "transform/position", "thisComp.layer(\"C\").transform.position");
+    set(&mut s, d, "transform/rotation", &format!("comp(\"Other\").layer({index}).transform.rotation"));
+    let dry = s.execute("layer.unprecompose", json!({"layers": [pre], "dryRun": true})).unwrap();
+    let exprs: Vec<String> =
+        dry["warnings"].as_array().unwrap().iter().filter_map(|w| w.as_str()).filter(|w| w.contains("expression")).map(str::to_string).collect();
+    assert_eq!(exprs.len(), 2, "{exprs:?}");
+    assert!(exprs.iter().all(|w| w.contains("layer “C”") && w.contains("“Inner”") && w.contains("no longer find it")), "{exprs:?}");
+    assert!(exprs.iter().any(|w| w.contains("Position")) && exprs.iter().any(|w| w.contains("Rotation")), "{exprs:?}");
+    warned_then_forced(&mut s, pre, "has an expression that refers to “Inner”");
+    // Forced, the expressions are left as written.
+    s.execute("layer.unprecompose", json!({"layers": [pre], "force": true})).unwrap();
+    let text = layer(&s, c).transform().unwrap().get("position").unwrap().expr.clone().unwrap().text;
+    assert_eq!(text, "thisComp.layer(\"Inner\").transform.position");
+    scene_look(&mut s);
+}
+
+/// An expression naming a layer by a number below the pre-comp layer points at another layer once
+/// the nested comp's two layers replace it: a warning. One naming a number above it does not move.
+#[test]
+fn unprecompose_warns_when_it_renumbers_the_layers_an_expression_names() {
+    let (mut s, _, _, pre) = unprecompose_scene();
+    let c = id_named(&s, "C");
+    let index = s.active_comp().unwrap().layers.iter().position(|l| l.id.0 == pre).unwrap() + 1;
+    let warned = |s: &mut Session, number: usize| {
+        let text = format!("thisComp.layer({number}).transform.rotation");
+        s.execute("prop.setExpression", json!({"layer": c, "path": "transform/rotation", "expression": text})).unwrap();
+        let dry = s.execute("layer.unprecompose", json!({"layers": [pre], "dryRun": true})).unwrap();
+        dry["warnings"].as_array().unwrap().iter().filter_map(|w| w.as_str()).any(|w| w.contains("by number"))
+    };
+    assert!(warned(&mut s, index + 1), "a number below it");
+    assert!(!warned(&mut s, index - 1), "a number above it");
+}
+
+/// A nested comp that preserves its own frame rate (10 fps in a 30 fps comp) samples its layers on
+/// its own frames; expanded, they would change on every frame of the parent: a warning. Without
+/// Preserve Frame Rate the nested layers are sampled at the parent's times already: no warning.
+#[test]
+fn unprecompose_warns_when_the_nested_comp_preserves_another_frame_rate() {
+    let (mut s, _, inner, pre) = unprecompose_scene();
+    s.execute("comp.settings", json!({"comp": inner, "frameRate": 10})).unwrap();
+    let dry = s.execute("layer.unprecompose", json!({"layers": [pre], "dryRun": true})).unwrap();
+    assert_eq!(dry["warnings"], json!([]), "a different rate alone samples at the parent's times");
+    s.execute("comp.settings", json!({"comp": inner, "preserveFrameRate": true})).unwrap();
+    warned_then_forced(&mut s, pre, "preserves a frame rate");
+
+    // A motion-blurred nested layer under another shutter would be blurred with the parent's.
+    let (mut s, outer, inner, pre) = unprecompose_scene();
+    s.execute("comp.settings", json!({"comp": inner, "shutterAngle": 90})).unwrap();
+    let dry = s.execute("layer.unprecompose", json!({"layers": [pre], "dryRun": true})).unwrap();
+    assert_eq!(dry["warnings"], json!([]), "no layer uses motion blur");
+    s.execute("comp.open", json!({"comp": inner})).unwrap();
+    let a = id_named(&s, "A");
+    s.execute("layer.setSwitch", json!({"layers": [a], "switch": "motionBlur", "value": true})).unwrap();
+    s.execute("comp.open", json!({"comp": outer.0})).unwrap();
+    warned_then_forced(&mut s, pre, "motion blur shutter");
+}
+
+/// The pre-comp layer's move (Position against Anchor Point) is added to the stored Position of
+/// unparented nested layers; one whose Position has an expression may ignore it: a warning, only
+/// when there is a move.
+#[test]
+fn unprecompose_warns_about_position_expressions_it_cannot_move() {
+    let (mut s, outer, inner, pre) = unprecompose_scene();
+    s.execute("comp.open", json!({"comp": inner})).unwrap();
+    let a = id_named(&s, "A");
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/position", "expression": "[100, 100]"})).unwrap();
+    s.execute("comp.open", json!({"comp": outer.0})).unwrap();
+    let dry = s.execute("layer.unprecompose", json!({"layers": [pre], "dryRun": true})).unwrap();
+    assert_eq!(dry["warnings"], json!([]), "no move, nothing to lose");
+    s.execute("prop.set", json!({"layer": pre, "path": "transform/position", "value": [360, 160]})).unwrap();
+    warned_then_forced(&mut s, pre, "layer “A” has a Position expression");
+}
+
+/// Expanded copies keep pointing at each other: a track matte and a layer-valued effect property
+/// on a nested layer follow the copy of the layer they named, and the nested comp's markers are
+/// moved by the pre-comp layer's Start and merged in time order with the comp's own.
+#[test]
+fn unprecompose_remaps_mattes_layer_values_and_merges_markers_in_order() {
+    let (mut s, outer, inner, pre) = unprecompose_scene();
+    s.execute("comp.open", json!({"comp": inner})).unwrap();
+    let (a, b) = (id_named(&s, "A"), id_named(&s, "B"));
+    s.execute("layer.setParent", json!({"layers": [b], "parent": null})).unwrap();
+    s.execute("layer.setTrackMatte", json!({"layer": b, "matte": a})).unwrap();
+    s.execute("effect.apply", json!({"layers": [b], "effect": "Set Matte"})).unwrap();
+    {
+        let proj = std::sync::Arc::make_mut(&mut s.project);
+        let l = proj.comp_mut(effectcraft_project::ItemId(inner)).unwrap().layer_mut(effectcraft_project::LayerId(b)).unwrap();
+        l.props.walk_mut(&mut |p| {
+            if matches!(p.value, KV::Layer(_)) {
+                p.value = KV::Layer(Some(a));
+            }
+        });
+    }
+    for t in [2.5, 0.5] {
+        s.execute("comp.addMarker", json!({"time": t, "comment": format!("in {t}")})).unwrap();
+    }
+    s.execute("comp.open", json!({"comp": outer.0})).unwrap();
+    s.execute("comp.addMarker", json!({"time": 2.0, "comment": "out"})).unwrap();
+    s.execute("layer.timing", json!({"layers": [pre], "op": "set", "start": 1.0})).unwrap();
+    s.execute("layer.unprecompose", json!({"layers": [pre]})).unwrap();
+    let (a, b) = (layer(&s, id_named(&s, "A")), layer(&s, id_named(&s, "B")));
+    assert_eq!(b.track_matte.map(|m| m.layer), Some(a.id), "B's matte is the copy of A");
+    let mut refs = vec![];
+    b.props.walk("", &mut |_, p| {
+        if let KV::Layer(v) = p.value {
+            refs.push(v);
+        }
+    });
+    assert_eq!(refs, vec![Some(a.id.0)], "Set Matte names the copy of A");
+    let markers: Vec<(f64, String)> = s.active_comp().unwrap().markers.iter().map(|m| (m.time.seconds(), m.comment.clone())).collect();
+    let want = [(1.5, "in 0.5"), (2.0, "out"), (3.5, "in 2.5")];
+    assert_eq!(markers.len(), 3, "{markers:?}");
+    for ((t, c), (wt, wc)) in markers.iter().zip(want) {
+        assert!((t - wt).abs() < 1e-9 && c == wc, "{markers:?}");
+    }
+    scene_look(&mut s);
+}
+
+/// Every reason at once, forced: unpacked without a crash, one undo step, undone exactly.
+#[test]
+fn unprecompose_forced_with_everything_at_once() {
+    let (mut s, outer, inner, pre) = unprecompose_scene();
+    let c = id_named(&s, "C");
+    s.execute("comp.open", json!({"comp": inner})).unwrap();
+    let a = id_named(&s, "A");
+    for sw in ["solo", "threeD", "adjustment", "preserveTransparency"] {
+        s.execute("layer.setSwitch", json!({"layers": [a], "switch": sw, "value": true})).unwrap();
+    }
+    s.execute("layer.newCamera", json!({})).unwrap();
+    s.execute("comp.open", json!({"comp": outer.0})).unwrap();
+    s.execute("prop.set", json!({"layer": pre, "path": "transform/opacity", "value": 20})).unwrap();
+    s.execute("prop.addKey", json!({"layer": pre, "path": "transform/rotation", "time": 0, "value": 30})).unwrap();
+    s.execute("effect.apply", json!({"layers": [pre], "effect": "Gaussian Blur"})).unwrap();
+    s.execute("layer.addMask", json!({"layer": pre})).unwrap();
+    s.execute("layer.style.add", json!({"layers": [pre], "style": "dropShadow"})).unwrap();
+    s.execute("layer.setBlendMode", json!({"layers": [pre], "mode": "Screen"})).unwrap();
+    s.execute("layer.enableTimeRemap", json!({"layers": [pre], "value": true})).unwrap();
+    s.execute("layer.timeStretch", json!({"layers": [pre], "percent": -50.0})).unwrap();
+    for sw in ["solo", "guide", "threeD", "collapse", "adjustment", "preserveTransparency"] {
+        s.execute("layer.setSwitch", json!({"layers": [pre], "switch": sw, "value": true})).unwrap();
+    }
+    s.execute("layer.setSwitch", json!({"layers": [pre], "switch": "video", "value": false})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [pre], "parent": c})).unwrap();
+    s.execute("layer.setTrackMatte", json!({"layer": pre, "matte": c})).unwrap();
+    let undo = s.history.undo.len();
+    let before = whole_project(&s);
+    let r = s.execute("layer.unprecompose", json!({"layers": [pre], "force": true})).unwrap();
+    assert!(r["warnings"].as_array().unwrap().len() >= 10, "{r}");
+    // The undo history is capped (32 levels by default), so its length may stay; one undo is what
+    // takes the whole unpack back.
+    assert!(s.history.undo.len() == undo + 1 || s.history.undo.len() == undo, "one undo step");
+    assert!(whole_project(&s) != before, "it unpacked");
+    scene_look(&mut s);
+    assert!(s.history.redo.is_empty());
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.history.redo.len(), 1, "one undo step took it all back");
+    assert!(whole_project(&s) == before, "undo restores the exact project");
+}
+
+/// Quick Set Anchor (#2967): every one of the nine points moves the Anchor Point of a rotated,
+/// scaled layer with keyed Position to that point of its content, and the layer looks the same
+/// on every frame (Position and its keys are compensated), in one undo step.
+#[test]
+fn quick_set_anchor_moves_the_anchor_without_moving_the_layer_over_its_keys() {
+    let near = |a: [f64; 4], b: [f64; 4]| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-6);
+    // (name, anchor in the 200×100 solid's layer space)
+    let points = [
+        ("topLeft", [0.0, 0.0]),
+        ("top", [100.0, 0.0]),
+        ("topRight", [200.0, 0.0]),
+        ("left", [0.0, 50.0]),
+        ("center", [100.0, 50.0]),
+        ("right", [200.0, 50.0]),
+        ("bottomLeft", [0.0, 100.0]),
+        ("bottom", [100.0, 100.0]),
+        ("bottomRight", [200.0, 100.0]),
+    ];
+    for (name, want) in points {
+        let mut s = comp();
+        let a = solid(&mut s, "#ff0000");
+        s.execute("prop.set", json!({"layer": a, "path": "transform/scale", "value": [150, 80]})).unwrap();
+        s.execute("prop.set", json!({"layer": a, "path": "transform/rotation", "value": 30})).unwrap();
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/position", "time": 0, "value": [100, 80]})).unwrap();
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/position", "time": 1, "value": [400, 250]})).unwrap();
+        s.execute("prop.addKey", json!({"layer": a, "path": "transform/position", "time": 2, "value": [300, 60]})).unwrap();
+        let look = |s: &mut Session| {
+            [0.0, 0.4, 1.0, 1.5, 2.0]
+                .map(|t| {
+                    s.execute("time.set", json!({"time": t})).unwrap();
+                    seen_bounds(s, a)
+                })
+                .to_vec()
+        };
+        let before = look(&mut s);
+        let undo = s.history.undo.len();
+        s.execute("layer.quickSetAnchor", json!({"layers": [a], "point": name})).unwrap();
+        let anchor = layer(&s, a).transform().unwrap().get("anchor").unwrap().value.as_vec3();
+        assert!(anchor[0] == want[0] && anchor[1] == want[1], "{name}: anchor {anchor:?}, wanted {want:?}");
+        for (b, n) in before.iter().zip(look(&mut s)) {
+            assert!(near(*b, n), "{name}: the layer moved, {b:?} → {n:?}");
+        }
+        // The centre is where the anchor already is: nothing changes, so there's no undo step.
+        assert_eq!(s.history.undo.len(), undo + usize::from(name != "center"), "{name}: one undo step");
+        if name == "center" {
+            continue;
+        }
+        s.execute("edit.undo", json!({})).unwrap();
+        let back = layer(&s, a).transform().unwrap().get("anchor").unwrap().value.as_vec3();
+        assert_eq!(back[..2], [100.0, 50.0], "{name}: undo restores the anchor");
+    }
+}
+
+/// Same as above with Position split into X and Y, each with its own keys: both channels get the
+/// shift, so the layer still looks the same on every frame.
+#[test]
+fn quick_set_anchor_keeps_a_layer_with_separated_keyed_position_in_place() {
+    let mut s = comp();
+    let a = solid(&mut s, "#ff0000");
+    s.execute("prop.set", json!({"layer": a, "path": "transform/scale", "value": [150, 80]})).unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "transform/rotation", "value": 30})).unwrap();
+    s.execute("prop.separateDimensions", json!({"layer": a, "value": true})).unwrap();
+    for (path, values) in [("transform/positionX", [100.0, 400.0, 300.0]), ("transform/positionY", [80.0, 250.0, 60.0])] {
+        for (time, value) in [0.0, 1.0, 2.0].into_iter().zip(values) {
+            s.execute("prop.addKey", json!({"layer": a, "path": path, "time": time, "value": value})).unwrap();
+        }
+    }
+    let look = |s: &mut Session| {
+        [0.0, 0.4, 1.0, 1.5, 2.0]
+            .map(|t| {
+                s.execute("time.set", json!({"time": t})).unwrap();
+                seen_bounds(s, a)
+            })
+            .to_vec()
+    };
+    let before = look(&mut s);
+    s.execute("layer.quickSetAnchor", json!({"layers": [a], "point": "topLeft"})).unwrap();
+    let anchor = layer(&s, a).transform().unwrap().get("anchor").unwrap().value.as_vec3();
+    assert_eq!(anchor[..2], [0.0, 0.0], "the anchor moved to the top left");
+    for (b, n) in before.iter().zip(look(&mut s)) {
+        assert!(b.iter().zip(n).all(|(x, y)| (x - y).abs() < 1e-6), "the layer moved, {b:?} → {n:?}");
+    }
+}
+
+#[test]
+fn quick_set_anchor_skips_locked_and_3d_layers_and_checks_its_point() {
+    let mut s = comp();
+    let flat = solid(&mut s, "#00ff00");
+    let deep = solid(&mut s, "#0000ff");
+    let locked = solid(&mut s, "#ffffff");
+    s.execute("layer.setSwitch", json!({"layers": [deep], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [locked], "switch": "lock", "value": true})).unwrap();
+    let anchor_of = |s: &Session, l: u64| layer(s, l).transform().unwrap().get("anchor").unwrap().value.as_vec3();
+    let r = s.execute("layer.quickSetAnchor", json!({"layers": [flat, deep, locked], "point": "topLeft"})).unwrap();
+    assert_eq!(r["layers"], 1, "only the unlocked 2D layer changed");
+    assert_eq!(anchor_of(&s, flat)[..2], [0.0, 0.0]);
+    assert_eq!(anchor_of(&s, deep)[..2], [100.0, 50.0]);
+    assert_eq!(anchor_of(&s, locked)[..2], [100.0, 50.0]);
+    assert!(s.execute("layer.quickSetAnchor", json!({"layers": [deep], "point": "top"})).is_err(), "3D only: nothing to do");
+    assert!(s.execute("layer.quickSetAnchor", json!({"layers": [flat], "point": "middle"})).is_err());
+    assert!(s.execute("layer.quickSetAnchor", json!({"layers": [flat]})).is_err());
+}
+
+/// The anchor is set at the current time and the Position shift comes from the current Anchor
+/// Point, Scale and Rotation, so a layer where one of them is keyed would move at other frames:
+/// it is skipped, and alone it is an error.
+#[test]
+fn quick_set_anchor_skips_layers_whose_anchor_scale_or_rotation_is_keyed() {
+    for path in ["transform/anchor", "transform/scale", "transform/rotation"] {
+        let mut s = comp();
+        let flat = solid(&mut s, "#00ff00");
+        let keyed = solid(&mut s, "#0000ff");
+        let value = if path.ends_with("rotation") {
+            json!(0)
+        } else if path.ends_with("scale") {
+            json!([100, 100])
+        } else {
+            json!([100, 50])
+        };
+        let later = if path.ends_with("rotation") {
+            json!(90)
+        } else if path.ends_with("scale") {
+            json!([50, 50])
+        } else {
+            json!([20, 10])
+        };
+        s.execute("prop.addKey", json!({"layer": keyed, "path": path, "time": 0, "value": value})).unwrap();
+        s.execute("prop.addKey", json!({"layer": keyed, "path": path, "time": 2, "value": later})).unwrap();
+        let before = layer(&s, keyed);
+        let r = s.execute("layer.quickSetAnchor", json!({"layers": [flat, keyed], "point": "topLeft"})).unwrap();
+        assert_eq!(r["layers"], 1, "{path}: only the layer without keys changed");
+        assert_eq!(layer(&s, keyed), before, "{path}: the keyed layer is untouched");
+        assert!(s.execute("layer.quickSetAnchor", json!({"layers": [keyed], "point": "top"})).is_err(), "{path}: nothing to do");
+    }
+}
+
+/// An expression on Position (or on the separated X / Y) would override the shifted value, and
+/// Auto-Orient along the path adds a rotation the shift does not know: those layers are skipped.
+#[test]
+fn quick_set_anchor_skips_position_expressions_and_along_path_layers() {
+    for case in ["position", "positionX", "alongPath"] {
+        let mut s = comp();
+        let flat = solid(&mut s, "#00ff00");
+        let other = solid(&mut s, "#0000ff");
+        match case {
+            "alongPath" => {
+                s.execute("layer.autoOrient", json!({"layers": [other], "mode": "alongPath"})).unwrap();
+            }
+            "position" => {
+                s.execute("prop.setExpression", json!({"layer": other, "path": "transform/position", "expression": "[100, 50]"})).unwrap();
+            }
+            _ => {
+                s.execute("prop.separateDimensions", json!({"layer": other, "value": true})).unwrap();
+                s.execute("prop.setExpression", json!({"layer": other, "path": "transform/positionX", "expression": "100"})).unwrap();
+            }
+        }
+        let before = layer(&s, other);
+        let r = s.execute("layer.quickSetAnchor", json!({"layers": [flat, other], "point": "topLeft"})).unwrap();
+        assert_eq!(r["layers"], 1, "{case}: only the plain layer changed");
+        assert_eq!(layer(&s, other), before, "{case}: the layer is untouched");
+        assert!(s.execute("layer.quickSetAnchor", json!({"layers": [other], "point": "top"})).is_err(), "{case}: nothing to do");
+    }
+}
+
+/// A selection of only empty text layers (no content bounds) is an error, not a silent `{layers: 0}`;
+/// `layer.centerAnchor` keeps reporting 0 for it.
+#[test]
+fn quick_set_anchor_errors_when_no_layer_has_content_bounds() {
+    let mut s = comp();
+    let t = s.execute("layer.newText", json!({"text": ""})).unwrap()["layer"].as_u64().unwrap();
+    assert!(s.execute("layer.quickSetAnchor", json!({"layers": [t], "point": "center"})).is_err());
+    let r = s.execute("layer.centerAnchor", json!({"layers": [t]})).unwrap();
+    assert_eq!(r["layers"], 0);
+}
+
+/// A child of a rotated, scaled parent keeps its place when its anchor moves (Position is in the
+/// parent's space).
+#[test]
+fn quick_set_anchor_keeps_a_parented_layer_in_place() {
+    let mut s = comp();
+    let parent = solid(&mut s, "#ff0000");
+    let child = solid(&mut s, "#00ff00");
+    s.execute("prop.set", json!({"layer": parent, "path": "transform/rotation", "value": 25})).unwrap();
+    s.execute("prop.set", json!({"layer": parent, "path": "transform/scale", "value": [120, 70]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [child], "parent": parent})).unwrap();
+    s.execute("prop.set", json!({"layer": child, "path": "transform/rotation", "value": -40})).unwrap();
+    s.execute("prop.set", json!({"layer": child, "path": "transform/scale", "value": [60, 90]})).unwrap();
+    let before = seen_bounds(&s, child);
+    s.execute("layer.quickSetAnchor", json!({"layers": [child], "point": "bottomRight"})).unwrap();
+    let after = seen_bounds(&s, child);
+    assert!(before.iter().zip(after).all(|(a, b)| (a - b).abs() < 1e-6), "{before:?} → {after:?}");
+    assert_eq!(layer(&s, child).transform().unwrap().get("anchor").unwrap().value.as_vec3()[..2], [200.0, 100.0]);
+}
diff --git a/crates/engine/src/tests_model3d.rs b/crates/engine/src/tests/model3d.rs
similarity index 83%
rename from crates/engine/src/tests_model3d.rs
rename to crates/engine/src/tests/model3d.rs
index 40a165799..548e93b20 100644
--- a/crates/engine/src/tests_model3d.rs
+++ b/crates/engine/src/tests/model3d.rs
@@ -232,6 +232,43 @@ fn material_commands_and_serde() {
     assert_eq!(&back, &*s.project);
 }
 
+/// #2917: a 3D model layer keeps its file's materials, so it has no Base Color, Metallic or
+/// Roughness. material.set refused them with "no Material Options property matched (…,
+/// baseColor, metallic, roughness, …)", naming the very parameters it refused, and next to a
+/// parameter the layer does have it dropped them without a word.
+#[test]
+fn material_set_names_the_parameters_a_layer_lacks() {
+    let mut s = session();
+    let r = s.execute("file.import", json!({"paths": [fixture("quad.glb")]})).unwrap();
+    let item = r["items"][0].as_u64().unwrap();
+    let m = s.execute("layer.addItem", json!({"item": item})).unwrap()["layer"].as_u64().unwrap();
+    let e = s.execute_checked("material.set", json!({"layers": [m], "baseColor": "#3366ff", "roughness": 20})).unwrap_err().to_string();
+    assert!(e.contains("`baseColor`, `roughness`") && e.contains("model file") && e.contains("appearsInReflections"), "{e}");
+    assert!(!e.contains("`metallic`"), "{e}");
+    // A parameter the layer has doesn't hide one it lacks, and nothing is set.
+    assert!(s.execute_checked("material.set", json!({"layers": [m], "castsShadows": "on", "metallic": 50})).is_err());
+    assert_eq!(layer(&s, m).props.prop("materialOptions/castsShadows").unwrap().value, KV::Enum(0));
+    s.execute_checked("material.set", json!({"layers": [m], "castsShadows": "on"})).unwrap();
+    assert_eq!(layer(&s, m).props.prop("materialOptions/castsShadows").unwrap().value, KV::Enum(1));
+    // Across layers, a parameter goes to the ones that have it.
+    let cube = s.execute("layer.newPrimitive", json!({"kind": "cube"})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!(s.execute_checked("material.set", json!({"layers": [m, cube], "roughness": 20})).unwrap()["set"], 1);
+    assert_eq!(layer(&s, cube).props.prop("materialOptions/roughness").unwrap().value.as_f64(), 20.0);
+    // A solid has the classic shading, not the primitive's material.
+    let solid = s.execute("layer.newSolid", json!({"width": 64, "height": 32})).unwrap()["layer"].as_u64().unwrap();
+    let e = s.execute_checked("material.set", json!({"layers": [solid], "emissive": "#ffffff"})).unwrap_err().to_string();
+    assert!(e.contains("`emissive`") && e.contains("specularShininess"), "{e}");
+    assert!(s.execute_checked("material.set", json!({"layers": [m]})).is_err());
+    // The parameter list still names every parameter, or agents' calls are refused before they run.
+    let spec = crate::command_specs().iter().find(|c| c.id == "material.set").unwrap();
+    let keys = crate::commands::accepted_params(spec.params).unwrap();
+    let want = "layers time castsShadows acceptsShadows acceptsLights appearsInReflections baseColor metallic roughness emissive \
+                lightTransmission ambient diffuse specularIntensity specularShininess metal";
+    for k in want.split_whitespace() {
+        assert!(keys.iter().any(|a| a == k), "{k}: {keys:?}");
+    }
+}
+
 /// #264: only Advanced 3D draws models and primitives, and new comps are Classic 3D, so an
 /// imported model was invisible. Adding one switches the comp to Advanced 3D (in the same undo
 /// step, with a toast), as After Effects does.
diff --git a/crates/engine/src/tests/models.rs b/crates/engine/src/tests/models.rs
new file mode 100644
index 000000000..e1baab2d8
--- /dev/null
+++ b/crates/engine/src/tests/models.rs
@@ -0,0 +1,282 @@
+//! Settings ▸ Roto Brush and Settings ▸ Face Tracking: the model registry, choosing, installing
+//! (verified, with its notice) and loading trained models.
+
+use std::sync::Arc;
+
+use effectcraft_segment::Task;
+use serde_json::json;
+
+use crate::Session;
+use crate::config::{ConfigStore, DirConfig};
+
+fn session(tag: &str) -> (Session, std::path::PathBuf) {
+    let d = std::env::temp_dir().join(format!("ec-models-{tag}-{}", std::process::id()));
+    let store: Arc<dyn ConfigStore> = Arc::new(DirConfig::new(d.join("config")));
+    (Session { config: Some(store), ..Default::default() }, d)
+}
+
+#[test]
+fn model_list_and_direct_selection_agree_on_target_availability() {
+    super::roto::hold_roto_cache_test_lock();
+    let mut s = Session::default();
+    let list = s.execute_checked("roto.models", json!({})).unwrap();
+    let models = list["models"].as_array().unwrap();
+    for id in ["sam2.1-hiera-tiny", "sam2.1-hiera-small", "sam2.1-hiera-base-plus", "sam2.1-hiera-large"] {
+        let chosen = s.chosen_model(Task::Mask).to_string();
+        let generation = s.models.status(Task::Mask).generation;
+        let selected = s.execute_checked("roto.model.select", json!({"id": id}));
+        if cfg!(target_arch = "wasm32") {
+            assert!(!models.iter().any(|m| m["id"] == id));
+            assert!(selected.is_err());
+            assert_eq!(s.chosen_model(Task::Mask), chosen);
+            assert_eq!(s.models.status(Task::Mask).generation, generation, "rejection must not alter model state");
+        } else {
+            assert!(models.iter().any(|m| m["id"] == id));
+            selected.unwrap();
+            assert_eq!(s.chosen_model(Task::Mask), id);
+        }
+    }
+    s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+    assert_eq!(s.chosen_model(Task::Mask), "classical");
+    assert!(models.iter().any(|m| m["id"] == "mobilesam"));
+}
+
+/// Poll until `task`'s model is in use (or a few seconds pass).
+fn wait_loaded(s: &mut Session, task: Task) {
+    for _ in 0..400 {
+        s.poll_models();
+        if s.models.status(task).active.is_some() {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(20));
+    }
+}
+
+#[test]
+fn models_are_listed_chosen_and_verified() {
+    crate::tests::roto::hold_roto_cache_test_lock();
+    let (mut s, d) = session("list");
+    std::fs::create_dir_all(&d).unwrap();
+    let bogus = d.join("bogus.bin");
+    std::fs::write(&bogus, b"not the weights").unwrap();
+    for (prefix, model, task) in [("roto", "mobilesam", Task::Mask), ("face", "mediapipe-face", Task::Face)] {
+        let list = s.execute_checked(&format!("{prefix}.models"), json!({})).unwrap();
+        let ids: Vec<&str> = list["models"].as_array().unwrap().iter().map(|m| m["id"].as_str().unwrap()).collect();
+        // Roto Brush also offers SAM 2.1 in four sizes (video trackers; see crates/sam2).
+        let expect: Vec<&str> = if task == Task::Mask && !cfg!(target_arch = "wasm32") {
+            vec!["classical", model, "sam2.1-hiera-tiny", "sam2.1-hiera-small", "sam2.1-hiera-base-plus", "sam2.1-hiera-large"]
+        } else {
+            vec!["classical", model]
+        };
+        assert_eq!(ids, expect);
+        let m = &list["models"][1];
+        assert_eq!((m["licence"].as_str(), m["installed"].as_bool()), (Some("Apache-2.0"), Some(false)));
+        assert!(m["url"].as_str().unwrap().starts_with("https://") && !m["authors"].as_str().unwrap().is_empty());
+        // Unknown ids, the other task's models and files that aren't the published weights are
+        // refused.
+        let other = if task == Task::Mask { "mediapipe-face" } else { "mobilesam" };
+        for id in ["nope", other] {
+            assert!(s.execute_checked(&format!("{prefix}.model.select"), json!({"id": id})).is_err(), "{prefix} {id}");
+        }
+        let path = bogus.to_string_lossy();
+        let e = s.execute_checked(&format!("{prefix}.model.install"), json!({"path": path})).unwrap_err().to_string();
+        assert!(e.contains("SHA-256"), "{e}");
+        assert!(s.execute_checked(&format!("{prefix}.model.install"), json!({"path": path, "id": model})).is_err());
+        // Choosing a model that isn't installed keeps the classic engine.
+        s.execute_checked(&format!("{prefix}.model.select"), json!({"id": model})).unwrap();
+        assert_eq!(s.chosen_model(task), model);
+        assert!(s.models.status(task).active.is_none());
+        assert!(crate::prefs::pages().iter().any(|p| p.id == prefix));
+    }
+    assert!(s.models.face().is_none());
+    assert_eq!(crate::prefs::page_id("Face Tracking"), Some("face"));
+    // With the real weights (EFFECTCRAFT_MOBILESAM=path/to/mobile_sam.pt): install, load, use.
+    if let Ok(path) = std::env::var("EFFECTCRAFT_MOBILESAM") {
+        s.execute_checked("roto.model.install", json!({"path": path})).unwrap();
+        wait_loaded(&mut s, Task::Mask);
+        assert_eq!(s.models.status(Task::Mask).active.as_deref(), Some("mobilesam"));
+        // Roto Brush 3.0 (the default version) now segments with it.
+        let params = crate::effects::Params { values: [("version".to_string(), effectcraft_keyframe::Value::Enum(2))].into_iter().collect() };
+        assert_eq!(crate::effects::roto::model_for(&params).map(|m| m.info().id), Some("mobilesam"));
+        s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+        assert!(crate::effects::roto::model_for(&params).is_none());
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    verify_installed_sam2_sizes(&mut s);
+    // EFFECTCRAFT_FACE_LANDMARKER=path/to/face_landmarker.task: installed with its notice,
+    // loaded for face tracking, dropped when the classic tracker is chosen, removed.
+    if let Ok(path) = std::env::var("EFFECTCRAFT_FACE_LANDMARKER") {
+        let r = s.execute_checked("face.model.install", json!({"path": path})).unwrap();
+        assert_eq!(r["id"], "mediapipe-face");
+        let dir = s.models_dir().unwrap();
+        let notice = std::fs::read_to_string(dir.join("face_landmarker.task.NOTICE.txt")).unwrap();
+        assert!(notice.contains("Google LLC") && notice.contains("Apache-2.0"), "{notice}");
+        wait_loaded(&mut s, Task::Face);
+        assert_eq!(s.models.face().map(|m| m.info().id), Some("mediapipe-face"));
+        s.execute_checked("face.model.select", json!({"id": "classical"})).unwrap();
+        assert!(s.models.face().is_none());
+        assert_eq!(s.execute_checked("face.model.remove", json!({"id": "mediapipe-face"})).unwrap()["removed"], true);
+        assert!(!dir.join("face_landmarker.task").exists() && !dir.join("face_landmarker.task.NOTICE.txt").exists());
+    }
+    let _ = std::fs::remove_dir_all(d);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn verify_installed_sam2_sizes(s: &mut Session) {
+    // The SAM 2.1 sizes, each from its own file (EFFECTCRAFT_SAM2, _SAM2_SMALL, _SAM2_BASE_PLUS, _SAM2_LARGE =
+    // path/to/model.safetensors of facebook/sam2.1-hiera-*): installed with its notice, loaded (verified, native
+    // only) and used by Roto Brush 3.0, then dropped and removed.
+    for (var, id) in [
+        ("EFFECTCRAFT_SAM2", "sam2.1-hiera-tiny"),
+        ("EFFECTCRAFT_SAM2_SMALL", "sam2.1-hiera-small"),
+        ("EFFECTCRAFT_SAM2_BASE_PLUS", "sam2.1-hiera-base-plus"),
+        ("EFFECTCRAFT_SAM2_LARGE", "sam2.1-hiera-large"),
+    ] {
+        let Ok(path) = std::env::var(var) else { continue };
+        let r = s.execute_checked("roto.model.install", json!({"path": path})).unwrap();
+        assert_eq!(r["id"], id, "{var}");
+        let dir = s.models_dir().unwrap();
+        let notice = std::fs::read_to_string(dir.join(format!("{id}.safetensors.NOTICE.txt"))).unwrap();
+        assert!(notice.contains("Meta AI") && notice.contains("Apache-2.0"), "{notice}");
+        s.execute_checked("roto.model.select", json!({"id": id})).unwrap();
+        wait_loaded(s, Task::Mask);
+        assert_eq!(s.models.status(Task::Mask).active.as_deref(), Some(id), "{var}");
+        let params = crate::effects::Params { values: [("version".to_string(), effectcraft_keyframe::Value::Enum(2))].into_iter().collect() };
+        assert_eq!(crate::effects::roto::model_for(&params).map(|m| m.info().id), Some(id));
+        // the list says it is installed, and exactly one size is recommended
+        let list = s.execute_checked("roto.models", json!({})).unwrap();
+        let entry = list["models"].as_array().unwrap().iter().find(|m| m["id"] == id).unwrap();
+        assert_eq!(entry["installed"], true);
+        assert_eq!(list["models"].as_array().unwrap().iter().filter(|m| m["recommended"] == true).count(), 1);
+        s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+        assert!(crate::effects::roto::model_for(&params).is_none());
+        assert_eq!(s.execute_checked("roto.model.remove", json!({"id": id})).unwrap()["removed"], true);
+        assert!(!dir.join(format!("{id}.safetensors")).exists(), "{id} removed");
+    }
+}
+
+/// A Roto Brush model that has been idle for ten minutes is unloaded (the choice stays), one in use is not,
+/// and a model that does not track use is never unloaded.
+#[test]
+fn an_idle_roto_model_is_unloaded() {
+    use effectcraft_segment::{Loaded, MaskModel, ModelInfo, Prompt};
+    struct Fake(Option<f64>);
+    impl MaskModel for Fake {
+        fn info(&self) -> &'static ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Err("no weights".into())
+        }
+        fn idle_secs(&self) -> Option<f64> {
+            self.0
+        }
+    }
+    crate::tests::roto::hold_roto_cache_test_lock();
+    let (mut s, d) = session("idle");
+    for (idle, unloaded) in [(Some(5.0), false), (None, false), (Some(601.0), true)] {
+        let m: Arc<dyn MaskModel> = Arc::new(Fake(idle));
+        s.models.set_active(Task::Mask, Some(Loaded::Mask(m)));
+        assert_eq!(s.models.status(Task::Mask).active.as_deref(), Some("sam2.1-hiera-tiny"));
+        s.poll_models();
+        assert_eq!(s.models.status(Task::Mask).active.is_none(), unloaded, "idle {idle:?}");
+        assert_eq!(crate::effects::roto::installed_model().is_none(), unloaded, "the effect's model follows");
+        if unloaded {
+            assert!(s.events.iter().any(|e| matches!(e, crate::Event::Toast { message, .. } if message.contains("unloaded after 10 minutes"))));
+        }
+    }
+    // the choice survives, and with the classic engine chosen reloading does nothing
+    s.reload_roto_model();
+    assert!(s.models.status(Task::Mask).active.is_none());
+    crate::effects::roto::set_model(None);
+    let _ = std::fs::remove_dir_all(d);
+}
+
+/// A model that finishes loading after the choice changed is dropped, not activated.
+#[test]
+fn a_load_for_an_old_choice_does_not_activate() {
+    use effectcraft_segment::{Loaded, MaskModel, ModelInfo, Prompt};
+    struct Fake;
+    impl MaskModel for Fake {
+        fn info(&self) -> &'static ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Err("no weights".into())
+        }
+    }
+    super::roto::hold_roto_cache_test_lock();
+    let (mut s, d) = session("stale-load");
+    let started = s.models.status(Task::Mask).generation;
+    // the user picks another engine while the load runs
+    s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+    s.execute_checked("roto.model.select", json!({"id": "sam2.1-hiera-tiny"})).unwrap();
+    assert_ne!(s.models.status(Task::Mask).generation, started, "a changed choice is counted");
+    let m: Arc<dyn MaskModel> = Arc::new(Fake);
+    assert!(!s.models.set_active_if_current(Task::Mask, Loaded::Mask(m.clone()), started), "the stale load is dropped");
+    assert!(s.models.status(Task::Mask).active.is_none() && crate::effects::roto::installed_model().is_none());
+    let now = s.models.status(Task::Mask).generation;
+    assert!(s.models.set_active_if_current(Task::Mask, Loaded::Mask(m), now), "a load for the current choice activates");
+    assert_eq!(s.models.status(Task::Mask).active.as_deref(), Some("sam2.1-hiera-tiny"));
+    crate::effects::roto::set_model(None);
+    let _ = std::fs::remove_dir_all(d);
+}
+
+/// A stroke reloading an unloaded model never waits for the load and never retries one that already failed.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn reloading_for_a_stroke_does_not_block_or_retry_a_failed_load() {
+    super::roto::hold_roto_cache_test_lock();
+    let (mut s, d) = session("reload-failed");
+    let info = effectcraft_segment::info("mobilesam").unwrap();
+    let dir = s.models_dir().unwrap();
+    std::fs::create_dir_all(&dir).unwrap();
+    // the right size, the wrong content: found as installed, then fails to load
+    std::fs::File::create(dir.join(info.file_name)).unwrap().set_len(info.size).unwrap();
+    s.execute_checked("roto.model.select", json!({"id": "mobilesam"})).unwrap();
+    let t0 = std::time::Instant::now();
+    while s.models.status(Task::Mask).busy.is_some() && t0.elapsed().as_secs() < 30 {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let failed = s.models.status(Task::Mask).error;
+    assert!(failed.is_some(), "the unreadable file fails to load");
+    s.reload_roto_model();
+    let st = s.models.status(Task::Mask);
+    assert!(st.busy.is_none(), "a failed model is not loaded again by every stroke");
+    assert_eq!(st.error, failed);
+    s.poll_models();
+    let st = s.models.status(Task::Mask);
+    assert_eq!(st.error, failed, "polling must keep the actionable error until an explicit retry");
+    assert!(st.busy.is_none(), "a failed load must not restart on every poll");
+    // an unloaded, not failed model loads on the worker: the call returns with the load still pending or done
+    s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+    crate::effects::roto::set_model(None);
+    let _ = std::fs::remove_dir_all(d);
+}
+
+/// With `EFFECTCRAFT_DOWNLOAD_SIZE=mobilesam` (or another downloadable registry id): the in-app
+/// download verifies and loads the file. SAM 2 must refuse until a storytold mirror is available.
+/// Skipped without the variable: downloadable entries need the network and large files.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn downloading_a_size_installs_and_loads_it() {
+    let Ok(id) = std::env::var("EFFECTCRAFT_DOWNLOAD_SIZE") else { return };
+    crate::tests::roto::hold_roto_cache_test_lock();
+    let (mut s, d) = session("download");
+    let info = effectcraft_segment::info(&id).unwrap();
+    if info.url.is_empty() {
+        assert!(s.execute_checked("roto.model.download", json!({"id": id, "wait": true})).unwrap_err().to_string().contains("Install from File"));
+        return;
+    }
+    let r = s.execute_checked("roto.model.download", json!({"id": id, "wait": true})).unwrap();
+    assert_eq!(r["id"], id.as_str(), "{r}");
+    let dir = s.models_dir().unwrap();
+    let file = dir.join(info.file_name);
+    assert_eq!(std::fs::metadata(&file).unwrap().len(), info.size, "the whole file arrived");
+    assert!(dir.join(format!("{}.NOTICE.txt", info.file_name)).exists());
+    assert!(!dir.join(format!("{}.part", info.file_name)).exists(), "no partial file is left");
+    s.execute_checked("roto.model.select", json!({"id": id})).unwrap();
+    wait_loaded(&mut s, Task::Mask);
+    assert_eq!(s.models.status(Task::Mask).active.as_deref(), Some(id.as_str()));
+    let _ = std::fs::remove_dir_all(d);
+}
diff --git a/crates/engine/src/tests_motion_blur_depth.rs b/crates/engine/src/tests/motion_blur_depth.rs
similarity index 100%
rename from crates/engine/src/tests_motion_blur_depth.rs
rename to crates/engine/src/tests/motion_blur_depth.rs
diff --git a/crates/engine/src/tests_paint.rs b/crates/engine/src/tests/paint.rs
similarity index 80%
rename from crates/engine/src/tests_paint.rs
rename to crates/engine/src/tests/paint.rs
index db831ca96..2d2e540a5 100644
--- a/crates/engine/src/tests_paint.rs
+++ b/crates/engine/src/tests/paint.rs
@@ -225,6 +225,71 @@ fn a_pin_added_to_a_bent_mesh_moves_nothing() {
     }
 }
 
+fn mesh_count(s: &mut Session, id: u64) -> usize {
+    s.execute("puppet.info", json!({"layer": id})).unwrap()["meshes"].as_array().unwrap().len()
+}
+
+/// #2865: where the deformed layer is empty a click makes nothing: no copy of the art it has moved
+/// off, no undo step, no error.
+#[test]
+fn a_pin_where_the_deformed_layer_is_empty_creates_nothing() {
+    let (mut s, id) = setup();
+    s.execute("puppet.addPin", json!({"layer": id, "position": [10, 30]})).unwrap();
+    s.execute("puppet.addPin", json!({"layer": id, "position": [90, 30]})).unwrap();
+    s.set_time(Tick::from_seconds_f64(1.0));
+    s.execute("puppet.movePin", json!({"layer": id, "pin": "Puppet Pin 1", "position": [10, 70]})).unwrap();
+    s.execute("puppet.movePin", json!({"layer": id, "pin": "Puppet Pin 2", "position": [90, 70]})).unwrap();
+    let (cid, t) = (s.active_comp_id().unwrap(), Tick::from_seconds_f64(1.0));
+    let before = s.render(cid, t, RenderOpts::default());
+    let revision = s.revision;
+    let lid = effectcraft_project::LayerId(id);
+    // The solid's top, which the pins have carried 40 px down; and well off it.
+    for at in [[50, 10], [300, 300]] {
+        assert!(!crate::commands::puppet::places_pin(&s, cid, lid, [at[0] as f64, at[1] as f64], t), "{at:?}");
+        let r = s.execute("puppet.addPin", json!({"layer": id, "position": at})).unwrap();
+        assert_eq!(r["pin"], Value::Null, "{at:?}");
+        assert_eq!(s.revision, revision, "{at:?} changed the project");
+    }
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (1, 2));
+    assert_eq!(s.render(cid, t, RenderOpts::default()), before);
+    // Whatever Expansion new meshes would now get, the art is the mesh's own.
+    s.state.puppet.expansion = 9.0;
+    assert_eq!(s.execute("puppet.addPin", json!({"layer": id, "position": [50, 10]})).unwrap()["pin"], Value::Null);
+    // On the deformed shape a pin still goes on the mesh.
+    assert!(crate::commands::puppet::places_pin(&s, cid, lid, [50.0, 70.0], t));
+    assert!(s.execute("puppet.addPin", json!({"layer": id, "position": [50, 70]})).unwrap()["pin"].is_u64());
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (1, 3));
+}
+
+/// #2865: separate art still gets its own mesh, also from a near miss in the gap beside it (a click
+/// off the art finds the art nearest it): only a repeat of a mesh is refused.
+#[test]
+fn separate_art_still_gets_its_own_mesh() {
+    let (mut s, id) = setup();
+    for x in [[0, 30], [60, 100]] {
+        s.execute("mask.new", json!({"layer": id, "vertices": [[x[0], 0], [x[1], 0], [x[1], 60], [x[0], 60]], "closed": true})).unwrap();
+    }
+    s.execute("puppet.addPin", json!({"layer": id, "position": [10, 30]})).unwrap();
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (1, 1));
+    // In the gap, nearer the right piece and past reach of the left piece's mesh.
+    s.execute("puppet.addPin", json!({"layer": id, "position": [46, 30]})).unwrap();
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (2, 2), "the near miss meshes the right piece");
+    s.undo();
+    s.execute("puppet.addPin", json!({"layer": id, "position": [80, 30]})).unwrap();
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (2, 2), "the right piece gets its own mesh");
+    s.execute("puppet.addPin", json!({"layer": id, "position": [80, 50]})).unwrap();
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (2, 3), "and the next pin goes on it");
+}
+
+/// `newMesh` asks for a new mesh wherever the click is, the art's own mesh or not.
+#[test]
+fn new_mesh_option_starts_a_mesh_on_meshed_art() {
+    let (mut s, id) = setup();
+    s.execute("puppet.addPin", json!({"layer": id, "position": [10, 30]})).unwrap();
+    s.execute("puppet.addPin", json!({"layer": id, "position": [50, 30], "newMesh": true})).unwrap();
+    assert_eq!((mesh_count(&mut s, id), pin_count(&s, id)), (2, 2));
+}
+
 #[test]
 fn puppet_pin_kinds_and_mesh_options() {
     let (mut s, id) = setup();
@@ -308,6 +373,45 @@ fn puppet_select_all_takes_the_pin_kind_and_several_pins_record_together() {
     assert!(s.execute("puppet.recordPin", json!({"layer": id, "pin": a, "pins": [st], "samples": samples})).is_err());
 }
 
+/// Editing a parameter of one of several selected pins edits the same parameter of the others,
+/// in one undo step; unselected pins keep theirs (#1751).
+#[test]
+fn editing_one_selected_pin_edits_the_other_selected_pins() {
+    let (mut s, id) = setup();
+    let pin = |s: &mut Session, x: i64| s.execute("puppet.addPin", json!({"layer": id, "position": [x, 30]})).unwrap()["pin"].as_u64().unwrap();
+    let (a, b, c) = (pin(&mut s, 10), pin(&mut s, 50), pin(&mut s, 90));
+    let position = |s: &Session, pin: u64| layer(s, id).props.find_group(pin).unwrap().get("position").unwrap().clone();
+    let (pa, pb) = (position(&s, a).uid, position(&s, b).uid);
+    let at = |s: &Session, pin: u64| position(s, pin).value_at(Tick::ZERO).components();
+    s.execute("prop.select", json!({"layer": id, "prop": a, "selectKeys": false})).unwrap();
+    s.execute("prop.select", json!({"layer": id, "prop": b, "selectKeys": false, "add": true})).unwrap();
+
+    // A typed value lands on both selected pins, and one Undo takes it back.
+    let steps = s.history.undo.len();
+    s.execute("prop.set", json!({"layer": id, "prop": pa, "value": [20, 40], "selected": true})).unwrap();
+    assert_eq!((at(&s, a), at(&s, b), at(&s, c)), (vec![20.0, 40.0], vec![20.0, 40.0], vec![90.0, 30.0]));
+    assert_eq!(s.history.undo.len(), steps + 1, "one undo step");
+    s.undo();
+    assert_eq!((at(&s, a), at(&s, b)), (vec![10.0, 30.0], vec![50.0, 30.0]));
+
+    // A scrub moves each selected pin by the same change from its own value.
+    s.execute("prop.set", json!({"layer": id, "prop": pb, "value": [55, 25], "selected": true, "offset": true})).unwrap();
+    assert_eq!((at(&s, a), at(&s, b), at(&s, c)), (vec![15.0, 25.0], vec![55.0, 25.0], vec![90.0, 30.0]));
+
+    // The stopwatch follows on both (a new pin starts keyed, so the toggle turns it off).
+    let animated = |s: &Session| [a, b, c].map(|p| position(s, p).is_animated());
+    assert_eq!(animated(&s), [true; 3]);
+    s.execute("prop.toggleAnimation", json!({"layer": id, "prop": pa, "selected": true})).unwrap();
+    assert_eq!(animated(&s), [false, false, true]);
+
+    // Without `selected`, or with only one pin selected, the edit stays on its own pin.
+    s.execute("prop.set", json!({"layer": id, "prop": pa, "value": [0, 0]})).unwrap();
+    assert_eq!(at(&s, b), vec![55.0, 25.0]);
+    s.execute("prop.select", json!({"layer": id, "prop": a, "selectKeys": false})).unwrap();
+    s.execute("prop.set", json!({"layer": id, "prop": pa, "value": [5, 5], "selected": true})).unwrap();
+    assert_eq!(at(&s, b), vec![55.0, 25.0]);
+}
+
 fn expr_of(s: &Session, layer: u64, uid: u64) -> String {
     let l = layer_of(s, layer);
     l.props.find(uid).and_then(|p| p.expr.as_ref()).map(|e| e.text.clone()).unwrap_or_default()
diff --git a/crates/engine/src/tests_panels.rs b/crates/engine/src/tests/panels.rs
similarity index 86%
rename from crates/engine/src/tests_panels.rs
rename to crates/engine/src/tests/panels.rs
index b442d7c3a..547b7f100 100644
--- a/crates/engine/src/tests_panels.rs
+++ b/crates/engine/src/tests/panels.rs
@@ -321,6 +321,58 @@ fn content_aware_fill_removes_an_object() {
     assert!(s2.execute("contentFill.generate", json!({"wait": true, "outputDir": tmp("caf2").to_string_lossy()})).is_err());
 }
 
+/// A scratch folder that cannot be created surfaces as an error, not a cancelled fill or a
+/// black frame (#2570 review).
+#[test]
+fn content_aware_fill_reports_a_spill_failure() {
+    let (mut s, _, _, _) = setup(48, 32, 0.2, |f| {
+        let mut img = Image::new(48, 32);
+        for y in 0..32 {
+            for x in 0..48 {
+                img.set(x, y, bg(x as f32 + f as f32, y as f32));
+            }
+        }
+        img
+    });
+    s.execute("layer.addMask", json!({"rect": [20.0, 10.0, 8.0, 8.0], "mode": "subtract"})).unwrap();
+    let dir = tmp("cafspill");
+    std::fs::create_dir_all(&dir).unwrap();
+    let file = dir.join("not-a-folder");
+    std::fs::write(&file, b"x").unwrap();
+    // The fill wants to create its spill here; the parent is a file.
+    let out = file.join("fills");
+    let e = s.execute("contentFill.generate", json!({"method": "object", "outputDir": out.to_string_lossy(), "wait": true})).unwrap_err();
+    // The OS wording differs ("Not a directory" on Unix, "Cannot create a file when that file
+    // already exists" on Windows), so look for the fill's own marker.
+    let msg = e.to_string();
+    assert!(msg.contains("spill: cannot make the scratch file"), "not a spill error: {msg}");
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
+/// A fill plan that comes back without files or frames (a job worker that wrote none) is an
+/// error, not a crash on the first file (#2570 review).
+#[test]
+fn content_aware_fill_without_files_is_an_error() {
+    let (mut s, cid, lid, _) = setup(48, 32, 0.2, |_| Image::filled(48, 32, [0.5, 0.5, 0.5, 1.0]));
+    let plan = crate::commands::content_fill::FillPlan {
+        comp: cid,
+        layer: lid,
+        name: "Clip".into(),
+        width: 48,
+        height: 32,
+        times: vec![Tick::ZERO],
+        method: "object".into(),
+        lighting: 0.0,
+        expand: 0,
+        reference: None,
+        dir: "Clip_Fill_1".into(),
+    };
+    assert!(crate::commands::content_fill::apply_plan(&mut s, &plan, vec![]).is_err());
+    let empty = crate::commands::content_fill::FillPlan { times: vec![], ..plan };
+    assert!(crate::commands::content_fill::apply_plan(&mut s, &empty, vec!["Clip_Fill_1/fill_00000.png".into()]).is_err());
+    assert_eq!(s.project.comp(cid).unwrap().layers.len(), 1, "no fill layer was added");
+}
+
 #[test]
 fn content_aware_fill_runs_in_the_background() {
     let (mut s, _, _, _) = setup(48, 32, 0.2, |f| {
@@ -672,3 +724,47 @@ fn footage_that_cannot_be_decoded_reports_why() {
     s.execute("footage.open", json!({"item": item.0})).unwrap();
     assert_eq!(s.execute("footage.info", json!({})).unwrap()["problem"], it["problem"]);
 }
+
+/// A proxy in use that can't be decoded leaves its item without a picture although the item's
+/// own file is fine: `project.summary` and `footage.info` give the proxy's reason, said to be the
+/// proxy's, for footage and compositions alike, and nothing once Use Proxy is off.
+#[test]
+fn a_proxy_in_use_that_cannot_be_decoded_reports_why() {
+    struct BrokenProxies;
+    impl FootageSource for BrokenProxies {
+        fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
+            None
+        }
+        fn problem(&self, f: &Footage) -> Option<String> {
+            f.path.ends_with(".avi").then(|| format!("{} isn't supported by the built-in decoder", f.codec))
+        }
+    }
+    let mut s = Session { footage: Arc::new(BrokenProxies), ..Default::default() };
+    let comp = s.execute("comp.new", json!({"name": "C", "width": 64, "height": 36, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    let still = Footage { kind: FootageKind::Still, path: "a.png".into(), width: 64, height: 36, has_video: true, ..Default::default() };
+    let item = std::sync::Arc::make_mut(&mut s.project).add_item("Plate", Default::default(), None, ItemKind::Footage(still));
+    let proxy = Footage {
+        kind: FootageKind::Video,
+        path: "plate.avi".into(),
+        codec: "MPEG-4 Part 2".into(),
+        width: 32,
+        height: 18,
+        has_video: true,
+        ..Default::default()
+    };
+    let want = json!("Proxy: MPEG-4 Part 2 isn't supported by the built-in decoder");
+    let problem = |s: &mut Session, id: u64| {
+        let sum = s.execute("project.summary", json!({})).unwrap();
+        sum["items"].as_array().unwrap().iter().find(|i| i["id"] == json!(id)).unwrap().get("problem").cloned()
+    };
+    for id in [item.0, comp] {
+        let p = std::sync::Arc::make_mut(&mut s.project);
+        p.items.get_mut(&ItemId(id)).unwrap().proxy = Some(Box::new(effectcraft_project::Proxy { footage: proxy.clone(), enabled: true }));
+        assert_eq!(problem(&mut s, id), Some(want.clone()), "item {id}");
+        std::sync::Arc::make_mut(&mut s.project).items.get_mut(&ItemId(id)).unwrap().proxy.as_mut().unwrap().enabled = false;
+        assert_eq!(problem(&mut s, id), None, "item {id}: its own file shows, and is fine");
+    }
+    std::sync::Arc::make_mut(&mut s.project).items.get_mut(&item).unwrap().proxy.as_mut().unwrap().enabled = true;
+    s.execute("footage.open", json!({"item": item.0})).unwrap();
+    assert_eq!(s.execute("footage.info", json!({})).unwrap()["problem"], want);
+}
diff --git a/crates/engine/src/tests_project_items.rs b/crates/engine/src/tests/project_items.rs
similarity index 100%
rename from crates/engine/src/tests_project_items.rs
rename to crates/engine/src/tests/project_items.rs
diff --git a/crates/engine/src/tests/proxy.rs b/crates/engine/src/tests/proxy.rs
new file mode 100644
index 000000000..40927b8b8
--- /dev/null
+++ b/crates/engine/src/tests/proxy.rs
@@ -0,0 +1,566 @@
+//! Proxies (Set Proxy, Use Proxy, Proxy Use render settings, comp proxies, Create Proxy) and
+//! Interpret Footage (fields, pixel aspect, alpha guess / invert, linear light, Cineon Settings),
+//! rendered through a synthetic footage source.
+
+use std::sync::Arc;
+
+use effectcraft_project::render_queue::ProxyUse;
+use effectcraft_project::{AlphaMode, Footage, FootageKind, ItemId, ItemKind};
+use effectcraft_raster::Image;
+use effectcraft_time::{FrameRate, Tick};
+use serde_json::json;
+
+use crate::Session;
+use crate::render::{FootageSource, RenderOpts};
+
+/// Files by name: `red16.png` (16×16 red), `blue8.png` (8×8 blue), `lines.mov` (interlaced:
+/// even rows red, odd rows blue; 4×4, 10 fps), `flash.mov` (10×10, 10 fps: red, then blue from
+/// the second frame), `matte_black.png` / `matte_white.png` (a
+/// semi-transparent green premultiplied against black / white, read as straight), `half.png`
+/// (white at 25 % alpha), `wide.png` (10×10 white).
+struct Synthetic;
+
+fn file_px(path: &str, x: u32, y: u32) -> [f32; 4] {
+    let name = std::path::Path::new(path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("");
+    match name {
+        "red16.png" => [1.0, 0.0, 0.0, 1.0],
+        "blue8.png" => [0.0, 0.0, 1.0, 1.0],
+        "lines.mov" => {
+            if y.is_multiple_of(2) {
+                [1.0, 0.0, 0.0, 1.0]
+            } else {
+                [0.0, 0.0, 1.0, 1.0]
+            }
+        }
+        // Straight interpretation of a file whose colour is green·a + matte·(1 − a), a = 0.5.
+        "matte_black.png" => [0.0, 0.5, 0.0, 0.5],
+        "matte_white.png" => [0.5, 1.0, 0.5, 0.5],
+        "half.png" => [1.0, 1.0, 1.0, 0.25],
+        // A log film scan: code values 95, 685, 400 and 1023 across, as the DPX reader hands
+        // them out (code / 1023).
+        "scan.dpx" | "plate.dpx" => {
+            let v = [95.0, 685.0, 400.0, 1023.0][x.min(3) as usize] / 1023.0;
+            [v, v, v, 1.0]
+        }
+        _ => {
+            let _ = x;
+            [1.0, 1.0, 1.0, 1.0]
+        }
+    }
+}
+
+fn size_of(path: &str) -> (u32, u32) {
+    match std::path::Path::new(path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("") {
+        "red16.png" => (16, 16),
+        "blue8.png" => (8, 8),
+        "lines.mov" | "matte_black.png" | "matte_white.png" | "half.png" | "scan.dpx" | "plate.dpx" => (4, 4),
+        _ => (10, 10),
+    }
+}
+
+impl FootageSource for Synthetic {
+    fn frame(&self, _: ItemId, f: &Footage, t: Tick) -> Option<Arc<Image>> {
+        let (w, h) = size_of(&f.path);
+        let mut img = Image::new(w, h);
+        // `flash.mov` is red for its first frame and blue from its second (0.1 s) on.
+        if f.path.ends_with("flash.mov") {
+            let c = if t.seconds() >= 0.1 - 1e-9 { [0.0, 0.0, 1.0, 1.0] } else { [1.0, 0.0, 0.0, 1.0] };
+            return Some(Arc::new(Image::filled(w, h, c)));
+        }
+        for y in 0..h {
+            for x in 0..w {
+                // Decoders hand out premultiplied pixels (straight file colour × alpha).
+                let mut p = file_px(&f.path, x, y);
+                // A log scan sequence: code 95 on even frames, 685 on odd ones.
+                if f.path.ends_with("frames.dpx") {
+                    let v = if f.frame_rate.frame_at(t) % 2 == 0 { 95.0 } else { 685.0 } / 1023.0;
+                    p = [v, v, v, 1.0];
+                }
+                img.set(x, y, [p[0] * p[3], p[1] * p[3], p[2] * p[3], p[3]]);
+            }
+        }
+        Some(Arc::new(img))
+    }
+}
+
+struct Probe;
+impl crate::Importer for Probe {
+    fn probe(&self, path: &str) -> Result<Footage, String> {
+        let (w, h) = size_of(path);
+        let video = path.ends_with(".mov") || path.ends_with("frames.dpx");
+        Ok(Footage {
+            path: path.into(),
+            kind: if video { FootageKind::Video } else { FootageKind::Still },
+            width: w,
+            height: h,
+            has_video: true,
+            frame_rate: FrameRate::from_f64(10.0),
+            duration: Tick::from_seconds_f64(if video { 2.0 } else { 0.0 }),
+            ..Default::default()
+        })
+    }
+}
+
+fn session() -> Session {
+    Session { footage: Arc::new(Synthetic), importer: Some(Arc::new(Probe)), ..Default::default() }
+}
+
+fn import(s: &mut Session, path: &str) -> ItemId {
+    ItemId(s.execute("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap())
+}
+
+fn px(s: &Session, comp: ItemId, t: f64, opts: RenderOpts, x: i64, y: i64) -> [f32; 4] {
+    s.render(comp, Tick::from_seconds_f64(t), opts).get(x, y)
+}
+
+fn red(p: [f32; 4]) -> bool {
+    p[0] > 0.99 && p[2] < 0.01 && p[3] > 0.99
+}
+fn blue(p: [f32; 4]) -> bool {
+    p[2] > 0.99 && p[0] < 0.01 && p[3] > 0.99
+}
+
+#[test]
+fn footage_proxy_follows_use_proxy_and_proxy_use() {
+    let mut s = session();
+    let full = import(&mut s, "/m/red16.png");
+    s.execute("comp.new", json!({"name": "C", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
+    let c = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": full.0})).unwrap();
+    let o = RenderOpts::default();
+    assert!(red(px(&s, c, 0.0, o, 8, 8)));
+    s.execute("file.setProxy", json!({"item": full.0, "path": "/m/blue8.png"})).unwrap();
+    // The 8×8 proxy fills the 16×16 footage frame.
+    for (x, y) in [(1, 1), (8, 8), (14, 14)] {
+        assert!(blue(px(&s, c, 0.0, o, x, y)), "proxy at {x},{y}");
+    }
+    assert!(s.project.item(full).unwrap().proxy.as_ref().unwrap().enabled);
+    // Render Settings ▸ Proxy Use.
+    assert!(red(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseNone, ..o }, 8, 8)));
+    assert!(red(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseCompOnly, ..o }, 8, 8)));
+    // Use Proxy off: the viewer shows the source, Use All Proxies still uses it.
+    s.execute("file.useProxy", json!({"item": full.0})).unwrap();
+    assert!(!s.project.item(full).unwrap().proxy.as_ref().unwrap().enabled);
+    assert!(red(px(&s, c, 0.0, o, 8, 8)));
+    assert!(blue(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseAll, ..o }, 8, 8)));
+    // Undo / Set Proxy ▸ None.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(blue(px(&s, c, 0.0, o, 8, 8)));
+    s.execute("file.setProxyNone", json!({"item": full.0})).unwrap();
+    assert!(s.project.item(full).unwrap().proxy.is_none());
+    assert!(red(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseAll, ..o }, 8, 8)));
+    // Render queue items carry Proxy Use (Best Settings: none).
+    let r = s.execute("renderQueue.add", json!({"proxyUse": "all"})).unwrap();
+    assert_eq!(s.project.render_queue[0].settings.proxy_use, ProxyUse::UseAll, "{r}");
+    assert_eq!(effectcraft_project::render_queue::RenderSettings::default().proxy_use, ProxyUse::UseNone);
+}
+
+#[test]
+fn comp_proxy_and_create_proxy() {
+    let mut s = session();
+    s.execute("comp.new", json!({"name": "Inner", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
+    let inner = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
+    let outer = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": inner.0})).unwrap();
+    let o = RenderOpts::default();
+    assert!(red(px(&s, outer, 0.0, o, 8, 8)));
+    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/blue8.png"})).unwrap();
+    assert!(blue(px(&s, outer, 0.0, o, 14, 1)));
+    assert!(blue(px(&s, outer, 0.0, RenderOpts { proxy: ProxyUse::UseCompOnly, ..o }, 8, 8)));
+    assert!(red(px(&s, outer, 0.0, RenderOpts { proxy: ProxyUse::UseNone, ..o }, 8, 8)));
+    s.execute("file.setProxyNone", json!({"item": inner.0})).unwrap();
+    // Create Proxy queues a half-resolution render whose post-render action sets the proxy.
+    s.state.project_selection = vec![inner];
+    let r = s.execute("file.createProxy", json!({"kind": "still"})).unwrap();
+    let it = s.project.render_queue.last().unwrap().clone();
+    assert_eq!(it.comp, inner);
+    assert_eq!(it.post_render, effectcraft_project::render_queue::PostRenderAction::SetProxy);
+    assert_eq!(it.settings.resolution, 0.5);
+    assert!(r["output"].as_str().unwrap().contains("Inner_proxy_"), "{r}");
+    let m = s.execute("file.createProxy", json!({"kind": "movie", "comp": inner.0})).unwrap();
+    assert!(m["output"].as_str().unwrap().ends_with("Inner_proxy.mov"), "{m}");
+    // The post-render action (what a finished render runs) attaches the file.
+    let id = it.id;
+    s.post_render_action(id, "/m/blue8.png").unwrap();
+    assert_eq!(s.project.item(inner).unwrap().proxy.as_ref().unwrap().footage.path, "/m/blue8.png");
+    assert!(blue(px(&s, outer, 0.0, o, 8, 8)));
+}
+
+/// Outer (4×4, 20 fps) holding a layer of Inner (4×4, 10 fps, a red solid): (inner, outer).
+fn nested(s: &mut Session) -> (ItemId, ItemId) {
+    s.execute("comp.new", json!({"name": "Inner", "width": 4, "height": 4, "frameRate": 10, "duration": 2})).unwrap();
+    let inner = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 4, "height": 4, "frameRate": 20, "duration": 2})).unwrap();
+    let outer = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": inner.0})).unwrap();
+    (inner, outer)
+}
+
+/// Interpret Footage ▸ Proxy's Invert Alpha and Interpret As Linear Light change what a
+/// composition proxy draws, as they do for the same file used as footage.
+#[test]
+fn comp_proxy_draws_with_its_interpretation() {
+    let mut s = session();
+    let (inner, outer) = nested(&mut s);
+    let o = RenderOpts::default();
+    // Invert Alpha: the 25 % proxy covers 75 %.
+    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/half.png"})).unwrap();
+    s.execute("file.interpretProxy", json!({"item": inner.0, "alpha": "straight", "invertAlpha": true})).unwrap();
+    let p = px(&s, outer, 0.0, o, 1, 1);
+    assert!((p[3] - 0.75).abs() < 0.01, "{p:?}");
+    // Interpret As Linear Light: the proxy draws as the file does as footage with that setting.
+    let f = import(&mut s, "/m/matte_black.png");
+    s.execute("file.interpretFootage", json!({"item": f.0, "linearLight": true})).unwrap();
+    s.execute("comp.new", json!({"name": "Ref", "width": 4, "height": 4, "frameRate": 20, "duration": 2})).unwrap();
+    let r = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": f.0})).unwrap();
+    let want = px(&s, r, 0.0, o, 1, 1);
+    assert!(want[1] / want[3] > 0.7, "linear light re-encodes the 0.5 green: {want:?}");
+    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/matte_black.png"})).unwrap();
+    s.execute("file.interpretProxy", json!({"item": inner.0, "linearLight": true})).unwrap();
+    let p = px(&s, outer, 0.0, o, 1, 1);
+    assert!((0..4).all(|i| (p[i] - want[i]).abs() < 1e-3), "{p:?} != {want:?}");
+}
+
+/// Interpret Footage ▸ Proxy ▸ Separate Fields: a composition proxy shows one field per frame
+/// at twice the rate, as footage does.
+#[test]
+fn comp_proxy_separates_fields() {
+    let mut s = session();
+    let (inner, outer) = nested(&mut s);
+    let o = RenderOpts::default();
+    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/lines.mov"})).unwrap();
+    assert!(red(px(&s, outer, 0.05, o, 1, 0)) && blue(px(&s, outer, 0.05, o, 1, 1)), "progressive");
+    s.execute("file.interpretProxy", json!({"item": inner.0, "fields": "upper"})).unwrap();
+    // At 0.05 s the lower field (odd rows, blue) is shown, with the even rows interpolated.
+    for y in 0..3 {
+        assert!(blue(px(&s, outer, 0.05, o, 1, y)), "lower field at row {y}");
+    }
+}
+
+/// Frame Blending on a precomp layer blends the frames of the composition's proxy.
+#[test]
+fn comp_proxy_frames_blend() {
+    let mut s = session();
+    let (inner, outer) = nested(&mut s);
+    let o = RenderOpts::default();
+    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/flash.mov"})).unwrap();
+    assert!(red(px(&s, outer, 0.05, o, 1, 1)));
+    s.execute("layer.frameBlending", json!({"mode": "frameMix"})).unwrap();
+    s.execute("comp.setSwitch", json!({"switch": "frameBlending", "value": true})).unwrap();
+    // Halfway between the red first frame and the blue second one.
+    let p = px(&s, outer, 0.05, o, 1, 1);
+    assert!((p[0] - 0.5).abs() < 0.05 && (p[2] - 0.5).abs() < 0.05 && p[3] > 0.99, "{p:?}");
+    assert!(blue(px(&s, outer, 0.1, o, 1, 1)));
+}
+
+#[test]
+fn comp_proxy_frame_blend_cache_tracks_alpha_interpretation() {
+    struct Interpreted(std::sync::atomic::AtomicUsize);
+    impl FootageSource for Interpreted {
+        fn frame(&self, _: ItemId, f: &Footage, _: Tick) -> Option<Arc<Image>> {
+            self.0.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            let pixel = match f.alpha {
+                AlphaMode::Straight => [0.4, 0.2, 0.1, 0.5],
+                AlphaMode::Premultiplied => [f.premul_color[0] * 0.5, 0.1, 0.0, 0.5],
+                AlphaMode::Ignore => [0.8, 0.4, 0.2, 1.0],
+            };
+            Some(Arc::new(Image::filled(4, 4, pixel)))
+        }
+    }
+    for mode in ["frameMix", "pixelMotion"] {
+        let mut s = session();
+        let footage = Arc::new(Interpreted(std::sync::atomic::AtomicUsize::new(0)));
+        s.footage = footage.clone();
+        let (inner, outer) = nested(&mut s);
+        s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/alpha.mov"})).unwrap();
+        s.execute("file.interpretProxy", json!({"item": inner.0, "alpha": "straight"})).unwrap();
+        s.execute("layer.frameBlending", json!({"mode": mode})).unwrap();
+        s.execute("comp.setSwitch", json!({"switch": "frameBlending", "value": true})).unwrap();
+        let opts = RenderOpts::default();
+        let first = px(&s, outer, 0.05, opts, 1, 1);
+        let calls = footage.0.load(std::sync::atomic::Ordering::Relaxed);
+        assert_eq!(px(&s, outer, 0.05, opts, 1, 1), first);
+        assert_eq!(footage.0.load(std::sync::atomic::Ordering::Relaxed), calls);
+        for params in [
+            json!({"item": inner.0, "alpha": "ignore"}),
+            json!({"item": inner.0, "alpha": "premultiplied", "premulColor": [0.0, 0.0, 0.0]}),
+            json!({"item": inner.0, "alpha": "premultiplied", "premulColor": [1.0, 0.0, 0.0]}),
+        ] {
+            s.execute("file.interpretProxy", params.clone()).unwrap();
+            let mut fresh = s.renderer(opts);
+            fresh.cache = None;
+            let want = fresh.comp_frame(outer, Tick::from_seconds_f64(0.05)).get(1, 1);
+            let actual = px(&s, outer, 0.05, opts, 1, 1);
+            assert_eq!(actual, want, "{mode} after {params}");
+        }
+    }
+}
+
+#[test]
+fn interpret_proxy_settings_apply_to_the_proxy() {
+    let mut s = session();
+    let full = import(&mut s, "/m/red16.png");
+    s.execute("file.setProxy", json!({"item": full.0, "path": "/m/half.png"})).unwrap();
+    s.execute("file.interpretProxy", json!({"item": full.0, "alpha": "ignore", "invertAlpha": true})).unwrap();
+    let px = s.project.item(full).unwrap().proxy.clone().unwrap();
+    assert_eq!(px.footage.alpha, AlphaMode::Ignore);
+    assert!(px.footage.invert_alpha);
+    let f = match &s.project.item(full).unwrap().kind {
+        ItemKind::Footage(f) => f.clone(),
+        _ => panic!("not footage"),
+    };
+    assert_eq!(f.alpha, AlphaMode::Straight, "the main footage keeps its interpretation");
+}
+
+/// Agents and the control channel run commands through `execute_checked`, which refuses keys a
+/// params doc does not list. The Interpret Footage commands list every key they read.
+#[test]
+fn interpret_commands_accept_their_keys_when_checked() {
+    let mut s = session();
+    let mov = import(&mut s, "/m/lines.mov");
+    let b = import(&mut s, "/m/red16.png");
+    s.execute("file.setProxy", json!({"item": mov.0, "path": "/m/lines.mov"})).unwrap();
+    s.execute("file.setProxy", json!({"item": b.0, "path": "/m/matte_black.png"})).unwrap();
+    s.execute_checked("file.interpretProxy", json!({"item": mov.0, "preserveRgb": true, "overrideStart": true, "startTimecode": 25})).unwrap();
+    let px = s.project.item(mov).unwrap().proxy.clone().unwrap().footage;
+    assert!(px.preserve_rgb);
+    assert_eq!(px.start_timecode, Some(25));
+    s.execute_checked("file.interpretProxy", json!({"item": mov.0, "overrideStart": false})).unwrap();
+    assert_eq!(s.project.item(mov).unwrap().proxy.as_ref().unwrap().footage.start_timecode, None);
+    s.execute_checked("file.interpretProxy", json!({"item": b.0, "guessAlpha": true})).unwrap();
+    assert_eq!(s.project.item(b).unwrap().proxy.as_ref().unwrap().footage.alpha, AlphaMode::Premultiplied);
+    s.execute_checked("file.interpretProxy", json!({"item": b.0, "premulColor": [1.0, 0.0, 0.0]})).unwrap();
+    assert_eq!(s.project.item(b).unwrap().proxy.as_ref().unwrap().footage.premul_color, [1.0, 0.0, 0.0]);
+    // `item` names one footage item, as `items` names several.
+    s.execute_checked("file.interpretFootage", json!({"item": b.0, "invertAlpha": true, "premulColor": [0.0, 1.0, 0.0]})).unwrap();
+    s.execute_checked("file.rememberInterpretation", json!({"item": b.0})).unwrap();
+    s.execute_checked("file.applyInterpretation", json!({"item": mov.0})).unwrap();
+    let f = match &s.project.item(mov).unwrap().kind {
+        ItemKind::Footage(f) => f.clone(),
+        _ => panic!("not footage"),
+    };
+    assert!(f.invert_alpha);
+    assert_eq!(f.premul_color, [0.0, 1.0, 0.0]);
+    assert_eq!(s.execute_checked("file.reloadFootage", json!({"item": mov.0})).unwrap()["reloaded"], 1);
+}
+
+/// Separate Fields: each field becomes a frame at twice the frame rate, the other field's lines
+/// interpolated; the dominant field comes first.
+#[test]
+fn separate_fields_make_frames_from_fields() {
+    let mut s = session();
+    let mov = import(&mut s, "/m/lines.mov");
+    s.execute("comp.new", json!({"name": "C", "width": 4, "height": 4, "frameRate": 20, "duration": 1})).unwrap();
+    let c = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": mov.0})).unwrap();
+    let o = RenderOpts::default();
+    // Progressive: alternating rows.
+    assert!(red(px(&s, c, 0.0, o, 1, 0)) && blue(px(&s, c, 0.0, o, 1, 1)));
+    s.execute("file.interpretFootage", json!({"item": mov.0, "fields": "upper"})).unwrap();
+    // Field 1 (upper = even rows, red) then field 2 (odd rows, blue), each 1/20 s.
+    for y in 0..3 {
+        assert!(red(px(&s, c, 0.0, o, 1, y)), "upper field at row {y}");
+        assert!(blue(px(&s, c, 0.05, o, 1, y + 1)), "lower field at row {}", y + 1);
+    }
+    s.execute("file.interpretFootage", json!({"item": mov.0, "fields": "lower"})).unwrap();
+    assert!(blue(px(&s, c, 0.0, o, 1, 2)));
+    assert!(red(px(&s, c, 0.05, o, 1, 1)));
+    let r = s.execute("file.interpretFootage", json!({"item": mov.0, "fields": "off"})).unwrap();
+    assert_eq!(r["items"][0]["fields"], "Off");
+}
+
+/// Non-square pixels: a 10×10 footage with pixel aspect 2 covers 20×10 comp pixels.
+#[test]
+fn pixel_aspect_stretches_footage_in_the_comp() {
+    let mut s = session();
+    let w = import(&mut s, "/m/wide.png");
+    s.execute("comp.new", json!({"name": "C", "width": 40, "height": 20, "frameRate": 10, "duration": 1})).unwrap();
+    let c = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": w.0})).unwrap();
+    let o = RenderOpts::default();
+    let covered = |s: &Session| s.render(c, Tick::ZERO, o).data.iter().filter(|p| p[3] > 0.5).count();
+    assert_eq!(covered(&s), 100);
+    s.execute("file.interpretFootage", json!({"item": w.0, "pixelAspect": 2.0})).unwrap();
+    assert_eq!(covered(&s), 200);
+    // Centered on the comp: x 10..30 (edge pixels are filtered).
+    assert!(px(&s, c, 0.0, o, 11, 10)[3] > 0.99 && px(&s, c, 0.0, o, 28, 10)[3] > 0.99);
+    assert!(px(&s, c, 0.0, o, 8, 10)[3] < 0.01 && px(&s, c, 0.0, o, 31, 10)[3] < 0.01);
+    // A comp with the same pixel aspect shows the footage 1:1.
+    s.execute("comp.settings", json!({"pixelAspect": 2.0})).unwrap();
+    assert_eq!(covered(&s), 100);
+}
+
+/// Alpha ▸ Guess: premultiplied files are recognised with their matte colour; Invert Alpha
+/// and Interpret As Linear Light change the decoded pixels.
+#[test]
+fn guess_alpha_invert_and_linear_light() {
+    let mut s = session();
+    let b = import(&mut s, "/m/matte_black.png");
+    let w = import(&mut s, "/m/matte_white.png");
+    let h = import(&mut s, "/m/half.png");
+    let foot = |s: &Session, i: ItemId| match &s.project.item(i).unwrap().kind {
+        ItemKind::Footage(f) => f.clone(),
+        _ => panic!("not footage"),
+    };
+    s.execute("file.interpretFootage", json!({"items": [b.0, w.0, h.0], "alpha": "guess"})).unwrap();
+    assert_eq!(foot(&s, b).alpha, AlphaMode::Premultiplied);
+    assert_eq!(foot(&s, b).premul_color, [0.0; 3]);
+    assert_eq!(foot(&s, w).alpha, AlphaMode::Premultiplied);
+    assert_eq!(foot(&s, w).premul_color, [1.0; 3]);
+    // White at 25 %: not explained by a black matte (1 > 0.25) but it is by white… either way
+    // the guess is consistent with the pixels.
+    assert!(matches!(foot(&s, h).alpha, AlphaMode::Straight | AlphaMode::Premultiplied));
+    // An explicit matte colour.
+    s.execute("file.interpretFootage", json!({"item": b.0, "alpha": "premultiplied", "matteColor": "#808080"})).unwrap();
+    assert!((foot(&s, b).premul_color[0] - 128.0 / 255.0).abs() < 1e-3);
+    // Invert Alpha: 25 % → 75 %.
+    s.execute("file.interpretFootage", json!({"item": h.0, "alpha": "straight", "invertAlpha": true})).unwrap();
+    s.execute("comp.new", json!({"name": "C", "width": 4, "height": 4, "frameRate": 10, "duration": 1})).unwrap();
+    let c = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": h.0})).unwrap();
+    let p = px(&s, c, 0.0, RenderOpts::default(), 1, 1);
+    assert!((p[3] - 0.75).abs() < 0.01 && p[0] > 0.7, "{p:?}");
+    // Interpret As Linear Light keeps alpha and re-encodes the colour.
+    s.execute("file.interpretFootage", json!({"item": h.0, "invertAlpha": false, "linearLight": true})).unwrap();
+    let p = px(&s, c, 0.0, RenderOpts::default(), 1, 1);
+    assert!((p[3] - 0.25).abs() < 0.01, "{p:?}");
+    // Remember / Apply Interpretation carries the new settings.
+    s.state.project_selection = vec![h];
+    s.execute("file.rememberInterpretation", json!({"item": h.0})).unwrap();
+    s.execute("file.applyInterpretation", json!({"items": [w.0]})).unwrap();
+    assert!(foot(&s, w).linear_light);
+    // Color ▸ Preserve RGB (#411) is set, rendered and carried by Apply Interpretation.
+    let out = s.execute("file.interpretFootage", json!({"item": h.0, "preserveRgb": true})).unwrap();
+    assert_eq!(out["items"][0]["preserveRgb"], true);
+    let p = px(&s, c, 0.0, RenderOpts::default(), 1, 1);
+    assert!((p[0] - 0.25).abs() < 0.01, "white at 25 %, unconverted: {p:?}");
+    s.execute("file.rememberInterpretation", json!({"item": h.0})).unwrap();
+    s.execute("file.applyInterpretation", json!({"items": [w.0]})).unwrap();
+    assert!(foot(&s, w).preserve_rgb);
+}
+
+/// Color ▸ Cineon Settings: Logarithmic Conversion turns a DPX file's log code values into the
+/// Current Gamma between the converted points (off, they show as stored); the converted points
+/// are read and reported in the chosen Units; out-of-range values and footage that is not DPX
+/// or Cineon are refused; Remember / Apply Interpretation and undo carry the settings.
+#[test]
+fn cineon_settings_convert_dpx_code_values() {
+    let mut s = session();
+    let d = import(&mut s, "/m/scan.dpx");
+    let other = import(&mut s, "/m/plate.dpx");
+    let png = import(&mut s, "/m/red16.png");
+    let foot = |s: &Session, i: ItemId| match &s.project.item(i).unwrap().kind {
+        ItemKind::Footage(f) => f.clone(),
+        _ => panic!("not footage"),
+    };
+    s.execute("comp.new", json!({"name": "C", "width": 4, "height": 4, "frameRate": 10, "duration": 1})).unwrap();
+    let c = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": d.0})).unwrap();
+    let at = |s: &Session, x: i64| px(s, c, 0.0, RenderOpts::default(), x, 0)[0];
+    let near = |a: f32, b: f32| (a - b).abs() < 1.5 / 255.0;
+    // Off: the code values as stored.
+    assert!(near(at(&s, 2), 400.0 / 1023.0), "{}", at(&s, 2));
+    // The checked path (control channel, MCP) accepts every Cineon parameter the doc lists.
+    let out = s.execute_checked("file.interpretFootage", json!({"items": [d.0], "logConversion": true, "highlightRolloff": 0})).unwrap();
+    assert_eq!(out["items"][0]["cineon"]["logConversion"], true, "{out}");
+    assert!(near(at(&s, 0), 0.0) && near(at(&s, 1), 1.0), "{} {}", at(&s, 0), at(&s, 1));
+    assert!(near(at(&s, 2), 0.26190), "code 400 at gamma 1.7: {}", at(&s, 2));
+    s.execute("file.interpretFootage", json!({"item": d.0, "currentGamma": 1})).unwrap();
+    assert!(near(at(&s, 2), 0.10251), "code 400 in linear light: {}", at(&s, 2));
+    // Converted points, in 8-bit units.
+    let out = s
+        .execute_checked("file.interpretFootage", json!({"items": [d.0], "cineonUnits": "8bit", "convertedBlack": 16, "convertedWhite": 235, "currentGamma": 1, "tenBitBlack": 95, "tenBitWhite": 685}))
+        .unwrap();
+    assert_eq!(out["items"][0]["cineon"]["units"], "8bit");
+    assert!((out["items"][0]["cineon"]["convertedWhite"].as_f64().unwrap() - 235.0).abs() < 1e-3, "{out}");
+    assert!(near(at(&s, 0), 16.0 / 255.0) && near(at(&s, 1), 235.0 / 255.0), "{} {}", at(&s, 0), at(&s, 1));
+    // The form sends the points in the units it showed them in (`pointUnits`) with a new Units.
+    s.execute_checked("file.interpretFootage", json!({"items": [d.0], "pointUnits": "8bit", "cineonUnits": "float", "convertedWhite": 255})).unwrap();
+    let f = foot(&s, d);
+    assert_eq!(f.cineon.units, effectcraft_project::CineonUnits::Float);
+    assert!((f.cineon.converted_white - 1023.0).abs() < 1e-3, "{:?}", f.cineon);
+    // Refused: a black point at or above the white point, values out of range, and footage
+    // that is not DPX or Cineon. Nothing changes.
+    let before = foot(&s, d).cineon;
+    for bad in [
+        json!({"item": d.0, "tenBitBlack": 700}),
+        json!({"item": d.0, "tenBitWhite": 2000}),
+        json!({"item": d.0, "currentGamma": 0}),
+        json!({"item": d.0, "highlightRolloff": -1}),
+        json!({"item": d.0, "convertedWhite": 1.5}),
+        json!({"item": d.0, "cineonUnits": "12bit"}),
+        json!({"item": png.0, "logConversion": true}),
+    ] {
+        assert!(s.execute("file.interpretFootage", bad.clone()).is_err(), "{bad}");
+    }
+    assert_eq!(foot(&s, d).cineon, before);
+    assert!(foot(&s, png).cineon == effectcraft_project::CineonSettings::default());
+    // With DPX and other footage selected, only the DPX file takes the settings.
+    s.execute("file.interpretFootage", json!({"items": [png.0, other.0], "logConversion": true})).unwrap();
+    assert!(foot(&s, other).cineon.log_conversion && !foot(&s, png).cineon.log_conversion);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(!foot(&s, other).cineon.log_conversion);
+    // Remember / Apply Interpretation.
+    s.state.project_selection = vec![d];
+    s.execute("file.rememberInterpretation", json!({"item": d.0})).unwrap();
+    s.execute("file.applyInterpretation", json!({"items": [other.0, png.0]})).unwrap();
+    assert_eq!(foot(&s, other).cineon, before);
+    assert_eq!(foot(&s, png).cineon, effectcraft_project::CineonSettings::default());
+    // Off again: as stored.
+    s.execute("file.interpretFootage", json!({"item": d.0, "logConversion": false})).unwrap();
+    assert!(near(at(&s, 2), 400.0 / 1023.0), "{}", at(&s, 2));
+    // Frame Mix blends converted frames: halfway between code 95 (black) and 685 (white) at
+    // Current Gamma 1 is 0.5, not the conversion of the blended code values.
+    let seq = import(&mut s, "/m/frames.dpx");
+    s.execute("file.interpretFootage", json!({"item": seq.0, "logConversion": true, "currentGamma": 1, "highlightRolloff": 0})).unwrap();
+    s.execute("comp.new", json!({"name": "Blend", "width": 10, "height": 10, "frameRate": 20, "duration": 1})).unwrap();
+    let bc = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": seq.0})).unwrap();
+    s.execute("layer.frameBlending", json!({"mode": "frameMix"})).unwrap();
+    let mid = px(&s, bc, 0.05, RenderOpts::default(), 5, 5)[0];
+    assert!(near(mid, 0.5), "frame-mixed log frames: {mid}");
+    // A DPX proxy of a composition: Interpret Proxy's settings convert it where it stands in.
+    s.execute("comp.new", json!({"name": "Inner", "width": 4, "height": 4, "frameRate": 10, "duration": 1})).unwrap();
+    let inner = s.active_comp_id().unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 4, "height": 4, "frameRate": 10, "duration": 1})).unwrap();
+    let outer = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": inner.0})).unwrap();
+    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/scan.dpx"})).unwrap();
+    let proxied = |s: &Session, x: i64| px(s, outer, 0.0, RenderOpts::default(), x, 0)[0];
+    assert!(near(proxied(&s, 1), 685.0 / 1023.0), "{}", proxied(&s, 1));
+    s.execute_checked("file.interpretProxy", json!({"items": [inner.0], "logConversion": true, "highlightRolloff": 0})).unwrap();
+    assert!(near(proxied(&s, 0), 0.0) && near(proxied(&s, 1), 1.0), "{} {}", proxied(&s, 0), proxied(&s, 1));
+}
+
+/// The Footage panel, the Project panel thumbnail and the tracker's source frames show DPX
+/// footage with its Cineon Settings, as a composition renders it.
+#[test]
+fn cineon_settings_apply_to_footage_panel_thumbnail_and_tracking() {
+    let mut s = session();
+    let d = import(&mut s, "/m/scan.dpx");
+    s.execute("comp.new", json!({"name": "C", "width": 4, "height": 4, "frameRate": 10, "duration": 1})).unwrap();
+    let c = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": d.0})).unwrap();
+    s.execute("file.interpretFootage", json!({"item": d.0, "logConversion": true, "highlightRolloff": 0})).unwrap();
+    let near = |a: f32, b: f32| (a - b).abs() < 1.5 / 255.0;
+    let rendered = px(&s, c, 0.0, RenderOpts::default(), 2, 0)[0];
+    assert!(near(rendered, 0.26190), "code 400 at gamma 1.7: {rendered}");
+    let f = match &s.project.item(d).unwrap().kind {
+        ItemKind::Footage(f) => f.clone(),
+        _ => panic!("not footage"),
+    };
+    let panel = crate::commands::footage_panel::frame(&s, d, &f, Tick::ZERO).unwrap().get(2, 0)[0];
+    assert!(near(panel, rendered), "Footage panel: {panel}");
+    let (w, _, rgba) = (s.thumbnail_job(d, Tick::ZERO, 64).unwrap())().unwrap();
+    assert_eq!(w, 4);
+    let thumb = rgba[8] as f32 / 255.0;
+    assert!(near(thumb, rendered), "Project panel thumbnail: {thumb}");
+    let comp = s.project.comp(c).unwrap();
+    let r = crate::render::Renderer::new(&s.project, s.footage.as_ref(), RenderOpts::default());
+    let (img, _) = crate::tracking::source_frame(&r, &s.project, c, comp, &comp.layers[0], Tick::ZERO, None).unwrap();
+    assert!(near(img.get(2, 0)[0], rendered), "tracker source frame: {}", img.get(2, 0)[0]);
+}
diff --git a/crates/engine/src/tests_quick_offset.rs b/crates/engine/src/tests/quick_offset.rs
similarity index 100%
rename from crates/engine/src/tests_quick_offset.rs
rename to crates/engine/src/tests/quick_offset.rs
diff --git a/crates/engine/src/tests/render_overwrite.rs b/crates/engine/src/tests/render_overwrite.rs
new file mode 100644
index 000000000..7ed21f739
--- /dev/null
+++ b/crates/engine/src/tests/render_overwrite.rs
@@ -0,0 +1,1042 @@
+//! Rendering never replaces a file the project reads (#1743). Ordinary-file replacement
+//! behavior stays with the exporter and its confirmation API. Two items of one job never write
+//! the same file either.
+
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use effectcraft_color::Label;
+use effectcraft_project::render_queue::{OutputFormat, RenderStatus, sequence_path};
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind};
+use effectcraft_time::Tick;
+use serde_json::{Value, json};
+
+use crate::{ExportJob, ExportResult, Exporter, Session};
+
+pub(crate) const SOURCE: &[u8] = b"SOURCE FOOTAGE";
+const EARLIER: &[u8] = b"AN EARLIER RENDER";
+const RENDERED: &[u8] = b"RENDERED";
+
+/// An exporter that writes like the real one: `RENDERED` at the job's path, or at the path of
+/// every frame for a sequence (leaving the frames that exist alone when the item skips them).
+#[derive(Default)]
+struct Writer {
+    jobs: Mutex<Vec<String>>,
+}
+
+impl Exporter for Writer {
+    fn formats(&self) -> Vec<OutputFormat> {
+        OutputFormat::ALL.to_vec()
+    }
+    fn supports_skip_existing(&self, _: &effectcraft_project::render_queue::RenderSettings) -> bool {
+        true
+    }
+    fn export(&self, job: &ExportJob, _: &mut dyn FnMut(u64, u64) -> bool) -> Result<ExportResult, String> {
+        self.jobs.lock().unwrap().push(job.path.to_string());
+        let comp = job.project.comp(job.item.comp).ok_or("no comp")?;
+        let paths: Vec<String> = if job.item.output.format.is_sequence() {
+            let first = job.item.settings.first_frame(comp);
+            (0..job.item.settings.frame_count(comp)).map(|k| sequence_path(job.path, first + k as i64)).collect()
+        } else {
+            vec![job.path.to_string()]
+        };
+        for path in &paths {
+            if job.item.settings.skip_existing && Path::new(path).exists() {
+                continue;
+            }
+            if let Some(dir) = Path::new(path).parent() {
+                std::fs::create_dir_all(dir).map_err(|e| e.to_string())?;
+            }
+            std::fs::write(path, RENDERED).map_err(|e| e.to_string())?;
+        }
+        Ok(ExportResult { path: paths.first().cloned().unwrap_or_default(), ..Default::default() })
+    }
+}
+
+/// A session whose project is saved in a fresh folder (the footage goes there too), with an
+/// exporter that writes real files.
+pub(crate) struct Fixture {
+    pub(crate) s: Session,
+    writer: Arc<Writer>,
+    pub(crate) dir: PathBuf,
+}
+
+impl Fixture {
+    pub(crate) fn new(name: &str) -> Fixture {
+        let dir = std::env::temp_dir().join("effectcraft-render-overwrite").join(format!("{}-{name}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let mut s = Session::default();
+        let writer = Arc::new(Writer::default());
+        s.exporter = Some(writer.clone());
+        s.execute("file.saveAs", json!({"path": dir.join("Project.ecproj").to_string_lossy()})).unwrap();
+        Fixture { s, writer, dir }
+    }
+
+    pub(crate) fn path(&self, file: &str) -> PathBuf {
+        self.dir.join(file)
+    }
+
+    pub(crate) fn text(&self, file: &str) -> String {
+        self.path(file).to_string_lossy().into_owned()
+    }
+
+    pub(crate) fn read(&self, file: &str) -> Vec<u8> {
+        std::fs::read(self.path(file)).unwrap()
+    }
+
+    pub(crate) fn write(&self, file: &str, bytes: &[u8]) {
+        std::fs::write(self.path(file), bytes).unwrap();
+    }
+
+    /// A video file in the project's folder, imported.
+    pub(crate) fn footage(&mut self, file: &str) -> ItemId {
+        self.write(file, SOURCE);
+        let f = Footage {
+            path: self.text(file),
+            kind: FootageKind::Video,
+            width: 64,
+            height: 36,
+            has_video: true,
+            duration: Tick::from_seconds_f64(1.0),
+            ..Default::default()
+        };
+        Arc::make_mut(&mut self.s.project).add_item(file, Label::None, None, ItemKind::Footage(f))
+    }
+
+    /// Numbered stills in the project's folder, imported as one image sequence.
+    fn sequence(&mut self, name: &str, frames: std::ops::Range<u32>) -> ItemId {
+        self.sequence_as(name, "png", frames)
+    }
+
+    /// [`Fixture::sequence`] of files with extension `ext`.
+    pub(crate) fn sequence_as(&mut self, name: &str, ext: &str, frames: std::ops::Range<u32>) -> ItemId {
+        let files: Vec<String> = frames
+            .map(|n| {
+                let file = format!("{name}_{n:05}.{ext}");
+                self.write(&file, SOURCE);
+                self.text(&file)
+            })
+            .collect();
+        let f = Footage {
+            path: files[0].clone(),
+            kind: FootageKind::Sequence,
+            sequence: files,
+            width: 16,
+            height: 16,
+            has_video: true,
+            duration: Tick::from_seconds_f64(0.5),
+            ..Default::default()
+        };
+        Arc::make_mut(&mut self.s.project).add_item(&format!("{name}_[00000-00004].{ext}"), Label::None, None, ItemKind::Footage(f))
+    }
+
+    /// A five-frame composition.
+    pub(crate) fn comp(&mut self, name: &str) {
+        self.s.execute("comp.new", json!({"name": name, "width": 16, "height": 16, "frameRate": 10, "duration": 0.5})).unwrap();
+    }
+
+    /// The output path of queue item `index` (0-based).
+    fn output(&self, index: usize) -> PathBuf {
+        PathBuf::from(self.s.resolve_output(&self.s.project.render_queue[index]).unwrap())
+    }
+
+    /// The paths the exporter was started for.
+    pub(crate) fn exported(&self) -> Vec<String> {
+        self.writer.jobs.lock().unwrap().clone()
+    }
+
+    fn render(&mut self, params: Value) -> crate::Result<Value> {
+        self.s.execute("renderQueue.render", params)
+    }
+}
+
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+fn link(target: &Path, link: &Path) -> std::io::Result<()> {
+    #[cfg(unix)]
+    return std::os::unix::fs::symlink(target, link);
+    #[cfg(windows)]
+    return std::os::windows::fs::symlink_file(target, link);
+    #[cfg(not(any(unix, windows)))]
+    {
+        let _ = (target, link);
+        Err(std::io::ErrorKind::Unsupported.into())
+    }
+}
+
+/// A folder that leads to `target`: a symbolic link, or on Windows, where that takes a privilege
+/// most accounts lack, a junction.
+fn link_dir(target: &Path, link: &Path) -> std::io::Result<()> {
+    #[cfg(unix)]
+    return std::os::unix::fs::symlink(target, link);
+    #[cfg(windows)]
+    return std::os::windows::fs::symlink_dir(target, link).or_else(|_| {
+        let made = std::process::Command::new("cmd").args(["/C", "mklink", "/J"]).arg(link).arg(target).output()?;
+        if made.status.success() { Ok(()) } else { Err(std::io::Error::other(String::from_utf8_lossy(&made.stdout).into_owned())) }
+    });
+    #[cfg(not(any(unix, windows)))]
+    {
+        let _ = (target, link);
+        Err(std::io::ErrorKind::Unsupported.into())
+    }
+}
+
+/// The report: save a new project beside `footage.mp4`, import it, make a composition from it
+/// (it is named after the file), add that to the Render Queue and click Render. The composition's
+/// default output is `<project folder>/footage.mp4`, the footage itself.
+#[test]
+fn a_comp_made_from_footage_does_not_render_over_it() {
+    let mut f = Fixture::new("comp-from-footage");
+    let footage = f.footage("footage.mp4");
+    f.s.state.project_selection = vec![footage];
+    f.s.execute("file.newCompFromSelection", json!({"addToRenderQueue": true})).unwrap();
+    assert_eq!(f.s.project.render_queue.len(), 1);
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("footage.mp4"), SOURCE, "the footage is still the footage");
+    assert_eq!(f.s.project.render_queue[0].status, RenderStatus::Done);
+    // The default name stepped aside: the render sits next to it.
+    assert_eq!(f.output(0), f.path("footage_1.mp4"));
+    assert_eq!(f.read("footage_1.mp4"), RENDERED);
+    // Another item for the same composition takes the next free number.
+    f.s.execute("renderQueue.add", json!({})).unwrap();
+    assert_eq!(f.output(1), f.path("footage_2.mp4"));
+}
+
+#[test]
+fn an_output_that_is_the_footage_is_refused_with_or_without_overwrite() {
+    for (n, params) in [json!({}), json!({"overwrite": true})].into_iter().enumerate() {
+        let mut f = Fixture::new(&format!("explicit-footage-{n}"));
+        f.footage("clip.mov");
+        f.comp("Main");
+        let clip = f.text("clip.mov");
+        f.s.execute("renderQueue.add", json!({"format": "prores", "output": clip})).unwrap();
+        let e = f.render(params).unwrap_err().to_string();
+        assert!(e.contains("clip.mov") && e.contains("footage"), "{e}");
+        assert_eq!(f.read("clip.mov"), SOURCE);
+        assert!(f.exported().is_empty(), "the exporter was not started");
+        let RenderStatus::Failed(why) = &f.s.project.render_queue[0].status else { panic!("{:?}", f.s.project.render_queue[0].status) };
+        assert!(why.contains("clip.mov"), "{why}");
+    }
+}
+
+/// An item that would replace the footage fails on its own; the rest of the queue renders.
+#[test]
+fn the_rest_of_the_queue_renders_when_one_item_would_replace_footage() {
+    let mut f = Fixture::new("one-refused");
+    f.footage("clip.mov");
+    f.comp("Main");
+    let clip = f.text("clip.mov");
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": clip})).unwrap();
+    let ok = f.text("main.mp4");
+    f.s.execute("renderQueue.add", json!({"output": ok})).unwrap();
+    let r = f.render(json!({})).unwrap();
+    assert_eq!(f.read("clip.mov"), SOURCE);
+    assert_eq!(f.read("main.mp4"), RENDERED);
+    assert!(matches!(f.s.project.render_queue[0].status, RenderStatus::Failed(_)));
+    assert_eq!(f.s.project.render_queue[1].status, RenderStatus::Done);
+    assert!(r["items"].as_array().unwrap().iter().any(|i| i["status"].get("Failed").is_some()), "the reply includes the refused item: {r}");
+    assert!(r["items"].as_array().unwrap().iter().any(|i| i["status"] == "Done"), "{r}");
+}
+
+#[test]
+fn the_project_file_is_never_an_output() {
+    let mut f = Fixture::new("project-file");
+    // A project saved under a name a movie could have.
+    let name = f.text("final.mp4");
+    f.s.execute("file.saveAs", json!({"path": name})).unwrap();
+    f.comp("final");
+    f.s.execute("renderQueue.add", json!({})).unwrap();
+    assert_eq!(f.output(0), f.path("final_1.mp4"), "the default name moves aside");
+    f.s.execute("renderQueue.remove", json!({"index": 1})).unwrap();
+    f.s.execute("renderQueue.add", json!({"output": name})).unwrap();
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("final.mp4") && e.contains("project"), "{e}");
+    assert!(std::fs::read_to_string(f.path("final.mp4")).unwrap().contains("\"schema\""), "the project file is still a project");
+}
+
+#[test]
+fn a_proxy_is_not_an_output_either() {
+    let mut f = Fixture::new("proxy");
+    f.footage("clip.mov");
+    f.write("proxy.mov", SOURCE);
+    f.comp("Main");
+    let proxy = Footage { path: f.text("proxy.mov"), kind: FootageKind::Video, has_video: true, ..Default::default() };
+    let comp = f.s.active_comp_id().unwrap();
+    Arc::make_mut(&mut f.s.project).item_mut(comp).unwrap().proxy = Some(Box::new(effectcraft_project::Proxy { footage: proxy, enabled: true }));
+    let target = f.text("proxy.mov");
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": target})).unwrap();
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("proxy"), "{e}");
+    assert_eq!(f.read("proxy.mov"), SOURCE);
+}
+
+/// Recreating a default proxy writes a new file and attaches it, without replacing the proxy
+/// the project is currently reading. Explicitly choosing that protected path is still refused.
+#[test]
+fn creating_a_proxy_again_chooses_a_new_default_and_attaches_it() {
+    struct Probe;
+    impl crate::Importer for Probe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            if !Path::new(path).is_file() {
+                return Err("proxy file missing".into());
+            }
+            Ok(Footage {
+                path: path.into(),
+                kind: if path.ends_with(".png") { FootageKind::Still } else { FootageKind::Video },
+                width: 16,
+                height: 16,
+                has_video: true,
+                ..Default::default()
+            })
+        }
+    }
+    for kind in ["movie", "still"] {
+        let mut f = Fixture::new(&format!("recreate-proxy-{kind}"));
+        f.s.importer = Some(Arc::new(Probe));
+        f.comp("Main");
+        let comp = f.s.active_comp_id().unwrap();
+        f.s.execute("file.createProxy", json!({"kind": kind})).unwrap();
+        f.render(json!({})).unwrap();
+        let first = f.s.project.item(comp).unwrap().proxy.as_ref().unwrap().footage.path.clone();
+        assert_eq!(std::fs::read(&first).unwrap(), RENDERED);
+
+        f.s.execute("file.createProxy", json!({"kind": kind})).unwrap();
+        f.render(json!({})).unwrap();
+        let second = f.s.project.item(comp).unwrap().proxy.as_ref().unwrap().footage.path.clone();
+        assert_ne!(second, first, "the replacement proxy gets its own file");
+        assert_eq!(std::fs::read(&second).unwrap(), RENDERED);
+        assert_eq!(std::fs::read(&first).unwrap(), RENDERED);
+        assert_eq!(f.exported().len(), 2);
+
+        // For a still proxy, an explicit output is the sequence pattern, not its first
+        // rendered frame (a bare PNG name would have another frame number appended).
+        let protected_output = f.output(1);
+        f.s.execute("file.createProxy", json!({"kind": kind, "path": protected_output})).unwrap();
+        let error = f.render(json!({})).unwrap_err().to_string();
+        assert!(error.contains("never replaces a proxy"), "{error}");
+        assert_eq!(f.exported().len(), 2);
+    }
+}
+
+/// A pre-render becomes imported footage. Its old output stays protected even from the
+/// same queue item; issuing Pre-render again supplies a fresh default output instead.
+#[test]
+fn refreshing_a_pre_render_uses_a_new_default_without_exempting_imported_footage() {
+    struct Probe;
+    impl crate::Importer for Probe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            if !Path::new(path).is_file() {
+                return Err("pre-render missing".into());
+            }
+            Ok(Footage { path: path.into(), kind: FootageKind::Video, width: 16, height: 16, has_video: true, ..Default::default() })
+        }
+    }
+    let mut f = Fixture::new("refresh-pre-render");
+    f.s.importer = Some(Arc::new(Probe));
+    f.comp("Main");
+    f.s.execute("render.preRender", json!({"format": "gif"})).unwrap();
+    let first = f.output(0);
+    f.render(json!({})).unwrap();
+    f.s.execute("renderQueue.setRender", json!({"index": 1, "render": true})).unwrap();
+    let error = f.render(json!({})).unwrap_err().to_string();
+    assert!(error.contains("footage"), "{error}");
+    assert_eq!(std::fs::read(&first).unwrap(), RENDERED);
+    assert_eq!(f.exported().len(), 1);
+    f.s.execute("renderQueue.setRender", json!({"index": 1, "render": false})).unwrap();
+    f.s.execute("render.preRender", json!({"format": "gif"})).unwrap();
+    let second = f.output(1);
+    assert_ne!(first, second);
+    f.render(json!({})).unwrap();
+    assert_eq!(std::fs::read(first).unwrap(), RENDERED);
+    assert_eq!(std::fs::read(second).unwrap(), RENDERED);
+    assert_eq!(f.exported().len(), 2);
+}
+
+/// Exercise the engine's import and project serialization paths, rather than injecting a
+/// Footage item directly. The importer reads dimensions from a real, generated PNG.
+#[test]
+fn imported_footage_stays_protected_after_the_project_is_reopened() {
+    struct PngProbe;
+    impl crate::Importer for PngProbe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            let (width, height) = image::image_dimensions(path).map_err(|e| e.to_string())?;
+            Ok(Footage { path: path.into(), kind: FootageKind::Still, width, height, has_video: true, ..Default::default() })
+        }
+    }
+    let mut f = Fixture::new("import-reopen");
+    f.s.importer = Some(Arc::new(PngProbe));
+    let path = f.path("plate_00002.png");
+    image::RgbaImage::from_pixel(4, 4, image::Rgba([40, 80, 120, 255])).save(&path).unwrap();
+    let original = std::fs::read(&path).unwrap();
+    let result = f.s.execute("file.import", json!({"paths": [path]})).unwrap();
+    assert_eq!(result["items"].as_array().unwrap().len(), 1);
+    f.comp("Main");
+    f.s.execute("renderQueue.add", json!({"format": "png", "output": f.text("plate_[#####].png")})).unwrap();
+    f.s.execute("file.save", json!({})).unwrap();
+    f.s.execute("file.open", json!({"path": f.text("Project.ecproj")})).unwrap();
+    let error = f.render(json!({})).unwrap_err().to_string();
+    assert!(error.contains("plate_00002.png") && error.contains("footage"), "{error}");
+    assert_eq!(std::fs::read(&path).unwrap(), original);
+    assert!(f.exported().is_empty());
+}
+
+#[test]
+fn a_protected_frame_past_the_probe_limit_is_not_rendered() {
+    struct LastFrame(PathBuf);
+    impl Exporter for LastFrame {
+        fn formats(&self) -> Vec<OutputFormat> {
+            vec![OutputFormat::PngSequence]
+        }
+        fn export(&self, _: &ExportJob, _: &mut dyn FnMut(u64, u64) -> bool) -> Result<ExportResult, String> {
+            // A synthetic exporter writes only the vulnerable late frame, so a broken guard
+            // can be reproduced without creating 100,001 output directories.
+            std::fs::write(&self.0, RENDERED).map_err(|e| e.to_string())?;
+            Ok(ExportResult { path: self.0.to_string_lossy().into_owned(), ..Default::default() })
+        }
+    }
+    let mut f = Fixture::new("late-frame");
+    std::fs::create_dir_all(f.path("f100000")).unwrap();
+    f.footage("f100000/plate.png");
+    f.comp("Main");
+    f.s.execute("comp.settings", json!({"duration": 10000.1})).unwrap();
+    f.s.exporter = Some(Arc::new(LastFrame(f.path("f100000/plate.png"))));
+    f.s.execute("renderQueue.add", json!({"format": "png", "output": f.text("f[######]/plate.png")})).unwrap();
+    let error = f.render(json!({})).unwrap_err().to_string();
+    assert!(error.contains("cannot safely check"), "{error}");
+    assert_eq!(f.read("f100000/plate.png"), SOURCE);
+}
+
+/// A numbered sequence is footage frame by frame: one colliding frame is enough, and nothing of
+/// the item is rendered.
+#[test]
+fn a_sequence_never_replaces_one_of_its_footage_frames() {
+    let mut f = Fixture::new("sequence");
+    f.sequence("shot", 0..5);
+    f.comp("shot");
+    // The default name steps aside as a whole: shot_1_00000.png …
+    f.s.execute("renderQueue.add", json!({"format": "png"})).unwrap();
+    assert_eq!(f.output(0), f.path("shot_1_[#####].png"));
+    f.render(json!({})).unwrap();
+    for n in 0..5 {
+        assert_eq!(f.read(&format!("shot_{n:05}.png")), SOURCE, "frame {n}");
+        assert_eq!(f.read(&format!("shot_1_{n:05}.png")), RENDERED, "frame {n}");
+    }
+
+    // Named by hand, one frame of five is a footage file.
+    let mut f = Fixture::new("sequence-one-frame");
+    f.write("shot_00002.png", SOURCE);
+    let still = Footage { path: f.text("shot_00002.png"), kind: FootageKind::Still, width: 16, height: 16, has_video: true, ..Default::default() };
+    Arc::make_mut(&mut f.s.project).add_item("shot_00002.png", Label::None, None, ItemKind::Footage(still));
+    f.comp("shot");
+    let pattern = f.text("shot_[#####].png");
+    f.s.execute("renderQueue.add", json!({"format": "png", "output": pattern})).unwrap();
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("shot_00002.png"), "{e}");
+    assert_eq!(f.read("shot_00002.png"), SOURCE);
+    assert!(!f.path("shot_00000.png").exists(), "the frames before it were not rendered either");
+    assert!(f.exported().is_empty());
+}
+
+#[test]
+fn ordinary_existing_outputs_keep_the_exporters_replacement_policy() {
+    let mut f = Fixture::new("earlier-render");
+    f.comp("Main");
+    f.s.execute("renderQueue.add", json!({"output": f.text("render.mp4")})).unwrap();
+    f.write("render.mp4", EARLIER);
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("render.mp4"), RENDERED);
+    assert_eq!(f.s.project.render_queue[0].status, RenderStatus::Done);
+}
+
+#[test]
+fn a_render_with_nothing_in_the_way_needs_no_flag() {
+    let mut f = Fixture::new("free");
+    f.comp("Main");
+    f.s.execute("renderQueue.add", json!({})).unwrap();
+    assert_eq!(f.output(0), f.path("Main.mp4"), "no footage in the way: the comp's own name");
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("Main.mp4"), RENDERED);
+}
+
+/// Skip Existing Files leaves the frames that exist alone, so they need no answer.
+#[test]
+fn a_sequence_that_skips_existing_frames_needs_no_flag() {
+    let mut f = Fixture::new("skip-existing");
+    f.comp("Main");
+    let pattern = f.text("render_[#####].png");
+    f.s.execute("renderQueue.add", json!({"format": "png", "output": pattern, "skipExisting": true})).unwrap();
+    for n in 0..3 {
+        f.write(&format!("render_{n:05}.png"), EARLIER);
+    }
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("render_00002.png"), EARLIER);
+    assert_eq!(f.read("render_00003.png"), RENDERED);
+    // Ordinary files still follow the exporter's replacement policy when skipping is off.
+    f.s.execute("renderQueue.setRenderSettings", json!({"index": 1, "skipExisting": false})).unwrap();
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("render_00002.png"), RENDERED);
+}
+
+/// A link is another name for the file it points to.
+#[test]
+fn a_link_to_the_footage_is_the_footage() {
+    let mut f = Fixture::new("link");
+    f.footage("clip.mov");
+    f.comp("Main");
+    let alias = f.path("render.mov");
+    if link(&f.path("clip.mov"), &alias).is_err() {
+        eprintln!("this account cannot make symbolic links: skipped");
+        return;
+    }
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": f.text("render.mov")})).unwrap();
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("render.mov") && e.contains("footage"), "{e}");
+    assert_eq!(f.read("clip.mov"), SOURCE);
+    assert!(std::fs::symlink_metadata(&alias).unwrap().file_type().is_symlink(), "the link was not replaced either");
+}
+
+/// A hard link to the footage under another name is the same file on disk: replacing it would truncate the footage.
+#[test]
+fn a_hard_link_to_the_footage_is_the_footage() {
+    let mut f = Fixture::new("hardlink");
+    f.footage("clip.mov");
+    f.comp("Main");
+    if std::fs::hard_link(f.path("clip.mov"), f.path("render.mov")).is_err() {
+        eprintln!("this volume cannot make hard links: skipped");
+        return;
+    }
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": f.text("render.mov")})).unwrap();
+    // not even with overwrite
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("render.mov") && e.contains("footage"), "{e}");
+    assert_eq!(f.read("clip.mov"), SOURCE);
+    assert_eq!(f.read("render.mov"), SOURCE, "the other name still leads to the footage");
+    assert!(f.exported().is_empty(), "nothing was rendered");
+}
+
+/// A copy of the footage has its size and bytes, but it is another file: an earlier render may replace it.
+#[test]
+fn a_copy_of_the_footage_is_not_the_footage() {
+    let mut f = Fixture::new("copy");
+    f.footage("clip.mov");
+    f.comp("Main");
+    std::fs::copy(f.path("clip.mov"), f.path("copy.mov")).unwrap();
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": f.text("copy.mov")})).unwrap();
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("copy.mov"), RENDERED);
+    assert_eq!(f.read("clip.mov"), SOURCE, "the footage is as it was");
+}
+
+/// Footage imported through a linked folder is the same file as the one in the real folder.
+#[test]
+fn footage_reached_through_a_linked_folder_is_still_footage() {
+    let mut f = Fixture::new("linked-folder");
+    std::fs::create_dir_all(f.path("real")).unwrap();
+    std::fs::write(f.path("real").join("clip.mov"), SOURCE).unwrap();
+    if link_dir(&f.path("real"), &f.path("linked")).is_err() {
+        eprintln!("this account cannot link folders: skipped");
+        return;
+    }
+    let via_link =
+        Footage { path: f.path("linked").join("clip.mov").to_string_lossy().into_owned(), kind: FootageKind::Video, has_video: true, ..Default::default() };
+    Arc::make_mut(&mut f.s.project).add_item("clip.mov", Label::None, None, ItemKind::Footage(via_link));
+    f.comp("Main");
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": f.path("real").join("clip.mov").to_string_lossy()})).unwrap();
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("footage"), "{e}");
+    assert_eq!(std::fs::read(f.path("real").join("clip.mov")).unwrap(), SOURCE);
+}
+
+/// Where the volume ignores case, `CLIP.MOV` is `clip.mov`.
+#[test]
+fn another_spelling_of_the_footage_name_is_the_footage_where_the_volume_ignores_case() {
+    let mut f = Fixture::new("case");
+    f.footage("clip.mov");
+    f.comp("Main");
+    if !f.path("CLIP.MOV").exists() {
+        eprintln!("this volume tells the two names apart: skipped");
+        return;
+    }
+    let shouting = f.text("CLIP.MOV");
+    f.s.execute("renderQueue.add", json!({"format": "prores", "output": shouting})).unwrap();
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("footage"), "{e}");
+    assert_eq!(f.read("clip.mov"), SOURCE);
+}
+
+#[test]
+fn save_current_preview_never_replaces_footage() {
+    let mut f = Fixture::new("preview");
+    f.footage("clip.mov");
+    f.comp("Main");
+    let clip = f.text("clip.mov");
+    let e = f.s.execute("render.saveCurrentPreview", json!({"path": clip})).unwrap_err().to_string();
+    assert!(e.contains("clip.mov") && e.contains("footage"), "{e}");
+    assert_eq!(f.read("clip.mov"), SOURCE);
+    assert!(f.exported().is_empty());
+    // Anywhere else it renders.
+    let elsewhere = f.text("preview.mp4");
+    f.s.execute("render.saveCurrentPreview", json!({"path": elsewhere})).unwrap();
+    assert_eq!(f.read("preview.mp4"), RENDERED);
+}
+
+#[test]
+fn save_current_preview_checks_sequence_frames_as_well_as_the_pattern() {
+    let mut f = Fixture::new("preview-sequence");
+    f.sequence("plate", 0..5);
+    f.comp("Main");
+    let error = f.s.execute("render.saveCurrentPreview", json!({"path": f.text("plate_[#####].png")})).unwrap_err().to_string();
+    assert!(error.contains("plate_000") && error.contains("footage"), "{error}");
+    for frame in 0..5 {
+        assert_eq!(f.read(&format!("plate_{frame:05}.png")), SOURCE);
+    }
+    assert!(f.exported().is_empty());
+}
+
+/// A watched folder renders unattended; delete the status file to render a project again.
+#[test]
+fn a_watched_folder_still_renders_a_project_again_over_its_outputs() {
+    let mut f = Fixture::new("watch");
+    f.comp("Main");
+    let out = f.text("Main.mp4");
+    f.s.execute("renderQueue.add", json!({"output": out})).unwrap();
+    f.s.execute("file.save", json!({})).unwrap();
+    f.write("Main.mp4", EARLIER);
+    let folder = f.dir.to_string_lossy().into_owned();
+    let done = crate::commands::watch_folder::poll(&mut f.s, &folder).unwrap();
+    assert_eq!(done.len(), 1, "{done:?}");
+    assert_eq!(done[0]["state"], "done", "{:?}", done[0]);
+    assert_eq!(f.read("Main.mp4"), RENDERED);
+}
+
+// ------------------------------------------------------------ one file, two items of one job
+//
+// Nothing is on disk when a job starts, so the check for files that exist said nothing about two
+// queue items that resolve to one output: the item rendered last replaced the file of the one
+// before it, inside the same job.
+
+impl Fixture {
+    /// The output path of every queue item, in queue order.
+    fn outputs(&self) -> Vec<PathBuf> {
+        (0..self.s.project.render_queue.len()).map(|i| self.output(i)).collect()
+    }
+
+    fn add(&mut self, params: Value) {
+        self.s.execute("renderQueue.add", params).unwrap();
+    }
+
+    /// What the queue would write twice, in the shape the tests read: `{"duplicates": [...]}`.
+    fn check(&mut self) -> Value {
+        let formats = self.s.exporter.as_ref().map(|e| e.formats()).unwrap_or_default();
+        let (items, _) = self.s.queued_outputs(&formats);
+        let refused = self.s.check_outputs(&items);
+        let duplicates: Vec<Value> = self
+            .s
+            .duplicate_outputs(&items, &refused)
+            .unwrap()
+            .iter()
+            .map(|d| {
+                json!({
+                    "item": d.item, "index": d.index, "comp": d.comp, "path": d.path, "files": d.files, "sequence": d.sequence,
+                    "with": {"item": d.with, "index": d.with_index, "comp": d.with_comp}, "reason": d.reason(),
+                })
+            })
+            .collect();
+        json!({"duplicates": duplicates})
+    }
+
+    /// What `check` lists under `duplicates`: for each, the place in the queue of the item that
+    /// would write over a file, the place of the item that wrote it first, and how many files.
+    fn clashes(&mut self) -> Vec<(u64, u64, u64)> {
+        let found = self.check();
+        let list = found["duplicates"].as_array().unwrap_or_else(|| panic!("checkOutputs lists no duplicates: {found}"));
+        list.iter().map(|d| (d["index"].as_u64().unwrap_or(0), d["with"]["index"].as_u64().unwrap_or(0), d["files"].as_u64().unwrap_or(0))).collect()
+    }
+}
+
+/// A PNG sequence of `pattern` for the composition's seconds `start..end`.
+fn span(pattern: &str, start: f64, end: f64) -> Value {
+    json!({"format": "png", "output": pattern, "timeSpan": "custom", "start": start, "end": end})
+}
+
+fn with_overflow(f: &mut Fixture) {
+    struct Room;
+    impl effectcraft_project::render_queue::StorageQuota for Room {
+        fn has_room(&self, _: &str, _: u64) -> bool {
+            true
+        }
+    }
+    f.s.storage_quota = Some(Arc::new(Room));
+    std::fs::create_dir_all(f.path("overflow")).unwrap();
+    Arc::make_mut(&mut f.s.project).render_prefs.overflow_folders = vec![f.text("overflow")];
+}
+
+#[test]
+fn default_names_avoid_possible_storage_overflow_collisions() {
+    let mut f = Fixture::new("overflow-default");
+    f.comp("Main");
+    with_overflow(&mut f);
+    f.add(json!({"output": f.text("other/Main.mp4"), "storageOverflow": true}));
+    f.add(json!({"storageOverflow": true}));
+    assert_eq!(f.output(1), f.path("Main_1.mp4"));
+    assert!(f.clashes().is_empty());
+}
+
+#[test]
+fn possible_storage_overflow_destinations_cannot_replace_footage() {
+    let mut f = Fixture::new("overflow-footage");
+    f.comp("Main");
+    with_overflow(&mut f);
+    f.footage("overflow/Main.mp4");
+    f.add(json!({"output": f.text("other/Main.mp4"), "storageOverflow": true}));
+    let error = f.render(json!({})).unwrap_err().to_string();
+    assert!(error.contains("footage") && error.contains("Main.mp4"), "{error}");
+    assert!(f.exported().is_empty());
+    assert_eq!(f.read("overflow/Main.mp4"), SOURCE);
+}
+
+#[test]
+fn default_names_avoid_protected_storage_overflow_destinations() {
+    let mut f = Fixture::new("overflow-protected-default");
+    f.comp("Main");
+    with_overflow(&mut f);
+    f.footage("overflow/Main.mp4");
+    f.add(json!({"storageOverflow": true}));
+    assert_eq!(f.output(0), f.path("Main_1.mp4"));
+    f.render(json!({})).unwrap();
+    assert_eq!(f.exported().len(), 1);
+    assert_eq!(f.read("overflow/Main.mp4"), SOURCE);
+}
+
+/// After Effects numbers the second item of one composition (`Comp 1_1.mov`). A default output
+/// name that another item of the queue already has is numbered the same way.
+#[test]
+fn a_second_default_item_for_one_comp_gets_the_next_free_name() {
+    let mut f = Fixture::new("second-default");
+    f.comp("Main");
+    for _ in 0..3 {
+        f.add(json!({}));
+    }
+    assert_eq!(f.outputs(), [f.path("Main.mp4"), f.path("Main_1.mp4"), f.path("Main_2.mp4")]);
+    // The name is stored in the item: taking the first one out renames nothing, and the name it
+    // frees is the next default.
+    f.s.execute("renderQueue.remove", json!({"index": 1})).unwrap();
+    assert_eq!(f.outputs(), [f.path("Main_1.mp4"), f.path("Main_2.mp4")]);
+    f.add(json!({}));
+    assert_eq!(f.output(2), f.path("Main.mp4"));
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    for file in ["Main.mp4", "Main_1.mp4", "Main_2.mp4"] {
+        assert_eq!(f.read(file), RENDERED, "{file}");
+    }
+    assert_eq!(f.exported().len(), 3);
+}
+
+#[test]
+fn only_outputs_that_name_one_file_are_numbered() {
+    let mut f = Fixture::new("same-file-only");
+    f.comp("Main");
+    f.add(json!({"format": "h264"}));
+    f.add(json!({"format": "prores"}));
+    f.add(json!({"format": "hevc"})); // H.264 and HEVC both write .mp4
+    f.add(json!({"format": "png"}));
+    f.add(json!({"format": "png"})); // the same five frames of the same sequence
+    assert_eq!(f.outputs(), [f.path("Main.mp4"), f.path("Main.mov"), f.path("Main_1.mp4"), f.path("Main_[#####].png"), f.path("Main_1_[#####].png")]);
+    assert!(f.clashes().is_empty());
+}
+
+#[test]
+fn a_default_name_avoids_every_output_module_of_the_other_items() {
+    let mut f = Fixture::new("modules");
+    f.comp("Main");
+    f.add(json!({}));
+    // The item's second module is named Main_2.mp4, so that it does not clash with its first.
+    let item = f.s.execute("render.addOutputModule", json!({})).unwrap();
+    assert_eq!(Path::new(item["extraOutputs"][0]["outputPath"].as_str().unwrap()), f.path("Main_2.mp4"), "{item}");
+    f.add(json!({}));
+    f.add(json!({}));
+    assert_eq!(f.output(1), f.path("Main_1.mp4"));
+    assert_eq!(f.output(2), f.path("Main_3.mp4"), "Main_2.mp4 is the first item's second module");
+    assert!(f.clashes().is_empty());
+}
+
+#[test]
+fn a_name_the_caller_gave_is_never_numbered() {
+    let mut f = Fixture::new("named");
+    f.comp("Main");
+    let out = f.text("final.mp4");
+    f.add(json!({"output": out}));
+    f.add(json!({"output": out}));
+    f.add(json!({"path": out}));
+    assert_eq!(f.outputs(), vec![f.path("final.mp4"); 3]);
+    assert!(f.s.project.render_queue.iter().all(|i| i.output.output == out), "the names stored in the items are the ones given");
+    // Rendering them is what is refused (below): items 2 and 3 each clash with item 1.
+    assert_eq!(f.clashes(), [(2, 1, 1), (3, 1, 1)]);
+}
+
+#[test]
+fn a_pre_render_numbers_its_default_name_too() {
+    let mut f = Fixture::new("pre-render");
+    f.comp("Main");
+    f.s.execute("render.preRender", json!({})).unwrap();
+    f.s.execute("render.preRender", json!({})).unwrap();
+    f.s.execute("render.preRender", json!({"output": f.text("mine.mov")})).unwrap();
+    f.s.execute("render.preRender", json!({"output": f.text("mine.mov")})).unwrap();
+    assert_eq!(f.outputs(), [f.path("Main_prerender.mov"), f.path("Main_prerender_1.mov"), f.path("mine.mov"), f.path("mine.mov")]);
+}
+
+/// File ▸ Create Proxy queues a render with a default name of its own too.
+#[test]
+fn create_proxy_numbers_its_default_name_too() {
+    let mut f = Fixture::new("proxy-names");
+    f.comp("Main");
+    f.s.execute("file.createProxy", json!({"kind": "movie"})).unwrap();
+    f.s.execute("file.createProxy", json!({"kind": "movie"})).unwrap();
+    f.s.execute("file.createProxy", json!({"kind": "movie", "output": f.text("mine.mov")})).unwrap();
+    f.s.execute("file.createProxy", json!({"kind": "movie", "output": f.text("mine.mov")})).unwrap();
+    assert_eq!(f.outputs(), [f.path("Main_proxy.mov"), f.path("Main_proxy_1.mov"), f.path("mine.mov"), f.path("mine.mov")]);
+}
+
+/// Save Frame As ▸ File… with `queue`: every file of a sequence has its frame number in its name,
+/// so two frames of one composition share no file, and the same frame twice does.
+#[test]
+fn queued_frames_number_their_default_names_only_when_they_are_the_same_frame() {
+    let mut f = Fixture::new("frames");
+    f.comp("Main");
+    for time in [0.0, 0.2, 0.0] {
+        f.s.execute("comp.saveFrameAs", json!({"queue": true, "time": time})).unwrap();
+    }
+    assert_eq!(f.outputs(), [f.path("Main_[#####].png"), f.path("Main_[#####].png"), f.path("Main_1_[#####].png")]);
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    for file in ["Main_00000.png", "Main_00002.png", "Main_1_00000.png"] {
+        assert_eq!(f.read(file), RENDERED, "{file}");
+    }
+}
+
+/// The report: two queue items forced to one path (the same Output To) replaced each other's file
+/// inside one job. The render is refused before anything is written, whatever `overwrite` says:
+/// that flag is for files that exist, and this is the render replacing its own output.
+#[test]
+fn two_items_forced_to_one_file_are_reported_and_the_render_is_refused() {
+    let mut f = Fixture::new("one-file");
+    f.comp("Main");
+    let out = f.text("render.mp4");
+    f.add(json!({"output": out}));
+    f.add(json!({"output": out}));
+    let found = f.check();
+    let list = found["duplicates"].as_array().unwrap_or_else(|| panic!("checkOutputs lists no duplicates: {found}"));
+    assert_eq!(list.len(), 1, "{found}");
+    let d = &list[0];
+    let (first, second) = (f.s.project.render_queue[0].id, f.s.project.render_queue[1].id);
+    assert_eq!((d["item"].as_u64(), d["index"].as_u64(), d["comp"].as_str()), (Some(second), Some(2), Some("Main")), "{found}");
+    assert_eq!((d["with"]["item"].as_u64(), d["with"]["index"].as_u64(), d["with"]["comp"].as_str()), (Some(first), Some(1), Some("Main")), "{found}");
+    assert_eq!((d["files"].as_u64(), d["sequence"].as_bool()), (Some(1), Some(false)), "{found}");
+    assert_eq!(Path::new(d["path"].as_str().unwrap_or_default()), f.path("render.mp4"), "{found}");
+    let why = d["reason"].as_str().unwrap_or_default();
+    assert!(why.contains("#1") && why.contains("#2") && why.contains("render.mp4") && why.contains("Output To"), "{found}");
+
+    let queue = f.s.project.render_queue.clone();
+    let e = f.render(json!({})).unwrap_err().to_string();
+    assert!(e.contains("#1") && e.contains("#2") && e.contains("render.mp4") && e.contains("Nothing was rendered"), "{e}");
+    assert!(!f.path("render.mp4").exists());
+    assert!(f.exported().is_empty(), "the exporter was not started");
+    assert_eq!(f.s.project.render_queue, queue, "a refused render changes nothing in the queue");
+
+    // A file that exists as well does not change that: replacing it would not help.
+    f.write("render.mp4", EARLIER);
+    let found = f.check();
+    assert_eq!(found["duplicates"].as_array().map(Vec::len), Some(1), "{found}");
+    let e = f.render(json!({})).unwrap_err().to_string();
+    assert!(e.contains("#2") && e.contains("Nothing was rendered"), "{e}");
+    assert_eq!(f.read("render.mp4"), EARLIER);
+
+    // Another Output To for one of them, and both render.
+    f.s.execute("renderQueue.setOutput", json!({"index": 2, "path": f.text("second.mp4")})).unwrap();
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    assert_eq!((f.read("render.mp4"), f.read("second.mp4")), (RENDERED.to_vec(), RENDERED.to_vec()));
+}
+
+/// `renderQueue.duplicate` copies the item as it is, output included: it is reported until one of
+/// the two gets another Output To (or is turned off).
+#[test]
+fn a_duplicated_item_is_a_copy_and_clashes_until_one_of_them_changes() {
+    let mut f = Fixture::new("duplicate");
+    f.comp("Main");
+    f.add(json!({}));
+    f.s.execute("renderQueue.duplicate", json!({"index": 1})).unwrap();
+    assert_eq!(f.outputs(), [f.path("Main.mp4"), f.path("Main.mp4")], "a duplicate is a copy, its output included");
+    assert_eq!(f.clashes(), [(2, 1, 1)]);
+    let e = f.render(json!({})).unwrap_err().to_string();
+    assert!(e.contains("#1") && e.contains("#2") && e.contains("Main.mp4"), "{e}");
+    assert!(f.exported().is_empty());
+    // Turned off, the copy is not part of the job.
+    f.s.execute("renderQueue.setRender", json!({"index": 2, "render": false})).unwrap();
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("Main.mp4"), RENDERED);
+    assert_eq!(f.exported().len(), 1);
+}
+
+/// Only the items of the job are compared: an earlier job's file is a file that exists, and
+/// replacing it is up to `overwrite`.
+#[test]
+fn an_item_that_is_not_in_the_job_does_not_clash() {
+    let mut f = Fixture::new("not-in-job");
+    f.comp("Main");
+    let out = f.text("render.mp4");
+    f.add(json!({"output": out}));
+    f.add(json!({"output": out}));
+    f.s.execute("renderQueue.setRender", json!({"index": 2, "render": false})).unwrap();
+    f.render(json!({})).unwrap(); // item 1 renders alone
+    f.s.execute("renderQueue.setRender", json!({"index": 2, "render": true})).unwrap();
+    assert!(f.clashes().is_empty(), "item 1 is done and is not in this job");
+    // item 2 now replaces the file item 1 wrote in the earlier job: an ordinary file, left to the exporter
+    f.render(json!({})).unwrap();
+}
+
+#[test]
+fn another_spelling_of_one_file_is_one_file_where_the_volume_ignores_case() {
+    let mut f = Fixture::new("spellings");
+    f.comp("Main");
+    f.write("probe.txt", b"x");
+    if !f.path("PROBE.TXT").exists() {
+        eprintln!("this volume tells the two names apart: skipped");
+        return;
+    }
+    f.add(json!({"output": f.text("Render.mp4")}));
+    f.add(json!({"output": f.text("render.MP4")}));
+    f.add(json!({"output": f.dir.join("sub").join("..").join("RENDER.mp4").to_string_lossy()}));
+    f.add(json!({"output": f.text("other.mp4")}));
+    assert_eq!(f.clashes(), [(2, 1, 1), (3, 1, 1)]);
+}
+
+/// A sequence writes one file per frame: two items of one pattern clash on the frames they share,
+/// and not at all when their frames differ.
+#[test]
+fn sequences_clash_only_on_the_frames_they_both_write() {
+    let mut f = Fixture::new("sequence-halves");
+    f.comp("Main");
+    let pattern = f.text("seq_[#####].png");
+    f.add(span(&pattern, 0.0, 0.2)); // frames 0-1
+    f.add(span(&pattern, 0.2, 0.5)); // frames 2-4
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    for n in 0..5 {
+        assert_eq!(f.read(&format!("seq_{n:05}.png")), RENDERED, "frame {n}");
+    }
+
+    let mut f = Fixture::new("sequence-overlap");
+    f.comp("Main");
+    let pattern = f.text("seq_[#####].png");
+    f.add(span(&pattern, 0.0, 0.2));
+    f.add(span(&pattern, 0.2, 0.5));
+    f.add(span(&pattern, 0.3, 0.5)); // frames 3-4 again
+    assert_eq!(f.clashes(), [(3, 2, 2)]);
+    let found = f.check();
+    assert_eq!(found["duplicates"][0]["sequence"], true, "{found}");
+    let e = f.render(json!({"overwrite": true})).unwrap_err().to_string();
+    assert!(e.contains("#2") && e.contains("#3") && e.contains("2 frames") && e.contains("seq_[#####].png"), "{e}");
+    assert!(!f.path("seq_00000.png").exists(), "the frames before the clash were not rendered either");
+    assert!(f.exported().is_empty());
+}
+
+#[test]
+fn differently_padded_sequences_cannot_replace_the_same_frames() {
+    let mut f = Fixture::new("padding-width-clash");
+    f.s.execute("comp.new", json!({"name": "Main", "width": 16, "height": 16, "frameRate": 10, "duration": 2})).unwrap();
+    f.add(span(&f.text("seq_[#].png"), 0.9, 1.2));
+    f.add(span(&f.text("seq_[##].png"), 0.9, 1.2));
+    assert_eq!(f.clashes(), [(2, 1, 2)]);
+    assert!(f.render(json!({})).is_err());
+    assert!(f.exported().is_empty());
+}
+
+/// Skip Existing Files leaves a frame alone when it is there: the item that skips and comes second
+/// writes only what the first did not. The item that skips and comes first is written over.
+#[test]
+fn a_later_item_that_skips_existing_frames_leaves_the_earlier_ones_alone() {
+    let mut f = Fixture::new("skip-later");
+    f.comp("Main");
+    let pattern = f.text("seq_[#####].png");
+    f.add(json!({"format": "png", "output": pattern}));
+    f.add(json!({"format": "png", "output": pattern, "skipExisting": true}));
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("seq_00004.png"), RENDERED);
+
+    let mut f = Fixture::new("skip-earlier");
+    f.comp("Main");
+    let pattern = f.text("seq_[#####].png");
+    f.add(json!({"format": "png", "output": pattern, "skipExisting": true}));
+    f.add(json!({"format": "png", "output": pattern}));
+    assert_eq!(f.clashes(), [(2, 1, 5)]);
+}
+
+#[test]
+fn two_output_modules_of_one_item_cannot_share_a_file() {
+    let mut f = Fixture::new("two-modules");
+    f.comp("Main");
+    let out = f.text("render.mp4");
+    f.add(json!({"output": out}));
+    f.s.execute("render.addOutputModule", json!({"output": out})).unwrap();
+    assert_eq!(f.clashes(), [(1, 1, 1)]);
+    let e = f.render(json!({})).unwrap_err().to_string();
+    assert!(e.contains("#1") && e.contains("twice"), "{e}");
+    assert!(f.exported().is_empty());
+}
+
+/// Settings ▸ Export ▸ Segment Sequences puts each item's frames in numbered folders: default
+/// names keep two items' folders apart, and items given one name clash segment by segment.
+#[test]
+fn segmented_sequences_clash_segment_by_segment() {
+    let mut f = Fixture::new("segments");
+    f.comp("Main");
+    f.s.prefs.export.segment_sequences = true;
+    f.s.prefs.export.segment_sequence_files = 2; // five frames: segments of 2, 2 and 1
+    f.add(json!({"format": "png"}));
+    f.add(json!({"format": "png"}));
+    assert_eq!(f.output(1), f.path("Main_1_[#####].png"));
+    assert!(f.clashes().is_empty());
+    f.render(json!({})).unwrap();
+    assert_eq!(f.read("Main_001/Main_00000.png"), RENDERED);
+    assert_eq!(f.read("Main_1_003/Main_1_00004.png"), RENDERED);
+
+    let mut f = Fixture::new("segments-named");
+    f.comp("Main");
+    f.s.prefs.export.segment_sequences = true;
+    f.s.prefs.export.segment_sequence_files = 2;
+    let pattern = f.text("seg_[#####].png");
+    f.add(json!({"format": "png", "output": pattern}));
+    f.add(json!({"format": "png", "output": pattern}));
+    assert_eq!(f.clashes(), [(2, 1, 2), (2, 1, 2), (2, 1, 1)]);
+    let e = f.render(json!({})).unwrap_err().to_string();
+    assert!(e.contains("2 more"), "the first clash is named, the rest counted: {e}");
+    assert!(f.exported().is_empty());
+}
+
+/// An item that is refused for the file it would replace does not write anything, so it cannot
+/// clash with another item.
+#[test]
+fn items_refused_for_footage_are_not_compared_with_each_other() {
+    let mut f = Fixture::new("refused-pair");
+    f.footage("clip.mov");
+    f.comp("Main");
+    let clip = f.text("clip.mov");
+    f.add(json!({"format": "prores", "output": clip}));
+    f.add(json!({"format": "prores", "output": clip}));
+    f.add(json!({"output": f.text("ok.mp4")}));
+    let found = f.check();
+    assert_eq!(found["duplicates"].as_array().map(Vec::len), Some(0), "{found}");
+    let r = f.render(json!({})).unwrap();
+    let failed = r["items"].as_array().unwrap().iter().filter(|i| i["status"].get("Failed").is_some()).count();
+    assert_eq!(failed, 2, "both items on the footage are refused: {r}");
+    assert_eq!(f.read("clip.mov"), SOURCE);
+    assert_eq!(f.read("ok.mp4"), RENDERED);
+}
diff --git a/crates/engine/src/tests/replace_source.rs b/crates/engine/src/tests/replace_source.rs
new file mode 100644
index 000000000..a5cb252ce
--- /dev/null
+++ b/crates/engine/src/tests/replace_source.rs
@@ -0,0 +1,158 @@
+//! Layer ▸ Replace Source (#991, and the `replaceSource` part of #813): Alt-drag and Ctrl+Alt+/
+//! replace an AV layer's source while every other layer property stays.
+
+use std::sync::Arc;
+
+use effectcraft_color::Label;
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, LayerSource, Solid};
+use serde_json::json;
+
+use crate::Session;
+
+fn comp() -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 640, "height": 360, "frameRate": 30, "duration": 10})).unwrap();
+    s
+}
+
+fn layer(s: &Session, id: u64) -> effectcraft_project::Layer {
+    s.active_comp().unwrap().layer(effectcraft_project::LayerId(id)).unwrap().clone()
+}
+
+fn solid(s: &mut Session, name: &str) -> u64 {
+    s.execute("layer.newSolid", json!({"name": name, "color": "#ff0000", "width": 200, "height": 100})).unwrap()["layer"].as_u64().unwrap()
+}
+
+fn add_footage(s: &mut Session, name: &str, kind: FootageKind, width: u32, height: u32, has_audio: bool) -> ItemId {
+    let f = Footage { path: format!("/tmp/{name}"), kind, width, height, has_video: kind != FootageKind::Data, has_audio, ..Default::default() };
+    Arc::make_mut(&mut s.project).add_item(name, Label::None, None, ItemKind::Footage(f))
+}
+
+/// The replacement changes `source` and nothing else: name, label, comment, timing, stretch,
+/// switches, blending, parenting, track matte and the whole property tree (keys, expression,
+/// effect, mask) stay.
+#[test]
+fn replace_source_keeps_every_layer_property() {
+    let mut s = comp();
+    let a = solid(&mut s, "Hero");
+    let parent = solid(&mut s, "Parent");
+    let matte = solid(&mut s, "Matte");
+    s.execute("layer.timing", json!({"layers": [a], "in": 1.0, "out": 5.0})).unwrap();
+    s.execute("layer.timeStretch", json!({"layers": [a], "percent": 50})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [a], "switch": "preserveTransparency", "value": true})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [a], "switch": "motionBlur", "value": true})).unwrap();
+    s.execute("layer.setBlendMode", json!({"layers": [a], "mode": "Multiply"})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [a], "parent": parent, "compensate": false})).unwrap();
+    s.execute("layer.setTrackMatte", json!({"layer": a, "matte": matte, "kind": "alpha"})).unwrap();
+    s.execute("layer.setComment", json!({"layers": [a], "comment": "keep me"})).unwrap();
+    s.execute("effect.apply", json!({"layer": a, "effect": "Gaussian Blur"})).unwrap();
+    s.execute("mask.new", json!({"layer": a, "vertices": [[10, 10], [90, 10], [90, 90]], "closed": true})).unwrap();
+    s.execute("prop.addKey", json!({"layer": a, "path": "transform/opacity", "time": 1.0, "value": 25.0})).unwrap();
+    s.execute("prop.addKey", json!({"layer": a, "path": "transform/opacity", "time": 2.0, "value": 75.0})).unwrap();
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "time * 90"})).unwrap();
+    let before = layer(&s, a);
+    let item = add_footage(&mut s, "new.png", FootageKind::Still, 120, 80, false);
+    s.execute("layer.replaceSource", json!({"layers": [a], "item": item.0})).unwrap();
+    let after = layer(&s, a);
+    assert_eq!(after.source, LayerSource::Footage { item });
+    assert_eq!(after.name, before.name);
+    assert_eq!(after.label, before.label);
+    assert_eq!(after.comment, before.comment);
+    assert_eq!((after.start_time, after.in_point, after.out_point, after.stretch), (before.start_time, before.in_point, before.out_point, before.stretch));
+    assert_eq!((after.switches, after.blend_mode, after.preserve_transparency), (before.switches, before.blend_mode, before.preserve_transparency));
+    assert_eq!((after.parent, after.track_matte), (before.parent, before.track_matte));
+    assert_eq!(after.props, before.props);
+    assert_eq!(s.active_comp().unwrap().layers.len(), 3, "no layer is added or removed");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(layer(&s, a).source, before.source, "one undo step restores the source");
+}
+
+/// Composition, footage and solid sources are interchangeable; a precomposition adds its Audio
+/// group when the layer has none, and an existing Audio group is kept when the next source has no
+/// audio.
+#[test]
+fn replace_source_crosses_types_and_adds_audio() {
+    let mut s = comp();
+    let a = solid(&mut s, "Layer");
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 200, "height": 100, "frameRate": 25, "duration": 3})).unwrap()["comp"].as_u64().unwrap();
+    let main = s.project.items.values().find(|i| i.name == "Main").unwrap().id;
+    s.execute("comp.open", json!({"comp": main})).unwrap();
+    let before = layer(&s, a);
+    s.execute("layer.replaceSource", json!({"layers": [a], "item": inner})).unwrap();
+    let after = layer(&s, a);
+    assert_eq!(after.source, LayerSource::Comp { item: ItemId(inner) });
+    assert_eq!(after.name, before.name);
+    assert!(after.props.sub("audio").is_some(), "a precomposition brings Audio");
+    let footage = add_footage(&mut s, "still.png", FootageKind::Still, 64, 32, false);
+    s.execute("layer.replaceSource", json!({"layers": [a], "item": footage.0})).unwrap();
+    let after = layer(&s, a);
+    assert_eq!(after.source, LayerSource::Footage { item: footage });
+    assert!(after.props.sub("audio").is_some(), "the Audio group is preserved for the next source");
+    let new_solid = Arc::make_mut(&mut s.project).add_item(
+        "New Solid",
+        Label::None,
+        None,
+        ItemKind::Solid(Solid { color: [0.0, 1.0, 0.0], width: 10, height: 10, pixel_aspect: 1.0 }),
+    );
+    s.execute("layer.replaceSource", json!({"layers": [a], "item": new_solid.0})).unwrap();
+    assert_eq!(layer(&s, a).source, LayerSource::Solid { item: new_solid });
+    assert_eq!(s.active_comp().unwrap().layers.len(), 1);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(layer(&s, a).source, LayerSource::Footage { item: footage });
+}
+
+/// Folders, data files, 3D models, non-source layers and composition cycles are refused before
+/// anything is edited.
+#[test]
+fn replace_source_refuses_invalid_sources_targets_and_cycles() {
+    let mut s = comp();
+    let a = solid(&mut s, "Layer");
+    let folder = Arc::make_mut(&mut s.project).add_item("Folder", Label::None, None, ItemKind::Folder);
+    let data = add_footage(&mut s, "data.txt", FootageKind::Data, 0, 0, false);
+    let model = add_footage(&mut s, "model.glb", FootageKind::Model, 10, 10, false);
+    for (item, needle) in [(folder, "folder"), (data, "data"), (model, "3D model")] {
+        let err = s.execute("layer.replaceSource", json!({"layers": [a], "item": item.0})).unwrap_err().to_string();
+        assert!(err.contains(needle), "{err}");
+    }
+    let footage = add_footage(&mut s, "still.png", FootageKind::Still, 10, 10, false);
+    let text = s.execute("layer.newText", json!({"text": "Hello"})).unwrap()["layer"].as_u64().unwrap();
+    let err = s.execute("layer.replaceSource", json!({"layers": [text], "item": footage.0})).unwrap_err().to_string();
+    assert!(err.contains("no source item"), "{err}");
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    let main = s.project.items.values().find(|i| i.name == "Main").unwrap().id;
+    s.execute("comp.open", json!({"comp": main})).unwrap();
+    let inner_layer = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
+    let err = s.execute("layer.replaceSource", json!({"layers": [inner_layer], "item": main.0})).unwrap_err().to_string();
+    assert!(err.contains("contain"), "{err}");
+}
+
+/// Ctrl+Alt+/ takes the source from the Project panel selection and replaces every selected
+/// layer; locked layers are left alone (and an all-locked selection is an error).
+#[test]
+fn replace_source_uses_the_project_selection_and_skips_locked_layers() {
+    let mut s = comp();
+    let a = solid(&mut s, "A");
+    let b = solid(&mut s, "B");
+    let footage = add_footage(&mut s, "still.png", FootageKind::Still, 10, 10, false);
+    s.state.project_selection = vec![footage];
+    let r = s.execute("layer.replaceSource", json!({"layers": [a, b]})).unwrap();
+    assert_eq!(r["item"], json!(footage.0));
+    assert!(matches!(layer(&s, a).source, LayerSource::Footage { item } if item == footage));
+    assert!(matches!(layer(&s, b).source, LayerSource::Footage { item } if item == footage));
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [b], "switch": "lock", "value": true})).unwrap();
+    let old_b = layer(&s, b).source;
+    let r = s.execute("layer.replaceSource", json!({"layers": [a, b], "item": footage.0})).unwrap();
+    assert_eq!(r["layers"], json!([a]));
+    assert!(matches!(layer(&s, a).source, LayerSource::Footage { item } if item == footage));
+    assert_eq!(layer(&s, b).source, old_b);
+    let err = s.execute("layer.replaceSource", json!({"layers": [b], "item": footage.0})).unwrap_err().to_string();
+    assert!(err.contains("locked"), "{err}");
+}
+
+/// After Effects' Ctrl+Alt+/ default (Cmd+Alt+/ in EffectCraft's shortcut syntax).
+#[test]
+fn replace_source_is_bound_to_ctrl_alt_slash() {
+    let b = crate::shortcuts::bindables(&[]).into_iter().find(|b| b.command == "layer.replaceSource").expect("layer.replaceSource is bindable");
+    assert!(b.defaults.iter().any(|d| d == "Cmd+Alt+/"), "{:?}", b.defaults);
+}
diff --git a/crates/engine/src/tests_rig3d.rs b/crates/engine/src/tests/rig3d.rs
similarity index 54%
rename from crates/engine/src/tests_rig3d.rs
rename to crates/engine/src/tests/rig3d.rs
index d3b965107..2c1557c91 100644
--- a/crates/engine/src/tests_rig3d.rs
+++ b/crates/engine/src/tests/rig3d.rs
@@ -7,7 +7,7 @@ use std::sync::Arc;
 use effectcraft_geom::{Vec3, vec3};
 use effectcraft_keyframe::Value as KV;
 use effectcraft_project::{Footage, FootageKind, GroupKind, ItemId, Layer, LayerId, LayerSource, LightKind, Project};
-use effectcraft_render::three_d::camera::layer_frame;
+use effectcraft_render::three_d::camera::{is_two_node, layer_frame};
 use effectcraft_render::{EvalCtx, FootageSource, RenderOpts};
 use effectcraft_time::{FrameRate, Tick};
 use serde_json::{Value, json};
@@ -40,7 +40,17 @@ fn close3(a: [f64; 3], b: [f64; 3], tol: f64) -> bool {
 fn frame(s: &Session, id: u64) -> (Vec3, Vec3) {
     let c = cid(s);
     let comp = s.project.comp(c).unwrap();
-    let ctx = EvalCtx { project: &s.project, comp_id: c, comp, time: Tick::ZERO, expr: None, footage: None };
+    let ctx = EvalCtx {
+        project: &s.project,
+        comp_id: c,
+        comp,
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let (e, f, _) = layer_frame(&ctx, comp.layer(LayerId(id)).unwrap());
     (e, f)
 }
@@ -49,6 +59,50 @@ fn camera(s: &mut Session) -> u64 {
     s.execute("layer.newCamera", json!({"name": "Cam", "position": [320, 180, -800], "poi": [320, 180, 0], "zoom": 900})).unwrap()["layer"].as_u64().unwrap()
 }
 
+/// Controls on a hidden null in the source comp.
+fn assert_stereo_controls(ctl: &Layer) {
+    assert_eq!(ctl.name, "Stereo 3D Controls");
+    assert!(!ctl.switches.video);
+    let fx = ctl.effects().unwrap().groups().next().unwrap().clone();
+    assert!(matches!(&fx.kind, GroupKind::Effect { effect } if effect == effectcraft_effects::controls::STEREO_CONTROLS));
+    assert_eq!(fx.get("sceneDepth").unwrap().value, KV::Scalar(4.0));
+}
+
+/// An eye comp: an eye camera (two-node, linked by expressions) at `x` and the collapsed source comp.
+fn assert_eye_comp(s: &Session, src: ItemId, ec: ItemId, name: &str, x: f64) {
+    assert_eq!(s.project.item(ec).unwrap().name, name);
+    let c = s.project.comp(ec).unwrap();
+    assert_eq!((c.width, c.height), (640, 360));
+    assert_eq!(c.layers.len(), 2);
+    let cam = &c.layers[0];
+    assert!(cam.is_camera() && effectcraft_render::three_d::camera::is_two_node(cam));
+    assert!(close3(v3(cam, "transform/position"), [x, 180.0, -800.0], 1e-6), "{:?}", v3(cam, "transform/position"));
+    // Parallel eyes (no convergence): each looks straight ahead.
+    assert!(close3(v3(cam, "transform/poi"), [x, 180.0, 0.0], 1e-6), "{:?}", v3(cam, "transform/poi"));
+    assert_eq!(cam.props.prop("cameraOptions/zoom").unwrap().value, KV::Scalar(900.0));
+    for p in ["transform/position", "transform/poi", "cameraOptions/zoom"] {
+        let e = cam.props.prop(p).unwrap().expr.clone().unwrap();
+        assert!(e.text.contains("comp(\"Scene\")") && e.text.contains("Cam"), "{p}: {}", e.text);
+    }
+    let nest = &c.layers[1];
+    assert_eq!(nest.source, LayerSource::Comp { item: src });
+    assert!(nest.switches.collapse && nest.switches.three_d);
+}
+
+/// The stereo comp: left eye on top with 3D Glasses fed by both eyes; right eye hidden.
+fn assert_stereo_comp(s: &Session, r: &serde_json::Value) {
+    let oc = ItemId(r["stereoComp"].as_u64().unwrap());
+    let out = s.project.comp(oc).unwrap();
+    assert_eq!(s.project.item(oc).unwrap().name, "Scene Stereo 3D");
+    let (l, rr) = (r["leftLayer"].as_u64().unwrap(), r["rightLayer"].as_u64().unwrap());
+    assert_eq!(out.layers[0].id.0, l);
+    assert!(!out.layers[1].switches.video);
+    let g = out.layers[0].effects().unwrap().groups().next().unwrap().clone();
+    assert!(matches!(&g.kind, GroupKind::Effect { effect } if effect == "ec.perspective.3dglasses"));
+    assert_eq!(g.get("leftView").unwrap().value, KV::Layer(Some(l)));
+    assert_eq!(g.get("rightView").unwrap().value, KV::Layer(Some(rr)));
+}
+
 #[test]
 fn stereo_rig_builds_eye_comps_and_glasses() {
     let mut s = session();
@@ -58,46 +112,12 @@ fn stereo_rig_builds_eye_comps_and_glasses() {
     let r = s.execute("camera.stereoRig", json!({"sceneDepth": 4})).unwrap();
     assert_eq!(s.project.items.len(), items_before + 3, "left, right and stereo comps");
     assert_eq!(r["master"].as_u64(), Some(cam));
-    // Controls on a hidden null in the source comp.
-    let ctl = layer_in(&s, src, r["controls"].as_u64().unwrap());
-    assert_eq!(ctl.name, "Stereo 3D Controls");
-    assert!(!ctl.switches.video);
-    let fx = ctl.effects().unwrap().groups().next().unwrap().clone();
-    assert!(matches!(&fx.kind, GroupKind::Effect { effect } if effect == effectcraft_effects::controls::STEREO_CONTROLS));
-    assert_eq!(fx.get("sceneDepth").unwrap().value, KV::Scalar(4.0));
-    // Eye comps: an eye camera (two-node, linked by expressions) and the collapsed source comp.
+    assert_stereo_controls(&layer_in(&s, src, r["controls"].as_u64().unwrap()));
     let d = 0.04 * 640.0;
     for (key, name, x) in [("leftComp", "Scene Left Eye", 320.0 - d / 2.0), ("rightComp", "Scene Right Eye", 320.0 + d / 2.0)] {
-        let ec = ItemId(r[key].as_u64().unwrap());
-        assert_eq!(s.project.item(ec).unwrap().name, name);
-        let c = s.project.comp(ec).unwrap();
-        assert_eq!((c.width, c.height), (640, 360));
-        assert_eq!(c.layers.len(), 2);
-        let cam = &c.layers[0];
-        assert!(cam.is_camera() && effectcraft_render::three_d::camera::is_two_node(cam));
-        assert!(close3(v3(cam, "transform/position"), [x, 180.0, -800.0], 1e-6), "{:?}", v3(cam, "transform/position"));
-        // Parallel eyes (no convergence): each looks straight ahead.
-        assert!(close3(v3(cam, "transform/poi"), [x, 180.0, 0.0], 1e-6), "{:?}", v3(cam, "transform/poi"));
-        assert_eq!(cam.props.prop("cameraOptions/zoom").unwrap().value, KV::Scalar(900.0));
-        for p in ["transform/position", "transform/poi", "cameraOptions/zoom"] {
-            let e = cam.props.prop(p).unwrap().expr.clone().unwrap();
-            assert!(e.text.contains("comp(\"Scene\")") && e.text.contains("Cam"), "{p}: {}", e.text);
-        }
-        let nest = &c.layers[1];
-        assert_eq!(nest.source, LayerSource::Comp { item: src });
-        assert!(nest.switches.collapse && nest.switches.three_d);
+        assert_eye_comp(&s, src, ItemId(r[key].as_u64().unwrap()), name, x);
     }
-    // The stereo comp: left eye on top with 3D Glasses fed by both eyes; right eye hidden.
-    let oc = ItemId(r["stereoComp"].as_u64().unwrap());
-    let out = s.project.comp(oc).unwrap();
-    assert_eq!(s.project.item(oc).unwrap().name, "Scene Stereo 3D");
-    let (l, rr) = (r["leftLayer"].as_u64().unwrap(), r["rightLayer"].as_u64().unwrap());
-    assert_eq!(out.layers[0].id.0, l);
-    assert!(!out.layers[1].switches.video);
-    let g = out.layers[0].effects().unwrap().groups().next().unwrap().clone();
-    assert!(matches!(&g.kind, GroupKind::Effect { effect } if effect == "ec.perspective.3dglasses"));
-    assert_eq!(g.get("leftView").unwrap().value, KV::Layer(Some(l)));
-    assert_eq!(g.get("rightView").unwrap().value, KV::Layer(Some(rr)));
+    assert_stereo_comp(&s, &r);
     // One undo step; redo; serde.
     let json = serde_json::to_string(&*s.project).unwrap();
     let back: Project = serde_json::from_str(&json).unwrap();
@@ -207,8 +227,187 @@ fn control_light_with_camera_follows_and_releases() {
     assert!(s.execute("light.controlWithCamera", json!({"layers": [cam]})).is_err());
 }
 
+/// Parenting keeps a camera where it is (After Effects' Parent & Link): Position and Point of
+/// Interest are re-expressed in the null's space, so the frame does not move.
+#[test]
+fn parented_camera_keeps_its_frame_under_an_offset_null() {
+    let mut s = session();
+    let cam = camera(&mut s);
+    let (eye0, f0) = frame(&s, cam);
+    let nul = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/position", "value": [100, 60, 0]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [cam], "parent": nul})).unwrap();
+    let (eye1, f1) = frame(&s, cam);
+    assert!((eye1 - eye0).length() < 1e-6 && (f1 - f0).length() < 1e-6, "{eye0:?} {eye1:?}");
+    // The null's origin is Position minus its default anchor (50, 50): (50, 10) in the comp.
+    let c = layer_in(&s, cid(&s), cam);
+    assert!(close3(v3(&c, "transform/position"), [270.0, 170.0, -800.0], 1e-6), "{:?}", v3(&c, "transform/position"));
+    assert!(close3(v3(&c, "transform/poi"), [270.0, 170.0, 0.0], 1e-6), "{:?}", v3(&c, "transform/poi"));
+    // Moving the null carries the camera and keeps its aim.
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/position", "value": [140, 90, 0]})).unwrap();
+    let (eye2, f2) = frame(&s, cam);
+    assert!((eye2 - (eye0 + vec3(40.0, 30.0, 0.0))).length() < 1e-6, "{eye2:?}");
+    assert!((f2 - f0).length() < 1e-6, "{f2:?}");
+}
+
+/// World (eye, forward, down) of a layer in the active comp at time `t`.
+fn frame_at(s: &Session, id: u64, t: Tick) -> (Vec3, Vec3, Vec3) {
+    let c = cid(s);
+    let comp = s.project.comp(c).unwrap();
+    let ctx = EvalCtx { project: &s.project, comp_id: c, comp, time: t, expr: None, footage: None, property_overrides: &[], media_overrides: &[], reads: None };
+    layer_frame(&ctx, comp.layer(LayerId(id)).unwrap())
+}
+
+/// Whether two frames agree on eye, forward and down.
+fn frames_match(a: (Vec3, Vec3, Vec3), b: (Vec3, Vec3, Vec3)) -> bool {
+    (a.0 - b.0).length() < 1e-6 && (a.1 - b.1).length() < 1e-6 && (a.2 - b.2).length() < 1e-6
+}
+
+/// A 3D null off-centre in the comp, with an Orientation and a Z rotation.
+fn rotated_null(s: &mut Session, orientation: [f64; 3], turn: f64) -> u64 {
+    let nul = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [nul], "switch": "threeD", "value": true})).unwrap();
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/position", "value": [100, 60, 40]})).unwrap();
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/orientation", "value": orientation})).unwrap();
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/rotation", "value": turn})).unwrap();
+    nul
+}
+
+/// A two-node camera under a rotated null keeps its eye, aim and roll: its Orientation is
+/// re-expressed against the new aim, so Up does not drift.
+#[test]
+fn two_node_camera_under_rotated_null_keeps_its_roll() {
+    let mut s = session();
+    let cam = camera(&mut s);
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/rotation", "value": 25})).unwrap();
+    assert!(is_two_node(&layer_in(&s, cid(&s), cam)));
+    let before = frame_at(&s, cam, Tick::ZERO);
+    let nul = rotated_null(&mut s, [20.0, -35.0, 60.0], 30.0);
+    s.execute("layer.setParent", json!({"layers": [cam], "parent": nul})).unwrap();
+    let after = frame_at(&s, cam, Tick::ZERO);
+    assert!(frames_match(before, after), "{before:?} {after:?}");
+}
+
+#[test]
+fn parented_point_light_keeps_its_direction_under_a_rotated_null() {
+    let mut s = session();
+    let light = s.execute("layer.newLight", json!({"kind": "Point", "position": [320, 180, -500]})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": light, "path": "transform/orientation", "value": [30, 0, 0]})).unwrap();
+    let (eye0, f0) = frame(&s, light);
+    let nul = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/position", "value": [100, 60, 0]})).unwrap();
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/rotation", "value": 30})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [light], "parent": nul})).unwrap();
+    let (eye1, f1) = frame(&s, light);
+    assert!((eye1 - eye0).length() < 1e-6 && (f1 - f0).length() < 1e-6, "{eye0:?} {eye1:?} {f0:?} {f1:?}");
+}
+
+/// Keyed Orientation under a Z-only turn is re-expressed exactly, so the light keeps its direction at
+/// every time, between the keys too.
+#[test]
+fn keyed_orientation_under_a_z_turn_keeps_the_direction_at_every_time() {
+    let mut s = session();
+    let light = s.execute("layer.newLight", json!({"kind": "Point", "position": [320, 180, -500]})).unwrap()["layer"].as_u64().unwrap();
+    for (time, value) in [(0.0, json!([-8.0, 12.0, -13.0])), (1.0, json!([5.0, 18.0, 14.0]))] {
+        s.execute("prop.addKey", json!({"layer": light, "path": "transform/orientation", "time": time, "value": value})).unwrap();
+    }
+    let times = [0.0, 0.25, 0.5, 0.75, 1.0].map(Tick::from_seconds_f64);
+    let before = times.map(|t| frame_at(&s, light, t));
+    let nul = rotated_null(&mut s, [0.0, 0.0, 0.0], 30.0);
+    s.execute("layer.setParent", json!({"layers": [light], "parent": nul})).unwrap();
+    for (t, b) in times.into_iter().zip(before) {
+        assert!(frames_match(b, frame_at(&s, light, t)), "a Z-only turn keeps the light's direction");
+    }
+}
+
+/// Under a tilted null the re-expressed endpoints preserve the quaternion arc exactly,
+/// without adding keys between them.
+#[test]
+fn keyed_orientation_under_a_tilted_null_follows_between_the_keys() {
+    {
+        let mut s = session();
+        let light = s.execute("layer.newLight", json!({"kind": "Point", "position": [320, 180, -500]})).unwrap()["layer"].as_u64().unwrap();
+        for (time, value) in [(0.0, json!([-8.0, 12.0, -13.0])), (1.5, json!([50.0, 118.0, 74.0]))] {
+            s.execute("prop.addKey", json!({"layer": light, "path": "transform/orientation", "time": time, "value": value})).unwrap();
+        }
+        let times = [0.0, 0.2, 0.5, 0.9, 1.3, 1.5].map(Tick::from_seconds_f64);
+        let before = times.map(|t| frame_at(&s, light, t));
+        let nul = rotated_null(&mut s, [20.0, -35.0, 60.0], 30.0);
+        s.execute("layer.setParent", json!({"layers": [light], "parent": nul})).unwrap();
+        for (t, b) in times.into_iter().zip(before) {
+            let a = frame_at(&s, light, t);
+            assert!((a.0 - b.0).length() < 1e-6 && (a.1 - b.1).length() < 1e-8, "at {t:?}: {:?} vs {:?}", a.1, b.1);
+        }
+        assert_eq!(layer_in(&s, cid(&s), light).props.prop("transform/orientation").unwrap().keys.len(), 2, "quaternion arcs need no extra keys");
+    }
+}
+
+/// A one-node light parented under a mirrored null (Z scale -100%) keeps the Position and
+/// Orientation it was authored with: it has no Scale to carry the mirror, so none of it is
+/// compensated rather than reversing its frame (a half-compensated light would point backwards).
+#[test]
+fn one_node_light_under_a_mirrored_null_keeps_its_authored_values() {
+    let mut s = session();
+    let light = s.execute("layer.newLight", json!({"kind": "Point", "position": [320, 180, -500]})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": light, "path": "transform/orientation", "value": [30, 0, 0]})).unwrap();
+    let before = layer_in(&s, cid(&s), light);
+    let nul = rotated_null(&mut s, [0.0, 0.0, 0.0], 0.0);
+    s.execute("prop.set", json!({"layer": nul, "path": "transform/scale", "value": [100, 100, -100]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [light], "parent": nul})).unwrap();
+    let after = layer_in(&s, cid(&s), light);
+    assert_eq!(after.parent, Some(LayerId(nul)));
+    assert_eq!(v3(&after, "transform/position"), v3(&before, "transform/position"));
+    assert_eq!(v3(&after, "transform/orientation"), v3(&before, "transform/orientation"));
+}
+
+/// Many strongly eased Orientation segments keep their authored key count and easing.
+#[test]
+fn reexpressed_orientation_preserves_key_count_across_the_whole_property() {
+    let mut s = session();
+    let light = s.execute("layer.newLight", json!({"kind": "Point", "position": [320, 180, -500]})).unwrap()["layer"].as_u64().unwrap();
+    let count = 120;
+    for i in 0..count {
+        let swing = if i % 2 == 0 { json!([0.0, 0.0, 0.0]) } else { json!([170.0, 60.0, 120.0]) };
+        s.execute("prop.addKey", json!({"layer": light, "path": "transform/orientation", "time": i as f64 * 0.05, "value": swing})).unwrap();
+    }
+    let uid = layer_in(&s, cid(&s), light).props.prop("transform/orientation").unwrap().uid;
+    let keys: Vec<_> = (0..count).map(|i| json!({"layer": light, "prop": uid, "time": i as f64 * 0.05})).collect();
+    s.execute("keys.select", json!({"keys": keys})).unwrap();
+    s.execute("keys.easyEase", json!({})).unwrap();
+    let nul = rotated_null(&mut s, [20.0, -35.0, 60.0], 30.0);
+    s.execute("layer.setParent", json!({"layers": [light], "parent": nul})).unwrap();
+    let n = layer_in(&s, cid(&s), light).props.prop("transform/orientation").unwrap().keys.len();
+    assert_eq!(n, count, "re-expressing quaternion arcs must not add keys");
+    // Re-expressed endpoints retain their authored easing.
+    let orientation = layer_in(&s, cid(&s), light);
+    let keys = &orientation.props.prop("transform/orientation").unwrap().keys;
+    let last = keys.iter().rev().nth(1).expect("the penultimate key");
+    assert_ne!(last.out_interp, effectcraft_keyframe::Interp::Linear, "the last segment keeps its authored easing");
+}
+
 // ---------------------------------------------------------------- from 3D model
 
+/// Easy Ease agrees with a straight blend at the midpoint, but not at the quarter points.
+#[test]
+fn eased_orientation_under_x_parent_keeps_motion_between_keys() {
+    let mut s = session();
+    let light = s.execute("layer.newLight", json!({"kind": "Point", "position": [320, 180, -500]})).unwrap()["layer"].as_u64().unwrap();
+    for (time, value) in [(0.0, json!([0.0, 0.0, 0.0])), (1.0, json!([90.0, 0.0, 0.0]))] {
+        s.execute("prop.addKey", json!({"layer": light, "path": "transform/orientation", "time": time, "value": value})).unwrap();
+    }
+    let uid = layer_in(&s, cid(&s), light).props.prop("transform/orientation").unwrap().uid;
+    s.execute("keys.select", json!({"keys": [{"layer": light, "prop": uid, "time": 0.0}, {"layer": light, "prop": uid, "time": 1.0}]})).unwrap();
+    s.execute("keys.easyEase", json!({})).unwrap();
+    let times: Vec<_> = (0..=100).map(|i| Tick::from_seconds_f64(i as f64 / 100.0)).collect();
+    let before: Vec<_> = times.iter().map(|t| frame_at(&s, light, *t)).collect();
+    let parent = rotated_null(&mut s, [30.0, 0.0, 0.0], 0.0);
+    s.execute("layer.setParent", json!({"layers": [light], "parent": parent})).unwrap();
+    for (t, b) in times.into_iter().zip(before) {
+        let a = frame_at(&s, light, t);
+        assert!((a.0 - b.0).length() < 1e-6 && (a.1 - b.1).length() < 1e-3, "at {t:?}: {:?} vs {:?}", a.1, b.1);
+    }
+}
+
 struct DiskModels;
 
 impl FootageSource for DiskModels {
@@ -240,7 +439,7 @@ const RIGGED: &str = r#"{
   ],
   "cameras": [{"type": "perspective", "name": "Shot", "perspective": {"yfov": 0.6, "znear": 0.1}}],
   "extensions": {"KHR_lights_punctual": {"lights": [
-    {"type": "spot", "name": "Key Light", "color": [1, 0.8, 0.6], "intensity": 1.5, "spot": {"innerConeAngle": 0.25, "outerConeAngle": 0.5}},
+    {"type": "spot", "name": "Screen Color Key", "color": [1, 0.8, 0.6], "intensity": 1.5, "spot": {"innerConeAngle": 0.25, "outerConeAngle": 0.5}},
     {"type": "point", "name": "Fill Light", "intensity": 0.5, "range": 4}
   ]}}
 }"#;
@@ -279,7 +478,7 @@ fn cameras_and_lights_from_model() {
     let r = s.execute("light.fromModel", json!({})).unwrap();
     let ls: Vec<Layer> = r["layers"].as_array().unwrap().iter().map(|v| layer_in(&s, cid(&s), v.as_u64().unwrap())).collect();
     assert_eq!(ls.len(), 2);
-    let key = ls.iter().find(|l| l.name == "Key Light").unwrap();
+    let key = ls.iter().find(|l| l.name == "Screen Color Key").unwrap();
     assert_eq!(key.source, LayerSource::Light { kind: LightKind::Spot });
     assert!((key.props.prop("lightOptions/coneAngle").unwrap().value.as_f64() - 1.0f64.to_degrees()).abs() < 1e-6);
     assert!((key.props.prop("lightOptions/coneFeather").unwrap().value.as_f64() - 50.0).abs() < 1e-6);
diff --git a/crates/engine/src/tests_roto.rs b/crates/engine/src/tests/roto.rs
similarity index 52%
rename from crates/engine/src/tests_roto.rs
rename to crates/engine/src/tests/roto.rs
index 33500b4ec..99c155265 100644
--- a/crates/engine/src/tests_roto.rs
+++ b/crates/engine/src/tests/roto.rs
@@ -8,7 +8,7 @@ use effectcraft_track::roto::rle;
 use serde_json::{Value, json};
 
 use crate::Session;
-use crate::tests_track::{H, W, frame_time, setup};
+use crate::tests::track::{H, W, frame_time, setup};
 
 /// Keep cache/model mutation tests from clearing segmentations under another fixture.
 /// Libtest runs each test on its own thread; the guard lives until that thread exits.
@@ -164,6 +164,33 @@ fn alpha_at(s: &Session, f: u32) -> Vec<f32> {
     img.data.iter().map(|p| p[3]).collect()
 }
 
+/// Green, then Alt (red) over part of the object, then green there again: the last stroke wins,
+/// in the render and through Undo / Redo (#1646).
+#[test]
+fn roto_brush_strokes_correct_earlier_ones() {
+    let (mut s, clip, _) = painted(center, "disk-1646.mov");
+    let c = center(0);
+    let spot = [c[0], c[1] + 25.0];
+    let i = spot[1] as usize * W as usize + spot[0] as usize;
+    let paint = |s: &mut Session, kind: &str| {
+        s.execute_checked(
+            "roto.stroke",
+            json!({"layer": clip.0, "kind": kind, "points": line([spot[0] - 6.0, spot[1]], [spot[0] + 6.0, spot[1]]), "radius": 7}),
+        )
+        .unwrap();
+    };
+    assert!(alpha_at(&s, 0)[i] > 0.5, "the spot starts inside the matte");
+    paint(&mut s, "bg");
+    assert!(alpha_at(&s, 0)[i] < 0.5, "Alt removes it");
+    paint(&mut s, "fg");
+    assert!(alpha_at(&s, 0)[i] > 0.5, "green over the Alt stroke restores it");
+    assert!(iou_at(&mut s, clip, 0, c) > 0.95);
+    assert!(s.undo());
+    assert!(alpha_at(&s, 0)[i] < 0.5, "undo brings the removal back");
+    assert!(s.redo());
+    assert!(alpha_at(&s, 0)[i] > 0.5, "redo restores it again");
+}
+
 #[test]
 fn roto_brush_segments_and_propagates() {
     let (mut s, clip, uid) = painted(center, "disk-a.mov");
@@ -641,3 +668,494 @@ fn object_matte_mattes_persist_in_the_disk_cache() {
     assert!(om::ensure(&moved, size, 25.0, 0, None, &mut |_| None, &|| false).is_none());
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// SAM 2 tracks the clip end to end (needs the real weights: `EFFECTCRAFT_SAM2=path/to/model.safetensors`).
+/// Every frame comes from the tracker with a confidence, the mattes are right, and nothing changes
+/// once the model is deselected.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn sam2_tracks_the_clip_through_roto_propagate() {
+    let Ok(weights) = std::env::var("EFFECTCRAFT_SAM2") else { return };
+    let dir = std::env::temp_dir().join(format!("ec-roto-sam2-{}", std::process::id()));
+    hold_roto_cache_test_lock();
+    let (mut s, clip, _) = painted(center, "disk-sam2.mov");
+    s.models_dir = Some(dir.join("models"));
+    std::fs::create_dir_all(dir.join("models")).unwrap();
+    s.execute_checked("roto.model.install", json!({"path": weights})).unwrap();
+    s.execute_checked("roto.model.select", json!({"id": "sam2.1-hiera-tiny", "wait": true})).unwrap();
+    assert_eq!(s.models.status(effectcraft_segment::Task::Mask).active.as_deref(), Some("sam2.1-hiera-tiny"));
+    let r = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true})).unwrap();
+    assert_eq!(r["frames"], 21, "{r}");
+    let mut worst: f64 = 1.0;
+    for f in 0..=20 {
+        let j = iou_at(&mut s, clip, f, center(f));
+        let st = s.execute("roto.status", json!({"layer": clip.0, "frame": f})).unwrap();
+        eprintln!("frame {f}: IoU {j:.3}, {:?}", st["tracker"]["frames"][f.to_string()]);
+        worst = worst.min(j);
+    }
+    assert!(worst > 0.9, "worst IoU over the span with SAM 2: {worst}");
+    let st = s.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "tracker", "{st}");
+    let frames = st["tracker"]["frames"].as_object().unwrap();
+    assert_eq!(frames.len(), 21);
+    assert!(frames.values().all(|t| t["occluded"] == false && t["confidence"].as_f64().unwrap() > 0.3), "{frames:?}");
+    assert_eq!(st["tracker"]["model"], "sam2.1-hiera-tiny");
+    // Settings choose the classic engine: the saved tracking stays until a Propagate replaces it.
+    s.execute_checked("roto.model.select", json!({"id": "classical", "wait": true})).unwrap();
+    let st = s.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "tracker", "{st}");
+    assert!(st["notice"].as_str().unwrap().contains("Propagate again"), "{st}");
+    assert_eq!(st["computed"].as_array().unwrap().len(), 21, "still computed under another model: {st}");
+    // A classic Propagate: its own segmentation, no tracker data.
+    s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true})).unwrap();
+    let st = s.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "classical", "{st}");
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 0);
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// Choosing a model that is not installed must not fall back to the classic engine silently:
+/// propagate refuses and `roto.status` says why. Choosing the classic engine runs it again.
+#[test]
+fn a_selected_model_that_is_not_installed_refuses_to_propagate() {
+    hold_roto_cache_test_lock();
+    let (mut s, clip, _) = painted(center, "disk-not-installed.mov");
+    s.models_dir = Some(std::env::temp_dir().join(format!("ec-roto-none-{}", std::process::id())));
+    s.execute_checked("roto.model.select", json!({"id": "sam2.1-hiera-tiny"})).unwrap();
+    let st = s.execute("roto.status", json!({"layer": clip.0})).unwrap();
+    assert_eq!(st["model"]["selected"], "sam2.1-hiera-tiny", "{st}");
+    assert_eq!(st["model"]["installed"], false, "{st}");
+    assert!(st["notice"].as_str().unwrap().contains("not installed"), "{st}");
+    let e = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("not installed"), "{e}");
+    assert_eq!(s.execute("roto.status", json!({"layer": clip.0, "frame": 10})).unwrap()["source"], "classical");
+    s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+    let r = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true})).unwrap();
+    assert_eq!(r["frames"], 21, "{r}");
+    assert!(s.execute("roto.status", json!({"layer": clip.0})).unwrap()["notice"].is_null());
+}
+
+/// Selecting SAM 2 without `wait` and propagating at once: propagate loads the model first, so the
+/// tracker (not the classic engine) does the work. Needs EFFECTCRAFT_SAM2 like the test above.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn sam2_selected_without_wait_is_loaded_before_propagate() {
+    let Ok(weights) = std::env::var("EFFECTCRAFT_SAM2") else { return };
+    hold_roto_cache_test_lock();
+    let dir = std::env::temp_dir().join(format!("ec-roto-sam2-wait-{}", std::process::id()));
+    let (mut s, clip, _) = painted(center, "disk-sam2-wait.mov");
+    s.models_dir = Some(dir.join("models"));
+    std::fs::create_dir_all(dir.join("models")).unwrap();
+    s.execute_checked("roto.model.install", json!({"path": weights})).unwrap();
+    s.execute_checked("roto.model.select", json!({"id": "sam2.1-hiera-tiny"})).unwrap();
+    let r = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true})).unwrap();
+    assert_eq!(r["frames"], 21, "{r}");
+    let st = s.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "tracker", "{st}");
+    assert_eq!(st["tracker"]["model"], "sam2.1-hiera-tiny");
+    assert!(st["notice"].is_null(), "{st}");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// A tracker that follows the disc exactly: its true mask on every frame of the request. A stand-in
+/// for SAM 2, so the saved tracking can be tested without the weights.
+struct Exact;
+
+impl effectcraft_segment::MaskModel for Exact {
+    fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+        &effectcraft_segment::SAM2_TINY
+    }
+    fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+        Err("no weights".into())
+    }
+    fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+        Some(self)
+    }
+}
+
+impl effectcraft_segment::ObjectTracker for Exact {
+    fn track(
+        &self,
+        req: &effectcraft_segment::TrackRequest,
+        frame: &mut dyn FnMut(i64) -> Option<std::sync::Arc<effectcraft_segment::ClipFrame>>,
+        _: &dyn Fn() -> bool,
+        out: &mut dyn FnMut(usize, i64, effectcraft_segment::TrackedFrame),
+    ) -> effectcraft_segment::Result<()> {
+        for g in req.first..req.first + req.count as i64 {
+            let Some(img) = frame(g) else { return Err(format!("no frame {g}")) };
+            let c = center(g as u32);
+            let prob = (0..img.w * img.h)
+                .map(|i| ((((i % img.w) as f64 + 0.5 - c[0]).hypot((i / img.w) as f64 + 0.5 - c[1])) <= R) as u8 as f32)
+                .collect::<Vec<f32>>();
+            out(0, g, effectcraft_segment::TrackedFrame { prob, w: img.w, h: img.h, confidence: 0.99, occluded: false });
+        }
+        Ok(())
+    }
+}
+
+/// Saved tracking is part of the project: written with the instance, it applies when the project
+/// opens, with or without the model loaded, and Settings choosing the classic engine leaves it in place
+/// until a Propagate replaces it.
+#[test]
+fn saved_tracking_is_kept_in_the_project_and_applies_when_it_reopens() {
+    let sam2 = "sam2.1-hiera-tiny";
+    let (s, clip, uid, path) = saved_project("saved");
+    // Reopened with SAM 2 chosen but not loaded (none is installed here): the saved frames apply.
+    forget(&s, clip, uid);
+    let mut s2 = Session::default();
+    s2.execute_checked("file.open", json!({"path": path})).unwrap();
+    s2.execute_checked("roto.model.select", json!({"id": sam2})).unwrap();
+    let st = s2.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "tracker", "{st}");
+    assert_eq!(st["tracker"]["saved"], sam2, "{st}");
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 21, "{st}");
+    // The span bar's "computed" frames include the saved ones before anything has been decoded.
+    assert_eq!(st["computed"].as_array().unwrap().len(), 21, "{st}");
+    let j = iou_at(&mut s2, clip, 12, center(12));
+    assert!(j > 0.9, "IoU of a saved frame: {j}");
+    // The render path (Chain::ensure) reads the same frame.
+    let comp = s2.active_comp().unwrap();
+    let l = comp.layer(clip).unwrap();
+    let g = l.props.find_group(uid).unwrap();
+    let size = crate::roto::layer_size(&s2.project, comp, l);
+    let ch = effectcraft_effects::roto::Chain::new(&crate::roto::params_static(g), size, comp.frame_rate.as_f64(), 1.0);
+    let seg = ch.ensure(12, &mut |_| None, &|| false).expect("the render path reads the saved frame");
+    let truth = rle::decode(&gt(center(12))).unwrap();
+    let inter = seg.matte.iter().zip(&truth).filter(|(a, b)| **a != 0 && **b != 0).count();
+    let uni = seg.matte.iter().zip(&truth).filter(|(a, b)| **a != 0 || **b != 0).count();
+    assert!(inter as f64 / uni as f64 > 0.9, "the render path's frame: IoU {}", inter as f64 / uni as f64);
+    // Settings choose the classic engine: the saved frames still apply, and the notice says so.
+    s2.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
+    let st = s2.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "tracker", "{st}");
+    assert!(st["notice"].as_str().unwrap().contains("Propagate again"), "{st}");
+    // A classic Propagate replaces the saved tracking with nothing.
+    // The synthetic source is not a file on disk; give the reopened session its provider before
+    // asking it to recompute frames. The checks above intentionally rendered without that provider.
+    s2.footage = s.footage.clone();
+    s2.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true})).unwrap();
+    let st = s2.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "classical", "{st}");
+    assert!(st["tracker"]["saved"].is_null() && st["notice"].is_null(), "{st}");
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// A reopened project propagated again with the same model and nothing new to track keeps the tracking it has: the
+/// saved frames are not replaced by an empty one, so a later reopen still finds them.
+#[test]
+fn propagating_with_nothing_new_keeps_the_saved_tracking() {
+    let (s, clip, uid, path) = saved_project("keep-saved");
+    forget(&s, clip, uid);
+    let mut s2 = Session::default();
+    s2.execute_checked("file.open", json!({"path": path})).unwrap();
+    s2.footage = s.footage.clone();
+    effectcraft_effects::roto::set_model(Some(std::sync::Arc::new(Exact)));
+    let result = s2.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true}));
+    effectcraft_effects::roto::set_model(None);
+    result.unwrap();
+    let st = s2.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["tracker"]["saved"], "sam2.1-hiera-tiny", "{st}");
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 21, "{st}");
+    // and it is still in the file after saving and reopening
+    s2.execute_checked("file.save", json!({})).unwrap();
+    let mut s3 = Session::default();
+    s3.execute_checked("file.open", json!({"path": path})).unwrap();
+    let st = s3.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 21, "{st}");
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// Freeze reads saved tracking without its model: choosing a model that is not installed does not stop it when
+/// the saved frames cover every frame it freezes.
+#[test]
+fn freeze_uses_complete_saved_tracking_without_the_model() {
+    let (s, clip, uid, path) = saved_project("freeze-saved");
+    forget(&s, clip, uid);
+    let mut s2 = Session::default();
+    s2.execute_checked("file.open", json!({"path": path})).unwrap();
+    s2.footage = s.footage.clone();
+    s2.execute_checked("roto.model.select", json!({"id": "sam2.1-hiera-tiny"})).unwrap();
+    s2.execute_checked("roto.freeze", json!({"layer": clip.0, "wait": true})).unwrap();
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// Propagate replaces a fully saved span when a different tracking model is active.
+#[test]
+fn propagating_saved_tracking_uses_the_new_model() {
+    struct OtherModel;
+    impl effectcraft_segment::MaskModel for OtherModel {
+        fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+            &effectcraft_segment::SAM2_SMALL
+        }
+        fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Err("no weights".into())
+        }
+        fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+            Some(&Exact)
+        }
+    }
+    let (mut s, clip, _uid, path) = saved_project("model-switch");
+    effectcraft_effects::roto::set_model(Some(std::sync::Arc::new(OtherModel)));
+    let result = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true}));
+    effectcraft_effects::roto::set_model(None);
+    result.unwrap();
+    let status = s.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(status["tracker"]["saved"], "sam2.1-hiera-small", "{status}");
+    assert_eq!(status["tracker"]["frames"].as_object().unwrap().len(), 21, "{status}");
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// A tracked clip saved to a project file: the session that tracked it, its layer and instance, and the
+/// file.
+fn saved_project(name: &str) -> (Session, LayerId, u64, String) {
+    let (mut s, clip, uid) = painted(center, &format!("disk-{name}.mov"));
+    effectcraft_effects::roto::set_model(Some(std::sync::Arc::new(Exact)));
+    let r = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true}));
+    effectcraft_effects::roto::set_model(None);
+    assert_eq!(r.unwrap()["frames"], 21);
+    let dir = std::env::temp_dir().join(format!("ec-roto-{name}-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("tracked.ecproj").to_string_lossy().to_string();
+    s.execute_checked("file.saveAs", json!({"path": path})).unwrap();
+    let saved = std::fs::read_to_string(&path).unwrap();
+    assert!(saved.contains("sam2.1-hiera-tiny"), "the project file carries the tracking and the model that made it");
+    (s, clip, uid, path)
+}
+
+/// A stroke change makes the saved tracking stale: the instance is classical until the next Propagate.
+#[test]
+fn a_stroke_change_makes_the_saved_tracking_stale() {
+    let (_s, clip, _uid, path) = saved_project("stale");
+    let mut s2 = Session::default();
+    s2.execute_checked("file.open", json!({"path": path})).unwrap();
+    s2.execute_checked("roto.model.select", json!({"id": "sam2.1-hiera-tiny"})).unwrap();
+    assert_eq!(s2.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap()["source"], "tracker");
+    s2.execute_checked("roto.stroke", json!({"layer": clip.0, "kind": "bg", "points": line([10.0, 10.0], [60.0, 12.0]), "radius": 4})).unwrap();
+    let st = s2.execute("roto.status", json!({"layer": clip.0, "frame": 12})).unwrap();
+    assert_eq!(st["source"], "classical", "{st}");
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 0, "{st}");
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// A tracker that emits a completed frame before failing must leave only classic results behind.
+#[test]
+fn a_partially_failing_tracker_falls_back_to_the_classic_engine() {
+    use effectcraft_segment::{ClipFrame, MaskModel, ModelInfo, ObjectTracker, Prompt, TrackRequest, TrackedFrame};
+    use std::sync::Arc;
+    struct Broken;
+    impl MaskModel for Broken {
+        fn info(&self) -> &'static ModelInfo {
+            &effectcraft_segment::SAM2_TINY
+        }
+        fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+            Err("no weights".into())
+        }
+        fn tracker(&self) -> Option<&dyn ObjectTracker> {
+            Some(self)
+        }
+    }
+    impl ObjectTracker for Broken {
+        fn track(
+            &self,
+            req: &TrackRequest,
+            frame: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+            _: &dyn Fn() -> bool,
+            out: &mut dyn FnMut(usize, i64, TrackedFrame),
+        ) -> effectcraft_segment::Result<()> {
+            let img = frame(req.first).ok_or("missing test frame")?;
+            for object in 0..req.objects.len() {
+                out(object, req.first, TrackedFrame { prob: vec![1.0; img.w * img.h], w: img.w, h: img.h, confidence: 0.9, occluded: false });
+            }
+            Err("the tracker broke after emitting a frame".into())
+        }
+    }
+    hold_roto_cache_test_lock();
+    let (mut s, clip, uid) = painted(center, "disk-partially-broken-tracker.mov");
+    s.execute_checked("roto.stroke", json!({"layer": clip.0, "object": 1, "points": [center(0)], "radius": 4})).unwrap();
+    effectcraft_effects::roto::set_model(Some(Arc::new(Broken)));
+    let r = s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "both", "wait": true}));
+    let st = s.execute("roto.status", json!({"layer": clip.0, "frame": 0}));
+    let comp = s.active_comp().unwrap();
+    let layer = comp.layer(clip).unwrap();
+    let params = crate::roto::params_static(layer.props.find_group(uid).unwrap());
+    let size = crate::roto::layer_size(&s.project, comp, layer);
+    let mut chain = effectcraft_effects::roto::Chain::new(&params, size, comp.frame_rate.as_f64(), 1.0);
+    let index = layer.effects().unwrap().groups().position(|g| g.uid == uid).unwrap();
+    let mut source =
+        crate::roto::FrameSource::new(&s.project, s.footage.as_ref(), s.expr.as_deref(), &s.layer_cache, s.active_comp_id().unwrap(), comp, layer, index, size);
+    let mut get = |f: i64| source.get(f);
+    let actual: Option<Vec<_>> = (0..=20).map(|f| chain.ensure(f, &mut get, &|| false)).collect();
+    let retained_object = chain.object_seg(0, 0).is_some() || chain.object_seg(0, 1).is_some();
+    let retained_trust = chain.trust_at(0);
+    // Build the reference only after capturing the fallback, with no model or cached union.
+    effectcraft_effects::roto::forget(chain.keys.values().copied());
+    chain.model = None;
+    let expected: Option<Vec<_>> = (0..=20).map(|f| chain.ensure(f, &mut get, &|| false)).collect();
+    effectcraft_effects::roto::set_model(None);
+    let r = r.unwrap();
+    assert_eq!(r["frames"], 21, "{r}");
+    let st = st.unwrap();
+    assert_ne!(st["source"], "tracker", "{st}");
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 0);
+    assert!(!retained_object, "partial per-object mattes must be discarded");
+    assert_eq!(retained_trust, None, "partial tracker confidence must be discarded");
+    for (frame, (actual, expected)) in actual.unwrap().into_iter().zip(expected.unwrap()).enumerate() {
+        assert!(actual == expected, "fallback frame {frame} differs from the classic engine");
+    }
+}
+
+/// Without a tracking model the Roto Brush chain is exactly the classic engine: every frame
+/// equals a direct call of `segment_with` / `propagate_with` (no model), bit for bit.
+#[test]
+fn without_a_tracker_the_chain_is_exactly_the_classic_engine() {
+    use effectcraft_track::roto as rb;
+    use std::sync::Arc;
+    let (s, clip, uid) = painted(center, "disk-bitexact.mov");
+    forget(&s, clip, uid);
+    let comp = s.active_comp().unwrap();
+    let l = comp.layer(clip).unwrap();
+    let g = l.props.find_group(uid).unwrap();
+    let size = crate::roto::layer_size(&s.project, comp, l);
+    let chain = effectcraft_effects::roto::Chain::new(&crate::roto::params_static(g), size, comp.frame_rate.as_f64(), 1.0);
+    assert!(!chain.has_tracker());
+    let img = |f: i64| Arc::new(draw(center(f as u32)));
+    let mut prev: Option<(Arc<Image>, rb::FrameSeg)> = None;
+    for f in 0..=5i64 {
+        let got = chain.ensure(f, &mut |g| Some(img(g)), &|| false).unwrap();
+        let cur = img(f);
+        let strokes = chain.data.strokes_at(f);
+        let want = match &prev {
+            None => rb::segment_with(&cur, &strokes, None, &chain.opts, chain.refine_radius, None),
+            Some((pi, ps)) => rb::propagate_with(pi, ps, &cur, &strokes, &chain.opts, chain.refine_radius, None),
+        };
+        assert_eq!(*got, want, "frame {f} differs from the classic engine");
+        prev = Some((cur, want));
+    }
+    forget(&s, clip, uid);
+}
+
+/// Records the windows it is asked to track, and follows the disc exactly like [`Exact`].
+#[derive(Default)]
+struct Recorder {
+    requests: std::sync::Mutex<Vec<(i64, usize, Vec<i64>)>>,
+}
+
+impl effectcraft_segment::MaskModel for Recorder {
+    fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+        &effectcraft_segment::SAM2_TINY
+    }
+    fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+        Err("no weights".into())
+    }
+    fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+        Some(self)
+    }
+}
+
+impl effectcraft_segment::ObjectTracker for Recorder {
+    fn track(
+        &self,
+        req: &effectcraft_segment::TrackRequest,
+        frame: &mut dyn FnMut(i64) -> Option<std::sync::Arc<effectcraft_segment::ClipFrame>>,
+        cancel: &dyn Fn() -> bool,
+        out: &mut dyn FnMut(usize, i64, effectcraft_segment::TrackedFrame),
+    ) -> effectcraft_segment::Result<()> {
+        let prompted = req.objects.iter().flatten().map(|(f, _)| *f).collect();
+        self.requests.lock().unwrap().push((req.first, req.count, prompted));
+        effectcraft_segment::ObjectTracker::track(&Exact, req, frame, cancel, out)
+    }
+}
+
+/// A correction stroke re-tracks only what it changes: the frames from it on, restarted at the
+/// corrected frame; the frames before it keep their tracked results.
+#[test]
+fn a_correction_re_tracks_only_the_frames_it_changes() {
+    let (mut s, clip, uid) = painted(center, "disk-retrack.mov");
+    let cid = s.active_comp_id().unwrap();
+    assert!(s.roto_trust(cid, clip, uid).is_empty(), "no tracker data before tracking");
+    let rec = std::sync::Arc::new(Recorder::default());
+    effectcraft_effects::roto::set_model(Some(rec.clone()));
+    let run = |s: &mut Session| s.execute_checked("roto.propagate", json!({"layer": clip.0, "direction": "forward", "wait": true}));
+    let first = run(&mut s);
+    assert_eq!(rec.requests.lock().unwrap().as_slice(), [(0, 21, vec![0])], "the first pass tracks the whole span");
+    first.unwrap();
+    // Nothing changed: nothing to track.
+    run(&mut s).unwrap();
+    assert_eq!(rec.requests.lock().unwrap().len(), 1, "an unchanged span is not tracked again");
+    // A correction on frame 8: the frames from 8 on are tracked again, restarting at frame 8.
+    let c = center(8);
+    s.execute_checked("roto.stroke", json!({"layer": clip.0, "frame": 8, "points": line([c[0] - 20.0, c[1]], [c[0] + 20.0, c[1]]), "radius": 6})).unwrap();
+    let again = run(&mut s);
+    let reqs = rec.requests.lock().unwrap().clone();
+    effectcraft_effects::roto::set_model(None);
+    again.unwrap();
+    assert_eq!(reqs.len(), 2);
+    assert_eq!(reqs[1], (8, 13, vec![8]), "the window runs from the corrected frame to the end of the span");
+    // The frames before the correction are still the first pass's, the rest the second's.
+    let st = s.execute("roto.status", json!({"layer": clip.0, "frame": 3})).unwrap();
+    assert_eq!(st["source"], "tracker", "{st}");
+    assert_eq!(st["tracker"]["frames"].as_object().unwrap().len(), 21, "{st}");
+    // The span bar's data: the tracker's confidence for every tracked frame.
+    let trust = s.roto_trust(cid, clip, uid);
+    assert_eq!(trust.len(), 21);
+    assert!(trust.values().all(|t| t.confidence > 0.9 && !t.occluded));
+}
+
+#[test]
+fn strokes_belong_to_the_current_object() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 64, "height": 64, "frameRate": 25, "duration": 1})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({"width": 64, "height": 64})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("roto.stroke", json!({"layer": layer, "points": [[10, 10]], "radius": 4})).unwrap();
+    // the current object is an option shared by the tool and the commands
+    s.execute("roto.options", json!({"object": 1})).unwrap();
+    s.execute("roto.stroke", json!({"layer": layer, "points": [[50, 50]], "radius": 4})).unwrap();
+    s.execute("roto.stroke", json!({"layer": layer, "kind": "bg", "points": [[30, 30]], "radius": 4})).unwrap();
+    // an explicit object wins over the option, and is clamped to the supported range
+    s.execute("roto.stroke", json!({"layer": layer, "points": [[20, 50]], "radius": 4, "object": 99})).unwrap();
+    let st = s.execute("roto.status", json!({"layer": layer})).unwrap();
+    assert_eq!(st["currentObject"], 1);
+    assert_eq!(st["objects"], json!([{"id": 0, "strokes": 1}, {"id": 1, "strokes": 2}, {"id": 31, "strokes": 1}]));
+    // removing one object's strokes leaves the others
+    let r = s.execute("roto.clearStrokes", json!({"layer": layer, "object": 1})).unwrap();
+    assert_eq!(r["removed"], 2);
+    let st = s.execute("roto.status", json!({"layer": layer})).unwrap();
+    assert_eq!(st["objects"], json!([{"id": 0, "strokes": 1}, {"id": 31, "strokes": 1}]));
+    // the object survives a save and a load
+    let json = s.project.to_json();
+    assert!(json.contains("\\\"object\\\":31"), "the project file carries the object");
+}
+
+#[test]
+fn clearing_one_object_keeps_shared_refine_edge_strokes() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 64, "height": 64, "duration": 1})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({})).unwrap()["layer"].as_u64().unwrap();
+    for (object, kind) in [(0, "fg"), (0, "bg"), (0, "refine"), (0, "refineErase"), (1, "fg")] {
+        s.execute("roto.stroke", json!({"layer": layer, "object": object, "kind": kind, "points": [[20, 20]], "radius": 4})).unwrap();
+    }
+    let before = s.project.to_json();
+    let result = s.execute("roto.clearStrokes", json!({"layer": layer, "object": 0})).unwrap();
+    assert_eq!(result["removed"], 2, "only the object's foreground/background strokes are owned by it");
+    assert_eq!(result["strokes"], 3);
+    assert!(s.undo());
+    assert_eq!(s.project.to_json(), before);
+    for kind in ["refine", "refineErase"] {
+        let result = s.execute("roto.clearStrokes", json!({"layer": layer, "kind": kind})).unwrap();
+        assert_eq!(result["removed"], 1, "explicitly clearing shared {kind} still works");
+    }
+}
+
+#[test]
+fn clearing_strokes_rejects_invalid_object_filters_without_editing() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 64, "height": 64, "duration": 1})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("roto.stroke", json!({"layer": layer, "points": [[20, 20]], "radius": 4})).unwrap();
+    let before = s.project.to_json();
+    for object in [json!(-1), json!(-0.1), json!(32), json!(1e30), json!(null), json!("0")] {
+        let result = s.execute("roto.clearStrokes", json!({"layer": layer, "object": object}));
+        assert!(result.is_err(), "invalid object {object} must not delete object zero: {result:?}");
+        assert_eq!(s.project.to_json(), before);
+    }
+}
diff --git a/crates/engine/src/tests/scale_comp.rs b/crates/engine/src/tests/scale_comp.rs
new file mode 100644
index 000000000..752ce9fe5
--- /dev/null
+++ b/crates/engine/src/tests/scale_comp.rs
@@ -0,0 +1,287 @@
+//! Scale Composition (`comp.scale`, #2208): the comp and everything in it grow or shrink by one
+//! factor, so the frame looks the same at the new size.
+
+use effectcraft_project::{Layer, LayerId};
+use effectcraft_time::Tick;
+use serde_json::json;
+
+use crate::{EngineError, Session};
+
+fn comp(w: u32, h: u32) -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": w, "height": h, "frameRate": 10, "duration": 2})).unwrap();
+    s
+}
+
+fn solid(s: &mut Session, color: &str, w: u32, h: u32) -> u64 {
+    s.execute("layer.newSolid", json!({"color": color, "width": w, "height": h})).unwrap()["layer"].as_u64().unwrap()
+}
+
+fn layer(s: &Session, id: u64) -> Layer {
+    s.active_comp().unwrap().layer(LayerId(id)).unwrap().clone()
+}
+
+fn v3(s: &Session, id: u64, path: &str, t: f64) -> [f64; 3] {
+    layer(s, id).props.prop(path).unwrap().value_at(Tick::from_seconds_f64(t)).as_vec3()
+}
+
+/// Opaque pixels of `color_channel` (0 = red, 1 = green) at `t`: (x0, y0, x1, y1, count).
+fn bounds(s: &Session, t: f64, channel: usize) -> (i64, i64, i64, i64, u32) {
+    let img = s.render(s.active_comp_id().unwrap(), Tick::from_seconds_f64(t), Default::default());
+    let (mut x0, mut y0, mut x1, mut y1, mut n) = (i64::MAX, i64::MAX, i64::MIN, i64::MIN, 0);
+    for y in 0..img.height as i64 {
+        for x in 0..img.width as i64 {
+            let p = img.get(x, y);
+            if p[3] > 0.5 && p[channel] > 0.5 {
+                n += 1;
+                (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+            }
+        }
+    }
+    (x0, y0, x1, y1, n)
+}
+
+/// Twice as large on every side, from a pixel-exact frame.
+fn doubled(b: (i64, i64, i64, i64, u32)) -> (i64, i64, i64, i64, u32) {
+    (b.0 * 2, b.1 * 2, b.2 * 2 + 1, b.3 * 2 + 1, b.4 * 4)
+}
+
+#[test]
+fn scale_comp_doubles_the_frame_with_keys_and_parented_layers() {
+    let mut s = comp(200, 100);
+    // A red solid moving right (two Position keys), and a green solid parented to a null.
+    let red = solid(&mut s, "#ff0000", 20, 10);
+    s.execute("prop.addKey", json!({"layer": red, "path": "transform/position", "time": 0, "value": [30, 20]})).unwrap();
+    s.execute("prop.addKey", json!({"layer": red, "path": "transform/position", "time": 1, "value": [70, 20]})).unwrap();
+    let green = solid(&mut s, "#00ff00", 10, 10);
+    let rig = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": rig, "path": "transform/position", "value": [150, 60]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [green], "parent": rig})).unwrap();
+    s.execute("prop.set", json!({"layer": green, "path": "transform/position", "value": [10, 15]})).unwrap();
+    let before = s.project.clone();
+    let (red0, red1, green0) = (bounds(&s, 0.0, 0), bounds(&s, 1.0, 0), bounds(&s, 0.0, 1));
+    assert_eq!(red0, (20, 15, 39, 24, 200));
+
+    let r = s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    assert_eq!((r["width"].as_u64(), r["height"].as_u64()), (Some(400), Some(200)));
+    let c = s.active_comp().unwrap();
+    assert_eq!((c.width, c.height), (400, 200));
+    // Every key moves, not only the value at the current time.
+    assert_eq!(bounds(&s, 0.0, 0), doubled(red0));
+    assert_eq!(bounds(&s, 1.0, 0), doubled(red1));
+    assert_eq!(v3(&s, red, "transform/scale", 1.0), [200.0; 3]);
+    // The child keeps its own transform: its scaled parent carries it.
+    assert_eq!(bounds(&s, 0.0, 1), doubled(green0));
+    assert_eq!(v3(&s, green, "transform/position", 0.0)[..2], [10.0, 15.0]);
+    assert_eq!(v3(&s, green, "transform/scale", 0.0), [100.0; 3]);
+    let after = s.project.clone();
+
+    // One undo step, and one redo step.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.project == before, "undo restores the comp and every layer");
+    s.execute("edit.redo", json!({})).unwrap();
+    assert!(s.project == after, "redo scales the comp and every layer again");
+}
+
+#[test]
+fn scale_comp_to_a_width_keeps_the_aspect_and_scales_cameras_3d_and_guides() {
+    let mut s = comp(640, 360);
+    let card = solid(&mut s, "#ff0000", 100, 100);
+    s.execute("layer.setSwitch", json!({"layers": [card], "switch": "threeD", "value": true})).unwrap();
+    s.execute("prop.set", json!({"layer": card, "path": "transform/position", "value": [100, 50, 200]})).unwrap();
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("view.addGuide", json!({"orientation": "vertical", "position": 160})).unwrap();
+    s.execute("view.addGuide", json!({"orientation": "horizontal", "position": 25, "percent": true})).unwrap();
+    let zoom = |s: &Session| layer(s, cam).props.prop("cameraOptions/zoom").unwrap().value.as_f64();
+    let (zoom0, cam0, poi0) = (zoom(&s), v3(&s, cam, "transform/position", 0.0), v3(&s, cam, "transform/poi", 0.0));
+    let seen0 = bounds(&s, 0.0, 0);
+    s.execute("view.setRegionOfInterest", json!({"rect": [10, 20, 70, 70]})).unwrap();
+
+    let r = s.execute("comp.scale", json!({"width": 960})).unwrap();
+    assert_eq!((r["width"].as_u64(), r["height"].as_u64(), r["factor"].as_f64()), (Some(960), Some(540), Some(1.5)));
+    assert_eq!(v3(&s, card, "transform/position", 0.0), [150.0, 75.0, 300.0]);
+    assert_eq!(v3(&s, card, "transform/scale", 0.0), [150.0; 3]);
+    assert!((zoom(&s) - zoom0 * 1.5).abs() < 1e-9, "the camera sees the same frame");
+    assert_eq!(v3(&s, cam, "transform/position", 0.0), cam0.map(|v| v * 1.5));
+    assert_eq!(v3(&s, cam, "transform/poi", 0.0), poi0.map(|v| v * 1.5));
+    // Through the camera the card covers the same part of the frame.
+    let seen = bounds(&s, 0.0, 0);
+    let near = |a: i64, b: i64| (a as f64 - b as f64 * 1.5).abs() <= 2.0;
+    assert!(near(seen.0, seen0.0) && near(seen.1, seen0.1) && near(seen.2, seen0.2) && near(seen.3, seen0.3), "{seen0:?} → {seen:?}");
+    let c = s.active_comp().unwrap();
+    assert_eq!(c.guides[0].px(c.width, c.height), 240.0);
+    assert_eq!(c.guides[1].position, 25.0, "a percentage guide keeps its percent");
+    assert_eq!(s.state.region_of_interest, Some([15.0, 30.0, 105.0, 105.0]), "the region of interest covers the same part");
+
+    // A height alone works the same way.
+    let r = s.execute("comp.scale", json!({"height": 270})).unwrap();
+    assert_eq!((r["width"].as_u64(), r["height"].as_u64()), (Some(480), Some(270)));
+}
+
+#[test]
+fn scale_comp_scales_depth_under_a_2d_parent_and_children_of_a_camera() {
+    let mut s = comp(200, 100);
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    // A 3D card under a 2D null: the null's Scale carries X and Y but not Z.
+    let card = solid(&mut s, "#ff0000", 20, 10);
+    let rig = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": rig, "path": "transform/position", "value": [100, 50]})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [card], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [card], "parent": rig})).unwrap();
+    s.execute("prop.set", json!({"layer": card, "path": "transform/position", "value": [-40, 0, 500]})).unwrap();
+    // A 3D card parented to the camera, in front of it.
+    let held = solid(&mut s, "#00ff00", 10, 10);
+    s.execute("layer.setSwitch", json!({"layers": [held], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [held], "parent": cam})).unwrap();
+    s.execute("prop.set", json!({"layer": held, "path": "transform/position", "value": [30, 0, 500]})).unwrap();
+    let (card0, held0) = (bounds(&s, 0.0, 0), bounds(&s, 0.0, 1));
+    let (held_pos0, held_scale0) = (v3(&s, held, "transform/position", 0.0), v3(&s, held, "transform/scale", 0.0));
+    assert!(card0.4 > 0 && held0.4 > 0, "both cards are in view: {card0:?} {held0:?}");
+
+    s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    let near = |a: (i64, i64, i64, i64, u32), b: (i64, i64, i64, i64, u32)| {
+        [(a.0, b.0 * 2), (a.1, b.1 * 2), (a.2, b.2 * 2 + 1), (a.3, b.3 * 2 + 1)].iter().all(|&(x, y)| (x - y).abs() <= 2)
+    };
+    let (card1, held1) = (bounds(&s, 0.0, 0), bounds(&s, 0.0, 1));
+    assert!(near(card1, card0), "the card under the 2D null doubles: {card0:?} → {card1:?}");
+    assert_eq!(v3(&s, card, "transform/position", 0.0), [-40.0, 0.0, 1000.0]);
+    assert!(near(held1, held0), "the card held by the camera doubles: {held0:?} → {held1:?}");
+    assert_eq!(v3(&s, held, "transform/position", 0.0), held_pos0.map(|v| v * 2.0));
+    assert_eq!(v3(&s, held, "transform/scale", 0.0), held_scale0.map(|v| v * 2.0));
+}
+
+#[test]
+fn scale_comp_keeps_the_ease_of_depth_moves_under_a_2d_parent() {
+    let mut s = comp(200, 100);
+    let card = solid(&mut s, "#ff0000", 20, 10);
+    let rig = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [card], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [card], "parent": rig})).unwrap();
+    s.execute("prop.addKey", json!({"layer": card, "path": "transform/position", "time": 0, "value": [0, 0, 0]})).unwrap();
+    s.execute("prop.addKey", json!({"layer": card, "path": "transform/position", "time": 1, "value": [0, 0, 100]})).unwrap();
+    s.execute("keys.setEase", json!({"layer": card, "path": "transform/position", "time": 0, "side": "out", "speed": 100, "influence": 50})).unwrap();
+    s.execute("prop.addKey", json!({"layer": card, "path": "transform/scale", "time": 0, "value": [100, 100, 100]})).unwrap();
+    s.execute("prop.addKey", json!({"layer": card, "path": "transform/scale", "time": 1, "value": [100, 100, 300]})).unwrap();
+    s.execute("keys.setEase", json!({"layer": card, "path": "transform/scale", "time": 0, "side": "out", "speed": 300, "influence": 50})).unwrap();
+    let (pos0, scale0) = (v3(&s, card, "transform/position", 0.25), v3(&s, card, "transform/scale", 0.25));
+
+    s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    // Twice the distance in the same time: the same ease, every frame twice as deep.
+    let (pos, scale) = (v3(&s, card, "transform/position", 0.25), v3(&s, card, "transform/scale", 0.25));
+    assert!((pos[2] - pos0[2] * 2.0).abs() < 1e-6, "{pos0:?} → {pos:?}");
+    assert!((scale[2] - scale0[2] * 2.0).abs() < 1e-6, "{scale0:?} → {scale:?}");
+    assert_eq!(scale[..2], scale0[..2]);
+}
+
+#[test]
+fn scale_comp_gives_z_its_own_speed_when_a_scale_key_has_one_ease() {
+    let mut s = comp(200, 100);
+    let card = solid(&mut s, "#ff0000", 20, 10);
+    let rig = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [card], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [card], "parent": rig})).unwrap();
+    s.execute("prop.addKey", json!({"layer": card, "path": "transform/scale", "time": 0, "value": [100, 100, 100]})).unwrap();
+    s.execute("prop.addKey", json!({"layer": card, "path": "transform/scale", "time": 1, "value": [100, 100, 300]})).unwrap();
+    s.execute("keys.setEase", json!({"layer": card, "path": "transform/scale", "time": 0, "side": "out", "speed": 300, "influence": 50})).unwrap();
+    // One ease for every dimension, as a project file may store it.
+    let cid = s.active_comp_id().unwrap();
+    let key =
+        &mut std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(LayerId(card)).unwrap().props.prop_mut("transform/scale").unwrap().keys
+            [0];
+    key.out_ease.truncate(1);
+    let scale0 = v3(&s, card, "transform/scale", 0.25);
+
+    s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    let scale = v3(&s, card, "transform/scale", 0.25);
+    assert!((scale[2] - scale0[2] * 2.0).abs() < 1e-6, "{scale0:?} → {scale:?}");
+    assert_eq!(scale[..2], scale0[..2], "X and Y keep the shared ease");
+}
+
+#[test]
+fn scale_comp_scales_depth_once_through_a_3d_grandparent() {
+    let mut s = comp(200, 100);
+    s.execute("layer.newCamera", json!({})).unwrap();
+    // card (3D) → A (2D null) → B (3D null): B's Scale already carries the depth.
+    let card = solid(&mut s, "#ff0000", 20, 10);
+    let a = s.execute("layer.newNull", json!({"name": "A"})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.newNull", json!({"name": "B"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [card, b], "switch": "threeD", "value": true})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "transform/position", "value": [100, 50, 0]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [a], "parent": b})).unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "transform/position", "value": [0, 0]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [card], "parent": a})).unwrap();
+    s.execute("prop.set", json!({"layer": card, "path": "transform/position", "value": [-40, 0, 500]})).unwrap();
+    let card0 = bounds(&s, 0.0, 0);
+    assert!(card0.4 > 0, "the card is in view");
+
+    s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    assert_eq!(v3(&s, card, "transform/position", 0.0), [-40.0, 0.0, 500.0]);
+    let card1 = bounds(&s, 0.0, 0);
+    let near =
+        [(card1.0, card0.0 * 2), (card1.1, card0.1 * 2), (card1.2, card0.2 * 2 + 1), (card1.3, card0.3 * 2 + 1)].iter().all(|&(x, y)| (x - y).abs() <= 2);
+    assert!(near, "{card0:?} → {card1:?}");
+}
+
+#[test]
+fn scale_comp_scales_once_through_a_camera_under_a_scaled_null() {
+    let mut s = comp(200, 100);
+    // solid → camera → B (3D null): B's Scale reaches the solid through the camera.
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.newNull", json!({"name": "B"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [b], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [cam], "parent": b})).unwrap();
+    let held = solid(&mut s, "#00ff00", 10, 10);
+    s.execute("layer.setSwitch", json!({"layers": [held], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [held], "parent": cam})).unwrap();
+    s.execute("prop.set", json!({"layer": held, "path": "transform/position", "value": [30, 0, 500]})).unwrap();
+    let held0 = bounds(&s, 0.0, 1);
+    assert!(held0.4 > 0, "the solid is in view: {held0:?}");
+
+    s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    assert_eq!(v3(&s, held, "transform/position", 0.0), [30.0, 0.0, 500.0]);
+    assert_eq!(v3(&s, held, "transform/scale", 0.0), [100.0; 3]);
+    let held1 = bounds(&s, 0.0, 1);
+    let near =
+        [(held1.0, held0.0 * 2), (held1.1, held0.1 * 2), (held1.2, held0.2 * 2 + 1), (held1.3, held0.3 * 2 + 1)].iter().all(|&(x, y)| (x - y).abs() <= 2);
+    assert!(near, "{held0:?} → {held1:?}");
+}
+
+#[test]
+fn scale_comp_scales_the_point_of_interest_depth_of_a_camera_under_a_2d_null() {
+    let mut s = comp(200, 100);
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let rig = s.execute("layer.newNull", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setParent", json!({"layers": [cam], "parent": rig})).unwrap();
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/position", "value": [10, 20, -1000]})).unwrap();
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/poi", "value": [10, 20, 200]})).unwrap();
+
+    s.execute("comp.scale", json!({"factor": 2})).unwrap();
+    // The 2D null carries X and Y; the camera's own Z doubles at both ends, so it looks the same way.
+    assert_eq!(v3(&s, cam, "transform/position", 0.0), [10.0, 20.0, -2000.0]);
+    assert_eq!(v3(&s, cam, "transform/poi", 0.0), [10.0, 20.0, 400.0]);
+}
+
+#[test]
+fn scale_comp_refuses_a_bad_factor_and_changes_nothing() {
+    let mut s = comp(640, 360);
+    solid(&mut s, "#ff0000", 100, 100);
+    let before = s.project.clone();
+    let cases = [
+        (json!({}), "pass `factor`"),
+        (json!({"factor": 0}), "4 to 30,000 px"),
+        (json!({"factor": -2}), "4 to 30,000 px"),
+        (json!({"width": 0}), "4 to 30,000 px"),
+        (json!({"factor": 100}), "4 to 30,000 px"),
+        (json!({"factor": 0.001}), "4 to 30,000 px"),
+        (json!({"factor": 2, "width": 960}), "only one of"),
+        (json!({"width": 960, "height": 360}), "only one of"),
+    ];
+    for (p, why) in cases {
+        match s.execute("comp.scale", p.clone()) {
+            Err(EngineError::BadParams { cmd, msg }) => assert!(cmd == "comp.scale" && msg.contains(why), "{p}: {msg}"),
+            other => panic!("{p} is refused as bad parameters, got {other:?}"),
+        }
+        assert!(s.project == before, "{p} leaves the project alone");
+    }
+    s.execute("comp.scale", json!({"factor": 1})).unwrap();
+}
diff --git a/crates/engine/src/tests_sequence.rs b/crates/engine/src/tests/sequence.rs
similarity index 63%
rename from crates/engine/src/tests_sequence.rs
rename to crates/engine/src/tests/sequence.rs
index 7f937596f..b084e6b36 100644
--- a/crates/engine/src/tests_sequence.rs
+++ b/crates/engine/src/tests/sequence.rs
@@ -1,6 +1,6 @@
 //! Image sequences (#297): File ▸ Import with the "<format> Sequence" option, picked ranges,
 //! folders, Force Alphabetical Order, the import frame rate, Replace Footage, missing frames
-//! (placeholders, as in After Effects) and Interpret Footage ▸ Start Timecode.
+//! (they hold the previous frame) and Interpret Footage ▸ Start Timecode.
 
 use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind};
 use effectcraft_time::{FrameRate, Tick};
@@ -8,14 +8,16 @@ use serde_json::{Value, json};
 
 use crate::Session;
 
-/// Probes every file as a 64×32 still (the media layer's single-file probe).
+/// Probes every file as a still 64 + its byte length wide and 32 high (the media layer's
+/// single-file probe).
 struct Stills;
 impl crate::Importer for Stills {
     fn probe(&self, path: &str) -> Result<Footage, String> {
         if !std::path::Path::new(path).is_file() {
             return Err(format!("{path}: no such file"));
         }
-        Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 64, height: 32, has_video: true, codec: "PNG".into(), ..Default::default() })
+        let width = 64 + std::fs::metadata(path).map_or(0, |m| m.len() as u32);
+        Ok(Footage { path: path.into(), kind: FootageKind::Still, width, height: 32, has_video: true, codec: "PNG".into(), ..Default::default() })
     }
 }
 
@@ -60,12 +62,13 @@ fn one_picked_numbered_file_imports_its_run_as_one_sequence() {
     assert_eq!(name, "shot_[0001-0005].png");
     assert_eq!((f.kind, f.sequence.len(), f.alphabetical), (FootageKind::Sequence, 4, false));
     assert_eq!(f.path, at(&dir, "shot_0001.png"));
-    // Frames 1–5 at Settings ▸ Import ▸ Sequence Footage (30 fps); frame 3 is a placeholder.
+    // Frames 1–5 at Settings ▸ Import ▸ Sequence Footage (30 fps); frame 3 holds frame 2.
     assert_eq!(f.duration, FrameRate::FPS_30.tick_of(5));
     assert_eq!(f.sequence_file(2), None);
     // Settings ▸ Import ▸ Report Missing Frames.
     let w = r["warnings"][0].as_str().unwrap();
     assert!(w.contains("1 missing frame (3)"), "{w}");
+    assert!(w.contains("previous frame is held") && !w.contains("placeholder"), "{w}");
 }
 
 /// Picking every frame of a sequence used to make one item per frame (each a whole sequence on
@@ -102,10 +105,11 @@ fn numbered_stills_import_as_stills_by_default() {
     let r = s.execute("file.import", json!({"paths": [dir.clone()], "drag": true})).unwrap();
     let (name, f) = footage(&s, &r["items"][0]);
     assert_eq!((name.as_str(), f.kind), ("shot_[0001-0005].png", FootageKind::Sequence));
-    // Scripts and agents naming one frame without `sequence` still get its run.
-    let r = s.execute("file.import", json!({"paths": [at(&dir, "shot_0003.png")]})).unwrap();
-    let (_, f) = footage(&s, &r["items"][0]);
-    assert_eq!(f.kind, FootageKind::Sequence);
+    // #2018: scripts and agents naming one frame without `sequence` get that still, as
+    // `ImportOptions.sequence` defaults to false in After Effects.
+    let r = s.execute("file.import", json!({"paths": [at(&dir, "shot_0005.png")]})).unwrap();
+    let (name, f) = footage(&s, &r["items"][0]);
+    assert_eq!((name.as_str(), f.kind), ("shot_0005.png", FootageKind::Still));
 }
 
 #[test]
@@ -179,14 +183,58 @@ fn interpret_footage_start_timecode_relabels_source_time() {
 }
 
 #[test]
-fn replace_footage_and_reload_keep_sequences() {
+fn replace_footage_keeps_a_still_a_still() {
     let dir = folder(&RUN);
     let mut s = session();
     let item = s.execute("file.import", json!({"paths": [at(&dir, "shot_0001.png")], "sequence": false})).unwrap()["items"][0].clone();
     s.state.project_selection = vec![ItemId(item.as_u64().unwrap())];
+    // Replacing with a numbered still does not silently turn the item into a sequence (#2073).
     s.execute("file.replaceFootage", json!({"path": at(&dir, "shot_0004.png")})).unwrap();
     let (name, f) = footage(&s, &item);
-    assert_eq!((name.as_str(), f.sequence.len()), ("shot_[0001-0005].png", 4));
+    assert_eq!((name.as_str(), f.kind), ("shot_0004.png", FootageKind::Still));
+    // JSON null is unspecified, not "on": the still stays a still.
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "shot_0004.png"), "sequence": null})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind), ("shot_0004.png", FootageKind::Still));
+    // Alphabetical is a sequence modifier, not a request to make one.
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "shot_0004.png"), "alphabetical": true})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind), ("shot_0004.png", FootageKind::Still));
+    // Asking for the run still brings it.
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "shot_0004.png"), "sequence": true})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind, f.sequence.len()), ("shot_[0001-0005].png", FootageKind::Sequence, 4));
+}
+
+#[test]
+fn replace_footage_keeps_a_one_frame_run_a_sequence() {
+    let dir = folder(&["shot_0001.png", "shot_0002.png", "solo_0007.png", "cover.png"]);
+    let mut s = session();
+    let item = s.execute("file.import", json!({"paths": [at(&dir, "shot_0001.png")], "sequence": true})).unwrap()["items"][0].clone();
+    s.state.project_selection = vec![ItemId(item.as_u64().unwrap())];
+    // A numbered file with no other frame in its run is still the replacement for a sequence.
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "solo_0007.png")})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind, f.sequence.len()), ("solo_0007.png", FootageKind::Sequence, 1));
+    // A single-file source keeps the sequence kind too.
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "cover.png")})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind, f.sequence.len()), ("cover.png", FootageKind::Sequence, 1));
+    // An explicit `sequence: false` still asks for one frame.
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "cover.png"), "sequence": false})).unwrap();
+    let (_, f) = footage(&s, &item);
+    assert_eq!((f.kind, f.sequence.len()), (FootageKind::Still, 0));
+}
+
+#[test]
+fn replace_footage_and_reload_keep_sequences() {
+    let dir = folder(&RUN);
+    let mut s = session();
+    let item = s.execute("file.import", json!({"paths": [at(&dir, "shot_0001.png")], "sequence": true})).unwrap()["items"][0].clone();
+    s.state.project_selection = vec![ItemId(item.as_u64().unwrap())];
+    s.execute("file.replaceFootage", json!({"path": at(&dir, "shot_0004.png")})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind, f.sequence.len()), ("shot_[0001-0005].png", FootageKind::Sequence, 4));
     // Reload finds a new frame and keeps the interpretation.
     s.execute("file.interpretFootage", json!({"items": [item], "frameRate": 12, "startTimecode": 2})).unwrap();
     std::fs::write(at(&dir, "shot_0003.png"), b"").unwrap();
@@ -196,6 +244,19 @@ fn replace_footage_and_reload_keep_sequences() {
     assert_eq!(f.duration, FrameRate::from_f64(12.0).tick_of(5));
 }
 
+/// #2074: reloading a numbered still probed it as its run, so it took the first file's size.
+#[test]
+fn reloading_a_numbered_still_measures_its_own_file() {
+    let dir = folder(&RUN);
+    let mut s = session();
+    let item = s.execute("file.import", json!({"paths": [at(&dir, "shot_0002.png")], "sequence": false})).unwrap()["items"][0].clone();
+    std::fs::write(at(&dir, "shot_0002.png"), [0; 16]).unwrap();
+    s.execute("file.reloadFootage", json!({"items": [item]})).unwrap();
+    let (name, f) = footage(&s, &item);
+    assert_eq!((name.as_str(), f.kind, f.width, f.sequence.len()), ("shot_0002.png", FootageKind::Still, 80, 0));
+    assert_eq!(f.path, at(&dir, "shot_0002.png"));
+}
+
 /// #756: numbered DPX and Cineon scans import as sequences, as in After Effects (`.cin` was not
 /// an image to the Media Browser, so its runs came in one file at a time).
 #[test]
@@ -207,3 +268,32 @@ fn dpx_and_cineon_runs_import_as_sequences() {
     got.sort();
     assert_eq!(got, [("plate.[0001-0003].dpx".to_string(), 3), ("scan_[01-02].cin".to_string(), 2)], "{r}");
 }
+
+/// #1926, #3184: an edit does no file work at all for the disk cache (it used to stamp every
+/// frame of the project's image sequences for a salt; with large sequences each keystroke in a
+/// text field took over half a second): the cache stays attached and no file is looked at, after
+/// edits, after a frame of the sequence was rewritten, after Reload Footage and new footage.
+/// Entries check the files they list when they are read instead.
+#[test]
+fn edits_do_no_disk_cache_file_work() {
+    let dir = folder(&RUN);
+    let cache = std::env::temp_dir().join(format!("ec-seq-nofiles-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&cache);
+    let mut s = session();
+    s.execute_checked("prefs.set", json!({"values": {"disk.diskCacheFolder": cache.to_string_lossy(), "disk.diskCacheEnabled": true}})).unwrap();
+    let dc = s.disk_cache.clone().expect("a disk cache");
+    let attached = |s: &Session| s.layer_cache.disk().is_some_and(|d| std::sync::Arc::ptr_eq(&d, &dc));
+    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 32, "frameRate": 30, "duration": 1})).unwrap();
+    let r = s.execute("file.import", json!({"paths": [at(&dir, "shot_0002.png")], "sequence": true, "addToComp": true})).unwrap();
+    let item = r["items"][0].clone();
+    // A frame rewritten in place: same footage settings, another size on disk.
+    std::fs::write(at(&dir, "shot_0004.png"), b"a new render of this frame").unwrap();
+    s.execute("layer.newText", json!({"text": "title"})).unwrap();
+    s.execute("layer.setText", json!({"text": "title 2"})).unwrap();
+    s.execute("file.reloadFootage", json!({"items": [item]})).unwrap();
+    std::fs::write(at(&dir, "extra.png"), b"").unwrap();
+    s.execute("file.import", json!({"paths": [at(&dir, "extra.png")]})).unwrap();
+    assert!(attached(&s), "attached all along");
+    assert_eq!(dc.file_checks(), 0, "no file looked at for the disk cache");
+    let _ = std::fs::remove_dir_all(&cache);
+}
diff --git a/crates/engine/src/tests/session.rs b/crates/engine/src/tests/session.rs
new file mode 100644
index 000000000..b253640e7
--- /dev/null
+++ b/crates/engine/src/tests/session.rs
@@ -0,0 +1,863 @@
+use serde_json::json;
+
+use crate::Session;
+
+fn demo() -> Session {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    s
+}
+
+#[test]
+fn demo_opens_and_renders() {
+    let s = demo();
+    let cid = s.active_comp_id().unwrap();
+    let img = s.render(cid, s.time(), effectcraft_render::RenderOpts { scale: 0.25, ..Default::default() });
+    assert_eq!((img.width, img.height), (480, 270));
+    let lit = img.data.iter().filter(|p| p[3] > 0.99).count();
+    assert!(lit > 100_000, "{lit}");
+}
+
+/// The session's layer cache never changes pixels: scrubbing the demo (including back and
+/// forth, and across an edit made through a command) matches cache-less renders exactly.
+#[test]
+fn demo_layer_cache_is_transparent() {
+    let mut s = demo();
+    let cid = s.active_comp_id().unwrap();
+    let opts = effectcraft_render::RenderOpts { scale: 0.25, ..Default::default() };
+    let uncached = |s: &Session, t: f64| {
+        let mut r = effectcraft_render::Renderer::new(&s.project, s.footage.as_ref(), opts);
+        r.expr = s.expr.as_deref();
+        r.comp_frame(cid, effectcraft_time::Tick::from_seconds_f64(t))
+    };
+    let check = |s: &Session, t: f64| {
+        let a = s.render(cid, effectcraft_time::Tick::from_seconds_f64(t), opts);
+        let b = uncached(s, t);
+        assert!(a.data.iter().zip(&b.data).all(|(p, q)| (0..4).all(|c| (p[c] - q[c]).abs() < 1e-6)), "t={t}");
+    };
+    for t in [0.5, 1.0, 3.0, 3.0334, 6.0, 3.0, 0.5] {
+        check(&s, t);
+    }
+    assert!(s.layer_cache.stats().hits > 0);
+    // Edit the title's glow through the command layer, then scrub again.
+    let title = s.project.comp(cid).unwrap().layers.iter().find(|l| l.name == "EFFECTCRAFT").map(|l| l.id.0).unwrap();
+    s.execute("prop.set", json!({"layer": title, "path": "effects/#1/radius", "value": 5.0})).unwrap();
+    for t in [3.0, 0.5] {
+        check(&s, t);
+    }
+}
+
+/// `layer.addItem` puts the layer at `index` (1-based) in the stack and starts it at `time`, as a
+/// drop in the Timeline does (#89).
+#[test]
+fn add_item_at_a_stack_index_and_time() {
+    let mut s = Session::default();
+    let clip = s.execute("comp.new", json!({"name": "Clip", "width": 16, "height": 16, "frameRate": 30, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 32, "height": 32, "frameRate": 30, "duration": 4})).unwrap();
+    for name in ["C", "B", "A"] {
+        s.execute("layer.newSolid", json!({"name": name})).unwrap();
+    }
+    let names = |s: &Session| s.active_comp().unwrap().layers.iter().map(|l| l.name.clone()).collect::<Vec<_>>();
+    s.execute("layer.addItem", json!({"item": clip, "index": 2, "time": 1.01})).unwrap();
+    assert_eq!(names(&s), ["A", "Clip", "B", "C"]);
+    let l = &s.active_comp().unwrap().layers[1];
+    assert_eq!(l.in_point, effectcraft_time::Tick::from_seconds_f64(1.0), "on the nearest frame");
+    // Past the bottom: the bottom.
+    s.execute("layer.addItem", json!({"item": clip, "index": 99})).unwrap();
+    assert_eq!(names(&s).last().map(String::as_str), Some("Clip 2"));
+    assert!(s.execute("layer.addItem", json!({"item": clip, "index": 0})).is_err(), "1-based");
+}
+
+/// Files dropped on the Timeline or the Composition viewer (`file.import {addToComp}`) become
+/// layers of the comp that was active, one under the other, where they were dropped (#85, #89).
+#[test]
+fn imported_files_go_into_the_comp_where_they_were_dropped() {
+    use effectcraft_project::{Footage, FootageKind};
+    struct Probe;
+    impl crate::Importer for Probe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 64, height: 32, has_video: true, ..Default::default() })
+        }
+    }
+    let mut s = Session { importer: Some(std::sync::Arc::new(Probe)), ..Default::default() };
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bg"})).unwrap();
+    let params = json!({"paths": ["/drop/a.png", "/drop/b.png"], "addToComp": true, "position": [40.0, 50.0], "index": 1, "time": 1.0});
+    s.execute("file.import", params).unwrap();
+    let comp = s.active_comp().unwrap();
+    assert_eq!(comp.layers.iter().map(|l| l.name.as_str()).collect::<Vec<_>>(), ["a.png", "b.png", "Bg"]);
+    for l in comp.layers.iter().take(2) {
+        assert_eq!(l.props.prop("transform/position").map(|p| p.value.clone()), Some(effectcraft_keyframe::Value::Vec3([40.0, 50.0, 0.0])));
+        assert_eq!(l.in_point, effectcraft_time::Tick::from_seconds_f64(1.0));
+    }
+    // Without `addToComp` they only import.
+    s.execute("file.import", json!({"paths": ["/drop/c.png"]})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 3);
+    assert!(s.execute("layer.addItem", json!({"item": "a.png", "position": [1.0]})).is_err(), "position needs x and y");
+}
+
+/// #270: files dropped or picked in the Import dialog (`file.import {background}`) are probed in
+/// a background job that says which file it is reading and how many are left; then they arrive
+/// in one undo step, all selected, with a count. The same file imported again arrives again.
+#[test]
+fn background_imports_report_progress_and_select_what_arrived() {
+    use effectcraft_project::{Footage, FootageKind, ItemId};
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    /// Probes file k once `allow` > k (a slow video; 5 s at most, so an import that waits for it
+    /// fails the test instead of hanging it); `.xyz` files fail.
+    struct Gated {
+        started: AtomicUsize,
+        allow: Arc<AtomicUsize>,
+    }
+    impl crate::Importer for Gated {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            let k = self.started.fetch_add(1, Ordering::SeqCst);
+            let until = std::time::Instant::now() + std::time::Duration::from_secs(5);
+            while self.allow.load(Ordering::SeqCst) <= k && std::time::Instant::now() < until {
+                std::thread::sleep(std::time::Duration::from_millis(1));
+            }
+            if path.ends_with(".xyz") {
+                return Err("unsupported file".into());
+            }
+            Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 64, height: 32, has_video: true, ..Default::default() })
+        }
+    }
+    let allow = Arc::new(AtomicUsize::new(1));
+    let mut s = Session { importer: Some(Arc::new(Gated { started: AtomicUsize::new(0), allow: allow.clone() })), ..Default::default() };
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
+    let undo = s.history.undo.len();
+    let r = s.execute("file.import", json!({"paths": ["/drop/a.png", "/drop/b.png", "/drop/a.png"], "background": true})).unwrap();
+    let job = r["job"].as_str().unwrap().to_string();
+    // The first file is through; the second is being read.
+    let running = |s: &mut Session| s.execute("jobs.list", json!({})).unwrap()["running"].as_array().unwrap().clone();
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    while running(&mut s)[0]["done"] != json!(1) && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    let row = running(&mut s)[0].clone();
+    assert_eq!(row["id"], json!(job));
+    assert_eq!(row["label"], json!("Importing 3 files"));
+    assert_eq!(row["message"], json!("b.png (2 of 3)"));
+    assert_eq!((row["done"].as_u64(), row["total"].as_u64()), (Some(1), Some(3)));
+    assert!(s.project.items.values().all(|i| i.name != "a.png"), "nothing is added before the import finishes");
+    allow.store(usize::MAX, Ordering::SeqCst);
+    s.execute("jobs.wait", json!({})).unwrap();
+    let names = |s: &Session, ids: &[ItemId]| ids.iter().map(|i| s.project.item(*i).unwrap().name.clone()).collect::<Vec<_>>();
+    assert_eq!(names(&s, &s.state.project_selection), ["a.png", "b.png", "a.png"], "everything imported is selected, the same file twice too");
+    assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
+    let rec = s.job_log.last().unwrap();
+    assert_eq!((rec.status.as_str(), rec.message.as_str()), ("done", "Imported 3 items"));
+    assert!(s.drain_events().iter().any(|e| matches!(e, crate::Event::Toast { message, .. } if message == "Imported 3 items")));
+    // Dropped on the viewer: they become layers too; a file that can't be read is reported.
+    s.execute("file.import", json!({"paths": ["/drop/c.png", "/drop/d.xyz"], "background": true, "addToComp": true, "position": [10.0, 20.0]})).unwrap();
+    s.execute("jobs.wait", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.iter().map(|l| l.name.as_str()).collect::<Vec<_>>(), ["c.png"]);
+    assert_eq!(s.job_log.last().unwrap().message, "Imported 1 item. /drop/d.xyz: unsupported file");
+    // Agents and scripts import at once by default.
+    let r = s.execute("file.import", json!({"paths": ["/drop/e.png"]})).unwrap();
+    assert_eq!(r["items"].as_array().map(Vec::len), Some(1));
+}
+
+/// #2573: New Composition From Footage (`file.import {newComp}`) makes one composition of what
+/// the import made, first file on top, at once or when the background job lands; an import that
+/// made nothing makes no comp.
+#[test]
+fn new_comp_from_footage_makes_a_comp_of_what_was_imported() {
+    use effectcraft_project::{Footage, FootageKind, ItemKind};
+    struct Probe;
+    impl crate::Importer for Probe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            if path.ends_with(".xyz") {
+                return Err("unsupported file".into());
+            }
+            Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 64, height: 32, has_video: true, ..Default::default() })
+        }
+    }
+    let mut s = Session { importer: Some(std::sync::Arc::new(Probe)), ..Default::default() };
+    let comps = |s: &Session| s.project.items.values().filter(|i| matches!(i.kind, ItemKind::Comp(_))).count();
+    let layers = |s: &Session| s.active_comp().unwrap().layers.iter().map(|l| l.name.clone()).collect::<Vec<_>>();
+    // At once.
+    s.execute("file.import", json!({"paths": ["/drop/a.png", "/drop/b.xyz"], "newComp": true})).unwrap();
+    assert_eq!(comps(&s), 1);
+    assert_eq!(layers(&s), ["a.png"]);
+    assert_eq!((s.active_comp().unwrap().width, s.active_comp().unwrap().height), (64, 32));
+    // In the background: the job's own items, whatever is selected or active meanwhile; it takes
+    // precedence over `addToComp`.
+    s.execute("file.import", json!({"paths": ["/drop/c.png", "/drop/d.png"], "background": true, "newComp": true, "addToComp": true})).unwrap();
+    s.state.project_selection.clear();
+    s.execute("jobs.wait", json!({})).unwrap();
+    assert_eq!(comps(&s), 2);
+    assert_eq!(layers(&s), ["c.png", "d.png"]);
+    // Nothing imported: no comp, and the failure is reported.
+    s.execute("file.import", json!({"paths": ["/drop/e.xyz"], "background": true, "newComp": true})).unwrap();
+    s.execute("jobs.wait", json!({})).unwrap();
+    assert_eq!(comps(&s), 2);
+    assert!(s.job_log.last().unwrap().message.contains("unsupported file"));
+    let r = s.execute("file.import", json!({"paths": ["/drop/f.xyz"], "newComp": true})).unwrap();
+    assert_eq!(comps(&s), 2);
+    assert_eq!(r["errors"].as_array().map(Vec::len), Some(1));
+}
+
+/// Audio, Lock and Shy don't change pixels: toggling them keeps the cached layers (#103).
+#[test]
+fn audio_lock_and_shy_keep_cached_layers() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 160, "height": 90, "frameRate": 30, "duration": 1})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#3080ff", "width": 80, "height": 40})).unwrap();
+    s.execute("effect.apply", json!({"layer": "#1", "effect": "Gaussian Blur"})).unwrap();
+    s.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/blurriness", "value": 12})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let t = s.time();
+    s.render(cid, t, Default::default());
+    let before = s.layer_cache.stats();
+    for sw in ["audio", "lock", "shy"] {
+        s.execute("layer.setSwitch", json!({"layers": ["#1"], "switch": sw, "value": sw != "audio"})).unwrap();
+    }
+    s.render(cid, t, Default::default());
+    let after = s.layer_cache.stats();
+    assert_eq!(after.misses, before.misses, "no layer rendered again");
+    assert!(after.hits > before.hits);
+}
+
+#[test]
+fn every_command_has_unique_id_and_runs_or_reports() {
+    let mut ids = std::collections::HashSet::new();
+    for c in crate::command_specs() {
+        assert!(ids.insert(c.id), "duplicate {}", c.id);
+    }
+    assert!(ids.len() >= 90, "{}", ids.len());
+}
+
+#[test]
+fn layer_workflow_with_undo() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Test", "width": 640, "height": 360, "frameRate": 30, "duration": 4})).unwrap();
+    let r = s.execute("layer.newSolid", json!({"color": "#336699"})).unwrap();
+    let lid = r["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": lid, "path": "transform/opacity", "value": 50})).unwrap();
+    let tree = s.execute("layer.tree", json!({"layer": lid})).unwrap();
+    assert!(tree.to_string().contains("\"value\":50.0"));
+    s.execute("prop.toggleAnimation", json!({"layer": lid, "path": "transform/position"})).unwrap();
+    s.execute("time.set", json!({"time": 2.0})).unwrap();
+    s.execute("prop.set", json!({"layer": lid, "path": "transform/position", "value": [100, 100]})).unwrap();
+    let comp = s.active_comp().unwrap();
+    let pos = comp.layers[0].props.prop("transform/position").unwrap();
+    assert_eq!(pos.keys.len(), 2);
+    s.execute("prop.select", json!({"layer": lid, "path": "transform/position"})).unwrap();
+    assert_eq!(s.state.selected_keys.len(), 2);
+    s.execute("keys.easyEase", json!({})).unwrap();
+    s.execute("keys.move", json!({"delta": 0.5})).unwrap();
+    let pos = s.active_comp().unwrap().layers[0].props.prop("transform/position").unwrap().clone();
+    assert!((pos.keys[0].time.seconds() - 0.5).abs() < 0.02);
+    assert_eq!(pos.keys[0].out_interp, effectcraft_keyframe::Interp::Bezier);
+    // undo back to before the move
+    s.execute("edit.undo", json!({})).unwrap();
+    let pos = s.active_comp().unwrap().layers[0].props.prop("transform/position").unwrap().clone();
+    assert!(pos.keys[0].time.seconds().abs() < 0.02);
+    s.execute("effect.apply", json!({"layer": lid, "effect": "Gaussian Blur"})).unwrap();
+    s.execute("prop.set", json!({"layer": lid, "path": "effects/#1/blurriness", "value": 12})).unwrap();
+    // Applying selects the new effect (Edit ▸ Duplicate would duplicate it); select the layer.
+    s.execute("layer.select", json!({"layers": [lid]})).unwrap();
+    s.execute("edit.duplicate", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 2);
+    s.execute("layer.precompose", json!({"layers": [1, 2], "name": "Pre"})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 1);
+}
+
+#[test]
+fn text_shape_mask_matte_parent() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 800, "height": 450, "duration": 3})).unwrap();
+    let t = s.execute("layer.newText", json!({"text": "Hello", "size": 90})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.addTextAnimator", json!({"layer": t, "properties": ["position", "opacity"]})).unwrap();
+    let sh = s.execute("layer.newShape", json!({"kind": "star", "fill": "#ffcc00"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.addShapeItem", json!({"layer": sh, "kind": "trim"})).unwrap();
+    s.execute("layer.addMask", json!({"layer": sh, "shape": "ellipse"})).unwrap();
+    s.execute("layer.setMask", json!({"layer": sh, "mask": 1, "mode": "Subtract", "inverted": true})).unwrap();
+    s.execute("layer.setTrackMatte", json!({"layer": sh, "matte": t, "kind": "luma"})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [sh], "parent": t})).unwrap();
+    assert!(s.execute("layer.setParent", json!({"layers": [t], "parent": sh})).is_err());
+    s.execute("layer.setBlendMode", json!({"layers": [sh], "mode": "Screen"})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [sh], "switch": "threeD"})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let _ = s.render(cid, s.time(), Default::default());
+    let info = s.execute("comp.info", json!({})).unwrap();
+    assert_eq!(info["layers"].as_array().unwrap().len(), 2);
+}
+
+/// The toolbar's Fill / Stroke change a selected shape layer's paint (#205): a shape drawn
+/// without a stroke gets one, later edits change it, and the Contents "Add:" items (#206) include
+/// an empty Path and a Gradient Stroke that render.
+#[test]
+fn toolbar_fill_and_stroke_paint_selected_shape_layers() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
+    let sh = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let paint = |s: &mut Session| s.execute("shape.fillStroke", json!({})).unwrap();
+    assert_eq!(paint(&mut s)["stroke"], serde_json::Value::Null, "drawn without a stroke");
+    s.execute("shape.fillStroke", json!({"stroke": "#00ff00", "strokeWidth": 6})).unwrap();
+    let p = paint(&mut s);
+    assert_eq!((p["stroke"][1].as_f64(), p["strokeWidth"].as_f64()), (Some(1.0), Some(6.0)), "{p}");
+    s.execute("shape.fillStroke", json!({"fill": "#0000ff", "strokeWidth": 3})).unwrap();
+    let p = paint(&mut s);
+    assert_eq!((p["fill"][2].as_f64(), p["strokeWidth"].as_f64()), (Some(1.0), Some(3.0)), "{p}");
+    // One stroke, before the fill (paths, stroke, fill), and each change is one undo step.
+    let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap().clone();
+    let group = l.props.group("contents/group").unwrap();
+    let order: Vec<&str> = group.sub("contents").unwrap().groups().map(|g| g.match_id.as_str()).collect();
+    assert_eq!(order, ["rect", "stroke", "fill"]);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(paint(&mut s)["strokeWidth"].as_f64(), Some(6.0));
+    // Only shape layers.
+    s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap();
+    assert!(s.execute("shape.fillStroke", json!({"fill": "#ffffff"})).is_err());
+    for kind in ["path", "gstroke"] {
+        let r = s.execute("layer.addShapeItem", json!({"layer": sh, "kind": kind})).unwrap();
+        assert!(r["path"].as_str().is_some_and(|p| p.starts_with("contents/")), "{r}");
+    }
+    let cid = s.active_comp_id().unwrap();
+    let _ = s.render(cid, s.time(), Default::default());
+}
+
+/// The toolbar/query width follows the selected solid or gradient stroke, including animation.
+#[test]
+fn shape_toolbar_reads_solid_and_gradient_stroke_widths_at_the_current_time() {
+    for kind in ["solid", "linear", "radial"] {
+        for (stretch, expected) in [(100.0, 17.0), (200.0, 13.0)] {
+            let mut s = Session::default();
+            s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
+            let layer = s.execute("layer.newShape", json!({"kind": "rect"})).unwrap()["layer"].as_u64().unwrap();
+            s.execute("layer.timeStretch", json!({"layer": layer, "percent": stretch})).unwrap();
+            let configured = s.execute("shape.fillStroke", json!({"fill": false, "strokeType": kind, "strokeWidth": 9})).unwrap();
+            assert_eq!(configured["strokeWidth"].as_f64(), Some(9.0), "configured {kind} stroke");
+            let group = if kind == "solid" { "stroke" } else { "gstroke" };
+            let path = format!("contents/group/contents/{group}/width");
+            for (time, width) in [(0, 9), (1, 17)] {
+                s.execute("prop.addKey", json!({"layer": layer, "path": path, "time": time, "timeBase": "layer", "value": width})).unwrap();
+            }
+            s.set_time(effectcraft_time::Tick::from_seconds_f64(1.0));
+            let displayed = s.execute("shape.fillStroke", json!({})).unwrap();
+            assert_eq!(displayed["strokeWidth"].as_f64(), Some(expected), "animated {kind} stroke at {stretch}% stretch");
+        }
+    }
+}
+
+/// A later solid stroke supplies color without overwriting the first gradient stroke's width.
+#[test]
+fn shape_toolbar_keeps_the_first_gradient_width_with_a_later_solid_stroke() {
+    for kind in ["linear", "radial"] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
+        let layer = s.execute("layer.newShape", json!({"kind": "rect"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("shape.fillStroke", json!({"strokeType": kind, "strokeWidth": 9})).unwrap();
+        s.execute("layer.addShapeItem", json!({"layer": layer, "group": "contents/group", "kind": "stroke"})).unwrap();
+        for (field, value) in [("color", json!([0.0, 1.0, 0.0, 1.0])), ("width", json!(99))] {
+            s.execute("prop.set", json!({"layer": layer, "path": format!("contents/group/contents/stroke/{field}"), "value": value})).unwrap();
+        }
+        for (time, width) in [(0, 9), (1, 17)] {
+            s.execute("prop.addKey", json!({"layer": layer, "path": "contents/group/contents/gstroke/width", "time": time, "value": width})).unwrap();
+        }
+        for (time, width) in [(0.0, 9.0), (1.0, 17.0)] {
+            s.set_time(effectcraft_time::Tick::from_seconds_f64(time));
+            let displayed = s.execute("shape.fillStroke", json!({})).unwrap();
+            assert_eq!(displayed["strokeWidth"].as_f64(), Some(width));
+            assert_eq!(displayed["stroke"], json!([0.0, 1.0, 0.0, 1.0]));
+        }
+    }
+}
+
+/// A Wiggle Paths saved without Spatial Phase gets the property, at 0°, after Temporal Phase when
+/// the project opens.
+#[test]
+fn opening_a_wiggle_paths_without_spatial_phase_adds_it() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
+    let sh = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let uid = s.execute("layer.addShapeItem", json!({"layer": sh, "kind": "wiggle"})).unwrap()["uid"].as_u64().unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let mut old = effectcraft_project::Project::from_json(&s.project.to_file_json().unwrap()).unwrap();
+    let l = old.comp_mut(cid).unwrap().layer_mut(effectcraft_project::LayerId(sh)).unwrap();
+    let g = l.props.find_group_mut(uid).unwrap();
+    g.children.retain(|c| c.match_id() != "spatialPhase");
+    assert_eq!(g.children.len(), 7);
+    let next = old.next_id;
+    s.replace_project(old, None);
+    let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap().clone();
+    let g = l.props.find_group(uid).unwrap();
+    let ids: Vec<&str> = g.children.iter().map(|c| c.match_id()).collect();
+    assert_eq!(ids, ["size", "detail", "points", "speed", "correlation", "phase", "spatialPhase", "seed"]);
+    let sp = g.get("spatialPhase").unwrap();
+    assert_eq!((sp.name.as_str(), &sp.value), ("Spatial Phase", &effectcraft_keyframe::Value::Scalar(0.0)));
+    assert!(sp.uid >= next && s.project.next_id > sp.uid, "a fresh uid: {} (next {next})", sp.uid);
+}
+
+/// The toolbar's Fill Options / Stroke Options change a selected shape layer's paint kind (#732):
+/// None switches the fill off, a gradient turns the Fill into a Gradient Fill that keeps its
+/// opacity, Solid Color turns it back, and a Stroke kind adds a stroke where there is none.
+#[test]
+fn toolbar_fill_and_stroke_kinds_change_selected_shape_layers() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
+    let sh = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let items = |s: &Session| -> Vec<(String, bool)> {
+        let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap();
+        l.props.group("contents/group/contents").unwrap().groups().map(|g| (g.match_id.clone(), g.enabled)).collect()
+    };
+    let kinds = |s: &mut Session| {
+        let p = s.execute("shape.fillStroke", json!({})).unwrap();
+        (p["fillType"].as_str().unwrap().to_string(), p["strokeType"].as_str().unwrap().to_string())
+    };
+    assert_eq!(kinds(&mut s), ("solid".into(), "none".into()));
+    let cid = s.active_comp_id().unwrap();
+    let centre = |s: &Session| s.render(cid, s.time(), Default::default()).get(200, 150);
+    let red = centre(&s);
+    // None switches the fill off: nothing is drawn, and the item stays.
+    s.execute("shape.fillStroke", json!({"fillType": "none"})).unwrap();
+    assert_eq!(items(&s), [("rect".into(), true), ("fill".into(), false)]);
+    assert_eq!(kinds(&mut s).0, "none");
+    assert_ne!(centre(&s), red, "the fill is off");
+    // A radial gradient: the Fill becomes a Gradient Fill (switched on) that keeps its opacity.
+    s.execute("shape.fillStroke", json!({"fillType": "solid", "fill": "#ff0000"})).unwrap();
+    assert_eq!(centre(&s), red);
+    let opacity = |s: &Session, m: &str| {
+        let l = s.active_comp().unwrap().layer(effectcraft_project::LayerId(sh)).unwrap();
+        l.props.group(&format!("contents/group/contents/{m}")).unwrap().get("opacity").unwrap().value.as_f64()
+    };
+    s.execute("prop.set", json!({"layer": sh, "path": "contents/group/contents/fill/opacity", "value": 40})).unwrap();
+    s.execute("shape.fillStroke", json!({"fillType": "radial"})).unwrap();
+    assert_eq!(items(&s), [("rect".into(), true), ("gfill".into(), true)]);
+    assert_eq!((kinds(&mut s).0.as_str(), opacity(&s, "gfill")), ("radial", 40.0));
+    s.execute("shape.fillStroke", json!({"fillType": "linear"})).unwrap();
+    assert_eq!(kinds(&mut s).0, "linear");
+    s.execute("shape.fillStroke", json!({"fillType": "solid", "fill": "#00ff00"})).unwrap();
+    assert_eq!(items(&s), [("rect".into(), true), ("fill".into(), true)]);
+    assert_eq!(opacity(&s, "fill"), 40.0);
+    // A Stroke kind adds a stroke (before the fill); None switches it off again; undo is per step.
+    s.execute("shape.fillStroke", json!({"strokeType": "linear"})).unwrap();
+    assert_eq!(items(&s), [("rect".into(), true), ("gstroke".into(), true), ("fill".into(), true)]);
+    s.execute("shape.fillStroke", json!({"strokeType": "none"})).unwrap();
+    assert_eq!(kinds(&mut s), ("solid".into(), "none".into()));
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(kinds(&mut s), ("solid".into(), "linear".into()));
+    assert!(s.execute("shape.fillStroke", json!({"fillType": "plaid"})).is_err());
+}
+
+/// Selecting a mask in the Timeline (its row or its Mask Path) selects all of its points, so the
+/// viewer drags the whole mask (#203); a shape's Path item works the same way.
+#[test]
+fn selecting_a_mask_selects_its_points() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 400, "height": 300, "duration": 2})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
+    let m1 = s.execute("layer.addMask", json!({"layer": l, "shape": "rect"})).unwrap()["mask"].as_u64().unwrap();
+    let m2 = s.execute("layer.addMask", json!({"layer": l, "shape": "ellipse"})).unwrap()["mask"].as_u64().unwrap();
+    let points = |s: &Session, m: u64| s.state.selected_vertices.iter().filter(|v| v.mask == m).count();
+    s.execute("prop.select", json!({"layer": l, "prop": m1, "selectKeys": false})).unwrap();
+    assert_eq!((points(&s, m1), s.state.selected_vertices.len()), (4, 4));
+    // Mask Path selects them too; Shift-adding another mask keeps the first.
+    let path = s.active_comp().unwrap().layer(effectcraft_project::LayerId(l)).unwrap().props.find_group(m2).unwrap().get("path").unwrap().uid;
+    s.execute("prop.select", json!({"layer": l, "prop": path, "add": true})).unwrap();
+    assert_eq!((points(&s, m1), points(&s, m2)), (4, 4));
+    // Another mask replaces them; another property deselects them.
+    s.execute("prop.select", json!({"layer": l, "prop": m2})).unwrap();
+    assert_eq!((points(&s, m1), points(&s, m2)), (0, 4));
+    // Delete removes the selected mask (not only its points).
+    s.execute("edit.clear", json!({})).unwrap();
+    let masks = |s: &Session| s.active_comp().unwrap().layer(effectcraft_project::LayerId(l)).unwrap().masks().unwrap().children.len();
+    assert_eq!(masks(&s), 1);
+    s.execute("prop.select", json!({"layer": l, "path": "transform/opacity"})).unwrap();
+    assert!(s.state.selected_vertices.is_empty());
+    let sh = s.execute("layer.newShape", json!({"kind": "star"})).unwrap()["layer"].as_u64().unwrap();
+    let star = s.execute("layer.addShapeItem", json!({"layer": sh, "kind": "path"})).unwrap()["uid"].as_u64().unwrap();
+    s.execute("prop.select", json!({"layer": sh, "prop": star})).unwrap();
+    assert_eq!(s.state.selected_vertices.len(), 0, "an empty Path has no points");
+}
+
+#[test]
+fn save_and_open_roundtrip() {
+    let mut s = demo();
+    let dir = std::env::temp_dir().join(format!("ec-test-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("demo.ecproj").to_string_lossy().to_string();
+    s.execute("file.saveAs", json!({"path": path})).unwrap();
+    let before = s.project.clone();
+    let mut s2 = Session::default();
+    s2.execute("file.open", json!({"path": path})).unwrap();
+    assert_eq!(*before, *s2.project);
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+#[test]
+fn help_links_emit_urls() {
+    let mut s = Session::default();
+    let r = s.execute("help.discord", json!({})).unwrap();
+    assert_eq!(r["url"], "https://discord.gg/artcraft");
+    assert!(s.drain_events().iter().any(|e| matches!(e, crate::Event::OpenUrl(u) if u.contains("discord"))));
+    assert_eq!(s.execute("help.github", json!({})).unwrap()["url"], "https://github.com/storytold/effectcraft");
+}
+
+/// Every Help ▸ documentation page opens a file that is in the repository (#2696: Expression Reference opened a 404).
+#[test]
+fn help_docs_pages_exist_in_the_repository() {
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    for page in [None, Some("help"), Some("scripting"), Some("expressions"), Some("effects"), Some("agents")] {
+        let mut s = Session::default();
+        let params = page.map_or_else(|| json!({}), |p| json!({"page": p}));
+        let url = s.execute("help.docs", params).unwrap()["url"].as_str().unwrap().to_owned();
+        let path = url.strip_prefix("https://github.com/storytold/effectcraft/blob/main/").unwrap_or_else(|| panic!("{page:?}: {url}"));
+        assert!(root.join(path).is_file(), "{page:?} opens {url}, which is not in the repository");
+    }
+}
+
+#[test]
+fn time_navigation() {
+    let mut s = demo();
+    s.execute("time.start", json!({})).unwrap();
+    let r = s.execute("time.nextKey", json!({})).unwrap();
+    assert!(r["time"].as_f64().unwrap() > 0.0);
+    s.execute("time.set", json!({"frame": 45})).unwrap();
+    assert_eq!(s.execute("time.step", json!({"frames": 5})).unwrap()["frame"], 50);
+}
+
+#[test]
+fn time_navigation_per_property() {
+    let mut s = demo();
+    // An animated property and the comp times of its keys.
+    let comp = s.active_comp().unwrap().clone();
+    let mut found = None;
+    for l in &comp.layers {
+        l.props.walk("", &mut |_, pr| {
+            if found.is_none() && pr.keys.len() >= 2 {
+                found = Some((pr.uid, pr.keys.iter().map(|k| l.comp_time(k.time)).collect::<Vec<_>>()));
+            }
+        });
+    }
+    let (uid, times) = found.expect("demo has an animated property");
+    s.set_time(effectcraft_time::Tick::ZERO);
+    let half = comp.frame_duration().0 / 2;
+    let expect = times.iter().copied().filter(|t| t.0 > half).min().unwrap();
+    s.execute("time.go", json!({"to": "nextKey", "prop": uid})).unwrap();
+    let snap = |t| comp.frame_rate.snap(t);
+    assert_eq!(s.time(), snap(expect));
+    // Going back from past the last key lands on the last key.
+    s.set_time(comp.duration);
+    s.execute("time.go", json!({"to": "prevKey", "prop": uid})).unwrap();
+    assert_eq!(s.time(), snap(*times.iter().max().unwrap()));
+}
+
+#[test]
+fn set_text_paragraph_fill_and_leading() {
+    use effectcraft_keyframe::{Justify, Value as KValue};
+    let mut s = demo();
+    let t = s.execute("layer.newText", json!({"text": "Hi"})).unwrap()["layer"].as_u64().unwrap();
+    let doc = |s: &Session| {
+        let l = s.active_comp().unwrap().layer(crate::project::LayerId(t)).unwrap().clone();
+        match &l.props.prop("text/sourceText").unwrap().value {
+            KValue::Text(d) => (**d).clone(),
+            v => panic!("{v:?}"),
+        }
+    };
+    for (key, j) in [
+        ("justifyLeft", Justify::JustifyLastLeft),
+        ("justifyCenter", Justify::JustifyLastCenter),
+        ("justifyRight", Justify::JustifyLastRight),
+        ("justifyAll", Justify::JustifyAll),
+        ("center", Justify::Center),
+    ] {
+        s.execute("layer.setText", json!({"layer": t, "justify": key})).unwrap();
+        assert_eq!(doc(&s).justify, j, "{key}");
+    }
+    s.execute("layer.setText", json!({"layer": t, "leading": 50, "applyFill": false, "applyStroke": true})).unwrap();
+    let d = doc(&s);
+    assert_eq!((d.leading, d.apply_fill, d.apply_stroke), (Some(50.0), false, true));
+    s.execute("layer.setText", json!({"layer": t, "leading": "auto"})).unwrap();
+    assert_eq!(doc(&s).leading, None);
+    s.execute("layer.setText", json!({"layer": t, "hScale": 120, "vScale": 80, "baselineShift": 4, "smallCaps": true, "strokeOverFill": true})).unwrap();
+    let d = doc(&s);
+    assert_eq!((d.h_scale, d.v_scale, d.baseline_shift, d.small_caps, d.stroke_over_fill), (120.0, 80.0, 4.0, true, true));
+    s.execute("layer.setText", json!({"layer": t, "lineJoin": "bevel"})).unwrap();
+    assert_eq!(doc(&s).line_join, effectcraft_keyframe::LineJoin::Bevel);
+    assert!(s.execute("layer.setText", json!({"layer": t, "lineJoin": "square"})).is_err());
+}
+
+#[test]
+fn property_groups_report_actionable_errors() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "T"})).unwrap();
+    let l = s.execute("layer.newText", json!({"text": "Hi"})).unwrap()["layer"].as_u64().unwrap();
+    let uid = s.active_comp().unwrap().layer(crate::project::LayerId(l)).unwrap().props.group("text/pathOptions").unwrap().uid;
+    for selector in [json!({"path": "text"}), json!({"path": "text/pathOptions"}), json!({"path": format!("@{uid}")}), json!({"prop": uid})] {
+        let mut params = selector;
+        params["layer"] = json!(l);
+        for cmd in ["prop.get", "prop.set"] {
+            let err = s.execute(cmd, params.clone()).unwrap_err().to_string();
+            assert!(err.contains("is a property group"), "{cmd}: {err}");
+            assert!(err.contains("get_layer"), "{cmd}: {err}");
+        }
+    }
+    assert!(s.execute("prop.get", json!({"layer": l, "path": "text/sourceText"})).is_ok());
+    let err = s.execute("prop.get", json!({"layer": l, "path": "missing"})).unwrap_err().to_string();
+    assert!(err.contains("no property `missing`"), "{err}");
+}
+
+#[test]
+fn prop_get_and_render_rgba8() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "T", "width": 320, "height": 180, "duration": 2.0, "frameRate": 30})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": 0.0, "value": [0, 0]})).unwrap();
+    s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": 1.0, "value": [100, 50]})).unwrap();
+    let v = s.execute("prop.get", json!({"layer": l, "path": "transform/position", "time": 1.0})).unwrap();
+    assert_eq!(v["animated"], true);
+    assert_eq!(v["keys"].as_array().unwrap().len(), 2);
+    assert_eq!(v["value"][0].as_f64().unwrap(), 100.0);
+    let cid = s.resolve_comp(Some(&json!("T"))).unwrap();
+    let (w, h, rgba) = s.render_rgba8(cid, effectcraft_time::Tick::ZERO, 160).unwrap();
+    assert_eq!((w, h), (160, 90));
+    assert_eq!(rgba.len(), (w * h * 4) as usize);
+}
+
+#[test]
+fn params_docs_parse() {
+    use crate::commands::accepted_params;
+    let k = |d: &str| accepted_params(d).unwrap();
+    assert_eq!(k("{layers: [id|name|#n], add?, toggle?}"), ["layers", "add", "toggle"]);
+    assert_eq!(k("{time? (s) | frame? | timecode?}"), ["time", "frame", "timecode"]);
+    assert_eq!(k("{interpolation?|in?|out?: linear|bezier|hold, autoBezier?}"), ["interpolation", "in", "out", "autoBezier"]);
+    assert_eq!(k("{keys: [{layer, prop, time}], add?}"), ["keys", "add"]);
+    assert_eq!(k("{label: Red|Yellow|Aqua|…, layers?}"), ["label", "layers"]);
+    assert_eq!(k("{name?, background? [r,g,b]|#hex, open?}"), ["name", "background", "open"]);
+    assert!(k("{}").is_empty());
+    assert!(accepted_params("free text").is_none());
+    // Every registered command documents its params as a parseable key list.
+    for c in crate::command_specs() {
+        assert!(accepted_params(c.params).is_some(), "{}: {}", c.id, c.params);
+    }
+}
+
+#[test]
+fn execute_checked_rejects_unknown_params() {
+    let mut s = demo();
+    let e = s.execute_checked("layer.select", json!({"index": 2})).unwrap_err().to_string();
+    assert!(e.contains("`index`") && e.contains("layers, add, toggle"), "{e}");
+    s.execute_checked("layer.select", json!({"layers": ["#2"]})).unwrap();
+    assert_eq!(s.state.selected_layers.len(), 1);
+    // Aliases and always-accepted keys.
+    s.execute_checked("layer.select", json!({"layer": "#1", "comp": s.active_comp_id().unwrap().0})).unwrap();
+    s.execute_checked("time.set", json!({"frame": 3})).unwrap();
+    assert!(s.execute_checked("edit.undo", json!({"steps": 2})).is_err());
+    // Non-object params are not validated; the unchecked path stays lenient.
+    s.execute("layer.select", json!({"layers": ["#1"], "index": 2})).unwrap();
+}
+
+#[test]
+fn layer_tree_paths_resolve() {
+    let mut s = demo();
+    s.execute("effect.apply", json!({"layer": 1, "effect": "Gaussian Blur"})).unwrap();
+    let comp = s.execute("comp.info", json!({})).unwrap();
+    let mut checked = 0;
+    for l in comp["layers"].as_array().unwrap() {
+        let tree = s.execute("layer.tree", json!({"layer": l["id"]})).unwrap();
+        let mut stack = vec![tree["properties"].clone()];
+        while let Some(n) = stack.pop() {
+            if let Some(ch) = n["children"].as_array() {
+                stack.extend(ch.iter().cloned());
+                continue;
+            }
+            let path = n["path"].as_str().unwrap();
+            let got = s.execute("prop.get", json!({"layer": l["id"], "path": path})).unwrap();
+            assert_eq!(got["uid"], n["uid"], "path {path} on layer {}", l["name"]);
+            checked += 1;
+        }
+    }
+    assert!(checked > 20, "{checked}");
+}
+
+#[test]
+fn comp_settings_anchor_start_timecode_renderer() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "A", "width": 100, "height": 100, "duration": 2.0})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": 0.0, "value": [10, 20]})).unwrap();
+    let pos = |s: &Session| {
+        let pr = s.active_comp().unwrap().layer(crate::project::LayerId(l)).unwrap().props.prop("transform/position").unwrap().clone();
+        pr.keys[0].value.components()
+    };
+    // Center anchor: grow by 100x50 → shift by half.
+    s.execute("comp.settings", json!({"width": 200, "height": 150})).unwrap();
+    assert_eq!(pos(&s)[..2], [60.0, 45.0]);
+    // Top-left anchor: no shift. Bottom-right: full shift.
+    s.execute("comp.settings", json!({"width": 300, "anchor": 0})).unwrap();
+    assert_eq!(pos(&s)[..2], [60.0, 45.0]);
+    s.execute("comp.settings", json!({"width": 200, "height": 100, "anchor": 8})).unwrap();
+    assert_eq!(pos(&s)[..2], [-40.0, -5.0]);
+    s.execute("comp.settings", json!({"startTimecode": "0:00:01:00", "renderer": "advanced3D"})).unwrap();
+    let c = s.active_comp().unwrap();
+    assert_eq!(c.display_start, c.frame_rate.tick_of(30));
+    assert_eq!(c.renderer, crate::project::Renderer::Advanced3D);
+}
+
+/// `advanced3D` is a value of `renderer`, not a key: comp.new / comp.settings don't advertise it
+/// in their schemas and reject it as unknown instead of ignoring it (#177).
+#[test]
+fn renderer_values_are_not_parameter_keys() {
+    let mut s = Session::default();
+    for (id, p) in [("comp.new", json!({"name": "A"})), ("comp.settings", json!({}))] {
+        let spec = crate::command_specs().iter().find(|c| c.id == id).unwrap();
+        let keys = crate::commands::accepted_params(spec.params).unwrap();
+        assert!(keys.contains(&"renderer".to_string()) && !keys.contains(&"advanced3D".to_string()), "{id}: {keys:?}");
+        let mut bad = p.clone();
+        bad["advanced3D"] = json!(true);
+        let e = s.execute_checked(id, bad).unwrap_err().to_string();
+        assert!(e.contains("unknown parameter(s) `advanced3D`"), "{id}: {e}");
+        let mut good = p;
+        good["renderer"] = json!("advanced3D");
+        s.execute_checked(id, good).unwrap();
+        assert_eq!(s.active_comp().unwrap().renderer, crate::project::Renderer::Advanced3D, "{id}");
+        s.execute("comp.renderer", json!({"renderer": "classic3d"})).unwrap();
+    }
+}
+
+#[test]
+fn comp_rejects_zero_and_negative_frame_rates() {
+    let mut s = Session::default();
+    for fps in [0.0, -30.0, 0.0001] {
+        assert!(s.execute("comp.new", json!({"frameRate": fps})).is_err(), "{fps}");
+    }
+    s.execute("comp.new", json!({"frameRate": 30, "duration": 1})).unwrap();
+    assert!(s.execute("comp.settings", json!({"frameRate": 0})).is_err());
+    assert_eq!(s.active_comp().unwrap().frame_rate, crate::time::FrameRate::FPS_30);
+}
+
+#[test]
+fn render_queue_add_accepts_documented_settings_when_checked() {
+    let mut s = demo();
+    let r = s.execute_checked(
+        "renderQueue.add",
+        json!({"format": "gif", "output": "/tmp/x.gif", "resolution": "quarter", "timeSpan": "custom", "start": 0.0, "end": 0.5, "quality": "draft", "loop": true}),
+    );
+    // Without an exporter the add itself still succeeds (rendering is what needs one).
+    assert!(r.is_ok(), "{r:?}");
+    assert!(s.execute_checked("renderQueue.add", json!({"bogus": 1})).is_err());
+}
+
+#[test]
+fn new_text_rejects_malformed_positions_without_creating_a_layer() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 64, "duration": 1})).unwrap();
+    for position in [json!([]), json!([10]), json!(["x", 20]), json!([null, 20])] {
+        let err = s.execute("layer.newText", json!({"text": "Hello", "position": position})).unwrap_err();
+        assert!(err.to_string().contains("position: [x, y]"), "{err}");
+        assert!(s.active_comp().unwrap().layers.is_empty());
+    }
+    s.execute("layer.newText", json!({"name": "Valid", "text": "Hello", "position": [10, 20]})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers[0].props.prop("transform/position").unwrap().value, effectcraft_keyframe::Value::Vec3([10.0, 20.0, 0.0]));
+    s.execute("layer.newText", json!({"text": "No explicit position"})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 2);
+}
+
+/// The active comp and the open comp tabs are saved with the project and restored on open (#748).
+#[test]
+fn reopening_a_project_restores_its_active_comp() {
+    use effectcraft_project::ItemId;
+    let dir = std::env::temp_dir().join(format!("ec-test-748-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("view.ecproj").to_string_lossy().to_string();
+    let mut s = Session::default();
+    let a = s.execute("comp.new", json!({"name": "CompA"})).unwrap()["comp"].as_u64().unwrap();
+    let b = s.execute("comp.new", json!({"name": "CompB"})).unwrap()["comp"].as_u64().unwrap();
+    let c = s.execute("comp.new", json!({"name": "CompC"})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("comp.open", json!({"comp": "CompB"})).unwrap();
+    s.state.open_comps.retain(|id| id.0 != c);
+    s.execute("file.saveAs", json!({"path": path})).unwrap();
+    let mut s2 = Session::default();
+    s2.execute("file.open", json!({"path": path})).unwrap();
+    assert_eq!(s2.state.active_comp, Some(ItemId(b)));
+    assert_eq!(s2.state.open_comps, vec![ItemId(a), ItemId(b)]);
+    assert!(!s2.is_dirty());
+
+    // A file from before the view was saved opens on its first comp, as it always did.
+    let text = std::fs::read_to_string(&path).unwrap();
+    let mut old: serde_json::Value = serde_json::from_str(&text).unwrap();
+    let obj = old.as_object_mut().unwrap();
+    obj.remove("activeComp");
+    obj.remove("openComps");
+    std::fs::write(&path, serde_json::to_string_pretty(&old).unwrap()).unwrap();
+    let mut s3 = Session::default();
+    s3.execute("file.open", json!({"path": path})).unwrap();
+    assert_eq!((s3.state.active_comp, s3.state.open_comps.clone()), (Some(ItemId(a)), vec![ItemId(a)]));
+
+    // Ids that no longer name a comp (edited by hand, or written by another tool) fall back.
+    obj_set(&mut old, json!(999), json!([999, b, "x"]));
+    std::fs::write(&path, serde_json::to_string_pretty(&old).unwrap()).unwrap();
+    let mut s4 = Session::default();
+    s4.execute("file.open", json!({"path": path})).unwrap();
+    assert_eq!((s4.state.active_comp, s4.state.open_comps.clone()), (Some(ItemId(b)), vec![ItemId(b)]));
+    obj_set(&mut old, json!(999), json!([]));
+    std::fs::write(&path, serde_json::to_string_pretty(&old).unwrap()).unwrap();
+    let mut s5 = Session::default();
+    s5.execute("file.open", json!({"path": path})).unwrap();
+    assert_eq!((s5.state.active_comp, s5.state.open_comps.clone()), (Some(ItemId(a)), vec![ItemId(a)]));
+
+    // XML copies carry it too.
+    let xml = dir.join("view.ecprojx").to_string_lossy().to_string();
+    s.execute("file.saveAs", json!({"path": xml})).unwrap();
+    let mut s6 = Session::default();
+    s6.execute("file.open", json!({"path": xml})).unwrap();
+    assert_eq!(s6.state.active_comp, Some(ItemId(b)));
+    let _ = std::fs::remove_dir_all(dir);
+
+    fn obj_set(v: &mut serde_json::Value, active: serde_json::Value, open: serde_json::Value) {
+        let o = v.as_object_mut().unwrap();
+        o.insert("activeComp".into(), active);
+        o.insert("openComps".into(), open);
+    }
+}
+
+/// Layer times are saved as exact ticks and read back unchanged, and each comp reopens at the
+/// current time it was saved at, not at 0, where a layer starting later shows nothing (#1714).
+#[test]
+fn reopening_a_project_restores_layer_times_and_current_time() {
+    use effectcraft_project::ItemId;
+    use effectcraft_time::{FrameRate, Tick};
+    let dir = std::env::temp_dir().join(format!("ec-test-1714-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("times.ecproj").to_string_lossy().to_string();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 108, "height": 192, "duration": 60})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "crown"})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let comp = std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap();
+    comp.frame_rate = FrameRate::FPS_59_94;
+    // The layer from the issue: 34f, 315f and 3033f at 59.94 fps.
+    let l = comp.layers.first_mut().unwrap();
+    (l.start_time, l.in_point, l.out_point) = (Tick(144_086_342_400), Tick(1_334_917_584_000), Tick(12_853_349_308_800));
+    s.execute("time.set", json!({"time": 6.0})).unwrap();
+    let t = s.time();
+    // A second comp keeps its own time.
+    let b = ItemId(s.execute("comp.new", json!({"name": "B"})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("time.set", json!({"time": 2.0})).unwrap();
+    let tb = s.time();
+    s.execute("comp.open", json!({"comp": "C"})).unwrap();
+    s.execute("file.saveAs", json!({"path": path})).unwrap();
+
+    let mut s2 = Session::default();
+    s2.execute("file.open", json!({"path": path})).unwrap();
+    let l = s2.project.comp(cid).unwrap().layers.first().unwrap();
+    assert_eq!((l.start_time, l.in_point, l.out_point), (Tick(144_086_342_400), Tick(1_334_917_584_000), Tick(12_853_349_308_800)));
+    assert_eq!((s2.time(), s2.state.times.get(&b).copied()), (t, Some(tb)));
+    assert!(l.in_point <= s2.time() && s2.time() < l.out_point, "the layer shows at the reopened time");
+    assert!(!s2.is_dirty());
+
+    // Hand-edited times past the end or before the start land on the last or first frame.
+    let mut file: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
+    file["compTimes"] = json!({cid.0.to_string(): i64::MAX, b.0.to_string(): -5});
+    std::fs::write(&path, file.to_string()).unwrap();
+    let mut s3 = Session::default();
+    s3.execute("file.open", json!({"path": path})).unwrap();
+    let c = s3.project.comp(cid).unwrap();
+    assert_eq!(s3.time(), c.frame_rate.snap_nearest(c.duration - c.frame_duration()));
+    assert_eq!(s3.time(), c.frame_rate.snap_nearest(c.duration - c.frame_duration()));
+    assert_eq!(s3.state.times.get(&b).copied(), Some(Tick::ZERO));
+}
diff --git a/crates/engine/src/tests_settings.rs b/crates/engine/src/tests/settings.rs
similarity index 85%
rename from crates/engine/src/tests_settings.rs
rename to crates/engine/src/tests/settings.rs
index a4f4d89eb..b37c5ca3e 100644
--- a/crates/engine/src/tests_settings.rs
+++ b/crates/engine/src/tests/settings.rs
@@ -40,6 +40,22 @@ fn prefs_round_trip_through_json() {
     assert_eq!(Prefs::from_json(&Prefs::default().to_json()), Prefs::default());
 }
 
+/// A document with one bad page and many unknown keys recovers its good pages in one pass per
+/// page, not one full parse per key.
+#[test]
+fn prefs_recovery_tries_only_the_settings_pages() {
+    let mut doc = serde_json::Map::new();
+    doc.insert("general".into(), json!({"undoLevels": "not a number"}));
+    doc.insert("labels".into(), serde_json::to_value(Prefs::default()).unwrap()["labels"].clone());
+    for i in 0..20_000 {
+        doc.insert(format!("unknown{i}"), json!({"x": i}));
+    }
+    let t = std::time::Instant::now();
+    let p = Prefs::from_json(&serde_json::Value::Object(doc).to_string());
+    assert!(t.elapsed() < std::time::Duration::from_secs(10), "{:?}", t.elapsed());
+    assert_eq!(p.general, Prefs::default().general);
+}
+
 #[test]
 fn prefs_migrate_old_layout_and_keep_unknown_keys() {
     let old = r#"{
@@ -71,6 +87,23 @@ fn prefs_migrate_old_layout_and_keep_unknown_keys() {
     assert_eq!(Prefs::from_json("not json"), Prefs::default());
 }
 
+#[test]
+fn prefs_migrate_old_disk_cache_default() {
+    // The old 100 GB default becomes 20 GB; a size the user chose stays (#2551).
+    assert_eq!(Prefs::from_json(r#"{"version": 2, "disk": {"diskCacheMaxGb": 100}}"#).disk.disk_cache_max_gb, 20);
+    assert_eq!(Prefs::from_json(r#"{"version": 2, "disk": {"diskCacheMaxGb": 50}}"#).disk.disk_cache_max_gb, 50);
+    assert_eq!(Prefs::from_json(r#"{"version": 3, "disk": {"diskCacheMaxGb": 100}}"#).disk.disk_cache_max_gb, 100);
+}
+
+#[test]
+fn prefs_migrate_old_split_layers_default() {
+    // Settings saved before #2083 kept "below"; they move to After Effects' "above" once (#2545).
+    let above = |doc: &str| Prefs::from_json(doc).general.create_split_layers_above;
+    assert!(above(r#"{"version": 3, "general": {"createSplitLayersAbove": false}}"#));
+    assert!(above(r#"{"version": 2, "general": {"createSplitLayersAbove": false}}"#));
+    assert!(!above(r#"{"version": 4, "general": {"createSplitLayersAbove": false}}"#), "a choice made since stays");
+}
+
 #[test]
 fn prefs_set_validates_keys_types_and_ranges() {
     let mut p = Prefs::default();
@@ -181,7 +214,7 @@ fn every_schema_key_exists_and_docs_list_the_todo_settings() {
             assert!(ids.contains(&page), "{path:?} opens unknown page {page}");
         }
     }
-    let docs = include_str!("../../../docs/preferences.md");
+    let docs = include_str!("../../../../docs/preferences.md");
     for k in crate::prefs::todo_keys() {
         assert!(docs.contains(&format!("`{k}`")), "docs/preferences.md must list the not-yet-wired setting `{k}`");
     }
@@ -381,6 +414,23 @@ fn new_project_template_and_default_renderer() {
     let _ = std::fs::remove_dir_all(d);
 }
 
+#[test]
+fn project_files_are_indented_unless_compact_is_on() {
+    let d = tmp("compact-project-files");
+    let path = d.join("p.ecproj");
+    let mut s = session_with_comp();
+    s.execute("file.saveAs", json!({"path": path.to_string_lossy()})).unwrap();
+    let pretty = std::fs::read_to_string(&path).unwrap();
+    assert!(pretty.starts_with("{\n  \"savedBy\""), "indented by default");
+    s.execute("prefs.set", json!({"key": "project.compactProjectFiles", "value": true})).unwrap();
+    s.execute("file.saveAs", json!({"path": path.to_string_lossy()})).unwrap();
+    let compact = std::fs::read_to_string(&path).unwrap();
+    assert!(!compact.contains('\n'), "one line when Save Compact Project Files is on");
+    let open = |text: &str| effectcraft_project::Project::from_json(text).unwrap();
+    assert_eq!(open(&compact), open(&pretty), "both read back as the same project");
+    let _ = std::fs::remove_dir_all(d);
+}
+
 // ---------------------------------------------------------------- shortcuts
 
 #[test]
@@ -563,8 +613,8 @@ fn shortcut_presets_duplicate_rename_delete_export_import() {
 fn frontend_commands_are_bindable_with_panel_scope() {
     let mut s = Session::default();
     s.set_ui_commands(vec![
-        crate::shortcuts::UiCommand { id: "timeline.zoomIn".into(), label: "Zoom In Time".into(), shortcut: Some("=".into()) },
-        crate::shortcuts::UiCommand { id: "tool.hand".into(), label: "Hand Tool".into(), shortcut: Some("H".into()) },
+        crate::shortcuts::UiCommand { id: "timeline.zoomIn".into(), label: "Zoom In Time".into(), shortcut: Some("=".into()), scope: None },
+        crate::shortcuts::UiCommand { id: "tool.hand".into(), label: "Hand Tool".into(), shortcut: Some("H".into()), scope: None },
     ]);
     let b = s.shortcuts().find("timeline.zoomIn").unwrap().clone();
     assert_eq!(b.scope, "Timeline");
@@ -572,6 +622,49 @@ fn frontend_commands_are_bindable_with_panel_scope() {
     // A panel shortcut conflicts with an application shortcut on the same keys.
     let c = s.shortcuts().conflicts(&b, "H");
     assert!(c.iter().any(|c| c.key == "tool.hand"));
+    // A registry command that only the Project panel runs is scoped to it.
+    assert_eq!(s.shortcuts().find("project.deleteWithoutConfirmation").unwrap().scope, "Project");
+}
+
+/// The binding that runs a key press: the narrowest scope; a physical binding at the same rank;
+/// nothing when two other panels (or two active contexts) claim it at the same rank.
+#[test]
+fn shortcut_dispatch_picks_the_narrowest_scope_deterministically() {
+    use crate::shortcuts::pick;
+    // Two unrelated panels, neither focused: neither runs, in either order.
+    let both = [("Project", false, "delete"), ("RenderQueue", false, "duplicate")];
+    assert_eq!(pick(both, "Timeline", &[]), Err(vec!["Project".to_string(), "RenderQueue".into()]));
+    assert_eq!(pick([both[1], both[0]], "Timeline", &[]), Err(vec!["RenderQueue".to_string(), "Project".into()]));
+    // The focused one of them wins.
+    assert_eq!(pick(both, "RenderQueue", &[]), Ok(Some("duplicate")));
+    // A single other panel's shortcut runs when nothing nearer claims the chord.
+    assert_eq!(pick([("Project", false, "delete")], "Timeline", &[]), Ok(Some("delete")));
+    // An application binding beats an unrelated panel's binding, also a physical one.
+    assert_eq!(pick([("RenderQueue", true, "duplicate"), ("Application", false, "app")], "Timeline", &[]), Ok(Some("app")));
+    // At the same rank a physical binding wins, in either order.
+    assert_eq!(pick([("Application", false, "logical"), ("Application", true, "physical")], "Timeline", &[]), Ok(Some("physical")));
+    assert_eq!(pick([("Application", true, "physical"), ("Application", false, "logical")], "Timeline", &[]), Ok(Some("physical")));
+    // A Composition binding runs in the Composition panel over the application's.
+    assert_eq!(pick([("Application", false, "app"), ("Composition", false, "comp")], "Composition", &[]), Ok(Some("comp")));
+    // Two active contexts tie; an inactive one doesn't run.
+    assert_eq!(pick([("Mask", false, "mask"), ("Paint", false, "paint")], "Composition", &["Paint", "Mask"]), Err(vec!["Mask".to_string(), "Paint".into()]));
+    assert_eq!(pick([("Mask", false, "mask"), ("Paint", false, "paint")], "Composition", &["Paint"]), Ok(Some("paint")));
+    // The same scope twice (a reported conflict): the first one.
+    assert_eq!(pick([("Timeline", false, "a"), ("Timeline", false, "b")], "Timeline", &[]), Ok(Some("a")));
+}
+
+/// Two contexts can be active at once, so their shortcuts on the same keys conflict.
+#[test]
+fn context_shortcuts_on_the_same_keys_conflict() {
+    let mut s = Session::default();
+    s.set_ui_commands(vec![
+        crate::shortcuts::UiCommand { id: "test.mask".into(), label: "Mask".into(), shortcut: Some("F9".into()), scope: Some("Mask".into()) },
+        crate::shortcuts::UiCommand { id: "test.paint".into(), label: "Paint".into(), shortcut: Some("F9".into()), scope: Some("Paint".into()) },
+    ]);
+    let t = s.shortcuts();
+    assert!(t.all_conflicts().iter().any(|(a, c)| a == "test.mask" && c.key == "test.paint" && !c.overrides), "{:?}", t.all_conflicts());
+    let b = t.find("test.mask").unwrap();
+    assert!(t.conflicts(b, "F9").iter().any(|c| c.key == "test.paint" && !c.overrides));
 }
 
 // ---------------------------------------------------------------- auto-save / recovery
@@ -1064,6 +1157,20 @@ fn interface_language_is_validated_persisted_and_backward_compatible() {
     cs.load_settings();
     assert_eq!(cs.prefs.general.language, "cs");
     assert_eq!(Prefs::from_json(r#"{"general":{"language":"cs"}}"#).general.language, "cs");
+    // Polish, likewise.
+    assert!(crate::prefs::LANGUAGES.contains(&("Polski", "pl")));
+    s.execute("prefs.set", json!({"key": "general.language", "value": "pl"})).unwrap();
+    assert_eq!(s.execute("prefs.get", json!({"key": "general.language"})).unwrap(), json!("pl"));
+    let mut pl = Session { config: Some(store.clone()), ..Default::default() };
+    pl.load_settings();
+    assert_eq!(pl.prefs.general.language, "pl");
+    assert_eq!(Prefs::from_json(r#"{"general":{"language":"pl"}}"#).general.language, "pl");
+    // Georgian too.
+    assert!(crate::prefs::LANGUAGES.contains(&("ქართული", "ka")));
+    s.execute("prefs.set", json!({"key": "general.language", "value": "ka"})).unwrap();
+    let mut ka = Session { config: Some(store.clone()), ..Default::default() };
+    ka.load_settings();
+    assert_eq!(ka.prefs.general.language, "ka");
     s.execute("prefs.set", json!({"key": "general.language", "value": "ja"})).unwrap();
     let mut reloaded = Session { config: Some(store), ..Default::default() };
     reloaded.load_settings();
@@ -1075,6 +1182,23 @@ fn interface_language_is_validated_persisted_and_backward_compatible() {
     assert_eq!(Prefs::from_json(r#"{"general":{"language":"en"}}"#).general.language, "en", "a chosen language stays");
 }
 
+/// Swedish is stored as `sv` rather than a locale tag, and persists like every other catalog.
+#[test]
+fn swedish_interface_language_is_validated_and_persisted() {
+    let store = Arc::new(MemoryConfig::default());
+    let mut s = Session { config: Some(store.clone()), ..Default::default() };
+    assert!(crate::prefs::LANGUAGES.contains(&("Svenska", "sv")));
+    for value in ["sv-SE", "sv_SE", "SV"] {
+        assert!(s.execute("prefs.set", json!({"key": "general.language", "value": value})).is_err(), "{value}");
+    }
+    s.execute("prefs.set", json!({"key": "general.language", "value": "sv"})).unwrap();
+    assert_eq!(s.execute("prefs.get", json!({"key": "general.language"})).unwrap(), json!("sv"));
+    let mut sv = Session { config: Some(store), ..Default::default() };
+    sv.load_settings();
+    assert_eq!(sv.prefs.general.language, "sv");
+    assert_eq!(Prefs::from_json(r#"{"general":{"language":"sv"}}"#).general.language, "sv");
+}
+
 #[test]
 fn unicode_label_colors_fall_back_without_panicking() {
     use effectcraft_color::Label;
@@ -1097,7 +1221,35 @@ fn render_backend_says_why_it_renders_on_the_cpu() {
     assert_eq!(why(&mut s), json!("no GPU compositor is attached"));
     s.accel_note = Some("headless: renders on the CPU unless started with --gpu".into());
     assert_eq!(why(&mut s), json!("headless: renders on the CPU unless started with --gpu"));
-    assert_eq!(s.execute("render.backend", json!({"backend": "cpu"})).unwrap()["why"], json!("the project's renderer is Mercury Software Only"));
+    assert_eq!(s.execute("render.backend", json!({"backend": "cpu"})).unwrap()["why"], json!("the project's renderer is Software Rendering"));
+}
+
+/// Display labels are descriptive; machine-readable settings remain the same.
+#[test]
+fn renderer_labels_keep_their_stable_machine_values() {
+    let mut s = Session::default();
+    for (backend, label, gpu) in [("cpu", "Software Rendering", false), ("gpu", "GPU Acceleration", true)] {
+        let status = s.execute("render.backend", json!({"backend": backend})).unwrap();
+        assert_eq!(status["renderer"], json!(label));
+        assert_eq!(status["gpuAcceleration"], json!(gpu));
+        assert_eq!(status["active"], json!("cpu"), "the headless test has no GPU adapter");
+    }
+}
+
+/// The label `render.backend` reports is one it accepts back, so a caller can round-trip the
+/// status instead of guessing the command's own values.
+#[test]
+fn renderer_status_labels_round_trip_through_the_command() {
+    let mut s = Session::default();
+    for (backend, label, gpu) in [("cpu", "Software Rendering", false), ("gpu", "GPU Acceleration", true)] {
+        let reported = s.execute("render.backend", json!({"backend": backend})).unwrap()["renderer"].clone();
+        assert_eq!(reported, json!(label));
+        let parsed = effectcraft_render::Backend::parse(reported.as_str().unwrap()).expect("the reported renderer parses back");
+        assert_eq!(parsed == effectcraft_render::Backend::Cpu, !gpu, "{reported}");
+        let again = s.execute("render.backend", json!({"backend": reported})).unwrap();
+        assert_eq!(again["renderer"], reported);
+        assert_eq!(again["gpuAcceleration"], json!(gpu));
+    }
 }
 
 /// Settings ▸ GPU Information names what the GPU compositor runs on, or why it is off, and the
diff --git a/crates/engine/src/tests/shared_layers.rs b/crates/engine/src/tests/shared_layers.rs
new file mode 100644
index 000000000..275fdd624
--- /dev/null
+++ b/crates/engine/src/tests/shared_layers.rs
@@ -0,0 +1,42 @@
+//! An edit copies only the layer it changes: the others stay shared with the undo state, so an
+//! edit's cost doesn't grow with the size of the comp (scripts setting many keys went quadratic).
+
+use std::sync::Arc;
+
+use serde_json::json;
+
+use crate::Session;
+
+#[test]
+fn a_key_on_one_layer_leaves_the_other_layers_shared_with_undo() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Big", "duration": 10, "frameRate": 30})).unwrap();
+    let ids: Vec<u64> = (0..20).map(|i| s.execute("layer.newNull", json!({"name": format!("N{i}")})).unwrap()["layer"].as_u64().unwrap()).collect();
+    let cid = s.active_comp_id().unwrap();
+    let before = s.project.clone();
+    s.execute("prop.addKey", json!({"layer": ids[7], "path": "transform/position", "time": 1.0, "value": [5, 5]})).unwrap();
+    let (old, new) = (before.comp(cid).unwrap(), s.project.comp(cid).unwrap());
+    assert_eq!(old.layers.len(), new.layers.len());
+    let edited = new.layers.iter().position(|l| l.id.0 == ids[7]).unwrap();
+    for i in 0..new.layers.len() {
+        assert_eq!(new.layers.same_at(&old.layers, i), i != edited, "layer {i} shared: {}", new.layers.same_at(&old.layers, i));
+    }
+    // Undo brings back the very same state, and the edited layer is the only one that differed.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(Arc::ptr_eq(&s.project, &before));
+}
+
+#[test]
+fn layers_save_and_load_as_a_plain_list() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Round trip", "duration": 5, "frameRate": 25})).unwrap();
+    for i in 0..3 {
+        s.execute("layer.newNull", json!({"name": format!("N{i}")})).unwrap();
+    }
+    let cid = s.active_comp_id().unwrap();
+    let comp = s.project.comp(cid).unwrap();
+    let text = serde_json::to_value(&comp.layers).unwrap();
+    assert_eq!(text.as_array().map(Vec::len), Some(3), "a JSON array of layers, as before");
+    let back: effectcraft_project::Layers = serde_json::from_value(text).unwrap();
+    assert_eq!(&back, &comp.layers);
+}
diff --git a/crates/engine/src/tests_shortcut_cmds.rs b/crates/engine/src/tests/shortcut_cmds.rs
similarity index 88%
rename from crates/engine/src/tests_shortcut_cmds.rs
rename to crates/engine/src/tests/shortcut_cmds.rs
index dd306ef93..c11885db1 100644
--- a/crates/engine/src/tests_shortcut_cmds.rs
+++ b/crates/engine/src/tests/shortcut_cmds.rs
@@ -184,6 +184,28 @@ fn in_and_out_points_stretch_to_the_current_time() {
     assert!(s.execute("layer.timeStretch", json!({"to": "middle"})).is_err());
 }
 
+#[test]
+fn trimming_out_to_the_playhead_keeps_its_frame_visible() {
+    let (mut s, ids) = session([(1.0, 9.0); 3]);
+    let frame = 1.0 / 30.0;
+    // Alt+] at 4 s: the Out edge lands one frame after the playhead, so 4 s is the layer's last
+    // visible frame — it must not be cut away at the playhead (as in After Effects).
+    s.execute("time.set", json!({"time": 4.0})).unwrap();
+    s.execute("layer.timing", json!({"layers": [ids[0]], "op": "trimOutToTime"})).unwrap();
+    assert!((span(&s, ids[0]).1 - (4.0 + frame)).abs() < 1e-9, "{:?}", span(&s, ids[0]));
+    // Alt+[ at 2 s: the playhead's frame becomes the layer's first visible one.
+    s.execute("time.set", json!({"time": 2.0})).unwrap();
+    s.execute("layer.timing", json!({"layers": [ids[1]], "op": "trimInToTime"})).unwrap();
+    assert!((span(&s, ids[1]).0 - 2.0).abs() < 1e-9, "{:?}", span(&s, ids[1]));
+    // Trimmed before the In point, the Out point keeps one frame of layer.
+    s.execute("time.set", json!({"time": 0.5})).unwrap();
+    s.execute("layer.timing", json!({"layers": [ids[2]], "op": "trimOutToTime"})).unwrap();
+    assert!((span(&s, ids[2]).1 - (1.0 + frame)).abs() < 1e-9, "{:?}", span(&s, ids[2]));
+    // One undo step back to the original span.
+    assert!(s.undo());
+    assert!((span(&s, ids[2]).1 - 9.0).abs() < 1e-9);
+}
+
 #[test]
 fn masks_are_stepped_through_and_wrap() {
     let (mut s, ids) = session([(0.0, 10.0); 3]);
diff --git a/crates/engine/src/tests_stubs.rs b/crates/engine/src/tests/stubs.rs
similarity index 75%
rename from crates/engine/src/tests_stubs.rs
rename to crates/engine/src/tests/stubs.rs
index 84321ee7e..6f89f4f62 100644
--- a/crates/engine/src/tests_stubs.rs
+++ b/crates/engine/src/tests/stubs.rs
@@ -519,9 +519,10 @@ fn convert_to_bezier_turns_a_parametric_shape_into_an_editable_path() {
     };
     let radius = |v: [f64; 2]| v[0].hypot(v[1]);
 
-    // A 120 x 80 rectangle is its four corners, joined by straight edges.
+    // A 120 x 80 rectangle is its four corners, joined by straight edges, from the top-right
+    // corner clockwise as After Effects draws it.
     let (mut s, l, was, rect) = convert(json!({"kind": "rect", "size": [120, 80]}));
-    assert_eq!(rect.vertices, vec![[-60.0, -40.0], [60.0, -40.0], [60.0, 40.0], [-60.0, 40.0]]);
+    assert_eq!(rect.vertices, vec![[60.0, -40.0], [60.0, 40.0], [-60.0, 40.0], [-60.0, -40.0]]);
     assert!(rect.in_tangents.iter().chain(&rect.out_tangents).all(|t| *t == [0.0, 0.0]), "straight edges: {rect:?}");
     // Undo brings the parametric shape back.
     s.execute("edit.undo", json!({})).unwrap();
@@ -583,3 +584,192 @@ fn convert_to_bezier_reads_the_shape_as_it_is_set() {
     let mid = |v: &[f64]| (v.iter().copied().fold(f64::MAX, f64::min) + v.iter().copied().fold(f64::MIN, f64::max)) / 2.0;
     assert!((mid(&xs) - 10.0).abs() < 1e-6 && (mid(&ys) - 5.0).abs() < 1e-6, "centred on the position: {:?} {:?}", mid(&xs), mid(&ys));
 }
+
+/// #1896: Convert To Bezier Path reads Per-Corner Roundness, not just the uniform Roundness, so
+/// the editable path is the shape that was on screen.
+#[test]
+fn convert_to_bezier_honours_per_corner_roundness() {
+    let mut s = comp();
+    let l = s.execute("layer.newShape", json!({"kind": "rect", "size": [120, 80]})).unwrap()["layer"].as_u64().unwrap();
+    let (uid, _) = first_shape(&s, l);
+    let uid_of = |s: &Session, id: &str| layer(s, l).props.sub("contents").unwrap().find_group(uid).unwrap().get(id).unwrap().uid;
+    let per_corner = uid_of(&s, "perCorner");
+    let top_left = uid_of(&s, "topLeftRoundness");
+    let bottom_right = uid_of(&s, "bottomRightRoundness");
+    for (u, v) in [(per_corner, json!(true)), (top_left, json!(20.0)), (bottom_right, json!(10.0))] {
+        s.execute("prop.set", json!({"layer": l, "path": format!("@{u}"), "value": v})).unwrap();
+    }
+
+    s.state.selected_props = vec![(LayerId(l), uid)];
+    s.execute("path.convertToBezier", json!({})).unwrap();
+    let (new_uid, now) = first_shape(&s, l);
+    assert_eq!(now, "path");
+    let path = shape_path_of(&s, l, new_uid);
+    let expected = effectcraft_path::from_kurbo(&effectcraft_path::rect_radii([120.0, 80.0], [0.0, 0.0], [20.0, 0.0, 10.0, 0.0])).into_iter().next().unwrap();
+    assert_eq!(path, expected, "the converted path has the per-corner geometry");
+}
+
+/// #1896: Convert To Bezier Path evaluates the shape's expressions, so an expression-driven
+/// Per-Corner checkbox and radius convert to the geometry on screen.
+#[test]
+fn convert_to_bezier_evaluates_corner_expressions() {
+    struct Corners;
+    impl effectcraft_render::ExprHost for Corners {
+        fn eval(
+            &self,
+            _: &effectcraft_render::EvalCtx,
+            _: &effectcraft_project::Layer,
+            prop: &effectcraft_project::Property,
+            value: &KV,
+        ) -> std::result::Result<KV, String> {
+            Ok(match prop.match_id.as_str() {
+                "perCorner" => KV::Bool(true),
+                "topLeftRoundness" => KV::Scalar(20.0),
+                _ => value.clone(),
+            })
+        }
+    }
+
+    let mut s = comp();
+    s.expr = Some(Arc::new(Corners));
+    let l = s.execute("layer.newShape", json!({"kind": "rect", "size": [120, 80]})).unwrap()["layer"].as_u64().unwrap();
+    let (uid, _) = first_shape(&s, l);
+    let uid_of = |s: &Session, id: &str| layer(s, l).props.sub("contents").unwrap().find_group(uid).unwrap().get(id).unwrap().uid;
+    for (id, expression) in [("perCorner", "true"), ("topLeftRoundness", "20")] {
+        let u = uid_of(&s, id);
+        s.execute("prop.setExpression", json!({"layer": l, "path": format!("@{u}"), "expression": expression})).unwrap();
+    }
+
+    s.state.selected_props = vec![(LayerId(l), uid)];
+    s.execute("path.convertToBezier", json!({})).unwrap();
+    let (new_uid, now) = first_shape(&s, l);
+    assert_eq!(now, "path");
+    let path = shape_path_of(&s, l, new_uid);
+    let expected = effectcraft_path::from_kurbo(&effectcraft_path::rect_radii([120.0, 80.0], [0.0, 0.0], [20.0, 0.0, 0.0, 0.0])).into_iter().next().unwrap();
+    assert_eq!(path, expected, "the expression-evaluated corner is converted");
+}
+
+/// #2201: a viewer drag on the free-transform box sends one `path.freeTransform` per frame with a
+/// shared merge key; one undo must revert the whole drag, not the last frame.
+#[test]
+fn free_transform_drag_undoes_in_one_step() {
+    let mut s = comp();
+    let (l, m) = masked(&mut s);
+    s.state.selected_vertices.clear();
+    let before = mask_path(&s, l, m);
+    for k in [90, 90, 90, 90] {
+        s.execute("path.freeTransform", json!({"layer": l, "scale": k, "merge": "viewer-drag-1"})).unwrap();
+    }
+    let after = mask_path(&s, l, m);
+    assert_ne!(after, before);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(mask_path(&s, l, m), before, "one undo reverts the whole drag");
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(mask_path(&s, l, m), after, "redo restores the whole drag");
+}
+
+fn bounds(p: &effectcraft_keyframe::ShapePath) -> ([f64; 2], [f64; 2]) {
+    let lo = p.vertices.iter().fold([f64::MAX; 2], |a, v| [a[0].min(v[0]), a[1].min(v[1])]);
+    let hi = p.vertices.iter().fold([f64::MIN; 2], |a, v| [a[0].max(v[0]), a[1].max(v[1])]);
+    (lo, hi)
+}
+
+#[test]
+fn rounded_mask_roundness_is_set_on_creation_and_editable() {
+    let mut s = comp();
+    let l = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 400, "height": 300})).unwrap()["layer"].as_u64().unwrap();
+    // A 20 px radius by default; an explicit radius moves the first vertex.
+    let m = s.execute("layer.addMask", json!({"layer": l, "shape": "rounded", "rect": [100, 100, 200, 100]})).unwrap()["mask"].as_u64().unwrap();
+    let default = mask_path(&s, l, m);
+    assert_eq!(default.vertices[0], [300.0, 120.0]);
+    let m2 =
+        s.execute("layer.addMask", json!({"layer": l, "shape": "rounded", "rect": [100, 100, 200, 100], "roundness": 30})).unwrap()["mask"].as_u64().unwrap();
+    assert_eq!(mask_path(&s, l, m2).vertices[0], [300.0, 130.0]);
+    assert!(s.execute("layer.addMask", json!({"layer": l, "shape": "ellipse", "roundness": 5})).is_err());
+    assert!(s.execute("layer.addMask", json!({"layer": l, "shape": "rounded", "roundness": -1})).is_err());
+    // Edit it afterwards: same box, new radius; 0 is a plain rectangle; undo restores.
+    s.execute("mask.setRoundness", json!({"layer": l, "mask": m, "roundness": 50})).unwrap();
+    let p = mask_path(&s, l, m);
+    assert_eq!(p.vertices[0], [300.0, 150.0]);
+    assert_eq!(bounds(&p), ([100.0, 100.0], [300.0, 200.0]));
+    s.execute("mask.setRoundness", json!({"layer": l, "mask": m, "roundness": 0})).unwrap();
+    let p = mask_path(&s, l, m);
+    assert_eq!(p.vertices.len(), 4);
+    assert_eq!(bounds(&p), ([100.0, 100.0], [300.0, 200.0]));
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(mask_path(&s, l, m).vertices[0], [300.0, 150.0]);
+}
+
+#[test]
+fn set_roundness_refuses_what_is_not_a_rectangle() {
+    let mut s = comp();
+    let l = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 400, "height": 300})).unwrap()["layer"].as_u64().unwrap();
+    let star = s.execute("layer.addMask", json!({"layer": l, "shape": "star"})).unwrap()["mask"].as_u64().unwrap();
+    let before = mask_path(&s, l, star);
+    assert!(s.execute("mask.setRoundness", json!({"layer": l, "mask": star, "roundness": 10})).is_err());
+    assert_eq!(mask_path(&s, l, star), before, "a refused edit leaves the mask alone");
+    assert!(s.execute("mask.setRoundness", json!({"layer": l, "mask": star})).is_err(), "needs a roundness");
+    // A diamond inscribed in its box touches every edge but is not a rectangle.
+    s.execute("mask.new", json!({"layer": l, "vertices": [[150, 100], [200, 150], [150, 200], [100, 150]], "closed": true})).unwrap();
+    let diamond = layer(&s, l).masks().unwrap().groups().last().unwrap().uid;
+    assert!(s.execute("mask.setRoundness", json!({"layer": l, "mask": diamond, "roundness": 10})).is_err());
+    assert_eq!(mask_path(&s, l, diamond).vertices.len(), 4);
+    // "roundness": null is unset, and an unknown shape is reported as such.
+    s.execute("layer.addMask", json!({"layer": l, "shape": "rounded", "roundness": null})).unwrap();
+    let e = s.execute("layer.addMask", json!({"layer": l, "shape": "foo", "roundness": 5})).unwrap_err().to_string();
+    assert!(e.contains("unknown shape"), "{e}");
+}
+
+#[test]
+fn set_roundness_refuses_an_ellipse_and_keeps_feather_points_and_keys_in_step() {
+    let mut s = comp();
+    let l = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 400, "height": 300})).unwrap()["layer"].as_u64().unwrap();
+    let add = |s: &mut Session, shape: &str, rect: [u32; 4], extra: serde_json::Value| {
+        let mut p = json!({"layer": l, "shape": shape, "rect": rect});
+        if let (Some(p), Some(e)) = (p.as_object_mut(), extra.as_object()) {
+            p.extend(e.clone());
+        }
+        s.execute("layer.addMask", p).unwrap()["mask"].as_u64().unwrap()
+    };
+    // An ellipse (or a circle) has its four vertices on its box's edges and curved sides, but it
+    // is not a rectangle: refused, unchanged.
+    for rect in [[100, 100, 200, 100], [100, 100, 100, 100]] {
+        let e = add(&mut s, "ellipse", rect, json!({}));
+        let before = mask_path(&s, l, e);
+        assert!(s.execute("mask.setRoundness", json!({"layer": l, "mask": e, "roundness": 10})).is_err(), "{rect:?}");
+        assert_eq!(mask_path(&s, l, e), before);
+    }
+    // A feather point on the top side survives a rounded-to-rounded edit, still on the top side.
+    let m = add(&mut s, "rounded", [100, 100, 200, 100], json!({"roundness": 30}));
+    s.execute("mask.featherPoint.add", json!({"layer": l, "mask": m, "point": [200, 90]})).unwrap();
+    let on_top = |p: &effectcraft_keyframe::ShapePath| {
+        let f = &p.feather[0];
+        let n = p.vertices.len();
+        p.vertices[f.segment % n][1] == 100.0 && p.vertices[(f.segment + 1) % n][1] == 100.0
+    };
+    assert!(on_top(&mask_path(&s, l, m)));
+    s.execute("mask.setRoundness", json!({"layer": l, "mask": m, "roundness": 50})).unwrap();
+    let p = mask_path(&s, l, m);
+    assert_eq!((p.vertices.len(), p.feather.len()), (8, 1));
+    assert!(on_top(&p), "{p:?}");
+    // Square corners would drop four vertices under the feather point: refused.
+    assert!(s.execute("mask.setRoundness", json!({"layer": l, "mask": m, "roundness": 0})).is_err());
+    assert_eq!(mask_path(&s, l, m), p);
+    // A keyed path: a rounded one is re-rounded with its vertex count kept, so its keys still
+    // interpolate; a square one can't gain the corner vertices on one key only.
+    let keys = |s: &Session, m: u64| -> Vec<usize> {
+        let g = layer(s, l).masks().unwrap().find_group(m).unwrap().clone();
+        g.get("path").unwrap().keys.iter().map(|k| k.value.as_path().unwrap().vertices.len()).collect()
+    };
+    let r = add(&mut s, "rounded", [100, 100, 200, 100], json!({"roundness": 20}));
+    let q = add(&mut s, "rect", [100, 100, 200, 100], json!({}));
+    for (i, mask) in [(4, r), (5, q)] {
+        s.execute("time.set", json!({"time": 0})).unwrap();
+        s.execute("prop.addKey", json!({"layer": l, "path": format!("masks/#{i}/path"), "time": 0.0})).unwrap();
+        s.execute("time.set", json!({"time": 1})).unwrap();
+        let ok = s.execute("mask.setRoundness", json!({"layer": l, "mask": mask, "roundness": 40})).is_ok();
+        assert_eq!(ok, mask == r);
+    }
+    assert_eq!(keys(&s, r), [8, 8]);
+    assert_eq!(keys(&s, q), [4]);
+}
diff --git a/crates/engine/src/tests_styles.rs b/crates/engine/src/tests/styles.rs
similarity index 66%
rename from crates/engine/src/tests_styles.rs
rename to crates/engine/src/tests/styles.rs
index e589241fb..1aef9e825 100644
--- a/crates/engine/src/tests_styles.rs
+++ b/crates/engine/src/tests/styles.rs
@@ -117,3 +117,51 @@ fn styles_render_and_round_trip() {
     assert_eq!(back, *s.project);
     assert_eq!(back.comp(cid).unwrap().global_light.angle.value.as_f64(), 33.0);
 }
+
+/// #1389: Blending Options on a layer with no styles. `layer.style.add` with `blendingOptions`
+/// creates the Layer Styles group with Blending Options only; with the same merge key as the
+/// value set right after it, both are one undo step, and undoing it leaves no group behind.
+#[test]
+fn blending_options_alone_create_the_group_in_one_undo_step() {
+    let (mut s, a, b) = session();
+    let undo = s.history.undo.len();
+    let r = s.execute("layer.style.add", json!({"layers": [a], "style": "blendingOptions", "merge": "bo"})).unwrap();
+    assert_eq!(r["styles"][0]["style"], "blendingOptions", "{r}");
+    let layer = s.active_comp().unwrap().layer(effectcraft_project::LayerId(a)).unwrap().clone();
+    let g = layer.layer_styles().expect("the group is created");
+    assert!(g.sub("blendingOptions").is_some());
+    assert!(styles_of(&s, a).is_empty(), "no style is added with it");
+    s.execute("prop.set", json!({"layer": a, "path": "layerStyles/blendingOptions/advancedBlending/fillOpacity", "value": 40, "merge": "bo"})).unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "layerStyles/blendingOptions/advancedBlending/fillOpacity", "value": 30, "merge": "bo"})).unwrap();
+    assert_eq!(s.history.undo.len(), undo + 1, "creating the group and setting the value are one step");
+    // The other layer is untouched, and Global Light is the comp's.
+    assert!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(b)).unwrap().layer_styles().is_none());
+    let gl = s.execute("prop.get", json!({"layer": a, "path": "layerStyles/blendingOptions/globalLightAngle"})).unwrap();
+    assert!(gl.to_string().contains("120"), "{gl}");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(a)).unwrap().layer_styles().is_none(), "one undo removes the group");
+    // By display name too.
+    s.execute("layer.style.add", json!({"layers": [a], "style": "Blending Options"})).unwrap();
+    assert!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(a)).unwrap().layer_styles().is_some());
+}
+
+/// Removing the last style keeps a Layer Styles group whose Blending Options were changed (a
+/// group with Blending Options only is a state of its own since #1389); at their defaults the
+/// group goes, as before.
+#[test]
+fn removing_the_last_style_keeps_changed_blending_options() {
+    let (mut s, a, b) = session();
+    let fill = "layerStyles/blendingOptions/advancedBlending/fillOpacity";
+    s.execute("layer.style.add", json!({"layers": [a], "style": "blendingOptions"})).unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": fill, "value": 40})).unwrap();
+    s.execute("layer.style.dropShadow", json!({"layers": [a]})).unwrap();
+    s.execute("layer.style.remove", json!({"layer": a, "style": "dropShadow"})).unwrap();
+    let v = s.execute("prop.get", json!({"layer": a, "path": fill})).unwrap();
+    assert_eq!(v["value"].as_f64(), Some(40.0), "{v}");
+    assert!(styles_of(&s, a).is_empty());
+    // At the defaults (here on the other layer, through the same command) the group goes.
+    s.execute("layer.style.add", json!({"layers": [b], "style": "blendingOptions"})).unwrap();
+    s.execute("layer.style.dropShadow", json!({"layers": [b]})).unwrap();
+    s.execute("layer.style.remove", json!({"layer": b, "style": "dropShadow"})).unwrap();
+    assert!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(b)).unwrap().layer_styles().is_none());
+}
diff --git a/crates/engine/src/tests_tail.rs b/crates/engine/src/tests/tail.rs
similarity index 83%
rename from crates/engine/src/tests_tail.rs
rename to crates/engine/src/tests/tail.rs
index 2710365eb..90cfd1bfc 100644
--- a/crates/engine/src/tests_tail.rs
+++ b/crates/engine/src/tests/tail.rs
@@ -421,6 +421,70 @@ fn camera_focus_commands_undo_and_serde() {
     assert!(s.execute("camera.linkFocusToPoi", json!({})).is_ok());
 }
 
+/// Set Focus Distance to Layer: degenerate targets (behind the camera, exactly at it) are clean
+/// errors, and a depth-of-field frame renders right after the command.
+#[test]
+fn camera_set_focus_to_layer_degenerate_targets_and_dof_frame() {
+    let mut s = comp(400, 300);
+    let t = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 50, "height": 50})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [t], "switch": "threeD", "value": true})).unwrap();
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/position", "value": [200, 150, -500]})).unwrap();
+    s.execute("prop.set", json!({"layer": cam, "path": "cameraOptions/dof", "value": true})).unwrap();
+    s.execute("layer.select", json!({"layers": [cam, t]})).unwrap();
+    // Behind the camera (which now sits at z = −500 looking towards +z).
+    s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [200, 150, -1000]})).unwrap();
+    let e = s.execute("camera.setFocusToLayer", json!({})).unwrap_err().to_string();
+    assert!(e.contains("behind the camera"), "{e}");
+    // Exactly at the camera: depth 0, still a clean error.
+    s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [200, 150, -500]})).unwrap();
+    assert!(s.execute("camera.setFocusToLayer", json!({})).is_err());
+    // In front: the command works, and the depth-of-field frame renders with finite pixels.
+    s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [200, 150, 400]})).unwrap();
+    let d = s.execute("camera.setFocusToLayer", json!({})).unwrap()["focusDistance"].as_f64().unwrap();
+    assert!((d - 900.0).abs() < 1e-6, "{d}");
+    // An out-of-focus 3D layer, which must visibly blur, and a 0%-scaled one, whose pixels cover
+    // ~0 screen pixels and so turn an ordinary defocus into a radius of ~1e9 buffer pixels.
+    s.execute("prop.set", json!({"layer": cam, "path": "cameraOptions/aperture", "value": 120})).unwrap();
+    let blur = s.execute("layer.newSolid", json!({"color": "#00ff00", "width": 60, "height": 60})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [blur], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setTransform", json!({"layer": blur, "prop": "position", "value": [200, 150, 1200]})).unwrap();
+    let invis = s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 40, "height": 40})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [invis], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setTransform", json!({"layer": invis, "prop": "position", "value": [200, 150, 1600]})).unwrap();
+    s.execute("layer.setTransform", json!({"layer": invis, "prop": "scale", "value": [0.0, 0.0, 0.0]})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let img = s.render(cid, effectcraft_time::Tick::ZERO, Default::default());
+    assert!(img.data.iter().all(|p| p.iter().all(|c| c.is_finite())), "non-finite pixels after setFocusToLayer");
+    // The DoF frame actually blurred (not a no-op blur): the same frame with DoF off differs.
+    s.execute("prop.set", json!({"layer": cam, "path": "cameraOptions/dof", "value": false})).unwrap();
+    let plain = s.render(cid, effectcraft_time::Tick::ZERO, Default::default());
+    assert_ne!(img.data, plain.data, "the out-of-focus layer should have blurred");
+}
+
+/// Set Focus Distance to Layer fails cleanly on a depth that isn't finite. Every stored number
+/// here is finite, but their difference overflows f64 to infinity; JSON has no infinity, so
+/// storing it would leave a project that can't be saved.
+#[test]
+fn camera_set_focus_to_layer_rejects_non_finite_depth() {
+    let mut s = comp(400, 300);
+    let t = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 50, "height": 50})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [t], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [200.0, 150.0, 1e308]})).unwrap();
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setTransform", json!({"layer": cam, "prop": "position", "value": [200.0, 150.0, -1e308]})).unwrap();
+    s.execute("layer.select", json!({"layers": [cam, t]})).unwrap();
+    let before = s.execute("prop.get", json!({"layer": cam, "path": "cameraOptions/focusDistance"})).unwrap()["value"].as_f64().unwrap();
+    let e = s.execute("camera.setFocusToLayer", json!({})).unwrap_err().to_string();
+    assert!(e.contains("out of range"), "{e}");
+    let after = s.execute("prop.get", json!({"layer": cam, "path": "cameraOptions/focusDistance"})).unwrap()["value"].as_f64().unwrap();
+    assert!((after - before).abs() < 1e-9, "a non-finite focus distance was written: {after}");
+    // The project still round-trips through serde (a stored infinity would come back as null).
+    let back = roundtrip(&s);
+    let f = back.comp(s.active_comp_id().unwrap()).unwrap().layer(LayerId(cam)).unwrap().props.prop("cameraOptions/focusDistance").unwrap().value.as_f64();
+    assert!((f - before).abs() < 1e-9, "serde focus distance: {f}");
+}
+
 /// An id sent as a string (`"98"`, as MCP clients often do) resolves as an id when no name matches.
 #[test]
 fn numeric_string_resolves_as_id() {
diff --git a/crates/engine/src/tests_text.rs b/crates/engine/src/tests/text.rs
similarity index 86%
rename from crates/engine/src/tests_text.rs
rename to crates/engine/src/tests/text.rs
index 84f88fd33..d24a09240 100644
--- a/crates/engine/src/tests_text.rs
+++ b/crates/engine/src/tests/text.rs
@@ -49,6 +49,38 @@ fn animate_text_adds_animators_with_companion_properties() {
     let _ = s.render(cid, s.time(), Default::default());
 }
 
+/// `animator` counts from 1, as `#n` references do, and a uid match wins over an index: every
+/// command that takes it says so, and 0 fails with an error that says so (agents reading
+/// `uid|index` tried 0).
+#[test]
+fn animator_indices_count_from_1_and_say_so() {
+    let (mut s, t) = session();
+    let uid = s.execute("layer.addTextAnimator", json!({"layer": t, "property": "position"})).unwrap()["animator"].as_u64().unwrap();
+    for id in ["layer.addTextAnimatorProperty", "layer.addTextSelector", "text.addSelector", "text.animatorFontAxes"] {
+        let spec = crate::cmd::command_specs().iter().find(|c| c.id == id).unwrap();
+        assert!(spec.params.contains("animator?: uid|index (1-based; a uid match wins over an index)"), "{id}: {}", spec.params);
+    }
+    for (id, p) in [
+        ("layer.addTextAnimatorProperty", json!({"layer": t, "animator": 0, "property": "fillHue"})),
+        ("layer.addTextSelector", json!({"layer": t, "animator": 0, "kind": "wiggly"})),
+    ] {
+        let e = s.execute(id, p).unwrap_err().to_string();
+        assert!(e.contains("no animator 0") && e.contains("1-based"), "{id}: {e}");
+    }
+    let r = s.execute("layer.addTextSelector", json!({"layer": t, "animator": 1, "kind": "wiggly"})).unwrap();
+    assert_eq!(r["animator"].as_u64(), Some(uid));
+    // A second animator whose uid is 1: `animator: 1` is that uid, not the first animator, and
+    // index 2 reaches the same animator.
+    s.execute("layer.addTextAnimator", json!({"layer": t, "property": "opacity"})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let layer = std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(LayerId(t)).unwrap();
+    layer.props.group_mut("text/animators").unwrap().children[1].as_group_mut().unwrap().uid = 1;
+    for (id, animator) in [("layer.addTextSelector", 1), ("text.addSelector", 1), ("layer.addTextSelector", 2)] {
+        let r = s.execute(id, json!({"layer": t, "animator": animator, "kind": "wiggly"})).unwrap();
+        assert_eq!(r["animator"].as_u64(), Some(1), "{id} animator {animator}: {r}");
+    }
+}
+
 #[test]
 fn add_property_and_selectors_with_undo_redo() {
     let (mut s, t) = session();
@@ -198,7 +230,7 @@ fn cached_text_presets_keep_the_catalog_and_application_independent() {
 #[ignore = "warm text-preset listing benchmark"]
 fn text_preset_listing_benchmark() {
     let old = || {
-        let v: serde_json::Value = serde_json::from_str(include_str!("../presets/text_animators.json")).unwrap();
+        let v: serde_json::Value = serde_json::from_str(include_str!("../../presets/text_animators.json")).unwrap();
         let presets = v["presets"].as_array().unwrap().clone();
         presets.iter().map(|p| (p["id"].as_str().unwrap().to_string(), p["name"].as_str().unwrap().to_string())).collect::<Vec<_>>()
     };
diff --git a/crates/engine/src/tests/text_edit.rs b/crates/engine/src/tests/text_edit.rs
new file mode 100644
index 000000000..db8d4679a
--- /dev/null
+++ b/crates/engine/src/tests/text_edit.rs
@@ -0,0 +1,1523 @@
+//! On-canvas text editing and per-character styles through commands: run-scoped
+//! `layer.setText`, text.insert / delete / setSelection / moveCaret, the text clipboard and the
+//! paste-formatting commands, with undo / redo.
+
+use effectcraft_keyframe::{BaselineOption, Justify, Kerning, TextDoc};
+use serde_json::json;
+
+use crate::Session;
+use crate::commands::text_edit::{MAX_IME_TEXT_BYTES, ime_stamp_revision, ime_surrounding, layer_doc};
+use crate::tests::three_d::layer_count;
+
+fn session(text: &str) -> (Session, u64) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 640, "height": 360, "duration": 4})).unwrap();
+    let t = s.execute("layer.newText", json!({"text": text, "size": 60, "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    (s, t)
+}
+
+fn doc(s: &Session, t: u64) -> TextDoc {
+    layer_doc(s, effectcraft_project::LayerId(t)).unwrap()
+}
+
+fn sel(s: &Session) -> (usize, usize) {
+    let e = s.state.text_edit.as_ref().unwrap();
+    (e.anchor, e.caret)
+}
+
+/// Start editing the text layer with everything selected (no caret given).
+fn begin_edit(s: &mut Session, t: u64) {
+    s.execute("text.edit", json!({"layer": t})).unwrap();
+}
+
+/// Start editing the text layer with the caret at `caret`.
+fn begin_edit_at(s: &mut Session, t: u64, caret: usize) {
+    s.execute("text.edit", json!({"layer": t, "caret": caret})).unwrap();
+}
+
+/// A session with one text layer already open in the editor at `caret`.
+fn editing(text: &str, caret: usize) -> (Session, u64) {
+    let (mut s, t) = session(text);
+    begin_edit_at(&mut s, t, caret);
+    (s, t)
+}
+
+/// A session with one text layer already open in the editor with everything selected.
+fn editing_all(text: &str) -> (Session, u64) {
+    let (mut s, t) = session(text);
+    begin_edit(&mut s, t);
+    (s, t)
+}
+
+/// The IME owner token of the open editor.
+fn ime_owner(s: &Session) -> u64 {
+    s.state.text_edit.as_ref().unwrap().session
+}
+
+fn undo_steps(s: &Session) -> usize {
+    s.history.undo.len()
+}
+
+/// The editor kept its document (same IME owner).
+fn assert_ime_owner(s: &Session, expected: u64, why: &str) {
+    assert_eq!(ime_owner(s), expected, "{why}");
+}
+
+/// The editor's document was replaced (new IME owner/epoch).
+fn assert_ime_epoch_changed(s: &Session, previous: u64, why: &str) {
+    assert_ne!(ime_owner(s), previous, "{why}");
+}
+
+fn assert_text(s: &Session, t: u64, expected: &str) {
+    assert_eq!(doc(s, t).text, expected);
+}
+
+/// A new, empty composition called "Other" (the standard second comp).
+fn new_other_comp(s: &mut Session) -> u64 {
+    s.execute("comp.new", json!({"name": "Other", "width": 320, "height": 180, "duration": 2})).unwrap()["comp"].as_u64().unwrap()
+}
+
+/// Stopwatch the layer's Source Text (one key at the CTI).
+fn animate_source(s: &mut Session, t: u64) {
+    s.execute("prop.toggleAnimation", json!({"layer": t, "path": "text/sourceText"})).unwrap();
+}
+
+/// Add a Source Text key at `time`.
+fn add_source_key(s: &mut Session, t: u64, time: f64, value: &str) {
+    s.execute("prop.addKey", json!({"layer": t, "path": "text/sourceText", "time": time, "value": value})).unwrap();
+}
+
+/// Write Source Text as a static value (a replacement when it differs from the shown text).
+fn set_source(s: &mut Session, t: u64, value: &str) {
+    s.execute("prop.set", json!({"layer": t, "path": "text/sourceText", "value": value})).unwrap();
+}
+
+/// Write the Source Text key at `time`.
+fn set_source_key(s: &mut Session, t: u64, time: f64, value: &str) {
+    s.execute("prop.set", json!({"layer": t, "path": "text/sourceText", "time": time, "value": value})).unwrap();
+}
+
+/// Set the Source Text key at the CTI (`keys.set`).
+fn set_source_cti_key(s: &mut Session, t: u64, time: f64, value: &str) {
+    s.execute("keys.set", json!({"layer": t, "path": "text/sourceText", "time": time, "value": value})).unwrap();
+}
+
+/// Replace the whole Source Text of the layer (`layer.setText`).
+fn replace_text(s: &mut Session, t: u64, text: &str) {
+    s.execute("layer.setText", json!({"layer": t, "text": text})).unwrap();
+}
+
+/// Select the character range `start..end` in the open editor.
+fn select(s: &mut Session, start: usize, end: usize) {
+    s.execute("text.setSelection", json!({"start": start, "end": end})).unwrap();
+}
+
+/// Set both selection ends, keeping their direction (`anchor` is the other end).
+fn select_anchor(s: &mut Session, anchor: usize, caret: usize) {
+    s.execute("text.setSelection", json!({"anchor": anchor, "caret": caret})).unwrap();
+}
+
+#[test]
+fn set_text_with_a_range_creates_runs_and_undoes() {
+    let (mut s, t) = session("Hello World");
+    s.execute("layer.setText", json!({"layer": t, "range": [6, 11], "size": 30, "fill": "#ff0000", "kerning": "optical"})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!(d.runs().len(), 2);
+    assert_eq!(d.style_at(0).size, 60.0);
+    assert_eq!(d.style_at(7).size, 30.0);
+    assert_eq!(d.style_at(7).fill, [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(d.style_at(7).kerning, Kerning::Optical);
+    // Paragraph attributes apply to the paragraphs the range touches; document ones to all.
+    s.execute("layer.setText", json!({"layer": t, "range": [0, 1], "justify": "justifyAll", "indentFirst": 20, "spaceAfter": 6, "direction": "rtl"})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!((d.justify, d.indent_first, d.space_after), (Justify::JustifyAll, 20.0, 6.0));
+    // Unknown attributes and bad values are errors (nothing changes).
+    assert!(s.execute("layer.setText", json!({"layer": t, "sizee": 3})).is_err());
+    assert!(s.execute("layer.setText", json!({"layer": t, "size": "big"})).is_err());
+    assert!(s.execute("edit.undo", json!({})).is_ok());
+    assert_eq!(doc(&s, t).justify, Justify::Left);
+    assert!(s.execute("edit.undo", json!({})).is_ok());
+    assert!(doc(&s, t).is_uniform());
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(doc(&s, t).runs().len(), 2);
+    // Without a range everything changes and the runs collapse again.
+    s.execute("layer.setText", json!({"layer": t, "size": 44, "superscript": true})).unwrap();
+    let d = doc(&s, t);
+    assert!(d.runs().iter().all(|r| r.style.size == 44.0 && r.style.baseline == BaselineOption::Superscript));
+    // Replacing a range's text keeps the formatting around it.
+    s.execute("layer.setText", json!({"layer": t, "range": [0, 5], "text": "Howdy", "fauxBold": true})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!(d.text, "Howdy World");
+    assert!(d.style_at(2).faux_bold && !d.style_at(7).faux_bold);
+}
+
+#[test]
+fn typing_deleting_and_caret_movement() {
+    let (mut s, t) = session("abc def");
+    s.execute("text.edit", json!({"layer": t})).unwrap();
+    assert_eq!(sel(&s), (0, 7), "editing starts with everything selected");
+    s.execute("text.setSelection", json!({"start": 3})).unwrap();
+    s.execute("text.insert", json!({"text": "XY", "merge": "typing-1"})).unwrap();
+    s.execute("text.insert", json!({"text": "Z", "merge": "typing-1"})).unwrap();
+    assert_eq!(doc(&s, t).text, "abcXYZ def");
+    assert_eq!(sel(&s), (6, 6));
+    // One undo step for the merged typing.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc(&s, t).text, "abc def");
+    assert_eq!(sel(&s), (6, 6));
+    s.execute("edit.redo", json!({})).unwrap();
+    s.execute("text.setSelection", json!({"start": 6})).unwrap();
+    // Backspace / Delete, by character and by word.
+    s.execute("text.delete", json!({})).unwrap();
+    assert_eq!(doc(&s, t).text, "abcXY def");
+    s.execute("text.delete", json!({"direction": "forward", "word": true})).unwrap();
+    assert_eq!(doc(&s, t).text, "abcXY");
+    s.execute("text.delete", json!({"word": true})).unwrap();
+    assert_eq!(doc(&s, t).text, "");
+    s.execute("text.insert", json!({"text": "one two\nthree"})).unwrap();
+    assert_eq!(sel(&s), (13, 13));
+    // Caret movement: words, lines, up / down, extend.
+    let mv = |s: &mut Session, to: &str, extend: bool| -> (usize, usize) {
+        let r = s.execute("text.moveCaret", json!({"to": to, "extend": extend})).unwrap();
+        (r["anchor"].as_u64().unwrap() as usize, r["caret"].as_u64().unwrap() as usize)
+    };
+    assert_eq!(mv(&mut s, "lineStart", false), (8, 8));
+    assert_eq!(mv(&mut s, "up", false).1, 0);
+    assert_eq!(mv(&mut s, "wordRight", false), (3, 3));
+    assert_eq!(mv(&mut s, "wordRight", true), (3, 7));
+    assert_eq!(mv(&mut s, "left", false), (3, 3), "left collapses a selection to its start");
+    assert_eq!(mv(&mut s, "lineEnd", false), (7, 7));
+    assert_eq!(mv(&mut s, "down", false).1, 13);
+    assert_eq!(mv(&mut s, "start", true), (13, 0));
+    assert_eq!(mv(&mut s, "paraEnd", false), (7, 7));
+    // Select All while editing selects the text, not the layers.
+    s.execute("edit.selectAll", json!({})).unwrap();
+    assert_eq!(sel(&s), (0, 13));
+    // Undo past the insertion clamps the selection.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(sel(&s).0 <= doc(&s, t).char_len() && sel(&s).1 <= doc(&s, t).char_len());
+    s.execute("text.endEdit", json!({})).unwrap();
+    assert!(s.state.text_edit.is_none());
+}
+
+/// Duplicating during a text edit moves the selection to the copy: the edit on the original ends
+/// (#2226), as in After Effects — typing must not keep editing an unselected layer.
+#[test]
+fn duplicate_during_a_text_edit_ends_the_edit() {
+    let (mut s, t) = session("Hello");
+    s.execute("text.edit", json!({"layer": t, "caret": 5})).unwrap();
+    let copy = s.execute("edit.duplicate", json!({"layers": [t]})).unwrap()[0].as_u64().unwrap();
+    assert_ne!(copy, t, "the duplicate is created");
+    assert_eq!(s.state.selected_layers, vec![effectcraft_project::LayerId(copy)], "the copy is selected");
+    assert!(s.state.text_edit.is_none(), "the edit ended with the selection move (#2226)");
+    assert_eq!(doc(&s, t).text, "Hello", "the original keeps its text");
+    assert_eq!(doc(&s, copy).text, "Hello", "and the copy carries it");
+}
+
+#[test]
+fn caret_style_applies_to_the_next_typed_text() {
+    let (mut s, t) = session("ab");
+    s.execute("text.edit", json!({"layer": t, "caret": 1})).unwrap();
+    s.execute("layer.setText", json!({"layer": t, "range": [1, 1], "size": 12, "fill": [0, 1, 0]})).unwrap();
+    assert!(doc(&s, t).is_uniform(), "a caret-only change doesn't touch the text");
+    s.execute("text.insert", json!({"text": "Q"})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!(d.text, "aQb");
+    assert_eq!(d.style_at(1).size, 12.0);
+    assert_eq!(d.style_at(1).fill, [0.0, 1.0, 0.0, 1.0]);
+    assert_eq!(d.style_at(2).size, 60.0);
+    // Typing again continues the new style (the character before the caret).
+    s.execute("text.insert", json!({"text": "R"})).unwrap();
+    assert_eq!(doc(&s, t).style_at(2).size, 12.0);
+}
+
+#[test]
+fn clipboard_and_paste_formatting() {
+    let (mut s, t) = session("red plain");
+    s.execute("layer.setText", json!({"layer": t, "range": [0, 3], "fill": "#ff0000", "size": 20})).unwrap();
+    s.execute("text.edit", json!({"layer": t, "select": [0, 3]})).unwrap();
+    let r = s.execute("edit.copy", json!({})).unwrap();
+    assert_eq!(r["text"], "red");
+    // Paste keeps the copied formatting.
+    s.execute("text.setSelection", json!({"start": 9})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!(d.text, "red plainred");
+    assert_eq!(d.style_at(10).fill, [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(sel(&s), (12, 12));
+    // Different text from the system clipboard pastes in the caret's style.
+    s.execute("text.setSelection", json!({"start": 4})).unwrap();
+    s.execute("edit.paste", json!({"text": "new "})).unwrap();
+    assert_eq!(doc(&s, t).text, "red new plainred");
+    assert_eq!(doc(&s, t).style_at(5).size, 60.0);
+    // Paste Text and Match Formatting: the copied text in the caret's style.
+    s.execute("text.setSelection", json!({"start": 8})).unwrap();
+    s.execute("edit.pasteTextMatchFormatting", json!({})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!(d.text, "red new redplainred");
+    assert_eq!(d.style_at(9).fill, [1.0; 4]);
+    // Paste Text Formatting Only onto a selection.
+    s.execute("text.setSelection", json!({"start": 11, "end": 16})).unwrap();
+    s.execute("edit.pasteTextFormattingOnly", json!({})).unwrap();
+    let d = doc(&s, t);
+    assert_eq!(d.style_at(12).fill, [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(d.style_at(12).size, 20.0);
+    // Cut removes the selection.
+    s.execute("text.setSelection", json!({"start": 0, "end": 4})).unwrap();
+    assert_eq!(s.execute("edit.cut", json!({})).unwrap()["text"], "red ");
+    assert_eq!(doc(&s, t).text, "new redplainred");
+    // Not editing: Paste Text Formatting Only restyles the whole selected text layer.
+    s.execute("text.endEdit", json!({})).unwrap();
+    s.execute("layer.select", json!({"layers": [t]})).unwrap();
+    s.execute("edit.pasteTextFormattingOnly", json!({})).unwrap();
+    assert!(doc(&s, t).is_uniform());
+    assert_eq!(doc(&s, t).size, 20.0);
+}
+
+#[test]
+fn type_tool_layers_point_box_and_empty_layer_is_kept() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 640, "height": 360, "duration": 4})).unwrap();
+    let t = s.execute("layer.newText", json!({"text": "", "position": [100, 200], "justify": "left", "edit": true})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!(s.state.text_edit.as_ref().map(|e| e.layer.0), Some(t));
+    // Leaving an untouched Type-tool layer keeps it, as After Effects does.
+    s.execute("text.endEdit", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 1, "an empty Type-tool layer is kept, as in AE");
+    let b = s.execute("layer.newText", json!({"text": "", "box": [40, 50, 300, 120], "edit": true})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("text.insert", json!({"text": "Boxed"})).unwrap();
+    let d = doc(&s, b);
+    assert_eq!(d.box_size, Some([300.0, 120.0]));
+    assert_eq!(d.box_pos, [-150.0, -60.0]);
+    let l = s.active_comp().unwrap().layers.iter().find(|l| l.id.0 == b).expect("the boxed layer").clone();
+    assert_eq!(l.name, "Boxed", "named after its text");
+    let pos = l.props.prop("transform/position").unwrap().value.as_vec3();
+    assert_eq!([pos[0], pos[1]], [190.0, 110.0]);
+    s.execute("text.endEdit", json!({})).unwrap();
+    assert_eq!(s.active_comp().unwrap().layers.len(), 2, "both text layers stay, the empty one included");
+    // Resizing the box (layer space) is an attribute too.
+    s.execute("layer.setText", json!({"layer": b, "box": [-100, -60, 200, 120]})).unwrap();
+    assert_eq!(doc(&s, b).box_size, Some([200.0, 120.0]));
+    s.execute("layer.setText", json!({"layer": b, "vertical": true})).unwrap();
+    assert!(doc(&s, b).vertical);
+}
+
+#[test]
+fn edit_state_round_trips_through_serde() {
+    let (mut s, t) = session("abc");
+    s.execute("text.edit", json!({"layer": t, "select": [1, 2]})).unwrap();
+    let j = serde_json::to_value(&s.state).unwrap();
+    let back: crate::EditorState = serde_json::from_value(j).unwrap();
+    let before = s.state.text_edit.clone().expect("editing");
+    let after = back.text_edit.clone().expect("editing");
+    assert_eq!((after.layer, after.anchor, after.caret), (before.layer, before.anchor, before.caret));
+    assert_ne!(after.session, before.session, "a restored editor gets a process-unique replacement epoch");
+    assert_ne!(after.session, 0, "the restored epoch is always a real session token");
+}
+
+#[test]
+fn ime_session_epoch_tracks_replaced_text_and_layer_restoration() {
+    let (mut s, t) = editing_all("abc");
+    let first = ime_owner(&s);
+
+    // Replacing Source Text is a new document even though the layer id stays.
+    replace_text(&mut s, t, "replaced");
+    let replaced = ime_owner(&s);
+    assert_ne!(replaced, first, "layer.setText starts a new IME epoch");
+
+    // Undo restores another document: it must not revive the token from before either edit.
+    s.execute("edit.undo", json!({})).unwrap();
+    let undone = ime_owner(&s);
+    assert_ne!(undone, replaced);
+    assert_ne!(undone, first);
+
+    // Clear + immediate undo in the same command sequence: the layer is gone long enough to
+    // end the session, and the restored layer cannot inherit a composition.
+    begin_edit(&mut s, t);
+    s.execute("edit.clear", json!({"layers": [t]})).unwrap();
+    assert!(s.state.text_edit.is_none(), "clearing the edited layer ends the session");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(s.state.text_edit.is_none(), "undo does not recreate the old composition session");
+    begin_edit(&mut s, t);
+    assert_ne!(ime_owner(&s), first);
+}
+
+#[test]
+fn no_op_ime_deletion_keeps_a_static_plain_text_value_and_records_no_step() {
+    use effectcraft_keyframe::Value as KV;
+    let (mut s, t) = session("abc");
+    // Legacy/imported text can still be stored as a plain Str rather than a TextDoc.
+    let cid = s.active_comp_id().unwrap();
+    let pr = std::sync::Arc::make_mut(&mut s.project)
+        .comp_mut(cid)
+        .unwrap()
+        .layer_mut(effectcraft_project::LayerId(t))
+        .unwrap()
+        .props
+        .prop_mut("text/sourceText")
+        .unwrap();
+    pr.value = KV::Str("abc".into());
+    begin_edit_at(&mut s, t, 0);
+    let steps = undo_steps(&s);
+
+    // A non-zero before count at the document start deletes nothing.
+    s.execute("text.deleteSurrounding", json!({"before": 1, "after": 0})).unwrap();
+
+    let pr = s.active_comp().unwrap().layer(effectcraft_project::LayerId(t)).unwrap().props.prop("text/sourceText").unwrap();
+    assert!(matches!(&pr.value, KV::Str(_)), "a no-op keeps the static Str variant");
+    assert!(pr.keys.is_empty());
+    assert_eq!(undo_steps(&s), steps, "a no-op adds no undo step");
+}
+
+#[test]
+fn no_op_ime_deletion_does_not_add_a_keyframe_to_animated_source_text() {
+    let (mut s, t) = editing("abc", 0);
+    animate_source(&mut s, t);
+    let lid = effectcraft_project::LayerId(t);
+    let keys = |s: &Session| s.active_comp().unwrap().layer(lid).unwrap().props.prop("text/sourceText").unwrap().keys.len();
+    assert_eq!(keys(&s), 1, "one key from the stopwatch");
+    s.execute("time.set", json!({"time": 1.0})).unwrap();
+    let steps = undo_steps(&s);
+
+    // A non-zero before count at the document start deletes nothing, at a time with no key.
+    s.execute("text.deleteSurrounding", json!({"before": 1, "after": 0})).unwrap();
+
+    assert_eq!(keys(&s), 1, "a no-op does not key Source Text at the CTI");
+    assert_eq!(undo_steps(&s), steps, "a no-op adds no undo step");
+}
+
+#[test]
+fn property_writes_replace_the_edited_document_only_when_the_text_changes() {
+    let (mut s, t) = session("abc");
+    let other = s.execute("layer.newText", json!({"text": "other"})).unwrap()["layer"].as_u64().unwrap();
+    begin_edit_at(&mut s, t, 1);
+    let owner = ime_owner(&s);
+    let steps = undo_steps(&s);
+
+    // Writing the text the document already has is a no-op: same document, same owner, no step.
+    set_source(&mut s, t, "abc");
+    assert_ime_owner(&s, owner, "a no-op write keeps the IME owner");
+    assert_eq!(undo_steps(&s), steps, "a no-op write records no undo step");
+    replace_text(&mut s, t, "abc");
+    assert_ime_owner(&s, owner, "a no-op layer.setText keeps the IME owner");
+    assert_eq!(undo_steps(&s), steps, "a no-op layer.setText records no undo step");
+
+    // Another property of the edited layer leaves its document alone.
+    s.execute("prop.set", json!({"layer": t, "path": "transform/opacity", "value": 50})).unwrap();
+    assert_ime_owner(&s, owner, "an unrelated property keeps the IME owner");
+
+    // Source Text of another layer is not the editor's document either.
+    set_source(&mut s, other, "changed");
+    assert_ime_owner(&s, owner, "another layer's text keeps the IME owner");
+
+    // Replacing the edited layer's Source Text is a document replacement: a new IME epoch.
+    set_source(&mut s, t, "replaced");
+    assert_text(&s, t, "replaced");
+    assert_ime_epoch_changed(&s, owner, "replacing the document changes the IME owner");
+}
+
+#[test]
+fn undo_and_redo_of_an_unrelated_property_keep_the_ime_owner_and_selection() {
+    let (mut s, t) = editing("abcdef", 3);
+    let owner = ime_owner(&s);
+
+    s.execute("prop.set", json!({"layer": t, "path": "transform/opacity", "value": 50})).unwrap();
+    assert_ime_owner(&s, owner, "the opacity write keeps the owner");
+    assert_eq!(sel(&s), (3, 3), "the opacity write keeps the selection");
+
+    // The opacity step does not change Source Text: restoring it keeps the same editor.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_ime_owner(&s, owner, "undoing only opacity keeps the owner");
+    assert_eq!(sel(&s), (3, 3), "undoing only opacity keeps the selection");
+
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_ime_owner(&s, owner, "redoing only opacity keeps the owner");
+    assert_eq!(sel(&s), (3, 3), "redoing only opacity keeps the selection");
+}
+
+#[test]
+fn a_style_only_text_change_and_its_undo_replace_the_editor_epoch() {
+    let (mut s, t) = editing("abcdef", 3);
+    let owner = ime_owner(&s);
+
+    // The same characters with another run style are still a different document.
+    s.execute("layer.setText", json!({"layer": t, "range": [1, 4], "size": 12})).unwrap();
+    assert_eq!(doc(&s, t).text, "abcdef");
+    assert_eq!(doc(&s, t).style_at(2).size, 12.0);
+    assert_ime_epoch_changed(&s, owner, "a style-only change starts a new IME epoch");
+    assert_eq!(sel(&s), (3, 3), "a same-length style change keeps the caret in range");
+    let styled = ime_owner(&s);
+
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc(&s, t).style_at(2).size, 60.0);
+    assert_ime_epoch_changed(&s, styled, "undoing a style change starts a new IME epoch");
+}
+
+#[test]
+fn history_jumps_keep_the_owner_over_unrelated_steps_and_replace_it_when_the_text_changes() {
+    let (mut s, t) = editing("abcdef", 3);
+    let owner = ime_owner(&s);
+    s.execute("prop.set", json!({"layer": t, "path": "transform/opacity", "value": 50})).unwrap();
+    s.execute("prop.set", json!({"layer": t, "path": "transform/opacity", "value": 25})).unwrap();
+    let states = s.execute("edit.history.list", json!({})).unwrap()["states"].as_array().unwrap().clone();
+    let cur = states.iter().find(|n| n["current"] == true).unwrap()["index"].as_u64().unwrap();
+    let parent = states.iter().find(|n| n["index"].as_u64() == Some(cur)).unwrap()["parent"].as_u64().unwrap();
+
+    // Both states show the same Source Text: jumping between them keeps the editor.
+    s.execute("edit.history.goto", json!({"index": parent})).unwrap();
+    assert_ime_owner(&s, owner, "jumping to another opacity state keeps the owner");
+    assert_eq!(sel(&s), (3, 3), "and the selection");
+    s.execute("edit.history.goto", json!({"index": cur})).unwrap();
+    assert_ime_owner(&s, owner, "jumping back keeps the owner");
+    assert_eq!(sel(&s), (3, 3), "and the selection");
+
+    // A history state whose Source Text differs is a document replacement.
+    set_source(&mut s, t, "abc");
+    let changed = ime_owner(&s);
+    assert_ne!(changed, owner);
+    s.execute("edit.history.goto", json!({"index": parent})).unwrap();
+    assert_text(&s, t, "abcdef");
+    assert_ime_epoch_changed(&s, changed, "jumping to a different document starts a new epoch");
+}
+
+#[test]
+fn atomic_batch_rollback_keeps_the_owner_for_unrelated_steps_and_replaces_it_for_text_changes() {
+    let (mut s, t) = editing("abcdef", 3);
+    let owner = ime_owner(&s);
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "prop.set", "params": {"layer": t, "path": "transform/opacity", "value": 50}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_ime_owner(&s, owner, "rolling back an unrelated step keeps the owner");
+    assert_eq!(sel(&s), (3, 3), "and the selection");
+
+    // A partially applied text replacement was still shown before the rollback restores the
+    // original document, so the editor must not revive the composition it had before the batch.
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "layer.setText", "params": {"layer": t, "text": "ab"}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_text(&s, t, "abcdef");
+    assert_ime_epoch_changed(&s, owner, "a rolled-back text change does not revive the old owner");
+    assert_eq!(sel(&s), (3, 3), "the restored document keeps the caret in range");
+}
+
+#[test]
+fn atomic_batch_rollback_after_a_transient_editor_restart_bumps_the_epoch() {
+    let (mut s, t) = editing("abcdef", 3);
+    let owner = ime_owner(&s);
+
+    // `text.edit` restarts the session even on the layer that is already edited. The rollback
+    // restores the pre-batch TextEdit (with the old token), so the intermediate restart must be
+    // detected from the snapshot: neither the old composition nor its token may be revived.
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "text.edit", "params": {"layer": t, "caret": 1}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_eq!(sel(&s), (3, 3), "the restored selection is the pre-batch one");
+    assert_ime_epoch_changed(&s, owner, "a canceled intermediate editor must not revive the old token");
+}
+
+#[test]
+fn atomic_batch_rollback_after_a_cross_comp_editor_switch_bumps_the_epoch() {
+    let (mut s, t) = session("abcdef");
+    let original = s.active_comp_id().unwrap();
+    // Give the other comp a layer with the same id and the same Source Text, so only the comp
+    // and editor-session identity distinguishes the two editors.
+    let layer = s.active_comp().unwrap().layer(effectcraft_project::LayerId(t)).unwrap().clone();
+    let other = new_other_comp(&mut s);
+    let other_id = effectcraft_project::ItemId(other);
+    std::sync::Arc::make_mut(&mut s.project).comp_mut(other_id).unwrap().layers.push(layer);
+    s.execute("comp.open", json!({"comp": original.0})).unwrap();
+    begin_edit_at(&mut s, t, 3);
+    let owner = ime_owner(&s);
+
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "comp.open", "params": {"comp": other}},
+            {"command": "text.edit", "params": {"layer": t, "caret": 1}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_eq!(s.active_comp_id(), Some(original), "the batch restored the original comp");
+    assert_eq!(sel(&s), (3, 3), "and the pre-batch selection");
+    assert_ime_epoch_changed(&s, owner, "an identical layer in another comp must not revive the old token");
+}
+
+#[test]
+fn an_atomic_batch_drops_the_events_its_failed_steps_queued() {
+    let (mut s, _) = session("abcdef");
+    let original = s.active_comp_id().unwrap();
+    // `comp.new` opens the comp it creates; go back so the batch's switch is a real one.
+    let other = new_other_comp(&mut s);
+    s.execute("comp.open", json!({"comp": original.0})).unwrap();
+    s.drain_events();
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "comp.open", "params": {"comp": other}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_eq!(s.active_comp_id(), Some(original), "the batch restored the original comp");
+    assert!(
+        !s.drain_events().iter().any(|e| matches!(e, crate::Event::OpenComp(id) if id.0 == other)),
+        "the rolled-back step's OpenComp is not queued for the UI"
+    );
+}
+
+#[test]
+fn atomic_batch_rollback_after_closing_the_editor_does_not_revive_it() {
+    let (mut s, t) = session("abcdef");
+    let original = s.active_comp_id().unwrap();
+    let other = new_other_comp(&mut s);
+    s.execute("comp.open", json!({"comp": original.0})).unwrap();
+    begin_edit_at(&mut s, t, 3);
+    let owner = ime_owner(&s);
+
+    // The failing state has no editor at all: the restoration brings the pre-batch one back and
+    // must treat it as unverified rather than revive its composition.
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "comp.open", "params": {"comp": other}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert!(s.state.text_edit.is_some(), "the batch restored the editor state");
+    assert_eq!(sel(&s), (3, 3));
+    assert_ime_epoch_changed(&s, owner, "a canceled editor close must not revive the old token");
+}
+
+#[test]
+fn restoring_without_an_editor_snapshot_replaces_an_open_editor() {
+    let (mut s, _) = editing("abcdef", 3);
+    let owner = ime_owner(&s);
+
+    // `None` means no editor was open when the state was replaced; an editor that is open
+    // afterwards cannot prove it kept its document.
+    s.sanitize_after_replacement(None);
+    assert_ime_epoch_changed(&s, owner, "an unverified restored editor starts a new epoch");
+    assert_eq!(sel(&s), (3, 3));
+}
+
+#[test]
+fn undo_to_a_shorter_document_clamps_the_caret() {
+    let (mut s, t) = editing("abc", 3);
+    replace_text(&mut s, t, "abcdef");
+    select_anchor(&mut s, 6, 6);
+    let owner = ime_owner(&s);
+    assert_eq!(sel(&s), (6, 6));
+
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_text(&s, t, "abc");
+    assert_eq!(sel(&s), (3, 3), "undoing to a shorter document clamps the caret");
+    assert_ime_epoch_changed(&s, owner, "and starts a new epoch");
+}
+
+#[test]
+fn the_ime_stamp_revision_follows_the_editor_not_unrelated_project_edits() {
+    let (mut s, t) = editing("abcdef", 6);
+    let revision = ime_stamp_revision(&s);
+
+    s.execute("prop.set", json!({"layer": t, "path": "transform/opacity", "value": 50})).unwrap();
+    assert_eq!(ime_stamp_revision(&s), revision, "an unrelated property write does not advance it");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(ime_stamp_revision(&s), revision, "undoing it does not either");
+
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "prop.set", "params": {"layer": t, "path": "transform/opacity", "value": 25}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_eq!(ime_stamp_revision(&s), revision, "a rolled-back unrelated batch restores it");
+
+    s.execute("text.insert", json!({"text": "x"})).unwrap();
+    assert!(ime_stamp_revision(&s) > revision, "typing advances it");
+    let typed = ime_stamp_revision(&s);
+    s.execute("layer.setText", json!({"layer": t, "text": "y"})).unwrap();
+    assert!(ime_stamp_revision(&s) > typed, "a replaced document advances it too");
+}
+
+#[test]
+fn a_failed_atomic_batch_with_a_transient_edit_keeps_its_high_water_ime_revision() {
+    let (mut s, t) = editing("abcdef", 6);
+    let revision = ime_stamp_revision(&s);
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "text.insert", "params": {"text": "x"}},
+            {"command": "text.delete", "params": {}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_text(&s, t, "abcdef");
+    // The intermediate document edit is real even though the final document equals the
+    // pre-batch one: its stamp must remain the high-water mark.
+    assert!(ime_stamp_revision(&s) > revision, "a transient edit must not rewind the IME revision");
+    let after_transient = ime_stamp_revision(&s);
+
+    // An unrelated failed batch really did not edit the document: it must preserve the revision
+    // exactly, or every wide-selection composition would be canceled by unrelated work.
+    let r = s.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "prop.set", "params": {"layer": t, "path": "transform/opacity", "value": 25}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_eq!(ime_stamp_revision(&s), after_transient, "an unrelated rolled-back batch preserves the revision");
+}
+
+#[test]
+fn a_replacing_property_write_clamps_the_selection_so_the_next_backspace_deletes() {
+    let (mut s, t) = editing("abcdef", 6);
+    let owner = ime_owner(&s);
+
+    set_source(&mut s, t, "a");
+    assert_text(&s, t, "a");
+    assert_eq!(sel(&s), (1, 1), "the shortened document leaves the caret in range");
+    assert_ne!(ime_owner(&s), owner);
+
+    // Backspace at the clamped caret removes the character instead of no-opping on 5..6.
+    s.execute("text.delete", json!({})).unwrap();
+    assert_text(&s, t, "");
+    assert_eq!(sel(&s), (0, 0));
+}
+
+#[test]
+fn keyframe_writes_on_source_text_replace_the_edited_document_only_when_the_cti_value_changes() {
+    let (mut s, t) = editing("abc", 1);
+    // Keying the text the CTI already shows leaves the document equal.
+    animate_source(&mut s, t);
+    let owner = ime_owner(&s);
+
+    set_source_cti_key(&mut s, t, 0.0, "abc");
+    assert_ime_owner(&s, owner, "a no-op key write keeps the IME owner");
+
+    // `keys.set` changes the key at the CTI: a document replacement.
+    set_source_cti_key(&mut s, t, 0.0, "replaced");
+    assert_text(&s, t, "replaced");
+    assert_ime_epoch_changed(&s, owner, "a changed keyframe changes the IME owner");
+}
+
+#[test]
+fn deleting_the_cti_keyframe_first_replaces_the_document_then_the_last_key_is_a_noop() {
+    let (mut s, t) = editing("abc", 1);
+    animate_source(&mut s, t);
+    add_source_key(&mut s, t, 1.0, "later");
+    let owner = ime_owner(&s);
+    let lid = effectcraft_project::LayerId(t);
+    let pr = s.active_comp().unwrap().layer(lid).unwrap().props.prop("text/sourceText").unwrap();
+    let uid = pr.uid;
+    let times: Vec<_> = pr.keys.iter().map(|k| k.time).collect();
+    assert_eq!(times.len(), 2);
+
+    // Deleting the key at the CTI (0s) while the 1s key remains shows the later text: replacing
+    // the document starts a new epoch.
+    s.state.selected_keys = vec![crate::KeyRef { layer: lid, prop: uid, time: times[0] }];
+    assert_eq!(s.execute("keys.delete", json!({})).unwrap(), json!(1));
+    assert_text(&s, t, "later");
+    let replaced = ime_owner(&s);
+    assert_ne!(replaced, owner, "deleting the CTI key changed the document");
+
+    // Removing the last key turns its value into the static CTI value. That value is what the
+    // CTI already showed, so the document does not change and the new owner stays.
+    s.state.selected_keys = vec![crate::KeyRef { layer: lid, prop: uid, time: times[1] }];
+    assert_eq!(s.execute("keys.delete", json!({})).unwrap(), json!(1));
+    assert_text(&s, t, "later");
+    assert_ime_owner(&s, replaced, "removing the last key is a document no-op");
+}
+
+#[test]
+fn moving_the_cti_to_a_shorter_animated_key_clamps_and_starts_a_new_epoch() {
+    let (mut s, t) = session("abcdef");
+    animate_source(&mut s, t);
+    add_source_key(&mut s, t, 1.0, "a");
+    begin_edit_at(&mut s, t, 6);
+    let owner = ime_owner(&s);
+
+    // The same time still shows the same document: no new epoch.
+    s.execute("time.set", json!({"time": 0.0})).unwrap();
+    assert_text(&s, t, "abcdef");
+    assert_ime_owner(&s, owner, "an unchanged CTI document keeps the IME owner");
+
+    // The key at 1s holds shorter text: the document changes, the selection is clamped and the
+    // editor gets a new epoch.
+    s.execute("time.set", json!({"time": 1.0})).unwrap();
+    assert_text(&s, t, "a");
+    assert_eq!(sel(&s), (1, 1), "the shortened document leaves the caret in range");
+    let replaced = ime_owner(&s);
+    assert_ne!(replaced, owner, "a changed CTI document starts a new IME epoch");
+
+    // Backspace at the clamped caret removes the character instead of no-opping on 5..6.
+    s.execute("text.delete", json!({})).unwrap();
+    assert_text(&s, t, "");
+    assert_eq!(sel(&s), (0, 0));
+    assert_ime_owner(&s, replaced, "typing after the replacement keeps its owner");
+
+    // Staying at the same time after the edit is a no-op for the document too.
+    s.execute("time.set", json!({"time": 1.0})).unwrap();
+    assert_text(&s, t, "");
+    assert_ime_owner(&s, replaced, "a no-op time move keeps the IME owner");
+}
+
+#[test]
+fn sync_related_times_replaces_the_edited_document_when_it_moves_the_active_comp() {
+    let (mut s, t) = session("abcdef");
+    animate_source(&mut s, t);
+    add_source_key(&mut s, t, 1.0, "a");
+    let outer = s.active_comp_id().unwrap();
+    let r = s.execute("layer.precompose", json!({"layers": [t], "name": "Inner", "open": true})).unwrap();
+    let inner = effectcraft_project::ItemId(r["comp"].as_u64().unwrap());
+    assert_eq!(s.active_comp_id(), Some(inner));
+
+    begin_edit_at(&mut s, t, 6);
+    let owner = ime_owner(&s);
+    s.sync_related_times(outer, effectcraft_time::Tick::from_seconds_f64(1.0));
+
+    assert_text(&s, t, "a");
+    assert_eq!(sel(&s), (1, 1), "the related time move clamps the selection");
+    assert_ime_epoch_changed(&s, owner, "the related time move changed the document");
+}
+
+#[test]
+fn applying_a_preset_that_writes_source_text_replaces_the_edited_document() {
+    let (mut s, t) = editing("abc", 1);
+    let owner = ime_owner(&s);
+    let preset = json!({
+        "effectcraftAnimationPreset": 1,
+        "properties": [{"path": "text/sourceText", "value": {"t": "Text", "v": {"text": "replaced"}}, "keys": []}],
+    });
+    s.execute("anim.applyPreset", json!({"preset": preset, "layers": [t]})).unwrap();
+    assert_text(&s, t, "replaced");
+    assert_ime_epoch_changed(&s, owner, "a preset that replaces source text changes the IME owner");
+}
+
+#[test]
+fn a_failed_property_write_keeps_the_edited_document_and_its_owner() {
+    let (mut s, t) = editing("abc", 1);
+    let owner = ime_owner(&s);
+    let steps = undo_steps(&s);
+
+    // null cannot coerce to a Text value: the edit fails before anything is committed.
+    assert!(s.execute("prop.set", json!({"layer": t, "path": "text/sourceText", "value": null})).is_err());
+    assert_text(&s, t, "abc");
+    assert_ime_owner(&s, owner, "a failed write keeps the IME owner");
+    assert_eq!(undo_steps(&s), steps, "a failed write records no undo step");
+}
+
+#[test]
+fn property_writes_off_the_cti_keep_the_owner_until_they_change_the_cti_document() {
+    let (mut s, t) = editing("abc", 1);
+    animate_source(&mut s, t);
+    add_source_key(&mut s, t, 1.0, "later");
+    let owner = ime_owner(&s);
+
+    // Writing a key at 1s leaves the CTI (0s) value as it was.
+    set_source_key(&mut s, t, 1.0, "changed");
+    assert_text(&s, t, "abc");
+    assert_ime_owner(&s, owner, "an off-CTI write keeps the IME owner");
+
+    // Writing the CTI value itself replaces the document.
+    set_source(&mut s, t, "cti");
+    assert_text(&s, t, "cti");
+    assert_ime_epoch_changed(&s, owner, "a CTI write changes the IME owner");
+}
+
+#[test]
+fn unrelated_project_cleanup_keeps_the_ime_owner_but_replacement_changes_it() {
+    let (mut s, t) = editing("abc", 1);
+    let owner = ime_owner(&s);
+
+    // file.removeUnusedFootage calls sanitize_state while the edited document is untouched.
+    s.execute("file.importSolid", json!({"name": "Unused"})).unwrap();
+    let removed = s.execute("file.removeUnusedFootage", json!({})).unwrap();
+    assert_eq!(removed["removed"], json!(1), "the unused solid was actually removed");
+    assert_ime_owner(&s, owner, "unrelated cleanup keeps the IME owner");
+
+    // Replacing the Source Text is a document replacement: a new owner.
+    replace_text(&mut s, t, "replaced");
+    assert_ime_epoch_changed(&s, owner, "replacing the document changes the owner");
+}
+
+#[test]
+fn ime_session_does_not_cross_a_composition_switch() {
+    let (mut s, _) = editing_all("abc");
+    let other = new_other_comp(&mut s);
+    s.execute("comp.open", json!({"comp": other})).unwrap();
+    assert!(s.state.text_edit.is_none(), "the old comp's editor is not reused in another comp");
+}
+
+#[test]
+fn removing_the_active_comp_does_not_retarget_its_text_editor() {
+    for replacement in [false, true] {
+        let (mut s, t) = session("original");
+        let original = s.active_comp_id().unwrap();
+        let layer = s.active_comp().unwrap().layer(effectcraft_project::LayerId(t)).unwrap().clone();
+        let other = new_other_comp(&mut s);
+        let other_id = effectcraft_project::ItemId(other);
+        std::sync::Arc::make_mut(&mut s.project).comp_mut(other_id).unwrap().layers.push(layer);
+        s.execute("comp.open", json!({"comp": other})).unwrap();
+        s.execute("comp.open", json!({"comp": original.0})).unwrap();
+        begin_edit_at(&mut s, t, 1);
+        assert!(s.state.text_edit.is_some());
+
+        // Reproduce cleanup after a project replacement, bypassing Session::edit's earlier
+        // document guard so this specifically exercises sanitize_state's fallback-comp branch.
+        let edited = crate::commands::text_edit::active_editor_snapshot(&s);
+        std::sync::Arc::make_mut(&mut s.project).items.remove(&original);
+        if replacement {
+            s.sanitize_after_replacement(edited.as_ref());
+        } else {
+            s.sanitize_state();
+        }
+        assert_eq!(s.active_comp_id(), Some(other_id));
+        assert!(s.state.text_edit.is_none(), "the same-numbered layer belongs to a different comp");
+        assert!(s.execute("text.insert", json!({"text": "wrong document"})).is_err());
+        assert_eq!(doc(&s, t).text, "original", "the fallback comp was not edited");
+    }
+}
+
+#[test]
+fn opentype_features_per_range_render_and_query() {
+    let (mut s, t) = session("Office 1/2");
+    s.execute("layer.setText", json!({"layer": t, "range": [7, 10], "fractions": true, "ss01": true})).unwrap();
+    let d = doc(&s, t);
+    assert!(!d.style_at(0).opentype.fractions);
+    assert!(d.style_at(8).opentype.fractions && d.style_at(8).opentype.stylistic_set(1));
+    // The laid-out glyphs change (frac turns 1/2 into a fraction).
+    let plain = effectcraft_text::layout_doc(&TextDoc { text: "1/2".into(), ..Default::default() });
+    let frac = effectcraft_text::layout_doc(&d.slice(7..10));
+    let ids = |l: &effectcraft_text::TextLayout| l.glyphs.iter().map(|g| g.gid).collect::<Vec<_>>();
+    assert_ne!(ids(&plain), ids(&frac));
+    // Undo restores the uniform style.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(doc(&s, t).is_uniform());
+    // Font feature query (font by name, or the layer's).
+    let f = s.execute("text.fontFeatures", json!({"font": "Noto Serif"})).unwrap();
+    assert_eq!(f["options"]["smallCaps"], true);
+    assert!(f["features"].as_array().unwrap().iter().any(|t| t == "onum"));
+    let f = s.execute("text.fontFeatures", json!({"layer": t})).unwrap();
+    assert_eq!(f["family"], "Inter");
+    assert!(f["options"]["stylisticSets"].as_array().unwrap().contains(&json!(1)));
+    assert_eq!(f["options"]["smallCaps"], false);
+}
+
+#[test]
+fn fonts_lists_bundled_and_installed_families() {
+    let mut s = Session::default();
+    let r = s.execute("text.fonts", json!({})).unwrap();
+    let fams = r["families"].as_array().unwrap();
+    assert_eq!(r["count"].as_u64().unwrap() as usize, fams.len());
+    let inter = fams.iter().find(|f| f["family"] == "Inter").unwrap();
+    assert_eq!(inter["origin"], "bundled");
+    assert!(inter["styles"].as_array().unwrap().contains(&json!("Bold")));
+    // Installed fonts are listed without any layer having asked for one.
+    use effectcraft_text::fonts::FontSource as _;
+    let installed = effectcraft_text::fonts::DirectorySource::system().faces();
+    for face in &installed {
+        assert!(fams.iter().any(|f| f["family"].as_str().unwrap().eq_ignore_ascii_case(&face.family)), "{} not listed", face.family);
+    }
+    // Filtered by name; rescanning keeps what was there.
+    let r = s.execute("text.fonts", json!({"query": "noto ser", "rescan": true})).unwrap();
+    assert_eq!(r["families"][0]["family"], "Noto Serif");
+    // The bundled face is Regular; the OS can also provide Bold, Italic, or other faces.
+    // Model `add_source()` on the independent directory inventory: a system face whose family
+    // and primary style duplicate an earlier face is skipped, with its named instances.
+    let mut expected_styles = std::collections::BTreeSet::from(["regular".to_string()]);
+    let mut retained = std::collections::BTreeSet::from([("noto serif".to_string(), "regular".to_string())]);
+    for face in installed.iter().filter(|face| face.family.eq_ignore_ascii_case("Noto Serif")) {
+        if retained.insert((face.family.to_ascii_lowercase(), face.style.to_ascii_lowercase())) {
+            expected_styles.insert(face.style.to_ascii_lowercase());
+            expected_styles.extend(face.instances.iter().map(|i| i.style.to_ascii_lowercase()));
+        }
+    }
+    let styles: Vec<String> = r["families"][0]["styles"].as_array().unwrap().iter().map(|style| style.as_str().unwrap().to_string()).collect();
+    // `families()` keeps the first spelling of a style that differs only in case.
+    assert_eq!(styles.iter().map(|style| style.to_ascii_lowercase()).collect::<std::collections::BTreeSet<_>>(), expected_styles);
+    assert_eq!(styles.len(), expected_styles.len(), "style menu has no duplicates");
+    assert!(r["families"].as_array().unwrap().iter().all(|f| f["family"].as_str().unwrap().to_lowercase().contains("noto ser")));
+    // The style menus offer a family's own styles.
+    assert_eq!(crate::font_styles("noto serif"), styles);
+    assert_eq!(crate::font_styles("NOTO SERIF"), styles);
+    assert_eq!(crate::font_styles("No Such Family").len(), 5);
+}
+
+/// A big-endian `u16` array, as sfnt tables store them.
+fn u16s(v: &[u16]) -> Vec<u8> {
+    v.iter().flat_map(|x| x.to_be_bytes()).collect()
+}
+
+/// A `name` table with one Windows/Unicode English record per `(id, text)`.
+fn name_table(strings: &[(u16, String)]) -> Vec<u8> {
+    let enc: Vec<(u16, Vec<u8>)> = strings.iter().map(|(id, s)| (*id, s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect())).collect();
+    let mut name = u16s(&[0, enc.len() as u16, 6 + 12 * enc.len() as u16]);
+    let mut off = 0;
+    for (id, st) in &enc {
+        name.extend(u16s(&[3, 1, 0x409, *id, st.len() as u16, off]));
+        off += st.len() as u16;
+    }
+    enc.iter().for_each(|(_, st)| name.extend(st));
+    name
+}
+
+/// A single-face font with `tables` in order (zero checksums, offsets after the directory).
+fn sfnt(tables: &[(&[u8; 4], Vec<u8>)]) -> Vec<u8> {
+    let mut out = u16s(&[1, 0, tables.len() as u16, 0, 0, 0]);
+    let mut body: Vec<u8> = vec![];
+    for (tag, data) in tables {
+        out.extend(*tag);
+        out.extend([0u8; 4]);
+        out.extend(((12 + 16 * tables.len() + body.len()) as u32).to_be_bytes());
+        out.extend((data.len() as u32).to_be_bytes());
+        body.extend(data);
+    }
+    out.extend(body);
+    out
+}
+
+/// A font file of just `name` (the family, Regular) and an `fvar` table with one axis pinned at
+/// 400 (so the helpers that look for an installed font with a real axis range never pick it).
+fn pinned_variable_font(family: &str) -> Vec<u8> {
+    let mut fvar = u16s(&[1, 0, 16, 2, 1, 20, 0, 8]);
+    fvar.extend(b"wght".iter().copied().chain(u16s(&[0x190, 0, 0x190, 0, 0x190, 0, 0, 256])));
+    let name = name_table(&[(1, family.to_owned()), (2, "Regular".to_owned())]);
+    sfnt(&[(b"fvar", fvar), (b"name", name)])
+}
+
+/// The font menu's Variable Fonts filter (After Effects 26.3): `text.fonts {variable: true}`
+/// lists only families with variation axes, every listing says which families are variable, and
+/// the font menu's rows carry the flag the filter uses.
+#[test]
+fn fonts_filter_variable_families() {
+    const FAMILY: &str = "EffectCraft Variable Filter Test";
+    assert_eq!(effectcraft_text::fonts::add_font_data(pinned_variable_font(FAMILY)).len(), 1);
+    let mut s = Session::default();
+    let all = s.execute("text.fonts", json!({})).unwrap();
+    let fams = all["families"].as_array().unwrap();
+    let flag = |name: &str| fams.iter().find(|f| f["family"] == name).map(|f| f["variable"].clone());
+    assert_eq!(flag("Inter"), Some(json!(false)), "the bundled fonts are static");
+    assert_eq!(flag(FAMILY), Some(json!(true)));
+    let var = s.execute("text.fonts", json!({"variable": true})).unwrap();
+    let listed = var["families"].as_array().unwrap();
+    assert_eq!(var["count"].as_u64(), Some(listed.len() as u64));
+    assert!(listed.iter().all(|f| f["variable"] == true), "{var}");
+    assert!(listed.iter().any(|f| f["family"] == FAMILY), "{var}");
+    assert!(listed.len() < fams.len(), "the filter drops the static families");
+    // Combined with the name query.
+    let both = s.execute("text.fonts", json!({"variable": true, "query": "variable filter"})).unwrap();
+    assert_eq!(both["families"].as_array().map(Vec::len), Some(1), "{both}");
+    let none = s.execute("text.fonts", json!({"variable": true, "query": "jetbrains mono"})).unwrap();
+    assert!(!none["families"].as_array().unwrap().iter().any(|f| f["family"] == "JetBrains Mono"), "{none}");
+    // The font menu's rows.
+    let menu = crate::font_menu(&s.prefs);
+    assert!(menu.iter().any(|r| r.family == FAMILY && r.variable));
+    assert!(menu.iter().any(|r| r.family == "Inter" && !r.variable));
+}
+
+/// A variable font of `name` and `fvar` only: one `wght` axis 100..900 (default 300, style
+/// `Light`) and the named `instances` (style, `wght`), each with a PostScript name
+/// `<family without spaces>-<style without spaces>`.
+fn instanced_variable_font(family: &str, instances: &[(&str, f32)]) -> Vec<u8> {
+    let squash = |s: &str| s.chars().filter(char::is_ascii_alphanumeric).collect::<String>();
+    let mut strings: Vec<(u16, String)> = vec![(1, family.into()), (2, "Light".into())];
+    let mut fvar = u16s(&[1, 0, 16, 2, 1, 20, instances.len() as u16, 10]);
+    fvar.extend(b"wght".iter().copied().chain(u16s(&[100, 0, 300, 0, 900, 0, 0, 256])));
+    for (i, (style, w)) in instances.iter().enumerate() {
+        let id = 256 + 2 * i as u16;
+        strings.push((id, (*style).into()));
+        strings.push((id + 1, format!("{}-{}", squash(family), squash(style))));
+        fvar.extend(u16s(&[id, 0]));
+        fvar.extend(((w * 65536.0) as i32).to_be_bytes());
+        fvar.extend(u16s(&[id + 1]));
+    }
+    sfnt(&[(b"fvar", fvar), (b"name", name_table(&strings))])
+}
+
+/// #1563: a variable font's named instances are styles of its family in `text.fonts`, and a
+/// text layer set in one (by style, or by the instance's PostScript name as After Effects scripts
+/// do) is laid out at the instance's axis values; an axis set on the text still wins.
+#[test]
+fn variable_font_named_instances_are_styles() {
+    const FAMILY: &str = "EffectCraft Named Instance Test";
+    assert_eq!(effectcraft_text::fonts::add_font_data(instanced_variable_font(FAMILY, &[("Light", 300.0), ("Regular", 400.0), ("Black", 900.0)])).len(), 1);
+    let (mut s, t) = session("Hi");
+    let fonts = s.execute("text.fonts", json!({"query": FAMILY})).unwrap();
+    assert_eq!(fonts["families"][0]["styles"], json!(["Light", "Regular", "Black"]), "{fonts}");
+    let wght = |s: &Session| -> Vec<Vec<(String, f32)>> { effectcraft_text::layout_doc(&doc(s, t)).glyphs.iter().map(|g| g.variations.clone()).collect() };
+    let black = vec![("wght".to_string(), 900.0)];
+    s.execute("layer.setText", json!({"layer": t, "font": FAMILY, "style": "Black"})).unwrap();
+    let by_style = wght(&s);
+    assert!(!by_style.is_empty() && by_style.iter().all(|v| v == &black), "{by_style:?}");
+    s.execute("layer.setText", json!({"layer": t, "font": "EffectCraftNamedInstanceTest-Black", "style": "Regular"})).unwrap();
+    let by_ps = wght(&s);
+    assert!(!by_ps.is_empty() && by_ps.iter().all(|v| v == &black), "{by_ps:?}");
+    s.execute("layer.setText", json!({"layer": t, "variations": {"wght": 650}})).unwrap();
+    assert!(wght(&s).iter().all(|v| v == &[("wght".to_string(), 650.0)]), "{:?}", wght(&s));
+}
+
+/// `layer.setText`'s schema lists every OpenType key as optional, so checked execution (control
+/// channel, MCP) accepts them and requires none (#520).
+#[test]
+fn set_text_schema_accepts_every_opentype_key_and_requires_none() {
+    let spec = crate::commands::find("layer.setText").unwrap();
+    let schema = crate::commands::params_schema(spec);
+    assert_eq!(schema["required"], json!([]));
+    for key in ["discretionaryLigatures", "ss01", "ss02", "ss20", "swash"] {
+        assert!(schema["properties"].get(key).is_some(), "{key} is not in the schema");
+    }
+    assert!(schema["properties"].get("OpenType").is_none());
+    let (mut s, t) = session("Office 1/2");
+    s.execute_checked("layer.setText", json!({"layer": t, "discretionaryLigatures": true, "ss02": true, "ss20": true})).unwrap();
+    assert!(doc(&s, t).style_at(0).opentype.stylistic_set(20));
+}
+
+/// Incoming IME replacement (stock `DeleteSurrounding` / the fork's `DeleteSurroundingBytes`):
+/// the characters around the selection go, the selected text stays for the following commit, and
+/// a byte count that ends inside a UTF-8 character leaves that character.
+#[test]
+fn ime_replacement_keeps_the_selection_and_never_splits_a_character() {
+    let (mut s, t) = editing_all("abcdef");
+    select(&mut s, 1, 4);
+    // One character before "bcd" and everything after it: the selection survives for the commit.
+    s.execute("text.deleteSurrounding", json!({"before": 1, "after": 99, "merge": "typing-0"})).unwrap();
+    assert_text(&s, t, "bcd");
+    assert_eq!(sel(&s), (0, 3), "the selection is kept for the commit that follows");
+    s.execute("text.insert", json!({"text": "X", "merge": "typing-0"})).unwrap();
+    assert_text(&s, t, "X");
+    assert_eq!(sel(&s), (1, 1));
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc(&s, t).text, "abcdef", "the surrounding delete and its commit are one undo step");
+    // An empty count is a no-op (deletion-only batches, empty commits), never an undo step.
+    s.execute("edit.redo", json!({})).unwrap();
+    select(&mut s, 0, 1);
+    s.execute("text.deleteSurrounding", json!({"before": 0, "after": 0})).unwrap();
+    assert_text(&s, t, "X");
+
+    // Byte counts end inside a character: it stays whole (never a split UTF-8 sequence).
+    let (mut s, t) = editing_all("A😀B");
+    select(&mut s, 3, 3);
+    s.execute("text.deleteSurrounding", json!({"before": 2, "after": 0, "bytes": true})).unwrap();
+    assert_eq!(doc(&s, t).text, "A😀", "B is whole, the emoji only partly covered, so both are not one range");
+    select(&mut s, 2, 2);
+    s.execute("text.deleteSurrounding", json!({"before": 4, "after": 0, "bytes": true})).unwrap();
+    assert_eq!(doc(&s, t).text, "A", "four bytes cover the whole emoji");
+
+    // A combining mark is one character of two bytes: one byte of it removes nothing.
+    let (mut s, t) = editing_all("e\u{301}");
+    select(&mut s, 2, 2);
+    s.execute("text.deleteSurrounding", json!({"before": 1, "after": 0, "bytes": true})).unwrap();
+    assert_eq!(doc(&s, t).text, "e\u{301}", "a partial combining mark stays");
+    s.execute("text.deleteSurrounding", json!({"before": 2, "after": 0, "bytes": true})).unwrap();
+    assert_eq!(doc(&s, t).text, "e", "the whole combining mark is one character");
+}
+
+/// The outgoing IME query: logical committed text (the pre-edit never enters the model), UTF-8
+/// byte offsets in either selection direction, a bounded window, and an explicit unavailable
+/// answer for a selection that cannot be represented.
+#[test]
+fn ime_surrounding_maps_characters_to_bytes_and_preserves_direction() {
+    let (mut s, _) = editing_all("café😀");
+    select_anchor(&mut s, 2, 5);
+    let w = ime_surrounding(&s).expect("an available document");
+    assert_eq!(w.text, "café😀");
+    assert_eq!((w.cursor, w.anchor), (9, 2), "the caret is six characters in, after the emoji; the anchor stays at byte 2");
+    assert_eq!(&w.text[w.cursor..], "");
+    assert_eq!(&w.text[..w.anchor], "ca");
+
+    // Reversed: the caret stays the primary end and the anchor the other one.
+    select_anchor(&mut s, 5, 2);
+    let reversed = ime_surrounding(&s).expect("an available document");
+    assert_eq!((reversed.cursor, reversed.anchor), (2, 9), "cursor > anchor is preserved after the conversion");
+    assert_eq!(&reversed.text[reversed.cursor..reversed.anchor], "fé😀");
+
+    // An available empty document is not the unavailable state.
+    let (s, _) = editing_all("");
+    let empty = ime_surrounding(&s).expect("empty text is available");
+    assert_eq!((empty.text.as_str(), empty.cursor, empty.anchor), ("", 0, 0));
+
+    // No edit session: unavailable, not an empty document.
+    let (s, _) = session("text");
+    assert!(ime_surrounding(&s).is_none());
+}
+
+#[test]
+fn ime_surrounding_is_bounded_and_refuses_a_too_wide_selection() {
+    // A long line: the query copies only a window around the caret, never the document.
+    let text = "a".repeat(20_000);
+    let (mut s, _) = editing(&text, 10_000);
+    let w = ime_surrounding(&s).expect("a collapsed caret fits");
+    assert!(w.text.len() <= MAX_IME_TEXT_BYTES, "the payload is bounded");
+    assert!(w.text.len() > 1000, "the caret keeps a useful amount of context");
+    assert!(w.text.is_char_boundary(w.cursor) && w.text.is_char_boundary(w.anchor));
+    assert_eq!(w.cursor, w.anchor);
+
+    // A selection wider than the protocol limit is unavailable, not a truncated one.
+    select(&mut s, 0, 20_000);
+    assert!(ime_surrounding(&s).is_none(), "a too-wide selection is unavailable");
+
+    // Multi-byte text at the window boundary is never split, and offsets stay on boundaries.
+    let text = "é".repeat(5_000);
+    let (s, _) = editing(&text, 2_500);
+    let w = ime_surrounding(&s).expect("a collapsed caret fits");
+    assert!(w.text.len() <= MAX_IME_TEXT_BYTES);
+    assert!(w.text.is_char_boundary(w.cursor));
+    assert_eq!(&w.text[w.cursor..w.cursor + "é".len()], "é");
+}
+
+/// A reversed selection survives a byte-count deletion: both endpoints shift by the removed
+/// characters before the selection, its direction stays reversed, and partial characters on
+/// either side stay whole.
+#[test]
+fn ime_byte_deletion_keeps_a_reversed_selection_direction() {
+    let (mut s, t) = editing_all("😀ab😀");
+    select_anchor(&mut s, 3, 1);
+    let (anchor, caret) = sel(&s);
+    assert_eq!((anchor, caret), (3, 1), "reversed before the replacement");
+
+    // Three bytes cover only part of either four-byte emoji: neither is split or removed.
+    s.execute("text.deleteSurrounding", json!({"before": 3, "after": 3, "bytes": true})).unwrap();
+    assert_text(&s, t, "😀ab😀");
+
+    // Four bytes cover each whole emoji: the selection text stays, shifted, still reversed.
+    s.execute("text.deleteSurrounding", json!({"before": 4, "after": 4, "bytes": true})).unwrap();
+    assert_text(&s, t, "ab");
+    assert_eq!(sel(&s), (2, 0), "the anchor stays after the caret");
+    let w = ime_surrounding(&s).expect("available");
+    assert_eq!((w.text.as_str(), w.cursor, w.anchor), ("ab", 0, 2), "the outgoing offsets keep the direction");
+}
+
+#[test]
+fn deselect_all_ends_the_open_edit() {
+    let (mut s, t) = editing("Hello", 5);
+    s.execute("text.insert", json!({"text": "!"})).unwrap();
+    assert_eq!(doc(&s, t).text, "Hello!");
+    s.execute("edit.deselectAll", json!({})).unwrap();
+    assert!(s.state.text_edit.is_none(), "Deselect All ends the open text edit on every route");
+    assert!(s.state.selected_layers.is_empty(), "and leaves nothing selected");
+    assert_eq!(doc(&s, t).text, "Hello!", "the text stays committed");
+    // Ending an edit is no undoable step of its own (as with text.endEdit): undo takes
+    // the typed text, it does not reopen the edit.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc(&s, t).text, "Hello", "undo reverts the typed text, not the deselection");
+    assert!(s.state.text_edit.is_none(), "undo does not reopen the edit");
+}
+
+#[test]
+fn deselect_all_keeps_an_empty_type_tool_layer() {
+    let (mut s, _keep) = session("Hello");
+    let new = s.execute("layer.newText", json!({"text": "", "position": [80.0, 80.0], "edit": true})).unwrap()["layer"].as_u64().unwrap();
+    assert!(
+        s.state.text_edit.as_ref().is_some_and(|e| e.created && e.layer == effectcraft_project::LayerId(new)),
+        "the Type tool opens the edit on its new, empty layer"
+    );
+    let before = layer_count(&s);
+    s.execute("edit.deselectAll", json!({})).unwrap();
+    assert!(s.state.text_edit.is_none());
+    assert!(s.state.selected_layers.is_empty());
+    assert_eq!(layer_count(&s), before, "an empty Type-tool layer is kept, as in After Effects");
+}
+
+#[test]
+fn duplicate_ends_an_edit_on_already_committed_text() {
+    // The engine route (MCP, control channel, script) with text that was committed before the
+    // edit opened and nothing typed inside it: the edit still ends and the copy is selected.
+    let (mut s, t) = editing("Hello", 5);
+    let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+    assert!(s.state.text_edit.is_none(), "the open edit ends on a direct edit.duplicate");
+    assert_eq!(s.state.selected_layers, vec![effectcraft_project::LayerId(copy)], "and the copy is selected");
+    assert_eq!(doc(&s, t).text, "Hello", "the committed text is kept on the original");
+    assert_eq!(doc(&s, copy).text, "Hello", "and carried by the copy");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(layer_count(&s), 1, "undo removes the copy");
+    assert!(s.state.text_edit.is_none(), "undo does not reopen the edit");
+}
+
+#[test]
+fn duplicate_during_an_edit_copies_the_layer_not_a_selected_property_group() {
+    use effectcraft_project::LayerId;
+    // Opening the editor by command, as a Type-tool click does, keeps the property selection, so
+    // an effect, shape item or text animator can still be selected while the user types.
+    for what in ["effect", "shape item", "text animator"] {
+        let (mut s, t) = session("Hello");
+        let (owner, path) = match what {
+            "effect" => {
+                s.execute("effect.apply", json!({"layers": [t], "effect": "Gaussian Blur"})).unwrap();
+                (t, "effects")
+            }
+            "shape item" => (s.execute("layer.newShape", json!({"kind": "rect"})).unwrap()["layer"].as_u64().unwrap(), "contents"),
+            _ => {
+                s.execute("layer.addTextAnimator", json!({"layer": t, "properties": ["opacity"]})).unwrap();
+                (t, "text/animators")
+            }
+        };
+        let items =
+            |s: &Session| s.active_comp().unwrap().layer(LayerId(owner)).unwrap().props.group(path).unwrap().groups().map(|g| g.uid).collect::<Vec<_>>();
+        let item = items(&s)[0];
+        let n = items(&s).len();
+        let before = layer_count(&s);
+        s.execute("prop.select", json!({"layer": owner, "prop": item})).unwrap();
+        begin_edit_at(&mut s, t, 5);
+        let r = s.execute("edit.duplicate", json!({})).unwrap();
+        assert!(s.state.text_edit.is_none(), "{what}: Duplicate ends the open edit");
+        assert_eq!(items(&s).len(), n, "{what}: the selected {what} is not duplicated");
+        assert_eq!(layer_count(&s), before + 1, "{what}: the edited layer is");
+        assert_eq!(s.state.selected_layers, vec![LayerId(r[0].as_u64().unwrap())], "{what}: and its copy is selected");
+        // The selection the edit passed over goes with it: the next Duplicate copies the selected
+        // copy rather than reaching back to the original's {what}.
+        s.execute("edit.duplicate", json!({})).unwrap();
+        assert_eq!(items(&s).len(), n, "{what}: a second Duplicate leaves the original's {what} alone");
+        assert_eq!(layer_count(&s), before + 2, "{what}: and copies the copy");
+        // With no edit open, the selected item keeps its precedence over the layers.
+        s.execute("prop.select", json!({"layer": owner, "prop": item})).unwrap();
+        s.execute("edit.duplicate", json!({})).unwrap();
+        assert_eq!(items(&s).len(), n + 1, "{what}: outside an edit Duplicate copies the selected {what}");
+        assert_eq!(layer_count(&s), before + 2, "{what}: and no layer");
+    }
+}
+
+#[test]
+fn duplicate_during_an_edit_leaves_no_key_or_vertex_selected_on_the_original() {
+    use effectcraft_project::LayerId;
+    // Opening the editor keeps the keyframe and mask-vertex selection too. Once the copy takes the
+    // selection, Clear deletes the copy, not a key or a vertex of the original.
+    for what in ["keyframe", "mask vertex"] {
+        let (mut s, t) = session("Hello");
+        let mask = match what {
+            "keyframe" => {
+                for time in [0.0, 1.0] {
+                    s.execute("prop.addKey", json!({"layer": t, "path": "transform/opacity", "time": time, "value": 50})).unwrap();
+                }
+                s.execute("keys.select", json!({"keys": [{"layer": t, "path": "transform/opacity", "time": 0.0}]})).unwrap();
+                None
+            }
+            // The Pen leaves the new mask's last vertex selected.
+            _ => Some(s.execute("mask.new", json!({"layer": t, "vertices": [[0, 0], [40, 0], [40, 40]], "closed": true})).unwrap()["mask"].as_u64().unwrap()),
+        };
+        let original = |s: &Session| {
+            let l = s.active_comp().unwrap().layer(LayerId(t)).unwrap();
+            match mask {
+                None => l.props.prop("transform/opacity").unwrap().keys.len(),
+                Some(m) => l.props.find_group(m).unwrap().get("path").unwrap().value.as_path().unwrap().vertices.len(),
+            }
+        };
+        let (n, before) = (original(&s), layer_count(&s));
+        begin_edit_at(&mut s, t, 5);
+        let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+        assert_eq!(s.state.selected_layers, vec![LayerId(copy)], "{what}: the copy is selected");
+        s.execute("edit.clear", json!({})).unwrap();
+        assert_eq!(layer_count(&s), before, "{what}: Clear deletes the selected copy");
+        assert_eq!(original(&s), n, "{what}: and leaves the original's {what} alone");
+    }
+}
+
+#[test]
+fn duplicate_during_an_edit_copies_the_edited_layer_after_another_is_selected() {
+    use effectcraft_project::LayerId;
+    // An engine route (MCP, control channel, script) can select another layer while the edit
+    // stays open. The implicit Duplicate still means the edited layer, as Clear does; a named
+    // target keeps its meaning.
+    let (mut s, t) = session("Hello");
+    let other = s.execute("layer.newText", json!({"text": "Other"})).unwrap()["layer"].as_u64().unwrap();
+    begin_edit_at(&mut s, t, 5);
+    s.execute("layer.select", json!({"layer": other})).unwrap();
+    assert!(s.state.text_edit.as_ref().is_some_and(|e| e.layer == LayerId(t)), "selecting another layer leaves the edit open");
+    let before = layer_count(&s);
+    let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+    assert!(s.state.text_edit.is_none(), "Duplicate ends the open edit");
+    assert_eq!(layer_count(&s), before + 1, "one layer is copied");
+    assert_eq!(doc(&s, copy).text, "Hello", "the edited layer is copied, not the newly selected one");
+    assert_eq!(s.state.selected_layers, vec![LayerId(copy)], "and its copy is selected");
+    // Null parameters name no layer, as everywhere else layers are read.
+    for unnamed in [json!({"layers": null}), json!({"layer": null})] {
+        begin_edit_at(&mut s, t, 5);
+        s.execute("layer.select", json!({"layer": other})).unwrap();
+        let copy = s.execute("edit.duplicate", unnamed.clone()).unwrap()[0].as_u64().unwrap();
+        assert_eq!(doc(&s, copy).text, "Hello", "{unnamed}: the edited layer is copied");
+    }
+    begin_edit_at(&mut s, t, 5);
+    let named = s.execute("edit.duplicate", json!({"layer": other})).unwrap()[0].as_u64().unwrap();
+    assert_eq!(doc(&s, named).text, "Other", "a named layer is copied as named");
+}
+
+#[test]
+fn duplicate_during_an_edit_with_nothing_selected_copies_the_edited_layer() {
+    use effectcraft_project::LayerId;
+    // An engine route can also clear the selection while the edit stays open. Duplicate stays
+    // available, since its unnamed target is the edited layer, not the selection.
+    let (mut s, _) = editing("Hello", 5);
+    s.execute("layer.select", json!({"layers": []})).unwrap();
+    assert!(s.state.selected_layers.is_empty() && s.state.text_edit.is_some(), "the edit is open with nothing selected");
+    let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+    assert!(s.state.text_edit.is_none(), "Duplicate ends the open edit");
+    assert_eq!(doc(&s, copy).text, "Hello", "and copies the edited layer");
+    assert_eq!(s.state.selected_layers, vec![LayerId(copy)], "which is selected");
+    // With no edit open, nothing selected still means nothing to duplicate.
+    s.execute("layer.select", json!({"layers": []})).unwrap();
+    let before = layer_count(&s);
+    assert!(s.execute("edit.duplicate", json!({})).is_err(), "outside an edit Duplicate needs a selection");
+    assert_eq!(layer_count(&s), before, "and copies nothing");
+}
+
+#[test]
+fn duplicate_ends_the_open_edit_and_selects_the_copy() {
+    let (mut s, t) = editing("Hello", 5);
+    s.execute("text.insert", json!({"text": "!"})).unwrap();
+    assert_eq!(doc(&s, t).text, "Hello!");
+    let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+    // A deselected layer never keeps an open text edit: Duplicate commits the edit through the
+    // same route as text.endEdit before the selection moves, so every route (menu, shortcut,
+    // palette, MCP, script) leaves one final state.
+    assert!(s.state.text_edit.is_none(), "Duplicate ends the open text edit, as Deselect All does");
+    assert_eq!(s.state.selected_layers, vec![effectcraft_project::LayerId(copy)], "and selects the copy");
+    assert_eq!(doc(&s, t).text, "Hello!", "the original keeps the typed text");
+    assert_eq!(doc(&s, copy).text, "Hello!", "the copy carries it too");
+    // The edit ending is no undoable step of its own (as with text.endEdit): undo takes the
+    // duplicate, it does not reopen the edit or undo the typing.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(layer_count(&s), 1, "undo removed the copy");
+    assert_eq!(doc(&s, t).text, "Hello!", "the typed text stays committed");
+    assert!(s.state.text_edit.is_none(), "undo does not reopen the edit");
+    // With no open edit Duplicate is untouched by all of this: same behavior, no extra steps.
+    s.execute("edit.duplicate", json!({"layers": [t]})).unwrap();
+    assert_eq!(layer_count(&s), 2, "a plain duplicate still duplicates");
+    assert!(s.state.text_edit.is_none());
+}
+
+#[test]
+fn duplicate_of_an_empty_type_tool_layer_ends_the_edit_and_copies_it() {
+    use effectcraft_project::LayerId;
+    let (mut s, _keep) = session("Hello");
+    let new = s.execute("layer.newText", json!({"text": "", "position": [80.0, 80.0], "edit": true})).unwrap()["layer"].as_u64().unwrap();
+    assert!(s.state.text_edit.as_ref().is_some_and(|e| e.created && e.layer == LayerId(new)), "the Type tool opens the edit on its new, empty layer");
+    let before = layer_count(&s);
+    let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+    assert!(s.state.text_edit.is_none(), "the edit ends the way text.endEdit ends it");
+    assert_eq!(layer_count(&s), before + 1, "the empty layer is kept, as text.endEdit keeps it, and copied");
+    assert_eq!(s.state.selected_layers, vec![LayerId(copy)], "and the copy is selected");
+}
+
+fn layer_name(s: &Session, t: u64) -> String {
+    s.active_comp().unwrap().layer(effectcraft_project::LayerId(t)).unwrap().name.clone()
+}
+
+/// Replace the text with `text` in the on-canvas editor (everything selected, typed, committed).
+fn retype(s: &mut Session, t: u64, text: &str) {
+    begin_edit(s, t);
+    s.execute("text.insert", json!({"text": text})).unwrap();
+    s.execute("text.endEdit", json!({})).unwrap();
+}
+
+/// #3233: a text layer's name follows its Source Text, edited on canvas or by `layer.setText`,
+/// until the user renames it (After Effects). A user name stays, even one that starts with
+/// "Text", and so does a copy's; renaming to an empty name follows the text again.
+#[test]
+fn a_text_layer_name_follows_its_text_until_renamed() {
+    let (mut s, t) = session("Hello");
+    assert_eq!(layer_name(&s, t), "Hello");
+    retype(&mut s, t, "World");
+    assert_eq!(layer_name(&s, t), "World", "a new text layer follows its text");
+    s.execute("layer.setText", json!({"layer": t, "text": "Again"})).unwrap();
+    assert_eq!(layer_name(&s, t), "Again");
+    s.execute("layer.rename", json!({"layer": t, "name": "Text Title"})).unwrap();
+    s.execute("layer.setText", json!({"layer": t, "text": "Changed"})).unwrap();
+    assert_eq!(layer_name(&s, t), "Text Title", "layer.setText keeps the user's name");
+    retype(&mut s, t, "Typed");
+    assert_eq!(layer_name(&s, t), "Text Title", "typing keeps the user's name");
+    s.execute("layer.select", json!({"layers": [t]})).unwrap();
+    let copy = s.execute("edit.duplicate", json!({})).unwrap()[0].as_u64().unwrap();
+    let copy_name = layer_name(&s, copy);
+    s.execute("layer.setText", json!({"layer": copy, "text": "Copied"})).unwrap();
+    assert_eq!(layer_name(&s, copy), copy_name, "a copy keeps the user's name too");
+    // Renaming to an empty name: the name is the text's again, and follows it.
+    s.execute("layer.rename", json!({"layer": t, "name": ""})).unwrap();
+    assert_eq!(layer_name(&s, t), "Typed", "an empty name shows the text");
+    retype(&mut s, t, "Followed");
+    assert_eq!(layer_name(&s, t), "Followed", "and follows it again");
+    // Committing the unchanged name (Enter, Enter) does not stop the following.
+    s.execute("layer.rename", json!({"layer": t, "name": "Followed"})).unwrap();
+    s.execute("layer.setText", json!({"layer": t, "text": "Still"})).unwrap();
+    assert_eq!(layer_name(&s, t), "Still");
+    // A name given in Layer Settings is the user's too. The UI offers Layer Settings only for
+    // solids, nulls, cameras and lights (as After Effects does); this guards the command, which
+    // agents can call on any layer.
+    s.execute("layer.settings", json!({"layer": t, "name": "Settings Name"})).unwrap();
+    s.execute("layer.setText", json!({"layer": t, "text": "Later"})).unwrap();
+    assert_eq!(layer_name(&s, t), "Settings Name", "Layer Settings names it for good");
+    // An empty Layer Settings name follows the text again, as `layer.rename` does.
+    s.execute("layer.settings", json!({"layer": t, "name": ""})).unwrap();
+    assert_eq!(layer_name(&s, t), "Later", "an empty Layer Settings name shows the text");
+    s.execute("layer.setText", json!({"layer": t, "text": "Follows"})).unwrap();
+    assert_eq!(layer_name(&s, t), "Follows", "and follows it again");
+    // A layer given a name when it is made does not follow.
+    let named = s.execute("layer.newText", json!({"text": "Body", "name": "Caption"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setText", json!({"layer": named, "text": "Other"})).unwrap();
+    assert_eq!(layer_name(&s, named), "Caption");
+}
+
+/// #3233: After Effects breaks paragraphs with a bare carriage return; the name is the first
+/// paragraph, without the break, and an older layer named after it counts as following.
+#[test]
+fn a_text_layer_name_ends_at_a_bare_carriage_return() {
+    let (mut s, t) = session("A\rB");
+    assert_eq!(layer_name(&s, t), "A");
+    s.execute("layer.setText", json!({"layer": t, "text": "C\rD"})).unwrap();
+    assert_eq!(layer_name(&s, t), "C");
+    retype(&mut s, t, "E\rF");
+    assert_eq!(layer_name(&s, t), "E");
+    let cid = s.active_comp_id().unwrap();
+    let l = std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(effectcraft_project::LayerId(t)).unwrap();
+    l.name = "Para1".into();
+    l.name_follows_text = None;
+    l.props.prop_mut("text/sourceText").unwrap().value = effectcraft_keyframe::Value::Text(Box::new(TextDoc::plain("Para1\rPara2")));
+    s.execute("layer.setText", json!({"layer": t, "text": "Next\rLine"})).unwrap();
+    assert_eq!(layer_name(&s, t), "Next", "an older layer named after its first paragraph follows");
+}
+
+/// #3233: projects saved before the state was recorded load without it; there a name that is
+/// the text's, empty, or the default "Text"/"Text 2"… follows the text, any other name stays.
+#[test]
+fn older_text_layers_without_the_name_state_follow_as_before() {
+    let (mut s, t) = session("Hello");
+    let mut v = serde_json::to_value(s.active_comp().unwrap().layer(effectcraft_project::LayerId(t)).unwrap()).unwrap();
+    v.as_object_mut().unwrap().remove("name_follows_text");
+    let old: effectcraft_project::Layer = serde_json::from_value(v).unwrap();
+    assert_eq!(old.name_follows_text, None, "an older project has no state");
+    for (name, follows) in [("Hello", true), ("", true), ("Text", true), ("Text 3", true), ("Text Title", false), ("Text 3b", false), ("Title", false)] {
+        let l = effectcraft_project::Layer { name: name.into(), ..old.clone() };
+        assert_eq!(l.name_follows_text("Hello"), follows, "{name:?}");
+    }
+    let legacy = |s: &mut Session, name: &str| {
+        let cid = s.active_comp_id().unwrap();
+        let l = std::sync::Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(effectcraft_project::LayerId(t)).unwrap();
+        l.name = name.into();
+        l.name_follows_text = None;
+    };
+    legacy(&mut s, "Hello");
+    s.execute("layer.setText", json!({"layer": t, "text": "World"})).unwrap();
+    assert_eq!(layer_name(&s, t), "World", "a name equal to the text follows it");
+    legacy(&mut s, "Title");
+    retype(&mut s, t, "Typed");
+    assert_eq!(layer_name(&s, t), "Title", "another name stays");
+}
diff --git a/crates/engine/src/tests_3d.rs b/crates/engine/src/tests/three_d.rs
similarity index 68%
rename from crates/engine/src/tests_3d.rs
rename to crates/engine/src/tests/three_d.rs
index cf9773f9a..5b5af594d 100644
--- a/crates/engine/src/tests_3d.rs
+++ b/crates/engine/src/tests/three_d.rs
@@ -1,6 +1,6 @@
 //! 3D commands: cameras, lights, views, camera tools (with undo/redo), and the 3D demo comp.
 
-use effectcraft_project::{AutoOrient, LayerSource, LightKind};
+use effectcraft_project::{AutoOrient, LayerSource, LightKind, Renderer};
 use effectcraft_render::three_d::View3D;
 use serde_json::json;
 
@@ -26,7 +26,8 @@ fn auto_orient_command() {
     assert!(!effectcraft_render::three_d::camera::is_two_node(&s.active_comp().unwrap().layers[0]));
 }
 
-fn layer_count(s: &Session) -> usize {
+/// Layers in the active comp.
+pub(crate) fn layer_count(s: &Session) -> usize {
     s.active_comp().unwrap().layers.len()
 }
 
@@ -131,6 +132,102 @@ fn environment_light_is_listed_and_takes_a_source_layer() {
     assert_eq!(prop(&s, env, "lightOptions/source").as_layer(), None);
 }
 
+/// Deleting the layer a Source points at leaves no dangling id: "None" means the comp's
+/// Environment Layer, and a dead id rendered as nothing at all (#2153).
+#[test]
+fn deleting_a_source_layer_clears_the_reference() {
+    let mut s = session();
+    let sky = s.execute("layer.newSolid", json!({"width": 256, "height": 128, "name": "Sky"})).unwrap()["layer"].as_u64().unwrap();
+    let env = s.execute("layer.newLight", json!({"kind": "Environment", "name": "Env"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": env, "path": "lightOptions/source", "value": sky})).unwrap();
+    assert_eq!(prop(&s, env, "lightOptions/source").as_layer(), Some(sky));
+    s.execute("edit.clear", json!({"layers": [sky]})).unwrap();
+    assert_eq!(prop(&s, env, "lightOptions/source").as_layer(), None, "the reference goes with the layer");
+    // One history step with the delete, so undo brings both back.
+    s.undo();
+    assert_eq!(prop(&s, env, "lightOptions/source").as_layer(), Some(sky));
+    assert!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(sky)).is_some());
+}
+
+/// #2436: only the Advanced 3D renderer lights with Environment lights, and new comps are
+/// Classic 3D, so one had no visible effect. Adding one (or changing a light into one) switches
+/// the comp to Advanced 3D (in the same undo step, with a toast), as After Effects does.
+#[test]
+fn environment_lights_switch_classic_comps_to_advanced_3d() {
+    let toasts = |s: &mut Session| -> Vec<String> {
+        s.drain_events().into_iter().filter_map(|e| if let crate::Event::Toast { message, .. } = e { Some(message) } else { None }).collect()
+    };
+    let mut s = session();
+    let text = s.execute("layer.newText", json!({"text": "Hi"})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Classic3D);
+    toasts(&mut s);
+    let r = s.execute("layer.newLight", json!({"kind": "Environment"})).unwrap();
+    assert_eq!(r["advanced3d"], true);
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Advanced3D);
+    // As with Composition Settings: the text layer gets Geometry Options.
+    assert!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(text)).unwrap().props.sub("geometryOptions").is_some());
+    assert!(toasts(&mut s).iter().any(|m| m.contains("Advanced 3D")));
+    // A second Environment light leaves the comp (and the user) alone.
+    s.execute("layer.newLight", json!({"kind": "Environment"})).unwrap();
+    assert!(toasts(&mut s).is_empty());
+    // Undoing the creations takes the lights and the switch back together.
+    s.undo();
+    s.undo();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Classic3D);
+    assert_eq!(layer_count(&s), 1);
+    // Changing a light to Environment switches too, and undoes with the type.
+    let spot = s.execute("layer.newLight", json!({"kind": "Spot"})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Classic3D);
+    s.execute("layer.lightSettings", json!({"layer": spot, "kind": "Environment"})).unwrap();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Advanced3D);
+    s.undo();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Classic3D);
+    assert_eq!(s.active_comp().unwrap().layer(effectcraft_project::LayerId(spot)).unwrap().source, LayerSource::Light { kind: LightKind::Spot });
+    // Other light types never switch it.
+    s.execute("layer.newLight", json!({"kind": "Point"})).unwrap();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Classic3D);
+    // Switching back to Classic 3D with an Environment light in the comp explains itself.
+    let env = s.execute("layer.newLight", json!({"kind": "Environment"})).unwrap()["layer"].as_u64().unwrap();
+    toasts(&mut s);
+    s.execute("comp.renderer", json!({"renderer": "classic3d"})).unwrap();
+    assert!(toasts(&mut s).iter().any(|m| m.contains("Environment light")), "the Classic 3D limit is explained");
+    // Editing that Environment light (no type change) leaves the renderer the user chose.
+    s.execute("layer.lightSettings", json!({"layer": env, "intensity": 80})).unwrap();
+    assert_eq!(s.active_comp().unwrap().renderer, Renderer::Classic3D, "an ordinary edit doesn't re-switch");
+    assert!(toasts(&mut s).is_empty(), "and doesn't toast either");
+}
+
+/// An Environment light takes Casts Shadows (with Shadow Darkness and Diffusion) like every
+/// other light — the Light Settings dialog offers them for all types but Ambient — and keeps no
+/// Falloff, which an environment light shining from every direction has no use for (#2436).
+#[test]
+fn environment_light_takes_shadow_options_but_no_falloff() {
+    let mut s = session();
+    let env = s.execute("layer.newLight", json!({"kind": "Environment", "castsShadows": true, "shadowDarkness": 60, "shadowDiffusion": 12})).unwrap()["layer"]
+        .as_u64()
+        .unwrap();
+    assert!(prop(&s, env, "lightOptions/castsShadows").as_bool());
+    assert_eq!(prop(&s, env, "lightOptions/shadowDarkness").as_f64(), 60.0);
+    assert_eq!(prop(&s, env, "lightOptions/shadowDiffusion").as_f64(), 12.0);
+    assert!(
+        s.active_comp().unwrap().layer(effectcraft_project::LayerId(env)).unwrap().props.prop("lightOptions/falloff").is_none(),
+        "an environment light has no Falloff"
+    );
+    // The shadow values carry over when the type changes, both ways.
+    s.execute("layer.lightSettings", json!({"layer": env, "kind": "Spot", "coneAngle": 70})).unwrap();
+    assert!(prop(&s, env, "lightOptions/castsShadows").as_bool());
+    assert_eq!(prop(&s, env, "lightOptions/shadowDarkness").as_f64(), 60.0);
+    assert_eq!(prop(&s, env, "lightOptions/coneAngle").as_f64(), 70.0);
+    s.execute("layer.lightSettings", json!({"layer": env, "kind": "Environment"})).unwrap();
+    assert!(prop(&s, env, "lightOptions/castsShadows").as_bool());
+    assert_eq!(prop(&s, env, "lightOptions/source").as_layer(), None, "back to Environment: it has a Source again");
+    s.undo();
+    assert!(
+        s.active_comp().unwrap().layer(effectcraft_project::LayerId(env)).unwrap().props.prop("lightOptions/coneAngle").is_some(),
+        "back to Spot: it has a Cone Angle again"
+    );
+}
+
 #[test]
 fn three_d_switch_undo_redo() {
     let mut s = session();
diff --git a/crates/engine/src/tests_timeline.rs b/crates/engine/src/tests/timeline.rs
similarity index 88%
rename from crates/engine/src/tests_timeline.rs
rename to crates/engine/src/tests/timeline.rs
index 29168e17a..55475eef3 100644
--- a/crates/engine/src/tests_timeline.rs
+++ b/crates/engine/src/tests/timeline.rs
@@ -298,6 +298,25 @@ fn interpolation_dialog_temporal_spatial_and_roving() {
     assert_ne!(prop(&s, l, "transform/position").keys[0].out_interp, Interp::Hold);
 }
 
+/// Editing another key's value or time keeps the roving key at its share of the path (#1284: the
+/// roving key went back to where it was after edits to other keys).
+#[test]
+fn roving_key_follows_value_and_time_edits_to_other_keys() {
+    let (mut s, l) = setup();
+    animate(&mut s, l, "transform/position", &[(0.0, json!([0, 0])), (0.3, json!([300, 0])), (2.0, json!([400, 0]))]);
+    let uid = prop(&s, l, "transform/position").uid;
+    s.execute("keys.select", json!({"keys": [{"layer": l, "prop": uid, "time": 0.3}]})).unwrap();
+    s.execute("keys.interpolation", json!({"roving": true})).unwrap();
+    let roving_at = |s: &Session| prop(s, l, "transform/position").keys[1].time.seconds();
+    assert!((roving_at(&s) - 1.5).abs() < 0.01, "start: {}", roving_at(&s));
+    // The last key's value moves to 800 px: the path is 300 + 500 px, so the roving key is at 300 / 800.
+    s.execute("keys.set", json!({"layer": l, "path": "transform/position", "time": 2.0, "value": [800, 0]})).unwrap();
+    assert!((roving_at(&s) - 0.75).abs() < 0.02, "value edit: {}", roving_at(&s));
+    // The last key moves to 3 s: the same 300 / 800 share of 3 s.
+    s.execute("keys.set", json!({"layer": l, "path": "transform/position", "time": 2.0, "newTime": 3.0})).unwrap();
+    assert!((roving_at(&s) - 1.125).abs() < 0.02, "time edit: {}", roving_at(&s));
+}
+
 #[test]
 fn graph_editor_key_and_handle_edits() {
     let (mut s, l) = setup();
@@ -325,6 +344,34 @@ fn graph_editor_key_and_handle_edits() {
     assert_eq!(prop(&s, l, "transform/opacity").keys[0].out_interp, Interp::Linear);
 }
 
+#[test]
+fn graph_editor_ease_edits_reject_a_locked_layer() {
+    let (mut s, l) = setup();
+    animate(&mut s, l, "transform/opacity", &[(0.0, json!(0)), (1.0, json!(100)), (2.0, json!(0))]);
+    select_prop_keys(&mut s, l, "transform/opacity");
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "locked", "value": true})).unwrap();
+    let before = prop(&s, l, "transform/opacity");
+    let selected = s.state.selected_keys.clone();
+    let undo = s.history.undo.len();
+    for side in ["in", "out"] {
+        let error =
+            s.execute("keys.setEase", json!({"layer": l, "path": "transform/opacity", "time": 1.0, "side": side, "speed": 200, "influence": 60})).unwrap_err();
+        assert!(error.to_string().contains("locked"), "{error}");
+        assert_eq!(prop(&s, l, "transform/opacity").keys, before.keys);
+        assert_eq!(s.state.selected_keys, selected);
+        assert_eq!(s.history.undo.len(), undo);
+    }
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "locked", "value": false})).unwrap();
+    s.execute("keys.setEase", json!({"layer": l, "path": "transform/opacity", "time": 1.0, "side": "out", "speed": 200, "influence": 60})).unwrap();
+    let after = prop(&s, l, "transform/opacity");
+    assert_eq!(after.keys[1].out_interp, Interp::Bezier);
+    assert_eq!(after.keys[1].out_ease[0].speed, 200.0);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(prop(&s, l, "transform/opacity").keys, before.keys);
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(prop(&s, l, "transform/opacity").keys, after.keys);
+}
+
 #[test]
 fn convert_expression_to_keyframes_on_a_reversed_layer_keeps_values() {
     let (mut s, l) = setup();
@@ -613,6 +660,51 @@ fn time_set_reads_frames_style_digits_as_a_frame_count() {
     assert_eq!(r["display"], "00100");
 }
 
+/// Project Settings ▸ Time Display Style ▸ Frames ▸ Frame Count: Start at 0 / Start at 1
+/// (`app.project.framesCountType`), undoable and saved with the project (#1807).
+#[test]
+fn project_settings_frame_count_starts_at_one() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Count", "width": 64, "height": 64, "frameRate": 30, "duration": 2})).unwrap();
+    s.execute("file.projectSettings", json!({"timeDisplay": "frames"})).unwrap();
+    assert_eq!(s.execute("time.set", json!({"frame": 12})).unwrap()["display"], "00012");
+
+    s.execute("file.projectSettings", json!({"frameStart": 1})).unwrap();
+    assert_eq!(s.execute("time.set", json!({"frame": 12})).unwrap()["display"], "00013");
+    for bad in [json!(2), json!(-1), json!("one")] {
+        assert!(s.execute("file.projectSettings", json!({"frameStart": bad})).is_err(), "{bad}");
+    }
+    assert_eq!(s.project.settings.frame_start, 1);
+
+    let dir = std::env::temp_dir().join(format!("ec-frame-start-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("count.ecproj").to_string_lossy().to_string();
+    s.execute("file.save", json!({"path": path})).unwrap();
+    let mut reopened = Session::default();
+    reopened.execute("file.open", json!({"path": path})).unwrap();
+    let _ = std::fs::remove_dir_all(dir);
+    assert_eq!(reopened.project.settings.frame_start, 1);
+
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.execute("time.set", json!({"frame": 12})).unwrap()["display"], "00012");
+}
+
+/// A Duration is a count of frames: Start at 1 and the comp's Start Timecode number positions,
+/// not lengths (#1807).
+#[test]
+fn durations_ignore_the_frame_count_and_the_start_timecode() {
+    use crate::commands::time::display_duration;
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Len", "width": 64, "height": 64, "frameRate": 30, "duration": 10, "startTimecode": "0:00:01:00"})).unwrap();
+    s.execute("file.projectSettings", json!({"frameStart": 1})).unwrap();
+    let comp = s.active_comp().unwrap().clone();
+    let len = comp.frame_rate.tick_of(30);
+    for (style, want) in [("frames", "00030"), ("feet35", "0001+14"), ("timecode", "0:00:01:00")] {
+        s.execute("file.projectSettings", json!({"timeDisplay": style})).unwrap();
+        assert_eq!(display_duration(&s, &comp, len), want, "{style}");
+    }
+}
+
 #[test]
 fn separate_dimensions_split_and_rejoin() {
     let (mut s, l) = setup();
@@ -720,6 +812,59 @@ fn pick_whip_generates_ae_reference_expressions() {
     assert!(s.execute("prop.pickWhip", json!({"layer": l, "path": "transform/opacity", "target": {"layer": l, "path": "transform/opacity"}})).is_err());
 }
 
+/// #1072: an Alt pick whip (`byIndex`) selects an effect's properties by their index,
+/// `effect("Color Control")(1)`, its place among its group's children (nested groups too). The
+/// effect keeps its name; other properties, dimensions, insertion into an expression and match
+/// names (Compact English off) work as before. (`effectcraft-host`'s `pick_whip` tests check the
+/// references read the right values.)
+#[test]
+fn pick_whip_by_index_selects_effect_properties_by_their_index() {
+    let (mut s, l) = setup();
+    let o = s.execute("layer.newSolid", json!({"name": "Other", "color": "#00ff00"})).unwrap()["layer"].as_u64().unwrap();
+    for fx in ["Color Control", "Fractal Noise", "Point Control"] {
+        s.execute("effect.apply", json!({"layer": o, "effect": fx})).unwrap();
+    }
+    // Fractal Noise ▸ Transform ▸ Scale, by its places in the property tree.
+    let fx = s.active_comp().unwrap().layer(effectcraft_project::LayerId(o)).unwrap().props.sub("effects").unwrap().groups().nth(1).unwrap().clone();
+    let group = fx.children.iter().position(|c| c.match_id() == "transform").unwrap() + 1;
+    let scale = fx.sub("transform").unwrap().children.iter().position(|c| c.match_id() == "scale").unwrap() + 1;
+    let whip = |s: &mut Session, path: &str, target: Value, extra: Value| {
+        let mut p = json!({"layer": l, "path": path, "target": target, "byIndex": true});
+        p.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+        s.execute("prop.pickWhip", p).unwrap()
+    };
+    let other = "thisComp.layer(\"Other\")";
+    let undo = s.history.undo.len();
+    assert_eq!(
+        whip(&mut s, "transform/rotation", json!({"layer": o, "path": "effects/#1/color"}), json!({})),
+        json!(format!("{other}.effect(\"Color Control\")(1)[0]")),
+        "a colour into one value: its first"
+    );
+    assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
+    let nested = format!("{other}.effect(\"Fractal Noise\")({group})({scale})");
+    assert_eq!(whip(&mut s, "transform/rotation", json!({"layer": o, "path": "effects/#2/transform/scale"}), json!({})), json!(nested));
+    assert_eq!(
+        whip(&mut s, "transform/opacity", json!({"layer": o, "path": "effects/#3/point", "dimension": 1}), json!({})),
+        json!(format!("{other}.effect(\"Point Control\")(1)[1]"))
+    );
+    assert_eq!(
+        whip(&mut s, "transform/rotation", json!({"layer": o, "path": "effects/#2/transform/scale"}), json!({"expression": "1 + ", "range": [4, 4]})),
+        json!(format!("1 + {nested}")),
+        "inserted at the cursor"
+    );
+    assert_eq!(
+        whip(&mut s, "transform/opacity", json!({"layer": o, "path": "transform/opacity"}), json!({})),
+        json!(format!("{other}.transform.opacity")),
+        "only an effect's properties go by index"
+    );
+    // Match names (Compact English off): the effect by its match name, its properties by index.
+    s.execute("prefs.set", json!({"key": "general.expressionPickWhipCompact", "value": false})).unwrap();
+    let e = whip(&mut s, "transform/rotation", json!({"layer": o, "path": "effects/#2/transform/scale"}), json!({}));
+    assert!(e.as_str().unwrap().ends_with(&format!("({group})({scale})")), "{e}");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(prop(&s, l, "transform/rotation").expr.unwrap().text, format!("1 + {nested}"), "one undo per pick");
+}
+
 /// #407: Reset without a value gives a property its own default (a Transform property's, an
 /// effect parameter's) besides removing its keyframes and expression.
 #[test]
@@ -1385,3 +1530,29 @@ fn a_typed_component_applies_only_that_component_to_the_selected_layers() {
     s.execute("prop.set", json!({"layer": a, "prop": uid, "value": [1.0, 2.0, 3.0], "selected": true})).unwrap();
     assert_eq!(pos(&s, c), vec![1.0, 2.0, 3.0]);
 }
+
+/// #2485: linked Audio Levels typed with several layers selected: each takes the typed Left, and
+/// its Right moves by its own change, so every layer keeps its own stereo balance.
+#[test]
+fn a_typed_component_moves_its_follow_components_by_each_layers_own_change() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Sound", "width": 64, "height": 36, "duration": 4})).unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    let a = s.execute("layer.addItem", json!({"item": "Sound"})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.addItem", json!({"item": "Sound"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "audio/levels", "value": [-6.0, -12.0]})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "audio/levels", "value": [-20.0, -30.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [a, b]})).unwrap();
+    let uid = prop(&s, a, "audio/levels").uid;
+    let undo = s.history.undo.len();
+    s.execute_checked("prop.set", json!({"layer": a, "prop": uid, "value": [-3.0, -9.0], "selected": true, "dims": [0], "follow": [1]})).unwrap();
+    assert_eq!(prop(&s, a, "audio/levels").value.components(), vec![-3.0, -9.0]);
+    assert_eq!(prop(&s, b, "audio/levels").value.components(), vec![-3.0, -13.0], "B rises 17 dB on both channels");
+    assert_eq!(s.history.undo.len(), undo + 1, "one undo step");
+
+    // Keyed at a time other than the CTI: B's change is measured on its key there.
+    animate(&mut s, b, "audio/levels", &[(0.0, json!([-20.0, -30.0])), (1.0, json!([-10.0, -40.0]))]);
+    s.execute("prop.set", json!({"layer": a, "prop": uid, "value": [-4.0, -10.0], "time": 1.0, "selected": true, "dims": [0], "follow": [1]})).unwrap();
+    let keys: Vec<Vec<f64>> = prop(&s, b, "audio/levels").keys.iter().map(|k| k.value.components()).collect();
+    assert_eq!(keys, vec![vec![-20.0, -30.0], vec![-4.0, -34.0]], "B's 1 s key rises 6 dB on both channels");
+}
diff --git a/crates/engine/src/tests_timeline_interchange.rs b/crates/engine/src/tests/timeline_interchange.rs
similarity index 87%
rename from crates/engine/src/tests_timeline_interchange.rs
rename to crates/engine/src/tests/timeline_interchange.rs
index b32e19c49..0ebfa2316 100644
--- a/crates/engine/src/tests_timeline_interchange.rs
+++ b/crates/engine/src/tests/timeline_interchange.rs
@@ -1,5 +1,5 @@
 //! File ▸ Import / Export ▸ Adobe Premiere Pro Project… (timeline interchange) through the command
-//! registry, without media decoding (pixels: `crates/host/tests/timeline_interop.rs`).
+//! registry, without media decoding (pixels: `crates/host/tests/it/timeline_interop.rs`).
 
 use serde_json::json;
 
@@ -52,6 +52,14 @@ fn export_and_reimport_timeline_commands() {
     let r = s.execute_checked("file.exportTimeline", json!({"comp": main, "path": tmp("NoExt"), "format": "otio", "prerender": "none"})).unwrap();
     assert!(r["path"].as_str().unwrap().ends_with("NoExt.otio"));
     assert!(s.execute_checked("file.exportTimeline", json!({"path": tmp("x.xml"), "prerender": "sometimes"})).is_err());
+    // In the background (the export dialog, #2269): a job, then the same file and result.
+    let path = tmp("Background.xml");
+    let r = s.execute_checked("file.exportTimeline", json!({"comp": main, "path": path, "background": true})).unwrap();
+    assert!(r["job"].is_string(), "{r}");
+    s.wait_jobs();
+    let done = s.job_log.last().unwrap();
+    assert_eq!((done.status.as_str(), done.result["path"].as_str()), ("done", Some(path.as_str())));
+    assert!(std::fs::read_to_string(&path).unwrap().contains("<xmeml"));
     assert!(s.execute_checked("file.importTimeline", json!({"path": "/nope/a.prproj"})).is_err());
     let formats = s.execute("file.timelineFormats", json!({})).unwrap();
     assert_eq!(formats.as_array().unwrap().len(), 6);
diff --git a/crates/engine/src/tests_track.rs b/crates/engine/src/tests/track.rs
similarity index 100%
rename from crates/engine/src/tests_track.rs
rename to crates/engine/src/tests/track.rs
diff --git a/crates/engine/src/tests_vector_import.rs b/crates/engine/src/tests/vector_import.rs
similarity index 86%
rename from crates/engine/src/tests_vector_import.rs
rename to crates/engine/src/tests/vector_import.rs
index 63513b910..10c07c2ad 100644
--- a/crates/engine/src/tests_vector_import.rs
+++ b/crates/engine/src/tests/vector_import.rs
@@ -2,7 +2,7 @@
 
 use effectcraft_color::BlendMode;
 use effectcraft_keyframe::Value as KV;
-use effectcraft_project::{ItemKind, LayerSource, MaskMode};
+use effectcraft_project::{Comp, ItemKind, Layer, LayerSource, MaskMode};
 use effectcraft_psd::write::*;
 use effectcraft_psd::{DValue, Descriptor, Rect};
 use serde_json::json;
@@ -74,22 +74,8 @@ pub(crate) fn sample_psd() -> Vec<u8> {
     write(&d)
 }
 
-#[test]
-fn psd_imports_as_composition() {
-    let path = tmp("sample.psd");
-    std::fs::write(&path, sample_psd()).unwrap();
-    let mut s = Session::default();
-    let r = s.execute_checked("file.import", json!({"paths": [path], "importAs": "composition"})).unwrap();
-    assert_eq!(r["errors"], json!([]), "{r}");
-    let cid = effectcraft_project::ItemId(r["comps"][0].as_u64().unwrap());
-    assert_eq!(s.state.active_comp, Some(cid));
-    assert_eq!(s.project.item(cid).unwrap().name, "sample");
-    let c = s.project.comp(cid).unwrap().clone();
-    assert_eq!((c.width, c.height), (120, 80));
-    let names: Vec<&str> = c.layers.iter().map(|l| l.name.as_str()).collect();
-    assert_eq!(names, ["Title", "Hue Shift", "Vector Masked", "Clipped", "Base", "Group A", "Background"]);
-    // Text layer: editable text, positioned at the type origin.
-    let title = &c.layers[0];
+/// Text layer: editable text, positioned at the type origin.
+fn assert_title_layer(title: &Layer) {
     assert!(matches!(title.source, LayerSource::Text));
     let Some(KV::Text(doc)) = title.props.prop("text/sourceText").map(|p| p.value.clone()) else { panic!("text") };
     assert_eq!(doc.text, "Hello PSD");
@@ -97,14 +83,18 @@ fn psd_imports_as_composition() {
     assert_eq!(doc.font, "Inter");
     assert_eq!(doc.style, "Bold");
     assert_eq!(title.props.prop("transform/position").unwrap().value.as_vec2(), [8.0, 70.0]);
-    // Adjustment layer with Hue/Saturation.
-    let hue = &c.layers[1];
+}
+
+/// Adjustment layer with Hue/Saturation.
+fn assert_hue_layer(hue: &Layer) {
     assert!(hue.switches.adjustment);
     let fx = hue.effects().unwrap().groups().next().unwrap();
     assert_eq!(fx.get("hue").unwrap().value.as_f64(), 40.0);
     assert_eq!(fx.get("saturation").unwrap().value.as_f64(), 10.0);
-    // Vector mask → mask; Stroke style.
-    let vm = &c.layers[2];
+}
+
+/// Vector mask → mask; Stroke style.
+fn assert_vector_mask_layer(vm: &Layer) {
     let m = vm.masks().unwrap().groups().next().unwrap();
     assert!(matches!(m.kind, effectcraft_project::GroupKind::Mask { mode: MaskMode::Add, .. }));
     let Some(KV::Path(p)) = m.get("path").map(|p| p.value.clone()) else { panic!("mask path") };
@@ -113,19 +103,23 @@ fn psd_imports_as_composition() {
     let st = vm.props.group("layerStyles/stroke").unwrap();
     assert_eq!(st.get("size").unwrap().value.as_f64(), 2.0);
     assert_eq!(st.get("position").unwrap().value, KV::Enum(1));
-    // Clipped → preserve transparency; opacity and blend mode.
+}
+
+/// Clipped → preserve transparency (opacity, blend mode); drop shadow.
+fn assert_clipped_and_shadow(c: &Comp) {
     let clipped = &c.layers[3];
     assert!(clipped.preserve_transparency);
     assert_eq!(clipped.blend_mode, BlendMode::Screen);
     assert!((clipped.props.prop("transform/opacity").unwrap().value.as_f64() - 128.0 / 255.0 * 100.0).abs() < 1e-9);
-    // Drop shadow.
     let ds = c.layers[4].props.group("layerStyles/dropShadow").unwrap();
     assert_eq!(ds.get("distance").unwrap().value.as_f64(), 9.0);
     assert_eq!(ds.get("angle").unwrap().value.as_f64(), 45.0);
     assert_eq!(ds.get("useGlobalLight").unwrap().value, KV::Bool(false));
     assert_eq!(ds.get("opacity").unwrap().value.as_f64(), 60.0);
-    // Group → collapsed precomp (pass through) with its layers.
-    let g = &c.layers[5];
+}
+
+/// Group → collapsed precomp (pass through) with its layers; footage items name their Photoshop layer.
+fn assert_group_precomp(s: &Session, g: &Layer) {
     assert!(g.switches.collapse);
     let LayerSource::Comp { item } = g.source else { panic!("precomp") };
     let inner = s.project.comp(item).unwrap();
@@ -140,11 +134,63 @@ fn psd_imports_as_composition() {
     assert_eq!((sl.name.as_str(), sl.layer_size), ("Masked Square", false));
     assert_eq!((f.width, f.height), (120, 80));
     assert_eq!(s.project.item(item).unwrap().name, "Masked Square/sample.psd");
+}
+
+#[test]
+fn psd_imports_as_composition() {
+    let path = tmp("sample.psd");
+    std::fs::write(&path, sample_psd()).unwrap();
+    let mut s = Session::default();
+    let r = s.execute_checked("file.import", json!({"paths": [path], "importAs": "composition"})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let cid = effectcraft_project::ItemId(r["comps"][0].as_u64().unwrap());
+    assert_eq!(s.state.active_comp, Some(cid));
+    assert_eq!(s.project.item(cid).unwrap().name, "sample");
+    let c = s.project.comp(cid).unwrap().clone();
+    assert_eq!((c.width, c.height), (120, 80));
+    let names: Vec<&str> = c.layers.iter().map(|l| l.name.as_str()).collect();
+    assert_eq!(names, ["Title", "Hue Shift", "Vector Masked", "Clipped", "Base", "Group A", "Background"]);
+    assert_title_layer(&c.layers[0]);
+    assert_hue_layer(&c.layers[1]);
+    assert_vector_mask_layer(&c.layers[2]);
+    assert_clipped_and_shadow(&c);
+    assert_group_precomp(&s, &c.layers[5]);
     // One undo step removes everything.
     s.execute("edit.undo", json!({})).unwrap();
     assert!(s.project.comp(cid).is_none());
 }
 
+/// #2573: New Composition From Footage on a Photoshop file imported as a composition opens that
+/// composition; it isn't wrapped in another.
+#[test]
+fn psd_imported_as_composition_with_new_comp_is_the_new_comp() {
+    let path = tmp("newcomp.psd");
+    std::fs::write(&path, sample_psd()).unwrap();
+    let mut s = Session::default();
+    let r = s.execute_checked("file.import", json!({"paths": [path], "importAs": "composition", "newComp": true})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let cid = effectcraft_project::ItemId(r["comps"][0].as_u64().unwrap());
+    assert_eq!(s.state.active_comp, Some(cid));
+    let roots = s.project.items.values().filter(|i| matches!(i.kind, ItemKind::Comp(_)) && i.name.starts_with("newcomp")).count();
+    assert_eq!(roots, 1, "no wrapper comp");
+}
+
+/// A Photoshop file imported as a composition and dropped on the Timeline (`addToComp`) adds
+/// its composition once, not its folder too.
+#[test]
+fn psd_imported_as_composition_into_a_comp_adds_one_layer() {
+    let path = tmp("dropped.psd");
+    std::fs::write(&path, sample_psd()).unwrap();
+    let mut s = Session::default();
+    let main = s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap()["comp"].as_u64().unwrap();
+    let r = s.execute_checked("file.import", json!({"paths": [path], "importAs": "composition", "addToComp": true})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let psd = r["comps"][0].as_u64().unwrap();
+    let layers = &s.project.comp(effectcraft_project::ItemId(main)).unwrap().layers;
+    assert_eq!(layers.len(), 1, "{layers:?}");
+    assert!(matches!(layers[0].source, LayerSource::Comp { item } if item.0 == psd));
+}
+
 #[test]
 fn psd_retain_layer_sizes() {
     let path = tmp("retain.psd");
diff --git a/crates/engine/src/tests_viewer.rs b/crates/engine/src/tests/viewer.rs
similarity index 74%
rename from crates/engine/src/tests_viewer.rs
rename to crates/engine/src/tests/viewer.rs
index 5ed0848b9..31197b2a8 100644
--- a/crates/engine/src/tests_viewer.rs
+++ b/crates/engine/src/tests/viewer.rs
@@ -8,7 +8,7 @@ use effectcraft_time::Tick;
 use serde_json::json;
 
 use crate::Session;
-use crate::viewer::{Channel, PRI_GRID, PRI_GUIDE, PRI_LAYER, PRI_VERTEX, SnapKind, SnapSource, SnapTarget, display_transform, snap};
+use crate::viewer::{Channel, DisplayPass, FrameEncoding, PRI_GRID, PRI_GUIDE, PRI_LAYER, PRI_VERTEX, PassCurve, SnapKind, SnapSource, SnapTarget, snap};
 
 fn comp() -> Session {
     let mut s = Session::default();
@@ -60,6 +60,62 @@ fn snap_lines_snap_axes_independently_and_priority_breaks_ties() {
     assert_eq!(snap(&[[0.0, 0.0]], &t3, 5.0).unwrap().hits[0].source, SnapSource::Vertex(LayerId(3)));
 }
 
+/// #2855: an edge midpoint lies on its edge line, so one line nearer than the point must not win
+/// and leave the other axis free. Two lines do win when together they are nearer.
+#[test]
+fn snap_point_beats_one_line_and_loses_only_to_two_nearer_lines() {
+    let src = SnapSource::Layer(LayerId(1));
+    let mid = SnapTarget::point([100.0, 50.0], PRI_LAYER, src);
+    let top = SnapTarget::hline(50.0, PRI_LAYER, src);
+    // The line alone is nearer (1 against √10), and the point still snaps both axes.
+    let s = snap(&[[103.0, 51.0]], &[top, mid], 5.0).unwrap();
+    assert_eq!(s.at, [100.0, 50.0]);
+    assert_eq!(s.delta, [-3.0, -1.0]);
+    assert_eq!(s.hits, [mid]);
+    // Lines through the point itself tie with it: the point.
+    let centre = SnapTarget::vline(100.0, PRI_LAYER, src);
+    assert_eq!(snap(&[[103.0, 51.0]], &[top, centre, mid], 5.0).unwrap().hits, [mid]);
+    // Two lines together nearer than the point: both snap.
+    let far = SnapTarget::point([101.0, 55.0], PRI_LAYER, src);
+    let v = SnapTarget::vline(102.0, PRI_GUIDE, SnapSource::Guide);
+    let h = SnapTarget::hline(52.0, PRI_GUIDE, SnapSource::Guide);
+    let s = snap(&[[103.0, 51.0]], &[v, h, far], 5.0).unwrap();
+    assert_eq!(s.at, [102.0, 52.0]);
+    assert_eq!(s.hits, [v, h]);
+}
+
+/// #2855: an unrotated layer's centre lines follow its edges' span rule, reach the outer comp
+/// through a collapsed precomp layer, and a rotated layer keeps its points only.
+#[test]
+fn layer_centre_lines_follow_the_edges() {
+    use crate::viewer::{SnapFeatures, SnapOptions, targets};
+    let mut s = comp();
+    // A 100×50 solid moved off the comp's centre lines: x 70–170, y 55–105, centre (120, 80).
+    let a = s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 100, "height": 50})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "transform/position", "value": [120, 80, 0]})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let at = |s: &Session, f: SnapFeatures| {
+        let comp = s.project.comp(cid).unwrap().clone();
+        let ctx = effectcraft_render::EvalCtx::new(&s.project, cid, &comp, Tick::ZERO);
+        targets(&ctx, &[], SnapOptions { layers: true, features: f, guides: false, grid: false, grid_spacing: 0.0 })
+    };
+    let lines = |t: &[SnapTarget], l: LayerId| {
+        let of = |kind: SnapKind, i: usize, c: f64| t.iter().find(|t| t.kind == kind && t.source == SnapSource::Layer(l) && t.pos[i] == c).map(|t| t.span);
+        (of(SnapKind::VLine, 0, 120.0), of(SnapKind::HLine, 1, 80.0))
+    };
+    assert_eq!(lines(&at(&s, SnapFeatures::default()), LayerId(a)), (Some(None), Some(None)));
+    let off = SnapFeatures { edges_extended: false, ..Default::default() };
+    assert_eq!(lines(&at(&s, off), LayerId(a)), (Some(Some([55.0, 105.0])), Some(Some([70.0, 170.0]))));
+    // Through a collapsed precomp layer (it fills the comp, unmoved, so the numbers stay).
+    s.execute("layer.precompose", json!({"layers": [a], "name": "Inner"})).unwrap();
+    let pre = s.active_comp().unwrap().layers[0].id;
+    s.execute("layer.setSwitch", json!({"layers": [pre.0], "switch": "collapse", "value": true})).unwrap();
+    assert_eq!(lines(&at(&s, off), pre), (Some(Some([55.0, 105.0])), Some(Some([70.0, 170.0]))));
+    // Rotated: no lines at all.
+    s.execute("prop.set", json!({"layer": pre.0, "path": "transform/rotation", "value": 30})).unwrap();
+    assert_eq!(lines(&at(&s, off), pre), (None, None));
+}
+
 #[test]
 fn snap_targets_cover_layers_comp_guides_and_grid() {
     let mut s = comp();
@@ -169,15 +225,19 @@ fn snapping_options_command_sets_and_toggles() {
 
 // ---------------------------------------------------------------- channels, exposure, snapshot
 
+/// The display pass on 8-bit frames (sRGB, no HDR step): Show Channel and exposure.
+fn display_rgba8(px: [u8; 4], channel: Channel, colorized: bool, stops: f32) -> [u8; 4] {
+    let encoding = FrameEncoding { curve: PassCurve::Srgb, hdr: effectcraft_project::HdrMode::Clip };
+    let mut v = [px];
+    DisplayPass::new(channel, colorized, stops, encoding, None).apply_rgba8(&mut v);
+    v[0]
+}
+
 #[test]
 fn channel_and_exposure_pixel_transforms() {
     // Premultiplied: straight (200, 100, 50) at 50% alpha.
     let px = [100u8, 50, 25, 128];
-    let run = |c: Channel, col: bool, stops: f32| {
-        let mut v = [px];
-        display_transform(&mut v, c, col, stops);
-        v[0]
-    };
+    let run = |c: Channel, col: bool, stops: f32| display_rgba8(px, c, col, stops);
     assert_eq!(run(Channel::Rgb, false, 0.0), px);
     assert_eq!(run(Channel::Red, false, 0.0), [100, 100, 100, 255]);
     assert_eq!(run(Channel::Green, true, 0.0), [0, 50, 0, 255]);
@@ -186,13 +246,13 @@ fn channel_and_exposure_pixel_transforms() {
     let st = run(Channel::RgbStraight, false, 0.0);
     assert!((st[0] as i32 - 199).abs() <= 1 && (st[1] as i32 - 100).abs() <= 1 && st[3] == 255, "{st:?}");
     // +1 stop doubles linear light: sRGB 50% gray → about 69%; -1 stop darkens; 0 is identity.
-    let mut g = [[128u8, 128, 128, 255]];
-    display_transform(&mut g, Channel::Rgb, false, 1.0);
-    assert!((174..=178).contains(&g[0][0]), "{:?}", g[0]);
-    let mut g = [[128u8, 128, 128, 255]];
-    display_transform(&mut g, Channel::Rgb, false, -1.0);
-    assert!((92..=96).contains(&g[0][0]), "{:?}", g[0]);
-    assert_eq!(crate::viewer::exposure_lut(0.0)[200], 200);
+    let g = display_rgba8([128, 128, 128, 255], Channel::Rgb, false, 1.0);
+    assert!((174..=178).contains(&g[0]), "{g:?}");
+    let g = display_rgba8([128, 128, 128, 255], Channel::Rgb, false, -1.0);
+    assert!((92..=96).contains(&g[0]), "{g:?}");
+    for v in 0..=255u8 {
+        assert_eq!(display_rgba8([v, v, v, 255], Channel::Rgb, false, 0.0), [v, v, v, 255]);
+    }
     // Exposure applies to a single channel too, and keeps alpha untouched in RGB.
     assert!(run(Channel::Red, false, 1.0)[0] > 100);
     assert_eq!(run(Channel::Rgb, false, 2.0)[3], 128);
@@ -419,7 +479,7 @@ fn shape_tool_options_paint_new_shapes() {
 fn masks_of_every_shape_tool_kind() {
     let mut s = comp();
     let sol = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
-    for (kind, n) in [("rect", 4), ("ellipse", 4), ("rounded", 8), ("polygon", 6), ("star", 10)] {
+    for (kind, n) in [("rect", 4), ("ellipse", 4), ("rounded", 8), ("polygon", 5), ("star", 10)] {
         let m = s.execute("layer.addMask", json!({"layer": sol, "shape": kind, "rect": [100, 100, 80, 80]})).unwrap()["mask"].as_u64().unwrap();
         let path = layer(&s, sol).props.find_group(m).unwrap().get("path").unwrap().value.as_path().unwrap().clone();
         assert!(path.closed, "{kind}");
@@ -697,3 +757,166 @@ fn polystar_animated_type_keeps_the_inner_controls_needed_by_other_frames() {
     assert_eq!(star.get("type").unwrap().value_at(Tick::from_seconds_f64(1.0)), KV::Enum(1));
     assert_eq!(star.get("innerRadius").unwrap().value, KV::Scalar(27.0));
 }
+
+#[test]
+fn polystar_expression_routes_synchronize_controls_in_the_same_undo_step() {
+    for explicit in [false, true] {
+        let mut s = comp();
+        let lid = s.execute("layer.newShape", json!({"kind": "polygon"})).unwrap()["layer"].as_u64().unwrap();
+        let group = |s: &Session| layer(s, lid).props.group("contents/group/contents/star").unwrap().clone();
+        let before = group(&s);
+        let uid = before.get("type").unwrap().uid;
+        s.state.selected_props = vec![(LayerId(lid), uid)];
+        let params = if explicit { json!({"layer": lid, "prop": uid, "expression": "1"}) } else { json!({"expression": "1"}) };
+        s.execute("prop.setExpression", params).unwrap();
+        let animated = group(&s);
+        assert!(animated.get("innerRadius").is_some() && animated.get("innerRoundness").is_some());
+        assert!(s.undo());
+        assert_eq!(group(&s), before);
+        assert!(s.redo());
+        assert_eq!(group(&s), animated);
+        let inner = animated.get("innerRadius").unwrap().uid;
+        s.state.selected_props = vec![(LayerId(lid), inner)];
+        s.execute("prop.setExpression", json!({"layer": lid, "prop": uid, "expression": ""})).unwrap();
+        assert!(group(&s).get("innerRadius").is_none());
+        assert!(s.state.selected_props.is_empty());
+        assert!(s.undo());
+        assert_eq!(group(&s), animated);
+        assert!(s.redo());
+        assert!(group(&s).get("innerRadius").is_none());
+    }
+}
+
+#[test]
+fn polystar_animation_menu_adds_inner_controls_and_undoes() {
+    let mut s = comp();
+    let lid = s.execute("layer.newShape", json!({"kind": "polygon"})).unwrap()["layer"].as_u64().unwrap();
+    let group = |s: &Session| layer(s, lid).props.group("contents/group/contents/star").unwrap().clone();
+    let before = group(&s);
+    s.state.selected_props = vec![(LayerId(lid), before.get("type").unwrap().uid)];
+    s.execute("anim.addKeyframe", json!({})).unwrap();
+    let animated = group(&s);
+    assert_eq!(animated.get("type").unwrap().keys.len(), 1);
+    assert!(animated.get("innerRadius").is_some() && animated.get("innerRoundness").is_some());
+    assert!(s.undo());
+    assert_eq!(group(&s), before);
+    assert!(s.redo());
+    assert_eq!(group(&s), animated);
+}
+
+#[test]
+fn deleting_the_last_polystar_type_key_removes_stale_controls_and_selection() {
+    for command in ["keys.delete", "edit.clear"] {
+        let mut s = comp();
+        let lid = s.execute("layer.newShape", json!({"kind": "polygon"})).unwrap()["layer"].as_u64().unwrap();
+        let group = |s: &Session| layer(s, lid).props.group("contents/group/contents/star").unwrap().clone();
+        let type_uid = group(&s).get("type").unwrap().uid;
+        s.execute("prop.addKey", json!({"layer": lid, "prop": type_uid, "time": 0, "value": 1})).unwrap();
+        let animated = group(&s);
+        let inner = animated.get("innerRadius").unwrap().uid;
+        s.state.selected_props = vec![(LayerId(lid), inner)];
+        s.state.selected_keys = vec![crate::KeyRef { layer: LayerId(lid), prop: type_uid, time: Tick::ZERO }];
+        s.execute(command, json!({})).unwrap();
+        let polygon = group(&s);
+        assert!(polygon.get("innerRadius").is_none() && polygon.get("innerRoundness").is_none());
+        assert!(s.state.selected_props.is_empty() && s.state.selected_keys.is_empty());
+        assert!(s.undo());
+        assert_eq!(group(&s), animated);
+        assert!(s.redo());
+        assert_eq!(group(&s), polygon);
+    }
+}
+
+#[test]
+fn polystar_sync_cleans_the_edited_compositions_parked_selection() {
+    let mut s = comp();
+    let first = s.active_comp_id().unwrap();
+    let lid = s.execute("layer.newShape", json!({"kind": "polygon"})).unwrap()["layer"].as_u64().unwrap();
+    let path = "contents/group/contents/star";
+    let type_uid = layer(&s, lid).props.group(path).unwrap().get("type").unwrap().uid;
+    s.execute("prop.addKey", json!({"layer": lid, "prop": type_uid, "time": 0, "value": 1})).unwrap();
+    let before = layer(&s, lid).props.group(path).unwrap().clone();
+    let inner = before.get("innerRadius").unwrap().uid;
+    s.state.selected_props = vec![(LayerId(lid), inner)];
+    s.state.selected_keys = vec![crate::KeyRef { layer: LayerId(lid), prop: inner, time: Tick::ZERO }];
+    s.execute("comp.new", json!({"width": 100, "height": 100, "duration": 2})).unwrap();
+    let second = s.active_comp_id().unwrap();
+    let other = s.execute("layer.newSolid", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let other_prop = layer(&s, other).props.prop("transform/rotation").unwrap().uid;
+    s.execute("prop.addKey", json!({"layer": other, "prop": other_prop, "time": 0, "value": 15})).unwrap();
+    s.state.selected_props = vec![(LayerId(other), other_prop)];
+    s.state.selected_keys = vec![crate::KeyRef { layer: LayerId(other), prop: other_prop, time: Tick::ZERO }];
+    let live = (s.state.selected_props.clone(), s.state.selected_keys.clone());
+    s.execute("prop.toggleAnimation", json!({"comp": first.0, "layer": lid, "prop": type_uid, "value": false})).unwrap();
+    assert_eq!(s.active_comp_id(), Some(second));
+    assert_eq!((s.state.selected_props.clone(), s.state.selected_keys.clone()), live);
+    let parked = s.state.comp_selections.get(&first).unwrap();
+    assert!(parked.props.is_empty() && parked.keys.is_empty(), "the inactive composition must not keep removed control references");
+    let after = s.project.comp(first).unwrap().layer(LayerId(lid)).unwrap().props.group(path).unwrap().clone();
+    assert!(after.get("innerRadius").is_none());
+    assert!(s.undo());
+    assert_eq!(s.project.comp(first).unwrap().layer(LayerId(lid)).unwrap().props.group(path).unwrap(), &before);
+    assert!(s.redo());
+    assert_eq!(s.project.comp(first).unwrap().layer(LayerId(lid)).unwrap().props.group(path).unwrap(), &after);
+}
+
+#[test]
+fn polystar_multi_property_expression_clear_resolves_targets_before_removing_controls() {
+    let mut s = comp();
+    let lid = s.execute("layer.newShape", json!({"kind": "polygon"})).unwrap()["layer"].as_u64().unwrap();
+    let group = |s: &Session| layer(s, lid).props.group("contents/group/contents/star").unwrap().clone();
+    let type_uid = group(&s).get("type").unwrap().uid;
+    s.execute("prop.setExpression", json!({"layer": lid, "prop": type_uid, "expression": "1"})).unwrap();
+    let inner = group(&s).get("innerRadius").unwrap().uid;
+    s.execute("prop.setExpression", json!({"layer": lid, "prop": inner, "expression": "37"})).unwrap();
+    let before = group(&s);
+    s.state.selected_props = vec![(LayerId(lid), type_uid), (LayerId(lid), inner)];
+    assert_eq!(s.execute("prop.setExpression", json!({"expression": ""})).unwrap(), json!([null, null]));
+    let after = group(&s);
+    assert!(after.get("type").unwrap().expr.is_none());
+    assert!(after.get("innerRadius").is_none());
+    assert_eq!(s.state.selected_props, vec![(LayerId(lid), type_uid)]);
+    assert!(s.undo());
+    assert_eq!(group(&s), before);
+    assert!(s.redo());
+    assert_eq!(group(&s), after);
+}
+
+/// Undo must discard removed controls before their UIDs can name newly allocated properties.
+#[test]
+fn polystar_undo_sanitizes_live_and_parked_property_selections_before_uid_reuse() {
+    for parked in [false, true] {
+        let mut s = comp();
+        let cid = s.active_comp_id().unwrap();
+        let lid = s.execute("layer.newShape", json!({"kind": "polygon"})).unwrap()["layer"].as_u64().unwrap();
+        let polygon = layer(&s, lid).props.group("contents/group/contents/star").unwrap().clone();
+        let type_uid = polygon.get("type").unwrap().uid;
+        s.execute("comp.new", json!({"width": 100, "height": 100, "duration": 2})).unwrap();
+        let other = s.active_comp_id().unwrap();
+        s.activate_comp(cid);
+        s.state.selected_props = vec![(LayerId(lid), type_uid)];
+        s.execute("anim.addKeyframe", json!({})).unwrap();
+        let inner = layer(&s, lid).props.group("contents/group/contents/star").unwrap().get("innerRadius").unwrap().uid;
+        let valid = vec![(LayerId(lid), type_uid), (LayerId(lid), polygon.uid)];
+        s.state.selected_props = valid.iter().copied().chain([(LayerId(lid), inner)]).collect();
+        s.state.selected_keys = vec![crate::KeyRef { layer: LayerId(lid), prop: inner, time: Tick::ZERO }];
+        if parked {
+            s.activate_comp(other);
+        }
+        assert!(s.undo());
+        let (props, keys) = if parked {
+            let selection = s.state.comp_selections.get(&cid).unwrap();
+            (&selection.props, &selection.keys)
+        } else {
+            (&s.state.selected_props, &s.state.selected_keys)
+        };
+        assert_eq!(props, &valid, "remove stale leaves while preserving property and group selections");
+        assert!(keys.is_empty());
+        s.activate_comp(cid);
+        s.execute("prop.separateDimensions", json!({"layer": lid, "value": true})).unwrap();
+        let position_z = layer(&s, lid).props.prop("transform/positionZ").unwrap().clone();
+        assert_eq!(position_z.uid, inner, "the removed control's UID was actually reused");
+        s.execute("prop.setExpression", json!({"expression": "1"})).unwrap();
+        assert_eq!(layer(&s, lid).props.prop("transform/positionZ").unwrap(), &position_z, "the reused UID must not become an implicit expression target");
+    }
+}
diff --git a/crates/engine/src/tests_delete_keys.rs b/crates/engine/src/tests_delete_keys.rs
deleted file mode 100644
index b1b9af316..000000000
--- a/crates/engine/src/tests_delete_keys.rs
+++ /dev/null
@@ -1,45 +0,0 @@
-//! `keys.delete` reports the keys it removed, not the keys it was asked to remove.
-
-use effectcraft_project::LayerId;
-use serde_json::json;
-
-use crate::{KeyRef, Session};
-
-fn setup() -> (Session, u64, u64) {
-    let mut s = Session::default();
-    s.execute_checked("comp.new", json!({"width": 64, "height": 64, "frameRate": 30, "duration": 4})).unwrap();
-    let layer = s.execute_checked("layer.newSolid", json!({"name": "Box", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
-    for t in 0..3 {
-        s.execute_checked("prop.addKey", json!({"layer": layer, "path": "transform/opacity", "time": t, "value": t * 25})).unwrap();
-    }
-    let prop = s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("transform/opacity").unwrap().uid;
-    (s, layer, prop)
-}
-
-fn keys_of(s: &Session, layer: u64, prop: u64) -> Vec<KeyRef> {
-    let keys = &s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find(prop).unwrap().keys;
-    keys.iter().map(|k| KeyRef { layer: LayerId(layer), prop, time: k.time }).collect()
-}
-
-#[test]
-fn delete_keys_counts_only_the_keys_it_removed() {
-    let (mut s, layer, prop) = setup();
-    let keys = keys_of(&s, layer, prop);
-    assert_eq!(keys.len(), 3);
-    // Two real keys, one of them listed twice, and a key of a property that does not exist.
-    let missing = KeyRef { layer: LayerId(layer), prop: u64::MAX, time: keys[1].time };
-    s.state.selected_keys = vec![keys[0], keys[2], keys[0], missing];
-    let removed = s.execute_checked("keys.delete", json!({})).unwrap();
-    assert_eq!(removed, json!(2));
-    assert_eq!(keys_of(&s, layer, prop), vec![keys[1]]);
-}
-
-#[test]
-fn delete_keys_reports_zero_when_no_selected_key_exists() {
-    let (mut s, layer, prop) = setup();
-    let keys = keys_of(&s, layer, prop);
-    s.state.selected_keys = vec![KeyRef { layer: LayerId(layer), prop: u64::MAX, time: keys[0].time }];
-    let removed = s.execute_checked("keys.delete", json!({})).unwrap();
-    assert_eq!(removed, json!(0));
-    assert_eq!(keys_of(&s, layer, prop), keys);
-}
diff --git a/crates/engine/src/tests_disk_cache.rs b/crates/engine/src/tests_disk_cache.rs
deleted file mode 100644
index 3091964ad..000000000
--- a/crates/engine/src/tests_disk_cache.rs
+++ /dev/null
@@ -1,138 +0,0 @@
-//! The persistent disk cache (PRV-2) through the session: settings, layer cache persistence
-//! across restarts, invalidation on edits, purging.
-
-use serde_json::json;
-
-use crate::Session;
-use crate::render::RenderOpts;
-
-fn folder(name: &str) -> String {
-    let d = std::env::temp_dir().join(format!("effectcraft-session-disk-{name}-{}", std::process::id()));
-    let _ = std::fs::remove_dir_all(&d);
-    d.to_string_lossy().to_string()
-}
-
-fn session(dir: &str) -> Session {
-    let mut s = Session::default();
-    s.execute_checked("prefs.set", json!({"values": {"disk.diskCacheFolder": dir, "disk.diskCacheEnabled": true}})).unwrap();
-    // Write every layer buffer, however quick to render.
-    s.disk_cache.as_ref().unwrap().set_min_layer_ms(0);
-    s
-}
-
-fn project(s: &mut Session) -> effectcraft_project::ItemId {
-    s.execute("comp.new", json!({"name": "D", "width": 160, "height": 90, "frameRate": 30, "duration": 1})).unwrap();
-    s.execute("layer.newSolid", json!({"color": "#3080ff", "width": 80, "height": 40})).unwrap();
-    s.execute("effect.apply", json!({"layer": "#1", "effect": "Gaussian Blur"})).unwrap();
-    s.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/blurriness", "value": 12})).unwrap();
-    s.active_comp_id().unwrap()
-}
-
-#[test]
-fn disk_cache_settings_persistence_and_invalidation() {
-    crate::tests_roto::hold_roto_cache_test_lock();
-    let dir = folder("persist");
-    let mut s = session(&dir);
-    let st = s.execute_checked("cache.diskStats", json!({})).unwrap();
-    assert_eq!(st["enabled"], json!(true));
-    assert_eq!(st["maxBytes"], json!(100u64 << 30));
-    let cid = project(&mut s);
-    let t = s.time();
-    let first = s.render(cid, t, RenderOpts::default());
-    let dc = s.disk_cache.clone().unwrap();
-    dc.flush();
-    let written = dc.stats().entries;
-    assert!(written > 0, "layer buffers written");
-    // "Restart": a new session on the same folder and project renders from disk.
-    let saved = s.project.clone();
-    drop(s);
-    let mut s2 = session(&dir);
-    s2.project = saved;
-    s2.bump();
-    s2.open_comp(cid);
-    let dc2 = s2.disk_cache.clone().unwrap();
-    assert_eq!(dc2.stats().entries, written);
-    let again = s2.render(cid, t, RenderOpts::default());
-    assert!(dc2.stats().hits > 0, "{:?}", dc2.stats());
-    assert_eq!(again.data, first.data, "disk-cached pixels are exact");
-    // An edit changes the keys: a miss, and new entries.
-    let hits = dc2.stats().hits;
-    s2.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/blurriness", "value": 20})).unwrap();
-    let edited = s2.render(cid, t, RenderOpts::default());
-    assert_ne!(edited.data, first.data);
-    assert_eq!(dc2.stats().hits, hits);
-    dc2.flush();
-    assert!(dc2.stats().entries > written);
-    // Purge ▸ All Disk Cache empties it; memory purge leaves the disk alone.
-    let r = s2.execute_checked("edit.purge", json!({"what": "memory"})).unwrap();
-    assert_eq!(r["diskEntries"], json!(0));
-    assert!(dc2.stats().entries > 0);
-    let r = s2.execute_checked("edit.purge", json!({"what": "disk"})).unwrap();
-    assert!(r["diskEntries"].as_u64().unwrap() > 0);
-    assert_eq!(dc2.stats().entries, 0);
-    // Disabling detaches it.
-    s2.execute_checked("prefs.set", json!({"key": "disk.diskCacheEnabled", "value": false})).unwrap();
-    assert!(s2.disk_cache.is_none());
-    assert!(s2.layer_cache.disk().is_none());
-}
-
-#[test]
-fn footage_changes_change_the_salt() {
-    let dir = folder("salt");
-    let mut s = session(&dir);
-    let foot = std::env::temp_dir().join(format!("effectcraft-salt-{}.png", std::process::id()));
-    std::fs::write(&foot, b"one").unwrap();
-    s.edit("add", None, |p, _| {
-        let f = effectcraft_project::Footage {
-            path: foot.to_string_lossy().to_string(),
-            kind: effectcraft_project::FootageKind::Still,
-            width: 1,
-            height: 1,
-            pixel_aspect: 1.0,
-            frame_rate: effectcraft_time::FrameRate::FPS_30,
-            native_rate: None,
-            duration: effectcraft_time::Tick::ZERO,
-            has_video: true,
-            has_audio: false,
-            alpha: effectcraft_project::AlphaMode::Ignore,
-            premul_color: [0.0; 3],
-            loop_count: 1,
-            codec: "PNG".into(),
-            missing: false,
-            sequence: vec![],
-            color_profile: None,
-            layer: None,
-            ..Default::default()
-        };
-        p.add_item("f.png", effectcraft_color::Label::Lavender, None, effectcraft_project::ItemKind::Footage(f));
-        Ok(())
-    })
-    .unwrap();
-    let a = effectcraft_render::disk_cache::footage_salt(&s.project);
-    std::fs::write(&foot, b"two, longer").unwrap();
-    let b = effectcraft_render::disk_cache::footage_salt(&s.project);
-    assert_ne!(a, b);
-    let cid = project(&mut s);
-    let k1 = effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
-    s.execute("prop.set", json!({"layer": "#1", "path": "transform/opacity", "value": 50})).unwrap();
-    let k2 = effectcraft_render::disk_cache::comp_content_key(&s.project, cid);
-    assert_ne!(k1, k2);
-    // Switches that don't change pixels (Audio, Lock, Shy, Hide Shy Layers) don't change it (#103).
-    for sw in ["audio", "lock", "shy"] {
-        s.execute("layer.setSwitch", json!({"layers": ["#1"], "switch": sw, "value": sw != "audio"})).unwrap();
-    }
-    s.execute("comp.setSwitch", json!({"switch": "hideShy", "value": true})).unwrap();
-    assert_eq!(effectcraft_render::disk_cache::comp_content_key(&s.project, cid), k2);
-    // Unrelated comps do not change it.
-    s.execute("comp.new", json!({"name": "Other", "width": 10, "height": 10, "frameRate": 30, "duration": 1})).unwrap();
-    assert_eq!(effectcraft_render::disk_cache::comp_content_key(&s.project, cid), k2);
-    // A proxy, and its Use Proxy switch, change the pixels.
-    let set_proxy = |s: &mut Session, enabled: bool| {
-        let it = std::sync::Arc::make_mut(&mut s.project).items.get_mut(&cid).unwrap();
-        it.proxy = Some(Box::new(effectcraft_project::Proxy { footage: effectcraft_project::Footage::default(), enabled }));
-        effectcraft_render::disk_cache::comp_content_key(&s.project, cid)
-    };
-    let k3 = set_proxy(&mut s, true);
-    assert_ne!(k3, k2);
-    assert_ne!(set_proxy(&mut s, false), k3);
-}
diff --git a/crates/engine/src/tests_frame_export.rs b/crates/engine/src/tests_frame_export.rs
deleted file mode 100644
index a45c5d444..000000000
--- a/crates/engine/src/tests_frame_export.rs
+++ /dev/null
@@ -1,166 +0,0 @@
-//! Composition ▸ Save Frame As ▸ Photoshop Layers… / ProEXR…, and Copy Frame to Clipboard.
-
-use serde_json::json;
-
-use crate::Session;
-
-fn out_dir(name: &str) -> std::path::PathBuf {
-    let d = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out").join(name);
-    let _ = std::fs::remove_dir_all(&d);
-    std::fs::create_dir_all(&d).unwrap();
-    d
-}
-
-/// A 32×32 comp: a red full-frame solid under a 16×16 blue Multiply solid at 50%.
-fn frame() -> Session {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Frame", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
-    s.execute("layer.newSolid", json!({"name": "Red", "color": "#ff0000"})).unwrap();
-    let blue = s.execute("layer.newSolid", json!({"name": "Blue.Box", "color": "#0000ff", "width": 16, "height": 16})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("layer.setBlendMode", json!({"layers": [blue], "mode": "Multiply"})).unwrap();
-    s.execute("prop.set", json!({"layer": blue, "path": "transform/opacity", "value": 50})).unwrap();
-    s
-}
-
-#[test]
-fn photoshop_layers_writes_one_psd_layer_per_comp_layer() {
-    let mut s = frame();
-    let dir = out_dir("frame-psd");
-    let path = dir.join("frame.psd").to_string_lossy().to_string();
-    let r = s.execute("comp.saveFrameAsPsd", json!({"path": path})).unwrap();
-    assert_eq!(r["layers"], 2);
-    let psd = effectcraft_psd::Psd::parse(std::fs::read(&path).unwrap()).unwrap();
-    assert_eq!((psd.width, psd.height), (32, 32));
-    let names: Vec<&str> = psd.layers.iter().map(|l| l.name.as_str()).collect();
-    assert_eq!(names, ["Red", "Blue.Box"], "bottom first");
-    let blue = &psd.layers[1];
-    assert_eq!(blue.blend_key(), "mul ");
-    assert_eq!(blue.opacity, 128);
-    // Cropped to its pixels (16×16, centred) and rendered at full opacity.
-    assert_eq!((blue.rect.left, blue.rect.top, blue.rect.width(), blue.rect.height()), (8, 8, 16, 16));
-    assert_eq!(psd.layers[0].blend_key(), "norm");
-    assert_eq!(psd.layers[0].opacity, 255);
-    // The merged image is the comp frame: red × (50% blue multiply) in the middle.
-    let m = psd.composite().unwrap();
-    let mid = m.data[16 * 32 + 16];
-    assert!(mid[0] > 0.4 && mid[0] < 0.6 && mid[2] < 0.05, "{mid:?}");
-    let corner = m.data[0];
-    assert!(corner[0] > 0.99 && corner[2] < 0.01, "{corner:?}");
-    // The menu has it.
-    assert!(crate::commands::find("comp.saveFrameAsPsd").is_some());
-}
-
-#[test]
-fn proexr_writes_layer_prefixed_channels_and_the_composite() {
-    use exr::prelude::*;
-    let mut s = frame();
-    let dir = out_dir("frame-exr");
-    let path = dir.join("frame.exr").to_string_lossy().to_string();
-    let r = s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
-    let names: Vec<&str> = r["channels"].as_array().unwrap().iter().map(|c| c.as_str().unwrap()).collect();
-    assert_eq!(names.len(), 12);
-    assert!(names.contains(&"R") && names.contains(&"A") && names.contains(&"Red.R") && names.contains(&"Blue_Box.B"), "{names:?}");
-    let img = read().no_deep_data().largest_resolution_level().all_channels().all_layers().all_attributes().from_file(&path).unwrap();
-    let layer = &img.layer_data[0];
-    assert_eq!((layer.size.0, layer.size.1), (32, 32));
-    let ch = |n: &str| layer.channel_data.list.iter().find(|c| c.name.to_string() == n).unwrap_or_else(|| panic!("no channel {n}"));
-    let at = |n: &str, x: usize, y: usize| match &ch(n).sample_data {
-        FlatSamples::F32(v) => v[y * 32 + x],
-        o => panic!("{o:?}"),
-    };
-    // The blue layer alone: blue inside its box, transparent outside.
-    assert!((at("Blue_Box.B", 16, 16) - 1.0).abs() < 1e-3);
-    assert_eq!(at("Blue_Box.A", 0, 0), 0.0);
-    assert!((at("Red.R", 0, 0) - 1.0).abs() < 1e-3);
-    // Composite: opaque everywhere.
-    assert!((at("A", 16, 16) - 1.0).abs() < 1e-3);
-    assert!(at("R", 16, 16) < 0.5, "multiplied by 50% blue (linear)");
-}
-
-#[test]
-fn proexr_names_a_non_ascii_layer_with_underscores_instead_of_panicking() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Frame", "width": 8, "height": 8, "frameRate": 24, "duration": 1})).unwrap();
-    s.execute("layer.newSolid", json!({"name": "你好", "color": "#ff0000"})).unwrap();
-    let dir = out_dir("frame-exr-non-ascii");
-    let path = dir.join("frame.exr").to_string_lossy().to_string();
-    let r = s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
-    let names: Vec<&str> = r["channels"].as_array().unwrap().iter().map(|c| c.as_str().unwrap()).collect();
-    assert!(names.contains(&"__.R") && names.contains(&"__.A"), "{names:?}");
-    assert!(std::path::Path::new(&path).exists());
-}
-
-/// Save a 32×32 comp holding one opaque solid of `color` (an sRGB-encoded triple) as ProEXR and
-/// return the centre pixel of the composite and of the solid's own layer: `[R, G, B]` each.
-fn proexr_centre(color: [f64; 3], bit_depth: u64) -> ([f32; 3], [f32; 3]) {
-    use exr::prelude::*;
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Bright", "width": 32, "height": 32, "frameRate": 24, "duration": 1})).unwrap();
-    s.execute("file.projectSettings", json!({"bitDepth": bit_depth})).unwrap();
-    s.execute("layer.newSolid", json!({"name": "Bright", "color": color})).unwrap();
-    let dir = out_dir(&format!("frame-exr-over-{}", color[0]));
-    let path = dir.join(format!("frame{bit_depth}.exr")).to_string_lossy().to_string();
-    s.execute("comp.saveFrameAsExr", json!({"path": path})).unwrap();
-    let img = read().no_deep_data().largest_resolution_level().all_channels().all_layers().all_attributes().from_file(&path).unwrap();
-    let layer = &img.layer_data[0];
-    let at = |n: &str| {
-        let c = layer.channel_data.list.iter().find(|c| c.name.to_string() == n).unwrap_or_else(|| panic!("no channel {n}"));
-        match &c.sample_data {
-            FlatSamples::F32(v) => v[16 * 32 + 16],
-            o => panic!("{o:?}"),
-        }
-    };
-    ([at("R"), at("G"), at("B")], [at("Bright.R"), at("Bright.G"), at("Bright.B")])
-}
-
-#[test]
-fn proexr_keeps_values_above_one_in_32_bpc() {
-    // Issue #339: over-range colour reaches the EXR in scene-linear light (sRGB decode, uncapped).
-    let src = [1.5, 1.25, 0.75];
-    let (comp, layer) = proexr_centre(src, 32);
-    for i in 0..3 {
-        let want = effectcraft_color::srgb_to_linear(src[i] as f32);
-        for got in [comp[i], layer[i]] {
-            assert!((got - want).abs() < 1e-3 * want.max(1.0), "channel {i}: got {got}, want {want} ({comp:?} / {layer:?})");
-        }
-    }
-    assert!(comp[0] > 1.5 && comp[1] > 1.25, "{comp:?}");
-}
-
-#[test]
-fn proexr_values_at_or_below_one_are_unchanged() {
-    let (comp, layer) = proexr_centre([1.0, 0.4, 0.0], 32);
-    for got in [comp, layer] {
-        assert!((got[0] - 1.0).abs() < 1e-4 && (got[1] - 0.1329).abs() < 1e-3 && got[2].abs() < 1e-6, "{got:?}");
-    }
-}
-
-/// Composition ▸ Copy Frame to Clipboard (After Effects 26.3): the frame, as Save Frame As
-/// renders it, goes to the frontend as an image for the system clipboard.
-#[test]
-fn copy_frame_hands_the_rendered_frame_to_the_frontend() {
-    let mut s = frame();
-    s.drain_events();
-    let r = s.execute("comp.copyFrame", json!({})).unwrap();
-    assert_eq!((r["width"].as_u64(), r["height"].as_u64()), (Some(32), Some(32)));
-    let events = s.drain_events();
-    let Some((width, height, rgba)) = events.iter().find_map(|e| match e {
-        crate::Event::CopyImage { width, height, rgba } => Some((*width, *height, rgba)),
-        _ => None,
-    }) else {
-        panic!("no CopyImage event in {events:?}")
-    };
-    assert_eq!((width, height, rgba.len()), (32, 32, 32 * 32 * 4));
-    // Red in the corner; red × (50% blue multiply) in the middle; opaque everywhere.
-    assert_eq!(&rgba[..4], &[255, 0, 0, 255]);
-    let mid = &rgba[(16 * 32 + 16) * 4..][..4];
-    assert!(mid[0] > 100 && mid[0] < 160 && mid[2] < 13 && mid[3] == 255, "{mid:?}");
-    assert!(rgba.chunks(4).all(|p| p[3] == 255));
-    // The pixels are not serialized into the event stream.
-    let json = serde_json::to_value(events.iter().find(|e| matches!(e, crate::Event::CopyImage { .. })).unwrap()).unwrap();
-    assert!(json["CopyImage"].get("rgba").is_none(), "{json}");
-    // Scaled, and refused without a composition.
-    assert_eq!(s.execute("comp.copyFrame", json!({"scale": 0.5})).unwrap()["width"], 16);
-    assert!(Session::default().execute("comp.copyFrame", json!({})).is_err());
-    assert!(crate::menus::entries().iter().any(|(path, e)| e.command == "comp.copyFrame" && path.first().map(String::as_str) == Some("Composition")));
-}
diff --git a/crates/engine/src/tests_models.rs b/crates/engine/src/tests_models.rs
deleted file mode 100644
index 66111eb34..000000000
--- a/crates/engine/src/tests_models.rs
+++ /dev/null
@@ -1,88 +0,0 @@
-//! Settings ▸ Roto Brush and Settings ▸ Face Tracking: the model registry, choosing, installing
-//! (verified, with its notice) and loading trained models.
-
-use std::sync::Arc;
-
-use effectcraft_segment::Task;
-use serde_json::json;
-
-use crate::Session;
-use crate::config::{ConfigStore, DirConfig};
-
-fn session(tag: &str) -> (Session, std::path::PathBuf) {
-    let d = std::env::temp_dir().join(format!("ec-models-{tag}-{}", std::process::id()));
-    let store: Arc<dyn ConfigStore> = Arc::new(DirConfig::new(d.join("config")));
-    (Session { config: Some(store), ..Default::default() }, d)
-}
-
-/// Poll until `task`'s model is in use (or a few seconds pass).
-fn wait_loaded(s: &mut Session, task: Task) {
-    for _ in 0..400 {
-        s.poll_models();
-        if s.models.status(task).active.is_some() {
-            return;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(20));
-    }
-}
-
-#[test]
-fn models_are_listed_chosen_and_verified() {
-    crate::tests_roto::hold_roto_cache_test_lock();
-    let (mut s, d) = session("list");
-    std::fs::create_dir_all(&d).unwrap();
-    let bogus = d.join("bogus.bin");
-    std::fs::write(&bogus, b"not the weights").unwrap();
-    for (prefix, model, task) in [("roto", "mobilesam", Task::Mask), ("face", "mediapipe-face", Task::Face)] {
-        let list = s.execute_checked(&format!("{prefix}.models"), json!({})).unwrap();
-        let ids: Vec<&str> = list["models"].as_array().unwrap().iter().map(|m| m["id"].as_str().unwrap()).collect();
-        assert_eq!(ids, ["classical", model]);
-        let m = &list["models"][1];
-        assert_eq!((m["licence"].as_str(), m["installed"].as_bool()), (Some("Apache-2.0"), Some(false)));
-        assert!(m["url"].as_str().unwrap().starts_with("https://") && !m["authors"].as_str().unwrap().is_empty());
-        // Unknown ids, the other task's models and files that aren't the published weights are
-        // refused.
-        let other = if task == Task::Mask { "mediapipe-face" } else { "mobilesam" };
-        for id in ["nope", other] {
-            assert!(s.execute_checked(&format!("{prefix}.model.select"), json!({"id": id})).is_err(), "{prefix} {id}");
-        }
-        let path = bogus.to_string_lossy();
-        let e = s.execute_checked(&format!("{prefix}.model.install"), json!({"path": path})).unwrap_err().to_string();
-        assert!(e.contains("SHA-256"), "{e}");
-        assert!(s.execute_checked(&format!("{prefix}.model.install"), json!({"path": path, "id": model})).is_err());
-        // Choosing a model that isn't installed keeps the classic engine.
-        s.execute_checked(&format!("{prefix}.model.select"), json!({"id": model})).unwrap();
-        assert_eq!(s.chosen_model(task), model);
-        assert!(s.models.status(task).active.is_none());
-        assert!(crate::prefs::pages().iter().any(|p| p.id == prefix));
-    }
-    assert!(s.models.face().is_none());
-    assert_eq!(crate::prefs::page_id("Face Tracking"), Some("face"));
-    // With the real weights (EFFECTCRAFT_MOBILESAM=path/to/mobile_sam.pt): install, load, use.
-    if let Ok(path) = std::env::var("EFFECTCRAFT_MOBILESAM") {
-        s.execute_checked("roto.model.install", json!({"path": path})).unwrap();
-        wait_loaded(&mut s, Task::Mask);
-        assert_eq!(s.models.status(Task::Mask).active.as_deref(), Some("mobilesam"));
-        // Roto Brush 3.0 (the default version) now segments with it.
-        let params = crate::effects::Params { values: [("version".to_string(), effectcraft_keyframe::Value::Enum(2))].into_iter().collect() };
-        assert_eq!(crate::effects::roto::model_for(&params).map(|m| m.info().id), Some("mobilesam"));
-        s.execute_checked("roto.model.select", json!({"id": "classical"})).unwrap();
-        assert!(crate::effects::roto::model_for(&params).is_none());
-    }
-    // EFFECTCRAFT_FACE_LANDMARKER=path/to/face_landmarker.task: installed with its notice,
-    // loaded for face tracking, dropped when the classic tracker is chosen, removed.
-    if let Ok(path) = std::env::var("EFFECTCRAFT_FACE_LANDMARKER") {
-        let r = s.execute_checked("face.model.install", json!({"path": path})).unwrap();
-        assert_eq!(r["id"], "mediapipe-face");
-        let dir = s.models_dir().unwrap();
-        let notice = std::fs::read_to_string(dir.join("face_landmarker.task.NOTICE.txt")).unwrap();
-        assert!(notice.contains("Google LLC") && notice.contains("Apache-2.0"), "{notice}");
-        wait_loaded(&mut s, Task::Face);
-        assert_eq!(s.models.face().map(|m| m.info().id), Some("mediapipe-face"));
-        s.execute_checked("face.model.select", json!({"id": "classical"})).unwrap();
-        assert!(s.models.face().is_none());
-        assert_eq!(s.execute_checked("face.model.remove", json!({"id": "mediapipe-face"})).unwrap()["removed"], true);
-        assert!(!dir.join("face_landmarker.task").exists() && !dir.join("face_landmarker.task.NOTICE.txt").exists());
-    }
-    let _ = std::fs::remove_dir_all(d);
-}
diff --git a/crates/engine/src/tests_proxy.rs b/crates/engine/src/tests_proxy.rs
deleted file mode 100644
index 82cd1dcfd..000000000
--- a/crates/engine/src/tests_proxy.rs
+++ /dev/null
@@ -1,283 +0,0 @@
-//! Proxies (Set Proxy, Use Proxy, Proxy Use render settings, comp proxies, Create Proxy) and
-//! Interpret Footage (fields, pixel aspect, alpha guess / invert, linear light), rendered through
-//! a synthetic footage source.
-
-use std::sync::Arc;
-
-use effectcraft_project::render_queue::ProxyUse;
-use effectcraft_project::{AlphaMode, Footage, FootageKind, ItemId, ItemKind};
-use effectcraft_raster::Image;
-use effectcraft_time::{FrameRate, Tick};
-use serde_json::json;
-
-use crate::Session;
-use crate::render::{FootageSource, RenderOpts};
-
-/// Files by name: `red16.png` (16×16 red), `blue8.png` (8×8 blue), `lines.mov` (interlaced:
-/// even rows red, odd rows blue; 4×4, 10 fps), `matte_black.png` / `matte_white.png` (a
-/// semi-transparent green premultiplied against black / white, read as straight), `half.png`
-/// (white at 25 % alpha), `wide.png` (10×10 white).
-struct Synthetic;
-
-fn file_px(path: &str, x: u32, y: u32) -> [f32; 4] {
-    let name = std::path::Path::new(path).file_name().and_then(|n| n.to_str()).unwrap_or("");
-    match name {
-        "red16.png" => [1.0, 0.0, 0.0, 1.0],
-        "blue8.png" => [0.0, 0.0, 1.0, 1.0],
-        "lines.mov" => {
-            if y.is_multiple_of(2) {
-                [1.0, 0.0, 0.0, 1.0]
-            } else {
-                [0.0, 0.0, 1.0, 1.0]
-            }
-        }
-        // Straight interpretation of a file whose colour is green·a + matte·(1 − a), a = 0.5.
-        "matte_black.png" => [0.0, 0.5, 0.0, 0.5],
-        "matte_white.png" => [0.5, 1.0, 0.5, 0.5],
-        "half.png" => [1.0, 1.0, 1.0, 0.25],
-        _ => {
-            let _ = x;
-            [1.0, 1.0, 1.0, 1.0]
-        }
-    }
-}
-
-fn size_of(path: &str) -> (u32, u32) {
-    match std::path::Path::new(path).file_name().and_then(|n| n.to_str()).unwrap_or("") {
-        "red16.png" => (16, 16),
-        "blue8.png" => (8, 8),
-        "lines.mov" | "matte_black.png" | "matte_white.png" | "half.png" => (4, 4),
-        _ => (10, 10),
-    }
-}
-
-impl FootageSource for Synthetic {
-    fn frame(&self, _: ItemId, f: &Footage, _t: Tick) -> Option<Arc<Image>> {
-        let (w, h) = size_of(&f.path);
-        let mut img = Image::new(w, h);
-        for y in 0..h {
-            for x in 0..w {
-                // Decoders hand out premultiplied pixels (straight file colour × alpha).
-                let p = file_px(&f.path, x, y);
-                img.set(x, y, [p[0] * p[3], p[1] * p[3], p[2] * p[3], p[3]]);
-            }
-        }
-        Some(Arc::new(img))
-    }
-}
-
-struct Probe;
-impl crate::Importer for Probe {
-    fn probe(&self, path: &str) -> Result<Footage, String> {
-        let (w, h) = size_of(path);
-        let video = path.ends_with(".mov");
-        Ok(Footage {
-            path: path.into(),
-            kind: if video { FootageKind::Video } else { FootageKind::Still },
-            width: w,
-            height: h,
-            has_video: true,
-            frame_rate: FrameRate::from_f64(10.0),
-            duration: Tick::from_seconds_f64(if video { 2.0 } else { 0.0 }),
-            ..Default::default()
-        })
-    }
-}
-
-fn session() -> Session {
-    Session { footage: Arc::new(Synthetic), importer: Some(Arc::new(Probe)), ..Default::default() }
-}
-
-fn import(s: &mut Session, path: &str) -> ItemId {
-    ItemId(s.execute("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap())
-}
-
-fn px(s: &Session, comp: ItemId, t: f64, opts: RenderOpts, x: i64, y: i64) -> [f32; 4] {
-    s.render(comp, Tick::from_seconds_f64(t), opts).get(x, y)
-}
-
-fn red(p: [f32; 4]) -> bool {
-    p[0] > 0.99 && p[2] < 0.01 && p[3] > 0.99
-}
-fn blue(p: [f32; 4]) -> bool {
-    p[2] > 0.99 && p[0] < 0.01 && p[3] > 0.99
-}
-
-#[test]
-fn footage_proxy_follows_use_proxy_and_proxy_use() {
-    let mut s = session();
-    let full = import(&mut s, "/m/red16.png");
-    s.execute("comp.new", json!({"name": "C", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
-    let c = s.active_comp_id().unwrap();
-    s.execute("layer.addItem", json!({"item": full.0})).unwrap();
-    let o = RenderOpts::default();
-    assert!(red(px(&s, c, 0.0, o, 8, 8)));
-    s.execute("file.setProxy", json!({"item": full.0, "path": "/m/blue8.png"})).unwrap();
-    // The 8×8 proxy fills the 16×16 footage frame.
-    for (x, y) in [(1, 1), (8, 8), (14, 14)] {
-        assert!(blue(px(&s, c, 0.0, o, x, y)), "proxy at {x},{y}");
-    }
-    assert!(s.project.item(full).unwrap().proxy.as_ref().unwrap().enabled);
-    // Render Settings ▸ Proxy Use.
-    assert!(red(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseNone, ..o }, 8, 8)));
-    assert!(red(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseCompOnly, ..o }, 8, 8)));
-    // Use Proxy off: the viewer shows the source, Use All Proxies still uses it.
-    s.execute("file.useProxy", json!({"item": full.0})).unwrap();
-    assert!(!s.project.item(full).unwrap().proxy.as_ref().unwrap().enabled);
-    assert!(red(px(&s, c, 0.0, o, 8, 8)));
-    assert!(blue(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseAll, ..o }, 8, 8)));
-    // Undo / Set Proxy ▸ None.
-    s.execute("edit.undo", json!({})).unwrap();
-    assert!(blue(px(&s, c, 0.0, o, 8, 8)));
-    s.execute("file.setProxyNone", json!({"item": full.0})).unwrap();
-    assert!(s.project.item(full).unwrap().proxy.is_none());
-    assert!(red(px(&s, c, 0.0, RenderOpts { proxy: ProxyUse::UseAll, ..o }, 8, 8)));
-    // Render queue items carry Proxy Use (Best Settings: none).
-    let r = s.execute("renderQueue.add", json!({"proxyUse": "all"})).unwrap();
-    assert_eq!(s.project.render_queue[0].settings.proxy_use, ProxyUse::UseAll, "{r}");
-    assert_eq!(effectcraft_project::render_queue::RenderSettings::default().proxy_use, ProxyUse::UseNone);
-}
-
-#[test]
-fn comp_proxy_and_create_proxy() {
-    let mut s = session();
-    s.execute("comp.new", json!({"name": "Inner", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
-    let inner = s.active_comp_id().unwrap();
-    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
-    s.execute("comp.new", json!({"name": "Outer", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
-    let outer = s.active_comp_id().unwrap();
-    s.execute("layer.addItem", json!({"item": inner.0})).unwrap();
-    let o = RenderOpts::default();
-    assert!(red(px(&s, outer, 0.0, o, 8, 8)));
-    s.execute("file.setProxy", json!({"item": inner.0, "path": "/m/blue8.png"})).unwrap();
-    assert!(blue(px(&s, outer, 0.0, o, 14, 1)));
-    assert!(blue(px(&s, outer, 0.0, RenderOpts { proxy: ProxyUse::UseCompOnly, ..o }, 8, 8)));
-    assert!(red(px(&s, outer, 0.0, RenderOpts { proxy: ProxyUse::UseNone, ..o }, 8, 8)));
-    s.execute("file.setProxyNone", json!({"item": inner.0})).unwrap();
-    // Create Proxy queues a half-resolution render whose post-render action sets the proxy.
-    s.state.project_selection = vec![inner];
-    let r = s.execute("file.createProxy", json!({"kind": "still"})).unwrap();
-    let it = s.project.render_queue.last().unwrap().clone();
-    assert_eq!(it.comp, inner);
-    assert_eq!(it.post_render, effectcraft_project::render_queue::PostRenderAction::SetProxy);
-    assert_eq!(it.settings.resolution, 0.5);
-    assert!(r["output"].as_str().unwrap().contains("Inner_proxy_"), "{r}");
-    let m = s.execute("file.createProxy", json!({"kind": "movie", "comp": inner.0})).unwrap();
-    assert!(m["output"].as_str().unwrap().ends_with("Inner_proxy.mov"), "{m}");
-    // The post-render action (what a finished render runs) attaches the file.
-    let id = it.id;
-    s.post_render_action(id, "/m/blue8.png").unwrap();
-    assert_eq!(s.project.item(inner).unwrap().proxy.as_ref().unwrap().footage.path, "/m/blue8.png");
-    assert!(blue(px(&s, outer, 0.0, o, 8, 8)));
-}
-
-#[test]
-fn interpret_proxy_settings_apply_to_the_proxy() {
-    let mut s = session();
-    let full = import(&mut s, "/m/red16.png");
-    s.execute("file.setProxy", json!({"item": full.0, "path": "/m/half.png"})).unwrap();
-    s.execute("file.interpretProxy", json!({"item": full.0, "alpha": "ignore", "invertAlpha": true})).unwrap();
-    let px = s.project.item(full).unwrap().proxy.clone().unwrap();
-    assert_eq!(px.footage.alpha, AlphaMode::Ignore);
-    assert!(px.footage.invert_alpha);
-    let f = match &s.project.item(full).unwrap().kind {
-        ItemKind::Footage(f) => f.clone(),
-        _ => panic!("not footage"),
-    };
-    assert_eq!(f.alpha, AlphaMode::Straight, "the main footage keeps its interpretation");
-}
-
-/// Separate Fields: each field becomes a frame at twice the frame rate, the other field's lines
-/// interpolated; the dominant field comes first.
-#[test]
-fn separate_fields_make_frames_from_fields() {
-    let mut s = session();
-    let mov = import(&mut s, "/m/lines.mov");
-    s.execute("comp.new", json!({"name": "C", "width": 4, "height": 4, "frameRate": 20, "duration": 1})).unwrap();
-    let c = s.active_comp_id().unwrap();
-    s.execute("layer.addItem", json!({"item": mov.0})).unwrap();
-    let o = RenderOpts::default();
-    // Progressive: alternating rows.
-    assert!(red(px(&s, c, 0.0, o, 1, 0)) && blue(px(&s, c, 0.0, o, 1, 1)));
-    s.execute("file.interpretFootage", json!({"item": mov.0, "fields": "upper"})).unwrap();
-    // Field 1 (upper = even rows, red) then field 2 (odd rows, blue), each 1/20 s.
-    for y in 0..3 {
-        assert!(red(px(&s, c, 0.0, o, 1, y)), "upper field at row {y}");
-        assert!(blue(px(&s, c, 0.05, o, 1, y + 1)), "lower field at row {}", y + 1);
-    }
-    s.execute("file.interpretFootage", json!({"item": mov.0, "fields": "lower"})).unwrap();
-    assert!(blue(px(&s, c, 0.0, o, 1, 2)));
-    assert!(red(px(&s, c, 0.05, o, 1, 1)));
-    let r = s.execute("file.interpretFootage", json!({"item": mov.0, "fields": "off"})).unwrap();
-    assert_eq!(r["items"][0]["fields"], "Off");
-}
-
-/// Non-square pixels: a 10×10 footage with pixel aspect 2 covers 20×10 comp pixels.
-#[test]
-fn pixel_aspect_stretches_footage_in_the_comp() {
-    let mut s = session();
-    let w = import(&mut s, "/m/wide.png");
-    s.execute("comp.new", json!({"name": "C", "width": 40, "height": 20, "frameRate": 10, "duration": 1})).unwrap();
-    let c = s.active_comp_id().unwrap();
-    s.execute("layer.addItem", json!({"item": w.0})).unwrap();
-    let o = RenderOpts::default();
-    let covered = |s: &Session| s.render(c, Tick::ZERO, o).data.iter().filter(|p| p[3] > 0.5).count();
-    assert_eq!(covered(&s), 100);
-    s.execute("file.interpretFootage", json!({"item": w.0, "pixelAspect": 2.0})).unwrap();
-    assert_eq!(covered(&s), 200);
-    // Centered on the comp: x 10..30 (edge pixels are filtered).
-    assert!(px(&s, c, 0.0, o, 11, 10)[3] > 0.99 && px(&s, c, 0.0, o, 28, 10)[3] > 0.99);
-    assert!(px(&s, c, 0.0, o, 8, 10)[3] < 0.01 && px(&s, c, 0.0, o, 31, 10)[3] < 0.01);
-    // A comp with the same pixel aspect shows the footage 1:1.
-    s.execute("comp.settings", json!({"pixelAspect": 2.0})).unwrap();
-    assert_eq!(covered(&s), 100);
-}
-
-/// Alpha ▸ Guess: premultiplied files are recognised with their matte colour; Invert Alpha
-/// and Interpret As Linear Light change the decoded pixels.
-#[test]
-fn guess_alpha_invert_and_linear_light() {
-    let mut s = session();
-    let b = import(&mut s, "/m/matte_black.png");
-    let w = import(&mut s, "/m/matte_white.png");
-    let h = import(&mut s, "/m/half.png");
-    let foot = |s: &Session, i: ItemId| match &s.project.item(i).unwrap().kind {
-        ItemKind::Footage(f) => f.clone(),
-        _ => panic!("not footage"),
-    };
-    s.execute("file.interpretFootage", json!({"items": [b.0, w.0, h.0], "alpha": "guess"})).unwrap();
-    assert_eq!(foot(&s, b).alpha, AlphaMode::Premultiplied);
-    assert_eq!(foot(&s, b).premul_color, [0.0; 3]);
-    assert_eq!(foot(&s, w).alpha, AlphaMode::Premultiplied);
-    assert_eq!(foot(&s, w).premul_color, [1.0; 3]);
-    // White at 25 %: not explained by a black matte (1 > 0.25) but it is by white… either way
-    // the guess is consistent with the pixels.
-    assert!(matches!(foot(&s, h).alpha, AlphaMode::Straight | AlphaMode::Premultiplied));
-    // An explicit matte colour.
-    s.execute("file.interpretFootage", json!({"item": b.0, "alpha": "premultiplied", "matteColor": "#808080"})).unwrap();
-    assert!((foot(&s, b).premul_color[0] - 128.0 / 255.0).abs() < 1e-3);
-    // Invert Alpha: 25 % → 75 %.
-    s.execute("file.interpretFootage", json!({"item": h.0, "alpha": "straight", "invertAlpha": true})).unwrap();
-    s.execute("comp.new", json!({"name": "C", "width": 4, "height": 4, "frameRate": 10, "duration": 1})).unwrap();
-    let c = s.active_comp_id().unwrap();
-    s.execute("layer.addItem", json!({"item": h.0})).unwrap();
-    let p = px(&s, c, 0.0, RenderOpts::default(), 1, 1);
-    assert!((p[3] - 0.75).abs() < 0.01 && p[0] > 0.7, "{p:?}");
-    // Interpret As Linear Light keeps alpha and re-encodes the colour.
-    s.execute("file.interpretFootage", json!({"item": h.0, "invertAlpha": false, "linearLight": true})).unwrap();
-    let p = px(&s, c, 0.0, RenderOpts::default(), 1, 1);
-    assert!((p[3] - 0.25).abs() < 0.01, "{p:?}");
-    // Remember / Apply Interpretation carries the new settings.
-    s.state.project_selection = vec![h];
-    s.execute("file.rememberInterpretation", json!({"item": h.0})).unwrap();
-    s.execute("file.applyInterpretation", json!({"items": [w.0]})).unwrap();
-    assert!(foot(&s, w).linear_light);
-    // Color ▸ Preserve RGB (#411) is set, rendered and carried by Apply Interpretation.
-    let out = s.execute("file.interpretFootage", json!({"item": h.0, "preserveRgb": true})).unwrap();
-    assert_eq!(out["items"][0]["preserveRgb"], true);
-    let p = px(&s, c, 0.0, RenderOpts::default(), 1, 1);
-    assert!((p[0] - 0.25).abs() < 0.01, "white at 25 %, unconverted: {p:?}");
-    s.execute("file.rememberInterpretation", json!({"item": h.0})).unwrap();
-    s.execute("file.applyInterpretation", json!({"items": [w.0]})).unwrap();
-    assert!(foot(&s, w).preserve_rgb);
-}
diff --git a/crates/engine/src/tests_text_edit.rs b/crates/engine/src/tests_text_edit.rs
deleted file mode 100644
index 243a9c676..000000000
--- a/crates/engine/src/tests_text_edit.rs
+++ /dev/null
@@ -1,394 +0,0 @@
-//! On-canvas text editing and per-character styles through commands: run-scoped
-//! `layer.setText`, text.insert / delete / setSelection / moveCaret, the text clipboard and the
-//! paste-formatting commands, with undo / redo.
-
-use effectcraft_keyframe::{BaselineOption, Justify, Kerning, TextDoc};
-use serde_json::json;
-
-use crate::Session;
-use crate::commands::text_edit::layer_doc;
-
-fn session(text: &str) -> (Session, u64) {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "C", "width": 640, "height": 360, "duration": 4})).unwrap();
-    let t = s.execute("layer.newText", json!({"text": text, "size": 60, "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
-    (s, t)
-}
-
-fn doc(s: &Session, t: u64) -> TextDoc {
-    layer_doc(s, effectcraft_project::LayerId(t)).unwrap()
-}
-
-fn sel(s: &Session) -> (usize, usize) {
-    let e = s.state.text_edit.as_ref().unwrap();
-    (e.anchor, e.caret)
-}
-
-#[test]
-fn set_text_with_a_range_creates_runs_and_undoes() {
-    let (mut s, t) = session("Hello World");
-    s.execute("layer.setText", json!({"layer": t, "range": [6, 11], "size": 30, "fill": "#ff0000", "kerning": "optical"})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!(d.runs().len(), 2);
-    assert_eq!(d.style_at(0).size, 60.0);
-    assert_eq!(d.style_at(7).size, 30.0);
-    assert_eq!(d.style_at(7).fill, [1.0, 0.0, 0.0, 1.0]);
-    assert_eq!(d.style_at(7).kerning, Kerning::Optical);
-    // Paragraph attributes apply to the paragraphs the range touches; document ones to all.
-    s.execute("layer.setText", json!({"layer": t, "range": [0, 1], "justify": "justifyAll", "indentFirst": 20, "spaceAfter": 6, "direction": "rtl"})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!((d.justify, d.indent_first, d.space_after), (Justify::JustifyAll, 20.0, 6.0));
-    // Unknown attributes and bad values are errors (nothing changes).
-    assert!(s.execute("layer.setText", json!({"layer": t, "sizee": 3})).is_err());
-    assert!(s.execute("layer.setText", json!({"layer": t, "size": "big"})).is_err());
-    assert!(s.execute("edit.undo", json!({})).is_ok());
-    assert_eq!(doc(&s, t).justify, Justify::Left);
-    assert!(s.execute("edit.undo", json!({})).is_ok());
-    assert!(doc(&s, t).is_uniform());
-    s.execute("edit.redo", json!({})).unwrap();
-    assert_eq!(doc(&s, t).runs().len(), 2);
-    // Without a range everything changes and the runs collapse again.
-    s.execute("layer.setText", json!({"layer": t, "size": 44, "superscript": true})).unwrap();
-    let d = doc(&s, t);
-    assert!(d.runs().iter().all(|r| r.style.size == 44.0 && r.style.baseline == BaselineOption::Superscript));
-    // Replacing a range's text keeps the formatting around it.
-    s.execute("layer.setText", json!({"layer": t, "range": [0, 5], "text": "Howdy", "fauxBold": true})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!(d.text, "Howdy World");
-    assert!(d.style_at(2).faux_bold && !d.style_at(7).faux_bold);
-}
-
-#[test]
-fn typing_deleting_and_caret_movement() {
-    let (mut s, t) = session("abc def");
-    s.execute("text.edit", json!({"layer": t})).unwrap();
-    assert_eq!(sel(&s), (0, 7), "editing starts with everything selected");
-    s.execute("text.setSelection", json!({"start": 3})).unwrap();
-    s.execute("text.insert", json!({"text": "XY", "merge": "typing-1"})).unwrap();
-    s.execute("text.insert", json!({"text": "Z", "merge": "typing-1"})).unwrap();
-    assert_eq!(doc(&s, t).text, "abcXYZ def");
-    assert_eq!(sel(&s), (6, 6));
-    // One undo step for the merged typing.
-    s.execute("edit.undo", json!({})).unwrap();
-    assert_eq!(doc(&s, t).text, "abc def");
-    assert_eq!(sel(&s), (6, 6));
-    s.execute("edit.redo", json!({})).unwrap();
-    s.execute("text.setSelection", json!({"start": 6})).unwrap();
-    // Backspace / Delete, by character and by word.
-    s.execute("text.delete", json!({})).unwrap();
-    assert_eq!(doc(&s, t).text, "abcXY def");
-    s.execute("text.delete", json!({"direction": "forward", "word": true})).unwrap();
-    assert_eq!(doc(&s, t).text, "abcXY");
-    s.execute("text.delete", json!({"word": true})).unwrap();
-    assert_eq!(doc(&s, t).text, "");
-    s.execute("text.insert", json!({"text": "one two\nthree"})).unwrap();
-    assert_eq!(sel(&s), (13, 13));
-    // Caret movement: words, lines, up / down, extend.
-    let mv = |s: &mut Session, to: &str, extend: bool| -> (usize, usize) {
-        let r = s.execute("text.moveCaret", json!({"to": to, "extend": extend})).unwrap();
-        (r["anchor"].as_u64().unwrap() as usize, r["caret"].as_u64().unwrap() as usize)
-    };
-    assert_eq!(mv(&mut s, "lineStart", false), (8, 8));
-    assert_eq!(mv(&mut s, "up", false).1, 0);
-    assert_eq!(mv(&mut s, "wordRight", false), (3, 3));
-    assert_eq!(mv(&mut s, "wordRight", true), (3, 7));
-    assert_eq!(mv(&mut s, "left", false), (3, 3), "left collapses a selection to its start");
-    assert_eq!(mv(&mut s, "lineEnd", false), (7, 7));
-    assert_eq!(mv(&mut s, "down", false).1, 13);
-    assert_eq!(mv(&mut s, "start", true), (13, 0));
-    assert_eq!(mv(&mut s, "paraEnd", false), (7, 7));
-    // Select All while editing selects the text, not the layers.
-    s.execute("edit.selectAll", json!({})).unwrap();
-    assert_eq!(sel(&s), (0, 13));
-    // Undo past the insertion clamps the selection.
-    s.execute("edit.undo", json!({})).unwrap();
-    assert!(sel(&s).0 <= doc(&s, t).char_len() && sel(&s).1 <= doc(&s, t).char_len());
-    s.execute("text.endEdit", json!({})).unwrap();
-    assert!(s.state.text_edit.is_none());
-}
-
-#[test]
-fn caret_style_applies_to_the_next_typed_text() {
-    let (mut s, t) = session("ab");
-    s.execute("text.edit", json!({"layer": t, "caret": 1})).unwrap();
-    s.execute("layer.setText", json!({"layer": t, "range": [1, 1], "size": 12, "fill": [0, 1, 0]})).unwrap();
-    assert!(doc(&s, t).is_uniform(), "a caret-only change doesn't touch the text");
-    s.execute("text.insert", json!({"text": "Q"})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!(d.text, "aQb");
-    assert_eq!(d.style_at(1).size, 12.0);
-    assert_eq!(d.style_at(1).fill, [0.0, 1.0, 0.0, 1.0]);
-    assert_eq!(d.style_at(2).size, 60.0);
-    // Typing again continues the new style (the character before the caret).
-    s.execute("text.insert", json!({"text": "R"})).unwrap();
-    assert_eq!(doc(&s, t).style_at(2).size, 12.0);
-}
-
-#[test]
-fn clipboard_and_paste_formatting() {
-    let (mut s, t) = session("red plain");
-    s.execute("layer.setText", json!({"layer": t, "range": [0, 3], "fill": "#ff0000", "size": 20})).unwrap();
-    s.execute("text.edit", json!({"layer": t, "select": [0, 3]})).unwrap();
-    let r = s.execute("edit.copy", json!({})).unwrap();
-    assert_eq!(r["text"], "red");
-    // Paste keeps the copied formatting.
-    s.execute("text.setSelection", json!({"start": 9})).unwrap();
-    s.execute("edit.paste", json!({})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!(d.text, "red plainred");
-    assert_eq!(d.style_at(10).fill, [1.0, 0.0, 0.0, 1.0]);
-    assert_eq!(sel(&s), (12, 12));
-    // Different text from the system clipboard pastes in the caret's style.
-    s.execute("text.setSelection", json!({"start": 4})).unwrap();
-    s.execute("edit.paste", json!({"text": "new "})).unwrap();
-    assert_eq!(doc(&s, t).text, "red new plainred");
-    assert_eq!(doc(&s, t).style_at(5).size, 60.0);
-    // Paste Text and Match Formatting: the copied text in the caret's style.
-    s.execute("text.setSelection", json!({"start": 8})).unwrap();
-    s.execute("edit.pasteTextMatchFormatting", json!({})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!(d.text, "red new redplainred");
-    assert_eq!(d.style_at(9).fill, [1.0; 4]);
-    // Paste Text Formatting Only onto a selection.
-    s.execute("text.setSelection", json!({"start": 11, "end": 16})).unwrap();
-    s.execute("edit.pasteTextFormattingOnly", json!({})).unwrap();
-    let d = doc(&s, t);
-    assert_eq!(d.style_at(12).fill, [1.0, 0.0, 0.0, 1.0]);
-    assert_eq!(d.style_at(12).size, 20.0);
-    // Cut removes the selection.
-    s.execute("text.setSelection", json!({"start": 0, "end": 4})).unwrap();
-    assert_eq!(s.execute("edit.cut", json!({})).unwrap()["text"], "red ");
-    assert_eq!(doc(&s, t).text, "new redplainred");
-    // Not editing: Paste Text Formatting Only restyles the whole selected text layer.
-    s.execute("text.endEdit", json!({})).unwrap();
-    s.execute("layer.select", json!({"layers": [t]})).unwrap();
-    s.execute("edit.pasteTextFormattingOnly", json!({})).unwrap();
-    assert!(doc(&s, t).is_uniform());
-    assert_eq!(doc(&s, t).size, 20.0);
-}
-
-#[test]
-fn type_tool_layers_point_box_and_empty_cleanup() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "C", "width": 640, "height": 360, "duration": 4})).unwrap();
-    let t = s.execute("layer.newText", json!({"text": "", "position": [100, 200], "justify": "left", "edit": true})).unwrap()["layer"].as_u64().unwrap();
-    assert_eq!(s.state.text_edit.as_ref().map(|e| e.layer.0), Some(t));
-    // Leaving an untouched Type-tool layer deletes it.
-    s.execute("text.endEdit", json!({})).unwrap();
-    assert!(s.active_comp().unwrap().layers.is_empty());
-    let b = s.execute("layer.newText", json!({"text": "", "box": [40, 50, 300, 120], "edit": true})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("text.insert", json!({"text": "Boxed"})).unwrap();
-    let d = doc(&s, b);
-    assert_eq!(d.box_size, Some([300.0, 120.0]));
-    assert_eq!(d.box_pos, [-150.0, -60.0]);
-    let l = s.active_comp().unwrap().layers[0].clone();
-    assert_eq!(l.name, "Boxed", "named after its text");
-    let pos = l.props.prop("transform/position").unwrap().value.as_vec3();
-    assert_eq!([pos[0], pos[1]], [190.0, 110.0]);
-    s.execute("text.endEdit", json!({})).unwrap();
-    assert_eq!(s.active_comp().unwrap().layers.len(), 1);
-    // Resizing the box (layer space) is an attribute too.
-    s.execute("layer.setText", json!({"layer": b, "box": [-100, -60, 200, 120]})).unwrap();
-    assert_eq!(doc(&s, b).box_size, Some([200.0, 120.0]));
-    s.execute("layer.setText", json!({"layer": b, "vertical": true})).unwrap();
-    assert!(doc(&s, b).vertical);
-}
-
-#[test]
-fn edit_state_round_trips_through_serde() {
-    let (mut s, t) = session("abc");
-    s.execute("text.edit", json!({"layer": t, "select": [1, 2]})).unwrap();
-    let j = serde_json::to_value(&s.state).unwrap();
-    let back: crate::EditorState = serde_json::from_value(j).unwrap();
-    assert_eq!(back.text_edit, s.state.text_edit);
-}
-
-#[test]
-fn opentype_features_per_range_render_and_query() {
-    let (mut s, t) = session("Office 1/2");
-    s.execute("layer.setText", json!({"layer": t, "range": [7, 10], "fractions": true, "ss01": true})).unwrap();
-    let d = doc(&s, t);
-    assert!(!d.style_at(0).opentype.fractions);
-    assert!(d.style_at(8).opentype.fractions && d.style_at(8).opentype.stylistic_set(1));
-    // The laid-out glyphs change (frac turns 1/2 into a fraction).
-    let plain = effectcraft_text::layout_doc(&TextDoc { text: "1/2".into(), ..Default::default() });
-    let frac = effectcraft_text::layout_doc(&d.slice(7..10));
-    let ids = |l: &effectcraft_text::TextLayout| l.glyphs.iter().map(|g| g.gid).collect::<Vec<_>>();
-    assert_ne!(ids(&plain), ids(&frac));
-    // Undo restores the uniform style.
-    s.execute("edit.undo", json!({})).unwrap();
-    assert!(doc(&s, t).is_uniform());
-    // Font feature query (font by name, or the layer's).
-    let f = s.execute("text.fontFeatures", json!({"font": "Noto Serif"})).unwrap();
-    assert_eq!(f["options"]["smallCaps"], true);
-    assert!(f["features"].as_array().unwrap().iter().any(|t| t == "onum"));
-    let f = s.execute("text.fontFeatures", json!({"layer": t})).unwrap();
-    assert_eq!(f["family"], "Inter");
-    assert!(f["options"]["stylisticSets"].as_array().unwrap().contains(&json!(1)));
-    assert_eq!(f["options"]["smallCaps"], false);
-}
-
-#[test]
-fn fonts_lists_bundled_and_installed_families() {
-    let mut s = Session::default();
-    let r = s.execute("text.fonts", json!({})).unwrap();
-    let fams = r["families"].as_array().unwrap();
-    assert_eq!(r["count"].as_u64().unwrap() as usize, fams.len());
-    let inter = fams.iter().find(|f| f["family"] == "Inter").unwrap();
-    assert_eq!(inter["origin"], "bundled");
-    assert!(inter["styles"].as_array().unwrap().contains(&json!("Bold")));
-    // Installed fonts are listed without any layer having asked for one.
-    use effectcraft_text::fonts::FontSource as _;
-    let installed = effectcraft_text::fonts::DirectorySource::system().faces();
-    for face in &installed {
-        assert!(fams.iter().any(|f| f["family"].as_str().unwrap().eq_ignore_ascii_case(&face.family)), "{} not listed", face.family);
-    }
-    // Filtered by name; rescanning keeps what was there.
-    let r = s.execute("text.fonts", json!({"query": "noto ser", "rescan": true})).unwrap();
-    assert_eq!(r["families"][0]["family"], "Noto Serif");
-    // The bundled face is Regular; the OS can also provide Bold, Italic, or other faces.
-    // Compare against the independent directory inventory rather than assuming an empty OS.
-    let mut expected_styles = std::collections::BTreeSet::from(["Regular".to_string()]);
-    expected_styles.extend(installed.iter().filter(|face| face.family.eq_ignore_ascii_case("Noto Serif")).map(|face| face.style.clone()));
-    let styles: Vec<String> = r["families"][0]["styles"].as_array().unwrap().iter().map(|style| style.as_str().unwrap().to_string()).collect();
-    assert_eq!(styles.iter().cloned().collect::<std::collections::BTreeSet<_>>(), expected_styles);
-    assert_eq!(styles.len(), expected_styles.len(), "style menu has no duplicates");
-    assert!(r["families"].as_array().unwrap().iter().all(|f| f["family"].as_str().unwrap().to_lowercase().contains("noto ser")));
-    // The style menus offer a family's own styles.
-    assert_eq!(crate::font_styles("noto serif"), styles);
-    assert_eq!(crate::font_styles("NOTO SERIF"), styles);
-    assert_eq!(crate::font_styles("No Such Family").len(), 5);
-}
-
-/// A font file of just `name` (the family, Regular) and an `fvar` table with one axis pinned at
-/// 400 (so the helpers that look for an installed font with a real axis range never pick it).
-fn pinned_variable_font(family: &str) -> Vec<u8> {
-    let u16s = |v: &[u16]| -> Vec<u8> { v.iter().flat_map(|x| x.to_be_bytes()).collect() };
-    let strings: Vec<Vec<u8>> = [family, "Regular"].iter().map(|s| s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect()).collect();
-    let mut name = u16s(&[0, 2, 30]);
-    let mut off = 0;
-    for (id, st) in strings.iter().enumerate() {
-        name.extend(u16s(&[3, 1, 0x409, id as u16 + 1, st.len() as u16, off]));
-        off += st.len() as u16;
-    }
-    strings.iter().for_each(|st| name.extend(st));
-    let mut fvar = u16s(&[1, 0, 16, 2, 1, 20, 0, 8]);
-    fvar.extend(b"wght".iter().copied().chain(u16s(&[0x190, 0, 0x190, 0, 0x190, 0, 0, 256])));
-    let mut out = u16s(&[1, 0, 2, 0, 0, 0]);
-    let mut body: Vec<u8> = vec![];
-    for (tag, data) in [(b"fvar", fvar), (b"name", name)] {
-        out.extend(tag);
-        out.extend([0u8; 4]);
-        out.extend(((12 + 32 + body.len()) as u32).to_be_bytes());
-        out.extend((data.len() as u32).to_be_bytes());
-        body.extend(data);
-    }
-    out.extend(body);
-    out
-}
-
-/// The font menu's Variable Fonts filter (After Effects 26.3): `text.fonts {variable: true}`
-/// lists only families with variation axes, every listing says which families are variable, and
-/// the font menu's rows carry the flag the filter uses.
-#[test]
-fn fonts_filter_variable_families() {
-    const FAMILY: &str = "EffectCraft Variable Filter Test";
-    assert_eq!(effectcraft_text::fonts::add_font_data(pinned_variable_font(FAMILY)).len(), 1);
-    let mut s = Session::default();
-    let all = s.execute("text.fonts", json!({})).unwrap();
-    let fams = all["families"].as_array().unwrap();
-    let flag = |name: &str| fams.iter().find(|f| f["family"] == name).map(|f| f["variable"].clone());
-    assert_eq!(flag("Inter"), Some(json!(false)), "the bundled fonts are static");
-    assert_eq!(flag(FAMILY), Some(json!(true)));
-    let var = s.execute("text.fonts", json!({"variable": true})).unwrap();
-    let listed = var["families"].as_array().unwrap();
-    assert_eq!(var["count"].as_u64(), Some(listed.len() as u64));
-    assert!(listed.iter().all(|f| f["variable"] == true), "{var}");
-    assert!(listed.iter().any(|f| f["family"] == FAMILY), "{var}");
-    assert!(listed.len() < fams.len(), "the filter drops the static families");
-    // Combined with the name query.
-    let both = s.execute("text.fonts", json!({"variable": true, "query": "variable filter"})).unwrap();
-    assert_eq!(both["families"].as_array().map(Vec::len), Some(1), "{both}");
-    let none = s.execute("text.fonts", json!({"variable": true, "query": "jetbrains mono"})).unwrap();
-    assert!(!none["families"].as_array().unwrap().iter().any(|f| f["family"] == "JetBrains Mono"), "{none}");
-    // The font menu's rows.
-    let menu = crate::font_menu(&s.prefs);
-    assert!(menu.iter().any(|r| r.family == FAMILY && r.variable));
-    assert!(menu.iter().any(|r| r.family == "Inter" && !r.variable));
-}
-
-/// A variable font of `name` and `fvar` only: one `wght` axis 100..900 (default 300, style
-/// `Light`) and the named `instances` (style, `wght`), each with a PostScript name
-/// `<family without spaces>-<style without spaces>`.
-fn instanced_variable_font(family: &str, instances: &[(&str, f32)]) -> Vec<u8> {
-    let u16s = |v: &[u16]| -> Vec<u8> { v.iter().flat_map(|x| x.to_be_bytes()).collect() };
-    let squash = |s: &str| s.chars().filter(char::is_ascii_alphanumeric).collect::<String>();
-    let mut strings: Vec<(u16, String)> = vec![(1, family.into()), (2, "Light".into())];
-    let mut fvar = u16s(&[1, 0, 16, 2, 1, 20, instances.len() as u16, 10]);
-    fvar.extend(b"wght".iter().copied().chain(u16s(&[100, 0, 300, 0, 900, 0, 0, 256])));
-    for (i, (style, w)) in instances.iter().enumerate() {
-        let id = 256 + 2 * i as u16;
-        strings.push((id, (*style).into()));
-        strings.push((id + 1, format!("{}-{}", squash(family), squash(style))));
-        fvar.extend(u16s(&[id, 0]));
-        fvar.extend(((w * 65536.0) as i32).to_be_bytes());
-        fvar.extend(u16s(&[id + 1]));
-    }
-    let enc: Vec<(u16, Vec<u8>)> = strings.iter().map(|(id, s)| (*id, s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect())).collect();
-    let mut name = u16s(&[0, enc.len() as u16, 6 + 12 * enc.len() as u16]);
-    let mut off = 0;
-    for (id, st) in &enc {
-        name.extend(u16s(&[3, 1, 0x409, *id, st.len() as u16, off]));
-        off += st.len() as u16;
-    }
-    enc.iter().for_each(|(_, st)| name.extend(st));
-    let mut out = u16s(&[1, 0, 2, 0, 0, 0]);
-    let mut body: Vec<u8> = vec![];
-    for (tag, data) in [(b"fvar", fvar), (b"name", name)] {
-        out.extend(tag);
-        out.extend([0u8; 4]);
-        out.extend(((12 + 32 + body.len()) as u32).to_be_bytes());
-        out.extend((data.len() as u32).to_be_bytes());
-        body.extend(data);
-    }
-    out.extend(body);
-    out
-}
-
-/// #1563: a variable font's named instances are styles of its family in `text.fonts`, and a
-/// text layer set in one (by style, or by the instance's PostScript name as After Effects scripts
-/// do) is laid out at the instance's axis values; an axis set on the text still wins.
-#[test]
-fn variable_font_named_instances_are_styles() {
-    const FAMILY: &str = "EffectCraft Named Instance Test";
-    assert_eq!(effectcraft_text::fonts::add_font_data(instanced_variable_font(FAMILY, &[("Light", 300.0), ("Regular", 400.0), ("Black", 900.0)])).len(), 1);
-    let (mut s, t) = session("Hi");
-    let fonts = s.execute("text.fonts", json!({"query": FAMILY})).unwrap();
-    assert_eq!(fonts["families"][0]["styles"], json!(["Light", "Regular", "Black"]), "{fonts}");
-    let wght = |s: &Session| -> Vec<Vec<(String, f32)>> { effectcraft_text::layout_doc(&doc(s, t)).glyphs.iter().map(|g| g.variations.clone()).collect() };
-    let black = vec![("wght".to_string(), 900.0)];
-    s.execute("layer.setText", json!({"layer": t, "font": FAMILY, "style": "Black"})).unwrap();
-    let by_style = wght(&s);
-    assert!(!by_style.is_empty() && by_style.iter().all(|v| v == &black), "{by_style:?}");
-    s.execute("layer.setText", json!({"layer": t, "font": "EffectCraftNamedInstanceTest-Black", "style": "Regular"})).unwrap();
-    let by_ps = wght(&s);
-    assert!(!by_ps.is_empty() && by_ps.iter().all(|v| v == &black), "{by_ps:?}");
-    s.execute("layer.setText", json!({"layer": t, "variations": {"wght": 650}})).unwrap();
-    assert!(wght(&s).iter().all(|v| v == &[("wght".to_string(), 650.0)]), "{:?}", wght(&s));
-}
-
-/// `layer.setText`'s schema lists every OpenType key as optional, so checked execution (control
-/// channel, MCP) accepts them and requires none (#520).
-#[test]
-fn set_text_schema_accepts_every_opentype_key_and_requires_none() {
-    let spec = crate::commands::find("layer.setText").unwrap();
-    let schema = crate::commands::params_schema(spec);
-    assert_eq!(schema["required"], json!([]));
-    for key in ["discretionaryLigatures", "ss01", "ss02", "ss20", "swash"] {
-        assert!(schema["properties"].get(key).is_some(), "{key} is not in the schema");
-    }
-    assert!(schema["properties"].get("OpenType").is_none());
-    let (mut s, t) = session("Office 1/2");
-    s.execute_checked("layer.setText", json!({"layer": t, "discretionaryLigatures": true, "ss02": true, "ss20": true})).unwrap();
-    assert!(doc(&s, t).style_at(0).opentype.stylistic_set(20));
-}
diff --git a/crates/engine/src/viewer.rs b/crates/engine/src/viewer.rs
index 997c2023b..f8e4c7740 100644
--- a/crates/engine/src/viewer.rs
+++ b/crates/engine/src/viewer.rs
@@ -1,5 +1,5 @@
 //! Composition viewer maths shared by the frontends and tests: snapping (targets, tolerance and
-//! priority), the Show Channel / Exposure display transforms, and the viewer snapshot.
+//! priority), the display pass (Show Channel, exposure, display colour), and the viewer snapshot.
 //!
 //! Nothing here touches the project; edits go through commands.
 
@@ -15,6 +15,9 @@ use effectcraft_render::{EvalCtx, ExprHost};
 use effectcraft_time::Tick;
 use serde::{Deserialize, Serialize};
 
+mod display_pass;
+pub use display_pass::{DisplayPass, FrameEncoding, PassColor, PassConv, PassCurve, SHADER_EXPONENTS, hdr_step, lut_eval};
+
 // ---------------------------------------------------------------- snapping
 
 /// What a snap target is: a point (snaps both axes) or an axis-aligned line.
@@ -48,7 +51,7 @@ pub struct SnapTarget {
     pub priority: u8,
     pub source: SnapSource,
     /// A line's extent along itself (y of a vertical line, x of a horizontal one): a layer's
-    /// edge without Snap Edges Extended. `None` runs across the whole comp.
+    /// edge or centre line without Snap Edges Extended. `None` runs across the whole comp.
     #[serde(default)]
     pub span: Option<[f64; 2]>,
 }
@@ -70,7 +73,7 @@ impl SnapTarget {
 }
 
 /// Tools bar ▸ Snapping options, the two After Effects' Snapping menu has: Snap Edges Extended
-/// (layer edges snap along their whole line, beyond the layer's bounds) and Snap to Features in
+/// (layer edge and centre lines snap along their whole line, beyond the layer's bounds) and Snap to Features in
 /// Collapsed Compositions and Text Layers (the layers inside a precomp layer with Collapse
 /// Transformations on are targets too). Both are on by default. Every layer feature snaps
 /// (corners, edge midpoints, centre, anchor point, mask and shape path points), as in After
@@ -126,9 +129,10 @@ fn better(a: (f64, u8), b: (f64, u8)) -> bool {
 }
 
 /// Snap feature points `sources` (comp pixels) to the nearest target within `tol` comp pixels.
-/// A point target snaps both axes and wins when it is at least as near as the best lines;
-/// otherwise the nearest vertical and horizontal lines snap x and y independently. Ties go to
-/// the lower priority value.
+/// A point target snaps both axes and wins unless a vertical and a horizontal line both resolve
+/// and together lie nearer than it (one line alone leaves the other axis free, so it never beats
+/// a point: a layer's edge midpoint lies on its edge line); otherwise the nearest vertical and
+/// horizontal lines snap x and y independently. Ties go to the lower priority value.
 pub fn snap(sources: &[[f64; 2]], targets: &[SnapTarget], tol: f64) -> Option<Snap> {
     let mut best_pt: Option<((f64, u8), [f64; 2], SnapTarget)> = None;
     let mut best_x: Option<((f64, u8), [f64; 2], SnapTarget)> = None;
@@ -150,9 +154,9 @@ pub fn snap(sources: &[[f64; 2]], targets: &[SnapTarget], tol: f64) -> Option<Sn
             }
         }
     }
-    let line_best = [best_x.map(|b| b.0.0), best_y.map(|b| b.0.0)].into_iter().flatten().fold(f64::INFINITY, f64::min);
+    let both_lines = best_x.zip(best_y).map_or(f64::INFINITY, |(x, y)| x.0.0.hypot(y.0.0));
     if let Some((k, s, t)) = best_pt
-        && k.0 <= line_best + 1e-9
+        && k.0 <= both_lines + 1e-9
     {
         return Some(Snap { delta: [t.pos[0] - s[0], t.pos[1] - s[1]], hits: vec![t], at: t.pos });
     }
@@ -366,8 +370,8 @@ fn visible_layers<'a>(ctx: &EvalCtx<'a>, exclude: &'a [LayerId]) -> impl Iterato
     comp.layers.iter().filter(move |l| l.is_active_at(time) && l.switches.video && (!any_solo || l.switches.solo) && !exclude.contains(&l.id))
 }
 
-/// A 2D layer's snap targets: its box points, its edges as lines while unrotated (across the
-/// comp with Snap Edges Extended, along the layer otherwise), its anchor point unless `anchor` is
+/// A 2D layer's snap targets: its box points, its edges and centre as lines while unrotated (across
+/// the comp with Snap Edges Extended, along the layer otherwise), its anchor point unless `anchor` is
 /// false (Pan Behind drags it, the box stays put), its mask and shape path vertices and, with
 /// Snap to Features in Collapsed Compositions, the targets of the visible layers inside a
 /// collapsed precomp layer. None for cameras, lights and 3D layers.
@@ -386,10 +390,10 @@ fn layer_targets_at(ctx: &EvalCtx, l: &Layer, anchor: bool, f: SnapFeatures, dep
         let [nw, ne, _, sw] = b.corners;
         if (nw[1] - ne[1]).abs() < 1e-6 && (nw[0] - sw[0]).abs() < 1e-6 {
             let (xs, ys) = if f.edges_extended { (None, None) } else { (Some([nw[0], ne[0]]), Some([nw[1], sw[1]])) };
-            for x in [nw[0], ne[0]] {
+            for x in [nw[0], b.center[0], ne[0]] {
                 out.push(SnapTarget::vline(x, PRI_LAYER, src).within(ys));
             }
-            for y in [nw[1], sw[1]] {
+            for y in [nw[1], b.center[1], sw[1]] {
                 out.push(SnapTarget::hline(y, PRI_LAYER, src).within(xs));
             }
         }
@@ -499,63 +503,6 @@ fn linear_to_srgb(v: f32) -> f32 {
     if v <= 0.003_130_8 { v * 12.92 } else { 1.055 * v.powf(1.0 / 2.4) - 0.055 }
 }
 
-/// 8-bit exposure lookup table: `stops` applied in linear light.
-pub fn exposure_lut(stops: f32) -> [u8; 256] {
-    let k = 2f32.powf(stops);
-    let mut lut = [0u8; 256];
-    for (i, o) in lut.iter_mut().enumerate() {
-        let lin = srgb_to_linear(i as f32 / 255.0) * k;
-        *o = (linear_to_srgb(lin).clamp(0.0, 1.0) * 255.0 + 0.5) as u8;
-    }
-    lut
-}
-
-/// Apply the viewer's channel and exposure to premultiplied 8-bit RGBA pixels in place.
-/// RGB shows the image (exposure only); Red/Green/Blue/Alpha show one channel as an opaque
-/// grayscale image (or tinted in that channel's colour when `colorized`); RGB Straight shows the
-/// unpremultiplied colour, opaque.
-pub fn display_transform(px: &mut [[u8; 4]], channel: Channel, colorized: bool, stops: f32) {
-    let lut = (stops != 0.0).then(|| exposure_lut(stops));
-    let ex = |v: u8| lut.as_ref().map(|l| l[v as usize]).unwrap_or(v);
-    for p in px.iter_mut() {
-        let [r, g, b, a] = *p;
-        *p = match channel {
-            Channel::Rgb => {
-                if lut.is_none() {
-                    continue;
-                }
-                // Exposure on straight colour, re-premultiplied.
-                let un = |c: u8| if a == 0 { 0 } else { ((c as u32 * 255 + a as u32 / 2) / a as u32).min(255) as u8 };
-                let pm = |c: u8| ((ex(un(c)) as u32 * a as u32 + 127) / 255) as u8;
-                [pm(r), pm(g), pm(b), a]
-            }
-            Channel::Red | Channel::Green | Channel::Blue => {
-                let (i, c) = match channel {
-                    Channel::Red => (0, r),
-                    Channel::Green => (1, g),
-                    _ => (2, b),
-                };
-                let v = ex(c);
-                if colorized {
-                    let mut o = [0, 0, 0, 255];
-                    o[i] = v;
-                    o
-                } else {
-                    [v, v, v, 255]
-                }
-            }
-            Channel::Alpha => {
-                let v = ex(a);
-                [v, v, v, 255]
-            }
-            Channel::RgbStraight => {
-                let un = |c: u8| if a == 0 { 0 } else { ((c as u32 * 255 + a as u32 / 2) / a as u32).min(255) as u8 };
-                [ex(un(r)), ex(un(g)), ex(un(b)), 255]
-            }
-        };
-    }
-}
-
 // ---------------------------------------------------------------- display colour management
 
 /// View ▸ Simulate Output: the output device a preview imitates.
@@ -663,10 +610,10 @@ impl SimProfile {
     }
 
     pub fn parse(s: &str) -> Option<SimProfile> {
-        let k: String = s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase();
+        let k: String = s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase();
         SimProfile::ALL
             .into_iter()
-            .find(|p| p.id().to_ascii_lowercase() == k || p.label().chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase() == k)
+            .find(|p| p.id().to_ascii_lowercase() == k || p.label().chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase() == k)
             .or(match k.as_str() {
                 "off" => Some(SimProfile::None),
                 "hdtv" | "bt709" => Some(SimProfile::Rec709),
@@ -998,6 +945,12 @@ impl DisplayColor {
         )
     }
 
+    /// A conversion that is a baked 3D LUT alone, as a LUT-based My Custom RGB profile makes
+    /// (tests of the display pass).
+    pub fn from_lut(lut: Arc<effectcraft_color::icc::Lut3d>) -> DisplayColor {
+        DisplayColor { sim: None, display: None, lut: Some(lut) }
+    }
+
     /// Whether the simulation runs a LUT-based ICC profile (baked into a 3D LUT).
     pub fn is_lut(&self) -> bool {
         self.lut.is_some()
@@ -1096,6 +1049,9 @@ pub struct Snapshot {
     /// Render scale the image was taken at.
     pub scale: f64,
     pub image: Arc<Image>,
+    /// How `image` is encoded: rendered without the HDR step in 32 bpc, so viewer exposure
+    /// reaches its over-range values; the display pass applies the step.
+    pub encoding: FrameEncoding,
 }
 
 #[cfg(test)]
diff --git a/crates/engine/src/viewer/display_pass.rs b/crates/engine/src/viewer/display_pass.rs
new file mode 100644
index 000000000..f3daf579c
--- /dev/null
+++ b/crates/engine/src/viewer/display_pass.rs
@@ -0,0 +1,404 @@
+//! The viewer's display pass as plain data: what turns a rendered frame into the pixels the
+//! Composition panel shows. The frontend runs it in a shader. The same steps on the CPU
+//! ([`DisplayPass::pixel`]) are its fallback without a GPU and the reference the shader is tested
+//! against, so both use the same `f32` operations in the same order.
+//!
+//! Steps, per pixel of a premultiplied frame encoded in the output space:
+//! 1. Unpremultiply (NaN alpha counts as 0, NaN colour as 0).
+//! 2. When exposure or an HDR step applies: decode with the frame's curve, multiply by 2^stops
+//!    in linear light, run the pending HDR step (Project Settings ▸ HDR: Compand / Tone Map, for
+//!    frames rendered without it), encode again.
+//! 3. Clamp to 0..1: the output's numbers.
+//! 4. The display colour conversion (Use Display Color Management, Simulate Output), on RGB and
+//!    RGB Straight only.
+//! 5. Show Channel, premultiply (without step 2 or a display conversion: the frame's own
+//!    premultiplied values, clamped to alpha), and round to 8 bits with `floor(v · 255 + 0.5)`.
+//!
+//! Exposure therefore acts on the full float range of 32 bpc frames, before tone mapping and
+//! before the display conversion. With neither exposure nor an HDR step, step 2 is skipped, so
+//! 8-bit frames pass through unchanged.
+
+use std::sync::Arc;
+
+use effectcraft_color::icc::Lut3d;
+use effectcraft_color::space;
+use effectcraft_project::{HdrMode, ProjectSettings};
+use effectcraft_render::color::Pipe;
+
+use super::{Channel, Conv, Curve, DisplayColor};
+
+/// A transfer curve of the display pass.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum PassCurve {
+    Linear,
+    Srgb,
+    /// A pure power curve (BT.1886 2.4, Mac 1.8, custom gammas).
+    Gamma(f32),
+    Pq,
+    Hlg,
+}
+
+/// SMPTE ST 2084 and BT.2100 HLG constants (`effectcraft_color::space`), in `f32`.
+const PQ_M1: f32 = 2610.0 / 16384.0;
+const PQ_M2: f32 = 2523.0 / 4096.0 * 128.0;
+const PQ_C1: f32 = 3424.0 / 4096.0;
+const PQ_C2: f32 = 2413.0 / 4096.0 * 32.0;
+const PQ_C3: f32 = 2392.0 / 4096.0 * 32.0;
+/// Linear 1.0 as a share of PQ's 10 000 cd/m² (the 203 cd/m² reference white).
+const PQ_WHITE: f32 = 203.0 / 10_000.0;
+const HLG_A: f32 = 0.178_832_77;
+const HLG_B: f32 = 0.284_668_92;
+const HLG_C: f32 = 0.559_910_7;
+const HLG_REFERENCE: f32 = 0.264_962_56;
+
+/// The exponents the shader is handed (`vals2.yzw`): 1 / 2.4, 1 / PQ m2, 1 / PQ m1.
+pub const SHADER_EXPONENTS: [f32; 3] = [1.0 / 2.4, 1.0 / PQ_M2, 1.0 / PQ_M1];
+
+/// `a^g` for `a ≥ 0`, 0 at 0 (WGSL leaves `pow(0, g)` to the implementation).
+fn power(a: f32, g: f32) -> f32 {
+    if a <= 0.0 { 0.0 } else { a.powf(g) }
+}
+
+impl PassCurve {
+    /// The curve a colour space encodes with.
+    pub fn of(curve: space::Curve) -> PassCurve {
+        match curve {
+            space::Curve::Linear => PassCurve::Linear,
+            space::Curve::Srgb => PassCurve::Srgb,
+            space::Curve::Gamma24 => PassCurve::Gamma(2.4),
+            space::Curve::Pq => PassCurve::Pq,
+            space::Curve::Hlg => PassCurve::Hlg,
+        }
+    }
+
+    fn of_viewer(c: Curve) -> PassCurve {
+        match c {
+            Curve::Srgb => PassCurve::Srgb,
+            Curve::Gamma(g) => PassCurve::Gamma(g),
+            Curve::Linear => PassCurve::Linear,
+            Curve::Space(c) => PassCurve::of(c),
+        }
+    }
+
+    /// The shader's curve id.
+    pub fn id(self) -> u32 {
+        match self {
+            PassCurve::Linear => 0,
+            PassCurve::Srgb => 1,
+            PassCurve::Gamma(_) => 2,
+            PassCurve::Pq => 3,
+            PassCurve::Hlg => 4,
+        }
+    }
+
+    /// The shader's parameter to decode with: the gamma (1 for other curves).
+    pub fn decode_param(self) -> f32 {
+        if let PassCurve::Gamma(g) = self { g } else { 1.0 }
+    }
+
+    /// The shader's parameter to encode with: 1 / the gamma, as [`PassCurve::encode`] divides.
+    pub fn encode_param(self) -> f32 {
+        if let PassCurve::Gamma(g) = self { 1.0 / g } else { 1.0 }
+    }
+
+    /// Encoded → linear light, mirrored around zero.
+    pub fn decode(self, v: f32) -> f32 {
+        let a = v.abs();
+        let l = match self {
+            PassCurve::Linear => a,
+            PassCurve::Srgb => {
+                if a <= 0.04045 {
+                    a / 12.92
+                } else {
+                    power((a + 0.055) / 1.055, 2.4)
+                }
+            }
+            PassCurve::Gamma(g) => power(a, g),
+            PassCurve::Pq => {
+                let p = power(a.min(1.0), 1.0 / PQ_M2);
+                power((p - PQ_C1).max(0.0) / (PQ_C2 - PQ_C3 * p), 1.0 / PQ_M1) / PQ_WHITE
+            }
+            PassCurve::Hlg => {
+                let e = if a <= 0.5 { a * a / 3.0 } else { (((a - HLG_C) / HLG_A).exp() + HLG_B) / 12.0 };
+                e / HLG_REFERENCE
+            }
+        };
+        l.copysign(v)
+    }
+
+    /// Linear light → encoded, mirrored around zero.
+    pub fn encode(self, v: f32) -> f32 {
+        let a = v.abs();
+        let e = match self {
+            PassCurve::Linear => a,
+            PassCurve::Srgb => {
+                if a <= 0.003_130_8 {
+                    a * 12.92
+                } else {
+                    1.055 * power(a, 1.0 / 2.4) - 0.055
+                }
+            }
+            PassCurve::Gamma(g) => power(a, 1.0 / g),
+            PassCurve::Pq => {
+                let y = power(a * PQ_WHITE, PQ_M1);
+                power((PQ_C1 + PQ_C2 * y) / (1.0 + PQ_C3 * y), PQ_M2)
+            }
+            PassCurve::Hlg => {
+                let e = a * HLG_REFERENCE;
+                if e <= 1.0 / 12.0 { (3.0 * e).sqrt() } else { HLG_A * (12.0 * e - HLG_B).ln() + HLG_C }
+            }
+        };
+        e.copysign(v)
+    }
+}
+
+/// A conversion of the display colour: decode, an optional linear-light matrix, encode.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct PassConv {
+    pub from: PassCurve,
+    /// Rows of the linear RGB matrix (`None`: the same primaries).
+    pub matrix: Option<[[f32; 3]; 3]>,
+    pub to: PassCurve,
+}
+
+impl PassConv {
+    fn of(c: &Conv) -> PassConv {
+        PassConv { from: PassCurve::of_viewer(c.from), matrix: c.m, to: PassCurve::of_viewer(c.to) }
+    }
+
+    pub fn apply(&self, c: [f32; 3]) -> [f32; 3] {
+        let l = c.map(|v| self.from.decode(v));
+        let l = match &self.matrix {
+            Some(m) => [0, 1, 2].map(|i| m[i][0] * l[0] + m[i][1] * l[1] + m[i][2] * l[2]),
+            None => l,
+        };
+        l.map(|v| self.to.encode(v))
+    }
+}
+
+/// The display colour conversion ([`DisplayColor`]) as data for the display pass.
+#[derive(Clone, Debug)]
+pub enum PassColor {
+    /// One conversion; with Simulate Output, the conversion to the simulated device, its 8-bit
+    /// numbers (`quantize`) and the conversion from the device to the display.
+    Convs { first: PassConv, quantize: bool, second: Option<PassConv> },
+    /// A LUT-based My Custom RGB profile: the whole simulation baked into a 3D LUT.
+    Lut(Arc<Lut3d>),
+}
+
+impl PassColor {
+    /// One straight colour (0..1) to the display's numbers (0..1).
+    pub fn apply(&self, c: [f32; 3]) -> [f32; 3] {
+        let o = match self {
+            PassColor::Lut(l) => lut_eval(l, c),
+            PassColor::Convs { first, quantize, second } => {
+                let mut o = first.apply(c);
+                if *quantize {
+                    o = o.map(|v| (v.clamp(0.0, 1.0) * 255.0 + 0.5).floor() / 255.0);
+                }
+                match second {
+                    Some(s) => s.apply(o),
+                    None => o,
+                }
+            }
+        };
+        o.map(|v| v.clamp(0.0, 1.0))
+    }
+}
+
+/// [`Lut3d::eval`], written as the shader samples the LUT (the same products and sums).
+pub fn lut_eval(l: &Lut3d, c: [f32; 3]) -> [f32; 3] {
+    let n = l.size.max(2);
+    let mut k = [0usize; 3];
+    let mut f = [0f32; 3];
+    for i in 0..3 {
+        let x = c[i].clamp(0.0, 1.0) * (n - 1) as f32;
+        k[i] = (x.floor() as usize).min(n - 2);
+        f[i] = x - k[i] as f32;
+    }
+    let at = |r: usize, g: usize, b: usize| l.data.get((r * n + g) * n + b).copied().unwrap_or_default();
+    let mut out = [0f32; 3];
+    for corner in 0..8 {
+        let (dr, dg, db) = (corner >> 2 & 1, corner >> 1 & 1, corner & 1);
+        let w = (if dr == 1 { f[0] } else { 1.0 - f[0] }) * (if dg == 1 { f[1] } else { 1.0 - f[1] }) * (if db == 1 { f[2] } else { 1.0 - f[2] });
+        let v = at(k[0] + dr, k[1] + dg, k[2] + db);
+        for i in 0..3 {
+            out[i] += w * v[i];
+        }
+    }
+    out
+}
+
+impl DisplayColor {
+    /// The conversion as data for the display pass.
+    pub fn pass(&self) -> PassColor {
+        if let Some(l) = &self.lut {
+            return PassColor::Lut(l.clone());
+        }
+        match (&self.sim, &self.display) {
+            (Some((to, show)), _) => PassColor::Convs { first: PassConv::of(to), quantize: true, second: show.as_ref().map(PassConv::of) },
+            (None, Some(d)) => PassColor::Convs { first: PassConv::of(d), quantize: false, second: None },
+            (None, None) => {
+                PassColor::Convs { first: PassConv { from: PassCurve::Linear, matrix: None, to: PassCurve::Linear }, quantize: false, second: None }
+            }
+        }
+    }
+}
+
+/// How a rendered frame's pixels are encoded: the curve of its output space, and the HDR step
+/// (Project Settings ▸ HDR) it was rendered without and the display pass still runs (`Clip`:
+/// none). Kept with the frame, so a later settings change doesn't reinterpret older frames.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct FrameEncoding {
+    pub curve: PassCurve,
+    pub hdr: HdrMode,
+}
+
+impl FrameEncoding {
+    /// A frame of a project with `settings`; `skipped_hdr_step`: rendered with
+    /// `RenderOpts::skip_hdr_step`.
+    pub fn of(settings: &ProjectSettings, skipped_hdr_step: bool) -> FrameEncoding {
+        let pipe = Pipe::of(settings);
+        let curve = pipe.output_linear().decode.map_or(PassCurve::Linear, |s| PassCurve::of(s.curve()));
+        let hdr = if skipped_hdr_step && pipe.output_hdr().is_some() { settings.hdr } else { HdrMode::Clip };
+        FrameEncoding { curve, hdr }
+    }
+
+    /// The frame as it would have been rendered with the HDR step: one straight colour.
+    pub fn finish(&self, c: [f32; 3]) -> [f32; 3] {
+        if self.hdr == HdrMode::Clip {
+            return c;
+        }
+        let l = hdr_step(self.hdr, c.map(|v| self.curve.decode(v)));
+        l.map(|v| self.curve.encode(v))
+    }
+}
+
+/// Project Settings ▸ HDR on linear light (`effectcraft_render::color::output_hdr`).
+pub fn hdr_step(mode: HdrMode, l: [f32; 3]) -> [f32; 3] {
+    match mode {
+        HdrMode::Clip => l,
+        HdrMode::Compand => l.map(effectcraft_render::color::compand),
+        HdrMode::ToneMap => effectcraft_render::color::tone_map(l),
+    }
+}
+
+/// The whole display pass of one viewer: Show Channel, exposure, the frame's encoding and the
+/// display colour conversion.
+#[derive(Clone, Debug)]
+pub struct DisplayPass {
+    pub channel: Channel,
+    pub colorized: bool,
+    /// 2^stops of the viewer's exposure.
+    pub gain: f32,
+    pub encoding: FrameEncoding,
+    pub color: Option<PassColor>,
+}
+
+impl DisplayPass {
+    /// `stops` of exposure on frames encoded as `encoding`.
+    pub fn new(channel: Channel, colorized: bool, stops: f32, encoding: FrameEncoding, color: Option<&DisplayColor>) -> DisplayPass {
+        let gain = if stops == 0.0 || !stops.is_finite() { 1.0 } else { 2f32.powf(stops) };
+        // The display conversion applies to the colour views only (as before).
+        let color = color.filter(|_| matches!(channel, Channel::Rgb | Channel::RgbStraight)).map(DisplayColor::pass);
+        DisplayPass { channel, colorized, gain, encoding, color }
+    }
+
+    /// Step 2 of the module docs runs.
+    pub fn changes_light(&self) -> bool {
+        self.gain != 1.0 || self.encoding.hdr != HdrMode::Clip
+    }
+
+    /// Nothing changes the frame's pixels (beyond clamping and rounding).
+    pub fn is_identity(&self) -> bool {
+        self.channel == Channel::Rgb && !self.changes_light() && self.color.is_none()
+    }
+
+    /// Step 2: exposure and the pending HDR step on straight colour.
+    fn light(&self, c: [f32; 3]) -> [f32; 3] {
+        if !self.changes_light() {
+            return c;
+        }
+        let curve = self.encoding.curve;
+        let l = hdr_step(self.encoding.hdr, c.map(|v| curve.decode(v) * self.gain));
+        l.map(|v| curve.encode(v))
+    }
+
+    /// One premultiplied pixel (encoded in the output space) → premultiplied RGBA8 on screen.
+    pub fn pixel(&self, p: [f32; 4]) -> [u8; 4] {
+        let q = |v: f32| (v.clamp(0.0, 1.0) * 255.0 + 0.5).floor() as u8;
+        let a = if p[3].is_nan() { 0.0 } else { p[3].clamp(0.0, 1.0) };
+        let un = |v: f32| if a > 0.0 && !v.is_nan() { v / a } else { 0.0 };
+        let c = self.light([un(p[0]), un(p[1]), un(p[2])]).map(|v| v.clamp(0.0, 1.0));
+        // A premultiplied channel: without exposure or HDR step straight from the frame (clamped
+        // to alpha, as `display_pixel`), so nothing changes it by a division's rounding.
+        let premul = |i: usize| if self.changes_light() || p[i].is_nan() { c[i] * a } else { p[i].clamp(0.0, a) };
+        match self.channel {
+            Channel::Rgb | Channel::RgbStraight => {
+                let c = match &self.color {
+                    Some(dc) => dc.apply(c),
+                    None => c,
+                };
+                if self.channel == Channel::RgbStraight {
+                    [q(c[0]), q(c[1]), q(c[2]), 255]
+                } else if self.color.is_none() {
+                    [q(premul(0)), q(premul(1)), q(premul(2)), q(a)]
+                } else {
+                    [q(c[0] * a), q(c[1] * a), q(c[2] * a), q(a)]
+                }
+            }
+            Channel::Red | Channel::Green | Channel::Blue => {
+                let i = match self.channel {
+                    Channel::Red => 0,
+                    Channel::Green => 1,
+                    _ => 2,
+                };
+                let v = q(premul(i));
+                if self.colorized {
+                    let mut o = [0, 0, 0, 255];
+                    o[i] = v;
+                    o
+                } else {
+                    [v, v, v, 255]
+                }
+            }
+            Channel::Alpha => {
+                // Exposure lightens or darkens the alpha view as an encoded grey.
+                let v = if self.gain != 1.0 { self.encoding.curve.encode(self.encoding.curve.decode(a) * self.gain) } else { a };
+                let v = q(v);
+                [v, v, v, 255]
+            }
+        }
+    }
+
+    /// The pass on premultiplied 8-bit pixels in place (the CPU path for 8-bit frames). Without
+    /// a display conversion or HDR step each channel of an opaque pixel goes through the same
+    /// curve on its own, so those pixels (and the Alpha view, which reads alpha only) look the
+    /// result up in a table of [`DisplayPass::pixel`] (the browser has no threads to share
+    /// the per-pixel work).
+    pub fn apply_rgba8(&self, px: &mut [[u8; 4]]) {
+        use rayon::prelude::*;
+        if self.is_identity() {
+            return;
+        }
+        let f = |v: u8| v as f32 / 255.0;
+        if self.channel == Channel::Alpha {
+            let t: [[u8; 4]; 256] = std::array::from_fn(|a| self.pixel([0.0, 0.0, 0.0, f(a as u8)]));
+            px.par_iter_mut().for_each(|p| *p = t[p[3] as usize]);
+            return;
+        }
+        let table = (self.color.is_none() && self.encoding.hdr == HdrMode::Clip)
+            .then(|| -> [[u8; 4]; 256] { std::array::from_fn(|v| self.pixel([f(v as u8), f(v as u8), f(v as u8), 1.0])) });
+        px.par_iter_mut().for_each(|p| {
+            *p = match &table {
+                Some(t) if p[3] == 255 => match self.channel {
+                    Channel::Rgb | Channel::RgbStraight => [t[p[0] as usize][0], t[p[1] as usize][1], t[p[2] as usize][2], 255],
+                    Channel::Red => t[p[0] as usize],
+                    Channel::Green => t[p[1] as usize],
+                    _ => t[p[2] as usize],
+                },
+                _ => self.pixel(p.map(f)),
+            }
+        });
+    }
+}
diff --git a/crates/engine/tests/blender_scene_oracle.py b/crates/engine/tests/blender_scene_oracle.py
new file mode 100644
index 000000000..3d1cbeda7
--- /dev/null
+++ b/crates/engine/tests/blender_scene_oracle.py
@@ -0,0 +1,61 @@
+"""Public-API oracle for scripts generated by src/tests/blender.rs; no Blender source dependency."""
+import json
+import math
+import runpy
+import sys
+
+import bpy
+from bpy_extras.object_utils import world_to_camera_view
+from mathutils import Quaternion, Vector
+
+path = sys.argv[sys.argv.index("--") + 1]
+before = set(bpy.data.scenes)
+exported = runpy.run_path(path, run_name="__main__")
+scene = exported["EFFECTCRAFT_SCENE"]
+data = exported["DATA"]
+assert before.issubset(set(bpy.data.scenes)), "existing scenes were removed"
+assert scene not in before
+assert scene.frame_start == 101 and scene.frame_end == 103
+assert abs(scene.render.fps / scene.render.fps_base - 30000 / 1001) < 1e-4
+assert (scene.render.resolution_x, scene.render.resolution_y) == (640, 360)
+camera = scene.camera
+assert camera.animation_data.action is not None
+assert camera.data.animation_data.action is not None
+assert camera.data.sensor_fit == 'HORIZONTAL'
+metadata = json.loads(bpy.data.texts[scene["effectcraft_metadata_text"]].as_string())
+assert metadata["solve"]["averageError"] == 0.12
+cloud = scene.objects["Solved Track Points"]
+assert len(cloud.data.vertices) == 2
+assert cloud.hide_render
+assert cloud.data.attributes["track_id"].data[0].value == 7
+assert any(obj.name.startswith("Solved Ground Plane") for obj in scene.objects)
+
+for i, sample in enumerate(data["frames"]):
+    scene.frame_set(sample["frame"])
+    bpy.context.view_layer.update()
+    assert abs(camera.data.lens - sample["lens"]) < 1e-5
+    assert abs(camera.data.dof.focus_distance - sample["focus"]) < 1e-5
+    assert abs(camera.data.dof.aperture_fstop - sample["fstop"]) < 1e-5
+    assert camera.data.dof.use_dof
+    assert (camera.location - Vector(sample["location"])).length < 1e-5
+    raw = data["solve"]["frames"][i]
+    rot = Vector(raw["rot"])
+    rotation = Quaternion(rot.normalized(), rot.length).to_matrix() if rot.length else Quaternion().to_matrix()
+    for vertex, point in zip(cloud.data.vertices, data["solve"]["points"]):
+        relative = rotation @ (Vector(point["pos"]) - Vector(raw["center"]))
+        expected = (raw["focal"] * relative.x / relative.z + 320,
+                    raw["focal"] * relative.y / relative.z + 180)
+        projected = world_to_camera_view(scene, camera, vertex.co)
+        actual = (projected.x * 640, (1.0 - projected.y) * 360)
+        assert math.dist(actual, expected) < 0.002, (sample["frame"], actual, expected)
+
+    if "Video not found" not in " ".join(data["warnings"]):
+        background = camera.data.background_images[0]
+        assert background.image.source == 'MOVIE'
+        assert tuple(background.image.size) == (640, 360)
+        user = background.image_user
+        actual_source = sample["frame"] - user.frame_start + user.frame_offset
+        assert actual_source == sample["sourceFrame"], (actual_source, sample["sourceFrame"])
+        assert user.use_auto_refresh
+
+print("EFFECTCRAFT_BLENDER_ORACLE_OK")
diff --git a/crates/engine/tests/key_time_post_snap_bounds.rs b/crates/engine/tests/it/key_time_post_snap_bounds.rs
similarity index 100%
rename from crates/engine/tests/key_time_post_snap_bounds.rs
rename to crates/engine/tests/it/key_time_post_snap_bounds.rs
diff --git a/crates/engine/tests/key_time_reply_contract.rs b/crates/engine/tests/it/key_time_reply_contract.rs
similarity index 100%
rename from crates/engine/tests/key_time_reply_contract.rs
rename to crates/engine/tests/it/key_time_reply_contract.rs
diff --git a/crates/engine/tests/it/main.rs b/crates/engine/tests/it/main.rs
new file mode 100644
index 000000000..ac1484cfb
--- /dev/null
+++ b/crates/engine/tests/it/main.rs
@@ -0,0 +1,5 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod key_time_post_snap_bounds;
+mod key_time_reply_contract;
+mod parenting_3d_position;
diff --git a/crates/engine/tests/parenting_3d_position.rs b/crates/engine/tests/it/parenting_3d_position.rs
similarity index 87%
rename from crates/engine/tests/parenting_3d_position.rs
rename to crates/engine/tests/it/parenting_3d_position.rs
index f9dd9ae3f..de2bc5dad 100644
--- a/crates/engine/tests/parenting_3d_position.rs
+++ b/crates/engine/tests/it/parenting_3d_position.rs
@@ -410,12 +410,12 @@ fn parenting_static_orientation_is_exact_just_off_gimbal_lock() {
 fn parenting_animated_orientation_and_nonuniform_parent_keep_authored_pose_boundary() {
     for animated in [true, false] {
         let (mut s, p, c) = fixture(true, true);
+        // A non-uniform parent has no uniform pose to re-express, animated or not.
+        set(&mut s, p, "transform/scale", json!([120.0, 100.0, 80.0]));
         if animated {
             for (time, value) in [(0.0, json!([-8.0, 12.0, -13.0])), (1.0, json!([5.0, 18.0, 14.0]))] {
                 command(&mut s, "prop.addKey", json!({"layer":c,"path":"transform/orientation","time":time,"value":value}));
             }
-        } else {
-            set(&mut s, p, "transform/scale", json!([120.0, 100.0, 80.0]));
         }
         let layer = s.active_comp().unwrap().layer(LayerId(c)).unwrap();
         let orientation = layer.props.prop("transform/orientation").unwrap().clone();
@@ -430,6 +430,27 @@ fn parenting_animated_orientation_and_nonuniform_parent_keep_authored_pose_bound
     }
 }
 
+/// Keyed Orientation under a uniform parent is re-expressed at every key, so the child's world pose
+/// and pixels stay put at every time along the quaternion arcs between keys.
+#[test]
+fn parenting_uniform_parent_re_expresses_keyed_orientation() {
+    for factor in [120.0, -120.0] {
+        let (mut s, p, c) = fixture(true, false);
+        set(&mut s, p, "transform/rotation", json!(42.0));
+        set(&mut s, p, "transform/scale", json!([factor, factor, factor]));
+        for (time, value) in [(0.0, json!([-8.0, 12.0, -13.0])), (1.0, json!([5.0, 18.0, 14.0]))] {
+            command(&mut s, "prop.addKey", json!({"layer":c,"path":"transform/orientation","time":time,"value":value}));
+        }
+        let times = [0.0, 0.25, 0.5, 0.75, 1.0].map(Tick::from_seconds_f64);
+        let before = times.map(|t| world(&s, c, t));
+        let images = times.map(|t| cpu(&s, t));
+        parent(&mut s, c, Some(p), true);
+        let error = times.into_iter().zip(before).map(|(t, b)| displacement(b, world(&s, c, t))).fold(0.0, f64::max);
+        let pixels = times.into_iter().zip(&images).map(|(t, i)| diff(i, &cpu(&s, t))).fold(0.0, f32::max);
+        assert!(error < 1e-8 && pixels < 2e-5, "keyed Orientation under a uniform parent (factor {factor}): corners {error}, pixels {pixels}");
+    }
+}
+
 /// Position's temporal speed is measured along its spatial path, in parent-space units.
 #[test]
 fn parenting_uniform_parent_preserves_eased_position_at_quarter_times_and_undo() {
@@ -523,3 +544,49 @@ fn parenting_camera_to_default_null_preserves_framing() {
     assert_eq!(authored(&s, "transform/position"), pos0, "unparenting restores position");
     assert_eq!(authored(&s, "transform/poi"), poi0, "unparenting restores point of interest");
 }
+
+/// A constant parent rotation preserves the full eased quaternion path, including mixed axes.
+#[test]
+fn parenting_mixed_axis_eased_orientation_preserves_arcs_and_key_metadata() {
+    use effectcraft_engine::keyframe::{Ease, Interp};
+    for factor in [120.0, -120.0] {
+        let (mut s, p, c) = fixture(true, true);
+        set(&mut s, p, "transform/scale", json!([factor, factor, factor]));
+        for (time, value) in [(0.0, json!([-35.0, 48.0, 150.0])), (0.7, json!([62.0, -27.0, -145.0])), (1.6, json!([-12.0, 58.0, 70.0]))] {
+            command(&mut s, "prop.addKey", json!({"layer":c,"path":"transform/orientation","time":time,"value":value}));
+        }
+        let cid = s.active_comp_id().unwrap();
+        let orientation = Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(LayerId(c)).unwrap().props.prop_mut("transform/orientation").unwrap();
+        for key in &mut orientation.keys {
+            key.in_interp = Interp::Bezier;
+            key.out_interp = Interp::Bezier;
+            key.in_ease = vec![Ease { speed: 17.0, influence: 0.3 }];
+            key.out_ease = vec![Ease { speed: 11.0, influence: 0.4 }];
+        }
+        orientation.keys[1].auto_bezier = true;
+        let original = orientation.keys.clone();
+        let times: Vec<_> = (0..=32).map(|i| Tick::from_seconds_f64(i as f64 * 0.05)).collect();
+        let before: Vec<_> = times.iter().map(|&t| world(&s, c, t)).collect();
+        let old_project = s.project.clone();
+        parent(&mut s, c, Some(p), true);
+        let converted = &s.active_comp().unwrap().layer(LayerId(c)).unwrap().props.prop("transform/orientation").unwrap().keys;
+        assert_eq!(converted.len(), original.len());
+        for (new, old) in converted.iter().zip(&original) {
+            let mut metadata = new.clone();
+            metadata.value = old.value.clone();
+            assert_eq!(&metadata, old, "all authored key metadata must survive");
+        }
+        // Rotation matrices represent both q and -q identically, so compare transformed geometry
+        // rather than Euler representatives or quaternion signs.
+        for (&t, &matrix) in times.iter().zip(&before) {
+            assert!(displacement(matrix, world(&s, c, t)) < 1e-8, "pose changed at {t:?}, factor {factor}");
+        }
+        parent(&mut s, c, None, true);
+        for (&t, &matrix) in times.iter().zip(&before) {
+            assert!(displacement(matrix, world(&s, c, t)) < 1e-8, "unparent changed pose at {t:?}");
+        }
+        assert!(s.undo());
+        assert!(s.undo());
+        assert!(Arc::ptr_eq(&old_project, &s.project));
+    }
+}
diff --git a/crates/export/Cargo.toml b/crates/export/Cargo.toml
index 2ef6f5ad8..c477d2787 100644
--- a/crates/export/Cargo.toml
+++ b/crates/export/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "effectcraft-export"
-description = "Render Queue jobs and output modules: H.264 MP4 (+AAC), ProRes and uncompressed MOV (+PCM) via FilmCraft, HEVC / AV1 MP4 (+AAC) and WebM (VP9 or AV1 + Opus) via EffectCraft encoders, PNG/JPEG/TIFF/EXR sequences, animated GIF, WAV/AIFF"
+description = "Render Queue jobs and output modules: H.264 MP4 (+AAC), ProRes and uncompressed MOV (+PCM) via FilmCraft, HEVC / AV1 MP4 (+AAC) and WebM (VP9 or AV1 + Opus) via EffectCraft encoders, PNG/JPEG/TIFF/EXR/Targa sequences, animated GIF, WAV/AIFF"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -22,7 +22,8 @@ effectcraft-opusenc = { workspace = true }
 effectcraft-vp9enc = { workspace = true }
 effectcraft-hevcenc = { workspace = true }
 effectcraft-av1enc = { workspace = true }
-image = { workspace = true, features = ["png", "jpeg", "tiff", "exr"] }
+image = { workspace = true, features = ["png", "jpeg", "tiff", "exr", "tga"] }
+exr = { workspace = true }
 gif = { workspace = true }
 rayon = { workspace = true }
 web-time = { workspace = true }
diff --git a/crates/export/src/encode.rs b/crates/export/src/encode.rs
index e4a45561d..dd972d326 100644
--- a/crates/export/src/encode.rs
+++ b/crates/export/src/encode.rs
@@ -4,10 +4,10 @@
 
 use std::io::Write;
 
-use effectcraft_project::Comp;
 use effectcraft_project::render_queue::{AudioFormat, Channels, OutputFormat, ProResProfile};
+use effectcraft_project::{Comp, ProjectSettings};
 use effectcraft_time::{FrameRate, Tick};
-use filmcraft_isobmff::{Brand, FourCc, Mp4Writer, PcmConfig, SampleEntry, TrackConfig, WriteSample, WriterOptions};
+use filmcraft_isobmff::{Brand, ColorInfo, FourCc, Mp4Writer, PcmConfig, SampleEntry, TrackConfig, WriteSample, WriterOptions};
 use rayon::prelude::*;
 
 use crate::{Cx, ExportError, Report, Result, State, batch_size, wants_audio};
@@ -19,6 +19,44 @@ fn mux_err(e: impl std::fmt::Display) -> ExportError {
     ExportError::Io(e.to_string())
 }
 
+/// What a render's frames are, as ITU-T H.273 code points, for the `colr` box and the encoders'
+/// own colour description. The matrix is BT.709, the one every encoder here converts with
+/// (`rgba_to_yuv420`, `rgba_to_yuv_10` and `rgba_to_yuv420_bits` all use the 0.2126/0.7152/0.0722
+/// luma). Primaries and transfer follow the render path (`Pipe::output`): only a working space
+/// converts to the output space, so unmanaged frames pass through. sRGB output keeps transfer 1
+/// rather than 13 (#340), and an alpha matte is not in the output space.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Codes {
+    pub(crate) primaries: u8,
+    pub(crate) transfer: u8,
+    pub(crate) matrix: u8,
+}
+
+pub(crate) fn output_codes(settings: &ProjectSettings, channels: Channels) -> Codes {
+    use effectcraft_project::ColorSpace as Space;
+    let output = settings.working_space.and(settings.output_space).filter(|_| channels != Channels::Alpha);
+    let (primaries, transfer) = match output {
+        None | Some(Space::Srgb | Space::Rec709) => (1, 1),
+        Some(Space::Rec2020) => (9, 1),
+        Some(Space::DisplayP3) => (12, 13),
+        Some(Space::Rec2100Pq) => (9, 16),
+        Some(Space::Rec2100Hlg) => (9, 18),
+        // H.273 has no code for the ACES primaries: unspecified, in linear light.
+        Some(Space::AcesCg | Space::Aces2065) => (2, 8),
+    };
+    Codes { primaries, transfer, matrix: 1 }
+}
+
+/// Tag a video [`SampleEntry`] with the limited-range (16–235 luma, as every encoder here
+/// writes) `colr` (nclx) box for `c` (#2879). Without it a re-import falls back to the
+/// container's resolution-based `default_matrix` — BT.601 below 1024×577 — and shifts the
+/// colours (pure red came back as [232,0,1]).
+pub(crate) fn tag_nclx_limited(entry: &mut SampleEntry, c: Codes) {
+    if let Some(v) = entry.video.as_mut() {
+        v.color = Some(ColorInfo::Nclx { primaries: c.primaries.into(), transfer: c.transfer.into(), matrix: c.matrix.into(), full_range: false });
+    }
+}
+
 pub(crate) struct Packet {
     pub(crate) data: Vec<u8>,
     pub(crate) key: bool,
@@ -26,9 +64,49 @@ pub(crate) struct Packet {
     pub(crate) cto: i32,
 }
 
-pub(crate) trait VideoEncoder {
+/// A frame for the movie encoder: 8-bit RGBA, or 8-bit 4:2:0 planes already converted on the
+/// render threads (for encoders whose [`VideoEncoder::takes_yuv420`] is true).
+pub(crate) enum Pixels {
+    Rgba(Vec<u8>),
+    Yuv420(Yuv420),
+}
+
+/// BT.709 limited-range 8-bit 4:2:0 planes ([`rgba_to_yuv420`], or Y then U and V from the
+/// accelerator).
+pub(crate) enum Yuv420 {
+    Planes { y: Vec<u8>, u: Vec<u8>, v: Vec<u8> },
+    Packed(Vec<u8>),
+}
+
+impl Yuv420 {
+    fn from_rgba(rgba: &[u8], w: usize, h: usize) -> Yuv420 {
+        let (mut y, mut u, mut v) = (vec![], vec![], vec![]);
+        rgba_to_yuv420(rgba, w, h, &mut y, &mut u, &mut v);
+        Yuv420::Planes { y, u, v }
+    }
+    fn slices(&self, w: usize, h: usize) -> (&[u8], &[u8], &[u8]) {
+        match self {
+            Yuv420::Planes { y, u, v } => (y, u, v),
+            Yuv420::Packed(p) => {
+                let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
+                let (y, uv) = p.split_at(w * h);
+                let (u, v) = uv.split_at(cw * ch);
+                (y, u, v)
+            }
+        }
+    }
+}
+
+pub(crate) trait VideoEncoder: Send {
     fn sample_entry(&self) -> SampleEntry;
     fn encode(&mut self, rgba: &[u8], index: u64) -> Result<Vec<Packet>>;
+    /// Whether frames should come as [`Pixels::Yuv420`] (converted while other frames render).
+    fn takes_yuv420(&self) -> bool {
+        false
+    }
+    fn encode_yuv420(&mut self, _frame: &Yuv420, _index: u64) -> Result<Vec<Packet>> {
+        Err(ExportError::Unsupported("this encoder takes RGBA frames".into()))
+    }
     fn flush(&mut self) -> Result<Vec<Packet>>;
     /// Edit-list media start (B-frame delay) in the track timescale.
     fn media_start(&self) -> Option<i64> {
@@ -43,21 +121,23 @@ struct H264 {
     w: u32,
     h: u32,
     rate: FrameRate,
+    codes: Codes,
     y: Vec<u8>,
     u: Vec<u8>,
     v: Vec<u8>,
 }
 
 impl H264 {
-    fn new(w: u32, h: u32, rate: FrameRate, kbps: u32) -> Result<H264> {
+    fn new(w: u32, h: u32, rate: FrameRate, kbps: u32, codes: Codes) -> Result<H264> {
         let mut cfg = filmcraft_h264enc::EncoderConfig::new(w, h, rate.num as u32, rate.den as u32);
         cfg.format = filmcraft_h264enc::PacketFormat::LengthPrefixed;
         cfg.aud = false;
         cfg.keyint = (rate.as_f64() * 2.0).round().max(1.0) as u32;
         let kbps = kbps.max(100);
         cfg.rate = filmcraft_h264enc::RateControl::Vbr { target_kbps: kbps, max_kbps: kbps * 3 / 2 };
+        cfg.color = filmcraft_h264enc::ColorConfig { primaries: codes.primaries, transfer: codes.transfer, matrix: codes.matrix, full_range: false };
         let enc = filmcraft_h264enc::Encoder::new(cfg).map_err(enc)?;
-        Ok(H264 { enc, w, h, rate, y: vec![], u: vec![], v: vec![] })
+        Ok(H264 { enc, w, h, rate, codes, y: vec![], u: vec![], v: vec![] })
     }
     fn packets(&self, ps: Vec<filmcraft_h264enc::Packet>) -> Vec<Packet> {
         ps.into_iter().map(|p| Packet { data: p.data, key: p.keyframe, cto: (p.pts - p.dts) as i32 }).collect()
@@ -70,12 +150,27 @@ impl VideoEncoder for H264 {
             let (sps, pps) = self.enc.sps_pps();
             filmcraft_isobmff::AvcConfig::new(vec![sps], vec![pps], 4)
         });
-        SampleEntry::avc(cfg, self.w as u16, self.h as u16)
+        let mut entry = SampleEntry::avc(cfg, self.w as u16, self.h as u16);
+        tag_nclx_limited(&mut entry, self.codes);
+        entry
     }
     fn encode(&mut self, rgba: &[u8], index: u64) -> Result<Vec<Packet>> {
-        rgba_to_yuv420(rgba, self.w as usize, self.h as usize, &mut self.y, &mut self.u, &mut self.v);
-        let cw = (self.w as usize).div_ceil(2);
-        let frame = filmcraft_h264enc::YuvFrame { y: &self.y, u: &self.u, v: &self.v, y_stride: self.w as usize, uv_stride: cw };
+        let (mut y, mut u, mut v) = (std::mem::take(&mut self.y), std::mem::take(&mut self.u), std::mem::take(&mut self.v));
+        rgba_to_yuv420(rgba, self.w as usize, self.h as usize, &mut y, &mut u, &mut v);
+        let planes = Yuv420::Planes { y, u, v };
+        let r = self.encode_yuv420(&planes, index);
+        if let Yuv420::Planes { y, u, v } = planes {
+            (self.y, self.u, self.v) = (y, u, v);
+        }
+        r
+    }
+    fn takes_yuv420(&self) -> bool {
+        true
+    }
+    fn encode_yuv420(&mut self, p: &Yuv420, index: u64) -> Result<Vec<Packet>> {
+        let (w, cw) = (self.w as usize, (self.w as usize).div_ceil(2));
+        let (y, u, v) = p.slices(w, self.h as usize);
+        let frame = filmcraft_h264enc::YuvFrame { y, u, v, y_stride: w, uv_stride: cw };
         let ps = self.enc.try_encode(&frame, index as i64 * self.rate.den).map_err(enc)?;
         Ok(self.packets(ps))
     }
@@ -88,33 +183,7 @@ impl VideoEncoder for H264 {
     }
 }
 
-/// BT.709 limited-range 8-bit 4:2:0 from RGBA8 (2×2 chroma average; alpha ignored).
-pub(crate) fn rgba_to_yuv420(rgba: &[u8], w: usize, h: usize, y: &mut Vec<u8>, u: &mut Vec<u8>, v: &mut Vec<u8>) {
-    let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
-    y.resize(w * h, 0);
-    u.resize(cw * ch, 0);
-    v.resize(cw * ch, 0);
-    y.par_chunks_mut(w * 2).zip(u.par_chunks_mut(cw).zip(v.par_chunks_mut(cw))).enumerate().for_each(|(cy, (yr, (ur, vr)))| {
-        let rows = yr.len() / w;
-        let mut acc = vec![(0f32, 0f32, 0f32); cw];
-        for dy in 0..rows {
-            let src = &rgba[(cy * 2 + dy) * w * 4..][..w * 4];
-            for x in 0..w {
-                let (r, g, b) = (src[x * 4] as f32 / 255.0, src[x * 4 + 1] as f32 / 255.0, src[x * 4 + 2] as f32 / 255.0);
-                let l = 0.2126 * r + 0.7152 * g + 0.0722 * b;
-                yr[dy * w + x] = (16.0 + 219.0 * l).round().clamp(1.0, 254.0) as u8;
-                let a = &mut acc[x / 2];
-                a.0 += (b - l) / 1.8556;
-                a.1 += (r - l) / 1.5748;
-                a.2 += 1.0;
-            }
-        }
-        for (cx, a) in acc.iter().enumerate() {
-            ur[cx] = (128.0 + 224.0 * a.0 / a.2).round().clamp(1.0, 254.0) as u8;
-            vr[cx] = (128.0 + 224.0 * a.1 / a.2).round().clamp(1.0, 254.0) as u8;
-        }
-    });
-}
+pub(crate) use effectcraft_raster::yuv::rgba_to_yuv420;
 
 // ---------------------------------------------------------------- ProRes
 
@@ -124,6 +193,13 @@ struct ProRes {
     w: u32,
     h: u32,
     alpha: bool,
+    colr: ColorInfo,
+}
+
+/// The `colr` atom of a ProRes render ([`output_codes`]). MOV uses QuickTime's `nclc`, which has
+/// no range flag; ProRes frames are limited range.
+fn prores_colr(c: Codes) -> ColorInfo {
+    ColorInfo::Nclc { primaries: c.primaries.into(), transfer: c.transfer.into(), matrix: c.matrix.into() }
 }
 
 fn prores_profile(p: ProResProfile) -> filmcraft_prores::Profile {
@@ -139,14 +215,20 @@ fn prores_profile(p: ProResProfile) -> filmcraft_prores::Profile {
 }
 
 impl ProRes {
-    fn new(w: u32, h: u32, profile: ProResProfile, channels: Channels) -> ProRes {
+    fn new(w: u32, h: u32, profile: ProResProfile, channels: Channels, colr: ColorInfo) -> ProRes {
         // Alpha needs a 4444 flavour.
         let profile = if channels == Channels::Rgba && !profile.is_4444() { ProResProfile::P4444 } else { profile };
         let profile = prores_profile(profile);
         let alpha = channels == Channels::Rgba;
         let mut cfg = filmcraft_prores::EncoderConfig::new(profile, w, h);
         cfg.encode_alpha = alpha;
-        ProRes { enc: filmcraft_prores::Encoder::with_config(cfg), profile, w, h, alpha }
+        // The frame header carries the same H.273 codes as the `colr` atom, so readers that trust
+        // either one agree.
+        if let ColorInfo::Nclc { primaries, transfer, matrix } = colr {
+            let code = |c| u8::try_from(c).unwrap_or(2);
+            cfg.color = filmcraft_prores::ColorInfo { primaries: code(primaries), transfer: code(transfer), matrix: code(matrix) };
+        }
+        ProRes { enc: filmcraft_prores::Encoder::with_config(cfg), profile, w, h, alpha, colr }
     }
     fn is_444(&self) -> bool {
         matches!(self.profile, filmcraft_prores::Profile::P4444 | filmcraft_prores::Profile::P4444Xq)
@@ -155,7 +237,11 @@ impl ProRes {
 
 impl VideoEncoder for ProRes {
     fn sample_entry(&self) -> SampleEntry {
-        SampleEntry::prores(FourCc(self.profile.fourcc()), self.w as u16, self.h as u16)
+        let mut entry = SampleEntry::prores(FourCc(self.profile.fourcc()), self.w as u16, self.h as u16);
+        if let Some(v) = entry.video.as_mut() {
+            v.color = Some(self.colr.clone());
+        }
+        entry
     }
     fn encode(&mut self, rgba: &[u8], _index: u64) -> Result<Vec<Packet>> {
         let chroma = if self.is_444() { filmcraft_prores::ChromaFormat::Yuv444 } else { filmcraft_prores::ChromaFormat::Yuv422 };
@@ -256,24 +342,51 @@ pub(crate) async fn movie(job: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut St
         Channels::Rgba if !matches!(fmt, OutputFormat::ProRes | OutputFormat::Uncompressed) => Channels::Rgb,
         c => c,
     };
+    let codes = output_codes(&job.project.settings, channels);
     let mut venc: Box<dyn VideoEncoder> = match fmt {
-        OutputFormat::H264 => Box::new(H264::new(w, h, rate, job.output.bitrate_kbps)?),
-        OutputFormat::Hevc => Box::new(crate::hevc_av1::Hevc::new(w, h, rate, job.output)?),
-        OutputFormat::Av1 => Box::new(crate::hevc_av1::Av1::new(w, h, rate, job.output)?),
+        OutputFormat::H264 => Box::new(H264::new(w, h, rate, job.output.bitrate_kbps, codes)?),
+        OutputFormat::Hevc => Box::new(crate::hevc_av1::Hevc::new(w, h, rate, job.output, codes)?),
+        OutputFormat::Av1 => Box::new(crate::hevc_av1::Av1::new(w, h, rate, job.output, codes)?),
         OutputFormat::Uncompressed => Box::new(crate::uncompressed::Raw::new(w, h, channels == Channels::Rgba)?),
-        _ => Box::new(ProRes::new(w, h, job.output.prores_profile, if channels == Channels::Alpha { Channels::Rgb } else { channels })),
+        _ => Box::new(ProRes::new(w, h, job.output.prores_profile, if channels == Channels::Alpha { Channels::Rgb } else { channels }, prores_colr(codes))),
     };
     let brand = if matches!(fmt, OutputFormat::ProRes | OutputFormat::Uncompressed) { Brand::Mov } else { Brand::Mp4 };
     let batch = batch_size();
-    let render = |_: u64, img: effectcraft_raster::Image| -> Vec<u8> { job.pixels(&img, comp, channels, w, h) };
+    let yuv = venc.takes_yuv420();
+    let render = |_: u64, img: effectcraft_raster::Image| -> Pixels {
+        let px = job.pixels(&img, comp, channels, w, h);
+        if yuv { Pixels::Yuv420(Yuv420::from_rgba(&px, w as usize, h as usize)) } else { Pixels::Rgba(px) }
+    };
+    // H.264 frames the accelerator can convert itself come back as planes (12 MB instead of
+    // 133 MB of RGBA f32 read back at 4K); everything else renders and converts as before.
+    // Deferred readbacks (a browser worker) keep their pass-based path: no blocking there.
+    let gpu_yuv = yuv && channels == Channels::Rgb && !job.deferred();
+    let batch_frames = async |ks: Vec<u64>| -> Vec<Pixels> {
+        if gpu_yuv { job.h264_frames(comp, ks, w, h, |p| Pixels::Yuv420(Yuv420::Packed(p)), render) } else { job.frames(comp, ks, render).await }
+    };
+    let encode = |venc: &mut Box<dyn VideoEncoder>, px: &Pixels, index: u64| match px {
+        Pixels::Rgba(rgba) => venc.encode(rgba, index),
+        Pixels::Yuv420(planes) => venc.encode_yuv420(planes, index),
+    };
+
+    let beside = crate::pipeline::Beside::shared();
+    let total = st.total;
 
     // Encode the first batch before creating tracks: encoders finalise their config on frame 1.
-    let first_end = batch.min(st.total);
-    let first: Vec<Vec<u8>> = job.frames(comp, (0..first_end).collect(), render).await;
-    let mut pending = Vec::new();
-    for (k, px) in first.iter().enumerate() {
-        pending.extend(venc.encode(px, k as u64)?);
-    }
+    // Each batch encodes while the next one renders.
+    let first_end = batch.min(total);
+    let first: Vec<Pixels> = batch_frames((0..first_end).collect()).await;
+    let next_end = (first_end + batch).min(total);
+    let (pending, mut ready) = job
+        .beside(beside, batch_frames((first_end..next_end).collect()), || -> Result<Vec<Packet>> {
+            let mut pending = Vec::new();
+            for (k, px) in first.iter().enumerate() {
+                pending.extend(encode(&mut venc, px, k as u64)?);
+            }
+            Ok(pending)
+        })
+        .await?;
+    let pending = pending?;
     drop(first);
     st.advance(first_end)?;
 
@@ -351,19 +464,25 @@ pub(crate) async fn movie(job: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut St
         }
         Ok(())
     };
-    let total = st.total;
     let frame_end_time = |k: u64| -> Tick { if k >= total { span_end } else { job.settings.frame_time(comp, k) } };
     write_video(&mut mux, pending)?;
     write_audio_until(&mut mux, frame_end_time(first_end), &mut cursor)?;
     let mut i = first_end;
     while i < total {
         let end = (i + batch).min(total);
-        let frames: Vec<Vec<u8>> = job.frames(comp, (i..end).collect(), render).await;
-        for (k, px) in frames.iter().enumerate() {
-            let ps = venc.encode(px, i + k as u64)?;
-            write_video(&mut mux, ps)?;
-        }
-        write_audio_until(&mut mux, frame_end_time(end), &mut cursor)?;
+        let next_end = (end + batch).min(total);
+        let frames = std::mem::take(&mut ready);
+        let (done, next) = job
+            .beside(beside, batch_frames((end..next_end).collect()), || -> Result<()> {
+                for (k, px) in frames.iter().enumerate() {
+                    let ps = encode(&mut venc, px, i + k as u64)?;
+                    write_video(&mut mux, ps)?;
+                }
+                write_audio_until(&mut mux, frame_end_time(end), &mut cursor)
+            })
+            .await?;
+        done?;
+        ready = next;
         st.advance(end - i)?;
         i = end;
     }
@@ -382,8 +501,74 @@ pub(crate) async fn movie(job: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut St
 
 #[cfg(test)]
 mod tests {
+    use effectcraft_raster::yuv::{UNIT8, round_pos};
+
     use super::*;
 
+    /// The conversion as first written (per-pixel division and `f32::round`).
+    fn yuv420_reference(rgba: &[u8], w: usize, h: usize) -> (Vec<u8>, Vec<u8>, Vec<u8>) {
+        let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
+        let (mut y, mut u, mut v) = (vec![0u8; w * h], vec![0u8; cw * ch], vec![0u8; cw * ch]);
+        for cy in 0..ch {
+            let mut acc = vec![(0f32, 0f32, 0f32); cw];
+            for row in cy * 2..(cy * 2 + 2).min(h) {
+                for x in 0..w {
+                    let s = &rgba[(row * w + x) * 4..];
+                    let (r, g, b) = (s[0] as f32 / 255.0, s[1] as f32 / 255.0, s[2] as f32 / 255.0);
+                    let l = 0.2126 * r + 0.7152 * g + 0.0722 * b;
+                    y[row * w + x] = (16.0 + 219.0 * l).round().clamp(1.0, 254.0) as u8;
+                    let a = &mut acc[x / 2];
+                    a.0 += (b - l) / 1.8556;
+                    a.1 += (r - l) / 1.5748;
+                    a.2 += 1.0;
+                }
+            }
+            for (cx, a) in acc.iter().enumerate() {
+                u[cy * cw + cx] = (128.0 + 224.0 * a.0 / a.2).round().clamp(1.0, 254.0) as u8;
+                v[cy * cw + cx] = (128.0 + 224.0 * a.1 / a.2).round().clamp(1.0, 254.0) as u8;
+            }
+        }
+        (y, u, v)
+    }
+
+    #[test]
+    fn round_pos_is_round() {
+        for i in 0..2_000_000u32 {
+            let v = i as f32 * 0.000_25;
+            assert_eq!(round_pos(v).to_bits(), v.round().to_bits(), "{v}");
+            let n = f32::from_bits(v.to_bits().wrapping_sub(1)).max(0.0);
+            assert_eq!(round_pos(n).to_bits(), n.round().to_bits(), "{n}");
+        }
+        for k in 0..1024u32 {
+            for v in [k as f32 + 0.5, f32::from_bits((k as f32 + 0.5).to_bits() - 1), f32::from_bits((k as f32 + 0.5).to_bits() + 1)] {
+                assert_eq!(round_pos(v), v.round(), "{v}");
+            }
+        }
+        for (i, u) in UNIT8.iter().enumerate() {
+            assert_eq!(u.to_bits(), (i as f32 / 255.0).to_bits());
+        }
+    }
+
+    #[test]
+    fn yuv420_matches_the_reference() {
+        // Every 8-bit level in every channel, odd sizes, and pseudo-random pixels.
+        for (w, h) in [(1, 1), (2, 2), (3, 5), (17, 9), (64, 33)] {
+            let mut rgba = vec![0u8; w * h * 4];
+            let mut seed = (w * 31 + h) as u32;
+            for (i, b) in rgba.iter_mut().enumerate() {
+                seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+                *b = if i % 7 == 0 { (i / 4 % 256) as u8 } else { (seed >> 24) as u8 };
+            }
+            let (mut y, mut u, mut v) = (vec![], vec![], vec![]);
+            rgba_to_yuv420(&rgba, w, h, &mut y, &mut u, &mut v);
+            assert_eq!((y, u, v), yuv420_reference(&rgba, w, h), "{w}x{h}");
+        }
+        let grey: Vec<u8> = (0..=255u8).flat_map(|g| [g, g, g, 255, g, 255 - g, g / 2, 255]).collect();
+        let (mut y, mut u, mut v) = (vec![], vec![], vec![]);
+        rgba_to_yuv420(&grey, 512, 1, &mut y, &mut u, &mut v);
+        assert_eq!((y, u, v), yuv420_reference(&grey, 512, 1));
+    }
+
     #[test]
     fn yuv_of_primaries() {
         let rgba = [255u8, 255, 255, 255, 0, 0, 0, 255, 255, 0, 0, 255, 0, 255, 0, 255];
diff --git a/crates/export/src/exr_out.rs b/crates/export/src/exr_out.rs
new file mode 100644
index 000000000..43467629a
--- /dev/null
+++ b/crates/export/src/exr_out.rs
@@ -0,0 +1,268 @@
+//! OpenEXR sequence frames: one single-part scan-line file per frame, RGBA, with the Output
+//! Module's compression and sample type (#2911).
+//!
+//! Scan lines, not tiles: `image`'s encoder wrote 64×64 RLE tiles, which FilmCraft and other
+//! scan-line readers refuse (#2805). Each compression keeps its own block height (1 line for
+//! None, RLE and ZIPS; 16 for ZIP and PXR24; 32 for PIZ, B44, B44A and DWAA; 256 for DWAB) and the
+//! `exr` crate's default levels for ZIP and DWA. Half-float samples are rounded from the 32-bit
+//! render to the nearest half, ties to even. The lossy methods (PXR24 on float, B44 / B44A on half,
+//! DWAA / DWAB at either depth) keep every linear sample within 0.03 + 6 % of its value in the
+//! tests below. Half float holds at most ±65 504: larger samples are written as that limit, not
+//! as infinity.
+
+use std::io::{Seek, Write};
+
+use effectcraft_project::render_queue::{ExrBitDepth, ExrCompression};
+use exr::meta::attribute::Chromaticities;
+use exr::prelude::{Blocks, Compression, Encoding, Image, Layer, LayerAttributes, LineOrder, SpecificChannels, Vec2, WritableImage, f16};
+
+/// The largest finite half float.
+const HALF_MAX: f32 = 65_504.0;
+
+/// A sample as half float: rounded to the nearest half (ties to even), held to ±65 504 so an
+/// over-range render doesn't turn into infinity. NaN stays NaN.
+fn to_half(v: f32) -> f16 {
+    f16::from_f32(v.clamp(-HALF_MAX, HALF_MAX))
+}
+
+/// The `exr` crate's compression for an Output Module setting.
+pub fn compression(c: ExrCompression) -> Compression {
+    match c {
+        ExrCompression::None => Compression::Uncompressed,
+        ExrCompression::Rle => Compression::RLE,
+        ExrCompression::Zips => Compression::ZIP1,
+        ExrCompression::Zip => Compression::ZIP16,
+        ExrCompression::Piz => Compression::PIZ,
+        ExrCompression::Pxr24 => Compression::PXR24,
+        ExrCompression::B44 => Compression::B44,
+        ExrCompression::B44a => Compression::B44A,
+        ExrCompression::Dwaa => Compression::DWAA(None),
+        ExrCompression::Dwab => Compression::DWAB(None),
+    }
+}
+
+/// Scan lines, top to bottom, with compression `c`.
+fn encoding(c: ExrCompression) -> Encoding {
+    Encoding { compression: compression(c), blocks: Blocks::ScanLines, line_order: LineOrder::Increasing }
+}
+
+/// Write `w`×`h` RGBA pixels (`data`: four samples per pixel as they are to be written,
+/// premultiplied, rows top to bottom) as one OpenEXR frame, its blocks compressed in parallel as before. A pixel `data`
+/// doesn't cover is written as transparent black.
+///
+/// `chroma` is the primaries and white the samples are in (red, green, blue, white as CIE xy), written as the
+/// file's `chromaticities` attribute for Nuke, After Effects and Blender; `None` writes no attribute.
+pub fn write_rgba<W: Write + Seek>(
+    file: &mut W,
+    data: &[f32],
+    (w, h): (usize, usize),
+    (c, depth): (ExrCompression, ExrBitDepth),
+    chroma: Option<[[f32; 2]; 4]>,
+) -> exr::error::UnitResult {
+    let chroma = chroma.map(|[red, green, blue, white]| {
+        let v = |[x, y]: [f32; 2]| Vec2(x, y);
+        Chromaticities { red: v(red), green: v(green), blue: v(blue), white: v(white) }
+    });
+    let row = w.saturating_mul(4);
+    let px = move |p: Vec2<usize>| -> [f32; 4] {
+        let o = p.y().saturating_mul(row).saturating_add(p.x().saturating_mul(4));
+        match data.get(o..o.saturating_add(4)) {
+            Some(&[r, g, b, a]) => [r, g, b, a],
+            _ => [0.0; 4],
+        }
+    };
+    match depth {
+        ExrBitDepth::Float => {
+            let mut image = Image::from_layer(Layer::new(
+                (w, h),
+                LayerAttributes::default(),
+                encoding(c),
+                SpecificChannels::rgba(move |p: Vec2<usize>| {
+                    let [r, g, b, a] = px(p);
+                    (r, g, b, a)
+                }),
+            ));
+            image.attributes.chromaticities = chroma;
+            image.write().to_buffered(file)
+        }
+        ExrBitDepth::Half => {
+            let mut image = Image::from_layer(Layer::new(
+                (w, h),
+                LayerAttributes::default(),
+                encoding(c),
+                SpecificChannels::rgba(move |p: Vec2<usize>| {
+                    let [r, g, b, a] = px(p).map(to_half);
+                    (r, g, b, a)
+                }),
+            ));
+            image.attributes.chromaticities = chroma;
+            image.write().to_buffered(file)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use exr::prelude::{ReadChannels, ReadLayers};
+    use exr::prelude::{SampleType, read};
+    use std::io::Cursor;
+
+    /// A frame with a smooth gradient, grain, over-range highlights, a hard-edged high-contrast
+    /// block and a soft alpha ramp (premultiplied), like a render with text over a plate.
+    fn frame(w: usize, h: usize) -> Vec<f32> {
+        let mut s = 0x9e37_79b9u32;
+        let mut grain = move || {
+            s ^= s << 13;
+            s ^= s >> 17;
+            s ^= s << 5;
+            (s as f32 / u32::MAX as f32 - 0.5) * 0.02
+        };
+        let mut d = Vec::with_capacity(w * h * 4);
+        for y in 0..h {
+            for x in 0..w {
+                let (fx, fy) = (x as f32 / w as f32, y as f32 / h as f32);
+                let a = ((1.0 - fx) * 3.0).clamp(0.0, 1.0);
+                let text = (w / 3..2 * w / 3).contains(&x) && (h / 3..h / 2).contains(&y) && (x % 6 < 2 || y % 7 == 0);
+                let c = if text { [6.0; 3] } else { [0.18 + 0.8 * fx, 0.05 + 0.6 * fy, 0.4 * (1.0 - fx) + 0.2 * fy] };
+                let g = grain();
+                d.extend_from_slice(&[(c[0] + g).max(0.0) * a, (c[1] + g).max(0.0) * a, (c[2] + g).max(0.0) * a, a]);
+            }
+        }
+        d
+    }
+
+    fn write(data: &[f32], size: (usize, usize), c: ExrCompression, depth: ExrBitDepth) -> Vec<u8> {
+        let mut buf = Cursor::new(Vec::new());
+        write_rgba(&mut buf, data, size, (c, depth), None).unwrap();
+        buf.into_inner()
+    }
+
+    /// The samples of an RGBA file as f32, and the sample type it stores.
+    fn read_back(bytes: &[u8]) -> (Vec<f32>, SampleType) {
+        let image = read()
+            .no_deep_data()
+            .largest_resolution_level()
+            .rgba_channels(
+                |res, _| (res.width(), vec![0f32; res.width() * res.height() * 4]),
+                |(w, v): &mut (usize, Vec<f32>), p: Vec2<usize>, (r, g, b, a): (f32, f32, f32, f32)| {
+                    let o = (p.y() * *w + p.x()) * 4;
+                    v[o..o + 4].copy_from_slice(&[r, g, b, a]);
+                },
+            )
+            .first_valid_layer()
+            .all_attributes()
+            .from_buffered(Cursor::new(bytes))
+            .unwrap();
+        let ty = image.layer_data.channel_data.channels.0.sample_type;
+        (image.layer_data.channel_data.pixels.1, ty)
+    }
+
+    /// Every compression at both depths reads back: the lossless ones exactly (half: exactly the
+    /// f16 rounding of the render), the lossy ones within the tolerance the docs give. The project
+    /// crate's lossy table matches the `exr` crate's own.
+    #[test]
+    fn every_compression_and_depth_round_trips() {
+        let (w, h) = (97, 61);
+        let src = frame(w, h);
+        for depth in ExrBitDepth::ALL {
+            let want: Vec<f32> = match depth {
+                ExrBitDepth::Float => src.clone(),
+                ExrBitDepth::Half => src.iter().map(|v| f16::from_f32(*v).to_f32()).collect(),
+            };
+            let ty = if depth == ExrBitDepth::Half { SampleType::F16 } else { SampleType::F32 };
+            for c in ExrCompression::ALL {
+                assert_eq!(c.is_lossy(depth), !compression(c).is_lossless_for(ty), "{c:?} {depth:?}");
+                let bytes = write(&src, (w, h), c, depth);
+                if c.is_lossy(depth) {
+                    assert!(bytes.len() < write(&src, (w, h), ExrCompression::None, depth).len(), "{c:?} {depth:?}: smaller than None");
+                }
+                let (got, stored) = read_back(&bytes);
+                assert_eq!(stored, ty, "{c:?} {depth:?}");
+                assert_eq!(got.len(), want.len());
+                if c.is_lossy(depth) {
+                    for (i, (g, s)) in got.iter().zip(&want).enumerate() {
+                        assert!((g - s).abs() <= 0.03 + 0.06 * s.abs(), "{c:?} {depth:?} sample {i}: {g} vs {s}");
+                    }
+                } else {
+                    assert!(got.iter().zip(&want).all(|(g, s)| g.to_bits() == s.to_bits()), "{c:?} {depth:?} is not exact");
+                }
+            }
+        }
+    }
+
+    /// Files are single-part scan-line images (no tile bit in the version field) with the chosen
+    /// compression, also when the frame spans several blocks and ends in a partial one.
+    #[test]
+    fn frames_are_scan_lines_with_the_chosen_compression() {
+        let (w, h) = (80, 300);
+        let src = frame(w, h);
+        for depth in ExrBitDepth::ALL {
+            for c in ExrCompression::ALL {
+                let bytes = write(&src, (w, h), c, depth);
+                assert_eq!(&bytes[..4], &[0x76, 0x2f, 0x31, 0x01], "magic");
+                assert_eq!(&bytes[4..6], &[2, 0], "{c:?} {depth:?}: version 2, no tile / multi-part flags");
+                let meta = exr::meta::MetaData::read_from_buffered(Cursor::new(&bytes), false).unwrap();
+                assert_eq!(meta.headers.len(), 1);
+                assert_eq!(meta.headers[0].blocks, exr::meta::BlockDescription::ScanLines, "{c:?}");
+                assert_eq!(meta.headers[0].compression, compression(c), "{c:?}");
+                assert_eq!(meta.headers[0].line_order, LineOrder::Increasing);
+            }
+        }
+    }
+
+    /// The default (ZIP, 32-bit float) writes the `exr` crate's `SMALL_LOSSLESS` preset (scan
+    /// lines, ZIP), the layout the Render Queue has written since #2812. The reference is that
+    /// preset, not files from before #2812, which were tiled RLE.
+    #[test]
+    fn the_default_matches_the_small_lossless_preset_byte_for_byte() {
+        let (w, h) = (64, 48);
+        let src = frame(w, h);
+        let pixels = SpecificChannels::rgba(|p: Vec2<usize>| {
+            let o = p.y() * w * 4 + p.x() * 4;
+            (src[o], src[o + 1], src[o + 2], src[o + 3])
+        });
+        let layer = Layer::new((w, h), LayerAttributes::default(), Encoding::SMALL_LOSSLESS, pixels);
+        let mut before = Cursor::new(Vec::new());
+        Image::from_layer(layer).write().to_buffered(&mut before).unwrap();
+        let default = (ExrCompression::default(), ExrBitDepth::default());
+        assert_eq!(default, (ExrCompression::Zip, ExrBitDepth::Float));
+        assert_eq!(write(&src, (w, h), default.0, default.1), before.into_inner());
+    }
+
+    /// Half-float files hold samples above the half range at its largest finite value, not as
+    /// infinity; the 32-bit file keeps them.
+    #[test]
+    fn half_clamps_over_range_samples_to_the_largest_half() {
+        let data = [1.0e6, 70_000.0, 65_504.0, 1.0, -1.0e6, 0.5, f32::NAN, 1.0];
+        let (half, _) = read_back(&write(&data, (2, 1), ExrCompression::Zip, ExrBitDepth::Half));
+        assert_eq!(&half[..6], &[65_504.0, 65_504.0, 65_504.0, 1.0, -65_504.0, 0.5]);
+        assert!(half[6].is_nan() && half.iter().all(|v| !v.is_infinite()));
+        let (float, _) = read_back(&write(&data, (2, 1), ExrCompression::Zip, ExrBitDepth::Float));
+        assert_eq!(&float[..2], &[1.0e6, 70_000.0]);
+    }
+
+    /// Data shorter than the frame (never produced by the Render Queue) writes transparent black
+    /// for the missing pixels instead of panicking.
+    #[test]
+    fn short_data_is_padded_not_a_panic() {
+        let (got, _) = read_back(&write(&[1.0, 0.5, 0.25, 1.0], (3, 2), ExrCompression::Zip, ExrBitDepth::Half));
+        assert_eq!(&got[..4], &[1.0, 0.5, 0.25, 1.0]);
+        assert!(got[4..].iter().all(|v| *v == 0.0));
+    }
+
+    /// The chromaticities attribute is written when given and absent otherwise.
+    #[test]
+    fn chromaticities_are_written_only_when_given() {
+        let rec709 = [[0.64, 0.33], [0.30, 0.60], [0.15, 0.06], [0.3127, 0.3290]];
+        for depth in [ExrBitDepth::Float, ExrBitDepth::Half] {
+            let mut with = Cursor::new(Vec::new());
+            write_rgba(&mut with, &[0.5; 4], (1, 1), (ExrCompression::Zip, depth), Some(rec709)).unwrap();
+            let meta = exr::meta::MetaData::read_from_buffered(Cursor::new(with.into_inner()), false).unwrap();
+            let got = meta.headers[0].shared_attributes.chromaticities.map(|c| [c.red, c.green, c.blue, c.white].map(|v| [v.0, v.1]));
+            assert_eq!(got, Some(rec709));
+            let meta = exr::meta::MetaData::read_from_buffered(Cursor::new(write(&[0.5; 4], (1, 1), ExrCompression::Zip, depth)), false).unwrap();
+            assert!(meta.headers[0].shared_attributes.chromaticities.is_none());
+        }
+    }
+}
diff --git a/crates/export/src/hevc_av1.rs b/crates/export/src/hevc_av1.rs
index f42ccda24..d43b1c5ed 100644
--- a/crates/export/src/hevc_av1.rs
+++ b/crates/export/src/hevc_av1.rs
@@ -7,7 +7,7 @@ use effectcraft_time::FrameRate;
 use filmcraft_isobmff::{Av1Config, CodecConfig, FourCc, HevcConfig, SampleEntry};
 use rayon::prelude::*;
 
-use crate::encode::{Packet, VideoEncoder};
+use crate::encode::{Codes, Packet, VideoEncoder};
 use crate::{ExportError, Result};
 
 fn enc_err(e: impl std::fmt::Display) -> ExportError {
@@ -59,6 +59,7 @@ pub(crate) struct Hevc {
     w: u32,
     h: u32,
     bits: u8,
+    codes: Codes,
     planes: Planes,
 }
 
@@ -81,18 +82,21 @@ pub(crate) fn hevc_config(w: u32, h: u32, rate: FrameRate, om: &OutputModule) ->
 }
 
 impl Hevc {
-    pub(crate) fn new(w: u32, h: u32, rate: FrameRate, om: &OutputModule) -> Result<Hevc> {
-        let cfg = hevc_config(w, h, rate, om);
+    pub(crate) fn new(w: u32, h: u32, rate: FrameRate, om: &OutputModule, codes: Codes) -> Result<Hevc> {
+        let mut cfg = hevc_config(w, h, rate, om);
+        (cfg.colour_primaries, cfg.transfer_characteristics, cfg.matrix_coeffs) = (codes.primaries, codes.transfer, codes.matrix);
         let bits = cfg.profile.bit_depth();
         let enc = effectcraft_hevcenc::Encoder::new(cfg).map_err(enc_err)?;
-        Ok(Hevc { enc, w, h, bits, planes: Planes::default() })
+        Ok(Hevc { enc, w, h, bits, codes, planes: Planes::default() })
     }
 }
 
 impl VideoEncoder for Hevc {
     fn sample_entry(&self) -> SampleEntry {
         let cfg = HevcConfig::parse(&self.enc.hvcc()).unwrap_or_default();
-        SampleEntry::hevc(cfg, self.w as u16, self.h as u16)
+        let mut entry = SampleEntry::hevc(cfg, self.w as u16, self.h as u16);
+        crate::encode::tag_nclx_limited(&mut entry, self.codes);
+        entry
     }
     fn encode(&mut self, rgba: &[u8], _index: u64) -> Result<Vec<Packet>> {
         let (w, h) = (self.w as usize, self.h as usize);
@@ -114,6 +118,7 @@ pub(crate) struct Av1 {
     w: u32,
     h: u32,
     bits: u8,
+    codes: Codes,
     planes: Planes,
 }
 
@@ -133,11 +138,12 @@ pub(crate) fn av1_config(w: u32, h: u32, rate: FrameRate, om: &OutputModule) ->
 }
 
 impl Av1 {
-    pub(crate) fn new(w: u32, h: u32, rate: FrameRate, om: &OutputModule) -> Result<Av1> {
-        let cfg = av1_config(w, h, rate, om);
+    pub(crate) fn new(w: u32, h: u32, rate: FrameRate, om: &OutputModule, codes: Codes) -> Result<Av1> {
+        let mut cfg = av1_config(w, h, rate, om);
+        (cfg.color_primaries, cfg.transfer_characteristics, cfg.matrix_coefficients) = (codes.primaries, codes.transfer, codes.matrix);
         let bits = cfg.bit_depth;
         let enc = effectcraft_av1enc::Encoder::new(cfg).map_err(enc_err)?;
-        Ok(Av1 { enc, w, h, bits, planes: Planes::default() })
+        Ok(Av1 { enc, w, h, bits, codes, planes: Planes::default() })
     }
     /// The `av1C` record (also the WebM CodecPrivate).
     pub(crate) fn av1c(&self) -> Vec<u8> {
@@ -148,7 +154,9 @@ impl Av1 {
 impl VideoEncoder for Av1 {
     fn sample_entry(&self) -> SampleEntry {
         let cfg = Av1Config::parse(&self.enc.av1c()).unwrap_or_default();
-        SampleEntry::video(FourCc(*b"av01"), CodecConfig::Av1(cfg), self.w as u16, self.h as u16)
+        let mut entry = SampleEntry::video(FourCc(*b"av01"), CodecConfig::Av1(cfg), self.w as u16, self.h as u16);
+        crate::encode::tag_nclx_limited(&mut entry, self.codes);
+        entry
     }
     fn encode(&mut self, rgba: &[u8], _index: u64) -> Result<Vec<Packet>> {
         let (w, h) = (self.w as usize, self.h as usize);
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index eda979958..9827ce754 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -6,14 +6,15 @@
 //! | ProRes | QuickTime MOV | FilmCraft ProRes 422 Proxy/LT/422/HQ, 10-bit; 4444/4444 XQ 4:4:4 | 4444 (16-bit alpha coding) | PCM 16/24-bit or 32-bit float, mono/stereo |
 //! | Uncompressed | QuickTime MOV (`raw `) | 8-bit RGB (depth 24, rows padded to even bytes) or ARGB (depth 32) | RGB + Alpha (straight or premultiplied) | PCM 16/24-bit or 32-bit float, mono/stereo |
 //! | PNG / JPEG / TIFF sequence | one file per frame | 8-bit | PNG, TIFF | — |
-//! | OpenEXR sequence | one file per frame | 32-bit float, linear light, premultiplied | yes | — |
+//! | OpenEXR sequence | one file per frame, scan lines | 32-bit float (default) or half float, linear light, premultiplied; compression None, RLE, ZIPS, ZIP (default), PIZ, PXR24, B44, B44A, DWAA, DWAB | yes | — |
+//! | Targa sequence | one file per frame | uncompressed 8-bit: 24-bit RGB, 32-bit RGB + Alpha (8 alpha bits), 8-bit grey for Alpha; top-left origin | yes (straight or premultiplied) | — |
 //! | Animated GIF | GIF89a | 256-colour palette per frame (NeuQuant) | 1-bit | — |
 //! | WebM | WebM (Matroska) | VP9 profile 0 (`effectcraft-vp9enc`: key + inter frames, a key frame every 2 s, loop filter), 8-bit 4:2:0; or AV1 (`effectcraft-av1enc`) | VP9 alpha (BlockAdditional) | Opus (`effectcraft-opusenc`: SILK / hybrid / CELT by bitrate and application), 48 kHz |
 //! | HEVC | MP4 (`hvc1`) | `effectcraft-hevcenc` Main / Main 10 4:2:0, I + P slices, bitrate or constant quality, level, key-frame interval | no | AAC-LC (FilmCraft) |
 //! | AV1 | MP4 (`av01`) | `effectcraft-av1enc` Main 8/10-bit 4:2:0, key + inter frames | no | AAC-LC (FilmCraft) |
 //! | WAV / AIFF | RIFF WAVE / AIFF (AIFF-C for float) | — | — | PCM 16/24-bit or 32-bit float, mono/stereo (audio only) |
 //!
-//! Every frame goes through [`pipeline`]: the Render Settings overrides (Effects, Solo Switches,
+//! Every frame goes through the internal `pipeline` module: the Render Settings overrides (Effects, Solo Switches,
 //! Guide Layers, Frame Blending, Motion Blur, Color Depth), field rendering (two fields half a
 //! frame apart woven line by line, with optional 3:2 pulldown from film frames at 4/5 of the
 //! rate), then the Output Module's Crop (edges or the region of interest) and Resize. Channels
@@ -33,6 +34,7 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 mod encode;
+pub mod exr_out;
 mod hevc_av1;
 mod out;
 mod pipeline;
@@ -174,7 +176,9 @@ pub fn export(job: &Job, progress: &mut dyn FnMut(&Progress) -> bool) -> Result<
 pub async fn export_async(job: &Job<'_>, progress: &mut dyn FnMut(&Progress) -> bool) -> Result<Report> {
     let t0 = Instant::now();
     let cx = Cx::new(job);
+    let render = RenderEnd(job.accel);
     let mut r = export_with(&cx, progress, t0).await;
+    drop(render);
     if matches!(r, Err(ExportError::Cancelled)) {
         cx.remove_cancelled_outputs()?;
         return r;
@@ -187,6 +191,18 @@ pub async fn export_async(job: &Job<'_>, progress: &mut dyn FnMut(&Progress) ->
     r
 }
 
+/// Calls [`effectcraft_render::Accelerator::render_end`] when dropped: after the export, and
+/// also when it panics or its future is dropped (a browser worker aborting it).
+struct RenderEnd<'a>(Option<&'a dyn effectcraft_render::Accelerator>);
+
+impl Drop for RenderEnd<'_> {
+    fn drop(&mut self) {
+        if let Some(a) = self.0 {
+            a.render_end();
+        }
+    }
+}
+
 async fn export_with(cx: &Cx<'_>, progress: &mut dyn FnMut(&Progress) -> bool, t0: Instant) -> Result<Report> {
     let comp = cx.comp().ok_or(ExportError::NoComp)?;
     let total = cx.settings.frame_count(comp);
@@ -270,7 +286,7 @@ async fn sequence(cx: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut State<'_>)
                 let path = sequence_path(cx.path, f0 + k as i64);
                 // Encode in memory first: the storage hook decides where it fits.
                 let mut buf = std::io::Cursor::new(Vec::new());
-                write_still(cx, &mut buf, fmt, &img, comp, channels, w, h, cx.output.quality)?;
+                write_still(cx, &mut buf, &img, comp, StillOutput { format: fmt, channels, size: (w, h), quality: cx.output.quality })?;
                 let data = buf.into_inner();
                 let path = cx.place(&path, data.len() as u64);
                 let mut f = cx.create(&path)?;
@@ -287,49 +303,53 @@ async fn sequence(cx: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut State<'_>)
     Ok(Report { path: sequence_path(cx.path, f0), frames: 0, width: w, height: h, seconds: 0.0, bytes, audio: false, log: None, overflow: vec![] })
 }
 
-#[allow(clippy::too_many_arguments)]
-fn write_still<W: std::io::Write + std::io::Seek>(
-    cx: &Cx,
-    file: &mut W,
-    fmt: OutputFormat,
-    img: &Image,
-    comp: &Comp,
+struct StillOutput {
+    format: OutputFormat,
     channels: Channels,
-    w: u32,
-    h: u32,
+    size: (u32, u32),
     quality: u8,
-) -> Result<()> {
-    use image::{ExtendedColorType, ImageEncoder, ImageFormat};
+}
+
+fn write_still<W: std::io::Write + std::io::Seek>(cx: &Cx, file: &mut W, img: &Image, comp: &Comp, output: StillOutput) -> Result<()> {
+    let StillOutput { format: fmt, channels, size: (w, h), quality } = output;
+    use image::{ExtendedColorType, ImageEncoder};
     match fmt {
         OutputFormat::ExrSequence => {
             // Linear light, premultiplied (the EXR convention); RGB keeps alpha = 1 over the background.
             // Colour is floored at 0 but not capped at 1: a 32 bpc frame's over-range values survive (#339).
-            let lin = |v: f32| if v <= 0.04045 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) };
+            // The frame was rendered without the HDR step (`RenderOpts::skip_hdr_step`) and is
+            // decoded with the output space's curve, in the output space's primaries.
+            let pipe = effectcraft_render::color::Pipe::of(&cx.project.settings);
+            let dec = pipe.output_linear();
+            let lin3 = |c: [f32; 3]| dec.apply(c.map(|v| v.max(0.0)));
             let mut data = Vec::with_capacity((w * h * 4) as usize);
             for y in 0..h {
                 for x in 0..w {
                     let p = if x < img.width && y < img.height { img.data[img.idx(x, y)] } else { [0.0; 4] };
                     let (c, a) = match channels {
-                        Channels::Alpha => {
-                            let a = p[3].clamp(0.0, 1.0);
-                            ([lin(a); 3], 1.0)
-                        }
+                        // Alpha is coverage, not encoded colour: written as it is.
+                        Channels::Alpha => ([p[3].clamp(0.0, 1.0); 3], 1.0),
                         Channels::Rgba => {
                             let a = p[3].clamp(0.0, 1.0);
-                            let s = |c: f32| if a > 0.0 { lin((c / a).max(0.0)) * a } else { 0.0 };
-                            ([s(p[0]), s(p[1]), s(p[2])], a)
+                            let c = if a > 0.0 { lin3([p[0] / a, p[1] / a, p[2] / a]).map(|v| v * a) } else { [0.0; 3] };
+                            (c, a)
                         }
                         Channels::Rgb => {
+                            // The background is added to the output-encoded frame as it is, as every other output
+                            // does (`Image::to_rgba8_over`), then decoded with the frame: same colour as a PNG.
                             let k = 1.0 - p[3].clamp(0.0, 1.0);
-                            let c = |i: usize| lin((p[i] + comp.background[i] * k).max(0.0));
-                            ([c(0), c(1), c(2)], 1.0)
+                            (lin3([0, 1, 2].map(|i| p[i] + comp.background[i] * k)), 1.0)
                         }
                     };
                     data.extend_from_slice(&[c[0], c[1], c[2], a]);
                 }
             }
-            let buf = image::Rgba32FImage::from_raw(w, h, data).ok_or_else(|| ExportError::Encode("exr buffer".into()))?;
-            image::DynamicImage::ImageRgba32F(buf).write_to(file, ImageFormat::OpenExr).map_err(|e| ExportError::Encode(e.to_string()))
+            // Scan lines with the module's compression and sample type (`exr_out`), naming the primaries and
+            // white the values are in (the output space's), for Nuke, AE and Blender.
+            let om = cx.output;
+            let chroma = Some(pipe.output_linear_space().exr_chromaticities());
+            exr_out::write_rgba(file, &data, (w as usize, h as usize), (om.exr_compression, om.exr_bit_depth), chroma)
+                .map_err(|e| ExportError::Encode(e.to_string()))
         }
         OutputFormat::JpegSequence => {
             let px = cx.pixels(img, comp, if channels == Channels::Alpha { Channels::Alpha } else { Channels::Rgb }, w, h);
@@ -338,19 +358,22 @@ fn write_still<W: std::io::Write + std::io::Seek>(
                 .write_image(&rgb, w, h, ExtendedColorType::Rgb8)
                 .map_err(|e| ExportError::Encode(e.to_string()))
         }
-        OutputFormat::PngSequence | OutputFormat::TiffSequence => {
+        OutputFormat::PngSequence | OutputFormat::TiffSequence | OutputFormat::TargaSequence => {
             let px = cx.pixels(img, comp, channels, w, h);
             let (data, ct) = match channels {
                 Channels::Rgba => (px, ExtendedColorType::Rgba8),
                 Channels::Alpha => (px.as_chunks::<4>().0.iter().map(|p| p[0]).collect(), ExtendedColorType::L8),
                 Channels::Rgb => (px.as_chunks::<4>().0.iter().flat_map(|p| [p[0], p[1], p[2]]).collect(), ExtendedColorType::Rgb8),
             };
-            if fmt == OutputFormat::PngSequence {
-                image::codecs::png::PngEncoder::new(file).write_image(&data, w, h, ct).map_err(|e| ExportError::Encode(e.to_string()))
-            } else {
+            match fmt {
+                OutputFormat::PngSequence => image::codecs::png::PngEncoder::new(file).write_image(&data, w, h, ct),
+                // Uncompressed (the encoder's run-length compression is off), top-left origin, the
+                // alpha bits in the image descriptor: 8 for RGB + Alpha, 0 otherwise.
+                OutputFormat::TargaSequence => image::codecs::tga::TgaEncoder::new(file).disable_rle().write_image(&data, w, h, ct),
                 // (the TIFF encoder needs Seek)
-                image::codecs::tiff::TiffEncoder::new(file).write_image(&data, w, h, ct).map_err(|e| ExportError::Encode(e.to_string()))
+                _ => image::codecs::tiff::TiffEncoder::new(file).write_image(&data, w, h, ct),
             }
+            .map_err(|e| ExportError::Encode(e.to_string()))
         }
         f => Err(ExportError::Unsupported(format!("{} is not a still format", f.label()))),
     }
@@ -375,7 +398,7 @@ async fn gif_export(job: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut State<'_
         let end = (i + batch).min(st.total);
         let frames: Vec<gif::Frame<'static>> = job
             .frames(comp, (i..end).collect(), |_, img| {
-                let mut px = job.pixels(&img, comp, job.output.channels, w, h);
+                let mut px = job.pixels_with(&img, comp, job.output.channels, w, h, false);
                 gif::Frame::from_rgba_speed(w as u16, h as u16, &mut px, 10)
             })
             .await;
diff --git a/crates/export/src/pipeline.rs b/crates/export/src/pipeline.rs
index 8dcee03e4..e0c5cfc87 100644
--- a/crates/export/src/pipeline.rs
+++ b/crates/export/src/pipeline.rs
@@ -4,10 +4,8 @@
 
 use std::sync::Mutex;
 
-use effectcraft_project::render_queue::{
-    AlphaMode, Channels, ColorDepth, CurrentOrOff, EffectsMode, FrameSample, RenderLog, ResizeQuality, SwitchOverride, log_path,
-};
-use effectcraft_project::{Comp, Project};
+use effectcraft_project::render_queue::{AlphaMode, Channels, CurrentOrOff, EffectsMode, FrameSample, RenderLog, ResizeQuality, SwitchOverride, log_path};
+use effectcraft_project::{BitDepth, Comp, Project};
 use effectcraft_raster::Image;
 use effectcraft_render::{Backend, LayerCache, RenderOpts, Renderer};
 use effectcraft_time::Tick;
@@ -39,6 +37,57 @@ pub(crate) fn gpu_inflight(var: Option<&str>) -> usize {
     }
 }
 
+/// Caps CPU frames in flight (#1615): a whole number of frames, at least 1. Unset, CPU renders
+/// keep one frame per thread in flight as before. A heavy comp can need gigabytes of working
+/// memory per frame, so 16 threads at once can get the process OOM-killed; the headless CLI
+/// reads no `memory.*` preferences, so this is how a render there is held to fewer frames.
+pub(crate) const CPU_INFLIGHT_ENV: &str = "EFFECTCRAFT_CPU_INFLIGHT";
+
+/// CPU frames in flight from the `EFFECTCRAFT_CPU_INFLIGHT` value: `None` (no cap) when unset or
+/// blank, a positive whole number, or `None` with a warning when it is 0, negative, not a
+/// number or too large.
+pub(crate) fn cpu_inflight(var: Option<&str>) -> Option<usize> {
+    let v = var?;
+    if v.trim().is_empty() {
+        return None;
+    }
+    match v.trim().parse::<usize>() {
+        Ok(n) if n >= 1 => Some(n),
+        _ => {
+            log::warn!(target: "effectcraft_export", "{CPU_INFLIGHT_ENV}={v:?} is not a whole number of frames of at least 1: CPU frames are not capped");
+            None
+        }
+    }
+}
+
+/// The frames-in-flight caps of a batch: `gpu` (#879) for the GPU's memory, `cpu` (#1615) for
+/// the process's.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) struct Inflight {
+    pub gpu: Option<usize>,
+    pub cpu: Option<usize>,
+}
+
+impl Inflight {
+    /// Frames rendered at once: the smaller cap while the GPU renders, and only the CPU cap once
+    /// it has stopped for good (the CPU fallback renders in parallel, #1511). `None`: uncapped.
+    pub fn renders(&self, gpu_live: bool) -> Option<usize> {
+        let gpu = self.gpu.filter(|_| gpu_live);
+        let n = match (gpu, self.cpu) {
+            (Some(g), Some(c)) => Some(g.min(c)),
+            (g, c) => g.or(c),
+        };
+        n.map(|n| n.max(1))
+    }
+
+    /// Frames per window, rendered (`renders` at a time) and then encoded in parallel: with a CPU
+    /// cap at most that many, so finished images held before encoding count against it too;
+    /// with a GPU cap alone, one per thread (the images are in RAM, not VRAM).
+    pub fn window(&self, renders: usize) -> usize {
+        self.cpu.map_or(renders.max(rayon::current_num_threads()), |c| c.max(1))
+    }
+}
+
 /// `render` then `encode` over the frames `ks`, results in `ks` order.
 ///
 /// Without `cap` every frame renders and encodes in one parallel batch (the CPU path, as
@@ -55,42 +104,63 @@ pub(crate) fn map_frames<I: Send, T: Send>(
     render: impl Fn(u64) -> I + Sync + Send,
     encode: impl Fn(u64, I) -> T + Sync + Send,
 ) -> Vec<T> {
-    map_frames_while(ks, cap, || true, render, encode)
+    map_frames_while(ks, Inflight { gpu: cap, cpu: None }, || true, render, encode)
 }
 
-/// [`map_frames`] whose `cap` holds only while `capped()`: once it turns false (the GPU stopped
-/// for good, so every frame falls back to the CPU), the remaining frames render in parallel
-/// like the uncapped CPU path instead of one chunk of `cap` at a time.
+/// [`map_frames`] with the caps of `caps`, the GPU cap holding only while `gpu_live()`: once it
+/// turns false (the GPU stopped for good, so every frame falls back to the CPU), the remaining
+/// frames render under the CPU cap alone, in parallel when there is none, instead of one chunk
+/// of the GPU cap at a time. A CPU cap also bounds each window ([`Inflight::window`]).
 pub(crate) fn map_frames_while<I: Send, T: Send>(
     ks: Vec<u64>,
-    cap: Option<usize>,
-    capped: impl Fn() -> bool,
+    caps: Inflight,
+    gpu_live: impl Fn() -> bool,
     render: impl Fn(u64) -> I + Sync + Send,
     encode: impl Fn(u64, I) -> T + Sync + Send,
 ) -> Vec<T> {
     use rayon::prelude::*;
-    let Some(n) = cap.map(|n| n.max(1)).filter(|_| capped()) else {
+    if caps.renders(gpu_live()).is_none() {
         return ks.into_par_iter().map(|k| encode(k, render(k))).collect();
-    };
-    let window = n.max(rayon::current_num_threads());
+    }
     let mut out = Vec::with_capacity(ks.len());
-    for (w, win) in ks.chunks(window).enumerate() {
-        if !capped() {
-            out.par_extend(ks[w * window..].par_iter().map(|&k| encode(k, render(k))));
+    let mut rest = &ks[..];
+    while !rest.is_empty() {
+        let Some(n) = caps.renders(gpu_live()) else {
+            out.par_extend(rest.par_iter().map(|&k| encode(k, render(k))));
             break;
-        }
+        };
+        let (win, tail) = rest.split_at(caps.window(n).min(rest.len()));
         let mut imgs = Vec::with_capacity(win.len());
         let mut i = 0;
         while i < win.len() {
-            let end = if capped() { (i + n).min(win.len()) } else { win.len() };
+            let end = caps.renders(gpu_live()).map_or(win.len(), |n| (i + n).min(win.len()));
             imgs.par_extend(win[i..end].par_iter().map(|&k| render(k)));
             i = end;
         }
         out.par_extend(win.par_iter().copied().zip(imgs.into_par_iter()).map(|(k, img)| encode(k, img)));
+        rest = tail;
     }
     out
 }
 
+/// Threads that encode one batch of frames while the next renders ([`Cx::frames_beside`]).
+/// Their own pool: the encoder's parallel steps (colour conversion) would otherwise queue behind
+/// the render's work in the global pool. `None` where threads can't be started (a browser
+/// without them): encoding and rendering then take turns.
+pub(crate) struct Beside(Option<rayon::ThreadPool>);
+
+impl Beside {
+    fn new() -> Beside {
+        Beside(rayon::ThreadPoolBuilder::new().thread_name(|i| format!("export-encode-{i}")).build().ok())
+    }
+
+    /// The process's encode threads, started by the first movie export and shared by all.
+    pub fn shared() -> &'static Beside {
+        static SHARED: std::sync::OnceLock<Beside> = std::sync::OnceLock::new();
+        SHARED.get_or_init(Beside::new)
+    }
+}
+
 /// A job being exported: the job, the project with the Render Settings overrides applied, the
 /// job's layer cache and per-frame timing for the render log.
 pub(crate) struct Cx<'a> {
@@ -148,6 +218,9 @@ impl<'a> Cx<'a> {
     pub fn new(job: &'a Job<'a>) -> Cx<'a> {
         let mut project = job.project.clone();
         apply_overrides(&mut project, job);
+        // Render Settings ▸ Color Depth overrides the project's depth for the whole render (every
+        // layer and effect quantises at it), not just the finished frame (#2022).
+        project.settings.bit_depth = job.settings.color_depth.resolve(project.settings.bit_depth);
         let frame_times = (job.options.log == RenderLog::PlusPerFrameInfo).then(|| Mutex::new(Vec::new()));
         let cache = LayerCache::default();
         // With deferred readbacks, buffers computed from a missed pass's placeholders are not kept.
@@ -168,7 +241,7 @@ impl<'a> Cx<'a> {
         // compositors differ slightly, so a per-frame choice made renders differ run to run.
         let backend = if self.project.settings.gpu_acceleration { Backend::Gpu } else { Backend::Cpu };
         let opts = RenderOpts {
-            scale: s.resolution.clamp(0.01, 4.0),
+            scale: self.comp().map(|c| s.effective_scale(c)).unwrap_or_else(|| s.resolution.clamp(0.01, 4.0)),
             motion_blur: s.motion_blur_override() != SwitchOverride::OffForAll,
             guides: s.guide_layers == CurrentOrOff::Current,
             draft: s.quality == RenderQuality::Draft,
@@ -178,6 +251,8 @@ impl<'a> Cx<'a> {
             roi: None,
             nested_switches: self.job.nested_switches,
             draft_shadows: true,
+            // OpenEXR keeps over-range values: no HDR compand / tone mapping on its frames.
+            skip_hdr_step: self.job.output.format == effectcraft_project::render_queue::OutputFormat::ExrSequence,
             proxy: s.proxy_use,
         };
         let mut r = Renderer::new(&self.project, self.job.footage, opts);
@@ -208,10 +283,56 @@ impl<'a> Cx<'a> {
             }
             return out;
         }
-        // The cap is for the GPU's memory: once it has stopped for good, frames render on the
-        // CPU in parallel.
+        // The GPU cap is for the GPU's memory: once it has stopped for good, frames render on the
+        // CPU, in parallel or under the CPU cap (#1615), which holds throughout.
         let gpu_live = || self.job.accel.is_none_or(|a| a.available());
-        map_frames_while(ks, self.gpu_cap(), gpu_live, |k| self.frame(comp, k), f)
+        map_frames_while(ks, self.inflight(), gpu_live, |k| self.frame(comp, k), f)
+    }
+
+    /// [`Cx::frames`] for `ks` while `encode` runs beside them on `beside`'s threads, so the
+    /// render threads don't wait for the (largely sequential) encoder of the previous batch.
+    /// With deferred readbacks, or where no encode thread could be started, `encode` runs first.
+    #[cfg(test)]
+    pub async fn frames_beside<T: Send, A: Send>(
+        &self,
+        beside: &Beside,
+        comp: &Comp,
+        ks: Vec<u64>,
+        f: impl Fn(u64, Image) -> T + Sync + Send,
+        encode: impl FnOnce() -> A + Send,
+    ) -> crate::Result<(A, Vec<T>)> {
+        self.beside(beside, self.frames(comp, ks, f), encode).await
+    }
+
+    /// Run `encode` on `beside`'s threads while `frames` renders the next batch. With deferred
+    /// readbacks, or where no encode thread could be started, `encode` runs first.
+    pub async fn beside<T: Send, A: Send>(
+        &self,
+        beside: &Beside,
+        frames: impl std::future::Future<Output = Vec<T>>,
+        encode: impl FnOnce() -> A + Send,
+    ) -> crate::Result<(A, Vec<T>)> {
+        match &beside.0 {
+            Some(pool) if !self.deferred() => {
+                let mut done = None;
+                let frames = pool.in_place_scope(|s| {
+                    s.spawn(|_| done = Some(std::panic::catch_unwind(std::panic::AssertUnwindSafe(encode))));
+                    effectcraft_render::passes::block_on(frames)
+                });
+                match done {
+                    Some(Ok(a)) => Ok((a, frames)),
+                    Some(Err(panic)) => {
+                        let why = panic.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| panic.downcast_ref::<String>().cloned()).unwrap_or_default();
+                        Err(crate::ExportError::Encode(format!("the encoder stopped unexpectedly: {why}")))
+                    }
+                    None => Err(crate::ExportError::Encode("the encoder stopped unexpectedly".into())),
+                }
+            }
+            _ => {
+                let a = encode();
+                Ok((a, frames.await))
+            }
+        }
     }
 
     /// GPU frames rendered at once (#879), decided once per batch: with a GPU accelerator every
@@ -222,6 +343,11 @@ impl<'a> Cx<'a> {
         (self.job.accel.is_some() && self.project.settings.gpu_acceleration).then(|| gpu_inflight(std::env::var(GPU_INFLIGHT_ENV).ok().as_deref()))
     }
 
+    /// The GPU and CPU frames-in-flight caps every frame loop shares (#1615).
+    fn inflight(&self) -> Inflight {
+        Inflight { gpu: self.gpu_cap(), cpu: cpu_inflight(std::env::var(CPU_INFLIGHT_ENV).ok().as_deref()) }
+    }
+
     /// Output frame `i`: sampled (fields, pulldown), at the colour depth, cropped and resized.
     pub fn frame(&self, comp: &Comp, i: u64) -> Image {
         effectcraft_render::passes::block_on(self.frame_async(comp, i))
@@ -237,31 +363,86 @@ impl<'a> Cx<'a> {
                 if second == first { a } else { interleave(&a, &self.render_at(second).await, upper_first) }
             }
         };
-        let mut img = img;
-        // Color Depth: renders run at the project's depth; another depth quantises the frame.
-        let depth = self.job.settings.color_depth;
-        if depth != ColorDepth::Current
-            && let Some(levels) = depth.resolve(self.project.settings.bit_depth).levels()
-        {
-            img.quantize(levels);
-        }
         let img = self.crop_resize(img);
+        if let Some(ft) = &self.frame_times {
+            ft.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push((i, t0.elapsed().as_secs_f64()));
+        }
+        img
+    }
+
+    /// Output frame `i` as the H.264 export's 4:2:0 planes at `w`×`h`, rendered and converted
+    /// by the accelerator ([`effectcraft_render::Accelerator::comp_frame_yuv420`]). Only for
+    /// frames that need nothing done after the render (progressive, at the project's depth, no
+    /// crop or resize, rendered at exactly `w`×`h`). `None`: render it with [`Cx::frame`].
+    pub fn yuv420_frame(&self, comp: &Comp, i: u64, w: u32, h: u32) -> Option<Vec<u8>> {
+        if self.deferred() {
+            return None;
+        }
+        let FrameSample::Progressive(t) = self.job.settings.sample(comp, i) else { return None };
+        // Above 8 bpc the colour is dithered on its way to 8 bits (`Cx::pixels`), which the
+        // accelerator's conversion doesn't do: those frames render as usual so H.264 doesn't
+        // band (#2022). The project's depth already includes Render Settings ▸ Color Depth.
+        if self.project.settings.bit_depth != BitDepth::Bpc8 {
+            return None;
+        }
+        let om = self.job.output;
+        let scale = self.job.settings.effective_scale(comp);
+        let size = |n: u32| ((n as f64 * scale).round() as u32).max(1);
+        if om.resize.enabled || (size(comp.width), size(comp.height)) != (w, h) || om.crop.edges(w, h, scale) != (0, 0, 0, 0) {
+            return None;
+        }
+        let t0 = Instant::now();
+        let r = self.renderer();
+        let a = r.active_accel()?;
+        let planes = a.comp_frame_yuv420(&r, self.job.comp, t, comp.background)?;
+        let (cw, ch) = (w.div_ceil(2) as usize, h.div_ceil(2) as usize);
+        if planes.len() != w as usize * h as usize + 2 * cw * ch {
+            return None;
+        }
+        // A frame rendered off `passes::comp_frame` ends here; on a `None` the fallback renders and ends it.
+        a.frame_end();
         if let Some(ft) = &self.frame_times {
             ft.lock().unwrap_or_else(|e| e.into_inner()).push((i, t0.elapsed().as_secs_f64()));
         }
-        img
+        Some(planes)
+    }
+
+    /// Output frames `ks` for the H.264 encoder: the accelerator's planes
+    /// ([`Cx::yuv420_frame`]) where it can, otherwise `fallback` of the frame rendered as usual.
+    pub(crate) fn h264_frames<T: Send>(
+        &self,
+        comp: &Comp,
+        ks: Vec<u64>,
+        w: u32,
+        h: u32,
+        planes: impl Fn(Vec<u8>) -> T + Sync + Send,
+        fallback: impl Fn(u64, Image) -> T + Sync + Send,
+    ) -> Vec<T> {
+        // As in `frames`: once the GPU has stopped for good, the rest render in parallel.
+        let gpu_live = || self.job.accel.is_none_or(|a| a.available());
+        map_frames_while(
+            ks,
+            self.inflight(),
+            gpu_live,
+            |k| self.yuv420_frame(comp, k, w, h).ok_or_else(|| self.frame(comp, k)),
+            |k, r| match r {
+                Ok(p) => planes(p),
+                Err(img) => fallback(k, img),
+            },
+        )
     }
 
     /// Output Module ▸ Crop, then Resize.
     fn crop_resize(&self, img: Image) -> Image {
         let om = self.job.output;
-        let scale = self.job.settings.resolution.clamp(0.01, 4.0);
+        let scale = self.comp().map(|c| self.job.settings.effective_scale(c)).unwrap_or_else(|| self.job.settings.resolution.clamp(0.01, 4.0));
+        // frame_size applies crop itself: use the original frame and the same scale as edges.
+        let (w, h) = om.frame_size(img.width, img.height, scale);
         let (t, l, b, r) = om.crop.edges(img.width, img.height, scale);
         let img = if (t, l, b, r) == (0, 0, 0, 0) { img } else { crop(&img, t, l, b, r) };
         if !om.resize.enabled {
             return img;
         }
-        let (w, h) = om.frame_size(img.width, img.height, 1.0);
         if (w, h) == (img.width, img.height) {
             return img;
         }
@@ -273,12 +454,24 @@ impl<'a> Cx<'a> {
 
     /// 8-bit RGBA of the requested channels cropped/padded to `w`×`h` (codec rounding): RGB over
     /// the comp background (opaque), RGB + Alpha straight or premultiplied, or the alpha matte.
+    /// When the render runs above 8 bpc, the colour is dithered on its way to 8 bits, as After
+    /// Effects dithers colours converted down to 8 bpc for rendering and export, so gradients
+    /// rendered at 16 or 32 bpc don't band (#2022). An 8 bpc render has no finer values to
+    /// dither, so its output stays byte for byte what it was.
     pub fn pixels(&self, img: &Image, comp: &Comp, channels: Channels, w: u32, h: u32) -> Vec<u8> {
+        let dither = self.project.settings.bit_depth != BitDepth::Bpc8;
+        self.pixels_with(img, comp, channels, w, h, dither)
+    }
+
+    /// [`Cx::pixels`], dithering the colour or not (a GIF palette gains nothing from dither noise).
+    pub fn pixels_with(&self, img: &Image, comp: &Comp, channels: Channels, w: u32, h: u32, dither: bool) -> Vec<u8> {
         let px = match channels {
+            Channels::Rgb if dither => img.to_rgba8_over_dithered(comp.background),
             Channels::Rgb => img.to_rgba8_over(comp.background),
-            Channels::Rgba => match self.job.output.alpha_mode {
-                AlphaMode::Straight => img.to_rgba8(),
-                AlphaMode::Premultiplied => premultiplied8(img),
+            Channels::Rgba => match (self.job.output.alpha_mode, dither) {
+                (AlphaMode::Straight, true) => img.to_rgba8_dithered(),
+                (AlphaMode::Straight, false) => img.to_rgba8(),
+                (AlphaMode::Premultiplied, _) => premultiplied8(img, dither),
             },
             Channels::Alpha => img
                 .data
@@ -327,7 +520,7 @@ impl<'a> Cx<'a> {
         for dir in &self.job.options.overflow {
             let p = std::path::Path::new(dir).join(&name).to_string_lossy().to_string();
             if q.has_room(&p, bytes) {
-                self.overflowed.lock().unwrap_or_else(|e| e.into_inner()).push(p.clone());
+                self.overflowed.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(p.clone());
                 return p;
             }
         }
@@ -351,7 +544,7 @@ impl<'a> Cx<'a> {
             Ok(r) => s.push_str(&format!("Result: Done ({} frames, {}×{}, {} bytes) in {seconds:.2} s\n", r.frames, r.width, r.height, r.bytes)),
             Err(e) => s.push_str(&format!("Result: Failed\nError: {e}\n")),
         }
-        let over = self.overflowed.lock().unwrap_or_else(|e| e.into_inner());
+        let over = self.overflowed.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         if !over.is_empty() {
             s.push_str(&format!("Storage overflow: {} file(s) written to overflow folders (first: {})\n", over.len(), over[0]));
         }
@@ -366,7 +559,7 @@ impl<'a> Cx<'a> {
             }
         }
         if let (RenderLog::PlusPerFrameInfo, Some(ft), Some(c)) = (level, &self.frame_times, comp) {
-            let mut v = ft.lock().unwrap_or_else(|e| e.into_inner()).clone();
+            let mut v = ft.lock().unwrap_or_else(std::sync::PoisonError::into_inner).clone();
             v.sort_by_key(|(i, _)| *i);
             s.push_str("\nFrames:\n");
             let f0 = self.job.settings.first_frame(c);
@@ -439,21 +632,42 @@ fn bicubic(src: &Image, w: u32, h: u32) -> Image {
     out
 }
 
-/// Premultiplied 8-bit RGBA (colour matted with black).
-fn premultiplied8(img: &Image) -> Vec<u8> {
-    img.data
-        .iter()
-        .flat_map(|p| {
-            let a = p[3].clamp(0.0, 1.0);
-            [0, 1, 2].map(|c| (p[c].clamp(0.0, a) * 255.0 + 0.5) as u8).into_iter().chain([(a * 255.0 + 0.5) as u8])
-        })
-        .collect()
+/// Premultiplied 8-bit RGBA (colour matted with black), the colour dithered when `dither`.
+fn premultiplied8(img: &Image, dither: bool) -> Vec<u8> {
+    let w = img.width.max(1) as usize;
+    let mut out = Vec::with_capacity(img.data.len() * 4);
+    for (i, p) in img.data.iter().enumerate() {
+        let a = p[3].clamp(0.0, 1.0);
+        let a8 = (a * 255.0 + 0.5) as u8;
+        let (x, y) = ((i % w) as u32, (i / w) as u32);
+        for c in 0..3 {
+            let v = p[c].clamp(0.0, a);
+            // Dither may round up past the rounded alpha; premultiplied colour never exceeds it.
+            out.push(if dither { effectcraft_raster::dither_u8(v, x, y).min(a8) } else { (v * 255.0 + 0.5) as u8 });
+        }
+        out.push(a8);
+    }
+    out
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
     use rayon::prelude::*;
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+
+    /// Dither may round a colour up while alpha rounds down; premultiplied colour stays at or
+    /// below the written alpha at every pixel.
+    #[test]
+    fn dithered_premultiplied_colour_never_exceeds_alpha() {
+        let v = 100.25 / 255.0;
+        let img = Image::filled(64, 64, [v, v, v, v]);
+        let px = premultiplied8(&img, true);
+        assert!(px.as_chunks::<4>().0.iter().all(|p| p[..3].iter().all(|c| *c <= p[3])), "a colour byte is above its alpha");
+        assert!(px.as_chunks::<4>().0.iter().all(|p| p[3] == 100));
+        let plain = premultiplied8(&img, false);
+        assert!(plain.as_chunks::<4>().0.iter().all(|p| *p == [100, 100, 100, 100]));
+    }
 
     /// Frames `0..n` through [`map_frames`] with `cap`, recording the most running at once.
     fn run_capped(n: u64, cap: Option<usize>) -> (Vec<u64>, usize) {
@@ -486,7 +700,7 @@ mod tests {
         let out = pool.install(|| {
             map_frames_while(
                 (0..24).collect(),
-                Some(1),
+                Inflight { gpu: Some(1), cpu: None },
                 || live.load(Ordering::SeqCst),
                 |k| {
                     if k == 1 {
@@ -646,6 +860,103 @@ mod tests {
         assert_eq!(Cx::new(&job).gpu_cap(), None, "no accelerator");
     }
 
+    #[test]
+    fn cpu_inflight_is_off_unless_a_positive_number() {
+        assert_eq!(cpu_inflight(None), None);
+        assert_eq!(cpu_inflight(Some("2")), Some(2));
+        assert_eq!(cpu_inflight(Some(" 4 ")), Some(4));
+        for bad in ["0", "", "  ", "-2", "three", "2.5", "99999999999999999999999"] {
+            assert_eq!(cpu_inflight(Some(bad)), None, "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn cpu_cap_holds_and_combines_with_the_gpu_cap() {
+        // #1615: CPU renders had no cap; a GPU cap alone still lapses when the GPU stops.
+        let caps = |gpu, cpu| Inflight { gpu, cpu };
+        for live in [true, false] {
+            assert_eq!(caps(None, None).renders(live), None);
+            assert_eq!(caps(None, Some(2)).renders(live), Some(2));
+        }
+        assert_eq!(caps(Some(1), None).renders(true), Some(1));
+        assert_eq!(caps(Some(1), None).renders(false), None);
+        assert_eq!(caps(Some(3), Some(2)).renders(true), Some(2));
+        assert_eq!(caps(Some(1), Some(4)).renders(true), Some(1));
+        // Review of #1615: once the GPU stops, the CPU cap applies, not the GPU's 1.
+        assert_eq!(caps(Some(1), Some(4)).renders(false), Some(4));
+        // A CPU cap of 2 on 8 threads renders at most 2 frames at once.
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(8).build().unwrap();
+        let (now, max) = (AtomicUsize::new(0), AtomicUsize::new(0));
+        let out = pool.install(|| map_frames_while((0..16).collect(), caps(None, Some(2)), || true, |k| track(&now, &max, k), |_, k| k));
+        assert_eq!(out, (0..16).collect::<Vec<_>>());
+        assert!(max.load(Ordering::SeqCst) <= 2, "{max:?} frames in flight");
+    }
+
+    /// Counts `k` in flight in `now`, records the most in `max`, and holds it for a moment.
+    fn track(now: &AtomicUsize, max: &AtomicUsize, k: u64) -> u64 {
+        let c = now.fetch_add(1, Ordering::SeqCst) + 1;
+        max.fetch_max(c, Ordering::SeqCst);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+        now.fetch_sub(1, Ordering::SeqCst);
+        k
+    }
+
+    #[test]
+    fn a_cpu_cap_bounds_the_images_waiting_to_encode() {
+        // Review of #1615: a window of one image per thread was rendered before any encoded, so
+        // a cap of 2 on 8 threads still held 8 finished images.
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(8).build().unwrap();
+        for gpu in [None, Some(1)] {
+            let (held, max) = (AtomicUsize::new(0), AtomicUsize::new(0));
+            let out = pool.install(|| {
+                map_frames_while(
+                    (0..20).collect(),
+                    Inflight { gpu, cpu: Some(2) },
+                    || true,
+                    |k| {
+                        let c = held.fetch_add(1, Ordering::SeqCst) + 1;
+                        max.fetch_max(c, Ordering::SeqCst);
+                        k
+                    },
+                    |k, img| {
+                        held.fetch_sub(1, Ordering::SeqCst);
+                        assert_eq!(k, img);
+                        k
+                    },
+                )
+            });
+            assert_eq!(out, (0..20).collect::<Vec<_>>());
+            assert!(max.load(Ordering::SeqCst) <= 2, "gpu {gpu:?}: {max:?} images held");
+        }
+    }
+
+    #[test]
+    fn the_cpu_cap_takes_over_once_the_gpu_stops() {
+        // Review of #1615: with both caps, frames after the GPU stopped rendered one at a time.
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(8).build().unwrap();
+        let (live, now, max) = (AtomicBool::new(true), AtomicUsize::new(0), AtomicUsize::new(0));
+        let out = pool.install(|| {
+            map_frames_while(
+                (0..40).collect(),
+                Inflight { gpu: Some(1), cpu: Some(4) },
+                || live.load(Ordering::SeqCst),
+                |k| {
+                    if k == 1 {
+                        live.store(false, Ordering::SeqCst);
+                    }
+                    if k < 4 {
+                        return k;
+                    }
+                    track(&now, &max, k)
+                },
+                |_, k| k,
+            )
+        });
+        assert_eq!(out, (0..40).collect::<Vec<_>>());
+        let max = max.load(Ordering::SeqCst);
+        assert!((2..=4).contains(&max), "{max} frames in flight after the GPU stopped");
+    }
+
     #[test]
     fn gpu_inflight_override_is_a_positive_number_or_the_default() {
         assert_eq!(gpu_inflight(None), GPU_INFLIGHT_DEFAULT);
@@ -706,6 +1017,45 @@ mod tests {
         assert!(stats.hits >= 9, "{stats:?}");
     }
 
+    #[test]
+    fn frames_render_beside_the_encoder() {
+        use effectcraft_project::render_queue::{OutputFormat, OutputModule, RenderSettings};
+        use effectcraft_render::NoFootage;
+        use effectcraft_time::FrameRate;
+        let mut p = Project::default();
+        let comp = Comp::new(32, 16, FrameRate::FPS_25, Tick::from_seconds_f64(1.0));
+        let cid = p.add_item("Comp", effectcraft_color::Label::Sandstone, None, effectcraft_project::ItemKind::Comp(comp.into()));
+        let (settings, output) = (RenderSettings::default(), OutputModule::for_format(OutputFormat::H264));
+        let job = Job {
+            project: &p,
+            footage: &NoFootage,
+            expr: None,
+            accel: None,
+            comp: cid,
+            settings: &settings,
+            output: &output,
+            path: "/c/out.mp4",
+            sink: None,
+            nested_switches: true,
+            options: Default::default(),
+        };
+        let cx = Cx::new(&job);
+        let comp = cx.comp().unwrap();
+        use effectcraft_render::passes::block_on;
+        let want = block_on(cx.frames(comp, (0..6).collect(), |k, img| (k, img.width, img.height)));
+        // On threads of their own, and taking turns (no threads): the same frames, in order.
+        for beside in [Beside::shared(), &Beside(None)] {
+            let (a, frames) = block_on(cx.frames_beside(beside, comp, (0..6).collect(), |k, img| (k, img.width, img.height), || 7)).unwrap();
+            assert_eq!((a, &frames), (7, &want));
+        }
+        // A panicking encoder fails the export instead of taking the render thread down.
+        let r = block_on(cx.frames_beside(Beside::shared(), comp, vec![0], |k, _| k, || -> u32 { panic!("encoder bug") }));
+        match r {
+            Err(crate::ExportError::Encode(e)) => assert!(e.contains("encoder bug"), "{e}"),
+            other => panic!("{:?}", other.map(|(a, f)| (a, f.len()))),
+        }
+    }
+
     #[test]
     fn interleave_takes_alternate_lines() {
         let a = Image::filled(3, 4, [1.0, 0.0, 0.0, 1.0]);
@@ -718,6 +1068,91 @@ mod tests {
         }
     }
 
+    /// Regress the locked-aspect example: cropping 1920x1080 must resize to 1280x1440.
+    #[test]
+    fn crop_resize_applies_margins_once() {
+        use effectcraft_project::render_queue::{Crop, OutputModule, Resize};
+        let output = OutputModule {
+            crop: Crop { enabled: true, left: 480, right: 480, ..Default::default() },
+            resize: Resize { enabled: true, width: 1280, lock_aspect: true, quality: ResizeQuality::Low, ..Default::default() },
+            ..Default::default()
+        };
+        assert_eq!(output.frame_size(1920, 1080, 1.0), (1280, 1440));
+        let img = run_crop_resize(Image::new(1920, 1080), &output, 1.0);
+        assert_eq!((img.width, img.height), (1280, 1440));
+        assert_eq!(img.data.len(), 1280 * 1440);
+    }
+
+    /// Apply output-module geometry to a synthetic frame without rendering or writing files.
+    fn run_crop_resize(img: Image, output: &effectcraft_project::render_queue::OutputModule, scale: f64) -> Image {
+        use effectcraft_project::render_queue::RenderSettings;
+        let project = Project::default();
+        let settings = RenderSettings { resolution: scale, ..Default::default() };
+        let job = Job {
+            project: &project,
+            footage: &effectcraft_render::NoFootage,
+            expr: None,
+            accel: None,
+            comp: effectcraft_project::ItemId(0),
+            settings: &settings,
+            output,
+            path: "unused.png",
+            sink: None,
+            nested_switches: true,
+            options: Default::default(),
+        };
+        Cx::new(&job).crop_resize(img)
+    }
+
+    /// Match predicted dimensions across crop, padding, ROI scale, aspect locks and resize qualities.
+    #[test]
+    fn crop_resize_dimensions_match_the_output_module() {
+        use effectcraft_project::render_queue::{Crop, OutputModule, Resize};
+        let edges = Crop { enabled: true, left: 2, right: 2, ..Default::default() };
+        let padding = Crop { enabled: true, left: -2, bottom: -2, ..Default::default() };
+        let roi = |rect| Crop { enabled: true, use_roi: true, roi: Some(rect), ..Default::default() };
+        for quality in [ResizeQuality::Low, ResizeQuality::High] {
+            let resize = |width| Resize { enabled: true, width, height: 1, lock_aspect: true, quality };
+            for (crop, resize, scale, expected) in [
+                (Crop::default(), Resize::default(), 1.0, (8, 6)),
+                (edges, Resize::default(), 1.0, (4, 6)),
+                (Crop::default(), resize(4), 1.0, (4, 3)),
+                (edges, resize(8), 1.0, (8, 12)),
+                (padding, resize(5), 1.0, (5, 4)),
+                (roi([4.0, 2.0, 8.0, 6.0]), resize(8), 0.5, (8, 6)),
+                (roi([1.0, 0.5, 2.0, 1.5]), resize(8), 2.0, (8, 6)),
+                (edges, Resize { lock_aspect: false, height: 2, ..resize(5) }, 1.0, (5, 2)),
+            ] {
+                let output = OutputModule { crop, resize, ..Default::default() };
+                assert_eq!(output.frame_size(8, 6, scale), expected);
+                let img = run_crop_resize(Image::filled(8, 6, [0.25, 0.0, 0.0, 0.5]), &output, scale);
+                assert_eq!((img.width, img.height), expected, "{crop:?}, {resize:?}, scale {scale}");
+                assert_eq!(img.data.len(), expected.0 as usize * expected.1 as usize);
+            }
+        }
+    }
+
+    /// Exercise zero/empty inputs, collapsed crops and existing caps on extreme single-axis resizes.
+    #[test]
+    fn crop_resize_zero_and_extreme_sizes_stay_bounded() {
+        use effectcraft_project::render_queue::{Crop, OutputModule, Resize};
+        for quality in [ResizeQuality::Low, ResizeQuality::High] {
+            for (size, crop, width, height, expected) in [
+                ((8, 6), Crop::default(), 0, 0, (1, 1)),
+                ((8, 1), Crop::default(), u32::MAX, 1, (30_000, 1)),
+                ((1, 8), Crop::default(), 1, u32::MAX, (1, 30_000)),
+                ((8, 6), Crop { enabled: true, left: 20_000, right: 20_000, ..Default::default() }, 2, 3, (2, 3)),
+                ((0, 0), Crop { enabled: true, left: 1, top: 1, ..Default::default() }, 2, 3, (2, 3)),
+            ] {
+                let output = OutputModule { crop, resize: Resize { enabled: true, width, height, lock_aspect: false, quality }, ..Default::default() };
+                let img = run_crop_resize(Image::new(size.0, size.1), &output, 1.0);
+                assert_eq!((img.width, img.height), expected);
+                assert_eq!(img.data.len(), expected.0 as usize * expected.1 as usize);
+                assert!(img.data.iter().all(|p| *p == [0.0; 4]));
+            }
+        }
+    }
+
     #[test]
     fn crop_and_pad() {
         let mut img = Image::new(4, 3);
diff --git a/crates/export/src/webm_av1.rs b/crates/export/src/webm_av1.rs
index ca06a3e51..a85a5c9ec 100644
--- a/crates/export/src/webm_av1.rs
+++ b/crates/export/src/webm_av1.rs
@@ -42,7 +42,8 @@ fn cluster(blocks: &mut [Block]) -> Vec<u8> {
 
 pub(crate) async fn webm_av1(job: &Cx<'_>, comp: &Comp, w: u32, h: u32, st: &mut State<'_>) -> Result<Report> {
     let rate = job.settings.rate(comp);
-    let mut venc = crate::hevc_av1::Av1::new(w, h, rate, job.output)?;
+    let codes = crate::encode::output_codes(&job.project.settings, job.output.channels);
+    let mut venc = crate::hevc_av1::Av1::new(w, h, rate, job.output, codes)?;
     let with_audio = wants_audio(job);
     let opus_channels = if job.output.audio_channels == 1 { 1usize } else { 2 };
     let mut opus = with_audio.then(|| opus_encoder(job));
diff --git a/crates/export/tests/audio_sample_positions.rs b/crates/export/tests/it/audio_sample_positions.rs
similarity index 100%
rename from crates/export/tests/audio_sample_positions.rs
rename to crates/export/tests/it/audio_sample_positions.rs
diff --git a/crates/export/tests/it/banding.rs b/crates/export/tests/it/banding.rs
new file mode 100644
index 000000000..3f99f1eb6
--- /dev/null
+++ b/crates/export/tests/it/banding.rs
@@ -0,0 +1,156 @@
+//! Gradients exported at 16 bpc (or with a 16 bpc Color Depth override) don't band (#2022): the
+//! float frame is dithered on its way to 8 bits, and the Render Settings' Color Depth reaches the
+//! render itself.
+
+use std::sync::{Arc, Mutex};
+
+use effectcraft_color::Label;
+use effectcraft_export::render_queue::*;
+use effectcraft_export::{Job, JobOptions, Sink, export};
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{BitDepth, Comp, ItemId, ItemKind, LayerSource, Project, Solid};
+use effectcraft_render::NoFootage;
+use effectcraft_time::{FrameRate, Tick};
+
+const W: u32 = 1024;
+const H: u32 = 16;
+/// The ramp runs from this grey to `HI` across the comp: about 25 eight-bit codes in 1024 px,
+/// so plain rounding makes bands about 40 px wide.
+const LO: f64 = 0.20;
+const HI: f64 = 0.30;
+/// Width of the column blocks whose mean is compared with the ideal ramp.
+const WINDOW: u32 = 8;
+
+/// A grey horizontal ramp over a comp of the given project depth.
+fn ramp_project(depth: BitDepth) -> (Project, ItemId) {
+    let mut p = Project::default();
+    p.settings.bit_depth = depth;
+    let mut comp = Comp::new(W, H, FrameRate::new(25, 1), Tick::from_seconds_f64(1.0));
+    comp.background = [0.0, 0.0, 0.0];
+    let sid = p.add_item("Ramp", Label::Red, None, ItemKind::Solid(Solid { color: [1.0, 1.0, 1.0], width: W, height: H, pixel_aspect: 1.0 }));
+    let mut layer = build::layer(&mut p, &comp, "Ramp", LayerSource::Solid { item: sid }, (W, H), None);
+    let spec = effectcraft_effects::find("ec.generate.gradientramp").expect("gradient ramp effect");
+    let mut next = p.next_id;
+    let mut group = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), spec.name, [W as f64, H as f64]);
+    p.next_id = next;
+    for (k, v) in [
+        ("start", Value::Vec2([0.0, 0.0])),
+        ("end", Value::Vec2([W as f64, 0.0])),
+        ("startColor", Value::Color([LO, LO, LO, 1.0])),
+        ("endColor", Value::Color([HI, HI, HI, 1.0])),
+    ] {
+        group.get_mut(k).expect("ramp parameter").value = v;
+    }
+    layer.props.sub_mut("effects").expect("effects group").children.push(group.into());
+    comp.layers.push(layer);
+    let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+/// Export frame 0 as PNG with the Render Settings' Color Depth `depth` and return the grey of
+/// every row.
+fn export_rows(p: &Project, cid: ItemId, depth: ColorDepth) -> Vec<Vec<u8>> {
+    let files: Arc<Mutex<Vec<(String, Vec<u8>)>>> = Default::default();
+    let f = files.clone();
+    let sink: Box<Sink> = Box::new(move |path: &str, data: Vec<u8>| f.lock().unwrap().push((path.to_string(), data)));
+    let settings =
+        RenderSettings { time_span: TimeSpan::Custom { start: Tick::ZERO, end: Tick::from_seconds_f64(0.04) }, color_depth: depth, ..Default::default() };
+    let om = OutputModule::for_format(OutputFormat::PngSequence);
+    let job = Job {
+        project: p,
+        footage: &NoFootage,
+        expr: None,
+        accel: None,
+        comp: cid,
+        settings: &settings,
+        output: &om,
+        path: "/banding/f_[#####].png",
+        sink: Some(&*sink),
+        options: JobOptions::default(),
+        nested_switches: true,
+    };
+    export(&job, &mut |_| true).expect("export");
+    let files = files.lock().unwrap();
+    let (_, png) = files.iter().find(|(path, _)| path.ends_with(".png")).expect("a PNG");
+    let img = image::load_from_memory(png).expect("png").to_rgba8();
+    (0..H).map(|y| (0..W).map(|x| img.get_pixel(x, y).0[1]).collect()).collect()
+}
+
+/// The ideal ramp at column `x`, in 8-bit codes.
+fn ideal(x: f64) -> f64 {
+    255.0 * (LO + (HI - LO) * (x + 0.5) / W as f64)
+}
+
+/// Longest run of equal neighbours in the row: a band's width.
+fn longest_run(row: &[u8]) -> usize {
+    let (mut best, mut run) = (1, 1);
+    for w in row.windows(2) {
+        run = if w[0] == w[1] { run + 1 } else { 1 };
+        best = best.max(run);
+    }
+    best
+}
+
+/// Horizontal neighbours with different values, over all rows: ~25 per row when every band is a
+/// flat step, hundreds when the steps are dithered.
+fn transitions(rows: &[Vec<u8>]) -> usize {
+    rows.iter().map(|r| r.windows(2).filter(|w| w[0] != w[1]).count()).sum()
+}
+
+/// Largest difference, in 8-bit codes, between the mean of a `WINDOW`-column block over all rows
+/// and the ideal ramp's mean over it. Plain rounding leaves up to ~0.4 codes of it beside a step
+/// edge; dither averages it away (its noise on a mean of `WINDOW * H` samples is under 0.05).
+fn worst_window_error(rows: &[Vec<u8>]) -> f64 {
+    (0..W / WINDOW)
+        .map(|i| {
+            let (x0, x1) = ((i * WINDOW) as usize, ((i + 1) * WINDOW) as usize);
+            let sum: f64 = rows.iter().flat_map(|r| &r[x0..x1]).map(|&v| v as f64).sum();
+            let mean = sum / (rows.len() * (x1 - x0)) as f64;
+            (mean - ideal((x0 + x1) as f64 / 2.0 - 1.0)).abs()
+        })
+        .fold(0.0, f64::max)
+}
+
+#[test]
+fn a_16_bpc_gradient_export_is_dithered() {
+    let (p, cid) = ramp_project(BitDepth::Bpc16);
+    let rows = export_rows(&p, cid, ColorDepth::Current);
+    let (steps, err) = (transitions(&rows), worst_window_error(&rows));
+    eprintln!("16 bpc project: {steps} transitions, worst {WINDOW}-px mean error {err:.3} codes");
+    // Undithered there are ~25 flat steps per row (400 transitions) and the block means are off
+    // by up to ~0.4 codes.
+    assert!(steps > 2000, "the steps survive: {steps} transitions");
+    assert!(err < 0.25, "the local mean is off by {err} codes");
+    // Dither never moves a value a whole code from the ideal ramp.
+    for row in &rows {
+        for (x, &v) in row.iter().enumerate() {
+            let want = ideal(x as f64);
+            assert!((v as f64 - want).abs() < 1.05, "x {x}: {v} vs {want}");
+        }
+    }
+}
+
+#[test]
+fn the_export_is_the_same_every_time() {
+    let (p, cid) = ramp_project(BitDepth::Bpc16);
+    assert_eq!(export_rows(&p, cid, ColorDepth::Current), export_rows(&p, cid, ColorDepth::Current));
+}
+
+#[test]
+fn the_render_color_depth_reaches_the_render() {
+    // An 8 bpc project renders every layer at 8 bits: flat steps, nothing for the output to dither.
+    let (p, cid) = ramp_project(BitDepth::Bpc8);
+    let banded = export_rows(&p, cid, ColorDepth::Current);
+    assert!(longest_run(&banded[0]) >= 30, "an 8 bpc render is quantised before export");
+    assert!(transitions(&banded) < 16 * 30);
+    // The Render Settings' 16 bpc depth overrides the project's: the render keeps its precision
+    // until the final conversion, which dithers.
+    let deep = export_rows(&p, cid, ColorDepth::Bpc16);
+    let (steps, err) = (transitions(&deep), worst_window_error(&deep));
+    eprintln!("8 bpc project, 16 bpc render: {steps} transitions, worst {WINDOW}-px mean error {err:.3} codes");
+    assert!(steps > 2000 && err < 0.25, "a 16 bpc render still bands: {steps} transitions, error {err}");
+    // And 8 bpc on a 16 bpc project renders at 8 bits.
+    let (p16, cid16) = ramp_project(BitDepth::Bpc16);
+    assert_eq!(export_rows(&p16, cid16, ColorDepth::Bpc8), banded);
+}
diff --git a/crates/export/tests/it/exr_scene_linear.rs b/crates/export/tests/it/exr_scene_linear.rs
new file mode 100644
index 000000000..081a956a6
--- /dev/null
+++ b/crates/export/tests/it/exr_scene_linear.rs
@@ -0,0 +1,480 @@
+//! OpenEXR output holds the comp's values in linear light without Project Settings ▸ HDR
+//! (compand / tone map), and decodes with the output space's own curve; 8-bit writers keep the
+//! HDR step and their exact bytes.
+
+use std::path::{Path, PathBuf};
+
+use effectcraft_color::{ColorSpace, Conversion, Label};
+use effectcraft_export::render_queue::{Channels, OutputFormat, OutputModule, RenderSettings, TimeSpan};
+use effectcraft_export::{Job, export};
+use effectcraft_project::{BitDepth, Comp, HdrMode, ItemId, ItemKind, LayerSource, Project, Solid, build};
+use effectcraft_render::NoFootage;
+use effectcraft_time::{FrameRate, Tick};
+
+const W: u32 = 48;
+const H: u32 = 16;
+/// Three nested bands, outermost first: in range, inside the compand knee, over range.
+const BANDS: [[f32; 3]; 3] = [[0.2, 0.5, 0.9], [0.85, 0.9, 0.95], [4.0, 2.0, 0.5]];
+
+fn out_dir(name: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("effectcraft-exr-scene-{}-{name}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).expect("mkdir");
+    d
+}
+
+/// A one-frame comp of [`BANDS`] (full width, 2/3, 1/3, centred) with the given colour settings.
+fn project(depth: BitDepth, hdr: HdrMode, ws: Option<ColorSpace>, linearize: bool, out: Option<ColorSpace>) -> (Project, ItemId) {
+    let mut p = Project::default();
+    p.settings.bit_depth = depth;
+    p.settings.hdr = hdr;
+    p.settings.working_space = ws;
+    p.settings.linearize = linearize;
+    p.settings.output_space = out;
+    let mut comp = Comp::new(W, H, FrameRate::new(10, 1), Tick::from_seconds_f64(0.1));
+    comp.background = [0.0, 0.0, 0.0];
+    for (i, color) in BANDS.into_iter().enumerate() {
+        let w = W - W / 3 * i as u32;
+        let sid = p.add_item(&format!("Band {i}"), Label::Red, None, ItemKind::Solid(Solid { color, width: w, height: H, pixel_aspect: 1.0 }));
+        let l = build::layer(&mut p, &comp, &format!("Band {i}"), LayerSource::Solid { item: sid }, (w, H), None);
+        comp.layers.insert(0, l);
+    }
+    let cid = p.add_item("Comp 1", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+/// A comp builder: bit depth, HDR mode, working space, Linearize Working Space, output space.
+type Build = fn(BitDepth, HdrMode, Option<ColorSpace>, bool, Option<ColorSpace>) -> (Project, ItemId);
+
+/// The half-opacity layer of [`half_project`]: over range in red.
+const HALF: [f32; 3] = [4.0, 0.6, 0.3];
+
+/// A one-frame comp over a coloured background whose only layer, [`HALF`] at 50% opacity,
+/// covers the left two thirds: semi-transparent and transparent pixels (the premultiplied and
+/// RGB-over-background paths of the writers).
+fn half_project(depth: BitDepth, hdr: HdrMode, ws: Option<ColorSpace>, linearize: bool, out: Option<ColorSpace>) -> (Project, ItemId) {
+    let mut p = Project::default();
+    p.settings.bit_depth = depth;
+    p.settings.hdr = hdr;
+    p.settings.working_space = ws;
+    p.settings.linearize = linearize;
+    p.settings.output_space = out;
+    let mut comp = Comp::new(W, H, FrameRate::new(10, 1), Tick::from_seconds_f64(0.1));
+    comp.background = [0.2, 0.3, 0.4];
+    let w = W / 3 * 2;
+    let sid = p.add_item("Half", Label::Red, None, ItemKind::Solid(Solid { color: HALF, width: w, height: H, pixel_aspect: 1.0 }));
+    let mut l = build::layer(&mut p, &comp, "Half", LayerSource::Solid { item: sid }, (w, H), None);
+    l.props.prop_mut("transform/position").expect("position").value = effectcraft_keyframe::Value::Vec3([w as f64 / 2.0, H as f64 / 2.0, 0.0]);
+    l.props.prop_mut("transform/opacity").expect("opacity").value = effectcraft_keyframe::Value::Scalar(50.0);
+    comp.layers.push(l);
+    let cid = p.add_item("Comp 1", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+/// Export the comp's one frame as a `fmt` sequence; the frame file's path.
+fn render(p: &Project, cid: ItemId, fmt: OutputFormat, channels: Channels, dir: &Path, ext: &str) -> PathBuf {
+    let mut om = OutputModule::for_format(fmt);
+    om.channels = channels;
+    let s = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let path = dir.join(format!("f_[#####].{ext}")).to_string_lossy().to_string();
+    let job = Job {
+        project: p,
+        footage: &NoFootage,
+        expr: None,
+        accel: None,
+        comp: cid,
+        settings: &s,
+        output: &om,
+        path: &path,
+        sink: None,
+        options: Default::default(),
+        nested_switches: true,
+    };
+    export(&job, &mut |_| true).expect("export");
+    dir.join(format!("f_00000.{ext}"))
+}
+
+fn fnv(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf2_9ce4_8422_2325u64, |h, b| (h ^ *b as u64).wrapping_mul(0x0100_0000_01b3))
+}
+
+const DEPTHS: [BitDepth; 3] = [BitDepth::Bpc8, BitDepth::Bpc16, BitDepth::Bpc32];
+const MODES: [HdrMode; 3] = [HdrMode::Clip, HdrMode::Compand, HdrMode::ToneMap];
+const STILLS: [(OutputFormat, Channels, &str); 3] = [
+    (OutputFormat::PngSequence, Channels::Rgba, "png"),
+    (OutputFormat::TiffSequence, Channels::Rgb, "tif"),
+    (OutputFormat::TargaSequence, Channels::Rgba, "tga"),
+];
+
+/// The bytes of every 8-bit still for each bit depth × HDR mode, in a managed linear sRGB
+/// project with a Display P3 output.
+fn still_hashes(build: Build) -> Vec<u64> {
+    let mut out = vec![];
+    for depth in DEPTHS {
+        for mode in MODES {
+            let (p, cid) = build(depth, mode, Some(ColorSpace::Srgb), true, Some(ColorSpace::DisplayP3));
+            for (fmt, ch, ext) in STILLS {
+                let d = out_dir(&format!("golden-{depth:?}-{mode:?}-{ext}"));
+                let bytes = std::fs::read(render(&p, cid, fmt, ch, &d, ext)).expect("read");
+                out.push(fnv(&bytes));
+                let _ = std::fs::remove_dir_all(&d);
+            }
+        }
+    }
+    out
+}
+
+/// [`still_hashes`] before float outputs skipped the HDR step: PNG, TIFF and Targa (8-bit
+/// writers, which keep compand / tone mapping) are byte for byte the same.
+const STILL_GOLDEN: [u64; 27] = [
+    0xd0cf67f45d6b6b68,
+    0x712d42f3e204cbdb,
+    0x021dc457f259eb87,
+    0x88a16b1ca2db8805,
+    0xc6fb221b89179bdb,
+    0x965636561aaabb87,
+    0x85c831b7694662db,
+    0x8875a5c5232a33db,
+    0x42d8f3c110bd0987,
+    0xd555a6850fe66f04,
+    0x920b49ee0f9900e4,
+    0x94e4f43742f2c8ce,
+    0xab0792254da43348,
+    0x647a60c0a33237ec,
+    0x65cba80bc3ecff08,
+    0x0726be1b60eb7276,
+    0xffd0315633cb88db,
+    0x4f6a13131fb7a175,
+    0x07a706a7e100b51d,
+    0x718600eaa65a6f80,
+    0x53489230b732f638,
+    0x13024d498aa2552c,
+    0x3a3dae30c9e25f83,
+    0xc3191a3e860aa0c5,
+    0xe5d7d08ecc3ddece,
+    0x29a748f729fe5c8a,
+    0x78d3b9aa9e107774,
+];
+
+#[test]
+fn eight_bit_stills_are_unchanged() {
+    assert_eq!(still_hashes(project), STILL_GOLDEN);
+    assert_eq!(still_hashes(half_project), HALF_STILL_GOLDEN);
+}
+
+/// [`still_hashes`] of [`half_project`] before: premultiplied and RGB-over-background stills.
+const HALF_STILL_GOLDEN: [u64; 27] = [
+    0x3abd611ee63b7edd,
+    0x51e7ec0426773cdb,
+    0xbee34abe9f0a3d87,
+    0x554c03dba915d290,
+    0xe98490fc826a7adb,
+    0x0a0e77927bf1a187,
+    0x4f1c076634822d50,
+    0xe790f474e05b3adb,
+    0xe517c3136471a187,
+    0x07cd5e73765539f9,
+    0x68e51bbd8d442a64,
+    0x844a5f23a9cc9a3d,
+    0xc302b2b86f4cdd70,
+    0xb7247795d204a2c5,
+    0x3b18867537c69265,
+    0x9a5f7679bb5a2399,
+    0x868b729dcc804656,
+    0x2e0bc64a3fb562f0,
+    0x6dc9e1a1eac1220d,
+    0x6e101cd849e78f32,
+    0x7b7a2a776f73d70b,
+    0x6b3244f808c65d4e,
+    0xbfa1b35fada2c77d,
+    0x8c3a31415ed47e33,
+    0xac787507caf1c896,
+    0x4a38297060de19ff,
+    0x300d6e4222eaa5b5,
+];
+
+/// The decoded samples of a still EXR frame, row-major RGBA.
+fn exr_samples(path: &Path) -> Vec<f32> {
+    image::open(path).expect("exr").to_rgba32f().into_raw()
+}
+
+fn bits_hash(v: &[f32]) -> u64 {
+    fnv(&v.iter().flat_map(|x| x.to_bits().to_le_bytes()).collect::<Vec<u8>>())
+}
+
+/// [`bits_hash`] of the samples rounded to 15 mantissa bits. 32 bpc samples go through `powf`, and
+/// the last bits of its result differ between platforms' math libraries (macOS on Apple silicon).
+fn near_hash(v: &[f32]) -> u64 {
+    bits_hash(&v.iter().map(|x| f32::from_bits(x.to_bits().wrapping_add(0x80) & !0xff)).collect::<Vec<f32>>())
+}
+
+/// Clip-mode EXR samples with an sRGB output, for each colour setup × bit depth × channels.
+fn exr_clip_hashes(build: Build, channels: &[Channels]) -> Vec<u64> {
+    let mut out = vec![];
+    for (ws, linearize) in [(None, false), (Some(ColorSpace::Srgb), false), (Some(ColorSpace::Srgb), true), (Some(ColorSpace::AcesCg), true)] {
+        for depth in DEPTHS {
+            let (p, cid) = build(depth, HdrMode::Clip, ws, linearize, None);
+            for &ch in channels {
+                let d = out_dir(&format!("clip-{ws:?}-{linearize}-{depth:?}-{ch:?}"));
+                out.push(near_hash(&exr_samples(&render(&p, cid, OutputFormat::ExrSequence, ch, &d, "exr"))));
+                let _ = std::fs::remove_dir_all(&d);
+            }
+        }
+    }
+    out
+}
+
+/// [`exr_clip_hashes`] before: Clip-mode EXRs with an sRGB output keep every sample.
+const EXR_CLIP_GOLDEN: [u64; 36] = [
+    0x008b8f887b9f6d25,
+    0x008b8f887b9f6d25,
+    0x7d40ad9df8600325,
+    0x5d55eb1dddaa5f25,
+    0x5d55eb1dddaa5f25,
+    0x7d40ad9df8600325,
+    0x41734aa4aa58c525,
+    0x41734aa4aa58c525,
+    0x7d40ad9df8600325,
+    0x008b8f887b9f6d25,
+    0x008b8f887b9f6d25,
+    0x7d40ad9df8600325,
+    0x5d55eb1dddaa5f25,
+    0x5d55eb1dddaa5f25,
+    0x7d40ad9df8600325,
+    0x41734aa4aa58c525,
+    0x41734aa4aa58c525,
+    0x7d40ad9df8600325,
+    0x6f6623e2a3f91d25,
+    0x6f6623e2a3f91d25,
+    0x7d40ad9df8600325,
+    0x5d55eb1dddaa5f25,
+    0x5d55eb1dddaa5f25,
+    0x7d40ad9df8600325,
+    0x41734aa4aa58c525,
+    0x41734aa4aa58c525,
+    0x7d40ad9df8600325,
+    0x283ae54f8c799325,
+    0x283ae54f8c799325,
+    0x7d40ad9df8600325,
+    0xa33e57ad0ed75f25,
+    0xa33e57ad0ed75f25,
+    0x7d40ad9df8600325,
+    0xb394d882f55d9d25,
+    0xb394d882f55d9d25,
+    0x7d40ad9df8600325,
+];
+
+#[test]
+fn exr_clip_with_srgb_output_is_unchanged() {
+    // The bands are opaque everywhere, so the Alpha-only files (alpha 1.0) are unchanged too.
+    assert_eq!(exr_clip_hashes(project, &[Channels::Rgba, Channels::Rgb, Channels::Alpha]), EXR_CLIP_GOLDEN);
+    assert_eq!(exr_clip_hashes(half_project, &[Channels::Rgba, Channels::Rgb]), HALF_EXR_CLIP_GOLDEN);
+}
+
+/// [`exr_clip_hashes`] of [`half_project`] before (RGBA premultiplied, RGB over the background).
+const HALF_EXR_CLIP_GOLDEN: [u64; 24] = [
+    0xff7aaead9ab01325,
+    0x3acad0d73898c925,
+    0x43f9a05a72195325,
+    0x3ecc7469546f8125,
+    0x53f3d9bb0c539325,
+    0xc39f1146174d9525,
+    0xff7aaead9ab01325,
+    0x3acad0d73898c925,
+    0x43f9a05a72195325,
+    0x3ecc7469546f8125,
+    0x53f3d9bb0c539325,
+    0xc39f1146174d9525,
+    0x2f1672447511f325,
+    0x24cd9261bb6a2125,
+    0x7860797209347f25,
+    0xfb0c8f2dcb2e5125,
+    0x53f3d9bb0c539325,
+    0xc39f1146174d9525,
+    0xad649b2be4ec3f25,
+    0x604f764e18b99925,
+    0x65d354406ce81b25,
+    0x4d30fabdbcdbe125,
+    0xf125e2282bdd9725,
+    0x00276de880e5e125,
+];
+
+/// An Alpha-only EXR holds the alpha (coverage) as it is in every output space: no transfer
+/// curve is decoded from it (it used to be sRGB-decoded, 0.5 → 0.214).
+#[test]
+fn exr_alpha_only_is_raw_alpha() {
+    for out in [None, Some(ColorSpace::Rec709), Some(ColorSpace::Rec2100Pq), Some(ColorSpace::AcesCg)] {
+        for ws in [None, Some(ColorSpace::Srgb)] {
+            let (p, cid) = half_project(BitDepth::Bpc32, HdrMode::Clip, ws, false, out);
+            let d = out_dir(&format!("alpha-{ws:?}-{out:?}"));
+            let v = exr_samples(&render(&p, cid, OutputFormat::ExrSequence, Channels::Alpha, &d, "exr"));
+            let _ = std::fs::remove_dir_all(&d);
+            let at = |x: u32| &v[((H / 2 * W + x) * 4) as usize..][..4];
+            assert_eq!(at(2), [0.5, 0.5, 0.5, 1.0], "{ws:?} {out:?} covered");
+            assert_eq!(at(W - 2), [0.0, 0.0, 0.0, 1.0], "{ws:?} {out:?} transparent");
+        }
+    }
+}
+
+/// Compand and tone mapping leave EXR output alone: the file holds the Clip mode's samples, for
+/// every bit depth, channel set and colour setup (wide working spaces, a Display P3 output).
+#[test]
+fn exr_ignores_compand_and_tone_mapping() {
+    let setups = [
+        (Some(ColorSpace::Srgb), true, None),
+        (Some(ColorSpace::Srgb), false, Some(ColorSpace::DisplayP3)),
+        (Some(ColorSpace::AcesCg), true, None),
+        (Some(ColorSpace::Rec2020), true, Some(ColorSpace::Rec709)),
+    ];
+    for (ws, linearize, out) in setups {
+        for depth in DEPTHS {
+            for (ch, (name, build)) in
+                [Channels::Rgba, Channels::Rgb].into_iter().flat_map(|c| [(c, ("bands", project as Build)), (c, ("half", half_project as Build))])
+            {
+                let samples = |mode: HdrMode| {
+                    let (p, cid) = build(depth, mode, ws, linearize, out);
+                    let d = out_dir(&format!("modes-{name}-{ws:?}-{linearize}-{out:?}-{depth:?}-{ch:?}-{mode:?}"));
+                    let v = exr_samples(&render(&p, cid, OutputFormat::ExrSequence, ch, &d, "exr"));
+                    let _ = std::fs::remove_dir_all(&d);
+                    v
+                };
+                let clip = samples(HdrMode::Clip);
+                for mode in [HdrMode::Compand, HdrMode::ToneMap] {
+                    assert!(samples(mode) == clip, "{name} {ws:?} {linearize} {out:?} {depth:?} {ch:?} {mode:?}");
+                }
+            }
+        }
+    }
+}
+
+/// The centre pixel (the innermost band) of a one-frame EXR render.
+fn exr_centre(p: &Project, cid: ItemId, name: &str) -> [f32; 4] {
+    let d = out_dir(name);
+    let v = exr_samples(&render(p, cid, OutputFormat::ExrSequence, Channels::Rgba, &d, "exr"));
+    let _ = std::fs::remove_dir_all(&d);
+    let o = ((H / 2 * W + W / 2) * 4) as usize;
+    [v[o], v[o + 1], v[o + 2], v[o + 3]]
+}
+
+fn assert_near(got: [f32; 4], want: [f32; 3], what: &str) {
+    for i in 0..3 {
+        assert!((got[i] - want[i]).abs() <= 1e-4 * want[i].abs().max(1.0), "{what}: channel {i}: got {got:?}, want {want:?}");
+    }
+    assert_eq!(got[3], 1.0, "{what}: {got:?}");
+}
+
+/// In a 32 bpc linear project with compand or tone mapping, the EXR holds the comp's scene-linear
+/// values in the output space's primaries: 4.0 stays 4.0. (Solid colours are authored in the
+/// working space's encoding; ACES spaces are linear.)
+#[test]
+fn exr_holds_scene_linear_values_in_output_primaries() {
+    let [_, _, band] = BANDS;
+    for mode in [HdrMode::Compand, HdrMode::ToneMap] {
+        let cases = [
+            // ACEScg in and out: nothing converts.
+            (ColorSpace::AcesCg, ColorSpace::AcesCg, band),
+            // ACEScg working space, Display P3 output: the primaries convert, the values stay linear.
+            (ColorSpace::AcesCg, ColorSpace::DisplayP3, Conversion::new(ColorSpace::AcesCg, true, ColorSpace::DisplayP3, true).expect("matrix").apply(band)),
+            // Linearized Rec. 2020 working space, sRGB output.
+            (ColorSpace::Rec2020, ColorSpace::Srgb, Conversion::new(ColorSpace::Rec2020, false, ColorSpace::Srgb, true).expect("matrix").apply(band)),
+            // Linearized sRGB in and out.
+            (ColorSpace::Srgb, ColorSpace::Srgb, band.map(effectcraft_color::srgb_to_linear)),
+        ];
+        for (ws, out, want) in cases {
+            let (p, cid) = project(BitDepth::Bpc32, mode, Some(ws), true, Some(out));
+            let what = format!("{mode:?} {ws:?} to {out:?}");
+            assert_near(exr_centre(&p, cid, &format!("lin-{ws:?}-{out:?}-{mode:?}")), want.map(|v| v.max(0.0)), &what);
+        }
+    }
+    let (p, cid) = project(BitDepth::Bpc32, HdrMode::ToneMap, Some(ColorSpace::AcesCg), true, Some(ColorSpace::AcesCg));
+    assert_eq!(exr_centre(&p, cid, "lin-exact")[..3], band, "4.0 is exactly 4.0");
+}
+
+/// Rec. 2100 PQ and HLG outputs (no HDR step there in any mode) are decoded with their own
+/// curves: linear light in Rec. 2020 primaries, 1.0 = reference white (203 cd/m²).
+#[test]
+fn exr_decodes_pq_and_hlg_outputs() {
+    let [_, _, band] = BANDS;
+    let want = Conversion::new(ColorSpace::AcesCg, true, ColorSpace::Rec2020, true).expect("matrix").apply(band).map(|v| v.max(0.0));
+    for out in [ColorSpace::Rec2100Pq, ColorSpace::Rec2100Hlg] {
+        for mode in MODES {
+            let (p, cid) = project(BitDepth::Bpc32, mode, Some(ColorSpace::AcesCg), true, Some(out));
+            let got = exr_centre(&p, cid, &format!("hdr-out-{out:?}-{mode:?}"));
+            for i in 0..3 {
+                assert!((got[i] - want[i]).abs() <= 1e-3 * want[i].max(1.0), "{out:?} {mode:?} channel {i}: got {got:?}, want {want:?}");
+            }
+        }
+    }
+}
+
+/// The EXR is decoded with the output space's curve, not always sRGB's: a Rec. 709 output (pure
+/// 2.4 power curve) and an unmanaged project at Working Gamma 2.4 give back the linear values.
+#[test]
+fn exr_decodes_with_the_output_curve() {
+    let [_, _, band] = BANDS;
+    // A linearized sRGB working space (same primaries as Rec. 709): the authored colour, decoded.
+    let (p, cid) = project(BitDepth::Bpc32, HdrMode::Clip, Some(ColorSpace::Srgb), true, Some(ColorSpace::Rec709));
+    assert_near(exr_centre(&p, cid, "curve-709"), band.map(effectcraft_color::srgb_to_linear), "Rec. 709 output");
+    // Unmanaged at 2.4: the solid's colour is encoded with the 2.4 power curve.
+    let (mut p, cid) = project(BitDepth::Bpc32, HdrMode::Clip, None, false, None);
+    p.settings.working_gamma = 2.4;
+    assert_near(exr_centre(&p, cid, "curve-gamma24"), band.map(|v| v.powf(2.4)), "Working Gamma 2.4");
+    // Working Gamma 2.2 keeps the sRGB curve.
+    let (p, cid) = project(BitDepth::Bpc32, HdrMode::Clip, None, false, None);
+    assert_near(exr_centre(&p, cid, "curve-gamma22"), band.map(effectcraft_color::srgb_to_linear), "Working Gamma 2.2");
+}
+
+/// The `chromaticities` attribute of an EXR file: red, green, blue, white (CIE xy), or `None`.
+fn chromaticities(path: &Path) -> Option<[[f32; 2]; 4]> {
+    let bytes = std::fs::read(path).expect("read");
+    let meta = exr::meta::MetaData::read_from_buffered(std::io::Cursor::new(bytes), false).expect("exr header");
+    meta.headers[0].shared_attributes.chromaticities.map(|c| [c.red, c.green, c.blue, c.white].map(|v| [v.0, v.1]))
+}
+
+/// The primaries (red, green, blue, white) the standards publish for each output space, typed in
+/// here rather than read from the colour crate: Rec. 709 / sRGB, Rec. 2020 (also Rec. 2100 PQ and
+/// HLG), Display P3 (D65), ACEScg (AP1) and ACES2065-1 (AP0) with the ACES white.
+const D65: [f32; 2] = [0.3127, 0.3290];
+const ACES_WHITE: [f32; 2] = [0.32168, 0.33767];
+const REC709: [[f32; 2]; 4] = [[0.64, 0.33], [0.30, 0.60], [0.15, 0.06], D65];
+const REC2020: [[f32; 2]; 4] = [[0.708, 0.292], [0.170, 0.797], [0.131, 0.046], D65];
+const P3: [[f32; 2]; 4] = [[0.680, 0.320], [0.265, 0.690], [0.150, 0.060], D65];
+const AP1: [[f32; 2]; 4] = [[0.713, 0.293], [0.165, 0.830], [0.128, 0.044], ACES_WHITE];
+const AP0: [[f32; 2]; 4] = [[0.7347, 0.2653], [0.0, 1.0], [0.0001, -0.0770], ACES_WHITE];
+
+/// A sequence frame names the output space's primaries and white, for every space a project knows.
+#[test]
+fn exr_writes_the_output_spaces_chromaticities() {
+    let table = [
+        (ColorSpace::Srgb, REC709),
+        (ColorSpace::Rec709, REC709),
+        (ColorSpace::Rec2020, REC2020),
+        (ColorSpace::DisplayP3, P3),
+        (ColorSpace::AcesCg, AP1),
+        (ColorSpace::Aces2065, AP0),
+        (ColorSpace::Rec2100Pq, REC2020),
+        (ColorSpace::Rec2100Hlg, REC2020),
+    ];
+    assert!(ColorSpace::ALL.iter().all(|c| table.iter().filter(|(t, _)| t == c).count() == 1), "every space once");
+    for (out, want) in table {
+        for ch in [Channels::Rgba, Channels::Rgb] {
+            let (p, cid) = project(BitDepth::Bpc32, HdrMode::Clip, Some(ColorSpace::Srgb), true, Some(out));
+            let d = out_dir(&format!("chroma-{out:?}-{ch:?}"));
+            let f = render(&p, cid, OutputFormat::ExrSequence, ch, &d, "exr");
+            assert_eq!(chromaticities(&f), Some(want), "{out:?} {ch:?}");
+        }
+    }
+}
+
+/// The default project (no output space chosen, managed or not) writes the standard Rec. 709 /
+/// sRGB chromaticities; an unmanaged project ignores the output space (its frame is decoded with
+/// the Working Gamma's curve, Rec. 709 primaries).
+#[test]
+fn exr_default_is_rec709_chromaticities() {
+    for (name, ws, out) in [("default", None, None), ("managed", Some(ColorSpace::Srgb), None), ("unmanaged-p3", None, Some(ColorSpace::DisplayP3))] {
+        let (p, cid) = project(BitDepth::Bpc32, HdrMode::Clip, ws, false, out);
+        let d = out_dir(&format!("chroma-{name}"));
+        let f = render(&p, cid, OutputFormat::ExrSequence, Channels::Rgba, &d, "exr");
+        assert_eq!(chromaticities(&f), Some(REC709), "{name}");
+    }
+}
diff --git a/crates/export/tests/it/h264_gpu_yuv.rs b/crates/export/tests/it/h264_gpu_yuv.rs
new file mode 100644
index 000000000..02963ef46
--- /dev/null
+++ b/crates/export/tests/it/h264_gpu_yuv.rs
@@ -0,0 +1,210 @@
+//! H.264 export with an accelerator that converts frames to 4:2:0 itself
+//! (`Accelerator::comp_frame_yuv420`): the file is the same as the CPU conversion's, and frames
+//! the accelerator can't take (odd sizes, crop) fall back to the RGBA path.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use effectcraft_color::Label;
+use effectcraft_export::render_queue::{ColorDepth, OutputFormat, OutputModule, RenderSettings, TimeSpan};
+use effectcraft_export::{Job, export};
+use effectcraft_project::{Comp, ItemId, ItemKind, LayerSource, Project, Solid, build};
+use effectcraft_raster::Image;
+use effectcraft_render::{Accelerator, NoFootage, Renderer};
+use effectcraft_time::{FrameRate, Tick};
+
+/// Renders on the CPU; converts to 4:2:0 with the export's own function when `yuv` is set.
+/// `deferred`: claims deferred readbacks (a browser worker's GPU), whose frames render in passes.
+/// `stop_after`: the device stops for good after that many planes (`available` turns false).
+struct Fake {
+    yuv: bool,
+    yuv_frames: AtomicUsize,
+    deferred: bool,
+    stop_after: usize,
+    /// Frames asking for planes right now, and the most at once after the stop.
+    asking: AtomicUsize,
+    most_after_stop: AtomicUsize,
+    /// `Accelerator::frame_end` calls: one per rendered comp frame, planes or not.
+    frame_ends: AtomicUsize,
+}
+
+impl Fake {
+    fn new(yuv: bool, deferred: bool, stop_after: usize) -> Self {
+        Fake {
+            yuv,
+            yuv_frames: AtomicUsize::new(0),
+            deferred,
+            stop_after,
+            asking: AtomicUsize::new(0),
+            most_after_stop: AtomicUsize::new(0),
+            frame_ends: AtomicUsize::new(0),
+        }
+    }
+}
+
+impl Accelerator for Fake {
+    fn name(&self) -> String {
+        "fake".into()
+    }
+    fn comp_frame(&self, r: &Renderer, comp: ItemId, t: Tick) -> Option<Image> {
+        Some(r.comp_frame_cpu(comp, t))
+    }
+    fn comp_frame_yuv420(&self, r: &Renderer, comp: ItemId, t: Tick, bg: [f32; 3]) -> Option<Vec<u8>> {
+        if !self.yuv {
+            return None;
+        }
+        if self.yuv_frames.fetch_add(1, Ordering::SeqCst) >= self.stop_after {
+            self.yuv_frames.fetch_sub(1, Ordering::SeqCst);
+            // Stopped: every frame still asks first, so asks that overlap are frames rendering at once.
+            let now = self.asking.fetch_add(1, Ordering::SeqCst) + 1;
+            self.most_after_stop.fetch_max(now, Ordering::SeqCst);
+            std::thread::sleep(std::time::Duration::from_millis(30));
+            self.asking.fetch_sub(1, Ordering::SeqCst);
+            return None;
+        }
+        Some(effectcraft_raster::yuv::yuv420_over(&r.comp_frame_cpu(comp, t), bg))
+    }
+    fn frame_end(&self) {
+        self.frame_ends.fetch_add(1, Ordering::SeqCst);
+    }
+    fn available(&self) -> bool {
+        self.yuv_frames.load(Ordering::SeqCst) < self.stop_after
+    }
+    fn miss_gate(&self) -> Option<std::sync::Arc<std::sync::atomic::AtomicBool>> {
+        self.deferred.then(Default::default)
+    }
+    fn supports_effect(&self, _id: &str) -> bool {
+        false
+    }
+    fn effects(&self, _chain: &[effectcraft_render::FxStep], _buf: &effectcraft_effects::Buf, _levels: Option<f32>) -> Option<effectcraft_effects::Buf> {
+        None
+    }
+}
+
+fn out_dir(name: &str) -> PathBuf {
+    let d = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/export").join(name);
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).expect("mkdir");
+    d
+}
+
+fn project() -> (Project, ItemId) {
+    let mut p = Project::default();
+    p.settings.gpu_acceleration = true;
+    let mut comp = Comp::new(64, 48, FrameRate::new(10, 1), Tick::from_seconds_f64(0.6));
+    comp.background = [0.1, 0.1, 0.4];
+    let sid = p.add_item("Red", Label::Red, None, ItemKind::Solid(Solid { color: [1.0, 0.2, 0.0], width: 30, height: 20, pixel_aspect: 1.0 }));
+    let mut l = build::layer(&mut p, &comp, "Red", LayerSource::Solid { item: sid }, (30, 20), None);
+    l.in_point = comp.frame_rate.tick_of(2);
+    comp.layers.push(l);
+    let cid = p.add_item("Comp 1", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+fn run(p: &Project, cid: ItemId, accel: Option<&dyn Accelerator>, s: &RenderSettings, path: &Path) -> Vec<u8> {
+    let om = OutputModule { bitrate_kbps: 4000, ..OutputModule::for_format(OutputFormat::H264) };
+    let path = path.to_string_lossy().to_string();
+    let job = Job {
+        project: p,
+        footage: &NoFootage,
+        expr: None,
+        accel,
+        comp: cid,
+        settings: s,
+        output: &om,
+        path: &path,
+        sink: None,
+        options: Default::default(),
+        nested_switches: true,
+    };
+    export(&job, &mut |_| true).expect("export");
+    std::fs::read(&path).expect("read")
+}
+
+#[test]
+fn accelerator_planes_encode_like_the_cpu_conversion() {
+    let d = out_dir("h264-gpu-yuv");
+    let (mut p, cid) = project();
+    // Across more than one 16-frame batch so the second batch renders beside the encoder.
+    p.comp_mut(cid).unwrap().duration = Tick::from_seconds_f64(2.0);
+    let s = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let yuv = Fake::new(true, false, usize::MAX);
+    let rgba = Fake::new(false, false, usize::MAX);
+    let yuv_mp4 = d.join("yuv.mp4");
+    let a = run(&p, cid, Some(&yuv), &s, &yuv_mp4);
+    let b = run(&p, cid, Some(&rgba), &s, &d.join("rgba.mp4"));
+    let c = run(&p, cid, None, &s, &d.join("cpu.mp4"));
+    assert_eq!(yuv.yuv_frames.load(Ordering::SeqCst), 20, "every frame came from the accelerator");
+    assert_eq!(yuv.frame_ends.load(Ordering::SeqCst), 20, "every planes frame ends once");
+    assert_eq!(rgba.frame_ends.load(Ordering::SeqCst), 20, "every RGBA frame ends once");
+    assert!(a == b && b == c, "the three files differ");
+    let f = effectcraft_media::probe(&yuv_mp4).expect("probe yuv.mp4");
+    assert_eq!((f.width, f.height), (64, 48));
+    assert_eq!(f.frame_rate.frame_at(f.duration - Tick(1)) + 1, 20);
+    let pool = effectcraft_media::MediaPool::new();
+    for k in 0..20 {
+        let img = pool.frame_at(&f, f.frame_rate.tick_of(k)).expect("decode frame");
+        assert_eq!((img.width, img.height), (64, 48));
+    }
+}
+
+#[test]
+fn frames_the_accelerator_cannot_take_fall_back_to_rgba() {
+    let d = out_dir("h264-gpu-yuv-fallback");
+    let (p, cid) = project();
+    let base = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    // Renders at 62×47, encodes at 62×46 (the codec size): planes of the render would not fit.
+    let odd = RenderSettings { resolution: 31.0 / 32.0, ..base.clone() };
+    let yuv = Fake::new(true, false, usize::MAX);
+    let a = run(&p, cid, Some(&yuv), &odd, &d.join("yuv.mp4"));
+    let c = run(&p, cid, None, &odd, &d.join("cpu.mp4"));
+    assert_eq!(yuv.yuv_frames.load(Ordering::SeqCst), 0);
+    assert_eq!(yuv.frame_ends.load(Ordering::SeqCst), 6, "every fallback frame ends once");
+    assert!(a == c);
+}
+
+/// Above 8 bpc the colour is dithered on its way to 8 bits, which the accelerator's planes
+/// don't do: those frames take the RGBA path, so an H.264 export doesn't band (#2022).
+#[test]
+fn renders_above_8_bpc_skip_the_planes() {
+    let d = out_dir("h264-gpu-yuv-16bpc");
+    let (p, cid) = project();
+    let s = RenderSettings { time_span: TimeSpan::LengthOfComp, color_depth: ColorDepth::Bpc16, ..Default::default() };
+    let yuv = Fake::new(true, false, usize::MAX);
+    let a = run(&p, cid, Some(&yuv), &s, &d.join("yuv.mp4"));
+    let c = run(&p, cid, None, &s, &d.join("cpu.mp4"));
+    assert_eq!(yuv.yuv_frames.load(Ordering::SeqCst), 0, "no planes asked for above 8 bpc");
+    assert!(a == c);
+}
+
+/// With deferred readbacks the export keeps rendering frames in passes (`Cx::frames`), never
+/// through the blocking per-frame path the planes use.
+#[test]
+fn deferred_accelerators_keep_the_pass_based_path() {
+    let d = out_dir("h264-gpu-yuv-deferred");
+    let (p, cid) = project();
+    let s = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let deferred = Fake::new(true, true, usize::MAX);
+    let a = run(&p, cid, Some(&deferred), &s, &d.join("deferred.mp4"));
+    let c = run(&p, cid, None, &s, &d.join("cpu.mp4"));
+    assert_eq!(deferred.yuv_frames.load(Ordering::SeqCst), 0, "no planes asked for");
+    assert!(a == c);
+}
+
+/// An accelerator that stops for good mid-export (`available` false): the frames left render
+/// on the CPU side by side, not one at a time under the GPU's frames-in-flight cap (as
+/// `Cx::frames` does), and the file is still the CPU's.
+#[test]
+fn frames_after_the_accelerator_stops_render_on_the_cpu() {
+    let d = out_dir("h264-gpu-yuv-stops");
+    let (p, cid) = project();
+    let s = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let stops = Fake::new(true, false, 1);
+    // Enough threads for frames to overlap wherever the machine runs it.
+    let pool = rayon::ThreadPoolBuilder::new().num_threads(4).build().unwrap();
+    let a = pool.install(|| run(&p, cid, Some(&stops), &s, &d.join("stops.mp4")));
+    let c = run(&p, cid, None, &s, &d.join("cpu.mp4"));
+    assert_eq!(stops.yuv_frames.load(Ordering::SeqCst), 1, "planes only until the stop");
+    assert!(stops.most_after_stop.load(Ordering::SeqCst) > 1, "frames after the stop rendered one at a time");
+    assert!(a == c);
+}
diff --git a/crates/export/tests/hevc_av1_roundtrip.rs b/crates/export/tests/it/hevc_av1_roundtrip.rs
similarity index 92%
rename from crates/export/tests/hevc_av1_roundtrip.rs
rename to crates/export/tests/it/hevc_av1_roundtrip.rs
index 93a82719a..4022da1ca 100644
--- a/crates/export/tests/hevc_av1_roundtrip.rs
+++ b/crates/export/tests/it/hevc_av1_roundtrip.rs
@@ -123,7 +123,15 @@ fn ffprobe_video(path: &Path) -> Option<String> {
         .output()
         .expect("ffprobe");
     assert!(out.status.success() && out.stderr.is_empty(), "ffprobe rejected {}: {}", path.display(), String::from_utf8_lossy(&out.stderr));
-    Some(String::from_utf8_lossy(&out.stdout).trim().to_string())
+    let s = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    // An ffprobe whose build lacks this codec's decoder (distro "free" builds) only parses the
+    // container: pix_fmt and the counted frames come back unknown/N/A, describing the build
+    // rather than our output. Skip the oracle, as when ffprobe is absent.
+    if s.contains("|unknown|") || s.ends_with("|N/A") {
+        eprintln!("ffprobe cannot decode this codec here: skipping the oracle ({s})");
+        return None;
+    }
+    Some(s)
 }
 
 /// Decode every frame with ffmpeg (no errors allowed) and check frames 0, 4, 5 and the last.
@@ -140,7 +148,14 @@ fn ffmpeg_check(path: &Path, decoder: Option<&str>, tol: f32) {
         cmd.args(["-c:v", d]);
     }
     let out = cmd.arg("-i").arg(path).args(["-pix_fmt", "rgba"]).arg(dir.join("f%03d.png")).output().expect("ffmpeg");
-    assert!(out.status.success() && out.stderr.is_empty(), "ffmpeg ({decoder:?}) failed on {}: {}", path.display(), String::from_utf8_lossy(&out.stderr));
+    let err = String::from_utf8_lossy(&out.stderr).to_string();
+    // Same as ffprobe: an ffmpeg without this codec's decoder cannot judge our output, so the
+    // oracle skips instead of failing (the in-repo decode above already proved the frames).
+    if !out.status.success() && err.contains("no decoder found") {
+        eprintln!("ffmpeg cannot decode this codec here: skipping the oracle decode ({err})");
+        return;
+    }
+    assert!(out.status.success() && err.is_empty(), "ffmpeg ({decoder:?}) failed on {}: {}", path.display(), err);
     for k in [0, 4, 5, FRAMES - 1] {
         let img = image::open(dir.join(format!("f{:03}.png", k + 1))).expect("ffmpeg frame").to_rgba8();
         check_frame(&Image::from_rgba8(img.width(), img.height(), img.as_raw()), k, tol);
diff --git a/crates/export/tests/it/main.rs b/crates/export/tests/it/main.rs
new file mode 100644
index 000000000..07ee96c05
--- /dev/null
+++ b/crates/export/tests/it/main.rs
@@ -0,0 +1,21 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod audio_sample_positions;
+mod banding;
+mod exr_scene_linear;
+mod h264_gpu_yuv;
+mod hevc_av1_roundtrip;
+#[cfg(not(target_arch = "wasm32"))]
+mod mov_audio_sample_positions;
+mod movie_bytes;
+mod movie_color;
+mod ms_rounded_footage;
+#[cfg(not(target_arch = "wasm32"))]
+mod native_audio_sample_positions;
+mod opus_roundtrip;
+mod prores_color;
+mod render_settings;
+mod roundtrip;
+mod targa_sequence;
+mod uncompressed_mov;
+mod vp9_roundtrip;
diff --git a/crates/export/tests/mov_audio_sample_positions.rs b/crates/export/tests/it/mov_audio_sample_positions.rs
similarity index 99%
rename from crates/export/tests/mov_audio_sample_positions.rs
rename to crates/export/tests/it/mov_audio_sample_positions.rs
index c58d2b14d..a46a49271 100644
--- a/crates/export/tests/mov_audio_sample_positions.rs
+++ b/crates/export/tests/it/mov_audio_sample_positions.rs
@@ -1,5 +1,3 @@
-#![cfg(not(target_arch = "wasm32"))]
-
 //! Tiny native WAV to ProRes PCM MOV sample-position proof.
 use effectcraft_export::render_queue::{AudioFormat, OutputFormat, OutputModule, RenderSettings};
 use effectcraft_export::{Job, JobOptions, Sink, export};
diff --git a/crates/export/tests/it/movie_bytes.rs b/crates/export/tests/it/movie_bytes.rs
new file mode 100644
index 000000000..76b89d1c7
--- /dev/null
+++ b/crates/export/tests/it/movie_bytes.rs
@@ -0,0 +1,108 @@
+//! Movie exports pinned byte for byte: a comp longer than one render batch, with a rotating
+//! stroked ring (mostly transparent, bilinear), a fading half-transparent solid at a fractional
+//! position and a Screen-mode shape, in 8 bpc. The comp is at most four macroblock rows high,
+//! so the H.264 encoder writes one slice per frame on any number of cores. The hashes are those of the files written before
+//! frames rendered while the previous batch encoded, before transparent source tiles were
+//! skipped and before blended pixels were quantised as they were drawn: those changes must not
+//! move a single byte.
+
+use effectcraft_color::{BlendMode, Label};
+use effectcraft_export::render_queue::{OutputFormat, OutputModule, RenderSettings, TimeSpan};
+use effectcraft_export::{Job, Sink, export};
+use effectcraft_keyframe::{Keyframe, Value};
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{Comp, ItemId, ItemKind, LayerSource, Project, Solid};
+use effectcraft_render::NoFootage;
+use effectcraft_time::{FrameRate, Tick};
+
+fn fnv1a(data: &[u8]) -> u64 {
+    data.iter().fold(0xcbf2_9ce4_8422_2325u64, |h, &b| (h ^ b as u64).wrapping_mul(0x100_0000_01b3))
+}
+
+fn project() -> (Project, ItemId) {
+    let mut p = Project::default();
+    let mut comp = Comp::new(160, 64, FrameRate::new(30, 1), Tick::from_seconds_f64(2.0));
+    comp.background = [0.05, 0.1, 0.3];
+    let t = Tick::from_seconds_f64;
+
+    let sid = p.add_item("Half", Label::Red, None, ItemKind::Solid(Solid { color: [0.9, 0.5, 0.1], width: 70, height: 40, pixel_aspect: 1.0 }));
+    let mut solid = build::layer(&mut p, &comp, "Half", LayerSource::Solid { item: sid }, (70, 40), None);
+    if let Some(pr) = solid.props.prop_mut("transform/position") {
+        pr.value = Value::Vec3([60.25, 36.5, 0.0]);
+    }
+    if let Some(pr) = solid.props.prop_mut("transform/opacity") {
+        pr.keys = vec![Keyframe::new(t(0.0), Value::Scalar(20.0)), Keyframe::new(t(2.0), Value::Scalar(70.0))];
+    }
+
+    let mut ring = build::layer(&mut p, &comp, "Ring", LayerSource::Shape, (160, 64), None);
+    let mut box_ = build::layer(&mut p, &comp, "Box", LayerSource::Shape, (160, 64), None);
+    let mut next = p.next_id;
+    {
+        let mut ids = Ids(&mut next);
+        let e = build::shape_ellipse(&mut ids, [56.0, 56.0], [0.0, 0.0]);
+        let s = build::shape_stroke(&mut ids, [0.3, 0.8, 1.0, 1.0], 3.0);
+        let g = build::shape_group(&mut ids, "Ring", vec![e, s]);
+        if let Some(c) = ring.props.sub_mut("contents") {
+            c.children.push(g.into());
+        }
+        let r = build::shape_rect(&mut ids, [30.0, 20.0], [25.0, -10.0], 4.0);
+        let f = build::shape_fill(&mut ids, [0.2, 1.0, 0.4, 0.8]);
+        let g = build::shape_group(&mut ids, "Box", vec![r, f]);
+        if let Some(c) = box_.props.sub_mut("contents") {
+            c.children.push(g.into());
+        }
+    }
+    p.next_id = next;
+    if let Some(pr) = ring.props.prop_mut("transform/rotation") {
+        pr.keys = vec![Keyframe::new(t(0.0), Value::Scalar(0.0)), Keyframe::new(t(2.0), Value::Scalar(130.0))];
+    }
+    if let Some(pr) = box_.props.prop_mut("transform/position") {
+        pr.keys = vec![Keyframe::new(t(0.0), Value::Vec3([70.0, 30.0, 0.0])), Keyframe::new(t(2.0), Value::Vec3([95.5, 38.25, 0.0]))];
+    }
+    box_.blend_mode = BlendMode::Screen;
+
+    comp.layers = vec![box_, ring, solid].into();
+    let cid = p.add_item("Comp 1", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+fn export_bytes(format: OutputFormat, name: &str) -> Vec<u8> {
+    let (p, cid) = project();
+    let settings = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let om = OutputModule::for_format(format);
+    let out = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+    let file = out.clone();
+    let sink: &Sink = &move |_: &str, data: Vec<u8>| *file.lock().unwrap() = data;
+    let job = Job {
+        project: &p,
+        footage: &NoFootage,
+        expr: None,
+        accel: None,
+        comp: cid,
+        settings: &settings,
+        output: &om,
+        path: name,
+        sink: Some(sink),
+        options: Default::default(),
+        nested_switches: true,
+    };
+    let r = export(&job, &mut |_| true).expect("export");
+    assert_eq!(r.frames, 60);
+    std::mem::take(&mut *out.lock().unwrap())
+}
+
+#[test]
+fn h264_movie_bytes_are_pinned() {
+    let data = export_bytes(OutputFormat::H264, "/out/pinned.mp4");
+    // FilmCraft 09aaf9b's encoder lists its settings in the first frame's user-data SEI (211
+    // bytes where 0.1.1's name took 50): 161 bytes more than the FilmCraft 2c5ba7a pin. The encoder's
+    // version string "0.8.0" -> "0.12.0" in that SEI adds one more byte (and one to the size fields).
+    assert_eq!((data.len(), fnv1a(&data)), (104_342, 17_327_612_315_319_115_693), "H.264 MP4");
+}
+
+#[test]
+fn prores_movie_bytes_are_pinned() {
+    let data = export_bytes(OutputFormat::ProRes, "/out/pinned.mov");
+    // The `nclc` colr atom (#2801) adds exactly 18 bytes; the frames don't move.
+    assert_eq!((data.len(), fnv1a(&data)), (270_112, 2_693_123_490_992_200_481), "ProRes MOV");
+}
diff --git a/crates/export/tests/it/movie_color.rs b/crates/export/tests/it/movie_color.rs
new file mode 100644
index 000000000..1a5371d91
--- /dev/null
+++ b/crates/export/tests/it/movie_color.rs
@@ -0,0 +1,95 @@
+//! H.264, HEVC and AV1 MP4s describe the frames the render path made (#2879): the `colr` box, read
+//! back with FilmCraft's demuxer, and the bitstream's own colour description (the SPS VUI, AV1's
+//! `color_config`), which ffprobe reports for the first frame of the bare elementary stream when
+//! ffmpeg can copy it out and decode it.
+
+use std::path::Path;
+use std::process::Command;
+
+use effectcraft_color::Label;
+use effectcraft_export::render_queue::{OutputFormat, OutputModule, RenderSettings, TimeSpan};
+use effectcraft_export::{Job, export};
+use effectcraft_project::{ColorSpace, Comp, ItemKind, LayerSource, Project, Solid, build};
+use effectcraft_render::NoFootage;
+use effectcraft_time::{FrameRate, Tick};
+use filmcraft_isobmff::{ColorInfo, TrackKind};
+
+/// (name, Output color space, H.273 primaries / transfer / matrix, the same as ffprobe names them)
+const ROWS: &[(&str, Option<ColorSpace>, [u16; 3], [&str; 3])] = &[
+    ("default", None, [1, 1, 1], ["bt709", "bt709", "bt709"]),
+    ("rec2020", Some(ColorSpace::Rec2020), [9, 1, 1], ["bt2020", "bt709", "bt709"]),
+    ("p3", Some(ColorSpace::DisplayP3), [12, 13, 1], ["smpte432", "iec61966-2-1", "bt709"]),
+    ("pq", Some(ColorSpace::Rec2100Pq), [9, 16, 1], ["bt2020", "smpte2084", "bt709"]),
+    ("hlg", Some(ColorSpace::Rec2100Hlg), [9, 18, 1], ["bt2020", "arib-std-b67", "bt709"]),
+];
+
+fn render(output: Option<ColorSpace>, format: OutputFormat, path: &Path) {
+    let mut p = Project::default();
+    p.settings.working_space = Some(ColorSpace::Srgb);
+    p.settings.output_space = output;
+    let mut comp = Comp::new(64, 48, FrameRate::new(10, 1), Tick::from_seconds_f64(0.2));
+    let sid = p.add_item("Solid", Label::Red, None, ItemKind::Solid(Solid { color: [0.75, 0.25, 0.5], width: 64, height: 48, pixel_aspect: 1.0 }));
+    comp.layers.push(build::layer(&mut p, &comp, "Solid", LayerSource::Solid { item: sid }, (64, 48), None));
+    let comp = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    let settings = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let om = OutputModule::for_format(format);
+    let out = path.to_string_lossy().to_string();
+    let job = Job {
+        project: &p,
+        footage: &NoFootage,
+        expr: None,
+        accel: None,
+        comp,
+        settings: &settings,
+        output: &om,
+        path: &out,
+        sink: None,
+        options: Default::default(),
+        nested_switches: true,
+    };
+    export(&job, &mut |_| true).expect("export");
+}
+
+/// ffprobe's primaries, transfer and matrix of the first frame of the movie's video copied out as a
+/// bare elementary stream (`h264`, `hevc` or `obu`), so no container metadata can stand in for the
+/// bitstream's own; `None` without ffmpeg or when its build can't copy or decode the stream.
+fn bitstream_tags(path: &Path, format: &str) -> Option<Vec<String>> {
+    let es = path.with_extension(format);
+    let copied =
+        Command::new("ffmpeg").args(["-v", "error", "-y", "-i"]).arg(path).args(["-map", "0:v:0", "-c", "copy", "-f", format]).arg(&es).status().ok()?;
+    if !copied.success() {
+        return None;
+    }
+    let out = Command::new("ffprobe")
+        .args(["-v", "error", "-read_intervals", "%+#1", "-show_entries", "frame=color_primaries,color_transfer,color_space", "-of", "default=nw=1"])
+        .arg(&es)
+        .output()
+        .ok()?;
+    let text = String::from_utf8_lossy(&out.stdout).to_string();
+    let tag = |key: &str| text.lines().find_map(|l| l.strip_prefix(key)?.strip_prefix('=')).map(str::to_string);
+    Some(vec![tag("color_primaries")?, tag("color_transfer")?, tag("color_space")?])
+}
+
+#[test]
+fn mp4_tags_describe_the_frames() {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/export/movie_color");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).expect("mkdir");
+    for (format, codec, stream) in [(OutputFormat::H264, "h264", "h264"), (OutputFormat::Hevc, "hevc", "hevc"), (OutputFormat::Av1, "av1", "obu")] {
+        for &(name, output, [primaries, transfer, matrix], names) in ROWS {
+            let path = dir.join(format!("{codec}_{name}.mp4"));
+            render(output, format, &path);
+
+            let bytes = std::fs::read(&path).expect("read movie");
+            let mp4 = filmcraft_isobmff::open(bytes.as_slice()).expect("demux");
+            let track = mp4.tracks.iter().find(|t| t.kind == TrackKind::Video).expect("video track");
+            let colr = track.entries[0].video.as_ref().and_then(|v| v.color.clone());
+            assert_eq!(colr, Some(ColorInfo::Nclx { primaries, transfer, matrix, full_range: false }), "{codec} {name}: colr");
+
+            match bitstream_tags(&path, stream) {
+                Some(tags) => assert_eq!(tags, names, "{codec} {name}: the bitstream's colour description"),
+                None => eprintln!("{codec} {name}: ffprobe can't decode it here, bitstream not checked"),
+            }
+        }
+    }
+}
diff --git a/crates/export/tests/ms_rounded_footage.rs b/crates/export/tests/it/ms_rounded_footage.rs
similarity index 100%
rename from crates/export/tests/ms_rounded_footage.rs
rename to crates/export/tests/it/ms_rounded_footage.rs
diff --git a/crates/export/tests/native_audio_sample_positions.rs b/crates/export/tests/it/native_audio_sample_positions.rs
similarity index 99%
rename from crates/export/tests/native_audio_sample_positions.rs
rename to crates/export/tests/it/native_audio_sample_positions.rs
index 1b59e8c11..9222d0f23 100644
--- a/crates/export/tests/native_audio_sample_positions.rs
+++ b/crates/export/tests/it/native_audio_sample_positions.rs
@@ -1,5 +1,3 @@
-#![cfg(not(target_arch = "wasm32"))]
-
 //! Native MediaPool decoding and native WAV export preserve selected sample positions.
 use effectcraft_export::render_queue::{AudioFormat, OutputFormat, OutputModule, RenderSettings};
 use effectcraft_export::{Job, JobOptions, Sink, export};
diff --git a/crates/export/tests/opus_roundtrip.rs b/crates/export/tests/it/opus_roundtrip.rs
similarity index 100%
rename from crates/export/tests/opus_roundtrip.rs
rename to crates/export/tests/it/opus_roundtrip.rs
diff --git a/crates/export/tests/it/prores_color.rs b/crates/export/tests/it/prores_color.rs
new file mode 100644
index 000000000..a54a17293
--- /dev/null
+++ b/crates/export/tests/it/prores_color.rs
@@ -0,0 +1,158 @@
+//! ProRes `colr` atom (#2801): it describes the frames the render path made, read back with
+//! FilmCraft's demuxer and, when installed, ffprobe as an external oracle. A PQ or HLG render
+//! read back into a managed project has the colours it was rendered from (#2849).
+
+use std::path::Path;
+use std::process::Command;
+
+use effectcraft_color::Label;
+use effectcraft_export::render_queue::{Channels, OutputFormat, OutputModule, RenderSettings, TimeSpan, sequence_path};
+use effectcraft_export::{Job, export};
+use effectcraft_media::MediaPool;
+use effectcraft_project::{ColorSpace, Comp, ItemKind, LayerSource, Project, Solid, build};
+use effectcraft_render::{FootageSource, NoFootage};
+use effectcraft_time::{FrameRate, Tick};
+use filmcraft_isobmff::{ColorInfo, TrackKind};
+
+struct Row {
+    name: &'static str,
+    working: Option<ColorSpace>,
+    output: Option<ColorSpace>,
+    channels: Channels,
+    /// H.273 primaries, transfer and matrix.
+    codes: [u16; 3],
+    /// The same as ffprobe names them.
+    names: [&'static str; 3],
+}
+
+const SRGB: Option<ColorSpace> = Some(ColorSpace::Srgb);
+const PQ: Option<ColorSpace> = Some(ColorSpace::Rec2100Pq);
+const BT709: [&str; 3] = ["bt709", "bt709", "bt709"];
+
+const ROWS: &[Row] = &[
+    Row { name: "unmanaged", working: None, output: None, channels: Channels::Rgb, codes: [1, 1, 1], names: BT709 },
+    Row { name: "unmanaged_ignores_output", working: None, output: PQ, channels: Channels::Rgb, codes: [1, 1, 1], names: BT709 },
+    Row { name: "srgb_output_stays_1_1_1", working: SRGB, output: None, channels: Channels::Rgb, codes: [1, 1, 1], names: BT709 },
+    Row { name: "rec709", working: SRGB, output: Some(ColorSpace::Rec709), channels: Channels::Rgb, codes: [1, 1, 1], names: BT709 },
+    Row { name: "rec2020", working: SRGB, output: Some(ColorSpace::Rec2020), channels: Channels::Rgb, codes: [9, 1, 1], names: ["bt2020", "bt709", "bt709"] },
+    Row {
+        name: "p3",
+        working: SRGB,
+        output: Some(ColorSpace::DisplayP3),
+        channels: Channels::Rgb,
+        codes: [12, 13, 1],
+        names: ["smpte432", "iec61966-2-1", "bt709"],
+    },
+    Row { name: "pq", working: SRGB, output: PQ, channels: Channels::Rgb, codes: [9, 16, 1], names: ["bt2020", "smpte2084", "bt709"] },
+    Row {
+        name: "hlg",
+        working: SRGB,
+        output: Some(ColorSpace::Rec2100Hlg),
+        channels: Channels::Rgb,
+        codes: [9, 18, 1],
+        names: ["bt2020", "arib-std-b67", "bt709"],
+    },
+    Row { name: "aces", working: SRGB, output: Some(ColorSpace::AcesCg), channels: Channels::Rgb, codes: [2, 8, 1], names: ["unknown", "linear", "bt709"] },
+    Row { name: "pq_with_alpha", working: SRGB, output: PQ, channels: Channels::Rgba, codes: [9, 16, 1], names: ["bt2020", "smpte2084", "bt709"] },
+    Row { name: "alpha_matte", working: SRGB, output: PQ, channels: Channels::Alpha, codes: [1, 1, 1], names: BT709 },
+];
+
+/// The solid every row renders; with the default output it comes out as these values.
+const SOLID: [f32; 3] = [0.75, 0.25, 0.5];
+
+fn render(row: &Row, path: &Path) {
+    let mut p = Project::default();
+    p.settings.working_space = row.working;
+    p.settings.output_space = row.output;
+    let mut comp = Comp::new(64, 48, FrameRate::new(10, 1), Tick::from_seconds_f64(0.2));
+    let sid = p.add_item("Solid", Label::Red, None, ItemKind::Solid(Solid { color: SOLID, width: 64, height: 48, pixel_aspect: 1.0 }));
+    comp.layers.push(build::layer(&mut p, &comp, "Solid", LayerSource::Solid { item: sid }, (64, 48), None));
+    let comp = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    let output = OutputModule { channels: row.channels, ..OutputModule::for_format(OutputFormat::ProRes) };
+    run(&p, comp, &NoFootage, &output, path);
+}
+
+fn run(p: &Project, comp: effectcraft_project::ItemId, footage: &dyn FootageSource, output: &OutputModule, path: &Path) {
+    let settings = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let out = path.to_string_lossy().to_string();
+    let job = Job {
+        project: p,
+        footage,
+        expr: None,
+        accel: None,
+        comp,
+        settings: &settings,
+        output,
+        path: &out,
+        sink: None,
+        options: Default::default(),
+        nested_switches: true,
+    };
+    export(&job, &mut |_| true).expect("export");
+}
+
+/// ffprobe's primaries, transfer and matrix for the stream, or `None` without ffprobe.
+fn ffprobe_tags(path: &Path) -> Option<Vec<String>> {
+    let out = Command::new("ffprobe")
+        .args(["-v", "error", "-select_streams", "v:0", "-show_entries", "stream=color_primaries,color_transfer,color_space", "-of", "default=nw=1"])
+        .arg(path)
+        .output()
+        .ok()?;
+    assert!(out.status.success(), "ffprobe rejected {}: {}", path.display(), String::from_utf8_lossy(&out.stderr));
+    let text = String::from_utf8_lossy(&out.stdout).to_string();
+    let tag = |key: &str| text.lines().find_map(|l| l.strip_prefix(key)?.strip_prefix('=')).unwrap_or("").to_string();
+    Some(vec![tag("color_primaries"), tag("color_transfer"), tag("color_space")])
+}
+
+#[test]
+fn prores_colr_describes_the_frames() {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/export/prores_color");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).expect("mkdir");
+    for row in ROWS {
+        let path = dir.join(format!("{}.mov", row.name));
+        render(row, &path);
+
+        let bytes = std::fs::read(&path).expect("read movie");
+        let mov = filmcraft_isobmff::open(bytes.as_slice()).expect("demux");
+        let track = mov.tracks.iter().find(|t| t.kind == TrackKind::Video).expect("video track");
+        let [primaries, transfer, matrix] = row.codes;
+        let colr = track.entries[0].video.as_ref().and_then(|v| v.color.clone());
+        assert_eq!(colr, Some(ColorInfo::Nclc { primaries, transfer, matrix }), "{}: colr", row.name);
+
+        if let Some(stream) = ffprobe_tags(&path) {
+            assert_eq!(stream, row.names, "{}: ffprobe stream tags", row.name);
+        }
+    }
+}
+
+/// #2849: a PQ or HLG render, imported into a project with an sRGB working space, gets the
+/// Rec. 2100 profile its `colr` atom names and shows the solid it was rendered from.
+#[test]
+fn hdr_renders_reimport_with_their_colours() {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/export/prores_hdr_reimport");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).expect("mkdir");
+    let want = SOLID.map(|v| (v * 255.0 + 0.5) as i32);
+    for (name, space) in [("pq", ColorSpace::Rec2100Pq), ("hlg", ColorSpace::Rec2100Hlg)] {
+        let row = ROWS.iter().find(|r| r.name == name).expect("row");
+        let movie = dir.join(format!("{name}.mov"));
+        render(row, &movie);
+
+        let footage = effectcraft_media::probe(&movie).expect("probe");
+        let profile = footage.color_profile;
+        let mut p = Project::default();
+        p.settings.working_space = SRGB;
+        let mut comp = Comp::new(64, 48, FrameRate::new(10, 1), Tick::from_seconds_f64(0.1));
+        let fid = p.add_item(name, Label::SeaFoam, None, ItemKind::Footage(footage));
+        comp.layers.push(build::layer(&mut p, &comp, name, LayerSource::Footage { item: fid }, (64, 48), None));
+        let comp = p.add_item("Reimport", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+        let pattern = dir.join(format!("{name}_[#####].png")).to_string_lossy().to_string();
+        run(&p, comp, &MediaPool::new(), &OutputModule::for_format(OutputFormat::PngSequence), Path::new(&pattern));
+
+        let png = image::open(sequence_path(&pattern, 0)).expect("png").to_rgb8();
+        let got = png.get_pixel(32, 24).0.map(i32::from);
+        assert!(got.iter().zip(want).all(|(g, w)| (g - w).abs() <= 2), "{name}: centre {got:?}, want {want:?} (profile {profile:?})");
+        assert_eq!(profile, Some(space), "{name}: profile");
+    }
+}
diff --git a/crates/export/tests/render_settings.rs b/crates/export/tests/it/render_settings.rs
similarity index 92%
rename from crates/export/tests/render_settings.rs
rename to crates/export/tests/it/render_settings.rs
index 9e9a0a18f..0fd6d471b 100644
--- a/crates/export/tests/render_settings.rs
+++ b/crates/export/tests/it/render_settings.rs
@@ -45,7 +45,7 @@ fn custom(start: f64, end: f64) -> RenderSettings {
 }
 
 fn run_with(p: &Project, cid: ItemId, s: &RenderSettings, om: &OutputModule, path: &str, options: JobOptions, cancel: bool) -> (Result<Report, String>, Files) {
-    run_on(p, cid, s, om, path, options, None, cancel)
+    run_on(p, cid, s, om, path, options, (None, cancel))
 }
 
 /// [`run_with`] with an accelerator.
@@ -56,9 +56,9 @@ fn run_on(
     om: &OutputModule,
     path: &str,
     options: JobOptions,
-    accel: Option<&dyn Accelerator>,
-    cancel: bool,
+    execution: (Option<&dyn Accelerator>, bool),
 ) -> (Result<Report, String>, Files) {
+    let (accel, cancel) = execution;
     let files: Files = Default::default();
     let f = files.clone();
     let sink: Box<Sink> = Box::new(move |path: &str, data: Vec<u8>| f.lock().unwrap().push((path.to_string(), data)));
@@ -174,6 +174,31 @@ fn crop_roi_and_resize() {
     assert_eq!((z.width(), z.height()), (32, 24));
 }
 
+/// Resizing to the cropped frame's own dimensions must preserve every decoded PNG pixel.
+/// Compare against crop-only output for padding and scaled ROIs with both resize qualities.
+#[test]
+fn crop_resize_preserves_pixels_when_the_cropped_size_is_requested() {
+    let (p, cid) = project(FrameRate::new(25, 1), |_, _| {});
+    for (crop, scale, expected) in [
+        (Crop { enabled: true, left: 16, right: 16, ..Default::default() }, 1.0, (32, 48)),
+        (Crop { enabled: true, left: -4, top: -2, ..Default::default() }, 1.0, (68, 50)),
+        (Crop { enabled: true, use_roi: true, roi: Some([0.0, 24.0, 32.0, 24.0]), ..Default::default() }, 0.5, (16, 12)),
+        (Crop { enabled: true, use_roi: true, roi: Some([0.0, 24.0, 32.0, 24.0]), ..Default::default() }, 2.0, (64, 48)),
+    ] {
+        let settings = RenderSettings { resolution: scale, ..custom(0.4, 0.44) };
+        let mut output = OutputModule { crop, ..OutputModule::for_format(OutputFormat::PngSequence) };
+        let reference = png(&run(&p, cid, &settings, &output, "/c/reference_[#####].png"), 0);
+        assert_eq!(reference.dimensions(), expected);
+        assert!(reference.pixels().any(|p| p.0[0] > 150), "the reference contains visible content");
+        for quality in [ResizeQuality::Low, ResizeQuality::High] {
+            output.resize = Resize { enabled: true, width: expected.0, height: 1, lock_aspect: true, quality };
+            let actual = png(&run(&p, cid, &settings, &output, "/c/resized_[#####].png"), 0);
+            assert_eq!(actual.dimensions(), expected);
+            assert!(actual == reference, "crop {crop:?}, scale {scale}, quality {quality:?}: pixels changed");
+        }
+    }
+}
+
 #[test]
 fn alpha_only_and_premultiplied() {
     let (p, cid) = project(FrameRate::new(25, 1), |p, comp| {
@@ -456,7 +481,7 @@ fn a_job_renders_on_one_compositor() {
     let om = OutputModule::for_format(OutputFormat::PngSequence);
     let s = custom(0.0, 0.4);
     let render = |p: &Project, accel: &GreenAccel, path: &str| {
-        let (r, files) = run_on(p, cid, &s, &om, path, JobOptions::default(), Some(accel), false);
+        let (r, files) = run_on(p, cid, &s, &om, path, JobOptions::default(), (Some(accel), false));
         r.expect("export");
         (0..10).map(|i| png(&files, i)).collect::<Vec<_>>()
     };
diff --git a/crates/export/tests/roundtrip.rs b/crates/export/tests/it/roundtrip.rs
similarity index 70%
rename from crates/export/tests/roundtrip.rs
rename to crates/export/tests/it/roundtrip.rs
index 0fc747018..c8634fa21 100644
--- a/crates/export/tests/roundtrip.rs
+++ b/crates/export/tests/it/roundtrip.rs
@@ -10,7 +10,7 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use effectcraft_color::Label;
-use effectcraft_export::render_queue::{AudioOutput, Channels, OutputFormat, OutputModule, ProResProfile, RenderSettings, TimeSpan, sequence_path};
+use effectcraft_export::render_queue::{AlphaMode, AudioOutput, Channels, OutputFormat, OutputModule, ProResProfile, RenderSettings, TimeSpan, sequence_path};
 use effectcraft_export::{Job, Progress, export};
 use effectcraft_media::MediaPool;
 use effectcraft_project::{Comp, ItemId, ItemKind, LayerSource, Project, Solid, build};
@@ -23,6 +23,24 @@ const H: u32 = 48;
 const BG: [f32; 3] = [0.1, 0.1, 0.4];
 const FRAMES: u64 = 12;
 
+/// An H.264 encoder this ffmpeg build actually ships, or `None` when it has none. Distro "free"
+/// builds often omit `libx264` but ship an alternative (e.g. libopenh264), so pick the first
+/// present by name rather than hard-coding one that may be absent. The oracle only needs *an*
+/// H.264 encoder; the encoder identity is irrelevant to the assertion.
+fn h264_encoder() -> Option<&'static str> {
+    static ENC: std::sync::OnceLock<Option<&'static str>> = std::sync::OnceLock::new();
+    *ENC.get_or_init(|| {
+        let out = Command::new("ffmpeg").args(["-hide_banner", "-encoders"]).output().ok()?;
+        if !out.status.success() {
+            return None;
+        }
+        let text = String::from_utf8_lossy(&out.stdout);
+        ["libx264", "libopenh264", "h264_nvenc", "h264_vaapi", "h264_qsv", "h264_v4l2m2m", "h264_amf"]
+            .into_iter()
+            .find(|name| text.lines().any(|l| l.split_whitespace().any(|tok| tok == *name)))
+    })
+}
+
 fn out_dir(name: &str) -> PathBuf {
     let d = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/export").join(name);
     let _ = std::fs::remove_dir_all(&d);
@@ -52,6 +70,7 @@ fn settings() -> RenderSettings {
     RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() }
 }
 
+/// Exports the standard test comp and checks progress for all [`FRAMES`] frames.
 fn run(p: &Project, cid: ItemId, footage: &dyn FootageSource, om: &OutputModule, path: &Path) -> effectcraft_export::Report {
     run_frames(p, cid, footage, om, path, FRAMES)
 }
@@ -233,6 +252,65 @@ fn prores_4444_with_alpha() {
     }
 }
 
+/// Checks stored alpha run codewords in exported MOVs across both 4444 profiles,
+/// alpha modes and motion-blur settings, without relying on permissive decoders.
+#[test]
+fn prores_alpha_final_run_is_present_in_exported_movies() {
+    let dir = out_dir("prores-alpha-final-run");
+    let png = dir.join("alpha.png");
+    // One macroblock with 255 transparent pixels followed by one opaque pixel.
+    // The last alpha difference is -1 (modulo 65536), requiring a singleton run.
+    let mut pixels = image::RgbaImage::new(16, 16);
+    pixels.put_pixel(15, 15, image::Rgba([255, 80, 20, 255]));
+    pixels.save(&png).expect("synthetic alpha PNG");
+
+    for profile in [ProResProfile::P4444, ProResProfile::P4444Xq] {
+        for alpha_mode in [AlphaMode::Straight, AlphaMode::Premultiplied] {
+            for motion_blur in [false, true] {
+                let mut project = Project::default();
+                let rate = FrameRate::FPS_30;
+                let mut comp = Comp::new(16, 16, rate, rate.tick_of(1));
+                comp.enable_motion_blur = motion_blur;
+                let footage = effectcraft_media::probe(&png).expect("probe synthetic PNG");
+                let item = project.add_item("Alpha", Label::SeaFoam, None, ItemKind::Footage(footage));
+                let mut layer = build::layer(&mut project, &comp, "Alpha", LayerSource::Footage { item }, (16, 16), None);
+                layer.switches.motion_blur = motion_blur;
+                comp.layers.push(layer);
+                let comp = project.add_item("Alpha", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+                let output = OutputModule {
+                    channels: Channels::Rgba,
+                    prores_profile: profile,
+                    alpha_mode,
+                    audio: AudioOutput::Off,
+                    ..OutputModule::for_format(OutputFormat::ProRes)
+                };
+                let path = dir.join(format!("{profile:?}-{alpha_mode:?}-blur-{motion_blur}.mov"));
+                run_frames(&project, comp, &MediaPool::new(), &output, &path, 1);
+
+                let bytes = std::fs::read(&path).expect("exported MOV");
+                let movie = filmcraft_isobmff::open(bytes.as_slice()).expect("demux exported MOV");
+                let video = movie.tracks.iter().find(|track| track.kind == filmcraft_isobmff::TrackKind::Video).expect("video track");
+                assert_eq!(video.samples.len(), 1);
+                let sample = &video.samples[0];
+                let frame = &bytes[sample.offset as usize..][..sample.size as usize];
+                let (header, start, size) = filmcraft_prores::FrameHeader::parse(frame).expect("ProRes header");
+                assert_eq!((header.width, header.height), (16, 16));
+                let picture = &frame[start..size];
+                let header = filmcraft_prores::PictureHeader::parse(picture).expect("picture header");
+                assert_eq!(header.num_slices, 1);
+                let slice = &picture[header.header_size + 2..];
+                let color_bytes: usize = slice[2..8].as_chunks::<2>().0.iter().map(|b| u16::from_be_bytes(*b) as usize).sum();
+                let alpha = &slice[(slice[0] >> 3) as usize + color_bytes..];
+                // RDD 36:2022 Tables 12–14: +1, run 255, -1, run 1, alignment.
+                // The old encoder stopped after -1, giving [00 00 fe 01]. Its
+                // own decoder and FFmpeg accept that truncated payload, so a
+                // round-trip alone cannot enforce the native decoder's syntax.
+                assert_eq!(alpha, [0x00, 0x00, 0xfe, 0x01, 0x80], "{profile:?}, {alpha_mode:?}, blur={motion_blur}");
+            }
+        }
+    }
+}
+
 fn check_still_dir(dir: &Path, ext: &str, tol: f32, alpha: bool) {
     for k in 0..FRAMES {
         let path = sequence_path(&dir.join(format!("f_[#####].{ext}")).to_string_lossy(), k as i64);
@@ -260,6 +338,8 @@ fn image_sequences_roundtrip() {
         (OutputFormat::JpegSequence, "jpg", 0.06, Channels::Rgb),
         (OutputFormat::TiffSequence, "tif", 0.01, Channels::Rgb),
         (OutputFormat::TiffSequence, "tif", 0.01, Channels::Rgba),
+        (OutputFormat::TargaSequence, "tga", 0.01, Channels::Rgb),
+        (OutputFormat::TargaSequence, "tga", 0.01, Channels::Rgba),
     ] {
         let d = out_dir(&format!("seq-{ext}-{ch:?}"));
         let om = OutputModule { channels: ch, ..OutputModule::for_format(fmt) };
@@ -282,6 +362,122 @@ fn exr_sequence_is_linear() {
     assert!((c[2] - 0.1329).abs() < 0.01 && (c[3] - 1.0).abs() < 1e-6, "{c:?}");
 }
 
+/// Sequence frames are scan-line EXR, not tiled, so scan-line readers such as FilmCraft open
+/// them (#2805).
+#[test]
+fn exr_sequence_writes_scan_lines() {
+    let (p, cid) = project(None);
+    let d = out_dir("seq-exr-scanline");
+    let om = OutputModule::for_format(OutputFormat::ExrSequence);
+    run(&p, cid, &NoFootage, &om, &d.join("f_[#####].exr"));
+    let bytes = std::fs::read(d.join("f_00000.exr")).expect("exr");
+    // Version field (little-endian u32 at bytes 4..8): version 2, then the flags byte. Its 0x02
+    // bit is the tiled bit, 0x200 of the field, so a scan-line file has 0 there.
+    assert_eq!(&bytes[4..6], &[2, 0], "{:02x?}", &bytes[..8]);
+    let meta = exr::meta::MetaData::read_from_buffered(std::io::Cursor::new(&bytes), false).expect("exr header");
+    assert_eq!(meta.headers[0].blocks, exr::meta::BlockDescription::ScanLines);
+    assert_eq!(meta.headers[0].compression, exr::compression::Compression::ZIP16);
+}
+
+/// The RGBA samples of an EXR file, as stored (f16 widened to f32), and their sample types.
+fn exr_samples(path: &Path) -> (Vec<f32>, Vec<exr::prelude::SampleType>) {
+    use exr::prelude::{ReadChannels, ReadLayers};
+    let image = exr::prelude::read()
+        .no_deep_data()
+        .largest_resolution_level()
+        .rgba_channels(
+            |res, _| (res.width(), vec![0f32; res.width() * res.height() * 4]),
+            |(w, v): &mut (usize, Vec<f32>), p: exr::prelude::Vec2<usize>, (r, g, b, a): (f32, f32, f32, f32)| {
+                let o = (p.y() * *w + p.x()) * 4;
+                v[o..o + 4].copy_from_slice(&[r, g, b, a]);
+            },
+        )
+        .first_valid_layer()
+        .all_attributes()
+        .from_file(path)
+        .expect("read exr");
+    let c = &image.layer_data.channel_data.channels;
+    (image.layer_data.channel_data.pixels.1, vec![c.0.sample_type, c.1.sample_type, c.2.sample_type, c.3.as_ref().expect("alpha").sample_type])
+}
+
+/// Every OpenEXR compression at both bit depths renders through the Render Queue as scan lines
+/// with that compression and sample type, and reads back through the media pool (#2911):
+/// lossless 32-bit float matches the uncompressed render exactly, lossless half float stores
+/// exactly the half rounding of it, and lossy methods stay within the tolerance the docs give.
+#[test]
+fn exr_compressions_and_bit_depths_round_trip() {
+    use effectcraft_export::render_queue::{ExrBitDepth, ExrCompression};
+    use exr::prelude::{SampleType, f16};
+    let (p, cid) = project(None);
+    let render = |c: ExrCompression, d: ExrBitDepth| {
+        let dir = out_dir(&format!("seq-exr-{}-{}", c.name(), d.name()));
+        let om = OutputModule { channels: Channels::Rgba, exr_compression: c, exr_bit_depth: d, ..OutputModule::for_format(OutputFormat::ExrSequence) };
+        run(&p, cid, &NoFootage, &om, &dir.join("f_[#####].exr"));
+        dir.join("f_00007.exr")
+    };
+    let pooled = |path: &Path| {
+        let f = effectcraft_media::probe(path).expect("probe");
+        MediaPool::new().frame_at(&f, Tick(0)).expect("decode")
+    };
+    let reference = render(ExrCompression::None, ExrBitDepth::Float);
+    let (want, _) = exr_samples(&reference);
+    let want_pooled = pooled(&reference);
+    assert!(want.iter().any(|v| *v > 0.5) && want.contains(&0.0), "the frame has red, background and transparent corners");
+    for d in ExrBitDepth::ALL {
+        let ty = if d == ExrBitDepth::Half { SampleType::F16 } else { SampleType::F32 };
+        for c in ExrCompression::ALL {
+            let path = render(c, d);
+            let bytes = std::fs::read(&path).expect("exr");
+            assert_eq!(&bytes[4..6], &[2, 0], "{c:?} {d:?}: single-part scan lines");
+            let meta = exr::meta::MetaData::read_from_buffered(std::io::Cursor::new(&bytes), false).expect("exr header");
+            assert_eq!(meta.headers[0].blocks, exr::meta::BlockDescription::ScanLines, "{c:?} {d:?}");
+            assert_eq!(meta.headers[0].compression.to_string(), exr_compression_name(c), "{c:?} {d:?}");
+            let (got, types) = exr_samples(&path);
+            assert_eq!(types, [ty; 4], "{c:?} {d:?}");
+            let lossy = c.is_lossy(d);
+            for (i, (g, w)) in got.iter().zip(&want).enumerate() {
+                let w = if d == ExrBitDepth::Half { f16::from_f32(*w).to_f32() } else { *w };
+                if lossy {
+                    assert!((g - w).abs() <= 0.03 + 0.06 * w.abs(), "{c:?} {d:?} sample {i}: {g} vs {w}");
+                } else {
+                    assert_eq!(g.to_bits(), w.to_bits(), "{c:?} {d:?} sample {i}: {g} vs {w}");
+                }
+            }
+            let img = pooled(&path);
+            assert_eq!((img.width, img.height), (W, H));
+            let tol = if lossy {
+                0.06
+            } else if d == ExrBitDepth::Half {
+                2e-3
+            } else {
+                0.0
+            };
+            for (k, (a, b)) in img.data.iter().zip(&want_pooled.data).enumerate() {
+                assert!(a.iter().zip(b).all(|(x, y)| (x - y).abs() <= tol), "{c:?} {d:?} pixel {k}: {a:?} vs {b:?}");
+            }
+        }
+    }
+}
+
+/// The `exr` crate's name for the compression an Output Module setting writes.
+fn exr_compression_name(c: effectcraft_export::render_queue::ExrCompression) -> String {
+    use effectcraft_export::render_queue::ExrCompression::*;
+    use exr::compression::Compression as X;
+    match c {
+        None => X::Uncompressed,
+        Rle => X::RLE,
+        Zips => X::ZIP1,
+        Zip => X::ZIP16,
+        Piz => X::PIZ,
+        Pxr24 => X::PXR24,
+        B44 => X::B44,
+        B44a => X::B44A,
+        Dwaa => X::DWAA(Option::None),
+        Dwab => X::DWAB(Option::None),
+    }
+    .to_string()
+}
+
 /// A 32 bpc project whose only layer is a full-frame opaque solid of the given colour.
 fn bright_project(color: [f32; 3]) -> (Project, ItemId) {
     let mut p = Project::default();
@@ -489,14 +685,18 @@ fn ffmpeg_audio(src: &Path) -> Vec<f32> {
 fn movies_carry_resampled_footage_audio() {
     let d = out_dir("audio-44k");
     let clip = d.join("clip.mp4");
+    let Some(enc) = h264_encoder() else {
+        eprintln!("ffmpeg has no H.264 encoder: skipping");
+        return;
+    };
     let made = Command::new("ffmpeg")
         .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=64x48:rate=30000/1001:duration=3", "-f", "lavfi", "-i"])
-        .args(["aevalsrc=0.5*sin(2*PI*440*t)|0.5*sin(2*PI*(200+400*t/3)*t):s=44100:d=3", "-c:v", "libx264", "-pix_fmt", "yuv420p", "-c:a", "aac", "-shortest"])
+        .args(["aevalsrc=0.5*sin(2*PI*440*t)|0.5*sin(2*PI*(200+400*t/3)*t):s=44100:d=3", "-c:v", enc, "-pix_fmt", "yuv420p", "-c:a", "aac", "-shortest"])
         .arg(&clip)
         .status()
         .is_ok_and(|s| s.success());
     if !made {
-        eprintln!("ffmpeg not found: skipping");
+        eprintln!("ffmpeg could not make the H.264 fixture: skipping");
         return;
     }
     let fps = FrameRate::new(30000, 1001);
diff --git a/crates/export/tests/it/targa_sequence.rs b/crates/export/tests/it/targa_sequence.rs
new file mode 100644
index 000000000..b496163d2
--- /dev/null
+++ b/crates/export/tests/it/targa_sequence.rs
@@ -0,0 +1,218 @@
+//! Targa sequence output: every file is an uncompressed TGA (Truevision TGA 2.0 specification:
+//! an 18-byte header, BGR(A) pixels, top-left origin, the alpha bits in the image descriptor)
+//! holding exactly the pixels the lossless PNG sequence of the same job writes, and EffectCraft's
+//! own Targa import (#745) reads the frames back as the same picture.
+//!
+//! The comp is 7×4 @ 10 fps, 3 frames: frame 0 is the background alone, frames 1 and 2 add a
+//! 2×2 solid in the top two rows (so a flipped picture shows), on a half pixel horizontally, so
+//! its left and right columns carry partial alpha.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use effectcraft_color::Label;
+use effectcraft_export::render_queue::{AlphaMode, Channels, OutputFormat, OutputModule, RenderSettings, TimeSpan, sequence_path};
+use effectcraft_export::{Job, export};
+use effectcraft_keyframe::Value;
+use effectcraft_media::MediaPool;
+use effectcraft_project::{Comp, Footage, FootageKind, ItemId, ItemKind, LayerSource, Project, Solid, build};
+use effectcraft_render::NoFootage;
+use effectcraft_time::{FrameRate, Tick};
+
+const W: u32 = 7;
+const H: u32 = 4;
+const FRAMES: u64 = 3;
+
+fn out_dir(name: &str) -> PathBuf {
+    let d = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/export").join(name);
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).expect("mkdir");
+    d
+}
+
+fn project() -> (Project, ItemId) {
+    let mut p = Project::default();
+    let mut comp = Comp::new(W, H, FrameRate::new(10, 1), Tick::from_seconds_f64(FRAMES as f64 / 10.0));
+    comp.background = [0.1, 0.3, 0.6];
+    let sid = p.add_item("Red", Label::Red, None, ItemKind::Solid(Solid { color: [0.9, 0.2, 0.1], width: 2, height: 2, pixel_aspect: 1.0 }));
+    let mut l = build::layer(&mut p, &comp, "Red", LayerSource::Solid { item: sid }, (2, 2), None);
+    l.props.prop_mut("transform/position").expect("position").value = Value::Vec3([3.5, 1.0, 0.0]);
+    l.in_point = comp.frame_rate.tick_of(1);
+    comp.layers.push(l);
+    let cid = p.add_item("Comp 1", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+/// Render the comp through `om` to `dir/f_[#####].<ext>`; the first frame's path.
+fn render(p: &Project, cid: ItemId, om: &OutputModule, dir: &Path) -> String {
+    let s = RenderSettings { time_span: TimeSpan::LengthOfComp, ..Default::default() };
+    let path = dir.join(format!("f_[#####].{}", om.format.extension())).to_string_lossy().to_string();
+    let job = Job {
+        project: p,
+        footage: &NoFootage,
+        expr: None,
+        accel: None,
+        comp: cid,
+        settings: &s,
+        output: om,
+        path: &path,
+        sink: None,
+        options: Default::default(),
+        nested_switches: true,
+    };
+    let r = export(&job, &mut |_| true).expect("export");
+    assert_eq!((r.frames, r.width, r.height), (FRAMES, W, H));
+    r.path
+}
+
+/// The numbered files of a render of `ext`: frames 0..FRAMES and nothing after.
+fn frame_paths(dir: &Path, ext: &str) -> Vec<String> {
+    let template = dir.join(format!("f_[#####].{ext}")).to_string_lossy().to_string();
+    assert!(!Path::new(&sequence_path(&template, FRAMES as i64)).exists(), "no frame after the last");
+    (0..FRAMES as i64).map(|k| sequence_path(&template, k)).collect()
+}
+
+/// A Targa file's header fields and its pixels as top-down RGBA bytes.
+struct Tga {
+    image_type: u8,
+    width: u16,
+    height: u16,
+    depth: u8,
+    descriptor: u8,
+    rgba: Vec<u8>,
+}
+
+fn read_tga(path: &str) -> Tga {
+    let b = std::fs::read(path).unwrap_or_else(|e| panic!("{path}: {e}"));
+    let u16_at = |i: usize| u16::from_le_bytes([b[i], b[i + 1]]);
+    assert_eq!((b[0], b[1]), (0, 0), "{path}: no image ID, no colour map");
+    assert_eq!((u16_at(8), u16_at(10)), (0, 0), "{path}: X / Y origin");
+    let (width, height, depth, descriptor) = (u16_at(12), u16_at(14), b[16], b[17]);
+    let bpp = usize::from(depth / 8);
+    // Uncompressed, without an image ID, colour map or 2.0 footer: header and pixels only.
+    assert_eq!(b.len(), 18 + usize::from(width) * usize::from(height) * bpp, "{path}: file size");
+    let rgba = b[18..]
+        .chunks(bpp)
+        .flat_map(|p| match p {
+            [b, g, r, a] => [*r, *g, *b, *a],
+            [b, g, r] => [*r, *g, *b, 255],
+            [v] => [*v, *v, *v, 255],
+            _ => panic!("{path}: {depth}-bit pixels"),
+        })
+        .collect();
+    Tga { image_type: b[2], width, height, depth, descriptor, rgba }
+}
+
+fn png_rgba(path: &str) -> Vec<u8> {
+    image::open(path).unwrap_or_else(|e| panic!("{path}: {e}")).to_rgba8().into_raw()
+}
+
+#[test]
+fn targa_sequence_writes_the_png_sequence_pixels() {
+    let (p, cid) = project();
+    for (channels, alpha_mode, image_type, depth, descriptor) in [
+        (Channels::Rgb, AlphaMode::Straight, 2, 24, 0x20),
+        (Channels::Rgba, AlphaMode::Straight, 2, 32, 0x28),
+        (Channels::Rgba, AlphaMode::Premultiplied, 2, 32, 0x28),
+        (Channels::Alpha, AlphaMode::Straight, 3, 8, 0x20),
+    ] {
+        let name = format!("tga-{channels:?}-{alpha_mode:?}");
+        let tga_dir = out_dir(&name);
+        let png_dir = out_dir(&format!("{name}-png"));
+        let om = OutputModule { channels, alpha_mode, ..OutputModule::for_format(OutputFormat::TargaSequence) };
+        let first = render(&p, cid, &om, &tga_dir);
+        assert!(first.ends_with("f_00000.tga"), "{first}");
+        render(&p, cid, &OutputModule { format: OutputFormat::PngSequence, ..om.clone() }, &png_dir);
+        let mut frames = Vec::new();
+        for (tga, png) in frame_paths(&tga_dir, "tga").iter().zip(frame_paths(&png_dir, "png")) {
+            let t = read_tga(tga);
+            assert_eq!((t.image_type, t.width, t.height, t.depth, t.descriptor), (image_type, W as u16, H as u16, depth, descriptor), "{tga}");
+            assert_eq!(t.rgba, png_rgba(&png), "{tga} matches {png}");
+            frames.push(t.rgba);
+        }
+        // Frame 0 is background only; frames 1 and 2 hold the solid, so the numbering follows
+        // the comp's frames.
+        let at = |f: &[u8], x: u32, y: u32| -> [u8; 4] {
+            let i = ((y * W + x) * 4) as usize;
+            [f[i], f[i + 1], f[i + 2], f[i + 3]]
+        };
+        assert_ne!(at(&frames[0], 3, 1), at(&frames[1], 3, 1), "{name}");
+        assert_eq!(frames[1], frames[2], "{name}");
+        // Top-down rows: the solid is in the top half, the bottom rows are still background.
+        assert_eq!(at(&frames[1], 3, 3), at(&frames[0], 3, 3), "{name}: bottom row");
+        match channels {
+            Channels::Rgb => {
+                assert_eq!(at(&frames[0], 0, 0)[3], 255);
+                assert_eq!(at(&frames[1], 3, 1), [230, 51, 26, 255], "{name}: the opaque solid");
+            }
+            Channels::Rgba => {
+                assert_eq!(at(&frames[0], 0, 0), [0, 0, 0, 0], "{name}: transparent background");
+                assert_eq!(at(&frames[1], 3, 1), [230, 51, 26, 255], "{name}: the opaque solid");
+                let edge = at(&frames[1], 2, 1);
+                assert!(edge[3] > 0 && edge[3] < 255, "{name}: partial alpha at the solid's edge {edge:?}");
+                if alpha_mode == AlphaMode::Straight {
+                    // Unmatted from the renderer's premultiplied pixel: the solid's colour, within rounding.
+                    assert!(edge[..3].iter().zip([230u8, 51, 26]).all(|(a, b)| a.abs_diff(b) <= 1), "{name}: straight colour {edge:?}");
+                } else {
+                    assert!(edge[0] < 230 && edge[0] <= edge[3], "{name}: premultiplied colour {edge:?}");
+                }
+            }
+            Channels::Alpha => {
+                assert_eq!(at(&frames[0], 0, 0), [0, 0, 0, 255], "{name}: no matte yet");
+                assert_eq!(at(&frames[1], 3, 1), [255, 255, 255, 255], "{name}: the solid's matte");
+            }
+        }
+    }
+}
+
+/// Numbered stills read back as an image sequence through the media layer (Targa: #745).
+fn import_sequence(paths: &[String]) -> (Footage, MediaPool) {
+    let pool = MediaPool::new();
+    pool.set_read_ahead(false);
+    let first = effectcraft_media::probe(&paths[0]).expect("probe our output");
+    assert_eq!((first.kind, first.width, first.height), (FootageKind::Still, W, H));
+    for p in paths {
+        let bytes: Arc<[u8]> = std::fs::read(p).expect("read").into();
+        pool.add_bytes(p, bytes);
+    }
+    let mut footage = Footage { kind: FootageKind::Sequence, sequence: paths.to_vec(), ..first };
+    footage.sync_sequence_duration();
+    (footage, pool)
+}
+
+#[test]
+fn targa_sequence_round_trips_through_targa_import() {
+    let (p, cid) = project();
+    for alpha_mode in [AlphaMode::Straight, AlphaMode::Premultiplied] {
+        let name = format!("tga-import-{alpha_mode:?}");
+        let tga_dir = out_dir(&name);
+        let png_dir = out_dir(&format!("{name}-png"));
+        let om = OutputModule { channels: Channels::Rgba, alpha_mode, ..OutputModule::for_format(OutputFormat::TargaSequence) };
+        render(&p, cid, &om, &tga_dir);
+        // The reference: the same job as a straight-alpha PNG sequence (PNG's alpha is labelled).
+        render(&p, cid, &OutputModule { format: OutputFormat::PngSequence, alpha_mode: AlphaMode::Straight, ..om.clone() }, &png_dir);
+        let (mut tga, tga_pool) = import_sequence(&frame_paths(&tga_dir, "tga"));
+        let (png, png_pool) = import_sequence(&frame_paths(&png_dir, "png"));
+        assert_eq!(tga.codec, "TGA");
+        assert_eq!(tga.sequence_frames(), FRAMES as i64);
+        // Targa doesn't label its alpha: import guesses straight, and Interpret Footage sets
+        // premultiplied for a premultiplied render.
+        assert_eq!(tga.alpha, effectcraft_project::AlphaMode::Straight);
+        if alpha_mode == AlphaMode::Premultiplied {
+            tga.alpha = effectcraft_project::AlphaMode::Premultiplied;
+        }
+        // Premultiplying to 8 bits rounds partially transparent colour.
+        let tol = if alpha_mode == AlphaMode::Straight { 0.0 } else { 1.0 / 255.0 };
+        for k in 0..FRAMES as i64 {
+            let a = tga_pool.frame_at(&tga, tga.frame_rate.tick_of(k)).expect("decode Targa");
+            let b = png_pool.frame_at(&png, png.frame_rate.tick_of(k)).expect("decode PNG");
+            assert_eq!((a.width, a.height), (W, H));
+            for (x, y) in a.data.iter().zip(&b.data) {
+                assert!(x.iter().zip(y).all(|(x, y)| (x - y).abs() <= tol), "{name} frame {k}: {x:?} != {y:?}");
+            }
+        }
+        let opaque = tga_pool.frame_at(&tga, tga.frame_rate.tick_of(1)).expect("decode");
+        assert_eq!(opaque.data[opaque.idx(0, 0)][3], 0.0, "{name}: the background stays transparent");
+        assert_eq!(opaque.data[opaque.idx(3, 1)][3], 1.0, "{name}: the solid is opaque");
+    }
+}
diff --git a/crates/export/tests/uncompressed_mov.rs b/crates/export/tests/it/uncompressed_mov.rs
similarity index 100%
rename from crates/export/tests/uncompressed_mov.rs
rename to crates/export/tests/it/uncompressed_mov.rs
diff --git a/crates/export/tests/vp9_roundtrip.rs b/crates/export/tests/it/vp9_roundtrip.rs
similarity index 99%
rename from crates/export/tests/vp9_roundtrip.rs
rename to crates/export/tests/it/vp9_roundtrip.rs
index e7c2b0346..1432e3892 100644
--- a/crates/export/tests/vp9_roundtrip.rs
+++ b/crates/export/tests/it/vp9_roundtrip.rs
@@ -41,7 +41,7 @@ fn source(w: usize, h: usize, kind: u32) -> (Vec<u8>, Vec<u8>, Vec<u8>) {
 }
 
 fn decode(frame: &[u8]) -> filmcraft_vp9::Picture {
-    let mut d = Decoder::new();
+    let mut d = Decoder::with_threads(1);
     let mut pics = d.decode(frame, 0).expect("decode");
     assert_eq!(pics.len(), 1);
     pics.remove(0)
@@ -189,7 +189,7 @@ fn planes_of(p: &filmcraft_vp9::Picture, w: usize, h: usize) -> [Vec<u8>; 3] {
 fn run_sequence(cfg: EncoderConfig, n: usize, kind: u32) -> (usize, f64) {
     let (w, h) = (cfg.width as usize, cfg.height as usize);
     let mut e = Vp9Encoder::new(cfg);
-    let mut d = Decoder::new();
+    let mut d = Decoder::with_threads(1);
     let (mut bytes, mut db) = (0usize, 0.0);
     for t in 0..n {
         let (y, u, v) = moving(w, h, t, kind);
@@ -344,7 +344,7 @@ fn frames_never_end_in_a_superframe_marker() {
     }
     let Some((w, h, q, frames, recon)) = padded else { panic!("no frame needed the padding: widen the search") };
     // The padded frames decode exactly, with FilmCraft's decoder and with ffmpeg.
-    let mut d = Decoder::new();
+    let mut d = Decoder::with_threads(1);
     for (t, (f, r)) in frames.iter().zip(&recon).enumerate() {
         let mut pics = d.decode(f, t as i64).unwrap_or_else(|e| panic!("{w}x{h} q{q} frame {t}: {e:?}"));
         assert_eq!(planes_of(&pics.remove(0), w, h), *r, "{w}x{h} q{q} frame {t}");
diff --git a/crates/expr/src/host.rs b/crates/expr/src/host.rs
index f98b895a5..43400ea1d 100644
--- a/crates/expr/src/host.rs
+++ b/crates/expr/src/host.rs
@@ -10,7 +10,7 @@
 use effectcraft_geom::{Mat3, Mat4};
 use effectcraft_keyframe::Value;
 use effectcraft_project::{Comp, ItemId, ItemKind, Layer, LayerId, LayerSource, Node, PropGroup, Property};
-use effectcraft_render::{EvalCtx, source_size};
+use effectcraft_render::EvalCtx;
 use effectcraft_time::Tick;
 
 /// A name-or-index argument (`layer("A")`, `layer(2)`, `effect(1)`).
@@ -297,9 +297,21 @@ impl<'a> Resolver<'a> {
         }
         self.comp(c)?.layer(LayerId(l))
     }
+    /// The evaluation context for comp `c` at time `t` seconds, or `None` when the comp does not exist.
     fn ctx_at(&self, c: u64, t: f64) -> Option<EvalCtx<'a>> {
         let comp = self.comp(c)?;
-        Some(EvalCtx { project: self.ctx.project, comp_id: ItemId(c), comp, time: Tick::from_seconds_f64(t), expr: self.ctx.expr, footage: self.ctx.footage })
+        let same_comp = c == self.ctx.comp_id.0;
+        Some(EvalCtx {
+            project: self.ctx.project,
+            comp_id: ItemId(c),
+            comp,
+            time: Tick::from_seconds_f64(t),
+            expr: self.ctx.expr,
+            footage: self.ctx.footage,
+            property_overrides: if same_comp { self.ctx.property_overrides } else { &[] },
+            media_overrides: if same_comp { self.ctx.media_overrides } else { &[] },
+            reads: self.ctx.reads,
+        })
     }
     fn prop(&self, c: u64, l: u64, path: &str) -> Option<(&'a Layer, &'a Property)> {
         let layer = self.layer(c, l)?;
@@ -313,6 +325,32 @@ impl<'a> Resolver<'a> {
         self.try_resolve(req).unwrap_or(Resp::Null)
     }
 
+    /// Resolve an ancestor from its UID path while preserving child indexing.
+    fn ancestor(&self, comp: u64, layer: u64, path: &str, up: i64) -> Option<Resp> {
+        let l = self.layer(comp, layer)?;
+        // The node's full `@uid/@uid/…` path from the layer: its ancestors are its prefixes.
+        let uid = match self.prop(comp, layer, path) {
+            Some((_, p)) => p.uid,
+            None => l.props.node(path)?.uid(),
+        };
+        let full = l.props.path_of(uid)?;
+        let segs: Vec<&str> = full.split('/').collect();
+        let up = usize::try_from(up).ok().filter(|u| *u >= 1 && *u <= segs.len())?;
+        if up == segs.len() {
+            return Some(Resp::Str("layer".into()));
+        }
+        let keep = segs.len() - up;
+        let group_path = segs.get(..keep)?.join("/");
+        let parent = match keep {
+            1 => &l.props,
+            _ => l.props.group(&segs.get(..keep - 1)?.join("/"))?,
+        };
+        let uid = segs.get(keep - 1)?.strip_prefix('@')?.parse::<u64>().ok()?;
+        let index = parent.children.iter().position(|c| c.uid() == uid)?;
+        let n = parent.children.get(index)?;
+        Some(node_resp(group_path, n, index + 1))
+    }
+
     fn try_resolve(&self, req: &Req) -> Option<Resp> {
         let project = self.ctx.project;
         Some(match req {
@@ -346,7 +384,7 @@ impl<'a> Resolver<'a> {
             Req::LayerInfo { comp, layer } => {
                 let c = self.comp(*comp)?;
                 let l = self.layer(*comp, *layer)?;
-                let (mut w, mut h) = source_size(project, l);
+                let (mut w, mut h) = self.ctx_at(*comp, self.ctx.time.seconds())?.source_size(l);
                 if w == 0 || h == 0 {
                     (w, h) = (c.width, c.height);
                 }
@@ -373,30 +411,7 @@ impl<'a> Resolver<'a> {
                 let path = if group.is_empty() { format!("@{}", n.uid()) } else { format!("{group}/@{}", n.uid()) };
                 node_resp(path, n, index)
             }
-            Req::Ancestor { comp, layer, path, up } => {
-                let l = self.layer(*comp, *layer)?;
-                // The node's full `@uid/@uid/…` path from the layer: its ancestors are its prefixes.
-                let uid = match self.prop(*comp, *layer, path) {
-                    Some((_, p)) => p.uid,
-                    None => l.props.node(path)?.uid(),
-                };
-                let full = l.props.path_of(uid)?;
-                let segs: Vec<&str> = full.split('/').collect();
-                let up = usize::try_from(*up).ok().filter(|u| *u >= 1 && *u <= segs.len())?;
-                if up == segs.len() {
-                    return Some(Resp::Str("layer".into()));
-                }
-                let keep = segs.len() - up;
-                let group_path = segs.get(..keep)?.join("/");
-                let parent = match keep {
-                    1 => &l.props,
-                    _ => l.props.group(&segs.get(..keep - 1)?.join("/"))?,
-                };
-                let uid = segs.get(keep - 1)?.strip_prefix('@')?.parse::<u64>().ok()?;
-                let index = parent.children.iter().position(|c| c.uid() == uid)?;
-                let n = parent.children.get(index)?;
-                node_resp(group_path, n, index + 1)
-            }
+            Req::Ancestor { comp, layer, path, up } => return self.ancestor(*comp, *layer, path, *up),
             Req::PropInfo { comp, layer, path } => {
                 let (l, p) = self.prop(*comp, *layer, path)?;
                 let dims = prop_dims(l, p);
@@ -464,7 +479,7 @@ impl<'a> Resolver<'a> {
                         }
                     }
                     _ => {
-                        let (w, h) = source_size(project, l);
+                        let (w, h) = ctx.source_size(l);
                         [0.0, 0.0, w as f64, h as f64]
                     }
                 };
@@ -498,7 +513,12 @@ impl<'a> Resolver<'a> {
             Req::SourceInfo { comp, layer } => {
                 let c = self.comp(*comp)?;
                 let l = self.layer(*comp, *layer)?;
-                let it = project.item(l.source.item()?)?;
+                let ctx = self.ctx_at(*comp, self.ctx.time.seconds())?;
+                let item = match &l.source {
+                    LayerSource::Footage { item } => ctx.media_item(l, *item),
+                    _ => l.source.item()?,
+                };
+                let it = project.item(item)?;
                 let (kind, aspect, frame, duration) = match &it.kind {
                     ItemKind::Comp(nc) => ("comp", nc.pixel_aspect, nc.frame_duration().seconds(), nc.duration.seconds()),
                     ItemKind::Footage(f) => ("footage", f.pixel_aspect, f.frame_rate.frame_duration().seconds(), f.duration.seconds()),
diff --git a/crates/expr/src/lib.rs b/crates/expr/src/lib.rs
index 4963810c4..ae9e647f8 100644
--- a/crates/expr/src/lib.rs
+++ b/crates/expr/src/lib.rs
@@ -17,7 +17,8 @@
 //!   `sourceRectAtTime`), property methods (`valueAtTime`, `velocityAtTime`, `speedAtTime`, `key`,
 //!   `nearestKey`, `numKeys`, `wiggle`, `temporalWiggle`, `smooth`, `loopIn/Out[Duration]`) and the
 //!   global helpers (`linear`/`ease`/`easeIn`/`easeOut`, `random`/`gaussRandom`/`seedRandom`/
-//!   `noise`, vector maths, `clamp`, `lookAt`, time and colour conversions, `posterizeTime`).
+//!   `noise`, vector maths, `clamp`, `lookAt`, time and colour conversions, `posterizeTime`),
+//!   plus `bezier`, a CSS-style cubic-Bezier easing helper that After Effects does not have.
 //! * **Determinism**: `wiggle` and `random` are seeded by layer index, property uid (and time /
 //!   `seedRandom`), so frames render identically on every thread and platform.
 //! * **Runtime**: one boa `Context` per thread with compiled scripts cached by text. Scripts read
@@ -93,7 +94,7 @@ impl ExprHost for Expressions {
             return Ok([v.first().copied().unwrap_or(100.0), v.get(1).copied().unwrap_or(100.0), v.get(2).copied().unwrap_or(100.0)]);
         };
         let value = prop.value_at(layer.layer_time(ctx.time));
-        let out = evaluate_out(self, ctx, layer, prop, &value, &e.text, [index as f64 + 1.0, total as f64], selector)?;
+        let out = evaluate_out(self, ctx, layer, prop, &value, &e.text, TextSelector { index_total: [index as f64 + 1.0, total as f64], value: selector })?;
         let num = |o: &runtime::Out| match o {
             runtime::Out::Num(x) => Some(*x),
             runtime::Out::Bool(b) => Some(if *b { 100.0 } else { 0.0 }),
@@ -124,13 +125,17 @@ impl Drop for FrameGuard {
 /// Evaluate `text` as the expression of `prop` on `layer` at `ctx.time`, given its keyframed
 /// `value`. Other properties' expressions are evaluated through `host`.
 pub fn evaluate(host: &dyn ExprHost, ctx: &EvalCtx, layer: &Layer, prop: &Property, value: &Value, text: &str) -> Result<Value, String> {
-    let out = evaluate_out(host, ctx, layer, prop, value, text, [1.0, 1.0], [100.0; 3])?;
+    let out = evaluate_out(host, ctx, layer, prop, value, text, TextSelector { index_total: [1.0, 1.0], value: [100.0; 3] })?;
     runtime::to_value(&out, value)
 }
 
-/// Run an expression and return the raw script result. `text_sel` / `selector` are the text
-/// Expression Selector's `[textIndex, textTotal]` and `selectorValue`.
-#[allow(clippy::too_many_arguments)]
+/// Expression Selector state: `[textIndex, textTotal]` and `selectorValue`.
+struct TextSelector {
+    index_total: [f64; 2],
+    value: [f64; 3],
+}
+
+/// Run an expression and return the raw script result.
 fn evaluate_out(
     host: &dyn ExprHost,
     ctx: &EvalCtx,
@@ -138,9 +143,9 @@ fn evaluate_out(
     prop: &Property,
     value: &Value,
     text: &str,
-    text_sel: [f64; 2],
-    selector: [f64; 3],
+    text_selector: TextSelector,
 ) -> Result<runtime::Out, String> {
+    let TextSelector { index_total: text_sel, value: selector } = text_selector;
     let owner = Owner { comp: ctx.comp_id.0, layer: layer.id.0, uid: prop.uid, time: ctx.time, text: text.to_string() };
     let (depth, cycle) = FRAMES.with(|f| {
         let f = f.borrow();
@@ -158,7 +163,17 @@ fn evaluate_out(
         return Err("Error: expressions reference each other too deeply (circular reference?)".into());
     }
     budget_left()?;
-    let ctx = EvalCtx { project: ctx.project, comp_id: ctx.comp_id, comp: ctx.comp, time: ctx.time, expr: Some(host), footage: ctx.footage };
+    let ctx = EvalCtx {
+        project: ctx.project,
+        comp_id: ctx.comp_id,
+        comp: ctx.comp,
+        time: ctx.time,
+        expr: Some(host),
+        footage: ctx.footage,
+        property_overrides: ctx.property_overrides,
+        media_overrides: ctx.media_overrides,
+        reads: ctx.reads,
+    };
     let comp = ctx.comp_id.0;
     let path = layer.props.path_of(prop.uid).unwrap_or_else(|| format!("@{}", prop.uid));
     let resolver = Resolver { ctx, own: Own { comp, layer, prop, path: path.clone() } };
diff --git a/crates/expr/src/prelude.js b/crates/expr/src/prelude.js
index 4da7bc63b..cc0405251 100644
--- a/crates/expr/src/prelude.js
+++ b/crates/expr/src/prelude.js
@@ -31,6 +31,7 @@ function __begin(t, v, c, l, path, uid, idx, fd, ti, tt, sv) {
   __seed = 0;
   __timeless = false;
   __projectInfo = null;
+  __layersTrim();
 }
 
 function __finish(r) {
@@ -44,7 +45,7 @@ function __finish(r) {
 
 function __result(r) {
   r = __v(r);
-  if (r !== null && typeof r === 'object' && r.__isLayer) return r.index;
+  if (typeof r === 'function' && r.__isLayer) return r.index;
   if (r !== null && typeof r === 'object' && r.__isTextStyle) return r.__out();
   // `[temp, temp]` where temp is a property (pick-whip 1D → 2D): read the values here, while
   // host requests can still be answered and the script re-run.
@@ -166,12 +167,28 @@ function normalize(a) {
   return l === 0 ? a.map(function () { return 0; }) : div(a, l);
 }
 
+// Orientation that points the layer's z axis at `at` with its x axis kept level, in the
+// Orientation order (Rx · Ry · Rz) and wrapped to [0, 360), as After Effects returns it.
 function lookAt(from, at) {
   var d = normalize(sub(__v(at), __v(from)));
   var x = d[0], y = d[1], z = d[2] || 0;
-  var rx = -Math.asin(Math.max(-1, Math.min(1, y))) * 180 / Math.PI;
-  var ry = Math.atan2(x, z) * 180 / Math.PI;
-  return [rx, ry, 0];
+  var p = Math.asin(Math.max(-1, Math.min(1, -y)));
+  var w = Math.atan2(x, z);
+  var cw = Math.cos(w), sw = Math.sin(w), cp = Math.cos(p), sp = Math.sin(p);
+  // The rotation Ry(w) · Rx(p), written as Orientation angles.
+  var oy = Math.asin(Math.max(-1, Math.min(1, sw * cp)));
+  var ox, oz;
+  if (Math.sqrt(cw * cw + sw * sw * sp * sp) > 1e-9) {
+    ox = Math.atan2(sp, cw * cp);
+    oz = Math.atan2(-sw * sp, cw);
+  } else {
+    ox = Math.atan2(cw * sp, cp);
+    oz = 0;
+  }
+  return [ox, oy, oz].map(function (r) {
+    var a = ((r * 180 / Math.PI) % 360 + 360) % 360;
+    return a >= 360 - 1e-9 || Math.abs(a) < 1e-9 ? 0 : a;
+  });
 }
 
 function degreesToRadians(d) { return d * Math.PI / 180; }
@@ -207,6 +224,60 @@ function ease() { return __interp(__ease, arguments); }
 function easeIn() { return __interp(__easeIn, arguments); }
 function easeOut() { return __interp(__easeOut, arguments); }
 
+// Cubic-Bezier easing (the CSS cubic-bezier() shape): [x1, y1, x2, y2], with x1 / x2 in 0..1
+// and y1 / y2 free (overshoot included). Solves x(u) = x by Newton–Raphson, then by bisection
+// when Newton leaves 0..1 or the derivative vanishes, and returns y(u). A curve that is not four
+// finite numbers is linear, never an error.
+function __cubicBezier(curve) {
+  var x1, y1, x2, y2;
+  if (Array.isArray(curve) && curve.length === 4) {
+    x1 = curve[0]; y1 = curve[1]; x2 = curve[2]; y2 = curve[3];
+  }
+  if (typeof x1 !== 'number' || typeof y1 !== 'number' || typeof x2 !== 'number' || typeof y2 !== 'number' ||
+      !isFinite(x1) || !isFinite(y1) || !isFinite(x2) || !isFinite(y2)) {
+    return __lin;
+  }
+  x1 = Math.max(0, Math.min(1, x1));
+  x2 = Math.max(0, Math.min(1, x2));
+  function bx(u) { var v = 1 - u; return 3 * v * v * u * x1 + 3 * v * u * u * x2 + u * u * u; }
+  function dbx(u) { var v = 1 - u; return 3 * v * v * x1 + 6 * v * u * (x2 - x1) + 3 * u * u * (1 - x2); }
+  function by(u) { var v = 1 - u; return 3 * v * v * u * y1 + 3 * v * u * u * y2 + u * u * u; }
+  function dby(u) { var v = 1 - u; return 3 * v * v * y1 + 6 * v * u * (y2 - y1) + 3 * u * u * (1 - y2); }
+  return function (x) {
+    if (x <= 0) return 0;
+    if (x >= 1) return 1;
+    var u = x;
+    for (var i = 0; i < 8; i++) {
+      var f = bx(u) - x;
+      var d = dbx(u);
+      if (Math.abs(d) < 1e-12) break;
+      // Stop when the *value* is accurate: near the endpoints dy/dx is steep, so a residual in x
+      // alone can still mean a visible error in y (f * dy/dx estimates it).
+      if (Math.abs(f * dby(u) / d) < 1e-9) return by(u);
+      var n = u - f / d;
+      if (!(n >= 0 && n <= 1)) break;
+      u = n;
+    }
+    var lo = 0, hi = 1;
+    for (var j = 0; j < 60; j++) {
+      var mid = (lo + hi) / 2;
+      if (bx(mid) < x) lo = mid; else hi = mid;
+    }
+    return by((lo + hi) / 2);
+  };
+}
+
+// bezier(t, tMin, tMax, value1, value2, curve), or bezier(t, value1, value2, curve): the curve is
+// the sixth / fourth argument. Read it by position, not from the end: when it is missing or
+// unusable, the interpolation falls back to linear without consuming the last value.
+function bezier() {
+  var a = arguments, n = a.length;
+  if (n >= 6) return __interp(__cubicBezier(a[5]), [a[0], a[1], a[2], a[3], a[4]]);
+  if (n === 5) return __interp(__lin, [a[0], a[1], a[2], a[3], a[4]]);
+  if (n === 4) return __interp(__cubicBezier(a[3]), [a[0], a[1], a[2]]);
+  return __interp(__lin, [a[0], a[1], a[2]]);
+}
+
 // ---------------------------------------------------------------------------------------------
 // Random numbers and noise.
 
@@ -434,7 +505,7 @@ function __ancestor(c, l, path, countUp) {
   if (typeof n !== 'number' || !(n >= 1) || !isFinite(n)) __err('propertyGroup(' + countUp + '): the count must be a number of 1 or more');
   n = Math.floor(n);
   var info = __h(__ANCESTOR, c, l, path, n);
-  if (info === 'layer') return new Layer(c, l);
+  if (info === 'layer') return __layer(c, l);
   if (info === null) __err('propertyGroup(' + n + ') goes above the layer');
   return __mkGroup(c, l, info);
 }
@@ -461,13 +532,13 @@ Comp.prototype = {
       var l = this.layer(i);
       if (l.__info[10] === 'Camera' && l.active) return l;
     }
-    __err('Composition "' + this.name + '" has no active camera');
+    return __err('Composition "' + this.name + '" has no active camera');
   },
   layer: function (a, rel) {
-    if (a !== null && typeof a === 'object' && a.__isLayer) return this.layer(a.index + (rel || 0));
+    if (typeof a === 'function' && a.__isLayer) return this.layer(a.index + (rel || 0));
     var id = __h(__LAYER, this.__c, a);
     if (id === null) __err(typeof a === 'string' ? 'Layer named "' + a + '" does not exist' : 'Layer index ' + a + ' out of range');
-    return new Layer(this.__c, id);
+    return __layer(this.__c, id);
   },
   toString: function () { return '[object Comp]'; },
 };
@@ -542,7 +613,55 @@ var thisProject = {
 
 // Layer -----------------------------------------------------------------------------------------
 
-function Layer(c, l) { this.__c = c; this.__l = l; this.__i = null; }
+// A layer is a property group too, as in After Effects: `thisLayer("transform")`, another layer's
+// `("effects")("Slider Control")`, `thisLayer(1)` (what the pick whip writes with Compact English
+// off). Callable like a group (`__mkGroup`), with the Layer methods.
+function Layer(c, l) {
+  var f = function (k) { return f.__group(k); };
+  delete f.name;
+  delete f.length;
+  Object.setPrototypeOf(f, Layer.prototype);
+  // Kept across evaluations (`__layer`), so an expression can't change which layer it is, delete
+  // a field or leave its own on it. Its info is private to `__info`, which reads it again in an
+  // evaluation whose `__S` isn't the one it was read in (every evaluation has a new `__S`), so
+  // freezing the layer can't keep its info either.
+  var info = null, read = null;
+  Object.defineProperty(f, '__c', { value: c });
+  Object.defineProperty(f, '__l', { value: l });
+  Object.defineProperty(f, '__info', {
+    get: function () {
+      if (read !== __S) { info = __h(__LINFO, c, l); read = __S; }
+      return info;
+    },
+  });
+  Object.preventExtensions(f);
+  return f;
+}
+
+// Layer `l` of comp `c`, made once per runtime: a callable Layer is dearer to make than a plain
+// object, so it is kept, and its info (`__info`) is read again in each evaluation.
+// The kept layers are out of an expression's reach (their maps have no prototype, so a change to
+// `Object.prototype` doesn't reach them either), and bounded like the runtime's scripts: once
+// `max` are kept, the layers after them aren't, and the next evaluation starts over
+// (`__layersTrim`, so a layer stays the same object for a whole evaluation).
+var __layer, __layersTrim;
+(function () {
+  var layers = Object.create(null), kept = 0, max = 4096;
+  __layer = function (c, l) {
+    // By comp, then layer: a `c + ':' + l` key costs more to build than the lookup saves.
+    var m = layers[c], f = m && m[l];
+    if (f) return f;
+    f = new Layer(c, l);
+    if (kept < max) {
+      (m || (layers[c] = Object.create(null)))[l] = f;
+      kept++;
+    }
+    return f;
+  };
+  __layersTrim = function () {
+    if (kept >= max) { layers = Object.create(null); kept = 0; }
+  };
+})();
 
 function __m3(m, p) {
   var x = p[0] || 0, y = p[1] || 0;
@@ -566,7 +685,6 @@ function __m4(m, p, vec) {
 
 Layer.prototype = {
   __isLayer: true,
-  get __info() { return this.__i || (this.__i = __h(__LINFO, this.__c, this.__l)); },
   get name() { return this.__info[0]; },
   get index() { return this.__info[1]; },
   get inPoint() { return this.__info[2]; },
@@ -578,7 +696,7 @@ Layer.prototype = {
   get parent() {
     var p = this.__info[7];
     if (p === null) __err('Layer "' + this.name + '" has no parent');
-    return new Layer(this.__c, p);
+    return __layer(this.__c, p);
   },
   get hasVideo() { return this.__info[8]; },
   get enabled() { return this.__info[11]; },
@@ -670,14 +788,17 @@ var __groupHandler = {
   },
 };
 
-function __mkGroup(c, l, info) {
-  var f = function (k) { return f.__get(k); };
-  delete f.name;
-  delete f.length;
-  Object.setPrototypeOf(f, __GroupProto);
-  f.__c = c; f.__l = l; f.__p = info[0]; f.__info = info;
-  return new Proxy(f, __groupHandler);
-}
+// `Proxy` is private to the object model (see "Stack safety" at the end).
+var __mkGroup = (function (P) {
+  return function (c, l, info) {
+    var f = function (k) { return f.__get(k); };
+    delete f.name;
+    delete f.length;
+    Object.setPrototypeOf(f, __GroupProto);
+    f.__c = c; f.__l = l; f.__p = info[0]; f.__info = info;
+    return new P(f, __groupHandler);
+  };
+})(Proxy);
 
 // Properties ------------------------------------------------------------------------------------
 
@@ -747,7 +868,7 @@ Prop.prototype = {
   propertyGroup: function (n) { return __ancestor(this.__c, this.__l, this.__p, n); },
   __wrap: function (v) {
     var kind = this.__info[2];
-    if (kind === 'layer') return v === null ? null : new Layer(this.__c, v);
+    if (kind === 'layer') return v === null ? null : __layer(this.__c, v);
     if (kind === 'path' && v !== null) return new __Path(v[0], v[1], v[2], v[3]);
     return v;
   },
@@ -777,7 +898,7 @@ Prop.prototype = {
     for (var i = 1; i < times.length; i++) if (Math.abs(times[i] - t) < Math.abs(times[best] - t)) best = i;
     return this.key(best + 1);
   },
-  __seedIndex: function () { return this.__self ? __S.idx : new Layer(this.__c, this.__l).index; },
+  __seedIndex: function () { return this.__self ? __S.idx : __layer(this.__c, this.__l).index; },
   wiggle: function (freq, amp, octaves, ampMult, t) {
     if (octaves === undefined) octaves = 1;
     if (ampMult === undefined) ampMult = 0.5;
@@ -840,21 +961,24 @@ var __propHandler = {
     // A layer-valued property (a Layer Control's Layer) is named as its layer (#809).
     if (k === 'name' && t.__info[2] === 'layer') {
       var lv = t.value;
-      if (lv !== null && lv !== undefined && lv.__isLayer) return lv.name;
+      if (lv?.__isLayer) return lv.name;
     }
     if (k in t) return t[k];
     var v = t.value;
     if (v === null || v === undefined) return undefined;
     var x = v[k];
-    // Property groups are callable proxies: hand them over as they are, not bound like methods (#809).
-    if (x !== null && x !== undefined && x.__isGroup) return x;
+    // Property groups and layers are callable: hand them over as they are, not bound like methods
+    // (#809).
+    if (typeof x === 'function' && (x.__isGroup || x.__isLayer)) return x;
     return typeof x === 'function' ? x.bind(v) : x;
   },
 };
 
-function __mkProp(c, l, path) {
-  return new Proxy(new Prop(c, l, path), __propHandler);
-}
+var __mkProp = (function (P) {
+  return function (c, l, path) {
+    return new P(new Prop(c, l, path), __propHandler);
+  };
+})(Proxy);
 
 // Text styles (the Source Text style API) ------------------------------------------------------
 // A TextStyle is the source document (as JSON from the host), the character index it reads its
@@ -904,8 +1028,8 @@ __TextStyle.prototype = {
   },
   get text() {
     var t = this.__d.text;
-    for (var k = 0; k < this.__ops.length; k++) {
-      var o = this.__ops[k];
+    for (const elem of this.__ops) {
+      var o = elem;
       if (o[0] !== 'text') continue;
       if (o[2] < 0) t = String(o[1]);
       else t = t.slice(0, o[2]) + String(o[1]) + (o[3] < 0 ? '' : t.slice(o[2] + o[3]));
@@ -1023,20 +1147,20 @@ Markers.prototype = {
 // ---------------------------------------------------------------------------------------------
 // Unqualified names: thisLayer / thisProperty attributes and the `this*` objects. They're
 // accessors on the global object; assigning one (`var width = 10`) shadows it for the current
-// evaluation only.
+// evaluation only. They can't be deleted or redefined, so an expression can't take one away from
+// the evaluations after it.
 
 function __global(name, get) {
   Object.defineProperty(globalThis, name, {
-    configurable: true,
     get: function () { return name in __S.vars ? __S.vars[name] : get(); },
     set: function (v) { __S.vars[name] = v; },
   });
 }
 
 __global('thisComp', function () { return __S.comp || (__S.comp = new Comp(__S.c)); });
-__global('thisLayer', function () { return __S.layer || (__S.layer = new Layer(__S.c, __S.l)); });
+__global('thisLayer', function () { return __S.layer || (__S.layer = __layer(__S.c, __S.l)); });
 __global('thisProperty', function () { return __S.prop || (__S.prop = __mkProp(__S.c, __S.l, __S.path)); });
-['name', 'index', 'inPoint', 'outPoint', 'startTime', 'width', 'height', 'hasParent', 'parent', 'hasVideo', 'enabled', 'active',
+['name', 'index', 'inPoint', 'outPoint', 'startTime', 'width', 'height', 'hasParent', 'parent', 'hasVideo', 'enabled', 'active', 'source',
   'transform', 'position', 'scale', 'rotation', 'opacity', 'anchorPoint', 'text', 'marker'].forEach(function (k) {
   __global(k, function () { return thisLayer[k]; });
 });
@@ -1069,3 +1193,276 @@ function velocityAtTime(t) { return thisProperty.velocityAtTime(t); }
 function speedAtTime(t) { return thisProperty.speedAtTime(t); }
 function key(n) { return thisProperty.key(n); }
 function nearestKey(t) { return thisProperty.nearestKey(t); }
+
+// ---------------------------------------------------------------------------------------------
+// Stack safety (#2124, #2125). A stack overflow aborts the whole app, so nothing a script does
+// may nest native code without bound. The expression text is checked for nesting before it is
+// compiled; source handed to `eval` and the function constructors at run time is checked by
+// `__nest`. The natives that walk nested values recursively (`join`, which `toString` and string
+// conversion use, `toLocaleString`, `JSON.stringify`, `flat`) call `__stack` once per level,
+// which throws once the run has used its share of the stack. `Proxy` (chains of proxies nest
+// without any script frame) and `Reflect` are not available to expressions.
+(function () {
+  var nest = __nest, stack = __stack, apply = Reflect.apply, construct = Reflect.construct;
+  var define = Object.defineProperty, describe = Object.getOwnPropertyDescriptor, proto = Object.getPrototypeOf;
+  // Replace `obj[name]` keeping its attributes.
+  function replace(obj, name, f) {
+    var d = describe(obj, name);
+    define(obj, name, { value: f, writable: d.writable, enumerable: d.enumerable, configurable: true });
+  }
+  function guard(obj, name) {
+    var f = obj[name];
+    replace(obj, name, function () { stack(); return apply(f, this, arguments); });
+  }
+
+  // Indirect on purpose: a wrapper can't make a direct eval, so `eval` sees globals and `var`s
+  // but not `let`/`const` locals of the expression. Keeping direct eval would mean leaving it
+  // unchecked; expressions practically never need their locals inside eval.
+  var evalJs = eval;
+  eval = function (x) {
+    if (typeof x === 'string') {
+      stack();
+      nest(x);
+    }
+    return evalJs(x);
+  };
+  // `Function` and the generator / async variants (reachable as `(function* () {}).constructor`).
+  function dynamic(F) {
+    var w = function () {
+      var args = [];
+      for (var i = 0; i < arguments.length; i++) args.push(String(arguments[i]));
+      stack();
+      nest(args.slice(0, -1).join(','));
+      nest(args.length ? args[args.length - 1] : '');
+      return construct(F, args);
+    };
+    define(w, 'name', { value: F.name, configurable: true });
+    w.prototype = F.prototype;
+    replace(F.prototype, 'constructor', w);
+    return w;
+  }
+  Function = dynamic(Function);
+  dynamic(proto(function* () {}).constructor);
+  dynamic(proto(async function () {}).constructor);
+  dynamic(proto(async function* () {}).constructor);
+
+  guard(Array.prototype, 'join');
+  guard(Array.prototype, 'toLocaleString');
+  var flat = Array.prototype.flat;
+  replace(Array.prototype, 'flat', function (depth) {
+    stack();
+    var d = depth === undefined ? 1 : Number(depth);
+    return apply(flat, this, [d > 64 ? 64 : d]);
+  });
+
+  // A replacer function sees every value before it is serialized: the per-level check. An array
+  // replacer (a list of keys) becomes one that copies each object's listed keys, in list order.
+  // Each source object gets one copy per call, so a cycle in the source is a cycle of copies and
+  // the native check reports it (TypeError); an object shared without a cycle is still fine.
+  var stringify = JSON.stringify, MapJs = Map;
+  replace(JSON, 'stringify', function (value, replacer, space) {
+    var fn = typeof replacer === 'function' ? replacer : null;
+    var keys = null, copies = new MapJs();
+    if (Array.isArray(replacer)) {
+      keys = [];
+      for (var i = 0; i < replacer.length; i++) {
+        var k = replacer[i];
+        if (typeof k === 'number' || k instanceof Number || k instanceof String) k = String(k);
+        if (typeof k === 'string' && keys.indexOf(k) < 0) keys.push(k);
+      }
+    }
+    return apply(stringify, JSON, [value, function (key, v) {
+      stack();
+      if (fn !== null) v = apply(fn, this, [key, v]);
+      if (keys !== null && v !== null && typeof v === 'object' && !Array.isArray(v) &&
+          !(v instanceof Number || v instanceof String || v instanceof Boolean)) {
+        var o = copies.get(v);
+        if (o === undefined) {
+          o = {};
+          for (var j = 0; j < keys.length; j++) if (keys[j] in v) o[keys[j]] = v[keys[j]];
+          copies.set(v, o);
+        }
+        v = o;
+      }
+      return v;
+    }, space]);
+  });
+
+  delete globalThis.Proxy;
+  delete globalThis.Reflect;
+})();
+
+// ---------------------------------------------------------------------------------------------
+// The runtime runs this file once and keeps it for the thread's later evaluations, so an
+// expression can't change the object model or the internals: the prototypes are frozen, and the
+// `__` globals, the constructors and `thisProject` can't be reassigned. The `__` state below is
+// set again by `__begin` in each evaluation.
+
+[Comp, Footage, Layer, Prop, Markers, __Path, __TextStyle].forEach(function (f) {
+  Object.freeze(f.prototype);
+  Object.freeze(f);
+});
+[__GroupProto, __groupHandler, __propHandler, thisProject].forEach(Object.freeze);
+(function () {
+  var perEvaluation = { __S: true, __rc: true, __seed: true, __timeless: true, __projectInfo: true };
+  var model = { Comp: true, Footage: true, Layer: true, Prop: true, Markers: true, thisProject: true };
+  Object.getOwnPropertyNames(globalThis).forEach(function (k) {
+    if (!(k.slice(0, 2) === '__' && !perEvaluation[k]) && !model[k]) return;
+    if ('value' in Object.getOwnPropertyDescriptor(globalThis, k)) Object.defineProperty(globalThis, k, { writable: false, configurable: false });
+  });
+})();
+
+// ---------------------------------------------------------------------------------------------
+// One runtime serves every expression on a thread, and user code runs as a script at global
+// scope, so `linear = …` or a top-level `var clamp` would otherwise rebind a prelude name for
+// every later expression, and for every later project in the session (#2133). The block above
+// closes the `__` globals, the model constructors and the prelude's own prototypes; what is left
+// is the rest of the global surface: the prelude's own helpers (`linear`, `clamp`, `wiggle`), the
+// JavaScript built-ins that an expression and the prelude both call, and the prototypes those
+// hang off. A non-writable, non-configurable binding makes such a write a silent no-op in sloppy
+// mode, and `var` leaves an existing global property alone. A name the user introduces is not
+// frozen, so an expression that declares its own functions still works.
+(function () {
+  var g = globalThis;
+  // Every intrinsic this block needs, read once before the first prototype is rewritten. The
+  // block turns `Array.prototype.concat` and `forEach` into accessors as it goes, so reaching for
+  // them through a prototype part-way down the list would be reaching for something it has just
+  // changed under itself: the loops below index arrays directly for the same reason.
+  var describe = Object.getOwnPropertyDescriptor, define = Object.defineProperty;
+  var getNames = Object.getOwnPropertyNames, getSyms = Object.getOwnPropertySymbols;
+  var freeze = Object.freeze, isFrozen = Object.isFrozen, isExtensible = Object.isExtensible;
+  var protoOf = Object.getPrototypeOf;
+
+  var lock = function (n) {
+    var d = describe(g, n);
+    if (!d || !d.writable) return;
+    define(g, n, { value: d.value, writable: false, enumerable: d.enumerable, configurable: false });
+  };
+
+  // `name` and `message` on an error's prototype are the two names the repair below has to leave
+  // alone. The host renders a thrown error by reading both straight off the object, with no
+  // context to call a getter with, and it has no way to run one safely either: the time budget is
+  // checked between polls of the evaluation, and formatting happens after that returns, so a
+  // getter of the expression's own would run outside it — bounded by the loop and recursion limits
+  // at some hundreds of millions of iterations, which is a hang. Left as data properties they are
+  // frozen rather than repaired, so `e.name = 'MyError'` on an expression's own error is dropped
+  // in silence. That is the cost; an unbounded getter in the failure path is not worth paying to
+  // avoid it.
+  var HOST_READ = ['name', 'message'];
+  var hostRead = [];
+  var errorNames = ['Error', 'EvalError', 'RangeError', 'ReferenceError', 'SyntaxError', 'TypeError',
+    'URIError', 'AggregateError'];
+  for (var e = 0; e < errorNames.length; e++) {
+    var C = g[errorNames[e]];
+    if (typeof C === 'function') {
+      var cd = describe(C, 'prototype');
+      if (cd && 'value' in cd) hostRead.push(cd.value);
+    }
+  }
+  var readByHost = function (p, n) {
+    for (var i = 0; i < HOST_READ.length; i++) {
+      if (n !== HOST_READ[i]) continue;
+      for (var j = 0; j < hostRead.length; j++) if (hostRead[j] === p) return true;
+    }
+    return false;
+  };
+
+  // Freezing a prototype costs an expression the right to shadow an inherited name on its own
+  // object: once the inherited data property is non-writable, `o.toString = …` is dropped in
+  // sloppy mode rather than creating an own property — the "override mistake". That is ordinary
+  // expression code: `counts[w]` with `w` of "constructor" or "valueOf" uses an object as a
+  // dictionary, and `a.map = …` gives one array its own version of a method. So every name that
+  // was shadowable before the freeze becomes an accessor whose setter writes an own property on
+  // the instance, which leaves the shadowing that worked before this block working after it.
+  var tolerate = function (p, n) {
+    var d = describe(p, n);
+    // An accessor has no value to stand in for, and a name already non-writable or
+    // non-configurable could not be shadowed before this ran either: no regression to repair.
+    if (!d || !d.configurable || !('value' in d) || !d.writable) return;
+    var v = d.value;
+    define(p, n, {
+      get: function () { return v; },
+      set: function (nv) {
+        // This setter stands in for the data property it replaced, so it answers a write the way
+        // that property would: an accessor is handed the receiver and nothing else, while a data
+        // property has the receiver's own property consulted first
+        // (OrdinarySetWithOwnDescriptor). Doing that here keeps the repair invisible — an own
+        // writable property is updated in place and keeps its other attributes, an own
+        // non-writable one drops the write rather than being overwritten, and a target that
+        // cannot take a new property is left alone instead of being handed to `defineProperty`,
+        // which would throw. That last case covers a frozen prototype, an object the expression
+        // froze itself, and `null` or `undefined`.
+        if (this === p || this === null || this === undefined) return;
+        var own = describe(this, n);
+        if (own) {
+          if (own.writable) define(this, n, { value: nv });
+          return;
+        }
+        if (!isExtensible(this)) return;
+        define(this, n, { value: nv, writable: true, enumerable: true, configurable: true });
+      },
+      enumerable: d.enumerable,
+      configurable: false,
+    });
+  };
+
+  var freezeProto = function (p) {
+    if (p === null || (typeof p !== 'object' && typeof p !== 'function') || isFrozen(p)) return;
+    var names = getNames(p);
+    for (var i = 0; i < names.length; i++) if (!readByHost(p, names[i])) tolerate(p, names[i]);
+    // Symbol keys go the same way: `a[Symbol.iterator] = …` on an expression's own array is an
+    // ordinary way to make something iterable, and left frozen it is dropped in silence while
+    // `for…of` quietly walks the array's own elements instead.
+    var syms = getSyms(p);
+    for (var j = 0; j < syms.length; j++) tolerate(p, syms[j]);
+    freeze(p);
+  };
+
+  // Freezing a function also makes its own `prototype` property non-writable, so `Comp.prototype =
+  // {}` is a no-op; freezing that prototype object closes the methods hanging off it.
+  var shut = function (o) {
+    var d = describe(o, 'prototype');
+    if (d && 'value' in d) freezeProto(d.value);
+    freeze(o);
+  };
+
+  var globals = getNames(g);
+  for (var k = 0; k < globals.length; k++) {
+    var n = globals[k];
+    var d = describe(g, n);
+    if (!d || !('value' in d) || typeof d.value !== 'function') continue;
+    // The function object as well as the binding: the prelude calls `Array.isArray` and
+    // `Object.setPrototypeOf` while it answers an expression, so a replacement for one of those
+    // would not merely shadow a name, it would change what a later expression computes.
+    shut(d.value);
+    lock(n);
+  }
+  // `Math.sin = …` goes the same way, and the prelude leans on both of these itself. They are the
+  // `prototype` of no function, so the loop above never reaches them, and they are the prototype
+  // of no object either: nothing inherits `sin` or `parse`, so there is no shadowing for the
+  // accessor repair to keep, and a plain freeze closes them. That matters on the hot path, where
+  // a repaired name costs an accessor call on every read and a per-frame expression reads
+  // `Math.*` more than anything else. The bindings are locked as well, so `Math = {}` cannot take
+  // them away from the next expression either.
+  freeze(Math);
+  freeze(JSON);
+  lock('Math');
+  lock('JSON');
+  // The iterator intrinsics are the `prototype` of no global function either, and `for…of`,
+  // destructuring and spread all run through them: replacing `next` on the array iterator left
+  // every later expression on the thread unable to iterate at all.
+  var walk = function (o) {
+    for (var p = o; p !== null && p !== undefined; p = protoOf(p)) freezeProto(p);
+  };
+  var probes = [function () { return [][Symbol.iterator](); },
+    function () { return ''[Symbol.iterator](); },
+    function () { return new Map()[Symbol.iterator](); },
+    function () { return new Set()[Symbol.iterator](); },
+    function () { return (function* () {})(); },
+    function () { return 'a'.matchAll(/a/g); },
+    function () { return Int8Array.prototype; }];
+  for (var m = 0; m < probes.length; m++) {
+    // Each one is a probe for an intrinsic this engine may not have at all.
+    try { walk(protoOf(probes[m]())); } catch (e) { /* not present */ }
+  }
+})();
diff --git a/crates/expr/src/rewrite.rs b/crates/expr/src/rewrite.rs
index 55e9800aa..34b52439b 100644
--- a/crates/expr/src/rewrite.rs
+++ b/crates/expr/src/rewrite.rs
@@ -528,8 +528,9 @@ fn rewrite_seq(items: &[Item]) -> String {
                 let end = assignment_end(items, j + 1);
                 let rhs = rewrite_seq(&items[j + 1..end]);
                 let h = helper(&op.text[..1]).unwrap_or("__add");
+                let target = compound_assignment_target(items, i, j);
                 out.push_str(&p.ws);
-                out.push_str(&format!("{} ={}{h}({}, ({rhs}))", p.body, op.ws, p.body));
+                out.push_str(&format!("{target} ={}{h}({target}, ({rhs}))", op.ws));
                 i = end;
                 continue;
             }
@@ -543,6 +544,34 @@ fn rewrite_seq(items: &[Item]) -> String {
     out
 }
 
+fn raw_ref(item: &Item) -> String {
+    match item {
+        Item::Tok(t) => format!("{}{}", t.ws, t.text),
+        Item::Group { open, inner, close } => {
+            let mut out = format!("{}{}", open.ws, open.text);
+            if has_assign(inner) {
+                // shortcut: nested assignments stay verbatim (rewriting them would double per level), so arithmetic beside them is not array-aware
+                for item in inner {
+                    out.push_str(&raw_ref(item));
+                }
+            } else {
+                out.push_str(&rewrite_seq(inner));
+            }
+            if let Some(close) = close {
+                out.push_str(&close.text);
+            }
+            out
+        }
+    }
+}
+
+fn has_assign(items: &[Item]) -> bool {
+    items.iter().any(|it| match it {
+        Item::Tok(t) => ASSIGN.contains(&t.text.as_str()),
+        Item::Group { inner, .. } => has_assign(inner),
+    })
+}
+
 fn push_piece(out: &mut String, p: Piece) {
     out.push_str(&p.ws);
     out.push_str(&p.body);
@@ -552,8 +581,20 @@ fn push_piece(out: &mut String, p: Piece) {
 /// rewrite (which nests a call per arithmetic operator). The JavaScript parser and compiler
 /// recurse per level and a 2 MiB thread overflows its stack (aborting the app) at about 75
 /// nested brackets, so deeper expressions are rejected with an error instead. Constructs that
-/// nest without brackets count as part of a level ([`too_nested`]).
+/// nest without brackets count as part of a level (`too_nested`).
 pub const MAX_NESTING: usize = 32;
+/// Hard limit on bytes emitted by the array-math source rewrite.
+pub const MAX_REWRITTEN_BYTES: usize = 4 * 1024 * 1024;
+
+fn over_rewrite_limit(text: &str) -> bool {
+    text.len() > MAX_REWRITTEN_BYTES
+}
+
+fn compound_assignment_target(items: &[Item], start: usize, end: usize) -> String {
+    // Rewriting the whole left side duplicates nested computed assignment targets. Keep the
+    // original target syntax for both reads/writes; source length is bounded above.
+    items[start..end].iter().map(raw_ref).collect()
+}
 
 /// Stack cost of one level of brackets (also of a template substitution, a regex group and a
 /// prefix operator, which cost the parser about as much or are never chained in real code).
@@ -567,7 +608,7 @@ const HEAVY: usize = 32;
 /// about 3 800 links).
 const LIGHT: usize = 6;
 
-/// One bracket level of [`too_nested`]'s walk.
+/// One bracket level of `too_nested`'s walk.
 #[derive(Default)]
 struct Level {
     /// `[`: commas separate elements (a loop in the parser), not operands.
@@ -669,7 +710,7 @@ fn too_nested(toks: &[Tok]) -> bool {
     too_nested_from(toks, 0)
 }
 
-/// [`too_nested`] for code that already sits `base` deep (a template substitution).
+/// `too_nested` for code that already sits `base` deep (a template substitution).
 fn too_nested_from(toks: &[Tok], base: usize) -> bool {
     let mut levels = vec![Level::default()];
     let mut prefix = 0usize;
@@ -746,18 +787,30 @@ fn too_nested_from(toks: &[Tok], base: usize) -> bool {
 
 /// An error when `src` nests deeper than [`MAX_NESTING`] levels (before or after the rewrite).
 pub fn check_nesting(src: &str) -> Result<(), String> {
+    if over_rewrite_limit(src) {
+        return Err(too_large());
+    }
     let (toks, tail) = tokenize(src);
     if too_nested(&toks) {
         return Err(too_deep());
     }
     let mut out = rewrite_seq(&build(toks));
     out.push_str(&tail);
+    if over_rewrite_limit(&out) {
+        return Err(too_large());
+    }
     if too_nested(&tokenize(&out).0) {
         return Err(too_deep());
     }
     Ok(())
 }
 
+/// An error when plain JavaScript `src` (not rewritten: what `eval` and `Function` get at run
+/// time) nests deeper than [`MAX_NESTING`] levels.
+pub fn check_plain_nesting(src: &str) -> Result<(), String> {
+    if too_nested(&tokenize(src).0) { Err(too_deep()) } else { Ok(()) }
+}
+
 fn too_deep() -> String {
     format!("Error: expression is nested too deeply (more than {MAX_NESTING} levels of brackets, or too long a chain of operators)")
 }
@@ -765,12 +818,18 @@ fn too_deep() -> String {
 /// Rewrite an expression's source for array-aware arithmetic. Line breaks are preserved.
 /// An expression nested deeper than [`MAX_NESTING`] becomes a `throw` of that error.
 pub fn rewrite(src: &str) -> String {
+    if over_rewrite_limit(src) {
+        return throw_too_large();
+    }
     let (toks, tail) = tokenize(src);
     if too_nested(&toks) {
         return throw_too_deep();
     }
     let mut out = rewrite_seq(&build(toks));
     out.push_str(&tail);
+    if over_rewrite_limit(&out) {
+        return throw_too_large();
+    }
     if too_nested(&tokenize(&out).0) {
         return throw_too_deep();
     }
@@ -781,6 +840,14 @@ fn throw_too_deep() -> String {
     format!("throw new RangeError({:?})", too_deep().trim_start_matches("Error: "))
 }
 
+fn too_large() -> String {
+    format!("Error: expression exceeds the {MAX_REWRITTEN_BYTES}-byte rewrite limit")
+}
+
+fn throw_too_large() -> String {
+    format!("throw new RangeError({:?})", too_large().trim_start_matches("Error: "))
+}
+
 #[cfg(test)]
 mod tests {
     use super::{MAX_NESTING, check_nesting, rewrite};
@@ -821,6 +888,8 @@ mod tests {
     #[test]
     fn compound_assignment_and_functions() {
         assert_eq!(n(&rewrite("x += [1, 0];")), n("x = __add(x, ( [1, 0]));"));
+        assert_eq!(n(&rewrite("obj[key] += 1")), n("obj[key] = __add(obj[key], (1))"));
+        assert_eq!(n(&rewrite("o[a + b] += 1")), n("o[__add(a, b)] = __add(o[__add(a, b)], (1))"));
         assert_eq!(n(&rewrite("function f(a) { return a * 2 }")), n("function f(a) { return __mul(a,  2) }"));
         assert_eq!(n(&rewrite("var g = (a) => a - 1")), n("var g = (a) => __sub(a,  1)"));
         assert_eq!(n(&rewrite("typeof a + 'x'")), n("__add(typeof a,  'x')"));
@@ -828,6 +897,20 @@ mod tests {
         assert_eq!(n(&rewrite("2 ** 3 * 2")), n("__mul(2 ** 3,  2)"));
     }
 
+    #[test]
+    fn source_expansion_is_bounded_before_rewriting() {
+        let src = "x += 1;".repeat(super::MAX_REWRITTEN_BYTES / 6 + 1);
+        assert!(check_nesting(&src).unwrap_err().contains("rewrite limit"));
+        assert!(rewrite(&src).starts_with("throw new RangeError("));
+    }
+
+    #[test]
+    fn output_expansion_is_bounded() {
+        let src = format!("{} += 1", "a".repeat(super::MAX_REWRITTEN_BYTES / 2));
+        assert!(check_nesting(&src).unwrap_err().contains("rewrite limit"));
+        assert!(rewrite(&src).starts_with("throw new RangeError("));
+    }
+
     #[test]
     fn deep_nesting_is_an_error_not_a_stack_overflow() {
         // Each level costs the JavaScript parser stack: ~60 nested brackets overflowed a 2 MiB
diff --git a/crates/expr/src/runtime.rs b/crates/expr/src/runtime.rs
index 53c2960ba..84bfcdf3c 100644
--- a/crates/expr/src/runtime.rs
+++ b/crates/expr/src/runtime.rs
@@ -51,6 +51,8 @@ thread_local! {
     pub static FRAMES: RefCell<Vec<Frame>> = const { RefCell::new(Vec::new()) };
     /// Script runs since the outermost evaluation on this thread began (nested ones included).
     pub static RUNS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+    /// Stack address where the current script run began (0: none; see [`native_stack`]).
+    static STACK_BASE: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -232,17 +234,54 @@ fn native_random(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<J
     Ok(JsValue::from(noise::unit(noise::mix(&parts))))
 }
 
+/// Stack a script run may use below [`run`] for natives that recurse once per level of a nested
+/// value (`join`, `JSON.stringify`, …; the prelude calls [`native_stack`] per level). It is the
+/// same on every thread, so a value converts or fails alike in preview, export and commands.
+/// Expressions run on render, export and diagnostics threads (2 MiB, std and rayon's default)
+/// and on the main thread for commands and syntax checks (1 MiB on Windows). A debug build
+/// stops the nested-value tests within a fresh 512 KiB thread, which leaves the main thread
+/// 512 KiB for its callers. The parser's limit ([`crate::rewrite::MAX_NESTING`]) is the tighter
+/// one there: 30 levels need about 1 MiB in debug builds. On wasm32 the address of a local is on
+/// the shadow stack, not the engine's call stack, so this measures nothing useful there.
+const NATIVE_STACK: usize = 256 << 10;
+
+/// An address on the current stack (on wasm32, the shadow stack).
+fn stack_here() -> usize {
+    let marker = 0u8;
+    std::hint::black_box(&marker) as *const u8 as usize
+}
+
+/// `__stack()`: throw once the current run has used [`NATIVE_STACK`] (values nested so deeply
+/// would overflow the stack, which aborts the app).
+fn native_stack(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    let base = STACK_BASE.with(|b| b.get());
+    if base != 0 && base.abs_diff(stack_here()) > NATIVE_STACK {
+        return Err(JsNativeError::range().with_message("value is nested too deeply").into());
+    }
+    Ok(JsValue::undefined())
+}
+
+/// `__nest(src)`: throw when source handed to `eval` / `Function` at run time nests deeper than
+/// the parser's stack allows (the expression text itself is checked before it is compiled).
+fn native_nesting(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let src = string(args, 0, ctx)?;
+    crate::rewrite::check_plain_nesting(&src).map_err(|e| JsNativeError::range().with_message(e.trim_start_matches("Error: ").to_string()))?;
+    Ok(JsValue::undefined())
+}
+
 impl Runtime {
     fn new() -> Result<Runtime, String> {
         let mut ctx = Context::default();
         let limits = ctx.runtime_limits_mut();
         limits.set_loop_iteration_limit(LOOP_LIMIT);
         limits.set_recursion_limit(400);
-        let natives: [(JsString, usize, fn(&JsValue, &[JsValue], &mut Context) -> JsResult<JsValue>); 4] = [
+        let natives: [(JsString, usize, fn(&JsValue, &[JsValue], &mut Context) -> JsResult<JsValue>); 6] = [
+            (js_string!("__stack"), 0, native_stack),
             (js_string!("__h"), 6, native_host),
             (js_string!("__wig"), 8, native_wiggle),
             (js_string!("__noise"), 3, native_noise),
             (js_string!("__rnd"), 6, native_random),
+            (js_string!("__nest"), 1, native_nesting),
         ];
         for (name, len, f) in natives {
             ctx.register_global_callable(name, len, NativeFunction::from_fn_ptr(f)).map_err(|e| e.to_string())?;
@@ -361,6 +400,9 @@ pub fn out_of_time() -> bool {
     }
 }
 
+/// Levels of nested arrays a script result keeps.
+const MAX_DETACH: usize = 4;
+
 /// Copy a JS value out of the heap.
 fn detach(v: &JsValue, ctx: &mut Context, depth: usize) -> Result<Out, String> {
     if v.is_undefined() {
@@ -380,7 +422,7 @@ fn detach(v: &JsValue, ctx: &mut Context, depth: usize) -> Result<Out, String> {
     }
     let err = |e: boa_engine::JsError| format_error(&e.to_string(), usize::MAX);
     if let Some(o) = v.as_object() {
-        if o.is_array() && depth < 4 {
+        if o.is_array() && depth < MAX_DETACH {
             let arr = JsArray::from_object(o).map_err(err)?;
             let n = arr.length(ctx).map_err(err)?.min(1 << 16);
             let mut out = Vec::with_capacity(n as usize);
@@ -408,6 +450,11 @@ fn detach(v: &JsValue, ctx: &mut Context, depth: usize) -> Result<Out, String> {
             return Ok(Out::Path { points, ins, outs, closed });
         }
     }
+    // Below the levels detached above, an object's text could be its whole nested content
+    // (`String([[[…]]])`), converted by natives that recurse once per level.
+    if depth >= MAX_DETACH && v.is_object() {
+        return Ok(Out::Object("[object]".into()));
+    }
     Ok(Out::Object(v.to_string(ctx).map(|s| s.to_std_string_escaped()).unwrap_or_default()))
 }
 
@@ -484,6 +531,8 @@ fn position_line(msg: &str) -> Option<usize> {
 /// `__begin` with memoized answers, so nothing carries over. A script that really overflows the
 /// stack fails again on the fresh context and reports the error.
 pub fn run(text: &str, b: &Begin) -> Run {
+    // Runs don't nest (other expressions are evaluated between runs), so one base suffices.
+    STACK_BASE.with(|s| s.set(stack_here()));
     RUNTIME.with(|r| {
         let mut r = r.borrow_mut();
         for fresh in [false, true] {
@@ -628,6 +677,7 @@ pub fn styled_doc(v: &serde_json::Value, own: &effectcraft_keyframe::TextDoc) ->
             let p0 = src.para(0);
             d.set_paras(vec![p0; d.para_count()]);
             d.stroke_over_fill = src.stroke_over_fill;
+            d.line_join = src.line_join;
         }
     }
     for op in v.get("ops").and_then(|o| o.as_array()).into_iter().flatten() {
diff --git a/crates/expr/src/sample.rs b/crates/expr/src/sample.rs
index bff5a2149..88dc06b9e 100644
--- a/crates/expr/src/sample.rs
+++ b/crates/expr/src/sample.rs
@@ -4,13 +4,16 @@
 //! expression (its footage source; [`EvalCtx::footage`]): source → masks → effects for
 //! `postEffect = true`, the bare source otherwise, in layer space (before the transform). Buffers
 //! are cached per thread for the frame, so many expressions sampling the same layer at the same
-//! time render it once.
+//! time render it once. The source files a sampled render reads are kept with its buffer and
+//! noted in the evaluating render's log ([`EvalCtx::reads`]) on every use, so a frame whose
+//! expressions sample footage lists that footage too (#3184).
 
 use std::cell::RefCell;
 use std::collections::HashMap;
 use std::sync::Arc;
 
 use effectcraft_project::{ItemId, Layer};
+use effectcraft_render::reads::{ReadFiles, ReadLog};
 use effectcraft_render::{EvalCtx, NoFootage, RenderOpts, Renderer};
 use effectcraft_time::Tick;
 
@@ -26,7 +29,8 @@ struct Sampled {
 type Key = (usize, u64, u64, u64, bool, u64);
 
 thread_local! {
-    static CACHE: RefCell<HashMap<Key, Option<Sampled>>> = RefCell::new(HashMap::new());
+    /// The sampled buffers and the source files each was made of.
+    static CACHE: RefCell<HashMap<Key, (Option<Sampled>, Arc<ReadFiles>)>> = RefCell::new(HashMap::new());
     /// Nested sampleImage renders (a sampled layer whose expressions sample again).
     static DEPTH: RefCell<usize> = const { RefCell::new(0) };
 }
@@ -42,13 +46,21 @@ fn fingerprint(layer: &Layer) -> u64 {
     h.finish()
 }
 
+/// Renders `layer` of `comp` at time `t` for an expression sample, before or after effects as `post` says.
+/// Returns `None` once the nesting depth limit is reached.
 fn render(ctx: EvalCtx, comp: ItemId, layer: &Layer, post: bool, t: f64) -> Option<Sampled> {
     let depth = DEPTH.with(|d| *d.borrow());
     if depth >= MAX_DEPTH {
         return None;
     }
     let key: Key = (ctx.project as *const _ as usize, comp.0, layer.id.0, t.to_bits(), post, fingerprint(layer));
-    if let Some(hit) = CACHE.with(|c| c.borrow().get(&key).cloned()) {
+    let note = |files: &ReadFiles| {
+        if let Some(log) = ctx.reads {
+            log.note_all(files);
+        }
+    };
+    if let Some((hit, files)) = CACHE.with(|c| c.borrow().get(&key).cloned()) {
+        note(&files);
         return hit;
     }
     DEPTH.with(|d| *d.borrow_mut() += 1);
@@ -60,20 +72,24 @@ fn render(ctx: EvalCtx, comp: ItemId, layer: &Layer, post: bool, t: f64) -> Opti
     }
     let _pop = Pop;
     let footage: &dyn effectcraft_render::FootageSource = ctx.footage.unwrap_or(&NoFootage);
+    let log = ReadLog::new();
     let mut r = Renderer::new(ctx.project, footage, RenderOpts { motion_blur: false, ..Default::default() });
     r.expr = ctx.expr;
+    r.reads = Some(&log);
     let ectx = r.eval_ctx(comp, Tick::from_seconds_f64(t))?;
     let out = if post {
-        r.content_buf(&ectx, layer).map(|b| Sampled { img: Arc::new(b.img.clone()), offset: b.offset, scale: b.scale })
+        r.layer_content(&ectx, layer).map(|b| Sampled { img: Arc::new(b.img.clone()), offset: b.offset, scale: b.scale })
     } else {
         r.layer_source(&ectx, layer).map(|b| Sampled { img: Arc::new(b.img), offset: b.offset, scale: b.scale })
     };
+    let files = Arc::new(log.into_files());
+    note(&files);
     CACHE.with(|c| {
         let mut c = c.borrow_mut();
         if c.len() >= MAX_CACHE {
             c.clear();
         }
-        c.insert(key, out.clone());
+        c.insert(key, (out.clone(), files));
     });
     out
 }
@@ -99,8 +115,8 @@ pub fn sample_image(ctx: EvalCtx, comp: ItemId, layer: &Layer, point: [f64; 2],
     };
     let mut acc = [0.0f64; 4];
     let mut n = 0.0;
-    for y in y0..=y1.min(y0 + 4096) {
-        for x in x0..=x1.min(x0 + 4096) {
+    for y in y0..=y1.min(y0.saturating_add(4096)) {
+        for x in x0..=x1.min(x0.saturating_add(4096)) {
             let p = b.img.get(x, y);
             for k in 0..4 {
                 acc[k] += p[k] as f64;
diff --git a/crates/expr/src/tests.rs b/crates/expr/src/tests.rs
index 18b725084..d16f1dd54 100644
--- a/crates/expr/src/tests.rs
+++ b/crates/expr/src/tests.rs
@@ -1,5 +1,6 @@
 use std::time::Instant;
 
+mod deep_nesting;
 mod fuzz;
 
 use effectcraft_color::Label;
@@ -76,7 +77,7 @@ fn fx() -> Fx {
 
     let ids = (a.id, b.id, title.id, shape.id);
     let c = p.comp_mut(cid).unwrap();
-    c.layers = vec![a, b, title, shape];
+    c.layers = vec![a, b, title, shape].into();
     c.markers.push(Marker { time: secs(1.5), comment: "comp marker".into(), ..Default::default() });
 
     let other = Comp::new(64, 32, FrameRate::FPS_24, Tick::from_seconds_f64(3.0));
@@ -192,6 +193,315 @@ fn functions_and_let_are_reusable_across_evaluations() {
     assert_close!(f.num(e, 2.0), 9.0);
 }
 
+#[test]
+fn an_expression_cannot_rebind_a_prelude_name_for_the_next_one() {
+    let f = fx();
+    // #2133: one runtime serves every expression on a thread and user code runs at global scope, so
+    // a write to a prelude name used to outlive the expression that made it and poison every later
+    // one — in this session's other projects too.
+    assert_close!(f.num("linear = function () { return 777 };\n50", 0.0), 50.0);
+    assert_close!(f.num("linear(time, 0, 1, 0, 100)", 0.0), 0.0);
+    assert_close!(f.num("var clamp = 5;\n10", 0.0), 10.0);
+    assert_close!(f.num("clamp(50, 0, 100)", 0.0), 50.0);
+    assert_close!(f.num("Math.sin = function () { return 9 };\n1", 0.0), 1.0);
+    assert_close!(f.num("Math.sin(Math.PI / 2) * 100", 0.0), 100.0);
+    assert_close!(f.num("Object.prototype.leak = 9;\n2", 0.0), 2.0);
+    assert_close!(f.num("({}).leak === undefined ? 1 : 0", 0.0), 1.0);
+    // The runtime is one thread-local singleton, so a second project on this thread meets the same
+    // objects: the isolation has to hold between projects, not only between the evaluations of one.
+    let g = fx();
+    assert_close!(g.num("linear(time, 0, 1, 0, 100)", 0.0), 0.0);
+    assert_close!(g.num("clamp(50, 0, 100)", 0.0), 50.0);
+    assert_close!(g.num("Math.sin(Math.PI / 2) * 100", 0.0), 100.0);
+    assert_close!(g.num("({}).leak === undefined ? 1 : 0", 0.0), 1.0);
+}
+
+/// The four ways a script can reach a global binding, against a prelude *function* rather than one
+/// of the unqualified accessors: assignment, `var`, `delete` and `defineProperty`. The lock is
+/// `writable: false, configurable: false`, and it is the second half of that pair that answers the
+/// last two — a `delete` of a non-configurable property is false, and a `defineProperty` over one
+/// is a `TypeError`. Asked for by a reviewer on #2176.
+#[test]
+fn a_prelude_function_survives_every_way_a_script_can_reach_its_binding() {
+    let f = fx();
+    // Assignment and `var`: silent, and the next expression still has the original.
+    assert_close!(f.num("clamp = function () { return 777 };\n1", 0.0), 1.0);
+    assert_close!(f.num("var clamp = 5;\n2", 0.0), 2.0);
+    assert_close!(f.num("clamp(50, 0, 100)", 0.0), 50.0);
+    // `delete` of a non-configurable binding answers false in sloppy mode rather than throwing.
+    assert_close!(f.num("delete clamp ? 1 : 0", 0.0), 0.0);
+    assert_close!(f.num("clamp(50, 0, 100)", 0.0), 50.0);
+    assert_close!(f.num("typeof clamp === 'function' ? 1 : 0", 0.0), 1.0);
+    // `defineProperty` over one is a `TypeError`, so this is the one route the user does see. The
+    // expression fails; what it was reaching for is unchanged for the next one.
+    assert!(f.err("Object.defineProperty(globalThis, 'clamp', { value: 5 })").contains("TypeError"));
+    assert_close!(f.num("clamp(50, 0, 100)", 0.0), 50.0);
+    // Reconfiguring it to writable is refused the same way, so the lock cannot be reopened.
+    assert!(f.err("Object.defineProperty(globalThis, 'clamp', { writable: true })").contains("TypeError"));
+    assert_close!(f.num("clamp = 7;\n3", 0.0), 3.0);
+    assert_close!(f.num("clamp(50, 0, 100)", 0.0), 50.0);
+    // A second project on the same thread-local runtime meets the same bindings.
+    let g = fx();
+    assert_close!(g.num("clamp(50, 0, 100)", 0.0), 50.0);
+    assert_close!(g.num("typeof clamp === 'function' ? 1 : 0", 0.0), 1.0);
+}
+
+/// Which mode a write is silent in decides what the user sees, and the answer is that an expression
+/// cannot reach strict mode at all: `Runtime::script` wraps the text in `try{…}catch(__e){throw __e}`,
+/// so a `"use strict"` the user writes is an expression statement inside a block rather than a
+/// directive prologue, and has no effect. A failed write is therefore always the silent kind.
+/// Asked for by a reviewer on #2176.
+#[test]
+fn a_use_strict_in_an_expression_is_inert_so_a_refused_write_stays_silent() {
+    let f = fx();
+    assert_close!(f.num("\"use strict\";\nlinear = function () { return 777 };\n50", 0.0), 50.0);
+    assert_close!(f.num("linear(time, 0, 1, 0, 100)", 0.0), 0.0);
+    // The directive is inert rather than honoured: in strict mode an assignment to an undeclared
+    // name is a ReferenceError, and here it quietly creates a global instead.
+    assert_close!(f.num("\"use strict\";\nundeclared_global = 5;\nundeclared_global", 0.0), 5.0);
+    // Which is also why the refused write above cannot be made to report itself by the user: the
+    // only mode an expression runs in is the one where it is dropped.
+    assert_close!(f.num("\"use strict\";\ntypeof linear === 'function' ? 1 : 0", 0.0), 1.0);
+}
+
+/// The same leak, reached through the objects instead of the names: a prelude constructor keeps its
+/// methods on its `prototype`, the prelude itself calls `Array.isArray` and `Object.setPrototypeOf`
+/// while it answers an expression, and `thisProject` is reachable surface that holds no function at
+/// all (#2133).
+#[test]
+fn an_expression_cannot_tamper_with_a_prelude_object_for_the_next_one() {
+    let f = fx();
+    // An unqualified name is an accessor, so it takes a `defineProperty` or a `delete` rather than
+    // an assignment; the setter an assignment goes through writes per-evaluation state.
+    assert_close!(f.num("try { Object.defineProperty(globalThis, 'width', { value: 777 }) } catch (e) {}\n1", 0.0), 1.0);
+    assert_close!(f.num("delete width;\n2", 0.0), 2.0);
+    assert_close!(f.num("width", 0.0), 20.0);
+    assert_close!(f.num("Comp.prototype = {};\n3", 0.0), 3.0);
+    assert_close!(f.num("Comp.prototype.leak = 9;\n4", 0.0), 4.0);
+    assert_close!(f.num("thisComp.width", 0.0), 200.0);
+    // `add` reads its arguments through `Array.isArray`, and reaching an effect builds a group with
+    // `Object.setPrototypeOf`, so a replacement for either would change the answers below.
+    assert_close!(f.num("Array.isArray = function () { return false };\n5", 0.0), 5.0);
+    assert_close!(f.num("Object.setPrototypeOf = function (o) { return o };\n6", 0.0), 6.0);
+    assert_close!(f.num("add([1, 2], [3, 4])[0]", 0.0), 4.0);
+    assert_close!(f.num("effect(\"Slider Control\")(\"Slider\")", 0.0), 42.0);
+    assert_close!(f.num("thisProject = 5;\nthisProject.leak = 9;\n7", 0.0), 7.0);
+    assert_close!(f.num("typeof thisProject === 'object' && thisProject.leak === undefined ? 1 : 0", 0.0), 1.0);
+}
+
+/// `Math` and `JSON` are namespaces rather than prototypes: nothing inherits from them, so the
+/// prelude freezes them plainly instead of turning every method into a shadowable accessor, which
+/// would put a getter call on every `Math.sin` of a per-frame expression for a shadowing no object
+/// can do. They still cannot be rewritten, through a member or through the binding (#2176).
+#[test]
+fn math_and_json_are_frozen_and_cannot_be_replaced_for_the_next_expression() {
+    let f = fx();
+    assert_close!(f.num("Object.isFrozen(Math) && Object.isFrozen(JSON) ? 1 : 0", 0.0), 1.0);
+    // Plain data properties, not the accessor repair: the hot path reads the native method directly.
+    assert_close!(f.num("'value' in Object.getOwnPropertyDescriptor(Math, 'sin') ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("'value' in Object.getOwnPropertyDescriptor(JSON, 'stringify') ? 1 : 0", 0.0), 1.0);
+    // A member write is dropped in silence, and the next expression still has the original.
+    assert_close!(f.num("Math.sin = function () { return 9 }; Math.max = function () { return -1 };\n1", 0.0), 1.0);
+    assert_close!(f.num("Math.sin(Math.PI / 2) * 100 + Math.max(3, 7)", 0.0), 107.0);
+    assert_close!(f.num("JSON.stringify = function () { return 'x' }; JSON.parse = null;\n2", 0.0), 2.0);
+    assert_close!(f.num("JSON.stringify(JSON.parse('[1,2]')) === '[1,2]' ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("Math.leak = 5; JSON.leak = 6;\n3", 0.0), 3.0);
+    assert_close!(f.num("Math.leak === undefined && JSON.leak === undefined ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("delete Math.floor ? 1 : 0", 0.0), 0.0);
+    assert!(f.err("Object.defineProperty(Math, 'floor', { value: 5 })").contains("TypeError"));
+    // The bindings are locked too: assignment, `var` and `delete` leave both in place.
+    assert_close!(f.num("Math = { sin: function () { return 9 } }; JSON = null;\n4", 0.0), 4.0);
+    assert_close!(f.num("var Math = 5; var JSON = 6;\n5", 0.0), 5.0);
+    assert_close!(f.num("delete Math || delete JSON ? 1 : 0", 0.0), 0.0);
+    assert_close!(f.num("Math.floor(2.7) + JSON.parse('3')", 0.0), 5.0);
+    // A second project on the same thread-local runtime meets the same objects.
+    let g = fx();
+    assert_close!(g.num("Math.sin(Math.PI / 2) * 100", 0.0), 100.0);
+    assert_close!(g.num("JSON.stringify([1]) === '[1]' ? 1 : 0", 0.0), 1.0);
+}
+
+/// Closing the prototypes must not cost an expression its own objects: once an inherited data
+/// property is non-writable, an assignment meaning to shadow it on an instance is dropped in sloppy
+/// mode rather than creating an own property, and using an object as a dictionary runs into exactly
+/// those names (#2133).
+#[test]
+fn an_expression_can_shadow_an_inherited_name_on_its_own_object() {
+    let f = fx();
+    assert_close!(f.num("var o = {}; o.toString = function () { return 'x' }; o.toString() === 'x' ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("var d = {}; d.constructor = 3; d.constructor", 0.0), 3.0);
+    assert_close!(f.num("var c = {}; c['valueOf'] = 2; c['valueOf']", 0.0), 2.0);
+    // The shared prototype itself still cannot be written through, which is the point of freezing.
+    assert_close!(f.num("Object.prototype.toString = function () { return 'z' };\n1", 0.0), 1.0);
+    assert_close!(f.num("({}).toString() === 'z' ? 0 : 1", 0.0), 1.0);
+}
+
+/// The names an expression shadows are not only `Object.prototype`'s: giving one array its own
+/// `map` or one function its own `call` is ordinary JavaScript, and a prototype frozen without the
+/// repair takes it away. The two halves fail differently, which is why both are checked here —
+/// `map`, `forEach` and `filter` throw, while `push` and `join` silently run the native method and
+/// return its answer, so an expression using them keeps working and quietly computes something
+/// else (#2133).
+#[test]
+fn an_expression_can_shadow_an_inherited_method_on_its_own_array_or_function() {
+    let f = fx();
+    assert_close!(f.num("var a = []; a.map = function () { return 42 }; a.map()", 0.0), 42.0);
+    assert_close!(f.num("var a = [1, 2]; a.forEach = function () { return 5 }; a.forEach()", 0.0), 5.0);
+    assert_close!(f.num("var a = [1, 2]; a.filter = function () { return 6 }; a.filter()", 0.0), 6.0);
+    // `push` returned the native length and `join` the native string before the repair.
+    assert_close!(f.num("var a = [1]; a.push = function () { return 99 }; a.push(2)", 0.0), 99.0);
+    assert_close!(f.num("var a = [1]; a.push = function () { return 99 }; a.push(2); a.length", 0.0), 1.0);
+    assert_close!(f.num("var a = [1]; a.join = function () { return 'J' }; a.join() === 'J' ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("var fn = function () {}; fn.call = function () { return 7 }; fn.call()", 0.0), 7.0);
+    assert_close!(f.num("var fn = function () {}; fn.apply = function () { return 8 }; fn.apply()", 0.0), 8.0);
+    // A symbol key on a prototype the loop reaches goes the same way.
+    assert_close!(f.num("var a = [1]; a[Symbol.toPrimitive] = function () { return 11 }; +a", 0.0), 11.0);
+    // Reading an unshadowed method still answers with the native one, through the repair.
+    assert_close!(f.num("[1, 2, 3].map(function (x) { return x * 2 })[2]", 0.0), 6.0);
+    assert_close!(f.num("[1, 2, 3].filter(function (x) { return x > 1 }).length", 0.0), 2.0);
+    assert_close!(f.num("[3, 1, 2].sort()[0]", 0.0), 1.0);
+    assert_close!(f.num("[1, 2].concat([3]).length", 0.0), 3.0);
+    // The shared prototype itself still cannot be written through, which is the point of freezing.
+    assert_close!(f.num("Array.prototype.map = function () { return 0 };\n1", 0.0), 1.0);
+    assert_close!(f.num("[1].map(function (x) { return x + 1 })[0]", 0.0), 2.0);
+    assert_close!(f.num("Function.prototype.call = function () { return 0 };\n1", 0.0), 1.0);
+    assert_close!(f.num("(function () { return 4 }).call(null)", 0.0), 4.0);
+}
+
+/// `name` and `message` on an error's prototype are the one exception to the repair, because the
+/// host reads both off a thrown object to render it and has no context to call a getter with, nor
+/// anywhere safe to call one: formatting happens after the evaluation's time budget stops being
+/// checked. What matters is that the message still names the error and the line, and that the
+/// assignment the exception costs is dropped in silence rather than failing the expression (#2133).
+#[test]
+fn an_error_still_renders_with_its_name_and_the_users_line() {
+    let f = fx();
+    // The write the exception costs: a no-op, not a throw, and the next statement still runs.
+    assert_close!(f.num("var e = new Error('x'); e.name = 'MyError'; 1", 0.0), 1.0);
+    assert_close!(f.num("var e = new Error('x'); e.name === 'Error' ? 1 : 0", 0.0), 1.0);
+    // An own `message` is the instance's, so it is untouched by any of this.
+    assert_close!(f.num("new Error('x').message === 'x' ? 1 : 0", 0.0), 1.0);
+    // The prototype itself still cannot be rebound for the next expression, which is the point.
+    assert_close!(f.num("Error.prototype.name = 'Hacked';\n1", 0.0), 1.0);
+    assert_close!(f.num("new Error('x').name === 'Error' ? 1 : 0", 0.0), 1.0);
+    // A getter the expression installs on its own error is reached through its own property, so it
+    // never goes near the host's read of the prototype.
+    assert_close!(f.num("var e = new Error('x'); Object.defineProperty(e, 'name', { get: function () { return 'Own' } }); e.name === 'Own' ? 1 : 0", 0.0), 1.0);
+}
+
+/// The repair must not turn a dropped assignment into a failed expression: in sloppy mode a write
+/// to a frozen target is ignored, and the setter runs for every receiver that inherits the name,
+/// including the other frozen prototypes and an object the expression froze itself.
+#[test]
+fn assigning_a_repaired_name_on_a_frozen_object_is_dropped_not_an_error() {
+    let f = fx();
+    // `hasOwnProperty` is `Object.prototype`'s, so this runs the repaired setter with a frozen
+    // `Array.prototype` as the receiver.
+    assert_close!(f.num("Array.prototype.hasOwnProperty = function () { return true };\n1", 0.0), 1.0);
+    assert_close!(f.num("[].hasOwnProperty('length') ? 1 : 0", 0.0), 1.0);
+    // The prelude freezes these, and each inherits the repaired names.
+    assert_close!(f.num("Math.toString = function () { return 'm' };\n2", 0.0), 2.0);
+    assert_close!(f.num("JSON.valueOf = 3;\n3", 0.0), 3.0);
+    assert_close!(f.num("thisProject.toLocaleString = 4;\n4", 0.0), 4.0);
+    // An object the expression froze itself behaves as it does outside the prelude.
+    assert_close!(f.num("var o = {}; Object.freeze(o); o.toString = function () { return 'x' };\n5", 0.0), 5.0);
+    assert_close!(f.num("var s = {}; Object.seal(s); s.constructor = 6;\n6", 0.0), 6.0);
+    // Still a no-op where it has to be, and still working where it has to work.
+    assert_close!(f.num("({}).toString() === '[object Object]' ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("var k = {}; k.toString = function () { return 'y' }; k.toString() === 'y' ? 1 : 0", 0.0), 1.0);
+    // A primitive target boxes into a throwaway wrapper, and `null` is not extensible, which is why
+    // the receiver check alone is enough.
+    assert_close!(f.num("'abc'.toString = function () { return 'q' };\n7", 0.0), 7.0);
+    assert_close!(f.num("(5).constructor = 8;\n8", 0.0), 8.0);
+    assert_close!(f.num("Object.isExtensible(null) === false && Object.isExtensible(undefined) === false ? 1 : 0", 0.0), 1.0);
+}
+
+/// The repaired name is an accessor standing in for a data property, and an accessor is handed the
+/// receiver while a data property has the receiver's own property consulted first, so the setter
+/// has to do that itself or the substitution shows through. An ordinary assignment finds the own
+/// property and never reaches the setter, so these call it with the receiver directly, which is
+/// what `Reflect.set(Object.prototype, name, v, o)` would do; `Reflect` is not available to
+/// expressions. Every expected value is what that `Reflect.set` answers in node, where the name
+/// is still the data property this one stands in for.
+#[test]
+fn the_repair_answers_a_write_as_the_data_property_it_replaced_would() {
+    let f = fx();
+    let set = "var put = Object.getOwnPropertyDescriptor(Object.prototype, 'toString').set;";
+    // An own writable property is updated in place, even when the receiver takes no new ones.
+    assert_close!(f.num(&format!("{set} var o = {{ toString: 1 }}; Object.preventExtensions(o); put.call(o, 2); o.toString"), 0.0), 2.0);
+    assert_close!(f.num(&format!("{set} var o = {{ toString: 1 }}; put.call(o, 2); o.toString"), 0.0), 2.0);
+    // ... and keeps the attributes it had, rather than being redefined as a fresh enumerable one.
+    assert_close!(
+        f.num(
+            &format!(
+                "{set} var o = {{}}; Object.defineProperty(o, 'toString', {{ value: 1, writable: true, enumerable: false, configurable: true }});
+                 put.call(o, 2); Object.getOwnPropertyDescriptor(o, 'toString').enumerable ? 1 : 0"
+            ),
+            0.0
+        ),
+        0.0
+    );
+    // An own non-writable property drops the write instead of being overwritten.
+    assert_close!(
+        f.num(
+            &format!(
+                "{set} var o = {{}}; Object.defineProperty(o, 'toString', {{ value: 1, writable: false, enumerable: false, configurable: true }});
+                 put.call(o, 2); o.toString"
+            ),
+            0.0
+        ),
+        1.0
+    );
+    // Writing through the prototype itself changes nothing for anyone.
+    assert_close!(f.num(&format!("{set} put.call(Object.prototype, 2); ({{}}).toString === undefined ? 0 : 1"), 0.0), 1.0);
+    // An ordinary assignment finds the own property first and never reaches the setter at all.
+    assert_close!(f.num("var o = { toString: 1 }; o.toString = 2; o.toString", 0.0), 2.0);
+}
+
+/// `for…of`, destructuring and spread all go through the iterator intrinsics, and those are the
+/// `prototype` of no global function, so freezing what the globals reach never touched them (#2133).
+#[test]
+fn an_expression_cannot_poison_iteration_for_the_next_one() {
+    let f = fx();
+    assert_close!(f.num("Object.getPrototypeOf([][Symbol.iterator]()).next = function () { return { done: true } };\n1", 0.0), 1.0);
+    assert_close!(f.num("var s = 0; for (var x of [1, 2, 3]) s += x; s", 0.0), 6.0);
+    assert_close!(f.num("var [a, b] = [4, 5]; a + b", 0.0), 9.0);
+    assert_close!(f.num("Math.max(...[1, 7, 3])", 0.0), 7.0);
+}
+
+/// Shadowing an inherited name on an instance has to keep working for symbol keys too: making an
+/// object iterable by assigning `Symbol.iterator` is ordinary JavaScript, and a frozen
+/// `Array.prototype` drops that write in silence, so `for…of` walks the array's own elements and
+/// quietly returns a different number rather than failing (#2133).
+#[test]
+fn an_expression_can_give_its_own_array_an_iterator() {
+    let f = fx();
+    assert_close!(
+        f.num(
+            "var a = [1, 2];
+             a[Symbol.iterator] = function () { var d = false; return { next: function () { if (d) return { done: true }; d = true; return { value: 9, done: false } } } };
+             var s = 0; for (var x of a) s += x; s",
+            0.0
+        ),
+        9.0
+    );
+    assert_close!(f.num("var a = [1, 2]; a[Symbol.iterator] = 1; a[Symbol.iterator] === 1 ? 1 : 0", 0.0), 1.0);
+    // `Object.prototype` carries no symbol keys, so a plain object was never affected.
+    assert_close!(f.num("var o = {}; o[Symbol.iterator] = 1; o[Symbol.iterator] === 1 ? 1 : 0", 0.0), 1.0);
+    // An inherited name that is already non-writable is left alone, as it is outside the prelude:
+    // `Date.prototype[Symbol.toPrimitive]` drops the write on `main` and in node as well.
+    assert_close!(f.num("var d = new Date(0); d[Symbol.toPrimitive] = 1; d[Symbol.toPrimitive] === 1 ? 1 : 0", 0.0), 0.0);
+    // Repairing the key must not reopen it: the shared prototype still cannot be written through.
+    assert_close!(
+        f.num(
+            "Array.prototype[Symbol.iterator] = function () { return { next: function () { return { done: true } } } };
+1",
+            0.0
+        ),
+        1.0
+    );
+    assert_close!(f.num("var s = 0; for (var x of [1, 2, 3]) s += x; s", 0.0), 6.0);
+}
+
 #[test]
 fn comments_are_ignored() {
     let f = fx();
@@ -276,6 +586,12 @@ fn angles_and_look_at() {
     assert_close!(f.num("degreesToRadians(90)", 0.0), std::f64::consts::FRAC_PI_2);
     let o = f.ev(f.a, "transform/orientation", "lookAt([0, 0, 0], [100, 0, 100])", 0.0).unwrap().as_vec3();
     assert!(close(o[1], 45.0) && close(o[0], 0.0), "{o:?}");
+    // After Effects 2026 read-backs of lookAt(position, …) on a layer at [960, 540, 0].
+    for (at, want) in [([1500.0, 200.0, 300.0], [48.5763, 49.9802, 319.0442]), ([500.0, 900.0, -400.0], [221.9872, 319.4766, 210.3184])] {
+        let e = format!("lookAt([960, 540, 0], [{}, {}, {}])", at[0], at[1], at[2]);
+        let o = f.ev(f.a, "transform/orientation", &e, 0.0).unwrap().as_vec3();
+        assert!((0..3).all(|i| (o[i] - want[i]).abs() < 1e-3), "{e}: {o:?}");
+    }
 }
 
 // ---- interpolation ----------------------------------------------------------------------------
@@ -313,8 +629,78 @@ fn interpolation_with_arrays() {
     assert_eq!(f.pos("ease(time, 0, 1, [0, 0], [100, 50])", 1.0), [100.0, 50.0, 0.0]);
 }
 
-// ---- object model -----------------------------------------------------------------------------
+#[test]
+fn cubic_bezier_curves() {
+    let f = fx();
+    // ease(t, …) is cubic-bezier(1/3, 0, 2/3, 1): x(u) = u and y(u) = 3u² - 2u³.
+    assert_close!(f.num("bezier(0.25, 0, 1, 0, 100, [0.3333333333333333, 0, 0.6666666666666666, 1])", 0.0), f.num("ease(0.25, 0, 1, 0, 100)", 0.0));
+    assert_close!(f.num("bezier(0.5, 0, 1, 0, 100, [0.3333333333333333, 0, 0.6666666666666666, 1])", 0.0), 50.0);
+    // Symmetric ease-in-out: slower at both ends, faster in the middle.
+    let early = f.num("bezier(0.25, 0, 1, 0, 100, [0.42, 0, 0.58, 1])", 0.0);
+    let late = f.num("bezier(0.75, 0, 1, 0, 100, [0.42, 0, 0.58, 1])", 0.0);
+    assert!(early < 25.0 && late > 75.0, "ease-in-out: {early}, {late}");
+    // Control points on the diagonal are linear.
+    assert_close!(f.num("bezier(0.3, 0, 1, 0, 100, [0, 0, 1, 1])", 0.0), 30.0);
+    // t is clamped to tMin..tMax; tMin == tMax behaves like the other helpers.
+    assert_close!(f.num("bezier(-1, 0, 1, 0, 100, [0.42, 0, 0.58, 1])", 0.0), 0.0);
+    assert_close!(f.num("bezier(2, 0, 1, 0, 100, [0.42, 0, 0.58, 1])", 0.0), 100.0);
+    assert_close!(f.num("bezier(5, 2, 2, 0, 100, [0.42, 0, 0.58, 1])", 0.0), 100.0);
+}
 
+#[test]
+fn cubic_bezier_short_form_arrays_and_fallbacks() {
+    let f = fx();
+    // Short form: no tMin / tMax.
+    assert_close!(f.num("bezier(0.25, 10, 20, [0, 0, 1, 1])", 0.0), 12.5);
+    assert_eq!(f.pos("bezier(time, 0, 1, [0, 0], [100, 50], [0.42, 0, 0.58, 1])", 1.0), [100.0, 50.0, 0.0]);
+    // y outside 0..1 overshoots, as CSS allows.
+    let over = f.num("bezier(0.5, 0, 1, 0, 100, [0.5, 2, 0.5, 2])", 0.0);
+    assert!(over > 100.0, "overshoot: {over}");
+    // A curve that is not four finite numbers falls back to linear instead of throwing.
+    assert_close!(f.num("bezier(0.5, 0, 1, 0, 100, [1, 0])", 0.0), 50.0);
+    assert_close!(f.num("bezier(0.5, 0, 1, 0, 100, 'ease')", 0.0), 50.0);
+    // A missing or unusable curve must not consume the last value: read the curve by position.
+    assert_close!(f.num("bezier(0.5, 0, 1, 0, 100)", 0.0), 50.0);
+    assert_close!(f.num("bezier(0.5, 0, 100)", 0.0), 50.0);
+    assert_close!(f.num("bezier(0.5, 0, 100, [1, 0])", 0.0), 50.0);
+    let v = f.ev(f.shape, "contents/#1/contents/fill/color", "bezier(0.5, 0, 1, [0, 0, 0, 1], [1, 1, 1, 1])", 0.0).unwrap();
+    assert_eq!(v, Value::Color([0.5, 0.5, 0.5, 1.0]));
+    // Exactly four values are a curve; extra ones mean the curve is malformed, so linear.
+    assert_close!(f.num("bezier(0.5, 0, 1, 0, 100, [0.42, 0, 0.58, 1, 0])", 0.0), 50.0);
+    assert_close!(f.num("bezier(0.5, 0, 1, 0, 100, [0.42, 0, 0.58, 1, 2, 3])", 0.0), 50.0);
+    // x control points outside 0..1 are clamped, as CSS requires.
+    let v = f.num("bezier(0.5, 0, 1, 0, 100, [-1, 0, 2, 1])", 0.0);
+    assert!(v.is_finite(), "clamped curve: {v}");
+}
+
+#[test]
+fn cubic_bezier_is_accurate_near_the_endpoints() {
+    /// The value the curve reaches at `x`, by bisection on its monotone x(u).
+    fn reference(x1: f64, y1: f64, x2: f64, y2: f64, x: f64) -> f64 {
+        let bx = |u: f64| 3.0 * (1.0 - u) * (1.0 - u) * u * x1 + 3.0 * (1.0 - u) * u * u * x2 + u * u * u;
+        let by = |u: f64| 3.0 * (1.0 - u) * (1.0 - u) * u * y1 + 3.0 * (1.0 - u) * u * u * y2 + u * u * u;
+        let (mut lo, mut hi) = (0.0f64, 1.0f64);
+        for _ in 0..100 {
+            let mid = 0.5 * (lo + hi);
+            if bx(mid) < x {
+                lo = mid;
+            } else {
+                hi = mid;
+            }
+        }
+        by(0.5 * (lo + hi))
+    }
+    // Steep curves: a residual in x is not a residual in y near the endpoints (dy/dx is in the
+    // thousands), so the solver stops on the estimated y error instead.
+    let f = fx();
+    for (c, x) in [([0.0, 1000.0, 1.0, 1.0], 1e-6), ([0.0, 100.0, 1.0, 0.0], 1e-9), ([0.8, -500.0, 1.0, 1.0], 0.999999)] {
+        let got = f.num(&format!("bezier({x}, 0, 1, [{}, {}, {}, {}])", c[0], c[1], c[2], c[3]), 0.0);
+        let want = reference(c[0], c[1], c[2], c[3], x);
+        assert!((got - want).abs() < 1e-6, "curve {c:?} at {x}: {got} vs {want}");
+    }
+}
+
+// ---- object model -----------------------------------------------------------------------------
 #[test]
 fn comp_attributes() {
     let f = fx();
@@ -907,6 +1293,50 @@ fn source_rect_at_time() {
     assert!((s[0] + 31.0).abs() < 2.0 && (s[1] + 16.0).abs() < 2.0 && (s[2] - 62.0).abs() < 3.0, "{s:?}");
 }
 
+#[test]
+fn source_dimensions_follow_media_replacement() {
+    let mut p = Project::default();
+    let comp = Comp::new(200, 100, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+    let cid = p.add_item("Main", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+    let footage = |p: &mut Project, name: &str, width, height| {
+        p.add_item(
+            name,
+            Label::SeaFoam,
+            None,
+            ItemKind::Footage(effectcraft_project::Footage {
+                path: name.into(),
+                kind: effectcraft_project::FootageKind::Still,
+                width,
+                height,
+                has_video: true,
+                ..Default::default()
+            }),
+        )
+    };
+    let original = footage(&mut p, "original.png", 100, 80);
+    let replacement = footage(&mut p, "replacement.png", 30, 40);
+    let mut l = build::layer(&mut p, &comp, "Clip", LayerSource::Footage { item: original }, (100, 80), None);
+    l.props.prop_mut(ROT).unwrap().expr =
+        Some(Expression { text: "thisLayer.width + thisLayer.height + thisLayer.source.width + sourceRectAtTime().width".into(), enabled: true });
+    let lid = l.id;
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let c = p.comp(cid).unwrap();
+    let l = c.layer(lid).unwrap();
+    let media = effectcraft_render::MediaOverride::new(lid, replacement);
+    let ctx = EvalCtx {
+        project: &p,
+        comp_id: cid,
+        comp: c,
+        time: Tick::ZERO,
+        expr: Some(&Expressions),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[media],
+        reads: None,
+    };
+    assert_eq!(ctx.value(l, l.props.prop(ROT).unwrap()), Value::Scalar(130.0));
+}
+
 // ---- colour -----------------------------------------------------------------------------------
 
 #[test]
@@ -985,6 +1415,8 @@ fn shadowing_layer_attribute_names_is_local() {
     let f = fx();
     assert_close!(f.num("var width = 3;\nwidth * 2", 0.0), 6.0);
     assert_close!(f.num("width", 0.0), 20.0, 1e-9);
+    assert_close!(f.num("function width() { return 4; }\nwidth() * 2", 0.0), 8.0);
+    assert_close!(f.num("width", 0.0), 20.0, 1e-9);
 }
 
 #[test]
@@ -1114,7 +1546,17 @@ fn text_expression_selector_values() {
     let sel_of = |p: &Project| {
         let c = p.comp(cid).unwrap();
         let l = c.layer(lid).unwrap();
-        let ctx = EvalCtx { project: p, comp_id: cid, comp: c, time: Tick::ZERO, expr: Some(&Expressions), footage: None };
+        let ctx = EvalCtx {
+            project: p,
+            comp_id: cid,
+            comp: c,
+            time: Tick::ZERO,
+            expr: Some(&Expressions),
+            footage: None,
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: None,
+        };
         let doc = effectcraft_render::text::source_text(&ctx, l).unwrap();
         let lay = effectcraft_text::layout_doc(&doc);
         let anim = l.props.group("text/animators/#1").unwrap();
@@ -1166,6 +1608,50 @@ fn sample_image_reads_rendered_pixels() {
     assert_close!(f.num(&code("thisComp.layer(\"B\").sampleImage([-50, -50])"), 0.0), 0.0);
 }
 
+/// The footage `sampleImage` renders is a file the evaluating render read (#3184): it is noted in
+/// the render's log, also when the sampled buffer comes from the per-thread cache.
+#[test]
+fn sample_image_notes_the_files_it_reads() {
+    use effectcraft_render::reads::{FileStamp, ReadFile, ReadLog};
+    /// A grey picture of any footage, noting `/clip.png` for every read.
+    struct Clip;
+    impl effectcraft_render::FootageSource for Clip {
+        fn frame(&self, _: ItemId, f: &effectcraft_project::Footage, _: Tick) -> Option<std::sync::Arc<effectcraft_render::Image>> {
+            let mut img = effectcraft_render::Image::new(f.width, f.height);
+            img.data.fill([0.5, 0.5, 0.5, 1.0]);
+            Some(std::sync::Arc::new(img))
+        }
+        fn recording(&self, reads: &ReadLog, f: &mut dyn FnMut()) {
+            f();
+            reads.note(ReadFile::new("/clip.png", FileStamp::Native { len: 3, modified: Some(1) }));
+        }
+    }
+    let mut p = Project::default();
+    let comp = Comp::new(20, 20, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    let footage =
+        effectcraft_project::Footage { path: "/clip.png".into(), width: 8, height: 8, has_video: true, frame_rate: FrameRate::FPS_30, ..Default::default() };
+    let item = p.add_item("Clip", Label::Aqua, None, ItemKind::Footage(footage));
+    let layer = build::layer(&mut p, &comp, "Clip", LayerSource::Footage { item }, (8, 8), None);
+    let cid = p.add_item("C", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    let c = p.comp(cid).unwrap();
+    for pass in ["rendered", "cached"] {
+        let log = ReadLog::new();
+        let ctx = EvalCtx { footage: Some(&Clip), reads: Some(&log), ..EvalCtx::new(&p, cid, c, Tick::ZERO) };
+        let px = crate::sample::sample_image(ctx, cid, &layer, [4.0, 4.0], [0.5, 0.5], false, 0.0).unwrap();
+        assert!((px[0] - 0.5).abs() < 1e-3 && px[3] > 0.99, "{pass}: {px:?}");
+        let files = log.into_files();
+        assert_eq!(files.files().iter().map(|f| &*f.path).collect::<Vec<_>>(), ["/clip.png"], "{pass}");
+        assert!(files.is_complete(), "{pass}");
+    }
+}
+
+/// A huge sample point saturates the pixel coordinates; it must not overflow the loop bounds.
+#[test]
+fn sample_image_huge_point_is_transparent() {
+    let f = fx();
+    assert_close!(f.num("var c = thisComp.layer(\"B\").sampleImage([1e300, 1e300]); c[3]", 0.0), 0.0);
+}
+
 fn data_item(p: &mut Project, name: &str, text: &str) {
     let f = effectcraft_project::Footage {
         path: format!("/data/{name}"),
@@ -1270,6 +1756,89 @@ fn layer_source_is_the_layers_source_item() {
     assert_close!(f.num("thisComp.layer('Pre').source.numLayers", 0.0), 1.0);
 }
 
+/// The fixture plus a 20×12 solid "Wide", a 48×36 still "Still" (item "still.png") and a precomp
+/// layer "Pre" of the 64×32 "Other" comp.
+fn implicit_source_fx() -> (Fx, LayerId, LayerId, LayerId) {
+    let mut f = fx();
+    let main = f.p.comp(f.cid).unwrap().clone();
+    let wide = solid(&mut f.p, &main, "Wide", [1.0, 1.0, 0.0], 20, 12);
+    let item = f.p.add_item(
+        "still.png",
+        Label::SeaFoam,
+        None,
+        ItemKind::Footage(effectcraft_project::Footage {
+            path: "still.png".into(),
+            kind: effectcraft_project::FootageKind::Still,
+            width: 48,
+            height: 36,
+            has_video: true,
+            ..Default::default()
+        }),
+    );
+    let still = build::layer(&mut f.p, &main, "Still", LayerSource::Footage { item }, (48, 36), None);
+    let other = f.p.items.values().find(|i| i.name == "Other").unwrap().id;
+    let pre = build::layer(&mut f.p, &main, "Pre", LayerSource::Comp { item: other }, (64, 32), None);
+    let ids = (wide.id, still.id, pre.id);
+    let c = f.p.comp_mut(f.cid).unwrap();
+    c.layers.push(wide);
+    c.layers.push(still);
+    c.layers.push(pre);
+    (f, ids.0, ids.1, ids.2)
+}
+
+fn num_on(f: &Fx, layer: LayerId, text: &str) -> f64 {
+    match f.ev(layer, ROT, text, 0.0) {
+        Ok(v) => v.as_f64(),
+        Err(e) => panic!("{text}: {e}"),
+    }
+}
+
+#[test]
+fn implicit_source_matches_this_layer_source() {
+    let (f, wide, still, pre) = implicit_source_fx();
+    let same = "['name', 'width', 'height', 'duration', 'frameDuration', 'pixelAspect']\
+                .every(function (k) { return source[k] === thisLayer.source[k]; }) ? 1 : 0";
+    for (layer, name, w, h) in [(wide, "Wide", 20.0, 12.0), (still, "still.png", 48.0, 36.0), (pre, "Other", 64.0, 32.0)] {
+        assert_close!(num_on(&f, layer, "source.width"), w);
+        assert_close!(num_on(&f, layer, "source.height"), h);
+        assert_close!(num_on(&f, layer, &format!("source.name == '{name}' ? 1 : 0")), 1.0);
+        assert_close!(num_on(&f, layer, same), 1.0);
+    }
+    assert_close!(num_on(&f, pre, "source.numLayers"), 1.0);
+}
+
+#[test]
+fn implicit_source_is_null_without_a_source_item() {
+    let f = fx();
+    for layer in [f.title, f.shape] {
+        assert_close!(num_on(&f, layer, "source === null && thisLayer.source === null ? 1 : 0"), 1.0);
+        let bare = f.ev(layer, ROT, "source.width", 0.0).unwrap_err();
+        let qualified = f.ev(layer, ROT, "thisLayer.source.width", 0.0).unwrap_err();
+        assert!(qualified.contains("TypeError"), "{qualified}");
+        assert_eq!(bare, qualified);
+    }
+}
+
+#[test]
+fn implicit_source_can_be_shadowed_locally() {
+    let (f, wide, ..) = implicit_source_fx();
+    assert_close!(num_on(&f, wide, "var source = 7;\nsource * 2"), 14.0);
+    assert_close!(num_on(&f, wide, "source.width"), 20.0);
+    assert_close!(num_on(&f, wide, "var source = thisComp.layer('B').source;\nsource.width"), 40.0);
+    assert_close!(num_on(&f, wide, "source.height"), 12.0);
+}
+
+#[test]
+fn implicit_source_follows_the_current_layer() {
+    let (f, wide, still, pre) = implicit_source_fx();
+    let e = "source === null ? -1 : source.width * 1000 + source.height";
+    for _ in 0..2 {
+        for (layer, want) in [(wide, 20012.0), (still, 48036.0), (pre, 64032.0), (f.title, -1.0), (f.b, 40040.0)] {
+            assert_close!(num_on(&f, layer, e), want);
+        }
+    }
+}
+
 #[test]
 fn layer_control_property_stands_for_its_layer() {
     let mut f = fx();
@@ -1363,4 +1932,167 @@ fn time_to_frames_preserves_coercion_and_small_durations() {
     }
 }
 
+/// A layer is a property group too, as in After Effects: `thisLayer("transform")`, another
+/// layer's `("effects")("Slider Control")` or `(1)`, as the pick whip writes them with Compact
+/// English off (they failed: "not a callable function"). It is still a layer.
+#[test]
+fn layers_are_callable_property_groups() {
+    let f = fx();
+    assert_close!(f.num("thisLayer(\"transform\")(\"opacity\")", 0.0), 100.0);
+    assert_close!(f.num("thisComp.layer(\"A\")(\"effects\")(\"ec.control.slider\")(\"slider\")", 0.0), 42.0);
+    assert_close!(f.num("thisComp.layer(\"A\")(\"effects\")(\"Slider Control\")(1)", 0.0), 42.0);
+    assert_close!(f.num("thisComp.layer(1)(\"effects\")(1)(1)", 0.0), 42.0);
+    // Its own name, index and methods, and a layer as the result still reads as its index.
+    assert_close!(f.num("thisLayer.name == \"A\" ? thisComp.layer(\"B\").index : 0", 0.0), 2.0);
+    assert_close!(f.num("thisComp.layer(\"B\")", 0.0), 2.0);
+    assert_close!(f.num("thisComp.layer(thisComp.layer(\"B\"), -1).index", 0.0), 1.0);
+    assert!(f.err("thisLayer(\"nope\")").contains("no property"), "{}", f.err("thisLayer(\"nope\")"));
+}
+
+/// A layer is kept from one evaluation to the next (it is dear to make) but reads the project
+/// afresh in each, and an expression's own fields on it don't reach the next one.
+#[test]
+fn a_kept_layer_reads_the_project_again() {
+    let mut f = fx();
+    let first = "thisComp.layer(\"B\").index * 10 + thisComp.layer(2).name.length";
+    assert_close!(f.num(first, 0.0), 21.0);
+    f.layer_mut(f.b).name = "Bee".into();
+    f.p.comp_mut(f.cid).unwrap().layers.swap(0, 1);
+    assert_close!(f.num("thisComp.layer(\"Bee\").index * 10 + thisComp.layer(2).name.length", 0.0), 11.0);
+    assert_close!(f.num("thisLayer.index", 0.0), 2.0);
+    let _ = f.ev(f.a, ROT, "thisLayer.mine = 5; 0", 0.0);
+    assert_close!(f.num("thisLayer.mine === undefined ? 1 : 0", 0.0), 1.0);
+    let _ = f.ev(f.a, ROT, "var L = thisLayer; L.__c = 'x'; L.__l = 99; L.__i = ['Z', 7]; L.__s = __S; 0", 0.0);
+    assert_close!(f.num("thisLayer.index * 10 + thisLayer.name.length", 0.0), 21.0);
+    let _ = f.ev(f.a, ROT, "var L = thisLayer; delete L.__c; delete L.__l; delete L.__i; delete L.__s; 0", 0.0);
+    assert_close!(f.num("thisLayer.index * 10 + thisLayer.name.length", 0.0), 21.0);
+    let _ = f.ev(f.a, ROT, "Object.freeze(thisLayer); 0", 0.0);
+    f.layer_mut(f.a).name = "Ay".into();
+    f.p.comp_mut(f.cid).unwrap().layers.swap(0, 1);
+    assert_close!(f.num("thisLayer.index * 10 + thisLayer.name.length", 0.0), 12.0);
+}
+
+/// The kept layers are bounded: past the bound a layer isn't kept, an evaluation that makes more
+/// layers than are kept still sees one object for each layer it had kept, and the evaluations
+/// after it, which start over, read the right layers.
+#[test]
+fn the_kept_layers_are_bounded() {
+    let f = fx();
+    let same = "(thisLayer === thisComp.layer(thisLayer.index) ? 1 : 0)";
+    let many =
+        format!("var c = thisLayer.__c;\nfor (var i = 0; i < 5000; i++) __layer(c, 100000 + i);\n{same} * 10 + (__layer(c, 1e6) === __layer(c, 1e6) ? 0 : 1)");
+    assert_close!(f.num(&many, 0.0), 11.0);
+    assert_close!(f.num(&format!("{same} * 100 + thisLayer.index * 10 + thisLayer.name.length"), 0.0), 111.0);
+    assert_close!(f.num(&format!("{same} * 100 + thisLayer.index * 10 + thisLayer.name.length"), 0.0), 111.0);
+}
+
+/// A change to `Object.prototype` doesn't reach the kept layers: a frozen object put there under
+/// the comp's id, before any of its layers is kept, doesn't stop them being kept.
+#[test]
+fn the_kept_layers_dont_go_through_object_prototype() {
+    let f = fx();
+    let _ = f.ev(f.a, ROT, "try { Object.prototype[thisComp.__c] = Object.freeze({}); } catch (e) {} 0", 0.0);
+    assert_close!(f.num("thisLayer === thisComp.layer(thisLayer.index) ? 1 : 0", 0.0), 1.0);
+}
+
+/// The prelude is kept from one evaluation to the next, so an expression can't change its object
+/// model or internals for the ones after it.
+#[test]
+fn an_expression_cant_change_the_prelude_for_the_next() {
+    let f = fx();
+    let read = "[thisComp.layer(1).index, thisLayer.index, thisLayer('transform').property('rotation').value,                 thisLayer.transform.opacity.value, thisProject.bitsPerChannel, comp(thisComp.name).numLayers, width]";
+    let before = f.ev(f.a, ROT, read, 0.5).unwrap();
+    let attacks = [
+        "Comp.prototype.layer = function () { return 0; }",
+        "Object.getPrototypeOf(thisLayer).index = 0",
+        "Object.getPrototypeOf(thisLayer('transform')).property = function () { return 0; }",
+        "Object.getPrototypeOf(thisLayer.transform.opacity).value = 0",
+        "Comp = function () {}",
+        "Prop = function () {}",
+        "thisProject = null",
+        "__h = function () { return null; }",
+        "__layer = function () { return null; }",
+        "__child = function () {}",
+        "delete __mkProp",
+        "delete thisLayer",
+        "delete thisComp",
+        "delete width",
+        "Object.defineProperty(globalThis, 'thisComp', { get: function () { return 0; } })",
+    ];
+    for a in attacks {
+        let _ = f.ev(f.a, ROT, &format!("try {{ {a} }} catch (e) {{}} 0"), 0.0);
+        assert_eq!(f.ev(f.a, ROT, read, 0.5).unwrap(), before, "after `{a}`");
+    }
+}
+
 mod property_group;
+
+/// Timing harness for the prelude's cost on the evaluation path. Ignored: it is a measurement, not
+/// an assertion. `cargo test -p effectcraft-expr --release --lib bench_evaluation -- --ignored
+/// --nocapture`.
+#[test]
+#[ignore = "timing measurement, not a test"]
+fn bench_evaluation() {
+    let f = fx();
+    // Each case runs on a property whose dimension its answer fits: a scalar handed to `position`
+    // is rejected after the script has already run, so the case would be timing an error path.
+    // Ordinary expressions first, then three that read an inherited name in a loop: the repair
+    // turns each of those reads into an accessor call, and `Array.prototype.map` is the one an
+    // expression is most likely to reach for in quantity.
+    let cases: [(&str, &str, &str, u32); 10] = [
+        ("array maths", POS, "value + [10, 0]", 2500),
+        ("scalar maths", ROT, "time * 100 + 5", 3000),
+        ("prelude call", ROT, "linear(time, 0, 1, 0, 100)", 2500),
+        ("cross-layer read", ROT, "thisComp.layer(\"B\").transform.position[0]", 200),
+        ("effect read", ROT, "effect(\"Slider Control\")(\"Slider\")", 150),
+        ("wiggle", POS, "wiggle(2, 10)", 800),
+        ("dictionary", ROT, "var c = {}; var k = 'constructor'; c[k] = 1; c[k] + value", 2500),
+        ("toString x100", ROT, "var o = {}; var n = 0; for (var i = 0; i < 100; i++) { if (o.toString) n++; } n", 250),
+        ("hasOwnProperty x100", ROT, "var o = {}; var n = 0; for (var i = 0; i < 100; i++) { if (o.hasOwnProperty) n++; } n", 250),
+        ("array method x100", ROT, "var a = [1]; var n = 0; for (var i = 0; i < 100; i++) { if (a.map) n++; } n", 250),
+    ];
+    for (label, path, text, iters) in cases {
+        let mut best = u128::MAX;
+        // Three passes, keeping the fastest: a slower pass is scheduling noise, not the prelude.
+        for _ in 0..3 {
+            // The warm-up checks as it goes, at every time the measured loop uses: that loop drops
+            // its answer by design, so a case that had started failing would be timed on its error
+            // path and still print a number.
+            for i in 0..50 {
+                assert!(f.ev(f.a, path, text, f64::from(i % 10) * 0.1).is_ok(), "{label}");
+            }
+            let start = std::time::Instant::now();
+            for i in 0..iters {
+                let _ = f.ev(f.a, path, text, f64::from(i % 10) * 0.1);
+            }
+            best = best.min(start.elapsed().as_nanos() / u128::from(iters));
+        }
+        println!("BENCH {best:>9} ns/eval  {label} (min of 3 x {iters})");
+    }
+}
+
+/// Viewport clipping must never affect layer-space expression reads (#1388).
+#[test]
+fn sample_image_reads_3d_shape_behind_camera_before_and_after_effects() {
+    let mut p = Project::default();
+    let comp = Comp::new(100, 100, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    let mut layer = build::layer(&mut p, &comp, "Shape", LayerSource::Shape, (100, 100), None);
+    let mut next = p.next_id;
+    let mut ids = build::Ids(&mut next);
+    let rect = build::shape_rect(&mut ids, [40.0, 40.0], [0.0, 0.0], 0.0);
+    let fill = build::shape_fill(&mut ids, [1.0, 0.0, 0.0, 1.0]);
+    let group = build::shape_group(&mut ids, "Box", vec![rect, fill]);
+    layer.props.sub_mut("contents").unwrap().children.push(group.into());
+    p.next_id = next;
+    layer.switches.three_d = true;
+    layer.props.prop_mut("transform/position").unwrap().value = Value::Vec3([50.0, 50.0, -300.0]);
+    let cid = p.add_item("C", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    p.comp_mut(cid).unwrap().layers.push(layer);
+    let comp = p.comp(cid).unwrap();
+    let layer = &comp.layers[0];
+    let ctx = EvalCtx::new(&p, cid, comp, Tick::ZERO);
+    for post in [false, true] {
+        let pixel = crate::sample::sample_image(ctx, cid, layer, [0.0, 0.0], [0.5, 0.5], post, 0.0).unwrap();
+        assert!(pixel[0] > 0.99 && pixel[3] > 0.99, "postEffect={post}: {pixel:?}");
+    }
+}
diff --git a/crates/expr/src/tests/deep_nesting.rs b/crates/expr/src/tests/deep_nesting.rs
new file mode 100644
index 000000000..ae78c5b20
--- /dev/null
+++ b/crates/expr/src/tests/deep_nesting.rs
@@ -0,0 +1,130 @@
+//! Deep nesting the expression text check can't see (#2124, #2125): source handed to `eval` /
+//! `Function` at run time, and deeply nested values that boa's natives (`join`, `JSON.stringify`,
+//! proxies…) walk recursively. Each used to overflow the stack, which aborts the whole app
+//! (`catch_unwind` can't catch it); now each is an expression error.
+
+use super::*;
+
+/// The render threads' stack size (rayon's default): what the app gets.
+const RENDER_STACK: usize = 2 << 20;
+
+/// Evaluate `text` on the title's source text (any result converts) on a render-sized stack.
+fn eval_small_stack(text: &str) -> Result<Value, String> {
+    eval_on_stack(text, RENDER_STACK)
+}
+
+/// Evaluate `text` on the title's source text on a thread with `size` bytes of stack.
+fn eval_on_stack(text: &str, size: usize) -> Result<Value, String> {
+    let text = text.to_string();
+    std::thread::Builder::new()
+        .stack_size(size)
+        .spawn(move || {
+            let f = fx();
+            f.ev(f.title, "text/sourceText", &text, 0.0)
+        })
+        .unwrap()
+        .join()
+        .unwrap()
+}
+
+fn text_of(r: Result<Value, String>) -> String {
+    match r {
+        Ok(Value::Text(d)) => d.text,
+        other => panic!("not text: {other:?}"),
+    }
+}
+
+/// A 100 000-deep array: `var a = []; … a = [a]` in a loop (under the loop limit).
+const DEEP_ARRAY: &str = "var a = []; for (var i = 0; i < 100000; i++) a = [a];";
+
+#[test]
+fn eval_and_function_constructors_check_nesting() {
+    let deep = r#""(".repeat(1000) + "1" + ")".repeat(1000)"#;
+    for call in [
+        format!("eval({deep})"),
+        format!("Function({deep})()"),
+        format!("new Function('a', {deep})(1)"),
+        format!("Function('a = ' + {deep}, 'return a')()"),
+        "Function.apply(null, '('.repeat(1000).split('').concat(['1']))".to_string(),
+        format!("(function () {{}}).constructor({deep})()"),
+        format!("Object.getPrototypeOf(function* () {{}}).constructor({deep})"),
+        format!("Object.getPrototypeOf(async function () {{}}).constructor({deep})"),
+        format!("Object.getPrototypeOf(async function* () {{}}).constructor({deep})"),
+    ] {
+        let e = eval_small_stack(&call).expect_err(&call);
+        assert!(e.contains("nested too deeply"), "{call}: {e}");
+    }
+}
+
+#[test]
+fn eval_and_function_still_work() {
+    let f = fx();
+    assert_eq!(f.num("eval('1 + 2')", 0.0), 3.0);
+    assert_eq!(f.num("eval('[1, [2, (3)]]')[1][1]", 0.0), 3.0);
+    assert_eq!(f.num("new Function('a', 'b', 'return a * b')(3, 4)", 0.0), 12.0);
+    assert_eq!(f.num("Function('return 5')()", 0.0), 5.0);
+    assert_eq!(f.num("(function () {}).constructor('return 6')()", 0.0), 6.0);
+    assert_eq!(f.num("(function () {}) instanceof Function ? 1 : 0", 0.0), 1.0);
+    assert_eq!(f.num("(function () {}).constructor === Function ? 1 : 0", 0.0), 1.0);
+    assert_eq!(f.num("Object.getPrototypeOf(function* () { yield 7; }).constructor('yield 7')().next().value", 0.0), 7.0);
+}
+
+#[test]
+fn deep_array_result_is_an_error_or_text_not_a_crash() {
+    // The result itself: detaching it used to `toString` it past depth 4.
+    let _ = eval_small_stack(&format!("{DEEP_ARRAY} a"));
+    // Explicit conversions inside the script.
+    for tail in ["a.join()", "a.toString()", "String(a)", "a + ''", "`${a}`", "a.toLocaleString()", "JSON.stringify(a)", "JSON.stringify({ a: a })"] {
+        let text = format!("{DEEP_ARRAY} {tail}");
+        let e = eval_small_stack(&text).expect_err(&text);
+        assert!(e.contains("nested too deeply"), "{text}: {e}");
+    }
+    // A deep array as a text style value goes through JSON.stringify in the prelude.
+    let _ = eval_small_stack(&format!("{DEEP_ARRAY} text.sourceText.style.setFontSize(a)"));
+}
+
+#[test]
+fn deep_proxy_chain_is_an_error_not_a_crash() {
+    let text = "var p = {}; for (var i = 0; i < 100000; i++) p = new Proxy(p, {}); p.x";
+    let e = eval_small_stack(text).expect_err(text);
+    assert!(e.contains("Proxy") && e.contains("not defined"), "{text}: {e}");
+    // Neither is available to expressions; the object model's own proxies still work.
+    let f = fx();
+    assert_eq!(f.text("typeof Proxy + ' ' + typeof Reflect", 0.0), "undefined undefined");
+    assert_eq!(f.num("thisComp.layer('A').effect('Slider Control')('Slider')", 0.0), 42.0);
+}
+
+#[test]
+fn nested_values_still_convert() {
+    let f = fx();
+    assert_eq!(f.text("[[1, 2], [3, [4, 5]]].join(';')", 0.0), "1,2;3,4,5");
+    assert_eq!(f.text("String([[1, 2], 3])", 0.0), "1,2,3");
+    assert_eq!(f.text("JSON.stringify({ a: [1, { b: [2] }] })", 0.0), r#"{"a":[1,{"b":[2]}]}"#);
+    assert_eq!(f.text("JSON.stringify({ a: 1, b: 2 }, ['b'])", 0.0), r#"{"b":2}"#);
+    assert_eq!(f.text("JSON.stringify([1, [2]], null, 1)", 0.0), "[\n 1,\n [\n  2\n ]\n]");
+    assert_eq!(f.text("JSON.stringify({ a: 1 }, function (k, v) { return k === 'a' ? v + 1 : v; })", 0.0), r#"{"a":2}"#);
+    // Nested deeper than the detached levels: still converts to its text.
+    assert_eq!(text_of(eval_small_stack("[[[[[[1, 2]]]]]]")), "");
+    assert_eq!(f.text("String([[[[[[[[1]]]]]]]])", 0.0), "1");
+    assert_eq!(f.num("[1, [2, [3, [4]]]].flat(Infinity).length", 0.0), 4.0);
+}
+
+/// The main thread runs commands and syntax checks: 1 MiB on Windows. Half of it, for the
+/// callers above the evaluation, must still turn the nested-value triggers into errors.
+#[test]
+fn nested_values_are_an_error_on_half_the_main_thread() {
+    for tail in ["a.join()", "String([a])", "JSON.stringify(a)", "a.toLocaleString()"] {
+        let text = format!("{DEEP_ARRAY} {tail}");
+        let e = eval_on_stack(&text, 512 << 10).expect_err(&text);
+        assert!(e.contains("nested too deeply"), "{tail}: {e}");
+    }
+}
+
+#[test]
+fn stringify_with_a_key_list_reports_cycles_and_allows_shared_objects() {
+    let f = fx();
+    let cyclic = f.text("var o = {a: 1}; o.self = o; try { JSON.stringify(o, ['a', 'self']) } catch (e) { e.name }", 0.0);
+    assert_eq!(cyclic, "TypeError");
+    let shared = f.text("var x = {a: 1, b: 2}; JSON.stringify({p: x, q: x}, ['p', 'q', 'a'])", 0.0);
+    assert_eq!(shared, r#"{"p":{"a":1},"q":{"a":1}}"#);
+}
diff --git a/crates/expr/src/tests/fuzz.rs b/crates/expr/src/tests/fuzz.rs
index 1bfaf8c16..37b28c415 100644
--- a/crates/expr/src/tests/fuzz.rs
+++ b/crates/expr/src/tests/fuzz.rs
@@ -93,6 +93,8 @@ const SEEDS: &[&str] = &[
     "linear(time, 0, 1, 0, 100)",
     "ease(time, 0, 2, [0, 0], [100, 50])",
     "easeIn(time, 0, 1, 0, 360) + easeOut(time, 1, 2, 0, 10)",
+    "bezier(time, 0, 1, 0, 100, [0.42, 0, 0.58, 1])",
+    "bezier(time, [0, 0], [100, 50], [0.25, 0.1, 0.25, 1])",
     "clamp(value * 2, 0, 100)",
     "length([0, 0], [3, 4]) + dot([1, 0], [0, 1]) + cross([1, 0, 0], [0, 1, 0])[2]",
     "normalize([3, 4])[0] * degreesToRadians(180)",
diff --git a/crates/expr/src/tests/property_group.rs b/crates/expr/src/tests/property_group.rs
index debe5e5ac..c96045ec2 100644
--- a/crates/expr/src/tests/property_group.rs
+++ b/crates/expr/src/tests/property_group.rs
@@ -72,6 +72,9 @@ fn property_group_reaches_the_layer() {
     assert_close!(f.num("thisProperty.propertyGroup(2).name == 'A' ? 1 : 0", 0.0), 1.0);
     assert_close!(f.num("thisProperty.propertyGroup(2).index", 0.0), 1.0);
     assert_close!(f.num("thisProperty.propertyGroup(1).propertyGroup(1).name == 'A' ? 1 : 0", 0.0), 1.0);
+    // The layer it reaches is the same object as `thisLayer`.
+    assert_close!(f.num("thisLayer('transform').propertyGroup(1) === thisLayer ? 1 : 0", 0.0), 1.0);
+    assert_close!(f.num("thisProperty.propertyGroup(2) === thisLayer ? 1 : 0", 0.0), 1.0);
     let s = staggered();
     assert_close!(s.shape_num(SCALE_2, "thisProperty.propertyGroup(4).name == 'Shape' ? 1 : 0"), 1.0);
 }
diff --git a/crates/geom/src/lib.rs b/crates/geom/src/lib.rs
index a03c9d46c..794761f6c 100644
--- a/crates/geom/src/lib.rs
+++ b/crates/geom/src/lib.rs
@@ -3,7 +3,8 @@
 //!
 //! Conventions follow After Effects' public documentation: y grows downwards, angles are degrees
 //! clockwise on screen, 3D uses a left-handed system with +z pointing into the screen, and a 3D
-//! layer's rotation is Orientation (X, Y, Z) followed by X Rotation, Y Rotation, Z Rotation.
+//! layer's rotation is Orientation then X/Y/Z Rotation, each composed as `Rx · Ry · Rz` (Z turns
+//! the vector first; measured in After Effects).
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
@@ -261,6 +262,9 @@ impl Mat3 {
             return Mat3([[x1 - x0, x3 - x0, x0], [y1 - y0, y3 - y0, y0], [0.0, 0.0, 1.0]]);
         }
         let den = dx1 * dy2 - dx2 * dy1;
+        if den == 0.0 || !den.is_finite() {
+            return Mat3::IDENTITY;
+        }
         let g = (sx * dy2 - dx2 * sy) / den;
         let h = (dx1 * sy - sx * dy1) / den;
         Mat3([[x1 - x0 + g * x1, x3 - x0 + h * x3, x0], [y1 - y0 + g * y1, y3 - y0 + h * y3, y0], [g, h, 1.0]])
@@ -318,17 +322,32 @@ impl Mat4 {
         let (s, c) = deg.to_radians().sin_cos();
         Mat4([[c, -s, 0.0, 0.0], [s, c, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0], [0.0, 0.0, 0.0, 1.0]])
     }
-    /// Orientation (degrees, X then Y then Z applied to the vector in that order).
+    /// Orientation (degrees): `Rx(x) · Ry(y) · Rz(z)`, i.e. Z is applied to the vector first,
+    /// then Y, then X. Measured in After Effects 2026 (Orientation [10,20,30] and X/Y/Z Rotation
+    /// 10/20/30 on a 3D solid match this order to the anti-aliased edge; the reverse order is
+    /// 5 % of the frame off).
     pub fn orientation(o: Vec3) -> Mat4 {
-        Mat4::rotate_z(o.z) * Mat4::rotate_y(o.y) * Mat4::rotate_x(o.x)
+        Mat4::rotate_x(o.x) * Mat4::rotate_y(o.y) * Mat4::rotate_z(o.z)
     }
-    /// The 3D layer transform: layer space → parent space.
+    /// X, Y and Z Rotation of a 3D layer (degrees), composed like [`Mat4::orientation`].
+    pub fn rotation_xyz(x: f64, y: f64, z: f64) -> Mat4 {
+        Mat4::rotate_x(x) * Mat4::rotate_y(y) * Mat4::rotate_z(z)
+    }
+    /// The Orientation angles (degrees) of this matrix's rotation part: the inverse of
+    /// [`Mat4::orientation`] (Y in [-90, 90], X and Z in (-180, 180]; Z = 0 at gimbal lock).
+    pub fn orientation_angles(&self) -> Vec3 {
+        let m = &self.0;
+        let sy = m[0][2].clamp(-1.0, 1.0);
+        let cy = m[0][0].hypot(m[0][1]);
+        let y = sy.atan2(cy);
+        let (x, z) = if cy > 1e-9 { ((-m[1][2]).atan2(m[2][2]), (-m[0][1]).atan2(m[0][0])) } else { (m[2][1].atan2(m[1][1]), 0.0) };
+        vec3(x.to_degrees(), y.to_degrees(), z.to_degrees())
+    }
+    /// The 3D layer transform: layer space → parent space (Orientation, then X/Y/Z Rotation).
     pub fn layer_3d(anchor: Vec3, position: Vec3, scale_pct: Vec3, orientation: Vec3, rotation: Vec3) -> Mat4 {
         Mat4::translate(position)
             * Mat4::orientation(orientation)
-            * Mat4::rotate_z(rotation.z)
-            * Mat4::rotate_y(rotation.y)
-            * Mat4::rotate_x(rotation.x)
+            * Mat4::rotation_xyz(rotation.x, rotation.y, rotation.z)
             * Mat4::scale(scale_pct / 100.0)
             * Mat4::translate(-anchor)
     }
@@ -360,6 +379,9 @@ impl Mat4 {
     }
     /// General inverse (Gauss-Jordan with partial pivoting).
     pub fn inverse(&self) -> Option<Mat4> {
+        if !self.0.iter().flatten().all(|v| v.is_finite()) {
+            return None;
+        }
         let mut a = self.0;
         let mut inv = Mat4::IDENTITY.0;
         for col in 0..4 {
@@ -442,14 +464,107 @@ pub fn look_at(pos: Vec3, poi: Vec3, extra: Mat4) -> Mat4 {
     extra * rot * Mat4::translate(-pos)
 }
 
+/// Unit quaternion `[w, x, y, z]` of [`Mat4::orientation`]`(o)`.
+fn orientation_quat(o: Vec3) -> [f64; 4] {
+    let half = |d: f64| (d.to_radians() * 0.5).sin_cos();
+    let (sx, cx) = half(o.x);
+    let (sy, cy) = half(o.y);
+    let (sz, cz) = half(o.z);
+    // qx · qy · qz (Hamilton product), matching Rx · Ry · Rz.
+    let (w, x, y, z) = (cx * cy, sx * cy, cx * sy, sx * sy);
+    [w * cz - z * sz, x * cz + y * sz, y * cz - x * sz, z * cz + w * sz]
+}
+
+fn quat_matrix(q: [f64; 4]) -> Mat4 {
+    let [w, x, y, z] = q;
+    Mat4([
+        [1.0 - 2.0 * (y * y + z * z), 2.0 * (x * y - z * w), 2.0 * (x * z + y * w), 0.0],
+        [2.0 * (x * y + z * w), 1.0 - 2.0 * (x * x + z * z), 2.0 * (y * z - x * w), 0.0],
+        [2.0 * (x * z - y * w), 2.0 * (y * z + x * w), 1.0 - 2.0 * (x * x + y * y), 0.0],
+        [0.0, 0.0, 0.0, 1.0],
+    ])
+}
+
+/// Angle (degrees, 0..=180) of the shortest rotation between two Orientations.
+pub fn orientation_arc_deg(a: Vec3, b: Vec3) -> f64 {
+    let (p, q) = (orientation_quat(a), orientation_quat(b));
+    let d = (p[0] * q[0] + p[1] * q[1] + p[2] * q[2] + p[3] * q[3]).abs().clamp(0.0, 1.0);
+    let arc = 2.0 * d.acos().to_degrees();
+    if arc.is_finite() { arc } else { 0.0 }
+}
+
+/// Orientation between two Orientations at fraction `t`, as After Effects interpolates keyed
+/// Orientation: spherical linear interpolation of the two rotations along the shortest arc,
+/// written as angles in [0, 360) (measured in After Effects 2026: keys [0,0,0] → [10,20,30] read
+/// back [6.2643, 9.3531, 15.2190] half-way, [0,0,0] → [60,80,40] [30.6186, 35.7617, 28.4317],
+/// [0,0,0] → [0,0,270] [0, 0, 315], [0,0,0] → [0,0,720] [0, 0, 0]).
+pub fn orientation_slerp(a: Vec3, b: Vec3, t: f64) -> Vec3 {
+    let blend = a + (b - a) * t;
+    if !t.is_finite() || !blend.x.is_finite() || !blend.y.is_finite() || !blend.z.is_finite() {
+        return a;
+    }
+    let p = orientation_quat(a);
+    let mut q = orientation_quat(b);
+    let mut d = p[0] * q[0] + p[1] * q[1] + p[2] * q[2] + p[3] * q[3];
+    if d < 0.0 {
+        q = q.map(|c| -c);
+        d = -d;
+    }
+    let d = d.clamp(-1.0, 1.0);
+    let (ka, kb) = if d > 1.0 - 1e-12 {
+        (1.0 - t, t)
+    } else {
+        let om = d.acos();
+        let s = om.sin();
+        (((1.0 - t) * om).sin() / s, (t * om).sin() / s)
+    };
+    let mut r = [0.0; 4];
+    for (i, c) in r.iter_mut().enumerate() {
+        *c = ka * p[i] + kb * q[i];
+    }
+    let n = r.iter().map(|c| c * c).sum::<f64>().sqrt();
+    if !(n > 1e-12 && n.is_finite()) {
+        return a;
+    }
+    let e = quat_matrix(r.map(|c| c / n)).orientation_angles();
+    let wrap = |v: f64| {
+        let w = v.rem_euclid(360.0);
+        if w >= 360.0 - 1e-9 || w.abs() < 1e-9 { 0.0 } else { w }
+    };
+    vec3(wrap(e.x), wrap(e.y), wrap(e.z))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// A quad with three collinear corners has no projective map: identity, not NaN.
+    #[test]
+    fn square_to_quad_degenerate_is_finite() {
+        let m = Mat3::square_to_quad([vec2(0.0, 5.0), vec2(0.0, 0.0), vec2(10.0, 0.0), vec2(20.0, 0.0)]);
+        assert!(m.0.iter().flatten().all(|v| v.is_finite()), "non-finite: {m:?}");
+    }
+
+    #[test]
+    fn square_to_quad_regular_is_finite() {
+        let m = Mat3::square_to_quad([vec2(0.0, 0.0), vec2(10.0, 0.0), vec2(8.0, 6.0), vec2(0.0, 5.0)]);
+        assert!(m.0.iter().flatten().all(|v| v.is_finite()));
+    }
+
     fn close(a: Vec2, b: Vec2) -> bool {
         (a - b).length() < 1e-9
     }
 
+    #[test]
+    fn mat4_inverse_rejects_non_finite() {
+        for (r, c, v) in [(0, 0, f64::NAN), (2, 1, f64::NAN), (1, 3, f64::INFINITY)] {
+            let mut m = Mat4::IDENTITY;
+            m.0[r][c] = v;
+            assert!(m.inverse().is_none(), "{r},{c},{v}");
+        }
+        assert!(Mat4::IDENTITY.inverse().is_some());
+    }
+
     #[test]
     fn layer_2d_maps_anchor_to_position() {
         let m = Mat3::layer_2d(vec2(50.0, 25.0), vec2(960.0, 540.0), vec2(200.0, 50.0), 30.0);
@@ -483,6 +598,66 @@ mod tests {
         assert!((i.apply(m.apply(p)) - p).length() < 1e-9);
     }
 
+    fn near3(a: Vec3, b: [f64; 3], tol: f64) -> bool {
+        (a.x - b[0]).abs() < tol && (a.y - b[1]).abs() < tol && (a.z - b[2]).abs() < tol
+    }
+
+    #[test]
+    fn orientation_applies_z_then_y_then_x() {
+        // Rx · Ry · Rz: the vector is turned about Z first.
+        let o = Mat4::orientation(vec3(90.0, 0.0, 90.0));
+        let p = o.apply_vec(vec3(1.0, 0.0, 0.0));
+        // Rz(90): +x → +y; Rx(90): +y → +z.
+        assert!((p - vec3(0.0, 0.0, 1.0)).length() < 1e-12, "{p:?}");
+        let r = Mat4::rotation_xyz(10.0, 20.0, 30.0);
+        assert_eq!(r, Mat4::orientation(vec3(10.0, 20.0, 30.0)));
+    }
+
+    #[test]
+    fn orientation_angles_invert_orientation() {
+        for o in [[10.0, 20.0, 30.0], [-45.0, 80.0, 170.0], [120.0, -30.0, -90.0], [0.0, 90.0, 0.0], [30.0, -90.0, 0.0]] {
+            let m = Mat4::orientation(Vec3::from(o));
+            let back = Mat4::orientation(m.orientation_angles());
+            for r in 0..3 {
+                for c in 0..3 {
+                    assert!((m.0[r][c] - back.0[r][c]).abs() < 1e-9, "{o:?}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn keyed_orientation_slerps_as_after_effects() {
+        // After Effects 2026 read-backs of linear Orientation keys (cases 703 and 802).
+        let a = vec3(0.0, 0.0, 0.0);
+        let b = vec3(10.0, 20.0, 30.0);
+        assert!(near3(orientation_slerp(a, b, 0.25), [3.4341, 4.4691, 7.7129], 1e-3));
+        assert!(near3(orientation_slerp(a, b, 0.5), [6.2643, 9.3531, 15.2190], 1e-3));
+        assert!(near3(orientation_slerp(a, b, 0.75), [8.4650, 14.5598, 22.6095], 1e-3));
+        let b = vec3(60.0, 80.0, 40.0);
+        assert!(near3(orientation_slerp(a, b, 0.25), [16.9201, 16.0688, 16.0629], 1e-3));
+        assert!(near3(orientation_slerp(a, b, 0.5), [30.6186, 35.7617, 28.4317], 1e-3));
+        // The shortest way round, written in [0, 360).
+        assert!(near3(orientation_slerp(a, vec3(0.0, 0.0, 270.0), 0.5), [0.0, 0.0, 315.0], 1e-9));
+        assert!(near3(orientation_slerp(a, vec3(0.0, 0.0, 270.0), 0.25), [0.0, 0.0, 337.5], 1e-9));
+        assert!(near3(orientation_slerp(a, vec3(350.0, 0.0, 0.0), 0.5), [355.0, 0.0, 0.0], 1e-9));
+        assert!(near3(orientation_slerp(a, vec3(0.0, 0.0, 720.0), 0.5), [0.0, 0.0, 0.0], 1e-9));
+        // The ends are the key rotations.
+        let k = vec3(200.0, 10.0, 5.0);
+        let end = Mat4::orientation(orientation_slerp(vec3(0.0, 0.0, 350.0), k, 1.0));
+        let want = Mat4::orientation(k);
+        assert!((0..3).all(|r| (0..3).all(|c| (end.0[r][c] - want.0[r][c]).abs() < 1e-9)));
+        // Equal rotations and hostile input do not blow up.
+        let whole = Mat4::orientation(orientation_slerp(a, vec3(0.0, 0.0, 360.0), 0.5)).apply_vec(vec3(1.0, 0.0, 0.0));
+        assert!((whole - vec3(1.0, 0.0, 0.0)).length() < 1e-9 && orientation_arc_deg(a, vec3(0.0, 0.0, 360.0)) < 1e-6);
+        let nan = orientation_slerp(vec3(f64::NAN, 0.0, 0.0), b, 0.5);
+        // A non-finite key comes back as given (the first key), not as a blended rotation.
+        assert!(nan.x.is_nan() && nan.y == 0.0 && nan.z == 0.0, "{nan:?}");
+        assert!(orientation_slerp(a, b, f64::INFINITY).x.is_finite());
+        assert!((orientation_arc_deg(a, vec3(0.0, 0.0, 90.0)) - 90.0).abs() < 1e-9);
+        assert!((orientation_arc_deg(a, vec3(0.0, 0.0, 270.0)) - 90.0).abs() < 1e-9);
+    }
+
     #[test]
     fn default_camera_sees_z0_plane_unscaled() {
         let (w, h) = (1920.0, 1080.0);
diff --git a/crates/gpu/Cargo.toml b/crates/gpu/Cargo.toml
index 49fe51c16..01154dd9f 100644
--- a/crates/gpu/Cargo.toml
+++ b/crates/gpu/Cargo.toml
@@ -21,6 +21,7 @@ effectcraft-keyframe = { workspace = true }
 wgpu = { workspace = true }
 bytemuck = { workspace = true }
 log = { workspace = true }
+rayon = { workspace = true }
 web-time = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
diff --git a/crates/gpu/src/adv3d.rs b/crates/gpu/src/adv3d.rs
index 24c5a3b35..b88322316 100644
--- a/crates/gpu/src/adv3d.rs
+++ b/crates/gpu/src/adv3d.rs
@@ -77,7 +77,7 @@ fn buffer_bytes(count: u64, stride: u64, limit: u64) -> Option<u64> {
 /// Checking these before serialization bounds host packing as well as the GPU uploads.
 fn packed_bytes(counts: [u64; 6], uniform_limit: u64, storage_limit: u64, buffer_limit: u64) -> Option<[u64; 7]> {
     let mut sizes = [0; 7];
-    sizes[0] = buffer_bytes(40, 4, uniform_limit.min(buffer_limit))?;
+    sizes[0] = buffer_bytes(44, 4, uniform_limit.min(buffer_limit))?;
     for (index, (count, stride)) in counts.into_iter().zip([96, 16, 16, 80, 80, 4]).enumerate() {
         let size = count.checked_mul(stride)?.max(16);
         sizes[index + 1] = buffer_bytes(size, 1, storage_limit.min(buffer_limit))?;
@@ -164,11 +164,11 @@ mod capability_tests {
 
     #[test]
     fn packed_arrays_preflight_exact_strides_and_empty_padding() {
-        assert_eq!(packed_bytes([0; 6], 160, 16, 160), Some([160, 16, 16, 16, 16, 16, 16]));
-        assert_eq!(packed_bytes([2; 6], 160, 192, 192), Some([160, 192, 32, 32, 160, 160, 16]));
-        assert!(packed_bytes([0; 6], 159, 16, 160).is_none());
-        assert!(packed_bytes([0; 6], 160, 15, 160).is_none());
-        assert!(packed_bytes([2; 6], 160, 192, 191).is_none());
+        assert_eq!(packed_bytes([0; 6], 176, 16, 176), Some([176, 16, 16, 16, 16, 16, 16]));
+        assert_eq!(packed_bytes([2; 6], 176, 192, 192), Some([176, 192, 32, 32, 160, 160, 16]));
+        assert!(packed_bytes([0; 6], 175, 16, 176).is_none());
+        assert!(packed_bytes([0; 6], 176, 15, 176).is_none());
+        assert!(packed_bytes([2; 6], 176, 192, 191).is_none());
         for index in 0..6 {
             let mut counts = [0; 6];
             counts[index] = u64::MAX;
@@ -203,7 +203,7 @@ mod capability_tests {
         };
         for (scene, counts) in [(Scene::default(), [0; 6]), (scene, [1; 6])] {
             let actual = pack(&scene).map(|bytes| bytes.len() as u64);
-            assert_eq!(Some(actual), packed_bytes(counts, 160, 160, 160));
+            assert_eq!(Some(actual), packed_bytes(counts, 176, 176, 176));
         }
     }
 }
@@ -315,10 +315,25 @@ fn pack(s: &Scene) -> [Vec<u8>; 7] {
     globals.extend([s.eye[0], s.eye[1], s.eye[2], s.ortho as u32 as f32]);
     globals.extend([s.cam_fwd[0], s.cam_fwd[1], s.cam_fwd[2], s.lights.len() as f32]);
     globals.extend([s.ambient[0], s.ambient[1], s.ambient[2], s.env.is_some() as u32 as f32]);
-    let e = s.env.unwrap_or(effectcraft_render::three_d::adv::EnvInfo { radiance: 0, mips: 1, irradiance: 0, intensity: 0.0, rotation: 0.0 });
+    let e = s.env.unwrap_or(effectcraft_render::three_d::adv::EnvInfo {
+        radiance: 0,
+        mips: 1,
+        irradiance: 0,
+        intensity: 0.0,
+        rotation: 0.0,
+        sun: [0.0; 3],
+        key: 0.0,
+        shadow: -1,
+        shadow_darkness: 0.0,
+        shadow_diffusion: 0.0,
+    });
     globals.extend([e.radiance as f32, e.mips as f32, e.irradiance as f32, e.intensity]);
     let lit = !(s.lights.is_empty() && s.env.is_none() && s.ambient == [0.0; 3]);
-    globals.extend([e.rotation, lit as u32 as f32, 0.0, 0.0]);
+    // env2: rotation, any lighting (0/1), shadow map index (-1 none), shadow darkness.
+    globals.extend([e.rotation, lit as u32 as f32, e.shadow as f32, e.shadow_darkness]);
+    // The environment's dominant direction (its shadow's source), for the shadow bias slope,
+    // and its key fraction — how much of its light the shadow can remove (shade::env_shadow).
+    globals.extend([e.sun[0], e.sun[1], e.sun[2], e.key]);
     let mats = s.materials.iter().flat_map(|m| {
         let flags = (m.double_sided as u32)
             | (m.unlit as u32) << 1
@@ -474,7 +489,7 @@ fn raster_into(e: &mut Enc, s: &Scene) -> Option<(wgpu::Texture, wgpu::Texture)>
     let zout = tex(DEPTH_OUT, rt);
     let depth = tex(DEPTH, wgpu::TextureUsages::RENDER_ATTACHMENT);
     let (cv, zv, dv) = (color.create_view(&Default::default()), zout.create_view(&Default::default()), depth.create_view(&Default::default()));
-    let enc = e.encoder();
+    let enc = e.record(&[]);
     {
         let mut pass = enc.begin_render_pass(&wgpu::RenderPassDescriptor {
             label: Some("adv3d"),
@@ -748,7 +763,7 @@ fn dispatch(e: &mut Enc, kernel: &str, u0: [u32; 4], f0: [f32; 4], b: Binds, gro
     }
     entries.push(wgpu::BindGroupEntry { binding: 10, resource: wgpu::BindingResource::TextureView(b.out.unwrap_or(&post.dummy_out)) });
     let bg = g.device.create_bind_group(&wgpu::BindGroupDescriptor { label: Some(kernel), layout: &post.bgl, entries: &entries });
-    let enc = e.encoder();
+    let enc = e.record(&[]);
     let mut pass = enc.begin_compute_pass(&wgpu::ComputePassDescriptor { label: Some(kernel), timestamp_writes: None });
     pass.set_pipeline(pipe);
     pass.set_bind_group(0, &bg, &[]);
@@ -784,7 +799,7 @@ fn read_buffer(e: &mut Enc, buf: &wgpu::Buffer, size: u64) -> Option<Vec<u8>> {
         usage: wgpu::BufferUsages::MAP_READ | wgpu::BufferUsages::COPY_DST,
         mapped_at_creation: false,
     });
-    e.encoder().copy_buffer_to_buffer(buf, 0, &rb, 0, size);
+    e.record(&[]).copy_buffer_to_buffer(buf, 0, &rb, 0, size);
     e.submit();
     let out = e.g.read_buffer(&rb, row, row, 1).map_err(|e| log::error!("gpu 3d readback: {e}")).ok()?;
     Some(out)
@@ -907,6 +922,7 @@ fn depth_of_field(e: &mut Enc, acc: &wgpu::Buffer, depth: &wgpu::Buffer, (w, h):
 
 /// The resolved run as an image in the canvas's encoding, composited over `canvas` when given.
 pub(crate) fn finish(e: &mut Enc, r: &Resolved, encode: bool, canvas: Option<&GpuImage>) -> GpuImage {
+    canvas.inspect(|c| e.uses(c));
     let out = e.image(r.width, r.height);
     let ov = out.texture.create_view(&Default::default());
     let cv = canvas.map(|c| c.texture.create_view(&Default::default()));
@@ -1008,7 +1024,7 @@ fn render_prepared_deferred(g: &GpuContext, d: &std::sync::Arc<crate::deferred::
         usage: wgpu::BufferUsages::MAP_READ | wgpu::BufferUsages::COPY_DST,
         mapped_at_creation: false,
     });
-    e.encoder().copy_buffer_to_buffer(&r.depth, 0, &rb, 0, size);
+    e.record(&[]).copy_buffer_to_buffer(&r.depth, 0, &rb, 0, size);
     e.submit();
     let done = d.start(kz, w, h, [0.0; 2], 1.0);
     g.map_readback(&rb, row, row, 1, move |r| done(r.map_err(|e| log::error!("gpu depth readback: {e}")).ok()));
@@ -1065,6 +1081,7 @@ pub(crate) fn sky(e: &mut Enc, sky: &effectcraft_render::three_d::SkyDraw, canva
 /// Wireframe-quality layer outlines: `canvas` with `pixels` set to opaque white
 /// ([`effectcraft_render::Renderer::wireframe_pixels`]).
 pub(crate) fn wireframe(e: &mut Enc, canvas: &GpuImage, pixels: &[(u32, u32)]) -> GpuImage {
+    e.uses(canvas);
     let out = e.image(canvas.width, canvas.height);
     e.copy_into(canvas, &out, 0, 0);
     if pixels.is_empty() {
diff --git a/crates/gpu/src/bokeh.rs b/crates/gpu/src/bokeh.rs
index ac07448c9..a3f05bf12 100644
--- a/crates/gpu/src/bokeh.rs
+++ b/crates/gpu/src/bokeh.rs
@@ -10,8 +10,9 @@ use crate::context::{Enc, GpuImage, Params};
 
 /// Blur `src` (an unpadded plane buffer) as `d` says. Returns the padded, blurred image.
 pub(crate) fn apply(e: &mut Enc, src: &GpuImage, d: &PlaneDof) -> Option<GpuImage> {
-    let (w, h) = (src.width + 2 * d.pad, src.height + 2 * d.pad);
-    if !e.g.fits(w + 1, h) || d.radius.len() != w as usize * h as usize || d.levels.is_empty() {
+    // Saturating, so an oversized padding is refused by `fits` below instead of wrapping around.
+    let (w, h) = (src.width.saturating_add(d.pad.saturating_mul(2)), src.height.saturating_add(d.pad.saturating_mul(2)));
+    if !e.g.fits(w.saturating_add(1), h) || d.radius.len() != w as usize * h as usize || d.levels.is_empty() {
         return None;
     }
     let padded = e.image(w, h);
@@ -26,7 +27,7 @@ pub(crate) fn apply(e: &mut Enc, src: &GpuImage, d: &PlaneDof) -> Option<GpuImag
         padded
     };
     let prefix = e.image(w + 1, h);
-    e.dispatch("bokeh_prefix", &Params::default(), &boosted, None, &prefix, None, (h.div_ceil(64), 1));
+    e.dispatch("bokeh_prefix", &Params::default(), crate::context::KernelImages { src: &boosted, aux: None, out: &prefix }, None, (h.div_ceil(64), 1));
     // Radius map, then every level's spans.
     let mut data: Vec<f32> = d.radius.as_ref().clone();
     let mut levels = vec![];
diff --git a/crates/gpu/src/classic3d.rs b/crates/gpu/src/classic3d.rs
index 7ee2988f9..65dc52a6e 100644
--- a/crates/gpu/src/classic3d.rs
+++ b/crates/gpu/src/classic3d.rs
@@ -126,6 +126,10 @@ const LIGHT_BYTES: usize = 6 * 16;
 /// Composite a prepared Classic 3D run over `canvas`. `None` when it cannot run here (the
 /// caller draws it on the CPU).
 pub(crate) fn draw_run(e: &mut Enc, run: &Run3d, canvas: &GpuImage) -> Option<GpuImage> {
+    // FXC (DirectX 12) may fail to build the kernel (#613): the caller renders the run on the CPU.
+    if !e.g.has_kernel("classic3d") {
+        return None;
+    }
     let (w, h) = (canvas.width, canvas.height);
     let boxes: Vec<[i64; 4]> = run.planes.iter().filter(|p| p.draw).map(|p| p.bbox).collect();
     if boxes.is_empty() {
@@ -214,7 +218,14 @@ pub(crate) fn draw_run(e: &mut Enc, run: &Run3d, canvas: &GpuImage) -> Option<Gp
     let mut p = Params::default();
     p.u[0] = [run.planes.len() as u32, run.lights.len() as u32, run.casters.len() as u32, 0];
     let out = e.scratch(w, h);
-    e.dispatch_ext("classic3d", &p, &atlas, Some(canvas), &out, Some(&mb), (w.div_ceil(16), h.div_ceil(16)), Some([&pb, &gb, &lb, &cb]));
+    e.dispatch_ext(
+        "classic3d",
+        &p,
+        crate::context::KernelImages { src: &atlas, aux: Some(canvas), out: &out },
+        Some(&mb),
+        (w.div_ceil(16), h.div_ceil(16)),
+        Some([&pb, &gb, &lb, &cb]),
+    );
     Some(out)
 }
 
diff --git a/crates/gpu/src/context.rs b/crates/gpu/src/context.rs
index 7229aa5ad..1f04fa5b1 100644
--- a/crates/gpu/src/context.rs
+++ b/crates/gpu/src/context.rs
@@ -24,15 +24,90 @@ const ENTRIES: &[&str] = &[
     "fill",
 ];
 
-/// Effect entry points in `kernels.wgsl`. Like the `fx_*` kernels, one that fails to build
-/// (a driver's shader compiler rejecting it, #613) leaves its effects to the CPU instead of
-/// turning the whole compositor off.
+/// Effect entry points in `kernels.wgsl`. Like the `fx_*` kernels, they are built on first use
+/// (building all ~200 up front kept Chrome's GPU process busy past its watchdog, #1590, and
+/// FXC took over a minute, #613), and one that fails to build (a driver's shader compiler
+/// rejecting it) leaves its effects to the CPU instead of turning the whole compositor off.
 const EFFECT_ENTRIES: &[&str] = &["box_h", "box_v", "directional", "glow_bright", "glow_combine", "shadow_make", "shadow_combine", "pointwise"];
 
 /// Entry points that also bind group 1 (four read-only storage buffers; see
-/// [`Enc::dispatch_ext`]).
+/// [`Enc::dispatch_ext`]). Like the effect kernels, one that fails to build (FXC on DirectX 12
+/// can't unroll `classic3d`'s loops, #613) leaves its work to the CPU.
 const EXT_ENTRIES: &[&str] = &["classic3d"];
 
+/// What every kernel module starts with: the shared helpers and bindings, and `kernels.wgsl`
+/// (the compositor's kernels, which declare `out` and helpers the effect files use).
+const BASE_WGSL: [&str; 2] = [include_str!("shaders/common.wgsl"), include_str!("shaders/kernels.wgsl")];
+
+/// The family whose module also gets the adapter's median implementation
+/// ([`crate::fx_noise::MedianKernel::source`]), chosen when the context is created.
+const MEDIAN_FAMILY: &str = "fx_noise";
+
+/// Kernel families: each is compiled as a module of its own, `BASE_WGSL` plus its file and the
+/// files it borrows functions from, built the first time one of its kernels is. A pipeline then
+/// compiles at most ~120K characters of WGSL instead of all ~460K: on WebGPU each pipeline
+/// compiles its module again, and the page's and its workers' devices doing that for every
+/// kernel kept Chrome's GPU process busy past its watchdog (#1590). Family 0 is the base module.
+const FAMILIES: &[(&str, &[&str], &[&str])] = &[
+    ("kernels", &[], EFFECT_ENTRIES),
+    ("fx_color", &[include_str!("shaders/fx_lut.wgsl"), include_str!("shaders/fx_color.wgsl")], crate::fx_color::KERNELS),
+    ("fx_distort", &[include_str!("shaders/fx_distort.wgsl")], crate::fx_distort::KERNELS),
+    ("fx_generate", &[include_str!("shaders/fx_generate.wgsl")], crate::fx_generate::KERNELS),
+    ("fx_key", &[include_str!("shaders/fx_distort.wgsl"), include_str!("shaders/fx_key.wgsl")], crate::fx_key::KERNELS),
+    ("fx_stylize", &[include_str!("shaders/fx_stylize.wgsl")], crate::fx_stylize::KERNELS),
+    (MEDIAN_FAMILY, &[include_str!("shaders/fx_noise.wgsl")], crate::fx_noise::KERNELS),
+    ("fx_tone", &[include_str!("shaders/fx_tone.wgsl")], crate::fx_tone::KERNELS),
+    ("fx_warp", &[include_str!("shaders/fx_warp.wgsl")], crate::fx_warp::KERNELS),
+    ("fx_extra", &[include_str!("shaders/fx_generate.wgsl"), include_str!("shaders/fx_extra.wgsl")], crate::fx_extra::KERNELS),
+    ("fx_depth", &[include_str!("shaders/fx_depth.wgsl")], crate::fx_depth::KERNELS),
+    ("fx_lut", &[include_str!("shaders/fx_lut.wgsl")], crate::fx_lut::KERNELS),
+    ("fx_sim", &[include_str!("shaders/fx_sim.wgsl")], crate::fx_sim::KERNELS),
+    (
+        "fx_particles",
+        &[include_str!("shaders/fx_stylize.wgsl"), include_str!("shaders/fx_sim.wgsl"), include_str!("shaders/fx_particles.wgsl")],
+        crate::fx_particles::KERNELS,
+    ),
+    ("fx_vr", &[include_str!("shaders/fx_vr.wgsl")], crate::fx_vr::KERNELS),
+    ("fx_light", &[include_str!("shaders/fx_light.wgsl")], crate::fx_light::KERNELS),
+    ("fx_transition", &[include_str!("shaders/fx_transition.wgsl")], crate::fx_transition::KERNELS),
+    ("fx_text", &[include_str!("shaders/fx_text.wgsl")], crate::fx_text::KERNELS),
+    ("fx_time", &[include_str!("shaders/fx_time.wgsl")], crate::fx_time::KERNELS),
+    ("fx_pixel2", &[include_str!("shaders/fx_stylize.wgsl"), include_str!("shaders/fx_pixel2.wgsl")], crate::fx_pixel2::KERNELS),
+    ("fx_gen2", &[include_str!("shaders/fx_gen2.wgsl")], crate::fx_gen2::KERNELS),
+    ("inpaint", &[include_str!("shaders/inpaint.wgsl")], crate::inpaint::KERNELS),
+];
+
+/// Module `label`: `BASE_WGSL` followed by `files`.
+fn kernel_module(device: &wgpu::Device, label: &str, files: &[&str]) -> Result<wgpu::ShaderModule, String> {
+    let src: String = BASE_WGSL.iter().chain(files).copied().collect();
+    init_resource(device, &format!("{label} shader module"), || {
+        device.create_shader_module(wgpu::ShaderModuleDescriptor { label: Some(label), source: wgpu::ShaderSource::Wgsl(src.into()) })
+    })
+}
+
+/// Compute pipeline `entry` of `module`; a shader compiler rejecting it (FXC, #613) is an `Err`.
+fn build_pipeline(
+    device: &wgpu::Device,
+    module: &wgpu::ShaderModule,
+    layout: &wgpu::PipelineLayout,
+    entry: &'static str,
+) -> Result<wgpu::ComputePipeline, String> {
+    init_resource(device, entry, || {
+        device.create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
+            label: Some(entry),
+            layout: Some(layout),
+            module,
+            entry_point: Some(entry),
+            compilation_options: Default::default(),
+            cache: None,
+        })
+    })
+}
+
+/// Effect kernels by entry point: their family (index in `FAMILIES`) and, once asked for, the
+/// built pipeline or why it didn't build.
+type EffectPipelines = HashMap<&'static str, (usize, std::sync::OnceLock<Result<wgpu::ComputePipeline, String>>)>;
+
 /// Pixel format of every working texture: premultiplied RGBA, 32-bit float (32 bpc headroom;
 /// 8/16 bpc are emulated by clamping and quantising, as on the CPU).
 pub const FORMAT: wgpu::TextureFormat = wgpu::TextureFormat::Rgba32Float;
@@ -41,7 +116,17 @@ pub const FORMAT: wgpu::TextureFormat = wgpu::TextureFormat::Rgba32Float;
 const UPLOAD_BUDGET: usize = 1536 << 20;
 
 /// Working textures kept for reuse once their last image is dropped (bytes).
-const POOL_BUDGET: usize = 768 << 20;
+const POOL_BUDGET: usize = 256 << 20;
+
+/// Frames after which a size the pool was not asked for is stale: only stale sizes are
+/// evicted to make room (see [`Pool::make_free`]).
+///
+/// The clock is coarse: it advances on every finished frame ([`GpuContext::pool_frame_end`])
+/// from any thread, so with many frames in flight (an export renders up to 16 at once) this
+/// means "not asked for during the last 2 completions", not "during 2 frames' rendering". A
+/// size a slower in-flight frame still needs can go stale and be evicted. That costs a pool
+/// miss (a new allocation), never a wrong pixel.
+const STALE_FRAMES: u64 = 2;
 
 /// Readback staging buffers kept for reuse across sizes (bytes).
 const STAGING_BUDGET: u64 = 256 << 20;
@@ -65,6 +150,20 @@ impl GpuImage {
     pub fn new(texture: wgpu::Texture, width: u32, height: u32) -> GpuImage {
         GpuImage { texture, width, height, _lease: None, levels: None }
     }
+
+    /// This image leaves the [`Enc`] that made it (read by an encoder that may stay open, see
+    /// [`Enc::uses`]): when its last clone drops, its texture waits for every open encoder
+    /// ([`Pool::release`]) instead of going back to that `Enc` for immediate reuse.
+    pub(crate) fn escape(&self) {
+        if let Some(l) = &self._lease {
+            l.escaped.store(true, std::sync::atomic::Ordering::Relaxed);
+        }
+    }
+
+    /// A pooled image of another `Enc` than `owner` (see [`GpuImage::escape`]).
+    fn foreign_to(&self, owner: u64) -> bool {
+        self._lease.as_ref().is_some_and(|l| l.owner != owner)
+    }
 }
 
 /// Hands a pooled texture back to its [`Pool`] when the last [`GpuImage`] holding it drops.
@@ -73,6 +172,12 @@ struct Lease {
     pool: Weak<Mutex<Pool>>,
     /// The [`Enc`] that took it (see [`Pool::owned`]).
     owner: u64,
+    /// Another [`Enc`] recorded work on it ([`Enc::uses`], [`GpuImage::escape`]):
+    /// its owner can no longer reuse it at once, since that other encoder may still be open, so
+    /// it is released through the guarded [`Pool::release`].
+    escaped: std::sync::atomic::AtomicBool,
+    /// The pool's [`Pool::generation`] when it was taken.
+    generation: u64,
 }
 
 impl std::fmt::Debug for Lease {
@@ -86,7 +191,15 @@ impl Drop for Lease {
         if let Some(pool) = self.pool.upgrade()
             && let Ok(mut p) = pool.lock()
         {
-            p.release_owned(self.texture.clone(), self.owner);
+            // Always undo `pooled`'s leased count first: `Pool::discard` does not reset
+            // `leased`, and a stale-generation lease must still clear its contribution.
+            p.leased = p.leased.saturating_sub(tex_bytes(&self.texture));
+            if !self.escaped.load(std::sync::atomic::Ordering::Relaxed) {
+                p.release_owned(self.texture.clone(), self.owner, self.generation);
+            } else if self.generation == p.generation {
+                // Like `release_owned`, nothing taken before a failed frame comes back (#1319).
+                p.release(self.texture.clone());
+            }
         }
     }
 }
@@ -100,16 +213,42 @@ impl Drop for Lease {
 /// it was released has been submitted (or dropped).
 #[derive(Default)]
 pub(crate) struct Pool {
-    free: HashMap<(u32, u32), Vec<wgpu::Texture>>,
+    /// Free textures by size, each with the [`Pool::stamp`] at which it was freed (oldest first).
+    free: HashMap<(u32, u32), std::collections::VecDeque<(wgpu::Texture, u64)>>,
+    /// Counts frees, so the free list evicts the oldest texture first.
+    stamp: u64,
+    /// Bytes the free list may hold (0 = [`POOL_BUDGET`]); tests lower it per context.
+    budget: usize,
     /// (texture, newest encoder open at its release).
     released: Vec<(wgpu::Texture, u64)>,
     /// Encoders with recorded, unsubmitted work.
     open: BTreeSet<u64>,
     next: u64,
     bytes: usize,
+    /// Bytes currently held by live [`Lease`]s.
+    leased: usize,
     /// Working textures reused / newly allocated (diagnostics, tests).
     hits: u64,
     misses: u64,
+    /// Free textures dropped to make room for newer ones (diagnostics, tests).
+    evicted: u64,
+    /// Output frames done so far ([`GpuContext::pool_frame_end`]).
+    frame: u64,
+    /// Per size, the [`Pool::frame`] in which it was last asked for (hit or miss).
+    asked: HashMap<(u32, u32), u64>,
+    /// Bytes of evicted textures whose GPU memory may not be freed yet: wgpu frees a dropped
+    /// texture only once the submissions that used it are done. Counted against the budget
+    /// for evicting, so evicting and reallocating cannot stack up freed-but-held memory.
+    dying: Arc<std::sync::atomic::AtomicUsize>,
+    /// The [`Pool::dying`] bytes left after a [`GpuContext::pool_frame_end`] wait that cleared
+    /// none of them (`0` = not stalled). While `dying` does not drop below it, later frames only
+    /// poll instead of waiting again (each wait could take up to [`crate::readback::TIMEOUT`]
+    /// when the queue stopped completing work).
+    stalled: usize,
+    /// Number of empty-submission waits from [`GpuContext::pool_frame_end`] (diagnostics, tests).
+    waits: u64,
+    /// Reports when the submissions that may use an evicted texture are done.
+    queue: Option<wgpu::Queue>,
     /// Textures released while the [`Enc`] that took them is alive, kept for that `Enc` only.
     /// Its later commands run after everything it recorded or submitted before (one queue,
     /// recording order), so it can overwrite them at once instead of allocating a new texture
@@ -117,6 +256,8 @@ pub(crate) struct Pool {
     /// working texture of another `Enc` before it is gone.
     owned: HashMap<u64, HashMap<(u32, u32), Vec<wgpu::Texture>>>,
     next_owner: u64,
+    /// Raised by [`Pool::discard`]: a texture taken before it never comes back to the pool.
+    generation: u64,
 }
 
 /// In-`Enc` texture reuse ([`Pool::owned`]); tests turn it off to compare.
@@ -229,13 +370,100 @@ impl Pool {
         }
     }
 
+    fn budget(&self) -> usize {
+        if self.budget == 0 { POOL_BUDGET } else { self.budget }
+    }
+
+    /// Keep `t` on the free list if it fits. Otherwise make room by evicting stale sizes, least
+    /// recently freed first: sizes not asked for in the last [`STALE_FRAMES`] output frames (a
+    /// blur bound or padded layer size that no longer occurs), so they age out instead of
+    /// filling the budget for good. Sizes still in use are never evicted for a newcomer: a
+    /// frame that frees more than the budget in a repeating order would otherwise evict, on
+    /// every free, the texture the next call takes first (LRU on a cycle), and miss on every
+    /// take. If nothing stale makes room, `t` is dropped (the kept set keeps hitting).
+    ///
+    /// Evicted textures count against the budget ([`Pool::dying`]) until the GPU work
+    /// submitted so far is done. That throttles eviction to roughly one budget ahead of the
+    /// GPU; it is not a hard bound (wgpu frees a dropped texture only when the device is
+    /// maintained, which can be later than the work-done callback).
     fn make_free(&mut self, t: wgpu::Texture) {
+        use std::sync::atomic::Ordering::Relaxed;
         let b = tex_bytes(&t);
-        if self.bytes + b > POOL_BUDGET {
+        let budget = self.budget();
+        if b > budget {
+            return;
+        }
+        let mut evicted = 0;
+        while self.bytes + b > budget {
+            let frame = self.frame;
+            let asked = &self.asked;
+            let stale = |k: &(u32, u32)| asked.get(k).is_none_or(|f| frame.saturating_sub(*f) >= STALE_FRAMES);
+            let Some(oldest) = self.free.iter().filter(|(k, _)| stale(k)).filter_map(|(k, q)| q.front().map(|(_, s)| (*s, *k))).min().map(|(_, k)| k) else {
+                break;
+            };
+            let ob = oldest.0 as usize * oldest.1 as usize * 16;
+            if self.dying.load(Relaxed) + evicted + ob > budget {
+                break;
+            }
+            let Some(q) = self.free.get_mut(&oldest) else { break };
+            if let Some((old, _)) = q.pop_front() {
+                self.bytes -= tex_bytes(&old);
+                evicted += ob;
+                self.evicted += 1;
+            }
+            if q.is_empty() {
+                self.free.remove(&oldest);
+            }
+        }
+        if evicted > 0 {
+            self.dying.fetch_add(evicted, Relaxed);
+            let dying = self.dying.clone();
+            match &self.queue {
+                Some(q) => q.on_submitted_work_done(move || {
+                    let _ = dying.try_update(Relaxed, Relaxed, |d| Some(d.saturating_sub(evicted)));
+                }),
+                None => {
+                    let _ = dying.try_update(Relaxed, Relaxed, |d| Some(d.saturating_sub(evicted)));
+                }
+            }
+        }
+        if self.bytes + b > budget {
             return;
         }
         self.bytes += b;
-        self.free.entry((t.width(), t.height())).or_default().push(t);
+        self.stamp += 1;
+        self.free.entry((t.width(), t.height())).or_default().push_back((t, self.stamp));
+    }
+
+    /// An output frame is done: sizes not asked for since age towards [`STALE_FRAMES`].
+    /// Returns the evicted bytes the caller should wait for: 0 when none still count, or when a
+    /// previous wait cleared none and none has been freed since.
+    fn frame_end(&mut self) -> usize {
+        self.frame += 1;
+        let (frame, free) = (self.frame, &self.free);
+        self.asked.retain(|k, f| frame - *f < STALE_FRAMES || free.contains_key(k));
+        let d = self.dying.load(std::sync::atomic::Ordering::Relaxed);
+        if d == 0 {
+            self.stalled = 0;
+            return 0;
+        }
+        if self.stalled != 0 && d >= self.stalled {
+            // No progress since the stalled wait: do not wait again.
+            return 0;
+        }
+        self.stalled = 0;
+        d
+    }
+
+    /// A [`GpuContext::pool_frame_end`] wait finished with `before` dying bytes still counted
+    /// beforehand. A wait that freed nothing (timed out, or callbacks not run synchronously,
+    /// e.g. on WebGPU where poll does not block) marks the pool stalled.
+    fn waited(&mut self, before: usize) {
+        self.waits += 1;
+        let d = self.dying.load(std::sync::atomic::Ordering::Relaxed);
+        if d >= before {
+            self.stalled = d;
+        }
     }
 
     fn open(&mut self) -> u64 {
@@ -275,7 +503,10 @@ impl Pool {
         }
     }
 
-    fn release_owned(&mut self, t: wgpu::Texture, owner: u64) {
+    fn release_owned(&mut self, t: wgpu::Texture, owner: u64, generation: u64) {
+        if generation != self.generation {
+            return;
+        }
         if let Some(m) = self.owned.get_mut(&owner) {
             m.entry((t.width(), t.height())).or_default().push(t);
             return;
@@ -283,14 +514,92 @@ impl Pool {
         self.release(t);
     }
 
+    /// An owner for [`Enc::lent`]. It is a fresh id each time, so a lease of an earlier lent
+    /// `Enc` that drops later (an image that outlived its call) finds no owner and goes
+    /// through [`Pool::release`], which waits for every open encoder.
+    fn lend(&mut self) -> u64 {
+        self.register()
+    }
+
+    /// [`Enc::lent`] is done with `owner` (its work submitted or discarded): its kept textures
+    /// go to the shared free list at once. The free list has one [`POOL_BUDGET`] (only stale
+    /// sizes are evicted), so finished calls no longer keep a budget each (16 frame threads
+    /// kept up to 16 × `POOL_BUDGET`). The budget caps the free list only: textures waiting
+    /// for open encoders ([`Pool::released`]) and those held by live `Enc`s are outside it.
+    ///
+    /// They skip [`Pool::release`]'s wait for open encoders: a kept texture's lease has
+    /// dropped and only this `Enc` recorded work on it, which is already submitted or
+    /// discarded, so later work cannot overtake it on the queue. That is enforced, not assumed:
+    /// a lease read by another `Enc` is marked escaped
+    /// ([`GpuImage::escape`]) and released through [`Pool::release`] whenever it drops, and a
+    /// lease that drops after this call finds no owner and goes the same way.
+    fn give_back(&mut self, owner: u64) {
+        if let Some(m) = self.owned.remove(&owner) {
+            for t in m.into_values().flatten() {
+                self.make_free(t);
+            }
+        }
+    }
+
+    /// Moves `owner`'s returned working textures onto the shared free list (dropping any over
+    /// budget) right after `owner`'s encoder has been submitted, while keeping `owner` registered.
+    fn flush_owned(&mut self, owner: u64) {
+        let Some(m) = self.owned.get_mut(&owner).map(std::mem::take) else { return };
+        for t in m.into_values().flatten() {
+            self.make_free(t);
+        }
+    }
+
+    /// Bytes the pool will still keep alive (live `Lease`s, other owners' in-flight working sets,
+    /// released textures still guarded by other open encoders, and up to `budget` on the shared
+    /// free list) once `owner` flushes its returned textures and `closing_enc` submits.
+    fn kept_after_flush(&self, owner: u64, closing_enc: Option<u64>) -> usize {
+        let oldest = self.open.iter().copied().find(|&o| Some(o) != closing_enc).unwrap_or(u64::MAX);
+        let mut ready = 0usize;
+        let mut still_released = 0usize;
+        for (t, w) in &self.released {
+            let b = tex_bytes(t);
+            if *w < oldest {
+                ready += b;
+            } else {
+                still_released += b;
+            }
+        }
+        let mut self_owned = 0usize;
+        let mut other_owned = 0usize;
+        for (&k, m) in &self.owned {
+            let b: usize = m.values().flatten().map(tex_bytes).sum();
+            if k == owner {
+                self_owned += b;
+            } else {
+                other_owned += b;
+            }
+        }
+        let free_after = self.bytes.max((self.bytes + ready + self_owned).min(self.budget()));
+        self.leased + other_owned + still_released + free_after
+    }
+
+    /// Bytes of working textures kept for reuse: the free list, those waiting for open
+    /// encoders and those kept by live `Enc`s.
+    fn retained(&self) -> usize {
+        let owned = self.owned.values().flat_map(|m| m.values().flatten());
+        self.released.iter().map(|(t, _)| t).chain(owned).map(tex_bytes).fold(self.bytes, usize::saturating_add)
+    }
+
     fn take_owned(&mut self, owner: u64, w: u32, h: u32) -> Option<wgpu::Texture> {
         let t = self.owned.get_mut(&owner)?.get_mut(&(w, h))?.pop()?;
+        self.asked.insert((w, h), self.frame);
         self.hits += 1;
         Some(t)
     }
 
     fn take(&mut self, w: u32, h: u32) -> Option<wgpu::Texture> {
-        let t = self.free.get_mut(&(w, h)).and_then(Vec::pop);
+        self.asked.insert((w, h), self.frame);
+        let q = self.free.get_mut(&(w, h));
+        let t = q.and_then(|q| q.pop_back()).map(|(t, _)| t);
+        if self.free.get(&(w, h)).is_some_and(|q| q.is_empty()) {
+            self.free.remove(&(w, h));
+        }
         match &t {
             Some(t) => {
                 self.bytes -= tex_bytes(t);
@@ -305,6 +614,18 @@ impl Pool {
         self.free.clear();
         self.bytes = 0;
     }
+
+    /// After a failed frame (#1319): drop every kept texture, the free ones and those waiting
+    /// for an open encoder or kept by one, and the textures still out never return. The
+    /// encoders' bookkeeping stays, so reuse remains ordered.
+    fn discard(&mut self) {
+        self.clear();
+        self.released.clear();
+        for kept in self.owned.values_mut() {
+            kept.clear();
+        }
+        self.generation = self.generation.wrapping_add(1);
+    }
 }
 
 /// Uniform parameter block shared by every kernel (see `shaders/common.wgsl`).
@@ -351,11 +672,19 @@ pub struct GpuContext {
     pub queue: wgpu::Queue,
     pub(crate) name: String,
     pub(crate) max_dim: u32,
+    pub(crate) median_kernel: crate::fx_noise::MedianKernel,
     bgl: wgpu::BindGroupLayout,
     bgl_ext: wgpu::BindGroupLayout,
+    /// Each of `FAMILIES`' modules, built with its first kernel; and their group 0 layout.
+    modules: Vec<std::sync::OnceLock<Result<wgpu::ShaderModule, String>>>,
+    layout: wgpu::PipelineLayout,
+    /// The compositor's own kernels and Classic 3D (built up front).
     pipelines: HashMap<&'static str, wgpu::ComputePipeline>,
-    /// Effect kernels that failed to build, and why (their effects render on the CPU).
+    /// Kernels built up front that failed to build, and why (Classic 3D renders on the CPU).
     unavailable: Vec<(&'static str, String)>,
+    /// Effect kernels, built on first dispatch (`GpuContext::pipeline`); one that doesn't build
+    /// leaves its effects to the CPU.
+    effect_pipelines: EffectPipelines,
     display_bgl: wgpu::BindGroupLayout,
     display: wgpu::ComputePipeline,
     /// The display texture's next mip level from the one above (`display.wgsl` `mip`).
@@ -383,7 +712,18 @@ pub struct GpuContext {
     pub(crate) particle_states: crate::particles::StatesCell,
     /// Deferred readbacks (a browser worker's WebGPU device), see [`crate::deferred`].
     pub(crate) deferred: Option<Arc<crate::deferred::Deferred>>,
+    /// The adapter is a software rasteriser (llvmpipe, WARP): its float maths follows the
+    /// CPU's exactly, so the YUV tests hold it to exact parity.
+    #[cfg_attr(not(test), allow(dead_code))]
+    pub(crate) software: bool,
+    /// Export frame → YUV 4:2:0 kernel (built on first use).
+    pub(crate) yuv: std::sync::OnceLock<Result<crate::yuv::YuvPipe, String>>,
     readbacks: Arc<crate::readback::Readbacks>,
+    /// Serializes `device.poll` across threads (`wgpu-core 30.0.1` can panic on concurrent
+    /// `Device::maintain` when two callers poll the same device at once). Shared by every
+    /// context on the same device.
+    poll_lock: Arc<Mutex<()>>,
+    memcap: crate::memcap::MemCap,
 }
 
 fn tex_entry(binding: u32) -> wgpu::BindGroupLayoutEntry {
@@ -436,7 +776,7 @@ pub(crate) fn init_resource<T>(device: &wgpu::Device, label: &str, create: impl
 /// Browser scope completion is asynchronous. Preserve the existing browser constructor;
 /// never block its event loop or introduce a guard across an asynchronous boundary here.
 #[cfg(target_arch = "wasm32")]
-fn init_resource<T>(_device: &wgpu::Device, _label: &str, create: impl FnOnce() -> T) -> Result<T, String> {
+pub(crate) fn init_resource<T>(_device: &wgpu::Device, _label: &str, create: impl FnOnce() -> T) -> Result<T, String> {
     Ok(create())
 }
 
@@ -462,6 +802,12 @@ pub(crate) fn buffer_init(device: &wgpu::Device, queue: &wgpu::Queue, label: Opt
     buffer
 }
 
+/// The descriptor for a device the compositor owns: `MemoryUsage` so freed textures give their
+/// allocator blocks back instead of a few long-lived objects pinning large ones.
+pub(crate) fn device_descriptor(required_limits: wgpu::Limits) -> wgpu::DeviceDescriptor<'static> {
+    wgpu::DeviceDescriptor { label: Some("effectcraft gpu"), required_limits, memory_hints: wgpu::MemoryHints::MemoryUsage, ..Default::default() }
+}
+
 impl GpuContext {
     /// [`buffer_init`] on this context's device.
     pub(crate) fn buffer_init(&self, label: Option<&str>, contents: &[u8], usage: wgpu::BufferUsages) -> wgpu::Buffer {
@@ -475,6 +821,9 @@ impl GpuContext {
     /// [`Self::device_failure_notifier`] for immediate readback cancellation.
     pub fn new(adapter: &wgpu::Adapter, device: wgpu::Device, queue: wgpu::Queue) -> Result<GpuContext, String> {
         let info = adapter.get_info();
+        let median_kernel = crate::fx_noise::MedianKernel::for_adapter(info.backend, info.device_type);
+        #[cfg(test)]
+        let median_kernel = median_kernel.test_override()?;
         if !adapter.get_downlevel_capabilities().flags.contains(wgpu::DownlevelFlags::COMPUTE_SHADERS) {
             return Err(format!("{} ({:?}): no compute shaders", info.name, info.backend));
         }
@@ -494,6 +843,7 @@ impl GpuContext {
             ("max_compute_workgroup_size_x", l.max_compute_workgroup_size_x, 64),
             ("max_compute_workgroup_size_y", l.max_compute_workgroup_size_y, 16),
             ("max_compute_invocations_per_workgroup", l.max_compute_invocations_per_workgroup, 256),
+            ("max_compute_workgroup_storage_size", l.max_compute_workgroup_storage_size, median_kernel.workgroup_storage()),
         ];
         if let Some((limit, have, need)) = needs.iter().find(|(_, have, need)| have < need) {
             return Err(format!("{} ({:?}): device limit {limit} is {have}, needs {need}", info.name, info.backend));
@@ -509,36 +859,7 @@ impl GpuContext {
         if let Some(why) = &adv3d_unsupported {
             log::info!("gpu {name}: Advanced 3D renders on the CPU ({why})");
         }
-        let src = [
-            include_str!("shaders/common.wgsl"),
-            include_str!("shaders/kernels.wgsl"),
-            include_str!("shaders/classic3d.wgsl"),
-            include_str!("shaders/fx_color.wgsl"),
-            include_str!("shaders/fx_distort.wgsl"),
-            include_str!("shaders/fx_generate.wgsl"),
-            include_str!("shaders/fx_key.wgsl"),
-            include_str!("shaders/fx_stylize.wgsl"),
-            include_str!("shaders/fx_noise.wgsl"),
-            include_str!("shaders/fx_tone.wgsl"),
-            include_str!("shaders/fx_warp.wgsl"),
-            include_str!("shaders/fx_extra.wgsl"),
-            include_str!("shaders/fx_depth.wgsl"),
-            include_str!("shaders/fx_lut.wgsl"),
-            include_str!("shaders/fx_sim.wgsl"),
-            include_str!("shaders/fx_particles.wgsl"),
-            include_str!("shaders/fx_vr.wgsl"),
-            include_str!("shaders/fx_light.wgsl"),
-            include_str!("shaders/fx_transition.wgsl"),
-            include_str!("shaders/fx_text.wgsl"),
-            include_str!("shaders/fx_time.wgsl"),
-            include_str!("shaders/fx_pixel2.wgsl"),
-            include_str!("shaders/fx_gen2.wgsl"),
-            include_str!("shaders/sky.wgsl"),
-        ]
-        .concat();
-        let module = init_resource(&device, "kernels shader module", || {
-            device.create_shader_module(wgpu::ShaderModuleDescriptor { label: Some("effectcraft kernels"), source: wgpu::ShaderSource::Wgsl(src.into()) })
-        })?;
+        let module = kernel_module(&device, "effectcraft kernels", &[])?;
         let bgl = init_resource(&device, "kernels bind-group layout", || {
             device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
                 label: Some("effectcraft kernels"),
@@ -591,61 +912,39 @@ impl GpuContext {
                 immediate_size: 0,
             })
         })?;
-        let build = |e: &'static str, layout: &wgpu::PipelineLayout| {
-            init_resource(&device, e, || {
-                device.create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
-                    label: Some(e),
-                    layout: Some(layout),
-                    module: &module,
-                    entry_point: Some(e),
-                    compilation_options: Default::default(),
-                    cache: None,
-                })
-            })
-        };
-        // The compositor's own kernels are required; an effect kernel that doesn't build is
-        // left out, and its effects render on the CPU (see `Enc::take_missing`).
+        // The compositor's own kernels are required and built now. A Classic 3D kernel that
+        // doesn't build is left out (its 3D runs render on the CPU), and effect kernels are built
+        // on first use (`GpuContext::pipeline`); one that doesn't build leaves its effects to the
+        // CPU (see `Enc::take_missing`).
+        let sky = kernel_module(&device, "effectcraft sky", &[include_str!("shaders/sky.wgsl")])?;
         let mut pipelines = ENTRIES
             .iter()
-            .chain(crate::adv3d::SKY_KERNELS)
-            .map(|e| (e, &layout))
-            .chain(EXT_ENTRIES.iter().map(|e| (e, &layout_ext)))
-            .map(|(e, layout)| Ok((*e, build(e, layout)?)))
+            .map(|e| (e, &module))
+            .chain(crate::adv3d::SKY_KERNELS.iter().map(|e| (e, &sky)))
+            .map(|(e, module)| Ok((*e, build_pipeline(&device, module, &layout, e)?)))
             .collect::<Result<HashMap<_, _>, String>>()?;
         let mut unavailable = vec![];
-        for e in EFFECT_ENTRIES
-            .iter()
-            .chain(crate::fx_color::KERNELS)
-            .chain(crate::fx_distort::KERNELS)
-            .chain(crate::fx_generate::KERNELS)
-            .chain(crate::fx_key::KERNELS)
-            .chain(crate::fx_stylize::KERNELS)
-            .chain(crate::fx_noise::KERNELS)
-            .chain(crate::fx_tone::KERNELS)
-            .chain(crate::fx_warp::KERNELS)
-            .chain(crate::fx_extra::KERNELS)
-            .chain(crate::fx_depth::KERNELS)
-            .chain(crate::fx_lut::KERNELS)
-            .chain(crate::fx_sim::KERNELS)
-            .chain(crate::fx_particles::KERNELS)
-            .chain(crate::fx_vr::KERNELS)
-            .chain(crate::fx_light::KERNELS)
-            .chain(crate::fx_transition::KERNELS)
-            .chain(crate::fx_text::KERNELS)
-            .chain(crate::fx_time::KERNELS)
-            .chain(crate::fx_pixel2::KERNELS)
-            .chain(crate::fx_gen2::KERNELS)
-        {
-            match build(e, &layout) {
+        let classic3d = kernel_module(&device, "effectcraft classic3d", &[include_str!("shaders/classic3d.wgsl")]);
+        for e in EXT_ENTRIES {
+            match classic3d.as_ref().map_err(Clone::clone).and_then(|m| build_pipeline(&device, m, &layout_ext, e)) {
                 Ok(p) => {
                     pipelines.insert(*e, p);
                 }
                 Err(why) => {
-                    log::warn!("gpu {name}: kernel {e} unavailable, its effects render on the CPU: {why}");
+                    log::warn!("gpu {name}: kernel {e} unavailable, its 3D layers render on the CPU: {why}");
                     unavailable.push((*e, why));
                 }
             }
         }
+        #[cfg(test)]
+        {
+            // The numerical probe (tests) calls `fx_stylize.wgsl` helpers.
+            let probe = kernel_module(&device, "effectcraft math probe", &[include_str!("shaders/fx_stylize.wgsl"), crate::tests::MATH_PROBE_SHADER])?;
+            pipelines.insert("math_probe", build_pipeline(&device, &probe, &layout, "math_probe")?);
+        }
+        let effect_pipelines =
+            FAMILIES.iter().enumerate().flat_map(|(family, (_, _, kernels))| kernels.iter().map(move |e| (*e, (family, std::sync::OnceLock::new())))).collect();
+        let modules = std::iter::once(std::sync::OnceLock::from(Ok(module))).chain(FAMILIES.iter().skip(1).map(|_| std::sync::OnceLock::new())).collect();
         let dmodule = init_resource(&device, "display shader module", || {
             device.create_shader_module(wgpu::ShaderModuleDescriptor {
                 label: Some("effectcraft display"),
@@ -695,15 +994,22 @@ impl GpuContext {
             init_resource(&device, "dummy storage buffer", || buffer_init(&device, &queue, Some("dummy"), &[0u8; 16], wgpu::BufferUsages::STORAGE))?;
         let dummy_tex = init_resource(&device, "dummy texture view", || dummy.create_view(&Default::default()))?;
         let max_dim = device.limits().max_texture_dimension_2d;
+        let memcap = crate::memcap::MemCap::new(&info);
+        let pool_budget = if memcap.cap() > 0 { POOL_BUDGET.min((memcap.cap() / 4) as usize) } else { 0 };
+        let pool = Arc::new(Mutex::new(Pool { queue: Some(queue.clone()), budget: pool_budget, ..Default::default() }));
         Ok(GpuContext {
             device,
             queue,
             name,
             max_dim,
+            median_kernel,
             bgl,
             bgl_ext,
+            modules,
+            layout,
             pipelines,
             unavailable,
+            effect_pipelines,
             display_bgl,
             display,
             display_mip,
@@ -713,16 +1019,20 @@ impl GpuContext {
             uploads: Mutex::new(Uploads::default()),
             upload_budget: std::sync::atomic::AtomicUsize::new(UPLOAD_BUDGET),
             upload_full_warned: Default::default(),
-            pool: Default::default(),
+            pool,
             staging: Default::default(),
             transfers: Default::default(),
             zeros: Default::default(),
             adv3d: std::sync::OnceLock::new(),
+            yuv: std::sync::OnceLock::new(),
+            software: info.device_type == wgpu::DeviceType::Cpu,
             adv3d_raster: adv3d_unsupported.is_none(),
             particles: Default::default(),
             particle_states: Default::default(),
             deferred: None,
             readbacks,
+            poll_lock: Default::default(),
+            memcap,
         })
     }
 
@@ -733,6 +1043,18 @@ impl GpuContext {
         self.readbacks.check()
     }
 
+    /// Export frame → YUV 4:2:0 kernel, initialized once and `None` when shader or pipeline creation fails.
+    pub(crate) fn yuv_pipe(&self) -> Option<&crate::yuv::YuvPipe> {
+        self.yuv
+            .get_or_init(|| {
+                crate::yuv::YuvPipe::new(&self.device).inspect_err(|e| {
+                    log::warn!(target: "effectcraft_gpu", "yuv420 kernel unavailable: {e}");
+                })
+            })
+            .as_ref()
+            .ok()
+    }
+
     /// A notification hook for the owner of a shared device's error/loss handlers.
     /// Invoke it with diagnostic context when the host observes a device failure.
     /// It retires this context and settles pending readbacks without replacing any
@@ -744,10 +1066,25 @@ impl GpuContext {
         crate::readback::failure_notifier(&self.readbacks)
     }
 
+    /// Maximum time a blocking poll holds `poll_lock` in one slice so concurrent readbacks are not
+    /// starved behind a long `mem_gate` or readback wait.
+    const POLL_SLICE: std::time::Duration = std::time::Duration::from_millis(20);
+
     /// All device polling routes through this failure bridge.
     pub(crate) fn poll_readbacks(&self, kind: wgpu::PollType) -> Result<wgpu::PollStatus, String> {
         self.readbacks.check()?;
-        self.device.poll(kind).map_err(|e| {
+        let res = {
+            let _guard = match kind {
+                wgpu::PollType::Poll => match self.poll_lock.try_lock() {
+                    Ok(g) => g,
+                    Err(std::sync::TryLockError::Poisoned(e)) => e.into_inner(),
+                    Err(std::sync::TryLockError::WouldBlock) => return Ok(wgpu::PollStatus::Poll),
+                },
+                _ => self.poll_lock.lock().unwrap_or_else(|e| e.into_inner()),
+            };
+            self.device.poll(kind)
+        };
+        res.map_err(|e| {
             let error = format!("GPU readback poll: {e}");
             self.readbacks.retire(error.clone());
             log::error!("{error}");
@@ -755,6 +1092,73 @@ impl GpuContext {
         })
     }
 
+    /// Waits on `submission_index` up to `timeout` in [`Self::POLL_SLICE`] increments so wgpu
+    /// frees resources dropped before that submission without holding `poll_lock` for seconds at a
+    /// time. A timeout simply moves on without retiring the context or its readbacks; any other
+    /// poll error retires the readbacks through the failure path.
+    fn poll_wait(&self, submission_index: wgpu::SubmissionIndex, timeout: std::time::Duration) {
+        if self.readbacks.check().is_err() {
+            return;
+        }
+        let deadline = web_time::Instant::now() + timeout;
+        loop {
+            let remaining = deadline.saturating_duration_since(web_time::Instant::now());
+            let slice = remaining.min(Self::POLL_SLICE);
+            let res = {
+                let _guard = self.poll_lock.lock().unwrap_or_else(|e| e.into_inner());
+                self.device.poll(wgpu::PollType::Wait { submission_index: Some(submission_index.clone()), timeout: Some(slice) })
+            };
+            let done = match res {
+                Ok(_) => true,
+                Err(wgpu::PollError::Timeout) => false,
+                Err(e) => {
+                    let error = format!("GPU poll wait: {e}");
+                    self.readbacks.retire(error.clone());
+                    log::error!("{error}");
+                    true
+                }
+            };
+            if done || remaining <= slice {
+                break;
+            }
+        }
+    }
+
+    /// Bytes held by wgpu's device allocator (`0` on backends that do not report).
+    pub(crate) fn allocated_bytes(&self) -> u64 {
+        self.device.generate_allocator_report().map_or(0, |r| r.total_allocated_bytes)
+    }
+
+    /// Bytes held in long-lived or still-referenced GPU caches/leases that submitting and waiting
+    /// on `owner` (`closing_enc`) cannot free.
+    fn kept_bytes(&self, owner: u64, closing_enc: Option<u64>) -> u64 {
+        let uploads = self.uploads.lock().map(|u| u.bytes as u64).unwrap_or(0);
+        let pool = self.pool.lock().map(|p| p.kept_after_flush(owner, closing_enc) as u64).unwrap_or(0);
+        let staging: u64 = self.staging.lock().map(|s| s.iter().map(|(k, v)| k * v.len() as u64).sum()).unwrap_or(0);
+        let zeros: u64 = self.zeros.lock().map(|z| z.keys().map(|&(w, h)| w as u64 * h as u64 * 16).sum()).unwrap_or(0);
+        uploads + pool + staging + zeros
+    }
+
+    #[cfg(test)]
+    pub(crate) fn memcap_waits(&self) -> u64 {
+        self.memcap.waits()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn memcap_warned(&self) -> bool {
+        self.memcap.warned()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_memcap_wait_timeout(&self, timeout: std::time::Duration) {
+        self.memcap.set_wait_timeout(timeout);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn lock_poll_for_test(&self) -> std::sync::MutexGuard<'_, ()> {
+        self.poll_lock.lock().unwrap_or_else(|e| e.into_inner())
+    }
+
     /// Start a bounded buffer mapping. Retired contexts reject new requests immediately.
     pub(crate) fn map_readback(
         &self,
@@ -789,25 +1193,52 @@ impl GpuContext {
         });
     }
 
-    /// A bounded native readback: polling and receiving share one deadline.
+    /// A bounded native readback: polling and receiving share one deadline, started once
+    /// `poll_lock` is first acquired and polled in [`Self::POLL_SLICE`] slices so lock contention
+    /// never consumes the readback deadline or holds the mutex across the whole timeout.
     #[cfg(not(target_arch = "wasm32"))]
     pub(crate) fn read_buffer(&self, buffer: &wgpu::Buffer, row: usize, stride: usize, height: usize) -> Result<Vec<u8>, String> {
-        let deadline = std::time::Instant::now() + crate::readback::TIMEOUT;
         let (tx, rx) = std::sync::mpsc::channel();
         self.map_readback(buffer, row, stride, height, move |r| {
             let _ = tx.send(r);
         });
+        let mut deadline = None;
         loop {
             self.readbacks.check()?;
-            let remaining = deadline.saturating_duration_since(std::time::Instant::now());
+            if let Ok(result) = rx.try_recv() {
+                return result;
+            }
+            let (remaining, slice, poll_res) = {
+                let _guard = self.poll_lock.lock().unwrap_or_else(|e| e.into_inner());
+                self.readbacks.check()?;
+                let d = *deadline.get_or_insert_with(|| std::time::Instant::now() + crate::readback::TIMEOUT);
+                let remaining = d.saturating_duration_since(std::time::Instant::now());
+                if remaining.is_zero() {
+                    (remaining, std::time::Duration::ZERO, Ok(wgpu::PollStatus::Poll))
+                } else {
+                    let slice = remaining.min(Self::POLL_SLICE);
+                    let res = self.device.poll(wgpu::PollType::Wait { submission_index: None, timeout: Some(slice) });
+                    (remaining, slice, res)
+                }
+            };
+            if let Ok(result) = rx.try_recv() {
+                return result;
+            }
             if remaining.is_zero() {
                 let error = "GPU readback receive timed out; context retired".to_string();
                 self.readbacks.retire(error.clone());
                 return Err(error);
             }
-            // Block until the GPU is done (bounded by the deadline: a timeout retires the
-            // context) rather than polling and sleeping, which adds latency to every readback.
-            self.poll_readbacks(wgpu::PollType::Wait { submission_index: None, timeout: Some(remaining) })?;
+            match poll_res {
+                Ok(_) => {}
+                Err(wgpu::PollError::Timeout) if remaining > slice => {}
+                Err(e) => {
+                    let error = format!("GPU readback poll: {e}");
+                    self.readbacks.retire(error.clone());
+                    log::error!("{error}");
+                    return Err(error);
+                }
+            }
             // The callback may be running on another thread that polled the same device.
             match rx.recv_timeout(remaining.min(std::time::Duration::from_millis(1))) {
                 Ok(result) => return result,
@@ -870,10 +1301,7 @@ impl GpuContext {
             max_buffer_size: limits.max_buffer_size,
             ..wgpu::Limits::default()
         };
-        let (device, queue) = adapter
-            .request_device(&wgpu::DeviceDescriptor { label: Some("effectcraft gpu"), required_limits, ..Default::default() })
-            .await
-            .map_err(|e| match by_name {
+        let (device, queue) = adapter.request_device(&device_descriptor(required_limits)).await.map_err(|e| match by_name {
             true => format!("no device on {} (picked by WGPU_ADAPTER_NAME): {e}", adapter.get_info().name),
             false => format!("no device: {e}"),
         })?;
@@ -892,16 +1320,149 @@ impl GpuContext {
 
     /// Readbacks (GPU → CPU) are possible: waited for natively, or deferred (a browser
     /// worker, [`crate::deferred`]). Impossible on the browser's main thread.
-    /// Effect kernels the device couldn't build, with why: their effects render on the CPU.
-    pub fn unavailable_kernels(&self) -> &[(&'static str, String)] {
-        &self.unavailable
+    /// Kernels the device couldn't build so far, with why: their effects render on the CPU.
+    /// Effect kernels are built on first use, so one not used yet isn't listed.
+    pub fn unavailable_kernels(&self) -> Vec<(&'static str, String)> {
+        let mut out: Vec<_> = self
+            .unavailable
+            .iter()
+            .cloned()
+            .chain(self.effect_pipelines.iter().filter_map(|(e, (_, cell))| match cell.get() {
+                Some(Err(why)) => Some((*e, why.clone())),
+                _ => None,
+            }))
+            .collect();
+        out.sort_unstable_by_key(|(e, _)| *e);
+        out
+    }
+
+    /// Whether kernel `entry` is available (an effect or Classic 3D kernel can be missing,
+    /// #613); an effect kernel not built yet is built now.
+    pub(crate) fn has_kernel(&self, entry: &str) -> bool {
+        self.pipeline(entry).is_some()
+    }
+
+    /// Kernel `entry`'s pipeline: one built up front, or an effect kernel, built the first time
+    /// it is asked for. `None` when the device doesn't have it.
+    fn pipeline(&self, entry: &str) -> Option<&wgpu::ComputePipeline> {
+        if let Some(p) = self.pipelines.get(entry) {
+            return Some(p);
+        }
+        let Some((e, (family, cell))) = self.effect_pipelines.get_key_value(entry) else {
+            if !self.unavailable.iter().any(|(e, _)| *e == entry) {
+                log::error!("gpu: no kernel {entry}");
+            }
+            return None;
+        };
+        let built = cell.get_or_init(|| {
+            let built = self.family_module(*family).and_then(|module| build_pipeline(&self.device, module, &self.layout, e));
+            if let Err(why) = &built {
+                log::warn!("gpu {}: kernel {e} unavailable, its effects render on the CPU: {why}", self.name);
+            }
+            built
+        });
+        built.as_ref().ok()
+    }
+
+    /// Family `family`'s module (`FAMILIES`), built the first time it is asked for.
+    fn family_module(&self, family: usize) -> Result<&wgpu::ShaderModule, String> {
+        let (Some((label, files, _)), Some(cell)) = (FAMILIES.get(family), self.modules.get(family)) else {
+            return Err(format!("no kernel family {family}"));
+        };
+        cell.get_or_init(|| {
+            let median = [self.median_kernel.source()];
+            let extra: &[&str] = if *label == MEDIAN_FAMILY { &median } else { &[] };
+            let files: Vec<&str> = files.iter().chain(extra).copied().collect();
+            kernel_module(&self.device, label, &files)
+        })
+        .as_ref()
+        .map_err(Clone::clone)
+    }
+
+    /// Build every effect kernel not built yet (tests; and a host that would rather pay the
+    /// compile time up front than on first use).
+    pub fn build_all_kernels(&self) {
+        for e in self.effect_pipelines.keys() {
+            let _ = self.pipeline(e);
+        }
+    }
+
+    /// How many effect kernels have been built (tests).
+    #[cfg(test)]
+    pub(crate) fn effect_pipelines_built(&self) -> usize {
+        self.effect_pipelines.values().filter(|(_, cell)| matches!(cell.get(), Some(Ok(_)))).count()
+    }
+
+    /// Leave kernel `entry` out of `pipelines`/`effect_pipelines`, as if it had failed to build.
+    #[cfg(test)]
+    fn drop_from(
+        pipelines: &mut HashMap<&'static str, wgpu::ComputePipeline>,
+        unavailable: &mut Vec<(&'static str, String)>,
+        effects: &mut EffectPipelines,
+        entry: &'static str,
+    ) {
+        let why = "dropped by a test".to_string();
+        pipelines.remove(entry);
+        match effects.get(entry).map(|(f, _)| *f) {
+            Some(family) => {
+                effects.insert(entry, (family, std::sync::OnceLock::from(Err(why))));
+            }
+            None => unavailable.push((entry, why)),
+        }
     }
 
     /// Leave kernel `entry` out, as if it had failed to build (tests of the CPU fallback).
     #[cfg(test)]
     pub(crate) fn drop_kernel(&mut self, entry: &'static str) {
-        self.pipelines.remove(entry);
-        self.unavailable.push((entry, "dropped by a test".into()));
+        Self::drop_from(&mut self.pipelines, &mut self.unavailable, &mut self.effect_pipelines, entry);
+    }
+
+    /// A copy of this context sharing the same [`wgpu::Device`] and [`wgpu::Queue`] with
+    /// kernel `entry` left out, as if it had failed to build (tests of the CPU fallback
+    /// without opening a second device on `llvmpipe`).
+    #[cfg(test)]
+    pub(crate) fn without_kernel(&self, entry: &'static str) -> GpuContext {
+        let mut pipelines = self.pipelines.clone();
+        let mut unavailable = self.unavailable.clone();
+        let mut effect_pipelines = self.effect_pipelines.clone();
+        Self::drop_from(&mut pipelines, &mut unavailable, &mut effect_pipelines, entry);
+        GpuContext {
+            device: self.device.clone(),
+            queue: self.queue.clone(),
+            name: self.name.clone(),
+            max_dim: self.max_dim,
+            median_kernel: self.median_kernel,
+            bgl: self.bgl.clone(),
+            bgl_ext: self.bgl_ext.clone(),
+            modules: self.modules.clone(),
+            layout: self.layout.clone(),
+            pipelines,
+            unavailable,
+            effect_pipelines,
+            display_bgl: self.display_bgl.clone(),
+            display: self.display.clone(),
+            display_mip: self.display_mip.clone(),
+            dummy_tex: self.dummy_tex.clone(),
+            dummy: self.dummy.clone(),
+            dummy_buf: self.dummy_buf.clone(),
+            uploads: Mutex::new(Uploads::default()),
+            upload_budget: std::sync::atomic::AtomicUsize::new(UPLOAD_BUDGET),
+            upload_full_warned: Default::default(),
+            pool: self.pool.clone(),
+            staging: Default::default(),
+            transfers: Default::default(),
+            zeros: Default::default(),
+            adv3d: std::sync::OnceLock::new(),
+            adv3d_raster: self.adv3d_raster,
+            particles: Default::default(),
+            particle_states: Default::default(),
+            deferred: self.deferred.clone(),
+            readbacks: self.readbacks.clone(),
+            software: self.software,
+            yuv: std::sync::OnceLock::new(),
+            poll_lock: self.poll_lock.clone(),
+            memcap: self.memcap.fresh(),
+        }
     }
 
     /// Bytes of readback staging buffers kept for reuse (tests).
@@ -930,8 +1491,9 @@ impl GpuContext {
     }
 
     fn texture(&self, w: u32, h: u32) -> wgpu::Texture {
+        // Named with its size, so a GPU error about it says which texture failed (#1319).
         self.device.create_texture(&wgpu::TextureDescriptor {
-            label: None,
+            label: Some(&format!("working image {w}×{h}")),
             size: wgpu::Extent3d { width: w.max(1), height: h.max(1), depth_or_array_layers: 1 },
             mip_level_count: 1,
             sample_count: 1,
@@ -946,10 +1508,19 @@ impl GpuContext {
     /// one is zeroed.
     fn pooled(&self, w: u32, h: u32, owner: u64) -> (GpuImage, bool) {
         let (w, h) = (w.max(1), h.max(1));
-        let reused = self.pool.lock().ok().and_then(|mut p| p.take_owned(owner, w, h).or_else(|| p.take(w, h)));
+        let bytes = w as usize * h as usize * 16;
+        let (reused, generation) = self
+            .pool
+            .lock()
+            .map(|mut p| {
+                let t = p.take_owned(owner, w, h).or_else(|| p.take(w, h));
+                p.leased += bytes;
+                (t, p.generation)
+            })
+            .unwrap_or((None, u64::MAX));
         let was_reused = reused.is_some();
         let texture = reused.unwrap_or_else(|| self.texture(w, h));
-        let lease = Arc::new(Lease { texture: texture.clone(), pool: Arc::downgrade(&self.pool), owner });
+        let lease = Arc::new(Lease { texture: texture.clone(), pool: Arc::downgrade(&self.pool), owner, escaped: Default::default(), generation });
         (GpuImage { texture, width: w, height: h, _lease: Some(lease), levels: None }, was_reused)
     }
 
@@ -976,6 +1547,73 @@ impl GpuContext {
         }
     }
 
+    /// Bytes of working textures the pool keeps for reuse (see [`GpuContext::trim_pool`]).
+    pub fn pool_retained_bytes(&self) -> usize {
+        self.pool.lock().map(|p| p.retained()).unwrap_or_default()
+    }
+
+    /// Drop the working textures kept for reuse (a render is done). Textures still waiting for
+    /// an open encoder and those of live `Enc`s are unaffected.
+    pub fn trim_pool(&self) {
+        if let Ok(mut p) = self.pool.lock() {
+            p.clear();
+        }
+    }
+
+    /// An output frame is done: the pool ages the sizes not asked for since (only sizes unused
+    /// for [`STALE_FRAMES`] frames are evicted to make room for others). When evicted textures
+    /// still count ([`Pool::dying`]), waits once so their work-done callbacks can clear that
+    /// count; if the wait frees none of them, later frames only poll until `dying` drops (a
+    /// stopped queue must not re-wait [`crate::readback::TIMEOUT`] on every frame).
+    pub fn pool_frame_end(&self) {
+        let before = self.pool.lock().map(|mut p| p.frame_end()).unwrap_or_default();
+        if before > 0 {
+            // A work-done callback waits for a submission; an empty one closes the wait.
+            let index = self.queue.submit([]);
+            self.poll_wait(index, crate::readback::TIMEOUT);
+            if let Ok(mut p) = self.pool.lock() {
+                p.waited(before);
+            }
+        } else {
+            let _ = self.poll_readbacks(wgpu::PollType::Poll);
+        }
+    }
+
+    /// Bytes the pool's free list may keep (tests lower it on a context of their own).
+    #[cfg(test)]
+    pub(crate) fn set_pool_budget(&self, bytes: usize) {
+        if let Ok(mut p) = self.pool.lock() {
+            p.budget = bytes;
+        }
+    }
+
+    /// Free textures evicted to make room for newer ones.
+    #[cfg(test)]
+    pub(crate) fn pool_evictions(&self) -> u64 {
+        self.pool.lock().map(|p| p.evicted).unwrap_or_default()
+    }
+
+    /// Empty-submission waits from [`GpuContext::pool_frame_end`].
+    #[cfg(test)]
+    pub(crate) fn pool_waits(&self) -> u64 {
+        self.pool.lock().map(|p| p.waits).unwrap_or_default()
+    }
+
+    /// Add or subtract phantom [`Pool::dying`] bytes without a work-done callback (tests that
+    /// simulate a queue which stopped completing work).
+    #[cfg(test)]
+    pub(crate) fn pool_charge_dying(&self, bytes: isize) {
+        use std::sync::atomic::Ordering::Relaxed;
+        if let Ok(p) = self.pool.lock() {
+            if bytes >= 0 {
+                p.dying.fetch_add(bytes as usize, Relaxed);
+            } else {
+                let sub = (-bytes) as usize;
+                let _ = p.dying.try_update(Relaxed, Relaxed, |d| Some(d.saturating_sub(sub)));
+            }
+        }
+    }
+
     /// Texture pool counters: (working textures reused, newly allocated).
     pub fn pool_stats(&self) -> (u64, u64) {
         self.pool.lock().map(|p| (p.hits, p.misses)).unwrap_or_default()
@@ -1065,6 +1703,21 @@ impl GpuContext {
             s.clear();
         }
     }
+
+    /// After a failed frame: forget every texture and buffer kept for reuse, since any of them
+    /// may be one the device rejected (#1319). Later frames allocate afresh.
+    pub fn discard_kept(&self) {
+        self.clear_uploads();
+        if let Ok(mut p) = self.pool.lock() {
+            p.discard();
+        }
+        if let Ok(mut z) = self.zeros.lock() {
+            z.clear();
+        }
+        if let Ok(mut c) = self.particle_states.lock() {
+            c.clear();
+        }
+    }
 }
 
 /// Records GPU work for one render (a command encoder submitted at readback or the end).
@@ -1072,11 +1725,21 @@ pub(crate) struct Enc<'g> {
     pub g: &'g GpuContext,
     /// The open command encoder and its id in the texture pool.
     enc: Option<(wgpu::CommandEncoder, u64)>,
+    last_submit: Option<wgpu::SubmissionIndex>,
     pending: usize,
     /// A dispatch named a kernel the device doesn't have (see [`Enc::take_missing`]).
     missing: bool,
     /// This `Enc`'s id in the texture pool (textures it may reuse at once).
     owner: u64,
+    /// `owner` is lent ([`Enc::lent`]) and outlives this `Enc`.
+    lent: bool,
+}
+
+/// Images bound to a compute kernel's source, optional auxiliary and output slots.
+pub(crate) struct KernelImages<'a> {
+    pub src: &'a GpuImage,
+    pub aux: Option<&'a GpuImage>,
+    pub out: &'a GpuImage,
 }
 
 impl Drop for Enc<'_> {
@@ -1086,7 +1749,11 @@ impl Drop for Enc<'_> {
             if let Some((_, id)) = self.enc.take() {
                 p.close(id);
             }
-            p.unregister(self.owner);
+            if self.lent {
+                p.give_back(self.owner);
+            } else {
+                p.unregister(self.owner);
+            }
         }
     }
 }
@@ -1094,7 +1761,27 @@ impl Drop for Enc<'_> {
 impl<'g> Enc<'g> {
     pub fn new(g: &'g GpuContext) -> Enc<'g> {
         let owner = g.pool.lock().map(|mut p| p.register()).unwrap_or(0);
-        Enc { g, enc: None, pending: 0, missing: false, owner }
+        Enc { g, enc: None, last_submit: None, pending: 0, missing: false, owner, lent: false }
+    }
+
+    /// An `Enc` for self-contained work (an effect chain): once it is dropped, its working
+    /// textures can be reused at once ([`Pool::give_back`]). Its images stay with it, except a
+    /// result another `Enc` records work on ([`Enc::uses`]), whose lease then releases through
+    /// the guarded [`Pool::release`]. A plain [`Enc::new`] hands its
+    /// textures back through the shared pool, where they wait for every open encoder, and a
+    /// GPU frame keeps its encoder open while the CPU renders layers with GPU effects, so every
+    /// effect's intermediates stayed allocated until the frame ended.
+    pub(crate) fn lent(g: &'g GpuContext) -> Enc<'g> {
+        let owner = g.pool.lock().map(|mut p| p.lend()).unwrap_or(0);
+        Enc { g, enc: None, last_submit: None, pending: 0, missing: false, owner, lent: true }
+    }
+
+    /// `img` is used by this `Enc`: if another `Enc` made it, that one must not reuse it at once
+    /// (this encoder may still be open when its lease drops), so mark it escaped.
+    pub(crate) fn uses(&self, img: &GpuImage) {
+        if img.foreign_to(self.owner) {
+            img.escape();
+        }
     }
 
     /// Whether a dispatch since the last call named a kernel the device doesn't have (one
@@ -1103,7 +1790,21 @@ impl<'g> Enc<'g> {
         std::mem::take(&mut self.missing)
     }
 
-    pub(crate) fn encoder(&mut self) -> &mut wgpu::CommandEncoder {
+    /// The command encoder, to record work that touches `imgs` (every pooled image the commands
+    /// read or write; buffers and textures of the caller's own need not be named). The only
+    /// way to record outside this module: naming the images marks foreign leases escaped
+    /// ([`Enc::uses`]). Callers must name every pooled image the encoder's work uses, here or
+    /// with separate [`Enc::uses`] calls (`record(&[])` plus `uses()` is allowed); this is a
+    /// convention, not enforced, and skipping it reintroduces the reuse race it guards (#1441).
+    pub(crate) fn record(&mut self, imgs: &[&GpuImage]) -> &mut wgpu::CommandEncoder {
+        for img in imgs {
+            self.uses(img);
+        }
+        self.encoder()
+    }
+
+    /// The raw encoder: within this module only, after [`Enc::uses`] on every pooled image.
+    fn encoder(&mut self) -> &mut wgpu::CommandEncoder {
         let g = self.g;
         &mut self
             .enc
@@ -1152,37 +1853,23 @@ impl<'g> Enc<'g> {
     }
 
     /// Run kernel `entry` writing `out` (dispatched over `groups` workgroups).
-    pub fn dispatch(
-        &mut self,
-        entry: &str,
-        p: &Params,
-        src: &GpuImage,
-        aux: Option<&GpuImage>,
-        out: &GpuImage,
-        data: Option<&wgpu::Buffer>,
-        groups: (u32, u32),
-    ) {
-        self.dispatch_ext(entry, p, src, aux, out, data, groups, None);
+    pub fn dispatch(&mut self, entry: &str, p: &Params, images: KernelImages<'_>, data: Option<&wgpu::Buffer>, groups: (u32, u32)) {
+        self.dispatch_ext(entry, p, images, data, groups, None);
     }
 
     /// [`Enc::dispatch`] for the kernels in `EXT_ENTRIES`, with their group 1 storage buffers.
-    #[allow(clippy::too_many_arguments)]
     pub fn dispatch_ext(
         &mut self,
         entry: &str,
         p: &Params,
-        src: &GpuImage,
-        aux: Option<&GpuImage>,
-        out: &GpuImage,
+        images: KernelImages<'_>,
         data: Option<&wgpu::Buffer>,
         groups: (u32, u32),
         ext: Option<[&wgpu::Buffer; 4]>,
     ) {
+        let KernelImages { src, aux, out } = images;
         let g = self.g;
-        let Some(pipe) = g.pipelines.get(entry) else {
-            if !g.unavailable.iter().any(|(e, _)| *e == entry) {
-                log::error!("gpu: no kernel {entry}");
-            }
+        let Some(pipe) = g.pipeline(entry) else {
             self.missing = true;
             return;
         };
@@ -1213,7 +1900,8 @@ impl<'g> Enc<'g> {
                 ],
             })
         });
-        let enc = self.encoder();
+        let imgs: Vec<&GpuImage> = [Some(src), aux, Some(out)].into_iter().flatten().collect();
+        let enc = self.record(&imgs);
         {
             let mut pass = enc.begin_compute_pass(&wgpu::ComputePassDescriptor { label: Some(entry), timestamp_writes: None });
             pass.set_pipeline(pipe);
@@ -1233,12 +1921,12 @@ impl<'g> Enc<'g> {
     /// Per-pixel kernel over `out`'s size (16×16 workgroups).
     pub fn pixels(&mut self, entry: &str, p: &Params, src: &GpuImage, aux: Option<&GpuImage>, out: &GpuImage, data: Option<&wgpu::Buffer>) {
         let groups = (out.width.div_ceil(16), out.height.div_ceil(16));
-        self.dispatch(entry, p, src, aux, out, data, groups);
+        self.dispatch(entry, p, KernelImages { src, aux, out }, data, groups);
     }
 
     /// Copy `src` into a larger zeroed image at (`x`, `y`) (Buf::pad).
     pub fn copy_into(&mut self, src: &GpuImage, dst: &GpuImage, x: u32, y: u32) {
-        let enc = self.encoder();
+        let enc = self.record(&[src, dst]);
         enc.copy_texture_to_texture(
             wgpu::TexelCopyTextureInfo { texture: &src.texture, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
             wgpu::TexelCopyTextureInfo { texture: &dst.texture, mip_level: 0, origin: wgpu::Origin3d { x, y, z: 0 }, aspect: wgpu::TextureAspect::All },
@@ -1246,10 +1934,28 @@ impl<'g> Enc<'g> {
         );
     }
 
+    /// A `w` × `h` image showing `src` with its pixel (`x`, `y`) at the top-left, transparent
+    /// where `src` doesn't reach (Image::crop).
+    pub fn crop(&mut self, src: &GpuImage, x: i64, y: i64, w: u32, h: u32) -> GpuImage {
+        let dst = self.image(w, h);
+        let span = |o: i64, n: u32, len: u32| {
+            let (a, b) = (o.max(0), (o + n as i64).min(len as i64));
+            (b > a).then(|| (a as u32, (a - o) as u32, (b - a) as u32))
+        };
+        let (Some((sx, dx, cw)), Some((sy, dy, ch))) = (span(x, w, src.width), span(y, h, src.height)) else { return dst };
+        let enc = self.record(&[src, &dst]);
+        enc.copy_texture_to_texture(
+            wgpu::TexelCopyTextureInfo { texture: &src.texture, mip_level: 0, origin: wgpu::Origin3d { x: sx, y: sy, z: 0 }, aspect: wgpu::TextureAspect::All },
+            wgpu::TexelCopyTextureInfo { texture: &dst.texture, mip_level: 0, origin: wgpu::Origin3d { x: dx, y: dy, z: 0 }, aspect: wgpu::TextureAspect::All },
+            wgpu::Extent3d { width: cw, height: ch, depth_or_array_layers: 1 },
+        );
+        dst
+    }
+
     /// Submit recorded work.
     pub fn submit(&mut self) {
         if let Some((enc, id)) = self.enc.take() {
-            self.g.queue.submit([enc.finish()]);
+            self.last_submit = Some(self.g.queue.submit([enc.finish()]));
             if let Ok(mut p) = self.g.pool.lock() {
                 p.close(id);
             }
@@ -1257,8 +1963,34 @@ impl<'g> Enc<'g> {
         self.pending = 0;
     }
 
+    /// Submits and waits on this encoder's own submission when the device allocator is over the
+    /// memory cap and enough of that memory is reclaimable, so wgpu frees textures dropped so far.
+    pub fn mem_gate(&mut self) {
+        if !self.g.memcap.due() {
+            return;
+        }
+        let allocated = self.g.allocated_bytes();
+        if allocated <= self.g.memcap.cap() {
+            let _ = self.g.memcap.should_wait(allocated, 0);
+            return;
+        }
+        let closing = self.enc.as_ref().map(|(_, id)| *id);
+        let kept = self.g.kept_bytes(self.owner, closing);
+        if !self.g.memcap.should_wait(allocated, kept) {
+            return;
+        }
+        self.submit();
+        if let Ok(mut p) = self.g.pool.lock() {
+            p.flush_owned(self.owner);
+        }
+        let idx = self.last_submit.take().unwrap_or_else(|| self.g.queue.submit([]));
+        self.g.poll_wait(idx, self.g.memcap.wait_timeout());
+        self.g.memcap.record_wait(self.g.allocated_bytes(), self.g.kept_bytes(self.owner, None));
+    }
+
     /// Read an image back to the CPU (submits and waits). `None` where readback is impossible.
     pub fn download(&mut self, img: &GpuImage) -> Option<Image> {
+        self.uses(img);
         let layout = crate::readback::Layout::new(img.width, img.height, 16, self.g.device.limits().max_buffer_size)
             .map_err(|e| log::error!("gpu image readback: {e}"))
             .ok()?;
@@ -1267,23 +1999,31 @@ impl<'g> Enc<'g> {
         data.resize(layout.len / 16, [0.0; 4]);
         let mut out = Image { width: img.width, height: img.height, data };
         let dst: &mut [u8] = bytemuck::cast_slice_mut(&mut out.data);
-        self.read_texture_into(&img.texture, img.width, img.height, 16, dst)?;
+        self.read_texture_into(&img.texture, [0, 0, img.width, img.height], 16, dst)?;
         Some(out)
     }
 
     /// Tightly packed texel bytes of a texture (`bpp` bytes per pixel).
     pub fn read_texture(&mut self, texture: &wgpu::Texture, w: u32, h: u32, bpp: u32) -> Option<Vec<u8>> {
+        self.read_rect(texture, 0, 0, w, h, bpp)
+    }
+
+    /// [`Enc::read_texture`] of a sub-rectangle at (`x`, `y`): a fill only changes its hole, so
+    /// only the hole's bounds need to cross back (`bytes_per_row` is still row-aligned inside).
+    pub fn read_rect(&mut self, texture: &wgpu::Texture, x: u32, y: u32, w: u32, h: u32, bpp: u32) -> Option<Vec<u8>> {
         let layout =
             crate::readback::Layout::new(w, h, bpp, self.g.device.limits().max_buffer_size).map_err(|e| log::error!("gpu texture readback: {e}")).ok()?;
         let mut out = Vec::new();
         out.try_reserve_exact(layout.len).map_err(|e| log::error!("gpu readback allocation: {e}")).ok()?;
         out.resize(layout.len, 0);
-        self.read_texture_into(texture, w, h, bpp, &mut out)?;
+        self.read_texture_into(texture, [x, y, w, h], bpp, &mut out)?;
         Some(out)
     }
 
-    /// [`Enc::read_texture`] into `out` (`w × bpp × h` bytes), through a reused staging buffer.
-    fn read_texture_into(&mut self, texture: &wgpu::Texture, w: u32, h: u32, bpp: u32, out: &mut [u8]) -> Option<()> {
+    /// [`Enc::read_rect`] into `out` (`w × bpp × h` bytes), through a reused staging buffer.
+    /// `rect` is `[x, y, w, h]`.
+    fn read_texture_into(&mut self, texture: &wgpu::Texture, rect: [u32; 4], bpp: u32, out: &mut [u8]) -> Option<()> {
+        let [x, y, w, h] = rect;
         if !self.g.can_wait() {
             return None;
         }
@@ -1306,7 +2046,7 @@ impl<'g> Enc<'g> {
             })
         });
         self.encoder().copy_texture_to_buffer(
-            wgpu::TexelCopyTextureInfo { texture, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+            wgpu::TexelCopyTextureInfo { texture, mip_level: 0, origin: wgpu::Origin3d { x, y, z: 0 }, aspect: wgpu::TextureAspect::All },
             wgpu::TexelCopyBufferInfo { buffer: &buf, layout: wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(padded), rows_per_image: Some(h) } },
             wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
         );
@@ -1375,6 +2115,7 @@ impl<'g> Enc<'g> {
     /// once they arrived (`Some(None)`: the readback failed), else `None` after starting the
     /// copy if needed and marking the pass missed.
     pub(crate) fn read_keyed(&mut self, img: &GpuImage, key: u128, offset: [f64; 2], scale: f64) -> Option<Option<crate::deferred::Readback>> {
+        self.uses(img);
         use crate::deferred::Lookup;
         let d = self.g.deferred.clone()?;
         match d.lookup(key) {
@@ -1402,6 +2143,7 @@ impl<'g> Enc<'g> {
     /// Copy an image into a storage buffer (RGBA f32 rows) for kernels that read a third image
     /// through `data`: (buffer, row length in pixels).
     pub fn image_rows(&mut self, img: &GpuImage) -> (wgpu::Buffer, u32) {
+        self.uses(img);
         let row = (img.width * 16).div_ceil(wgpu::COPY_BYTES_PER_ROW_ALIGNMENT) * wgpu::COPY_BYTES_PER_ROW_ALIGNMENT;
         let buf = self.g.device.create_buffer(&wgpu::BufferDescriptor {
             label: Some("image rows"),
@@ -1431,6 +2173,7 @@ impl<'g> Enc<'g> {
     /// Convert to the viewer's premultiplied RGBA8 texture (egui-wgpu's native texture format),
     /// with a full mip chain so the viewer minifies it without aliasing (#417).
     pub fn display(&mut self, img: &GpuImage) -> wgpu::Texture {
+        self.uses(img);
         let g = self.g;
         let levels = mip_levels(img.width, img.height);
         let tex = g.device.create_texture(&wgpu::TextureDescriptor {
@@ -1473,6 +2216,30 @@ pub(crate) fn mip_levels(w: u32, h: u32) -> u32 {
     u32::BITS - w.max(h).max(1).leading_zeros()
 }
 
+#[cfg(test)]
+mod pool_stall_tests {
+    use super::Pool;
+    use std::sync::atomic::Ordering::Relaxed;
+
+    #[test]
+    fn frame_end_skips_wait_while_stalled_until_dying_drops() {
+        let mut p = Pool::default();
+        p.dying.store(100, Relaxed);
+        assert_eq!(p.frame_end(), 100);
+        p.waited(100);
+        assert_eq!(p.stalled, 100);
+        assert_eq!(p.waits, 1);
+        assert_eq!(p.frame_end(), 0);
+        p.dying.store(150, Relaxed);
+        assert_eq!(p.frame_end(), 0);
+        p.dying.store(50, Relaxed);
+        assert_eq!(p.frame_end(), 50);
+        assert_eq!(p.stalled, 0);
+        p.dying.store(0, Relaxed);
+        assert_eq!(p.frame_end(), 0);
+    }
+}
+
 #[cfg(test)]
 mod adapter_name_tests {
     use super::{match_adapter_name, wanted_adapter_name};
diff --git a/crates/gpu/src/deferred.rs b/crates/gpu/src/deferred.rs
index 3ac2c67e6..e96b54a1d 100644
--- a/crates/gpu/src/deferred.rs
+++ b/crates/gpu/src/deferred.rs
@@ -252,6 +252,7 @@ pub(crate) fn chain_key(chain: &[FxStep], buf: &Buf, levels: Option<f32>) -> u12
         k.u64(e.effect_index as u64);
         k.debug(&e.working_space);
         k.u64(e.working_linear as u64);
+        k.u64(e.float_depth as u64);
         k.debug(&e.shutter);
     }
     k.finish()
diff --git a/crates/gpu/src/effects.rs b/crates/gpu/src/effects.rs
index 42d2bab71..b33c15e99 100644
--- a/crates/gpu/src/effects.rs
+++ b/crates/gpu/src/effects.rs
@@ -2,7 +2,6 @@
 //! radii, parameter conversions), with the pixel loops as compute kernels.
 
 use effectcraft_effects::{Buf, EffectCtx};
-use effectcraft_geom::{Mat3, vec2};
 use effectcraft_raster::Sampling;
 use effectcraft_render::FxStep;
 
@@ -23,12 +22,45 @@ pub(crate) struct GBuf {
 }
 
 impl GBuf {
+    /// [`effectcraft_effects::Buf::cover`] on the device; `None` when it can't hold it.
+    pub fn cover(&mut self, e: &mut Enc, size: [f64; 2]) -> Option<()> {
+        let Some((dx, dy, w, h)) = effectcraft_effects::cover_plan(self.offset, self.scale, size, self.img.width, self.img.height) else { return Some(()) };
+        if !e.g.fits(w, h) {
+            return None;
+        }
+        let out = e.image(w, h);
+        e.copy_into(&self.img, &out, dx, dy);
+        self.img = out;
+        self.offset[0] += dx as f64;
+        self.offset[1] += dy as f64;
+        Some(())
+    }
+
     pub fn to_px(&self, p: [f64; 2]) -> (f64, f64) {
         (p[0] * self.scale + self.offset[0], p[1] * self.scale + self.offset[1])
     }
 
+    /// Buf::pad_sides: grow by transparent pixels (left, top, right, bottom).
+    pub fn pad_sides(&mut self, e: &mut Enc, sides: [u32; 4]) -> Option<()> {
+        let [l, t, r, b] = sides;
+        if l == 0 && t == 0 && r == 0 && b == 0 {
+            return Some(());
+        }
+        let (w, h) = (self.img.width.checked_add(l)?.checked_add(r)?, self.img.height.checked_add(t)?.checked_add(b)?);
+        if !e.g.fits(w, h) {
+            return None;
+        }
+        let out = e.image(w, h);
+        e.copy_into(&self.img, &out, l, t);
+        self.img = out;
+        self.offset[0] += l as f64;
+        self.offset[1] += t as f64;
+        Some(())
+    }
+
     /// Buf::pad: grow by `pad` transparent pixels on every side.
     pub fn pad(&mut self, e: &mut Enc, pad: u32) -> Option<()> {
+        let pad = effectcraft_effects::pad_within_budget(self.img.width, self.img.height, pad);
         if pad == 0 {
             return Some(());
         }
@@ -69,6 +101,7 @@ pub(crate) fn run_chain(e: &mut Enc, chain: &[FxStep], buf: &Buf, levels: Option
     e.take_missing();
     for step in chain {
         b = apply(e, step.spec.id, &step.ctx, b)?;
+        e.mem_gate();
         if e.take_missing() {
             return None;
         }
@@ -126,6 +159,7 @@ impl effectcraft_render::FxTarget for GpuFx<'_, '_> {
         self.e.take_missing();
         for step in steps {
             let Some(next) = apply(self.e, step.spec.id, &step.ctx, cur) else { return false };
+            self.e.mem_gate();
             // A kernel the device couldn't build: the effects render on the CPU (#613).
             if self.e.take_missing() {
                 return false;
@@ -149,12 +183,23 @@ impl effectcraft_render::FxTarget for GpuFx<'_, '_> {
     /// GBuf::cover, like `pad`: a bigger texture with the old one copied into place, no
     /// readback. A region the device can't allocate leaves the buffer as it is.
     fn cover(&mut self, size: [f64; 2]) {
+        let Some(mut b) = self.b.take() else { return };
+        let keep = (b.img.clone(), b.offset);
+        if b.cover(self.e, size).is_none() {
+            (b.img, b.offset) = keep;
+        }
+        self.b = Some(b);
+    }
+
+    /// [`effectcraft_effects::Buf::align`] on the device: a texture grown left/top, the old one
+    /// copied in. A size the device can't allocate leaves the buffer as it is.
+    fn align(&mut self, size: [f64; 2]) {
         let Some(b) = self.b.take() else { return };
-        let out = match effectcraft_effects::cover_plan(b.offset, b.scale, size, b.img.width, b.img.height) {
-            Some((dx, dy, w, h)) if self.e.g.fits(w, h) => {
-                let img = self.e.image(w, h);
-                self.e.copy_into(&b.img, &img, dx, dy);
-                GBuf { img, offset: [b.offset[0] + dx as f64, b.offset[1] + dy as f64], scale: b.scale }
+        let out = match effectcraft_effects::align_plan(b.offset, b.scale, size, b.img.width, b.img.height) {
+            Some((l, t)) if self.e.g.fits(b.img.width + l, b.img.height + t) => {
+                let img = self.e.image(b.img.width + l, b.img.height + t);
+                self.e.copy_into(&b.img, &img, l, t);
+                GBuf { img, offset: [b.offset[0] + l as f64, b.offset[1] + t as f64], scale: b.scale }
             }
             _ => b,
         };
@@ -234,7 +279,13 @@ pub(crate) fn box_passes(e: &mut Enc, img: &GpuImage, rx: &[usize], ry: &[usize]
         let mut p = Params::default();
         p.u[0] = [r as u32, repeat as u32, block, 0];
         let out = e.scratch(cur.width, cur.height);
-        e.dispatch(if vertical { "box_v" } else { "box_h" }, &p, &cur, None, &out, None, (lines.div_ceil(64), n.div_ceil(block)));
+        e.dispatch(
+            if vertical { "box_v" } else { "box_h" },
+            &p,
+            crate::context::KernelImages { src: &cur, aux: None, out: &out },
+            None,
+            (lines.div_ceil(64), n.div_ceil(block)),
+        );
         cur = out;
     }
     cur
@@ -261,16 +312,28 @@ fn gaussian(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
         return Some(b);
     }
     let (kx, ky) = dims_xy(ctx.params.e("dimensions"));
+    // Small sigmas use the CPU's sampled kernel (#1939).
+    if effectcraft_raster::gaussian_is_exact(s * kx, s * ky) {
+        return None;
+    }
     let repeat = ctx.params.b("repeatEdge");
     if !repeat && !ctx.adjustment {
         b.pad(e, (s * 3.0).ceil() as u32)?;
+    } else if repeat && !ctx.adjustment {
+        // The edge it repeats is the layer's, not the painted content's (#1205).
+        b.cover(e, ctx.layer_size)?;
     }
     b.img = gaussian_blur(e, &b.img, s * kx, s * ky, repeat || ctx.adjustment);
     Some(b)
 }
 
 fn box_blur(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
-    let r = (ctx.params.f("radius") * b.scale).round().max(0.0) as usize;
+    let radius = (ctx.params.f("radius") * b.scale).max(0.0);
+    // Fractional radii blend two integer radii on the CPU (#1939).
+    if radius - radius.floor() >= 1e-4 {
+        return None;
+    }
+    let r = radius.floor() as usize;
     if r == 0 {
         return Some(b);
     }
@@ -279,6 +342,9 @@ fn box_blur(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     let repeat = ctx.params.b("repeatEdge");
     if !repeat && !ctx.adjustment {
         b.pad(e, (r * it) as u32 + 1)?;
+    } else if repeat && !ctx.adjustment {
+        // The edge it repeats is the layer's, not the painted content's (#1205).
+        b.cover(e, ctx.layer_size)?;
     }
     b.img = box_passes(e, &b.img, &vec![r * kx as usize; it], &vec![r * ky as usize; it], repeat || ctx.adjustment);
     Some(b)
@@ -324,10 +390,11 @@ fn glow(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     p.f[2] = cb;
     let bright = e.image(b.img.width, b.img.height);
     e.pixels("glow_bright", &p, &b.img, None, &bright, None);
-    let s = (radius / 2.0).max(0.5);
+    let s = effectcraft_effects::glow_sigma(radius);
     let blurred = gaussian_blur(e, &bright, s * kx, s * ky, false);
     let mut p = Params::default();
     p.u[0][0] = ctx.params.e("operation").min(2);
+    p.u[0][1] = (ctx.params.e("based") == 0) as u32;
     p.f[0][0] = intensity;
     let out = e.scratch(b.img.width, b.img.height);
     e.pixels("glow_combine", &p, &b.img, Some(&blurred), &out, None);
@@ -369,26 +436,24 @@ fn transform(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     if ctx.env.host.is_some() && effectcraft_effects::transform_shutter(ctx).is_some() {
         return None;
     }
-    let anchor = b.to_px(ctx.params.v2("anchor"));
-    let pos = b.to_px(ctx.params.v2("position"));
-    let sh = ctx.params.f("scaleHeight");
-    let sw = if ctx.params.b("uniform") { sh } else { ctx.params.f("scaleWidth") };
     let opacity = ctx.params.f("opacity") as f32 / 100.0;
-    let m = Mat3::translate(vec2(pos.0, pos.1))
-        * Mat3::rotate_deg(ctx.params.f("rotation"))
-        * Mat3::skew_deg(ctx.params.f("skew"), ctx.params.f("skewAxis"))
-        * Mat3::scale(vec2(sw / 100.0, sh / 100.0))
-        * Mat3::translate(vec2(-anchor.0, -anchor.1));
+    // As distort::transform: After Effects' matrix, drawn outside the layer's bounds.
+    if !ctx.adjustment {
+        let m = effectcraft_effects::transform_matrix_px(ctx.params, |p| b.to_px(p));
+        let sides = effectcraft_effects::transform_grow(&[m], b.img.width, b.img.height);
+        b.pad_sides(e, sides)?;
+    }
+    let m = effectcraft_effects::transform_matrix_px(ctx.params, |p| b.to_px(p));
     let sampling = if ctx.params.e("sampling") == 1 { Sampling::Bicubic } else { Sampling::Bilinear };
     let empty = e.image(b.img.width, b.img.height);
-    b.img = ops::warp(e, &empty, &b.img, &m, sampling, effectcraft_color::BlendMode::Normal, opacity, 0, None);
+    b.img = ops::warp(e, &empty, &b.img, &m, ops::WarpOptions { sampling, mode: effectcraft_color::BlendMode::Normal, opacity, seed: 0 }, None);
     Some(b)
 }
 
 // ---------------------------------------------------------------- per-pixel
 
 fn curves(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
-    let parsed = ["rgb", "red", "green", "blue", "alpha"].map(|id| effectcraft_effects::Curve::parse(ctx.params.s(id)));
+    let parsed = ["rgb", "red", "green", "blue", "alpha"].map(|id| effectcraft_effects::Curve::parse_natural(ctx.params.s(id)));
     if parsed.iter().all(Option::is_none) {
         return Some(b);
     }
@@ -528,9 +593,19 @@ fn pointwise(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
             let sub = (f("subSettings/subScaling") / 100.0).clamp(0.1, 1.0);
             p.u[0] = [10, kind, octaves.ceil() as u32, f("evolutionOptions/seed") as u32 ^ 0x51ed];
             p.u[1] = [pr.b("invert") as u32, pr.e("overflow"), mode, 0];
-            p.f[0] = [f("contrast") as f32 / 100.0, f("brightness") as f32 / 100.0, (sw * b.scale).max(1.0) as f32, (octaves - octaves.floor()) as f32];
+            p.f[0] = [
+                f("contrast") as f32 / 100.0,
+                f("brightness") as f32 / 100.0,
+                (sw * effectcraft_effects::NOISE_CELL * b.scale).max(1.0) as f32,
+                (octaves - octaves.floor()) as f32,
+            ];
             p.f[1] = [ox as f32, oy as f32, sr, cr];
-            p.f[2] = [f("evolution") as f32 / 360.0, f("blend") as f32 / 100.0, (f("opacity") as f32 / 100.0).clamp(0.0, 1.0), (sh * b.scale).max(1.0) as f32];
+            p.f[2] = [
+                f("evolution") as f32 / 360.0,
+                f("blend") as f32 / 100.0,
+                (f("opacity") as f32 / 100.0).clamp(0.0, 1.0),
+                (sh * effectcraft_effects::NOISE_CELL * b.scale).max(1.0) as f32,
+            ];
             p.f[3] = [(f("subSettings/subInfluence") as f32 / 100.0).clamp(0.0, 1.0), 1.0 / sub as f32, 0.0, 0.0];
         }
         _ => return None,
diff --git a/crates/gpu/src/fx_color.rs b/crates/gpu/src/fx_color.rs
index b9ae5282c..18bd8409f 100644
--- a/crates/gpu/src/fx_color.rs
+++ b/crates/gpu/src/fx_color.rs
@@ -90,11 +90,10 @@ fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
         "ec.color.blackwhite" => {
             let w = ["reds", "yellows", "greens", "cyans", "blues", "magentas"].map(|k| f(k) / 100.0);
             let tc = pr.color("tintColor");
-            let (th, ts, _) = rgb_to_hsl(tc[0], tc[1], tc[2]);
             p.u[0] = [3, pr.b("tint") as u32, 0, 0];
             p.f[0] = [w[0], w[1], w[2], w[3]];
             p.f[1] = [w[4], w[5], 0.0, 0.0];
-            p.f[2] = [th, ts, 0.0, 0.0];
+            p.f[2] = [tc[0], tc[1], tc[2], 0.0];
         }
         "ec.color.tritone" => {
             p.u[0][0] = 4;
diff --git a/crates/gpu/src/fx_depth.rs b/crates/gpu/src/fx_depth.rs
index 4931afe2a..3f348c47d 100644
--- a/crates/gpu/src/fx_depth.rs
+++ b/crates/gpu/src/fx_depth.rs
@@ -268,21 +268,20 @@ fn identifier(e: &mut Enc, ctx: &EffectCtx, b: GBuf, a: &AuxChannels) -> Option<
 
 fn cryptomatte(e: &mut Enc, ctx: &EffectCtx, b: GBuf, a: &AuxChannels) -> Option<GBuf> {
     let pr = ctx.params;
-    let layers = a.crypto_layers();
-    if layers.is_empty() {
-        return Some(b);
-    }
-    let want = effectcraft_effects::CRYPTO_LAYERS[(pr.e("layer") as usize).min(2)];
-    let layer = layers.iter().find(|l| l.as_str() == want || l.ends_with(want)).unwrap_or(&layers[0]).clone();
+    let Some(layer) = effectcraft_effects::crypto_layer_named(a, pr.s("layerName"), pr.e("layer") as usize) else { return Some(b) };
     let manifest = a.manifests.iter().find(|(l, _)| *l == layer).map(|(_, m)| m.as_slice());
     let sel = effectcraft_effects::selection_hashes(pr.s("selection"), manifest);
     // Per aux pixel: coverage-weighted ID colours (RGB) and the selection's coverage (A), on all
     // cores with the rank planes resolved once.
-    let img = effectcraft_effects::crypto_aux_image(a, &layer, &sel);
+    // The ID colours are only read by the Colors display; Matte, Preview and Matte Only need the
+    // matte alone.
+    // `tests::fx_depth::cryptomatte_every_display_matches_the_cpu` guards this against the shader.
+    let what = effectcraft_effects::CryptoAux::for_display(pr.e("display"), pr.b("matteOnly"));
+    let img = effectcraft_effects::crypto_aux_image_with(a, &layer, &sel, what);
     let tex = e.g.upload_image(&img)?;
     let plane = lookup(e, &b, a, &tex, [0.5, 0.5], [0.0; 4]);
     let mut p = op(7);
-    p.u[0] = [7, pr.e("display"), pr.b("matteOnly") as u32, 0];
+    p.u[0] = [7, pr.e("display"), pr.b("matteOnly") as u32, pr.b(effectcraft_effects::MATTE_ONLY_IN_ALPHA) as u32];
     point(e, &p, b, &plane)
 }
 
@@ -293,19 +292,14 @@ fn extractor(e: &mut Enc, ctx: &EffectCtx, b: GBuf, a: Option<&AuxChannels>) ->
     let names = [pr.s("red"), pr.s("green"), pr.s("blue"), pr.s("alpha")];
     let (bp, wp) = (pr.f("blackPoint") as f32, pr.f("whitePoint") as f32);
     let unmult = pr.b("unMult");
-    let own = |n: &str| match n.trim().to_ascii_uppercase().as_str() {
-        "R" | "RED" => Some(0u32),
-        "G" | "GREEN" => Some(1),
-        "B" | "BLUE" => Some(2),
-        "A" | "ALPHA" => Some(3),
-        _ => None,
-    };
-    let src_ch: Vec<Option<&[f32]>> = names.iter().map(|n| a.and_then(|a| if n.trim().is_empty() { None } else { a.get(n.trim()) })).collect();
-    if src_ch.iter().all(Option::is_none) && bp == 0.0 && wp == 1.0 && !unmult && names.iter().enumerate().all(|(k, n)| own(n) == Some(k as u32)) {
+    // `(copy)`: the input's own channel of the same position, never an aux channel.
+    let own = |k: usize, n: &str| effectcraft_effects::extractor_own_channel(k, n).and_then(|c| u32::try_from(c).ok());
+    let src_ch: Vec<Option<&[f32]>> = names.iter().map(|n| a.and_then(|a| effectcraft_effects::extractor_aux_channel(a, n))).collect();
+    if src_ch.iter().all(Option::is_none) && bp == 0.0 && wp == 1.0 && !unmult && names.iter().enumerate().all(|(k, n)| own(k, n) == Some(k as u32)) {
         return Some(b);
     }
     // Per output channel: 0..3 = the layer's own channel, 4 = aux, 5 = default (0, alpha 1).
-    let sources: [u32; 4] = std::array::from_fn(|k| if src_ch[k].is_some() { 4 } else { own(names[k]).unwrap_or(5) });
+    let sources: [u32; 4] = std::array::from_fn(|k| if src_ch[k].is_some() { 4 } else { own(k, names[k]).unwrap_or(5) });
     let plane = match a {
         Some(a) if src_ch.iter().any(Option::is_some) => {
             let tex = aux_texture(e, a, [src_ch[0], src_ch[1], src_ch[2], src_ch[3]])?;
diff --git a/crates/gpu/src/fx_distort.rs b/crates/gpu/src/fx_distort.rs
index ce7133822..510f91e8c 100644
--- a/crates/gpu/src/fx_distort.rs
+++ b/crates/gpu/src/fx_distort.rs
@@ -180,6 +180,9 @@ fn turbulent(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     let size = (ctx.params.f("size") * b.scale).max(1.0);
     if ctx.params.b("resizeLayer") && !ctx.adjustment {
         b.pad(e, amount.abs().ceil() as u32 + 1)?;
+    } else {
+        // Room for pixels displaced past the content, up to the layer's edge (#1205).
+        b.pad(e, effectcraft_effects::cover_pad(ctx, [b.img.width, b.img.height], b.offset, b.scale, amount.abs().ceil() as u32 + 1))?;
     }
     let off = b.to_px(ctx.params.v2("offset"));
     let oct = ctx.params.f("complexity").clamp(1.0, 10.0);
diff --git a/crates/gpu/src/fx_extra.rs b/crates/gpu/src/fx_extra.rs
index 2e8bb85b8..cff516305 100644
--- a/crates/gpu/src/fx_extra.rs
+++ b/crates/gpu/src/fx_extra.rs
@@ -188,6 +188,10 @@ fn gaussian_legacy(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
         2 => (0.0, 1.0),
         _ => (1.0, 1.0),
     };
+    // Small sigmas use the CPU's sampled kernel (#1939).
+    if effectcraft_raster::gaussian_is_exact(s * kx, s * ky) {
+        return None;
+    }
     if !ctx.adjustment {
         b.pad(e, (s * 3.0).ceil() as u32)?;
     }
diff --git a/crates/gpu/src/fx_generate.rs b/crates/gpu/src/fx_generate.rs
index 3744ec4fa..c6f2d1def 100644
--- a/crates/gpu/src/fx_generate.rs
+++ b/crates/gpu/src/fx_generate.rs
@@ -117,11 +117,14 @@ fn radial_blur(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     run(e, "gen_radial_blur", &p, b, None, Some(&data))
 }
 
-fn radial_fast(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
+fn radial_fast(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     let s = (ctx.params.f("amount") / 100.0).clamp(0.0, 1.0) * 0.5;
     if s <= 0.0 {
         return Some(b);
     }
+    if !ctx.adjustment {
+        b.pad(e, effectcraft_effects::radial_fast_pad(b.to_px(ctx.params.v2("center")), b.img.width, b.img.height, s))?;
+    }
     let c = b.to_px(ctx.params.v2("center"));
     let mut p = Params::default();
     p.u[0][0] = ctx.params.e("zoom");
@@ -162,7 +165,7 @@ fn camera_lens(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
             return None;
         }
         let pre = e.image(w + 1, h);
-        e.dispatch("gen_row_prefix", &Params::default(), &src, None, &pre, None, (h.div_ceil(64), 1));
+        e.dispatch("gen_row_prefix", &Params::default(), crate::context::KernelImages { src: &src, aux: None, out: &pre }, None, (h.div_ceil(64), 1));
         Some(pre)
     } else {
         None
@@ -180,79 +183,107 @@ fn camera_lens(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
 
 // ---------------------------------------------------------------- transitions
 
-fn linear_wipe(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
+/// Linear Wipe (`effects::misc::linear_wipe`): the hard matte at `lo + completion·(hi − lo)`
+/// blurred by Feather with the layer's edges repeated, or the legacy linear ramp.
+fn linear_wipe(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     let done = ctx.params.f("completion") / 100.0;
-    let ang = ctx.params.f("angle").to_radians();
-    let feather = (ctx.params.f("feather") * b.scale).max(0.001);
     let (w, h) = (b.img.width as f64, b.img.height as f64);
-    let (dx, dy) = (ang.sin(), -ang.cos());
-    let corners = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h)];
-    let proj: Vec<f64> = corners.iter().map(|(x, y)| x * dx + y * dy).collect();
-    let (lo, hi) = (proj.iter().cloned().fold(f64::INFINITY, f64::min), proj.iter().cloned().fold(f64::NEG_INFINITY, f64::max));
-    let edge = lo - feather + (hi - lo + 2.0 * feather) * done;
-    let mut data = Vec::with_capacity(2 * (b.img.width + b.img.height) as usize);
-    for x in 0..b.img.width {
-        data.extend(hl((x as f64 + 0.5) * dx - edge));
+    let ([dx, dy], lo, hi) = effectcraft_effects::linear_wipe_axis(ctx.params.f("angle"), w, h);
+    // Per column ((x + 0.5)·dx − edge), per row ((y + 0.5)·dy), as (hi, lo) pairs.
+    let table = |edge: f64| {
+        let mut data = Vec::with_capacity(2 * (b.img.width + b.img.height) as usize);
+        for x in 0..b.img.width {
+            data.extend(hl((x as f64 + 0.5) * dx - edge));
+        }
+        for y in 0..b.img.height {
+            data.extend(hl((y as f64 + 0.5) * dy));
+        }
+        data
+    };
+    let params = |width: f64, mode: u32| {
+        let mut p = Params::default();
+        p.u[0][0] = 2 * b.img.width;
+        p.u[0][1] = mode;
+        p.f[0][0] = width as f32;
+        p
+    };
+    if ctx.params.b("legacyFeather") {
+        let feather = (ctx.params.f("feather") * b.scale).max(0.001);
+        let data = table(lo - feather + (hi - lo + 2.0 * feather) * done);
+        return run(e, "gen_linear_wipe", &params(feather, 0), b, None, Some(&data));
     }
-    for y in 0..b.img.height {
-        data.extend(hl((y as f64 + 0.5) * dy));
+    if done.is_nan() || done <= 0.0 {
+        return Some(b);
     }
-    let mut p = Params::default();
-    p.u[0][0] = 2 * b.img.width;
-    p.f[0][0] = feather as f32;
-    run(e, "gen_linear_wipe", &p, b, None, Some(&data))
+    // 100 % clears the layer whatever the angle (the CPU clears before it reads it).
+    if done >= 1.0 {
+        b.img = e.image(b.img.width, b.img.height);
+        return Some(b);
+    }
+    let edge = lo + (hi - lo) * done;
+    if !(edge.is_finite() && dx.is_finite() && dy.is_finite()) {
+        return Some(b);
+    }
+    let data = table(edge);
+    let sigma = effectcraft_effects::linear_wipe_sigma(ctx.params.f("feather"), b.scale, w, h);
+    if sigma <= 1e-3 {
+        return run(e, "gen_linear_wipe", &params(1.0, 0), b, None, Some(&data));
+    }
+    let buf = e.data(&data);
+    let matte = e.scratch(b.img.width, b.img.height);
+    e.pixels("gen_linear_wipe", &params(1.0, 1), &b.img, None, &matte, Some(&buf));
+    let blurred = gaussian_blur(e, &matte, sigma, sigma, true);
+    run(e, "gen_linear_wipe", &params(1.0, 2), b, Some(&blurred), Some(&data))
 }
 
 fn venetian(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
-    let done = ctx.params.f("completion") / 100.0;
+    let done = (ctx.params.f("completion") / 100.0).clamp(0.0, 1.0);
+    if done <= 0.0 {
+        return Some(b);
+    }
     let ang = ctx.params.f("direction").to_radians();
     let width = (ctx.params.f("width") * b.scale).max(1.0);
-    let feather = (ctx.params.f("feather") * b.scale).max(0.001);
+    let sigma = ctx.params.f("feather").max(0.0) * b.scale / 2.0;
+    // The CPU's even veil and term count (effects::venetian_cover).
+    if sigma > 8.0 * width {
+        return None;
+    }
     let (dx, dy) = (ang.cos(), ang.sin());
-    let mut data = Vec::with_capacity((6 * b.img.width + 2 * b.img.height) as usize);
+    let (ox, oy) = b.to_px(effectcraft_effects::venetian_origin(ctx.layer_size));
+    let mut data = Vec::with_capacity((4 * b.img.width + 2 * b.img.height) as usize);
     for x in 0..b.img.width {
-        let cx = ((x as f64 + 0.5) * dx).rem_euclid(width);
-        data.extend(hl(cx - done * width));
-        data.extend(hl(cx - width - done * width));
+        let cx = ((x as f64 + 0.5 - ox) * dx).rem_euclid(width);
+        data.extend(hl(cx));
         data.extend(hl(cx - width));
     }
     for y in 0..b.img.height {
-        data.extend(hl(((y as f64 + 0.5) * dy).rem_euclid(width)));
+        data.extend(hl(((y as f64 + 0.5 - oy) * dy).rem_euclid(width)));
     }
     let mut p = Params::default();
-    p.u[0][0] = 6 * b.img.width;
-    p.f[0][0] = feather as f32;
+    p.u[0][0] = 4 * b.img.width;
+    p.u[0][1] = if sigma < 1e-3 { 0 } else { ((4.0 * sigma / width).ceil() as u32 + 1).clamp(1, 40) };
+    p.f[0] = [width as f32, (done * width) as f32, sigma as f32, 0.0];
     run(e, "gen_venetian", &p, b, None, Some(&data))
 }
 
 fn radial_wipe(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
-    let done = ctx.params.f("completion") / 100.0;
+    let done = (ctx.params.f("completion") / 100.0).clamp(0.0, 1.0);
+    if done <= 0.0 {
+        return Some(b);
+    }
     let start = ctx.params.f("startAngle");
     let c = b.to_px(ctx.params.v2("center"));
-    let dir = ctx.params.e("wipe");
-    let feather = ctx.params.f("feather").max(0.01);
-    let edge = if dir == 2 { done * 180.0 } else { done * 360.0 };
-    // Rotations: the start angle, and the start angle ± the edge (where the wipe's edge lies).
-    let rots = [start, start + edge, start - edge].map(|r| r.to_radians().sin_cos());
-    let mut data = Vec::with_capacity(9 * (b.img.width + b.img.height) as usize);
-    for x in 0..b.img.width {
-        let ux = x as f64 + 0.5 - c.0;
-        for (s, co) in rots {
-            data.extend(hl(ux * co));
-            data.push((ux * s) as f32);
-        }
-    }
-    for y in 0..b.img.height {
-        let uy = -(y as f64 + 0.5 - c.1);
-        for (s, co) in rots {
-            data.extend(hl(uy * s));
-            data.push((uy * co) as f32);
-        }
-    }
+    let (w0, span) = effectcraft_effects::radial_wipe_wedge(ctx.params.e("wipe"), done);
+    let sigma = effectcraft_effects::radial_wipe_sigma(ctx.params.f("feather")) * b.scale;
+    let ray0 = start + w0;
+    let (s0, c0) = ray0.to_radians().sin_cos();
+    let (s1, c1) = (ray0 + span).to_radians().sin_cos();
     let mut p = Params::default();
-    p.u[0] = [9 * b.img.width, dir.min(2), 0, 0];
-    p.f[0] = [edge as f32, feather as f32, 0.0, 0.0];
-    run(e, "gen_radial_wipe", &p, b, None, Some(&data))
+    p.u[0] = [(done >= 1.0) as u32, (sigma < 1e-3) as u32, 0, 0];
+    p.f[0] = [c.0 as f32, c.1 as f32, sigma.max(1e-3) as f32, ray0.rem_euclid(360.0) as f32];
+    p.f[1] = [s0 as f32, c0 as f32, s1 as f32, c1 as f32];
+    p.f[2][0] = span as f32;
+    run(e, "gen_radial_wipe", &p, b, None, None)
 }
 
 fn gradient_wipe(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
@@ -353,10 +384,10 @@ fn four_color(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
         p.f[i] = [q.0 as f32, q.1 as f32, 0.0, 0.0];
         p.f[4 + i] = ctx.params.color(&format!("positionsColors/color{}", i + 1));
     }
-    let blend = ctx.params.f("blend").max(1.0);
+    let k = effectcraft_effects::four_color_softening(ctx.params.f("blend"), b.scale);
     let jitter = (ctx.params.f("jitter") / 100.0).clamp(0.0, 1.0) as f32;
     p.u[0] = [gen_mode(ctx.params.e("blendingMode")), ctx.seed, 0, 0];
-    p.f[8] = [(blend * 100.0) as f32, jitter, ctx.params.f("opacity") as f32 / 100.0, 0.0];
+    p.f[8] = [k as f32, jitter, ctx.params.f("opacity") as f32 / 100.0, 0.0];
     run(e, "gen_fourcolor", &p, b, None, None)
 }
 
diff --git a/crates/gpu/src/fx_key.rs b/crates/gpu/src/fx_key.rs
index 1099bccd1..3bb5a87ab 100644
--- a/crates/gpu/src/fx_key.rs
+++ b/crates/gpu/src/fx_key.rs
@@ -438,8 +438,10 @@ fn refine(e: &mut Enc, ctx: &EffectCtx, b: GBuf, hard: bool) -> Option<GBuf> {
 
 const SET_CHANNEL_LAYERS: [&str; 4] = ["sourceLayer1", "sourceLayer2", "sourceLayer3", "sourceLayer4"];
 
+/// Shift Channels' Take … From menu, in the order of `effects`' `SHIFT_ORDER`: the two must agree,
+/// or the source depends on whether the effect renders on the GPU.
 const SHIFT_ORDER: [Src; 11] =
-    [Src::Alpha, Src::Red, Src::Green, Src::Blue, Src::Luminance, Src::Hue, Src::Lightness, Src::Saturation, Src::Full, Src::Half, Src::Off];
+    [Src::Alpha, Src::Red, Src::Green, Src::Blue, Src::Luminance, Src::Hue, Src::Lightness, Src::Saturation, Src::Full, Src::Off, Src::Half];
 
 const MATTE_ORDER: [Src; 10] = [Src::Red, Src::Green, Src::Blue, Src::Alpha, Src::Luminance, Src::Hue, Src::Lightness, Src::Saturation, Src::Full, Src::Off];
 
@@ -527,7 +529,8 @@ fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
             p.f[0] = [level, pr.f("softness").clamp(0.0, 100.0) as f32 / 100.0, 0.0, 0.0];
         }
         "ec.channel.shiftchannels" => {
-            let s = ["takeRedFrom", "takeGreenFrom", "takeBlueFrom", "takeAlphaFrom"].map(|id| src_index(SHIFT_ORDER[(pr.e(id) as usize).min(10)]));
+            let s = ["takeRedFrom", "takeGreenFrom", "takeBlueFrom", "takeAlphaFrom"]
+                .map(|id| src_index(SHIFT_ORDER[(pr.e(id) as usize).min(SHIFT_ORDER.len() - 1)]));
             return route(e, b, s);
         }
         "ec.channel.removecolormatting" => {
diff --git a/crates/gpu/src/fx_noise.rs b/crates/gpu/src/fx_noise.rs
index 1a20aa453..9ae503994 100644
--- a/crates/gpu/src/fx_noise.rs
+++ b/crates/gpu/src/fx_noise.rs
@@ -73,6 +73,53 @@ pub(crate) const IDS: &[&str] = &[
 /// not its square.
 pub(crate) const MEDIAN_BISECT_R: usize = 4;
 
+/// Physical GPUs retain the original parallel private histogram. Software Vulkan
+/// uses bounded workgroup storage to avoid its expensive first-use private-array
+/// lowering. This trades some warmed software throughput for bounded first use.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum MedianKernel {
+    Private64,
+    Software2,
+}
+
+impl MedianKernel {
+    pub(crate) fn for_adapter(backend: wgpu::Backend, device_type: wgpu::DeviceType) -> Self {
+        if backend == wgpu::Backend::Vulkan && device_type == wgpu::DeviceType::Cpu { Self::Software2 } else { Self::Private64 }
+    }
+
+    pub(crate) fn rows_per_workgroup(self) -> u32 {
+        match self {
+            Self::Private64 => 64,
+            Self::Software2 => 2,
+        }
+    }
+
+    pub(crate) fn workgroup_storage(self) -> u32 {
+        match self {
+            Self::Private64 => 0,
+            Self::Software2 => 16_384,
+        }
+    }
+
+    pub(crate) fn source(self) -> &'static str {
+        match self {
+            Self::Private64 => include_str!("shaders/median_private.wgsl"),
+            Self::Software2 => include_str!("shaders/median_software.wgsl"),
+        }
+    }
+
+    /// Separate test processes can qualify both implementations against existing oracles.
+    #[cfg(test)]
+    pub(crate) fn test_override(self) -> Result<Self, String> {
+        match std::env::var("EFFECTCRAFT_TEST_MEDIAN_KERNEL") {
+            Err(std::env::VarError::NotPresent) => Ok(self),
+            Ok(value) if value == "private64" => Ok(Self::Private64),
+            Ok(value) if value == "software2" => Ok(Self::Software2),
+            value => Err(format!("invalid EFFECTCRAFT_TEST_MEDIAN_KERNEL {value:?}; expected private64 or software2")),
+        }
+    }
+}
+
 /// Run effect `id` (one of [`IDS`]); `None` = this parameter combination runs on the CPU.
 pub(crate) fn apply(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     match id {
@@ -166,7 +213,8 @@ pub(crate) fn median_image(e: &mut Enc, img: &GpuImage, r: usize, straight: bool
     // sliding along the rest.
     let seg = (4 * r as u32).clamp(32, 512).min(q.width);
     let out = e.scratch(q.width, q.height);
-    e.dispatch("fxn_median_huang", &with_u0([r as u32, seg, 0, 0]), &q, None, &out, Some(&levels), (q.height.div_ceil(64), q.width.div_ceil(seg)));
+    let groups = (q.height.div_ceil(e.g.median_kernel.rows_per_workgroup()), q.width.div_ceil(seg));
+    e.dispatch("fxn_median_huang", &with_u0([r as u32, seg, 0, 0]), crate::context::KernelImages { src: &q, aux: None, out: &out }, Some(&levels), groups);
     out
 }
 
@@ -553,6 +601,8 @@ fn minimax(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
 
 // ---------------------------------------------------------------- Echo / Posterize Time (time_fx.rs)
 
+/// Echo on the GPU (`time_fx::echo`): the frames fetched on the CPU, folded in order by
+/// `fxn_echo` into two ping-pong images, then `fxn_echo_fin` clamps the result.
 fn echo(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     let n = ctx.params.f("numberOfEchoes").round().clamp(0.0, 255.0) as usize;
     let dt = ctx.params.f("echoTime");
@@ -572,8 +622,7 @@ fn echo(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
         e.pixels("fxn_echo", &p, a, Some(&frame), o, None);
         acc.swap(0, 1);
     }
-    let mut p = with_u0([op, 0, 0, 0]);
-    p.f[0][0] = (n + 1) as f32;
+    let p = with_u0([op, 0, 0, 0]);
     let img = run(e, "fxn_echo_fin", &p, &acc[0], None, None);
     Some(GBuf { img, offset: grid.offset, scale: grid.scale })
 }
diff --git a/crates/gpu/src/fx_pixel2.rs b/crates/gpu/src/fx_pixel2.rs
index acba936d0..5b20976f4 100644
--- a/crates/gpu/src/fx_pixel2.rs
+++ b/crates/gpu/src/fx_pixel2.rs
@@ -12,9 +12,11 @@
 //! Layer is chosen; the colouring runs here.
 
 use effectcraft_color::BlendMode;
-use effectcraft_effects::EffectCtx;
+use effectcraft_effects::{Buf, EffectCtx};
 use effectcraft_raster::Image;
 
+use rayon::prelude::*;
+
 use crate::context::{Enc, GpuImage, Params};
 use crate::effects::{GBuf, box_passes, gaussian_blur};
 use crate::ops::mode_id;
@@ -213,6 +215,8 @@ fn composite_mode(m: u32) -> BlendMode {
     }
 }
 
+/// The per-pixel effects of `fp2_point` (Cineon, HDR Compander and Highlight Compression, CC
+/// Overbrights, CC Composite, Color Link): their parameters packed for the kernel, or `None`.
 fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     let pr = ctx.params;
     let mut p = Params::default();
@@ -236,11 +240,12 @@ fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
         }
         "ec.utility.hdrcompression" => {
             let t = (pr.f("amount") / 100.0).clamp(0.0, 1.0) as f32;
-            if t <= 0.0 {
+            // A NaN Amount keeps the layer, as on the CPU.
+            if t <= 0.0 || !t.is_finite() {
                 return Some(b);
             }
             p.u[0][0] = 2;
-            p.f[0][0] = 1.0 - 0.5 * t;
+            p.f[0][0] = t;
         }
         "ec.utility.ccoverbrights" => {
             p.u[0] = [3, pr.e("channel"), 0, 0];
@@ -380,14 +385,24 @@ fn clamp_plane(e: &mut Enc, pl: &GpuImage, lo: f32, hi: f32) -> GpuImage {
 // ---------------------------------------------------------------- CC HexTile / CC Mr. Smoothie (stylize3)
 
 fn hextile(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
-    let r = (ctx.params.f("radius") * b.scale).max(0.5);
-    let c = b.to_px(ctx.params.v2("center"));
-    let (sn, cs) = ctx.params.f("rotate").to_radians().sin_cos();
-    let mut p = Params::default();
-    p.u[0][0] = ctx.params.e("render");
-    p.f[0] = [c.0 as f32, c.1 as f32, r as f32, (ctx.params.f("smearing") / 100.0).clamp(0.0, 1.0) as f32];
-    p.f[1] = [sn as f32, cs as f32, 0.0, 0.0];
-    run(e, "fp2_hextile", &p, b, None, None)
+    let count = (b.img.width as usize).checked_mul(b.img.height as usize)?;
+    if count.checked_mul(8)? > e.g.device.limits().max_storage_buffer_binding_size as usize {
+        return None;
+    }
+    let geometry = effectcraft_effects::HexTile::new(
+        ctx,
+        &Buf { img: Image { width: b.img.width, height: b.img.height, data: vec![] }, offset: b.offset, scale: b.scale },
+    );
+    let stride = (b.img.width as usize).checked_mul(2)?.max(2);
+    let mut coords = vec![0.0; count.checked_mul(2)?];
+    coords.par_chunks_mut(stride).enumerate().for_each(|(y, row)| {
+        for (x, xy) in row.as_chunks_mut::<2>().0.iter_mut().enumerate() {
+            let (sx, sy) = geometry.source_at(x as u32, y as u32);
+            *xy = [sx as f32, sy as f32];
+        }
+    });
+    let data = e.data(&coords);
+    run(e, "fp2_hextile", &Params::default(), b, None, Some(&data))
 }
 
 fn smoothie(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
diff --git a/crates/gpu/src/fx_sim.rs b/crates/gpu/src/fx_sim.rs
index a2d2c24dd..944ca6c07 100644
--- a/crates/gpu/src/fx_sim.rs
+++ b/crates/gpu/src/fx_sim.rs
@@ -253,6 +253,7 @@ fn bubbles(e: &mut Enc, ctx: &EffectCtx, b: GBuf, geo: &effectcraft_effects::Buf
     }
     let mut p = Params::default();
     p.u[1] = [0, (ctx.params.e("reflectionType") == 1) as u32, ctx.params.e("shadingType"), 0];
+    p.f[0] = effectcraft_effects::bubble_sample_bounds(ctx, b.offset, b.scale);
     let img = raster(e, items, 1, false, &b.img, None, p, w, h)?;
     Some(GBuf { img, ..b })
 }
diff --git a/crates/gpu/src/fx_stylize.rs b/crates/gpu/src/fx_stylize.rs
index f5b7708d9..34d434307 100644
--- a/crates/gpu/src/fx_stylize.rs
+++ b/crates/gpu/src/fx_stylize.rs
@@ -637,13 +637,7 @@ fn motion_tile(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     let mirror = ctx.params.b("mirrorEdges");
     let phase = ctx.params.f("phase") / 360.0;
     let hshift = ctx.params.b("horizontalPhaseShift");
-    let (nw, nh, noff) = if ctx.adjustment {
-        (b.img.width, b.img.height, b.offset)
-    } else {
-        let ow = (lw * ctx.params.f("outputWidth") / 100.0).max(1.0 / s);
-        let oh = (lh * ctx.params.f("outputHeight") / 100.0).max(1.0 / s);
-        ((ow * s).round().max(1.0) as u32, (oh * s).round().max(1.0) as u32, [(ow - lw) * 0.5 * s, (oh - lh) * 0.5 * s])
-    };
+    let (nw, nh, noff) = effectcraft_effects::motion_tile_frame(ctx, b.offset, (b.img.width, b.img.height), s);
     if !e.g.fits(nw, nh) {
         return None;
     }
@@ -877,6 +871,17 @@ fn texturize(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
 
 fn corner_pin(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     let (w, h) = (ctx.layer_size[0].max(1.0), ctx.layer_size[1].max(1.0));
+    // Grow to hold the whole quad, like the CPU `corner_pin`.
+    if !ctx.adjustment {
+        let pts = ["ul", "ur", "lr", "ll"].map(|k| {
+            let p = b.to_px(ctx.params.v2(k));
+            [p.0, p.1]
+        });
+        let (lo, hi) = effectcraft_effects::quad_bounds(&pts);
+        if let Some(sides) = effectcraft_effects::grow_sides(lo, hi, b.img.width, b.img.height) {
+            b.pad_sides(e, sides)?;
+        }
+    }
     let q = ["ul", "ur", "lr", "ll"].map(|k| {
         let p = b.to_px(ctx.params.v2(k));
         vec2(p.0, p.1)
@@ -885,7 +890,7 @@ fn corner_pin(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
     let o = b.to_px([0.0, 0.0]);
     let m = quad * Mat3::scale(vec2(1.0 / (w * b.scale), 1.0 / (h * b.scale))) * Mat3::translate(vec2(-o.0, -o.1));
     let empty = e.image(b.img.width, b.img.height);
-    b.img = ops::warp(e, &empty, &b.img, &m, Sampling::Bilinear, BlendMode::Normal, 1.0, 0, None);
+    b.img = ops::warp(e, &empty, &b.img, &m, ops::WarpOptions { sampling: Sampling::Bilinear, mode: BlendMode::Normal, opacity: 1.0, seed: 0 }, None);
     Some(b)
 }
 
@@ -943,11 +948,12 @@ pub(crate) fn glow(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBuf> {
         p.f[2] = ctx.params.color("colorB");
         e.pixels("glow_bright", &p, &b.img, None, &bright, None);
     }
-    let s = (radius / 2.0).max(0.5);
+    let s = effectcraft_effects::glow_sigma(radius);
     let blurred = gaussian_blur(e, &bright, s * kx, s * ky, false);
     let operation = ctx.params.e("operation");
     let glow_op = effectcraft_effects::glow_operation(ctx);
     let mut p = Params::default();
+    p.u[0][1] = (ctx.params.e("based") == 0) as u32;
     p.f[0][0] = intensity;
     let out = e.scratch(b.img.width, b.img.height);
     if operation == 0 && glow_op != BlendMode::Add {
@@ -969,15 +975,7 @@ pub(crate) fn transform_blur(ctx: &EffectCtx) -> bool {
 
 /// distort::transform_matrix.
 fn transform_matrix(pr: &effectcraft_effects::Params, b: &GBuf) -> Mat3 {
-    let anchor = b.to_px(pr.v2("anchor"));
-    let pos = b.to_px(pr.v2("position"));
-    let sh = pr.f("scaleHeight");
-    let sw = if pr.b("uniform") { sh } else { pr.f("scaleWidth") };
-    Mat3::translate(vec2(pos.0, pos.1))
-        * Mat3::rotate_deg(pr.f("rotation"))
-        * Mat3::skew_deg(pr.f("skew"), pr.f("skewAxis"))
-        * Mat3::scale(vec2(sw / 100.0, sh / 100.0))
-        * Mat3::translate(vec2(-anchor.0, -anchor.1))
+    effectcraft_effects::transform_matrix_px(pr, |p| b.to_px(p))
 }
 
 /// distort::transform's motion blur: the transform at Samples instants across the shutter,
@@ -987,15 +985,24 @@ pub(crate) fn transform(e: &mut Enc, ctx: &EffectCtx, mut b: GBuf) -> Option<GBu
     let host = ctx.env.host?;
     let sampling = if ctx.params.e("sampling") == 1 { Sampling::Bicubic } else { Sampling::Bilinear };
     let fd = 1.0 / ctx.fps();
+    let samples: Vec<effectcraft_effects::Params> =
+        (0..n).filter_map(|k| host.params_at(ctx.time + (phase + angle * k as f64 / (n - 1) as f64) / 360.0 * fd)).collect();
+    if samples.is_empty() {
+        // The CPU renders the frame sharp.
+        return None;
+    }
+    if !ctx.adjustment {
+        let ms: Vec<Mat3> = samples.iter().map(|pr| transform_matrix(pr, &b)).collect();
+        let sides = effectcraft_effects::transform_grow(&ms, b.img.width, b.img.height);
+        b.pad_sides(e, sides)?;
+    }
     let (w, h) = (b.img.width, b.img.height);
     let mut acc = e.image(w, h);
     let mut count = 0u32;
-    for k in 0..n {
-        let t = ctx.time + (phase + angle * k as f64 / (n - 1) as f64) / 360.0 * fd;
-        let Some(pr) = host.params_at(t) else { continue };
+    for pr in &samples {
         let op = pr.f("opacity") as f32 / 100.0;
         let empty = e.image(w, h);
-        let one = ops::warp(e, &empty, &b.img, &transform_matrix(&pr, &b), sampling, BlendMode::Normal, op, 0, None);
+        let one = ops::warp(e, &empty, &b.img, &transform_matrix(pr, &b), ops::WarpOptions { sampling, mode: BlendMode::Normal, opacity: op, seed: 0 }, None);
         let sum = e.image(w, h);
         e.pixels("fxs_add", &Params::default(), &acc, Some(&one), &sum, None);
         acc = sum;
diff --git a/crates/gpu/src/fx_tone.rs b/crates/gpu/src/fx_tone.rs
index cb7144114..0274cdb0f 100644
--- a/crates/gpu/src/fx_tone.rs
+++ b/crates/gpu/src/fx_tone.rs
@@ -174,6 +174,64 @@ fn parse_map(s: &str) -> Vec<f32> {
     vals.iter().map(|v| (v * k).clamp(0.0, 1.0)).collect()
 }
 
+/// Piecewise-linear lookup in the CPU effect's f64 phase domain. Store the
+/// first representable f32 at each boundary, its value and the interval slope.
+/// Computing floor/wrap in shader f32 can select the end of the map instead of
+/// its beginning at a wrap (a full-scale colour error).
+fn arbitrary_map_table(map: &[f32], phase: f64) -> Option<Vec<f32>> {
+    let n = map.len();
+    if !(2..=4096).contains(&n) || !phase.is_finite() {
+        return None;
+    }
+    let scale = (n - 1) as f64;
+    let offset = phase * scale / 255.0;
+    if !offset.is_finite() || offset.abs() >= (1u64 << 52) as f64 {
+        return None;
+    }
+    let at = |v: f32| {
+        let x = (v as f64 * scale + offset).rem_euclid(n as f64);
+        // `rem_euclid` can round a tiny negative phase up to `n`: wrap the index like the CPU
+        // lookup (`color3::arbitrary_map`) so both endpoints come from the start of the map.
+        let i = x.floor() as usize % n;
+        let a = *map.get(i).unwrap_or(&0.0);
+        let b = *map.get((i + 1).min(n - 1)).unwrap_or(&a);
+        (a + (b - a) * (x - x.floor()) as f32, (b - a) * scale as f32)
+    };
+    let mut points = vec![0.0f32];
+    // Search ordered positive f32 encodings using the CPU's actual f64 sum.
+    // Merely rounding a mathematical boundary upward misses the half-ulp
+    // region where f64 addition itself rounds across a wrap.
+    let first = offset.floor() + 1.0;
+    for i in 0..=n {
+        let boundary = first + i as f64;
+        if boundary > scale + offset {
+            break;
+        }
+        let (mut lo, mut hi) = (0u32, 1.0f32.to_bits());
+        while lo < hi {
+            let mid = lo + (hi - lo) / 2;
+            if f32::from_bits(mid) as f64 * scale + offset < boundary {
+                lo = mid + 1;
+            } else {
+                hi = mid;
+            }
+        }
+        let start = f32::from_bits(lo);
+        if points.last().is_none_or(|last| start > *last) {
+            points.push(start);
+        }
+    }
+    if points.last() != Some(&1.0) {
+        points.push(1.0);
+    }
+    let mut table = Vec::with_capacity(points.len() * 3);
+    for v in points {
+        let (value, slope) = at(v);
+        table.extend([v, value, slope]);
+    }
+    Some(table)
+}
+
 fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     let pr = ctx.params;
     let f = |k: &str| pr.f(k) as f32;
@@ -308,9 +366,9 @@ fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
         }
         "ec.color.psarbitrarymap" => {
             let map = parse_map(pr.s("map"));
-            p.u[0] = [12, pr.b("applyPhaseMapToAlpha") as u32, map.len() as u32, 0];
-            p.f[0][0] = (pr.f("phase") * (map.len() - 1) as f64 / 255.0) as f32;
-            data = Some(map);
+            let table = arbitrary_map_table(&map, pr.f("phase"))?;
+            p.u[0] = [12, pr.b("applyPhaseMapToAlpha") as u32, (table.len() / 3) as u32, 0];
+            data = Some(table);
         }
         "ec.color.videolimiter" => {
             const CLIP_LEVELS: [f32; 5] = [0.9, 0.95, 1.0, 1.05, 1.09];
@@ -379,3 +437,19 @@ fn point(e: &mut Enc, id: &str, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     }
     run(e, &p, b, data)
 }
+
+#[cfg(test)]
+mod map_tests {
+    use super::arbitrary_map_table;
+
+    /// A phase just below zero rounds `rem_euclid` up to `n` at input 0: the table must hold the
+    /// map's first entry and the slope towards its second, as the CPU lookup does.
+    #[test]
+    fn arbitrary_map_wraps_a_phase_rounded_to_the_end() {
+        let map = [0.25f32, 0.75, 1.0];
+        let table = arbitrary_map_table(&map, -1e-300).unwrap();
+        assert_eq!(table[0], 0.0);
+        assert_eq!(table[1], 0.25, "value at input 0 is map[0]");
+        assert_eq!(table[2], 0.5 * 2.0, "slope from map[0] to map[1], times n - 1");
+    }
+}
diff --git a/crates/gpu/src/fx_transition.rs b/crates/gpu/src/fx_transition.rs
index a0ad54658..b5cb07012 100644
--- a/crates/gpu/src/fx_transition.rs
+++ b/crates/gpu/src/fx_transition.rs
@@ -15,6 +15,8 @@
 use effectcraft_effects::{Buf, EffectCtx};
 use effectcraft_raster::Image;
 
+use rayon::prelude::*;
+
 use crate::context::{Enc, GpuImage, Params};
 use crate::effects::{GBuf, gaussian_blur};
 
@@ -203,25 +205,22 @@ fn grid_wipe(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     if done <= 0.0 {
         return Some(b);
     }
-    let pr = ctx.params;
-    let c = b.to_px(pr.v2("center"));
-    let rot = pr.f("rotation").to_radians();
-    let border = pr.f("border").max(0.0) * b.scale;
-    let tiles = pr.f("tiles").round().clamp(1.0, 500.0);
-    let shape = pr.e("shape");
-    let cs = (ctx.layer_size[0] * b.scale / tiles).max(1.0);
-    let (s, co) = rot.sin_cos();
-    let metric = |dx: f64, dy: f64| match shape {
-        0 => dx.abs(),
-        2 => dx.abs().max(dy.abs()),
-        _ => dx.hypot(dy),
-    };
-    let maxd = max_corner_dist(&b, c, |dx, dy| metric(dx * co + dy * s, -dx * s + dy * co));
-    let mut p = Params::default();
-    p.u[0] = [shape, pr.b("reverse") as u32, 0, 0];
-    p.f[0] = f4([c.0, c.1, s, co]);
-    p.f[1] = f4([cs, maxd, done, border]);
-    run(e, "ftr_grid", &p, b, None, None)
+    // Decide discontinuous tile coverage in the CPU effect's f64 geometry.
+    // Only a scalar mask is uploaded; source pixels and multiplication stay resident.
+    let count = (b.img.width as usize).checked_mul(b.img.height as usize)?;
+    if count.checked_mul(4)? > e.g.device.limits().max_storage_buffer_binding_size as usize {
+        return None;
+    }
+    let geometry = shape(&b);
+    let grid = effectcraft_effects::GridWipe::new(ctx, &geometry);
+    let mut mask = vec![0.0; count];
+    mask.par_chunks_mut((b.img.width as usize).max(1)).enumerate().for_each(|(y, row)| {
+        for (x, value) in row.iter_mut().enumerate() {
+            *value = grid.coverage(x as u32, y as u32);
+        }
+    });
+    let data = e.data(&mask);
+    run(e, "ftr_grid", &Params::default(), b, None, Some(&data))
 }
 
 fn radial_scale_wipe(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
@@ -586,17 +585,19 @@ fn blobbylize(e: &mut Enc, ctx: &EffectCtx, b: GBuf) -> Option<GBuf> {
     let soft = pr.f("softness").max(0.0) * b.scale;
     let blob = layer_or_self(e, ctx, &b, "blobLayer")?;
     let raw = plane(e, &blob, pr.e("property").min(10));
-    let h = gaussian_blur(e, &raw, soft, soft, true);
+    let h = gaussian_blur(e, &raw, soft * 0.42, soft * 0.42, true);
     let lpos = b.to_px(pr.v2("lightPosition"));
     let lheight = pr.f("lightHeight");
     let (d, el) = (pr.f("lightDirection").to_radians(), (lheight / 100.0).clamp(0.0, 1.0) * std::f64::consts::FRAC_PI_2);
     let ldir = [d.sin() * el.cos(), -d.cos() * el.cos(), el.sin()];
     let span = (b.img.width.max(b.img.height) as f64).max(1.0);
     let mut p = Params::default();
-    p.f[0] = f4([(soft * 0.5).max(1.0), (pr.f("cutAway") / 100.0).clamp(0.0, 0.99), pr.f("lightIntensity") / 100.0, pr.f("ambient") / 100.0]);
+    p.f[0] = f4([(pr.f("cutAway") / 100.0).clamp(0.0, 1.0), pr.f("lightIntensity") / 100.0, pr.f("ambient") / 100.0, soft * 1.5]);
     p.f[1] = f4([pr.f("diffuse") / 100.0, pr.f("specular") / 100.0, (1.0 / pr.f("roughness").clamp(0.001, 1.0)).min(500.0), pr.f("metal") / 100.0]);
     p.f[2] = f4([lpos.0, lpos.1, lheight / 100.0 * span, (pr.e("lightType") == 1) as u32 as f64]);
     p.f[3] = f4([ldir[0], ldir[1], ldir[2], 0.0]);
     p.f[4] = rgb(pr.color("lightColor"), 0.0);
+    p.f[5] = f4([if soft > 0.05 { span / 64.0 } else { 0.0 }, span * 0.34 * b.scale, (soft * 0.65).max(1.0), 1.25]);
+    p.f[6] = f4([span * 0.5, 0.0, 0.0, 0.0]);
     run(e, "ftr_blob", &p, b, Some(&h), None)
 }
diff --git a/crates/gpu/src/fx_vr.rs b/crates/gpu/src/fx_vr.rs
index e719d606f..438eeb661 100644
--- a/crates/gpu/src/fx_vr.rs
+++ b/crates/gpu/src/fx_vr.rs
@@ -181,7 +181,13 @@ fn sphere_blur(e: &mut Enc, img: &GpuImage, sigma: f64) -> GpuImage {
         let mut p = Params::default();
         p.u[0][0] = 256;
         let out = e.scratch(cur.width, cur.height);
-        e.dispatch("fxv_box_h", &p, &cur, None, &out, Some(&buf), (cur.height.div_ceil(64), cur.width.div_ceil(256)));
+        e.dispatch(
+            "fxv_box_h",
+            &p,
+            crate::context::KernelImages { src: &cur, aux: None, out: &out },
+            Some(&buf),
+            (cur.height.div_ceil(64), cur.width.div_ceil(256)),
+        );
         cur = out;
     }
     for &r in &radii {
@@ -192,7 +198,13 @@ fn sphere_blur(e: &mut Enc, img: &GpuImage, sigma: f64) -> GpuImage {
         let mut p = Params::default();
         p.u[0] = [block, r as u32, 0, 0];
         let out = e.scratch(cur.width, cur.height);
-        e.dispatch("fxv_box_v", &p, &cur, None, &out, None, (cur.width.div_ceil(64), cur.height.div_ceil(block)));
+        e.dispatch(
+            "fxv_box_v",
+            &p,
+            crate::context::KernelImages { src: &cur, aux: None, out: &out },
+            None,
+            (cur.width.div_ceil(64), cur.height.div_ceil(block)),
+        );
         cur = out;
     }
     cur
diff --git a/crates/gpu/src/inpaint.rs b/crates/gpu/src/inpaint.rs
new file mode 100644
index 000000000..8adbc3069
--- /dev/null
+++ b/crates/gpu/src/inpaint.rs
@@ -0,0 +1,764 @@
+//! Content-Aware Fill's per-frame synthesis and flow on the GPU: PatchMatch's multi-scale EM
+//! loop, propagation, random search and vote of `effectcraft_raster::inpaint`, and the block
+//! matching of `effectcraft_raster::flow::block_flow`, as compute kernels following the CPU's
+//! steps (`shaders/inpaint.wgsl`).
+//!
+//! The fill's input frames are composited on the CPU by design (analyses do not use the job
+//! worker's GPU: `effectcraft_engine::background::offload::job_accel`), so this module is about the fill
+//! itself — the part that runs for minutes on a large mask, and whose parallel search is what a
+//! device wins on. The membrane (harmonic) solve, the flow's hole completion, the orchestration
+//! ([`effectcraft_raster::inpaint::fill_sequence_with`]), the flow-guided propagation and the
+//! per-frame flow control stay on the CPU: the membrane is bandwidth-bound (see
+//! [`FillBackend::patch`]), and the propagation's coupling is sequential, needing every frame of
+//! the range resident at once.
+//!
+//! Parity with the CPU reference is a quality contract, not bit-exactness: the CPU's
+//! scan-order propagation becomes a two-pass checkerboard, and its in-place relaxation becomes
+//! Jacobi reads. Both solve the same problem to the same quality (`tests/inpaint.rs`).
+
+use effectcraft_raster::Image;
+use effectcraft_raster::flow::{Flow, block_flow};
+use effectcraft_raster::inpaint::{FillBackend, complete_flow, dilate};
+
+use crate::Gpu;
+use crate::context::{Enc, GpuContext, GpuImage, KernelImages, Params};
+
+/// The kernels this module adds to the shared pipeline registry (`context.rs`).
+pub(crate) const KERNELS: &[&str] = &[
+    "imp_down",
+    "imp_up",
+    "imp_jacobi",
+    "imp_pm_down",
+    "imp_pm_up",
+    "imp_nnf_up",
+    "imp_pm_init",
+    "imp_pm_prop",
+    "imp_pm_rand",
+    "imp_nnf_store",
+    "imp_pm_vote",
+    "imp_hist",
+    "imp_fl_half",
+    "imp_fl_search",
+    "imp_fl_subpix",
+    "imp_fl_median",
+];
+
+/// Distance histogram bins (`imp_hist`); bin 0's `.g` holds the largest finite distance the
+/// dispatch saw, for the HDR re-bin.
+const BINS: usize = 1024;
+
+/// The distance range `imp_hist`'s bins cover for SDR input. An image whose channels are all ≤ 1
+/// has `Σ_c (a − b)² ≤ 4`, so no patch distance exceeds it and the bins need no rescaling.
+const SDR_DISTANCE: f32 = 4.0;
+
+/// `u`/`f` blocks of a kernel's parameter buffer (see `inpaint.wgsl`'s header).
+fn params(u0: [u32; 4], u1: [u32; 4], u2: [u32; 4], f0: [f32; 4]) -> Params {
+    Params { u: [u0, u1, u2, [0; 4]], f: [f0, [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4], [0.0; 4]] }
+}
+
+/// `p` with this level's mask offset in `u[3].x` (`inpaint.wgsl`'s `data`).
+fn with_off(p: Params, off: u32) -> Params {
+    Params { u: [p.u[0], p.u[1], p.u[2], [off, 0, 0, 0]], f: p.f }
+}
+
+/// A relaxation sweep count of `membrane_core`. The CPU uses 200 for the small levels and 40 for
+/// the large ones; this uses 64 and 40. The small levels are where the difference lies: Jacobi
+/// needs O(n²) sweeps to converge on an n-wide grid, so at the levels the coarse-to-fine schedule
+/// actually reaches (n ≤ 16, where n² ≤ 256) 64 sweeps is already converged, and finer levels
+/// start from a good guess. Matching the CPU's 200 measured ≈ 6% slower on the whole fill with no
+/// change in the result to two decimals (67.0 dB either way), so the schedule is deliberately
+/// not the CPU's — Jacobi and Gauss–Seidel do not converge alike, and the parity contract is
+/// quality, not bit-exactness.
+fn sweep_count(w: usize, h: usize) -> usize {
+    if w * h <= 4096 { 64 } else { 40 }
+}
+
+/// PatchMatch's patch radius at a level (`pm_level`).
+fn radius(patch: usize, w: u32, h: u32) -> u32 {
+    (patch / 2).min(w.min(h).saturating_sub(1) as usize / 2).max(1) as u32
+}
+
+/// The bounding box of `mask`'s set pixels, `[x0, y0, x1, y1)`, or `None` when it is empty.
+fn bbox(mask: &[bool], w: usize, h: usize) -> Option<[u32; 4]> {
+    let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0usize, 0usize);
+    for y in 0..h {
+        for x in 0..w {
+            if mask.get(y * w + x).copied().unwrap_or(false) {
+                x0 = x0.min(x);
+                y0 = y0.min(y);
+                x1 = x1.max(x + 1);
+                y1 = y1.max(y + 1);
+            }
+        }
+    }
+    if x0 == usize::MAX { None } else { Some([x0 as u32, y0 as u32, x1 as u32, y1 as u32]) }
+}
+
+/// [`bbox`] grown by `n` pixels, clipped to the image.
+fn grow(b: [u32; 4], n: u32, w: u32, h: u32) -> [u32; 4] {
+    [b[0].saturating_sub(n), b[1].saturating_sub(n), b[2].saturating_add(n).min(w), b[3].saturating_add(n).min(h)]
+}
+
+/// The bounding box of the pixels a membrane level still has to solve (`known` false), or
+/// `None` when every pixel is known.
+fn unknown_bbox(known: &[f32], w: usize, h: usize) -> Option<[u32; 4]> {
+    let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0usize, 0usize);
+    for y in 0..h {
+        for x in 0..w {
+            if known.get(y * w + x).copied().unwrap_or(1.0) <= 0.5 {
+                x0 = x0.min(x);
+                y0 = y0.min(y);
+                x1 = x1.max(x + 1);
+                y1 = y1.max(y + 1);
+            }
+        }
+    }
+    if x0 == usize::MAX { None } else { Some([x0 as u32, y0 as u32, x1 as u32, y1 as u32]) }
+}
+
+/// One dispatch's images, its per-pixel `data` table and the region it covers. Grouped into a
+/// struct because a kernel's bindings plus its bounds exceed clippy's argument limit, and the
+/// workspace denies `too_many_arguments`.
+struct Pass<'a> {
+    src: &'a GpuImage,
+    aux: Option<&'a GpuImage>,
+    out: &'a GpuImage,
+    data: Option<&'a wgpu::Buffer>,
+    bb: [u32; 4],
+}
+
+/// Dispatch a kernel over `pass.bb`. The box's origin is written into `P.u[1].xy` (the kernels
+/// place their other `u[1]` fields in `.zw`): deriving it from the box the dispatch is sized from
+/// keeps a dispatch's covered region and the origin its shader reads from drifting apart, which
+/// is the subtle way an edge of the region goes unwritten.
+fn over(e: &mut Enc, entry: &str, p: &Params, pass: Pass<'_>) {
+    let bb = pass.bb;
+    let p = Params { u: [p.u[0], [bb[0], bb[1], p.u[1][2], p.u[1][3]], p.u[2], p.u[3]], f: p.f };
+    let groups = ((bb[2] - bb[0]).div_ceil(16), (bb[3] - bb[1]).div_ceil(16));
+    e.dispatch(entry, &p, KernelImages { src: pass.src, aux: pass.aux, out: pass.out }, pass.data, groups);
+}
+
+// ------------------------------------------------------------------ membrane
+
+/// Relax `fine`'s unknown pixels — the harmonic interpolation of their border — with the CPU's
+/// coarse-to-fine schedule (`membrane_core`). `spare` is a free texture of the same size; the
+/// result is returned (it may be `fine`, `spare` or one of the coarse levels).
+fn membrane_tex(e: &mut Enc, fine: &GpuImage, spare: &GpuImage, hole: &[bool], w: u32, h: u32) -> Option<GpuImage> {
+    let (uw, uh) = (w as usize, h as usize);
+    let n = uw * uh;
+    if hole.len() < n || !hole.iter().take(n).any(|b| *b) || !hole.iter().take(n).any(|b| !*b) {
+        return Some(fine.clone());
+    }
+    // The recursion's levels: halve while the level is wider than 8.
+    let mut dims = vec![(uw, uh)];
+    while let Some(&(cw, ch)) = dims.last() {
+        if !(cw > 8 && ch > 8) || dims.len() >= 32 {
+            break;
+        }
+        dims.push((cw.div_ceil(2), ch.div_ceil(2)));
+    }
+    // The known mask of every level: a coarse pixel is known where any of its 2×2 is.
+    let mut knowns: Vec<Vec<f32>> = Vec::with_capacity(dims.len());
+    knowns.push(hole.iter().take(n).map(|b| if *b { 0.0 } else { 1.0 }).collect());
+    for k in 1..dims.len() {
+        let (pw, ph) = dims[k - 1];
+        let (cw, ch) = dims[k];
+        let prev = &knowns[k - 1];
+        let mut cur = vec![0.0f32; cw * ch];
+        for y in 0..ch {
+            for x in 0..cw {
+                for (dx, dy) in [(0usize, 0usize), (1, 0), (0, 1), (1, 1)] {
+                    let (fx, fy) = (2 * x + dx, 2 * y + dy);
+                    if fx < pw && fy < ph && prev[fy * pw + fx] > 0.5 {
+                        cur[y * cw + x] = 1.0;
+                        break;
+                    }
+                }
+            }
+        }
+        knowns.push(cur);
+    }
+    // One buffer for every level's mask (a buffer per level costs a device allocation each).
+    let mut packed: Vec<f32> = Vec::with_capacity(knowns.iter().map(|k| k.len()).sum());
+    let mut offs: Vec<u32> = Vec::with_capacity(knowns.len());
+    for k in &knowns {
+        offs.push(packed.len() as u32);
+        packed.extend_from_slice(k);
+    }
+    let datas = e.data(&packed);
+    let moff = |k: usize| offs.get(k).copied().unwrap_or(0);
+    // The bounds of each level's unknown pixels: the relaxation only touches them (known pixels
+    // never move), which keeps a fill's cost proportional to the hole, not the frame.
+    let mut uns: Vec<Option<[u32; 4]>> = Vec::with_capacity(dims.len());
+    for (k, &(cw, ch)) in dims.iter().enumerate() {
+        uns.push(unknown_bbox(knowns.get(k)?, cw, ch));
+    }
+    // Two textures per coarse level, for the ping-pong sweeps.
+    let mut lv: Vec<GpuImage> = Vec::with_capacity(2 * dims.len());
+    for k in 1..dims.len() {
+        let (cw, ch) = dims[k];
+        lv.push(e.scratch(cw as u32, ch as u32));
+        lv.push(e.scratch(cw as u32, ch as u32));
+    }
+    // Fine to coarse.
+    for k in 1..dims.len() {
+        let (pw, ph) = dims[k - 1];
+        let (cw, ch) = dims[k];
+        let p = with_off(params([pw as u32, ph as u32, cw as u32, ch as u32], [0; 4], [0; 4], [0.0; 4]), moff(k - 1));
+        let src = if k == 1 { fine } else { lv.get(2 * (k - 2))? };
+        e.pixels("imp_down", &p, src, None, lv.get(2 * (k - 1))?, Some(&datas));
+    }
+    // Relax, coarse to fine. `first[k]` says whether level k's image is the first of its pair
+    // (level 0's pair is `fine`/`spare`).
+    let top = dims.len() - 1;
+    let mut first = vec![true; dims.len()];
+    if top >= 1 {
+        let (a, b) = (lv.get(2 * (top - 1))?, lv.get(2 * (top - 1) + 1)?);
+        // Both textures must hold the level before the sweeps: they now write only the hole.
+        e.copy_into(a, b, 0, 0);
+        first[top] = sweeps(e, &datas, moff(top), a, b, Region { w: dims[top].0 as u32, h: dims[top].1 as u32, bb: uns.get(top).copied().flatten() });
+    }
+    for k in (1..top).rev() {
+        let (cw, ch) = dims[k];
+        let (pw, ph) = dims[k + 1];
+        let coarse = lv.get(2 * k + usize::from(!first[k + 1]))?;
+        let (fa, fb) = (lv.get(2 * (k - 1))?, lv.get(2 * (k - 1) + 1)?);
+        e.copy_into(fa, fb, 0, 0);
+        if let Some(bb) = uns.get(k).copied().flatten() {
+            let p = with_off(params([cw as u32, ch as u32, pw as u32, ph as u32], [0; 4], [0; 4], [0.0; 4]), moff(k));
+            over(e, "imp_up", &p, Pass { src: coarse, aux: None, out: fb, data: Some(&datas), bb });
+        }
+        // `imp_up` wrote into `fb`, the pair's second.
+        first[k] = !sweeps(e, &datas, moff(k), fb, fa, Region { w: cw as u32, h: ch as u32, bb: uns.get(k).copied().flatten() });
+    }
+    if top >= 1 {
+        let coarse = lv.get(usize::from(!first[1]))?;
+        e.copy_into(fine, spare, 0, 0);
+        let bb = uns.first().copied().flatten()?;
+        let p = with_off(params([w, h, dims[1].0 as u32, dims[1].1 as u32], [0; 4], [0; 4], [0.0; 4]), moff(0));
+        over(e, "imp_up", &p, Pass { src: coarse, aux: None, out: spare, data: Some(&datas), bb });
+        return Some(if sweeps(e, &datas, moff(0), spare, fine, Region { w, h, bb: Some(bb) }) { spare.clone() } else { fine.clone() });
+    }
+    let bb = uns.first().copied().flatten()?;
+    e.copy_into(fine, spare, 0, 0);
+    Some(if sweeps(e, &datas, moff(0), fine, spare, Region { w, h, bb: Some(bb) }) { fine.clone() } else { spare.clone() })
+}
+
+/// A texture's dimensions and the region a dispatch covers (`None`: nothing to do).
+struct Region {
+    w: u32,
+    h: u32,
+    bb: Option<[u32; 4]>,
+}
+
+/// Jacobi relaxation sweeps of a texture pair, over the unknown pixels' bounds `region.bb` (the
+/// state starts in `a`); returns whether the result is in `a`.
+fn sweeps(e: &mut Enc, data: &wgpu::Buffer, off: u32, a: &GpuImage, b: &GpuImage, region: Region) -> bool {
+    let Some(bb) = region.bb else { return true };
+    let p = with_off(params([region.w, region.h, 0, 0], [0; 4], [0; 4], [0.0; 4]), off);
+    let mut in_a = true;
+    for _ in 0..sweep_count(region.w as usize, region.h as usize) {
+        let (src, out) = if in_a { (a, b) } else { (b, a) };
+        over(e, "imp_jacobi", &p, Pass { src, aux: None, out, data: Some(data), bb });
+        in_a = !in_a;
+    }
+    in_a
+}
+
+/// `img` with the pixels `mask` marks inside `bb` replaced by `rect` — the tightly packed RGBA f32
+/// rows of the rectangle that was read back. Pixels outside the mask stay the input's, bit for bit.
+fn patch_back(img: &Image, mask: &[bool], bb: [u32; 4], rect: &[u8]) -> Image {
+    let (w, rw) = (img.width as usize, (bb[2] - bb[0]) as usize);
+    let mut out = img.clone();
+    for y in bb[1]..bb[3] {
+        for x in bb[0]..bb[2] {
+            let i = y as usize * w + x as usize;
+            if !mask.get(i).copied().unwrap_or(false) {
+                continue;
+            }
+            let off = ((y - bb[1]) as usize * rw + (x - bb[0]) as usize) * 16;
+            let Some(b) = rect.get(off..off + 16) else { continue };
+            let mut px = [0.0f32; 4];
+            for (c, v) in px.iter_mut().enumerate() {
+                *v = f32::from_le_bytes([b[c * 4], b[c * 4 + 1], b[c * 4 + 2], b[c * 4 + 3]]);
+            }
+            out.data[i] = px;
+        }
+    }
+    out
+}
+
+impl FillBackend for Gpu {
+    /// PatchMatch synthesis — the fill's dominant cost, and the stage a device wins on: two to
+    /// three times faster than the CPU's 18-rayon-thread loop at 1920×1080 with a 300×200 hole
+    /// on an Intel Arc iGPU, and far more on a discrete one.
+    ///
+    /// The membrane ([`FillBackend::membrane`]) deliberately stays on the CPU: a harmonic solve
+    /// over a hole is only a few tens of milliseconds, and on the same measurement it is *slower*
+    /// on the device (≈ 90 ms against ≈ 55 ms). Most of that is the fill's full-frame data
+    /// movement — uploading the frame, copying it and building the known pyramid — which does not
+    /// shrink with the hole, while the relaxation itself does. The CPU's in-place Gauss–Seidel
+    /// over many cores is already competitive there, so the device only takes the stage where its
+    /// parallel search actually pays. (`membrane_tex` still runs on the device *inside* this
+    /// stage, where it is the coarsest level's start and never crosses back to the CPU.)
+    fn patch(&self, img: &Image, hole: &[bool], init: Option<&Image>, patch: usize, seed: u32) -> Image {
+        // The error scopes make an allocation or validation failure local to this frame: the
+        // CPU fills it instead, rather than an uncaptured error retiring the shared context.
+        if self.ctx.can_wait()
+            && let Ok(Some(out)) = self.within_memory(|| patch_image(&self.ctx, img, hole, init, patch, seed))
+        {
+            return out;
+        }
+        effectcraft_raster::inpaint::patch_fill(img, hole, init, patch, seed)
+    }
+
+    /// The block matching that the sequence's flow-guided propagation starts from, which is the
+    /// flow's dominant cost. The field is a small `cols × rows` grid (8 px tiles, so 240 × 135 at
+    /// 1080p), and the search is texture-load-bound: at 1920×1080 the CPU's `block_flow` is
+    /// ≈ 65–70 ms against ≈ 55 ms here, most of it the coarsest level's window (`radius 6` over
+    /// up to six seeds) and the finest level's 8×8 blocks. That is a smaller margin than
+    /// [`patch`](Self::patch), but the flow runs twice per frame pair, so on a four-frame 1080p
+    /// sequence it is worth ≈ 0.15× of the fill's total (1.42× against 1.27× with the CPU flow).
+    ///
+    /// The field is exhaustive, not heuristic: it matches the CPU's to a float rounding, so the
+    /// propagation sees the same motion. Both A's block per candidate (hoisted into registers)
+    /// and the CPU's `Plane::luma` (computed here by [`effectcraft_raster::flow::luma_pair`] and
+    /// uploaded, because a device may contract `a·b + c` into a multiply-add and round the luma
+    /// differently) are why it is that close.
+    ///
+    /// The completion — marking the tiles that touch either hole and interpolating the surrounding
+    /// motion over them — stays on the CPU ([`complete_flow`]). It is a membrane solve over that
+    /// same tiny grid whose cost is the mask, not the solve, so there is little for the device to
+    /// take; keeping it here also keeps the completed field the CPU's to within the search's
+    /// rounding.
+    fn flow(&self, a: &Image, b: &Image, hole_a: &[bool], hole_b: &[bool]) -> Flow {
+        // Frame-local error scopes, as for the patch: a failed GPU search falls back to the CPU.
+        if self.ctx.can_wait()
+            && let Ok(Some(f)) = self.within_memory(|| flow_image(&self.ctx, a, b))
+        {
+            return complete_flow(f, hole_a, hole_b, a.width as usize, a.height as usize);
+        }
+        complete_flow(block_flow(a, b, 8, 6), hole_a, hole_b, a.width as usize, a.height as usize)
+    }
+}
+
+// ------------------------------------------------------------------ block flow
+
+/// `effectcraft_raster::flow::block_flow(a, b, 8, 6)` on the device: the two frames' luma
+/// pyramids, the coarse-to-fine search, the sub-pixel fit and the 3×3 median, returning the raw
+/// field ([`complete_flow`] does the hole completion). `None` where the device cannot run it and
+/// the caller falls back to the CPU.
+pub(crate) fn flow_image(g: &GpuContext, a: &Image, b: &Image) -> Option<Flow> {
+    let (w, h) = (a.width, a.height);
+    if w == 0 || h == 0 || w != b.width || h != b.height || !g.fits(w, h) {
+        return None;
+    }
+    let (tile, win, radius) = (8u32, 8u32, 6u32);
+    let cols = (w as usize).div_ceil(tile as usize).max(1);
+    let rows = (h as usize).div_ceil(tile as usize).max(1);
+    // block_flow_window's early out: a frame too small to hold one block and window.
+    if w < tile || h < tile || w < win || h < win {
+        return Some(Flow { width: w, height: h, block: tile, cols, rows, v: vec![[0.0; 2]; cols * rows] });
+    }
+    let mut e = Enc::new(g);
+    // The luma pyramid: `Plane::luma` (packed .x/.y), halved while both sides stay worth matching
+    // (`Plane::half`), at most four levels.
+    let mut dims = vec![(w, h)];
+    while dims.len() < 4 {
+        let (cw, ch) = *dims.last()?;
+        if cw / 2 < 16 || ch / 2 < 16 {
+            break;
+        }
+        dims.push(((cw / 2).max(1), (ch / 2).max(1)));
+    }
+    // The luma is the CPU's (`luma_pair`), so the field matches `block_flow`'s bit for bit; the
+    // halves below are exact additions and a multiply by a power of two.
+    let pair = g.upload_image(&effectcraft_raster::flow::luma_pair(a, b))?;
+    let mut luma: Vec<GpuImage> = Vec::with_capacity(dims.len());
+    luma.push(pair);
+    for k in 1..dims.len() {
+        let (pw, ph) = dims[k - 1];
+        let (cw, ch) = dims[k];
+        let dst = e.scratch(cw, ch);
+        e.pixels("imp_fl_half", &params([pw, ph, cw, ch], [0; 4], [0; 4], [0.0; 4]), luma.get(k - 1)?, None, &dst, None);
+        luma.push(dst);
+    }
+    // The coarse-to-fine search: the coarsest level from the zero vector, each finer level from
+    // the doubled vectors of its tile and its four neighbours.
+    let top = dims.len() - 1;
+    let groups = (cols.div_ceil(16) as u32, rows.div_ceil(16) as u32);
+    let mut field: Vec<GpuImage> = Vec::with_capacity(dims.len());
+    for _ in 0..dims.len() {
+        field.push(e.scratch(cols as u32, rows as u32));
+    }
+    for k in (0..dims.len()).rev() {
+        let (pw, ph) = dims[k];
+        let coarser = (k != top).then(|| field.get(k + 1)).flatten();
+        let p = params([pw, ph, cols as u32, rows as u32], [tile, win, 1u32 << k, if k == top { radius } else { 1 }], [u32::from(k != top), 0, 0, 0], [0.0; 4]);
+        e.dispatch("imp_fl_search", &p, KernelImages { src: luma.get(k)?, aux: coarser, out: field.get(k)? }, None, groups);
+    }
+    // The full-resolution sub-pixel fit, then the vector median.
+    let fine = e.scratch(cols as u32, rows as u32);
+    e.dispatch(
+        "imp_fl_subpix",
+        &params([w, h, cols as u32, rows as u32], [tile, win, 0, 0], [0; 4], [0.0; 4]),
+        KernelImages { src: luma.first()?, aux: Some(field.first()?), out: &fine },
+        None,
+        groups,
+    );
+    let out = e.scratch(cols as u32, rows as u32);
+    e.dispatch(
+        "imp_fl_median",
+        &params([w, h, cols as u32, rows as u32], [0; 4], [0; 4], [0.0; 4]),
+        KernelImages { src: &fine, aux: None, out: &out },
+        None,
+        groups,
+    );
+    if e.take_missing() {
+        return None;
+    }
+    // Only the field crosses back to the CPU: `cols × rows` entries.
+    let rect = e.read_rect(&out.texture, 0, 0, cols as u32, rows as u32, 16)?;
+    let mut v = Vec::with_capacity(cols * rows);
+    for i in 0..cols * rows {
+        let b = rect.get(i * 16..i * 16 + 16)?;
+        let f = |o: usize| b.get(o).copied().unwrap_or(0);
+        v.push([f32::from_le_bytes([f(0), f(1), f(2), f(3)]), f32::from_le_bytes([f(4), f(5), f(6), f(7)])]);
+    }
+    Some(Flow { width: w, height: h, block: tile, cols, rows, v })
+}
+
+// ------------------------------------------------------------------ PatchMatch
+
+/// One PatchMatch level's plan.
+struct Lv {
+    w: u32,
+    h: u32,
+    r: u32,
+    /// The target centres: pixels whose patch overlaps the hole (`near`).
+    near: [u32; 4],
+    /// The hole's own bounding box (the vote's dispatch).
+    holes: [u32; 4],
+    /// Where the nearest-neighbour field must be defined: the vote reads it `r` pixels out.
+    field: [u32; 4],
+    flags: wgpu::Buffer,
+}
+
+/// The multi-scale PatchMatch synthesis of `patch_fill`: `init` is the starting guess (the
+/// previous frame's fill warped onto this one), which refines the finest level only.
+pub(crate) fn patch_image(g: &GpuContext, img: &Image, hole: &[bool], init: Option<&Image>, patch: usize, seed: u32) -> Option<Image> {
+    let (w, h) = (img.width, img.height);
+    if w == 0 || h == 0 || !g.fits(w, h) {
+        return None;
+    }
+    let (uw, uh) = (w as usize, h as usize);
+    let n = uw * uh;
+    if hole.len() < n || !hole.iter().take(n).any(|b| *b) {
+        return Some(img.clone());
+    }
+    let hole: Vec<bool> = hole.iter().take(n).copied().collect();
+    let patch = patch.max(3) | 1;
+    let mut e = Enc::new(g);
+
+    // A refinement of one frame (`patch_fill`'s `init`): the previous frame's fill seeds the
+    // hole and only the finest level runs, from 2 EM rounds of 4 iterations.
+    if let Some(init) = init {
+        if init.width != w || init.height != h {
+            return None;
+        }
+        let mut start = img.clone();
+        for (i, v) in start.data.iter_mut().enumerate() {
+            if hole.get(i).copied().unwrap_or(false) {
+                *v = *init.data.get(i)?;
+            }
+        }
+        let lv = plan_level(&mut e, &hole, w, h, patch)?;
+        let image = g.upload_image(&start)?;
+        let spare = e.scratch(w, h);
+        let nnf = e.image(w, h);
+        let (out, _) = pm_level(&mut e, &lv, PmRun { seed, em: 2, iters: 4 }, &image, &spare, &nnf)?;
+        if e.take_missing() {
+            return None;
+        }
+        let bb = bbox(&hole, uw, uh)?;
+        let rect = e.read_rect(&out.texture, bb[0], bb[1], bb[2] - bb[0], bb[3] - bb[1], 16)?;
+        return Some(patch_back(img, &hole, bb, &rect));
+    }
+
+    // The pyramid: halve while the level is still a few patches across.
+    let mut dims = vec![(w, h)];
+    let mut holes = vec![hole.clone()];
+    while dims.len() < 6 {
+        let &(lw, lh) = dims.last()?;
+        let hl = holes.last()?;
+        if lw.min(lh) / 2 < patch as u32 * 4 || !hl.iter().any(|b| *b) {
+            break;
+        }
+        let (cw, ch) = (lw.div_ceil(2) as usize, lh.div_ceil(2) as usize);
+        let mut nh = vec![false; cw * ch];
+        for y in 0..ch {
+            for x in 0..cw {
+                for (dx, dy) in [(0usize, 0usize), (1, 0), (0, 1), (1, 1)] {
+                    let (fx, fy) = ((2 * x + dx).min(lw as usize - 1), (2 * y + dy).min(lh as usize - 1));
+                    if hl[fy * lw as usize + fx] {
+                        nh[y * cw + x] = true;
+                        break;
+                    }
+                }
+            }
+        }
+        if !nh.iter().any(|b| !*b) {
+            break;
+        }
+        dims.push((cw as u32, ch as u32));
+        holes.push(nh);
+    }
+    let levels = dims.len();
+    let top = levels - 1;
+
+    let mut plan = Vec::with_capacity(levels);
+    for k in 0..levels {
+        plan.push(plan_level(&mut e, holes.get(k)?, dims[k].0, dims[k].1, patch)?);
+    }
+
+    // One image per level (the coarse-to-fine steps and the vote ping-pong in fresh textures).
+    let mut ima: Vec<GpuImage> = Vec::with_capacity(levels);
+    ima.push(g.upload_image(img)?);
+    for k in 1..levels {
+        let (cw, ch) = dims[k];
+        ima.push(e.scratch(cw, ch));
+    }
+    for k in 1..levels {
+        let (pw, ph) = dims[k - 1];
+        let (cw, ch) = dims[k];
+        e.pixels("imp_pm_down", &params([pw, ph, cw, ch], [0; 4], [0; 4], [0.0; 4]), &ima[k - 1], None, &ima[k], Some(&plan[k - 1].flags));
+    }
+    // The coarsest level starts as its membrane fill.
+    let (cw, ch) = dims[top];
+    let spare = e.scratch(cw, ch);
+    ima[top] = membrane_tex(&mut e, &ima[top], &spare, &holes[top], cw, ch)?;
+
+    // Coarse to fine: upsample, then the EM rounds of propagation and voting.
+    let mut nnf: Option<GpuImage> = None;
+    for k in (0..levels).rev() {
+        let lv = &plan[k];
+        nnf = Some(match nnf {
+            Some(coarse) => {
+                let (cw, ch) = dims[k + 1];
+                let fine = e.scratch(lv.w, lv.h);
+                e.pixels("imp_nnf_up", &params([lv.w, lv.h, cw, ch], [0; 4], [0; 4], [0.0; 4]), &coarse, None, &fine, None);
+                fine
+            }
+            None => e.image(lv.w, lv.h),
+        });
+        if k < top {
+            let (cw, ch) = dims[k + 1];
+            let dst = e.scratch(lv.w, lv.h);
+            e.copy_into(&ima[k], &dst, 0, 0);
+            e.pixels("imp_pm_up", &params([lv.w, lv.h, cw, ch], [0; 4], [0; 4], [0.0; 4]), &ima[k + 1], None, &dst, Some(&lv.flags));
+            ima[k] = dst;
+        }
+        let (em, iters) = if k == top { (8, 5) } else { (4, 5) };
+        let spare = e.scratch(lv.w, lv.h);
+        let run = PmRun { seed: seed.wrapping_add(k as u32 * 101), em, iters };
+        let (out, out_nnf) = pm_level(&mut e, lv, run, &ima[k], &spare, nnf.as_ref()?)?;
+        ima[k] = out;
+        nnf = Some(out_nnf);
+    }
+    if e.take_missing() {
+        return None;
+    }
+    // Only the hole changes, so only the hole's bounds cross back to the CPU.
+    let bb = bbox(&hole, uw, uh)?;
+    let rect = e.read_rect(&ima[0].texture, bb[0], bb[1], bb[2] - bb[0], bb[3] - bb[1], 16)?;
+    Some(patch_back(img, &hole, bb, &rect))
+}
+
+/// The plan of one level: its flags (`bit 0` hole, `bit 1` a target centre) and the dispatch
+/// bounds of its targets, holes and field.
+fn plan_level(e: &mut Enc, hole: &[bool], w: u32, h: u32, patch: usize) -> Option<Lv> {
+    // Texture and buffer limits are independent: a level that fits as a texture can still need a
+    // flags buffer over the device's storage binding limit, and that validation error would
+    // retire the context. Decline the GPU path instead (the fill runs on the CPU).
+    if !flags_fit(&e.g.device.limits(), w, h) {
+        return None;
+    }
+    let (iw, ih) = (w as usize, h as usize);
+    let r = radius(patch, w, h);
+    let near = dilate(hole, iw, ih, r as usize);
+    let near_bb = bbox(&near, iw, ih)?;
+    let flags: Vec<f32> = (0..iw * ih).map(|i| (u32::from(hole[i]) + 2 * u32::from(near[i])) as f32).collect();
+    Some(Lv { w, h, r, near: near_bb, holes: bbox(hole, iw, ih)?, field: grow(near_bb, r + 1, w, h), flags: e.data(&flags) })
+}
+
+/// Whether a level's `w × h` f32 flags buffer (at least the 16 bytes [`Enc::data`] allocates)
+/// can be created and bound as one storage buffer on a device with `limits`.
+fn flags_fit(limits: &wgpu::Limits, w: u32, h: u32) -> bool {
+    u64::from(w)
+        .checked_mul(u64::from(h))
+        .and_then(|n| n.checked_mul(4))
+        .map(|b| b.max(16))
+        .is_some_and(|b| b <= limits.max_buffer_size && b <= limits.max_storage_buffer_binding_size)
+}
+
+/// The PatchMatch run at one level: the random stream's seed and the EM round and iteration
+/// counts.
+struct PmRun {
+    seed: u32,
+    em: usize,
+    iters: usize,
+}
+
+/// `pm_level`: `run.em` EM rounds of propagation and voting at one level. `img` holds the level's
+/// image and `img_spare` is a free texture of the same size; the nearest-neighbour field starts
+/// at `nnf`. Returns the level's filled image and its field.
+fn pm_level(e: &mut Enc, lv: &Lv, run: PmRun, img: &GpuImage, img_spare: &GpuImage, nnf: &GpuImage) -> Option<(GpuImage, GpuImage)> {
+    let (seed, em, iters) = (run.seed, run.em, run.iters);
+    let (r, w, h) = (lv.r, lv.w, lv.h);
+    let field_a = e.scratch(w, h);
+    let field_b = e.scratch(w, h);
+    let hist = e.scratch(BINS as u32, 1);
+    let (img_a, img_b) = (img.clone(), img_spare.clone());
+    let (mut field_nnf, mut nnf_spare) = (nnf.clone(), e.scratch(w, h));
+    // The propagation and random search write the targets and the one-pixel ring around them, so
+    // every neighbour they read has a defined alpha (`grow(near, 1)`). The dispatch origin must
+    // be the ring's, not the targets': `over` sizes the dispatch from the box it is given.
+    let ring = grow(lv.near, 1, w, h);
+    let mut in_a = true;
+    for round in 0..em {
+        // The round's initial field: the inherited source where it is still valid, else random.
+        // Every pixel of the field's bounds is written, so the previous round's field is free.
+        let img = if in_a { &img_a } else { &img_b };
+        let p = params([w, h, r, 0], [0; 4], [seed, 0, 0, round as u32], [0.0; 4]);
+        over(e, "imp_pm_init", &p, Pass { src: &field_nnf, aux: Some(img), out: &field_a, data: Some(&lv.flags), bb: lv.field });
+        let mut f_in_a = true;
+        for it in 0..iters {
+            for parity in 0..2u32 {
+                let (s, o) = if f_in_a { (&field_a, &field_b) } else { (&field_b, &field_a) };
+                let p = params([w, h, r, parity], [0; 4], [seed, it as u32, 0, round as u32], [0.0; 4]);
+                over(e, "imp_pm_prop", &p, Pass { src: s, aux: Some(img), out: o, data: Some(&lv.flags), bb: ring });
+                f_in_a = !f_in_a;
+            }
+            let (s, o) = if f_in_a { (&field_a, &field_b) } else { (&field_b, &field_a) };
+            let p = params([w, h, r, 0], [0; 4], [seed, it as u32, 0, round as u32], [0.0; 4]);
+            over(e, "imp_pm_rand", &p, Pass { src: s, aux: Some(img), out: o, data: Some(&lv.flags), bb: ring });
+            f_in_a = !f_in_a;
+        }
+        let field = if f_in_a { &field_a } else { &field_b };
+        // The vote's sigma²: the 75th percentile of the targets' match distances (`pm_level`).
+        let sigma2 = sigma2(e, field, lv, &hist)?;
+        let next_img = if in_a { &img_b } else { &img_a };
+        e.copy_into(img, next_img, 0, 0);
+        let p = params([w, h, r, 0], [0; 4], [0; 4], [sigma2, 0.0, 0.0, 0.0]);
+        over(e, "imp_pm_vote", &p, Pass { src: field, aux: Some(img), out: next_img, data: Some(&lv.flags), bb: lv.holes });
+        // Carry the round's sources into the nearest-neighbour field (targets only).
+        e.pixels("imp_nnf_store", &params([w, h, 0, 0], [0; 4], [0; 4], [0.0; 4]), field, Some(&field_nnf), &nnf_spare, Some(&lv.flags));
+        std::mem::swap(&mut field_nnf, &mut nnf_spare);
+        in_a = !in_a;
+    }
+    Some((if in_a { img_a } else { img_b }, field_nnf))
+}
+
+/// The 75th percentile of a 1024-bin distance histogram (`imp_hist`'s readback) covering
+/// `0..range`, and the histogram's total. The bin's centre is the estimate: within half a bin
+/// (`range/2048`) of the CPU's exact percentile.
+fn percentile(bytes: &[u8], range: f32) -> (f32, f64) {
+    let bin = |i: usize| -> f64 {
+        match bytes.get(i * 16..i * 16 + 4) {
+            Some(b) => f32::from_le_bytes([b[0], b[1], b[2], b[3]]) as f64,
+            None => 0.0,
+        }
+    };
+    let total: f64 = (0..BINS).map(bin).sum();
+    if total < 1.0 {
+        return (1.0, total);
+    }
+    let rank = total * 3.0 / 4.0;
+    let mut cum = 0.0f64;
+    let mut at = BINS - 1;
+    for i in 0..BINS {
+        cum += bin(i);
+        if cum > rank {
+            at = i;
+            break;
+        }
+    }
+    let centre = ((at as f32) + 0.5) * range / BINS as f32;
+    (centre.max(1e-5), total)
+}
+
+/// The largest finite distance `imp_hist` saw, from bin 0's `.g` channel.
+fn max_distance(bytes: &[u8]) -> f32 {
+    match bytes.get(4..8) {
+        Some(b) => f32::from_le_bytes([b[0], b[1], b[2], b[3]]),
+        None => 0.0,
+    }
+}
+
+/// `imp_hist` over `bb`, the targets' bounds: the 75th percentile of the finite distances and the
+/// sample count. SDR input is binned over the fixed [`SDR_DISTANCE`] range; a frame with values
+/// above 1 (32-bpc HDR) has larger distances, so the second dispatch bins over the observed
+/// maximum instead. Clamping those to the SDR range would report a sigma² of ≈ 4 for a distance
+/// of 1600, and `imp_pm_vote`'s weights would round to zero and keep the prior image.
+///
+/// One 16 KB readback per EM round (≈ 28 per 1080p patch) on the SDR path: a few percent of the
+/// stage, and the obvious next thing to remove if the patch has to be faster (a device-side
+/// percentile would need a reduction instead). HDR frames pay one more dispatch and readback.
+fn histogram(e: &mut Enc, field: &GpuImage, flags: &wgpu::Buffer, w: u32, h: u32, bb: [u32; 4], hist: &GpuImage) -> Option<(f32, f64)> {
+    let (bw, bh) = (bb[2] - bb[0], bb[3] - bb[1]);
+    let mut p = params([w, h, 0, 0], [bb[0], bb[1], bw, bh], [0; 4], [0.0; 4]);
+    e.dispatch("imp_hist", &p, KernelImages { src: field, aux: None, out: hist }, Some(flags), (1, 1));
+    let bytes = e.read_texture(&hist.texture, BINS as u32, 1, 16)?;
+    let max = max_distance(&bytes);
+    if max <= SDR_DISTANCE {
+        return Some(percentile(&bytes, SDR_DISTANCE));
+    }
+    // The observed maximum itself has to be in the last bin, so widen the range by a hair rather
+    // than binning it to 1024.
+    let range = max * (1.0 + 1e-6);
+    p.f[0] = [range, 0.0, 0.0, 0.0];
+    e.dispatch("imp_hist", &p, KernelImages { src: field, aux: None, out: hist }, Some(flags), (1, 1));
+    let bytes = e.read_texture(&hist.texture, BINS as u32, 1, 16)?;
+    Some(percentile(&bytes, range))
+}
+
+/// The vote's sigma² at a level (`pm_level`): the 75th percentile of the targets' distances.
+fn sigma2(e: &mut Enc, field: &GpuImage, lv: &Lv, hist: &GpuImage) -> Option<f32> {
+    Some(histogram(e, field, &lv.flags, lv.w, lv.h, lv.near, hist)?.0)
+}
+
+/// [`imp_hist`] on its own: `field`'s match distance (`.b`, `.a` > 0.5 where set) over the
+/// pixels `near` marks, returning the 75th percentile and the sample count. Used by the test that
+/// checks the histogram counts the whole target population.
+#[cfg(test)]
+pub(crate) fn distance_histogram(g: &GpuContext, field: &Image, near: &[bool], w: u32, h: u32) -> Option<(f32, f64)> {
+    let flags: Vec<f32> = near.iter().map(|b| if *b { 2.0 } else { 0.0 }).collect();
+    let mut e = Enc::new(g);
+    let data = e.data(&flags);
+    let img = g.upload_image(field)?;
+    let hist = e.scratch(BINS as u32, 1);
+    let out = histogram(&mut e, &img, &data, w, h, [0, 0, w, h], &hist);
+    if e.take_missing() {
+        return None;
+    }
+    out
+}
+
+#[cfg(test)]
+mod limit_tests {
+    use super::flags_fit;
+
+    /// A level whose flags buffer is over the storage binding limit is declined before it is
+    /// created (the default 128 MiB binding holds 33,554,432 flags: 8192 × 4096).
+    #[test]
+    fn flags_buffer_is_checked_against_the_device_limits() {
+        let l = wgpu::Limits::default();
+        assert!(flags_fit(&l, 1, 1));
+        assert!(flags_fit(&l, 8192, 4096));
+        assert!(!flags_fit(&l, 8192, 4097));
+        assert!(!flags_fit(&l, 16384, 16384));
+        let small = wgpu::Limits { max_buffer_size: 1024, ..wgpu::Limits::default() };
+        assert!(flags_fit(&small, 16, 16));
+        assert!(!flags_fit(&small, 16, 17));
+    }
+}
diff --git a/crates/gpu/src/lib.rs b/crates/gpu/src/lib.rs
index 1cff8be07..3ede5c6b9 100644
--- a/crates/gpu/src/lib.rs
+++ b/crates/gpu/src/lib.rs
@@ -79,10 +79,13 @@ mod fx_tone;
 mod fx_transition;
 mod fx_vr;
 mod fx_warp;
+mod inpaint;
+mod memcap;
 mod ops;
 mod particles;
 mod readback;
 mod walk;
+mod yuv;
 
 use std::sync::Arc;
 
@@ -96,6 +99,29 @@ pub use wgpu;
 
 use crate::context::Enc;
 
+/// Why [`Gpu::within_memory`] discarded a frame.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum FrameError {
+    /// The GPU context is retired (device lost, a readback timed out, an uncaptured error).
+    Retired(String),
+    /// Out of video memory (or a driver reporting a failed allocation as an internal error),
+    /// with any validation errors it went on to cause.
+    Memory(String),
+    /// The device rejected a command with no allocation failure before it (an invalid texture
+    /// or parameters, #1319): a compositor bug, not memory pressure.
+    Validation(String),
+}
+
+impl std::fmt::Display for FrameError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            FrameError::Retired(e) | FrameError::Memory(e) | FrameError::Validation(e) => f.write_str(e),
+        }
+    }
+}
+
+impl std::error::Error for FrameError {}
+
 /// The GPU compositor (cheap to clone; one device shared by all clones).
 #[derive(Clone)]
 pub struct Gpu {
@@ -264,33 +290,42 @@ impl Gpu {
         }
     }
 
-    /// Run work in native thread-local out-of-memory and internal-error scopes. A failed
-    /// result is discarded and cached allocations are released; callers can retry with a fresh
-    /// CPU renderer. Some drivers report a failed allocation as an internal error rather than
-    /// out-of-memory (Adreno's `ERROR_INITIALIZATION_FAILED`, #591), so both count.
+    /// Run work in native thread-local out-of-memory, internal-error and validation scopes. A
+    /// failed result is discarded and the textures and buffers kept for reuse are released;
+    /// callers can retry with a fresh CPU renderer. Some drivers report a failed allocation as an
+    /// internal error rather than out-of-memory (Adreno's `ERROR_INITIALIZATION_FAILED`, #591),
+    /// so both count. A failed allocation leaves an invalid texture whose use is then a
+    /// validation error (`Texture::create_view`, #1319): caught here, it fails this frame only
+    /// instead of retiring the GPU compositor for the session as an uncaptured error.
     /// Browser callers use the host/owned-device failure bridge and bounded readbacks instead
     /// of blocking their event loop on an error-scope future.
-    pub fn within_memory<T>(&self, f: impl FnOnce() -> T) -> Result<T, String> {
-        self.ctx.check_health()?;
+    pub fn within_memory<T>(&self, f: impl FnOnce() -> T) -> Result<T, FrameError> {
+        self.ctx.check_health().map_err(FrameError::Retired)?;
         #[cfg(not(target_arch = "wasm32"))]
         {
             let oom = self.ctx.device.push_error_scope(wgpu::ErrorFilter::OutOfMemory);
             let internal = self.ctx.device.push_error_scope(wgpu::ErrorFilter::Internal);
+            let validation = self.ctx.device.push_error_scope(wgpu::ErrorFilter::Validation);
             let out = f();
+            let validation = pollster::block_on(validation.pop());
             let internal = pollster::block_on(internal.pop());
             let oom = pollster::block_on(oom.pop());
-            match internal.or(oom) {
-                Some(e) => {
-                    self.ctx.clear_uploads();
-                    Err(e.to_string())
-                }
-                None => self.ctx.check_health().map(|()| out),
+            let memory = oom.is_some() || internal.is_some();
+            // The allocation failure first: a validation error is often its consequence.
+            let errors: Vec<String> = [oom, internal, validation].into_iter().flatten().map(|e| e.to_string()).collect();
+            if errors.is_empty() {
+                return self.ctx.check_health().map(|()| out).map_err(FrameError::Retired);
             }
+            // Its textures go back to the pool when dropped: drop them before emptying it.
+            drop(out);
+            self.ctx.discard_kept();
+            let errors = errors.join("; then: ");
+            Err(if memory { FrameError::Memory(errors) } else { FrameError::Validation(errors) })
         }
         #[cfg(target_arch = "wasm32")]
         {
             let out = f();
-            self.ctx.check_health().map(|()| out)
+            self.ctx.check_health().map(|()| out).map_err(FrameError::Retired)
         }
     }
 
@@ -339,13 +374,32 @@ impl Accelerator for Gpu {
         img
     }
 
+    fn comp_frame_yuv420(&self, r: &Renderer, comp: ItemId, t: Tick, bg: [f32; 3]) -> Option<Vec<u8>> {
+        self.ctx.check_health().ok()?;
+        if !self.ctx.can_readback() || self.ctx.deferred.is_some() {
+            return None;
+        }
+        // Sizes the kernel can't take fall back before any GPU work, not after a render.
+        let (w, h) = walk::frame_size(r, comp, t)?;
+        if !yuv::supported(w, h) || !yuv::fits_limits(w, h, &self.ctx.device.limits()) {
+            return None;
+        }
+        let yp = self.ctx.yuv_pipe()?;
+        let mut e = Enc::new(&self.ctx);
+        let img = walk::render(&mut e, r, comp, t)?;
+        let planes = yuv::convert(&mut e, yp, &img, bg)?;
+        // A device fault seen while the frame recorded makes the planes untrustworthy.
+        self.ctx.check_health().ok()?;
+        Some(planes)
+    }
+
     fn supports_effect(&self, id: &str) -> bool {
         self.ctx.check_health().is_ok() && self.ctx.can_readback() && effects::supports(id)
     }
 
     fn effects(&self, chain: &[FxStep], buf: &Buf, levels: Option<f32>) -> Option<Buf> {
         self.ctx.check_health().ok()?;
-        effects::run_chain(&mut Enc::new(&self.ctx), chain, buf, levels)
+        effects::run_chain(&mut Enc::lent(&self.ctx), chain, buf, levels)
     }
 
     fn raster_3d(&self, scene: &effectcraft_render::three_d::adv::Scene) -> Option<effectcraft_render::three_d::adv::Target> {
@@ -363,16 +417,41 @@ impl Accelerator for Gpu {
         self.ctx.can_readback().then_some(self as &dyn effectcraft_effects::psim::ParticleSim)
     }
 
+    fn inpaint(&self) -> Option<&dyn effectcraft_raster::inpaint::FillBackend> {
+        self.ctx.check_health().ok()?;
+        // Readback is synchronous-only, and a kernel that failed to build would make every stage
+        // fall back to the CPU *after* paying the upload and a failed dispatch (and the fill
+        // would still report the GPU path). Neither is a backend at all.
+        if !self.ctx.can_wait() || !crate::inpaint::KERNELS.iter().all(|e| self.ctx.has_kernel(e)) {
+            return None;
+        }
+        Some(self as &dyn effectcraft_raster::inpaint::FillBackend)
+    }
+
     fn auto_pick(&self) -> Option<&effectcraft_render::AutoPick> {
         Some(&self.auto)
     }
 
+    fn render_end(&self) {
+        let (hits, misses) = self.ctx.pool_stats();
+        let pct = hits.saturating_mul(100) / hits.saturating_add(misses).max(1);
+        log::debug!(
+            target: "effectcraft_gpu",
+            "gpu pool: {hits} working textures reused, {misses} allocated ({pct}% reuse) so far"
+        );
+        self.ctx.trim_pool();
+    }
+
     fn frame_begin(&self) {
         if let Some(d) = self.ctx.deferred() {
             d.frame_begin();
         }
     }
 
+    fn frame_end(&self) {
+        self.ctx.pool_frame_end();
+    }
+
     fn pass_begin(&self) {
         if let Some(d) = self.ctx.deferred() {
             d.pass_begin();
@@ -407,57 +486,3 @@ impl effectcraft_effects::psim::ParticleSim for Gpu {
 
 #[cfg(test)]
 mod tests;
-#[cfg(test)]
-mod tests_3d;
-#[cfg(test)]
-mod tests_adjust;
-#[cfg(test)]
-mod tests_adv3d;
-#[cfg(test)]
-mod tests_deferred;
-#[cfg(test)]
-mod tests_deferred_jobs;
-#[cfg(test)]
-mod tests_fx_color;
-#[cfg(test)]
-mod tests_fx_depth;
-#[cfg(test)]
-mod tests_fx_distort;
-#[cfg(test)]
-mod tests_fx_extra;
-#[cfg(test)]
-mod tests_fx_gen2;
-#[cfg(test)]
-mod tests_fx_generate;
-#[cfg(test)]
-mod tests_fx_key;
-#[cfg(test)]
-mod tests_fx_light;
-#[cfg(test)]
-mod tests_fx_lut;
-#[cfg(test)]
-mod tests_fx_noise;
-#[cfg(test)]
-mod tests_fx_particles;
-#[cfg(test)]
-mod tests_fx_pixel2;
-#[cfg(test)]
-mod tests_fx_sim;
-#[cfg(test)]
-mod tests_fx_stylize;
-#[cfg(test)]
-mod tests_fx_text;
-#[cfg(test)]
-mod tests_fx_time;
-#[cfg(test)]
-mod tests_fx_tone;
-#[cfg(test)]
-mod tests_fx_transition;
-#[cfg(test)]
-mod tests_fx_vr;
-#[cfg(test)]
-mod tests_fx_warp;
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod tests_init;
-#[cfg(test)]
-mod tests_particles;
diff --git a/crates/gpu/src/memcap.rs b/crates/gpu/src/memcap.rs
new file mode 100644
index 000000000..9c745322f
--- /dev/null
+++ b/crates/gpu/src/memcap.rs
@@ -0,0 +1,328 @@
+//! Memory back-pressure for frames in flight.
+//!
+//! wgpu destroys a texture or buffer we drop only once the submissions that used it have
+//! completed, and pooled textures released while other frames' encoders are open stay pending
+//! until then. With several 4K frames in flight, the frames record work faster than the GPU
+//! retires it, and freed-but-not-destroyed memory runs the device out of memory (#879). Once the
+//! allocator holds more than the cap and enough of that total is reclaimable (not held by the
+//! upload cache, the texture pool, or live images), a frame submits its encoder and waits for its
+//! own submission so wgpu frees what was dropped. Frames are not held back for memory that cannot
+//! be reclaimed; a warning is logged once.
+//!
+//! wgpu has no safe query for the adapter's memory size (`max_buffer_size` is capped at `i32::MAX`
+//! on Direct3D 12 and Linux/Mesa Vulkan), so the default cap is conservative per device type,
+//! and lower on a discrete card whose memory the OS reports without `unsafe` (Linux's amdgpu
+//! driver, in sysfs: a 2–4 GB card ran out of memory and took the system down, #1487);
+//! `EFFECTCRAFT_GPU_MEMCAP_MB` overrides it (0 = off). Backends without an allocator report
+//! (Metal, WebGPU, GL) are never gated.
+
+use std::path::Path;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering::Relaxed};
+use std::time::Duration;
+
+/// Check the allocator only every this many gate calls (effect calls and layers): the report
+/// lists every allocation, and between checks a frame adds at most a few textures.
+const EVERY: u64 = 8;
+
+const GIB: u64 = 1 << 30;
+const MIB: u64 = 1 << 20;
+
+/// Overrides the default cap: whole MiB, 0 turns the gate off.
+const MEMCAP_ENV: &str = "EFFECTCRAFT_GPU_MEMCAP_MB";
+
+pub(crate) struct MemCap {
+    cap: u64,
+    hysteresis: u64,
+    calls: AtomicU64,
+    waits: AtomicU64,
+    /// Reclaimable bytes remaining after the last wait: another wait fires only once reclaimable
+    /// memory grows by `hysteresis` above this floor (or drops below it first).
+    floor: AtomicU64,
+    /// Set after the first over-cap sample where non-reclaimable memory alone exceeds the cap.
+    warned: AtomicBool,
+    #[cfg(test)]
+    timeout_ns: AtomicU64,
+}
+
+impl MemCap {
+    pub(crate) fn new(info: &wgpu::AdapterInfo) -> MemCap {
+        let env = std::env::var(MEMCAP_ENV).ok();
+        Self::from_env(env.as_deref(), info.device_type, vram(info))
+    }
+
+    fn from_env(var: Option<&str>, device_type: wgpu::DeviceType, vram: Option<u64>) -> MemCap {
+        let cap = cap_from_env(var, device_type, vram);
+        MemCap {
+            cap,
+            hysteresis: default_hysteresis(cap),
+            calls: AtomicU64::new(0),
+            waits: AtomicU64::new(0),
+            floor: AtomicU64::new(0),
+            warned: AtomicBool::new(false),
+            #[cfg(test)]
+            timeout_ns: AtomicU64::new(crate::readback::TIMEOUT.as_nanos() as u64),
+        }
+    }
+
+    /// The same cap with fresh counters (a test context sharing another's device).
+    #[cfg(test)]
+    pub(crate) fn fresh(&self) -> MemCap {
+        MemCap {
+            cap: self.cap,
+            hysteresis: self.hysteresis,
+            calls: AtomicU64::new(0),
+            waits: AtomicU64::new(0),
+            floor: AtomicU64::new(0),
+            warned: AtomicBool::new(false),
+            timeout_ns: AtomicU64::new(self.timeout_ns.load(Relaxed)),
+        }
+    }
+
+    pub(crate) fn cap(&self) -> u64 {
+        self.cap
+    }
+
+    /// Whether to sample the allocator on this call.
+    pub(crate) fn due(&self) -> bool {
+        self.cap != 0 && self.calls.fetch_add(1, Relaxed).is_multiple_of(EVERY)
+    }
+
+    /// Whether `allocated` bytes in the allocator with `kept` non-reclaimable bytes (upload
+    /// cache, pool free list, live frames) should trigger a submit and wait.
+    pub(crate) fn should_wait(&self, allocated: u64, kept: u64) -> bool {
+        if self.cap == 0 || allocated <= self.cap {
+            self.floor.store(0, Relaxed);
+            return false;
+        }
+        if kept > self.cap && !self.warned.swap(true, Relaxed) {
+            log::warn!(
+                target: "effectcraft_gpu",
+                "gpu: {} MiB held by live frames, the upload cache and the texture pool is over the {} MiB memory cap: waiting cannot free it, so frames are not held back for it ({MEMCAP_ENV} sets the cap)",
+                kept >> 20,
+                self.cap >> 20,
+            );
+        }
+        let reclaimable = allocated.saturating_sub(kept);
+        let floor = self.floor.load(Relaxed);
+        if reclaimable < floor {
+            self.floor.store(reclaimable, Relaxed);
+            return false;
+        }
+        reclaimable >= floor.saturating_add(self.hysteresis)
+    }
+
+    pub(crate) fn record_wait(&self, allocated_after: u64, kept_after: u64) {
+        self.floor.store(allocated_after.saturating_sub(kept_after), Relaxed);
+        let n = self.waits.fetch_add(1, Relaxed);
+        if n == 0 {
+            log::info!("gpu: allocator over the {} MiB memory cap, frames wait for the GPU to catch up", self.cap >> 20);
+        }
+    }
+
+    pub(crate) fn wait_timeout(&self) -> Duration {
+        #[cfg(test)]
+        {
+            Duration::from_nanos(self.timeout_ns.load(Relaxed))
+        }
+        #[cfg(not(test))]
+        {
+            crate::readback::TIMEOUT
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn waits(&self) -> u64 {
+        self.waits.load(Relaxed)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn warned(&self) -> bool {
+        self.warned.load(Relaxed)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_wait_timeout(&self, timeout: Duration) {
+        self.timeout_ns.store(timeout.as_nanos() as u64, Relaxed);
+    }
+}
+
+/// The cap from the `EFFECTCRAFT_GPU_MEMCAP_MB` value: whole MiB (0 turns the gate off), or the
+/// default for `device_type` when unset, or (with a warning) when not a number or too large.
+fn cap_from_env(var: Option<&str>, device_type: wgpu::DeviceType, vram: Option<u64>) -> u64 {
+    let Some(v) = var else { return default_cap(device_type, vram) };
+    match v.trim().parse::<u64>().ok().and_then(|mb| mb.checked_mul(MIB)) {
+        Some(cap) => cap,
+        None => {
+            let cap = default_cap(device_type, vram);
+            log::warn!(target: "effectcraft_gpu", "{MEMCAP_ENV}={v:?} is not a whole number of MiB that fits in 64 bits: using {} MiB", cap / MIB);
+            cap
+        }
+    }
+}
+
+/// Discrete cards: 3 GiB, low enough to fire on 4–8 GB cards with headroom for the driver and
+/// desktop while leaving ~1 GiB above the default 1.5 GiB upload cache + 256 MB pool (larger
+/// cards can raise it with `EFFECTCRAFT_GPU_MEMCAP_MB`), and at most three quarters of the card's
+/// memory when it is known (`vram`), so a 2 GB card gets 1.5 GiB (#1487). Integrated and software
+/// adapters share system memory: 2 GiB, whatever their carve-out.
+fn default_cap(t: wgpu::DeviceType, vram: Option<u64>) -> u64 {
+    match t {
+        wgpu::DeviceType::DiscreteGpu => vram.map_or(3 * GIB, |v| (v / 4).saturating_mul(3).min(3 * GIB)),
+        _ => 2 * GIB,
+    }
+}
+
+/// The adapter's dedicated memory in bytes, where the OS reports it without `unsafe`.
+fn vram(info: &wgpu::AdapterInfo) -> Option<u64> {
+    if !cfg!(target_os = "linux") || info.device_type != wgpu::DeviceType::DiscreteGpu {
+        return None;
+    }
+    let bytes = vram_in_sysfs(Path::new("/sys/class/drm"), info.vendor, info.device, &info.device_pci_bus_id);
+    if let Some(b) = bytes {
+        log::info!(target: "effectcraft_gpu", "gpu {}: {} MiB of video memory (sysfs)", info.name, b >> 20);
+    }
+    bytes
+}
+
+/// `mem_info_vram_total` (amdgpu) of the DRM card under `drm` whose PCI vendor and device ids are
+/// `vendor` and `device`. Connector entries (`card1-DP-1`) are skipped. Variants of one model share
+/// those ids (the RX 550 ships with 2 and 4 GB), so the card at PCI address `bus` (`uevent`'s
+/// `PCI_SLOT_NAME`, wgpu's `device_pci_bus_id`) wins; without one, the smallest matching card.
+fn vram_in_sysfs(drm: &Path, vendor: u32, device: u32, bus: &str) -> Option<u64> {
+    let id = |path: &Path| std::fs::read_to_string(path).ok().and_then(|s| u32::from_str_radix(s.trim().trim_start_matches("0x"), 16).ok());
+    let slot = |dev: &Path| {
+        std::fs::read_to_string(dev.join("uevent")).ok()?.lines().find_map(|l| l.strip_prefix("PCI_SLOT_NAME=").map(|s| s.trim().to_ascii_lowercase()))
+    };
+    let mut cards: Vec<_> = std::fs::read_dir(drm)
+        .ok()?
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.file_name().and_then(|n| n.to_str()).is_some_and(|n| n.starts_with("card") && !n.contains('-')))
+        .collect();
+    cards.sort();
+    let found: Vec<(Option<String>, u64)> = cards
+        .iter()
+        .filter_map(|card| {
+            let dev = card.join("device");
+            if id(&dev.join("vendor")) != Some(vendor) || id(&dev.join("device")) != Some(device) {
+                return None;
+            }
+            let bytes = std::fs::read_to_string(dev.join("mem_info_vram_total")).ok()?.trim().parse::<u64>().ok().filter(|&b| b > 0)?;
+            Some((slot(&dev), bytes))
+        })
+        .collect();
+    let bus = bus.trim().to_ascii_lowercase();
+    found.iter().find(|(s, _)| !bus.is_empty() && s.as_deref() == Some(bus.as_str())).map(|&(_, b)| b).or_else(|| found.iter().map(|&(_, b)| b).min())
+}
+
+/// Minimum reclaimable bytes before a wait is worth draining an encoder (1/8 of the cap,
+/// clamped between 1 MiB and 256 MiB, or 1/4 of caps smaller than 4 MiB).
+fn default_hysteresis(cap: u64) -> u64 {
+    if cap == 0 { 0 } else { (cap / 8).clamp(MIB.min(cap / 4), 256 * MIB) }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn defaults_and_cadence() {
+        assert_eq!(default_cap(wgpu::DeviceType::DiscreteGpu, None), 3 * GIB);
+        assert_eq!(default_cap(wgpu::DeviceType::IntegratedGpu, None), 2 * GIB);
+        let m = MemCap::from_env(None, wgpu::DeviceType::IntegratedGpu, None);
+        assert_eq!(m.cap(), 2 * GIB);
+        let due = (0..2 * EVERY).filter(|_| m.due()).count();
+        assert_eq!(due, 2);
+        let off = MemCap::from_env(Some("0"), wgpu::DeviceType::DiscreteGpu, None);
+        assert_eq!(off.cap(), 0);
+        assert!((0..EVERY).all(|_| !off.due()));
+    }
+
+    #[test]
+    fn override_is_whole_mib_or_the_default() {
+        let cap = |v| MemCap::from_env(Some(v), wgpu::DeviceType::DiscreteGpu, None).cap();
+        assert_eq!(cap("2048"), 2 * GIB);
+        assert_eq!(cap(" 8 "), 8 * MIB);
+        assert_eq!(cap("17592186044415"), 17592186044415 * MIB, "the largest value that fits");
+        for bad in ["", "lots", "-1", "1.5", "17592186044416", "99999999999999999999"] {
+            assert_eq!(cap(bad), 3 * GIB, "{bad:?} falls back to the default");
+        }
+    }
+
+    #[test]
+    fn hysteresis_skips_non_reclaimable_and_unfreed_memory() {
+        let m = MemCap::from_env(Some("2048"), wgpu::DeviceType::IntegratedGpu, None);
+        // Upload cache + pool + live frames (2.15 GiB) sit over the 2 GiB cap with only 50 MiB
+        // reclaimable: waiting would free almost nothing, so the gate must stay quiet.
+        let kept = 2150 * MIB;
+        assert!(!m.should_wait(kept + 50 * MIB, kept));
+        assert!(!m.should_wait(kept + 200 * MIB, kept));
+        // Once 256 MiB of dropped textures pile up, the gate fires.
+        assert!(m.should_wait(kept + 256 * MIB, kept));
+        // If a wait freed nothing (e.g. held by another thread's open encoder or timed out),
+        // the floor prevents firing again until another 256 MiB of reclaimable memory accumulates.
+        m.record_wait(kept + 256 * MIB, kept);
+        assert!(!m.should_wait(kept + 256 * MIB, kept));
+        assert!(!m.should_wait(kept + 400 * MIB, kept));
+        assert!(m.should_wait(kept + 512 * MIB, kept));
+        // Once the other thread finishes and reclaimable memory drops, the floor drops with it.
+        assert!(!m.should_wait(kept + 16 * MIB, kept));
+        assert!(m.should_wait(kept + (16 + 256) * MIB, kept));
+    }
+
+    #[test]
+    fn kept_memory_over_the_cap_warns_once_and_never_waits() {
+        let m = MemCap::from_env(Some("8"), wgpu::DeviceType::IntegratedGpu, None);
+        // Cap 8 MiB: kept alone over the cap with reclaimable under the hysteresis → no wait, warn once.
+        assert!(!m.should_wait(20 * MIB, 20 * MIB));
+        assert!(m.warned());
+        assert!(!m.should_wait(20 * MIB, 20 * MIB));
+        assert!(!m.should_wait(20 * MIB, 19 * MIB + MIB / 2));
+        assert!(m.should_wait(20 * MIB, 4 * MIB), "16 MiB reclaimable is over the hysteresis");
+    }
+
+    /// #1487: a 2–4 GB card gets three quarters of its memory instead of the 3 GiB default; a
+    /// larger card keeps the default, and an integrated GPU's carve-out doesn't lower its cap.
+    #[test]
+    fn known_video_memory_lowers_the_discrete_cap() {
+        let d = wgpu::DeviceType::DiscreteGpu;
+        assert_eq!(default_cap(d, Some(2 * GIB)), 3 * GIB / 2);
+        assert_eq!(default_cap(d, Some(4 * GIB)), 3 * GIB);
+        assert_eq!(default_cap(d, Some(16 * GIB)), 3 * GIB, "never above the default");
+        assert_eq!(default_cap(wgpu::DeviceType::IntegratedGpu, Some(GIB / 2)), 2 * GIB);
+        assert_eq!(cap_from_env(None, d, Some(2 * GIB)), 3 * GIB / 2);
+        assert_eq!(cap_from_env(Some("lots"), d, Some(2 * GIB)), 3 * GIB / 2, "a bad override falls back to it");
+        assert_eq!(cap_from_env(Some("4096"), d, Some(2 * GIB)), 4 * GIB, "the override still wins");
+    }
+
+    #[test]
+    fn video_memory_is_read_from_the_matching_drm_card() {
+        let dir = std::env::temp_dir().join(format!("effectcraft-memcap-{}", std::process::id()));
+        let card = |name: &str, vendor: &str, device: &str, vram: Option<&str>| {
+            let dev = dir.join(name).join("device");
+            std::fs::create_dir_all(&dev).unwrap();
+            std::fs::write(dev.join("vendor"), vendor).unwrap();
+            std::fs::write(dev.join("device"), device).unwrap();
+            if let Some(v) = vram {
+                std::fs::write(dev.join("mem_info_vram_total"), v).unwrap();
+            }
+        };
+        // An integrated Intel GPU (no amdgpu file), the RX 550 and a connector entry.
+        card("card0", "0x8086\n", "0x9bc5\n", None);
+        card("card1", "0x1002\n", "0x699f\n", Some("4294967296\n"));
+        std::fs::create_dir_all(dir.join("card1-DP-1")).unwrap();
+        assert_eq!(vram_in_sysfs(&dir, 0x1002, 0x699f, ""), Some(4 * GIB));
+        assert_eq!(vram_in_sysfs(&dir, 0x8086, 0x9bc5, ""), None, "no mem_info_vram_total");
+        assert_eq!(vram_in_sysfs(&dir, 0x1002, 0x73bf, ""), None, "no such card");
+        assert_eq!(vram_in_sysfs(&dir.join("missing"), 0x1002, 0x699f, ""), None);
+        // A 2 GB RX 550 next to the 4 GB one: same ids, told apart by PCI address.
+        card("card2", "0x1002\n", "0x699f\n", Some("2147483648\n"));
+        std::fs::write(dir.join("card1/device/uevent"), "DRIVER=amdgpu\nPCI_SLOT_NAME=0000:01:00.0\n").unwrap();
+        std::fs::write(dir.join("card2/device/uevent"), "DRIVER=amdgpu\nPCI_SLOT_NAME=0000:03:00.0\n").unwrap();
+        assert_eq!(vram_in_sysfs(&dir, 0x1002, 0x699f, "0000:01:00.0"), Some(4 * GIB));
+        assert_eq!(vram_in_sysfs(&dir, 0x1002, 0x699f, "0000:03:00.0"), Some(2 * GIB));
+        assert_eq!(vram_in_sysfs(&dir, 0x1002, 0x699f, ""), Some(2 * GIB), "unknown address: the smaller card");
+        assert_eq!(vram_in_sysfs(&dir, 0x1002, 0x699f, "0000:09:00.0"), Some(2 * GIB), "no such address: the smaller card");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/gpu/src/ops.rs b/crates/gpu/src/ops.rs
index c9e0900e9..30c8c9bea 100644
--- a/crates/gpu/src/ops.rs
+++ b/crates/gpu/src/ops.rs
@@ -32,37 +32,23 @@ pub fn half(e: &mut Enc, src: &GpuImage) -> GpuImage {
     out
 }
 
-/// `raster::composite_warp` (and, with `accumulate = Some(weight)`, `accumulate_warp`): draw
-/// `src` transformed by `m` (src pixels → dst pixels) onto `dst`.
-pub fn warp(
-    e: &mut Enc,
-    dst: &GpuImage,
-    src: &GpuImage,
-    m: &Mat3,
-    sampling: Sampling,
-    mode: BlendMode,
-    opacity: f32,
-    seed: u32,
-    accumulate: Option<f32>,
-) -> GpuImage {
-    warp_q(e, dst, src, m, sampling, mode, opacity, seed, accumulate, None)
+/// Sampling and blending policy for a transformed GPU image.
+pub struct WarpOptions {
+    pub sampling: Sampling,
+    pub mode: BlendMode,
+    pub opacity: f32,
+    pub seed: u32,
+}
+
+/// Draw `src` transformed by `m` onto `dst`, or accumulate it with a sample weight.
+pub fn warp(e: &mut Enc, dst: &GpuImage, src: &GpuImage, m: &Mat3, opts: WarpOptions, accumulate: Option<f32>) -> GpuImage {
+    warp_q(e, dst, src, m, opts, accumulate, None)
 }
 
 /// [`warp`], clamping and quantising the result to `levels` (8/16 bpc: the comp after a layer,
 /// in the same pass).
-#[allow(clippy::too_many_arguments)]
-pub fn warp_q(
-    e: &mut Enc,
-    dst: &GpuImage,
-    src: &GpuImage,
-    m: &Mat3,
-    sampling: Sampling,
-    mode: BlendMode,
-    opacity: f32,
-    seed: u32,
-    accumulate: Option<f32>,
-    levels: Option<f32>,
-) -> GpuImage {
+pub fn warp_q(e: &mut Enc, dst: &GpuImage, src: &GpuImage, m: &Mat3, opts: WarpOptions, accumulate: Option<f32>, levels: Option<f32>) -> GpuImage {
+    let WarpOptions { sampling, mode, opacity, seed } = opts;
     if src.width == 0 || src.height == 0 || opacity <= 0.0 {
         return dst.clone();
     }
diff --git a/crates/gpu/src/particles.rs b/crates/gpu/src/particles.rs
index 7934dee0c..9ac103557 100644
--- a/crates/gpu/src/particles.rs
+++ b/crates/gpu/src/particles.rs
@@ -23,16 +23,38 @@ struct Checkpoint {
     key: u64,
     steps: u64,
     n: u32,
+    /// The birth steps of its particles (see [`born`]).
+    born: u64,
     buf: wgpu::Buffer,
     used: u64,
 }
 
+/// The particles born in the first `steps` steps of `births` (ascending birth steps) and a hash
+/// of their birth steps: a checkpoint is only resumed from when the request's births before it
+/// are the same (a keyframed Birth Rate isn't part of the system key, #1373).
+fn born(births: &[u32], steps: u64) -> (u32, u64) {
+    let mut h = 0xcbf2_9ce4_8422_2325u64;
+    let mut n = 0u32;
+    for &b in births.iter().take_while(|&&b| u64::from(b) < steps) {
+        h = (h ^ u64::from(b)).wrapping_mul(0x0100_0000_01b3);
+        n += 1;
+    }
+    (n, h)
+}
+
 #[derive(Default)]
 pub(crate) struct Checkpoints {
     list: Vec<Checkpoint>,
     clock: u64,
 }
 
+impl Checkpoints {
+    /// Forget every kept state (after a failed frame, whose buffers may be invalid).
+    pub(crate) fn clear(&mut self) {
+        self.list.clear();
+    }
+}
+
 fn pipes(g: &GpuContext) -> &Pipes {
     g.particles.get_or_init(|| {
         let d = &g.device;
@@ -106,6 +128,10 @@ fn uniforms(req: &SimRequest, n: u32, s0: u64, prev_n: u32) -> Vec<u8> {
     out
 }
 
+/// Simulations dispatched on the GPU (tests check the GPU path really ran).
+#[cfg(test)]
+pub(crate) static DISPATCHES: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
 /// Simulate `req` (see [`effectcraft_effects::psim::ParticleSim`]).
 ///
 /// With deferred readbacks (a browser worker) the state's readback is keyed by the request
@@ -141,7 +167,7 @@ pub(crate) fn simulate(g: &GpuContext, req: &SimRequest) -> Option<Vec<SimPartic
         let mut c = g.particle_states.lock().ok()?;
         c.clock += 1;
         let now = c.clock;
-        match c.list.iter_mut().filter(|k| k.key == req.key && k.steps <= req.steps).max_by_key(|k| k.steps) {
+        match c.list.iter_mut().filter(|k| k.key == req.key && k.steps <= req.steps && born(req.births, k.steps) == (k.n, k.born)).max_by_key(|k| k.steps) {
             Some(k) => {
                 k.used = now;
                 (k.steps, Some(k.buf.clone()), k.n)
@@ -187,6 +213,8 @@ pub(crate) fn simulate(g: &GpuContext, req: &SimRequest) -> Option<Vec<SimPartic
     }
     enc.copy_buffer_to_buffer(&next, 0, &read, 0, size);
     g.queue.submit([enc.finish()]);
+    #[cfg(test)]
+    DISPATCHES.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
     if let (Some(d), Some(k)) = (&deferred, key) {
         let row = usize::try_from(size).ok()?;
         let done = d.start(k, n, 1, [0.0; 2], 1.0);
@@ -232,7 +260,8 @@ fn keep_checkpoint(g: &GpuContext, req: &SimRequest, n: u32, next: wgpu::Buffer)
     if let Ok(mut c) = g.particle_states.lock() {
         let now = c.clock;
         c.list.retain(|k| !(k.key == req.key && k.steps == req.steps));
-        c.list.push(Checkpoint { key: req.key, steps: req.steps, n, buf: next, used: now });
+        let (_, h) = born(req.births, req.steps);
+        c.list.push(Checkpoint { key: req.key, steps: req.steps, n, born: h, buf: next, used: now });
         while c.list.len() > CHECKPOINTS {
             let Some(i) = c.list.iter().enumerate().min_by_key(|(_, k)| k.used).map(|(i, _)| i) else { break };
             c.list.remove(i);
diff --git a/crates/gpu/src/readback.rs b/crates/gpu/src/readback.rs
index 0ca011350..b9d0a28a8 100644
--- a/crates/gpu/src/readback.rs
+++ b/crates/gpu/src/readback.rs
@@ -2,12 +2,15 @@
 // Browser callbacks stay on their worker thread. The workspace's wgpu feature still
 // requires Send callbacks on non-atomic wasm, and ParticleSim requires Send + Sync.
 use std::collections::BTreeMap;
+#[cfg(not(target_arch = "wasm32"))]
+use std::sync::Condvar;
 use std::sync::{Arc, Mutex, Weak};
 use std::time::Duration;
 
 pub(crate) const TIMEOUT: Duration = Duration::from_secs(10);
 pub(crate) type Error = String;
 type Done = Box<dyn FnOnce(Result<Vec<u8>, Error>) + Send>;
+const TIMED_OUT: &str = "GPU readback timed out; context retired";
 
 struct Entry {
     deadline: web_time::Instant,
@@ -20,9 +23,70 @@ struct State {
     retired: Option<Error>,
     #[cfg(target_arch = "wasm32")]
     timer_armed: bool,
+    /// The deadline worker is to exit: the context was dropped.
+    #[cfg(not(target_arch = "wasm32"))]
+    closed: bool,
+    /// How many times the deadline worker woke up (tests: it must not wake while idle).
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    worker_wakes: u64,
+}
+/// The state and, natively, the condition the deadline worker sleeps on. The worker owns an
+/// `Arc` of this, not of the [`Readbacks`], so it can block on the condition without keeping
+/// the context alive; dropping the context closes it.
+#[derive(Default)]
+struct Inner {
+    state: Mutex<State>,
+    #[cfg(not(target_arch = "wasm32"))]
+    wake: Condvar,
 }
 #[derive(Default)]
-pub(crate) struct Readbacks(Mutex<State>);
+pub(crate) struct Readbacks(Arc<Inner>);
+
+/// Retire the context when a deadline has passed: the entries to fail, or `None` when none
+/// is due (or it is retired already). Decides and drains under the lock the caller holds.
+fn expire_locked(s: &mut State, now: web_time::Instant) -> Option<Vec<Entry>> {
+    // Decide and drain atomically: a cancelled old deadline must not retire
+    // a newer request inserted between the deadline check and retirement.
+    if s.retired.is_some() || !s.pending.values().any(|e| now >= e.deadline) {
+        return None;
+    }
+    s.retired = Some(TIMED_OUT.to_string());
+    Some(std::mem::take(&mut s.pending).into_values().collect())
+}
+
+/// The deadline worker. It sleeps while nothing is pending, and otherwise exactly until the
+/// earliest deadline or until what is pending changes, so an idle context costs no wakeups
+/// (a 100 ms polling loop here was ten wakeups a second for the life of the app). When a
+/// deadline has passed it retires the context and fails every pending readback.
+#[cfg(not(target_arch = "wasm32"))]
+fn run_deadlines(inner: &Inner) {
+    let mut s = inner.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    loop {
+        if s.closed {
+            return;
+        }
+        let now = web_time::Instant::now();
+        match s.pending.values().map(|e| e.deadline).min() {
+            None => s = inner.wake.wait(s).unwrap_or_else(std::sync::PoisonError::into_inner),
+            Some(deadline) if deadline > now => {
+                s = inner.wake.wait_timeout(s, deadline - now).unwrap_or_else(std::sync::PoisonError::into_inner).0;
+            }
+            Some(_) => {
+                let expired = expire_locked(&mut s, now);
+                drop(s);
+                for entry in expired.into_iter().flatten() {
+                    notify(entry.done, Err(TIMED_OUT.into()));
+                }
+                s = inner.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+                continue;
+            }
+        }
+        #[cfg(test)]
+        {
+            s.worker_wakes += 1;
+        }
+    }
+}
 pub(crate) struct Ticket {
     owner: Weak<Readbacks>,
     id: u64,
@@ -50,23 +114,24 @@ impl Readbacks {
         let me = Arc::new(Self::default());
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let weak = Arc::downgrade(&me);
+            let inner = Arc::clone(&me.0);
             std::thread::Builder::new()
                 .name("gpu-readback-deadlines".into())
-                .spawn(move || {
-                    loop {
-                        std::thread::sleep(Duration::from_millis(100));
-                        let Some(me) = weak.upgrade() else { break };
-                        me.expire(web_time::Instant::now());
-                    }
-                })
+                .spawn(move || run_deadlines(&inner))
                 .map_err(|e| format!("starting GPU readback deadline worker: {e}"))?;
         }
         Ok(me)
     }
 
+    /// Have the deadline worker look at what is pending again (natively; the browser's timer
+    /// re-arms itself).
+    fn poke(&self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        self.0.wake.notify_one();
+    }
+
     pub(crate) fn check(&self) -> Result<(), Error> {
-        let s = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         match &s.retired {
             Some(e) => Err(e.clone()),
             None => Ok(()),
@@ -76,7 +141,7 @@ impl Readbacks {
     pub(crate) fn start(self: &Arc<Self>, done: impl FnOnce(Result<Vec<u8>, Error>) + wgpu::WasmNotSend + 'static) -> Result<Ticket, Error> {
         let mut done: Option<Done> = Some(Box::new(done));
         let result = {
-            let mut s = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let mut s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             if let Some(e) = &s.retired {
                 Err(e.clone())
             } else if s.pending.len() >= 256 {
@@ -96,8 +161,10 @@ impl Readbacks {
         {
             notify(done, Err(e.clone()));
         }
-        #[cfg(target_arch = "wasm32")]
         if result.is_ok() {
+            // The worker may be asleep with nothing pending: this is its new earliest deadline.
+            self.poke();
+            #[cfg(target_arch = "wasm32")]
             self.arm_timer();
         }
         result
@@ -106,7 +173,7 @@ impl Readbacks {
     #[cfg(target_arch = "wasm32")]
     fn arm_timer(self: &Arc<Self>) {
         let delay = {
-            let mut s = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let mut s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             if s.timer_armed || s.retired.is_some() {
                 return;
             }
@@ -123,13 +190,14 @@ impl Readbacks {
 
     pub(crate) fn retire(&self, error: Error) {
         let pending = {
-            let mut s = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let mut s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             if s.retired.is_some() {
                 return;
             }
             s.retired = Some(error.clone());
             std::mem::take(&mut s.pending)
         };
+        self.poke();
         for (_, entry) in pending {
             notify(entry.done, Err(error.clone()));
         }
@@ -137,34 +205,49 @@ impl Readbacks {
 
     pub(crate) fn cancel_pending(&self, error: Error) {
         let pending = {
-            let mut s = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let mut s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             std::mem::take(&mut s.pending)
         };
+        self.poke();
         for (_, entry) in pending {
             notify(entry.done, Err(error.clone()));
         }
     }
 
+    /// Retire the context when a deadline has passed (the browser's timer and tests; natively
+    /// the deadline worker does this itself).
+    #[cfg(any(test, target_arch = "wasm32"))]
     fn expire(&self, now: web_time::Instant) {
-        let error = "GPU readback timed out; context retired".to_string();
-        let pending = {
-            let mut s = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-            // Decide and drain atomically: a cancelled old deadline must not retire
-            // a newer request inserted between the deadline check and retirement.
-            if s.retired.is_some() || !s.pending.values().any(|e| now >= e.deadline) {
-                return;
-            }
-            s.retired = Some(error.clone());
-            std::mem::take(&mut s.pending)
+        let expired = {
+            let mut s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            expire_locked(&mut s, now)
         };
-        for (_, entry) in pending {
-            notify(entry.done, Err(error.clone()));
+        for entry in expired.into_iter().flatten() {
+            notify(entry.done, Err(TIMED_OUT.into()));
         }
     }
+
+    /// Move every pending deadline to `deadline` and wake the worker, as a test's stand-in for
+    /// waiting out the production timeout.
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    fn move_deadlines_for_test(&self, deadline: web_time::Instant) {
+        {
+            let mut s = self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            for entry in s.pending.values_mut() {
+                entry.deadline = deadline;
+            }
+        }
+        self.poke();
+    }
 }
 impl Drop for Readbacks {
     fn drop(&mut self) {
         self.retire("GPU readback context dropped".into());
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner).closed = true;
+            self.0.wake.notify_all();
+        }
     }
 }
 
@@ -194,12 +277,14 @@ impl Layout {
 
 impl Ticket {
     pub(crate) fn active(&self) -> bool {
-        self.owner.upgrade().is_some_and(|me| me.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).pending.contains_key(&self.id))
+        self.owner.upgrade().is_some_and(|me| me.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner).pending.contains_key(&self.id))
     }
     pub(crate) fn complete(self, result: Result<Vec<u8>, Error>) {
         let Some(me) = self.owner.upgrade() else { return };
-        let entry = me.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).pending.remove(&self.id);
+        let entry = me.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner).pending.remove(&self.id);
         if let Some(entry) = entry {
+            // Its deadline is gone: the worker sleeps until the next one, or until something new.
+            me.poke();
             notify(entry.done, result);
         }
     }
@@ -215,7 +300,7 @@ fn schedule(me: Weak<Readbacks>, delay: Duration) -> Result<(), Error> {
         .map_err(|_| "GPU deadline timer unavailable".to_string())?;
     let callback = Closure::once(move || {
         if let Some(me) = me.upgrade() {
-            me.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).timer_armed = false;
+            me.0.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner).timer_armed = false;
             me.expire(web_time::Instant::now());
             // If the earliest request completed, arm for the next live deadline.
             me.arm_timer();
@@ -377,7 +462,7 @@ mod tests {
         assert_eq!(deferred.in_flight(), 0);
         assert_eq!(wakes.0.load(Ordering::SeqCst), 1);
         assert!(matches!(settled.as_mut().poll(&mut Context::from_waker(&waker)), Poll::Ready(())));
-        assert!(me.0.lock().unwrap().pending.is_empty());
+        assert!(me.0.state.lock().unwrap().pending.is_empty());
         rx.recv_timeout(Duration::from_secs(2)).unwrap();
         rx.recv_timeout(Duration::from_secs(2)).unwrap();
 
@@ -390,17 +475,64 @@ mod tests {
                 tx2.send(()).unwrap();
             })
             .unwrap();
-        {
-            let mut state = me.0.lock().unwrap();
-            for entry in state.pending.values_mut() {
-                entry.deadline = web_time::Instant::now();
-            }
-        }
+        me.move_deadlines_for_test(web_time::Instant::now());
         rx.recv_timeout(Duration::from_secs(2)).unwrap();
-        assert!(me.0.lock().unwrap().pending.is_empty());
+        assert!(me.0.state.lock().unwrap().pending.is_empty());
         assert!(me.check().is_err());
     }
 
+    /// With nothing pending the deadline worker sleeps: no periodic wakeups (it used to poll
+    /// every 100 ms for the life of the app, ten wakeups a second while idle).
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn an_idle_deadline_worker_does_not_wake_up() {
+        let me = Readbacks::new().unwrap();
+        std::thread::sleep(Duration::from_millis(350));
+        let wakes = me.0.state.lock().unwrap().worker_wakes;
+        assert!(wakes <= 1, "the worker woke {wakes} times while nothing was pending");
+        // A readback that completes in time: the worker is told, and goes back to sleep.
+        let ticket = me.start(|r| assert!(r.is_ok())).unwrap();
+        ticket.complete(Ok(vec![1]));
+        std::thread::sleep(Duration::from_millis(350));
+        let wakes = me.0.state.lock().unwrap().worker_wakes;
+        assert!(wakes <= 3, "the worker woke {wakes} times for one completed readback");
+        assert!(me.check().is_ok());
+    }
+
+    /// A deadline that passes wakes the worker exactly then, without the old polling loop.
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn a_pending_deadline_wakes_the_worker_when_it_is_due() {
+        let me = Readbacks::new().unwrap();
+        let (tx, rx) = std::sync::mpsc::channel();
+        let _ticket = me
+            .start(move |r| {
+                assert!(r.is_err());
+                tx.send(web_time::Instant::now()).unwrap();
+            })
+            .unwrap();
+        let due = web_time::Instant::now() + Duration::from_millis(200);
+        me.move_deadlines_for_test(due);
+        let fired = rx.recv_timeout(Duration::from_secs(5)).expect("the deadline fires");
+        assert!(fired >= due, "fired {:?} early", due - fired);
+        assert!(fired < due + Duration::from_secs(2), "fired {:?} late", fired - due);
+        assert!(me.check().is_err());
+    }
+
+    /// Dropping the last handle lets the worker exit: it holds the state, not the context.
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn dropping_the_context_stops_the_deadline_worker() {
+        let me = Readbacks::new().unwrap();
+        let inner = Arc::downgrade(&me.0);
+        drop(me);
+        let t0 = web_time::Instant::now();
+        while inner.upgrade().is_some() {
+            assert!(t0.elapsed() < Duration::from_secs(5), "the worker is still holding the state");
+            std::thread::sleep(Duration::from_millis(10));
+        }
+    }
+
     #[test]
     fn missing_callback_times_out_once_and_rejects_late_success() {
         let me = Arc::new(Readbacks::default());
diff --git a/crates/gpu/src/shaders/advanced3d.wgsl b/crates/gpu/src/shaders/advanced3d.wgsl
index 06becba49..8ac143ad0 100644
--- a/crates/gpu/src/shaders/advanced3d.wgsl
+++ b/crates/gpu/src/shaders/advanced3d.wgsl
@@ -14,8 +14,10 @@ struct Globals {
     ambient: vec4<f32>,
     // radiance first texture, mip count, irradiance texture, intensity
     env: vec4<f32>,
-    // rotation, any lighting (0/1), -, -
+    // rotation, any lighting (0/1), shadow map index (-1 none), shadow darkness
     env2: vec4<f32>,
+    // the environment's dominant direction (its shadow's source)
+    env_sun: vec4<f32>,
 };
 
 @group(0) @binding(0) var<uniform> g: Globals;
@@ -179,7 +181,60 @@ fn equirect_uv(d: vec3<f32>, rot: f32) -> vec2<f32> {
     return vec2<f32>(u - floor(u), v);
 }
 
-fn shadow_factor(m: u32, p: vec3<f32>, n_l: f32) -> f32 {
+fn shadow_texel_at(offset: u32, sz: i32, x: i32, y: i32) -> f32 {
+    if (x < 0 || y < 0 || x >= sz || y >= sz) {
+        return 1e30; // outside the map: the light was never blocked there (finite stand-in for the CPU path's infinity sentinel)
+    }
+    return shadow_texels[offset + u32(y * sz + x)];
+}
+
+fn tap_hash(x: i32, y: i32) -> u32 {
+    var h: u32 = (u32(x) * 0x9E3779B9u) ^ (u32(y) * 0x85EBCA6Bu);
+    h = h ^ (h >> 16u);
+    h = h * 0x2545F491u;
+    h = h ^ (h >> 15u);
+    return h;
+}
+
+fn tap_jitter_at(x: i32, y: i32) -> vec2<f32> {
+    let h = tap_hash(x, y);
+    return vec2<f32>(f32(h & 0xFFFFu) * (1.0 / 65536.0) - 0.5, f32((h >> 16u) & 0xFFFFu) * (1.0 / 65536.0) - 0.5);
+}
+
+// shade::tap_jitter: the hash at the four corners of the receiver's 1/8-texel lattice
+// cell (cx, cy), blended bilinearly by the receiver's position w in the cell.
+fn tap_jitter(cx: i32, cy: i32, w: vec2<f32>, i: i32, j: i32) -> vec2<f32> {
+    let x = cx + i * 7919;
+    let y = cy + j * 7919;
+    let c00 = tap_jitter_at(x, y);
+    let c10 = tap_jitter_at(x + 1, y);
+    let c01 = tap_jitter_at(x, y + 1);
+    let c11 = tap_jitter_at(x + 1, y + 1);
+    let a = c00 + (c10 - c00) * w.x;
+    let b = c01 + (c11 - c01) * w.x;
+    return a + (b - a) * w.y;
+}
+
+const PCF_MAX_TAPS: i32 = 10;
+const PLANE_SLOPE_MAX: f32 = 64.0;
+
+// shade::shadow_factor's `open`: 1 where texel (x, y) does not occlude the receiver
+// plane (depth slope -t in texel footprints per texel) at the texel's centre; the
+// perspective compare runs on inverse depth (iz + g·iq), which is linear across the map.
+fn shadow_open(offset: u32, sz: i32, x: i32, y: i32, ortho: bool, z: f32, texel: f32, bias: f32, t: vec2<f32>, u: f32, v: f32, iz: f32, iq: f32) -> f32 {
+    let s = shadow_texel_at(offset, sz, x, y) + bias;
+    let g = t.x * (f32(x) + 0.5 - u) + t.y * (f32(y) + 0.5 - v);
+    var lit: bool;
+    if (ortho) {
+        lit = z - g * texel <= s;
+    } else {
+        let inv = iz + g * iq;
+        lit = inv <= 0.0 || inv * s >= 1.0;
+    }
+    return select(0.0, 1.0, lit);
+}
+
+fn shadow_factor(m: u32, p: vec3<f32>, ng: vec3<f32>, n_l: f32) -> f32 {
     let r0 = shadows[m];
     let r1 = shadows[m + 1u];
     let r2 = shadows[m + 2u];
@@ -205,28 +260,68 @@ fn shadow_factor(m: u32, p: vec3<f32>, n_l: f32) -> f32 {
     }
     let z = q.z;
     let texel = select(abs(z) / focal, 1.0 / focal, ortho);
-    let bias = extra.x * texel * (1.0 + extra.y) * (1.0 + 3.0 * (1.0 - clamp(n_l, 0.0, 1.0)));
-    let step = extra.y / 2.0;
+    // CPU mirror (shade::shadow_factor), step for step: slope-scaled bias at texel
+    // scale (independent of the PCF radius extra.y; a diffusion-scaled bias lifts
+    // shadows off their casters), each texel compared against the receiver plane's
+    // depth at its centre so wide kernels never self-shadow a lit surface, an N×N grid
+    // jittered by an integer hash (bit-identical across backends) of the sub-texel
+    // lattice and tap index, blended across the receiver's lattice cell, and bilinear
+    // compares of the four nearest texel centers.
+    // extra.y is the wanted penumbra in output pixels; dividing by the receiver's
+    // texel footprint keeps it in output pixels at any map resolution, and the reach
+    // is at least two texels so hard edges ramp over texel steps instead of showing them.
+    let bias = extra.x * texel * (1.0 + 3.0 * (1.0 - clamp(n_l, 0.0, 1.0)));
     let sz = i32(size);
+    let nv = vec3<f32>(dot(r0.xyz, ng), dot(r1.xyz, ng), dot(r2.xyz, ng));
+    var den0 = nv.z;
+    if (!ortho) {
+        den0 = nv.x * ((u - c) / focal) + nv.y * ((v - c) / focal) + nv.z;
+    }
+    var t = vec2<f32>(0.0, 0.0);
+    if (den0 < -1e-6) {
+        t = vec2<f32>(clamp(nv.x / den0, -PLANE_SLOPE_MAX, PLANE_SLOPE_MAX), clamp(nv.y / den0, -PLANE_SLOPE_MAX, PLANE_SLOPE_MAX));
+    }
+    let iz = 1.0 / z;
+    let iq = 1.0 / (focal * z);
+    var reach = clamp(extra.y / texel, 2.0, 256.0);
+    if (!(reach < 1e30)) {
+        reach = 1.0;
+    }
+    let n = clamp(i32(ceil(reach)) + 1, 5, PCF_MAX_TAPS);
+    let step = reach / f32(n - 1);
+    let half = f32(n - 1) * 0.5;
+    let gu = u * 8.0;
+    let gv = v * 8.0;
+    let cx = i32(floor(gu));
+    let cy = i32(floor(gv));
+    let wc = vec2<f32>(gu - floor(gu), gv - floor(gv));
     var lit = 0.0;
-    for (var j = -2; j <= 2; j = j + 1) {
-        for (var i = -2; i <= 2; i = i + 1) {
-            let x = i32(floor(u + f32(i) * step));
-            let y = i32(floor(v + f32(j) * step));
-            if (x < 0 || y < 0 || x >= sz || y >= sz) {
-                lit = lit + 1.0;
-                continue;
-            }
-            let d = shadow_texels[offset + u32(y * sz + x)];
-            if (z - bias <= d) {
-                lit = lit + 1.0;
-            }
+    for (var j = 0; j < n; j = j + 1) {
+        for (var i = 0; i < n; i = i + 1) {
+            let jit = tap_jitter(cx, cy, wc, i, j);
+            let su = u + ((f32(i) - half) + jit.x) * step;
+            let sv = v + ((f32(j) - half) + jit.y) * step;
+            // Texel (x, y) holds the depth at its centre (x + 0.5, y + 0.5); each of the
+            // four is compared against the receiver plane at that centre.
+            let tu = su - 0.5;
+            let tv = sv - 0.5;
+            let fx = tu - floor(tu);
+            let fy = tv - floor(tv);
+            let x0 = i32(floor(tu));
+            let y0 = i32(floor(tv));
+            let h00 = shadow_open(offset, sz, x0, y0, ortho, z, texel, bias, t, u, v, iz, iq);
+            let h10 = shadow_open(offset, sz, x0 + 1, y0, ortho, z, texel, bias, t, u, v, iz, iq);
+            let h01 = shadow_open(offset, sz, x0, y0 + 1, ortho, z, texel, bias, t, u, v, iz, iq);
+            let h11 = shadow_open(offset, sz, x0 + 1, y0 + 1, ortho, z, texel, bias, t, u, v, iz, iq);
+            let a = h00 + (h10 - h00) * fx;
+            let b = h01 + (h11 - h01) * fx;
+            lit = lit + a + (b - a) * fy;
         }
     }
-    return lit / 25.0;
+    return lit / f32(n * n);
 }
 
-fn light_shadow(li: u32, kind: u32, lpos: vec3<f32>, shadow: i32, darkness: f32, p: vec3<f32>, n_l: f32) -> f32 {
+fn light_shadow(li: u32, kind: u32, lpos: vec3<f32>, shadow: i32, darkness: f32, p: vec3<f32>, ng: vec3<f32>, n_l: f32) -> f32 {
     if (shadow < 0) {
         return 1.0;
     }
@@ -242,10 +337,22 @@ fn light_shadow(li: u32, kind: u32, lpos: vec3<f32>, shadow: i32, darkness: f32,
             face = select(5u, 4u, d.z > 0.0);
         }
     }
-    let f = shadow_factor((u32(shadow) + face) * SHADOW_STRIDE, p, n_l);
+    let f = shadow_factor((u32(shadow) + face) * SHADOW_STRIDE, p, ng, n_l);
     return 1.0 - darkness * (1.0 - f);
 }
 
+// The Environment light's shadow from its dominant direction (shade::env_shadow). Only the
+// image's key fraction (g.env_sun.w) of the light is occluded — the fill keeps shining — so
+// the shadow stays partial the way After Effects renders an area-light shadow.
+fn env_shadow(p: vec3<f32>, ng: vec3<f32>, n: vec3<f32>) -> f32 {
+    if (g.env2.z < 0.0) {
+        return 1.0;
+    }
+    let n_l = clamp(dot(n, g.env_sun.xyz), 0.0, 1.0);
+    let f = shadow_factor(u32(g.env2.z + 0.5) * SHADOW_STRIDE, p, ng, n_l);
+    return 1.0 - g.env2.w * g.env_sun.w * (1.0 - f);
+}
+
 fn attenuation(kind: u32, falloff: u32, radius: f32, falloff_distance: f32, cos_inner: f32, cos_outer: f32, dir: vec3<f32>, to_l: vec3<f32>, dist: f32) -> f32 {
     var k = 1.0;
     if (falloff == 1u && kind != 0u) {
@@ -330,7 +437,11 @@ fn shadow_only_amount(unlit: bool, normal: vec3<f32>, front: bool, pos: vec3<f32
         if (n_l <= 0.0) {
             continue;
         }
-        amount = max(amount, 1.0 - light_shadow(li, kind, l0.xyz, i32(l3.w), l4.x, pos, n_l));
+        amount = max(amount, 1.0 - light_shadow(li, kind, l0.xyz, i32(l3.w), l4.x, pos, n, n_l));
+    }
+    // The Environment light's shadow counts too (it reaches every surface: no falloff).
+    if (g.ambient.w > 0.5) {
+        amount = max(amount, 1.0 - env_shadow(pos, n, n));
     }
     return amount;
 }
@@ -399,6 +510,8 @@ fn fs(i: VOut, @builtin(front_facing) front: bool) -> FOut {
     if (!front) {
         n = -n;
     }
+    // Shadow lookups follow the geometric surface, not the normal map.
+    let ng = n;
     let tex_n = i32(m3.z);
     if (tex_n >= 0) {
         let t = sample_tex(tex_n, i.uv);
@@ -446,7 +559,7 @@ fn fs(i: VOut, @builtin(front_facing) front: bool) -> FOut {
         }
         var sh = 1.0;
         if (receives_shadows) {
-            sh = light_shadow(li, kind, l0.xyz, i32(l3.w), l4.x, i.pos, n_l);
+            sh = light_shadow(li, kind, l0.xyz, i32(l3.w), l4.x, i.pos, ng, n_l);
         }
         let b = brdf(rgb, metallic, rough, spec_k, diff_k, n, v, to_l);
         acc = acc + b * l2.xyz * k * sh;
@@ -469,7 +582,11 @@ fn fs(i: VOut, @builtin(front_facing) front: bool) -> FOut {
         let f0 = mix(vec3<f32>(0.04 * spec_k), rgb, metallic);
         let ab = env_brdf(n_v, rough);
         let fs = f0 * ab.x + vec3<f32>(ab.y);
-        acc = acc + (irr * rgb * (vec3<f32>(1.0) - fs) * (1.0 - metallic) * diff_k + spec * fs) * ao;
+        var esh = 1.0;
+        if (receives_shadows) {
+            esh = env_shadow(i.pos, ng, n);
+        }
+        acc = acc + (irr * rgb * (vec3<f32>(1.0) - fs) * (1.0 - metallic) * diff_k + spec * fs) * ao * esh;
     }
     let c = acc + emissive;
     out.color = vec4<f32>(c * alpha, alpha);
diff --git a/crates/gpu/src/shaders/classic3d.wgsl b/crates/gpu/src/shaders/classic3d.wgsl
index d2cad8324..41996af36 100644
--- a/crates/gpu/src/shaders/classic3d.wgsl
+++ b/crates/gpu/src/shaders/classic3d.wgsl
@@ -199,6 +199,12 @@ fn attenuation(l: u32, p: vec3<f32>) -> f32 {
     return k;
 }
 
+// compose::shadow_taps: samples per side of the Shadow Diffusion kernel.
+fn shadow_taps(r_px: f32) -> u32 {
+    let n = clamp(u32(ceil(2.0 * r_px / 1.5)), 3u, 15u);
+    return n | 1u;
+}
+
 // compose::occlusion: RGB transmittance of light `l` reaching `p` past caster `c`.
 fn occlusion(c: u32, p: vec3<f32>, l: u32) -> vec3<f32> {
     let pl = planes[c];
@@ -243,9 +249,14 @@ fn occlusion(c: u32, p: vec3<f32>, l: u32) -> vec3<f32> {
     if (r * pl.tex.z < 0.5) {
         px = texel(c, hit.x, hit.y);
     } else {
-        for (var j = -1; j <= 1; j++) {
-            for (var i = -1; i <= 1; i++) {
-                px += texel(c, hit.x + f32(i) * r * 0.66, hit.y + f32(j) * r * 0.66) / 9.0;
+        // compose::shadow_taps: n × n box filter over the penumbra square.
+        let n = shadow_taps(r * pl.tex.z);
+        let step = 2.0 * r / f32(n);
+        let h = i32(n / 2u);
+        let w = 1.0 / f32(n * n);
+        for (var j = -h; j <= h; j++) {
+            for (var i = -h; i <= h; i++) {
+                px += texel(c, hit.x + f32(i) * step, hit.y + f32(j) * step) * w;
             }
         }
     }
@@ -255,16 +266,14 @@ fn occlusion(c: u32, p: vec3<f32>, l: u32) -> vec3<f32> {
     }
     let tr = pl.mat1.y;
     let dark = li.shadow.x;
-    var o = vec3<f32>(1.0);
-    for (var k = 0; k < 3; k++) {
-        var st = 0.0;
-        if (px.w > 0.0) {
-            st = clamp(px[k] / px.w, 0.0, 1.0);
-        }
-        let through = (1.0 - alpha) + alpha * tr * st;
-        o[k] = 1.0 - dark * (1.0 - through);
+    // Per channel, as whole vectors: FXC (DirectX 12) can't write a vector component through a
+    // loop index without unrolling every loop around the call, and fails (#613).
+    var st = vec3<f32>(0.0);
+    if (px.w > 0.0) {
+        st = clamp(px.xyz / px.w, vec3<f32>(0.0), vec3<f32>(1.0));
     }
-    return o;
+    let through = (1.0 - alpha) + alpha * tr * st;
+    return 1.0 - dark * (1.0 - through);
 }
 
 fn shadow_of(it: u32, l: u32, p: vec3<f32>) -> vec3<f32> {
diff --git a/crates/gpu/src/shaders/common.wgsl b/crates/gpu/src/shaders/common.wgsl
index 2c65c9d4a..5541a42c4 100644
--- a/crates/gpu/src/shaders/common.wgsl
+++ b/crates/gpu/src/shaders/common.wgsl
@@ -50,6 +50,91 @@ fn acos_p(x: f32) -> f32 {
     return 1.5707963267948966 - asin_p(x);
 }
 
+// Some hardware's native trig instructions saturate cos near a full turn and
+// have errors large enough to move particles and sphere samples visibly. Reduce
+// to [-pi/4, pi/4] with a split pi/2, then evaluate the Taylor polynomials with
+// explicit fused operations. The effect angles use this bounded range; retain
+// the builtins for non-finite or very large arguments rather than cast them.
+fn sincos_p(x: f32) -> vec2<f32> {
+    if (!(abs(x) <= 8192.0)) {
+        return vec2<f32>(sin(x), cos(x));
+    }
+    let k = round(x * 0.6366197723675814);
+    // Keep the coarse reduction in integers. Some drivers reassociate even
+    // explicit fma chains into x - k*pi/2, losing low bits for large angles.
+    // 3216/2048 is exact; the bounded scaled input and product fit in i32.
+    let scaled = x * 2048.0;
+    let whole = floor(scaled);
+    var r = f32(i32(whole) - i32(k) * 3216) / 2048.0;
+    r += (scaled - whole) / 2048.0;
+    r = fma(-k, 0.0004838267893064022, r);
+    r = fma(-k, 5.564431554416771e-12, r);
+    let z = r * r;
+    var sp = fma(z, -1.0 / 39916800.0, 1.0 / 362880.0);
+    sp = fma(z, sp, -1.0 / 5040.0);
+    sp = fma(z, sp, 1.0 / 120.0);
+    sp = fma(z, sp, -1.0 / 6.0);
+    let sn = fma(r * z, sp, r);
+    var cp = fma(z, -1.0 / 3628800.0, 1.0 / 40320.0);
+    cp = fma(z, cp, -1.0 / 720.0);
+    cp = fma(z, cp, 1.0 / 24.0);
+    cp = fma(z, cp, -0.5);
+    let cs = fma(z, cp, 1.0);
+    switch imod(i32(k), 4) {
+        case 1: { return vec2<f32>(cs, -sn); }
+        case 2: { return vec2<f32>(-sn, -cs); }
+        case 3: { return vec2<f32>(-cs, sn); }
+        default: { return vec2<f32>(sn, cs); }
+    }
+}
+
+fn sin_p(x: f32) -> f32 { return sincos_p(x).x; }
+fn cos_p(x: f32) -> f32 { return sincos_p(x).y; }
+
+// Correctly-rounded positive x/a, clamped to [0,1]. Native division and fma
+// need not have IEEE precision on every shader backend. Discontinuous colour
+// effects need the exact CPU f32 value, not just an approximation within an ulp.
+// Long division uses only bounded 24-bit significands (at most 24 iterations).
+fn unit_div(x: f32, a: f32) -> f32 {
+    if (x <= 0.0 || a <= 0.0) { return 0.0; }
+    if (x >= a) { return 1.0; }
+    if (a == 1.0) { return x; }
+    let xb = bitcast<u32>(x);
+    let ab = bitcast<u32>(a);
+    var nx = xb & 0x7fffffu;
+    var na = ab & 0x7fffffu;
+    var ex = i32((xb >> 23u) & 255u) - 127;
+    var ea = i32((ab >> 23u) & 255u) - 127;
+    if (ex == -127) {
+        let shift = 23u - firstLeadingBit(nx);
+        nx <<= shift;
+        ex = -126 - i32(shift);
+    } else { nx |= 0x800000u; }
+    if (ea == -127) {
+        let shift = 23u - firstLeadingBit(na);
+        na <<= shift;
+        ea = -126 - i32(shift);
+    } else { na |= 0x800000u; }
+    var exponent = ex - ea;
+    if (nx < na) { nx <<= 1u; exponent -= 1; }
+    var rem = nx - na;
+    if (exponent < -150) { return 0.0; }
+    if (exponent == -150) { return bitcast<f32>(select(0u, 1u, rem != 0u)); }
+    let fraction = u32(min(23, exponent + 149));
+    var q = 1u;
+    for (var i = 0u; i <= fraction; i++) {
+        rem <<= 1u;
+        q <<= 1u;
+        if (rem >= na) { rem -= na; q |= 1u; }
+    }
+    let guard = q & 1u;
+    q >>= 1u;
+    if (guard != 0u && (rem != 0u || (q & 1u) != 0u)) { q += 1u; }
+    if (exponent < -126) { return bitcast<f32>(q); }
+    if (q == 0x1000000u) { q >>= 1u; exponent += 1; }
+    return bitcast<f32>((u32(exponent + 127) << 23u) | (q & 0x7fffffu));
+}
+
 // ---------------------------------------------------------------- sampling (raster::Image)
 
 fn tex_get(t: texture_2d<f32>, x: i32, y: i32) -> vec4<f32> {
@@ -157,13 +242,20 @@ fn powz(x: f32, y: f32) -> f32 {
     return pow(x, y);
 }
 
-// Rust's f32::round (half away from zero; WGSL's round() is half to even).
+// Rust's f32::round (half away from zero; WGSL's round() is half to even). Decided by comparing
+// `x` with `t ± 0.5` (exact for integer `t`) rather than subtracting: drivers may fuse a product
+// that feeds `x - t` into one fma (AMD does), skipping the product's rounding, so `5/6 · 3`,
+// which rounds to exactly 2.5 on the CPU, came out 0.49999994 above 2 and rounded down (#1605).
 fn round_away(x: f32) -> f32 {
-    let t = trunc(x);
-    if (abs(x - t) >= 0.5) {
-        return t + sign(x);
+    // From 2^23 up every f32 is an integer, and `t + 0.5` would round to even (8388608 → 8388609).
+    if (abs(x) >= 8388608.0) {
+        return x;
     }
-    return t;
+    let t = trunc(x);
+    if (x >= 0.0) {
+        return select(t, t + 1.0, x >= t + 0.5);
+    }
+    return select(t, t - 1.0, x <= t - 0.5);
 }
 
 // f32::rem_euclid(1.0).
diff --git a/crates/gpu/src/shaders/fx_color.wgsl b/crates/gpu/src/shaders/fx_color.wgsl
index 6b8641dd9..f616a2d9d 100644
--- a/crates/gpu/src/shaders/fx_color.wgsl
+++ b/crates/gpu/src/shaders/fx_color.wgsl
@@ -100,11 +100,36 @@ fn fxc_sc_weights(c0: vec3<f32>) -> array<f32, 9> {
     return w;
 }
 
+// Black & White's Tint (effects::color_fx::bw_tint): the tint's hue and saturation at the
+// gray's luminosity (Color blend, weights 0.3 / 0.59 / 0.11, channels clipped toward the gray).
+// The weights are effects::BW_TINT_LUMA (checked by the test shader_constants_match_the_cpu).
+fn fxc_bw_tint(tint: vec3<f32>, gray: f32) -> vec3<f32> {
+    if (!(gray > 0.0)) {
+        return vec3<f32>(0.0);
+    }
+    if (gray >= 1.0) {
+        return vec3<f32>(gray);
+    }
+    let w = vec3<f32>(0.3, 0.59, 0.11);
+    let c = tint + vec3<f32>(gray - dot(tint, w));
+    let l = dot(c, w);
+    let n = min(min(c.x, c.y), c.z);
+    let x = max(max(c.x, c.y), c.z);
+    var o = c;
+    if (n < 0.0 && l - n > 1e-9) {
+        o = vec3<f32>(l) + (o - vec3<f32>(l)) * l / (l - n);
+    }
+    if (x > 1.0 && x - l > 1e-9) {
+        o = vec3<f32>(l) + (o - vec3<f32>(l)) * (1.0 - l) / (x - l);
+    }
+    return o;
+}
+
 // u[0].x = op:
 //  1 Color Balance   f[0] = shadows, f[1] = midtones, f[2] = highlights; u[0].y = preserve luminosity
 //  2 Vibrance        f[0] = (vibrance, saturation)
 //  3 Black & White   f[0] = (reds, yellows, greens, cyans), f[1] = (blues, magentas);
-//                    u[0].y = tint; f[2] = (tint hue, tint saturation)
+//                    u[0].y = tint; f[2] = tint colour
 //  4 Tritone         f[0] = highlights, f[1] = midtones, f[2] = shadows; f[3].x = 1 − blend
 //  5 Colorama        u[0].y = phase mode, u[0].z = interpolate; f[0] = (cycles, shift, 1 − blend)
 //  6 Channel Mixer   f[0..3] = output rows (r, g, b, const); u[0].y = monochrome
@@ -159,7 +184,7 @@ fn fxc_point(@builtin(global_invocation_id) gid: vec3<u32>) {
                 let gray = max(mn + (mx - mn) * wt, 0.0);
                 var o = vec3<f32>(gray);
                 if (P.u[0].y != 0u) {
-                    o = hsl_to_rgb(P.f[2].x, P.f[2].y, min(gray, 1.0));
+                    o = fxc_bw_tint(P.f[2].xyz, gray);
                 }
                 px = vec4<f32>(o * a, a);
             }
@@ -167,7 +192,9 @@ fn fxc_point(@builtin(global_invocation_id) gid: vec3<u32>) {
         case 4u: {
             if (a > 0.0) {
                 let c = px.xyz / a;
-                let l = clamp(luminance(c), 0.0, 1.0);
+                // Rec. 601 weights, as effects::color_fx::tritone: effects::LUMA_601 (checked by
+                // the test shader_constants_match_the_cpu).
+                let l = clamp(dot(c, vec3<f32>(0.299, 0.587, 0.114)), 0.0, 1.0);
                 var t: vec3<f32>;
                 if (l < 0.5) {
                     t = fxc_mix(P.f[2].xyz, P.f[1].xyz, l * 2.0);
diff --git a/crates/gpu/src/shaders/fx_depth.wgsl b/crates/gpu/src/shaders/fx_depth.wgsl
index 468bd1261..68fc78f9f 100644
--- a/crates/gpu/src/shaders/fx_depth.wgsl
+++ b/crates/gpu/src/shaders/fx_depth.wgsl
@@ -198,11 +198,13 @@ fn fxd_point(@builtin(global_invocation_id) gid: vec3<u32>) {
                 }
             }
         }
-        // Cryptomatte (aux = (ID colours, selection coverage)). u[0] = (op, display, matte only).
+        // Cryptomatte (aux = (ID colours, selection coverage)). u[0] = (op, display, matte only,
+        // matte only in alpha). Matte Only is the matte in RGB over alpha 1, or in every channel
+        // for projects saved before #3127 (`effectcraft_effects::matte_only_px`).
         case 7u: {
             let m = q.w;
             if (P.u[0].z != 0u) {
-                o = vec4<f32>(m);
+                o = select(vec4<f32>(m, m, m, 1.0), vec4<f32>(m), P.u[0].w != 0u);
             } else if (P.u[0].y == 0u) {
                 o = vec4<f32>(q.xyz * (1.0 - 0.5 * m) + 0.5 * m, 1.0);
             } else if (P.u[0].y == 1u) {
diff --git a/crates/gpu/src/shaders/fx_distort.wgsl b/crates/gpu/src/shaders/fx_distort.wgsl
index 5fbc76b4b..5e9e20a12 100644
--- a/crates/gpu/src/shaders/fx_distort.wgsl
+++ b/crates/gpu/src/shaders/fx_distort.wgsl
@@ -238,7 +238,7 @@ fn dst_fbm(u: f32, v: f32, z: f32, seed: u32) -> f32 {
         if (o + 1u == n && frac > 0.0) {
             w = frac;
         }
-        sum += value_noise(u * f, v * f, z + f32(o) * 5.17, seed + o * 101u) * amp * w;
+        sum += value_noise_linear_z(u * f, v * f, z + f32(o) * 5.17, seed + o * 101u) * amp * w;
         norm += amp * w;
         amp *= falloff;
         f *= 2.0;
diff --git a/crates/gpu/src/shaders/fx_generate.wgsl b/crates/gpu/src/shaders/fx_generate.wgsl
index f46b2f0ba..7a2a026bd 100644
--- a/crates/gpu/src/shaders/fx_generate.wgsl
+++ b/crates/gpu/src/shaders/fx_generate.wgsl
@@ -42,6 +42,15 @@ fn gen_sum(a: vec2<f32>, b: vec2<f32>) -> f32 {
     return (a.x + b.x) + (a.y + b.y);
 }
 
+// Standard normal CDF (Abramowitz & Stegun 7.1.26 erf; effects::misc::norm_cdf).
+fn gen_norm_cdf(z: f32) -> f32 {
+    let x = abs(z) * 0.70710678;
+    let t = 1.0 / (1.0 + 0.3275911 * x);
+    let poly = t * (0.254829592 + t * (-0.284496736 + t * (1.421413741 + t * (-1.453152027 + t * 1.061405429))));
+    let erf = 1.0 - poly * exp(-x * x);
+    return select(0.5 * (1.0 - erf), 0.5 * (1.0 + erf), z >= 0.0);
+}
+
 // ---------------------------------------------------------------- Radial Blur (raster::radial_blur)
 
 // u[0] = (zoom, samples); f[0] = (cx, cy); data = per sample (sin, cos) (spin) or k (zoom).
@@ -67,7 +76,10 @@ fn gen_radial_blur(@builtin(global_invocation_id) gid: vec3<u32>) {
             let cs = data[2u * i + 1u];
             s = vec2<f32>(c.x + v.x * cs - v.y * sn, c.y + v.x * sn + v.y * cs);
         }
-        acc += sample_bilinear(src, s.x, s.y);
+        // Edge samples repeat (raster::radial_blur).
+        let hi = vec2<f32>(f32(dims.x), f32(dims.y)) - vec2<f32>(0.5);
+        let sc = clamp(s, vec2<f32>(0.5), max(hi, vec2<f32>(0.5)));
+        acc += sample_bilinear(src, sc.x, sc.y);
     }
     textureStore(out, p, acc / f32(n));
 }
@@ -222,7 +234,9 @@ fn gen_lens_blur(@builtin(global_invocation_id) gid: vec3<u32>) {
 // ---------------------------------------------------------------- wipes
 
 // Linear Wipe. data = per column ((x + 0.5)·dx − edge) (hi, lo), then per row ((y + 0.5)·dy)
-// (hi, lo); u[0].x = row table offset; f[0].x = feather.
+// (hi, lo); u[0] = (row table offset, mode); f[0].x = ramp width (the legacy feather, 1 = pixel
+// coverage). Mode 0 multiplies the layer by the ramp, 1 writes the ramp itself (the hard matte
+// Feather blurs), 2 multiplies the layer by aux's alpha (the blurred matte).
 @compute @workgroup_size(16, 16)
 fn gen_linear_wipe(@builtin(global_invocation_id) gid: vec3<u32>) {
     let dims = out_dims();
@@ -230,14 +244,23 @@ fn gen_linear_wipe(@builtin(global_invocation_id) gid: vec3<u32>) {
     if (p.x >= dims.x || p.y >= dims.y) {
         return;
     }
+    if (P.u[0].y == 2u) {
+        let m = clamp(textureLoad(aux, p, 0).w, 0.0, 1.0);
+        textureStore(out, p, textureLoad(src, p, 0) * m);
+        return;
+    }
     let d = gen_sum(gen_hl(2u * u32(p.x)), gen_hl(P.u[0].x + 2u * u32(p.y)));
     let k = clamp(d / P.f[0].x + 0.5, 0.0, 1.0);
+    if (P.u[0].y == 1u) {
+        textureStore(out, p, vec4<f32>(k));
+        return;
+    }
     textureStore(out, p, textureLoad(src, p, 0) * k);
 }
 
-// Venetian Blinds. Per column (6 floats): (cx − done·w), (cx − w − done·w), (cx − w) as
-// (hi, lo), with cx = ((x + 0.5)·dx) mod w; per row (2 floats): ((y + 0.5)·dy) mod w.
-// u[0].x = row table offset; f[0].x = feather.
+// Venetian Blinds (effects::venetian_cover). Per column (4 floats): cx, (cx − w) as (hi, lo),
+// with cx = ((x + 0.5 − ox)·dx) mod w; per row (2 floats): ((y + 0.5 − oy)·dy) mod w.
+// u[0] = (row table offset, Gaussian terms per side, 0 = hard edge); f[0] = (w, band, σ).
 @compute @workgroup_size(16, 16)
 fn gen_venetian(@builtin(global_invocation_id) gid: vec3<u32>) {
     let dims = out_dims();
@@ -245,34 +268,33 @@ fn gen_venetian(@builtin(global_invocation_id) gid: vec3<u32>) {
     if (p.x >= dims.x || p.y >= dims.y) {
         return;
     }
-    let col = 6u * u32(p.x);
+    let col = 4u * u32(p.x);
     let row = gen_hl(P.u[0].x + 2u * u32(p.y));
     // (d mod w) wraps once the column and row terms reach w.
-    let wrapped = gen_sum(gen_hl(col + 4u), row) >= 0.0;
-    var t: f32;
-    if (wrapped) {
-        t = gen_sum(gen_hl(col + 2u), row);
-    } else {
-        t = gen_sum(gen_hl(col), row);
+    var d = gen_sum(gen_hl(col), row);
+    if (gen_sum(gen_hl(col + 2u), row) >= 0.0) {
+        d = gen_sum(gen_hl(col + 2u), row);
     }
-    let k = clamp(t / P.f[0].x + 0.5, 0.0, 1.0);
-    textureStore(out, p, textureLoad(src, p, 0) * k);
+    let w = P.f[0].x;
+    let band = P.f[0].y;
+    let sigma = P.f[0].z;
+    let n = i32(P.u[0].y);
+    var t = 0.0;
+    if (n == 0) {
+        t = select(0.0, 1.0, d < band);
+    } else {
+        for (var k = -n; k <= n; k++) {
+            let u = d + f32(k) * w;
+            t += gen_norm_cdf(u / sigma) - gen_norm_cdf((u - band) / sigma);
+        }
+    }
+    let cover = clamp(t, 0.0, 1.0);
+    textureStore(out, p, textureLoad(src, p, 0) * (1.0 - cover));
 }
 
-// Angle (degrees, clockwise from up) of the pixel vector rotated by rotation `r` (0 = start,
-// 1 = start + edge, 2 = start − edge), from the per-column / per-row tables of Radial Wipe.
-fn gen_psi(r: u32, x: u32, y: u32) -> f32 {
-    let c = 9u * x + 3u * r;
-    let w = P.u[0].x + 9u * y + 3u * r;
-    // x' = ux·cos R − uy·sin R (cancels at the edge), y' = uy·cos R + ux·sin R.
-    let xr = (data[c] - data[w]) + (data[c + 1u] - data[w + 1u]);
-    let yr = data[w + 2u] + data[c + 2u];
-    return atan2(xr, yr) * GEN_DEG;
-}
-
-// Radial Wipe. data: per column 9 floats (for each rotation: ux·cos R (hi, lo), ux·sin R),
-// per row 9 floats (uy·sin R (hi, lo), uy·cos R); u[0] = (row offset, wipe);
-// f[0] = (edge, feather).
+// Radial Wipe (effects::misc::radial_wipe_alpha). u[0] = (fully wiped, hard edge);
+// f[0] = (centre x, centre y, σ, first ray in degrees); f[1] = (sin, cos) of both rays;
+// f[2].x = span in degrees.
 @compute @workgroup_size(16, 16)
 fn gen_radial_wipe(@builtin(global_invocation_id) gid: vec3<u32>) {
     let dims = out_dims();
@@ -280,30 +302,31 @@ fn gen_radial_wipe(@builtin(global_invocation_id) gid: vec3<u32>) {
     if (p.x >= dims.x || p.y >= dims.y) {
         return;
     }
-    let x = u32(p.x);
-    let y = u32(p.y);
-    let dir = P.u[0].y;
-    let edge = P.f[0].x;
-    var a = gen_psi(0u, x, y);
-    if (a < 0.0) {
-        a += 360.0;
-    }
-    var base: f32;
-    if (dir == 0u || (dir == 2u && a <= 180.0)) {
-        base = a - edge;
-        if (abs(base) < 90.0) {
-            base = gen_psi(1u, x, y);
-        }
-    } else {
-        base = (360.0 - a) - edge;
-        if (abs(base) < 90.0) {
-            base = -gen_psi(2u, x, y);
+    var k = 0.0;
+    if (P.u[0].x == 0u) {
+        let ux = f32(p.x) + 0.5 - P.f[0].x;
+        let uy = f32(p.y) + 0.5 - P.f[0].y;
+        var a = atan2(ux, -uy) * GEN_DEG - P.f[0].w;
+        a = a - 360.0 * floor(a / 360.0);
+        let wiped = a < P.f[2].x;
+        let d = min(gen_ray_dist(ux, uy, P.f[1].x, P.f[1].y), gen_ray_dist(ux, uy, P.f[1].z, P.f[1].w));
+        if (P.u[0].y != 0u) {
+            k = select(1.0, 0.0, wiped);
+        } else {
+            k = gen_norm_cdf(select(d, -d, wiped) / P.f[0].z);
         }
     }
-    let k = clamp(base / P.f[0].y + 0.5, 0.0, 1.0);
     textureStore(out, p, textureLoad(src, p, 0) * k);
 }
 
+// Distance from (ux, uy) to the ray from the centre in direction (s, −c) (y down).
+fn gen_ray_dist(ux: f32, uy: f32, s: f32, c: f32) -> f32 {
+    if (ux * s - uy * c > 0.0) {
+        return abs(ux * c + uy * s);
+    }
+    return length(vec2<f32>(ux, uy));
+}
+
 // Gradient Wipe: aux = the placed gradient layer. u[0].x = invert; f[0] = (done, softness).
 @compute @workgroup_size(16, 16)
 fn gen_gradient_wipe(@builtin(global_invocation_id) gid: vec3<u32>) {
@@ -500,7 +523,7 @@ fn gen_fourcolor(@builtin(global_invocation_id) gid: vec3<u32>) {
         let dx = f32(p.x) + 0.5 - q.x;
         let dy = f32(p.y) + 0.5 - q.y;
         let d2 = dx * dx + dy * dy;
-        let w = 1.0 / pow(d2 / bl + 1e-6, 1.5);
+        let w = 1.0 / (d2 + bl);
         acc += P.f[4 + i].xyz * w;
         wsum += w;
     }
diff --git a/crates/gpu/src/shaders/fx_key.wgsl b/crates/gpu/src/shaders/fx_key.wgsl
index a28ecc65c..bee93ea65 100644
--- a/crates/gpu/src/shaders/fx_key.wgsl
+++ b/crates/gpu/src/shaders/fx_key.wgsl
@@ -62,6 +62,12 @@ fn fxk_range_components(space: u32, c: vec3<f32>) -> vec3<f32> {
 }
 
 // keying::matte_levels.
+// Luma Key / Extract luminance: Rec. 601, effects::LUMA_601 (checked by the test
+// shader_constants_match_the_cpu).
+fn fxk_key_luma(c: vec3<f32>) -> f32 {
+    return dot(c, vec3<f32>(0.299, 0.587, 0.114));
+}
+
 fn fxk_matte_levels(v: f32, in_b: f32, in_w: f32, gamma: f32, out_b: f32, out_w: f32) -> f32 {
     var t = clamp((v - in_b / 255.0) / max((in_w - in_b) / 255.0, 1e-4), 0.0, 1.0);
     t = powz(t, 1.0 / max(gamma, 0.01));
@@ -195,27 +201,17 @@ fn fxk_point(@builtin(global_invocation_id) gid: vec3<u32>) {
             o = vec4<f32>(select(1.0, 0.0, d <= f0.w));
         }
         case 2u: {
-            let l = luminance(c);
+            let l = fxk_key_luma(c);
             let thr = f0.x;
             let tol = f0.y;
             var m: f32;
+            // As effects::keying::luma_key: Brighter / Darker cut hard at the threshold
+            // (Tolerance only shapes Similar / Dissimilar), as After Effects.
             switch u0.y {
-                case 0u: {
-                    if (tol > 0.0) {
-                        m = clamp((thr + tol - l) / tol, 0.0, 1.0);
-                    } else {
-                        m = select(1.0, 0.0, l > thr);
-                    }
-                }
+                case 0u: { m = select(1.0, 0.0, l > thr); }
                 case 2u: { m = select(1.0, 0.0, abs(l - thr) <= tol); }
                 case 3u: { m = select(0.0, 1.0, abs(l - thr) <= tol); }
-                default: {
-                    if (tol > 0.0) {
-                        m = clamp((l - (thr - tol)) / tol, 0.0, 1.0);
-                    } else {
-                        m = select(1.0, 0.0, l < thr);
-                    }
-                }
+                default: { m = select(1.0, 0.0, l < thr); }
             }
             o = vec4<f32>(m);
         }
@@ -241,7 +237,7 @@ fn fxk_point(@builtin(global_invocation_id) gid: vec3<u32>) {
                 case 2u: { v = c.y; }
                 case 3u: { v = c.z; }
                 case 4u: { v = a; }
-                default: { v = luminance(c); }
+                default: { v = fxk_key_luma(c); }
             }
             v = 255.0 * v;
             let bp = f0.x;
diff --git a/crates/gpu/src/shaders/fx_noise.wgsl b/crates/gpu/src/shaders/fx_noise.wgsl
index 1f62d4429..3d0a7977d 100644
--- a/crates/gpu/src/shaders/fx_noise.wgsl
+++ b/crates/gpu/src/shaders/fx_noise.wgsl
@@ -82,69 +82,6 @@ fn fxn_median(@builtin(global_invocation_id) gid: vec3<u32>) {
     textureStore(out, p, vec4<f32>(data[level.x], data[level.y], data[level.z], data[level.w]));
 }
 
-// The same median for large radii, as the CPU computes it: a sliding 512-bin histogram per
-// channel (Huang). One invocation per row segment of u[0].y pixels: it fills the histogram for
-// the segment's first window, then slides right one column at a time (remove the column
-// leaving, add the one entering) and moves each channel's median by the counts below it.
-// u[0] = (r, segment length); dispatched over (rows, segments) with 64 × 1 workgroups.
-// data = the 512 CPU-rounded level / 511 values.
-@compute @workgroup_size(64, 1)
-fn fxn_median_huang(@builtin(global_invocation_id) gid: vec3<u32>) {
-    let dims = out_dims();
-    let y = i32(gid.x);
-    let seg = i32(P.u[0].y);
-    let x0 = i32(gid.y) * seg;
-    if (y >= dims.y || x0 >= dims.x) {
-        return;
-    }
-    let x1 = min(x0 + seg, dims.x);
-    let r = i32(P.u[0].x);
-    let half = u32((2 * r + 1) * (2 * r + 1) / 2);
-    var hist: array<u32, 2048>;
-    for (var dy = -r; dy <= r; dy++) {
-        for (var dx = -r; dx <= r; dx++) {
-            let v = vec4<u32>(tex_get_clamped(src, x0 + dx, y + dy));
-            hist[v.x] += 1u;
-            hist[512u + v.y] += 1u;
-            hist[1024u + v.z] += 1u;
-            hist[1536u + v.w] += 1u;
-        }
-    }
-    // Per channel: the median level and the count of values below it.
-    var med = vec4<u32>(0u);
-    var lt = vec4<u32>(0u);
-    for (var x = x0; x < x1; x++) {
-        if (x > x0) {
-            for (var dy = -r; dy <= r; dy++) {
-                let o = vec4<u32>(tex_get_clamped(src, x - 1 - r, y + dy));
-                let n = vec4<u32>(tex_get_clamped(src, x + r, y + dy));
-                for (var c = 0u; c < 4u; c++) {
-                    hist[c * 512u + o[c]] -= 1u;
-                    if (o[c] < med[c]) {
-                        lt[c] -= 1u;
-                    }
-                    hist[c * 512u + n[c]] += 1u;
-                    if (n[c] < med[c]) {
-                        lt[c] += 1u;
-                    }
-                }
-            }
-        }
-        for (var c = 0u; c < 4u; c++) {
-            let base = c * 512u;
-            while (lt[c] > half) {
-                med[c] -= 1u;
-                lt[c] -= hist[base + med[c]];
-            }
-            while (lt[c] + hist[base + med[c]] <= half) {
-                lt[c] += hist[base + med[c]];
-                med[c] += 1u;
-            }
-        }
-        textureStore(out, vec2<i32>(x, y), vec4<f32>(data[med.x], data[med.y], data[med.z], data[med.w]));
-    }
-}
-
 // noise::median_px.
 fn fxn_median_px(o: vec4<f32>, m: vec4<f32>, on_alpha: bool) -> vec4<f32> {
     if (on_alpha) {
@@ -470,12 +407,14 @@ fn fxn_echo(@builtin(global_invocation_id) gid: vec3<u32>) {
         case 3u: {
             acc = acc + q - acc * q;
         }
+        // Composite In Back: each echo over what is there (time_fx.rs echo).
         case 4u: {
-            acc += q * (1.0 - acc.w);
-        }
-        case 5u: {
             acc = q + acc * (1.0 - q.w);
         }
+        // Composite In Front: each echo behind what is there.
+        case 5u: {
+            acc += q * (1.0 - acc.w);
+        }
         default: {
             acc += q;
         }
@@ -483,7 +422,7 @@ fn fxn_echo(@builtin(global_invocation_id) gid: vec3<u32>) {
     textureStore(out, p, acc);
 }
 
-// Echo's finish. u[0].x = operator; f[0].x = number of frames.
+// Echo's finish. u[0].x = operator. Blend sums like Add (time_fx.rs echo), so nothing divides.
 @compute @workgroup_size(16, 16)
 fn fxn_echo_fin(@builtin(global_invocation_id) gid: vec3<u32>) {
     let p = fxn_pixel(gid);
@@ -492,9 +431,6 @@ fn fxn_echo_fin(@builtin(global_invocation_id) gid: vec3<u32>) {
     }
     let op = P.u[0].x;
     var acc = textureLoad(src, p, 0);
-    if (op == 6u) {
-        acc = acc / P.f[0].x;
-    }
     if (op == 2u && acc.x == FXN_MAX) {
         acc = vec4<f32>(0.0);
     }
@@ -538,7 +474,7 @@ fn fxn_typed_noise(x: f32, y: f32, z: f32, seed: u32, nt: u32) -> f32 {
     let z0 = floor(z);
     let tx = x - x0;
     let ty = y - y0;
-    let fz = fade(z - z0);
+    let fz = z - z0;
     let a = fxn_slice(i32(x0), i32(y0), i32(z0), tx, ty, seed, nt);
     let b = fxn_slice(i32(x0), i32(y0), i32(z0) + 1, tx, ty, seed, nt);
     return a + (b - a) * fz;
diff --git a/crates/gpu/src/shaders/fx_pixel2.wgsl b/crates/gpu/src/shaders/fx_pixel2.wgsl
index a63a91fed..2944f03b2 100644
--- a/crates/gpu/src/shaders/fx_pixel2.wgsl
+++ b/crates/gpu/src/shaders/fx_pixel2.wgsl
@@ -336,17 +336,21 @@ fn fp2_point(@builtin(global_invocation_id) gid: vec3<u32>) {
                 o = vec4<f32>(r * px.w, px.w);
             }
         }
-        // f[0].x = knee.
+        // utility::hdr_compress_pixel; f[0].x = blend t (Amount / 100).
         case 2u: {
             if (px.w > 0.0) {
                 let c = px.xyz / px.w;
-                let m = max(max(c.x, c.y), c.z);
-                let knee = P.f[0].x;
-                if (m > knee) {
-                    let w = 1.0 - knee;
-                    let k = (knee + w * (m - knee) / ((m - knee) + w)) / m;
-                    o = vec4<f32>(c * k * px.w, px.w);
-                }
+                let t = P.f[0].x;
+                let y = max(0.30 * c.x + 0.59 * c.y + 0.11 * c.z, 0.0);
+                let comp = min(c * (1.0 / (1.0 + y)), vec3<f32>(1.0));
+                let g = 0.4;
+                let mixed = vec3<f32>(
+                    (1.0 - t) * fp2_spow(c.x, g) + t * fp2_spow(comp.x, g),
+                    (1.0 - t) * fp2_spow(c.y, g) + t * fp2_spow(comp.y, g),
+                    (1.0 - t) * fp2_spow(c.z, g) + t * fp2_spow(comp.z, g),
+                );
+                let r = vec3<f32>(fp2_spow(mixed.x, 1.0 / g), fp2_spow(mixed.y, 1.0 / g), fp2_spow(mixed.z, 1.0 / g));
+                o = vec4<f32>(r * px.w, px.w);
             }
         }
         // u[0].y = channel; f[0] = highlight colour.
@@ -633,50 +637,9 @@ fn fp2_hextile(@builtin(global_invocation_id) gid: vec3<u32>) {
     if (!fp2_inside(p)) {
         return;
     }
-    let cx = P.f[0].x;
-    let cy = P.f[0].y;
-    let r = P.f[0].z;
-    let smear = P.f[0].w;
-    let sn = P.f[1].x;
-    let cs = P.f[1].y;
-    let mode = P.u[0].x;
-    let dx = f32(p.x) + 0.5 - cx;
-    let dy = f32(p.y) + 0.5 - cy;
-    let u = dx * cs + dy * sn;
-    let v = -dx * sn + dy * cs;
-    // stylize3::hex_cell (cube rounding).
-    let q = (0.5773502691896257 * u - v / 3.0) / r;
-    let rr = (2.0 / 3.0 * v) / r;
-    let ccy = -q - rr;
-    var rx = round_away(q);
-    let ry = round_away(ccy);
-    var rz = round_away(rr);
-    let ddx = abs(rx - q);
-    let ddy = abs(ry - ccy);
-    let ddz = abs(rz - rr);
-    if (ddx > ddy && ddx > ddz) {
-        rx = -ry - rz;
-    } else if (ddy <= ddz) {
-        rz = -rx - ry;
-    }
-    let hx = r * 1.7320508075688772 * (rx + rz / 2.0);
-    let hy = r * 1.5 * rz;
-    var lu = u - hx;
-    var lv = v - hy;
-    let odd = imod(i32(rx) + i32(rz), 2) == 1;
-    if ((mode == 1u || mode == 2u) && odd) {
-        lu = -lu;
-    }
-    if (mode == 2u && odd) {
-        lv = -lv;
-    }
-    let ox = lu * cs - lv * sn;
-    let oy = lu * sn + lv * cs;
-    let tx = cx + ox;
-    let ty = cy + oy;
-    let sx = tx + (f32(p.x) + 0.5 - tx) * smear;
-    let sy = ty + (f32(p.y) + 0.5 - ty) * smear;
-    textureStore(out, p, sample_bilinear_clamped(src, sx, sy));
+    // Cell membership and reflection were decided in the CPU effect's f64 geometry.
+    let i = (gid.y * u32(out_dims().x) + gid.x) * 2u;
+    textureStore(out, p, sample_bilinear_clamped(src, data[i], data[i + 1u]));
 }
 
 // ---------------------------------------------------------------- CC Mr. Smoothie (stylize3::smoothie)
diff --git a/crates/gpu/src/shaders/fx_sim.wgsl b/crates/gpu/src/shaders/fx_sim.wgsl
index d936861d3..7deeac048 100644
--- a/crates/gpu/src/shaders/fx_sim.wgsl
+++ b/crates/gpu/src/shaders/fx_sim.wgsl
@@ -114,8 +114,8 @@ fn fxm_sprite(at: u32, x: f32, y: f32) -> FxmShade {
             cov = min(0.12 * select(0.0, 1.0, d <= 1.0) + ring * 0.8 + hl, 1.0);
         }
         case 5u: {
-            let sn = sin(data[at + 8u]);
-            let cs = cos(data[at + 8u]);
+            let sn = sin_p(data[at + 8u]);
+            let cs = cos_p(data[at + 8u]);
             let ux = (dx * cs + dy * sn) / r;
             let uy = (-dx * sn + dy * cs) / r;
             let d = sqrt(ux * ux + uy * uy);
@@ -125,23 +125,23 @@ fn fxm_sprite(at: u32, x: f32, y: f32) -> FxmShade {
             cov = min(core + stx + sty, 1.0);
         }
         case 6u: {
-            let sn = sin(data[at + 8u]);
-            let cs = cos(data[at + 8u]);
+            let sn = sin_p(data[at + 8u]);
+            let cs = cos_p(data[at + 8u]);
             let ux = dx * cs + dy * sn;
             let uy = -dx * sn + dy * cs;
             let e = r * 0.75;
             cov = fxm_aa(e - abs(ux)) * fxm_aa(e - abs(uy));
         }
         case 7u: {
-            let sn = sin(data[at + 8u]);
-            let cs = cos(data[at + 8u]);
+            let sn = sin_p(data[at + 8u]);
+            let cs = cos_p(data[at + 8u]);
             let ux = dx * cs + dy * sn;
             let uy = -dx * sn + dy * cs;
             let e = r * 0.5;
             var m = 3.4e38;
             for (var k = 0; k < 3; k++) {
                 let a = 1.5707964 + f32(k) * 6.2831855 / 3.0;
-                m = min(m, e - (ux * cos(a) + uy * sin(a)));
+                m = min(m, e - (ux * cos_p(a) + uy * sin_p(a)));
             }
             cov = fxm_aa(m);
         }
@@ -165,7 +165,8 @@ fn fxm_sprite(at: u32, x: f32, y: f32) -> FxmShade {
     return FxmShade(true, vec4<f32>(rgb * a, a));
 }
 
-// CC Bubbles' bubble (sim::bubbles). u[1].y = metal, u[1].z = shading type.
+// CC Bubbles' bubble (sim::bubbles). u[1].y = metal, u[1].z = shading type, f[0] = the layer
+// rectangle's first and last pixel centres (x0, y0, x1, y1), which refraction samples stay within.
 fn fxm_bubble(at: u32, x: f32, y: f32) -> FxmShade {
     let qx = data[at + 1u];
     let qy = data[at + 2u];
@@ -180,7 +181,9 @@ fn fxm_bubble(at: u32, x: f32, y: f32) -> FxmShade {
     }
     let k = select(-0.7, 1.6, P.u[1].y != 0u);
     let nz = sqrt(max(1.0 - d2, 0.0));
-    let s = fxm_unpremul(sample_bilinear(src, data[at + 4u] + dx * qr * k, data[at + 5u] + dy * qr * k));
+    let sx = min(max(data[at + 4u] + dx * qr * k, P.f[0].x), P.f[0].z);
+    let sy = min(max(data[at + 5u] + dy * qr * k, P.f[0].y), P.f[0].w);
+    let s = fxm_unpremul(sample_bilinear_clamped(src, sx, sy));
     var c = s.xyz;
     if (s.w <= 0.0) {
         c = vec3<f32>(0.6, 0.7, 0.8);
@@ -428,8 +431,8 @@ fn fxm_ripples(x: f32, y: f32) -> f32 {
         let r = data[i * 4u + 2u];
         let u = (d - r) / P.f[0].y;
         if (abs(u) < 1.0) {
-            let env = 0.5 + 0.5 * cos(u * 3.1415927);
-            v += data[i * 4u + 3u] * env * cos((d - r) / P.f[0].x * 6.2831855);
+            let env = 0.5 + 0.5 * cos_p(u * 3.1415927);
+            v += data[i * 4u + 3u] * env * cos_p((d - r) / P.f[0].x * 6.2831855);
         }
     }
     return v;
diff --git a/crates/gpu/src/shaders/fx_stylize.wgsl b/crates/gpu/src/shaders/fx_stylize.wgsl
index 3db442750..c9eb9a50e 100644
--- a/crates/gpu/src/shaders/fx_stylize.wgsl
+++ b/crates/gpu/src/shaders/fx_stylize.wgsl
@@ -42,7 +42,11 @@ fn fxs_qdiv(x: vec3<f32>, a: f32) -> vec3<f32> {
     let r = fma(-q, vec3<f32>(a), x);
     // `q + r / a`, written as an fma so drivers (NVIDIA Vulkan) can't contract it another way
     // and round differently from the CPU.
-    return fma(r / a, vec3<f32>(1.0), q);
+    let corrected = fma(r / a, vec3<f32>(1.0), q);
+    return vec3<f32>(
+        select(corrected.x, unit_div(x.x, a), x.x >= 0.0 && x.x <= a),
+        select(corrected.y, unit_div(x.y, a), x.y >= 0.0 && x.y <= a),
+        select(corrected.z, unit_div(x.z, a), x.z >= 0.0 && x.z <= a));
 }
 
 fn fxs_rem2(i: i32) -> i32 {
@@ -63,6 +67,32 @@ fn fxs_bin(v: f32, t: f32, inv: bool) -> f32 {
     return select(0.0, 1.0, (v >= t) != inv);
 }
 
+// Preserve the CPU's separately-rounded f32 multiply before rounding to a bin.
+// A shader compiler may reassociate division and multiplication across a half
+// threshold. The 24-bit mantissa times at most 254 fits in u32 exactly.
+fn fxs_posterize_bin(v: f32, levels: u32) -> f32 {
+    let bits = bitcast<u32>(clamp(v, 0.0, 1.0));
+    let exponent = (bits >> 23u) & 255u;
+    if (exponent == 0u) { return 0.0; }
+    var product = ((bits & 0x7fffffu) | 0x800000u) * levels;
+    let high = firstLeadingBit(product);
+    if (high > 23u) {
+        let lost = high - 23u;
+        let mask = (1u << lost) - 1u;
+        let remainder = product & mask;
+        let half = 1u << (lost - 1u);
+        var kept = product >> lost;
+        if (remainder > half || (remainder == half && (kept & 1u) != 0u)) { kept += 1u; }
+        product = kept << lost;
+    }
+    let shift = 150u - exponent;
+    if (shift > 32u) { return 0.0; }
+    if (shift == 32u) { return select(0.0, 1.0, product >= 0x80000000u); }
+    let mask = (1u << shift) - 1u;
+    let integer = (product >> shift) + select(0u, 1u, (product & mask) >= (1u << (shift - 1u)));
+    return f32(integer);
+}
+
 fn fxs_strobe_op(op: u32, v: f32, k: f32) -> f32 {
     switch op {
         case 1u: { return v + k; }
@@ -96,8 +126,10 @@ fn fxs_point(@builtin(global_invocation_id) gid: vec3<u32>) {
     switch mode {
         case 1u: {
             let lv = P.f[0].x;
-            let c = clamp(fxs_qdiv(px.xyz, a), vec3<f32>(0.0), vec3<f32>(1.0)) * lv;
-            let o = vec3<f32>(round_away(c.x), round_away(c.y), round_away(c.z)) / lv;
+            let c = vec3<f32>(unit_div(px.x, a), unit_div(px.y, a), unit_div(px.z, a));
+            // (`unit_div`: a native division by the levels is off by an ulp on real GPUs)
+            let bins = vec3<f32>(fxs_posterize_bin(c.x, u32(lv)), fxs_posterize_bin(c.y, u32(lv)), fxs_posterize_bin(c.z, u32(lv)));
+            let o = vec3<f32>(unit_div(bins.x, lv), unit_div(bins.y, lv), unit_div(bins.z, lv));
             textureStore(out, p, vec4<f32>(o * a, a));
         }
         case 2u: {
@@ -611,7 +643,9 @@ fn fxs_motiontile(@builtin(global_invocation_id) gid: vec3<u32>) {
             fy = 1.0 - fy;
         }
     }
-    textureStore(out, p, sample_bilinear(src, fx * P.f[0].y + P.f[1].x, fy * P.f[0].z + P.f[1].y));
+    // Clamped for the same reason as the CPU path: a fold on a pixel centre samples the
+    // source's geometric edge, where the plain sampler mixes in the transparent outside.
+    textureStore(out, p, sample_bilinear_clamped(src, fx * P.f[0].y + P.f[1].x, fy * P.f[0].z + P.f[1].y));
 }
 
 // CC RepeTile (stylize2::repetile) into a new output size. data: per output column (tile index,
@@ -922,18 +956,28 @@ fn fxs_glow_map(@builtin(global_invocation_id) gid: vec3<u32>) {
     let k = clamp((l - thr) / max(1.0 - thr, 1e-3), 0.0, 1.0);
     let t = glow_ab_t(l);
     let c = vec3<f32>(curve_eval(P.f[1].x, t), curve_eval(P.f[1].y, t), curve_eval(P.f[1].z, t));
-    textureStore(out, p, vec4<f32>(c * k * a, k * a));
+    // Based on the colour channels the glow covers the layer's whole alpha (effects::misc::glow).
+    var ga = a;
+    if (P.u[0].y != 0u) {
+        ga = k * a;
+    }
+    textureStore(out, p, vec4<f32>(c * k * a, ga));
 }
 
 // On Top with another Glow Operation: blend_pixel(mode, original, glow · intensity, 0).
-// aux = the blurred glow; u[0].x = blend mode id; f[0].x = intensity
+// aux = the blurred glow; u[0].x = blend mode id; u[0].y = based on alpha (intensity also
+// scales the glow's alpha); f[0].x = intensity
 @compute @workgroup_size(16, 16)
 fn fxs_glow_op(@builtin(global_invocation_id) gid: vec3<u32>) {
     let p = vec2<i32>(gid.xy);
     if (!fxs_inside(p)) {
         return;
     }
-    let g = textureLoad(aux, p, 0) * P.f[0].x;
+    let gs = textureLoad(aux, p, 0);
+    var g = vec4<f32>(gs.xyz * P.f[0].x, gs.w);
+    if (P.u[0].y != 0u) {
+        g.w = gs.w * P.f[0].x;
+    }
     var o = blend_pixel(P.u[0].x, textureLoad(src, p, 0), g, 0.0);
     o.w = clamp(o.w, 0.0, 1.0);
     textureStore(out, p, o);
diff --git a/crates/gpu/src/shaders/fx_tone.wgsl b/crates/gpu/src/shaders/fx_tone.wgsl
index 39db34588..bb206adbd 100644
--- a/crates/gpu/src/shaders/fx_tone.wgsl
+++ b/crates/gpu/src/shaders/fx_tone.wgsl
@@ -20,6 +20,14 @@ fn fxt_rem360(x: f32) -> f32 {
 }
 
 // Levels (Individual Controls) channel `i` (data: 5 × (ib, iw, g, ob, ow, identity)).
+// color_fx::levels_gamma: unclipped values below 0 mirror the curve.
+fn fxt_gamma(t: f32, g: f32) -> f32 {
+    if (t >= 0.0) {
+        return powz(t, 1.0 / g);
+    }
+    return -powz(-t, 1.0 / g);
+}
+
 fn fxt_lv(i: u32, v: f32, clip_b: bool, clip_w: bool) -> f32 {
     let o = i * 6u;
     if (data[o + 5u] != 0.0) {
@@ -32,7 +40,7 @@ fn fxt_lv(i: u32, v: f32, clip_b: bool, clip_w: bool) -> f32 {
     if (clip_w) {
         t = min(t, 1.0);
     }
-    return data[o + 3u] + (data[o + 4u] - data[o + 3u]) * powz(max(t, 0.0), 1.0 / max(data[o + 2u], 0.01));
+    return data[o + 3u] + (data[o + 4u] - data[o + 3u]) * fxt_gamma(t, max(data[o + 2u], 0.01));
 }
 
 // color_fx::level (data offset o: ib, iw, g, ob, ow, clip black, clip white).
@@ -44,8 +52,7 @@ fn fxt_level(o: u32, v: f32) -> f32 {
     if (data[o + 6u] != 0.0) {
         t = min(t, 1.0);
     }
-    t = powz(max(t, 0.0), 1.0 / data[o + 2u]);
-    return data[o + 3u] + (data[o + 4u] - data[o + 3u]) * t;
+    return data[o + 3u] + (data[o + 4u] - data[o + 3u]) * fxt_gamma(t, data[o + 2u]);
 }
 
 fn fxt_level_ident(o: u32) -> bool {
@@ -122,16 +129,17 @@ fn fxt_knee(v: f32, start: f32, limit: f32) -> f32 {
     return start + r * (1.0 - exp(-(v - start) / r));
 }
 
-// PS Arbitrary Map lookup (map in data, n entries; f[0].x = phase offset in entries).
+// PS Arbitrary Map: CPU-rounded interval starts, values and slopes in data.
 fn fxt_lookup(v: f32, n: u32) -> f32 {
-    let nf = f32(n);
-    var x = clamp(v, 0.0, 1.0) * (nf - 1.0) + P.f[0].x;
-    x = x - nf * floor(x / nf);
-    let fl = floor(x);
-    let i0 = u32(fl) % n;
-    let i1 = select(i0, i0 + 1u, i0 + 1u < n);
-    let t = x - fl;
-    return data[i0] + (data[i1] - data[i0]) * t;
+    let x = clamp(v, 0.0, 1.0);
+    var lo = 0u;
+    var hi = n;
+    while (lo + 1u < hi) {
+        let mid = lo + (hi - lo) / 2u;
+        if (x < data[mid * 3u]) { hi = mid; } else { lo = mid; }
+    }
+    let i = lo * 3u;
+    return data[i + 1u] + (x - data[i]) * data[i + 2u];
 }
 
 fn fxt_eq_look(table: u32, n: u32, v: f32) -> f32 {
@@ -177,7 +185,7 @@ fn fxt_point(@builtin(global_invocation_id) gid: vec3<u32>) {
                 let aa = max(a, 0.0);
                 var nc: vec3<f32>;
                 for (var i = 0u; i < 3u; i++) {
-                    nc[i] = fxt_lv(i + 1u, fxt_lv(0u, c[i], cb, cw), cb, cw);
+                    nc[i] = fxt_lv(0u, fxt_lv(i + 1u, c[i], cb, cw), cb, cw);
                 }
                 let na = clamp(clamp(fxt_lv(4u, aa, cb, cw), 0.0, 1.0), 0.0, 1.0);
                 o = vec4<f32>(nc * na, na);
@@ -440,7 +448,11 @@ fn fxt_point(@builtin(global_invocation_id) gid: vec3<u32>) {
         case 12u: {
             let n = u0.z;
             let aa = max(a, 0.0);
-            let r = vec3<f32>(fxt_lookup(c.x, n), fxt_lookup(c.y, n), fxt_lookup(c.z, n));
+            var straight = vec3<f32>(0.0);
+            if (a > 1e-6) {
+                straight = vec3<f32>(unit_div(px.x, a), unit_div(px.y, a), unit_div(px.z, a));
+            }
+            let r = vec3<f32>(fxt_lookup(straight.x, n), fxt_lookup(straight.y, n), fxt_lookup(straight.z, n));
             var na = aa;
             if (u0.y != 0u) {
                 na = fxt_lookup(aa, n);
diff --git a/crates/gpu/src/shaders/fx_transition.wgsl b/crates/gpu/src/shaders/fx_transition.wgsl
index 379b64469..0e9553d58 100644
--- a/crates/gpu/src/shaders/fx_transition.wgsl
+++ b/crates/gpu/src/shaders/fx_transition.wgsl
@@ -224,28 +224,8 @@ fn ftr_grid(@builtin(global_invocation_id) gid: vec3<u32>) {
         return;
     }
     let px = textureLoad(src, p, 0);
-    let d = ftr_centre(p) - P.f[0].xy;
-    let s = P.f[0].z;
-    let co = P.f[0].w;
-    let q = vec2<f32>(d.x * co + d.y * s, -d.x * s + d.y * co);
-    let cs = P.f[1].x;
-    let cc = (floor(q / cs) + 0.5) * cs;
-    var o = clamp(ftr_metric(P.u[0].x, cc) / P.f[1].y, 0.0, 1.0);
-    if (P.u[0].y != 0u) {
-        o = 1.0 - o;
-    }
-    let spread = 0.25;
-    let pr = clamp((P.f[1].z * (1.0 + spread) - o) / spread, 0.0, 1.0);
-    if (pr <= 0.0) {
-        textureStore(out, p, px);
-        return;
-    }
-    let half = cs * 0.5 * (1.0 - pr);
-    let m = max(abs(q.x - cc.x), abs(q.y - cc.y));
-    var k = select(0.0, 1.0, m < half);
-    if (P.f[1].w > 0.0) {
-        k = clamp((half - m) / P.f[1].w + 0.5, 0.0, 1.0);
-    }
+    // CPU-generated coverage preserves exact f64 tile and hard-edge decisions.
+    let k = data[gid.y * u32(out_dims().x) + gid.x];
     textureStore(out, p, px * k);
 }
 
@@ -569,9 +549,11 @@ fn ftr_bender(@builtin(global_invocation_id) gid: vec3<u32>) {
 }
 
 // ---------------------------------------------------------------- CC Blobbylize (distort3::cc_blobbylize)
-// aux = the blurred blob plane (x). f[0] = (depth, cut away, intensity, ambient);
-// f[1] = (diffuse, specular, shininess, metal); f[2] = (light x, y, point light height,
-// point light); f[3] = distant light direction; f[4] = light colour.
+// aux = the Softness-blurred blob plane (x). f[0] = (cut away, intensity, ambient,
+// matte slope); f[1] = (diffuse, specular, shininess, metal); f[2] = (light x, y,
+// point light height, point); f[3] = distant light direction; f[4] = light colour;
+// f[5] = (matte depth, RGB depth, light slope, matte antialias width);
+// f[6].x = displacement clamp.
 
 @compute @workgroup_size(16, 16)
 fn ftr_blob(@builtin(global_invocation_id) gid: vec3<u32>) {
@@ -579,32 +561,55 @@ fn ftr_blob(@builtin(global_invocation_id) gid: vec3<u32>) {
     if (!ftr_inside(p)) {
         return;
     }
-    let depth = P.f[0].x;
-    let cut = P.f[0].y;
+    let cut = P.f[0].x;
+    if (cut >= 1.0) {
+        // Endpoint guard: an opaque source can reach h = 1.0, where the gradient antialias
+        // would otherwise leave a half-covered pixel at Cut Away 100.
+        textureStore(out, p, vec4<f32>(0.0));
+        return;
+    }
     let hv = textureLoad(aux, p, 0).x;
     let g = ftr_grad(p);
+    let grad = length(g);
+    var m = 0.0;
+    if (grad > 1e-9) {
+        let aa = max(P.f[5].w * grad, 5e-4);
+        m = clamp(0.5 + (hv - cut) / aa, 0.0, 1.0);
+    } else if (hv > cut) {
+        m = 1.0;
+    }
+    if (m <= 0.0) {
+        textureStore(out, p, vec4<f32>(0.0));
+        return;
+    }
     let f = ftr_centre(p);
-    let s = sample_bilinear(src, f.x - g.x * depth * 2.0, f.y - g.y * depth * 2.0);
-    let c = ftr_unpremul(s);
-    let a = max(s.w, 0.0);
-    let m = clamp((hv - cut) / max((1.0 - cut) * 0.5, 1e-3), 0.0, 1.0);
-    let alpha = max(a, s.w) * m;
+    // Softness-scaled bevel warp of the source matte (normal z = 1).
+    let na = normalize(vec3<f32>(-g.x * P.f[0].w, -g.y * P.f[0].w, 1.0));
+    let sa = sample_bilinear(src, f.x + na.x * P.f[5].x, f.y + na.y * P.f[5].x);
+    let alpha = max(sa.w, 0.0) * m;
     if (alpha <= 0.0) {
         textureStore(out, p, vec4<f32>(0.0));
         return;
     }
-    let n = normalize(vec3<f32>(-g.x * depth, -g.y * depth, 1.0));
+    // Height-field refraction of the colour (normal z = height), independent of Softness.
+    let hz = max(hv, 1e-3);
+    let d = -g * P.f[5].y / hz;
+    let lim = P.f[6].x;
+    let disp = vec2<f32>(clamp(d.x, -lim, lim), clamp(d.y, -lim, lim));
+    let srgb = sample_bilinear(src, f.x + disp.x, f.y + disp.y);
+    let c = ftr_unpremul(srgb);
+    let n = normalize(vec3<f32>(-g.x * P.f[5].z, -g.y * P.f[5].z, 1.0));
     var l = P.f[3].xyz;
     if (P.f[2].w != 0.0) {
-        l = normalize(vec3<f32>(P.f[2].x - f32(p.x), P.f[2].y - f32(p.y), P.f[2].z));
+        l = normalize(vec3<f32>(P.f[2].x - f.x, P.f[2].y - f.y, P.f[2].z));
     }
-    let intensity = P.f[0].z;
+    let intensity = P.f[0].y;
     let ndl = max(dot(n, l), 0.0);
     let h3 = normalize(vec3<f32>(l.x, l.y, l.z + 1.0));
     let sp = powz(max(dot(n, h3), 0.0), P.f[1].z) * P.f[1].y;
     let lc = P.f[4].xyz;
     let metal = P.f[1].w;
-    let lit = (P.f[0].w + P.f[1].x * ndl * intensity) * lc;
+    let lit = (P.f[0].z + P.f[1].x * ndl * intensity) * lc;
     let spec_col = (1.0 - metal) * lc + metal * c * lc;
     let o = c * lit + (sp * intensity) * spec_col;
     textureStore(out, p, vec4<f32>(o * alpha, alpha));
diff --git a/crates/gpu/src/shaders/fx_vr.wgsl b/crates/gpu/src/shaders/fx_vr.wgsl
index a2bb364c8..9e2d4390e 100644
--- a/crates/gpu/src/shaders/fx_vr.wgsl
+++ b/crates/gpu/src/shaders/fx_vr.wgsl
@@ -16,7 +16,7 @@ fn fxv_unpremul(p: vec4<f32>) -> vec4<f32> {
 fn fxv_equi_dir(x: f32, y: f32, w: f32, h: f32) -> vec3<f32> {
     let lon = (x / w - 0.5) * 2.0 * FXV_PI;
     let lat = (0.5 - y / h) * FXV_PI;
-    return vec3<f32>(cos(lat) * sin(lon), sin(lat), cos(lat) * cos(lon));
+    return vec3<f32>(cos_p(lat) * sin_p(lon), sin_p(lat), cos_p(lat) * cos_p(lon));
 }
 
 // vr::equi_px.
@@ -168,7 +168,7 @@ fn fxv_dir(kind: u32, fov: f32, x: f32, y: f32, w: f32, h: f32) -> vec4<f32> {
             cu = u / r;
             cv = v / r;
         }
-        return vec4<f32>(sin(th) * cu, cos(th), sin(th) * cv, 1.0);
+        return vec4<f32>(sin_p(th) * cu, cos_p(th), sin_p(th) * cv, 1.0);
     }
     if (kind == 4u) {
         let half = radians(clamp(fov, 1.0, 360.0) / 2.0);
@@ -186,7 +186,7 @@ fn fxv_dir(kind: u32, fov: f32, x: f32, y: f32, w: f32, h: f32) -> vec4<f32> {
             cu = u / r;
             cv = v / r;
         }
-        return vec4<f32>(sin(th) * cu, sin(th) * cv, cos(th), 1.0);
+        return vec4<f32>(sin_p(th) * cu, sin_p(th) * cv, cos_p(th), 1.0);
     }
     let t = tan(radians(clamp(fov, 1.0, 179.0) / 2.0));
     let u = (x / w * 2.0 - 1.0) * t;
@@ -519,8 +519,8 @@ fn fxv_gen(@builtin(global_invocation_id) gid: vec3<u32>) {
                 var s = px;
                 if (al >= 1e-9) {
                     let new_th = th * (1.0 - P.f[0][c] * weight);
-                    let perp = normalize(d - center * cos(th));
-                    let nd = center * cos(new_th) + perp * sin(new_th);
+                    let perp = normalize(d - center * cos_p(th));
+                    let nd = center * cos_p(new_th) + perp * sin_p(new_th);
                     let q = fxv_equi_px(nd, w, h);
                     s = fxv_sample_equi(q.x, q.y);
                 }
diff --git a/crates/gpu/src/shaders/inpaint.wgsl b/crates/gpu/src/shaders/inpaint.wgsl
new file mode 100644
index 000000000..56c468f85
--- /dev/null
+++ b/crates/gpu/src/shaders/inpaint.wgsl
@@ -0,0 +1,796 @@
+// GPU Content-Aware Fill: the membrane (harmonic) fill and PatchMatch synthesis of
+// effectcraft_raster::inpaint, operation for operation (the CPU reference is the oracle; see
+// crates/gpu/src/tests/inpaint.rs).
+//
+// Bindings are the shared ones (common.wgsl): `src` / `aux` are the input textures (an image, a
+// coarser level, or the nearest-neighbour field), `out` is the storage texture and `data` is a
+// per-pixel float table — the level's flags:
+//   * membrane kernels: data[i] = 1 where the pixel is known (the hole's complement);
+//   * PatchMatch kernels: data[i] = bit 0 hole, bit 1 near (a pixel whose patch touches the hole).
+//
+// Parameter block (P.u = u32, P.f = f32):
+//   membrane kernels:  u[0] = (w, h, coarseW, coarseH), u[1] = (x0, y0, 0, 0) (dispatch
+//                      origin), u[3].x = this level's offset into `data`
+//   down kernels:      u[0] = (srcW, srcH, dstW, dstH)
+//   PatchMatch kernels: u[0] = (w, h, r, parity), u[1] = (x0, y0, 0, 0) (dispatch origin),
+//                       u[2] = (seed, iteration, 0, EM round), f[0] = (sigma², 0, 0, 0)
+//   histogram:          u[0] = (w, h, 0, 0), u[1] = (x0, y0, w, h) (target bounds),
+//                       f[0].x = the distance range (0: the SDR range 0…4)
+// The nearest-neighbour field texture holds one entry per pixel: r, g = source centre ("px"),
+// b = SSD distance (inf where unset), a = 1 where the entry is set.
+
+const IMP_INF: f32 = 1e30;
+
+fn imp_flags(i: i32) -> u32 {
+    return u32(max(data[i], 0.0));
+}
+
+fn imp_hole(i: i32) -> bool {
+    return (imp_flags(i) & 1u) != 0u;
+}
+
+fn imp_near(i: i32) -> bool {
+    return (imp_flags(i) & 2u) != 0u;
+}
+
+// A source centre whose patch is fully known and inside the image (Pm::valid_source).
+fn imp_valid_source(x: i32, y: i32, w: i32, h: i32, r: i32) -> bool {
+    if (x < r || y < r || x + r >= w || y + r >= h) {
+        return false;
+    }
+    return !imp_near(y * w + x);
+}
+
+// PatchMatch's hashing rnd (raster::inpaint::rnd), bit for bit: the CPU's random stream is a
+// contract of the algorithm, not an implementation detail.
+fn imp_rnd(seed: u32, a: u32, b: u32) -> u32 {
+    var h = (seed * 0x9E3779B9u) ^ (a * 0x85EBCA6Bu) ^ (b * 0xC2B2AE35u);
+    h = h ^ (h >> 16u);
+    h = h * 0x7FEB352Du;
+    h = h ^ (h >> 15u);
+    h = h * 0x846CA68Bu;
+    return h ^ (h >> 16u);
+}
+
+// SSD of the patch at target (tx, ty) (clipped to the image) against source (sx, sy)
+// (Pm::dist). `cap` short-circuits a match that is already worse.
+fn imp_dist(tx: i32, ty: i32, sx: i32, sy: i32, w: i32, h: i32, r: i32, cap: f32) -> f32 {
+    var d = 0.0;
+    var n = 0.0;
+    for (var dy = -r; dy <= r; dy = dy + 1) {
+        let ty2 = ty + dy;
+        if (ty2 < 0 || ty2 >= h) {
+            continue;
+        }
+        let sy2 = sy + dy;
+        for (var dx = -r; dx <= r; dx = dx + 1) {
+            let tx2 = tx + dx;
+            if (tx2 < 0 || tx2 >= w) {
+                continue;
+            }
+            let a = textureLoad(aux, vec2<i32>(tx2, ty2), 0);
+            let b = textureLoad(aux, vec2<i32>(sx + dx, sy2), 0);
+            let e = a - b;
+            d = d + e.x * e.x + e.y * e.y + e.z * e.z + e.w * e.w;
+            n = n + 1.0;
+        }
+        if (d > cap * max(n, 1.0)) {
+            return IMP_INF;
+        }
+    }
+    return d / max(n, 1.0);
+}
+
+// ---------------------------------------------------------------- membrane
+
+// membrane_core's coarse level: the known-weighted 2×2 average.
+@compute @workgroup_size(16, 16)
+fn imp_down(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let cw = i32(P.u[0].z);
+    let ch = i32(P.u[0].w);
+    let cx = i32(gid.x);
+    let cy = i32(gid.y);
+    if (cx >= cw || cy >= ch) {
+        return;
+    }
+    var s = vec4<f32>(0.0);
+    var n = 0.0;
+    for (var dy = 0; dy < 2; dy = dy + 1) {
+        for (var dx = 0; dx < 2; dx = dx + 1) {
+            let fx = 2 * cx + dx;
+            let fy = 2 * cy + dy;
+            if (fx < w && fy < h && data[i32(P.u[3].x) + fy * w + fx] > 0.5) {
+                s = s + textureLoad(src, vec2<i32>(fx, fy), 0);
+                n = n + 1.0;
+            }
+        }
+    }
+    var v = vec4<f32>(0.0);
+    if (n > 0.0) {
+        v = s / n;
+    }
+    textureStore(out, vec2<i32>(cx, cy), v);
+}
+
+// membrane_core's coarse-to-fine step: unknown pixels take the nearest coarse value. The fine
+// image is copied into `out` first, so writing only the unknown pixels keeps the known ones.
+// Dispatched over the unknown pixels' bounds (`P.u[1]`); the coarse level is valid everywhere.
+@compute @workgroup_size(16, 16)
+fn imp_up(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let cw = i32(P.u[0].z);
+    let ch = i32(P.u[0].w);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h || data[i32(P.u[3].x) + y * w + x] > 0.5) {
+        return;
+    }
+    let cx = min(x / 2, cw - 1);
+    let cy = min(y / 2, ch - 1);
+    textureStore(out, vec2<i32>(x, y), textureLoad(src, vec2<i32>(cx, cy), 0));
+}
+
+// One relaxation of the unknown pixels (membrane_core's Jacobi sweep). `src` is the current
+// state and `aux` is unused. Dispatched over the unknown pixels' bounds (`P.u[1]`): known
+// pixels never move, so nothing outside them needs writing. Both `src` and `out` are valid
+// across the image (the fine level's, a copy of it, or the full downsample).
+@compute @workgroup_size(16, 16)
+fn imp_jacobi(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    var v = textureLoad(src, vec2<i32>(x, y), 0);
+    if (data[i32(P.u[3].x) + y * w + x] <= 0.5) {
+        var s = vec4<f32>(0.0);
+        var n = 0.0;
+        if (x > 0) {
+            s = s + textureLoad(src, vec2<i32>(x - 1, y), 0);
+            n = n + 1.0;
+        }
+        if (x + 1 < w) {
+            s = s + textureLoad(src, vec2<i32>(x + 1, y), 0);
+            n = n + 1.0;
+        }
+        if (y > 0) {
+            s = s + textureLoad(src, vec2<i32>(x, y - 1), 0);
+            n = n + 1.0;
+        }
+        if (y + 1 < h) {
+            s = s + textureLoad(src, vec2<i32>(x, y + 1), 0);
+            n = n + 1.0;
+        }
+        if (n > 0.0) {
+            v = s / n;
+        }
+    }
+    textureStore(out, vec2<i32>(x, y), v);
+}
+
+// ---------------------------------------------------------------- PatchMatch
+
+// PatchMatch's pyramid downsample (downsample): the level's image, hole pixels excluded from the
+// average, over `out`'s size.
+@compute @workgroup_size(16, 16)
+fn imp_pm_down(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let cw = i32(P.u[0].z);
+    let ch = i32(P.u[0].w);
+    let cx = i32(gid.x);
+    let cy = i32(gid.y);
+    if (cx >= cw || cy >= ch) {
+        return;
+    }
+    var s = vec4<f32>(0.0);
+    var n = 0.0;
+    for (var dy = 0; dy < 2; dy = dy + 1) {
+        for (var dx = 0; dx < 2; dx = dx + 1) {
+            let fx = min(2 * cx + dx, w - 1);
+            let fy = min(2 * cy + dy, h - 1);
+            if (!imp_hole(fy * w + fx)) {
+                s = s + textureLoad(src, vec2<i32>(fx, fy), 0);
+                n = n + 1.0;
+            }
+        }
+    }
+    var v = vec4<f32>(0.0);
+    if (n > 0.0) {
+        v = s / n;
+    }
+    textureStore(out, vec2<i32>(cx, cy), v);
+}
+
+// PatchMatch's coarse-to-fine step: bilinear upsample of the coarse image into this level's hole
+// (patch_fill's upsample loop). The fine image is copied into `out` first.
+@compute @workgroup_size(16, 16)
+fn imp_pm_up(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let cw = i32(P.u[0].z);
+    let ch = i32(P.u[0].w);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h || !imp_hole(y * w + x)) {
+        return;
+    }
+    let fx = clamp((f32(x) + 0.5) / 2.0 - 0.5, 0.0, f32(cw - 1));
+    let fy = clamp((f32(y) + 0.5) / 2.0 - 0.5, 0.0, f32(ch - 1));
+    let x0 = i32(floor(fx));
+    let y0 = i32(floor(fy));
+    let x1 = min(x0 + 1, cw - 1);
+    let y1 = min(y0 + 1, ch - 1);
+    let tx = fx - f32(x0);
+    let ty = fy - f32(y0);
+    let a = textureLoad(src, vec2<i32>(x0, y0), 0);
+    let b = textureLoad(src, vec2<i32>(x1, y0), 0);
+    let c = textureLoad(src, vec2<i32>(x0, y1), 0);
+    let d = textureLoad(src, vec2<i32>(x1, y1), 0);
+    let top = a + (b - a) * tx;
+    let bot = c + (d - c) * tx;
+    textureStore(out, vec2<i32>(x, y), top + (bot - top) * ty);
+}
+
+// The NNF's coarse-to-fine step: ×2 (patch_fill's nnf upsample).
+@compute @workgroup_size(16, 16)
+fn imp_nnf_up(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let cw = i32(P.u[0].z);
+    let ch = i32(P.u[0].w);
+    let x = i32(gid.x);
+    let y = i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    let cx = min(x / 2, cw - 1);
+    let cy = min(y / 2, ch - 1);
+    let c = textureLoad(src, vec2<i32>(cx, cy), 0);
+    var o = vec4<f32>(0.0);
+    if (c.a > 0.5) {
+        o = vec4<f32>(c.r * 2.0 + f32(x % 2), c.g * 2.0 + f32(y % 2), 0.0, 1.0);
+    }
+    textureStore(out, vec2<i32>(x, y), o);
+}
+
+// A random valid source centre, by rejection (the CPU draws from its compacted source list; the
+// distribution over the valid centres is the same, the stream differs from the list's order).
+fn imp_any_source(seed: u32, i: u32, k: u32, w: i32, h: i32, r: i32) -> vec2<i32> {
+    for (var n = 0u; n < 32u; n = n + 1u) {
+        let a = imp_rnd(seed, i, k + n);
+        let x = i32(a % u32(w));
+        let y = i32((a >> 16u) % u32(h));
+        if (imp_valid_source(x, y, w, h, r)) {
+            return vec2<i32>(x, y);
+        }
+    }
+    return vec2<i32>(-1, -1);
+}
+
+// A round's initial field: the inherited source where it is still valid, a random one otherwise
+// (pm_level's initialise/validate step).
+@compute @workgroup_size(16, 16)
+fn imp_pm_init(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let r = i32(P.u[0].z);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    let i = y * w + x;
+    var o = vec4<f32>(0.0, 0.0, IMP_INF, 0.0);
+    if (imp_near(i)) {
+        let prev = textureLoad(src, vec2<i32>(x, y), 0);
+        var s = vec2<i32>(i32(prev.r), i32(prev.g));
+        if (prev.a <= 0.5 || !imp_valid_source(s.x, s.y, w, h, r)) {
+            // rnd(seed ^ e, i, 0), the round's random source (see imp_any_source).
+            s = imp_any_source(P.u[2].x ^ P.u[2].w, u32(i), 0u, w, h, r);
+        }
+        if (s.x >= 0) {
+            let d = imp_dist(x, y, s.x, s.y, w, h, r, IMP_INF);
+            o = vec4<f32>(f32(s.x), f32(s.y), d, 1.0);
+        }
+    }
+    textureStore(out, vec2<i32>(x, y), o);
+}
+
+// One propagation pass: every target pixel tries its four neighbours' sources shifted by the
+// step that would move that neighbour's match onto this pixel. The checkerboard parity in P.u[0].w
+// makes the pass race-free (a pixel of one parity only reads the other's).
+@compute @workgroup_size(16, 16)
+fn imp_pm_prop(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let r = i32(P.u[0].z);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    let cur = textureLoad(src, vec2<i32>(x, y), 0);
+    let i = y * w + x;
+    if (!imp_near(i) || ((x + y) & 1) != i32(P.u[0].w)) {
+        textureStore(out, vec2<i32>(x, y), cur);
+        return;
+    }
+    var best = vec2<i32>(i32(cur.r), i32(cur.g));
+    var bd = cur.b;
+    if (cur.a <= 0.5) {
+        bd = IMP_INF;
+    }
+    for (var k = 0; k < 4; k = k + 1) {
+        var nx = x;
+        var ny = y;
+        var sx = 0;
+        var sy = 0;
+        if (k == 0) {
+            nx = x - 1;
+            sx = 1;
+        } else if (k == 1) {
+            nx = x + 1;
+            sx = -1;
+        } else if (k == 2) {
+            ny = y - 1;
+            sy = 1;
+        } else {
+            ny = y + 1;
+            sy = -1;
+        }
+        if (nx < 0 || ny < 0 || nx >= w || ny >= h) {
+            continue;
+        }
+        let n = textureLoad(src, vec2<i32>(nx, ny), 0);
+        if (n.a <= 0.5) {
+            continue;
+        }
+        let c = vec2<i32>(i32(n.r) + sx, i32(n.g) + sy);
+        if (c.x == best.x && c.y == best.y) {
+            continue;
+        }
+        if (!imp_valid_source(c.x, c.y, w, h, r)) {
+            continue;
+        }
+        let d = imp_dist(x, y, c.x, c.y, w, h, r, bd);
+        if (d < bd) {
+            bd = d;
+            best = c;
+        }
+    }
+    // alpha = the entry is set: `bd` stays INF only if no match was found.
+    textureStore(out, vec2<i32>(x, y), vec4<f32>(f32(best.x), f32(best.y), bd, select(0.0, 1.0, bd < IMP_INF)));
+}
+
+// The random search (halving radius) and one random source anywhere, after propagation.
+@compute @workgroup_size(16, 16)
+fn imp_pm_rand(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let r = i32(P.u[0].z);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    let cur = textureLoad(src, vec2<i32>(x, y), 0);
+    let i = y * w + x;
+    if (!imp_near(i) || cur.a <= 0.5) {
+        textureStore(out, vec2<i32>(x, y), cur);
+        return;
+    }
+    var best = vec2<i32>(i32(cur.r), i32(cur.g));
+    var bd = cur.b;
+    let seed = P.u[2].x;
+    let it = P.u[2].y;
+    let em = P.u[2].w;
+    let iu = u32(i);
+    var rad = max(w, h);
+    var k = 0u;
+    while (rad >= 1) {
+        let a = imp_rnd(seed + it * 977u + em * 31u, iu, k);
+        let ox = i32(a % u32(2 * rad + 1)) - rad;
+        let oy = i32((a >> 16u) % u32(2 * rad + 1)) - rad;
+        let c = vec2<i32>(best.x + ox, best.y + oy);
+        if (imp_valid_source(c.x, c.y, w, h, r)) {
+            let d = imp_dist(x, y, c.x, c.y, w, h, r, bd);
+            if (d < bd) {
+                bd = d;
+                best = c;
+            }
+        }
+        rad = rad / 2;
+        k = k + 1u;
+    }
+    let any = imp_any_source(seed ^ 0xABCDu, iu, it + em * 64u, w, h, r);
+    if (any.x >= 0 && (any.x != best.x || any.y != best.y)) {
+        let d = imp_dist(x, y, any.x, any.y, w, h, r, bd);
+        if (d < bd) {
+            bd = d;
+            best = any;
+        }
+    }
+    textureStore(out, vec2<i32>(x, y), vec4<f32>(f32(best.x), f32(best.y), bd, select(0.0, 1.0, bd < IMP_INF)));
+}
+
+// Carry a round's field back into the nearest-neighbour field (only targets, as on the CPU).
+@compute @workgroup_size(16, 16)
+fn imp_nnf_store(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let x = i32(gid.x);
+    let y = i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    let i = y * w + x;
+    var o = textureLoad(aux, vec2<i32>(x, y), 0);
+    if (imp_near(i)) {
+        let f = textureLoad(src, vec2<i32>(x, y), 0);
+        o = vec4<f32>(f.r, f.g, 0.0, 1.0);
+    }
+    textureStore(out, vec2<i32>(x, y), o);
+}
+
+// The vote: every hole pixel becomes the distance-weighted mean of the samples its overlapping
+// patches carry (pm_level's vote step). `aux` is the current image; the image is copied into
+// `out` first, so only hole pixels are written.
+@compute @workgroup_size(16, 16)
+fn imp_pm_vote(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let r = i32(P.u[0].z);
+    let x = i32(P.u[1].x) + i32(gid.x);
+    let y = i32(P.u[1].y) + i32(gid.y);
+    if (x >= w || y >= h) {
+        return;
+    }
+    let i = y * w + x;
+    if (!imp_hole(i)) {
+        return;
+    }
+    let sigma2 = P.f[0].x;
+    var acc = vec4<f32>(0.0);
+    var wsum = 0.0;
+    for (var dy = -r; dy <= r; dy = dy + 1) {
+        let py = y + dy;
+        if (py < 0 || py >= h) {
+            continue;
+        }
+        for (var dx = -r; dx <= r; dx = dx + 1) {
+            let px = x + dx;
+            if (px < 0 || px >= w) {
+                continue;
+            }
+            let f = textureLoad(src, vec2<i32>(px, py), 0);
+            if (f.a <= 0.5 || f.b >= IMP_INF) {
+                continue;
+            }
+            let s = vec2<i32>(i32(f.r) - dx, i32(f.g) - dy);
+            let wt = exp(-f.b / (2.0 * sigma2));
+            acc = acc + textureLoad(aux, vec2<i32>(s.x, s.y), 0) * wt;
+            wsum = wsum + wt;
+        }
+    }
+    if (wsum > 0.0) {
+        textureStore(out, vec2<i32>(x, y), acc / wsum);
+    } else {
+        textureStore(out, vec2<i32>(x, y), textureLoad(aux, vec2<i32>(x, y), 0));
+    }
+}
+
+// The workgroup's 1024 distance bins (`imp_hist`); the name is unique across the concatenated
+// shader sources because `var<workgroup>` is module scope.
+var<workgroup> imp_hist_bins: array<atomic<u32>, 1024>;
+// The largest finite distance this dispatch saw (as its f32 bit pattern: positive floats are
+// ordered by their bits). `sigma2` uses it to learn whether the frame needs a wider range.
+var<workgroup> imp_hist_max: atomic<u32>;
+
+// One workgroup's histogram of the targets' match distances, for the vote's sigma² (the CPU takes
+// the 75th percentile of the finite distances). The single workgroup accumulates the whole
+// population through the shared atomic bins above.
+//
+// `P.f[0].x` is the range the bins cover; 0 selects the SDR range 0…4, where an image whose
+// channels are all ≤ 1 lives: each channel's squared difference is ≤ 4, so the mean SSD is too.
+// Frames with values above 1 (32-bpc HDR) have larger distances, so `sigma2` re-dispatches with
+// the observed maximum as the range instead of clamping them to bin 1023, which would report a
+// sigma² of ≈ 4 for a distance of 1600 and round the vote's weights to zero. The observed maximum
+// rides in bin 0's unused `.g` channel on every dispatch (its `.x` stays the count).
+@compute @workgroup_size(256, 1, 1)
+fn imp_hist(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let x0 = i32(P.u[1].x);
+    let y0 = i32(P.u[1].y);
+    let bw = i32(P.u[1].z);
+    let bh = i32(P.u[1].w);
+    let t = gid.x;
+    let range = select(4.0, P.f[0].x, P.f[0].x > 0.0);
+    let scale = 1024.0 / range;
+    if (t == 0u) {
+        atomicStore(&imp_hist_max, 0u);
+    }
+    // One workgroup, so the whole population is counted through shared atomics: a per-thread
+    // strided pass would keep only the pixels whose bin selected that thread (a biased ~1/256
+    // subsample, correlated with the pixel index).
+    for (var i = t; i < 1024u; i = i + 256u) {
+        atomicStore(&imp_hist_bins[i], 0u);
+    }
+    workgroupBarrier();
+    let total = u32(max(bw, 0) * max(bh, 0));
+    for (var idx = t; idx < total; idx = idx + 256u) {
+        let x = x0 + i32(idx) % bw;
+        let y = y0 + i32(idx) / bw;
+        let i = y * w + x;
+        if (!imp_near(i)) {
+            continue;
+        }
+        let f = textureLoad(src, vec2<i32>(x, y), 0);
+        if (f.a <= 0.5 || f.b >= IMP_INF) {
+            continue;
+        }
+        atomicMax(&imp_hist_max, bitcast<u32>(f.b));
+        // Clamp in f32 before the conversion: a distance far outside the range (a mismatched patch
+        // in an HDR frame) would overflow the i32 conversion, which is indeterminate in WGSL.
+        let b = u32(clamp(f.b * scale, 0.0, 1023.0));
+        atomicAdd(&imp_hist_bins[b], 1u);
+    }
+    workgroupBarrier();
+    // 256 threads × 4 bins cover the histogram.
+    for (var j = 0u; j < 4u; j = j + 1u) {
+        let bin = t * 4u + j;
+        textureStore(out, vec2<i32>(i32(bin), 0), vec4<f32>(f32(atomicLoad(&imp_hist_bins[bin])), 0.0, 0.0, 0.0));
+    }
+    // Thread 0 is bin 0's only writer, so this store follows the one above. `.g` carries the
+    // observed maximum: host readbacks keep the row 1024 texels wide (a 16 KB, 256-aligned copy).
+    if (t == 0u) {
+        textureStore(out, vec2<i32>(0, 0), vec4<f32>(f32(atomicLoad(&imp_hist_bins[0])), bitcast<f32>(atomicLoad(&imp_hist_max)), 0.0, 0.0));
+    }
+}
+
+// ---------------------------------------------------------------- block flow (flow completion)
+
+// The block matcher of effectcraft_raster::flow::block_flow(a, b, 8, 6), which the fill uses to
+// compute the motion between neighbouring membrane-filled frames before completing it inside the
+// holes (`FillBackend::flow`). `src` packs the two frames' luma planes at the current level:
+// .x is frame A's, .y is frame B's (`effectcraft_raster::flow::Plane::luma`). The kernels mirror
+// the CPU operation for operation, so the field matches the CPU's (crates/gpu/src/tests/inpaint.rs).
+
+// Plane::half of the packed pair: the clamped 2×2 average of each channel.
+@compute @workgroup_size(16, 16)
+fn imp_fl_half(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let cx = i32(gid.x);
+    let cy = i32(gid.y);
+    if (cx >= i32(P.u[0].z) || cy >= i32(P.u[0].w)) {
+        return;
+    }
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    var sx = 0.0;
+    var sy = 0.0;
+    for (var dy = 0; dy < 2; dy = dy + 1) {
+        for (var dx = 0; dx < 2; dx = dx + 1) {
+            let v = textureLoad(src, vec2<i32>(min(2 * cx + dx, w - 1), min(2 * cy + dy, h - 1)), 0);
+            sx = sx + v.x;
+            sy = sy + v.y;
+        }
+    }
+    textureStore(out, vec2<i32>(cx, cy), vec4<f32>(sx * 0.25, sy * 0.25, 0.0, 0.0));
+}
+
+// Plane::get: the packed luma at (x, y), clamped to the plane.
+fn imp_fl_tex(x: i32, y: i32, w: i32, h: i32) -> vec2<f32> {
+    let v = textureLoad(src, clamp(vec2<i32>(x, y), vec2<i32>(0, 0), vec2<i32>(w - 1, h - 1)), 0);
+    return vec2<f32>(v.x, v.y);
+}
+
+// The block match's SAD with A's block already loaded (`la`, row-major): B's luma is the packed
+// .y. The sub-pixel kernel's five fits share the window's block, so it is read once; the search
+// hoists its own 4×4/8×8 block the same way. The loops' bounds are literals so the backend can
+// unroll them and keep the loads in flight — a runtime-bound loop runs an order of magnitude
+// slower.
+fn imp_fl_sad8h(bx: i32, by: i32, dx: i32, dy: i32, w: i32, h: i32, la: array<f32, 64>) -> f32 {
+    var s = 0.0;
+    for (var yy = 0; yy < 8; yy = yy + 1) {
+        for (var xx = 0; xx < 8; xx = xx + 1) {
+            s = s + abs(la[yy * 8 + xx] - imp_fl_tex(bx + xx + dx, by + yy + dy, w, h).y);
+        }
+    }
+    return s;
+}
+
+// block_flow_window's coarse-to-fine search at one level: one integer vector per tile, seeded by
+// the previous (coarser) level's vector at the tile and its four neighbours. `aux` is that field
+// (`P.u[2].x` = 0 at the coarsest level, where the only seed is the zero vector).
+@compute @workgroup_size(16, 16)
+fn imp_fl_search(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let cols = i32(P.u[0].z);
+    let rows = i32(P.u[0].w);
+    let c = i32(gid.x);
+    let r = i32(gid.y);
+    if (c >= cols || r >= rows) {
+        return;
+    }
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let bs = i32(P.u[1].x);
+    let k = i32(P.u[1].z);
+    let rad = i32(P.u[1].w);
+    let lbs = max(i32(P.u[1].y) / k, 4);
+    let bx = c * bs / k;
+    let by = r * bs / k;
+    // The zero vector plus up to five neighbour seeds (the tile and its four neighbours).
+    var seeds: array<vec2<i32>, 6>;
+    var ns = 0;
+    seeds[ns] = vec2<i32>(0, 0);
+    ns = ns + 1;
+    if (P.u[2].x != 0u) {
+        var nbr = array<vec2<i32>, 5>(vec2<i32>(0, 0), vec2<i32>(-1, 0), vec2<i32>(1, 0), vec2<i32>(0, -1), vec2<i32>(0, 1));
+        for (var j = 0; j < 5; j = j + 1) {
+            let nc = c + nbr[j].x;
+            let nr = r + nbr[j].y;
+            if (nc >= 0 && nr >= 0 && nc < cols && nr < rows) {
+                let pv = textureLoad(aux, vec2<i32>(nc, nr), 0);
+                seeds[ns] = vec2<i32>(i32(round(pv.x)) * 2, i32(round(pv.y)) * 2);
+                ns = ns + 1;
+            }
+        }
+    }
+    // sort_unstable + dedup: distinct seeds in lexicographic (x, then y) order.
+    for (var i = 1; i < ns; i = i + 1) {
+        let key = seeds[i];
+        var j = i - 1;
+        while (j >= 0 && (seeds[j].x > key.x || (seeds[j].x == key.x && seeds[j].y > key.y))) {
+            seeds[j + 1] = seeds[j];
+            j = j - 1;
+        }
+        seeds[j + 1] = key;
+    }
+    var m = 0;
+    for (var i = 0; i < ns; i = i + 1) {
+        if (m == 0 || seeds[i].x != seeds[m - 1].x || seeds[i].y != seeds[m - 1].y) {
+            seeds[m] = seeds[i];
+            m = m + 1;
+        }
+    }
+    ns = m;
+    // A's block is the same for every candidate, so load it once (the unrolled loops keep it in
+    // registers) and the search only reads B's shifted block.
+    var la4: array<f32, 16>;
+    var la8: array<f32, 64>;
+    if (lbs >= 8) {
+        for (var yy = 0; yy < 8; yy = yy + 1) {
+            for (var xx = 0; xx < 8; xx = xx + 1) {
+                la8[yy * 8 + xx] = imp_fl_tex(bx + xx, by + yy, w, h).x;
+            }
+        }
+    } else {
+        for (var yy = 0; yy < 4; yy = yy + 1) {
+            for (var xx = 0; xx < 4; xx = xx + 1) {
+                la4[yy * 4 + xx] = imp_fl_tex(bx + xx, by + yy, w, h).x;
+            }
+        }
+    }
+    var best = vec2<i32>(0, 0);
+    var best_e = 1e30;
+    for (var si = 0; si < ns; si = si + 1) {
+        let s = seeds[si];
+        for (var dy = -rad; dy <= rad; dy = dy + 1) {
+            for (var dx = -rad; dx <= rad; dx = dx + 1) {
+                let d0 = s.x + dx;
+                let d1 = s.y + dy;
+                var acc = 0.0;
+                if (lbs >= 8) {
+                    for (var yy = 0; yy < 8; yy = yy + 1) {
+                        for (var xx = 0; xx < 8; xx = xx + 1) {
+                            acc = acc + abs(la8[yy * 8 + xx] - imp_fl_tex(bx + xx + d0, by + yy + d1, w, h).y);
+                        }
+                    }
+                } else {
+                    for (var yy = 0; yy < 4; yy = yy + 1) {
+                        for (var xx = 0; xx < 4; xx = xx + 1) {
+                            acc = acc + abs(la4[yy * 4 + xx] - imp_fl_tex(bx + xx + d0, by + yy + d1, w, h).y);
+                        }
+                    }
+                }
+                let e = acc + 1e-4 * f32(abs(d0) + abs(d1));
+                if (e < best_e) {
+                    best_e = e;
+                    best = vec2<i32>(d0, d1);
+                }
+            }
+        }
+    }
+    textureStore(out, vec2<i32>(c, r), vec4<f32>(f32(best.x), f32(best.y), 0.0, 0.0));
+}
+
+// The parabola fit of the SAD around the best vector (block_flow_window's sub-pixel step).
+fn imp_fl_fit(em: f32, ep: f32, e0: f32) -> f32 {
+    let den = em - 2.0 * e0 + ep;
+    if (den > 1e-6) {
+        return clamp(0.5 * (em - ep) / den, -0.5, 0.5);
+    }
+    return 0.0;
+}
+
+// Sub-pixel refinement at full resolution: `aux` is the integer field of level 0, `src` the
+// level-0 packed luma (`P.u[1]` = (tile, window, 0, 0)).
+@compute @workgroup_size(16, 16)
+fn imp_fl_subpix(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let cols = i32(P.u[0].z);
+    let rows = i32(P.u[0].w);
+    let c = i32(gid.x);
+    let r = i32(gid.y);
+    if (c >= cols || r >= rows) {
+        return;
+    }
+    let w = i32(P.u[0].x);
+    let h = i32(P.u[0].y);
+    let bs = i32(P.u[1].x);
+    let win = i32(P.u[1].y);
+    let bx = c * bs;
+    let by = r * bs;
+    let f = textureLoad(aux, vec2<i32>(c, r), 0);
+    let d = vec2<i32>(i32(round(f.x)), i32(round(f.y)));
+    // The window's A block is the same for the five SADs: load it once (the loop is unrolled).
+    var la: array<f32, 64>;
+    for (var yy = 0; yy < 8; yy = yy + 1) {
+        for (var xx = 0; xx < 8; xx = xx + 1) {
+            la[yy * 8 + xx] = imp_fl_tex(bx + xx, by + yy, w, h).x;
+        }
+    }
+    let e0 = imp_fl_sad8h(bx, by, d.x, d.y, w, h, la);
+    let sx = imp_fl_fit(imp_fl_sad8h(bx, by, d.x - 1, d.y, w, h, la), imp_fl_sad8h(bx, by, d.x + 1, d.y, w, h, la), e0);
+    let sy = imp_fl_fit(imp_fl_sad8h(bx, by, d.x, d.y - 1, w, h, la), imp_fl_sad8h(bx, by, d.x, d.y + 1, w, h, la), e0);
+    textureStore(out, vec2<i32>(c, r), vec4<f32>(f32(d.x) + sx, f32(d.y) + sy, 0.0, 0.0));
+}
+
+// The 3×3 component-wise vector median against outliers (each component sorted on its own).
+@compute @workgroup_size(16, 16)
+fn imp_fl_median(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let cols = i32(P.u[0].z);
+    let rows = i32(P.u[0].w);
+    let c = i32(gid.x);
+    let r = i32(gid.y);
+    if (c >= cols || r >= rows) {
+        return;
+    }
+    var xs: array<f32, 9>;
+    var ys: array<f32, 9>;
+    var n = 0;
+    for (var dr = -1; dr <= 1; dr = dr + 1) {
+        for (var dc = -1; dc <= 1; dc = dc + 1) {
+            let nc = c + dc;
+            let nr = r + dr;
+            if (nc >= 0 && nr >= 0 && nc < cols && nr < rows) {
+                let v = textureLoad(src, vec2<i32>(nc, nr), 0);
+                xs[n] = v.x;
+                ys[n] = v.y;
+                n = n + 1;
+            }
+        }
+    }
+    for (var i = 1; i < n; i = i + 1) {
+        let kx = xs[i];
+        var j = i - 1;
+        while (j >= 0 && xs[j] > kx) {
+            xs[j + 1] = xs[j];
+            j = j - 1;
+        }
+        xs[j + 1] = kx;
+        let ky = ys[i];
+        j = i - 1;
+        while (j >= 0 && ys[j] > ky) {
+            ys[j + 1] = ys[j];
+            j = j - 1;
+        }
+        ys[j + 1] = ky;
+    }
+    textureStore(out, vec2<i32>(c, r), vec4<f32>(xs[n / 2], ys[n / 2], 0.0, 0.0));
+}
diff --git a/crates/gpu/src/shaders/kernels.wgsl b/crates/gpu/src/shaders/kernels.wgsl
index defbb5bf4..bb4a5e63a 100644
--- a/crates/gpu/src/shaders/kernels.wgsl
+++ b/crates/gpu/src/shaders/kernels.wgsl
@@ -380,19 +380,31 @@ fn glow_bright(@builtin(global_invocation_id) gid: vec3<u32>) {
         l = a;
     }
     let k = clamp((l - thr) / max(1.0 - thr, 1e-3), 0.0, 1.0);
+    // Based on the colour channels the glow covers the layer's whole alpha (effects::misc::glow).
+    var ga = a;
+    if (P.u[0].y != 0u) {
+        ga = k * a;
+    }
     if (P.u[0].x != 0u) {
         let t = glow_ab_t(l);
         let ca = P.f[1].xyz;
         let cb = P.f[2].xyz;
         let c = ca + (cb - ca) * t;
-        textureStore(out, p, vec4<f32>(c * k * a, k * a));
+        textureStore(out, p, vec4<f32>(c * k * a, ga));
+    } else if (P.u[0].y != 0u) {
+        textureStore(out, p, vec4<f32>(px.xyz * k, ga));
     } else {
-        textureStore(out, p, px * k);
+        // Original colours, per channel (effects::misc::glow_bright_channel): gain 8.0 is
+        // effects::GLOW_GAIN, 0.0611 is effects::GLOW_KNEE (checked by the test
+        // glow_constants_match_the_cpu).
+        let c = max(8.0 * (px.xyz / a - vec3<f32>(thr - 0.0611)), vec3<f32>(0.0));
+        textureStore(out, p, vec4<f32>(c * a, ga));
     }
 }
 
 // Glow composite: original `src` with the blurred glow `aux`. u[0].x = 0 on top, 1 behind,
-// 2 none (glow only); f[0].x = intensity.
+// 2 none (glow only); u[0].y = based on alpha (intensity also scales the glow's alpha);
+// f[0].x = intensity.
 @compute @workgroup_size(16, 16)
 fn glow_combine(@builtin(global_invocation_id) gid: vec3<u32>) {
     let dims = out_dims();
@@ -401,7 +413,11 @@ fn glow_combine(@builtin(global_invocation_id) gid: vec3<u32>) {
         return;
     }
     var o = textureLoad(src, p, 0);
-    let g = textureLoad(aux, p, 0) * P.f[0].x;
+    let gs = textureLoad(aux, p, 0);
+    var g = vec4<f32>(gs.xyz * P.f[0].x, gs.w);
+    if (P.u[0].y != 0u) {
+        g.w = gs.w * P.f[0].x;
+    }
     if (P.u[0].x == 2u) {
         o = g;
     } else if (P.u[0].x == 1u) {
@@ -509,12 +525,25 @@ fn fade(t: f32) -> f32 {
 }
 
 fn value_noise(x: f32, y: f32, z: f32, seed: u32) -> f32 {
+    return value_noise_z(x, y, z, seed, true);
+}
+
+// effects::generate::value_noise_linear_z: z (evolution) interpolates linearly, x and y keep the
+// quintic fade (Turbulent Displace, #943).
+fn value_noise_linear_z(x: f32, y: f32, z: f32, seed: u32) -> f32 {
+    return value_noise_z(x, y, z, seed, false);
+}
+
+fn value_noise_z(x: f32, y: f32, z: f32, seed: u32, ease_z: bool) -> f32 {
     let x0 = floor(x);
     let y0 = floor(y);
     let z0 = floor(z);
     let fx = fade(x - x0);
     let fy = fade(y - y0);
-    let fz = fade(z - z0);
+    var fz = z - z0;
+    if (ease_z) {
+        fz = fade(fz);
+    }
     let ix = i32(x0);
     let iy = i32(y0);
     let iz = i32(z0);
@@ -561,7 +590,7 @@ fn soft_linear_noise(x: f32, y: f32, z: f32, seed: u32) -> f32 {
     let wy = bspline(y + 0.5 - y0);
     let a = soft_linear_slice(i32(x0), i32(y0), i32(z0), wx, wy, seed);
     let b = soft_linear_slice(i32(x0), i32(y0), i32(z0) + 1, wx, wy, seed);
-    let n = a + (b - a) * fade(z - z0);
+    let n = a + (b - a) * (z - z0);
     return 0.5 + (n - 0.5) * SOFT_LINEAR_GAIN;
 }
 
@@ -605,7 +634,9 @@ fn pointwise(@builtin(global_invocation_id) gid: vec3<u32>) {
         case 1u: {
             if (a > 0.0) {
                 let c = straight(px);
-                let l = clamp(luminance(c), 0.0, 1.0);
+                // Rec. 601 weights, as After Effects: effects::LUMA_601 (checked by the test
+                // shader_constants_match_the_cpu).
+                let l = clamp(0.299 * c.x + 0.587 * c.y + 0.114 * c.z, 0.0, 1.0);
                 let blk = P.f[0].xyz;
                 let wht = P.f[1].xyz;
                 let t = blk + (wht - blk) * l;
@@ -623,14 +654,20 @@ fn pointwise(@builtin(global_invocation_id) gid: vec3<u32>) {
                 } else if (P.u[0].y == 2u) {
                     // Brightness & Contrast tone curves (effects crate bc_modern, AE-fitted #681).
                     var o = c;
-                    let g = max(1.0 + 0.53 * ct, 0.05);
+                    // Negative settings invert the positive curves (reciprocal exponents).
+                    var g = max(1.0 + 0.53 * abs(ct), 0.05);
+                    if (ct < 0.0) {
+                        g = 1.0 / g;
+                    }
+                    var e = exp2(1.24 * abs(br));
+                    if (br < 0.0) {
+                        e = 1.0 / e;
+                    }
                     for (var i = 0; i < 3; i++) {
                         if (c[i] < 1.0) {
                             var v = max(c[i], 0.0);
-                            if (br > 0.0) {
-                                v = 1.0 - powz(1.0 - v, exp2(1.24 * br));
-                            } else if (br < 0.0) {
-                                v = powz(v, exp2(-1.32 * br));
+                            if (br != 0.0) {
+                                v = 1.0 - powz(1.0 - v, e);
                             }
                             if (ct != 0.0) {
                                 if (v < 0.5) {
@@ -702,7 +739,12 @@ fn pointwise(@builtin(global_invocation_id) gid: vec3<u32>) {
                     if (P.u[0].z != 0u) {
                         t = min(t, 1.0);
                     }
-                    t = powz(max(t, 0.0), 1.0 / g);
+                    // color_fx::levels_gamma: unclipped values below 0 mirror the curve.
+                    if (t >= 0.0) {
+                        t = powz(t, 1.0 / g);
+                    } else {
+                        t = -powz(-t, 1.0 / g);
+                    }
                     o[i] = ob + (ow - ob) * t;
                 }
                 px = vec4<f32>(o * a, a);
@@ -713,14 +755,16 @@ fn pointwise(@builtin(global_invocation_id) gid: vec3<u32>) {
                 let c = straight(px);
                 var o = vec3<f32>(0.0);
                 for (var i = 0; i < 3; i++) {
-                    // Per-channel gain, offset, gamma; negative values are mirrored.
+                    // Per-channel gain, offset, gamma; negative values are mirrored. The
+                    // linear-light conversion is a pure 2.2 power: effects::EXPOSURE_LINEAR_GAMMA
+                    // (checked by the test shader_constants_match_the_cpu).
                     if (P.u[0].y != 0u) {
                         let x = c[i] * P.f[0][i] + P.f[1][i];
                         o[i] = sign(x) * powz(abs(x), 1.0 / P.f[2][i]);
                     } else {
-                        let lin = srgb_to_linear(max(c[i], 0.0));
+                        let lin = sign(c[i]) * powz(abs(c[i]), 2.2);
                         let x = lin * P.f[0][i] + P.f[1][i];
-                        o[i] = sign(x) * linear_to_srgb(powz(abs(x), 1.0 / P.f[2][i]));
+                        o[i] = sign(x) * powz(powz(abs(x), 1.0 / P.f[2][i]), 1.0 / 2.2);
                     }
                 }
                 px = vec4<f32>(o * a, a);
@@ -753,17 +797,13 @@ fn pointwise(@builtin(global_invocation_id) gid: vec3<u32>) {
             let c = P.f[0];
             let invert = P.u[0].y != 0u;
             let opacity = P.f[1].x;
+            // The fill colour at the layer's (or inverted) alpha times Opacity (color_fx::fill).
             var fa = px.w;
             if (invert) {
                 fa = 1.0 - px.w;
             }
-            let f = c.xyz * fa;
-            let rgb = px.xyz + (f - px.xyz) * opacity;
-            var alpha = px.w;
-            if (invert) {
-                alpha = px.w + (fa - px.w) * opacity;
-            }
-            px = vec4<f32>(rgb, alpha);
+            fa = fa * opacity;
+            px = vec4<f32>(c.xyz * fa, fa);
         }
         case 8u: {
             // effects::color2::map_ca: transparent pixels only change through the alpha curve.
diff --git a/crates/gpu/src/shaders/median_private.wgsl b/crates/gpu/src/shaders/median_private.wgsl
new file mode 100644
index 000000000..5b3afefe4
--- /dev/null
+++ b/crates/gpu/src/shaders/median_private.wgsl
@@ -0,0 +1,63 @@
+// The same median for large radii, as the CPU computes it: a sliding 512-bin histogram per
+// channel (Huang). One invocation per row segment of u[0].y pixels: it fills the histogram for
+// the segment's first window, then slides right one column at a time (remove the column
+// leaving, add the one entering) and moves each channel's median by the counts below it.
+// u[0] = (r, segment length); dispatched over (rows, segments) with 64 × 1 workgroups.
+// data = the 512 CPU-rounded level / 511 values.
+@compute @workgroup_size(64, 1)
+fn fxn_median_huang(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let dims = out_dims();
+    let y = i32(gid.x);
+    let seg = i32(P.u[0].y);
+    let x0 = i32(gid.y) * seg;
+    if (y >= dims.y || x0 >= dims.x) {
+        return;
+    }
+    let x1 = min(x0 + seg, dims.x);
+    let r = i32(P.u[0].x);
+    let half = u32((2 * r + 1) * (2 * r + 1) / 2);
+    var hist: array<u32, 2048>;
+    for (var dy = -r; dy <= r; dy++) {
+        for (var dx = -r; dx <= r; dx++) {
+            let v = vec4<u32>(tex_get_clamped(src, x0 + dx, y + dy));
+            hist[v.x] += 1u;
+            hist[512u + v.y] += 1u;
+            hist[1024u + v.z] += 1u;
+            hist[1536u + v.w] += 1u;
+        }
+    }
+    // Per channel: the median level and the count of values below it.
+    var med = vec4<u32>(0u);
+    var lt = vec4<u32>(0u);
+    for (var x = x0; x < x1; x++) {
+        if (x > x0) {
+            for (var dy = -r; dy <= r; dy++) {
+                let o = vec4<u32>(tex_get_clamped(src, x - 1 - r, y + dy));
+                let n = vec4<u32>(tex_get_clamped(src, x + r, y + dy));
+                for (var c = 0u; c < 4u; c++) {
+                    hist[c * 512u + o[c]] -= 1u;
+                    if (o[c] < med[c]) {
+                        lt[c] -= 1u;
+                    }
+                    hist[c * 512u + n[c]] += 1u;
+                    if (n[c] < med[c]) {
+                        lt[c] += 1u;
+                    }
+                }
+            }
+        }
+        for (var c = 0u; c < 4u; c++) {
+            let base = c * 512u;
+            while (lt[c] > half) {
+                med[c] -= 1u;
+                lt[c] -= hist[base + med[c]];
+            }
+            while (lt[c] + hist[base + med[c]] <= half) {
+                lt[c] += hist[base + med[c]];
+                med[c] += 1u;
+            }
+        }
+        textureStore(out, vec2<i32>(x, y), vec4<f32>(data[med.x], data[med.y], data[med.z], data[med.w]));
+    }
+}
+
diff --git a/crates/gpu/src/shaders/median_software.wgsl b/crates/gpu/src/shaders/median_software.wgsl
new file mode 100644
index 000000000..606a5e4b4
--- /dev/null
+++ b/crates/gpu/src/shaders/median_software.wgsl
@@ -0,0 +1,65 @@
+// The same median for large radii, as the CPU computes it: a sliding 512-bin histogram per
+// channel (Huang). One invocation per row segment of u[0].y pixels: it fills the histogram for
+// the segment's first window, then slides right one column at a time (remove the column
+// leaving, add the one entering) and moves each channel's median by the counts below it.
+// Each invocation owns one 8 KiB slice of the workgroup's zero-initialized histogram.
+// Two slices fit the guaranteed 16 KiB workgroup storage limit. No bins are shared.
+var<workgroup> median_hist: array<array<u32, 2048>, 2>;
+// u[0] = (r, segment length); dispatched over (rows, segments) with 2 × 1 workgroups.
+// data = the 512 CPU-rounded level / 511 values.
+@compute @workgroup_size(2, 1)
+fn fxn_median_huang(@builtin(global_invocation_id) gid: vec3<u32>, @builtin(local_invocation_index) lane: u32) {
+    let dims = out_dims();
+    let y = i32(gid.x);
+    let seg = i32(P.u[0].y);
+    let x0 = i32(gid.y) * seg;
+    if (y >= dims.y || x0 >= dims.x) {
+        return;
+    }
+    let x1 = min(x0 + seg, dims.x);
+    let r = i32(P.u[0].x);
+    let half = u32((2 * r + 1) * (2 * r + 1) / 2);
+    for (var dy = -r; dy <= r; dy++) {
+        for (var dx = -r; dx <= r; dx++) {
+            let v = vec4<u32>(tex_get_clamped(src, x0 + dx, y + dy));
+            median_hist[lane][v.x] += 1u;
+            median_hist[lane][512u + v.y] += 1u;
+            median_hist[lane][1024u + v.z] += 1u;
+            median_hist[lane][1536u + v.w] += 1u;
+        }
+    }
+    // Per channel: the median level and the count of values below it.
+    var med = vec4<u32>(0u);
+    var lt = vec4<u32>(0u);
+    for (var x = x0; x < x1; x++) {
+        if (x > x0) {
+            for (var dy = -r; dy <= r; dy++) {
+                let o = vec4<u32>(tex_get_clamped(src, x - 1 - r, y + dy));
+                let n = vec4<u32>(tex_get_clamped(src, x + r, y + dy));
+                for (var c = 0u; c < 4u; c++) {
+                    median_hist[lane][c * 512u + o[c]] -= 1u;
+                    if (o[c] < med[c]) {
+                        lt[c] -= 1u;
+                    }
+                    median_hist[lane][c * 512u + n[c]] += 1u;
+                    if (n[c] < med[c]) {
+                        lt[c] += 1u;
+                    }
+                }
+            }
+        }
+        for (var c = 0u; c < 4u; c++) {
+            let base = c * 512u;
+            while (lt[c] > half) {
+                med[c] -= 1u;
+                lt[c] -= median_hist[lane][base + med[c]];
+            }
+            while (lt[c] + median_hist[lane][base + med[c]] <= half) {
+                lt[c] += median_hist[lane][base + med[c]];
+                med[c] += 1u;
+            }
+        }
+        textureStore(out, vec2<i32>(x, y), vec4<f32>(data[med.x], data[med.y], data[med.z], data[med.w]));
+    }
+}
+
diff --git a/crates/gpu/src/shaders/particles.wgsl b/crates/gpu/src/shaders/particles.wgsl
index 694d6fb67..ac12b8fc7 100644
--- a/crates/gpu/src/shaders/particles.wgsl
+++ b/crates/gpu/src/shaders/particles.wgsl
@@ -53,12 +53,12 @@ fn ps_norm3(v: vec3<f32>) -> vec3<f32> {
 fn ps_rand_dir(i: u32, k: u32, flat: bool) -> vec3<f32> {
     if (flat) {
         let a = ps_h(i, k) * PS_TAU;
-        return vec3<f32>(cos(a), sin(a), 0.0);
+        return vec3<f32>(cos_p(a), sin_p(a), 0.0);
     }
     let z = ps_hs(i, k);
     let a = ps_h(i, k + 1u) * PS_TAU;
     let r = sqrt(max(1.0 - z * z, 0.0));
-    return vec3<f32>(r * cos(a), r * sin(a), z);
+    return vec3<f32>(r * cos_p(a), r * sin_p(a), z);
 }
 
 struct Part {
@@ -189,7 +189,7 @@ fn ps_spawn_cannon(id: u32) -> Part {
     let vel = S.f[1].y;
     let vel_spread = S.f[1].z;
     let a = radians(angle + ps_hs(id, 1u) * spread * 0.5);
-    let d = vec2<f32>(sin(a), -cos(a));
+    let d = vec2<f32>(sin_p(a), -cos_p(a));
     let speed = max(vel + ps_hs(id, 3u) * vel_spread, 0.0);
     var off: vec2<f32>;
     if (r >= 0.0) {
@@ -197,7 +197,7 @@ fn ps_spawn_cannon(id: u32) -> Part {
     } else {
         let aa = ps_h(id, 5u) * PS_TAU;
         let rr = sqrt(ps_h(id, 6u)) * -r;
-        off = vec2<f32>(cos(aa) * rr, sin(aa) * rr);
+        off = vec2<f32>(cos_p(aa) * rr, sin_p(aa) * rr);
     }
     let v = d * speed;
     let dt = S.f[2].z;
diff --git a/crates/gpu/src/shaders/yuv.wgsl b/crates/gpu/src/shaders/yuv.wgsl
new file mode 100644
index 000000000..935acb4dc
--- /dev/null
+++ b/crates/gpu/src/shaders/yuv.wgsl
@@ -0,0 +1,96 @@
+// Finished frame → 8-bit BT.709 limited-range 4:2:0 (Y, U, V planes packed 4 bytes per word),
+// composited over the comp background: the GPU twin of `Image::to_rgba8_over` followed by
+// export's `rgba_to_yuv420`, operation for operation (same order of float operations, the same
+// rounding: `as u8` truncation of `x * 255 + 0.5`, `f32::round` half away from zero).
+
+struct YP {
+    // width, height, chroma width, Y words
+    size: vec4<u32>,
+    bg: vec4<f32>,
+}
+
+@group(0) @binding(0) var<uniform> Y: YP;
+@group(0) @binding(1) var frame: texture_2d<f32>;
+@group(0) @binding(2) var<storage, read_write> outw: array<u32>;
+
+// NaN by its bits: drivers may assume arithmetic never sees NaN.
+fn is_nan(x: f32) -> bool {
+    return (bitcast<u32>(x) & 0x7fffffffu) > 0x7f800000u;
+}
+
+// `(c.clamp(0, 1) * 255 + 0.5) as u8`; the CPU's `as u8` turns NaN into 0.
+fn q8(c: f32, nan: bool) -> f32 {
+    if (nan) {
+        return 0.0;
+    }
+    return floor(clamp(c, 0.0, 1.0) * 255.0 + 0.5);
+}
+
+// f32::round for x >= 0 (half away from zero).
+fn round_pos(x: f32) -> f32 {
+    let f = floor(x);
+    return select(f, f + 1.0, x - f >= 0.5);
+}
+
+fn px(x: u32, y: u32) -> vec3<f32> {
+    let p = textureLoad(frame, vec2<i32>(i32(x), i32(y)), 0);
+    // A NaN alpha makes every channel NaN on the CPU (k is NaN).
+    let na = is_nan(p.w);
+    let k = select(1.0 - clamp(p.w, 0.0, 1.0), 0.0, na);
+    let c = vec3<f32>(q8(p.x + Y.bg.x * k, na || is_nan(p.x)), q8(p.y + Y.bg.y * k, na || is_nan(p.y)), q8(p.z + Y.bg.z * k, na || is_nan(p.z)));
+    return c / 255.0;
+}
+
+fn luma(c: vec3<f32>) -> f32 {
+    return 0.2126 * c.x + 0.7152 * c.y + 0.0722 * c.z;
+}
+
+fn y8(l: f32) -> u32 {
+    return u32(clamp(round_pos(16.0 + 219.0 * l), 1.0, 254.0));
+}
+
+// One invocation: 4 chroma samples = 8 × 2 pixels.
+@compute @workgroup_size(8, 8)
+fn yuv420(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let w = Y.size.x;
+    let h = Y.size.y;
+    let cw = Y.size.z;
+    if (gid.x * 4u >= cw || gid.y * 2u >= h) {
+        return;
+    }
+    let x0 = gid.x * 8u;
+    let cy = gid.y;
+    var uw = 0u;
+    var vw = 0u;
+    var yw = array<u32, 4>(0u, 0u, 0u, 0u);
+    for (var q = 0u; q < 4u; q++) {
+        // Accumulate in the CPU's order: row 0 left, right; row 1 left, right.
+        var a0 = 0.0;
+        var a1 = 0.0;
+        for (var dy = 0u; dy < 2u; dy++) {
+            for (var dx = 0u; dx < 2u; dx++) {
+                let x = x0 + q * 2u + dx;
+                let c = px(x, cy * 2u + dy);
+                let l = luma(c);
+                let byte = q * 2u + dx;
+                yw[dy * 2u + byte / 4u] |= y8(l) << (8u * (byte % 4u));
+                a0 += (c.z - l) / 1.8556;
+                a1 += (c.x - l) / 1.5748;
+            }
+        }
+        let u = u32(clamp(round_pos(128.0 + 224.0 * a0 / 4.0), 1.0, 254.0));
+        let v = u32(clamp(round_pos(128.0 + 224.0 * a1 / 4.0), 1.0, 254.0));
+        uw |= u << (8u * q);
+        vw |= v << (8u * q);
+    }
+    let r0 = (cy * 2u * w + x0) / 4u;
+    let r1 = ((cy * 2u + 1u) * w + x0) / 4u;
+    outw[r0] = yw[0];
+    outw[r0 + 1u] = yw[1];
+    outw[r1] = yw[2];
+    outw[r1 + 1u] = yw[3];
+    let cwords = cw / 4u * (h / 2u);
+    let ci = (cy * cw) / 4u + gid.x;
+    outw[Y.size.w + ci] = uw;
+    outw[Y.size.w + cwords + ci] = vw;
+}
diff --git a/crates/gpu/src/tests.rs b/crates/gpu/src/tests.rs
index 24f8c9614..b88bac0be 100644
--- a/crates/gpu/src/tests.rs
+++ b/crates/gpu/src/tests.rs
@@ -26,6 +26,162 @@ use effectcraft_time::{FrameRate, Tick};
 
 use crate::Gpu;
 
+mod adjust;
+mod adv3d;
+mod deferred;
+mod deferred_jobs;
+mod fx_color;
+mod fx_depth;
+mod fx_distort;
+mod fx_extra;
+mod fx_gen2;
+mod fx_generate;
+mod fx_key;
+mod fx_light;
+mod fx_lut;
+mod fx_noise;
+mod fx_particles;
+mod fx_pixel2;
+mod fx_sim;
+mod fx_stylize;
+mod fx_text;
+mod fx_time;
+mod fx_tone;
+mod fx_transition;
+mod fx_vr;
+mod fx_warp;
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod init;
+mod inpaint;
+mod particles;
+mod three_d;
+mod wgsl_grammar;
+
+pub(crate) const MATH_PROBE_SHADER: &str = r#"
+@compute @workgroup_size(16, 16)
+fn math_probe(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let p = vec2<i32>(gid.xy);
+    if (p.x >= out_dims().x || p.y >= out_dims().y) { return; }
+    let v = textureLoad(src, p, 0).x;
+    if (P.u[0].x == 1u) {
+        let a = textureLoad(src, p, 0).w;
+        let q = unit_div(v, a);
+        textureStore(out, p, vec4<f32>(q, fxs_posterize_bin(q, P.u[0].y), 0.0, 1.0));
+        return;
+    }
+    if (P.u[0].x == 2u) {
+        textureStore(out, p, vec4<f32>(round_away(v), 0.0, 0.0, 1.0));
+        return;
+    }
+    textureStore(out, p, vec4<f32>(sin_p(v), cos_p(v), 0.0, 1.0));
+}
+"#;
+
+/// Direction errors accumulate into visible particle offsets and spherical
+/// remapping errors. Check the numerical primitive before rendering a scene.
+#[test]
+fn angular_math_preserves_particle_and_vr_directions() {
+    let Some(g) = gpu() else { return };
+    for extent in [std::f32::consts::TAU, 100.0, 8192.0] {
+        let mut img = Image::new(4097, 1);
+        for (i, px) in img.data.iter_mut().enumerate() {
+            px[0] = (i as f32 - 2048.0) * extent / 2048.0;
+        }
+        let input = g.ctx.upload_image(&img).unwrap();
+        let mut e = crate::context::Enc::new(&g.ctx);
+        let out = e.scratch(img.width, img.height);
+        e.pixels("math_probe", &Default::default(), &input, None, &out, None);
+        let result = e.download(&out).unwrap();
+        for (i, (v, got)) in img.data.iter().zip(result.data).enumerate() {
+            let want = [(v[0] as f64).sin() as f32, (v[0] as f64).cos() as f32];
+            for c in 0..2 {
+                assert!((want[c] - got[c]).abs() <= 2e-7, "sample {i}, angle {}: CPU {want:?}, GPU {got:?}", v[0]);
+            }
+        }
+    }
+}
+
+#[test]
+fn alpha_division_and_posterization_match_f32_rounding() {
+    let Some(g) = gpu() else { return };
+    let mut values = vec![];
+    for levels in [1u32, 3, 8, 254] {
+        values.clear();
+        for a in [1.0f32, 0.1, 0.3, 1.0 / 255.0, 6.0 / 255.0] {
+            for i in 0..levels {
+                let half = (i as f32 + 0.5) / levels as f32;
+                for v in [0.0, 1e-6, half.next_down(), half, half.next_up(), 1.0] {
+                    values.push([v * a, 0.0, 0.0, a]);
+                }
+            }
+        }
+        let img = Image { width: values.len() as u32, height: 1, data: values.clone() };
+        let input = g.ctx.upload_image(&img).unwrap();
+        let mut e = crate::context::Enc::new(&g.ctx);
+        let out = e.scratch(img.width, 1);
+        let mut params = crate::context::Params::default();
+        params.u[0] = [1, levels, 0, 0];
+        e.pixels("math_probe", &params, &input, None, &out, None);
+        let result = e.download(&out).unwrap();
+        for (i, (v, got)) in values.iter().zip(result.data).enumerate() {
+            let q = (v[0] / v[3]).clamp(0.0, 1.0);
+            assert_eq!(q.to_bits(), got[0].to_bits(), "levels {levels}, pixel {i}, input {v:?}");
+            assert_eq!((q * levels as f32).round(), got[1], "levels {levels}, pixel {i}, input {v:?}");
+        }
+    }
+}
+
+/// `round_away` is `f32::round`, also from 2^23 up where every value is already an integer
+/// (integer IDs there must not merge: 8388608 and 8388609 both rounded to 8388609).
+#[test]
+fn round_away_matches_f32_round_for_large_values() {
+    let Some(g) = gpu() else { return };
+    let mut values = vec![];
+    for m in [1.0f32, -1.0] {
+        for v in [0.0f32, 0.5, 1.5, 2.5, 0.49999997, 4194303.5, 8388607.5, 8388608.0, 8388609.0, 8388610.0, 16777216.0, 3.0e9] {
+            values.push([m * v, 0.0, 0.0, 1.0]);
+        }
+    }
+    let img = Image { width: values.len() as u32, height: 1, data: values.clone() };
+    let input = g.ctx.upload_image(&img).unwrap();
+    let mut e = crate::context::Enc::new(&g.ctx);
+    let out = e.scratch(img.width, 1);
+    let mut params = crate::context::Params::default();
+    params.u[0] = [2, 0, 0, 0];
+    e.pixels("math_probe", &params, &input, None, &out, None);
+    let result = e.download(&out).unwrap();
+    for (v, got) in values.iter().zip(result.data) {
+        assert_eq!(v[0].round(), got[0], "round_away({})", v[0]);
+    }
+}
+
+/// Prove that the numerical fixes run on the device, without per-effect image
+/// downloads or CPU fallback. Compiler-limited DX12 devices retain their tested
+/// fallback contract; these kernels must compile on the Vulkan test adapters.
+#[test]
+fn numerical_effects_remain_resident_on_vulkan() {
+    let Some(g) = gpu() else { return };
+    if !g.ctx.name.ends_with("(Vulkan)") {
+        return;
+    }
+    for entry in ["fxs_point", "fxt_point", "ftr_grid", "fp2_hextile"] {
+        assert!(g.ctx.has_kernel(entry), "{entry}: {:?}", g.ctx.unavailable_kernels());
+    }
+    for (id, vals) in [
+        ("ec.stylize.posterize", vec![("level", n(4.0))]),
+        ("ec.color.psarbitrarymap", vec![("phase", n(40.0))]),
+        ("ec.transition.ccgridwipe", vec![("completion", n(40.0))]),
+        ("ec.stylize.cchextile", vec![("radius", n(9.3))]),
+    ] {
+        let before = g.ctx.transfer_stats();
+        effect_direct(id, &vals, false);
+        let after = g.ctx.transfer_stats();
+        // Full- and half-resolution runs each upload once and download once.
+        assert_eq!(after.uploads - before.uploads, 2, "{id}: uploads");
+        assert_eq!(after.readbacks - before.readbacks, 2, "{id}: readbacks");
+    }
+}
+
 /// One GPU test at a time in this process: the calling test thread holds a process-wide lock
 /// until it exits (libtest runs every test on a thread of its own). wgpu's OpenGL backend (Mesa
 /// llvmpipe on FreeBSD, Linux without Vulkan) has one context lock per adapter and panics when a
@@ -52,9 +208,29 @@ pub(crate) fn gpu() -> Option<&'static Gpu> {
     static G: OnceLock<Result<Gpu, String>> = OnceLock::new();
     hold_gpu_lock();
     let g = G.get_or_init(|| {
+        // Readback mapping/allocation errors become None without necessarily retiring the
+        // context. Preserve their original messages alongside the failure's health snapshot.
+        struct GpuTestLog;
+        impl log::Log for GpuTestLog {
+            fn enabled(&self, metadata: &log::Metadata<'_>) -> bool {
+                metadata.level() <= log::Level::Warn && metadata.target().starts_with("effectcraft_gpu")
+            }
+
+            fn log(&self, record: &log::Record<'_>) {
+                if self.enabled(record.metadata()) {
+                    eprintln!("{} {}: {}", record.level(), record.target(), record.args());
+                }
+            }
+
+            fn flush(&self) {}
+        }
+        static LOGGER: GpuTestLog = GpuTestLog;
+        if log::set_logger(&LOGGER).is_ok() {
+            log::set_max_level(log::LevelFilter::Warn);
+        }
         let g = Gpu::try_headless();
         match &g {
-            Ok(g) => eprintln!("effectcraft-gpu tests: adapter {}", g.ctx.name),
+            Ok(g) => eprintln!("effectcraft-gpu tests: adapter {}, median {:?}", g.ctx.name, g.ctx.median_kernel),
             Err(e) => eprintln!("effectcraft-gpu tests: no GPU ({e}), skipping GPU comparisons"),
         }
         g
@@ -79,6 +255,35 @@ pub(crate) fn on_gl() -> bool {
     gpu().is_some_and(|g| g.ctx.name.ends_with("(Gl)"))
 }
 
+/// The test device is Mesa's software rasteriser, llvmpipe: on OpenGL, or as lavapipe on Vulkan
+/// (the Linux CI gate).
+pub(crate) fn on_llvmpipe() -> bool {
+    gpu().is_some_and(|g| g.ctx.name.starts_with("llvmpipe"))
+}
+
+thread_local! {
+    static LLVMPIPE_FLIPS: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+}
+
+/// Until the guard drops, comparisons on lavapipe get [`GL_BOUNDARY_FLIPS`] too. Only the tests
+/// that measured such flips there opt in (CC HexTile cell edges, CC Threshold RGB thresholds);
+/// every other comparison on the Linux gate stays exact.
+pub(crate) fn allow_llvmpipe_boundary_flips() -> impl Drop {
+    struct Reset;
+    impl Drop for Reset {
+        fn drop(&mut self) {
+            LLVMPIPE_FLIPS.with(|f| f.set(false));
+        }
+    }
+    LLVMPIPE_FLIPS.with(|f| f.set(true));
+    Reset
+}
+
+/// The boundary-flip allowance applies: OpenGL, or llvmpipe in a test that opted in.
+fn boundary_flips_allowed() -> bool {
+    on_gl() || (LLVMPIPE_FLIPS.with(std::cell::Cell::get) && on_llvmpipe())
+}
+
 /// On GL, the fraction of pixels allowed past the tolerance: pixels on a decision boundary (a
 /// hex cell's edge, a threshold, a corner pin's coverage edge, a median's rank tie) may land on
 /// the other side, since GL drivers may divide through a reciprocal and GLSL's `fma` need not be
@@ -255,7 +460,7 @@ pub(crate) fn check(label: &str, d: Option<Diff>, allow: f64) {
     let frac = d.over as f64 / d.total as f64;
     // Quantised depths: rounding-boundary flips (see the module docs).
     let (allow, cap) = if d.quantized && allow == 0.0 { (0.003, 4.0 / 255.0 + 1e-6) } else { (allow, f32::INFINITY) };
-    let (allow, cap) = if on_gl() { (allow.max(GL_BOUNDARY_FLIPS), f32::INFINITY) } else { (allow, cap) };
+    let (allow, cap) = if boundary_flips_allowed() { (allow.max(GL_BOUNDARY_FLIPS), f32::INFINITY) } else { (allow, cap) };
     assert!(frac <= allow && d.max <= cap, "{label}: {} of {} pixels over tolerance (max {:.6}); worst {:?}", d.over, d.total, d.max, d.worst);
     if d.over > 0 {
         eprintln!("{label}: {} of {} pixels over tolerance (max {:.6})", d.over, d.total, d.max);
@@ -419,7 +624,7 @@ fn layer_styles_collapsed_precomps_and_cpu_fallbacks() {
             b.blend_mode = BlendMode::Difference;
             (a, b)
         };
-        s.p.comp_mut(inner_id).unwrap().layers = vec![b, a];
+        s.p.comp_mut(inner_id).unwrap().layers = vec![b, a].into();
         let bg = s.footage(97, 61);
         s.push(bg);
         let mut pre = build::layer(&mut s.p, &s.comp, "Inner", LayerSource::Comp { item: inner_id }, (60, 40), None);
@@ -431,6 +636,12 @@ fn layer_styles_collapsed_precomps_and_cpu_fallbacks() {
         adj.switches.adjustment = true;
         s.effect(&mut adj, "ec.channel.invert", &[]);
         s.push(adj);
+        // An adjustment layer in another blend mode blends the adjusted comp in that mode (#2618).
+        let mut adj = s.solid([1.0, 1.0, 1.0], 70, 40);
+        adj.switches.adjustment = true;
+        adj.blend_mode = BlendMode::Screen;
+        set(&mut adj, "transform/opacity", Value::Scalar(60.0));
+        s.push(adj);
         check(&format!("collapse + adjustment {depth:?}"), compare_at(&s, opts(), Tick::ZERO), 0.0);
     }
 }
@@ -446,15 +657,28 @@ pub(crate) fn effect_direct(id: &str, vals: &[(&str, Value)], adjustment: bool)
     for (k, v) in vals {
         params.values.insert(k.to_string(), v.clone());
     }
+    let expect_empty = id == "ec.distort.ccblobbylize" && vals.iter().any(|(k, v)| *k == "cutAway" && matches!(v, Value::Scalar(x) if *x == 100.0));
     for scale in [1.0, 0.5] {
         let img = pattern(7, (size[0] * scale) as u32, (size[1] * scale) as u32);
         let buf = effectcraft_effects::Buf { img, offset: [0.0, 0.0], scale };
         let ctx = || effectcraft_effects::EffectCtx { params: &params, time: 0.25, layer_size: size, seed: 11, adjustment, env: Default::default() };
         let cpu = (spec.render)(&ctx(), buf.clone());
-        let out = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &buf, None).expect("the GPU runs the effect");
+        let started = std::time::Instant::now();
+        let out = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &buf, None).unwrap_or_else(|| {
+            panic!(
+                "the GPU runs {id} {vals:?} adj {adjustment} scale {scale}; elapsed={:?}, health={:?}, unavailable={:?}, transfers={:?}",
+                started.elapsed(),
+                g.ctx.check_health(),
+                g.ctx.unavailable_kernels(),
+                g.ctx.transfer_stats()
+            )
+        });
+        if expect_empty {
+            assert!(out.img.data.iter().all(|p| p[3] == 0.0), "{id} {vals:?} adj {adjustment} scale {scale}: Cut Away 100 produced non-zero alpha");
+        }
         assert_eq!((out.offset, out.scale), (cpu.offset, cpu.scale), "{id}: geometry");
         let d = diff(&cpu.img, &out.img, 1e-3);
-        let allow = if on_gl() { (d.total as f64 * GL_BOUNDARY_FLIPS) as usize } else { 0 };
+        let allow = if boundary_flips_allowed() { (d.total as f64 * GL_BOUNDARY_FLIPS) as usize } else { 0 };
         assert!(
             d.over <= allow,
             "{id} {vals:?} adj {adjustment} scale {scale}: {} of {} pixels over 1e-3 (max {}); worst {:?}",
@@ -491,12 +715,27 @@ pub(crate) fn c(r: f64, g: f64, b: f64) -> Value {
     Value::Color([r, g, b, 1.0])
 }
 
+#[test]
+fn small_blurs_fall_back_to_the_cpu() {
+    // #1939: small Gaussian sigmas and fractional box radii render on the CPU kernel.
+    for (id, vals) in [("ec.blur.gaussian", [("blurriness", n(0.9))]), ("ec.blur.fastbox", [("radius", n(1.5))])] {
+        let mut s = Scene::new(BitDepth::Bpc32);
+        let bg = s.solid([0.15, 0.1, 0.2], 97, 61);
+        s.push(bg);
+        let mut l = s.footage(70, 44);
+        s.effect(&mut l, id, &vals);
+        s.push(l);
+        check(&format!("{id} {vals:?}"), compare_at(&s, opts(), Tick::ZERO), 0.0);
+    }
+}
+
 #[test]
 fn gpu_effects_match_cpu() {
-    effect_case("ec.blur.gaussian", &[("blurriness", n(9.0))]);
-    effect_case("ec.blur.gaussian", &[("blurriness", n(4.0)), ("dimensions", Value::Enum(1)), ("repeatEdge", Value::Bool(true))]);
-    effect_case("ec.blur.fastbox", &[("radius", n(5.0)), ("iterations", n(2.0))]);
-    effect_case("ec.blur.fastbox", &[("radius", n(3.0)), ("dimensions", Value::Enum(2)), ("repeatEdge", Value::Bool(true))]);
+    // Sigma 3 px and up and even radii, so the half-scale pass stays on the GPU too (#1939).
+    effect_case("ec.blur.gaussian", &[("blurriness", n(14.0))]);
+    effect_case("ec.blur.gaussian", &[("blurriness", n(12.0)), ("dimensions", Value::Enum(1)), ("repeatEdge", Value::Bool(true))]);
+    effect_case("ec.blur.fastbox", &[("radius", n(6.0)), ("iterations", n(2.0))]);
+    effect_case("ec.blur.fastbox", &[("radius", n(4.0)), ("dimensions", Value::Enum(2)), ("repeatEdge", Value::Bool(true))]);
     effect_case("ec.blur.directional", &[("direction", n(30.0)), ("length", n(12.0))]);
     effect_case("ec.stylize.glow", &[("threshold", n(40.0)), ("radius", n(14.0)), ("intensity", n(1.5))]);
     effect_case("ec.stylize.glow", &[("colors", Value::Enum(1)), ("operation", Value::Enum(1)), ("colorA", c(1.0, 0.8, 0.1))]);
@@ -671,7 +910,7 @@ fn display_frames_are_mipmapped() {
         view_formats: &[],
     });
     let mut e = crate::context::Enc::new(&g.ctx);
-    e.encoder().copy_texture_to_texture(
+    e.record(&[]).copy_texture_to_texture(
         wgpu::TexelCopyTextureInfo { texture: &f.texture, mip_level: 1, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
         wgpu::TexelCopyTextureInfo { texture: &tex, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
         wgpu::Extent3d { width: w1, height: h1, depth_or_array_layers: 1 },
@@ -757,6 +996,71 @@ fn within_memory_returns_the_work_when_there_is_room() {
     assert_eq!((img.width, img.height), (64, 32));
 }
 
+/// A texture the device rejected (deliberately too wide), made outside any frame under a scope
+/// of its own: the view a frame then makes of it is the reported validation error.
+fn rejected_texture(g: &Gpu) -> wgpu::Texture {
+    let scope = g.ctx.device.push_error_scope(wgpu::ErrorFilter::Validation);
+    let too_wide = g.ctx.device.limits().max_texture_dimension_2d.saturating_add(1);
+    let t = g.ctx.device.create_texture(&wgpu::TextureDescriptor {
+        label: Some("deliberately too wide"),
+        size: wgpu::Extent3d { width: too_wide, height: 1, depth_or_array_layers: 1 },
+        mip_level_count: 1,
+        sample_count: 1,
+        dimension: wgpu::TextureDimension::D2,
+        format: wgpu::TextureFormat::Rgba8Unorm,
+        usage: wgpu::TextureUsages::TEXTURE_BINDING,
+        view_formats: &[],
+    });
+    assert!(pollster::block_on(scope.pop()).is_some(), "the device rejected the texture");
+    t
+}
+
+/// A frame that makes a view of an invalid texture ("Texture with '' label is invalid", #1319)
+/// fails alone: the validation error doesn't reach the device's handler (which retires the
+/// compositor for the session, and panics in tests), and the next frame composites on the GPU,
+/// read back, like the CPU.
+#[test]
+fn a_view_of_an_invalid_texture_fails_the_frame_not_the_compositor() {
+    hold_gpu_lock();
+    let Some(g) = Gpu::headless() else { return };
+    let rejected = rejected_texture(&g);
+    let err = g.within_memory(|| rejected.create_view(&Default::default())).expect_err("the frame fails");
+    assert!(matches!(&err, crate::FrameError::Validation(e) if e.contains("deliberately too wide")), "{err:?}");
+    assert!(g.ctx.check_health().is_ok(), "the compositor stays on: {:?}", g.ctx.check_health());
+    let s = blend_scene(BitDepth::Bpc32, BlendMode::Normal);
+    let cpu = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Cpu, ..opts() }).comp_frame_cpu(s.cid, Tick::ZERO);
+    let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..opts() });
+    r.accel = Some(&g);
+    let img = g.within_memory(|| g.render(&r, s.cid, Tick::ZERO)).expect("the next frame isn't rejected").expect("the GPU renders it");
+    let mut d = diff(&cpu, &img, tolerance(BitDepth::Bpc32));
+    d.quantized = false;
+    check("after a rejected frame", Some(d), 0.0);
+}
+
+/// No texture of a failed frame is reused: not one released while another encoder is still
+/// open (it waits for that encoder), nor one taken before the failure and handed back after.
+#[test]
+fn a_failed_frame_returns_no_texture_to_the_pool() {
+    hold_gpu_lock();
+    let Some(g) = Gpu::headless() else { return };
+    let rejected = rejected_texture(&g);
+    let earlier = g.within_memory(|| crate::context::Enc::new(&g.ctx).image(48, 16)).expect("an earlier frame");
+    let mut other = crate::context::Enc::new(&g.ctx);
+    other.record(&[]);
+    g.within_memory(|| (crate::context::Enc::new(&g.ctx).image(64, 32), rejected.create_view(&Default::default()))).expect_err("the frame fails");
+    drop(earlier);
+    drop(other);
+    let (hits, _) = g.ctx.pool_stats();
+    let (a, b) = g
+        .within_memory(|| {
+            let mut e = crate::context::Enc::new(&g.ctx);
+            (e.image(64, 32), e.image(48, 16))
+        })
+        .expect("the next frame");
+    assert_eq!(((a.width, a.height), (b.width, b.height)), ((64, 32), (48, 16)));
+    assert_eq!(g.ctx.pool_stats().0, hits, "no texture of the failed frame was reused");
+}
+
 /// A buffer whose allocation fails (here: over the device's buffer size limit; on Adreno an
 /// internal `ERROR_INITIALIZATION_FAILED`) is reported to the caller's error scope instead of
 /// panicking in `create_buffer_init`'s mapped range on a frame thread (#591).
@@ -831,7 +1135,7 @@ fn effects_whose_kernels_failed_render_on_the_cpu() {
     ctx.drop_kernel("pointwise");
     ctx.drop_kernel("box_h");
     let names: Vec<&str> = ctx.unavailable_kernels().iter().map(|(e, _)| *e).collect();
-    assert_eq!(names, ["pointwise", "box_h"]);
+    assert_eq!(names, ["box_h", "pointwise"]);
     let g = Gpu::from_context(ctx);
     for depth in [BitDepth::Bpc8, BitDepth::Bpc32] {
         let mut s = Scene::new(depth);
@@ -851,6 +1155,80 @@ fn effects_whose_kernels_failed_render_on_the_cpu() {
     }
 }
 
+/// #1590: effect kernels are built on first use, not with the context (building all of them
+/// up front kept Chrome's GPU process busy past its watchdog). Once asked for, every one of
+/// them builds on this device: a kernel no test dispatches still can't break unnoticed.
+#[test]
+fn effect_kernels_build_on_first_use() {
+    if gpu().is_none() {
+        return;
+    }
+    let Ok(ctx) = pollster::block_on(crate::context::GpuContext::request()) else { return };
+    let built = |ctx: &crate::context::GpuContext| ctx.effect_pipelines_built();
+    assert_eq!(built(&ctx), 0, "no effect kernel is built with the context");
+    let started = std::time::Instant::now();
+    ctx.build_all_kernels();
+    eprintln!("{}: built {} effect kernels in {:.2?}", ctx.name, built(&ctx), started.elapsed());
+    assert_eq!(ctx.unavailable_kernels(), vec![], "every effect kernel builds on {}", ctx.name);
+    assert!(ctx.has_kernel("classic3d") && ctx.has_kernel("math_probe"), "the up-front kernels build on {}", ctx.name);
+}
+
+/// WGSL cannot read the CPU's constants, so Glow's bright pass repeats them as literals; this
+/// ties them to `effects::GLOW_GAIN` / `GLOW_KNEE` (runs without a GPU).
+#[test]
+fn glow_constants_match_the_cpu() {
+    use effectcraft_effects::{GLOW_GAIN, GLOW_KNEE};
+    let kernels = include_str!("shaders/kernels.wgsl");
+    let want = format!("max({GLOW_GAIN:?} * (px.xyz / a - vec3<f32>(thr - {GLOW_KNEE:?})), vec3<f32>(0.0))");
+    assert!(kernels.contains(&want), "Glow's bright pass in kernels.wgsl is not `{want}`");
+}
+
+/// The GPU Tint gives After Effects 2026's greys for full-frame solids at its defaults (sRGB
+/// working space, not linearised): Rec. 601 weights, as the CPU (`color_fx::luma_601`).
+#[test]
+fn gpu_tint_defaults_match_after_effects_greys() {
+    let Some(g) = gpu() else {
+        // Visible skip (EFFECTCRAFT_REQUIRE_GPU=1 makes a missing adapter fail instead).
+        eprintln!("gpu_tint_defaults_match_after_effects_greys: skipped: no GPU adapter");
+        return;
+    };
+    for (col, want) in [([1.0, 0.0, 0.0], 76.0), ([0.0, 1.0, 0.0], 150.0), ([0.0, 0.0, 1.0], 29.0), ([0.5, 0.5, 0.5], 128.0)] {
+        let mut s = Scene::new(BitDepth::Bpc32);
+        s.p.settings.working_space = Some(ColorSpace::Srgb);
+        let mut l = s.solid(col, 97, 61);
+        s.effect(&mut l, "ec.color.tint", &[]);
+        s.push(l);
+        let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..opts() });
+        r.accel = Some(g);
+        let o = g.render(&r, s.cid, Tick::ZERO).expect("the GPU renders the frame").get(48, 30);
+        let want = want / 255.0;
+        assert!(o[..3].iter().all(|v| (v - want).abs() <= 1.0 / 255.0), "{col:?}: {o:?} vs {want}");
+    }
+}
+
+/// WGSL has no way to read the CPU's constants, so the kernels repeat them as literals; this
+/// ties each literal to its Rust source (runs without a GPU): Rec. 601 luma for Tint (`pointwise`
+/// op 1), Tritone and Luma Key / Extract, Black & White's tint weights and Exposure's 2.2 power.
+#[test]
+fn shader_constants_match_the_cpu() {
+    use effectcraft_effects::{BW_TINT_LUMA, EXPOSURE_LINEAR_GAMMA, LUMA_601};
+    let kernels = include_str!("shaders/kernels.wgsl");
+    let color = include_str!("shaders/fx_color.wgsl");
+    let key = include_str!("shaders/fx_key.wgsl");
+    let [r, g, b] = LUMA_601;
+    let dot = format!("dot(c, vec3<f32>({r}, {g}, {b}))");
+    assert!(kernels.contains(&format!("clamp({r} * c.x + {g} * c.y + {b} * c.z, 0.0, 1.0)")), "Tint luma in kernels.wgsl is not {LUMA_601:?}");
+    assert!(color.contains(&format!("clamp({dot}, 0.0, 1.0)")), "Tritone luma in fx_color.wgsl is not {LUMA_601:?}");
+    assert!(key.contains(&format!("return {dot};")), "fxk_key_luma in fx_key.wgsl is not {LUMA_601:?}");
+    let [r, g, b] = BW_TINT_LUMA;
+    assert!(color.contains(&format!("let w = vec3<f32>({r}, {g}, {b});")), "fxc_bw_tint weights are not {BW_TINT_LUMA:?}");
+    let gamma = EXPOSURE_LINEAR_GAMMA;
+    assert!(
+        kernels.contains(&format!("powz(abs(c[i]), {gamma})")) && kernels.contains(&format!("1.0 / {gamma})")),
+        "Exposure's power in kernels.wgsl is not {gamma}"
+    );
+}
+
 /// A layer whose bounds change every frame reads back at a new size each time: the staging
 /// buffers kept for reuse stay within budget instead of growing for the whole render (#2081).
 #[test]
@@ -1071,3 +1449,527 @@ fn upload_cache_drops_textures_of_freed_buffers() {
     let kept = g.ctx.upload_entries();
     assert!(kept <= before + 1, "the upload cache kept {kept} textures of freed buffers (had {before})");
 }
+
+/// The device the compositor owns asks for `MemoryUsage` so freed textures give
+/// their allocator blocks back, while its label and limits stay as they were.
+#[test]
+fn owned_devices_favour_memory_usage() {
+    let d = crate::context::device_descriptor(wgpu::Limits::default());
+    assert!(matches!(d.memory_hints, wgpu::MemoryHints::MemoryUsage));
+    assert_eq!(d.label, Some("effectcraft gpu"));
+    assert_eq!(d.required_limits.max_texture_dimension_2d, wgpu::Limits::default().max_texture_dimension_2d);
+}
+
+/// `RenderOpts::skip_hdr_step` (float outputs) skips Project Settings ▸ HDR on the GPU as on the
+/// CPU: both compositors agree, and the frame is the Clip frame with its over-range values.
+#[test]
+fn skipping_the_hdr_step_on_the_gpu_matches_clip() {
+    use effectcraft_project::HdrMode;
+    let Some(g) = gpu() else {
+        // Visible skip (EFFECTCRAFT_REQUIRE_GPU=1 makes a missing adapter fail instead).
+        eprintln!("skipping_the_hdr_step_on_the_gpu_matches_clip: skipped: no GPU adapter");
+        return;
+    };
+    for mode in [HdrMode::Compand, HdrMode::ToneMap] {
+        let mut s = blend_scene(BitDepth::Bpc32, BlendMode::Normal);
+        let mut bright = s.solid([3.0, 1.5, 0.5], 30, 20);
+        bright.blend_mode = BlendMode::Add;
+        s.push(bright);
+        s.p.settings.working_space = Some(ColorSpace::Srgb);
+        s.p.settings.linearize = true;
+        s.p.settings.hdr = mode;
+        let scene = RenderOpts { skip_hdr_step: true, ..opts() };
+        check(&format!("no HDR step {mode:?}"), compare_at(&s, scene, Tick::ZERO), 0.0);
+        let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..scene });
+        r.accel = Some(g);
+        let img = g.render(&r, s.cid, Tick::ZERO).expect("the GPU renders the frame");
+        let mut clip = s.p.clone();
+        clip.settings.hdr = HdrMode::Clip;
+        let want = Renderer::new(&clip, &Pattern, RenderOpts { backend: Backend::Cpu, ..opts() }).comp_frame_cpu(s.cid, Tick::ZERO);
+        let d = diff(&want, &img, tolerance(BitDepth::Bpc32));
+        assert_eq!(d.over, 0, "{mode:?}: max {} at {:?}", d.max, d.worst);
+        assert!(img.data.iter().any(|p| p[3] > 0.0 && p[0] / p[3] > 1.0), "{mode:?}: over-range values survive");
+    }
+}
+
+/// A GPU context of its own with a small pool budget, so other tests (sharing [`gpu`]) neither
+/// see the budget nor add to what the pool keeps.
+fn private_gpu(budget: usize) -> Option<Gpu> {
+    gpu()?;
+    let g = Gpu::headless()?;
+    g.context().set_pool_budget(budget);
+    Some(g)
+}
+
+/// Three effect calls while a frame encoder is open with recorded work reuse one set of
+/// textures: lent calls give them back at once, without waiting for that frame to submit.
+#[test]
+fn three_effect_calls_in_a_frame_reuse_one_set_of_textures() {
+    let Some(g) = private_gpu(8 << 20) else { return };
+    let ctx = g.context();
+    let mut frame = crate::context::Enc::new(ctx);
+    // Open the frame encoder with real work so the pool has an open id (an empty Enc::new does not).
+    let src = frame.image(64, 64);
+    let dst = frame.image(64, 64);
+    frame.copy_into(&src, &dst, 0, 0);
+    let (hits0, misses0) = ctx.pool_stats();
+    for _ in 0..3 {
+        let mut e = crate::context::Enc::lent(ctx);
+        let a = e.image(256, 256);
+        let b = e.image(256, 256);
+        drop((a, b));
+        drop(e);
+    }
+    let (hits, misses) = (ctx.pool_stats().0 - hits0, ctx.pool_stats().1 - misses0);
+    assert_eq!(misses, 2, "only the first effect call allocates: {hits} hits, {misses} misses");
+    assert_eq!(hits, 4, "calls 2 and 3 reuse both textures: {hits} hits, {misses} misses");
+    frame.submit();
+    drop((src, dst, frame));
+}
+
+/// Review of #1523: after the first frame fills the free list, later identical frames hit
+/// instead of allocating again.
+#[test]
+fn a_repeated_frame_reuses_after_the_first() {
+    let Some(g) = private_gpu(8 << 20) else { return };
+    let ctx = g.context();
+    let frame = || {
+        let mut e = crate::context::Enc::lent(ctx);
+        drop((e.image(256, 256), e.image(128, 64)));
+        drop(e);
+        ctx.pool_frame_end();
+    };
+    let (hits0, misses0) = ctx.pool_stats();
+    frame();
+    let (hits1, misses1) = (ctx.pool_stats().0 - hits0, ctx.pool_stats().1 - misses0);
+    assert_eq!(misses1, 2, "first frame allocates both sizes: {hits1} hits, {misses1} misses");
+    let (hits_a, misses_a) = ctx.pool_stats();
+    for _ in 0..3 {
+        frame();
+    }
+    let (hits, misses) = (ctx.pool_stats().0 - hits_a, ctx.pool_stats().1 - misses_a);
+    assert_eq!(misses, 0, "frames 2..4 allocate nothing: {hits} hits, {misses} misses");
+    assert!(hits >= 6, "frames 2..4 reuse both sizes: {hits} hits");
+}
+
+/// Review of #1523: every idle effect-call owner kept up to the pool budget of its own,
+/// outside the shared accounting, and there are as many as calls ever ran at once (16 frame
+/// threads: ~12 GB after a 4K render). Finished calls share the free list's one budget, and
+/// the end of a render drops it.
+#[test]
+fn idle_effect_calls_share_one_pool_budget() {
+    let budget = 8 << 20;
+    let Some(g) = private_gpu(budget) else { return };
+    let ctx = g.context();
+    // 16 effect calls in flight at once, each with three 1 MB working textures.
+    let mut encs: Vec<_> = (0..16).map(|_| crate::context::Enc::lent(ctx)).collect();
+    for e in &mut encs {
+        let imgs: Vec<_> = (0..3).map(|_| e.image(256, 256)).collect();
+        drop(imgs);
+    }
+    drop(encs);
+    let kept = ctx.pool_retained_bytes();
+    assert!(kept <= budget, "idle effect calls keep {} MB, budget {} MB", kept >> 20, budget >> 20);
+    // A later call reuses them instead of allocating.
+    let (hits, _) = ctx.pool_stats();
+    drop(crate::context::Enc::lent(ctx).image(256, 256));
+    assert_eq!(ctx.pool_stats().0, hits + 1, "a later effect call reuses a kept texture");
+    effectcraft_render::Accelerator::render_end(&g);
+    assert_eq!(ctx.pool_retained_bytes(), 0, "the end of a render drops the kept textures");
+}
+
+/// Review of #1523: a full free list rejected every new texture instead of evicting, so once
+/// sizes that no longer occur (per-frame blur bounds, padded layer sizes) filled it, a steady
+/// size never got a hit again: ~0.75 GB of dead weight plus an allocation per working texture.
+#[test]
+fn stale_sizes_do_not_starve_a_steady_size() {
+    let budget = 8 << 20;
+    let Some(g) = private_gpu(budget) else { return };
+    let ctx = g.context();
+    for k in 0..16 {
+        let mut e = crate::context::Enc::lent(ctx);
+        drop((e.image(256 + k, 256), e.image(256 + k, 256)));
+        drop(e);
+        ctx.pool_frame_end();
+    }
+    let (hits0, misses0) = ctx.pool_stats();
+    for _ in 0..10 {
+        let mut e = crate::context::Enc::lent(ctx);
+        drop((e.image(300, 300), e.image(300, 300)));
+        drop(e);
+        ctx.pool_frame_end();
+    }
+    let (hits, misses) = (ctx.pool_stats().0 - hits0, ctx.pool_stats().1 - misses0);
+    assert!(ctx.pool_retained_bytes() <= budget);
+    assert!(ctx.pool_evictions() > 0, "the stale sizes were evicted");
+    assert!(hits >= 18 && misses <= 2, "steady 300x300 calls after stale sizes: {hits} hits, {misses} misses");
+}
+
+/// Review of #1523: a `pool_frame_end` wait that clears none of the evicted bytes (timeout, or
+/// callbacks that never run) must not re-wait on every later frame while `dying` stays put.
+#[test]
+fn a_wait_without_progress_is_not_repeated() {
+    let Some(g) = private_gpu(8 << 20) else { return };
+    let ctx = g.context();
+    let phantom = 1 << 20;
+    ctx.pool_charge_dying(phantom as isize);
+    ctx.pool_frame_end();
+    assert_eq!(ctx.pool_waits(), 1, "first frame with dying bytes waits once");
+    for _ in 0..3 {
+        ctx.pool_frame_end();
+    }
+    assert_eq!(ctx.pool_waits(), 1, "no progress: later frames must not wait again");
+    ctx.pool_charge_dying(-(phantom as isize));
+    ctx.pool_frame_end();
+    assert_eq!(ctx.pool_waits(), 1, "dying cleared: poll only, stall cleared");
+    ctx.pool_charge_dying(phantom as isize);
+    ctx.pool_frame_end();
+    assert_eq!(ctx.pool_waits(), 2, "a new stall waits once");
+    // Partial progress: more dying while stalled → still no wait; drop below stalled → wait.
+    let extra = phantom / 2;
+    ctx.pool_charge_dying(extra as isize);
+    ctx.pool_frame_end();
+    assert_eq!(ctx.pool_waits(), 2, "dying above stalled: poll only");
+    ctx.pool_charge_dying(-(extra as isize + 1));
+    ctx.pool_frame_end();
+    assert_eq!(ctx.pool_waits(), 3, "dying dropped below stalled: wait again");
+    ctx.pool_charge_dying(-((phantom - 1) as isize));
+}
+
+/// RTX 3090 4K runs of #1523: evicting the least recently freed texture to fit every newcomer
+/// thrashes when a frame frees more than the budget in a repeating order (blur/glow
+/// intermediates): each free evicts the size the next call takes first, so every take
+/// missed (d_blurglow misses back at the old level, and evict + reallocate raised the peak).
+/// Sizes still in use stay; a kept subset of the cycle must keep hitting.
+#[test]
+fn repeating_sizes_over_the_budget_keep_hitting() {
+    let budget = 8 << 20;
+    let Some(g) = private_gpu(budget) else { return };
+    let ctx = g.context();
+    // Five ~2.1 MB sizes a frame (10.5 MB > 8 MB), one effect call each, same order every frame.
+    let sizes: Vec<(u32, u32)> = (0..5).map(|k| (256 + 8 * k, 512)).collect();
+    let frame = || {
+        for &(w, h) in &sizes {
+            drop(crate::context::Enc::lent(ctx).image(w, h));
+        }
+        ctx.pool_frame_end();
+    };
+    for _ in 0..3 {
+        frame();
+    }
+    let (hits0, misses0) = ctx.pool_stats();
+    let evicted0 = ctx.pool_evictions();
+    for _ in 0..10 {
+        frame();
+    }
+    let (hits, misses) = (ctx.pool_stats().0 - hits0, ctx.pool_stats().1 - misses0);
+    assert!(ctx.pool_retained_bytes() <= budget);
+    assert!(hits >= 30, "10 frames of a 5-size cycle over the budget: {hits} hits, {misses} misses");
+    assert_eq!(ctx.pool_evictions(), evicted0, "sizes in use were evicted");
+}
+
+/// Review of #1523: a lent call's image read by another, still open encoder must not go back to
+/// the lent call for reuse when its lease drops first: that encoder's read is not submitted yet.
+#[test]
+fn image_read_by_an_open_encoder_is_not_reused_by_its_lent_call() {
+    let Some(g) = private_gpu(8 << 20) else { return };
+    let ctx = g.context();
+    let mut frame = crate::context::Enc::new(ctx);
+    let mut lent = crate::context::Enc::lent(ctx);
+    let img = lent.image(64, 64);
+    let dst = frame.image(64, 64);
+    frame.copy_into(&img, &dst, 0, 0);
+    drop(img);
+    let (hits, _) = ctx.pool_stats();
+    drop(lent.image(64, 64));
+    assert_eq!(ctx.pool_stats().0, hits, "the lent call reused a texture an open encoder still reads");
+    drop(lent);
+    let (hits, _) = ctx.pool_stats();
+    drop(crate::context::Enc::lent(ctx).image(64, 64));
+    // The other 64x64 (the lent call's second image) is free; the read one still waits.
+    let (hits2, _) = ctx.pool_stats();
+    assert_eq!(hits2, hits + 1);
+    let (h, _) = ctx.pool_stats();
+    let mut e = crate::context::Enc::lent(ctx);
+    let a = e.image(64, 64);
+    let b = e.image(64, 64);
+    assert_eq!(ctx.pool_stats().0, h + 1, "the read texture waits for the open encoder");
+    drop((a, b, e));
+    frame.submit();
+    drop(dst);
+}
+
+/// The same through [`Gpu::effects`] from 16 threads at once, as an export's frame threads.
+#[test]
+fn effect_calls_on_16_threads_keep_one_pool_budget() {
+    if on_gl() {
+        return; // one context lock per adapter on wgpu's GL backend (see hold_gpu_lock)
+    }
+    let budget = 8 << 20;
+    let Some(g) = private_gpu(budget) else { return };
+    let g = &g;
+    let ctx = g.context();
+    let spec = effectcraft_effects::find("ec.blur.gaussian").unwrap();
+    let size = [240.0, 240.0];
+    let mut params =
+        effectcraft_effects::Params { values: spec.params.iter().map(|ps| (ps.id.to_string(), effectcraft_effects::default_value(ps, size))).collect() };
+    params.values.insert("blurriness".into(), Value::Scalar(6.0));
+    let buf = effectcraft_effects::Buf { img: pattern(3, 240, 240), offset: [0.0, 0.0], scale: 1.0 };
+    let go = std::sync::Barrier::new(16);
+    std::thread::scope(|s| {
+        for i in 0..16 {
+            let (params, buf, go) = (&params, &buf, &go);
+            s.spawn(move || {
+                go.wait();
+                for _ in 0..3 {
+                    let fx = effectcraft_effects::EffectCtx { params, time: 0.0, layer_size: size, seed: i, adjustment: false, env: Default::default() };
+                    effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: fx }], buf, None).expect("the GPU runs the effect");
+                }
+            });
+        }
+    });
+    let kept = ctx.pool_retained_bytes();
+    assert!(kept <= budget, "16 threads of effect calls keep {} MB, budget {} MB", kept >> 20, budget >> 20);
+    effectcraft_render::Accelerator::render_end(g);
+    assert_eq!(ctx.pool_retained_bytes(), 0, "the end of a render drops the kept textures");
+}
+
+/// Sceptic r2 of #1523: only the export pipeline ended frames, so off export (preview, remote
+/// frames) the pool's clock stood still, no size ever went stale and a full free list dropped
+/// every newcomer again. Frames rendered through [`effectcraft_render::passes::comp_frame`]
+/// (no explicit `pool_frame_end`) must age the sizes they did not ask for.
+#[test]
+fn frames_outside_the_export_pipeline_age_the_pool() {
+    let budget = 8 << 20;
+    let Some(g) = private_gpu(budget) else { return };
+    let ctx = g.context();
+    // Fill the free list with sizes no frame asks for again.
+    for k in 0..16 {
+        let mut e = crate::context::Enc::lent(ctx);
+        drop((e.image(256 + k, 256), e.image(256 + k, 256)));
+    }
+    let evicted0 = ctx.pool_evictions();
+    let s = blend_scene(BitDepth::Bpc8, BlendMode::Screen);
+    let mut r = Renderer::new(&s.p, &Pattern, opts());
+    r.accel = Some(&g);
+    for _ in 0..3 {
+        effectcraft_render::passes::block_on(effectcraft_render::passes::comp_frame(&r, s.cid, Tick::ZERO));
+    }
+    for _ in 0..4 {
+        let mut e = crate::context::Enc::lent(ctx);
+        drop((e.image(300, 300), e.image(300, 300)));
+    }
+    assert!(ctx.pool_retained_bytes() <= budget);
+    assert!(ctx.pool_evictions() > evicted0, "rendered frames did not age the pool: stale sizes were never evicted");
+}
+
+/// #1550: with a small `EFFECTCRAFT_GPU_MEMCAP_MB` on a backend that reports allocator usage
+/// (Vulkan, DX12), `Enc::mem_gate` stays quiet when the bytes over the cap are non-reclaimable
+/// (live uploads), submits and waits when dropped working textures push reclaimable bytes over
+/// the cap, carries on without retiring the context if a wait times out, warns once when a
+/// frame's kept memory alone exceeds the cap, waits between two frames that fit only one at a
+/// time, and recovers budget when a frame is dropped unfinished.
+#[test]
+fn mem_gate_reclaims_over_cap_and_tolerates_timeout() {
+    const ENV: &str = "EFFECTCRAFT_GPU_MEMCAP_TEST_CHILD";
+    const SKIP: &str = "mem_gate_reclaims_over_cap_and_tolerates_timeout: skipped";
+    if std::env::var_os(ENV).is_none() {
+        let exe = std::env::current_exe().expect("test binary path");
+        let out = std::process::Command::new(exe)
+            .env(ENV, "1")
+            .env("EFFECTCRAFT_GPU_MEMCAP_MB", "8")
+            .args(["--exact", "tests::mem_gate_reclaims_over_cap_and_tolerates_timeout", "--nocapture"])
+            .output()
+            .expect("spawn child test process");
+        assert!(
+            out.status.success(),
+            "child test failed (status {:?}):\nstdout:\n{}\nstderr:\n{}",
+            out.status.code(),
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr),
+        );
+        // The child's output is captured: pass its skip line on.
+        String::from_utf8_lossy(&out.stderr).lines().filter(|l| l.starts_with(SKIP)).for_each(|l| eprintln!("{l}"));
+        return;
+    }
+
+    // EFFECTCRAFT_REQUIRE_GPU=1 (inherited from the parent) fails on a GPU that didn't start.
+    let g = Gpu::try_headless();
+    let Some(g) = require_gpu("mem_gate child", g.as_ref()) else {
+        eprintln!("{SKIP}: no GPU ({})", g.as_ref().err().map_or("", String::as_str));
+        return;
+    };
+    let ctx = g.context();
+    if ctx.allocated_bytes() == 0 {
+        // The backend has no allocator report (Metal, GL, WebGPU): the gate never engages.
+        eprintln!("{SKIP}: adapter {} reports no allocator usage", ctx.name);
+        return;
+    }
+
+    // 1. Non-reclaimable memory (upload cache) over the 8 MiB cap must not trigger waits.
+    let img = pattern(7, 512, 512); // 4 MiB in RGBA f32
+    let held: Vec<_> = (0..3)
+        .map(|i| {
+            let b = std::sync::Arc::new(effectcraft_effects::Buf { img: img.clone(), offset: [i as f64, 0.0], scale: 1.0 });
+            ctx.upload_buf(&b).expect("upload");
+            b
+        })
+        .collect();
+    let idx = ctx.queue.submit([]);
+    let _ = ctx.poll_readbacks(wgpu::PollType::Wait { submission_index: Some(idx), timeout: Some(std::time::Duration::from_secs(1)) });
+    assert!(ctx.allocated_bytes() > (8 << 20), "uploads should put the allocator over the 8 MiB cap (got {} B)", ctx.allocated_bytes());
+    {
+        let mut e = crate::context::Enc::new(ctx);
+        for _ in 0..16 {
+            e.mem_gate();
+        }
+    }
+    assert_eq!(ctx.memcap_waits(), 0, "mem_gate must not wait when over-cap memory is held by live uploads");
+    assert!(ctx.memcap_warned(), "uploads alone over the cap log the one-time warning");
+    drop(held);
+    ctx.clear_uploads();
+    ctx.pool_frame_end();
+
+    // 2. Dropped working textures over the 2 MiB pool budget and 8 MiB cap trigger a wait and
+    // free the dropped textures in wgpu's allocator.
+    let mut e = crate::context::Enc::new(ctx);
+    let mut peak_before_wait = 0u64;
+    for k in 0..16u32 {
+        let a = e.image(512 + k * 16, 256); // ~2 MiB each, distinct sizes
+        let b = e.image(512 + k * 16, 256);
+        e.copy_into(&a, &b, 0, 0);
+        drop((a, b));
+        peak_before_wait = peak_before_wait.max(ctx.allocated_bytes());
+        e.mem_gate();
+    }
+    drop(e);
+    assert!(peak_before_wait > (8 << 20), "working textures should push allocator over 8 MiB before a wait (peak {} B)", peak_before_wait);
+    let waits = ctx.memcap_waits();
+    assert!(waits > 0, "mem_gate should have waited once reclaimable bytes exceeded the cap");
+    assert!(
+        ctx.allocated_bytes() < peak_before_wait,
+        "waiting should reclaim dropped textures (peak {} B, after {} B)",
+        peak_before_wait,
+        ctx.allocated_bytes()
+    );
+    assert!(ctx.check_health().is_ok());
+    ctx.pool_frame_end();
+
+    // 3. A frame bigger than the cap: live GpuImages count in Pool::leased (kept for every owner),
+    // so three live 512×512 RGBA f32 images (12 MiB) make kept alone exceed the 8 MiB cap.
+    // Waiting cannot free them; mem_gate must not add waits (warning already asserted in section 1).
+    let waits_before_big = ctx.memcap_waits();
+    {
+        let mut e = crate::context::Enc::new(ctx);
+        let live = [e.image(512, 512), e.image(512, 512), e.image(512, 512)];
+        for _ in 0..16 {
+            e.mem_gate();
+        }
+        assert_eq!(ctx.memcap_waits(), waits_before_big, "a frame whose live images alone exceed the cap must not wait");
+        assert!(ctx.check_health().is_ok());
+        drop(live);
+    }
+    ctx.pool_frame_end();
+
+    // 4. Two frames that fit only one at a time: frame 1 creates ~6 MiB, copies, submits its
+    // work and drops its images, so wgpu holds them until the submission is done and polled.
+    // Frame 2 keeps ~6 MiB of new live images and waits for frame 1's reclaimable memory.
+    {
+        let mut e1 = crate::context::Enc::new(ctx);
+        let hold = [e1.image(512, 384), e1.image(512, 384)]; // 6 MiB
+        e1.copy_into(&hold[0], &hold[1], 0, 0);
+        e1.submit();
+        drop((hold, e1));
+    }
+    let allocated_after_f1 = ctx.allocated_bytes();
+    let waits_before_pair = ctx.memcap_waits();
+    let allocated_before_gate;
+    let downloaded;
+    {
+        let mut e2 = crate::context::Enc::new(ctx);
+        let a = e2.image(520, 384);
+        let b = e2.image(504, 384); // ~6 MiB together, sizes distinct from each other and frame 1
+        e2.copy_into(&b, &a, 0, 0);
+        allocated_before_gate = ctx.allocated_bytes();
+        assert!(
+            allocated_before_gate > (8 << 20),
+            "frame 1's unreclaimed memory ({allocated_after_f1} B) plus frame 2's live images should exceed the 8 MiB cap (got {allocated_before_gate} B)"
+        );
+        for _ in 0..16 {
+            e2.mem_gate();
+        }
+        assert!(ctx.memcap_waits() > waits_before_pair, "frame 2 should wait for frame 1's reclaimable memory (its own images stay live)");
+        assert!(
+            ctx.allocated_bytes() < allocated_before_gate,
+            "waiting should reclaim frame 1's dropped textures (before {} B, after {} B)",
+            allocated_before_gate,
+            ctx.allocated_bytes()
+        );
+        downloaded = e2.download(&a);
+    }
+    assert!(downloaded.is_some(), "frame 2 must finish with a correct download after waiting");
+    ctx.pool_frame_end();
+
+    // 5. A failed / unfinished frame releases its budget: drop an Enc mid-flight, then a
+    // following frame must not wait once the pool has drained.
+    let baseline = ctx.allocated_bytes();
+    {
+        let mut e = crate::context::Enc::new(ctx);
+        let _hold = [e.image(512, 512), e.image(512, 512), e.image(480, 480)];
+        // Drop without finishing: same path as a frame that errors before submit.
+    }
+    ctx.pool_frame_end();
+    let _ = ctx.poll_readbacks(wgpu::PollType::Poll);
+    assert!(
+        ctx.allocated_bytes() <= baseline + (2 << 20) + (1 << 20),
+        "dropped frame must release to baseline + pool budget (2 MiB) with slack (got {} B, baseline {} B)",
+        ctx.allocated_bytes(),
+        baseline
+    );
+    let waits_after_drop = ctx.memcap_waits();
+    {
+        let mut e = crate::context::Enc::lent(ctx);
+        for _ in 0..16 {
+            e.mem_gate();
+        }
+    }
+    assert_eq!(ctx.memcap_waits(), waits_after_drop, "a following frame must not wait after a dropped frame released its memory");
+
+    // 6. A zero-timeout wait must not retire the context or break subsequent renders.
+    ctx.set_memcap_wait_timeout(std::time::Duration::ZERO);
+    {
+        let mut e = crate::context::Enc::lent(ctx);
+        for k in 0..16u32 {
+            let a = e.image(384 + k * 16, 256);
+            let b = e.image(384 + k * 16, 256);
+            e.copy_into(&a, &b, 0, 0);
+            drop((a, b));
+            e.mem_gate();
+        }
+    }
+    assert!(ctx.memcap_waits() > waits_after_drop, "mem_gate should have fired again under zero timeout");
+    assert!(ctx.check_health().is_ok(), "a mem_gate wait timeout must carry on without retiring the context");
+    let s = blend_scene(BitDepth::Bpc8, BlendMode::Screen);
+    let r = Renderer::new(&s.p, &Pattern, opts());
+    assert!(g.render(&r, s.cid, Tick::ZERO).is_some(), "context renders normally after a zero-timeout mem_gate wait");
+
+    // 7. Non-blocking polls (`Gpu::poll`, `pool_frame_end`) skip when `poll_lock` is held by
+    // another thread, and `read_buffer` waits for `poll_lock` without consuming its deadline.
+    // Drain any dying pool textures first so the timed path takes Poll (try_lock) rather than Wait.
+    ctx.set_memcap_wait_timeout(crate::readback::TIMEOUT);
+    ctx.pool_frame_end();
+    let (locked_tx, locked_rx) = std::sync::mpsc::channel();
+    std::thread::scope(|sc| {
+        sc.spawn(|| {
+            let _guard = ctx.lock_poll_for_test();
+            locked_tx.send(()).unwrap();
+            std::thread::sleep(std::time::Duration::from_millis(60));
+        });
+        locked_rx.recv().unwrap();
+        let t0 = std::time::Instant::now();
+        g.poll();
+        ctx.pool_frame_end();
+        assert!(t0.elapsed() < std::time::Duration::from_millis(30), "non-blocking polls must not wait on a contended poll_lock (took {:?})", t0.elapsed());
+        assert!(g.render(&r, s.cid, Tick::ZERO).is_some(), "readback waits for poll_lock and succeeds without retiring the context");
+    });
+}
diff --git a/crates/gpu/src/tests_adjust.rs b/crates/gpu/src/tests/adjust.rs
similarity index 98%
rename from crates/gpu/src/tests_adjust.rs
rename to crates/gpu/src/tests/adjust.rs
index 5635e08e1..39438d43e 100644
--- a/crates/gpu/src/tests_adjust.rs
+++ b/crates/gpu/src/tests/adjust.rs
@@ -83,7 +83,7 @@ fn track_mattes_limit_gpu_adjustments_like_the_cpu() {
             set(&mut matte, "transform/rotation", Value::Scalar(10.0));
             let mid = s.push(matte);
             let c = s.p.comp_mut(s.cid).unwrap();
-            let adj = c.layers.iter_mut().find(|l| l.switches.adjustment).unwrap();
+            let adj = c.layers.find_mut(|l| l.switches.adjustment).unwrap();
             adj.track_matte = Some(TrackMatte { layer: mid, kind });
             check(&format!("matted adjustment {kind:?} {depth:?}"), compare_at(&s, opts(), Tick::ZERO), 0.0);
         }
diff --git a/crates/gpu/src/tests_adv3d.rs b/crates/gpu/src/tests/adv3d.rs
similarity index 86%
rename from crates/gpu/src/tests_adv3d.rs
rename to crates/gpu/src/tests/adv3d.rs
index 231dc9763..4914c4912 100644
--- a/crates/gpu/src/tests_adv3d.rs
+++ b/crates/gpu/src/tests/adv3d.rs
@@ -5,7 +5,7 @@
 //! edges may be covered by the other neighbour. Interior pixels agree within 2/255; at most
 //! 1.5 % of pixels (silhouettes) may differ more. Skipped without an adapter.
 
-use effectcraft_keyframe::Value;
+use effectcraft_keyframe::{Gradient, Value};
 use effectcraft_project::build;
 use effectcraft_project::{Comp, ItemId, ItemKind, LayerSource, LightKind, PrimitiveKind, Project, Renderer as R3, Solid};
 use effectcraft_render::three_d::adv::{self, Scene};
@@ -38,7 +38,8 @@ fn set(l: &mut effectcraft_project::Layer, path: &str, v: Value) {
 }
 
 /// Primitives with metal/dielectric materials, a shadow-casting spot light and a point light,
-/// an environment light, a semi-transparent textured card.
+/// a shadow-casting Environment light over a sky-gradient environment layer, a semi-transparent
+/// textured card.
 pub(crate) fn scene_project() -> (Project, ItemId) {
     let mut p = Project::default();
     let mut c = Comp::new(240, 160, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
@@ -73,12 +74,29 @@ pub(crate) fn scene_project() -> (Project, ItemId) {
         set(l, "transform/position", Value::Vec3([120.0, 80.0, -60.0]));
         set(l, "transform/rotationY", Value::Scalar(30.0));
     });
-    let env = p.add_item("E", Default::default(), None, ItemKind::Solid(Solid { color: [0.6, 0.7, 1.0], width: 32, height: 16, pixel_aspect: 1.0 }));
-    add(&mut p, cid, LayerSource::Solid { item: env }, |l| {
-        l.environment = true;
+    // The Environment Layer: a sky-to-ground gradient (its dominant region, the bright sky,
+    // shadows the scene from above).
+    add(&mut p, cid, LayerSource::Shape, |l| {
         l.switches.three_d = true;
+        let mut next = 10_000u64;
+        let ids = &mut build::Ids(&mut next);
+        let rect = build::shape_rect(ids, [240.0, 160.0], [0.0, 0.0], 0.0);
+        let gfill = build::shape_gradient_fill(
+            ids,
+            false,
+            [0.0, -80.0],
+            [0.0, 80.0],
+            Gradient { colors: vec![(0.0, [1.0, 1.0, 1.0, 1.0]), (1.0, [0.04, 0.05, 0.08, 1.0])], opacities: vec![(0.0, 1.0), (1.0, 1.0)] },
+        );
+        let g = build::shape_group(ids, "Sky", vec![rect, gfill]);
+        l.props.sub_mut("contents").unwrap().children.push(g.into());
+        l.environment = true;
+    });
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/intensity", Value::Scalar(50.0));
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+        set(l, "lightOptions/shadowDiffusion", Value::Scalar(6.0));
     });
-    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| set(l, "lightOptions/intensity", Value::Scalar(50.0)));
     add(&mut p, cid, LayerSource::Light { kind: LightKind::Spot }, |l| {
         set(l, "transform/position", Value::Vec3([40.0, -120.0, -200.0]));
         set(l, "transform/poi", Value::Vec3([120.0, 100.0, 0.0]));
@@ -96,7 +114,17 @@ pub(crate) fn scene_project() -> (Project, ItemId) {
 
 pub(crate) fn scene(p: &Project, cid: ItemId) -> Scene {
     let r = Renderer::new(p, &NoFootage, RenderOpts::default());
-    let ctx = EvalCtx { project: p, comp_id: cid, comp: p.comp(cid).unwrap(), time: Tick::ZERO, expr: None, footage: None };
+    let ctx = EvalCtx {
+        project: p,
+        comp_id: cid,
+        comp: p.comp(cid).unwrap(),
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let run: Vec<&effectcraft_project::Layer> = ctx.comp.layers.iter().rev().filter(|l| l.is_3d() && l.has_video()).collect();
     adv::scene_of(&r, &ctx, &run, (ctx.comp.width, ctx.comp.height))
 }
@@ -135,6 +163,8 @@ fn gpu_matches_cpu_lit_scene() {
     let (p, cid) = scene_project();
     let s = scene(&p, cid);
     assert!(!s.shadows.is_empty() && s.env.is_some() && s.opaque_count < s.indices.len() as u32);
+    // The Environment light casts its shadow (the sky gradient's dominant direction).
+    assert!(s.env.is_some_and(|e| e.shadow >= 0 && e.sun != [0.0; 3]), "the environment shadow map is built");
     compare(&s, &g);
 }
 
@@ -167,6 +197,44 @@ fn gpu_matches_cpu_shadow_catcher() {
     compare(&s, &g);
 }
 
+#[test]
+fn gpu_matches_cpu_wide_penumbrae() {
+    // Both lights cast with wide Shadow Diffusion. Penumbrae cover much of the frame, so a
+    // backend drift in the PCF (jitter hash, tap grid, receiver-plane compare) would hide
+    // inside the scene-wide 1.5 % silhouette budget; here every shadowed pixel off a
+    // silhouette must match the CPU within 2/255.
+    let Some(g) = gpu() else { return };
+    let (mut p, cid) = scene_project();
+    let comp = p.comp_mut(cid).unwrap();
+    set(&mut comp.layers[1], "lightOptions/shadowDiffusion", Value::Scalar(48.0));
+    set(&mut comp.layers[0], "lightOptions/castsShadows", Value::Bool(true));
+    set(&mut comp.layers[0], "lightOptions/shadowDiffusion", Value::Scalar(30.0));
+    let s = scene(&p, cid);
+    let (cpu, gt) = (adv::raster::render(&s), g.raster_3d(&s).expect("gpu raster"));
+    for l in p.comp_mut(cid).unwrap().layers.iter_mut().take(2) {
+        set(l, "lightOptions/castsShadows", Value::Bool(false));
+    }
+    let unshadowed = adv::raster::render(&scene(&p, cid));
+    let w = cpu.width as usize;
+    let luma = |c: &[f32; 4]| (c[0] + c[1] + c[2]) / 3.0;
+    // Off a silhouette: the pixel and its four neighbours see one continuous surface.
+    let smooth = |i: usize| -> bool {
+        let (x, y) = (i % w, i / w);
+        let d = cpu.depth[i];
+        x > 0
+            && y > 0
+            && x + 1 < w
+            && i + w < cpu.depth.len()
+            && d.is_finite()
+            && [i - 1, i + 1, i - w, i + w].iter().all(|&j| (cpu.depth[j] - d).abs() < 0.01 * d.abs().max(1.0))
+    };
+    let shadowed: Vec<usize> = (0..cpu.color.len()).filter(|&i| luma(&unshadowed.color[i]) - luma(&cpu.color[i]) > 0.01 && smooth(i)).collect();
+    let bad = shadowed.iter().filter(|&&i| (0..4).any(|k| (cpu.color[i][k] - gt.color[i][k]).abs() / cpu.color[i][k].abs().max(1.0) > 2.0 / 255.0)).count();
+    eprintln!("adv3d wide penumbrae: {bad}/{} shadowed pixels beyond 2/255", shadowed.len());
+    assert!(shadowed.len() > 2000, "the shadows cover a large area: {}", shadowed.len());
+    assert!(bad as f64 <= 0.002 * shadowed.len() as f64, "{bad}/{} shadowed pixels differ", shadowed.len());
+}
+
 #[test]
 fn gpu_raster_perf_smoke() {
     let Some(g) = gpu() else { return };
@@ -213,7 +281,7 @@ pub(crate) fn dof_mb_project() -> (Project, ItemId) {
     c.enable_motion_blur = true;
     c.motion_blur_samples = 6;
     // The sphere moves 40 px per frame.
-    let sphere = c.layers.iter_mut().find(|l| matches!(l.source, LayerSource::Primitive { kind: PrimitiveKind::Sphere })).unwrap();
+    let sphere = c.layers.find_mut(|l| matches!(l.source, LayerSource::Primitive { kind: PrimitiveKind::Sphere })).unwrap();
     sphere.switches.motion_blur = true;
     sphere.props.prop_mut("transform/position").unwrap().keys = vec![
         effectcraft_keyframe::Keyframe::new(Tick::ZERO, Value::Vec3([80.0, 95.0, 0.0])),
@@ -239,7 +307,17 @@ pub(crate) fn off_share(a: &[[f32; 4]], b: &[[f32; 4]]) -> (f64, f32) {
 }
 
 pub(crate) fn run_of(p: &Project, cid: ItemId) -> (EvalCtx<'_>, Vec<&effectcraft_project::Layer>) {
-    let ctx = EvalCtx { project: p, comp_id: cid, comp: p.comp(cid).unwrap(), time: Tick::ZERO, expr: None, footage: None };
+    let ctx = EvalCtx {
+        project: p,
+        comp_id: cid,
+        comp: p.comp(cid).unwrap(),
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let run: Vec<&effectcraft_project::Layer> = ctx.comp.layers.iter().rev().filter(|l| l.is_3d() && l.has_video()).collect();
     (ctx, run)
 }
@@ -373,7 +451,7 @@ fn gpu_compositor_draws_advanced_3d_runs_on_the_device() {
     eprintln!("walk: {:.3} % beyond 1/255 (max {max:.4})", share * 100.0);
     assert!(share <= 0.01, "{:.3} % of pixels differ", share * 100.0);
     // A blend mode in the run takes the 2D compositing path (`SplitRun`, also on the GPU).
-    p.comp_mut(cid).unwrap().layers.iter_mut().find(|l| l.switches.three_d && !l.is_light() && l.source.is_av()).unwrap().blend_mode =
+    p.comp_mut(cid).unwrap().layers.find_mut(|l| l.switches.three_d && !l.is_light() && l.source.is_av()).unwrap().blend_mode =
         effectcraft_color::BlendMode::Screen;
     let (ctx, run) = run_of(&p, cid);
     assert!(Renderer::new(&p, &NoFootage, RenderOpts::default()).prepare_adv_run(&ctx, &run, (240, 160)).is_none());
@@ -494,12 +572,12 @@ fn gpu_compositor_draws_split_advanced_3d_runs_and_skies() {
             });
         }
         let c = p.comp_mut(cid).unwrap();
-        let env = c.layers.iter_mut().find(|l| l.environment).unwrap();
+        let env = c.layers.find_mut(|l| l.environment).unwrap();
         env.props.sub_mut("effects").unwrap().children.push(ramp.into());
         let ids: Vec<_> = c.layers.iter().filter(|l| l.switches.three_d && !l.is_light() && !l.environment && l.source.is_av()).map(|l| l.id).collect();
         let top = c.layers[0].id;
         fn by_id(c: &mut Comp, id: effectcraft_project::LayerId) -> &mut effectcraft_project::Layer {
-            c.layers.iter_mut().find(|l| l.id == id).unwrap()
+            c.layers.find_mut(|l| l.id == id).unwrap()
         }
         match case {
             0 => by_id(c, ids[1]).blend_mode = effectcraft_color::BlendMode::Screen,
@@ -517,7 +595,7 @@ fn gpu_compositor_draws_split_advanced_3d_runs_and_skies() {
             }
             _ => {
                 // An environment background behind the run, and the 2D track matte.
-                c.layers.iter_mut().find(|l| l.environment).unwrap().environment_background = true;
+                c.layers.find_mut(|l| l.environment).unwrap().environment_background = true;
                 by_id(c, ids[0]).track_matte = Some(effectcraft_project::TrackMatte { layer: top, kind: effectcraft_project::MatteKind::Alpha });
             }
         }
diff --git a/crates/gpu/src/tests_deferred.rs b/crates/gpu/src/tests/deferred.rs
similarity index 98%
rename from crates/gpu/src/tests_deferred.rs
rename to crates/gpu/src/tests/deferred.rs
index b6e43b55f..e8778b628 100644
--- a/crates/gpu/src/tests_deferred.rs
+++ b/crates/gpu/src/tests/deferred.rs
@@ -30,7 +30,7 @@ pub(crate) fn deferred_gpu() -> Option<(&'static Gpu, std::sync::MutexGuard<'sta
         g
     });
     let g = crate::tests::require_gpu("deferred gpu tests", g.as_ref())?;
-    Some((g, LOCK.lock().unwrap_or_else(|e| e.into_inner())))
+    Some((g, LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner)))
 }
 
 /// Footage with GPU effects around a CPU-only one, a solid with Glow, and a precomp whose
diff --git a/crates/gpu/src/tests_deferred_jobs.rs b/crates/gpu/src/tests/deferred_jobs.rs
similarity index 95%
rename from crates/gpu/src/tests_deferred_jobs.rs
rename to crates/gpu/src/tests/deferred_jobs.rs
index 7f10f53d4..7e5edbedd 100644
--- a/crates/gpu/src/tests_deferred_jobs.rs
+++ b/crates/gpu/src/tests/deferred_jobs.rs
@@ -8,10 +8,10 @@ use effectcraft_render::three_d::adv;
 use effectcraft_render::{Accelerator, Backend, LayerCache, NoFootage, RenderOpts, Renderer};
 use effectcraft_time::Tick;
 
+use crate::tests::adv3d::{off_share, run_of, scene, scene_project};
+use crate::tests::deferred::{deferred_gpu, render_passes};
+use crate::tests::particles::{Host, agree, params};
 use crate::tests::{Pattern, diff, n, tolerance};
-use crate::tests_adv3d::{off_share, run_of, scene, scene_project};
-use crate::tests_deferred::{deferred_gpu, render_passes};
-use crate::tests_particles::{Host, agree, params};
 
 /// The device's readbacks have landed (the browser's event loop; natively a poll).
 fn settle(g: &crate::Gpu) {
@@ -87,7 +87,7 @@ fn advanced_3d_resolves_in_passes() {
 #[test]
 fn job_frames_render_in_passes() {
     let Some((g, _lock)) = deferred_gpu() else { return };
-    let s = crate::tests_deferred::scene();
+    let s = crate::tests::deferred::scene();
     let t = Tick::from_seconds_f64(0.5);
     let cache = LayerCache::default();
     cache.set_gate(g.miss_gate());
diff --git a/crates/gpu/src/tests_fx_color.rs b/crates/gpu/src/tests/fx_color.rs
similarity index 100%
rename from crates/gpu/src/tests_fx_color.rs
rename to crates/gpu/src/tests/fx_color.rs
diff --git a/crates/gpu/src/tests_fx_depth.rs b/crates/gpu/src/tests/fx_depth.rs
similarity index 88%
rename from crates/gpu/src/tests_fx_depth.rs
rename to crates/gpu/src/tests/fx_depth.rs
index b84b4849d..f60f31e3e 100644
--- a/crates/gpu/src/tests_fx_depth.rs
+++ b/crates/gpu/src/tests/fx_depth.rs
@@ -208,6 +208,13 @@ fn on() -> Value {
     Value::Bool(true)
 }
 
+/// #474: every effect done here reads aux channels, so the session gives the media layer its
+/// footage ([`effectcraft_effects::reads_aux`]).
+#[test]
+fn every_effect_here_reads_aux() {
+    assert!(crate::fx_depth::IDS.iter().all(|i| effectcraft_effects::reads_aux(i)));
+}
+
 #[test]
 fn channel_extract() {
     case("ec.3d.channelextract", &[("blackPoint", n(0.0)), ("whitePoint", n(1200.0))]);
@@ -251,6 +258,27 @@ fn ids_and_cryptomatte() {
     case("ec.3d.cryptomatte", &[("selection", Value::Str("alpha".into())), ("matteOnly", on())]);
 }
 
+/// The GPU skips the ID colours for displays that do not read them
+/// ([`effectcraft_effects::CryptoAux::for_display`]): every display × Matte Only must still match
+/// the CPU effect, so a shader that starts reading RGB in another mode fails here. Matte Only is
+/// checked both ways: the matte in RGB over alpha 1 (#3127) and, for older projects, in alpha too.
+#[test]
+fn cryptomatte_every_display_matches_the_cpu() {
+    for display in 0..3 {
+        for (matte_only, in_alpha) in [(false, false), (true, false), (true, true)] {
+            case(
+                "ec.3d.cryptomatte",
+                &[
+                    ("selection", Value::Str("beta, delta".into())),
+                    ("display", e(display)),
+                    ("matteOnly", Value::Bool(matte_only)),
+                    (effectcraft_effects::MATTE_ONLY_IN_ALPHA, Value::Bool(in_alpha)),
+                ],
+            );
+        }
+    }
+}
+
 #[test]
 fn extractor() {
     case("ec.3d.extractor", &[("red", Value::Str("Z".into())), ("green", Value::Str("UV.U".into())), ("whitePoint", n(1000.0))]);
@@ -260,4 +288,7 @@ fn extractor() {
     );
     case("ec.3d.extractor", &[("red", Value::Str("A".into())), ("blackPoint", n(0.2)), ("whitePoint", n(0.8)), ("clip", on())]);
     case("ec.3d.extractor", &[("green", Value::Str("".into())), ("alpha", Value::Str("nothing".into()))]);
+    // `(copy)` reads the input's own channel, not the footage's R plane of aux_scene.
+    let copy = || Value::Str(effectcraft_effects::EXTRACTOR_COPY.into());
+    case("ec.3d.extractor", &[("red", copy()), ("green", Value::Str("Coverage".into())), ("alpha", copy())]);
 }
diff --git a/crates/gpu/src/tests_fx_distort.rs b/crates/gpu/src/tests/fx_distort.rs
similarity index 95%
rename from crates/gpu/src/tests_fx_distort.rs
rename to crates/gpu/src/tests/fx_distort.rs
index 19cdcd605..1b8621408 100644
--- a/crates/gpu/src/tests_fx_distort.rs
+++ b/crates/gpu/src/tests/fx_distort.rs
@@ -55,6 +55,11 @@ fn turbulent_displace_and_cc_lens() {
         ],
     );
     effect_case("ec.distort.turbulentdisplace", &[("displacement", e(8)), ("size", n(15.0)), ("pinning", e(6))]);
+    // #943: Evolution moves the pattern at a constant rate on both paths, including steps of a
+    // few degrees and angles past a whole revolution, where an eased evolution axis diverges.
+    for evolution in [10.0, 37.0, 400.0, 725.5] {
+        effect_case("ec.distort.turbulentdisplace", &[("evolution", n(evolution)), ("size", n(12.0)), ("amount", n(30.0))]);
+    }
     effect_case("ec.distort.cclens", &[("size", n(70.0))]);
     effect_case("ec.distort.cclens", &[("size", n(45.0)), ("convergence", n(60.0)), ("center", Value::Vec2([30.0, 20.0]))]);
     effect_case("ec.distort.cclens", &[("convergence", n(-70.0))]);
diff --git a/crates/gpu/src/tests_fx_extra.rs b/crates/gpu/src/tests/fx_extra.rs
similarity index 94%
rename from crates/gpu/src/tests_fx_extra.rs
rename to crates/gpu/src/tests/fx_extra.rs
index b7fe6cbd2..136a66d2f 100644
--- a/crates/gpu/src/tests_fx_extra.rs
+++ b/crates/gpu/src/tests/fx_extra.rs
@@ -46,6 +46,7 @@ fn bevels_and_legacy_gaussian() {
     effect_case("ec.perspective.bevelalpha", &[("edgeThickness", n(2.0)), ("lightAngle", n(200.0)), ("lightColor", c(1.0, 0.8, 0.5))]);
     effect_case("ec.perspective.beveledges", &[("edgeThickness", n(0.1)), ("lightIntensity", n(0.5))]);
     effect_case("ec.perspective.beveledges", &[("edgeThickness", n(0.3)), ("lightAngle", n(130.0))]);
-    effect_case("ec.obsolete.gaussianlegacy", &[("blurriness", n(7.0))]);
-    effect_case("ec.obsolete.gaussianlegacy", &[("blurriness", n(5.0)), ("blurDimensions", e(2))]);
+    // Sigma 3 px and up at half scale too: smaller ones render on the CPU (#1939).
+    effect_case("ec.obsolete.gaussianlegacy", &[("blurriness", n(14.0))]);
+    effect_case("ec.obsolete.gaussianlegacy", &[("blurriness", n(12.0)), ("blurDimensions", e(2))]);
 }
diff --git a/crates/gpu/src/tests_fx_gen2.rs b/crates/gpu/src/tests/fx_gen2.rs
similarity index 99%
rename from crates/gpu/src/tests_fx_gen2.rs
rename to crates/gpu/src/tests/fx_gen2.rs
index 8eba75c8c..620cced13 100644
--- a/crates/gpu/src/tests_fx_gen2.rs
+++ b/crates/gpu/src/tests/fx_gen2.rs
@@ -7,8 +7,8 @@
 use effectcraft_keyframe::Value;
 use effectcraft_time::Tick;
 
+use crate::tests::fx_pixel2::{e, env_case, env_case_allow, env_case_at, off, on, pt};
 use crate::tests::{c, n};
-use crate::tests_fx_pixel2::{e, env_case, env_case_allow, env_case_at, off, on, pt};
 
 fn layer(id: u64) -> Value {
     Value::Layer(Some(id))
diff --git a/crates/gpu/src/tests_fx_generate.rs b/crates/gpu/src/tests/fx_generate.rs
similarity index 89%
rename from crates/gpu/src/tests_fx_generate.rs
rename to crates/gpu/src/tests/fx_generate.rs
index e15abb37e..d12920797 100644
--- a/crates/gpu/src/tests_fx_generate.rs
+++ b/crates/gpu/src/tests/fx_generate.rs
@@ -31,6 +31,8 @@ fn cc_radial_fast_blur() {
     effect_case("ec.blur.ccradialfast", &[("amount", n(40.0))]);
     effect_case("ec.blur.ccradialfast", &[("amount", n(70.0)), ("zoom", e(1)), ("center", pt(22.4, 16.1))]);
     effect_case("ec.blur.ccradialfast", &[("amount", n(25.0)), ("zoom", e(2))]);
+    // Center outside the layer: the buffer grows so the streaks pass its edge (#2095).
+    effect_case("ec.blur.ccradialfast", &[("amount", n(80.0)), ("center", pt(-30.0, 20.0))]);
 }
 
 #[test]
@@ -67,6 +69,13 @@ fn wipes() {
     effect_case("ec.transition.linearwipe", &[("completion", n(40.0)), ("angle", n(30.0)), ("feather", n(12.0))]);
     effect_case("ec.transition.linearwipe", &[("completion", n(55.0)), ("angle", n(-120.0))]);
     effect_case("ec.transition.linearwipe", &[("completion", n(20.0)), ("angle", n(90.0)), ("feather", n(3.0))]);
+    // #3125: After Effects' feather (blurred matte, edges repeated), 0 % and 100 %, and the legacy ramp.
+    effect_case("ec.transition.linearwipe", &[("completion", n(10.0)), ("angle", n(77.0)), ("feather", n(16.0))]);
+    effect_case("ec.transition.linearwipe", &[("completion", n(100.0)), ("feather", n(32000.0))]);
+    effect_case("ec.transition.linearwipe", &[("completion", n(0.0)), ("feather", n(40.0))]);
+    // 100 % clears the layer also when the angle is not a number (the CPU clears before reading it).
+    effect_case("ec.transition.linearwipe", &[("completion", n(100.0)), ("angle", n(f64::NAN))]);
+    effect_case("ec.transition.linearwipe", &[("completion", n(40.0)), ("angle", n(30.0)), ("feather", n(12.0)), ("legacyFeather", b(true))]);
     effect_case("ec.transition.venetian", &[("completion", n(35.0)), ("direction", n(30.0)), ("width", n(11.0)), ("feather", n(2.0))]);
     effect_case("ec.transition.venetian", &[("completion", n(60.0)), ("width", n(17.0))]);
     effect_case("ec.transition.venetian", &[("completion", n(25.0)), ("direction", n(-70.0)), ("width", n(9.0)), ("feather", n(0.5))]);
diff --git a/crates/gpu/src/tests_fx_key.rs b/crates/gpu/src/tests/fx_key.rs
similarity index 98%
rename from crates/gpu/src/tests_fx_key.rs
rename to crates/gpu/src/tests/fx_key.rs
index 5ece27e69..35303bb0b 100644
--- a/crates/gpu/src/tests_fx_key.rs
+++ b/crates/gpu/src/tests/fx_key.rs
@@ -155,6 +155,9 @@ fn refine_mattes() {
 fn channel_effects() {
     effect_case("ec.channel.setchannels", &[("setRedTo", e(2)), ("setGreenTo", e(4)), ("setBlueTo", e(5)), ("setAlphaTo", e(6))]);
     effect_case("ec.channel.shiftchannels", &[("takeRedFrom", e(3)), ("takeGreenFrom", e(7)), ("takeAlphaFrom", e(4))]);
+    // #1797: the constant sources at the end of the menu, where the GPU's order could drift from
+    // the CPU's (Full On, Full Off, Half On).
+    effect_case("ec.channel.shiftchannels", &[("takeRedFrom", e(8)), ("takeGreenFrom", e(9)), ("takeBlueFrom", e(10))]);
     effect_case("ec.channel.removecolormatting", &[("backgroundColor", c(0.3, 0.5, 0.7))]);
     effect_case("ec.channel.removecolormatting", &[("backgroundColor", c(0.8, 0.2, 0.1)), ("clipHdr", off())]);
     for op in [0, 2, 3, 4, 8, 10, 12] {
diff --git a/crates/gpu/src/tests_fx_light.rs b/crates/gpu/src/tests/fx_light.rs
similarity index 100%
rename from crates/gpu/src/tests_fx_light.rs
rename to crates/gpu/src/tests/fx_light.rs
diff --git a/crates/gpu/src/tests_fx_lut.rs b/crates/gpu/src/tests/fx_lut.rs
similarity index 100%
rename from crates/gpu/src/tests_fx_lut.rs
rename to crates/gpu/src/tests/fx_lut.rs
diff --git a/crates/gpu/src/tests_fx_noise.rs b/crates/gpu/src/tests/fx_noise.rs
similarity index 88%
rename from crates/gpu/src/tests_fx_noise.rs
rename to crates/gpu/src/tests/fx_noise.rs
index 476f08642..7d13004ee 100644
--- a/crates/gpu/src/tests_fx_noise.rs
+++ b/crates/gpu/src/tests/fx_noise.rs
@@ -22,6 +22,24 @@ fn pt(x: f64, y: f64) -> Value {
     Value::Vec2([x, y])
 }
 
+#[test]
+fn median_kernel_selection_preserves_physical_gpu_path() {
+    use crate::fx_noise::MedianKernel;
+    for backend in [wgpu::Backend::Vulkan, wgpu::Backend::Metal, wgpu::Backend::Dx12, wgpu::Backend::Gl, wgpu::Backend::BrowserWebGpu] {
+        for device_type in
+            [wgpu::DeviceType::DiscreteGpu, wgpu::DeviceType::IntegratedGpu, wgpu::DeviceType::VirtualGpu, wgpu::DeviceType::Cpu, wgpu::DeviceType::Other]
+        {
+            let selected = MedianKernel::for_adapter(backend, device_type);
+            let expected =
+                if backend == wgpu::Backend::Vulkan && device_type == wgpu::DeviceType::Cpu { MedianKernel::Software2 } else { MedianKernel::Private64 };
+            assert_eq!(selected, expected, "{backend:?} {device_type:?}");
+        }
+    }
+    assert_eq!(MedianKernel::Private64.rows_per_workgroup(), 64);
+    assert_eq!(MedianKernel::Software2.rows_per_workgroup(), 2);
+    assert_eq!(MedianKernel::Software2.workgroup_storage(), 16_384);
+}
+
 #[test]
 fn medians() {
     effect_case("ec.noise.median", &[("radius", n(2.0))]);
@@ -190,7 +208,7 @@ fn echo_and_posterize_time() {
             pos.keys = vec![Keyframe::new(Tick::ZERO, crate::tests::v3(10.0, 12.0)), Keyframe::new(Tick::from_seconds_f64(1.0), crate::tests::v3(50.0, 30.0))];
             let rot = a.props.prop_mut("transform/rotation").unwrap();
             rot.keys = vec![Keyframe::new(Tick::ZERO, Value::Scalar(0.0)), Keyframe::new(Tick::from_seconds_f64(1.0), Value::Scalar(90.0))];
-            s.p.comp_mut(inner_id).unwrap().layers = vec![a];
+            s.p.comp_mut(inner_id).unwrap().layers = vec![a].into();
             let mut l = build::layer(&mut s.p, &s.comp, "Inner", LayerSource::Comp { item: inner_id }, (60, 40), None);
             s.effect(&mut l, id, &vals);
             set(&mut l, "transform/rotation", Value::Scalar(8.0));
@@ -237,8 +255,17 @@ fn median_levels_match_cpu_division() {
         // A monotone row's median is its centre, including repeated edges. Exercise both
         // the bisection and sliding-histogram kernels at every quantised level.
         let mut enc = crate::context::Enc::new(&g.ctx);
+        let started = std::time::Instant::now();
         let median = crate::fx_noise::median_image(&mut enc, &input, radius, false);
-        let actual = enc.download(&median).unwrap();
+        let actual = enc.download(&median).unwrap_or_else(|| {
+            panic!(
+                "median download radius {radius}; elapsed={:?}, health={:?}, unavailable={:?}, transfers={:?}",
+                started.elapsed(),
+                g.ctx.check_health(),
+                g.ctx.unavailable_kernels(),
+                g.ctx.transfer_stats()
+            )
+        });
         for (level, (want, got)) in image.data.iter().zip(&actual.data).enumerate() {
             assert_eq!(got, want, "radius {radius}, level {level}");
         }
@@ -273,7 +300,16 @@ fn dust_strict_threshold_boundaries() {
             let buf = effectcraft_effects::Buf { img, offset: [0.0; 2], scale: 1.0 };
             let cpu = (spec.render)(&ctx(), buf.clone());
             assert_eq!(cpu.img.data[24] != original, replaced, "CPU radius {radius}, threshold {threshold}");
-            let gpu = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &buf, None).unwrap();
+            let started = std::time::Instant::now();
+            let gpu = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &buf, None).unwrap_or_else(|| {
+                panic!(
+                    "dust radius {radius}, threshold {threshold}; elapsed={:?}, health={:?}, unavailable={:?}, transfers={:?}",
+                    started.elapsed(),
+                    g.ctx.check_health(),
+                    g.ctx.unavailable_kernels(),
+                    g.ctx.transfer_stats()
+                )
+            });
             assert_eq!(gpu.img.data[24], cpu.img.data[24], "radius {radius}, threshold {threshold}");
         }
     }
diff --git a/crates/gpu/src/tests_fx_particles.rs b/crates/gpu/src/tests/fx_particles.rs
similarity index 99%
rename from crates/gpu/src/tests_fx_particles.rs
rename to crates/gpu/src/tests/fx_particles.rs
index b67df9a43..e8c3a7ce6 100644
--- a/crates/gpu/src/tests_fx_particles.rs
+++ b/crates/gpu/src/tests/fx_particles.rs
@@ -7,8 +7,8 @@ use effectcraft_project::{BitDepth, LayerSource, build};
 use effectcraft_render::RenderOpts;
 use effectcraft_time::Tick;
 
+use crate::tests::fx_sim::{case, composited, e, off, on};
 use crate::tests::{Scene, check, compare_at, n, opts, set};
-use crate::tests_fx_sim::{case, composited, e, off, on};
 
 fn v2(x: f64, y: f64) -> Value {
     Value::Vec2([x, y])
diff --git a/crates/gpu/src/tests_fx_pixel2.rs b/crates/gpu/src/tests/fx_pixel2.rs
similarity index 92%
rename from crates/gpu/src/tests_fx_pixel2.rs
rename to crates/gpu/src/tests/fx_pixel2.rs
index 899955b85..16f2bd392 100644
--- a/crates/gpu/src/tests_fx_pixel2.rs
+++ b/crates/gpu/src/tests/fx_pixel2.rs
@@ -12,7 +12,7 @@ use effectcraft_project::{BitDepth, MaskMode};
 use effectcraft_render::RenderOpts;
 use effectcraft_time::Tick;
 
-use crate::tests::{Scene, c, check, compare_at, diff, effect_case, gpu, n, opts, pattern, set};
+use crate::tests::{Scene, allow_llvmpipe_boundary_flips, c, check, compare_at, diff, effect_case, gpu, n, opts, pattern, set};
 
 pub(crate) fn e(v: u32) -> Value {
     Value::Enum(v)
@@ -184,6 +184,9 @@ fn composites_and_colour() {
     effect_case("ec.utility.hdrcompander", &[("mode", e(1)), ("gain", n(3.0)), ("gamma", n(1.5))]);
     effect_case("ec.utility.hdrcompression", &[]);
     effect_case("ec.utility.hdrcompression", &[("amount", n(40.0))]);
+    effect_case("ec.utility.hdrcompression", &[("amount", n(90.0))]);
+    // A NaN Amount keeps the layer (the CPU returns it unchanged).
+    effect_case("ec.utility.hdrcompression", &[("amount", n(f64::NAN))]);
     effect_case("ec.utility.growbounds", &[("pixels", n(9.0))]);
     effect_case("ec.utility.ccoverbrights", &[]);
     for ch in 1..=5 {
@@ -191,8 +194,25 @@ fn composites_and_colour() {
     }
 }
 
+/// HDR Highlight Compression on over-range input (HDR Compander expanding first), where the
+/// compressed channel clips at 1 before the Amount blend.
+#[test]
+fn hdr_compression_over_range() {
+    for amount in [100.0, 60.0] {
+        let mut s = Scene::new(BitDepth::Bpc32);
+        let bg = s.solid([0.15, 0.1, 0.2], 97, 61);
+        s.push(bg);
+        let mut l = s.footage(70, 44);
+        s.effect(&mut l, "ec.utility.hdrcompander", &[("mode", e(1)), ("gain", n(4.0)), ("gamma", n(1.0))]);
+        s.effect(&mut l, "ec.utility.hdrcompression", &[("amount", n(amount))]);
+        s.push(l);
+        check(&format!("hdr compression over range {amount}"), compare_at(&s, opts(), Tick::ZERO), 0.0);
+    }
+}
+
 #[test]
 fn stylize() {
+    let _flips = allow_llvmpipe_boundary_flips();
     for (done, flags) in
         [(30.0, [true, true, true, false]), (55.0, [false, true, false, true]), (70.0, [true, false, false, false]), (10.0, [false, false, true, true])]
     {
diff --git a/crates/gpu/src/tests_fx_sim.rs b/crates/gpu/src/tests/fx_sim.rs
similarity index 83%
rename from crates/gpu/src/tests_fx_sim.rs
rename to crates/gpu/src/tests/fx_sim.rs
index dc2510bb3..4f54e07b6 100644
--- a/crates/gpu/src/tests_fx_sim.rs
+++ b/crates/gpu/src/tests/fx_sim.rs
@@ -105,6 +105,34 @@ fn bubbles_drizzle_mercury() {
     case("ec.sim.ccmrmercury", &[("birthRate", n(3.0)), ("blobInfluence", n(60.0)), ("shading/metal", n(80.0)), ("gravity", n(2.0))], 1.5, 0.0);
 }
 
+/// CC Bubbles on a buffer with transparent padding around the layer: both sides clamp the
+/// refraction samples to the layer rectangle, not to the buffer (#2024).
+#[test]
+fn bubbles_on_padded_buffers() {
+    let Some(g) = gpu() else { return };
+    let spec = effectcraft_effects::find("ec.sim.ccbubbles").unwrap();
+    let size = [70.0, 44.0];
+    for reflection in [0, 1] {
+        let mut params =
+            effectcraft_effects::Params { values: spec.params.iter().map(|ps| (ps.id.to_string(), effectcraft_effects::default_value(ps, size))).collect() };
+        for (k, v) in [("bubbleAmount", n(80.0)), ("bubbleSize", n(4.0)), ("reflectionType", e(reflection))] {
+            params.values.insert(k.to_string(), v);
+        }
+        for scale in [1.0, 0.5] {
+            let img = pattern(7, (size[0] * scale) as u32, (size[1] * scale) as u32);
+            let mut buf = effectcraft_effects::Buf { img, offset: [0.0, 0.0], scale };
+            buf.pad(6);
+            let ctx = || effectcraft_effects::EffectCtx { params: &params, time: 0.5, layer_size: size, seed: 11, adjustment: false, env: Default::default() };
+            let cpu = (spec.render)(&ctx(), buf.clone());
+            let out =
+                effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &buf, None).expect("the GPU runs the effect");
+            assert_eq!((out.offset, out.scale), (cpu.offset, cpu.scale), "geometry");
+            let d = diff(&cpu.img, &out.img, 1e-3);
+            assert!(d.over == 0, "reflection {reflection} scale {scale}: {} of {} pixels over 1e-3 (max {}); worst {:?}", d.over, d.total, d.max, d.worst);
+        }
+    }
+}
+
 #[test]
 fn hair_wave_world_foam() {
     case("ec.sim.cchair", &[("density", n(300.0)), ("length", n(10.0))], 0.0, 0.0);
diff --git a/crates/gpu/src/tests_fx_stylize.rs b/crates/gpu/src/tests/fx_stylize.rs
similarity index 60%
rename from crates/gpu/src/tests_fx_stylize.rs
rename to crates/gpu/src/tests/fx_stylize.rs
index 44e156aec..63d93f207 100644
--- a/crates/gpu/src/tests_fx_stylize.rs
+++ b/crates/gpu/src/tests/fx_stylize.rs
@@ -6,7 +6,7 @@ use effectcraft_project::BitDepth;
 use effectcraft_render::RenderOpts;
 use effectcraft_time::Tick;
 
-use crate::tests::{Scene, c, check, compare_at, effect_case, n, opts, set};
+use crate::tests::{Scene, allow_llvmpipe_boundary_flips, c, check, compare_at, effect_case, n, opts, set};
 
 fn e(v: u32) -> Value {
     Value::Enum(v)
@@ -22,6 +22,7 @@ fn pt(x: f64, y: f64) -> Value {
 
 #[test]
 fn posterize_thresholds_strobe_vignette() {
+    let _flips = allow_llvmpipe_boundary_flips();
     effect_case("ec.stylize.posterize", &[("level", n(4.0))]);
     effect_case("ec.stylize.posterize", &[("level", n(9.0))]);
     effect_case("ec.stylize.threshold", &[("level", n(100.0))]);
@@ -45,6 +46,66 @@ fn posterize_thresholds_strobe_vignette() {
     effect_case("ec.stylize.ccvignette", &[("amount", n(-60.0)), ("pinHighlights", n(50.0)), ("angleOfView", n(120.0)), ("center", pt(20.0, 15.0))]);
 }
 
+/// Premultiplied, quantized footage often lands exactly on a posterization
+/// threshold after division by alpha. Exercise that input before any placement
+/// or compositing can hide a wrong bin behind the normal image tolerance.
+#[test]
+fn posterize_quantized_premultiplied_boundaries() {
+    let Some(g) = crate::tests::gpu() else { return };
+    let spec = effectcraft_effects::find("ec.stylize.posterize").unwrap();
+    for level in [4.0, 9.0] {
+        let params = effectcraft_effects::Params { values: [("level".into(), n(level))].into() };
+        let ctx =
+            || effectcraft_effects::EffectCtx { params: &params, time: 0.0, layer_size: [70.0, 44.0], seed: 11, adjustment: false, env: Default::default() };
+        for seed in 1..=7 {
+            let mut img = crate::tests::pattern(seed, 70, 44);
+            effectcraft_render::color::quantize(&mut img, 255.0);
+            let input = effectcraft_effects::Buf { img, offset: [0.0; 2], scale: 1.0 };
+            let cpu = (spec.render)(&ctx(), input.clone());
+            let gpu = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &input, None).unwrap();
+            for (i, (want, got)) in cpu.img.data.iter().zip(&gpu.img.data).enumerate() {
+                for c in 0..4 {
+                    assert!((want[c] - got[c]).abs() <= 1e-6, "level {level} seed {seed} pixel {i}: input {:?}, CPU {want:?}, GPU {got:?}", input.img.data[i]);
+                }
+            }
+        }
+    }
+}
+
+/// Wrapped ramps have a large discontinuity at their end. Check signed and
+/// fractional phases, including a wrap a few double-precision ulps above zero.
+#[test]
+fn arbitrary_map_signed_fractional_and_near_zero_wraps() {
+    let Some(g) = crate::tests::gpu() else { return };
+    let spec = effectcraft_effects::find("ec.color.psarbitrarymap").unwrap();
+    for phase in [-1000.0, -20.5, 0.0, 40.0, 1000.0, 255.99999999999997] {
+        let params = effectcraft_effects::Params {
+            values: [
+                ("map".into(), Value::Str((0..256).map(|n| n.to_string()).collect::<Vec<_>>().join(","))),
+                ("phase".into(), n(phase)),
+                ("applyPhaseMapToAlpha".into(), on()),
+            ]
+            .into(),
+        };
+        let ctx =
+            || effectcraft_effects::EffectCtx { params: &params, time: 0.0, layer_size: [1024.0, 1.0], seed: 7, adjustment: false, env: Default::default() };
+        let mut img = effectcraft_raster::Image::new(1024, 1);
+        for (i, px) in img.data.iter_mut().enumerate() {
+            let v = if i < 512 { i as f32 * 1e-18 } else { (i - 512) as f32 / 511.0 };
+            let a = [1.0f32, 0.1, 0.3, 6.0 / 255.0][i % 4];
+            *px = [v * a, v * a, v * a, a];
+        }
+        let input = effectcraft_effects::Buf { img, offset: [0.0; 2], scale: 1.0 };
+        let cpu = (spec.render)(&ctx(), input.clone());
+        let gpu = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &input, None).unwrap();
+        for (i, (want, got)) in cpu.img.data.iter().zip(&gpu.img.data).enumerate() {
+            for c in 0..4 {
+                assert!((want[c] - got[c]).abs() <= 1e-6, "phase {phase}, pixel {i}: CPU {want:?}, GPU {got:?}");
+            }
+        }
+    }
+}
+
 #[test]
 fn scatter_brush_strokes() {
     effect_case("ec.stylize.scatter", &[("amount", n(5.0))]);
@@ -88,6 +149,8 @@ fn tiles_kaleida_repetile() {
         "ec.stylize.motiontile",
         &[("horizontalPhaseShift", on()), ("phase", n(33.0)), ("tileCenter", pt(30.0, 17.0)), ("tileHeight", n(55.0)), ("outputWidth", n(80.0))],
     );
+    // Output under 100 % on an adjustment crops the comp below (#1727).
+    effect_case("ec.stylize.motiontile", &[("outputWidth", n(60.0)), ("outputHeight", n(300.0)), ("mirrorEdges", on())]);
     effect_case("ec.stylize.cckaleida", &[]);
     effect_case("ec.stylize.cckaleida", &[("mirroring", e(2)), ("rotation", n(20.0)), ("size", n(150.0))]);
     effect_case("ec.stylize.ccrepetile", &[("expandRight", n(10.0)), ("expandUp", n(4.0))]);
@@ -111,6 +174,7 @@ fn mirror_offset_polar_spherize_corner_pin() {
     effect_case("ec.distort.spherize", &[("radius", n(35.0)), ("center", pt(30.0, 25.0))]);
     effect_case("ec.distort.cornerpin", &[("ul", pt(5.0, 3.0)), ("ur", pt(60.0, 8.0)), ("lr", pt(66.0, 40.0)), ("ll", pt(2.0, 44.0))]);
     effect_case("ec.distort.cornerpin", &[("ul", pt(-8.0, 6.0)), ("ur", pt(75.0, -4.0)), ("lr", pt(50.0, 30.0)), ("ll", pt(12.0, 50.0))]);
+    effect_case("ec.distort.cornerpin", &[("ul", pt(70.0, 55.0)), ("ur", pt(120.0, 55.0)), ("lr", pt(120.0, 90.0)), ("ll", pt(70.0, 90.0))]);
 }
 
 #[test]
@@ -224,3 +288,72 @@ fn transform_motion_blur() {
         check(&format!("{label} half"), compare_at(&s, RenderOpts { scale: 0.5, ..opts() }, Tick::from_seconds_f64(0.3)), 0.0);
     }
 }
+
+/// #1605: Posterize matches the CPU exactly on every 8 bpc premultiplied colour and alpha. A
+/// straight value of 5/6 at level 4 rounds to exactly 2.5 on the CPU; drivers that fused the
+/// product into `round_away`'s subtraction (AMD) rounded it down a level.
+#[test]
+fn posterize_matches_the_cpu_on_every_8bpc_pair() {
+    let Some(g) = crate::tests::gpu() else { return };
+    let spec = effectcraft_effects::find("ec.stylize.posterize").unwrap();
+    let size = [256.0, 255.0];
+    let mut params =
+        effectcraft_effects::Params { values: spec.params.iter().map(|ps| (ps.id.to_string(), effectcraft_effects::default_value(ps, size))).collect() };
+    for level in [4.0, 7.0, 9.0] {
+        params.values.insert("level".into(), n(level));
+        // Pixel (x, a - 1): premultiplied colour min(x, a)/255 on alpha a/255.
+        let mut img = effectcraft_raster::Image::new(256, 255);
+        for a in 1..=255u32 {
+            for x in 0..256u32 {
+                let v = x.min(a) as f32 / 255.0;
+                img.data[((a - 1) * 256 + x) as usize] = [v, v, v, a as f32 / 255.0];
+            }
+        }
+        let buf = effectcraft_effects::Buf { img, offset: [0.0, 0.0], scale: 1.0 };
+        let ctx = || effectcraft_effects::EffectCtx { params: &params, time: 0.0, layer_size: size, seed: 1, adjustment: false, env: Default::default() };
+        let cpu = (spec.render)(&ctx(), buf.clone());
+        let out = effectcraft_render::Accelerator::effects(g, &[effectcraft_render::FxStep { spec, ctx: ctx() }], &buf, None).expect("the GPU runs the effect");
+        let bad: Vec<(usize, usize)> =
+            cpu.img.data.iter().zip(&out.img.data).enumerate().filter(|(_, (c, o))| c != o).map(|(i, _)| ((i % 256).min(i / 256 + 1), i / 256 + 1)).collect();
+        assert!(bad.is_empty(), "level {level}: {} (x, a) pairs differ from the CPU, first {:?}", bad.len(), &bad[..bad.len().min(8)]);
+    }
+}
+
+/// Motion Tile's Output size on an adjustment layer with a Transform after it that scales the
+/// tiles into view, and cropping (Output under 100 %): the stack's grown or cropped frame goes
+/// back onto the canvas as on the CPU (#1727).
+#[test]
+fn adjustment_motion_tile_output_then_transform() {
+    for (out_w, out_h, scale) in [(300.0, 300.0, 40.0), (250.0, 120.0, 70.0), (60.0, 80.0, 100.0)] {
+        for depth in [BitDepth::Bpc8, BitDepth::Bpc32] {
+            let mut s = Scene::new(depth);
+            let bg = s.footage(97, 61);
+            s.push(bg);
+            let mut adj = s.solid([1.0, 1.0, 1.0], 97, 61);
+            adj.switches.adjustment = true;
+            s.effect(&mut adj, "ec.stylize.motiontile", &[("outputWidth", n(out_w)), ("outputHeight", n(out_h)), ("mirrorEdges", on())]);
+            s.effect(&mut adj, "ec.distort.transform", &[("scaleHeight", n(scale)), ("scaleWidth", n(scale))]);
+            s.push(adj);
+            let label = format!("adjustment Motion Tile {out_w}×{out_h} % then Scale {scale} % {depth:?}");
+            check(&label, compare_at(&s, opts(), Tick::ZERO), 0.0);
+            check(&format!("{label} half"), compare_at(&s, RenderOpts { scale: 0.5, ..opts() }, Tick::ZERO), 0.0);
+        }
+    }
+}
+
+/// The same on a full-frame footage layer (#1991).
+#[test]
+fn layer_motion_tile_output_then_transform() {
+    for (out_w, out_h, scale) in [(300.0, 300.0, 40.0), (250.0, 120.0, 70.0)] {
+        for depth in [BitDepth::Bpc8, BitDepth::Bpc32] {
+            let mut s = Scene::new(depth);
+            let mut l = s.footage(97, 61);
+            s.effect(&mut l, "ec.stylize.motiontile", &[("outputWidth", n(out_w)), ("outputHeight", n(out_h)), ("mirrorEdges", on())]);
+            s.effect(&mut l, "ec.distort.transform", &[("scaleHeight", n(scale)), ("scaleWidth", n(scale))]);
+            s.push(l);
+            let label = format!("layer Motion Tile {out_w}×{out_h} % then Scale {scale} % {depth:?}");
+            check(&label, compare_at(&s, opts(), Tick::ZERO), 0.0);
+            check(&format!("{label} half"), compare_at(&s, RenderOpts { scale: 0.5, ..opts() }, Tick::ZERO), 0.0);
+        }
+    }
+}
diff --git a/crates/gpu/src/tests_fx_text.rs b/crates/gpu/src/tests/fx_text.rs
similarity index 100%
rename from crates/gpu/src/tests_fx_text.rs
rename to crates/gpu/src/tests/fx_text.rs
diff --git a/crates/gpu/src/tests_fx_time.rs b/crates/gpu/src/tests/fx_time.rs
similarity index 98%
rename from crates/gpu/src/tests_fx_time.rs
rename to crates/gpu/src/tests/fx_time.rs
index 0c94bb413..c71355736 100644
--- a/crates/gpu/src/tests_fx_time.rs
+++ b/crates/gpu/src/tests/fx_time.rs
@@ -40,7 +40,7 @@ fn moving(id: &str, vals: &[(&str, Value)], map: Option<&str>) {
         pos.keys = vec![Keyframe::new(Tick::ZERO, v3(10.0, 12.0)), Keyframe::new(Tick::from_seconds_f64(1.0), v3(50.0, 30.0))];
         let rot = a.props.prop_mut("transform/rotation").unwrap();
         rot.keys = vec![Keyframe::new(Tick::ZERO, Value::Scalar(0.0)), Keyframe::new(Tick::from_seconds_f64(1.0), Value::Scalar(90.0))];
-        s.p.comp_mut(inner_id).unwrap().layers = vec![a];
+        s.p.comp_mut(inner_id).unwrap().layers = vec![a].into();
         let mut l = build::layer(&mut s.p, &s.comp, "Inner", LayerSource::Comp { item: inner_id }, (60, 40), None);
         s.effect(&mut l, id, &vals);
         set(&mut l, "transform/rotation", Value::Scalar(8.0));
diff --git a/crates/gpu/src/tests_fx_tone.rs b/crates/gpu/src/tests/fx_tone.rs
similarity index 99%
rename from crates/gpu/src/tests_fx_tone.rs
rename to crates/gpu/src/tests/fx_tone.rs
index 08212a12a..40bc9483f 100644
--- a/crates/gpu/src/tests_fx_tone.rs
+++ b/crates/gpu/src/tests/fx_tone.rs
@@ -164,7 +164,7 @@ fn color_stabilizer() {
             pos.keys = vec![Keyframe::new(Tick::ZERO, crate::tests::v3(22.0, 18.0)), Keyframe::new(Tick::from_seconds_f64(1.0), crate::tests::v3(38.0, 24.0))];
             let op = a.props.prop_mut("transform/opacity").unwrap();
             op.keys = vec![Keyframe::new(Tick::ZERO, Value::Scalar(100.0)), Keyframe::new(Tick::from_seconds_f64(1.0), Value::Scalar(40.0))];
-            s.p.comp_mut(inner_id).unwrap().layers = vec![a];
+            s.p.comp_mut(inner_id).unwrap().layers = vec![a].into();
             let mut l = build::layer(&mut s.p, &s.comp, "Inner", LayerSource::Comp { item: inner_id }, (60, 40), None);
             let vals = [
                 ("stabilize", e(mode)),
diff --git a/crates/gpu/src/tests_fx_transition.rs b/crates/gpu/src/tests/fx_transition.rs
similarity index 99%
rename from crates/gpu/src/tests_fx_transition.rs
rename to crates/gpu/src/tests/fx_transition.rs
index b4b3572a0..abe9273dc 100644
--- a/crates/gpu/src/tests_fx_transition.rs
+++ b/crates/gpu/src/tests/fx_transition.rs
@@ -126,6 +126,7 @@ fn distort() {
         "ec.distort.ccblobbylize",
         &[("property", e(4)), ("softness", n(3.0)), ("cutAway", n(30.0)), ("lightType", e(1)), ("lightPosition", pt(20.0, 10.0))],
     );
+    effect_case("ec.distort.ccblobbylize", &[("cutAway", n(100.0))]);
     effect_case("ec.distort.ccblobbylize", &[("property", e(5)), ("metal", n(30.0)), ("roughness", n(0.2))]);
 }
 
diff --git a/crates/gpu/src/tests_fx_vr.rs b/crates/gpu/src/tests/fx_vr.rs
similarity index 100%
rename from crates/gpu/src/tests_fx_vr.rs
rename to crates/gpu/src/tests/fx_vr.rs
diff --git a/crates/gpu/src/tests_fx_warp.rs b/crates/gpu/src/tests/fx_warp.rs
similarity index 95%
rename from crates/gpu/src/tests_fx_warp.rs
rename to crates/gpu/src/tests/fx_warp.rs
index 39bcba13c..1482c268b 100644
--- a/crates/gpu/src/tests_fx_warp.rs
+++ b/crates/gpu/src/tests/fx_warp.rs
@@ -2,6 +2,8 @@
 //! Emboss, Cartoon) vs the CPU effects (the oracle): direct on a buffer at full and half
 //! resolution, as adjustment, and composited at 8 and 32 bpc.
 
+use std::io::Write;
+
 use effectcraft_effects::MaskShape;
 use effectcraft_keyframe::{ShapePath, Value};
 use effectcraft_project::build::{self, Ids};
@@ -9,7 +11,7 @@ use effectcraft_project::{BitDepth, MaskMode};
 use effectcraft_render::RenderOpts;
 use effectcraft_time::Tick;
 
-use crate::tests::{Scene, c, check, compare_at, diff, effect_case, gpu, n, opts, pattern};
+use crate::tests::{Scene, c, check, compare_at, diff, effect_case, gpu, n, on_llvmpipe, opts, pattern};
 
 fn e(v: u32) -> Value {
     Value::Enum(v)
@@ -182,6 +184,12 @@ fn smear_and_reshape() {
         ],
     ];
     for vals in reshape {
+        if on_llvmpipe() && vals.iter().any(|(k, _)| *k == "boundaryMask") {
+            // Straight to stderr: libtest captures `eprintln!` of passing tests, and the skip
+            // should show in the log.
+            let _ = writeln!(std::io::stderr(), "tests_fx_warp::smear_and_reshape: skipping ec.distort.reshape {vals:?} on llvmpipe (crashes lavapipe, #2238)");
+            continue;
+        }
         direct_with_masks("ec.distort.reshape", vals);
         composite_with_masks("ec.distort.reshape", vals);
     }
diff --git a/crates/gpu/src/tests_init.rs b/crates/gpu/src/tests/init.rs
similarity index 89%
rename from crates/gpu/src/tests_init.rs
rename to crates/gpu/src/tests/init.rs
index 9c579ae69..4578a8489 100644
--- a/crates/gpu/src/tests_init.rs
+++ b/crates/gpu/src/tests/init.rs
@@ -2,7 +2,6 @@
 //! Set EFFECTCRAFT_REQUIRE_GPU=1 for acceptance: unavailable adapters/devices then fail
 //! instead of taking the explicitly logged headless-CI skip path.
 #![cfg(not(target_arch = "wasm32"))]
-#![allow(clippy::expect_used)] // Test helpers require successful setup to exercise rejection.
 
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -149,23 +148,28 @@ fn opengl_adapters_get_cpu_compositing_at_once() {
     assert!(t.elapsed() < std::time::Duration::from_secs(1), "{:?}", t.elapsed());
 }
 
+/// #613: FXC (DirectX 12's default shader compiler) builds Classic 3D, so the compositor starts
+/// on DirectX 12 with its 3D kernel, and initialization leaves the caller's error scope and the
+/// host's error handler untouched. Ignored by default: FXC compiles every kernel, which takes
+/// minutes. Skips where there is no DirectX 12 adapter.
 #[test]
 #[cfg(target_os = "windows")]
-#[ignore = "requires the reproduced Windows DX12/FXC pointwise compiler failure; no adapter skips"]
-fn reproduced_fxc_pointwise_failure_returns_error_without_escaping_or_notifying_host() {
+#[ignore = "slow: FXC compiles every kernel"]
+fn fxc_builds_classic3d_and_initialization_errors_stay_scoped() {
     let mut desc = wgpu::InstanceDescriptor::new_without_display_handle();
     desc.backends = wgpu::Backends::DX12;
     desc.backend_options.dx12.shader_compiler = wgpu::Dx12Compiler::Fxc;
-    let (adapter, device, queue) = native_device(desc, true).expect("required DX12 device");
+    let Some((adapter, device, queue)) = native_device(desc, false) else { return };
     assert_eq!(adapter.get_info().backend, wgpu::Backend::Dx12);
     let host = count_host_errors(&device);
     let outer = device.push_error_scope(wgpu::ErrorFilter::Validation);
     let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| GpuContext::new(&adapter, device.clone(), queue)));
-    let error = match result.expect("FXC compiler failure must not escape the constructor") {
-        Err(error) => error,
-        Ok(_) => panic!("the platform-specific FXC failure no longer reproduces; reassess this diagnostic"),
+    let ctx = match result.expect("an FXC compiler failure must not escape the constructor") {
+        Ok(ctx) => ctx,
+        Err(error) => panic!("the compositor starts on DirectX 12 with FXC: {}", brief(error)),
     };
-    assert!(error.contains("GPU initialization (pointwise)") && error.contains("FXC D3DCompile"), "{}", brief(error));
+    let missing: Vec<&str> = ctx.unavailable_kernels().iter().map(|(e, _)| *e).collect();
+    assert!(ctx.has_kernel("classic3d"), "FXC builds classic3d (unavailable: {missing:?})");
     assert!(pollster::block_on(outer.pop()).is_none(), "constructor must drain its own scopes and leave the caller's scope clean");
     assert_eq!(host.load(Ordering::SeqCst), 0);
     valid_pipeline(&device);
diff --git a/crates/gpu/src/tests/inpaint.rs b/crates/gpu/src/tests/inpaint.rs
new file mode 100644
index 000000000..dacda05e2
--- /dev/null
+++ b/crates/gpu/src/tests/inpaint.rs
@@ -0,0 +1,322 @@
+//! GPU Content-Aware Fill vs the CPU reference: the CPU's fill is the oracle.
+//!
+//! Parity here is a quality contract, not bit-exactness (see `inpaint.rs`): PatchMatch's
+//! scan-order propagation becomes a two-pass checkerboard. So the tests compare both
+//! syntheses against the ground truth they are reconstructing, and check the GPU is not the
+//! worse of the two.
+
+use effectcraft_raster::Image;
+use effectcraft_raster::inpaint::{FillBackend, FillInput, FillOpts, fill_sequence_with, membrane_fill, patch_fill, psnr};
+
+use crate::tests::gpu;
+
+/// A textured background (periodic stripes + blocky noise), shifted by `dx` (the CPU tests'
+/// scene, so the numbers here are comparable with theirs).
+fn background(w: u32, h: u32, dx: f32) -> Image {
+    let mut img = Image::new(w, h);
+    for y in 0..h {
+        for x in 0..w {
+            let fx = x as f32 + dx;
+            let s = 0.5 + 0.3 * (fx * std::f32::consts::TAU / 10.0).sin();
+            let n = effectcraft_raster::hash_noise(((fx.floor() as i64).rem_euclid(20) / 4) as u32, (y % 20) / 4, 3);
+            img.set(x, y, [s, 0.3 + 0.4 * n, 0.6 - 0.3 * s * n, 1.0]);
+        }
+    }
+    img
+}
+
+fn cut(img: &Image, hole: &[bool]) -> Image {
+    let mut o = img.clone();
+    for (p, h) in o.data.iter_mut().zip(hole) {
+        if *h {
+            *p = [0.0; 4];
+        }
+    }
+    o
+}
+
+fn rect_hole(w: u32, h: u32, x0: u32, y0: u32, s: u32) -> Vec<bool> {
+    (0..w * h).map(|i| (x0..x0 + s).contains(&(i % w)) && (y0..y0 + s).contains(&(i / w))).collect()
+}
+
+/// The kernels must exist: a shader that fails to build falls back to the CPU silently, which
+/// would make every quality test below pass while testing nothing.
+#[test]
+fn the_inpaint_kernels_are_available() {
+    let Some(g) = gpu() else { return };
+    let bad: Vec<&str> = crate::inpaint::KERNELS.iter().copied().filter(|e| !g.ctx.has_kernel(e)).collect();
+    assert!(bad.is_empty(), "inpaint kernels did not build on {}: {bad:?}", g.ctx.name);
+}
+
+/// The device path (not the CPU fallback) is what the quality tests measure.
+#[test]
+fn the_gpu_runs_the_fill_itself() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 72u32);
+    let gt = background(w, h, 0.0);
+    let hole = rect_hole(w, h, 40, 28, 16);
+    let src = cut(&gt, &hole);
+    assert!(crate::inpaint::patch_image(&g.ctx, &src, &hole, None, 7, 1).is_some(), "PatchMatch fell back to the CPU");
+}
+
+#[test]
+fn patchmatch_beats_the_membrane_on_texture() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 72u32);
+    let gt = background(w, h, 0.0);
+    let hole = rect_hole(w, h, 40, 28, 16);
+    let src = cut(&gt, &hole);
+    let mem = membrane_fill(&src, &hole);
+    let pm = g.patch(&src, &hole, None, 7, 1);
+    let (pm_db, mem_db) = (psnr(&pm, &gt, Some(&hole)), psnr(&mem, &gt, Some(&hole)));
+    assert!(pm_db > mem_db + 3.0 && pm_db > 20.0, "PatchMatch {pm_db:.1} dB vs membrane {mem_db:.1} dB");
+    for i in 0..hole.len() {
+        if !hole[i] {
+            assert_eq!(pm.data[i], gt.data[i]);
+        }
+    }
+}
+
+#[test]
+fn patchmatch_agrees_with_the_cpu() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 72u32);
+    let gt = background(w, h, 0.0);
+    let hole = rect_hole(w, h, 40, 28, 16);
+    let src = cut(&gt, &hole);
+    let (cpu, gpu_pm) = (patch_fill(&src, &hole, None, 7, 1), g.patch(&src, &hole, None, 7, 1));
+    // Both are syntheses of the same hole: neither is the other's ground truth, so they are
+    // compared as two reconstructions of the same thing. On this periodic background both are
+    // near-exact, so a relative dB check at machine precision says nothing; the device must be a
+    // good reconstruction *and* agree with the CPU (a wrong fill that still looks plausible would
+    // pass the first and fail the second).
+    let gpu_db = psnr(&gpu_pm, &gt, Some(&hole));
+    assert!(gpu_db > 25.0, "GPU {gpu_db:.1} dB");
+    assert!(psnr(&gpu_pm, &cpu, Some(&hole)) > 30.0, "the two syntheses disagree");
+}
+
+/// The `init` path (a frame refined from the previous frame's warped fill) is the finest level
+/// only, from two rounds of four iterations (`patch_fill`).
+#[test]
+fn patchmatch_refines_an_init_frame() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 72u32);
+    let gt = background(w, h, 0.0);
+    let hole = rect_hole(w, h, 40, 28, 16);
+    let src = cut(&gt, &hole);
+    let init = gt.clone();
+    let (cpu, gpu_pm) = (patch_fill(&src, &hole, Some(&init), 7, 1), g.patch(&src, &hole, Some(&init), 7, 1));
+    assert!(psnr(&gpu_pm, &gt, Some(&hole)) > 25.0, "{:.1} dB", psnr(&gpu_pm, &gt, Some(&hole)));
+    assert!(psnr(&gpu_pm, &cpu, Some(&hole)) > 20.0, "the two syntheses disagree");
+}
+
+/// A hole across the whole multi-scale pyramid (the coarse levels' membrane start included):
+/// every level must come back finite and the pyramid must beat a single-level solve.
+#[test]
+fn patchmatch_survives_a_large_hole_across_levels() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (256u32, 192u32);
+    let gt = background(w, h, 0.0);
+    let hole = rect_hole(w, h, 90, 70, 80);
+    let src = cut(&gt, &hole);
+    let pm = g.patch(&src, &hole, None, 7, 1);
+    assert!(pm.data.iter().flatten().all(|v| v.is_finite()), "the synthesis left a non-finite value");
+    let db = psnr(&pm, &gt, Some(&hole));
+    assert!(db > 20.0, "{db:.1} dB");
+    for i in 0..hole.len() {
+        if !hole[i] {
+            assert_eq!(pm.data[i], gt.data[i], "known pixel {i}");
+        }
+    }
+}
+
+/// A moving object removed from a (static or panning) textured background, filled frame by
+/// frame through the device backend the sequence driver uses.
+#[test]
+fn object_fill_recovers_background_and_is_stable() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 64u32);
+    for pan in [0.0f32, 1.0] {
+        let mut frames = vec![];
+        let mut holes = vec![];
+        let mut gts = vec![];
+        for t in 0..8u32 {
+            let gt = background(w, h, t as f32 * pan);
+            let hole = rect_hole(w, h, 10 + 8 * t, 22, 18);
+            frames.push(cut(&gt, &hole));
+            holes.push(hole);
+            gts.push(gt);
+        }
+        let input = FillInput {
+            frames: effectcraft_raster::inpaint::Frames::Memory(frames),
+            holes: holes.into_iter().map(|h| effectcraft_raster::inpaint::HoleMask::from_vec(&h)).collect(),
+            references: vec![],
+        };
+        let out = fill_sequence_with(input.clone(), &FillOpts::default(), g, &mut |_, _| true, None).expect("fill");
+        for t in 0..out.len() {
+            let db = psnr(&out[t], &gts[t], Some(&input.holes[t].to_vec()));
+            assert!(db > 26.0, "frame {t} pan {pan}: {db:.1} dB");
+            assert_eq!(out[t].data[0][3], 1.0);
+        }
+        if pan == 0.0 {
+            for t in 1..out.len() {
+                let both: Vec<bool> = input.holes[t].to_vec().iter().zip(input.holes[t - 1].to_vec().iter()).map(|(a, b)| *a || *b).collect();
+                let db = psnr(&out[t], &out[t - 1], Some(&both));
+                assert!(db > 30.0, "frames {}–{t} differ: {db:.1} dB", t - 1);
+            }
+        }
+    }
+}
+
+/// The membrane stays on the CPU (see [`crate::inpaint`]): Edge Blend must still get the CPU's
+/// result through the backend, not a device one.
+#[test]
+fn edge_blend_takes_the_cpu_membrane() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (80u32, 60u32);
+    let gt = background(w, h, 0.0);
+    let hole = rect_hole(w, h, 30, 20, 14);
+    let input = FillInput {
+        frames: effectcraft_raster::inpaint::Frames::Memory(vec![cut(&gt, &hole); 4]),
+        holes: vec![effectcraft_raster::inpaint::HoleMask::from_vec(&hole); 4],
+        references: vec![],
+    };
+    let opts = FillOpts { method: effectcraft_raster::inpaint::FillMethod::EdgeBlend, ..Default::default() };
+    let edge = fill_sequence_with(input.clone(), &opts, g, &mut |_, _| true, None).expect("fill");
+    for t in 1..4 {
+        assert!(psnr(&edge[t], &edge[0], Some(&hole)) > 40.0, "frame {t}");
+    }
+    assert!(psnr(&edge[0], &membrane_fill(&input.frames.get(0), &hole), Some(&hole)) > 60.0);
+}
+
+/// The dilation the level plans are built from (kept honest: the flags' target bit is `near`).
+#[test]
+fn the_target_band_is_the_dilated_hole() {
+    let (w, h) = (24u32, 18u32);
+    let hole = rect_hole(w, h, 8, 6, 4);
+    let near = effectcraft_raster::inpaint::dilate(&hole, w as usize, h as usize, 3);
+    assert!(near.iter().filter(|b| **b).count() > hole.iter().filter(|b| **b).count());
+    assert!(near.iter().zip(&hole).all(|(n, h)| !*h || *n));
+}
+
+/// The flow's block matching runs on the device and finds the same motion the CPU does: the two
+/// frames are the membrane-filled neighbours the sequence driver builds, with a hole in each.
+#[test]
+fn flow_agrees_with_the_cpu() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (192u32, 128u32);
+    let a_gt = background(w, h, 0.0);
+    let b_gt = background(w, h, 5.0);
+    let hole_a = rect_hole(w, h, 30, 40, 40);
+    let mut hole_b = vec![false; (w * h) as usize];
+    for y in 50..90 {
+        for x in 120..160 {
+            hole_b[(y * w + x) as usize] = true;
+        }
+    }
+    let a = membrane_fill(&cut(&a_gt, &hole_a), &hole_a);
+    let b = membrane_fill(&cut(&b_gt, &hole_b), &hole_b);
+    assert!(crate::inpaint::flow_image(&g.ctx, &a, &b).is_some(), "the flow fell back to the CPU");
+    let cpu = effectcraft_raster::inpaint::CpuFill.flow(&a, &b, &hole_a, &hole_b);
+    let dev = g.flow(&a, &b, &hole_a, &hole_b);
+    assert_eq!((dev.cols, dev.rows, dev.block), (cpu.cols, cpu.rows, cpu.block));
+    // The field is the CPU's to a float rounding: the luma is the CPU's (`luma_pair`), the
+    // pyramid is exact additions, and the search enumerates candidates in the CPU's order.
+    let diff = cpu.v.iter().zip(&dev.v).map(|(c, d)| (c[0] - d[0]).abs().max((c[1] - d[1]).abs())).fold(0.0f32, f32::max);
+    assert!(diff <= 1e-6, "the flow fields differ by {diff}");
+    // The motion is real: the panning background's 5 px shift survives the completion. `b`'s
+    // content sits 5 px left of `a`'s (`background` adds `dx` inside the sample), so a → b is −5.
+    let m = dev.at(96.0, 64.0);
+    assert!((m[0] + 5.0).abs() < 0.5 && m[1].abs() < 0.5, "flow at centre: {m:?}");
+}
+
+/// The vote's σ² comes from a histogram that must count *every* target: the old per-thread
+/// strided pass kept only the pixels whose bin selected that thread (a biased ~1/256 subsample),
+/// which left small holes with a `total < 1` fallback and near-uniform vote weights.
+#[test]
+fn the_distance_histogram_counts_every_target() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (48u32, 32u32);
+    // Every target has the same distance, so the histogram is one spike. 0.5 is the SDR range
+    // (bin 128); 1600 is above it, which is reachable from a 32-bpc frame (the reviewer's example:
+    // clamping it to bin 1023 reported σ² ≈ 4, and the vote's weights then rounded to zero).
+    for (d, want) in [(0.5f32, 128.5f32 / 256.0), (1600.0, 1600.0)] {
+        let (mut field, near) = (Image::new(w, h), vec![true; (w * h) as usize]);
+        for px in field.data.iter_mut() {
+            *px = [0.0, 0.0, d, 1.0];
+        }
+        let (sigma2, total) = crate::inpaint::distance_histogram(&g.ctx, &field, &near, w, h).expect("histogram");
+        assert_eq!(total as usize, (w * h) as usize, "distance {d}: the histogram kept {total} of {} samples", w * h);
+        let tol = (want * 1e-3).max(1e-3);
+        assert!((sigma2 - want).abs() <= tol, "distance {d}: sigma2 {sigma2}, want {want}");
+    }
+}
+
+/// HDR frames (channels above 1, as a 32-bpc image has) must still fill like the CPU. Their patch
+/// distances are far past the SDR 0…4 range the histogram used to clamp at, so this covers the
+/// rescaled binning end to end; `the_distance_histogram_counts_every_target` pins the estimator
+/// itself (the old clamp read σ² ≈ 4 for a distance of 1600).
+#[test]
+fn hdr_frames_fill_like_the_cpu() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 72u32);
+    let mut gt = background(w, h, 0.0);
+    for px in &mut gt.data {
+        // A 32-bpc frame's values are unbounded: at 24× the patch distances run into the thousands.
+        // The old fixed 0…4 histogram reported σ² ≈ 4 for those, `exp(-d/(2σ²))` rounded to zero,
+        // and the vote kept the prior image instead of synthesising.
+        for c in 0..3 {
+            px[c] *= 24.0;
+        }
+    }
+    let hole = rect_hole(w, h, 40, 28, 16);
+    let src = cut(&gt, &hole);
+    let (cpu, gpu_pm) = (patch_fill(&src, &hole, None, 7, 1), g.patch(&src, &hole, None, 7, 1));
+    let gpu_db = psnr(&gpu_pm, &gt, Some(&hole));
+    assert!(gpu_db > 25.0, "GPU {gpu_db:.1} dB");
+    assert!(psnr(&gpu_pm, &cpu, Some(&hole)) > 30.0, "the two syntheses disagree");
+}
+
+/// A frame too small for one block is the CPU's zero field, on the device path too.
+#[test]
+fn small_frames_get_a_zero_flow() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (6u32, 6u32);
+    let a = background(w, h, 0.0);
+    let b = background(w, h, 2.0);
+    let none = vec![false; (w * h) as usize];
+    let f = g.flow(&a, &b, &none, &none);
+    assert_eq!((f.cols, f.rows), (1, 1));
+    assert_eq!(f.v, vec![[0.0, 0.0]]);
+}
+
+/// The flow the sequence driver uses (through the `Gpu` backend) keeps the fill stable: the same
+/// frames filled with the CPU backend and the device backend agree, so the propagation sees the
+/// same motion.
+#[test]
+fn sequence_fill_with_the_device_flow_matches_the_cpu() {
+    let Some(g) = gpu() else { return };
+    let (w, h) = (96u32, 64u32);
+    let cpu = effectcraft_raster::inpaint::CpuFill;
+    for pan in [0.0f32, 2.0] {
+        let mut frames = vec![];
+        let mut holes = vec![];
+        for t in 0..6u32 {
+            let gt = background(w, h, t as f32 * pan);
+            let hole = rect_hole(w, h, 12 + 6 * t, 22, 18);
+            frames.push(cut(&gt, &hole));
+            holes.push(hole);
+        }
+        let input = FillInput {
+            frames: effectcraft_raster::inpaint::Frames::Memory(frames),
+            holes: holes.into_iter().map(|h| effectcraft_raster::inpaint::HoleMask::from_vec(&h)).collect(),
+            references: vec![],
+        };
+        let dev = fill_sequence_with(input.clone(), &FillOpts::default(), g, &mut |_, _| true, None).expect("gpu fill");
+        let ref_cpu = fill_sequence_with(input.clone(), &FillOpts::default(), &cpu, &mut |_, _| true, None).expect("cpu fill");
+        for t in 0..dev.len() {
+            let db = psnr(&dev[t], &ref_cpu[t], Some(&input.holes[t].to_vec()));
+            assert!(db > 40.0, "frame {t} pan {pan}: device vs CPU {db:.1} dB");
+        }
+    }
+}
diff --git a/crates/gpu/src/tests_particles.rs b/crates/gpu/src/tests/particles.rs
similarity index 67%
rename from crates/gpu/src/tests_particles.rs
rename to crates/gpu/src/tests/particles.rs
index d2a229b0f..e11dd6585 100644
--- a/crates/gpu/src/tests_particles.rs
+++ b/crates/gpu/src/tests/particles.rs
@@ -91,6 +91,79 @@ fn particle_world_matches_the_cpu() {
     }
 }
 
+/// A host whose Birth Rate is `rate(layer time)` (#1373), with the GPU backend or without (the
+/// CPU oracle).
+struct Keyed {
+    gpu: Option<&'static Gpu>,
+    rate: fn(f64) -> f64,
+}
+
+impl EffectHost for Keyed {
+    fn layer(&self, _id: u64, _masks_and_effects: bool) -> Option<LayerPixels> {
+        None
+    }
+    fn audio(&self, _id: u64, _start: f64, _frames: usize, _rate: u32) -> Option<Vec<f32>> {
+        None
+    }
+    fn particles(&self) -> Option<&dyn ParticleSim> {
+        self.gpu.map(|g| g as &dyn ParticleSim)
+    }
+    fn param_at(&self, _effect_index: usize, id: &str, t: f64) -> Option<Value> {
+        (id == "birthRate").then(|| n((self.rate)(t)))
+    }
+}
+
+/// Effect `id`'s live particles at layer time `t` through `host`.
+fn keyed_state(id: &str, p: &Params, t: f64, host: &Keyed) -> Vec<SimParticle> {
+    let env = EffectEnv { host: Some(host), ..Default::default() };
+    let ctx = EffectCtx { params: p, time: t, layer_size: [320.0, 240.0], seed: 5, adjustment: false, env };
+    effectcraft_effects::particle_state(id, &ctx).unwrap()
+}
+
+/// 3 a second from 0 to 0.5 s.
+fn early(t: f64) -> f64 {
+    if t < 0.5 { 3.0 } else { 0.0 }
+}
+
+/// 3 a second from 0.25 to 0.75 s: as many births by 0.9 s as [`early`], at other steps.
+fn late(t: f64) -> f64 {
+    if (0.25..0.75).contains(&t) { 3.0 } else { 0.0 }
+}
+
+/// Effect `id` (parameters `p`) under the [`early`] then the [`late`] Birth Rate history: the
+/// GPU's particles match the CPU's, and each really came from the GPU.
+fn keyed_agree(id: &str, p: &Params, g: &'static Gpu) {
+    for (rate, times) in [(early as fn(f64) -> f64, [0.4, 0.9, 1.2]), (late, [0.9, 1.2, 0.6])] {
+        let (cpu_host, gpu_host) = (Keyed { gpu: None, rate }, Keyed { gpu: Some(g), rate });
+        for t in times {
+            let cpu = keyed_state(id, p, t, &cpu_host);
+            let before = crate::particles::DISPATCHES.load(std::sync::atomic::Ordering::Relaxed);
+            let gpu = keyed_state(id, p, t, &gpu_host);
+            assert!(crate::particles::DISPATCHES.load(std::sync::atomic::Ordering::Relaxed) > before, "{id} t {t}: simulated on the GPU");
+            agree(&format!("{id} keyed birth rate t {t}"), &cpu, &gpu, 1e-4, cpu.len() / 100 + 1);
+        }
+    }
+}
+
+/// #1373: with a keyed Birth Rate the GPU is given the births of each moment, as the CPU
+/// simulates them: a burst lives on after the rate drops to 0, and a GPU checkpoint of one
+/// history is not resumed for another with the same system key, even when both have born as
+/// many particles (180 by 0.9 s here) at other steps.
+#[test]
+fn particle_world_with_a_keyed_birth_rate_matches_the_cpu() {
+    let Some(g) = gpu() else { return };
+    let p = params("ec.sim.ccparticleworld", &[("birthRate", n(0.0)), ("longevity", n(1.2)), ("extras/randomSeed", n(21.0))]);
+    keyed_agree("ec.sim.ccparticleworld", &p, g);
+}
+
+/// The same for CC Particle Systems II (90 births by 0.9 s in both histories).
+#[test]
+fn particle_systems_ii_with_a_keyed_birth_rate_matches_the_cpu() {
+    let Some(g) = gpu() else { return };
+    let p = params("ec.sim.ccparticlesystems2", &[("birthRate", n(0.0)), ("longevity", n(1.2)), ("randomSeed", n(22.0))]);
+    keyed_agree("ec.sim.ccparticlesystems2", &p, g);
+}
+
 #[test]
 fn particle_systems_ii_matches_the_cpu() {
     let Some(g) = gpu() else { return };
diff --git a/crates/gpu/src/tests_3d.rs b/crates/gpu/src/tests/three_d.rs
similarity index 84%
rename from crates/gpu/src/tests_3d.rs
rename to crates/gpu/src/tests/three_d.rs
index bd9455b9e..acdbea7b1 100644
--- a/crates/gpu/src/tests_3d.rs
+++ b/crates/gpu/src/tests/three_d.rs
@@ -11,7 +11,7 @@ use effectcraft_project::{BitDepth, Comp, ItemKind, Layer, LayerSource, LightKin
 use effectcraft_render::{Backend, RenderOpts, Renderer};
 use effectcraft_time::{FrameRate, Tick};
 
-use crate::tests::{Pattern, Scene, check, compare_at, gpu, n, opts, set};
+use crate::tests::{Pattern, Scene, check, compare_at, diff, gpu, n, opts, set, tolerance};
 
 const W: u32 = 160;
 const H: u32 = 100;
@@ -133,6 +133,22 @@ fn lights_specular_transmission_and_shadows() {
     }
 }
 
+#[test]
+fn wide_shadow_diffusion() {
+    // #2444: a wide penumbra takes more than the 3 × 3 kernel's samples; both sides pick the
+    // same count.
+    for depth in [BitDepth::Bpc8, BitDepth::Bpc32] {
+        let mut s = crossing(depth, BlendMode::Normal);
+        for l in &mut s.p.comp_mut(s.cid).unwrap().layers {
+            if l.switches.three_d {
+                set(l, "materialOptions/castsShadows", Value::Enum(1));
+            }
+        }
+        light(&mut s, LightKind::Point, [150.0, 20.0, -80.0], &[("castsShadows", Value::Bool(true)), ("shadowDiffusion", n(60.0))]);
+        check(&format!("wide shadow diffusion {depth:?}"), compare_at(&s, opts(), Tick::ZERO), 0.005);
+    }
+}
+
 #[test]
 fn depth_of_field_and_motion_blur() {
     for depth in [BitDepth::Bpc8, BitDepth::Bpc32] {
@@ -161,7 +177,7 @@ fn mattes_preserve_transparency_precomps_and_adjustment_splits() {
         let mid = s.push(m);
         let layers = &mut s.p.comp_mut(s.cid).unwrap().layers;
         layers[1].track_matte = Some(TrackMatte { layer: mid, kind: MatteKind::Luma });
-        if let Some(far) = layers.iter_mut().find(|l| l.switches.three_d && l.name == "Pattern") {
+        if let Some(far) = layers.find_mut(|l| l.switches.three_d && l.name == "Pattern") {
             far.preserve_transparency = true;
         }
         // Move the matte below the bottom so the 3D run stays one run.
@@ -187,7 +203,7 @@ fn mattes_preserve_transparency_precomps_and_adjustment_splits() {
         a.switches.three_d = true;
         set(&mut a, "transform/rotationX", Value::Scalar(40.0));
         let b = s.solid([0.2, 0.8, 0.4], 30, 20);
-        s.p.comp_mut(inner_id).unwrap().layers = vec![b, a];
+        s.p.comp_mut(inner_id).unwrap().layers = vec![b, a].into();
         let mut pre = build::layer(&mut s.p, &s.comp, "Inner", LayerSource::Comp { item: inner_id }, (80, 60), None);
         pre.switches.collapse = true;
         pre.switches.three_d = true;
@@ -209,6 +225,10 @@ fn the_gpu_draws_classic_3d_runs_itself() {
     assert_eq!(prep.planes.iter().filter(|p| p.draw).count(), 3);
     let mut e = crate::context::Enc::new(g.context());
     let canvas = e.image(W, H);
+    if !g.context().has_kernel("classic3d") {
+        // FXC (DirectX 12) can't build the kernel (#613); the CPU fallback is tested below.
+        return;
+    }
     let out = crate::classic3d::draw_run(&mut e, &prep, &canvas).expect("the kernel draws the run");
     let img = e.download(&out).unwrap();
     let mut cpu = effectcraft_raster::Image::new(W, H);
@@ -253,7 +273,9 @@ fn bokeh_depth_of_field_runs_on_the_gpu() {
                 assert!(prep.planes.iter().filter(|p| p.draw).all(|p| p.dof.is_some()), "{label}: depth of field deferred to the GPU");
                 let mut e = crate::context::Enc::new(g.context());
                 let canvas = e.image(W, H);
-                assert!(crate::classic3d::draw_run(&mut e, &prep, &canvas).is_some(), "{label}: drawn on the GPU");
+                if g.context().has_kernel("classic3d") {
+                    assert!(crate::classic3d::draw_run(&mut e, &prep, &canvas).is_some(), "{label}: drawn on the GPU");
+                }
             }
         }
     }
@@ -277,7 +299,7 @@ fn two_d_layer_with_a_three_d_track_matte() {
             let layers = &mut s.p.comp_mut(s.cid).unwrap().layers;
             let fi = layers.iter().position(|l| l.id == fid).unwrap();
             layers[fi].track_matte = Some(TrackMatte { layer: mid, kind });
-            if let Some(ml) = layers.iter_mut().find(|l| l.id == mid) {
+            if let Some(ml) = layers.find_mut(|l| l.id == mid) {
                 ml.switches.video = false;
             }
             check(&format!("3d matte {kind:?} {depth:?}"), compare_at(&s, opts(), Tick::ZERO), 0.005);
@@ -288,3 +310,27 @@ fn two_d_layer_with_a_three_d_track_matte() {
         }
     }
 }
+
+/// #613: FXC on DirectX 12 fails to build `classic3d` (it can't unroll its loops). The
+/// compositor still starts without it, lists it, and 3D runs render on the CPU, matching the
+/// CPU render.
+#[test]
+fn classic_3d_runs_render_on_the_cpu_without_the_kernel() {
+    let Some(base) = gpu() else {
+        return;
+    };
+    let ctx = base.context().without_kernel("classic3d");
+    assert!(!ctx.has_kernel("classic3d"));
+    let g = crate::Gpu::from_context(ctx);
+    for depth in [BitDepth::Bpc8, BitDepth::Bpc32] {
+        let mut s = crossing(depth, BlendMode::Normal);
+        camera(&mut s, [30.0, 20.0, -260.0], None);
+        let cpu = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Cpu, ..opts() }).comp_frame_cpu(s.cid, Tick::ZERO);
+        let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..opts() });
+        r.accel = Some(&g);
+        let img = g.render(&r, s.cid, Tick::ZERO).expect("the GPU renders the frame");
+        let mut d = diff(&cpu, &img, tolerance(depth));
+        d.quantized = depth != BitDepth::Bpc32;
+        check(&format!("classic 3D without its kernel {depth:?}"), Some(d), 0.0);
+    }
+}
diff --git a/crates/gpu/src/tests/wgsl_grammar.rs b/crates/gpu/src/tests/wgsl_grammar.rs
new file mode 100644
index 000000000..dfb75b5a5
--- /dev/null
+++ b/crates/gpu/src/tests/wgsl_grammar.rs
@@ -0,0 +1,231 @@
+//! WGSL rules naga accepts but stricter front-ends (Tint, i.e. the browser's
+//! WebGPU, which receives the WGSL source verbatim on wasm) reject.
+//!
+//! WGSL gives the bitwise operators `&`, `|` and `^` no precedence against any other
+//! binary operator: `a * b ^ c` must be written `(a * b) ^ c`, and `a & b == c` as
+//! `(a & b) == c`. Only a chain of the same bitwise operator may go unparenthesised.
+
+use std::fs;
+use std::path::Path;
+
+#[derive(Clone, Copy, PartialEq)]
+enum Tok<'a> {
+    Operand,
+    Open,
+    Close,
+    Op(&'a str),
+    /// A unary prefix (`!`, `~`): the operator after it cannot be binary.
+    Prefix,
+    /// Ends an expression: `,` `;` `{` `}` `:` `=` compound assignment, `->`, `@`.
+    Sep,
+}
+
+const BITWISE: [&str; 3] = ["&", "|", "^"];
+
+const OPS: [&str; 18] = ["&&", "||", "==", "!=", "<=", ">=", "<<", ">>", "<", ">", "+", "-", "*", "/", "%", "&", "|", "^"];
+
+/// Drop comments and template argument lists (`vec3<f32>`, `array<vec4<u32>>`), whose
+/// angle brackets are not relational operators.
+fn strip(src: &str) -> String {
+    let mut out = drop_comments(src);
+    loop {
+        let (next, changed) = drop_template_lists_once(&out);
+        out = next;
+        if !changed {
+            return out;
+        }
+    }
+}
+
+fn drop_comments(src: &str) -> String {
+    let mut out = String::with_capacity(src.len());
+    let b = src.as_bytes();
+    let mut i = 0;
+    while i < b.len() {
+        if b[i..].starts_with(b"//") {
+            while i < b.len() && b[i] != b'\n' {
+                i += 1;
+            }
+        } else if b[i..].starts_with(b"/*") {
+            i += 2;
+            while i + 1 < b.len() && !b[i..].starts_with(b"*/") {
+                out.push(if b[i] == b'\n' { '\n' } else { ' ' });
+                i += 1;
+            }
+            i += 2;
+        } else {
+            out.push(b[i] as char);
+            i += 1;
+        }
+    }
+    out
+}
+
+/// One pass over `out` dropping every template argument list. Returns whether one was dropped.
+fn drop_template_lists_once(out: &str) -> (String, bool) {
+    let mut changed = false;
+    let mut next = String::with_capacity(out.len());
+    let c: Vec<char> = out.chars().collect();
+    let mut i = 0;
+    while i < c.len() {
+        if let Some(end) = template_list_end(&c, i) {
+            i = end;
+            changed = true;
+            continue;
+        }
+        next.push(c[i]);
+        i += 1;
+    }
+    (next, changed)
+}
+
+/// If `c[i]` opens a template argument list after an identifier, the index just past its `>`.
+fn template_list_end(c: &[char], i: usize) -> Option<usize> {
+    let prev = i.checked_sub(1).and_then(|p| c.get(p))?;
+    if c.get(i) != Some(&'<') || !(prev.is_alphanumeric() || *prev == '_') {
+        return None;
+    }
+    let mut j = i + 1;
+    while let Some(&ch) = c.get(j) {
+        if !(ch.is_alphanumeric() || ch == '_' || ch == ',' || ch == ' ') {
+            break;
+        }
+        j += 1;
+    }
+    (c.get(j) == Some(&'>')).then_some(j + 1)
+}
+
+/// Scans the token starting at `*at` (not whitespace) and advances `*at` past it.
+fn next_token<'a>(s: &'a str, at: &mut usize) -> Tok<'a> {
+    let b = s.as_bytes();
+    let Some(&ch) = b.get(*at) else {
+        return Tok::Sep;
+    };
+    let mut i = *at;
+    let tok = if ch.is_ascii_alphanumeric() || ch == b'_' || ch == b'.' {
+        // Identifier, member access or number (`1e-6`, `0x9E3779B9u`).
+        let start = i;
+        while i < b.len() && (b[i].is_ascii_alphanumeric() || b[i] == b'_' || b[i] == b'.') {
+            if (b[i] == b'e' || b[i] == b'E')
+                && b[start].is_ascii_digit()
+                && !s[start..i].starts_with("0x")
+                && i + 1 < b.len()
+                && (b[i + 1] == b'-' || b[i + 1] == b'+')
+            {
+                i += 1;
+            }
+            i += 1;
+        }
+        Tok::Operand
+    } else if ch == b'(' || ch == b'[' {
+        i += 1;
+        Tok::Open
+    } else if ch == b')' || ch == b']' {
+        i += 1;
+        Tok::Close
+    } else if b[i..].starts_with(b"->") || b[i..].starts_with(b"++") || b[i..].starts_with(b"--") {
+        i += 2;
+        Tok::Sep
+    } else if matches!(ch, b',' | b';' | b'{' | b'}' | b':' | b'@') {
+        i += 1;
+        Tok::Sep
+    } else if let Some(op) = OPS.iter().find(|op| b[i..].starts_with(op.as_bytes())) {
+        i += op.len();
+        if b.get(i) == Some(&b'=') && !matches!(*op, "==" | "!=" | "<=" | ">=") {
+            i += 1;
+            Tok::Sep // compound assignment
+        } else {
+            Tok::Op(op)
+        }
+    } else if ch == b'=' {
+        i += 1;
+        Tok::Sep
+    } else {
+        i += 1;
+        Tok::Prefix
+    };
+    *at = i;
+    tok
+}
+
+/// Records a binary operator at the current parenthesis level, reporting it if it mixes with
+/// one already seen there.
+fn note_operator<'a>(level: &mut Vec<&'a str>, op: &'a str, line: usize, out: &mut Vec<(usize, String)>) {
+    let mixes = |a: &str, b: &str| a != b && (BITWISE.contains(&a) || BITWISE.contains(&b));
+    if let Some(other) = level.iter().find(|o| mixes(o, op)) {
+        out.push((line, format!("mixing '{other}' and '{op}' requires parentheses")));
+    }
+    level.push(op);
+}
+
+/// `(line, message)` for every bitwise operator mixed with another binary operator at
+/// the same parenthesis level.
+fn violations(src: &str) -> Vec<(usize, String)> {
+    let s = strip(src);
+    let b = s.as_bytes();
+    let mut out = vec![];
+    // Binary operators seen at each open parenthesis level.
+    let mut levels: Vec<Vec<&str>> = vec![vec![]];
+    let mut prev = Tok::Sep;
+    let (mut i, mut line) = (0, 1);
+    while i < b.len() {
+        let ch = b[i];
+        if ch == b'\n' {
+            line += 1;
+            i += 1;
+            continue;
+        }
+        if ch.is_ascii_whitespace() {
+            i += 1;
+            continue;
+        }
+        let tok = next_token(&s, &mut i);
+        match tok {
+            Tok::Open => levels.push(vec![]),
+            Tok::Close if levels.len() > 1 => {
+                levels.pop();
+            }
+            Tok::Sep => {
+                if let Some(l) = levels.last_mut() {
+                    l.clear();
+                }
+            }
+            Tok::Op(op) if matches!(prev, Tok::Operand | Tok::Close) => {
+                let level = levels.last_mut().expect("level");
+                note_operator(level, op, line, &mut out);
+            }
+            _ => {}
+        }
+        prev = tok;
+    }
+    out
+}
+
+#[test]
+fn checker_flags_unparenthesised_bitwise_mixes() {
+    assert_eq!(violations("let h = u32(x) * 3u ^ u32(y) * 5u;").len(), 2);
+    assert_eq!(violations("let a = b & c == d;").len(), 1);
+    assert!(violations("let h = (u32(x) * 3u) ^ (u32(y) * 5u);").is_empty());
+    assert!(violations("let h = a ^ b ^ c; let m = f32(h & 0xFFFFu) * (1.0 / 65536.0) - 0.5;").is_empty());
+    assert!(violations("let v: vec3<f32> = vec3<f32>(1e-6, -x, a < b); if (a < b && c > d) { h ^= h >> 16u; }").is_empty());
+    assert!(violations("var p = &x; let y = -a & b;").is_empty());
+}
+
+#[test]
+fn shaders_parenthesise_bitwise_operators() {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("src/shaders");
+    let mut bad = vec![];
+    let mut files = 0;
+    for entry in fs::read_dir(&dir).expect("shader dir") {
+        let path = entry.expect("entry").path();
+        if path.extension().is_some_and(|e| e == "wgsl") {
+            files += 1;
+            let src = fs::read_to_string(&path).expect("shader source");
+            for (line, msg) in violations(&src) {
+                bad.push(format!("{}:{line}: {msg}", path.file_name().map(|n| n.to_string_lossy()).unwrap_or_default()));
+            }
+        }
+    }
+    assert!(files > 10, "found the shaders: {files}");
+    assert!(bad.is_empty(), "WGSL a strict front-end rejects:\n{}", bad.join("\n"));
+}
diff --git a/crates/gpu/src/walk.rs b/crates/gpu/src/walk.rs
index b1209070a..f688a6375 100644
--- a/crates/gpu/src/walk.rs
+++ b/crates/gpu/src/walk.rs
@@ -17,6 +17,12 @@ use effectcraft_time::Tick;
 use crate::context::{Enc, GpuImage};
 use crate::ops;
 
+/// The size [`render`] renders `comp_id` at, without rendering it.
+pub(crate) fn frame_size(r: &Renderer, comp_id: ItemId, t: Tick) -> Option<(u32, u32)> {
+    let ctx = r.eval_ctx(comp_id, t)?;
+    Some(effectcraft_render::frame_size(ctx.comp.width, ctx.comp.height, r.opts.scale))
+}
+
 /// Render a comp frame into a GPU image (the canvas in the output space, as
 /// `Renderer::comp_frame_cpu` returns it). `None` when something cannot run here (the caller
 /// renders on the CPU instead).
@@ -26,9 +32,7 @@ pub(crate) fn render<'g>(e: &mut Enc<'g>, r: &Renderer, comp_id: ItemId, t: Tick
         return None;
     }
     let ctx = r.eval_ctx(comp_id, t)?;
-    let s = r.opts.scale;
-    let w = ((ctx.comp.width as f64 * s).round() as u32).max(1);
-    let h = ((ctx.comp.height as f64 * s).round() as u32).max(1);
+    let (w, h) = effectcraft_render::frame_size(ctx.comp.width, ctx.comp.height, r.opts.scale);
     if r.depth() > 16 || !e.g.fits(w, h) {
         return None;
     }
@@ -41,8 +45,9 @@ pub(crate) fn render<'g>(e: &mut Enc<'g>, r: &Renderer, comp_id: ItemId, t: Tick
     if let Some(l) = pipe.levels {
         canvas = ops::quantize(e, &canvas, l);
     }
+    let out = r.output_pipe();
     if r.depth() == 0
-        && let Some(c) = pipe.output()
+        && let Some(c) = out.output()
     {
         canvas = ops::convert(e, &canvas, &c);
         if let Some(l) = pipe.levels {
@@ -50,7 +55,7 @@ pub(crate) fn render<'g>(e: &mut Enc<'g>, r: &Renderer, comp_id: ItemId, t: Tick
         }
     }
     if r.depth() == 0
-        && let Some((lin, mode, enc)) = pipe.output_hdr()
+        && let Some((lin, mode, enc)) = out.output_hdr()
     {
         on_cpu(e, &mut canvas, |img| {
             effectcraft_render::color::output_hdr(img, lin, mode, enc);
@@ -85,7 +90,7 @@ fn draw_comp<'a>(e: &mut Enc, r: &Renderer<'a>, ctx: &EvalCtx<'a>, canvas: &mut
             i = j;
         } else {
             match r.collapsed(ctx, visible[i]) {
-                Some(item) => draw_collapsed(e, r, ctx, visible[i], item, canvas)?,
+                Some(collapsed) => draw_collapsed(e, r, ctx, visible[i], &collapsed, canvas)?,
                 None => draw_layer(e, r, ctx, visible[i], canvas)?,
             }
             i += 1;
@@ -183,25 +188,38 @@ fn draw_split(e: &mut Enc, r: &Renderer, ctx: &EvalCtx, split: &effectcraft_rend
     Some(cv)
 }
 
-fn draw_collapsed<'a>(e: &mut Enc, r: &Renderer<'a>, ctx: &EvalCtx<'a>, layer: &Layer, item: ItemId, canvas: &mut GpuImage) -> Option<()> {
+fn draw_collapsed<'a>(
+    e: &mut Enc,
+    r: &Renderer<'a>,
+    ctx: &EvalCtx<'a>,
+    layer: &'a Layer,
+    collapsed: &effectcraft_render::Collapsed,
+    canvas: &mut GpuImage,
+) -> Option<()> {
     let opacity = r.layer_opacity(ctx, layer);
     if opacity <= 0.0 {
         return Some(());
     }
     let matte = r.track_matte(ctx, layer).is_some();
     if layer.blend_mode == BlendMode::Normal && !matte && !layer.preserve_transparency {
-        if let Some((sub, nctx)) = r.collapse_into(ctx, layer, item, opacity) {
+        if let Some((sub, nctx)) = r.collapse_into(ctx, layer, collapsed, opacity) {
             draw_comp(e, &sub, &nctx, canvas)?;
         }
         return Some(());
     }
-    let Some((sub, nctx)) = r.collapse_into(ctx, layer, item, 1.0) else { return Some(()) };
+    let Some((sub, nctx)) = r.collapse_into(ctx, layer, collapsed, 1.0) else { return Some(()) };
     let mut iso = e.zeros(canvas.width, canvas.height);
     draw_comp(e, &sub, &nctx, &mut iso)?;
     composite_iso(e, r, ctx, layer, iso, canvas, opacity)
 }
 
 fn draw_layer(e: &mut Enc, r: &Renderer, ctx: &EvalCtx, layer: &Layer, canvas: &mut GpuImage) -> Option<()> {
+    let out = draw_layer_on(e, r, ctx, layer, canvas);
+    e.mem_gate();
+    out
+}
+
+fn draw_layer_on(e: &mut Enc, r: &Renderer, ctx: &EvalCtx, layer: &Layer, canvas: &mut GpuImage) -> Option<()> {
     if layer.switches.adjustment {
         if draw_adjustment(e, r, ctx, layer, canvas).is_some() {
             return Some(());
@@ -341,8 +359,8 @@ fn draw_precomp(e: &mut Enc, r: &Renderer, ctx: &EvalCtx, layer: &Layer, canvas:
 
 /// Adjustment layer (`Renderer::draw_adjustment`): the effect stack runs on the comp below,
 /// resident on the GPU (non-GPU effects read back, run on the CPU and upload), and the result
-/// replaces the canvas inside the layer's footprint × track matte × opacity. `None` = draw it
-/// on the CPU.
+/// replaces the canvas inside the layer's footprint × track matte × opacity, or blends onto it in
+/// the layer's blend mode when that isn't Normal. `None` = draw it on the CPU.
 fn draw_adjustment(e: &mut Enc, r: &Renderer, ctx: &EvalCtx, layer: &Layer, canvas: &mut GpuImage) -> Option<()> {
     let opacity = r.layer_opacity(ctx, layer);
     let Some(foot) = r.adjustment_footprint(ctx, layer) else { return Some(()) };
@@ -357,14 +375,24 @@ fn draw_adjustment(e: &mut Enc, r: &Renderer, ctx: &EvalCtx, layer: &Layer, canv
     };
     let mut fx = crate::effects::GpuFx::new(e, below, [0.0; 2], r.opts.scale, pipe.levels);
     r.run_effects_on(ctx, layer, true, &mut fx);
-    let (mut adjusted, _, _) = fx.finish()?;
+    let (mut adjusted, offset, _) = fx.finish()?;
+    // An effect that changed the frame (Motion Tile's Output size): back onto the canvas.
+    if let Some((dx, dy)) = effectcraft_effects::adjustment_crop(offset, [0.0; 2], (adjusted.width, adjusted.height), (w, h)) {
+        adjusted = e.crop(&adjusted, dx, dy, w, h);
+    }
     if adjusted.width != w || adjusted.height != h {
         return Some(());
     }
     if let Some(c) = pipe.to_blend() {
         adjusted = ops::convert(e, &adjusted, &c);
     }
-    *canvas = ops::adjust_mix(e, canvas, &adjusted, &matte, opacity);
+    *canvas = if layer.blend_mode == BlendMode::Normal {
+        ops::adjust_mix(e, canvas, &adjusted, &matte, opacity)
+    } else {
+        // The adjusted comp is a layer in that mode over the comp below (#2618).
+        let iso = ops::matte(e, &adjusted, &matte, effectcraft_project::MatteKind::Alpha);
+        ops::blend_full(e, canvas, &iso, layer.blend_mode, opacity, layer.id.0 as u32, None)
+    };
     Some(())
 }
 
@@ -464,12 +492,12 @@ fn place_src(
 ) -> Option<GpuImage> {
     let pl = r.placement(ctx, layer, buf);
     if let [m] = pl.matrices.as_slice() {
-        return Some(ops::warp_q(e, target, &src, m, pl.sampling, mode, opacity, pl.seed, None, levels));
+        return Some(ops::warp_q(e, target, &src, m, ops::WarpOptions { sampling: pl.sampling, mode, opacity, seed: pl.seed }, None, levels));
     }
     let mut acc = e.zeros(target.width, target.height);
     let k = 1.0 / pl.matrices.len() as f32;
     for m in &pl.matrices {
-        acc = ops::warp(e, &acc, &src, m, pl.sampling, BlendMode::Normal, 1.0, 0, Some(k));
+        acc = ops::warp(e, &acc, &src, m, ops::WarpOptions { sampling: pl.sampling, mode: BlendMode::Normal, opacity: 1.0, seed: 0 }, Some(k));
     }
     Some(ops::blend_full(e, target, &acc, mode, opacity, pl.seed, levels))
 }
diff --git a/crates/gpu/src/yuv.rs b/crates/gpu/src/yuv.rs
new file mode 100644
index 000000000..27df90110
--- /dev/null
+++ b/crates/gpu/src/yuv.rs
@@ -0,0 +1,403 @@
+//! Export frames converted on the device to the H.264 encoder's input (8-bit BT.709 limited
+//! range 4:2:0, see `shaders/yuv.wgsl`): a 4K frame reads back 12 MB of planes instead of
+//! 133 MB of RGBA f32, and the CPU skips `to_rgba8_over` + `rgba_to_yuv420`.
+
+use wgpu::util::DeviceExt;
+
+use crate::context::{Enc, GpuImage};
+
+pub(crate) struct YuvPipe {
+    bgl: wgpu::BindGroupLayout,
+    pipe: wgpu::ComputePipeline,
+}
+
+impl YuvPipe {
+    pub(crate) fn new(device: &wgpu::Device) -> Result<YuvPipe, String> {
+        crate::context::init_resource(device, "yuv420", || {
+            let module = device.create_shader_module(wgpu::ShaderModuleDescriptor {
+                label: Some("yuv420"),
+                source: wgpu::ShaderSource::Wgsl(include_str!("shaders/yuv.wgsl").into()),
+            });
+            let storage =
+                wgpu::BindingType::Buffer { ty: wgpu::BufferBindingType::Storage { read_only: false }, has_dynamic_offset: false, min_binding_size: None };
+            let bgl = device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+                label: Some("yuv420"),
+                entries: &[
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 0,
+                        visibility: wgpu::ShaderStages::COMPUTE,
+                        ty: wgpu::BindingType::Buffer { ty: wgpu::BufferBindingType::Uniform, has_dynamic_offset: false, min_binding_size: None },
+                        count: None,
+                    },
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 1,
+                        visibility: wgpu::ShaderStages::COMPUTE,
+                        ty: wgpu::BindingType::Texture {
+                            sample_type: wgpu::TextureSampleType::Float { filterable: false },
+                            view_dimension: wgpu::TextureViewDimension::D2,
+                            multisampled: false,
+                        },
+                        count: None,
+                    },
+                    wgpu::BindGroupLayoutEntry { binding: 2, visibility: wgpu::ShaderStages::COMPUTE, ty: storage, count: None },
+                ],
+            });
+            let layout =
+                device.create_pipeline_layout(&wgpu::PipelineLayoutDescriptor { label: Some("yuv420"), bind_group_layouts: &[Some(&bgl)], immediate_size: 0 });
+            let pipe = device.create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
+                label: Some("yuv420"),
+                layout: Some(&layout),
+                module: &module,
+                entry_point: Some("yuv420"),
+                compilation_options: Default::default(),
+                cache: None,
+            });
+            YuvPipe { bgl, pipe }
+        })
+    }
+}
+
+/// The frame sizes the kernel handles: width a multiple of 8 (4 chroma samples per
+/// invocation), height even.
+pub(crate) fn supported(w: u32, h: u32) -> bool {
+    w > 0 && h > 0 && w.is_multiple_of(8) && h.is_multiple_of(2)
+}
+
+/// Bytes of the planes: Y `w×h`, then U and V `w/2 × h/2`.
+pub(crate) fn planes_len(w: u32, h: u32) -> u64 {
+    w as u64 * h as u64 + 2 * ((w / 2) as u64 * (h / 2) as u64)
+}
+
+/// Whether the [`planes_len`] storage and staging buffers for `w×h` fit within `limits`.
+pub(crate) fn fits_limits(w: u32, h: u32, limits: &wgpu::Limits) -> bool {
+    let size = planes_len(w, h);
+    size <= limits.max_storage_buffer_binding_size && size <= limits.max_buffer_size
+}
+
+/// Record the conversion of `img` over `bg` into a new `MAP_READ` buffer of
+/// [`planes_len`] bytes and submit it. `None`: the size is not [`supported`], exceeds the
+/// device's buffer limits, or buffer allocation failed.
+pub(crate) fn record(e: &mut Enc, yp: &YuvPipe, img: &GpuImage, bg: [f32; 3]) -> Option<wgpu::Buffer> {
+    let (w, h) = (img.width, img.height);
+    let g = e.g;
+    if !supported(w, h) || !fits_limits(w, h, &g.device.limits()) {
+        return None;
+    }
+    let cw = w / 2;
+    let size = planes_len(w, h);
+    let mut params = [0u8; 32];
+    // w * h fits in u32: both are at most the texture limit (16384).
+    for (i, v) in [w, h, cw, w * h / 4].into_iter().enumerate() {
+        params[i * 4..i * 4 + 4].copy_from_slice(&v.to_le_bytes());
+    }
+    for (i, v) in [bg[0], bg[1], bg[2], 1.0].into_iter().enumerate() {
+        params[16 + i * 4..16 + i * 4 + 4].copy_from_slice(&v.to_le_bytes());
+    }
+    let (out, stg, ub) = match crate::context::init_resource(&g.device, "yuv420 buffers", || {
+        let out = g.device.create_buffer(&wgpu::BufferDescriptor {
+            label: Some("yuv420 out"),
+            size,
+            usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_SRC,
+            mapped_at_creation: false,
+        });
+        let stg = g.device.create_buffer(&wgpu::BufferDescriptor {
+            label: Some("yuv420 staging"),
+            size,
+            usage: wgpu::BufferUsages::MAP_READ | wgpu::BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        let ub = g.device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: Some("yuv420 params"),
+            contents: &params,
+            usage: wgpu::BufferUsages::UNIFORM,
+        });
+        (out, stg, ub)
+    }) {
+        Ok(buffers) => buffers,
+        Err(err) => {
+            log::warn!(target: "effectcraft_gpu", "yuv420 buffers: {err}");
+            return None;
+        }
+    };
+    let view = img.texture.create_view(&Default::default());
+    let group = g.device.create_bind_group(&wgpu::BindGroupDescriptor {
+        label: Some("yuv420"),
+        layout: &yp.bgl,
+        entries: &[
+            wgpu::BindGroupEntry { binding: 0, resource: ub.as_entire_binding() },
+            wgpu::BindGroupEntry { binding: 1, resource: wgpu::BindingResource::TextureView(&view) },
+            wgpu::BindGroupEntry { binding: 2, resource: out.as_entire_binding() },
+        ],
+    });
+    {
+        let enc = e.record(&[img]);
+        {
+            let mut pass = enc.begin_compute_pass(&wgpu::ComputePassDescriptor { label: Some("yuv420"), timestamp_writes: None });
+            pass.set_pipeline(&yp.pipe);
+            pass.set_bind_group(0, &group, &[]);
+            pass.dispatch_workgroups((w / 8).div_ceil(8), (h / 2).div_ceil(8), 1);
+        }
+        enc.copy_buffer_to_buffer(&out, 0, &stg, 0, size);
+    }
+    e.submit();
+    Some(stg)
+}
+
+/// Convert `img` over `bg` and read the planes back, waiting for the device.
+pub(crate) fn convert(e: &mut Enc, yp: &YuvPipe, img: &GpuImage, bg: [f32; 3]) -> Option<Vec<u8>> {
+    let stg = record(e, yp, img, bg)?;
+    let n = planes_len(img.width, img.height) as usize;
+    e.g.read_buffer(&stg, n, n, 1).map_err(|err| log::error!(target: "effectcraft_gpu", "yuv420 readback: {err}")).ok()
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use effectcraft_raster::Image;
+
+    /// The export's conversion (`to_rgba8_over` + `rgba_to_yuv420`), the reference the kernel
+    /// is held to.
+    pub(crate) fn cpu(img: &Image, bg: [f32; 3]) -> Vec<u8> {
+        effectcraft_raster::yuv::yuv420_over(img, bg)
+    }
+
+    /// Premultiplied noise with some out-of-range values, opaque pixels, exact 8-bit levels and
+    /// a few NaN and infinite components (the CPU writes 0 for NaN).
+    pub(crate) fn noise(w: u32, h: u32, seed: u32) -> Image {
+        let mut img = Image::new(w, h);
+        let mut s = seed | 1;
+        let mut rnd = || {
+            s ^= s << 13;
+            s ^= s >> 17;
+            s ^= s << 5;
+            s as f32 / u32::MAX as f32
+        };
+        for (i, p) in img.data.iter_mut().enumerate() {
+            let a = if i % 7 == 0 { 1.0 } else { rnd() };
+            *p = if i % 97 == 3 {
+                [f32::NAN, 0.5, f32::INFINITY, a]
+            } else if i % 101 == 5 {
+                [0.2, 0.3, 0.4, f32::NAN]
+            } else if i % 103 == 7 {
+                [f32::NEG_INFINITY, 0.1, 0.9, f32::INFINITY]
+            } else if i % 5 == 0 {
+                let q = (i % 256) as f32 / 255.0;
+                [q, 1.0 - q, q * 0.5, 1.0]
+            } else {
+                [rnd() * a * 1.1 - 0.02, rnd() * a, rnd() * a, a]
+            };
+        }
+        img
+    }
+
+    /// Check `got` against the CPU's `want`. Software adapters (llvmpipe, WARP) must match
+    /// exactly. A hardware driver may contract multiply-adds or divide less exactly, which
+    /// moves a value near a rounding boundary by one level (seen on an RTX 3090 under Vulkan):
+    /// there every byte must be within one level and at most `budget` of them off (about 2–3×
+    /// the rate measured on the 3090). A wrong formula, rounding mode or NaN rule fails either
+    /// way on software adapters.
+    pub(crate) fn assert_parity(g: &crate::Gpu, got: &[u8], want: &[u8], budget: f64, what: &str) {
+        assert_eq!(got.len(), want.len(), "{what}: length");
+        let diff: Vec<usize> = (0..got.len()).filter(|&i| got[i] != want[i]).collect();
+        let max = diff.iter().map(|&i| (got[i] as i32 - want[i] as i32).abs()).max().unwrap_or(0);
+        eprintln!("{what} on {}: {} of {} bytes differ (max {max})", g.ctx.name, diff.len(), got.len());
+        if g.ctx.software {
+            assert!(diff.is_empty(), "{what}: a software adapter must match exactly, first diffs at {:?}", &diff[..diff.len().min(10)]);
+            return;
+        }
+        assert!(max <= 1, "{what}: a byte is {max} levels off, first diffs at {:?}", &diff[..diff.len().min(10)]);
+        assert!(diff.len() as f64 <= budget * got.len() as f64, "{what}: {} of {} bytes off by one", diff.len(), got.len());
+    }
+
+    #[test]
+    fn yuv420_matches_cpu() {
+        let Some(g) = crate::tests::gpu() else { return };
+        let yp = super::YuvPipe::new(&g.ctx.device).expect("yuv420 pipe");
+        for (w, h, bg) in [(264u32, 150u32, [0.05, 0.1, 0.2]), (8, 2, [1.0, 1.0, 1.0]), (1928, 6, [0.0, 0.0, 0.0])] {
+            let img = noise(w, h, w ^ (h << 16));
+            let src = g.ctx.upload_image(&img).expect("upload");
+            let got = super::convert(&mut crate::context::Enc::new(&g.ctx), &yp, &src, bg).expect("readback");
+            assert_parity(g, &got, &cpu(&img, bg), 0.00005, &format!("noise {w}x{h}"));
+        }
+    }
+
+    #[test]
+    fn unsupported_sizes_are_declined() {
+        assert!(super::supported(8, 2));
+        for (w, h) in [(0, 2), (8, 0), (12, 2), (8, 3), (7, 4)] {
+            assert!(!super::supported(w, h), "{w}x{h}");
+        }
+        assert_eq!(super::planes_len(8, 2), 16 + 2 * 4);
+    }
+
+    #[test]
+    fn sizes_exceeding_buffer_limits_are_declined() {
+        let def = wgpu::Limits::default();
+        assert!(super::fits_limits(3840, 2160, &def));
+        // 16384×16384 planes are 384 MiB, over default max_storage_buffer_binding_size (128 MiB)
+        // and max_buffer_size (256 MiB).
+        assert!(!super::fits_limits(16384, 16384, &def));
+        let size = super::planes_len(64, 64);
+        assert!(super::fits_limits(64, 64, &wgpu::Limits { max_storage_buffer_binding_size: size, max_buffer_size: size, ..def.clone() }));
+        assert!(!super::fits_limits(64, 64, &wgpu::Limits { max_storage_buffer_binding_size: size - 1, max_buffer_size: size, ..def.clone() }));
+        assert!(!super::fits_limits(64, 64, &wgpu::Limits { max_storage_buffer_binding_size: size, max_buffer_size: size - 1, ..def.clone() }));
+
+        let Some(_) = crate::tests::gpu() else { return };
+        let instance = wgpu::Instance::new(wgpu::InstanceDescriptor::new_without_display_handle());
+        let adapter = pollster::block_on(instance.request_adapter(&Default::default())).expect("adapter");
+        let required_limits = wgpu::Limits { max_storage_buffer_binding_size: 4096, max_buffer_size: 4096, ..def };
+        let (device, queue) = pollster::block_on(adapter.request_device(&crate::context::device_descriptor(required_limits))).expect("limited device");
+        let g = crate::Gpu::new(&adapter, device, queue).expect("limited Gpu");
+        let yp = super::YuvPipe::new(&g.ctx.device).expect("yuv420 pipe");
+        let src = g.ctx.upload_image(&noise(64, 64, 1)).expect("upload");
+        assert!(super::convert(&mut crate::context::Enc::new(&g.ctx), &yp, &src, [0.0; 3]).is_none());
+        assert!(g.ctx.check_health().is_ok());
+    }
+
+    #[test]
+    fn unsupported_sizes_are_not_converted() {
+        let Some(g) = crate::tests::gpu() else { return };
+        let yp = super::YuvPipe::new(&g.ctx.device).expect("yuv420 pipe");
+        let src = g.ctx.upload_image(&noise(12, 4, 3)).expect("upload");
+        assert!(super::convert(&mut crate::context::Enc::new(&g.ctx), &yp, &src, [0.0; 3]).is_none());
+    }
+}
+
+#[cfg(test)]
+mod accel_tests {
+    use effectcraft_color::Label;
+    use effectcraft_project::{BitDepth, Comp, ItemKind};
+    use effectcraft_render::{Accelerator, Backend, RenderOpts, Renderer};
+    use effectcraft_time::{FrameRate, Tick};
+
+    use crate::tests::{Pattern, Scene, opts};
+
+    fn scene(w: u32, h: u32) -> Scene {
+        let mut s = Scene::new(BitDepth::Bpc8);
+        let comp = Comp::new(w, h, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+        s.cid = s.p.add_item("Comp yuv", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+        s.comp = comp;
+        let l = s.footage(w + 7, h + 3);
+        s.push(l);
+        let sol = s.solid([0.9, 0.2, 0.4], w / 2, h / 3);
+        s.push(sol);
+        s
+    }
+
+    /// The accelerator's YUV frame is the export's CPU conversion of the very frame
+    /// `comp_frame` returns.
+    #[test]
+    fn comp_frame_yuv420_is_the_cpu_conversion_of_comp_frame() {
+        let Some(g) = crate::tests::gpu() else { return };
+        let s = scene(96, 60);
+        let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..opts() });
+        r.accel = Some(g);
+        let bg = [0.2, 0.3, 0.4];
+        let rgba = g.comp_frame(&r, s.cid, Tick::ZERO).expect("rgba frame");
+        let yuv = g.comp_frame_yuv420(&r, s.cid, Tick::ZERO, bg).expect("yuv frame");
+        super::tests::assert_parity(g, &yuv, &super::tests::cpu(&rgba, bg), 0.006, "comp frame");
+    }
+
+    #[test]
+    fn odd_sized_comps_fall_back_to_the_cpu() {
+        let Some(g) = crate::tests::gpu() else { return };
+        let s = scene(97, 61);
+        let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..opts() });
+        r.accel = Some(g);
+        assert!(g.comp_frame(&r, s.cid, Tick::ZERO).is_some());
+        assert!(g.comp_frame_yuv420(&r, s.cid, Tick::ZERO, [0.0; 3]).is_none());
+    }
+
+    #[test]
+    fn comp_frame_yuv420_falls_back_when_pipeline_init_failed() {
+        let Some(_) = crate::tests::gpu() else { return };
+        let g = crate::Gpu::try_headless().expect("headless Gpu");
+        let _ = g.ctx.yuv.set(Err("simulated yuv420 init failure".into()));
+        let s = scene(96, 60);
+        let mut r = Renderer::new(&s.p, &Pattern, RenderOpts { backend: Backend::Gpu, ..opts() });
+        r.accel = Some(&g);
+        assert!(g.comp_frame_yuv420(&r, s.cid, Tick::ZERO, [0.0; 3]).is_none());
+    }
+}
+
+#[cfg(test)]
+mod tie_tests {
+    use effectcraft_raster::Image;
+
+    fn lum(r: u8, g: u8, b: u8) -> f32 {
+        let (r, g, b) = (r as f32 / 255.0, g as f32 / 255.0, b as f32 / 255.0);
+        0.2126 * r + 0.7152 * g + 0.0722 * b
+    }
+
+    fn px(p: [u8; 3]) -> [f32; 4] {
+        [p[0] as f32 / 255.0, p[1] as f32 / 255.0, p[2] as f32 / 255.0, 1.0]
+    }
+
+    /// Opaque pixels whose Y (or whose 2×2 block's U or V) lands exactly on .5 in the CPU's f32
+    /// math: a kernel that rounds ties the other way moves most of them.
+    #[test]
+    fn rounding_ties_match_cpu() {
+        let mut ties: Vec<[u8; 3]> = vec![];
+        for r in 0..=255u8 {
+            for g in 0..=255u8 {
+                for b in 0..=255u8 {
+                    let x = 16.0 + 219.0 * lum(r, g, b);
+                    if x - x.floor() == 0.5 {
+                        ties.push([r, g, b]);
+                    }
+                }
+            }
+        }
+        assert!(!ties.is_empty());
+        let mut blocks: Vec<[[u8; 3]; 4]> = vec![];
+        let mut s = 12345u32;
+        let mut rnd = || {
+            s ^= s << 13;
+            s ^= s >> 17;
+            s ^= s << 5;
+            (s >> 24) as u8
+        };
+        // Bounded so the search stays quick in debug builds (a few hundred blocks).
+        for _ in 0..8_000_000 {
+            let blk = [[rnd(), rnd(), rnd()], [rnd(), rnd(), rnd()], [rnd(), rnd(), rnd()], [rnd(), rnd(), rnd()]];
+            let (mut a0, mut a1) = (0f32, 0f32);
+            for p in blk {
+                let l = lum(p[0], p[1], p[2]);
+                a0 += (p[2] as f32 / 255.0 - l) / 1.8556;
+                a1 += (p[0] as f32 / 255.0 - l) / 1.5748;
+            }
+            let u = 128.0 + 224.0 * a0 / 4.0;
+            let v = 128.0 + 224.0 * a1 / 4.0;
+            if u - u.floor() == 0.5 || v - v.floor() == 0.5 {
+                blocks.push(blk);
+            }
+        }
+        eprintln!("Y tie pixels: {}, chroma tie blocks: {}", ties.len(), blocks.len());
+        assert!(!blocks.is_empty());
+        let Some(g) = crate::tests::gpu() else { return };
+        let yp = super::YuvPipe::new(&g.ctx.device).expect("yuv420 pipe");
+        let w = 1024usize;
+        let h = (ties.len().div_ceil(w) + 1) & !1;
+        let mut img = Image::new(w as u32, h as u32);
+        for (i, p) in img.data.iter_mut().enumerate() {
+            *p = px(ties[i % ties.len()]);
+        }
+        let src = g.ctx.upload_image(&img).expect("upload");
+        let got = super::convert(&mut crate::context::Enc::new(&g.ctx), &yp, &src, [0.0; 3]).expect("readback");
+        super::tests::assert_parity(g, &got, &super::tests::cpu(&img, [0.0; 3]), 0.02, "Y ties");
+        let cw = 512usize;
+        let rows = blocks.len().div_ceil(cw);
+        let mut img = Image::new((cw * 2) as u32, (rows * 2) as u32);
+        for cy in 0..rows {
+            for cx in 0..cw {
+                let b = blocks[(cy * cw + cx) % blocks.len()];
+                for (k, p) in b.iter().enumerate() {
+                    let (x, y) = (cx * 2 + k % 2, cy * 2 + k / 2);
+                    img.data[y * cw * 2 + x] = px(*p);
+                }
+            }
+        }
+        let src = g.ctx.upload_image(&img).expect("upload");
+        let got = super::convert(&mut crate::context::Enc::new(&g.ctx), &yp, &src, [0.0; 3]).expect("readback");
+        super::tests::assert_parity(g, &got, &super::tests::cpu(&img, [0.0; 3]), 0.06, "chroma ties");
+    }
+}
diff --git a/crates/helper-host/Cargo.toml b/crates/helper-host/Cargo.toml
new file mode 100644
index 000000000..a593b5055
--- /dev/null
+++ b/crates/helper-host/Cargo.toml
@@ -0,0 +1,26 @@
+[package]
+name = "effectcraft-helper-host"
+description = "External effect helpers: finds helper programs, talks to them over a versioned pipe + shared-file protocol and registers their effects (plug-in API 2). Safe Rust; a crashing helper is an error, not a crash"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+effectcraft-effects = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+log = { workspace = true }
+bytemuck = { workspace = true }
+
+# The crate's integration tests (one binary, `tests/it/main.rs`): the whole protocol against a
+# fake helper. The test binary is also the helper (started with `--effectcraft-helper`), so
+# `cargo test` covers it on every platform with nothing to install; `harness = false` because
+# libtest would reject the helper argument.
+[[test]]
+name = "it"
+path = "tests/it/main.rs"
+harness = false
diff --git a/crates/helper-host/src/blocklist.rs b/crates/helper-host/src/blocklist.rs
new file mode 100644
index 000000000..a7967edfc
--- /dev/null
+++ b/crates/helper-host/src/blocklist.rs
@@ -0,0 +1,135 @@
+//! Effects that keep taking their helper down are turned off.
+//!
+//! Each time a render through a helper ends with the helper crashing or hanging, the effect is
+//! charged; at [`CRASH_LIMIT`] it is blocked: its renders fail at once with a message instead of
+//! restarting the helper again. Blocks are kept in `helper_blocklist.txt` in the state folder
+//! ([`set_state_dir`]), one effect id per line, so they last across launches until a scan with
+//! `retry` ([`clear`]).
+
+use std::collections::HashMap;
+use std::io::Read;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, OnceLock};
+
+use crate::client::lock;
+
+/// Crashes after which an effect is blocked.
+pub const CRASH_LIMIT: u32 = 3;
+
+const FILE: &str = "helper_blocklist.txt";
+/// The most of the block list file read (tens of thousands of effect ids).
+const MAX_FILE: u64 = 1 << 20;
+
+#[derive(Default)]
+struct State {
+    dir: Option<PathBuf>,
+    crashes: HashMap<String, u32>,
+    blocked: Vec<String>,
+    loaded: bool,
+}
+
+fn state() -> &'static Mutex<State> {
+    static S: OnceLock<Mutex<State>> = OnceLock::new();
+    S.get_or_init(Default::default)
+}
+
+/// Where the block list lives (EffectCraft's settings folder); helpers get it as
+/// `EFFECTCRAFT_HELPER_STATE_DIR` for their own records.
+pub fn set_state_dir(dir: PathBuf) {
+    let mut s = lock(state());
+    s.dir = Some(dir);
+    s.loaded = false;
+}
+
+pub fn state_dir() -> Option<PathBuf> {
+    lock(state()).dir.clone()
+}
+
+fn load(s: &mut State) {
+    if s.loaded {
+        return;
+    }
+    s.loaded = true;
+    if let Some(text) = s.dir.as_ref().and_then(|d| read_capped(&d.join(FILE))) {
+        for id in text.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')) {
+            if !s.blocked.iter().any(|b| b == id) {
+                s.blocked.push(id.to_string());
+            }
+        }
+    }
+}
+
+/// The file's text, at most [`MAX_FILE`] bytes of it.
+fn read_capped(path: &Path) -> Option<String> {
+    let mut text = String::new();
+    std::fs::File::open(path).ok()?.take(MAX_FILE).read_to_string(&mut text).ok()?;
+    Some(text)
+}
+
+fn save(s: &State) {
+    let Some(dir) = &s.dir else { return };
+    let mut text =
+        String::from("# Effects turned off because they kept stopping their effect helper.\n# Delete a line (or scan with retry) to try one again.\n");
+    for id in &s.blocked {
+        text.push_str(id);
+        text.push('\n');
+    }
+    if let Err(e) = std::fs::create_dir_all(dir).and_then(|_| std::fs::write(dir.join(FILE), text)) {
+        log::warn!("can't save the helper block list: {e}");
+    }
+}
+
+pub fn is_blocked(id: &str) -> bool {
+    let mut s = lock(state());
+    load(&mut s);
+    s.blocked.iter().any(|b| b == id)
+}
+
+/// Charge `id` with a helper crash; returns whether it is now blocked.
+pub fn note_crash(id: &str) -> bool {
+    let mut s = lock(state());
+    load(&mut s);
+    let n = {
+        let n = s.crashes.entry(id.to_string()).or_insert(0);
+        *n = n.saturating_add(1);
+        *n
+    };
+    if n >= CRASH_LIMIT && !s.blocked.iter().any(|b| b == id) {
+        s.blocked.push(id.to_string());
+        save(&s);
+    }
+    n >= CRASH_LIMIT
+}
+
+/// The blocked effect ids.
+pub fn blocked() -> Vec<String> {
+    let mut s = lock(state());
+    load(&mut s);
+    s.blocked.clone()
+}
+
+/// Forget every block and crash count.
+pub fn clear() {
+    let mut s = lock(state());
+    load(&mut s);
+    s.blocked.clear();
+    s.crashes.clear();
+    save(&s);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn effects_are_blocked_after_repeated_crashes() {
+        let id = "org.test.blocklist-unit";
+        for _ in 1..CRASH_LIMIT {
+            assert!(!note_crash(id));
+        }
+        assert!(note_crash(id));
+        assert!(is_blocked(id) && blocked().iter().any(|b| b == id));
+        clear();
+        assert!(!is_blocked(id));
+    }
+}
diff --git a/crates/helper-host/src/client.rs b/crates/helper-host/src/client.rs
new file mode 100644
index 000000000..8379d4dd9
--- /dev/null
+++ b/crates/helper-host/src/client.rs
@@ -0,0 +1,686 @@
+//! EffectCraft's side of a helper: the child process, its pipes and frame exchange file, and
+//! the [`EffectPlugin`] each remote effect is registered as.
+//!
+//! Nothing a helper does can take EffectCraft down: a helper that exits, hangs past its
+//! timeout or answers nonsense is stopped, the render that hit it fails with a message (shown on
+//! the effect, the frame is left as it was), and the next render starts the helper again. An
+//! effect that took its helper down [`crate::blocklist::CRASH_LIMIT`] times is blocked.
+
+use std::io::{BufRead, BufReader, Read, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Child, ChildStdin, Command, Stdio};
+use std::sync::mpsc::{Receiver, RecvTimeoutError, Sender, channel};
+use std::sync::{Arc, Condvar, Mutex, MutexGuard, PoisonError, TryLockError};
+use std::thread::ThreadId;
+use std::time::{Duration, Instant};
+
+use effectcraft_effects::plugin::{EffectPlugin, PluginFrame, PluginHost, PluginImage, PluginManifest, PluginParams};
+
+use crate::blocklist;
+use crate::frames::Exchange;
+use crate::protocol::{HELPER_ARG, ImageRef, MAX_LINE, PROTOCOL_VERSION, RemoteEffect, RenderRequest, Reply, Request, parse_reply, request_line};
+
+/// How deep renders through one helper may nest (an effect asking for its input, which another
+/// effect of the same helper renders, ...).
+const MAX_DEPTH: u32 = 16;
+/// Restarts allowed per minute before a helper is left stopped until the next scan.
+const MAX_RESTARTS_PER_MINUTE: usize = 5;
+/// A helper idle for longer than this is pinged before it is used again.
+const HEARTBEAT_AFTER: Duration = Duration::from_secs(30);
+const HEARTBEAT_TIMEOUT: Duration = Duration::from_secs(10);
+/// The longest piece of a helper's stderr logged as one line (longer lines are logged in parts).
+const MAX_LOG_LINE: u64 = 64 << 10;
+
+/// [`set_render_timeout`] (milliseconds; 0 = not set).
+static RENDER_TIMEOUT_MS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
+/// Override the render timeout (tests; `EFFECTCRAFT_HELPER_TIMEOUT` still wins).
+pub fn set_render_timeout(t: Duration) {
+    RENDER_TIMEOUT_MS.store(u64::try_from(t.as_millis()).unwrap_or(u64::MAX), std::sync::atomic::Ordering::Relaxed);
+}
+
+/// Timeout for one render step, `EFFECTCRAFT_HELPER_TIMEOUT` seconds (default 120: heavy
+/// plug-ins take a while on their first frame).
+fn render_timeout() -> Duration {
+    if let Some(s) = env_secs("EFFECTCRAFT_HELPER_TIMEOUT") {
+        return Duration::from_secs(s);
+    }
+    match RENDER_TIMEOUT_MS.load(std::sync::atomic::Ordering::Relaxed) {
+        0 => Duration::from_secs(120),
+        ms => Duration::from_millis(ms),
+    }
+}
+
+/// Timeout for start-up, `describe` and `load`, `EFFECTCRAFT_HELPER_LOAD_TIMEOUT` seconds
+/// (default 600: scanning large plug-in suites is slow).
+fn load_timeout() -> Duration {
+    Duration::from_secs(env_secs("EFFECTCRAFT_HELPER_LOAD_TIMEOUT").unwrap_or(600))
+}
+
+fn env_secs(k: &str) -> Option<u64> {
+    std::env::var(k).ok()?.trim().parse().ok().filter(|s| *s > 0)
+}
+
+pub(crate) fn lock<T>(m: &Mutex<T>) -> MutexGuard<'_, T> {
+    m.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// What the reader thread passes on.
+enum Line {
+    Reply(Result<Reply, String>),
+    Closed,
+}
+
+/// A running helper process.
+struct Conn {
+    child: Child,
+    /// Request lines for the writer thread, which owns the helper's stdin: a helper that stops
+    /// reading can block that thread, never the render waiting for it ([`Conn::send`]).
+    input: Sender<Vec<u8>>,
+    /// The writer thread's result for each line, in order.
+    written: Receiver<Result<(), String>>,
+    rx: Receiver<Line>,
+    exchange: Exchange,
+    /// The first free byte of the exchange file (images are stacked, see [`Helper::render`]).
+    top: u64,
+    last_used: Instant,
+    generation: u64,
+}
+
+impl Conn {
+    /// Write one request, waiting at most `timeout` for the helper to take it.
+    fn send(&mut self, r: &Request, timeout: Duration) -> Result<(), Failure> {
+        let line = request_line(r).map_err(Failure::Broken)?;
+        let closed = || Failure::Broken("can't write to the helper: its input is closed".into());
+        self.input.send(line.into_bytes()).map_err(|_| closed())?;
+        match self.written.recv_timeout(timeout) {
+            Ok(Ok(())) => Ok(()),
+            Ok(Err(e)) => Err(Failure::Broken(format!("can't write to the helper: {e}"))),
+            Err(RecvTimeoutError::Timeout) => {
+                Err(Failure::Broken(format!("the helper did not answer within {} s (it stopped reading its input)", timeout.as_secs())))
+            }
+            Err(RecvTimeoutError::Disconnected) => Err(closed()),
+        }
+    }
+
+    fn recv(&mut self, timeout: Duration) -> Result<Reply, Failure> {
+        match self.rx.recv_timeout(timeout) {
+            Ok(Line::Reply(Ok(r))) => Ok(r),
+            Ok(Line::Reply(Err(e))) => Err(Failure::Broken(e)),
+            Ok(Line::Closed) | Err(RecvTimeoutError::Disconnected) => {
+                // Give the process a moment to finish exiting so its status can be reported.
+                std::thread::sleep(Duration::from_millis(50));
+                let status = match self.child.try_wait() {
+                    Ok(Some(s)) => s.to_string(),
+                    _ => "closed its output".into(),
+                };
+                Err(Failure::Broken(format!("the helper stopped ({status})")))
+            }
+            Err(RecvTimeoutError::Timeout) => Err(Failure::Broken(format!("the helper did not answer within {} s", timeout.as_secs()))),
+        }
+    }
+
+    fn call(&mut self, r: &Request, timeout: Duration) -> Result<Reply, Failure> {
+        self.send(r, timeout)?;
+        self.recv(timeout)
+    }
+
+    /// Reserve room for an image of `width × height` at the top of the exchange file.
+    fn alloc(&mut self, width: u32, height: u32, origin: [f64; 2], scale: f64) -> Result<ImageRef, String> {
+        let at = ImageRef { offset: self.top, width, height, origin, scale };
+        let bytes = at.bytes().ok_or_else(|| format!("image {width}×{height} is too large for a helper"))?;
+        // Keep images 64-byte aligned for helpers that map the file.
+        self.top = self.top.checked_add(bytes.div_ceil(64).saturating_mul(64)).ok_or("frame exchange file too large")?;
+        Ok(at)
+    }
+
+    fn stop(mut self) {
+        // Not waited for: the process is killed right after, which also ends a blocked write.
+        if let Ok(line) = request_line(&Request::Shutdown) {
+            let _ = self.input.send(line.into_bytes());
+        }
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+/// Why a request failed.
+enum Failure {
+    /// The helper answered with an error and is fine.
+    Refused(String),
+    /// The helper crashed, hung or broke the protocol: it is stopped.
+    Broken(String),
+}
+
+/// Whose turn it is to talk to the helper: one thread at a time, re-entered by that thread for
+/// nested renders.
+#[derive(Default)]
+struct Turn {
+    owner: Option<ThreadId>,
+    depth: u32,
+}
+
+struct TurnGuard<'a>(&'a Helper);
+
+impl Drop for TurnGuard<'_> {
+    fn drop(&mut self) {
+        let mut t = lock(&self.0.turn);
+        t.depth = t.depth.saturating_sub(1);
+        if t.depth == 0 {
+            t.owner = None;
+            self.0.turn_cv.notify_all();
+        }
+    }
+}
+
+/// What [`Helper::status`] reports.
+#[derive(Clone, Debug, Default)]
+pub struct HelperStatus {
+    pub program: PathBuf,
+    pub name: String,
+    pub version: String,
+    pub loads: Vec<String>,
+    pub running: bool,
+    pub effects: usize,
+    pub restarts: usize,
+    pub last_error: Option<String>,
+}
+
+/// One helper program and, while it runs, its process.
+pub struct Helper {
+    program: PathBuf,
+    info: Mutex<HelperStatus>,
+    conn: Mutex<Option<Conn>>,
+    turn: Mutex<Turn>,
+    turn_cv: Condvar,
+    /// Paths loaded with [`Helper::load`], loaded again after a restart.
+    loaded: Mutex<Vec<String>>,
+    restarts: Mutex<Vec<Instant>>,
+    generation: Mutex<u64>,
+}
+
+impl Helper {
+    /// Start a helper and list its effects.
+    pub fn start(program: &Path) -> Result<(Arc<Helper>, Vec<RemoteEffect>, Vec<String>), String> {
+        let h = Arc::new(Helper {
+            program: program.to_path_buf(),
+            info: Mutex::new(HelperStatus { program: program.to_path_buf(), ..Default::default() }),
+            conn: Mutex::new(None),
+            turn: Mutex::new(Turn::default()),
+            turn_cv: Condvar::new(),
+            loaded: Mutex::new(vec![]),
+            restarts: Mutex::new(vec![]),
+            generation: Mutex::new(0),
+        });
+        let (effects, errors) = {
+            let _turn = h.take_turn()?;
+            // A helper that crashes while listing its effects (one bad plug-in) is given a
+            // second and third chance: helpers remember what crashed them and skip it.
+            let mut last = String::new();
+            let mut out = None;
+            for _ in 0..3 {
+                match h.with_conn(|c| c.call(&Request::Describe, load_timeout())) {
+                    Ok(Reply::Effects { effects, errors }) => {
+                        out = Some((effects, errors));
+                        break;
+                    }
+                    Ok(other) => last = format!("unexpected reply to describe: {other:?}"),
+                    Err(Failure::Refused(e) | Failure::Broken(e)) => last = e,
+                }
+            }
+            out.ok_or_else(|| format!("{}: {last}", program.display()))?
+        };
+        lock(&h.info).effects = effects.len();
+        Ok((h, effects, errors))
+    }
+
+    pub fn program(&self) -> &Path {
+        &self.program
+    }
+
+    pub fn status(&self) -> HelperStatus {
+        let mut s = lock(&self.info).clone();
+        // A render holds the process for as long as the helper works on it: don't wait for it.
+        s.running = match self.conn.try_lock() {
+            Ok(c) => c.is_some(),
+            Err(TryLockError::Poisoned(c)) => c.into_inner().is_some(),
+            Err(TryLockError::WouldBlock) => true,
+        };
+        s.restarts = lock(&self.restarts).len();
+        s
+    }
+
+    pub fn loads(&self, ext: &str) -> bool {
+        lock(&self.info).loads.iter().any(|e| e.eq_ignore_ascii_case(ext))
+    }
+
+    pub(crate) fn add_effects(&self, n: usize) {
+        let mut i = lock(&self.info);
+        i.effects = i.effects.saturating_add(n);
+    }
+
+    /// Load effects from a path through the helper ([`Request::Load`]).
+    pub fn load(&self, path: &str) -> Result<(Vec<RemoteEffect>, Vec<String>), String> {
+        let _turn = self.take_turn()?;
+        let r = self.with_conn(|c| c.call(&Request::Load { path: path.to_string() }, load_timeout()));
+        match r {
+            Ok(Reply::Effects { effects, errors }) => {
+                let mut l = lock(&self.loaded);
+                if !l.iter().any(|p| p == path) {
+                    l.push(path.to_string());
+                }
+                Ok((effects, errors))
+            }
+            Ok(Reply::Error { message }) => Err(message),
+            Ok(other) => Err(format!("unexpected reply to load: {other:?}")),
+            Err(Failure::Refused(e) | Failure::Broken(e)) => Err(e),
+        }
+    }
+
+    /// Stop the process (it starts again when next needed).
+    pub fn stop(&self) {
+        if let Some(c) = lock(&self.conn).take() {
+            c.stop();
+        }
+    }
+
+    fn take_turn(&self) -> Result<TurnGuard<'_>, String> {
+        let me = std::thread::current().id();
+        // Bounded, so a thread that can't get the helper (its holder waiting for work that a
+        // blocked thread pool would have to do) fails instead of hanging forever.
+        let limit = load_timeout();
+        let deadline = Instant::now().checked_add(limit);
+        let mut t = lock(&self.turn);
+        loop {
+            match t.owner {
+                None => {
+                    t.owner = Some(me);
+                    t.depth = 1;
+                    break;
+                }
+                Some(o) if o == me => {
+                    if t.depth >= MAX_DEPTH {
+                        return Err("effects through this helper are nested too deeply".into());
+                    }
+                    t.depth += 1;
+                    break;
+                }
+                Some(_) => {
+                    let left = deadline.map_or(limit, |d| d.saturating_duration_since(Instant::now()));
+                    if left.is_zero() {
+                        return Err(format!("the effect helper was busy for more than {} s", limit.as_secs()));
+                    }
+                    t = self.turn_cv.wait_timeout(t, left).unwrap_or_else(PoisonError::into_inner).0;
+                }
+            }
+        }
+        Ok(TurnGuard(self))
+    }
+
+    /// Run `f` on the running process, starting it first if needed. A [`Failure::Broken`]
+    /// stops the process.
+    fn with_conn<T>(&self, f: impl FnOnce(&mut Conn) -> Result<T, Failure>) -> Result<T, Failure> {
+        let mut g = lock(&self.conn);
+        if g.is_none() {
+            *g = Some(self.spawn().map_err(|e| self.not_started(e))?);
+        }
+        let Some(c) = g.as_mut() else { return Err(Failure::Broken("the helper is not running".into())) };
+        if c.last_used.elapsed() > HEARTBEAT_AFTER && !matches!(c.call(&Request::Ping, HEARTBEAT_TIMEOUT), Ok(Reply::Pong)) {
+            if let Some(dead) = g.take() {
+                dead.stop();
+            }
+            self.note_error("the helper stopped answering; restarting it");
+            *g = Some(self.spawn().map_err(|e| self.not_started(e))?);
+        }
+        let Some(c) = g.as_mut() else { return Err(Failure::Broken("the helper is not running".into())) };
+        let r = f(c);
+        c.last_used = Instant::now();
+        if let Err(Failure::Broken(e)) = &r {
+            self.note_error(e);
+            if let Some(dead) = g.take() {
+                dead.stop();
+            }
+        }
+        r
+    }
+
+    /// Run `f` on the process a render started on (generation `started`), without starting or
+    /// pinging one: mid-render the helper is waiting for the answer to its question. A
+    /// [`Failure::Broken`] stops the process. A process already gone was stopped by what broke it
+    /// (a nested render, charged there): not charged again to this render's effect.
+    fn with_running<T>(&self, started: u64, f: impl FnOnce(&mut Conn) -> Result<T, Failure>) -> Result<T, Failure> {
+        let mut g = lock(&self.conn);
+        let Some(c) = g.as_mut().filter(|c| c.generation == started) else {
+            return Err(Failure::Refused("the helper stopped during the render".into()));
+        };
+        let r = f(c);
+        c.last_used = Instant::now();
+        if let Err(Failure::Broken(e)) = &r {
+            self.note_error(e);
+            if let Some(dead) = g.take() {
+                dead.stop();
+            }
+        }
+        r
+    }
+
+    /// A helper that could not be started (not installed any more, restarting too often, no
+    /// frame exchange file): reported, but not charged to the effect that asked for it, since
+    /// nothing it did stopped the helper ([`Failure::Refused`], not [`Failure::Broken`]).
+    fn not_started(&self, e: String) -> Failure {
+        self.note_error(&e);
+        Failure::Refused(e)
+    }
+
+    fn note_error(&self, e: &str) {
+        log::warn!("helper {}: {e}", self.program.display());
+        lock(&self.info).last_error = Some(e.to_string());
+    }
+
+    fn spawn(&self) -> Result<Conn, String> {
+        {
+            let mut r = lock(&self.restarts);
+            r.retain(|t| t.elapsed() < Duration::from_secs(60));
+            if r.len() >= MAX_RESTARTS_PER_MINUTE {
+                return Err("the helper keeps stopping; it stays off until the next scan (Effect ▸ Scan for Effect Helpers)".into());
+            }
+            r.push(Instant::now());
+        }
+        let exchange = Exchange::create().map_err(|e| format!("can't create the frame exchange file: {e}"))?;
+        let mut cmd = Command::new(&self.program);
+        cmd.arg(HELPER_ARG).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped());
+        if let Some(dir) = blocklist::state_dir() {
+            cmd.env("EFFECTCRAFT_HELPER_STATE_DIR", dir);
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::process::CommandExt;
+            // CREATE_NO_WINDOW: no console window per helper.
+            cmd.creation_flags(0x0800_0000);
+        }
+        let mut child = cmd.spawn().map_err(|e| format!("can't start {}: {e}", self.program.display()))?;
+        let (Some(stdin), Some(stdout), stderr) = (child.stdin.take(), child.stdout.take(), child.stderr.take()) else {
+            let _ = child.kill();
+            let _ = child.wait();
+            return Err("the helper's pipes are unavailable".into());
+        };
+        let (tx, rx) = channel();
+        let label = self.program.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        let l2 = label.clone();
+        let spawned = std::thread::Builder::new().name(format!("helper-out {label}")).spawn(move || {
+            let mut r = BufReader::new(stdout);
+            loop {
+                let mut buf = vec![];
+                match (&mut r).take(MAX_LINE).read_until(b'\n', &mut buf) {
+                    Ok(0) | Err(_) => {
+                        let _ = tx.send(Line::Closed);
+                        return;
+                    }
+                    Ok(_) => {
+                        let line = String::from_utf8_lossy(&buf);
+                        match parse_reply(&line) {
+                            Some(reply) => {
+                                if tx.send(Line::Reply(reply)).is_err() {
+                                    return;
+                                }
+                            }
+                            None => log::info!("helper {l2}: {}", line.trim_end()),
+                        }
+                    }
+                }
+            }
+        });
+        if let Err(e) = spawned {
+            let _ = child.kill();
+            let _ = child.wait();
+            return Err(format!("can't start a reader thread: {e}"));
+        }
+        let (input, lines) = channel::<Vec<u8>>();
+        let (done, written) = channel();
+        let writer = std::thread::Builder::new().name(format!("helper-in {label}")).spawn(move || {
+            let mut stdin: ChildStdin = stdin;
+            for line in lines {
+                let r = stdin.write_all(&line).and_then(|_| stdin.flush()).map_err(|e| e.to_string());
+                let failed = r.is_err();
+                if done.send(r).is_err() || failed {
+                    return;
+                }
+            }
+        });
+        if let Err(e) = writer {
+            let _ = child.kill();
+            let _ = child.wait();
+            return Err(format!("can't start a writer thread: {e}"));
+        }
+        if let Some(err) = stderr {
+            // Drained to the end whatever it holds (bytes that aren't UTF-8, endless lines): a
+            // helper blocked on a full stderr pipe would hang its render.
+            let _ = std::thread::Builder::new().name(format!("helper-err {label}")).spawn(move || {
+                let mut r = BufReader::new(err);
+                let mut buf = vec![];
+                loop {
+                    buf.clear();
+                    match (&mut r).take(MAX_LOG_LINE).read_until(b'\n', &mut buf) {
+                        Ok(0) | Err(_) => return,
+                        Ok(_) => log::info!("helper {label}: {}", String::from_utf8_lossy(&buf).trim_end()),
+                    }
+                }
+            });
+        }
+        let generation = {
+            let mut g = lock(&self.generation);
+            *g = g.saturating_add(1);
+            *g
+        };
+        let mut c = Conn { child, input, written, rx, exchange, top: 0, last_used: Instant::now(), generation };
+        let frames = c.exchange.path().to_string_lossy().into_owned();
+        match c.call(&Request::Hello { version: PROTOCOL_VERSION, frames }, load_timeout()) {
+            Ok(Reply::Hello { version, name, helper_version, loads }) if version == PROTOCOL_VERSION => {
+                let mut i = lock(&self.info);
+                (i.name, i.version, i.loads) = (name, helper_version, loads);
+            }
+            Ok(Reply::Hello { version, .. }) => {
+                c.stop();
+                return Err(format!("the helper speaks protocol {version}; this EffectCraft speaks {PROTOCOL_VERSION}"));
+            }
+            Ok(Reply::Error { message }) => {
+                c.stop();
+                return Err(message);
+            }
+            Ok(other) => {
+                c.stop();
+                return Err(format!("unexpected reply to hello: {other:?}"));
+            }
+            Err(Failure::Refused(e) | Failure::Broken(e)) => {
+                c.stop();
+                return Err(e);
+            }
+        }
+        c.exchange.unlink();
+        // After a restart the new process knows no effects yet: list them again (the first
+        // start lists them in `Helper::start`), then load what the user loaded before.
+        if generation > 1 && !matches!(c.call(&Request::Describe, load_timeout()), Ok(Reply::Effects { .. })) {
+            c.stop();
+            return Err("the restarted helper could not list its effects".into());
+        }
+        for path in lock(&self.loaded).clone() {
+            if !matches!(c.call(&Request::Load { path: path.clone() }, load_timeout()), Ok(Reply::Effects { .. })) {
+                log::warn!("helper {}: reloading {path} failed", self.program.display());
+            }
+        }
+        Ok(c)
+    }
+
+    fn padding(&self, effect: &str, params: &PluginParams, time: f64, scale: f64, layer_size: [f64; 2], instance: u64) -> Result<u32, String> {
+        let _turn = self.take_turn()?;
+        let req = Request::Padding { effect: effect.to_string(), instance, time, scale, layer_size, flat: params.flat.to_vec(), texts: params.texts.to_vec() };
+        match self.with_conn(|c| c.call(&req, render_timeout())) {
+            Ok(Reply::Padding { pixels }) => Ok(pixels),
+            Ok(Reply::Error { message }) => Err(message),
+            Ok(other) => Err(format!("unexpected reply to padding: {other:?}")),
+            Err(Failure::Refused(e) | Failure::Broken(e)) => Err(e),
+        }
+    }
+
+    /// Render one frame through the helper. Images live on a stack in the exchange file: the
+    /// frame first, then whatever the helper asks for, freed again when the render ends (nested
+    /// renders stack above).
+    fn render(&self, effect: &str, frame: &mut PluginFrame, params: &PluginParams, time: f64, host: &dyn PluginHost) -> Result<(), Failure> {
+        let _turn = self.take_turn().map_err(Failure::Refused)?;
+        // The generation of the process this render runs on: taken inside `with_conn`, which
+        // may start the process (after a crash or `stop`), so it is never that of a dead one.
+        let (at, base, started) = self.with_conn(|c| {
+            let base = c.top;
+            let at = c.alloc(frame.width, frame.height, frame.origin, frame.scale).map_err(Failure::Refused)?;
+            // Nothing is sent yet, so the helper is fine (a full disk, say): not its fault.
+            if let Err(e) = c.exchange.write(&at, frame.pixels) {
+                c.top = base;
+                return Err(Failure::Refused(e));
+            }
+            Ok((at, base, c.generation))
+        })?;
+        let req = Request::Render(RenderRequest {
+            effect: effect.to_string(),
+            instance: host.instance_key(),
+            time,
+            frame: at,
+            layer_size: frame.layer_size,
+            flat: params.flat.to_vec(),
+            texts: params.texts.to_vec(),
+            frame_rate: host.frame_rate(),
+            frame_range: host.frame_range(),
+        });
+        let result = self.converse(req, frame, &at, host, started);
+        // Free this render's images (if the same process is still running).
+        if let Some(c) = lock(&self.conn).as_mut()
+            && c.generation == started
+        {
+            c.top = base;
+        }
+        result
+    }
+
+    fn converse(&self, req: Request, frame: &mut PluginFrame, at: &ImageRef, host: &dyn PluginHost, started: u64) -> Result<(), Failure> {
+        let mut next = req;
+        loop {
+            let reply = self.with_running(started, |c| c.call(&next, render_timeout()))?;
+            next = match reply {
+                Reply::Done => return self.with_running(started, |c| c.exchange.read_into(at, frame.pixels).map_err(Failure::Broken)),
+                Reply::Error { message } => return Err(Failure::Refused(message)),
+                // Host callbacks run without holding the process, so they may render through
+                // this helper again (on this thread: the turn is re-entered).
+                Reply::InputAt { time } => self.send_image(host.input_at(time), started)?,
+                Reply::LayerInput { param, time } => self.send_image(host.layer_input(&param, time), started)?,
+                Reply::ParamsAt { time } => Request::Params { values: host.params_at(time) },
+                other => return Err(Failure::Broken(format!("unexpected reply during a render: {other:?}"))),
+            };
+        }
+    }
+
+    /// Put a callback's image in the exchange file and make the answer. The helper is waiting
+    /// for one, so an image that can't be passed on is answered with none (failing here would
+    /// leave it waiting, out of step with the next request).
+    fn send_image(&self, img: Option<PluginImage>, started: u64) -> Result<Request, Failure> {
+        let Some(img) = img.filter(|i| u64::from(i.width).saturating_mul(u64::from(i.height)) == i.pixels.len() as u64) else {
+            return Ok(Request::Image { image: None });
+        };
+        self.with_running(started, |c| {
+            let base = c.top;
+            let written = c.alloc(img.width, img.height, img.origin, img.scale).and_then(|at| c.exchange.write(&at, &img.pixels).map(|()| at));
+            Ok(match written {
+                Ok(at) => Request::Image { image: Some(at) },
+                Err(e) => {
+                    log::warn!("helper {}: {e}", self.program.display());
+                    c.top = base;
+                    Request::Image { image: None }
+                }
+            })
+        })
+    }
+}
+
+impl Drop for Helper {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+/// A helper's effect, registered like any plug-in effect.
+pub struct HelperEffect {
+    helper: Arc<Helper>,
+    manifest: PluginManifest,
+    padding: bool,
+}
+
+impl HelperEffect {
+    pub fn new(helper: Arc<Helper>, remote: RemoteEffect) -> HelperEffect {
+        HelperEffect { helper, manifest: remote.manifest, padding: remote.padding }
+    }
+}
+
+/// A host for [`EffectPlugin::render`] without services.
+struct NoHost;
+
+impl PluginHost for NoHost {
+    fn input_at(&self, _: f64) -> Option<PluginImage> {
+        None
+    }
+    fn layer_input(&self, _: &str, _: f64) -> Option<PluginImage> {
+        None
+    }
+    fn params_at(&self, _: f64) -> Option<(Vec<f64>, Vec<String>)> {
+        None
+    }
+    fn frame_rate(&self) -> f64 {
+        30.0
+    }
+    fn time(&self) -> f64 {
+        0.0
+    }
+}
+
+impl EffectPlugin for HelperEffect {
+    fn manifest(&self) -> &PluginManifest {
+        &self.manifest
+    }
+
+    fn render(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64) -> Result<(), String> {
+        self.render_v2(frame, params, time, &NoHost)
+    }
+
+    fn source(&self) -> String {
+        format!("helper: {}", self.helper.program.display())
+    }
+
+    fn padding(&self, params: &PluginParams, time: f64, scale: f64, layer_size: [f64; 2], instance_key: u64) -> u32 {
+        if !self.padding || blocklist::is_blocked(&self.manifest.id) {
+            return 0;
+        }
+        match self.helper.padding(&self.manifest.id, params, time, scale, layer_size, instance_key) {
+            Ok(p) => p,
+            Err(e) => {
+                log::warn!("helper effect `{}`: padding: {e}", self.manifest.id);
+                0
+            }
+        }
+    }
+
+    fn render_v2(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64, host: &dyn PluginHost) -> Result<(), String> {
+        let id = &self.manifest.id;
+        if blocklist::is_blocked(id) {
+            return Err(format!(
+                "{} is turned off: it stopped its helper {} times (Effect ▸ Scan for Effect Helpers with retry turns it back on)",
+                self.manifest.name,
+                blocklist::CRASH_LIMIT
+            ));
+        }
+        match self.helper.render(id, frame, params, time, host) {
+            Ok(()) => Ok(()),
+            Err(Failure::Refused(e)) => Err(e),
+            Err(Failure::Broken(e)) => {
+                blocklist::note_crash(id);
+                Err(format!("{}: the effect helper failed: {e}", self.manifest.name))
+            }
+        }
+    }
+}
diff --git a/crates/helper-host/src/frames.rs b/crates/helper-host/src/frames.rs
new file mode 100644
index 000000000..1570ce459
--- /dev/null
+++ b/crates/helper-host/src/frames.rs
@@ -0,0 +1,121 @@
+//! The frame exchange file: pixels shared between EffectCraft and a helper without going
+//! through the control pipe. EffectCraft creates it (in `/dev/shm` when there is one, so it
+//! stays in memory, else the temp folder) and both sides read and write it at the offsets the
+//! messages name. Plain file I/O, no `unsafe`: the OS page cache makes it shared memory in
+//! practice, and a helper is free to map it.
+
+use std::fs::{File, OpenOptions};
+use std::io::{Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use crate::protocol::ImageRef;
+
+/// An open frame exchange file.
+pub struct Exchange {
+    file: File,
+    path: PathBuf,
+    /// Remove the file when dropped (the side that created it).
+    owned: bool,
+}
+
+impl Exchange {
+    /// Create a new, empty exchange file (EffectCraft's side).
+    pub fn create() -> std::io::Result<Exchange> {
+        static N: AtomicU64 = AtomicU64::new(0);
+        let shm = Path::new("/dev/shm");
+        let dir = if cfg!(target_os = "linux") && shm.is_dir() { shm.to_path_buf() } else { std::env::temp_dir() };
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.subsec_nanos()).unwrap_or(0);
+        let path = dir.join(format!("effectcraft-helper-{}-{}-{nanos}.frames", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let mut opts = OpenOptions::new();
+        opts.read(true).write(true).create_new(true);
+        // Frames are the user's pixels and /dev/shm is shared: only this user may read them
+        // (the helper runs as the same user).
+        #[cfg(unix)]
+        std::os::unix::fs::OpenOptionsExt::mode(&mut opts, 0o600);
+        let file = opts.open(&path)?;
+        Ok(Exchange { file, path, owned: true })
+    }
+
+    /// Open an exchange file EffectCraft created (the helper's side).
+    pub fn open(path: &Path) -> std::io::Result<Exchange> {
+        let file = OpenOptions::new().read(true).write(true).open(path)?;
+        Ok(Exchange { file, path: path.to_path_buf(), owned: false })
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    /// Remove the file's name once both sides have it open (Unix keeps the open file usable),
+    /// so nothing is left behind if either side dies.
+    pub fn unlink(&mut self) {
+        if cfg!(unix) && self.owned && std::fs::remove_file(&self.path).is_ok() {
+            self.owned = false;
+        }
+    }
+
+    /// Write `pixels` as the image `at` describes.
+    pub fn write(&mut self, at: &ImageRef, pixels: &[[f32; 4]]) -> Result<(), String> {
+        if at.pixels() != Some(pixels.len()) {
+            return Err(format!("image is {}×{} but has {} pixels", at.width, at.height, pixels.len()));
+        }
+        self.file.seek(SeekFrom::Start(at.offset)).map_err(io)?;
+        self.file.write_all(bytemuck::cast_slice(pixels)).map_err(io)
+    }
+
+    /// Read the image `at` describes into `out` (which must have its size).
+    pub fn read_into(&mut self, at: &ImageRef, out: &mut [[f32; 4]]) -> Result<(), String> {
+        if at.pixels() != Some(out.len()) {
+            return Err(format!("image is {}×{} but the buffer has {} pixels", at.width, at.height, out.len()));
+        }
+        self.file.seek(SeekFrom::Start(at.offset)).map_err(io)?;
+        self.file.read_exact(bytemuck::cast_slice_mut(out)).map_err(io)
+    }
+
+    /// Read the image `at` describes.
+    pub fn read(&mut self, at: &ImageRef) -> Result<Vec<[f32; 4]>, String> {
+        let n = at.pixels().ok_or_else(|| format!("image {}×{} is too large", at.width, at.height))?;
+        let mut out = vec![[0.0f32; 4]; n];
+        self.read_into(at, &mut out)?;
+        Ok(out)
+    }
+}
+
+fn io(e: std::io::Error) -> String {
+    format!("frame exchange: {e}")
+}
+
+impl Drop for Exchange {
+    fn drop(&mut self) {
+        if self.owned {
+            let _ = std::fs::remove_file(&self.path);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn both_sides_see_the_same_pixels() {
+        let mut a = Exchange::create().unwrap();
+        let mut b = Exchange::open(a.path()).unwrap();
+        // Owner-only: frames are the user's pixels and /dev/shm is shared.
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(std::fs::metadata(a.path()).unwrap().permissions().mode() & 0o777, 0o600);
+        }
+        let at = ImageRef { offset: 64, width: 2, height: 1, origin: [0.0; 2], scale: 1.0 };
+        a.write(&at, &[[0.1, 0.2, 0.3, 0.4], [1.0, 2.0, 3.0, 4.0]]).unwrap();
+        assert_eq!(b.read(&at).unwrap()[1], [1.0, 2.0, 3.0, 4.0]);
+        assert!(b.write(&at, &[[0.0; 4]]).is_err(), "size mismatch is an error");
+        let p = a.path().to_path_buf();
+        a.unlink();
+        drop(a);
+        drop(b);
+        assert!(!p.exists());
+    }
+}
diff --git a/crates/helper-host/src/lib.rs b/crates/helper-host/src/lib.rs
new file mode 100644
index 000000000..dd91f23b1
--- /dev/null
+++ b/crates/helper-host/src/lib.rs
@@ -0,0 +1,258 @@
+//! # effectcraft-helper-host (L3)
+//!
+//! **External effect helpers**: separate programs that offer effects to EffectCraft over a small,
+//! versioned protocol ([`protocol`], `docs/external-helpers.md`, ADR
+//! `docs/adr/0001-external-effect-helpers.md`). EffectCraft finds installed helpers
+//! ([`find_helpers`]), starts each as a child process, lists its effects and registers every one
+//! as an ordinary plug-in effect (plug-in API 2), so the UI, the property tree, keyframes,
+//! scripting and the command surface need nothing new. Rendering sends the frame to the helper
+//! through a shared exchange file ([`frames`]) and answers its questions (the input at another
+//! time, another layer, parameters at another time) while it works.
+//!
+//! The point is containment: whatever native code a helper runs (an OpenFX plug-in host, for
+//! example) runs in **its** process. If it crashes, hangs or talks nonsense, EffectCraft stops
+//! it, shows the error on the effect, leaves the frame as it was and starts the helper again
+//! for the next render; an effect that keeps taking its helper down is turned off
+//! ([`blocklist`]). This crate is safe Rust (`unsafe_code = "forbid"`, like the rest of the
+//! workspace), loads no native code and opens no network connection.
+//!
+//! [`serve`] is the helper side, for helper programs written in Rust.
+//!
+//! Native only: on wasm32 the crate is empty (there are no processes to start).
+
+#![cfg(not(target_arch = "wasm32"))]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+pub mod blocklist;
+pub mod client;
+pub mod frames;
+pub mod protocol;
+pub mod serve;
+
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, OnceLock};
+
+use effectcraft_effects::plugin::{plugin, register_plugin};
+use serde_json::{Value, json};
+
+use crate::client::{Helper, HelperEffect, lock};
+use crate::protocol::RemoteEffect;
+
+/// Helper program names start with this (`effectcraft-helper-ofx`, plus `.exe` on Windows).
+pub const PROGRAM_PREFIX: &str = "effectcraft-helper-";
+
+/// The running helpers.
+fn helpers() -> &'static Mutex<Vec<Arc<Helper>>> {
+    static H: OnceLock<Mutex<Vec<Arc<Helper>>>> = OnceLock::new();
+    H.get_or_init(Default::default)
+}
+
+/// Where helpers are looked for: `helpers/` next to the executable, `helpers/` in the settings
+/// folder (`config_dir`), and every entry of `EFFECTCRAFT_HELPER_PATH` (a path list of helper
+/// programs or folders).
+pub fn default_search_paths(config_dir: Option<&Path>) -> Vec<PathBuf> {
+    let mut v = vec![];
+    if let Some(dir) = std::env::current_exe().ok().and_then(|e| e.parent().map(Path::to_path_buf)) {
+        v.push(dir.join("helpers"));
+        // macOS app bundles: Contents/MacOS/effectcraft → Contents/Helpers.
+        if cfg!(target_os = "macos")
+            && let Some(contents) = dir.parent()
+        {
+            v.push(contents.join("Helpers"));
+        }
+    }
+    if let Some(c) = config_dir {
+        v.push(c.join("helpers"));
+    }
+    if let Some(p) = std::env::var_os("EFFECTCRAFT_HELPER_PATH") {
+        v.extend(std::env::split_paths(&p).filter(|p| !p.as_os_str().is_empty()));
+    }
+    v
+}
+
+/// Whether a file name is a helper program's.
+pub fn is_helper_name(name: &str) -> bool {
+    let stem = if cfg!(windows) {
+        match name.len().checked_sub(4).and_then(|i| name.get(i..).map(|ext| (i, ext))) {
+            Some((i, ext)) if ext.eq_ignore_ascii_case(".exe") => name.get(..i).unwrap_or(""),
+            _ => return false,
+        }
+    } else {
+        name
+    };
+    stem.len() > PROGRAM_PREFIX.len() && stem.starts_with(PROGRAM_PREFIX) && !stem.contains('.')
+}
+
+/// The helper programs in `paths`: files named `effectcraft-helper-*` in each folder and its
+/// direct subfolders, and paths that are themselves such files (any name is accepted for an
+/// explicit file). Sorted, without duplicates.
+pub fn find_helpers(paths: &[PathBuf]) -> Vec<PathBuf> {
+    fn named(p: &Path) -> bool {
+        p.is_file() && p.file_name().and_then(|n| n.to_str()).is_some_and(is_helper_name)
+    }
+    let mut out = vec![];
+    for p in paths {
+        if p.is_file() {
+            out.push(p.clone());
+            continue;
+        }
+        let Ok(rd) = std::fs::read_dir(p) else { continue };
+        for e in rd.flatten() {
+            let path = e.path();
+            if named(&path) {
+                out.push(path);
+            } else if path.is_dir()
+                && let Ok(sub) = std::fs::read_dir(&path)
+            {
+                out.extend(sub.flatten().map(|e| e.path()).filter(|p| named(p)));
+            }
+        }
+    }
+    out.sort();
+    out.dedup();
+    out
+}
+
+/// Register a helper's effects. Effects already registered (an earlier scan) are kept as they
+/// are; blocked effects are reported, not registered.
+fn register(helper: &Arc<Helper>, effects: Vec<RemoteEffect>, errors: &mut Vec<String>) -> Vec<Value> {
+    let mut loaded = vec![];
+    let mut added = 0;
+    for e in effects {
+        let id = e.manifest.id.clone();
+        if blocklist::is_blocked(&id) {
+            errors.push(format!("{id}: turned off because it kept stopping its helper (scan with retry to try again)"));
+            continue;
+        }
+        if plugin(&id).is_some() {
+            continue;
+        }
+        let (name, category) = (e.manifest.name.clone(), e.manifest.category.clone());
+        match register_plugin(Arc::new(HelperEffect::new(helper.clone(), e))) {
+            Ok(_) => {
+                added += 1;
+                loaded.push(json!({"id": id, "name": name, "category": category, "helper": helper.program().to_string_lossy()}));
+            }
+            Err(err) => errors.push(format!("{id}: {err}")),
+        }
+    }
+    helper.add_effects(added);
+    loaded
+}
+
+/// Start every helper found in `paths` that isn't running yet and register its effects.
+/// `retry` forgets the block list first. Returns `{paths, helpers, loaded, errors}`.
+pub fn scan_paths(paths: &[PathBuf], retry: bool) -> Value {
+    if retry {
+        blocklist::clear();
+    }
+    let (mut started, mut loaded, mut errors) = (vec![], vec![], vec![]);
+    for program in find_helpers(paths) {
+        if lock(helpers()).iter().any(|h| h.program() == program) {
+            continue;
+        }
+        match Helper::start(&program) {
+            Ok((h, effects, errs)) => {
+                errors.extend(errs.into_iter().map(|e| format!("{}: {e}", program.display())));
+                loaded.extend(register(&h, effects, &mut errors));
+                started.push(json!(program.to_string_lossy()));
+                lock(helpers()).push(h);
+            }
+            Err(e) => errors.push(e),
+        }
+    }
+    json!({
+        "paths": paths.iter().map(|p| p.to_string_lossy()).collect::<Vec<_>>(),
+        "helpers": started,
+        "loaded": loaded,
+        "errors": errors,
+    })
+}
+
+/// Load a file or folder through the helpers that accept its extension (a folder goes to every
+/// helper that loads anything). Returns `{loaded, errors}`.
+pub fn load_path(path: &str) -> Result<Value, String> {
+    let p = Path::new(path);
+    let ext = p.extension().and_then(|e| e.to_str()).unwrap_or("").to_string();
+    // `.ofx.bundle` folders and the like: match on any dotted part of the name.
+    let parts: Vec<String> = p.file_name().and_then(|n| n.to_str()).map(|n| n.split('.').skip(1).map(str::to_string).collect()).unwrap_or_default();
+    let list: Vec<Arc<Helper>> = lock(helpers()).clone();
+    let takers: Vec<Arc<Helper>> = list
+        .into_iter()
+        .filter(|h| {
+            let s = h.status();
+            if p.is_dir() && parts.is_empty() { !s.loads.is_empty() } else { h.loads(&ext) || parts.iter().any(|x| h.loads(x)) }
+        })
+        .collect();
+    if takers.is_empty() {
+        return Err(format!("no effect helper loads `{path}` (installed helpers: Effect ▸ Scan for Effect Helpers)"));
+    }
+    let (mut loaded, mut errors) = (vec![], vec![]);
+    for h in takers {
+        match h.load(path) {
+            Ok((effects, errs)) => {
+                errors.extend(errs);
+                loaded.extend(register(&h, effects, &mut errors));
+            }
+            Err(e) => errors.push(e),
+        }
+    }
+    if loaded.is_empty() && !errors.is_empty() {
+        return Err(errors.join("; "));
+    }
+    Ok(json!({"loaded": loaded, "errors": errors}))
+}
+
+/// The helpers and their state: `{helpers: [{program, name, version, loads, running, effects,
+/// restarts, error}], blocked}`.
+pub fn list() -> Value {
+    let helpers: Vec<Value> = lock(helpers())
+        .iter()
+        .map(|h| {
+            let s = h.status();
+            json!({
+                "program": s.program.to_string_lossy(),
+                "name": s.name,
+                "version": s.version,
+                "loads": s.loads,
+                "running": s.running,
+                "effects": s.effects,
+                "restarts": s.restarts,
+                "error": s.last_error,
+            })
+        })
+        .collect();
+    json!({"helpers": helpers, "blocked": blocklist::blocked()})
+}
+
+/// Stop every helper process (they start again when needed). Called when the app quits;
+/// helpers also exit on their own when EffectCraft's end of the pipe closes.
+pub fn stop_all() {
+    for h in lock(helpers()).iter() {
+        h.stop();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn helper_programs_are_recognised_by_name() {
+        if cfg!(windows) {
+            assert!(is_helper_name("effectcraft-helper-ofx.exe"));
+            assert!(!is_helper_name("effectcraft-helper-ofx"));
+        } else {
+            assert!(is_helper_name("effectcraft-helper-ofx"));
+            assert!(!is_helper_name("effectcraft-helper-ofx.pdb"));
+        }
+        assert!(!is_helper_name("effectcraft-helper-"));
+        assert!(!is_helper_name("effectcraft"));
+    }
+
+    #[test]
+    fn missing_folders_find_nothing_and_loading_without_helpers_is_an_error() {
+        assert!(find_helpers(&[PathBuf::from("/no/such/folder")]).is_empty());
+        assert!(load_path("/no/such/thing.xyz").is_err());
+    }
+}
diff --git a/crates/helper-host/src/protocol.rs b/crates/helper-host/src/protocol.rs
new file mode 100644
index 000000000..48a891023
--- /dev/null
+++ b/crates/helper-host/src/protocol.rs
@@ -0,0 +1,207 @@
+//! The helper protocol, version [`PROTOCOL_VERSION`] (`docs/external-helpers.md`).
+//!
+//! Control messages are JSON, one per line. EffectCraft writes requests ([`Request`]) to the
+//! helper's stdin; the helper writes replies ([`Reply`]) to its stdout, each line starting with
+//! [`MAGIC`] so that anything else a helper (or a library it loads) prints is ignored. Pixels
+//! never travel over the pipe: they live in the **frame exchange file** named in
+//! [`Request::Hello`] and are addressed by [`ImageRef`]s (byte offset + size).
+
+use effectcraft_effects::plugin::PluginManifest;
+use serde::{Deserialize, Serialize};
+
+/// The protocol version this build speaks. A helper that answers `hello` with another version
+/// is not used.
+pub const PROTOCOL_VERSION: u32 = 1;
+
+/// Every reply line from a helper starts with this (anything before it on the line, and lines
+/// without it, are the helper's own output and only logged).
+pub const MAGIC: &str = "@ec-helper ";
+
+/// The argument EffectCraft starts helpers with.
+pub const HELPER_ARG: &str = "--effectcraft-helper";
+
+/// The longest control line either side accepts (bytes). Hidden parameters can carry a few MB.
+pub const MAX_LINE: u64 = 256 << 20;
+
+/// The most pixels one image may have (16384 × 16384).
+pub const MAX_PIXELS: u64 = 1 << 28;
+
+/// Bytes per pixel in the exchange file: premultiplied RGBA `f32`, native byte order.
+pub const PIXEL_BYTES: u64 = 16;
+
+/// An image in the frame exchange file: `width * height` premultiplied RGBA `f32` pixels, row 0
+/// on top, starting `offset` bytes into the file. `origin` and `scale` are as in
+/// [`effectcraft_effects::plugin::PluginImage`].
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ImageRef {
+    pub offset: u64,
+    pub width: u32,
+    pub height: u32,
+    #[serde(default)]
+    pub origin: [f64; 2],
+    #[serde(default = "one")]
+    pub scale: f64,
+}
+
+fn one() -> f64 {
+    1.0
+}
+
+impl ImageRef {
+    /// Pixels in the image, `None` when it is larger than [`MAX_PIXELS`].
+    pub fn pixels(&self) -> Option<usize> {
+        let n = u64::from(self.width).checked_mul(u64::from(self.height))?;
+        (n <= MAX_PIXELS).then_some(n).and_then(|n| usize::try_from(n).ok())
+    }
+    /// Bytes the image takes in the exchange file.
+    pub fn bytes(&self) -> Option<u64> {
+        u64::try_from(self.pixels()?).ok()?.checked_mul(PIXEL_BYTES)
+    }
+}
+
+/// One render of one effect instance.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RenderRequest {
+    /// The effect id (as described by the helper).
+    pub effect: String,
+    /// A stable id of the applied effect instance ([`effectcraft_effects::plugin::PluginHost::instance_key`]).
+    pub instance: u64,
+    /// Layer time, seconds.
+    pub time: f64,
+    /// The buffer to process in place (already padded); the result is written back to it.
+    pub frame: ImageRef,
+    /// The layer's size in layer pixels.
+    pub layer_size: [f64; 2],
+    /// Flattened parameter values (plug-in API 2 rules).
+    pub flat: Vec<f64>,
+    /// Text / hidden parameter strings.
+    #[serde(default)]
+    pub texts: Vec<String>,
+    pub frame_rate: f64,
+    /// The layer's source range in layer-time seconds, when it has one.
+    #[serde(default)]
+    pub frame_range: Option<(f64, f64)>,
+}
+
+/// EffectCraft → helper.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "op", rename_all = "snake_case")]
+pub enum Request {
+    /// First message: the protocol version and the frame exchange file to open (read + write).
+    Hello { version: u32, frames: String },
+    /// List the effects the helper offers → [`Reply::Effects`].
+    Describe,
+    /// Load more effects from a file or folder the user picked → [`Reply::Effects`] (only the
+    /// new ones).
+    Load { path: String },
+    /// Transparent pixels to add around the buffer before [`Request::Render`] → [`Reply::Padding`].
+    Padding { effect: String, instance: u64, time: f64, scale: f64, layer_size: [f64; 2], flat: Vec<f64>, texts: Vec<String> },
+    /// Render → callbacks ([`Reply::InputAt`], ...) answered with [`Request::Image`] /
+    /// [`Request::Params`], then [`Reply::Done`] or [`Reply::Error`].
+    Render(RenderRequest),
+    /// The answer to [`Reply::InputAt`] / [`Reply::LayerInput`]: the image, or `None`.
+    Image { image: Option<ImageRef> },
+    /// The answer to [`Reply::ParamsAt`]: flattened values and texts, or `None`.
+    Params { values: Option<(Vec<f64>, Vec<String>)> },
+    /// The effect instance is gone; the helper may free what it keeps for it. No reply.
+    Destroy { instance: u64 },
+    /// Heartbeat → [`Reply::Pong`].
+    Ping,
+    /// Exit. No reply. (Closing stdin means the same.)
+    Shutdown,
+}
+
+/// One effect a helper offers.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RemoteEffect {
+    /// The plug-in API 2 manifest (id, name, category, parameters).
+    pub manifest: PluginManifest,
+    /// Whether to ask [`Request::Padding`] before every render (otherwise no padding).
+    #[serde(default)]
+    pub padding: bool,
+}
+
+/// Helper → EffectCraft.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "op", rename_all = "snake_case")]
+pub enum Reply {
+    /// Answer to [`Request::Hello`]. `loads` lists the file extensions [`Request::Load`] accepts
+    /// (`["ofx"]`), empty when the helper loads nothing on request.
+    Hello {
+        version: u32,
+        name: String,
+        #[serde(default)]
+        helper_version: String,
+        #[serde(default)]
+        loads: Vec<String>,
+    },
+    Effects {
+        effects: Vec<RemoteEffect>,
+        #[serde(default)]
+        errors: Vec<String>,
+    },
+    Padding {
+        pixels: u32,
+    },
+    /// During a render: the effect's input at another layer time.
+    InputAt {
+        time: f64,
+    },
+    /// During a render: the layer chosen in a layer parameter, at a layer time.
+    LayerInput {
+        param: String,
+        time: f64,
+    },
+    /// During a render: the parameter values at another layer time.
+    ParamsAt {
+        time: f64,
+    },
+    /// The render finished; the result is in the request's frame.
+    Done,
+    /// The request failed (the helper keeps running).
+    Error {
+        message: String,
+    },
+    Pong,
+}
+
+/// A reply as one protocol line (with [`MAGIC`] and the newline).
+pub fn reply_line(r: &Reply) -> Result<String, String> {
+    serde_json::to_string(r).map(|s| format!("{MAGIC}{s}\n")).map_err(|e| e.to_string())
+}
+
+/// A request as one protocol line (with the newline).
+pub fn request_line(r: &Request) -> Result<String, String> {
+    serde_json::to_string(r).map(|s| format!("{s}\n")).map_err(|e| e.to_string())
+}
+
+/// Parse a helper output line: `Some` for a protocol line (after [`MAGIC`]), `None` for other
+/// output.
+pub fn parse_reply(line: &str) -> Option<Result<Reply, String>> {
+    let at = line.find(MAGIC)?;
+    let json = line.get(at + MAGIC.len()..)?.trim_end();
+    Some(serde_json::from_str(json).map_err(|e| format!("bad reply from helper: {e}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn replies_round_trip_and_other_output_is_ignored() {
+        let r = Reply::InputAt { time: 1.5 };
+        let line = reply_line(&r).unwrap();
+        assert_eq!(parse_reply(&line).unwrap().unwrap(), r);
+        // A plug-in that printed without a newline doesn't break the protocol line.
+        assert_eq!(parse_reply(&format!("loading...{line}")).unwrap().unwrap(), r);
+        assert!(parse_reply("plug-in chatter").is_none());
+        assert!(parse_reply("@ec-helper {nope").unwrap().is_err());
+    }
+
+    #[test]
+    fn image_sizes_are_checked() {
+        let r = ImageRef { offset: 0, width: 4, height: 2, origin: [0.0; 2], scale: 1.0 };
+        assert_eq!(r.bytes(), Some(128));
+        assert_eq!(ImageRef { width: u32::MAX, height: u32::MAX, ..r }.pixels(), None);
+    }
+}
diff --git a/crates/helper-host/src/serve.rs b/crates/helper-host/src/serve.rs
new file mode 100644
index 000000000..5eb82c236
--- /dev/null
+++ b/crates/helper-host/src/serve.rs
@@ -0,0 +1,240 @@
+//! The helper side of the protocol: [`serve`] answers EffectCraft's requests with any set of
+//! [`EffectPlugin`]s, so a helper program only has to provide its effects ([`Provider`]).
+//! The fake helper in the tests and the OpenFX helper both use it.
+//!
+//! During a render the plug-in's [`PluginHost`] calls become requests to EffectCraft
+//! ([`Reply::InputAt`], ...). While a helper waits for the answer, EffectCraft may send a nested
+//! [`Request::Render`] (an effect of this helper further up the same layer's stack); it is
+//! served right away, on the same stack, before the wait goes on.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::io::{BufRead, Read, Write};
+use std::path::Path;
+use std::sync::Arc;
+
+use effectcraft_effects::plugin::{EffectPlugin, PluginFrame, PluginHost, PluginImage, PluginParams};
+
+use crate::frames::Exchange;
+use crate::protocol::{ImageRef, MAX_LINE, PROTOCOL_VERSION, RemoteEffect, RenderRequest, Reply, Request, reply_line};
+
+/// How deep nested renders may go.
+const MAX_DEPTH: u32 = 16;
+
+/// What a helper program offers.
+pub trait Provider {
+    /// The helper's display name (`OpenFX`).
+    fn name(&self) -> String;
+    /// The helper's own version.
+    fn version(&self) -> String {
+        String::new()
+    }
+    /// File extensions [`Provider::load`] accepts (`["ofx"]`).
+    fn loads(&self) -> Vec<String> {
+        vec![]
+    }
+    /// The effects available at start-up, and errors worth reporting.
+    fn effects(&mut self) -> (Vec<Arc<dyn EffectPlugin>>, Vec<String>);
+    /// Load effects from a file or folder the user picked.
+    fn load(&mut self, _path: &str) -> Result<(Vec<Arc<dyn EffectPlugin>>, Vec<String>), String> {
+        Err("this helper does not load files".into())
+    }
+    /// Whether EffectCraft should ask for padding before each render of `effect`.
+    fn wants_padding(&self, _effect: &dyn EffectPlugin) -> bool {
+        true
+    }
+    /// The effect instance is gone.
+    fn destroy(&mut self, _instance: u64) {}
+}
+
+/// Serve requests on stdin / stdout until EffectCraft says `shutdown` or closes the pipe.
+pub fn serve(provider: &mut dyn Provider) -> Result<(), String> {
+    let stdin = std::io::stdin();
+    let stdout = std::io::stdout();
+    serve_io(provider, stdin.lock(), stdout.lock())
+}
+
+/// [`serve`] on any reader / writer.
+pub fn serve_io(provider: &mut dyn Provider, input: impl BufRead, output: impl Write) -> Result<(), String> {
+    let mut s = Server { provider, input: Box::new(input), output: Box::new(output), exchange: None, effects: HashMap::new(), depth: 0 };
+    loop {
+        let Some(req) = s.next_request()? else { return Ok(()) };
+        if matches!(req, Request::Shutdown) {
+            return Ok(());
+        }
+        s.handle(req)?;
+    }
+}
+
+struct Server<'p> {
+    provider: &'p mut dyn Provider,
+    input: Box<dyn BufRead + 'p>,
+    output: Box<dyn Write + 'p>,
+    exchange: Option<Exchange>,
+    effects: HashMap<String, Arc<dyn EffectPlugin>>,
+    depth: u32,
+}
+
+impl Server<'_> {
+    /// The next request; `None` when the pipe closed.
+    fn next_request(&mut self) -> Result<Option<Request>, String> {
+        loop {
+            let mut buf = vec![];
+            let n = (&mut self.input).take(MAX_LINE).read_until(b'\n', &mut buf).map_err(|e| e.to_string())?;
+            if n == 0 {
+                return Ok(None);
+            }
+            let line = String::from_utf8_lossy(&buf);
+            if line.trim().is_empty() {
+                continue;
+            }
+            match serde_json::from_str::<Request>(line.trim()) {
+                Ok(r) => return Ok(Some(r)),
+                Err(e) => self.send(&Reply::Error { message: format!("bad request: {e}") })?,
+            }
+        }
+    }
+
+    fn send(&mut self, r: &Reply) -> Result<(), String> {
+        let line = reply_line(r)?;
+        self.output.write_all(line.as_bytes()).and_then(|_| self.output.flush()).map_err(|e| e.to_string())
+    }
+
+    fn describe(&mut self, list: Vec<Arc<dyn EffectPlugin>>, errors: Vec<String>) -> Result<(), String> {
+        let mut effects = vec![];
+        for e in list {
+            let manifest = e.manifest().clone();
+            effects.push(RemoteEffect { padding: self.provider.wants_padding(e.as_ref()), manifest: manifest.clone() });
+            self.effects.insert(manifest.id, e);
+        }
+        self.send(&Reply::Effects { effects, errors })
+    }
+
+    /// Answer one request (anything but `shutdown`).
+    fn handle(&mut self, req: Request) -> Result<(), String> {
+        match req {
+            Request::Hello { version, frames } => {
+                if version != PROTOCOL_VERSION {
+                    return self.send(&Reply::Error { message: format!("this helper speaks protocol {PROTOCOL_VERSION}, not {version}") });
+                }
+                match Exchange::open(Path::new(&frames)) {
+                    Ok(x) => self.exchange = Some(x),
+                    Err(e) => return self.send(&Reply::Error { message: format!("can't open the frame exchange file: {e}") }),
+                }
+                let (name, helper_version, loads) = (self.provider.name(), self.provider.version(), self.provider.loads());
+                self.send(&Reply::Hello { version: PROTOCOL_VERSION, name, helper_version, loads })
+            }
+            Request::Describe => {
+                let (list, errors) = self.provider.effects();
+                self.describe(list, errors)
+            }
+            Request::Load { path } => match self.provider.load(&path) {
+                Ok((list, errors)) => self.describe(list, errors),
+                Err(message) => self.send(&Reply::Error { message }),
+            },
+            Request::Padding { effect, instance, time, scale, layer_size, flat, texts } => {
+                let Some(e) = self.effects.get(&effect).cloned() else {
+                    return self.send(&Reply::Error { message: format!("unknown effect `{effect}`") });
+                };
+                let params = PluginParams { manifest: e.manifest(), flat: &flat, texts: &texts };
+                let pixels = e.padding(&params, time, scale, layer_size, instance);
+                self.send(&Reply::Padding { pixels })
+            }
+            Request::Render(r) => match self.render(&r) {
+                Ok(()) => self.send(&Reply::Done),
+                Err(message) => self.send(&Reply::Error { message }),
+            },
+            Request::Destroy { instance } => {
+                self.provider.destroy(instance);
+                Ok(())
+            }
+            Request::Ping => self.send(&Reply::Pong),
+            Request::Image { .. } | Request::Params { .. } => self.send(&Reply::Error { message: "no callback is waiting for an answer".into() }),
+            Request::Shutdown => Ok(()),
+        }
+    }
+
+    fn render(&mut self, r: &RenderRequest) -> Result<(), String> {
+        let e = self.effects.get(&r.effect).cloned().ok_or_else(|| format!("unknown effect `{}`", r.effect))?;
+        if self.depth >= MAX_DEPTH {
+            return Err("renders nested too deeply".into());
+        }
+        let exchange = self.exchange.as_mut().ok_or("no frame exchange file (hello first)")?;
+        let mut pixels = exchange.read(&r.frame)?;
+        let params = PluginParams { manifest: e.manifest(), flat: &r.flat, texts: &r.texts };
+        let mut frame = PluginFrame {
+            width: r.frame.width,
+            height: r.frame.height,
+            pixels: &mut pixels,
+            scale: r.frame.scale,
+            origin: r.frame.origin,
+            layer_size: r.layer_size,
+        };
+        self.depth += 1;
+        let result = {
+            let host = Callbacks { server: RefCell::new(&mut *self), req: r };
+            e.render_v2(&mut frame, &params, r.time, &host)
+        };
+        self.depth = self.depth.saturating_sub(1);
+        result?;
+        let exchange = self.exchange.as_mut().ok_or("no frame exchange file")?;
+        exchange.write(&r.frame, &pixels)
+    }
+
+    /// Ask EffectCraft something during a render and wait for the answer, serving nested
+    /// requests meanwhile.
+    fn ask(&mut self, q: &Reply) -> Result<Request, String> {
+        self.send(q)?;
+        loop {
+            let req = self.next_request()?.ok_or("EffectCraft closed the pipe")?;
+            match req {
+                Request::Image { .. } | Request::Params { .. } => return Ok(req),
+                Request::Shutdown => return Err("EffectCraft asked the helper to shut down".into()),
+                other => self.handle(other)?,
+            }
+        }
+    }
+
+    fn image(&mut self, q: &Reply) -> Option<PluginImage> {
+        let Ok(Request::Image { image: Some(at) }) = self.ask(q) else { return None };
+        self.read_image(&at)
+    }
+
+    fn read_image(&mut self, at: &ImageRef) -> Option<PluginImage> {
+        let pixels = self.exchange.as_mut()?.read(at).ok()?;
+        Some(PluginImage { width: at.width, height: at.height, pixels, origin: at.origin, scale: at.scale })
+    }
+}
+
+/// The [`PluginHost`] a helper's plug-in renders with: questions go back to EffectCraft.
+struct Callbacks<'a, 'p> {
+    server: RefCell<&'a mut Server<'p>>,
+    req: &'a RenderRequest,
+}
+
+impl PluginHost for Callbacks<'_, '_> {
+    fn input_at(&self, layer_time: f64) -> Option<PluginImage> {
+        self.server.try_borrow_mut().ok()?.image(&Reply::InputAt { time: layer_time })
+    }
+    fn layer_input(&self, param_id: &str, layer_time: f64) -> Option<PluginImage> {
+        self.server.try_borrow_mut().ok()?.image(&Reply::LayerInput { param: param_id.to_string(), time: layer_time })
+    }
+    fn params_at(&self, layer_time: f64) -> Option<(Vec<f64>, Vec<String>)> {
+        match self.server.try_borrow_mut().ok()?.ask(&Reply::ParamsAt { time: layer_time }) {
+            Ok(Request::Params { values }) => values,
+            _ => None,
+        }
+    }
+    fn frame_rate(&self) -> f64 {
+        self.req.frame_rate
+    }
+    fn time(&self) -> f64 {
+        self.req.time
+    }
+    fn instance_key(&self) -> u64 {
+        self.req.instance
+    }
+    fn frame_range(&self) -> Option<(f64, f64)> {
+        self.req.frame_range
+    }
+}
diff --git a/crates/helper-host/tests/it/main.rs b/crates/helper-host/tests/it/main.rs
new file mode 100644
index 000000000..b0338ee91
--- /dev/null
+++ b/crates/helper-host/tests/it/main.rs
@@ -0,0 +1,327 @@
+//! The helper protocol end to end against a fake helper, written in safe Rust with
+//! [`effectcraft_helper_host::serve`]. This binary is both sides: started with
+//! `--effectcraft-helper` it is the helper, otherwise it runs the checks, starting itself as
+//! the helper. (`harness = false`: libtest would reject the helper argument.)
+
+use std::io::Write;
+use std::sync::Arc;
+use std::time::Duration;
+
+use effectcraft_effects::plugin::{EffectPlugin, PluginFrame, PluginHost, PluginImage, PluginManifest, PluginParam, PluginParamKind, PluginParams, plugin};
+use effectcraft_helper_host::protocol::{HELPER_ARG, Reply, reply_line};
+use effectcraft_helper_host::serve::{Provider, serve};
+
+fn manifest(id: &str, params: Vec<PluginParam>) -> PluginManifest {
+    PluginManifest {
+        api: 2,
+        id: id.into(),
+        name: id.rsplit('.').next().unwrap_or(id).into(),
+        category: "Helper Test".into(),
+        version: "1".into(),
+        author: String::new(),
+        description: String::new(),
+        params,
+    }
+}
+
+fn amount() -> PluginParam {
+    PluginParam {
+        id: "amount".into(),
+        name: "Amount".into(),
+        group: String::new(),
+        kind: PluginParamKind::Slider { default: 1.0, min: 0.0, max: 1.0, slider_min: None, slider_max: None, decimals: 2, integer: false },
+    }
+}
+
+/// What each fake effect does.
+#[derive(Clone, Copy, PartialEq)]
+enum Kind {
+    /// RGB → amount·(1 − RGB).
+    Invert,
+    /// Asks for 3 pixels of padding; fills the frame with its padding as red.
+    Pad,
+    /// Replaces the frame with the input one frame earlier, and puts `amount` from
+    /// `params_at(0)` in alpha of pixel 0.
+    Echo,
+    /// Exits the process mid-render.
+    Crash,
+    /// Asks for the parameters before 0 (an answer far larger than a pipe holds), then never
+    /// reads it or answers.
+    Hang,
+    /// Writes a long line of bytes that aren't UTF-8 to stderr, then more, then inverts.
+    Noisy,
+}
+
+struct Fake {
+    m: PluginManifest,
+    kind: Kind,
+}
+
+impl EffectPlugin for Fake {
+    fn manifest(&self) -> &PluginManifest {
+        &self.m
+    }
+    fn render(&self, _: &mut PluginFrame, _: &PluginParams, _: f64) -> Result<(), String> {
+        Err("needs render_v2".into())
+    }
+    fn padding(&self, _: &PluginParams, _: f64, _: f64, _: [f64; 2], _: u64) -> u32 {
+        if self.kind == Kind::Pad { 3 } else { 0 }
+    }
+    fn render_v2(&self, frame: &mut PluginFrame, params: &PluginParams, _time: f64, host: &dyn PluginHost) -> Result<(), String> {
+        match self.kind {
+            Kind::Invert => {
+                let a = params.f("amount") as f32;
+                for p in frame.pixels.iter_mut() {
+                    for c in &mut p[..3] {
+                        *c = a * (1.0 - *c);
+                    }
+                }
+            }
+            Kind::Pad => frame.pixels.iter_mut().for_each(|p| *p = [3.0, 0.0, 0.0, 1.0]),
+            Kind::Echo => {
+                let prev = host.input_at(host.time() - 1.0 / host.frame_rate()).ok_or("no input at the previous frame")?;
+                if prev.pixels.len() != frame.pixels.len() {
+                    return Err("previous frame has another size".into());
+                }
+                frame.pixels.copy_from_slice(&prev.pixels);
+                let (flat, _) = host.params_at(0.0).ok_or("no params at 0")?;
+                if let (Some(p), Some(a)) = (frame.pixels.first_mut(), flat.first()) {
+                    p[3] = *a as f32;
+                }
+            }
+            Kind::Crash => std::process::exit(3),
+            Kind::Hang => {
+                let mut out = std::io::stdout();
+                out.write_all(reply_line(&Reply::ParamsAt { time: -1.0 })?.as_bytes()).and_then(|_| out.flush()).map_err(|e| e.to_string())?;
+                std::thread::sleep(Duration::from_secs(3600));
+            }
+            Kind::Noisy => {
+                let mut err = std::io::stderr();
+                let mut junk = vec![0xffu8; 1 << 20];
+                junk.push(b'\n');
+                err.write_all(&junk).map_err(|e| format!("stderr: {e}"))?;
+                // EffectCraft must still be reading.
+                std::thread::sleep(Duration::from_millis(300));
+                err.write_all(b"still talking\n").map_err(|e| format!("stderr: {e}"))?;
+                frame.pixels.iter_mut().for_each(|p| *p = [1.0, 0.0, 0.0, 1.0]);
+            }
+        }
+        Ok(())
+    }
+}
+
+struct FakeProvider;
+
+impl Provider for FakeProvider {
+    fn name(&self) -> String {
+        "Fake".into()
+    }
+    fn effects(&mut self) -> (Vec<Arc<dyn EffectPlugin>>, Vec<String>) {
+        let v: Vec<Arc<dyn EffectPlugin>> =
+            [("invert", Kind::Invert), ("pad", Kind::Pad), ("echo", Kind::Echo), ("crash", Kind::Crash), ("hang", Kind::Hang), ("noisy", Kind::Noisy)]
+                .into_iter()
+                .map(|(n, kind)| Arc::new(Fake { m: manifest(&format!("org.test.helper.{n}"), vec![amount()]), kind }) as Arc<dyn EffectPlugin>)
+                .collect();
+        (v, vec!["fake helper: a warning".into()])
+    }
+}
+
+/// The host side of a render in these checks: the input at any time is a flat grey of that
+/// time; with `nest`, asking for the input renders `invert` through the same helper first.
+struct TestHost {
+    w: u32,
+    h: u32,
+    nest: bool,
+}
+
+impl PluginHost for TestHost {
+    fn input_at(&self, t: f64) -> Option<PluginImage> {
+        let mut pixels = vec![[t as f32, t as f32, t as f32, 1.0]; (self.w * self.h) as usize];
+        if self.nest {
+            let inv = plugin("org.test.helper.invert")?;
+            let m = inv.manifest().clone();
+            let mut f =
+                PluginFrame { width: self.w, height: self.h, pixels: &mut pixels, scale: 1.0, origin: [0.0; 2], layer_size: [self.w as f64, self.h as f64] };
+            inv.render_v2(&mut f, &PluginParams { manifest: &m, flat: &[1.0], texts: &[] }, t, &TestHost { nest: false, ..*self }).ok()?;
+        }
+        Some(PluginImage { width: self.w, height: self.h, pixels, origin: [0.0; 2], scale: 1.0 })
+    }
+    fn layer_input(&self, _: &str, _: f64) -> Option<PluginImage> {
+        None
+    }
+    fn params_at(&self, t: f64) -> Option<(Vec<f64>, Vec<String>)> {
+        // Before 0: megabytes, far more than a pipe holds (see `Kind::Hang`).
+        if t < 0.0 {
+            return Some((vec![0.5; 1 << 20], vec![]));
+        }
+        Some((vec![0.25], vec![]))
+    }
+    fn frame_rate(&self) -> f64 {
+        10.0
+    }
+    fn time(&self) -> f64 {
+        1.0
+    }
+    fn instance_key(&self) -> u64 {
+        7
+    }
+}
+
+fn render(id: &str, pixels: &mut Vec<[f32; 4]>, w: u32, h: u32, amount: f64, nest: bool) -> Result<(), String> {
+    let p = plugin(id).ok_or_else(|| format!("{id} is not registered"))?;
+    let m = p.manifest().clone();
+    let params = PluginParams { manifest: &m, flat: &[amount], texts: &[] };
+    let host = TestHost { w, h, nest };
+    let pad = p.padding(&params, 1.0, 1.0, [w as f64, h as f64], 7);
+    let (w, h) = (w + 2 * pad, h + 2 * pad);
+    pixels.resize((w * h) as usize, [0.0; 4]);
+    let mut f = PluginFrame { width: w, height: h, pixels, scale: 1.0, origin: [pad as f64; 2], layer_size: [w as f64, h as f64] };
+    p.render_v2(&mut f, &params, 1.0, &host)
+}
+
+fn check(name: &str, ok: bool, detail: impl std::fmt::Debug) -> bool {
+    println!("{} {name}{}", if ok { "ok  " } else { "FAIL" }, if ok { String::new() } else { format!(": {detail:?}") });
+    ok
+}
+
+fn run_checks() -> bool {
+    let exe = match std::env::current_exe() {
+        Ok(e) => e,
+        Err(e) => return check("current exe", false, e),
+    };
+    let state = std::env::temp_dir().join(format!("ec-fake-helper-state-{}", std::process::id()));
+    effectcraft_helper_host::blocklist::set_state_dir(state.clone());
+    let mut all = true;
+
+    // Discovery + describe.
+    let r = effectcraft_helper_host::scan_paths(std::slice::from_ref(&exe), false);
+    let loaded = r["loaded"].as_array().map_or(0, Vec::len);
+    all &= check("scan registers the helper's effects", loaded == 6, &r);
+    all &= check("helper warnings are reported", r["errors"].to_string().contains("a warning"), &r);
+    all &= check(
+        "a second scan doesn't start it twice",
+        effectcraft_helper_host::scan_paths(std::slice::from_ref(&exe), false)["helpers"].as_array().is_some_and(Vec::is_empty),
+        "",
+    );
+    let list = effectcraft_helper_host::list();
+    all &= check("list names the helper", list["helpers"][0]["name"] == "Fake" && list["helpers"][0]["running"] == true, &list);
+
+    // Plain render through the exchange file.
+    let mut px = vec![[0.25, 0.5, 1.0, 1.0]; 6];
+    let r = render("org.test.helper.invert", &mut px, 3, 2, 1.0, false);
+    all &= check("invert renders", r.is_ok() && px.iter().all(|p| (p[0] - 0.75).abs() < 1e-6 && p[2].abs() < 1e-6 && p[3] == 1.0), (&r, &px));
+
+    // Output on stderr that isn't text, in long lines, is drained, so the helper never blocks on it
+    // or loses its stderr.
+    let mut px = vec![[0.0; 4]; 4];
+    let r = render("org.test.helper.noisy", &mut px, 2, 2, 1.0, false);
+    all &= check("a helper's stderr is drained whatever it holds", r.is_ok() && px[0] == [1.0, 0.0, 0.0, 1.0], &r);
+
+    // Padding.
+    let mut px = vec![[0.0; 4]; 4];
+    let r = render("org.test.helper.pad", &mut px, 2, 2, 1.0, false);
+    all &= check("padding grows the frame", r.is_ok() && px.len() == 64 && px[0][0] == 3.0, (&r, px.len()));
+
+    // Callbacks: the input at another time and parameters at another time.
+    let mut px = vec![[0.0; 4]; 4];
+    let r = render("org.test.helper.echo", &mut px, 2, 2, 1.0, false);
+    all &= check("input_at / params_at round-trip", r.is_ok() && (px[1][0] - 0.9).abs() < 1e-6 && px[0][3] == 0.25, (&r, &px));
+
+    // Nested: answering input_at renders another effect of the same helper.
+    let mut px = vec![[0.0; 4]; 4];
+    let r = render("org.test.helper.echo", &mut px, 2, 2, 1.0, true);
+    all &= check("nested renders through one helper", r.is_ok() && (px[1][0] - 0.1).abs() < 1e-5, (&r, &px));
+
+    // Several threads at once share the helper.
+    let threads: Vec<_> = (0..4)
+        .map(|i| {
+            std::thread::spawn(move || {
+                let mut px = vec![[0.0, 0.0, 0.0, 1.0]; 16];
+                render("org.test.helper.invert", &mut px, 4, 4, 0.5, false).map(|_| (i, px[0][0]))
+            })
+        })
+        .collect();
+    let results: Vec<_> = threads.into_iter().map(|t| t.join().map_err(|_| "thread panicked".to_string()).and_then(|r| r)).collect();
+    all &= check("concurrent renders", results.iter().all(|r| matches!(r, Ok((_, v)) if (*v - 0.5).abs() < 1e-6)), &results);
+
+    // A crash mid-render is an error, the frame is untouched, and the helper comes back.
+    let mut px = vec![[0.5; 4]; 4];
+    let r = render("org.test.helper.crash", &mut px, 2, 2, 1.0, false);
+    all &= check("a crashing helper is an error", r.as_ref().is_err_and(|e| e.contains("helper")) && px.iter().all(|p| *p == [0.5; 4]), &r);
+    let mut px = vec![[0.0, 0.0, 0.0, 1.0]; 4];
+    let r = render("org.test.helper.invert", &mut px, 2, 2, 1.0, false);
+    all &= check("the helper restarts for the next render", r.is_ok() && px[0][0] == 1.0, &r);
+    // A render that starts the stopped helper itself (no padding request first) succeeds.
+    effectcraft_helper_host::stop_all();
+    let r = plugin("org.test.helper.invert").ok_or("invert is not registered").and_then(|p| {
+        let m = p.manifest().clone();
+        let mut px = vec![[0.0, 0.0, 0.0, 1.0]; 4];
+        let mut f = PluginFrame { width: 2, height: 2, pixels: &mut px, scale: 1.0, origin: [0.0; 2], layer_size: [2.0; 2] };
+        let host = TestHost { w: 2, h: 2, nest: false };
+        p.render_v2(&mut f, &PluginParams { manifest: &m, flat: &[1.0], texts: &[] }, 1.0, &host).map_err(|_| "render failed")?;
+        Ok(px[0][0])
+    });
+    all &= check("a stopped helper restarts for a render without padding", r == Ok(1.0), r);
+
+    // Effects that keep crashing it are turned off (and the list survives in the state dir).
+    for _ in 0..3 {
+        let _ = render("org.test.helper.crash", &mut vec![[0.0; 4]; 4], 2, 2, 1.0, false);
+    }
+    let r = render("org.test.helper.crash", &mut vec![[0.0; 4]; 4], 2, 2, 1.0, false);
+    all &= check("repeat offenders are blocked", r.as_ref().is_err_and(|e| e.contains("turned off")), &r);
+    all &= check("the block list is saved", std::fs::read_to_string(state.join("helper_blocklist.txt")).is_ok_and(|t| t.contains("org.test.helper.crash")), "");
+    let r = effectcraft_helper_host::scan_paths(&[], true);
+    all &= check("retry clears the block list", !effectcraft_helper_host::blocklist::is_blocked("org.test.helper.crash"), &r);
+
+    // A hang is cut off by the timeout, also while EffectCraft is writing to a helper that
+    // stopped reading.
+    let t0 = std::time::Instant::now();
+    let r = render("org.test.helper.hang", &mut vec![[0.0; 4]; 4], 2, 2, 1.0, false);
+    all &= check(
+        "a hanging helper times out",
+        r.as_ref().is_err_and(|e| e.contains("did not answer")) && t0.elapsed() < Duration::from_secs(30),
+        (&r, t0.elapsed()),
+    );
+
+    // The restarts above use up the helper's restarts for this minute, so it can't start again.
+    // That is not the fault of the effect being rendered: it fails, but is not charged and never
+    // turned off (it would be after CRASH_LIMIT charged failures).
+    let starts: Vec<_> = (0..4).map(|_| render("org.test.helper.invert", &mut vec![[0.0; 4]; 4], 2, 2, 1.0, false)).collect();
+    all &= check(
+        "a helper that can't start doesn't block the effect",
+        starts.iter().all(|r| r.as_ref().is_err_and(|e| e.contains("keeps stopping")))
+            && !effectcraft_helper_host::blocklist::is_blocked("org.test.helper.invert"),
+        &starts,
+    );
+
+    effectcraft_helper_host::stop_all();
+    let _ = std::fs::remove_dir_all(&state);
+    all
+}
+
+/// The one test this binary reports to test runners.
+const TEST_NAME: &str = "helper_protocol";
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    if args.iter().any(|a| a == HELPER_ARG) {
+        if let Err(e) = serve(&mut FakeProvider) {
+            eprintln!("fake helper: {e}");
+            std::process::exit(1);
+        }
+        return;
+    }
+    // The libtest listing protocol cargo-nextest uses (`--list --format terse`, with and without
+    // `--ignored`): one `name: test` line, then nextest runs `<binary> helper_protocol --exact`.
+    if args.iter().any(|a| a == "--list") {
+        if !args.iter().any(|a| a == "--ignored") {
+            println!("{TEST_NAME}: test");
+        }
+        return;
+    }
+    // Keep the hang check short.
+    effectcraft_helper_host::client::set_render_timeout(Duration::from_secs(3));
+    if !run_checks() {
+        std::process::exit(1);
+    }
+}
diff --git a/crates/hevcenc/src/deblock.rs b/crates/hevcenc/src/deblock.rs
index 6f5d17b87..6d326e5d4 100644
--- a/crates/hevcenc/src/deblock.rs
+++ b/crates/hevcenc/src/deblock.rs
@@ -78,7 +78,6 @@ pub fn deblock(planes: &mut [Vec<u16>; 3], blk: &[Blk], w: usize, h: usize, qp:
 
 /// Filter one 4-sample luma edge segment. `o` = offset of q0 of the first line, `step` = distance
 /// between samples across the edge, `along` = distance between lines.
-#[allow(clippy::too_many_arguments)]
 fn filter_luma(s: &mut [u16], o: usize, step: usize, along: usize, tc: i32, beta: i32, bd: u32) {
     let px = |s: &[u16], k: usize, i: usize| s[o + k * along - (i + 1) * step] as i32;
     let qx = |s: &[u16], k: usize, i: usize| s[o + k * along + i * step] as i32;
diff --git a/crates/hevcenc/src/frame.rs b/crates/hevcenc/src/frame.rs
index 760bea2b0..ee141e3e7 100644
--- a/crates/hevcenc/src/frame.rs
+++ b/crates/hevcenc/src/frame.rs
@@ -7,7 +7,10 @@ use crate::inter::{self, PlaneRef};
 use crate::intra::{self, Refs};
 use crate::me::MeRef;
 use crate::params::{LOG2_CTB, LOG2_MAX_TB, LOG2_MIN_CB, MAX_MERGE_CAND};
-use crate::tables::*;
+use crate::tables::{
+    ABS_MVD_GT0, ABS_MVD_GT1, CBF_CHROMA, CBF_LUMA, CODED_SUB_BLOCK, CTX_IDX_MAP, CU_SKIP, GT1, GT2, INTRA_CHROMA, LAST_X_PREFIX, LAST_Y_PREFIX, MERGE_FLAG,
+    MERGE_IDX, MVP_FLAG, PART_MODE, PRED_MODE, PREV_INTRA_LUMA, RQT_ROOT_CBF, SCAN_4, SIG_COEFF, SPLIT_CU, qpc_420, scan_order,
+};
 use crate::transform;
 
 pub const F_INTRA: u8 = 1;
@@ -73,6 +76,40 @@ pub enum SliceKind {
     P,
 }
 
+/// Picture geometry and slice coding parameters shared by the CTU encoder.
+pub struct FrameConfig {
+    pub bit_depth: u32,
+    pub width: usize,
+    pub height: usize,
+    pub kind: SliceKind,
+    pub slice_qp: i32,
+}
+
+/// A square node in the coding or transform quadtree.
+#[derive(Clone, Copy)]
+struct TreeNode {
+    x: usize,
+    y: usize,
+    log2: u32,
+    depth: u32,
+}
+
+impl TreeNode {
+    fn children(self) -> impl Iterator<Item = Self> {
+        let h = 1usize << (self.log2 - 1);
+        [(0, 0), (h, 0), (0, h), (h, h)].into_iter().map(move |(dx, dy)| Self { x: self.x + dx, y: self.y + dy, log2: self.log2 - 1, depth: self.depth + 1 })
+    }
+}
+
+/// Transform syntax inherited from the parent node and the enclosing CU.
+#[derive(Clone, Copy)]
+struct TransformState {
+    blk_idx: u32,
+    parent: [bool; 2],
+    intra: bool,
+    nxn: bool,
+}
+
 pub struct FrameCoder<'a> {
     pub bd: u32,
     pub w: usize,
@@ -114,17 +151,8 @@ fn morton(x: u32, y: u32) -> u32 {
 const COARSE_MODES: [u32; 11] = [0, 1, 2, 6, 10, 14, 18, 22, 26, 30, 34];
 
 impl<'a> FrameCoder<'a> {
-    #[allow(clippy::too_many_arguments)]
-    pub fn new(
-        bd: u32,
-        w: usize,
-        h: usize,
-        kind: SliceKind,
-        slice_qp: i32,
-        src: &'a [Vec<u16>; 3],
-        refp: Option<&'a [Vec<u16>; 3]>,
-        me: Option<&'a MeRef>,
-    ) -> Self {
+    pub fn new(config: FrameConfig, src: &'a [Vec<u16>; 3], refp: Option<&'a [Vec<u16>; 3]>, me: Option<&'a MeRef>) -> Self {
+        let FrameConfig { bit_depth: bd, width: w, height: h, kind, slice_qp } = config;
         let off = 6 * (bd as i32 - 8);
         let qpi = slice_qp.clamp(-off, 57);
         let qp_c = qpc_420(qpi) + off;
@@ -256,7 +284,7 @@ impl<'a> FrameCoder<'a> {
             let mut decs = Vec::with_capacity(64);
             self.decide(x, y, LOG2_CTB, 0, &mut est, &mut decs);
             let mut idx = 0;
-            self.write_cq(enc, x, y, LOG2_CTB, 0, &decs, &mut idx);
+            self.write_cq(enc, TreeNode { x, y, log2: LOG2_CTB, depth: 0 }, &decs, &mut idx);
             debug_assert_eq!(idx, decs.len());
             debug_assert_eq!(est.ctx, enc.ctx);
             enc.terminate((i + 1 == total) as u32); // end_of_slice_segment_flag
@@ -276,7 +304,8 @@ impl<'a> FrameCoder<'a> {
     }
 
     /// Final pass: re-code the decided quadtree with the real arithmetic coder.
-    fn write_cq(&mut self, enc: &mut CabacEncoder, x: usize, y: usize, log2: u32, depth: u32, decs: &[CuDec], idx: &mut usize) {
+    fn write_cq(&mut self, enc: &mut CabacEncoder, node: TreeNode, decs: &[CuDec], idx: &mut usize) {
+        let TreeNode { x, y, log2, depth } = node;
         if x >= self.w || y >= self.h {
             return;
         }
@@ -294,9 +323,8 @@ impl<'a> FrameCoder<'a> {
             let (eff, _) = self.encode_cu(enc, x, y, log2, depth, d.mode);
             debug_assert_eq!(eff, d.mode);
         } else {
-            let h = n / 2;
-            for (dx, dy) in [(0, 0), (h, 0), (0, h), (h, h)] {
-                self.write_cq(enc, x + dx, y + dy, log2 - 1, depth + 1, decs, idx);
+            for child in node.children() {
+                self.write_cq(enc, child, decs, idx);
             }
         }
     }
@@ -447,7 +475,7 @@ impl<'a> FrameCoder<'a> {
                 self.write_intra_modes(s, x, y, n, nxn, &modes);
                 s.decision(INTRA_CHROMA, 0); // intra_chroma_pred_mode 4 (DM)
                 let mut ti = 0;
-                self.write_tt(s, x, y, x, y, log2, 0, 0, [true, true], true, nxn, &mut ti);
+                self.write_tt(s, TreeNode { x, y, log2, depth: 0 }, TransformState { blk_idx: 0, parent: [true, true], intra: true, nxn }, &mut ti);
                 (mode, self.cu_dist(x, y, n))
             }
             _ => {
@@ -490,7 +518,12 @@ impl<'a> FrameCoder<'a> {
                         s.decision(MERGE_FLAG, 1);
                         write_merge_idx(s, idx as usize);
                         let mut ti = 0;
-                        self.write_tt(s, x, y, x, y, log2, 0, 0, [true, true], false, false, &mut ti);
+                        self.write_tt(
+                            s,
+                            TreeNode { x, y, log2, depth: 0 },
+                            TransformState { blk_idx: 0, parent: [true, true], intra: false, nxn: false },
+                            &mut ti,
+                        );
                     }
                     CuMode::Amvp { mv, mvp } => {
                         s.decision(CU_SKIP + skip_ctx, 0);
@@ -503,7 +536,12 @@ impl<'a> FrameCoder<'a> {
                         s.decision(RQT_ROOT_CBF, root as u32);
                         if root {
                             let mut ti = 0;
-                            self.write_tt(s, x, y, x, y, log2, 0, 0, [true, true], false, false, &mut ti);
+                            self.write_tt(
+                                s,
+                                TreeNode { x, y, log2, depth: 0 },
+                                TransformState { blk_idx: 0, parent: [true, true], intra: false, nxn: false },
+                                &mut ti,
+                            );
                         }
                     }
                     // Handled by the arm above.
@@ -715,22 +753,9 @@ impl<'a> FrameCoder<'a> {
 
     /// transform_tree() (7.3.8.8) over the coded transform blocks of the CU; no split flag is ever
     /// coded (max_transform_hierarchy_depth_* = 0), splits are inferred.
-    #[allow(clippy::too_many_arguments)]
-    fn write_tt<S: Sink>(
-        &self,
-        s: &mut S,
-        x0: usize,
-        y0: usize,
-        xb: usize,
-        yb: usize,
-        log2: u32,
-        depth: u32,
-        blk_idx: u32,
-        parent: [bool; 2],
-        intra: bool,
-        nxn: bool,
-        ti: &mut usize,
-    ) {
+    fn write_tt<S: Sink>(&self, s: &mut S, node: TreeNode, state: TransformState, ti: &mut usize) {
+        let TreeNode { x: x0, y: y0, log2, depth } = node;
+        let TransformState { blk_idx, parent, intra, nxn } = state;
         let n = 1usize << log2;
         let split = log2 > LOG2_MAX_TB || (nxn && depth == 0);
         let mut cbf_c = [false; 2];
@@ -745,13 +770,11 @@ impl<'a> FrameCoder<'a> {
             cbf_c = parent;
         }
         if split {
-            let h = n / 2;
-            for (i, (dx, dy)) in [(0, 0), (h, 0), (0, h), (h, h)].into_iter().enumerate() {
-                self.write_tt(s, x0 + dx, y0 + dy, x0, y0, log2 - 1, depth + 1, i as u32, cbf_c, intra, nxn, ti);
+            for (i, child) in node.children().enumerate() {
+                self.write_tt(s, child, TransformState { blk_idx: i as u32, parent: cbf_c, ..state }, ti);
             }
             return;
         }
-        let _ = (xb, yb);
         let tb = self.tbs[*ti];
         *ti += 1;
         debug_assert_eq!(tb.c, 0);
@@ -874,9 +897,9 @@ impl<'a> FrameCoder<'a> {
             let (px, py, pn, pw, ph) = if c == 0 { (x, y, n, self.w, self.h) } else { (x / 2, y / 2, n / 2, self.cw, self.ch) };
             let pr = PlaneRef { data: &refp[c], w: pw, h: ph };
             if c == 0 {
-                inter::mc_luma(pr, self.bd, px as i32, py as i32, mv, pn, pn, &mut self.pred);
+                inter::mc_luma(pr, self.bd, px as i32, py as i32, mv, (pn, pn), &mut self.pred);
             } else {
-                inter::mc_chroma(pr, self.bd, px as i32, py as i32, mv, pn, pn, &mut self.pred);
+                inter::mc_chroma(pr, self.bd, px as i32, py as i32, mv, (pn, pn), &mut self.pred);
             }
             inter::put_uni(&self.pred, pn, pn, self.bd, &mut self.rec[c][py * pw + px..], pw);
         }
@@ -1153,8 +1176,119 @@ fn last_prefix(v: u32) -> (u32, u32, u32) {
     }
 }
 
+/// Context increment for significant_coeff_flag (H.265 9.3.4.2).
+fn significance_context(group: (usize, usize), pos: (usize, usize), log2: u32, prev_csbf: u8, c: usize, scan_idx: usize) -> usize {
+    let (xs, ys) = group;
+    let (xp, yp) = pos;
+    let (xc, yc) = (xs * 4 + xp, ys * 4 + yp);
+    if log2 == 2 {
+        CTX_IDX_MAP[(yc << 2) + xc] as usize
+    } else if xc + yc == 0 {
+        0
+    } else {
+        let mut sc = match prev_csbf {
+            0 => {
+                if xp + yp == 0 {
+                    2
+                } else if xp + yp < 3 {
+                    1
+                } else {
+                    0
+                }
+            }
+            1 => {
+                if yp == 0 {
+                    2
+                } else if yp == 1 {
+                    1
+                } else {
+                    0
+                }
+            }
+            2 => {
+                if xp == 0 {
+                    2
+                } else if xp == 1 {
+                    1
+                } else {
+                    0
+                }
+            }
+            _ => 2,
+        };
+        if c == 0 {
+            if xs + ys > 0 {
+                sc += 3;
+            }
+            sc += if log2 == 3 { if scan_idx == 0 { 9 } else { 15 } } else { 21 };
+        } else {
+            sc += if log2 == 3 { 9 } else { 12 };
+        }
+        sc
+    }
+}
+
+/// Absolute levels, signs and Rice remainders for one significant coefficient group.
+fn write_coefficient_levels<S: Sink>(s: &mut S, sig: &[u8], at: impl Fn(usize) -> i32, i: usize, c: usize, prev_g1: &mut Option<u32>) {
+    let nsig = sig.len();
+    let abs_at = |k: usize| at(sig[k] as usize).unsigned_abs();
+    let mut ctx_set = if i == 0 || c > 0 { 0 } else { 2 };
+    if *prev_g1 == Some(0) {
+        ctx_set += 1;
+    }
+    let mut g1ctx = 1u32;
+    let mut gt1 = [0u8; 16];
+    let mut first_g1: Option<usize> = None;
+    let c_off_g1 = if c > 0 { 16 } else { 0 };
+    for k in 0..nsig.min(8) {
+        let f = abs_at(k) > 1;
+        s.decision(GT1 + ctx_set * 4 + g1ctx.min(3) as usize + c_off_g1, f as u32);
+        gt1[k] = f as u8;
+        if f {
+            g1ctx = 0;
+            if first_g1.is_none() {
+                first_g1 = Some(k);
+            }
+        } else if g1ctx > 0 {
+            g1ctx += 1;
+        }
+    }
+    *prev_g1 = Some(g1ctx);
+    let mut gt2 = 0u32;
+    if let Some(k) = first_g1 {
+        gt2 = (abs_at(k) > 2) as u32;
+        s.decision(GT2 + ctx_set + if c > 0 { 4 } else { 0 }, gt2);
+    }
+    // sign data hiding: the sign of the first coefficient in scan order (sig[nsig - 1]) is
+    // inferred from the parity of the sum of absolute levels
+    let hidden = sig[0] as i32 - sig[nsig - 1] as i32 > 3;
+    let nsigns = if hidden { nsig - 1 } else { nsig };
+    for k in 0..nsigns {
+        s.bypass((at(sig[k] as usize) < 0) as u32);
+    }
+    if hidden {
+        let sum: u32 = (0..nsig).map(abs_at).sum();
+        debug_assert_eq!(at(sig[nsig - 1] as usize) < 0, sum & 1 == 1, "sign hiding parity");
+    }
+    let mut rice = 0u32;
+    for k in 0..nsig {
+        let mut base = 1 + gt1[k] as u32;
+        if Some(k) == first_g1 {
+            base += gt2;
+        }
+        let thresh = if k < 8 { if Some(k) == first_g1 { 3 } else { 2 } } else { 1 };
+        if base == thresh {
+            let level = abs_at(k);
+            write_remaining(s, level - base, rice);
+            if level > 3 * (1 << rice) {
+                rice = (rice + 1).min(4);
+            }
+        }
+    }
+}
+
 /// residual_coding() (7.3.8.11) of one transform block of levels (row-major, n x n). No transform
-/// skip, no sign data hiding.
+/// skip; signs use sign data hiding where the coefficient span permits it.
 fn residual_coding<S: Sink>(s: &mut S, lv: &[i32], log2: u32, c: usize, scan_idx: usize) {
     let n = 1usize << log2;
     let log2sb = log2 - 2;
@@ -1233,51 +1367,7 @@ fn residual_coding<S: Sink>(s: &mut S, lv: &[i32], log2: u32, c: usize, scan_idx
             let (xc, yc) = (xs * 4 + xp, ys * 4 + yp);
             let v = lv[yc * n + xc] != 0;
             if np > 0 || !infer_dc {
-                let sig_ctx = if log2 == 2 {
-                    CTX_IDX_MAP[(yc << 2) + xc] as usize
-                } else if xc + yc == 0 {
-                    0
-                } else {
-                    let mut sc = match prev_csbf {
-                        0 => {
-                            if xp + yp == 0 {
-                                2
-                            } else if xp + yp < 3 {
-                                1
-                            } else {
-                                0
-                            }
-                        }
-                        1 => {
-                            if yp == 0 {
-                                2
-                            } else if yp == 1 {
-                                1
-                            } else {
-                                0
-                            }
-                        }
-                        2 => {
-                            if xp == 0 {
-                                2
-                            } else if xp == 1 {
-                                1
-                            } else {
-                                0
-                            }
-                        }
-                        _ => 2,
-                    };
-                    if c == 0 {
-                        if xs + ys > 0 {
-                            sc += 3;
-                        }
-                        sc += if log2 == 3 { if scan_idx == 0 { 9 } else { 15 } } else { 21 };
-                    } else {
-                        sc += if log2 == 3 { 9 } else { 12 };
-                    }
-                    sc
-                };
+                let sig_ctx = significance_context((xs, ys), (xp, yp), log2, prev_csbf, c, scan_idx);
                 s.decision(SIG_COEFF + c_off_sig + sig_ctx, v as u32);
                 if v {
                     sig[nsig] = p as u8;
@@ -1294,60 +1384,7 @@ fn residual_coding<S: Sink>(s: &mut S, lv: &[i32], log2: u32, c: usize, scan_idx
         if nsig == 0 {
             continue;
         }
-        let abs_at = |k: usize| at(xs, ys, sig[k] as usize).unsigned_abs();
-        let mut ctx_set = if i == 0 || c > 0 { 0 } else { 2 };
-        if prev_g1 == Some(0) {
-            ctx_set += 1;
-        }
-        let mut g1ctx = 1u32;
-        let mut gt1 = [0u8; 16];
-        let mut first_g1: Option<usize> = None;
-        let c_off_g1 = if c > 0 { 16 } else { 0 };
-        for k in 0..nsig.min(8) {
-            let f = abs_at(k) > 1;
-            s.decision(GT1 + ctx_set * 4 + g1ctx.min(3) as usize + c_off_g1, f as u32);
-            gt1[k] = f as u8;
-            if f {
-                g1ctx = 0;
-                if first_g1.is_none() {
-                    first_g1 = Some(k);
-                }
-            } else if g1ctx > 0 {
-                g1ctx += 1;
-            }
-        }
-        prev_g1 = Some(g1ctx);
-        let mut gt2 = 0u32;
-        if let Some(k) = first_g1 {
-            gt2 = (abs_at(k) > 2) as u32;
-            s.decision(GT2 + ctx_set + if c > 0 { 4 } else { 0 }, gt2);
-        }
-        // sign data hiding: the sign of the first coefficient in scan order (sig[nsig - 1]) is
-        // inferred from the parity of the sum of absolute levels
-        let hidden = sig[0] as i32 - sig[nsig - 1] as i32 > 3;
-        let nsigns = if hidden { nsig - 1 } else { nsig };
-        for k in 0..nsigns {
-            s.bypass((at(xs, ys, sig[k] as usize) < 0) as u32);
-        }
-        if hidden {
-            let sum: u32 = (0..nsig).map(abs_at).sum();
-            debug_assert_eq!(at(xs, ys, sig[nsig - 1] as usize) < 0, sum & 1 == 1, "sign hiding parity");
-        }
-        let mut rice = 0u32;
-        for k in 0..nsig {
-            let mut base = 1 + gt1[k] as u32;
-            if Some(k) == first_g1 {
-                base += gt2;
-            }
-            let thresh = if k < 8 { if Some(k) == first_g1 { 3 } else { 2 } } else { 1 };
-            if base == thresh {
-                let level = abs_at(k);
-                write_remaining(s, level - base, rice);
-                if level > 3 * (1 << rice) {
-                    rice = (rice + 1).min(4);
-                }
-            }
-        }
+        write_coefficient_levels(s, &sig[..nsig], |p| at(xs, ys, p), i, c, &mut prev_g1);
     }
 }
 
diff --git a/crates/hevcenc/src/inter.rs b/crates/hevcenc/src/inter.rs
index e363871b5..03bf50ffb 100644
--- a/crates/hevcenc/src/inter.rs
+++ b/crates/hevcenc/src/inter.rs
@@ -35,7 +35,8 @@ impl PlaneRef<'_> {
 
 /// Luma prediction samples (14-bit intermediate) of a w x h block at (x, y) displaced by the
 /// quarter-sample vector `mv`, into `out` (stride w).
-pub fn mc_luma(f: PlaneRef, bd: u32, x: i32, y: i32, mv: [i16; 2], w: usize, h: usize, out: &mut [i16]) {
+pub fn mc_luma(f: PlaneRef, bd: u32, x: i32, y: i32, mv: [i16; 2], size: (usize, usize), out: &mut [i16]) {
+    let (w, h) = size;
     let (fx, fy) = ((mv[0] & 3) as usize, (mv[1] & 3) as usize);
     let xi = x + (mv[0] as i32 >> 2);
     let yi = y + (mv[1] as i32 >> 2);
@@ -89,7 +90,8 @@ pub fn mc_luma(f: PlaneRef, bd: u32, x: i32, y: i32, mv: [i16; 2], w: usize, h:
 }
 
 /// Chroma prediction samples of a w x h block at chroma position (x, y) with a 1/8-sample vector.
-pub fn mc_chroma(f: PlaneRef, bd: u32, x: i32, y: i32, mv: [i16; 2], w: usize, h: usize, out: &mut [i16]) {
+pub fn mc_chroma(f: PlaneRef, bd: u32, x: i32, y: i32, mv: [i16; 2], size: (usize, usize), out: &mut [i16]) {
+    let (w, h) = size;
     let (fx, fy) = ((mv[0] & 7) as usize, (mv[1] & 7) as usize);
     let xi = x + (mv[0] as i32 >> 3);
     let yi = y + (mv[1] as i32 >> 3);
diff --git a/crates/hevcenc/src/lib.rs b/crates/hevcenc/src/lib.rs
index b2e86b6a1..1934143a0 100644
--- a/crates/hevcenc/src/lib.rs
+++ b/crates/hevcenc/src/lib.rs
@@ -15,8 +15,6 @@
 //! ```
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-// Index loops over fixed-size blocks read more clearly than iterator chains in codec code.
-#![allow(clippy::needless_range_loop, clippy::too_many_arguments)]
 
 mod bitstream;
 mod cabac;
@@ -85,6 +83,10 @@ pub struct EncoderConfig {
     pub keyint: u32,
     /// BT.709 limited range is signalled in the VUI unless this is set.
     pub full_range: bool,
+    /// The VUI colour description (ITU-T H.273 code points); BT.709 by default.
+    pub colour_primaries: u8,
+    pub transfer_characteristics: u8,
+    pub matrix_coeffs: u8,
 }
 
 impl EncoderConfig {
@@ -99,6 +101,9 @@ impl EncoderConfig {
             rate: RateControl::ConstantQp(28),
             keyint: 60,
             full_range: false,
+            colour_primaries: 1,
+            transfer_characteristics: 1,
+            matrix_coeffs: 1,
         }
     }
 }
@@ -236,6 +241,9 @@ impl Encoder {
             profile_idc: cfg.profile.idc(),
             level_idc,
             full_range: cfg.full_range,
+            colour_primaries: cfg.colour_primaries,
+            transfer_characteristics: cfg.transfer_characteristics,
+            matrix_coeffs: cfg.matrix_coeffs,
             fps_num: cfg.fps_num,
             fps_den: cfg.fps_den,
         };
@@ -311,7 +319,7 @@ impl Encoder {
         let kind = if idr { SliceKind::I } else { SliceKind::P };
         let me = if idr { None } else { self.reference.as_ref().map(|r| me::MeRef::new(&r[0], w, h, bd)) };
         let refp = if idr { None } else { self.reference.as_ref() };
-        let mut fc = FrameCoder::new(bd, w, h, kind, qp, &src, refp, me.as_ref());
+        let mut fc = FrameCoder::new(frame::FrameConfig { bit_depth: bd, width: w, height: h, kind, slice_qp: qp }, &src, refp, me.as_ref());
 
         // slice_segment_header() (7.3.6.1)
         let mut bw = BitWriter::new();
diff --git a/crates/hevcenc/src/params.rs b/crates/hevcenc/src/params.rs
index f1b89f731..89bac938e 100644
--- a/crates/hevcenc/src/params.rs
+++ b/crates/hevcenc/src/params.rs
@@ -25,6 +25,9 @@ pub struct SeqParams {
     pub profile_idc: u8,
     pub level_idc: u8,
     pub full_range: bool,
+    pub colour_primaries: u8,
+    pub transfer_characteristics: u8,
+    pub matrix_coeffs: u8,
     pub fps_num: u32,
     pub fps_den: u32,
 }
@@ -166,9 +169,9 @@ fn vui(w: &mut BitWriter, p: &SeqParams) {
     w.put(5, 3); // video_format: unspecified
     w.flag(p.full_range);
     w.put(1, 1); // colour_description_present_flag
-    w.put(1, 8); // colour_primaries BT.709
-    w.put(1, 8); // transfer_characteristics BT.709
-    w.put(1, 8); // matrix_coeffs BT.709
+    w.put(p.colour_primaries as u32, 8); // colour_primaries
+    w.put(p.transfer_characteristics as u32, 8); // transfer_characteristics
+    w.put(p.matrix_coeffs as u32, 8); // matrix_coeffs
     w.put(0, 1); // chroma_loc_info_present_flag
     w.put(0, 1); // neutral_chroma_indication_flag
     w.put(0, 1); // field_seq_flag
diff --git a/crates/hevcenc/tests/roundtrip.rs b/crates/hevcenc/tests/roundtrip.rs
index 777bc455b..7591517e9 100644
--- a/crates/hevcenc/tests/roundtrip.rs
+++ b/crates/hevcenc/tests/roundtrip.rs
@@ -132,12 +132,36 @@ fn ffmpeg_available() -> bool {
     Command::new("ffmpeg").arg("-version").output().map(|o| o.status.success()).unwrap_or(false)
 }
 
+/// `true` when this ffmpeg/ffprobe build actually ships an HEVC decoder. Distro "free" builds
+/// (e.g. Fedora's ffmpeg-free) ship without one — the tools run but cannot decode our stream, so
+/// the external oracle means nothing and the test skips rather than failing on a gap in the tool.
+fn hevc_decoder_available() -> bool {
+    Command::new("ffmpeg")
+        .args(["-hide_banner", "-decoders"])
+        .output()
+        .map(|o| {
+            String::from_utf8_lossy(&o.stdout).lines().any(|l| {
+                // Decoder rows look like ` V....D hevc ...`; match the codec name, not the text.
+                // Every row of `-decoders` is a decoder, so the flags column says nothing about
+                // that — its trailing `D` is "supports direct rendering method 1", which a
+                // build's hevc decoder may well lack (requiring it would skip a working oracle).
+                let mut it = l.split_whitespace();
+                it.next().is_some() && it.next() == Some("hevc")
+            })
+        })
+        .unwrap_or(false)
+}
+
 /// Decode the Annex-B stream with ffmpeg and require bit-exact equality and an empty stderr.
 fn check_ffmpeg(run: &Run, w: usize, h: usize, bd: u32, tag: &str) {
     if !ffmpeg_available() {
         eprintln!("ffmpeg not found; skipping the ffmpeg oracle");
         return;
     }
+    if !hevc_decoder_available() {
+        eprintln!("ffmpeg has no HEVC decoder here; skipping the ffmpeg oracle");
+        return;
+    }
     let dir = std::env::temp_dir();
     let uniq = format!("{}-{}-{}", tag, std::process::id(), std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos());
     let inp = dir.join(format!("hevcenc-{uniq}.hevc"));
@@ -197,6 +221,10 @@ fn ffprobe_stream_info() {
     if !ffmpeg_available() {
         return;
     }
+    if !hevc_decoder_available() {
+        eprintln!("ffmpeg has no HEVC decoder here; ffprobe cannot fully describe our stream, skipping");
+        return;
+    }
     let (w, h) = (130, 72);
     let pics: Vec<Pic> = (0..2).map(|i| synth(w, h, 10, i, 0)).collect();
     let mut c = cfg(w as u32, h as u32, 30, 30, Profile::Main10);
diff --git a/crates/host/Cargo.toml b/crates/host/Cargo.toml
index 80f61e4c3..70991b22e 100644
--- a/crates/host/Cargo.toml
+++ b/crates/host/Cargo.toml
@@ -18,13 +18,17 @@ effectcraft-expr = { workspace = true }
 effectcraft-script = { workspace = true }
 effectcraft-export = { workspace = true }
 effectcraft-plugin = { workspace = true }
+serde_json = { workspace = true }
 
 # WebAssembly effect plug-ins run in wasmi on native builds.
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 effectcraft-plugin = { workspace = true, features = ["wasm"] }
+# External effect helpers: separate processes, so their native code can't take the app down.
+effectcraft-helper-host = { workspace = true }
 
 [dev-dependencies]
 serde_json = { workspace = true }
+tempfile = { workspace = true }
 effectcraft-psd = { workspace = true }
 effectcraft-svg = { workspace = true }
 effectcraft-pdf = { workspace = true }
diff --git a/crates/host/src/lib.rs b/crates/host/src/lib.rs
index bdb4e2bc3..74fa8348d 100644
--- a/crates/host/src/lib.rs
+++ b/crates/host/src/lib.rs
@@ -33,6 +33,10 @@ impl Exporter for FileExporter {
     fn formats(&self) -> Vec<OutputFormat> {
         effectcraft_export::available_formats()
     }
+    fn supports_skip_existing(&self, settings: &effectcraft_project::render_queue::RenderSettings) -> bool {
+        // The exporter's existence check precedes storage-overflow redirection.
+        self.sink.is_none() && !cfg!(target_arch = "wasm32") && !settings.storage_overflow
+    }
     fn export(&self, job: &ExportJob, progress: &mut dyn FnMut(u64, u64) -> bool) -> Result<ExportResult, String> {
         effectcraft_engine::render::passes::block_on(self.export_async(job, progress))
     }
@@ -82,7 +86,7 @@ impl Exporter for FileExporter {
 
 /// A new session with media, import, expressions, scripting and export enabled.
 pub fn session() -> Session {
-    Session {
+    let mut s = Session {
         // The desktop app, the CLI and the MCP server share installed Roto Brush models.
         models_dir: config_dir().map(|d| d.join("models")),
         exporter: Some(Arc::new(FileExporter::default())),
@@ -90,11 +94,39 @@ pub fn session() -> Session {
         importer: Some(Arc::new(MediaImporter)),
         expr: Some(Arc::new(effectcraft_expr::Expressions)),
         expr_check: Some(effectcraft_expr::check_syntax),
-        script: Some(effectcraft_script::runner),
-        script_ui: effectcraft_engine::scriptui::ScriptUi { dispatch: Some(effectcraft_script::dispatch_ui), ..Default::default() },
         plugin_loader: effectcraft_plugin::wasm_available().then_some(effectcraft_plugin::loader as effectcraft_engine::PluginLoader),
+        helpers: helper_hooks(),
+        plugin_previewer: effectcraft_plugin::wasm_available().then_some(effectcraft_plugin::preview as effectcraft_engine::PluginPreviewer),
+        plugins_dir: config_dir().map(|d| d.join("Plug-ins")),
         ..Default::default()
+    };
+    effectcraft_script::install(&mut s);
+    s
+}
+
+/// External effect helpers run as child processes: native builds only.
+#[cfg(not(target_arch = "wasm32"))]
+fn helper_hooks() -> Option<effectcraft_engine::HelperHooks> {
+    use effectcraft_helper_host as hh;
+    // Effects that keep stopping their helper are remembered in the settings folder.
+    if let Some(dir) = config_dir() {
+        hh::blocklist::set_state_dir(dir);
     }
+    fn scan(retry: bool) -> serde_json::Value {
+        hh::scan_paths(&hh::default_search_paths(config_dir().as_deref()), retry)
+    }
+    Some(effectcraft_engine::HelperHooks { scan, load: hh::load_path, list: hh::list })
+}
+
+#[cfg(target_arch = "wasm32")]
+fn helper_hooks() -> Option<effectcraft_engine::HelperHooks> {
+    None
+}
+
+/// Stop the external effect helpers (when the app quits).
+pub fn stop_helpers() {
+    #[cfg(not(target_arch = "wasm32"))]
+    effectcraft_helper_host::stop_all();
 }
 
 /// The platform config directory for EffectCraft (`EFFECTCRAFT_CONFIG_DIR` overrides):
@@ -106,538 +138,4 @@ pub fn config_dir() -> Option<std::path::PathBuf> {
 }
 
 #[cfg(test)]
-mod tests {
-    use serde_json::json;
-
-    /// Layer ▸ Camera ▸ Link Focus Distance to Point of Interest / to Layer: the expressions
-    /// evaluate to the camera's focus on the target.
-    #[test]
-    fn focus_link_expressions_track_the_target() {
-        use effectcraft_engine::geom::vec3;
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "F", "width": 400, "height": 300, "duration": 2})).unwrap();
-        let t = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 50, "height": 50})).unwrap()["layer"].as_u64().unwrap();
-        s.execute("layer.setSwitch", json!({"layers": [t], "switch": "threeD", "value": true})).unwrap();
-        s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [260, 120, 400]})).unwrap();
-        let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let focus = |s: &effectcraft_engine::Session| {
-            let comp = s.project.comp(cid).unwrap();
-            let mut ctx = effectcraft_engine::render::EvalCtx::new(&s.project, cid, comp, s.time());
-            ctx.expr = s.expr.as_deref();
-            let l = comp.layer(effectcraft_engine::project::LayerId(cam)).unwrap();
-            ctx.value(l, l.props.prop("cameraOptions/focusDistance").unwrap()).as_f64()
-        };
-        let depth = |s: &effectcraft_engine::Session| {
-            let comp = s.project.comp(cid).unwrap();
-            let ctx = effectcraft_engine::render::EvalCtx::new(&s.project, cid, comp, s.time());
-            let c = comp.layer(effectcraft_engine::project::LayerId(cam)).unwrap();
-            let tl = comp.layer(effectcraft_engine::project::LayerId(t)).unwrap();
-            let cs = effectcraft_engine::render::three_d::camera::layer_camera(&ctx, c);
-            cs.depth(ctx.world_matrix(tl).apply(vec3(25.0, 25.0, 0.0)))
-        };
-        s.execute("layer.select", json!({"layers": [cam, t]})).unwrap();
-        let set = s.execute("camera.setFocusToLayer", json!({})).unwrap()["focusDistance"].as_f64().unwrap();
-        assert!((set - depth(&s)).abs() < 1e-6 && (focus(&s) - set).abs() < 1e-6);
-        s.execute("camera.linkFocusToLayer", json!({})).unwrap();
-        // Move the target: the linked focus follows.
-        s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [200, 150, 900]})).unwrap();
-        assert!((focus(&s) - depth(&s)).abs() < 1e-3, "{} vs {}", focus(&s), depth(&s));
-        s.execute("camera.linkFocusToPoi", json!({"camera": cam})).unwrap();
-        let poi = {
-            let l = s.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(cam)).unwrap();
-            let p = l.props.prop("transform/position").unwrap().value.as_vec3();
-            let q = l.props.prop("transform/poi").unwrap().value.as_vec3();
-            ((p[0] - q[0]).powi(2) + (p[1] - q[1]).powi(2) + (p[2] - q[2]).powi(2)).sqrt()
-        };
-        assert!((focus(&s) - poi).abs() < 1e-6, "{} vs {poi}", focus(&s));
-    }
-
-    #[test]
-    fn wired_session_renders_demo_with_expressions() {
-        let mut s = super::session();
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let lid = s.active_comp().unwrap().layers[1].id.0;
-        s.execute("prop.setExpression", json!({"layer": lid, "path": "transform/rotation", "expression": "time * 90"})).unwrap();
-        let img = s.render(cid, s.time(), effectcraft_engine::render::RenderOpts { scale: 0.25, ..Default::default() });
-        assert!(img.data.iter().any(|p| p[3] > 0.5));
-    }
-
-    /// File ▸ Import of glTF/GLB/OBJ models through the media layer, placed as model layers and
-    /// drawn by the Advanced 3D renderer.
-    #[test]
-    fn imported_models_render_in_advanced_3d() {
-        let fx = |n: &str| format!("{}/../model/tests/fixtures/{n}", env!("CARGO_MANIFEST_DIR"));
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "M", "width": 160, "height": 120, "renderer": "advanced3d"})).unwrap();
-        let r = s.execute("file.import", json!({"paths": [fx("cube.obj"), fx("quad.glb"), fx("quad.gltf")]})).unwrap();
-        assert_eq!(r["errors"], json!([]), "{r}");
-        let items: Vec<u64> = r["items"].as_array().unwrap().iter().map(|v| v.as_u64().unwrap()).collect();
-        assert_eq!(items.len(), 3);
-        let cube = s.execute("layer.addItem", json!({"item": items[0]})).unwrap()["layer"].as_u64().unwrap();
-        s.execute("prop.set", json!({"layer": cube, "path": "transform/rotationY", "value": 30})).unwrap();
-        s.execute("prop.set", json!({"layer": cube, "path": "transform/rotationX", "value": 20})).unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let opts = effectcraft_engine::render::RenderOpts::default();
-        let img = s.render(cid, s.time(), opts);
-        let covered = img.data.iter().filter(|p| p[3] > 0.99).count();
-        assert!(covered > 1000, "the cube covers part of the frame: {covered}");
-        // Red faces (material Red) are visible.
-        assert!(img.data.iter().any(|p| p[3] > 0.99 && p[0] > 0.5 && p[1] < 0.2));
-        // The textured binary glTF quad.
-        for _ in 0..3 {
-            s.execute("edit.undo", json!({})).unwrap();
-        }
-        s.execute("layer.addItem", json!({"item": items[1]})).unwrap();
-        let img = s.render(cid, s.time(), opts);
-        assert!(img.data.iter().filter(|p| p[3] > 0.99).count() > 1000);
-        // Classic 3D doesn't draw models.
-        s.execute("comp.renderer", json!({"renderer": "classic3d"})).unwrap();
-        assert!(s.render(cid, s.time(), opts).data.iter().all(|p| p[3] == 0.0));
-    }
-
-    /// A binary glTF of a red cube 2 units wide (positions and indices only).
-    fn glb_cube() -> Vec<u8> {
-        let mut bin: Vec<u8> = (0..8u32).flat_map(|i| [i & 1, (i >> 1) & 1, (i >> 2) & 1].map(|b| b as f32 * 2.0 - 1.0)).flat_map(f32::to_le_bytes).collect();
-        let faces: [[u16; 4]; 6] = [[0, 2, 3, 1], [4, 5, 7, 6], [0, 1, 5, 4], [2, 6, 7, 3], [0, 4, 6, 2], [1, 3, 7, 5]];
-        bin.extend(faces.iter().flat_map(|f| [f[0], f[1], f[2], f[0], f[2], f[3]]).flat_map(u16::to_le_bytes));
-        let gltf = json!({
-            "asset": {"version": "2.0"},
-            "scene": 0,
-            "scenes": [{"nodes": [0]}],
-            "nodes": [{"mesh": 0}],
-            "meshes": [{"primitives": [{"attributes": {"POSITION": 0}, "indices": 1, "material": 0}]}],
-            "materials": [{"pbrMetallicRoughness": {"baseColorFactor": [1, 0, 0, 1], "metallicFactor": 0, "roughnessFactor": 1}}],
-            "buffers": [{"byteLength": bin.len()}],
-            "bufferViews": [{"buffer": 0, "byteOffset": 0, "byteLength": 96}, {"buffer": 0, "byteOffset": 96, "byteLength": 72}],
-            "accessors": [
-                {"bufferView": 0, "componentType": 5126, "count": 8, "type": "VEC3", "min": [-1, -1, -1], "max": [1, 1, 1]},
-                {"bufferView": 1, "componentType": 5123, "count": 36, "type": "SCALAR"}
-            ]
-        });
-        let mut text = gltf.to_string().into_bytes();
-        text.resize(text.len().div_ceil(4) * 4, b' ');
-        let chunk = |kind: &[u8; 4], data: &[u8]| [&(data.len() as u32).to_le_bytes()[..], kind, data].concat();
-        let body = [chunk(b"JSON", &text), chunk(b"BIN\0", &bin)].concat();
-        [&b"glTF"[..], &2u32.to_le_bytes(), &(12 + body.len() as u32).to_le_bytes(), &body].concat()
-    }
-
-    /// #264: a model imported into a new composition (Classic 3D by default) was invisible on
-    /// every renderer, because only Advanced 3D draws models. Adding it now switches the comp,
-    /// and the software renderer (no GPU, as on the reporter's Intel HD Graphics 5500) draws it.
-    #[test]
-    fn imported_glb_shows_in_a_new_composition() {
-        let path = std::env::temp_dir().join(format!("effectcraft-264-cube-{}.glb", std::process::id()));
-        std::fs::write(&path, glb_cube()).unwrap();
-        let mut s = super::session();
-        assert!(s.accel.is_none(), "renders in software");
-        let r = s.execute("file.import", json!({"paths": [path.to_string_lossy()]})).unwrap();
-        assert_eq!(r["errors"], json!([]), "{r}");
-        s.state.project_selection = vec![effectcraft_project::ItemId(r["items"][0].as_u64().unwrap())];
-        s.execute("file.newCompFromSelection", json!({})).unwrap();
-        let comp = s.active_comp().unwrap();
-        assert_eq!(comp.renderer, effectcraft_project::Renderer::Advanced3D);
-        let layer = comp.layers[0].id.0;
-        s.execute("prop.set", json!({"layer": layer, "path": "transform/rotationY", "value": 30})).unwrap();
-        s.execute("prop.set", json!({"layer": layer, "path": "transform/rotationX", "value": 20})).unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let img = s.render(cid, s.time(), effectcraft_engine::render::RenderOpts { scale: 0.25, ..Default::default() });
-        let red = img.data.iter().filter(|p| p[3] > 0.99 && p[0] > 0.2 && p[1] < 0.05 && p[2] < 0.05).count();
-        let _ = std::fs::remove_file(&path);
-        // Half the comp height wide, seen at an angle: well over 5% of the frame.
-        assert!(red * 20 > img.data.len(), "red cube pixels: {red} of {}", img.data.len());
-    }
-
-    /// #651: an animated GIF imported from disk plays: the layer shows each frame at its time,
-    /// in the viewer's renders and in exports alike.
-    #[test]
-    fn an_imported_animated_gif_plays() {
-        let dir = std::env::temp_dir().join(format!("ec-gif-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let path = dir.join("anim.gif");
-        let mut bytes = Vec::new();
-        {
-            let mut enc = gif::Encoder::new(&mut bytes, 4, 4, &[]).unwrap();
-            for rgb in [[255u8, 0, 0], [0, 255, 0], [0, 0, 255]] {
-                let mut f = gif::Frame::from_rgb(4, 4, &rgb.repeat(16));
-                f.delay = 10;
-                enc.write_frame(&f).unwrap();
-            }
-        }
-        std::fs::write(&path, bytes).unwrap();
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "G", "width": 4, "height": 4, "frameRate": 30, "duration": 1})).unwrap();
-        s.execute("file.import", json!({"paths": [path.to_string_lossy()], "addToComp": true})).unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let rgb = |t: f64| {
-            let img = s.render(cid, effectcraft_time::Tick::from_seconds_f64(t), effectcraft_engine::render::RenderOpts::default());
-            let p = img.data[5];
-            [p[0].round(), p[1].round(), p[2].round()]
-        };
-        assert_eq!(rgb(0.05), [1.0, 0.0, 0.0]);
-        assert_eq!(rgb(0.15), [0.0, 1.0, 0.0]);
-        assert_eq!(rgb(0.25), [0.0, 0.0, 1.0]);
-        let _ = std::fs::remove_dir_all(dir);
-    }
-
-    /// The web app's path: outputs go to a sink (downloads), never to the file system.
-    #[test]
-    fn render_queue_exports_to_a_sink() {
-        use std::sync::{Arc, Mutex};
-        let got: Arc<Mutex<Vec<(String, Vec<u8>)>>> = Arc::default();
-        let g = got.clone();
-        let mut s = super::session();
-        s.exporter = Some(Arc::new(super::FileExporter { sink: Some(Arc::new(move |p: &str, d: Vec<u8>| g.lock().unwrap().push((p.to_string(), d)))) }));
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        // Rooted without a drive letter is not absolute on Windows, where the engine joins it to the home drive.
-        let dir = if cfg!(windows) { "C:/no-such-dir-effectcraft-sink-test" } else { "/no-such-dir-effectcraft-sink-test" };
-        s.execute(
-            "renderQueue.add",
-            json!({"format": "gif", "output": format!("{dir}/a.gif"), "resolution": 0.0625, "timeSpan": "custom", "start": 0.0, "end": 0.2}),
-        )
-        .unwrap();
-        s.execute(
-            "renderQueue.add",
-            json!({"format": "png", "output": format!("{dir}/seq_[##].png"), "resolution": 0.0625, "timeSpan": "custom", "start": 0.0, "end": 0.1}),
-        )
-        .unwrap();
-        s.execute("renderQueue.render", json!({"wait": true})).unwrap();
-        s.poll_render();
-        let mut got = got.lock().unwrap().clone();
-        got.sort_by(|a, b| a.0.cmp(&b.0));
-        let names: Vec<std::path::PathBuf> = got.iter().map(|(p, _)| std::path::PathBuf::from(p)).collect();
-        let expected = [format!("{dir}/a.gif"), format!("{dir}/seq_00.png"), format!("{dir}/seq_01.png"), format!("{dir}/seq_02.png")]
-            .map(|p| std::path::absolute(p).unwrap());
-        assert_eq!(names, expected);
-        assert!(got[0].1.starts_with(b"GIF89a"));
-        assert!(got[1].1.starts_with(b"\x89PNG"));
-        assert!(!std::path::Path::new(dir).exists());
-    }
-
-    #[test]
-    fn render_queue_exports_demo_comp() {
-        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-rq");
-        let _ = std::fs::remove_dir_all(&dir);
-        let mut s = super::session();
-        s.execute("file.openDemoProject", json!({})).unwrap();
-        let out = dir.join("[compName]_[width]x[height].[fileExtension]");
-        let r = s
-            .execute(
-                "renderQueue.add",
-                json!({"format": "h264", "output": out.to_string_lossy(), "resolution": 0.125, "timeSpan": "custom", "start": 0.0, "end": 0.4}),
-            )
-            .unwrap();
-        let path = r["outputPath"].as_str().unwrap().to_string();
-        assert!(path.ends_with("_240x134.mp4"), "{path}");
-        // A second item: PNG sequence, rendered in the background.
-        s.execute("renderQueue.add", json!({"format": "png", "output": dir.join("seq_[###].png").to_string_lossy(), "resolution": 0.0625, "timeSpan": "custom", "start": 0.0, "end": 0.2})).unwrap();
-        let r = s.execute("renderQueue.render", json!({"wait": false})).unwrap();
-        assert_eq!(r["items"].as_array().unwrap().len(), 2);
-        let t0 = std::time::Instant::now();
-        while s.is_rendering() {
-            assert!(t0.elapsed().as_secs() < 300, "render timed out");
-            std::thread::sleep(std::time::Duration::from_millis(20));
-            s.poll_render();
-        }
-        s.poll_render();
-        let list = s.execute("renderQueue.list", json!({})).unwrap();
-        for it in list["items"].as_array().unwrap() {
-            assert_eq!(it["statusLabel"], "Done", "{it}");
-            assert!(it["render_time"].as_f64().is_some());
-            assert!(std::path::Path::new(it["last_output"].as_str().unwrap()).exists(), "{it}");
-        }
-        assert!(std::path::Path::new(&path).metadata().unwrap().len() > 500);
-        assert!(dir.join("seq_000.png").exists() && dir.join("seq_005.png").exists() && !dir.join("seq_006.png").exists());
-        // Rendering again needs a re-queue.
-        assert!(s.execute("renderQueue.render", json!({})).is_err());
-        s.execute("renderQueue.setRender", json!({"index": 1, "render": true})).unwrap();
-        assert_eq!(s.project.render_queue[0].status, effectcraft_engine::project::render_queue::RenderStatus::Queued);
-    }
-
-    /// Value of a property of layer `l` at time 0 (keys + expression).
-    fn value(s: &effectcraft_engine::Session, l: u64, path: &str) -> effectcraft_engine::keyframe::Value {
-        let cid = s.active_comp_id().unwrap();
-        let comp = s.project.comp(cid).unwrap();
-        let layer = comp.layer(effectcraft_engine::project::LayerId(l)).unwrap();
-        let ctx =
-            effectcraft_engine::render::EvalCtx { project: &s.project, comp_id: cid, comp, time: Default::default(), expr: s.expr.as_deref(), footage: None };
-        ctx.value(layer, layer.props.prop(path).unwrap())
-    }
-
-    #[test]
-    fn pick_whip_expressions_evaluate() {
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "C", "width": 200, "height": 200, "frameRate": 30, "duration": 2})).unwrap();
-        let a = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
-        let b = s.execute("layer.newSolid", json!({"name": "Src", "color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
-        s.execute("prop.set", json!({"layer": b, "path": "transform/rotation", "value": 33})).unwrap();
-        s.execute("prop.set", json!({"layer": b, "path": "transform/position", "value": [12, 34]})).unwrap();
-        s.execute("effect.apply", json!({"layer": b, "effect": "Gaussian Blur"})).unwrap();
-        s.execute("prop.set", json!({"layer": b, "path": "effects/#1/blurriness", "value": 21})).unwrap();
-        s.execute("layer.addMask", json!({"layer": b})).unwrap();
-        s.execute("prop.set", json!({"layer": b, "path": "masks/#1/feather", "value": [7, 7]})).unwrap();
-        let link = |s: &mut effectcraft_engine::Session, from: &str, to: &str| {
-            s.execute("prop.pickWhip", json!({"layer": a, "path": from, "target": {"layer": b, "path": to}})).unwrap();
-        };
-        link(&mut s, "transform/opacity", "transform/rotation");
-        assert_eq!(value(&s, a, "transform/opacity").as_f64(), 33.0);
-        link(&mut s, "transform/scale", "transform/rotation");
-        let cid = s.active_comp_id().unwrap();
-        let ep = effectcraft_expr::eval_property(&s.project, cid, effectcraft_engine::project::LayerId(a), "transform/scale", 0.0);
-        assert!(ep.is_ok(), "{ep:?}");
-        assert_eq!(value(&s, a, "transform/scale").as_vec2(), [33.0, 33.0]);
-        link(&mut s, "transform/position", "transform/position");
-        assert_eq!(value(&s, a, "transform/position").as_vec2(), [12.0, 34.0]);
-        link(&mut s, "transform/rotation", "effects/#1/blurriness");
-        assert_eq!(value(&s, a, "transform/rotation").as_f64(), 21.0);
-        link(&mut s, "transform/opacity", "masks/#1/feather");
-        assert_eq!(value(&s, a, "transform/opacity").as_f64(), 7.0);
-        // Separated dimensions: X Position reference.
-        s.execute("prop.separateDimensions", json!({"layer": b})).unwrap();
-        link(&mut s, "transform/rotation", "transform/positionX");
-        assert_eq!(value(&s, a, "transform/rotation").as_f64(), 12.0);
-    }
-
-    /// The expression error bar's list: evaluation errors and syntax errors, with the layer and
-    /// property they belong to.
-    #[test]
-    fn expression_errors_are_collected() {
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
-        let a = s.execute("layer.newSolid", json!({"name": "Box", "color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "50"})).unwrap();
-        assert_eq!(s.execute("expr.errors", json!({})).unwrap()["count"], 0);
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "thisComp.layer(\"Nope\").rotation"})).unwrap();
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "1 +* ("})).unwrap();
-        let r = s.execute("expr.errors", json!({})).unwrap();
-        assert_eq!(r["count"], 2, "{r}");
-        let errs = r["errors"].as_array().unwrap();
-        let rot = errs.iter().find(|e| e["path"] == "transform/rotation").unwrap();
-        assert!(rot["message"].as_str().unwrap().contains("Nope"), "{rot}");
-        assert_eq!(rot["layerIndex"], 1);
-        assert_eq!(rot["layerName"], "Box");
-        assert_eq!(rot["disabled"], false);
-        let op = errs.iter().find(|e| e["path"] == "transform/opacity").unwrap();
-        assert_eq!(op["disabled"], true);
-        assert!(r["text"][0].as_str().unwrap().contains("of layer 1 ('Box') in comp 'C'"), "{r}");
-        // A user-disabled (but valid) expression is not an error.
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "45"})).unwrap();
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "enabled": false})).unwrap();
-        assert_eq!(s.execute("expr.errors", json!({})).unwrap()["count"], 1);
-        // The Expression Language menu is categorised.
-        let m = s.execute("expr.languageMenu", json!({})).unwrap();
-        assert!(m.as_array().unwrap().iter().any(|c| c["category"] == "Footage" && c["items"].as_array().unwrap().iter().any(|i| i["text"] == "sourceData")));
-    }
-
-    /// File ▸ Import of JSON/CSV data files as data footage, read by expressions.
-    #[test]
-    fn imported_data_files_drive_expressions() {
-        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-data");
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        std::fs::write(dir.join("levels.csv"), "label,value\nlow,10\nhigh,90\n").unwrap();
-        std::fs::write(dir.join("cfg.json"), r#"{"angle": 33}"#).unwrap();
-        std::fs::write(dir.join("broken.json"), "{nope").unwrap();
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
-        let paths: Vec<String> = ["levels.csv", "cfg.json", "broken.json"].iter().map(|n| dir.join(n).to_string_lossy().to_string()).collect();
-        let r = s.execute("file.import", json!({"paths": paths})).unwrap();
-        assert_eq!(r["items"].as_array().unwrap().len(), 2, "{r}");
-        assert_eq!(r["errors"].as_array().unwrap().len(), 1, "{r}");
-        let csv = r["items"][0].as_u64().unwrap();
-        assert_eq!(s.project.item(effectcraft_engine::project::ItemId(csv)).unwrap().type_name(), "Data");
-        assert!(s.execute("layer.addItem", json!({"item": csv})).is_err(), "data files are not layers");
-        let a = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "footage(\"levels.csv\").sourceData[1].value"})).unwrap();
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "footage(\"cfg.json\").sourceData.angle"})).unwrap();
-        assert_eq!(value(&s, a, "transform/opacity").as_f64(), 90.0);
-        assert_eq!(value(&s, a, "transform/rotation").as_f64(), 33.0);
-    }
-
-    /// sampleImage through the renderer: a box's Fill colour follows the solid under it.
-    #[test]
-    fn sample_image_drives_a_colour() {
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
-        s.execute("layer.newSolid", json!({"name": "Bg", "color": "#00ff00"})).unwrap();
-        let a = s.execute("layer.newSolid", json!({"name": "Fg", "color": "#ffffff", "width": 20, "height": 20})).unwrap()["layer"].as_u64().unwrap();
-        s.execute("effect.apply", json!({"layer": a, "effect": "Fill"})).unwrap();
-        s.execute(
-            "prop.setExpression",
-            json!({"layer": a, "path": "effects/#1/color", "expression": "thisComp.layer(\"Bg\").sampleImage(thisComp.layer(\"Bg\").fromComp(toComp(anchorPoint)))"}),
-        )
-        .unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let img = s.render(cid, s.time(), effectcraft_engine::render::RenderOpts::default());
-        let px = img.get(50, 50);
-        assert!(px[1] > 0.99 && px[0] < 0.01, "the box is filled with the sampled green: {px:?}");
-    }
-
-    /// Proxies through the real media and export layers: Render Settings ▸ Proxy Use decides
-    /// whether an export uses the proxy, and Create Proxy renders and attaches one.
-    #[test]
-    fn proxies_in_exports_and_create_proxy() {
-        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-proxy");
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        let p = |n: &str| dir.join(n).to_string_lossy().to_string();
-        let mut s = super::session();
-        // Source and proxy stills, written by the app itself.
-        s.execute("comp.new", json!({"name": "Red", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
-        let red = s.active_comp_id().unwrap();
-        s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
-        s.execute("comp.saveFrameAs", json!({"path": p("red.png")})).unwrap();
-        s.execute("comp.new", json!({"name": "Blue", "width": 8, "height": 8, "frameRate": 10, "duration": 1})).unwrap();
-        s.execute("layer.newSolid", json!({"color": "#0000ff"})).unwrap();
-        s.execute("comp.saveFrameAs", json!({"path": p("blue.png")})).unwrap();
-        let foot = s.execute("file.import", json!({"paths": [p("red.png")]})).unwrap()["items"][0].as_u64().unwrap();
-        s.execute("file.setProxy", json!({"item": foot, "path": p("blue.png")})).unwrap();
-        s.execute("comp.new", json!({"name": "Out", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
-        let out = s.active_comp_id().unwrap();
-        s.execute("layer.addItem", json!({"item": foot})).unwrap();
-        // Export one frame with each Proxy Use.
-        for (name, using) in [("all", "use_all_[#].png"), ("none", "use_none_[#].png")] {
-            s.execute(
-                "renderQueue.add",
-                json!({"comp": out.0, "format": "png", "output": p(using), "timeSpan": "custom", "start": 0.0, "end": 0.1, "proxyUse": name}),
-            )
-            .unwrap();
-        }
-        s.execute("renderQueue.render", json!({"wait": true})).unwrap();
-        s.poll_render();
-        let centre = |s: &mut effectcraft_engine::Session, path: &str| {
-            let id = s.execute("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap();
-            s.execute("comp.new", json!({"name": "Probe", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
-            s.execute("layer.addItem", json!({"item": id})).unwrap();
-            let c = s.active_comp_id().unwrap();
-            s.render(c, Default::default(), Default::default()).get(8, 8)
-        };
-        let all = centre(&mut s, &p("use_all_0.png"));
-        assert!(all[2] > 0.99 && all[0] < 0.01, "Use All Proxies renders the blue proxy: {all:?}");
-        let none = centre(&mut s, &p("use_none_0.png"));
-        assert!(none[0] > 0.99 && none[2] < 0.01, "Use No Proxies renders the red source: {none:?}");
-        // Create Proxy ▸ Still: rendered at half size and attached to the comp.
-        s.execute("file.createProxy", json!({"kind": "still", "comp": red.0, "path": p("red_proxy_[#####].png")})).unwrap();
-        s.execute("renderQueue.render", json!({"wait": true})).unwrap();
-        s.poll_render();
-        let px = s.project.item(red).unwrap().proxy.clone().expect("Create Proxy attached the rendered still");
-        assert!(px.enabled);
-        assert_eq!((px.footage.width, px.footage.height), (8, 8));
-        assert!(std::path::Path::new(&px.footage.path).exists(), "{}", px.footage.path);
-    }
-
-    /// A script builds a comp, queues it and renders it through the Render Queue.
-    #[test]
-    fn script_renders_through_the_render_queue() {
-        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-script");
-        let _ = std::fs::remove_dir_all(&dir);
-        let out = dir.join("scripted.gif");
-        let mut s = super::session();
-        let code = format!(
-            r#"
-            var comp = app.project.items.addComp("Scripted", 64, 48, 1, 0.2, 10);
-            var sq = comp.layers.addSolid([1, 0.5, 0], "Square", 16, 16, 1);
-            sq.transform.position.setValueAtTime(0, [8, 24]);
-            sq.transform.position.setValueAtTime(0.1, [56, 24]);
-            var item = app.project.renderQueue.items.add(comp);
-            item.outputModule(1).applyTemplate("GIF");
-            item.outputModule(1).file = new File({});
-            app.project.renderQueue.render();
-            [item.status == RQItemStatus.DONE, item.outputModule(1).file.fsName, app.project.renderQueue.numItems]
-            "#,
-            serde_json::to_string(&out.to_string_lossy()).unwrap()
-        );
-        let r = s.execute("script.run", json!({"code": code})).unwrap();
-        assert_eq!(r["ok"], json!(true), "{r}");
-        assert_eq!(r["result"][0], json!(true), "{r}");
-        assert_eq!(r["result"][2], json!(1));
-        let bytes = std::fs::read(&out).unwrap();
-        assert!(bytes.starts_with(b"GIF89a"));
-    }
-
-    /// importFile, layers.add(footage) and project save/open from a script.
-    #[test]
-    fn script_imports_footage_and_saves() {
-        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-script-import");
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        let q = |n: &str| serde_json::to_string(&dir.join(n).to_string_lossy()).unwrap();
-        let mut s = super::session();
-        let code = format!(
-            r#"
-            var c = app.project.items.addComp("Src", 32, 32, 1, 1, 10);
-            c.layers.addSolid([0, 1, 0], "G", 32, 32, 1);
-            app.run("comp.saveFrameAs", {{comp: c.id, path: {png}}});
-            var still = app.project.importFile(new ImportOptions(new File({png})));
-            var main = app.project.items.addComp("Main", 64, 64, 1, 1, 10);
-            var l = main.layers.add(still);
-            app.project.save(new File({proj}));
-            [still instanceof FootageItem, still.width, still.mainSource.isStill, l.source.name, app.project.file.name]
-            "#,
-            png = q("frame.png"),
-            proj = q("p.ecproj")
-        );
-        let r = s.execute("script.run", json!({"code": code})).unwrap();
-        assert_eq!(r["ok"], json!(true), "{r}");
-        assert_eq!(r["result"], json!([true, 32, true, "frame.png", "p.ecproj"]), "{r}");
-        let r = s.execute("script.run", json!({"code": format!("app.open(new File({})); app.project.numItems", q("p.ecproj"))})).unwrap();
-        assert_eq!(r["result"], json!(5), "{r}"); // Src, Solids, G, frame.png, Main
-    }
-
-    #[test]
-    fn expression_syntax_errors_disable_the_expression() {
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
-        let a = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
-        let r = s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "1 +* ("})).unwrap();
-        assert!(r["error"].is_string(), "{r}");
-        let pr = s.active_comp().unwrap().layers[0].props.prop("transform/opacity").unwrap().clone();
-        assert!(!pr.expr.unwrap().enabled);
-        assert_eq!(value(&s, a, "transform/opacity").as_f64(), 100.0);
-        s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "50"})).unwrap();
-        assert_eq!(value(&s, a, "transform/opacity").as_f64(), 50.0);
-    }
-    /// Create Stereo 3D Rig: the eye cameras' expressions follow the master camera and the
-    /// Stereo 3D Controls (and agree with the values the command wrote).
-    #[test]
-    fn stereo_rig_expressions_follow_the_master_camera() {
-        let mut s = super::session();
-        s.execute("comp.new", json!({"name": "Shot", "width": 640, "height": 360, "frameRate": 30, "duration": 2})).unwrap();
-        let src = s.active_comp_id().unwrap();
-        let cam = s.execute("layer.newCamera", json!({"name": "Main", "position": [320, 180, -800], "poi": [320, 180, 0], "zoom": 900})).unwrap()["layer"]
-            .as_u64()
-            .unwrap();
-        let r = s.execute("camera.stereoRig", json!({"sceneDepth": 4})).unwrap();
-        let ctl = r["controls"].as_u64().unwrap();
-        let left = effectcraft_engine::project::ItemId(r["leftComp"].as_u64().unwrap());
-        // The left eye camera's evaluated value (expressions on).
-        let v3 = |s: &effectcraft_engine::Session, path: &str| {
-            let comp = s.project.comp(left).unwrap();
-            let layer = &comp.layers[0];
-            let ctx = effectcraft_engine::render::EvalCtx {
-                project: &s.project,
-                comp_id: left,
-                comp,
-                time: Default::default(),
-                expr: s.expr.as_deref(),
-                footage: None,
-            };
-            ctx.value(layer, layer.props.prop(path).unwrap()).as_vec3()
-        };
-        let close = |a: [f64; 3], b: [f64; 3]| (0..3).all(|i| (a[i] - b[i]).abs() < 1e-6);
-        let d = 0.04 * 640.0;
-        assert!(close(v3(&s, "transform/position"), [320.0 - d / 2.0, 180.0, -800.0]), "{:?}", v3(&s, "transform/position"));
-        assert!(close(v3(&s, "transform/poi"), [320.0 - d / 2.0, 180.0, 0.0]), "{:?}", v3(&s, "transform/poi"));
-        // Moving the master moves the eyes.
-        s.execute("comp.open", json!({"comp": src.0})).unwrap();
-        s.execute("prop.set", json!({"layer": cam, "path": "transform/position", "value": [300, 180, -800]})).unwrap();
-        s.execute("prop.set", json!({"layer": cam, "path": "transform/poi", "value": [300, 180, 0]})).unwrap();
-        assert!(close(v3(&s, "transform/position"), [300.0 - d / 2.0, 180.0, -800.0]), "{:?}", v3(&s, "transform/position"));
-        // Controls: Center & Left puts the left eye a full separation left; convergence toes in.
-        s.execute("prop.set", json!({"layer": ctl, "path": "effects/#1/configuration", "value": 2})).unwrap();
-        s.execute("prop.set", json!({"layer": ctl, "path": "effects/#1/convergence", "value": true})).unwrap();
-        assert!(close(v3(&s, "transform/position"), [300.0 - d, 180.0, -800.0]), "{:?}", v3(&s, "transform/position"));
-        assert!(close(v3(&s, "transform/poi"), [300.0, 180.0, 0.0]), "{:?}", v3(&s, "transform/poi"));
-    }
-}
+mod tests;
diff --git a/crates/host/src/tests.rs b/crates/host/src/tests.rs
new file mode 100644
index 000000000..55240698f
--- /dev/null
+++ b/crates/host/src/tests.rs
@@ -0,0 +1,660 @@
+use serde_json::json;
+
+#[test]
+#[cfg(not(target_arch = "wasm32"))]
+fn storage_overflow_cannot_bypass_duplicate_output_protection() {
+    for same_folder in [true, false] {
+        refuse_overflow_collision(same_folder);
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn refuse_overflow_collision(same_folder: bool) {
+    use std::{path::PathBuf, sync::Arc};
+    struct OverflowOnly(PathBuf);
+    impl effectcraft_project::render_queue::StorageQuota for OverflowOnly {
+        fn has_room(&self, path: &str, _: u64) -> bool {
+            std::path::Path::new(path).starts_with(&self.0)
+        }
+    }
+    let dir = std::env::temp_dir().join(format!("ec-duplicate-overflow-{}-{same_folder}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let overflow = dir.join("overflow");
+    std::fs::create_dir_all(&overflow).unwrap();
+    let mut s = effectcraft_engine::Session {
+        exporter: Some(Arc::new(super::FileExporter::default())),
+        storage_quota: Some(Arc::new(OverflowOnly(overflow.clone()))),
+        ..Default::default()
+    };
+    Arc::make_mut(&mut s.project).render_prefs.overflow_folders = vec![overflow.to_string_lossy().into_owned(); 2];
+    s.execute("comp.new", json!({"width": 16, "height": 16, "frameRate": 10, "duration": 0.2})).unwrap();
+    for index in 0..2 {
+        let folder = if same_folder { dir.clone() } else { dir.join(index.to_string()) };
+        s.execute("renderQueue.add", json!({"format": "png", "output": folder.join("frames_[#####].png"), "skipExisting": true, "storageOverflow": true}))
+            .unwrap();
+    }
+    let result = s.execute("renderQueue.render", json!({}));
+    let written = std::fs::read_dir(&overflow).unwrap().count();
+    assert!(result.is_err(), "overflow destinations cannot skip previous frames: {result:?}");
+    assert_eq!(written, 0, "refused before any overflow file is written");
+    s.execute("renderQueue.remove", json!({"index": 2})).unwrap();
+    let result = s.execute("renderQueue.render", json!({})).unwrap();
+    assert_eq!(result["items"][0]["status"], "Done", "one output's alternatives are not separate outputs: {result}");
+    assert_eq!(std::fs::read_dir(&overflow).unwrap().count(), 2);
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
+#[test]
+fn memory_sink_cannot_overwrite_a_previous_output_even_with_skip_existing() {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    };
+    let writes = Arc::new(AtomicUsize::new(0));
+    let count = writes.clone();
+    let sink: Arc<effectcraft_export::Sink> = Arc::new(move |_, _| {
+        count.fetch_add(1, Ordering::Relaxed);
+    });
+    let mut s = effectcraft_engine::Session { exporter: Some(Arc::new(super::FileExporter { sink: Some(sink) })), ..Default::default() };
+    s.execute("comp.new", json!({"name": "Main", "width": 16, "height": 16, "frameRate": 10, "duration": 0.2})).unwrap();
+    for _ in 0..2 {
+        s.execute("renderQueue.add", json!({"format": "png", "output": "/virtual/frames_[#####].png", "skipExisting": true})).unwrap();
+    }
+    let result = s.execute("renderQueue.render", json!({}));
+    assert!(result.is_err(), "a sink cannot skip previous paths: {result:?}");
+    assert_eq!(writes.load(Ordering::Relaxed), 0, "refused before the sink receives bytes");
+}
+
+#[test]
+fn host_runs_tasks_scheduled_by_panel_handlers() {
+    let mut s = super::session();
+    let result = s.execute("script.run", json!({"code": "var w=new Window('palette','Timer regression'); var b=w.add('button',undefined,'Import'); b.onClick=function(){app.scheduleTask(\"app.project.items.addComp('Scheduled',64,64,1,1,25)\",0,false);};w.show();"})).unwrap();
+    assert_eq!(result["ok"], true, "{result}");
+    s.execute("scriptui.click", json!({"window":"Timer regression","widget":"Import"})).unwrap();
+    assert!(s.project.items.is_empty());
+    let tick = s.execute("script.runTasks", json!({})).unwrap();
+    assert_eq!(tick["ran"], 1, "{tick}");
+    assert_eq!(tick["errors"], json!([]), "{tick}");
+    assert!(s.project.items.values().any(|item| item.name == "Scheduled"));
+    s.execute("scriptui.close", json!({"window":"Timer regression"})).unwrap();
+}
+
+/// Layer ▸ Camera ▸ Link Focus Distance to Point of Interest / to Layer: the expressions
+/// evaluate to the camera's focus on the target.
+#[test]
+fn focus_link_expressions_track_the_target() {
+    use effectcraft_engine::geom::vec3;
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "F", "width": 400, "height": 300, "duration": 2})).unwrap();
+    let t = s.execute("layer.newSolid", json!({"color": "#ffffff", "width": 50, "height": 50})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [t], "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [260, 120, 400]})).unwrap();
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let focus = |s: &effectcraft_engine::Session| {
+        let comp = s.project.comp(cid).unwrap();
+        let mut ctx = effectcraft_engine::render::EvalCtx::new(&s.project, cid, comp, s.time());
+        ctx.expr = s.expr.as_deref();
+        let l = comp.layer(effectcraft_engine::project::LayerId(cam)).unwrap();
+        ctx.value(l, l.props.prop("cameraOptions/focusDistance").unwrap()).as_f64()
+    };
+    let depth = |s: &effectcraft_engine::Session| {
+        let comp = s.project.comp(cid).unwrap();
+        let ctx = effectcraft_engine::render::EvalCtx::new(&s.project, cid, comp, s.time());
+        let c = comp.layer(effectcraft_engine::project::LayerId(cam)).unwrap();
+        let tl = comp.layer(effectcraft_engine::project::LayerId(t)).unwrap();
+        let cs = effectcraft_engine::render::three_d::camera::layer_camera(&ctx, c);
+        cs.depth(ctx.world_matrix(tl).apply(vec3(25.0, 25.0, 0.0)))
+    };
+    s.execute("layer.select", json!({"layers": [cam, t]})).unwrap();
+    let set = s.execute("camera.setFocusToLayer", json!({})).unwrap()["focusDistance"].as_f64().unwrap();
+    assert!((set - depth(&s)).abs() < 1e-6 && (focus(&s) - set).abs() < 1e-6);
+    s.execute("camera.linkFocusToLayer", json!({})).unwrap();
+    // Move the target: the linked focus follows.
+    s.execute("layer.setTransform", json!({"layer": t, "prop": "position", "value": [200, 150, 900]})).unwrap();
+    assert!((focus(&s) - depth(&s)).abs() < 1e-3, "{} vs {}", focus(&s), depth(&s));
+    s.execute("camera.linkFocusToPoi", json!({"camera": cam})).unwrap();
+    let poi = {
+        let l = s.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(cam)).unwrap();
+        let p = l.props.prop("transform/position").unwrap().value.as_vec3();
+        let q = l.props.prop("transform/poi").unwrap().value.as_vec3();
+        ((p[0] - q[0]).powi(2) + (p[1] - q[1]).powi(2) + (p[2] - q[2]).powi(2)).sqrt()
+    };
+    assert!((focus(&s) - poi).abs() < 1e-6, "{} vs {poi}", focus(&s));
+}
+
+#[test]
+fn wired_session_renders_demo_with_expressions() {
+    let mut s = super::session();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let lid = s.active_comp().unwrap().layers[1].id.0;
+    s.execute("prop.setExpression", json!({"layer": lid, "path": "transform/rotation", "expression": "time * 90"})).unwrap();
+    let img = s.render(cid, s.time(), effectcraft_engine::render::RenderOpts { scale: 0.25, ..Default::default() });
+    assert!(img.data.iter().any(|p| p[3] > 0.5));
+}
+
+/// File ▸ Import of glTF/GLB/OBJ models through the media layer, placed as model layers and
+/// drawn by the Advanced 3D renderer.
+#[test]
+fn imported_models_render_in_advanced_3d() {
+    let fx = |n: &str| format!("{}/../model/tests/fixtures/{n}", env!("CARGO_MANIFEST_DIR"));
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "M", "width": 160, "height": 120, "renderer": "advanced3d"})).unwrap();
+    let r = s.execute("file.import", json!({"paths": [fx("cube.obj"), fx("quad.glb"), fx("quad.gltf")]})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let items: Vec<u64> = r["items"].as_array().unwrap().iter().map(|v| v.as_u64().unwrap()).collect();
+    assert_eq!(items.len(), 3);
+    let cube = s.execute("layer.addItem", json!({"item": items[0]})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": cube, "path": "transform/rotationY", "value": 30})).unwrap();
+    s.execute("prop.set", json!({"layer": cube, "path": "transform/rotationX", "value": 20})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let opts = effectcraft_engine::render::RenderOpts::default();
+    let img = s.render(cid, s.time(), opts);
+    let covered = img.data.iter().filter(|p| p[3] > 0.99).count();
+    assert!(covered > 1000, "the cube covers part of the frame: {covered}");
+    // Red faces (material Red) are visible.
+    assert!(img.data.iter().any(|p| p[3] > 0.99 && p[0] > 0.5 && p[1] < 0.2));
+    // The textured binary glTF quad.
+    for _ in 0..3 {
+        s.execute("edit.undo", json!({})).unwrap();
+    }
+    s.execute("layer.addItem", json!({"item": items[1]})).unwrap();
+    let img = s.render(cid, s.time(), opts);
+    assert!(img.data.iter().filter(|p| p[3] > 0.99).count() > 1000);
+    // Classic 3D doesn't draw models.
+    s.execute("comp.renderer", json!({"renderer": "classic3d"})).unwrap();
+    assert!(s.render(cid, s.time(), opts).data.iter().all(|p| p[3] == 0.0));
+}
+
+/// A binary glTF of a red cube 2 units wide (positions and indices only).
+fn glb_cube() -> Vec<u8> {
+    let mut bin: Vec<u8> = (0..8u32).flat_map(|i| [i & 1, (i >> 1) & 1, (i >> 2) & 1].map(|b| b as f32 * 2.0 - 1.0)).flat_map(f32::to_le_bytes).collect();
+    let faces: [[u16; 4]; 6] = [[0, 2, 3, 1], [4, 5, 7, 6], [0, 1, 5, 4], [2, 6, 7, 3], [0, 4, 6, 2], [1, 3, 7, 5]];
+    bin.extend(faces.iter().flat_map(|f| [f[0], f[1], f[2], f[0], f[2], f[3]]).flat_map(u16::to_le_bytes));
+    let gltf = json!({
+        "asset": {"version": "2.0"},
+        "scene": 0,
+        "scenes": [{"nodes": [0]}],
+        "nodes": [{"mesh": 0}],
+        "meshes": [{"primitives": [{"attributes": {"POSITION": 0}, "indices": 1, "material": 0}]}],
+        "materials": [{"pbrMetallicRoughness": {"baseColorFactor": [1, 0, 0, 1], "metallicFactor": 0, "roughnessFactor": 1}}],
+        "buffers": [{"byteLength": bin.len()}],
+        "bufferViews": [{"buffer": 0, "byteOffset": 0, "byteLength": 96}, {"buffer": 0, "byteOffset": 96, "byteLength": 72}],
+        "accessors": [
+            {"bufferView": 0, "componentType": 5126, "count": 8, "type": "VEC3", "min": [-1, -1, -1], "max": [1, 1, 1]},
+            {"bufferView": 1, "componentType": 5123, "count": 36, "type": "SCALAR"}
+        ]
+    });
+    let mut text = gltf.to_string().into_bytes();
+    text.resize(text.len().div_ceil(4) * 4, b' ');
+    let chunk = |kind: &[u8; 4], data: &[u8]| [&(data.len() as u32).to_le_bytes()[..], kind, data].concat();
+    let body = [chunk(b"JSON", &text), chunk(b"BIN\0", &bin)].concat();
+    [&b"glTF"[..], &2u32.to_le_bytes(), &(12 + body.len() as u32).to_le_bytes(), &body].concat()
+}
+
+/// #264: a model imported into a new composition (Classic 3D by default) was invisible on
+/// every renderer, because only Advanced 3D draws models. Adding it now switches the comp,
+/// and the software renderer (no GPU, as on the reporter's Intel HD Graphics 5500) draws it.
+#[test]
+fn imported_glb_shows_in_a_new_composition() {
+    let path = std::env::temp_dir().join(format!("effectcraft-264-cube-{}.glb", std::process::id()));
+    std::fs::write(&path, glb_cube()).unwrap();
+    let mut s = super::session();
+    assert!(s.accel.is_none(), "renders in software");
+    let r = s.execute("file.import", json!({"paths": [path.to_string_lossy()]})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    s.state.project_selection = vec![effectcraft_project::ItemId(r["items"][0].as_u64().unwrap())];
+    s.execute("file.newCompFromSelection", json!({})).unwrap();
+    let comp = s.active_comp().unwrap();
+    assert_eq!(comp.renderer, effectcraft_project::Renderer::Advanced3D);
+    let layer = comp.layers[0].id.0;
+    s.execute("prop.set", json!({"layer": layer, "path": "transform/rotationY", "value": 30})).unwrap();
+    s.execute("prop.set", json!({"layer": layer, "path": "transform/rotationX", "value": 20})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let img = s.render(cid, s.time(), effectcraft_engine::render::RenderOpts { scale: 0.25, ..Default::default() });
+    let red = img.data.iter().filter(|p| p[3] > 0.99 && p[0] > 0.2 && p[1] < 0.05 && p[2] < 0.05).count();
+    let _ = std::fs::remove_file(&path);
+    // Half the comp height wide, seen at an angle: well over 5% of the frame.
+    assert!(red * 20 > img.data.len(), "red cube pixels: {red} of {}", img.data.len());
+}
+
+/// #651: an animated GIF imported from disk plays: the layer shows each frame at its time,
+/// in the viewer's renders and in exports alike.
+#[test]
+fn an_imported_animated_gif_plays() {
+    let dir = std::env::temp_dir().join(format!("ec-gif-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("anim.gif");
+    let mut bytes = Vec::new();
+    {
+        let mut enc = gif::Encoder::new(&mut bytes, 4, 4, &[]).unwrap();
+        for rgb in [[255u8, 0, 0], [0, 255, 0], [0, 0, 255]] {
+            let mut f = gif::Frame::from_rgb(4, 4, &rgb.repeat(16));
+            f.delay = 10;
+            enc.write_frame(&f).unwrap();
+        }
+    }
+    std::fs::write(&path, bytes).unwrap();
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "G", "width": 4, "height": 4, "frameRate": 30, "duration": 1})).unwrap();
+    s.execute("file.import", json!({"paths": [path.to_string_lossy()], "addToComp": true})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let rgb = |t: f64| {
+        let img = s.render(cid, effectcraft_time::Tick::from_seconds_f64(t), effectcraft_engine::render::RenderOpts::default());
+        let p = img.data[5];
+        [p[0].round(), p[1].round(), p[2].round()]
+    };
+    assert_eq!(rgb(0.05), [1.0, 0.0, 0.0]);
+    assert_eq!(rgb(0.15), [0.0, 1.0, 0.0]);
+    assert_eq!(rgb(0.25), [0.0, 0.0, 1.0]);
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// The web app's path: outputs go to a sink (downloads), never to the file system.
+#[test]
+fn render_queue_exports_to_a_sink() {
+    use std::sync::{Arc, Mutex};
+    let got: Arc<Mutex<Vec<(String, Vec<u8>)>>> = Arc::default();
+    let g = got.clone();
+    let mut s = super::session();
+    s.exporter = Some(Arc::new(super::FileExporter { sink: Some(Arc::new(move |p: &str, d: Vec<u8>| g.lock().unwrap().push((p.to_string(), d)))) }));
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    // Rooted without a drive letter is not absolute on Windows, where the engine joins it to the home drive.
+    let dir = if cfg!(windows) { "C:/no-such-dir-effectcraft-sink-test" } else { "/no-such-dir-effectcraft-sink-test" };
+    s.execute(
+        "renderQueue.add",
+        json!({"format": "gif", "output": format!("{dir}/a.gif"), "resolution": 0.0625, "timeSpan": "custom", "start": 0.0, "end": 0.2}),
+    )
+    .unwrap();
+    s.execute(
+        "renderQueue.add",
+        json!({"format": "png", "output": format!("{dir}/seq_[##].png"), "resolution": 0.0625, "timeSpan": "custom", "start": 0.0, "end": 0.1}),
+    )
+    .unwrap();
+    s.execute("renderQueue.render", json!({"wait": true})).unwrap();
+    s.poll_render();
+    let mut got = got.lock().unwrap().clone();
+    got.sort_by(|a, b| a.0.cmp(&b.0));
+    let names: Vec<std::path::PathBuf> = got.iter().map(|(p, _)| std::path::PathBuf::from(p)).collect();
+    let expected = [format!("{dir}/a.gif"), format!("{dir}/seq_00.png"), format!("{dir}/seq_01.png"), format!("{dir}/seq_02.png")]
+        .map(|p| std::path::absolute(p).unwrap());
+    assert_eq!(names, expected);
+    assert!(got[0].1.starts_with(b"GIF89a"));
+    assert!(got[1].1.starts_with(b"\x89PNG"));
+    assert!(!std::path::Path::new(dir).exists());
+}
+
+#[test]
+fn render_queue_exports_demo_comp() {
+    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-rq");
+    let _ = std::fs::remove_dir_all(&dir);
+    let mut s = super::session();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let out = dir.join("[compName]_[width]x[height].[fileExtension]");
+    let r = s
+        .execute(
+            "renderQueue.add",
+            json!({"format": "h264", "output": out.to_string_lossy(), "resolution": 0.125, "timeSpan": "custom", "start": 0.0, "end": 0.4}),
+        )
+        .unwrap();
+    let path = r["outputPath"].as_str().unwrap().to_string();
+    assert!(path.ends_with("_240x134.mp4"), "{path}");
+    // A second item: PNG sequence, rendered in the background.
+    s.execute(
+        "renderQueue.add",
+        json!({"format": "png", "output": dir.join("seq_[###].png").to_string_lossy(), "resolution": 0.0625, "timeSpan": "custom", "start": 0.0, "end": 0.2}),
+    )
+    .unwrap();
+    let r = s.execute("renderQueue.render", json!({"wait": false})).unwrap();
+    assert_eq!(r["items"].as_array().unwrap().len(), 2);
+    let t0 = std::time::Instant::now();
+    while s.is_rendering() {
+        assert!(t0.elapsed().as_secs() < 300, "render timed out");
+        std::thread::sleep(std::time::Duration::from_millis(20));
+        s.poll_render();
+    }
+    s.poll_render();
+    let list = s.execute("renderQueue.list", json!({})).unwrap();
+    for it in list["items"].as_array().unwrap() {
+        assert_eq!(it["statusLabel"], "Done", "{it}");
+        assert!(it["render_time"].as_f64().is_some());
+        assert!(std::path::Path::new(it["last_output"].as_str().unwrap()).exists(), "{it}");
+    }
+    assert!(std::path::Path::new(&path).metadata().unwrap().len() > 500);
+    assert!(dir.join("seq_000.png").exists() && dir.join("seq_005.png").exists() && !dir.join("seq_006.png").exists());
+    // Rendering again needs a re-queue.
+    assert!(s.execute("renderQueue.render", json!({})).is_err());
+    s.execute("renderQueue.setRender", json!({"index": 1, "render": true})).unwrap();
+    assert_eq!(s.project.render_queue[0].status, effectcraft_engine::project::render_queue::RenderStatus::Queued);
+}
+
+/// Value of a property of layer `l` at time 0 (keys + expression).
+fn value(s: &effectcraft_engine::Session, l: u64, path: &str) -> effectcraft_engine::keyframe::Value {
+    let cid = s.active_comp_id().unwrap();
+    let comp = s.project.comp(cid).unwrap();
+    let layer = comp.layer(effectcraft_engine::project::LayerId(l)).unwrap();
+    let ctx = effectcraft_engine::render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: Default::default(),
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    ctx.value(layer, layer.props.prop(path).unwrap())
+}
+
+#[test]
+fn pick_whip_expressions_evaluate() {
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "C", "width": 200, "height": 200, "frameRate": 30, "duration": 2})).unwrap();
+    let a = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.newSolid", json!({"name": "Src", "color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "transform/rotation", "value": 33})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "transform/position", "value": [12, 34]})).unwrap();
+    s.execute("effect.apply", json!({"layer": b, "effect": "Gaussian Blur"})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "effects/#1/blurriness", "value": 21})).unwrap();
+    s.execute("layer.addMask", json!({"layer": b})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "masks/#1/feather", "value": [7, 7]})).unwrap();
+    let link = |s: &mut effectcraft_engine::Session, from: &str, to: &str| {
+        s.execute("prop.pickWhip", json!({"layer": a, "path": from, "target": {"layer": b, "path": to}})).unwrap();
+    };
+    link(&mut s, "transform/opacity", "transform/rotation");
+    assert_eq!(value(&s, a, "transform/opacity").as_f64(), 33.0);
+    link(&mut s, "transform/scale", "transform/rotation");
+    let cid = s.active_comp_id().unwrap();
+    let ep = effectcraft_expr::eval_property(&s.project, cid, effectcraft_engine::project::LayerId(a), "transform/scale", 0.0);
+    assert!(ep.is_ok(), "{ep:?}");
+    assert_eq!(value(&s, a, "transform/scale").as_vec2(), [33.0, 33.0]);
+    link(&mut s, "transform/position", "transform/position");
+    assert_eq!(value(&s, a, "transform/position").as_vec2(), [12.0, 34.0]);
+    link(&mut s, "transform/rotation", "effects/#1/blurriness");
+    assert_eq!(value(&s, a, "transform/rotation").as_f64(), 21.0);
+    link(&mut s, "transform/opacity", "masks/#1/feather");
+    assert_eq!(value(&s, a, "transform/opacity").as_f64(), 7.0);
+    // Separated dimensions: X Position reference.
+    s.execute("prop.separateDimensions", json!({"layer": b})).unwrap();
+    link(&mut s, "transform/rotation", "transform/positionX");
+    assert_eq!(value(&s, a, "transform/rotation").as_f64(), 12.0);
+}
+
+/// The expression error bar's list: evaluation errors and syntax errors, with the layer and
+/// property they belong to.
+#[test]
+fn expression_errors_are_collected() {
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
+    let a = s.execute("layer.newSolid", json!({"name": "Box", "color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "50"})).unwrap();
+    assert_eq!(s.execute("expr.errors", json!({})).unwrap()["count"], 0);
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "thisComp.layer(\"Nope\").rotation"})).unwrap();
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "1 +* ("})).unwrap();
+    let r = s.execute("expr.errors", json!({})).unwrap();
+    assert_eq!(r["count"], 2, "{r}");
+    let errs = r["errors"].as_array().unwrap();
+    let rot = errs.iter().find(|e| e["path"] == "transform/rotation").unwrap();
+    assert!(rot["message"].as_str().unwrap().contains("Nope"), "{rot}");
+    assert_eq!(rot["layerIndex"], 1);
+    assert_eq!(rot["layerName"], "Box");
+    assert_eq!(rot["disabled"], false);
+    let op = errs.iter().find(|e| e["path"] == "transform/opacity").unwrap();
+    assert_eq!(op["disabled"], true);
+    assert!(r["text"][0].as_str().unwrap().contains("of layer 1 ('Box') in comp 'C'"), "{r}");
+    // A user-disabled (but valid) expression is not an error.
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "45"})).unwrap();
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "enabled": false})).unwrap();
+    assert_eq!(s.execute("expr.errors", json!({})).unwrap()["count"], 1);
+    // The Expression Language menu is categorised.
+    let m = s.execute("expr.languageMenu", json!({})).unwrap();
+    assert!(m.as_array().unwrap().iter().any(|c| c["category"] == "Footage" && c["items"].as_array().unwrap().iter().any(|i| i["text"] == "sourceData")));
+}
+
+/// File ▸ Import of JSON/CSV data files as data footage, read by expressions.
+#[test]
+fn imported_data_files_drive_expressions() {
+    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-data");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("levels.csv"), "label,value\nlow,10\nhigh,90\n").unwrap();
+    std::fs::write(dir.join("cfg.json"), r#"{"angle": 33}"#).unwrap();
+    std::fs::write(dir.join("broken.json"), "{nope").unwrap();
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
+    let paths: Vec<String> = ["levels.csv", "cfg.json", "broken.json"].iter().map(|n| dir.join(n).to_string_lossy().to_string()).collect();
+    let r = s.execute("file.import", json!({"paths": paths})).unwrap();
+    assert_eq!(r["items"].as_array().unwrap().len(), 2, "{r}");
+    assert_eq!(r["errors"].as_array().unwrap().len(), 1, "{r}");
+    let csv = r["items"][0].as_u64().unwrap();
+    assert_eq!(s.project.item(effectcraft_engine::project::ItemId(csv)).unwrap().type_name(), "Data");
+    assert!(s.execute("layer.addItem", json!({"item": csv})).is_err(), "data files are not layers");
+    let a = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "footage(\"levels.csv\").sourceData[1].value"})).unwrap();
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/rotation", "expression": "footage(\"cfg.json\").sourceData.angle"})).unwrap();
+    assert_eq!(value(&s, a, "transform/opacity").as_f64(), 90.0);
+    assert_eq!(value(&s, a, "transform/rotation").as_f64(), 33.0);
+}
+
+/// sampleImage through the renderer: a box's Fill colour follows the solid under it.
+#[test]
+fn sample_image_drives_a_colour() {
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bg", "color": "#00ff00"})).unwrap();
+    let a = s.execute("layer.newSolid", json!({"name": "Fg", "color": "#ffffff", "width": 20, "height": 20})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layer": a, "effect": "Fill"})).unwrap();
+    s.execute(
+        "prop.setExpression",
+        json!({"layer": a, "path": "effects/#1/color", "expression": "thisComp.layer(\"Bg\").sampleImage(thisComp.layer(\"Bg\").fromComp(toComp(anchorPoint)))"}),
+    )
+    .unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let img = s.render(cid, s.time(), effectcraft_engine::render::RenderOpts::default());
+    let px = img.get(50, 50);
+    assert!(px[1] > 0.99 && px[0] < 0.01, "the box is filled with the sampled green: {px:?}");
+}
+
+/// Proxies through the real media and export layers: Render Settings ▸ Proxy Use decides
+/// whether an export uses the proxy, and Create Proxy renders and attaches one.
+#[test]
+fn proxies_in_exports_and_create_proxy() {
+    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-proxy");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let p = |n: &str| dir.join(n).to_string_lossy().to_string();
+    let mut s = super::session();
+    // Source and proxy stills, written by the app itself.
+    s.execute("comp.new", json!({"name": "Red", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
+    let red = s.active_comp_id().unwrap();
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    s.execute("comp.saveFrameAs", json!({"path": p("red.png")})).unwrap();
+    s.execute("comp.new", json!({"name": "Blue", "width": 8, "height": 8, "frameRate": 10, "duration": 1})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#0000ff"})).unwrap();
+    s.execute("comp.saveFrameAs", json!({"path": p("blue.png")})).unwrap();
+    let foot = s.execute("file.import", json!({"paths": [p("red.png")]})).unwrap()["items"][0].as_u64().unwrap();
+    s.execute("file.setProxy", json!({"item": foot, "path": p("blue.png")})).unwrap();
+    s.execute("comp.new", json!({"name": "Out", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
+    let out = s.active_comp_id().unwrap();
+    s.execute("layer.addItem", json!({"item": foot})).unwrap();
+    // Export one frame with each Proxy Use.
+    for (name, using) in [("all", "use_all_[#].png"), ("none", "use_none_[#].png")] {
+        s.execute(
+            "renderQueue.add",
+            json!({"comp": out.0, "format": "png", "output": p(using), "timeSpan": "custom", "start": 0.0, "end": 0.1, "proxyUse": name}),
+        )
+        .unwrap();
+    }
+    s.execute("renderQueue.render", json!({"wait": true})).unwrap();
+    s.poll_render();
+    let centre = |s: &mut effectcraft_engine::Session, path: &str| {
+        let id = s.execute("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap();
+        s.execute("comp.new", json!({"name": "Probe", "width": 16, "height": 16, "frameRate": 10, "duration": 1})).unwrap();
+        s.execute("layer.addItem", json!({"item": id})).unwrap();
+        let c = s.active_comp_id().unwrap();
+        s.render(c, Default::default(), Default::default()).get(8, 8)
+    };
+    let all = centre(&mut s, &p("use_all_0.png"));
+    assert!(all[2] > 0.99 && all[0] < 0.01, "Use All Proxies renders the blue proxy: {all:?}");
+    let none = centre(&mut s, &p("use_none_0.png"));
+    assert!(none[0] > 0.99 && none[2] < 0.01, "Use No Proxies renders the red source: {none:?}");
+    // Create Proxy ▸ Still: rendered at half size and attached to the comp.
+    s.execute("file.createProxy", json!({"kind": "still", "comp": red.0, "path": p("red_proxy_[#####].png")})).unwrap();
+    s.execute("renderQueue.render", json!({"wait": true})).unwrap();
+    s.poll_render();
+    let px = s.project.item(red).unwrap().proxy.clone().expect("Create Proxy attached the rendered still");
+    assert!(px.enabled);
+    assert_eq!((px.footage.width, px.footage.height), (8, 8));
+    assert!(std::path::Path::new(&px.footage.path).exists(), "{}", px.footage.path);
+}
+
+/// A script builds a comp, queues it and renders it through the Render Queue.
+#[test]
+fn script_renders_through_the_render_queue() {
+    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-script");
+    let _ = std::fs::remove_dir_all(&dir);
+    let out = dir.join("scripted.gif");
+    let mut s = super::session();
+    let code = format!(
+        r#"
+            var comp = app.project.items.addComp("Scripted", 64, 48, 1, 0.2, 10);
+            var sq = comp.layers.addSolid([1, 0.5, 0], "Square", 16, 16, 1);
+            sq.transform.position.setValueAtTime(0, [8, 24]);
+            sq.transform.position.setValueAtTime(0.1, [56, 24]);
+            var item = app.project.renderQueue.items.add(comp);
+            item.outputModule(1).applyTemplate("GIF");
+            item.outputModule(1).file = new File({});
+            app.project.renderQueue.render();
+            [item.status == RQItemStatus.DONE, item.outputModule(1).file.fsName, app.project.renderQueue.numItems]
+            "#,
+        serde_json::to_string(&out.to_string_lossy()).unwrap()
+    );
+    let r = s.execute("script.run", json!({"code": code})).unwrap();
+    assert_eq!(r["ok"], json!(true), "{r}");
+    assert_eq!(r["result"][0], json!(true), "{r}");
+    assert_eq!(r["result"][2], json!(1));
+    let bytes = std::fs::read(&out).unwrap();
+    assert!(bytes.starts_with(b"GIF89a"));
+}
+
+/// importFile, layers.add(footage) and project save/open from a script.
+#[test]
+fn script_imports_footage_and_saves() {
+    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-out/host-script-import");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let q = |n: &str| serde_json::to_string(&dir.join(n).to_string_lossy()).unwrap();
+    let mut s = super::session();
+    let code = format!(
+        r#"
+            var c = app.project.items.addComp("Src", 32, 32, 1, 1, 10);
+            c.layers.addSolid([0, 1, 0], "G", 32, 32, 1);
+            app.run("comp.saveFrameAs", {{comp: c.id, path: {png}}});
+            var still = app.project.importFile(new ImportOptions(new File({png})));
+            var main = app.project.items.addComp("Main", 64, 64, 1, 1, 10);
+            var l = main.layers.add(still);
+            app.project.save(new File({proj}));
+            [still instanceof FootageItem, still.width, still.mainSource.isStill, l.source.name, app.project.file.name]
+            "#,
+        png = q("frame.png"),
+        proj = q("p.ecproj")
+    );
+    let r = s.execute("script.run", json!({"code": code})).unwrap();
+    assert_eq!(r["ok"], json!(true), "{r}");
+    assert_eq!(r["result"], json!([true, 32, true, "frame.png", "p.ecproj"]), "{r}");
+    let r = s.execute("script.run", json!({"code": format!("app.open(new File({})); app.project.numItems", q("p.ecproj"))})).unwrap();
+    assert_eq!(r["result"], json!(5), "{r}"); // Src, Solids, G, frame.png, Main
+}
+
+#[test]
+fn expression_syntax_errors_disable_the_expression() {
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "C", "width": 100, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
+    let a = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    let r = s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "1 +* ("})).unwrap();
+    assert!(r["error"].is_string(), "{r}");
+    let pr = s.active_comp().unwrap().layers[0].props.prop("transform/opacity").unwrap().clone();
+    assert!(!pr.expr.unwrap().enabled);
+    assert_eq!(value(&s, a, "transform/opacity").as_f64(), 100.0);
+    s.execute("prop.setExpression", json!({"layer": a, "path": "transform/opacity", "expression": "50"})).unwrap();
+    assert_eq!(value(&s, a, "transform/opacity").as_f64(), 50.0);
+}
+/// Create Stereo 3D Rig: the eye cameras' expressions follow the master camera and the
+/// Stereo 3D Controls (and agree with the values the command wrote).
+#[test]
+fn stereo_rig_expressions_follow_the_master_camera() {
+    let mut s = super::session();
+    s.execute("comp.new", json!({"name": "Shot", "width": 640, "height": 360, "frameRate": 30, "duration": 2})).unwrap();
+    let src = s.active_comp_id().unwrap();
+    let cam = s.execute("layer.newCamera", json!({"name": "Main", "position": [320, 180, -800], "poi": [320, 180, 0], "zoom": 900})).unwrap()["layer"]
+        .as_u64()
+        .unwrap();
+    let r = s.execute("camera.stereoRig", json!({"sceneDepth": 4})).unwrap();
+    let ctl = r["controls"].as_u64().unwrap();
+    let left = effectcraft_engine::project::ItemId(r["leftComp"].as_u64().unwrap());
+    // The left eye camera's evaluated value (expressions on).
+    let v3 = |s: &effectcraft_engine::Session, path: &str| {
+        let comp = s.project.comp(left).unwrap();
+        let layer = &comp.layers[0];
+        let ctx = effectcraft_engine::render::EvalCtx {
+            project: &s.project,
+            comp_id: left,
+            comp,
+            time: Default::default(),
+            expr: s.expr.as_deref(),
+            footage: None,
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: None,
+        };
+        ctx.value(layer, layer.props.prop(path).unwrap()).as_vec3()
+    };
+    let close = |a: [f64; 3], b: [f64; 3]| (0..3).all(|i| (a[i] - b[i]).abs() < 1e-6);
+    let d = 0.04 * 640.0;
+    assert!(close(v3(&s, "transform/position"), [320.0 - d / 2.0, 180.0, -800.0]), "{:?}", v3(&s, "transform/position"));
+    assert!(close(v3(&s, "transform/poi"), [320.0 - d / 2.0, 180.0, 0.0]), "{:?}", v3(&s, "transform/poi"));
+    // Moving the master moves the eyes.
+    s.execute("comp.open", json!({"comp": src.0})).unwrap();
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/position", "value": [300, 180, -800]})).unwrap();
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/poi", "value": [300, 180, 0]})).unwrap();
+    assert!(close(v3(&s, "transform/position"), [300.0 - d / 2.0, 180.0, -800.0]), "{:?}", v3(&s, "transform/position"));
+    // Controls: Center & Left puts the left eye a full separation left; convergence toes in.
+    s.execute("prop.set", json!({"layer": ctl, "path": "effects/#1/configuration", "value": 2})).unwrap();
+    s.execute("prop.set", json!({"layer": ctl, "path": "effects/#1/convergence", "value": true})).unwrap();
+    assert!(close(v3(&s, "transform/position"), [300.0 - d, 180.0, -800.0]), "{:?}", v3(&s, "transform/position"));
+    assert!(close(v3(&s, "transform/poi"), [300.0, 180.0, 0.0]), "{:?}", v3(&s, "transform/poi"));
+}
+
+/// A text layer showing a 3D model's name (`thisComp.layer("Model").source.name`): renaming the
+/// model gives the comp a new disk key and the text shows the new name (expressions on).
+#[test]
+fn renaming_a_model_a_text_expression_reads_changes_the_key_and_the_text() {
+    use effectcraft_engine::Session;
+    let mut s = super::session();
+    let cid = effectcraft_project::ItemId(
+        s.execute("comp.new", json!({"name": "M", "width": 160, "height": 60, "frameRate": 30, "duration": 1})).unwrap()["comp"].as_u64().unwrap(),
+    );
+    let model = s
+        .edit("add model", None, |p, _| {
+            let f = effectcraft_project::Footage { kind: effectcraft_project::FootageKind::Model, ..Default::default() };
+            let model = p.add_item("chair.glb", Default::default(), None, effectcraft_project::ItemKind::Footage(f));
+            let comp = p.comp(cid).cloned().unwrap();
+            let mut l = effectcraft_project::build::layer(p, &comp, "Model", effectcraft_project::LayerSource::Model { item: model }, (16, 16), None);
+            // (not drawn: no model file; an expression still reads its source)
+            l.switches.video = false;
+            p.comp_mut(cid).unwrap().layers.push(l);
+            Ok(model)
+        })
+        .unwrap();
+    let text = s.execute("layer.newText", json!({"comp": cid.0, "text": "x"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.setExpression", json!({"comp": cid.0, "layer": text, "path": "text/sourceText", "expression": "thisComp.layer(\"Model\").source.name"}))
+        .unwrap();
+    let key = effectcraft_engine::render::disk_cache::comp_content_key(&s.project, cid);
+    let shown = |s: &mut Session| s.execute("prop.get", json!({"comp": cid.0, "layer": text, "path": "text/sourceText"})).unwrap()["evaluated"].to_string();
+    assert!(shown(&mut s).contains("chair.glb"), "{}", shown(&mut s));
+    s.execute("project.rename", json!({"item": model.0, "name": "table.glb"})).unwrap();
+    assert_ne!(effectcraft_engine::render::disk_cache::comp_content_key(&s.project, cid), key, "the comp's frames on disk hold the old name");
+    assert!(shown(&mut s).contains("table.glb"), "the text shows the new name: {}", shown(&mut s));
+}
diff --git a/crates/host/tests/background_presets.rs b/crates/host/tests/it/background_presets.rs
similarity index 64%
rename from crates/host/tests/background_presets.rs
rename to crates/host/tests/it/background_presets.rs
index e3e44b009..c03ec0066 100644
--- a/crates/host/tests/background_presets.rs
+++ b/crates/host/tests/it/background_presets.rs
@@ -58,3 +58,34 @@ fn every_background_preset_renders_moves_and_undoes() {
         assert_eq!(fx, 0, "{id}: undo removes the effects");
     }
 }
+
+/// #1510: each Behaviors preset keeps its layer moving (position, scale, rotation or opacity
+/// changes over time) and renders finite, deterministic frames.
+#[test]
+fn every_behavior_preset_renders_and_moves() {
+    let mut s = effectcraft_host::session();
+    s.execute("comp.new", json!({"name": "BH", "width": 160, "height": 90, "frameRate": 30, "duration": 8})).unwrap();
+    // A small white square in the middle so position, scale and rotation changes are visible.
+    let solid = s.execute("layer.newSolid", json!({"name": "S", "color": "#ffffff", "width": 60, "height": 60})).unwrap()["layer"].as_u64().unwrap();
+    let list = s.execute("anim.builtinPresets", json!({"category": "Behaviors"})).unwrap();
+    let list = list.as_array().unwrap().clone();
+    assert!(list.len() >= 20, "{}", list.len());
+    for p in &list {
+        let id = p["id"].as_str().unwrap();
+        s.execute("time.set", json!({"time": 0.0})).unwrap();
+        let r = s.execute("anim.applyBuiltinPreset", json!({"layers": [solid], "preset": id})).unwrap();
+        assert_eq!(r["skipped"], json!([]), "{id}");
+        let mut frames = Vec::new();
+        // Times chosen off the periods of every preset so no two samples coincide.
+        for t in [0.03, 0.13, 0.41, 0.97, 1.73] {
+            let (px, _, _, nan) = frame(&s, t);
+            assert!(!nan, "{id} @ {t}: NaN or infinite pixel");
+            let (again, ..) = frame(&s, t);
+            assert!(px == again, "{id} @ {t}: render is not deterministic");
+            frames.push(px);
+        }
+        let moved = (1..frames.len()).any(|i| diff(&frames[0], &frames[i]) > 20.0);
+        assert!(moved, "{id}: the layer does not move ({:?})", (1..frames.len()).map(|i| diff(&frames[0], &frames[i])).collect::<Vec<_>>());
+        s.execute("edit.undo", json!({})).unwrap();
+    }
+}
diff --git a/crates/host/tests/it/cryptomatte_pick.rs b/crates/host/tests/it/cryptomatte_pick.rs
new file mode 100644
index 000000000..57b6e624b
--- /dev/null
+++ b/crates/host/tests/it/cryptomatte_pick.rs
@@ -0,0 +1,128 @@
+//! The Cryptomatte eyedropper on real OpenEXR footage (#473): `effect.pickCryptomatte` reads the
+//! file's Cryptomatte ranks and manifest, edits the Selection, and the rendered matte follows,
+//! including undo.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::time::Tick;
+use effectcraft_raster::channels3d::{crypto_float, crypto_hash};
+use serde_json::json;
+
+const RIGHT: &str = "Right, \"Box\"";
+
+/// An 8 × 4 EXR: white RGBA, and a CryptoObject layer with `Left` in columns before `split` and
+/// the comma-and-quotes name from there, both named in its manifest.
+fn crypto_exr(tag: &str, split: usize) -> String {
+    use exr::prelude::*;
+    let (w, h) = (8usize, 4usize);
+    let ids: Vec<f32> = (0..w * h).map(|i| crypto_float(crypto_hash(if i % w < split { "Left" } else { RIGHT }))).collect();
+    let ch = |n: &str, v: Vec<f32>| AnyChannel::new(n, FlatSamples::F32(v));
+    let one = || vec![1.0f32; w * h];
+    let channels = AnyChannels::sort(
+        vec![ch("R", one()), ch("G", one()), ch("B", one()), ch("A", one()), ch("CryptoObject00.R", ids), ch("CryptoObject00.G", one())].into(),
+    );
+    let mut layer = Layer::new((w, h), LayerAttributes::default(), Encoding::FAST_LOSSLESS, channels);
+    let manifest = json!({"Left": format!("{:08x}", crypto_hash("Left")), RIGHT: format!("{:08x}", crypto_hash(RIGHT))}).to_string();
+    for (k, v) in [("name", "CryptoObject".to_string()), ("manifest", manifest)] {
+        layer.attributes.other.insert(Text::from(format!("cryptomatte/f834d0a/{k}").as_str()), AttributeValue::Text(Text::from(v.as_str())));
+    }
+    // A folder of its own: numbered siblings would import as an image sequence.
+    let dir = std::env::temp_dir().join(format!("ec-crypto-pick-{tag}-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("crypto.exr");
+    Image::from_layer(layer).write().to_file(&path).unwrap();
+    path.to_string_lossy().to_string()
+}
+
+/// A session with the EXR as a layer of a 2 s comp, under a Cryptomatte effect.
+fn footage(tag: &str, split: usize) -> (Session, String) {
+    let path = crypto_exr(tag, split);
+    let mut s = effectcraft_host::session();
+    let r = s.execute("file.import", json!({"paths": [path]})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    s.execute("comp.new", json!({"name": "Crypto", "width": 8, "height": 4, "frameRate": 24, "duration": 2})).unwrap();
+    s.execute("layer.addItem", json!({"item": r["items"][0]})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    (s, path)
+}
+
+/// The matte's alpha over the left and right halves.
+fn matte(s: &Session) -> [f32; 2] {
+    let img = s.render(s.active_comp_id().unwrap(), Tick::ZERO, Default::default());
+    [img.get(1, 1)[3], img.get(6, 2)[3]]
+}
+
+#[test]
+fn picking_on_a_cryptomatte_exr_edits_the_selection_and_the_matte() {
+    let (mut s, path) = footage("edit", 4);
+    s.execute_checked("prop.set", json!({"path": "effects/#1/display", "value": 1})).unwrap();
+    assert_eq!(matte(&s), [0.0, 0.0], "nothing selected");
+    let pick = |s: &mut Session, x: f64, mode: &str| s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": x, "y": 1, "mode": mode})).unwrap();
+
+    assert_eq!(pick(&mut s, 1.0, "replace")["selection"], "Left");
+    assert_eq!(matte(&s), [1.0, 0.0]);
+    let r = pick(&mut s, 6.0, "add");
+    assert_eq!((r["name"].as_str(), r["layer"].as_str()), (Some(RIGHT), Some("CryptoObject")), "{r}");
+    assert_eq!(r["selection"], r#"Left, "Right, \"Box\"""#);
+    assert_eq!(matte(&s), [1.0, 1.0], "the quoted name selects the right half");
+    pick(&mut s, 2.0, "remove");
+    assert_eq!(matte(&s), [0.0, 1.0]);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(matte(&s), [1.0, 1.0]);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(matte(&s), [1.0, 0.0]);
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// At half resolution a preview pixel shows the aux texel at its centre (layer x 3 for preview
+/// pixel 1): `scale` makes the pick read that one, so what is clicked is what lights up.
+#[test]
+fn a_pick_at_preview_resolution_reads_the_pixel_the_preview_shows() {
+    let (mut s, path) = footage("half", 3);
+    s.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap();
+    let r = s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 2.5, "y": 1.5, "scale": 0.5})).unwrap();
+    assert_eq!(r["name"], RIGHT, "{r}");
+    let opts = effectcraft_engine::render::RenderOpts { scale: 0.5, ..Default::default() };
+    // Matte Only: the matte in RGB over alpha 1 (#3127).
+    assert_eq!(s.render(s.active_comp_id().unwrap(), Tick::ZERO, opts).get(1, 0), [1.0; 4]);
+    // At full resolution the same point is Left's pixel.
+    let r = s.execute_checked("effect.cryptomatteAt", json!({"effect": 1, "x": 2.5, "y": 1.5})).unwrap();
+    assert_eq!(r["name"], "Left");
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// A keyframed Selection picked at `time` is edited at that time, not at the current time.
+#[test]
+fn a_keyframed_selection_is_edited_where_it_was_read() {
+    let (mut s, path) = footage("key", 4);
+    for t in [0.0, 1.0] {
+        s.execute_checked("prop.addKey", json!({"path": "effects/#1/selection", "time": t, "value": format!("<{:08x}>", crypto_hash(RIGHT))})).unwrap();
+    }
+    let r = s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 0.5, "y": 1.5, "mode": "add", "time": 1.0})).unwrap();
+    assert_eq!((r["changed"].as_bool(), r["selected"].as_bool()), (Some(true), Some(true)), "{r}");
+    let sel = |s: &mut Session, t: f64| {
+        let r = s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": 0.5, "y": 1.5, "time": t})).unwrap();
+        r["selected"].as_bool()
+    };
+    assert_eq!((sel(&mut s, 0.0), sel(&mut s, 1.0)), (Some(false), Some(true)), "only the key at 1 s gains Left");
+    let _ = std::fs::remove_dir_all(std::path::Path::new(&path).parent().unwrap());
+}
+
+/// A precomp whose 3D layer an expression moves: the pick finds it where the render keys it
+/// (the pick's aux pass runs the session's expressions).
+#[test]
+fn a_pick_on_a_precomp_follows_expressions() {
+    let mut s = effectcraft_host::session();
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 40, "height": 20, "frameRate": 24, "duration": 1})).unwrap()["comp"].clone();
+    let l = s.execute("layer.newSolid", json!({"name": "Ball", "width": 6, "height": 6})).unwrap()["layer"].clone();
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "threeD", "value": true})).unwrap();
+    s.execute_checked("prop.setExpression", json!({"layer": l, "path": "transform/position", "expression": "[33, 10, 0]"})).unwrap();
+    s.execute("comp.new", json!({"name": "Outer", "width": 40, "height": 20, "frameRate": 24, "duration": 1})).unwrap();
+    s.execute("layer.addItem", json!({"item": inner})).unwrap();
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    s.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap();
+    let r = s.execute_checked("effect.pickCryptomatte", json!({"effect": 1, "x": 33.5, "y": 10.5})).unwrap();
+    assert_eq!(r["selection"], "Ball", "{r}");
+    let img = s.render(s.active_comp_id().unwrap(), Tick::ZERO, Default::default());
+    assert_eq!((img.get(33, 10), img.get(20, 10)), ([1.0; 4], [0.0, 0.0, 0.0, 1.0]));
+    assert_eq!(s.execute("effect.cryptomatteAt", json!({"effect": 1, "x": 20.5, "y": 10.5})).unwrap(), serde_json::Value::Null);
+}
diff --git a/crates/host/tests/determinism.rs b/crates/host/tests/it/determinism.rs
similarity index 100%
rename from crates/host/tests/determinism.rs
rename to crates/host/tests/it/determinism.rs
diff --git a/crates/host/tests/exr_layers.rs b/crates/host/tests/it/exr_layers.rs
similarity index 100%
rename from crates/host/tests/exr_layers.rs
rename to crates/host/tests/it/exr_layers.rs
diff --git a/crates/host/tests/footage_reload.rs b/crates/host/tests/it/footage_reload.rs
similarity index 87%
rename from crates/host/tests/footage_reload.rs
rename to crates/host/tests/it/footage_reload.rs
index faf2b09e3..61dc9dbdc 100644
--- a/crates/host/tests/footage_reload.rs
+++ b/crates/host/tests/it/footage_reload.rs
@@ -146,27 +146,58 @@ fn a_file_still_being_written_is_tried_again() {
     assert!(near(pixel(&s, cid, 32, 24), BLUE));
 }
 
+/// The desktop app's watcher ([`footage_reload::Watcher`]) notices a footage file another app
+/// saved, hands its stamps over once, and reloads it through [`footage_reload::Scan::apply`];
+/// while nothing changes it hands over nothing (so the interface is never woken for it).
 #[test]
-fn background_scan_reloads_changed_footage() {
-    let path = tmp("scan.psd");
+fn the_watcher_notices_a_footage_file_changed_on_disk() {
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::time::{Duration, Instant};
+    let path = tmp("watched.psd");
     std::fs::write(&path, flat(RED, false)).unwrap();
     let (mut s, _, cid) = flat_in_comp(&path);
-    let scan = |s: &mut Session| {
-        footage_reload::start_scan(s);
-        let t0 = std::time::Instant::now();
+    let wakes = Arc::new(AtomicUsize::new(0));
+    let counter = Arc::clone(&wakes);
+    let fast = Duration::from_millis(20);
+    let mut w = footage_reload::Watcher::start_with(
+        s.services.clone(),
+        move || {
+            counter.fetch_add(1, Ordering::SeqCst);
+        },
+        fast,
+        Duration::from_secs(60),
+    )
+    .unwrap();
+    w.set_focused(true);
+    w.set_watched(footage_reload::watched(&s));
+    // Report `n`: the worker stores the stamps and then wakes the interface, so wait for the
+    // wake too, not only for the stamps.
+    let next = |w: &footage_reload::Watcher, n: usize| {
+        let t0 = Instant::now();
         loop {
-            if let Some(r) = footage_reload::poll_scan(s) {
-                return r.unwrap();
+            if wakes.load(Ordering::SeqCst) >= n
+                && let Some(stamps) = w.take()
+            {
+                return stamps;
             }
-            assert!(t0.elapsed().as_secs() < 10, "scan never finished");
-            std::thread::yield_now();
+            assert!(t0.elapsed() < Duration::from_secs(10), "the watcher never reported");
+            std::thread::sleep(Duration::from_millis(5));
         }
     };
-    assert_eq!(scan(&mut s), json!({"files": 0, "reloaded": 0}));
+    // First look: remembered, nothing to reload.
+    assert_eq!(next(&w, 1).apply(&mut s).unwrap(), json!({"files": 0, "reloaded": 0}));
+    assert_eq!(wakes.load(Ordering::SeqCst), 1);
+    std::thread::sleep(fast * 15);
+    assert!(w.take().is_none(), "an unchanged file is never reported");
+    assert_eq!(wakes.load(Ordering::SeqCst), 1, "and never wakes the interface");
+    // Saved in another app: reported once, reloaded, shown.
     save(&path, &flat(GREEN, true));
-    assert_eq!(scan(&mut s), json!({"files": 1, "reloaded": 1}));
+    assert_eq!(next(&w, 2).apply(&mut s).unwrap(), json!({"files": 1, "reloaded": 1}));
     assert!(near(pixel(&s, cid, 32, 24), GREEN));
-    assert!(s.footage_scan.is_none());
+    assert_eq!(wakes.load(Ordering::SeqCst), 2);
+    std::thread::sleep(fast * 10);
+    assert!(w.take().is_none());
 }
 
 #[test]
diff --git a/crates/host/tests/gif_animates.rs b/crates/host/tests/it/gif_animates.rs
similarity index 100%
rename from crates/host/tests/gif_animates.rs
rename to crates/host/tests/it/gif_animates.rs
diff --git a/crates/host/tests/it/library.rs b/crates/host/tests/it/library.rs
new file mode 100644
index 000000000..4cd94ecdd
--- /dev/null
+++ b/crates/host/tests/it/library.rs
@@ -0,0 +1,347 @@
+//! The Plug-in Library in a full session, against a local catalog (`file://`): install, update,
+//! remove and start-up loading of WebAssembly packages, checksum and URL rules.
+
+use std::path::{Path, PathBuf};
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{GroupKind, LayerId, Node};
+use effectcraft_engine::segment::sha256;
+use serde_json::{Value, json};
+
+use super::plugins::wat_plugin;
+
+/// A fresh folder for one test: the plug-ins folder and the catalog's files.
+fn tmp(name: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("effectcraft-library-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(d.join("served")).unwrap();
+    d
+}
+
+/// `p` as a `file://` URL (`file:///C:/…` on Windows).
+fn file_url(p: &Path) -> String {
+    let s = p.to_string_lossy().replace('\\', "/");
+    if s.starts_with('/') { format!("file://{s}") } else { format!("file:///{s}") }
+}
+
+/// A host session that installs into `dir`.
+fn session(dir: &Path) -> Session {
+    let mut s = effectcraft_host::session();
+    s.plugins_dir = Some(dir.join("Plug-ins"));
+    s
+}
+
+/// A served module for `effect`; returns (url, sha256).
+fn serve(dir: &Path, file: &str, effect: &str) -> (String, String) {
+    let bytes = wat_plugin(effect, 1, "i32.const 0").into_bytes();
+    let path = dir.join("served").join(file);
+    std::fs::write(&path, &bytes).unwrap();
+    (file_url(&path), sha256::hex(&bytes))
+}
+
+/// Write the catalog (`packages`) and return its URL.
+fn write_catalog(dir: &Path, packages: Value) -> String {
+    let path = dir.join("served").join("index.json");
+    std::fs::write(&path, json!({"schema": 1, "packages": packages}).to_string()).unwrap();
+    file_url(&path)
+}
+
+/// A catalog release entry for a served module.
+fn release(version: &str, (url, sha): &(String, String), effect: &str) -> Value {
+    json!({"version": version, "api": 1, "url": url, "sha256": sha, "effects": [effect]})
+}
+
+/// The package `id` in a `library.list` reply.
+fn package<'a>(list: &'a Value, id: &str) -> &'a Value {
+    list["packages"].as_array().unwrap().iter().find(|p| p["id"] == id).unwrap_or_else(|| panic!("no {id} in {list}"))
+}
+
+/// The effect ids registered in the process.
+fn plugin_ids(s: &mut Session) -> Vec<String> {
+    let l = s.execute("effect.plugins.list", json!({})).unwrap();
+    l["plugins"].as_array().unwrap().iter().filter_map(|p| p["id"].as_str().map(str::to_string)).collect()
+}
+
+#[test]
+fn install_update_and_remove_a_package() {
+    let dir = tmp("cycle");
+    let fx = "org.test.library.cycle";
+    let v1 = serve(&dir, "cycle-1.wasm", fx);
+    let catalog = write_catalog(
+        &dir,
+        json!([{"id": "org.test.cycle", "name": "Cycle", "author": "Tester", "license": "MIT", "tags": ["test"], "versions": [release("1.0.0", &v1, fx)]}]),
+    );
+    let mut s = session(&dir);
+    // Before a catalog: nothing listed, installing is refused.
+    assert_eq!(s.execute("library.list", json!({})).unwrap()["packages"], json!([]));
+    assert!(s.execute("library.install", json!({"id": "org.test.cycle", "wait": true})).unwrap_err().to_string().contains("library.refresh"));
+    assert_eq!(s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap()["packages"], 1);
+    let l = s.execute("library.list", json!({"query": "tester"})).unwrap();
+    let p = package(&l, "org.test.cycle");
+    assert_eq!((p["latest"].as_str(), p["installed"].as_str(), p["effects"][0].as_str()), (Some("1.0.0"), None, Some(fx)), "{l}");
+    assert_eq!(l["tags"], json!(["test"]));
+    assert_eq!(s.execute("library.list", json!({"query": "no such thing"})).unwrap()["packages"], json!([]));
+
+    let r = s.execute("library.install", json!({"id": "org.test.cycle", "wait": true})).unwrap();
+    assert_eq!((r["installed"].as_bool(), r["restartNeeded"].as_bool()), (Some(true), Some(false)), "{r}");
+    assert!(plugin_ids(&mut s).iter().any(|i| i == fx), "loaded right away");
+    let lib = dir.join("Plug-ins").join("Library");
+    assert!(lib.join("org.test.cycle").join("1.0.0").join("org.test.cycle.wasm").is_file());
+    let installed: Value = serde_json::from_slice(&std::fs::read(lib.join("installed.json")).unwrap()).unwrap();
+    assert_eq!(installed["packages"]["org.test.cycle"]["version"], "1.0.0");
+    // The effect applies like any other.
+    s.execute("comp.new", json!({"name": "L", "width": 8, "height": 8, "duration": 1})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({"color": [1, 0, 0], "width": 8, "height": 8})).unwrap()["layer"].clone();
+    s.execute("effect.apply", json!({"layer": layer, "effect": fx})).unwrap();
+    assert_eq!(s.execute("library.missing", json!({})).unwrap()["effects"], json!([]));
+
+    // Version 2: an update; the loaded version stays until the next start.
+    let v2 = serve(&dir, "cycle-2.wasm", fx);
+    let catalog = write_catalog(&dir, json!([{"id": "org.test.cycle", "name": "Cycle", "versions": [release("1.0.0", &v1, fx), release("1.10.0", &v2, fx)]}]));
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    assert_eq!(package(&s.execute("library.list", json!({})).unwrap(), "org.test.cycle")["updateAvailable"], true);
+    let r = s.execute("library.update", json!({"wait": true})).unwrap();
+    assert_eq!(r["updating"], json!(["org.test.cycle"]), "{r}");
+    let p = s.execute("library.list", json!({"installed": true})).unwrap();
+    let p = package(&p, "org.test.cycle");
+    assert_eq!((p["installed"].as_str(), p["updateAvailable"].as_bool(), p["restartNeeded"].as_bool()), (Some("1.10.0"), Some(false), Some(true)), "{p}");
+    assert!(!lib.join("org.test.cycle").join("1.0.0").exists(), "the old version is removed");
+
+    let r = s.execute("library.uninstall", json!({"id": "org.test.cycle"})).unwrap();
+    assert_eq!((r["removed"].as_bool(), r["restartNeeded"].as_bool()), (Some(true), Some(true)));
+    assert!(!lib.join("org.test.cycle").exists());
+    assert_eq!(s.execute("library.uninstall", json!({"id": "org.test.cycle"})).unwrap()["removed"], false);
+    // Still listed by the catalog, no longer installed.
+    assert!(package(&s.execute("library.list", json!({})).unwrap(), "org.test.cycle")["installed"].is_null());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_wrong_checksum_or_a_bad_module_installs_nothing() {
+    let dir = tmp("checks");
+    let (url, _) = serve(&dir, "a.wasm", "org.test.library.checks.a");
+    let garbage = dir.join("served").join("garbage.wasm");
+    std::fs::write(&garbage, b"\0asm\x01\0\0\0garbage").unwrap();
+    let garbage_sha = sha256::hex(&std::fs::read(&garbage).unwrap());
+    let catalog = write_catalog(
+        &dir,
+        json!([
+            {"id": "org.test.badsum", "name": "Bad Sum", "versions": [{"version": "1", "api": 1, "url": url, "sha256": "0".repeat(64)}]},
+            {"id": "org.test.garbage", "name": "Garbage", "versions": [{"version": "1", "api": 1, "url": file_url(&garbage), "sha256": garbage_sha}]},
+            {"id": "org.test.web", "name": "Web", "versions": [{"version": "1", "api": 1, "url": "https://example.com/x.wasm", "sha256": "0".repeat(64)}]},
+            {"id": "org.test.future", "name": "Future", "versions": [{"version": "1", "api": 99, "url": url, "sha256": "0".repeat(64)}]}
+        ]),
+    );
+    let mut s = session(&dir);
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    let e = s.execute("library.install", json!({"id": "org.test.badsum", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("SHA-256"), "{e}");
+    let e = s.execute("library.install", json!({"id": "org.test.garbage", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("didn't load"), "{e}");
+    let e = s.execute("library.install", json!({"id": "org.test.web", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("isn't on GitHub"), "{e}");
+    let e = s.execute("library.install", json!({"id": "org.test.future", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("no release for this EffectCraft"), "{e}");
+    assert_eq!(package(&s.execute("library.list", json!({})).unwrap(), "org.test.future")["needsNewerApp"], true);
+    let lib = dir.join("Plug-ins").join("Library");
+    for id in ["org.test.badsum", "org.test.garbage", "org.test.web"] {
+        assert!(!lib.join(id).exists(), "{id}");
+    }
+    assert!(!lib.join("installed.json").exists());
+    // Remote catalogs must be on GitHub too; the list still works from the cached copy.
+    assert!(s.execute("library.refresh", json!({"catalog": "https://example.com/index.json"})).unwrap_err().to_string().contains("isn't on GitHub"));
+    assert!(s.execute("library.refresh", json!({"catalog": "http://raw.githubusercontent.com/x"})).is_err());
+    let mut fresh = session(&dir);
+    assert_eq!(fresh.execute("library.list", json!({})).unwrap()["packages"].as_array().unwrap().len(), 4, "read from catalog.json");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn installed_packages_load_at_start_and_changed_files_are_refused() {
+    let dir = tmp("startup");
+    let lib = dir.join("Plug-ins").join("Library");
+    let mut entries = serde_json::Map::new();
+    for (id, effect, tamper) in
+        [("org.test.start.ok", "org.test.library.start.ok", false), ("org.test.start.tampered", "org.test.library.start.tampered", true)]
+    {
+        let bytes = wat_plugin(effect, 1, "i32.const 0").into_bytes();
+        let file = format!("{id}/1.0.0/{id}.wasm");
+        let path = lib.join(id).join("1.0.0");
+        std::fs::create_dir_all(&path).unwrap();
+        let written = if tamper { wat_plugin(effect, 1, "i32.const 1").into_bytes() } else { bytes.clone() };
+        std::fs::write(path.join(format!("{id}.wasm")), written).unwrap();
+        entries.insert(id.into(), json!({"version": "1.0.0", "file": file, "sha256": sha256::hex(&bytes), "effects": [effect]}));
+    }
+    entries.insert("org.test.start.escape".into(), json!({"version": "1", "file": "../../outside.wasm", "sha256": "0".repeat(64)}));
+    std::fs::write(lib.join("installed.json"), json!({"packages": entries}).to_string()).unwrap();
+    let mut s = session(&dir);
+    let r = s.execute("library.loadInstalled", json!({})).unwrap();
+    let loaded: Vec<&str> = r["loaded"].as_array().unwrap().iter().filter_map(|v| v["package"].as_str()).collect();
+    assert_eq!(loaded, ["org.test.start.ok"], "{r}");
+    let errors = r["errors"].to_string();
+    assert!(errors.contains("org.test.start.tampered") && errors.contains("SHA-256"), "{r}");
+    assert!(errors.contains("bad module path"), "{r}");
+    assert!(plugin_ids(&mut s).iter().any(|i| i == "org.test.library.start.ok"));
+    // Running it again loads nothing twice.
+    assert_eq!(s.execute("library.loadInstalled", json!({})).unwrap()["loaded"], json!([]));
+    // Without a catalog the installed packages are still listed.
+    let l = s.execute("library.list", json!({})).unwrap();
+    let p = package(&l, "org.test.start.ok");
+    assert_eq!((p["unlisted"].as_bool(), p["loaded"].as_str()), (Some(true), Some("1.0.0")), "{l}");
+    // A corrupt installed.json is an empty library, not a failure.
+    std::fs::write(lib.join("installed.json"), b"{not json").unwrap();
+    assert_eq!(session(&dir).execute("library.loadInstalled", json!({})).unwrap()["loaded"], json!([]));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn missing_effects_name_the_packages_that_provide_them() {
+    let dir = tmp("missing");
+    let fx = "org.test.library.missing.fx";
+    let v = serve(&dir, "m.wasm", fx);
+    let catalog = write_catalog(&dir, json!([{"id": "org.test.missing", "name": "Missing", "versions": [release("1.0.0", &v, fx)]}]));
+    let mut s = session(&dir);
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    // A project whose effects include one this session doesn't have (as when a project from
+    // someone with the plug-in opens here).
+    s.execute("comp.new", json!({"name": "M", "width": 8, "height": 8, "duration": 1})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({"color": [1, 0, 0], "width": 8, "height": 8})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layer": layer, "effect": "ec.blur.gaussian"})).unwrap();
+    s.execute("effect.apply", json!({"layer": layer, "effect": "ec.blur.gaussian"})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let proj = std::sync::Arc::make_mut(&mut s.project);
+    let l = proj.comp_mut(cid).unwrap().layer_mut(LayerId(layer)).unwrap();
+    let first = l.props.sub_mut("effects").unwrap().children.iter_mut().find_map(|n| match n {
+        Node::Group(g) => Some(g),
+        _ => None,
+    });
+    first.unwrap().kind = GroupKind::Effect { effect: fx.into() };
+    let r = s.execute("library.missing", json!({})).unwrap();
+    assert_eq!(r["effects"], json!([{"effect": fx, "packages": ["org.test.missing"]}]), "{r}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn preview_renders_a_package_without_installing_it() {
+    let dir = tmp("preview");
+    let fx = "org.test.library.preview.fx";
+    // The preview frame (320 × 180 RGBA f32) needs more than the test module's two pages.
+    let bytes = wat_plugin(fx, 1, "i32.const 0").replace("(memory (export \"memory\") 2)", "(memory (export \"memory\") 20)").into_bytes();
+    let path = dir.join("served").join("p.wasm");
+    std::fs::write(&path, &bytes).unwrap();
+    let v = (file_url(&path), sha256::hex(&bytes));
+    let mut bad = release("1.0.0", &v, fx);
+    bad["sha256"] = json!("0".repeat(64));
+    let catalog = write_catalog(
+        &dir,
+        json!([
+            {"id": "org.test.preview", "name": "Preview", "preview": {"video": "https://www.youtube.com/watch?v=x"}, "versions": [release("1.0.0", &v, fx)]},
+            {"id": "org.test.preview.bad", "name": "Bad", "preview": {"video": "javascript:alert(1)"}, "versions": [bad]}
+        ]),
+    );
+    let mut s = session(&dir);
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    let r = s.execute("library.preview", json!({"id": "org.test.preview", "wait": true})).unwrap();
+    assert_eq!((r["frames"].as_u64(), r["width"].as_u64(), r["effect"]["id"].as_str()), (Some(24), Some(320), Some(fx)), "{r}");
+    let st = s.library.status();
+    let pv = st.preview.as_ref().unwrap();
+    assert_eq!((pv.before.len(), pv.frames[0].len()), (320 * 180 * 4, 320 * 180 * 4));
+    // Previewing installs and registers nothing.
+    assert!(!dir.join("Plug-ins").join("Library").join("org.test.preview").exists());
+    assert!(!plugin_ids(&mut s).iter().any(|i| i == fx));
+    let l = s.execute("library.list", json!({})).unwrap();
+    let p = package(&l, "org.test.preview");
+    assert_eq!((p["previewed"].as_bool(), p["video"].as_str()), (Some(true), Some("https://www.youtube.com/watch?v=x")), "{l}");
+    assert!(package(&l, "org.test.preview.bad")["video"].is_null(), "only https:// videos are kept");
+    // Asking again answers from memory; a wrong checksum previews nothing.
+    assert_eq!(s.execute("library.preview", json!({"id": "org.test.preview"})).unwrap()["frames"], 24);
+    let e = s.execute("library.preview", json!({"id": "org.test.preview.bad", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("SHA-256"), "{e}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_reinstall_that_fails_to_load_keeps_the_installed_copy() {
+    let dir = tmp("reinstall");
+    let fx = "org.test.library.reinstall.fx";
+    let v = serve(&dir, "r.wasm", fx);
+    let catalog = write_catalog(&dir, json!([{"id": "org.test.reinstall", "name": "Reinstall", "versions": [release("1.0.0", &v, fx)]}]));
+    let mut s = session(&dir);
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    s.execute("library.install", json!({"id": "org.test.reinstall", "wait": true})).unwrap();
+    // A second session in this process: the effect is registered already, so loading fails.
+    let mut other = session(&dir);
+    let e = other.execute("library.install", json!({"id": "org.test.reinstall", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("didn't load"), "{e}");
+    let lib = dir.join("Plug-ins").join("Library");
+    assert!(lib.join("org.test.reinstall").join("1.0.0").join("org.test.reinstall.wasm").is_file());
+    let installed: Value = serde_json::from_slice(&std::fs::read(lib.join("installed.json")).unwrap()).unwrap();
+    assert_eq!(installed["packages"]["org.test.reinstall"]["version"], "1.0.0");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn an_update_that_would_not_load_keeps_the_loaded_version() {
+    let dir = tmp("badupdate");
+    let fx = "org.test.library.badupdate.fx";
+    let v1 = serve(&dir, "u1.wasm", fx);
+    // The right checksum for a file that isn't a plug-in.
+    let junk = b"not a WebAssembly module".to_vec();
+    let path = dir.join("served").join("u2.wasm");
+    std::fs::write(&path, &junk).unwrap();
+    let v2 = (file_url(&path), sha256::hex(&junk));
+    let catalog = write_catalog(&dir, json!([{"id": "org.test.badupdate", "name": "Bad Update", "versions": [release("1.0.0", &v1, fx)]}]));
+    let mut s = session(&dir);
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    s.execute("library.install", json!({"id": "org.test.badupdate", "wait": true})).unwrap();
+    let catalog =
+        write_catalog(&dir, json!([{"id": "org.test.badupdate", "name": "Bad Update", "versions": [release("1.0.0", &v1, fx), release("2.0.0", &v2, fx)]}]));
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    // Version 1 is loaded in this session, so version 2 would only load at the next start.
+    let e = s.execute("library.update", json!({"id": "org.test.badupdate", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("didn't load"), "{e}");
+    let lib = dir.join("Plug-ins").join("Library");
+    assert!(lib.join("org.test.badupdate").join("1.0.0").join("org.test.badupdate.wasm").is_file());
+    assert!(!lib.join("org.test.badupdate").join("2.0.0").exists());
+    let installed: Value = serde_json::from_slice(&std::fs::read(lib.join("installed.json")).unwrap()).unwrap();
+    assert_eq!(installed["packages"]["org.test.badupdate"]["version"], "1.0.0");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn update_all_updates_every_package_and_min_app_is_enforced() {
+    let dir = tmp("updateall");
+    let (fa, fb) = ("org.test.library.updateall.a", "org.test.library.updateall.b");
+    let (a1, b1) = (serve(&dir, "a1.wasm", fa), serve(&dir, "b1.wasm", fb));
+    let catalog = write_catalog(
+        &dir,
+        json!([
+            {"id": "org.test.ua", "name": "A", "versions": [release("1.0.0", &a1, fa)]},
+            {"id": "org.test.ub", "name": "B", "versions": [release("1.0.0", &b1, fb)]}
+        ]),
+    );
+    let mut s = session(&dir);
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    for id in ["org.test.ua", "org.test.ub"] {
+        s.execute("library.install", json!({"id": id, "wait": true})).unwrap();
+    }
+    let mut future = release("3.0.0", &a1, fa);
+    future["minApp"] = json!("999.0");
+    let catalog = write_catalog(
+        &dir,
+        json!([
+            {"id": "org.test.ua", "name": "A", "versions": [release("1.0.0", &a1, fa), release("2.0.0", &a1, fa), future]},
+            {"id": "org.test.ub", "name": "B", "versions": [release("1.0.0", &b1, fb), release("2.0.0", &b1, fb)]}
+        ]),
+    );
+    s.execute("library.refresh", json!({"catalog": catalog, "wait": true})).unwrap();
+    let e = s.execute("library.install", json!({"id": "org.test.ua", "version": "3.0.0", "wait": true})).unwrap_err().to_string();
+    assert!(e.contains("999.0"), "{e}");
+    let r = s.execute("library.update", json!({"wait": true})).unwrap();
+    assert_eq!(r["updating"], json!(["org.test.ua", "org.test.ub"]), "{r}");
+    let l = s.execute("library.list", json!({"installed": true})).unwrap();
+    for id in ["org.test.ua", "org.test.ub"] {
+        assert_eq!(package(&l, id)["installed"], "2.0.0", "{l}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/host/tests/it/main.rs b/crates/host/tests/it/main.rs
new file mode 100644
index 000000000..168ec127a
--- /dev/null
+++ b/crates/host/tests/it/main.rs
@@ -0,0 +1,17 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod background_presets;
+mod cryptomatte_pick;
+mod determinism;
+mod exr_layers;
+mod footage_reload;
+mod gif_animates;
+mod library;
+mod pick_whip;
+mod plugins;
+mod relink;
+mod tga_import;
+mod timeline_interop;
+mod vector_import;
+mod wav_markers;
+mod webm_metadata;
diff --git a/crates/host/tests/it/pick_whip.rs b/crates/host/tests/it/pick_whip.rs
new file mode 100644
index 000000000..340cda053
--- /dev/null
+++ b/crates/host/tests/it/pick_whip.rs
@@ -0,0 +1,38 @@
+//! The pick whip's references read the property they were made from (#1072): an Alt pick whip's
+//! (`byIndex`) select an effect's properties by index, `effect("Fractal Noise")(i)(j)`, and must
+//! read the same value as the reference by name.
+//!
+//! (With Compact English off, a reference to another layer, `thisComp.layer("Other")("effects")…`,
+//! doesn't evaluate yet, by name or by index: "not a callable function".)
+
+use serde_json::{Value, json};
+
+#[test]
+fn index_references_read_the_same_values_as_names() {
+    let mut s = effectcraft_host::session();
+    s.execute("comp.new", json!({"name": "T", "width": 64, "height": 64, "duration": 1})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"name": "Reader", "color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    let o = s.execute("layer.newSolid", json!({"name": "Other", "color": "#00ff00"})).unwrap()["layer"].as_u64().unwrap();
+    for fx in ["Fractal Noise", "Point Control"] {
+        s.execute("effect.apply", json!({"layer": o, "effect": fx})).unwrap();
+    }
+    s.execute("prop.set", json!({"layer": o, "path": "effects/#1/transform/scale", "value": 77})).unwrap();
+    s.execute("prop.set", json!({"layer": o, "path": "effects/#2/point", "value": [12, 34]})).unwrap();
+    let evaluated = |s: &mut effectcraft_engine::Session, path: &str| -> Value {
+        let v = s.execute("prop.get", json!({"layer": l, "path": path})).unwrap();
+        assert!(v.get("expressionError").is_none(), "{v}");
+        v["evaluated"].clone()
+    };
+    for (path, target, dimension, want) in
+        [("transform/rotation", "effects/#1/transform/scale", None, json!(77.0)), ("transform/opacity", "effects/#2/point", Some(1), json!(34.0))]
+    {
+        let mut t = json!({"layer": o, "path": target});
+        if let Some(d) = dimension {
+            t["dimension"] = json!(d);
+        }
+        for by_index in [false, true] {
+            let e = s.execute("prop.pickWhip", json!({"layer": l, "path": path, "target": t, "byIndex": by_index})).unwrap();
+            assert_eq!(evaluated(&mut s, path), want, "by index {by_index}: {e}");
+        }
+    }
+}
diff --git a/crates/host/tests/it/plugins.rs b/crates/host/tests/it/plugins.rs
new file mode 100644
index 000000000..33748d366
--- /dev/null
+++ b/crates/host/tests/it/plugins.rs
@@ -0,0 +1,440 @@
+//! Effect plug-ins in a full session: a Rust plug-in registered through the trait and the
+//! example WebAssembly plug-in (examples/plugins/posterize-bands) loaded with
+//! `effect.plugins.load`, both applied by id like built-ins and rendered.
+
+use std::sync::Arc;
+
+use effectcraft_engine::Session;
+use effectcraft_engine::effects::plugin::{EffectPlugin, PluginFrame, PluginManifest, PluginParam, PluginParamKind, PluginParams, register_plugin};
+use effectcraft_engine::time::Tick;
+use serde_json::json;
+
+struct Swap {
+    m: PluginManifest,
+}
+
+impl EffectPlugin for Swap {
+    fn manifest(&self) -> &PluginManifest {
+        &self.m
+    }
+    fn render(&self, frame: &mut PluginFrame, params: &PluginParams, _time: f64) -> Result<(), String> {
+        if params.b("on") {
+            for p in frame.pixels.iter_mut() {
+                p.swap(0, 2);
+            }
+        }
+        Ok(())
+    }
+}
+
+fn setup() -> (Session, u64) {
+    let mut s = effectcraft_host::session();
+    s.execute("comp.new", json!({"name": "P", "width": 40, "height": 20, "duration": 1})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": [1.0, 0.5, 0.0], "width": 40, "height": 20})).unwrap()["layer"].as_u64().unwrap();
+    (s, l)
+}
+
+fn px(s: &Session) -> [f32; 4] {
+    let cid = s.active_comp_id().unwrap();
+    s.render(cid, Tick::ZERO, Default::default()).get(20, 10)
+}
+
+#[test]
+fn rust_plugins_apply_by_id() {
+    let m = PluginManifest {
+        api: 1,
+        id: "org.test.swap".into(),
+        name: "Swap Red Blue".into(),
+        category: "Channel".into(),
+        version: "1".into(),
+        author: String::new(),
+        description: String::new(),
+        params: vec![PluginParam { id: "on".into(), name: "On".into(), kind: PluginParamKind::Checkbox { default: true }, group: String::new() }],
+    };
+    register_plugin(Arc::new(Swap { m })).unwrap();
+    let (mut s, l) = setup();
+    s.execute("effect.apply", json!({"layer": l, "effect": "org.test.swap"})).unwrap();
+    let p = px(&s);
+    assert!(p[0] < 0.01 && (p[1] - 0.5).abs() < 0.01 && p[2] > 0.99, "{p:?}");
+    // Its parameters are ordinary properties: set (and animate) them like any effect's.
+    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/on", "value": false})).unwrap();
+    let p = px(&s);
+    assert!(p[0] > 0.99 && p[2] < 0.01, "{p:?}");
+    let list = s.execute("effect.plugins.list", json!({})).unwrap();
+    assert!(list["plugins"].as_array().unwrap().iter().any(|p| p["id"] == "org.test.swap" && p["category"] == "Channel"));
+    assert_eq!(list["api"], 2);
+    assert!(s.execute("effect.list", json!({"filter": "swap red"})).unwrap().as_array().unwrap().len() == 1);
+}
+
+/// Build the example plug-in (skipped when the wasm32 target isn't installed).
+fn build_example() -> Option<std::path::PathBuf> {
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../examples/plugins/posterize-bands");
+    let workspace = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let assigned = std::env::var_os("CARGO_TARGET_DIR");
+    let target = assigned.as_ref().map(std::path::PathBuf::from).unwrap_or_else(|| workspace.join("target"));
+    let target = if target.is_absolute() { target } else { workspace.join(target) };
+    // The plug-in is part of this test's build. Inherit the assigned target and
+    // compiler guards rather than creating a second target at its root.
+    let mut command = std::process::Command::new(env!("CARGO"));
+    command.current_dir(&workspace).args(["build", "--release", "--target", "wasm32-unknown-unknown", "--manifest-path"]).arg(root.join("Cargo.toml"));
+    if assigned.is_none() {
+        command.env("CARGO_TARGET_DIR", &target);
+    }
+    let st = command.status().ok()?;
+    if !st.success() {
+        eprintln!("skipping: the example plug-in didn't build (rustup target add wasm32-unknown-unknown)");
+        return None;
+    }
+    Some(target.join("wasm32-unknown-unknown/release/posterize_bands.wasm"))
+}
+
+/// A host session whose settings and Plug-ins folder are both in `config`: installs must never
+/// reach the real settings folder the host session points its Plug-ins folder at.
+fn install_session(config: &std::path::Path) -> Session {
+    let mut s = effectcraft_host::session();
+    s.config = Some(Arc::new(effectcraft_engine::config::DirConfig::new(config)));
+    s.plugins_dir = Some(config.join("Plug-ins"));
+    s
+}
+
+#[test]
+fn plugin_bundle_install_copies_wasm_and_installs_panels() {
+    let config = tempfile::TempDir::new().unwrap();
+    let config = config.path();
+    let plug_dir = config.join("Plug-ins");
+    let bundle = tempfile::TempDir::new().unwrap();
+    let bundle = bundle.path();
+    std::fs::write(bundle.join("a-good.wasm"), wat_plugin("org.test.host.install", 1, "i32.const 0")).unwrap();
+    std::fs::write(bundle.join("My Panel.jsx"), "1".as_bytes()).unwrap();
+    std::fs::write(bundle.join("notes.txt"), b"not a plug-in").unwrap();
+
+    let mut s = install_session(config);
+    let r = s.execute("effect.plugins.install", json!({"folder": bundle.to_string_lossy()})).unwrap();
+    assert_eq!(r["installed"].as_array().unwrap().len(), 1, "{r}");
+    assert_eq!(r["errors"].as_array().unwrap().len(), 0, "{r}");
+    assert_eq!(r["panels"].as_array().unwrap()[0], json!("My Panel.jsx"), "{r}");
+    // The plug-in is on disk where the start-up scan looks, and the panel is listable like an
+    // installed one.
+    assert!(plug_dir.join("a-good.wasm").is_file(), "{r}");
+    assert!(s.config.as_ref().unwrap().read("Scripts/ScriptUI Panels/My Panel.jsx").as_deref() == Some("1"), "{r}");
+    // The effect is usable in this session already.
+    s.execute("comp.new", json!({"name": "I", "width": 40, "height": 20, "duration": 1})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": [1.0, 0.5, 0.0], "width": 40, "height": 20})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layer": l, "effect": "Host org.test.host.install"})).unwrap();
+
+    // A load failure rolls the copy back: nothing left behind to fail every start.
+    let bad = tempfile::TempDir::new().unwrap();
+    let bad = bad.path();
+    std::fs::write(bad.join("b-garbage.wasm"), b"\0asm\x01\0\0\0garbage").unwrap();
+    let r2 = s.execute("effect.plugins.install", json!({"folder": bad.to_string_lossy()})).unwrap();
+    assert_eq!(r2["errors"].as_array().unwrap().len(), 1, "{r2}");
+    assert!(r2["installed"].as_array().unwrap().is_empty(), "{r2}");
+    assert!(!plug_dir.join("b-garbage.wasm").exists(), "{r2}");
+
+    // A single-file install: non-wasm paths are refused, and good files land on disk.
+    assert!(s.execute("effect.plugins.install", json!({"path": bundle.join("My Panel.jsx").to_string_lossy()})).is_err());
+    // A single-file success: the file lands in the Plug-ins folder and is reported installed.
+    let fresh = bundle.join("fresh.wasm");
+    std::fs::write(&fresh, wat_plugin("org.test.host.fresh", 1, "i32.const 0")).unwrap();
+    let r3 = s.execute("effect.plugins.install", json!({"path": fresh.to_string_lossy()})).unwrap();
+    assert_eq!(r3["installed"].as_array().unwrap()[0], json!("fresh.wasm"), "{r3}");
+    assert!(plug_dir.join("fresh.wasm").is_file(), "{r3}");
+    // Again from `config`: an already-registered (in-session) id fails as a duplicate.
+    let again = config.join("keep.wasm");
+    std::fs::copy(bundle.join("a-good.wasm"), &again).unwrap();
+    assert!(s.execute("effect.plugins.install", json!({"path": again.to_string_lossy()})).is_err());
+}
+
+#[test]
+fn plugin_install_never_replaces_an_installed_plugin() {
+    let config = tempfile::TempDir::new().unwrap();
+    let config = config.path();
+    let plug_dir = config.join("Plug-ins");
+    let src = tempfile::TempDir::new().unwrap();
+    let src = src.path();
+    std::fs::write(src.join("a-good.wasm"), wat_plugin("org.test.host.replace", 1, "i32.const 0")).unwrap();
+
+    let mut s = install_session(config);
+    s.execute("effect.plugins.install", json!({"path": src.join("a-good.wasm").to_string_lossy()})).unwrap();
+    let installed = std::fs::read(plug_dir.join("a-good.wasm")).unwrap();
+
+    // Same file name, a different plug-in: installing over the existing one must be refused,
+    // not quietly swap it — and the first plug-in's bytes on disk stay exactly what they were.
+    let attack = tempfile::TempDir::new().unwrap();
+    let attack = attack.path();
+    std::fs::write(attack.join("a-good.wasm"), wat_plugin("org.test.host.hack", 1, "i32.const 0")).unwrap();
+    let r = s.execute("effect.plugins.install", json!({"folder": attack.to_string_lossy()})).unwrap();
+    assert!(r["installed"].as_array().unwrap().is_empty(), "{r}");
+    let errs: Vec<String> = r["errors"].as_array().unwrap().iter().map(|e| e["error"].as_str().unwrap().to_string()).collect();
+    assert!(errs.iter().any(|e| e.contains("already installed")), "{r}");
+    assert_eq!(std::fs::read(plug_dir.join("a-good.wasm")).unwrap(), installed);
+
+    // The same through a single-file install: a command error, disk untouched.
+    assert!(s.execute("effect.plugins.install", json!({"path": attack.join("a-good.wasm").to_string_lossy()})).is_err());
+    assert_eq!(std::fs::read(plug_dir.join("a-good.wasm")).unwrap(), installed);
+
+    // A ScriptUI panel is code too: a bundle must not replace an installed one silently either.
+    let p1 = tempfile::TempDir::new().unwrap();
+    std::fs::write(p1.path().join("My Panel.jsx"), "1").unwrap();
+    s.execute("effect.plugins.install", json!({"folder": p1.path().to_string_lossy()})).unwrap();
+    let p2 = tempfile::TempDir::new().unwrap();
+    std::fs::write(p2.path().join("My Panel.jsx"), "2").unwrap();
+    let r = s.execute("effect.plugins.install", json!({"folder": p2.path().to_string_lossy()})).unwrap();
+    assert!(r["panels"].as_array().unwrap().is_empty(), "{r}");
+    let errs: Vec<String> = r["errors"].as_array().unwrap().iter().map(|e| e["error"].as_str().unwrap().to_string()).collect();
+    assert!(errs.iter().any(|e| e.contains("already installed as a ScriptUI panel")), "{r}");
+    assert_eq!(s.config.as_ref().unwrap().read("Scripts/ScriptUI Panels/My Panel.jsx").as_deref(), Some("1"));
+}
+
+/// A single install of a hidden file is an error, not a success that installed nothing; a panel
+/// whose name differs from an installed one only in case is refused (on Windows and macOS writing
+/// it would replace that panel); an installed plug-in's source is its installed copy.
+#[test]
+fn plugin_install_refuses_hidden_files_and_case_variant_panels() {
+    let config = tempfile::TempDir::new().unwrap();
+    let config = config.path();
+    let src = tempfile::TempDir::new().unwrap();
+    let src = src.path();
+    let mut s = install_session(config);
+
+    let hidden = src.join(".hidden.wasm");
+    std::fs::write(&hidden, wat_plugin("org.test.host.hidden", 1, "i32.const 0")).unwrap();
+    assert!(s.execute("effect.plugins.install", json!({"path": hidden.to_string_lossy()})).is_err());
+    assert!(!config.join("Plug-ins").join(".hidden.wasm").exists());
+
+    let p1 = tempfile::TempDir::new().unwrap();
+    std::fs::write(p1.path().join("Case Panel.jsx"), "1").unwrap();
+    s.execute("effect.plugins.install", json!({"folder": p1.path().to_string_lossy()})).unwrap();
+    let p2 = tempfile::TempDir::new().unwrap();
+    std::fs::write(p2.path().join("case panel.jsx"), "2").unwrap();
+    let r = s.execute("effect.plugins.install", json!({"folder": p2.path().to_string_lossy()})).unwrap();
+    assert!(r["panels"].as_array().unwrap().is_empty(), "{r}");
+    assert_eq!(r["errors"].as_array().unwrap().len(), 1, "{r}");
+    assert_eq!(s.config.as_ref().unwrap().read("Scripts/ScriptUI Panels/Case Panel.jsx").as_deref(), Some("1"));
+
+    let good = src.join("sourced.wasm");
+    std::fs::write(&good, wat_plugin("org.test.host.sourced", 1, "i32.const 0")).unwrap();
+    s.execute("effect.plugins.install", json!({"path": good.to_string_lossy()})).unwrap();
+    let list = s.execute("effect.plugins.list", json!({})).unwrap();
+    let entry = list["plugins"].as_array().unwrap().iter().find(|p| p["id"] == "org.test.host.sourced").cloned().unwrap();
+    assert_eq!(entry["source"], json!(config.join("Plug-ins").join("sourced.wasm").to_string_lossy()), "{entry}");
+}
+
+/// A huge file is refused before it is read into memory and copied into the folder the app loads
+/// at every start.
+#[test]
+fn plugin_install_refuses_an_oversized_file() {
+    let config = tempfile::TempDir::new().unwrap();
+    let src = tempfile::TempDir::new().unwrap();
+    let big = src.path().join("big.wasm");
+    // Sparse on every platform we build for: no 64 MiB written, just the length.
+    std::fs::File::create(&big).unwrap().set_len((64 << 20) + 1).unwrap();
+
+    let mut s = install_session(config.path());
+    let Err(e) = s.execute("effect.plugins.install", json!({"path": big.to_string_lossy()})) else { panic!("an oversized plug-in was installed") };
+    assert!(e.to_string().contains("byte limit"), "{e}");
+    assert!(!config.path().join("Plug-ins/big.wasm").exists(), "{e}");
+}
+
+#[test]
+fn example_wasm_plugin_loads_and_renders() {
+    let Some(wasm) = build_example() else { return };
+    let (mut s, l) = setup();
+    let r = s.execute("effect.plugins.load", json!({"path": wasm.to_string_lossy()})).unwrap();
+    assert_eq!(r["loaded"][0]["id"], "org.effectcraft.example.posterize-bands", "{r}");
+    s.execute("effect.apply", json!({"layer": l, "effect": "Posterize Bands"})).unwrap();
+    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/mix", "value": 0})).unwrap();
+    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/levels", "value": 2})).unwrap();
+    // Luminance of (1, .5, 0) is ~0.57: with 2 levels it bands to 1, scaling the colour by 1/y
+    // (8 bpc: red clips at 1).
+    let p = px(&s);
+    let y = 0.2126 + 0.7152 * 0.5;
+    assert!((p[1] - 0.5 / y as f32).abs() < 0.01 && p[0] > 0.99 && p[2] < 0.01, "{p:?}");
+    // Invert: band 0.
+    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/invert", "value": true})).unwrap();
+    assert_eq!(px(&s)[..3], [0.0, 0.0, 0.0]);
+    let list = s.execute("effect.plugins.list", json!({})).unwrap();
+    assert!(list["plugins"].as_array().unwrap().iter().any(|p| p["source"].as_str().unwrap_or("").ends_with(".wasm")));
+}
+
+/// A parameterless plug-in module (WebAssembly text): `render` is `ec_render`'s body.
+pub(super) fn wat_plugin(id: &str, api: i32, render: &str) -> String {
+    let manifest = format!(r#"{{"api":1,"id":"{id}","name":"Host {id}","category":"Test Plug-ins","version":"1","params":[]}}"#);
+    let len = manifest.len();
+    let escaped = manifest.replace('"', "\\\"");
+    format!(
+        r#"(module
+  (memory (export "memory") 2)
+  (data (i32.const 16) "{escaped}")
+  (func (export "ec_api_version") (result i32) i32.const {api})
+  (func (export "ec_manifest_ptr") (result i32) i32.const 16)
+  (func (export "ec_manifest_len") (result i32) i32.const {len})
+  (func (export "ec_alloc") (param i32) (result i32) i32.const 1024)
+  (func (export "ec_render") (param i32 i32 i32 i32 i32 f64 f64) (result i32) {render}))"#
+    )
+}
+
+#[test]
+fn plugin_loading_reports_bad_modules_and_survives_failing_renders() {
+    let dir = std::env::temp_dir().join(format!("effectcraft-host-plugins-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let files = [
+        ("a-good.wasm", wat_plugin("org.test.host.good", 1, "i32.const 0").into_bytes()),
+        ("b-garbage.wasm", b"\0asm\x01\0\0\0garbage".to_vec()),
+        ("c-v3.wasm", wat_plugin("org.test.host.v3", 3, "i32.const 0").into_bytes()),
+        ("d-empty.wasm", vec![]),
+        ("e-trap.wasm", wat_plugin("org.test.host.trap", 1, "unreachable").into_bytes()),
+        ("notes.txt", b"not a plug-in".to_vec()),
+    ];
+    for (name, bytes) in &files {
+        std::fs::write(dir.join(name), bytes).unwrap();
+    }
+    let (mut s, l) = setup();
+    let r = s.execute("effect.plugins.load", json!({"folder": dir.to_string_lossy()})).unwrap();
+    let ids: Vec<&str> = r["loaded"].as_array().unwrap().iter().filter_map(|v| v["id"].as_str()).collect();
+    assert_eq!(ids, ["org.test.host.good", "org.test.host.trap"], "{r}");
+    let errs: Vec<String> = r["errors"].as_array().unwrap().iter().map(|e| e["path"].as_str().unwrap().to_string()).collect();
+    assert_eq!(errs.len(), 3, "{r}");
+    assert!(errs.iter().all(|p| !p.ends_with(".txt")));
+    assert!(r["errors"].to_string().contains("ABI 3"), "{r}");
+    // A single file: errors come back as command errors; loading twice is refused.
+    let good = dir.join("a-good.wasm").to_string_lossy().to_string();
+    assert!(s.execute("effect.plugins.load", json!({"path": good})).unwrap_err().to_string().contains("already registered"));
+    assert!(s.execute("effect.plugins.load", json!({"path": dir.join("missing.wasm").to_string_lossy()})).is_err());
+    assert!(s.execute("effect.plugins.load", json!({"folder": dir.join("missing").to_string_lossy()})).is_err());
+    assert!(s.execute("effect.plugins.load", json!({})).is_err());
+    // A plug-in that traps on every frame leaves the layer as it was.
+    let before = px(&s);
+    s.execute("effect.apply", json!({"layer": l, "effect": "org.test.host.trap"})).unwrap();
+    assert_eq!(px(&s), before);
+    s.execute("effect.apply", json!({"layer": l, "effect": "org.test.host.good"})).unwrap();
+    assert_eq!(px(&s), before);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// An ABI 2 plug-in (WebAssembly text) that shows the neighbouring frames it got: per pixel it
+/// writes |next.red − prev.red| into red, `flags / 8` into green, `prev_time` into blue and 1
+/// into alpha, so a render test can read the frames and their times back from the image.
+fn wat_neighbour_plugin(id: &str) -> String {
+    let manifest = format!(r#"{{"api":2,"id":"{id}","name":"Host {id}","category":"Test Plug-ins","version":"1","params":[]}}"#);
+    let len = manifest.len();
+    let escaped = manifest.replace('"', "\\\"");
+    format!(
+        r#"(module
+  (memory (export "memory") 2)
+  (data (i32.const 16) "{escaped}")
+  (func (export "ec_api_version") (result i32) i32.const 2)
+  (func (export "ec_manifest_ptr") (result i32) i32.const 16)
+  (func (export "ec_manifest_len") (result i32) i32.const {len})
+  (func (export "ec_alloc") (param i32) (result i32) i32.const 1024)
+  (func (export "ec_render2")
+    (param $px i32) (param $w i32) (param $h i32) (param $params i32) (param $np i32)
+    (param $t f64) (param $scale f64)
+    (param $prev i32) (param $prev_t f64) (param $next i32) (param $next_t f64) (param $flags i32)
+    (result i32)
+    (local $i i32)
+    (local $n i32)
+    local.get $w
+    local.get $h
+    i32.mul
+    local.set $n
+    block $done
+      loop $per_pixel
+        local.get $i
+        local.get $n
+        i32.ge_u
+        br_if $done
+        ;; red = |next.red - prev.red|
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        local.get $next
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        f32.load
+        local.get $prev
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        f32.load
+        f32.sub
+        f32.abs
+        f32.store
+        ;; green = flags / 8
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        local.get $flags
+        f32.convert_i32_s
+        f32.const 8
+        f32.div
+        f32.store offset=4
+        ;; blue = prev_time
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        local.get $prev_t
+        f32.demote_f64
+        f32.store offset=8
+        ;; alpha = 1
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        f32.const 1
+        f32.store offset=12
+        local.get $i
+        i32.const 1
+        i32.add
+        local.set $i
+        br $per_pixel
+      end
+    end
+    i32.const 0))"#
+    )
+}
+
+/// The neighbouring frames are the layer's own pixels at other times: here a precomp whose
+/// nested solid fades from 0 to 100 % over one second, at 4 fps. At 0.5 s the neighbours are
+/// 0.25 s and 0.75 s, so red (the current frame) was 0.5 and |next − prev| is 0.5.
+#[test]
+fn abi_v2_plugins_render_with_real_neighbour_frames() {
+    let mut s = effectcraft_host::session();
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 40, "height": 20, "frameRate": 4, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+    let solid = s.execute("layer.newSolid", json!({"color": [1.0, 0.0, 0.0], "width": 40, "height": 20})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.addKey", json!({"layer": solid, "path": "transform/opacity", "time": 0.0, "value": 0})).unwrap();
+    s.execute("prop.addKey", json!({"layer": solid, "path": "transform/opacity", "time": 1.0, "value": 100})).unwrap();
+    let outer = s.execute("comp.new", json!({"name": "Outer", "width": 40, "height": 20, "frameRate": 4, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+    let layer = s.execute("layer.addItem", json!({"comp": outer, "item": inner, "time": 0})).unwrap()["layer"].as_u64().unwrap();
+    let outer = effectcraft_engine::project::ItemId(outer);
+
+    let dir = tempfile::TempDir::new().unwrap();
+    let wasm = dir.path().join("neighbours.wasm");
+    std::fs::write(&wasm, wat_neighbour_plugin("org.test.host.neighbours")).unwrap();
+    let r = s.execute("effect.plugins.load", json!({"path": wasm.to_string_lossy()})).unwrap();
+    assert_eq!(r["loaded"][0]["id"], "org.test.host.neighbours", "{r}");
+    s.execute("effect.apply", json!({"layer": layer, "effect": "org.test.host.neighbours"})).unwrap();
+
+    let p = s.render(outer, Tick::from_seconds_f64(0.5), Default::default()).get(20, 10);
+    assert!((p[0] - 0.5).abs() < 0.02, "precomp neighbours: {p:?}");
+    // Both neighbours exist, the previous one is the 0.25 s frame, and the frame is opaque.
+    assert!((p[1] - 3.0 / 8.0).abs() < 0.01, "flags: {p:?}");
+    assert!((p[2] - 0.25).abs() < 0.01, "prev time: {p:?}");
+    assert_eq!(p[3], 1.0, "{p:?}");
+
+    // At the very start of the layer only the next frame exists (the previous one is zeroed);
+    // solids are filled with a quantised colour, hence the 8-bit step.
+    let p = s.render(outer, Tick::ZERO, Default::default()).get(20, 10);
+    assert!((p[0] - 0.25).abs() < 0.01, "the next frame's red, with no previous frame: {p:?}");
+    assert!((p[1] - 2.0 / 8.0).abs() < 0.01, "only the next frame is valid: {p:?}");
+}
diff --git a/crates/host/tests/relink.rs b/crates/host/tests/it/relink.rs
similarity index 100%
rename from crates/host/tests/relink.rs
rename to crates/host/tests/it/relink.rs
diff --git a/crates/host/tests/tga_import.rs b/crates/host/tests/it/tga_import.rs
similarity index 100%
rename from crates/host/tests/tga_import.rs
rename to crates/host/tests/it/tga_import.rs
diff --git a/crates/host/tests/timeline_interop.rs b/crates/host/tests/it/timeline_interop.rs
similarity index 99%
rename from crates/host/tests/timeline_interop.rs
rename to crates/host/tests/it/timeline_interop.rs
index 5123dc721..9688a409f 100644
--- a/crates/host/tests/timeline_interop.rs
+++ b/crates/host/tests/it/timeline_interop.rs
@@ -56,8 +56,9 @@ fn still(p: &mut fp::Project, path: &str) -> fp::ItemId {
             color: Default::default(),
             has_alpha: false,
             bitrate: None,
+            hdr: None,
         }),
-        audio: None,
+        audio_streams: Vec::new(),
         container: String::new(),
         start_timecode: None,
         file_size: None,
diff --git a/crates/host/tests/vector_import.rs b/crates/host/tests/it/vector_import.rs
similarity index 59%
rename from crates/host/tests/vector_import.rs
rename to crates/host/tests/it/vector_import.rs
index 49f8d950c..eff5b4b4b 100644
--- a/crates/host/tests/vector_import.rs
+++ b/crates/host/tests/it/vector_import.rs
@@ -121,8 +121,8 @@ fn psd_16bit_cmyk_composition_imports() {
     assert!(d < 2.0 / 255.0, "mean diff {d}");
 }
 
-const SVG: &[u8] = include_bytes!("../../svg/tests/fixtures/basic-shapes.svg");
-const SVG2: &[u8] = include_bytes!("../../svg/tests/fixtures/paths-gradients.svg");
+const SVG: &[u8] = include_bytes!("../../../svg/tests/fixtures/basic-shapes.svg");
+const SVG2: &[u8] = include_bytes!("../../../svg/tests/fixtures/paths-gradients.svg");
 
 #[test]
 fn svg_footage_and_shapes_from_vector_layer() {
@@ -466,6 +466,11 @@ fn psd_smart_objects_with_perspective_and_warp_bake_as_placed() {
 
 /// A PDF with two placed images (one turned a quarter) between a background and a shape.
 fn image_pdf() -> Vec<u8> {
+    image_pdf_with("")
+}
+
+/// [`image_pdf`] with `boxes` added to the page dictionary.
+fn image_pdf_with(boxes: &str) -> Vec<u8> {
     let content = "0.9 0.9 0.9 rg 0 0 120 80 re f\nq 60 0 0 30 10 40 cm /Im Do Q\nq 0 40 -20 0 110 10 cm /Im Do Q\n0 0 1 rg 20 5 30 20 re f\n";
     // 8×8 pixels in quadrants: red, green / white, black.
     let quad = |x: usize, y: usize| -> [u8; 3] { [[[255, 0, 0], [0, 255, 0]], [[255, 255, 255], [0, 0, 0]]][y / 4][x / 4] };
@@ -474,7 +479,7 @@ fn image_pdf() -> Vec<u8> {
         &[
             (1, "<< /Type /Catalog /Pages 2 0 R >>".into(), None),
             (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(), None),
-            (3, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 120 80] /Resources << /XObject << /Im 5 0 R >> >> /Contents 4 0 R >>".into(), None),
+            (3, format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 120 80] {boxes} /Resources << /XObject << /Im 5 0 R >> >> /Contents 4 0 R >>"), None),
             (4, "<< >>".into(), Some(content.as_bytes().to_vec())),
             (5, "<< /Type /XObject /Subtype /Image /Width 8 /Height 8 /ColorSpace /DeviceRGB /BitsPerComponent 8 >>".into(), Some(px)),
         ],
@@ -509,7 +514,7 @@ fn shapes_from_vector_layer_keeps_images_as_footage_layers() {
     assert_eq!(names, ["images.pdf Outlines", "Image", "Image", "images.pdf Outlines 1", "images.pdf"]);
     assert_eq!(c.layers[0].id.0, sid);
     assert_eq!(r["layers"].as_array().unwrap().len(), 2);
-    for l in &c.layers[1..3] {
+    for l in c.layers.iter().skip(1).take(2) {
         assert_eq!(l.parent.map(|p| p.0), Some(sid), "{}", l.name);
         assert!(matches!(l.source, effectcraft_project::LayerSource::Footage { .. }));
     }
@@ -546,6 +551,355 @@ fn retain_pdf(width: u32) -> Vec<u8> {
     )
 }
 
+/// A 200 × 100 pt page: red left half, blue right half.
+fn halves_pdf() -> Vec<u8> {
+    effectcraft_pdf::write::pdf(
+        &[
+            (1, "<< /Type /Catalog /Pages 2 0 R >>".into(), None),
+            (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(), None),
+            (3, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R >>".into(), None),
+            (4, "<< >>".into(), Some(b"1 0 0 rg 0 0 100 100 re f 0 0 1 rg 100 0 100 100 re f".to_vec())),
+        ],
+        1,
+    )
+}
+
+/// #3099: footage from an After Effects project ([`effectcraft_project::Footage::placed_page`])
+/// keeps the size After Effects stored for a placed .ai, which can differ from the page as read
+/// here. The page fills that size at full and at reduced resolution alike: it was drawn at its own
+/// aspect at full resolution and stretched to the stored size below 3/4 (the art jumped when the
+/// viewer changed resolution, and the masks, stored against that size, came out too large at
+/// full resolution). Two placed items of one file at different stored sizes each get their own
+/// pixels, and neither reuses the file's frame at its own size, decoded first.
+#[test]
+fn placed_vector_footage_fills_its_stored_size_at_every_resolution() {
+    use effectcraft_project::ItemKind;
+    use effectcraft_time::Tick;
+
+    let path = tmp("stored-size.ai");
+    std::fs::write(&path, halves_pdf()).unwrap();
+    let mut s = effectcraft_host::session();
+    let item = ItemId(s.execute_checked("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap());
+    let red = |p: [f32; 4]| p[3] > 0.99 && p[0] > 0.9 && p[2] < 0.1;
+    let blue = |p: [f32; 4]| p[3] > 0.99 && p[2] > 0.9 && p[0] < 0.1;
+    // At the file's own size first (its frame goes to the pool's cache).
+    s.execute("comp.new", json!({"name": "Own", "width": 200, "height": 100, "frameRate": 25, "duration": 1})).unwrap();
+    s.execute_checked("layer.addItem", json!({"item": item.0})).unwrap();
+    let own_comp = s.active_comp_id().unwrap();
+    let own = s.render(own_comp, Tick::ZERO, RenderOpts::default());
+    assert!(red(own.get(50, 90)) && blue(own.get(150, 90)));
+    // Two placed items of the file with the sizes an After Effects project stores (other aspects).
+    let proj = std::sync::Arc::make_mut(&mut s.project);
+    let ItemKind::Footage(f) = &mut proj.item_mut(item).unwrap().kind else { panic!("footage") };
+    (f.width, f.height, f.placed_page) = (100, 80, true);
+    let tall = effectcraft_project::Footage { width: 60, height: 120, ..f.clone() };
+    let tall = proj.add_item("tall", Default::default(), None, ItemKind::Footage(tall));
+    for (item, (w, h)) in [(item, (100u32, 80u32)), (tall, (60, 120))] {
+        s.execute("comp.new", json!({"name": format!("Stored {w}"), "width": w, "height": h, "frameRate": 25, "duration": 1})).unwrap();
+        let lid = s.execute_checked("layer.addItem", json!({"item": item.0})).unwrap()["layer"].as_u64().unwrap();
+        let cid = s.active_comp_id().unwrap();
+        let (l, r, top, bottom) = (i64::from(w / 4), i64::from(w * 3 / 4), 3, i64::from(h) - 4);
+        for collapse in [false, true] {
+            s.execute("layer.setSwitch", json!({"layers": [lid], "switch": "collapse", "value": collapse})).unwrap();
+            let full = s.render(cid, Tick::ZERO, RenderOpts::default());
+            assert_eq!((full.width, full.height), (w, h));
+            for y in [top, bottom] {
+                let (a, b) = (full.get(l, y), full.get(r, y));
+                assert!(red(a) && blue(b), "{w}×{h}, collapse {collapse}, full resolution, row {y}: {a:?} {b:?}");
+            }
+            let half = s.render(cid, Tick::ZERO, RenderOpts { scale: 0.5, ..RenderOpts::default() });
+            assert_eq!((half.width, half.height), (w / 2, h / 2));
+            for y in [top / 2, bottom / 2] {
+                let (a, b) = (half.get(l / 2, y), half.get(r / 2, y));
+                assert!(red(a) && blue(b), "{w}×{h}, collapse {collapse}, half resolution, row {y}: {a:?} {b:?}");
+            }
+        }
+        // Create Shapes from Vector Layer draws the shapes where the footage is drawn.
+        s.execute_checked("layer.create", json!({"op": "shapesFromVector", "layers": [lid]})).unwrap();
+        s.execute("layer.setSwitch", json!({"layers": [lid], "switch": "video", "value": false})).unwrap();
+        let shapes = s.render(cid, Tick::ZERO, RenderOpts::default());
+        for y in [top, bottom] {
+            let (a, b) = (shapes.get(l, y), shapes.get(r, y));
+            assert!(red(a) && blue(b), "{w}×{h}, shapes, row {y}: {a:?} {b:?}");
+        }
+    }
+}
+
+/// #3099 review: Create Shapes from Vector Layer on a placed page keeps the page's frame. The
+/// footage's raster shows only the ArtBox (241 × 121) of `art_box_ai()`, whose grey media box
+/// reaches past it on every side; in a composition larger than the footage, the outlines show
+/// the same colours inside the frame and nothing (the background) outside it. Without the clip
+/// they showed the whole page: the grey background around the art.
+#[test]
+fn shapes_from_a_placed_page_stay_inside_its_frame() {
+    use effectcraft_project::ItemKind;
+    use effectcraft_time::Tick;
+
+    let path = tmp("placed-frame.ai");
+    std::fs::write(&path, art_box_ai()).unwrap();
+    let mut s = effectcraft_host::session();
+    let item = ItemId(s.execute_checked("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap());
+    // As an After Effects project stores it: the ArtBox's size, placed.
+    let ItemKind::Footage(f) = &mut std::sync::Arc::make_mut(&mut s.project).item_mut(item).unwrap().kind else { panic!("footage") };
+    (f.width, f.height, f.placed_page) = (241, 121, true);
+    s.execute("comp.new", json!({"name": "Big", "width": 400, "height": 300, "frameRate": 25, "duration": 1})).unwrap();
+    let lid = s.execute_checked("layer.addItem", json!({"item": item.0})).unwrap()["layer"].as_u64().unwrap();
+    let cid = s.active_comp_id().unwrap();
+    // The layer is centred: layer pixel (x, y) is comp (x + 79.5, y + 89.5).
+    let at = |img: &Image, x: f64, y: f64| img.get((x + 79.5).floor() as i64, (y + 89.5).floor() as i64);
+    let red = |p: [f32; 4]| p[3] > 0.99 && p[0] > 0.9 && p[1] < 0.1 && p[2] < 0.1;
+    let blue = |p: [f32; 4]| p[3] > 0.99 && p[2] > 0.9 && p[0] < 0.1 && p[1] < 0.1;
+    let empty = |p: [f32; 4]| p[0] < 0.02 && p[1] < 0.02 && p[2] < 0.02;
+    let inside = [([20.0, 20.0], true), ([110.0, 100.0], true), ([130.0, 20.0], false), ([230.0, 110.0], false)];
+    // Outside the frame, where the page's grey media box would show: left, right, above, below.
+    let outside = [[-20.0, 60.0], [-55.0, 100.0], [260.0, 60.0], [300.0, 10.0], [120.0, -20.0], [120.0, 140.0]];
+    let check = |img: &Image, what: &str| {
+        for (p, want_red) in inside {
+            let px = at(img, p[0], p[1]);
+            assert!(if want_red { red(px) } else { blue(px) }, "{what}: inside the frame at {p:?}: {px:?}");
+        }
+        for p in outside {
+            let px = at(img, p[0], p[1]);
+            assert!(empty(px), "{what}: outside the frame at {p:?}: {px:?}");
+        }
+    };
+    check(&s.render(cid, Tick::ZERO, RenderOpts::default()), "footage");
+    s.execute_checked("layer.create", json!({"op": "shapesFromVector", "layers": [lid]})).unwrap();
+    let comp = s.project.comp(cid).unwrap();
+    assert!(!comp.layers.iter().find(|l| l.id.0 == lid).unwrap().switches.video, "the source is switched off");
+    check(&s.render(cid, Tick::ZERO, RenderOpts::default()), "shapes");
+}
+
+/// #3099 review: the images of a placed page become footage layers clipped to the frame too.
+/// `image_pdf_with` an ArtBox [20 15 100 70]: the upright image reaches past the frame's left
+/// edge, the turned one past its right and bottom edges, the grey page around it. After the
+/// conversion the layers inside the frame match the footage, and outside it nothing shows.
+#[test]
+fn images_from_a_placed_page_stay_inside_its_frame() {
+    use effectcraft_project::{ItemKind, MatteKind, TrackMatte};
+    use effectcraft_time::Tick;
+
+    let path = tmp("placed-images.pdf");
+    std::fs::write(&path, image_pdf_with("/ArtBox [20 15 100 70]")).unwrap();
+    let mut s = effectcraft_host::session();
+    let item = ItemId(s.execute_checked("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap());
+    let ItemKind::Footage(f) = &mut std::sync::Arc::make_mut(&mut s.project).item_mut(item).unwrap().kind else { panic!("footage") };
+    (f.width, f.height, f.placed_page) = (80, 55, true);
+    s.execute("comp.new", json!({"name": "Big", "width": 200, "height": 150, "frameRate": 25, "duration": 1})).unwrap();
+    let lid = s.execute_checked("layer.addItem", json!({"item": item.0})).unwrap()["layer"].as_u64().unwrap();
+    let cid = s.active_comp_id().unwrap();
+    // Centred: layer pixel (x, y) is comp (x + 60, y + 47.5).
+    let at = |img: &Image, x: f64, y: f64| img.get((x + 60.0).floor() as i64, (y + 47.5).floor() as i64);
+    let empty = |p: [f32; 4]| p[0] < 0.02 && p[1] < 0.02 && p[2] < 0.02;
+    // Inside: both images and the grey page; outside: the images past the frame, the grey page.
+    let inside = [[10.0, 8.0], [40.0, 8.0], [10.0, 22.0], [40.0, 22.0], [75.0, 25.0], [75.0, 50.0], [5.0, 40.0], [60.0, 10.0]];
+    let outside = [[-5.0, 15.0], [85.0, 40.0], [75.0, 58.0], [-15.0, 50.0], [40.0, -5.0]];
+    let footage = s.render(cid, Tick::ZERO, RenderOpts::default());
+    for p in outside {
+        assert!(empty(at(&footage, p[0], p[1])), "footage outside the frame at {p:?}: {:?}", at(&footage, p[0], p[1]));
+    }
+    let r = s.execute_checked("layer.create", json!({"op": "shapesFromVector", "layers": [lid]})).unwrap();
+    assert_eq!(r["skipped"], json!([]), "{r}");
+    // One hidden frame layer is the Alpha track matte of every layer made from the page.
+    let comp = s.project.comp(cid).unwrap();
+    let frame = comp.layers.iter().find(|l| l.name.ends_with(" Frame")).expect("the frame matte layer");
+    assert!(!frame.switches.video);
+    let made: Vec<_> = comp.layers.iter().filter(|l| l.id != frame.id && l.id.0 != lid).collect();
+    assert_eq!(made.iter().filter(|l| l.name == "Image").count(), 2);
+    for l in &made {
+        assert_eq!(l.track_matte, Some(TrackMatte { layer: frame.id, kind: MatteKind::Alpha }), "{}", l.name);
+    }
+    let shapes = s.render(cid, Tick::ZERO, RenderOpts::default());
+    for p in inside {
+        let (a, b) = (at(&shapes, p[0], p[1]), at(&footage, p[0], p[1]));
+        assert!((0..4).all(|k| (a[k] - b[k]).abs() < 0.05), "inside the frame at {p:?}: {a:?} vs footage {b:?}");
+    }
+    for p in outside {
+        assert!(empty(at(&shapes, p[0], p[1])), "shapes outside the frame at {p:?}: {:?}", at(&shapes, p[0], p[1]));
+    }
+}
+
+/// A PDF with an ArtBox, imported here (not from an After Effects project), and a project saved
+/// with it before #3099: shown as a PDF viewer frames it (the crop box, 410 × 210) at its own
+/// size, exactly as before; the project file has no new field.
+#[test]
+fn a_pdf_with_an_art_box_imported_here_keeps_the_viewer_framing() {
+    use effectcraft_project::{ItemKind, Project};
+    use effectcraft_time::Tick;
+
+    let bytes = art_box_ai();
+    let path = tmp("viewer-art-box.pdf");
+    std::fs::write(&path, &bytes).unwrap();
+    let mut s = effectcraft_host::session();
+    let item = ItemId(s.execute_checked("file.import", json!({"paths": [path]})).unwrap()["items"][0].as_u64().unwrap());
+    let ItemKind::Footage(f) = &s.project.item(item).unwrap().kind else { panic!("footage") };
+    assert_eq!((f.width, f.height, f.placed_page), (410, 210, false));
+    s.execute("comp.new", json!({"name": "V", "width": 410, "height": 210, "frameRate": 25, "duration": 1})).unwrap();
+    s.execute_checked("layer.addItem", json!({"item": item.0})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let direct = effectcraft_svg::rasterize(&effectcraft_pdf::parse(&bytes).unwrap(), 410, 210, 1.0);
+    assert!(mean_diff(&s.render(cid, Tick::ZERO, RenderOpts::default()), &direct) < 1.0 / 255.0);
+    let saved = s.project.to_json();
+    assert!(!saved.contains("placed_page"), "the saved project is in the earlier format");
+    s.project = std::sync::Arc::new(Project::from_json(&saved).unwrap());
+    assert!(mean_diff(&s.render(cid, Tick::ZERO, RenderOpts::default()), &direct) < 1.0 / 255.0, "reopened");
+}
+
+/// `i3099-a-boxes.ai` of `effectcraft-aep`'s `ai-mask-3099.aep` (its boxes as in
+/// `tests/fixtures/tools/ai-mask-3099.py`): MediaBox 420 × 220, CropBox, BleedBox and TrimBox
+/// inside it, ArtBox [60 50 300.6 170.4]. Here grey over the media box, the art box red on its
+/// left half and blue on its right half.
+fn art_box_ai() -> Vec<u8> {
+    let page = "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 420 220] /CropBox [5 5 415 215] /BleedBox [10 10 410 210] /TrimBox [20 20 400 200] /ArtBox [60 50 300.6 170.4] /Contents 4 0 R >>";
+    let content = b"0.5 g 0 0 420 220 re f 1 0 0 rg 60 50 120.3 120.4 re f 0 0 1 rg 180.3 50 120.3 120.4 re f";
+    effectcraft_pdf::write::pdf(
+        &[
+            (1, "<< /Type /Catalog /Pages 2 0 R >>".into(), None),
+            (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(), None),
+            (3, page.into(), None),
+            (4, "<< >>".into(), Some(content.to_vec())),
+        ],
+        1,
+    )
+}
+
+/// `i3099-d-trim.ai` of `ai-mask-3099.aep`: MediaBox 418 × 218, TrimBox, ArtBox [40 30 250 150]
+/// (no CropBox). Grey over the media box, the art box red on its left half, blue on its right.
+fn trim_ai() -> Vec<u8> {
+    let page = "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 418 218] /TrimBox [9 9 409 209] /BleedBox [0 0 418 218] /ArtBox [40 30 250 150] /Contents 4 0 R >>";
+    let content = b"0.5 g 0 0 418 218 re f 1 0 0 rg 40 30 105 120 re f 0 0 1 rg 145 30 105 120 re f";
+    effectcraft_pdf::write::pdf(
+        &[
+            (1, "<< /Type /Catalog /Pages 2 0 R >>".into(), None),
+            (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(), None),
+            (3, page.into(), None),
+            (4, "<< >>".into(), Some(content.to_vec())),
+        ],
+        1,
+    )
+}
+
+/// `i3099-c-rot.ai` of `ai-mask-3099.aep`: MediaBox [100 50 400 150] with `/Rotate 90`, grey,
+/// with a blue 20 × 10 marker 4 pt in from the media box's lower-left corner.
+fn rotated_ai() -> Vec<u8> {
+    effectcraft_pdf::write::pdf(
+        &[
+            (1, "<< /Type /Catalog /Pages 2 0 R >>".into(), None),
+            (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(), None),
+            (3, "<< /Type /Page /Parent 2 0 R /MediaBox [100 50 400 150] /Rotate 90 /Contents 4 0 R >>".into(), None),
+            (4, "<< >>".into(), Some(b"0.5 g 100 50 300 100 re f 0 0 1 rg 104 54 20 10 re f".to_vec())),
+        ],
+        1,
+    )
+}
+
+/// #3099 end to end, against After Effects 2026's own read-back of the committed project
+/// `ai-mask-3099.aep`: a placed .ai (ArtBox inside a larger crop box) parented to a Null parented
+/// to a Null, with two rectangular masks. After Effects sizes the footage 241 × 121 (the ArtBox)
+/// and puts the layer's corners at the comp points below (`toComp`). The art fills the layer
+/// between the masks at full and at half resolution; it was drawn from the crop box (410 × 210)
+/// scaled to the layer's width, so the masks cut the wrong part of it and half resolution
+/// squeezed it, and the Null left at its default anchor moved it. `artC` (`/Rotate 90`) is drawn
+/// unturned as After Effects draws it, `artD` (Continuously Rasterize) as `art`.
+#[test]
+fn aep_ai_layer_with_masks_under_two_nulls_renders_like_after_effects() {
+    use effectcraft_engine::render::EvalCtx;
+    use effectcraft_project::ItemKind;
+    use effectcraft_time::Tick;
+
+    let dir = std::path::PathBuf::from(tmp("ai-mask-3099"));
+    std::fs::create_dir_all(&dir).unwrap();
+    let aep = dir.join("ai-mask-3099.aep");
+    // The fixture belongs to `effectcraft-aep` (its sidecar and generator are there); this test
+    // renders it through the wired session, which that crate cannot.
+    std::fs::write(&aep, include_bytes!("../../../aep/tests/fixtures/ai-mask-3099.aep")).unwrap();
+    let mut s = effectcraft_host::session();
+    s.execute_checked("file.importAep", json!({"path": aep.to_string_lossy(), "allowLosses": true})).unwrap();
+    // The project's footage paths are neutral (`C:\fixture\x\...`): the files are linked here.
+    for (name, bytes, size) in
+        [("i3099-a-boxes.ai", art_box_ai(), (241, 121)), ("i3099-c-rot.ai", rotated_ai(), (300, 100)), ("i3099-d-trim.ai", trim_ai(), (210, 120))]
+    {
+        let file = dir.join(name);
+        std::fs::write(&file, bytes).unwrap();
+        let item = s
+            .project
+            .items
+            .values()
+            .find(|i| matches!(&i.kind, ItemKind::Footage(f) if f.path.ends_with(name)))
+            .map(|i| i.id)
+            .unwrap_or_else(|| panic!("footage {name}"));
+        let ItemKind::Footage(f) = &mut std::sync::Arc::make_mut(&mut s.project).item_mut(item).unwrap().kind else { panic!("footage") };
+        assert_eq!((f.width, f.height, f.placed_page), (size.0, size.1, true), "{name}: After Effects' size of the placed .ai");
+        (f.path, f.missing) = (file.to_string_lossy().into_owned(), false);
+    }
+    let cid = s.project.items.values().find(|i| i.name == "ai-mask").map(|i| i.id).expect("comp ai-mask");
+
+    // After Effects' toComp of the art layer's points (layer pixels → comp pixels).
+    let ae = [
+        ([0.0, 0.0], [634.193413913741, 195.085717365354]),
+        ([241.0, 0.0], [913.539162876539, 269.936185209003]),
+        ([0.0, 121.0], [577.822625890412, 405.464362331113]),
+        ([40.0, 30.0], [666.58162514008, 259.669026149884]),
+        ([350.0, 160.0], [965.342375965623, 581.976354279664]),
+    ];
+    let comp = s.project.comp(cid).unwrap();
+    let art = comp.layer_by_name("art").unwrap();
+    let (m, _) = EvalCtx::new(&s.project, cid, comp, Tick::ZERO).layer_to_comp(art);
+    let to_comp = |[u, v]: [f64; 2]| [m.0[0][0] * u + m.0[0][1] * v + m.0[0][2], m.0[1][0] * u + m.0[1][1] * v + m.0[1][2]];
+    for (p, want) in ae {
+        let got = to_comp(p);
+        assert!((got[0] - want[0]).abs() < 1e-3 && (got[1] - want[1]).abs() < 1e-3, "{p:?}: {got:?} vs After Effects {want:?}");
+    }
+
+    // Inside the masks (M1: x 40..200, y 30..90; M2: x 220..350, y 100..160, cut by the layer).
+    let red = |p: [f32; 4]| p[0] > 0.9 && p[1] < 0.1 && p[2] < 0.1;
+    let blue = |p: [f32; 4]| p[2] > 0.9 && p[0] < 0.1 && p[1] < 0.1;
+    let full = s.render(cid, Tick::ZERO, RenderOpts::default());
+    let half = s.render(cid, Tick::ZERO, RenderOpts { scale: 0.5, ..RenderOpts::default() });
+    for (p, want_red) in [([60.0, 45.0], true), ([100.0, 75.0], true), ([150.0, 40.0], false), ([190.0, 80.0], false), ([232.0, 112.0], false)] {
+        let [x, y] = to_comp(p);
+        let at = |img: &Image, k: f64| img.get((x * k).round() as i64, (y * k).round() as i64);
+        for (img, k, what) in [(&full, 1.0, "full"), (&half, 0.5, "half")] {
+            let px = at(img, k);
+            let ok = if want_red { red(px) } else { blue(px) };
+            assert!(ok, "{what} resolution, layer point {p:?}: {px:?} (want {})", if want_red { "red" } else { "blue" });
+        }
+    }
+    // Outside the masks the art is cut away: the black background.
+    for p in [[100.0, 110.0], [20.0, 60.0]] {
+        let [x, y] = to_comp(p);
+        let px = full.get(x.round() as i64, y.round() as i64);
+        assert!(px[0] < 0.05 && px[1] < 0.05 && px[2] < 0.05, "layer point {p:?}: {px:?}");
+    }
+    // artC (/Rotate 90, position (1500, 800), anchor (150, 50)): After Effects draws the page
+    // unturned, 300 × 100, the marker at its lower left (comp 1354..1374, 836..846).
+    for (img, k, what) in [(&full, 1.0, "full"), (&half, 0.5, "half")] {
+        let at = |x: f64, y: f64| img.get((x * k).round() as i64, (y * k).round() as i64);
+        let marker = at(1364.0, 841.0);
+        assert!(blue(marker), "{what} resolution, artC marker: {marker:?}");
+        for (x, y) in [(1450.0, 780.0), (1630.0, 790.0), (1364.0, 770.0)] {
+            let grey = at(x, y);
+            assert!(grey[3] > 0.99 && (grey[0] - grey[2]).abs() < 0.02 && grey[0] > 0.1 && grey[0] < 0.9, "{what} resolution, artC at ({x}, {y}): {grey:?}");
+        }
+    }
+    for (x, y) in [(1340.0, 800.0), (1500.0, 870.0)] {
+        let px = full.get(x as i64, y as i64);
+        assert!(px[0] < 0.05 && px[2] < 0.05, "outside artC ({x}, {y}): {px:?}");
+    }
+    // artD (ArtBox 210 × 120, Continuously Rasterize, the same masks, also under N2): placed by
+    // After Effects' toComp of its corners.
+    let (tl, tr, bl) = ([883.191424310055, 728.610562914909], [1126.6047325349, 793.832962280744], [827.286510567911, 937.250541393348]);
+    let d_to_comp = |[u, v]: [f64; 2]| [0, 1].map(|i| tl[i] + u / 210.0 * (tr[i] - tl[i]) + v / 120.0 * (bl[i] - tl[i]));
+    for (p, want_red) in [([60.0, 45.0], true), ([90.0, 75.0], true), ([150.0, 40.0], false), ([190.0, 80.0], false)] {
+        let [x, y] = d_to_comp(p);
+        for (img, k, what) in [(&full, 1.0, "full"), (&half, 0.5, "half")] {
+            let px = img.get((x * k).round() as i64, (y * k).round() as i64);
+            let ok = if want_red { red(px) } else { blue(px) };
+            assert!(ok, "artD, {what} resolution, layer point {p:?}: {px:?} (want {})", if want_red { "red" } else { "blue" });
+        }
+    }
+}
+
 #[test]
 fn ai_composition_retains_layer_sizes_and_positions() {
     use effectcraft_project::{ItemKind, LayerSource, Project};
diff --git a/crates/host/tests/it/wav_markers.rs b/crates/host/tests/it/wav_markers.rs
new file mode 100644
index 000000000..98d2685dc
--- /dev/null
+++ b/crates/host/tests/it/wav_markers.rs
@@ -0,0 +1,126 @@
+//! Markers a WAV file carries, through the fully wired session (media import included): the
+//! layer made from the file starts with them, and Update Markers From Source copies them again,
+//! through its bound `layers` parameter as well as the selection, as one undo step.
+
+use effectcraft_engine::Session;
+use effectcraft_project::LayerSource;
+use serde_json::json;
+
+/// The comments of a layer's markers, in time order.
+fn names(s: &mut Session, layer: u64) -> Vec<String> {
+    let list = s.execute_checked("markers.list", json!({"layer": layer})).unwrap();
+    list.as_array().unwrap().iter().map(|m| m["comment"].as_str().unwrap().to_string()).collect()
+}
+
+/// A one-second mono 8 kHz WAV with the named cue points `(id, sample, name)` (a `cue ` chunk and a
+/// `LIST` `adtl`).
+fn marker_wav(points: &[(u32, u32, &str)]) -> Vec<u8> {
+    fn chunk(id: &[u8; 4], body: &[u8]) -> Vec<u8> {
+        let mut v = id.to_vec();
+        v.extend((body.len() as u32).to_le_bytes());
+        v.extend(body);
+        if body.len() % 2 == 1 {
+            v.push(0);
+        }
+        v
+    }
+    let mut fmt = Vec::new();
+    fmt.extend(1u16.to_le_bytes());
+    fmt.extend(1u16.to_le_bytes());
+    fmt.extend(8000u32.to_le_bytes());
+    fmt.extend(16000u32.to_le_bytes());
+    fmt.extend(2u16.to_le_bytes());
+    fmt.extend(16u16.to_le_bytes());
+    let mut cue = (points.len() as u32).to_le_bytes().to_vec();
+    let mut adtl = b"adtl".to_vec();
+    for &(id, at, name) in points {
+        for v in [id, 0] {
+            cue.extend(v.to_le_bytes());
+        }
+        cue.extend(b"data");
+        for v in [0, 0, at] {
+            cue.extend(u32::to_le_bytes(v));
+        }
+        let mut labl = id.to_le_bytes().to_vec();
+        labl.extend(name.as_bytes());
+        labl.push(0);
+        adtl.extend(chunk(b"labl", &labl));
+    }
+    let mut body = b"WAVE".to_vec();
+    for c in [chunk(b"fmt ", &fmt), chunk(b"data", &[0; 16000]), chunk(b"cue ", &cue), chunk(b"LIST", &adtl)] {
+        body.extend(c);
+    }
+    let mut file = b"RIFF".to_vec();
+    file.extend((body.len() as u32).to_le_bytes());
+    file.extend(body);
+    file
+}
+
+/// A WAV's cue points become markers on the layer made from it, named as in the file, and
+/// Update Markers From Source brings back one that was deleted (through the fully wired session,
+/// media import included).
+#[test]
+fn a_wav_layer_starts_with_the_markers_in_its_file() {
+    let mut s = effectcraft_host::session();
+    s.execute_checked("comp.new", json!({"name": "C", "width": 64, "height": 48, "frameRate": 30, "duration": 2})).unwrap();
+    let dir = std::env::temp_dir().join(format!("effectcraft-host-wav-markers-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("cues.wav");
+    std::fs::write(&path, marker_wav(&[(1, 0, "Intro"), (2, 4000, "Middle")])).unwrap();
+    let r = s.execute_checked("file.import", json!({"paths": [path.to_string_lossy()], "addToComp": true})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let layer = s.active_comp().unwrap().layers.iter().find(|l| matches!(l.source, LayerSource::Footage { .. })).unwrap().id.0;
+    let list = s.execute_checked("markers.list", json!({"layer": layer})).unwrap();
+    let marks: Vec<(String, f64)> =
+        list.as_array().unwrap().iter().map(|m| (m["comment"].as_str().unwrap().to_string(), m["time"].as_f64().unwrap())).collect();
+    assert_eq!(marks, [("Intro".to_string(), 0.0), ("Middle".to_string(), 0.5)]);
+    s.execute_checked("markers.delete", json!({"layer": layer, "index": 0})).unwrap();
+    assert_eq!(names(&mut s, layer), ["Middle"]);
+    s.execute_checked("layer.select", json!({"layers": [layer]})).unwrap();
+    // The bound `layers` parameter (what a script or the menu's own binding passes) brings the marker back...
+    let r = s.execute_checked("layer.updateMarkersFromSource", json!({"layers": [layer]})).unwrap();
+    assert_eq!(r["added"], 1);
+    assert_eq!(names(&mut s, layer), ["Intro", "Middle"]);
+    // ...as one undo step: undo removes it again, redo restores it.
+    assert!(s.undo());
+    assert_eq!(names(&mut s, layer), ["Middle"]);
+    assert!(s.redo());
+    assert_eq!(names(&mut s, layer), ["Intro", "Middle"]);
+    // The selection route (no parameter) finds nothing more to add.
+    assert_eq!(s.execute_checked("layer.updateMarkersFromSource", json!({})).unwrap()["added"], 0);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Reload Footage re-reads the markers the file carries: a cue point added to the file after the
+/// import is available to Update Markers From Source (and a layer already made keeps its own).
+#[test]
+fn reloading_a_wav_picks_up_cue_points_added_to_the_file() {
+    let mut s = effectcraft_host::session();
+    s.execute_checked("comp.new", json!({"name": "C", "width": 64, "height": 48, "frameRate": 30, "duration": 2})).unwrap();
+    let dir = std::env::temp_dir().join(format!("effectcraft-host-wav-reload-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("cues.wav");
+    std::fs::write(&path, marker_wav(&[(1, 0, "Intro")])).unwrap();
+    let r = s.execute_checked("file.import", json!({"paths": [path.to_string_lossy()], "addToComp": true})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let (layer, item) = s
+        .active_comp()
+        .unwrap()
+        .layers
+        .iter()
+        .find_map(|l| match l.source {
+            LayerSource::Footage { item } => Some((l.id.0, item.0)),
+            _ => None,
+        })
+        .unwrap();
+    assert_eq!(names(&mut s, layer), ["Intro"]);
+    // The file gains a cue point; the layer does not change until asked.
+    std::fs::write(&path, marker_wav(&[(1, 0, "Intro"), (2, 4000, "Added later")])).unwrap();
+    let r = s.execute_checked("file.reloadFootage", json!({"items": [item]})).unwrap();
+    assert_eq!(r["reloaded"], 1, "{r}");
+    assert_eq!(names(&mut s, layer), ["Intro"]);
+    let r = s.execute_checked("layer.updateMarkersFromSource", json!({"layers": [layer]})).unwrap();
+    assert_eq!(r["added"], 1);
+    assert_eq!(names(&mut s, layer), ["Intro", "Added later"]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/host/tests/webm_metadata.rs b/crates/host/tests/it/webm_metadata.rs
similarity index 100%
rename from crates/host/tests/webm_metadata.rs
rename to crates/host/tests/it/webm_metadata.rs
diff --git a/crates/host/tests/plugins.rs b/crates/host/tests/plugins.rs
deleted file mode 100644
index 83891148d..000000000
--- a/crates/host/tests/plugins.rs
+++ /dev/null
@@ -1,161 +0,0 @@
-//! Effect plug-ins in a full session: a Rust plug-in registered through the trait and the
-//! example WebAssembly plug-in (examples/plugins/posterize-bands) loaded with
-//! `effect.plugins.load`, both applied by id like built-ins and rendered.
-
-use std::sync::Arc;
-
-use effectcraft_engine::Session;
-use effectcraft_engine::effects::plugin::{EffectPlugin, PluginFrame, PluginManifest, PluginParam, PluginParamKind, PluginParams, register_plugin};
-use effectcraft_engine::time::Tick;
-use serde_json::json;
-
-struct Swap {
-    m: PluginManifest,
-}
-
-impl EffectPlugin for Swap {
-    fn manifest(&self) -> &PluginManifest {
-        &self.m
-    }
-    fn render(&self, frame: &mut PluginFrame, params: &PluginParams, _time: f64) -> Result<(), String> {
-        if params.b("on") {
-            for p in frame.pixels.iter_mut() {
-                p.swap(0, 2);
-            }
-        }
-        Ok(())
-    }
-}
-
-fn setup() -> (Session, u64) {
-    let mut s = effectcraft_host::session();
-    s.execute("comp.new", json!({"name": "P", "width": 40, "height": 20, "duration": 1})).unwrap();
-    let l = s.execute("layer.newSolid", json!({"color": [1.0, 0.5, 0.0], "width": 40, "height": 20})).unwrap()["layer"].as_u64().unwrap();
-    (s, l)
-}
-
-fn px(s: &Session) -> [f32; 4] {
-    let cid = s.active_comp_id().unwrap();
-    s.render(cid, Tick::ZERO, Default::default()).get(20, 10)
-}
-
-#[test]
-fn rust_plugins_apply_by_id() {
-    let m = PluginManifest {
-        api: 1,
-        id: "org.test.swap".into(),
-        name: "Swap Red Blue".into(),
-        category: "Channel".into(),
-        version: "1".into(),
-        author: String::new(),
-        description: String::new(),
-        params: vec![PluginParam { id: "on".into(), name: "On".into(), kind: PluginParamKind::Checkbox { default: true } }],
-    };
-    register_plugin(Arc::new(Swap { m })).unwrap();
-    let (mut s, l) = setup();
-    s.execute("effect.apply", json!({"layer": l, "effect": "org.test.swap"})).unwrap();
-    let p = px(&s);
-    assert!(p[0] < 0.01 && (p[1] - 0.5).abs() < 0.01 && p[2] > 0.99, "{p:?}");
-    // Its parameters are ordinary properties: set (and animate) them like any effect's.
-    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/on", "value": false})).unwrap();
-    let p = px(&s);
-    assert!(p[0] > 0.99 && p[2] < 0.01, "{p:?}");
-    let list = s.execute("effect.plugins.list", json!({})).unwrap();
-    assert!(list["plugins"].as_array().unwrap().iter().any(|p| p["id"] == "org.test.swap" && p["category"] == "Channel"));
-    assert_eq!(list["api"], 1);
-    assert!(s.execute("effect.list", json!({"filter": "swap red"})).unwrap().as_array().unwrap().len() == 1);
-}
-
-/// Build the example plug-in (skipped when the wasm32 target isn't installed).
-fn build_example() -> Option<std::path::PathBuf> {
-    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../examples/plugins/posterize-bands");
-    let target = std::env::var_os("CARGO_TARGET_DIR").map(std::path::PathBuf::from).unwrap_or_else(|| root.join("../../../target")).join("plugin-example");
-    let target = if target.is_absolute() { target } else { root.join("../../..").join(target) };
-    let st = std::process::Command::new(env!("CARGO"))
-        .current_dir(&root)
-        .args(["build", "--release", "--target", "wasm32-unknown-unknown", "--target-dir"])
-        .arg(&target)
-        .status()
-        .ok()?;
-    if !st.success() {
-        eprintln!("skipping: the example plug-in didn't build (rustup target add wasm32-unknown-unknown)");
-        return None;
-    }
-    Some(target.join("wasm32-unknown-unknown/release/posterize_bands.wasm"))
-}
-
-#[test]
-fn example_wasm_plugin_loads_and_renders() {
-    let Some(wasm) = build_example() else { return };
-    let (mut s, l) = setup();
-    let r = s.execute("effect.plugins.load", json!({"path": wasm.to_string_lossy()})).unwrap();
-    assert_eq!(r["loaded"][0]["id"], "org.effectcraft.example.posterize-bands", "{r}");
-    s.execute("effect.apply", json!({"layer": l, "effect": "Posterize Bands"})).unwrap();
-    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/mix", "value": 0})).unwrap();
-    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/levels", "value": 2})).unwrap();
-    // Luminance of (1, .5, 0) is ~0.57: with 2 levels it bands to 1, scaling the colour by 1/y
-    // (8 bpc: red clips at 1).
-    let p = px(&s);
-    let y = 0.2126 + 0.7152 * 0.5;
-    assert!((p[1] - 0.5 / y as f32).abs() < 0.01 && p[0] > 0.99 && p[2] < 0.01, "{p:?}");
-    // Invert: band 0.
-    s.execute("prop.set", json!({"layer": l, "path": "effects/#1/invert", "value": true})).unwrap();
-    assert_eq!(px(&s)[..3], [0.0, 0.0, 0.0]);
-    let list = s.execute("effect.plugins.list", json!({})).unwrap();
-    assert!(list["plugins"].as_array().unwrap().iter().any(|p| p["source"].as_str().unwrap_or("").ends_with(".wasm")));
-}
-
-/// A parameterless plug-in module (WebAssembly text): `render` is `ec_render`'s body.
-fn wat_plugin(id: &str, api: i32, render: &str) -> String {
-    let manifest = format!(r#"{{"api":1,"id":"{id}","name":"Host {id}","category":"Test Plug-ins","version":"1","params":[]}}"#);
-    let len = manifest.len();
-    let escaped = manifest.replace('"', "\\\"");
-    format!(
-        r#"(module
-  (memory (export "memory") 2)
-  (data (i32.const 16) "{escaped}")
-  (func (export "ec_api_version") (result i32) i32.const {api})
-  (func (export "ec_manifest_ptr") (result i32) i32.const 16)
-  (func (export "ec_manifest_len") (result i32) i32.const {len})
-  (func (export "ec_alloc") (param i32) (result i32) i32.const 1024)
-  (func (export "ec_render") (param i32 i32 i32 i32 i32 f64 f64) (result i32) {render}))"#
-    )
-}
-
-#[test]
-fn plugin_loading_reports_bad_modules_and_survives_failing_renders() {
-    let dir = std::env::temp_dir().join(format!("effectcraft-host-plugins-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let files = [
-        ("a-good.wasm", wat_plugin("org.test.host.good", 1, "i32.const 0").into_bytes()),
-        ("b-garbage.wasm", b"\0asm\x01\0\0\0garbage".to_vec()),
-        ("c-v2.wasm", wat_plugin("org.test.host.v2", 2, "i32.const 0").into_bytes()),
-        ("d-empty.wasm", vec![]),
-        ("e-trap.wasm", wat_plugin("org.test.host.trap", 1, "unreachable").into_bytes()),
-        ("notes.txt", b"not a plug-in".to_vec()),
-    ];
-    for (name, bytes) in &files {
-        std::fs::write(dir.join(name), bytes).unwrap();
-    }
-    let (mut s, l) = setup();
-    let r = s.execute("effect.plugins.load", json!({"folder": dir.to_string_lossy()})).unwrap();
-    let ids: Vec<&str> = r["loaded"].as_array().unwrap().iter().filter_map(|v| v["id"].as_str()).collect();
-    assert_eq!(ids, ["org.test.host.good", "org.test.host.trap"], "{r}");
-    let errs: Vec<String> = r["errors"].as_array().unwrap().iter().map(|e| e["path"].as_str().unwrap().to_string()).collect();
-    assert_eq!(errs.len(), 3, "{r}");
-    assert!(errs.iter().all(|p| !p.ends_with(".txt")));
-    assert!(r["errors"].to_string().contains("API 2"), "{r}");
-    // A single file: errors come back as command errors; loading twice is refused.
-    let good = dir.join("a-good.wasm").to_string_lossy().to_string();
-    assert!(s.execute("effect.plugins.load", json!({"path": good})).unwrap_err().to_string().contains("already registered"));
-    assert!(s.execute("effect.plugins.load", json!({"path": dir.join("missing.wasm").to_string_lossy()})).is_err());
-    assert!(s.execute("effect.plugins.load", json!({"folder": dir.join("missing").to_string_lossy()})).is_err());
-    assert!(s.execute("effect.plugins.load", json!({})).is_err());
-    // A plug-in that traps on every frame leaves the layer as it was.
-    let before = px(&s);
-    s.execute("effect.apply", json!({"layer": l, "effect": "org.test.host.trap"})).unwrap();
-    assert_eq!(px(&s), before);
-    s.execute("effect.apply", json!({"layer": l, "effect": "org.test.host.good"})).unwrap();
-    assert_eq!(px(&s), before);
-    let _ = std::fs::remove_dir_all(&dir);
-}
diff --git a/crates/interchange/src/export.rs b/crates/interchange/src/export.rs
index 7da18913a..375c1bf1b 100644
--- a/crates/interchange/src/export.rs
+++ b/crates/interchange/src/export.rs
@@ -138,7 +138,7 @@ fn unsupported(project: &Project, comp: &Comp, l: &Layer, format: TimelineFormat
     if l.is_3d() {
         return Some("3D layer".into());
     }
-    if l.props.sub("layerStyles").is_some_and(|g| !g.children.is_empty()) {
+    if l.styles_change_pixels() {
         return Some("layer styles".into());
     }
     if l.props.get("timeRemap").is_some_and(|p| p.is_animated()) {
@@ -155,12 +155,7 @@ fn unsupported(project: &Project, comp: &Comp, l: &Layer, format: TimelineFormat
         return Some(format!("blend mode {}", l.blend_mode.label()));
     }
     // Premiere's Basic Motion in the interchange formats has one (uniform) scale.
-    if let Some(s) = l.transform().and_then(|t| t.get("scale"))
-        && std::iter::once(&s.value).chain(s.keys.iter().map(|k| &k.value)).any(|v| {
-            let a = v.as_vec3();
-            (a[0] - a[1]).abs() > 1e-9
-        })
-    {
+    if l.transform().and_then(|t| t.get("scale")).is_some_and(non_uniform_scale) {
         return Some("non-uniform scale".into());
     }
     if l.preserve_transparency {
@@ -581,10 +576,7 @@ impl Exporter<'_> {
             }
         }
         if let Some(p) = tr.get("scale") {
-            let uniform = std::iter::once(&p.value).chain(p.keys.iter().map(|k| &k.value)).all(|v| {
-                let a = v.as_vec3();
-                (a[0] - a[1]).abs() < 1e-9
-            });
+            let uniform = !non_uniform_scale(p);
             m.params.insert("scale".into(), param_out(p, &to_clip, |v| fp::ParamValue::Float(v.as_vec3()[1])));
             if !uniform {
                 m.params.insert("scale_width".into(), param_out(p, &to_clip, |v| fp::ParamValue::Float(v.as_vec3()[0])));
@@ -636,6 +628,16 @@ fn differs(v: &Value, def: [f64; 2]) -> bool {
     (a[0] - def[0]).abs() > 1e-6 || (a[1] - def[1]).abs() > 1e-6
 }
 
+/// Whether a scale property is non-uniform at some point: active key values, or the static
+/// value when every key is muted (muted keys are not exported, #1894).
+fn non_uniform_scale(p: &Property) -> bool {
+    let non_uniform = |v: &Value| {
+        let a = v.as_vec3();
+        (a[0] - a[1]).abs() > 1e-9
+    };
+    if p.keys.iter().any(|k| !k.muted) { p.keys.iter().filter(|k| !k.muted).any(|k| non_uniform(&k.value)) } else { non_uniform(&p.value) }
+}
+
 /// The clip's `id` effect, or a new instance of it (None if the registry has no such effect).
 fn effect_or_new(ti: &fp::TrackItem, id: &str) -> Option<fp::EffectInstance> {
     ti.effect(id).cloned().or_else(|| fp::find_effect(id).map(|e| e.instance()))
@@ -651,7 +653,9 @@ fn set_effect(ti: &mut fp::TrackItem, e: fp::EffectInstance) {
 /// A property → a FilmCraft parameter (layer-time keys → clip-time keys).
 fn param_out(p: &Property, to_clip: &impl Fn(Tick) -> filmcraft_time::Tick, conv: impl Fn(&Value) -> fp::ParamValue) -> fp::Param {
     let mut out = fp::Param::new(conv(&p.value));
-    for k in &p.keys {
+    // XML timelines have no mute state: leave muted keys out, as the Lottie exporter does, so
+    // the exported animation matches what the renderer shows (#1894).
+    for k in p.keys.iter().filter(|k| !k.muted) {
         let mut fk = fp::Keyframe::new(to_clip(k.time), conv(&k.value));
         fk.interp = match k.out_interp {
             Interp::Linear => fp::Interpolation::Linear,
@@ -684,8 +688,12 @@ fn media_info(name: &str, kind: MediaKind, duration: Tick, video: Option<VideoSp
             color: Default::default(),
             has_alpha,
             bitrate: None,
+            hdr: None,
         }),
-        audio: audio.then(|| AudioStreamInfo { sample_rate: 48_000, channels: 2, codec: "pcm".into(), bits_per_sample: Some(16) }),
+        audio_streams: audio
+            .then(|| AudioStreamInfo { sample_rate: 48_000, channels: 2, codec: "pcm".into(), bits_per_sample: Some(16) })
+            .into_iter()
+            .collect(),
         container: String::new(),
         start_timecode: None,
         file_size: None,
diff --git a/crates/interchange/src/import.rs b/crates/interchange/src/import.rs
index 55161b718..22e22b4f2 100644
--- a/crates/interchange/src/import.rs
+++ b/crates/interchange/src/import.rs
@@ -1,7 +1,7 @@
 //! Timeline documents → compositions (File ▸ Import ▸ Adobe Premiere Pro Project / Timeline
 //! Interchange…).
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 
 use effectcraft_color::{BlendMode, Label};
 use effectcraft_keyframe::{Keyframe, Value};
@@ -143,6 +143,11 @@ pub fn import(
     if depth > MAX_DEPTH {
         return Err(Error::TooDeep(MAX_DEPTH));
     }
+    // FilmCraft's parser expands internal entities without a node limit (#2129); Final Cut Pro
+    // and FCPXML exports never declare any.
+    if matches!(format, TimelineFormat::Fcp7Xml | TimelineFormat::Fcpxml) && bytes.windows(8).any(|w| w == b"<!ENTITY") {
+        return Err(Error::XmlEntities);
+    }
     let fc_opts = filmcraft_interchange::ImportOptions {
         base_dir: opts.base_dir.clone(),
         edl_frame_rate: opts.edl_frame_rate.map(|f| {
@@ -151,18 +156,119 @@ pub fn import(
         }),
         name: Some(opts.name.trim_end_matches(|c| c != '.').trim_end_matches('.').to_string()).filter(|s| !s.is_empty()),
     };
-    let (imported, report) = filmcraft_interchange::import_with(bytes, format.fc(), &fc_opts)?;
+    let (mut imported, report) = filmcraft_interchange::import_with(bytes, format.fc(), &fc_opts)?;
+    // Each file is probed once, though an EDL's media are probed before the layers are made.
+    let mut probed: HashMap<String, Option<Footage>> = HashMap::new();
+    // An EDL's guessed paths that leave the list's folder are not probed (see `guessed_outside`).
+    let outside = if format == TimelineFormat::Edl { guessed_outside(&imported.project, opts.base_dir.as_deref()) } else { HashSet::new() };
+    let mut probe_once = |path: &str| if outside.contains(path) { None } else { probed.entry(path.to_string()).or_insert_with(|| probe(path)).clone() };
+    let left_on_timecode = if format == TimelineFormat::Edl { rebase_to_file_timecode(&mut imported.project, &mut probe_once) } else { Vec::new() };
     let mut res = ImportResult { format: Some(format), ..Default::default() };
     for e in &report.entries {
+        // The reader's "rebase after probing" note is done above: name only the media it wasn't.
+        if format == TimelineFormat::Edl && e.message.starts_with(EDL_MEDIA_TIME_NOTE) {
+            if !left_on_timecode.is_empty() {
+                res.warnings
+                    .push(format!("EDL source timecodes stay media time for {}: the file is missing or has no start timecode", left_on_timecode.join(", ")));
+            }
+            continue;
+        }
         if e.count > 1 { res.warnings.push(format!("{} (×{})", e.message, e.count)) } else { res.warnings.push(e.message.clone()) }
     }
     let folder_name = if opts.name.is_empty() { "Imported Timeline".to_string() } else { opts.name.clone() };
     res.folder = project.add_item(&folder_name, Label::None, None, ItemKind::Folder);
-    let mut im = Importer { src: &imported.project, project, res, items: HashMap::new(), solids: HashMap::new(), solids_folder: None, bins: HashMap::new() };
-    im.run(&imported.sequences, probe);
+    let mut im = Importer {
+        src: &imported.project,
+        project,
+        res,
+        items: HashMap::new(),
+        solids: HashMap::new(),
+        solids_folder: None,
+        bins: HashMap::new(),
+        probe_offline: format == TimelineFormat::Edl,
+    };
+    im.run(&imported.sequences, &mut probe_once);
     Ok(im.res)
 }
 
+/// The start of the note FilmCraft's EDL reader adds when source timecodes look like real
+/// timecode (an hour or more) and it has kept them as media time.
+const EDL_MEDIA_TIME_NOTE: &str = "EDL source timecodes were imported as media time";
+
+/// An EDL's source times are its source timecodes, which FilmCraft's reader keeps as media time.
+/// The largest start timecode, in frames, a file may have: a day at 1000 fps.
+const MAX_FILE_TIMECODE: i64 = 24 * 3600 * 1000;
+
+/// The paths an EDL reader guessed (media it flags offline: a line without `SOURCE FILE` names
+/// only its clip) that are not inside the list's folder: a clip name of `../x.mov` or an absolute
+/// one would link a file elsewhere on the disk. They stay placeholders. A `SOURCE FILE` path is
+/// the list's own choice and is kept, also when another clip guesses the same path.
+fn guessed_outside(project: &fp::Project, base_dir: Option<&str>) -> HashSet<String> {
+    let inside = |path: &str| {
+        let p = std::path::Path::new(path);
+        let rest = match base_dir.filter(|b| !b.is_empty()) {
+            Some(b) => p.strip_prefix(b).ok(),
+            None => Some(p),
+        };
+        rest.is_some_and(|r| r.components().all(|c| matches!(c, std::path::Component::Normal(_))))
+    };
+    let (mut guessed, mut named) = (HashSet::new(), HashSet::new());
+    for it in project.items.values() {
+        if let fp::ItemKind::Media(m) = &it.kind
+            && let fp::MediaRef::File { path } = &m.media
+        {
+            if m.offline && !inside(path) {
+                guessed.insert(path.clone());
+            } else {
+                named.insert(path.clone());
+            }
+        }
+    }
+    guessed.retain(|p| !named.contains(p));
+    guessed
+}
+
+/// Put the clips of each file that has a start timecode on the file's own time, as FilmCraft does
+/// when it links the media of an imported EDL. Returns the names of the media that stay on
+/// timecode though their clips use an hour or more of it (the file is missing or has none).
+fn rebase_to_file_timecode(project: &mut fp::Project, probe: &mut dyn FnMut(&str) -> Option<Footage>) -> Vec<String> {
+    let mut on_timecode: HashSet<fp::ItemId> = HashSet::new();
+    for it in project.items.values() {
+        if let fp::ItemKind::Sequence(seq) = &it.kind {
+            // 01:00:00:00 as the list counts it: 01:00:00;00 drop-frame at 29.97 fps is 3599.996 s
+            let (rate, df) = (seq.settings.frame_rate, seq.settings.drop_frame);
+            let hour = rate.tick_of(filmcraft_time::fields_to_frames(1, 0, 0, 0, rate, df));
+            on_timecode.extend(seq.all_tracks().flat_map(|t| &t.items).filter(|ti| ti.source_in >= hour).map(|ti| ti.item));
+        }
+    }
+    let files: Vec<(fp::ItemId, String, String)> = project
+        .items
+        .values()
+        .filter_map(|it| match &it.kind {
+            fp::ItemKind::Media(m) => match &m.media {
+                fp::MediaRef::File { path } => Some((it.id, it.name.clone(), path.clone())),
+                _ => None,
+            },
+            _ => None,
+        })
+        .collect();
+    let mut left = Vec::new();
+    for (id, name, path) in files {
+        match probe(&path) {
+            // A corrupt timecode past a day of frames (at up to 1000 fps) would overflow the tick
+            // arithmetic; such a file stays on timecode.
+            Some(Footage { file_timecode: Some(tc), native_rate, frame_rate, .. }) if (0..=MAX_FILE_TIMECODE).contains(&tc) => {
+                filmcraft_interchange::rebase_source_timecode(project, id, tc, crate::rate_out(native_rate.unwrap_or(frame_rate)));
+            }
+            _ if on_timecode.contains(&id) => left.push(name),
+            _ => {}
+        }
+    }
+    left.sort();
+    left.dedup();
+    left
+}
+
 struct Importer<'a> {
     src: &'a fp::Project,
     project: &'a mut Project,
@@ -174,6 +280,11 @@ struct Importer<'a> {
     solids_folder: Option<ItemId>,
     /// Folder of each source item (from the bins).
     bins: HashMap<fp::ItemId, ItemId>,
+    /// Probe media the reader flags offline too. An EDL line without `SOURCE FILE` names its clip and
+    /// FilmCraft guesses the path beside the list; other readers flag media offline for other reasons
+    /// (an OTIO missing reference also gets a guessed path), and a same-named file there is not
+    /// the intended clip.
+    probe_offline: bool,
 }
 
 impl Importer<'_> {
@@ -246,7 +357,9 @@ impl Importer<'_> {
     }
 
     fn footage(&mut self, name: &str, path: &str, m: &fp::MediaClip, probe: &mut dyn FnMut(&str) -> Option<Footage>) -> Footage {
-        if !m.offline
+        // An EDL's offline media is probed: the clip is named and the file may sit beside the list.
+        // A path that is not there probes to nothing and stays a placeholder.
+        if (!m.offline || self.probe_offline)
             && let Some(mut f) = probe(path)
         {
             if let Some(r) = m.interpret.frame_rate
@@ -271,7 +384,7 @@ impl Importer<'_> {
             MediaKind::AudioOnly => FootageKind::Audio,
             MediaKind::Still => FootageKind::Still,
             MediaKind::ImageSequence => FootageKind::Sequence,
-            _ if v.is_none() && info.audio.is_some() => FootageKind::Audio,
+            _ if v.is_none() && info.has_audio() => FootageKind::Audio,
             _ => FootageKind::Video,
         };
         let _ = name;
@@ -284,7 +397,7 @@ impl Importer<'_> {
             frame_rate: rate_in(info.frame_rate()),
             duration: tick_in(info.duration),
             has_video: kind != FootageKind::Audio,
-            has_audio: info.audio.is_some() || kind == FootageKind::Audio,
+            has_audio: info.has_audio() || kind == FootageKind::Audio,
             alpha: if v.is_some_and(|v| v.has_alpha) { AlphaMode::Straight } else { AlphaMode::Ignore },
             codec: v.map(|v| v.codec.clone()).unwrap_or_default(),
             missing: true,
@@ -409,11 +522,31 @@ impl Importer<'_> {
         // ---- timing
         let start = tick_in(ti.start);
         let dur = tick_in(ti.duration);
-        let speed = if ti.speed.abs() < 1e-9 { 1.0 } else { ti.speed.abs() };
+        // A zero, tiny (below 1e-9) or non-finite speed plays at 100 %. Otherwise the layer's
+        // stretch (100 / speed) is held to the range the app supports (±1 % to ±9900 %): a speed
+        // of 1e300 or 1e-300 from a damaged file made the layer and audio time divide by ~0
+        // (#3247). The speed follows the stretch so the start time below matches it.
+        let raw = ti.speed.abs();
+        let (speed, stretch) = if !raw.is_finite() || raw < 1e-9 {
+            // A speed of exactly 0 keeps its old silent 100 %; a tiny or non-finite one is named.
+            if !raw.is_finite() || raw > 0.0 {
+                self.warn(format!("clip \"{}\": a speed of {} is not supported (100 % used)", ti.name, ti.speed));
+            }
+            (1.0, 100.0)
+        } else {
+            let stretch = effectcraft_project::limits::stretch(100.0 / raw);
+            if stretch.to_bits() == (100.0 / raw).to_bits() {
+                (raw, stretch)
+            } else {
+                let speed = 100.0 / stretch;
+                self.warn(format!("clip \"{}\": a speed of {:e} % is outside what a layer supports ({} % used)", ti.name, raw * 100.0, speed * 100.0));
+                (speed, stretch)
+            }
+        };
         let reverse = ti.reverse || ti.speed < 0.0;
         let src_in = tick_in(ti.source_in);
         let span = Tick((dur.0 as f64 * speed).round() as i64);
-        l.stretch = if reverse { -100.0 / speed } else { 100.0 / speed };
+        l.stretch = if reverse { -stretch } else { stretch };
         l.start_time =
             if reverse { start + Tick(((src_in + span).0 as f64 / speed).round() as i64) } else { start - Tick((src_in.0 as f64 / speed).round() as i64) };
         l.in_point = start;
diff --git a/crates/interchange/src/lib.rs b/crates/interchange/src/lib.rs
index 34d9aeab3..5b03403df 100644
--- a/crates/interchange/src/lib.rs
+++ b/crates/interchange/src/lib.rs
@@ -160,6 +160,8 @@ pub enum Error {
     NoComp(u64),
     #[error("the timeline document nests more than {0} levels deep")]
     TooDeep(usize),
+    #[error("the timeline document declares XML entities, which timeline files don't use and which can expand without bound")]
+    XmlEntities,
 }
 
 pub type Result<T> = std::result::Result<T, Error>;
diff --git a/crates/interchange/src/tests.rs b/crates/interchange/src/tests.rs
index 3ad7fcaae..b451ecf81 100644
--- a/crates/interchange/src/tests.rs
+++ b/crates/interchange/src/tests.rs
@@ -36,8 +36,12 @@ fn info(kind: filmcraft_media::MediaKind, video: bool, audio: bool) -> filmcraft
             color: Default::default(),
             has_alpha: false,
             bitrate: None,
+            hdr: None,
         }),
-        audio: audio.then(|| filmcraft_media::AudioStreamInfo { sample_rate: 48_000, channels: 2, codec: "pcm".into(), bits_per_sample: Some(16) }),
+        audio_streams: audio
+            .then(|| filmcraft_media::AudioStreamInfo { sample_rate: 48_000, channels: 2, codec: "pcm".into(), bits_per_sample: Some(16) })
+            .into_iter()
+            .collect(),
         container: String::new(),
         start_timecode: None,
         file_size: None,
@@ -310,6 +314,24 @@ fn imports_fcp7_xml_fcpxml_and_otio() {
     }
 }
 
+/// A clip speed past what a layer's stretch supports (±1 % to ±9900 %) is held to it and named.
+/// Before, a speed of 1e6 gave a stretch of 1e-4 % and the layer and audio time divided by ~0
+/// (#3247).
+#[test]
+fn an_extreme_clip_speed_is_held_to_the_stretch_range() {
+    for (speed, stretch) in [(1e6, 1.0), (1e-6, 9900.0)] {
+        let (mut doc, main) = edit();
+        doc.sequence_mut(main).unwrap().video_tracks[1].items[0].speed = speed;
+        let (bytes, _) = fc::export(&doc, main, fc::Format::Otio, &Default::default()).unwrap();
+        let (p, r) = import_doc(&bytes, "Main.otio", &mut probe);
+        let main_comp = r.comps.iter().copied().find(|c| p.item(*c).unwrap().name == "Main").expect("Main comp");
+        let c = p.comp(main_comp).unwrap();
+        let stretched: Vec<f64> = c.layers.iter().map(|l| l.stretch).filter(|s| (s - 100.0).abs() > 1e-9).collect();
+        assert_eq!(stretched, [stretch], "speed {speed}");
+        assert!(r.warnings.iter().any(|w| w.contains("speed") && w.contains("outside")), "speed {speed}: {:?}", r.warnings);
+    }
+}
+
 #[test]
 fn imports_aaf_and_omf() {
     let (doc, main) = edit();
@@ -361,6 +383,136 @@ fn edl_imports_one_track() {
     assert!(c.layers.len() >= 2);
 }
 
+/// An EDL's source timecodes are footage time once the file's own start timecode is known:
+/// 01:00:01:00 in a file that starts at 01:00:00:00 is one second in, not 3601 s.
+#[test]
+fn edl_source_timecode_lands_on_the_files_own_time() {
+    let edl = "TITLE: CUT\nFCM: NON-DROP FRAME\n\n001  A001     V     C        01:00:01:00 01:00:02:00 01:00:00:00 01:00:01:00\n* FROM CLIP NAME: a.mov\n* SOURCE FILE: /media/a.mov\n";
+    let mut probe_tc = |path: &str| probe(path).map(|f| Footage { file_timecode: Some(3600 * 25), ..f });
+    let mut p = Project::default();
+    let opts = ImportOptions { name: "cut.edl".into(), edl_frame_rate: Some(25.0), ..Default::default() };
+    let r = import(&mut p, edl.as_bytes(), None, &opts, &mut probe_tc).unwrap();
+    let c = p.comp(r.comps[0]).unwrap();
+    let l = layer(c, "a.mov");
+    assert!(near(l.layer_time(l.in_point), t(1.0)), "{}", l.layer_time(l.in_point).seconds());
+    assert!(near(l.start_time, t(-1.0)), "{}", l.start_time.seconds());
+    assert!(!r.warnings.iter().any(|w| w.contains("media time")), "the rebase is done: {:?}", r.warnings);
+}
+
+/// The reader's note to rebase after probing is replaced by the media that couldn't be rebased:
+/// a file with no start timecode and a missing file. Media cut from 00:00:00:00 needs no rebase.
+#[test]
+fn edl_media_left_on_timecode_is_named() {
+    let event = |n: u32, reel: &str, ch: &str, src: (&str, &str), rec: (&str, &str), file: &str| {
+        format!("{n:03}  {reel:<8} {ch:<5} C        {} {} {} {}\n* FROM CLIP NAME: {file}\n* SOURCE FILE: /media/{file}\n\n", src.0, src.1, rec.0, rec.1)
+    };
+    let edl = [
+        "TITLE: CUT\nFCM: NON-DROP FRAME\n\n".to_string(),
+        event(1, "A", "V", ("01:00:01:00", "01:00:02:00"), ("01:00:00:00", "01:00:01:00"), "a.mov"),
+        event(2, "B", "V", ("01:00:01:00", "01:00:02:00"), ("01:00:01:00", "01:00:02:00"), "b.mov"),
+        event(3, "C", "V", ("01:00:01:00", "01:00:02:00"), ("01:00:02:00", "01:00:03:00"), "c.mov"),
+        event(4, "D", "A", ("00:00:00:00", "00:00:03:00"), ("01:00:00:00", "01:00:03:00"), "d.wav"),
+    ]
+    .concat();
+    let mut probe_some = |path: &str| match path {
+        "/media/a.mov" => probe(path).map(|f| Footage { file_timecode: Some(3600 * 25), ..f }),
+        "/media/c.mov" => None,
+        _ => probe(path),
+    };
+    let mut p = Project::default();
+    let opts = ImportOptions { name: "cut.edl".into(), edl_frame_rate: Some(25.0), ..Default::default() };
+    let r = import(&mut p, edl.as_bytes(), None, &opts, &mut probe_some).unwrap();
+    let notes: Vec<&String> = r.warnings.iter().filter(|w| w.contains("media time")).collect();
+    assert_eq!(notes, ["EDL source timecodes stay media time for b.mov, c.mov: the file is missing or has no start timecode"], "{:?}", r.warnings);
+}
+
+/// An EDL line without `SOURCE FILE` only names its clip; the file beside the list is still found
+/// (the reader flags such media offline, but the guess is probed all the same).
+#[test]
+fn edl_clip_without_a_source_file_links_the_file_beside_the_list() {
+    let edl = "TITLE: CUT
+FCM: NON-DROP FRAME
+
+001  A002C003 V     C        10:00:31:00 10:00:33:00 02:00:00:00 02:00:02:00
+* FROM CLIP NAME: A002C003.mov
+
+002  A001C001 V     C        10:00:24:00 10:00:26:00 02:00:02:00 02:00:04:00
+* FROM CLIP NAME: A001C001.mov
+";
+    let mut probe_beside = |path: &str| (path == "/work/A002C003.mov").then(|| probe(path)).flatten();
+    let mut p = Project::default();
+    let opts = ImportOptions { name: "hand.edl".into(), edl_frame_rate: Some(25.0), base_dir: Some("/work".into()) };
+    let r = import(&mut p, edl.as_bytes(), None, &opts, &mut probe_beside).unwrap();
+    assert_eq!(r.missing, ["/work/A001C001.mov"], "only the file that is not there is missing");
+    let linked = p.items.values().find_map(|it| match &it.kind {
+        ItemKind::Footage(f) if f.path == "/work/A002C003.mov" => Some(f.missing),
+        _ => None,
+    });
+    assert_eq!(linked, Some(false));
+}
+
+/// A clip name that leaves the list's folder (`../x.mov`, an absolute path) is a guess too far:
+/// the file there is neither probed nor linked, and its timecode does not rebase the clip. A
+/// `SOURCE FILE` path outside the folder is the list's own choice and still links.
+#[test]
+fn edl_guessed_paths_outside_the_list_folder_are_not_probed() {
+    let edl = "TITLE: CUT
+FCM: NON-DROP FRAME
+
+001  A001 V     C        10:00:31:00 10:00:33:00 02:00:00:00 02:00:02:00
+* FROM CLIP NAME: ../up.mov
+
+002  A002 V     C        10:00:24:00 10:00:26:00 02:00:02:00 02:00:04:00
+* FROM CLIP NAME: /elsewhere/abs.mov
+
+003  A003 V     C        10:00:24:00 10:00:26:00 02:00:04:00 02:00:06:00
+* FROM CLIP NAME: inside.mov
+
+004  A004 V     C        10:00:24:00 10:00:26:00 02:00:06:00 02:00:08:00
+* FROM CLIP NAME: named.mov
+* SOURCE FILE: /elsewhere/named.mov
+";
+    let mut asked = Vec::new();
+    let mut probe_all = |path: &str| {
+        asked.push(path.to_string());
+        probe(path)
+    };
+    let mut p = Project::default();
+    let opts = ImportOptions { name: "hand.edl".into(), edl_frame_rate: Some(25.0), base_dir: Some("/work".into()) };
+    let r = import(&mut p, edl.as_bytes(), None, &opts, &mut probe_all).unwrap();
+    asked.sort();
+    assert_eq!(asked, ["/elsewhere/named.mov", "/work/inside.mov"], "only the file inside the folder and the named one");
+    let mut missing = r.missing.clone();
+    missing.sort();
+    assert_eq!(missing.len(), 2, "{missing:?}");
+    assert!(missing.iter().all(|m| m.ends_with("up.mov") || m.ends_with("abs.mov")), "{missing:?}");
+}
+
+/// Only an EDL's guessed paths are probed: an OTIO missing reference also gets a path built from
+/// the clip name, and a same-named file beside the document is not the intended clip.
+#[test]
+fn otio_missing_reference_stays_a_placeholder_even_with_a_file_of_that_name() {
+    let otio = r#"{"OTIO_SCHEMA":"Timeline.1","name":"t","global_start_time":null,"tracks":{"OTIO_SCHEMA":"Stack.1","name":"tracks","children":[{"OTIO_SCHEMA":"Track.1","name":"V1","kind":"Video","children":[{"OTIO_SCHEMA":"Clip.2","name":"a.mov","source_range":{"OTIO_SCHEMA":"TimeRange.1","start_time":{"OTIO_SCHEMA":"RationalTime.1","rate":25.0,"value":0.0},"duration":{"OTIO_SCHEMA":"RationalTime.1","rate":25.0,"value":50.0}},"media_references":{"DEFAULT_MEDIA":{"OTIO_SCHEMA":"MissingReference.1","name":"","available_range":null}},"active_media_reference_key":"DEFAULT_MEDIA"}]}]}}"#;
+    let mut p = Project::default();
+    let opts = ImportOptions { name: "t.otio".into(), edl_frame_rate: None, base_dir: Some("/work".into()) };
+    let mut probe_any = |path: &str| probe(path);
+    let r = import(&mut p, otio.as_bytes(), None, &opts, &mut probe_any).unwrap();
+    assert_eq!(r.format, Some(TimelineFormat::Otio));
+    assert!(!r.missing.is_empty(), "the missing reference stays a placeholder: {:?}", r.warnings);
+}
+
+/// A drop-frame list counts its hour in timecode: a clip cut at 01:00:00;00 (3599.996 s at 29.97
+/// fps) from a missing file is still named.
+#[test]
+fn edl_drop_frame_media_left_on_timecode_is_named() {
+    let edl = "TITLE: CUT\nFCM: DROP FRAME\n\n001  C        V     C        01:00:00;00 01:00:01;00 01:00:00;00 01:00:01;00\n* FROM CLIP NAME: c.mov\n* SOURCE FILE: /media/c.mov\n";
+    let mut p = Project::default();
+    let opts = ImportOptions { name: "cut.edl".into(), edl_frame_rate: Some(29.97), ..Default::default() };
+    let r = import(&mut p, edl.as_bytes(), None, &opts, &mut |_: &str| None).unwrap();
+    let notes: Vec<&String> = r.warnings.iter().filter(|w| w.contains("media time")).collect();
+    assert_eq!(notes, ["EDL source timecodes stay media time for c.mov: the file is missing or has no start timecode"], "{:?}", r.warnings);
+}
+
 #[test]
 fn rejects_unknown_documents() {
     let mut p = Project::default();
@@ -411,7 +563,7 @@ fn ae_project() -> (Project, ItemId) {
     let mut ls = effectcraft_project::build::layer(&mut p, &c, "tone", LayerSource::Footage { item: s }, (0, 0), None);
     ls.out_point = t(3.0);
     ls.props.prop_mut("audio/levels").unwrap().value = Value::Vec2([-3.0, -3.0]);
-    c.layers = vec![lt, lp, la, ls];
+    c.layers = vec![lt, lp, la, ls].into();
     let cid = comp_item(&mut p, "Main", c);
     (p, cid)
 }
@@ -429,6 +581,36 @@ fn plan_prerenders_rendered_only_layers() {
     assert!(plan_prerender(&p, cid, &ExportOptions { prerender: PrerenderMode::None, ..Default::default() }).is_empty());
 }
 
+/// A Layer Styles group that doesn't change the picture (Blending Options at their defaults, or
+/// every style switched off) keeps a clip a clip; Fill Opacity or a style that is on pre-renders it.
+#[test]
+fn only_layer_styles_that_change_pixels_prerender() {
+    use effectcraft_project::styles::{self as st, GROUP};
+    let opts = ExportOptions::default();
+    let reason = |edit: &dyn Fn(&mut Project, &mut Layer)| {
+        let (mut p, cid) = ae_project();
+        let c = p.comp(cid).unwrap();
+        let gl = c.global_light.clone();
+        let mut l = c.layers.iter().find(|l| l.name == "clip a").unwrap().clone();
+        st::add_blending_options(&mut l, &mut effectcraft_project::build::Ids(&mut p.next_id), &gl).unwrap();
+        edit(&mut p, &mut l);
+        let lid = l.id;
+        *p.comp_mut(cid).unwrap().layers.iter_mut().find(|x| x.id == lid).unwrap() = l;
+        prerender_reason(&p, cid, lid, &opts)
+    };
+    let fill = |l: &mut Layer, v: f64| l.props.prop_mut(&format!("{GROUP}/blendingOptions/advancedBlending/fillOpacity")).unwrap().value = Value::Scalar(v);
+    assert_eq!(reason(&|_, _| {}), None, "Blending Options at their defaults");
+    assert_eq!(reason(&|_, l| fill(l, 40.0)).as_deref(), Some("layer styles"));
+    let style = |on: bool| {
+        move |p: &mut Project, l: &mut Layer| {
+            let gl = effectcraft_project::styles::GlobalLight::default();
+            st::add_style(l, &mut effectcraft_project::build::Ids(&mut p.next_id), "dropShadow", &gl, on).unwrap();
+        }
+    };
+    assert_eq!(reason(&style(false)), None, "a style switched off");
+    assert_eq!(reason(&style(true)).as_deref(), Some("layer styles"));
+}
+
 #[test]
 fn export_then_reimport_keeps_the_timeline() {
     let (p, cid) = ae_project();
@@ -480,6 +662,59 @@ fn tr_orig(l: &Layer) -> &effectcraft_project::Property {
     l.transform().unwrap().get("position").unwrap()
 }
 
+/// #1894: XML timelines have no mute state, so a muted key must not be written as a keyframe
+/// (the export would otherwise animate through it).
+#[test]
+fn export_skips_muted_keyframes() {
+    let mut p = Project::default();
+    let a = footage_item(&mut p, "/media/a.mov");
+    let mut c = Comp::new(W, H, FrameRate::new(25, 1), t(4.0));
+    let mut l = effectcraft_project::build::layer(&mut p, &c, "clip", LayerSource::Footage { item: a }, (W, H), None);
+    {
+        let pos = l.transform_mut().unwrap().get_mut("position").unwrap();
+        pos.keys = vec![
+            Keyframe::new(t(0.0), Value::Vec3([100.0, 120.0, 0.0])),
+            Keyframe::new(t(1.0), Value::Vec3([500.0, 240.0, 0.0])),
+            Keyframe::new(t(2.0), Value::Vec3([300.0, 60.0, 0.0])),
+        ];
+        pos.keys[1].muted = true;
+    }
+    c.layers.push(l);
+    let cid = comp_item(&mut p, "Main", c);
+    let out = export(&p, cid, &ExportOptions { format: TimelineFormat::Fcp7Xml, ..Default::default() }, &HashMap::new()).unwrap();
+    let (q, r) = import_doc(&out.bytes, "Main.xml", &mut probe);
+    let main = r.comps.iter().copied().find(|c| q.item(*c).unwrap().name == "Main").expect("Main");
+    let pos = layer(q.comp(main).unwrap(), "clip").transform().unwrap().get("position").unwrap();
+    assert_eq!(pos.keys.len(), 2, "the muted key was exported");
+    assert_eq!(pos.keys[0].value.as_vec3()[0], 100.0);
+    assert_eq!(pos.keys[1].value.as_vec3()[0], 300.0);
+}
+
+/// #1894: a muted non-uniform scale key must not force a uniform layer to pre-render; only the
+/// active keys matter, and the static value when every key is muted.
+#[test]
+fn muted_non_uniform_scale_does_not_force_prerendering() {
+    let mut p = Project::default();
+    let a = footage_item(&mut p, "/media/a.mov");
+    let mut c = Comp::new(W, H, FrameRate::new(25, 1), t(2.0));
+    let mut l = effectcraft_project::build::layer(&mut p, &c, "clip", LayerSource::Footage { item: a }, (W, H), None);
+    {
+        let scale = l.transform_mut().unwrap().get_mut("scale").unwrap();
+        scale.keys = vec![Keyframe::new(t(0.0), Value::Vec3([100.0, 100.0, 100.0])), Keyframe::new(t(1.0), Value::Vec3([50.0, 200.0, 100.0]))];
+        scale.keys[1].muted = true;
+    }
+    let lid = l.id;
+    c.layers.push(l);
+    let cid = comp_item(&mut p, "Main", c);
+    assert_eq!(prerender_reason(&p, cid, lid, &ExportOptions::default()), None);
+    // With every key muted the static value drives evaluation, so a non-uniform static scale
+    // still takes the flattened path.
+    let scale = p.comp_mut(cid).unwrap().layer_mut(lid).unwrap().transform_mut().unwrap().get_mut("scale").unwrap();
+    scale.keys[0].muted = true;
+    scale.value = Value::Vec3([50.0, 200.0, 100.0]);
+    assert_eq!(prerender_reason(&p, cid, lid, &ExportOptions::default()).as_deref(), Some("non-uniform scale"));
+}
+
 #[test]
 fn export_without_prerender_leaves_text_out() {
     let (p, cid) = ae_project();
@@ -520,6 +755,21 @@ fn export_survives_a_precomp_layer_pointing_at_a_non_comp() {
     assert!(matches!(export(&p, footage, &ExportOptions::default(), &HashMap::new()), Err(Error::NoComp(_))));
 }
 
+#[test]
+fn xml_timelines_declaring_entities_are_refused() {
+    // #2129: the timeline parser expands internal entities without a node limit.
+    let dtd = "<!DOCTYPE x [<!ENTITY a \"aaaaaaaaaa\"><!ENTITY b \"&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;\">]>";
+    let docs = [
+        (TimelineFormat::Fcp7Xml, format!("<?xml version=\"1.0\"?>{dtd}<xmeml version=\"5\">&b;</xmeml>")),
+        (TimelineFormat::Fcpxml, format!("<?xml version=\"1.0\"?>{dtd}<fcpxml version=\"1.9\">&b;</fcpxml>")),
+    ];
+    for (format, doc) in docs {
+        let mut p = Project::default();
+        let r = import(&mut p, doc.as_bytes(), Some(format), &ImportOptions::default(), &mut |_| None);
+        assert!(matches!(r, Err(Error::XmlEntities)), "{format:?}");
+    }
+}
+
 #[test]
 fn deeply_nested_documents_error_instead_of_overflowing_the_stack() {
     // A few hundred kilobytes nested 100 000 levels deep overflowed the parsers' stack.
diff --git a/crates/keyframe/src/lib.rs b/crates/keyframe/src/lib.rs
index e0ee137ba..0998790a1 100644
--- a/crates/keyframe/src/lib.rs
+++ b/crates/keyframe/src/lib.rs
@@ -15,7 +15,8 @@ pub mod value;
 
 use effectcraft_time::{TICKS_PER_SECOND, Tick};
 use serde::{Deserialize, Serialize};
-pub use text_doc::{BaselineOption, CharStyle, Composer, Direction, FigureStyle, FigureWidth, Kerning, OpenType, ParaStyle, StyleRun};
+use std::borrow::Borrow;
+pub use text_doc::{BaselineOption, CharStyle, Composer, Direction, FigureStyle, FigureWidth, Kerning, LineJoin, OpenType, ParaStyle, StyleRun};
 pub use value::{FeatherPoint, Gradient, Justify, ShapePath, TextDoc, Value};
 
 /// Temporal interpolation on one side of a keyframe.
@@ -56,6 +57,12 @@ impl Ease {
     pub const EASY: Ease = Ease { speed: 0.0, influence: 1.0 / 3.0 };
 }
 
+/// Influence of a linear key side in a segment whose other side is eased: the side keeps the
+/// segment's average speed with a 16.67 % influence, as After Effects shows it in the Keyframe
+/// Velocity dialog and evaluates it (time-remap read-backs: a bezier-out (speed 0, 50 %) into a
+/// linear-in from 3.5 to 0.5 over 2 s gives 3.290 at a quarter and 2.657 at half of the segment).
+pub const LINEAR_SIDE_INFLUENCE: f64 = 1.0 / 6.0;
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Keyframe {
     pub time: Tick,
@@ -89,12 +96,19 @@ pub struct Keyframe {
     /// Keyframe color label: index into the label list (0 = None).
     #[serde(default, skip_serializing_if = "is_zero")]
     pub label: u8,
+    /// Muted keys stay in the list (and the UI) but evaluation skips them.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub muted: bool,
 }
 
 fn is_zero(v: &u8) -> bool {
     *v == 0
 }
 
+fn is_false(v: &bool) -> bool {
+    !*v
+}
+
 fn yes() -> bool {
     true
 }
@@ -116,6 +130,7 @@ impl Keyframe {
             spatial_continuous: false,
             roving: false,
             label: 0,
+            muted: false,
         }
     }
     pub fn hold(mut self) -> Keyframe {
@@ -320,19 +335,29 @@ fn v3(v: &Value) -> [f64; 3] {
 /// tangent is a sixth of the way from the previous key to the next, the in tangent its mirror, and
 /// key times play no part. An end key uses its one neighbour, so the path leaves the first key
 /// and enters the last one toward the neighbouring key instead of with no tangent.
-fn auto_spatial(keys: &[Keyframe], i: usize) -> ([f64; 3], [f64; 3]) {
+fn auto_spatial<K: Borrow<Keyframe>>(keys: &[K], i: usize) -> ([f64; 3], [f64; 3]) {
     if i >= keys.len() || keys.len() < 2 {
         return ([0.0; 3], [0.0; 3]);
     }
-    let a = v3(&keys[i.saturating_sub(1)].value);
-    let c = v3(&keys[(i + 1).min(keys.len() - 1)].value);
+    let a = v3(&keys[i.saturating_sub(1)].borrow().value);
+    let c = v3(&keys[(i + 1).min(keys.len() - 1)].borrow().value);
     let tout = [(c[0] - a[0]) / 6.0, (c[1] - a[1]) / 6.0, (c[2] - a[2]) / 6.0];
-    ([-tout[0], -tout[1], -tout[2]], tout)
+    // A side facing a key at the same position gets no tangent, so the segment between two
+    // identical keys has zero length and the layer holds still (#1675).
+    let p = v3(&keys[i].borrow().value);
+    let tin = if i > 0 && a == p { [0.0; 3] } else { [-tout[0], -tout[1], -tout[2]] };
+    let tout = if i + 1 < keys.len() && c == p { [0.0; 3] } else { tout };
+    (tin, tout)
 }
 
 /// Effective spatial tangents of key `i` (auto or stored).
 pub fn spatial_tangents(keys: &[Keyframe], i: usize) -> ([f64; 3], [f64; 3]) {
-    let Some(key) = keys.get(i) else { return ([0.0; 3], [0.0; 3]) };
+    tangents_of(keys, i)
+}
+
+/// [`spatial_tangents`] over stored keys or a filtered list of them (see [`evaluate`]).
+fn tangents_of<K: Borrow<Keyframe>>(keys: &[K], i: usize) -> ([f64; 3], [f64; 3]) {
+    let Some(key) = keys.get(i).map(Borrow::borrow) else { return ([0.0; 3], [0.0; 3]) };
     if key.spatial_auto { auto_spatial(keys, i) } else { (key.spatial_in, key.spatial_out) }
 }
 
@@ -368,18 +393,18 @@ pub fn spatial_handles(keys: &[Keyframe], i: usize) -> ([f64; 3], [f64; 3]) {
 }
 
 /// Effective temporal ease of key `i` for dimension `d` (auto-Bezier keys get the neighbour slope).
-fn effective_ease(keys: &[Keyframe], i: usize, d: usize, spatial: bool, out: bool) -> Ease {
-    let k = &keys[i];
+fn effective_ease<K: Borrow<Keyframe>>(keys: &[K], i: usize, d: usize, spatial: bool, out: bool) -> Ease {
+    let k = keys[i].borrow();
     let list = if out { &k.out_ease } else { &k.in_ease };
     if k.auto_bezier && i > 0 && i + 1 < keys.len() {
-        let dt = secs(keys[i + 1].time) - secs(keys[i - 1].time);
+        let dt = secs(keys[i + 1].borrow().time) - secs(keys[i - 1].borrow().time);
         let slope = if spatial {
-            let a = v3(&keys[i - 1].value);
-            let c = v3(&keys[i + 1].value);
+            let a = v3(&keys[i - 1].borrow().value);
+            let c = v3(&keys[i + 1].borrow().value);
             ((c[0] - a[0]).powi(2) + (c[1] - a[1]).powi(2) + (c[2] - a[2]).powi(2)).sqrt() / dt.max(1e-12)
         } else {
-            let a = keys[i - 1].value.components();
-            let c = keys[i + 1].value.components();
+            let a = keys[i - 1].borrow().value.components();
+            let c = keys[i + 1].borrow().value.components();
             (c.get(d).unwrap_or(&0.0) - a.get(d).unwrap_or(&0.0)) / dt.max(1e-12)
         };
         return Ease { speed: slope, influence: 1.0 / 6.0 };
@@ -389,7 +414,7 @@ fn effective_ease(keys: &[Keyframe], i: usize, d: usize, spatial: bool, out: boo
 
 /// The ease a key side presents in the Graph Editor and the Keyframe Velocity dialog: stored
 /// Bezier eases, auto-Bezier slopes, or the equivalent of a linear side (speed of the straight
-/// segment, 33.3 % influence). `None` for hold sides and sides without a neighbour.
+/// segment, [`LINEAR_SIDE_INFLUENCE`]). `None` for hold sides and sides without a neighbour.
 pub fn side_ease(keys: &[Keyframe], i: usize, d: usize, spatial: bool, out: bool) -> Option<Ease> {
     let k = keys.get(i)?;
     let j = if out { i + 1 } else { i.checked_sub(1)? };
@@ -410,7 +435,7 @@ pub fn side_ease(keys: &[Keyframe], i: usize, d: usize, spatial: bool, out: bool
             let dv = b.get(d).unwrap_or(&0.0) - a.get(d).unwrap_or(&0.0);
             if out { dv } else { -dv }
         };
-        return Some(Ease { speed: dv / dur, influence: 1.0 / 3.0 });
+        return Some(Ease { speed: dv / dur, influence: LINEAR_SIDE_INFLUENCE });
     }
     Some(effective_ease(keys, i, if is_spatial { 0 } else { d }, is_spatial, out))
 }
@@ -503,7 +528,35 @@ pub fn time_reverse(keys: &mut [Keyframe]) {
 }
 
 /// Evaluate a keyframed property at `t`. `spatial` selects motion-path semantics for 2D/3D values.
+/// Muted keys are skipped, so the active neighbours interpolate as if they were not there; `None`
+/// means every key is muted (the property's static value applies).
 pub fn evaluate(keys: &[Keyframe], t: Tick, spatial: bool) -> Option<Value> {
+    if !keys.iter().any(|k| k.muted) {
+        return evaluate_active(keys, t, spatial);
+    }
+    // Muting is rare: skip the muted keys by reference rather than copying every key and value.
+    let active: Vec<&Keyframe> = keys.iter().filter(|k| !k.muted).collect();
+    evaluate_active(&active, t, spatial)
+}
+
+fn evaluate_active<K: Borrow<Keyframe>>(keys: &[K], t: Tick, spatial: bool) -> Option<Value> {
+    let first = keys.first()?.borrow();
+    if keys.len() == 1 || t <= first.time {
+        return Some(first.value.clone());
+    }
+    let last = keys.last()?.borrow();
+    if t >= last.time {
+        return Some(last.value.clone());
+    }
+    let i = keys.partition_point(|k| k.borrow().time <= t) - 1;
+    Some(segment_value_of(keys, i, t, spatial))
+}
+
+/// Evaluate keyed 3D Orientation at `t` as After Effects does: the temporal ease gives the
+/// progress through each segment, and the rotation moves along the shortest arc between the two
+/// keys ([`effectcraft_geom::orientation_slerp`]) instead of blending each angle. Speeds are
+/// degrees per second along that arc. Values other than 3D vectors evaluate as [`evaluate`].
+pub fn evaluate_orientation(keys: &[Keyframe], t: Tick) -> Option<Value> {
     let first = keys.first()?;
     if keys.len() == 1 || t <= first.time {
         return Some(first.value.clone());
@@ -512,14 +565,59 @@ pub fn evaluate(keys: &[Keyframe], t: Tick, spatial: bool) -> Option<Value> {
     if t >= last.time {
         return Some(last.value.clone());
     }
-    let i = keys.partition_point(|k| k.time <= t) - 1;
-    Some(segment_value(keys, i, t, spatial))
+    let i = keys.partition_point(|k| k.time <= t).checked_sub(1)?;
+    let (a, b) = (keys.get(i)?, keys.get(i + 1)?);
+    let (Value::Vec3(va), Value::Vec3(vb)) = (&a.value, &b.value) else { return Some(segment_value(keys, i, t, false)) };
+    if a.out_interp == Interp::Hold {
+        return Some(a.value.clone());
+    }
+    let (t0, t1) = (secs(a.time), secs(b.time));
+    let dur = (t1 - t0).max(1e-12);
+    let x = ((secs(t) - t0) / dur).clamp(0.0, 1.0);
+    // On a key: its own value, as stored.
+    if x <= 0.0 {
+        return Some(a.value.clone());
+    }
+    let arc = effectcraft_geom::orientation_arc_deg((*va).into(), (*vb).into());
+    let lin_out = a.out_interp == Interp::Linear;
+    let lin_in = b.in_interp != Interp::Bezier;
+    let f = if lin_out && lin_in || arc <= 1e-9 {
+        x
+    } else {
+        // Auto-Bezier keys take the arc speed between their neighbours.
+        let side = |j: usize, out: bool| -> Ease {
+            // A linear side keeps the segment's average speed at the same influence as in
+            // `segment_value` (and a missing key, unreachable here, is treated as one).
+            let Some(k) = keys.get(j) else { return Ease { speed: arc / dur, influence: LINEAR_SIDE_INFLUENCE } };
+            let linear = if out { lin_out } else { lin_in };
+            if linear {
+                return Ease { speed: arc / dur, influence: LINEAR_SIDE_INFLUENCE };
+            }
+            if k.auto_bezier && j > 0 && j + 1 < keys.len() {
+                let span = (secs(keys[j + 1].time) - secs(keys[j - 1].time)).max(1e-12);
+                let (Value::Vec3(p), Value::Vec3(n)) = (&keys[j - 1].value, &keys[j + 1].value) else { return Ease { speed: arc / dur, influence: 1.0 / 6.0 } };
+                return Ease { speed: effectcraft_geom::orientation_arc_deg((*p).into(), (*n).into()) / span, influence: 1.0 / 6.0 };
+            }
+            let list = if out { &k.out_ease } else { &k.in_ease };
+            list.first().copied().unwrap_or_default()
+        };
+        let (eo, ei) = (side(i, true), side(i + 1, false));
+        ease_progress(eo.speed * dur / arc, eo.influence, ei.speed * dur / arc, ei.influence, x)
+    };
+    let f = if f.is_finite() { f } else { x };
+    let o = effectcraft_geom::orientation_slerp((*va).into(), (*vb).into(), f);
+    Some(Value::Vec3([o.x, o.y, o.z]))
 }
 
 /// Value inside segment `i` → `i+1` at time `t`.
 pub fn segment_value(keys: &[Keyframe], i: usize, t: Tick, spatial: bool) -> Value {
-    let a = &keys[i];
-    let b = &keys[i + 1];
+    segment_value_of(keys, i, t, spatial)
+}
+
+/// [`segment_value`] over stored keys or a filtered list of them (see [`evaluate`]).
+fn segment_value_of<K: Borrow<Keyframe>>(keys: &[K], i: usize, t: Tick, spatial: bool) -> Value {
+    let a = keys[i].borrow();
+    let b = keys[i + 1].borrow();
     if a.out_interp == Interp::Hold || !a.value.interpolates() {
         return a.value.clone();
     }
@@ -534,15 +632,15 @@ pub fn segment_value(keys: &[Keyframe], i: usize, t: Tick, spatial: bool) -> Val
     if is_spatial {
         let p0 = v3(&a.value);
         let p3 = v3(&b.value);
-        let (_, out_t) = spatial_tangents(keys, i);
-        let (in_t, _) = spatial_tangents(keys, i + 1);
+        let (_, out_t) = tangents_of(keys, i);
+        let (in_t, _) = tangents_of(keys, i + 1);
         let seg = SpatialSeg::new([p0, [p0[0] + out_t[0], p0[1] + out_t[1], p0[2] + out_t[2]], [p3[0] + in_t[0], p3[1] + in_t[1], p3[2] + in_t[2]], p3]);
         let len = seg.length();
         let f = if lin_out && lin_in || len <= 1e-12 {
             x
         } else {
-            let eo = if lin_out { Ease { speed: len / dur, influence: 1.0 / 3.0 } } else { effective_ease(keys, i, 0, true, true) };
-            let ei = if lin_in { Ease { speed: len / dur, influence: 1.0 / 3.0 } } else { effective_ease(keys, i + 1, 0, true, false) };
+            let eo = if lin_out { Ease { speed: len / dur, influence: LINEAR_SIDE_INFLUENCE } } else { effective_ease(keys, i, 0, true, true) };
+            let ei = if lin_in { Ease { speed: len / dur, influence: LINEAR_SIDE_INFLUENCE } } else { effective_ease(keys, i + 1, 0, true, false) };
             ease_progress(eo.speed * dur / len, eo.influence, ei.speed * dur / len, ei.influence, x)
         };
         // A straight path (both handles on the chord, as auto-Bezier keys on a line have) is the
@@ -561,16 +659,16 @@ pub fn segment_value(keys: &[Keyframe], i: usize, t: Tick, spatial: bool) -> Val
     let cb = b.value.components();
     if ca.is_empty() || ca.len() != cb.len() {
         // Paths, gradients: ease on dimension 0 as overall progress.
-        let eo = if lin_out { Ease { speed: 1.0 / dur, influence: 1.0 / 3.0 } } else { effective_ease(keys, i, 0, false, true) };
-        let ei = if lin_in { Ease { speed: 1.0 / dur, influence: 1.0 / 3.0 } } else { effective_ease(keys, i + 1, 0, false, false) };
+        let eo = if lin_out { Ease { speed: 1.0 / dur, influence: LINEAR_SIDE_INFLUENCE } } else { effective_ease(keys, i, 0, false, true) };
+        let ei = if lin_in { Ease { speed: 1.0 / dur, influence: LINEAR_SIDE_INFLUENCE } } else { effective_ease(keys, i + 1, 0, false, false) };
         let f = ease_progress(eo.speed * dur, eo.influence, ei.speed * dur, ei.influence, x);
         return a.value.lerp(&b.value, f);
     }
     let mut out = Vec::with_capacity(ca.len());
     for d in 0..ca.len() {
         let dv = cb[d] - ca[d];
-        let eo = if lin_out { Ease { speed: dv / dur, influence: 1.0 / 3.0 } } else { effective_ease(keys, i, d, false, true) };
-        let ei = if lin_in { Ease { speed: dv / dur, influence: 1.0 / 3.0 } } else { effective_ease(keys, i + 1, d, false, false) };
+        let eo = if lin_out { Ease { speed: dv / dur, influence: LINEAR_SIDE_INFLUENCE } } else { effective_ease(keys, i, d, false, true) };
+        let ei = if lin_in { Ease { speed: dv / dur, influence: LINEAR_SIDE_INFLUENCE } } else { effective_ease(keys, i + 1, d, false, false) };
         // Bezier in (time, value) space directly: P1 = (i0, v0 + s0*i0*dur), P2 = (1-i1, v1 - s1*i1*dur).
         let (i0, i1) = (eo.influence.clamp(0.0, 1.0), ei.influence.clamp(0.0, 1.0));
         let u = solve_u(0.0, i0, 1.0 - i1, 1.0, x);
@@ -612,6 +710,7 @@ pub fn set_key(keys: &mut Vec<Keyframe>, key: Keyframe) -> usize {
             k.spatial_continuous = old.spatial_continuous;
             k.roving = old.roving;
             k.label = old.label;
+            k.muted = old.muted;
             keys[i] = k;
             i
         }
@@ -642,382 +741,4 @@ pub fn easy_ease(k: &mut Keyframe, ease_in: bool, ease_out: bool) {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn s(x: f64) -> Tick {
-        Tick::from_seconds_f64(x)
-    }
-
-    #[test]
-    fn missing_spatial_keys_have_no_tangents_or_length() {
-        let keys = vec![Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0]))];
-        for i in [1, usize::MAX] {
-            assert_eq!(spatial_tangents(&keys, i), ([0.0; 3], [0.0; 3]));
-            assert_eq!(spatial_segment_length(&keys, i), 0.0);
-        }
-        assert_eq!(spatial_tangents(&[], 0), ([0.0; 3], [0.0; 3]));
-        assert_eq!(spatial_segment_length(&[], usize::MAX), 0.0);
-    }
-
-    #[test]
-    fn time_reverse_handles_deserialized_tick_extremes() {
-        // Tick's public serde representation can contain values beyond from_seconds_f64's cap.
-        for (first, last) in [(i64::MIN, i64::MIN + 10), (i64::MAX - 10, i64::MAX), (i64::MIN, i64::MAX)] {
-            let mut keys = vec![Keyframe::new(Tick(first), Value::Scalar(1.0)), Keyframe::new(Tick(last), Value::Scalar(2.0))];
-            time_reverse(&mut keys);
-            assert_eq!(keys[0].time, Tick(first));
-            assert_eq!(keys[0].value, Value::Scalar(2.0));
-            assert_eq!(keys[1].time, Tick(last));
-            assert_eq!(keys[1].value, Value::Scalar(1.0));
-            time_reverse(&mut keys);
-            assert_eq!(keys[0].value, Value::Scalar(1.0));
-        }
-    }
-
-    #[test]
-    fn roving_handles_deserialized_tick_extremes() {
-        let mut keys = vec![
-            Keyframe::new(Tick(i64::MIN), Value::Vec2([0.0, 0.0])),
-            Keyframe::new(Tick(10), Value::Vec2([50.0, 0.0])),
-            Keyframe::new(Tick(i64::MAX), Value::Vec2([100.0, 0.0])),
-        ];
-        for key in &mut keys {
-            key.spatial_auto = false;
-        }
-        keys[1].roving = true;
-        assert!(retime_roving(&mut keys, true));
-        assert_eq!(keys[1].time, Tick::ZERO);
-    }
-
-    #[test]
-    fn replacing_key_preserves_spatial_metadata() {
-        let mut key = Keyframe::new(s(1.0), Value::Vec2([20.0, 30.0]));
-        key.roving = true;
-        key.spatial_continuous = true;
-        let mut keys = vec![key];
-        set_key(&mut keys, Keyframe::new(s(1.0), Value::Vec2([40.0, 50.0])));
-        assert!(keys[0].roving);
-        assert!(keys[0].spatial_continuous);
-        assert_eq!(keys[0].value, Value::Vec2([40.0, 50.0]));
-    }
-
-    #[test]
-    fn temporal_ease_matches_live_ae_with_overlapping_influences() {
-        // Original Rotation probe via AEsync 2.0.4, AE 26.3x87, 2026-10-05.
-        // AE retains each handle's requested influence even when their sum exceeds 100%.
-        for (from, to, out_speed, out_inf, in_speed, in_inf, samples) in [
-            (0.0, 100.0, 0.0, 0.8, 0.0, 0.8, [(0.1, 0.59243939036327), (0.25, 4.76438030608764), (0.4, 18.4284394271562), (0.75, 95.2356196939123)]),
-            (0.0, 100.0, 20.0, 0.8, 80.0, 0.6, [(0.1, 2.25754942621577), (0.25, 6.99841889412931), (0.4, 14.9334636959052), (0.75, 73.8196785378389)]),
-            (100.0, 0.0, -20.0, 0.6, -80.0, 0.8, [(0.1, 97.6395466334594), (0.25, 91.597048571292), (0.4, 74.5367957474338), (0.75, 22.3789127753126)]),
-        ] {
-            let mut a = Keyframe::new(s(0.0), Value::Scalar(from));
-            let mut b = Keyframe::new(s(1.0), Value::Scalar(to));
-            a.out_interp = Interp::Bezier;
-            b.in_interp = Interp::Bezier;
-            a.out_ease = vec![Ease { speed: out_speed, influence: out_inf }];
-            b.in_ease = vec![Ease { speed: in_speed, influence: in_inf }];
-            for (time, expected) in samples {
-                let value = evaluate(&[a.clone(), b.clone()], s(time), false).unwrap().as_f64();
-                assert!((value - expected).abs() < 1e-7, "{time}: {value} != {expected}");
-                let normalized = ease_progress(out_speed / (to - from), out_inf, in_speed / (to - from), in_inf, time);
-                assert!((from + normalized * (to - from) - expected).abs() < 1e-7);
-            }
-        }
-    }
-
-    #[test]
-    fn maximum_influence_resolves_flat_midpoint_time_curve() {
-        for time in [0.5 - 1e-9, 0.5 - 1e-12, 0.5, 0.5 + 1e-12, 0.5 + 1e-9] {
-            // At 100%/100%, x = 0.5 + 4*(u - 0.5)^3 exactly.
-            let u = 0.5 + ((time - 0.5) / 4.0_f64).cbrt();
-            let expected = bez(0.0, 0.0, 1.0, 1.0, u);
-            let actual = ease_progress(0.0, 1.0, 0.0, 1.0, time);
-            assert!((actual - expected).abs() < 1e-10, "{time}: {actual} != {expected}");
-        }
-    }
-
-    /// M13.15: agents set gradients as plain JSON, not only the tagged form `get` returns.
-    #[test]
-    fn gradients_coerce_from_plain_json() {
-        let g = Value::Gradient(Gradient::default());
-        let plain = serde_json::json!({"colors": [[0, [0, 0.5, 1, 1]], [1, "#ffff00"]], "opacities": [[0, 1], [1, 0.5]]});
-        let Some(Value::Gradient(a)) = g.coerce_json(&plain) else { panic!("object form") };
-        assert_eq!(a.colors, vec![(0.0, [0.0, 0.5, 1.0, 1.0]), (1.0, [1.0, 1.0, 0.0, 1.0])]);
-        assert_eq!(a.opacities, vec![(0.0, 1.0), (1.0, 0.5)]);
-        let Some(Value::Gradient(b)) = g.coerce_json(&serde_json::json!(["#ff0000", "#00ff00", "#0000ff"])) else { panic!("list form") };
-        assert_eq!(b.colors.iter().map(|c| c.0).collect::<Vec<_>>(), vec![0.0, 0.5, 1.0]);
-        assert_eq!(b.opacities.len(), 3);
-        // The tagged form (what prop.get returns) still round-trips.
-        assert_eq!(g.coerce_json(&g.to_json()), Some(g.clone()));
-        assert_eq!(g.coerce_json(&serde_json::json!(5)), None);
-    }
-
-    /// #612: the gradient editor samples a new stop from its own track only. `sample` multiplies
-    /// in the opacity stops, so feeding its alpha into a colour stop would apply 50% twice (25%).
-    #[test]
-    fn gradient_tracks_sample_separately() {
-        let g = Gradient { colors: vec![(0.0, [1.0, 0.0, 0.0, 0.8]), (1.0, [0.0, 0.0, 1.0, 0.4])], opacities: vec![(0.0, 0.5), (1.0, 0.5)] };
-        let c = g.color_at(0.5);
-        assert!((c[0] - 0.5).abs() < 1e-6 && (c[2] - 0.5).abs() < 1e-6, "{c:?}");
-        assert!((c[3] - 0.6).abs() < 1e-6, "the colour track's own alpha, without opacity: {c:?}");
-        assert!((g.opacity_at(0.5) - 0.5).abs() < 1e-6);
-        assert!((g.sample(0.5)[3] - 0.3).abs() < 1e-6, "sample still applies opacity once");
-        // A stop added at 50% from the opacity track keeps 50%: sampled again, it is still 50%.
-        let mut with_stop = g.clone();
-        with_stop.opacities.insert(1, (0.5, g.opacity_at(0.5)));
-        assert!((with_stop.opacity_at(0.5) - 0.5).abs() < 1e-6);
-        assert!((with_stop.sample(0.5)[3] - 0.3).abs() < 1e-6, "adding a stop doesn't change the look");
-        // Outside the stops, and with none: the ends hold, and an empty track is opaque white.
-        assert_eq!(g.color_at(-1.0), [1.0, 0.0, 0.0, 0.8]);
-        assert_eq!(g.color_at(2.0), [0.0, 0.0, 1.0, 0.4]);
-        let empty = Gradient { colors: vec![], opacities: vec![] };
-        assert_eq!((empty.color_at(0.3), empty.opacity_at(0.3)), ([1.0; 4], 1.0));
-    }
-
-    /// #612: the editor saves the typed form, so one colour stop (which the plain JSON parser
-    /// rejects) and each stop's RGBA come back exactly.
-    #[test]
-    fn typed_gradient_round_trips_one_stop_and_rgba() {
-        let one = Value::Gradient(Gradient { colors: vec![(0.25, [0.1, 0.2, 0.3, 0.7])], opacities: vec![(0.0, 1.0), (0.6, 0.35)] });
-        let cur = Value::Gradient(Gradient::default());
-        assert_eq!(cur.coerce_json(&one.to_json()), Some(one.clone()));
-        assert_eq!(cur.coerce_json(&serde_json::json!({"colors": [[0.25, [0.1, 0.2, 0.3, 0.7]]]})), None, "plain JSON needs two colours");
-    }
-
-    #[test]
-    fn linear_and_hold() {
-        let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(2.0), Value::Scalar(100.0))];
-        assert_eq!(evaluate(&keys, s(1.0), false), Some(Value::Scalar(50.0)));
-        assert_eq!(evaluate(&keys, s(-1.0), false), Some(Value::Scalar(0.0)));
-        assert_eq!(evaluate(&keys, s(3.0), false), Some(Value::Scalar(100.0)));
-        let held = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)).hold(), Keyframe::new(s(2.0), Value::Scalar(100.0))];
-        assert_eq!(evaluate(&held, s(1.999), false), Some(Value::Scalar(0.0)));
-    }
-
-    #[test]
-    fn hold_key_keeps_its_incoming_segment_linear() {
-        // Hold on the second key (in and out, as KeyframeInterpolationType.HOLD sets it) holds
-        // what comes after it, not the linear motion into it.
-        let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(2.0), Value::Scalar(100.0)).hold()];
-        assert_eq!(evaluate(&keys, s(0.5), false), Some(Value::Scalar(25.0)));
-        let keys = vec![Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])), Keyframe::new(s(2.0), Value::Vec2([100.0, 0.0])).hold()];
-        let p = evaluate(&keys, s(0.5), true).unwrap().as_vec2();
-        assert!((p[0] - 25.0).abs() < 0.01, "{p:?}");
-    }
-
-    #[test]
-    fn easy_ease_is_symmetric_and_slow_at_ends() {
-        let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)).eased(), Keyframe::new(s(1.0), Value::Scalar(100.0)).eased()];
-        let mid = evaluate(&keys, s(0.5), false).unwrap().as_f64();
-        assert!((mid - 50.0).abs() < 1e-6, "{mid}");
-        let early = evaluate(&keys, s(0.1), false).unwrap().as_f64();
-        assert!(early < 10.0 && early > 0.0, "{early}");
-        let v0 = velocity(&keys, s(0.01), false)[0];
-        let vm = velocity(&keys, s(0.5), false)[0];
-        assert!(v0 < vm);
-    }
-
-    #[test]
-    fn bezier_with_linear_speed_matches_linear() {
-        let mut a = Keyframe::new(s(0.0), Value::Scalar(0.0));
-        let mut b = Keyframe::new(s(2.0), Value::Scalar(100.0));
-        a.out_interp = Interp::Bezier;
-        b.in_interp = Interp::Bezier;
-        a.out_ease = vec![Ease { speed: 50.0, influence: 1.0 / 3.0 }];
-        b.in_ease = vec![Ease { speed: 50.0, influence: 1.0 / 3.0 }];
-        let keys = vec![a, b];
-        for i in 0..=20 {
-            let t = i as f64 * 0.1;
-            let v = evaluate(&keys, s(t), false).unwrap().as_f64();
-            assert!((v - 50.0 * t).abs() < 1e-6, "{t} {v}");
-        }
-    }
-
-    #[test]
-    fn spatial_linear_constant_speed() {
-        let keys = vec![Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])), Keyframe::new(s(1.0), Value::Vec2([300.0, 400.0]))];
-        let p = evaluate(&keys, s(0.5), true).unwrap().as_vec2();
-        assert!((p[0] - 150.0).abs() < 0.5 && (p[1] - 200.0).abs() < 0.5, "{p:?}");
-    }
-
-    /// #456: along a curved spatial path with linear (constant-speed) keys the speed graph is
-    /// flat, not a sawtooth from a piecewise-linear arc-length table.
-    #[test]
-    fn spatial_curved_path_has_smooth_constant_speed() {
-        let mut a = Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0]));
-        let mut b = Keyframe::new(s(2.0), Value::Vec2([400.0, 0.0]));
-        a.spatial_auto = false;
-        b.spatial_auto = false;
-        a.spatial_out = [50.0, -300.0, 0.0];
-        b.spatial_in = [80.0, 250.0, 0.0];
-        let keys = vec![a, b];
-        let len = spatial_segment_length(&keys, 0);
-        let speeds: Vec<f64> = (1..400).map(|i| speed(&keys, s(i as f64 * 0.005), true)).collect();
-        for v in &speeds {
-            assert!((v - len / 2.0).abs() < 1e-3 * len, "speed {v} vs {}", len / 2.0);
-        }
-    }
-
-    #[test]
-    fn spatial_auto_bezier_passes_through_keys() {
-        let keys = vec![
-            Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])),
-            Keyframe::new(s(1.0), Value::Vec2([100.0, 100.0])),
-            Keyframe::new(s(2.0), Value::Vec2([200.0, 0.0])),
-        ];
-        let p = evaluate(&keys, s(1.0), true).unwrap().as_vec2();
-        assert_eq!(p, [100.0, 100.0]);
-        // Curved: the midpoint of the first segment lies off the straight line.
-        let m = evaluate(&keys, s(0.5), true).unwrap().as_vec2();
-        assert!((m[0] - m[1]).abs() > 1.0, "{m:?}");
-    }
-
-    #[test]
-    fn straight_auto_bezier_path_is_exact() {
-        // Auto-Bezier ends now have handles along the line; the chord is still hit exactly.
-        let keys = vec![Keyframe::new(s(0.0), Value::Vec2([40.0, 50.0])), Keyframe::new(s(2.0), Value::Vec2([120.0, 50.0]))];
-        assert_eq!(segment_value(&keys, 0, s(1.0), true), Value::Vec2([80.0, 50.0]));
-    }
-
-    /// #880: a motion path whose arc length overflows (huge coordinates, as the Position field
-    /// accepts) or is NaN evaluates without panicking: scrubbing over it crashed the app.
-    #[test]
-    fn overflowing_or_nan_motion_paths_evaluate() {
-        let paths = [
-            [[-1.7e308, 0.0], [1.7e308, 0.0], [-1.7e308, 5.0]],
-            [[0.0, 0.0], [f64::NAN, 10.0], [20.0, 0.0]],
-            [[f64::INFINITY, 0.0], [0.0, f64::NEG_INFINITY], [20.0, 0.0]],
-        ];
-        for path in paths {
-            let mut keys: Vec<Keyframe> = path.iter().enumerate().map(|(i, &v)| Keyframe::new(s(i as f64 * 2.0), Value::Vec2(v))).collect();
-            for eased in [false, true] {
-                if eased {
-                    keys = keys.into_iter().map(Keyframe::eased).collect();
-                }
-                for f in 0..=40 {
-                    let t = s(f as f64 * 0.1);
-                    assert!(evaluate(&keys, t, true).is_some());
-                    let _ = speed(&keys, t, true);
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn spatial_auto_bezier_tangents_follow_after_effects() {
-        // Measured on After Effects 26.3 with original paths (docs/fidelity/README.md): each
-        // auto-Bezier key's out tangent is (next - previous) / 6 and its in tangent the mirror,
-        // whatever the key times. End keys use their one neighbour: (neighbour - key) / 6.
-        let p = [[40.0, 300.0, 0.0], [260.0, 80.0, 20.0], [700.0, 420.0, -40.0], [1100.0, 150.0, 0.0]];
-        let mut keys: Vec<Keyframe> = [0.0, 0.2, 1.5, 1.8].iter().zip(p).map(|(&t, v)| Keyframe::new(s(t), Value::Vec3(v))).collect();
-        let sixth = |a: [f64; 3], b: [f64; 3]| [(b[0] - a[0]) / 6.0, (b[1] - a[1]) / 6.0, (b[2] - a[2]) / 6.0];
-        let neg = |v: [f64; 3]| [-v[0], -v[1], -v[2]];
-        let close = |a: [f64; 3], b: [f64; 3]| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-9);
-        let want = [sixth(p[0], p[1]), sixth(p[0], p[2]), sixth(p[1], p[3]), sixth(p[2], p[3])];
-        for (i, out) in want.into_iter().enumerate() {
-            let (tin, tout) = spatial_tangents(&keys, i);
-            assert!(close(tout, out) && close(tin, neg(out)), "key {i}: {tin:?} {tout:?}");
-        }
-        // Moving a key in time leaves every tangent as it was.
-        keys[1].time = s(1.2);
-        assert!(close(spatial_tangents(&keys, 1).1, sixth(p[0], p[2])));
-        // A key between two coincident neighbours, and a lone key, have none.
-        let still = [[5.0, 5.0], [9.0, 1.0], [5.0, 5.0]].iter().enumerate().map(|(i, &v)| Keyframe::new(s(i as f64), Value::Vec2(v))).collect::<Vec<_>>();
-        assert_eq!(spatial_tangents(&still, 1), ([0.0; 3], [0.0; 3]));
-        assert_eq!(spatial_tangents(&still[..1], 0), ([0.0; 3], [0.0; 3]));
-    }
-
-    #[test]
-    fn set_key_replaces_same_time() {
-        let mut keys = vec![];
-        set_key(&mut keys, Keyframe::new(s(1.0), Value::Scalar(1.0)).eased());
-        set_key(&mut keys, Keyframe::new(s(0.0), Value::Scalar(0.0)));
-        set_key(&mut keys, Keyframe::new(s(1.0), Value::Scalar(5.0)));
-        assert_eq!(keys.len(), 2);
-        assert_eq!(keys[1].value, Value::Scalar(5.0));
-        assert_eq!(keys[1].in_interp, Interp::Bezier);
-    }
-
-    #[test]
-    fn colors_and_paths_interpolate() {
-        let keys = vec![Keyframe::new(s(0.0), Value::Color([0.0, 0.0, 0.0, 1.0])), Keyframe::new(s(1.0), Value::Color([1.0, 0.5, 0.0, 1.0]))];
-        assert_eq!(evaluate(&keys, s(0.5), false).unwrap().as_color(), [0.5, 0.25, 0.0, 1.0]);
-        let a = ShapePath::rect([0.0, 0.0], 10.0, 10.0);
-        let b = ShapePath::rect([0.0, 0.0], 20.0, 20.0);
-        let keys = vec![Keyframe::new(s(0.0), Value::Path(a)), Keyframe::new(s(1.0), Value::Path(b))];
-        let v = evaluate(&keys, s(0.5), false).unwrap();
-        assert_eq!(v.as_path().unwrap().vertices[0], [-7.5, -7.5]);
-    }
-
-    #[test]
-    fn roving_keys_get_constant_speed_times() {
-        let mut keys = vec![
-            Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])),
-            Keyframe::new(s(0.2), Value::Vec2([300.0, 0.0])),
-            Keyframe::new(s(2.0), Value::Vec2([400.0, 0.0])),
-        ];
-        for k in &mut keys {
-            k.spatial_auto = false;
-        }
-        keys[1].roving = true;
-        assert!(retime_roving(&mut keys, true));
-        // 300 of 400 px → 75 % of the 2 s span.
-        assert!((keys[1].time.seconds() - 1.5).abs() < 1e-6, "{}", keys[1].time.seconds());
-        let v0 = speed(&keys, s(0.5), true);
-        let v1 = speed(&keys, s(1.8), true);
-        assert!((v0 - 200.0).abs() < 1.0 && (v1 - 200.0).abs() < 1.0, "{v0} {v1}");
-        // First/last keys can't rove.
-        keys[0].roving = true;
-        retime_roving(&mut keys, true);
-        assert!(!keys[0].roving);
-    }
-
-    #[test]
-    fn roving_keys_never_share_a_time_with_a_fixed_key() {
-        // Zero-length last segment (issue #532) and zero-length first segment.
-        for xs in [[0.0, 40.0, 120.0, 120.0], [0.0, 0.0, 40.0, 120.0]] {
-            let mut keys: Vec<Keyframe> = xs.iter().enumerate().map(|(i, x)| Keyframe::new(s(i as f64), Value::Vec2([*x, 64.0]))).collect();
-            for k in &mut keys {
-                k.spatial_auto = false;
-            }
-            keys[1].roving = true;
-            keys[2].roving = true;
-            retime_roving(&mut keys, true);
-            assert!(keys.windows(2).all(|w| w[0].time < w[1].time), "{xs:?}: {:?}", keys.iter().map(|k| k.time).collect::<Vec<_>>());
-        }
-    }
-
-    #[test]
-    fn side_ease_reports_linear_and_eased_sides() {
-        let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(2.0), Value::Scalar(100.0)).eased()];
-        let out = side_ease(&keys, 0, 0, false, true).unwrap();
-        assert!((out.speed - 50.0).abs() < 1e-9);
-        let inn = side_ease(&keys, 1, 0, false, false).unwrap();
-        assert_eq!(inn, Ease::EASY);
-        assert!(side_ease(&keys, 0, 0, false, false).is_none());
-    }
-
-    #[test]
-    fn time_reverse_mirrors_keys() {
-        let mut keys =
-            vec![Keyframe::new(s(1.0), Value::Scalar(0.0)).eased(), Keyframe::new(s(2.0), Value::Scalar(5.0)), Keyframe::new(s(4.0), Value::Scalar(10.0))];
-        keys[0].out_interp = Interp::Hold;
-        time_reverse(&mut keys);
-        assert_eq!(keys.iter().map(|k| k.time.seconds().round() as i64).collect::<Vec<_>>(), vec![1, 3, 4]);
-        assert_eq!(keys[0].value, Value::Scalar(10.0));
-        assert_eq!(keys[2].in_interp, Interp::Hold);
-    }
-
-    proptest::proptest! {
-        #[test]
-        fn eased_values_stay_in_range(t in 0.0f64..1.0, i0 in 0.01f64..1.0, i1 in 0.01f64..1.0) {
-            let mut a = Keyframe::new(s(0.0), Value::Scalar(0.0)).eased();
-            let mut b = Keyframe::new(s(1.0), Value::Scalar(10.0)).eased();
-            a.out_ease = vec![Ease { speed: 0.0, influence: i0 }];
-            b.in_ease = vec![Ease { speed: 0.0, influence: i1 }];
-            let v = evaluate(&[a, b], s(t), false).unwrap().as_f64();
-            proptest::prop_assert!((-1e-9..=10.0 + 1e-9).contains(&v));
-        }
-    }
-}
+mod tests;
diff --git a/crates/keyframe/src/tests.rs b/crates/keyframe/src/tests.rs
new file mode 100644
index 000000000..88f9f3249
--- /dev/null
+++ b/crates/keyframe/src/tests.rs
@@ -0,0 +1,543 @@
+use super::*;
+
+fn s(x: f64) -> Tick {
+    Tick::from_seconds_f64(x)
+}
+
+#[test]
+fn missing_spatial_keys_have_no_tangents_or_length() {
+    let keys = vec![Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0]))];
+    for i in [1, usize::MAX] {
+        assert_eq!(spatial_tangents(&keys, i), ([0.0; 3], [0.0; 3]));
+        assert_eq!(spatial_segment_length(&keys, i), 0.0);
+    }
+    assert_eq!(spatial_tangents(&[], 0), ([0.0; 3], [0.0; 3]));
+    assert_eq!(spatial_segment_length(&[], usize::MAX), 0.0);
+}
+
+#[test]
+fn time_reverse_handles_deserialized_tick_extremes() {
+    // Tick's public serde representation can contain values beyond from_seconds_f64's cap.
+    for (first, last) in [(i64::MIN, i64::MIN + 10), (i64::MAX - 10, i64::MAX), (i64::MIN, i64::MAX)] {
+        let mut keys = vec![Keyframe::new(Tick(first), Value::Scalar(1.0)), Keyframe::new(Tick(last), Value::Scalar(2.0))];
+        time_reverse(&mut keys);
+        assert_eq!(keys[0].time, Tick(first));
+        assert_eq!(keys[0].value, Value::Scalar(2.0));
+        assert_eq!(keys[1].time, Tick(last));
+        assert_eq!(keys[1].value, Value::Scalar(1.0));
+        time_reverse(&mut keys);
+        assert_eq!(keys[0].value, Value::Scalar(1.0));
+    }
+}
+
+#[test]
+fn roving_handles_deserialized_tick_extremes() {
+    let mut keys = vec![
+        Keyframe::new(Tick(i64::MIN), Value::Vec2([0.0, 0.0])),
+        Keyframe::new(Tick(10), Value::Vec2([50.0, 0.0])),
+        Keyframe::new(Tick(i64::MAX), Value::Vec2([100.0, 0.0])),
+    ];
+    for key in &mut keys {
+        key.spatial_auto = false;
+    }
+    keys[1].roving = true;
+    assert!(retime_roving(&mut keys, true));
+    assert_eq!(keys[1].time, Tick::ZERO);
+}
+
+#[test]
+fn replacing_key_preserves_spatial_metadata() {
+    let mut key = Keyframe::new(s(1.0), Value::Vec2([20.0, 30.0]));
+    key.roving = true;
+    key.spatial_continuous = true;
+    let mut keys = vec![key];
+    set_key(&mut keys, Keyframe::new(s(1.0), Value::Vec2([40.0, 50.0])));
+    assert!(keys[0].roving);
+    assert!(keys[0].spatial_continuous);
+    assert_eq!(keys[0].value, Value::Vec2([40.0, 50.0]));
+}
+
+#[test]
+fn temporal_ease_matches_live_ae_with_overlapping_influences() {
+    // Original Rotation probe via AEsync 2.0.4, AE 26.3x87, 2026-10-05.
+    // AE retains each handle's requested influence even when their sum exceeds 100%.
+    for (from, to, out_speed, out_inf, in_speed, in_inf, samples) in [
+        (0.0, 100.0, 0.0, 0.8, 0.0, 0.8, [(0.1, 0.59243939036327), (0.25, 4.76438030608764), (0.4, 18.4284394271562), (0.75, 95.2356196939123)]),
+        (0.0, 100.0, 20.0, 0.8, 80.0, 0.6, [(0.1, 2.25754942621577), (0.25, 6.99841889412931), (0.4, 14.9334636959052), (0.75, 73.8196785378389)]),
+        (100.0, 0.0, -20.0, 0.6, -80.0, 0.8, [(0.1, 97.6395466334594), (0.25, 91.597048571292), (0.4, 74.5367957474338), (0.75, 22.3789127753126)]),
+    ] {
+        let mut a = Keyframe::new(s(0.0), Value::Scalar(from));
+        let mut b = Keyframe::new(s(1.0), Value::Scalar(to));
+        a.out_interp = Interp::Bezier;
+        b.in_interp = Interp::Bezier;
+        a.out_ease = vec![Ease { speed: out_speed, influence: out_inf }];
+        b.in_ease = vec![Ease { speed: in_speed, influence: in_inf }];
+        for (time, expected) in samples {
+            let value = evaluate(&[a.clone(), b.clone()], s(time), false).unwrap().as_f64();
+            assert!((value - expected).abs() < 1e-7, "{time}: {value} != {expected}");
+            let normalized = ease_progress(out_speed / (to - from), out_inf, in_speed / (to - from), in_inf, time);
+            assert!((from + normalized * (to - from) - expected).abs() < 1e-7);
+        }
+    }
+}
+
+#[test]
+fn maximum_influence_resolves_flat_midpoint_time_curve() {
+    for time in [0.5 - 1e-9, 0.5 - 1e-12, 0.5, 0.5 + 1e-12, 0.5 + 1e-9] {
+        // At 100%/100%, x = 0.5 + 4*(u - 0.5)^3 exactly.
+        let u = 0.5 + ((time - 0.5) / 4.0_f64).cbrt();
+        let expected = bez(0.0, 0.0, 1.0, 1.0, u);
+        let actual = ease_progress(0.0, 1.0, 0.0, 1.0, time);
+        assert!((actual - expected).abs() < 1e-10, "{time}: {actual} != {expected}");
+    }
+}
+
+/// Keyed Orientation moves along the shortest arc, eased in time, as After Effects 2026 reads
+/// it back (cases 802 and 803: keys [0,0,0] at 0 s and [60,80,40] at 2 s).
+#[test]
+fn keyed_orientation_matches_after_effects() {
+    let close = |v: Value, e: [f64; 3]| {
+        let v = v.as_vec3();
+        assert!((0..3).all(|i| (v[i] - e[i]).abs() < 2e-3), "{v:?} vs {e:?}");
+    };
+    let lin = vec![Keyframe::new(s(0.0), Value::Vec3([0.0; 3])), Keyframe::new(s(2.0), Value::Vec3([60.0, 80.0, 40.0]))];
+    close(evaluate_orientation(&lin, s(0.5)).unwrap(), [16.9201, 16.0688, 16.0629]);
+    close(evaluate_orientation(&lin, s(1.0)).unwrap(), [30.6186, 35.7617, 28.4317]);
+    close(evaluate_orientation(&lin, s(2.0)).unwrap(), [60.0, 80.0, 40.0]);
+    // A middle key reads back as stored (not as another angle triple of the same rotation).
+    let three =
+        vec![Keyframe::new(s(0.0), Value::Vec3([0.0; 3])), Keyframe::new(s(1.0), Value::Vec3([0.0, 120.0, 0.0])), Keyframe::new(s(2.0), Value::Vec3([0.0; 3]))];
+    assert_eq!(evaluate_orientation(&three, s(1.0)), Some(Value::Vec3([0.0, 120.0, 0.0])));
+    // Easy ease (AE's preset: speed 0, influence 33 %) on both keys.
+    let ease = |k: Keyframe| {
+        let mut k = k.eased();
+        k.in_ease = vec![Ease { speed: 0.0, influence: 0.33 }];
+        k.out_ease = vec![Ease { speed: 0.0, influence: 0.33 }];
+        k
+    };
+    let eased: Vec<Keyframe> = lin.into_iter().map(ease).collect();
+    close(evaluate_orientation(&eased, s(0.5)).unwrap(), [11.0974, 9.5750, 10.5916]);
+    close(evaluate_orientation(&eased, s(1.0)).unwrap(), [30.6186, 35.7617, 28.4317]);
+    close(evaluate_orientation(&eased, s(1.5)).unwrap(), [47.6915, 65.7590, 40.3338]);
+    // Hold keys and other value types.
+    let held = vec![Keyframe::new(s(0.0), Value::Vec3([1.0, 2.0, 3.0])).hold(), Keyframe::new(s(1.0), Value::Vec3([0.0; 3]))];
+    close(evaluate_orientation(&held, s(0.5)).unwrap(), [1.0, 2.0, 3.0]);
+    let scalar = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(1.0), Value::Scalar(10.0))];
+    assert_eq!(evaluate_orientation(&scalar, s(0.5)), Some(Value::Scalar(5.0)));
+    assert_eq!(evaluate_orientation(&[], s(0.5)), None);
+}
+
+/// M13.15: agents set gradients as plain JSON, not only the tagged form `get` returns.
+#[test]
+fn gradients_coerce_from_plain_json() {
+    let g = Value::Gradient(Gradient::default());
+    let plain = serde_json::json!({"colors": [[0, [0, 0.5, 1, 1]], [1, "#ffff00"]], "opacities": [[0, 1], [1, 0.5]]});
+    let Some(Value::Gradient(a)) = g.coerce_json(&plain) else { panic!("object form") };
+    assert_eq!(a.colors, vec![(0.0, [0.0, 0.5, 1.0, 1.0]), (1.0, [1.0, 1.0, 0.0, 1.0])]);
+    assert_eq!(a.opacities, vec![(0.0, 1.0), (1.0, 0.5)]);
+    let Some(Value::Gradient(b)) = g.coerce_json(&serde_json::json!(["#ff0000", "#00ff00", "#0000ff"])) else { panic!("list form") };
+    assert_eq!(b.colors.iter().map(|c| c.0).collect::<Vec<_>>(), vec![0.0, 0.5, 1.0]);
+    assert_eq!(b.opacities.len(), 3);
+    // The tagged form (what prop.get returns) still round-trips.
+    assert_eq!(g.coerce_json(&g.to_json()), Some(g.clone()));
+    assert_eq!(g.coerce_json(&serde_json::json!(5)), None);
+}
+
+/// #612: the gradient editor samples a new stop from its own track only. `sample` multiplies
+/// in the opacity stops, so feeding its alpha into a colour stop would apply 50% twice (25%).
+#[test]
+fn gradient_tracks_sample_separately() {
+    let g = Gradient { colors: vec![(0.0, [1.0, 0.0, 0.0, 0.8]), (1.0, [0.0, 0.0, 1.0, 0.4])], opacities: vec![(0.0, 0.5), (1.0, 0.5)] };
+    let c = g.color_at(0.5);
+    assert!((c[0] - 0.5).abs() < 1e-6 && (c[2] - 0.5).abs() < 1e-6, "{c:?}");
+    assert!((c[3] - 0.6).abs() < 1e-6, "the colour track's own alpha, without opacity: {c:?}");
+    assert!((g.opacity_at(0.5) - 0.5).abs() < 1e-6);
+    assert!((g.sample(0.5)[3] - 0.3).abs() < 1e-6, "sample still applies opacity once");
+    // A stop added at 50% from the opacity track keeps 50%: sampled again, it is still 50%.
+    let mut with_stop = g.clone();
+    with_stop.opacities.insert(1, (0.5, g.opacity_at(0.5)));
+    assert!((with_stop.opacity_at(0.5) - 0.5).abs() < 1e-6);
+    assert!((with_stop.sample(0.5)[3] - 0.3).abs() < 1e-6, "adding a stop doesn't change the look");
+    // Outside the stops, and with none: the ends hold, and an empty track is opaque white.
+    assert_eq!(g.color_at(-1.0), [1.0, 0.0, 0.0, 0.8]);
+    assert_eq!(g.color_at(2.0), [0.0, 0.0, 1.0, 0.4]);
+    let empty = Gradient { colors: vec![], opacities: vec![] };
+    assert_eq!((empty.color_at(0.3), empty.opacity_at(0.3)), ([1.0; 4], 1.0));
+}
+
+/// #612: the editor saves the typed form, so one colour stop (which the plain JSON parser
+/// rejects) and each stop's RGBA come back exactly.
+#[test]
+fn typed_gradient_round_trips_one_stop_and_rgba() {
+    let one = Value::Gradient(Gradient { colors: vec![(0.25, [0.1, 0.2, 0.3, 0.7])], opacities: vec![(0.0, 1.0), (0.6, 0.35)] });
+    let cur = Value::Gradient(Gradient::default());
+    assert_eq!(cur.coerce_json(&one.to_json()), Some(one.clone()));
+    assert_eq!(cur.coerce_json(&serde_json::json!({"colors": [[0.25, [0.1, 0.2, 0.3, 0.7]]]})), None, "plain JSON needs two colours");
+}
+
+#[test]
+fn linear_and_hold() {
+    let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(2.0), Value::Scalar(100.0))];
+    assert_eq!(evaluate(&keys, s(1.0), false), Some(Value::Scalar(50.0)));
+    assert_eq!(evaluate(&keys, s(-1.0), false), Some(Value::Scalar(0.0)));
+    assert_eq!(evaluate(&keys, s(3.0), false), Some(Value::Scalar(100.0)));
+    let held = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)).hold(), Keyframe::new(s(2.0), Value::Scalar(100.0))];
+    assert_eq!(evaluate(&held, s(1.999), false), Some(Value::Scalar(0.0)));
+}
+
+#[test]
+fn hold_key_keeps_its_incoming_segment_linear() {
+    // Hold on the second key (in and out, as KeyframeInterpolationType.HOLD sets it) holds
+    // what comes after it, not the linear motion into it.
+    let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(2.0), Value::Scalar(100.0)).hold()];
+    assert_eq!(evaluate(&keys, s(0.5), false), Some(Value::Scalar(25.0)));
+    let keys = vec![Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])), Keyframe::new(s(2.0), Value::Vec2([100.0, 0.0])).hold()];
+    let p = evaluate(&keys, s(0.5), true).unwrap().as_vec2();
+    assert!((p[0] - 25.0).abs() < 0.01, "{p:?}");
+}
+
+#[test]
+fn easy_ease_is_symmetric_and_slow_at_ends() {
+    let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)).eased(), Keyframe::new(s(1.0), Value::Scalar(100.0)).eased()];
+    let mid = evaluate(&keys, s(0.5), false).unwrap().as_f64();
+    assert!((mid - 50.0).abs() < 1e-6, "{mid}");
+    let early = evaluate(&keys, s(0.1), false).unwrap().as_f64();
+    assert!(early < 10.0 && early > 0.0, "{early}");
+    let v0 = velocity(&keys, s(0.01), false)[0];
+    let vm = velocity(&keys, s(0.5), false)[0];
+    assert!(v0 < vm);
+}
+
+#[test]
+fn bezier_with_linear_speed_matches_linear() {
+    let mut a = Keyframe::new(s(0.0), Value::Scalar(0.0));
+    let mut b = Keyframe::new(s(2.0), Value::Scalar(100.0));
+    a.out_interp = Interp::Bezier;
+    b.in_interp = Interp::Bezier;
+    a.out_ease = vec![Ease { speed: 50.0, influence: 1.0 / 3.0 }];
+    b.in_ease = vec![Ease { speed: 50.0, influence: 1.0 / 3.0 }];
+    let keys = vec![a, b];
+    for i in 0..=20 {
+        let t = i as f64 * 0.1;
+        let v = evaluate(&keys, s(t), false).unwrap().as_f64();
+        assert!((v - 50.0 * t).abs() < 1e-6, "{t} {v}");
+    }
+}
+
+/// A linear side next to an eased one keeps the segment's average speed at 16.67 %
+/// influence. After Effects time-remap read-backs (a square at x = 50 + 455 * remap): out of
+/// a key at 2 s (3.5, speed 0, influence 50 %) into a linear key at 4 s (0.5) the remap is
+/// 3.290 at 2.5 s and 2.657 at 3 s (33.3 % gave 3.308 and 2.629).
+#[test]
+fn a_linear_side_next_to_an_eased_side_matches_after_effects() {
+    let mut a = Keyframe::new(s(2.0), Value::Scalar(3.5));
+    a.out_interp = Interp::Bezier;
+    a.out_ease = vec![Ease { speed: 0.0, influence: 0.5 }];
+    let keys = vec![a, Keyframe::new(s(4.0), Value::Scalar(0.5))];
+    for (t, ae) in [(2.5, 3.290), (3.0, 2.657)] {
+        let v = evaluate(&keys, s(t), false).unwrap().as_f64();
+        // AE's square edge is read to the pixel: 1 px = 1 / 455 of remap.
+        assert!((v - ae).abs() < 2.0 / 455.0, "{t}: {v} vs {ae}");
+    }
+    // The mirror case: a linear out into an eased in.
+    let mut b = Keyframe::new(s(4.0), Value::Scalar(0.5));
+    b.in_interp = Interp::Bezier;
+    b.in_ease = vec![Ease { speed: 0.0, influence: 0.5 }];
+    let mirror = vec![Keyframe::new(s(2.0), Value::Scalar(3.5)), b];
+    let v = evaluate(&mirror, s(3.5), false).unwrap().as_f64();
+    assert!((v - (4.0 - 3.290)).abs() < 2.0 / 455.0, "{v}");
+    assert_eq!(side_ease(&keys, 1, 0, false, false).map(|e| e.influence), Some(LINEAR_SIDE_INFLUENCE));
+}
+
+/// Keyed Orientation shapes a linear side next to an eased one as a scalar property does
+/// (`LINEAR_SIDE_INFLUENCE`): about one axis the shortest arc is the angle itself, so the
+/// orientation follows the same curve as a scalar with the same keys (CodeRabbit on #1876).
+#[test]
+fn orientation_linear_side_next_to_an_eased_side_matches_a_scalar() {
+    let ease = vec![Ease { speed: 0.0, influence: 0.5 }];
+    let (mut a, mut sa) = (Keyframe::new(s(2.0), Value::Vec3([0.0, 0.0, 0.0])), Keyframe::new(s(2.0), Value::Scalar(0.0)));
+    for k in [&mut a, &mut sa] {
+        k.out_interp = Interp::Bezier;
+        k.out_ease = ease.clone();
+    }
+    let orient = vec![a, Keyframe::new(s(4.0), Value::Vec3([0.0, 0.0, 90.0]))];
+    let scalar = vec![sa, Keyframe::new(s(4.0), Value::Scalar(90.0))];
+    // The mirror: a linear out into an eased in.
+    let (mut b, mut sb) = (Keyframe::new(s(4.0), Value::Vec3([0.0, 0.0, 90.0])), Keyframe::new(s(4.0), Value::Scalar(90.0)));
+    for k in [&mut b, &mut sb] {
+        k.in_interp = Interp::Bezier;
+        k.in_ease = ease.clone();
+    }
+    let orient_m = vec![Keyframe::new(s(2.0), Value::Vec3([0.0, 0.0, 0.0])), b];
+    let scalar_m = vec![Keyframe::new(s(2.0), Value::Scalar(0.0)), sb];
+    for (o, sc) in [(&orient, &scalar), (&orient_m, &scalar_m)] {
+        for t in [2.25, 2.5, 3.0, 3.5, 3.75] {
+            let Some(Value::Vec3(v)) = evaluate_orientation(o, s(t)) else { panic!("orientation at {t}") };
+            let want = evaluate(sc, s(t), false).unwrap().as_f64();
+            assert!((v[2] - want).abs() < 1e-6 && v[0].abs() < 1e-9 && v[1].abs() < 1e-9, "{t}: {v:?} vs {want}");
+        }
+    }
+}
+
+#[test]
+fn spatial_linear_constant_speed() {
+    let keys = vec![Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])), Keyframe::new(s(1.0), Value::Vec2([300.0, 400.0]))];
+    let p = evaluate(&keys, s(0.5), true).unwrap().as_vec2();
+    assert!((p[0] - 150.0).abs() < 0.5 && (p[1] - 200.0).abs() < 0.5, "{p:?}");
+}
+
+/// #456: along a curved spatial path with linear (constant-speed) keys the speed graph is
+/// flat, not a sawtooth from a piecewise-linear arc-length table.
+#[test]
+fn spatial_curved_path_has_smooth_constant_speed() {
+    let mut a = Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0]));
+    let mut b = Keyframe::new(s(2.0), Value::Vec2([400.0, 0.0]));
+    a.spatial_auto = false;
+    b.spatial_auto = false;
+    a.spatial_out = [50.0, -300.0, 0.0];
+    b.spatial_in = [80.0, 250.0, 0.0];
+    let keys = vec![a, b];
+    let len = spatial_segment_length(&keys, 0);
+    let speeds: Vec<f64> = (1..400).map(|i| speed(&keys, s(i as f64 * 0.005), true)).collect();
+    for v in &speeds {
+        assert!((v - len / 2.0).abs() < 1e-3 * len, "speed {v} vs {}", len / 2.0);
+    }
+}
+
+#[test]
+fn spatial_auto_bezier_passes_through_keys() {
+    let keys = vec![
+        Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])),
+        Keyframe::new(s(1.0), Value::Vec2([100.0, 100.0])),
+        Keyframe::new(s(2.0), Value::Vec2([200.0, 0.0])),
+    ];
+    let p = evaluate(&keys, s(1.0), true).unwrap().as_vec2();
+    assert_eq!(p, [100.0, 100.0]);
+    // Curved: the midpoint of the first segment lies off the straight line.
+    let m = evaluate(&keys, s(0.5), true).unwrap().as_vec2();
+    assert!((m[0] - m[1]).abs() > 1.0, "{m:?}");
+}
+
+#[test]
+fn straight_auto_bezier_path_is_exact() {
+    // Auto-Bezier ends now have handles along the line; the chord is still hit exactly.
+    let keys = vec![Keyframe::new(s(0.0), Value::Vec2([40.0, 50.0])), Keyframe::new(s(2.0), Value::Vec2([120.0, 50.0]))];
+    assert_eq!(segment_value(&keys, 0, s(1.0), true), Value::Vec2([80.0, 50.0]));
+}
+
+/// #880: a motion path whose arc length overflows (huge coordinates, as the Position field
+/// accepts) or is NaN evaluates without panicking: scrubbing over it crashed the app.
+#[test]
+fn overflowing_or_nan_motion_paths_evaluate() {
+    let paths = [
+        [[-1.7e308, 0.0], [1.7e308, 0.0], [-1.7e308, 5.0]],
+        [[0.0, 0.0], [f64::NAN, 10.0], [20.0, 0.0]],
+        [[f64::INFINITY, 0.0], [0.0, f64::NEG_INFINITY], [20.0, 0.0]],
+    ];
+    for path in paths {
+        let mut keys: Vec<Keyframe> = path.iter().enumerate().map(|(i, &v)| Keyframe::new(s(i as f64 * 2.0), Value::Vec2(v))).collect();
+        for eased in [false, true] {
+            if eased {
+                keys = keys.into_iter().map(Keyframe::eased).collect();
+            }
+            for f in 0..=40 {
+                let t = s(f as f64 * 0.1);
+                assert!(evaluate(&keys, t, true).is_some());
+                let _ = speed(&keys, t, true);
+            }
+        }
+    }
+}
+
+#[test]
+fn spatial_auto_bezier_tangents_follow_after_effects() {
+    // Measured on After Effects 26.3 with original paths (docs/fidelity/README.md): each
+    // auto-Bezier key's out tangent is (next - previous) / 6 and its in tangent the mirror,
+    // whatever the key times. End keys use their one neighbour: (neighbour - key) / 6.
+    let p = [[40.0, 300.0, 0.0], [260.0, 80.0, 20.0], [700.0, 420.0, -40.0], [1100.0, 150.0, 0.0]];
+    let mut keys: Vec<Keyframe> = [0.0, 0.2, 1.5, 1.8].iter().zip(p).map(|(&t, v)| Keyframe::new(s(t), Value::Vec3(v))).collect();
+    let sixth = |a: [f64; 3], b: [f64; 3]| [(b[0] - a[0]) / 6.0, (b[1] - a[1]) / 6.0, (b[2] - a[2]) / 6.0];
+    let neg = |v: [f64; 3]| [-v[0], -v[1], -v[2]];
+    let close = |a: [f64; 3], b: [f64; 3]| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-9);
+    let want = [sixth(p[0], p[1]), sixth(p[0], p[2]), sixth(p[1], p[3]), sixth(p[2], p[3])];
+    for (i, out) in want.into_iter().enumerate() {
+        let (tin, tout) = spatial_tangents(&keys, i);
+        assert!(close(tout, out) && close(tin, neg(out)), "key {i}: {tin:?} {tout:?}");
+    }
+    // Moving a key in time leaves every tangent as it was.
+    keys[1].time = s(1.2);
+    assert!(close(spatial_tangents(&keys, 1).1, sixth(p[0], p[2])));
+    // A key between two coincident neighbours, and a lone key, have none.
+    let still = [[5.0, 5.0], [9.0, 1.0], [5.0, 5.0]].iter().enumerate().map(|(i, &v)| Keyframe::new(s(i as f64), Value::Vec2(v))).collect::<Vec<_>>();
+    assert_eq!(spatial_tangents(&still, 1), ([0.0; 3], [0.0; 3]));
+    assert_eq!(spatial_tangents(&still[..1], 0), ([0.0; 3], [0.0; 3]));
+}
+
+#[test]
+fn auto_spatial_holds_between_identical_keys() {
+    let path = [(0.0, [0.0, 540.0]), (0.6, [400.0, 540.0]), (4.4, [400.0, 540.0]), (5.0, [0.0, 540.0])];
+    for eased in [false, true] {
+        let keys: Vec<Keyframe> = path
+            .iter()
+            .map(|&(t, v)| {
+                let k = Keyframe::new(s(t), Value::Vec2(v));
+                if eased { k.eased() } else { k }
+            })
+            .collect();
+        assert_eq!(spatial_tangents(&keys, 1).1, [0.0; 3]);
+        assert_eq!(spatial_tangents(&keys, 2).0, [0.0; 3]);
+        for t in [0.7, 1.0, 2.5, 4.0, 4.3] {
+            let p = evaluate(&keys, s(t), true).unwrap().as_vec3();
+            assert!((p[0] - 400.0).abs() < 1e-6 && (p[1] - 540.0).abs() < 1e-6, "eased={eased} t={t} p={p:?}");
+        }
+    }
+}
+
+#[test]
+fn set_key_replaces_same_time() {
+    let mut keys = vec![];
+    set_key(&mut keys, Keyframe::new(s(1.0), Value::Scalar(1.0)).eased());
+    set_key(&mut keys, Keyframe::new(s(0.0), Value::Scalar(0.0)));
+    set_key(&mut keys, Keyframe::new(s(1.0), Value::Scalar(5.0)));
+    assert_eq!(keys.len(), 2);
+    assert_eq!(keys[1].value, Value::Scalar(5.0));
+    assert_eq!(keys[1].in_interp, Interp::Bezier);
+}
+
+#[test]
+fn colors_and_paths_interpolate() {
+    let keys = vec![Keyframe::new(s(0.0), Value::Color([0.0, 0.0, 0.0, 1.0])), Keyframe::new(s(1.0), Value::Color([1.0, 0.5, 0.0, 1.0]))];
+    assert_eq!(evaluate(&keys, s(0.5), false).unwrap().as_color(), [0.5, 0.25, 0.0, 1.0]);
+    let a = ShapePath::rect([0.0, 0.0], 10.0, 10.0);
+    let b = ShapePath::rect([0.0, 0.0], 20.0, 20.0);
+    let keys = vec![Keyframe::new(s(0.0), Value::Path(a)), Keyframe::new(s(1.0), Value::Path(b))];
+    let v = evaluate(&keys, s(0.5), false).unwrap();
+    assert_eq!(v.as_path().unwrap().vertices[0], [-7.5, -7.5]);
+}
+
+#[test]
+fn roving_keys_get_constant_speed_times() {
+    let mut keys = vec![
+        Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])),
+        Keyframe::new(s(0.2), Value::Vec2([300.0, 0.0])),
+        Keyframe::new(s(2.0), Value::Vec2([400.0, 0.0])),
+    ];
+    for k in &mut keys {
+        k.spatial_auto = false;
+    }
+    keys[1].roving = true;
+    assert!(retime_roving(&mut keys, true));
+    // 300 of 400 px → 75 % of the 2 s span.
+    assert!((keys[1].time.seconds() - 1.5).abs() < 1e-6, "{}", keys[1].time.seconds());
+    let v0 = speed(&keys, s(0.5), true);
+    let v1 = speed(&keys, s(1.8), true);
+    assert!((v0 - 200.0).abs() < 1.0 && (v1 - 200.0).abs() < 1.0, "{v0} {v1}");
+    // First/last keys can't rove.
+    keys[0].roving = true;
+    retime_roving(&mut keys, true);
+    assert!(!keys[0].roving);
+}
+
+#[test]
+fn roving_keys_never_share_a_time_with_a_fixed_key() {
+    // Zero-length last segment (issue #532) and zero-length first segment.
+    for xs in [[0.0, 40.0, 120.0, 120.0], [0.0, 0.0, 40.0, 120.0]] {
+        let mut keys: Vec<Keyframe> = xs.iter().enumerate().map(|(i, x)| Keyframe::new(s(i as f64), Value::Vec2([*x, 64.0]))).collect();
+        for k in &mut keys {
+            k.spatial_auto = false;
+        }
+        keys[1].roving = true;
+        keys[2].roving = true;
+        retime_roving(&mut keys, true);
+        assert!(keys.windows(2).all(|w| w[0].time < w[1].time), "{xs:?}: {:?}", keys.iter().map(|k| k.time).collect::<Vec<_>>());
+    }
+}
+
+#[test]
+fn side_ease_reports_linear_and_eased_sides() {
+    let keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(2.0), Value::Scalar(100.0)).eased()];
+    let out = side_ease(&keys, 0, 0, false, true).unwrap();
+    assert!((out.speed - 50.0).abs() < 1e-9);
+    let inn = side_ease(&keys, 1, 0, false, false).unwrap();
+    assert_eq!(inn, Ease::EASY);
+    assert!(side_ease(&keys, 0, 0, false, false).is_none());
+}
+
+#[test]
+fn time_reverse_mirrors_keys() {
+    let mut keys =
+        vec![Keyframe::new(s(1.0), Value::Scalar(0.0)).eased(), Keyframe::new(s(2.0), Value::Scalar(5.0)), Keyframe::new(s(4.0), Value::Scalar(10.0))];
+    keys[0].out_interp = Interp::Hold;
+    time_reverse(&mut keys);
+    assert_eq!(keys.iter().map(|k| k.time.seconds().round() as i64).collect::<Vec<_>>(), vec![1, 3, 4]);
+    assert_eq!(keys[0].value, Value::Scalar(10.0));
+    assert_eq!(keys[2].in_interp, Interp::Hold);
+}
+
+proptest::proptest! {
+    #[test]
+    fn eased_values_stay_in_range(t in 0.0f64..1.0, i0 in 0.01f64..1.0, i1 in 0.01f64..1.0) {
+        let mut a = Keyframe::new(s(0.0), Value::Scalar(0.0)).eased();
+        let mut b = Keyframe::new(s(1.0), Value::Scalar(10.0)).eased();
+        a.out_ease = vec![Ease { speed: 0.0, influence: i0 }];
+        b.in_ease = vec![Ease { speed: 0.0, influence: i1 }];
+        let v = evaluate(&[a, b], s(t), false).unwrap().as_f64();
+        proptest::prop_assert!((-1e-9..=10.0 + 1e-9).contains(&v));
+    }
+}
+
+#[test]
+fn muted_keys_are_skipped_by_evaluation() {
+    let mut keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), Keyframe::new(s(1.0), Value::Scalar(100.0)), Keyframe::new(s(2.0), Value::Scalar(300.0))];
+    let at = |keys: &[Keyframe], t: f64| evaluate(keys, s(t), false).unwrap().as_f64();
+    assert!((at(&keys, 0.5) - 50.0).abs() < 1e-9);
+    assert!((at(&keys, 1.5) - 200.0).abs() < 1e-9);
+    keys[1].muted = true;
+    // The 0 → 300 segment now spans 0 → 2 s.
+    assert!((at(&keys, 0.5) - 75.0).abs() < 1e-9);
+    assert!((at(&keys, 1.0) - 150.0).abs() < 1e-9);
+    assert!((at(&keys, 1.5) - 225.0).abs() < 1e-9);
+    for k in &mut keys {
+        k.muted = true;
+    }
+    assert!(evaluate(&keys, s(0.5), false).is_none());
+}
+
+#[test]
+fn muted_key_automation_uses_the_active_neighbours() {
+    let mut keys = vec![
+        Keyframe::new(s(0.0), Value::Vec2([0.0, 0.0])),
+        Keyframe::new(s(1.0), Value::Vec2([50.0, 100.0])),
+        Keyframe::new(s(2.0), Value::Vec2([100.0, 0.0])),
+    ];
+    for k in &mut keys {
+        k.auto_bezier = true;
+        k.in_interp = Interp::Bezier;
+        k.out_interp = Interp::Bezier;
+    }
+    let all = keys.clone();
+    let mut active = keys.clone();
+    active.remove(1);
+    keys[1].muted = true;
+    for t in [0.0, 0.25, 0.5, 1.0, 1.5, 1.75, 2.0] {
+        assert_eq!(evaluate(&keys, s(t), true), evaluate(&active, s(t), true), "{t}");
+    }
+    // The muted auto-Bezier key no longer bulges the motion path.
+    assert_ne!(evaluate(&keys, s(0.5), true), evaluate(&all, s(0.5), true));
+}
+
+#[test]
+fn mute_round_trips_and_survives_value_replacement() {
+    let mut k = Keyframe::new(s(0.0), Value::Scalar(1.0));
+    let json = serde_json::to_value(&k).unwrap();
+    assert!(json.get("muted").is_none(), "false is the default and is skipped");
+    k.muted = true;
+    let json = serde_json::to_value(&k).unwrap();
+    assert_eq!(json["muted"], serde_json::json!(true));
+    let back: Keyframe = serde_json::from_value(json).unwrap();
+    assert!(back.muted);
+    let mut keys = vec![k];
+    set_key(&mut keys, Keyframe::new(s(0.0), Value::Scalar(2.0)));
+    assert!(keys[0].muted);
+    assert_eq!(keys[0].value, Value::Scalar(2.0));
+}
diff --git a/crates/keyframe/src/text_doc.rs b/crates/keyframe/src/text_doc.rs
index 6c1e5b843..96a8b6be3 100644
--- a/crates/keyframe/src/text_doc.rs
+++ b/crates/keyframe/src/text_doc.rs
@@ -179,6 +179,31 @@ pub enum Composer {
 fn single_line() -> Composer {
     Composer::SingleLine
 }
+
+/// How the corners of a text stroke are drawn (Character panel Line Join).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum LineJoin {
+    /// Sharp corners (AE's default for new text).
+    #[default]
+    Miter,
+    Round,
+    Bevel,
+}
+
+impl LineJoin {
+    pub fn parse(s: &str) -> Option<LineJoin> {
+        Some(match s.to_ascii_lowercase().as_str() {
+            "miter" => LineJoin::Miter,
+            "round" => LineJoin::Round,
+            "bevel" => LineJoin::Bevel,
+            _ => return None,
+        })
+    }
+}
+
+fn round_join() -> LineJoin {
+    LineJoin::Round
+}
 fn yes() -> bool {
     true
 }
@@ -402,6 +427,9 @@ pub struct TextDoc {
     pub apply_fill: bool,
     pub apply_stroke: bool,
     pub stroke_over_fill: bool,
+    /// Documents saved before line joins existed drew round joins.
+    #[serde(default = "round_join")]
+    pub line_join: LineJoin,
     pub tracking: f64,
     /// None = auto (120% of size).
     pub leading: Option<f64>,
@@ -463,6 +491,7 @@ impl Default for TextDoc {
             apply_fill: true,
             apply_stroke: false,
             stroke_over_fill: true,
+            line_join: LineJoin::Miter,
             tracking: 0.0,
             leading: None,
             justify: Justify::Left,
@@ -909,6 +938,10 @@ impl TextDoc {
                 self.stroke_over_fill = v.as_bool().ok_or("strokeOverFill: expected a boolean")?;
                 return Ok(true);
             }
+            "lineJoin" => {
+                self.line_join = v.as_str().and_then(LineJoin::parse).ok_or("lineJoin: expected miter|round|bevel")?;
+                return Ok(true);
+            }
             "vertical" => {
                 self.vertical = v.as_bool().ok_or("vertical: expected a boolean")?;
                 return Ok(true);
@@ -1423,6 +1456,8 @@ mod tests {
         assert!(d.is_uniform());
         assert_eq!(d.style_at(2).size, 50.0);
         assert_eq!(d.composer, Composer::SingleLine, "old box text keeps greedy breaking");
+        assert_eq!(d.line_join, LineJoin::Round, "old strokes keep their round corners");
+        assert_eq!(TextDoc::default().line_join, LineJoin::Miter);
         assert!(d.ligatures);
         assert_eq!(d.kerning, Kerning::Metrics);
         // Round trip with runs.
diff --git a/crates/keyframe/src/value.rs b/crates/keyframe/src/value.rs
index 1dff4477f..6609aed68 100644
--- a/crates/keyframe/src/value.rs
+++ b/crates/keyframe/src/value.rs
@@ -82,7 +82,18 @@ impl ShapePath {
             if i == 0 && f.segment == 0 && !self.closed {
                 return false;
             }
-            if i > 0 && f.segment == i - 1 {
+            if i == 0 && self.closed && segs > 0 {
+                // The old closing segment and segment 0 merge into the new closing one.
+                if f.segment == segs {
+                    f.segment = segs - 1;
+                    f.t *= 0.5;
+                } else if f.segment == 0 {
+                    f.segment = segs - 1;
+                    f.t = 0.5 + f.t * 0.5;
+                } else {
+                    f.segment -= 1;
+                }
+            } else if i > 0 && f.segment == i - 1 {
                 f.t *= 0.5;
             } else if f.segment == i && i > 0 {
                 f.segment = i - 1;
diff --git a/crates/keyframe/tests/feather_remove.rs b/crates/keyframe/tests/feather_remove.rs
new file mode 100644
index 000000000..06836bbf6
--- /dev/null
+++ b/crates/keyframe/tests/feather_remove.rs
@@ -0,0 +1,14 @@
+use effectcraft_keyframe::{FeatherPoint, ShapePath};
+
+#[test]
+fn removing_first_vertex_of_closed_path_merges_closing_segment() {
+    let mut p = ShapePath::rect([0.0, 0.0], 10.0, 10.0);
+    let fp = |segment| FeatherPoint { segment, t: 0.5, radius: 1.0, tension: 0.0 };
+    p.feather = vec![fp(3), fp(0)];
+    p.vertices.remove(0);
+    p.in_tangents.remove(0);
+    p.out_tangents.remove(0);
+    p.feather_after_remove(0);
+    let got: Vec<(usize, f64)> = p.feather.iter().map(|f| (f.segment, f.t)).collect();
+    assert_eq!(got, vec![(2, 0.25), (2, 0.75)]);
+}
diff --git a/crates/lottie/src/anim.rs b/crates/lottie/src/anim.rs
index e3264e3b7..5b6dabf50 100644
--- a/crates/lottie/src/anim.rs
+++ b/crates/lottie/src/anim.rs
@@ -73,9 +73,22 @@ fn is_spatial(p: &Property) -> bool {
 }
 
 /// Export a property as a Lottie animatable property (`{a, k}` plus `x` for expressions).
-/// `label` names the property in warnings.
+/// `label` names the property in warnings. Muted keys are omitted: Lottie has no mute state, and
+/// the remaining keys carry the animation the renderer shows.
 pub(crate) fn export_prop(ex: &mut Ex, p: &Property, conv: &dyn Fn(&Value) -> Json, label: &str) -> Json {
-    let mut out = if p.keys.is_empty() { json!({"a": 0, "k": conv(&p.value)}) } else { json!({"a": 1, "k": export_keys(ex, p, conv)}) };
+    let muted = p.keys.iter().any(|k| k.muted);
+    if muted {
+        ex.warn(format!("{label}: muted keyframes are not exported"));
+    }
+    let active: Vec<Keyframe>;
+    let keys: &[Keyframe] = if muted {
+        active = p.keys.iter().filter(|k| !k.muted).cloned().collect();
+        &active
+    } else {
+        &p.keys
+    };
+    let mut out =
+        if keys.is_empty() { json!({"a": 0, "k": conv(&p.value)}) } else { json!({"a": 1, "k": export_keys(ex, keys, is_spatial(p), p.hold_only, conv)}) };
     if let Some(e) = p.expr.as_ref().filter(|e| e.enabled && !e.text.trim().is_empty()) {
         if ex.include_expressions {
             out["x"] = json!(e.text);
@@ -86,20 +99,18 @@ pub(crate) fn export_prop(ex: &mut Ex, p: &Property, conv: &dyn Fn(&Value) -> Js
     out
 }
 
-fn export_keys(ex: &Ex, p: &Property, conv: &dyn Fn(&Value) -> Json) -> Vec<Json> {
-    let keys = &p.keys;
-    let spatial = is_spatial(p);
+fn export_keys(ex: &Ex, keys: &[Keyframe], spatial: bool, hold_only: bool, conv: &dyn Fn(&Value) -> Json) -> Vec<Json> {
     let mut out = Vec::with_capacity(keys.len());
     for (i, k) in keys.iter().enumerate() {
         let mut o = json!({"t": r6(ex.tb.frame(k.time)), "s": wrap(conv(&k.value))});
         if i + 1 == keys.len() {
-            if k.out_interp == Interp::Hold || p.hold_only {
+            if k.out_interp == Interp::Hold || hold_only {
                 o["h"] = json!(1);
             }
             out.push(o);
             continue;
         }
-        if k.out_interp == Interp::Hold || p.hold_only || !k.value.interpolates() {
+        if k.out_interp == Interp::Hold || hold_only || !k.value.interpolates() {
             o["h"] = json!(1);
             out.push(o);
             continue;
@@ -139,11 +150,15 @@ fn segment_ease(keys: &[Keyframe], i: usize, spatial: bool) -> (Vec<f64>, Vec<f6
             let side = |k: &Keyframe, out: bool| {
                 let interp = if out { k.out_interp } else { k.in_interp };
                 let list = if out { &k.out_ease } else { &k.in_ease };
-                if interp == Interp::Bezier { list.first().copied().unwrap_or_default() } else { Ease { speed: 1.0 / dur, influence: 1.0 / 3.0 } }
+                if interp == Interp::Bezier {
+                    list.first().copied().unwrap_or_default()
+                } else {
+                    Ease { speed: 1.0 / dur, influence: kf::LINEAR_SIDE_INFLUENCE }
+                }
             };
             (1.0, Some(side(a, true)), Some(side(b, false)))
         };
-        let lin = Ease { speed: dv / dur, influence: 1.0 / 3.0 };
+        let lin = Ease { speed: dv / dur, influence: kf::LINEAR_SIDE_INFLUENCE };
         let (eo, ei) = (eo.unwrap_or(lin), ei.unwrap_or(lin));
         // Crossing time handles must retain the independently specified influences.
         let (i0, i1) = (eo.influence.clamp(0.0, 1.0), ei.influence.clamp(0.0, 1.0));
diff --git a/crates/lottie/src/import.rs b/crates/lottie/src/import.rs
index 7730017d8..57ef6427a 100644
--- a/crates/lottie/src/import.rs
+++ b/crates/lottie/src/import.rs
@@ -47,7 +47,9 @@ fn s<'a>(j: &'a Json, k: &str) -> Option<&'a str> {
 
 fn hex_color(sc: &str) -> [f32; 3] {
     let h = sc.trim_start_matches('#');
-    let c = |i: usize| h.get(i..i + 2).and_then(|x| u8::from_str_radix(x, 16).ok()).unwrap_or(0) as f32 / 255.0;
+    let c = |i: usize| {
+        h.get(i..i + 2).filter(|x| x.bytes().all(|b| b.is_ascii_hexdigit())).and_then(|x| u8::from_str_radix(x, 16).ok()).unwrap_or(0) as f32 / 255.0
+    };
     [c(0), c(2), c(4)]
 }
 
@@ -96,9 +98,11 @@ fn external_image(stored: &str, base_dir: &str) -> Result<String, String> {
         let doc = std::path::Path::new(base_dir).join("lottie.json");
         std::path::absolute(&doc).unwrap_or(doc)
     });
-    match craft_docpath::resolve(stored, doc.as_deref()) {
-        Ok(path) if path.is_absolute() => Ok(path.to_string_lossy().into_owned()),
-        Ok(_) => Err(format!("{stored} is relative and the Lottie file's folder is not known")),
+    match craft_docpath::resolve_absolute(stored, doc.as_deref()) {
+        Ok(path) => Ok(path.to_string_lossy().into_owned()),
+        Err(craft_docpath::Refused::Invalid) if doc.is_none() && craft_docpath::resolve(stored, None).is_ok() => {
+            Err(format!("{stored} is relative and the Lottie file's folder is not known"))
+        }
         Err(why) => Err(format!("{stored}: {why}")),
     }
 }
@@ -131,6 +135,17 @@ pub fn import(
             cx.fonts.push((n, fam, st));
         }
     }
+    // Glyph outlines embedded for players without the fonts. Text is set in installed fonts.
+    if let Some(chars) = doc.get("chars").and_then(Json::as_array).filter(|c| !c.is_empty()) {
+        let mut fams: Vec<&str> = vec![];
+        for fam in chars.iter().filter_map(|c| s(c, "fFamily")).filter(|f| !f.trim().is_empty()) {
+            if !fams.contains(&fam) {
+                fams.push(fam);
+            }
+        }
+        let of = if fams.is_empty() { String::new() } else { format!(" of {}", fams.join(", ")) };
+        cx.im.warn(format!("embedded glyphs (`chars`){of} are not imported; text uses the installed fonts"));
+    }
     let (w, h) = (w.round().max(1.0) as u32, h.round().max(1.0) as u32);
     let duration = tb.tick(op);
     // Pass 1: asset items (precomps empty for now, images stored).
@@ -139,7 +154,9 @@ pub fn import(
         let Some(id) = s(a, "id") else { continue };
         if a.get("layers").is_some() {
             let folder = cx.folder(project);
-            let (aw, ah) = (f(a, "w").map(|v| v as u32).unwrap_or(w), f(a, "h").map(|v| v as u32).unwrap_or(h));
+            let layer = precomp_layer_size(&doc, &assets, id);
+            let aw = f(a, "w").map(|v| v as u32).or(layer.map(|l| l.0)).unwrap_or(w);
+            let ah = f(a, "h").map(|v| v as u32).or(layer.map(|l| l.1)).unwrap_or(h);
             let arate = f(a, "fr").map(FrameRate::from_f64).unwrap_or(rate);
             let c = Comp::new(aw, ah, arate, duration);
             let nm = s(a, "nm").unwrap_or(id).to_string();
@@ -238,6 +255,19 @@ pub fn import(
     Ok(ImportResult { comp: id, items: cx.items, warnings: cx.im.warnings })
 }
 
+/// The `w`/`h` of the first precomp layer, in the main comp or in any asset, that shows asset `id`.
+/// lottie-spec gives a precomposition asset no size: the layer's `w`/`h` are its clipping rect.
+fn precomp_layer_size(doc: &Json, assets: &[Json], id: &str) -> Option<(u32, u32)> {
+    let lists = doc.get("layers").into_iter().chain(assets.iter().filter_map(|a| a.get("layers")));
+    lists.filter_map(Json::as_array).flatten().find_map(|l| {
+        if l.get("ty").and_then(Json::as_u64) != Some(0) || s(l, "refId") != Some(id) {
+            return None;
+        }
+        let (lw, lh) = f(l, "w").zip(f(l, "h"))?;
+        Some((lw.round().max(1.0) as u32, lh.round().max(1.0) as u32))
+    })
+}
+
 fn transform(im: &Im, ks: &Json, tr: &mut PropGroup, next: &mut u64) {
     let set = |tr: &mut PropGroup, m: &str, j: Option<&Json>, conv: &dyn Fn(&Json) -> Option<Value>| {
         if let (Some(j), Some(p)) = (j, tr.get_mut(m)) {
@@ -286,7 +316,8 @@ fn masks(im: &Im, ids: &mut Ids, list: &[Json], g: &mut PropGroup) {
                 import_prop(im, j, p, conv);
             }
         };
-        set("pt", "path", &shapes::to_path);
+        let closed = m.get("cl").and_then(Json::as_bool).unwrap_or(false);
+        set("pt", "path", &|v| shapes::to_path(v, closed));
         set("o", "opacity", &anim::to_scalar);
         set("x", "expansion", &anim::to_scalar);
         set("f", "feather", &anim::to_vec2);
@@ -397,7 +428,19 @@ fn build_layers(cx: &mut Ctx, project: &mut Project, comp: &mut Comp, layers: &[
         l.in_point = tb.tick(ip);
         l.out_point = tb.tick(op.max(ip));
         l.start_time = tb.tick(f(j, "st").unwrap_or(0.0));
-        l.stretch = f(j, "sr").unwrap_or(1.0) * 100.0;
+        // Below 1 % (or 0) the layer time divides by ~0, and layer.timeStretch refuses it too.
+        let sr = f(j, "sr").unwrap_or(1.0);
+        l.stretch = if sr.is_finite() && sr.abs() >= 0.01 {
+            // Past ±9900 % too (#3247): the largest stretch a layer supports, sign kept.
+            let pct = effectcraft_project::limits::stretch(sr * 100.0);
+            if pct.to_bits() != (sr * 100.0).to_bits() {
+                cx.im.warn(format!("{name}: a time stretch of {} % is not supported ({pct} % used)", sr * 100.0));
+            }
+            pct
+        } else {
+            cx.im.warn(format!("{name}: a time stretch of {} % is not supported (100 % used)", sr * 100.0));
+            100.0
+        };
         if j.get("ddd").and_then(Json::as_u64) == Some(1) {
             l.switches.three_d = true;
         }
@@ -483,3 +526,15 @@ fn build_layers(cx: &mut Ctx, project: &mut Project, comp: &mut Comp, layers: &[
         }
     }
 }
+
+#[cfg(test)]
+mod hex_color_tests {
+    use super::hex_color;
+
+    #[test]
+    fn hex_color_rejects_plus_sign() {
+        assert_eq!(hex_color("#+f0000"), [0.0, 0.0, 0.0]);
+        assert_eq!(hex_color("#zz0000"), [0.0, 0.0, 0.0]);
+        assert_eq!(hex_color("#ff0000"), [1.0, 0.0, 0.0]);
+    }
+}
diff --git a/crates/lottie/src/shapes.rs b/crates/lottie/src/shapes.rs
index 1283a2497..fab8d3646 100644
--- a/crates/lottie/src/shapes.rs
+++ b/crates/lottie/src/shapes.rs
@@ -3,8 +3,8 @@
 
 use effectcraft_color::BlendMode;
 use effectcraft_keyframe::{Gradient, ShapePath, Value};
-use effectcraft_project::build::{self, Ids};
-use effectcraft_project::{Node, PropGroup};
+use effectcraft_project::build::{self, EXTRA_DASHES, Ids};
+use effectcraft_project::{Node, ParamUi, PropGroup};
 use serde_json::{Map, Value as Json, json};
 
 use crate::anim::{self, Ex, Im, export_prop, import_prop};
@@ -27,7 +27,9 @@ pub(crate) fn path_value(v: &Value) -> Json {
     }
 }
 
-pub(crate) fn to_path(j: &Json) -> Option<Value> {
+/// A Lottie path. `closed` is used when the path has no `c`: Bodymovin 3.x and early 4.x keep the
+/// flag outside the path, as `cl` on a mask and `closed` on an `sh` item.
+pub(crate) fn to_path(j: &Json, closed: bool) -> Option<Value> {
     let o = match j {
         Json::Array(a) => a.first()?,
         o => o,
@@ -48,7 +50,7 @@ pub(crate) fn to_path(j: &Json) -> Option<Value> {
         in_tangents: fit(pts("i")),
         out_tangents: fit(pts("o")),
         vertices,
-        closed: o.get("c").and_then(Json::as_bool).unwrap_or(false),
+        closed: o.get("c").and_then(Json::as_bool).unwrap_or(closed),
         feather: Vec::new(),
     }))
 }
@@ -113,6 +115,9 @@ impl Out<'_, '_> {
     fn f(&self, m: &str) -> f64 {
         self.g.get(m).map(|p| p.value.as_f64()).unwrap_or(0.0)
     }
+    fn flag(&self, m: &str) -> bool {
+        self.g.get(m).map(|p| p.value.as_bool()).unwrap_or(false)
+    }
     fn animated(&self, m: &str) -> bool {
         self.g.get(m).is_some_and(|p| p.is_animated() || p.has_expression())
     }
@@ -232,7 +237,20 @@ pub(crate) fn export_items(ex: &mut Ex, contents: &PropGroup, label: &str) -> Ve
                 dir(&mut o);
                 o.put("s", "size", &anim::arr2);
                 o.put("p", "position", &anim::arr2);
-                o.put("r", "roundness", &anim::num);
+                if o.flag("perCorner") {
+                    let names = ["topLeftRoundness", "topRightRoundness", "bottomRightRoundness", "bottomLeftRoundness"];
+                    let radii = names.map(|m| o.f(m));
+                    // Lottie `rc` has one `r`: four equal static radii export as that value.
+                    // `r` is a property (`{a, k}`) like the uniform branch writes, not a bare number.
+                    if radii.iter().all(|v| (v - radii[0]).abs() < 1e-6) && !names.iter().any(|m| o.animated(m)) && radii[0] >= 0.0 {
+                        o.raw("r", json!({"a": 0, "k": r(radii[0])}));
+                    } else {
+                        o.ex.warn(format!("{}: per-corner roundness has no Lottie rectangle equivalent (roundness 0 exported)", o.label));
+                        o.raw("r", json!({"a": 0, "k": 0}));
+                    }
+                } else {
+                    o.put("r", "roundness", &anim::num);
+                }
             }
             "el" => {
                 dir(&mut o);
@@ -356,7 +374,7 @@ fn import_blend(j: &Json, g: &mut PropGroup) {
     }
 }
 
-fn import_stroke(im: &Im, j: &Json, g: &mut PropGroup) {
+fn import_stroke(im: &Im, ids: &mut Ids, j: &Json, g: &mut PropGroup) {
     set(im, g, "width", j.get("w"), &anim::to_scalar);
     if let Some(lc) = int(j, "lc") {
         set_enum(g, "cap", lc.saturating_sub(1).clamp(0, 2) as u32);
@@ -374,17 +392,32 @@ fn import_stroke(im: &Im, j: &Json, g: &mut PropGroup) {
     if let Some(list) = j.get("d").and_then(Json::as_array)
         && let Some(d) = g.sub_mut("dashes")
     {
-        let mut seen_dash = false;
+        // The n-th `d` and `g` are the n-th Dash/Gap pair; the extra pairs are created as the Dashes "+" does.
+        let (mut dashes, mut gaps) = (0, 0);
         for e in list {
-            let m = match e.get("n").and_then(Json::as_str) {
-                Some("d") if !seen_dash => {
-                    seen_dash = true;
-                    "dash"
+            let (n, pair) = match e.get("n").and_then(Json::as_str) {
+                Some("d") => (&mut dashes, 0),
+                Some("g") => (&mut gaps, 1),
+                Some("o") => {
+                    set(im, d, "offset", e.get("v"), &anim::to_scalar);
+                    continue;
                 }
-                Some("g") => "gap",
-                Some("o") => "offset",
                 _ => continue,
             };
+            let k = *n;
+            *n += 1;
+            let m = match k {
+                0 => ["dash", "gap"][pair],
+                _ => {
+                    let Some(&(dm, gm)) = EXTRA_DASHES.get(k - 1) else { continue };
+                    if d.get(dm).is_none() {
+                        let at = d.children.iter().position(|c| c.match_id() == "offset").unwrap_or(d.children.len());
+                        d.children.insert(at, ids.prop(gm, &format!("Gap {}", k + 1), Value::Scalar(0.0)).with_ui(ParamUi::Pixels).into());
+                        d.children.insert(at, ids.prop(dm, &format!("Dash {}", k + 1), Value::Scalar(0.0)).with_ui(ParamUi::Pixels).into());
+                    }
+                    [dm, gm][pair]
+                }
+            };
             set(im, d, m, e.get("v"), &anim::to_scalar);
         }
     }
@@ -432,6 +465,11 @@ pub(crate) fn import_items(im: &mut Im, ids: &mut Ids, items: &[Json]) -> Vec<Pr
                 set(im, &mut g, "size", j.get("s"), &anim::to_vec2);
                 set(im, &mut g, "position", j.get("p"), &anim::to_vec2);
                 set(im, &mut g, "roundness", j.get("r"), &anim::to_scalar);
+                // Lottie has one roundness: keep the per-corner values in step so ticking the box
+                // on an imported rectangle keeps the shape.
+                for m in ["topLeftRoundness", "topRightRoundness", "bottomRightRoundness", "bottomLeftRoundness"] {
+                    set(im, &mut g, m, j.get("r"), &anim::to_scalar);
+                }
                 g
             }
             "el" => {
@@ -457,7 +495,8 @@ pub(crate) fn import_items(im: &mut Im, ids: &mut Ids, items: &[Json]) -> Vec<Pr
             "sh" => {
                 let mut g = build::shape_path(ids, ShapePath::default());
                 dir(&mut g);
-                set(im, &mut g, "path", j.get("ks"), &to_path);
+                let closed = j.get("closed").and_then(Json::as_bool).unwrap_or(false);
+                set(im, &mut g, "path", j.get("ks"), &|v| to_path(v, closed));
                 g
             }
             "fl" => {
@@ -474,7 +513,7 @@ pub(crate) fn import_items(im: &mut Im, ids: &mut Ids, items: &[Json]) -> Vec<Pr
                 let mut g = build::shape_stroke(ids, [1.0, 1.0, 1.0, 1.0], 2.0);
                 set(im, &mut g, "color", j.get("c"), &anim::to_color);
                 set(im, &mut g, "opacity", j.get("o"), &anim::to_scalar);
-                import_stroke(im, j, &mut g);
+                import_stroke(im, ids, j, &mut g);
                 import_blend(j, &mut g);
                 g
             }
@@ -501,7 +540,7 @@ pub(crate) fn import_items(im: &mut Im, ids: &mut Ids, items: &[Json]) -> Vec<Pr
                         set_enum(&mut g, "rule", 1);
                     }
                 } else {
-                    import_stroke(im, j, &mut g);
+                    import_stroke(im, ids, j, &mut g);
                 }
                 import_blend(j, &mut g);
                 g
diff --git a/crates/lottie/src/tests.rs b/crates/lottie/src/tests.rs
index e819c0239..414c875f0 100644
--- a/crates/lottie/src/tests.rs
+++ b/crates/lottie/src/tests.rs
@@ -407,6 +407,30 @@ fn offset_paths_miter_uses_animatable_lottie_value() {
     assert_eq!(second.get("miter").unwrap().value, Value::Scalar(6.0));
 }
 
+#[test]
+fn extra_dash_gap_pairs_survive_a_roundtrip() {
+    let (mut p, cid) = setup();
+    let l = shape_layer(&mut p, cid, |ids| {
+        let mut stroke = build::shape_stroke(ids, [0.0, 0.0, 1.0, 1.0], 3.0);
+        let d = stroke.sub_mut("dashes").unwrap();
+        d.get_mut("dash").unwrap().value = Value::Scalar(10.0);
+        d.get_mut("gap").unwrap().value = Value::Scalar(5.0);
+        let at = d.children.iter().position(|n| n.match_id() == "offset").unwrap();
+        d.children.insert(at, ids.prop("gap2", "Gap 2", Value::Scalar(3.0)).into());
+        d.children.insert(at, ids.prop("dash2", "Dash 2", Value::Scalar(20.0)).into());
+        let rect = build::shape_rect(ids, [60.0, 40.0], [0.0, 0.0], 0.0);
+        vec![build::shape_group(ids, "G", vec![rect, stroke])]
+    });
+    push(&mut p, cid, l);
+    let (q, nc, _, _) = roundtrip(&p, cid, &ExportOptions::default());
+    let c = q.comp(nc).unwrap();
+    let g = c.layers[0].props.sub("contents").unwrap().groups().next().unwrap();
+    let stroke = g.sub("contents").unwrap().groups().find(|g| g.match_id == "stroke").unwrap();
+    let d = stroke.sub("dashes").unwrap();
+    let v = |m: &str| d.get(m).map(|p| p.value.as_f64());
+    assert_eq!((v("dash"), v("gap"), v("dash2"), v("gap2")), (Some(10.0), Some(5.0), Some(20.0), Some(3.0)));
+}
+
 // ---------------------------------------------------------------- layers
 
 #[test]
@@ -484,6 +508,71 @@ fn layers_parenting_timing_mattes_masks_and_blend_modes() {
     compare_renders(&p, cid, &q, nc, 2.0 / 255.0);
 }
 
+#[test]
+fn zero_time_stretch_is_not_imported() {
+    let doc = json!({"w": 20, "h": 20, "fr": 30, "ip": 0, "op": 30, "assets": [],
+        "layers": [{"ty": 1, "ind": 1, "sc": "#ff0000", "sw": 20, "sh": 20, "sr": 0, "ip": 0, "op": 30, "st": 0, "ks": {}}]});
+    let mut q = Project::default();
+    let imp = import(&mut q, doc.to_string().as_bytes(), "Imported", "", &mut |_| None).unwrap();
+    let l = &q.comp(imp.comp).unwrap().layers[0];
+    // layer.timeStretch refuses anything below 1 %, and keyframe commands refuse a layer with 0 %.
+    assert_eq!(l.stretch, 100.0);
+    assert!(imp.warnings.iter().any(|w| w.contains("time stretch")), "{:?}", imp.warnings);
+}
+
+#[test]
+fn a_time_stretch_past_9900_percent_is_held_to_it() {
+    // `sr` 1e300 was imported as 1e302 % (#3247); the sign of a reversed layer is kept.
+    for (sr, want) in [(1e300, 9900.0), (-1e300, -9900.0), (99.0, 9900.0)] {
+        let doc = json!({"w": 20, "h": 20, "fr": 30, "ip": 0, "op": 30, "assets": [],
+            "layers": [{"ty": 1, "ind": 1, "sc": "#ff0000", "sw": 20, "sh": 20, "sr": sr, "ip": 0, "op": 30, "st": 0, "ks": {}}]});
+        let mut q = Project::default();
+        let imp = import(&mut q, doc.to_string().as_bytes(), "Imported", "", &mut |_| None).unwrap();
+        let l = &q.comp(imp.comp).unwrap().layers[0];
+        assert_eq!(l.stretch, want, "sr {sr}");
+        let warned = imp.warnings.iter().any(|w| w.contains("time stretch"));
+        assert_eq!(warned, sr != 99.0, "sr {sr}: {:?}", imp.warnings);
+    }
+}
+
+#[test]
+fn embedded_glyphs_are_reported_when_dropped() {
+    let glyph = |ch: &str, fam: &str| json!({"ch": ch, "size": 100, "style": "Regular", "w": 60, "fFamily": fam, "data": {"shapes": []}});
+    let doc = json!({"w": 20, "h": 20, "fr": 30, "ip": 0, "op": 30, "assets": [], "layers": [],
+        "fonts": {"list": [{"fName": "Sans-Regular", "fFamily": "Sans", "fStyle": "Regular"}]},
+        "chars": [glyph("A", "Sans"), glyph("B", ""), glyph("C", "Serif")]});
+    let warnings = |doc: &Json| import(&mut Project::default(), doc.to_string().as_bytes(), "Imported", "", &mut |_| None).unwrap().warnings;
+    // A blank family name is left out, not listed as "of , …".
+    assert_eq!(warnings(&doc), ["embedded glyphs (`chars`) of Sans, Serif are not imported; text uses the installed fonts"]);
+    let blank = json!({"w": 20, "h": 20, "fr": 30, "layers": [], "chars": [glyph("A", " ")]});
+    assert_eq!(warnings(&blank), ["embedded glyphs (`chars`) are not imported; text uses the installed fonts"]);
+}
+
+#[test]
+fn legacy_closed_flags_close_masks_and_paths() {
+    // Bodymovin 3.x and early 4.x put the closed flag on the mask (`cl`) and on the `sh` item
+    // (`closed`), with no `c` in the path. An open mask would leave the solid whole.
+    let square = json!({"i": [[0, 0], [0, 0], [0, 0], [0, 0]], "o": [[0, 0], [0, 0], [0, 0], [0, 0]], "v": [[5, 5], [15, 5], [15, 15], [5, 15]]});
+    let doc = json!({"w": 20, "h": 20, "fr": 30, "ip": 0, "op": 30, "assets": [], "layers": [
+        {"ty": 4, "ind": 1, "ip": 0, "op": 30, "st": 0, "ks": {},
+         "shapes": [{"ty": "sh", "closed": true, "ks": {"k": [{"t": 0, "s": [square], "e": [square]}, {"t": 10}]}}]},
+        {"ty": 1, "ind": 2, "sc": "#ff0000", "sw": 20, "sh": 20, "ip": 0, "op": 30, "st": 0, "ks": {},
+         "masksProperties": [{"mode": "a", "cl": true, "pt": {"k": square}}]}]});
+    let mut q = Project::default();
+    let nc = import(&mut q, doc.to_string().as_bytes(), "Imported", "", &mut |_| None).unwrap().comp;
+    let comp = q.comp(nc).unwrap();
+    let closed = |v: &Value| matches!(v, Value::Path(sp) if sp.closed);
+    let shape = comp.layers[0].props.sub("contents").unwrap().groups().next().unwrap();
+    let keys = &shape.get("path").unwrap().keys;
+    assert_eq!(keys.len(), 2);
+    assert!(keys.iter().all(|k| closed(&k.value)));
+    let mask = comp.layers[1].masks().unwrap().groups().next().unwrap();
+    assert!(closed(&mask.get("path").unwrap().value));
+    let img = render_frame(&q, nc, s(0.0), 1.0);
+    assert_eq!(img.data[0][3], 0.0, "the mask cuts the corner away");
+    assert!(img.data[10 * 20 + 10][3] > 0.99);
+}
+
 #[test]
 fn precomp_with_time_remap() {
     let (mut p, cid) = setup();
@@ -515,6 +604,19 @@ fn precomp_with_time_remap() {
     compare_renders(&p, cid, &q, nc, 2.0 / 255.0);
 }
 
+#[test]
+fn precomp_size_comes_from_the_layer_when_the_asset_has_none() {
+    // lottie-spec: a precomposition asset has no `w`/`h`; the precomp layer carries them.
+    let doc = json!({"w": 200, "h": 120, "fr": 30, "ip": 0, "op": 30,
+        "assets": [{"id": "c", "layers": []}],
+        "layers": [{"ty": 0, "ind": 1, "refId": "c", "w": 50, "h": 40, "ip": 0, "op": 30, "st": 0, "ks": {}}]});
+    let mut q = Project::default();
+    let nc = import(&mut q, doc.to_string().as_bytes(), "Imported", "", &mut |_| None).unwrap().comp;
+    let LayerSource::Comp { item } = q.comp(nc).unwrap().layers[0].source else { panic!("not a precomp") };
+    let pc = q.comp(item).unwrap();
+    assert_eq!((pc.width, pc.height), (50, 40));
+}
+
 #[test]
 fn text_layers_roundtrip_as_text_and_as_shapes() {
     let (mut p, cid) = setup();
@@ -829,3 +931,57 @@ fn external_images_are_local_or_skipped() {
     assert_eq!(std::path::Path::new(&paths[0]), base.join("images").join("a.png"));
     assert_eq!(r.warnings.iter().filter(|w| w.contains("is not imported")).count(), assets.len() - 1, "{:?}", r.warnings);
 }
+
+#[test]
+fn muted_keys_are_omitted_from_the_export() {
+    let (mut p, cid) = setup();
+    let mut l = solid_layer(&mut p, cid, [0.0, 1.0, 0.0], 20, 20);
+    let mut b = Keyframe::new(s(1.0), Value::Scalar(100.0));
+    b.muted = true;
+    l.props.prop_mut("transform/opacity").unwrap().keys = vec![Keyframe::new(s(0.0), Value::Scalar(0.0)), b, Keyframe::new(s(2.0), Value::Scalar(300.0))];
+    push(&mut p, cid, l);
+    let (q, nc, warnings, json) = roundtrip(&p, cid, &ExportOptions::default());
+    assert!(warnings.iter().any(|w| w.contains("muted keyframes")), "{warnings:?}");
+    // Lottie has no mute state: the two active keys carry the 0 → 300 animation.
+    assert_eq!(json["layers"][0]["ks"]["o"]["k"].as_array().unwrap().len(), 2);
+    assert_eq!(json["layers"][0]["ks"]["o"]["k"][1]["s"], json!([300.0]));
+    let opacity_at = |p: &Project, cid: ItemId, t: f64| p.comp(cid).unwrap().layers[0].props.prop("transform/opacity").unwrap().value_at(s(t)).as_f64();
+    assert!((opacity_at(&p, cid, 1.0) - 150.0).abs() < 1e-6);
+    assert!((opacity_at(&q, nc, 1.0) - 150.0).abs() < 1e-6);
+}
+
+#[test]
+fn per_corner_roundness_exports_equal_radii_and_warns_when_mixed() {
+    let shape = |radii: [f64; 4], roundness: f64, per_corner: bool| {
+        let (mut p, cid) = setup();
+        let l = shape_layer(&mut p, cid, move |ids| {
+            let mut g = build::shape_rect(ids, [100.0, 50.0], [0.0, 0.0], roundness);
+            g.prop_mut("perCorner").unwrap().value = Value::Bool(per_corner);
+            for (m, v) in
+                [("topLeftRoundness", radii[0]), ("topRightRoundness", radii[1]), ("bottomRightRoundness", radii[2]), ("bottomLeftRoundness", radii[3])]
+            {
+                g.prop_mut(m).unwrap().value = Value::Scalar(v);
+            }
+            let fill = build::shape_fill(ids, [1.0, 0.0, 0.0, 1.0]);
+            vec![build::shape_group(ids, "Rectangle 1", vec![g, fill])]
+        });
+        push(&mut p, cid, l);
+        (p, cid)
+    };
+    let rc = |json: &Json| -> Json { json["layers"][0]["shapes"][0]["it"].as_array().unwrap().iter().find(|i| i["ty"] == "rc").cloned().unwrap() };
+    // Four equal static radii: `rc.r` carries the value, no warning.
+    let (p, cid) = shape([12.0; 4], 5.0, true);
+    let (_, _, warnings, json) = roundtrip(&p, cid, &ExportOptions::default());
+    assert_eq!(rc(&json)["r"], json!({"a": 0, "k": 12.0}));
+    assert!(!warnings.iter().any(|w| w.contains("per-corner")), "{warnings:?}");
+    // Mixed radii: not representable, roundness 0 exported with a warning.
+    let (p, cid) = shape([10.0, 20.0, 10.0, 20.0], 5.0, true);
+    let (_, _, warnings, json) = roundtrip(&p, cid, &ExportOptions::default());
+    assert_eq!(rc(&json)["r"], json!({"a": 0, "k": 0}));
+    assert!(warnings.iter().any(|w| w.contains("per-corner roundness")), "{warnings:?}");
+    // The checkbox off exports the single Roundness and ignores the four values.
+    let (p, cid) = shape([10.0, 20.0, 10.0, 20.0], 5.0, false);
+    let (_, _, warnings, json) = roundtrip(&p, cid, &ExportOptions::default());
+    assert_eq!(rc(&json)["r"]["k"], json!(5.0));
+    assert!(!warnings.iter().any(|w| w.contains("per-corner")), "{warnings:?}");
+}
diff --git a/crates/media/Cargo.toml b/crates/media/Cargo.toml
index 0ef01d831..4947d928a 100644
--- a/crates/media/Cargo.toml
+++ b/crates/media/Cargo.toml
@@ -12,6 +12,7 @@ workspace = true
 [dependencies]
 craft-docpath = { workspace = true }
 effectcraft-time = { workspace = true }
+effectcraft-color = { workspace = true }
 effectcraft-project = { workspace = true }
 effectcraft-raster = { workspace = true }
 effectcraft-render = { workspace = true }
@@ -21,12 +22,13 @@ effectcraft-pdf = { workspace = true }
 effectcraft-model = { workspace = true }
 filmcraft-codecs = { workspace = true }
 filmcraft-media = { workspace = true }
+filmcraft-aac = { workspace = true }
 filmcraft-isobmff = { workspace = true }
+filmcraft-matroska = { workspace = true }
+filmcraft-mpegts = { workspace = true }
 filmcraft-frame = { workspace = true }
 filmcraft-color = { workspace = true }
 filmcraft-time = { workspace = true }
-# AIFF import (#1428): enables the aiff reader of filmcraft-codecs' symphonia.
-symphonia = { workspace = true }
 exr = { workspace = true }
 gif = { workspace = true }
 image = { workspace = true, features = ["gif", "webp", "tiff", "bmp", "exr", "tga", "hdr"] }
@@ -34,3 +36,7 @@ rayon = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
+
+[dev-dependencies]
+# (tests render comps that read layers through effects; already a dependency of effectcraft-render)
+effectcraft-effects = { workspace = true }
diff --git a/crates/media/src/aac.rs b/crates/media/src/aac.rs
new file mode 100644
index 000000000..625c37b43
--- /dev/null
+++ b/crates/media/src/aac.rs
@@ -0,0 +1,116 @@
+//! The AudioSpecificConfig of the AAC track FilmCraft plays from a movie, from the containers that carry
+//! it outside the audio frames: MP4 / MOV (`esds`), Matroska (`CodecPrivate`) and LATM in MPEG
+//! TS / PS (its StreamMuxConfig). FilmCraft's other AAC is ADTS (in MPEG TS / PS or a raw `.aac`),
+//! whose channel configurations FilmCraft decodes (1 to 7) its channel count tells apart
+//! ([`crate::downmix::Order::Aac`]).
+
+use std::io;
+
+use filmcraft_aac::AudioSpecificConfig;
+use filmcraft_media::ByteReader;
+
+/// How far into an MPEG TS / PS file the audio streams are looked for: the stream is indexed as
+/// far as this, not through the whole file.
+const MPEG_HEAD: u64 = 8 << 20;
+
+/// The configuration of the audio track FilmCraft plays, if it is AAC: from an MP4 / MOV `header`
+/// (its ftyp and moov, or the whole file) and `file`, or else from `file`, read as Matroska or
+/// MPEG TS / PS.
+pub(crate) fn config(header: Option<&[u8]>, file: Option<&dyn ByteReader>) -> Option<AudioSpecificConfig> {
+    let asc = match header.and_then(|h| mp4(h, file)) {
+        Some(asc) => asc,
+        None => {
+            let file = file?;
+            let mut magic = [0u8; 4];
+            file.read_at(0, &mut magic).ok()?;
+            if magic == [0x1A, 0x45, 0xDF, 0xA3] { matroska(file)? } else { latm(file)? }
+        }
+    };
+    AudioSpecificConfig::parse(&asc).ok()
+}
+
+/// The track FilmCraft's MP4 source plays: the first audio track with samples, a sample
+/// description and a timescale, read from the whole file as it is (a fragmented movie's samples
+/// are in its fragments, not the `moov`).
+fn mp4(header: &[u8], file: Option<&dyn ByteReader>) -> Option<Vec<u8>> {
+    let mp4 = match file {
+        Some(f) => filmcraft_isobmff::open(Head(f, f.len())),
+        None => filmcraft_isobmff::open(header),
+    };
+    let mp4 = mp4.ok()?;
+    let playable =
+        |t: &&filmcraft_isobmff::Track| t.kind == filmcraft_isobmff::TrackKind::Audio && !t.samples.is_empty() && !t.entries.is_empty() && t.timescale > 0;
+    let track = mp4.tracks.iter().find(playable)?;
+    match &track.entries.first()?.codec {
+        filmcraft_isobmff::CodecConfig::Aac(a) => Some(a.asc.clone()),
+        _ => None,
+    }
+}
+
+/// The track FilmCraft's Matroska source plays: the first audio track with frames, found by
+/// indexing the clusters as that source does.
+fn matroska(file: &dyn ByteReader) -> Option<Vec<u8>> {
+    let mkv = filmcraft_matroska::open(Head(file, file.len())).ok()?;
+    match &mkv.tracks.iter().find(|t| t.kind == filmcraft_matroska::TrackKind::Audio && !t.samples.is_empty())?.codec {
+        filmcraft_matroska::Codec::Aac { asc } => Some(asc.clone()),
+        _ => None,
+    }
+}
+
+/// The configuration of the stream FilmCraft's MPEG source plays: the first audio stream whose
+/// first unit it can read. Only AAC is asked about, so the streams before that one were refused
+/// whatever their codec, and an ADTS stream played has no configuration outside its frames.
+fn latm(file: &dyn ByteReader) -> Option<Vec<u8>> {
+    use filmcraft_mpegts::Codec;
+    let head = Head(file, file.len().min(MPEG_HEAD));
+    let mpeg = filmcraft_mpegts::open(&head).ok()?;
+    let audio = mpeg.streams.iter().enumerate().filter(|(_, s)| s.kind() == filmcraft_mpegts::Kind::Audio && !s.units.is_empty());
+    let played = audio.take(filmcraft_media::MAX_AUDIO_STREAMS).find_map(|(i, s)| {
+        let first = mpeg.read_unit(&head, i, 0).ok()?;
+        match s.codec {
+            Codec::AacAdts => filmcraft_mpegts::frame_info(&s.codec, &first).map(|_| None),
+            Codec::AacLatm => filmcraft_codecs::audio::latm_config(&first).map(|c| Some(c.asc)),
+            _ => None,
+        }
+    });
+    played?
+}
+
+/// The first `.1` bytes of a file, as the byte source FilmCraft's demuxers read.
+struct Head<'a>(&'a dyn ByteReader, u64);
+
+impl Head<'_> {
+    fn read(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        match offset.checked_add(buf.len() as u64) {
+            Some(end) if end <= self.1 => self.0.read_at(offset, buf),
+            _ => Err(io::Error::new(io::ErrorKind::UnexpectedEof, "read past the end")),
+        }
+    }
+}
+
+impl filmcraft_isobmff::ByteSource for Head<'_> {
+    fn len(&self) -> u64 {
+        self.1
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.read(offset, buf)
+    }
+}
+
+impl filmcraft_matroska::ByteSource for Head<'_> {
+    fn len(&self) -> u64 {
+        self.1
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.read(offset, buf)
+    }
+}
+
+impl filmcraft_mpegts::ByteSource for Head<'_> {
+    fn len(&self) -> u64 {
+        self.1
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.read(offset, buf)
+    }
+}
diff --git a/crates/media/src/convert.rs b/crates/media/src/convert.rs
index d483e4b47..a2b24b3ae 100644
--- a/crates/media/src/convert.rs
+++ b/crates/media/src/convert.rs
@@ -103,12 +103,34 @@ pub(crate) fn frame_to_image_in(f: &VideoFrame, op: AlphaOp, mut buf: Vec<Px>) -
         PixelData::Yuv8 { planes, chroma, alpha } => {
             let yuv = Yuv::new(f.color.matrix, f.color.range, 8);
             let amax = 255.0;
-            convert_yuv(&mut img, w, h, *chroma, [&planes[0][..], &planes[1][..], &planes[2][..]], alpha.as_deref().map(|a| &a[..]), amax, &yuv, op);
+            convert_yuv(
+                &mut img,
+                YuvSource {
+                    size: (w, h),
+                    chroma: *chroma,
+                    planes: [&planes[0][..], &planes[1][..], &planes[2][..]],
+                    alpha: alpha.as_deref().map(|a| &a[..]),
+                    amax,
+                },
+                &yuv,
+                op,
+            );
         }
         PixelData::Yuv16 { planes, chroma, bits, alpha } => {
             let yuv = Yuv::new(f.color.matrix, f.color.range, *bits);
             let amax = ((1u32 << *bits) - 1) as f32;
-            convert_yuv(&mut img, w, h, *chroma, [&planes[0][..], &planes[1][..], &planes[2][..]], alpha.as_deref().map(|a| &a[..]), amax, &yuv, op);
+            convert_yuv(
+                &mut img,
+                YuvSource {
+                    size: (w, h),
+                    chroma: *chroma,
+                    planes: [&planes[0][..], &planes[1][..], &planes[2][..]],
+                    alpha: alpha.as_deref().map(|a| &a[..]),
+                    amax,
+                },
+                &yuv,
+                op,
+            );
         }
     }
     img
@@ -280,8 +302,17 @@ fn centred(i: usize, n: usize) -> (usize, usize) {
     (c, o)
 }
 
-#[allow(clippy::too_many_arguments)]
-fn convert_yuv<T: Sample>(img: &mut Image, w: usize, h: usize, chroma: Chroma, planes: [&[T]; 3], alpha: Option<&[T]>, amax: f32, k: &Yuv, op: AlphaOp) {
+/// Borrowed YUV planes and the geometry/range needed to interpret their samples.
+struct YuvSource<'a, T> {
+    size: (usize, usize),
+    chroma: Chroma,
+    planes: [&'a [T]; 3],
+    alpha: Option<&'a [T]>,
+    amax: f32,
+}
+
+fn convert_yuv<T: Sample>(img: &mut Image, source: YuvSource<'_, T>, k: &Yuv, op: AlphaOp) {
+    let YuvSource { size: (w, h), chroma, planes, alpha, amax } = source;
     let (sx, sy) = chroma.shifts();
     let cw = w.div_ceil(1 << sx);
     let ch = h.div_ceil(1 << sy);
@@ -345,30 +376,20 @@ fn convert_yuv<T: Sample>(img: &mut Image, w: usize, h: usize, chroma: Chroma, p
 pub(crate) fn dynamic_to_image(img: &image::DynamicImage, op: AlphaOp) -> Image {
     use image::DynamicImage as D;
     let (w, h) = (img.width(), img.height());
+    if let D::ImageRgb32F(_) | D::ImageRgba32F(_) = img {
+        let px = img.to_rgba32f();
+        let raw = px.as_raw();
+        return float_to_image(w, h, op, |i| {
+            let s = &raw[i * 4..i * 4 + 4];
+            [s[0], s[1], s[2], s[3]]
+        });
+    }
     let mut out = Image::new(w, h);
     let wu = w as usize;
     if wu == 0 || h == 0 {
         return out;
     }
     match img {
-        D::ImageRgb32F(_) | D::ImageRgba32F(_) => {
-            let px = img.to_rgba32f();
-            let raw = px.as_raw();
-            let premul = op.mode == AlphaMode::Premultiplied;
-            out.data.par_chunks_mut(wu).enumerate().for_each(|(y, row)| {
-                for (x, o) in row.iter_mut().enumerate() {
-                    let s = &raw[(y * wu + x) * 4..(y * wu + x) * 4 + 4];
-                    let a = s[3];
-                    let c = if premul {
-                        let inv = if a > 0.0 { 1.0 / a } else { 0.0 };
-                        [op.float(s[0] * inv) * a, op.float(s[1] * inv) * a, op.float(s[2] * inv) * a]
-                    } else {
-                        [op.float(s[0]), op.float(s[1]), op.float(s[2])]
-                    };
-                    *o = op.apply(c, a.clamp(0.0, 1.0));
-                }
-            });
-        }
         D::ImageLuma16(_) | D::ImageLumaA16(_) | D::ImageRgb16(_) | D::ImageRgba16(_) => {
             let px = img.to_rgba16();
             let raw = px.as_raw();
@@ -394,6 +415,32 @@ pub(crate) fn dynamic_to_image(img: &image::DynamicImage, op: AlphaOp) -> Image
     out
 }
 
+/// Float RGBA (linear light, alpha straight or premultiplied as the footage says), `px(i)` for
+/// pixel `i` in rows, to an [`Image`]: how [`dynamic_to_image`] converts float stills, also used
+/// for OpenEXR pictures made from decoded channel planes without an interleaved copy (#474).
+pub(crate) fn float_to_image(w: u32, h: u32, op: AlphaOp, px: impl Fn(usize) -> [f32; 4] + Sync) -> Image {
+    let mut out = Image::new(w, h);
+    let wu = w as usize;
+    if wu == 0 || h == 0 {
+        return out;
+    }
+    let premul = op.mode == AlphaMode::Premultiplied;
+    out.data.par_chunks_mut(wu).enumerate().for_each(|(y, row)| {
+        for (x, o) in row.iter_mut().enumerate() {
+            let s = px(y * wu + x);
+            let a = s[3];
+            let c = if premul {
+                let inv = if a > 0.0 { 1.0 / a } else { 0.0 };
+                [op.float(s[0] * inv) * a, op.float(s[1] * inv) * a, op.float(s[2] * inv) * a]
+            } else {
+                [op.float(s[0]), op.float(s[1]), op.float(s[2])]
+            };
+            *o = op.apply(c, a.clamp(0.0, 1.0));
+        }
+    });
+    out
+}
+
 /// Straight RGBA `f32` pixels (layered stills: Photoshop, SVG) to an [`Image`].
 pub(crate) fn straight_to_image(w: u32, h: u32, px: &[[f32; 4]], op: AlphaOp) -> Image {
     let mut out = Image::new(w, h);
diff --git a/crates/media/src/downmix.rs b/crates/media/src/downmix.rs
index 2ef417dd7..09bb1e1f6 100644
--- a/crates/media/src/downmix.rs
+++ b/crates/media/src/downmix.rs
@@ -10,16 +10,19 @@
 //! exceed full scale: 5.1 is scaled by 1/(1 + 0.707 + 0.707). Mono stays duplicated at unity and
 //! stereo is untouched.
 //!
-//! Channel order follows the WAVE / SMPTE convention by channel count (what FilmCraft's AC-3, PCM,
-//! FLAC and Opus readers deliver): 3 = L R C, 4 = quad L R Ls Rs, 5 = L R C Ls Rs,
-//! 6 = L R C LFE Ls Rs, 7 = L R C LFE Cs Ls Rs, 8 = L R C LFE Lb Rb Ls Rs. FilmCraft's AAC-LC
-//! decoder instead delivers AAC's own order (C L R first, LFE last), so AAC gets its own tables.
-//! More than 8 channels carry no known layout: only the first two (front L/R) are used.
+//! A decoded channel's gains come from where it plays. WAVE / SMPTE order by channel count is what
+//! FilmCraft's AC-3, PCM, FLAC and Opus readers deliver: 3 = L R C, 4 = quad L R Ls Rs,
+//! 5 = L R C Ls Rs, 6 = L R C LFE Ls Rs, 7 = L R C LFE Cs Ls Rs, 8 = L R C LFE Lb Rb Ls Rs. AAC
+//! arrives in an order its configuration decides ([`aac_order`]). More than 8 channels in WAVE
+//! order carry no known layout: only the first two (front L/R) are used.
 
 use std::f32::consts::FRAC_1_SQRT_2;
+use std::sync::Arc;
+
+use filmcraft_aac::{AudioSpecificConfig, ProgramConfig};
 
 /// A source channel's contribution to the left and right outputs, before normalisation.
-type Pair = [f32; 2];
+pub type Pair = [f32; 2];
 
 const FL: Pair = [1.0, 0.0];
 const FR: Pair = [0.0, 1.0];
@@ -29,33 +32,18 @@ const SL: Pair = [FRAC_1_SQRT_2, 0.0];
 const SR: Pair = [0.0, FRAC_1_SQRT_2];
 const CS: Pair = [0.5, 0.5];
 
-/// The per-channel `[left, right]` gains for `count` channels in the given order, normalised.
-/// `aac` selects AAC's native channel order. Empty for zero channels.
-pub fn stereo_gains(count: usize, aac: bool) -> Vec<Pair> {
-    let raw: &[Pair] = match (count, aac) {
-        (0, _) => &[],
-        (1, _) => &[[1.0, 1.0]],
-        (2, _) => &[FL, FR],
-        (3, false) => &[FL, FR, FC],
-        (3, true) => &[FC, FL, FR],
-        (4, false) => &[FL, FR, SL, SR],
-        (4, true) => &[FC, FL, FR, CS],
-        (5, false) => &[FL, FR, FC, SL, SR],
-        (5, true) => &[FC, FL, FR, SL, SR],
-        (6, false) => &[FL, FR, FC, LFE, SL, SR],
-        (6, true) => &[FC, FL, FR, SL, SR, LFE],
-        (7, false) => &[FL, FR, FC, LFE, CS, SL, SR],
-        (7, true) => &[FC, FL, FR, SL, SR, CS, LFE],
-        (8, false) => &[FL, FR, FC, LFE, SL, SR, SL, SR],
-        (8, true) => &[FC, FL, FR, SL, SR, SL, SR, LFE],
-        _ => &[FL, FR],
-    };
+/// AAC channel configuration 7 as FilmCraft decodes it (element order, not reordered).
+const CONFIG_7: [Pair; 8] = [FC, FL, FR, SL, SR, SL, SR, LFE];
+/// AAC channel configuration 4 (C L R Cs), which FilmCraft reorders to L R C Cs.
+const CONFIG_4: [Pair; 4] = [FL, FR, FC, CS];
+
+/// `raw` scaled by the reciprocal of its larger row sum when that exceeds 1 (more than two
+/// channels): full-scale input can never exceed full scale.
+fn normalised(raw: &[Pair]) -> Vec<Pair> {
     let mut out = raw.to_vec();
-    // Channels beyond a known layout (more than 8) are silent.
-    out.resize(count, [0.0, 0.0]);
     let peak = out.iter().map(|g| g[0]).sum::<f32>().max(out.iter().map(|g| g[1]).sum::<f32>());
     // Mono is deliberately left at unity on both sides; so is anything already within range.
-    if count > 2 && peak > 1.0 {
+    if out.len() > 2 && peak > 1.0 {
         for g in &mut out {
             g[0] /= peak;
             g[1] /= peak;
@@ -64,11 +52,109 @@ pub fn stereo_gains(count: usize, aac: bool) -> Vec<Pair> {
     out
 }
 
-/// Downmix planar `channels` to interleaved stereo in `out` (`out.len() / 2` frames); frames a
-/// channel is too short for count as silence, extra frames in `out` stay as they are.
-pub fn downmix_into(channels: &[Vec<f32>], aac: bool, out: &mut [f32]) {
-    let gains = stereo_gains(channels.len(), aac);
-    for (ch, g) in channels.iter().zip(&gains) {
+/// The per-channel `[left, right]` gains for `count` channels in WAVE / SMPTE order, normalised.
+/// Empty for zero channels.
+pub fn stereo_gains(count: usize) -> Vec<Pair> {
+    let raw: &[Pair] = match count {
+        0 => &[],
+        1 => &[[1.0, 1.0]],
+        2 => &[FL, FR],
+        3 => &[FL, FR, FC],
+        4 => &[FL, FR, SL, SR],
+        5 => &[FL, FR, FC, SL, SR],
+        6 => &[FL, FR, FC, LFE, SL, SR],
+        7 => &[FL, FR, FC, LFE, CS, SL, SR],
+        8 => &[FL, FR, FC, LFE, SL, SR, SL, SR],
+        _ => &[FL, FR],
+    };
+    let mut raw = raw.to_vec();
+    // Channels beyond a known layout (more than 8) are silent.
+    raw.resize(count, [0.0, 0.0]);
+    normalised(&raw)
+}
+
+/// Where a source's decoded channels play.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub enum Order {
+    /// WAVE / SMPTE by channel count: PCM, FLAC, AC-3, Opus and the rest.
+    #[default]
+    Wav,
+    /// AAC whose configuration wasn't read: by channel count as the configurations 1 to 7 decode
+    /// (exact for ADTS, which can signal no other configuration FilmCraft decodes), 7 channels as
+    /// configuration 11.
+    Aac,
+    /// Each decoded channel's gains, before normalisation.
+    Speakers(Arc<[Pair]>),
+}
+
+/// How FilmCraft's decoder hands over AAC with the configuration `asc`: it reorders channel
+/// configurations 3 to 6, 11 and 12 to WAVE / SMPTE and leaves 7 and PCE layouts in element order.
+pub fn aac_order(asc: &AudioSpecificConfig) -> Order {
+    match (asc.channel_config, &asc.pce) {
+        (4, _) => Order::Speakers(CONFIG_4.into()),
+        (1..=6 | 11 | 12, _) => Order::Wav,
+        (7, _) => Order::Speakers(CONFIG_7.into()),
+        (0, Some(pce)) => Order::Speakers(pce_speakers(pce).into()),
+        _ => Order::Aac,
+    }
+}
+
+/// ffmpeg's encoder fills a program config element's elements with its layout's channels in its
+/// own order (L R C LFE …), and for these structures that order doesn't match the element
+/// positions: an LFE in a side SCE, a back centre in a side pair. Front, side and back element
+/// types (`true` for a pair) and the channels of the ffmpeg layout with that structure (the first
+/// ffmpeg 8.1 lists, where several share it: 6.1 for 6.1(back) and 6.1(front), 7.1(wide) for
+/// 7.1(wide-side)).
+const FFMPEG_PCE: [(&[bool], &[bool], &[bool], &[Pair]); 6] = [
+    (&[true, false], &[false], &[false], &[FL, FR, FC, LFE, CS]),
+    (&[true, false], &[false], &[true], &[FL, FR, FC, LFE, SL, SR]),
+    (&[true, false], &[true], &[false], &[FL, FR, FC, CS, SL, SR]),
+    (&[true, false], &[false], &[true, false], &[FL, FR, FC, LFE, CS, SL, SR]),
+    (&[true, false], &[false], &[true, true], &[FL, FR, FC, LFE, SL, SR, FL, FR]),
+    (&[true, false], &[true], &[true, false], &[FL, FR, FC, SL, SR, CS, SL, SR]),
+];
+
+/// The channels of a PCE layout in decoded (element) order: ffmpeg's for its structures above
+/// (it names itself in the PCE's comment), otherwise by position (ISO/IEC 14496-3's program config element):
+/// front pairs left and right, a front single the centre, side and back pairs surrounds, a side
+/// or back single a back centre.
+fn pce_speakers(pce: &ProgramConfig) -> Vec<Pair> {
+    let pairs = |els: &[(bool, u8)]| els.iter().map(|e| e.0).collect::<Vec<_>>();
+    let (front, side, back) = (pairs(&pce.front), pairs(&pce.side), pairs(&pce.back));
+    if pce.comment.starts_with(b"Lavc") && pce.lfe.is_empty() {
+        let known = FFMPEG_PCE.iter().find(|(f, s, b, _)| *f == front.as_slice() && *s == side.as_slice() && *b == back.as_slice());
+        if let Some((.., speakers)) = known {
+            return speakers.to_vec();
+        }
+    }
+    let mut out = Vec::new();
+    for pair in front {
+        out.extend_from_slice(if pair { &[FL, FR] } else { &[FC] });
+    }
+    for pair in side.into_iter().chain(back) {
+        out.extend_from_slice(if pair { &[SL, SR] } else { &[CS] });
+    }
+    out.extend(pce.lfe.iter().map(|_| LFE));
+    out
+}
+
+/// The gains for `count` channels arriving in `order`. FilmCraft decodes as many channels as the
+/// container names, the first ones of the layout where that is fewer (MPEG-TS LATM names 7 of
+/// configuration 7's 8, ffmpeg 4.2 MP4s 2 of a PCE's); more go by count.
+pub fn decoded_gains(count: usize, order: &Order) -> Vec<Pair> {
+    match order {
+        Order::Speakers(s) if count <= s.len() => normalised(s.get(..count).unwrap_or_default()),
+        Order::Aac if count == 4 => normalised(&CONFIG_4),
+        Order::Aac if count == 8 => normalised(&CONFIG_7),
+        _ => stereo_gains(count),
+    }
+}
+
+/// Downmix planar `channels` arriving in `order` to interleaved stereo in `out` (`out.len() / 2`
+/// frames); frames a channel is too short for count as silence, extra frames in `out` stay as
+/// they are.
+pub fn downmix_into(channels: &[Vec<f32>], order: &Order, out: &mut [f32]) {
+    for (ch, g) in channels.iter().zip(&decoded_gains(channels.len(), order)) {
         if g[0] == 0.0 && g[1] == 0.0 {
             continue;
         }
@@ -85,49 +171,105 @@ mod tests {
 
     #[test]
     fn every_channel_count_has_a_bounded_defined_matrix() {
-        for aac in [false, true] {
+        let pce = Order::Speakers([FL, FR, FC, FC, SL, SR, SL, SR, CS, LFE].into());
+        for order in [Order::Wav, Order::Aac, Order::Speakers(CONFIG_7.into()), pce] {
             for n in 0..40usize {
-                let g = stereo_gains(n, aac);
+                let g = decoded_gains(n, &order);
                 assert_eq!(g.len(), n);
                 let (l, r) = (g.iter().map(|p| p[0]).sum::<f32>(), g.iter().map(|p| p[1]).sum::<f32>());
                 if n > 2 {
-                    assert!(l <= 1.0001 && r <= 1.0001, "{n} channels (aac {aac}): {l} {r}");
+                    assert!(l <= 1.0001 && r <= 1.0001, "{n} channels ({order:?}): {l} {r}");
                     assert!(l > 0.0 && r > 0.0);
                 }
             }
         }
     }
 
+    /// AudioSpecificConfigs as ffmpeg 8.1 and FilmCraft's encoder write them (48 kHz AAC-LC).
+    const PCE_FFMPEG_61: &str = "118004c848002000c4400d4c61766336322e32382e31303256e500";
+    const PCE_FILMCRAFT_61: &str = "118004c845000108840000";
+
+    fn order(hex: &str) -> Order {
+        let asc: Vec<u8> = (0..hex.len() / 2).filter_map(|i| hex.get(2 * i..2 * i + 2).and_then(|b| u8::from_str_radix(b, 16).ok())).collect();
+        aac_order(&AudioSpecificConfig::parse(&asc).expect("an AudioSpecificConfig"))
+    }
+
+    fn speakers(order: &Order) -> Vec<Pair> {
+        match order {
+            Order::Speakers(s) => s.to_vec(),
+            o => panic!("{o:?} names no speakers"),
+        }
+    }
+
+    #[test]
+    fn aac_order_follows_the_channel_configuration() {
+        for n in [1, 2, 3, 5, 6, 11, 12] {
+            assert_eq!(aac_order(&AudioSpecificConfig::lc(3, n)), Order::Wav, "configuration {n}");
+        }
+        assert_eq!(speakers(&aac_order(&AudioSpecificConfig::lc(3, 4))), [FL, FR, FC, CS]);
+        assert_eq!(speakers(&aac_order(&AudioSpecificConfig::lc(3, 7))), [FC, FL, FR, SL, SR, SL, SR, LFE]);
+        assert_eq!(speakers(&order(PCE_FFMPEG_61)), [FL, FR, FC, LFE, CS, SL, SR], "ffmpeg's 6.1 carries the LFE in a side SCE");
+        assert_eq!(speakers(&order(PCE_FILMCRAFT_61)), [FC, FL, FR, SL, SR, CS, LFE], "a centre-first PCE by position");
+    }
+
+    #[test]
+    fn only_ffmpeg_pce_structures_it_misplaces_take_its_channel_order() {
+        let pce = |comment: &[u8], side: Vec<(bool, u8)>, lfe: Vec<u8>| ProgramConfig {
+            front: vec![(true, 0), (false, 0)],
+            side,
+            back: vec![(true, 1)],
+            lfe,
+            comment: comment.to_vec(),
+            ..Default::default()
+        };
+        // 5.1(side): ffmpeg's LFE sits in the side SCE
+        assert_eq!(pce_speakers(&pce(b"Lavc58.54.100", vec![(false, 1)], vec![])), [FL, FR, FC, LFE, SL, SR]);
+        // the same structure from another encoder: a back centre by position
+        assert_eq!(pce_speakers(&pce(b"", vec![(false, 1)], vec![])), [FL, FR, FC, CS, SL, SR]);
+        // 7.0: ffmpeg's order matches the positions
+        assert_eq!(pce_speakers(&pce(b"Lavc62.28.102", vec![(true, 2)], vec![])), [FL, FR, FC, SL, SR, SL, SR]);
+        // a real LFE element is never ffmpeg's misplaced one
+        assert_eq!(pce_speakers(&pce(b"Lavc62.28.102", vec![(false, 1)], vec![0])), [FL, FR, FC, CS, SL, SR, LFE]);
+    }
+
+    #[test]
+    fn a_decode_of_fewer_channels_takes_the_first_of_the_layout_and_more_go_by_count() {
+        assert_eq!(decoded_gains(2, &order(PCE_FILMCRAFT_61)), [FC, FL]);
+        assert_eq!(decoded_gains(7, &Order::Speakers(CONFIG_7.into())), normalised(&CONFIG_7[..7]));
+        assert_eq!(decoded_gains(9, &Order::Speakers(CONFIG_7.into())), stereo_gains(9));
+        assert_eq!(decoded_gains(4, &Order::Aac), normalised(&[FL, FR, FC, CS]));
+        assert_eq!(decoded_gains(8, &Order::Aac), normalised(&CONFIG_7));
+        for n in [3, 5, 6, 7] {
+            assert_eq!(decoded_gains(n, &Order::Aac), stereo_gains(n), "{n} channels");
+        }
+    }
+
     #[test]
     fn five_one_matches_the_bs775_matrix() {
         let k = 1.0 / (1.0 + 2.0 * FRAC_1_SQRT_2);
-        let g = stereo_gains(6, false);
+        let g = stereo_gains(6);
         assert!((g[0][0] - k).abs() < 1e-6 && g[0][1] == 0.0);
         assert!((g[2][0] - k * FRAC_1_SQRT_2).abs() < 1e-6 && (g[2][1] - k * FRAC_1_SQRT_2).abs() < 1e-6);
         assert_eq!(g[3], [0.0, 0.0], "LFE is left out");
         assert!((g[4][0] - k * FRAC_1_SQRT_2).abs() < 1e-6 && g[4][1] == 0.0);
         assert!((g[5][1] - k * FRAC_1_SQRT_2).abs() < 1e-6 && g[5][0] == 0.0);
-        // AAC order: the centre is first, LFE last
-        let a = stereo_gains(6, true);
-        assert_eq!((a[0], a[5]), (g[2], g[3]));
-        assert_eq!((a[1], a[2]), (g[0], g[1]));
     }
 
     #[test]
     fn mono_and_stereo_are_untouched_and_wide_layouts_use_the_front_pair() {
-        assert_eq!(stereo_gains(1, false), vec![[1.0, 1.0]]);
-        assert_eq!(stereo_gains(2, true), vec![FL, FR]);
-        let g = stereo_gains(12, false);
+        assert_eq!(stereo_gains(1), vec![[1.0, 1.0]]);
+        assert_eq!(stereo_gains(2), vec![FL, FR]);
+        let g = stereo_gains(12);
         assert_eq!((g[0], g[1], g[2]), (FL, FR, [0.0, 0.0]));
     }
 
     #[test]
     fn ragged_and_empty_input_never_panics() {
         let mut out = vec![0.0; 8];
-        downmix_into(&[], false, &mut out);
-        downmix_into(&[vec![1.0; 100], vec![1.0; 2], vec![], vec![1.0; 3], vec![1.0; 1], vec![1.0]], true, &mut out);
+        downmix_into(&[], &Order::Wav, &mut out);
+        downmix_into(&[vec![1.0; 100], vec![1.0; 2], vec![], vec![1.0; 3], vec![1.0; 1], vec![1.0]], &Order::Aac, &mut out);
         assert!(out.iter().all(|v| v.is_finite()));
         let mut none: [f32; 0] = [];
-        downmix_into(&vec![vec![1.0; 3]; 7], false, &mut none);
+        downmix_into(&vec![vec![1.0; 3]; 7], &Order::Speakers(CONFIG_7.into()), &mut none);
     }
 }
diff --git a/crates/media/src/exr_channels.rs b/crates/media/src/exr_channels.rs
index 8c4cb1339..d0acf590f 100644
--- a/crates/media/src/exr_channels.rs
+++ b/crates/media/src/exr_channels.rs
@@ -6,12 +6,30 @@
 //! 0, or the background depth for depth channels). Cryptomatte manifests come from the
 //! `cryptomatte/<key>/name` and `cryptomatte/<key>/manifest` header attributes (the published
 //! Cryptomatte metadata convention: the manifest is a JSON object of name → hex hash).
+//!
+//! Decoded files are kept in a small cache ([`CACHE_BUDGET`]) that the picture of an EXR
+//! footage item shares with EXtractoR / Cryptomatte once an effect has read its channels
+//! (#474); a file is decoded once however many callers ask for it at the same time.
 
 use std::collections::HashMap;
-use std::sync::{Arc, Mutex, OnceLock};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Mutex, OnceLock, PoisonError};
 
-use effectcraft_raster::AuxChannels;
 use effectcraft_raster::channels3d::{BACKGROUND_DEPTH, split_channel};
+use effectcraft_raster::{AuxChannels, Image};
+use effectcraft_render::reads::{ReadFile, ReadFiles};
+use exr::block::UncompressedBlock;
+use exr::block::chunk::TileCoordinates;
+use exr::image::read::image::ReadImage;
+use exr::image::read::layers::{ChannelsReader, ReadAllLayers, ReadChannels};
+use exr::meta::attribute::SampleType;
+use exr::meta::header::Header;
+
+use crate::convert::{AlphaOp, float_to_image};
+
+/// The largest display window decoded (16384²; vector footage and Continuously Rasterize
+/// stop at the same size).
+const MAX_DISPLAY_PIXELS: usize = 1 << 28;
 
 fn is_depth(name: &str) -> bool {
     let last = name.rsplit('.').next().unwrap_or(name);
@@ -29,6 +47,11 @@ fn channel_name(part: Option<&str>, channel: &str) -> String {
     }
 }
 
+/// The part name channels are prefixed with (`None`: unnamed).
+fn part_name(header: &Header) -> Option<String> {
+    header.own_attributes.layer_name.as_ref().map(|t| t.to_string()).filter(|s| !s.is_empty())
+}
+
 /// Parse a Cryptomatte manifest (`{"name": "hexhash", …}`).
 pub fn parse_manifest(json: &str) -> Vec<(String, u32)> {
     let Ok(serde_json::Value::Object(m)) = serde_json::from_str::<serde_json::Value>(json) else { return vec![] };
@@ -49,23 +72,245 @@ pub fn unsupported_compression(bytes: &[u8]) -> Option<&'static str> {
         .then_some("OpenEXR HTJ2K compression isn't supported yet: re-save the file with ZIP, PIZ or DWAA compression")
 }
 
-/// Read all channels of an EXR file's bytes. `None` when it is not a readable EXR.
-pub fn read_exr_channels(bytes: &[u8]) -> Option<AuxChannels> {
-    use exr::prelude::*;
-    let img = read().no_deep_data().largest_resolution_level().all_channels().all_layers().all_attributes().from_buffered(std::io::Cursor::new(bytes)).ok()?;
-    let dw = img.attributes.display_window;
-    let (w, h) = (dw.size.0, dw.size.1);
-    if w == 0 || h == 0 {
-        return None;
+/// Which channels a decode keeps, by plane name, and the display window they are placed in
+/// (the first part's, as the `exr` crate reports the image's).
+struct Planes<'k> {
+    keep: &'k dyn Fn(&str) -> bool,
+    display: exr::meta::attribute::IntegerBounds,
+}
+
+/// One part's kept channels while it is decoded: each line of samples goes straight into its
+/// channel's display-window plane (no copy of the part's samples in their own type first).
+struct PlanesReader {
+    /// Per channel of the part: its plane name, sample type and plane (`None`: not kept).
+    planes: Vec<Option<(String, SampleType, Vec<f32>)>>,
+    /// The data window's position in the display window, and the data window's and display
+    /// window's sizes.
+    offset: (i64, i64),
+    layer: (usize, usize),
+    display: (usize, usize),
+    f16s: Vec<exr::prelude::f16>,
+    u32s: Vec<u32>,
+    f32s: Vec<f32>,
+    /// The part's channel indices of exact `R`, `G`, `B` and `A`, when it has R, G and B.
+    rgb: Option<([usize; 3], Option<usize>)>,
+    /// The part's display window differs from the first part's.
+    own_display: bool,
+}
+
+/// A decoded part: its kept planes (in channel order) and what [`PlanesReader`] found.
+struct PartPlanes {
+    planes: Vec<(String, Vec<f32>)>,
+    /// Positions in `planes` of the part's R, G, B (and A) channels, when it has them and keeps
+    /// them all.
+    rgb: Option<([usize; 3], Option<usize>)>,
+    has_rgb: bool,
+    exact: bool,
+}
+
+impl<'s> ReadChannels<'s> for Planes<'_> {
+    type Reader = PlanesReader;
+
+    fn create_channels_reader(&'s self, header: &Header) -> exr::error::Result<PlanesReader> {
+        if header.deep {
+            return Err(exr::error::Error::NotSupported("deep data".into()));
+        }
+        let dw = self.display;
+        let display = (dw.size.0, dw.size.1);
+        // Each channel is a display-window plane: a 60000² window over a 1×1 data window was a
+        // multi-gigabyte allocation per channel (#2141).
+        let n = display.0.checked_mul(display.1).filter(|n| *n > 0 && *n <= MAX_DISPLAY_PIXELS).ok_or(exr::error::Error::Invalid("display window".into()))?;
+        let prefix = part_name(header);
+        let pos = header.own_attributes.layer_position;
+        let offset = (i64::from(pos.0) - i64::from(dw.position.0), i64::from(pos.1) - i64::from(dw.position.1));
+        let planes = header
+            .channels
+            .list
+            .iter()
+            .map(|ch| {
+                let name = channel_name(prefix.as_deref(), &ch.name.to_string());
+                let fill = if is_depth(&name) { BACKGROUND_DEPTH } else { 0.0 };
+                (self.keep)(&name).then(|| (name, ch.sample_type, vec![fill; n]))
+            })
+            .collect();
+        let find = |c: &str| header.channels.find_index_of_channel(&exr::meta::attribute::Text::from(c));
+        let rgb = match (find("R"), find("G"), find("B")) {
+            (Some(r), Some(g), Some(b)) => Some(([r, g, b], find("A"))),
+            _ => None,
+        };
+        Ok(PlanesReader {
+            planes,
+            offset,
+            layer: (header.layer_size.0, header.layer_size.1),
+            display,
+            f16s: vec![],
+            u32s: vec![],
+            f32s: vec![],
+            rgb,
+            own_display: header.shared_attributes.display_window != dw,
+        })
     }
-    let mut aux = AuxChannels::new(w as u32, h as u32, 1.0);
+}
+
+impl ChannelsReader for PlanesReader {
+    type Channels = PartPlanes;
+
+    fn filter_block(&self, tile: TileCoordinates) -> bool {
+        tile.is_largest_resolution_level() && self.planes.iter().any(Option::is_some)
+    }
+
+    fn read_block(&mut self, header: &Header, block: UncompressedBlock) -> exr::error::UnitResult {
+        let ((lw, lh), (w, h)) = (self.layer, self.display);
+        for line in block.lines(&header.channels) {
+            let Some(Some((_, kind, plane))) = self.planes.get_mut(line.location.channel) else { continue };
+            let (x0, y, count) = (line.location.position.0, line.location.position.1, line.location.sample_count);
+            // The samples of data-window row `y`, columns `x0..x0 + count`, at display row `ty`
+            // from display column `tx0`; clipped to the display window.
+            if y >= lh || x0.checked_add(count).is_none_or(|end| end > lw) {
+                continue;
+            }
+            let Some(ty) = usize::try_from(y as i64 + self.offset.1).ok().filter(|ty| *ty < h) else { continue };
+            let tx0 = x0 as i64 + self.offset.0;
+            let skip = usize::try_from(-tx0).unwrap_or(0).min(count);
+            let tx = usize::try_from(tx0.max(0)).unwrap_or(usize::MAX);
+            let take = (count - skip).min(w.saturating_sub(tx));
+            let start = ty.checked_mul(w).and_then(|row| row.checked_add(tx));
+            let Some(dst) = start.filter(|_| take > 0).and_then(|s| plane.get_mut(s..s.checked_add(take)?)) else { continue };
+            match kind {
+                SampleType::F16 => {
+                    self.f16s.resize(count, exr::prelude::f16::ZERO);
+                    line.read_samples_into_slice(&mut self.f16s)?;
+                    for (d, s) in dst.iter_mut().zip(self.f16s.iter().skip(skip)) {
+                        *d = s.to_f32();
+                    }
+                }
+                SampleType::F32 => {
+                    self.f32s.resize(count, 0.0);
+                    line.read_samples_into_slice(&mut self.f32s)?;
+                    for (d, s) in dst.iter_mut().zip(self.f32s.iter().skip(skip)) {
+                        *d = *s;
+                    }
+                }
+                SampleType::U32 => {
+                    self.u32s.resize(count, 0);
+                    line.read_samples_into_slice(&mut self.u32s)?;
+                    for (d, s) in dst.iter_mut().zip(self.u32s.iter().skip(skip)) {
+                        *d = *s as f32;
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn into_channels(self) -> PartPlanes {
+        // Positions of the kept channels among the kept planes.
+        let mut at = vec![None; self.planes.len()];
+        let mut planes = Vec::with_capacity(self.planes.len());
+        for (i, p) in self.planes.into_iter().enumerate() {
+            if let Some((name, _, data)) = p {
+                if let Some(slot) = at.get_mut(i) {
+                    *slot = Some(planes.len());
+                }
+                planes.push((name, data));
+            }
+        }
+        let kept = |i: usize| at.get(i).copied().flatten();
+        let has_rgb = self.rgb.is_some();
+        let rgb = self.rgb.and_then(|([r, g, b], a)| {
+            let a = match a {
+                Some(a) => Some(kept(a)?),
+                None => None,
+            };
+            Some(([kept(r)?, kept(g)?, kept(b)?], a))
+        });
+        PartPlanes { planes, rgb, has_rgb, exact: !self.own_display }
+    }
+}
+
+/// How the `image` crate's OpenEXR decoder would show a file: the first part with exact `R`, `G`
+/// and `B` channels (alpha `A` when it has one, else opaque), placed in the display window with
+/// 0 outside the data window.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Rgb {
+    /// No part has R, G and B: the decoder refuses the file (a multi-layer file, shown with
+    /// [`layered_image`]'s rule).
+    None,
+    /// The channels (indices in [`AuxChannels::channels`]) hold exactly what it would show.
+    Planes([usize; 3], Option<usize>),
+    /// The planes can't stand in for it (a depth-named channel, whose plane is filled with the
+    /// background depth, or another display window): decode with the `image` crate.
+    Unsupported,
+}
+
+/// A decoded file: its channels and how its picture is made of them.
+pub(crate) struct Decoded {
+    pub(crate) aux: Arc<AuxChannels>,
+    rgb: Rgb,
+}
+
+impl Decoded {
+    /// Bytes held (the planes; names and manifests are small).
+    fn bytes(&self) -> usize {
+        self.aux.channels.iter().map(|(n, p)| n.len() + std::mem::size_of_val(p.as_slice())).sum()
+    }
+}
+
+/// The most bytes of planes one decode allocates (every kept channel is a display-window plane
+/// of f32, allocated before any pixels are read): a header can ask for far more than the file
+/// holds.
+#[cfg(target_pointer_width = "64")]
+const MAX_DECODE_BYTES: usize = 8 << 30;
+#[cfg(not(target_pointer_width = "64"))]
+const MAX_DECODE_BYTES: usize = 512 << 20;
+
+/// Why a file's channels weren't decoded.
+#[derive(Debug, PartialEq)]
+enum Refused {
+    /// Not a readable OpenEXR file.
+    Unreadable,
+    /// Its kept channels need more memory than [`MAX_DECODE_BYTES`] (the reason, to show).
+    TooLarge(String),
+}
+
+/// Bytes the planes of the channels `keep` names would take (`None`: not a readable header).
+fn planes_bytes(meta: &exr::meta::MetaData, keep: &dyn Fn(&str) -> bool) -> Option<usize> {
+    let dw = meta.headers.first()?.shared_attributes.display_window;
+    let n = dw.size.0.checked_mul(dw.size.1)?;
+    let mut kept = 0usize;
+    for header in meta.headers.iter() {
+        let prefix = part_name(header);
+        kept = kept.saturating_add(header.channels.list.iter().filter(|ch| keep(&channel_name(prefix.as_deref(), &ch.name.to_string()))).count());
+    }
+    Some(n.saturating_mul(kept).saturating_mul(std::mem::size_of::<f32>()))
+}
+
+/// Decode the channels of an EXR file's bytes that `keep` names (by plane name).
+fn decode(bytes: &[u8], keep: &dyn Fn(&str) -> bool) -> Result<Decoded, Refused> {
+    let meta = exr::meta::MetaData::read_from_buffered(std::io::Cursor::new(bytes), false).map_err(|_| Refused::Unreadable)?;
+    let display = meta.headers.first().ok_or(Refused::Unreadable)?.shared_attributes.display_window;
+    let need = planes_bytes(&meta, keep).ok_or(Refused::Unreadable)?;
+    if need > MAX_DECODE_BYTES {
+        let gb = |b: usize| b as f64 / f64::from(1u32 << 30);
+        return Err(Refused::TooLarge(format!(
+            "its {}×{} OpenEXR channels need {:.1} GB of memory, more than the {:.1} GB one file may use",
+            display.size.0,
+            display.size.1,
+            gb(need),
+            gb(MAX_DECODE_BYTES)
+        )));
+    }
+    let read = ReadImage::new(ReadAllLayers { read_channels: Planes { keep, display } }, |_| {});
+    let img = read.from_buffered(std::io::Cursor::new(bytes)).map_err(|_| Refused::Unreadable)?;
+    let dw = img.attributes.display_window;
+    let mut aux = AuxChannels::new(dw.size.0 as u32, dw.size.1 as u32, 1.0);
     let mut crypto: HashMap<String, (Option<String>, Option<String>)> = HashMap::new();
-    let mut collect_meta = |other: &HashMap<Text, AttributeValue>| {
+    let mut collect_meta = |other: &HashMap<exr::meta::attribute::Text, exr::meta::attribute::AttributeValue>| {
         for (k, v) in other {
             let key = k.to_string();
             let Some(rest) = key.strip_prefix("cryptomatte/") else { continue };
             let Some((id, field)) = rest.split_once('/') else { continue };
-            let AttributeValue::Text(t) = v else { continue };
+            let exr::meta::attribute::AttributeValue::Text(t) = v else { continue };
             let e = crypto.entry(id.to_string()).or_default();
             match field {
                 "name" => e.0 = Some(t.to_string()),
@@ -75,22 +320,22 @@ pub fn read_exr_channels(bytes: &[u8]) -> Option<AuxChannels> {
         }
     };
     collect_meta(&img.attributes.other);
-    let n = w.checked_mul(h)?;
-    // The decoded image is consumed channel by channel, so each channel's samples are freed (or
-    // moved) as its plane is made instead of the whole file being held twice (#474).
+    let mut rgb = Rgb::None;
     for layer in img.layer_data {
         collect_meta(&layer.attributes.other);
-        let prefix = layer.attributes.layer_name.as_ref().map(|t| t.to_string()).filter(|s| !s.is_empty());
-        let size = (layer.size.0, layer.size.1);
-        let pos = layer.attributes.layer_position;
-        let offset = (i64::from(pos.0) - i64::from(dw.position.0), i64::from(pos.1) - i64::from(dw.position.1));
-        for ch in layer.channel_data.list {
-            let name = channel_name(prefix.as_deref(), &ch.name.to_string());
-            let fill = if is_depth(&name) { BACKGROUND_DEPTH } else { 0.0 };
-            if let Some(plane) = place(ch.sample_data, size, offset, (w, h), n, fill) {
-                aux.channels.push((name, plane));
-            }
+        let part = layer.channel_data;
+        if rgb == Rgb::None && part.has_rgb {
+            let base = aux.channels.len();
+            rgb = match part.rgb {
+                Some(([r, g, b], a)) if part.exact => {
+                    let picked = [Some(r), Some(g), Some(b), a];
+                    let depth = picked.iter().flatten().any(|i| part.planes.get(*i).is_some_and(|(n, _)| is_depth(n)));
+                    if depth { Rgb::Unsupported } else { Rgb::Planes([base + r, base + g, base + b], a.map(|a| base + a)) }
+                }
+                _ => Rgb::Unsupported,
+            };
         }
+        aux.channels.extend(part.planes);
     }
     for (_, (name, manifest)) in crypto {
         if let (Some(n), Some(m)) = (name, manifest) {
@@ -98,46 +343,13 @@ pub fn read_exr_channels(bytes: &[u8]) -> Option<AuxChannels> {
         }
     }
     aux.manifests.sort();
-    Some(aux)
+    Ok(Decoded { aux: Arc::new(aux), rgb })
 }
 
-/// One channel's samples (`size`, at `offset` in the `display` window of `n` pixels) as a
-/// display-window plane, `fill` outside its data window. A channel covering exactly the display
-/// window is converted in one pass, and an f32 one is moved without a copy. `None` when the
-/// channel has fewer samples than its size.
-fn place(samples: exr::image::FlatSamples, size: (usize, usize), offset: (i64, i64), display: (usize, usize), n: usize, fill: f32) -> Option<Vec<f32>> {
-    use exr::image::FlatSamples;
-    let (lw, lh) = size;
-    if samples.len() < lw.checked_mul(lh)? {
-        return None;
-    }
-    if size == display && offset == (0, 0) {
-        return Some(match samples {
-            FlatSamples::F32(mut v) => {
-                v.truncate(n);
-                v
-            }
-            FlatSamples::F16(v) => v.iter().take(n).map(|s| s.to_f32()).collect(),
-            FlatSamples::U32(v) => v.iter().take(n).map(|s| *s as f32).collect(),
-        });
-    }
-    let value = |i: usize| match &samples {
-        FlatSamples::F32(v) => v.get(i).copied(),
-        FlatSamples::F16(v) => v.get(i).map(|s| s.to_f32()),
-        FlatSamples::U32(v) => v.get(i).map(|s| *s as f32),
-    };
-    let (w, h) = display;
-    let mut plane = vec![fill; n];
-    for y in 0..lh {
-        let Some(ty) = usize::try_from(y as i64 + offset.1).ok().filter(|ty| *ty < h) else { continue };
-        for x in 0..lw {
-            let Some(tx) = usize::try_from(x as i64 + offset.0).ok().filter(|tx| *tx < w) else { continue };
-            if let (Some(v), Some(p)) = (value(y * lw + x), plane.get_mut(ty * w + tx)) {
-                *p = v;
-            }
-        }
-    }
-    Some(plane)
+/// Read all channels of an EXR file's bytes. `None` when it is not a readable EXR.
+pub fn read_exr_channels(bytes: &[u8]) -> Option<AuxChannels> {
+    let aux = decode(bytes, &|_| true).ok()?.aux;
+    Some(Arc::try_unwrap(aux).unwrap_or_else(|a| (*a).clone()))
 }
 
 /// Names of the beauty pass, most preferred first, matched against the last part of a layer's
@@ -180,33 +392,50 @@ fn picture_layer<'a>(aux: &AuxChannels, layers: &[&'a str]) -> Option<&'a str> {
         .copied()
 }
 
-/// The picture of a multi-layer OpenEXR file without an unnamed RGB layer (Blender's
-/// `ViewLayer.Combined.R`, the compositor's `Image.R`, Nuke's `beauty.R`, …), which the image
-/// decoder rejects. After Effects shows a file's main RGBA channels and leaves the other layers
-/// to EXtractoR; here that is the beauty pass by name ([`BEAUTY`]), else the first colour layer
-/// that is not a data pass (never Cryptomatte, depth or normals, #412), else the first channel
-/// as grey. Linear, straight RGBA as the file stores it. `None` when it is not a readable EXR.
-pub fn layered_image(bytes: &[u8]) -> Option<image::DynamicImage> {
-    picture_of(&read_exr_channels(bytes)?)
-}
-
-/// [`layered_image`] of the EXR at `path` from the channel cache, so the picture and EXtractoR /
-/// Cryptomatte share one decode of the file (#474).
-pub(crate) fn cached_layered_image(path: &str, bytes: Arc<[u8]>) -> Option<image::DynamicImage> {
-    let aux = cached(path, || Some(bytes))?;
-    picture_of(&aux)
-}
-
-/// The picture of decoded channels (see [`layered_image`]).
-fn picture_of(aux: &AuxChannels) -> Option<image::DynamicImage> {
+/// The planes a multi-layer file's picture is made of (see [`layered_image`]): red, green, blue
+/// (one channel thrice for grey) and alpha, by name. Only the names of `aux` are read.
+fn picture_names(aux: &AuxChannels) -> Option<([String; 3], Option<String>)> {
     let layers = aux.layers();
     let colour = picture_layer(aux, &layers)?;
     let names = aux.layer_rgba(colour);
     // A layer without R, G and B channels shows its first channel as grey.
     let first = aux.names().into_iter().find(|n| split_channel(n).0 == colour).unwrap_or_default();
-    let plane = |k: usize| -> Option<&[f32]> { aux.get(names.get(k).map(String::as_str).filter(|n| !n.is_empty()).unwrap_or(first)) };
-    let (r, g, b) = (plane(0)?, plane(1)?, plane(2)?);
-    let a = names.get(3).filter(|n| !n.is_empty()).and_then(|n| aux.get(n));
+    let pick = |k: usize| names.get(k).map(String::as_str).filter(|n| !n.is_empty()).unwrap_or(first).to_string();
+    let a = names.get(3).filter(|n| !n.is_empty() && aux.get(n).is_some()).cloned();
+    Some(([pick(0), pick(1), pick(2)], a))
+}
+
+/// The channels of the picture of a multi-layer file and nothing else (names first from the
+/// headers, then only those channels decoded; in a multi-part file the other parts' pixels are
+/// not even decompressed), with the names of its planes.
+fn picture_only(bytes: &[u8]) -> Result<(Decoded, [String; 3], Option<String>), Refused> {
+    let meta = exr::meta::MetaData::read_from_buffered(std::io::Cursor::new(bytes), false).map_err(|_| Refused::Unreadable)?;
+    let mut names = AuxChannels::new(0, 0, 1.0);
+    for header in meta.headers.iter() {
+        let prefix = part_name(header);
+        names.channels.extend(header.channels.list.iter().map(|ch| (channel_name(prefix.as_deref(), &ch.name.to_string()), vec![])));
+    }
+    let (rgb, a) = picture_names(&names).ok_or(Refused::Unreadable)?;
+    // Planes are looked up by name ignoring case, so every channel that could answer is kept.
+    let keep = |n: &str| rgb.iter().chain(&a).any(|k| k.eq_ignore_ascii_case(n));
+    let decoded = decode(bytes, &keep)?;
+    Ok((decoded, rgb, a))
+}
+
+/// The picture of a multi-layer OpenEXR file without an unnamed RGB layer (Blender's
+/// `ViewLayer.Combined.R`, the compositor's `Image.R`, Nuke's `beauty.R`, …), which the image
+/// decoder rejects. After Effects shows a file's main RGBA channels and leaves the other layers
+/// to EXtractoR; here that is the beauty pass by name (`BEAUTY`), else the first colour layer
+/// that is not a data pass (never Cryptomatte, depth or normals, #412), else the first channel
+/// as grey. Linear, straight RGBA as the file stores it. `None` when it is not a readable EXR.
+pub fn layered_image(bytes: &[u8]) -> Option<image::DynamicImage> {
+    let (d, rgb, a) = picture_only(bytes).ok()?;
+    let aux = &d.aux;
+    let [r, g, b] = [aux.get(&rgb[0])?, aux.get(&rgb[1])?, aux.get(&rgb[2])?];
+    let a = match &a {
+        Some(n) => Some(aux.get(n)?),
+        None => None,
+    };
     let n = (aux.width as usize).checked_mul(aux.height as usize)?;
     let mut data = Vec::with_capacity(n.checked_mul(4)?);
     for i in 0..n {
@@ -221,40 +450,357 @@ fn picture_of(aux: &AuxChannels) -> Option<image::DynamicImage> {
     }
 }
 
-type Cache = Mutex<Vec<(String, Option<Arc<AuxChannels>>)>>;
+/// The picture made of planes `rgb` and `a` (opaque without one) of `aux`, as
+/// [`crate::convert::dynamic_to_image`] makes it of the same values. `None` when a plane is
+/// missing or short.
+fn planes_picture(aux: &AuxChannels, rgb: [&[f32]; 3], a: Option<&[f32]>, op: AlphaOp) -> Option<Image> {
+    let n = (aux.width as usize).checked_mul(aux.height as usize)?;
+    if rgb.iter().chain(&a).any(|p| p.len() < n) {
+        return None;
+    }
+    let [r, g, b] = rgb;
+    let at = |p: &[f32], i: usize| p.get(i).copied().unwrap_or(0.0);
+    Some(float_to_image(aux.width, aux.height, op, |i| [at(r, i), at(g, i), at(b, i), a.map_or(1.0, |a| at(a, i))]))
+}
 
-fn cache() -> &'static Cache {
-    static CACHE: OnceLock<Cache> = OnceLock::new();
-    CACHE.get_or_init(|| Mutex::new(Vec::new()))
+/// The picture of a decoded file by [`layered_image`]'s rule.
+fn layered_picture_of(aux: &AuxChannels, op: AlphaOp) -> Option<Image> {
+    let (rgb, a) = picture_names(aux)?;
+    let a = match &a {
+        Some(n) => Some(aux.get(n)?),
+        None => None,
+    };
+    planes_picture(aux, [aux.get(&rgb[0])?, aux.get(&rgb[1])?, aux.get(&rgb[2])?], a, op)
+}
+
+/// The picture of the multi-layer EXR at `path` ([`layered_image`]'s rule) as an [`Image`]:
+/// from the channel cache when `shared` (an effect reads the footage's channels, so they are
+/// decoded anyway), else of the picture's channels alone (also when the cache has no channels
+/// for the file: a read that failed, or a broken part the picture doesn't use). `Err(Some(why))`
+/// when the file is too large to decode, `Err(None)` when it isn't a readable multi-layer EXR.
+pub(crate) fn layered_picture(path: &str, bytes: Arc<[u8]>, file: &ReadFile, op: AlphaOp, shared: bool) -> Result<Image, Option<String>> {
+    if shared && let Some(d) = cache().get(path, Use::Picture, || read_as(file, bytes.clone())) {
+        return layered_picture_of(&d.aux, op).ok_or(None);
+    }
+    let (d, rgb, a) = picture_only(&bytes).map_err(|r| match r {
+        Refused::TooLarge(why) => Some(why),
+        Refused::Unreadable => None,
+    })?;
+    let aux = &d.aux;
+    let plane = |n: &str| aux.get(n).ok_or(None);
+    let a = match &a {
+        Some(n) => Some(plane(n)?),
+        None => None,
+    };
+    planes_picture(aux, [plane(&rgb[0])?, plane(&rgb[1])?, plane(&rgb[2])?], a, op).ok_or(None)
+}
+
+/// The picture of the EXR at `path` from the channel cache (#474: EXtractoR / Cryptomatte read
+/// this footage's channels, so the picture shares their decode): what the `image` crate's
+/// decoder shows for a file it reads, [`layered_image`]'s rule for one it refuses. `None` when
+/// the planes can't stand in for the `image` crate's picture (decode with it), or the file is
+/// not a readable EXR.
+pub(crate) fn cached_picture(path: &str, bytes: Arc<[u8]>, file: &ReadFile, op: AlphaOp) -> Option<Image> {
+    let d = cache().get(path, Use::Picture, || read_as(file, bytes))?;
+    let aux = &d.aux;
+    match d.rgb {
+        Rgb::None => layered_picture_of(aux, op),
+        Rgb::Planes([r, g, b], a) => {
+            let plane = |i: usize| aux.channels.get(i).map(|(_, p)| p.as_slice());
+            let a = match a {
+                Some(a) => Some(plane(a)?),
+                None => None,
+            };
+            planes_picture(aux, [plane(r)?, plane(g)?, plane(b)?], a, op)
+        }
+        Rgb::Unsupported => None,
+    }
+}
+
+/// How many bytes of decoded channels the cache keeps, like the frame cache's default
+/// ([`crate::DEFAULT_BUDGET`]): two 2560×1440 files of 32 channels (470 MB each, as every plane
+/// is f32). A soft bound: the newest file is kept whatever its size (so a frame's picture and its
+/// effects share its decode), and files still in use are never dropped (planes an effect holds,
+/// [`HELD_FILES`] pictures waiting for their effects, decodes in progress), so memory can go
+/// above it while they are. (Measured on such a sequence decoded one frame at a time: 1 GiB held
+/// peak memory about 1 GB lower than 2 GiB, at the same speed.)
+#[cfg(not(target_arch = "wasm32"))]
+pub const CACHE_BUDGET: usize = 1 << 30;
+#[cfg(target_arch = "wasm32")]
+pub const CACHE_BUDGET: usize = 512 << 20;
+
+/// At most this many files are cached (unreadable ones hold no bytes).
+const CACHE_FILES: usize = 64;
+
+/// At most this many files whose picture was made of their planes are kept for their effects
+/// (the renderer asks for a frame's picture, then its channels): about as many frames as are
+/// rendered at once. The oldest stops being kept when another comes.
+const HELD_FILES: usize = 4;
+
+/// A file's decode: done once, by the first caller; the others wait for it. With the files read
+/// for it (see [`crate::reads`]), noted again on every hit.
+type Slot = Arc<OnceLock<(Option<Arc<Decoded>>, ReadFiles)>>;
+
+/// Bytes the caller already read from `file`, given to the cache as read from it (so the entry
+/// keeps the file's identity).
+fn read_as(file: &ReadFile, bytes: Arc<[u8]>) -> Option<Arc<[u8]>> {
+    crate::reads::note(file.clone());
+    Some(bytes)
+}
+
+struct Entry {
+    path: String,
+    slot: Slot,
+    /// Bytes of the finished decode, or the planes it will allocate while it decodes.
+    bytes: usize,
+    /// When it was last asked for or finished decoding (a counter).
+    used: u64,
+}
+
+impl Entry {
+    /// Dropping it would free nothing or lose a decode in progress: an effect (or a picture
+    /// waiting for its effects) still holds its planes, or it is decoding.
+    fn in_use(&self) -> bool {
+        match self.slot.get() {
+            None => true,
+            Some((None, _)) => false,
+            Some((Some(d), _)) => Arc::strong_count(d) > 1 || Arc::strong_count(&d.aux) > 1,
+        }
+    }
+}
+
+struct State {
+    entries: Vec<Entry>,
+    clock: u64,
+    /// Files whose picture was made of their planes and whose channels haven't been asked for
+    /// since, oldest first (at most [`HELD_FILES`]).
+    held: std::collections::VecDeque<(String, Arc<Decoded>)>,
+}
+
+/// Who asks for a file's channels.
+#[derive(Clone, Copy, PartialEq)]
+pub(crate) enum Use {
+    /// The picture of a footage item whose effects read its channels next: kept for them.
+    Picture,
+    /// The channels themselves (EXtractoR, Cryptomatte, the 3D Channel effects).
+    Channels,
+}
+
+/// Decoded EXR files by path, bounded by bytes, least recently used out first.
+pub(crate) struct ChannelCache {
+    state: Mutex<State>,
+    budget: usize,
+    /// Files decoded (for tests).
+    decodes: AtomicU64,
+}
+
+/// Removes a decode's entry if the decode panics, so the file doesn't stay "decoding" (never
+/// dropped, its estimated bytes counted) until someone asks for it again.
+struct Abandon<'a> {
+    cache: &'a ChannelCache,
+    slot: &'a Slot,
+}
+
+impl Drop for Abandon<'_> {
+    fn drop(&mut self) {
+        if std::thread::panicking() {
+            self.cache.lock().entries.retain(|e| !Arc::ptr_eq(&e.slot, self.slot));
+        }
+    }
+}
+
+impl ChannelCache {
+    pub(crate) const fn new(budget: usize) -> Self {
+        Self { state: Mutex::new(State { entries: Vec::new(), clock: 0, held: std::collections::VecDeque::new() }), budget, decodes: AtomicU64::new(0) }
+    }
+
+    fn lock(&self) -> std::sync::MutexGuard<'_, State> {
+        self.state.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// Set the bytes of the entry of `slot` (if it's still cached), mark it used now and drop
+    /// least recently used files until the rest fit the budget.
+    fn account(&self, slot: &Slot, bytes: usize) {
+        let mut state = self.lock();
+        state.clock += 1;
+        let clock = state.clock;
+        // (gone when the file was forgotten meanwhile) Used as of now: a file asked for before
+        // another but decoded after it is not the older one.
+        if let Some(e) = state.entries.iter_mut().find(|e| Arc::ptr_eq(&e.slot, slot)) {
+            e.bytes = bytes;
+            e.used = clock;
+        }
+        Self::evict(&mut state.entries, self.budget, slot);
+    }
+
+    /// The decoded file at `path`, read with `read` by the first caller; callers asking for the
+    /// same file meanwhile wait for that decode instead of decoding it again.
+    pub(crate) fn get(&self, path: &str, by: Use, read: impl FnOnce() -> Option<Arc<[u8]>>) -> Option<Arc<Decoded>> {
+        let slot = {
+            let mut state = self.lock();
+            state.clock += 1;
+            let clock = state.clock;
+            match state.entries.iter_mut().find(|e| e.path == path) {
+                Some(e) => {
+                    e.used = clock;
+                    e.slot.clone()
+                }
+                None => {
+                    let slot = Slot::default();
+                    state.entries.push(Entry { path: path.to_string(), slot: slot.clone(), bytes: 0, used: clock });
+                    slot
+                }
+            }
+        };
+        let mut decoded_here = false;
+        // Waiting here can block a rayon worker (which `Inner::frame_at` avoids for frames): that
+        // is safe because the decode never waits on rayon's global pool (the exr crate
+        // decompresses on a pool of its own and this thread only receives the blocks), so the
+        // decoding thread can't be waiting for this one.
+        let (v, files) = slot.get_or_init(|| {
+            decoded_here = true;
+            self.decodes.fetch_add(1, Ordering::Relaxed);
+            #[cfg(test)]
+            count_decode(true);
+            let _abandon = Abandon { cache: self, slot: &slot };
+            let (bytes, files) = crate::reads::captured(read);
+            (bytes.and_then(|bytes| self.decode_file(path, &slot, &bytes)), files)
+        });
+        // The file(s) the decode was made of, read now or for an earlier caller.
+        crate::reads::note_all(files);
+        let v = v.clone();
+        if decoded_here {
+            self.account(&slot, v.as_ref().map_or(0, |d| d.bytes()));
+        }
+        let mut state = self.lock();
+        match (by, &v) {
+            (Use::Picture, Some(d)) => {
+                if !state.held.iter().any(|(p, _)| p == path) {
+                    state.held.push_back((path.to_string(), d.clone()));
+                    if state.held.len() > HELD_FILES {
+                        state.held.pop_front();
+                    }
+                }
+            }
+            (Use::Channels, _) => state.held.retain(|(p, _)| p != path),
+            (Use::Picture, None) => {}
+        }
+        drop(state);
+        v
+    }
+
+    /// Decode the file at `path` whose bytes are `bytes` for `slot` (see [`ChannelCache::get`]).
+    fn decode_file(&self, path: &str, slot: &Slot, bytes: &[u8]) -> Option<Arc<Decoded>> {
+        // The planes it will allocate count against the budget while it decodes.
+        if let Ok(meta) = exr::meta::MetaData::read_from_buffered(std::io::Cursor::new(bytes), false)
+            && let Some(need) = planes_bytes(&meta, &|_| true)
+        {
+            self.account(slot, need.min(MAX_DECODE_BYTES));
+        }
+        match decode(bytes, &|_| true) {
+            Ok(d) => Some(Arc::new(d)),
+            Err(Refused::TooLarge(why)) => {
+                log::warn!("media: {path}: {why}");
+                None
+            }
+            Err(Refused::Unreadable) => None,
+        }
+    }
+
+    /// Drop least recently used files not in use until the rest fit the budget, keeping `newest`.
+    fn evict(entries: &mut Vec<Entry>, budget: usize, newest: &Slot) {
+        while entries.iter().map(|e| e.bytes).sum::<usize>() > budget || entries.len() > CACHE_FILES {
+            let oldest = entries.iter().enumerate().filter(|(_, e)| !Arc::ptr_eq(&e.slot, newest) && !e.in_use()).min_by_key(|(_, e)| e.used).map(|(i, _)| i);
+            let Some(i) = oldest else { break };
+            entries.remove(i);
+        }
+    }
+
+    pub(crate) fn forget(&self, path: &str) {
+        let mut state = self.lock();
+        state.entries.retain(|e| e.path != path);
+        state.held.retain(|(p, _)| p != path);
+    }
+
+    #[cfg(test)]
+    fn decodes(&self) -> u64 {
+        self.decodes.load(Ordering::Relaxed)
+    }
+
+    #[cfg(test)]
+    fn cached(&self) -> Vec<String> {
+        self.lock().entries.iter().map(|e| e.path.clone()).collect()
+    }
+}
+
+fn cache() -> &'static ChannelCache {
+    static CACHE: ChannelCache = ChannelCache::new(CACHE_BUDGET);
+    &CACHE
 }
 
 /// Drop the cached channels of `path` (the file changed on disk).
 pub(crate) fn forget(path: &str) {
-    if let Ok(mut c) = cache().lock() {
-        c.retain(|(p, _)| p != path);
-    }
+    cache().forget(path);
 }
 
-/// Read (and cache, a few files) the channels of the EXR at `path` via `read`.
+/// Stop keeping the decodes of the last pictures for their effects ([`HELD_FILES`]): which
+/// footage effects read changed, so they may wait for effects that are gone. Their entries stay
+/// cached as any other, least recently used out first.
+pub(crate) fn release_held() {
+    cache().lock().held.clear();
+}
+
+/// Read (and cache, see [`CACHE_BUDGET`]) the channels of the EXR at `path` via `read`.
 pub(crate) fn cached(path: &str, read: impl FnOnce() -> Option<Arc<[u8]>>) -> Option<Arc<AuxChannels>> {
-    let cache = cache();
-    if let Some(v) = cache.lock().ok().and_then(|c| c.iter().find(|(p, _)| p == path).map(|(_, v)| v.clone())) {
-        return v;
-    }
-    let v = read().and_then(|b| read_exr_channels(&b)).map(Arc::new);
-    if let Ok(mut c) = cache.lock() {
-        if c.len() >= 4 {
-            c.remove(0);
-        }
-        c.push((path.to_string(), v.clone()));
-    }
-    v
+    cache().get(path, Use::Channels, read).map(|d| d.aux.clone())
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Decodes of a still's pixels on this thread ([`count_decode`]): the `image` crate's, then
+    /// the channel cache's.
+    static DECODES: std::cell::Cell<[u64; 2]> = const { std::cell::Cell::new([0; 2]) };
+}
+
+/// Count a decode of a file's pixels on this thread (tests): by the channel cache (`channels`)
+/// or by the `image` crate.
+#[cfg(test)]
+pub(crate) fn count_decode(channels: bool) {
+    DECODES.with(|d| {
+        let mut n = d.get();
+        n[usize::from(channels)] += 1;
+        d.set(n);
+    });
+}
+
+/// The decodes [`count_decode`] counted on this thread since the last call: by the `image` crate
+/// and by the channel cache.
+#[cfg(test)]
+pub(crate) fn take_decodes() -> [u64; 2] {
+    DECODES.with(|d| d.replace([0; 2]))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// An EXR file of `layers` (with their display window `display`).
+    fn file(layers: Vec<exr::prelude::Layer<exr::prelude::AnyChannels<exr::prelude::FlatSamples>>>, display: exr::prelude::IntegerBounds) -> Vec<u8> {
+        use exr::prelude::*;
+        let image = Image::from_layers(ImageAttributes::new(display), layers);
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        image.write().to_buffered(&mut bytes).unwrap();
+        bytes.into_inner()
+    }
+
+    /// A single-part file of float channels named `names`, `w`×`h`, every sample `v`.
+    fn flat(names: &[&str], (w, h): (usize, usize), v: f32) -> Vec<u8> {
+        use exr::prelude::*;
+        let list: Vec<AnyChannel<FlatSamples>> = names.iter().map(|n| AnyChannel::new(*n, FlatSamples::F32(vec![v; w * h]))).collect();
+        let layer = Layer::new((w, h), LayerAttributes::default(), Encoding::FAST_LOSSLESS, AnyChannels::sort(list.into()));
+        file(vec![layer], IntegerBounds::from_dimensions((w, h)))
+    }
+
     #[test]
     fn reads_layered_channels_and_cryptomatte_metadata() {
         use exr::prelude::*;
@@ -288,53 +834,380 @@ mod tests {
         assert!(read_exr_channels(b"not an exr").is_none());
     }
 
-    /// #474: a full-window f32 channel (Cryptomatte ranks, …) becomes its plane without a copy,
-    /// so a decode no longer holds the file's samples twice; other channels are placed in the
-    /// display window as before.
+    /// #474: each line of samples goes straight into its display-window plane: a data window
+    /// inside the display window is placed with the fill around it (the background depth for
+    /// depth), one partly outside is clipped, never out of bounds; half and uint samples are
+    /// converted as the file stores them.
     #[test]
-    fn channels_become_planes_without_an_extra_copy() {
-        use exr::image::FlatSamples;
-        let v = vec![0.25f32; 6];
-        let ptr = v.as_ptr();
-        let plane = place(FlatSamples::F32(v), (3, 2), (0, 0), (3, 2), 6, 0.0).unwrap();
-        assert_eq!(plane.as_ptr(), ptr, "moved, not copied");
-        assert_eq!(plane, [0.25; 6]);
-        let half = |x: f32| exr::prelude::f16::from_f32(x);
-        let full = place(FlatSamples::F16(vec![half(0.5); 6]), (3, 2), (0, 0), (3, 2), 6, 0.0).unwrap();
-        assert_eq!(full, [0.5; 6]);
-        // A 2×1 data window at (1, 1) of a 3×2 display window; the rest is the fill.
-        let part = place(FlatSamples::F16(vec![half(1.0), half(2.0)]), (2, 1), (1, 1), (3, 2), 6, 9.0).unwrap();
-        assert_eq!(part, [9.0, 9.0, 9.0, 9.0, 1.0, 2.0]);
-        // Partly outside the display window: clipped, never out of bounds.
-        let off = place(FlatSamples::U32(vec![7, 8]), (2, 1), (2, -1), (3, 2), 6, 0.0).unwrap();
-        assert_eq!(off, [0.0; 6]);
-        let edge = place(FlatSamples::U32(vec![7, 8]), (2, 1), (2, 0), (3, 2), 6, 0.0).unwrap();
-        assert_eq!(edge, [0.0, 0.0, 7.0, 0.0, 0.0, 0.0]);
-        assert!(place(FlatSamples::F32(vec![1.0; 5]), (3, 2), (0, 0), (3, 2), 6, 0.0).is_none(), "too few samples");
+    fn channels_are_placed_in_the_display_window() {
+        use exr::prelude::*;
+        let half = |x: f32| f16::from_f32(x);
+        let part = |pos: (i32, i32), size: (usize, usize), list: Vec<AnyChannel<FlatSamples>>| {
+            let attrs = LayerAttributes { layer_position: Vec2(pos.0, pos.1), ..Default::default() };
+            Layer::new(size, attrs, Encoding::FAST_LOSSLESS, AnyChannels::sort(list.into()))
+        };
+        let display = IntegerBounds::from_dimensions((3, 2));
+        // A 2×1 data window at (1, 1).
+        let inside = file(
+            vec![part(
+                (1, 1),
+                (2, 1),
+                vec![AnyChannel::new("G", FlatSamples::F16(vec![half(1.0), half(2.0)])), AnyChannel::new("Z", FlatSamples::U32(vec![7, 8]))],
+            )],
+            display,
+        );
+        let aux = read_exr_channels(&inside).unwrap();
+        assert_eq!(aux.get("G").unwrap(), [0.0, 0.0, 0.0, 0.0, 1.0, 2.0]);
+        let bg = BACKGROUND_DEPTH;
+        assert_eq!(aux.get("Z").unwrap(), [bg, bg, bg, bg, 7.0, 8.0]);
+        // A 2×2 data window at (2, -1): only its bottom-left sample lands at (2, 0).
+        let off = file(vec![part((2, -1), (2, 2), vec![AnyChannel::new("G", FlatSamples::F32(vec![1.0, 2.0, 3.0, 4.0]))])], display);
+        assert_eq!(read_exr_channels(&off).unwrap().get("G").unwrap(), [0.0, 0.0, 3.0, 0.0, 0.0, 0.0]);
+        // Entirely outside: all fill.
+        let away = file(vec![part((-5, 0), (2, 2), vec![AnyChannel::new("G", FlatSamples::F32(vec![1.0; 4]))])], display);
+        assert_eq!(read_exr_channels(&away).unwrap().get("G").unwrap(), [0.0; 6]);
+    }
+
+    /// #474: concurrent requests for a file that isn't cached decode it once; the others wait
+    /// for that decode and share its planes.
+    #[test]
+    fn concurrent_requests_decode_a_file_once() {
+        let bytes: Arc<[u8]> = flat(&["R", "G", "B", "Z"], (64, 64), 0.5).into();
+        let cache = ChannelCache::new(CACHE_BUDGET);
+        let reads = AtomicU64::new(0);
+        let barrier = std::sync::Barrier::new(8);
+        let got: Vec<Arc<Decoded>> = std::thread::scope(|s| {
+            let jobs: Vec<_> = (0..8)
+                .map(|_| {
+                    s.spawn(|| {
+                        barrier.wait();
+                        cache
+                            .get("/474-concurrent.exr", Use::Channels, || {
+                                reads.fetch_add(1, Ordering::Relaxed);
+                                // Long enough for the others to arrive while this one decodes.
+                                std::thread::sleep(std::time::Duration::from_millis(50));
+                                Some(bytes.clone())
+                            })
+                            .unwrap()
+                    })
+                })
+                .collect();
+            jobs.into_iter().map(|j| j.join().unwrap()).collect()
+        });
+        assert_eq!(cache.decodes(), 1, "one decode");
+        assert_eq!(reads.load(Ordering::Relaxed), 1, "the file is read once");
+        assert!(got.iter().all(|d| Arc::ptr_eq(d, &got[0])), "every caller has the same planes");
+        assert_eq!(got[0].aux.get("Z").and_then(|z| z.first()).copied(), Some(0.5));
+    }
+
+    /// #474: the cache is bounded by the bytes of its planes, least recently used out first; the
+    /// newest file stays even when it alone is over the budget, and unreadable files are cached
+    /// (as such) without counting bytes.
+    #[test]
+    fn cache_evicts_least_recently_used_by_bytes() {
+        // 4 float planes of 32×32: 16 KiB of samples (plus a few bytes of names) per file.
+        let bytes: Arc<[u8]> = flat(&["R", "G", "B", "A"], (32, 32), 0.25).into();
+        let one = 4 * 32 * 32 * 4 + 4;
+        let cache = ChannelCache::new(2 * one);
+        let get = |p: &str| cache.get(p, Use::Channels, || Some(bytes.clone())).unwrap();
+        assert_eq!(get("/a.exr").bytes(), one);
+        get("/b.exr");
+        get("/a.exr"); // a is now more recent than b
+        get("/c.exr");
+        assert_eq!(cache.cached(), ["/a.exr", "/c.exr"], "b was least recently used");
+        assert_eq!(cache.decodes(), 3);
+        get("/a.exr");
+        assert_eq!(cache.decodes(), 3, "a hit");
+        // A file over the budget on its own is still kept while it is the newest.
+        let small = ChannelCache::new(one / 2);
+        assert!(small.get("/big.exr", Use::Channels, || Some(bytes.clone())).is_some());
+        assert_eq!(small.cached(), ["/big.exr"]);
+        small.get("/big2.exr", Use::Channels, || Some(bytes.clone()));
+        assert_eq!(small.cached(), ["/big2.exr"]);
+        // An unreadable file is remembered (not read again) without bytes, and forgotten on request.
+        assert!(cache.get("/broken.exr", Use::Channels, || Some(Arc::from(&b"not an exr"[..]))).is_none());
+        assert!(cache.get("/broken.exr", Use::Channels, || panic!("not read again")).is_none());
+        cache.forget("/broken.exr");
+        assert!(!cache.cached().contains(&"/broken.exr".to_string()));
+        // At most CACHE_FILES files, however small.
+        for i in 0..CACHE_FILES + 10 {
+            cache.get(&format!("/none{i}.exr"), Use::Channels, || None);
+        }
+        assert!(cache.cached().len() <= CACHE_FILES);
+    }
+
+    /// #474: a file counts as used when its decode finishes: one asked for first but decoded
+    /// after another is the newer of the two, so concurrent frames don't evict each other's
+    /// files before their effects read them.
+    #[test]
+    fn a_file_is_used_as_of_its_decode() {
+        let bytes: Arc<[u8]> = flat(&["R", "G", "B", "A"], (32, 32), 0.25).into();
+        let one = 4 * 32 * 32 * 4 + 4;
+        let cache = ChannelCache::new(2 * one);
+        cache.get("/first.exr", Use::Channels, || {
+            // Another frame's file is asked for and decoded while this one decodes.
+            cache.get("/second.exr", Use::Channels, || Some(bytes.clone()));
+            Some(bytes.clone())
+        });
+        cache.get("/third.exr", Use::Channels, || Some(bytes.clone()));
+        assert_eq!(cache.cached(), ["/first.exr", "/third.exr"], "the file decoded first went first");
+    }
+
+    /// #474: frames rendered at once (each asks for its picture, then its effects for the
+    /// channels while other frames decode) decode each file once, though the budget holds only
+    /// one: a picture's file is kept for its effects, and files in use are never dropped.
+    #[test]
+    fn concurrent_frames_decode_each_file_once() {
+        let bytes: Arc<[u8]> = flat(&["R", "G", "B", "Z"], (64, 64), 0.5).into();
+        let cache = ChannelCache::new(4 * 64 * 64 * 4 + 4);
+        let (next, reads, frames) = (std::sync::atomic::AtomicUsize::new(0), AtomicU64::new(0), 24);
+        let read = || {
+            reads.fetch_add(1, Ordering::Relaxed);
+            Some(bytes.clone())
+        };
+        std::thread::scope(|s| {
+            for _ in 0..4 {
+                s.spawn(|| {
+                    loop {
+                        let i = next.fetch_add(1, Ordering::Relaxed);
+                        if i >= frames {
+                            break;
+                        }
+                        let path = format!("/474-frames/{i:04}.exr");
+                        drop(cache.get(&path, Use::Picture, read).unwrap());
+                        std::thread::sleep(std::time::Duration::from_millis(3));
+                        let aux = cache.get(&path, Use::Channels, read).unwrap();
+                        std::thread::sleep(std::time::Duration::from_millis(2));
+                        assert_eq!(aux.aux.get("Z").and_then(|z| z.first()).copied(), Some(0.5));
+                    }
+                });
+            }
+        });
+        assert_eq!(cache.decodes(), frames as u64, "one decode per frame");
+        assert_eq!(reads.load(Ordering::Relaxed), frames as u64);
+    }
+
+    /// #474: a decode that panics doesn't leave its file "decoding" in the cache (never dropped,
+    /// its planes counted): the entry goes, and the next request decodes the file.
+    #[test]
+    fn a_decode_that_panics_is_not_left_in_the_cache() {
+        let bytes: Arc<[u8]> = flat(&["R"], (8, 8), 1.0).into();
+        let cache = ChannelCache::new(CACHE_BUDGET);
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| cache.get("/474-panics.exr", Use::Channels, || panic!("the read failed"))));
+        assert!(r.is_err());
+        assert!(cache.cached().is_empty());
+        assert!(cache.get("/474-panics.exr", Use::Channels, || Some(bytes.clone())).is_some());
+        assert_eq!(cache.cached(), ["/474-panics.exr"]);
+    }
+
+    /// #474: the picture of a multi-layer file whose effects read its channels comes from the
+    /// cache, and from the picture's own channels when the cache has none for the file (a read
+    /// that failed, or a broken part the picture doesn't use).
+    #[test]
+    fn a_shared_picture_without_cached_channels_is_still_decoded() {
+        use effectcraft_project::Footage;
+        use effectcraft_render::FloatCurve;
+        let bytes: Arc<[u8]> = flat(&["Image.R", "Image.G", "Image.B", "depth.Z"], (4, 2), 0.5).into();
+        let path = "/474-shared-fallback.exr";
+        assert!(cache().get(path, Use::Channels, || None).is_none(), "a read that failed");
+        let op = AlphaOp::of(&Footage::default(), FloatCurve::Linear);
+        let img = layered_picture(path, bytes, &ReadFile::new(path, effectcraft_render::reads::FileStamp::Virtual), op, true).unwrap();
+        assert_eq!(img.get(1, 1), [0.5, 0.5, 0.5, 1.0]);
+    }
+
+    /// #474: a header asking for more plane memory than one decode may allocate (16384² display
+    /// window, 40 channels: 43 GB) is refused with a reason before anything is allocated.
+    #[test]
+    fn a_header_asking_for_too_much_memory_is_refused() {
+        use exr::prelude::*;
+        let list: Vec<AnyChannel<FlatSamples>> = (0..40).map(|i| AnyChannel::new(format!("pass{i:02}.Y").as_str(), FlatSamples::F32(vec![0.5]))).collect();
+        let layer = Layer::new((1, 1), LayerAttributes::default(), Encoding::FAST_LOSSLESS, AnyChannels::sort(list.into()));
+        let bytes = file(vec![layer], IntegerBounds::new((0, 0), (16384, 16384)));
+        match decode(&bytes, &|_| true) {
+            Err(Refused::TooLarge(why)) => assert!(why.contains("16384×16384") && why.contains("GB"), "{why}"),
+            Err(Refused::Unreadable) => panic!("readable"),
+            Ok(_) => panic!("refused"),
+        }
+        assert!(read_exr_channels(&bytes).is_none());
+        assert!(cached("/474-too-large.exr", || Some(bytes.as_slice().into())).is_none());
+    }
+
+    /// #474: a file forgotten (changed on disk) while it decodes isn't cached under its path when
+    /// that decode finishes.
+    #[test]
+    fn a_file_forgotten_while_it_decodes_is_not_cached() {
+        let bytes: Arc<[u8]> = flat(&["R"], (8, 8), 1.0).into();
+        let cache = ChannelCache::new(CACHE_BUDGET);
+        let d = cache.get("/changed.exr", Use::Channels, || {
+            cache.forget("/changed.exr");
+            Some(bytes.clone())
+        });
+        assert!(d.is_some());
+        assert!(cache.cached().is_empty());
     }
 
     /// #295: a multi-layer EXR whose colour is only in named layers (`diffuse.R`, as Blender and
     /// Nuke write them) failed to import ("does not contain non-deep rgb channels"); it now
     /// shows its colour layer and keeps every channel for EXtractoR.
-    /// #474: the picture and EXtractoR / Cryptomatte share one decode of a multi-layer file:
-    /// after the frame is decoded, the aux channels come from the cache without reading the file.
+    /// #474: once an effect has read a footage item's channels, the picture of each later frame
+    /// shares one decode with them: the frame's decode is cached and the channels come from it
+    /// without reading the file again.
     #[test]
     fn picture_and_aux_channels_share_one_decode() {
         use exr::prelude::*;
         let (w, h) = (2usize, 2usize);
-        let ch = |n: &str, v: f32| AnyChannel::new(n, FlatSamples::F32(vec![v; w * h]));
-        let channels = AnyChannels::sort(vec![ch("Image.R", 0.5), ch("Image.G", 0.5), ch("Image.B", 0.5), ch("GlossDir.R", 0.25)].into());
-        let image = Image::from_layer(Layer::new((w, h), LayerAttributes::default(), Encoding::FAST_LOSSLESS, channels));
+        let frame = |v: f32| -> Arc<[u8]> {
+            let ch = |n: &str, v: f32| AnyChannel::new(n, FlatSamples::F32(vec![v; w * h]));
+            let channels = AnyChannels::sort(vec![ch("Image.R", 0.5), ch("Image.G", 0.5), ch("Image.B", 0.5), ch("GlossDir.R", v)].into());
+            let image = Image::from_layer(Layer::new((w, h), LayerAttributes::default(), Encoding::FAST_LOSSLESS, channels));
+            let mut bytes = std::io::Cursor::new(Vec::new());
+            image.write().to_buffered(&mut bytes).unwrap();
+            bytes.into_inner().into()
+        };
+        let paths = ["/474-shared-decode_0001.exr", "/474-shared-decode_0002.exr"];
+        let pool = crate::MediaPool::new();
+        pool.add_bytes(paths[0], frame(0.25));
+        pool.add_bytes(paths[1], frame(0.75));
+        let mut f = crate::probe_bytes(paths[0], frame(0.25)).unwrap();
+        f.kind = effectcraft_project::FootageKind::Sequence;
+        f.sequence = paths.iter().map(|p| p.to_string()).collect();
+        let t1 = f.frame_rate.tick_of(1);
+        use effectcraft_render::FootageSource;
+        // The first frame: the picture, then an effect reads the channels.
+        pool.frame_at(&f, effectcraft_time::Tick::ZERO).unwrap();
+        let aux = pool.aux(effectcraft_project::ItemId(1), &f, effectcraft_time::Tick::ZERO).unwrap();
+        assert_eq!(aux.get("GlossDir.R").and_then(|p| p.first()).copied(), Some(0.25));
+        // The next frame's picture decodes the file into the cache, so its channels are not read.
+        let px = pool.frame_at(&f, t1).unwrap().get(0, 0);
+        let aux = cached(paths[1], || panic!("the frame's decode is reused, the file is not read again")).unwrap();
+        assert_eq!(aux.get("GlossDir.R").and_then(|p| p.first()).copied(), Some(0.75));
+        assert_eq!(px, pool.frame_at(&f, effectcraft_time::Tick::ZERO).unwrap().get(0, 0), "the same picture");
+    }
+
+    /// An EXR file with an unnamed RGB layer and a named `GlossDir.R` of `v` (2×2).
+    fn rgb_and_gloss(v: f32) -> Arc<[u8]> {
+        flat(&["R", "G", "B", "GlossDir.R"], (2, 2), v).into()
+    }
+
+    /// #474: footage the project says effects read the channels of
+    /// ([`FootageSource::set_aux_footage`]) costs one decode from its first frame on: a single
+    /// still with EXtractoR decodes once. Without it the first frame decodes twice (the picture,
+    /// then the channels once `aux()` asks).
+    #[test]
+    fn given_aux_footage_decodes_once_from_the_first_frame() {
+        use effectcraft_render::FootageSource;
+        let (given, learned) = ("/474-given-still.exr", "/474-learned-still.exr");
+        let pool = crate::MediaPool::new();
+        let mut f = std::collections::HashMap::new();
+        for p in [given, learned] {
+            pool.add_bytes(p, rgb_and_gloss(0.25));
+            f.insert(p, crate::probe_bytes(p, rgb_and_gloss(0.25)).unwrap());
+        }
+        pool.set_aux_footage(&[given.to_string()]);
+        take_decodes();
+        let t = effectcraft_time::Tick::ZERO;
+        pool.frame_at(&f[given], t).unwrap();
+        let aux = pool.aux(effectcraft_project::ItemId(1), &f[given], t).unwrap();
+        assert_eq!(aux.get("GlossDir.R").and_then(|p| p.first()).copied(), Some(0.25));
+        assert_eq!(take_decodes(), [0, 1], "the picture and the channels share one decode");
+        // Learned only at the first `aux()`: the picture was decoded on its own before.
+        pool.frame_at(&f[learned], t).unwrap();
+        pool.aux(effectcraft_project::ItemId(2), &f[learned], t).unwrap();
+        assert_eq!(take_decodes(), [1, 1]);
+    }
+
+    /// #474: once the project no longer names footage (its effect removed), later frames decode
+    /// only their picture again; what `aux()` learned is dropped with each new set too.
+    #[test]
+    fn a_new_aux_footage_set_returns_to_picture_only() {
+        use effectcraft_render::FootageSource;
+        let paths: Vec<String> = (1..=4).map(|i| format!("/474-unset_{i:04}.exr")).collect();
+        let pool = crate::MediaPool::new();
+        for p in &paths {
+            pool.add_bytes(p, rgb_and_gloss(0.5));
+        }
+        let mut f = crate::probe_bytes(&paths[0], rgb_and_gloss(0.5)).unwrap();
+        f.kind = effectcraft_project::FootageKind::Sequence;
+        f.sequence = paths.clone();
+        let at = |i: i64| f.frame_rate.tick_of(i);
+        // (counted on this thread, so other tests sharing the channel cache don't change them)
+        let frame = |i: i64| {
+            take_decodes();
+            pool.frame_at(&f, at(i)).unwrap();
+            take_decodes()
+        };
+        pool.set_aux_footage(std::slice::from_ref(&f.path));
+        assert_eq!(frame(0), [0, 1], "given: the picture comes from the channel decode");
+        pool.set_aux_footage(&[]);
+        assert!(!cache().lock().held.iter().any(|(p, _)| *p == paths[0]), "no longer kept once no effect reads it");
+        assert_eq!(frame(1), [1, 0], "no longer given: the picture alone");
+        // Learned by `aux()`, then a new set without it: picture only again.
+        pool.aux(effectcraft_project::ItemId(1), &f, at(1)).unwrap();
+        assert_eq!(frame(2), [0, 1], "learned");
+        pool.set_aux_footage(&[]);
+        assert_eq!(frame(3), [1, 0], "a new set drops what was learned");
+    }
+
+    /// #474: the picture made of the cached planes of a file with exact R, G, B channels is the
+    /// `image` crate's, bit for bit (first such part, alpha or opaque, data window placed with 0
+    /// around it), in every alpha interpretation and float curve.
+    #[test]
+    fn picture_from_planes_is_the_image_crates() {
+        use effectcraft_project::{AlphaMode, Footage};
+        use effectcraft_render::FloatCurve;
+        use exr::prelude::*;
+        let half = |n: &str, v: f32, len: usize| AnyChannel::new(n, FlatSamples::F16((0..len).map(|i| f16::from_f32(v + i as f32 * 0.37 - 1.0)).collect()));
+        let float = |n: &str, v: f32, len: usize| AnyChannel::new(n, FlatSamples::F32((0..len).map(|i| ((i * 7) % 11) as f32 * v).collect()));
+        let part = |name: Option<&str>, pos: (i32, i32), size: (usize, usize), list: Vec<AnyChannel<FlatSamples>>| {
+            let mut attrs = name.map_or_else(LayerAttributes::default, LayerAttributes::named);
+            attrs.layer_position = Vec2(pos.0, pos.1);
+            Layer::new(size, attrs, Encoding::SMALL_LOSSLESS, AnyChannels::sort(list.into()))
+        };
+        let display = IntegerBounds::new((1, -1), (5, 4));
+        let n = 20;
+        let files = [
+            file(
+                vec![part(None, (1, -1), (5, 4), vec![half("R", 0.1, n), half("G", 0.2, n), half("B", 0.3, n), float("A", 0.1, n), float("Z", 2.0, n)])],
+                display,
+            ),
+            file(vec![part(None, (0, 0), (3, 2), vec![float("R", 0.4, 6), float("G", 0.5, 6), float("B", 0.6, 6), half("Image.R", 0.1, 6)])], display),
+            file(
+                vec![
+                    part(Some("diffuse"), (1, -1), (5, 4), vec![half("R", 0.1, n), half("G", 0.2, n), half("B", 0.3, n)]),
+                    part(Some("beauty"), (2, 0), (2, 2), vec![half("R", 0.4, 4), half("G", 0.5, 4), half("B", 0.6, 4), half("A", 0.5, 4)]),
+                ],
+                display,
+            ),
+        ];
+        let bits = |i: &effectcraft_raster::Image| i.data.iter().flat_map(|p| p.map(f32::to_bits)).collect::<Vec<_>>();
+        for (k, bytes) in files.iter().enumerate() {
+            let path = format!("/474-planes-{k}.exr");
+            let d = cache().get(&path, Use::Channels, || Some(bytes.as_slice().into())).unwrap();
+            assert!(matches!(d.rgb, Rgb::Planes(..)), "file {k}: {:?}", d.rgb);
+            let img = crate::probe::load_oriented(bytes, Some(image::ImageFormat::OpenExr)).unwrap();
+            for alpha in [AlphaMode::Straight, AlphaMode::Premultiplied, AlphaMode::Ignore] {
+                for curve in [FloatCurve::Srgb, FloatCurve::Linear, FloatCurve::Gamma24] {
+                    let op = AlphaOp::of(&Footage { alpha, premul_color: [0.2, 0.4, 0.6], ..Default::default() }, curve);
+                    let want = crate::convert::dynamic_to_image(&img, op);
+                    let got = cached_picture(&path, bytes.as_slice().into(), &ReadFile::new(path.as_str(), effectcraft_render::reads::FileStamp::Virtual), op)
+                        .unwrap();
+                    assert_eq!((got.width, got.height), (want.width, want.height));
+                    assert_eq!(bits(&got), bits(&want), "file {k} {alpha:?} {curve:?}");
+                }
+            }
+        }
+    }
+
+    /// #2141: one pixel of data in a 60000² display window is refused, not allocated per channel.
+    #[test]
+    fn a_huge_display_window_is_refused_not_allocated() {
+        use exr::prelude::*;
+        let channels = AnyChannels::sort(vec![AnyChannel::new("R", FlatSamples::F32(vec![0.5]))].into());
+        let mut image = Image::from_layer(Layer::new((1, 1), LayerAttributes::default(), Encoding::FAST_LOSSLESS, channels));
+        image.attributes.display_window = IntegerBounds::new((0, 0), (60000, 60000));
         let mut bytes = std::io::Cursor::new(Vec::new());
         image.write().to_buffered(&mut bytes).unwrap();
-        let b: Arc<[u8]> = bytes.into_inner().into();
-        let path = "/474-shared-decode.exr";
-        let pool = crate::MediaPool::new();
-        pool.add_bytes(path, b.clone());
-        let f = crate::probe_bytes(path, b).unwrap();
-        pool.frame_at(&f, effectcraft_time::Tick::ZERO).unwrap();
-        let aux = cached(path, || panic!("the frame's decode is reused, the file is not read again")).unwrap();
-        assert_eq!(aux.get("GlossDir.R").and_then(|p| p.first()).copied(), Some(0.25));
+        assert!(read_exr_channels(&bytes.into_inner()).is_none());
     }
 
     #[test]
diff --git a/crates/media/src/layered.rs b/crates/media/src/layered.rs
index 0a70d1f7f..64ade9394 100644
--- a/crates/media/src/layered.rs
+++ b/crates/media/src/layered.rs
@@ -14,19 +14,20 @@ fn is_svg(path: &str, bytes: &[u8]) -> bool {
 }
 
 /// The vector document of an SVG / PDF / AI / EPS file (`None` for other formats): page
-/// `page` of a PDF, restricted to the footage's layer when it names one.
+/// `page` of a PDF framed as `framing` says, restricted to the footage's layer when it names one.
 pub fn vector_doc(
     path: &str,
     bytes: &[u8],
     layer: Option<&effectcraft_project::SourceLayer>,
     page: u32,
+    framing: effectcraft_pdf::Framing,
 ) -> Option<std::result::Result<effectcraft_svg::Doc, String>> {
     if is_svg(path, bytes) {
         return Some(effectcraft_svg::parse(bytes).map_err(|e| format!("{path}: {e}")));
     }
     effectcraft_pdf::sniff(bytes)?;
     Some(
-        effectcraft_pdf::parse_page(bytes, page as usize)
+        effectcraft_pdf::parse_page_framed(bytes, page as usize, framing)
             .map(|d| match layer {
                 Some(l) => effectcraft_pdf::layer_doc_with_sizes(&d, l.index as usize, l.layer_size).0,
                 None => d,
@@ -36,7 +37,7 @@ pub fn vector_doc(
 }
 
 fn is_pdf_like(path: &str, bytes: &[u8]) -> bool {
-    let ext = std::path::Path::new(path).extension().and_then(|e| e.to_str()).unwrap_or("").to_ascii_lowercase();
+    let ext = std::path::Path::new(path).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("").to_ascii_lowercase();
     effectcraft_pdf::sniff(bytes).is_some() && (effectcraft_pdf::EXTENSIONS.contains(&ext.as_str()) || bytes.starts_with(b"%PDF"))
 }
 
@@ -111,9 +112,14 @@ pub(crate) fn decode(path: &str, bytes: &[u8], footage: &Footage, op: AlphaOp) -
         return Ok(Some(straight_to_image(px.width, px.height, &px.data, op)));
     }
     if is_svg(path, bytes) || is_pdf_like(path, bytes) {
-        let doc = vector_doc(path, bytes, footage.layer.as_ref(), footage.page).unwrap_or(Err(String::new())).map_err(MediaError::Decode)?;
-        let (w, h) = doc.pixel_size();
-        let img = effectcraft_svg::rasterize(&doc, w, h, 1.0);
+        let doc = footage_doc(path, bytes, footage).unwrap_or(Err(String::new())).map_err(MediaError::Decode)?;
+        let ((w, h), to_image) = fit(&doc, footage, 1.0);
+        // A declared size up to 30000² would be a 14 GB allocation that aborts the app (#2136):
+        // past what Continuously Rasterize can draw, the footage reports an error instead.
+        if u64::from(w) * u64::from(h) > u64::from(MAX_VECTOR_SIDE) * u64::from(MAX_VECTOR_SIDE) {
+            return Err(MediaError::Decode(format!("{path}: {w}×{h} pixels is larger than vector footage can be drawn ({MAX_VECTOR_SIDE}×{MAX_VECTOR_SIDE})")));
+        }
+        let img = effectcraft_svg::rasterize_with(&doc, w, h, to_image);
         // The rasteriser produces premultiplied pixels already.
         let _ = op;
         return Ok(Some(img));
@@ -121,10 +127,110 @@ pub(crate) fn decode(path: &str, bytes: &[u8], footage: &Footage, op: AlphaOp) -
     Ok(None)
 }
 
-/// A vector file rasterised at `scale` × its pixel size (Continuously Rasterize).
-pub(crate) fn rasterize_vector(path: &str, bytes: &[u8], layer: Option<&effectcraft_project::SourceLayer>, page: u32, scale: f64) -> Option<Image> {
-    let doc = vector_doc(path, bytes, layer, page)?.ok()?;
-    let (w, h) = doc.pixel_size();
-    let (sw, sh) = (((w as f64 * scale).ceil() as u32).clamp(1, 16384), ((h as f64 * scale).ceil() as u32).clamp(1, 16384));
-    Some(effectcraft_svg::rasterize(&doc, sw, sh, scale))
+/// The largest side vector footage is drawn at, decoded or continuously rasterised.
+const MAX_VECTOR_SIDE: u32 = 16384;
+
+/// The vector footage `footage` (of the file `path` with these `bytes`) rasterised at `scale` ×
+/// its size as [`effectcraft_render::vector_fit`] draws it (Continuously Rasterize).
+pub(crate) fn rasterize_vector(path: &str, bytes: &[u8], footage: &Footage, scale: f64) -> Option<Image> {
+    let doc = footage_doc(path, bytes, footage)?.ok()?;
+    let ((sw, sh), to_image) = fit(&doc, footage, scale);
+    Some(effectcraft_svg::rasterize_with(&doc, sw.clamp(1, MAX_VECTOR_SIDE), sh.clamp(1, MAX_VECTOR_SIDE), to_image))
+}
+
+/// The page framing of vector footage: as After Effects places it for footage from an After
+/// Effects project ([`Footage::placed_page`]), as a PDF viewer shows it otherwise.
+fn framing(footage: &Footage) -> effectcraft_pdf::Framing {
+    if footage.placed_page { effectcraft_pdf::Framing::Placed } else { effectcraft_pdf::Framing::Viewer }
+}
+
+/// [`vector_doc`] of `footage`'s page, layer and framing.
+fn footage_doc(path: &str, bytes: &[u8], footage: &Footage) -> Option<std::result::Result<effectcraft_svg::Doc, String>> {
+    vector_doc(path, bytes, footage.layer.as_ref(), footage.page, framing(footage))
+}
+
+/// The image size and document → image mapping of `doc` drawn for `footage` at `scale`.
+fn fit(doc: &effectcraft_svg::Doc, footage: &Footage, scale: f64) -> ((u32, u32), effectcraft_svg::Affine) {
+    let (size, [sx, sy]) = effectcraft_render::vector_fit(footage, [doc.width, doc.height], doc.pixel_size(), scale);
+    (size, effectcraft_svg::Affine::scale_non_uniform(sx, sy))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// #2136: an SVG that declares 30000×30000 asked for a 14 GB image and aborted the app; it
+    /// is now an error, and a drawable size still decodes.
+    #[test]
+    fn vector_footage_past_the_drawable_size_is_an_error_not_an_abort() {
+        let huge = br#"<svg xmlns="http://www.w3.org/2000/svg" width="30000" height="30000"/>"#;
+        let footage = probe("huge.svg", huge).unwrap().unwrap();
+        let e = decode("huge.svg", huge, &footage, AlphaOp::new(footage.alpha, footage.premul_color)).err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(e.contains("30000×30000"), "{e}");
+        let small = br#"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><rect width="40" height="20"/></svg>"#;
+        let footage = probe("small.svg", small).unwrap().unwrap();
+        let img = decode("small.svg", small, &footage, AlphaOp::new(footage.alpha, footage.premul_color)).unwrap().unwrap();
+        assert_eq!((img.width, img.height), (40, 20));
+    }
+
+    /// A 200 × 100 pt page: red left half, blue right half.
+    fn halves_pdf() -> Vec<u8> {
+        effectcraft_pdf::write::pdf(
+            &[
+                (1, "<< /Type /Catalog /Pages 2 0 R >>".into(), None),
+                (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(), None),
+                (3, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R >>".into(), None),
+                (4, "<< >>".into(), Some(b"1 0 0 rg 0 0 100 100 re f 0 0 1 rg 100 0 100 100 re f".to_vec())),
+            ],
+            1,
+        )
+    }
+
+    /// An opaque red pixel.
+    fn is_red(p: [f32; 4]) -> bool {
+        p[3] > 0.99 && p[0] > 0.9 && p[2] < 0.1
+    }
+
+    /// An opaque blue pixel.
+    fn is_blue(p: [f32; 4]) -> bool {
+        p[3] > 0.99 && p[2] > 0.9 && p[0] < 0.1
+    }
+
+    /// #3099: an After Effects project keeps the size After Effects measured for a placed .ai or
+    /// PDF, which can differ from this reader's page size. A placed page fills that size (the
+    /// layer's anchor and masks are measured against it), decoded and continuously rasterised;
+    /// other footage is drawn at the page's own size as before, whatever size it says.
+    #[test]
+    fn placed_vector_footage_fills_the_footage_size() {
+        let pdf = halves_pdf();
+        let mut footage = probe("art.ai", &pdf).unwrap().unwrap();
+        assert_eq!((footage.width, footage.height), (200, 100));
+        assert!(!footage.placed_page);
+        let op = AlphaOp::new(footage.alpha, footage.premul_color);
+        let own = decode("art.ai", &pdf, &footage, op).unwrap().unwrap();
+        assert_eq!((own.width, own.height), (200, 100));
+        assert!(is_red(own.get(50, 50)) && is_blue(own.get(150, 50)));
+
+        (footage.width, footage.height) = (100, 80);
+        let unplaced = decode("art.ai", &pdf, &footage, op).unwrap().unwrap();
+        assert!(unplaced == own, "not placed: drawn as before");
+        assert_eq!(rasterize_vector("art.ai", &pdf, &footage, 0.5).map(|i| (i.width, i.height)), Some((100, 50)));
+
+        footage.placed_page = true;
+        let img = decode("art.ai", &pdf, &footage, op).unwrap().unwrap();
+        assert_eq!((img.width, img.height), (100, 80));
+        for (x, y) in [(25, 3), (25, 76)] {
+            assert!(is_red(img.get(x, y)), "red at ({x}, {y}): {:?}", img.get(x, y));
+        }
+        for (x, y) in [(75, 3), (75, 76)] {
+            assert!(is_blue(img.get(x, y)), "blue at ({x}, {y}): {:?}", img.get(x, y));
+        }
+
+        let sharp = rasterize_vector("art.ai", &pdf, &footage, 2.0).unwrap();
+        assert_eq!((sharp.width, sharp.height), (200, 160));
+        assert!(is_red(sharp.get(50, 155)) && is_blue(sharp.get(150, 155)));
+        // Placed at the page's own size: 1:1.
+        (footage.width, footage.height) = (200, 100);
+        assert!(decode("art.ai", &pdf, &footage, op).unwrap().unwrap() == own, "placed at its own size: 1:1");
+    }
 }
diff --git a/crates/media/src/lib.rs b/crates/media/src/lib.rs
index 04a9d95e3..0b509c45f 100644
--- a/crates/media/src/lib.rs
+++ b/crates/media/src/lib.rs
@@ -15,6 +15,7 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+mod aac;
 mod convert;
 pub mod downmix;
 mod dpx;
@@ -24,9 +25,13 @@ mod layered;
 pub use layered::vector_doc;
 mod pool;
 mod probe;
+mod reads;
 mod stream;
+mod wav_markers;
 mod webp_anim;
 
+/// Video decoder counters (time in decoders, samples decoded, seeks, cache hits), for benchmarks.
+pub use filmcraft_codecs::{GopStats, gop_stats};
 pub use pool::{DEFAULT_BUDGET, MediaPool, PoolStats};
 pub use probe::{DEFAULT_SEQUENCE_RATE, probe, probe_bytes, probe_model};
 
@@ -63,8 +68,7 @@ pub const STILL_EXTENSIONS: &[&str] =
     &["png", "jpg", "jpeg", "gif", "webp", "tif", "tiff", "bmp", "exr", "tga", "hdr", "psd", "psb", "svg", "pdf", "ai", "eps"];
 /// File extensions recognised as audio-only files.
 pub const AUDIO_EXTENSIONS: &[&str] = filmcraft_media::AUDIO_EXTENSIONS;
-/// File extensions recognised as movies.
-pub const VIDEO_EXTENSIONS: &[&str] = &["mp4", "m4v", "mov", "mkv", "webm", "mxf"];
+pub use effectcraft_project::VIDEO_EXTENSIONS;
 
 /// File extensions recognised as 3D models (Advanced 3D model layers).
 pub const MODEL_EXTENSIONS: &[&str] = &["gltf", "glb", "obj", "stl", "fbx"];
@@ -79,8 +83,47 @@ pub fn is_importable(path: &std::path::Path) -> bool {
         || dpx::EXTENSIONS.contains(&ext.as_str())
 }
 
+/// A whole file's bytes, refusing anything that isn't a regular file: a project can name
+/// `/dev/zero` or a FIFO as footage, and reading those never ends (#2134).
+pub(crate) fn read_regular_file(path: &std::path::Path) -> std::io::Result<Vec<u8>> {
+    read_regular_file_stamped(path).map(|(bytes, _)| bytes)
+}
+
+/// [`read_regular_file`] with the file's identity, from the metadata of the open file (no
+/// second look at the path).
+pub(crate) fn read_regular_file_stamped(path: &std::path::Path) -> std::io::Result<(Vec<u8>, effectcraft_render::reads::FileStamp)> {
+    use std::io::Read;
+    #[cfg(test)]
+    count_open(path);
+    let mut file = std::fs::File::open(path)?;
+    let meta = file.metadata()?;
+    if !meta.is_file() {
+        return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, format!("{} is not a file", path.display())));
+    }
+    let mut bytes = Vec::new();
+    // A sparse file can claim far more than memory: an error, not an abort.
+    bytes.try_reserve_exact(usize::try_from(meta.len()).unwrap_or(usize::MAX)).map_err(|e| std::io::Error::new(std::io::ErrorKind::OutOfMemory, e))?;
+    file.read_to_end(&mut bytes)?;
+    Ok((bytes, effectcraft_render::reads::FileStamp::of_metadata(&meta)))
+}
+
+#[cfg(test)]
+static OPENS: std::sync::Mutex<Vec<std::path::PathBuf>> = std::sync::Mutex::new(Vec::new());
+
+/// Count an open of a file (tests: which files a render touched on disk).
+#[cfg(test)]
+pub(crate) fn count_open(path: &std::path::Path) {
+    OPENS.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(path.to_path_buf());
+}
+
+/// How many times files under `dir` were opened so far (tests).
+#[cfg(test)]
+pub(crate) fn opens_under(dir: &std::path::Path) -> usize {
+    OPENS.lock().unwrap_or_else(std::sync::PoisonError::into_inner).iter().filter(|p| p.starts_with(dir)).count()
+}
+
 pub(crate) fn ext_of(path: &std::path::Path) -> String {
-    path.extension().and_then(|e| e.to_str()).unwrap_or("").to_ascii_lowercase()
+    path.extension().and_then(std::ffi::OsStr::to_str).unwrap_or("").to_ascii_lowercase()
 }
 
 /// The `image` crate format of a still: from its signature, else from its extension (Targa has
@@ -99,3 +142,20 @@ pub(crate) fn still_format(path: &str, bytes: &[u8]) -> Option<image::ImageForma
 pub(crate) fn rate_from_fc(r: filmcraft_time::FrameRate) -> effectcraft_time::FrameRate {
     if r.num > 0 && r.den > 0 { effectcraft_time::FrameRate::new(r.num, r.den) } else { effectcraft_time::FrameRate::FPS_30 }
 }
+
+#[cfg(test)]
+mod read_tests {
+    /// #2134: a folder (and on Unix a device) named as footage is an error, not an endless read.
+    #[test]
+    fn only_regular_files_are_read_whole() {
+        let dir = std::env::temp_dir();
+        assert!(super::read_regular_file(&dir).is_err());
+        assert!(crate::probe::probe(&dir).is_err(), "probing a folder fails instead of reading it");
+        #[cfg(unix)]
+        assert!(super::read_regular_file(std::path::Path::new("/dev/zero")).is_err());
+        let f = dir.join(format!("ec-read-regular-{}.bin", std::process::id()));
+        std::fs::write(&f, b"abc").unwrap();
+        assert_eq!(super::read_regular_file(&f).unwrap(), b"abc");
+        let _ = std::fs::remove_file(f);
+    }
+}
diff --git a/crates/media/src/pool.rs b/crates/media/src/pool.rs
index 9a8ec5c28..cd6676220 100644
--- a/crates/media/src/pool.rs
+++ b/crates/media/src/pool.rs
@@ -6,13 +6,16 @@ use std::sync::{Arc, Condvar, Mutex, OnceLock};
 
 use effectcraft_project::{AlphaMode, Footage, FootageKind, ItemId};
 use effectcraft_raster::{Image, Px};
+use effectcraft_render::reads::{FileStamp, ReadFile, ReadFiles, ReadLog};
 use effectcraft_render::{FloatCurve, FootageSource};
 use effectcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
 use filmcraft_media::{FrameRequest, SharedSource};
 use image::metadata::Orientation;
 
 use crate::convert::{AlphaOp, dynamic_to_image, frame_to_image_in, frame_to_image_scaled, turned};
+use crate::downmix::Order;
 use crate::gif_anim::{self, Anim};
+use crate::reads;
 use crate::{MediaError, Result};
 
 /// Default frame-cache budget: 1 GiB of decoded frames.
@@ -39,16 +42,23 @@ fn colour_bars(w: u32, h: u32) -> Image {
 struct Key {
     path: Arc<str>,
     frame: i64,
-    /// The alpha interpretation (bits 0–1) and how float values are encoded (bits 2–3: sRGB,
-    /// as stored, a 2.4 power curve): they change the decoded pixels.
+    /// The alpha interpretation (bits 0–1), how float values are encoded (bits 2–3: sRGB, as
+    /// stored, a 2.4 power curve) and a placed PDF / Illustrator page's framing (bit 4,
+    /// [`Footage::placed_page`]): they change the decoded pixels.
     interp: u8,
     matte: [u32; 3],
     /// A movie frame made at this size for a reduced-resolution render ((0, 0): as decoded).
     size: (u32, u32),
+    /// A still at a reduced `size`: the footage's nominal size, which decides whether it is
+    /// resampled (see `Inner::still_at_size`); also at its own size for a placed PDF /
+    /// Illustrator page, which is drawn to fill it ([`Footage::placed_page`]); (0, 0) otherwise.
+    nominal: (u32, u32),
 }
 
 struct Entry {
     img: Arc<Image>,
+    /// The files the frame was decoded from (see [`crate::reads`]).
+    files: Arc<ReadFiles>,
     stamp: u64,
     bytes: usize,
 }
@@ -64,6 +74,10 @@ const CONFORM_VERSION: u32 = 3;
 /// conform thread allocate all of it at once (#408).
 const MAX_CONFORM_SECONDS: i64 = 24 * 3600;
 
+/// The sample rates audio is read at; a header outside them is damaged or hostile (#2141).
+const MIN_SAMPLE_RATE: u32 = 1_000;
+const MAX_SAMPLE_RATE: u32 = 768_000;
+
 /// The sample frames of `footage`'s audio at `rate` Hz that a conformed file holds, `None` past
 /// [`MAX_CONFORM_SECONDS`].
 #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
@@ -98,18 +112,20 @@ struct Lru {
 }
 
 impl Lru {
-    fn get(&mut self, k: &Key) -> Option<Arc<Image>> {
+    /// The cached image and its read files for `k`, marking the entry as most recently used.
+    fn get(&mut self, k: &Key) -> Option<(Arc<Image>, Arc<ReadFiles>)> {
         let e = self.map.get_mut(k)?;
         self.order.remove(&e.stamp);
         self.clock += 1;
         e.stamp = self.clock;
         self.order.insert(e.stamp, k.clone());
-        Some(e.img.clone())
+        Some((e.img.clone(), e.files.clone()))
     }
-    fn insert(&mut self, k: Key, img: Arc<Image>, budget: usize) {
+    /// Stores an image with its read files under `k` and evicts the least recently used entries until the cache fits `budget` bytes.
+    fn insert(&mut self, k: Key, img: Arc<Image>, files: Arc<ReadFiles>, budget: usize) {
         let bytes = img.data.len() * std::mem::size_of::<Px>() + 64;
         self.clock += 1;
-        if let Some(old) = self.map.insert(k.clone(), Entry { img, stamp: self.clock, bytes }) {
+        if let Some(old) = self.map.insert(k.clone(), Entry { img, files, stamp: self.clock, bytes }) {
             self.order.remove(&old.stamp);
             self.bytes -= old.bytes;
         }
@@ -171,13 +187,40 @@ struct CacheState {
     last: HashMap<Arc<str>, i64>,
 }
 
-/// A movie/audio source by path and the turn its picture is shown with
-/// ([`crate::probe::video_turn`]), opened by the first caller while the others wait for it
-/// (`None`: failed to open; not retried until `forget`).
-type SourceSlot = Arc<OnceLock<Option<(SharedSource, Orientation)>>>;
+/// A movie/audio source by path ([`Opened`]), opened by the first caller while the others wait
+/// for it (`None`: failed to open; not retried until `forget`), with the file's identity as
+/// opened.
+type SourceSlot = Arc<OnceLock<(Option<Opened>, ReadFile)>>;
+
+/// An opened movie/audio source, the turn its picture is shown with and the order its decoded
+/// audio channels arrive in.
+#[derive(Clone)]
+struct Opened {
+    src: SharedSource,
+    turn: Orientation,
+    order: Order,
+}
+
+impl Opened {
+    /// `src` with what its container says: `header` is an MP4/MOV's ftyp and moov (or the whole
+    /// file), `file` the file for other containers' AAC configuration.
+    fn new(src: SharedSource, header: Option<&[u8]>, file: Option<&dyn filmcraft_media::ByteReader>) -> Opened {
+        let turn = header.map_or(Orientation::NoTransforms, crate::probe::video_turn);
+        Opened { order: channel_order(&src, header, file), src, turn }
+    }
+}
+
+/// The order `src`'s audio channels decode in; multichannel AAC's by its configuration, where
+/// the container's header shows it ([`crate::aac::config`]).
+fn channel_order(src: &SharedSource, header: Option<&[u8]>, file: Option<&dyn filmcraft_media::ByteReader>) -> Order {
+    match src.info().audio() {
+        Some(a) if a.codec.contains("AAC") && a.channels > 2 => crate::aac::config(header, file).map_or(Order::Aac, |asc| crate::downmix::aac_order(&asc)),
+        _ => Order::Wav,
+    }
+}
 
 /// An animated GIF by path, as [`SourceSlot`] (the error message when it failed to load).
-type GifSlot = Arc<OnceLock<std::result::Result<Arc<Anim>, String>>>;
+type GifSlot = Arc<OnceLock<(std::result::Result<Arc<Anim>, String>, ReadFile)>>;
 
 struct Inner {
     /// Opened movie/audio sources by path.
@@ -186,8 +229,9 @@ struct Inner {
     opened: AtomicU64,
     /// In-memory files registered with `add_bytes` (web builds, tests).
     files: Mutex<HashMap<String, Arc<[u8]>>>,
-    /// Parsed 3D models by path (`None`: failed to load; not retried until `forget`).
-    models: Mutex<HashMap<String, Option<Arc<effectcraft_model::Model>>>>,
+    /// Parsed 3D models by path (`None`: failed to load; not retried until `forget`), with the
+    /// files read for them (the model's and the resources it names).
+    models: Mutex<HashMap<String, (Option<Arc<effectcraft_model::Model>>, Arc<ReadFiles>)>>,
     /// Decoded animated GIFs and WebPs by path, loaded by the first caller while the others wait (an
     /// `Err` is not retried until `forget`).
     gifs: Mutex<HashMap<Arc<str>, GifSlot>>,
@@ -211,6 +255,25 @@ struct Inner {
     /// Movies that failed to open or decode (path to a readable reason; see
     /// [`FootageSource::problem`]). The first failure of a file is logged, later ones are not.
     problems: Mutex<HashMap<Arc<str>, String>>,
+    /// OpenEXR footage (by path) whose channels effects read (EXtractoR, Cryptomatte, the 3D
+    /// Channel effects): its pictures come from the same cached decode (#474).
+    aux_footage: Mutex<AuxFootage>,
+}
+
+/// Footage whose channels effects read ([`Inner::aux_footage`]), by [`Footage::path`].
+#[derive(Default)]
+struct AuxFootage {
+    /// What the project says ([`FootageSource::set_aux_footage`]).
+    given: HashSet<String>,
+    /// Read through [`FootageSource::aux`] but not given (a reader the project doesn't name, or
+    /// a source that never gives a set). Cleared with each new set.
+    learned: HashSet<String>,
+}
+
+impl AuxFootage {
+    fn contains(&self, path: &str) -> bool {
+        self.given.contains(path) || self.learned.contains(path)
+    }
 }
 
 /// Decodes footage for the renderer: stills, image sequences and movies (FilmCraft codecs), plus
@@ -281,6 +344,7 @@ impl MediaPool {
                 conforming: Mutex::default(),
                 conform_failed: Mutex::default(),
                 problems: Mutex::default(),
+                aux_footage: Mutex::default(),
             }),
         }
     }
@@ -385,11 +449,13 @@ impl MediaPool {
     }
 
     /// The conformed-audio file of `path` at `rate` (named by a hash of the path, size and
-    /// modification time, so an edited file conforms again, and of [`CONFORM_VERSION`]).
+    /// modification time, so an edited file conforms again, and of `CONFORM_VERSION`). Notes
+    /// `path` as read with that identity (see [`crate::reads`]): its samples come from it.
     pub fn conformed_path(&self, path: &str, rate: u32) -> Option<std::path::PathBuf> {
         use std::hash::{Hash, Hasher};
         let folder = lock(&self.inner.conform).clone()?;
         let meta = std::fs::metadata(path).ok()?;
+        reads::note(ReadFile::new(path, FileStamp::of_metadata(&meta)));
         let mut h = std::collections::hash_map::DefaultHasher::new();
         (CONFORM_VERSION, path, meta.len(), meta.modified().ok()).hash(&mut h);
         Some(folder.join(format!("{:016x}_{rate}.ecaf", h.finish())))
@@ -507,18 +573,23 @@ impl MediaPool {
     /// [`MediaPool::decode_audio`], failing when the source can't be opened or read.
     fn try_decode_audio(&self, footage: &Footage, start: Tick, frames: usize, rate: u32) -> std::result::Result<Vec<f32>, String> {
         let path: Arc<str> = footage.path.as_str().into();
-        let src = self.inner.source(&path).ok_or("the file can't be opened")?;
+        let Opened { src, order, .. } = self.inner.opened(&path).ok_or("the file can't be opened")?;
         let s0 = start.to_units_floor(rate as i64);
-        let native = src.info().audio.as_ref().map_or(rate, |a| a.sample_rate);
+        let native = src.info().audio().map_or(rate, |a| a.sample_rate);
+        // The header's rate scales the samples read: 0xFFFFFFFF Hz made one conform chunk about
+        // 47 GB (#2141). Real audio is 1–768 kHz.
+        if native != 0 && !(MIN_SAMPLE_RATE..=MAX_SAMPLE_RATE).contains(&native) {
+            return Err(format!("a sample rate of {native} Hz is outside {MIN_SAMPLE_RATE}–{MAX_SAMPLE_RATE} Hz"));
+        }
         if native == 0 || rate == 0 || native == rate {
-            return read_stereo(&src, s0, frames, rate);
+            return read_stereo(&src, &order, s0, frames, rate);
         }
         // Output sample `n` sits at source position n × native / rate.
         let (native_i, rate_i) = (i128::from(native), i128::from(rate));
         let first = (i128::from(s0) * native_i).div_euclid(rate_i);
         let last = ((i128::from(s0) + frames as i128) * native_i).div_euclid(rate_i) + 1;
         let (Ok(first64), Ok(count)) = (i64::try_from(first), usize::try_from(last - first + 1)) else { return Ok(vec![0.0; frames * 2]) };
-        let buf = read_stereo(&src, first64, count, native)?;
+        let buf = read_stereo(&src, &order, first64, count, native)?;
         let mut out = Vec::with_capacity(frames * 2);
         for k in 0..frames as i128 {
             let pos = (i128::from(s0) + k) * native_i;
@@ -553,16 +624,20 @@ impl Inner {
 
     /// A 3D model file and its sibling resources (buffers, textures, MTL files), parsed once.
     fn model(&self, path: &str) -> Option<Arc<effectcraft_model::Model>> {
-        if let Some(m) = lock(&self.models).get(path) {
-            return m.clone();
+        let found = lock(&self.models).get(path).cloned();
+        if let Some((m, files)) = found {
+            reads::note_all(&files);
+            return m;
         }
-        let loaded = self.read(path).map_err(|e| e.to_string()).and_then(|bytes| {
-            // Files the model names are read only when local or on the model's own network share.
-            let resolve = |uri: &str| -> Option<Vec<u8>> {
-                let p = craft_docpath::resolve(uri, Some(std::path::Path::new(path))).ok().filter(|p| p.is_absolute())?;
-                self.read(&p.to_string_lossy()).ok().map(|b| b.to_vec())
-            };
-            effectcraft_model::load(path, &bytes, &resolve).map_err(|e| e.to_string())
+        let (loaded, files) = reads::captured(|| {
+            self.read(path).map_err(|e| e.to_string()).and_then(|bytes| {
+                // Files the model names are read only when local or on the model's own network share.
+                let resolve = |uri: &str| -> Option<Vec<u8>> {
+                    let p = craft_docpath::resolve_absolute(uri, Some(std::path::Path::new(path))).ok()?;
+                    self.read(&p.to_string_lossy()).ok().map(|b| b.to_vec())
+                };
+                effectcraft_model::load(path, &bytes, &resolve).map_err(|e| e.to_string())
+            })
         });
         let m = match loaded {
             Ok(m) => Some(Arc::new(m)),
@@ -571,55 +646,72 @@ impl Inner {
                 None
             }
         };
-        lock(&self.models).entry(path.to_string()).or_insert(m).clone()
+        let (m, files) = lock(&self.models).entry(path.to_string()).or_insert((m, Arc::new(files))).clone();
+        reads::note_all(&files);
+        m
     }
 
+    /// The bytes of the file at `path`, noted as read (see [`crate::reads`]).
     fn read(&self, path: &str) -> Result<Arc<[u8]>> {
-        if let Some(b) = lock(&self.files).get(path) {
-            return Ok(b.clone());
+        let (bytes, file) = self.read_file(path);
+        reads::note(file);
+        bytes
+    }
+
+    /// The bytes of the file at `path` and its identity as read ([`FileStamp::Missing`] when it
+    /// can't be read), not noted.
+    fn read_file(&self, path: &str) -> (Result<Arc<[u8]>>, ReadFile) {
+        let in_memory = lock(&self.files).get(path).cloned();
+        if let Some(b) = in_memory {
+            return (Ok(b), ReadFile::new(path, FileStamp::Virtual));
+        }
+        match crate::read_regular_file_stamped(std::path::Path::new(path)) {
+            Ok((bytes, stamp)) => (Ok(bytes.into()), ReadFile::new(path, stamp)),
+            Err(e) => (Err(MediaError::Io(format!("{path}: {e}"))), ReadFile::new(path, FileStamp::Missing)),
         }
-        std::fs::read(path).map(Into::into).map_err(|e| MediaError::Io(format!("{path}: {e}")))
     }
 
-    /// The opened movie/audio source for `path`. The first caller opens it, outside the map's
-    /// lock (reading and parsing a large file takes a moment; FLAC, MP3, Ogg and AIFF files are
-    /// decoded whole); callers asking for the same file meanwhile wait for that instead of opening
-    /// it again: a preview's frame workers, audio feeder, conform and waveform threads each
-    /// decoded a long FLAC in full at once (#408).
-    fn source(&self, path: &Arc<str>) -> Option<SharedSource> {
-        self.opened(path).map(|(src, _)| src)
-    }
-
-    /// [`Self::source`] and the turn the movie's picture is shown with.
-    fn opened(&self, path: &Arc<str>) -> Option<(SharedSource, Orientation)> {
+    /// The opened movie/audio source for `path` ([`Opened`]). The first caller opens it, outside
+    /// the map's lock (reading and parsing a large file takes a moment; FLAC, MP3, Ogg and AIFF
+    /// files are decoded whole); callers asking for the same file meanwhile wait for that instead
+    /// of opening it again: a preview's frame workers, audio feeder, conform and waveform threads
+    /// each decoded a long FLAC in full at once (#408).
+    /// Each call notes the file as read (see [`crate::reads`]), with its identity as opened.
+    fn opened(&self, path: &Arc<str>) -> Option<Opened> {
         let slot = lock(&self.sources).entry(path.clone()).or_default().clone();
-        slot.get_or_init(|| {
-            self.opened.fetch_add(1, Ordering::Relaxed);
-            // Files on disk are read in place (the index, then samples on demand) rather than
-            // whole; in-memory files (`add_bytes`) and wasm32 builds open from bytes.
-            let in_memory = lock(&self.files).contains_key(&**path);
-            let file = std::path::Path::new(&**path);
-            let in_place = if in_memory { None } else { crate::stream::open_source(file) };
-            let in_place = in_place.map(|src| {
-                let turn = crate::stream::movie_header(file).map_or(Orientation::NoTransforms, |h| crate::probe::video_turn(&h));
-                src.map(|src| (src, turn))
+        let (opened, file) = slot.get_or_init(|| self.open(path));
+        reads::note(file.clone());
+        opened.clone()
+    }
+
+    /// Open the movie/audio file at `path` (see [`Inner::opened`]), with its identity as opened.
+    fn open(&self, path: &Arc<str>) -> (Option<Opened>, ReadFile) {
+        self.opened.fetch_add(1, Ordering::Relaxed);
+        // Files on disk are read in place (the index, then samples on demand) rather than
+        // whole; in-memory files (`add_bytes`) and wasm32 builds open from bytes.
+        let in_memory = lock(&self.files).contains_key(&**path);
+        let file = std::path::Path::new(&**path);
+        let in_place = if in_memory { None } else { crate::stream::open_source(file) };
+        let in_place = in_place.map(|(src, stamp)| {
+            let (header, reader) = (crate::stream::movie_header(file), crate::stream::file_reader(file));
+            (src.map(|src| Opened::new(src, header.as_deref(), reader.as_deref())), ReadFile::new(path.clone(), stamp))
+        });
+        let (opened, read) = in_place.unwrap_or_else(|| {
+            let (bytes, read) = self.read_file(path);
+            let opened = bytes.and_then(|bytes| {
+                let name = std::path::Path::new(&**path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
+                let src = filmcraft_codecs::open_bytes(&name, bytes.clone()).map_err(MediaError::from)?;
+                Ok(Opened::new(src, Some(&bytes), Some(&filmcraft_media::reader::MemReader(bytes.clone()))))
             });
-            let opened = in_place.unwrap_or_else(|| {
-                self.read(path).and_then(|bytes| {
-                    let name = std::path::Path::new(&**path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
-                    let turn = crate::probe::video_turn(&bytes);
-                    filmcraft_codecs::open_bytes(&name, bytes).map(|src| (src, turn)).map_err(MediaError::from)
-                })
-            });
-            match opened {
-                Ok(s) => Some(s),
-                Err(e) => {
-                    self.note_problem(path, "", &e);
-                    None
-                }
+            (opened, read)
+        });
+        match opened {
+            Ok(s) => (Some(s), read),
+            Err(e) => {
+                self.note_problem(path, "", &e);
+                (None, read)
             }
-        })
-        .clone()
+        }
     }
 
     /// Remember why the movie at `path` cannot be shown (`codec` is the footage's, when known)
@@ -640,13 +732,15 @@ impl Inner {
     /// map's lock; callers asking for the same file meanwhile wait for that.
     fn gif(&self, path: &Arc<str>) -> Result<Arc<Anim>> {
         let slot = lock(&self.gifs).entry(path.clone()).or_default().clone();
-        let loaded = slot.get_or_init(|| {
-            let loaded = self.read(path).and_then(|bytes| Anim::load(&bytes));
-            loaded.map(Arc::new).map_err(|e| {
+        let (loaded, file) = slot.get_or_init(|| {
+            let (bytes, file) = self.read_file(path);
+            let loaded = bytes.and_then(|bytes| Anim::load(&bytes)).map(Arc::new).map_err(|e| {
                 log::warn!("media: cannot decode {path}: {e}");
                 e.to_string()
-            })
+            });
+            (loaded, file)
         });
+        reads::note(file.clone());
         loaded.clone().map_err(|e| MediaError::Decode(format!("{path}: {e}")))
     }
 
@@ -664,6 +758,8 @@ impl Inner {
         ((d.0 as i128 * rate.num as i128 + den / 2) / den) as i64
     }
 
+    /// Where the frame of `footage` at `t` comes from (file, frame or media time) and its cache
+    /// key, at the footage's own size.
     fn locate(footage: &Footage, t: Tick, float: FloatCurve) -> Loc {
         let alpha = match footage.alpha {
             AlphaMode::Straight => 0,
@@ -676,15 +772,16 @@ impl Inner {
                 FloatCurve::Srgb => 0,
                 FloatCurve::Linear => 1,
                 FloatCurve::Gamma24 => 2,
-            } << 2);
+            } << 2)
+            | (u8::from(footage.placed_page) << 4);
         let matte = if footage.alpha == AlphaMode::Premultiplied { footage.premul_color.map(f32::to_bits) } else { [0; 3] };
-        let key = |path: &str, frame| Key { path: path.into(), frame, interp, matte, size: (0, 0) };
+        let key = |path: &str, frame| Key { path: path.into(), frame, interp, matte, size: (0, 0), nominal: (0, 0) };
         match footage.kind {
             FootageKind::Sequence if !footage.sequence.is_empty() => {
                 let i = Self::frame_index(footage.frame_rate, t, footage.sequence_frames(), footage.loop_count);
-                match footage.sequence_file(i) {
+                match footage.sequence_file_held(i) {
                     Some(path) => Loc { key: key(path, 0), media_t: None, float },
-                    // A gap in the numbering: colour bars, as in After Effects.
+                    // No file at or before the frame: colour bars.
                     None => Loc { key: key(PLACEHOLDER, ((footage.width as i64) << 32) | footage.height as i64), media_t: None, float },
                 }
             }
@@ -700,41 +797,49 @@ impl Inner {
                 let rate = footage.frame_rate;
                 let n = Self::frame_count(rate, footage.duration);
                 let i = Self::frame_index(rate, t, n, footage.loop_count);
-                // Middle of the frame in the file's own timing (robust to timestamp rounding).
+                // A quarter into the frame in the file's own timing: FilmCraft rounds a request to
+                // the track's nearest timestamp unit (halves up), so the middle of a frame would
+                // land on the next one when the timescale is the frame rate; a quarter still
+                // tolerates timestamps rounded either way.
                 let native = footage.native_rate.unwrap_or(rate);
-                let mt = native.tick_of(i) + Tick(native.frame_duration().0 / 2);
+                let mt = native.tick_of(i) + Tick(native.frame_duration().0 / 4);
                 Loc { key: key(&footage.path, i), media_t: Some(mt), float }
             }
         }
     }
 
-    /// The frame of `footage` at `t`; a movie's resampled to `size` when it can be made at that
-    /// size directly (see [`FootageSource::frame_at_size`]).
+    /// The frame of `footage` at `t`, resampled to `size` (see [`FootageSource::frame_at_size`]):
+    /// a movie's made at that size directly, a still's resampled once and kept at that size.
     fn frame_at(self: &Arc<Self>, footage: &Footage, t: Tick, playback: bool, size: Option<(u32, u32)>, float: FloatCurve) -> Result<Arc<Image>> {
         if !footage.has_video {
             return Err(MediaError::Unsupported(format!("{}: no video", footage.path)));
         }
         let mut loc = Self::locate(footage, t, float);
         let movie = loc.media_t.is_some();
-        if movie && let Some(size) = size {
+        // A still asked for at its own size is the unsized frame (one decode, one entry).
+        if let Some(size) = size.filter(|s| movie || *s != (footage.width, footage.height)) {
             loc.key.size = size;
+            if !movie {
+                loc.key.nominal = (footage.width, footage.height);
+            }
+        }
+        // A placed PDF / Illustrator page is drawn to fill the footage's size (`layered::decode`,
+        // #3099): two items of one file stored at different sizes have different pixels.
+        if footage.placed_page && !movie {
+            loc.key.nominal = (footage.width, footage.height);
         }
         let mut c = lock(&self.cache);
         // sequential playback of a movie: read the next frame ahead
         if playback && movie {
-            let prev = c.last.insert(loc.key.path.clone(), loc.key.frame);
-            if prev == Some(loc.key.frame - 1) && self.read_ahead.load(Ordering::Relaxed) {
-                let next_t = t + footage.frame_rate.frame_duration();
-                let mut next = Self::locate(footage, next_t, float);
-                next.key.size = loc.key.size;
-                if next.key != loc.key && !c.lru.map.contains_key(&next.key) && !c.inflight.contains(&next.key) {
-                    self.prefetch(footage, next_t, size, float);
-                }
-            }
+            self.prefetch_next(&mut c, &loc, footage, t, size, float);
         }
+        // (Each exit notes the files the frame came from, see `crate::reads`; a cached frame
+        // notes those it was decoded from, without touching them.)
         loop {
-            if let Some(img) = c.lru.get(&loc.key) {
+            if let Some((img, files)) = c.lru.get(&loc.key) {
                 self.hits.fetch_add(1, Ordering::Relaxed);
+                drop(c);
+                reads::note_all(&files);
                 return Ok(img);
             }
             if !c.inflight.contains(&loc.key) {
@@ -747,19 +852,36 @@ impl Inner {
             if rayon::current_thread_index().is_some() {
                 self.misses.fetch_add(1, Ordering::Relaxed);
                 drop(c);
-                return Ok(Arc::new(self.decode(&loc, footage)?));
+                let (img, files) = reads::captured(|| self.decode(&loc, footage));
+                reads::note_all(&files);
+                return Ok(Arc::new(img?));
             }
-            c = self.done.wait(c).unwrap_or_else(|e| e.into_inner());
+            c = self.done.wait(c).unwrap_or_else(std::sync::PoisonError::into_inner);
         }
         self.misses.fetch_add(1, Ordering::Relaxed);
         c.inflight.insert(loc.key.clone());
         drop(c);
         let _guard = Inflight { inner: self, key: loc.key.clone() };
-        let img = Arc::new(self.decode(&loc, footage)?);
-        lock(&self.cache).lru.insert(loc.key, img.clone(), self.budget());
+        let (img, files) = reads::captured(|| self.decode(&loc, footage));
+        reads::note_all(&files);
+        let img = Arc::new(img?);
+        lock(&self.cache).lru.insert(loc.key, img.clone(), Arc::new(files), self.budget());
         Ok(img)
     }
 
+    /// Sequential playback of a movie (`loc`, at `t`): read the frame after it ahead.
+    fn prefetch_next(self: &Arc<Self>, c: &mut CacheState, loc: &Loc, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) {
+        let prev = c.last.insert(loc.key.path.clone(), loc.key.frame);
+        if prev == Some(loc.key.frame - 1) && self.read_ahead.load(Ordering::Relaxed) {
+            let next_t = t + footage.frame_rate.frame_duration();
+            let mut next = Self::locate(footage, next_t, float);
+            next.key.size = loc.key.size;
+            if next.key != loc.key && !c.lru.map.contains_key(&next.key) && !c.inflight.contains(&next.key) {
+                self.prefetch(footage, next_t, size, float);
+            }
+        }
+    }
+
     #[cfg(not(target_arch = "wasm32"))]
     fn prefetch(self: &Arc<Self>, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) {
         let (me, f) = (self.clone(), footage.clone());
@@ -773,41 +895,82 @@ impl Inner {
     #[cfg(target_arch = "wasm32")]
     fn prefetch(self: &Arc<Self>, _footage: &Footage, _t: Tick, _size: Option<(u32, u32)>, _float: FloatCurve) {}
 
+    /// A still (image file or sequence frame) at `loc.key.size` when one is set: resampled as the
+    /// renderer would ([`FootageSource::frame_at_size`]), so the pool keeps the reduced frame and a
+    /// reduced-resolution render neither decodes nor resamples a large still again for every frame
+    /// (#1812: 21120-px plates at Quarter). Like the renderer's `footage_buf`, an image decoded
+    /// larger than the footage's nominal size (a smart object's pixels) is resampled too, and one
+    /// decoded smaller is not (the renderer scales the layer instead).
+    fn still_at_size(img: Image, loc: &Loc, footage: &Footage) -> Image {
+        let (w, h) = loc.key.size;
+        let smaller = img.width == 0 || footage.width as f64 / img.width as f64 > 1.0 + 1e-9;
+        if w == 0 || h == 0 || smaller || (w, h) == (img.width, img.height) {
+            return img;
+        }
+        effectcraft_raster::resample(&img, w, h)
+    }
+
     fn decode(&self, loc: &Loc, footage: &Footage) -> Result<Image> {
+        match loc.media_t {
+            None => self.decode_still(loc, footage).map(|img| Self::still_at_size(img, loc, footage)),
+            Some(_) => self.decode_media(loc, footage),
+        }
+    }
+
+    /// Decodes the still image at `loc` and applies the footage alpha and float handling.
+    /// A placeholder path decodes to colour bars.
+    fn decode_still(&self, loc: &Loc, footage: &Footage) -> Result<Image> {
+        let op = AlphaOp::of(footage, loc.float);
+        let path = &loc.key.path;
+        if &**path == PLACEHOLDER {
+            return Ok(colour_bars(footage.width, footage.height));
+        }
+        let (bytes, file) = self.read_file(path);
+        reads::note(file.clone());
+        let bytes = bytes?;
+        if let Some(img) = crate::dpx::decode(path, &bytes)? {
+            return Ok(dynamic_to_image(&img, op));
+        }
+        if let Some(img) = crate::layered::decode(path, &bytes, footage, op)? {
+            return Ok(img);
+        }
+        // (an OpenEXR compression the decoder lacks came out transparent or as a missing
+        // channel error)
+        if path.to_ascii_lowercase().ends_with(".exr")
+            && let Some(why) = crate::exr_channels::unsupported_compression(&bytes)
+        {
+            return Err(MediaError::Decode(format!("{path}: {why}")));
+        }
+        // An effect reads this footage's channels: the picture is made of the same decode (#474).
+        let shared = lock(&self.aux_footage).contains(&footage.path);
+        if shared
+            && path.to_ascii_lowercase().ends_with(".exr")
+            && let Some(img) = crate::exr_channels::cached_picture(path, bytes.clone(), &file, op)
+        {
+            return Ok(img);
+        }
+        #[cfg(test)]
+        crate::exr_channels::count_decode(false);
+        match crate::probe::load_oriented(&bytes, crate::still_format(path, &bytes)) {
+            Ok(img) => Ok(dynamic_to_image(&img, op)),
+            // A multi-layer OpenEXR file without an unnamed RGB layer: its colour layer.
+            Err(e) => crate::exr_channels::layered_picture(path, bytes, &file, op, shared)
+                .map_err(|why| MediaError::Decode(format!("{path}: {}", why.unwrap_or_else(|| e.to_string())))),
+        }
+    }
+
+    fn decode_media(&self, loc: &Loc, footage: &Footage) -> Result<Image> {
         let op = AlphaOp::of(footage, loc.float);
         let path = &loc.key.path;
         match loc.media_t {
-            None if &**path == PLACEHOLDER => Ok(colour_bars(footage.width, footage.height)),
-            None => {
-                let bytes = self.read(path)?;
-                if let Some(img) = crate::dpx::decode(path, &bytes)? {
-                    return Ok(dynamic_to_image(&img, op));
-                }
-                if let Some(img) = crate::layered::decode(path, &bytes, footage, op)? {
-                    return Ok(img);
-                }
-                // (an OpenEXR compression the decoder lacks came out transparent or as a missing
-                // channel error)
-                if path.to_ascii_lowercase().ends_with(".exr")
-                    && let Some(why) = crate::exr_channels::unsupported_compression(&bytes)
-                {
-                    return Err(MediaError::Decode(format!("{path}: {why}")));
-                }
-                let loaded = crate::probe::load_oriented(&bytes, crate::still_format(path, &bytes));
-                let img = match loaded {
-                    Ok(img) => img,
-                    // A multi-layer OpenEXR file without an unnamed RGB layer: its colour layer.
-                    Err(e) => crate::exr_channels::cached_layered_image(path, bytes).ok_or_else(|| MediaError::Decode(format!("{path}: {e}")))?,
-                };
-                Ok(dynamic_to_image(&img, op))
-            }
+            None => self.decode_still(loc, footage),
             Some(mt) if gif_anim::is_animated(footage) => {
                 let anim = self.gif(path)?;
                 let frame = anim.frame_at(Tick(mt.0)).ok_or_else(|| MediaError::Decode(format!("{path}: no frames")))?;
                 Ok(dynamic_to_image(frame, op))
             }
             Some(mt) => {
-                let (src, turn) = self.opened(path).ok_or_else(|| MediaError::Io(format!("{path}: cannot open")))?;
+                let Opened { src, turn, .. } = self.opened(path).ok_or_else(|| MediaError::Io(format!("{path}: cannot open")))?;
                 let vf = src
                     .video_frame(FrameRequest::full(filmcraft_time::Tick(mt.0)))
                     .map_err(MediaError::from)
@@ -859,6 +1022,13 @@ impl FootageSource for MediaPool {
     fn cancellable(&self, cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
         filmcraft_media::cancel::with_cancel(cancel, f)
     }
+    /// Every read of a file notes it (see [`crate::reads`]): a frame's image file or sequence
+    /// frame, a movie, a model and the files it names, an EXR's channels, a movie's audio. A
+    /// frame (or other entry) served from memory notes the files it was made of, as they were
+    /// when read, without reading them again. A missing sequence frame (colour bars) reads none.
+    fn recording(&self, reads: &ReadLog, f: &mut dyn FnMut()) {
+        reads::recording(reads, f)
+    }
     fn frame(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<Image>> {
         self.frame_sized(item, footage, t, None, FloatCurve::Srgb)
     }
@@ -881,7 +1051,17 @@ impl FootageSource for MediaPool {
             return None;
         }
         let bytes = self.inner.read(&footage.path).ok()?;
-        crate::layered::rasterize_vector(&footage.path, &bytes, footage.layer.as_ref(), footage.page, scale).map(Arc::new)
+        crate::layered::rasterize_vector(&footage.path, &bytes, footage, scale).map(Arc::new)
+    }
+
+    fn set_aux_footage(&self, paths: &[String]) {
+        let given: HashSet<String> = paths.iter().cloned().collect();
+        let mut wanted = lock(&self.inner.aux_footage);
+        if given != wanted.given || !wanted.learned.is_empty() {
+            crate::exr_channels::release_held();
+        }
+        wanted.given = given;
+        wanted.learned.clear();
     }
 
     fn aux(&self, _item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<effectcraft_raster::AuxChannels>> {
@@ -893,6 +1073,16 @@ impl FootageSource for MediaPool {
             return None;
         }
         let path = loc.key.path.clone();
+        {
+            let mut wanted = lock(&self.inner.aux_footage);
+            if !wanted.contains(&footage.path) {
+                // (a bound: names of footage items, cleared otherwise only by a new set)
+                if wanted.learned.len() >= 4096 {
+                    wanted.learned.clear();
+                }
+                wanted.learned.insert(footage.path.clone());
+            }
+        }
         crate::exr_channels::cached(&path, || self.inner.read(&path).ok())
     }
 
@@ -906,8 +1096,8 @@ impl FootageSource for MediaPool {
 
 /// `frames` stereo sample frames (interleaved) of `src` from sample `s0` at `rate` Hz, which
 /// FilmCraft serves as decoded when it is the source's own rate. Mono is duplicated to both
-/// channels, multichannel sources are downmixed ([`crate::downmix`]); silence before the start. An error where decoding fails.
-fn read_stereo(src: &SharedSource, s0: i64, frames: usize, rate: u32) -> std::result::Result<Vec<f32>, String> {
+/// channels, multichannel sources (channels in `order`) are downmixed ([`crate::downmix`]); silence before the start. An error where decoding fails.
+fn read_stereo(src: &SharedSource, order: &Order, s0: i64, frames: usize, rate: u32) -> std::result::Result<Vec<f32>, String> {
     let mut out = vec![0.0; frames * 2];
     let skip = usize::try_from(s0.saturating_neg()).unwrap_or(0);
     if skip >= frames {
@@ -915,8 +1105,7 @@ fn read_stereo(src: &SharedSource, s0: i64, frames: usize, rate: u32) -> std::re
     }
     let buf = src.audio(s0.max(0), frames - skip, rate).map_err(|e| e.to_string())?;
     let Some(dst) = skip.checked_mul(2).and_then(|i| out.get_mut(i..)) else { return Ok(out) };
-    let aac = src.info().audio.as_ref().is_some_and(|a| a.codec.starts_with("AAC"));
-    crate::downmix::downmix_into(&buf.channels, aac, dst);
+    crate::downmix::downmix_into(&buf.channels, order, dst);
     Ok(out)
 }
 
@@ -937,7 +1126,7 @@ fn describe_problem(codec: &str, e: &MediaError) -> String {
 }
 
 fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
-    m.lock().unwrap_or_else(|e| e.into_inner())
+    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }
 
 #[cfg(test)]
@@ -1030,6 +1219,48 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    // Regression test for #382 (#274): resampling footage audio divided by the requested mix
+    // rate, so a rate of 0 panicked (division by zero); the read must come back instead.
+    #[test]
+    fn decoding_audio_at_a_zero_mix_rate_does_not_divide_by_zero() {
+        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/test-zero-rate");
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        // One second of a 440 Hz tone, 44.1 kHz mono 16-bit PCM: not the 48 kHz mix rate.
+        let native = 44_100u32;
+        let pcm: Vec<u8> =
+            (0..native).flat_map(|n| (((n as f32 * 440.0 * std::f32::consts::TAU / native as f32).sin() * 8000.0) as i16).to_le_bytes()).collect();
+        let mut wav = b"RIFF".to_vec();
+        wav.extend((36 + pcm.len() as u32).to_le_bytes());
+        wav.extend(b"WAVEfmt ");
+        wav.extend(16u32.to_le_bytes());
+        wav.extend([1u16, 1].iter().flat_map(|v| v.to_le_bytes()));
+        wav.extend(native.to_le_bytes());
+        wav.extend((native * 2).to_le_bytes());
+        wav.extend([2u16, 16].iter().flat_map(|v| v.to_le_bytes()));
+        wav.extend(b"data");
+        wav.extend((pcm.len() as u32).to_le_bytes());
+        wav.extend(&pcm);
+        let path = dir.join("tone.wav");
+        std::fs::write(&path, &wav).unwrap();
+        let footage = Footage {
+            path: path.to_string_lossy().into(),
+            kind: FootageKind::Audio,
+            duration: Tick::from_seconds_f64(1.0),
+            has_audio: true,
+            ..Default::default()
+        };
+        let pool = MediaPool::new();
+        // The file really is read, and resampled, at a normal rate...
+        let tone = pool.decode_audio(&footage, Tick::from_seconds_f64(0.1), 1024, 48_000);
+        assert!(tone.iter().any(|v| v.abs() > 0.05), "the tone is audible at 48 kHz");
+        // ...and a mix rate of 0 (which `audio_samples` itself turns away) returns a read of the
+        // requested length instead of dividing by it.
+        let degenerate = pool.try_decode_audio(&footage, Tick::from_seconds_f64(0.1), 64, 0).unwrap();
+        assert_eq!(degenerate.len(), 128);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn frame_index_loops_and_clamps() {
         let r = FrameRate::FPS_30;
@@ -1045,16 +1276,16 @@ mod tests {
     fn lru_respects_budget_and_recycles() {
         let mut c = Lru::default();
         let img = || Arc::new(Image::new(16, 16)); // 4 KiB + overhead
-        let k = |i| Key { path: "a".into(), frame: i, interp: 0, matte: [0; 3], size: (0, 0) };
+        let k = |i| Key { path: "a".into(), frame: i, interp: 0, matte: [0; 3], size: (0, 0), nominal: (0, 0) };
         let budget = 3 * (4096 + 64);
         for i in 0..10 {
-            c.insert(k(i), img(), budget);
+            c.insert(k(i), img(), Arc::default(), budget);
         }
         assert_eq!(c.map.len(), 3);
         assert!(c.get(&k(9)).is_some() && c.get(&k(6)).is_none());
         // touching 7 makes 8 the oldest
         c.get(&k(7));
-        c.insert(k(10), img(), budget);
+        c.insert(k(10), img(), Arc::default(), budget);
         assert!(c.get(&k(7)).is_some() && c.get(&k(8)).is_none());
         assert_eq!(c.spare.len(), MAX_SPARE);
         assert_eq!(c.take_spare(256).len(), 256);
@@ -1141,8 +1372,8 @@ mod tests {
         assert_eq!(px(&f, FloatCurve::Gamma24), g24);
     }
 
-    /// A model's material library is read beside it; one named by a path to another computer
-    /// is not read.
+    /// A model's material library is read beside it; one named by a path to another computer is
+    /// looked up under its own file name beside the model, never fetched from that machine (#1274).
     #[test]
     fn model_files_on_other_computers_are_not_read() {
         let dir = std::env::temp_dir().join(format!("ec-model-files-{}", std::process::id()));
@@ -1156,11 +1387,13 @@ mod tests {
             model.materials.iter().any(|m| m.base_color[..3] == [1.0, 0.0, 0.0])
         };
         assert!(red("beside.obj", "red.mtl"));
-        assert!(!red("unc.obj", r"\\192.0.2.1\share\red.mtl"));
-        assert!(!red("url.obj", "file://192.0.2.1/s/red.mtl"));
+        // 192.0.2.1 is a test-net address nothing here can reach, so these passes prove the
+        // material library came from beside the model, not from another computer.
+        assert!(red("unc.obj", r"\\192.0.2.1\share\red.mtl"));
+        assert!(red("url.obj", "file://192.0.2.1/s/red.mtl"));
         // Linux reads `//dir/red.mtl` as the local file.
         #[cfg(unix)]
-        assert!(!red("slashes.obj", &format!("/{}", dir.join("red.mtl").display())));
+        assert!(red("slashes.obj", &format!("/{}", dir.join("red.mtl").display())));
         let _ = std::fs::remove_dir_all(&dir);
     }
 }
diff --git a/crates/media/src/probe.rs b/crates/media/src/probe.rs
index 2793be251..1fc945aa1 100644
--- a/crates/media/src/probe.rs
+++ b/crates/media/src/probe.rs
@@ -23,16 +23,26 @@ pub fn probe(path: impl AsRef<Path>) -> Result<Footage> {
         let turn = header.as_deref().map_or(Orientation::NoTransforms, video_turn);
         turn_footage(&mut f, turn);
         correct_rate(&mut f, header.as_deref().and_then(video_rate));
+        trim_to_edits(&mut f, header.as_deref().and_then(video_shown));
         return Ok(f);
     }
-    let bytes = std::fs::read(path).map_err(|e| MediaError::Io(format!("{}: {e}", path.display())))?;
+    let bytes = crate::read_regular_file(path).map_err(|e| MediaError::Io(format!("{}: {e}", path.display())))?;
     if crate::MODEL_EXTENSIONS.contains(&ext_of(path).as_str()) {
-        let dir = path.parent().map(Path::to_path_buf).unwrap_or_default();
-        return probe_model(&path.to_string_lossy(), &bytes, &|uri| std::fs::read(dir.join(uri)).ok());
+        return probe_model(&path.to_string_lossy(), &bytes, &side_file_reader(path));
     }
     probe_bytes(&path.to_string_lossy(), bytes.into())
 }
 
+/// Reads the files a model file names (buffers, textures, MTL files). Like the pool, it follows only
+/// local files and files on the model's own network share: a URI is a path stored in the model.
+fn side_file_reader(model: &Path) -> impl Fn(&str) -> Option<Vec<u8>> + use<> {
+    let model = std::path::absolute(model).unwrap_or_else(|_| model.to_path_buf());
+    move |uri| {
+        let p = craft_docpath::resolve_absolute(uri, Some(&model)).ok()?;
+        crate::read_regular_file(&p).ok()
+    }
+}
+
 /// Probe a 3D model (glTF 2.0 / OBJ / STL / FBX): a [`FootageKind::Model`] item whose duration is its
 /// longest animation. `resolve` reads sibling resources.
 pub fn probe_model(path: &str, bytes: &[u8], resolve: &dyn Fn(&str) -> Option<Vec<u8>>) -> Result<Footage> {
@@ -98,13 +108,45 @@ pub fn probe_bytes(path: &str, bytes: Arc<[u8]>) -> Result<Footage> {
     let name = Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
     let turn = video_turn(&bytes);
     let rate = video_rate(&bytes);
+    let shown = video_shown(&bytes);
+    // A WAV's cue points and XMP markers become the footage's markers.
+    let markers = crate::wav_markers::read(&bytes);
     let src = filmcraft_codecs::open_bytes(&name, bytes)?;
     let mut f = footage_from_info(path, src.info());
+    f.markers = markers;
     turn_footage(&mut f, turn);
     correct_rate(&mut f, rate);
+    trim_to_edits(&mut f, shown);
     Ok(f)
 }
 
+/// A movie lasts as long as its video edit list shows (#2592): the reader reports the media
+/// duration (`mdhd`), which for H.264 with B-frames runs past the last shown frame by the
+/// encoder delay the edit list trims (75 frames at 25 fps read as 3.04 s). Never lengthens.
+fn trim_to_edits(f: &mut Footage, shown: Option<Tick>) {
+    if f.kind == FootageKind::Video
+        && let Some(shown) = shown.filter(|s| *s > Tick::ZERO && *s < f.duration)
+    {
+        f.duration = shown;
+    }
+}
+
+/// How long the video track's edit list shows its media (`elst` segments, movie timescale):
+/// `None` without edits, or with an empty edit (a delayed start keeps the reader's duration).
+fn video_shown(bytes: &[u8]) -> Option<Tick> {
+    let file = filmcraft_isobmff::open(bytes).ok()?;
+    let t = file.tracks.iter().find(|t| t.kind == filmcraft_isobmff::TrackKind::Video && !t.samples.is_empty())?;
+    edits_shown(&t.edits, file.timescale)
+}
+
+fn edits_shown(edits: &[filmcraft_isobmff::Edit], timescale: u32) -> Option<Tick> {
+    if edits.is_empty() || timescale == 0 || edits.iter().any(|e| e.media_time < 0) {
+        return None;
+    }
+    let units = edits.iter().try_fold(0u64, |acc, e| acc.checked_add(e.segment_duration))?;
+    Some(Tick::from_units(i64::try_from(units).ok()?, i64::from(timescale)))
+}
+
 /// A movie's frame rate as its frame durations average to ([`video_rate`]), where the reader's
 /// own estimate misreads it.
 fn correct_rate(f: &mut Footage, rate: Option<FrameRate>) {
@@ -133,7 +175,7 @@ pub(crate) fn footage_from_info(path: &str, info: &filmcraft_media::MediaInfo) -
         (_, None) => FootageKind::Audio,
     };
     let rate = v.map_or(FrameRate::FPS_30, |v| rate_from_fc(v.frame_rate));
-    let codec = match (v, info.audio.as_ref()) {
+    let codec = match (v, info.audio()) {
         (Some(v), _) => v.codec.clone(),
         (None, Some(a)) => a.codec.clone(),
         _ => String::new(),
@@ -148,7 +190,7 @@ pub(crate) fn footage_from_info(path: &str, info: &filmcraft_media::MediaInfo) -
         native_rate: None,
         duration: if kind == FootageKind::Still { Tick::ZERO } else { Tick(info.duration.0) },
         has_video: v.is_some(),
-        has_audio: info.audio.is_some(),
+        has_audio: info.has_audio(),
         alpha: if v.is_some_and(|v| v.has_alpha) { AlphaMode::Straight } else { AlphaMode::Ignore },
         premul_color: [0.0; 3],
         loop_count: 1,
@@ -156,16 +198,21 @@ pub(crate) fn footage_from_info(path: &str, info: &filmcraft_media::MediaInfo) -
         missing: false,
         sequence: Vec::new(),
         color_profile: v.and_then(|v| profile_of(&v.color)),
+        // counted in video frames, so only with a video stream
+        file_timecode: v.and(info.start_timecode),
         ..Default::default()
     }
 }
 
 /// The colour profile a video stream declares (H.273 primaries / transfer from the bitstream or
-/// container). `None` (interpreted as sRGB) for Rec. 709 primaries with an sRGB curve.
+/// container). `None` (interpreted as sRGB) for Rec. 709 primaries with an sRGB curve. BT.2020
+/// with a PQ or HLG curve is Rec. 2100 (HDR10, HLG), not Rec. 2020's 2.4 gamma (#2849).
 fn profile_of(c: &filmcraft_color::ColorInfo) -> Option<effectcraft_project::ColorSpace> {
     use effectcraft_project::ColorSpace;
     use filmcraft_color::{Primaries, Transfer};
     match (c.primaries, c.transfer) {
+        (Primaries::Bt2020, Transfer::Pq) => Some(ColorSpace::Rec2100Pq),
+        (Primaries::Bt2020, Transfer::Hlg) => Some(ColorSpace::Rec2100Hlg),
         (Primaries::Bt2020, _) => Some(ColorSpace::Rec2020),
         (Primaries::P3D65, _) => Some(ColorSpace::DisplayP3),
         (_, Transfer::Bt709) => Some(ColorSpace::Rec709),
@@ -253,12 +300,19 @@ pub(crate) fn load_oriented(bytes: &[u8], fmt: Option<image::ImageFormat>) -> im
 /// The rotation an MP4/MOV movie is shown with (a phone held upright records sideways frames and
 /// says so in its video track's header): the quarter turn nearest the track's rotation. Only the
 /// rotation counts; any mirroring, scaling or offset in the header is ignored, and other
-/// containers have none.
+/// containers have none. FilmCraft turns the frames of a pure 0/90/180/270° header itself, so this
+/// is only the quarter turn nearest to a header it does not turn.
 pub(crate) fn video_turn(bytes: &[u8]) -> Orientation {
     let Ok(file) = filmcraft_isobmff::open(bytes) else { return Orientation::NoTransforms };
-    let Some(m) = file.tracks.iter().find(|t| t.kind == filmcraft_isobmff::TrackKind::Video).map(|t| t.matrix) else {
+    let Some(track) = file.tracks.iter().find(|t| t.kind == filmcraft_isobmff::TrackKind::Video) else {
         return Orientation::NoTransforms;
     };
+    // A pure rotation is already applied by FilmCraft's decoder (frames and size come out
+    // upright); only the headers it leaves as stored (mirrored, scaled, sheared) are turned here.
+    if track.display_rotation().is_some() {
+        return Orientation::NoTransforms;
+    }
+    let m = track.matrix;
     // [a b u; c d v; x y w]: (a, b) is where the picture's x axis points.
     let (a, b) = (m[0] as i64, m[1] as i64);
     match (a.abs() >= b.abs(), a >= 0, b >= 0) {
@@ -310,12 +364,63 @@ fn averaged_rate(timescale: u32, durations: impl Iterator<Item = u32>) -> Option
 mod tests {
     use super::*;
 
+    /// #2592: an encoder-delayed H.264 track's edit list shows 75 frames at 25 fps (3 s at a
+    /// 1000 timescale), though its media runs a frame longer; empty edits and no edits leave it.
+    #[test]
+    fn the_edit_list_trims_a_movie_to_the_frames_it_shows() {
+        let edit = |segment_duration, media_time| filmcraft_isobmff::Edit { segment_duration, media_time, media_rate: 0x0001_0000 };
+        let shown = edits_shown(&[edit(3000, 1024)], 1000);
+        assert_eq!(shown, Some(Tick::from_units(3, 1)));
+        let mut f = Footage { kind: FootageKind::Video, duration: Tick::from_units(76, 25), ..Footage::default() };
+        trim_to_edits(&mut f, shown);
+        assert_eq!(f.duration, Tick::from_units(75, 25));
+        // Never longer than the reader's duration, and only for video.
+        trim_to_edits(&mut f, Some(Tick::from_units(4, 1)));
+        assert_eq!(f.duration, Tick::from_units(75, 25));
+        assert_eq!(edits_shown(&[edit(1000, -1), edit(3000, 0)], 1000), None);
+        assert_eq!(edits_shown(&[], 1000), None);
+        assert_eq!(edits_shown(&[edit(3000, 0)], 0), None);
+    }
+
     /// Durations (in 1/`timescale` s) of `n` frames at `rate` whose times are rounded to the timescale.
     fn rounded(rate: FrameRate, timescale: i64, n: i64) -> Vec<u32> {
         let at = |k: i64| (2 * k * timescale * rate.den + rate.num) / (2 * rate.num);
         (0..n).map(|k| (at(k + 1) - at(k)) as u32).collect()
     }
 
+    /// #2849: a stream's primaries and curve pick its profile; BT.2020 with PQ or HLG is Rec. 2100.
+    #[test]
+    fn stream_colour_picks_the_profile() {
+        use effectcraft_project::ColorSpace;
+        use filmcraft_color::{Primaries, Transfer};
+        let rows = [
+            (Primaries::Bt2020, Transfer::Pq, Some(ColorSpace::Rec2100Pq)),
+            (Primaries::Bt2020, Transfer::Hlg, Some(ColorSpace::Rec2100Hlg)),
+            (Primaries::Bt2020, Transfer::Bt709, Some(ColorSpace::Rec2020)),
+            (Primaries::P3D65, Transfer::Srgb, Some(ColorSpace::DisplayP3)),
+            (Primaries::Bt709, Transfer::Bt709, Some(ColorSpace::Rec709)),
+            (Primaries::Bt709, Transfer::Srgb, None),
+        ];
+        for (primaries, transfer, want) in rows {
+            let c = filmcraft_color::ColorInfo { primaries, transfer, ..filmcraft_color::ColorInfo::REC709 };
+            assert_eq!(profile_of(&c), want, "{primaries:?} + {transfer:?}");
+        }
+    }
+
+    /// A model's side files are read from beside it; a URI to another computer is not followed.
+    #[test]
+    fn model_side_files_are_not_read_from_other_computers() {
+        let dir = std::env::temp_dir().join(format!("ec-probe-side-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("buf.bin"), b"abc").unwrap();
+        let read = side_file_reader(&dir.join("model.gltf"));
+        assert_eq!(read("buf.bin"), Some(b"abc".to_vec()));
+        assert_eq!(read(r"\\192.0.2.1\share\buf.bin"), None);
+        assert_eq!(read("file://192.0.2.1/share/buf.bin"), None);
+        assert_eq!(read(r"C:\buf.bin"), None);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn millisecond_rounded_frame_times_average_to_their_rate() {
         assert_eq!(rounded(FrameRate::FPS_30, 1000, 6), [33, 34, 33, 33, 34, 33]);
diff --git a/crates/media/src/reads.rs b/crates/media/src/reads.rs
new file mode 100644
index 000000000..43ea209b8
--- /dev/null
+++ b/crates/media/src/reads.rs
@@ -0,0 +1,120 @@
+//! Which files the [`MediaPool`](crate::MediaPool) reads for a render
+//! ([`FootageSource::recording`](effectcraft_render::FootageSource::recording)).
+//!
+//! Every read of a file notes it, with the identity it had when read, in the innermost scope open
+//! on this thread. The pool's caches (decoded frames, opened movies, GIFs, models, EXR channels)
+//! keep what their entries were made of and note it again on each hit, so a frame served from
+//! memory reports its file without touching the disk.
+//!
+//! The scopes are per thread: a read noted while a render's scope is open on the thread belongs
+//! to that render. A thread waiting inside a decode can run another job meanwhile (rayon); that
+//! job's reads go to its own scope when it opens one, and otherwise to the scope below it, which
+//! then lists a file more than it read (never fewer).
+
+use std::cell::RefCell;
+
+use effectcraft_render::reads::{ReadFile, ReadFiles, ReadLog};
+
+/// Scopes nested deeper than this are not opened (a thread that keeps taking jobs while it waits
+/// cannot pile them up without bound): their reads go to the scope below, and they come back
+/// incomplete.
+const MAX_DEPTH: usize = 64;
+
+thread_local! {
+    /// The open scopes on this thread, innermost last, each with the files noted in it.
+    static SCOPES: RefCell<Vec<ReadFiles>> = const { RefCell::new(Vec::new()) };
+}
+
+/// Note `file` in the innermost open scope on this thread (nothing when none is open).
+pub(crate) fn note(file: ReadFile) {
+    let _ = SCOPES.try_with(|s| {
+        if let Ok(mut s) = s.try_borrow_mut()
+            && let Some(top) = s.last_mut()
+        {
+            top.add(file);
+        }
+    });
+}
+
+/// Note every file of `files` in the innermost open scope on this thread.
+pub(crate) fn note_all(files: &ReadFiles) {
+    if files.is_empty() && files.is_complete() {
+        return;
+    }
+    let _ = SCOPES.try_with(|s| {
+        if let Ok(mut s) = s.try_borrow_mut()
+            && let Some(top) = s.last_mut()
+        {
+            top.extend(files);
+        }
+    });
+}
+
+/// Closes the scope it opened, also when what runs inside panics: its files go to `out`.
+struct Scope<'a> {
+    out: Out<'a>,
+    opened: bool,
+}
+
+enum Out<'a> {
+    /// A render's log ([`recording`]).
+    Log(&'a ReadLog),
+    /// The caller's ([`captured`]).
+    Files(&'a mut ReadFiles),
+}
+
+impl Scope<'_> {
+    /// Starts collecting the files read on this thread into `out`.
+    /// At the nesting limit the scope stays closed and reports an incomplete list.
+    fn open(out: Out<'_>) -> Scope<'_> {
+        let opened = SCOPES
+            .try_with(|s| match s.try_borrow_mut() {
+                Ok(mut s) if s.len() < MAX_DEPTH => {
+                    s.push(ReadFiles::default());
+                    true
+                }
+                _ => false,
+            })
+            .unwrap_or(false);
+        Scope { out, opened }
+    }
+}
+
+impl Drop for Scope<'_> {
+    /// Ends the scope and hands the collected files to its output, marked incomplete when the scope could not be opened.
+    fn drop(&mut self) {
+        let files = if self.opened { SCOPES.try_with(|s| s.try_borrow_mut().ok().and_then(|mut s| s.pop())).ok().flatten() } else { None };
+        // A scope that could not open saw nothing: what it made can't name its files.
+        let files = files.unwrap_or_else(|| {
+            let mut f = ReadFiles::default();
+            f.mark_incomplete();
+            f
+        });
+        match &mut self.out {
+            Out::Log(log) => log.note_all(&files),
+            Out::Files(out) => out.extend(&files),
+        }
+    }
+}
+
+/// Run `f` with the files it reads on this thread noted in `log`
+/// ([`FootageSource::recording`](effectcraft_render::FootageSource::recording)).
+pub(crate) fn recording(log: &ReadLog, f: &mut dyn FnMut()) {
+    let _scope = Scope::open(Out::Log(log));
+    f();
+}
+
+/// Run `f` and return what it returns with the files it read on this thread (to keep with a
+/// cache entry made of them). They are not noted in the enclosing scope: the caller notes them,
+/// as it does on each later hit of the entry.
+pub(crate) fn captured<T>(f: impl FnOnce() -> T) -> (T, ReadFiles) {
+    let mut files = ReadFiles::default();
+    let out = {
+        let _scope = Scope::open(Out::Files(&mut files));
+        f()
+    };
+    (out, files)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/media/src/reads/tests.rs b/crates/media/src/reads/tests.rs
new file mode 100644
index 000000000..5dae8415a
--- /dev/null
+++ b/crates/media/src/reads/tests.rs
@@ -0,0 +1,390 @@
+//! The files a render reads, as the media pool reports them (#3184): exactly the files the frame
+//! was made of, also when its pixels come from memory.
+
+use std::path::{Path, PathBuf};
+
+use effectcraft_color::Label;
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{Comp, Footage, FootageKind, ItemId, ItemKind, Layer, LayerSource, Project, Solid, Value};
+use effectcraft_render::reads::{FileStamp, ReadFiles, ReadLog};
+use effectcraft_render::{LayerCache, RenderOpts, Renderer};
+use effectcraft_time::FrameRate;
+
+use crate::MediaPool;
+
+const RATE: FrameRate = FrameRate::FPS_30;
+const SIZE: (u32, u32) = (16, 8);
+
+/// A fresh folder for test `name` (on the build drive, not the system temp folder).
+fn folder(name: &str) -> PathBuf {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join(format!("../../target/test-reads-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+/// A PNG at `path`, a flat grey of `level`.
+fn png(path: &Path, level: u8) -> String {
+    image::RgbaImage::from_pixel(SIZE.0, SIZE.1, image::Rgba([level, level, level, 255])).save(path).unwrap();
+    path.to_string_lossy().to_string()
+}
+
+/// An image sequence of `n` PNG frames in `dir`.
+fn sequence(dir: &Path, n: usize) -> Footage {
+    let files: Vec<String> = (0..n).map(|i| png(&dir.join(format!("seq_{i:04}.png")), 20 + i as u8 * 10)).collect();
+    let mut f = Footage { kind: FootageKind::Sequence, sequence: files, frame_rate: RATE, ..crate::probe(dir.join("seq_0000.png")).unwrap() };
+    f.sync_sequence_duration();
+    f
+}
+
+/// A still footage item of `path`.
+fn still(path: &Path, level: u8) -> Footage {
+    png(path, level);
+    crate::probe(path).unwrap()
+}
+
+fn comp() -> Comp {
+    Comp::new(SIZE.0, SIZE.1, RATE, RATE.tick_of(10))
+}
+
+fn footage_layer(p: &mut Project, comp: &Comp, name: &str, f: Footage) -> Layer {
+    let item = p.add_item(name, Label::Aqua, None, ItemKind::Footage(f));
+    build::layer(p, comp, name, LayerSource::Footage { item }, SIZE, Some(comp.duration))
+}
+
+fn add_comp(p: &mut Project, name: &str, mut comp: Comp, layers: Vec<Layer>) -> ItemId {
+    comp.layers = layers.into();
+    p.add_item(name, Label::Sandstone, None, ItemKind::Comp(comp.into()))
+}
+
+/// Render frame `frame` of `comp` with `pool` and `cache`: the picture's top-left pixel and the
+/// files the render reports.
+fn render(p: &Project, pool: &MediaPool, cache: &LayerCache, comp: ItemId, frame: i64) -> ([f32; 4], ReadFiles) {
+    let log = ReadLog::new();
+    let mut r = Renderer::new(p, pool, RenderOpts::default());
+    r.cache = Some(cache);
+    r.reads = Some(&log);
+    let img = r.comp_frame(comp, RATE.tick_of(frame));
+    (img.get(0, 0), log.into_files())
+}
+
+fn paths(files: &ReadFiles) -> Vec<String> {
+    files.files().iter().map(|f| f.path.to_string()).collect()
+}
+
+/// Every listed file has the identity it has on disk now.
+fn assert_stamps_match_disk(files: &ReadFiles) {
+    for f in files.files() {
+        assert_eq!(Some(f.stamp), FileStamp::native(&f.path), "{}", f.path);
+    }
+}
+
+/// (a) One frame of a comp with an image-sequence layer reads that frame's file and nothing else
+/// of the sequence; a large sequence in the project that no layer uses adds nothing, not even a
+/// look at its files.
+#[test]
+fn a_sequence_frame_reports_only_its_own_file() {
+    let dir = folder("sequence");
+    let unused_dir = dir.join("unused");
+    let mut p = Project::default();
+    let c = comp();
+    let seq = sequence(&dir, 5);
+    let (frame_2, frame_4) = (seq.sequence[2].clone(), seq.sequence[4].clone());
+    let layer = footage_layer(&mut p, &c, "Seq", seq);
+    // 5000 frames nobody shows (they don't even exist).
+    let unused = Footage {
+        kind: FootageKind::Sequence,
+        sequence: (0..5000).map(|i| unused_dir.join(format!("big_{i:05}.exr")).to_string_lossy().to_string()).collect(),
+        frame_rate: RATE,
+        width: SIZE.0,
+        height: SIZE.1,
+        has_video: true,
+        ..Default::default()
+    };
+    p.add_item("Unused", Label::Aqua, None, ItemKind::Footage(unused));
+    let cid = add_comp(&mut p, "C", c, vec![layer]);
+    let (pool, cache) = (MediaPool::new(), LayerCache::default());
+    let opened = crate::opens_under(&dir);
+    let (px, files) = render(&p, &pool, &cache, cid, 2);
+    assert!((px[0] - 40.0 / 255.0).abs() < 0.01, "frame 2 shows: {px:?}");
+    assert_eq!(paths(&files), [frame_2]);
+    assert!(files.is_complete());
+    assert_stamps_match_disk(&files);
+    assert_eq!(crate::opens_under(&dir) - opened, 1, "one file opened: the frame's");
+    assert_eq!(crate::opens_under(&unused_dir), 0, "the unused sequence was not looked at");
+    // Another frame reads its own file, also through the viewer's wrapper of the pool.
+    let viewer = effectcraft_render::CancellableFootage { inner: &pool, cancel: Default::default() };
+    let log = ReadLog::new();
+    let mut r = Renderer::new(&p, &viewer, RenderOpts::default());
+    r.cache = Some(&cache);
+    r.reads = Some(&log);
+    r.comp_frame(cid, RATE.tick_of(4));
+    let files = log.into_files();
+    assert_eq!(paths(&files), [frame_4]);
+    assert!(files.is_complete());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// (b) A precomp reports the files of what it draws, and an effect that reads another layer
+/// reports that layer's files (the layer itself is hidden: its pixels come only through the
+/// effect).
+#[test]
+fn precomps_and_layers_read_by_effects_report_their_files() {
+    let dir = folder("nested");
+    let mut p = Project::default();
+    let c = comp();
+    let seq = sequence(&dir, 4);
+    let nested_frame = seq.sequence[3].clone();
+    let inner_layer = footage_layer(&mut p, &c, "Seq", seq);
+    let inner = add_comp(&mut p, "Inner", c.clone(), vec![inner_layer]);
+    let pre = build::layer(&mut p, &c, "Inner", LayerSource::Comp { item: inner }, SIZE, Some(c.duration));
+    let matte_path = dir.join("matte.png");
+    let mut matte = footage_layer(&mut p, &c, "Matte", still(&matte_path, 255));
+    matte.switches.video = false;
+    let sid = p.add_item("S", Label::Red, None, ItemKind::Solid(Solid { color: [1.0, 0.0, 0.0], width: SIZE.0, height: SIZE.1, pixel_aspect: 1.0 }));
+    let mut solid = build::layer(&mut p, &c, "S", LayerSource::Solid { item: sid }, SIZE, Some(c.duration));
+    let spec = effectcraft_effects::find("ec.channel.setmatte").unwrap();
+    let mut next = p.next_id;
+    let mut fx = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), spec.name, [SIZE.0 as f64, SIZE.1 as f64]);
+    p.next_id = next;
+    fx.prop_mut("takeMatteFromLayer").unwrap().value = Value::Layer(Some(matte.id.0));
+    solid.props.sub_mut("effects").unwrap().children.push(fx.into());
+    let cid = add_comp(&mut p, "Outer", c, vec![solid, matte, pre]);
+    let (pool, cache) = (MediaPool::new(), LayerCache::default());
+    let (_, files) = render(&p, &pool, &cache, cid, 3);
+    let mut want = vec![matte_path.to_string_lossy().to_string(), nested_frame];
+    want.sort();
+    assert_eq!(paths(&files), want);
+    assert!(files.is_complete());
+    assert_stamps_match_disk(&files);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// (c) A frame rendered again comes from memory (the sequence frame from the media pool, the
+/// still layer from the layer cache) and reports the same files, with the identities they had
+/// when read, without opening anything: here the files are even gone by then.
+#[test]
+fn a_frame_served_from_memory_reports_its_files_without_touching_them() {
+    let dir = folder("memory");
+    let mut p = Project::default();
+    let c = comp();
+    // The sequence at half opacity over the still: both show.
+    let mut seq = footage_layer(&mut p, &c, "Seq", sequence(&dir, 3));
+    seq.props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(50.0);
+    let plate = footage_layer(&mut p, &c, "Plate", still(&dir.join("plate.png"), 128));
+    let cid = add_comp(&mut p, "C", c, vec![seq, plate]);
+    let (pool, cache) = (MediaPool::new(), LayerCache::default());
+    let (px, first) = render(&p, &pool, &cache, cid, 1);
+    assert_eq!(first.len(), 2, "{:?}", paths(&first));
+    assert_stamps_match_disk(&first);
+    std::fs::remove_dir_all(&dir).unwrap();
+    let opened = crate::opens_under(&dir);
+    let hits = cache.stats().hits;
+    let (again_px, again) = render(&p, &pool, &cache, cid, 1);
+    assert_eq!(again_px, px, "the same picture");
+    assert_eq!(again, first, "the same files, as they were when read");
+    assert!(cache.stats().hits > hits, "the still layer came from the layer cache");
+    // The media pool alone (a new layer cache) reports them too.
+    let (_, from_pool) = render(&p, &pool, &LayerCache::default(), cid, 1);
+    assert_eq!(from_pool, first);
+    assert_eq!(crate::opens_under(&dir), opened, "nothing was opened on disk");
+}
+
+// ---------------------------------------------------------------- layer entries on disk (#3184)
+
+use std::sync::Arc;
+
+use effectcraft_render::disk_cache::{DiskCache, Kind};
+
+/// A "session": a new media pool and layer cache over the disk cache in `cache` (opened anew,
+/// as after a restart), writing every layer buffer however quick to render.
+fn session(cache: &Path) -> (MediaPool, LayerCache, Arc<DiskCache>) {
+    let dc = DiskCache::open(cache, 1 << 30).unwrap();
+    dc.set_min_layer_ms(0);
+    let lc = LayerCache::default();
+    lc.set_disk(Some(dc.clone()));
+    (MediaPool::new(), lc, dc)
+}
+
+/// Give `path` a later modification time, so a rewrite within the clock's resolution counts.
+fn touch_later(path: &Path) {
+    let t = std::fs::metadata(path).unwrap().modified().unwrap() + std::time::Duration::from_secs(7);
+    std::fs::File::options().append(true).open(path).unwrap().set_modified(t).unwrap();
+}
+
+/// Two still plates (the upper one at half opacity, so both show), and a 5000-frame sequence
+/// in the project that no layer uses (its files don't even exist).
+fn plates(dir: &Path) -> (Project, ItemId, PathBuf) {
+    let mut p = Project::default();
+    let c = comp();
+    let a = dir.join("a.png");
+    let mut top = footage_layer(&mut p, &c, "A", still(&a, 60));
+    top.props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(50.0);
+    let bottom = footage_layer(&mut p, &c, "B", still(&dir.join("b.png"), 200));
+    let unused = dir.join("unused");
+    let seq = Footage {
+        kind: FootageKind::Sequence,
+        sequence: (0..5000).map(|i| unused.join(format!("big_{i:05}.exr")).to_string_lossy().to_string()).collect(),
+        frame_rate: RATE,
+        width: SIZE.0,
+        height: SIZE.1,
+        has_video: true,
+        ..Default::default()
+    };
+    p.add_item("Unused", Label::Aqua, None, ItemKind::Footage(seq));
+    let cid = add_comp(&mut p, "C", c, vec![top, bottom]);
+    (p, cid, a)
+}
+
+/// Correct and no scan: after a restart, only the layer buffer whose source file changed is
+/// rendered again (only that file is opened); the other comes from disk with its file list, so
+/// the frame's list is complete again (its frame entry can be stored). The disk cache checks
+/// exactly the files its entries list, never the unused sequence. The re-rendered buffer
+/// replaces its entry: the next restart opens nothing.
+#[test]
+fn a_changed_file_renders_only_the_layer_buffers_that_read_it_again() {
+    let dir = folder("layer-disk");
+    let (src, cache) = (dir.join("src"), dir.join("cache"));
+    std::fs::create_dir_all(&src).unwrap();
+    let (p, cid, a) = plates(&src);
+    let (pool, lc, dc) = session(&cache);
+    let (px, files) = render(&p, &pool, &lc, cid, 0);
+    assert!(files.is_complete() && files.len() == 2, "{:?}", paths(&files));
+    dc.flush();
+    let entries = dc.keys(Kind::Layer).len();
+    assert!(entries >= 2, "both plates' buffers are on disk: {entries}");
+    drop((pool, lc, dc));
+
+    // Restart without a change: everything from disk, nothing opened, a complete list.
+    let (pool, lc, dc) = session(&cache);
+    let opened = crate::opens_under(&src);
+    let (again, files_again) = render(&p, &pool, &lc, cid, 0);
+    assert_eq!(again, px);
+    assert_eq!(files_again, files, "the files of the entries, as they were read");
+    assert!(files_again.is_complete(), "a frame made of buffers from disk can be stored");
+    assert_eq!(crate::opens_under(&src), opened, "nothing opened");
+    let checks = dc.file_checks();
+    assert!(checks >= 2 && checks as usize <= entries, "one check per entry used: {checks} of {entries}");
+    drop((pool, lc, dc));
+
+    // a.png gets new pixels: only the top plate renders again.
+    png(&a, 120);
+    touch_later(&a);
+    let (pool, lc, dc) = session(&cache);
+    let opened = crate::opens_under(&src);
+    let (changed, files_changed) = render(&p, &pool, &lc, cid, 0);
+    assert_ne!(changed, px, "the new pixels show");
+    assert_eq!(crate::opens_under(&src) - opened, 1, "only the changed file is read");
+    assert!(files_changed.is_complete() && files_changed.len() == 2);
+    assert_stamps_match_disk(&files_changed);
+    assert!(dc.file_checks() as usize <= entries, "only listed files are checked");
+    assert_eq!(crate::opens_under(&src.join("unused")), 0);
+    dc.flush();
+    drop((pool, lc, dc));
+
+    // Its entry was replaced: the next restart opens nothing and shows the new pixels.
+    let (pool, lc, _dc) = session(&cache);
+    let opened = crate::opens_under(&src);
+    let (last, _) = render(&p, &pool, &lc, cid, 0);
+    assert_eq!(last, changed);
+    assert_eq!(crate::opens_under(&src), opened, "both from disk");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Two projects whose footage items have the same ids but name different files never share a
+/// layer entry: the layer key names the item's path and settings.
+#[test]
+fn projects_with_the_same_item_ids_never_share_a_layer_entry() {
+    let dir = folder("layer-disk-projects");
+    let (src, cache) = (dir.join("src"), dir.join("cache"));
+    std::fs::create_dir_all(&src).unwrap();
+    let mut p = Project::default();
+    let c = comp();
+    let layer = footage_layer(&mut p, &c, "Plate", still(&src.join("one.png"), 40));
+    let LayerSource::Footage { item } = layer.source else { panic!("a footage layer") };
+    let cid = add_comp(&mut p, "C", c, vec![layer]);
+    let mut other = p.clone();
+    other.item_mut(item).unwrap().kind = ItemKind::Footage(still(&src.join("two.png"), 220));
+    let (pool, lc, dc) = session(&cache);
+    let (one, _) = render(&p, &pool, &lc, cid, 0);
+    dc.flush();
+    drop((pool, lc, dc));
+    let (pool, lc, dc) = session(&cache);
+    let hits = dc.stats().hits;
+    let (two, files) = render(&other, &pool, &lc, cid, 0);
+    assert!((two[0] - 220.0 / 255.0).abs() < 0.01, "the other project's own file shows: {two:?}");
+    assert_ne!(two, one);
+    assert_eq!(dc.stats().hits, hits, "no entry of the first project is used");
+    assert_eq!(paths(&files), [src.join("two.png").to_string_lossy().to_string()]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Safe: a damaged layer entry, a source file that is missing, one replaced by something
+/// unreadable (a folder), and one back with other pixels never serve a stale buffer after a
+/// restart; the damaged entry is rendered again, replaced and then used.
+#[test]
+fn missing_unreadable_files_and_damaged_layer_entries_never_serve_stale_buffers() {
+    let dir = folder("layer-disk-safe");
+    let (src, cache) = (dir.join("src"), dir.join("cache"));
+    std::fs::create_dir_all(&src).unwrap();
+    let mut p = Project::default();
+    let c = comp();
+    let path = src.join("plate.png");
+    let layer = footage_layer(&mut p, &c, "Plate", still(&path, 90));
+    let cid = add_comp(&mut p, "C", c, vec![layer]);
+    let (pool, lc, dc) = session(&cache);
+    let (shown, _) = render(&p, &pool, &lc, cid, 0);
+    assert!(shown[3] > 0.99, "the plate shows: {shown:?}");
+    dc.flush();
+    drop((pool, lc, dc));
+
+    // A damaged entry: a miss, deleted, rendered again and stored anew.
+    let layers = cache.join("v1").join(Kind::Layer.dir());
+    for shard in std::fs::read_dir(&layers).unwrap().flatten() {
+        for f in std::fs::read_dir(shard.path()).unwrap().flatten() {
+            let mut d = std::fs::read(f.path()).unwrap();
+            let n = d.len() / 2;
+            d[n] ^= 0x5a;
+            std::fs::write(f.path(), d).unwrap();
+        }
+    }
+    let (pool, lc, dc) = session(&cache);
+    let opened = crate::opens_under(&src);
+    let (again, files) = render(&p, &pool, &lc, cid, 0);
+    assert_eq!(again, shown);
+    assert_eq!(crate::opens_under(&src) - opened, 1, "read again, not served from the damaged entry");
+    assert!(files.is_complete());
+    dc.flush();
+    drop((pool, lc, dc));
+    let (pool, lc, dc) = session(&cache);
+    let hits = dc.stats().hits;
+    assert_eq!(render(&p, &pool, &lc, cid, 0).0, shown);
+    assert!(dc.stats().hits > hits, "the rewritten entry is used");
+    drop((pool, lc, dc));
+
+    // The file is gone: not the old plate.
+    std::fs::remove_file(&path).unwrap();
+    let (pool, lc, dc) = session(&cache);
+    let hits = dc.stats().hits;
+    let (gone, files) = render(&p, &pool, &lc, cid, 0);
+    assert!(gone[3] < 0.01, "a missing file shows nothing, never the cached plate: {gone:?}");
+    assert_eq!(dc.stats().hits, hits);
+    assert!(files.files().iter().all(|f| f.stamp == FileStamp::Missing), "{files:?}");
+    dc.flush();
+    drop((pool, lc, dc));
+
+    // Something unreadable at its path (a folder): still not the old plate.
+    std::fs::create_dir(&path).unwrap();
+    let (pool, lc, _dc) = session(&cache);
+    let (unreadable, _) = render(&p, &pool, &lc, cid, 0);
+    assert!(unreadable[3] < 0.01, "{unreadable:?}");
+    std::fs::remove_dir(&path).unwrap();
+
+    // Back with other pixels: those show, not the entry made of the old file.
+    png(&path, 240);
+    touch_later(&path);
+    let (pool, lc, _dc) = session(&cache);
+    let (back, _) = render(&p, &pool, &lc, cid, 0);
+    assert!((back[0] - 240.0 / 255.0).abs() < 0.01, "{back:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/media/src/stream.rs b/crates/media/src/stream.rs
index 447e239d1..0155b4acd 100644
--- a/crates/media/src/stream.rs
+++ b/crates/media/src/stream.rs
@@ -9,6 +9,7 @@
 
 use std::path::Path;
 
+use effectcraft_render::reads::FileStamp;
 use filmcraft_media::SharedSource;
 
 use crate::Result;
@@ -19,17 +20,22 @@ use crate::Result;
 pub(crate) struct FileReader {
     file: std::fs::File,
     len: u64,
+    /// The file's identity when it was opened.
+    stamp: FileStamp,
 }
 
 #[cfg(any(unix, windows))]
 impl FileReader {
+    /// Opens `path` for reading and records its length and modification time.
     pub(crate) fn open(path: &Path) -> std::io::Result<Self> {
+        #[cfg(test)]
+        crate::count_open(path);
         let file = std::fs::File::open(path)?;
         let m = file.metadata()?;
         if !m.is_file() {
             return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, format!("{} is not a file", path.display())));
         }
-        Ok(Self { file, len: m.len() })
+        Ok(Self { file, len: m.len(), stamp: FileStamp::of_metadata(&m) })
     }
 }
 
@@ -72,16 +78,30 @@ fn name_of(path: &Path) -> String {
 /// Open a movie/audio file for the media pool, reading only what its container needs; files the
 /// reader openers don't handle are read whole and opened from memory, exactly as before. `None`
 /// when the file can't be opened in place (the caller reads it whole, which reports the error).
+/// With the file's identity as opened.
 #[cfg(any(unix, windows))]
-pub(crate) fn open_source(path: &Path) -> Option<Result<SharedSource>> {
+pub(crate) fn open_source(path: &Path) -> Option<(Result<SharedSource>, FileStamp)> {
     let reader = FileReader::open(path).ok()?;
+    let stamp = reader.stamp;
     let reader: filmcraft_media::SharedReader = std::sync::Arc::new(reader);
     let opened = filmcraft_media::reader::open_reader(&name_of(path), reader, &filmcraft_codecs::reader_openers(), &filmcraft_codecs::openers());
-    Some(opened.map_err(Into::into))
+    Some((opened.map_err(Into::into), stamp))
+}
+
+/// Without a native file system there is no in-place source: always `None`.
+#[cfg(not(any(unix, windows)))]
+pub(crate) fn open_source(_path: &Path) -> Option<(Result<SharedSource>, FileStamp)> {
+    None
+}
+
+/// `path` read in place (`None` when it can't be opened, or without a native file system).
+#[cfg(any(unix, windows))]
+pub(crate) fn file_reader(path: &Path) -> Option<Box<dyn filmcraft_media::ByteReader>> {
+    Some(Box::new(FileReader::open(path).ok()?))
 }
 
 #[cfg(not(any(unix, windows)))]
-pub(crate) fn open_source(_path: &Path) -> Option<Result<SharedSource>> {
+pub(crate) fn file_reader(_path: &Path) -> Option<Box<dyn filmcraft_media::ByteReader>> {
     None
 }
 
diff --git a/crates/media/src/wav_markers.rs b/crates/media/src/wav_markers.rs
new file mode 100644
index 000000000..ca40824b6
--- /dev/null
+++ b/crates/media/src/wav_markers.rs
@@ -0,0 +1,517 @@
+//! Markers a WAV file carries, read from its RIFF chunks.
+//!
+//! Two encodings are read and merged:
+//! - **Cue points** (the standard): a `cue ` chunk with one point per marker, named by `labl` (or
+//!   `note`) sub-chunks of a `LIST` `adtl` chunk, and given a length by `ltxt`.
+//! - **XMP** (Adobe's tools): an `_PMX` chunk holding an XMP packet whose `xmpDM:markers` list has
+//!   one entry per marker (`xmpDM:startTime`, `xmpDM:duration`, `xmpDM:name`), counted in frames
+//!   of `xmpDM:frameRate` (`f44100` for samples at 44.1 kHz).
+//!
+//! RF64 files (WAVs over 4 GB) carry a `0xFFFFFFFF` size for a chunk too big for 32 bits and give its real size in a
+//! `ds64` chunk; those sizes are resolved so the chunks after the audio are still found.
+//!
+//! The file is untrusted input: every read is bounds-checked, sizes use checked arithmetic, and
+//! the number of markers, of `adtl` sub-chunks looked at and the size of the XMP packet are capped.
+
+use std::collections::{HashMap, HashSet};
+
+use effectcraft_color::Label;
+use effectcraft_project::Marker;
+use effectcraft_time::Tick;
+
+/// Most markers read from one file.
+pub const MAX_MARKERS: usize = 10_000;
+/// Largest XMP packet read (bytes).
+const MAX_XMP: usize = 4 << 20;
+/// Most `adtl` sub-chunks (`labl`, `note`, `ltxt`) looked at in one file: a few per cue point is plenty.
+const MAX_ADTL_RECORDS: usize = 4 * MAX_MARKERS;
+/// Most entries read from an RF64 file's `ds64` size table.
+const MAX_DS64_TABLE: usize = 1_024;
+
+fn u32_at(b: &[u8], at: usize) -> Option<u32> {
+    let s = b.get(at..at.checked_add(4)?)?;
+    Some(u32::from_le_bytes(s.try_into().ok()?))
+}
+
+fn u64_at(b: &[u8], at: usize) -> Option<u64> {
+    let s = b.get(at..at.checked_add(8)?)?;
+    Some(u64::from_le_bytes(s.try_into().ok()?))
+}
+
+/// The text of a NUL-terminated label (the rest of the chunk), lossily decoded.
+fn label(b: &[u8]) -> String {
+    let end = b.iter().position(|&c| c == 0).unwrap_or(b.len());
+    String::from_utf8_lossy(b.get(..end).unwrap_or_default()).trim().to_string()
+}
+
+fn secs(frames: f64, rate: f64) -> Tick {
+    if rate > 0.0 && frames.is_finite() { Tick::from_seconds_f64((frames / rate).max(0.0)) } else { Tick::ZERO }
+}
+
+/// Whether `bytes` start a RIFF/WAVE file.
+pub fn is_wav(bytes: &[u8]) -> bool {
+    matches!(bytes.get(0..4), Some(b"RIFF" | b"RF64")) && bytes.get(8..12) == Some(b"WAVE")
+}
+
+/// The sizes an RF64 file's `ds64` chunk gives for chunks too big for the 32-bit size field.
+struct Ds64 {
+    /// The `data` chunk's size.
+    data: u64,
+    /// Other chunks: `(id, size)`.
+    table: Vec<([u8; 4], u64)>,
+}
+
+impl Ds64 {
+    /// The real size of chunk `id`, when the file says.
+    fn size_of(&self, id: &[u8; 4]) -> Option<u64> {
+        if id == b"data" { Some(self.data) } else { self.table.iter().find(|(t, _)| t == id).map(|(_, size)| *size) }
+    }
+}
+
+/// The `ds64` chunk of an RF64 file (`RF64`, size, `WAVE`, then `ds64`); `None` for any other file or one whose
+/// `ds64` doesn't fit.
+fn ds64(bytes: &[u8]) -> Option<Ds64> {
+    if bytes.get(0..4) != Some(b"RF64") || bytes.get(12..16) != Some(b"ds64") {
+        return None;
+    }
+    let size = usize::try_from(u32_at(bytes, 16)?).ok()?;
+    let body = bytes.get(20..20usize.checked_add(size)?)?;
+    // riff size (8), data size (8), sample count (8), table length (4), then `(id, size)` entries of 12 bytes
+    let data = u64_at(body, 8)?;
+    let entries = usize::try_from(u32_at(body, 24)?).ok()?;
+    let mut table = Vec::new();
+    for i in 0..entries.min(MAX_DS64_TABLE) {
+        let at = 28usize.checked_add(i.checked_mul(12)?)?;
+        let id = <[u8; 4]>::try_from(body.get(at..at.checked_add(4)?)?).ok()?;
+        table.push((id, u64_at(body, at + 4)?));
+    }
+    Some(Ds64 { data, table })
+}
+
+/// The chunks of a WAVE file as `(id, body)`, stopping at the first one that doesn't fit.
+fn chunks(bytes: &[u8]) -> Vec<([u8; 4], &[u8])> {
+    let big = ds64(bytes);
+    let mut out = Vec::new();
+    let mut at = 12usize;
+    while let Some(head) = bytes.get(at..at.saturating_add(8)) {
+        let (Ok(id), Some(field)) = (<[u8; 4]>::try_from(&head[..4]), u32_at(head, 4)) else { break };
+        // In an RF64 file a size field of 0xFFFFFFFF stands for the size `ds64` gives.
+        let size = match &big {
+            Some(d) if field == u32::MAX => d.size_of(&id).unwrap_or(u64::from(field)),
+            _ => u64::from(field),
+        };
+        let start = at.saturating_add(8);
+        let Some(end) = usize::try_from(size).ok().and_then(|n| start.checked_add(n)) else { break };
+        let Some(body) = bytes.get(start..end) else { break };
+        out.push((id, body));
+        // Chunks are padded to an even size.
+        at = end.saturating_add(end & 1);
+    }
+    out
+}
+
+/// The markers `bytes` carry, in time order (empty for anything that isn't a WAV with markers).
+pub fn read(bytes: &[u8]) -> Vec<Marker> {
+    if !is_wav(bytes) {
+        return Vec::new();
+    }
+    let chunks = chunks(bytes);
+    let rate = chunks.iter().find(|(id, _)| id == b"fmt ").and_then(|(_, b)| u32_at(b, 4)).map_or(0.0, f64::from);
+    let mut out = cue_markers(&chunks, rate);
+    if let Some((_, xmp)) = chunks.iter().find(|(id, _)| id == b"_PMX") {
+        // Tools that write both encodings repeat each marker.
+        let mut seen: HashSet<(String, Tick)> = out.iter().map(|o| (o.comment.clone(), o.time)).collect();
+        for m in xmp_markers(xmp, rate) {
+            if seen.insert((m.comment.clone(), m.time)) {
+                out.push(m);
+            }
+        }
+    }
+    out.truncate(MAX_MARKERS);
+    out.sort_by_key(|m| m.time);
+    out
+}
+
+/// Cue points named and sized by the `adtl` list.
+fn cue_markers(chunks: &[([u8; 4], &[u8])], rate: f64) -> Vec<Marker> {
+    let Some((_, cue)) = chunks.iter().find(|(id, _)| id == b"cue ") else { return Vec::new() };
+    let count = (u32_at(cue, 0).unwrap_or(0) as usize).min(MAX_MARKERS);
+    // The cue points first: `(id, offset in samples)`.
+    let mut points = Vec::new();
+    for i in 0..count {
+        let Some(point) = cue.get(4usize.saturating_add(i.saturating_mul(24))..) else { break };
+        let (Some(id), Some(offset)) = (u32_at(point, 0), u32_at(point, 20)) else { break };
+        points.push((id, offset));
+    }
+    // Only the names and lengths of those ids are kept, so a hostile `adtl` list cannot grow them past the cue count,
+    // and each record is a lookup, not a scan.
+    let wanted: HashSet<u32> = points.iter().map(|(id, _)| *id).collect();
+    let mut names: HashMap<u32, String> = HashMap::new();
+    let mut lengths: HashMap<u32, u32> = HashMap::new();
+    let mut records = 0usize;
+    'lists: for (_, list) in chunks.iter().filter(|(id, b)| id == b"LIST" && b.get(0..4) == Some(b"adtl")) {
+        let mut at = 4usize;
+        while let Some(head) = list.get(at..at.saturating_add(8)) {
+            let (Ok(id), Some(size)) = (<[u8; 4]>::try_from(&head[..4]), u32_at(head, 4)) else { break };
+            let start = at.saturating_add(8);
+            let Some(end) = start.checked_add(size as usize) else { break };
+            let Some(body) = list.get(start..end) else { break };
+            records += 1;
+            if records > MAX_ADTL_RECORDS {
+                break 'lists;
+            }
+            if let Some(cue_id) = u32_at(body, 0).filter(|c| wanted.contains(c)) {
+                match &id {
+                    // A `labl` is the name; a `note` only when there is none.
+                    b"labl" => {
+                        names.insert(cue_id, label(body.get(4..).unwrap_or_default()));
+                    }
+                    b"note" => {
+                        names.entry(cue_id).or_insert_with(|| label(body.get(4..).unwrap_or_default()));
+                    }
+                    // The first `ltxt` of a cue point gives its length.
+                    b"ltxt" => {
+                        lengths.entry(cue_id).or_insert_with(|| u32_at(body, 4).unwrap_or(0));
+                    }
+                    _ => {}
+                }
+            }
+            at = end.saturating_add(end & 1);
+        }
+    }
+    points
+        .into_iter()
+        .map(|(id, offset)| {
+            let comment = names.get(&id).cloned().unwrap_or_default();
+            let length = lengths.get(&id).copied().unwrap_or(0);
+            Marker { time: secs(f64::from(offset), rate), duration: secs(f64::from(length), rate), comment, label: Label::None, ..Default::default() }
+        })
+        .collect()
+}
+
+/// The text of `name` in an XMP entry, as an attribute (`name="v"`) or an element
+/// (`<name>v</name>`).
+fn xmp_value(entry: &str, name: &str) -> Option<String> {
+    let attr = format!("{name}=\"");
+    if let Some(i) = entry.find(&attr) {
+        let rest = entry.get(i + attr.len()..)?;
+        return Some(unescape(rest.get(..rest.find('"')?)?));
+    }
+    let open = format!("<{name}>");
+    let i = entry.find(&open)?;
+    let rest = entry.get(i + open.len()..)?;
+    Some(unescape(rest.get(..rest.find('<')?)?))
+}
+
+fn unescape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    let mut rest = s;
+    while let Some(i) = rest.find('&') {
+        out.push_str(rest.get(..i).unwrap_or_default());
+        let tail = rest.get(i..).unwrap_or_default();
+        let Some(semi) = tail.find(';').filter(|&n| n <= 10) else {
+            out.push('&');
+            rest = tail.get(1..).unwrap_or_default();
+            continue;
+        };
+        let ent = tail.get(1..semi).unwrap_or_default();
+        match ent {
+            "amp" => out.push('&'),
+            "lt" => out.push('<'),
+            "gt" => out.push('>'),
+            "quot" => out.push('"'),
+            "apos" => out.push('\''),
+            _ => {
+                let code = ent.strip_prefix("#x").and_then(|h| u32::from_str_radix(h, 16).ok()).or_else(|| ent.strip_prefix('#').and_then(|d| d.parse().ok()));
+                match code.and_then(char::from_u32) {
+                    Some(c) => out.push(c),
+                    None => out.push_str(tail.get(..=semi).unwrap_or_default()),
+                }
+            }
+        }
+        rest = tail.get(semi + 1..).unwrap_or_default();
+    }
+    out.push_str(rest);
+    out.trim().to_string()
+}
+
+/// A frame rate as XMP writes it: `f44100`, or `f30000s1001` (rate over scale).
+fn xmp_rate(text: &str) -> Option<f64> {
+    let t = text.trim().strip_prefix('f')?;
+    let (num, den) = t.split_once('s').unwrap_or((t, "1"));
+    let (n, d): (f64, f64) = (num.parse().ok()?, den.parse().ok()?);
+    (n > 0.0 && d > 0.0).then_some(n / d)
+}
+
+/// The markers of an XMP packet's `xmpDM:markers` entries.
+fn xmp_markers(packet: &[u8], file_rate: f64) -> Vec<Marker> {
+    let text = String::from_utf8_lossy(packet.get(..packet.len().min(MAX_XMP)).unwrap_or_default());
+    let mut out = Vec::new();
+    // The frame rate belongs to the track an entry follows.
+    let mut rate = file_rate;
+    for entry in text.split("<rdf:li").skip(1) {
+        if let Some(r) = xmp_value(entry, "xmpDM:frameRate").as_deref().and_then(xmp_rate) {
+            rate = r;
+        }
+        let Some(start) = xmp_value(entry, "xmpDM:startTime").and_then(|v| v.trim().parse::<f64>().ok()) else { continue };
+        let length = xmp_value(entry, "xmpDM:duration").and_then(|v| v.trim().parse::<f64>().ok()).unwrap_or(0.0);
+        let comment = xmp_value(entry, "xmpDM:name").unwrap_or_default();
+        out.push(Marker { time: secs(start, rate), duration: secs(length, rate), comment, label: Label::None, ..Default::default() });
+        if out.len() >= MAX_MARKERS {
+            break;
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn chunk(id: &[u8; 4], body: &[u8]) -> Vec<u8> {
+        let mut v = id.to_vec();
+        v.extend((body.len() as u32).to_le_bytes());
+        v.extend(body);
+        if body.len() % 2 == 1 {
+            v.push(0);
+        }
+        v
+    }
+
+    fn fmt(rate: u32) -> Vec<u8> {
+        let mut b = Vec::new();
+        b.extend(1u16.to_le_bytes()); // PCM
+        b.extend(1u16.to_le_bytes()); // mono
+        b.extend(rate.to_le_bytes());
+        b.extend((rate * 2).to_le_bytes());
+        b.extend(2u16.to_le_bytes());
+        b.extend(16u16.to_le_bytes());
+        chunk(b"fmt ", &b)
+    }
+
+    fn wav(chunks: &[Vec<u8>]) -> Vec<u8> {
+        let body: Vec<u8> = chunks.iter().flatten().copied().collect();
+        let mut v = b"RIFF".to_vec();
+        v.extend((body.len() as u32 + 4).to_le_bytes());
+        v.extend(b"WAVE");
+        v.extend(body);
+        v
+    }
+
+    fn cue(points: &[(u32, u32)]) -> Vec<u8> {
+        let mut b = (points.len() as u32).to_le_bytes().to_vec();
+        for (id, offset) in points {
+            b.extend(id.to_le_bytes());
+            b.extend(0u32.to_le_bytes());
+            b.extend(b"data");
+            b.extend(0u32.to_le_bytes());
+            b.extend(0u32.to_le_bytes());
+            b.extend(offset.to_le_bytes());
+        }
+        chunk(b"cue ", &b)
+    }
+
+    fn labl(id: &[u8; 4], cue_id: u32, text: &str) -> Vec<u8> {
+        let mut b = cue_id.to_le_bytes().to_vec();
+        b.extend(text.as_bytes());
+        b.push(0);
+        chunk(id, &b)
+    }
+
+    fn adtl(subs: &[Vec<u8>]) -> Vec<u8> {
+        let mut b = b"adtl".to_vec();
+        b.extend(subs.iter().flatten());
+        chunk(b"LIST", &b)
+    }
+
+    #[test]
+    fn cue_points_are_named_by_the_adtl_list_and_timed_in_samples() {
+        let file = wav(&[
+            fmt(44100),
+            chunk(b"data", &[0; 8]),
+            cue(&[(2, 88200), (1, 22050)]),
+            adtl(&[labl(b"labl", 1, "SEQ01_Prologue"), labl(b"labl", 2, "SEQ02_Vallee_P1_Agriculture")]),
+        ]);
+        let m = read(&file);
+        assert_eq!(m.len(), 2);
+        assert_eq!((m[0].comment.as_str(), m[0].time), ("SEQ01_Prologue", Tick::from_seconds_f64(0.5)));
+        assert_eq!((m[1].comment.as_str(), m[1].time), ("SEQ02_Vallee_P1_Agriculture", Tick::from_seconds_f64(2.0)));
+    }
+
+    #[test]
+    fn a_note_names_a_cue_only_when_it_has_no_label_and_ltxt_gives_a_length() {
+        let mut ltxt = 1u32.to_le_bytes().to_vec();
+        ltxt.extend(44100u32.to_le_bytes());
+        ltxt.extend([0; 16]);
+        let file = wav(&[
+            fmt(44100),
+            cue(&[(1, 0), (2, 44100)]),
+            adtl(&[labl(b"note", 1, "from note"), chunk(b"ltxt", &ltxt), labl(b"labl", 2, "named"), labl(b"note", 2, "ignored")]),
+        ]);
+        let m = read(&file);
+        assert_eq!((m[0].comment.as_str(), m[0].duration), ("from note", Tick::from_seconds_f64(1.0)));
+        assert_eq!(m[1].comment, "named");
+    }
+
+    const XMP_ELEMENTS: &str = r#"<x:xmpmeta><rdf:RDF><rdf:Description><xmpDM:Tracks><rdf:Bag><rdf:li rdf:parseType="Resource"><xmpDM:trackName>Markers</xmpDM:trackName><xmpDM:trackType>Cue</xmpDM:trackType><xmpDM:frameRate>f44100</xmpDM:frameRate><xmpDM:markers><rdf:Seq><rdf:li rdf:parseType="Resource"><xmpDM:startTime>44100</xmpDM:startTime><xmpDM:duration>0</xmpDM:duration><xmpDM:name>One &amp; Two</xmpDM:name></rdf:li><rdf:li rdf:parseType="Resource"><xmpDM:startTime>132300</xmpDM:startTime><xmpDM:duration>22050</xmpDM:duration><xmpDM:name>Three</xmpDM:name></rdf:li></rdf:Seq></xmpDM:markers></rdf:li></rdf:Bag></xmpDM:Tracks></rdf:Description></rdf:RDF></x:xmpmeta>"#;
+
+    #[test]
+    fn xmp_markers_are_read_as_elements_in_frames_of_the_track_rate() {
+        let file = wav(&[fmt(48000), chunk(b"_PMX", XMP_ELEMENTS.as_bytes())]);
+        let m = read(&file);
+        assert_eq!(m.len(), 2);
+        // 44100 frames at f44100 is one second, whatever the file's own rate.
+        assert_eq!((m[0].comment.as_str(), m[0].time), ("One & Two", Tick::from_seconds_f64(1.0)));
+        assert_eq!((m[1].comment.as_str(), m[1].time, m[1].duration), ("Three", Tick::from_seconds_f64(3.0), Tick::from_seconds_f64(0.5)));
+    }
+
+    #[test]
+    fn xmp_markers_are_read_as_attributes_and_use_the_file_rate_without_a_track_rate() {
+        let xmp = r#"<rdf:Seq><rdf:li xmpDM:startTime="24000" xmpDM:duration="0" xmpDM:name="Attr &#233;"/></rdf:Seq>"#;
+        let m = read(&wav(&[fmt(48000), chunk(b"_PMX", xmp.as_bytes())]));
+        assert_eq!((m[0].comment.as_str(), m[0].time), ("Attr é", Tick::from_seconds_f64(0.5)));
+    }
+
+    #[test]
+    fn a_marker_in_both_encodings_is_listed_once() {
+        let xmp = r#"<rdf:li xmpDM:startTime="44100" xmpDM:name="Same"/><rdf:li xmpDM:startTime="88200" xmpDM:name="Only XMP"/>"#;
+        let file = wav(&[fmt(44100), cue(&[(1, 44100)]), adtl(&[labl(b"labl", 1, "Same")]), chunk(b"_PMX", xmp.as_bytes())]);
+        let names: Vec<String> = read(&file).into_iter().map(|m| m.comment).collect();
+        assert_eq!(names, ["Same", "Only XMP"]);
+    }
+
+    #[test]
+    fn importing_a_wav_puts_its_markers_on_the_footage() {
+        let file = wav(&[
+            fmt(44100),
+            chunk(b"data", &[0; 4 * 44100]),
+            cue(&[(1, 0), (2, 44100)]),
+            adtl(&[labl(b"labl", 1, "SEQ01_Prologue"), labl(b"labl", 2, "SEQ02_Vallee_P1_Agriculture")]),
+        ]);
+        let f = crate::probe::probe_bytes("markers.wav", file.into()).expect("probe");
+        assert!(f.has_audio);
+        let names: Vec<&str> = f.markers.iter().map(|m| m.comment.as_str()).collect();
+        assert_eq!(names, ["SEQ01_Prologue", "SEQ02_Vallee_P1_Agriculture"]);
+        assert_eq!(f.markers[1].time, Tick::from_seconds_f64(1.0));
+    }
+
+    #[test]
+    fn damaged_or_hostile_files_read_as_far_as_they_go_without_panicking() {
+        assert!(read(b"").is_empty());
+        assert!(read(b"RIFF").is_empty());
+        assert!(read(b"not a wav file at all").is_empty());
+        let good = wav(&[fmt(44100), cue(&[(1, 44100)]), adtl(&[labl(b"labl", 1, "Kept")])]);
+        // Every truncation is safe.
+        for n in 0..good.len() {
+            let _ = read(&good[..n]);
+        }
+        // A cue count far beyond the chunk, and chunk sizes past the end of the file.
+        let mut huge = 0xFFFF_FFFFu32.to_le_bytes().to_vec();
+        huge.extend([0; 24]);
+        let m = read(&wav(&[fmt(44100), chunk(b"cue ", &huge)]));
+        assert!(m.len() <= 1);
+        let mut lying = good.clone();
+        lying.extend(b"LIST\xff\xff\xff\xffadtl");
+        assert_eq!(read(&lying).len(), 1);
+        // No sample rate: times are zero, not a division by zero.
+        let m = read(&wav(&[cue(&[(1, 44100)])]));
+        assert_eq!(m[0].time, Tick::ZERO);
+    }
+
+    /// A chunk whose size field says `field` (an RF64 file's `0xFFFFFFFF`) while its body is `body`.
+    fn chunk_with_size_field(id: &[u8; 4], field: u32, body: &[u8]) -> Vec<u8> {
+        let mut v = id.to_vec();
+        v.extend(field.to_le_bytes());
+        v.extend(body);
+        if body.len() % 2 == 1 {
+            v.push(0);
+        }
+        v
+    }
+
+    /// An RF64 `ds64` chunk: the `data` chunk's size and a table of other chunks' sizes.
+    fn ds64_chunk(data_size: u64, table: &[([u8; 4], u64)]) -> Vec<u8> {
+        let mut b = 0u64.to_le_bytes().to_vec(); // riff size (not used)
+        b.extend(data_size.to_le_bytes());
+        b.extend(0u64.to_le_bytes()); // sample count
+        b.extend((table.len() as u32).to_le_bytes());
+        for (id, size) in table {
+            b.extend(id);
+            b.extend(size.to_le_bytes());
+        }
+        chunk(b"ds64", &b)
+    }
+
+    fn rf64(chunks: &[Vec<u8>]) -> Vec<u8> {
+        let body: Vec<u8> = chunks.iter().flatten().copied().collect();
+        let mut v = b"RF64".to_vec();
+        v.extend(u32::MAX.to_le_bytes());
+        v.extend(b"WAVE");
+        v.extend(body);
+        v
+    }
+
+    #[test]
+    fn rf64_markers_after_a_data_chunk_of_sentinel_size_are_read() {
+        let audio = [0u8; 8];
+        let file = rf64(&[
+            ds64_chunk(audio.len() as u64, &[]),
+            fmt(44100),
+            chunk_with_size_field(b"data", u32::MAX, &audio),
+            cue(&[(1, 44100)]),
+            adtl(&[labl(b"labl", 1, "After the audio")]),
+        ]);
+        let m = read(&file);
+        assert_eq!(m.len(), 1);
+        assert_eq!((m[0].comment.as_str(), m[0].time), ("After the audio", Tick::from_seconds_f64(1.0)));
+    }
+
+    #[test]
+    fn rf64_sizes_of_other_chunks_come_from_the_ds64_table() {
+        let junk = [7u8; 6];
+        let tail = || [cue(&[(1, 8000)]), adtl(&[labl(b"labl", 1, "Found")])].concat();
+        let with_entry = rf64(&[ds64_chunk(0, &[(*b"junk", junk.len() as u64)]), fmt(8000), chunk_with_size_field(b"junk", u32::MAX, &junk), tail()]);
+        assert_eq!(read(&with_entry)[0].comment, "Found");
+        // Without the table entry the sentinel is all there is, and what follows is not reached.
+        let without = rf64(&[ds64_chunk(0, &[]), fmt(8000), chunk_with_size_field(b"junk", u32::MAX, &junk), tail()]);
+        assert!(read(&without).is_empty());
+    }
+
+    #[test]
+    fn hostile_rf64_size_tables_read_as_far_as_they_go_without_panicking() {
+        // sizes that overflow when added to an offset
+        for data in [u64::MAX, u64::MAX - 7, 1 << 63] {
+            let file = rf64(&[ds64_chunk(data, &[(*b"junk", u64::MAX)]), fmt(8000), chunk_with_size_field(b"data", u32::MAX, &[0; 4]), cue(&[(1, 0)])]);
+            assert!(read(&file).is_empty());
+        }
+        // a table that claims far more entries than its chunk holds
+        let mut liar = ds64_chunk(0, &[]);
+        liar[8 + 24..8 + 28].copy_from_slice(&u32::MAX.to_le_bytes());
+        let _ = read(&rf64(&[liar, fmt(8000), cue(&[(1, 0)])]));
+        // every truncation of a good RF64 file is safe
+        let good =
+            rf64(&[ds64_chunk(4, &[]), fmt(44100), chunk_with_size_field(b"data", u32::MAX, &[0; 4]), cue(&[(1, 44100)]), adtl(&[labl(b"labl", 1, "Kept")])]);
+        assert_eq!(read(&good).len(), 1);
+        for n in 0..good.len() {
+            let _ = read(&good[..n]);
+        }
+    }
+
+    #[test]
+    fn a_huge_adtl_list_is_read_in_linear_time_and_only_for_the_cue_points_that_exist() {
+        // Records for ids that have no cue point are skipped, not stored, and the number looked at is capped.
+        let junk = |n: u32| (1000..1000 + n).map(|id| labl(b"labl", id, "n")).collect::<Vec<_>>();
+        let started = std::time::Instant::now();
+        // the real label comes first: read
+        let mut subs = vec![labl(b"labl", 1, "Real")];
+        subs.extend(junk(100_000));
+        let m = read(&wav(&[fmt(44100), cue(&[(1, 44100)]), adtl(&subs)]));
+        assert_eq!(m[0].comment, "Real");
+        // it comes after more records than are looked at: not read, and the marker is still there
+        let mut subs = junk(MAX_ADTL_RECORDS as u32 + 10);
+        subs.push(labl(b"labl", 1, "Too late"));
+        let m = read(&wav(&[fmt(44100), cue(&[(1, 44100)]), adtl(&subs)]));
+        assert_eq!((m.len(), m[0].comment.as_str()), (1, ""));
+        assert!(started.elapsed() < std::time::Duration::from_secs(5), "took {:?}", started.elapsed());
+    }
+}
diff --git a/crates/media/tests/it/aac_layout.rs b/crates/media/tests/it/aac_layout.rs
new file mode 100644
index 000000000..fb3e078a6
--- /dev/null
+++ b/crates/media/tests/it/aac_layout.rs
@@ -0,0 +1,422 @@
+//! Multichannel AAC reaches stereo by where each channel plays, whatever order its channel
+//! configuration decodes in (#1701). Fixtures are tones encoded with FilmCraft's AAC encoder (no
+//! ffmpeg needed, so nothing is skipped), with the configuration rewritten where the coded
+//! elements fit another: configurations 11 and 12 code the same elements as the encoder's 7- and
+//! 8-channel output, and a program config element can name any of them.
+
+use std::f64::consts::PI;
+use std::io::Cursor;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use effectcraft_media::{MediaPool, probe, probe_bytes};
+use effectcraft_time::Tick;
+use filmcraft_aac::{AudioSpecificConfig, Encoder, EncoderConfig, ProgramConfig};
+
+const RATE: u32 = 48_000;
+/// Tone frequencies by channel; an LFE gets [`LFE_TONE`], which its element can carry.
+const FREQS: [u32; 8] = [300, 500, 700, 900, 1100, 1300, 1500, 1700];
+const LFE_TONE: u32 = 60;
+const AMP: f32 = 0.25;
+const K: f64 = std::f64::consts::FRAC_1_SQRT_2;
+
+/// A channel's content, by where it plays.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Ch {
+    L,
+    R,
+    C,
+    Lfe,
+    Ls,
+    Rs,
+    Cs,
+}
+
+impl Ch {
+    /// ITU-R BS.775 gains into `[left, right]`, before normalisation.
+    fn gains(self) -> [f64; 2] {
+        match self {
+            Ch::L => [1.0, 0.0],
+            Ch::R => [0.0, 1.0],
+            Ch::C => [K, K],
+            Ch::Lfe => [0.0, 0.0],
+            Ch::Ls => [K, 0.0],
+            Ch::Rs => [0.0, K],
+            Ch::Cs => [0.5, 0.5],
+        }
+    }
+}
+
+struct Case {
+    name: &'static str,
+    /// What the encoder's input channels carry (its element order: C, L R, …, LFE last).
+    content: &'static [Ch],
+    /// The AudioSpecificConfig written to the container instead of the encoder's, if any.
+    asc: Option<AudioSpecificConfig>,
+}
+
+fn lc(config: u8) -> Option<AudioSpecificConfig> {
+    Some(AudioSpecificConfig::lc(3, config))
+}
+
+fn pce(front: Vec<(bool, u8)>, side: Vec<(bool, u8)>, back: Vec<(bool, u8)>, lfe: Vec<u8>, comment: &[u8]) -> Option<AudioSpecificConfig> {
+    let pce = ProgramConfig { object_type: 1, sf_index: 3, front, side, back, lfe, comment: comment.to_vec(), ..Default::default() };
+    Some(AudioSpecificConfig { pce: Some(pce), ..AudioSpecificConfig::lc(3, 0) })
+}
+
+use Ch::*;
+
+fn cases() -> Vec<Case> {
+    vec![
+        Case { name: "config3", content: &[C, L, R], asc: None },
+        Case { name: "config4", content: &[C, L, R, Cs], asc: None },
+        Case { name: "config5", content: &[C, L, R, Ls, Rs], asc: None },
+        Case { name: "config6", content: &[C, L, R, Ls, Rs, Lfe], asc: None },
+        // configuration 7 as ffmpeg writes 7.1: the second and third pairs are surrounds
+        Case { name: "config7", content: &[C, L, R, Ls, Rs, Ls, Rs, Lfe], asc: None },
+        Case { name: "config11", content: &[C, L, R, Ls, Rs, Cs, Lfe], asc: lc(11) },
+        Case { name: "config12", content: &[C, L, R, Ls, Rs, Ls, Rs, Lfe], asc: lc(12) },
+        // the encoder's own 6.1: a PCE listing the centre first
+        Case { name: "pce61-centre-first", content: &[C, L, R, Ls, Rs, Cs, Lfe], asc: None },
+        // ffmpeg's 6.1 PCE: front pair and centre, a side SCE, a back pair and SCE, no LFE
+        // element, its channels in ffmpeg's order L R C LFE Cs Ls Rs. The decoder places the
+        // encoder's SCE 0 in the front SCE, pair 0 front, pair 1 back, SCE 1 in the back SCE (tag
+        // 1) and the LFE in the side SCE left over (tag 5).
+        Case {
+            name: "pce61-ffmpeg",
+            content: &[C, L, R, Cs, Ls, Rs, Lfe],
+            asc: pce(vec![(true, 0), (false, 0)], vec![(false, 5)], vec![(true, 1), (false, 1)], vec![], b"Lavc62.28.102"),
+        },
+    ]
+}
+
+fn freq(content: &[Ch], i: usize) -> u32 {
+    if content.get(i) == Some(&Lfe) { LFE_TONE } else { FREQS[i] }
+}
+
+/// Two seconds of `content`'s tones encoded as AAC: the AudioSpecificConfig and access units.
+fn encode(content: &[Ch], adts: bool) -> (Vec<u8>, Vec<Vec<u8>>) {
+    let n = content.len();
+    let mut cfg = EncoderConfig::cbr(RATE, n, 96_000 * n as u32);
+    cfg.adts = adts;
+    let mut enc = Encoder::new(cfg).expect("encoder");
+    let planes: Vec<Vec<f32>> =
+        (0..n).map(|c| (0..2 * RATE).map(|i| AMP * (2.0 * PI * f64::from(freq(content, c)) * f64::from(i) / f64::from(RATE)).sin() as f32).collect()).collect();
+    let refs: Vec<&[f32]> = planes.iter().map(Vec::as_slice).collect();
+    let mut units = enc.encode(&refs);
+    units.extend(enc.flush());
+    (enc.audio_specific_config(), units)
+}
+
+fn mp4(asc: Vec<u8>, channels: u32, units: &[Vec<u8>]) -> Vec<u8> {
+    mp4_after(None, asc, channels, units)
+}
+
+/// As [`mp4`], after an audio track with the configuration and channel count `empty` and no
+/// samples, if any.
+fn mp4_after(empty: Option<(Vec<u8>, u32)>, asc: Vec<u8>, channels: u32, units: &[Vec<u8>]) -> Vec<u8> {
+    use filmcraft_isobmff::{Brand, Mp4Writer, SampleEntry, TrackConfig, WriteSample, WriterOptions};
+    let mut w = Mp4Writer::new(Cursor::new(Vec::new()), WriterOptions::new(Brand::Mp4)).expect("writer");
+    if let Some((asc, channels)) = empty {
+        w.add_track(TrackConfig::new(SampleEntry::aac(asc, channels, RATE), RATE)).expect("empty track");
+    }
+    let t = w.add_track(TrackConfig::new(SampleEntry::aac(asc, channels, RATE), RATE)).expect("track");
+    for u in units {
+        w.write_sample(t, WriteSample { data: u, duration: 1024, composition_offset: 0, is_sync: true }).expect("sample");
+    }
+    w.finish().expect("finish").into_inner()
+}
+
+fn mkv(asc: Vec<u8>, channels: u32, units: &[Vec<u8>]) -> Vec<u8> {
+    mkv_after(None, asc, channels, units)
+}
+
+/// As [`mkv`], after an audio track with the configuration and channel count `empty` and no
+/// frames, if any.
+fn mkv_after(empty: Option<(Vec<u8>, u32)>, asc: Vec<u8>, channels: u32, units: &[Vec<u8>]) -> Vec<u8> {
+    use filmcraft_matroska::{MkvWriter, MuxOptions, TrackKind, TrackSpec};
+    let track = |asc: Vec<u8>, channels: u32| {
+        let mut t = TrackSpec::new(TrackKind::Audio, "A_AAC");
+        t.codec_private = asc;
+        t.audio = Some((f64::from(RATE), u64::from(channels), None));
+        t
+    };
+    let tracks: Vec<TrackSpec> = empty.into_iter().map(|(asc, n)| track(asc, n)).chain([track(asc, channels)]).collect();
+    let played = tracks.len() - 1;
+    let mut w = MkvWriter::new(Cursor::new(Vec::new()), tracks, MuxOptions::default()).expect("writer");
+    let frame_ns = 1_000_000_000 * 1024 / i64::from(RATE);
+    for (i, u) in units.iter().enumerate() {
+        w.write_frame(played, i as i64 * frame_ns, true, u, Some(frame_ns as u64)).expect("frame");
+    }
+    w.finish().expect("finish").into_inner()
+}
+
+/// The fixture written to disk as `name`.
+fn write(name: &str, bytes: &[u8]) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("effectcraft-aac-layout-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).expect("mkdir");
+    let p = dir.join(name);
+    std::fs::write(&p, bytes).expect("write");
+    p
+}
+
+/// Amplitude of the tone at `freq` in one side of interleaved stereo.
+fn amp(s: &[f32], side: usize, freq: u32) -> f64 {
+    let (mut re, mut im, mut n) = (0.0, 0.0, 0usize);
+    for (i, f) in s.as_chunks::<2>().0.iter().enumerate() {
+        let w = 2.0 * PI * f64::from(freq) * i as f64 / f64::from(RATE);
+        re += f64::from(f[side]) * w.cos();
+        im += f64::from(f[side]) * w.sin();
+        n += 1;
+    }
+    2.0 * (re * re + im * im).sqrt() / n.max(1) as f64
+}
+
+/// Stereo of one second from 0.5 s in, through the media pool as footage reads it.
+fn mix(pool: &MediaPool, footage: &effectcraft_project::Footage) -> Vec<f32> {
+    pool.audio_samples(footage, Tick::from_seconds_f64(0.5), RATE as usize, RATE)
+}
+
+/// Each channel of `content` reaches each side at its BS.775 gain, normalised by the larger
+/// side's sum (an LFE nowhere).
+fn check(label: &str, content: &[Ch], s: &[f32]) {
+    let raw: Vec<[f64; 2]> = content.iter().map(|c| c.gains()).collect();
+    let norm = raw.iter().map(|g| g[0]).sum::<f64>().max(raw.iter().map(|g| g[1]).sum::<f64>()).max(1.0);
+    for (i, (ch, g)) in content.iter().zip(&raw).enumerate() {
+        for side in 0..2 {
+            let (got, want) = (amp(s, side, freq(content, i)), f64::from(AMP) * g[side] / norm);
+            assert!(
+                (got - want).abs() <= f64::from(AMP) * 0.05,
+                "{label}: {ch:?} ({} Hz) -> {} is {got:.4}, expected {want:.4}",
+                freq(content, i),
+                ["L", "R"][side]
+            );
+        }
+    }
+}
+
+/// The LFE tone survives encoding, so its absence from the mix means it was left out.
+fn lfe_is_coded(case: &Case, bytes: Vec<u8>) {
+    if !case.content.contains(&Lfe) {
+        return;
+    }
+    let src = filmcraft_codecs::open_bytes("lfe.mp4", bytes.into()).expect("open");
+    let buf = src.audio(24_000, RATE as usize, RATE).expect("decode");
+    let best = buf.channels.iter().map(|ch| amp(&ch.iter().flat_map(|&v| [v, v]).collect::<Vec<_>>(), 0, LFE_TONE)).fold(0.0, f64::max);
+    assert!(best > 0.8 * f64::from(AMP), "{}: the LFE tone is coded ({best:.4})", case.name);
+}
+
+#[test]
+fn every_aac_layout_mixes_by_speaker_in_mp4() {
+    for case in cases() {
+        let (asc, units) = encode(case.content, false);
+        let asc = case.asc.as_ref().map_or(asc, AudioSpecificConfig::to_bytes);
+        let bytes = mp4(asc, case.content.len() as u32, &units);
+        lfe_is_coded(&case, bytes.clone());
+        let p = write(&format!("{}.mp4", case.name), &bytes);
+        check(case.name, case.content, &mix(&MediaPool::new(), &probe(&p).expect("probe")));
+        // in memory (`add_bytes`) as well as in place
+        let (path, bytes): (String, Arc<[u8]>) = (format!("/mem/{}.mp4", case.name), bytes.into());
+        let pool = MediaPool::new();
+        pool.add_bytes(&path, bytes.clone());
+        check(&format!("{} in memory", case.name), case.content, &mix(&pool, &probe_bytes(&path, bytes).expect("probe")));
+    }
+}
+
+#[test]
+fn matroska_aac_layouts_mix_by_speaker() {
+    for case in cases().into_iter().filter(|c| matches!(c.name, "config12" | "pce61-centre-first" | "pce61-ffmpeg")) {
+        let (asc, units) = encode(case.content, false);
+        let asc = case.asc.as_ref().map_or(asc, AudioSpecificConfig::to_bytes);
+        let p = write(&format!("{}.mkv", case.name), &mkv(asc, case.content.len() as u32, &units));
+        check(case.name, case.content, &mix(&MediaPool::new(), &probe(&p).expect("probe")));
+    }
+}
+
+/// ADTS signals configurations 1 to 7 only, which the channel count tells apart.
+#[test]
+fn adts_aac_layouts_mix_by_speaker() {
+    for case in cases().into_iter().filter(|c| c.asc.is_none() && c.content.len() != 7) {
+        let (_, units) = encode(case.content, true);
+        let p = write(&format!("{}.aac", case.name), &units.concat());
+        check(case.name, case.content, &mix(&MediaPool::new(), &probe(&p).expect("probe")));
+    }
+}
+
+/// Audio plays from the first track FilmCraft can play, so an audio track with no samples before
+/// it lends it no configuration. Each case decodes in another order than the empty track's
+/// configuration would (FilmCraft reorders 12 to WAVE / SMPTE but not 7, and 11 but not a PCE).
+#[test]
+fn an_empty_audio_track_lends_its_configuration_to_no_other() {
+    for (name, empty) in [("config12", 7), ("pce61-centre-first", 11)] {
+        let case = cases().into_iter().find(|c| c.name == name).expect("case");
+        let n = case.content.len() as u32;
+        let empty = Some((AudioSpecificConfig::lc(3, empty).to_bytes(), n));
+        let (asc, units) = encode(case.content, false);
+        let asc = case.asc.as_ref().map_or(asc, AudioSpecificConfig::to_bytes);
+        let p = write(&format!("{name}-after-empty.mp4"), &mp4_after(empty.clone(), asc.clone(), n, &units));
+        check(&format!("{name} MP4"), case.content, &mix(&MediaPool::new(), &probe(&p).expect("probe")));
+        let p = write(&format!("{name}-after-empty.mkv"), &mkv_after(empty, asc, n, &units));
+        check(&format!("{name} Matroska"), case.content, &mix(&MediaPool::new(), &probe(&p).expect("probe")));
+    }
+}
+
+/// A transport stream plays its first audio stream and mixes by that stream's configuration,
+/// whatever follows it. ADTS of configuration 7 decodes in element order, LATM of configuration
+/// 12 reordered to WAVE / SMPTE; LATM of configuration 7 names 7 channels, which mix as
+/// configuration 7's rather than as 7 channels by count. (FilmCraft decodes LATM of configuration
+/// 12 as 12 channels, so it isn't played here.)
+#[test]
+fn mpeg_aac_mixes_by_the_stream_played() {
+    let case = cases().into_iter().find(|c| c.name == "config7").expect("case");
+    let (_, adts) = encode(case.content, true);
+    let (_, raw) = encode(case.content, false);
+    for (label, latm_first, latm_config) in [("ADTS before LATM", false, 12), ("LATM before ADTS", true, 7)] {
+        let (adts_pid, latm_pid) = if latm_first { (0x102, 0x101) } else { (0x101, 0x102) };
+        let mut ts = Ts::default();
+        let mut streams = [(0x0F, adts_pid), (0x11, latm_pid)];
+        streams.sort_by_key(|s| s.1);
+        ts.psi(&streams);
+        for (i, (a, r)) in adts.iter().zip(&raw).enumerate() {
+            let pts = 1920 * i as i64;
+            let mut units = [(adts_pid, pes(pts, a)), (latm_pid, pes(pts, &loas(latm_config, r)))];
+            units.sort_by_key(|u| u.0);
+            for (pid, unit) in units {
+                ts.pes(pid, &unit);
+            }
+        }
+        let p = write(&format!("latm-first-{latm_first}.ts"), &ts.out);
+        check(label, case.content, &mix(&MediaPool::new(), &probe(&p).expect("probe")));
+    }
+}
+
+/// A LOAS frame of `payload` with its StreamMuxConfig: AAC LC, 48 kHz, channel configuration
+/// `config`.
+fn loas(config: u32, payload: &[u8]) -> Vec<u8> {
+    let mut bits = Bits::default();
+    // useSameStreamMux, audioMuxVersion, allStreamsSameTimeFraming, numSubFrames, numProgram, numLayer
+    bits.put(0b001, 3);
+    bits.put(0, 13);
+    // AudioSpecificConfig and GASpecificConfig
+    bits.put(2, 5);
+    bits.put(3, 4);
+    bits.put(config, 4);
+    bits.put(0, 3);
+    // frameLengthType, latmBufferFullness, otherDataPresent, crcCheckPresent
+    bits.put(0, 3);
+    bits.put(0xFF, 8);
+    bits.put(0, 2);
+    let mut len = payload.len();
+    while len >= 255 {
+        bits.put(255, 8);
+        len -= 255;
+    }
+    bits.put(len as u32, 8);
+    for &b in payload {
+        bits.put(u32::from(b), 8);
+    }
+    let body = bits.finish();
+    let mut v = vec![0x56, 0xE0 | (body.len() >> 8) as u8, body.len() as u8];
+    v.extend(body);
+    v
+}
+
+/// A big-endian bit writer.
+#[derive(Default)]
+struct Bits {
+    out: Vec<u8>,
+    acc: u64,
+    n: u32,
+}
+
+impl Bits {
+    fn put(&mut self, v: u32, n: u32) {
+        self.acc = self.acc << n | u64::from(v);
+        self.n += n;
+        while self.n >= 8 {
+            self.n -= 8;
+            self.out.push((self.acc >> self.n) as u8);
+        }
+    }
+    fn finish(mut self) -> Vec<u8> {
+        if self.n > 0 {
+            self.put(0, 8 - self.n);
+        }
+        self.out
+    }
+}
+
+/// An audio PES packet (stream id 0xC0) presented at `pts` (90 kHz).
+fn pes(pts: i64, payload: &[u8]) -> Vec<u8> {
+    let t = [0x21 | ((pts >> 29) & 0x0E) as u8, (pts >> 22) as u8, ((pts >> 14) & 0xFE) as u8 | 1, (pts >> 7) as u8, ((pts << 1) & 0xFE) as u8 | 1];
+    let len = 8 + payload.len();
+    let mut v = vec![0, 0, 1, 0xC0, (len >> 8) as u8, len as u8, 0x80, 0x80, 5];
+    v.extend(t);
+    v.extend_from_slice(payload);
+    v
+}
+
+/// A transport stream of one program (its PMT on PID 0x100), PES cut into 188-byte packets.
+#[derive(Default)]
+struct Ts {
+    out: Vec<u8>,
+    cc: std::collections::HashMap<u16, u8>,
+}
+
+impl Ts {
+    fn packet(&mut self, pid: u16, start: bool, payload: &[u8]) -> usize {
+        let cc = self.cc.entry(pid).or_insert(0);
+        let mut p = vec![0x47, u8::from(start) << 6 | (pid >> 8) as u8, pid as u8];
+        let n = payload.len().min(184);
+        if n < 184 {
+            let stuffing = 183 - n;
+            p.extend([0x30 | *cc, stuffing as u8]);
+            if stuffing > 0 {
+                p.push(0);
+                p.extend(std::iter::repeat_n(0xFF, stuffing - 1));
+            }
+        } else {
+            p.push(0x10 | *cc);
+        }
+        *cc = (*cc + 1) & 15;
+        p.extend_from_slice(&payload[..n]);
+        self.out.extend(p);
+        n
+    }
+    fn section(&mut self, pid: u16, body: &[u8]) {
+        let mut s = vec![0];
+        s.extend_from_slice(body);
+        s.extend(crc32_mpeg(body).to_be_bytes());
+        self.packet(pid, true, &s);
+    }
+    /// The PAT and a PMT of `streams` (stream type, PID).
+    fn psi(&mut self, streams: &[(u8, u16)]) {
+        self.section(0, &[0x00, 0xB0, 13, 0, 1, 0xC1, 0, 0, 0, 1, 0xE1, 0x00]);
+        let mut pmt = vec![0x02, 0xB0, 0, 0, 1, 0xC1, 0, 0, 0xE1, 0x01, 0xF0, 0];
+        for &(kind, pid) in streams {
+            pmt.extend([kind, 0xE0 | (pid >> 8) as u8, pid as u8, 0xF0, 0]);
+        }
+        pmt[2] = (pmt.len() + 1) as u8;
+        self.section(0x100, &pmt);
+    }
+    fn pes(&mut self, pid: u16, data: &[u8]) {
+        let (mut rest, mut start) = (data, true);
+        while !rest.is_empty() {
+            let n = self.packet(pid, start, rest);
+            rest = &rest[n..];
+            start = false;
+        }
+    }
+}
+
+/// CRC-32 of PSI sections (MSB first, polynomial 0x04C11DB7, initial value all ones).
+fn crc32_mpeg(data: &[u8]) -> u32 {
+    let mut crc = u32::MAX;
+    for &b in data {
+        crc ^= u32::from(b) << 24;
+        for _ in 0..8 {
+            crc = if crc & 0x8000_0000 != 0 { crc << 1 ^ 0x04C1_1DB7 } else { crc << 1 };
+        }
+    }
+    crc
+}
diff --git a/crates/media/tests/downmix.rs b/crates/media/tests/it/downmix.rs
similarity index 75%
rename from crates/media/tests/downmix.rs
rename to crates/media/tests/it/downmix.rs
index e0e7d2252..05205ab6a 100644
--- a/crates/media/tests/downmix.rs
+++ b/crates/media/tests/it/downmix.rs
@@ -94,8 +94,18 @@ fn cases() -> Vec<Case> {
     let (n71, g71) = seven_one();
     let k5 = 1.0 / (1.0 + 2.0 * K);
     let kq = 1.0 / (1.0 + K);
+    let k61 = 1.0 / (1.5 + 2.0 * K);
     vec![
         Case { file: "dm51.m4a", layout: "5.1", names: n51, codec: &["-c:a", "aac", "-b:a", "384k"], gains: g51.clone(), tol: 0.15 },
+        Case {
+            file: "dm61.m4a",
+            layout: "6.1",
+            names: &["FL", "FR", "FC", "LFE", "BC", "SL", "SR"],
+            codec: &["-c:a", "aac", "-b:a", "448k"],
+            gains: vec![[k61, 0.0], [0.0, k61], [k61 * K, k61 * K], [0.0, 0.0], [k61 / 2.0, k61 / 2.0], [k61 * K, 0.0], [0.0, k61 * K]],
+            tol: 0.15,
+        },
+        Case { file: "dm71.m4a", layout: "7.1", names: n71, codec: &["-c:a", "aac", "-b:a", "512k"], gains: g71.clone(), tol: 0.15 },
         Case { file: "dm51.ac3.mp4", layout: "5.1", names: n51, codec: &["-c:a", "ac3", "-b:a", "640k"], gains: g51.clone(), tol: 0.15 },
         Case { file: "dm51.wav", layout: "5.1", names: n51, codec: &["-c:a", "pcm_s16le"], gains: g51.clone(), tol: 0.02 },
         Case { file: "dm51.flac", layout: "5.1", names: n51, codec: &["-c:a", "flac"], gains: g51, tol: 0.02 },
@@ -154,24 +164,58 @@ fn each_channel_reaches_stereo_at_its_bs775_gain() {
     for c in cases() {
         let freqs: Vec<u32> = FREQS.iter().copied().take(c.names.len()).collect();
         let Some(p) = fixture(c.file, c.layout, c.names, &freqs, c.codec) else { continue };
-        let s = ours(&p);
-        let sine = 0.125 * 1.0; // peak of ffmpeg's sine source (0.125 = 2^-3)
-        for (i, (name, g)) in c.names.iter().zip(&c.gains).enumerate() {
-            for (side, gain) in g.iter().enumerate() {
-                let got = amp(&s, side, freqs[i]);
-                let want = sine * gain;
-                assert!((got - want).abs() <= sine * c.tol.max(0.02), "{}: {name} -> {} is {got:.4}, expected {want:.4}", c.file, ["L", "R"][side]);
-            }
-        }
-        let theirs = ffmpeg_ac2(&p);
-        let (a, b) = (rms(&s), rms(&theirs));
-        let db = 20.0 * (a / b).log10();
-        assert!(db.abs() < 1.0, "{}: level {db:.2} dB off ffmpeg -ac 2 (rms {a:.4} vs {b:.4})", c.file);
-        let pdb = 20.0 * (peak(&s) / peak(&theirs)).log10();
-        assert!(pdb.abs() < 1.5, "{}: peak {pdb:.2} dB off ffmpeg -ac 2", c.file);
+        check(&c, &p);
     }
 }
 
+/// `p`, or a copy whose AAC sample entry names all `channels` of its PCE layout: ffmpeg 4.2 writes
+/// 2 there for a PCE layout (8.1 the real count), and FilmCraft decodes as many channels as the
+/// sample entry names, so the other five of a 6.1 would never reach the mix.
+fn whole_pce_entry(p: &Path, channels: usize) -> PathBuf {
+    let mut bytes = std::fs::read(p).expect("read");
+    let Some((asc, 2)) = aac_entry(&bytes) else { return p.to_path_buf() };
+    if channels <= 2 || filmcraft_aac::AudioSpecificConfig::parse(&asc).map(|a| a.channel_config).ok() != Some(0) {
+        return p.to_path_buf();
+    }
+    // the `mp4a` entry's channelcount follows its 6 reserved bytes, data reference index and
+    // 8 reserved bytes
+    let at = bytes.windows(4).position(|w| w == b"mp4a").expect("an mp4a sample entry") + 4 + 6 + 2 + 8;
+    bytes[at..at + 2].copy_from_slice(&(channels as u16).to_be_bytes());
+    eprintln!("{}: its sample entry names 2 of {channels} channels (ffmpeg 4.2): reading a copy naming all", p.display());
+    let out = p.with_extension("entry.m4a");
+    std::fs::write(&out, bytes).expect("write");
+    out
+}
+
+/// The AudioSpecificConfig and sample entry channel count of an MP4's first AAC track.
+fn aac_entry(bytes: &[u8]) -> Option<(Vec<u8>, u32)> {
+    let file = filmcraft_isobmff::open(bytes).ok()?;
+    file.tracks.iter().flat_map(|t| &t.entries).find_map(|e| match &e.codec {
+        filmcraft_isobmff::CodecConfig::Aac(a) => Some((a.asc.clone(), e.audio.as_ref()?.channels)),
+        _ => None,
+    })
+}
+
+fn check(c: &Case, p: &Path) {
+    let p = &whole_pce_entry(p, c.names.len());
+    let s = ours(p);
+    let freqs: Vec<u32> = FREQS.iter().copied().take(c.names.len()).collect();
+    let sine = 0.125 * 1.0; // peak of ffmpeg's sine source (0.125 = 2^-3)
+    for (i, (name, g)) in c.names.iter().zip(&c.gains).enumerate() {
+        for (side, gain) in g.iter().enumerate() {
+            let got = amp(&s, side, freqs[i]);
+            let want = sine * gain;
+            assert!((got - want).abs() <= sine * c.tol.max(0.02), "{}: {name} -> {} is {got:.4}, expected {want:.4}", c.file, ["L", "R"][side]);
+        }
+    }
+    let theirs = ffmpeg_ac2(p);
+    let (a, b) = (rms(&s), rms(&theirs));
+    let db = 20.0 * (a / b).log10();
+    assert!(db.abs() < 1.0, "{}: level {db:.2} dB off ffmpeg -ac 2 (rms {a:.4} vs {b:.4})", c.file);
+    let pdb = 20.0 * (peak(&s) / peak(&theirs)).log10();
+    assert!(pdb.abs() < 1.5, "{}: peak {pdb:.2} dB off ffmpeg -ac 2", c.file);
+}
+
 /// Full-scale in every channel must not clip.
 #[test]
 fn loud_surround_does_not_clip() {
diff --git a/crates/media/tests/exif_orientation.rs b/crates/media/tests/it/exif_orientation.rs
similarity index 100%
rename from crates/media/tests/exif_orientation.rs
rename to crates/media/tests/it/exif_orientation.rs
diff --git a/crates/media/tests/it/exr_golden.rs b/crates/media/tests/it/exr_golden.rs
new file mode 100644
index 000000000..f760ed7c2
--- /dev/null
+++ b/crates/media/tests/it/exr_golden.rs
@@ -0,0 +1,516 @@
+//! OpenEXR pictures and aux channels pinned to exact hashes (#474).
+//!
+//! Synthetic files (single-layer, multi-layer with and without an unnamed RGB layer, multi-part,
+//! data windows smaller and larger than the display window, half / float / uint channels, RLE,
+//! ZIP, PIZ and DWAA) are decoded through the media pool as the renderer asks for them: the
+//! picture in each alpha interpretation, and the channels EXtractoR and Cryptomatte read. The
+//! hashes were taken before the picture and the channels started sharing one decode, so a change
+//! to how either is decoded must leave every bit as it was. Only bit-exact float steps are
+//! pinned (linear light, no `powf`), so the hashes hold on every platform; DWAA (whose decoder
+//! uses `powf`) and the sRGB / gamma 2.4 curves are checked for agreement between the two ways a
+//! frame can be decoded instead. Re-pin with `EXR_GOLDEN_PRINT=1` after an intended change.
+
+use std::sync::Arc;
+
+use effectcraft_media::{MediaPool, probe_bytes};
+use effectcraft_project::{AlphaMode, Footage, ItemId};
+use effectcraft_render::{FloatCurve, FootageSource};
+use effectcraft_time::Tick;
+use exr::prelude::*;
+
+const W: usize = 37;
+const H: usize = 23;
+
+/// A deterministic value for pixel (x, y) of channel `c`: negative, in range and above 1.
+fn value(x: usize, y: usize, c: usize) -> f32 {
+    ((x * 7 + y * 13 + c * 29) % 97) as f32 / 40.0 - 0.3
+}
+
+/// A deterministic alpha in 0..=1 (0 included, for the premultiplied divide).
+fn alpha(x: usize, y: usize) -> f32 {
+    ((x * 3 + y * 5) % 11) as f32 / 10.0
+}
+
+#[derive(Clone, Copy)]
+enum Kind {
+    Half,
+    Float,
+    Uint,
+}
+
+/// A channel `name` of `size` filled from [`value`] (or [`alpha`] for an `A` / `a` channel).
+fn channel(name: &str, kind: Kind, size: (usize, usize), c: usize) -> AnyChannel<FlatSamples> {
+    let is_alpha = name.rsplit('.').next().is_some_and(|n| n.eq_ignore_ascii_case("a"));
+    let px = |i: usize| {
+        let (x, y) = (i % size.0, i / size.0);
+        if is_alpha { alpha(x, y) } else { value(x, y, c) }
+    };
+    let n = size.0 * size.1;
+    let samples = match kind {
+        Kind::Half => FlatSamples::F16((0..n).map(|i| f16::from_f32(px(i))).collect()),
+        Kind::Float => FlatSamples::F32((0..n).map(px).collect()),
+        Kind::Uint => FlatSamples::U32((0..n).map(|i| (i as u32).wrapping_mul(2_654_435_761) >> 8).collect()),
+    };
+    AnyChannel::new(name, samples)
+}
+
+fn channels(list: &[(&str, Kind)], size: (usize, usize)) -> AnyChannels<FlatSamples> {
+    AnyChannels::sort(list.iter().enumerate().map(|(c, (n, k))| channel(n, *k, size, c)).collect::<Vec<_>>().into())
+}
+
+fn encoding(compression: Compression) -> Encoding {
+    Encoding { compression, blocks: Blocks::ScanLines, line_order: LineOrder::Increasing }
+}
+
+fn with_manifest(mut attrs: LayerAttributes) -> LayerAttributes {
+    attrs.other.insert(Text::from("cryptomatte/abc1234/name"), AttributeValue::Text(Text::from("CryptoObject")));
+    attrs.other.insert(Text::from("cryptomatte/abc1234/manifest"), AttributeValue::Text(Text::from(r#"{"bunny":"13851a76","floor":"0a1b2c3d"}"#)));
+    attrs
+}
+
+/// One part: `list` channels over a data window of `size` at `pos`.
+fn part(name: Option<&str>, list: &[(&str, Kind)], size: (usize, usize), pos: (i32, i32), compression: Compression) -> Layer<AnyChannels<FlatSamples>> {
+    part_with(name, list, size, pos, encoding(compression))
+}
+
+/// [`part`] with its own block layout (tiles) and line order.
+fn part_with(name: Option<&str>, list: &[(&str, Kind)], size: (usize, usize), pos: (i32, i32), encoding: Encoding) -> Layer<AnyChannels<FlatSamples>> {
+    let mut attrs = name.map_or_else(LayerAttributes::default, LayerAttributes::named);
+    attrs.layer_position = Vec2(pos.0, pos.1);
+    Layer::new(size, with_manifest(attrs), encoding, channels(list, size))
+}
+
+/// A tiled single-part file of `list` with mip levels down to 1×1 (each level its own values);
+/// the picture and the channels are its largest level.
+fn mipmapped(list: &[(&str, Kind)], compression: Compression) -> Vec<u8> {
+    let levels = |name: &str, kind: Kind, c: usize| {
+        let (mut data, mut size) = (vec![], (W, H));
+        loop {
+            data.push(channel(name, kind, size, c + data.len()).sample_data);
+            if size == (1, 1) {
+                break;
+            }
+            size = ((size.0 / 2).max(1), (size.1 / 2).max(1));
+        }
+        AnyChannel::new(name, Levels::Mip { rounding_mode: exr::math::RoundingMode::Down, level_data: data })
+    };
+    let list: Vec<AnyChannel<Levels<FlatSamples>>> = list.iter().enumerate().map(|(c, (n, k))| levels(n, *k, c)).collect();
+    let encoding = Encoding { compression, blocks: Blocks::Tiles(Vec2(16, 16)), line_order: LineOrder::Increasing };
+    let layer = Layer::new((W, H), with_manifest(LayerAttributes::default()), encoding, AnyChannels::sort(list.into()));
+    let mut bytes = std::io::Cursor::new(Vec::new());
+    Image::from_layer(layer).write().non_parallel().to_buffered(&mut bytes).unwrap();
+    bytes.into_inner()
+}
+
+/// Encode `layers` with the display window `display` (position, size).
+fn write(layers: Vec<Layer<AnyChannels<FlatSamples>>>, display: ((i32, i32), (usize, usize))) -> Vec<u8> {
+    let mut attrs = ImageAttributes::new(IntegerBounds::new(display.0, display.1));
+    attrs.pixel_aspect = 1.0;
+    let image = Image::from_layers(attrs, layers);
+    let mut bytes = std::io::Cursor::new(Vec::new());
+    image.write().non_parallel().to_buffered(&mut bytes).unwrap();
+    bytes.into_inner()
+}
+
+const RGBA_HALF: [(&str, Kind); 4] = [("R", Kind::Half), ("G", Kind::Half), ("B", Kind::Half), ("A", Kind::Half)];
+const CRYPTO: [(&str, Kind); 4] =
+    [("CryptoObject00.r", Kind::Float), ("CryptoObject00.g", Kind::Float), ("CryptoObject00.b", Kind::Float), ("CryptoObject00.a", Kind::Float)];
+
+/// The synthetic files: (name, bytes, whether the hashes are pinned).
+fn files() -> Vec<(&'static str, Vec<u8>, bool)> {
+    let full = (W, H);
+    let origin = ((0, 0), full);
+    let cat = |a: &[(&'static str, Kind)], b: &[(&'static str, Kind)]| -> Vec<(&'static str, Kind)> { a.iter().chain(b).copied().collect() };
+    let layered: Vec<(&str, Kind)> = cat(
+        &[
+            ("Image.R", Kind::Half),
+            ("Image.G", Kind::Half),
+            ("Image.B", Kind::Half),
+            ("Image.A", Kind::Half),
+            ("depth.Z", Kind::Float),
+            ("ObjectID", Kind::Uint),
+        ],
+        &CRYPTO,
+    );
+    let unnamed_plus: Vec<(&str, Kind)> =
+        cat(&cat(&RGBA_HALF, &[("Diffuse.R", Kind::Half), ("Diffuse.G", Kind::Half), ("Diffuse.B", Kind::Half), ("Z", Kind::Float)]), &CRYPTO);
+    let rgb_float = [("R", Kind::Float), ("G", Kind::Float), ("B", Kind::Float), ("depth.Z", Kind::Float)];
+    vec![
+        ("rgba_half_zip16", write(vec![part(None, &RGBA_HALF, full, (0, 0), Compression::ZIP16)], origin), true),
+        (
+            "rgb_float_piz",
+            write(vec![part(None, &[("R", Kind::Float), ("G", Kind::Float), ("B", Kind::Float), ("Z", Kind::Float)], full, (0, 0), Compression::PIZ)], origin),
+            true,
+        ),
+        ("layered_rle", write(vec![part(None, &layered, full, (0, 0), Compression::RLE)], origin), true),
+        ("unnamed_rgb_plus_layers_zip1", write(vec![part(None, &unnamed_plus, full, (0, 0), Compression::ZIP1)], origin), true),
+        (
+            "multipart_zip16",
+            write(
+                vec![
+                    part(Some("Image"), &RGBA_HALF, full, (0, 0), Compression::ZIP16),
+                    part(Some("depth"), &[("Z", Kind::Float)], full, (0, 0), Compression::ZIP16),
+                    part(
+                        Some("CryptoObject00"),
+                        &[("r", Kind::Float), ("g", Kind::Float), ("b", Kind::Float), ("a", Kind::Float)],
+                        full,
+                        (0, 0),
+                        Compression::ZIP16,
+                    ),
+                ],
+                origin,
+            ),
+            true,
+        ),
+        (
+            // The first part with R, G and B is not the beauty pass.
+            "multipart_diffuse_then_beauty_zip1",
+            write(
+                vec![
+                    part(Some("diffuse"), &[("R", Kind::Half), ("G", Kind::Half), ("B", Kind::Half)], full, (0, 0), Compression::ZIP1),
+                    part(Some("beauty"), &RGBA_HALF, (20, 10), (5, 7), Compression::ZIP1),
+                    part(Some("depth"), &[("Z", Kind::Float)], full, (0, 0), Compression::ZIP1),
+                ],
+                origin,
+            ),
+            true,
+        ),
+        (
+            "multipart_blender5_rle",
+            write(
+                vec![
+                    part(Some("ViewLayer.Depth"), &[("ViewLayer.Depth.Z", Kind::Float)], full, (0, 0), Compression::RLE),
+                    part(
+                        Some("ViewLayer.Combined"),
+                        &[
+                            ("ViewLayer.Combined.R", Kind::Half),
+                            ("ViewLayer.Combined.G", Kind::Half),
+                            ("ViewLayer.Combined.B", Kind::Half),
+                            ("ViewLayer.Combined.A", Kind::Half),
+                        ],
+                        full,
+                        (0, 0),
+                        Compression::RLE,
+                    ),
+                ],
+                origin,
+            ),
+            true,
+        ),
+        ("unnamed_rgb_window_smaller_zip16", write(vec![part(None, &unnamed_plus, (20, 10), (5, 7), Compression::ZIP16)], origin), true),
+        ("rgb_float_window_larger_piz", write(vec![part(None, &rgb_float, (45, 30), (-1, -5), Compression::PIZ)], ((3, -2), full)), true),
+        ("layered_window_smaller_zip16", write(vec![part(None, &layered, (20, 10), (5, 7), Compression::ZIP16)], origin), true),
+        ("layered_window_larger_piz", write(vec![part(None, &layered, (45, 30), (-4, -3), Compression::PIZ)], origin), true),
+        ("unnamed_rgb_plus_layers_dwaa", write(vec![part(None, &unnamed_plus, full, (0, 0), Compression::DWAA(None))], origin), false),
+        ("layered_dwaa", write(vec![part(None, &layered, full, (0, 0), Compression::DWAA(None))], origin), false),
+        (
+            "unnamed_rgb_plus_layers_tiled_zip16",
+            write(
+                vec![part_with(None, &unnamed_plus, (30, 20), (3, 2), Encoding { blocks: Blocks::Tiles(Vec2(16, 8)), ..encoding(Compression::ZIP16) })],
+                origin,
+            ),
+            true,
+        ),
+        (
+            "layered_tiled_rle",
+            write(vec![part_with(None, &layered, full, (0, 0), Encoding { blocks: Blocks::Tiles(Vec2(8, 8)), ..encoding(Compression::RLE) })], origin),
+            true,
+        ),
+        ("unnamed_rgb_plus_layers_mipmapped_zip16", mipmapped(&unnamed_plus, Compression::ZIP16), true),
+        ("layered_mipmapped_piz", mipmapped(&layered, Compression::PIZ), true),
+        (
+            "unnamed_rgb_plus_layers_decreasing_zip1",
+            write(
+                vec![part_with(None, &unnamed_plus, (20, 10), (5, 7), Encoding { line_order: LineOrder::Decreasing, ..encoding(Compression::ZIP1) })],
+                origin,
+            ),
+            true,
+        ),
+        (
+            "layered_decreasing_rle",
+            write(vec![part_with(None, &layered, full, (0, 0), Encoding { line_order: LineOrder::Decreasing, ..encoding(Compression::RLE) })], origin),
+            true,
+        ),
+        ("unnamed_rgb_plus_layers_uncompressed", write(vec![part(None, &unnamed_plus, (20, 10), (-3, 4), Compression::Uncompressed)], origin), true),
+        ("layered_uncompressed", write(vec![part(None, &layered, full, (0, 0), Compression::Uncompressed)], origin), true),
+        (
+            "uint_rgb_zip16",
+            write(
+                vec![part(
+                    None,
+                    &[("R", Kind::Uint), ("G", Kind::Uint), ("B", Kind::Uint), ("A", Kind::Half), ("depth.Z", Kind::Float)],
+                    full,
+                    (0, 0),
+                    Compression::ZIP16,
+                )],
+                origin,
+            ),
+            true,
+        ),
+        (
+            // The image crate shows the part "depth" (the first with R, G and B), whose planes are
+            // filled with the background depth outside its data window: decoded by the image crate.
+            "multipart_depth_named_rgb_zip16",
+            write(
+                vec![
+                    part(Some("depth"), &[("R", Kind::Half), ("G", Kind::Half), ("B", Kind::Half)], (20, 10), (5, 7), Compression::ZIP16),
+                    part(Some("beauty"), &RGBA_HALF, full, (0, 0), Compression::ZIP16),
+                ],
+                origin,
+            ),
+            true,
+        ),
+    ]
+}
+
+/// FNV-1a over 32-bit words.
+fn fnv(words: impl IntoIterator<Item = u32>) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for w in words {
+        for b in w.to_le_bytes() {
+            h ^= u64::from(b);
+            h = h.wrapping_mul(0x0100_0000_01b3);
+        }
+    }
+    h
+}
+
+fn picture_hash(pool: &MediaPool, f: &Footage, float: FloatCurve, size: Option<(u32, u32)>) -> u64 {
+    let img = pool.frame_with(ItemId(1), f, Tick::ZERO, size, float).expect("picture");
+    fnv([img.width, img.height].into_iter().chain(img.data.iter().flat_map(|p| p.map(f32::to_bits))))
+}
+
+fn aux_hash(pool: &MediaPool, f: &Footage) -> u64 {
+    let Some(aux) = pool.aux(ItemId(1), f, Tick::ZERO) else { return 0 };
+    let mut words = vec![aux.width, aux.height, aux.scale.to_bits() as u32];
+    for (name, plane) in &aux.channels {
+        words.extend(name.bytes().map(u32::from));
+        words.extend(plane.iter().map(|v| v.to_bits()));
+    }
+    for (name, objects) in &aux.manifests {
+        words.extend(name.bytes().map(u32::from));
+        for (o, h) in objects {
+            words.extend(o.bytes().map(u32::from));
+            words.push(*h);
+        }
+    }
+    fnv(words)
+}
+
+/// The interpretations a picture is decoded in: (label, footage, curve, size, pinned).
+fn variants(f: &Footage) -> Vec<(String, Footage, FloatCurve, Option<(u32, u32)>, bool)> {
+    let mut out = vec![];
+    for (mode, label) in
+        [(None, "probed"), (Some(AlphaMode::Straight), "straight"), (Some(AlphaMode::Premultiplied), "premul"), (Some(AlphaMode::Ignore), "ignore")]
+    {
+        let mut g = f.clone();
+        if let Some(m) = mode {
+            g.alpha = m;
+        }
+        g.premul_color = [0.2, 0.4, 0.6];
+        out.push((format!("{label}/linear"), g.clone(), FloatCurve::Linear, None, true));
+        out.push((format!("{label}/srgb"), g.clone(), FloatCurve::Srgb, None, false));
+        out.push((format!("{label}/gamma24"), g.clone(), FloatCurve::Gamma24, None, false));
+    }
+    let preserve = Footage { preserve_rgb: true, ..f.clone() };
+    out.push(("preserve_rgb".into(), preserve, FloatCurve::Srgb, None, true));
+    out.push(("half_size/srgb".into(), f.clone(), FloatCurve::Srgb, Some((f.width.div_ceil(2), f.height.div_ceil(2))), false));
+    out
+}
+
+/// Every hash of `file`: the size and alpha import finds, each picture and the channels, decoded
+/// picture first (the footage alone) or channels first (an effect reads them).
+fn hashes(name: &str, bytes: &[u8], aux_first: bool) -> Vec<(String, u64, bool)> {
+    let order = if aux_first { "aux-first" } else { "picture-first" };
+    let path = format!("/exr-golden-474/{order}/{name}.exr");
+    let b: Arc<[u8]> = bytes.into();
+    let pool = MediaPool::new();
+    pool.add_bytes(&path, b.clone());
+    let f = probe_bytes(&path, b).expect("probe");
+    let mut out = vec![("probe".to_string(), fnv([f.width, f.height, f.alpha as u32]), true)];
+    let aux = if aux_first { Some(aux_hash(&pool, &f)) } else { None };
+    for (label, g, float, size, pinned) in variants(&f) {
+        out.push((label, picture_hash(&pool, &g, float, size), pinned));
+    }
+    out.push(("aux".into(), aux.unwrap_or_else(|| aux_hash(&pool, &f)), true));
+    out
+}
+
+/// Hashes taken on main before #474's shared decode (`EXR_GOLDEN_PRINT=1`).
+const PINNED: &[(&str, &str, u64)] = &[
+    ("rgba_half_zip16", "probe", 0x0a32e074a28c1f66),
+    ("rgba_half_zip16", "probed/linear", 0xa84600283dce98f6),
+    ("rgba_half_zip16", "straight/linear", 0xf028e1367a2fbb30),
+    ("rgba_half_zip16", "premul/linear", 0xa84600283dce98f6),
+    ("rgba_half_zip16", "ignore/linear", 0xa90a57f9a67f7468),
+    ("rgba_half_zip16", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("rgba_half_zip16", "aux", 0xdd555e6cf67d75f3),
+    ("rgb_float_piz", "probe", 0x6a38346c4c5662d5),
+    ("rgb_float_piz", "probed/linear", 0xa6e8fbbad371a2ae),
+    ("rgb_float_piz", "straight/linear", 0xa6e8fbbad371a2ae),
+    ("rgb_float_piz", "premul/linear", 0x515f476c176229c9),
+    ("rgb_float_piz", "ignore/linear", 0xa6e8fbbad371a2ae),
+    ("rgb_float_piz", "preserve_rgb", 0xa6e8fbbad371a2ae),
+    ("rgb_float_piz", "aux", 0x554623d237c2e5ef),
+    ("layered_rle", "probe", 0x0a32e074a28c1f66),
+    ("layered_rle", "probed/linear", 0xa84600283dce98f6),
+    ("layered_rle", "straight/linear", 0xf028e1367a2fbb30),
+    ("layered_rle", "premul/linear", 0xa84600283dce98f6),
+    ("layered_rle", "ignore/linear", 0xa90a57f9a67f7468),
+    ("layered_rle", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("layered_rle", "aux", 0xa6b9bd9f02c192ad),
+    ("unnamed_rgb_plus_layers_zip1", "probe", 0x0a32e074a28c1f66),
+    ("unnamed_rgb_plus_layers_zip1", "probed/linear", 0xa84600283dce98f6),
+    ("unnamed_rgb_plus_layers_zip1", "straight/linear", 0xf028e1367a2fbb30),
+    ("unnamed_rgb_plus_layers_zip1", "premul/linear", 0xa84600283dce98f6),
+    ("unnamed_rgb_plus_layers_zip1", "ignore/linear", 0xa90a57f9a67f7468),
+    ("unnamed_rgb_plus_layers_zip1", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("unnamed_rgb_plus_layers_zip1", "aux", 0x27cc9b53d0862db1),
+    ("multipart_zip16", "probe", 0x0a32e074a28c1f66),
+    ("multipart_zip16", "probed/linear", 0xa84600283dce98f6),
+    ("multipart_zip16", "straight/linear", 0xf028e1367a2fbb30),
+    ("multipart_zip16", "premul/linear", 0xa84600283dce98f6),
+    ("multipart_zip16", "ignore/linear", 0xa90a57f9a67f7468),
+    ("multipart_zip16", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("multipart_zip16", "aux", 0x567ad99a6690d03d),
+    ("multipart_diffuse_then_beauty_zip1", "probe", 0x6a38346c4c5662d5),
+    ("multipart_diffuse_then_beauty_zip1", "probed/linear", 0xa90a57f9a67f7468),
+    ("multipart_diffuse_then_beauty_zip1", "straight/linear", 0xa90a57f9a67f7468),
+    ("multipart_diffuse_then_beauty_zip1", "premul/linear", 0x7ab18932e25c5cc8),
+    ("multipart_diffuse_then_beauty_zip1", "ignore/linear", 0xa90a57f9a67f7468),
+    ("multipart_diffuse_then_beauty_zip1", "preserve_rgb", 0xa90a57f9a67f7468),
+    ("multipart_diffuse_then_beauty_zip1", "aux", 0x6724d6dfd56a04cb),
+    ("multipart_blender5_rle", "probe", 0x0a32e074a28c1f66),
+    ("multipart_blender5_rle", "probed/linear", 0xa84600283dce98f6),
+    ("multipart_blender5_rle", "straight/linear", 0xf028e1367a2fbb30),
+    ("multipart_blender5_rle", "premul/linear", 0xa84600283dce98f6),
+    ("multipart_blender5_rle", "ignore/linear", 0xa90a57f9a67f7468),
+    ("multipart_blender5_rle", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("multipart_blender5_rle", "aux", 0x522ae4819dd92e89),
+    ("unnamed_rgb_window_smaller_zip16", "probe", 0x0a32e074a28c1f66),
+    ("unnamed_rgb_window_smaller_zip16", "probed/linear", 0x19eb3b1a88d108a7),
+    ("unnamed_rgb_window_smaller_zip16", "straight/linear", 0x2c73f9acaa936420),
+    ("unnamed_rgb_window_smaller_zip16", "premul/linear", 0x19eb3b1a88d108a7),
+    ("unnamed_rgb_window_smaller_zip16", "ignore/linear", 0x3b86057d18a16bf0),
+    ("unnamed_rgb_window_smaller_zip16", "preserve_rgb", 0x5b999014e4a64bb2),
+    ("unnamed_rgb_window_smaller_zip16", "aux", 0x8f78d3233450acf3),
+    ("rgb_float_window_larger_piz", "probe", 0x6a38346c4c5662d5),
+    ("rgb_float_window_larger_piz", "probed/linear", 0x8e3847d48f9967a6),
+    ("rgb_float_window_larger_piz", "straight/linear", 0x8e3847d48f9967a6),
+    ("rgb_float_window_larger_piz", "premul/linear", 0x0998eefc456dcdc9),
+    ("rgb_float_window_larger_piz", "ignore/linear", 0x8e3847d48f9967a6),
+    ("rgb_float_window_larger_piz", "preserve_rgb", 0x8e3847d48f9967a6),
+    ("rgb_float_window_larger_piz", "aux", 0x7ccc9f86e6ff6140),
+    ("layered_window_smaller_zip16", "probe", 0x0a32e074a28c1f66),
+    ("layered_window_smaller_zip16", "probed/linear", 0x19eb3b1a88d108a7),
+    ("layered_window_smaller_zip16", "straight/linear", 0x2c73f9acaa936420),
+    ("layered_window_smaller_zip16", "premul/linear", 0x19eb3b1a88d108a7),
+    ("layered_window_smaller_zip16", "ignore/linear", 0x3b86057d18a16bf0),
+    ("layered_window_smaller_zip16", "preserve_rgb", 0x5b999014e4a64bb2),
+    ("layered_window_smaller_zip16", "aux", 0x443480a1d789e63c),
+    ("layered_window_larger_piz", "probe", 0x0a32e074a28c1f66),
+    ("layered_window_larger_piz", "probed/linear", 0x443afe4029748836),
+    ("layered_window_larger_piz", "straight/linear", 0xb32b44880f746826),
+    ("layered_window_larger_piz", "premul/linear", 0x443afe4029748836),
+    ("layered_window_larger_piz", "ignore/linear", 0xaa01706accce2cc4),
+    ("layered_window_larger_piz", "preserve_rgb", 0xb2cbb40b10bc56b4),
+    ("layered_window_larger_piz", "aux", 0xb7d91c8eea56a772),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "probe", 0x0a32e074a28c1f66),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "probed/linear", 0x7612f20634fe957e),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "straight/linear", 0xaa5f42cb6a31c78a),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "premul/linear", 0x7612f20634fe957e),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "ignore/linear", 0xbbf236635dcaac90),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "preserve_rgb", 0x15b555a243d79613),
+    ("unnamed_rgb_plus_layers_tiled_zip16", "aux", 0x3d1439eed2202e41),
+    ("layered_tiled_rle", "probe", 0x0a32e074a28c1f66),
+    ("layered_tiled_rle", "probed/linear", 0xa84600283dce98f6),
+    ("layered_tiled_rle", "straight/linear", 0xf028e1367a2fbb30),
+    ("layered_tiled_rle", "premul/linear", 0xa84600283dce98f6),
+    ("layered_tiled_rle", "ignore/linear", 0xa90a57f9a67f7468),
+    ("layered_tiled_rle", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("layered_tiled_rle", "aux", 0xa6b9bd9f02c192ad),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "probe", 0x0a32e074a28c1f66),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "probed/linear", 0xa84600283dce98f6),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "straight/linear", 0xf028e1367a2fbb30),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "premul/linear", 0xa84600283dce98f6),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "ignore/linear", 0xa90a57f9a67f7468),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("unnamed_rgb_plus_layers_mipmapped_zip16", "aux", 0x27cc9b53d0862db1),
+    ("layered_mipmapped_piz", "probe", 0x0a32e074a28c1f66),
+    ("layered_mipmapped_piz", "probed/linear", 0xa84600283dce98f6),
+    ("layered_mipmapped_piz", "straight/linear", 0xf028e1367a2fbb30),
+    ("layered_mipmapped_piz", "premul/linear", 0xa84600283dce98f6),
+    ("layered_mipmapped_piz", "ignore/linear", 0xa90a57f9a67f7468),
+    ("layered_mipmapped_piz", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("layered_mipmapped_piz", "aux", 0xa6b9bd9f02c192ad),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "probe", 0x0a32e074a28c1f66),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "probed/linear", 0x19eb3b1a88d108a7),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "straight/linear", 0x2c73f9acaa936420),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "premul/linear", 0x19eb3b1a88d108a7),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "ignore/linear", 0x3b86057d18a16bf0),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "preserve_rgb", 0x5b999014e4a64bb2),
+    ("unnamed_rgb_plus_layers_decreasing_zip1", "aux", 0x8f78d3233450acf3),
+    ("layered_decreasing_rle", "probe", 0x0a32e074a28c1f66),
+    ("layered_decreasing_rle", "probed/linear", 0xa84600283dce98f6),
+    ("layered_decreasing_rle", "straight/linear", 0xf028e1367a2fbb30),
+    ("layered_decreasing_rle", "premul/linear", 0xa84600283dce98f6),
+    ("layered_decreasing_rle", "ignore/linear", 0xa90a57f9a67f7468),
+    ("layered_decreasing_rle", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("layered_decreasing_rle", "aux", 0xa6b9bd9f02c192ad),
+    ("unnamed_rgb_plus_layers_uncompressed", "probe", 0x0a32e074a28c1f66),
+    ("unnamed_rgb_plus_layers_uncompressed", "probed/linear", 0xa27668bf31d9426b),
+    ("unnamed_rgb_plus_layers_uncompressed", "straight/linear", 0xfc73fe89457ce029),
+    ("unnamed_rgb_plus_layers_uncompressed", "premul/linear", 0xa27668bf31d9426b),
+    ("unnamed_rgb_plus_layers_uncompressed", "ignore/linear", 0xb3276cc5126776d4),
+    ("unnamed_rgb_plus_layers_uncompressed", "preserve_rgb", 0xdee1105fa6e6822a),
+    ("unnamed_rgb_plus_layers_uncompressed", "aux", 0x854a5e84e7aaa5c2),
+    ("layered_uncompressed", "probe", 0x0a32e074a28c1f66),
+    ("layered_uncompressed", "probed/linear", 0xa84600283dce98f6),
+    ("layered_uncompressed", "straight/linear", 0xf028e1367a2fbb30),
+    ("layered_uncompressed", "premul/linear", 0xa84600283dce98f6),
+    ("layered_uncompressed", "ignore/linear", 0xa90a57f9a67f7468),
+    ("layered_uncompressed", "preserve_rgb", 0xc8e0050f5efe75b7),
+    ("layered_uncompressed", "aux", 0xa6b9bd9f02c192ad),
+    ("uint_rgb_zip16", "probe", 0x0a32e074a28c1f66),
+    ("uint_rgb_zip16", "probed/linear", 0xed89310ef0cdb9fd),
+    ("uint_rgb_zip16", "straight/linear", 0xf9fe11ab8ed97cc8),
+    ("uint_rgb_zip16", "premul/linear", 0xed89310ef0cdb9fd),
+    ("uint_rgb_zip16", "ignore/linear", 0xf78cd263c0d74f12),
+    ("uint_rgb_zip16", "preserve_rgb", 0x2a19d67b07cf4359),
+    ("uint_rgb_zip16", "aux", 0x03e42411f8521856),
+    ("multipart_depth_named_rgb_zip16", "probe", 0x6a38346c4c5662d5),
+    ("multipart_depth_named_rgb_zip16", "probed/linear", 0x3b86057d18a16bf0),
+    ("multipart_depth_named_rgb_zip16", "straight/linear", 0x3b86057d18a16bf0),
+    ("multipart_depth_named_rgb_zip16", "premul/linear", 0x869374e9b0384cea),
+    ("multipart_depth_named_rgb_zip16", "ignore/linear", 0x3b86057d18a16bf0),
+    ("multipart_depth_named_rgb_zip16", "preserve_rgb", 0x3b86057d18a16bf0),
+    ("multipart_depth_named_rgb_zip16", "aux", 0x0fa56884e83b4417),
+];
+
+#[test]
+fn exr_pictures_and_channels_are_bit_identical() {
+    let print = std::env::var_os("EXR_GOLDEN_PRINT").is_some();
+    let mut failures = vec![];
+    for (name, bytes, pinned_file) in files() {
+        let first = hashes(name, &bytes, false);
+        let second = hashes(name, &bytes, true);
+        for ((label, h, pinned), (_, h2, _)) in first.iter().zip(&second) {
+            if h != h2 {
+                failures.push(format!("{name} {label}: picture first {h:#018x}, channels first {h2:#018x}"));
+            }
+            if print {
+                println!("    (\"{name}\", \"{label}\", {h:#018x}),{}", if *pinned && pinned_file { "" } else { " // not pinned" });
+                continue;
+            }
+            if !(*pinned && pinned_file) {
+                continue;
+            }
+            match PINNED.iter().find(|(n, l, _)| *n == name && l == label) {
+                Some((_, _, want)) if want == h => {}
+                Some((_, _, want)) => failures.push(format!("{name} {label}: {h:#018x}, pinned {want:#018x}")),
+                None => failures.push(format!("{name} {label}: {h:#018x} is not pinned")),
+            }
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
diff --git a/crates/media/tests/it/file_timecode.rs b/crates/media/tests/it/file_timecode.rs
new file mode 100644
index 000000000..e5cbfa92d
--- /dev/null
+++ b/crates/media/tests/it/file_timecode.rs
@@ -0,0 +1,38 @@
+//! The start timecode a movie records is read into its footage (`Footage::file_timecode`).
+
+use std::io::Cursor;
+
+use effectcraft_project::FootageKind;
+use filmcraft_isobmff::{Brand, Mp4Writer, SampleEntry, TimecodeConfig, TrackConfig, WriteSample, WriterOptions};
+
+/// A two-frame 24 fps Motion JPEG MOV, with a timecode track from `start_frame` when given.
+fn mov(start_frame: Option<u32>) -> Vec<u8> {
+    let mut jpeg = Vec::new();
+    image::RgbImage::from_pixel(16, 16, image::Rgb([200, 40, 90])).write_to(&mut Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).expect("jpeg");
+    let mut w = Mp4Writer::new(Cursor::new(Vec::new()), WriterOptions::new(Brand::Mov)).expect("writer");
+    let v = w.add_track(TrackConfig::new(SampleEntry::jpeg(16, 16), 24)).expect("video track");
+    if let Some(start) = start_frame {
+        let tc = TimecodeConfig { timescale: 24, frame_duration: 1, frames_per_second: 24, ..Default::default() };
+        w.add_timecode_track(v, tc, start).expect("timecode track");
+    }
+    for _ in 0..2 {
+        w.write_sample(v, WriteSample { data: &jpeg, duration: 1, composition_offset: 0, is_sync: true }).expect("frame");
+    }
+    w.finish().expect("finish").into_inner()
+}
+
+#[test]
+fn a_movies_start_timecode_is_read() {
+    let dir = std::env::temp_dir().join(format!("effectcraft-file-timecode-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).expect("mkdir");
+    // 10:00:00:00 at 24 fps, and a movie with no timecode
+    for (name, start) in [("tc.mov", Some(10 * 3600 * 24)), ("none.mov", None)] {
+        let p = dir.join(name);
+        std::fs::write(&p, mov(start)).expect("write");
+        let f = effectcraft_media::probe(&p).expect("probe");
+        assert_eq!(f.kind, FootageKind::Video, "{name}");
+        assert_eq!(f.file_timecode, start.map(i64::from), "{name}");
+        assert_eq!(f.start_timecode, None, "{name}: Interpret Footage still uses the source file timecode");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/media/tests/footage.rs b/crates/media/tests/it/footage.rs
similarity index 78%
rename from crates/media/tests/footage.rs
rename to crates/media/tests/it/footage.rs
index 13ca605e2..7f0de6ae4 100644
--- a/crates/media/tests/footage.rs
+++ b/crates/media/tests/it/footage.rs
@@ -24,9 +24,40 @@ fn have_ffmpeg() -> bool {
     *HAVE.get_or_init(|| Command::new("ffmpeg").arg("-version").output().is_ok_and(|o| o.status.success()))
 }
 
+/// An H.264 encoder this ffmpeg build actually ships, or `None` when it has none. Distro "free"
+/// builds often omit `libx264` (the one named historically here) but ship an alternative, so pick
+/// the first present by name rather than hard-coding one that may be absent. These tests only
+/// need *an* H.264 encoder to make an oracle fixture; the encoder identity is irrelevant.
+fn h264_encoder() -> Option<&'static str> {
+    static ENC: std::sync::OnceLock<Option<&'static str>> = std::sync::OnceLock::new();
+    *ENC.get_or_init(|| {
+        let out = Command::new("ffmpeg").args(["-hide_banner", "-encoders"]).output().ok()?;
+        if !out.status.success() {
+            return None;
+        }
+        let text = String::from_utf8_lossy(&out.stdout);
+        ["libx264", "libopenh264", "h264_nvenc", "h264_vaapi", "h264_qsv", "h264_v4l2m2m", "h264_amf"]
+            .into_iter()
+            .find(|name| text.lines().any(|l| l.split_whitespace().any(|tok| tok == *name)))
+    })
+}
+
 /// Run ffmpeg to produce `name` (once; written to a temp name and renamed so concurrent test
 /// processes never see a partial file). `None` when ffmpeg is unavailable.
 fn ffmpeg_fixture(name: &str, args: &[&str]) -> Option<PathBuf> {
+    ffmpeg_fixture_inner(name, args, true)
+}
+
+/// Like [`ffmpeg_fixture`] for a fixture this build of ffmpeg may fail to make: an encoder found
+/// in the `-encoders` listing can still not run here (the hardware backends need their device,
+/// Fedora's `libopenh264` is the `noopenh264` stub), and fixtures built from one, like
+/// [`h264_mp4`], should skip with a note rather than fail on the packager's choice of ffmpeg —
+/// the same way every test here skips when ffmpeg is missing altogether.
+fn try_ffmpeg_fixture(name: &str, args: &[&str]) -> Option<PathBuf> {
+    ffmpeg_fixture_inner(name, args, false)
+}
+
+fn ffmpeg_fixture_inner(name: &str, args: &[&str], must_succeed: bool) -> Option<PathBuf> {
     if !have_ffmpeg() {
         eprintln!("ffmpeg not found: skipping");
         return None;
@@ -39,44 +70,51 @@ fn ffmpeg_fixture(name: &str, args: &[&str]) -> Option<PathBuf> {
     let ext = out.extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
     let tmp = out.with_file_name(format!("tmp-{}-{:?}.{ext}", std::process::id(), std::thread::current().id()).replace(['(', ')'], ""));
     let st = Command::new("ffmpeg").args(["-hide_banner", "-loglevel", "error", "-y"]).args(args).arg(&tmp).status().expect("run ffmpeg");
-    assert!(st.success(), "ffmpeg failed for {name}");
-    std::fs::rename(&tmp, &out).expect("rename");
+    if !st.success() {
+        let _ = std::fs::remove_file(&tmp);
+        if must_succeed {
+            panic!("ffmpeg failed for {name}");
+        }
+        eprintln!("this ffmpeg build cannot make {name}: skipping");
+        return None;
+    }
+    if std::fs::rename(&tmp, &out).is_err() {
+        // Another test made it first; on Windows the rename fails while that test has it open.
+        let _ = std::fs::remove_file(&tmp);
+        assert!(out.exists(), "rename {} to {name} failed", tmp.display());
+    }
     Some(out)
 }
 
+/// Video options the chosen H.264 encoder actually accepts. `libx264` keeps its constant-quality
+/// `-preset`/`-crf` pair; `libopenh264` rejects both (it takes a bitrate), and the hardware
+/// backends take a bitrate too — without this, a build whose picked encoder is not libx264 failed
+/// the fixture and silently skipped every check gated on it.
+fn h264_video_options(enc: &str) -> Vec<&'static str> {
+    if enc == "libx264" { vec!["-preset", "medium", "-crf", "18"] } else { vec!["-b:v", "2M"] }
+}
+
 fn h264_mp4() -> Option<PathBuf> {
-    ffmpeg_fixture(
-        "testsrc2_1080p.mp4",
-        &[
-            "-f",
-            "lavfi",
-            "-i",
-            "testsrc2=size=1920x1080:rate=30:duration=2",
-            "-f",
-            "lavfi",
-            "-i",
-            "sine=frequency=440:sample_rate=48000:duration=2",
-            "-c:v",
-            "libx264",
-            "-pix_fmt",
-            "yuv420p",
-            "-preset",
-            "medium",
-            "-crf",
-            "18",
-            "-colorspace",
-            "bt709",
-            "-color_primaries",
-            "bt709",
-            "-color_trc",
-            "bt709",
-            "-c:a",
-            "aac",
-            "-ac",
-            "2",
-            "-shortest",
-        ],
-    )
+    // Made with whatever encoder this build has listed: a listed encoder can still fail at run
+    // time (the hardware ones without their device), so this may skip rather than fail.
+    let enc = h264_encoder()?;
+    let mut args: Vec<&'static str> = vec![
+        "-f",
+        "lavfi",
+        "-i",
+        "testsrc2=size=1920x1080:rate=30:duration=2",
+        "-f",
+        "lavfi",
+        "-i",
+        "sine=frequency=440:sample_rate=48000:duration=2",
+        "-c:v",
+        enc,
+        "-pix_fmt",
+        "yuv420p",
+    ];
+    args.extend(h264_video_options(enc));
+    args.extend(["-colorspace", "bt709", "-color_primaries", "bt709", "-color_trc", "bt709", "-c:a", "aac", "-ac", "2", "-shortest"]);
+    try_ffmpeg_fixture("testsrc2_1080p.mp4", &args)
 }
 
 fn prores_mov() -> Option<PathBuf> {
@@ -168,9 +206,14 @@ fn tone_wav() -> Option<PathBuf> {
 
 /// Frame `n` of `src` as RGBA PNG extracted by ffmpeg (Y'CbCr → RGB with the BT.709 matrix).
 fn reference_frame(src: &Path, n: usize) -> Image {
+    reference_frame_in(src, n, "bt709")
+}
+
+/// [`reference_frame`] of a movie whose Y'CbCr is in `matrix` (`bt601` for Motion JPEG).
+fn reference_frame_in(src: &Path, n: usize, matrix: &str) -> Image {
     let stem = src.file_stem().expect("stem").to_string_lossy().to_string();
     let name = format!("ref_{stem}_{n}.png");
-    let vf = format!("select='eq(n\\,{n})',scale=in_color_matrix=bt709:in_range=auto:out_range=pc:flags=bilinear+accurate_rnd+full_chroma_int,format=rgba");
+    let vf = format!("select='eq(n\\,{n})',scale=in_color_matrix={matrix}:in_range=auto:out_range=pc:flags=bilinear+accurate_rnd+full_chroma_int,format=rgba");
     let p = ffmpeg_fixture(&name, &["-i", src.to_str().expect("utf8"), "-vf", &vf, "-fps_mode", "passthrough", "-frames:v", "1"]).expect("ffmpeg");
     load_png(&p)
 }
@@ -277,7 +320,10 @@ fn h264_audio_samples() {
 /// H.264 + AAC at 44.1 kHz in MP4 (ffmpeg writes an edit list that skips the AAC priming):
 /// 440 Hz left, a 200 → 1000 Hz sweep right, 29.97 fps.
 fn aac_44k_mp4() -> Option<PathBuf> {
-    ffmpeg_fixture(
+    // Made with whatever encoder this build has listed: a listed encoder can still fail at run
+    // time (the hardware ones without their device), so this may skip rather than fail.
+    let enc = h264_encoder()?;
+    try_ffmpeg_fixture(
         "aac_44k.mp4",
         &[
             "-f",
@@ -289,7 +335,7 @@ fn aac_44k_mp4() -> Option<PathBuf> {
             "-i",
             "aevalsrc=0.5*sin(2*PI*440*t)|0.5*sin(2*PI*(200+400*t/3)*t):s=44100:d=3",
             "-c:v",
-            "libx264",
+            enc,
             "-pix_fmt",
             "yuv420p",
             "-c:a",
@@ -472,12 +518,12 @@ fn dnxhd_mxf() -> Option<PathBuf> {
     )
 }
 
-/// MXF is importable footage (After Effects imports it), whatever the extension's case.
+/// MXF and AVI are importable footage (After Effects imports them), whatever the extension's case.
 #[test]
-fn mxf_is_importable() {
-    assert!(effectcraft_media::is_importable(Path::new("/media/A001C003.mxf")));
-    assert!(effectcraft_media::is_importable(Path::new("/media/A001C003.MXF")));
-    assert!(!effectcraft_media::is_importable(Path::new("/media/A001C003.avi")), "no AVI demuxer yet");
+fn mxf_and_avi_are_importable() {
+    for name in ["A001C003.mxf", "A001C003.MXF", "capture.avi", "CAPTURE.AVI"] {
+        assert!(effectcraft_media::is_importable(&Path::new("/media").join(name)), "{name}");
+    }
 }
 
 #[test]
@@ -523,6 +569,124 @@ fn mxf_dnxhd_frames() {
     }
 }
 
+fn mjpeg_avi() -> Option<PathBuf> {
+    ffmpeg_fixture(
+        "testsrc2_mjpeg_pcm.avi",
+        &[
+            "-f",
+            "lavfi",
+            "-i",
+            "testsrc2=size=640x360:rate=25:duration=2",
+            "-f",
+            "lavfi",
+            "-i",
+            "sine=frequency=440:sample_rate=48000:duration=2",
+            "-c:v",
+            "mjpeg",
+            "-q:v",
+            "2",
+            "-pix_fmt",
+            "yuvj420p",
+            "-c:a",
+            "pcm_s16le",
+            "-ac",
+            "2",
+        ],
+    )
+}
+
+#[test]
+fn avi_mjpeg_with_pcm_audio() {
+    let Some(p) = mjpeg_avi() else { return };
+    let f = probe(&p).expect("probe");
+    assert_eq!(f.kind, FootageKind::Video);
+    assert_eq!((f.width, f.height), (640, 360));
+    assert_eq!(f.frame_rate, FrameRate::FPS_25);
+    assert!((f.duration.seconds() - 2.0).abs() < 0.1, "duration {:?}", f.duration.seconds());
+    assert!(f.has_video && f.has_audio);
+    assert_eq!(f.codec, "Motion JPEG");
+    let pool = MediaPool::new();
+    for n in [0usize, 1, 30, 7, 49] {
+        let img = pool.frame_at(&f, t_of(f.frame_rate, n as i64)).expect("frame");
+        let db = psnr(&img, &reference_frame_in(&p, n, "bt601"));
+        assert!(db > 35.0, "frame {n}: {db:.2} dB");
+    }
+    let s = pool.audio_samples(&f, Tick(TICKS_PER_SECOND / 2), 4800, 48_000);
+    assert_eq!(s.len(), 9600);
+    let rms = (s.iter().map(|v| v * v).sum::<f32>() / s.len() as f32).sqrt();
+    assert!((rms - 0.0625).abs() < 0.01, "rms {rms}");
+}
+
+/// An AVI whose video FilmCraft can't decode imports, and says why it shows no picture (as an
+/// unsupported stream in any other container does), rather than failing as a broken file.
+#[test]
+fn avi_with_an_unsupported_codec_says_so() {
+    let Some(p) = ffmpeg_fixture("testsrc2_xvid.avi", &["-f", "lavfi", "-i", "testsrc2=size=320x180:rate=25:duration=1", "-c:v", "mpeg4", "-vtag", "XVID"])
+    else {
+        return;
+    };
+    let f = probe(&p).expect("a valid AVI imports");
+    assert_eq!((f.kind, f.width, f.height), (FootageKind::Video, 320, 180));
+    let pool = MediaPool::new();
+    if pool.frame(ItemId(1), &f, Tick::ZERO).is_some() {
+        // FilmCraft decodes MPEG-4 Part 2 now: nothing to report
+        assert_eq!(pool.problem(&f), None);
+        return;
+    }
+    let why = pool.problem(&f).expect("a failed frame leaves a reason");
+    assert!(why.contains("MPEG-4 Part 2") && why.contains("isn't supported"), "{why}");
+}
+
+/// A file that only looks like an AVI is an import error that says so.
+#[test]
+fn an_invalid_avi_is_an_import_error() {
+    let e = probe_bytes("broken.avi", Arc::from(&b"RIFF\x10\0\0\0AVI LIST\0\0\0\0garbage"[..])).expect_err("not an AVI");
+    assert!(e.to_string().contains("invalid AVI"), "{e}");
+}
+
+/// A damaged AVI imports: a truncated recording as far as it goes, and a packet that doesn't
+/// decode loses its own frame only, with a reason that says the file is damaged rather than
+/// unsupported.
+#[test]
+fn a_damaged_avi_loses_only_what_is_damaged() {
+    let Some(p) = mjpeg_avi() else { return };
+    let bytes = std::fs::read(&p).expect("read");
+    let full = probe(&p).expect("probe");
+    let pool = MediaPool::new();
+
+    let cut: Arc<[u8]> = bytes[..bytes.len() / 3].into();
+    let f = probe_bytes("cut.avi", cut.clone()).expect("a truncated AVI imports");
+    assert!(f.duration > Tick::ZERO && f.duration < full.duration, "{:?} of {:?}", f.duration, full.duration);
+    pool.add_bytes("cut.avi", cut);
+    let last = f.frame_rate.frame_at(f.duration - Tick(1));
+    assert!(pool.frame(ItemId(1), &f, t_of(f.frame_rate, last)).is_some(), "its last frame");
+
+    // Garble the JPEG data of the video chunk of frame 10.
+    let mut bad = bytes.clone();
+    let mut at = bad.windows(4).position(|w| w == b"movi").expect("movi") + 4;
+    let mut video = 0;
+    while let Some(head) = bad.get(at..at + 8) {
+        let size = u32::from_le_bytes([head[4], head[5], head[6], head[7]]) as usize;
+        if &head[2..4] == b"dc" {
+            if video == 10 {
+                bad[at + 8 + 200..at + 8 + size.min(3000)].iter_mut().enumerate().for_each(|(i, b)| *b = if i % 7 == 0 { 0xFF } else { 0 });
+                break;
+            }
+            video += 1;
+        }
+        at += 8 + size + size % 2;
+    }
+    assert_eq!(video, 10, "found frame 10's chunk");
+    let f = probe_bytes("bad.avi", bad.clone().into()).expect("a damaged AVI imports");
+    pool.add_bytes("bad.avi", bad.into());
+    assert!(pool.frame(ItemId(2), &f, t_of(f.frame_rate, 10)).is_none(), "the damaged frame");
+    for n in [9, 11, 30] {
+        assert!(pool.frame(ItemId(2), &f, t_of(f.frame_rate, n)).is_some(), "frame {n}");
+    }
+    let why = pool.problem(&f).expect("a failed frame leaves a reason");
+    assert!(why.contains("can't be decoded") && !why.contains("isn't supported"), "{why}");
+}
+
 #[test]
 fn png_sequence_import() {
     let Some(first) = png_sequence() else { return };
@@ -546,10 +710,11 @@ fn png_sequence_import() {
     assert_eq!(*img, load_png(&first.with_file_name("seq_0004.png")));
 }
 
-/// A gap in a sequence's numbering shows colour bars, as in After Effects; in Force
-/// Alphabetical Order the files play back to back (#297).
+/// A gap in a sequence's numbering holds the previous frame, as After Effects 2026 does (files
+/// 1, 2, 4, 5 show frame 2 at frame 3); in Force Alphabetical Order the files play back to back
+/// (#297).
 #[test]
-fn sequence_gaps_show_placeholders() {
+fn sequence_gaps_hold_the_previous_frame() {
     let dir = fixtures().join(format!("gap-seq-{}", std::process::id()));
     std::fs::create_dir_all(&dir).expect("mkdir");
     // Frames 1, 2 and 4: frame 3 is missing. Each frame is a flat grey of its number.
@@ -567,11 +732,8 @@ fn sequence_gaps_show_placeholders() {
     let at = |f: &Footage, n: i64| pool.frame_at(f, t_of(f.frame_rate, n)).expect("frame");
     let level = |img: &Image| (img.get(0, 0)[0] * 255.0).round() as u32;
     assert_eq!(level(&at(&f, 1)), 100);
-    // The placeholder: colour bars across the frame, starting with 75 % white.
-    let bars = at(&f, 2);
-    assert_eq!((bars.width, bars.height), (8, 4));
-    assert_eq!(bars.get(0, 0), [0.75, 0.75, 0.75, 1.0]);
-    assert_eq!(bars.get(7, 3), [0.0, 0.0, 0.75, 1.0], "blue on the right");
+    // The gap holds frame 2.
+    assert_eq!(level(&at(&f, 2)), 100);
     assert_eq!(level(&at(&f, 3)), 200);
     f.alphabetical = true;
     f.sync_sequence_duration();
@@ -580,6 +742,46 @@ fn sequence_gaps_show_placeholders() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// #1812: a still asked for at a reduced size comes back as the renderer would resample it, and
+/// is kept at that size: later frames at that size neither decode nor resample it again (a
+/// parallax project's 21120-px plates were decoded and resampled for every frame at Quarter).
+#[test]
+fn stills_at_reduced_sizes_are_resampled_once() {
+    let dir = std::env::temp_dir().join(format!("ec-still-size-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).expect("temp dir");
+    let p = dir.join("plate.png");
+    let px = |x: u32, y: u32| {
+        image::Rgba([(x * 7 % 256) as u8, (y * 13 % 256) as u8, ((x ^ y) % 256) as u8, if (x + y).is_multiple_of(5) { 0 } else { 255 - (x % 128) as u8 }])
+    };
+    image::RgbaImage::from_fn(613, 97, px).save(&p).expect("png");
+    let f = probe(&p).expect("probe");
+    let pool = MediaPool::new();
+    let full = pool.frame(ItemId(1), &f, Tick::ZERO).expect("frame");
+    // At its own size it is the unsized frame: no second decode, no second full-size copy.
+    let misses = pool.stats().misses;
+    let native = pool.frame_at_size(ItemId(1), &f, Tick::ZERO, f.width, f.height).expect("frame");
+    assert!(Arc::ptr_eq(&full, &native), "the native size reuses the unsized frame");
+    assert_eq!(pool.stats().misses, misses);
+    for (w, h) in [(306, 48), (153, 24), (77, 12)] {
+        let sized = pool.frame_at_size(ItemId(1), &f, Tick::ZERO, w, h).expect("frame");
+        assert_eq!(*sized, effectcraft_raster::resample(&full, w, h), "{w}×{h}: the renderer's resample");
+        let misses = pool.stats().misses;
+        let again = pool.frame_at_size(ItemId(1), &f, Tick(3 * TICKS_PER_SECOND), w, h).expect("frame");
+        assert!(Arc::ptr_eq(&sized, &again), "{w}×{h}: kept at that size");
+        assert_eq!(pool.stats().misses, misses, "{w}×{h}: not decoded again");
+    }
+    // Pixels larger than the nominal size (a smart object's) are resampled as the renderer does;
+    // smaller ones are left as they are (the renderer scales the layer up instead).
+    // One pool, one file, one requested size: the two decisions don't share a cache entry.
+    let larger = Footage { width: 306, height: 48, ..f.clone() };
+    let smaller = Footage { width: 1226, height: 194, ..f.clone() };
+    let sized = pool.frame_at_size(ItemId(2), &larger, Tick::ZERO, 153, 24).expect("frame");
+    assert_eq!(*sized, effectcraft_raster::resample(&full, 153, 24));
+    let kept = pool.frame_at_size(ItemId(3), &smaller, Tick::ZERO, 153, 24).expect("frame");
+    assert_eq!(*kept, *full);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[test]
 fn png_with_alpha() {
     let Some(p) = alpha_png() else { return };
@@ -833,8 +1035,8 @@ fn flac_audio_of_any_shape_reads_in_device_blocks() {
         }
         // ffmpeg's sine source has an amplitude of 1/8 (mono is duplicated). The fixture carries
         // channels 0 and 1 at full level and the others at half, so a multichannel file sounds as
-        // its stereo downmix (tests/downmix.rs checks that matrix channel by channel).
-        let gains = effectcraft_media::downmix::stereo_gains(channels as usize, false);
+        // its stereo downmix (tests/it/downmix.rs checks that matrix channel by channel).
+        let gains = effectcraft_media::downmix::stereo_gains(channels as usize);
         let side = |s: usize| gains.iter().enumerate().map(|(c, g)| f64::from(g[s]) * if c < 2 { 1.0 } else { 0.5 }).sum::<f64>();
         let want = 0.125 * ((side(0).powi(2) + side(1).powi(2)) / 2.0).sqrt() / 2f64.sqrt();
         let rms = (sum / n.max(1) as f64).sqrt();
@@ -1054,7 +1256,7 @@ fn a_called_off_read_does_not_decode() {
 /// footage reports it (not a black frame without a word).
 #[test]
 fn an_unsupported_stream_reports_why_it_shows_no_picture() {
-    let Some(p) = ffmpeg_fixture(
+    let Some(p) = try_ffmpeg_fixture(
         "h264_high422_10bit.mp4",
         &["-f", "lavfi", "-i", "testsrc=size=320x180:rate=24:duration=1", "-c:v", "libx264", "-profile:v", "high422", "-pix_fmt", "yuv422p10le"],
     ) else {
@@ -1078,3 +1280,13 @@ fn an_unsupported_stream_reports_why_it_shows_no_picture() {
     pool.forget(&f.path);
     assert_eq!(pool.problem(&f), None);
 }
+
+#[test]
+fn the_h264_fixture_options_fit_the_picked_encoder() {
+    assert_eq!(h264_video_options("libx264"), ["-preset", "medium", "-crf", "18"]);
+    for enc in ["libopenh264", "h264_nvenc", "h264_vaapi", "h264_qsv"] {
+        let options = h264_video_options(enc);
+        assert!(!options.iter().any(|o| *o == "-preset" || *o == "-crf"), "{enc} rejects preset/crf: {options:?}");
+        assert!(options.contains(&"-b:v"), "{enc} gets a bitrate: {options:?}");
+    }
+}
diff --git a/crates/media/tests/it/main.rs b/crates/media/tests/it/main.rs
new file mode 100644
index 000000000..efa69b5a6
--- /dev/null
+++ b/crates/media/tests/it/main.rs
@@ -0,0 +1,10 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod aac_layout;
+mod downmix;
+mod exif_orientation;
+mod exr_golden;
+mod file_timecode;
+mod footage;
+mod open_in_place;
+mod tga;
diff --git a/crates/media/tests/open_in_place.rs b/crates/media/tests/it/open_in_place.rs
similarity index 64%
rename from crates/media/tests/open_in_place.rs
rename to crates/media/tests/it/open_in_place.rs
index 78b0abcbc..2cf314d03 100644
--- a/crates/media/tests/open_in_place.rs
+++ b/crates/media/tests/it/open_in_place.rs
@@ -19,8 +19,26 @@ fn fixtures() -> PathBuf {
     Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/fixtures/media")
 }
 
+/// An H.264 encoder this ffmpeg build actually ships, or `None` when it has none (see the same
+/// helper in `footage.rs`: distro "free" builds often omit `libx264` and ship an alternative).
+fn h264_encoder() -> Option<&'static str> {
+    static ENC: std::sync::OnceLock<Option<&'static str>> = std::sync::OnceLock::new();
+    *ENC.get_or_init(|| {
+        let out = Command::new("ffmpeg").args(["-hide_banner", "-encoders"]).output().ok()?;
+        if !out.status.success() {
+            return None;
+        }
+        let text = String::from_utf8_lossy(&out.stdout);
+        ["libx264", "libopenh264", "h264_nvenc", "h264_vaapi", "h264_qsv", "h264_v4l2m2m", "h264_amf"]
+            .into_iter()
+            .find(|name| text.lines().any(|l| l.split_whitespace().any(|tok| tok == *name)))
+    })
+}
+
 /// A 2 s 320×240 H.264 + AAC movie (written to a temp name and renamed, so concurrent test
-/// processes never see a partial file). `None` without ffmpeg.
+/// processes never see a partial file). `None` without ffmpeg, or when this build cannot encode
+/// H.264 at all — the test only measures how a movie is read, so it skips rather than asserting
+/// on the packager's choice of ffmpeg.
 fn small_mp4() -> Option<PathBuf> {
     let out = fixtures().join("in_place_small.mp4");
     if out.exists() {
@@ -29,16 +47,21 @@ fn small_mp4() -> Option<PathBuf> {
     if !Command::new("ffmpeg").arg("-version").output().is_ok_and(|o| o.status.success()) {
         return None;
     }
+    let enc = h264_encoder()?;
     std::fs::create_dir_all(fixtures()).unwrap();
     let tmp = fixtures().join(format!("in_place_tmp_{}.mp4", std::process::id()));
     let st = Command::new("ffmpeg")
         .args(["-hide_banner", "-loglevel", "error", "-y", "-f", "lavfi", "-i", "testsrc2=size=320x240:rate=30:duration=2"])
         .args(["-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000:duration=2"])
-        .args(["-c:v", "libx264", "-pix_fmt", "yuv420p", "-c:a", "aac", "-shortest"])
+        .args(["-c:v", enc, "-pix_fmt", "yuv420p", "-c:a", "aac", "-shortest"])
         .arg(&tmp)
         .status()
         .unwrap();
-    assert!(st.success(), "ffmpeg failed");
+    if !st.success() {
+        let _ = std::fs::remove_file(&tmp);
+        eprintln!("this ffmpeg build cannot make in_place_small.mp4: skipping");
+        return None;
+    }
     std::fs::rename(&tmp, &out).unwrap();
     Some(out)
 }
@@ -56,12 +79,29 @@ fn reset_peak() -> Option<u64> {
     status_kib("VmHWM:").map(|k| k * 1024)
 }
 
+/// Set in the child process that does the measuring (see below).
+const ALONE: &str = "EFFECTCRAFT_TEST_RSS_ALONE";
+
 #[test]
 fn a_long_movie_is_read_in_place_not_whole() {
     if !cfg!(target_os = "linux") {
         eprintln!("peak RSS is read from /proc: skipping");
         return;
     }
+    // Peak RSS is per process, and the other tests in this binary run on parallel threads, so
+    // their allocations would count against this one. Measure in a child running only this test.
+    if std::env::var_os(ALONE).is_none() {
+        let out = std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "open_in_place::a_long_movie_is_read_in_place_not_whole", "--test-threads=1", "--nocapture"])
+            .env(ALONE, "1")
+            .output()
+            .unwrap();
+        let log = format!("{}{}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+        assert!(out.status.success(), "the measuring child failed:\n{log}");
+        assert!(log.contains("1 passed"), "the measuring child ran no test:\n{log}");
+        eprintln!("{log}");
+        return;
+    }
     let Some(small) = small_mp4() else {
         eprintln!("ffmpeg not found: skipping");
         return;
diff --git a/crates/media/tests/tga.rs b/crates/media/tests/it/tga.rs
similarity index 100%
rename from crates/media/tests/tga.rs
rename to crates/media/tests/it/tga.rs
diff --git a/crates/model/Cargo.toml b/crates/model/Cargo.toml
index 25397921a..ebe7da7e8 100644
--- a/crates/model/Cargo.toml
+++ b/crates/model/Cargo.toml
@@ -14,5 +14,6 @@ effectcraft-geom = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
+log = { workspace = true }
 image = { workspace = true }
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
diff --git a/crates/model/src/fbx.rs b/crates/model/src/fbx.rs
index 8a3fd9f40..bca387ff2 100644
--- a/crates/model/src/fbx.rs
+++ b/crates/model/src/fbx.rs
@@ -951,5 +951,4 @@ fn parse_within(bytes: &[u8], resolve: &dyn Fn(&str) -> Option<Vec<u8>>, limit:
 }
 
 #[cfg(test)]
-#[path = "fbx_tests.rs"]
 mod tests;
diff --git a/crates/model/src/fbx_tests.rs b/crates/model/src/fbx/tests.rs
similarity index 100%
rename from crates/model/src/fbx_tests.rs
rename to crates/model/src/fbx/tests.rs
diff --git a/crates/model/src/gltf.rs b/crates/model/src/gltf.rs
index e17d014f6..c0b736359 100644
--- a/crates/model/src/gltf.rs
+++ b/crates/model/src/gltf.rs
@@ -11,7 +11,7 @@
 //! `KHR_lights_punctual` lights (directional, point, spot). Sparse accessors and morph targets
 //! are ignored.
 
-use std::sync::Arc;
+use std::{cell::Cell, sync::Arc};
 
 use serde_json::Value;
 
@@ -87,6 +87,8 @@ pub fn uri_decode(s: &str) -> String {
     while i < b.len() {
         if b[i] == b'%'
             && i + 2 < b.len()
+            && b[i + 1].is_ascii_hexdigit()
+            && b[i + 2].is_ascii_hexdigit()
             && let Ok(v) = u8::from_str_radix(std::str::from_utf8(&b[i + 1..i + 3]).unwrap_or("zz"), 16)
         {
             out.push(v);
@@ -112,6 +114,14 @@ fn load_uri(uri: &str, resolve: &dyn Fn(&str) -> Option<Vec<u8>>) -> Result<Vec<
 struct Doc<'a> {
     j: &'a Value,
     buffers: Vec<Vec<u8>>,
+    /// Zero components that buffer-less accessors may still allocate, across the whole file:
+    /// nothing backs them, so many references to one capped accessor must not multiply (#2139).
+    zero_left: Cell<usize>,
+    /// Components every accessor read may still allocate, across the whole file: each primitive
+    /// that references an accessor keeps its own copy, so references must not multiply memory.
+    read_left: Cell<usize>,
+    /// The budget `read_left` started from, for the error message.
+    read_cap: usize,
 }
 
 fn arr<'v>(v: &'v Value, k: &str) -> &'v [Value] {
@@ -126,10 +136,18 @@ fn indices(v: &Value, k: &str) -> Vec<usize> {
     arr(v, k).iter().filter_map(Value::as_u64).filter_map(|c| usize::try_from(c).ok()).collect()
 }
 
-/// The most components an accessor without a buffer view (all zeros) may have: nothing in the
-/// file backs its count, so it is capped instead of checked against a buffer (#1235).
+/// The most components accessors without a buffer view (all zeros) may have, together: nothing
+/// in the file backs their counts, so they are capped instead of checked against a buffer
+/// (#1235, #2139).
 const MAX_ZERO_COMPONENTS: usize = 1 << 24;
 
+/// The most components all accessor reads in one file may allocate together (about 1 GiB as
+/// `f32`/`u32`). Each primitive keeps its own copy of what it reads, so an accessor referenced
+/// N times costs N times; this bounds that by a fixed amount rather than by buffer size, because
+/// real assets legitimately share one vertex buffer across many primitives. A 10M-triangle scan
+/// (5M vertices with position, normal, UV and tangent, 30M indices) reads about 90M.
+const MAX_READ_COMPONENTS: usize = 1 << 28;
+
 /// Where an accessor's elements lie in its buffer: `count` elements of `elem` bytes, `stride`
 /// apart from `base`, all checked to be inside `buf`.
 struct Span<'b> {
@@ -150,7 +168,30 @@ fn nums<const N: usize>(v: &Value, k: &str, d: [f64; N]) -> [f64; N] {
     out
 }
 
+/// Bytes of component `c` of element `i`, with checked offsets (the span was validated, but
+/// nothing derived from the file is indexed unchecked).
+fn component(buf: &[u8], base: usize, stride: usize, i: usize, c: usize, csize: usize) -> Result<&[u8]> {
+    let o = i.checked_mul(stride).and_then(|o| o.checked_add(base)).and_then(|o| o.checked_add(c.checked_mul(csize)?));
+    o.and_then(|o| buf.get(o..o.checked_add(csize)?)).ok_or_else(|| perr("accessor reads past its buffer"))
+}
+
 impl Doc<'_> {
+    /// Charge `total` components to the file's read budget before allocating them.
+    fn charge(&self, total: usize) -> Result<()> {
+        let left = self.read_left.get();
+        let Some(rest) = left.checked_sub(total) else {
+            let cap = self.read_cap;
+            return Err(perr(format!("accessor reads need more than {cap} components in total ({total} requested, {left} left)")));
+        };
+        self.read_left.set(rest);
+        Ok(())
+    }
+
+    /// Charge `count` items of `per` components each.
+    fn charge_each(&self, count: usize, per: usize) -> Result<()> {
+        self.charge(count.checked_mul(per).ok_or_else(|| perr("primitive is too large"))?)
+    }
+
     /// The accessor's element count and total components (`count * n`), checked; and its span in
     /// the buffer, validated before anything is allocated from the count. `None` for an
     /// accessor without a buffer view, whose components are all zero.
@@ -161,16 +202,19 @@ impl Doc<'_> {
         };
         let total = count.checked_mul(n).ok_or_else(|| perr("accessor count is too large"))?;
         let Some(bv) = idx(acc, "bufferView") else {
-            if total > MAX_ZERO_COMPONENTS {
-                return Err(perr(format!("accessor without a bufferView has {total} components (at most {MAX_ZERO_COMPONENTS})")));
-            }
+            let left = self.zero_left.get();
+            let Some(rest) = left.checked_sub(total) else {
+                return Err(perr(format!("accessors without a bufferView have more than {MAX_ZERO_COMPONENTS} components ({total} requested, {left} left)")));
+            };
+            self.zero_left.set(rest);
+            self.charge(total)?;
             return Ok((count, total, None));
         };
         let view = arr(self.j, "bufferViews").get(bv).ok_or_else(|| perr(format!("no bufferView {bv}")))?;
         let buf = self.buffers.get(idx(view, "buffer").unwrap_or(0)).ok_or_else(|| perr("bufferView buffer out of range"))?;
         let past = || perr("accessor reads past its buffer");
         let base = idx(view, "byteOffset").unwrap_or(0).checked_add(idx(acc, "byteOffset").unwrap_or(0)).ok_or_else(past)?;
-        let elem = csize * n;
+        let elem = csize.checked_mul(n).ok_or_else(past)?;
         let stride = idx(view, "byteStride").filter(|s| *s > 0).unwrap_or(elem);
         if stride < elem {
             return Err(perr(format!("bufferView byteStride {stride} is smaller than its {elem}-byte elements")));
@@ -181,6 +225,7 @@ impl Doc<'_> {
                 return Err(past());
             }
         }
+        self.charge(total)?;
         Ok((count, total, Some(Span { buf, base, stride })))
     }
 
@@ -214,8 +259,7 @@ impl Doc<'_> {
         // Matrices of 1/2-byte components pad columns to 4 bytes; ignored (rare).
         for i in 0..count {
             for c in 0..n {
-                let o = base + i * stride + c * csize;
-                let s = buf.get(o..o + csize).ok_or_else(|| perr("accessor reads past its buffer"))?;
+                let s = component(buf, base, stride, i, c, csize)?;
                 out[i * n + c] = match ct {
                     5126 => f32::from_le_bytes([s[0], s[1], s[2], s[3]]),
                     5125 => u32::from_le_bytes([s[0], s[1], s[2], s[3]]) as f32,
@@ -264,8 +308,7 @@ impl Doc<'_> {
         let mut out = Vec::with_capacity(total);
         for i in 0..count {
             for c in 0..n {
-                let o = base + i * stride + c * csize;
-                let s = buf.get(o..o + csize).ok_or_else(|| perr("accessor reads past its buffer"))?;
+                let s = component(buf, base, stride, i, c, csize)?;
                 out.push(match csize {
                     1 => s[0] as u32,
                     2 => u16::from_le_bytes([s[0], s[1]]) as u32,
@@ -279,6 +322,11 @@ impl Doc<'_> {
 
 /// Parse a `.gltf` (JSON) or `.glb` file.
 pub fn parse(bytes: &[u8], resolve: &dyn Fn(&str) -> Option<Vec<u8>>) -> Result<Model> {
+    parse_with_budget(bytes, resolve, MAX_READ_COMPONENTS)
+}
+
+/// [`parse`] with a read budget of `read_budget` accessor components for the whole file.
+pub(crate) fn parse_with_budget(bytes: &[u8], resolve: &dyn Fn(&str) -> Option<Vec<u8>>, read_budget: usize) -> Result<Model> {
     let (json, bin) = if bytes.starts_with(b"glTF") { split_glb(bytes)? } else { (bytes, None) };
     let j: Value = serde_json::from_slice(json).map_err(|e| perr(format!("glTF JSON: {e}")))?;
     let ver = j.get("asset").and_then(|a| a.get("version")).and_then(Value::as_str).unwrap_or("");
@@ -300,7 +348,7 @@ pub fn parse(bytes: &[u8], resolve: &dyn Fn(&str) -> Option<Vec<u8>>) -> Result<
         };
         buffers.push(data);
     }
-    let d = Doc { j: &j, buffers };
+    let d = Doc { j: &j, buffers, zero_left: Cell::new(MAX_ZERO_COMPONENTS), read_left: Cell::new(read_budget), read_cap: read_budget };
 
     // Images → textures (decoded once per image; samplers set the wrap modes).
     let mut images: Vec<Option<Arc<Texture>>> = vec![];
@@ -567,7 +615,11 @@ fn primitive(d: &Doc, p: &Value, materials: &[Material]) -> Result<Option<Primit
     };
     let raw: Vec<u32> = match idx(p, "indices") {
         Some(a) => d.ints(a)?,
-        None => (0..n as u32).collect(),
+        None => {
+            // Generated indices are allocated like a read, once per referencing primitive.
+            d.charge(n)?;
+            (0..n as u32).collect()
+        }
     };
     if raw.iter().any(|&i| i as usize >= n) {
         return Err(perr("index out of range"));
@@ -587,11 +639,19 @@ fn primitive(d: &Doc, p: &Value, materials: &[Material]) -> Result<Option<Primit
         }
         _ => indices.extend(raw.as_chunks::<3>().0.iter().flatten()),
     }
+    // The triangle list is kept besides the raw indices (a strip or fan of k indices becomes
+    // 3(k-2)), so it is charged like a read.
+    d.charge(indices.len())?;
     if normals.len() != n {
         normals.clear();
     }
     let material = idx(p, "material").filter(|&m| m < materials.len());
     let skinned = joints.len() == n && weights.len() == n;
+    if normals.is_empty() {
+        // Flat normals unshare every vertex: position and normal, plus UVs and joints/weights.
+        let per = 6 + if uvs.len() == n { 2 } else { 0 } + if skinned { 8 } else { 0 };
+        d.charge_each(indices.len(), per)?;
+    }
     let mut prim = Primitive {
         positions,
         normals,
@@ -608,7 +668,20 @@ fn primitive(d: &Doc, p: &Value, materials: &[Material]) -> Result<Option<Primit
     }
     let needs_tangents = material.is_some_and(|m| materials[m].normal_tex.is_some());
     if needs_tangents && prim.tangents.is_empty() {
+        d.charge_each(prim.positions.len(), 4)?;
         prim.compute_tangents();
     }
     Ok(Some(prim))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::uri_decode;
+
+    #[test]
+    fn uri_decode_rejects_signed_hex_pair() {
+        assert_eq!(uri_decode("a%+1b"), "a%+1b");
+        assert_eq!(uri_decode("a%-1b"), "a%-1b");
+        assert_eq!(uri_decode("a%41b"), "aAb");
+    }
+}
diff --git a/crates/model/src/obj.rs b/crates/model/src/obj.rs
index 059278ecd..22d9877a2 100644
--- a/crates/model/src/obj.rs
+++ b/crates/model/src/obj.rs
@@ -14,18 +14,52 @@ use std::sync::Arc;
 
 use crate::{AlphaMode, Material, Mesh, Model, Primitive, Result, TexRef, Texture, perr};
 
+/// The last component of a referenced path, treating `\` as a separator too: a path from a
+/// machine of another kind (`C:\textures\checker.png`) still finds `checker.png` next to the
+/// model (#1274). `None` when the name carries no path at all.
+fn sibling_name(name: &str) -> Option<&str> {
+    let file = name.rsplit(['/', '\\']).next()?;
+    (!file.is_empty() && file.len() < name.len()).then_some(file)
+}
+
+/// A material reference resolved against the model's folder: the name as written (a name
+/// containing spaces is one name), then its file name (an absolute path from another machine,
+/// #1274), then the final token (the options convention, `-bm 1 file.png`).
+fn resolve_reference(resolve: &dyn Fn(&str) -> Option<Vec<u8>>, name: &str) -> Option<Vec<u8>> {
+    let mut tried: Vec<&str> = vec![];
+    for candidate in [name, sibling_name(name).unwrap_or(name), name.split_whitespace().last().unwrap_or(name)] {
+        if tried.contains(&candidate) {
+            continue;
+        }
+        tried.push(candidate);
+        if let Some(b) = resolve(candidate) {
+            return Some(b);
+        }
+    }
+    None
+}
+
 /// Parse MTL text into named materials (textures appended to `textures`).
 pub fn parse_mtl(text: &str, resolve: &dyn Fn(&str) -> Option<Vec<u8>>, textures: &mut Vec<Arc<Texture>>) -> Vec<Material> {
     let mut out: Vec<Material> = vec![];
     let mut loaded: HashMap<String, Option<usize>> = HashMap::new();
     let mut tex = |name: &str, textures: &mut Vec<Arc<Texture>>| -> Option<TexRef> {
-        // Options (`-bm 1 file.png`): the file name is the last token.
-        let file = name.split_whitespace().last()?.to_string();
-        let t = *loaded.entry(file.clone()).or_insert_with(|| {
-            let b = resolve(&file)?;
-            let t = Texture::decode(&b).ok()?;
-            textures.push(Arc::new(t));
-            Some(textures.len() - 1)
+        let key = name.trim().to_string();
+        let t = *loaded.entry(key.clone()).or_insert_with(|| {
+            let Some(b) = resolve_reference(resolve, &key) else {
+                log::warn!("model: texture `{key}` was not found next to the model");
+                return None;
+            };
+            match Texture::decode(&b) {
+                Ok(t) => {
+                    textures.push(Arc::new(t));
+                    Some(textures.len() - 1)
+                }
+                Err(e) => {
+                    log::warn!("model: cannot decode texture `{key}`: {e}");
+                    None
+                }
+            }
         });
         t.map(|texture| TexRef { texture, uv_set: 0 })
     };
@@ -147,13 +181,18 @@ pub fn parse(bytes: &[u8], resolve: &dyn Fn(&str) -> Option<Vec<u8>>) -> Result<
             }
             "mtllib" => {
                 let name = line["mtllib".len()..].trim();
-                for file in std::iter::once(name).chain(name.split_whitespace()) {
+                let mut found = false;
+                for file in std::iter::once(name).chain(name.split_whitespace()).chain(sibling_name(name)) {
                     if let Some(b) = resolve(file) {
                         let mut ms = parse_mtl(&String::from_utf8_lossy(&b), resolve, &mut textures);
                         materials.append(&mut ms);
+                        found = true;
                         break;
                     }
                 }
+                if !found && !name.is_empty() {
+                    log::warn!("model: material library `{name}` was not found next to the model");
+                }
             }
             "usemtl" => {
                 let name = line["usemtl".len()..].trim();
diff --git a/crates/model/src/tests.rs b/crates/model/src/tests.rs
index 7c98c1ae7..5ee6a6950 100644
--- a/crates/model/src/tests.rs
+++ b/crates/model/src/tests.rs
@@ -119,6 +119,92 @@ fn obj_without_normals_gets_them() {
     assert!(obj::parse(b"v 0 0 0\n", &|_| None).is_err());
 }
 
+#[test]
+fn obj_textures_from_another_machine_find_the_file_next_to_the_model() {
+    // No committed media: the material file and its textures are written by the test itself.
+    let d = std::env::temp_dir().join(format!("ec-obj-sibling-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    let png = {
+        let img = image::RgbaImage::from_fn(2, 2, |x, y| if (x + y) % 2 == 0 { image::Rgba([255, 0, 0, 255]) } else { image::Rgba([0, 0, 255, 255]) });
+        let mut out = std::io::Cursor::new(Vec::new());
+        img.write_to(&mut out, image::ImageFormat::Png).unwrap();
+        out.into_inner()
+    };
+    std::fs::write(d.join("checker.png"), &png).unwrap();
+    std::fs::write(d.join("Diffuse Map.png"), &png).unwrap();
+    let mtl = "newmtl Mat\nKd 0.640000 0.640000 0.640000\nmap_Kd C:\\Users\\somebody\\Desktop\\textures\\checker.png\n\
+               newmtl Spaced\nKd 1.000000 1.000000 1.000000\nmap_Kd Diffuse Map.png\n\
+               newmtl Missing\nKd 0.500000 0.500000 0.500000\nmap_Kd nowhere.png\n";
+    let obj = "mtllib quad.mtl\nv -1 -1 0\nv 1 -1 0\nv 1 1 0\nv -1 1 0\nvt 0 0\nvt 1 0\nvt 1 1\nvt 0 1\n\
+               usemtl Mat\nf 1/1 2/2 3/3\nf 1/1 3/3 4/4\n";
+    // Like the media layer's resolver: a relative name joins the model's folder; an absolute
+    // path is only looked up where it points (here: nowhere else).
+    let resolve = |uri: &str| -> Option<Vec<u8>> {
+        let p = std::path::Path::new(uri);
+        if p.is_absolute() {
+            return None;
+        }
+        std::fs::read(d.join(p)).ok()
+    };
+    let resolver = |uri: &str| -> Option<Vec<u8>> { if uri == "quad.mtl" { Some(mtl.as_bytes().to_vec()) } else { resolve(uri) } };
+    let m = obj::parse(obj.as_bytes(), &resolver).unwrap();
+    assert_eq!(m.materials.len(), 3);
+    let mat = &m.materials[0];
+    let t = mat.base_color_tex.expect("the absolute map_Kd path finds checker.png next to the .obj");
+    let tex = &m.textures[t.texture];
+    assert_eq!((tex.width, tex.height), (2, 2));
+    assert_eq!(tex.data[0], [1.0, 0.0, 0.0, 1.0]);
+    assert!((mat.base_color[0] - obj::srgb_to_linear(0.64)).abs() < 1e-6, "Kd still tints the texture");
+    assert!(m.materials[1].base_color_tex.is_some(), "a texture name containing spaces is one name");
+    assert!(m.materials[2].base_color_tex.is_none(), "a genuinely missing texture keeps the Kd colour");
+    assert!((m.materials[2].base_color[0] - obj::srgb_to_linear(0.5)).abs() < 1e-6);
+    // The same fallback applies to the material library itself.
+    let here = obj.replace("mtllib quad.mtl", "mtllib C:\\build\\quad.mtl");
+    assert_eq!(obj::parse(here.as_bytes(), &resolver).unwrap().materials.len(), 3);
+    let _ = std::fs::remove_dir_all(&d);
+}
+
+#[test]
+fn obj_texture_prefers_the_complete_name_over_its_final_token() {
+    // Two textures sit beside the model: `Map.png` (the final whitespace token of the reference)
+    // and `Diffuse Map.png` (the complete name). The complete name must win, its basename next,
+    // the final token last (the `-bm 1 file.png` options convention).
+    let d = std::env::temp_dir().join(format!("ec-obj-full-name-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    let png = |w: u32| {
+        let img = image::RgbaImage::from_fn(w, 2, |_, _| image::Rgba([255, 0, 0, 255]));
+        let mut out = std::io::Cursor::new(Vec::new());
+        img.write_to(&mut out, image::ImageFormat::Png).unwrap();
+        out.into_inner()
+    };
+    std::fs::write(d.join("Map.png"), png(2)).unwrap();
+    std::fs::write(d.join("Diffuse Map.png"), png(4)).unwrap();
+    let mtl = "newmtl Spaced\nmap_Kd Diffuse Map.png\n\
+               newmtl Absolute\nmap_Kd C:\\tex\\Diffuse Map.png\n\
+               newmtl Options\nmap_Kd -bm 1 Map.png\n";
+    let obj = "mtllib quad.mtl\nv -1 -1 0\nv 1 -1 0\nv 1 1 0\nv -1 1 0\nvt 0 0\nvt 1 0\nvt 1 1\nvt 0 1\n\
+               usemtl Spaced\nf 1/1 2/2 3/3\nf 1/1 3/3 4/4\n";
+    // Like the media layer's resolver: a relative name joins the model's folder; an absolute
+    // path is only looked up where it points (here: nowhere else).
+    let resolve = |uri: &str| -> Option<Vec<u8>> {
+        let p = std::path::Path::new(uri);
+        if p.is_absolute() {
+            return None;
+        }
+        std::fs::read(d.join(p)).ok()
+    };
+    let resolver = |uri: &str| -> Option<Vec<u8>> { if uri == "quad.mtl" { Some(mtl.as_bytes().to_vec()) } else { resolve(uri) } };
+    let m = obj::parse(obj.as_bytes(), &resolver).unwrap();
+    assert_eq!(m.materials.len(), 3);
+    let size = |mat: &Material| mat.base_color_tex.map(|t| (m.textures[t.texture].width, m.textures[t.texture].height));
+    assert_eq!(size(&m.materials[0]), Some((4, 2)), "the complete `Diffuse Map.png` wins over its final token `Map.png`");
+    assert_eq!(size(&m.materials[1]), Some((4, 2)), "an absolute path's spaced basename beats its final token");
+    assert_eq!(size(&m.materials[2]), Some((2, 2)), "the `-bm 1 file.png` options convention still finds the final token");
+    let _ = std::fs::remove_dir_all(&d);
+}
+
 #[test]
 fn channel_interpolation_modes() {
     let mut c = Channel { node: 0, path: ChannelPath::Translation, interp: Interp::Step, times: vec![0.0, 1.0], values: vec![0.0, 0.0, 0.0, 10.0, 0.0, 0.0] };
@@ -564,3 +650,84 @@ fn gltf_strided_and_buffer_less_accessors_still_import() {
     let doc = gltf_doc(r#"{"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": 3}"#, r#"{"buffer": 0, "byteStride": 24}"#, 59);
     assert!(crate::gltf::parse(doc.as_bytes(), &|_| None).is_err());
 }
+
+#[test]
+fn gltf_issue_2139_huge_mat4_count_is_an_error() {
+    // The audit's trigger (#2139): a MAT4 accessor with a count of 10^11, with and without a
+    // buffer view, must fail cleanly instead of sizing an allocation from the count.
+    let view = r#"{"buffer": 0, "byteLength": 64}"#;
+    for acc in [
+        r#"{"bufferView": 0, "componentType": 5126, "type": "MAT4", "count": 100000000000}"#,
+        r#"{"componentType": 5126, "type": "MAT4", "count": 100000000000}"#,
+    ] {
+        let doc = gltf_doc(r#"{"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": 1}"#, view, 64)
+            .replace(r#""count": 1}]"#, &format!(r#""count": 1}}, {acc}]"#))
+            .replace(r#""nodes": [{"mesh": 0}]"#, r#""nodes": [{"mesh": 0, "skin": 0}], "skins": [{"joints": [0], "inverseBindMatrices": 1}]"#);
+        assert!(doc.contains("inverseBindMatrices"), "{doc}");
+        assert!(crate::gltf::parse(doc.as_bytes(), &|_| None).is_err(), "{acc}");
+    }
+}
+
+#[test]
+fn gltf_buffer_less_accessors_share_one_zero_budget() {
+    // Each buffer-less accessor is capped, but nothing backs any of them, so referencing a capped
+    // one from many primitives must not multiply the allocation (#2139).
+    let acc = r#"{"componentType": 5126, "type": "VEC3", "count": 5000000}"#;
+    let prims = [r#"{"attributes": {"POSITION": 0}}"#; 4].join(", ");
+    let doc = gltf_doc(acc, r#"{"buffer": 0}"#, 3).replace(r#"[{"attributes": {"POSITION": 0}}]"#, &format!("[{prims}]"));
+    assert_eq!(doc.matches(r#""POSITION": 0"#).count(), 4);
+    let e = crate::gltf::parse(doc.as_bytes(), &|_| None).err().unwrap_or_else(|| panic!("imported"));
+    assert!(e.to_string().contains("without a bufferView"), "{e}");
+    // One such accessor read once still imports.
+    let doc = gltf_doc(acc, r#"{"buffer": 0}"#, 3);
+    assert!(crate::gltf::parse(doc.as_bytes(), &|_| None).is_ok());
+}
+
+/// `refs` primitives sharing one buffer-backed `verts`-vertex POSITION accessor, without indices.
+fn gltf_shared_positions(verts: usize, refs: usize) -> String {
+    let acc = format!(r#"{{"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": {verts}}}"#);
+    let prims = vec![r#"{"attributes": {"POSITION": 0}}"#; refs].join(", ");
+    gltf_doc(&acc, r#"{"buffer": 0}"#, verts * 12).replace(r#"[{"attributes": {"POSITION": 0}}]"#, &format!("[{prims}]"))
+}
+
+#[test]
+fn gltf_buffer_backed_reads_share_one_read_budget() {
+    // A buffer-backed accessor is checked against its buffer, but each primitive that references
+    // it reads and keeps its own copy, so a small file listing many references must not ask for
+    // memory set by the reference count (#2139 review). Everything a primitive keeps is charged
+    // to one per-file budget: 1,000 vertices without indices or normals cost 3,000 position
+    // components, 1,000 generated indices, a 999-index triangle list and 999 flat-shaded
+    // vertices of 6 components, 10,993 in all.
+    let one = gltf_shared_positions(1000, 1);
+    let m = crate::gltf::parse_with_budget(one.as_bytes(), &|_| None, 20_000).unwrap();
+    assert_eq!(m.meshes[0].primitives.len(), 1);
+    let three = gltf_shared_positions(1000, 3);
+    assert_eq!(three.matches(r#""POSITION": 0"#).count(), 3);
+    let e = crate::gltf::parse_with_budget(three.as_bytes(), &|_| None, 20_000).err().unwrap_or_else(|| panic!("imported"));
+    assert!(e.to_string().contains("more than 20000 components"), "{e}");
+    // The real cap leaves room for legitimate sharing: many primitives over one vertex buffer.
+    let m = crate::gltf::parse(gltf_shared_positions(1000, 50).as_bytes(), &|_| None).unwrap();
+    assert_eq!(m.meshes[0].primitives.len(), 50);
+}
+
+#[test]
+fn gltf_missing_indices_are_charged_to_the_read_budget() {
+    // Without `indices` every vertex gets a generated index, allocated like a read: after the
+    // 3,000 position components, 999 left is one short for the 1,000 indices.
+    let doc = gltf_shared_positions(1000, 1);
+    let e = crate::gltf::parse_with_budget(doc.as_bytes(), &|_| None, 3999).err().unwrap_or_else(|| panic!("imported"));
+    assert!(e.to_string().contains("(1000 requested, 999 left)"), "{e}");
+}
+
+#[test]
+fn gltf_strip_expansion_is_charged_to_the_read_budget() {
+    // A strip of k indices becomes 3(k-2) triangle indices and as many flat-shaded vertices, so
+    // the output is charged, not only the 1,009 components read.
+    let doc = gltf_doc(r#"{"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": 3}"#, r#"{"buffer": 0}"#, 1036)
+        .replace(r#""count": 3}]"#, r#""count": 3}, {"bufferView": 0, "componentType": 5121, "type": "SCALAR", "count": 1000}]"#)
+        .replace(r#""attributes": {"POSITION": 0}"#, r#""attributes": {"POSITION": 0}, "indices": 1, "mode": 5"#);
+    let m = crate::gltf::parse_with_budget(doc.as_bytes(), &|_| None, 30_000).unwrap();
+    assert_eq!(m.meshes[0].primitives[0].indices.len(), 2994);
+    let e = crate::gltf::parse_with_budget(doc.as_bytes(), &|_| None, 5000).err().unwrap_or_else(|| panic!("imported"));
+    assert!(e.to_string().contains("more than 5000 components"), "{e}");
+}
diff --git a/crates/opusenc/README.md b/crates/opusenc/README.md
index 999d8a7e9..1ebf6fedb 100644
--- a/crates/opusenc/README.md
+++ b/crates/opusenc/README.md
@@ -130,7 +130,7 @@ weights) and the decoder-side normative arithmetic the encoder must reproduce bi
 allocation; SILK NLSF dequantisation and stabilisation, NLSF → LPC conversion, `log2lin`, the
 fixed-point division/inverse helpers and the LPC analysis filter) are mirrored from FilmCraft's
 first-party, spec-derived `filmcraft-opus` decoder (MIT OR Apache-2.0), which is also the
-round-trip oracle in `tests/` and `crates/export/tests/opus_roundtrip.rs` (ffmpeg is a second,
+round-trip oracle in `tests/` and `crates/export/tests/it/opus_roundtrip.rs` (ffmpeg is a second,
 external oracle when installed). All encoder-side analysis and search (pitch, LPC, NLSF and
 LTP search, noise feedback, rate control, stereo prediction, the decimator) is our own design.
 No third-party encoder or decoder source (libopus or otherwise) was consulted.
diff --git a/crates/opusenc/src/bands.rs b/crates/opusenc/src/bands.rs
index 744de3fe3..f90a554c4 100644
--- a/crates/opusenc/src/bands.rs
+++ b/crates/opusenc/src/bands.rs
@@ -8,7 +8,8 @@
 
 use crate::range::{BITRES, RangeEncoder, ilog};
 use crate::rate::{Mode, QTHETA_OFFSET, get_pulses};
-use crate::tables::*;
+use crate::tables::EBANDS;
+use crate::{CeltFrame, rate::Allocation};
 
 pub const SPREAD_NORMAL: usize = 2;
 
@@ -55,7 +56,7 @@ fn exp_rotation1_inv(x: &mut [f32], len: usize, stride: usize, c: f32, s: f32) {
     if len <= stride {
         return;
     }
-    if len >= 2 * stride + 1 {
+    if len > 2 * stride {
         for i in 0..=len - 2 * stride - 1 {
             let x1 = x[i];
             let x2 = x[i + stride];
@@ -96,12 +97,24 @@ pub fn exp_rotation_inv(x: &mut [f32], len: usize, k: usize, spread: usize) {
     }
 }
 
+/// Relative slack for the pulse-candidate filter in [`pvq_search`]: far above the f32 rounding of
+/// the filter score (a few 1e-7), far below the spread of real scores.
+const PVQ_SCORE_SLACK: f32 = 1e-5;
+
 /// Greedy PVQ search: the integer vector `y` with `sum |y| = k` closest in direction to `x`.
 pub fn pvq_search(x: &[f32], k: usize, y: &mut [i32]) {
     let n = x.len();
     y[..n].fill(0);
-    let abs: Vec<f32> = x.iter().map(|v| v.abs()).collect();
-    let sum: f32 = abs.iter().sum();
+    // `abs`, `dy` (2 y + 1, infinite in the padding) and the per-pass scores `score`, each padded to
+    // whole 8-lane chunks.
+    let np = n.next_multiple_of(8);
+    let mut buf = vec![0f32; 3 * np];
+    let (abs, rest) = buf.split_at_mut(np);
+    let (dy, score) = rest.split_at_mut(np);
+    for (a, v) in abs.iter_mut().zip(x) {
+        *a = v.abs();
+    }
+    let sum: f32 = abs[..n].iter().sum();
     if !sum.is_finite() || sum <= 1e-15 {
         y[0] = k as i32;
         return;
@@ -113,30 +126,69 @@ pub fn pvq_search(x: &[f32], k: usize, y: &mut [i32]) {
         // Pre-project onto the pyramid (rounding down) and place the rest greedily.
         let r = (k as f32 - 1.0) / sum;
         for j in 0..n {
-            let p = (abs[j] * r).floor() as i32;
+            // Non-negative and at most k, so the truncating cast is the floor.
+            let p = (abs[j] * r) as i32;
             y[j] = p;
             placed += p as usize;
             xy += abs[j] * p as f32;
             yy += (p * p) as f32;
         }
     }
+    for j in 0..np {
+        dy[j] = if j < n { 2.0 * y[j] as f32 + 1.0 } else { f32::INFINITY };
+    }
     while placed < k {
+        // Vectorisable scores (xy + |x_j|)^2 / (yy + 2 y_j + 1) and their maximum.
+        for ((sc, &a), &d) in score.iter_mut().zip(abs.iter()).zip(dy.iter()) {
+            let t = xy + a;
+            *sc = t * t / (yy + d);
+        }
+        let mut lane_max = [0f32; 8];
+        for c in score.as_chunks::<8>().0 {
+            for i in 0..8 {
+                lane_max[i] = if c[i] > lane_max[i] { c[i] } else { lane_max[i] };
+            }
+        }
+        let top = lane_max.iter().fold(0f32, |m, &v| if v > m { v } else { m });
+        // The exact cross-multiplied test below, in index order with the first maximum winning, only
+        // matters for entries within rounding distance of the top score: every other entry is beaten
+        // by the top one whenever it is reached and never beats it afterwards. Running the test on
+        // those alone therefore picks the same pulse as running it on all of them.
+        let filter = top > 1e-30 && top.is_finite();
+        let lo = top * (1.0 - PVQ_SCORE_SLACK);
+        // Usually exactly one entry qualifies; its index falls out of a lane-wise count.
+        let mut count = [0u32; 8];
+        let mut index = [0u32; 8];
+        for (ci, c) in score.as_chunks::<8>().0.iter().enumerate() {
+            for i in 0..8 {
+                let hit = u32::from(c[i] >= lo);
+                count[i] += hit;
+                index[i] += hit * (ci * 8 + i) as u32;
+            }
+        }
         let mut best = 0usize;
-        let mut best_num = -1f32;
-        let mut best_den = 1f32;
-        for j in 0..n {
-            let num = xy + abs[j];
-            let num = num * num;
-            let den = yy + 2.0 * y[j] as f32 + 1.0;
-            if num * best_den > best_num * den {
-                best_num = num;
-                best_den = den;
-                best = j;
+        if filter && count.iter().sum::<u32>() == 1 {
+            best = index.iter().sum::<u32>() as usize;
+        } else {
+            let mut best_num = -1f32;
+            let mut best_den = 1f32;
+            for j in 0..n {
+                if !filter || score[j] >= lo {
+                    let num = xy + abs[j];
+                    let num = num * num;
+                    let den = yy + 2.0 * y[j] as f32 + 1.0;
+                    if num * best_den > best_num * den {
+                        best_num = num;
+                        best_den = den;
+                        best = j;
+                    }
+                }
             }
         }
         xy += abs[best];
         yy += 2.0 * y[best] as f32 + 1.0;
         y[best] += 1;
+        dy[best] = 2.0 * y[best] as f32 + 1.0;
         placed += 1;
     }
     for j in 0..n {
@@ -146,25 +198,45 @@ pub fn pvq_search(x: &[f32], k: usize, y: &mut [i32]) {
     }
 }
 
-/// Encodes the PVQ codeword `y` (`sum |y| = k`) as the index the RFC 6716 §4.3.4.2 decoder maps
-/// back to `y`.
-pub fn encode_pulses(y: &[i32], k: usize, enc: &mut RangeEncoder, v: &mut Vec<u64>) {
-    let n = y.len();
-    let w = k + 1;
-    v.clear();
-    v.resize((n + 1) * w, 0);
+/// Largest band width and pulse count the encoder codes (176 coefficients, `get_pulses(40)` = 128).
+const PVQ_MAX_N: usize = 176;
+const PVQ_MAX_K: usize = 128;
+
+/// Row-major `V(n, k)` for `n <= max_n`, `k <= max_k` with row stride `max_k + 1`, saturated at
+/// `u32::MAX` (a codebook that large is never coded, see `rate::fits_in32`).
+fn build_pvq_table(max_n: usize, max_k: usize) -> Vec<u32> {
+    let w = max_k + 1;
+    let mut v = vec![0u32; (max_n + 1) * w];
     v[0] = 1;
-    for nn in 1..=n {
+    for nn in 1..=max_n {
         v[nn * w] = 1;
-        for kk in 1..=k {
-            let a = v[(nn - 1) * w + kk];
-            let b = v[nn * w + kk - 1];
-            let c = v[(nn - 1) * w + kk - 1];
-            v[nn * w + kk] = a.saturating_add(b).saturating_add(c);
+        for kk in 1..=max_k {
+            let sum = v[(nn - 1) * w + kk] as u64 + v[nn * w + kk - 1] as u64 + v[(nn - 1) * w + kk - 1] as u64;
+            v[nn * w + kk] = sum.min(u32::MAX as u64) as u32;
         }
     }
-    let total = v[n * w + k];
-    let vv = |nn: usize, kx: usize| v[nn * w + kx];
+    v
+}
+
+fn pvq_table() -> &'static [u32] {
+    static TABLE: std::sync::OnceLock<Vec<u32>> = std::sync::OnceLock::new();
+    TABLE.get_or_init(|| build_pvq_table(PVQ_MAX_N, PVQ_MAX_K))
+}
+
+/// Encodes the PVQ codeword `y` (`sum |y| = k`) as the index the RFC 6716 §4.3.4.2 decoder maps
+/// back to `y`.
+pub fn encode_pulses(y: &[i32], k: usize, enc: &mut RangeEncoder) {
+    let n = y.len();
+    // Shapes outside the coded range (never produced by the band layout) get a local table.
+    let local;
+    let (v, w) = if n <= PVQ_MAX_N && k <= PVQ_MAX_K {
+        (pvq_table(), PVQ_MAX_K + 1)
+    } else {
+        local = build_pvq_table(n, k);
+        (&local[..], k + 1)
+    };
+    let row = |nn: usize| &v[nn * w..(nn + 1) * w];
+    let total = row(n)[k] as u64;
     let mut index = 0u64;
     let mut kk = k;
     for j in 0..n {
@@ -173,10 +245,11 @@ pub fn encode_pulses(y: &[i32], k: usize, enc: &mut RangeEncoder, v: &mut Vec<u6
         }
         let rem = n - j;
         let t = y[j].unsigned_abs() as usize;
+        let below = row(rem - 1);
         // Codewords with |y_j| = t start at sum_{m < kk - t} V(rem-1, m) within their sign half.
-        let mut base: u64 = (0..kk - t).map(|m| vv(rem - 1, m)).sum();
+        let mut base: u64 = below[..kk - t].iter().map(|&x| x as u64).sum();
         if y[j] < 0 {
-            base += (vv(rem - 1, kk) + vv(rem, kk)) / 2;
+            base += (below[kk] as u64 + row(rem)[kk] as u64) / 2;
         }
         index += base;
         kk -= t;
@@ -193,7 +266,6 @@ pub struct BandEnc<'m, 'e> {
     pub i: usize,
     pub spread: usize,
     pub remaining_bits: i32,
-    pvq_v: Vec<u64>,
     iy: Vec<i32>,
     tmp: Vec<f32>,
 }
@@ -217,7 +289,7 @@ impl BandEnc<'_, '_> {
             let q = qn as u32;
             let half = q >> 1;
             let ft = (half + 1) * (half + 1);
-            let (fl, fs) = if it <= half { (it * (it + 1) >> 1, it + 1) } else { (ft - ((q + 1 - it) * (q + 2 - it) >> 1), q + 1 - it) };
+            let (fl, fs) = if it <= half { ((it * (it + 1)) >> 1, it + 1) } else { (ft - (((q + 1 - it) * (q + 2 - it)) >> 1), q + 1 - it) };
             self.enc.encode(fl, fl + fs, ft);
             itheta = ((it * 16384) / q) as i32;
         }
@@ -287,36 +359,29 @@ impl BandEnc<'_, '_> {
             iy.clear();
             iy.resize(n, 0);
             pvq_search(&tmp, k, &mut iy);
-            encode_pulses(&iy, k, self.enc, &mut self.pvq_v);
+            encode_pulses(&iy, k, self.enc);
             self.iy = iy;
             self.tmp = tmp;
         }
     }
 }
 
-/// Codes all band shapes (`quant_all_bands`, encoder side, long blocks). `x` holds `c` channels
-/// of `n` normalised MDCT coefficients each.
-#[allow(clippy::too_many_arguments)]
-pub fn quant_all_bands(
-    m: &Mode,
-    start: usize,
-    end: usize,
-    x: &[f32],
-    n_total: usize,
-    c: usize,
-    pulses: &[i32; NB_EBANDS],
-    spread: usize,
-    dual_stereo: bool,
-    intensity: usize,
-    total_bits: i32,
-    mut balance: i32,
-    enc: &mut RangeEncoder,
-    lm: usize,
-    coded_bands: usize,
-) {
+/// Shape-coding controls, independent of the selected band allocation.
+pub struct BandCoding {
+    pub spread: usize,
+    pub total_bits: i32,
+}
+
+/// Codes all band shapes (`quant_all_bands`, encoder side, long blocks). `x` holds
+/// `frame.channels` channels of `n_total` normalised MDCT coefficients each.
+pub fn quant_all_bands(m: &Mode, frame: CeltFrame, x: &[f32], n_total: usize, allocation: &Allocation, coding: BandCoding, enc: &mut RangeEncoder) {
+    let CeltFrame { start, end, channels: c, lm } = frame;
+    let Allocation { pulses, dual_stereo, intensity, coded_bands, balance, .. } = allocation;
+    let (dual_stereo, intensity, coded_bands, mut balance) = (*dual_stereo, *intensity, *coded_bands, *balance);
+    let BandCoding { spread, total_bits } = coding;
     let mm = 1usize << lm;
     debug_assert!(c == 1 || dual_stereo || intensity <= start, "stereo frames are coded as dual stereo");
-    let mut ctx = BandEnc { m, enc, i: 0, spread, remaining_bits: 0, pvq_v: Vec::new(), iy: Vec::new(), tmp: Vec::new() };
+    let mut ctx = BandEnc { m, enc, i: 0, spread, remaining_bits: 0, iy: Vec::new(), tmp: Vec::new() };
     for i in start..end {
         ctx.i = i;
         let xo = mm * EBANDS[i] as usize;
@@ -362,7 +427,7 @@ mod tests {
             x[i + stride] = c * x2 + s * x1;
             x[i] = c * x1 + ms * x2;
         }
-        if len >= 2 * stride + 1 {
+        if len > 2 * stride {
             for i in (0..=len - 2 * stride - 1).rev() {
                 let x1 = x[i];
                 let x2 = x[i + stride];
@@ -466,12 +531,11 @@ mod tests {
 
     #[test]
     fn pvq_index_roundtrip_exhaustive() {
-        let mut v = Vec::new();
         for n in 1..6usize {
             for k in 1..6usize {
                 for y in all_codewords(n, k) {
                     let mut e = RangeEncoder::new();
-                    encode_pulses(&y, k, &mut e, &mut v);
+                    encode_pulses(&y, k, &mut e);
                     let buf = e.done(16);
                     let mut d = RangeDecoder::new(&buf);
                     assert_eq!(decode_pulses(n, k, &mut d), y, "n={n} k={k}");
@@ -480,6 +544,165 @@ mod tests {
         }
     }
 
+    /// The per-call table encoder this module used before the shared table.
+    fn encode_pulses_reference(y: &[i32], k: usize, enc: &mut RangeEncoder) {
+        let n = y.len();
+        let w = k + 1;
+        let mut v = vec![0u64; (n + 1) * w];
+        v[0] = 1;
+        for nn in 1..=n {
+            v[nn * w] = 1;
+            for kk in 1..=k {
+                let a = v[(nn - 1) * w + kk];
+                let b = v[nn * w + kk - 1];
+                let c = v[(nn - 1) * w + kk - 1];
+                v[nn * w + kk] = a.saturating_add(b).saturating_add(c);
+            }
+        }
+        let total = v[n * w + k];
+        let vv = |nn: usize, kx: usize| v[nn * w + kx];
+        let mut index = 0u64;
+        let mut kk = k;
+        for j in 0..n {
+            if kk == 0 {
+                break;
+            }
+            let rem = n - j;
+            let t = y[j].unsigned_abs() as usize;
+            let mut base: u64 = (0..kk - t).map(|m| vv(rem - 1, m)).sum();
+            if y[j] < 0 {
+                base += (vv(rem - 1, kk) + vv(rem, kk)) / 2;
+            }
+            index += base;
+            kk -= t;
+        }
+        if total >= 2 {
+            enc.uint(index as u32, total as u32);
+        }
+    }
+
+    #[test]
+    fn pvq_table_encode_matches_per_call_table() {
+        let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+        let mut next = move |m: u64| {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            seed % m
+        };
+        let mut checked = 0;
+        for n in (1..=PVQ_MAX_N).step_by(5).chain([PVQ_MAX_N]) {
+            for k in (1..=PVQ_MAX_K).step_by(3).chain([PVQ_MAX_K]) {
+                if crate::rate::pvq_v(n, k) > u32::MAX as u128 {
+                    continue;
+                }
+                for _ in 0..4 {
+                    let mut y = vec![0i32; n];
+                    for _ in 0..k {
+                        let at = next(n as u64) as usize;
+                        y[at] += if next(2) == 0 { 1 } else { -1 };
+                    }
+                    // Opposite pulses cancel; top up so that sum |y| = k again.
+                    let mut have: usize = y.iter().map(|v| v.unsigned_abs() as usize).sum();
+                    while have < k {
+                        let at = next(n as u64) as usize;
+                        y[at] += if y[at] < 0 { -1 } else { 1 };
+                        have += 1;
+                    }
+                    let (mut a, mut b) = (RangeEncoder::new(), RangeEncoder::new());
+                    encode_pulses(&y, k, &mut a);
+                    encode_pulses_reference(&y, k, &mut b);
+                    assert_eq!(a.done(16), b.done(16), "n={n} k={k}");
+                    checked += 1;
+                }
+            }
+        }
+        assert!(checked > 100, "{checked}");
+    }
+
+    /// The scalar greedy search the vectorised one replaced.
+    fn pvq_search_ref(x: &[f32], k: usize, y: &mut [i32]) {
+        let n = x.len();
+        y[..n].fill(0);
+        let abs: Vec<f32> = x.iter().map(|v| v.abs()).collect();
+        let sum: f32 = abs.iter().sum();
+        if !sum.is_finite() || sum <= 1e-15 {
+            y[0] = k as i32;
+            return;
+        }
+        let mut placed = 0usize;
+        let mut xy = 0f32;
+        let mut yy = 0f32;
+        if k > n / 2 {
+            let r = (k as f32 - 1.0) / sum;
+            for j in 0..n {
+                let p = (abs[j] * r).floor() as i32;
+                y[j] = p;
+                placed += p as usize;
+                xy += abs[j] * p as f32;
+                yy += (p * p) as f32;
+            }
+        }
+        while placed < k {
+            let mut best = 0usize;
+            let mut best_num = -1f32;
+            let mut best_den = 1f32;
+            for j in 0..n {
+                let num = xy + abs[j];
+                let num = num * num;
+                let den = yy + 2.0 * y[j] as f32 + 1.0;
+                if num * best_den > best_num * den {
+                    best_num = num;
+                    best_den = den;
+                    best = j;
+                }
+            }
+            xy += abs[best];
+            yy += 2.0 * y[best] as f32 + 1.0;
+            y[best] += 1;
+            placed += 1;
+        }
+        for j in 0..n {
+            if x[j] < 0.0 {
+                y[j] = -y[j];
+            }
+        }
+    }
+
+    #[test]
+    fn pvq_search_matches_scalar_reference() {
+        let mut state = 0x9e3779b97f4a7c15u64;
+        let mut rnd = move || {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            (state >> 40) as f32 / (1u64 << 24) as f32 * 2.0 - 1.0
+        };
+        let mut a = vec![0i32; 200];
+        let mut b = vec![0i32; 200];
+        let mut cases = 0;
+        for round in 0..6000 {
+            let n = 1 + (round * 37 + (rnd().abs() * 176.0) as usize) % 176;
+            let k = 1 + (rnd().abs() * 127.0) as usize;
+            let scale = [1.0f32, 1e-9, 1e6, 3e-3][round % 4];
+            let x: Vec<f32> = (0..n)
+                .map(|_| match round % 6 {
+                    0 => rnd(),
+                    1 => if rnd() > 0.8 { rnd() } else { 0.0 },
+                    2 => (rnd() * 4.0).round() / 4.0,
+                    3 => if rnd() > 0.0 { 1.0 } else { -1.0 },
+                    4 => rnd().powi(5),
+                    _ => if rnd() > 0.95 { 3.0 * rnd() } else { 1e-4 * rnd() },
+                } * scale)
+                .collect();
+            pvq_search(&x, k, &mut a);
+            pvq_search_ref(&x, k, &mut b);
+            assert_eq!(a[..n], b[..n], "n={n} k={k} round={round}");
+            cases += 1;
+        }
+        assert_eq!(cases, 6000);
+    }
+
     #[test]
     fn pvq_search_finds_good_direction() {
         let x: Vec<f32> = (0..32).map(|i| ((i as f32) * 0.7).sin()).collect();
diff --git a/crates/opusenc/src/energy.rs b/crates/opusenc/src/energy.rs
index 0057ae33a..1d4b12719 100644
--- a/crates/opusenc/src/energy.rs
+++ b/crates/opusenc/src/energy.rs
@@ -4,9 +4,10 @@
 //! The quantised energies are updated with exactly the decoder's arithmetic so the prediction
 //! state never drifts between encoder and decoder.
 
+use crate::CeltFrame;
 use crate::range::RangeEncoder;
-use crate::rate::MAX_FINE_BITS;
-use crate::tables::*;
+use crate::rate::{Allocation, MAX_FINE_BITS};
+use crate::tables::{BETA_COEF, BETA_INTRA, E_PROB_MODEL, NB_EBANDS, PRED_COEF, SMALL_ENERGY_ICDF};
 
 const LAPLACE_MINP: u32 = 1;
 const LAPLACE_NMIN: u32 = 16;
@@ -56,18 +57,8 @@ pub fn laplace_encode(enc: &mut RangeEncoder, value: i32, mut fs: u32, decay: u3
 /// `quant_coarse_energy` for one prediction mode. `e` holds the target log2 energies (relative
 /// to `E_MEANS`), `old_e` the quantised energies, updated in place. `budget` is the frame size in
 /// bits.
-#[allow(clippy::too_many_arguments)]
-pub fn quant_coarse_energy(
-    start: usize,
-    end: usize,
-    e: &[f32; 2 * NB_EBANDS],
-    old_e: &mut [f32; 2 * NB_EBANDS],
-    intra: bool,
-    enc: &mut RangeEncoder,
-    c: usize,
-    lm: usize,
-    budget: i32,
-) {
+pub fn quant_coarse_energy(frame: CeltFrame, e: &[f32; 2 * NB_EBANDS], old_e: &mut [f32; 2 * NB_EBANDS], intra: bool, enc: &mut RangeEncoder, budget: i32) {
+    let CeltFrame { start, end, channels: c, lm } = frame;
     let prob = &E_PROB_MODEL[lm][intra as usize];
     let (coef, beta) = if intra { (0.0, BETA_INTRA) } else { (PRED_COEF[lm], BETA_COEF[lm]) };
     let mut prev = [0f32; 2];
@@ -111,15 +102,8 @@ pub fn quant_coarse_energy(
 }
 
 /// `quant_fine_energy`: raw bits refining each band's quantised energy.
-pub fn quant_fine_energy(
-    start: usize,
-    end: usize,
-    e: &[f32; 2 * NB_EBANDS],
-    old_e: &mut [f32; 2 * NB_EBANDS],
-    fine_quant: &[i32; NB_EBANDS],
-    enc: &mut RangeEncoder,
-    c: usize,
-) {
+pub fn quant_fine_energy(frame: CeltFrame, e: &[f32; 2 * NB_EBANDS], old_e: &mut [f32; 2 * NB_EBANDS], fine_quant: &[i32; NB_EBANDS], enc: &mut RangeEncoder) {
+    let CeltFrame { start, end, channels: c, .. } = frame;
     for i in start..end {
         let fq = fine_quant[i];
         if fq <= 0 {
@@ -139,18 +123,16 @@ pub fn quant_fine_energy(
 
 /// `quant_energy_finalise`: spends the bits left at the end of the frame on one more bit of
 /// energy resolution per band, in priority order.
-#[allow(clippy::too_many_arguments)]
 pub fn quant_energy_finalise(
-    start: usize,
-    end: usize,
+    frame: CeltFrame,
     e: &[f32; 2 * NB_EBANDS],
     old_e: &mut [f32; 2 * NB_EBANDS],
-    fine_quant: &[i32; NB_EBANDS],
-    fine_priority: &[i32; NB_EBANDS],
+    allocation: &Allocation,
     mut bits_left: i32,
     enc: &mut RangeEncoder,
-    c: usize,
 ) {
+    let CeltFrame { start, end, channels: c, .. } = frame;
+    let Allocation { fine_quant, fine_priority, .. } = allocation;
     for prio in 0..2 {
         let mut i = start;
         while i < end && bits_left >= c as i32 {
diff --git a/crates/opusenc/src/lib.rs b/crates/opusenc/src/lib.rs
index 9cc1f6a51..b4346ebd6 100644
--- a/crates/opusenc/src/lib.rs
+++ b/crates/opusenc/src/lib.rs
@@ -24,8 +24,6 @@
 //! ```
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-// The bit-allocation code mirrors the normative integer arithmetic; keep C-like shift expressions.
-#![allow(clippy::precedence, clippy::int_plus_one)]
 
 mod bands;
 mod energy;
@@ -38,14 +36,23 @@ mod tables;
 
 use std::sync::OnceLock;
 
-use bands::{SPREAD_NORMAL, quant_all_bands};
+use bands::{BandCoding, SPREAD_NORMAL, quant_all_bands};
 use energy::{quant_coarse_energy, quant_energy_finalise, quant_fine_energy};
 use mdct::Mdct;
 use range::{BITRES, RangeEncoder};
-use rate::{Mode as CeltMode, compute_allocation};
+use rate::{AllocationInput, Mode as CeltMode, compute_allocation};
 use resample::Downsampler;
 use silk::SilkEncoder;
-use tables::*;
+use tables::{E_MEANS, EBANDS, NB_EBANDS, OVERLAP, PREEMPH, SPREAD_ICDF, TF_SELECT_TABLE, TRIM_ICDF};
+
+/// Band range, channel count and transform size shared by CELT coding stages.
+#[derive(Clone, Copy)]
+struct CeltFrame {
+    start: usize,
+    end: usize,
+    channels: usize,
+    lm: usize,
+}
 
 /// Samples per channel in one 20 ms frame at 48 kHz.
 const N: usize = 960;
@@ -314,7 +321,7 @@ impl OpusEncoder {
             Mode::Celt => {
                 let (log_e, silence) = self.celt_analysis(pcm);
                 let len = self.frame_bytes;
-                packet.extend_from_slice(&self.encode_celt(RangeEncoder::new(), len, 0, NB_EBANDS, &log_e, silence));
+                packet.extend_from_slice(&self.encode_celt(RangeEncoder::new(), len, 0..NB_EBANDS, &log_e, silence));
             }
             Mode::Silk => {
                 let x = self.silk_input(pcm);
@@ -344,7 +351,7 @@ impl OpusEncoder {
                 }
                 let (log_e, _) = self.celt_analysis(pcm);
                 let end = if self.bandwidth == Bandwidth::SuperWideband { 19 } else { NB_EBANDS };
-                packet.extend_from_slice(&self.encode_celt(enc, len, HYBRID_START_BAND, end, &log_e, false));
+                packet.extend_from_slice(&self.encode_celt(enc, len, HYBRID_START_BAND..end, &log_e, false));
             }
         }
         packet
@@ -406,10 +413,11 @@ impl OpusEncoder {
     /// Codes one CELT frame (RFC 6716 §4.3, in bitstream order) of `len` bytes into `enc`
     /// (which already holds the SILK frame in hybrid mode), coding bands `start..end`, and
     /// finalises the frame.
-    #[allow(clippy::too_many_arguments)]
-    fn encode_celt(&mut self, mut enc: RangeEncoder, len: usize, start: usize, end: usize, log_e: &[f32; 2 * NB_EBANDS], silence: bool) -> Vec<u8> {
+    fn encode_celt(&mut self, mut enc: RangeEncoder, len: usize, bands: std::ops::Range<usize>, log_e: &[f32; 2 * NB_EBANDS], silence: bool) -> Vec<u8> {
         let m = celt_mode();
         let c = self.channels;
+        let frame = CeltFrame { start: bands.start, end: bands.end, channels: c, lm: LM };
+        let CeltFrame { start, end, .. } = frame;
         if c == 1 {
             for i in 0..NB_EBANDS {
                 self.old_band_e[i] = self.old_band_e[i].max(self.old_band_e[NB_EBANDS + i]);
@@ -438,10 +446,10 @@ impl OpusEncoder {
             let mut enc_intra = enc.clone();
             let mut old_intra = self.old_band_e;
             enc_intra.bit_logp(true, 3);
-            quant_coarse_energy(start, end, log_e, &mut old_intra, true, &mut enc_intra, c, LM, total_bits_raw);
+            quant_coarse_energy(frame, log_e, &mut old_intra, true, &mut enc_intra, total_bits_raw);
             enc.bit_logp(false, 3);
             let mut old_inter = self.old_band_e;
-            quant_coarse_energy(start, end, log_e, &mut old_inter, false, &mut enc, c, LM, total_bits_raw);
+            quant_coarse_energy(frame, log_e, &mut old_inter, false, &mut enc, total_bits_raw);
             if enc_intra.tell_frac() < enc.tell_frac() {
                 enc = enc_intra;
                 self.old_band_e = old_intra;
@@ -449,14 +457,14 @@ impl OpusEncoder {
                 self.old_band_e = old_inter;
             }
         } else {
-            quant_coarse_energy(start, end, log_e, &mut self.old_band_e, false, &mut enc, c, LM, total_bits_raw);
+            quant_coarse_energy(frame, log_e, &mut self.old_band_e, false, &mut enc, total_bits_raw);
         }
         // TF resolution: no changes.
         {
             let mut budget = total_bits_raw;
             let mut tell = enc.tell();
             let mut logp = 4;
-            let tf_select_rsv = LM > 0 && tell + logp + 1 <= budget;
+            let tf_select_rsv = LM > 0 && tell + logp < budget;
             budget -= tf_select_rsv as i32;
             for _ in start..end {
                 if tell + logp <= budget {
@@ -488,27 +496,11 @@ impl OpusEncoder {
             enc.icdf(alloc_trim as usize, &TRIM_ICDF, 7);
         }
         let bits = (total_bits_raw << BITRES) - enc.tell_frac() - 1;
-        let alloc = compute_allocation(m, start, end, &offsets, &cap, alloc_trim, bits, c, LM, &mut enc);
-        quant_fine_energy(start, end, log_e, &mut self.old_band_e, &alloc.fine_quant, &mut enc, c);
-        quant_all_bands(
-            m,
-            start,
-            end,
-            &self.freq,
-            N,
-            c,
-            &alloc.pulses,
-            SPREAD_NORMAL,
-            alloc.dual_stereo,
-            alloc.intensity,
-            total_bits_raw << BITRES,
-            alloc.balance,
-            &mut enc,
-            LM,
-            alloc.coded_bands,
-        );
+        let alloc = compute_allocation(m, frame, AllocationInput { offsets: &offsets, cap: &cap, trim: alloc_trim, bits }, &mut enc);
+        quant_fine_energy(frame, log_e, &mut self.old_band_e, &alloc.fine_quant, &mut enc);
+        quant_all_bands(m, frame, &self.freq, N, &alloc, BandCoding { spread: SPREAD_NORMAL, total_bits: total_bits_raw << BITRES }, &mut enc);
         let bits_left = total_bits_raw - enc.tell();
-        quant_energy_finalise(start, end, log_e, &mut self.old_band_e, &alloc.fine_quant, &alloc.fine_priority, bits_left, &mut enc, c);
+        quant_energy_finalise(frame, log_e, &mut self.old_band_e, &alloc, bits_left, &mut enc);
         debug_assert!(enc.tell() <= total_bits_raw, "frame overflow: {} > {}", enc.tell(), total_bits_raw);
         if c == 1 {
             let (a, b) = self.old_band_e.split_at_mut(NB_EBANDS);
diff --git a/crates/opusenc/src/mdct.rs b/crates/opusenc/src/mdct.rs
index 814de0375..131c4a7a1 100644
--- a/crates/opusenc/src/mdct.rs
+++ b/crates/opusenc/src/mdct.rs
@@ -24,6 +24,10 @@ impl Cpx {
     fn add(self, o: Cpx) -> Cpx {
         Cpx { re: self.re + o.re, im: self.im + o.im }
     }
+    #[inline]
+    fn sub(self, o: Cpx) -> Cpx {
+        Cpx { re: self.re - o.re, im: self.im - o.im }
+    }
 }
 
 /// Mixed-radix (2, 3, 4, 5) forward complex FFT, unscaled (decimation in time, recursive).
@@ -71,18 +75,64 @@ impl Fft {
                 self.rec(&mut out[q * m..(q + 1) * m], &inp[q * in_stride..], in_stride * p, m, fi + 1, tw_stride * p);
             }
         }
-        let big = self.n;
-        let mut t = [Cpx::default(); 5];
-        for k in 0..m {
-            for (q, tq) in t.iter_mut().enumerate().take(p) {
-                *tq = out[q * m + k].mul(self.twiddle[(q * k * tw_stride) % big]);
+        // The twiddle index q * k * tw_stride is always below n, so no modulo is needed.
+        let tw = &self.twiddle;
+        match p {
+            2 => {
+                for k in 0..m {
+                    let a0 = out[k];
+                    let a1 = out[m + k].mul(tw[k * tw_stride]);
+                    out[k] = a0.add(a1);
+                    out[m + k] = a0.sub(a1);
+                }
             }
-            for q2 in 0..p {
-                let mut acc = Cpx::default();
-                for (q, tq) in t.iter().enumerate().take(p) {
-                    acc = acc.add(tq.mul(self.twiddle[((q * q2) % p) * (big / p)]));
+            4 => {
+                for k in 0..m {
+                    let t0 = out[k];
+                    let t1 = out[m + k].mul(tw[k * tw_stride]);
+                    let t2 = out[2 * m + k].mul(tw[2 * k * tw_stride]);
+                    let t3 = out[3 * m + k].mul(tw[3 * k * tw_stride]);
+                    let (s0, d0) = (t0.add(t2), t0.sub(t2));
+                    let (s1, d1) = (t1.add(t3), t1.sub(t3));
+                    out[k] = s0.add(s1);
+                    out[2 * m + k] = s0.sub(s1);
+                    // The odd outputs combine d0 with -j * d1 = (d1.im, -d1.re) and its negative.
+                    out[m + k] = Cpx { re: d0.re + d1.im, im: d0.im - d1.re };
+                    out[3 * m + k] = Cpx { re: d0.re - d1.im, im: d0.im + d1.re };
+                }
+            }
+            3 => {
+                // Imaginary part of exp(-2 pi i / 3) = -sqrt(3) / 2.
+                let h = tw[self.n / 3].im;
+                for k in 0..m {
+                    let t0 = out[k];
+                    let t1 = out[m + k].mul(tw[k * tw_stride]);
+                    let t2 = out[2 * m + k].mul(tw[2 * k * tw_stride]);
+                    let (s, d) = (t1.add(t2), t1.sub(t2));
+                    let a = Cpx { re: t0.re - 0.5 * s.re, im: t0.im - 0.5 * s.im };
+                    out[k] = t0.add(s);
+                    // j * h * d = (-h * d.im, h * d.re)
+                    out[m + k] = Cpx { re: a.re - h * d.im, im: a.im + h * d.re };
+                    out[2 * m + k] = Cpx { re: a.re + h * d.im, im: a.im - h * d.re };
+                }
+            }
+            _ => {
+                // Generic DFT butterfly (radix 5, once per transform).
+                let roots: [Cpx; 5] = std::array::from_fn(|q| if q < p { tw[q * (self.n / p)] } else { Cpx::default() });
+                let mut t = [Cpx::default(); 5];
+                for k in 0..m {
+                    t[0] = out[k];
+                    for q in 1..p {
+                        t[q] = out[q * m + k].mul(tw[q * k * tw_stride]);
+                    }
+                    for q2 in 0..p {
+                        let mut acc = t[0];
+                        for q in 1..p {
+                            acc = acc.add(t[q].mul(roots[(q * q2) % p]));
+                        }
+                        out[q2 * m + k] = acc;
+                    }
                 }
-                out[q2 * m + k] = acc;
             }
         }
     }
@@ -198,6 +248,26 @@ mod tests {
             .collect()
     }
 
+    #[test]
+    fn fft_matches_dft() {
+        // Every radix combination, including the 480-point size of the 20 ms frame.
+        for &n in &[2usize, 3, 4, 5, 6, 8, 12, 15, 16, 20, 24, 30, 48, 60, 120, 240, 480] {
+            let fft = Fft::new(n);
+            let x: Vec<Cpx> = (0..n).map(|i| Cpx { re: ((i * 37 % 101) as f32 - 50.0) / 7.0, im: ((i * 53 % 89) as f32 - 44.0) / 9.0 }).collect();
+            let mut y = x.clone();
+            fft.process(&mut y, &mut Vec::new());
+            for k in 0..n {
+                let (mut re, mut im) = (0f64, 0f64);
+                for (j, v) in x.iter().enumerate() {
+                    let ph = -2.0 * std::f64::consts::PI * ((j * k) % n) as f64 / n as f64;
+                    re += v.re as f64 * ph.cos() - v.im as f64 * ph.sin();
+                    im += v.re as f64 * ph.sin() + v.im as f64 * ph.cos();
+                }
+                assert!((y[k].re as f64 - re).abs() < 2e-3 && (y[k].im as f64 - im).abs() < 2e-3, "n={n} k={k}: ({}, {}) vs ({re}, {im})", y[k].re, y[k].im);
+            }
+        }
+    }
+
     #[test]
     fn matches_direct_formula() {
         for &n in &[240usize, 960] {
diff --git a/crates/opusenc/src/rate.rs b/crates/opusenc/src/rate.rs
index a6ae81f5c..ff6ccae95 100644
--- a/crates/opusenc/src/rate.rs
+++ b/crates/opusenc/src/rate.rs
@@ -4,8 +4,9 @@
 //! spec-derived `filmcraft-opus` decoder (first-party, MIT OR Apache-2.0) step by step; the only
 //! difference is that the encoder *writes* the band-skip, intensity and dual-stereo symbols.
 
+use crate::CeltFrame;
 use crate::range::{BITRES, RangeEncoder, ilog};
-use crate::tables::*;
+use crate::tables::{ALLOC, EBANDS, LOG2_FRAC_TABLE, MAX_LM, NB_EBANDS};
 
 const MAX_PSEUDO: i32 = 40;
 const LOG_MAX_PSEUDO: i32 = 6;
@@ -127,7 +128,7 @@ impl Mode {
         let mut cap = [0i32; NB_EBANDS];
         for (i, cp) in cap.iter_mut().enumerate() {
             let n = (EBANDS[i + 1] - EBANDS[i]) << lm;
-            *cp = (self.caps[NB_EBANDS * (2 * lm + c - 1) + i] as i32 + 64) * c as i32 * n >> 2;
+            *cp = ((self.caps[NB_EBANDS * (2 * lm + c - 1) + i] as i32 + 64) * c as i32 * n) >> 2;
         }
         cap
     }
@@ -200,7 +201,7 @@ fn compute_caps(m: &Mode) -> Vec<u8> {
                 let mut n0 = EBANDS[j + 1] - EBANDS[j];
 
                 let max_bits = if n0 << i == 1 {
-                    c * (1 + MAX_FINE_BITS) << BITRES
+                    (c * (1 + MAX_FINE_BITS)) << BITRES
                 } else {
                     let mut lm0 = 0;
                     if n0 > 2 {
@@ -240,7 +241,7 @@ fn compute_caps(m: &Mode) -> Vec<u8> {
                     let num = mb + ndof * offset;
                     let den = (ndof - 1) << BITRES;
                     let qb = ((num + (den >> 1)) / den).min(MAX_FINE_BITS);
-                    mb += c * qb << BITRES;
+                    mb += (c * qb) << BITRES;
                     mb
                 };
                 let w = c * ((EBANDS[j + 1] - EBANDS[j]) << i);
@@ -263,21 +264,19 @@ pub struct Allocation {
     pub fine_priority: [i32; NB_EBANDS],
 }
 
+/// Per-band limits, boosts and available budget for the allocation search.
+pub struct AllocationInput<'a> {
+    pub offsets: &'a [i32; NB_EBANDS],
+    pub cap: &'a [i32; NB_EBANDS],
+    pub trim: i32,
+    pub bits: i32,
+}
+
 /// `clt_compute_allocation`, encoder side. Stereo frames are always coded as dual (L/R) stereo
 /// with no intensity bands, and no band is skipped voluntarily.
-#[allow(clippy::too_many_arguments)]
-pub fn compute_allocation(
-    m: &Mode,
-    start: usize,
-    end: usize,
-    offsets: &[i32; NB_EBANDS],
-    cap: &[i32; NB_EBANDS],
-    alloc_trim: i32,
-    total: i32,
-    c: usize,
-    lm: usize,
-    enc: &mut RangeEncoder,
-) -> Allocation {
+pub fn compute_allocation(m: &Mode, frame: CeltFrame, input: AllocationInput<'_>, enc: &mut RangeEncoder) -> Allocation {
+    let CeltFrame { start, end, channels: c, lm } = frame;
+    let AllocationInput { offsets, cap, trim: alloc_trim, bits: total } = input;
     let ci = c as i32;
     let lmi = lm as i32;
     let mut total = total.max(0);
@@ -302,8 +301,8 @@ pub fn compute_allocation(
     let mut trim_offset = [0i32; NB_EBANDS];
     for j in start..end {
         let w = EBANDS[j + 1] - EBANDS[j];
-        thresh[j] = (ci << BITRES).max((3 * w << lmi << BITRES) >> 4);
-        trim_offset[j] = ci * w * (alloc_trim - 5 - lmi) * (end as i32 - j as i32 - 1) * (1 << (lmi + BITRES as i32)) >> 6;
+        thresh[j] = (ci << BITRES).max(((3 * w) << lmi << BITRES) >> 4);
+        trim_offset[j] = (ci * w * (alloc_trim - 5 - lmi) * (end as i32 - j as i32 - 1) * (1 << (lmi + BITRES as i32))) >> 6;
         if w << lmi == 1 {
             trim_offset[j] -= ci << BITRES;
         }
@@ -317,7 +316,7 @@ pub fn compute_allocation(
         let mid = (lo + hi) >> 1;
         for j in (start..end).rev() {
             let n = EBANDS[j + 1] - EBANDS[j];
-            let mut bitsj = ci * n * (ALLOC[mid as usize][j] as i32) << lmi >> 2;
+            let mut bitsj = (ci * n * (ALLOC[mid as usize][j] as i32)) << lmi >> 2;
             if bitsj > 0 {
                 bitsj = (bitsj + trim_offset[j]).max(0);
             }
@@ -342,8 +341,8 @@ pub fn compute_allocation(
     lo -= 1;
     for j in start..end {
         let n = EBANDS[j + 1] - EBANDS[j];
-        let mut bits1j = ci * n * (ALLOC[lo as usize][j] as i32) << lmi >> 2;
-        let mut bits2j = if hi >= nb_alloc { cap[j] } else { ci * n * (ALLOC[hi as usize][j] as i32) << lmi >> 2 };
+        let mut bits1j = (ci * n * (ALLOC[lo as usize][j] as i32)) << lmi >> 2;
+        let mut bits2j = if hi >= nb_alloc { cap[j] } else { (ci * n * (ALLOC[hi as usize][j] as i32)) << lmi >> 2 };
         if bits1j > 0 {
             bits1j = (bits1j + trim_offset[j]).max(0);
         }
@@ -361,27 +360,27 @@ pub fn compute_allocation(
         bits1[j] = bits1j;
         bits2[j] = bits2j;
     }
-    interp_bits2pulses(m, start, end, skip_start, &bits1, &bits2, &thresh, cap, total, skip_rsv, intensity_rsv, dual_stereo_rsv, c, lm, enc)
+    let interpolation =
+        AllocationInterpolation { skip_start, bits1: &bits1, bits2: &bits2, thresh: &thresh, cap, total, skip_rsv, intensity_rsv, dual_stereo_rsv };
+    interp_bits2pulses(m, frame, interpolation, enc)
 }
 
-#[allow(clippy::too_many_arguments)]
-fn interp_bits2pulses(
-    m: &Mode,
-    start: usize,
-    end: usize,
+/// Bracketing allocation vectors and signalling reserves for the interpolation stage.
+struct AllocationInterpolation<'a> {
     skip_start: usize,
-    bits1: &[i32; NB_EBANDS],
-    bits2: &[i32; NB_EBANDS],
-    thresh: &[i32; NB_EBANDS],
-    cap: &[i32; NB_EBANDS],
-    mut total: i32,
+    bits1: &'a [i32; NB_EBANDS],
+    bits2: &'a [i32; NB_EBANDS],
+    thresh: &'a [i32; NB_EBANDS],
+    cap: &'a [i32; NB_EBANDS],
+    total: i32,
     skip_rsv: i32,
-    mut intensity_rsv: i32,
-    mut dual_stereo_rsv: i32,
-    c: usize,
-    lm: usize,
-    enc: &mut RangeEncoder,
-) -> Allocation {
+    intensity_rsv: i32,
+    dual_stereo_rsv: i32,
+}
+
+fn interp_bits2pulses(m: &Mode, frame: CeltFrame, interpolation: AllocationInterpolation<'_>, enc: &mut RangeEncoder) -> Allocation {
+    let CeltFrame { start, end, channels: c, lm } = frame;
+    let AllocationInterpolation { skip_start, bits1, bits2, thresh, cap, mut total, skip_rsv, mut intensity_rsv, mut dual_stereo_rsv } = interpolation;
     let ci = c as i32;
     let alloc_floor = ci << BITRES;
     let stereo = (c > 1) as i32;
@@ -393,7 +392,7 @@ fn interp_bits2pulses(
         let mut psum = 0;
         let mut done = false;
         for j in (start..end).rev() {
-            let tmp = bits1[j] + (mid * bits2[j] >> ALLOC_STEPS);
+            let tmp = bits1[j] + ((mid * bits2[j]) >> ALLOC_STEPS);
             if tmp >= thresh[j] || done {
                 done = true;
                 psum += tmp.min(cap[j]);
@@ -411,7 +410,7 @@ fn interp_bits2pulses(
     let mut psum = 0;
     let mut done = false;
     for j in (start..end).rev() {
-        let mut tmp = bits1[j] + (lo * bits2[j] >> ALLOC_STEPS);
+        let mut tmp = bits1[j] + ((lo * bits2[j]) >> ALLOC_STEPS);
         if tmp < thresh[j] && !done {
             tmp = if tmp >= alloc_floor { alloc_floor } else { 0 };
         } else {
@@ -500,9 +499,9 @@ fn interp_bits2pulses(
             if n == 2 {
                 offset += (den << BITRES) >> 2;
             }
-            if bits[j] + offset < den * 2 << BITRES {
+            if bits[j] + offset < (den * 2) << BITRES {
                 offset += nclogn >> 2;
-            } else if bits[j] + offset < den * 3 << BITRES {
+            } else if bits[j] + offset < (den * 3) << BITRES {
                 offset += nclogn >> 3;
             }
             let mut eb = (bits[j] + offset + (den << (BITRES - 1))).max(0);
@@ -513,7 +512,7 @@ fn interp_bits2pulses(
             eb = eb.min(MAX_FINE_BITS);
             ebits[j] = eb;
             fine_priority[j] = (eb * (den << BITRES) >= bits[j] + offset) as i32;
-            bits[j] -= ci * eb << BITRES;
+            bits[j] -= (ci * eb) << BITRES;
         } else {
             excess = (bit - (ci << BITRES)).max(0);
             bits[j] = bit - excess;
@@ -523,7 +522,7 @@ fn interp_bits2pulses(
         if excess > 0 {
             let extra_fine = (excess >> (stereo + BITRES as i32)).min(MAX_FINE_BITS - ebits[j]);
             ebits[j] += extra_fine;
-            let extra_bits = extra_fine * ci << BITRES;
+            let extra_bits = (extra_fine * ci) << BITRES;
             fine_priority[j] = (extra_bits >= excess - balance) as i32;
             excess -= extra_bits;
         }
diff --git a/crates/opusenc/src/resample.rs b/crates/opusenc/src/resample.rs
index 9045cb86d..1acc9a4e7 100644
--- a/crates/opusenc/src/resample.rs
+++ b/crates/opusenc/src/resample.rs
@@ -45,6 +45,25 @@ fn design(fc: f64, beta: f64, delay: usize) -> Vec<f32> {
     h.iter().map(|&v| v as f32).collect()
 }
 
+/// Dot product with eight independent partial sums, which the compiler can vectorise (a single
+/// running sum is bound by the latency of the float addition). The sums are combined pairwise.
+#[inline]
+fn dot8(a: &[f32], b: &[f32]) -> f32 {
+    let mut s = [0f32; 8];
+    let (ca, ra) = a.as_chunks::<8>();
+    let (cb, rb) = b.as_chunks::<8>();
+    for (x, y) in ca.iter().zip(cb) {
+        for l in 0..8 {
+            s[l] += x[l] * y[l];
+        }
+    }
+    let mut acc = ((s[0] + s[4]) + (s[1] + s[5])) + ((s[2] + s[6]) + (s[3] + s[7]));
+    for (x, y) in ra.iter().zip(rb) {
+        acc += x * y;
+    }
+    acc
+}
+
 /// Decimates one channel of 48 kHz audio by 3, 4 or 6.
 #[derive(Clone)]
 pub struct Downsampler {
@@ -77,7 +96,7 @@ impl Downsampler {
             let t = taps - 1 + self.factor * j;
             let win = &self.buf[t + 1 - taps..=t];
             // h is symmetric, so the window can be taken in forward order.
-            out.push(win.iter().zip(&self.h).map(|(a, b)| a * b).sum());
+            out.push(dot8(win, &self.h));
         }
         let n = self.buf.len();
         self.buf.copy_within(n - (taps - 1).., 0);
@@ -97,6 +116,16 @@ mod tests {
         (x.iter().map(|&v| (v as f64).powi(2)).sum::<f64>() / x.len() as f64).sqrt()
     }
 
+    #[test]
+    fn dot8_matches_sequential_sum() {
+        for len in [0usize, 1, 7, 8, 9, 63, 167, 251] {
+            let a: Vec<f32> = (0..len).map(|i| ((i * 37 % 101) as f32 - 50.0) / 50.0).collect();
+            let b: Vec<f32> = (0..len).map(|i| ((i * 53 % 89) as f32 - 44.0) / 44.0).collect();
+            let exact: f64 = a.iter().zip(&b).map(|(&x, &y)| x as f64 * y as f64).sum();
+            assert!((dot8(&a, &b) as f64 - exact).abs() < 1e-4, "len {len}");
+        }
+    }
+
     #[test]
     fn passes_band_and_rejects_aliases() {
         for &(fs, pass, stop) in &[(16_000u32, 6_000.0, 8_600.0), (12_000, 4_500.0, 6_500.0), (8_000, 3_000.0, 4_500.0)] {
diff --git a/crates/opusenc/src/silk/mod.rs b/crates/opusenc/src/silk.rs
similarity index 79%
rename from crates/opusenc/src/silk/mod.rs
rename to crates/opusenc/src/silk.rs
index c7a4b8692..9e202c958 100644
--- a/crates/opusenc/src/silk/mod.rs
+++ b/crates/opusenc/src/silk.rs
@@ -16,8 +16,12 @@ mod pulses;
 #[allow(dead_code)]
 pub(crate) mod tables;
 
-use lpc::*;
-use tables::*;
+use lpc::{MAX_LPC_ORDER, div32_varq, inverse32_varq, nlsf2a, rshift_round, sat16, smlawb, smulwb, smulww};
+use tables::{
+    DELTA_GAIN, GAIN_MSB, LTP_FILTER, LTP_PERIODICITY, LTP_SCALE, LTP_TAPS_0, LTP_TAPS_1, LTP_TAPS_2, MID_ONLY, NLSF_EXT, NLSF_INTERP, NLSF_SEL_NBMB,
+    NLSF_SEL_WB, NLSF_STAGE1, NLSF_STAGE2, PITCH_CONTOUR, PITCH_HIGH, PITCH_LOW, STEREO_PRED_JOINT, STEREO_WEIGHTS_Q13, TYPE_ACTIVE, TYPE_INACTIVE, UNIFORM3,
+    UNIFORM4, UNIFORM5, UNIFORM8,
+};
 
 use crate::range::RangeEncoder;
 
@@ -121,6 +125,48 @@ struct Coded {
     pulses: Vec<i32>,
 }
 
+/// Noise-feedback history (decoded − input), most recent first, as a double-length ring: each
+/// sample is stored at `pos` and `pos + MAX_LPC_ORDER`, so `buf[pos..pos + MAX_LPC_ORDER]` is
+/// always the contiguous window and a push costs two stores instead of a shift.
+struct NfRing {
+    buf: [f64; 2 * MAX_LPC_ORDER],
+    /// Index of the most recent sample, always below `MAX_LPC_ORDER`.
+    pos: usize,
+}
+
+impl NfRing {
+    fn new(hist: &[f64; MAX_LPC_ORDER]) -> Self {
+        let mut buf = [0.0; 2 * MAX_LPC_ORDER];
+        buf[..MAX_LPC_ORDER].copy_from_slice(hist);
+        buf[MAX_LPC_ORDER..].copy_from_slice(hist);
+        NfRing { buf, pos: 0 }
+    }
+
+    /// The history, most recent first.
+    fn window(&self) -> &[f64] {
+        self.buf.get(self.pos..self.pos + MAX_LPC_ORDER).unwrap_or(&[])
+    }
+
+    /// Makes `v` the most recent sample and drops the oldest.
+    fn push(&mut self, v: f64) {
+        self.pos = self.pos.checked_sub(1).unwrap_or(MAX_LPC_ORDER - 1);
+        for i in [self.pos, self.pos + MAX_LPC_ORDER] {
+            if let Some(slot) = self.buf.get_mut(i) {
+                *slot = v;
+            }
+        }
+    }
+
+    /// The history as a plain array, most recent first.
+    fn to_array(&self) -> [f64; MAX_LPC_ORDER] {
+        let mut out = [0.0; MAX_LPC_ORDER];
+        for (o, v) in out.iter_mut().zip(self.window()) {
+            *o = *v;
+        }
+        out
+    }
+}
+
 #[derive(Clone)]
 struct Channel {
     fs_khz: usize,
@@ -229,7 +275,7 @@ impl Channel {
         let sub = self.sub;
         let order = self.order;
         let st = &mut self.dec;
-        let nf = &mut self.nf;
+        let mut ring = NfRing::new(&self.nf);
         let off = if p.signal_type == 0 { offset + INACTIVE_OFFSET } else { offset };
         let gamma = nf_gamma(off);
         let mut nf_c = [0f64; MAX_LPC_ORDER];
@@ -347,7 +393,7 @@ impl Channel {
                 }
                 let lpc_q14 = lpc_pred.saturating_mul(16);
                 // Target excitation (Q14) for this sample.
-                let fb: f64 = (0..order).map(|j| nf_c[j] * nf[j]).sum();
+                let fb: f64 = nf_c.iter().zip(ring.window()).take(order).map(|(c, e)| c * e).sum();
                 let tgt = (x[n] as f64 + fb).clamp(-32768.0, 32767.0) * inv_g - lpc_q14 as f64 - ltp_q14 as f64;
                 let sgn = if seed_v < 0 { -1.0 } else { 1.0 };
                 let u = sgn * tgt;
@@ -386,11 +432,11 @@ impl Channel {
                 let v = res.saturating_add(lpc_q14);
                 s_lpc[MAX_LPC_ORDER + i] = v;
                 xq[n] = sat16(rshift_round(smulww(v, gain_q10), 8)) as i16;
-                nf.copy_within(0..MAX_LPC_ORDER - 1, 1);
-                nf[0] = xq[n] as f64 - x[n] as f64;
+                ring.push(xq[n] as f64 - x[n] as f64);
             }
             s_lpc.copy_within(sub..sub + MAX_LPC_ORDER, 0);
         }
+        self.nf = ring.to_array();
         st.s_lpc_q14.copy_from_slice(&s_lpc[..MAX_LPC_ORDER]);
         st.out_buf[..l].copy_from_slice(&xq);
         (Coded { gain_ix, gains_q16, seed, pulses }, xq)
@@ -477,6 +523,14 @@ struct Prep {
     pred_q13: [i32; 2],
 }
 
+/// One rate-loop trial: the frame coded at gain offset `offset`.
+struct Trial {
+    offset: f64,
+    bits: i32,
+    state: SilkEncoder,
+    coder: RangeEncoder,
+}
+
 /// SILK encoder for one mono or stereo (mid/side) stream.
 #[derive(Clone)]
 pub struct SilkEncoder {
@@ -627,11 +681,20 @@ impl SilkEncoder {
     pub fn encode(&mut self, input: &[Vec<f32>], target_bits: f64, max_bits: i32, enc: &mut RangeEncoder) {
         let prep = self.prepare(input);
         let start_bits = enc.tell();
-        let trial = |s: &Self, o: f64| -> i32 {
-            let mut t = s.clone();
-            let mut e = enc.clone();
-            t.code(&prep, o, &mut e);
-            e.tell() - start_bits
+        // Every trial codes the frame into a clone of the encoder and the range coder. The result
+        // is kept per offset: the hard-limit check below hits the memo for the chosen offset, and
+        // the final step adopts that trial instead of coding the frame once more.
+        let mut trials: Vec<Trial> = Vec::new();
+        let mut trial = |s: &Self, o: f64| -> i32 {
+            if let Some(t) = trials.iter().find(|t| t.offset == o) {
+                return t.bits;
+            }
+            let mut state = s.clone();
+            let mut coder = enc.clone();
+            state.code(&prep, o, &mut coder);
+            let bits = coder.tell() - start_bits;
+            trials.push(Trial { offset: o, bits, state, coder });
+            bits
         };
         // Bisection on the gain offset: the smallest offset (finest quantisation) within budget.
         let target = target_bits.min(max_bits as f64);
@@ -693,8 +756,20 @@ impl SilkEncoder {
         while trial(self, o) > max_bits && o < 12.0 {
             o += 1.0;
         }
+        match trials.iter().position(|t| t.offset == o) {
+            Some(i) => {
+                let t = trials.swap_remove(i);
+                *self = t.state;
+                *enc = t.coder;
+            }
+            None => self.code(&prep, o, enc),
+        }
+        self.end_frame(&prep, o);
+    }
+
+    /// Advances the input history and the frame counter after frame `prep` was coded at `o`.
+    fn end_frame(&mut self, prep: &Prep, o: f64) {
         self.last_offset = o;
-        self.code(&prep, o, enc);
         for ch in 0..self.channels {
             self.ch[ch].push_history(&prep.x[ch]);
         }
@@ -704,3 +779,80 @@ impl SilkEncoder {
         self.frame += 1;
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Deterministic speech-like test input: two harmonics with a moving pitch, a syllable
+    /// envelope, noise and short silences, at the internal rate and 16-bit scale.
+    fn signal(len: usize, fs_khz: usize, seed: u32) -> Vec<f32> {
+        let mut s = seed;
+        let fs = (fs_khz * 1000) as f64;
+        (0..len)
+            .map(|i| {
+                s = s.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+                let noise = (s >> 8) as f64 / (1u32 << 24) as f64 - 0.5;
+                let t = i as f64 / fs;
+                let f0 = 140.0 + 40.0 * (t * 1.3).sin();
+                let env = ((t * 4.0).sin().max(0.0)).powf(0.7);
+                let voiced = (std::f64::consts::TAU * f0 * t).sin() + 0.5 * (std::f64::consts::TAU * 2.0 * f0 * t).sin();
+                (8000.0 * env * voiced + 600.0 * noise) as f32
+            })
+            .collect()
+    }
+
+    #[test]
+    fn nf_ring_matches_a_shifted_history() {
+        let mut hist = [0f64; MAX_LPC_ORDER];
+        for (i, h) in hist.iter_mut().enumerate() {
+            *h = i as f64 * 0.5 - 3.0;
+        }
+        let mut ring = NfRing::new(&hist);
+        assert_eq!(ring.window(), &hist[..]);
+        for n in 0..100 {
+            let v = (n as f64 * 0.37).sin() * 100.0;
+            hist.copy_within(0..MAX_LPC_ORDER - 1, 1);
+            hist[0] = v;
+            ring.push(v);
+            assert_eq!(ring.window(), &hist[..], "after push {n}");
+        }
+        assert_eq!(ring.to_array(), hist);
+    }
+
+    /// The rate loop adopts the memoised trial for the chosen offset. A second encoder that codes
+    /// every frame afresh at that offset (what the loop did before the memo) must produce the
+    /// same bytes, frame after frame, so the adopted encoder and range-coder states are exact.
+    #[test]
+    fn adopting_the_memoised_trial_equals_coding_the_frame_again() {
+        for (fs_khz, channels, target_bits, max_bits) in
+            [(8, 1, 200.0, 1000), (12, 1, 320.0, 1000), (16, 1, 480.0, 1000), (16, 2, 640.0, 1000), (16, 1, 900.0, 400), (8, 2, 120.0, 160)]
+        {
+            let mut memo = SilkEncoder::new(fs_khz, channels);
+            let mut fresh = memo.clone();
+            let l = memo.frame_len();
+            let frames = 40;
+            let left = signal(l * frames, fs_khz, 7);
+            let right: Vec<f32> = signal(l * frames + 37, fs_khz, 11)[37..].iter().map(|v| v * 0.6).collect();
+            for f in 0..frames {
+                let mut input = vec![left[f * l..(f + 1) * l].to_vec()];
+                if channels == 2 {
+                    input.push(right[f * l..(f + 1) * l].to_vec());
+                }
+                let mut enc = RangeEncoder::new();
+                memo.encode(&input, target_bits, max_bits, &mut enc);
+                let o = memo.last_offset;
+                let prep = fresh.prepare(&input);
+                let mut enc_fresh = RangeEncoder::new();
+                fresh.code(&prep, o, &mut enc_fresh);
+                fresh.end_frame(&prep, o);
+                assert_eq!(enc.tell(), enc_fresh.tell(), "{fs_khz} kHz {channels} ch frame {f}");
+                assert_eq!(enc.done(1275), enc_fresh.done(1275), "{fs_khz} kHz {channels} ch frame {f}");
+                for c in 0..channels {
+                    assert_eq!(memo.ch[c].nf, fresh.ch[c].nf, "noise feedback, channel {c}, frame {f}");
+                    assert_eq!(memo.ch[c].dec.s_lpc_q14, fresh.ch[c].dec.s_lpc_q14, "LPC state, channel {c}, frame {f}");
+                }
+            }
+        }
+    }
+}
diff --git a/crates/opusenc/src/silk/analysis.rs b/crates/opusenc/src/silk/analysis.rs
index de510433e..d80052046 100644
--- a/crates/opusenc/src/silk/analysis.rs
+++ b/crates/opusenc/src/silk/analysis.rs
@@ -1,7 +1,7 @@
 //! Encoder-side signal analysis for SILK (own design): windowed autocorrelation LPC, LPC → NLSF
 //! conversion, open-loop pitch search and LTP codebook search.
 
-use super::tables::*;
+use super::tables::{CB_NB_20, CB_WB_20, LTP_FILTER, LTP_PERIODICITY, LTP_TAPS_0, LTP_TAPS_1, LTP_TAPS_2};
 
 /// Short-term prediction coefficients `a` (prediction `x[n] ≈ Σ a[j] x[n-1-j]`) from the
 /// windowed segment `x`, with a Gaussian lag window and white-noise correction.
@@ -69,28 +69,55 @@ pub fn levinson(r: &[f64], order: usize) -> Vec<f64> {
 }
 
 /// Evaluates the symmetric polynomial `p` (length `d + 1`, `d` even) as the cosine series
-/// `e^{jωd/2} P(e^{jω})`.
-fn cos_series(p: &[f64], w: f64) -> f64 {
+/// `e^{jωd/2} P(e^{jω})`, with `cos_m(m)` giving `cos(m ω)`.
+#[inline]
+fn cos_series_with(p: &[f64], cos_m: impl Fn(usize) -> f64) -> f64 {
     let h = (p.len() - 1) / 2;
     let mut s = p[h];
     for k in 0..h {
-        s += 2.0 * p[k] * ((h - k) as f64 * w).cos();
+        s += 2.0 * p[k] * cos_m(h - k);
     }
     s
 }
 
+fn cos_series(p: &[f64], w: f64) -> f64 {
+    cos_series_with(p, |m| (m as f64 * w).cos())
+}
+
+/// Number of grid intervals the root search scans over `[0, π]`.
+const GRID: usize = 1024;
+/// Largest multiple of ω in the series (half the LPC order, at most 16 / 2).
+const MAX_H: usize = 8;
+/// Bisection steps per root: the bracket shrinks to 3e-9 rad, far below one Q15 NLSF step (9.6e-5 rad).
+const BISECT_STEPS: usize = 20;
+
+/// `cos(m · π g / GRID)` for every grid point `g` and `m` in `0..=MAX_H`, computed with the same
+/// expression as [`cos_series`], so the table values are bit-identical to calling `cos` there.
+fn grid_cos() -> &'static [[f64; MAX_H + 1]] {
+    static TABLE: std::sync::OnceLock<Vec<[f64; MAX_H + 1]>> = std::sync::OnceLock::new();
+    TABLE.get_or_init(|| {
+        (0..=GRID)
+            .map(|g| {
+                let w = std::f64::consts::PI * g as f64 / GRID as f64;
+                std::array::from_fn(|m| (m as f64 * w).cos())
+            })
+            .collect()
+    })
+}
+
 fn roots(p: &[f64], out: &mut Vec<f64>) {
-    const GRID: usize = 1024;
+    let grid = grid_cos();
+    let at_grid = |g: usize| cos_series_with(p, |m| grid[g][m]);
     let mut w0 = 0.0;
-    let mut f0 = cos_series(p, w0);
+    let mut f0 = at_grid(0);
     for g in 1..=GRID {
         let w1 = std::f64::consts::PI * g as f64 / GRID as f64;
-        let f1 = cos_series(p, w1);
+        let f1 = at_grid(g);
         if f0 == 0.0 {
             out.push(w0);
         } else if f0 * f1 < 0.0 {
             let (mut lo, mut hi, mut flo) = (w0, w1, f0);
-            for _ in 0..40 {
+            for _ in 0..BISECT_STEPS {
                 let mid = 0.5 * (lo + hi);
                 let fm = cos_series(p, mid);
                 if fm * flo <= 0.0 {
@@ -111,6 +138,9 @@ fn roots(p: &[f64], out: &mut Vec<f64>) {
 /// when the root search fails (unstable or degenerate filter).
 pub fn a2nlsf(a: &[f64]) -> Option<Vec<f64>> {
     let d = a.len();
+    if d > 2 * MAX_H {
+        return None;
+    }
     let mut c = vec![0f64; d + 2];
     c[0] = 1.0;
     for k in 0..d {
@@ -199,9 +229,20 @@ pub fn pitch_search(x: &[f32], start: usize, len: usize, fs_khz: usize) -> Pitch
     let score = full[(lag - min_lag) as usize];
     // Contour: per-subframe lag offsets around the chosen lag.
     let cb: &[[i32; 4]] = if fs_khz == 8 { &CB_NB_20 } else { &CB_WB_20 };
+    // The contour search revisits the same (subframe, lag) pairs for neighbouring base lags and
+    // codebook entries, so each correlation is computed once.
+    let span = (18 * fs - min_lag + 1) as usize;
+    let memo = std::cell::RefCell::new(vec![f64::NAN; 4 * span]);
     let sub_score = |k: usize, l: i32| -> f64 {
         let l = l.clamp(min_lag, 18 * fs);
-        ncorr(x, start + k * sub..start + (k + 1) * sub, l as usize)
+        let slot = k * span + (l - min_lag) as usize;
+        let cached = memo.borrow()[slot];
+        if !cached.is_nan() {
+            return cached;
+        }
+        let v = ncorr(x, start + k * sub..start + (k + 1) * sub, l as usize);
+        memo.borrow_mut()[slot] = v;
+        v
     };
     let mut best = (f64::MIN, lag, 0usize);
     for l0 in (lag - 2).max(min_lag)..=(lag + 2).min(max_lag) {
@@ -319,4 +360,59 @@ mod tests {
             }
         }
     }
+
+    /// The root search as it was before the grid table: `cos` called for every evaluation.
+    fn roots_reference(p: &[f64], out: &mut Vec<f64>) {
+        let mut w0 = 0.0;
+        let mut f0 = cos_series(p, w0);
+        for g in 1..=GRID {
+            let w1 = std::f64::consts::PI * g as f64 / GRID as f64;
+            let f1 = cos_series(p, w1);
+            if f0 == 0.0 {
+                out.push(w0);
+            } else if f0 * f1 < 0.0 {
+                let (mut lo, mut hi, mut flo) = (w0, w1, f0);
+                for _ in 0..BISECT_STEPS {
+                    let mid = 0.5 * (lo + hi);
+                    let fm = cos_series(p, mid);
+                    if fm * flo <= 0.0 {
+                        hi = mid;
+                    } else {
+                        lo = mid;
+                        flo = fm;
+                    }
+                }
+                out.push(0.5 * (lo + hi));
+            }
+            w0 = w1;
+            f0 = f1;
+        }
+    }
+
+    #[test]
+    fn grid_table_roots_are_bit_identical_to_direct_cos() {
+        let mut seed = 7u64;
+        let mut rnd = move || {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            (seed >> 11) as f64 / (1u64 << 53) as f64 * 2.0 - 1.0
+        };
+        let mut found = 0;
+        for len in [11usize, 17] {
+            for _ in 0..300 {
+                let mut p = vec![0f64; len];
+                for k in 0..len / 2 + 1 {
+                    p[k] = rnd();
+                    p[len - 1 - k] = p[k];
+                }
+                let (mut a, mut b) = (Vec::new(), Vec::new());
+                roots(&p, &mut a);
+                roots_reference(&p, &mut b);
+                assert_eq!(a.iter().map(|v| v.to_bits()).collect::<Vec<_>>(), b.iter().map(|v| v.to_bits()).collect::<Vec<_>>());
+                found += a.len();
+            }
+        }
+        assert!(found > 1000, "{found}");
+    }
 }
diff --git a/crates/opusenc/src/silk/lpc.rs b/crates/opusenc/src/silk/lpc.rs
index 7846d2973..e0f8c107e 100644
--- a/crates/opusenc/src/silk/lpc.rs
+++ b/crates/opusenc/src/silk/lpc.rs
@@ -5,7 +5,10 @@
 //! spec-derived `filmcraft-opus` decoder (MIT OR Apache-2.0): the encoder must reconstruct the
 //! quantised NLSFs and LPC coefficients bit-exactly as the decoder does.
 
-use super::tables::*;
+use super::tables::{
+    COS_Q12, LSF_ORDER_NBMB, LSF_ORDER_WB, NLSF_CB_NBMB, NLSF_CB_WB, NLSF_MIN_SPACING_NBMB, NLSF_MIN_SPACING_WB, NLSF_PRED_NBMB, NLSF_PRED_WB, NLSF_PSEL_NBMB,
+    NLSF_PSEL_WB,
+};
 
 pub const MAX_LPC_ORDER: usize = 16;
 
diff --git a/crates/opusenc/src/silk/nlsf.rs b/crates/opusenc/src/silk/nlsf.rs
index 3f1f17ac6..4695152ff 100644
--- a/crates/opusenc/src/silk/nlsf.rs
+++ b/crates/opusenc/src/silk/nlsf.rs
@@ -3,7 +3,9 @@
 //! dequantisation exactly. The search strategy is our own.
 
 use super::lpc::{MAX_LPC_ORDER, nlsf_decode, smlawb, sqrt_approx};
-use super::tables::*;
+use super::tables::{
+    NLSF_CB_NBMB, NLSF_CB_WB, NLSF_EXT, NLSF_PRED_NBMB, NLSF_PRED_WB, NLSF_PSEL_NBMB, NLSF_PSEL_WB, NLSF_SEL_NBMB, NLSF_SEL_WB, NLSF_STAGE1, NLSF_STAGE2,
+};
 
 /// Number of stage-1 candidates refined with stage 2.
 const SURVIVORS: usize = 8;
diff --git a/crates/opusenc/src/silk/pulses.rs b/crates/opusenc/src/silk/pulses.rs
index f8cda15a9..ba22b5ec5 100644
--- a/crates/opusenc/src/silk/pulses.rs
+++ b/crates/opusenc/src/silk/pulses.rs
@@ -2,7 +2,7 @@
 //! with LSB escapes, the recursive shell code, LSBs and signs, written in exactly the order the
 //! decoder reads them.
 
-use super::tables::*;
+use super::tables::{EXC_LSB, EXC_SIGN, PULSE_COUNT, RATE_LEVEL, SHELL_2, SHELL_4, SHELL_8, SHELL_16};
 use crate::range::RangeEncoder;
 
 /// Largest pulse magnitude the quantiser produces (keeps every 16-sample block codable).
diff --git a/crates/opusenc/tests/common/mod.rs b/crates/opusenc/tests/it/common/mod.rs
similarity index 100%
rename from crates/opusenc/tests/common/mod.rs
rename to crates/opusenc/tests/it/common/mod.rs
diff --git a/crates/opusenc/tests/ffmpeg.rs b/crates/opusenc/tests/it/ffmpeg.rs
similarity index 99%
rename from crates/opusenc/tests/ffmpeg.rs
rename to crates/opusenc/tests/it/ffmpeg.rs
index fcbb8c8a7..1294ed348 100644
--- a/crates/opusenc/tests/ffmpeg.rs
+++ b/crates/opusenc/tests/it/ffmpeg.rs
@@ -2,7 +2,7 @@
 //! without errors with both ffmpeg's native `opus` decoder and `libopus`, honour the pre-skip
 //! and end granule, and reproduce the input. Skipped when ffmpeg is not installed.
 
-mod common;
+use crate::common;
 
 use std::process::Command;
 
diff --git a/crates/opusenc/tests/it/main.rs b/crates/opusenc/tests/it/main.rs
new file mode 100644
index 000000000..ba6a7895d
--- /dev/null
+++ b/crates/opusenc/tests/it/main.rs
@@ -0,0 +1,5 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod common;
+mod ffmpeg;
+mod modes;
diff --git a/crates/opusenc/tests/modes.rs b/crates/opusenc/tests/it/modes.rs
similarity index 99%
rename from crates/opusenc/tests/modes.rs
rename to crates/opusenc/tests/it/modes.rs
index 843cf3d9f..c01f64e69 100644
--- a/crates/opusenc/tests/modes.rs
+++ b/crates/opusenc/tests/it/modes.rs
@@ -2,7 +2,7 @@
 //! mode/bandwidth decodes, waveform quality on speech-like and music-like signals, bitrate
 //! tracking, stereo, the application tables and delay alignment.
 
-mod common;
+use crate::common;
 
 use common::*;
 use effectcraft_opusenc::{Application, Bandwidth, Mode, OpusEncoder};
diff --git a/crates/path/Cargo.toml b/crates/path/Cargo.toml
index 46cf0a832..2e9bc85d9 100644
--- a/crates/path/Cargo.toml
+++ b/crates/path/Cargo.toml
@@ -15,4 +15,4 @@ effectcraft-keyframe = { workspace = true }
 effectcraft-raster = { workspace = true }
 kurbo = { workspace = true }
 tiny-skia = { workspace = true }
-linesweeper = "0.4"
+linesweeper = "0.5"
diff --git a/crates/path/src/boolean.rs b/crates/path/src/boolean.rs
index 5a81b3e19..0323fc4ee 100644
--- a/crates/path/src/boolean.rs
+++ b/crates/path/src/boolean.rs
@@ -5,7 +5,7 @@
 //! MIT OR Apache-2.0), reworked to take and return kurbo paths directly.
 //!
 //! Inputs are closed implicitly (a filled open path is painted as if closed). The sweep splits
-//! curves at intersections and y-extrema; [`tidy_segments`] re-joins pieces that came from one
+//! curves at intersections and y-extrema; `tidy_segments` re-joins pieces that came from one
 //! input curve (exactly) or one smooth run (by least-squares refit), so results carry roughly as
 //! few vertices as the inputs. Output contours are simple and consistently oriented (holes wind
 //! opposite to their outer contour), so they fill the same under either fill rule.
@@ -26,24 +26,19 @@ pub(crate) fn inside(rule: FillRule, w: i32) -> bool {
     }
 }
 
-/// Winding numbers for an arbitrary number of input paths (tag = input index).
-#[derive(Clone, Debug, Default)]
-pub(crate) struct Multi(Vec<i32>);
+/// Winding numbers for an arbitrary number of input paths (tag = input index), stored sparsely:
+/// the nonzero `(tag, winding)` pairs in tag order. A segment's winding names only its own path,
+/// so the topology's per-segment copies stay small however many paths take part (a dense
+/// vector up to each segment's tag would grow with the square of the path count).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub(crate) struct Multi(Vec<(usize, i32)>);
 
 impl Multi {
     fn get(&self, i: usize) -> i32 {
-        self.0.get(i).copied().unwrap_or(0)
+        self.0.binary_search_by_key(&i, |e| e.0).map_or(0, |k| self.0[k].1)
     }
 }
 
-impl PartialEq for Multi {
-    fn eq(&self, other: &Self) -> bool {
-        let n = self.0.len().max(other.0.len());
-        (0..n).all(|i| self.get(i) == other.get(i))
-    }
-}
-impl Eq for Multi {}
-
 impl std::ops::Add for Multi {
     type Output = Multi;
     fn add(mut self, rhs: Self) -> Multi {
@@ -54,26 +49,51 @@ impl std::ops::Add for Multi {
 
 impl std::ops::AddAssign for Multi {
     fn add_assign(&mut self, rhs: Self) {
-        if self.0.len() < rhs.0.len() {
-            self.0.resize(rhs.0.len(), 0);
+        if rhs.0.is_empty() {
+            return;
         }
-        for (a, b) in self.0.iter_mut().zip(rhs.0) {
-            *a += b;
+        // Merge the two tag-ordered lists, dropping windings that cancel to zero (so equal
+        // windings have equal representations).
+        let (a, b) = (std::mem::take(&mut self.0), rhs.0);
+        let mut out = Vec::with_capacity(a.len() + b.len());
+        let (mut i, mut j) = (0, 0);
+        while i < a.len() || j < b.len() {
+            let e = match (a.get(i), b.get(j)) {
+                (Some(&x), Some(&y)) if x.0 == y.0 => {
+                    i += 1;
+                    j += 1;
+                    (x.0, x.1 + y.1)
+                }
+                (Some(&x), Some(&y)) if x.0 < y.0 => {
+                    i += 1;
+                    x
+                }
+                (Some(&x), None) => {
+                    i += 1;
+                    x
+                }
+                (_, Some(&y)) => {
+                    j += 1;
+                    y
+                }
+                (None, None) => break,
+            };
+            if e.1 != 0 {
+                out.push(e);
+            }
         }
+        self.0 = out;
     }
 }
 
 impl WindingNumber for Multi {
     type Tag = usize;
     fn single(tag: usize, positive: bool) -> Self {
-        let mut v = vec![0; tag + 1];
-        v[tag] = if positive { 1 } else { -1 };
-        Multi(v)
+        Multi(vec![(tag, if positive { 1 } else { -1 })])
     }
     fn of_tag(&self, tag: usize) -> Self {
-        let mut v = vec![0; tag + 1];
-        v[tag] = self.get(tag);
-        Multi(v)
+        let w = self.get(tag);
+        Multi(if w == 0 { Vec::new() } else { vec![(tag, w)] })
     }
 }
 
@@ -250,6 +270,9 @@ pub(crate) fn to_seg(s: PathSeg) -> Seg {
     }
 }
 
+/// Most segments `tidy_segments` merges into one.
+const MAX_MERGE_RUN: usize = 64;
+
 /// Merge segments of a closed loop that were split from one curve (or collinear lines) back
 /// together, dropping degenerate pieces.
 fn tidy_segments(segs: Vec<Seg>, tidy: &Tidy) -> Vec<Seg> {
@@ -284,7 +307,9 @@ fn tidy_segments(segs: Vec<Seg>, tidy: &Tidy) -> Vec<Seg> {
     while i < n {
         let mut cur = segs[i];
         let mut j = i + 1;
-        while j < n && mergeable(&segs[j - 1], &segs[j]) {
+        // Each attempt re-checks the whole run, so a run is capped: a long chain of redundant
+        // pieces costs linear, not quadratic, work and leaves at most a few extra joints.
+        while j < n && j - i < MAX_MERGE_RUN && mergeable(&segs[j - 1], &segs[j]) {
             match try_merge(&segs[i..=j], tidy) {
                 Some(m) => {
                     cur = m;
@@ -383,3 +408,46 @@ pub fn filled_area(path: &BezPath, rule: FillRule) -> f64 {
         None => 0.0,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sparse_windings_add_and_restrict() {
+        let a = Multi::single(3, true) + Multi::single(1000, false);
+        assert_eq!((a.get(3), a.get(1000), a.get(7)), (1, -1, 0));
+        // Only nonzero entries are stored, whatever the tag.
+        assert_eq!(a.0.len(), 2);
+        assert_eq!(a.of_tag(1000), Multi::single(1000, false));
+        assert_eq!(a.of_tag(5), Multi::default());
+        // Windings that cancel compare equal to none at all.
+        assert_eq!(a.clone() + Multi::single(3, false) + Multi::single(1000, true), Multi::default());
+    }
+
+    #[test]
+    fn many_paths_union_keeps_each_square() {
+        let squares: Vec<(BezPath, FillRule)> =
+            (0..400).map(|i| (kurbo::Rect::new(i as f64 * 3.0, 0.0, i as f64 * 3.0 + 2.0, 2.0).to_path(0.1), FillRule::NonZero)).collect();
+        let out = boolean_n(&squares, |m| m.iter().any(|&x| x));
+        assert_eq!(out.elements().iter().filter(|e| matches!(e, PathEl::MoveTo(_))).count(), 400);
+        assert!((out.area().abs() - 400.0 * 4.0).abs() < 1e-6);
+    }
+
+    #[test]
+    fn long_collinear_runs_merge_in_bounded_pieces() {
+        // A square whose top edge is split into thousands of collinear pieces.
+        let n: usize = 5000;
+        let mut segs: Vec<Seg> = (0..n).map(|k| Seg::line(Point::new(k as f64, 0.0), Point::new(k as f64 + 1.0, 0.0))).collect();
+        let w = n as f64;
+        segs.push(Seg::line(Point::new(w, 0.0), Point::new(w, w)));
+        segs.push(Seg::line(Point::new(w, w), Point::new(0.0, w)));
+        segs.push(Seg::line(Point::new(0.0, w), Point::new(0.0, 0.0)));
+        let out = tidy_segments(segs, &Tidy::free(DEFAULT_PRECISION));
+        // The top edge comes back as n / MAX_MERGE_RUN straight pieces on the same line.
+        assert!(out.len() <= n.div_ceil(MAX_MERGE_RUN) + 3, "{}", out.len());
+        assert!(out.iter().all(|s| s.line));
+        let top: f64 = out.iter().filter(|s| s.c.p0.y == 0.0 && s.c.p3.y == 0.0).map(|s| s.c.p3.x - s.c.p0.x).sum();
+        assert_eq!(top, w);
+    }
+}
diff --git a/crates/path/src/feather.rs b/crates/path/src/feather.rs
index e8e0fc4a8..47a4bda7e 100644
--- a/crates/path/src/feather.rs
+++ b/crates/path/src/feather.rs
@@ -70,6 +70,22 @@ fn flatten(sp: &ShapePath, m: &Mat3) -> Flat {
 }
 
 impl Flat {
+    /// Keep every other point (and the last), with their arc lengths.
+    fn thin(&mut self) {
+        let n = self.pts.len();
+        let keep = |i: usize| i.is_multiple_of(2) || i + 1 == n;
+        let mut i = 0;
+        self.pts.retain(|_| {
+            i += 1;
+            keep(i - 1)
+        });
+        let mut i = 0;
+        self.s.retain(|_| {
+            i += 1;
+            keep(i - 1)
+        });
+    }
+
     /// Arc length of a feather point.
     fn arc_of(&self, f: &FeatherPoint) -> Option<f64> {
         let table = self.seg_tables.get(f.segment)?;
@@ -123,14 +139,39 @@ impl Profile {
     }
 }
 
+/// Most pixel visits (summed over the flattened path's segments) a variable feather's distance
+/// pass may take: a few seconds of work, far beyond a feathered mask at 4K with a radius of a
+/// few hundred pixels. Past it the flattened path is thinned (see [`variable_feather_coverage`]).
+pub const FEATHER_WORK_BUDGET: u64 = 1 << 31;
+
+/// Pixel visits of the distance pass over the polyline `pts`: each segment's box grown by
+/// `reach`, clipped to the `w × h` mask.
+fn feather_work(pts: &[[f64; 2]], reach: f64, w: u32, h: u32) -> u64 {
+    let span = |lo: f64, hi: f64, n: u32| -> u64 {
+        let a = (lo - reach).floor().max(0.0);
+        let b = (hi + reach).ceil().min(f64::from(n) - 1.0);
+        if b >= a { (b - a + 1.0) as u64 } else { 0 }
+    };
+    pts.windows(2)
+        .map(|p| {
+            let (a, b) = (p[0], p[1]);
+            span(a[0].min(b[0]), a[0].max(b[0]), w).saturating_mul(span(a[1].min(b[1]), a[1].max(b[1]), h))
+        })
+        .fold(0u64, u64::saturating_add)
+}
+
 /// Coverage of a mask path with feather points, transformed by `m` (translate + uniform scale)
 /// into a `w × h` mask. `expansion` (layer pixels) grows (>0) or shrinks the mask first;
 /// `linear` selects the Linear feather falloff instead of Smooth.
 pub fn variable_feather_coverage(sp: &ShapePath, m: &Mat3, w: u32, h: u32, expansion: f64, linear: bool) -> Mask {
+    coverage_within(sp, m, (w, h), expansion, linear, FEATHER_WORK_BUDGET)
+}
+
+fn coverage_within(sp: &ShapePath, m: &Mat3, (w, h): (u32, u32), expansion: f64, linear: bool, budget: u64) -> Mask {
     let scale = m.mean_scale();
     let path = to_kurbo(sp);
     let hard = fill_coverage(std::slice::from_ref(&path), m, w, h, FillRule::NonZero);
-    let flat = flatten(sp, m);
+    let mut flat = flatten(sp, m);
     if flat.pts.len() < 2 {
         return hard;
     }
@@ -148,6 +189,16 @@ pub fn variable_feather_coverage(sp: &ShapePath, m: &Mat3, w: u32, h: u32, expan
     let rmax = prof.pts.iter().map(|p| p.1.max(p.2)).fold(0.0, f64::max);
     let exp = expansion * scale;
     let reach = rmax + exp.abs() + 2.0;
+    // Each flattened segment visits its box grown by the reach, so many segments with a reach
+    // spanning the mask would revisit every pixel once per segment. Past the budget the
+    // polyline is thinned (every other point, keeping their arc lengths) until it fits: the
+    // distances move by a fraction of the chords, small next to a feather that wide.
+    while feather_work(&flat.pts, reach, w, h) > budget {
+        if flat.pts.len() <= 8 {
+            return hard;
+        }
+        flat.thin();
+    }
     let (wu, hu) = (w as usize, h as usize);
     let mut dist = vec![f32::INFINITY; wu * hu];
     let mut arc = vec![0.0f32; wu * hu];
@@ -218,6 +269,32 @@ mod tests {
         m.data[(y * m.width + x) as usize]
     }
 
+    #[test]
+    fn feather_work_is_bounded_by_thinning_the_path() {
+        // Thousands of vertices with a feather reaching across the mask: the polyline is thinned
+        // until the distance pass fits the budget, and the result is still a feathered edge.
+        let n = 2000;
+        let verts: Vec<[f64; 2]> = (0..n)
+            .map(|i| {
+                let a = i as f64 / n as f64 * std::f64::consts::TAU;
+                [100.0 + 50.0 * a.cos(), 100.0 + 50.0 * a.sin()]
+            })
+            .collect();
+        let mut sp = ShapePath::polygon(&verts, true);
+        sp.feather = vec![FeatherPoint { segment: 0, t: 0.5, radius: 40.0, tension: 0.0 }];
+        let budget = 1 << 22;
+        let full = flatten(&sp, &Mat3::IDENTITY);
+        assert!(feather_work(&full.pts, 42.0, 200, 200) > budget);
+        let m = coverage_within(&sp, &Mat3::IDENTITY, (200, 200), 0.0, true, budget);
+        let unbounded = coverage_within(&sp, &Mat3::IDENTITY, (200, 200), 0.0, true, u64::MAX);
+        // Outside the edge: 1 at the circle falling linearly to 0 at 40 px, close to the
+        // unthinned result.
+        assert!(at(&m, 100, 100) > 0.99);
+        let (thin, exact) = (at(&m, 100, 30), at(&unbounded, 100, 30));
+        assert!(thin > 0.4 && thin < 0.6 && (thin - exact).abs() < 0.05, "{thin} {exact}");
+        assert!(at(&m, 100, 5) < 0.01);
+    }
+
     #[test]
     fn no_points_is_the_hard_mask() {
         let m = variable_feather_coverage(&square(), &Mat3::IDENTITY, 200, 200, 0.0, false);
diff --git a/crates/path/src/lib.rs b/crates/path/src/lib.rs
index 249eb9fdd..61fd0e6c3 100644
--- a/crates/path/src/lib.rs
+++ b/crates/path/src/lib.rs
@@ -130,11 +130,84 @@ pub fn from_kurbo(path: &BezPath) -> Vec<ShapePath> {
     out
 }
 
-/// Rectangle path centred at `pos` with corner `roundness` (AE draws clockwise from the top-right).
+/// Rectangle path centred at `pos` with corner `roundness`, drawn as After Effects draws it
+/// (Trim Paths measures from its first point): clockwise from the top-right corner, or with
+/// round corners from the end of the top-right arc on the right edge (After Effects 2026,
+/// 400 × 300 rectangles trimmed 0–25 %, case 930).
 pub fn rect(size: [f64; 2], pos: [f64; 2], roundness: f64) -> BezPath {
-    let r = kurbo::Rect::from_center_size(Point::new(pos[0], pos[1]), (size[0].abs(), size[1].abs()));
-    let rad = roundness.clamp(0.0, size[0].abs().min(size[1].abs()) / 2.0);
-    if rad > 0.0 { r.to_rounded_rect(rad).to_path(0.1) } else { r.to_path(0.1) }
+    let (w, h) = (size[0].abs(), size[1].abs());
+    let (x0, y0, x1, y1) = (pos[0] - w / 2.0, pos[1] - h / 2.0, pos[0] + w / 2.0, pos[1] + h / 2.0);
+    let max_rad = w.min(h) / 2.0;
+    // `f64::clamp` panics on a NaN bound (both size components NaN): fall back to no roundness.
+    let rad = if roundness.is_finite() && !max_rad.is_nan() { roundness.clamp(0.0, max_rad) } else { 0.0 };
+    let mut p = BezPath::new();
+    if rad <= 0.0 {
+        p.move_to((x1, y0));
+        p.line_to((x1, y1));
+        p.line_to((x0, y1));
+        p.line_to((x0, y0));
+        p.close_path();
+        return p;
+    }
+    // Quarter circles as cubics (handle 0.5523 × radius).
+    let k = rad * 0.552_284_749_8;
+    p.move_to((x1, y0 + rad));
+    p.line_to((x1, y1 - rad));
+    p.curve_to((x1, y1 - rad + k), (x1 - rad + k, y1), (x1 - rad, y1));
+    p.line_to((x0 + rad, y1));
+    p.curve_to((x0 + rad - k, y1), (x0, y1 - rad + k), (x0, y1 - rad));
+    p.line_to((x0, y0 + rad));
+    p.curve_to((x0, y0 + rad - k), (x0 + rad - k, y0), (x0 + rad, y0));
+    p.line_to((x1 - rad, y0));
+    p.curve_to((x1 - rad + k, y0), (x1, y0 + rad - k), (x1, y0 + rad));
+    p.close_path();
+    p
+}
+
+/// Rectangle path centred at `pos` with independent corner radii `[top-left, top-right,
+/// bottom-right, bottom-left]`, clockwise in screen coordinates. Negative and non-finite radii
+/// are 0; radii that would overlap are scaled down as CSS `border-radius` does.
+pub fn rect_radii(size: [f64; 2], pos: [f64; 2], radii: [f64; 4]) -> BezPath {
+    // Start at the end of the top-right arc on the right edge, like `rect`, and walk the corners
+    // clockwise: Trim Paths measures from the first point, so ticking per-corner roundness must
+    // not make a trim jump (#1896).
+    let w = if size[0].is_finite() { size[0].abs() } else { 0.0 };
+    let h = if size[1].is_finite() { size[1].abs() } else { 0.0 };
+    let (x0, y0) = (pos[0] - w / 2.0, pos[1] - h / 2.0);
+    let (x1, y1) = (pos[0] + w / 2.0, pos[1] + h / 2.0);
+    let mut r = radii.map(|v| if v.is_finite() { v.max(0.0) } else { 0.0 });
+    // CSS border-radius: when two radii on an edge overlap, scale every radius by the smallest
+    // edge ratio (a uniform radius then clamps to half the shorter side, as before).
+    let ratio = |a: f64, b: f64, edge: f64| if a + b > edge && a + b > 0.0 { (edge / (a + b)).min(1.0) } else { 1.0 };
+    let f = ratio(r[0], r[1], w).min(ratio(r[3], r[2], w)).min(ratio(r[0], r[3], h)).min(ratio(r[1], r[2], h));
+    if f < 1.0 {
+        for v in &mut r {
+            *v *= f;
+        }
+    }
+    let [tl, tr, br, bl] = r;
+    // Quarter-circle Bezier control distance.
+    const K: f64 = 0.552_284_749_830_793_6;
+    let mut p = BezPath::new();
+    p.move_to((x1, y0 + tr));
+    p.line_to((x1, y1 - br));
+    if br > 0.0 {
+        p.curve_to((x1, y1 - br + K * br), (x1 - br + K * br, y1), (x1 - br, y1));
+    }
+    p.line_to((x0 + bl, y1));
+    if bl > 0.0 {
+        p.curve_to((x0 + bl - K * bl, y1), (x0, y1 - bl + K * bl), (x0, y1 - bl));
+    }
+    p.line_to((x0, y0 + tl));
+    if tl > 0.0 {
+        p.curve_to((x0, y0 + tl - K * tl), (x0 + tl - K * tl, y0), (x0 + tl, y0));
+    }
+    p.line_to((x1 - tr, y0));
+    if tr > 0.0 {
+        p.curve_to((x1 - tr + K * tr, y0), (x1, y0 + tr - K * tr), (x1, y0 + tr));
+    }
+    p.close_path();
+    p
 }
 
 pub fn ellipse(size: [f64; 2], pos: [f64; 2]) -> BezPath {
@@ -142,7 +215,20 @@ pub fn ellipse(size: [f64; 2], pos: [f64; 2]) -> BezPath {
 }
 
 /// Polystar: a star (`inner` radius used) or polygon, rotation in degrees, roundness in percent.
-pub fn polystar(star: bool, points: f64, pos: [f64; 2], rotation: f64, inner: f64, outer: f64, inner_round: f64, outer_round: f64) -> BezPath {
+pub struct Polystar {
+    pub star: bool,
+    pub points: f64,
+    pub pos: [f64; 2],
+    pub rotation: f64,
+    pub inner: f64,
+    pub outer: f64,
+    pub inner_round: f64,
+    pub outer_round: f64,
+}
+
+/// Build the path described by the polystar's geometry.
+pub fn polystar(spec: Polystar) -> BezPath {
+    let Polystar { star, points, pos, rotation, inner, outer, inner_round, outer_round } = spec;
     let n = points.max(3.0).round() as usize;
     let verts = if star { n * 2 } else { n };
     let mut path = BezPath::new();
@@ -354,6 +440,47 @@ pub fn transform(paths: &[BezPath], m: &Mat3) -> Vec<BezPath> {
 mod tests {
     use super::*;
 
+    /// After Effects 2026 (case 930): 400 × 300 rectangles at the origin with Trim Paths. Plain:
+    /// 0–25 % runs from the top-right corner down the right edge and 50 px along the bottom.
+    /// Round corners 40: from the end of the top-right arc (200, −110) down, round the
+    /// bottom-right corner, to x 110 on the bottom. Start 70 / End 30 draws 30–70 %.
+    #[test]
+    fn rectangles_start_where_after_effects_starts_them() {
+        let ends = |p: &BezPath| {
+            let mut first = None;
+            let mut last = None;
+            for el in p.elements() {
+                match *el {
+                    PathEl::MoveTo(q) if first.is_none() => first = Some(q),
+                    PathEl::MoveTo(q) | PathEl::LineTo(q) | PathEl::CurveTo(_, _, q) | PathEl::QuadTo(_, q) => last = Some(q),
+                    PathEl::ClosePath => {}
+                }
+            }
+            (first.unwrap_or_default(), last.unwrap_or_default())
+        };
+        let near = |a: Point, b: (f64, f64)| (a.x - b.0).abs() < 1.0 && (a.y - b.1).abs() < 1.0;
+        let plain = ops::trim(&[rect([400.0, 300.0], [0.0, 0.0], 0.0)], 0.0, 25.0, 0.0);
+        let (a, b) = ends(&plain[0]);
+        assert!(near(a, (200.0, -150.0)) && near(b, (150.0, 150.0)), "{a:?} {b:?}");
+        let round = ops::trim(&[rect([400.0, 300.0], [0.0, 0.0], 40.0)], 0.0, 25.0, 0.0);
+        let (a, b) = ends(&round[0]);
+        assert!(near(a, (200.0, -110.0)) && near(b, (110.0, 150.0)), "{a:?} {b:?}");
+        // Per-corner roundness starts and runs in the same order: ticking the checkbox must not
+        // move a Trim Paths contour.
+        let corners = ops::trim(&[rect_radii([400.0, 300.0], [0.0, 0.0], [40.0; 4])], 0.0, 25.0, 0.0);
+        let (a, b) = ends(&corners[0]);
+        assert!(near(a, (200.0, -110.0)) && near(b, (110.0, 150.0)), "per-corner: {a:?} {b:?}");
+        // Start > End: AE draws 30..70 % (plain: from x 80 on the bottom up to y −130 on the left).
+        let swapped = ops::trim(&[rect([400.0, 300.0], [0.0, 0.0], 0.0)], 70.0, 30.0, 0.0);
+        let (a, b) = ends(&swapped[0]);
+        assert!(near(a, (80.0, 150.0)) && near(b, (-200.0, -130.0)), "{a:?} {b:?}");
+    }
+
+    #[test]
+    fn rect_with_nan_size_does_not_panic() {
+        let _ = rect([f64::NAN, f64::NAN], [0.0, 0.0], 5.0);
+    }
+
     #[test]
     fn roundtrip_vertex_model() {
         let sp = ShapePath::ellipse([10.0, 20.0], 40.0, 30.0);
@@ -380,6 +507,32 @@ mod tests {
         assert!((area - 200.0).abs() < 1.0, "{area}");
     }
 
+    #[test]
+    fn rect_radii_uniform_matches_a_rounded_rect() {
+        for r in [0.0, 5.0, 25.0, 100.0] {
+            let p = rect_radii([100.0, 50.0], [10.0, 20.0], [r; 4]);
+            let clamped = r.min(25.0);
+            let expect = 100.0 * 50.0 - (4.0 - std::f64::consts::PI) * clamped * clamped;
+            assert!((p.area().abs() - expect).abs() < 1.0, "{r}: {} != {expect}", p.area());
+            assert!((p.area() - rect([100.0, 50.0], [10.0, 20.0], r).area()).abs() < 1e-6);
+        }
+    }
+
+    #[test]
+    fn rect_radii_mixes_corners_and_scales_overlaps() {
+        // Only the top-left and bottom-right corners round.
+        let p = rect_radii([100.0, 50.0], [0.0, 0.0], [10.0, 0.0, 20.0, 0.0]);
+        let expect = 100.0 * 50.0 - (1.0 - std::f64::consts::PI / 4.0) * (10.0 * 10.0 + 20.0 * 20.0);
+        assert!((p.area().abs() - expect).abs() < 1.0, "{}", p.area());
+        // Radii wider than the top edge scale down together, like CSS border-radius.
+        let p = rect_radii([50.0, 100.0], [0.0, 0.0], [40.0, 40.0, 0.0, 0.0]);
+        let scaled = rect_radii([50.0, 100.0], [0.0, 0.0], [25.0, 25.0, 0.0, 0.0]);
+        assert!((p.area() - scaled.area()).abs() < 1e-9);
+        // Negative and non-finite radii are square corners.
+        let p = rect_radii([50.0, 50.0], [0.0, 0.0], [-5.0, f64::NAN, f64::INFINITY, 0.0]);
+        assert!((p.area().abs() - 2500.0).abs() < 1e-9);
+    }
+
     #[test]
     fn stroke_has_area() {
         let r = rect([40.0, 40.0], [50.0, 50.0], 0.0);
@@ -391,7 +544,7 @@ mod tests {
 
     #[test]
     fn star_has_right_vertex_count() {
-        let p = polystar(true, 5.0, [0.0, 0.0], 0.0, 20.0, 50.0, 0.0, 0.0);
+        let p = polystar(Polystar { star: true, points: 5.0, pos: [0.0, 0.0], rotation: 0.0, inner: 20.0, outer: 50.0, inner_round: 0.0, outer_round: 0.0 });
         let v = from_kurbo(&p);
         assert_eq!(v[0].vertices.len(), 10);
     }
diff --git a/crates/path/src/ops.rs b/crates/path/src/ops.rs
index ec6e18604..ba5349312 100644
--- a/crates/path/src/ops.rs
+++ b/crates/path/src/ops.rs
@@ -533,12 +533,15 @@ pub struct WiggleParams {
     pub correlation: f64,
     /// Temporal phase in degrees (360° = one wiggle period).
     pub phase_deg: f64,
+    /// Spatial phase in degrees: slides each subpath's pattern of displacements along its points
+    /// (360° = once around the subpath).
+    pub spatial_phase_deg: f64,
     pub seed: f64,
 }
 
 impl Default for WiggleParams {
     fn default() -> Self {
-        WiggleParams { size: 10.0, detail: 10.0, smooth: true, speed: 2.0, correlation: 50.0, phase_deg: 0.0, seed: 0.0 }
+        WiggleParams { size: 10.0, detail: 10.0, smooth: true, speed: 2.0, correlation: 50.0, phase_deg: 0.0, spatial_phase_deg: 0.0, seed: 0.0 }
     }
 }
 
@@ -561,16 +564,24 @@ fn noise(seed: u64, idx: u64, t: f64) -> f64 {
     let i = t.floor();
     let f = t - i;
     let i = i as i64;
-    let p = |k: i64| hash(seed, idx, i + k);
+    // `i` saturates at the i64 ends for an absurd `t`, so the neighbours wrap rather than overflow.
+    let p = |k: i64| hash(seed, idx, i.wrapping_add(k));
     // Catmull-Rom through four lattice values keeps the motion C1-continuous.
     let (p0, p1, p2, p3) = (p(-1), p(0), p(1), p(2));
     let v = 0.5 * (2.0 * p1 + (-p0 + p2) * f + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * f * f + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * f * f * f);
     v.clamp(-1.0, 1.0)
 }
 
+/// Catmull-Rom interpolation between `p1` (f = 0) and `p2` (f = 1).
+fn catmull_rom(p0: f64, p1: f64, p2: f64, p3: f64, f: f64) -> f64 {
+    0.5 * (2.0 * p1 + (-p0 + p2) * f + (2.0 * p0 - 5.0 * p1 + 4.0 * p2 - p3) * f * f + (-p0 + 3.0 * p1 - 3.0 * p2 + p3) * f * f * f)
+}
+
 /// Wiggle Paths: subdivides the paths (`detail` points per segment) and displaces every point by
 /// smooth random noise of up to `size` pixels that evolves over `time_s` seconds at `speed`
-/// wiggles per second. Deterministic for a given seed and time.
+/// wiggles per second. The spatial phase moves each point's own share of the noise along the
+/// subpath, and a fraction of a point is interpolated between its neighbors. Deterministic for a
+/// given seed and time.
 pub fn wiggle(paths: &[BezPath], w: &WiggleParams, time_s: f64) -> Vec<BezPath> {
     if w.size == 0.0 {
         return paths.to_vec();
@@ -580,6 +591,7 @@ pub fn wiggle(paths: &[BezPath], w: &WiggleParams, time_s: f64) -> Vec<BezPath>
     let t = time_s * w.speed + w.phase_deg / 360.0;
     let corr = (w.correlation / 100.0).clamp(0.0, 1.0);
     let shared = Vec2::new(noise(seed, u64::MAX, t), noise(seed, u64::MAX - 1, t));
+    let turns = if w.spatial_phase_deg.is_finite() { (w.spatial_phase_deg / 360.0).rem_euclid(1.0) } else { 0.0 };
     let mut idx: u64 = 0;
     paths
         .iter()
@@ -587,14 +599,28 @@ pub fn wiggle(paths: &[BezPath], w: &WiggleParams, time_s: f64) -> Vec<BezPath>
             let mut out = BezPath::new();
             for sub in subs(p) {
                 let s = resample(&sub, m);
-                let disp: Vec<Vec2> = s
-                    .iter()
-                    .map(|_| {
-                        let own = Vec2::new(noise(seed, idx * 2, t + idx as f64 * 0.37), noise(seed, idx * 2 + 1, t + idx as f64 * 0.61));
-                        idx += 1;
-                        (shared * corr + own * (1.0 - corr)) * w.size
-                    })
-                    .collect();
+                let n = s.len();
+                let first = idx;
+                let own = |j: usize| {
+                    let i = first + j as u64;
+                    Vec2::new(noise(seed, i * 2, t + i as f64 * 0.37), noise(seed, i * 2 + 1, t + i as f64 * 0.61))
+                };
+                let along = |j: usize| {
+                    if turns == 0.0 {
+                        return own(j);
+                    }
+                    let u = (j as f64 + turns * n as f64).rem_euclid(n as f64);
+                    let k = u.floor();
+                    let f = u - k;
+                    let k = k as usize % n;
+                    if f == 0.0 {
+                        return own(k);
+                    }
+                    let (p0, p1, p2, p3) = (own((k + n - 1) % n), own(k), own((k + 1) % n), own((k + 2) % n));
+                    Vec2::new(catmull_rom(p0.x, p1.x, p2.x, p3.x, f).clamp(-1.0, 1.0), catmull_rom(p0.y, p1.y, p2.y, p3.y, f).clamp(-1.0, 1.0))
+                };
+                let disp: Vec<Vec2> = (0..n).map(|j| (shared * corr + along(j) * (1.0 - corr)) * w.size).collect();
+                idx += n as u64;
                 emit(&s, &disp, sub.closed, w.smooth, 1.0 / 3.0, &mut out);
             }
             out
diff --git a/crates/path/src/ops/tests.rs b/crates/path/src/ops/tests.rs
index dbdf213ba..1ebdcea5b 100644
--- a/crates/path/src/ops/tests.rs
+++ b/crates/path/src/ops/tests.rs
@@ -292,6 +292,18 @@ fn wiggle_is_deterministic_and_time_varying() {
     assert_eq!(vertex_count(&a[0]), 4 * 11);
 }
 
+#[test]
+fn wiggle_survives_an_absurd_speed_or_time() {
+    // `t` far past i64 saturates the lattice index at i64::MAX, and the neighbours' `+ 1`, `+ 2` used to overflow.
+    let s = [sq(0.0, 0.0, 100.0)];
+    for v in [f64::INFINITY, f64::NEG_INFINITY, f64::NAN, f64::MAX, f64::MIN, 1e300, 9.3e18] {
+        let by_speed = wiggle(&s, &WiggleParams { speed: v, ..Default::default() }, 1.0);
+        let by_time = wiggle(&s, &WiggleParams::default(), v);
+        let by_phase = wiggle(&s, &WiggleParams { phase_deg: v, ..Default::default() }, 0.0);
+        assert_eq!((by_speed.len(), by_time.len(), by_phase.len()), (1, 1, 1), "wiggle with {v}");
+    }
+}
+
 #[test]
 fn wiggle_displacement_is_bounded() {
     let mut l = BezPath::new();
@@ -317,6 +329,38 @@ fn wiggle_full_correlation_translates() {
     assert_eq!(zero[0], s[0]);
 }
 
+/// Spatial Phase moves the pattern of displacements along the path: 360° is once around, and a
+/// whole number of points' worth gives each point the displacement of the point that far ahead.
+#[test]
+fn wiggle_spatial_phase_moves_the_pattern_along_the_path() {
+    let s = [sq(0.0, 0.0, 100.0)];
+    let w = WiggleParams { detail: 3.0, correlation: 0.0, smooth: false, ..Default::default() };
+    // Displacements are proportional to Size: twice the size less once the size.
+    let disp = |w: WiggleParams| -> Vec<Vec2> {
+        let a = on_curve(&wiggle(&s, &w, 0.4)[0]);
+        let b = on_curve(&wiggle(&s, &WiggleParams { size: w.size * 2.0, ..w }, 0.4)[0]);
+        a.iter().zip(&b).map(|(a, b)| *b - *a).take(16).collect()
+    };
+    let d0 = disp(w);
+    let n = d0.len();
+    assert_eq!(n, 16);
+    for k in [1, 5] {
+        let dk = disp(WiggleParams { spatial_phase_deg: 360.0 * k as f64 / n as f64, ..w });
+        for j in 0..n {
+            let e = d0[(j + k) % n];
+            assert!(close(dk[j].x, e.x, 1e-9) && close(dk[j].y, e.y, 1e-9), "{k} ahead, point {j}: {:?} vs {e:?}", dk[j]);
+        }
+    }
+    // Whole turns either way leave the path as it is.
+    let base = wiggle(&s, &w, 0.4);
+    assert_eq!(wiggle(&s, &WiggleParams { spatial_phase_deg: 360.0, ..w }, 0.4), base);
+    assert_eq!(wiggle(&s, &WiggleParams { spatial_phase_deg: -720.0, ..w }, 0.4), base);
+    // Half a point ahead, the displacements change and stay within Size.
+    let half = disp(WiggleParams { spatial_phase_deg: 180.0 / n as f64, ..w });
+    assert!(half.iter().zip(&d0).any(|(h, d)| (*h - *d).hypot() > 1e-3));
+    assert!(half.iter().all(|h| h.x.abs() <= 10.0 + 1e-9 && h.y.abs() <= 10.0 + 1e-9));
+}
+
 // ---------------------------------------------------------------- merge / booleans
 
 fn inclusion_exclusion(a: BezPath, b: BezPath) {
diff --git a/crates/path/src/trace.rs b/crates/path/src/trace.rs
index 429738032..01508bcaf 100644
--- a/crates/path/src/trace.rs
+++ b/crates/path/src/trace.rs
@@ -6,7 +6,7 @@
 //!    with "outside" so every contour closes.
 //! 2. **Douglas–Peucker** simplification of each closed loop to the Tolerance (pixels).
 //! 3. **Bezier fitting**: each simplified span is fitted with one cubic (least squares with fixed
-//!    end tangents, Newton reparameterisation; [`crate::fit`]). The tangent at each vertex is the
+//!    end tangents, Newton reparameterisation; `crate::fit`). The tangent at each vertex is the
 //!    chord direction at Corner Roundness 0 (straight segments, sharp corners) and the smooth
 //!    (Catmull–Rom) direction at 100 %, blended between.
 //!
diff --git a/crates/pdf/Cargo.toml b/crates/pdf/Cargo.toml
index b37dff50f..bf6148569 100644
--- a/crates/pdf/Cargo.toml
+++ b/crates/pdf/Cargo.toml
@@ -14,7 +14,7 @@ craft-pdf.workspace = true
 effectcraft-svg = { workspace = true }
 kurbo = { workspace = true }
 effectcraft-text = { workspace = true }
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
 # Embedded TrueType / OpenType font programs (MIT OR Apache-2.0).
 skrifa = { workspace = true }
 # DCT (JPEG) images (MIT OR Apache-2.0 OR Zlib; pure Rust).
diff --git a/crates/pdf/README.md b/crates/pdf/README.md
index 1d6bf3c13..eb960cc6e 100644
--- a/crates/pdf/README.md
+++ b/crates/pdf/README.md
@@ -29,7 +29,13 @@ ffmpeg elsewhere) to check the code tables against an independent implementation
   the app's existing object model. References retain object and generation numbers. A bounded
   compatibility repair recovers referenced objects from object streams when damaged xrefs omit
   them; every recovery or unresolved reference is reported in `Doc::skipped` (up to 64 messages).
-  The existing page tree preserves inherited resources, MediaBox / CropBox and `/Rotate`.
+  The existing page tree preserves inherited resources, MediaBox / CropBox and `/Rotate`. A page
+  is its CropBox (else MediaBox), turned by `/Rotate` (`Framing::Viewer`, the default). Footage
+  from an After Effects project is framed as After Effects places a PDF or `.ai`
+  (`Framing::Placed`, `parse_page_framed`): the page's own ArtBox clipped to the CropBox (else
+  MediaBox) when it has one, else the CropBox, else the MediaBox, with `/Rotate` ignored
+  (measured in After Effects 2026 with own files, #3099). Not measured: a CropBox without an
+  ArtBox, files saved by Illustrator itself, `.pdf` names.
   Content/image filters remain app-owned: Flate (with PNG predictors), LZW, ASCIIHex, ASCII85,
   RunLength and CCITTFax. Encrypted files remain refused; `page_count` returns zero when the
   reader refuses a document.
@@ -138,15 +144,17 @@ ffmpeg elsewhere) to check the code tables against an independent implementation
 ## Shared parser setup and bounds
 
 The workspace pins `craft-pdf` to `craft-libs` Git revision
-`ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d`, with `default-features = false` and only the explicit `read`
+`92d392cff132eaf53e13afff77f38b5c11b73aa0`, with `default-features = false` and only the explicit `read`
 feature. This excludes the backend's bundled fonts and Adobe CMaps and preserves EffectCraft's
 font and asset policies. The shared parser does not change the supported drawing operators,
 image codecs, continuously rasterized SVG tree, editable shapes, or EPS interpreter.
 This revision removes an unchecked lazy-array read and preserves later values and pages after
 sign-only numeric entries; the app exercises those inputs through its object adapter, public
-page parser and rasterizer on native and WASM targets.
+page parser and rasterizer on native and WASM targets. It also bounds xref, object-stream and
+graphics-state work, reads the full `/W[0]` xref type width, and caps JBIG2 segment references
+and bitmap allocation.
 
-The root Cargo patch pins Hayro-syntax to the same `storytold/craft-libs` revision. `cargo xtask pdf-deps` checks this graph and refuses
+The root Cargo patch pins Hayro-syntax and Hayro-jbig2 to the same `storytold/craft-libs` revision. `cargo xtask pdf-deps` checks this graph and refuses
 an enabled Hayro interpreter, rasterizer or CMap dependency. The shared revision must be
 published before a fresh app checkout can resolve it; no sibling checkout is required.
 
diff --git a/crates/pdf/src/font.rs b/crates/pdf/src/font.rs
index 296878c31..64b0a1c3a 100644
--- a/crates/pdf/src/font.rs
+++ b/crates/pdf/src/font.rs
@@ -89,7 +89,7 @@ impl OutlinePen for Pen {
 
 /// A bundled stand-in for a font that is not embedded, by its PostScript name.
 fn fallback(base: &str) -> &'static [u8] {
-    use effectcraft_text::fonts::*;
+    use effectcraft_text::fonts::{INTER_BOLD, INTER_ITALIC, INTER_REGULAR, INTER_SEMIBOLD, JETBRAINS_MONO_REGULAR, NOTO_SERIF_REGULAR};
     let b = base.to_ascii_lowercase();
     if b.contains("courier") || b.contains("mono") || b.contains("consol") {
         return JETBRAINS_MONO_REGULAR;
@@ -263,8 +263,8 @@ fn parse_cmap(data: &[u8]) -> CMap {
                                 }
                                 Obj::Array(list) => {
                                     for (k, s) in list.iter().enumerate() {
-                                        if let Obj::Str(s) = s {
-                                            m.unicode.insert(lo + k as u32, utf16(s));
+                                        if let (Obj::Str(s), Some(c)) = (s, lo.checked_add(k as u32)) {
+                                            m.unicode.insert(c, utf16(s));
                                         }
                                     }
                                 }
@@ -393,85 +393,10 @@ impl Font {
         }
         // Widths.
         if f.composite {
-            f.default_width = file.get_num(&desc_dict, "DW").unwrap_or(1000.0) / 1000.0;
-            if let Some(w) = file.get(&desc_dict, "W").and_then(Obj::array) {
-                let mut i = 0;
-                while i < w.len() {
-                    let first = file.resolve(&w[i]).num().unwrap_or(0.0) as u32;
-                    match w.get(i + 1).map(|x| file.resolve(x)) {
-                        Some(Obj::Array(list)) => {
-                            for (k, v) in list.iter().enumerate() {
-                                f.cid_widths.insert(first + k as u32, file.resolve(v).num().unwrap_or(0.0) / 1000.0);
-                            }
-                            i += 2;
-                        }
-                        Some(Obj::Num(last)) => {
-                            let wv = w.get(i + 2).and_then(|x| file.resolve(x).num()).unwrap_or(0.0) / 1000.0;
-                            for c in first..=(*last as u32).min(first + 65535) {
-                                f.cid_widths.insert(c, wv);
-                            }
-                            i += 3;
-                        }
-                        _ => break,
-                    }
-                }
-            }
-            // Vertical metrics (§9.7.4.3): /DW2 [vy w1y] and /W2 entries
-            // `c [w1y vx vy …]` or `cfirst clast w1y vx vy`.
-            let dw2 = file.get(&desc_dict, "DW2").map(|x| file.nums(x)).unwrap_or_default();
-            if dw2.len() == 2 {
-                f.dw2 = (dw2[0] / 1000.0, dw2[1] / 1000.0);
-            }
-            if let Some(w) = file.get(&desc_dict, "W2").and_then(Obj::array) {
-                let num = |i: usize| w.get(i).and_then(|x| file.resolve(x).num());
-                let mut i = 0;
-                while i < w.len() {
-                    let Some(first) = num(i) else { break };
-                    let first = first.max(0.0) as u32;
-                    match w.get(i + 1).map(|x| file.resolve(x)) {
-                        Some(Obj::Array(list)) => {
-                            let v: Vec<f64> = list.iter().filter_map(|x| file.resolve(x).num()).collect();
-                            for (k, t) in v.as_chunks::<3>().0.iter().enumerate() {
-                                f.cid_vmetrics.insert(first + k as u32, (t[0] / 1000.0, t[1] / 1000.0, t[2] / 1000.0));
-                            }
-                            i += 2;
-                        }
-                        Some(Obj::Num(last)) => {
-                            let (Some(w1), Some(vx), Some(vy)) = (num(i + 2), num(i + 3), num(i + 4)) else { break };
-                            for c in first..=(last.max(0.0) as u32).min(first + 65535) {
-                                f.cid_vmetrics.insert(c, (w1 / 1000.0, vx / 1000.0, vy / 1000.0));
-                            }
-                            i += 5;
-                        }
-                        _ => break,
-                    }
-                }
-            }
+            f.load_cid_widths(file, &desc_dict);
+            f.load_vertical_metrics(file, &desc_dict);
             f.has_widths = true;
-            // Encoding CMap.
-            match file.get(d, "Encoding") {
-                Some(Obj::Name(n)) => {
-                    f.vertical = n.ends_with("-V");
-                    if !n.starts_with("Identity") {
-                        skipped.push(format!("CMap {n}"));
-                    }
-                }
-                Some(Obj::Stream(sd, raw)) => {
-                    if let Some(data) = decode_stream(file, sd, raw) {
-                        let cm = parse_cmap(&data);
-                        f.vertical = cm.wmode || file.get_num(sd, "WMode") == Some(1.0);
-                        f.codespace = cm.codespace;
-                        f.cid_ranges = cm.cids;
-                    }
-                }
-                _ => {}
-            }
-            match file.get(&desc_dict, "CIDToGIDMap") {
-                Some(Obj::Stream(sd, raw)) => {
-                    f.cid_to_gid = decode_stream(file, sd, raw).map(|b| b.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect());
-                }
-                _ => f.cid_to_gid = None,
-            }
+            f.load_cid_encoding(file, d, &desc_dict, skipped);
         } else {
             f.first_char = file.get_num(d, "FirstChar").unwrap_or(0.0) as u32;
             if let Some(w) = file.get(d, "Widths") {
@@ -482,16 +407,113 @@ impl Font {
                 f.default_width = file.get_num(fd, "MissingWidth").unwrap_or(0.0);
             }
         }
+        f.load_program(file, d, fd.as_ref(), &subtype, skipped);
+        f.load_simple_encoding(file, d);
+        f
+    }
+
+    fn load_cid_widths(&mut self, file: &File, desc_dict: &Dict) {
+        self.default_width = file.get_num(desc_dict, "DW").unwrap_or(1000.0) / 1000.0;
+        if let Some(w) = file.get(desc_dict, "W").and_then(Obj::array) {
+            let mut i = 0;
+            while i < w.len() {
+                let first = file.resolve(&w[i]).num().unwrap_or(0.0) as u32;
+                match w.get(i + 1).map(|x| file.resolve(x)) {
+                    Some(Obj::Array(list)) => {
+                        for (k, v) in list.iter().enumerate() {
+                            if let Some(cid) = first.checked_add(k as u32) {
+                                self.cid_widths.insert(cid, file.resolve(v).num().unwrap_or(0.0) / 1000.0);
+                            }
+                        }
+                        i += 2;
+                    }
+                    Some(Obj::Num(last)) => {
+                        let wv = w.get(i + 2).and_then(|x| file.resolve(x).num()).unwrap_or(0.0) / 1000.0;
+                        for c in first..=(*last as u32).min(first.saturating_add(65535)) {
+                            self.cid_widths.insert(c, wv);
+                        }
+                        i += 3;
+                    }
+                    _ => break,
+                }
+            }
+        }
+    }
+
+    fn load_vertical_metrics(&mut self, file: &File, desc_dict: &Dict) {
+        // Vertical metrics (§9.7.4.3): /DW2 [vy w1y] and /W2 entries
+        // `c [w1y vx vy …]` or `cfirst clast w1y vx vy`.
+        let dw2 = file.get(desc_dict, "DW2").map(|x| file.nums(x)).unwrap_or_default();
+        if dw2.len() == 2 {
+            self.dw2 = (dw2[0] / 1000.0, dw2[1] / 1000.0);
+        }
+        if let Some(w) = file.get(desc_dict, "W2").and_then(Obj::array) {
+            let num = |i: usize| w.get(i).and_then(|x| file.resolve(x).num());
+            let mut i = 0;
+            while i < w.len() {
+                let Some(first) = num(i) else { break };
+                let first = first.max(0.0) as u32;
+                match w.get(i + 1).map(|x| file.resolve(x)) {
+                    Some(Obj::Array(list)) => {
+                        let v: Vec<f64> = list.iter().filter_map(|x| file.resolve(x).num()).collect();
+                        for (k, t) in v.as_chunks::<3>().0.iter().enumerate() {
+                            if let Some(cid) = first.checked_add(k as u32) {
+                                self.cid_vmetrics.insert(cid, (t[0] / 1000.0, t[1] / 1000.0, t[2] / 1000.0));
+                            }
+                        }
+                        i += 2;
+                    }
+                    Some(Obj::Num(last)) => {
+                        let (Some(w1), Some(vx), Some(vy)) = (num(i + 2), num(i + 3), num(i + 4)) else { break };
+                        for c in first..=(last.max(0.0) as u32).min(first.saturating_add(65535)) {
+                            self.cid_vmetrics.insert(c, (w1 / 1000.0, vx / 1000.0, vy / 1000.0));
+                        }
+                        i += 5;
+                    }
+                    _ => break,
+                }
+            }
+        }
+    }
+
+    fn load_cid_encoding(&mut self, file: &File, d: &Dict, desc_dict: &Dict, skipped: &mut Vec<String>) {
+        // Encoding CMap.
+        match file.get(d, "Encoding") {
+            Some(Obj::Name(n)) => {
+                self.vertical = n.ends_with("-V");
+                if !n.starts_with("Identity") {
+                    skipped.push(format!("CMap {n}"));
+                }
+            }
+            Some(Obj::Stream(sd, raw)) => {
+                if let Some(data) = decode_stream(file, sd, raw) {
+                    let cm = parse_cmap(&data);
+                    self.vertical = cm.wmode || file.get_num(sd, "WMode") == Some(1.0);
+                    self.codespace = cm.codespace;
+                    self.cid_ranges = cm.cids;
+                }
+            }
+            _ => {}
+        }
+        match file.get(desc_dict, "CIDToGIDMap") {
+            Some(Obj::Stream(sd, raw)) => {
+                self.cid_to_gid = decode_stream(file, sd, raw).map(|b| b.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect());
+            }
+            _ => self.cid_to_gid = None,
+        }
+    }
+
+    fn load_program(&mut self, file: &File, d: &Dict, fd: Option<&Dict>, subtype: &str, skipped: &mut Vec<String>) {
         // The program.
         let font_file = |key: &str| -> Option<(Dict, Vec<u8>)> {
-            let fd = fd.as_ref()?;
+            let fd = fd?;
             match file.get(fd, key) {
                 Some(Obj::Stream(sd, raw)) => Some((sd.clone(), decode_stream(file, sd, raw)?)),
                 _ => None,
             }
         };
         if subtype == "Type3" {
-            f.matrix = file
+            self.matrix = file
                 .get(d, "FontMatrix")
                 .map(|m| file.nums(m))
                 .filter(|m| m.len() == 6)
@@ -507,76 +529,78 @@ impl Font {
                     }
                 }
             }
-            f.program = Program::Type3 { procs, resources: file.get_dict(d, "Resources").cloned() };
+            self.program = Program::Type3 { procs, resources: file.get_dict(d, "Resources").cloned() };
             // Type 3 widths are in glyph space.
-            let m = f.matrix.as_coeffs()[0];
-            for w in &mut f.widths {
+            let m = self.matrix.as_coeffs()[0];
+            for w in &mut self.widths {
                 *w *= m * 1000.0;
             }
         } else if let Some((_, data)) = font_file("FontFile2") {
-            f.program = Program::TrueType(Arc::new(data));
+            self.program = Program::TrueType(Arc::new(data));
         } else if let Some((sd, data)) = font_file("FontFile3") {
             match file.get(&sd, "Subtype").and_then(Obj::name) {
                 Some("OpenType") => {
                     // An OpenType wrapper: TrueType outlines through skrifa, CFF through ours.
                     let cff = FontRef::new(&data).ok().and_then(|fr| fr.table_data(skrifa::Tag::new(b"CFF ")).map(|t| t.as_bytes().to_vec()));
                     match cff.and_then(|c| Cff::parse(&c)) {
-                        Some(c) => f.program = Program::Cff(Box::new(c)),
-                        None => f.program = Program::TrueType(Arc::new(data)),
+                        Some(c) => self.program = Program::Cff(Box::new(c)),
+                        None => self.program = Program::TrueType(Arc::new(data)),
                     }
                 }
                 _ => match Cff::parse(&data) {
-                    Some(c) => f.program = Program::Cff(Box::new(c)),
+                    Some(c) => self.program = Program::Cff(Box::new(c)),
                     None => skipped.push("font program (CFF)".into()),
                 },
             }
         } else if let Some((_, data)) = font_file("FontFile") {
             match Type1::parse(&data) {
-                Some(t) => f.program = Program::Type1(Box::new(t)),
+                Some(t) => self.program = Program::Type1(Box::new(t)),
                 None => skipped.push("font program (Type 1)".into()),
             }
         } else {
-            f.program = Program::Fallback(fallback(&base_name));
+            self.program = Program::Fallback(fallback(&self.base_name));
         }
-        if let Program::Cff(c) = &f.program {
+        if let Program::Cff(c) = &self.program {
             let m = c.font_matrix;
-            f.matrix = Affine::new(m);
+            self.matrix = Affine::new(m);
         }
-        if let Program::Type1(t) = &f.program
+        if let Program::Type1(t) = &self.program
             && let Some(m) = t.font_matrix
         {
-            f.matrix = Affine::new(m);
+            self.matrix = Affine::new(m);
         }
+    }
+
+    fn load_simple_encoding(&mut self, file: &File, d: &Dict) {
         // Simple-font encoding: base encoding, built-in encoding, Differences.
-        if !f.composite {
+        if !self.composite {
             let enc = file.get(d, "Encoding").map(|e| file.resolve(e));
             let base = match enc {
                 Some(Obj::Name(n)) => Base::from_name(n),
                 Some(Obj::Dict(e)) => file.get(e, "BaseEncoding").and_then(Obj::name).and_then(Base::from_name),
                 _ => None,
             };
-            let builtin: Option<Vec<Option<String>>> = match &f.program {
+            let builtin: Option<Vec<Option<String>>> = match &self.program {
                 Program::Type1(t) if !t.encoding.is_empty() => Some((0..256).map(|c| t.encoding.get(&(c as u8)).cloned()).collect()),
                 _ => None,
             };
-            let fallback_base = if f.symbolic { None } else { Some(Base::Standard) };
+            let fallback_base = if self.symbolic { None } else { Some(Base::Standard) };
             for c in 0..256usize {
-                f.names[c] = match (base, &builtin) {
+                self.names[c] = match (base, &builtin) {
                     (Some(b), _) => b.name(c as u8),
                     (None, Some(bi)) => bi[c].clone(),
-                    (None, None) => match &f.program {
+                    (None, None) => match &self.program {
                         // TrueType symbolic fonts map codes directly; others use Standard.
-                        Program::TrueType(_) if f.symbolic => None,
-                        Program::Fallback(_) if base_name.contains("Symbol") || base_name.contains("Dingbats") => None,
+                        Program::TrueType(_) if self.symbolic => None,
+                        Program::Fallback(_) if self.base_name.contains("Symbol") || self.base_name.contains("Dingbats") => None,
                         _ => fallback_base.or(Some(Base::Standard)).and_then(|b| b.name(c as u8)),
                     },
                 };
             }
             if let Some(Obj::Dict(e)) = enc {
-                differences(file, e, &mut f.names);
+                differences(file, e, &mut self.names);
             }
         }
-        f
     }
 
     /// Split a string into (code, byte length) pairs.
@@ -609,7 +633,7 @@ impl Font {
         if self.cid_ranges.is_empty() {
             return code;
         }
-        self.cid_ranges.iter().find(|(lo, hi, _)| code >= *lo && code <= *hi).map(|(lo, _, c)| c + (code - lo)).unwrap_or(0)
+        self.cid_ranges.iter().find(|(lo, hi, _)| code >= *lo && code <= *hi).and_then(|(lo, _, c)| c.checked_add(code - lo)).unwrap_or(0)
     }
 
     /// Vertical metrics of a code in text space (before the font size): the vertical
diff --git a/crates/pdf/src/image.rs b/crates/pdf/src/image.rs
index 4d55fef8e..7006979c2 100644
--- a/crates/pdf/src/image.rs
+++ b/crates/pdf/src/image.rs
@@ -16,6 +16,7 @@ pub(crate) struct Decoded {
 /// The longest side of a decoded image (larger images are refused rather than exhausting
 /// memory).
 const MAX_SIDE: usize = 16384;
+const MAX_PIXELS: usize = 64 << 20;
 
 fn get<'a>(file: &'a File, d: &'a Dict, long: &str, short: &str) -> Option<&'a Obj> {
     file.get(d, long).or_else(|| file.get(d, short))
@@ -114,6 +115,11 @@ fn jpeg_decode(data: &[u8]) -> Result<(Vec<u8>, usize), String> {
     use zune_jpeg::zune_core::options::DecoderOptions;
     let mut probe = JpegDecoder::new(std::io::Cursor::new(data));
     probe.decode_headers().map_err(|_| "image (JPEG)".to_string())?;
+    // Bound the header-declared size before decode() allocates the output.
+    let (hw, hh) = probe.dimensions().ok_or_else(|| "image (JPEG)".to_string())?;
+    if hw.checked_mul(hh).is_none_or(|p| p > MAX_PIXELS) {
+        return Err("image (JPEG)".to_string());
+    }
     let n = probe.input_colorspace().map(|c| c.num_components()).unwrap_or(3);
     let out = match n {
         1 => ColorSpace::Luma,
@@ -134,8 +140,17 @@ fn jpeg_decode(data: &[u8]) -> Result<(Vec<u8>, usize), String> {
 
 /// Unpack `w`×`h` samples of `n` components at `bpc` bits into 0..=max integers.
 fn unpack(data: &[u8], w: usize, h: usize, n: usize, bpc: usize) -> Vec<u16> {
-    let row_bytes = (w * n * bpc).div_ceil(8);
-    let mut out = Vec::with_capacity(w * h * n);
+    let Some(samples) = w.checked_mul(h).and_then(|p| p.checked_mul(n)).filter(|count| *count <= MAX_PIXELS.saturating_mul(4)) else { return Vec::new() };
+    let Some(row_bits) = w.checked_mul(n).and_then(|v| v.checked_mul(bpc)) else { return Vec::new() };
+    let row_bytes = row_bits.div_ceil(8);
+    let Some(row_len) = row_bytes.checked_mul(h) else { return Vec::new() };
+    if row_len > data.len() {
+        return Vec::new();
+    }
+    let mut out = Vec::new();
+    if out.try_reserve_exact(samples).is_err() {
+        return Vec::new();
+    }
     for y in 0..h {
         let row = data.get(y * row_bytes..((y + 1) * row_bytes).min(data.len())).unwrap_or(&[]);
         for i in 0..w * n {
@@ -157,10 +172,22 @@ fn unpack(data: &[u8], w: usize, h: usize, n: usize, bpc: usize) -> Vec<u16> {
 
 /// Nearest-neighbour resample of a single-channel 8-bit mask to `w`×`h`.
 fn resample(m: &[u8], mw: usize, mh: usize, w: usize, h: usize) -> Vec<u8> {
+    let Some(pixels) = w.checked_mul(h).filter(|p| *p <= MAX_PIXELS) else { return Vec::new() };
+    if mw.checked_mul(mh).is_none_or(|n| n > m.len()) {
+        return Vec::new();
+    }
     if mw == w && mh == h {
-        return m.to_vec();
+        let mut out = Vec::new();
+        if out.try_reserve_exact(pixels).is_err() {
+            return Vec::new();
+        }
+        out.extend_from_slice(&m[..pixels]);
+        return out;
+    }
+    let mut out = Vec::new();
+    if out.try_reserve_exact(pixels).is_err() {
+        return Vec::new();
     }
-    let mut out = Vec::with_capacity(w * h);
     for y in 0..h {
         let sy = (y * mh / h.max(1)).min(mh.saturating_sub(1));
         for x in 0..w {
@@ -176,12 +203,16 @@ fn mask_image(file: &File, o: &Obj, soft: bool) -> Option<(Vec<u8>, usize, usize
     let Obj::Stream(d, raw) = file.resolve(o) else { return None };
     let w = file.get_num(d, "Width")? as usize;
     let h = file.get_num(d, "Height")? as usize;
-    if w == 0 || h == 0 || w > MAX_SIDE || h > MAX_SIDE {
+    if w == 0 || h == 0 || w > MAX_SIDE || h > MAX_SIDE || w.checked_mul(h).is_none_or(|p| p > MAX_PIXELS) {
         return None;
     }
     let (data, jpeg_n) = samples(file, d, raw).ok()?;
+    let pixels = w.checked_mul(h)?;
     if jpeg_n.is_some() {
-        return Some((data.into_iter().step_by(jpeg_n.unwrap_or(1)).take(w * h).collect(), w, h));
+        let mut out = Vec::new();
+        out.try_reserve_exact(pixels).ok()?;
+        out.extend(data.into_iter().step_by(jpeg_n.unwrap_or(1)).take(pixels));
+        return Some((out, w, h));
     }
     let bpc = if soft { file.get_num(d, "BitsPerComponent").unwrap_or(8.0) as usize } else { 1 };
     // Like `decode()`: only 1/2/4/8/16-bit depths are supported. Anything else (notably
@@ -192,19 +223,21 @@ fn mask_image(file: &File, o: &Obj, soft: bool) -> Option<(Vec<u8>, usize, usize
     let max = ((1u32 << bpc) - 1).max(1) as f64;
     let dec = file.get(d, "Decode").map(|x| file.nums(x)).filter(|v| v.len() >= 2);
     let v = unpack(&data, w, h, 1, bpc);
-    let out = v
-        .into_iter()
-        .map(|s| {
-            let t = s as f64 / max;
-            let t = match &dec {
-                Some(dd) => dd[0] + t * (dd[1] - dd[0]),
-                None => t,
-            };
-            // Explicit (stencil) masks: sample 1 masks out with the default Decode.
-            let a = if soft { t } else { 1.0 - t };
-            (a.clamp(0.0, 1.0) * 255.0).round() as u8
-        })
-        .collect();
+    if v.len() != pixels {
+        return None;
+    }
+    let mut out = Vec::new();
+    out.try_reserve_exact(pixels).ok()?;
+    out.extend(v.into_iter().map(|s| {
+        let t = s as f64 / max;
+        let t = match &dec {
+            Some(dd) => dd[0] + t * (dd[1] - dd[0]),
+            None => t,
+        };
+        // Explicit (stencil) masks: sample 1 masks out with the default Decode.
+        let a = if soft { t } else { 1.0 - t };
+        (a.clamp(0.0, 1.0) * 255.0).round() as u8
+    }));
     Some((out, w, h))
 }
 
@@ -212,15 +245,24 @@ fn mask_image(file: &File, o: &Obj, soft: bool) -> Option<(Vec<u8>, usize, usize
 pub(crate) fn decode(file: &File, d: &Dict, raw: &[u8], res: Option<&Dict>, fill: [f64; 3]) -> Result<Decoded, String> {
     let w = file.get_num(d, "Width").unwrap_or(0.0) as usize;
     let h = file.get_num(d, "Height").unwrap_or(0.0) as usize;
-    if w == 0 || h == 0 || w > MAX_SIDE || h > MAX_SIDE || w * h > 64 << 20 {
+    let Some(pixels) = w.checked_mul(h).filter(|p| *p <= MAX_PIXELS) else {
+        return Err("image (size)".into());
+    };
+    if w == 0 || h == 0 || w > MAX_SIDE || h > MAX_SIDE {
         return Err("image (size)".into());
     }
     let stencil = matches!(file.get(d, "ImageMask"), Some(Obj::Bool(true)));
     let (data, jpeg_n) = samples(file, d, raw)?;
     let decode_arr = file.get(d, "Decode").map(|x| file.nums(x)).unwrap_or_default();
-    let mut rgba = vec![0u8; w * h * 4];
+    let rgba_len = pixels.checked_mul(4).ok_or_else(|| "image (size)".to_string())?;
+    let mut rgba = Vec::new();
+    rgba.try_reserve_exact(rgba_len).map_err(|_| "image (allocation)".to_string())?;
+    rgba.resize(rgba_len, 0);
     if stencil {
         let v = unpack(&data, w, h, 1, 1);
+        if v.len() != pixels {
+            return Err("image (sample allocation)".into());
+        }
         let paint_on = if decode_arr.first().copied().unwrap_or(0.0) > 0.5 { 1 } else { 0 };
         let c = fill.map(|x| (x.clamp(0.0, 1.0) * 255.0).round() as u8);
         for (i, s) in v.into_iter().enumerate() {
@@ -243,8 +285,14 @@ pub(crate) fn decode(file: &File, d: &Dict, raw: &[u8], res: Option<&Dict>, fill
     if !matches!(bpc, 1 | 2 | 4 | 8 | 16) {
         return Err(format!("image ({bpc} bits per component)"));
     }
+    let Some(sample_count) = pixels.checked_mul(n).filter(|n| *n <= MAX_PIXELS.saturating_mul(4)) else {
+        return Err("image (size)".into());
+    };
     let max = ((1u32 << bpc) - 1) as f64;
     let raw_samples = unpack(&data, w, h, n, bpc);
+    if raw_samples.len() != sample_count {
+        return Err("image (sample allocation)".into());
+    }
     // Decode ranges per component.
     let indexed = matches!(cs, Cs::Indexed { .. });
     let range = |k: usize| -> (f64, f64) {
@@ -262,7 +310,7 @@ pub(crate) fn decode(file: &File, d: &Dict, raw: &[u8], res: Option<&Dict>, fill
         Cs::Indexed { hival, .. } if n == 1 => Some((0..=*hival).map(|i| cs.to_rgb(&[i as f64])).collect()),
         _ => None,
     };
-    for i in 0..w * h {
+    for i in 0..pixels {
         if let Some(pal) = &palette {
             let s = raw_samples[i] as f64 / max;
             let (a, b) = ranges[0];
@@ -288,7 +336,7 @@ pub(crate) fn decode(file: &File, d: &Dict, raw: &[u8], res: Option<&Dict>, fill
         Some(Obj::Array(a)) => {
             let keys: Vec<f64> = a.iter().filter_map(|x| file.resolve(x).num()).collect();
             if keys.len() >= 2 * n {
-                for i in 0..w * h {
+                for i in 0..pixels {
                     if (0..n).all(|k| {
                         let v = raw_samples[i * n + k] as f64;
                         v >= keys[2 * k] && v <= keys[2 * k + 1]
@@ -300,7 +348,7 @@ pub(crate) fn decode(file: &File, d: &Dict, raw: &[u8], res: Option<&Dict>, fill
         }
         Some(m @ Obj::Stream(..)) => {
             if let Some((m, mw, mh)) = mask_image(file, m, false) {
-                for (i, a) in resample(&m, mw, mh, w, h).into_iter().enumerate() {
+                for (i, a) in resample(&m, mw, mh, w, h).into_iter().take(pixels).enumerate() {
                     rgba[i * 4 + 3] = a;
                 }
             }
@@ -310,7 +358,7 @@ pub(crate) fn decode(file: &File, d: &Dict, raw: &[u8], res: Option<&Dict>, fill
     if let Some(sm) = file.get(d, "SMask")
         && let Some((m, mw, mh)) = mask_image(file, sm, true)
     {
-        for (i, a) in resample(&m, mw, mh, w, h).into_iter().enumerate() {
+        for (i, a) in resample(&m, mw, mh, w, h).into_iter().take(pixels).enumerate() {
             rgba[i * 4 + 3] = ((rgba[i * 4 + 3] as u32 * a as u32) / 255) as u8;
         }
     }
diff --git a/crates/pdf/src/lib.rs b/crates/pdf/src/lib.rs
index 7c766559f..ff914e759 100644
--- a/crates/pdf/src/lib.rs
+++ b/crates/pdf/src/lib.rs
@@ -92,8 +92,25 @@ pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
 
 /// Parse page `index` of a PDF (EPS files have one page).
 pub fn parse_page(bytes: &[u8], index: usize) -> Result<Doc, Error> {
+    parse_page_framed(bytes, index, Framing::Viewer)
+}
+
+/// Which region of a PDF page becomes the document, and whether `/Rotate` turns it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Framing {
+    /// As a PDF viewer shows the page: its CropBox (else MediaBox), turned by `/Rotate`.
+    #[default]
+    Viewer,
+    /// As After Effects places a PDF or `.ai` as footage: the page's ArtBox clipped to the
+    /// CropBox (else MediaBox) when it has one, else the CropBox, else the MediaBox, with
+    /// `/Rotate` ignored (measured in After Effects 2026 with own files, #3099).
+    Placed,
+}
+
+/// [`parse_page`] with the page framed as `framing` says (EPS files are their bounding box).
+pub fn parse_page_framed(bytes: &[u8], index: usize, framing: Framing) -> Result<Doc, Error> {
     match sniff(bytes) {
-        Some(Format::Pdf) => parse_pdf(bytes, index),
+        Some(Format::Pdf) => parse_pdf(bytes, index, framing),
         Some(Format::Eps) => parse_eps(bytes),
         None => Err(Error::NotVector),
     }
@@ -142,17 +159,22 @@ fn finish(nodes: Vec<Node>, flags: Vec<bool>, skipped: Vec<String>, width: f64,
     Doc { width, height, root, skipped }
 }
 
-fn parse_pdf(bytes: &[u8], index: usize) -> Result<Doc, Error> {
+/// Page `index` of a PDF framed as `framing` says, as a document in points (y down).
+fn parse_pdf(bytes: &[u8], index: usize, framing: Framing) -> Result<Doc, Error> {
     let file = object::File::parse(bytes)?;
     let pages = page::pages(&file);
     if pages.is_empty() {
         return Err(Error::NoPages);
     }
     let pg = pages.get(index).ok_or(Error::PageOutOfRange(index))?;
-    let [x0, y0, x1, y1] = pg.bbox;
+    let (frame, rotate) = match framing {
+        Framing::Viewer => (pg.bbox, pg.rotate),
+        Framing::Placed => (pg.art.unwrap_or(pg.bbox), 0),
+    };
+    let [x0, y0, x1, y1] = frame;
     let (w, h) = (x1 - x0, y1 - y0);
     // Default user space (y up) → document pixels (y down), with the page's /Rotate.
-    let (to_doc, dw, dh) = match pg.rotate {
+    let (to_doc, dw, dh) = match rotate {
         90 => (Affine::new([0.0, 1.0, 1.0, 0.0, -y0, -x0]), h, w),
         180 => (Affine::new([-1.0, 0.0, 0.0, 1.0, x1, -y0]), w, h),
         270 => (Affine::new([0.0, -1.0, -1.0, 0.0, y1, x1]), h, w),
@@ -218,11 +240,3 @@ pub fn layer_doc_with_sizes(doc: &Doc, index: usize, retain: bool) -> (Doc, [f64
 
 #[cfg(test)]
 mod tests;
-#[cfg(test)]
-mod tests_groups;
-#[cfg(test)]
-mod tests_import;
-#[cfg(test)]
-mod tests_reader;
-#[cfg(test)]
-mod tests_shading;
diff --git a/crates/pdf/src/object.rs b/crates/pdf/src/object.rs
index cdbb9733a..79a91dde8 100644
--- a/crates/pdf/src/object.rs
+++ b/crates/pdf/src/object.rs
@@ -275,19 +275,26 @@ fn hexv(c: u8) -> u8 {
     }
 }
 
-fn decode_name(w: &[u8]) -> String {
-    let mut out = vec![];
+/// The bytes of a name token (after its `/`), with `#xx` escapes decoded.
+pub(crate) fn name_bytes(w: &[u8]) -> impl Iterator<Item = u8> {
     let mut i = 0;
-    while i < w.len() {
-        if w[i] == b'#' && w.get(i + 1).is_some_and(u8::is_ascii_hexdigit) && w.get(i + 2).is_some_and(u8::is_ascii_hexdigit) {
-            out.push((hexv(w[i + 1]) << 4) | hexv(w[i + 2]));
-            i += 3;
-        } else {
-            out.push(w[i]);
-            i += 1;
+    std::iter::from_fn(move || {
+        let c = *w.get(i)?;
+        match (c, w.get(i + 1), w.get(i + 2)) {
+            (b'#', Some(&hi), Some(&lo)) if hi.is_ascii_hexdigit() && lo.is_ascii_hexdigit() => {
+                i += 3;
+                Some((hexv(hi) << 4) | hexv(lo))
+            }
+            _ => {
+                i += 1;
+                Some(c)
+            }
         }
-    }
-    String::from_utf8_lossy(&out).into_owned()
+    })
+}
+
+fn decode_name(w: &[u8]) -> String {
+    String::from_utf8_lossy(&name_bytes(w).collect::<Vec<_>>()).into_owned()
 }
 
 pub fn parse_num(w: &[u8]) -> Option<f64> {
diff --git a/crates/pdf/src/page.rs b/crates/pdf/src/page.rs
index b7eb70fe0..0ebc0421d 100644
--- a/crates/pdf/src/page.rs
+++ b/crates/pdf/src/page.rs
@@ -23,6 +23,9 @@ pub struct Page {
     pub resources: Dict,
     /// CropBox (else MediaBox) `[x0, y0, x1, y1]`.
     pub bbox: [f64; 4],
+    /// The page's own ArtBox clipped to [`Page::bbox`] (ISO 32000-1 §14.11.2), when it has one
+    /// that keeps an area there; not inherited (table 30).
+    pub art: Option<[f64; 4]>,
     pub rotate: i32,
 }
 
@@ -31,13 +34,15 @@ pub fn pages(file: &File) -> Vec<Page> {
     let mut out = vec![];
     let Some(cat) = file.catalog() else { return out };
     let Some(root) = file.get_dict(cat, "Pages") else { return out };
+    /// Collects the pages under `node`, passing on the attributes pages inherit (resources,
+    /// MediaBox, CropBox, /Rotate); bounded in depth and page count.
     fn walk(file: &File, node: &Dict, inherited: (Option<Dict>, Option<Vec<f64>>, Option<Vec<f64>>, i32), out: &mut Vec<Page>, depth: usize) {
         if depth > 32 || out.len() > 10_000 {
             return;
         }
         let res = file.get_dict(node, "Resources").cloned().or(inherited.0);
-        let media = file.get(node, "MediaBox").map(|m| file.nums(m)).filter(|v| v.len() == 4).or(inherited.1);
-        let crop = file.get(node, "CropBox").map(|m| file.nums(m)).filter(|v| v.len() == 4).or(inherited.2);
+        let media = file.get(node, "MediaBox").map(|m| file.nums(m)).filter(|v| is_area(v)).or(inherited.1);
+        let crop = file.get(node, "CropBox").map(|m| file.nums(m)).filter(|v| is_area(v)).or(inherited.2);
         let rot = file.get_num(node, "Rotate").map(|r| r as i32).unwrap_or(inherited.3);
         match file.get(node, "Kids").and_then(Obj::array) {
             Some(kids) if file.get(node, "Type").and_then(Obj::name) != Some("Page") => {
@@ -49,8 +54,16 @@ pub fn pages(file: &File) -> Vec<Page> {
             }
             _ => {
                 let b = crop.or(media).unwrap_or_else(|| vec![0.0, 0.0, 612.0, 792.0]);
-                let bbox = [b[0].min(b[2]), b[1].min(b[3]), b[0].max(b[2]), b[1].max(b[3])];
-                out.push(Page { dict: node.clone(), resources: res.unwrap_or_default(), bbox, rotate: rot.rem_euclid(360) });
+                let bbox = normalized(&b).unwrap_or([0.0, 0.0, 612.0, 792.0]);
+                // The ArtBox is the page's own (not inherited), clipped to the crop box.
+                let art = file
+                    .get(node, "ArtBox")
+                    .map(|m| file.nums(m))
+                    .filter(|v| is_area(v))
+                    .and_then(|v| normalized(&v))
+                    .map(|a| [a[0].max(bbox[0]), a[1].max(bbox[1]), a[2].min(bbox[2]), a[3].min(bbox[3])])
+                    .filter(|a| a[2] > a[0] && a[3] > a[1]);
+                out.push(Page { dict: node.clone(), resources: res.unwrap_or_default(), bbox, art, rotate: rot.rem_euclid(360) });
             }
         }
     }
@@ -58,6 +71,26 @@ pub fn pages(file: &File) -> Vec<Page> {
     out
 }
 
+/// A box `[x0, y0, x1, y1]` (corners in any order) with finite corners and a finite span that
+/// encloses an area.
+fn is_area(v: &[f64]) -> bool {
+    match v {
+        [x0, y0, x1, y1] => {
+            let (w, h) = (x1 - x0, y1 - y0);
+            v.iter().all(|c| c.is_finite()) && w.is_finite() && h.is_finite() && w.abs() > 0.0 && h.abs() > 0.0
+        }
+        _ => false,
+    }
+}
+
+/// A box with its corners ordered (`x0 < x1`, `y0 < y1`), `None` unless [`is_area`].
+fn normalized(v: &[f64]) -> Option<[f64; 4]> {
+    match v {
+        [x0, y0, x1, y1] if is_area(v) => Some([x0.min(*x1), y0.min(*y1), x0.max(*x1), y0.max(*y1)]),
+        _ => None,
+    }
+}
+
 /// The page's content streams, decoded and joined.
 pub fn page_content(file: &File, page: &Page) -> Vec<u8> {
     let mut out = vec![];
diff --git a/crates/pdf/src/ps.rs b/crates/pdf/src/ps.rs
index 45db6c2ea..3d734e46c 100644
--- a/crates/pdf/src/ps.rs
+++ b/crates/pdf/src/ps.rs
@@ -18,294 +18,16 @@ use crate::build::{Builder, MAX_PATH};
 use crate::font::Font;
 use crate::object::{ascii85, is_white, parse_num};
 
-type DictRef = Rc<RefCell<HashMap<String, V>>>;
+mod builtin;
+mod eps;
+mod exec;
+mod paths;
+mod scanner;
+mod text;
+mod value;
 
-#[derive(Clone)]
-enum V {
-    Num(f64),
-    Bool(bool),
-    /// An executable name.
-    Name(Rc<str>),
-    /// A literal name (`/name`).
-    Lit(Rc<str>),
-    Str(Rc<RefCell<Vec<u8>>>),
-    Proc(Rc<Vec<V>>),
-    Array(Rc<RefCell<Vec<V>>>),
-    Dict(DictRef),
-    Mark,
-    Null,
-    /// `currentfile`.
-    File,
-}
-
-impl V {
-    fn num(&self) -> Option<f64> {
-        match self {
-            V::Num(n) => Some(*n),
-            _ => None,
-        }
-    }
-    fn key(&self) -> String {
-        match self {
-            V::Name(n) | V::Lit(n) => n.to_string(),
-            V::Str(s) => String::from_utf8_lossy(&s.borrow()).into_owned(),
-            V::Num(n) => format!("{n}"),
-            V::Bool(b) => format!("{b}"),
-            _ => String::new(),
-        }
-    }
-    fn items(&self) -> Option<Vec<V>> {
-        match self {
-            V::Array(a) => Some(a.borrow().clone()),
-            V::Proc(p) => Some(p.as_ref().clone()),
-            _ => None,
-        }
-    }
-}
-
-enum Flow {
-    Exit,
-    Stop,
-    Quit,
-}
-
-#[derive(Clone)]
-struct GState {
-    ctm: Affine,
-    color: [f64; 3],
-    lw: f64,
-    cap: Cap,
-    join: Join,
-    miter: f64,
-    dash: Option<(Vec<f64>, f64)>,
-    path: BezPath,
-    cur: Option<Point>,
-    start: Option<Point>,
-    depth: usize,
-    /// The current font dictionary.
-    font: Option<DictRef>,
-}
-
-/// Source tokenizer (the data source for `currentfile`).
-struct Src<'a> {
-    d: &'a [u8],
-    pos: usize,
-}
-
-impl Src<'_> {
-    fn skip_ws(&mut self) {
-        while self.pos < self.d.len() {
-            let c = self.d[self.pos];
-            if is_white(c) {
-                self.pos += 1;
-            } else if c == b'%' {
-                let s = self.pos;
-                while self.pos < self.d.len() && !matches!(self.d[self.pos], b'\n' | b'\r') {
-                    self.pos += 1;
-                }
-                // DSC: skip embedded binary / data sections.
-                let line = &self.d[s..self.pos];
-                if line.starts_with(b"%%BeginData:") || line.starts_with(b"%%BeginBinary:") || line.starts_with(b"%%BeginPreview") {
-                    let end: &[u8] = if line.starts_with(b"%%BeginData:") {
-                        b"%%EndData"
-                    } else if line.starts_with(b"%%BeginBinary:") {
-                        b"%%EndBinary"
-                    } else {
-                        b"%%EndPreview"
-                    };
-                    match self.d[self.pos..].windows(end.len()).position(|w| w == end) {
-                        Some(p) => self.pos += p,
-                        None => self.pos = self.d.len(),
-                    }
-                }
-            } else {
-                break;
-            }
-        }
-    }
-
-    fn word(&mut self) -> &[u8] {
-        let s = self.pos;
-        while self.pos < self.d.len() {
-            let c = self.d[self.pos];
-            if is_white(c) || matches!(c, b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%') {
-                break;
-            }
-            self.pos += 1;
-        }
-        &self.d[s..self.pos]
-    }
-
-    /// The next token; `{ … }` comes back as a whole procedure.
-    fn token(&mut self, depth: usize) -> Option<V> {
-        self.skip_ws();
-        let c = *self.d.get(self.pos)?;
-        Some(match c {
-            b'{' => {
-                self.pos += 1;
-                let mut body = vec![];
-                loop {
-                    self.skip_ws();
-                    match self.d.get(self.pos) {
-                        None => break,
-                        Some(b'}') => {
-                            self.pos += 1;
-                            break;
-                        }
-                        _ => {
-                            if depth > 100 {
-                                return None;
-                            }
-                            match self.token(depth + 1) {
-                                Some(t) => body.push(t),
-                                None => break,
-                            }
-                        }
-                    }
-                }
-                V::Proc(Rc::new(body))
-            }
-            b'}' => {
-                self.pos += 1;
-                V::Null
-            }
-            b'/' => {
-                self.pos += 1;
-                let imm = self.d.get(self.pos) == Some(&b'/');
-                if imm {
-                    self.pos += 1;
-                }
-                let w = String::from_utf8_lossy(self.word()).into_owned();
-                // `//name` (immediately evaluated) is treated like a plain name.
-                if imm { V::Name(w.into()) } else { V::Lit(w.into()) }
-            }
-            b'(' => {
-                self.pos += 1;
-                let mut out = vec![];
-                let mut depth = 1;
-                while self.pos < self.d.len() {
-                    let c = self.d[self.pos];
-                    self.pos += 1;
-                    match c {
-                        b'\\' => {
-                            let e = self.d.get(self.pos).copied().unwrap_or(b'\\');
-                            self.pos += 1;
-                            match e {
-                                b'n' => out.push(b'\n'),
-                                b'r' => out.push(b'\r'),
-                                b't' => out.push(b'\t'),
-                                b'0'..=b'7' => {
-                                    let mut v = (e - b'0') as u32;
-                                    for _ in 0..2 {
-                                        match self.d.get(self.pos) {
-                                            Some(d @ b'0'..=b'7') => {
-                                                v = v * 8 + (d - b'0') as u32;
-                                                self.pos += 1;
-                                            }
-                                            _ => break,
-                                        }
-                                    }
-                                    out.push(v as u8);
-                                }
-                                b'\n' | b'\r' => {}
-                                o => out.push(o),
-                            }
-                        }
-                        b'(' => {
-                            depth += 1;
-                            out.push(c);
-                        }
-                        b')' => {
-                            depth -= 1;
-                            if depth == 0 {
-                                break;
-                            }
-                            out.push(c);
-                        }
-                        _ => out.push(c),
-                    }
-                }
-                V::Str(Rc::new(RefCell::new(out)))
-            }
-            b'<' if self.d.get(self.pos + 1) == Some(&b'<') => {
-                self.pos += 2;
-                V::Name("<<".into())
-            }
-            b'>' if self.d.get(self.pos + 1) == Some(&b'>') => {
-                self.pos += 2;
-                V::Name(">>".into())
-            }
-            b'<' if self.d.get(self.pos + 1) == Some(&b'~') => {
-                let s = self.pos;
-                while self.pos + 1 < self.d.len() && !(self.d[self.pos] == b'~' && self.d[self.pos + 1] == b'>') {
-                    self.pos += 1;
-                }
-                self.pos = (self.pos + 2).min(self.d.len());
-                V::Str(Rc::new(RefCell::new(ascii85(&self.d[s..self.pos]))))
-            }
-            b'<' => {
-                self.pos += 1;
-                let mut hex = vec![];
-                while self.pos < self.d.len() && self.d[self.pos] != b'>' {
-                    if self.d[self.pos].is_ascii_hexdigit() {
-                        hex.push(self.d[self.pos]);
-                    }
-                    self.pos += 1;
-                }
-                self.pos += 1;
-                if hex.len() % 2 == 1 {
-                    hex.push(b'0');
-                }
-                let h = |c: u8| (c as char).to_digit(16).unwrap_or(0) as u8;
-                V::Str(Rc::new(RefCell::new(hex.chunks(2).map(|p| (h(p[0]) << 4) | h(p[1])).collect())))
-            }
-            b'[' | b']' => {
-                self.pos += 1;
-                V::Name(if c == b'[' { "[" } else { "]" }.into())
-            }
-            b')' | b'>' => {
-                self.pos += 1;
-                V::Null
-            }
-            _ => {
-                let w = self.word();
-                if w.is_empty() {
-                    self.pos += 1;
-                    return Some(V::Null);
-                }
-                match parse_num(w) {
-                    Some(n) => V::Num(n),
-                    None => {
-                        // Radix numbers (16#FF).
-                        let s = String::from_utf8_lossy(w).into_owned();
-                        match s.split_once('#').and_then(|(r, v)| i64::from_str_radix(v, r.parse::<u32>().ok().filter(|r| (2..=36).contains(r))?).ok()) {
-                            Some(n) => V::Num(n as f64),
-                            None => V::Name(s.into()),
-                        }
-                    }
-                }
-            }
-        })
-    }
-
-    /// Step over inline image data that follows an `image` operator reading `currentfile`.
-    fn skip_image_data(&mut self) {
-        self.skip_ws();
-        if self.d[self.pos..].starts_with(b"<~") || self.d.get(self.pos).is_some_and(|c| (b'!'..=b'u').contains(c) && !c.is_ascii_hexdigit()) {
-            match self.d[self.pos..].windows(2).position(|w| w == b"~>") {
-                Some(p) => self.pos += p + 2,
-                None => self.pos = self.d.len(),
-            }
-            return;
-        }
-        while self.pos < self.d.len() && (self.d[self.pos].is_ascii_hexdigit() || is_white(self.d[self.pos])) {
-            self.pos += 1;
-        }
-        if self.d.get(self.pos) == Some(&b'>') {
-            self.pos += 1;
-        }
-    }
-}
+pub use eps::eps_parts;
+use value::{DictRef, GState, V};
 
 pub(crate) struct Interp {
     pub b: Builder,
@@ -325,1587 +47,3 @@ pub(crate) struct Interp {
     page: [f64; 4],
     pub unknown: Vec<String>,
 }
-
-fn new_dict() -> DictRef {
-    Rc::new(RefCell::new(HashMap::new()))
-}
-
-fn array(v: Vec<V>) -> V {
-    V::Array(Rc::new(RefCell::new(v)))
-}
-
-fn matrix_of(v: &V) -> Option<Affine> {
-    let a: Vec<f64> = v.items()?.iter().filter_map(V::num).collect();
-    (a.len() == 6).then(|| Affine::new([a[0], a[1], a[2], a[3], a[4], a[5]]))
-}
-
-fn matrix_val(m: Affine) -> V {
-    array(m.as_coeffs().iter().map(|c| V::Num(*c)).collect())
-}
-
-/// The angle from `a` counterclockwise to `b` (degrees, 0 to 360), worked out from what is left
-/// of each after whole turns.
-fn ccw_turn(a: f64, b: f64) -> f64 {
-    (b % 360.0 - a % 360.0).rem_euclid(360.0)
-}
-
-/// The most turns one `arc` or `arcn` draws.
-const MAX_ARC_TURNS: f64 = 1024.0;
-
-/// The deepest procedure nesting run (deeper recursion stops the program).
-const MAX_CALL_DEPTH: usize = 256;
-
-impl Interp {
-    pub fn new(page: [f64; 4]) -> Interp {
-        Interp {
-            b: Builder::new(),
-            st: vec![],
-            dicts: vec![new_dict()],
-            gs: GState {
-                ctm: Affine::IDENTITY,
-                color: [0.0; 3],
-                lw: 1.0,
-                cap: Cap::Butt,
-                join: Join::Miter,
-                miter: 10.0,
-                dash: None,
-                path: BezPath::new(),
-                cur: None,
-                start: None,
-                depth: 1,
-                font: None,
-            },
-            saved: vec![],
-            budget: 8_000_000,
-            calls: 0,
-            font_dir: HashMap::new(),
-            embedded: HashMap::new(),
-            font_cache: HashMap::new(),
-            page,
-            unknown: vec![],
-        }
-    }
-
-    pub fn run(&mut self, data: &[u8]) {
-        self.embedded = embedded_fonts(data);
-        let mut src = Src { d: data, pos: 0 };
-        while let Some(t) = src.token(0) {
-            if let Err(Flow::Quit) = self.exec_token(t, &mut src) {
-                break;
-            }
-        }
-    }
-
-    fn pop(&mut self) -> V {
-        self.st.pop().unwrap_or(V::Null)
-    }
-    fn popn(&mut self) -> f64 {
-        self.pop().num().unwrap_or(0.0)
-    }
-    fn push(&mut self, v: V) {
-        if self.st.len() < 100_000 {
-            self.st.push(v);
-        }
-    }
-
-    fn lookup(&self, k: &str) -> Option<V> {
-        self.dicts.iter().rev().find_map(|d| d.borrow().get(k).cloned())
-    }
-
-    /// A token read from the file: procedures are pushed, names executed.
-    fn exec_token(&mut self, t: V, src: &mut Src) -> Result<(), Flow> {
-        match t {
-            V::Name(n) => self.exec_name(&n, src),
-            other => {
-                self.push(other);
-                Ok(())
-            }
-        }
-    }
-
-    /// Execute a value as an object (procedures run).
-    fn exec_obj(&mut self, v: V, src: &mut Src) -> Result<(), Flow> {
-        match v {
-            V::Proc(p) => {
-                if self.calls >= MAX_CALL_DEPTH {
-                    self.b.skip("PostScript (recursion limit)");
-                    return Err(Flow::Quit);
-                }
-                self.calls += 1;
-                let mut r = Ok(());
-                for x in p.iter() {
-                    match x {
-                        V::Name(n) => {
-                            r = self.exec_name(n, src);
-                            if r.is_err() {
-                                break;
-                            }
-                        }
-                        // Other items count against the budget as names do.
-                        other => {
-                            r = self.spend(1);
-                            if r.is_err() {
-                                break;
-                            }
-                            self.push(other.clone());
-                        }
-                    }
-                }
-                self.calls -= 1;
-                r
-            }
-            V::Name(n) => self.exec_name(&n, src),
-            other => {
-                self.push(other);
-                Ok(())
-            }
-        }
-    }
-
-    fn exec_name(&mut self, n: &str, src: &mut Src) -> Result<(), Flow> {
-        self.spend(1)?;
-        if let Some(v) = self.lookup(n) {
-            return match v {
-                V::Proc(_) => self.exec_obj(v, src),
-                other => {
-                    self.push(other);
-                    Ok(())
-                }
-            };
-        }
-        self.builtin(n, src)
-    }
-
-    /// Count `n` operations against the budget, and stop the program when fewer are left. An
-    /// operator that makes, reads or copies path elements counts each one as an operation.
-    fn spend(&mut self, n: usize) -> Result<(), Flow> {
-        match self.budget.checked_sub(n) {
-            Some(left) => {
-                self.budget = left;
-                Ok(())
-            }
-            None => {
-                self.b.skip("PostScript (operation limit)");
-                Err(Flow::Quit)
-            }
-        }
-    }
-
-    fn device_scale(&self) -> f64 {
-        self.gs.ctm.determinant().abs().sqrt()
-    }
-
-    fn user_point(&mut self) -> Point {
-        let y = self.popn();
-        let x = self.popn();
-        Point::new(x, y)
-    }
-
-    /// Stop the program when a path of `len` elements would be longer than [`MAX_PATH`].
-    fn path_fits(&mut self, len: usize) -> Result<(), Flow> {
-        if len <= MAX_PATH {
-            return Ok(());
-        }
-        self.b.skip("PostScript (path limit)");
-        Err(Flow::Quit)
-    }
-
-    /// [`Self::path_fits`] for the current path with `n` more elements.
-    fn room(&mut self, n: usize) -> Result<(), Flow> {
-        self.path_fits(self.gs.path.elements().len().saturating_add(n))
-    }
-
-    fn move_to(&mut self, p: Point) -> Result<(), Flow> {
-        // A moveto right after a moveto replaces it (PostScript Language Reference §8.2, `moveto`).
-        if matches!(self.gs.path.elements().last(), Some(PathEl::MoveTo(_))) {
-            self.gs.path.pop();
-        }
-        self.room(1)?;
-        let q = self.gs.ctm * p;
-        self.gs.path.move_to(q);
-        self.gs.cur = Some(q);
-        self.gs.start = Some(q);
-        Ok(())
-    }
-    fn line_to(&mut self, p: Point) -> Result<(), Flow> {
-        self.room(1 + usize::from(self.gs.cur.is_none()))?;
-        let q = self.gs.ctm * p;
-        if self.gs.cur.is_none() {
-            self.gs.path.move_to(q);
-            self.gs.start = Some(q);
-        }
-        self.gs.path.line_to(q);
-        self.gs.cur = Some(q);
-        Ok(())
-    }
-    fn curve_to(&mut self, a: Point, b: Point, c: Point) -> Result<(), Flow> {
-        self.room(1 + usize::from(self.gs.cur.is_none()))?;
-        let m = self.gs.ctm;
-        if self.gs.cur.is_none() {
-            self.gs.path.move_to(m * a);
-        }
-        self.gs.path.curve_to(m * a, m * b, m * c);
-        self.gs.cur = Some(m * c);
-        Ok(())
-    }
-    fn current_user(&self) -> Point {
-        self.gs.ctm.inverse() * self.gs.cur.unwrap_or_default()
-    }
-
-    fn arc(&mut self, neg: bool) -> Result<(), Flow> {
-        let a2 = self.popn();
-        let a1 = self.popn();
-        let r = self.popn();
-        let c = self.user_point();
-        // `arc` raises `a2` by multiples of 360 until it is at least `a1`, and `arcn` lowers it
-        // until it is at most `a1` (PostScript Language Reference §8.2, `arc` and `arcn`). Those
-        // sweeps, and the first endpoint, are worked out from what is left of each angle after
-        // whole turns.
-        let sweep = if !neg && a2 < a1 {
-            ccw_turn(a1, a2)
-        } else if neg && a2 > a1 {
-            -ccw_turn(a2, a1)
-        } else {
-            a2 - a1
-        };
-        // A sweep of more than `MAX_ARC_TURNS` turns is shortened by whole pairs of turns to
-        // between `MAX_ARC_TURNS - 2` and `MAX_ARC_TURNS` turns, with a skip note. The arc still
-        // ends at `a2`, and an even-odd fill or clip of it covers the same area as the full sweep.
-        let max = MAX_ARC_TURNS * 360.0;
-        let sweep = if sweep.abs() > max {
-            self.b.skip("arc (too many turns)");
-            let s = sweep.signum();
-            s * (max - 720.0 + (s * (a2 % 720.0 - a1 % 720.0)).rem_euclid(720.0))
-        } else {
-            sweep
-        };
-        let (a1, sweep) = ((a1 % 360.0).to_radians(), sweep.to_radians());
-        let start = Point::new(c.x + r * a1.cos(), c.y + r * a1.sin());
-        if self.gs.cur.is_some() {
-            self.line_to(start)?;
-        } else {
-            self.move_to(start)?;
-        }
-        let arc = kurbo::Arc::new(c, (r, r), a1, sweep, 0.0);
-        let m = self.gs.ctm;
-        // kurbo divides an arc into more curves the larger the radius (about 3.7 × 10^49 for a
-        // quarter turn at a radius of 10^300, more than a usize can count), so each one counts
-        // against the budget and the path limit.
-        let mut curves = arc.append_iter(0.1);
-        while let Some(PathEl::CurveTo(p1, p2, p3)) = curves.next() {
-            self.room(1)?;
-            self.spend(1)?;
-            self.gs.path.curve_to(m * p1, m * p2, m * p3);
-            self.gs.cur = Some(m * p3);
-        }
-        Ok(())
-    }
-
-    fn paint(&mut self, fill: Option<FillRule>, stroke: bool) {
-        let path = std::mem::take(&mut self.gs.path);
-        self.gs.cur = None;
-        self.gs.start = None;
-        let s = self.device_scale();
-        let st = stroke.then(|| Stroke {
-            paint: Paint::Color(self.gs.color),
-            opacity: 1.0,
-            width: if self.gs.lw <= 0.0 { 1.0 } else { self.gs.lw * s },
-            cap: self.gs.cap,
-            join: self.gs.join,
-            miter: self.gs.miter.max(1.0),
-            dash: self.gs.dash.as_ref().map(|(a, o)| (a.iter().map(|v| v * s).collect(), o * s)),
-        });
-        self.b.fill_stroke(path, Affine::IDENTITY, fill.map(|r| (Paint::Color(self.gs.color), 1.0, r)), st);
-    }
-
-    fn rect_path(&mut self) -> Result<Vec<BezPath>, Flow> {
-        // x y w h, or an array / string of numbers.
-        let top = self.pop();
-        let nums: Vec<f64> = match &top {
-            V::Array(_) | V::Proc(_) => {
-                let items = top.items().unwrap_or_default();
-                // An array's rectangles count against the budget, five path elements each.
-                self.spend(items.len() / 4 * 5)?;
-                items.iter().filter_map(V::num).collect()
-            }
-            V::Num(h) => {
-                let w = self.popn();
-                let y = self.popn();
-                let x = self.popn();
-                vec![x, y, w, *h]
-            }
-            _ => vec![],
-        };
-        self.path_fits(nums.len() / 4 * 5)?;
-        let m = self.gs.ctm;
-        Ok(nums
-            .as_chunks::<4>()
-            .0
-            .iter()
-            .map(|r| {
-                let mut p = BezPath::new();
-                p.move_to(m * Point::new(r[0], r[1]));
-                p.line_to(m * Point::new(r[0] + r[2], r[1]));
-                p.line_to(m * Point::new(r[0] + r[2], r[1] + r[3]));
-                p.line_to(m * Point::new(r[0], r[1] + r[3]));
-                p.close_path();
-                p
-            })
-            .collect())
-    }
-
-    fn grestore(&mut self) {
-        if let Some(g) = self.saved.pop() {
-            let d = g.depth;
-            self.gs = g;
-            self.b.close_to(d);
-        }
-    }
-
-    fn builtin(&mut self, n: &str, src: &mut Src) -> Result<(), Flow> {
-        match n {
-            // Stack.
-            "pop" => {
-                self.pop();
-            }
-            "exch" => {
-                let b = self.pop();
-                let a = self.pop();
-                self.push(b);
-                self.push(a);
-            }
-            "dup" => {
-                let a = self.st.last().cloned().unwrap_or(V::Null);
-                self.push(a);
-            }
-            "copy" => match self.pop() {
-                V::Num(k) => {
-                    let k = (k.max(0.0) as usize).min(self.st.len());
-                    let tail: Vec<V> = self.st[self.st.len() - k..].to_vec();
-                    self.st.extend(tail);
-                }
-                V::Array(dst) => {
-                    let s = self.pop().items().unwrap_or_default();
-                    let mut d = dst.borrow_mut();
-                    for (i, v) in s.into_iter().enumerate() {
-                        if i < d.len() {
-                            d[i] = v;
-                        }
-                    }
-                    drop(d);
-                    self.push(V::Array(dst));
-                }
-                other => self.push(other),
-            },
-            "index" => {
-                let k = self.popn().max(0.0) as usize;
-                let v = if k < self.st.len() { self.st[self.st.len() - 1 - k].clone() } else { V::Null };
-                self.push(v);
-            }
-            "roll" => {
-                let j = self.popn() as i64;
-                let k = (self.popn().max(0.0) as usize).min(self.st.len());
-                if k > 0 {
-                    let s = self.st.len() - k;
-                    let r = j.rem_euclid(k as i64) as usize;
-                    self.st[s..].rotate_right(r);
-                }
-            }
-            "clear" => self.st.clear(),
-            "count" => self.push(V::Num(self.st.len() as f64)),
-            "mark" | "[" | "<<" => self.push(V::Mark),
-            "cleartomark" => {
-                while let Some(v) = self.st.pop() {
-                    if matches!(v, V::Mark) {
-                        break;
-                    }
-                }
-            }
-            "counttomark" => {
-                let k = self.st.iter().rev().position(|v| matches!(v, V::Mark)).unwrap_or(self.st.len());
-                self.push(V::Num(k as f64));
-            }
-            "]" => {
-                let k = self.st.iter().rev().position(|v| matches!(v, V::Mark)).unwrap_or(self.st.len());
-                let items = self.st.split_off(self.st.len() - k);
-                self.st.pop();
-                self.push(array(items));
-            }
-            ">>" => {
-                let k = self.st.iter().rev().position(|v| matches!(v, V::Mark)).unwrap_or(self.st.len());
-                let items = self.st.split_off(self.st.len() - k);
-                self.st.pop();
-                let d = new_dict();
-                for kv in items.as_chunks::<2>().0 {
-                    d.borrow_mut().insert(kv[0].key(), kv[1].clone());
-                }
-                self.push(V::Dict(d));
-            }
-            // Arithmetic.
-            "add" | "sub" | "mul" | "div" | "idiv" | "mod" | "atan" | "exp" | "max" | "min" => {
-                let b = self.popn();
-                let a = self.popn();
-                let v = match n {
-                    "add" => a + b,
-                    "sub" => a - b,
-                    "mul" => a * b,
-                    "div" => {
-                        if b == 0.0 {
-                            0.0
-                        } else {
-                            a / b
-                        }
-                    }
-                    // `checked_*` give 0 both for a zero divisor and for the one overflowing
-                    // case, `i64::MIN / -1` (`/` and `%` panic on it in every build).
-                    "idiv" => (a as i64).checked_div(b as i64).unwrap_or(0) as f64,
-                    "mod" => (a as i64).checked_rem(b as i64).unwrap_or(0) as f64,
-                    "atan" => a.atan2(b).to_degrees().rem_euclid(360.0),
-                    "exp" => a.powf(b),
-                    "max" => a.max(b),
-                    _ => a.min(b),
-                };
-                self.push(V::Num(if v.is_finite() { v } else { 0.0 }));
-            }
-            "neg" | "abs" | "sqrt" | "sin" | "cos" | "ln" | "log" | "cvi" | "cvr" | "round" | "floor" | "ceiling" | "truncate" => {
-                let a = match self.pop() {
-                    V::Str(s) => parse_num(&s.borrow()).unwrap_or(0.0),
-                    v => v.num().unwrap_or(0.0),
-                };
-                let v = match n {
-                    "neg" => -a,
-                    "abs" => a.abs(),
-                    "sqrt" => a.max(0.0).sqrt(),
-                    "sin" => a.to_radians().sin(),
-                    "cos" => a.to_radians().cos(),
-                    "ln" => a.ln(),
-                    "log" => a.log10(),
-                    "cvi" | "truncate" => a.trunc(),
-                    "round" => (a + 0.5).floor(),
-                    "floor" => a.floor(),
-                    "ceiling" => a.ceil(),
-                    _ => a,
-                };
-                self.push(V::Num(if v.is_finite() { v } else { 0.0 }));
-            }
-            // Comparison and logic.
-            "eq" | "ne" => {
-                let b = self.pop();
-                let a = self.pop();
-                let eq = match (&a, &b) {
-                    (V::Num(x), V::Num(y)) => x == y,
-                    (V::Bool(x), V::Bool(y)) => x == y,
-                    (V::Null, V::Null) => true,
-                    (V::Array(x), V::Array(y)) => Rc::ptr_eq(x, y),
-                    (V::Dict(x), V::Dict(y)) => Rc::ptr_eq(x, y),
-                    (x, y) => !x.key().is_empty() && x.key() == y.key(),
-                };
-                self.push(V::Bool(eq == (n == "eq")));
-            }
-            "gt" | "ge" | "lt" | "le" => {
-                let b = self.popn();
-                let a = self.popn();
-                self.push(V::Bool(match n {
-                    "gt" => a > b,
-                    "ge" => a >= b,
-                    "lt" => a < b,
-                    _ => a <= b,
-                }));
-            }
-            "not" => match self.pop() {
-                V::Bool(b) => self.push(V::Bool(!b)),
-                v => self.push(V::Num(!(v.num().unwrap_or(0.0) as i64) as f64)),
-            },
-            "and" | "or" | "xor" => {
-                let b = self.pop();
-                let a = self.pop();
-                match (a, b) {
-                    (V::Bool(x), V::Bool(y)) => self.push(V::Bool(match n {
-                        "and" => x && y,
-                        "or" => x || y,
-                        _ => x ^ y,
-                    })),
-                    (x, y) => {
-                        let (x, y) = (x.num().unwrap_or(0.0) as i64, y.num().unwrap_or(0.0) as i64);
-                        self.push(V::Num(match n {
-                            "and" => x & y,
-                            "or" => x | y,
-                            _ => x ^ y,
-                        } as f64));
-                    }
-                }
-            }
-            "true" => self.push(V::Bool(true)),
-            "false" => self.push(V::Bool(false)),
-            "null" => self.push(V::Null),
-            // Control.
-            "exec" => {
-                let v = self.pop();
-                self.exec_obj(v, src)?;
-            }
-            "if" => {
-                let p = self.pop();
-                if let V::Bool(true) = self.pop() {
-                    self.exec_obj(p, src)?;
-                }
-            }
-            "ifelse" => {
-                let f = self.pop();
-                let t = self.pop();
-                let c = matches!(self.pop(), V::Bool(true));
-                self.exec_obj(if c { t } else { f }, src)?;
-            }
-            // Each pass of a loop counts against the budget.
-            "repeat" => {
-                let p = self.pop();
-                let k = self.popn().clamp(0.0, 1e6) as usize;
-                for _ in 0..k {
-                    self.spend(1)?;
-                    match self.exec_obj(p.clone(), src) {
-                        Err(Flow::Exit) => break,
-                        r => r?,
-                    }
-                }
-            }
-            "for" => {
-                let p = self.pop();
-                let lim = self.popn();
-                let inc = self.popn();
-                let mut i = self.popn();
-                let mut guard = 0;
-                while inc != 0.0 && ((inc > 0.0 && i <= lim) || (inc < 0.0 && i >= lim)) && guard < 1_000_000 {
-                    self.spend(1)?;
-                    self.push(V::Num(i));
-                    match self.exec_obj(p.clone(), src) {
-                        Err(Flow::Exit) => break,
-                        r => r?,
-                    }
-                    i += inc;
-                    guard += 1;
-                }
-            }
-            "loop" => {
-                let p = self.pop();
-                for _ in 0..1_000_000 {
-                    self.spend(1)?;
-                    match self.exec_obj(p.clone(), src) {
-                        Err(Flow::Exit) => break,
-                        r => r?,
-                    }
-                }
-            }
-            "forall" => {
-                let p = self.pop();
-                match self.pop() {
-                    V::Dict(d) => {
-                        let items: Vec<(String, V)> = d.borrow().iter().map(|(k, v)| (k.clone(), v.clone())).collect();
-                        for (k, v) in items {
-                            self.spend(1)?;
-                            self.push(V::Lit(k.into()));
-                            self.push(v);
-                            match self.exec_obj(p.clone(), src) {
-                                Err(Flow::Exit) => break,
-                                r => r?,
-                            }
-                        }
-                    }
-                    V::Str(s) => {
-                        let bytes = s.borrow().clone();
-                        for c in bytes {
-                            self.spend(1)?;
-                            self.push(V::Num(c as f64));
-                            match self.exec_obj(p.clone(), src) {
-                                Err(Flow::Exit) => break,
-                                r => r?,
-                            }
-                        }
-                    }
-                    a => {
-                        for v in a.items().unwrap_or_default() {
-                            self.spend(1)?;
-                            self.push(v);
-                            match self.exec_obj(p.clone(), src) {
-                                Err(Flow::Exit) => break,
-                                r => r?,
-                            }
-                        }
-                    }
-                }
-            }
-            "exit" => return Err(Flow::Exit),
-            "stop" => return Err(Flow::Stop),
-            "stopped" => {
-                let p = self.pop();
-                let stopped = match self.exec_obj(p, src) {
-                    Err(Flow::Quit) => return Err(Flow::Quit),
-                    Err(_) => true,
-                    Ok(()) => false,
-                };
-                self.push(V::Bool(stopped));
-            }
-            "quit" => return Err(Flow::Quit),
-            "showpage" | "copypage" => {}
-            // Dictionaries.
-            "def" => {
-                let v = self.pop();
-                let k = self.pop().key();
-                if let Some(d) = self.dicts.last() {
-                    d.borrow_mut().insert(k, v);
-                }
-            }
-            "store" => {
-                let v = self.pop();
-                let k = self.pop().key();
-                let d = self.dicts.iter().rev().find(|d| d.borrow().contains_key(&k)).or(self.dicts.last()).cloned();
-                if let Some(d) = d {
-                    d.borrow_mut().insert(k, v);
-                }
-            }
-            "load" => {
-                let k = self.pop().key();
-                let v = self.lookup(&k).unwrap_or(V::Name(k.into()));
-                self.push(v);
-            }
-            "undef" => {
-                let k = self.pop().key();
-                if let V::Dict(d) = self.pop() {
-                    d.borrow_mut().remove(&k);
-                }
-            }
-            "dict" => {
-                self.pop();
-                self.push(V::Dict(new_dict()));
-            }
-            "begin" => {
-                if let V::Dict(d) = self.pop()
-                    && self.dicts.len() < 64
-                {
-                    self.dicts.push(d);
-                }
-            }
-            "end" => {
-                if self.dicts.len() > 1 {
-                    self.dicts.pop();
-                }
-            }
-            "currentdict" => {
-                let d = self.dicts.last().cloned().unwrap_or_else(new_dict);
-                self.push(V::Dict(d));
-            }
-            "userdict" | "globaldict" | "systemdict" | "statusdict" | "errordict" | "$error" => {
-                let d = self.dicts[0].clone();
-                self.push(V::Dict(d));
-            }
-            "where" => {
-                let k = self.pop().key();
-                match self.dicts.iter().rev().find(|d| d.borrow().contains_key(&k)).cloned() {
-                    Some(d) => {
-                        self.push(V::Dict(d));
-                        self.push(V::Bool(true));
-                    }
-                    None => self.push(V::Bool(false)),
-                }
-            }
-            "known" => {
-                let k = self.pop().key();
-                let v = match self.pop() {
-                    V::Dict(d) => d.borrow().contains_key(&k),
-                    _ => false,
-                };
-                self.push(V::Bool(v));
-            }
-            "countdictstack" => self.push(V::Num(self.dicts.len() as f64)),
-            "cleardictstack" => self.dicts.truncate(1),
-            "findresource" | "findfont" | "findencoding" => {
-                let category = if n == "findresource" { self.pop().key() } else { String::new() };
-                let key = self.pop().key();
-                match (n, category.as_str()) {
-                    ("findfont", _) | (_, "Font") => {
-                        let f = self.find_font(&key);
-                        self.push(V::Dict(f));
-                    }
-                    ("findencoding", _) | (_, "Encoding") => self.push(encoding_array(&key)),
-                    _ => self.push(V::Dict(new_dict())),
-                }
-            }
-            "defineresource" => {
-                let category = self.pop().key();
-                let v = self.pop();
-                let key = self.pop().key();
-                if let (V::Dict(d), "Font") = (&v, category.as_str()) {
-                    self.font_dir.insert(key, d.clone());
-                }
-                self.push(v);
-            }
-            "resourcestatus" => {
-                self.pop();
-                self.pop();
-                self.push(V::Bool(false));
-            }
-            // Arrays and strings.
-            "array" => {
-                let k = self.popn().clamp(0.0, 1e6) as usize;
-                self.push(array(vec![V::Null; k]));
-            }
-            "string" => {
-                let k = self.popn().clamp(0.0, 1e7) as usize;
-                self.push(V::Str(Rc::new(RefCell::new(vec![0; k]))));
-            }
-            "length" => {
-                let l = match self.pop() {
-                    V::Str(s) => s.borrow().len(),
-                    V::Dict(d) => d.borrow().len(),
-                    V::Name(s) | V::Lit(s) => s.len(),
-                    v => v.items().map_or(0, |i| i.len()),
-                };
-                self.push(V::Num(l as f64));
-            }
-            "get" => {
-                let k = self.pop();
-                let v = match self.pop() {
-                    V::Dict(d) => d.borrow().get(&k.key()).cloned().unwrap_or(V::Null),
-                    V::Str(s) => V::Num(s.borrow().get(k.num().unwrap_or(0.0) as usize).copied().unwrap_or(0) as f64),
-                    a => a.items().and_then(|i| i.get(k.num().unwrap_or(0.0) as usize).cloned()).unwrap_or(V::Null),
-                };
-                self.push(v);
-            }
-            "put" => {
-                let v = self.pop();
-                let k = self.pop();
-                match self.pop() {
-                    V::Dict(d) => {
-                        d.borrow_mut().insert(k.key(), v);
-                    }
-                    V::Array(a) => {
-                        let i = k.num().unwrap_or(0.0) as usize;
-                        if let Some(slot) = a.borrow_mut().get_mut(i) {
-                            *slot = v;
-                        }
-                    }
-                    V::Str(s) => {
-                        let i = k.num().unwrap_or(0.0) as usize;
-                        if let Some(slot) = s.borrow_mut().get_mut(i) {
-                            *slot = v.num().unwrap_or(0.0) as u8;
-                        }
-                    }
-                    _ => {}
-                }
-            }
-            "getinterval" => {
-                let c = self.popn().max(0.0) as usize;
-                let i = self.popn().max(0.0) as usize;
-                match self.pop() {
-                    V::Str(s) => {
-                        let b = s.borrow();
-                        let part = b.get(i.min(b.len())..(i + c).min(b.len())).unwrap_or(&[]).to_vec();
-                        drop(b);
-                        self.push(V::Str(Rc::new(RefCell::new(part))));
-                    }
-                    a => {
-                        let items = a.items().unwrap_or_default();
-                        let part = items.get(i.min(items.len())..(i + c).min(items.len())).unwrap_or(&[]).to_vec();
-                        self.push(array(part));
-                    }
-                }
-            }
-            "putinterval" => {
-                self.pop();
-                self.pop();
-                self.pop();
-            }
-            "aload" => {
-                let a = self.pop();
-                for v in a.items().unwrap_or_default() {
-                    self.push(v);
-                }
-                self.push(a);
-            }
-            "astore" => {
-                let a = self.pop();
-                if let V::Array(arr) = &a {
-                    let k = arr.borrow().len().min(self.st.len());
-                    let items = self.st.split_off(self.st.len() - k);
-                    *arr.borrow_mut() = items;
-                }
-                self.push(a);
-            }
-            "cvx" => match self.pop() {
-                V::Array(a) => self.push(V::Proc(Rc::new(a.borrow().clone()))),
-                V::Lit(s) => self.push(V::Name(s)),
-                V::Str(s) => {
-                    // Executable string: tokenize it as a procedure.
-                    let bytes = s.borrow().clone();
-                    let mut sub = Src { d: &bytes, pos: 0 };
-                    let mut body = vec![];
-                    while let Some(t) = sub.token(0) {
-                        body.push(t);
-                    }
-                    self.push(V::Proc(Rc::new(body)));
-                }
-                v => self.push(v),
-            },
-            "cvlit" => match self.pop() {
-                V::Proc(p) => self.push(array(p.as_ref().clone())),
-                V::Name(s) => self.push(V::Lit(s)),
-                v => self.push(v),
-            },
-            "cvn" => {
-                let k = self.pop().key();
-                self.push(V::Lit(k.into()));
-            }
-            "cvs" => {
-                self.pop();
-                let k = self.pop().key();
-                self.push(V::Str(Rc::new(RefCell::new(k.into_bytes()))));
-            }
-            "xcheck" => {
-                let v = self.pop();
-                self.push(V::Bool(matches!(v, V::Proc(_) | V::Name(_))));
-            }
-            "type" => {
-                let t = match self.pop() {
-                    V::Num(_) => "realtype",
-                    V::Bool(_) => "booleantype",
-                    V::Name(_) | V::Lit(_) => "nametype",
-                    V::Str(_) => "stringtype",
-                    V::Proc(_) | V::Array(_) => "arraytype",
-                    V::Dict(_) => "dicttype",
-                    V::Mark => "marktype",
-                    V::Null => "nulltype",
-                    V::File => "filetype",
-                };
-                self.push(V::Name(t.into()));
-            }
-            "bind" | "readonly" | "executeonly" | "noaccess" => {}
-            "languagelevel" => self.push(V::Num(3.0)),
-            "version" | "product" => self.push(V::Str(Rc::new(RefCell::new(b"3010".to_vec())))),
-            "save" => {
-                self.spend(self.gs.path.elements().len())?;
-                self.saved.push(self.gs.clone());
-                self.gs.depth = self.b.depth();
-                self.push(V::Null);
-            }
-            "restore" => {
-                self.pop();
-                self.grestore();
-            }
-            "currentfile" => self.push(V::File),
-            "readstring" | "readhexstring" | "readline" => {
-                self.pop();
-                self.pop();
-                self.push(V::Str(Rc::new(RefCell::new(vec![]))));
-                self.push(V::Bool(false));
-            }
-            "flushfile" | "closefile" | "print" | "==" | "=" | "pstack" | "setpagedevice" | "setglobal" | "setpacking" | "setshared" | "setobjectformat"
-            | "setsmoothness" => {
-                if !matches!(n, "pstack") {
-                    self.pop();
-                }
-            }
-            "currentglobal" | "currentpacking" | "currentshared" => self.push(V::Bool(false)),
-            "vmstatus" => {
-                for _ in 0..3 {
-                    self.push(V::Num(0.0));
-                }
-            }
-            // Graphics state.
-            "gsave" => {
-                self.spend(self.gs.path.elements().len())?;
-                let mut g = self.gs.clone();
-                g.depth = self.b.depth();
-                self.saved.push(g);
-            }
-            "grestore" => self.grestore(),
-            "grestoreall" => {
-                while !self.saved.is_empty() {
-                    self.grestore();
-                }
-            }
-            "initgraphics" => {
-                self.gs.ctm = Affine::IDENTITY;
-                self.gs.lw = 1.0;
-                self.gs.color = [0.0; 3];
-            }
-            "setlinewidth" => self.gs.lw = self.popn(),
-            "currentlinewidth" => self.push(V::Num(self.gs.lw)),
-            "setlinecap" => self.gs.cap = [Cap::Butt, Cap::Round, Cap::Square][(self.popn().max(0.0) as usize).min(2)],
-            "setlinejoin" => self.gs.join = [Join::Miter, Join::Round, Join::Bevel][(self.popn().max(0.0) as usize).min(2)],
-            "setmiterlimit" => self.gs.miter = self.popn(),
-            "setdash" => {
-                let off = self.popn();
-                let a: Vec<f64> = self.pop().items().unwrap_or_default().iter().filter_map(V::num).collect();
-                self.gs.dash = (!a.is_empty() && a.iter().any(|v| *v > 0.0)).then_some((a, off));
-            }
-            "setflat" | "setstrokeadjust" | "setoverprint" | "setrenderingintent" | "setcolorrendering" | "sethalftone" | "setscreen" | "settransfer" => {
-                self.pop();
-            }
-            "setgray" => {
-                let g = self.popn().clamp(0.0, 1.0);
-                self.gs.color = [g; 3];
-            }
-            "setrgbcolor" => {
-                let b = self.popn();
-                let g = self.popn();
-                let r = self.popn();
-                self.gs.color = [r, g, b].map(|v| v.clamp(0.0, 1.0));
-            }
-            "sethsbcolor" => {
-                let v = self.popn().clamp(0.0, 1.0);
-                let s = self.popn().clamp(0.0, 1.0);
-                let h = self.popn().rem_euclid(1.0) * 6.0;
-                let (i, f) = (h.floor() as i32, h.fract());
-                let (p, q, t) = (v * (1.0 - s), v * (1.0 - s * f), v * (1.0 - s * (1.0 - f)));
-                self.gs.color = match i {
-                    0 => [v, t, p],
-                    1 => [q, v, p],
-                    2 => [p, v, t],
-                    3 => [p, q, v],
-                    4 => [t, p, v],
-                    _ => [v, p, q],
-                };
-            }
-            "setcmykcolor" => {
-                let k = self.popn().clamp(0.0, 1.0);
-                let y = self.popn().clamp(0.0, 1.0);
-                let m = self.popn().clamp(0.0, 1.0);
-                let c = self.popn().clamp(0.0, 1.0);
-                self.gs.color = [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)];
-            }
-            "setcolorspace" => {
-                self.pop();
-            }
-            "setcolor" => {
-                // Device colour by operand count (patterns are not drawn).
-                let k = self.st.iter().rev().take_while(|v| matches!(v, V::Num(_))).count().min(4);
-                let c: Vec<f64> = self.st.split_off(self.st.len() - k).iter().filter_map(V::num).collect();
-                self.gs.color = match c.len() {
-                    1 => [c[0]; 3],
-                    3 => [c[0], c[1], c[2]],
-                    4 => [(1.0 - c[0]) * (1.0 - c[3]), (1.0 - c[1]) * (1.0 - c[3]), (1.0 - c[2]) * (1.0 - c[3])],
-                    _ => self.gs.color,
-                };
-            }
-            "currentgray" => self.push(V::Num((self.gs.color[0] + self.gs.color[1] + self.gs.color[2]) / 3.0)),
-            "currentrgbcolor" => {
-                for c in self.gs.color {
-                    self.push(V::Num(c));
-                }
-            }
-            // Coordinates.
-            "matrix" => self.push(matrix_val(Affine::IDENTITY)),
-            "identmatrix" | "defaultmatrix" => {
-                self.pop();
-                self.push(matrix_val(Affine::IDENTITY));
-            }
-            "currentmatrix" => {
-                self.pop();
-                self.push(matrix_val(self.gs.ctm));
-            }
-            "setmatrix" => {
-                let m = self.pop();
-                self.gs.ctm = matrix_of(&m).unwrap_or(Affine::IDENTITY);
-            }
-            "concat" => {
-                let m = self.pop();
-                if let Some(m) = matrix_of(&m) {
-                    self.gs.ctm *= m;
-                }
-            }
-            "concatmatrix" => {
-                self.pop();
-                let b = self.pop();
-                let a = self.pop();
-                let (a, b) = (matrix_of(&a).unwrap_or(Affine::IDENTITY), matrix_of(&b).unwrap_or(Affine::IDENTITY));
-                self.push(matrix_val(b * a));
-            }
-            "invertmatrix" => {
-                self.pop();
-                let a = self.pop();
-                self.push(matrix_val(matrix_of(&a).unwrap_or(Affine::IDENTITY).inverse()));
-            }
-            "translate" | "scale" => {
-                let top = self.pop();
-                let (m_out, y) = match top {
-                    V::Array(_) => (Some(top), self.popn()),
-                    v => (None, v.num().unwrap_or(0.0)),
-                };
-                let x = self.popn();
-                let t = if n == "translate" { Affine::translate((x, y)) } else { Affine::scale_non_uniform(x, y) };
-                match m_out {
-                    Some(_) => self.push(matrix_val(t)),
-                    None => self.gs.ctm *= t,
-                }
-            }
-            "rotate" => {
-                let top = self.pop();
-                match top {
-                    V::Array(_) => {
-                        let a = self.popn();
-                        self.push(matrix_val(Affine::rotate(a.to_radians())));
-                    }
-                    v => self.gs.ctm *= Affine::rotate(v.num().unwrap_or(0.0).to_radians()),
-                }
-            }
-            "transform" | "itransform" | "dtransform" | "idtransform" => {
-                let top = self.pop();
-                let (m, y) = match top {
-                    V::Array(_) | V::Proc(_) => (matrix_of(&top).unwrap_or(Affine::IDENTITY), self.popn()),
-                    v => (self.gs.ctm, v.num().unwrap_or(0.0)),
-                };
-                let x = self.popn();
-                let m = if n.starts_with('i') { m.inverse() } else { m };
-                let p = if n.contains('d') {
-                    let c = m.as_coeffs();
-                    Point::new(c[0] * x + c[2] * y, c[1] * x + c[3] * y)
-                } else {
-                    m * Point::new(x, y)
-                };
-                self.push(V::Num(p.x));
-                self.push(V::Num(p.y));
-            }
-            // Paths.
-            "newpath" => {
-                self.gs.path = BezPath::new();
-                self.gs.cur = None;
-                self.gs.start = None;
-            }
-            "moveto" => {
-                let p = self.user_point();
-                self.move_to(p)?;
-            }
-            "rmoveto" => {
-                let d = self.user_point();
-                let c = self.current_user();
-                self.move_to(Point::new(c.x + d.x, c.y + d.y))?;
-            }
-            "lineto" => {
-                let p = self.user_point();
-                self.line_to(p)?;
-            }
-            "rlineto" => {
-                let d = self.user_point();
-                let c = self.current_user();
-                self.line_to(Point::new(c.x + d.x, c.y + d.y))?;
-            }
-            "curveto" | "rcurveto" => {
-                let p3 = self.user_point();
-                let p2 = self.user_point();
-                let p1 = self.user_point();
-                if n == "rcurveto" {
-                    let c = self.current_user();
-                    let o = |p: Point| Point::new(c.x + p.x, c.y + p.y);
-                    self.curve_to(o(p1), o(p2), o(p3))?;
-                } else {
-                    self.curve_to(p1, p2, p3)?;
-                }
-            }
-            "closepath" => {
-                if self.gs.cur.is_some() {
-                    self.room(1)?;
-                    self.gs.path.close_path();
-                    self.gs.cur = self.gs.start;
-                }
-            }
-            "arc" => self.arc(false)?,
-            "arcn" => self.arc(true)?,
-            "currentpoint" => {
-                let c = self.current_user();
-                self.push(V::Num(c.x));
-                self.push(V::Num(c.y));
-            }
-            "pathbbox" => {
-                self.spend(self.gs.path.elements().len())?;
-                let r = kurbo::Shape::bounding_box(&self.gs.path);
-                let inv = self.gs.ctm.inverse();
-                let (a, b) = (inv * Point::new(r.x0, r.y0), inv * Point::new(r.x1, r.y1));
-                for v in [a.x.min(b.x), a.y.min(b.y), a.x.max(b.x), a.y.max(b.y)] {
-                    self.push(V::Num(v));
-                }
-            }
-            "flattenpath" | "reversepath" | "strokepath" | "initclip" => {}
-            "clippath" => {
-                let p = self.page;
-                self.gs.path = kurbo::Shape::to_path(&kurbo::Rect::new(p[0], p[1], p[2], p[3]), 0.1);
-            }
-            // Painting.
-            "fill" => self.paint(Some(FillRule::NonZero), false),
-            "eofill" => self.paint(Some(FillRule::EvenOdd), false),
-            "stroke" => self.paint(None, true),
-            "clip" | "eoclip" => {
-                let rule = if n == "clip" { FillRule::NonZero } else { FillRule::EvenOdd };
-                self.spend(self.gs.path.elements().len())?;
-                let p = self.gs.path.clone();
-                if !p.elements().iter().all(|e| matches!(e, PathEl::MoveTo(_))) {
-                    self.b.clip(p, rule);
-                }
-            }
-            "rectfill" | "rectstroke" | "rectclip" => {
-                let paths = self.rect_path()?;
-                if n == "rectstroke" && matches!(self.st.last(), Some(V::Array(_))) {
-                    self.pop();
-                }
-                let mut all = BezPath::new();
-                for p in paths {
-                    all.extend(p);
-                }
-                match n {
-                    "rectclip" => self.b.clip(all, FillRule::NonZero),
-                    _ => {
-                        let saved = std::mem::replace(&mut self.gs.path, all);
-                        self.paint(if n == "rectfill" { Some(FillRule::NonZero) } else { None }, n == "rectstroke");
-                        self.gs.path = saved;
-                    }
-                }
-            }
-            "shfill" => {
-                self.pop();
-                self.b.skip("smooth shading (shfill)");
-            }
-            // Text (see `text_op`).
-            "scalefont" | "makefont" | "selectfont" | "setfont" | "show" | "charpath" | "glyphshow" | "rootfont" | "currentfont" | "setcachedevice"
-            | "setcharwidth" | "ashow" | "widthshow" | "awidthshow" | "xshow" | "yshow" | "xyshow" | "kshow" | "cshow" | "stringwidth" | "definefont"
-            | "StandardEncoding" | "ISOLatin1Encoding" | "eexec" | "StartData" | "undefinefont" => self.text_op(n, src)?,
-            // Images: operands popped, inline data skipped.
-            "image" | "imagemask" | "colorimage" => {
-                let mut reads_file = false;
-                let check = |v: &V, rf: &mut bool| {
-                    if matches!(v, V::File) || matches!(v, V::Proc(p) if p.iter().any(|x| matches!(x, V::Name(n) if &**n == "currentfile"))) {
-                        *rf = true;
-                    }
-                };
-                if n == "colorimage" {
-                    let ncomp = self.popn().max(1.0) as usize;
-                    let multi = matches!(self.pop(), V::Bool(true));
-                    for _ in 0..if multi { ncomp.min(4) } else { 1 } {
-                        let v = self.pop();
-                        check(&v, &mut reads_file);
-                    }
-                    for _ in 0..4 {
-                        self.pop();
-                    }
-                } else {
-                    match self.pop() {
-                        V::Dict(d) => {
-                            if let Some(ds) = d.borrow().get("DataSource") {
-                                check(ds, &mut reads_file);
-                            }
-                        }
-                        top => {
-                            check(&top, &mut reads_file);
-                            for _ in 0..4 {
-                                self.pop();
-                            }
-                        }
-                    }
-                }
-                if reads_file {
-                    src.skip_image_data();
-                }
-                self.b.skip("image");
-            }
-            _ => {
-                if self.unknown.len() < 32 && !self.unknown.iter().any(|u| u == n) {
-                    self.unknown.push(n.to_string());
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-/// The PostScript section of an EPS file (DOS EPS binary header handled) and its bounding box
-/// (`%%HiResBoundingBox` preferred).
-pub fn eps_parts(bytes: &[u8]) -> Option<(&[u8], [f64; 4])> {
-    let ps = if bytes.starts_with(&[0xC5, 0xD0, 0xD3, 0xC6]) && bytes.len() >= 12 {
-        let off = u32::from_le_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]) as usize;
-        let len = u32::from_le_bytes([bytes[8], bytes[9], bytes[10], bytes[11]]) as usize;
-        bytes.get(off..off.checked_add(len)?.min(bytes.len()))?
-    } else {
-        bytes
-    };
-    let find_box = |key: &[u8]| -> Option<[f64; 4]> {
-        let mut from = 0;
-        while let Some(p) = ps[from..].windows(key.len()).position(|w| w == key) {
-            let s = from + p + key.len();
-            let e = ps[s..].iter().position(|c| matches!(c, b'\n' | b'\r')).map_or(ps.len(), |q| s + q);
-            let v: Vec<f64> = String::from_utf8_lossy(&ps[s..e]).split_whitespace().filter_map(|t| t.parse().ok()).collect();
-            if v.len() == 4 && v[2] > v[0] && v[3] > v[1] {
-                return Some([v[0], v[1], v[2], v[3]]);
-            }
-            from = s;
-        }
-        None
-    };
-    let bbox = find_box(b"%%HiResBoundingBox:").or_else(|| find_box(b"%%BoundingBox:"))?;
-    Some((ps, bbox))
-}
-
-// ------------------------------------------------------------------ text
-
-/// An encoding array of glyph names (`StandardEncoding`; `ISOLatin1Encoding` and others are
-/// approximated by WinAnsi, which agrees with ISO Latin-1 on the printable codes).
-fn encoding_array(name: &str) -> V {
-    let base = if name == "StandardEncoding" { crate::encoding::Base::Standard } else { crate::encoding::Base::WinAnsi };
-    array((0..256).map(|c| V::Lit(base.name(c as u8).unwrap_or_else(|| ".notdef".into()).into())).collect())
-}
-
-fn find_from(hay: &[u8], needle: &[u8], from: usize) -> Option<usize> {
-    hay.get(from..)?.windows(needle.len()).position(|w| w == needle).map(|p| p + from)
-}
-
-fn rfind_before(hay: &[u8], needle: &[u8], to: usize) -> Option<usize> {
-    hay.get(..to)?.windows(needle.len()).rposition(|w| w == needle)
-}
-
-/// The name after `key` (`/FontName /Name`).
-fn name_after(b: &[u8], key: &[u8]) -> Option<String> {
-    let p = find_from(b, key, 0)? + key.len();
-    let rest = &b[p..];
-    let s = rest.iter().position(|c| *c == b'/')? + 1;
-    let e = rest[s..].iter().position(|c| is_white(*c) || matches!(c, b'/' | b'[' | b'(' | b'{')).map_or(rest.len(), |q| s + q);
-    (e > s).then(|| String::from_utf8_lossy(&rest[s..e]).into_owned())
-}
-
-/// Embedded font programs of an EPS file: Type 1 fonts (`… /FontName /X … currentfile eexec
-/// … cleartomark`, hexadecimal or binary) and CFF font sets (`… <length> StartData <bytes>`).
-fn embedded_fonts(ps: &[u8]) -> HashMap<String, (Rc<Vec<u8>>, bool)> {
-    let mut out = HashMap::new();
-    let mut from = 0;
-    while let Some(ee) = find_from(ps, b"eexec", from) {
-        from = ee + 5;
-        let start = [b"%!PS-AdobeFont".as_slice(), b"%!FontType1"]
-            .iter()
-            .filter_map(|h| rfind_before(ps, h, ee))
-            .max()
-            .or_else(|| rfind_before(ps, b"/FontName", ee).map(|p| p.saturating_sub(512)));
-        let Some(start) = start else { continue };
-        let end = find_from(ps, b"cleartomark", ee).map_or(ps.len(), |p| p + 11);
-        if let Some(name) = name_after(&ps[start..ee], b"/FontName") {
-            out.insert(name, (Rc::new(ps[start..end].to_vec()), false));
-        }
-        from = end;
-    }
-    let mut from = 0;
-    while let Some(sd) = find_from(ps, b"StartData", from) {
-        from = sd + 9;
-        let head = String::from_utf8_lossy(&ps[sd.saturating_sub(64)..sd]).into_owned();
-        let Some(len) = head.split_whitespace().last().and_then(|t| t.parse::<usize>().ok()) else { continue };
-        let s = sd + 10;
-        let Some(data) = ps.get(s..s.saturating_add(len)) else { continue };
-        if let Some(name) = crate::cff::font_name(data) {
-            out.insert(name, (Rc::new(data.to_vec()), true));
-        }
-        from = s + len;
-    }
-    out
-}
-
-fn dict_matrix(d: &DictRef, key: &str) -> Affine {
-    d.borrow().get(key).and_then(matrix_of).unwrap_or(Affine::IDENTITY)
-}
-
-/// A copy of a font dictionary with `m` applied after its matrix (`scalefont`, `makefont`).
-fn transformed(font: &DictRef, m: Affine) -> DictRef {
-    let copy: HashMap<String, V> = font.borrow().clone();
-    let d = Rc::new(RefCell::new(copy));
-    let old = dict_matrix(&d, "__m");
-    d.borrow_mut().insert("__m".into(), matrix_val(m * old));
-    d
-}
-
-impl Interp {
-    /// A font dictionary by name: one `definefont` made, else a new dictionary for an
-    /// embedded program or a bundled stand-in.
-    fn find_font(&mut self, key: &str) -> DictRef {
-        if let Some(d) = self.font_dir.get(key) {
-            return d.clone();
-        }
-        let d = new_dict();
-        {
-            let mut m = d.borrow_mut();
-            m.insert("FontName".into(), V::Lit(key.into()));
-            m.insert("FontType".into(), V::Num(1.0));
-            m.insert("FontMatrix".into(), matrix_val(Affine::scale(0.001)));
-            m.insert("FID".into(), V::Null);
-            m.insert("__base".into(), V::Lit(key.into()));
-            m.insert("__m".into(), matrix_val(Affine::IDENTITY));
-        }
-        self.font_dir.insert(key.to_string(), d.clone());
-        d
-    }
-
-    /// The drawable font of a font dictionary (its base program and encoding) and the matrix
-    /// from text space (font size 1) to user space.
-    fn font_of(&mut self, d: &DictRef) -> Option<(Rc<Font>, Affine)> {
-        if matches!(d.borrow().get("FontType"), Some(V::Num(t)) if *t == 3.0) {
-            // Type 3 fonts (glyph procedures) are not run.
-            self.b.skip("EPS Type 3 font");
-            return None;
-        }
-        let (base, names) = {
-            let m = d.borrow();
-            let base = m.get("__base").or_else(|| m.get("FontName")).map(V::key)?;
-            let names: Option<Vec<Option<String>>> = m.get("Encoding").and_then(V::items).map(|a| {
-                a.iter()
-                    .map(|v| match v {
-                        V::Lit(n) | V::Name(n) if &**n != ".notdef" => Some(n.to_string()),
-                        _ => None,
-                    })
-                    .collect()
-            });
-            (base, names)
-        };
-        let key = match &names {
-            Some(n) => format!("{base}\u{0}{}", n.iter().map(|x| x.as_deref().unwrap_or("")).collect::<Vec<_>>().join(" ")),
-            None => base.clone(),
-        };
-        let font = match self.font_cache.get(&key) {
-            Some(f) => f.clone(),
-            None => {
-                // Not embedded: a bundled stand-in, as for PDF.
-                let prog = self.embedded.get(&base).cloned();
-                let f = Rc::new(Font::standalone(&base, prog.as_ref().map(|(d, cff)| (d.as_slice(), *cff)), names));
-                self.font_cache.insert(key, f.clone());
-                f
-            }
-        };
-        Some((font, dict_matrix(d, "__m")))
-    }
-
-    /// A string's glyph outlines (device space) from the current point, with an extra
-    /// displacement `extra(index, code)` (user space) after each glyph; moves the current
-    /// point.
-    fn text_path(&mut self, bytes: &[u8], mut extra: impl FnMut(usize, u32) -> (f64, f64)) -> Result<Option<(BezPath, String)>, Flow> {
-        let Some(d) = self.gs.font.clone() else { return Ok(None) };
-        let Some((font, m)) = self.font_of(&d) else { return Ok(None) };
-        let mut p = self.current_user();
-        let mut path = BezPath::new();
-        let mut text = String::new();
-        let ctm = self.gs.ctm;
-        for (i, &code) in bytes.iter().enumerate() {
-            let code = code as u32;
-            if let Some(g) = font.glyph(code) {
-                path.extend(ctm * Affine::translate(p.to_vec2()) * m * (*g).clone());
-            }
-            text.push_str(&font.unicode(code));
-            let adv = m * Point::new(font.width(code), 0.0) - m * Point::ZERO;
-            let (ex, ey) = extra(i, code);
-            p += adv + kurbo::Vec2::new(ex, ey);
-        }
-        self.move_to(p)?;
-        Ok(Some((path, text)))
-    }
-
-    fn fill_text(&mut self, path: BezPath, text: &str) {
-        let label: String = text.chars().filter(|c| !c.is_control()).take(40).collect();
-        let name = if label.trim().is_empty() { "Text".to_string() } else { format!("Text: {}", label.trim()) };
-        self.b.fill_stroke_named(&name, path, Affine::IDENTITY, Some((Paint::Color(self.gs.color), 1.0, FillRule::NonZero)), None);
-    }
-
-    fn pop_string(&mut self) -> Vec<u8> {
-        match self.pop() {
-            V::Str(s) => s.borrow().clone(),
-            _ => vec![],
-        }
-    }
-
-    fn show_with(&mut self, s: &[u8], extra: impl FnMut(usize, u32) -> (f64, f64)) -> Result<(), Flow> {
-        match self.text_path(s, extra)? {
-            Some((path, text)) => self.fill_text(path, &text),
-            None => self.b.skip("text (no font)"),
-        }
-        Ok(())
-    }
-
-    /// Text and font operators (PostScript Language Reference §5.1, §8.2).
-    fn text_op(&mut self, n: &str, src: &mut Src) -> Result<(), Flow> {
-        match n {
-            "scalefont" | "makefont" => {
-                let m = if n == "scalefont" {
-                    Affine::scale(self.popn())
-                } else {
-                    let v = self.pop();
-                    matrix_of(&v).unwrap_or(Affine::IDENTITY)
-                };
-                let font = match self.pop() {
-                    V::Dict(d) => d,
-                    _ => self.find_font("Helvetica"),
-                };
-                self.push(V::Dict(transformed(&font, m)));
-            }
-            "selectfont" => {
-                let size = self.pop();
-                let key = self.pop().key();
-                let font = self.find_font(&key);
-                let m = match &size {
-                    V::Num(s) => Affine::scale(*s),
-                    other => matrix_of(other).unwrap_or(Affine::IDENTITY),
-                };
-                self.gs.font = Some(transformed(&font, m));
-            }
-            "setfont" => {
-                if let V::Dict(d) = self.pop() {
-                    self.gs.font = Some(d);
-                }
-            }
-            "currentfont" | "rootfont" => {
-                let d = self.gs.font.clone().unwrap_or_else(new_dict);
-                self.push(V::Dict(d));
-            }
-            "definefont" => {
-                let v = self.pop();
-                let key = self.pop().key();
-                if let V::Dict(d) = &v {
-                    if !d.borrow().contains_key("__base") {
-                        // A font the file defines itself: its embedded program, by name.
-                        d.borrow_mut().insert("__base".into(), V::Lit(key.as_str().into()));
-                        d.borrow_mut().insert("__m".into(), matrix_val(Affine::IDENTITY));
-                    }
-                    self.font_dir.insert(key, d.clone());
-                }
-                self.push(v);
-            }
-            "undefinefont" => {
-                let key = self.pop().key();
-                self.font_dir.remove(&key);
-            }
-            "StandardEncoding" | "ISOLatin1Encoding" => self.push(encoding_array(n)),
-            "show" => {
-                let s = self.pop_string();
-                self.show_with(&s, |_, _| (0.0, 0.0))?;
-            }
-            "ashow" => {
-                let s = self.pop_string();
-                let ay = self.popn();
-                let ax = self.popn();
-                self.show_with(&s, |_, _| (ax, ay))?;
-            }
-            "widthshow" => {
-                let s = self.pop_string();
-                let ch = self.popn() as u32;
-                let cy = self.popn();
-                let cx = self.popn();
-                self.show_with(&s, |_, c| if c == ch { (cx, cy) } else { (0.0, 0.0) })?;
-            }
-            "awidthshow" => {
-                let s = self.pop_string();
-                let ay = self.popn();
-                let ax = self.popn();
-                let ch = self.popn() as u32;
-                let cy = self.popn();
-                let cx = self.popn();
-                self.show_with(&s, |_, c| if c == ch { (cx + ax, cy + ay) } else { (ax, ay) })?;
-            }
-            "kshow" | "cshow" => {
-                // The procedure between characters is not run.
-                let s = self.pop_string();
-                self.pop();
-                self.show_with(&s, |_, _| (0.0, 0.0))?;
-            }
-            "xshow" | "yshow" | "xyshow" => {
-                let disp: Vec<f64> = self.pop().items().unwrap_or_default().iter().filter_map(V::num).collect();
-                let s = self.pop_string();
-                self.explicit_show(&s, &disp, n)?;
-            }
-            "glyphshow" => {
-                let name = self.pop().key();
-                let Some(d) = self.gs.font.clone() else { return Ok(()) };
-                // Drawn through a one-glyph encoding.
-                let mut e: Vec<V> = (0..256).map(|_| V::Lit(".notdef".into())).collect();
-                e[65] = V::Lit(name.as_str().into());
-                let tmp = transformed(&d, Affine::IDENTITY);
-                tmp.borrow_mut().insert("Encoding".into(), array(e));
-                self.gs.font = Some(tmp);
-                self.show_with(b"A", |_, _| (0.0, 0.0))?;
-                self.gs.font = Some(d);
-            }
-            "charpath" => {
-                self.pop();
-                let s = self.pop_string();
-                let saved = std::mem::take(&mut self.gs.path);
-                let start = self.gs.start;
-                match self.text_path(&s, |_, _| (0.0, 0.0))? {
-                    Some((glyphs, _)) => {
-                        // The outlines join the path: each element counts against the budget and
-                        // the path limit.
-                        self.gs.path = saved;
-                        self.room(glyphs.elements().len() + 1)?;
-                        self.spend(glyphs.elements().len())?;
-                        self.gs.path.extend(glyphs);
-                        if let Some(c) = self.gs.cur {
-                            self.gs.path.move_to(c);
-                        }
-                        self.gs.start = start;
-                    }
-                    None => self.gs.path = saved,
-                }
-            }
-            "stringwidth" => {
-                let s = self.pop_string();
-                let (mut w, mut h) = (0.0, 0.0);
-                if let Some(d) = self.gs.font.clone()
-                    && let Some((font, m)) = self.font_of(&d)
-                {
-                    for &c in &s {
-                        let v = m * Point::new(font.width(c as u32), 0.0) - m * Point::ZERO;
-                        w += v.x;
-                        h += v.y;
-                    }
-                }
-                self.push(V::Num(w));
-                self.push(V::Num(h));
-            }
-            "setcachedevice" => {
-                for _ in 0..6 {
-                    self.pop();
-                }
-            }
-            "setcharwidth" => {
-                self.pop();
-                self.pop();
-            }
-            // An embedded Type 1 program's encrypted part (read by `embedded_fonts`).
-            "eexec" => {
-                if matches!(self.pop(), V::File) {
-                    let rest = &src.d[src.pos.min(src.d.len())..];
-                    src.pos += rest.windows(11).position(|w| w == b"cleartomark").map_or(rest.len(), |p| p + 11);
-                }
-            }
-            // A CFF font set's binary data (read by `embedded_fonts`).
-            "StartData" => {
-                let len = self.popn().max(0.0) as usize;
-                self.pop();
-                src.pos = src.pos.saturating_add(1).saturating_add(len).min(src.d.len());
-            }
-            _ => {}
-        }
-        Ok(())
-    }
-
-    /// `xshow` / `yshow` / `xyshow`: glyph displacements from a number array instead of the
-    /// advances.
-    fn explicit_show(&mut self, s: &[u8], disp: &[f64], n: &str) -> Result<(), Flow> {
-        let step = if n == "xyshow" { 2 } else { 1 };
-        let d: Vec<(f64, f64)> = (0..s.len())
-            .map(|k| {
-                let i = k * step;
-                let v = |j: usize| disp.get(j).copied().unwrap_or(0.0);
-                match n {
-                    "xshow" => (v(i), 0.0),
-                    "yshow" => (0.0, v(i)),
-                    _ => (v(i), v(i + 1)),
-                }
-            })
-            .collect();
-        let Some(fd) = self.gs.font.clone() else {
-            self.b.skip("text (no font)");
-            return Ok(());
-        };
-        let Some((font, m)) = self.font_of(&fd) else { return Ok(()) };
-        self.show_with(s, move |k, c| {
-            let adv = m * Point::new(font.width(c), 0.0) - m * Point::ZERO;
-            let (dx, dy) = d.get(k).copied().unwrap_or((0.0, 0.0));
-            (dx - adv.x, dy - adv.y)
-        })
-    }
-}
diff --git a/crates/pdf/src/ps/builtin.rs b/crates/pdf/src/ps/builtin.rs
new file mode 100644
index 000000000..dcafa9417
--- /dev/null
+++ b/crates/pdf/src/ps/builtin.rs
@@ -0,0 +1,1066 @@
+use super::eps::find_from;
+use super::scanner::Src;
+use super::text::encoding_array;
+use super::value::{Flow, V, array, matrix_of, matrix_val, new_dict};
+use super::{Affine, BezPath, Cap, FillRule, Interp, Join, PathEl, Point, Rc, RefCell, parse_num};
+
+impl Interp {
+    pub(super) fn builtin(&mut self, n: &str, src: &mut Src) -> Result<(), Flow> {
+        // Every handler leaves the stacks untouched when the operator is outside its family.
+        if self.try_stack_op(n)
+            || self.try_arithmetic_op(n)
+            || self.try_logic_op(n)
+            || self.try_control_op(n, src)?
+            || self.try_dictionary_op(n)
+            || self.try_collection_op(n)
+            || self.try_environment_op(n, src)?
+            || self.try_graphics_op(n)?
+            || self.try_coordinate_op(n)
+            || self.try_path_op(n)?
+            || self.try_paint_op(n)?
+        {
+            return Ok(());
+        }
+        match n {
+            // Text (see `text_op`).
+            "scalefont" | "makefont" | "selectfont" | "setfont" | "show" | "charpath" | "glyphshow" | "rootfont" | "currentfont" | "setcachedevice"
+            | "setcharwidth" | "ashow" | "widthshow" | "awidthshow" | "xshow" | "yshow" | "xyshow" | "kshow" | "cshow" | "stringwidth" | "definefont"
+            | "StandardEncoding" | "ISOLatin1Encoding" | "eexec" | "StartData" | "undefinefont" => self.text_op(n, src)?,
+            // Images: operands popped, inline data skipped.
+            "image" | "imagemask" | "colorimage" => {
+                let mut reads_file = false;
+                let check = |v: &V, rf: &mut bool| {
+                    if matches!(v, V::File) || matches!(v, V::Proc(p) if p.iter().any(|x| matches!(x, V::Name(n) if &**n == "currentfile"))) {
+                        *rf = true;
+                    }
+                };
+                if n == "colorimage" {
+                    let ncomp = self.popn().max(1.0) as usize;
+                    let multi = matches!(self.pop(), V::Bool(true));
+                    for _ in 0..if multi { ncomp.min(4) } else { 1 } {
+                        let v = self.pop();
+                        check(&v, &mut reads_file);
+                    }
+                    for _ in 0..4 {
+                        self.pop();
+                    }
+                } else {
+                    match self.pop() {
+                        V::Dict(d) => {
+                            if let Some(ds) = d.borrow().get("DataSource") {
+                                check(ds, &mut reads_file);
+                            }
+                        }
+                        top => {
+                            check(&top, &mut reads_file);
+                            for _ in 0..4 {
+                                self.pop();
+                            }
+                        }
+                    }
+                }
+                if reads_file {
+                    src.skip_image_data();
+                }
+                self.b.skip("image");
+            }
+            _ => {
+                if self.unknown.len() < 32 && !self.unknown.iter().any(|u| u == n) {
+                    self.unknown.push(n.to_string());
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn repeat_proc(&mut self, src: &mut Src) -> Result<(), Flow> {
+        let p = self.pop();
+        let k = self.popn().clamp(0.0, 1e6) as usize;
+        for _ in 0..k {
+            self.spend(1)?;
+            match self.exec_obj(p.clone(), src) {
+                Err(Flow::Exit) => break,
+                r => r?,
+            }
+        }
+
+        Ok(())
+    }
+
+    fn for_proc(&mut self, src: &mut Src) -> Result<(), Flow> {
+        let p = self.pop();
+        let lim = self.popn();
+        let inc = self.popn();
+        let mut i = self.popn();
+        let mut guard = 0;
+        while inc != 0.0 && ((inc > 0.0 && i <= lim) || (inc < 0.0 && i >= lim)) && guard < 1_000_000 {
+            self.spend(1)?;
+            self.push(V::Num(i));
+            match self.exec_obj(p.clone(), src) {
+                Err(Flow::Exit) => break,
+                r => r?,
+            }
+            i += inc;
+            guard += 1;
+        }
+
+        Ok(())
+    }
+
+    fn loop_proc(&mut self, src: &mut Src) -> Result<(), Flow> {
+        let p = self.pop();
+        for _ in 0..1_000_000 {
+            self.spend(1)?;
+            match self.exec_obj(p.clone(), src) {
+                Err(Flow::Exit) => break,
+                r => r?,
+            }
+        }
+
+        Ok(())
+    }
+
+    fn forall_proc(&mut self, src: &mut Src) -> Result<(), Flow> {
+        let p = self.pop();
+        match self.pop() {
+            V::Dict(d) => {
+                let items: Vec<(String, V)> = d.borrow().iter().map(|(k, v)| (k.clone(), v.clone())).collect();
+                for (k, v) in items {
+                    self.spend(1)?;
+                    self.push(V::Lit(k.into()));
+                    self.push(v);
+                    match self.exec_obj(p.clone(), src) {
+                        Err(Flow::Exit) => break,
+                        r => r?,
+                    }
+                }
+            }
+            V::Str(s) => {
+                let bytes = s.borrow().clone();
+                for c in bytes {
+                    self.spend(1)?;
+                    self.push(V::Num(c as f64));
+                    match self.exec_obj(p.clone(), src) {
+                        Err(Flow::Exit) => break,
+                        r => r?,
+                    }
+                }
+            }
+            a => {
+                for v in a.items().unwrap_or_default() {
+                    self.spend(1)?;
+                    self.push(v);
+                    match self.exec_obj(p.clone(), src) {
+                        Err(Flow::Exit) => break,
+                        r => r?,
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    fn try_stack_op(&mut self, n: &str) -> bool {
+        match n {
+            // Stack.
+            "pop" => {
+                self.pop();
+            }
+            "exch" => {
+                let b = self.pop();
+                let a = self.pop();
+                self.push(b);
+                self.push(a);
+            }
+            "dup" => {
+                let a = self.st.last().cloned().unwrap_or(V::Null);
+                self.push(a);
+            }
+            "copy" => {
+                match self.pop() {
+                    V::Num(k) => {
+                        let k = (k.max(0.0) as usize).min(self.st.len());
+                        let tail: Vec<V> = self.st[self.st.len() - k..].to_vec();
+                        self.st.extend(tail);
+                    }
+                    V::Array(dst) => {
+                        let s = self.pop().items().unwrap_or_default();
+                        let mut d = dst.borrow_mut();
+                        for (i, v) in s.into_iter().enumerate() {
+                            if i < d.len() {
+                                d[i] = v;
+                            }
+                        }
+                        drop(d);
+                        self.push(V::Array(dst));
+                    }
+                    other => self.push(other),
+                };
+            }
+            "index" => {
+                let k = self.popn().max(0.0) as usize;
+                let v = if k < self.st.len() { self.st[self.st.len() - 1 - k].clone() } else { V::Null };
+                self.push(v);
+            }
+            "roll" => {
+                let j = self.popn() as i64;
+                let k = (self.popn().max(0.0) as usize).min(self.st.len());
+                if k > 0 {
+                    let s = self.st.len() - k;
+                    let r = j.rem_euclid(k as i64) as usize;
+                    self.st[s..].rotate_right(r);
+                }
+            }
+            "clear" => self.st.clear(),
+            "count" => self.push(V::Num(self.st.len() as f64)),
+            "mark" | "[" | "<<" => self.push(V::Mark),
+            "cleartomark" => {
+                while let Some(v) = self.st.pop() {
+                    if matches!(v, V::Mark) {
+                        break;
+                    }
+                }
+            }
+            "counttomark" => {
+                let k = self.st.iter().rev().position(|v| matches!(v, V::Mark)).unwrap_or(self.st.len());
+                self.push(V::Num(k as f64));
+            }
+            "]" => {
+                let k = self.st.iter().rev().position(|v| matches!(v, V::Mark)).unwrap_or(self.st.len());
+                let items = self.st.split_off(self.st.len() - k);
+                self.st.pop();
+                self.push(array(items));
+            }
+            ">>" => {
+                let k = self.st.iter().rev().position(|v| matches!(v, V::Mark)).unwrap_or(self.st.len());
+                let items = self.st.split_off(self.st.len() - k);
+                self.st.pop();
+                let d = new_dict();
+                for kv in items.as_chunks::<2>().0 {
+                    d.borrow_mut().insert(kv[0].key(), kv[1].clone());
+                }
+                self.push(V::Dict(d));
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn try_arithmetic_op(&mut self, n: &str) -> bool {
+        match n {
+            // Arithmetic.
+            "add" | "sub" | "mul" | "div" | "idiv" | "mod" | "atan" | "exp" | "max" | "min" => {
+                let b = self.popn();
+                let a = self.popn();
+                let v = match n {
+                    "add" => a + b,
+                    "sub" => a - b,
+                    "mul" => a * b,
+                    "div" => {
+                        if b == 0.0 {
+                            0.0
+                        } else {
+                            a / b
+                        }
+                    }
+                    // `checked_*` give 0 both for a zero divisor and for the one overflowing
+                    // case, `i64::MIN / -1` (`/` and `%` panic on it in every build).
+                    "idiv" => (a as i64).checked_div(b as i64).unwrap_or(0) as f64,
+                    "mod" => (a as i64).checked_rem(b as i64).unwrap_or(0) as f64,
+                    "atan" => a.atan2(b).to_degrees().rem_euclid(360.0),
+                    "exp" => a.powf(b),
+                    "max" => a.max(b),
+                    _ => a.min(b),
+                };
+                self.push(V::Num(if v.is_finite() { v } else { 0.0 }));
+            }
+            "neg" | "abs" | "sqrt" | "sin" | "cos" | "ln" | "log" | "cvi" | "cvr" | "round" | "floor" | "ceiling" | "truncate" => {
+                let a = match self.pop() {
+                    V::Str(s) => parse_num(&s.borrow()).unwrap_or(0.0),
+                    v => v.num().unwrap_or(0.0),
+                };
+                let v = match n {
+                    "neg" => -a,
+                    "abs" => a.abs(),
+                    "sqrt" => a.max(0.0).sqrt(),
+                    "sin" => a.to_radians().sin(),
+                    "cos" => a.to_radians().cos(),
+                    "ln" => a.ln(),
+                    "log" => a.log10(),
+                    "cvi" | "truncate" => a.trunc(),
+                    "round" => (a + 0.5).floor(),
+                    "floor" => a.floor(),
+                    "ceiling" => a.ceil(),
+                    _ => a,
+                };
+                self.push(V::Num(if v.is_finite() { v } else { 0.0 }));
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn try_logic_op(&mut self, n: &str) -> bool {
+        match n {
+            // Comparison and logic.
+            "eq" | "ne" => {
+                let b = self.pop();
+                let a = self.pop();
+                let eq = match (&a, &b) {
+                    (V::Num(x), V::Num(y)) => x == y,
+                    (V::Bool(x), V::Bool(y)) => x == y,
+                    (V::Null, V::Null) => true,
+                    (V::Array(x), V::Array(y)) => Rc::ptr_eq(x, y),
+                    (V::Dict(x), V::Dict(y)) => Rc::ptr_eq(x, y),
+                    (x, y) => !x.key().is_empty() && x.key() == y.key(),
+                };
+                self.push(V::Bool(eq == (n == "eq")));
+            }
+            "gt" | "ge" | "lt" | "le" => {
+                let b = self.popn();
+                let a = self.popn();
+                self.push(V::Bool(match n {
+                    "gt" => a > b,
+                    "ge" => a >= b,
+                    "lt" => a < b,
+                    _ => a <= b,
+                }));
+            }
+            "not" => match self.pop() {
+                V::Bool(b) => self.push(V::Bool(!b)),
+                v => self.push(V::Num(!(v.num().unwrap_or(0.0) as i64) as f64)),
+            },
+            "and" | "or" | "xor" => {
+                let b = self.pop();
+                let a = self.pop();
+                match (a, b) {
+                    (V::Bool(x), V::Bool(y)) => self.push(V::Bool(match n {
+                        "and" => x && y,
+                        "or" => x || y,
+                        _ => x ^ y,
+                    })),
+                    (x, y) => {
+                        let (x, y) = (x.num().unwrap_or(0.0) as i64, y.num().unwrap_or(0.0) as i64);
+                        self.push(V::Num(match n {
+                            "and" => x & y,
+                            "or" => x | y,
+                            _ => x ^ y,
+                        } as f64));
+                    }
+                }
+            }
+            "true" => self.push(V::Bool(true)),
+            "false" => self.push(V::Bool(false)),
+            "null" => self.push(V::Null),
+            _ => return false,
+        }
+        true
+    }
+
+    fn try_control_op(&mut self, n: &str, src: &mut Src) -> Result<bool, Flow> {
+        match n {
+            // Control.
+            "exec" => {
+                let v = self.pop();
+                self.exec_obj(v, src)?;
+            }
+            "if" => {
+                let p = self.pop();
+                if let V::Bool(true) = self.pop() {
+                    self.exec_obj(p, src)?;
+                }
+            }
+            "ifelse" => {
+                let f = self.pop();
+                let t = self.pop();
+                let c = matches!(self.pop(), V::Bool(true));
+                self.exec_obj(if c { t } else { f }, src)?;
+            }
+            // Each pass of a loop counts against the budget.
+            "repeat" => self.repeat_proc(src)?,
+            "for" => self.for_proc(src)?,
+            "loop" => self.loop_proc(src)?,
+            "forall" => self.forall_proc(src)?,
+            "exit" => return Err(Flow::Exit),
+            "stop" => return Err(Flow::Stop),
+            "stopped" => {
+                let p = self.pop();
+                let stopped = match self.exec_obj(p, src) {
+                    Err(Flow::Quit) => return Err(Flow::Quit),
+                    Err(_) => true,
+                    Ok(()) => false,
+                };
+                self.push(V::Bool(stopped));
+            }
+            "quit" => return Err(Flow::Quit),
+            "showpage" | "copypage" => {}
+            _ => return Ok(false),
+        }
+        Ok(true)
+    }
+
+    fn try_dictionary_op(&mut self, n: &str) -> bool {
+        match n {
+            // Dictionaries.
+            "def" => {
+                let v = self.pop();
+                let k = self.pop().key();
+                if let Some(d) = self.dicts.last() {
+                    d.borrow_mut().insert(k, v);
+                }
+            }
+            "store" => {
+                let v = self.pop();
+                let k = self.pop().key();
+                let d = self.dicts.iter().rev().find(|d| d.borrow().contains_key(&k)).or(self.dicts.last()).cloned();
+                if let Some(d) = d {
+                    d.borrow_mut().insert(k, v);
+                }
+            }
+            "load" => {
+                let k = self.pop().key();
+                let v = self.lookup(&k).unwrap_or(V::Op(k.into()));
+                self.push(v);
+            }
+            "undef" => {
+                let k = self.pop().key();
+                if let V::Dict(d) = self.pop() {
+                    d.borrow_mut().remove(&k);
+                }
+            }
+            "dict" => {
+                self.pop();
+                self.push(V::Dict(new_dict()));
+            }
+            "begin" => {
+                if let V::Dict(d) = self.pop()
+                    && self.dicts.len() < 64
+                {
+                    self.dicts.push(d);
+                }
+            }
+            "end" => {
+                if self.dicts.len() > 1 {
+                    self.dicts.pop();
+                }
+            }
+            "currentdict" => {
+                let d = self.dicts.last().cloned().unwrap_or_else(new_dict);
+                self.push(V::Dict(d));
+            }
+            "userdict" | "globaldict" | "systemdict" | "statusdict" | "errordict" | "$error" => {
+                let d = self.dicts[0].clone();
+                self.push(V::Dict(d));
+            }
+            "where" => {
+                let k = self.pop().key();
+                match self.dicts.iter().rev().find(|d| d.borrow().contains_key(&k)).cloned() {
+                    Some(d) => {
+                        self.push(V::Dict(d));
+                        self.push(V::Bool(true));
+                    }
+                    None => self.push(V::Bool(false)),
+                }
+            }
+            "known" => {
+                let k = self.pop().key();
+                let v = match self.pop() {
+                    V::Dict(d) => d.borrow().contains_key(&k),
+                    _ => false,
+                };
+                self.push(V::Bool(v));
+            }
+            "countdictstack" => self.push(V::Num(self.dicts.len() as f64)),
+            "cleardictstack" => self.dicts.truncate(1),
+            "findresource" | "findfont" | "findencoding" => {
+                let category = if n == "findresource" { self.pop().key() } else { String::new() };
+                let key = self.pop().key();
+                match (n, category.as_str()) {
+                    ("findfont", _) | (_, "Font") => {
+                        let f = self.find_font(&key);
+                        self.push(V::Dict(f));
+                    }
+                    ("findencoding", _) | (_, "Encoding") => self.push(encoding_array(&key)),
+                    _ => self.push(V::Dict(new_dict())),
+                }
+            }
+            "defineresource" => {
+                let category = self.pop().key();
+                let v = self.pop();
+                let key = self.pop().key();
+                if let (V::Dict(d), "Font") = (&v, category.as_str()) {
+                    self.font_dir.insert(key, d.clone());
+                }
+                self.push(v);
+            }
+            "resourcestatus" => {
+                self.pop();
+                self.pop();
+                self.push(V::Bool(false));
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn try_collection_op(&mut self, n: &str) -> bool {
+        match n {
+            // Arrays and strings.
+            "array" => {
+                let k = self.popn().clamp(0.0, 1e6) as usize;
+                self.push(array(vec![V::Null; k]));
+            }
+            "string" => {
+                let k = self.popn().clamp(0.0, 1e7) as usize;
+                self.push(V::Str(Rc::new(RefCell::new(vec![0; k]))));
+            }
+            "length" => {
+                let l = match self.pop() {
+                    V::Str(s) => s.borrow().len(),
+                    V::Dict(d) => d.borrow().len(),
+                    V::Name(s) | V::Lit(s) => s.len(),
+                    v => v.items().map_or(0, |i| i.len()),
+                };
+                self.push(V::Num(l as f64));
+            }
+            "get" => {
+                let k = self.pop();
+                let v = match self.pop() {
+                    V::Dict(d) => d.borrow().get(&k.key()).cloned().unwrap_or(V::Null),
+                    V::Str(s) => V::Num(s.borrow().get(k.num().unwrap_or(0.0) as usize).copied().unwrap_or(0) as f64),
+                    a => a.items().and_then(|i| i.get(k.num().unwrap_or(0.0) as usize).cloned()).unwrap_or(V::Null),
+                };
+                self.push(v);
+            }
+            "put" => {
+                let v = self.pop();
+                let k = self.pop();
+                match self.pop() {
+                    V::Dict(d) => {
+                        d.borrow_mut().insert(k.key(), v);
+                    }
+                    V::Array(a) => {
+                        let i = k.num().unwrap_or(0.0) as usize;
+                        if let Some(slot) = a.borrow_mut().get_mut(i) {
+                            *slot = v;
+                        }
+                    }
+                    V::Str(s) => {
+                        let i = k.num().unwrap_or(0.0) as usize;
+                        if let Some(slot) = s.borrow_mut().get_mut(i) {
+                            *slot = v.num().unwrap_or(0.0) as u8;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            "getinterval" => {
+                let c = self.popn().max(0.0) as usize;
+                let i = self.popn().max(0.0) as usize;
+                match self.pop() {
+                    V::Str(s) => {
+                        let b = s.borrow();
+                        let part = b.get(i.min(b.len())..(i + c).min(b.len())).unwrap_or(&[]).to_vec();
+                        drop(b);
+                        self.push(V::Str(Rc::new(RefCell::new(part))));
+                    }
+                    a => {
+                        let items = a.items().unwrap_or_default();
+                        let part = items.get(i.min(items.len())..(i + c).min(items.len())).unwrap_or(&[]).to_vec();
+                        self.push(array(part));
+                    }
+                }
+            }
+            "putinterval" => {
+                self.pop();
+                self.pop();
+                self.pop();
+            }
+            "aload" => {
+                let a = self.pop();
+                for v in a.items().unwrap_or_default() {
+                    self.push(v);
+                }
+                self.push(a);
+            }
+            "astore" => {
+                let a = self.pop();
+                if let V::Array(arr) = &a {
+                    let k = arr.borrow().len().min(self.st.len());
+                    let items = self.st.split_off(self.st.len() - k);
+                    *arr.borrow_mut() = items;
+                }
+                self.push(a);
+            }
+            "cvx" => match self.pop() {
+                V::Array(a) => self.push(V::Proc(Rc::new(a.borrow().clone()))),
+                V::Lit(s) => self.push(V::Name(s)),
+                V::Str(s) => {
+                    // Executable string: tokenize it as a procedure.
+                    let bytes = s.borrow().clone();
+                    let mut sub = Src { d: &bytes, pos: 0 };
+                    let mut body = vec![];
+                    while let Some(t) = sub.token(0) {
+                        body.push(t);
+                    }
+                    self.push(V::Proc(Rc::new(body)));
+                }
+                v => self.push(v),
+            },
+            "cvlit" => match self.pop() {
+                V::Proc(p) => self.push(array(p.as_ref().clone())),
+                V::Name(s) => self.push(V::Lit(s)),
+                v => self.push(v),
+            },
+            "cvn" => {
+                let k = self.pop().key();
+                self.push(V::Lit(k.into()));
+            }
+            "cvs" => {
+                self.pop();
+                let k = self.pop().key();
+                self.push(V::Str(Rc::new(RefCell::new(k.into_bytes()))));
+            }
+            "xcheck" => {
+                let v = self.pop();
+                self.push(V::Bool(matches!(v, V::Proc(_) | V::Name(_) | V::Op(_))));
+            }
+            "type" => {
+                let t = match self.pop() {
+                    V::Num(_) => "realtype",
+                    V::Bool(_) => "booleantype",
+                    V::Name(_) | V::Lit(_) => "nametype",
+                    V::Op(_) => "operatortype",
+                    V::Str(_) => "stringtype",
+                    V::Proc(_) | V::Array(_) => "arraytype",
+                    V::Dict(_) => "dicttype",
+                    V::Mark => "marktype",
+                    V::Null => "nulltype",
+                    V::File => "filetype",
+                };
+                self.push(V::Name(t.into()));
+            }
+            "bind" | "readonly" | "executeonly" | "noaccess" => {}
+            _ => return false,
+        }
+        true
+    }
+
+    fn try_environment_op(&mut self, n: &str, src: &mut Src) -> Result<bool, Flow> {
+        match n {
+            "languagelevel" => self.push(V::Num(3.0)),
+            "version" | "product" => self.push(V::Str(Rc::new(RefCell::new(b"3010".to_vec())))),
+            "save" => {
+                self.spend(self.gs.path.elements().len())?;
+                self.saved.push(self.gs.clone());
+                self.gs.depth = self.b.depth();
+                self.push(V::Null);
+            }
+            "restore" => {
+                self.pop();
+                self.grestore();
+            }
+            "currentfile" => self.push(V::File),
+            "readstring" | "readhexstring" | "readline" => {
+                self.pop();
+                self.pop();
+                self.push(V::Str(Rc::new(RefCell::new(vec![]))));
+                self.push(V::Bool(false));
+            }
+            "flushfile" | "closefile" | "print" | "==" | "=" | "pstack" | "setpagedevice" | "setglobal" | "setpacking" | "setshared" | "setobjectformat"
+            | "setsmoothness" => {
+                if !matches!(n, "pstack") {
+                    self.pop();
+                }
+            }
+            "currentglobal" | "currentpacking" | "currentshared" => self.push(V::Bool(false)),
+            // Operators that return values must push them, or the rest of the program reads a
+            // shifted stack: Illustrator's EPS prolog queries the device this way and then drew
+            // nothing (#955). Values are a plain device's defaults (PostScript Language
+            // Reference, 3rd ed., chapter 8).
+            "currentflat" => self.push(V::Num(1.0)),
+            "currentscreen" => {
+                self.push(V::Num(60.0));
+                self.push(V::Num(45.0));
+                self.push(V::Proc(Rc::new(vec![])));
+            }
+            "currentblackgeneration" | "currentundercolorremoval" | "currenttransfer" => self.push(V::Proc(Rc::new(vec![]))),
+            "currentcolortransfer" => {
+                for _ in 0..4 {
+                    self.push(V::Proc(Rc::new(vec![])));
+                }
+            }
+            "currentpagedevice" | "currenthalftone" | "currentsystemparams" | "currentuserparams" | "currentdevparams" => {
+                if n == "currentdevparams" {
+                    self.pop();
+                }
+                self.push(V::Dict(new_dict()));
+            }
+            "setuserparams" | "setsystemparams" | "setcolortransfer" | "setblackgeneration" | "setundercolorremoval" => {
+                let k = if n == "setcolortransfer" { 4 } else { 1 };
+                for _ in 0..k {
+                    self.pop();
+                }
+            }
+            // `file status` → false; `string status` → false (no such file).
+            "status" => {
+                self.pop();
+                self.push(V::Bool(false));
+            }
+            "dictstack" => {
+                self.pop();
+                let ds: Vec<V> = self.dicts.iter().map(|d| V::Dict(d.clone())).collect();
+                self.push(array(ds));
+            }
+            "maxlength" => {
+                let k = match self.pop() {
+                    V::Dict(d) => d.borrow().len(),
+                    _ => 0,
+                };
+                self.push(V::Num(k.saturating_add(16) as f64));
+            }
+            "internaldict" => {
+                self.pop();
+                let d = self.dicts[0].clone();
+                self.push(V::Dict(d));
+            }
+            "undefineresource" => {
+                self.pop();
+                self.pop();
+            }
+            // `[ … /Name pdfmark`: a Distiller annotation; other interpreters discard it.
+            "pdfmark" => {
+                while let Some(v) = self.st.pop() {
+                    if matches!(v, V::Mark) {
+                        break;
+                    }
+                }
+            }
+            // `source [params] /Name filter`. A SubFileDecode of the current file with a count of
+            // 0 reads to its end-of-data string: skip that data (an embedded XMP packet, which
+            // otherwise ran as PostScript). Other filters read what their source reads.
+            "filter" => {
+                let name = self.pop().key();
+                let mut skipped = false;
+                let source = if name == "SubFileDecode" && !matches!(self.st.last(), Some(V::Dict(_))) {
+                    let eod = match self.pop() {
+                        V::Str(s) => s.borrow().clone(),
+                        _ => vec![],
+                    };
+                    let count = self.popn();
+                    let source = self.pop();
+                    if matches!(source, V::File) && count == 0.0 && !eod.is_empty() {
+                        src.pos = match find_from(src.d, &eod, src.pos) {
+                            Some(p) => p.saturating_add(eod.len()),
+                            None => src.d.len(),
+                        };
+                        skipped = true;
+                    }
+                    source
+                } else {
+                    if matches!(self.st.last(), Some(V::Dict(_))) {
+                        self.pop();
+                    }
+                    self.pop()
+                };
+                // Data already stepped over leaves nothing for `image` to skip.
+                self.push(if skipped { V::Null } else { source });
+            }
+            "vmstatus" => {
+                for _ in 0..3 {
+                    self.push(V::Num(0.0));
+                }
+            }
+            _ => return Ok(false),
+        }
+        Ok(true)
+    }
+
+    fn try_graphics_op(&mut self, n: &str) -> Result<bool, Flow> {
+        match n {
+            // Graphics state.
+            "gsave" => {
+                self.spend(self.gs.path.elements().len())?;
+                let mut g = self.gs.clone();
+                g.depth = self.b.depth();
+                self.saved.push(g);
+            }
+            "grestore" => self.grestore(),
+            "grestoreall" => {
+                while !self.saved.is_empty() {
+                    self.grestore();
+                }
+            }
+            "initgraphics" => {
+                self.gs.ctm = Affine::IDENTITY;
+                self.gs.lw = 1.0;
+                self.gs.color = [0.0; 3];
+            }
+            "setlinewidth" => self.gs.lw = self.popn(),
+            "currentlinewidth" => self.push(V::Num(self.gs.lw)),
+            "setlinecap" => self.gs.cap = [Cap::Butt, Cap::Round, Cap::Square][(self.popn().max(0.0) as usize).min(2)],
+            "setlinejoin" => self.gs.join = [Join::Miter, Join::Round, Join::Bevel][(self.popn().max(0.0) as usize).min(2)],
+            "setmiterlimit" => self.gs.miter = self.popn(),
+            "setdash" => {
+                let off = self.popn();
+                let a: Vec<f64> = self.pop().items().unwrap_or_default().iter().filter_map(V::num).collect();
+                self.gs.dash = (!a.is_empty() && a.iter().any(|v| *v > 0.0)).then_some((a, off));
+            }
+            "setflat" | "setstrokeadjust" | "setoverprint" | "setrenderingintent" | "setcolorrendering" | "sethalftone" | "settransfer" => {
+                self.pop();
+            }
+            // frequency angle proc
+            "setscreen" => {
+                for _ in 0..3 {
+                    self.pop();
+                }
+            }
+            "setgray" => {
+                let g = self.popn().clamp(0.0, 1.0);
+                self.gs.color = [g; 3];
+            }
+            "setrgbcolor" => {
+                let b = self.popn();
+                let g = self.popn();
+                let r = self.popn();
+                self.gs.color = [r, g, b].map(|v| v.clamp(0.0, 1.0));
+            }
+            "sethsbcolor" => {
+                let v = self.popn().clamp(0.0, 1.0);
+                let s = self.popn().clamp(0.0, 1.0);
+                let h = self.popn().rem_euclid(1.0) * 6.0;
+                let (i, f) = (h.floor() as i32, h.fract());
+                let (p, q, t) = (v * (1.0 - s), v * (1.0 - s * f), v * (1.0 - s * (1.0 - f)));
+                self.gs.color = match i {
+                    0 => [v, t, p],
+                    1 => [q, v, p],
+                    2 => [p, v, t],
+                    3 => [p, q, v],
+                    4 => [t, p, v],
+                    _ => [v, p, q],
+                };
+            }
+            "setcmykcolor" => {
+                let k = self.popn().clamp(0.0, 1.0);
+                let y = self.popn().clamp(0.0, 1.0);
+                let m = self.popn().clamp(0.0, 1.0);
+                let c = self.popn().clamp(0.0, 1.0);
+                self.gs.color = [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)];
+            }
+            "setcolorspace" => {
+                self.pop();
+            }
+            "setcolor" => {
+                // Device colour by operand count (patterns are not drawn).
+                let k = self.st.iter().rev().take_while(|v| matches!(v, V::Num(_))).count().min(4);
+                let c: Vec<f64> = self.st.split_off(self.st.len() - k).iter().filter_map(V::num).collect();
+                self.gs.color = match c.len() {
+                    1 => [c[0]; 3],
+                    3 => [c[0], c[1], c[2]],
+                    4 => [(1.0 - c[0]) * (1.0 - c[3]), (1.0 - c[1]) * (1.0 - c[3]), (1.0 - c[2]) * (1.0 - c[3])],
+                    _ => self.gs.color,
+                };
+            }
+            "currentgray" => self.push(V::Num((self.gs.color[0] + self.gs.color[1] + self.gs.color[2]) / 3.0)),
+            "currentrgbcolor" => {
+                for c in self.gs.color {
+                    self.push(V::Num(c));
+                }
+            }
+            _ => return Ok(false),
+        }
+        Ok(true)
+    }
+
+    fn try_coordinate_op(&mut self, n: &str) -> bool {
+        match n {
+            // Coordinates.
+            "matrix" => self.push(matrix_val(Affine::IDENTITY)),
+            "identmatrix" | "defaultmatrix" => {
+                self.pop();
+                self.push(matrix_val(Affine::IDENTITY));
+            }
+            "currentmatrix" => {
+                self.pop();
+                self.push(matrix_val(self.gs.ctm));
+            }
+            "setmatrix" => {
+                let m = self.pop();
+                self.gs.ctm = matrix_of(&m).unwrap_or(Affine::IDENTITY);
+            }
+            "concat" => {
+                let m = self.pop();
+                if let Some(m) = matrix_of(&m) {
+                    self.gs.ctm *= m;
+                }
+            }
+            "concatmatrix" => {
+                self.pop();
+                let b = self.pop();
+                let a = self.pop();
+                let (a, b) = (matrix_of(&a).unwrap_or(Affine::IDENTITY), matrix_of(&b).unwrap_or(Affine::IDENTITY));
+                self.push(matrix_val(b * a));
+            }
+            "invertmatrix" => {
+                self.pop();
+                let a = self.pop();
+                self.push(matrix_val(matrix_of(&a).unwrap_or(Affine::IDENTITY).inverse()));
+            }
+            "translate" | "scale" => {
+                let top = self.pop();
+                let (m_out, y) = match top {
+                    V::Array(_) => (Some(top), self.popn()),
+                    v => (None, v.num().unwrap_or(0.0)),
+                };
+                let x = self.popn();
+                let t = if n == "translate" { Affine::translate((x, y)) } else { Affine::scale_non_uniform(x, y) };
+                match m_out {
+                    Some(_) => self.push(matrix_val(t)),
+                    None => self.gs.ctm *= t,
+                }
+            }
+            "rotate" => {
+                let top = self.pop();
+                match top {
+                    V::Array(_) => {
+                        let a = self.popn();
+                        self.push(matrix_val(Affine::rotate(a.to_radians())));
+                    }
+                    v => self.gs.ctm *= Affine::rotate(v.num().unwrap_or(0.0).to_radians()),
+                }
+            }
+            "transform" | "itransform" | "dtransform" | "idtransform" => {
+                let top = self.pop();
+                let (m, y) = match top {
+                    V::Array(_) | V::Proc(_) => (matrix_of(&top).unwrap_or(Affine::IDENTITY), self.popn()),
+                    v => (self.gs.ctm, v.num().unwrap_or(0.0)),
+                };
+                let x = self.popn();
+                let m = if n.starts_with('i') { m.inverse() } else { m };
+                let p = if n.contains('d') {
+                    let c = m.as_coeffs();
+                    Point::new(c[0] * x + c[2] * y, c[1] * x + c[3] * y)
+                } else {
+                    m * Point::new(x, y)
+                };
+                self.push(V::Num(p.x));
+                self.push(V::Num(p.y));
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn try_path_op(&mut self, n: &str) -> Result<bool, Flow> {
+        match n {
+            // Paths.
+            "newpath" => {
+                self.gs.path = BezPath::new();
+                self.gs.cur = None;
+                self.gs.start = None;
+            }
+            "moveto" => {
+                let p = self.user_point();
+                self.move_to(p)?;
+            }
+            "rmoveto" => {
+                let d = self.user_point();
+                let c = self.current_user();
+                self.move_to(Point::new(c.x + d.x, c.y + d.y))?;
+            }
+            "lineto" => {
+                let p = self.user_point();
+                self.line_to(p)?;
+            }
+            "rlineto" => {
+                let d = self.user_point();
+                let c = self.current_user();
+                self.line_to(Point::new(c.x + d.x, c.y + d.y))?;
+            }
+            "curveto" | "rcurveto" => {
+                let p3 = self.user_point();
+                let p2 = self.user_point();
+                let p1 = self.user_point();
+                if n == "rcurveto" {
+                    let c = self.current_user();
+                    let o = |p: Point| Point::new(c.x + p.x, c.y + p.y);
+                    self.curve_to(o(p1), o(p2), o(p3))?;
+                } else {
+                    self.curve_to(p1, p2, p3)?;
+                }
+            }
+            "closepath" => {
+                if self.gs.cur.is_some() {
+                    self.room(1)?;
+                    self.gs.path.close_path();
+                    self.gs.cur = self.gs.start;
+                }
+            }
+            "arc" => self.arc(false)?,
+            "arcn" => self.arc(true)?,
+            "currentpoint" => {
+                let c = self.current_user();
+                self.push(V::Num(c.x));
+                self.push(V::Num(c.y));
+            }
+            "pathbbox" => {
+                self.spend(self.gs.path.elements().len())?;
+                let r = kurbo::Shape::bounding_box(&self.gs.path);
+                let inv = self.gs.ctm.inverse();
+                let (a, b) = (inv * Point::new(r.x0, r.y0), inv * Point::new(r.x1, r.y1));
+                for v in [a.x.min(b.x), a.y.min(b.y), a.x.max(b.x), a.y.max(b.y)] {
+                    self.push(V::Num(v));
+                }
+            }
+            "flattenpath" | "reversepath" | "strokepath" | "initclip" => {}
+            "clippath" => {
+                let p = self.page;
+                self.gs.path = kurbo::Shape::to_path(&kurbo::Rect::new(p[0], p[1], p[2], p[3]), 0.1);
+            }
+            _ => return Ok(false),
+        }
+        Ok(true)
+    }
+
+    fn try_paint_op(&mut self, n: &str) -> Result<bool, Flow> {
+        match n {
+            // Painting.
+            "fill" => self.paint(Some(FillRule::NonZero), false),
+            "eofill" => self.paint(Some(FillRule::EvenOdd), false),
+            "stroke" => self.paint(None, true),
+            "clip" | "eoclip" => {
+                let rule = if n == "clip" { FillRule::NonZero } else { FillRule::EvenOdd };
+                self.spend(self.gs.path.elements().len())?;
+                let p = self.gs.path.clone();
+                if !p.elements().iter().all(|e| matches!(e, PathEl::MoveTo(_))) {
+                    self.b.clip(p, rule);
+                }
+            }
+            "rectfill" | "rectstroke" | "rectclip" => {
+                let paths = self.rect_path()?;
+                if n == "rectstroke" && matches!(self.st.last(), Some(V::Array(_))) {
+                    self.pop();
+                }
+                let mut all = BezPath::new();
+                for p in paths {
+                    all.extend(p);
+                }
+                match n {
+                    "rectclip" => self.b.clip(all, FillRule::NonZero),
+                    _ => {
+                        let saved = std::mem::replace(&mut self.gs.path, all);
+                        self.paint(if n == "rectfill" { Some(FillRule::NonZero) } else { None }, n == "rectstroke");
+                        self.gs.path = saved;
+                    }
+                }
+            }
+            "shfill" => {
+                self.pop();
+                self.b.skip("smooth shading (shfill)");
+            }
+            _ => return Ok(false),
+        }
+        Ok(true)
+    }
+}
diff --git a/crates/pdf/src/ps/eps.rs b/crates/pdf/src/ps/eps.rs
new file mode 100644
index 000000000..90d60cfbe
--- /dev/null
+++ b/crates/pdf/src/ps/eps.rs
@@ -0,0 +1,79 @@
+use super::{HashMap, Rc, is_white};
+
+/// The PostScript section of an EPS file (DOS EPS binary header handled) and its bounding box
+/// (`%%HiResBoundingBox` preferred).
+pub fn eps_parts(bytes: &[u8]) -> Option<(&[u8], [f64; 4])> {
+    let ps = if bytes.starts_with(&[0xC5, 0xD0, 0xD3, 0xC6]) && bytes.len() >= 12 {
+        let off = u32::from_le_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]) as usize;
+        let len = u32::from_le_bytes([bytes[8], bytes[9], bytes[10], bytes[11]]) as usize;
+        bytes.get(off..off.checked_add(len)?.min(bytes.len()))?
+    } else {
+        bytes
+    };
+    let find_box = |key: &[u8]| -> Option<[f64; 4]> {
+        let mut from = 0;
+        while let Some(p) = ps[from..].windows(key.len()).position(|w| w == key) {
+            let s = from + p + key.len();
+            let e = ps[s..].iter().position(|c| matches!(c, b'\n' | b'\r')).map_or(ps.len(), |q| s + q);
+            let v: Vec<f64> = String::from_utf8_lossy(&ps[s..e]).split_whitespace().filter_map(|t| t.parse().ok()).collect();
+            if v.len() == 4 && v[2] > v[0] && v[3] > v[1] {
+                return Some([v[0], v[1], v[2], v[3]]);
+            }
+            from = s;
+        }
+        None
+    };
+    let bbox = find_box(b"%%HiResBoundingBox:").or_else(|| find_box(b"%%BoundingBox:"))?;
+    Some((ps, bbox))
+}
+
+pub(super) fn find_from(hay: &[u8], needle: &[u8], from: usize) -> Option<usize> {
+    hay.get(from..)?.windows(needle.len()).position(|w| w == needle).map(|p| p + from)
+}
+
+fn rfind_before(hay: &[u8], needle: &[u8], to: usize) -> Option<usize> {
+    hay.get(..to)?.windows(needle.len()).rposition(|w| w == needle)
+}
+
+/// The name after `key` (`/FontName /Name`).
+fn name_after(b: &[u8], key: &[u8]) -> Option<String> {
+    let p = find_from(b, key, 0)? + key.len();
+    let rest = &b[p..];
+    let s = rest.iter().position(|c| *c == b'/')? + 1;
+    let e = rest[s..].iter().position(|c| is_white(*c) || matches!(c, b'/' | b'[' | b'(' | b'{')).map_or(rest.len(), |q| s + q);
+    (e > s).then(|| String::from_utf8_lossy(&rest[s..e]).into_owned())
+}
+
+/// Embedded font programs of an EPS file: Type 1 fonts (`… /FontName /X … currentfile eexec
+/// … cleartomark`, hexadecimal or binary) and CFF font sets (`… <length> StartData <bytes>`).
+pub(super) fn embedded_fonts(ps: &[u8]) -> HashMap<String, (Rc<Vec<u8>>, bool)> {
+    let mut out = HashMap::new();
+    let mut from = 0;
+    while let Some(ee) = find_from(ps, b"eexec", from) {
+        from = ee + 5;
+        let start = [b"%!PS-AdobeFont".as_slice(), b"%!FontType1"]
+            .iter()
+            .filter_map(|h| rfind_before(ps, h, ee))
+            .max()
+            .or_else(|| rfind_before(ps, b"/FontName", ee).map(|p| p.saturating_sub(512)));
+        let Some(start) = start else { continue };
+        let end = find_from(ps, b"cleartomark", ee).map_or(ps.len(), |p| p + 11);
+        if let Some(name) = name_after(&ps[start..ee], b"/FontName") {
+            out.insert(name, (Rc::new(ps[start..end].to_vec()), false));
+        }
+        from = end;
+    }
+    let mut from = 0;
+    while let Some(sd) = find_from(ps, b"StartData", from) {
+        from = sd + 9;
+        let head = String::from_utf8_lossy(&ps[sd.saturating_sub(64)..sd]).into_owned();
+        let Some(len) = head.split_whitespace().last().and_then(|t| t.parse::<usize>().ok()) else { continue };
+        let s = sd + 10;
+        let Some(data) = ps.get(s..s.saturating_add(len)) else { continue };
+        if let Some(name) = crate::cff::font_name(data) {
+            out.insert(name, (Rc::new(data.to_vec()), true));
+        }
+        from = s + len;
+    }
+    out
+}
diff --git a/crates/pdf/src/ps/exec.rs b/crates/pdf/src/ps/exec.rs
new file mode 100644
index 000000000..27697527c
--- /dev/null
+++ b/crates/pdf/src/ps/exec.rs
@@ -0,0 +1,172 @@
+use super::eps::embedded_fonts;
+use super::scanner::Src;
+use super::value::{Flow, GState, V, new_dict};
+use super::{Affine, BezPath, Builder, Cap, HashMap, Interp, Join};
+
+/// The deepest procedure nesting run (deeper recursion stops the program).
+const MAX_CALL_DEPTH: usize = 256;
+
+impl Interp {
+    pub fn new(page: [f64; 4]) -> Interp {
+        Interp {
+            b: Builder::new(),
+            st: vec![],
+            dicts: vec![new_dict()],
+            gs: GState {
+                ctm: Affine::IDENTITY,
+                color: [0.0; 3],
+                lw: 1.0,
+                cap: Cap::Butt,
+                join: Join::Miter,
+                miter: 10.0,
+                dash: None,
+                path: BezPath::new(),
+                cur: None,
+                start: None,
+                depth: 1,
+                font: None,
+            },
+            saved: vec![],
+            budget: 8_000_000,
+            calls: 0,
+            font_dir: HashMap::new(),
+            embedded: HashMap::new(),
+            font_cache: HashMap::new(),
+            page,
+            unknown: vec![],
+        }
+    }
+
+    pub fn run(&mut self, data: &[u8]) {
+        self.embedded = embedded_fonts(data);
+        let mut src = Src { d: data, pos: 0 };
+        while let Some(t) = src.token(0) {
+            if let Err(Flow::Quit) = self.exec_token(t, &mut src) {
+                break;
+            }
+        }
+    }
+
+    pub(super) fn pop(&mut self) -> V {
+        self.st.pop().unwrap_or(V::Null)
+    }
+
+    pub(super) fn popn(&mut self) -> f64 {
+        self.pop().num().unwrap_or(0.0)
+    }
+
+    pub(super) fn push(&mut self, v: V) {
+        if self.st.len() < 100_000 {
+            self.st.push(v);
+        }
+    }
+
+    pub(super) fn lookup(&self, k: &str) -> Option<V> {
+        self.dicts.iter().rev().find_map(|d| d.borrow().get(k).cloned())
+    }
+
+    /// A token read from the file: procedures are pushed, names executed.
+    fn exec_token(&mut self, t: V, src: &mut Src) -> Result<(), Flow> {
+        match t {
+            V::Name(n) => self.exec_name(&n, src),
+            other => {
+                self.push(other);
+                Ok(())
+            }
+        }
+    }
+
+    /// Execute a value as an object (procedures run).
+    pub(super) fn exec_obj(&mut self, v: V, src: &mut Src) -> Result<(), Flow> {
+        match v {
+            V::Proc(p) => {
+                if self.calls >= MAX_CALL_DEPTH {
+                    self.b.skip("PostScript (recursion limit)");
+                    return Err(Flow::Quit);
+                }
+                self.calls += 1;
+                let mut r = Ok(());
+                for x in p.iter() {
+                    match x {
+                        V::Name(n) => {
+                            r = self.exec_name(n, src);
+                            if r.is_err() {
+                                break;
+                            }
+                        }
+                        V::Op(op) => {
+                            r = self.spend(1).and_then(|()| self.builtin(op, src));
+                            if r.is_err() {
+                                break;
+                            }
+                        }
+                        // Other items count against the budget as names do.
+                        other => {
+                            r = self.spend(1);
+                            if r.is_err() {
+                                break;
+                            }
+                            self.push(other.clone());
+                        }
+                    }
+                }
+                self.calls -= 1;
+                r
+            }
+            // An executable name can run another (`exec` of `/exec cvx`), so names count too.
+            V::Name(n) => {
+                if self.calls >= MAX_CALL_DEPTH {
+                    self.b.skip("PostScript (recursion limit)");
+                    return Err(Flow::Quit);
+                }
+                self.calls += 1;
+                let r = self.exec_name(&n, src);
+                self.calls -= 1;
+                r
+            }
+            V::Op(op) => {
+                self.spend(1)?;
+                self.builtin(&op, src)
+            }
+            other => {
+                self.push(other);
+                Ok(())
+            }
+        }
+    }
+
+    fn exec_name(&mut self, n: &str, src: &mut Src) -> Result<(), Flow> {
+        self.spend(1)?;
+        if let Some(v) = self.lookup(n) {
+            return match v {
+                V::Proc(_) => self.exec_obj(v, src),
+                // An operator stored under another name (`/mo /moveto load def`, as Illustrator's
+                // EPS prolog does for every path operator) runs that operator. It pushed the
+                // operator's name instead, so such files drew nothing (#955).
+                V::Op(op) => self.builtin(&op, src),
+                // An executable name (`/y /x cvx def`) runs what that name is bound to.
+                V::Name(_) => self.exec_obj(v, src),
+                other => {
+                    self.push(other);
+                    Ok(())
+                }
+            };
+        }
+        self.builtin(n, src)
+    }
+
+    /// Count `n` operations against the budget, and stop the program when fewer are left. An
+    /// operator that makes, reads or copies path elements counts each one as an operation.
+    pub(super) fn spend(&mut self, n: usize) -> Result<(), Flow> {
+        match self.budget.checked_sub(n) {
+            Some(left) => {
+                self.budget = left;
+                Ok(())
+            }
+            None => {
+                self.b.skip("PostScript (operation limit)");
+                Err(Flow::Quit)
+            }
+        }
+    }
+}
diff --git a/crates/pdf/src/ps/paths.rs b/crates/pdf/src/ps/paths.rs
new file mode 100644
index 000000000..b1fe07092
--- /dev/null
+++ b/crates/pdf/src/ps/paths.rs
@@ -0,0 +1,187 @@
+use super::value::{Flow, V};
+use super::{Affine, BezPath, FillRule, Interp, MAX_PATH, Paint, PathEl, Point, Stroke};
+
+/// The angle from `a` counterclockwise to `b` (degrees, 0 to 360), worked out from what is left
+/// of each after whole turns.
+fn ccw_turn(a: f64, b: f64) -> f64 {
+    (b % 360.0 - a % 360.0).rem_euclid(360.0)
+}
+
+/// The most turns one `arc` or `arcn` draws.
+const MAX_ARC_TURNS: f64 = 1024.0;
+
+impl Interp {
+    fn device_scale(&self) -> f64 {
+        self.gs.ctm.determinant().abs().sqrt()
+    }
+
+    pub(super) fn user_point(&mut self) -> Point {
+        let y = self.popn();
+        let x = self.popn();
+        Point::new(x, y)
+    }
+
+    /// Stop the program when a path of `len` elements would be longer than [`MAX_PATH`].
+    fn path_fits(&mut self, len: usize) -> Result<(), Flow> {
+        if len <= MAX_PATH {
+            return Ok(());
+        }
+        self.b.skip("PostScript (path limit)");
+        Err(Flow::Quit)
+    }
+
+    /// [`Self::path_fits`] for the current path with `n` more elements.
+    pub(super) fn room(&mut self, n: usize) -> Result<(), Flow> {
+        self.path_fits(self.gs.path.elements().len().saturating_add(n))
+    }
+
+    pub(super) fn move_to(&mut self, p: Point) -> Result<(), Flow> {
+        // A moveto right after a moveto replaces it (PostScript Language Reference §8.2, `moveto`).
+        if matches!(self.gs.path.elements().last(), Some(PathEl::MoveTo(_))) {
+            self.gs.path.pop();
+        }
+        self.room(1)?;
+        let q = self.gs.ctm * p;
+        self.gs.path.move_to(q);
+        self.gs.cur = Some(q);
+        self.gs.start = Some(q);
+        Ok(())
+    }
+
+    pub(super) fn line_to(&mut self, p: Point) -> Result<(), Flow> {
+        self.room(1 + usize::from(self.gs.cur.is_none()))?;
+        let q = self.gs.ctm * p;
+        if self.gs.cur.is_none() {
+            self.gs.path.move_to(q);
+            self.gs.start = Some(q);
+        }
+        self.gs.path.line_to(q);
+        self.gs.cur = Some(q);
+        Ok(())
+    }
+
+    pub(super) fn curve_to(&mut self, a: Point, b: Point, c: Point) -> Result<(), Flow> {
+        self.room(1 + usize::from(self.gs.cur.is_none()))?;
+        let m = self.gs.ctm;
+        if self.gs.cur.is_none() {
+            self.gs.path.move_to(m * a);
+        }
+        self.gs.path.curve_to(m * a, m * b, m * c);
+        self.gs.cur = Some(m * c);
+        Ok(())
+    }
+
+    pub(super) fn current_user(&self) -> Point {
+        self.gs.ctm.inverse() * self.gs.cur.unwrap_or_default()
+    }
+
+    pub(super) fn arc(&mut self, neg: bool) -> Result<(), Flow> {
+        let a2 = self.popn();
+        let a1 = self.popn();
+        let r = self.popn();
+        let c = self.user_point();
+        // `arc` raises `a2` by multiples of 360 until it is at least `a1`, and `arcn` lowers it
+        // until it is at most `a1` (PostScript Language Reference §8.2, `arc` and `arcn`). Those
+        // sweeps, and the first endpoint, are worked out from what is left of each angle after
+        // whole turns.
+        let sweep = if !neg && a2 < a1 {
+            ccw_turn(a1, a2)
+        } else if neg && a2 > a1 {
+            -ccw_turn(a2, a1)
+        } else {
+            a2 - a1
+        };
+        // A sweep of more than `MAX_ARC_TURNS` turns is shortened by whole pairs of turns to
+        // between `MAX_ARC_TURNS - 2` and `MAX_ARC_TURNS` turns, with a skip note. The arc still
+        // ends at `a2`, and an even-odd fill or clip of it covers the same area as the full sweep.
+        let max = MAX_ARC_TURNS * 360.0;
+        let sweep = if sweep.abs() > max {
+            self.b.skip("arc (too many turns)");
+            let s = sweep.signum();
+            s * (max - 720.0 + (s * (a2 % 720.0 - a1 % 720.0)).rem_euclid(720.0))
+        } else {
+            sweep
+        };
+        let (a1, sweep) = ((a1 % 360.0).to_radians(), sweep.to_radians());
+        let start = Point::new(c.x + r * a1.cos(), c.y + r * a1.sin());
+        if self.gs.cur.is_some() {
+            self.line_to(start)?;
+        } else {
+            self.move_to(start)?;
+        }
+        let arc = kurbo::Arc::new(c, (r, r), a1, sweep, 0.0);
+        let m = self.gs.ctm;
+        // kurbo divides an arc into more curves the larger the radius (about 3.7 × 10^49 for a
+        // quarter turn at a radius of 10^300, more than a usize can count), so each one counts
+        // against the budget and the path limit.
+        let mut curves = arc.append_iter(0.1);
+        while let Some(PathEl::CurveTo(p1, p2, p3)) = curves.next() {
+            self.room(1)?;
+            self.spend(1)?;
+            self.gs.path.curve_to(m * p1, m * p2, m * p3);
+            self.gs.cur = Some(m * p3);
+        }
+        Ok(())
+    }
+
+    pub(super) fn paint(&mut self, fill: Option<FillRule>, stroke: bool) {
+        let path = std::mem::take(&mut self.gs.path);
+        self.gs.cur = None;
+        self.gs.start = None;
+        let s = self.device_scale();
+        let st = stroke.then(|| Stroke {
+            paint: Paint::Color(self.gs.color),
+            opacity: 1.0,
+            width: if self.gs.lw <= 0.0 { 1.0 } else { self.gs.lw * s },
+            cap: self.gs.cap,
+            join: self.gs.join,
+            miter: self.gs.miter.max(1.0),
+            dash: self.gs.dash.as_ref().map(|(a, o)| (a.iter().map(|v| v * s).collect(), o * s)),
+        });
+        self.b.fill_stroke(path, Affine::IDENTITY, fill.map(|r| (Paint::Color(self.gs.color), 1.0, r)), st);
+    }
+
+    pub(super) fn rect_path(&mut self) -> Result<Vec<BezPath>, Flow> {
+        // x y w h, or an array / string of numbers.
+        let top = self.pop();
+        let nums: Vec<f64> = match &top {
+            V::Array(_) | V::Proc(_) => {
+                let items = top.items().unwrap_or_default();
+                // An array's rectangles count against the budget, five path elements each.
+                self.spend(items.len() / 4 * 5)?;
+                items.iter().filter_map(V::num).collect()
+            }
+            V::Num(h) => {
+                let w = self.popn();
+                let y = self.popn();
+                let x = self.popn();
+                vec![x, y, w, *h]
+            }
+            _ => vec![],
+        };
+        self.path_fits(nums.len() / 4 * 5)?;
+        let m = self.gs.ctm;
+        Ok(nums
+            .as_chunks::<4>()
+            .0
+            .iter()
+            .map(|r| {
+                let mut p = BezPath::new();
+                p.move_to(m * Point::new(r[0], r[1]));
+                p.line_to(m * Point::new(r[0] + r[2], r[1]));
+                p.line_to(m * Point::new(r[0] + r[2], r[1] + r[3]));
+                p.line_to(m * Point::new(r[0], r[1] + r[3]));
+                p.close_path();
+                p
+            })
+            .collect())
+    }
+
+    pub(super) fn grestore(&mut self) {
+        if let Some(g) = self.saved.pop() {
+            let d = g.depth;
+            self.gs = g;
+            self.b.close_to(d);
+        }
+    }
+}
diff --git a/crates/pdf/src/ps/scanner.rs b/crates/pdf/src/ps/scanner.rs
new file mode 100644
index 000000000..59933e214
--- /dev/null
+++ b/crates/pdf/src/ps/scanner.rs
@@ -0,0 +1,223 @@
+use super::value::V;
+use super::{Rc, RefCell, ascii85, is_white, parse_num};
+
+/// Source tokenizer (the data source for `currentfile`).
+pub(super) struct Src<'a> {
+    pub(super) d: &'a [u8],
+    pub(crate) pos: usize,
+}
+
+impl Src<'_> {
+    fn skip_ws(&mut self) {
+        while self.pos < self.d.len() {
+            let c = self.d[self.pos];
+            if is_white(c) {
+                self.pos += 1;
+            } else if c == b'%' {
+                let s = self.pos;
+                while self.pos < self.d.len() && !matches!(self.d[self.pos], b'\n' | b'\r') {
+                    self.pos += 1;
+                }
+                // DSC: skip embedded binary / data sections.
+                let line = &self.d[s..self.pos];
+                if line.starts_with(b"%%BeginData:") || line.starts_with(b"%%BeginBinary:") || line.starts_with(b"%%BeginPreview") {
+                    let end: &[u8] = if line.starts_with(b"%%BeginData:") {
+                        b"%%EndData"
+                    } else if line.starts_with(b"%%BeginBinary:") {
+                        b"%%EndBinary"
+                    } else {
+                        b"%%EndPreview"
+                    };
+                    match self.d[self.pos..].windows(end.len()).position(|w| w == end) {
+                        Some(p) => self.pos += p,
+                        None => self.pos = self.d.len(),
+                    }
+                }
+            } else {
+                break;
+            }
+        }
+    }
+
+    fn word(&mut self) -> &[u8] {
+        let s = self.pos;
+        while self.pos < self.d.len() {
+            let c = self.d[self.pos];
+            if is_white(c) || matches!(c, b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%') {
+                break;
+            }
+            self.pos += 1;
+        }
+        &self.d[s..self.pos]
+    }
+
+    /// The next token; `{ … }` comes back as a whole procedure.
+    pub(super) fn token(&mut self, depth: usize) -> Option<V> {
+        self.skip_ws();
+        let c = *self.d.get(self.pos)?;
+        Some(match c {
+            b'{' => {
+                self.pos += 1;
+                let mut body = vec![];
+                loop {
+                    self.skip_ws();
+                    match self.d.get(self.pos) {
+                        None => break,
+                        Some(b'}') => {
+                            self.pos += 1;
+                            break;
+                        }
+                        _ => {
+                            if depth > 100 {
+                                return None;
+                            }
+                            match self.token(depth + 1) {
+                                Some(t) => body.push(t),
+                                None => break,
+                            }
+                        }
+                    }
+                }
+                V::Proc(Rc::new(body))
+            }
+            b'}' => {
+                self.pos += 1;
+                V::Null
+            }
+            b'/' => {
+                self.pos += 1;
+                let imm = self.d.get(self.pos) == Some(&b'/');
+                if imm {
+                    self.pos += 1;
+                }
+                let w = String::from_utf8_lossy(self.word()).into_owned();
+                // `//name` (immediately evaluated) is treated like a plain name.
+                if imm { V::Name(w.into()) } else { V::Lit(w.into()) }
+            }
+            b'(' => {
+                self.pos += 1;
+                let mut out = vec![];
+                let mut depth = 1;
+                while self.pos < self.d.len() {
+                    let c = self.d[self.pos];
+                    self.pos += 1;
+                    match c {
+                        b'\\' => {
+                            let e = self.d.get(self.pos).copied().unwrap_or(b'\\');
+                            self.pos += 1;
+                            match e {
+                                b'n' => out.push(b'\n'),
+                                b'r' => out.push(b'\r'),
+                                b't' => out.push(b'\t'),
+                                b'0'..=b'7' => {
+                                    let mut v = (e - b'0') as u32;
+                                    for _ in 0..2 {
+                                        match self.d.get(self.pos) {
+                                            Some(d @ b'0'..=b'7') => {
+                                                v = v * 8 + (d - b'0') as u32;
+                                                self.pos += 1;
+                                            }
+                                            _ => break,
+                                        }
+                                    }
+                                    out.push(v as u8);
+                                }
+                                b'\n' | b'\r' => {}
+                                o => out.push(o),
+                            }
+                        }
+                        b'(' => {
+                            depth += 1;
+                            out.push(c);
+                        }
+                        b')' => {
+                            depth -= 1;
+                            if depth == 0 {
+                                break;
+                            }
+                            out.push(c);
+                        }
+                        _ => out.push(c),
+                    }
+                }
+                V::Str(Rc::new(RefCell::new(out)))
+            }
+            b'<' if self.d.get(self.pos + 1) == Some(&b'<') => {
+                self.pos += 2;
+                V::Name("<<".into())
+            }
+            b'>' if self.d.get(self.pos + 1) == Some(&b'>') => {
+                self.pos += 2;
+                V::Name(">>".into())
+            }
+            b'<' if self.d.get(self.pos + 1) == Some(&b'~') => {
+                let s = self.pos;
+                while self.pos + 1 < self.d.len() && !(self.d[self.pos] == b'~' && self.d[self.pos + 1] == b'>') {
+                    self.pos += 1;
+                }
+                self.pos = (self.pos + 2).min(self.d.len());
+                V::Str(Rc::new(RefCell::new(ascii85(&self.d[s..self.pos]))))
+            }
+            b'<' => {
+                self.pos += 1;
+                let mut hex = vec![];
+                while self.pos < self.d.len() && self.d[self.pos] != b'>' {
+                    if self.d[self.pos].is_ascii_hexdigit() {
+                        hex.push(self.d[self.pos]);
+                    }
+                    self.pos += 1;
+                }
+                self.pos += 1;
+                if hex.len() % 2 == 1 {
+                    hex.push(b'0');
+                }
+                let h = |c: u8| (c as char).to_digit(16).unwrap_or(0) as u8;
+                V::Str(Rc::new(RefCell::new(hex.chunks(2).map(|p| (h(p[0]) << 4) | h(p[1])).collect())))
+            }
+            b'[' | b']' => {
+                self.pos += 1;
+                V::Name(if c == b'[' { "[" } else { "]" }.into())
+            }
+            b')' | b'>' => {
+                self.pos += 1;
+                V::Null
+            }
+            _ => {
+                let w = self.word();
+                if w.is_empty() {
+                    self.pos += 1;
+                    return Some(V::Null);
+                }
+                match parse_num(w) {
+                    Some(n) => V::Num(n),
+                    None => {
+                        // Radix numbers (16#FF).
+                        let s = String::from_utf8_lossy(w).into_owned();
+                        match s.split_once('#').and_then(|(r, v)| i64::from_str_radix(v, r.parse::<u32>().ok().filter(|r| (2..=36).contains(r))?).ok()) {
+                            Some(n) => V::Num(n as f64),
+                            None => V::Name(s.into()),
+                        }
+                    }
+                }
+            }
+        })
+    }
+
+    /// Step over inline image data that follows an `image` operator reading `currentfile`.
+    pub(super) fn skip_image_data(&mut self) {
+        self.skip_ws();
+        if self.d[self.pos..].starts_with(b"<~") || self.d.get(self.pos).is_some_and(|c| (b'!'..=b'u').contains(c) && !c.is_ascii_hexdigit()) {
+            match self.d[self.pos..].windows(2).position(|w| w == b"~>") {
+                Some(p) => self.pos += p + 2,
+                None => self.pos = self.d.len(),
+            }
+            return;
+        }
+        while self.pos < self.d.len() && (self.d[self.pos].is_ascii_hexdigit() || is_white(self.d[self.pos])) {
+            self.pos += 1;
+        }
+        if self.d.get(self.pos) == Some(&b'>') {
+            self.pos += 1;
+        }
+    }
+}
diff --git a/crates/pdf/src/ps/text.rs b/crates/pdf/src/ps/text.rs
new file mode 100644
index 000000000..b138965bb
--- /dev/null
+++ b/crates/pdf/src/ps/text.rs
@@ -0,0 +1,322 @@
+use super::scanner::Src;
+use super::value::{DictRef, Flow, V, array, matrix_of, matrix_val, new_dict};
+use super::{Affine, BezPath, FillRule, Font, HashMap, Interp, Paint, Point, Rc, RefCell};
+
+// ------------------------------------------------------------------ text
+
+/// An encoding array of glyph names (`StandardEncoding`; `ISOLatin1Encoding` and others are
+/// approximated by WinAnsi, which agrees with ISO Latin-1 on the printable codes).
+pub(super) fn encoding_array(name: &str) -> V {
+    let base = if name == "StandardEncoding" { crate::encoding::Base::Standard } else { crate::encoding::Base::WinAnsi };
+    array((0..256).map(|c| V::Lit(base.name(c as u8).unwrap_or_else(|| ".notdef".into()).into())).collect())
+}
+
+fn dict_matrix(d: &DictRef, key: &str) -> Affine {
+    d.borrow().get(key).and_then(matrix_of).unwrap_or(Affine::IDENTITY)
+}
+
+/// A copy of a font dictionary with `m` applied after its matrix (`scalefont`, `makefont`).
+fn transformed(font: &DictRef, m: Affine) -> DictRef {
+    let copy: HashMap<String, V> = font.borrow().clone();
+    let d = Rc::new(RefCell::new(copy));
+    let old = dict_matrix(&d, "__m");
+    d.borrow_mut().insert("__m".into(), matrix_val(m * old));
+    d
+}
+
+impl Interp {
+    /// A font dictionary by name: one `definefont` made, else a new dictionary for an
+    /// embedded program or a bundled stand-in.
+    pub(super) fn find_font(&mut self, key: &str) -> DictRef {
+        if let Some(d) = self.font_dir.get(key) {
+            return d.clone();
+        }
+        let d = new_dict();
+        {
+            let mut m = d.borrow_mut();
+            m.insert("FontName".into(), V::Lit(key.into()));
+            m.insert("FontType".into(), V::Num(1.0));
+            m.insert("FontMatrix".into(), matrix_val(Affine::scale(0.001)));
+            m.insert("FID".into(), V::Null);
+            m.insert("__base".into(), V::Lit(key.into()));
+            m.insert("__m".into(), matrix_val(Affine::IDENTITY));
+        }
+        self.font_dir.insert(key.to_string(), d.clone());
+        d
+    }
+
+    /// The drawable font of a font dictionary (its base program and encoding) and the matrix
+    /// from text space (font size 1) to user space.
+    fn font_of(&mut self, d: &DictRef) -> Option<(Rc<Font>, Affine)> {
+        if matches!(d.borrow().get("FontType"), Some(V::Num(t)) if *t == 3.0) {
+            // Type 3 fonts (glyph procedures) are not run.
+            self.b.skip("EPS Type 3 font");
+            return None;
+        }
+        let (base, names) = {
+            let m = d.borrow();
+            let base = m.get("__base").or_else(|| m.get("FontName")).map(V::key)?;
+            let names: Option<Vec<Option<String>>> = m.get("Encoding").and_then(V::items).map(|a| {
+                a.iter()
+                    .map(|v| match v {
+                        V::Lit(n) | V::Name(n) if &**n != ".notdef" => Some(n.to_string()),
+                        _ => None,
+                    })
+                    .collect()
+            });
+            (base, names)
+        };
+        let key = match &names {
+            Some(n) => format!("{base}\u{0}{}", n.iter().map(|x| x.as_deref().unwrap_or("")).collect::<Vec<_>>().join(" ")),
+            None => base.clone(),
+        };
+        let font = match self.font_cache.get(&key) {
+            Some(f) => f.clone(),
+            None => {
+                // Not embedded: a bundled stand-in, as for PDF.
+                let prog = self.embedded.get(&base).cloned();
+                let f = Rc::new(Font::standalone(&base, prog.as_ref().map(|(d, cff)| (d.as_slice(), *cff)), names));
+                self.font_cache.insert(key, f.clone());
+                f
+            }
+        };
+        Some((font, dict_matrix(d, "__m")))
+    }
+
+    /// A string's glyph outlines (device space) from the current point, with an extra
+    /// displacement `extra(index, code)` (user space) after each glyph; moves the current
+    /// point.
+    fn text_path(&mut self, bytes: &[u8], mut extra: impl FnMut(usize, u32) -> (f64, f64)) -> Result<Option<(BezPath, String)>, Flow> {
+        let Some(d) = self.gs.font.clone() else { return Ok(None) };
+        let Some((font, m)) = self.font_of(&d) else { return Ok(None) };
+        let mut p = self.current_user();
+        let mut path = BezPath::new();
+        let mut text = String::new();
+        let ctm = self.gs.ctm;
+        for (i, &code) in bytes.iter().enumerate() {
+            let code = code as u32;
+            if let Some(g) = font.glyph(code) {
+                path.extend(ctm * Affine::translate(p.to_vec2()) * m * (*g).clone());
+            }
+            text.push_str(&font.unicode(code));
+            let adv = m * Point::new(font.width(code), 0.0) - m * Point::ZERO;
+            let (ex, ey) = extra(i, code);
+            p += adv + kurbo::Vec2::new(ex, ey);
+        }
+        self.move_to(p)?;
+        Ok(Some((path, text)))
+    }
+
+    fn fill_text(&mut self, path: BezPath, text: &str) {
+        let label: String = text.chars().filter(|c| !c.is_control()).take(40).collect();
+        let name = if label.trim().is_empty() { "Text".to_string() } else { format!("Text: {}", label.trim()) };
+        self.b.fill_stroke_named(&name, path, Affine::IDENTITY, Some((Paint::Color(self.gs.color), 1.0, FillRule::NonZero)), None);
+    }
+
+    fn pop_string(&mut self) -> Vec<u8> {
+        match self.pop() {
+            V::Str(s) => s.borrow().clone(),
+            _ => vec![],
+        }
+    }
+
+    fn show_with(&mut self, s: &[u8], extra: impl FnMut(usize, u32) -> (f64, f64)) -> Result<(), Flow> {
+        match self.text_path(s, extra)? {
+            Some((path, text)) => self.fill_text(path, &text),
+            None => self.b.skip("text (no font)"),
+        }
+        Ok(())
+    }
+
+    /// Text and font operators (PostScript Language Reference §5.1, §8.2).
+    pub(super) fn text_op(&mut self, n: &str, src: &mut Src) -> Result<(), Flow> {
+        match n {
+            "scalefont" | "makefont" => {
+                let m = if n == "scalefont" {
+                    Affine::scale(self.popn())
+                } else {
+                    let v = self.pop();
+                    matrix_of(&v).unwrap_or(Affine::IDENTITY)
+                };
+                let font = match self.pop() {
+                    V::Dict(d) => d,
+                    _ => self.find_font("Helvetica"),
+                };
+                self.push(V::Dict(transformed(&font, m)));
+            }
+            "selectfont" => {
+                let size = self.pop();
+                let key = self.pop().key();
+                let font = self.find_font(&key);
+                let m = match &size {
+                    V::Num(s) => Affine::scale(*s),
+                    other => matrix_of(other).unwrap_or(Affine::IDENTITY),
+                };
+                self.gs.font = Some(transformed(&font, m));
+            }
+            "setfont" => {
+                if let V::Dict(d) = self.pop() {
+                    self.gs.font = Some(d);
+                }
+            }
+            "currentfont" | "rootfont" => {
+                let d = self.gs.font.clone().unwrap_or_else(new_dict);
+                self.push(V::Dict(d));
+            }
+            "definefont" => {
+                let v = self.pop();
+                let key = self.pop().key();
+                if let V::Dict(d) = &v {
+                    if !d.borrow().contains_key("__base") {
+                        // A font the file defines itself: its embedded program, by name.
+                        d.borrow_mut().insert("__base".into(), V::Lit(key.as_str().into()));
+                        d.borrow_mut().insert("__m".into(), matrix_val(Affine::IDENTITY));
+                    }
+                    self.font_dir.insert(key, d.clone());
+                }
+                self.push(v);
+            }
+            "undefinefont" => {
+                let key = self.pop().key();
+                self.font_dir.remove(&key);
+            }
+            "StandardEncoding" | "ISOLatin1Encoding" => self.push(encoding_array(n)),
+            "show" => {
+                let s = self.pop_string();
+                self.show_with(&s, |_, _| (0.0, 0.0))?;
+            }
+            "ashow" => {
+                let s = self.pop_string();
+                let ay = self.popn();
+                let ax = self.popn();
+                self.show_with(&s, |_, _| (ax, ay))?;
+            }
+            "widthshow" => {
+                let s = self.pop_string();
+                let ch = self.popn() as u32;
+                let cy = self.popn();
+                let cx = self.popn();
+                self.show_with(&s, |_, c| if c == ch { (cx, cy) } else { (0.0, 0.0) })?;
+            }
+            "awidthshow" => {
+                let s = self.pop_string();
+                let ay = self.popn();
+                let ax = self.popn();
+                let ch = self.popn() as u32;
+                let cy = self.popn();
+                let cx = self.popn();
+                self.show_with(&s, |_, c| if c == ch { (cx + ax, cy + ay) } else { (ax, ay) })?;
+            }
+            "kshow" | "cshow" => {
+                // The procedure between characters is not run.
+                let s = self.pop_string();
+                self.pop();
+                self.show_with(&s, |_, _| (0.0, 0.0))?;
+            }
+            "xshow" | "yshow" | "xyshow" => {
+                let disp: Vec<f64> = self.pop().items().unwrap_or_default().iter().filter_map(V::num).collect();
+                let s = self.pop_string();
+                self.explicit_show(&s, &disp, n)?;
+            }
+            "glyphshow" => {
+                let name = self.pop().key();
+                let Some(d) = self.gs.font.clone() else { return Ok(()) };
+                // Drawn through a one-glyph encoding.
+                let mut e: Vec<V> = (0..256).map(|_| V::Lit(".notdef".into())).collect();
+                e[65] = V::Lit(name.as_str().into());
+                let tmp = transformed(&d, Affine::IDENTITY);
+                tmp.borrow_mut().insert("Encoding".into(), array(e));
+                self.gs.font = Some(tmp);
+                self.show_with(b"A", |_, _| (0.0, 0.0))?;
+                self.gs.font = Some(d);
+            }
+            "charpath" => {
+                self.pop();
+                let s = self.pop_string();
+                let saved = std::mem::take(&mut self.gs.path);
+                let start = self.gs.start;
+                match self.text_path(&s, |_, _| (0.0, 0.0))? {
+                    Some((glyphs, _)) => {
+                        // The outlines join the path: each element counts against the budget and
+                        // the path limit.
+                        self.gs.path = saved;
+                        self.room(glyphs.elements().len() + 1)?;
+                        self.spend(glyphs.elements().len())?;
+                        self.gs.path.extend(glyphs);
+                        if let Some(c) = self.gs.cur {
+                            self.gs.path.move_to(c);
+                        }
+                        self.gs.start = start;
+                    }
+                    None => self.gs.path = saved,
+                }
+            }
+            "stringwidth" => {
+                let s = self.pop_string();
+                let (mut w, mut h) = (0.0, 0.0);
+                if let Some(d) = self.gs.font.clone()
+                    && let Some((font, m)) = self.font_of(&d)
+                {
+                    for &c in &s {
+                        let v = m * Point::new(font.width(c as u32), 0.0) - m * Point::ZERO;
+                        w += v.x;
+                        h += v.y;
+                    }
+                }
+                self.push(V::Num(w));
+                self.push(V::Num(h));
+            }
+            "setcachedevice" => {
+                for _ in 0..6 {
+                    self.pop();
+                }
+            }
+            "setcharwidth" => {
+                self.pop();
+                self.pop();
+            }
+            // An embedded Type 1 program's encrypted part (read by `embedded_fonts`).
+            "eexec" => {
+                if matches!(self.pop(), V::File) {
+                    let rest = &src.d[src.pos.min(src.d.len())..];
+                    src.pos += rest.windows(11).position(|w| w == b"cleartomark").map_or(rest.len(), |p| p + 11);
+                }
+            }
+            // A CFF font set's binary data (read by `embedded_fonts`).
+            "StartData" => {
+                let len = self.popn().max(0.0) as usize;
+                self.pop();
+                src.pos = src.pos.saturating_add(1).saturating_add(len).min(src.d.len());
+            }
+            _ => {}
+        }
+        Ok(())
+    }
+
+    /// `xshow` / `yshow` / `xyshow`: glyph displacements from a number array instead of the
+    /// advances.
+    fn explicit_show(&mut self, s: &[u8], disp: &[f64], n: &str) -> Result<(), Flow> {
+        let step = if n == "xyshow" { 2 } else { 1 };
+        let d: Vec<(f64, f64)> = (0..s.len())
+            .map(|k| {
+                let i = k * step;
+                let v = |j: usize| disp.get(j).copied().unwrap_or(0.0);
+                match n {
+                    "xshow" => (v(i), 0.0),
+                    "yshow" => (0.0, v(i)),
+                    _ => (v(i), v(i + 1)),
+                }
+            })
+            .collect();
+        let Some(fd) = self.gs.font.clone() else {
+            self.b.skip("text (no font)");
+            return Ok(());
+        };
+        let Some((font, m)) = self.font_of(&fd) else { return Ok(()) };
+        self.show_with(s, move |k, c| {
+            let adv = m * Point::new(font.width(c), 0.0) - m * Point::ZERO;
+            let (dx, dy) = d.get(k).copied().unwrap_or((0.0, 0.0));
+            (dx - adv.x, dy - adv.y)
+        })
+    }
+}
diff --git a/crates/pdf/src/ps/value.rs b/crates/pdf/src/ps/value.rs
new file mode 100644
index 000000000..3cfafed6e
--- /dev/null
+++ b/crates/pdf/src/ps/value.rs
@@ -0,0 +1,88 @@
+use super::{Affine, BezPath, Cap, HashMap, Join, Point, Rc, RefCell};
+
+pub(crate) type DictRef = Rc<RefCell<HashMap<String, V>>>;
+
+#[derive(Clone)]
+pub(crate) enum V {
+    Num(f64),
+    Bool(bool),
+    /// An executable name.
+    Name(Rc<str>),
+    /// A literal name (`/name`).
+    Lit(Rc<str>),
+    /// A built-in operator, as `load` returns it for a name no dictionary defines.
+    Op(Rc<str>),
+    Str(Rc<RefCell<Vec<u8>>>),
+    Proc(Rc<Vec<V>>),
+    Array(Rc<RefCell<Vec<V>>>),
+    Dict(DictRef),
+    Mark,
+    Null,
+    /// `currentfile`.
+    File,
+}
+
+impl V {
+    pub(super) fn num(&self) -> Option<f64> {
+        match self {
+            V::Num(n) => Some(*n),
+            _ => None,
+        }
+    }
+    pub(super) fn key(&self) -> String {
+        match self {
+            V::Name(n) | V::Lit(n) | V::Op(n) => n.to_string(),
+            V::Str(s) => String::from_utf8_lossy(&s.borrow()).into_owned(),
+            V::Num(n) => format!("{n}"),
+            V::Bool(b) => format!("{b}"),
+            _ => String::new(),
+        }
+    }
+    pub(super) fn items(&self) -> Option<Vec<V>> {
+        match self {
+            V::Array(a) => Some(a.borrow().clone()),
+            V::Proc(p) => Some(p.as_ref().clone()),
+            _ => None,
+        }
+    }
+}
+
+pub(super) enum Flow {
+    Exit,
+    Stop,
+    Quit,
+}
+
+#[derive(Clone)]
+pub(super) struct GState {
+    pub(crate) ctm: Affine,
+    pub(crate) color: [f64; 3],
+    pub(crate) lw: f64,
+    pub(crate) cap: Cap,
+    pub(crate) join: Join,
+    pub(crate) miter: f64,
+    pub(crate) dash: Option<(Vec<f64>, f64)>,
+    pub(crate) path: BezPath,
+    pub(crate) cur: Option<Point>,
+    pub(crate) start: Option<Point>,
+    pub(crate) depth: usize,
+    /// The current font dictionary.
+    pub(crate) font: Option<DictRef>,
+}
+
+pub(super) fn new_dict() -> DictRef {
+    Rc::new(RefCell::new(HashMap::new()))
+}
+
+pub(super) fn array(v: Vec<V>) -> V {
+    V::Array(Rc::new(RefCell::new(v)))
+}
+
+pub(super) fn matrix_of(v: &V) -> Option<Affine> {
+    let a: Vec<f64> = v.items()?.iter().filter_map(V::num).collect();
+    (a.len() == 6).then(|| Affine::new([a[0], a[1], a[2], a[3], a[4], a[5]]))
+}
+
+pub(super) fn matrix_val(m: Affine) -> V {
+    array(m.as_coeffs().iter().map(|c| V::Num(*c)).collect())
+}
diff --git a/crates/pdf/src/read.rs b/crates/pdf/src/read.rs
index 953582fc8..b9c86d0ad 100644
--- a/crates/pdf/src/read.rs
+++ b/crates/pdf/src/read.rs
@@ -2,6 +2,7 @@
 //! Only reachable objects are retained, references keep their generation, and native parser
 //! panics (including lazy object reads) discard the entire partially populated adapter.
 
+use std::cell::LazyCell;
 use std::collections::{HashMap, HashSet, VecDeque};
 use std::panic::{AssertUnwindSafe, catch_unwind};
 use std::sync::Arc;
@@ -10,12 +11,21 @@ use craft_pdf::syntax::object::{Dict as PdfDict, MaybeRef, Name, ObjRef, Object,
 use craft_pdf::syntax::xref::XRef;
 
 use crate::Error;
-use crate::object::{Dict, File, Lexer, Obj};
+use crate::object::{Dict, File, Lexer, Obj, is_delim, is_white, name_bytes};
 
 const MAX_OBJECTS: usize = 100_000;
 const MAX_VALUES: usize = 1_000_000;
 const MAX_DEPTH: usize = 64;
 const MAX_BYTES: usize = 512 * 1024 * 1024;
+/// How far after each `trailer` marker the encryption pre-scan lexes. A classic trailer
+/// dictionary is a few hundred bytes. If the lexer reaches the window's end before any object
+/// or inside a dictionary, the dictionary may start or continue past it, so the file is refused
+/// when a name token that decodes to `Encrypt`, in any spelling (`/Encrypt`, `/Encr#79pt`), ends
+/// past the window. This fallback is conservative: it refuses on any such name there, which in
+/// practice only encrypted files contain. The pre-scan stays linear in file size, at most
+/// `MAX_OBJECTS` windows (about 400 MB) and one search for the name, even when a marker is
+/// followed by an unterminated string or dictionary the lexer would follow to the end.
+const TRAILER_WINDOW: usize = 4 * 1024;
 
 fn limit(what: &str) -> Error {
     Error::Read(format!("PDF exceeds the {what} import limit"))
@@ -41,6 +51,15 @@ fn open_inner(bytes: &[u8]) -> Result<File, Error> {
     // Preserve the app's refusal of encrypted PDFs, including empty-user-password files.
     // Classic trailer dictionaries use the existing lexer; xref-stream dictionaries below
     // are read by the shared parser. This does not parse document objects a second time.
+    let regular = |c: u8| !is_white(c) && !is_delim(c);
+    // Where the last name token decoding to `Encrypt` (escaped or not) ends, searched at most once.
+    // Each token scan stops at the next `/`, so the search is linear.
+    let last_encrypt = LazyCell::new(|| {
+        bytes.iter().enumerate().rev().filter(|&(_, &c)| c == b'/').find_map(|(at, _)| {
+            let token = bytes.get(at + 1..).unwrap_or_default().split(|&c| !regular(c)).next().unwrap_or_default();
+            name_bytes(token).eq(*b"Encrypt").then_some(at + 1 + token.len())
+        })
+    });
     let mut markers = 0;
     for (offset, word) in bytes.windows(7).enumerate() {
         if word == b"trailer" {
@@ -48,9 +67,28 @@ fn open_inner(bytes: &[u8]) -> Result<File, Error> {
             if markers > MAX_OBJECTS {
                 return Err(limit("trailer count"));
             }
-            if let Some(Obj::Dict(dict)) = Lexer::new(bytes, offset + 7).next()
-                && dict.contains_key("Encrypt")
-            {
+            let start = offset + 7;
+            let mut end = bytes.len().min(start.saturating_add(TRAILER_WINDOW));
+            // If the first object after the marker starts in the window and does not open a dictionary
+            // (`<<`), such as a string running on through a stream, no trailer dictionary follows the
+            // marker, so the fallback below does not apply.
+            let mut first = Lexer::new(bytes.get(..end).unwrap_or_default(), start);
+            first.skip_ws();
+            let maybe_dict = first.pos >= end || bytes.get(first.pos..).is_some_and(|rest| rest.starts_with(b"<<"));
+            // A window ending inside a token (a regular byte on each side of the cut) would read its
+            // first part as all of it, such as `/Encrypt` of `/Encrypted`. It ends before that token
+            // instead, so the fallback below reads the token whole.
+            if bytes.get(end).is_some_and(|&c| regular(c)) {
+                end = end.saturating_sub(bytes.get(start..end).unwrap_or_default().iter().rev().take_while(|&&c| regular(c)).count());
+            }
+            let window = bytes.get(start..end).unwrap_or_default();
+            let mut lexer = Lexer::new(window, 0);
+            let encrypt = matches!(lexer.next(), Some(Obj::Dict(dict)) if dict.contains_key("Encrypt"));
+            // Whatever it returned, a lexer at the window's end (one past it after an unterminated
+            // hex string) may have stopped before the dictionary started or partway through it, so
+            // an `Encrypt` name in any spelling that ends past the window refuses the file.
+            let cut = maybe_dict && lexer.pos >= window.len() && last_encrypt.is_some_and(|name_end| name_end > end);
+            if encrypt || cut {
                 return Err(Error::Encrypted);
             }
         }
diff --git a/crates/pdf/src/tests.rs b/crates/pdf/src/tests.rs
index f2eff0466..cd3eecdb2 100644
--- a/crates/pdf/src/tests.rs
+++ b/crates/pdf/src/tests.rs
@@ -4,6 +4,11 @@ use super::*;
 
 use crate::write::pdf;
 
+mod groups;
+mod import;
+mod reader;
+mod shading;
+
 const CONTENT: &str = "/OC /MC0 BDC\n0 1 0 rg 0 0 200 100 re f\nEMC\n\
 /OC /MC1 BDC\nq 10 10 80 80 re W n\n1 0 0 rg 0 0 50 100 re f\nQ\n\
 /Pattern cs /P0 scn 100 0 100 50 re f\n\
@@ -107,6 +112,86 @@ fn pdf_forms_rotation_cmyk_and_alpha() {
     assert_eq!(img.get(30, 30)[3], 0.0, "form clipped to its bounding box");
 }
 
+/// A one-page PDF with a MediaBox [0 0 420 220], `pages` added to the /Pages node and `page` to
+/// the page: grey over the media box, a blue 20 × 10 marker at PDF (64, 54).
+fn boxes_pdf(pages: &str, page: &str) -> Vec<u8> {
+    let content = "0.5 g 0 0 420 220 re f 0 0 1 rg 64 54 20 10 re f";
+    pdf(
+        &[
+            (1, "<< /Type /Catalog /Pages 2 0 R >>".to_string(), None),
+            (2, format!("<< /Type /Pages /Kids [3 0 R] /Count 1 {pages} >>"), None),
+            (3, format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 420 220] {page} /Contents 4 0 R >>"), None),
+            (4, "<< >>".to_string(), Some(content.as_bytes().to_vec())),
+        ],
+        1,
+    )
+}
+
+/// The first page of `bytes` framed as After Effects places it.
+fn placed(bytes: &[u8]) -> Doc {
+    parse_page_framed(bytes, 0, Framing::Placed).unwrap()
+}
+
+/// #3099: After Effects 2026 places a .ai or PDF as footage by the page's ArtBox and shows only
+/// that region (a page with MediaBox 420 × 220, CropBox 410 × 210, TrimBox 380 × 180 and ArtBox
+/// [60 50 300.6 170.4] imports as 241 × 121). `Framing::Placed` frames it so; the viewer framing
+/// (the default, used by File ▸ Import) stays the CropBox.
+#[test]
+fn placed_framing_is_the_art_box() {
+    let bytes = boxes_pdf("/CropBox [5 5 415 215]", "/TrimBox [20 20 400 200] /ArtBox [60 50 300.6 170.4]");
+    let doc = placed(&bytes);
+    assert!((doc.width - 240.6).abs() < 1e-9 && (doc.height - 120.4).abs() < 1e-9, "{} × {}", doc.width, doc.height);
+    assert_eq!(doc.pixel_size(), (241, 121));
+    // The art box's top-left corner is the document's origin: the marker (PDF x 64..84, y 54..64)
+    // is at x 4..24, y 106.4..116.4 from the top.
+    let (w, h) = doc.pixel_size();
+    let img = effectcraft_svg::rasterize(&doc, w, h, 1.0);
+    let marker = img.get(10, 110);
+    assert!(marker[2] > 0.99 && marker[0] < 0.01, "{marker:?}");
+    assert!(img.get(30, 110)[2] < 0.6, "{:?}", img.get(30, 110));
+    let viewer = parse(&bytes).unwrap();
+    assert_eq!((viewer.width, viewer.height), (410.0, 210.0), "the viewer framing is unchanged");
+}
+
+/// The ArtBox is clipped to the crop box (ISO 32000-1 §14.11.2); one that keeps no area there,
+/// a degenerate or unreadable one, or one on the /Pages node (not inherited, table 30) leaves the
+/// crop box (else the media box).
+#[test]
+fn placed_framing_clips_the_art_box_and_falls_back() {
+    let size = |pages: &str, page: &str| {
+        let d = placed(&boxes_pdf(pages, page));
+        (d.width, d.height)
+    };
+    let crop = "/CropBox [5 5 415 215]";
+    assert_eq!(size(crop, "/ArtBox [-100 -100 1000 1000]"), (410.0, 210.0), "larger than the page");
+    assert_eq!(size(crop, "/ArtBox [300 100 900 900]"), (115.0, 115.0), "partly outside");
+    let (w, h) = size(crop, "/ArtBox [300.6 170.4 60 50]");
+    assert!((w - 240.6).abs() < 1e-9 && (h - 120.4).abs() < 1e-9, "corners in any order: {w} × {h}");
+    // Finite corners whose span is not.
+    let big = format!("1{}", "0".repeat(308));
+    let unreadable = [format!("/ArtBox [-{big} 50 {big} 170]")];
+    for page in ["/ArtBox [500 300 600 400]", "/ArtBox [60 50 60 170]", "/ArtBox [60 50 300]"].map(String::from).iter().chain(&unreadable) {
+        assert_eq!(size(crop, page), (410.0, 210.0), "{page}");
+    }
+    assert_eq!(size("/ArtBox [60 50 300 170]", ""), (420.0, 220.0), "an ArtBox on /Pages is not inherited");
+    // A crop box that is not a box leaves the media box.
+    assert_eq!(size("", &format!("/CropBox [-{big} 5 {big} 215]")), (420.0, 220.0));
+}
+
+/// After Effects ignores /Rotate on placed footage (a page [100 50 400 150] with /Rotate 90
+/// imports as 300 × 100, drawn unturned); the viewer framing turns it.
+#[test]
+fn placed_framing_ignores_rotate() {
+    let bytes = boxes_pdf("", "/Rotate 90");
+    let doc = placed(&bytes);
+    assert_eq!((doc.width, doc.height), (420.0, 220.0));
+    // Unturned: the marker at PDF (64..84, 54..64) is at x 64..84, y 156..166 from the top.
+    let img = effectcraft_svg::rasterize(&doc, 420, 220, 1.0);
+    assert!(img.get(70, 160)[2] > 0.99, "{:?}", img.get(70, 160));
+    let viewer = parse(&bytes).unwrap();
+    assert_eq!((viewer.width, viewer.height), (220.0, 420.0));
+}
+
 const EPS: &str = "%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\n\
 /m {moveto} bind def /l {lineto} bind def\n\
 /cm { 6 array astore concat } bind def\n\
@@ -1090,3 +1175,47 @@ fn retained_layers_preserve_artwork_beyond_the_bounds_depth_limit() {
     assert_eq!(cropped.pixel_size(), (120, 80), "unknown bounds keep the full page");
     assert_eq!(offset, [0.0, 0.0]);
 }
+
+#[test]
+fn cid_width_entries_at_the_top_of_the_cid_range_do_not_overflow() {
+    // A first CID of u32::MAX (larger values saturate to it) used to overflow `first + k` and `first + 65535`:
+    // a panic in debug builds; in release builds the list wrapped round to CID 0 and the range was dropped.
+    let load = |entry: &str| {
+        let type0 = "<< /Type /Font /Subtype /Type0 /BaseFont /X /Encoding /Identity-H /DescendantFonts [13 0 R] >>";
+        let desc = format!("<< /Type /Font /Subtype /CIDFontType2 {entry} >>");
+        let file = object::File::parse(&page_pdf("", "/Font << /F1 10 0 R >>", vec![(10, type0.into(), None), (13, desc, None)])).unwrap();
+        let d = file.objects.get(&(10, 0)).and_then(object::Obj::dict).unwrap();
+        font::Font::load(&file, d, &mut vec![])
+    };
+    let max = u32::MAX;
+    // c [w1 w2 ...]
+    let f = load("/W [4294967295 [500 600 700]]");
+    assert_eq!((f.width(max), f.width(0)), (0.5, 1.0));
+    // cfirst clast w
+    assert_eq!(load("/W [4294967295 4294967295 400]").width(max), 0.4);
+    // c [w1y vx vy ...]
+    let f = load("/W2 [4294967295 [1 2 3 4 5 6]]");
+    assert_eq!((f.vmetrics(max), f.vmetrics(0)), ((0.001, 0.002, 0.003), (-1.0, 0.5, 0.88)));
+    // cfirst clast w1y vx vy
+    assert_eq!(load("/W2 [4294967295 4294967295 1 2 3]").vmetrics(max), (0.001, 0.002, 0.003));
+}
+
+#[test]
+fn cmap_entries_at_the_top_of_the_code_range_do_not_overflow() {
+    // A bfrange array starting at code 0xFFFFFFFF and a cidrange mapping onto CID u32::MAX used to overflow
+    // `lo + k` and `c + (code - lo)`: a panic in debug builds, a wrap round to code / CID 0 in release builds.
+    let to_unicode = "beginbfrange <FFFFFFFF> <FFFFFFFF> [<0041> <0042>] endbfrange";
+    let encoding = "begincodespacerange <0000> <FFFF> endcodespacerange begincidrange <0000> <FFFF> 4294967295 endcidrange";
+    let objs: Objs = vec![
+        (10, "<< /Type /Font /Subtype /Type0 /Encoding 15 0 R /ToUnicode 14 0 R /DescendantFonts [13 0 R] >>".into(), None),
+        (13, "<< /Type /Font /Subtype /CIDFontType2 /W [0 [700 800] 4294967295 [500]] >>".into(), None),
+        (14, "<< >>".into(), Some(to_unicode.as_bytes().to_vec())),
+        (15, "<< /Type /CMap >>".into(), Some(encoding.as_bytes().to_vec())),
+    ];
+    let file = object::File::parse(&page_pdf("", "/Font << /F1 10 0 R >>", objs)).unwrap();
+    let d = file.objects.get(&(10, 0)).and_then(object::Obj::dict).unwrap();
+    let f = font::Font::load(&file, d, &mut vec![]);
+    assert_eq!((f.unicode(0xFFFF_FFFF), f.unicode(0)), ("A".to_string(), String::new()));
+    // Code 0 is CID u32::MAX; code 2 would be past it, so it falls back to CID 0 like an unmapped code.
+    assert_eq!((f.width(0), f.width(2)), (0.5, 0.7));
+}
diff --git a/crates/pdf/src/tests_groups.rs b/crates/pdf/src/tests/groups.rs
similarity index 99%
rename from crates/pdf/src/tests_groups.rs
rename to crates/pdf/src/tests/groups.rs
index ce928139f..14b6a4b09 100644
--- a/crates/pdf/src/tests_groups.rs
+++ b/crates/pdf/src/tests/groups.rs
@@ -1,8 +1,8 @@
 //! M13.12: transparency groups (isolated, knockout, group alpha) and soft masks on a group's
 //! combined result.
 
-use super::*;
 use crate::tests::{page_pdf, render};
+use crate::*;
 
 fn near(a: [f32; 4], b: [f32; 4]) -> bool {
     (0..4).all(|i| (a[i] - b[i]).abs() < 0.02)
diff --git a/crates/pdf/src/tests_import.rs b/crates/pdf/src/tests/import.rs
similarity index 88%
rename from crates/pdf/src/tests_import.rs
rename to crates/pdf/src/tests/import.rs
index b6a95859c..c7dcbee57 100644
--- a/crates/pdf/src/tests_import.rs
+++ b/crates/pdf/src/tests/import.rs
@@ -1,8 +1,8 @@
 //! M13.12: CCITT images in PDF pages, EPS text and parser robustness over truncated and
 //! corrupt inputs (generated fixtures).
 
-use super::*;
 use crate::tests::{coverage, page_pdf, render, shape_names};
+use crate::*;
 
 fn eps(body: &[u8]) -> Doc {
     let mut b = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 200 100\n".to_vec();
@@ -25,6 +25,55 @@ fn ink_x(img: &effectcraft_raster::Image) -> (i64, i64) {
     (x0, x1)
 }
 
+/// #955: EPS files that name their operators (`/mo /moveto load def`, as Illustrator's do),
+/// query the device and embed metadata read through a SubFileDecode filter draw their artwork.
+/// They imported as an empty layer.
+#[test]
+fn eps_with_aliased_operators_device_queries_and_embedded_data_draws() {
+    let square = "1 0 0 setrgbcolor 50 25 mo 150 25 li 150 75 li 50 75 li cp f\n";
+    let aliases = "/mo /moveto load def /li /lineto load def /cp /closepath load def /f /fill load def\n";
+    let doc = eps(format!("{aliases}{square}").as_bytes());
+    assert!(coverage(&render(&doc), 50, 25, 150, 75) > 4900.0, "aliased operators draw the square");
+    // Every operator that returns a value pushes it, so the stack stays aligned.
+    let queries = "mark currentflat currentscreen currentpagedevice currenthalftone currentblackgeneration \
+                   currentundercolorremoval currentcolortransfer currentsystemparams counttomark 13 eq /ok exch def cleartomark\n";
+    let doc = eps(format!("{aliases}{queries}ok {{ {square} }} if\n").as_bytes());
+    assert!(coverage(&render(&doc), 50, 25, 150, 75) > 4900.0, "device queries leave 13 values");
+    // Data up to the end-of-data string isn't run: its unbalanced brace would swallow the rest.
+    let data = "currentfile 0 (%END-OF-DATA) /SubFileDecode filter pop\n<x> { ( not PostScript\n%END-OF-DATA\n";
+    let doc = eps(format!("{aliases}{data}{square}").as_bytes());
+    assert!(coverage(&render(&doc), 50, 25, 150, 75) > 4900.0, "drawing after the embedded data");
+}
+
+#[test]
+fn eps_filter_on_a_string_source_does_not_skip_the_program() {
+    let square = "1 0 0 setrgbcolor 50 25 moveto 150 25 lineto 150 75 lineto 50 75 lineto closepath fill\n";
+    let img = "gsave 1 1 8 [1 0 0 1 0 0] (FF) /ASCIIHexDecode filter image grestore\n";
+    // Images aren't drawn yet, so this parses without `eps`'s nothing-skipped check.
+    let doc = parse(format!("%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 200 100\n{img}{square}").as_bytes()).unwrap();
+    assert_eq!(doc.skipped, ["image"]);
+    assert!(coverage(&render(&doc), 50, 25, 150, 75) > 4900.0, "drawing after an image read from a string");
+}
+
+/// A loaded operator runs that operator even after its name is redefined (the prolog idiom
+/// `/_m /moveto load def /moveto {… _m} def`), and an executable name bound with `cvx` runs what
+/// its name is bound to.
+#[test]
+fn eps_loaded_operators_and_executable_name_aliases() {
+    let saved = "/_m /moveto load def /moveto {_m} def 1 0 0 setrgbcolor 50 25 moveto 150 25 lineto 150 75 lineto 50 75 lineto closepath fill\n";
+    assert!(coverage(&render(&eps(saved.as_bytes())), 50, 25, 150, 75) > 4900.0, "a redefined moveto that calls the saved one");
+    let alias = "/sq {50 25 moveto 150 25 lineto 150 75 lineto 50 75 lineto closepath fill} def /y /sq cvx def 1 0 0 setrgbcolor y\n";
+    assert!(coverage(&render(&eps(alias.as_bytes())), 50, 25, 150, 75) > 4900.0, "an executable name bound to a procedure's name");
+}
+
+/// Each `exec` of the executable name `exec` runs the next one: the chain is cut off at the call
+/// depth instead of overflowing the stack.
+#[test]
+fn eps_exec_of_executable_names_stops_at_the_call_depth() {
+    let doc = parse(b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 200 100\n/exec cvx 99999 {dup} repeat exec\n").unwrap();
+    assert!(doc.skipped.iter().any(|s| s.contains("recursion limit")), "{:?}", doc.skipped);
+}
+
 #[test]
 fn eps_text_with_bundled_fonts_and_show_variants() {
     // Not embedded: drawn with the bundled stand-in, like the same text in a PDF.
diff --git a/crates/pdf/src/tests/reader.rs b/crates/pdf/src/tests/reader.rs
new file mode 100644
index 000000000..da5a0eab1
--- /dev/null
+++ b/crates/pdf/src/tests/reader.rs
@@ -0,0 +1,195 @@
+//! The shared object adapter preserves scalar references and bounds both tree and graph input.
+
+use crate::{Error, parse};
+
+fn document(extra: &str, tail: &[(u32, u16, String)]) -> Vec<u8> {
+    let content = "/GS gs 1 0 0 rg 0 0 20 10 re f";
+    let mut objects = vec![
+        (1, 0, format!("<< /Type /Catalog /Pages 2 0 R {extra} >>")),
+        (2, 0, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into()),
+        (3, 0, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 20 10] /Resources << /ExtGState << /GS << /ca 5 7 R >> >> >> /Contents 4 0 R >>".into()),
+        (4, 0, format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len())),
+        (5, 7, "0.25".into()),
+    ];
+    objects.extend_from_slice(tail);
+    let mut data = b"%PDF-1.7\n".to_vec();
+    let mut offsets = std::collections::BTreeMap::new();
+    for (number, generation, value) in objects {
+        offsets.insert(number, (data.len(), generation));
+        data.extend_from_slice(format!("{number} {generation} obj\n{value}\nendobj\n").as_bytes());
+    }
+    let xref = data.len();
+    let count = offsets.keys().last().copied().unwrap() + 1;
+    data.extend_from_slice(format!("xref\n0 {count}\n0000000000 65535 f \n").as_bytes());
+    for number in 1..count {
+        let entry = offsets.get(&number).map_or_else(|| "0000000000 65535 f \n".into(), |(offset, generation)| format!("{offset:010} {generation:05} n \n"));
+        data.extend_from_slice(entry.as_bytes());
+    }
+    data.extend_from_slice(format!("trailer\n<< /Size {count} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    data
+}
+
+#[test]
+fn a_nonzero_generation_scalar_keeps_the_drawing_opacity() {
+    let doc = parse(&document("", &[])).unwrap();
+    assert!(doc.skipped.is_empty(), "{:?}", doc.skipped);
+    let pixel = effectcraft_svg::rasterize(&doc, 20, 10, 1.0).get(10, 5);
+    assert!((pixel[0] - 0.25).abs() < 0.001 && (pixel[3] - 0.25).abs() < 0.001, "{pixel:?}");
+}
+
+#[test]
+fn a_long_cyclic_reference_graph_does_not_expand_recursively() {
+    let objects: Vec<_> = (10..1010).map(|id| (id, 0, format!("<< /Next {} 0 R >>", if id == 1009 { 10 } else { id + 1 }))).collect();
+    let plain = parse(&document("", &[])).unwrap();
+    let cyclic = parse(&document("/Extra 10 0 R", &objects)).unwrap();
+    assert_eq!(plain, cyclic);
+}
+
+#[test]
+fn excessive_inline_nesting_returns_an_error_instead_of_partial_art() {
+    let extra = format!("/Extra {}0{}", "[".repeat(80), "]".repeat(80));
+    let bytes = document(&extra, &[]);
+    // The shared parser rejects the catalog before the adapter's depth limit runs.
+    // Its Invalid result follows the existing NoPages mapping, with no partial document.
+    assert_eq!(crate::page_count(&bytes), 0);
+    assert_eq!(parse(&bytes), Err(Error::NoPages));
+}
+
+fn object_stream(entries: &[(u32, &str)]) -> String {
+    let (mut header, mut body) = (String::new(), String::new());
+    for (number, value) in entries {
+        header.push_str(&format!("{number} {} ", body.len()));
+        body.push_str(value);
+        body.push(' ');
+    }
+    let first = header.len();
+    let content = header + &body;
+    format!("<< /Type /ObjStm /N {} /First {first} /Length {} >>\nstream\n{content}\nendstream", entries.len(), content.len())
+}
+
+#[test]
+fn duplicate_unreferenced_compressed_objects_do_not_block_repair() {
+    let objects = vec![(20, 0, object_stream(&[(10, "<< /Value 1 >>"), (30, "null")])), (21, 0, object_stream(&[(30, "42")]))];
+    let doc = parse(&document("/Missing 10 0 R", &objects)).unwrap();
+    assert!(doc.skipped.iter().any(|warning| warning.contains("recovered PDF object from an object stream: 10 0")));
+    assert!(matches!(parse(&document("/Missing 30 0 R", &objects)), Err(Error::Read(message)) if message.contains("ambiguous recovered object 30")));
+}
+
+#[test]
+fn many_trailer_markers_with_unterminated_objects_do_not_rescan_the_file() {
+    // The encryption pre-scan lexes after every `trailer` marker. Unbounded, each unterminated
+    // string or dictionary here ran to the end of the file: about 10^11 bytes lexed (minutes),
+    // against 2 × 10^8 within the window. The markers sit in an unreferenced stream, so the
+    // file still opens as the plain document.
+    let junk = "trailer(trailer<<".repeat(25_000) + &" ".repeat(2 << 20);
+    let stream = (6, 0, format!("<< /Length {} >>\nstream\n{junk}\nendstream", junk.len()));
+    let plain = parse(&document("", &[])).unwrap();
+    assert_eq!(parse(&document("", &[stream])), Ok(plain));
+}
+
+#[test]
+fn a_classic_trailer_with_an_encrypt_entry_is_refused() {
+    let plain = String::from_utf8(document("", &[])).unwrap();
+    let encrypted = plain.replace("/Root 1 0 R >>", "/Root 1 0 R /Encrypt 9 0 R >>");
+    assert_ne!(encrypted, plain);
+    // Object 9 does not exist: the trailer pre-scan refuses the file before the shared parser runs.
+    assert_eq!(parse(encrypted.as_bytes()), Err(Error::Encrypted));
+}
+
+#[test]
+fn a_trailer_with_a_long_id_fits_the_window() {
+    // Two 128-byte file identifiers leave the trailer dictionary under 600 bytes, well inside the
+    // 4 KiB pre-scan window, so /Encrypt after them is read there.
+    let plain = String::from_utf8(document("", &[])).unwrap();
+    let id = format!("<{}>", "0123456789ABCDEF".repeat(16));
+    let with_id = plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R /ID [{id} {id}] >>"));
+    let encrypted = plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R /ID [{id} {id}] /Encrypt 9 0 R >>"));
+    let doc = parse(plain.as_bytes()).unwrap();
+    assert_eq!(parse(with_id.as_bytes()), Ok(doc));
+    assert_eq!(parse(encrypted.as_bytes()), Err(Error::Encrypted));
+}
+
+#[test]
+fn an_encrypt_entry_past_the_trailer_window_is_refused() {
+    // The filler pushes /Encrypt past the pre-scan's 4 KiB window. Object 9 does not exist, and the
+    // shared parser reads /Encrypt only as a dictionary, so it alone would open the file.
+    let plain = String::from_utf8(document("", &[])).unwrap();
+    let filler = "x".repeat(8 * 1024);
+    let long = plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R /Filler ({filler}) >>"));
+    let encrypted = plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R /Filler ({filler}) /Encrypt 9 0 R >>"));
+    let doc = parse(plain.as_bytes()).unwrap();
+    assert_eq!(parse(long.as_bytes()), Ok(doc));
+    assert_eq!(parse(encrypted.as_bytes()), Err(Error::Encrypted));
+}
+
+#[test]
+fn an_escaped_encrypt_entry_past_the_trailer_window_is_refused() {
+    // A name may write any byte as `#` and two hex digits, so these keys all read as /Encrypt and
+    // the past-the-window fallback refuses them. The decoys decode to other names and still open.
+    let plain = String::from_utf8(document("", &[])).unwrap();
+    let doc = parse(plain.as_bytes()).unwrap();
+    let filler = "x".repeat(8 * 1024);
+    let trailer = |key: &str| plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R /Filler ({filler}) {key} 9 0 R >>"));
+    for key in ["/Encr#79pt", "/#45#6E#63rypt", "/E#6e#63rypt"] {
+        assert_eq!(parse(trailer(key).as_bytes()), Err(Error::Encrypted), "{key}");
+    }
+    for decoy in ["/Encrypted", "/Encr#7Apt"] {
+        assert_eq!(parse(trailer(decoy).as_bytes()).as_ref(), Ok(&doc), "{decoy}");
+    }
+}
+
+#[test]
+fn a_hash_without_two_hex_digits_stays_in_a_name() {
+    // `#` escapes a byte only before two hex digits. Otherwise it and what follows stay as written,
+    // so none of these reads as `Encrypt`.
+    let name = |token: &str| String::from_utf8(crate::object::name_bytes(token.as_bytes()).collect()).unwrap();
+    assert_eq!(name("Encry#pt"), "Encry#pt");
+    assert_eq!(name("Encrypt#"), "Encrypt#");
+    assert_eq!(name("Encrypt#7"), "Encrypt#7");
+}
+
+#[test]
+fn an_encrypt_entry_after_a_window_cut_before_the_trailer_dictionary_is_refused() {
+    // The 4 KiB pre-scan window ends in the whitespace before the trailer dictionary (the lexer
+    // returns nothing) or between the two `<` of its `<<` (the lexer reads a hex string).
+    let plain = String::from_utf8(document("", &[])).unwrap();
+    let doc = parse(plain.as_bytes()).unwrap();
+    for pad in [4 * 1024, 4 * 1024 - 2] {
+        let spaced = plain.replace("trailer\n<<", &format!("trailer\n{}<<", " ".repeat(pad)));
+        let encrypted = spaced.replace("/Root 1 0 R >>", "/Root 1 0 R /Encrypt 9 0 R >>");
+        assert_eq!(parse(spaced.as_bytes()).as_ref(), Ok(&doc));
+        assert_eq!(parse(encrypted.as_bytes()), Err(Error::Encrypted));
+    }
+}
+
+#[test]
+fn a_key_cut_by_the_trailer_window_is_read_whole() {
+    // Spaces put the 4 KiB pre-scan window's end inside a trailer key, `inside` bytes into it. The
+    // `/Encrypt` of the decoy `/Encrypted` is not taken for the key, a real `/Encrypt` cut after
+    // `/Encryp` is still refused, and one ending exactly at the window's end is read there.
+    let plain = String::from_utf8(document("", &[])).unwrap();
+    let doc = parse(plain.as_bytes()).unwrap();
+    let window_end = plain.find("trailer").unwrap() + "trailer".len() + 4 * 1024;
+    let key_at = plain.find("/Root 1 0 R >>").unwrap() + "/Root 1 0 R ".len();
+    let trailer = |key: &str, inside: usize| {
+        let file = plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R {}{key} 9 0 R >>", " ".repeat(window_end - inside - key_at)));
+        assert!(file[window_end - inside..].starts_with(key), "{key}");
+        file
+    };
+    assert_eq!(parse(trailer("/Encrypted", 8).as_bytes()).as_ref(), Ok(&doc));
+    assert_eq!(parse(trailer("/Encrypt", 7).as_bytes()), Err(Error::Encrypted));
+    assert_eq!(parse(trailer("/Encrypt", 8).as_bytes()), Err(Error::Encrypted));
+}
+
+#[test]
+fn a_trailer_string_in_a_stream_does_not_refuse_a_later_encrypt_name() {
+    // A `trailer` marker in an unreferenced stream opens a string or array that runs on past the
+    // 4 KiB pre-scan window to an `Encrypt` name. The unbounded lexer read that object, not a
+    // trailer dictionary, so the past-the-window fallback does not refuse the file either.
+    let plain = parse(&document("", &[])).unwrap();
+    for (open, key) in [("(", "/Encrypt"), ("[", "/Encr#79pt")] {
+        let content = format!("trailer{open}{}{key} 9 0 R", "text ".repeat(1024));
+        let stream = (6, 0, format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()));
+        assert_eq!(parse(&document("", &[stream])).as_ref(), Ok(&plain), "{open}");
+    }
+}
diff --git a/crates/pdf/src/tests_shading.rs b/crates/pdf/src/tests/shading.rs
similarity index 99%
rename from crates/pdf/src/tests_shading.rs
rename to crates/pdf/src/tests/shading.rs
index 12ca2ff86..8e96193ab 100644
--- a/crates/pdf/src/tests_shading.rs
+++ b/crates/pdf/src/tests/shading.rs
@@ -1,7 +1,7 @@
 //! M13.12: function-based and mesh shadings (generated fixtures).
 
-use super::*;
 use crate::tests::{Objs, page_pdf, render};
+use crate::*;
 
 /// Mesh vertex data: 8-bit flags, 16-bit coordinates (Decode `[0 65535 0 65535 …]`, so raw
 /// values are page units) and 8-bit components.
diff --git a/crates/pdf/src/tests_reader.rs b/crates/pdf/src/tests_reader.rs
deleted file mode 100644
index 999a9900f..000000000
--- a/crates/pdf/src/tests_reader.rs
+++ /dev/null
@@ -1,76 +0,0 @@
-//! The shared object adapter preserves scalar references and bounds both tree and graph input.
-
-use crate::{Error, parse};
-
-fn document(extra: &str, tail: &[(u32, u16, String)]) -> Vec<u8> {
-    let content = "/GS gs 1 0 0 rg 0 0 20 10 re f";
-    let mut objects = vec![
-        (1, 0, format!("<< /Type /Catalog /Pages 2 0 R {extra} >>")),
-        (2, 0, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into()),
-        (3, 0, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 20 10] /Resources << /ExtGState << /GS << /ca 5 7 R >> >> >> /Contents 4 0 R >>".into()),
-        (4, 0, format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len())),
-        (5, 7, "0.25".into()),
-    ];
-    objects.extend_from_slice(tail);
-    let mut data = b"%PDF-1.7\n".to_vec();
-    let mut offsets = std::collections::BTreeMap::new();
-    for (number, generation, value) in objects {
-        offsets.insert(number, (data.len(), generation));
-        data.extend_from_slice(format!("{number} {generation} obj\n{value}\nendobj\n").as_bytes());
-    }
-    let xref = data.len();
-    let count = offsets.keys().last().copied().unwrap() + 1;
-    data.extend_from_slice(format!("xref\n0 {count}\n0000000000 65535 f \n").as_bytes());
-    for number in 1..count {
-        let entry = offsets.get(&number).map_or_else(|| "0000000000 65535 f \n".into(), |(offset, generation)| format!("{offset:010} {generation:05} n \n"));
-        data.extend_from_slice(entry.as_bytes());
-    }
-    data.extend_from_slice(format!("trailer\n<< /Size {count} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
-    data
-}
-
-#[test]
-fn a_nonzero_generation_scalar_keeps_the_drawing_opacity() {
-    let doc = parse(&document("", &[])).unwrap();
-    assert!(doc.skipped.is_empty(), "{:?}", doc.skipped);
-    let pixel = effectcraft_svg::rasterize(&doc, 20, 10, 1.0).get(10, 5);
-    assert!((pixel[0] - 0.25).abs() < 0.001 && (pixel[3] - 0.25).abs() < 0.001, "{pixel:?}");
-}
-
-#[test]
-fn a_long_cyclic_reference_graph_does_not_expand_recursively() {
-    let objects: Vec<_> = (10..1010).map(|id| (id, 0, format!("<< /Next {} 0 R >>", if id == 1009 { 10 } else { id + 1 }))).collect();
-    let plain = parse(&document("", &[])).unwrap();
-    let cyclic = parse(&document("/Extra 10 0 R", &objects)).unwrap();
-    assert_eq!(plain, cyclic);
-}
-
-#[test]
-fn excessive_inline_nesting_returns_an_error_instead_of_partial_art() {
-    let extra = format!("/Extra {}0{}", "[".repeat(80), "]".repeat(80));
-    let bytes = document(&extra, &[]);
-    // The shared parser rejects the catalog before the adapter's depth limit runs.
-    // Its Invalid result follows the existing NoPages mapping, with no partial document.
-    assert_eq!(crate::page_count(&bytes), 0);
-    assert_eq!(parse(&bytes), Err(Error::NoPages));
-}
-
-fn object_stream(entries: &[(u32, &str)]) -> String {
-    let (mut header, mut body) = (String::new(), String::new());
-    for (number, value) in entries {
-        header.push_str(&format!("{number} {} ", body.len()));
-        body.push_str(value);
-        body.push(' ');
-    }
-    let first = header.len();
-    let content = header + &body;
-    format!("<< /Type /ObjStm /N {} /First {first} /Length {} >>\nstream\n{content}\nendstream", entries.len(), content.len())
-}
-
-#[test]
-fn duplicate_unreferenced_compressed_objects_do_not_block_repair() {
-    let objects = vec![(20, 0, object_stream(&[(10, "<< /Value 1 >>"), (30, "null")])), (21, 0, object_stream(&[(30, "42")]))];
-    let doc = parse(&document("/Missing 10 0 R", &objects)).unwrap();
-    assert!(doc.skipped.iter().any(|warning| warning.contains("recovered PDF object from an object stream: 10 0")));
-    assert!(matches!(parse(&document("/Missing 30 0 R", &objects)), Err(Error::Read(message)) if message.contains("ambiguous recovered object 30")));
-}
diff --git a/crates/plugin/Cargo.toml b/crates/plugin/Cargo.toml
index 4081b61b6..d9b35a91a 100644
--- a/crates/plugin/Cargo.toml
+++ b/crates/plugin/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "effectcraft-plugin"
-description = "EffectCraft effect plug-ins: loads sandboxed WebAssembly effect modules (plug-in API v1) into the effect registry"
+description = "EffectCraft effect plug-ins: loads sandboxed WebAssembly effect modules (WebAssembly ABI v1 and v2) into the effect registry"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/plugin/src/lib.rs b/crates/plugin/src/lib.rs
index 829964378..da21e22a0 100644
--- a/crates/plugin/src/lib.rs
+++ b/crates/plugin/src/lib.rs
@@ -1,20 +1,25 @@
 //! # effectcraft-plugin (L3)
 //!
-//! Loads **WebAssembly effect plug-ins** (plug-in API v1, see `docs/plugins.md`) into the effect
-//! registry ([`effectcraft_effects::plugin`]). A plug-in is a `.wasm` (or `.wat`) module with
-//! no imports that exports:
+//! Loads **WebAssembly effect plug-ins** (WebAssembly ABI v1 and v2, see `docs/plugins.md`; the
+//! native plug-in API 2 additions such as layer parameters and host services are not part of it)
+//! into the effect registry ([`effectcraft_effects::plugin`]). A plug-in is a `.wasm` (or
+//! `.wat`) module with no imports that exports:
 //!
 //! | export | signature | |
 //! |---|---|---|
 //! | `memory` | memory | linear memory shared with the host |
-//! | `ec_api_version` | `() -> i32` | must return 1 |
+//! | `ec_api_version` | `() -> i32` | 1 for ABI 1, 2 for ABI 2 (neighbouring frames) |
 //! | `ec_manifest_ptr`, `ec_manifest_len` | `() -> i32` | a UTF-8 JSON [`PluginManifest`] in memory |
 //! | `ec_alloc` | `(bytes: i32) -> i32` | a buffer of at least `bytes` bytes, 8-byte aligned; it may reuse the previous one |
-//! | `ec_render` | `(pixels: i32, width: i32, height: i32, params: i32, nparams: i32, time: f64, scale: f64) -> i32` | process the pixels in place; 0 = ok |
+//! | `ec_render` (ABI 1) | `(pixels: i32, width: i32, height: i32, params: i32, nparams: i32, time: f64, scale: f64) -> i32` | process the pixels in place; 0 = ok |
+//! | `ec_render2` (ABI 2) | `ec_render`'s arguments, then `prev: i32, prev_time: f64, next: i32, next_time: f64, flags: i32` | the same, with the neighbouring frames; 0 = ok |
 //!
 //! For each render the host asks `ec_alloc` for one buffer holding the parameters (`nparams`
 //! little-endian `f64`s) followed by the pixels (`width × height × 4` little-endian `f32`s,
-//! premultiplied RGBA, row-major), calls `ec_render`, and reads the pixels back.
+//! premultiplied RGBA, row-major), calls the render export, and reads the pixels back. An ABI 2
+//! module gets two more pixel buffers after the current frame: the layer's previous and next
+//! frames, resampled onto the current grid, and their layer times. The buffers are always
+//! allocated (zeroed when a frame does not exist); `flags` bit 0/1 says which are real.
 //!
 //! Modules run in the [wasmi](https://github.com/wasmi-labs/wasmi) interpreter (pure Rust,
 //! MIT/Apache-2.0) with deterministic floats, no imports (no files, network or clock) and a
@@ -25,7 +30,9 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 use effectcraft_effects::EffectSpec;
-pub use effectcraft_effects::plugin::{EffectPlugin, PLUGIN_API_VERSION, PluginFrame, PluginManifest, PluginParams, register_plugin};
+pub use effectcraft_effects::plugin::{
+    EffectPlugin, MIN_WASM_API_VERSION, PLUGIN_API_VERSION, PluginFrame, PluginImage, PluginManifest, PluginParams, WASM_API_VERSION, register_plugin,
+};
 
 #[cfg(feature = "wasm")]
 mod wasm;
@@ -59,11 +66,53 @@ pub fn loader(bytes: &[u8], source: &str) -> Result<serde_json::Value, String> {
         "name": spec.name,
         "category": spec.category,
         "version": m.as_ref().map(|m| m.version.clone()).unwrap_or_default(),
-        "api": PLUGIN_API_VERSION,
+        "api": m.as_ref().map(|m| m.api).unwrap_or(PLUGIN_API_VERSION),
         "params": spec.params.len(),
     }))
 }
 
+/// Render a module's effect without registering it (the Plug-in Library's preview): default
+/// parameters, `pixels` (premultiplied RGBA, `width × height`) at each of `times` (seconds).
+/// Returns the manifest as JSON and one frame per time.
+pub fn preview(bytes: &[u8], width: u32, height: u32, pixels: &[[f32; 4]], times: &[f64]) -> Result<(serde_json::Value, Vec<Vec<[f32; 4]>>), String> {
+    #[cfg(feature = "wasm")]
+    {
+        use effectcraft_effects::plugin::{EffectPlugin, PluginFrame, PluginParamKind, PluginParams};
+        let p = wasm::WasmPlugin::new(bytes, "preview")?;
+        let m = p.manifest();
+        let mut flat = Vec::with_capacity(m.flat_len());
+        for param in &m.params {
+            match &param.kind {
+                PluginParamKind::Slider { default, .. } | PluginParamKind::Angle { default } => flat.push(*default),
+                PluginParamKind::Checkbox { default } => flat.push(if *default { 1.0 } else { 0.0 }),
+                PluginParamKind::Popup { default, .. } => flat.push(*default as f64),
+                // Points default to fractions of the layer: the frame is the layer.
+                PluginParamKind::Point { default } => flat.extend([default[0] * f64::from(width), default[1] * f64::from(height)]),
+                PluginParamKind::Color { default } => flat.extend(default.iter().copied()),
+                // API 2 kinds: a WebAssembly module can't declare them (`WasmPlugin::new` refuses them).
+                PluginParamKind::Point3 { default } => flat.extend(default.iter().copied()),
+                PluginParamKind::Layer => flat.push(-1.0),
+                PluginParamKind::Text { .. } | PluginParamKind::Hidden { .. } => {}
+            }
+        }
+        let params = PluginParams { manifest: m, flat: &flat, texts: &[] };
+        let mut frames = Vec::with_capacity(times.len());
+        for &t in times {
+            let mut px = pixels.to_vec();
+            let mut frame = PluginFrame { width, height, pixels: &mut px, scale: 1.0, origin: [0.0; 2], layer_size: [f64::from(width), f64::from(height)] };
+            p.render(&mut frame, &params, t)?;
+            frames.push(px);
+        }
+        let manifest = serde_json::to_value(m).map_err(|e| e.to_string())?;
+        Ok((manifest, frames))
+    }
+    #[cfg(not(feature = "wasm"))]
+    {
+        let _ = (bytes, width, height, pixels, times);
+        Err("WebAssembly plug-ins are not available in this build".into())
+    }
+}
+
 // Two attributes, so clippy sees `cfg(test)` and treats the module as test code.
 #[cfg(test)]
 #[cfg(feature = "wasm")]
diff --git a/crates/plugin/src/tests.rs b/crates/plugin/src/tests.rs
index f68fde00a..a4fadb26b 100644
--- a/crates/plugin/src/tests.rs
+++ b/crates/plugin/src/tests.rs
@@ -163,11 +163,15 @@ fn wasm_plugins_are_sandboxed() {
     // No imports (files, clock, network…).
     let imports = r#"(module (import "env" "now" (func $now (result f64))) (memory (export "memory") 1))"#;
     assert!(load_err(load_wasm(imports.as_bytes(), "imports.wat")).contains("import"));
-    // Garbage, wrong API version, bad manifests.
+    // Garbage, an ABI this build doesn't implement, bad manifests. A module that claims ABI 2
+    // must export `ec_render2` (this one still has only `ec_render`).
     assert!(load_wasm(b"\0asm nope", "bad.wasm").is_err());
     let v2 = gain_module("org.test.v2", "")
         .replace("(func (export \"ec_api_version\") (result i32) i32.const 1)", "(func (export \"ec_api_version\") (result i32) i32.const 2)");
-    assert!(load_err(load_wasm(v2.as_bytes(), "v2.wat")).contains("API 2"));
+    assert!(load_err(load_wasm(v2.as_bytes(), "v2.wat")).contains("ec_render2"));
+    let v3 = gain_module("org.test.v3", "")
+        .replace("(func (export \"ec_api_version\") (result i32) i32.const 1)", "(func (export \"ec_api_version\") (result i32) i32.const 3)");
+    assert!(load_err(load_wasm(v3.as_bytes(), "v3.wat")).contains("ABI 3"));
     let reserved = gain_module("ec.blur.mine", "");
     assert!(load_err(load_wasm(reserved.as_bytes(), "reserved.wat")).contains("reserved"));
 }
@@ -194,14 +198,14 @@ fn abi_violations_fail_to_load_with_reasons() {
     assert!(load_err(load_wasm(m.as_bytes(), "x.wat")).contains("ec_api_version"));
     let m = edit(&base, "(param $scale f64) (result i32)", "(param $scale f32) (result i32)");
     assert!(load_err(load_wasm(m.as_bytes(), "x.wat")).contains("ec_render"));
-    // API versions other than 1.
-    for v in ["0", "-1", "2147483647"] {
+    // WebAssembly ABIs other than 1 and 2.
+    for v in ["0", "-1", "3", "2147483647"] {
         let m = edit(
             &base,
             "(func (export \"ec_api_version\") (result i32) i32.const 1)",
             &format!("(func (export \"ec_api_version\") (result i32) i32.const {v})"),
         );
-        assert!(load_err(load_wasm(m.as_bytes(), "x.wat")).contains(&format!("API {v}")), "{v}");
+        assert!(load_err(load_wasm(m.as_bytes(), "x.wat")).contains(&format!("ABI {v}")), "{v}");
     }
     // Manifest out of bounds, negative or absurd lengths, not JSON.
     let ptr = "(func (export \"ec_manifest_ptr\") (result i32) i32.const 16)";
@@ -317,3 +321,168 @@ fn wasm_rendering_is_deterministic() {
     let twin = load_wasm(gain_module("org.test.det2", body).as_bytes(), "det2.wat").unwrap();
     assert_eq!(bits(&render(twin, 0.37, true)), first);
 }
+
+/// An ABI 2 module whose `ec_render2` writes what it got from the host into each pixel: red is
+/// |next.red − prev.red|, green `flags / 8`, blue `prev_time`, alpha 1.
+fn neighbour_module(id: &str) -> String {
+    let manifest = format!(r#"{{"api":2,"id":"{id}","name":"Neighbours {id}","category":"Test Plug-ins","version":"1","params":[]}}"#);
+    let len = manifest.len();
+    let escaped = manifest.replace('\\', "\\\\").replace('"', "\\\"");
+    format!(
+        r#"(module
+  (memory (export "memory") 2)
+  (data (i32.const 16) "{escaped}")
+  (func (export "ec_api_version") (result i32) i32.const 2)
+  (func (export "ec_manifest_ptr") (result i32) i32.const 16)
+  (func (export "ec_manifest_len") (result i32) i32.const {len})
+  (func (export "ec_alloc") (param i32) (result i32) i32.const 1024)
+  (func (export "ec_render2")
+    (param $px i32) (param $w i32) (param $h i32) (param $params i32) (param $np i32)
+    (param $t f64) (param $scale f64)
+    (param $prev i32) (param $prev_t f64) (param $next i32) (param $next_t f64) (param $flags i32)
+    (result i32)
+    (local $i i32) (local $n i32)
+    local.get $w
+    local.get $h
+    i32.mul
+    local.set $n
+    block $done
+      loop $per_pixel
+        local.get $i
+        local.get $n
+        i32.ge_u
+        br_if $done
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        local.get $next
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        f32.load
+        local.get $prev
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        f32.load
+        f32.sub
+        f32.abs
+        f32.store
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        local.get $flags
+        f32.convert_i32_s
+        f32.const 8
+        f32.div
+        f32.store offset=4
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        local.get $prev_t
+        f32.demote_f64
+        f32.store offset=8
+        local.get $px
+        local.get $i
+        i32.const 16
+        i32.mul
+        i32.add
+        f32.const 1
+        f32.store offset=12
+        local.get $i
+        i32.const 1
+        i32.add
+        local.set $i
+        br $per_pixel
+      end
+    end
+    i32.const 0))"#
+    )
+}
+
+fn neighbour_image(red: f32) -> effectcraft_effects::plugin::PluginImage {
+    effectcraft_effects::plugin::PluginImage { width: 2, height: 1, pixels: vec![[red, 0.0, 0.0, 1.0]; 2], origin: [0.0; 2], scale: 1.0 }
+}
+
+/// A host with frames at two layer times.
+struct Host {
+    time: f64,
+    fps: f64,
+    prev: Option<(f64, effectcraft_effects::plugin::PluginImage)>,
+    next: Option<(f64, effectcraft_effects::plugin::PluginImage)>,
+}
+
+impl effectcraft_effects::plugin::PluginHost for Host {
+    fn input_at(&self, layer_time: f64) -> Option<effectcraft_effects::plugin::PluginImage> {
+        if let Some((t, img)) = &self.prev
+            && (t - layer_time).abs() < 1e-9
+        {
+            return Some(img.clone());
+        }
+        if let Some((t, img)) = &self.next
+            && (t - layer_time).abs() < 1e-9
+        {
+            return Some(img.clone());
+        }
+        None
+    }
+
+    fn layer_input(&self, _param_id: &str, _layer_time: f64) -> Option<effectcraft_effects::plugin::PluginImage> {
+        None
+    }
+
+    fn params_at(&self, _layer_time: f64) -> Option<(Vec<f64>, Vec<String>)> {
+        None
+    }
+
+    fn frame_rate(&self) -> f64 {
+        self.fps
+    }
+
+    fn time(&self) -> f64 {
+        self.time
+    }
+}
+
+#[test]
+fn abi_v2_receives_neighbour_frames_and_times() {
+    load_wasm(neighbour_module("org.test.neighbours").as_bytes(), "neighbours.wat").unwrap();
+    let p = effectcraft_effects::plugin::plugin("org.test.neighbours").unwrap();
+    assert!(effectcraft_effects::plugin::reads_other_times("org.test.neighbours"));
+    assert!(effectcraft_effects::is_time_dependent("org.test.neighbours"));
+    // The module has no parameters, so the flattened vector is empty.
+    let params = effectcraft_effects::plugin::PluginParams { manifest: p.manifest(), flat: &[], texts: &[] };
+    let mut px = vec![[0.0f32; 4]; 2];
+    let host = Host { time: 0.5, fps: 4.0, prev: Some((0.25, neighbour_image(0.1))), next: Some((0.75, neighbour_image(0.6))) };
+    let mut frame = effectcraft_effects::plugin::PluginFrame { width: 2, height: 1, pixels: &mut px, scale: 1.0, origin: [0.0; 2], layer_size: [2.0, 1.0] };
+    p.render_v2(&mut frame, &params, 0.5, &host).unwrap();
+    assert!((px[0][0] - 0.5).abs() < 1e-6, "|next − prev|: {px:?}");
+    assert!((px[0][1] - 3.0 / 8.0).abs() < 1e-6, "both flags: {px:?}");
+    assert!((px[0][2] - 0.25).abs() < 1e-6, "previous frame's time: {px:?}");
+    assert_eq!(px[0][3], 1.0);
+}
+
+#[test]
+fn abi_v2_without_a_host_gets_zeroed_neighbours() {
+    let spec = load_wasm(neighbour_module("org.test.neighbours.empty").as_bytes(), "empty.wat").unwrap();
+    let mut next_id = 1;
+    let g = effectcraft_effects::instantiate(spec, &mut Ids(&mut next_id), spec.name, [2.0, 1.0]);
+    let params = effectcraft_effects::flatten_params(&g, &mut |p| p.value.clone());
+    let ctx = EffectCtx { params: &params, time: 0.5, layer_size: [2.0, 1.0], seed: 1, adjustment: false, env: EffectEnv::default() };
+    let buf = Buf { img: Image::filled(2, 1, [0.5, 0.5, 0.5, 1.0]), offset: [0.0; 2], scale: 1.0 };
+    // No host: both neighbour buffers are zeroed and no flag is set.
+    assert_eq!((spec.render)(&ctx, buf).img.get(0, 0), [0.0, 0.0, 0.0, 1.0]);
+    // ABI 1 plug-ins keep the time-independent behaviour.
+    let gain = load_wasm(gain_module("org.test.neighbours.v1", "").as_bytes(), "v1.wat").unwrap();
+    assert!(!effectcraft_effects::plugin::reads_other_times("org.test.neighbours.v1"));
+    assert!(!effectcraft_effects::is_time_dependent("org.test.neighbours.v1"));
+    assert!(gain.id.starts_with("org.test."));
+}
diff --git a/crates/plugin/src/wasm.rs b/crates/plugin/src/wasm.rs
index 1f61c6b44..499d57397 100644
--- a/crates/plugin/src/wasm.rs
+++ b/crates/plugin/src/wasm.rs
@@ -1,10 +1,11 @@
-//! The wasmi-backed [`EffectPlugin`] (plug-in API v1 ABI, see the crate docs).
+//! The wasmi-backed [`EffectPlugin`] (WebAssembly ABI v1 and v2, see the crate docs).
 
 use std::sync::Mutex;
 
 use wasmi::{Config, Engine, Instance, Linker, Memory, Module, Store, StoreLimits, StoreLimitsBuilder, TypedFunc, WasmParams, WasmResults};
 
-use crate::{EffectPlugin, PLUGIN_API_VERSION, PluginFrame, PluginManifest, PluginParams};
+use crate::{EffectPlugin, MIN_WASM_API_VERSION, PluginFrame, PluginManifest, PluginParams, WASM_API_VERSION};
+use effectcraft_effects::plugin::{PluginHost, PluginImage};
 
 /// Instruction budget per frame: a fixed allowance plus some per pixel. Generous for per-pixel
 /// work, but a runaway loop stops instead of hanging the render.
@@ -15,32 +16,74 @@ const MAX_MEMORY: usize = 1 << 30;
 /// The longest manifest read.
 const MAX_MANIFEST: i32 = 1 << 20;
 
+/// ABI 1: one buffer.
 type RenderFn = TypedFunc<(i32, i32, i32, i32, i32, f64, f64), i32>;
+/// ABI 2: the same call plus the previous and next frame buffers and their layer times.
+type Render2Fn = TypedFunc<(i32, i32, i32, i32, i32, f64, f64, i32, f64, i32, f64, i32), i32>;
+
+enum Renderer {
+    V1(RenderFn),
+    V2(Render2Fn),
+}
 
 /// One instantiated module (renders running on several threads each take their own).
 struct Inst {
+    store: Store<StoreLimits>,
+    memory: Memory,
+    alloc: TypedFunc<i32, i32>,
+    render: Renderer,
+}
+
+/// An instance whose ABI version (and so its render export) is not selected yet.
+struct Pending {
     store: Store<StoreLimits>,
     instance: Instance,
     memory: Memory,
     alloc: TypedFunc<i32, i32>,
-    render: RenderFn,
 }
 
-impl Inst {
+impl Pending {
+    /// A typed export by name, reporting a missing or mistyped export like [`missing`].
     fn func<P: WasmParams, R: WasmResults>(&self, name: &str) -> Result<TypedFunc<P, R>, String> {
         self.instance.get_typed_func::<P, R>(&self.store, name).map_err(|_| missing(name))
     }
+
+    /// Select the render export for `abi`.
+    fn finish(self, abi: u32) -> Result<Inst, String> {
+        let render = match abi {
+            1 => Renderer::V1(self.instance.get_typed_func::<_, i32>(&self.store, "ec_render").map_err(|_| missing("ec_render"))?),
+            2 => Renderer::V2(self.instance.get_typed_func::<_, i32>(&self.store, "ec_render2").map_err(|_| missing("ec_render2"))?),
+            v => return Err(unsupported(v as i32)),
+        };
+        Ok(Inst { store: self.store, memory: self.memory, alloc: self.alloc, render })
+    }
 }
 
+/// The error for a missing or mistyped export.
 fn missing(name: &str) -> String {
     format!("the module exports no `{name}` (or with the wrong signature)")
 }
 
+/// The error for an ABI this build does not implement.
+fn unsupported(v: i32) -> String {
+    format!("the module implements WebAssembly ABI {v}, this build implements ABI {MIN_WASM_API_VERSION} to {WASM_API_VERSION}")
+}
+
+/// The module's `ec_api_version`, when this build implements it.
+fn abi_of(v: i32) -> Result<u32, String> {
+    match u32::try_from(v) {
+        Ok(v) if (MIN_WASM_API_VERSION..=WASM_API_VERSION).contains(&v) => Ok(v),
+        _ => Err(unsupported(v)),
+    }
+}
+
+/// The error for a wasmi or trap failure.
 fn err(e: impl std::fmt::Display) -> String {
     e.to_string()
 }
 
-fn instantiate(engine: &Engine, module: &Module) -> Result<Inst, String> {
+/// Instantiate `module` in a fresh, limited store and read its memory and allocator.
+fn begin(engine: &Engine, module: &Module) -> Result<Pending, String> {
     let mut store = Store::new(engine, StoreLimitsBuilder::new().memory_size(MAX_MEMORY).instances(1).build());
     store.limiter(|l| l);
     store.set_fuel(FUEL_BASE).map_err(err)?;
@@ -48,14 +91,20 @@ fn instantiate(engine: &Engine, module: &Module) -> Result<Inst, String> {
     let instance = linker.instantiate_and_start(&mut store, module).map_err(|e| format!("instantiation failed: {e}"))?;
     let memory = instance.get_memory(&store, "memory").ok_or("the module exports no `memory`")?;
     let alloc = instance.get_typed_func::<i32, i32>(&store, "ec_alloc").map_err(|_| missing("ec_alloc"))?;
-    let render = instance.get_typed_func::<(i32, i32, i32, i32, i32, f64, f64), i32>(&store, "ec_render").map_err(|_| missing("ec_render"))?;
-    Ok(Inst { store, instance, memory, alloc, render })
+    Ok(Pending { store, instance, memory, alloc })
+}
+
+/// Instantiate `module` and select the render export for `abi`.
+fn instantiate(engine: &Engine, module: &Module, abi: u32) -> Result<Inst, String> {
+    begin(engine, module)?.finish(abi)
 }
 
 /// A loaded WebAssembly effect plug-in.
 pub struct WasmPlugin {
     manifest: PluginManifest,
     source: String,
+    /// The WebAssembly ABI the module implements (`ec_api_version`).
+    abi: u32,
     engine: Engine,
     module: Module,
     /// Idle instances.
@@ -63,6 +112,7 @@ pub struct WasmPlugin {
 }
 
 impl WasmPlugin {
+    /// Load `bytes` and its manifest; errors on imports, a bad manifest or a missing export.
     pub fn new(bytes: &[u8], source: &str) -> Result<WasmPlugin, String> {
         let mut config = Config::default();
         config.consume_fuel(true);
@@ -71,48 +121,42 @@ impl WasmPlugin {
         if let Some(i) = module.imports().next() {
             return Err(format!("plug-ins can't import anything (the module imports `{}.{}`)", i.module(), i.name()));
         }
-        let mut inst = instantiate(&engine, &module)?;
-        let version = inst.func::<(), i32>("ec_api_version")?;
-        let v = version.call(&mut inst.store, ()).map_err(err)?;
-        if v != PLUGIN_API_VERSION as i32 {
-            return Err(format!("the module implements plug-in API {v}, this build implements API {PLUGIN_API_VERSION}"));
-        }
-        let ptr = inst.func::<(), i32>("ec_manifest_ptr")?.call(&mut inst.store, ()).map_err(err)?;
-        let len = inst.func::<(), i32>("ec_manifest_len")?.call(&mut inst.store, ()).map_err(err)?;
+        let mut pending = begin(&engine, &module)?;
+        let version = pending.func::<(), i32>("ec_api_version")?;
+        let abi = abi_of(version.call(&mut pending.store, ()).map_err(err)?)?;
+        let ptr = pending.func::<(), i32>("ec_manifest_ptr")?.call(&mut pending.store, ()).map_err(err)?;
+        let len = pending.func::<(), i32>("ec_manifest_len")?.call(&mut pending.store, ()).map_err(err)?;
         if !(0..=MAX_MANIFEST).contains(&len) {
             return Err(format!("bad manifest length {len}"));
         }
         let mut text = vec![0u8; len as usize];
-        inst.memory.read(&inst.store, ptr as u32 as usize, &mut text).map_err(|e| format!("manifest out of bounds: {e}"))?;
+        pending.memory.read(&pending.store, ptr as u32 as usize, &mut text).map_err(|e| format!("manifest out of bounds: {e}"))?;
         let manifest: PluginManifest = serde_json::from_slice(&text).map_err(|e| format!("bad manifest JSON: {e}"))?;
         manifest.validate()?;
-        Ok(WasmPlugin { manifest, source: source.to_string(), engine, module, pool: Mutex::new(vec![inst]) })
+        if let Some(p) = manifest.params.iter().find(|p| p.kind.needs_v2()) {
+            return Err(format!("parameter `{}`: WebAssembly plug-ins use plug-in API 1 parameter types (no point3, layer, text or hidden)", p.id));
+        }
+        let inst = pending.finish(abi)?;
+        Ok(WasmPlugin { manifest, source: source.to_string(), abi, engine, module, pool: Mutex::new(vec![inst]) })
     }
 
+    /// An idle instance, or a fresh one when the pool is empty.
     fn take(&self) -> Result<Inst, String> {
         if let Some(i) = self.pool.lock().ok().and_then(|mut p| p.pop()) {
             return Ok(i);
         }
-        instantiate(&self.engine, &self.module)
+        instantiate(&self.engine, &self.module, self.abi)
     }
 
+    /// Return a working instance to the pool.
     fn give_back(&self, inst: Inst) {
         if let Ok(mut p) = self.pool.lock() {
             p.push(inst);
         }
     }
-}
 
-impl EffectPlugin for WasmPlugin {
-    fn manifest(&self) -> &PluginManifest {
-        &self.manifest
-    }
-
-    fn source(&self) -> String {
-        self.source.clone()
-    }
-
-    fn render(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64) -> Result<(), String> {
+    /// ABI 1: parameters, then the pixels; `ec_render`.
+    fn render_v1(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64) -> Result<(), String> {
         let n = frame.pixels.len();
         let params_bytes = params.flat.len() * 8;
         let total = params_bytes + n * 16;
@@ -127,25 +171,19 @@ impl EffectPlugin for WasmPlugin {
         for v in params.flat {
             buf.extend_from_slice(&v.to_le_bytes());
         }
-        for px in frame.pixels.iter() {
-            for c in px {
-                buf.extend_from_slice(&c.to_le_bytes());
-            }
-        }
+        push_pixels(&mut buf, frame.pixels);
         inst.memory.write(&mut inst.store, base, &buf).map_err(|e| format!("ec_alloc returned a buffer out of bounds: {e}"))?;
         let px_ptr = (base + params_bytes) as i32;
-        let r = inst
-            .render
-            .call(&mut inst.store, (px_ptr, frame.width as i32, frame.height as i32, base as i32, params.flat.len() as i32, time, frame.scale))
-            .map_err(|e| format!("ec_render trapped: {e}"));
+        let r = match &inst.render {
+            Renderer::V1(f) => f
+                .call(&mut inst.store, (px_ptr, frame.width as i32, frame.height as i32, base as i32, params.flat.len() as i32, time, frame.scale))
+                .map_err(|e| format!("ec_render trapped: {e}")),
+            Renderer::V2(_) => return Err("the module implements WebAssembly ABI 1 but exports ec_render2".into()),
+        };
         let r = match r {
             Ok(0) => {
                 inst.memory.read(&inst.store, base + params_bytes, &mut buf[params_bytes..]).map_err(err)?;
-                for (px, b) in frame.pixels.iter_mut().zip(buf[params_bytes..].as_chunks::<16>().0.iter()) {
-                    for (c, v) in px.iter_mut().zip(b.as_chunks::<4>().0.iter()) {
-                        *c = f32::from_le_bytes([v[0], v[1], v[2], v[3]]);
-                    }
-                }
+                read_pixels(&buf[params_bytes..], frame.pixels);
                 Ok(())
             }
             Ok(code) => Err(format!("ec_render returned error {code}")),
@@ -156,4 +194,170 @@ impl EffectPlugin for WasmPlugin {
         }
         r
     }
+
+    /// ABI 2: parameters, the current frame, then the previous and next frames; `ec_render2`.
+    /// The neighbour buffers are always allocated (zeroed when absent), so a module can read
+    /// both without a null check; `flags` says which hold real frames.
+    fn render_v2(
+        &self,
+        frame: &mut PluginFrame,
+        params: &PluginParams,
+        time: f64,
+        prev: Option<(f64, &PluginImage)>,
+        next: Option<(f64, &PluginImage)>,
+    ) -> Result<(), String> {
+        let n = frame.pixels.len();
+        let params_bytes = params.flat.len() * 8;
+        let frame_bytes = n * 16;
+        let total = params_bytes + frame_bytes * 3;
+        if total > i32::MAX as usize {
+            return Err("frame too large for a 32-bit plug-in".into());
+        }
+        let prev_px = prev.map(|(t, img)| (t, img.on_grid(frame.width, frame.height, frame.origin, frame.scale)));
+        let next_px = next.map(|(t, img)| (t, img.on_grid(frame.width, frame.height, frame.origin, frame.scale)));
+        let prev = prev_px.as_ref().filter(|(_, px)| px.len() == n);
+        let next = next_px.as_ref().filter(|(_, px)| px.len() == n);
+        let mut inst = self.take()?;
+        inst.store.set_fuel(FUEL_BASE + FUEL_PER_PIXEL * (n as u64 * 3)).map_err(err)?;
+        let base = inst.alloc.call(&mut inst.store, total as i32).map_err(err)? as u32 as usize;
+        let mut buf: Vec<u8> = Vec::with_capacity(total);
+        for v in params.flat {
+            buf.extend_from_slice(&v.to_le_bytes());
+        }
+        push_pixels(&mut buf, frame.pixels);
+        push_neighbour(&mut buf, prev, frame_bytes);
+        push_neighbour(&mut buf, next, frame_bytes);
+        inst.memory.write(&mut inst.store, base, &buf).map_err(|e| format!("ec_alloc returned a buffer out of bounds: {e}"))?;
+        let px_ptr = (base + params_bytes) as i32;
+        let prev_ptr = (base + params_bytes + frame_bytes) as i32;
+        let next_ptr = (base + params_bytes + frame_bytes * 2) as i32;
+        let flags = i32::from(prev.is_some()) | (i32::from(next.is_some()) << 1);
+        let prev_time = prev.map_or(0.0, |(t, _)| *t);
+        let next_time = next.map_or(0.0, |(t, _)| *t);
+        let r = match &inst.render {
+            Renderer::V2(f) => f
+                .call(
+                    &mut inst.store,
+                    (
+                        px_ptr,
+                        frame.width as i32,
+                        frame.height as i32,
+                        base as i32,
+                        params.flat.len() as i32,
+                        time,
+                        frame.scale,
+                        prev_ptr,
+                        prev_time,
+                        next_ptr,
+                        next_time,
+                        flags,
+                    ),
+                )
+                .map_err(|e| format!("ec_render2 trapped: {e}")),
+            Renderer::V1(_) => return Err("the module implements WebAssembly ABI 2 but exports ec_render".into()),
+        };
+        let r = match r {
+            Ok(0) => {
+                let mut out = vec![0u8; frame_bytes];
+                inst.memory.read(&inst.store, base + params_bytes, &mut out).map_err(err)?;
+                read_pixels(&out, frame.pixels);
+                Ok(())
+            }
+            Ok(code) => Err(format!("ec_render2 returned error {code}")),
+            Err(e) => Err(e),
+        };
+        if r.is_ok() {
+            self.give_back(inst);
+        }
+        r
+    }
+}
+
+/// Append pixels to the little-endian buffer the module reads.
+fn push_pixels(buf: &mut Vec<u8>, px: &[[f32; 4]]) {
+    for p in px {
+        for c in p {
+            buf.extend_from_slice(&c.to_le_bytes());
+        }
+    }
+}
+
+/// The neighbour's pixels, or `frame_bytes` zeroed bytes when there is no frame.
+fn push_neighbour(buf: &mut Vec<u8>, neighbour: Option<&(f64, Vec<[f32; 4]>)>, frame_bytes: usize) {
+    match neighbour {
+        Some((_, px)) => push_pixels(buf, px),
+        None => buf.resize(buf.len() + frame_bytes, 0),
+    }
+}
+
+/// Read the little-endian pixels the module wrote back.
+fn read_pixels(bytes: &[u8], pixels: &mut [[f32; 4]]) {
+    for (px, b) in pixels.iter_mut().zip(bytes.as_chunks::<16>().0.iter()) {
+        for (c, v) in px.iter_mut().zip(b.as_chunks::<4>().0.iter()) {
+            *c = f32::from_le_bytes([v[0], v[1], v[2], v[3]]);
+        }
+    }
+}
+
+/// The layer times of the frames around `time` on a `fps` grid: the frame before and after it
+/// at a frame boundary, the two frames that bracket it between frames.
+fn neighbour_times(time: f64, fps: f64) -> (f64, f64) {
+    if !fps.is_finite() || fps <= 0.0 {
+        return (time - 1.0 / 30.0, time + 1.0 / 30.0);
+    }
+    let step = 1.0 / fps;
+    let at = time * fps;
+    // Frame times are not exact in floating point: at NTSC rates `time * fps` often lands a few
+    // ulps above or below an integer. Treat a near-integer as a frame boundary, so the current
+    // frame is never handed back as its own neighbour.
+    if (at - at.round()).abs() < 1e-6 { (time - step, time + step) } else { (at.floor() / fps, at.ceil() / fps) }
+}
+
+impl EffectPlugin for WasmPlugin {
+    fn manifest(&self) -> &PluginManifest {
+        &self.manifest
+    }
+
+    fn source(&self) -> String {
+        self.source.clone()
+    }
+
+    fn reads_other_times(&self) -> bool {
+        self.abi >= 2
+    }
+
+    fn render(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64) -> Result<(), String> {
+        if self.abi == 1 { self.render_v1(frame, params, time) } else { self.render_v2(frame, params, time, None, None) }
+    }
+
+    fn render_v2(&self, frame: &mut PluginFrame, params: &PluginParams, time: f64, host: &dyn PluginHost) -> Result<(), String> {
+        if self.abi == 1 {
+            return self.render_v1(frame, params, time);
+        }
+        let (prev_time, next_time) = neighbour_times(time, host.frame_rate());
+        let prev = host.input_at(prev_time);
+        let next = host.input_at(next_time);
+        let prev = prev.as_ref().map(|img| (prev_time, img));
+        let next = next.as_ref().map(|img| (next_time, img));
+        self.render_v2(frame, params, time, prev, next)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::neighbour_times;
+
+    /// NTSC frame times do not multiply back exactly; every frame boundary must still get the
+    /// frames either side of it, never the frame itself.
+    #[test]
+    fn frame_boundaries_get_their_neighbours_at_ntsc_rates() {
+        let fps = 24000.0 / 1001.0;
+        for n in 0..2400 {
+            // 24000/1001 fps at 254 016 000 000 ticks/s, as `Tick` stores it.
+            let time = (n * 10_594_584_000_i64) as f64 / 254_016_000_000.0;
+            let (prev, next) = neighbour_times(time, fps);
+            assert!((prev - (time - 1.0 / fps)).abs() < 1e-9, "frame {n}: prev {prev}, current {time}");
+            assert!((next - (time + 1.0 / fps)).abs() < 1e-9, "frame {n}: next {next}, current {time}");
+        }
+    }
 }
diff --git a/crates/project/Cargo.toml b/crates/project/Cargo.toml
index 72d40db34..db11fea11 100644
--- a/crates/project/Cargo.toml
+++ b/crates/project/Cargo.toml
@@ -14,6 +14,7 @@ effectcraft-time = { workspace = true }
 effectcraft-geom = { workspace = true }
 effectcraft-color = { workspace = true }
 effectcraft-keyframe = { workspace = true }
+craft-ecproj-format = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
diff --git a/crates/project/src/build.rs b/crates/project/src/build.rs
index 935c03b0e..7a960dbfb 100644
--- a/crates/project/src/build.rs
+++ b/crates/project/src/build.rs
@@ -4,7 +4,7 @@ use effectcraft_color::{BlendMode, Label};
 use effectcraft_keyframe::{Gradient, ShapePath, TextDoc, Value};
 use effectcraft_time::Tick;
 
-use crate::props::{GroupKind, MaskMode, ParamUi, PropGroup, Property};
+use crate::props::{GroupKind, MaskMode, Node, ParamUi, PropGroup, Property};
 use crate::{Comp, Layer, LayerId, LayerSource, LightKind, Project, Switches};
 
 /// Id allocator borrowing the project's counter.
@@ -385,11 +385,18 @@ pub fn shape_group(ids: &mut Ids, name: &str, items: Vec<PropGroup>) -> PropGrou
 }
 
 pub fn shape_rect(ids: &mut Ids, size: [f64; 2], position: [f64; 2], roundness: f64) -> PropGroup {
+    // Per-corner radii start from the uniform Roundness, so ticking the box keeps the shape.
+    let r = if roundness.is_finite() { roundness.max(0.0) } else { 0.0 };
     indexed(ids.group("rect", "Rectangle Path 1"))
         .with(ids.prop("direction", "Path Direction", Value::Enum(0)).with_ui(ParamUi::Hidden))
         .with(ids.prop("size", "Size", Value::Vec2(size)).with_ui(ParamUi::Pixels))
         .with(ids.prop("position", "Position", Value::Vec2(position)).with_ui(ParamUi::Point))
         .with(ids.prop("roundness", "Roundness", Value::Scalar(roundness)).with_ui(ParamUi::Pixels))
+        .with(ids.prop("perCorner", "Per-Corner Roundness", Value::Bool(false)).with_ui(ParamUi::Checkbox))
+        .with(ids.prop("topLeftRoundness", "Top Left Roundness", Value::Scalar(r)).with_ui(ParamUi::Pixels))
+        .with(ids.prop("topRightRoundness", "Top Right Roundness", Value::Scalar(r)).with_ui(ParamUi::Pixels))
+        .with(ids.prop("bottomRightRoundness", "Bottom Right Roundness", Value::Scalar(r)).with_ui(ParamUi::Pixels))
+        .with(ids.prop("bottomLeftRoundness", "Bottom Left Roundness", Value::Scalar(r)).with_ui(ParamUi::Pixels))
 }
 
 pub fn shape_ellipse(ids: &mut Ids, size: [f64; 2], position: [f64; 2]) -> PropGroup {
@@ -594,7 +601,24 @@ pub fn shape_simple_op(ids: &mut Ids, kind: &str) -> Option<PropGroup> {
             .with(ids.prop("speed", "Wiggles/Second", Value::Scalar(2.0)))
             .with(ids.prop("correlation", "Correlation", Value::Scalar(50.0)).with_ui(ParamUi::Percent))
             .with(ids.prop("phase", "Temporal Phase", Value::Scalar(0.0)).with_ui(ParamUi::Angle))
+            .with(wiggle_spatial_phase(ids))
             .with(ids.prop("seed", "Random Seed", Value::Scalar(0.0))),
+        "wiggler" | "wiggleTransform" => {
+            // The Transform group holds how far each transformation wiggles.
+            let tr = ids
+                .group("transform", "Transform")
+                .with(ids.prop("anchor", "Anchor Point", Value::Vec2([0.0, 0.0])).with_ui(ParamUi::Point))
+                .with(ids.prop("position", "Position", Value::Vec2([0.0, 0.0])).with_ui(ParamUi::Point))
+                .with(ids.prop("scale", "Scale", Value::Vec2([0.0, 0.0])).with_ui(ParamUi::Percent))
+                .with(ids.prop("rotation", "Rotation", Value::Scalar(0.0)).with_ui(ParamUi::Angle));
+            indexed(ids.group("wiggler", "Wiggle Transform 1"))
+                .with(ids.prop("speed", "Wiggles/Second", Value::Scalar(2.0)))
+                .with(ids.prop("correlation", "Correlation", Value::Scalar(50.0)).with_ui(ParamUi::Percent))
+                .with(ids.prop("phase", "Temporal Phase", Value::Scalar(0.0)).with_ui(ParamUi::Angle))
+                .with(ids.prop("spatialPhase", "Spatial Phase", Value::Scalar(0.0)).with_ui(ParamUi::Angle))
+                .with(ids.prop("seed", "Random Seed", Value::Scalar(0.0)))
+                .with(tr)
+        }
         "merge" => indexed(ids.group("merge", "Merge Paths 1")).with(ids.prop("mode", "Mode", Value::Enum(0)).with_ui(popup(&[
             "Merge",
             "Add",
@@ -607,6 +631,32 @@ pub fn shape_simple_op(ids: &mut Ids, kind: &str) -> Option<PropGroup> {
     Some(g)
 }
 
+/// Wiggle Paths' Spatial Phase.
+fn wiggle_spatial_phase(ids: &mut Ids) -> Property {
+    ids.prop("spatialPhase", "Spatial Phase", Value::Scalar(0.0)).with_ui(ParamUi::Angle)
+}
+
+/// Adds the properties that shape path operations have gained since a project was saved (Wiggle
+/// Paths' Spatial Phase), at their defaults, to the operations in `contents` and its nested
+/// groups. Returns whether anything was added. It walks the nested groups with a work list and
+/// does not recurse.
+pub fn upgrade_shape_contents(ids: &mut Ids, contents: &mut PropGroup) -> bool {
+    let mut changed = false;
+    let mut todo = vec![contents];
+    while let Some(group) = todo.pop() {
+        for n in &mut group.children {
+            let Node::Group(g) = n else { continue };
+            if g.match_id == "wiggle" && !g.children.iter().any(|c| c.match_id() == "spatialPhase") {
+                let at = g.children.iter().position(|c| c.match_id() == "phase").map_or(g.children.len(), |i| i + 1);
+                g.children.insert(at, wiggle_spatial_phase(ids).into());
+                changed = true;
+            }
+            todo.push(g);
+        }
+    }
+    changed
+}
+
 // ---------------------------------------------------------------- camera / light / 3D
 
 pub fn camera_options(ids: &mut Ids, zoom: f64) -> PropGroup {
@@ -654,10 +704,16 @@ pub fn light_options(ids: &mut Ids, kind: LightKind) -> PropGroup {
     }
     if kind == LightKind::Environment {
         // The environment image: a layer (footage, comp…) mapped as an equirectangular panorama;
-        // none = the comp's Environment Layer.
+        // none = the comp's Environment Layer, or a flat default environment of the light's
+        // colour × intensity when there is none. No Falloff: an environment light shines from
+        // every direction at once. Environment lights cast shadows too (After Effects' Light
+        // Settings shows Cast Shadows for them; not for Ambient) (#2436).
         return g
             .with(ids.prop("source", "Source", Value::Layer(None)).with_ui(ParamUi::Layer))
-            .with(ids.prop("rotation", "Environment Rotation", Value::Scalar(0.0)).with_ui(ParamUi::Angle));
+            .with(ids.prop("rotation", "Environment Rotation", Value::Scalar(0.0)).with_ui(ParamUi::Angle))
+            .with(ids.prop("castsShadows", "Casts Shadows", Value::Bool(false)).with_ui(ParamUi::Checkbox))
+            .with(ids.prop("shadowDarkness", "Shadow Darkness", Value::Scalar(100.0)).with_ui(ParamUi::Percent))
+            .with(ids.prop("shadowDiffusion", "Shadow Diffusion", Value::Scalar(0.0)).with_ui(ParamUi::Pixels));
     }
     if kind != LightKind::Ambient {
         g = g
@@ -854,6 +910,14 @@ pub fn layer(project: &mut Project, comp: &Comp, name: &str, source: LayerSource
             _ => {}
         }
     }
+    // A footage layer starts with the markers its file carries (layer time is footage time).
+    let footage_markers = match &source {
+        LayerSource::Footage { item } => match project.item(*item).map(|i| &i.kind) {
+            Some(crate::ItemKind::Footage(f)) => f.markers.clone(),
+            _ => vec![],
+        },
+        _ => vec![],
+    };
     let has_audio = matches!(&source, LayerSource::Footage { item } if matches!(project.item(*item).map(|i| &i.kind), Some(crate::ItemKind::Footage(f)) if f.has_audio))
         || matches!(source, LayerSource::Comp { .. });
     if has_audio {
@@ -871,6 +935,7 @@ pub fn layer(project: &mut Project, comp: &Comp, name: &str, source: LayerSource
     Layer {
         id,
         name: comp.unique_layer_name(name),
+        name_follows_text: None,
         source,
         label,
         comment: String::new(),
@@ -883,7 +948,7 @@ pub fn layer(project: &mut Project, comp: &Comp, name: &str, source: LayerSource
         preserve_transparency: false,
         track_matte: None,
         parent: None,
-        markers: vec![],
+        markers: footage_markers,
         markers_locked: false,
         environment: false,
         environment_background: false,
diff --git a/crates/project/src/comp.rs b/crates/project/src/comp.rs
new file mode 100644
index 000000000..d8d7cda16
--- /dev/null
+++ b/crates/project/src/comp.rs
@@ -0,0 +1,536 @@
+use super::item::LayerId;
+use super::layer::{Layer, LayerSource};
+use super::settings::{Marker, yes};
+use super::{Deserialize, FrameRate, Node, PropGroup, Serialize, Tick, essential, styles};
+
+/// 3D renderer of a composition.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Renderer {
+    #[default]
+    Classic3D,
+    Advanced3D,
+}
+
+/// A composition's Resolution (the Composition panel's Resolution/Down Sample Factor popup, View ▸
+/// Resolution): how many of its pixels the viewer renders. Auto follows the magnification.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Resolution {
+    #[default]
+    Auto,
+    Full,
+    Half,
+    Third,
+    Quarter,
+    /// View ▸ Resolution ▸ Custom: render every n-th pixel (2..=40).
+    Custom(u8),
+}
+
+impl Resolution {
+    pub const ALL: [Resolution; 5] = [Resolution::Auto, Resolution::Full, Resolution::Half, Resolution::Third, Resolution::Quarter];
+    pub fn label(self) -> &'static str {
+        match self {
+            Resolution::Auto => "Auto",
+            Resolution::Full => "Full",
+            Resolution::Half => "Half",
+            Resolution::Third => "Third",
+            Resolution::Quarter => "Quarter",
+            Resolution::Custom(_) => "Custom",
+        }
+    }
+    pub fn is_auto(&self) -> bool {
+        *self == Resolution::Auto
+    }
+    /// The down-sample factor (render every n-th pixel); `None` for Auto.
+    pub fn factor(self) -> Option<u8> {
+        match self {
+            Resolution::Auto => None,
+            Resolution::Full => Some(1),
+            Resolution::Half => Some(2),
+            Resolution::Third => Some(3),
+            Resolution::Quarter => Some(4),
+            Resolution::Custom(n) => Some(n),
+        }
+    }
+    /// The resolution that renders every `n`-th pixel (1 = Full … 4 = Quarter; up to 40).
+    pub fn from_factor(n: u64) -> Resolution {
+        match n.clamp(1, 40) {
+            1 => Resolution::Full,
+            2 => Resolution::Half,
+            3 => Resolution::Third,
+            4 => Resolution::Quarter,
+            n => Resolution::Custom(n as u8),
+        }
+    }
+    /// Render scale for a viewer magnification (and display pixel density).
+    pub fn scale(self, zoom: f32, ppp: f32) -> f64 {
+        match self.factor() {
+            Some(n) => 1.0 / f64::from(n.clamp(1, 40)),
+            // As in After Effects, Auto renders the pixels the magnification needs: the coarsest
+            // whole factor that still gives every screen pixel a rendered one (Full above 50 %,
+            // Half down to 33.3 %, Third down to 25 %, Quarter below), never fewer (#417).
+            None => {
+                let n = (1.0 / (zoom * ppp) as f64 + 1e-3).floor();
+                if n >= 1.0 { 1.0 / n.min(4.0) } else { 1.0 }
+            }
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Comp {
+    pub width: u32,
+    pub height: u32,
+    pub pixel_aspect: f64,
+    pub frame_rate: FrameRate,
+    pub duration: Tick,
+    /// Start timecode/frame shown for time 0.
+    pub display_start: Tick,
+    pub background: [f32; 3],
+    pub work_area: (Tick, Tick),
+    /// Layer #1 first (top of the stack). Each layer is shared between undo states until edited.
+    pub layers: super::Layers,
+    #[serde(default)]
+    pub markers: Vec<Marker>,
+    pub shutter_angle: f64,
+    pub shutter_phase: f64,
+    /// Samples Per Frame: the minimum motion-blur samples (and the count for 3D layers).
+    pub motion_blur_samples: u32,
+    /// Adaptive Sample Limit (Composition Settings ▸ Advanced): the most samples a 2D layer gets
+    /// when it moves far within the shutter.
+    #[serde(default = "adaptive_limit_default")]
+    pub motion_blur_adaptive_limit: u32,
+    #[serde(default)]
+    pub renderer: Renderer,
+    /// Comp switches (timeline toolbar).
+    #[serde(default)]
+    pub hide_shy: bool,
+    #[serde(default = "yes")]
+    pub enable_motion_blur: bool,
+    #[serde(default = "yes")]
+    pub enable_frame_blending: bool,
+    #[serde(default)]
+    pub draft_3d: bool,
+    /// Composition Settings ▸ Advanced ▸ Preserve frame rate when nested or in render queue:
+    /// nested in another comp, or rendered at another rate, it shows only its own frames.
+    #[serde(default)]
+    pub preserve_frame_rate: bool,
+    /// Composition Settings ▸ Advanced ▸ Preserve resolution when nested: nested in a comp
+    /// previewed at a lower resolution, it still renders at full size.
+    #[serde(default)]
+    pub preserve_resolution: bool,
+    #[serde(default)]
+    pub poster_time: Tick,
+    /// Global Light for layer styles (Layer ▸ Layer Styles ▸ Blending Options).
+    #[serde(default)]
+    pub global_light: styles::GlobalLight,
+    /// Viewer guides (View ▸ Add Guide…), in comp pixels.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub guides: Vec<Guide>,
+    /// Essential Graphics: the controls this comp exposes to instances and templates.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub essential: Option<essential::EssentialGraphics>,
+    /// The Composition panel's Resolution, saved with the project as in After Effects. It changes
+    /// what the viewer renders, not the comp's pixels ([`Comp::same_pixels`]), and stays out of
+    /// the undo history.
+    #[serde(default, skip_serializing_if = "Resolution::is_auto")]
+    pub resolution: Resolution,
+}
+
+/// A viewer guide line: vertical guides sit at an x position, horizontal ones at a y position.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Guide {
+    pub vertical: bool,
+    /// Comp pixels, or percent of the comp's width (vertical) / height (horizontal) when
+    /// [`Guide::percent`] is set.
+    pub position: f64,
+    /// A percentage guide (After Effects 26.5): `position` is a percent of the comp's size, so the
+    /// guide keeps its relative place when the comp is resized. Absent in older projects.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub percent: bool,
+}
+
+impl Guide {
+    /// The comp's extent along this guide's axis, never zero.
+    fn extent(&self, width: u32, height: u32) -> f64 {
+        f64::from(if self.vertical { width } else { height }).max(1.0)
+    }
+
+    /// The guide's position in comp pixels for a comp of this size.
+    pub fn px(&self, width: u32, height: u32) -> f64 {
+        if self.percent { self.position / 100.0 * self.extent(width, height) } else { self.position }
+    }
+
+    /// Place the guide at `px` comp pixels, keeping its unit.
+    pub fn set_px(&mut self, px: f64, width: u32, height: u32) {
+        self.position = if self.percent { px / self.extent(width, height) * 100.0 } else { px };
+    }
+
+    /// Switch between pixels and percent without moving the guide on the comp.
+    pub fn set_percent(&mut self, percent: bool, width: u32, height: u32) {
+        let px = self.px(width, height);
+        self.percent = percent;
+        self.set_px(px, width, height);
+    }
+}
+
+fn adaptive_limit_default() -> u32 {
+    128
+}
+
+impl Comp {
+    pub fn new(width: u32, height: u32, frame_rate: FrameRate, duration: Tick) -> Comp {
+        Comp {
+            width,
+            height,
+            pixel_aspect: 1.0,
+            frame_rate,
+            duration,
+            display_start: Tick::ZERO,
+            background: [0.0, 0.0, 0.0],
+            work_area: (Tick::ZERO, duration),
+            layers: super::Layers::new(),
+            markers: vec![],
+            shutter_angle: 180.0,
+            shutter_phase: -90.0,
+            motion_blur_samples: 16,
+            motion_blur_adaptive_limit: 128,
+            renderer: Renderer::Classic3D,
+            hide_shy: false,
+            enable_motion_blur: true,
+            enable_frame_blending: true,
+            draft_3d: false,
+            preserve_frame_rate: false,
+            preserve_resolution: false,
+            poster_time: Tick::ZERO,
+            guides: vec![],
+            global_light: styles::GlobalLight::default(),
+            essential: None,
+            resolution: Resolution::Auto,
+        }
+    }
+
+    /// Whether the composition has a frame at its time `t`: nested, it shows nothing before it
+    /// starts or after it ends (a precomp layer trimmed or remapped past it).
+    pub fn covers(&self, t: Tick) -> bool {
+        t >= Tick::ZERO && t < self.duration
+    }
+
+    /// A new, empty composition with this one's settings (frame rate, pixel aspect, background,
+    /// motion blur, frame blending and the 3D renderer), as Pre-compose makes.
+    pub fn nested_like(&self, width: u32, height: u32, duration: Tick) -> Comp {
+        Comp {
+            pixel_aspect: self.pixel_aspect,
+            background: self.background,
+            shutter_angle: self.shutter_angle,
+            shutter_phase: self.shutter_phase,
+            motion_blur_samples: self.motion_blur_samples,
+            motion_blur_adaptive_limit: self.motion_blur_adaptive_limit,
+            renderer: self.renderer,
+            enable_motion_blur: self.enable_motion_blur,
+            enable_frame_blending: self.enable_frame_blending,
+            preserve_frame_rate: self.preserve_frame_rate,
+            preserve_resolution: self.preserve_resolution,
+            ..Comp::new(width, height, self.frame_rate, duration)
+        }
+    }
+
+    pub fn layer(&self, id: LayerId) -> Option<&Layer> {
+        self.layers.iter().find(|l| l.id == id)
+    }
+
+    pub fn layer_mut(&mut self, id: LayerId) -> Option<&mut Layer> {
+        self.layers.find_mut(|l| l.id == id)
+    }
+
+    /// 1-based layer number (#) of a layer.
+    pub fn index_of(&self, id: LayerId) -> Option<usize> {
+        self.layers.iter().position(|l| l.id == id).map(|i| i + 1)
+    }
+
+    pub fn layer_by_name(&self, name: &str) -> Option<&Layer> {
+        self.layers.iter().find(|l| l.name == name)
+    }
+
+    pub fn frame_duration(&self) -> Tick {
+        self.frame_rate.frame_duration()
+    }
+
+    /// Any 3D layer present (camera/lights or a 3D switch).
+    pub fn has_3d(&self) -> bool {
+        self.layers.iter().any(|l| l.switches.three_d || matches!(l.source, LayerSource::Camera | LayerSource::Light { .. }))
+    }
+
+    /// The active camera at `t`: the topmost enabled camera layer active at that time.
+    pub fn active_camera(&self, t: Tick) -> Option<&Layer> {
+        self.layers.iter().find(|l| matches!(l.source, LayerSource::Camera) && l.switches.video && l.is_active_at(t))
+    }
+
+    /// `base`, or the next free numbered name when a layer already has it (`Shape Layer 2`,
+    /// `v-b1.mp4 2`; see `numbered_name`).
+    pub fn unique_layer_name(&self, base: &str) -> String {
+        let taken = |n: &str| self.layers.iter().any(|l| l.name == n);
+        if taken(base) { crate::item::numbered_name(base, taken) } else { base.to_string() }
+    }
+}
+
+/// A protected time marker with a duration sets the comp's timing (Responsive Design), so it is
+/// part of the pixels even where plain markers are not.
+fn is_timing_marker(m: &Marker) -> bool {
+    m.protected && m.duration > Tick::ZERO
+}
+
+fn timing_markers(m: &[Marker]) -> impl Iterator<Item = (Tick, Tick)> + '_ {
+    m.iter().filter(|m| is_timing_marker(m)).map(|m| (m.time, m.duration))
+}
+
+impl Comp {
+    /// Draws the same pixels as `o`: equal but for its layers' Lock and Shy switches, Hide Shy
+    /// Layers, the viewer's Resolution, the work area (a preview and render range only) and, as
+    /// nothing draws their audio, its layers' Audio switches, Audio groups and audio effects.
+    pub fn same_pixels(&self, o: &Comp) -> bool {
+        self.same_pixels_with(o, true, &|_| false)
+    }
+
+    /// [`Self::same_pixels`], with the comp's and its layers' markers counting only when
+    /// `with_markers`: only expressions read them, so while none does, adding or moving a marker
+    /// (even during playback) leaves every rendered frame valid. Protected time markers with a
+    /// duration set the timing (Responsive Design), so those always count. A layer's audio counts
+    /// when `heard` says something draws it ([`crate::Project::heard_layers`]).
+    pub fn same_pixels_with(&self, o: &Comp, with_markers: bool, heard: &dyn Fn(LayerId) -> bool) -> bool {
+        self.same_settings(o, with_markers)
+            && self.layers.len() == o.layers.len()
+            && self.layers.iter().zip(&o.layers).all(|(a, b)| a.same_pixels_with(b, with_markers, heard(a.id)))
+    }
+
+    /// [`Self::same_pixels_with`] but for the layers.
+    fn same_settings(&self, o: &Comp, with_markers: bool) -> bool {
+        // Every field (no `..`: a new field must be considered here).
+        let Comp {
+            width,
+            height,
+            pixel_aspect,
+            frame_rate,
+            duration,
+            display_start,
+            background,
+            work_area: _,
+            layers: _,
+            markers,
+            shutter_angle,
+            shutter_phase,
+            motion_blur_samples,
+            motion_blur_adaptive_limit,
+            renderer,
+            hide_shy: _,
+            enable_motion_blur,
+            enable_frame_blending,
+            draft_3d,
+            preserve_frame_rate,
+            preserve_resolution,
+            poster_time,
+            global_light,
+            guides,
+            essential,
+            resolution: _,
+        } = self;
+        *width == o.width
+            && *height == o.height
+            && *pixel_aspect == o.pixel_aspect
+            && *frame_rate == o.frame_rate
+            && *duration == o.duration
+            && *display_start == o.display_start
+            && *background == o.background
+            && (if with_markers { *markers == o.markers } else { timing_markers(markers).eq(timing_markers(&o.markers)) })
+            && *shutter_angle == o.shutter_angle
+            && *shutter_phase == o.shutter_phase
+            && *motion_blur_samples == o.motion_blur_samples
+            && *motion_blur_adaptive_limit == o.motion_blur_adaptive_limit
+            && *renderer == o.renderer
+            && *enable_motion_blur == o.enable_motion_blur
+            && *enable_frame_blending == o.enable_frame_blending
+            && *draft_3d == o.draft_3d
+            && *preserve_frame_rate == o.preserve_frame_rate
+            && *preserve_resolution == o.preserve_resolution
+            && *poster_time == o.poster_time
+            && *global_light == o.global_light
+            && *guides == o.guides
+            && *essential == o.essential
+    }
+
+    /// The comp-time spans where `self` may draw other pixels than `o` after an edit of some of
+    /// its layers (moved, trimmed, split, edited, added, removed): where the active layers differ
+    /// or a changed one draws differently, widened by the shutter. A trim reaches only the part it
+    /// cut, a split only the copy's half (#1641). A layer that reads a changed one (its parent,
+    /// track matte, a layer it picks in an effect or tracker) draws differently wherever it is
+    /// active, and so does a layer with an expression that may read other layers or items when anything
+    /// changed: here or, `elsewhere`, outside these layers (markers, layers that draw nothing,
+    /// other comps and items). `None` when the edit can reach any frame: a comp setting, a layer
+    /// reorder, Solo turning on or off, an environment layer. A layer's audio counts when `heard`
+    /// says something draws it, a layer's markers when `with_markers`. `touched` layers draw differently in spans the caller adds (a
+    /// precomp whose comp changed): they reach the layers that read them, not their own frames.
+    pub fn changed_spans(
+        &self,
+        o: &Comp,
+        with_markers: bool,
+        heard: &dyn Fn(LayerId) -> bool,
+        elsewhere: bool,
+        touched: &[LayerId],
+    ) -> Option<Vec<(Tick, Tick)>> {
+        // An expression that may read outside its own layer: it names another comp, layer,
+        // footage, the project or its precomp's source, or its layer's `index` (a layer added or
+        // removed above shifts it). Its parent and the layers it picks in an effect are read
+        // through `referenced_layers` below.
+        // ponytail: text heuristic; misses another layer reached through a variable from a call
+        // without those words. Upgrade: record reads in the expression host.
+        fn reads_outside(g: &PropGroup) -> bool {
+            g.children.iter().any(|c| match c {
+                Node::Prop(p) => p.expr.as_ref().is_some_and(|e| {
+                    let t = e.text.to_lowercase().replace("thislayer", "");
+                    ["comp", "layer", "footage", "project", "source", "index"].iter().any(|w| t.contains(w))
+                }),
+                Node::Group(g) => reads_outside(g),
+            })
+        }
+        fn any_expression(g: &PropGroup) -> bool {
+            g.children.iter().any(|c| match c {
+                Node::Prop(p) => p.expr.is_some(),
+                Node::Group(g) => any_expression(g),
+            })
+        }
+        // Solo hides every other layer at every frame. (Comp markers count through `elsewhere`:
+        // an expression reading them names `thisComp`.)
+        if !self.same_settings(o, false) || self.any_solo() != o.any_solo() {
+            return None;
+        }
+        let common = |a: &Comp, b: &Comp| a.layers.iter().map(|l| l.id).filter(|id| b.layer(*id).is_some()).collect::<Vec<_>>();
+        if common(self, o) != common(o, self) {
+            return None;
+        }
+        // Changed, added or removed layers (each from both sides: its old and its new span), and
+        // those that draw the same apart from their span (a trim or split). Ids count: they seed
+        // randomness (noise, text randomisers), so a split's copy may draw differently.
+        let mut changed = Vec::new();
+        let mut respanned = Vec::new();
+        let mut keyed = Vec::new();
+        let mut cuts = Vec::new();
+        for (l, other) in self.layers.iter().map(|l| (l, o.layer(l.id))).chain(o.layers.iter().map(|l| (l, self.layer(l.id)))) {
+            if other.is_some_and(|b| l.same_pixels_with(b, with_markers, heard(l.id))) {
+                continue;
+            }
+            if l.environment || l.environment_background {
+                return None;
+            }
+            // (an expression on the layer can read its own in and out points and name, `inPoint`,
+            // `thisLayer.name`: then a trim or rename reaches all of it)
+            if let Some(b) = other
+                && !any_expression(&l.props)
+                && !any_expression(&b.props)
+                && (Layer { in_point: b.in_point, out_point: b.out_point, name: b.name.clone(), label: b.label, comment: b.comment.clone(), ..l.clone() })
+                    .same_pixels_with(b, with_markers, heard(l.id))
+            {
+                respanned.push(l.id);
+            } else if let Some(b) = other
+                && let Some(spans) = l.keyframe_spans(b, with_markers, heard(l.id))
+            {
+                // (drawn the same outside the keys it changed)
+                respanned.push(l.id);
+                keyed.extend(spans);
+            }
+            changed.push(l.id);
+            cuts.extend([l.in_point, l.out_point]);
+        }
+        // The layers the change reaches besides: expressions, then whatever reads a reached layer.
+        let both = || self.layers.iter().chain(&o.layers);
+        let mut reached: Vec<LayerId> = Vec::new();
+        if !changed.is_empty() || elsewhere || !touched.is_empty() {
+            reached.extend(both().filter(|l| reads_outside(&l.props)).map(|l| l.id));
+        }
+        // (each pass adds a layer or stops: at most one pass per layer)
+        loop {
+            let read = |l: &&Layer| {
+                !reached.contains(&l.id)
+                    && l.referenced_layers().iter().any(|r| *r != l.id && (changed.contains(r) || reached.contains(r) || touched.contains(r)))
+            };
+            let more: Vec<LayerId> = both().filter(read).map(|l| l.id).collect();
+            if more.is_empty() {
+                break;
+            }
+            reached.extend(more);
+        }
+        reached.sort_unstable();
+        reached.dedup();
+        for l in both().filter(|l| reached.contains(&l.id)) {
+            if l.environment || l.environment_background {
+                return None;
+            }
+            cuts.extend([l.in_point, l.out_point]);
+        }
+        let (before, after) = self.shutter_margin();
+        // Between two cuts the same layers are active; outside them no changed layer is.
+        cuts.sort_unstable();
+        cuts.dedup();
+        let draws_same = |l: &Layer| (!changed.contains(&l.id) || respanned.contains(&l.id)) && !reached.contains(&l.id);
+        let spans = cuts
+            .windows(2)
+            .filter_map(|w| {
+                let (&s, &e) = (w.first()?, w.last()?);
+                let active = |c: &Comp| c.layers.iter().filter(|l| l.is_active_at(s)).map(|l| l.id).collect::<Vec<_>>();
+                let same = active(self) == active(o) && self.layers.iter().filter(|l| l.is_active_at(s)).all(draws_same);
+                (!same).then(|| (s - before, e + after))
+            })
+            .chain(keyed.into_iter().map(|(s, e)| (s - before, e + after)))
+            .collect();
+        Some(spans)
+    }
+
+    /// How far a change at a time reaches the frames before and after it through the shutter: a
+    /// frame at `t` samples cameras, lights and transforms over its shutter,
+    /// `t + (phase + angle * 0..=1) / 360` frames, and draws the layers active at `t` itself.
+    pub fn shutter_margin(&self) -> (Tick, Tick) {
+        let (a, p) = (self.shutter_angle / 360.0, self.shutter_phase / 360.0);
+        let fd = self.frame_duration().seconds();
+        (Tick::from_seconds_f64(p.max(p + a).max(0.0) * fd), Tick::from_seconds_f64(-p.min(p + a).min(0.0) * fd))
+    }
+
+    /// Some layer is soloed: only the soloed layers draw.
+    pub fn any_solo(&self) -> bool {
+        self.layers.iter().any(|l| l.switches.solo && l.source.is_av())
+    }
+
+    /// The comp with those switches, the Resolution and the work area at their defaults (borrowed
+    /// when they already are), for keys that hash the whole comp.
+    pub fn pixel_form(&self) -> std::borrow::Cow<'_, Comp> {
+        self.pixel_form_with(true, &|_| false)
+    }
+
+    /// [`Self::pixel_form`], also without the comp's plain markers and its layers' markers when not
+    /// `with_markers` (see [`Self::same_pixels_with`] and [`Project::reads_markers`]), and with the
+    /// audio of the layers `heard` doesn't name at its defaults ([`Layer::picture_form`]).
+    pub fn pixel_form_with(&self, with_markers: bool, heard: &dyn Fn(LayerId) -> bool) -> std::borrow::Cow<'_, Comp> {
+        let pictures: Vec<Option<Layer>> = self.layers.iter().map(|l| l.picture_form(heard(l.id))).collect();
+        if !self.hide_shy
+            && self.resolution.is_auto()
+            && self.work_area == (Tick::ZERO, Tick::ZERO)
+            && pictures.iter().all(Option::is_none)
+            && (with_markers || (self.markers.iter().all(is_timing_marker) && self.layers.iter().all(|l| l.markers.is_empty())))
+        {
+            return std::borrow::Cow::Borrowed(self);
+        }
+        let mut c = self.clone();
+        c.hide_shy = false;
+        c.resolution = Resolution::Auto;
+        c.work_area = (Tick::ZERO, Tick::ZERO);
+        if !with_markers {
+            c.markers.retain(is_timing_marker);
+        }
+        for (l, picture) in c.layers.iter_mut().zip(pictures) {
+            if let Some(p) = picture {
+                *l = p;
+            }
+            if !with_markers {
+                l.markers.clear();
+            }
+        }
+        std::borrow::Cow::Owned(c)
+    }
+}
diff --git a/crates/project/src/dirty.rs b/crates/project/src/dirty.rs
new file mode 100644
index 000000000..a83ca35d9
--- /dev/null
+++ b/crates/project/src/dirty.rs
@@ -0,0 +1,112 @@
+//! Which frames of a comp an edit can change: frame caches keep the others.
+
+use super::comp::Comp;
+use super::item::{Heard, ItemId};
+use super::layer::{Layer, LayerSource, reads_other_frames};
+use super::{Arc, GroupKind, Node, Project, Tick};
+
+/// Precomps nested deeper than this count as changed wherever they show.
+const MAX_DEPTH: usize = 32;
+
+type Seen = std::collections::HashMap<ItemId, Option<Vec<(Tick, Tick)>>>;
+
+impl Project {
+    /// The comp-time spans of `comp` where `self` may draw other pixels than `old` (the project
+    /// before an edit): [`Comp::changed_spans`] of its layers, and for a precomp whose comp
+    /// changed, the spans that comp changed in, where the precomp shows them (#1641). Layers that
+    /// can't change the picture ([`Project::silent_layers`]) don't count, nor does the audio of
+    /// layers no effect draws it from (`heard`, best of both states). Expressions can read
+    /// anything, so any change (`outside` these comps too: another comp, an item's name) reaches
+    /// the layers that have one. `None` when the edit can reach any frame.
+    pub fn dirty_spans(&self, old: &Project, comp: ItemId, heard: &Heard, outside: bool) -> Option<Vec<(Tick, Tick)>> {
+        self.dirty_spans_at(old, comp, heard, outside, 0, &mut std::collections::HashMap::new())
+    }
+
+    /// `seen`: the spans of the comps already walked in this call, so a precomp shared by many
+    /// layers is walked once.
+    fn dirty_spans_at(&self, old: &Project, comp: ItemId, heard: &Heard, outside: bool, depth: usize, seen: &mut Seen) -> Option<Vec<(Tick, Tick)>> {
+        if depth > MAX_DEPTH {
+            return None;
+        }
+        if let Some(spans) = seen.get(&comp) {
+            return spans.clone();
+        }
+        let spans = self.comp_dirty_spans(old, comp, heard, outside, depth, seen);
+        seen.insert(comp, spans.clone());
+        spans
+    }
+
+    fn comp_dirty_spans(&self, old: &Project, comp: ItemId, heard: &Heard, outside: bool, depth: usize, seen: &mut Seen) -> Option<Vec<(Tick, Tick)>> {
+        let (new_c, old_c) = (self.comp_arc(comp)?, old.comp_arc(comp)?);
+        // Expressions may read what changed elsewhere, even from comps that didn't change.
+        let reads_elsewhere = heard.expressions && outside;
+        let quiet = self.silent_layers(comp, &new_c, heard);
+        // An edit of this comp is outside the comps it nests: their expressions may read it
+        // (`comp("Main").layer("Controls")`, at their own time).
+        let nested_outside = outside || !Arc::ptr_eq(&new_c, &old_c);
+        // Precomps (drawing the same comp before and after) whose comp changed: where they show it.
+        let mut touched = Vec::new();
+        let mut nested = Vec::new();
+        for l in new_c.layers.iter().filter(|l| !quiet.contains(&l.id)) {
+            let LayerSource::Comp { item } = l.source else { continue };
+            if old_c.layer(l.id).is_none_or(|before| before.source != l.source) {
+                continue;
+            }
+            // (an unchanged `Arc` says nothing of the comps nested in it: walk it anyway)
+            let (Some(n), Some(_)) = (self.comp_arc(item), old.comp_arc(item)) else { continue };
+            let inner = self.dirty_spans_at(old, item, heard, nested_outside, depth + 1, seen);
+            if inner.as_ref().is_some_and(Vec::is_empty) {
+                continue;
+            }
+            touched.push(l.id);
+            nested.extend(shown(l, &new_c, &n, inner));
+        }
+        if Arc::ptr_eq(&new_c, &old_c) && touched.is_empty() && !reads_elsewhere {
+            return Some(vec![]);
+        }
+        let picture = |p: &Project, c: &Comp| {
+            let mut c = c.clone();
+            let quiet = p.silent_layers(comp, &c, heard);
+            c.layers.retain(|l| !quiet.contains(&l.id));
+            c
+        };
+        let (a, b) = (picture(old, &old_c), picture(self, &new_c));
+        let elsewhere = heard.expressions && (outside || !new_c.same_pixels_with(&old_c, true, &|l| heard.contains(comp, l)) || !touched.is_empty());
+        let mut spans = b.changed_spans(&a, heard.expressions, &|l| heard.contains(comp, l), elsewhere, &touched)?;
+        spans.extend(nested);
+        Some(spans)
+    }
+}
+
+/// The comp-time spans of `outer` where its precomp layer `l` shows the spans `inner` of its comp
+/// `n` (`None`: all of it), widened by `outer`'s shutter. A time remap, Responsive Design
+/// timing or an effect reading the layer at other times (Echo, Posterize Time…: [`reads_other_frames`],
+/// or an effect picking the layer itself) can show any nested time anywhere: then the layer's
+/// whole span.
+fn shown(l: &Layer, outer: &Comp, n: &Comp, inner: Option<Vec<(Tick, Tick)>>) -> Vec<(Tick, Tick)> {
+    let (before, after) = outer.shutter_margin();
+    let whole = vec![(l.in_point - before, l.out_point + after)];
+    let responsive = (l.stretch - 100.0).abs() > 1e-9 && n.markers.iter().any(|m| m.protected && m.duration > Tick::ZERO);
+    let Some(inner) = inner else { return whole };
+    if l.props.get("timeRemap").is_some() || responsive || reads_itself_elsewhen(l) {
+        return whole;
+    }
+    // (a nested frame either side: Preserve Frame Rate holds nested frames, Frame Blending mixes
+    // neighbours)
+    let fd = n.frame_duration();
+    inner
+        .into_iter()
+        .filter_map(|(s, e)| {
+            let (x, y) = (l.comp_time(s - fd), l.comp_time(e + fd));
+            let (lo, hi) = (x.min(y).max(l.in_point), x.max(y).min(l.out_point));
+            (lo <= hi).then(|| (lo - before, hi + after))
+        })
+        .collect()
+}
+
+/// Some effect of `l` reads the layer at other times ([`reads_other_frames`]) or picks the layer
+/// itself (a layer parameter set to its own layer).
+fn reads_itself_elsewhen(l: &Layer) -> bool {
+    let time_fx = |c: &Node| matches!(c, Node::Group(f) if matches!(&f.kind, GroupKind::Effect { effect } if reads_other_frames(effect)));
+    l.picked_layers().contains(&l.id) || l.props.group("effects").is_some_and(|e| e.children.iter().any(time_fx))
+}
diff --git a/crates/project/src/file_check.rs b/crates/project/src/file_check.rs
new file mode 100644
index 000000000..f1b261c5a
--- /dev/null
+++ b/crates/project/src/file_check.rs
@@ -0,0 +1,329 @@
+//! A cheap check that a project file will read back, without parsing it.
+//!
+//! `serde_json` writes a non-finite float as `null` and refuses to parse nesting deeper than 128
+//! containers, so a project holding either would be saved to a file that can't be opened. Walking
+//! the value once, writing nothing, finds both without building the project again.
+
+use std::fmt;
+
+use serde::ser::{
+    self, Serialize, SerializeMap, SerializeSeq, SerializeStruct, SerializeStructVariant, SerializeTuple, SerializeTupleStruct, SerializeTupleVariant,
+    Serializer,
+};
+
+/// serde_json refuses to parse the 128th nested array/object (its recursion limit is 128).
+const MAX_DEPTH: u32 = 127;
+
+const NOT_FINITE: &str = "a number that isn't finite (NaN or infinity)";
+const TOO_DEEP: &str = "nesting deeper than 127 levels";
+
+/// Why a value can't be written to a project file.
+#[derive(Debug)]
+pub(crate) struct Unstorable(String);
+
+impl fmt::Display for Unstorable {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for Unstorable {}
+
+impl ser::Error for Unstorable {
+    fn custom<T: fmt::Display>(msg: T) -> Self {
+        Unstorable(msg.to_string())
+    }
+}
+
+/// Walk `value` as `serde_json` would write it, producing no text and allocating only on error.
+pub(crate) fn check<T: Serialize + ?Sized>(value: &T) -> Result<(), Unstorable> {
+    let mut walker = Walker { depth: 0 };
+    value.serialize(&mut walker)
+}
+
+/// The current nesting depth of the value being walked.
+struct Walker {
+    depth: u32,
+}
+
+impl Walker {
+    /// Enter `levels` nested containers, refusing anything serde_json couldn't parse back.
+    fn enter(&mut self, levels: u32) -> Result<(), Unstorable> {
+        let depth = self.depth.checked_add(levels).ok_or_else(|| Unstorable(TOO_DEEP.into()))?;
+        if depth > MAX_DEPTH {
+            return Err(Unstorable(TOO_DEEP.into()));
+        }
+        self.depth = depth;
+        Ok(())
+    }
+    fn leave(&mut self, levels: u32) {
+        self.depth = self.depth.saturating_sub(levels);
+    }
+}
+
+/// One compound value being walked; leaving it when it ends keeps the depth exact.
+struct Compound<'a> {
+    walker: &'a mut Walker,
+    levels: u32,
+}
+
+impl<'a> Compound<'a> {
+    fn new(walker: &'a mut Walker, levels: u32) -> Result<Self, Unstorable> {
+        walker.enter(levels)?;
+        Ok(Self { walker, levels })
+    }
+    fn value<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Unstorable> {
+        value.serialize(&mut *self.walker)
+    }
+    fn finish(self) -> Result<(), Unstorable> {
+        self.walker.leave(self.levels);
+        Ok(())
+    }
+}
+
+impl SerializeSeq for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_element<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl SerializeTuple for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_element<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl SerializeTupleStruct for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl SerializeTupleVariant for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl SerializeMap for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_key<T: Serialize + ?Sized>(&mut self, key: &T) -> Result<(), Unstorable> {
+        self.value(key)
+    }
+    fn serialize_value<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl SerializeStruct for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, _key: &'static str, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl SerializeStructVariant for Compound<'_> {
+    type Ok = ();
+    type Error = Unstorable;
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, _key: &'static str, value: &T) -> Result<(), Unstorable> {
+        self.value(value)
+    }
+    fn end(self) -> Result<(), Unstorable> {
+        self.finish()
+    }
+}
+
+impl<'a> Serializer for &'a mut Walker {
+    type Ok = ();
+    type Error = Unstorable;
+    type SerializeSeq = Compound<'a>;
+    type SerializeTuple = Compound<'a>;
+    type SerializeTupleStruct = Compound<'a>;
+    type SerializeTupleVariant = Compound<'a>;
+    type SerializeMap = Compound<'a>;
+    type SerializeStruct = Compound<'a>;
+    type SerializeStructVariant = Compound<'a>;
+
+    fn serialize_bool(self, _v: bool) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_i8(self, _v: i8) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_i16(self, _v: i16) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_i32(self, _v: i32) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_i64(self, _v: i64) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_i128(self, _v: i128) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_u8(self, _v: u8) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_u16(self, _v: u16) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_u32(self, _v: u32) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_u64(self, _v: u64) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_u128(self, _v: u128) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_f32(self, v: f32) -> Result<(), Unstorable> {
+        if v.is_finite() { Ok(()) } else { Err(Unstorable(NOT_FINITE.into())) }
+    }
+    fn serialize_f64(self, v: f64) -> Result<(), Unstorable> {
+        if v.is_finite() { Ok(()) } else { Err(Unstorable(NOT_FINITE.into())) }
+    }
+    fn serialize_char(self, _v: char) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_str(self, _v: &str) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    /// serde_json writes bytes as an array of numbers: one level of nesting.
+    fn serialize_bytes(self, _v: &[u8]) -> Result<(), Unstorable> {
+        Compound::new(self, 1)?.finish()
+    }
+    /// Writes text for a `Display` value; it is a scalar, not a container.
+    fn collect_str<T: fmt::Display + ?Sized>(self, _v: &T) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_none(self) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_some<T: Serialize + ?Sized>(self, value: &T) -> Result<(), Unstorable> {
+        value.serialize(&mut *self)
+    }
+    fn serialize_unit(self) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_unit_struct(self, _name: &'static str) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_unit_variant(self, _name: &'static str, _index: u32, _variant: &'static str) -> Result<(), Unstorable> {
+        Ok(())
+    }
+    fn serialize_newtype_struct<T: Serialize + ?Sized>(self, _name: &'static str, value: &T) -> Result<(), Unstorable> {
+        value.serialize(self)
+    }
+    fn serialize_newtype_variant<T: Serialize + ?Sized>(self, _name: &'static str, _index: u32, _variant: &'static str, value: &T) -> Result<(), Unstorable> {
+        let mut compound = Compound::new(self, 1)?;
+        compound.value(value)?;
+        compound.finish()
+    }
+    fn serialize_seq(self, _len: Option<usize>) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 1)
+    }
+    fn serialize_tuple(self, _len: usize) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 1)
+    }
+    fn serialize_tuple_struct(self, _name: &'static str, _len: usize) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 1)
+    }
+    fn serialize_tuple_variant(self, _name: &'static str, _index: u32, _variant: &'static str, _len: usize) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 2)
+    }
+    fn serialize_map(self, _len: Option<usize>) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 1)
+    }
+    fn serialize_struct(self, _name: &'static str, _len: usize) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 1)
+    }
+    fn serialize_struct_variant(self, _name: &'static str, _index: u32, _variant: &'static str, _len: usize) -> Result<Compound<'a>, Unstorable> {
+        Compound::new(self, 2)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use super::check;
+
+    #[test]
+    fn refuses_non_finite_numbers_anywhere() {
+        assert!(check(&1.5f64).is_ok());
+        assert!(check(&vec![Some(1.0f64), None]).is_ok());
+        assert!(check(&BTreeMap::from([("a".to_string(), 2.0f32)])).is_ok(), "finite floats in a map");
+        assert!(check(&f64::NAN).is_err());
+        assert!(check(&f64::INFINITY).is_err());
+        assert!(check(&vec![Some(f64::NEG_INFINITY)]).is_err(), "inside an option in a list");
+        assert!(check(&BTreeMap::from([("a".to_string(), f32::NAN)])).is_err(), "as a map value");
+    }
+
+    #[test]
+    fn depth_limit_matches_serde_json() {
+        for n in [127, 128] {
+            let mut v = serde_json::Value::Null;
+            for _ in 0..n {
+                v = serde_json::Value::Array(vec![v]);
+            }
+            let text = serde_json::to_string(&v).unwrap();
+            let reads_back = serde_json::from_str::<serde_json::Value>(&text).is_ok();
+            assert_eq!(check(&v).is_ok(), reads_back, "depth {n} agrees with serde_json");
+            assert_eq!(check(&v).is_ok(), n == 127, "depth {n}");
+        }
+    }
+
+    /// `n` nested lists around bytes, which serde_json writes as one more array.
+    struct BytesUnder(u32);
+
+    impl serde::Serialize for BytesUnder {
+        fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+            use serde::ser::SerializeSeq;
+            let Some(inner) = self.0.checked_sub(1) else {
+                return s.serialize_bytes(&[1]);
+            };
+            let mut seq = s.serialize_seq(Some(1))?;
+            seq.serialize_element(&BytesUnder(inner))?;
+            seq.end()
+        }
+    }
+
+    #[test]
+    fn bytes_count_as_one_level() {
+        for n in [126, 127] {
+            let text = serde_json::to_string(&BytesUnder(n)).unwrap();
+            let reads_back = serde_json::from_str::<serde_json::Value>(&text).is_ok();
+            assert_eq!(check(&BytesUnder(n)).is_ok(), reads_back, "depth {n} agrees with serde_json");
+            assert_eq!(check(&BytesUnder(n)).is_ok(), n == 126, "depth {n}");
+        }
+    }
+}
diff --git a/crates/project/src/footage.rs b/crates/project/src/footage.rs
new file mode 100644
index 000000000..eeace5e81
--- /dev/null
+++ b/crates/project/src/footage.rs
@@ -0,0 +1,405 @@
+use super::settings::{Marker, yes};
+use super::{ColorSpace, Deserialize, FrameRate, Serialize, Tick};
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum FootageKind {
+    #[default]
+    Video,
+    Still,
+    Sequence,
+    Audio,
+    /// A 3D model (glTF 2.0 / OBJ), placed as a model layer.
+    Model,
+    /// A data file (JSON, CSV, TSV) for data-driven animation: read by expressions through
+    /// `footage(name).sourceData` / `sourceText` / `dataValue`; it has no pixels.
+    Data,
+}
+
+/// Interpret Footage ▸ Fields and Pulldown ▸ Separate Fields.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum FieldOrder {
+    /// Progressive frames.
+    #[default]
+    Off,
+    /// Interlaced, upper (odd) field first: each field becomes a frame at twice the rate.
+    UpperFirst,
+    LowerFirst,
+}
+
+impl FieldOrder {
+    pub fn label(self) -> &'static str {
+        match self {
+            FieldOrder::Off => "Off",
+            FieldOrder::UpperFirst => "Upper Field First",
+            FieldOrder::LowerFirst => "Lower Field First",
+        }
+    }
+    pub fn parse(s: &str) -> Option<FieldOrder> {
+        match s.to_ascii_lowercase().replace([' ', '_', '-'], "").as_str() {
+            "off" | "none" | "progressive" => Some(FieldOrder::Off),
+            "upper" | "upperfirst" | "upperfieldfirst" => Some(FieldOrder::UpperFirst),
+            "lower" | "lowerfirst" | "lowerfieldfirst" => Some(FieldOrder::LowerFirst),
+            _ => None,
+        }
+    }
+}
+
+/// File extensions of the movie containers footage is imported from (FilmCraft reads them). The
+/// import and proxy file dialogs, the Media Browser and `effectcraft_media::is_importable` all go
+/// by this list.
+pub const VIDEO_EXTENSIONS: &[&str] = &["mp4", "m4v", "mov", "mkv", "webm", "mxf", "avi"];
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AlphaMode {
+    #[default]
+    Straight,
+    Premultiplied,
+    Ignore,
+}
+
+/// Interpret Footage ▸ Cineon Settings ▸ Units: how the Converted Black and White Points are
+/// shown and entered.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CineonUnits {
+    /// 10-bit code values (0–1023).
+    #[default]
+    TenBit,
+    /// 8-bit values (0–255).
+    EightBit,
+    /// Floating point (0–1).
+    Float,
+}
+
+impl CineonUnits {
+    pub const ALL: [CineonUnits; 3] = [CineonUnits::TenBit, CineonUnits::EightBit, CineonUnits::Float];
+
+    /// The id commands use: `10bit`, `8bit` or `float`.
+    pub fn id(self) -> &'static str {
+        match self {
+            CineonUnits::TenBit => "10bit",
+            CineonUnits::EightBit => "8bit",
+            CineonUnits::Float => "float",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            CineonUnits::TenBit => "10-bit",
+            CineonUnits::EightBit => "8-bit",
+            CineonUnits::Float => "Float",
+        }
+    }
+
+    pub fn parse(s: &str) -> Option<CineonUnits> {
+        match s.to_ascii_lowercase().replace([' ', '_', '-'], "").as_str() {
+            "10bit" | "10" => Some(CineonUnits::TenBit),
+            "8bit" | "8" => Some(CineonUnits::EightBit),
+            "float" | "32bit" => Some(CineonUnits::Float),
+            _ => None,
+        }
+    }
+
+    /// A 10-bit value (0–1023) in these units.
+    pub fn from_ten_bit(self, v: f64) -> f64 {
+        match self {
+            CineonUnits::TenBit => v,
+            CineonUnits::EightBit => v * 255.0 / 1023.0,
+            CineonUnits::Float => v / 1023.0,
+        }
+    }
+
+    /// A value in these units as a 10-bit value (0–1023).
+    pub fn to_ten_bit(self, v: f64) -> f64 {
+        match self {
+            CineonUnits::TenBit => v,
+            CineonUnits::EightBit => v * 1023.0 / 255.0,
+            CineonUnits::Float => v * 1023.0,
+        }
+    }
+}
+
+/// Interpret Footage ▸ Cineon Settings of DPX and Cineon footage: how the file's logarithmic
+/// (printing density) code values become the footage's pixels. Code values are counted in 10-bit
+/// units whatever the file's bit depth.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct CineonSettings {
+    /// Logarithmic Conversion: convert the code values from log to the Current Gamma. When it
+    /// is off, the code values are shown as stored.
+    pub log_conversion: bool,
+    /// Converted Black Point: the level the 10 Bit Black Point becomes (10-bit units).
+    pub converted_black: f32,
+    /// Converted White Point: the level the 10 Bit White Point becomes (10-bit units).
+    pub converted_white: f32,
+    /// 10 Bit Black Point: the code value of minimum density.
+    pub black: f32,
+    /// 10 Bit White Point: the code value of maximum density.
+    pub white: f32,
+    /// Current Gamma: the gamma the converted values are encoded with (1: linear light).
+    pub gamma: f32,
+    /// Highlight Rolloff (0–100): values near and above the white point ramp off gradually
+    /// instead of clipping; 0 keeps over-range values.
+    pub rolloff: f32,
+    /// Units of the Converted Black and White Points.
+    pub units: CineonUnits,
+}
+
+impl Default for CineonSettings {
+    fn default() -> Self {
+        CineonSettings {
+            log_conversion: false,
+            converted_black: 0.0,
+            converted_white: 1023.0,
+            black: 95.0,
+            white: 685.0,
+            gamma: 1.7,
+            rolloff: 20.0,
+            units: CineonUnits::TenBit,
+        }
+    }
+}
+
+impl CineonSettings {
+    /// The highest 10-bit value.
+    pub const MAX: f32 = 1023.0;
+
+    /// A code value (0–1 of the 10-bit range) converted from log to the Current Gamma and the
+    /// converted black and white levels (0–1; above 1 for over-range highlights).
+    pub fn convert(&self, v: f32) -> f32 {
+        let lin = cineon_log_to_lin(v, self.black, self.white, 1.0, self.gamma, self.rolloff);
+        let out = (self.converted_black + (self.converted_white - self.converted_black) * lin) / Self::MAX;
+        if out.is_finite() { out } else { 0.0 }
+    }
+}
+
+/// Cineon log to linear, shared by Interpret Footage ▸ Cineon Settings and the Cineon Converter
+/// effect. `v` is a code value as 0–1 of the 10-bit range; `black` and `white` are the 10 Bit
+/// Black and White Points. The result is 0 at the black point and 1 at the white point, raised to
+/// `scale / gamma`, with values above `1 - rolloff / 100` ramped off toward 1 (Highlight Rolloff
+/// 0–100; 0 keeps over-range values). A Gamma below 0.01 is raised to 0.01. Cineon Settings passes
+/// a `scale` of 1 (Gamma 1 gives linear light) and the Cineon Converter passes 1.7 (its default
+/// Gamma 1.7 gives linear light).
+pub fn cineon_log_to_lin(v: f32, black: f32, white: f32, scale: f32, gamma: f32, rolloff: f32) -> f32 {
+    // Kodak printing density: 0.002 density per code value, negative gamma 0.6.
+    let exposure = |code: f32| 10f32.powf((code - white) * 0.002 / 0.6);
+    let offset = exposure(black);
+    let mut lin = ((exposure(v * CineonSettings::MAX) - offset) / (1.0 - offset).max(1e-6)).max(0.0);
+    lin = lin.powf(scale / gamma.max(0.01));
+    let knee = 1.0 - (rolloff / 100.0).clamp(0.0, 0.99);
+    if knee < 1.0 && lin > knee {
+        let w = 1.0 - knee;
+        lin = knee + w * (1.0 - (-(lin - knee) / w).exp());
+    }
+    lin
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Footage {
+    pub path: String,
+    pub kind: FootageKind,
+    pub width: u32,
+    pub height: u32,
+    pub pixel_aspect: f64,
+    pub frame_rate: FrameRate,
+    /// Native rate before "Conform to frame rate".
+    #[serde(default)]
+    pub native_rate: Option<FrameRate>,
+    pub duration: Tick,
+    pub has_video: bool,
+    pub has_audio: bool,
+    pub alpha: AlphaMode,
+    #[serde(default)]
+    pub premul_color: [f32; 3],
+    #[serde(default = "one")]
+    pub loop_count: u32,
+    #[serde(default)]
+    pub codec: String,
+    #[serde(default)]
+    pub missing: bool,
+    /// Image sequence files (when kind = Sequence).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub sequence: Vec<String>,
+    /// Colour profile (from the file's metadata, or Interpret Footage). `None` = sRGB.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub color_profile: Option<ColorSpace>,
+    /// One layer of a layered file (Photoshop) instead of its merged image.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub layer: Option<SourceLayer>,
+    /// Interpret Footage ▸ Fields and Pulldown ▸ Separate Fields.
+    #[serde(default, skip_serializing_if = "is_default")]
+    pub fields: FieldOrder,
+    /// Interpret Footage ▸ Alpha ▸ Invert Alpha.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub invert_alpha: bool,
+    /// Interpret Footage ▸ Color ▸ Interpret As Linear Light: the file's values are linear.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub linear_light: bool,
+    /// Interpret Footage ▸ Color ▸ Preserve RGB: the file's values enter the composition
+    /// unconverted. Float footage (OpenEXR, float TIFF) is not sRGB-encoded on decode, and the
+    /// colour profile, Interpret As Linear Light and the working space don't apply.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub preserve_rgb: bool,
+    /// Interpret Footage ▸ Cineon Settings (DPX and Cineon files only; [`Footage::cineon_applies`]).
+    #[serde(default, skip_serializing_if = "is_default")]
+    pub cineon: CineonSettings,
+    /// Data footage ([`FootageKind::Data`]): the file's text (JSON, CSV or TSV), kept in the
+    /// project so expressions read it everywhere (and on the web).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub data: Option<String>,
+    /// PDF / Illustrator footage: the page shown (0-based; File ▸ Import ▸ Page).
+    #[serde(default, skip_serializing_if = "is_default")]
+    pub page: u32,
+    /// Image sequences imported with Force Alphabetical Order: the files play one after another
+    /// and their numbering doesn't count (otherwise a gap in it shows a placeholder, as in After
+    /// Effects; [`sequence`]).
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub alphabetical: bool,
+    /// Interpret Footage ▸ Start Timecode ▸ Override Start: the frame (at the footage's frame
+    /// rate) its timecode shows at its first frame. `None` = Use Source File Timecode (shown
+    /// from 0: [`Footage::file_timecode`] isn't used here yet). It only relabels source time, as
+    /// in After Effects.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub start_timecode: Option<i64>,
+    /// The start timecode recorded in the file, in frames at its own frame rate (`native_rate`,
+    /// else `frame_rate`). Read when probing; importing an EDL uses it to turn the list's source
+    /// timecodes into footage time.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub file_timecode: Option<i64>,
+    /// Markers the file carries (a WAV's cue points and XMP markers), at footage time. A layer
+    /// made from the footage starts with them, and Update Markers From Source copies new ones.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub markers: Vec<Marker>,
+    /// PDF / Illustrator footage (`.pdf`, `.ai`; not EPS) from an After Effects project: the page
+    /// is framed as After Effects places it (the ArtBox, `/Rotate` ignored) and drawn to fill
+    /// `width` × `height`, the size After Effects stored, which the layers' anchors and masks are
+    /// measured against (#3099). Other footage (and every project saved before this field) shows
+    /// the page as a PDF viewer does, at its own size.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub placed_page: bool,
+}
+
+fn is_default<T: Default + PartialEq>(v: &T) -> bool {
+    *v == T::default()
+}
+
+impl Default for Footage {
+    fn default() -> Self {
+        Footage {
+            path: String::new(),
+            kind: FootageKind::Still,
+            width: 0,
+            height: 0,
+            pixel_aspect: 1.0,
+            frame_rate: FrameRate::FPS_30,
+            native_rate: None,
+            duration: Tick::ZERO,
+            has_video: false,
+            has_audio: false,
+            alpha: AlphaMode::Straight,
+            premul_color: [0.0; 3],
+            loop_count: 1,
+            codec: String::new(),
+            missing: false,
+            sequence: vec![],
+            color_profile: None,
+            fields: FieldOrder::Off,
+            invert_alpha: false,
+            linear_light: false,
+            preserve_rgb: false,
+            cineon: CineonSettings::default(),
+            data: None,
+            layer: None,
+            page: 0,
+            alphabetical: false,
+            start_timecode: None,
+            file_timecode: None,
+            markers: vec![],
+            placed_page: false,
+        }
+    }
+}
+
+impl Footage {
+    /// The file is DPX or Cineon (the formats Interpret Footage ▸ Cineon Settings applies to).
+    pub fn is_cineon_file(&self) -> bool {
+        let ext = std::path::Path::new(&self.path).extension().and_then(|e| e.to_str()).unwrap_or("").to_ascii_lowercase();
+        matches!(ext.as_str(), "dpx" | "cin")
+    }
+
+    /// Cineon Settings ▸ Logarithmic Conversion applies: it is on and the file is DPX or Cineon.
+    pub fn cineon_applies(&self) -> bool {
+        self.cineon.log_conversion && self.is_cineon_file()
+    }
+
+    /// Interpret As Linear Light applies (Preserve RGB passes the file's values through).
+    pub fn linear_light_applies(&self) -> bool {
+        self.linear_light && !self.preserve_rgb
+    }
+
+    /// How long the footage plays: its duration times Interpret Footage ▸ Loop.
+    pub fn looped_duration(&self) -> Tick {
+        Tick(self.duration.0.saturating_mul(self.loop_count.max(1) as i64))
+    }
+
+    /// Source time as the footage's timecode: its frame `frame` from Start Timecode
+    /// (`0:00:41:20`), as the Footage panel shows it.
+    pub fn timecode(&self, frame: i64) -> String {
+        effectcraft_time::format_timecode_ae(frame.saturating_add(self.start_timecode.unwrap_or(0)), self.frame_rate, false)
+    }
+
+    /// The data format of data footage: `json`, `csv` or `tsv` (from the file extension).
+    pub fn data_format(&self) -> Option<&'static str> {
+        if self.kind != FootageKind::Data {
+            return None;
+        }
+        let ext = std::path::Path::new(&self.path).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("").to_ascii_lowercase();
+        Some(match ext.as_str() {
+            "csv" => "csv",
+            "tsv" | "tab" => "tsv",
+            _ => "json",
+        })
+    }
+}
+
+/// A proxy: a stand-in file used instead of a footage item or composition (File ▸ Set Proxy /
+/// Create Proxy), when its Use Proxy switch is on and the render's Proxy Use allows it.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Proxy {
+    /// The proxy's footage (path, size, rate…; File ▸ Interpret Footage ▸ Proxy edits it).
+    pub footage: Footage,
+    /// Use Proxy (the Project panel's proxy indicator: filled = in use, hollow = set but off).
+    #[serde(default = "yes")]
+    pub enabled: bool,
+}
+
+/// A layer of a layered still (a Photoshop document, or a PDF / Illustrator / EPS file) used as
+/// footage (File ▸ Import ▸ Composition / Composition – Retain Layer Sizes, or Choose Layer).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SourceLayer {
+    /// Layer record index in the file (bottom of the stack = 0).
+    pub index: u32,
+    pub name: String,
+    /// The footage is the layer's own bounds (Retain Layer Sizes) rather than the document size.
+    #[serde(default)]
+    pub layer_size: bool,
+    /// A Photoshop smart object: the unique id of its embedded file (linked layer data), which
+    /// is the footage instead of the layer's pixels.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub embedded: Option<String>,
+    /// A smart object with a perspective quad or a warp: the footage is its embedded file baked
+    /// as placed (warped and pinned to its corners) over the placed bounds in document space.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub placed: bool,
+}
+
+fn one() -> u32 {
+    1
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Solid {
+    pub color: [f32; 3],
+    pub width: u32,
+    pub height: u32,
+    pub pixel_aspect: f64,
+}
diff --git a/crates/project/src/item.rs b/crates/project/src/item.rs
new file mode 100644
index 000000000..4fcc06ab9
--- /dev/null
+++ b/crates/project/src/item.rs
@@ -0,0 +1,478 @@
+use super::comp::Comp;
+use super::footage::{Footage, FootageKind, Proxy, Solid};
+use super::layer::LayerSource;
+use super::settings::{APP_VERSION, ProjectError, ProjectSettings, SCHEMA_VERSION, SavedView};
+use super::{Arc, BTreeMap, Deserialize, FrameRate, Label, Project, Serialize, Tick, file_check, limits};
+
+/// `base` numbered with the lowest counter from 2 for which `taken` is false: a copy of an item or
+/// another layer of the same name. A number set off by a space is a counter and is replaced
+/// (`Red Solid 1` → `Red Solid 2`, `shot 2` → `shot 3`); digits that end a word belong to the
+/// name and stay (`v-b1.mp4` → `v-b1.mp4 2`, `clip2.mov` → `clip2.mov 2`).
+pub(crate) fn numbered_name(base: &str, taken: impl Fn(&str) -> bool) -> String {
+    let head = base.trim_end_matches(|c: char| c.is_ascii_digit());
+    let stem = match head.strip_suffix(' ') {
+        Some(stem) if head.len() < base.len() && !stem.trim_end().is_empty() => stem.trim_end(),
+        _ => base.trim_end(),
+    };
+    (2u64..).map(|k| format!("{stem} {k}")).find(|n| !taken(n)).unwrap_or_default()
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+pub struct ItemId(pub u64);
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+pub struct LayerId(pub u64);
+
+/// An explicit "None" in a layer parameter whose unset value means the owning layer (Compound
+/// Blur's Blur Layer, Displacement Map's map, Set Matte's matte): `Value::Layer(Some(NO_LAYER))`.
+/// Ids start at 1, so it never names a layer; it resolves to no layer and shows as "None".
+pub const NO_LAYER: u64 = 0;
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type")]
+#[allow(clippy::large_enum_variant)]
+pub enum ItemKind {
+    Folder,
+    Comp(Arc<Comp>),
+    Footage(Footage),
+    Solid(Solid),
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Item {
+    pub id: ItemId,
+    pub name: String,
+    pub label: Label,
+    #[serde(default)]
+    pub comment: String,
+    /// Containing folder (None = project root).
+    #[serde(default)]
+    pub parent: Option<ItemId>,
+    pub kind: ItemKind,
+    /// The item's proxy (footage and compositions).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub proxy: Option<Box<Proxy>>,
+}
+
+impl Item {
+    /// Whether an external original or proxy is known to be offline, even if the other can
+    /// still provide a preview. Generated items and embedded data have no external dependency.
+    pub fn has_missing_footage(&self) -> bool {
+        let missing = |f: &crate::Footage| f.missing && !f.path.is_empty() && f.kind != FootageKind::Data;
+        matches!(&self.kind, ItemKind::Footage(f) if missing(f)) || self.proxy.as_ref().is_some_and(|p| missing(&p.footage))
+    }
+
+    pub fn type_name(&self) -> &'static str {
+        match &self.kind {
+            ItemKind::Folder => "Folder",
+            ItemKind::Comp(_) => "Composition",
+            ItemKind::Footage(f) => match f.kind {
+                FootageKind::Video => "Video",
+                FootageKind::Still => "Image",
+                FootageKind::Sequence => "Image Sequence",
+                FootageKind::Audio => "Audio",
+                FootageKind::Model => "3D Model",
+                FootageKind::Data => "Data",
+            },
+            ItemKind::Solid(_) => "Solid",
+        }
+    }
+    pub fn as_comp(&self) -> Option<&Comp> {
+        if let ItemKind::Comp(c) = &self.kind { Some(c) } else { None }
+    }
+    pub fn is_folder(&self) -> bool {
+        matches!(self.kind, ItemKind::Folder)
+    }
+    /// (width, height) for visual items.
+    pub fn dimensions(&self) -> Option<(u32, u32)> {
+        match &self.kind {
+            ItemKind::Comp(c) => Some((c.width, c.height)),
+            ItemKind::Footage(f) if f.has_video => Some((f.width, f.height)),
+            ItemKind::Solid(s) => Some((s.width, s.height)),
+            _ => None,
+        }
+    }
+    pub fn duration(&self) -> Option<Tick> {
+        match &self.kind {
+            ItemKind::Comp(c) => Some(c.duration),
+            ItemKind::Footage(f) if f.kind != FootageKind::Still => Some(f.looped_duration()),
+            _ => None,
+        }
+    }
+    pub fn frame_rate(&self) -> Option<FrameRate> {
+        match &self.kind {
+            ItemKind::Comp(c) => Some(c.frame_rate),
+            ItemKind::Footage(f) if f.kind == FootageKind::Video || f.kind == FootageKind::Sequence => Some(f.frame_rate),
+            _ => None,
+        }
+    }
+}
+
+impl Default for Project {
+    fn default() -> Self {
+        Project {
+            schema: SCHEMA_VERSION,
+            settings: ProjectSettings::default(),
+            items: BTreeMap::new(),
+            next_id: 1,
+            render_queue: Vec::new(),
+            render_templates: Default::default(),
+            render_prefs: Default::default(),
+        }
+    }
+}
+
+impl Project {
+    /// Some layer has an expression, which can read markers (`marker.key(1)`, `numKeys`,
+    /// `nearestKey`...). Only then do the markers of comps and layers affect what is rendered, so
+    /// frame caches ignore them otherwise.
+    pub fn reads_markers(&self) -> bool {
+        // Called for every frame identity and disk-cache key: stops at the first expression and
+        // builds no paths (`PropGroup::walk` formats one per node).
+        fn any_expr(g: &crate::PropGroup) -> bool {
+            g.children.iter().any(|c| match c {
+                crate::Node::Prop(p) => p.expr.is_some(),
+                crate::Node::Group(sub) => any_expr(sub),
+            })
+        }
+        self.comps().any(|(_, c)| c.layers.iter().any(|l| any_expr(&l.props)))
+    }
+
+    /// The layers whose audio something draws ([`Heard`]): those a layer picks in an effect (an
+    /// Audio Spectrum or Audio Waveform's Audio Layer, even on itself), and the layers inside a
+    /// picked precomp, whose audio it mixes. With an expression anywhere (it can read any layer's
+    /// Audio Levels) every layer may be heard ([`Heard::contains`]).
+    pub fn heard_layers(&self) -> Heard {
+        let mut layers = std::collections::BTreeSet::new();
+        let mut stack: Vec<(ItemId, LayerId)> =
+            self.comps().flat_map(|(id, c)| c.layers.iter().flat_map(move |l| l.picked_layers().into_iter().map(move |r| (*id, r)))).collect();
+        // (bounded: each (comp, layer) is visited once)
+        while let Some((cid, lid)) = stack.pop() {
+            if !layers.insert((cid, lid)) {
+                continue;
+            }
+            let inner = self.comp(cid).and_then(|c| c.layer(lid)).and_then(|l| match l.source {
+                LayerSource::Comp { item } => Some(item),
+                _ => None,
+            });
+            if let Some(inner) = inner
+                && let Some(c) = self.comp(inner)
+            {
+                stack.extend(c.layers.iter().map(|l| (inner, l.id)));
+            }
+        }
+        Heard { expressions: self.reads_markers(), audio_exprs: self.reads_audio(), layers }
+    }
+
+    /// Some expression may read a layer's audio: its text names it (`audio`, `"Audio Levels"`,
+    /// `"ADBE Audio Group"`) or walks properties by index (`layer(1)(3)`).
+    // ponytail: text heuristic; misses an index walk through a variable (`g = layer(1); g(3)`).
+    // Upgrade: record audio reads in the expression host.
+    fn reads_audio(&self) -> bool {
+        fn reads(text: &str) -> bool {
+            let t: String = text.chars().filter(|c| !c.is_whitespace()).collect::<String>().to_lowercase();
+            t.contains("audio") || t.match_indices(")(").any(|(i, _)| t.get(i + 2..).and_then(|r| r.chars().next()).is_some_and(|c| c.is_ascii_digit()))
+        }
+        fn any(g: &crate::PropGroup) -> bool {
+            g.children.iter().any(|c| match c {
+                crate::Node::Prop(p) => p.expr.as_ref().is_some_and(|e| reads(&e.text)),
+                crate::Node::Group(sub) => any(sub),
+            })
+        }
+        self.comps().any(|(_, c)| c.layers.iter().any(|l| any(&l.props)))
+    }
+
+    /// Layers of `comp` (item `id`) that can't change its pixels: footage layers of files without
+    /// video (music, voice-over) and layers with the Video switch off, unless another layer reads
+    /// them (a hidden track matte) or something draws their audio ([`Self::heard_layers`]: the
+    /// Audio Spectrum's Audio Layer, also from a comp that nests this one). Cameras, lights,
+    /// nulls, environment layers and soloed layers (Solo hides every other layer) are never
+    /// silent. Expressions, which can read any layer, are the caller's concern.
+    pub fn silent_layers(&self, id: ItemId, comp: &Comp, heard: &Heard) -> std::collections::BTreeSet<LayerId> {
+        let read: std::collections::BTreeSet<LayerId> =
+            comp.layers.iter().flat_map(|l| l.referenced_layers().into_iter().filter(move |r| *r != l.id)).collect();
+        comp.layers
+            .iter()
+            .filter(|l| {
+                let no_picture = match &l.source {
+                    LayerSource::Footage { item } => matches!(self.item(*item).map(|i| &i.kind), Some(ItemKind::Footage(f)) if !f.has_video),
+                    _ => false,
+                };
+                // (environment layers light Advanced 3D scenes without being drawn)
+                (no_picture || l.source.is_av() && !l.switches.video)
+                    && !l.switches.solo
+                    && !l.environment
+                    && !l.environment_background
+                    && !read.contains(&l.id)
+                    && !heard.picked(id, l.id)
+            })
+            .map(|l| l.id)
+            .collect()
+    }
+
+    /// Allocate an id (items, layers and property uids share one counter).
+    pub fn alloc(&mut self) -> u64 {
+        let id = self.next_id;
+        self.next_id += 1;
+        id
+    }
+    pub fn item(&self, id: ItemId) -> Option<&Item> {
+        self.items.get(&id)
+    }
+    pub fn item_mut(&mut self, id: ItemId) -> Option<&mut Item> {
+        self.items.get_mut(&id)
+    }
+    pub fn comp(&self, id: ItemId) -> Option<&Comp> {
+        self.items.get(&id)?.as_comp()
+    }
+    /// A shared handle on a comp: a snapshot that costs a reference count, not a deep copy of
+    /// its layers (frontends hold one across a frame instead of cloning the comp).
+    pub fn comp_arc(&self, id: ItemId) -> Option<Arc<Comp>> {
+        match &self.items.get(&id)?.kind {
+            ItemKind::Comp(c) => Some(c.clone()),
+            _ => None,
+        }
+    }
+    /// Mutable comp (copy-on-write).
+    pub fn comp_mut(&mut self, id: ItemId) -> Option<&mut Comp> {
+        match &mut self.items.get_mut(&id)?.kind {
+            ItemKind::Comp(c) => Some(Arc::make_mut(c)),
+            _ => None,
+        }
+    }
+    /// Adds an item; its size, frame rate and the like are brought within [`limits`] first.
+    pub fn add_item(&mut self, name: &str, label: Label, parent: Option<ItemId>, mut kind: ItemKind) -> ItemId {
+        limits::repair_kind(name, &mut kind, &mut vec![]);
+        let id = ItemId(self.alloc());
+        self.items.insert(id, Item { id, name: name.into(), label, comment: String::new(), parent, kind, proxy: None });
+        id
+    }
+    /// Children of a folder (None = root), folders first then by name.
+    pub fn children(&self, folder: Option<ItemId>) -> Vec<&Item> {
+        let mut v: Vec<&Item> = self.items.values().filter(|i| i.parent == folder).collect();
+        v.sort_by(|a, b| b.is_folder().cmp(&a.is_folder()).then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase())));
+        v
+    }
+    pub fn comps(&self) -> impl Iterator<Item = (&ItemId, &Comp)> {
+        self.items.iter().filter_map(|(id, i)| i.as_comp().map(|c| (id, c)))
+    }
+    pub fn find_by_name(&self, name: &str) -> Option<&Item> {
+        self.items.values().find(|i| i.name == name)
+    }
+    /// A numbered name for a copy of `base` that no project item has (Edit ▸ Duplicate), as
+    /// `numbered_name` gives it (`Comp 1` → `Comp 2`, `Name` → `Name 2`, then `Name 3`,
+    /// `v-b1.mp4` → `v-b1.mp4 2`). Items for which `ignore` holds don't count.
+    pub fn numbered_item_name(&self, base: &str, ignore: impl Fn(&Item) -> bool) -> String {
+        numbered_name(base, |n| self.items.values().any(|i| i.name == n && !ignore(i)))
+    }
+    /// `base` when no project item has that name, else the next free numbered name as
+    /// [`Project::numbered_item_name`] gives it. Items for which `ignore` holds don't count.
+    pub fn unique_item_name(&self, base: &str, ignore: impl Fn(&Item) -> bool) -> String {
+        if self.items.values().any(|i| i.name == base && !ignore(i)) { self.numbered_item_name(base, ignore) } else { base.to_string() }
+    }
+    pub fn folder_named(&self, name: &str) -> Option<ItemId> {
+        self.items.values().find(|i| i.is_folder() && i.name == name).map(|i| i.id)
+    }
+    /// Find the comp that contains `layer`.
+    pub fn comp_of_layer(&self, layer: LayerId) -> Option<ItemId> {
+        self.comps().find(|(_, c)| c.layer(layer).is_some()).map(|(id, _)| *id)
+    }
+    /// The compositions whose layers use `item` as their source (footage, solid, 3D model or
+    /// precomp), each with how many of its layers do, ordered by comp name then id. Only direct
+    /// layers count, as in After Effects' Project panel ("used 3 times"): a solid inside a precomp
+    /// is used by the precomp, not by the comps that nest it. The total is the sum of the counts.
+    pub fn item_users(&self, item: ItemId) -> Vec<(ItemId, usize)> {
+        let mut users: Vec<(ItemId, String, usize)> = self
+            .items
+            .iter()
+            .filter_map(|(id, it)| {
+                let comp = it.as_comp()?;
+                let n = comp.layers.iter().filter(|l| l.source.item() == Some(item)).count();
+                (n > 0).then(|| (*id, it.name.to_lowercase(), n))
+            })
+            .collect();
+        users.sort_by(|a, b| a.1.cmp(&b.1).then(a.0.cmp(&b.0)));
+        users.into_iter().map(|(id, _, n)| (id, n)).collect()
+    }
+    /// Whether comp `inner` is (transitively) nested inside comp `outer` (to prevent cycles).
+    pub fn comp_contains(&self, outer: ItemId, inner: ItemId) -> bool {
+        // A walk with a stack and a visited set rather than recursion (#1237): a damaged project
+        // may hold a precomp cycle that doesn't pass `inner` (recursion never ended), a long
+        // chain must not use up the call stack, and comps shared by many paths are visited once
+        // (recursion re-walked them for every path).
+        if outer == inner {
+            return true;
+        }
+        let mut seen = std::collections::HashSet::new();
+        let mut stack = vec![outer];
+        while let Some(id) = stack.pop() {
+            if !seen.insert(id) {
+                continue;
+            }
+            let Some(c) = self.comp(id) else { continue };
+            for l in &c.layers {
+                if let LayerSource::Comp { item } = l.source {
+                    if item == inner {
+                        return true;
+                    }
+                    if !seen.contains(&item) {
+                        stack.push(item);
+                    }
+                }
+            }
+        }
+        false
+    }
+    /// Make sure `next_id` exceeds every id in the project (after loading or merging).
+    pub fn fix_next_id(&mut self) {
+        let mut m = self.next_id;
+        for (id, it) in &self.items {
+            // Saturating: a damaged file's ids must not overflow (the import then refuses it).
+            m = m.max(id.0.saturating_add(1));
+            if let ItemKind::Comp(c) = &it.kind {
+                for l in &c.layers {
+                    m = m.max(l.id.0.saturating_add(1)).max(l.props.max_uid().saturating_add(1));
+                }
+            }
+        }
+        self.next_id = m;
+    }
+    /// Whether `other` holds the same content. An allocated id counts (an edit may hand it out
+    /// beyond the project, so it must stay taken). Shared compositions compare by pointer first,
+    /// so after a copy-on-write edit only the comps it touched are compared field by field.
+    pub fn same_content(&self, other: &Project) -> bool {
+        let item_eq = |a: &Item, b: &Item| {
+            let kind = match (&a.kind, &b.kind) {
+                (ItemKind::Comp(x), ItemKind::Comp(y)) => Arc::ptr_eq(x, y) || x == y,
+                (x, y) => x == y,
+            };
+            kind && a.id == b.id && a.name == b.name && a.label == b.label && a.comment == b.comment && a.parent == b.parent && a.proxy == b.proxy
+        };
+        self.schema == other.schema
+            && self.next_id == other.next_id
+            && self.settings == other.settings
+            && self.items.len() == other.items.len()
+            && self.items.iter().zip(&other.items).all(|((ka, a), (kb, b))| ka == kb && item_eq(a, b))
+            && self.render_queue == other.render_queue
+            && self.render_templates == other.render_templates
+            && self.render_prefs == other.render_prefs
+    }
+    /// The project file's text: the project with the version that wrote it (`savedBy`), checked
+    /// to read back, so a save never writes a file that can't be opened. Values JSON can't hold
+    /// (NaN or infinity, written as `null`, and nesting too deep to parse) are refused on every
+    /// save; debug builds also read the text back.
+    pub fn to_file_json(&self) -> Result<String, ProjectError> {
+        self.to_file_json_with_view(&SavedView::default(), false)
+    }
+    /// [`Project::to_file_json`] that also records the open compositions ([`SavedView`]), on one
+    /// line when `compact` (Settings ▸ Project ▸ Save Compact Project Files).
+    pub fn to_file_json_with_view(&self, view: &SavedView, compact: bool) -> Result<String, ProjectError> {
+        craft_ecproj_format::check_schema(self.schema)
+            .map_err(|e| ProjectError::Invalid(format!("the project can't be saved: it holds a value a project file can't store ({e})")))?;
+        let file = craft_ecproj_format::File::new(APP_VERSION, view, self);
+        file_check::check(&file)
+            .map_err(|e| ProjectError::Invalid(format!("the project can't be saved: it holds a value a project file can't store ({e})")))?;
+        let text =
+            if compact { file.to_json_compact() } else { file.to_json() }.map_err(|e| ProjectError::Invalid(format!("the project can't be saved: {e}")))?;
+        #[cfg(debug_assertions)]
+        Project::from_json(&text)
+            .map_err(|e| ProjectError::Invalid(format!("the project can't be saved: it holds a value a project file can't store ({e})")))?;
+        Ok(text)
+    }
+    pub fn to_json(&self) -> String {
+        serde_json::to_string_pretty(self).unwrap_or_default()
+    }
+    /// [`Project::to_json`] without indentation: smaller and faster (auto-saves).
+    pub fn to_json_compact(&self) -> String {
+        serde_json::to_string(self).unwrap_or_default()
+    }
+    pub fn from_json(s: &str) -> Result<Project, ProjectError> {
+        Project::from_json_repaired(s).map(|(p, _)| p)
+    }
+    /// [`Project::from_json`], also returning one line per value that was out of [`limits`] and
+    /// was corrected (a composition of a billion pixels, a zero frame rate…), so a corrupt or
+    /// hostile file still opens, within bounds, and the user can be told what changed.
+    pub fn from_json_repaired(s: &str) -> Result<(Project, Vec<String>), ProjectError> {
+        let mut p: Project = serde_json::from_str(s).map_err(|e| ProjectError::Invalid(e.to_string()))?;
+        craft_ecproj_format::check_schema(p.schema).map_err(|e| ProjectError::Invalid(e.to_string()))?;
+        p.fix_next_id();
+        let mut notes = vec![];
+        for item in p.items.values_mut() {
+            limits::repair_item(item, &mut notes);
+        }
+        // An item inside a composition, a solid or footage (or inside an item that is not there) is
+        // in no folder: it would not be listed under any parent. It moves to the top level.
+        let folders: std::collections::BTreeSet<ItemId> = p.items.values().filter(|i| i.is_folder()).map(|i| i.id).collect();
+        for item in p.items.values_mut() {
+            if let Some(parent) = item.parent
+                && !folders.contains(&parent)
+            {
+                notes.push(format!("{}: its parent is not a folder, moved to the top level", item.name));
+                item.parent = None;
+            }
+        }
+        Ok((p, notes))
+    }
+}
+
+/// The layers whose audio something draws ([`Project::heard_layers`]): their Audio switch, Audio
+/// group and audio effects change pixels.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Heard {
+    /// Some layer has an expression (it can read anything).
+    pub expressions: bool,
+    /// Some expression may read a layer's audio ([`Project::reads_audio`]).
+    audio_exprs: bool,
+    layers: std::collections::BTreeSet<(ItemId, LayerId)>,
+}
+
+impl Heard {
+    /// Something may draw the audio of layer `layer` of comp `comp`: a layer picks it
+    /// ([`Self::picked`]) or an expression may read it.
+    pub fn contains(&self, comp: ItemId, layer: LayerId) -> bool {
+        self.audio_exprs || self.picked(comp, layer)
+    }
+
+    /// A layer picks layer `layer` of comp `comp` in an effect (or a precomp of it), so draws its
+    /// audio. Expressions aside: they draw in their own layers.
+    pub fn picked(&self, comp: ItemId, layer: LayerId) -> bool {
+        self.layers.contains(&(comp, layer))
+    }
+
+    /// Heard in `self` or in `o` (the states before and after an edit).
+    pub fn union(mut self, o: &Heard) -> Heard {
+        self.expressions |= o.expressions;
+        self.audio_exprs |= o.audio_exprs;
+        self.layers.extend(o.layers.iter().copied());
+        self
+    }
+}
+
+#[cfg(test)]
+mod availability_tests {
+    use super::*;
+
+    #[test]
+    fn inventory_status_tracks_original_and_proxy_independently() {
+        let footage = crate::Footage { path: "/original.png".into(), ..Default::default() };
+        let mut item = Item {
+            id: ItemId(1),
+            name: "Plate".into(),
+            label: Label::None,
+            comment: String::new(),
+            parent: None,
+            kind: ItemKind::Footage(footage.clone()),
+            proxy: None,
+        };
+        assert!(!item.has_missing_footage());
+        item.proxy = Some(Box::new(Proxy { footage: crate::Footage { path: "/proxy.png".into(), missing: true, ..footage.clone() }, enabled: false }));
+        assert!(item.has_missing_footage(), "unused missing proxies still need repair");
+        item.proxy.as_mut().unwrap().footage.missing = false;
+        assert!(!item.has_missing_footage());
+        if let ItemKind::Footage(f) = &mut item.kind {
+            f.missing = true;
+        }
+        item.proxy.as_mut().unwrap().enabled = true;
+        assert!(item.has_missing_footage(), "a working proxy does not make the original available");
+    }
+}
diff --git a/crates/project/src/layer.rs b/crates/project/src/layer.rs
new file mode 100644
index 000000000..b13c1d980
--- /dev/null
+++ b/crates/project/src/layer.rs
@@ -0,0 +1,665 @@
+use super::item::{ItemId, LayerId};
+use super::settings::Marker;
+use super::{BlendMode, Deserialize, GroupKind, Label, Node, ParamUi, PropGroup, Property, Serialize, Tick, Value};
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LightKind {
+    Parallel,
+    Spot,
+    #[default]
+    Point,
+    Ambient,
+    Environment,
+}
+
+impl LightKind {
+    pub const ALL: [LightKind; 5] = [LightKind::Parallel, LightKind::Spot, LightKind::Point, LightKind::Ambient, LightKind::Environment];
+    pub fn label(self) -> &'static str {
+        match self {
+            LightKind::Parallel => "Parallel",
+            LightKind::Spot => "Spot",
+            LightKind::Point => "Point",
+            LightKind::Ambient => "Ambient",
+            LightKind::Environment => "Environment",
+        }
+    }
+}
+
+/// A parametric 3D primitive (Layer ▸ New ▸ Cube/Sphere/Plane/Torus/Cone/Cylinder).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum PrimitiveKind {
+    #[default]
+    Cube,
+    Sphere,
+    Plane,
+    Torus,
+    Cone,
+    Cylinder,
+}
+
+impl PrimitiveKind {
+    pub const ALL: [PrimitiveKind; 6] =
+        [PrimitiveKind::Cube, PrimitiveKind::Sphere, PrimitiveKind::Plane, PrimitiveKind::Torus, PrimitiveKind::Cone, PrimitiveKind::Cylinder];
+    pub fn label(self) -> &'static str {
+        match self {
+            PrimitiveKind::Cube => "Cube",
+            PrimitiveKind::Sphere => "Sphere",
+            PrimitiveKind::Plane => "Plane",
+            PrimitiveKind::Torus => "Torus",
+            PrimitiveKind::Cone => "Cone",
+            PrimitiveKind::Cylinder => "Cylinder",
+        }
+    }
+    pub fn parse(s: &str) -> Option<PrimitiveKind> {
+        PrimitiveKind::ALL.into_iter().find(|k| k.label().eq_ignore_ascii_case(s.trim()))
+    }
+}
+
+/// What a layer shows.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum LayerSource {
+    /// Footage item (video, still, sequence, audio).
+    Footage {
+        item: ItemId,
+    },
+    /// Nested composition (precomp).
+    Comp {
+        item: ItemId,
+    },
+    /// Solid item (solids also back adjustment layers).
+    Solid {
+        item: ItemId,
+    },
+    Text,
+    Shape,
+    Null,
+    Camera,
+    Light {
+        kind: LightKind,
+    },
+    /// An imported 3D model (a footage item of kind [`FootageKind::Model`]; Advanced 3D).
+    Model {
+        item: ItemId,
+    },
+    /// A parametric 3D primitive (Advanced 3D).
+    Primitive {
+        kind: PrimitiveKind,
+    },
+}
+
+impl LayerSource {
+    pub fn item(&self) -> Option<ItemId> {
+        match self {
+            LayerSource::Footage { item } | LayerSource::Comp { item } | LayerSource::Solid { item } | LayerSource::Model { item } => Some(*item),
+            _ => None,
+        }
+    }
+    pub fn type_name(&self) -> &'static str {
+        match self {
+            LayerSource::Footage { .. } => "Footage",
+            LayerSource::Comp { .. } => "Composition",
+            LayerSource::Solid { .. } => "Solid",
+            LayerSource::Text => "Text",
+            LayerSource::Shape => "Shape",
+            LayerSource::Null => "Null",
+            LayerSource::Camera => "Camera",
+            LayerSource::Light { .. } => "Light",
+            LayerSource::Model { .. } => "3D Model",
+            LayerSource::Primitive { .. } => "3D Primitive",
+        }
+    }
+    /// Layers with pixels (cameras, lights and nulls have none).
+    pub fn is_av(&self) -> bool {
+        !matches!(self, LayerSource::Camera | LayerSource::Light { .. } | LayerSource::Null)
+    }
+    /// A 3D model or primitive layer (meshes; drawn by the Advanced 3D renderer).
+    pub fn is_model(&self) -> bool {
+        matches!(self, LayerSource::Model { .. } | LayerSource::Primitive { .. })
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Quality {
+    #[default]
+    Best,
+    Draft,
+    Wireframe,
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Sampling {
+    #[default]
+    Bilinear,
+    Bicubic,
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum FrameBlend {
+    #[default]
+    Off,
+    FrameMix,
+    PixelMotion,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Switches {
+    pub video: bool,
+    pub audio: bool,
+    pub solo: bool,
+    pub locked: bool,
+    pub shy: bool,
+    /// Collapse transformations (precomps) / continuously rasterize (vector layers).
+    pub collapse: bool,
+    pub quality: Quality,
+    pub sampling: Sampling,
+    pub effects: bool,
+    pub frame_blend: FrameBlend,
+    pub motion_blur: bool,
+    pub adjustment: bool,
+    pub three_d: bool,
+    pub guide: bool,
+}
+
+impl Default for Switches {
+    fn default() -> Self {
+        Switches {
+            video: true,
+            audio: true,
+            solo: false,
+            locked: false,
+            shy: false,
+            collapse: false,
+            quality: Quality::Best,
+            sampling: Sampling::Bilinear,
+            effects: true,
+            frame_blend: FrameBlend::Off,
+            motion_blur: false,
+            adjustment: false,
+            three_d: false,
+            guide: false,
+        }
+    }
+}
+
+// What a frame's pixels depend on. Caches key on it: the Lock and Shy switches and Hide Shy
+// Layers never change pixels, and the Audio switch, the Audio group and audio effects change them
+// only when something draws the layer's audio (a waveform or spectrum picks it, see
+// [`crate::Project::heard_layers`]), so editing those keeps cached frames (#103).
+
+/// Is `id` an audio effect (applied by the audio mix rather than the compositor)?
+pub fn is_audio_effect(id: &str) -> bool {
+    id.starts_with("ec.audio.")
+}
+
+/// Does effect `id` read its own layer at other times (`EffectHost::self_at`, `layer_at` on
+/// itself): the time effects (Echo, Posterize Time, Timewarp…), simulations, temporal smoothing
+/// and analysis (Remove Grain, Auto Levels, Color Stabilizer's reference frame, Warp Stabilizer,
+/// Roto Brush…) and Clone strokes with a time offset? On a precomp layer, a change at one nested
+/// time then reaches frames of the layer far from where it shows. Plug-in effects (every id
+/// outside `ec.`) count too: plug-in API 2 reads the input at other times (`PluginHost`).
+// ponytail: hand-kept list of the effects that call `self_at`; a new one must be added here.
+pub fn reads_other_frames(id: &str) -> bool {
+    !id.starts_with("ec.") || id.starts_with("ec.time.") || id.starts_with("ec.sim.") || READS_OTHER_FRAMES.contains(&id)
+}
+
+/// The effects outside `ec.time.` and `ec.sim.` that read their own layer at other times.
+const READS_OTHER_FRAMES: &[&str] = &[
+    "ec.noise.removegrain",
+    "ec.color.autolevels",
+    "ec.color.autocontrast",
+    "ec.color.autocolor",
+    "ec.color.shadowhighlight",
+    "ec.color.colorstabilizer",
+    "ec.matte.refinesoft",
+    "ec.matte.refinehard",
+    "ec.matte.rotobrush",
+    "ec.matte.objectmatte",
+    "ec.blur.camerashakedeblur",
+    "ec.distort.rollingshutterrepair",
+    "ec.distort.warpstabilizer",
+    "ec.key.ccsimplewireremoval",
+    "ec.paint.paint",
+];
+
+impl Switches {
+    /// These switches with Audio, Lock and Shy at their defaults.
+    pub fn pixels(&self) -> Switches {
+        Switches { audio: true, locked: false, shy: false, ..self.clone() }
+    }
+
+    /// The switches that change the pixels of a layer: [`Self::pixels`], keeping Audio when
+    /// something draws the layer's audio (`heard`).
+    pub fn picture(&self, heard: bool) -> Switches {
+        Switches { audio: if heard { self.audio } else { true }, ..self.pixels() }
+    }
+}
+
+/// A node only the audio mix reads: the layer's Audio group, an audio effect.
+fn audio_only(n: &Node, root: bool) -> bool {
+    match n {
+        Node::Group(g) => (root && g.match_id == "audio") || matches!(&g.kind, GroupKind::Effect { effect } if is_audio_effect(effect)),
+        Node::Prop(_) => false,
+    }
+}
+
+/// `a` and `b` are equal but for their audio-only nodes ([`audio_only`]: the root's Audio group,
+/// the effects in its Effects group that are audio effects).
+fn same_picture_props(a: &PropGroup, b: &PropGroup) -> bool {
+    fn head(a: &PropGroup, b: &PropGroup) -> bool {
+        // Every field (no `..`: a new field must be considered here).
+        let PropGroup { uid, match_id, name, kind, enabled, label, children: _ } = a;
+        *uid == b.uid && *match_id == b.match_id && *name == b.name && *kind == b.kind && *enabled == b.enabled && *label == b.label
+    }
+    fn children(a: &PropGroup, b: &PropGroup, root: bool) -> bool {
+        let mut x = a.children.iter().filter(|n| !audio_only(n, root));
+        let mut y = b.children.iter().filter(|n| !audio_only(n, root));
+        loop {
+            match (x.next(), y.next()) {
+                (None, None) => return true,
+                (Some(Node::Group(g)), Some(Node::Group(h))) if root && g.match_id == "effects" && h.match_id == "effects" => {
+                    if !(head(g, h) && children(g, h, false)) {
+                        return false;
+                    }
+                }
+                (Some(m), Some(n)) if m == n => {}
+                _ => return false,
+            }
+        }
+    }
+    head(a, b) && children(a, b, true)
+}
+
+/// `g` (a layer's property tree) without its audio-only nodes ([`same_picture_props`]).
+fn picture_props(g: &PropGroup) -> PropGroup {
+    let mut g = g.clone();
+    g.children.retain(|n| !audio_only(n, true));
+    for n in &mut g.children {
+        if let Node::Group(e) = n
+            && e.match_id == "effects"
+        {
+            e.children.retain(|n| !audio_only(n, false));
+        }
+    }
+    g
+}
+
+impl Layer {
+    /// Draws the same pixels as `o`: equal but for the Audio, Lock and Shy switches and what only
+    /// the audio mix reads (nothing draws its audio).
+    pub fn same_pixels(&self, o: &Layer) -> bool {
+        self.same_pixels_with(o, true, false)
+    }
+
+    /// [`Self::same_pixels`], with the markers counting only when `with_markers` (they are read by
+    /// expressions alone, so a project without any can edit them freely) and the audio (the Audio
+    /// switch, the Audio group, audio effects) only when `heard`: something draws it.
+    pub fn same_pixels_with(&self, o: &Layer, with_markers: bool, heard: bool) -> bool {
+        // Every field (no `..`: a new field must be considered here); the property tree last.
+        let Layer {
+            id,
+            name,
+            // Whether the name follows the text changes no pixels until the name changes.
+            name_follows_text: _,
+            source,
+            label,
+            comment,
+            start_time,
+            in_point,
+            out_point,
+            stretch,
+            switches,
+            blend_mode,
+            preserve_transparency,
+            track_matte,
+            parent,
+            markers,
+            markers_locked,
+            auto_orient,
+            environment,
+            environment_background,
+            props,
+        } = self;
+        *id == o.id
+            && *name == o.name
+            && *source == o.source
+            && *label == o.label
+            && *comment == o.comment
+            && *start_time == o.start_time
+            && *in_point == o.in_point
+            && *out_point == o.out_point
+            && *stretch == o.stretch
+            && switches.picture(heard) == o.switches.picture(heard)
+            && *blend_mode == o.blend_mode
+            && *preserve_transparency == o.preserve_transparency
+            && *track_matte == o.track_matte
+            && *parent == o.parent
+            && (!with_markers || *markers == o.markers)
+            && *markers_locked == o.markers_locked
+            && *auto_orient == o.auto_orient
+            && *environment == o.environment
+            && *environment_background == o.environment_background
+            && (if heard { *props == o.props } else { same_picture_props(props, &o.props) })
+    }
+
+    /// The comp-time spans where `self` draws differently than `o` when the two differ only in
+    /// the keyframes of Transform properties (a key's value, ease or interpolation moved in the
+    /// Timeline or Graph Editor): from two keys before the first changed key to two after the
+    /// last (auto-Bezier and continuous tangents reach the neighbouring segments), to the
+    /// layer's in or out point past the first or last key (values hold there). `None` for any
+    /// other difference, a static value, an expression on the layer (it can read the keyed
+    /// property at other times), roving or muted keys, a time remap or a time effect (it reads other
+    /// times): those reach the layer's whole span.
+    pub fn keyframe_spans(&self, o: &Layer, with_markers: bool, heard: bool) -> Option<Vec<(Tick, Tick)>> {
+        let transform = |l: &Layer| l.props.group("transform").cloned();
+        let (t1, t0) = (transform(self)?, transform(o)?);
+        let reads_time = |l: &Layer| {
+            l.props.get("timeRemap").is_some()
+                || l.props.group("effects").is_some_and(|e| {
+                    e.children.iter().any(|n| matches!(n, Node::Group(f) if matches!(&f.kind, GroupKind::Effect { effect } if reads_other_frames(effect))))
+                })
+        };
+        let has_expr = |l: &Layer| {
+            let mut any = false;
+            l.props.walk("", &mut |_, p| any |= p.has_expression());
+            any
+        };
+        if reads_time(self) || reads_time(o) || has_expr(self) || has_expr(o) {
+            return None;
+        }
+        // Everything but the Transform group draws the same.
+        let rest = |l: &Layer| {
+            let mut l = l.clone();
+            l.props.children.retain(|n| !matches!(n, Node::Group(g) if g.match_id == "transform"));
+            l
+        };
+        let head = |g: &PropGroup| PropGroup { children: vec![], ..g.clone() };
+        if !rest(self).same_pixels_with(&rest(o), with_markers, heard) || head(&t1) != head(&t0) || t1.children.len() != t0.children.len() {
+            return None;
+        }
+        let mut spans = Vec::new();
+        for (n1, n0) in t1.children.iter().zip(&t0.children) {
+            if n1 == n0 {
+                continue;
+            }
+            let (Node::Prop(p1), Node::Prop(p0)) = (n1, n0) else { return None };
+            let bare = |p: &Property| Property { keys: vec![], value: Value::Scalar(0.0), ..p.clone() };
+            // (muted keys are skipped: the keys around an edit that play can be any distance away)
+            if bare(p1) != bare(p0) || p1.keys.is_empty() || p0.keys.is_empty() || p1.keys.iter().chain(&p0.keys).any(|k| k.roving || k.muted) {
+                return None;
+            }
+            // Keys only one side has as they are (added, removed, edited, moved).
+            let changed: Vec<Tick> =
+                p1.keys.iter().filter(|k| !p0.keys.contains(k)).chain(p0.keys.iter().filter(|k| !p1.keys.contains(k))).map(|k| k.time).collect();
+            let (Some(first), Some(last)) = (changed.iter().min(), changed.iter().max()) else { continue };
+            // Two keys before the first changed one and two after the last, on either side (the
+            // first or last key when there are fewer: values hold beyond it). Past the first or
+            // last key the change reaches the in or out point (`None`).
+            let mut lo = Some(Tick(i64::MAX));
+            let mut hi = Some(Tick(i64::MIN));
+            for keys in [&p1.keys, &p0.keys] {
+                let before = keys.iter().filter(|k| k.time < *first).count();
+                let back = if before == 0 { None } else { keys.get(before.saturating_sub(2)) };
+                lo = lo.zip(back).map(|(a, k)| a.min(k.time));
+                let upto = keys.iter().filter(|k| k.time <= *last).count();
+                let ahead = if upto >= keys.len() { None } else { keys.get(upto.saturating_add(1).min(keys.len().saturating_sub(1))) };
+                hi = hi.zip(ahead).map(|(a, k)| a.max(k.time));
+            }
+            let (x, y) = (lo.map_or(self.in_point, |t| self.comp_time(t)), hi.map_or(self.out_point, |t| self.comp_time(t)));
+            let (x, y) = (x.min(y).max(self.in_point), x.max(y).min(self.out_point));
+            if x <= y {
+                spans.push((x, y));
+            }
+        }
+        Some(spans)
+    }
+
+    /// This layer with what doesn't change its pixels at its defaults (see
+    /// [`Self::same_pixels_with`]), for keys that hash it; `None` when it already is.
+    pub fn picture_form(&self, heard: bool) -> Option<Layer> {
+        let switches = self.switches.picture(heard);
+        let audio = !heard
+            && (self.props.children.iter().any(|n| audio_only(n, true))
+                || self
+                    .props
+                    .children
+                    .iter()
+                    .any(|n| matches!(n, Node::Group(e) if e.match_id == "effects" && e.children.iter().any(|n| audio_only(n, false)))));
+        if switches == self.switches && !audio {
+            return None;
+        }
+        let mut l = Layer { switches, ..self.clone() };
+        if audio {
+            l.props = picture_props(&self.props);
+        }
+        Some(l)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum MatteKind {
+    #[default]
+    Alpha,
+    AlphaInverted,
+    Luma,
+    LumaInverted,
+}
+
+impl MatteKind {
+    pub const ALL: [MatteKind; 4] = [MatteKind::Alpha, MatteKind::AlphaInverted, MatteKind::Luma, MatteKind::LumaInverted];
+    pub fn label(self) -> &'static str {
+        match self {
+            MatteKind::Alpha => "Alpha Matte",
+            MatteKind::AlphaInverted => "Alpha Inverted Matte",
+            MatteKind::Luma => "Luma Matte",
+            MatteKind::LumaInverted => "Luma Inverted Matte",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TrackMatte {
+    pub layer: LayerId,
+    pub kind: MatteKind,
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AutoOrient {
+    #[default]
+    Off,
+    AlongPath,
+    TowardsCamera,
+    TowardsPointOfInterest,
+}
+
+/// A stretch written as `null` (a NaN or infinite stretch: JSON holds neither, and auto-saves
+/// write it so) reads as NaN, so the project still opens and loading brings it to 100 % with a
+/// note ([`crate::limits::stretch`], #3247) instead of the whole file being refused. An infinite
+/// stretch therefore also reopens at 100 %, not at ±9900 %.
+fn stretch_or_nan<'de, D: serde::Deserializer<'de>>(d: D) -> Result<f64, D::Error> {
+    Ok(Option::<f64>::deserialize(d)?.unwrap_or(f64::NAN))
+}
+
+/// `t × mul / div` in ticks, within [`Tick::MIN`]..=[`Tick::MAX`] (the cast saturates, NaN is 0),
+/// so a layer time of an extreme stretch can't overflow later tick arithmetic.
+fn scaled(t: Tick, mul: f64, div: f64) -> Tick {
+    Tick(((t.0 as f64 * mul / div) as i64).clamp(Tick::MIN.0, Tick::MAX.0))
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Layer {
+    pub id: LayerId,
+    pub name: String,
+    /// A text layer's name follows the first line of its Source Text until the user renames it
+    /// (After Effects). `Some(true)`: it follows, `Some(false)`: the user named it. `None` (older
+    /// projects, layers made before this was recorded): see [`Layer::name_follows_text()`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name_follows_text: Option<bool>,
+    pub source: LayerSource,
+    pub label: Label,
+    #[serde(default)]
+    pub comment: String,
+    /// Comp time where the layer's time 0 sits.
+    pub start_time: Tick,
+    /// Visible span in comp time.
+    pub in_point: Tick,
+    pub out_point: Tick,
+    /// Time stretch in percent (100 = normal, negative = reversed).
+    #[serde(deserialize_with = "stretch_or_nan")]
+    pub stretch: f64,
+    pub switches: Switches,
+    pub blend_mode: BlendMode,
+    #[serde(default)]
+    pub preserve_transparency: bool,
+    #[serde(default)]
+    pub track_matte: Option<TrackMatte>,
+    #[serde(default)]
+    pub parent: Option<LayerId>,
+    #[serde(default)]
+    pub markers: Vec<Marker>,
+    /// Layer ▸ Markers ▸ Lock Markers.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub markers_locked: bool,
+    #[serde(default)]
+    pub auto_orient: AutoOrient,
+    /// Layer ▸ Environment Layer: the layer is the environment (image-based light and
+    /// reflections) of Advanced 3D comps instead of being drawn.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub environment: bool,
+    /// Layer ▸ Light ▸ Create Environment Light Background Layer: the layer's (equirectangular)
+    /// image is drawn as the 3D scene's backdrop, seen through the camera, instead of as a card.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub environment_background: bool,
+    /// The property tree (Masks, Effects, Transform, Text, Contents, Camera/Light options…).
+    pub props: PropGroup,
+}
+
+/// The name a text layer takes from its text: the first 40 characters of the first line. A line
+/// ends at a line feed or at a bare carriage return (After Effects' paragraph break).
+pub fn text_layer_name(text: &str) -> String {
+    text.split(['\r', '\n']).next().unwrap_or("").chars().take(40).collect()
+}
+
+/// A text layer's default name when its text gives none: "Text", numbered "Text 2", "Text 3"…
+fn is_default_text_name(name: &str) -> bool {
+    name == "Text" || name.strip_prefix("Text ").is_some_and(|n| !n.is_empty() && n.chars().all(|c| c.is_ascii_digit()))
+}
+
+impl Layer {
+    /// Whether this text layer's name follows its Source Text, whose first line gives the name
+    /// `current` (see [`text_layer_name`]). Without a recorded state (an older project), a name
+    /// that is empty, the text's own, or the default "Text"/"Text 2"… follows; any other name was
+    /// given by the user.
+    pub fn name_follows_text(&self, current: &str) -> bool {
+        self.name_follows_text.unwrap_or_else(|| self.name.is_empty() || self.name == current || is_default_text_name(&self.name))
+    }
+
+    /// The layers this layer reads: its parent, track matte, layer parameters (Displacement Map,
+    /// Audio Spectrum's Audio Layer…) and tracker targets.
+    pub fn referenced_layers(&self) -> Vec<LayerId> {
+        fn walk(g: &PropGroup, depth: usize, out: &mut Vec<LayerId>) {
+            if depth > 64 {
+                return;
+            }
+            if let GroupKind::Tracker { settings } = &g.kind
+                && let Some(t) = settings.target
+            {
+                out.push(t);
+            }
+            for c in &g.children {
+                match c {
+                    Node::Prop(p) => {
+                        for v in std::iter::once(&p.value).chain(p.keys.iter().map(|k| &k.value)) {
+                            if let Value::Layer(Some(id)) = v {
+                                out.push(LayerId(*id));
+                            }
+                        }
+                    }
+                    Node::Group(sub) => walk(sub, depth + 1, out),
+                }
+            }
+        }
+        let mut out: Vec<LayerId> = self.parent.iter().copied().chain(self.track_matte.iter().map(|m| m.layer)).collect();
+        walk(&self.props, 0, &mut out);
+        out
+    }
+
+    /// Layers this one picks in an effect or tracker (an Audio Spectrum's Audio Layer, a
+    /// Displacement Map's map layer…), itself included: [`Self::referenced_layers`] without the
+    /// parent and the track matte.
+    pub fn picked_layers(&self) -> Vec<LayerId> {
+        let skip = usize::from(self.parent.is_some()) + usize::from(self.track_matte.is_some());
+        self.referenced_layers().into_iter().skip(skip).collect()
+    }
+
+    pub fn is_active_at(&self, t: Tick) -> bool {
+        t >= self.in_point && t < self.out_point
+    }
+
+    /// The time stretch the layer plays at: [`Layer::stretch`] within
+    /// [`limits::stretch`](crate::limits::stretch) (a damaged value that got past loading, 0 or
+    /// NaN, never divides the layer's time by zero).
+    pub fn effective_stretch(&self) -> f64 {
+        crate::limits::stretch(self.stretch)
+    }
+
+    /// Layer time for a comp time (stretch-aware).
+    pub fn layer_time(&self, comp_t: Tick) -> Tick {
+        let d = comp_t - self.start_time;
+        let s = self.effective_stretch();
+        if (s - 100.0).abs() < 1e-9 { d } else { scaled(d, 100.0, s) }
+    }
+
+    /// Comp time for a layer time.
+    pub fn comp_time(&self, layer_t: Tick) -> Tick {
+        let s = self.effective_stretch();
+        if (s - 100.0).abs() < 1e-9 { self.start_time + layer_t } else { self.start_time + scaled(layer_t, s, 100.0) }
+    }
+
+    pub fn transform(&self) -> Option<&PropGroup> {
+        self.props.sub("transform")
+    }
+
+    pub fn transform_mut(&mut self) -> Option<&mut PropGroup> {
+        self.props.sub_mut("transform")
+    }
+
+    pub fn effects(&self) -> Option<&PropGroup> {
+        self.props.sub("effects")
+    }
+
+    pub fn masks(&self) -> Option<&PropGroup> {
+        self.props.sub("masks")
+    }
+
+    /// The labels popup property `p` of this layer offers: Text Path Options ▸ Path lists None and
+    /// the layer's masks (value k = mask k), every other popup its own options. `None` when `p` is
+    /// not a popup.
+    pub fn popup_options<'a>(&'a self, p: &'a Property) -> Option<std::borrow::Cow<'a, [String]>> {
+        if self.props.prop("text/pathOptions/path").is_some_and(|q| q.uid == p.uid) {
+            let masks = self.masks().into_iter().flat_map(|m| m.groups().map(|g| g.name.clone()));
+            return Some(std::iter::once("None".to_string()).chain(masks).collect::<Vec<_>>().into());
+        }
+        match &p.ui {
+            ParamUi::Popup { options } => Some(options.as_slice().into()),
+            _ => None,
+        }
+    }
+
+    pub fn is_camera(&self) -> bool {
+        matches!(self.source, LayerSource::Camera)
+    }
+
+    pub fn is_light(&self) -> bool {
+        matches!(self.source, LayerSource::Light { .. })
+    }
+
+    /// The layer participates in 3D (3D switch, or cameras/lights which are always 3D).
+    pub fn is_3d(&self) -> bool {
+        self.switches.three_d || self.is_camera() || self.is_light()
+    }
+
+    pub fn has_video(&self) -> bool {
+        self.source.is_av() && self.switches.video
+    }
+}
diff --git a/crates/project/src/layers.rs b/crates/project/src/layers.rs
new file mode 100644
index 000000000..6119a5753
--- /dev/null
+++ b/crates/project/src/layers.rs
@@ -0,0 +1,209 @@
+//! A comp's layer stack with structural sharing.
+//!
+//! Every undoable edit keeps the previous project for undo, so the comp it touches is shared and
+//! `Arc::make_mut` copies it. With the layers stored inline that copy is the whole stack, every
+//! layer and every keyframe, so an edit costs time in proportion to the comp's size and a script
+//! that sets many keys in a big comp goes quadratic. Here each layer sits behind its own `Arc`:
+//! copying the stack copies pointers, and only the layer an edit actually changes is copied.
+//!
+//! The API mirrors the `Vec<Layer>` it replaces. Serialized form is identical (a list of layers).
+
+use std::ops::{Index, IndexMut};
+use std::sync::Arc;
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+use super::layer::Layer;
+
+/// Layer #1 first (top of the stack).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Layers(Vec<Arc<Layer>>);
+
+impl Layers {
+    pub const fn new() -> Self {
+        Self(Vec::new())
+    }
+    pub fn with_capacity(n: usize) -> Self {
+        Self(Vec::with_capacity(n))
+    }
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+    pub fn iter(&self) -> impl DoubleEndedIterator<Item = &Layer> + ExactSizeIterator + Clone {
+        self.0.iter().map(|l| &**l)
+    }
+    /// Mutable access to every layer: each one that is still shared with an undo state is copied,
+    /// so prefer [`Layers::get_mut`] (or `iter` to find, then `get_mut`) when only some change.
+    pub fn iter_mut(&mut self) -> impl DoubleEndedIterator<Item = &mut Layer> + ExactSizeIterator {
+        self.0.iter_mut().map(Arc::make_mut)
+    }
+    /// Mutable access to just the layers `keep` accepts. `keep` reads each layer without copying
+    /// it; only the matching ones are copied (if shared). Use this, not `iter_mut().filter(..)`.
+    pub fn iter_mut_where<'a>(&'a mut self, mut keep: impl FnMut(&Layer) -> bool + 'a) -> impl Iterator<Item = &'a mut Layer> + 'a {
+        self.0.iter_mut().filter(move |l| keep(l)).map(Arc::make_mut)
+    }
+    /// The first layer `pred` accepts, copied only if it is that one. Use this, not `iter_mut().find(..)`.
+    pub fn find_mut(&mut self, mut pred: impl FnMut(&Layer) -> bool) -> Option<&mut Layer> {
+        self.0.iter_mut().find(|l| pred(l)).map(Arc::make_mut)
+    }
+    pub fn get(&self, i: usize) -> Option<&Layer> {
+        self.0.get(i).map(|l| &**l)
+    }
+    pub fn get_mut(&mut self, i: usize) -> Option<&mut Layer> {
+        self.0.get_mut(i).map(Arc::make_mut)
+    }
+    pub fn first(&self) -> Option<&Layer> {
+        self.get(0)
+    }
+    pub fn last(&self) -> Option<&Layer> {
+        self.0.last().map(|l| &**l)
+    }
+    pub fn first_mut(&mut self) -> Option<&mut Layer> {
+        self.get_mut(0)
+    }
+    pub fn last_mut(&mut self) -> Option<&mut Layer> {
+        self.0.last_mut().map(Arc::make_mut)
+    }
+    pub fn push(&mut self, l: Layer) {
+        self.0.push(Arc::new(l));
+    }
+    pub fn insert(&mut self, i: usize, l: Layer) {
+        self.0.insert(i, Arc::new(l));
+    }
+    pub fn remove(&mut self, i: usize) -> Layer {
+        Arc::unwrap_or_clone(self.0.remove(i))
+    }
+    pub fn pop(&mut self) -> Option<Layer> {
+        self.0.pop().map(Arc::unwrap_or_clone)
+    }
+    pub fn retain(&mut self, mut f: impl FnMut(&Layer) -> bool) {
+        self.0.retain(|l| f(l));
+    }
+    pub fn swap(&mut self, a: usize, b: usize) {
+        self.0.swap(a, b);
+    }
+    pub fn truncate(&mut self, n: usize) {
+        self.0.truncate(n);
+    }
+    pub fn clear(&mut self) {
+        self.0.clear();
+    }
+    pub fn reverse(&mut self) {
+        self.0.reverse();
+    }
+    pub fn sort_by_key<K: Ord>(&mut self, mut f: impl FnMut(&Layer) -> K) {
+        self.0.sort_by_key(|l| f(l));
+    }
+    pub fn sort_by(&mut self, mut f: impl FnMut(&Layer, &Layer) -> std::cmp::Ordering) {
+        self.0.sort_by(|a, b| f(a, b));
+    }
+    pub fn rotate_left(&mut self, n: usize) {
+        self.0.rotate_left(n);
+    }
+    pub fn rotate_right(&mut self, n: usize) {
+        self.0.rotate_right(n);
+    }
+    /// `layers[range].rotate_left(n)` (a slice of `Arc`s can't be handed out as a `&mut [Layer]`).
+    pub fn rotate_range_left(&mut self, r: impl std::slice::SliceIndex<[Arc<Layer>], Output = [Arc<Layer>]>, n: usize) {
+        if let Some(s) = self.0.get_mut(r) {
+            s.rotate_left(n);
+        }
+    }
+    pub fn rotate_range_right(&mut self, r: impl std::slice::SliceIndex<[Arc<Layer>], Output = [Arc<Layer>]>, n: usize) {
+        if let Some(s) = self.0.get_mut(r) {
+            s.rotate_right(n);
+        }
+    }
+    pub fn split_off(&mut self, at: usize) -> Layers {
+        Layers(self.0.split_off(at))
+    }
+    pub fn append(&mut self, other: &mut Layers) {
+        self.0.append(&mut other.0);
+    }
+    /// Remove a range of layers and return them (owned).
+    pub fn drain(&mut self, r: impl std::ops::RangeBounds<usize>) -> std::vec::IntoIter<Layer> {
+        self.0.drain(r).map(Arc::unwrap_or_clone).collect::<Vec<_>>().into_iter()
+    }
+    /// Whether `self` and `other` hold the very same (unchanged) layer at `i`: a cheap "did this
+    /// layer change" test between two project states.
+    pub fn same_at(&self, other: &Layers, i: usize) -> bool {
+        matches!((self.0.get(i), other.0.get(i)), (Some(a), Some(b)) if Arc::ptr_eq(a, b))
+    }
+    /// The shared layers themselves, for parallel iteration (`rayon` over `&[Arc<Layer>]`).
+    pub fn as_arcs(&self) -> &[Arc<Layer>] {
+        &self.0
+    }
+    pub fn to_vec(&self) -> Vec<Layer> {
+        self.iter().cloned().collect()
+    }
+}
+
+impl Index<usize> for Layers {
+    type Output = Layer;
+    fn index(&self, i: usize) -> &Layer {
+        &self.0[i]
+    }
+}
+
+impl IndexMut<usize> for Layers {
+    fn index_mut(&mut self, i: usize) -> &mut Layer {
+        Arc::make_mut(&mut self.0[i])
+    }
+}
+
+impl From<Vec<Layer>> for Layers {
+    fn from(v: Vec<Layer>) -> Self {
+        Self(v.into_iter().map(Arc::new).collect())
+    }
+}
+
+impl FromIterator<Layer> for Layers {
+    fn from_iter<I: IntoIterator<Item = Layer>>(it: I) -> Self {
+        Self(it.into_iter().map(Arc::new).collect())
+    }
+}
+
+impl Extend<Layer> for Layers {
+    fn extend<I: IntoIterator<Item = Layer>>(&mut self, it: I) {
+        self.0.extend(it.into_iter().map(Arc::new));
+    }
+}
+
+impl IntoIterator for Layers {
+    type Item = Layer;
+    type IntoIter = std::iter::Map<std::vec::IntoIter<Arc<Layer>>, fn(Arc<Layer>) -> Layer>;
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.into_iter().map(Arc::unwrap_or_clone as fn(Arc<Layer>) -> Layer)
+    }
+}
+
+impl<'a> IntoIterator for &'a Layers {
+    type Item = &'a Layer;
+    type IntoIter = std::iter::Map<std::slice::Iter<'a, Arc<Layer>>, fn(&'a Arc<Layer>) -> &'a Layer>;
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.iter().map(|l| &**l)
+    }
+}
+
+impl<'a> IntoIterator for &'a mut Layers {
+    type Item = &'a mut Layer;
+    type IntoIter = std::iter::Map<std::slice::IterMut<'a, Arc<Layer>>, fn(&'a mut Arc<Layer>) -> &'a mut Layer>;
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.iter_mut().map(Arc::make_mut)
+    }
+}
+
+impl Serialize for Layers {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.collect_seq(self.iter())
+    }
+}
+
+impl<'de> Deserialize<'de> for Layers {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        Vec::<Layer>::deserialize(d).map(Layers::from)
+    }
+}
diff --git a/crates/project/src/lib.rs b/crates/project/src/lib.rs
index a4bffbe0c..6d0a72976 100644
--- a/crates/project/src/lib.rs
+++ b/crates/project/src/lib.rs
@@ -1,13 +1,14 @@
 //! The EffectCraft document model.
 //!
 //! `Project` → items (folders, compositions, footage, solids) → `Comp` → `Layer` → property tree
-//! ([`props`]). Compositions sit behind `Arc` so undo snapshots share everything that did not
-//! change.
+//! ([`props`]). Compositions, and each layer within them ([`Layers`]), sit behind `Arc` so undo
+//! snapshots share everything that did not change.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 pub mod build;
 pub mod essential;
+mod file_check;
 pub mod limits;
 pub mod props;
 pub mod render_queue;
@@ -28,1335 +29,29 @@ use serde::{Deserialize, Serialize};
 pub use effectcraft_keyframe as keyframe;
 pub use effectcraft_keyframe::{Keyframe, Value};
 
-/// The project file schema. 2: effects on layers without a source rectangle (shape, text)
-/// measure positions from the top-left of their comp-sized bounds (effect space), not from
-/// the layer's origin; projects from schema 1 are converted when opened (#227).
-pub const SCHEMA_VERSION: u32 = 2;
-
-/// The first schema in which effect positions are in effect space (see [`SCHEMA_VERSION`]).
-pub const SCHEMA_EFFECT_SPACE: u32 = 2;
-
-/// The EffectCraft version, written into project files as `savedBy`.
-pub const APP_VERSION: &str = env!("CARGO_PKG_VERSION");
-
-/// The EffectCraft version that wrote a project file (its `savedBy`), when it says.
-pub fn saved_by(text: &str) -> Option<String> {
-    #[derive(Deserialize)]
-    struct Meta {
-        #[serde(rename = "savedBy", default)]
-        saved_by: Option<String>,
-    }
-    serde_json::from_str::<Meta>(text).ok()?.saved_by
-}
-
-/// The compositions that were open when a project file was saved and their current times
-/// (`activeComp`, `openComps` and `compTimes` next to `savedBy`), so it reopens where it was left
-/// (#748, #1714). Editor state rather than project
-/// content: opening a comp doesn't make the project unsaved, and it isn't part of
-/// [`Project`]. Older files have none; older versions ignore it.
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SavedView {
-    /// The comp shown in the viewer and the Timeline.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub active_comp: Option<ItemId>,
-    /// The open comps (Timeline tabs), in tab order.
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub open_comps: Vec<ItemId>,
-    /// Each comp's current time, so a project reopens on the frame it was saved at rather than
-    /// at 0, where its layers may not have started yet (#1714).
-    #[serde(skip_serializing_if = "BTreeMap::is_empty")]
-    pub comp_times: BTreeMap<ItemId, Tick>,
-}
-
-/// The view a project file was saved with ([`SavedView`]); empty for older files. Values that
-/// aren't ids are ignored (whether an id still names a comp is up to the caller).
-pub fn saved_view(text: &str) -> SavedView {
-    #[derive(Deserialize)]
-    struct Meta {
-        #[serde(rename = "activeComp", default)]
-        active_comp: Option<serde_json::Value>,
-        #[serde(rename = "openComps", default)]
-        open_comps: Option<serde_json::Value>,
-        #[serde(rename = "compTimes", default)]
-        comp_times: Option<serde_json::Value>,
-    }
-    let Ok(m) = serde_json::from_str::<Meta>(text) else { return SavedView::default() };
-    SavedView {
-        active_comp: m.active_comp.as_ref().and_then(serde_json::Value::as_u64).map(ItemId),
-        open_comps: m
-            .open_comps
-            .as_ref()
-            .and_then(serde_json::Value::as_array)
-            .map_or_else(Vec::new, |a| a.iter().filter_map(serde_json::Value::as_u64).map(ItemId).collect()),
-        comp_times: m
-            .comp_times
-            .as_ref()
-            .and_then(serde_json::Value::as_object)
-            .map_or_else(BTreeMap::new, |o| o.iter().filter_map(|(k, v)| Some((ItemId(k.parse().ok()?), Tick(v.as_i64()?)))).collect()),
-    }
-}
-
-/// Whether version `a` (`major.minor.patch`, pre-release suffixes ignored) is newer than `b`.
-pub fn is_newer_version(a: &str, b: &str) -> bool {
-    let parts = |v: &str| -> [u64; 3] {
-        let mut n = v.split(['-', '+']).next().unwrap_or("").split('.').map(|x| x.parse().unwrap_or(0));
-        [n.next().unwrap_or(0), n.next().unwrap_or(0), n.next().unwrap_or(0)]
-    };
-    parts(a) > parts(b)
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
-pub struct ItemId(pub u64);
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
-pub struct LayerId(pub u64);
-
-#[derive(Debug, thiserror::Error)]
-pub enum ProjectError {
-    #[error("no item {0:?}")]
-    NoItem(ItemId),
-    #[error("item {0:?} is not a composition")]
-    NotComp(ItemId),
-    #[error("no layer {0:?}")]
-    NoLayer(LayerId),
-    #[error("no property `{0}`")]
-    NoProperty(String),
-    #[error("{0}")]
-    Invalid(String),
-}
-
-/// Project bit depth.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum BitDepth {
-    #[default]
-    Bpc8,
-    Bpc16,
-    Bpc32,
-}
-
-impl BitDepth {
-    pub fn label(self) -> &'static str {
-        match self {
-            BitDepth::Bpc8 => "8 bpc",
-            BitDepth::Bpc16 => "16 bpc",
-            BitDepth::Bpc32 => "32 bpc",
-        }
-    }
-    pub fn next(self) -> BitDepth {
-        match self {
-            BitDepth::Bpc8 => BitDepth::Bpc16,
-            BitDepth::Bpc16 => BitDepth::Bpc32,
-            BitDepth::Bpc32 => BitDepth::Bpc8,
-        }
-    }
-    pub fn is_float(self) -> bool {
-        self == BitDepth::Bpc32
-    }
-    /// Quantisation levels per channel of the integer depths (8 bpc: 255; 16 bpc: 32768, After
-    /// Effects' "15 + 1" bit range), `None` for 32 bpc float.
-    pub fn levels(self) -> Option<f32> {
-        match self {
-            BitDepth::Bpc8 => Some(255.0),
-            BitDepth::Bpc16 => Some(32768.0),
-            BitDepth::Bpc32 => None,
-        }
-    }
-    pub fn bits(self) -> u32 {
-        match self {
-            BitDepth::Bpc8 => 8,
-            BitDepth::Bpc16 => 16,
-            BitDepth::Bpc32 => 32,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum TimeDisplayStyle {
-    #[default]
-    Timecode,
-    Frames,
-    /// Feet + Frames, 35 mm film (16 frames per foot).
-    Feet35,
-    /// Feet + Frames, 16 mm film (40 frames per foot).
-    Feet16,
-}
-
-impl TimeDisplayStyle {
-    /// Frames per foot of the Feet + Frames styles.
-    pub fn frames_per_foot(self) -> Option<i64> {
-        match self {
-            TimeDisplayStyle::Feet35 => Some(16),
-            TimeDisplayStyle::Feet16 => Some(40),
-            _ => None,
-        }
-    }
-    pub fn id(self) -> &'static str {
-        match self {
-            TimeDisplayStyle::Timecode => "timecode",
-            TimeDisplayStyle::Frames => "frames",
-            TimeDisplayStyle::Feet35 => "feet35",
-            TimeDisplayStyle::Feet16 => "feet16",
-        }
-    }
-    pub fn parse(s: &str) -> Option<TimeDisplayStyle> {
-        let k: String = s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase();
-        match k.as_str() {
-            "timecode" => Some(TimeDisplayStyle::Timecode),
-            "frames" => Some(TimeDisplayStyle::Frames),
-            "feet35" | "feetframes" | "feetandframes" | "feet35mm" | "35mm" | "feetframes35mm" => Some(TimeDisplayStyle::Feet35),
-            "feet16" | "feet16mm" | "16mm" | "feetframes16mm" => Some(TimeDisplayStyle::Feet16),
-            _ => None,
-        }
-    }
-}
-
-/// Project Settings ▸ Color ▸ Color Engine.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ColorEngine {
-    /// Built-in colour management (ICC-style working spaces).
-    #[default]
-    Adobe,
-    /// OCIO managed, with the built-in configuration (ACES working spaces).
-    Ocio,
-}
-
-/// Project Settings ▸ Color ▸ HDR: how over-range (HDR) values reach a standard-dynamic-range
-/// display or output.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HdrMode {
-    /// Values above 1.0 clip.
-    #[default]
-    Clip,
-    /// Highlights above 80% are companded (an exponential knee) into the remaining range.
-    Compand,
-    /// Extended Reinhard tone mapping of luminance (white at 4.0).
-    ToneMap,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ProjectSettings {
-    pub bit_depth: BitDepth,
-    /// Linearize Working Space: the working space uses linear light (1.0 gamma) for everything
-    /// (sources, effects, blending). Needs a working space.
-    pub linearize: bool,
-    /// Working Space (colour management). `None` = no colour management.
-    #[serde(default)]
-    pub working_space: Option<ColorSpace>,
-    /// Blend Colors Using 1.0 Gamma: layers blend in linear light (sources and effects stay in
-    /// the working space's encoding).
-    #[serde(default)]
-    pub blend_linear: bool,
-    pub time_display: TimeDisplayStyle,
-    /// Frame numbering starts at 0 (or 1).
-    pub frame_start: i64,
-    pub audio_sample_rate: u32,
-    /// Video Rendering and Effects ▸ Use: Mercury GPU Acceleration (`true`, the default; used
-    /// when a GPU adapter exists) or Mercury Software Only (`false`, the CPU compositor).
-    #[serde(default = "yes")]
-    pub gpu_acceleration: bool,
-    /// The project's comment (Metadata panel).
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub comment: String,
-    /// Color Engine (Adobe-style built-in or OCIO with ACES working spaces).
-    #[serde(default)]
-    pub color_engine: ColorEngine,
-    /// HDR handling for standard-dynamic-range output (display and renders).
-    #[serde(default)]
-    pub hdr: HdrMode,
-    /// The space the top-level comp is output in (renders and the viewer's source). `None` =
-    /// sRGB; Rec. 2100 PQ / HLG give HDR output.
-    #[serde(default)]
-    pub output_space: Option<ColorSpace>,
-    /// Working Gamma, 2.2 or 2.4 (`app.project.workingGamma`): with no working space, the curve
-    /// Interpret As Linear Light footage is encoded with and Blend Colors Using 1.0 Gamma
-    /// linearizes with: the sRGB curve at 2.2, a pure 2.4 power curve at 2.4. Ignored with a
-    /// working space (as in After Effects).
-    #[serde(default = "gamma_22")]
-    pub working_gamma: f64,
-}
-
-fn gamma_22() -> f64 {
-    2.2
-}
-
-impl ProjectSettings {
-    /// Working Gamma is 2.4 (anything else reads as 2.2).
-    pub fn working_gamma_24(&self) -> bool {
-        (self.working_gamma - 2.4).abs() < 0.05
-    }
-}
-
-impl Default for ProjectSettings {
-    fn default() -> Self {
-        ProjectSettings {
-            bit_depth: BitDepth::Bpc8,
-            linearize: false,
-            working_space: None,
-            blend_linear: false,
-            time_display: TimeDisplayStyle::Timecode,
-            frame_start: 0,
-            audio_sample_rate: 48_000,
-            gpu_acceleration: true,
-            comment: String::new(),
-            color_engine: ColorEngine::Adobe,
-            hdr: HdrMode::Clip,
-            output_space: None,
-            working_gamma: 2.2,
-        }
-    }
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct Marker {
-    pub time: Tick,
-    #[serde(default)]
-    pub duration: Tick,
-    #[serde(default)]
-    pub comment: String,
-    #[serde(default)]
-    pub label: Label,
-    #[serde(default)]
-    pub chapter: String,
-    #[serde(default)]
-    pub url: String,
-    #[serde(default)]
-    pub protected: bool,
-    /// Web link frame target (`_blank`, a frame name…).
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub frame_target: String,
-    /// Flash/video cue point (Event or Navigation) with name and parameters.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub cue_point: Option<CuePoint>,
-}
-
-/// A marker's cue point (Composition/Layer Marker dialog ▸ Cue Point).
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct CuePoint {
-    pub name: String,
-    /// Navigation (true) or Event cue point.
-    #[serde(default)]
-    pub navigation: bool,
-    /// (name, value) parameter pairs.
-    #[serde(default)]
-    pub params: Vec<(String, String)>,
-}
-
-/// 3D renderer of a composition.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum Renderer {
-    #[default]
-    Classic3D,
-    Advanced3D,
-}
-
-/// A composition's Resolution (the Composition panel's Resolution/Down Sample Factor popup, View ▸
-/// Resolution): how many of its pixels the viewer renders. Auto follows the magnification.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum Resolution {
-    #[default]
-    Auto,
-    Full,
-    Half,
-    Third,
-    Quarter,
-    /// View ▸ Resolution ▸ Custom: render every n-th pixel (2..=40).
-    Custom(u8),
-}
-
-impl Resolution {
-    pub const ALL: [Resolution; 5] = [Resolution::Auto, Resolution::Full, Resolution::Half, Resolution::Third, Resolution::Quarter];
-    pub fn label(self) -> &'static str {
-        match self {
-            Resolution::Auto => "Auto",
-            Resolution::Full => "Full",
-            Resolution::Half => "Half",
-            Resolution::Third => "Third",
-            Resolution::Quarter => "Quarter",
-            Resolution::Custom(_) => "Custom",
-        }
-    }
-    pub fn is_auto(&self) -> bool {
-        *self == Resolution::Auto
-    }
-    /// The down-sample factor (render every n-th pixel); `None` for Auto.
-    pub fn factor(self) -> Option<u8> {
-        match self {
-            Resolution::Auto => None,
-            Resolution::Full => Some(1),
-            Resolution::Half => Some(2),
-            Resolution::Third => Some(3),
-            Resolution::Quarter => Some(4),
-            Resolution::Custom(n) => Some(n),
-        }
-    }
-    /// The resolution that renders every `n`-th pixel (1 = Full … 4 = Quarter; up to 40).
-    pub fn from_factor(n: u64) -> Resolution {
-        match n.clamp(1, 40) {
-            1 => Resolution::Full,
-            2 => Resolution::Half,
-            3 => Resolution::Third,
-            4 => Resolution::Quarter,
-            n => Resolution::Custom(n as u8),
-        }
-    }
-    /// Render scale for a viewer magnification (and display pixel density).
-    pub fn scale(self, zoom: f32, ppp: f32) -> f64 {
-        match self.factor() {
-            Some(n) => 1.0 / f64::from(n.clamp(1, 40)),
-            // As in After Effects, Auto renders the pixels the magnification needs: the coarsest
-            // whole factor that still gives every screen pixel a rendered one (Full above 50 %,
-            // Half down to 33.3 %, Third down to 25 %, Quarter below), never fewer (#417).
-            None => {
-                let n = (1.0 / (zoom * ppp) as f64 + 1e-3).floor();
-                if n >= 1.0 { 1.0 / n.min(4.0) } else { 1.0 }
-            }
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Comp {
-    pub width: u32,
-    pub height: u32,
-    pub pixel_aspect: f64,
-    pub frame_rate: FrameRate,
-    pub duration: Tick,
-    /// Start timecode/frame shown for time 0.
-    pub display_start: Tick,
-    pub background: [f32; 3],
-    pub work_area: (Tick, Tick),
-    /// Layer #1 first (top of the stack).
-    pub layers: Vec<Layer>,
-    #[serde(default)]
-    pub markers: Vec<Marker>,
-    pub shutter_angle: f64,
-    pub shutter_phase: f64,
-    /// Samples Per Frame: the minimum motion-blur samples (and the count for 3D layers).
-    pub motion_blur_samples: u32,
-    /// Adaptive Sample Limit (Composition Settings ▸ Advanced): the most samples a 2D layer gets
-    /// when it moves far within the shutter.
-    #[serde(default = "adaptive_limit_default")]
-    pub motion_blur_adaptive_limit: u32,
-    #[serde(default)]
-    pub renderer: Renderer,
-    /// Comp switches (timeline toolbar).
-    #[serde(default)]
-    pub hide_shy: bool,
-    #[serde(default = "yes")]
-    pub enable_motion_blur: bool,
-    #[serde(default = "yes")]
-    pub enable_frame_blending: bool,
-    #[serde(default)]
-    pub draft_3d: bool,
-    /// Composition Settings ▸ Advanced ▸ Preserve frame rate when nested or in render queue:
-    /// nested in another comp, or rendered at another rate, it shows only its own frames.
-    #[serde(default)]
-    pub preserve_frame_rate: bool,
-    /// Composition Settings ▸ Advanced ▸ Preserve resolution when nested: nested in a comp
-    /// previewed at a lower resolution, it still renders at full size.
-    #[serde(default)]
-    pub preserve_resolution: bool,
-    #[serde(default)]
-    pub poster_time: Tick,
-    /// Global Light for layer styles (Layer ▸ Layer Styles ▸ Blending Options).
-    #[serde(default)]
-    pub global_light: styles::GlobalLight,
-    /// Viewer guides (View ▸ Add Guide…), in comp pixels.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub guides: Vec<Guide>,
-    /// Essential Graphics: the controls this comp exposes to instances and templates.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub essential: Option<essential::EssentialGraphics>,
-    /// The Composition panel's Resolution, saved with the project as in After Effects. It changes
-    /// what the viewer renders, not the comp's pixels ([`Comp::same_pixels`]), and stays out of
-    /// the undo history.
-    #[serde(default, skip_serializing_if = "Resolution::is_auto")]
-    pub resolution: Resolution,
-}
-
-/// A viewer guide line: vertical guides sit at an x position, horizontal ones at a y position.
-#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Guide {
-    pub vertical: bool,
-    /// Comp pixels, or percent of the comp's width (vertical) / height (horizontal) when
-    /// [`Guide::percent`] is set.
-    pub position: f64,
-    /// A percentage guide (After Effects 26.5): `position` is a percent of the comp's size, so the
-    /// guide keeps its relative place when the comp is resized. Absent in older projects.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub percent: bool,
-}
-
-impl Guide {
-    /// The comp's extent along this guide's axis, never zero.
-    fn extent(&self, width: u32, height: u32) -> f64 {
-        f64::from(if self.vertical { width } else { height }).max(1.0)
-    }
-
-    /// The guide's position in comp pixels for a comp of this size.
-    pub fn px(&self, width: u32, height: u32) -> f64 {
-        if self.percent { self.position / 100.0 * self.extent(width, height) } else { self.position }
-    }
-
-    /// Place the guide at `px` comp pixels, keeping its unit.
-    pub fn set_px(&mut self, px: f64, width: u32, height: u32) {
-        self.position = if self.percent { px / self.extent(width, height) * 100.0 } else { px };
-    }
-
-    /// Switch between pixels and percent without moving the guide on the comp.
-    pub fn set_percent(&mut self, percent: bool, width: u32, height: u32) {
-        let px = self.px(width, height);
-        self.percent = percent;
-        self.set_px(px, width, height);
-    }
-}
-
-fn yes() -> bool {
-    true
-}
-
-fn adaptive_limit_default() -> u32 {
-    128
-}
-
-impl Comp {
-    pub fn new(width: u32, height: u32, frame_rate: FrameRate, duration: Tick) -> Comp {
-        Comp {
-            width,
-            height,
-            pixel_aspect: 1.0,
-            frame_rate,
-            duration,
-            display_start: Tick::ZERO,
-            background: [0.0, 0.0, 0.0],
-            work_area: (Tick::ZERO, duration),
-            layers: vec![],
-            markers: vec![],
-            shutter_angle: 180.0,
-            shutter_phase: -90.0,
-            motion_blur_samples: 16,
-            motion_blur_adaptive_limit: 128,
-            renderer: Renderer::Classic3D,
-            hide_shy: false,
-            enable_motion_blur: true,
-            enable_frame_blending: true,
-            draft_3d: false,
-            preserve_frame_rate: false,
-            preserve_resolution: false,
-            poster_time: Tick::ZERO,
-            guides: vec![],
-            global_light: styles::GlobalLight::default(),
-            essential: None,
-            resolution: Resolution::Auto,
-        }
-    }
-    /// Whether the composition has a frame at its time `t`: nested, it shows nothing before it
-    /// starts or after it ends (a precomp layer trimmed or remapped past it).
-    pub fn covers(&self, t: Tick) -> bool {
-        t >= Tick::ZERO && t < self.duration
-    }
-    /// A new, empty composition with this one's settings (frame rate, pixel aspect, background,
-    /// motion blur, frame blending and the 3D renderer), as Pre-compose makes.
-    pub fn nested_like(&self, width: u32, height: u32, duration: Tick) -> Comp {
-        Comp {
-            pixel_aspect: self.pixel_aspect,
-            background: self.background,
-            shutter_angle: self.shutter_angle,
-            shutter_phase: self.shutter_phase,
-            motion_blur_samples: self.motion_blur_samples,
-            motion_blur_adaptive_limit: self.motion_blur_adaptive_limit,
-            renderer: self.renderer,
-            enable_motion_blur: self.enable_motion_blur,
-            enable_frame_blending: self.enable_frame_blending,
-            preserve_frame_rate: self.preserve_frame_rate,
-            preserve_resolution: self.preserve_resolution,
-            ..Comp::new(width, height, self.frame_rate, duration)
-        }
-    }
-    pub fn layer(&self, id: LayerId) -> Option<&Layer> {
-        self.layers.iter().find(|l| l.id == id)
-    }
-    pub fn layer_mut(&mut self, id: LayerId) -> Option<&mut Layer> {
-        self.layers.iter_mut().find(|l| l.id == id)
-    }
-    /// 1-based layer number (#) of a layer.
-    pub fn index_of(&self, id: LayerId) -> Option<usize> {
-        self.layers.iter().position(|l| l.id == id).map(|i| i + 1)
-    }
-    pub fn layer_by_name(&self, name: &str) -> Option<&Layer> {
-        self.layers.iter().find(|l| l.name == name)
-    }
-    pub fn frame_duration(&self) -> Tick {
-        self.frame_rate.frame_duration()
-    }
-    /// Any 3D layer present (camera/lights or a 3D switch).
-    pub fn has_3d(&self) -> bool {
-        self.layers.iter().any(|l| l.switches.three_d || matches!(l.source, LayerSource::Camera | LayerSource::Light { .. }))
-    }
-    /// The active camera at `t`: the topmost enabled camera layer active at that time.
-    pub fn active_camera(&self, t: Tick) -> Option<&Layer> {
-        self.layers.iter().find(|l| matches!(l.source, LayerSource::Camera) && l.switches.video && l.is_active_at(t))
-    }
-    /// Unique layer name with a numeric suffix (`Shape Layer 2`).
-    pub fn unique_layer_name(&self, base: &str) -> String {
-        if !self.layers.iter().any(|l| l.name == base) {
-            return base.to_string();
-        }
-        let stem = base.trim_end_matches(|c: char| c.is_ascii_digit()).trim_end();
-        (2..).map(|i| format!("{stem} {i}")).find(|n| !self.layers.iter().any(|l| &l.name == n)).unwrap_or_default()
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum LightKind {
-    Parallel,
-    Spot,
-    #[default]
-    Point,
-    Ambient,
-    Environment,
-}
-
-impl LightKind {
-    pub const ALL: [LightKind; 5] = [LightKind::Parallel, LightKind::Spot, LightKind::Point, LightKind::Ambient, LightKind::Environment];
-    pub fn label(self) -> &'static str {
-        match self {
-            LightKind::Parallel => "Parallel",
-            LightKind::Spot => "Spot",
-            LightKind::Point => "Point",
-            LightKind::Ambient => "Ambient",
-            LightKind::Environment => "Environment",
-        }
-    }
-}
-
-/// A parametric 3D primitive (Layer ▸ New ▸ Cube/Sphere/Plane/Torus/Cone/Cylinder).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub enum PrimitiveKind {
-    #[default]
-    Cube,
-    Sphere,
-    Plane,
-    Torus,
-    Cone,
-    Cylinder,
-}
-
-impl PrimitiveKind {
-    pub const ALL: [PrimitiveKind; 6] =
-        [PrimitiveKind::Cube, PrimitiveKind::Sphere, PrimitiveKind::Plane, PrimitiveKind::Torus, PrimitiveKind::Cone, PrimitiveKind::Cylinder];
-    pub fn label(self) -> &'static str {
-        match self {
-            PrimitiveKind::Cube => "Cube",
-            PrimitiveKind::Sphere => "Sphere",
-            PrimitiveKind::Plane => "Plane",
-            PrimitiveKind::Torus => "Torus",
-            PrimitiveKind::Cone => "Cone",
-            PrimitiveKind::Cylinder => "Cylinder",
-        }
-    }
-    pub fn parse(s: &str) -> Option<PrimitiveKind> {
-        PrimitiveKind::ALL.into_iter().find(|k| k.label().eq_ignore_ascii_case(s.trim()))
-    }
-}
-
-/// What a layer shows.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(tag = "type")]
-pub enum LayerSource {
-    /// Footage item (video, still, sequence, audio).
-    Footage {
-        item: ItemId,
-    },
-    /// Nested composition (precomp).
-    Comp {
-        item: ItemId,
-    },
-    /// Solid item (solids also back adjustment layers).
-    Solid {
-        item: ItemId,
-    },
-    Text,
-    Shape,
-    Null,
-    Camera,
-    Light {
-        kind: LightKind,
-    },
-    /// An imported 3D model (a footage item of kind [`FootageKind::Model`]; Advanced 3D).
-    Model {
-        item: ItemId,
-    },
-    /// A parametric 3D primitive (Advanced 3D).
-    Primitive {
-        kind: PrimitiveKind,
-    },
-}
-
-impl LayerSource {
-    pub fn item(&self) -> Option<ItemId> {
-        match self {
-            LayerSource::Footage { item } | LayerSource::Comp { item } | LayerSource::Solid { item } | LayerSource::Model { item } => Some(*item),
-            _ => None,
-        }
-    }
-    pub fn type_name(&self) -> &'static str {
-        match self {
-            LayerSource::Footage { .. } => "Footage",
-            LayerSource::Comp { .. } => "Composition",
-            LayerSource::Solid { .. } => "Solid",
-            LayerSource::Text => "Text",
-            LayerSource::Shape => "Shape",
-            LayerSource::Null => "Null",
-            LayerSource::Camera => "Camera",
-            LayerSource::Light { .. } => "Light",
-            LayerSource::Model { .. } => "3D Model",
-            LayerSource::Primitive { .. } => "3D Primitive",
-        }
-    }
-    /// Layers with pixels (cameras, lights and nulls have none).
-    pub fn is_av(&self) -> bool {
-        !matches!(self, LayerSource::Camera | LayerSource::Light { .. } | LayerSource::Null)
-    }
-    /// A 3D model or primitive layer (meshes; drawn by the Advanced 3D renderer).
-    pub fn is_model(&self) -> bool {
-        matches!(self, LayerSource::Model { .. } | LayerSource::Primitive { .. })
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum Quality {
-    #[default]
-    Best,
-    Draft,
-    Wireframe,
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum Sampling {
-    #[default]
-    Bilinear,
-    Bicubic,
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FrameBlend {
-    #[default]
-    Off,
-    FrameMix,
-    PixelMotion,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Switches {
-    pub video: bool,
-    pub audio: bool,
-    pub solo: bool,
-    pub locked: bool,
-    pub shy: bool,
-    /// Collapse transformations (precomps) / continuously rasterize (vector layers).
-    pub collapse: bool,
-    pub quality: Quality,
-    pub sampling: Sampling,
-    pub effects: bool,
-    pub frame_blend: FrameBlend,
-    pub motion_blur: bool,
-    pub adjustment: bool,
-    pub three_d: bool,
-    pub guide: bool,
-}
-
-impl Default for Switches {
-    fn default() -> Self {
-        Switches {
-            video: true,
-            audio: true,
-            solo: false,
-            locked: false,
-            shy: false,
-            collapse: false,
-            quality: Quality::Best,
-            sampling: Sampling::Bilinear,
-            effects: true,
-            frame_blend: FrameBlend::Off,
-            motion_blur: false,
-            adjustment: false,
-            three_d: false,
-            guide: false,
-        }
-    }
-}
-
-// What a frame's pixels depend on. Caches key on it: the Audio, Lock and Shy switches and Hide
-// Shy Layers don't change pixels, so toggling them keeps cached frames (#103).
-
-impl Switches {
-    /// These switches with Audio, Lock and Shy at their defaults.
-    pub fn pixels(&self) -> Switches {
-        Switches { audio: true, locked: false, shy: false, ..self.clone() }
-    }
-}
-
-impl Layer {
-    /// Draws the same pixels as `o`: equal but for the Audio, Lock and Shy switches.
-    pub fn same_pixels(&self, o: &Layer) -> bool {
-        // Every field (no `..`: a new field must be considered here); the property tree last.
-        let Layer {
-            id,
-            name,
-            source,
-            label,
-            comment,
-            start_time,
-            in_point,
-            out_point,
-            stretch,
-            switches,
-            blend_mode,
-            preserve_transparency,
-            track_matte,
-            parent,
-            markers,
-            markers_locked,
-            auto_orient,
-            environment,
-            environment_background,
-            props,
-        } = self;
-        *id == o.id
-            && *name == o.name
-            && *source == o.source
-            && *label == o.label
-            && *comment == o.comment
-            && *start_time == o.start_time
-            && *in_point == o.in_point
-            && *out_point == o.out_point
-            && *stretch == o.stretch
-            && switches.pixels() == o.switches.pixels()
-            && *blend_mode == o.blend_mode
-            && *preserve_transparency == o.preserve_transparency
-            && *track_matte == o.track_matte
-            && *parent == o.parent
-            && *markers == o.markers
-            && *markers_locked == o.markers_locked
-            && *auto_orient == o.auto_orient
-            && *environment == o.environment
-            && *environment_background == o.environment_background
-            && *props == o.props
-    }
-}
-
-impl Comp {
-    /// Draws the same pixels as `o`: equal but for its layers' Audio, Lock and Shy switches, Hide
-    /// Shy Layers and the viewer's Resolution.
-    pub fn same_pixels(&self, o: &Comp) -> bool {
-        // Every field (no `..`: a new field must be considered here); the layers last.
-        let Comp {
-            width,
-            height,
-            pixel_aspect,
-            frame_rate,
-            duration,
-            display_start,
-            background,
-            work_area,
-            layers,
-            markers,
-            shutter_angle,
-            shutter_phase,
-            motion_blur_samples,
-            motion_blur_adaptive_limit,
-            renderer,
-            hide_shy: _,
-            enable_motion_blur,
-            enable_frame_blending,
-            draft_3d,
-            preserve_frame_rate,
-            preserve_resolution,
-            poster_time,
-            global_light,
-            guides,
-            essential,
-            resolution: _,
-        } = self;
-        *width == o.width
-            && *height == o.height
-            && *pixel_aspect == o.pixel_aspect
-            && *frame_rate == o.frame_rate
-            && *duration == o.duration
-            && *display_start == o.display_start
-            && *background == o.background
-            && *work_area == o.work_area
-            && *markers == o.markers
-            && *shutter_angle == o.shutter_angle
-            && *shutter_phase == o.shutter_phase
-            && *motion_blur_samples == o.motion_blur_samples
-            && *motion_blur_adaptive_limit == o.motion_blur_adaptive_limit
-            && *renderer == o.renderer
-            && *enable_motion_blur == o.enable_motion_blur
-            && *enable_frame_blending == o.enable_frame_blending
-            && *draft_3d == o.draft_3d
-            && *preserve_frame_rate == o.preserve_frame_rate
-            && *preserve_resolution == o.preserve_resolution
-            && *poster_time == o.poster_time
-            && *global_light == o.global_light
-            && *guides == o.guides
-            && *essential == o.essential
-            && layers.len() == o.layers.len()
-            && layers.iter().zip(&o.layers).all(|(a, b)| a.same_pixels(b))
-    }
-
-    /// Draws the same pixels as `o` once plain markers are ignored: they change no pixels. Protected
-    /// time markers with a duration set the timing (Responsive Design), so those still count.
-    pub fn same_pixels_ignoring_markers(&self, o: &Comp) -> bool {
-        let protected =
-            |m: &[Marker]| -> Vec<(Tick, Tick)> { m.iter().filter(|m| m.protected && m.duration > Tick::ZERO).map(|m| (m.time, m.duration)).collect() };
-        if protected(&self.markers) != protected(&o.markers) {
-            return false;
-        }
-        let mut c = self.clone();
-        c.markers = o.markers.clone();
-        for (a, b) in c.layers.iter_mut().zip(&o.layers) {
-            a.markers = b.markers.clone();
-            a.markers_locked = b.markers_locked;
-        }
-        c.same_pixels(o)
-    }
-
-    /// The comp with those switches and the Resolution at their defaults (borrowed when they
-    /// already are), for keys that hash the whole comp.
-    pub fn pixel_form(&self) -> std::borrow::Cow<'_, Comp> {
-        if !self.hide_shy && self.resolution.is_auto() && self.layers.iter().all(|l| l.switches == l.switches.pixels()) {
-            return std::borrow::Cow::Borrowed(self);
-        }
-        let mut c = self.clone();
-        c.hide_shy = false;
-        c.resolution = Resolution::Auto;
-        for l in &mut c.layers {
-            l.switches = l.switches.pixels();
-        }
-        std::borrow::Cow::Owned(c)
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum MatteKind {
-    #[default]
-    Alpha,
-    AlphaInverted,
-    Luma,
-    LumaInverted,
-}
-
-impl MatteKind {
-    pub const ALL: [MatteKind; 4] = [MatteKind::Alpha, MatteKind::AlphaInverted, MatteKind::Luma, MatteKind::LumaInverted];
-    pub fn label(self) -> &'static str {
-        match self {
-            MatteKind::Alpha => "Alpha Matte",
-            MatteKind::AlphaInverted => "Alpha Inverted Matte",
-            MatteKind::Luma => "Luma Matte",
-            MatteKind::LumaInverted => "Luma Inverted Matte",
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct TrackMatte {
-    pub layer: LayerId,
-    pub kind: MatteKind,
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AutoOrient {
-    #[default]
-    Off,
-    AlongPath,
-    TowardsCamera,
-    TowardsPointOfInterest,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Layer {
-    pub id: LayerId,
-    pub name: String,
-    pub source: LayerSource,
-    pub label: Label,
-    #[serde(default)]
-    pub comment: String,
-    /// Comp time where the layer's time 0 sits.
-    pub start_time: Tick,
-    /// Visible span in comp time.
-    pub in_point: Tick,
-    pub out_point: Tick,
-    /// Time stretch in percent (100 = normal, negative = reversed).
-    pub stretch: f64,
-    pub switches: Switches,
-    pub blend_mode: BlendMode,
-    #[serde(default)]
-    pub preserve_transparency: bool,
-    #[serde(default)]
-    pub track_matte: Option<TrackMatte>,
-    #[serde(default)]
-    pub parent: Option<LayerId>,
-    #[serde(default)]
-    pub markers: Vec<Marker>,
-    /// Layer ▸ Markers ▸ Lock Markers.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub markers_locked: bool,
-    #[serde(default)]
-    pub auto_orient: AutoOrient,
-    /// Layer ▸ Environment Layer: the layer is the environment (image-based light and
-    /// reflections) of Advanced 3D comps instead of being drawn.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub environment: bool,
-    /// Layer ▸ Light ▸ Create Environment Light Background Layer: the layer's (equirectangular)
-    /// image is drawn as the 3D scene's backdrop, seen through the camera, instead of as a card.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub environment_background: bool,
-    /// The property tree (Masks, Effects, Transform, Text, Contents, Camera/Light options…).
-    pub props: PropGroup,
-}
-
-impl Layer {
-    pub fn is_active_at(&self, t: Tick) -> bool {
-        t >= self.in_point && t < self.out_point
-    }
-    /// Layer time for a comp time (stretch-aware).
-    pub fn layer_time(&self, comp_t: Tick) -> Tick {
-        let d = comp_t - self.start_time;
-        if (self.stretch - 100.0).abs() < 1e-9 { d } else { Tick((d.0 as f64 * 100.0 / self.stretch) as i64) }
-    }
-    /// Comp time for a layer time.
-    pub fn comp_time(&self, layer_t: Tick) -> Tick {
-        if (self.stretch - 100.0).abs() < 1e-9 { self.start_time + layer_t } else { self.start_time + Tick((layer_t.0 as f64 * self.stretch / 100.0) as i64) }
-    }
-    pub fn transform(&self) -> Option<&PropGroup> {
-        self.props.sub("transform")
-    }
-    pub fn transform_mut(&mut self) -> Option<&mut PropGroup> {
-        self.props.sub_mut("transform")
-    }
-    pub fn effects(&self) -> Option<&PropGroup> {
-        self.props.sub("effects")
-    }
-    pub fn masks(&self) -> Option<&PropGroup> {
-        self.props.sub("masks")
-    }
-    pub fn is_camera(&self) -> bool {
-        matches!(self.source, LayerSource::Camera)
-    }
-    pub fn is_light(&self) -> bool {
-        matches!(self.source, LayerSource::Light { .. })
-    }
-    /// The layer participates in 3D (3D switch, or cameras/lights which are always 3D).
-    pub fn is_3d(&self) -> bool {
-        self.switches.three_d || self.is_camera() || self.is_light()
-    }
-    pub fn has_video(&self) -> bool {
-        self.source.is_av() && self.switches.video
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FootageKind {
-    #[default]
-    Video,
-    Still,
-    Sequence,
-    Audio,
-    /// A 3D model (glTF 2.0 / OBJ), placed as a model layer.
-    Model,
-    /// A data file (JSON, CSV, TSV) for data-driven animation: read by expressions through
-    /// `footage(name).sourceData` / `sourceText` / `dataValue`; it has no pixels.
-    Data,
-}
-
-/// Interpret Footage ▸ Fields and Pulldown ▸ Separate Fields.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub enum FieldOrder {
-    /// Progressive frames.
-    #[default]
-    Off,
-    /// Interlaced, upper (odd) field first: each field becomes a frame at twice the rate.
-    UpperFirst,
-    LowerFirst,
-}
-
-impl FieldOrder {
-    pub fn label(self) -> &'static str {
-        match self {
-            FieldOrder::Off => "Off",
-            FieldOrder::UpperFirst => "Upper Field First",
-            FieldOrder::LowerFirst => "Lower Field First",
-        }
-    }
-    pub fn parse(s: &str) -> Option<FieldOrder> {
-        match s.to_ascii_lowercase().replace([' ', '_', '-'], "").as_str() {
-            "off" | "none" | "progressive" => Some(FieldOrder::Off),
-            "upper" | "upperfirst" | "upperfieldfirst" => Some(FieldOrder::UpperFirst),
-            "lower" | "lowerfirst" | "lowerfieldfirst" => Some(FieldOrder::LowerFirst),
-            _ => None,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AlphaMode {
-    #[default]
-    Straight,
-    Premultiplied,
-    Ignore,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Footage {
-    pub path: String,
-    pub kind: FootageKind,
-    pub width: u32,
-    pub height: u32,
-    pub pixel_aspect: f64,
-    pub frame_rate: FrameRate,
-    /// Native rate before "Conform to frame rate".
-    #[serde(default)]
-    pub native_rate: Option<FrameRate>,
-    pub duration: Tick,
-    pub has_video: bool,
-    pub has_audio: bool,
-    pub alpha: AlphaMode,
-    #[serde(default)]
-    pub premul_color: [f32; 3],
-    #[serde(default = "one")]
-    pub loop_count: u32,
-    #[serde(default)]
-    pub codec: String,
-    #[serde(default)]
-    pub missing: bool,
-    /// Image sequence files (when kind = Sequence).
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub sequence: Vec<String>,
-    /// Colour profile (from the file's metadata, or Interpret Footage). `None` = sRGB.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub color_profile: Option<ColorSpace>,
-    /// One layer of a layered file (Photoshop) instead of its merged image.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub layer: Option<SourceLayer>,
-    /// Interpret Footage ▸ Fields and Pulldown ▸ Separate Fields.
-    #[serde(default, skip_serializing_if = "is_default")]
-    pub fields: FieldOrder,
-    /// Interpret Footage ▸ Alpha ▸ Invert Alpha.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub invert_alpha: bool,
-    /// Interpret Footage ▸ Color ▸ Interpret As Linear Light: the file's values are linear.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub linear_light: bool,
-    /// Interpret Footage ▸ Color ▸ Preserve RGB: the file's values enter the composition
-    /// unconverted. Float footage (OpenEXR, float TIFF) is not sRGB-encoded on decode, and the
-    /// colour profile, Interpret As Linear Light and the working space don't apply.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub preserve_rgb: bool,
-    /// Data footage ([`FootageKind::Data`]): the file's text (JSON, CSV or TSV), kept in the
-    /// project so expressions read it everywhere (and on the web).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub data: Option<String>,
-    /// PDF / Illustrator footage: the page shown (0-based; File ▸ Import ▸ Page).
-    #[serde(default, skip_serializing_if = "is_default")]
-    pub page: u32,
-    /// Image sequences imported with Force Alphabetical Order: the files play one after another
-    /// and their numbering doesn't count (otherwise a gap in it shows a placeholder, as in After
-    /// Effects; [`sequence`]).
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub alphabetical: bool,
-    /// Interpret Footage ▸ Start Timecode ▸ Override Start: the frame (at the footage's frame
-    /// rate) its timecode shows at its first frame. `None` = Use Source File Timecode (0: file
-    /// timecode isn't read). It only relabels source time, as in After Effects.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub start_timecode: Option<i64>,
-}
-
-fn is_default<T: Default + PartialEq>(v: &T) -> bool {
-    *v == T::default()
-}
-
-impl Default for Footage {
-    fn default() -> Self {
-        Footage {
-            path: String::new(),
-            kind: FootageKind::Still,
-            width: 0,
-            height: 0,
-            pixel_aspect: 1.0,
-            frame_rate: FrameRate::FPS_30,
-            native_rate: None,
-            duration: Tick::ZERO,
-            has_video: false,
-            has_audio: false,
-            alpha: AlphaMode::Straight,
-            premul_color: [0.0; 3],
-            loop_count: 1,
-            codec: String::new(),
-            missing: false,
-            sequence: vec![],
-            color_profile: None,
-            fields: FieldOrder::Off,
-            invert_alpha: false,
-            linear_light: false,
-            preserve_rgb: false,
-            data: None,
-            layer: None,
-            page: 0,
-            alphabetical: false,
-            start_timecode: None,
-        }
-    }
-}
-
-impl Footage {
-    /// Interpret As Linear Light applies (Preserve RGB passes the file's values through).
-    pub fn linear_light_applies(&self) -> bool {
-        self.linear_light && !self.preserve_rgb
-    }
-
-    /// How long the footage plays: its duration times Interpret Footage ▸ Loop.
-    pub fn looped_duration(&self) -> Tick {
-        Tick(self.duration.0.saturating_mul(self.loop_count.max(1) as i64))
-    }
-
-    /// Source time as the footage's timecode: its frame `frame` from Start Timecode
-    /// (`0:00:41:20`), as the Footage panel shows it.
-    pub fn timecode(&self, frame: i64) -> String {
-        effectcraft_time::format_timecode_ae(frame.saturating_add(self.start_timecode.unwrap_or(0)), self.frame_rate, false)
-    }
-
-    /// The data format of data footage: `json`, `csv` or `tsv` (from the file extension).
-    pub fn data_format(&self) -> Option<&'static str> {
-        if self.kind != FootageKind::Data {
-            return None;
-        }
-        let ext = std::path::Path::new(&self.path).extension().and_then(|e| e.to_str()).unwrap_or("").to_ascii_lowercase();
-        Some(match ext.as_str() {
-            "csv" => "csv",
-            "tsv" | "tab" => "tsv",
-            _ => "json",
-        })
-    }
-}
-
-/// A proxy: a stand-in file used instead of a footage item or composition (File ▸ Set Proxy /
-/// Create Proxy), when its Use Proxy switch is on and the render's Proxy Use allows it.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Proxy {
-    /// The proxy's footage (path, size, rate…; File ▸ Interpret Footage ▸ Proxy edits it).
-    pub footage: Footage,
-    /// Use Proxy (the Project panel's proxy indicator: filled = in use, hollow = set but off).
-    #[serde(default = "yes")]
-    pub enabled: bool,
-}
-
-/// A layer of a layered still (a Photoshop document, or a PDF / Illustrator / EPS file) used as
-/// footage (File ▸ Import ▸ Composition / Composition – Retain Layer Sizes, or Choose Layer).
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct SourceLayer {
-    /// Layer record index in the file (bottom of the stack = 0).
-    pub index: u32,
-    pub name: String,
-    /// The footage is the layer's own bounds (Retain Layer Sizes) rather than the document size.
-    #[serde(default)]
-    pub layer_size: bool,
-    /// A Photoshop smart object: the unique id of its embedded file (linked layer data), which
-    /// is the footage instead of the layer's pixels.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub embedded: Option<String>,
-    /// A smart object with a perspective quad or a warp: the footage is its embedded file baked
-    /// as placed (warped and pinned to its corners) over the placed bounds in document space.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub placed: bool,
-}
-
-fn one() -> u32 {
-    1
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Solid {
-    pub color: [f32; 3],
-    pub width: u32,
-    pub height: u32,
-    pub pixel_aspect: f64,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(tag = "type")]
-#[allow(clippy::large_enum_variant)]
-pub enum ItemKind {
-    Folder,
-    Comp(Arc<Comp>),
-    Footage(Footage),
-    Solid(Solid),
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Item {
-    pub id: ItemId,
-    pub name: String,
-    pub label: Label,
-    #[serde(default)]
-    pub comment: String,
-    /// Containing folder (None = project root).
-    #[serde(default)]
-    pub parent: Option<ItemId>,
-    pub kind: ItemKind,
-    /// The item's proxy (footage and compositions).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub proxy: Option<Box<Proxy>>,
-}
-
-impl Item {
-    pub fn type_name(&self) -> &'static str {
-        match &self.kind {
-            ItemKind::Folder => "Folder",
-            ItemKind::Comp(_) => "Composition",
-            ItemKind::Footage(f) => match f.kind {
-                FootageKind::Video => "Video",
-                FootageKind::Still => "Image",
-                FootageKind::Sequence => "Image Sequence",
-                FootageKind::Audio => "Audio",
-                FootageKind::Model => "3D Model",
-                FootageKind::Data => "Data",
-            },
-            ItemKind::Solid(_) => "Solid",
-        }
-    }
-    pub fn as_comp(&self) -> Option<&Comp> {
-        if let ItemKind::Comp(c) = &self.kind { Some(c) } else { None }
-    }
-    pub fn is_folder(&self) -> bool {
-        matches!(self.kind, ItemKind::Folder)
-    }
-    /// (width, height) for visual items.
-    pub fn dimensions(&self) -> Option<(u32, u32)> {
-        match &self.kind {
-            ItemKind::Comp(c) => Some((c.width, c.height)),
-            ItemKind::Footage(f) if f.has_video => Some((f.width, f.height)),
-            ItemKind::Solid(s) => Some((s.width, s.height)),
-            _ => None,
-        }
-    }
-    pub fn duration(&self) -> Option<Tick> {
-        match &self.kind {
-            ItemKind::Comp(c) => Some(c.duration),
-            ItemKind::Footage(f) if f.kind != FootageKind::Still => Some(f.looped_duration()),
-            _ => None,
-        }
-    }
-    pub fn frame_rate(&self) -> Option<FrameRate> {
-        match &self.kind {
-            ItemKind::Comp(c) => Some(c.frame_rate),
-            ItemKind::Footage(f) if f.kind == FootageKind::Video || f.kind == FootageKind::Sequence => Some(f.frame_rate),
-            _ => None,
-        }
-    }
-}
+mod comp;
+mod dirty;
+mod footage;
+mod item;
+mod layer;
+mod layers;
+mod reach;
+mod settings;
+
+pub use comp::{Comp, Guide, Renderer, Resolution};
+pub use footage::{AlphaMode, CineonSettings, CineonUnits, FieldOrder, Footage, FootageKind, Proxy, Solid, SourceLayer, VIDEO_EXTENSIONS, cineon_log_to_lin};
+pub use item::NO_LAYER;
+pub use item::{Heard, Item, ItemId, ItemKind, LayerId};
+pub use layer::{
+    AutoOrient, FrameBlend, Layer, LayerSource, LightKind, MatteKind, PrimitiveKind, Quality, Sampling, Switches, TrackMatte, is_audio_effect,
+    reads_other_frames, text_layer_name,
+};
+pub use layers::Layers;
+pub use reach::{ExprReach, PixelReach, expression_reach};
+pub use settings::{
+    APP_VERSION, BitDepth, ColorEngine, CuePoint, HdrMode, Marker, ProjectError, ProjectSettings, SCHEMA_EFFECT_SPACE, SCHEMA_VERSION, SavedView,
+    TimeDisplayStyle, is_newer_version, saved_by, saved_view,
+};
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Project {
@@ -1375,198 +70,5 @@ pub struct Project {
     pub render_prefs: render_queue::RenderQueuePrefs,
 }
 
-impl Default for Project {
-    fn default() -> Self {
-        Project {
-            schema: SCHEMA_VERSION,
-            settings: ProjectSettings::default(),
-            items: BTreeMap::new(),
-            next_id: 1,
-            render_queue: Vec::new(),
-            render_templates: Default::default(),
-            render_prefs: Default::default(),
-        }
-    }
-}
-
-impl Project {
-    /// Allocate an id (items, layers and property uids share one counter).
-    pub fn alloc(&mut self) -> u64 {
-        let id = self.next_id;
-        self.next_id += 1;
-        id
-    }
-    pub fn item(&self, id: ItemId) -> Option<&Item> {
-        self.items.get(&id)
-    }
-    pub fn item_mut(&mut self, id: ItemId) -> Option<&mut Item> {
-        self.items.get_mut(&id)
-    }
-    pub fn comp(&self, id: ItemId) -> Option<&Comp> {
-        self.items.get(&id)?.as_comp()
-    }
-    /// A shared handle on a comp: a snapshot that costs a reference count, not a deep copy of
-    /// its layers (frontends hold one across a frame instead of cloning the comp).
-    pub fn comp_arc(&self, id: ItemId) -> Option<Arc<Comp>> {
-        match &self.items.get(&id)?.kind {
-            ItemKind::Comp(c) => Some(c.clone()),
-            _ => None,
-        }
-    }
-    /// Mutable comp (copy-on-write).
-    pub fn comp_mut(&mut self, id: ItemId) -> Option<&mut Comp> {
-        match &mut self.items.get_mut(&id)?.kind {
-            ItemKind::Comp(c) => Some(Arc::make_mut(c)),
-            _ => None,
-        }
-    }
-    /// Adds an item; its size, frame rate and the like are brought within [`limits`] first.
-    pub fn add_item(&mut self, name: &str, label: Label, parent: Option<ItemId>, mut kind: ItemKind) -> ItemId {
-        limits::repair_kind(name, &mut kind, &mut vec![]);
-        let id = ItemId(self.alloc());
-        self.items.insert(id, Item { id, name: name.into(), label, comment: String::new(), parent, kind, proxy: None });
-        id
-    }
-    /// Children of a folder (None = root), folders first then by name.
-    pub fn children(&self, folder: Option<ItemId>) -> Vec<&Item> {
-        let mut v: Vec<&Item> = self.items.values().filter(|i| i.parent == folder).collect();
-        v.sort_by(|a, b| b.is_folder().cmp(&a.is_folder()).then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase())));
-        v
-    }
-    pub fn comps(&self) -> impl Iterator<Item = (&ItemId, &Comp)> {
-        self.items.iter().filter_map(|(id, i)| i.as_comp().map(|c| (id, c)))
-    }
-    pub fn find_by_name(&self, name: &str) -> Option<&Item> {
-        self.items.values().find(|i| i.name == name)
-    }
-    /// A numbered name for a copy of `base` that no project item has (Edit ▸ Duplicate): its
-    /// trailing number is dropped and the lowest free one from 2 is added (`Comp 1` → `Comp 2`,
-    /// `Name` → `Name 2`, then `Name 3`). Items for which `ignore` holds don't count.
-    pub fn numbered_item_name(&self, base: &str, ignore: impl Fn(&Item) -> bool) -> String {
-        let stem = base.trim_end_matches(|c: char| c.is_ascii_digit()).trim_end();
-        let taken = |n: &str| self.items.values().any(|i| i.name == n && !ignore(i));
-        (2u64..).map(|k| format!("{stem} {k}")).find(|n| !taken(n)).unwrap_or_default()
-    }
-    /// `base` when no project item has that name, else the next free numbered name as
-    /// [`Project::numbered_item_name`] gives it. Items for which `ignore` holds don't count.
-    pub fn unique_item_name(&self, base: &str, ignore: impl Fn(&Item) -> bool) -> String {
-        if self.items.values().any(|i| i.name == base && !ignore(i)) { self.numbered_item_name(base, ignore) } else { base.to_string() }
-    }
-    pub fn folder_named(&self, name: &str) -> Option<ItemId> {
-        self.items.values().find(|i| i.is_folder() && i.name == name).map(|i| i.id)
-    }
-    /// Find the comp that contains `layer`.
-    pub fn comp_of_layer(&self, layer: LayerId) -> Option<ItemId> {
-        self.comps().find(|(_, c)| c.layer(layer).is_some()).map(|(id, _)| *id)
-    }
-    /// The compositions whose layers use `item` as their source (footage, solid, 3D model or
-    /// precomp), each with how many of its layers do, ordered by comp name then id. Only direct
-    /// layers count, as in After Effects' Project panel ("used 3 times"): a solid inside a precomp
-    /// is used by the precomp, not by the comps that nest it. The total is the sum of the counts.
-    pub fn item_users(&self, item: ItemId) -> Vec<(ItemId, usize)> {
-        let mut users: Vec<(ItemId, String, usize)> = self
-            .items
-            .iter()
-            .filter_map(|(id, it)| {
-                let comp = it.as_comp()?;
-                let n = comp.layers.iter().filter(|l| l.source.item() == Some(item)).count();
-                (n > 0).then(|| (*id, it.name.to_lowercase(), n))
-            })
-            .collect();
-        users.sort_by(|a, b| a.1.cmp(&b.1).then(a.0.cmp(&b.0)));
-        users.into_iter().map(|(id, _, n)| (id, n)).collect()
-    }
-    /// Whether comp `inner` is (transitively) nested inside comp `outer` (to prevent cycles).
-    pub fn comp_contains(&self, outer: ItemId, inner: ItemId) -> bool {
-        if outer == inner {
-            return true;
-        }
-        let Some(c) = self.comp(outer) else { return false };
-        c.layers.iter().any(|l| matches!(l.source, LayerSource::Comp { item } if self.comp_contains(item, inner)))
-    }
-    /// Make sure `next_id` exceeds every id in the project (after loading or merging).
-    pub fn fix_next_id(&mut self) {
-        let mut m = self.next_id;
-        for (id, it) in &self.items {
-            // Saturating: a damaged file's ids must not overflow (the import then refuses it).
-            m = m.max(id.0.saturating_add(1));
-            if let ItemKind::Comp(c) = &it.kind {
-                for l in &c.layers {
-                    m = m.max(l.id.0.saturating_add(1)).max(l.props.max_uid().saturating_add(1));
-                }
-            }
-        }
-        self.next_id = m;
-    }
-    /// Whether `other` holds the same content. An allocated id counts (an edit may hand it out
-    /// beyond the project, so it must stay taken). Shared compositions compare by pointer first,
-    /// so after a copy-on-write edit only the comps it touched are compared field by field.
-    pub fn same_content(&self, other: &Project) -> bool {
-        let item_eq = |a: &Item, b: &Item| {
-            let kind = match (&a.kind, &b.kind) {
-                (ItemKind::Comp(x), ItemKind::Comp(y)) => Arc::ptr_eq(x, y) || x == y,
-                (x, y) => x == y,
-            };
-            kind && a.id == b.id && a.name == b.name && a.label == b.label && a.comment == b.comment && a.parent == b.parent && a.proxy == b.proxy
-        };
-        self.schema == other.schema
-            && self.next_id == other.next_id
-            && self.settings == other.settings
-            && self.items.len() == other.items.len()
-            && self.items.iter().zip(&other.items).all(|((ka, a), (kb, b))| ka == kb && item_eq(a, b))
-            && self.render_queue == other.render_queue
-            && self.render_templates == other.render_templates
-            && self.render_prefs == other.render_prefs
-    }
-    /// The project file's text: the project with the version that wrote it (`savedBy`), checked
-    /// to read back, so a save never writes a file that can't be opened (JSON has no NaN or
-    /// infinity: such a value would be written as `null`).
-    pub fn to_file_json(&self) -> Result<String, ProjectError> {
-        self.to_file_json_with_view(&SavedView::default())
-    }
-    /// [`Project::to_file_json`] that also records the open compositions ([`SavedView`]).
-    pub fn to_file_json_with_view(&self, view: &SavedView) -> Result<String, ProjectError> {
-        #[derive(Serialize)]
-        struct File<'a> {
-            #[serde(rename = "savedBy")]
-            saved_by: &'a str,
-            #[serde(flatten)]
-            view: &'a SavedView,
-            #[serde(flatten)]
-            project: &'a Project,
-        }
-        let text = serde_json::to_string_pretty(&File { saved_by: APP_VERSION, view, project: self })
-            .map_err(|e| ProjectError::Invalid(format!("the project can't be saved: {e}")))?;
-        Project::from_json(&text)
-            .map_err(|e| ProjectError::Invalid(format!("the project can't be saved: it holds a value a project file can't store ({e})")))?;
-        Ok(text)
-    }
-    pub fn to_json(&self) -> String {
-        serde_json::to_string_pretty(self).unwrap_or_default()
-    }
-    /// [`Project::to_json`] without indentation: smaller and faster (auto-saves).
-    pub fn to_json_compact(&self) -> String {
-        serde_json::to_string(self).unwrap_or_default()
-    }
-    pub fn from_json(s: &str) -> Result<Project, ProjectError> {
-        Project::from_json_repaired(s).map(|(p, _)| p)
-    }
-    /// [`Project::from_json`], also returning one line per value that was out of [`limits`] and
-    /// was corrected (a composition of a billion pixels, a zero frame rate…), so a corrupt or
-    /// hostile file still opens, within bounds, and the user can be told what changed.
-    pub fn from_json_repaired(s: &str) -> Result<(Project, Vec<String>), ProjectError> {
-        let mut p: Project = serde_json::from_str(s).map_err(|e| ProjectError::Invalid(e.to_string()))?;
-        if p.schema > SCHEMA_VERSION {
-            return Err(ProjectError::Invalid(format!("project schema {} is newer than this version supports ({SCHEMA_VERSION})", p.schema)));
-        }
-        p.fix_next_id();
-        let mut notes = vec![];
-        for item in p.items.values_mut() {
-            limits::repair_item(item, &mut notes);
-        }
-        Ok((p, notes))
-    }
-}
-
 #[cfg(test)]
 mod tests;
diff --git a/crates/project/src/limits.rs b/crates/project/src/limits.rs
index 998f40225..7a74c992b 100644
--- a/crates/project/src/limits.rs
+++ b/crates/project/src/limits.rs
@@ -27,6 +27,30 @@ pub const MAX_PIXEL_ASPECT: f64 = 10.0;
 pub const MOTION_BLUR_SAMPLES: (u32, u32) = (2, 64);
 /// Composition Settings ▸ Advanced ▸ Adaptive Sample Limit.
 pub const ADAPTIVE_SAMPLE_LIMIT: (u32, u32) = (16, 256);
+/// The smallest time stretch, in percent, either way (After Effects sets a stretch between 0 and
+/// 1 % to 1 %, between -1 % and 0 to -1 %; `layer.timeStretch` refuses less).
+pub const MIN_STRETCH: f64 = 1.0;
+/// The largest time stretch, in percent, either way (After Effects' `Layer.stretch` range is
+/// -9900 to 9900).
+pub const MAX_STRETCH: f64 = 9900.0;
+
+/// A layer's time stretch from [`MIN_STRETCH`] to [`MAX_STRETCH`] % either way, its sign (a
+/// reversed layer) kept; 100 % for 0 or NaN. Layer and comp time divide by the stretch, and the
+/// audio mix reads `100 / stretch` source samples per sample, so a stretch of 1e-300 % or NaN
+/// from a damaged file must not reach them (#3247).
+pub fn stretch(v: f64) -> f64 {
+    if v.is_nan() || v == 0.0 {
+        return 100.0;
+    }
+    // Infinity clamps to the largest stretch with its sign.
+    v.signum() * v.abs().clamp(MIN_STRETCH, MAX_STRETCH)
+}
+
+/// A stretch for a note: a plain number in a readable range, scientific notation beyond it (a
+/// plain 1e-300 would print 300 digits).
+fn percent(v: f64) -> String {
+    if v == 0.0 || (1e-3..1e7).contains(&v.abs()) { format!("{v} %") } else { format!("{v:e} %") }
+}
 
 /// A width or height from 1 to [`MAX_SIZE`].
 pub fn size(v: u64) -> u32 {
@@ -97,9 +121,11 @@ fn repair_comp(name: &str, c: &Comp, notes: &mut Vec<String>) -> Option<Comp> {
     let duration = c.duration.max(rate.frame_duration());
     let samples = c.motion_blur_samples.clamp(MOTION_BLUR_SAMPLES.0, MOTION_BLUR_SAMPLES.1);
     let adaptive = c.motion_blur_adaptive_limit.clamp(ADAPTIVE_SAMPLE_LIMIT.0, ADAPTIVE_SAMPLE_LIMIT.1);
+    let stretch_ok = |l: &crate::Layer| stretch(l.stretch).to_bits() == l.stretch.to_bits();
     let unchanged = (width, height, rate, duration, samples, adaptive)
         == (c.width, c.height, c.frame_rate, c.duration, c.motion_blur_samples, c.motion_blur_adaptive_limit)
-        && pa.to_bits() == c.pixel_aspect.to_bits();
+        && pa.to_bits() == c.pixel_aspect.to_bits()
+        && c.layers.iter().all(stretch_ok);
     if unchanged {
         return None;
     }
@@ -125,6 +151,12 @@ fn repair_comp(name: &str, c: &Comp, notes: &mut Vec<String>) -> Option<Comp> {
     }
     (n.width, n.height, n.pixel_aspect, n.frame_rate, n.duration) = (width, height, pa, rate, duration);
     (n.motion_blur_samples, n.motion_blur_adaptive_limit) = (samples, adaptive);
+    // Only the layers out of range are copied (the others stay shared).
+    for l in n.layers.iter_mut_where(|l| !stretch_ok(l)) {
+        let fixed = stretch(l.stretch);
+        note(notes, name, &format!("layer '{}' time stretch", l.name), percent(l.stretch), percent(fixed));
+        l.stretch = fixed;
+    }
     Some(n)
 }
 
@@ -217,6 +249,85 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_stretch_is_held_to_one_to_9900_percent_with_its_sign() {
+        assert_eq!(stretch(f64::NAN), 100.0);
+        assert_eq!(stretch(0.0), 100.0);
+        assert_eq!(stretch(-0.0), 100.0);
+        assert_eq!(stretch(1e-300), MIN_STRETCH);
+        assert_eq!(stretch(-1e-300), -MIN_STRETCH);
+        assert_eq!(stretch(0.5), MIN_STRETCH);
+        assert_eq!(stretch(1e300), MAX_STRETCH);
+        assert_eq!(stretch(f64::INFINITY), MAX_STRETCH);
+        assert_eq!(stretch(f64::NEG_INFINITY), -MAX_STRETCH);
+        for v in [1.0, -1.0, 33.3, 100.0, -100.0, 200.0, 9900.0, -9900.0] {
+            assert_eq!(stretch(v).to_bits(), v.to_bits(), "{v} is in range");
+        }
+    }
+
+    /// A layer whose stretch got past loading (0, NaN, 1e-300 %, set in memory) still maps time
+    /// through a stretch in range: before, 0 and 1e-300 % saturated every layer time to the end of
+    /// time and NaN collapsed it to 0 (#3247).
+    #[test]
+    fn layer_and_comp_time_use_a_stretch_in_range() {
+        let mut p = crate::Project::default();
+        let comp = Comp::new(64, 64, FrameRate::FPS_25, Tick::from_seconds_f64(10.0));
+        let mut l = crate::build::layer(&mut p, &comp, "L", crate::LayerSource::Camera, (64, 64), None);
+        l.start_time = Tick::from_seconds_f64(1.0);
+        let at = |s: f64| Tick::from_seconds_f64(s);
+        for (bad, effective) in [(0.0, 100.0), (f64::NAN, 100.0), (1e-300, 1.0), (-1e-300, -1.0), (1e300, 9900.0), (f64::NEG_INFINITY, -9900.0)] {
+            l.stretch = bad;
+            assert_eq!(l.effective_stretch(), effective, "{bad}");
+            // One comp second after the start is 100 / stretch layer seconds.
+            let want = Tick((at(1.0).0 as f64 * 100.0 / effective) as i64);
+            assert_eq!(l.layer_time(at(2.0)), want, "{bad}");
+            // And back, within the rounding of the two conversions.
+            assert!((l.comp_time(l.layer_time(at(2.0))) - at(2.0)).abs() <= Tick(100), "{bad}");
+        }
+    }
+
+    #[test]
+    fn a_stretch_out_of_range_in_a_file_is_corrected_and_reported() {
+        let mut p = crate::Project::default();
+        let comp = Comp::new(64, 64, FrameRate::FPS_25, Tick::from_seconds_f64(2.0));
+        let mut c = comp.clone();
+        for (name, s) in [("tiny", 1e-300), ("reversed tiny", -1e-300), ("zero", 0.0), ("huge", 1e300), ("reversed huge", -5e4), ("fine", -50.0)] {
+            let mut l = crate::build::layer(&mut p, &comp, name, crate::LayerSource::Camera, (64, 64), None);
+            l.stretch = s;
+            c.layers.push(l);
+        }
+        // Added through `add_item`, the comp is held to the limits too: write the values back in.
+        let id = p.add_item("Comp", effectcraft_color::Label::None, None, ItemKind::Comp(Arc::new(c.clone())));
+        assert!(p.comp(id).unwrap().layers.iter().all(|l| l.stretch.abs() >= MIN_STRETCH && l.stretch.abs() <= MAX_STRETCH));
+        let mut v: serde_json::Value = serde_json::from_str(&p.to_json()).unwrap();
+        for (k, l) in c.layers.iter().enumerate() {
+            v["items"][id.0.to_string()]["kind"]["layers"][k]["stretch"] = serde_json::json!(l.stretch);
+        }
+        let (back, notes) = crate::Project::from_json_repaired(&v.to_string()).unwrap();
+        let got: Vec<f64> = back.comp(id).unwrap().layers.iter().map(|l| l.stretch).collect();
+        assert_eq!(got, [1.0, -1.0, 100.0, 9900.0, -9900.0, -50.0]);
+        assert_eq!(
+            notes,
+            [
+                "Comp: layer 'tiny' time stretch 1e-300 % → 1 %",
+                "Comp: layer 'reversed tiny' time stretch -1e-300 % → -1 %",
+                "Comp: layer 'zero' time stretch 0 % → 100 %",
+                "Comp: layer 'huge' time stretch 1e300 % → 9900 %",
+                "Comp: layer 'reversed huge' time stretch -50000 % → -9900 %",
+            ]
+        );
+        // A NaN stretch is written as null (an auto-save): the file opens, at 100 %, and says so.
+        // Before, the whole project was refused.
+        v["items"][id.0.to_string()]["kind"]["layers"][0]["stretch"] = serde_json::Value::Null;
+        let (back, notes) = crate::Project::from_json_repaired(&v.to_string()).unwrap();
+        assert_eq!(back.comp(id).unwrap().layers.iter().next().unwrap().stretch, 100.0);
+        assert_eq!(notes.first().map(String::as_str), Some("Comp: layer 'tiny' time stretch NaN % → 100 %"));
+        let mut nan = p.clone();
+        nan.comp_mut(id).unwrap().layers.iter_mut().for_each(|l| l.stretch = f64::NAN);
+        let (back, _) = crate::Project::from_json_repaired(&nan.to_json_compact()).unwrap();
+        assert!(back.comp(id).unwrap().layers.iter().all(|l| l.stretch == 100.0));
+    }
+
     #[test]
     fn a_comp_in_range_is_not_copied() {
         let c = Comp::new(1920, 1080, FrameRate::FPS_24, Tick::from_seconds_f64(2.0));
diff --git a/crates/project/src/props.rs b/crates/project/src/props.rs
index 6212a4b59..9b0b1853c 100644
--- a/crates/project/src/props.rs
+++ b/crates/project/src/props.rs
@@ -127,6 +127,13 @@ impl Property {
         if self.keys.is_empty() {
             return self.value.clone();
         }
+        // 3D Orientation turns along the shortest arc between its keys, as in After Effects.
+        // Routed by `match_id`: "orientation" is only used by the Orientation property of 3D
+        // layers, cameras and lights (`build.rs`), always a `Vec3` of degrees. A future property
+        // must not reuse that id unless it is a rotation that should slerp the same way.
+        if self.match_id == "orientation" && matches!(self.value, Value::Vec3(_)) {
+            return effectcraft_keyframe::evaluate_orientation(&self.keys, t).unwrap_or_else(|| self.value.clone());
+        }
         effectcraft_keyframe::evaluate(&self.keys, t, self.spatial).unwrap_or_else(|| self.value.clone())
     }
     /// Set the value at `t`: adds/replaces a key when animated, else sets the static value.
@@ -205,7 +212,8 @@ pub enum MaskMotionBlur {
     Off,
 }
 
-/// How a mask's feather ramps: Smooth (Gaussian) or Linear.
+/// How a mask's feather ramps: Smooth (three box passes, an S-shaped ramp of finite reach, as
+/// measured in After Effects) or Linear (one box pass: a straight ramp).
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub enum FeatherFalloff {
     #[default]
diff --git a/crates/project/src/reach.rs b/crates/project/src/reach.rs
new file mode 100644
index 000000000..31a2ed567
--- /dev/null
+++ b/crates/project/src/reach.rs
@@ -0,0 +1,405 @@
+//! What a composition's pixels can depend on, from the project in memory: the items it draws
+//! and, when expressions are among them, what those expressions can read (#3184). The disk
+//! cache keys a comp's frames by exactly these items, so an edit elsewhere in the project keeps
+//! them.
+//!
+//! An expression reaches its own comp's layers (`thisComp`, `thisLayer`), the sources of the
+//! layers it can read (`layer.source`, a precomp's layers through it), and other items by name:
+//! `comp("Name")` and `footage("Name")`. A name given as a plain string literal is followed; a
+//! computed name (`comp("Shot " + index)`), the object model's constructors and internals
+//! (`new Comp(7)`, `__h`), dynamic code (`eval`, `Function`) and anything the scanner can't read
+//! for sure (a regular expression literal, a template string, an escape in a name) count as
+//! reaching every item of the project. The scan errs on the side of reaching more: an item
+//! wrongly left out would serve a stale frame, one wrongly let in only renders again.
+//!
+//! Known limit (`ponytail`): an expression that builds the names of the object model's private
+//! fields at run time into a variable and writes them with a computed key it reads from that
+//! variable could forge another comp's id. That is deliberate tampering with the internals, not
+//! an expression one writes; the scan refuses every direct form of it (`__` names, the
+//! constructors, `Object`, `JSON`, `call`/`apply`/`bind`, computed writes and computed keys).
+//! Upgrade: have the expression host record which items an evaluation reached.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use crate::{Comp, ItemId, ItemKind, LayerId, Node, Project, PropGroup, Value};
+
+/// What an expression's text can reach outside its own comp and the layers it can read.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ExprReach {
+    /// Only items named by string literals: comps by `comp("…")`, footage by `footage("…")`.
+    Names { comps: Vec<String>, footage: Vec<String> },
+    /// Any item of the project.
+    Anything,
+}
+
+/// Names that hand an expression another item by id, run code built at run time, or give it the
+/// tools to forge the object model's private fields.
+const REACHES_ANYTHING: &[&str] = &[
+    "Comp",
+    "Footage",
+    "Layer",
+    "Prop",
+    "Markers",
+    "eval",
+    "Function",
+    "globalThis",
+    "this",
+    "self",
+    "window",
+    "arguments",
+    "constructor",
+    "prototype",
+    "Object",
+    "Reflect",
+    "Proxy",
+    "JSON",
+    "call",
+    "apply",
+    "bind",
+    "class",
+    "with",
+    "import",
+    "require",
+    "fromCharCode",
+    "fromCodePoint",
+    "getOwnPropertyDescriptor",
+    "getOwnPropertyDescriptors",
+    "getPrototypeOf",
+    "setPrototypeOf",
+    "defineProperty",
+];
+
+/// Keywords after which a `/` starts a regular expression.
+const BEFORE_REGEX: &[&str] = &["return", "typeof", "instanceof", "in", "of", "new", "delete", "void", "throw", "case", "do", "else", "yield", "await"];
+
+/// Keywords whose `( … )` a regular expression may follow (`if (a) /x/.test(s)`).
+const CONTROL: &[&str] = &["if", "while", "for", "with"];
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Tok<'a> {
+    Ident(&'a str),
+    /// A string literal's text between its quotes; `plain` when it has no escape.
+    Str {
+        text: &'a str,
+        plain: bool,
+    },
+    Num,
+    Punct(u8),
+}
+
+/// The tokens of `text`, or `None` when it can't be read for sure.
+fn tokens(text: &str) -> Option<Vec<Tok<'_>>> {
+    let b = text.as_bytes();
+    let mut out: Vec<Tok<'_>> = Vec::new();
+    // Per open `(`: whether a control keyword is before it; whether the last `)` closed one
+    // (only looked at right after a `)`).
+    let mut parens: Vec<bool> = Vec::new();
+    let mut control_close = false;
+    let mut i = 0;
+    while let Some(&c) = b.get(i) {
+        match c {
+            b' ' | b'\t' | b'\n' | b'\r' | 0x0b | 0x0c => i += 1,
+            b'/' if b.get(i + 1) == Some(&b'/') => {
+                while b.get(i).is_some_and(|c| *c != b'\n') {
+                    i += 1;
+                }
+            }
+            b'/' if b.get(i + 1) == Some(&b'*') => {
+                let end = text.get(i + 2..)?.find("*/")?;
+                i += 2 + end + 2;
+            }
+            b'/' => {
+                if regex_may_start(out.last(), control_close) {
+                    return None;
+                }
+                out.push(Tok::Punct(c));
+                i += 1;
+            }
+            b'"' | b'\'' => {
+                let start = i + 1;
+                let mut j = start;
+                let mut plain = true;
+                loop {
+                    match *b.get(j)? {
+                        q if q == c => break,
+                        b'\n' | b'\r' => return None,
+                        b'\\' => {
+                            // Only escapes that can't spell a name: `\n`, `\t`, a quote...
+                            if !matches!(b.get(j + 1)?, b'n' | b'r' | b't' | b'b' | b'f' | b'v' | b'\'' | b'"' | b'\\') {
+                                return None;
+                            }
+                            plain = false;
+                            j += 2;
+                        }
+                        _ => j += 1,
+                    }
+                }
+                let s = text.get(start..j)?;
+                if s.contains("__") {
+                    return None;
+                }
+                out.push(Tok::Str { text: s, plain });
+                i = j + 1;
+            }
+            b'0'..=b'9' => {
+                while b.get(i).is_some_and(|c| c.is_ascii_alphanumeric() || *c == b'_' || *c == b'.') {
+                    i += 1;
+                }
+                out.push(Tok::Num);
+            }
+            b'.' if b.get(i + 1).is_some_and(u8::is_ascii_digit) => {
+                i += 1;
+                while b.get(i).is_some_and(|c| c.is_ascii_alphanumeric() || *c == b'_' || *c == b'.') {
+                    i += 1;
+                }
+                out.push(Tok::Num);
+            }
+            c if c.is_ascii_alphabetic() || c == b'_' || c == b'$' => {
+                let start = i;
+                while b.get(i).is_some_and(|c| c.is_ascii_alphanumeric() || *c == b'_' || *c == b'$') {
+                    i += 1;
+                }
+                out.push(Tok::Ident(text.get(start..i)?));
+            }
+            // A template string (code inside `${}`), an escaped identifier, a name in another
+            // alphabet: not followed.
+            b'`' | b'\\' => return None,
+            c if !c.is_ascii() => return None,
+            c => {
+                match c {
+                    b'(' => parens.push(matches!(out.last(), Some(Tok::Ident(k)) if CONTROL.contains(k))),
+                    b')' => control_close = parens.pop().unwrap_or(false),
+                    _ => {}
+                }
+                out.push(Tok::Punct(c));
+                i += 1;
+            }
+        }
+    }
+    Some(out)
+}
+
+/// Whether a `/` after `prev` may start a regular expression literal (which the scanner doesn't
+/// read: its text could hide a quote).
+fn regex_may_start(prev: Option<&Tok<'_>>, control_close: bool) -> bool {
+    match prev {
+        None => true,
+        Some(Tok::Ident(k)) => BEFORE_REGEX.contains(k),
+        Some(Tok::Num | Tok::Str { .. }) => false,
+        Some(Tok::Punct(b')')) => control_close,
+        Some(Tok::Punct(b']')) => false,
+        Some(Tok::Punct(_)) => true,
+    }
+}
+
+/// What the expression `text` can reach by name, or [`ExprReach::Anything`].
+pub fn expression_reach(text: &str) -> ExprReach {
+    expression_names(text).map_or(ExprReach::Anything, |(comps, footage)| ExprReach::Names { comps, footage })
+}
+
+/// The comp names and footage names an expression references by literal name.
+/// Returns `None` when it can reach anything by a computed name or cannot be tokenised.
+fn expression_names(text: &str) -> Option<(Vec<String>, Vec<String>)> {
+    let toks = tokens(text)?;
+    let (mut comps, mut footage) = (Vec::new(), Vec::new());
+    // Per open `[`: a computed key (`{[k]: v}`), a computed member (`o[k]`).
+    let mut brackets: Vec<(bool, bool)> = Vec::new();
+    for (i, t) in toks.iter().enumerate() {
+        let prev = i.checked_sub(1).and_then(|p| toks.get(p));
+        let next = |n: usize| toks.get(i + n);
+        match *t {
+            Tok::Ident(name) if name.starts_with("__") || REACHES_ANYTHING.contains(&name) => return None,
+            Tok::Ident(name @ ("comp" | "footage")) => {
+                // Only a call with a plain literal, not a property of something else.
+                let (Some(Tok::Punct(b'(')), Some(Tok::Str { text, plain: true }), Some(Tok::Punct(b')'))) = (next(1), next(2), next(3)) else { return None };
+                if matches!(prev, Some(Tok::Punct(b'.'))) {
+                    return None;
+                }
+                if name == "comp" { comps.push((*text).to_string()) } else { footage.push((*text).to_string()) }
+            }
+            Tok::Punct(b'[') => {
+                let key = matches!(prev, Some(Tok::Punct(b'{' | b',')) | Some(Tok::Ident("get" | "set" | "static" | "async")) | Some(Tok::Punct(b'*')));
+                let member = matches!(prev, Some(Tok::Ident(_) | Tok::Str { .. } | Tok::Num | Tok::Punct(b')' | b']' | b'.')));
+                brackets.push((key, member));
+            }
+            Tok::Str { .. } if brackets.last().is_some_and(|(_, member)| *member) => return None,
+            Tok::Punct(b']') => {
+                let (key, _) = brackets.pop().unwrap_or((true, true));
+                // A computed key (`{[k]: v}`, `{[k]() {}}`) or a write through brackets (`o[k] = v`,
+                // `o[k] ||= v`, `for (o[k] in …)`, `[o[k]] = v`) could name a private field.
+                if key && matches!(next(1), Some(Tok::Punct(b':' | b'('))) {
+                    return None;
+                }
+                if assigns(&toks, i + 1) || matches!(next(1), Some(Tok::Ident("in" | "of"))) {
+                    return None;
+                }
+            }
+            // A destructuring write (`({a: o[k]} = v)`).
+            Tok::Punct(b'}') if assigns(&toks, i + 1) => return None,
+            _ => {}
+        }
+    }
+    Some((comps, footage))
+}
+
+/// Whether the tokens from `at` are an assignment operator (`=`, `+=`, `>>>=`, `??=`...), not a
+/// comparison (`==`, `<=`) or an arrow (`=>`).
+fn assigns(toks: &[Tok<'_>], at: usize) -> bool {
+    let mut op = Vec::new();
+    for t in toks.iter().skip(at).take(5) {
+        match t {
+            Tok::Punct(c) if b"+-*/%&|^<>?=".contains(c) => op.push(*c),
+            _ => break,
+        }
+    }
+    let Some(eq) = op.iter().position(|c| *c == b'=') else { return false };
+    let (before, after) = op.split_at(eq);
+    if after.get(1).is_some_and(|c| *c == b'=' || *c == b'>') {
+        return false;
+    }
+    matches!(before, b"" | b"+" | b"-" | b"*" | b"/" | b"%" | b"&" | b"|" | b"^" | b"**" | b"<<" | b">>" | b">>>" | b"&&" | b"||" | b"??")
+}
+
+/// The items a comp's pixels can depend on ([`Project::pixel_reach`]).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct PixelReach {
+    /// The items whose state counts; `None`: every item of the project.
+    pub items: Option<BTreeSet<ItemId>>,
+    /// Expressions are among them: they can read every layer of the comps they reach (hidden
+    /// and silent ones too) and the markers, which therefore count as well (#1083).
+    pub expressions: bool,
+    /// The names expressions look items up by (`true`: a comp's, `false`: footage's), each with
+    /// the ids of the items of that kind that have it now, in id order (the first one is what
+    /// the lookup finds; another item taking or giving up the name changes it).
+    pub names: Vec<(bool, String, Vec<ItemId>)>,
+}
+
+/// Each property of a group and its subgroups (iterative: no depth limit to hit).
+fn each_prop<'a>(g: &'a PropGroup, f: &mut dyn FnMut(&'a crate::Property) -> Option<()>) -> Option<()> {
+    let mut stack = vec![g];
+    while let Some(g) = stack.pop() {
+        for n in &g.children {
+            match n {
+                Node::Prop(p) => f(p)?,
+                Node::Group(sub) => stack.push(sub),
+            }
+        }
+    }
+    Some(())
+}
+
+impl Project {
+    /// The items comp `comp` draws ([`Self::silent_layers`] aside, with `heard`) and the
+    /// footage its precomp layers swap in (Essential Graphics Media Replacement); with an
+    /// expression in any of its comps, everything those expressions can reach
+    /// ([`expression_reach`]). Memory only: no file is looked at.
+    pub fn pixel_reach(&self, comp: ItemId, heard: &crate::Heard) -> PixelReach {
+        let Some(drawn) = self.reach_walk(comp, &|id, c| self.silent_layers(id, c, heard), &mut |_| Some(vec![])) else { return PixelReach::every() };
+        let has_expression = |g: &PropGroup| each_prop(g, &mut |p| p.expr.is_none().then_some(())).is_none();
+        if !drawn.iter().filter_map(|id| self.comp(*id)).any(|c| c.layers.iter().any(|l| has_expression(&l.props))) {
+            return PixelReach { items: Some(drawn), expressions: false, names: vec![] };
+        }
+        // Expressions: every layer of a comp they reach counts, and what they name.
+        let mut names: BTreeMap<(bool, String), Vec<ItemId>> = BTreeMap::new();
+        let mut scan = |p: &crate::Property| match p.expr.as_ref().map(|e| expression_reach(&e.text)) {
+            None => Some(vec![]),
+            Some(ExprReach::Anything) => None,
+            Some(ExprReach::Names { comps, footage }) => {
+                let mut found = vec![];
+                for (is_comp, name) in comps.into_iter().map(|n| (true, n)).chain(footage.into_iter().map(|n| (false, n))) {
+                    let ids = self.named(is_comp, &name);
+                    found.extend(ids.iter().copied());
+                    names.insert((is_comp, name), ids);
+                }
+                Some(found)
+            }
+        };
+        let Some(mut items) = self.reach_walk(comp, &|_, _| BTreeSet::new(), &mut scan) else { return PixelReach::every() };
+        // A source's data is read by its name (`layer.source.sourceData`).
+        let footage_names: BTreeSet<&str> =
+            items.iter().filter_map(|id| self.item(*id)).filter(|i| matches!(i.kind, ItemKind::Footage(_))).map(|i| i.name.as_str()).collect();
+        let same_name: Vec<ItemId> =
+            self.items.values().filter(|i| matches!(i.kind, ItemKind::Footage(_)) && footage_names.contains(i.name.as_str())).map(|i| i.id).collect();
+        items.extend(same_name);
+        PixelReach { items: Some(items), expressions: true, names: names.into_iter().map(|((c, n), ids)| (c, n, ids)).collect() }
+    }
+
+    /// The items of one kind (`is_comp`: comps, else footage) named `name`, in id order.
+    fn named(&self, is_comp: bool, name: &str) -> Vec<ItemId> {
+        self.items
+            .values()
+            .filter(|i| i.name == name && if is_comp { matches!(i.kind, ItemKind::Comp(_)) } else { matches!(i.kind, ItemKind::Footage(_)) })
+            .map(|i| i.id)
+            .collect()
+    }
+
+    /// The items reached from `comp` through its layers (but those `quiet` names) and the items
+    /// `scan` returns for each of their properties; `None` when something reaches every item.
+    /// (A stack and a visited set: each item is visited once, cycles included.)
+    fn reach_walk(
+        &self,
+        comp: ItemId,
+        quiet: &dyn Fn(ItemId, &Comp) -> BTreeSet<LayerId>,
+        scan: &mut dyn FnMut(&crate::Property) -> Option<Vec<ItemId>>,
+    ) -> Option<BTreeSet<ItemId>> {
+        let mut seen = BTreeSet::new();
+        let mut stack = vec![comp];
+        while let Some(id) = stack.pop() {
+            if !seen.insert(id) {
+                continue;
+            }
+            let Some(c) = self.comp(id) else { continue };
+            let quiet = quiet(id, c);
+            for l in c.layers.iter().filter(|l| !quiet.contains(&l.id)) {
+                // Every source item: a 3D model's too (it is drawn, and `layer.source` reads its
+                // name and size).
+                if let Some(item) = l.source.item() {
+                    stack.push(item);
+                }
+                stack.extend(self.media_replacements(l)?);
+                let mut reached = vec![];
+                each_prop(&l.props, &mut |p| {
+                    reached.extend(scan(p)?);
+                    Some(())
+                })?;
+                stack.extend(reached);
+            }
+        }
+        Some(seen)
+    }
+
+    /// The footage a precomp layer swaps in through its Essential Properties (Media Replacement):
+    /// the items its overridden properties name. `None` when they can't be listed (an
+    /// expression or keyframes choose the item over time).
+    fn media_replacements(&self, layer: &crate::Layer) -> Option<Vec<ItemId>> {
+        let over = crate::essential::overridden(layer);
+        let Some(g) = crate::essential::group(layer).filter(|_| !over.is_empty()) else { return Some(vec![]) };
+        let mut out = vec![];
+        each_prop(g, &mut |p| {
+            if !over.contains(&p.uid) {
+                return Some(());
+            }
+            if p.expr.is_some() || !p.keys.is_empty() {
+                return None;
+            }
+            if let Value::Scalar(id) = p.value {
+                let item = ItemId(id.max(0.0) as u64);
+                if matches!(self.item(item).map(|i| &i.kind), Some(ItemKind::Footage(_))) {
+                    out.push(item);
+                }
+            }
+            Some(())
+        })?;
+        Some(out)
+    }
+}
+
+impl PixelReach {
+    /// Every item of the project, with expressions.
+    fn every() -> PixelReach {
+        PixelReach { items: None, expressions: true, names: vec![] }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/project/src/reach/tests.rs b/crates/project/src/reach/tests.rs
new file mode 100644
index 000000000..53db8172a
--- /dev/null
+++ b/crates/project/src/reach/tests.rs
@@ -0,0 +1,198 @@
+use super::*;
+use crate::{Expression, LayerSource, Solid, build};
+use effectcraft_time::{FrameRate, Tick};
+
+fn names(comps: &[&str], footage: &[&str]) -> ExprReach {
+    ExprReach::Names { comps: comps.iter().map(|s| s.to_string()).collect(), footage: footage.iter().map(|s| s.to_string()).collect() }
+}
+
+/// Expressions that read their own comp, or other items by literal names, are followed; every
+/// way to reach items by a computed name or an id, or text the scanner can't read for sure,
+/// reaches everything.
+#[test]
+fn expression_reach_follows_literal_names_and_refuses_the_rest() {
+    let follows = [
+        ("wiggle(2, 20)", names(&[], &[])),
+        ("thisComp.layer(\"Comp 1 Layer\").transform.opacity * 2 / 3", names(&[], &[])),
+        ("value + [10, 0]; value[0] / 2", names(&[], &[])),
+        ("// comp(name) in a comment\n/* footage(x) */ value", names(&[], &[])),
+        ("\"a string that says comp(x) and Layer\"", names(&[], &[])),
+        ("comp(\"Other\").layer(1).transform.position", names(&["Other"], &[])),
+        ("comp( 'A' ).width + comp(\"B\").height", names(&["A", "B"], &[])),
+        ("footage(\"data.json\").sourceData.x", names(&[], &["data.json"])),
+        ("x = a[0] <= b ? a[1] : 0; y = a[0] == 1", names(&[], &[])),
+        ("thisLayer.source.layer(1).name", names(&[], &[])),
+        ("if (a) x = 1; else x = 2; (a + b) / 2", names(&[], &[])),
+        ("\"Ünïcödé name\"", names(&[], &[])),
+        ("const f = (v) => v * 2; f(1)", names(&[], &[])),
+    ];
+    for (text, want) in follows {
+        assert_eq!(expression_reach(text), want, "{text}");
+    }
+    let anything = [
+        "comp(\"Shot \" + index).layer(1)",
+        "comp(name)",
+        "var n = \"Other\"; comp(n)",
+        "comp(\"O\\\"ther\")",
+        "x.comp(\"Other\")",
+        "var comp = 1",
+        "footage(thisComp.name)",
+        "new Comp(7).layer(1)",
+        "Layer(7, 3).name",
+        "__h(__COMP, 7)",
+        "o.__c = 7",
+        "eval('1')",
+        "Function('return 1')()",
+        "this.x",
+        "({}).constructor",
+        "Object.getPrototypeOf(thisComp)",
+        "JSON.parse(s)",
+        "thisComp.layer.call(o, 1)",
+        "o['_' + '_c']",
+        "o[k] = 7",
+        "o[k] ||= 7",
+        "o[k] += 7",
+        "[o[k]] = [7]",
+        "({a: o[k]} = {a: 7})",
+        "for (o[k] in x) {}",
+        "({[k]: 7})",
+        "({a: 1, [k]: 7})",
+        "o = {'__c': 7}",
+        "'\\x5f\\x5fc'",
+        "'\\_\\_c'",
+        "`${x}`",
+        "c\\u006fmp('A')",
+        "comp\u{0430}('A')",
+        "/\"/.test(s); comp(n); \"",
+        "return /x/",
+        "if (a) /\"/.test(s)",
+        "x = '",
+        "/* comp(n)",
+        "class X {}",
+        "String.fromCharCode(95)",
+    ];
+    for text in anything {
+        assert_eq!(expression_reach(text), ExprReach::Anything, "{text}");
+    }
+}
+
+/// `a / b` divides after a name, a number, a string and a closing bracket or parenthesis.
+#[test]
+fn division_is_not_a_regular_expression() {
+    for text in ["a / b", "2 / 3", "'a' / 2", "x[0] / 2", "(a + b) / 2", "f(x) / 2 / g(y)"] {
+        assert_eq!(expression_reach(text), names(&[], &[]), "{text}");
+    }
+}
+
+struct Fixture {
+    p: Project,
+    main: ItemId,
+    other: ItemId,
+    third: ItemId,
+    unused: ItemId,
+    solid: ItemId,
+}
+
+/// Comps "Main" (a solid), "Other" (a solid), "Third" (empty), an unused footage item.
+fn fixture() -> Fixture {
+    let mut p = Project::default();
+    let comp = Comp::new(64, 64, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+    let solid =
+        p.add_item("Solid", effectcraft_color::Label::None, None, ItemKind::Solid(Solid { color: [1.0, 0.0, 0.0], width: 64, height: 64, pixel_aspect: 1.0 }));
+    let main = p.add_item("Main", effectcraft_color::Label::None, None, ItemKind::Comp(comp.clone().into()));
+    let other = p.add_item("Other", effectcraft_color::Label::None, None, ItemKind::Comp(comp.clone().into()));
+    let third = p.add_item("Third", effectcraft_color::Label::None, None, ItemKind::Comp(comp.clone().into()));
+    let unused = p.add_item("unused.png", effectcraft_color::Label::None, None, ItemKind::Footage(crate::Footage { has_video: true, ..Default::default() }));
+    for c in [main, other] {
+        let l = build::layer(&mut p, &comp, "S", LayerSource::Solid { item: solid }, (64, 64), None);
+        p.comp_mut(c).unwrap().layers.push(l);
+    }
+    Fixture { p, main, other, third, unused, solid }
+}
+
+fn set_expr(p: &mut Project, comp: ItemId, text: &str) {
+    let l = p.comp_mut(comp).unwrap().layers.first_mut().unwrap();
+    l.props.prop_mut("transform/opacity").unwrap().expr = Some(Expression { text: text.into(), enabled: true });
+}
+
+fn reach(p: &Project, comp: ItemId) -> PixelReach {
+    p.pixel_reach(comp, &p.heard_layers())
+}
+
+#[test]
+fn pixel_reach_is_what_the_comp_draws_and_what_its_expressions_name() {
+    let mut f = fixture();
+    let ids = |r: &PixelReach| r.items.clone().map(|s| s.into_iter().collect::<Vec<_>>());
+    assert_eq!(reach(&f.p, f.main), PixelReach { items: Some([f.solid, f.main].into()), expressions: false, names: vec![] });
+    // An expression reading only its own comp: what it draws, with expressions.
+    set_expr(&mut f.p, f.main, "thisComp.layer(1).transform.opacity");
+    let r = reach(&f.p, f.main);
+    assert!(r.expressions);
+    assert_eq!(ids(&r), Some(vec![f.solid, f.main]));
+    // An expression in another comp doesn't reach this one.
+    set_expr(&mut f.p, f.other, "wiggle(1, 1)");
+    assert_eq!(ids(&reach(&f.p, f.main)), Some(vec![f.solid, f.main]));
+    // A literal name: that comp and what it draws, with the name and the comps that have it.
+    set_expr(&mut f.p, f.main, "comp(\"Other\").layer(1).transform.opacity");
+    let r = reach(&f.p, f.main);
+    assert_eq!(ids(&r), Some(vec![f.solid, f.main, f.other]));
+    assert_eq!(r.names, vec![(true, "Other".to_string(), vec![f.other])]);
+    // Another comp taking the name is part of it, whichever the lookup finds.
+    f.p.item_mut(f.third).unwrap().name = "Other".into();
+    let r = reach(&f.p, f.main);
+    assert_eq!(r.names, vec![(true, "Other".to_string(), vec![f.other, f.third])]);
+    assert!(r.items.unwrap().contains(&f.third));
+    // A name no item has yet still counts (with no item).
+    set_expr(&mut f.p, f.main, "footage(\"later.json\").sourceData");
+    assert_eq!(reach(&f.p, f.main).names, vec![(false, "later.json".to_string(), vec![])]);
+    // A computed name reaches everything.
+    set_expr(&mut f.p, f.main, "comp(\"Ot\" + \"her\").width");
+    assert_eq!(reach(&f.p, f.main), PixelReach { items: None, expressions: true, names: vec![] });
+    // Footage reached as a layer's source brings the footage of its name (its data is read by
+    // name).
+    let comp = f.p.comp(f.main).unwrap().clone();
+    let l = build::layer(&mut f.p, &comp, "U", LayerSource::Footage { item: f.unused }, (64, 64), None);
+    f.p.comp_mut(f.main).unwrap().layers.push(l);
+    let twin = f.p.add_item("unused.png", effectcraft_color::Label::None, None, ItemKind::Footage(crate::Footage::default()));
+    set_expr(&mut f.p, f.main, "value");
+    let r = reach(&f.p, f.main).items.unwrap();
+    assert!(r.contains(&f.unused) && r.contains(&twin), "{r:?}");
+}
+
+/// A comp nested in the reach is scanned too: its expression's names count for the outer comp.
+#[test]
+fn nested_comps_bring_their_expressions_reach() {
+    let mut f = fixture();
+    let comp = f.p.comp(f.main).unwrap().clone();
+    let pre = build::layer(&mut f.p, &comp, "Pre", LayerSource::Comp { item: f.other }, (64, 64), None);
+    f.p.comp_mut(f.main).unwrap().layers.push(pre);
+    set_expr(&mut f.p, f.other, "comp(\"Third\").width");
+    let r = reach(&f.p, f.main);
+    assert!(r.expressions && r.items.unwrap().contains(&f.third));
+    // A cycle through names ends.
+    let l = build::layer(&mut f.p, &comp, "S", LayerSource::Solid { item: f.solid }, (64, 64), None);
+    f.p.comp_mut(f.third).unwrap().layers.push(l);
+    set_expr(&mut f.p, f.third, "comp(\"Main\").width");
+    assert!(reach(&f.p, f.main).items.unwrap().contains(&f.main));
+}
+
+/// A 3D model layer's item is reached like any other source: it is drawn, and an expression
+/// reads its name and size through `layer.source` (a renamed model left the comp's disk key and
+/// its old frames in place).
+#[test]
+fn model_sources_are_reached() {
+    let mut f = fixture();
+    let model = f.p.add_item(
+        "chair.glb",
+        effectcraft_color::Label::None,
+        None,
+        ItemKind::Footage(crate::Footage { kind: crate::FootageKind::Model, ..Default::default() }),
+    );
+    let comp = f.p.comp(f.main).unwrap().clone();
+    let l = build::layer(&mut f.p, &comp, "Model", LayerSource::Model { item: model }, (64, 64), None);
+    f.p.comp_mut(f.main).unwrap().layers.push(l);
+    assert!(reach(&f.p, f.main).items.unwrap().contains(&model), "drawn");
+    set_expr(&mut f.p, f.main, "thisComp.layer(\"Model\").source.name.length");
+    let r = reach(&f.p, f.main);
+    assert!(r.expressions && r.items.unwrap().contains(&model), "read by an expression");
+}
diff --git a/crates/project/src/render_queue.rs b/crates/project/src/render_queue.rs
index 2d3ab741b..8635bc9a8 100644
--- a/crates/project/src/render_queue.rs
+++ b/crates/project/src/render_queue.rs
@@ -442,9 +442,18 @@ impl RenderSettings {
     pub fn frame_time(&self, comp: &Comp, i: u64) -> Tick {
         self.rate(comp).tick_of(self.first_frame(comp) + i as i64)
     }
-    pub fn output_size(&self, comp: &Comp) -> (u32, u32) {
+    pub fn effective_scale(&self, comp: &Comp) -> f64 {
         let s = self.resolution.clamp(0.01, 4.0);
-        (((comp.width as f64 * s).round() as u32).max(1), ((comp.height as f64 * s).round() as u32).max(1))
+        let max = f64::from(crate::limits::MAX_SIZE);
+        s.min(max / f64::from(comp.width.max(1))).min(max / f64::from(comp.height.max(1)))
+    }
+    pub fn output_size(&self, comp: &Comp) -> (u32, u32) {
+        let s = self.effective_scale(comp);
+        // The scale is clamped so neither side exceeds the comp limit, keeping the aspect
+        // ratio: a 30 000 px side at 4x renders at 1x instead of cropping to a corner.
+        let w = ((comp.width as f64 * s).round() as u32).max(1);
+        let h = ((comp.height as f64 * s).round() as u32).max(1);
+        (w, h)
     }
     pub fn resolution_label(&self) -> &'static str {
         match self.resolution {
@@ -509,6 +518,9 @@ pub enum OutputFormat {
     TiffSequence,
     /// OpenEXR sequence (32-bit float, linear light).
     ExrSequence,
+    /// Targa sequence: uncompressed 24-bit RGB or 32-bit RGB + Alpha (8 alpha bits), top-left
+    /// origin.
+    TargaSequence,
     /// Animated GIF.
     Gif,
     /// WebM: VP9 video (alpha with RGB + Alpha) + Opus audio.
@@ -528,7 +540,7 @@ pub enum OutputFormat {
 }
 
 impl OutputFormat {
-    pub const ALL: [OutputFormat; 13] = [
+    pub const ALL: [OutputFormat; 14] = [
         OutputFormat::H264,
         OutputFormat::Hevc,
         OutputFormat::Av1,
@@ -539,6 +551,7 @@ impl OutputFormat {
         OutputFormat::JpegSequence,
         OutputFormat::TiffSequence,
         OutputFormat::ExrSequence,
+        OutputFormat::TargaSequence,
         OutputFormat::Gif,
         OutputFormat::Wav,
         OutputFormat::Aiff,
@@ -552,6 +565,7 @@ impl OutputFormat {
             OutputFormat::JpegSequence => "JPEG Sequence",
             OutputFormat::TiffSequence => "TIFF Sequence",
             OutputFormat::ExrSequence => "OpenEXR Sequence",
+            OutputFormat::TargaSequence => "Targa Sequence",
             OutputFormat::Gif => "Animated GIF",
             OutputFormat::WebM => "WebM (VP9 + Opus)",
             OutputFormat::Wav => "WAV",
@@ -569,6 +583,7 @@ impl OutputFormat {
             OutputFormat::JpegSequence => "jpg",
             OutputFormat::TiffSequence => "tif",
             OutputFormat::ExrSequence => "exr",
+            OutputFormat::TargaSequence => "tga",
             OutputFormat::Gif => "gif",
             OutputFormat::WebM => "webm",
             OutputFormat::Wav => "wav",
@@ -577,7 +592,10 @@ impl OutputFormat {
         }
     }
     pub fn is_sequence(self) -> bool {
-        matches!(self, OutputFormat::PngSequence | OutputFormat::JpegSequence | OutputFormat::TiffSequence | OutputFormat::ExrSequence)
+        matches!(
+            self,
+            OutputFormat::PngSequence | OutputFormat::JpegSequence | OutputFormat::TiffSequence | OutputFormat::ExrSequence | OutputFormat::TargaSequence
+        )
     }
     pub fn is_movie(self) -> bool {
         matches!(self, OutputFormat::H264 | OutputFormat::ProRes | OutputFormat::Uncompressed | OutputFormat::WebM | OutputFormat::Hevc | OutputFormat::Av1)
@@ -603,7 +621,7 @@ impl OutputFormat {
         if matches!(self, OutputFormat::H264 | OutputFormat::Hevc) { (even(w), even(h)) } else { (w, h) }
     }
     /// Parse a format name: `h264`, `mp4`, `prores`, `mov`, `uncompressed`, `png`, `jpeg`/`jpg`,
-    /// `tiff`/`tif`, `exr`, `gif`, or a label.
+    /// `tiff`/`tif`, `exr`, `tga`/`targa`, `gif`, or a label.
     pub fn from_name(s: &str) -> Option<OutputFormat> {
         let n = s.trim().to_ascii_lowercase().replace([' ', '.', '-', '_'], "");
         Some(match n.as_str() {
@@ -616,6 +634,7 @@ impl OutputFormat {
             "jpg" | "jpeg" | "jpegsequence" => OutputFormat::JpegSequence,
             "tif" | "tiff" | "tiffsequence" => OutputFormat::TiffSequence,
             "exr" | "openexr" | "openexrsequence" => OutputFormat::ExrSequence,
+            "tga" | "targa" | "targasequence" => OutputFormat::TargaSequence,
             "gif" | "animatedgif" => OutputFormat::Gif,
             "webm" | "vp9" | "webmvp9opus" => OutputFormat::WebM,
             "wav" | "wave" => OutputFormat::Wav,
@@ -769,15 +788,18 @@ impl Crop {
         if self.use_roi
             && let Some([x, y, rw, rh]) = self.roi
         {
-            // The quad arrives unvalidated (control channel or a hand-edited project):
-            // clamp like the sibling edge fields (plus/minus 20 000) and subtract
-            // without overflow.
-            let conv = |v: f64| v.round().clamp(-20_000.0, 20_000.0) as i32;
-            let l = conv(x * scale);
-            let t = conv(y * scale);
-            let r = (w as i32).saturating_sub(conv((x + rw) * scale));
-            let b = (h as i32).saturating_sub(conv((y + rh) * scale));
-            return (t, l, b, r);
+            // The quad arrives unvalidated (control channel or a hand-edited project). As in
+            // After Effects, the region of interest lies inside the frame: each converted edge
+            // is clamped to [0, w] / [0, h] (inf clamps to a side, NaN converts to 0), and the
+            // far edge never passes the near one. Every edge then lies inside the frame, so the
+            // crop can't be larger than the frame and no subtraction can overflow.
+            let (wi, hi) = (i32::try_from(w).unwrap_or(i32::MAX), i32::try_from(h).unwrap_or(i32::MAX));
+            let conv = |v: f64, side: i32| v.round().clamp(0.0, f64::from(side)) as i32;
+            let l = conv(x * scale, wi);
+            let t = conv(y * scale, hi);
+            let r = conv((x + rw) * scale, wi).max(l);
+            let b = conv((y + rh) * scale, hi).max(t);
+            return (t, l, hi - b, wi - r);
         }
         (self.top, self.left, self.bottom, self.right)
     }
@@ -873,6 +895,141 @@ impl ProResProfile {
     }
 }
 
+/// OpenEXR sequence compression. Every method writes scan lines, in blocks of the method's own
+/// height (1 line for None, RLE and ZIPS; 16 for ZIP and PXR24; 32 for PIZ, B44, B44A and DWAA;
+/// 256 for DWAB).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ExrCompression {
+    None,
+    Rle,
+    /// ZIP, one scan line per block.
+    Zips,
+    /// ZIP, 16 scan lines per block.
+    #[default]
+    Zip,
+    Piz,
+    /// Lossy for 32-bit float (rounded to 24 bits), lossless for half float.
+    Pxr24,
+    /// Lossy for half float; 32-bit float channels are stored uncompressed.
+    B44,
+    /// B44 that also packs flat areas smaller; lossy for half float, 32-bit float is stored uncompressed.
+    B44a,
+    /// Lossy DCT, 32 scan lines per block.
+    Dwaa,
+    /// Lossy DCT, 256 scan lines per block.
+    Dwab,
+}
+
+impl ExrCompression {
+    pub const ALL: [ExrCompression; 10] = [
+        ExrCompression::None,
+        ExrCompression::Rle,
+        ExrCompression::Zips,
+        ExrCompression::Zip,
+        ExrCompression::Piz,
+        ExrCompression::Pxr24,
+        ExrCompression::B44,
+        ExrCompression::B44a,
+        ExrCompression::Dwaa,
+        ExrCompression::Dwab,
+    ];
+    /// The parameter value (`exrCompression`).
+    pub fn name(self) -> &'static str {
+        match self {
+            ExrCompression::None => "none",
+            ExrCompression::Rle => "rle",
+            ExrCompression::Zips => "zips",
+            ExrCompression::Zip => "zip",
+            ExrCompression::Piz => "piz",
+            ExrCompression::Pxr24 => "pxr24",
+            ExrCompression::B44 => "b44",
+            ExrCompression::B44a => "b44a",
+            ExrCompression::Dwaa => "dwaa",
+            ExrCompression::Dwab => "dwab",
+        }
+    }
+    pub fn label(self) -> &'static str {
+        match self {
+            ExrCompression::None => "None",
+            ExrCompression::Rle => "RLE",
+            ExrCompression::Zips => "ZIPS (1 scan line)",
+            ExrCompression::Zip => "ZIP (16 scan lines)",
+            ExrCompression::Piz => "PIZ",
+            ExrCompression::Pxr24 => "PXR24",
+            ExrCompression::B44 => "B44",
+            ExrCompression::B44a => "B44A",
+            ExrCompression::Dwaa => "DWAA",
+            ExrCompression::Dwab => "DWAB",
+        }
+    }
+    /// Whether the written samples can differ from the rendered ones at `depth` (half float is
+    /// already rounded from the 32-bit render; that rounding is not counted here).
+    pub fn is_lossy(self, depth: ExrBitDepth) -> bool {
+        match self {
+            ExrCompression::None | ExrCompression::Rle | ExrCompression::Zips | ExrCompression::Zip | ExrCompression::Piz => false,
+            ExrCompression::Pxr24 => depth == ExrBitDepth::Float,
+            ExrCompression::B44 | ExrCompression::B44a => depth == ExrBitDepth::Half,
+            ExrCompression::Dwaa | ExrCompression::Dwab => true,
+        }
+    }
+    /// Whether the method leaves the samples uncompressed at `depth` (B44 and B44A pack only half
+    /// floats).
+    pub fn stores_uncompressed(self, depth: ExrBitDepth) -> bool {
+        self == ExrCompression::None || (matches!(self, ExrCompression::B44 | ExrCompression::B44a) && depth == ExrBitDepth::Float)
+    }
+    /// Parse a compression name: `none`/`uncompressed`, `rle`, `zips`/`zip1` (Nuke's "Zip (1
+    /// scanline)"), `zip`/`zip16`,
+    /// `piz`, `pxr24`, `b44`, `b44a`, `dwaa`, `dwab` (any case).
+    pub fn from_name(s: &str) -> Option<ExrCompression> {
+        let n = s.to_ascii_lowercase().replace([' ', '-', '_', '(', ')'], "");
+        match n.as_str() {
+            "uncompressed" | "off" => Some(ExrCompression::None),
+            "zip1" | "zips1scanline" | "zip1scanline" | "zip1scanlines" => Some(ExrCompression::Zips),
+            "zip16" | "zip16scanlines" => Some(ExrCompression::Zip),
+            _ => ExrCompression::ALL.into_iter().find(|c| c.name() == n),
+        }
+    }
+}
+
+/// OpenEXR sequence sample type: 16-bit half float (the usual VFX interchange) or 32-bit float.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ExrBitDepth {
+    Half,
+    #[default]
+    Float,
+}
+
+impl ExrBitDepth {
+    pub const ALL: [ExrBitDepth; 2] = [ExrBitDepth::Half, ExrBitDepth::Float];
+    /// The parameter value (`exrBitDepth`).
+    pub fn name(self) -> &'static str {
+        match self {
+            ExrBitDepth::Half => "half",
+            ExrBitDepth::Float => "float",
+        }
+    }
+    pub fn label(self) -> &'static str {
+        match self {
+            ExrBitDepth::Half => "16-bit Half Float",
+            ExrBitDepth::Float => "32-bit Float",
+        }
+    }
+    pub fn bits(self) -> u32 {
+        match self {
+            ExrBitDepth::Half => 16,
+            ExrBitDepth::Float => 32,
+        }
+    }
+    /// Parse `half`/`16`/`f16` or `float`/`32`/`f32` (any case).
+    pub fn from_name(s: &str) -> Option<ExrBitDepth> {
+        match s.to_ascii_lowercase().replace([' ', '-', '_'], "").as_str() {
+            "half" | "16" | "f16" | "16bit" | "halffloat" | "16bithalffloat" => Some(ExrBitDepth::Half),
+            "float" | "32" | "f32" | "32bit" | "full" | "fullfloat" | "32bitfloat" => Some(ExrBitDepth::Float),
+            _ => None,
+        }
+    }
+}
+
 /// HEVC / AV1 profile: 8-bit (HEVC Main, AV1 Main 8-bit) or 10-bit (HEVC Main 10, AV1 Main 10-bit).
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum CodecProfile {
@@ -1043,6 +1200,10 @@ pub struct OutputModule {
     /// Movies: frames between key frames (0 = automatic, two seconds).
     pub keyframe_interval: u32,
     pub prores_profile: ProResProfile,
+    /// OpenEXR sequence: compression (scan lines).
+    pub exr_compression: ExrCompression,
+    /// OpenEXR sequence: half or 32-bit float samples.
+    pub exr_bit_depth: ExrBitDepth,
     pub crop: Crop,
     pub resize: Resize,
     pub audio: AudioOutput,
@@ -1077,6 +1238,8 @@ impl Default for OutputModule {
             webm_bitrate: false,
             keyframe_interval: 0,
             prores_profile: ProResProfile::Hq,
+            exr_compression: ExrCompression::Zip,
+            exr_bit_depth: ExrBitDepth::Float,
             crop: Crop::default(),
             resize: Resize::default(),
             audio: AudioOutput::Auto,
@@ -1116,7 +1279,7 @@ impl OutputModule {
     /// rounding).
     pub fn output_size(&self, comp: &Comp, settings: &RenderSettings) -> (u32, u32) {
         let (w, h) = settings.output_size(comp);
-        let (w, h) = self.frame_size(w, h, settings.resolution.clamp(0.01, 4.0));
+        let (w, h) = self.frame_size(w, h, settings.effective_scale(comp));
         self.format.coded_size(w, h)
     }
     /// Every setting as `(label, value)` lines (render logs).
@@ -1133,6 +1296,10 @@ impl OutputModule {
         match self.format {
             OutputFormat::H264 => v.push(("Bitrate", format!("{} kbps", self.bitrate_kbps))),
             OutputFormat::ProRes => v.push(("Codec", self.prores_profile.label().into())),
+            OutputFormat::ExrSequence => {
+                v.push(("Compression", self.exr_compression_label()));
+                v.push(("Bit Depth", self.exr_bit_depth.label().into()));
+            }
             OutputFormat::WebM if self.webm_bitrate => v.push(("Bitrate", format!("{} kbps", self.bitrate_kbps))),
             OutputFormat::WebM | OutputFormat::JpegSequence => v.push(("Quality", self.quality.to_string())),
             _ => {}
@@ -1193,6 +1360,18 @@ impl OutputModule {
         }
         self.output = format!("{stem}.{}", format.extension());
     }
+    /// The OpenEXR compression's label, marked when it is lossy at the module's bit depth or, for
+    /// B44 / B44A at 32-bit float, stores the samples uncompressed.
+    pub fn exr_compression_label(&self) -> String {
+        let (c, d) = (self.exr_compression, self.exr_bit_depth);
+        if c.is_lossy(d) {
+            format!("{} (lossy)", c.label())
+        } else if c != ExrCompression::None && c.stores_uncompressed(d) {
+            format!("{} (uncompressed at float)", c.label())
+        } else {
+            c.label().into()
+        }
+    }
     /// Whether this module can write alpha (the format can, and WebM uses VP9).
     pub fn supports_alpha(&self) -> bool {
         self.format.supports_alpha() && !(self.format == OutputFormat::WebM && self.webm_codec == WebmVideoCodec::Av1)
@@ -1224,6 +1403,7 @@ impl OutputModule {
                 if self.channels == Channels::Rgba && !self.prores_profile.is_4444() { "Apple ProRes 4444" } else { self.prores_profile.label() }
             ),
             OutputFormat::Hevc | OutputFormat::Av1 => format!("{} · {}", self.format.label(), self.codec_summary()),
+            OutputFormat::ExrSequence => format!("{} · {} · {} · {ch}", self.format.label(), self.exr_compression_label(), self.exr_bit_depth.label()),
             OutputFormat::WebM if self.webm_codec == WebmVideoCodec::Av1 => {
                 format!("WebM (AV1 + Opus {} kbps) · {}", self.opus_bitrate_kbps, self.codec_summary())
             }
@@ -1455,22 +1635,56 @@ pub fn expand_template(template: &str, format: OutputFormat, v: &TemplateVars) -
 /// Replace the first run of `#` (optionally in brackets, `[####]`) with the zero-padded frame
 /// number. Paths without a run get `_NNNNN` before the extension.
 pub fn sequence_path(path: &str, frame: i64) -> String {
+    let (before, width, after) = sequence_parts(path);
+    format!("{before}{frame:0width$}{after}")
+}
+
+/// A sequence output path around its frame number: what comes before it, how many digits it is
+/// padded to and what comes after (`out/a_[#####].png` → `out/a_`, 5, `.png`).
+pub fn sequence_parts(path: &str) -> (String, usize, String) {
     if let Some(start) = path.find('#') {
         let len = path[start..].chars().take_while(|c| *c == '#').count();
         let (mut a, mut b) = (start, start + len);
-        if a > 0 && path.as_bytes()[a - 1] == b'[' && path.as_bytes().get(b) == Some(&b']') {
+        if a > 0 && path.as_bytes().get(a - 1) == Some(&b'[') && path.as_bytes().get(b) == Some(&b']') {
             a -= 1;
             b += 1;
         }
-        return format!("{}{:0width$}{}", &path[..a], frame, &path[b..], width = len);
+        return (path[..a].to_string(), len, path[b..].to_string());
     }
     let p = std::path::Path::new(path);
     match p.extension() {
-        Some(ext) => format!("{}_{frame:05}.{}", p.with_extension("").to_string_lossy(), ext.to_string_lossy()),
-        None => format!("{path}_{frame:05}"),
+        Some(ext) => (format!("{}_", p.with_extension("").to_string_lossy()), 5, format!(".{}", ext.to_string_lossy())),
+        None => (format!("{path}_"), 5, String::new()),
     }
 }
 
+/// The frame number `candidate` is the file of, when `path` (a sequence output path) writes it:
+/// the inverse of [`sequence_path`].
+pub fn sequence_frame(path: &str, candidate: &str) -> Option<i64> {
+    let (before, width, after) = sequence_parts(path);
+    let digits = candidate.strip_prefix(before.as_str())?.strip_suffix(after.as_str())?;
+    let frame: i64 = digits.parse().ok()?;
+    (format!("{frame:0width$}") == digits).then_some(frame)
+}
+
+/// `template` with `_n` added to the name: before the frame-number run of a sequence, else before
+/// the extension (`[compName].[fileExtension]` → `[compName]_1.[fileExtension]`,
+/// `[compName]_[#####].[fileExtension]` → `[compName]_1_[#####].[fileExtension]`).
+pub fn numbered_template(template: &str, n: u32) -> String {
+    let at = match template.find('#') {
+        Some(hash) => {
+            // The run's `[`, then the separator that sets it off from the name.
+            let run = if template[..hash].ends_with('[') { hash - 1 } else { hash };
+            if template[..run].ends_with(['_', '-', '.', ' ']) { run - 1 } else { run }
+        }
+        None => {
+            let name = template.rfind(['/', '\\']).map_or(0, |i| i + 1);
+            template[name..].rfind('.').map_or(template.len(), |i| name + i)
+        }
+    };
+    format!("{}_{n}{}", &template[..at], &template[at..])
+}
+
 /// Make a name safe as a file name component.
 pub fn sanitize(name: &str) -> String {
     name.chars().map(|c| if matches!(c, '/' | '\\' | ':' | '*' | '?' | '"' | '<' | '>' | '|') { '_' } else { c }).collect()
@@ -1490,6 +1704,44 @@ mod tests {
         assert_eq!(sequence_path("a.png", 3), "a_00003.png");
     }
 
+    /// `sequence_frame` reads back what `sequence_path` writes, and nothing else.
+    #[test]
+    fn sequence_frames_read_back() {
+        for path in ["out/a_[#####].png", "a###.tif", "a.png", "/x/[compName]/shot_[##].exr", "noext", "dir.v2/clip"] {
+            for frame in [0, 7, 42, 99_999, 123_456, -3] {
+                assert_eq!(sequence_frame(path, &sequence_path(path, frame)), Some(frame), "{path} {frame}");
+            }
+        }
+        let (before, width, after) = sequence_parts("out/a_[#####].png");
+        assert_eq!((before.as_str(), width, after.as_str()), ("out/a_", 5, ".png"));
+        let (before, width, after) = sequence_parts("a.png");
+        assert_eq!((before.as_str(), width, after.as_str()), ("a_", 5, ".png"));
+        // Other numbers, other widths, other names are not frames of the sequence.
+        assert_eq!(sequence_frame("a_[#####].png", "a_0042.png"), None, "padded to four");
+        assert_eq!(sequence_frame("a_[####].png", "a_+042.png"), None, "a sign is not padding");
+        assert_eq!(sequence_frame("a_[#####].png", "a_00042.jpg"), None);
+        assert_eq!(sequence_frame("a_[#####].png", "b_00042.png"), None);
+        assert_eq!(sequence_frame("a_[#####].png", "a_00x42.png"), None);
+        assert_eq!(sequence_frame("a_[#####].png", "a_.png"), None);
+        assert_eq!(sequence_frame("a_[#####].png", "a_99999999999999999999.png"), None, "too big for a frame number");
+    }
+
+    #[test]
+    fn numbered_templates() {
+        assert_eq!(numbered_template(DEFAULT_TEMPLATE, 1), "[compName]_1.[fileExtension]");
+        assert_eq!(numbered_template(DEFAULT_SEQUENCE_TEMPLATE, 2), "[compName]_2_[#####].[fileExtension]");
+        assert_eq!(numbered_template("[compName]_frame.[fileExtension]", 3), "[compName]_frame_3.[fileExtension]");
+        assert_eq!(numbered_template("out/[compName]###.png", 1), "out/[compName]_1###.png");
+        assert_eq!(numbered_template("my.dir/clip", 4), "my.dir/clip_4", "a dot in a folder is not an extension");
+        assert_eq!(numbered_template("clip.v2.mov", 1), "clip.v2_1.mov");
+        assert_eq!(numbered_template("", 1), "_1");
+        assert_eq!(numbered_template("#", 1), "_1#");
+        assert_eq!(numbered_template("[#]", 1), "_1[#]");
+        // A numbered default is still a default: it expands to the numbered name.
+        let v = TemplateVars { comp_name: "footage", project_name: "P", width: 64, height: 36, frame_rate: 30.0, start_frame: 0, end_frame: 29 };
+        assert_eq!(expand_template(&numbered_template(DEFAULT_TEMPLATE, 1), OutputFormat::H264, &v), "footage_1.mp4");
+    }
+
     #[test]
     fn set_format_fixes_names() {
         let mut m = OutputModule::default();
@@ -1649,8 +1901,8 @@ mod tests {
 
     #[test]
     fn hostile_roi_cannot_overflow_crop_math() {
-        // `-1e12` saturates to `i32::MIN` on conversion: `w as i32 - l` must saturate,
-        // not overflow, and still yield a usable (degenerate) frame size.
+        // `-1e12` is clamped into the frame on conversion: it must not overflow and must still
+        // yield a usable (degenerate) frame size.
         let c = Comp::new(1920, 1080, FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
         let rs = RenderSettings::default();
         let mut m = OutputModule::for_format(OutputFormat::PngSequence);
@@ -1663,6 +1915,66 @@ mod tests {
         assert_eq!(m.output_size(&c, &half), (400, 200));
     }
 
+    #[test]
+    fn output_size_never_exceeds_the_comp_limit() {
+        // The effective scale is clamped so neither side exceeds the limit (exporter
+        // `w * h * 4` would overflow at 120 000 px sides); the pipeline renders at the
+        // same scale, so it never requests a frame larger than this reports.
+        let rs = RenderSettings { resolution: 4.0, ..Default::default() };
+        let m = OutputModule::for_format(OutputFormat::PngSequence);
+        let square = Comp::new(30_000, 30_000, FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
+        assert_eq!(rs.effective_scale(&square), 1.0);
+        assert_eq!(rs.output_size(&square), (30_000, 30_000));
+        assert_eq!(m.output_size(&square, &rs), (30_000, 30_000));
+        // Wide comps keep their aspect ratio instead of clamping each side on its own.
+        let wide = Comp::new(30_000, 15_000, FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
+        assert_eq!(rs.effective_scale(&wide), 1.0);
+        assert_eq!(rs.output_size(&wide), (30_000, 15_000));
+        assert_eq!(m.output_size(&wide, &rs), (30_000, 15_000));
+        // A mid-size comp renders at the largest scale that still fits.
+        let mid = Comp::new(20_000, 10_000, FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
+        assert_eq!(mid.width as f64 * rs.effective_scale(&mid), 30_000.0);
+        assert_eq!(rs.output_size(&mid), (30_000, 15_000));
+    }
+
+    #[test]
+    fn valid_wide_roi_endpoints_are_preserved() {
+        // A supported 30 000 x 100 frame at scale 1: ROI [10000, 0, 20000, 100] spans x 10 000..30 000
+        // and must give 20 000 x 100 (the absolute right edge 30 000 exceeds the old +/-20 000 clamp).
+        let c = Comp::new(30_000, 100, FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
+        let rs = RenderSettings::default();
+        let mut m = OutputModule::for_format(OutputFormat::PngSequence);
+        m.crop = Crop { enabled: true, use_roi: true, roi: Some([10_000.0, 0.0, 20_000.0, 100.0]), ..Default::default() };
+        assert_eq!(m.output_size(&c, &rs), (20_000, 100));
+        assert_eq!(m.crop.edges(30_000, 100, 1.0), (0, 10_000, 0, 0));
+        // Scale 4.0 pushes a valid edge to 120 000 px (30 000 x 4); the left edge 40 000 and the
+        // right edge 120 000 are both beyond 20 000 and must survive.
+        assert_eq!(m.crop.edges(120_000, 400, 4.0), (0, 40_000, 0, 0));
+        assert_eq!(m.frame_size(120_000, 400, 4.0), (80_000, 400));
+        // Hostile quads stay inside the frame: never empty, never larger than the frame, so the
+        // export can't be asked for an unbounded crop (an ROI reaching far outside the comp
+        // used to pad the frame instead).
+        let (fw, fh) = (1920, 1080);
+        let hostile = [
+            [1e300, 1e300, 1e300, 1e300],
+            [-1e300, -1e300, 1e300, 1e300],
+            [-1e6, -1e6, 2e6 + 1920.0, 2e6 + 1080.0],
+            [-1e12, -1e12, -1e12, -1e12],
+            [f64::NAN, f64::INFINITY, f64::NEG_INFINITY, f64::NAN],
+            [f64::NEG_INFINITY, f64::NEG_INFINITY, f64::INFINITY, f64::INFINITY],
+        ];
+        for roi in hostile {
+            m.crop.roi = Some(roi);
+            let (t, l, b, r) = m.crop.edges(fw, fh, 1.0);
+            assert!([t, l, b, r].iter().all(|e| *e >= 0), "{roi:?}: an edge pads the frame: {:?}", (t, l, b, r));
+            let (w, h) = m.frame_size(fw, fh, 1.0);
+            assert!((1..=fw).contains(&w) && (1..=fh).contains(&h), "{roi:?}: {w}x{h} is outside 1x1..={fw}x{fh}");
+        }
+        // An ROI covering more than the frame is the whole frame.
+        m.crop.roi = Some([-1e6, -1e6, 2e6 + 1920.0, 2e6 + 1080.0]);
+        assert_eq!(m.frame_size(fw, fh, 1.0), (fw, fh));
+    }
+
     #[test]
     fn uncompressed_quicktime_format() {
         let f = OutputFormat::from_name("uncompressed").unwrap();
@@ -1682,6 +1994,28 @@ mod tests {
         assert_eq!(serde_json::from_str::<OutputModule>(&json).unwrap().format, f);
     }
 
+    #[test]
+    fn targa_sequence_format() {
+        let f = OutputFormat::from_name("tga").unwrap();
+        assert_eq!(f, OutputFormat::TargaSequence);
+        assert_eq!(OutputFormat::from_name(&format!("{f:?}")), Some(f));
+        assert_eq!(OutputFormat::from_name("Targa"), Some(f));
+        assert_eq!(OutputFormat::from_name("Targa Sequence"), Some(f));
+        assert_eq!(OutputFormat::from_path("/out/shot_00001.TGA"), Some(f));
+        assert!(OutputFormat::ALL.contains(&f));
+        assert!(f.is_sequence() && f.supports_alpha() && !f.supports_audio() && !f.is_movie());
+        assert_eq!((f.label(), f.extension()), ("Targa Sequence", "tga"));
+        assert_eq!(f.coded_size(3, 5), (3, 5));
+        // A movie name becomes a numbered sequence; RGB + Alpha survives the switch.
+        let mut m = OutputModule::for_format(OutputFormat::ProRes);
+        m.output = "/out/Comp 1.mov".into();
+        m.channels = Channels::Rgba;
+        m.set_format(f);
+        assert_eq!((m.output.as_str(), m.channels), ("/out/Comp 1_[#####].tga", Channels::Rgba));
+        let json = serde_json::to_string(&m).unwrap();
+        assert_eq!(serde_json::from_str::<OutputModule>(&json).unwrap().format, f);
+    }
+
     #[test]
     fn hevc_av1_codec_options() {
         assert_eq!(OutputFormat::from_name("H.265"), Some(OutputFormat::Hevc));
@@ -1719,4 +2053,45 @@ mod tests {
         let old: OutputModule = serde_json::from_str(r#"{"format":"H264","bitrate_kbps":5000}"#).unwrap();
         assert_eq!((old.codec, old.webm_codec, old.opus_bitrate_kbps), (VideoCodecOptions::default(), WebmVideoCodec::Vp9, 192));
     }
+
+    /// OpenEXR compression and bit depth (#2911): names parse, lossy methods are marked for the
+    /// depth they lose data at, and modules saved before the settings existed load as ZIP, 32-bit
+    /// float (what those projects rendered).
+    #[test]
+    fn exr_compression_and_bit_depth() {
+        for c in ExrCompression::ALL {
+            assert_eq!(ExrCompression::from_name(c.name()), Some(c));
+            assert_eq!(ExrCompression::from_name(&c.name().to_ascii_uppercase()), Some(c));
+        }
+        assert_eq!(ExrCompression::from_name("uncompressed"), Some(ExrCompression::None));
+        assert_eq!(ExrCompression::from_name("zip16"), Some(ExrCompression::Zip));
+        assert_eq!(ExrCompression::from_name("ZIP1"), Some(ExrCompression::Zips));
+        assert_eq!(ExrCompression::from_name("Zip (1 scanline)"), Some(ExrCompression::Zips));
+        assert_eq!(ExrCompression::from_name("Zip (16 scanlines)"), Some(ExrCompression::Zip));
+        assert_eq!(ExrCompression::from_name("htj2k"), None);
+        assert_eq!(ExrBitDepth::from_name("16"), Some(ExrBitDepth::Half));
+        assert_eq!(ExrBitDepth::from_name("Half"), Some(ExrBitDepth::Half));
+        assert_eq!(ExrBitDepth::from_name("f32"), Some(ExrBitDepth::Float));
+        assert_eq!(ExrBitDepth::from_name("8"), None);
+        let lossy = |d| ExrCompression::ALL.into_iter().filter(|c| c.is_lossy(d)).map(ExrCompression::name).collect::<Vec<_>>();
+        assert_eq!(lossy(ExrBitDepth::Float), ["pxr24", "dwaa", "dwab"]);
+        assert_eq!(lossy(ExrBitDepth::Half), ["b44", "b44a", "dwaa", "dwab"]);
+
+        let mut m = OutputModule::for_format(OutputFormat::ExrSequence);
+        assert_eq!((m.exr_compression, m.exr_bit_depth), (ExrCompression::Zip, ExrBitDepth::Float));
+        assert_eq!(m.summary(), "OpenEXR Sequence · ZIP (16 scan lines) · 32-bit Float · RGB");
+        m.exr_compression = ExrCompression::Dwaa;
+        m.exr_bit_depth = ExrBitDepth::Half;
+        assert!(m.describe().contains(&("Compression", "DWAA (lossy)".to_string())), "{:?}", m.describe());
+        assert!(m.describe().contains(&("Bit Depth", "16-bit Half Float".to_string())));
+        let json = serde_json::to_string(&m).unwrap();
+        assert_eq!(serde_json::from_str::<OutputModule>(&json).unwrap(), m);
+        m.exr_compression = ExrCompression::B44a;
+        m.exr_bit_depth = ExrBitDepth::Float;
+        assert_eq!(m.exr_compression_label(), "B44A (uncompressed at float)");
+        m.exr_bit_depth = ExrBitDepth::Half;
+        assert_eq!(m.exr_compression_label(), "B44A (lossy)");
+        let old: OutputModule = serde_json::from_str(r#"{"format":"ExrSequence","channels":"Rgba"}"#).unwrap();
+        assert_eq!((old.exr_compression, old.exr_bit_depth), (ExrCompression::Zip, ExrBitDepth::Float));
+    }
 }
diff --git a/crates/project/src/render_templates.rs b/crates/project/src/render_templates.rs
index cf52b000e..ea3560682 100644
--- a/crates/project/src/render_templates.rs
+++ b/crates/project/src/render_templates.rs
@@ -8,7 +8,9 @@
 
 use serde::{Deserialize, Serialize};
 
-use crate::render_queue::*;
+use crate::render_queue::{
+    AlphaMode, Channels, CurrentOrOff, FieldRender, OutputFormat, OutputModule, ProResProfile, ProxyUse, RenderQuality, RenderSettings, SwitchOverride,
+};
 use effectcraft_time::FrameRate;
 
 /// A default slot (the Defaults section of the Templates dialogs).
@@ -288,6 +290,7 @@ impl RenderTemplates {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::render_queue::{ColorDepth, Crop};
 
     #[test]
     fn builtins_defaults_and_round_trip() {
@@ -320,4 +323,19 @@ mod tests {
         t.delete(TemplateKind::OutputModule, "High Quality").unwrap();
         assert_eq!(t.output_module("High Quality").unwrap().format, OutputFormat::ProRes);
     }
+
+    /// An Output Module template keeps its OpenEXR compression and bit depth through a save and
+    /// load (#2911); the built-in EXR template stays ZIP, 32-bit float.
+    #[test]
+    fn exr_options_survive_a_template_round_trip() {
+        use crate::render_queue::{ExrBitDepth, ExrCompression};
+        let mut t = RenderTemplates::default();
+        let builtin = t.output_module("OpenEXR Sequence with Alpha").unwrap();
+        assert_eq!((builtin.exr_compression, builtin.exr_bit_depth), (ExrCompression::Zip, ExrBitDepth::Float));
+        let m = OutputModule { exr_compression: ExrCompression::Piz, exr_bit_depth: ExrBitDepth::Half, ..OutputModule::for_format(OutputFormat::ExrSequence) };
+        t.save_output_module("EXR Half PIZ", m);
+        let back: RenderTemplates = serde_json::from_str(&serde_json::to_string(&t).unwrap()).unwrap();
+        let m = back.output_module("exr half piz").unwrap();
+        assert_eq!((m.format, m.exr_compression, m.exr_bit_depth), (OutputFormat::ExrSequence, ExrCompression::Piz, ExrBitDepth::Half));
+    }
 }
diff --git a/crates/project/src/sequence.rs b/crates/project/src/sequence.rs
index fa3d522b5..0b23d528f 100644
--- a/crates/project/src/sequence.rs
+++ b/crates/project/src/sequence.rs
@@ -37,14 +37,21 @@ pub fn frame_number(path: &str) -> Option<i64> {
 }
 
 /// The After Effects name of a numbered sequence: `shot_[0001-0250].png`. `None` when the first
-/// file isn't numbered.
+/// file isn't numbered. Files that are only a number (`0001.png`) take their folder's name in
+/// front, `plate [0001-0250].png`, so sequences from several folders don't all read the same
+/// (#2019).
 pub fn sequence_name(files: &[String]) -> Option<String> {
     let (first, last) = (files.first()?, files.last()?);
-    let name = |p: &str| p.rsplit(['/', '\\']).next().unwrap_or(p).to_string();
+    let mut parts = first.rsplit(['/', '\\']);
+    let first_name = parts.next().unwrap_or(first);
+    let folder = parts.next().filter(|f| !f.is_empty() && !f.ends_with(':'));
     let (prefix, a) = split_frame_number(stem_of(first))?;
     let (_, b) = split_frame_number(stem_of(last))?;
-    let first_name = name(first);
     let ext = first_name.rsplit_once('.').map(|(_, e)| format!(".{e}")).unwrap_or_default();
+    let prefix = match folder {
+        Some(f) if prefix.is_empty() => format!("{f} "),
+        _ => prefix.to_string(),
+    };
     Some(format!("{prefix}[{a}-{b}]{ext}"))
 }
 
@@ -107,6 +114,22 @@ impl Footage {
         self.sequence.get(k).filter(|p| frame_number(p) == Some(n)).map(String::as_str)
     }
 
+    /// The file an image sequence shows at its frame `i`, holding the last existing file across a
+    /// gap in the numbering (After Effects 2026: files 1, 2, 4, 5 show frame 2 at frame 3).
+    /// `None` only when no file precedes the frame (or there are no files).
+    pub fn sequence_file_held(&self, i: i64) -> Option<&str> {
+        if let Some(p) = self.sequence_file(i) {
+            return Some(p);
+        }
+        let first = self.numbered()?;
+        let k = self.first_file_from(first.saturating_add(i));
+        // The preceding number, then the file `sequence_file` picks for it (the first with that
+        // number), so files sharing a number (`shot_0002`, `shot_002`) don't switch at a gap.
+        let prev = self.file_number(k.checked_sub(1)?)?;
+        let j = self.first_file_from(prev);
+        self.sequence.get(j).filter(|p| frame_number(p) == Some(prev)).map(String::as_str)
+    }
+
     /// Set an image sequence's duration to its frames at its frame rate (after its files or
     /// frame rate changed).
     pub fn sync_sequence_duration(&mut self) {
@@ -124,6 +147,17 @@ mod tests {
         Footage { kind: FootageKind::Sequence, sequence: numbers.iter().map(|n| format!("C:\\shots\\a_{n:04}.png")).collect(), ..Default::default() }
     }
 
+    #[test]
+    fn a_gap_holds_the_file_shown_for_the_preceding_number() {
+        let mut f = seq(&[]);
+        f.sequence = ["a_0001.png", "a_0002.png", "a_002.png", "a_0005.png"].map(String::from).to_vec();
+        assert_eq!(f.sequence_file(1), Some("a_0002.png"));
+        // Frames 3 and 4 (numbers 3, 4) hold what number 2 shows: the first file with it.
+        assert_eq!(f.sequence_file_held(2), Some("a_0002.png"));
+        assert_eq!(f.sequence_file_held(3), Some("a_0002.png"));
+        assert_eq!(f.sequence_file_held(4), Some("a_0005.png"));
+    }
+
     #[test]
     fn numbers_and_names() {
         assert_eq!(split_frame_number("shot_0012"), Some(("shot_", "0012")));
@@ -135,6 +169,13 @@ mod tests {
         let files: Vec<String> = ["/s/fx_0998.png", "/s/fx_1002.png"].map(String::from).to_vec();
         assert_eq!(sequence_name(&files).as_deref(), Some("fx_[0998-1002].png"));
         assert_eq!(sequence_name(&["/s/a.png".to_string()]), None);
+        // #2019: frames that are only a number take their folder's name.
+        let plain: Vec<String> = ["/shots/plate/0001.png", "/shots/plate/0250.png"].map(String::from).to_vec();
+        assert_eq!(sequence_name(&plain).as_deref(), Some("plate [0001-0250].png"));
+        let windows: Vec<String> = ["C:\\shots\\bg\\001.exr", "C:\\shots\\bg\\010.exr"].map(String::from).to_vec();
+        assert_eq!(sequence_name(&windows).as_deref(), Some("bg [001-010].exr"));
+        assert_eq!(sequence_name(&["0001.png".to_string(), "0002.png".to_string()]).as_deref(), Some("[0001-0002].png"));
+        assert_eq!(sequence_name(&["C:\\0001.png".to_string()]).as_deref(), Some("[0001-0001].png"));
     }
 
     #[test]
diff --git a/crates/project/src/settings.rs b/crates/project/src/settings.rs
new file mode 100644
index 000000000..29353908f
--- /dev/null
+++ b/crates/project/src/settings.rs
@@ -0,0 +1,314 @@
+use super::item::{ItemId, LayerId};
+use super::{BTreeMap, ColorSpace, Deserialize, Label, Serialize, Tick};
+
+/// The project file schema. 2: effects on layers without a source rectangle (shape, text)
+/// measure positions from the top-left of their comp-sized bounds (effect space), not from
+/// the layer's origin; projects from schema 1 are converted when opened (#227).
+pub use craft_ecproj_format::SCHEMA_VERSION;
+
+/// The first schema in which effect positions are in effect space (see [`SCHEMA_VERSION`]).
+pub const SCHEMA_EFFECT_SPACE: u32 = 2;
+
+/// The EffectCraft version, written into project files as `savedBy`.
+pub const APP_VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// The EffectCraft version that wrote a project file (its `savedBy`), when it says, also for a
+/// project whose schema is newer than [`SCHEMA_VERSION`].
+pub fn saved_by(text: &str) -> Option<String> {
+    match craft_ecproj_format::Head::read(text) {
+        Ok(head) => head.saved_by,
+        Err(craft_ecproj_format::ReadError::TooNew { saved_by, .. }) => saved_by,
+        Err(_) => None,
+    }
+}
+
+/// The compositions that were open when a project file was saved and their current times
+/// (`activeComp`, `openComps` and `compTimes` next to `savedBy`), so it reopens where it was left
+/// (#748, #1714). Editor state rather than project
+/// content: opening a comp doesn't make the project unsaved, and it isn't part of
+/// [`Project`]. Older files have none; older versions ignore it.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SavedView {
+    /// The comp shown in the viewer and the Timeline.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub active_comp: Option<ItemId>,
+    /// The open comps (Timeline tabs), in tab order.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub open_comps: Vec<ItemId>,
+    /// Each comp's current time, so a project reopens on the frame it was saved at rather than
+    /// at 0, where its layers may not have started yet (#1714).
+    #[serde(skip_serializing_if = "BTreeMap::is_empty")]
+    pub comp_times: BTreeMap<ItemId, Tick>,
+}
+
+/// The view a project file was saved with ([`SavedView`]); empty for older files. Values that
+/// aren't ids are ignored (whether an id still names a comp is up to the caller).
+pub fn saved_view(text: &str) -> SavedView {
+    #[derive(Deserialize)]
+    struct Meta {
+        #[serde(rename = "activeComp", default)]
+        active_comp: Option<serde_json::Value>,
+        #[serde(rename = "openComps", default)]
+        open_comps: Option<serde_json::Value>,
+        #[serde(rename = "compTimes", default)]
+        comp_times: Option<serde_json::Value>,
+    }
+    let Ok(m) = serde_json::from_str::<Meta>(text) else { return SavedView::default() };
+    SavedView {
+        active_comp: m.active_comp.as_ref().and_then(serde_json::Value::as_u64).map(ItemId),
+        open_comps: m
+            .open_comps
+            .as_ref()
+            .and_then(serde_json::Value::as_array)
+            .map_or_else(Vec::new, |a| a.iter().filter_map(serde_json::Value::as_u64).map(ItemId).collect()),
+        comp_times: m
+            .comp_times
+            .as_ref()
+            .and_then(serde_json::Value::as_object)
+            .map_or_else(BTreeMap::new, |o| o.iter().filter_map(|(k, v)| Some((ItemId(k.parse().ok()?), Tick(v.as_i64()?)))).collect()),
+    }
+}
+
+/// Whether version `a` (`major.minor.patch`, pre-release suffixes ignored) is newer than `b`.
+pub fn is_newer_version(a: &str, b: &str) -> bool {
+    let parts = |v: &str| -> [u64; 3] {
+        let mut n = v.split(['-', '+']).next().unwrap_or("").split('.').map(|x| x.parse().unwrap_or(0));
+        [n.next().unwrap_or(0), n.next().unwrap_or(0), n.next().unwrap_or(0)]
+    };
+    parts(a) > parts(b)
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ProjectError {
+    #[error("no item {0:?}")]
+    NoItem(ItemId),
+    #[error("item {0:?} is not a composition")]
+    NotComp(ItemId),
+    #[error("no layer {0:?}")]
+    NoLayer(LayerId),
+    #[error("no property `{0}`")]
+    NoProperty(String),
+    #[error("{0}")]
+    Invalid(String),
+}
+
+/// Project bit depth.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum BitDepth {
+    #[default]
+    Bpc8,
+    Bpc16,
+    Bpc32,
+}
+
+impl BitDepth {
+    pub fn label(self) -> &'static str {
+        match self {
+            BitDepth::Bpc8 => "8 bpc",
+            BitDepth::Bpc16 => "16 bpc",
+            BitDepth::Bpc32 => "32 bpc",
+        }
+    }
+    pub fn next(self) -> BitDepth {
+        match self {
+            BitDepth::Bpc8 => BitDepth::Bpc16,
+            BitDepth::Bpc16 => BitDepth::Bpc32,
+            BitDepth::Bpc32 => BitDepth::Bpc8,
+        }
+    }
+    pub fn is_float(self) -> bool {
+        self == BitDepth::Bpc32
+    }
+    /// Quantisation levels per channel of the integer depths (8 bpc: 255; 16 bpc: 32768, After
+    /// Effects' "15 + 1" bit range), `None` for 32 bpc float.
+    pub fn levels(self) -> Option<f32> {
+        match self {
+            BitDepth::Bpc8 => Some(255.0),
+            BitDepth::Bpc16 => Some(32768.0),
+            BitDepth::Bpc32 => None,
+        }
+    }
+    pub fn bits(self) -> u32 {
+        match self {
+            BitDepth::Bpc8 => 8,
+            BitDepth::Bpc16 => 16,
+            BitDepth::Bpc32 => 32,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum TimeDisplayStyle {
+    #[default]
+    Timecode,
+    Frames,
+    /// Feet + Frames, 35 mm film (16 frames per foot).
+    Feet35,
+    /// Feet + Frames, 16 mm film (40 frames per foot).
+    Feet16,
+}
+
+impl TimeDisplayStyle {
+    /// Frames per foot of the Feet + Frames styles.
+    pub fn frames_per_foot(self) -> Option<i64> {
+        match self {
+            TimeDisplayStyle::Feet35 => Some(16),
+            TimeDisplayStyle::Feet16 => Some(40),
+            _ => None,
+        }
+    }
+    pub fn id(self) -> &'static str {
+        match self {
+            TimeDisplayStyle::Timecode => "timecode",
+            TimeDisplayStyle::Frames => "frames",
+            TimeDisplayStyle::Feet35 => "feet35",
+            TimeDisplayStyle::Feet16 => "feet16",
+        }
+    }
+    pub fn parse(s: &str) -> Option<TimeDisplayStyle> {
+        let k: String = s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase();
+        match k.as_str() {
+            "timecode" => Some(TimeDisplayStyle::Timecode),
+            "frames" => Some(TimeDisplayStyle::Frames),
+            "feet35" | "feetframes" | "feetandframes" | "feet35mm" | "35mm" | "feetframes35mm" => Some(TimeDisplayStyle::Feet35),
+            "feet16" | "feet16mm" | "16mm" | "feetframes16mm" => Some(TimeDisplayStyle::Feet16),
+            _ => None,
+        }
+    }
+}
+
+/// Project Settings ▸ Color ▸ Color Engine.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ColorEngine {
+    /// Built-in colour management (ICC-style working spaces).
+    #[default]
+    Adobe,
+    /// OCIO managed, with the built-in configuration (ACES working spaces).
+    Ocio,
+}
+
+/// Project Settings ▸ Color ▸ HDR: how over-range (HDR) values reach a standard-dynamic-range
+/// display or output.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum HdrMode {
+    /// Values above 1.0 clip.
+    #[default]
+    Clip,
+    /// Highlights above 80% are companded (an exponential knee) into the remaining range.
+    Compand,
+    /// Extended Reinhard tone mapping of luminance (white at 4.0).
+    ToneMap,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ProjectSettings {
+    pub bit_depth: BitDepth,
+    /// Linearize Working Space: the working space uses linear light (1.0 gamma) for everything
+    /// (sources, effects, blending). Needs a working space.
+    pub linearize: bool,
+    /// Working Space (colour management). `None` = no colour management.
+    #[serde(default)]
+    pub working_space: Option<ColorSpace>,
+    /// Blend Colors Using 1.0 Gamma: layers blend in linear light (sources and effects stay in
+    /// the working space's encoding).
+    #[serde(default)]
+    pub blend_linear: bool,
+    pub time_display: TimeDisplayStyle,
+    /// Frame numbering starts at 0 (or 1).
+    pub frame_start: i64,
+    pub audio_sample_rate: u32,
+    /// Video Rendering and Effects ▸ Use: Mercury GPU Acceleration (`true`, the default; used
+    /// when a GPU adapter exists) or Mercury Software Only (`false`, the CPU compositor).
+    #[serde(default = "yes")]
+    pub gpu_acceleration: bool,
+    /// The project's comment (Metadata panel).
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub comment: String,
+    /// Color Engine (Adobe-style built-in or OCIO with ACES working spaces).
+    #[serde(default)]
+    pub color_engine: ColorEngine,
+    /// HDR handling for standard-dynamic-range output (display and renders).
+    #[serde(default)]
+    pub hdr: HdrMode,
+    /// The space the top-level comp is output in (renders and the viewer's source). `None` =
+    /// sRGB; Rec. 2100 PQ / HLG give HDR output.
+    #[serde(default)]
+    pub output_space: Option<ColorSpace>,
+    /// Working Gamma, 2.2 or 2.4 (`app.project.workingGamma`): with no working space, the curve
+    /// Interpret As Linear Light footage is encoded with and Blend Colors Using 1.0 Gamma
+    /// linearizes with: the sRGB curve at 2.2, a pure 2.4 power curve at 2.4. Ignored with a
+    /// working space (as in After Effects).
+    #[serde(default = "gamma_22")]
+    pub working_gamma: f64,
+}
+
+fn gamma_22() -> f64 {
+    2.2
+}
+
+impl ProjectSettings {
+    /// Working Gamma is 2.4 (anything else reads as 2.2).
+    pub fn working_gamma_24(&self) -> bool {
+        (self.working_gamma - 2.4).abs() < 0.05
+    }
+}
+
+impl Default for ProjectSettings {
+    fn default() -> Self {
+        ProjectSettings {
+            bit_depth: BitDepth::Bpc8,
+            linearize: false,
+            working_space: None,
+            blend_linear: false,
+            time_display: TimeDisplayStyle::Timecode,
+            frame_start: 0,
+            audio_sample_rate: 48_000,
+            gpu_acceleration: true,
+            comment: String::new(),
+            color_engine: ColorEngine::Adobe,
+            hdr: HdrMode::Clip,
+            output_space: None,
+            working_gamma: 2.2,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Marker {
+    pub time: Tick,
+    #[serde(default)]
+    pub duration: Tick,
+    #[serde(default)]
+    pub comment: String,
+    #[serde(default)]
+    pub label: Label,
+    #[serde(default)]
+    pub chapter: String,
+    #[serde(default)]
+    pub url: String,
+    #[serde(default)]
+    pub protected: bool,
+    /// Web link frame target (`_blank`, a frame name…).
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub frame_target: String,
+    /// Flash/video cue point (Event or Navigation) with name and parameters.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cue_point: Option<CuePoint>,
+}
+
+/// A marker's cue point (Composition/Layer Marker dialog ▸ Cue Point).
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CuePoint {
+    pub name: String,
+    /// Navigation (true) or Event cue point.
+    #[serde(default)]
+    pub navigation: bool,
+    /// (name, value) parameter pairs.
+    #[serde(default)]
+    pub params: Vec<(String, String)>,
+}
+
+pub(crate) fn yes() -> bool {
+    true
+}
diff --git a/crates/project/src/styles.rs b/crates/project/src/styles.rs
index 83db5e581..fd59fedda 100644
--- a/crates/project/src/styles.rs
+++ b/crates/project/src/styles.rs
@@ -312,6 +312,33 @@ impl Layer {
     pub fn can_have_styles(&self) -> bool {
         self.source.is_av() && !self.switches.adjustment
     }
+    /// Do the layer's styles change its pixels: the group on, and a style on or Advanced
+    /// Blending away from its defaults (animated counts as changed).
+    pub fn styles_change_pixels(&self) -> bool {
+        self.layer_styles()
+            .filter(|g| g.enabled && self.can_have_styles())
+            .is_some_and(|g| g.groups().any(|s| s.enabled && s.match_id != BLENDING) || g.sub(BLENDING).is_some_and(|bo| !blending_is_default(bo)))
+    }
+}
+
+/// Is Advanced Blending of this Blending Options group at its defaults (no keys, no
+/// expression)? Global Light is the comp's and doesn't count.
+pub fn blending_is_default(bo: &PropGroup) -> bool {
+    let mut next = 0;
+    let fresh = blending_options(&mut Ids(&mut next), &GlobalLight::default());
+    let (Some(adv), Some(def)) = (bo.sub("advancedBlending"), fresh.sub("advancedBlending")) else { return true };
+    def.props().all(|d| adv.get(&d.match_id).is_none_or(|p| same_anim(p, d)))
+}
+
+/// Give `layer` its Layer Styles group (Blending Options only, after Transform) when it has none.
+/// Returns the Blending Options group's uid.
+pub fn add_blending_options(layer: &mut Layer, ids: &mut Ids, gl: &GlobalLight) -> Option<u64> {
+    if layer.props.sub(GROUP).is_none() {
+        let g = layer_styles(ids, gl);
+        let at = layer.props.children.iter().position(|c| c.match_id() == "transform").map(|i| i + 1).unwrap_or(layer.props.children.len());
+        layer.props.children.insert(at, g.into());
+    }
+    Some(layer.props.sub(GROUP)?.sub(BLENDING)?.uid)
 }
 
 /// Add style `id` to `layer` (creating the Layer Styles group after Transform when missing).
@@ -319,9 +346,7 @@ impl Layer {
 pub fn add_style(layer: &mut Layer, ids: &mut Ids, id: &str, gl: &GlobalLight, enabled: bool) -> Option<u64> {
     let order = STYLES.iter().position(|s| s.0 == id)?;
     if layer.props.sub(GROUP).is_none() {
-        let g = layer_styles(ids, gl);
-        let at = layer.props.children.iter().position(|c| c.match_id() == "transform").map(|i| i + 1).unwrap_or(layer.props.children.len());
-        layer.props.children.insert(at, g.into());
+        add_blending_options(layer, ids, gl);
     }
     let ls = layer.props.sub_mut(GROUP)?;
     if let Some(g) = ls.sub(id) {
@@ -470,7 +495,7 @@ mod tests {
         let mut ids = Ids(&mut p.next_id);
         add_style(&mut a, &mut ids, "dropShadow", &gl, true);
         add_style(&mut b, &mut ids, "bevelEmboss", &gl, true);
-        comp.layers = vec![a, b];
+        comp.layers = vec![a, b].into();
         comp.layers[1].props.sub_mut(GROUP).unwrap().sub_mut(BLENDING).unwrap().get_mut("globalLightAngle").unwrap().value = Value::Scalar(45.0);
         assert!(needs_sync(&comp));
         sync_comp(&mut comp);
diff --git a/crates/project/src/tests.rs b/crates/project/src/tests.rs
index 8cd52092f..d040c8f0b 100644
--- a/crates/project/src/tests.rs
+++ b/crates/project/src/tests.rs
@@ -113,6 +113,33 @@ fn resolution_factors_and_scales() {
     assert_eq!(Resolution::Third.scale(0.1, 1.0), 1.0 / 3.0);
 }
 
+/// Another layer of the same source, and a duplicated item, get a numbered name. Only a number set
+/// off by a space is a counter; digits that end a word stay (`v-b1.mp4` gave `v-b1.mp 2`).
+#[test]
+fn numbered_names_keep_digits_that_end_a_word() {
+    // (the name in use, the next layer's and the item copy's name)
+    let rows = [
+        ("v-b1.mp4", "v-b1.mp4 2"),
+        ("clip2.mov", "clip2.mov 2"),
+        ("shot 2", "shot 3"),
+        ("a.b.c", "a.b.c 2"),
+        ("Background", "Background 2"),
+        ("Red Solid 1", "Red Solid 2"),
+    ];
+    for (name, next) in rows {
+        let mut p = Project::default();
+        let mut comp = Comp::new(64, 36, FrameRate::FPS_29_97, Tick::from_seconds_f64(1.0));
+        let solid = Solid { color: [0.5; 3], width: 64, height: 36, pixel_aspect: 1.0 };
+        let item = p.add_item(name, effectcraft_color::Label::Red, None, ItemKind::Solid(solid));
+        let first = build::layer(&mut p, &comp, name, LayerSource::Solid { item }, (64, 36), None);
+        assert_eq!(first.name, name, "the first layer of {name}");
+        comp.layers.push(first);
+        let second = build::layer(&mut p, &comp, name, LayerSource::Solid { item }, (64, 36), None);
+        assert_eq!(second.name, next, "the second layer of {name}");
+        assert_eq!(p.numbered_item_name(name, |_| false), next, "a copy of the item {name}");
+    }
+}
+
 #[test]
 fn unique_names_and_cycles() {
     let (p, cid) = project_with_layer();
@@ -162,19 +189,60 @@ fn project_files_name_their_version_and_always_read_back() {
     assert!(text.trim_start().starts_with("{\n  \"savedBy\""), "the version comes first");
     assert_eq!(Project::from_json(&text).unwrap(), p);
     assert_eq!(crate::saved_by(&p.to_json()), None, "plain JSON (worker hand-offs) has none");
+    assert_eq!(crate::saved_by(r#"{"savedBy": "999.0.0", "schema": 3}"#).as_deref(), Some("999.0.0"), "a newer schema still names its version");
+    assert_eq!(crate::saved_by(r#"[2, {}, {}, 1]"#), None, "the array form has none");
     // JSON can't hold NaN: saving refuses instead of writing a file that can't be opened.
     p.comp_mut(cid).unwrap().layers[0].props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(f64::NAN);
     let e = p.to_file_json().unwrap_err().to_string();
     assert!(e.contains("can't be saved"), "{e}");
+    // Infinity too, in either profile: the check doesn't rely on reading the file back.
+    p.comp_mut(cid).unwrap().layers[0].props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(f64::INFINITY);
+    let e = p.to_file_json().unwrap_err().to_string();
+    assert!(e.contains("can't be saved"), "{e}");
     assert!(crate::is_newer_version("0.2.0", "0.1.9") && crate::is_newer_version("1.0.0-rc.1", "0.9.9"));
     assert!(!crate::is_newer_version("0.1.1", "0.1.1") && !crate::is_newer_version("0.1.0", "0.1.1"));
 }
 
+#[test]
+fn project_files_refuse_newer_schemas() {
+    let p = Project { schema: crate::SCHEMA_VERSION + 1, ..Project::default() };
+    let expected = format!(
+        "the project can't be saved: it holds a value a project file can't store (project schema {} is newer than this version supports ({}))",
+        p.schema,
+        crate::SCHEMA_VERSION
+    );
+    assert_eq!(p.to_file_json().unwrap_err().to_string(), expected);
+    assert_eq!(p.to_file_json_with_view(&crate::SavedView::default(), false).unwrap_err().to_string(), expected);
+}
+
+#[test]
+fn saved_files_reopen_in_pretty_and_compact_form() {
+    let (p, _cid) = project_with_layer();
+    assert_eq!(Project::from_json(&p.to_file_json().unwrap()).unwrap(), p, "the pretty project file");
+    assert_eq!(Project::from_json(&p.to_json_compact()).unwrap(), p, "compact JSON");
+}
+
+/// A project file read back and saved again is the same text, indented and compact (Save Compact
+/// Project Files), with its saved view.
+#[test]
+fn project_files_save_again_byte_for_byte() {
+    let (p, cid) = project_with_layer();
+    let view = crate::SavedView { active_comp: Some(cid), open_comps: vec![cid], comp_times: [(cid, effectcraft_time::Tick(4_237_833_600))].into() };
+    for compact in [false, true] {
+        let text = p.to_file_json_with_view(&view, compact).unwrap();
+        let prefix = if compact { "{\"savedBy\":\"" } else { "{\n  \"savedBy\": \"" };
+        assert!(text.starts_with(&format!("{prefix}{}\"", crate::APP_VERSION)), "compact {compact}: {text}");
+        assert_eq!(text.contains('\n'), !compact);
+        let again = Project::from_json(&text).unwrap().to_file_json_with_view(&crate::saved_view(&text), compact).unwrap();
+        assert_eq!(again, text, "compact {compact}");
+    }
+}
+
 #[test]
 fn project_files_remember_the_open_comps() {
     let (p, cid) = project_with_layer();
     let view = crate::SavedView { active_comp: Some(cid), open_comps: vec![cid], comp_times: [(cid, effectcraft_time::Tick(4_237_833_600))].into() };
-    let text = p.to_file_json_with_view(&view).unwrap();
+    let text = p.to_file_json_with_view(&view, false).unwrap();
     assert_eq!(crate::saved_view(&text), view);
     assert_eq!(Project::from_json(&text).unwrap(), p, "the view is not part of the project");
     // Files from before #748 have no view; a garbled one is ignored, not an error.
@@ -212,3 +280,246 @@ fn item_users_count_layers_in_every_comp() {
     assert!(p.item_users(unused).is_empty());
     assert!(p.item_users(main).is_empty());
 }
+
+/// A project of `n` empty comps; `links` adds a precomp layer of comp `b` inside comp `a`
+/// (indexes into the returned ids).
+fn comp_graph(n: usize, links: &[(usize, usize)]) -> (Project, Vec<crate::ItemId>) {
+    let mut p = Project::default();
+    let ids: Vec<crate::ItemId> = (0..n)
+        .map(|i| {
+            p.add_item(
+                &format!("C{i}"),
+                effectcraft_color::Label::None,
+                None,
+                ItemKind::Comp(Comp::new(8, 8, FrameRate::FPS_25, Tick::from_seconds_f64(1.0)).into()),
+            )
+        })
+        .collect();
+    for &(a, b) in links {
+        let outer = p.comp(ids[a]).unwrap().clone();
+        let l = build::layer(&mut p, &outer, "pre", LayerSource::Comp { item: ids[b] }, (8, 8), None);
+        let ItemKind::Comp(c) = &mut p.item_mut(ids[a]).unwrap().kind else { panic!("comp") };
+        std::sync::Arc::make_mut(c).layers.push(l);
+    }
+    (p, ids)
+}
+
+#[test]
+fn comp_contains_ends_on_cycles_long_chains_and_shared_precomps() {
+    // A ⇄ B cycle, C unrelated: the walk used to recurse until the stack ran out (#1237).
+    let (p, c) = comp_graph(3, &[(0, 1), (1, 0)]);
+    assert!(!p.comp_contains(c[0], c[2]));
+    assert!(p.comp_contains(c[0], c[1]) && p.comp_contains(c[1], c[0]));
+    // A comp nesting itself.
+    let (p, c) = comp_graph(2, &[(0, 0)]);
+    assert!(!p.comp_contains(c[0], c[1]));
+    assert!(p.comp_contains(c[0], c[0]));
+    // A target reached through a cycle.
+    let (p, c) = comp_graph(3, &[(0, 1), (1, 0), (1, 2)]);
+    assert!(p.comp_contains(c[0], c[2]));
+    assert!(!p.comp_contains(c[2], c[0]));
+    // 40 levels of diamonds: 2^40 paths, each comp visited once.
+    let mut links = vec![];
+    for i in 0..40 {
+        let (top, l, r, bottom) = (i * 3, i * 3 + 1, i * 3 + 2, i * 3 + 3);
+        links.extend([(top, l), (top, r), (l, bottom), (r, bottom)]);
+    }
+    let (p, c) = comp_graph(121, &links);
+    let t0 = std::time::Instant::now();
+    assert!(p.comp_contains(c[0], c[120]));
+    assert!(!p.comp_contains(c[120], c[0]));
+    assert!(t0.elapsed() < std::time::Duration::from_secs(1), "{:?}", t0.elapsed());
+    // A chain 20 000 comps deep (a deep recursion's stack frames).
+    let n = 20_000;
+    let (p, c) = comp_graph(n, &(0..n - 1).map(|i| (i, i + 1)).collect::<Vec<_>>());
+    assert!(p.comp_contains(c[0], c[n - 1]));
+    assert!(!p.comp_contains(c[n - 1], c[0]));
+}
+
+/// Interpret Footage ▸ Cineon Settings: the 10 Bit Black and White Points become the converted
+/// points, Current Gamma 1 gives linear light, Highlight Rolloff 0 keeps over-range values and
+/// a higher one ramps them off; the settings apply only to DPX and Cineon files, and projects
+/// saved without them read the defaults.
+#[test]
+fn cineon_settings_convert_log_code_values() {
+    use crate::{CineonSettings, CineonUnits, Footage};
+    let code = |v: f32| v / 1023.0;
+    let c = CineonSettings { log_conversion: true, rolloff: 0.0, ..Default::default() };
+    assert!(c.convert(code(95.0)).abs() < 1e-6, "black point");
+    assert!((c.convert(code(685.0)) - 1.0).abs() < 1e-5, "white point");
+    // Code 400: (10^(-0.95) - 10^(-1.9667)) / (1 - 10^(-1.9667)) = 0.10251 linear, ^(1/1.7).
+    assert!((c.convert(code(400.0)) - 0.26190).abs() < 1e-4, "{}", c.convert(code(400.0)));
+    let linear = CineonSettings { gamma: 1.0, ..c };
+    assert!((linear.convert(code(400.0)) - 0.10251).abs() < 1e-4, "{}", linear.convert(code(400.0)));
+    assert!(c.convert(code(1023.0)) > 1.5, "over range kept: {}", c.convert(code(1023.0)));
+    // The default rolloff (20) ramps the white point and above off, up to 1.
+    let rolled = CineonSettings { rolloff: 20.0, ..c };
+    let (w, mid, top) = (rolled.convert(code(685.0)), rolled.convert(code(720.0)), rolled.convert(code(1023.0)));
+    assert!(w > 0.8 && w < mid && mid < top && top <= 1.0, "{w} {mid} {top}");
+    let points = CineonSettings { converted_black: 64.0, converted_white: 940.0, ..c };
+    assert!((points.convert(code(95.0)) - 64.0 / 1023.0).abs() < 1e-5);
+    assert!((points.convert(code(685.0)) - 940.0 / 1023.0).abs() < 1e-5);
+    // Units.
+    assert!((CineonUnits::EightBit.from_ten_bit(1023.0) - 255.0).abs() < 1e-9);
+    assert!((CineonUnits::Float.to_ten_bit(0.5) - 511.5).abs() < 1e-9);
+    assert_eq!(CineonUnits::parse("8-bit"), Some(CineonUnits::EightBit));
+    assert!(CineonUnits::ALL.iter().all(|u| CineonUnits::parse(u.id()) == Some(*u)));
+    // DPX and Cineon files only, and only with Logarithmic Conversion on.
+    let on = CineonSettings { log_conversion: true, ..Default::default() };
+    let dpx = Footage { path: "/m/plate.0001.DPX".into(), cineon: on, ..Default::default() };
+    assert!(dpx.cineon_applies());
+    assert!(Footage { path: "/m/scan.cin".into(), cineon: on, ..Default::default() }.cineon_applies());
+    assert!(!Footage { path: "/m/still.png".into(), cineon: on, ..Default::default() }.cineon_applies());
+    assert!(!Footage { path: "/m/plate.dpx".into(), ..Default::default() }.cineon_applies());
+    // Saved only when changed; read back, and absent in older projects.
+    let plain = serde_json::to_value(Footage { path: "/m/a.dpx".into(), ..Default::default() }).unwrap();
+    assert!(plain.get("cineon").is_none(), "{plain}");
+    let saved = serde_json::to_string(&dpx).unwrap();
+    assert_eq!(serde_json::from_str::<Footage>(&saved).unwrap().cineon, on);
+    assert_eq!(serde_json::from_value::<Footage>(plain).unwrap().cineon, CineonSettings::default());
+}
+
+/// A Wiggle Paths 100 000 groups deep gets Spatial Phase on a 2 MiB stack.
+#[test]
+fn upgrading_deeply_nested_shape_groups_fits_a_small_stack() {
+    let n = 100_000;
+    let mut next = 1;
+    let mut contents = build::shape_simple_op(&mut Ids(&mut next), "wiggle").unwrap();
+    contents.children.retain(|c| c.match_id() != "spatialPhase");
+    for _ in 0..n {
+        let uid = Ids(&mut next).alloc();
+        contents = crate::PropGroup::new(uid, "group", "Group 1").with(contents);
+    }
+    let h = std::thread::Builder::new()
+        .stack_size(2 << 20)
+        .spawn(move || {
+            let added = build::upgrade_shape_contents(&mut Ids(&mut next), &mut contents);
+            (added, contents)
+        })
+        .unwrap();
+    let (added, mut g) = h.join().unwrap();
+    assert!(added);
+    // One level at a time: dropping the whole tree would recurse as deep as it is nested.
+    let mut depth = 0;
+    while g.match_id == "group" {
+        let Some(crate::Node::Group(child)) = g.children.pop() else { panic!("a nested group") };
+        g = child;
+        depth += 1;
+    }
+    assert_eq!(depth, n);
+    let ids: Vec<&str> = g.children.iter().map(|c| c.match_id()).collect();
+    assert_eq!(ids, ["size", "detail", "points", "speed", "correlation", "phase", "spatialPhase", "seed"]);
+}
+
+/// Music in a precomp is heard, and so not silent, when a layer of a comp nesting it picks the
+/// precomp layer (an Audio Waveform drawing the precomp's mix).
+#[test]
+fn music_in_a_precomp_a_waveform_picks_is_not_silent() {
+    use crate::{Footage, FootageKind, GroupKind};
+    let (mut p, inner) = project_with_layer();
+    let song = p.add_item(
+        "song.wav",
+        effectcraft_color::Label::None,
+        None,
+        ItemKind::Footage(Footage { kind: FootageKind::Audio, has_video: false, has_audio: true, ..Default::default() }),
+    );
+    let comp = p.comp(inner).unwrap().clone();
+    let music = build::layer(&mut p, &comp, "Music", LayerSource::Footage { item: song }, (1920, 1080), None);
+    let music_id = music.id;
+    p.comp_mut(inner).unwrap().layers.push(music);
+    let outer = p.add_item("Outer", effectcraft_color::Label::None, None, ItemKind::Comp(comp.clone().into()));
+    let pre = build::layer(&mut p, &comp, "Pre", LayerSource::Comp { item: inner }, (1920, 1080), None);
+    let pre_id = pre.id;
+    p.comp_mut(outer).unwrap().layers.push(pre);
+    let silent = |p: &Project| p.silent_layers(inner, p.comp(inner).unwrap(), &p.heard_layers()).contains(&music_id);
+    assert!(silent(&p), "nothing draws the precomp's audio");
+    let mut n = 1_000_000;
+    let mut ids = build::Ids(&mut n);
+    let mut g = ids.group("waveform", "Audio Waveform");
+    g.kind = GroupKind::Effect { effect: "ec.generate.audiowaveform".into() };
+    g.children.push(ids.prop("audioLayer", "Audio Layer", Value::Layer(Some(pre_id.0))).into());
+    let solid = p.comp(outer).unwrap().layers[0].id;
+    p.comp_mut(outer).unwrap().layer_mut(solid).unwrap().props.group_mut("effects").unwrap().children.push(g.into());
+    assert!(!silent(&p), "the outer comp's waveform draws the music");
+}
+
+/// Layers that can't change the picture: music, hidden layers nothing reads. A hidden matte is
+/// read by the layer it mattes; nulls and cameras are never silent.
+#[test]
+fn silent_layers_are_music_and_unread_hidden_layers() {
+    use crate::{Footage, FootageKind, LayerId, MatteKind, TrackMatte};
+    let (mut p, cid) = project_with_layer();
+    let comp = p.comp(cid).unwrap().clone();
+    let song = p.add_item(
+        "song.wav",
+        effectcraft_color::Label::None,
+        None,
+        ItemKind::Footage(Footage { kind: FootageKind::Audio, has_video: false, has_audio: true, ..Default::default() }),
+    );
+    let add = |p: &mut Project, name: &str, source: LayerSource| {
+        let l = build::layer(p, &comp, name, source, (1920, 1080), None);
+        let id = l.id;
+        p.comp_mut(cid).unwrap().layers.push(l);
+        id
+    };
+    let music = add(&mut p, "Music", LayerSource::Footage { item: song });
+    let solid = p.comp(cid).unwrap().layers[0].source.clone();
+    let hidden = add(&mut p, "Hidden", solid.clone());
+    let matte = add(&mut p, "Matte", solid);
+    let null = add(&mut p, "Null", LayerSource::Null);
+    let first = p.comp(cid).unwrap().layers[0].id;
+    let c = p.comp_mut(cid).unwrap();
+    for id in [hidden, matte, null] {
+        c.layer_mut(id).unwrap().switches.video = false;
+    }
+    c.layer_mut(first).unwrap().track_matte = Some(TrackMatte { layer: matte, kind: MatteKind::Alpha });
+    let c = p.comp(cid).unwrap();
+    assert_eq!(p.silent_layers(cid, c, &p.heard_layers()).into_iter().collect::<Vec<LayerId>>(), vec![music, hidden]);
+    // Solo hides every other layer, so a soloed music or hidden layer changes the picture.
+    for (soloed, rest) in [(music, hidden), (hidden, music)] {
+        let mut q = p.clone();
+        q.comp_mut(cid).unwrap().layer_mut(soloed).unwrap().switches.solo = true;
+        assert_eq!(q.silent_layers(cid, q.comp(cid).unwrap(), &q.heard_layers()).into_iter().collect::<Vec<LayerId>>(), vec![rest]);
+    }
+}
+
+/// Plug-in effects read their input at other times (plug-in API 2), so a precomp under one is
+/// re-rendered over its whole span; built-in effects only when they are on the list.
+#[test]
+fn plug_in_effects_read_other_frames() {
+    assert!(crate::reads_other_frames("org.example.glow"));
+    assert!(crate::reads_other_frames("ec.time.echo"));
+    assert!(!crate::reads_other_frames("ec.blur.gaussian"));
+}
+
+/// An item whose parent is a composition (or an item that is not there) lists under no folder, and
+/// the AEP export lost it without a word (review finding): opening such a file moves it to the top
+/// level and says so; a parent that is a folder stays.
+#[test]
+fn an_item_inside_a_non_folder_moves_to_the_top_level_when_a_project_is_opened() {
+    let mut p = Project::default();
+    let folder = p.add_item("Folder", Default::default(), None, ItemKind::Folder);
+    let comp = p.add_item(
+        "Comp",
+        Default::default(),
+        None,
+        ItemKind::Comp(std::sync::Arc::new(Comp::new(64, 36, FrameRate::new(25, 1), Tick::from_seconds_f64(1.0)))),
+    );
+    let inside_folder = p.add_item("Fine", Default::default(), Some(folder), ItemKind::Folder);
+    let inside_comp = p.add_item("Inside comp", Default::default(), None, ItemKind::Folder);
+    let orphan = p.add_item("Orphan", Default::default(), None, ItemKind::Folder);
+    if let Some(i) = p.item_mut(inside_comp) {
+        i.parent = Some(comp);
+    }
+    if let Some(i) = p.item_mut(orphan) {
+        i.parent = Some(crate::ItemId(9_999));
+    }
+    let (q, notes) = Project::from_json_repaired(&p.to_json()).expect("opens");
+    assert_eq!(q.item(inside_folder).and_then(|i| i.parent), Some(folder));
+    assert_eq!(q.item(inside_comp).and_then(|i| i.parent), None);
+    assert_eq!(q.item(orphan).and_then(|i| i.parent), None);
+    assert_eq!(notes.len(), 2, "{notes:?}");
+    assert!(notes.iter().all(|n| n.contains("not a folder")), "{notes:?}");
+    // Nothing to repair in a sound project.
+    assert!(Project::from_json_repaired(&q.to_json()).expect("opens").1.is_empty());
+}
diff --git a/crates/psd/Cargo.toml b/crates/psd/Cargo.toml
index 49dda6a3b..b6849041b 100644
--- a/crates/psd/Cargo.toml
+++ b/crates/psd/Cargo.toml
@@ -10,4 +10,4 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
diff --git a/crates/psd/src/counters.rs b/crates/psd/src/counters.rs
new file mode 100644
index 000000000..f5c59b02c
--- /dev/null
+++ b/crates/psd/src/counters.rs
@@ -0,0 +1,19 @@
+use std::cell::Cell;
+use std::thread::LocalKey;
+
+thread_local! {
+    /// Scratch rows allocated by the 32-bit ZIP un-predictor.
+    pub static SCRATCH: Cell<usize> = const { Cell::new(0) };
+    /// `inside the mask rect` evaluations of the layer-mask loop.
+    pub static INSIDE: Cell<usize> = const { Cell::new(0) };
+    /// `square_to_quad` solves.
+    pub static QUAD: Cell<usize> = const { Cell::new(0) };
+}
+
+pub fn bump(c: &'static LocalKey<Cell<usize>>) {
+    c.with(|c| c.set(c.get() + 1));
+}
+/// Read and reset.
+pub fn take(c: &'static LocalKey<Cell<usize>>) -> usize {
+    c.with(|c| c.replace(0))
+}
diff --git a/crates/psd/src/lib.rs b/crates/psd/src/lib.rs
index 5ae32126a..91792a837 100644
--- a/crates/psd/src/lib.rs
+++ b/crates/psd/src/lib.rs
@@ -1,5 +1,5 @@
 //! Photoshop document (PSD / PSB) reader, implemented from Adobe's public *Photoshop File Formats
-//! Specification* (see README.md), and a minimal writer ([`write`]) for fixtures.
+//! Specification* (see README.md), and a minimal writer ([`mod@write`]) for fixtures.
 //!
 //! [`Psd::parse`] reads the structure (header, layer records and their additional information,
 //! the layer tree) without decoding pixels; [`Psd::composite`] decodes the merged image and
@@ -15,411 +15,26 @@ pub mod placed;
 mod read;
 pub mod write;
 
-use std::borrow::Cow;
 use std::sync::Arc;
 
 pub use descriptor::{DValue, Descriptor};
 use read::Reader;
 
-#[derive(Debug, Clone, PartialEq)]
-pub enum Error {
-    NotPsd,
-    Truncated,
-    Unsupported(String),
-    Invalid(String),
-}
+mod limits;
+mod model;
+mod parse;
+mod pixels;
 
-impl std::fmt::Display for Error {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Error::NotPsd => write!(f, "not a Photoshop document"),
-            Error::Truncated => write!(f, "truncated Photoshop document"),
-            Error::Unsupported(s) => write!(f, "unsupported Photoshop feature: {s}"),
-            Error::Invalid(s) => write!(f, "invalid Photoshop document: {s}"),
-        }
-    }
-}
-
-impl std::error::Error for Error {}
-
-pub type Result<T> = std::result::Result<T, Error>;
-
-/// The most pixels one decoded image (the composite, a layer or a mask) may have: 2^28, e.g.
-/// 16 384 × 16 384, 4 GiB as float RGBA. Bounds read from a file are untrusted, so a few bytes
-/// can't make the reader allocate more than that.
-const MAX_DECODE_PIXELS: u64 = 1 << 28;
-
-/// `w × h` as a pixel count, or an error when it exceeds [`MAX_DECODE_PIXELS`].
-fn decode_pixels(w: usize, h: usize) -> Result<usize> {
-    match (w as u64).checked_mul(h as u64) {
-        Some(n) if n <= MAX_DECODE_PIXELS => Ok(n as usize),
-        _ => Err(Error::Unsupported(format!("{w}×{h} pixels is too large to decode"))),
-    }
-}
-
-fn too_large(w: usize, h: usize) -> Error {
-    Error::Unsupported(format!("{w}×{h} pixels is too large to decode"))
-}
-
-/// What one decode (the composite, or one layer) may hold in memory at once: 4 GiB, 1 GiB where
-/// pointers are 32 bits wide (WebAssembly). [`MAX_DECODE_PIXELS`] bounds one image; this bounds
-/// the sum of the buffers a decode keeps alive together.
-#[cfg(target_pointer_width = "32")]
-const DECODE_BUDGET: u64 = 1 << 30;
-#[cfg(not(target_pointer_width = "32"))]
-const DECODE_BUDGET: u64 = 4 << 30;
-
-/// The bytes the buffers of one decode hold right now, against a limit. A decode charges a buffer
-/// before it allocates it (and releases it when it drops it), so a file that would need more
-/// than the limit fails with an error instead of an out-of-memory abort.
-struct Budget {
-    limit: u64,
-    live: u64,
-}
-
-impl Budget {
-    fn new(limit: u64) -> Budget {
-        Budget { limit, live: 0 }
-    }
-
-    fn charge(&mut self, bytes: u64) -> Result<()> {
-        self.check(bytes)?;
-        self.live += bytes;
-        Ok(())
-    }
-
-    /// Whether `bytes` more would still fit, without taking them. A decode checks its whole
-    /// expected peak first, so one that cannot fit fails before it has allocated anything.
-    fn check(&self, bytes: u64) -> Result<()> {
-        match self.live.checked_add(bytes) {
-            Some(total) if total <= self.limit => Ok(()),
-            _ => {
-                const MIB: u64 = 1 << 20;
-                Err(Error::Unsupported(format!(
-                    "decoding needs {} MiB more with {} MiB in use, over the {} MiB memory budget",
-                    bytes / MIB,
-                    self.live / MIB,
-                    self.limit / MIB
-                )))
-            }
-        }
-    }
-
-    fn release(&mut self, bytes: u64) {
-        self.live = self.live.saturating_sub(bytes);
-    }
-
-    /// An empty vector with room for `n` items, charged.
-    fn vec<T>(&mut self, n: usize) -> Result<Vec<T>> {
-        self.charge((n as u64).saturating_mul(std::mem::size_of::<T>() as u64))?;
-        let mut v = Vec::new();
-        v.try_reserve_exact(n).map_err(|_| Error::Unsupported(format!("out of memory for {n} items")))?;
-        Ok(v)
-    }
-
-    /// `n` copies of `value`, charged.
-    fn filled<T: Clone>(&mut self, n: usize, value: T) -> Result<Vec<T>> {
-        let mut v = self.vec::<T>(n)?;
-        v.resize(n, value);
-        Ok(v)
-    }
-}
-
-/// Inflate a zlib stream to at most `limit` bytes.
-fn inflate(src: &[u8], limit: usize) -> Result<Vec<u8>> {
-    miniz_oxide::inflate::decompress_to_vec_zlib_with_limit(src, limit).map_err(|e| Error::Invalid(format!("zip: {e:?}")))
-}
-
-/// Give back what a channel buffer from `Psd::channel_bytes` / `Psd::decode_plane` was charged:
-/// a borrowed one (uncompressed data, or a plane of an inflated stream charged as a whole) was not.
-fn release_bytes(budget: &mut Budget, raw: Cow<'_, [u8]>) {
-    if let Cow::Owned(v) = raw {
-        budget.release(v.len() as u64);
-    }
-}
-
-/// A 32-bit float sample made safe to use: NaN reads as 0, +inf as white (1.0, like the integer
-/// depths' maximum), -inf as 0.
-fn finite_sample(v: f32) -> f32 {
-    if v.is_nan() {
-        0.0
-    } else if v == f32::INFINITY {
-        1.0
-    } else if v == f32::NEG_INFINITY {
-        0.0
-    } else {
-        v
-    }
-}
-
-/// Whether `bytes` start like a Photoshop document.
-pub fn is_psd(bytes: &[u8]) -> bool {
-    bytes.len() >= 6 && &bytes[..4] == b"8BPS" && matches!(u16::from_be_bytes([bytes[4], bytes[5]]), 1 | 2)
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum ColorMode {
-    Bitmap,
-    Grayscale,
-    Indexed,
-    Rgb,
-    Cmyk,
-    Multichannel,
-    Duotone,
-    Lab,
-}
-
-impl ColorMode {
-    pub fn from_u16(v: u16) -> Option<ColorMode> {
-        Some(match v {
-            0 => ColorMode::Bitmap,
-            1 => ColorMode::Grayscale,
-            2 => ColorMode::Indexed,
-            3 => ColorMode::Rgb,
-            4 => ColorMode::Cmyk,
-            7 => ColorMode::Multichannel,
-            8 => ColorMode::Duotone,
-            9 => ColorMode::Lab,
-            _ => return None,
-        })
-    }
-    pub fn to_u16(self) -> u16 {
-        match self {
-            ColorMode::Bitmap => 0,
-            ColorMode::Grayscale => 1,
-            ColorMode::Indexed => 2,
-            ColorMode::Rgb => 3,
-            ColorMode::Cmyk => 4,
-            ColorMode::Multichannel => 7,
-            ColorMode::Duotone => 8,
-            ColorMode::Lab => 9,
-        }
-    }
-    /// Number of colour channels (before alpha).
-    pub fn color_channels(self) -> usize {
-        match self {
-            ColorMode::Rgb | ColorMode::Lab => 3,
-            ColorMode::Cmyk => 4,
-            _ => 1,
-        }
-    }
-}
-
-/// A rectangle in document pixels (`right`/`bottom` exclusive).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct Rect {
-    pub top: i32,
-    pub left: i32,
-    pub bottom: i32,
-    pub right: i32,
-}
-
-impl Rect {
-    pub fn new(left: i32, top: i32, width: i32, height: i32) -> Rect {
-        Rect { top, left, bottom: top.saturating_add(height), right: left.saturating_add(width) }
-    }
-    pub fn width(&self) -> u32 {
-        (i64::from(self.right) - i64::from(self.left)).clamp(0, i64::from(u32::MAX)) as u32
-    }
-    pub fn height(&self) -> u32 {
-        (i64::from(self.bottom) - i64::from(self.top)).clamp(0, i64::from(u32::MAX)) as u32
-    }
-    pub fn is_empty(&self) -> bool {
-        self.width() == 0 || self.height() == 0
-    }
-}
-
-/// One channel of a layer: id (0.. colour, -1 transparency, -2 layer mask, -3 real user mask) and
-/// where its data (compression + image data) sits in the file.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct ChannelInfo {
-    pub id: i16,
-    pub offset: usize,
-    pub len: usize,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct LayerMask {
-    pub rect: Rect,
-    /// Value outside the mask rectangle (0 or 255).
-    pub default_color: u8,
-    pub disabled: bool,
-    pub inverted: bool,
-}
-
-/// Layer kind from the section divider setting (`lsct`).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum Section {
-    #[default]
-    Layer,
-    OpenFolder,
-    ClosedFolder,
-    /// The hidden "</Layer group>" record that closes a group (below its children).
-    Divider,
-}
-
-/// A type layer (`TySh`).
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct TextInfo {
-    /// Text with `\n` line breaks.
-    pub text: String,
-    /// Affine transform (xx, xy, yx, yy, tx, ty): the text origin sits at (tx, ty).
-    pub transform: [f64; 6],
-    pub style: engine_data::TextStyle,
-    /// Text bounds (left, top, right, bottom) relative to the origin, when stored.
-    pub bounds: Option<[f64; 4]>,
-}
-
-/// Adjustment layers (best effort).
-#[derive(Clone, Debug, PartialEq)]
-pub enum Adjustment {
-    Invert,
-    BrightnessContrast {
-        brightness: f64,
-        contrast: f64,
-        legacy: bool,
-    },
-    HueSaturation {
-        hue: f64,
-        saturation: f64,
-        lightness: f64,
-        colorize: bool,
-    },
-    Levels {
-        in_black: f64,
-        in_white: f64,
-        gamma: f64,
-        out_black: f64,
-        out_white: f64,
-    },
-    Exposure {
-        exposure: f64,
-        offset: f64,
-        gamma: f64,
-    },
-    /// Another adjustment (its tagged-block key, e.g. `curv`, `blnc`).
-    Other(String),
-}
-
-/// A vector mask path: sub-paths of (in tangent, vertex, out tangent) points in document pixels.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct VectorMask {
-    pub inverted: bool,
-    pub disabled: bool,
-    pub subpaths: Vec<SubPath>,
-}
-
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct SubPath {
-    pub closed: bool,
-    /// Per knot: [control point preceding, anchor, control point leaving] as (x, y).
-    pub knots: Vec<[[f64; 2]; 3]>,
-}
-
-/// A placed layer (smart object): `SoLd` / `SoLE` (placed layer data) or the older `PlLd`.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct SmartObject {
-    /// Unique id of the linked file ([`Psd::linked`]) the layer shows.
-    pub uuid: String,
-    /// Where the content's corners sit in document pixels: top-left, top-right, bottom-right,
-    /// bottom-left.
-    pub quad: [[f64; 2]; 4],
-    /// The content's size in pixels (`Sz  `), when recorded.
-    pub size: Option<[f64; 2]>,
-    /// The placed layer's warp (`warp`), when it has one ([`placed`]).
-    pub warp: Option<placed::Warp>,
-}
-
-impl SmartObject {
-    /// The quad as an affine placement of a `w`×`h` content rectangle: (centre, scale x, scale
-    /// y, rotation in degrees). Perspective and skew are dropped.
-    pub fn placement(&self, w: f64, h: f64) -> ([f64; 2], f64, f64, f64) {
-        let q = self.quad;
-        let centre = [(q[0][0] + q[1][0] + q[2][0] + q[3][0]) / 4.0, (q[0][1] + q[1][1] + q[2][1] + q[3][1]) / 4.0];
-        let top = [q[1][0] - q[0][0], q[1][1] - q[0][1]];
-        let left = [q[3][0] - q[0][0], q[3][1] - q[0][1]];
-        let sx = top[0].hypot(top[1]) / w.max(1e-9);
-        let sy = left[0].hypot(left[1]) / h.max(1e-9);
-        // Mirrored content (left edge turning the other way) keeps a negative y scale.
-        let cross = top[0] * left[1] - top[1] * left[0];
-        (centre, sx, if cross < 0.0 { -sy } else { sy }, top[1].atan2(top[0]).to_degrees())
-    }
-}
-
-/// A file embedded in (or linked from) the document: linked layer data (`lnk2`, `lnkD`,
-/// `lnk3`, `lnkE`).
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct LinkedFile {
-    pub uuid: String,
-    pub name: String,
-    /// File type code (`8BPS`, `PNGf`, `JPEG`…), may be blank.
-    pub file_type: String,
-    /// Embedded data (absent for externally linked files).
-    pub data: Option<std::ops::Range<usize>>,
-}
-
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Layer {
-    /// Index in [`Psd::layers`] (file order: bottom of the stack first).
-    pub index: usize,
-    pub name: String,
-    pub id: Option<u32>,
-    pub rect: Rect,
-    /// Blend mode key (`norm`, `mul `, `pass`…).
-    pub blend: [u8; 4],
-    pub opacity: u8,
-    /// Fill opacity (`iOpa`), 255 when absent.
-    pub fill_opacity: u8,
-    /// Clipped to the layer below.
-    pub clipping: bool,
-    pub hidden: bool,
-    pub protect_transparency: bool,
-    pub section: Section,
-    pub channels: Vec<ChannelInfo>,
-    pub mask: Option<LayerMask>,
-    pub text: Option<TextInfo>,
-    pub adjustment: Option<Adjustment>,
-    /// Solid colour fill layer (`SoCo`), RGB 0..1.
-    pub fill: Option<[f64; 3]>,
-    /// Layer effects (`lfx2` descriptor).
-    pub effects: Option<Descriptor>,
-    pub vector_mask: Option<VectorMask>,
-    /// Smart object placement.
-    pub smart_object: Option<SmartObject>,
-    /// Keys of every additional-information block the layer carries.
-    pub keys: Vec<[u8; 4]>,
-}
-
-impl Layer {
-    pub fn is_group(&self) -> bool {
-        matches!(self.section, Section::OpenFolder | Section::ClosedFolder)
-    }
-    pub fn blend_key(&self) -> &str {
-        std::str::from_utf8(&self.blend).unwrap_or("norm")
-    }
-    pub fn has_pixels(&self) -> bool {
-        !self.rect.is_empty() && self.channels.iter().any(|c| c.id >= 0)
-    }
-}
-
-/// How deep groups nest in [`Psd::tree`]; deeper ones are flattened (a hostile file can nest
-/// thousands, and walking or dropping that tree would overflow the stack).
-pub const MAX_GROUP_DEPTH: usize = 64;
-
-/// The layer tree, top of the stack first.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Node {
-    Layer(usize),
-    Group { layer: usize, children: Vec<Node> },
-}
-
-/// Decoded pixels: straight RGBA, row-major.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Pixels {
-    pub width: u32,
-    pub height: u32,
-    pub data: Vec<[f32; 4]>,
-}
+#[cfg(test)]
+use limits::{Budget, decode_pixels};
+pub use limits::{Error, Result};
+pub use model::{
+    Adjustment, ChannelInfo, ColorMode, Layer, LayerMask, LinkedFile, MAX_GROUP_DEPTH, Node, Pixels, Rect, Section, SmartObject, SubPath, TextInfo, VectorMask,
+};
+pub use parse::is_psd;
+pub(crate) use pixels::pack_bits;
+#[cfg(test)]
+use pixels::{lab_to_rgb, srgb_encode, unpack_bits};
 
 /// A parsed Photoshop document.
 #[derive(Clone, Debug)]
@@ -446,1078 +61,11 @@ pub struct Psd {
     merged_offset: usize,
 }
 
-impl Psd {
-    pub fn parse(data: impl Into<Arc<[u8]>>) -> Result<Psd> {
-        let data: Arc<[u8]> = data.into();
-        let mut r = Reader::new(&data);
-        if r.bytes(4).ok() != Some(b"8BPS") {
-            return Err(Error::NotPsd);
-        }
-        let version = r.u16()?;
-        let psb = match version {
-            1 => false,
-            2 => true,
-            _ => return Err(Error::NotPsd),
-        };
-        r.skip(6)?;
-        let channels = r.u16()?;
-        let height = r.u32()?;
-        let width = r.u32()?;
-        let depth = r.u16()?;
-        let mode_v = r.u16()?;
-        let mode = ColorMode::from_u16(mode_v).ok_or_else(|| Error::Unsupported(format!("colour mode {mode_v}")))?;
-        if !matches!(depth, 1 | 8 | 16 | 32) {
-            return Err(Error::Unsupported(format!("{depth}-bit")));
-        }
-        if width == 0 || height == 0 || width > 300_000 || height > 300_000 {
-            return Err(Error::Invalid(format!("size {width}x{height}")));
-        }
-        // Colour mode data.
-        let n = r.u32()? as usize;
-        let palette = r.bytes(n)?.to_vec();
-        // Image resources.
-        let n = r.u32()? as usize;
-        r.skip(n)?;
-        // Layer and mask information.
-        let mut psd = Psd {
-            psb,
-            width,
-            height,
-            channels,
-            depth,
-            mode,
-            layers: vec![],
-            merged_alpha: false,
-            palette,
-            linked: vec![],
-            warnings: vec![],
-            data: data.clone(),
-            merged_offset: 0,
-        };
-        let lm_len = r.length(psb)?;
-        let lm_end = r.pos.checked_add(lm_len).filter(|&e| e <= data.len()).ok_or(Error::Truncated)?;
-        if lm_len > 0 {
-            let li_len = r.length(psb)?;
-            let li_end = r.pos.checked_add(li_len).filter(|&e| e <= lm_end).ok_or(Error::Truncated)?;
-            if li_len > 0
-                && let Err(e) = psd.layer_info(&data, r.pos, li_end)
-            {
-                // A damaged layer section must not discard the document: keep the header and the
-                // merged image, drop the layers and say so. Without a merged image there is
-                // nothing to fall back to, so the original error stands.
-                if lm_end.checked_add(2).is_none_or(|n| n > data.len()) {
-                    return Err(e);
-                }
-                psd.layers.clear();
-                psd.warnings.push(format!("Layers could not be read ({e}); only the flattened image is available"));
-            }
-            r.pos = li_end;
-            if r.pos + 4 <= lm_end {
-                let g = r.u32()? as usize;
-                r.pos = (r.pos + g).min(lm_end);
-            }
-            // Global additional layer information (16/32-bit layer info lives here).
-            while let Some((key, start, end)) = next_block(&data, &mut r.pos, lm_end, psb) {
-                if matches!(&key, b"lnk2" | b"lnkD" | b"lnk3" | b"lnkE") {
-                    psd.linked_files(&data, start, end);
-                }
-                if matches!(&key, b"Lr16" | b"Lr32" | b"Layr") && psd.layers.is_empty() && end > start {
-                    // The block holds the layer info, normally without its length field; accept
-                    // both layouts.
-                    if psd.layer_info(&data, start, end).is_err() || psd.layers.is_empty() {
-                        psd.layers.clear();
-                        let skip = if psb { 8 } else { 4 };
-                        if start + skip < end && psd.layer_info(&data, start + skip, end).is_err() {
-                            psd.layers.clear();
-                        }
-                    }
-                }
-                r.pos = end;
-            }
-        }
-        if !psd.layers.is_empty() {
-            // A 16/32-bit layer block recovered the layers.
-            psd.warnings.clear();
-        }
-        psd.merged_offset = lm_end;
-        Ok(psd)
-    }
-
-    /// The embedded bytes of linked file `uuid`.
-    pub fn linked_data(&self, uuid: &str) -> Option<&[u8]> {
-        let f = self.linked.iter().find(|f| f.uuid == uuid)?;
-        self.data.get(f.data.clone()?)
-    }
-
-    /// Linked layer data records (spec: "Linked Layer"): length, kind (`liFD` embedded data,
-    /// `liFE` external file, `liFA` alias), version, unique id, original file name, type,
-    /// creator, data length, optional descriptors, then the data. A damaged record ends the list.
-    fn linked_files(&mut self, data: &[u8], start: usize, end: usize) {
-        let mut pos = start;
-        while pos + 8 <= end {
-            let mut r = Reader::at(&data[..end], pos);
-            let Ok(len) = r.u64() else { break };
-            let body = r.pos;
-            let Some(rec_end) = body.checked_add(len as usize).filter(|e| *e <= end) else { break };
-            let mut r = Reader::at(&data[..rec_end], body);
-            let rec = (|| -> Result<LinkedFile> {
-                let kind = r.tag()?;
-                let version = r.u32()?;
-                let n = r.u8()? as usize;
-                let uuid = String::from_utf8_lossy(r.bytes(n)?).into_owned();
-                let name = descriptor::read_unicode(&mut r)?;
-                let file_type = String::from_utf8_lossy(&r.tag()?).trim().to_string();
-                let _creator = r.tag()?;
-                let dlen = r.u64()? as usize;
-                if r.u8()? != 0 {
-                    let _v = r.u32()?;
-                    descriptor::read_descriptor(&mut r)?;
-                }
-                let mut out = LinkedFile { uuid, name, file_type, data: None };
-                match &kind {
-                    b"liFD" => {
-                        let s = r.pos;
-                        r.skip(dlen)?;
-                        out.data = Some(s..s + dlen);
-                    }
-                    b"liFE" => {
-                        let _v = r.u32()?;
-                        descriptor::read_descriptor(&mut r)?;
-                        if version > 3 {
-                            r.skip(4 + 4 + 8)?;
-                        }
-                        let _size = r.u64()?;
-                        if version > 2 && r.remaining() >= dlen && dlen > 0 {
-                            let s = r.pos;
-                            out.data = Some(s..s + dlen);
-                        }
-                    }
-                    _ => {}
-                }
-                Ok(out)
-            })();
-            match rec {
-                Ok(f) => self.linked.push(f),
-                Err(_) => break,
-            }
-            pos = rec_end.div_ceil(4) * 4;
-        }
-    }
-
-    fn layer_info(&mut self, data: &[u8], start: usize, end: usize) -> Result<()> {
-        let mut r = Reader::at(&data[..end], start);
-        let count = r.i16()?;
-        self.merged_alpha = count < 0;
-        let n = count.unsigned_abs() as usize;
-        let mut layers = Vec::with_capacity(n);
-        for i in 0..n {
-            layers.push(self.layer_record(&mut r, i)?);
-        }
-        // Channel image data follows in record order.
-        for l in &mut layers {
-            for c in &mut l.channels {
-                c.offset = r.pos;
-                r.skip(c.len)?;
-            }
-        }
-        self.layers = layers;
-        Ok(())
-    }
-
-    fn layer_record(&self, r: &mut Reader, index: usize) -> Result<Layer> {
-        let psb = self.psb;
-        let (top, left, bottom, right) = (r.i32()?, r.i32()?, r.i32()?, r.i32()?);
-        let nch = r.u16()? as usize;
-        if nch > 64 {
-            return Err(Error::Invalid("channel count".into()));
-        }
-        let mut channels = Vec::with_capacity(nch);
-        for _ in 0..nch {
-            let id = r.i16()?;
-            let len = r.length(psb)?;
-            channels.push(ChannelInfo { id, offset: 0, len });
-        }
-        if r.bytes(4)? != b"8BIM" {
-            return Err(Error::Invalid("layer record signature".into()));
-        }
-        let blend = r.tag()?;
-        let opacity = r.u8()?;
-        let clipping = r.u8()? != 0;
-        let flags = r.u8()?;
-        r.skip(1)?;
-        let extra = r.u32()? as usize;
-        let extra_end = r.pos.checked_add(extra).filter(|&e| e <= r.data.len()).ok_or(Error::Truncated)?;
-        let mut l = Layer {
-            index,
-            rect: Rect { top, left, bottom, right },
-            blend,
-            opacity,
-            fill_opacity: 255,
-            clipping,
-            hidden: flags & 2 != 0,
-            protect_transparency: flags & 1 != 0,
-            channels,
-            ..Default::default()
-        };
-        // Layer mask data.
-        let mlen = r.u32()? as usize;
-        let mstart = r.pos;
-        if mlen >= 18 {
-            let rect = Rect { top: r.i32()?, left: r.i32()?, bottom: r.i32()?, right: r.i32()? };
-            let default_color = r.u8()?;
-            let mflags = r.u8()?;
-            l.mask = Some(LayerMask { rect, default_color, disabled: mflags & 2 != 0, inverted: mflags & 4 != 0 });
-        }
-        r.pos = mstart + mlen;
-        // Blending ranges.
-        let blen = r.u32()? as usize;
-        r.skip(blen)?;
-        l.name = r.pascal(4)?;
-        let mut pos = r.pos;
-        let data = r.data;
-        while let Some((key, start, end)) = next_block(data, &mut pos, extra_end, psb) {
-            l.keys.push(key);
-            let block = &data[start..end];
-            // A malformed block only loses that block's information.
-            let _ = self.layer_block(&mut l, &key, block);
-            pos = end;
-        }
-        r.pos = extra_end;
-        Ok(l)
-    }
-
-    fn layer_block(&self, l: &mut Layer, key: &[u8; 4], b: &[u8]) -> Result<()> {
-        let mut r = Reader::new(b);
-        match key {
-            b"luni" => {
-                let name = descriptor::read_unicode(&mut r)?;
-                if !name.is_empty() {
-                    l.name = name;
-                }
-            }
-            b"lyid" => l.id = Some(r.u32()?),
-            b"iOpa" => l.fill_opacity = r.u8()?,
-            b"lsct" | b"lsdk" => {
-                l.section = match r.u32()? {
-                    1 => Section::OpenFolder,
-                    2 => Section::ClosedFolder,
-                    3 => Section::Divider,
-                    _ => Section::Layer,
-                };
-                if b.len() >= 12 && &b[4..8] == b"8BIM" {
-                    l.blend.copy_from_slice(&b[8..12]);
-                }
-            }
-            b"TySh" => {
-                let _ver = r.u16()?;
-                let mut t = [0.0; 6];
-                for v in &mut t {
-                    *v = r.f64()?;
-                }
-                // A transform with NaN/inf is unusable: fall back to the identity.
-                if t.iter().any(|v| !v.is_finite()) {
-                    t = [1.0, 0.0, 0.0, 1.0, 0.0, 0.0];
-                }
-                let _text_ver = r.u16()?;
-                let _desc_ver = r.u32()?;
-                let d = descriptor::read_descriptor(&mut r)?;
-                let text = d.text("Txt ").unwrap_or_default().replace("\r\n", "\n").replace('\r', "\n");
-                let text = text.strip_suffix('\n').map(str::to_string).unwrap_or(text);
-                let style = d.raw("EngineData").map(|e| engine_data::text_style(&engine_data::parse(e))).unwrap_or_default();
-                let bounds =
-                    d.obj("bounds").or_else(|| d.obj("boundingBox")).and_then(|o| Some([o.num("Left")?, o.num("Top ")?, o.num("Rght")?, o.num("Btom")?]));
-                l.text = Some(TextInfo { text, transform: t, style, bounds });
-            }
-            b"lfx2" => {
-                let _ver = r.u32()?;
-                let _dver = r.u32()?;
-                l.effects = Some(descriptor::read_descriptor(&mut r)?);
-            }
-            b"SoCo" => {
-                let _ver = r.u32()?;
-                let d = descriptor::read_descriptor(&mut r)?;
-                l.fill = d.color("Clr ");
-            }
-            b"nvrt" => l.adjustment = Some(Adjustment::Invert),
-            b"brit" => {
-                let brightness = r.i16()? as f64;
-                let contrast = r.i16()? as f64;
-                if l.adjustment.is_none() {
-                    l.adjustment = Some(Adjustment::BrightnessContrast { brightness, contrast, legacy: true });
-                }
-            }
-            b"CgEd" => {
-                let _ver = r.u32()?;
-                let d = descriptor::read_descriptor(&mut r)?;
-                l.adjustment = Some(Adjustment::BrightnessContrast {
-                    brightness: d.num("Brgh").unwrap_or(0.0),
-                    contrast: d.num("Cntr").unwrap_or(0.0),
-                    legacy: d.bool("useLegacy").unwrap_or(false),
-                });
-            }
-            b"hue2" | b"hue " => {
-                let _ver = r.u16()?;
-                let colorize = r.u8()? != 0;
-                r.skip(1)?;
-                let ch = (r.i16()? as f64, r.i16()? as f64, r.i16()? as f64);
-                let m = (r.i16()? as f64, r.i16()? as f64, r.i16()? as f64);
-                let (hue, saturation, lightness) = if colorize { ch } else { m };
-                l.adjustment = Some(Adjustment::HueSaturation { hue, saturation, lightness, colorize });
-            }
-            b"levl" => {
-                let _ver = r.u16()?;
-                let (ib, iw, ob, ow, g) = (r.i16()?, r.i16()?, r.i16()?, r.i16()?, r.i16()?);
-                l.adjustment =
-                    Some(Adjustment::Levels { in_black: ib as f64, in_white: iw as f64, gamma: g as f64 / 100.0, out_black: ob as f64, out_white: ow as f64 });
-            }
-            b"expA" => {
-                let _ver = r.u16()?;
-                let mut finite = |default: f64| -> Result<f64> {
-                    let v = f64::from(r.f32()?);
-                    Ok(if v.is_finite() { v } else { default })
-                };
-                let exposure = finite(0.0)?;
-                let offset = finite(0.0)?;
-                let gamma = finite(1.0)?;
-                l.adjustment = Some(Adjustment::Exposure { exposure, offset, gamma });
-            }
-            b"curv" | b"blnc" | b"post" | b"thrs" | b"selc" | b"mixr" | b"phfl" | b"vibA" | b"blwh" | b"grdm" | b"clrL" if l.adjustment.is_none() => {
-                l.adjustment = Some(Adjustment::Other(String::from_utf8_lossy(key).into_owned()));
-            }
-            b"SoLd" | b"SoLE" => {
-                let _id = r.tag()?;
-                let _ver = r.u32()?;
-                let _dver = r.u32()?;
-                let d = descriptor::read_descriptor(&mut r)?;
-                let uuid = d.text("Idnt").unwrap_or_default().to_string();
-                let t = placed::eight(&d, "Trnf").unwrap_or([0.0; 8]);
-                // The non-affine transform when present (perspective), else the transform.
-                let t = placed::eight(&d, "nonAffineTransform").unwrap_or(t);
-                let size = d.obj("Sz  ").and_then(|s| Some([s.num("Wdth")?, s.num("Hght")?]));
-                let warp = d.obj("warp").and_then(placed::Warp::read);
-                l.smart_object = Some(SmartObject { uuid, quad: placed::quad_from(t), size, warp });
-            }
-            b"PlLd" if l.smart_object.is_none() => {
-                let _id = r.tag()?;
-                let _ver = r.u32()?;
-                let n = r.u8()? as usize;
-                let uuid = String::from_utf8_lossy(r.bytes(n)?).into_owned();
-                let _page = r.u32()?;
-                let _pages = r.u32()?;
-                let _aa = r.u32()?;
-                let _ty = r.u32()?;
-                let mut t = [0.0; 8];
-                for v in &mut t {
-                    *v = r.f64_finite()?;
-                }
-                l.smart_object = Some(SmartObject { uuid, quad: placed::quad_from(t), size: None, warp: None });
-            }
-            b"vmsk" | b"vsms" => {
-                let _ver = r.u32()?;
-                let flags = r.u32()?;
-                l.vector_mask = Some(self.vector_paths(&mut r, flags)?);
-            }
-            _ => {}
-        }
-        Ok(())
-    }
-
-    fn vector_paths(&self, r: &mut Reader, flags: u32) -> Result<VectorMask> {
-        let (w, h) = (self.width as f64, self.height as f64);
-        let mut vm = VectorMask { inverted: flags & 1 != 0, disabled: flags & 4 != 0, subpaths: vec![] };
-        let fixed = |r: &mut Reader| -> Result<f64> { Ok(r.i32()? as f64 / (1 << 24) as f64) };
-        while r.remaining() >= 26 {
-            let sel = r.u16()?;
-            match sel {
-                0 | 3 => {
-                    let _n = r.u16()?;
-                    r.skip(22)?;
-                    vm.subpaths.push(SubPath { closed: sel == 0, knots: vec![] });
-                }
-                1 | 2 | 4 | 5 => {
-                    let mut pts = [[0.0; 2]; 3];
-                    for p in &mut pts {
-                        let y = fixed(r)?;
-                        let x = fixed(r)?;
-                        *p = [x * w, y * h];
-                    }
-                    if let Some(sp) = vm.subpaths.last_mut() {
-                        sp.knots.push(pts);
-                    }
-                }
-                _ => r.skip(24)?,
-            }
-        }
-        vm.subpaths.retain(|s| !s.knots.is_empty());
-        Ok(vm)
-    }
-
-    /// The layer tree, top of the stack first. Groups nest at most [`MAX_GROUP_DEPTH`] deep (see
-    /// [`Psd::tree_report`]).
-    pub fn tree(&self) -> Vec<Node> {
-        self.tree_report().0
-    }
-
-    /// The layer tree plus the number of groups nested deeper than [`MAX_GROUP_DEPTH`]. Those
-    /// are flattened into their deepest allowed ancestor: their children stay, in order, and
-    /// the group record itself becomes a plain [`Node::Layer`], so no layer is lost and the
-    /// tree (and its `Drop`, `Clone` and `PartialEq`) cannot recurse deeper than the limit.
-    pub fn tree_report(&self) -> (Vec<Node>, usize) {
-        let mut stack: Vec<Vec<Node>> = vec![vec![]];
-        // Dividers seen while `MAX_GROUP_DEPTH` groups were already open.
-        let mut flattened_open = 0usize;
-        let mut flattened = 0usize;
-        for l in &self.layers {
-            match l.section {
-                Section::Divider => {
-                    if stack.len() > MAX_GROUP_DEPTH {
-                        flattened_open += 1;
-                    } else {
-                        stack.push(vec![]);
-                    }
-                }
-                Section::OpenFolder | Section::ClosedFolder => {
-                    if flattened_open > 0 {
-                        flattened_open -= 1;
-                        flattened += 1;
-                        if let Some(top) = stack.last_mut() {
-                            top.push(Node::Layer(l.index));
-                        }
-                        continue;
-                    }
-                    let children = if stack.len() > 1 { stack.pop().unwrap_or_default() } else { vec![] };
-                    if let Some(top) = stack.last_mut() {
-                        top.push(Node::Group { layer: l.index, children });
-                    }
-                }
-                Section::Layer => {
-                    if let Some(top) = stack.last_mut() {
-                        top.push(Node::Layer(l.index));
-                    }
-                }
-            }
-        }
-        while stack.len() > 1 {
-            let c = stack.pop().unwrap_or_default();
-            if let Some(top) = stack.last_mut() {
-                top.extend(c);
-            }
-        }
-        // Depth is at most `MAX_GROUP_DEPTH`, so recursion is bounded.
-        fn rev(v: &mut Vec<Node>) {
-            v.reverse();
-            for n in v {
-                if let Node::Group { children, .. } = n {
-                    rev(children);
-                }
-            }
-        }
-        let mut out = stack.pop().unwrap_or_default();
-        rev(&mut out);
-        (out, flattened)
-    }
-
-    fn bytes_per_sample(&self) -> usize {
-        match self.depth {
-            16 => 2,
-            32 => 4,
-            _ => 1,
-        }
-    }
-
-    /// The raw big-endian bytes of one channel of `w`×`h` samples at `offset` (compression field
-    /// first): `row_bytes(w) × h` of them with the compression and the prediction undone.
-    /// Uncompressed data is borrowed from the file, not copied; any other buffer is charged to
-    /// `budget` and the caller releases it (see [`release_bytes`]) once it is dropped.
-    fn channel_bytes(&self, offset: usize, len: usize, w: usize, h: usize, budget: &mut Budget) -> Result<Cow<'_, [u8]>> {
-        let end = offset.checked_add(len).filter(|&e| e <= self.data.len()).ok_or(Error::Truncated)?;
-        let mut r = Reader::at(self.data.get(..end).ok_or(Error::Truncated)?, offset);
-        let comp = r.u16()?;
-        decode_pixels(w, h)?;
-        self.plane_bytes(comp, &mut r, w, h, budget)
-    }
-
-    /// The raw bytes (`row_bytes(w)` × `h`, ZIP prediction undone) of one channel whose pixel data
-    /// follows `r`'s position (after the compression field). Uncompressed data is borrowed, not
-    /// copied; the other buffers are charged to `budget`.
-    fn plane_bytes<'a>(&self, comp: u16, r: &mut Reader<'a>, w: usize, h: usize, budget: &mut Budget) -> Result<Cow<'a, [u8]>> {
-        let rowb = self.row_bytes(w);
-        let size = rowb.checked_mul(h).ok_or_else(|| too_large(w, h))?;
-        Ok(match self.open_planes(comp, r, 1, 1, w, h, budget)? {
-            PlaneStream::Raw => Cow::Borrowed(r.bytes(size)?),
-            PlaneStream::Rle(counts) => Cow::Owned(Self::unpack_plane(&counts, 0, r, rowb, h, budget)?),
-            PlaneStream::Zip(mut v) => {
-                v.resize(size, 0);
-                self.zip_plane(comp, &mut v, 0, w, h)?;
-                Cow::Owned(v)
-            }
-        })
-    }
-
-    /// Prepare the pixel data at `r` (just after the compression field) of `total` planes of
-    /// `w`×`h` samples, of which the first `want` are decoded: the RLE row sizes of every plane,
-    /// or the inflated ZIP data, which holds all planes one after another (charged to `budget`
-    /// before it is inflated).
-    #[allow(clippy::too_many_arguments)]
-    fn open_planes(&self, comp: u16, r: &mut Reader, total: usize, want: usize, w: usize, h: usize, budget: &mut Budget) -> Result<PlaneStream> {
-        let size = self.row_bytes(w).checked_mul(h).ok_or_else(|| too_large(w, h))?;
-        Ok(match comp {
-            0 => PlaneStream::Raw,
-            1 => {
-                let n = total.saturating_mul(h);
-                let mut counts = Vec::with_capacity(n.min(r.remaining() / 2));
-                for _ in 0..n {
-                    counts.push(if self.psb { r.u32()? as usize } else { r.u16()? as usize });
-                }
-                PlaneStream::Rle(counts)
-            }
-            2 | 3 => {
-                let rest = r.bytes(r.remaining())?;
-                // One stream holds every plane: what it may decode to is what they need.
-                let all = size.checked_mul(want).ok_or_else(|| too_large(w, h))?;
-                budget.charge(all as u64)?;
-                PlaneStream::Zip(inflate(rest, all)?)
-            }
-            c => return Err(Error::Unsupported(format!("compression {c}"))),
-        })
-    }
-
-    /// The raw bytes (`row_bytes(w)` × `h`, ZIP prediction undone) of plane `c`: raw and RLE
-    /// planes are read from `r` in order, raw ones borrowed from the file data, ZIP ones from the
-    /// inflated buffer (un-predicted in place; already charged by `open_planes`), RLE ones charged
-    /// to `budget`.
-    #[allow(clippy::too_many_arguments)]
-    fn decode_plane<'x, 'a: 'x>(
-        &self,
-        comp: u16,
-        planes: &'x mut PlaneStream,
-        r: &mut Reader<'a>,
-        c: usize,
-        w: usize,
-        h: usize,
-        budget: &mut Budget,
-    ) -> Result<Cow<'x, [u8]>> {
-        let rowb = self.row_bytes(w);
-        let size = rowb.checked_mul(h).ok_or_else(|| too_large(w, h))?;
-        Ok(match planes {
-            PlaneStream::Raw => Cow::Borrowed(r.bytes(size)?),
-            PlaneStream::Rle(counts) => Cow::Owned(Self::unpack_plane(counts, c, r, rowb, h, budget)?),
-            PlaneStream::Zip(v) => Cow::Borrowed(self.zip_plane(comp, v, c, w, h)?),
-        })
-    }
-
-    /// Unpack the `h` RLE rows of plane `c` (row byte counts `counts`, plane after plane) into a
-    /// buffer charged to `budget`.
-    fn unpack_plane(counts: &[usize], c: usize, r: &mut Reader, rowb: usize, h: usize, budget: &mut Budget) -> Result<Vec<u8>> {
-        let mut out = budget.vec::<u8>(rowb.checked_mul(h).ok_or(Error::Truncated)?)?;
-        for row in 0..h {
-            let n = *counts.get(c * h + row).ok_or(Error::Truncated)?;
-            unpack_bits(r.bytes(n)?, rowb, &mut out)?;
-        }
-        Ok(out)
-    }
-
-    /// Plane `c` of the inflated ZIP data of consecutive planes, un-predicted in place (`comp` 3).
-    fn zip_plane<'v>(&self, comp: u16, v: &'v mut [u8], c: usize, w: usize, h: usize) -> Result<&'v [u8]> {
-        let rowb = self.row_bytes(w);
-        let plane = v.get_mut(c * rowb * h..(c + 1) * rowb * h).ok_or(Error::Truncated)?;
-        if comp == 3 {
-            self.unpredict(plane, w, h);
-        }
-        Ok(plane)
-    }
-
-    /// One channel as `w * h` floats (0..1), charged to `budget` (the caller releases it).
-    fn channel_floats(&self, offset: usize, len: usize, w: usize, h: usize, budget: &mut Budget) -> Result<Vec<f32>> {
-        let raw = self.channel_bytes(offset, len, w, h, budget)?;
-        let mut out = budget.filled(decode_pixels(w, h)?, 0.0f32)?;
-        self.for_each_sample(&raw, w, h, |i, v| {
-            if let Some(o) = out.get_mut(i) {
-                *o = v;
-            }
-        });
-        release_bytes(budget, raw);
-        Ok(out)
-    }
-
-    fn row_bytes(&self, w: usize) -> usize {
-        if self.depth == 1 { w.div_ceil(8) } else { w * self.bytes_per_sample() }
-    }
-
-    fn unpredict(&self, v: &mut [u8], w: usize, h: usize) {
-        match self.depth {
-            16 => {
-                for row in v.chunks_exact_mut(w * 2).take(h) {
-                    let mut prev = 0u16;
-                    for c in row.as_chunks_mut::<2>().0 {
-                        let x = u16::from_be_bytes([c[0], c[1]]).wrapping_add(prev);
-                        c.copy_from_slice(&x.to_be_bytes());
-                        prev = x;
-                    }
-                }
-            }
-            32 => {
-                // One scratch row for the whole plane.
-                let mut planar = vec![0u8; w * 4];
-                #[cfg(test)]
-                counters::bump(&counters::SCRATCH);
-                for row in v.chunks_exact_mut(w * 4).take(h) {
-                    for i in 1..row.len() {
-                        row[i] = row[i].wrapping_add(row[i - 1]);
-                    }
-                    // Bytes are stored plane by plane (all first bytes, then all second bytes…).
-                    planar.copy_from_slice(row);
-                    for x in 0..w {
-                        for b in 0..4 {
-                            row[x * 4 + b] = planar[b * w + x];
-                        }
-                    }
-                }
-            }
-            _ => {
-                for row in v.chunks_exact_mut(w).take(h) {
-                    for i in 1..row.len() {
-                        row[i] = row[i].wrapping_add(row[i - 1]);
-                    }
-                }
-            }
-        }
-    }
-
-    /// Hand every sample of `raw` (`w`×`h`, row-major, in order) to `f` as a float. Samples a short
-    /// `raw` does not have are not reported.
-    fn for_each_sample(&self, raw: &[u8], w: usize, h: usize, mut f: impl FnMut(usize, f32)) {
-        let n = w.saturating_mul(h);
-        match self.depth {
-            1 => {
-                let rowb = w.div_ceil(8);
-                for y in 0..h {
-                    for x in 0..w {
-                        let b = raw.get(y * rowb + x / 8).copied().unwrap_or(0);
-                        // 1 = black.
-                        f(y * w + x, if b & (0x80 >> (x % 8)) != 0 { 0.0 } else { 1.0 });
-                    }
-                }
-            }
-            16 => raw.as_chunks::<2>().0.iter().take(n).enumerate().for_each(|(i, c)| f(i, u16::from_be_bytes([c[0], c[1]]) as f32 / 65535.0)),
-            // NaN reads as 0, +inf as white (1.0, like the integer depths' maximum), -inf as 0.
-            32 => raw.as_chunks::<4>().0.iter().take(n).enumerate().for_each(|(i, c)| f(i, finite_sample(f32::from_be_bytes([c[0], c[1], c[2], c[3]])))),
-            _ => raw.iter().take(n).enumerate().for_each(|(i, &b)| f(i, b as f32 / 255.0)),
-        }
-    }
-
-    /// Convert colour values (the document mode's channels, missing ones 0) to RGB.
-    fn rgb_from(&self, v: [f32; 4]) -> [f32; 3] {
-        let g = |k: usize| v.get(k).copied().unwrap_or(0.0);
-        let rgb = match self.mode {
-            ColorMode::Rgb => [g(0), g(1), g(2)],
-            ColorMode::Cmyk => {
-                // Stored inverted (1 = no ink).
-                let k = g(3);
-                [g(0) * k, g(1) * k, g(2) * k]
-            }
-            ColorMode::Indexed if self.palette.len() >= 768 => {
-                let idx = (g(0) * 255.0).round() as usize & 255;
-                [self.palette[idx] as f32 / 255.0, self.palette[256 + idx] as f32 / 255.0, self.palette[512 + idx] as f32 / 255.0]
-            }
-            ColorMode::Lab => lab_to_rgb(g(0) * 100.0, g(1) * 255.0 - 128.0, g(2) * 255.0 - 128.0),
-            _ => [g(0); 3],
-        };
-        if self.depth == 32 && self.mode != ColorMode::Lab { rgb.map(srgb_encode) } else { rgb }
-    }
-
-    /// Write merged-image channel `c` (raw bytes) into the result: the first three colour channels
-    /// and the alpha channel into their slot of a pixel, the fourth CMYK channel into `black`.
-    fn store_merged_channel(&self, c: usize, raw: &[u8], data: &mut [[f32; 4]], black: &mut Option<Vec<f32>>) {
-        let (w, h, cc) = (self.width as usize, self.height as usize, self.mode.color_channels());
-        if c < cc.min(3) {
-            self.for_each_sample(raw, w, h, |i, v| {
-                if let Some(p) = data.get_mut(i) {
-                    p[c] = v;
-                }
-            });
-        } else if c == 3 && c < cc {
-            if let Some(k) = black {
-                self.for_each_sample(raw, w, h, |i, v| {
-                    if let Some(o) = k.get_mut(i) {
-                        *o = v;
-                    }
-                });
-            }
-        } else if c == cc && self.merged_alpha {
-            self.for_each_sample(raw, w, h, |i, v| {
-                if let Some(p) = data.get_mut(i) {
-                    p[3] = v;
-                }
-            });
-        }
-    }
-
-    /// The merged (flattened) image.
-    pub fn composite(&self) -> Result<Pixels> {
-        self.composite_with_budget(DECODE_BUDGET)
-    }
-
-    /// [`Self::composite`] with at most `limit` bytes live at once. The channels are written
-    /// straight into the result, so the peak is the result (16 bytes a pixel), the CMYK black
-    /// channel, and the one buffer a channel (or, for ZIP, all channels) decodes through.
-    pub(crate) fn composite_with_budget(&self, limit: u64) -> Result<Pixels> {
-        let mut budget = Budget::new(limit);
-        let (w, h) = (self.width as usize, self.height as usize);
-        let n = decode_pixels(w, h)?;
-        let mut r = Reader::at(&self.data, self.merged_offset);
-        let comp = r.u16()?;
-        let nch = self.channels as usize;
-        let cc = self.mode.color_channels();
-        let want = (cc + usize::from(self.merged_alpha)).min(nch);
-        let rowb = self.row_bytes(w);
-        let size = rowb.checked_mul(h).ok_or_else(|| too_large(w, h))?;
-        // The peak: the result, the CMYK black channel and what the channels decode through.
-        let black_bytes = if self.mode == ColorMode::Cmyk && want > 3 { 4 * n as u64 } else { 0 };
-        let transient = if matches!(comp, 2 | 3) { (size as u64).saturating_mul(want as u64) } else { size as u64 };
-        budget.check((16 * n as u64).saturating_add(black_bytes).saturating_add(transient))?;
-        // Opaque black until a channel says otherwise.
-        let mut data = budget.filled(n, [0.0f32, 0.0, 0.0, 1.0])?;
-        let mut black = if self.mode == ColorMode::Cmyk && want > 3 { Some(budget.filled(n, 0.0f32)?) } else { None };
-        let mut stream = self.open_planes(comp, &mut r, nch, want, w, h, &mut budget)?;
-        for c in 0..want {
-            let raw = self.decode_plane(comp, &mut stream, &mut r, c, w, h, &mut budget)?;
-            self.store_merged_channel(c, &raw, &mut data, &mut black);
-            release_bytes(&mut budget, raw);
-        }
-        for (i, p) in data.iter_mut().enumerate() {
-            let k = black.as_ref().and_then(|k| k.get(i)).copied().unwrap_or(0.0);
-            let [r, g, b] = self.rgb_from([p[0], p[1], p[2], k]);
-            *p = [r, g, b, p[3]];
-        }
-        Ok(Pixels { width: w as u32, height: h as u32, data })
-    }
-
-    /// One layer's pixels with its layer mask (and vector-less fill colour) applied to alpha.
-    /// `canvas`: document-sized with the layer in place; otherwise the layer's own bounds.
-    pub fn layer_pixels(&self, index: usize, canvas: bool) -> Result<Pixels> {
-        self.layer_pixels_with_budget(index, canvas, DECODE_BUDGET)
-    }
-
-    /// [`Self::layer_pixels`] with at most `limit` bytes live at once: the result (16 bytes a
-    /// pixel) with the channels written straight into it, the CMYK black channel, the one channel
-    /// being decoded, and the mask.
-    pub(crate) fn layer_pixels_with_budget(&self, index: usize, canvas: bool, limit: u64) -> Result<Pixels> {
-        let mut budget = Budget::new(limit);
-        let l = self.layers.get(index).ok_or_else(|| Error::Invalid(format!("no layer {index}")))?;
-        let doc = Rect { top: 0, left: 0, bottom: self.height as i32, right: self.width as i32 };
-        // Fill layers often have no pixel data: they cover the canvas (or the mask).
-        let fill_rect =
-            if l.fill.is_some() && !l.has_pixels() { l.mask.filter(|m| !m.rect.is_empty() && m.default_color == 0).map_or(doc, |m| m.rect) } else { l.rect };
-        let out_rect = if canvas {
-            doc
-        } else if fill_rect.is_empty() {
-            Rect { top: 0, left: 0, bottom: 1, right: 1 }
-        } else {
-            fill_rect
-        };
-        let (ow, oh) = (out_rect.width() as usize, out_rect.height() as usize);
-        let n = decode_pixels(ow, oh)?;
-        let src = fill_rect;
-        let (sw, sh) = (src.width() as usize, src.height() as usize);
-        // The peak: the result, then either the CMYK black channel with the channel being decoded,
-        // or the mask as floats with its bytes. Checked before anything is allocated.
-        let plane = |w: usize, h: usize| (self.row_bytes(w) as u64).saturating_mul(h as u64);
-        let mut pixels_peak = 0u64;
-        if l.has_pixels() && sw > 0 && sh > 0 {
-            pixels_peak = plane(sw, sh).saturating_add(if self.mode == ColorMode::Cmyk { 4 * n as u64 } else { 0 });
-        }
-        let mut mask_peak = 0u64;
-        if let Some(m) = l.mask.filter(|m| !m.disabled) {
-            let (mw, mh) = (m.rect.width() as usize, m.rect.height() as usize);
-            if mw > 0 && mh > 0 && l.channels.iter().any(|c| c.id == -2) {
-                mask_peak = plane(mw, mh).saturating_add((mw as u64).saturating_mul(mh as u64).saturating_mul(4));
-            }
-        }
-        budget.check((16 * n as u64).saturating_add(pixels_peak.max(mask_peak)))?;
-        let mut out = budget.filled(n, [0.0f32; 4])?;
-        if sw > 0 && sh > 0 {
-            // The source rows / columns that land inside the output (64-bit: file bounds can span
-            // the whole i32 range).
-            let span = |s0: i32, n: usize, o0: i32, on: usize| {
-                let off = i64::from(o0) - i64::from(s0);
-                let lo = off.clamp(0, n as i64);
-                let hi = (off + on as i64).clamp(lo, n as i64);
-                (lo as usize..hi as usize, off)
-            };
-            let (ys, oy) = span(src.top, sh, out_rect.top, oh);
-            let (xs, ox) = span(src.left, sw, out_rect.left, ow);
-            let dest = |y: usize, x: usize| (y as i64 - oy) as usize * ow + (x as i64 - ox) as usize;
-            let fill = l.fill.map(|c| c.map(|v| v as f32));
-            match fill {
-                Some(f) if !l.has_pixels() => {
-                    for y in ys {
-                        for x in xs.clone() {
-                            if let Some(p) = out.get_mut(dest(y, x)) {
-                                *p = [f[0], f[1], f[2], 1.0];
-                            }
-                        }
-                    }
-                }
-                _ => {
-                    // Opaque unless there is an alpha channel.
-                    for y in ys.clone() {
-                        for x in xs.clone() {
-                            if let Some(p) = out.get_mut(dest(y, x)) {
-                                p[3] = 1.0;
-                            }
-                        }
-                    }
-                    let cc = self.mode.color_channels();
-                    let mut black: Option<Vec<f32>> = None;
-                    if l.has_pixels() {
-                        for c in &l.channels {
-                            let slot = match c.id {
-                                -1 => 3,
-                                id if id >= 0 && (id as usize) < cc => id as usize,
-                                _ => continue,
-                            };
-                            let raw = self.channel_bytes(c.offset, c.len, sw, sh, &mut budget)?;
-                            // The fourth CMYK channel is the black plate, not a slot of the result.
-                            let to_black = c.id == 3;
-                            if to_black && black.is_none() {
-                                black = Some(budget.filled(out.len(), 0.0f32)?);
-                            }
-                            // Samples arrive in row-major order of the source.
-                            let (mut sy, mut sx) = (0usize, 0usize);
-                            self.for_each_sample(&raw, sw, sh, |_, v| {
-                                if ys.contains(&sy) && xs.contains(&sx) {
-                                    let d = dest(sy, sx);
-                                    if to_black {
-                                        if let Some(o) = black.as_mut().and_then(|k| k.get_mut(d)) {
-                                            *o = v;
-                                        }
-                                    } else if let Some(p) = out.get_mut(d) {
-                                        p[slot] = v;
-                                    }
-                                }
-                                sx += 1;
-                                if sx == sw {
-                                    sx = 0;
-                                    sy += 1;
-                                }
-                            });
-                            release_bytes(&mut budget, raw);
-                        }
-                    }
-                    for y in ys {
-                        for x in xs.clone() {
-                            let d = dest(y, x);
-                            let k = black.as_ref().and_then(|k| k.get(d)).copied().unwrap_or(0.0);
-                            if let Some(p) = out.get_mut(d) {
-                                let [r, g, b] = self.rgb_from([p[0], p[1], p[2], k]);
-                                *p = [r, g, b, p[3]];
-                            }
-                        }
-                    }
-                    if let Some(k) = black {
-                        budget.release(k.len() as u64 * 4);
-                    }
-                }
-            }
-        }
-        // Layer mask: multiplies alpha (also outside the mask rect, by its default colour).
-        if let Some(m) = l.mask.filter(|m| !m.disabled) {
-            let mc = l.channels.iter().find(|c| c.id == -2);
-            let (mw, mh) = (m.rect.width() as usize, m.rect.height() as usize);
-            let mask = match mc {
-                Some(c) if mw > 0 && mh > 0 => Some(self.channel_floats(c.offset, c.len, mw, mh, &mut budget)?),
-                _ => None,
-            };
-            let def = m.default_color as f32 / 255.0;
-            // The factor outside the mask rect, or everywhere when there is no mask data.
-            let outside = if m.inverted { 1.0 - def } else { def };
-            let scale = |px: &mut [[f32; 4]], v: f32| {
-                if v != 1.0 {
-                    for p in px {
-                        p[3] *= v;
-                    }
-                }
-            };
-            match &mask {
-                None => scale(&mut out, outside),
-                Some(mk) => {
-                    // The columns of the output that fall inside the mask rect (the same for every row).
-                    let lo = (i64::from(m.rect.left) - i64::from(out_rect.left)).clamp(0, ow as i64);
-                    let hi = (i64::from(m.rect.right) - i64::from(out_rect.left)).clamp(lo, ow as i64);
-                    let (lo, hi) = (lo as usize, hi as usize);
-                    for (y, row) in out.chunks_exact_mut(ow.max(1)).take(oh).enumerate() {
-                        let py = i64::from(out_rect.top) + y as i64;
-                        #[cfg(test)]
-                        counters::bump(&counters::INSIDE);
-                        if py < i64::from(m.rect.top) || py >= i64::from(m.rect.bottom) {
-                            scale(row, outside);
-                            continue;
-                        }
-                        let (left, rest) = row.split_at_mut(lo);
-                        let (mid, right) = rest.split_at_mut(hi - lo);
-                        scale(left, outside);
-                        scale(right, outside);
-                        // The mask row under `mid`: its first column is output column `lo`.
-                        let base = (py - i64::from(m.rect.top)) as usize * mw + (i64::from(out_rect.left) + lo as i64 - i64::from(m.rect.left)) as usize;
-                        for (i, p) in mid.iter_mut().enumerate() {
-                            let v = mk.get(base + i).copied().unwrap_or(def);
-                            p[3] *= if m.inverted { 1.0 - v } else { v };
-                        }
-                    }
-                }
-            }
-        }
-        Ok(Pixels { width: ow as u32, height: oh as u32, data: out })
-    }
-}
-
-/// The pixel data of a run of planes, as prepared by `Psd::open_planes`.
-enum PlaneStream {
-    Raw,
-    /// RLE row byte counts of every plane, plane after plane.
-    Rle(Vec<usize>),
-    /// The inflated ZIP data of all planes.
-    Zip(Vec<u8>),
-}
-
-/// The next additional-information block at `*pos` (signature `8BIM`/`8B64`, key, length):
-/// returns (key, data start, data end). Skips up to 3 padding bytes before a signature.
-fn next_block(data: &[u8], pos: &mut usize, end: usize, psb: bool) -> Option<([u8; 4], usize, usize)> {
-    let mut p = *pos;
-    for _ in 0..4 {
-        if p + 12 > end {
-            return None;
-        }
-        if &data[p..p + 4] == b"8BIM" || &data[p..p + 4] == b"8B64" {
-            break;
-        }
-        p += 1;
-    }
-    if p + 12 > end || !(&data[p..p + 4] == b"8BIM" || &data[p..p + 4] == b"8B64") {
-        return None;
-    }
-    let mut key = [0u8; 4];
-    key.copy_from_slice(&data[p + 4..p + 8]);
-    let wide =
-        psb && matches!(&key, b"LMsk" | b"Lr16" | b"Lr32" | b"Layr" | b"Mt16" | b"Mt32" | b"Mtrn" | b"Alph" | b"FMsk" | b"lnk2" | b"FEid" | b"FXid" | b"PxSD");
-    let mut r = Reader::at(&data[..end], p + 8);
-    let len = r.length(wide).ok()?;
-    let start = r.pos;
-    let stop = start.checked_add(len)?;
-    if stop > end {
-        return None;
-    }
-    *pos = stop;
-    Some((key, start, stop))
-}
-
-/// PackBits decoding of one row (appends exactly `row` bytes, zero-padded).
-fn unpack_bits(src: &[u8], row: usize, out: &mut Vec<u8>) -> Result<()> {
-    let start = out.len();
-    let mut i = 0;
-    while i < src.len() && out.len() - start < row {
-        let n = src[i] as i8;
-        i += 1;
-        if n >= 0 {
-            let k = n as usize + 1;
-            let s = src.get(i..i + k).ok_or(Error::Truncated)?;
-            out.extend_from_slice(s);
-            i += k;
-        } else if n != -128 {
-            let k = (1 - n as isize) as usize;
-            let v = *src.get(i).ok_or(Error::Truncated)?;
-            out.extend(std::iter::repeat_n(v, k));
-            i += 1;
-        }
-    }
-    out.resize(start + row, 0);
-    Ok(())
-}
-
-/// PackBits encoding of one row.
-pub(crate) fn pack_bits(src: &[u8]) -> Vec<u8> {
-    let mut out = vec![];
-    let mut i = 0;
-    while i < src.len() {
-        // run of identical bytes
-        let mut run = 1;
-        while i + run < src.len() && src[i + run] == src[i] && run < 128 {
-            run += 1;
-        }
-        if run >= 2 {
-            out.push((1 - run as isize) as i8 as u8);
-            out.push(src[i]);
-            i += run;
-            continue;
-        }
-        // literal run
-        let start = i;
-        let mut n = 0;
-        while i < src.len() && n < 128 {
-            if i + 1 < src.len() && src[i + 1] == src[i] {
-                break;
-            }
-            i += 1;
-            n += 1;
-        }
-        if n == 0 {
-            i += 1;
-            n = 1;
-        }
-        out.push((n - 1) as u8);
-        out.extend_from_slice(&src[start..start + n]);
-    }
-    out
-}
-
-fn srgb_encode(v: f32) -> f32 {
-    if v <= 0.003_130_8 { v * 12.92 } else { 1.055 * v.powf(1.0 / 2.4) - 0.055 }
-}
-
-/// CIE L*a*b* (D50) to sRGB (D65 via the Bradford-adapted matrix), clamped.
-fn lab_to_rgb(l: f32, a: f32, b: f32) -> [f32; 3] {
-    let fy = (l + 16.0) / 116.0;
-    let fx = fy + a / 500.0;
-    let fz = fy - b / 200.0;
-    let f = |t: f32| if t > 6.0 / 29.0 { t * t * t } else { 3.0 * (6.0f32 / 29.0).powi(2) * (t - 4.0 / 29.0) };
-    let (x, y, z) = (0.964_22 * f(fx), f(fy), 0.825_21 * f(fz));
-    // XYZ (D50) → linear sRGB.
-    let r = 3.133_856 * x - 1.616_867 * y - 0.490_615 * z;
-    let g = -0.978_768 * x + 1.916_142 * y + 0.033_454 * z;
-    let bb = 0.071_945 * x - 0.228_991 * y + 1.405_243 * z;
-    [r, g, bb].map(|v| srgb_encode(v.clamp(0.0, 1.0)))
-}
-
 #[cfg(test)]
 mod memory_tests;
 #[cfg(test)]
 mod tests;
-#[cfg(test)]
-mod tests_integration;
-#[cfg(test)]
-mod tests_opt;
 
 /// Test-only call counters (per thread), to prove what the optimised paths avoid doing.
 #[cfg(test)]
-pub(crate) mod counters {
-    use std::cell::Cell;
-    use std::thread::LocalKey;
-
-    thread_local! {
-        /// Scratch rows allocated by the 32-bit ZIP un-predictor.
-        pub static SCRATCH: Cell<usize> = const { Cell::new(0) };
-        /// `inside the mask rect` evaluations of the layer-mask loop.
-        pub static INSIDE: Cell<usize> = const { Cell::new(0) };
-        /// `square_to_quad` solves.
-        pub static QUAD: Cell<usize> = const { Cell::new(0) };
-    }
-
-    pub fn bump(c: &'static LocalKey<Cell<usize>>) {
-        c.with(|c| c.set(c.get() + 1));
-    }
-    /// Read and reset.
-    pub fn take(c: &'static LocalKey<Cell<usize>>) -> usize {
-        c.with(|c| c.replace(0))
-    }
-}
+pub(crate) mod counters;
diff --git a/crates/psd/src/limits.rs b/crates/psd/src/limits.rs
new file mode 100644
index 000000000..c1c23b390
--- /dev/null
+++ b/crates/psd/src/limits.rs
@@ -0,0 +1,133 @@
+use std::borrow::Cow;
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Error {
+    NotPsd,
+    Truncated,
+    Unsupported(String),
+    Invalid(String),
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::NotPsd => write!(f, "not a Photoshop document"),
+            Error::Truncated => write!(f, "truncated Photoshop document"),
+            Error::Unsupported(s) => write!(f, "unsupported Photoshop feature: {s}"),
+            Error::Invalid(s) => write!(f, "invalid Photoshop document: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+/// The most pixels one decoded image (the composite, a layer or a mask) may have: 2^28, e.g.
+/// 16 384 × 16 384, 4 GiB as float RGBA. Bounds read from a file are untrusted, so a few bytes
+/// can't make the reader allocate more than that.
+const MAX_DECODE_PIXELS: u64 = 1 << 28;
+
+/// `w × h` as a pixel count, or an error when it exceeds [`MAX_DECODE_PIXELS`].
+pub(crate) fn decode_pixels(w: usize, h: usize) -> Result<usize> {
+    match (w as u64).checked_mul(h as u64) {
+        Some(n) if n <= MAX_DECODE_PIXELS => Ok(n as usize),
+        _ => Err(Error::Unsupported(format!("{w}×{h} pixels is too large to decode"))),
+    }
+}
+
+pub(crate) fn too_large(w: usize, h: usize) -> Error {
+    Error::Unsupported(format!("{w}×{h} pixels is too large to decode"))
+}
+
+/// What one decode (the composite, or one layer) may hold in memory at once: 4 GiB, 1 GiB where
+/// pointers are 32 bits wide (WebAssembly). [`MAX_DECODE_PIXELS`] bounds one image; this bounds
+/// the sum of the buffers a decode keeps alive together.
+#[cfg(target_pointer_width = "32")]
+pub(crate) const DECODE_BUDGET: u64 = 1 << 30;
+
+#[cfg(not(target_pointer_width = "32"))]
+pub(crate) const DECODE_BUDGET: u64 = 4 << 30;
+
+/// The bytes the buffers of one decode hold right now, against a limit. A decode charges a buffer
+/// before it allocates it (and releases it when it drops it), so a file that would need more
+/// than the limit fails with an error instead of an out-of-memory abort.
+pub(crate) struct Budget {
+    limit: u64,
+    live: u64,
+}
+
+impl Budget {
+    pub(crate) fn new(limit: u64) -> Budget {
+        Budget { limit, live: 0 }
+    }
+
+    pub(crate) fn charge(&mut self, bytes: u64) -> Result<()> {
+        self.check(bytes)?;
+        self.live += bytes;
+        Ok(())
+    }
+
+    /// Whether `bytes` more would still fit, without taking them. A decode checks its whole
+    /// expected peak first, so one that cannot fit fails before it has allocated anything.
+    pub(crate) fn check(&self, bytes: u64) -> Result<()> {
+        match self.live.checked_add(bytes) {
+            Some(total) if total <= self.limit => Ok(()),
+            _ => {
+                const MIB: u64 = 1 << 20;
+                Err(Error::Unsupported(format!(
+                    "decoding needs {} MiB more with {} MiB in use, over the {} MiB memory budget",
+                    bytes / MIB,
+                    self.live / MIB,
+                    self.limit / MIB
+                )))
+            }
+        }
+    }
+
+    pub(crate) fn release(&mut self, bytes: u64) {
+        self.live = self.live.saturating_sub(bytes);
+    }
+
+    /// An empty vector with room for `n` items, charged.
+    pub(crate) fn vec<T>(&mut self, n: usize) -> Result<Vec<T>> {
+        self.charge((n as u64).saturating_mul(std::mem::size_of::<T>() as u64))?;
+        let mut v = Vec::new();
+        v.try_reserve_exact(n).map_err(|_| Error::Unsupported(format!("out of memory for {n} items")))?;
+        Ok(v)
+    }
+
+    /// `n` copies of `value`, charged.
+    pub(crate) fn filled<T: Clone>(&mut self, n: usize, value: T) -> Result<Vec<T>> {
+        let mut v = self.vec::<T>(n)?;
+        v.resize(n, value);
+        Ok(v)
+    }
+}
+
+/// Inflate a zlib stream to at most `limit` bytes.
+pub(crate) fn inflate(src: &[u8], limit: usize) -> Result<Vec<u8>> {
+    miniz_oxide::inflate::decompress_to_vec_zlib_with_limit(src, limit).map_err(|e| Error::Invalid(format!("zip: {e:?}")))
+}
+
+/// Give back what a channel buffer from `Psd::channel_bytes` / `Psd::decode_plane` was charged:
+/// a borrowed one (uncompressed data, or a plane of an inflated stream charged as a whole) was not.
+pub(crate) fn release_bytes(budget: &mut Budget, raw: Cow<'_, [u8]>) {
+    if let Cow::Owned(v) = raw {
+        budget.release(v.len() as u64);
+    }
+}
+
+/// A 32-bit float sample made safe to use: NaN reads as 0, +inf as white (1.0, like the integer
+/// depths' maximum), -inf as 0.
+pub(crate) fn finite_sample(v: f32) -> f32 {
+    if v.is_nan() {
+        0.0
+    } else if v == f32::INFINITY {
+        1.0
+    } else if v == f32::NEG_INFINITY {
+        0.0
+    } else {
+        v
+    }
+}
diff --git a/crates/psd/src/model.rs b/crates/psd/src/model.rs
new file mode 100644
index 000000000..729b9a3c4
--- /dev/null
+++ b/crates/psd/src/model.rs
@@ -0,0 +1,265 @@
+use super::{Descriptor, engine_data, placed};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ColorMode {
+    Bitmap,
+    Grayscale,
+    Indexed,
+    Rgb,
+    Cmyk,
+    Multichannel,
+    Duotone,
+    Lab,
+}
+
+impl ColorMode {
+    pub fn from_u16(v: u16) -> Option<ColorMode> {
+        Some(match v {
+            0 => ColorMode::Bitmap,
+            1 => ColorMode::Grayscale,
+            2 => ColorMode::Indexed,
+            3 => ColorMode::Rgb,
+            4 => ColorMode::Cmyk,
+            7 => ColorMode::Multichannel,
+            8 => ColorMode::Duotone,
+            9 => ColorMode::Lab,
+            _ => return None,
+        })
+    }
+    pub fn to_u16(self) -> u16 {
+        match self {
+            ColorMode::Bitmap => 0,
+            ColorMode::Grayscale => 1,
+            ColorMode::Indexed => 2,
+            ColorMode::Rgb => 3,
+            ColorMode::Cmyk => 4,
+            ColorMode::Multichannel => 7,
+            ColorMode::Duotone => 8,
+            ColorMode::Lab => 9,
+        }
+    }
+    /// Number of colour channels (before alpha).
+    pub fn color_channels(self) -> usize {
+        match self {
+            ColorMode::Rgb | ColorMode::Lab => 3,
+            ColorMode::Cmyk => 4,
+            _ => 1,
+        }
+    }
+}
+
+/// A rectangle in document pixels (`right`/`bottom` exclusive).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Rect {
+    pub top: i32,
+    pub left: i32,
+    pub bottom: i32,
+    pub right: i32,
+}
+
+impl Rect {
+    pub fn new(left: i32, top: i32, width: i32, height: i32) -> Rect {
+        Rect { top, left, bottom: top.saturating_add(height), right: left.saturating_add(width) }
+    }
+    pub fn width(&self) -> u32 {
+        (i64::from(self.right) - i64::from(self.left)).clamp(0, i64::from(u32::MAX)) as u32
+    }
+    pub fn height(&self) -> u32 {
+        (i64::from(self.bottom) - i64::from(self.top)).clamp(0, i64::from(u32::MAX)) as u32
+    }
+    pub fn is_empty(&self) -> bool {
+        self.width() == 0 || self.height() == 0
+    }
+}
+
+/// One channel of a layer: id (0.. colour, -1 transparency, -2 layer mask, -3 real user mask) and
+/// where its data (compression + image data) sits in the file.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ChannelInfo {
+    pub id: i16,
+    pub offset: usize,
+    pub len: usize,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct LayerMask {
+    pub rect: Rect,
+    /// Value outside the mask rectangle (0 or 255).
+    pub default_color: u8,
+    pub disabled: bool,
+    pub inverted: bool,
+}
+
+/// Layer kind from the section divider setting (`lsct`).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Section {
+    #[default]
+    Layer,
+    OpenFolder,
+    ClosedFolder,
+    /// The hidden "</Layer group>" record that closes a group (below its children).
+    Divider,
+}
+
+/// A type layer (`TySh`).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct TextInfo {
+    /// Text with `\n` line breaks.
+    pub text: String,
+    /// Affine transform (xx, xy, yx, yy, tx, ty): the text origin sits at (tx, ty).
+    pub transform: [f64; 6],
+    pub style: engine_data::TextStyle,
+    /// Text bounds (left, top, right, bottom) relative to the origin, when stored.
+    pub bounds: Option<[f64; 4]>,
+}
+
+/// Adjustment layers (best effort).
+#[derive(Clone, Debug, PartialEq)]
+pub enum Adjustment {
+    Invert,
+    BrightnessContrast {
+        brightness: f64,
+        contrast: f64,
+        legacy: bool,
+    },
+    HueSaturation {
+        hue: f64,
+        saturation: f64,
+        lightness: f64,
+        colorize: bool,
+    },
+    Levels {
+        in_black: f64,
+        in_white: f64,
+        gamma: f64,
+        out_black: f64,
+        out_white: f64,
+    },
+    Exposure {
+        exposure: f64,
+        offset: f64,
+        gamma: f64,
+    },
+    /// Another adjustment (its tagged-block key, e.g. `curv`, `blnc`).
+    Other(String),
+}
+
+/// A vector mask path: sub-paths of (in tangent, vertex, out tangent) points in document pixels.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct VectorMask {
+    pub inverted: bool,
+    pub disabled: bool,
+    pub subpaths: Vec<SubPath>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct SubPath {
+    pub closed: bool,
+    /// Per knot: [control point preceding, anchor, control point leaving] as (x, y).
+    pub knots: Vec<[[f64; 2]; 3]>,
+}
+
+/// A placed layer (smart object): `SoLd` / `SoLE` (placed layer data) or the older `PlLd`.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct SmartObject {
+    /// Unique id of the linked file ([`Psd::linked`]) the layer shows.
+    pub uuid: String,
+    /// Where the content's corners sit in document pixels: top-left, top-right, bottom-right,
+    /// bottom-left.
+    pub quad: [[f64; 2]; 4],
+    /// The content's size in pixels (`Sz  `), when recorded.
+    pub size: Option<[f64; 2]>,
+    /// The placed layer's warp (`warp`), when it has one ([`placed`]).
+    pub warp: Option<placed::Warp>,
+}
+
+impl SmartObject {
+    /// The quad as an affine placement of a `w`×`h` content rectangle: (centre, scale x, scale
+    /// y, rotation in degrees). Perspective and skew are dropped.
+    pub fn placement(&self, w: f64, h: f64) -> ([f64; 2], f64, f64, f64) {
+        let q = self.quad;
+        let centre = [(q[0][0] + q[1][0] + q[2][0] + q[3][0]) / 4.0, (q[0][1] + q[1][1] + q[2][1] + q[3][1]) / 4.0];
+        let top = [q[1][0] - q[0][0], q[1][1] - q[0][1]];
+        let left = [q[3][0] - q[0][0], q[3][1] - q[0][1]];
+        let sx = top[0].hypot(top[1]) / w.max(1e-9);
+        let sy = left[0].hypot(left[1]) / h.max(1e-9);
+        // Mirrored content (left edge turning the other way) keeps a negative y scale.
+        let cross = top[0] * left[1] - top[1] * left[0];
+        (centre, sx, if cross < 0.0 { -sy } else { sy }, top[1].atan2(top[0]).to_degrees())
+    }
+}
+
+/// A file embedded in (or linked from) the document: linked layer data (`lnk2`, `lnkD`,
+/// `lnk3`, `lnkE`).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct LinkedFile {
+    pub uuid: String,
+    pub name: String,
+    /// File type code (`8BPS`, `PNGf`, `JPEG`…), may be blank.
+    pub file_type: String,
+    /// Embedded data (absent for externally linked files).
+    pub data: Option<std::ops::Range<usize>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Layer {
+    /// Index in [`Psd::layers`] (file order: bottom of the stack first).
+    pub index: usize,
+    pub name: String,
+    pub id: Option<u32>,
+    pub rect: Rect,
+    /// Blend mode key (`norm`, `mul `, `pass`…).
+    pub blend: [u8; 4],
+    pub opacity: u8,
+    /// Fill opacity (`iOpa`), 255 when absent.
+    pub fill_opacity: u8,
+    /// Clipped to the layer below.
+    pub clipping: bool,
+    pub hidden: bool,
+    pub protect_transparency: bool,
+    pub section: Section,
+    pub channels: Vec<ChannelInfo>,
+    pub mask: Option<LayerMask>,
+    pub text: Option<TextInfo>,
+    pub adjustment: Option<Adjustment>,
+    /// Solid colour fill layer (`SoCo`), RGB 0..1.
+    pub fill: Option<[f64; 3]>,
+    /// Layer effects (`lfx2` descriptor).
+    pub effects: Option<Descriptor>,
+    pub vector_mask: Option<VectorMask>,
+    /// Smart object placement.
+    pub smart_object: Option<SmartObject>,
+    /// Keys of every additional-information block the layer carries.
+    pub keys: Vec<[u8; 4]>,
+}
+
+impl Layer {
+    pub fn is_group(&self) -> bool {
+        matches!(self.section, Section::OpenFolder | Section::ClosedFolder)
+    }
+    pub fn blend_key(&self) -> &str {
+        std::str::from_utf8(&self.blend).unwrap_or("norm")
+    }
+    pub fn has_pixels(&self) -> bool {
+        !self.rect.is_empty() && self.channels.iter().any(|c| c.id >= 0)
+    }
+}
+
+/// How deep groups nest in [`Psd::tree`]; deeper ones are flattened (a hostile file can nest
+/// thousands, and walking or dropping that tree would overflow the stack).
+pub const MAX_GROUP_DEPTH: usize = 64;
+
+/// The layer tree, top of the stack first.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Node {
+    Layer(usize),
+    Group { layer: usize, children: Vec<Node> },
+}
+
+/// Decoded pixels: straight RGBA, row-major.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Pixels {
+    pub width: u32,
+    pub height: u32,
+    pub data: Vec<[f32; 4]>,
+}
diff --git a/crates/psd/src/parse.rs b/crates/psd/src/parse.rs
new file mode 100644
index 000000000..d221b9044
--- /dev/null
+++ b/crates/psd/src/parse.rs
@@ -0,0 +1,514 @@
+use super::limits::{Error, Result};
+use super::model::{
+    Adjustment, ChannelInfo, ColorMode, Layer, LayerMask, LinkedFile, MAX_GROUP_DEPTH, Node, Rect, Section, SmartObject, SubPath, TextInfo, VectorMask,
+};
+use super::{Psd, Reader, descriptor, engine_data, placed};
+use std::sync::Arc;
+
+/// Whether `bytes` start like a Photoshop document.
+pub fn is_psd(bytes: &[u8]) -> bool {
+    bytes.len() >= 6 && &bytes[..4] == b"8BPS" && matches!(u16::from_be_bytes([bytes[4], bytes[5]]), 1 | 2)
+}
+
+impl Psd {
+    pub fn parse(data: impl Into<Arc<[u8]>>) -> Result<Psd> {
+        let data: Arc<[u8]> = data.into();
+        let mut r = Reader::new(&data);
+        if r.bytes(4).ok() != Some(b"8BPS") {
+            return Err(Error::NotPsd);
+        }
+        let version = r.u16()?;
+        let psb = match version {
+            1 => false,
+            2 => true,
+            _ => return Err(Error::NotPsd),
+        };
+        r.skip(6)?;
+        let channels = r.u16()?;
+        let height = r.u32()?;
+        let width = r.u32()?;
+        let depth = r.u16()?;
+        let mode_v = r.u16()?;
+        let mode = ColorMode::from_u16(mode_v).ok_or_else(|| Error::Unsupported(format!("colour mode {mode_v}")))?;
+        if !matches!(depth, 1 | 8 | 16 | 32) {
+            return Err(Error::Unsupported(format!("{depth}-bit")));
+        }
+        if width == 0 || height == 0 || width > 300_000 || height > 300_000 {
+            return Err(Error::Invalid(format!("size {width}x{height}")));
+        }
+        // Colour mode data.
+        let n = r.u32()? as usize;
+        let palette = r.bytes(n)?.to_vec();
+        // Image resources.
+        let n = r.u32()? as usize;
+        r.skip(n)?;
+        // Layer and mask information.
+        let mut psd = Psd {
+            psb,
+            width,
+            height,
+            channels,
+            depth,
+            mode,
+            layers: vec![],
+            merged_alpha: false,
+            palette,
+            linked: vec![],
+            warnings: vec![],
+            data: data.clone(),
+            merged_offset: 0,
+        };
+        let lm_len = r.length(psb)?;
+        let lm_end = r.pos.checked_add(lm_len).filter(|&e| e <= data.len()).ok_or(Error::Truncated)?;
+        if lm_len > 0 {
+            let li_len = r.length(psb)?;
+            let li_end = r.pos.checked_add(li_len).filter(|&e| e <= lm_end).ok_or(Error::Truncated)?;
+            if li_len > 0
+                && let Err(e) = psd.layer_info(&data, r.pos, li_end)
+            {
+                // A damaged layer section must not discard the document: keep the header and the
+                // merged image, drop the layers and say so. Without a merged image there is
+                // nothing to fall back to, so the original error stands.
+                if lm_end.checked_add(2).is_none_or(|n| n > data.len()) {
+                    return Err(e);
+                }
+                psd.layers.clear();
+                psd.warnings.push(format!("Layers could not be read ({e}); only the flattened image is available"));
+            }
+            r.pos = li_end;
+            if r.pos + 4 <= lm_end {
+                let g = r.u32()? as usize;
+                r.pos = (r.pos + g).min(lm_end);
+            }
+            // Global additional layer information (16/32-bit layer info lives here).
+            while let Some((key, start, end)) = next_block(&data, &mut r.pos, lm_end, psb) {
+                if matches!(&key, b"lnk2" | b"lnkD" | b"lnk3" | b"lnkE") {
+                    psd.linked_files(&data, start, end);
+                }
+                if matches!(&key, b"Lr16" | b"Lr32" | b"Layr") && psd.layers.is_empty() && end > start {
+                    // The block holds the layer info, normally without its length field; accept
+                    // both layouts.
+                    if psd.layer_info(&data, start, end).is_err() || psd.layers.is_empty() {
+                        psd.layers.clear();
+                        let skip = if psb { 8 } else { 4 };
+                        if start + skip < end && psd.layer_info(&data, start + skip, end).is_err() {
+                            psd.layers.clear();
+                        }
+                    }
+                }
+                r.pos = end;
+            }
+        }
+        if !psd.layers.is_empty() {
+            // A 16/32-bit layer block recovered the layers.
+            psd.warnings.clear();
+        }
+        psd.merged_offset = lm_end;
+        Ok(psd)
+    }
+
+    /// The embedded bytes of linked file `uuid`.
+    pub fn linked_data(&self, uuid: &str) -> Option<&[u8]> {
+        let f = self.linked.iter().find(|f| f.uuid == uuid)?;
+        self.data.get(f.data.clone()?)
+    }
+
+    /// Linked layer data records (spec: "Linked Layer"): length, kind (`liFD` embedded data,
+    /// `liFE` external file, `liFA` alias), version, unique id, original file name, type,
+    /// creator, data length, optional descriptors, then the data. A damaged record ends the list.
+    fn linked_files(&mut self, data: &[u8], start: usize, end: usize) {
+        let mut pos = start;
+        while pos + 8 <= end {
+            let mut r = Reader::at(&data[..end], pos);
+            let Ok(len) = r.u64() else { break };
+            let body = r.pos;
+            let Some(rec_end) = body.checked_add(len as usize).filter(|e| *e <= end) else { break };
+            let mut r = Reader::at(&data[..rec_end], body);
+            let rec = (|| -> Result<LinkedFile> {
+                let kind = r.tag()?;
+                let version = r.u32()?;
+                let n = r.u8()? as usize;
+                let uuid = String::from_utf8_lossy(r.bytes(n)?).into_owned();
+                let name = descriptor::read_unicode(&mut r)?;
+                let file_type = String::from_utf8_lossy(&r.tag()?).trim().to_string();
+                let _creator = r.tag()?;
+                let dlen = r.u64()? as usize;
+                if r.u8()? != 0 {
+                    let _v = r.u32()?;
+                    descriptor::read_descriptor(&mut r)?;
+                }
+                let mut out = LinkedFile { uuid, name, file_type, data: None };
+                match &kind {
+                    b"liFD" => {
+                        let s = r.pos;
+                        r.skip(dlen)?;
+                        out.data = Some(s..s + dlen);
+                    }
+                    b"liFE" => {
+                        let _v = r.u32()?;
+                        descriptor::read_descriptor(&mut r)?;
+                        if version > 3 {
+                            r.skip(4 + 4 + 8)?;
+                        }
+                        let _size = r.u64()?;
+                        if version > 2 && r.remaining() >= dlen && dlen > 0 {
+                            let s = r.pos;
+                            out.data = Some(s..s + dlen);
+                        }
+                    }
+                    _ => {}
+                }
+                Ok(out)
+            })();
+            match rec {
+                Ok(f) => self.linked.push(f),
+                Err(_) => break,
+            }
+            pos = rec_end.div_ceil(4) * 4;
+        }
+    }
+
+    fn layer_info(&mut self, data: &[u8], start: usize, end: usize) -> Result<()> {
+        let mut r = Reader::at(&data[..end], start);
+        let count = r.i16()?;
+        self.merged_alpha = count < 0;
+        let n = count.unsigned_abs() as usize;
+        let mut layers = Vec::with_capacity(n);
+        for i in 0..n {
+            layers.push(self.layer_record(&mut r, i)?);
+        }
+        // Channel image data follows in record order.
+        for l in &mut layers {
+            for c in &mut l.channels {
+                c.offset = r.pos;
+                r.skip(c.len)?;
+            }
+        }
+        self.layers = layers;
+        Ok(())
+    }
+
+    fn layer_record(&self, r: &mut Reader, index: usize) -> Result<Layer> {
+        let psb = self.psb;
+        let (top, left, bottom, right) = (r.i32()?, r.i32()?, r.i32()?, r.i32()?);
+        let nch = r.u16()? as usize;
+        if nch > 64 {
+            return Err(Error::Invalid("channel count".into()));
+        }
+        let mut channels = Vec::with_capacity(nch);
+        for _ in 0..nch {
+            let id = r.i16()?;
+            let len = r.length(psb)?;
+            channels.push(ChannelInfo { id, offset: 0, len });
+        }
+        if r.bytes(4)? != b"8BIM" {
+            return Err(Error::Invalid("layer record signature".into()));
+        }
+        let blend = r.tag()?;
+        let opacity = r.u8()?;
+        let clipping = r.u8()? != 0;
+        let flags = r.u8()?;
+        r.skip(1)?;
+        let extra = r.u32()? as usize;
+        let extra_end = r.pos.checked_add(extra).filter(|&e| e <= r.data.len()).ok_or(Error::Truncated)?;
+        let mut l = Layer {
+            index,
+            rect: Rect { top, left, bottom, right },
+            blend,
+            opacity,
+            fill_opacity: 255,
+            clipping,
+            hidden: flags & 2 != 0,
+            protect_transparency: flags & 1 != 0,
+            channels,
+            ..Default::default()
+        };
+        // Layer mask data.
+        let mlen = r.u32()? as usize;
+        let mstart = r.pos;
+        if mlen >= 18 {
+            let rect = Rect { top: r.i32()?, left: r.i32()?, bottom: r.i32()?, right: r.i32()? };
+            let default_color = r.u8()?;
+            let mflags = r.u8()?;
+            l.mask = Some(LayerMask { rect, default_color, disabled: mflags & 2 != 0, inverted: mflags & 4 != 0 });
+        }
+        r.pos = mstart + mlen;
+        // Blending ranges.
+        let blen = r.u32()? as usize;
+        r.skip(blen)?;
+        l.name = r.pascal(4)?;
+        let mut pos = r.pos;
+        let data = r.data;
+        while let Some((key, start, end)) = next_block(data, &mut pos, extra_end, psb) {
+            l.keys.push(key);
+            let block = &data[start..end];
+            // A malformed block only loses that block's information.
+            let _ = self.layer_block(&mut l, &key, block);
+            pos = end;
+        }
+        r.pos = extra_end;
+        Ok(l)
+    }
+
+    fn layer_block(&self, l: &mut Layer, key: &[u8; 4], b: &[u8]) -> Result<()> {
+        let mut r = Reader::new(b);
+        match key {
+            b"luni" => {
+                let name = descriptor::read_unicode(&mut r)?;
+                if !name.is_empty() {
+                    l.name = name;
+                }
+            }
+            b"lyid" => l.id = Some(r.u32()?),
+            b"iOpa" => l.fill_opacity = r.u8()?,
+            b"lsct" | b"lsdk" => {
+                l.section = match r.u32()? {
+                    1 => Section::OpenFolder,
+                    2 => Section::ClosedFolder,
+                    3 => Section::Divider,
+                    _ => Section::Layer,
+                };
+                if b.len() >= 12 && &b[4..8] == b"8BIM" {
+                    l.blend.copy_from_slice(&b[8..12]);
+                }
+            }
+            b"TySh" => {
+                let _ver = r.u16()?;
+                let mut t = [0.0; 6];
+                for v in &mut t {
+                    *v = r.f64()?;
+                }
+                // A transform with NaN/inf is unusable: fall back to the identity.
+                if t.iter().any(|v| !v.is_finite()) {
+                    t = [1.0, 0.0, 0.0, 1.0, 0.0, 0.0];
+                }
+                let _text_ver = r.u16()?;
+                let _desc_ver = r.u32()?;
+                let d = descriptor::read_descriptor(&mut r)?;
+                let text = d.text("Txt ").unwrap_or_default().replace("\r\n", "\n").replace('\r', "\n");
+                let text = text.strip_suffix('\n').map(str::to_string).unwrap_or(text);
+                let style = d.raw("EngineData").map(|e| engine_data::text_style(&engine_data::parse(e))).unwrap_or_default();
+                let bounds =
+                    d.obj("bounds").or_else(|| d.obj("boundingBox")).and_then(|o| Some([o.num("Left")?, o.num("Top ")?, o.num("Rght")?, o.num("Btom")?]));
+                l.text = Some(TextInfo { text, transform: t, style, bounds });
+            }
+            b"lfx2" => {
+                let _ver = r.u32()?;
+                let _dver = r.u32()?;
+                l.effects = Some(descriptor::read_descriptor(&mut r)?);
+            }
+            b"SoCo" => {
+                let _ver = r.u32()?;
+                let d = descriptor::read_descriptor(&mut r)?;
+                l.fill = d.color("Clr ");
+            }
+            b"nvrt" => l.adjustment = Some(Adjustment::Invert),
+            b"brit" => {
+                let brightness = r.i16()? as f64;
+                let contrast = r.i16()? as f64;
+                if l.adjustment.is_none() {
+                    l.adjustment = Some(Adjustment::BrightnessContrast { brightness, contrast, legacy: true });
+                }
+            }
+            b"CgEd" => {
+                let _ver = r.u32()?;
+                let d = descriptor::read_descriptor(&mut r)?;
+                l.adjustment = Some(Adjustment::BrightnessContrast {
+                    brightness: d.num("Brgh").unwrap_or(0.0),
+                    contrast: d.num("Cntr").unwrap_or(0.0),
+                    legacy: d.bool("useLegacy").unwrap_or(false),
+                });
+            }
+            b"hue2" | b"hue " => {
+                let _ver = r.u16()?;
+                let colorize = r.u8()? != 0;
+                r.skip(1)?;
+                let ch = (r.i16()? as f64, r.i16()? as f64, r.i16()? as f64);
+                let m = (r.i16()? as f64, r.i16()? as f64, r.i16()? as f64);
+                let (hue, saturation, lightness) = if colorize { ch } else { m };
+                l.adjustment = Some(Adjustment::HueSaturation { hue, saturation, lightness, colorize });
+            }
+            b"levl" => {
+                let _ver = r.u16()?;
+                let (ib, iw, ob, ow, g) = (r.i16()?, r.i16()?, r.i16()?, r.i16()?, r.i16()?);
+                l.adjustment =
+                    Some(Adjustment::Levels { in_black: ib as f64, in_white: iw as f64, gamma: g as f64 / 100.0, out_black: ob as f64, out_white: ow as f64 });
+            }
+            b"expA" => {
+                let _ver = r.u16()?;
+                let mut finite = |default: f64| -> Result<f64> {
+                    let v = f64::from(r.f32()?);
+                    Ok(if v.is_finite() { v } else { default })
+                };
+                let exposure = finite(0.0)?;
+                let offset = finite(0.0)?;
+                let gamma = finite(1.0)?;
+                l.adjustment = Some(Adjustment::Exposure { exposure, offset, gamma });
+            }
+            b"curv" | b"blnc" | b"post" | b"thrs" | b"selc" | b"mixr" | b"phfl" | b"vibA" | b"blwh" | b"grdm" | b"clrL" if l.adjustment.is_none() => {
+                l.adjustment = Some(Adjustment::Other(String::from_utf8_lossy(key).into_owned()));
+            }
+            b"SoLd" | b"SoLE" => {
+                let _id = r.tag()?;
+                let _ver = r.u32()?;
+                let _dver = r.u32()?;
+                let d = descriptor::read_descriptor(&mut r)?;
+                let uuid = d.text("Idnt").unwrap_or_default().to_string();
+                let t = placed::eight(&d, "Trnf").unwrap_or([0.0; 8]);
+                // The non-affine transform when present (perspective), else the transform.
+                let t = placed::eight(&d, "nonAffineTransform").unwrap_or(t);
+                let size = d.obj("Sz  ").and_then(|s| Some([s.num("Wdth")?, s.num("Hght")?]));
+                let warp = d.obj("warp").and_then(placed::Warp::read);
+                l.smart_object = Some(SmartObject { uuid, quad: placed::quad_from(t), size, warp });
+            }
+            b"PlLd" if l.smart_object.is_none() => {
+                let _id = r.tag()?;
+                let _ver = r.u32()?;
+                let n = r.u8()? as usize;
+                let uuid = String::from_utf8_lossy(r.bytes(n)?).into_owned();
+                let _page = r.u32()?;
+                let _pages = r.u32()?;
+                let _aa = r.u32()?;
+                let _ty = r.u32()?;
+                let mut t = [0.0; 8];
+                for v in &mut t {
+                    *v = r.f64_finite()?;
+                }
+                l.smart_object = Some(SmartObject { uuid, quad: placed::quad_from(t), size: None, warp: None });
+            }
+            b"vmsk" | b"vsms" => {
+                let _ver = r.u32()?;
+                let flags = r.u32()?;
+                l.vector_mask = Some(self.vector_paths(&mut r, flags)?);
+            }
+            _ => {}
+        }
+        Ok(())
+    }
+
+    fn vector_paths(&self, r: &mut Reader, flags: u32) -> Result<VectorMask> {
+        let (w, h) = (self.width as f64, self.height as f64);
+        let mut vm = VectorMask { inverted: flags & 1 != 0, disabled: flags & 4 != 0, subpaths: vec![] };
+        let fixed = |r: &mut Reader| -> Result<f64> { Ok(r.i32()? as f64 / (1 << 24) as f64) };
+        while r.remaining() >= 26 {
+            let sel = r.u16()?;
+            match sel {
+                0 | 3 => {
+                    let _n = r.u16()?;
+                    r.skip(22)?;
+                    vm.subpaths.push(SubPath { closed: sel == 0, knots: vec![] });
+                }
+                1 | 2 | 4 | 5 => {
+                    let mut pts = [[0.0; 2]; 3];
+                    for p in &mut pts {
+                        let y = fixed(r)?;
+                        let x = fixed(r)?;
+                        *p = [x * w, y * h];
+                    }
+                    if let Some(sp) = vm.subpaths.last_mut() {
+                        sp.knots.push(pts);
+                    }
+                }
+                _ => r.skip(24)?,
+            }
+        }
+        vm.subpaths.retain(|s| !s.knots.is_empty());
+        Ok(vm)
+    }
+
+    /// The layer tree, top of the stack first. Groups nest at most [`MAX_GROUP_DEPTH`] deep (see
+    /// [`Psd::tree_report`]).
+    pub fn tree(&self) -> Vec<Node> {
+        self.tree_report().0
+    }
+
+    /// The layer tree plus the number of groups nested deeper than [`MAX_GROUP_DEPTH`]. Those
+    /// are flattened into their deepest allowed ancestor: their children stay, in order, and
+    /// the group record itself becomes a plain [`Node::Layer`], so no layer is lost and the
+    /// tree (and its `Drop`, `Clone` and `PartialEq`) cannot recurse deeper than the limit.
+    pub fn tree_report(&self) -> (Vec<Node>, usize) {
+        let mut stack: Vec<Vec<Node>> = vec![vec![]];
+        // Dividers seen while `MAX_GROUP_DEPTH` groups were already open.
+        let mut flattened_open = 0usize;
+        let mut flattened = 0usize;
+        for l in &self.layers {
+            match l.section {
+                Section::Divider => {
+                    if stack.len() > MAX_GROUP_DEPTH {
+                        flattened_open += 1;
+                    } else {
+                        stack.push(vec![]);
+                    }
+                }
+                Section::OpenFolder | Section::ClosedFolder => {
+                    if flattened_open > 0 {
+                        flattened_open -= 1;
+                        flattened += 1;
+                        if let Some(top) = stack.last_mut() {
+                            top.push(Node::Layer(l.index));
+                        }
+                        continue;
+                    }
+                    let children = if stack.len() > 1 { stack.pop().unwrap_or_default() } else { vec![] };
+                    if let Some(top) = stack.last_mut() {
+                        top.push(Node::Group { layer: l.index, children });
+                    }
+                }
+                Section::Layer => {
+                    if let Some(top) = stack.last_mut() {
+                        top.push(Node::Layer(l.index));
+                    }
+                }
+            }
+        }
+        while stack.len() > 1 {
+            let c = stack.pop().unwrap_or_default();
+            if let Some(top) = stack.last_mut() {
+                top.extend(c);
+            }
+        }
+        // Depth is at most `MAX_GROUP_DEPTH`, so recursion is bounded.
+        fn rev(v: &mut Vec<Node>) {
+            v.reverse();
+            for n in v {
+                if let Node::Group { children, .. } = n {
+                    rev(children);
+                }
+            }
+        }
+        let mut out = stack.pop().unwrap_or_default();
+        rev(&mut out);
+        (out, flattened)
+    }
+}
+
+/// The next additional-information block at `*pos` (signature `8BIM`/`8B64`, key, length):
+/// returns (key, data start, data end). Skips up to 3 padding bytes before a signature.
+fn next_block(data: &[u8], pos: &mut usize, end: usize, psb: bool) -> Option<([u8; 4], usize, usize)> {
+    let mut p = *pos;
+    for _ in 0..4 {
+        if p + 12 > end {
+            return None;
+        }
+        if &data[p..p + 4] == b"8BIM" || &data[p..p + 4] == b"8B64" {
+            break;
+        }
+        p += 1;
+    }
+    if p + 12 > end || !(&data[p..p + 4] == b"8BIM" || &data[p..p + 4] == b"8B64") {
+        return None;
+    }
+    let mut key = [0u8; 4];
+    key.copy_from_slice(&data[p + 4..p + 8]);
+    let wide =
+        psb && matches!(&key, b"LMsk" | b"Lr16" | b"Lr32" | b"Layr" | b"Mt16" | b"Mt32" | b"Mtrn" | b"Alph" | b"FMsk" | b"lnk2" | b"FEid" | b"FXid" | b"PxSD");
+    let mut r = Reader::at(&data[..end], p + 8);
+    let len = r.length(wide).ok()?;
+    let start = r.pos;
+    let stop = start.checked_add(len)?;
+    if stop > end {
+        return None;
+    }
+    *pos = stop;
+    Some((key, start, stop))
+}
diff --git a/crates/psd/src/pixels.rs b/crates/psd/src/pixels.rs
new file mode 100644
index 000000000..21a5c8845
--- /dev/null
+++ b/crates/psd/src/pixels.rs
@@ -0,0 +1,554 @@
+#[cfg(test)]
+use super::counters;
+use super::limits::{Budget, DECODE_BUDGET, Error, Result, decode_pixels, finite_sample, inflate, release_bytes, too_large};
+use super::model::{ColorMode, Layer, Pixels, Rect};
+use super::{Psd, Reader};
+use std::borrow::Cow;
+
+impl Psd {
+    fn bytes_per_sample(&self) -> usize {
+        match self.depth {
+            16 => 2,
+            32 => 4,
+            _ => 1,
+        }
+    }
+
+    /// The raw big-endian bytes of one channel of `w`×`h` samples at `offset` (compression field
+    /// first): `row_bytes(w) × h` of them with the compression and the prediction undone.
+    /// Uncompressed data is borrowed from the file, not copied; any other buffer is charged to
+    /// `budget` and the caller releases it (see [`release_bytes`]) once it is dropped.
+    fn channel_bytes(&self, offset: usize, len: usize, w: usize, h: usize, budget: &mut Budget) -> Result<Cow<'_, [u8]>> {
+        let end = offset.checked_add(len).filter(|&e| e <= self.data.len()).ok_or(Error::Truncated)?;
+        let mut r = Reader::at(self.data.get(..end).ok_or(Error::Truncated)?, offset);
+        let comp = r.u16()?;
+        decode_pixels(w, h)?;
+        self.plane_bytes(comp, &mut r, w, h, budget)
+    }
+
+    /// The raw bytes (`row_bytes(w)` × `h`, ZIP prediction undone) of one channel whose pixel data
+    /// follows `r`'s position (after the compression field). Uncompressed data is borrowed, not
+    /// copied; the other buffers are charged to `budget`.
+    pub(crate) fn plane_bytes<'a>(&self, comp: u16, r: &mut Reader<'a>, w: usize, h: usize, budget: &mut Budget) -> Result<Cow<'a, [u8]>> {
+        let rowb = self.row_bytes(w);
+        let size = rowb.checked_mul(h).ok_or_else(|| too_large(w, h))?;
+        Ok(match self.open_planes(comp, r, 1, 1, (w, h), budget)? {
+            PlaneStream::Raw => Cow::Borrowed(r.bytes(size)?),
+            PlaneStream::Rle(counts) => Cow::Owned(Self::unpack_plane(&counts, 0, r, rowb, h, budget)?),
+            PlaneStream::Zip(mut v) => {
+                v.resize(size, 0);
+                self.zip_plane(comp, &mut v, 0, w, h)?;
+                Cow::Owned(v)
+            }
+        })
+    }
+
+    /// Prepare the pixel data at `r` (just after the compression field) of `total` planes of
+    /// `w`×`h` samples, of which the first `want` are decoded: the RLE row sizes of every plane,
+    /// or the inflated ZIP data, which holds all planes one after another (charged to `budget`
+    /// before it is inflated).
+    fn open_planes(&self, comp: u16, r: &mut Reader, total: usize, want: usize, size: (usize, usize), budget: &mut Budget) -> Result<PlaneStream> {
+        let (w, h) = size;
+        let size = self.row_bytes(w).checked_mul(h).ok_or_else(|| too_large(w, h))?;
+        Ok(match comp {
+            0 => PlaneStream::Raw,
+            1 => {
+                let n = total.saturating_mul(h);
+                let mut counts = Vec::with_capacity(n.min(r.remaining() / 2));
+                for _ in 0..n {
+                    counts.push(if self.psb { r.u32()? as usize } else { r.u16()? as usize });
+                }
+                PlaneStream::Rle(counts)
+            }
+            2 | 3 => {
+                let rest = r.bytes(r.remaining())?;
+                // One stream holds every plane: what it may decode to is what they need.
+                let all = size.checked_mul(want).ok_or_else(|| too_large(w, h))?;
+                budget.charge(all as u64)?;
+                PlaneStream::Zip(inflate(rest, all)?)
+            }
+            c => return Err(Error::Unsupported(format!("compression {c}"))),
+        })
+    }
+
+    /// The raw bytes (`row_bytes(w)` × `h`, ZIP prediction undone) of plane `c`: raw and RLE
+    /// planes are read from `r` in order, raw ones borrowed from the file data, ZIP ones from the
+    /// inflated buffer (un-predicted in place; already charged by `open_planes`), RLE ones charged
+    /// to `budget`.
+    fn decode_plane<'x, 'a: 'x>(
+        &self,
+        comp: u16,
+        planes: &'x mut PlaneStream,
+        r: &mut Reader<'a>,
+        c: usize,
+        size: (usize, usize),
+        budget: &mut Budget,
+    ) -> Result<Cow<'x, [u8]>> {
+        let (w, h) = size;
+        let rowb = self.row_bytes(w);
+        let size = rowb.checked_mul(h).ok_or_else(|| too_large(w, h))?;
+        Ok(match planes {
+            PlaneStream::Raw => Cow::Borrowed(r.bytes(size)?),
+            PlaneStream::Rle(counts) => Cow::Owned(Self::unpack_plane(counts, c, r, rowb, h, budget)?),
+            PlaneStream::Zip(v) => Cow::Borrowed(self.zip_plane(comp, v, c, w, h)?),
+        })
+    }
+
+    /// Unpack the `h` RLE rows of plane `c` (row byte counts `counts`, plane after plane) into a
+    /// buffer charged to `budget`.
+    fn unpack_plane(counts: &[usize], c: usize, r: &mut Reader, rowb: usize, h: usize, budget: &mut Budget) -> Result<Vec<u8>> {
+        let mut out = budget.vec::<u8>(rowb.checked_mul(h).ok_or(Error::Truncated)?)?;
+        for row in 0..h {
+            let n = *counts.get(c * h + row).ok_or(Error::Truncated)?;
+            unpack_bits(r.bytes(n)?, rowb, &mut out)?;
+        }
+        Ok(out)
+    }
+
+    /// Plane `c` of the inflated ZIP data of consecutive planes, un-predicted in place (`comp` 3).
+    pub(crate) fn zip_plane<'v>(&self, comp: u16, v: &'v mut [u8], c: usize, w: usize, h: usize) -> Result<&'v [u8]> {
+        let rowb = self.row_bytes(w);
+        let plane = v.get_mut(c * rowb * h..(c + 1) * rowb * h).ok_or(Error::Truncated)?;
+        if comp == 3 {
+            self.unpredict(plane, w, h);
+        }
+        Ok(plane)
+    }
+
+    /// One channel as `w * h` floats (0..1), charged to `budget` (the caller releases it).
+    fn channel_floats(&self, offset: usize, len: usize, w: usize, h: usize, budget: &mut Budget) -> Result<Vec<f32>> {
+        let raw = self.channel_bytes(offset, len, w, h, budget)?;
+        let mut out = budget.filled(decode_pixels(w, h)?, 0.0f32)?;
+        self.for_each_sample(&raw, w, h, |i, v| {
+            if let Some(o) = out.get_mut(i) {
+                *o = v;
+            }
+        });
+        release_bytes(budget, raw);
+        Ok(out)
+    }
+
+    pub(crate) fn row_bytes(&self, w: usize) -> usize {
+        if self.depth == 1 { w.div_ceil(8) } else { w * self.bytes_per_sample() }
+    }
+
+    pub(crate) fn unpredict(&self, v: &mut [u8], w: usize, h: usize) {
+        match self.depth {
+            16 => {
+                for row in v.chunks_exact_mut(w * 2).take(h) {
+                    let mut prev = 0u16;
+                    for c in row.as_chunks_mut::<2>().0 {
+                        let x = u16::from_be_bytes([c[0], c[1]]).wrapping_add(prev);
+                        c.copy_from_slice(&x.to_be_bytes());
+                        prev = x;
+                    }
+                }
+            }
+            32 => {
+                // One scratch row for the whole plane.
+                let mut planar = vec![0u8; w * 4];
+                #[cfg(test)]
+                counters::bump(&counters::SCRATCH);
+                for row in v.chunks_exact_mut(w * 4).take(h) {
+                    for i in 1..row.len() {
+                        row[i] = row[i].wrapping_add(row[i - 1]);
+                    }
+                    // Bytes are stored plane by plane (all first bytes, then all second bytes…).
+                    planar.copy_from_slice(row);
+                    for x in 0..w {
+                        for b in 0..4 {
+                            row[x * 4 + b] = planar[b * w + x];
+                        }
+                    }
+                }
+            }
+            _ => {
+                for row in v.chunks_exact_mut(w).take(h) {
+                    for i in 1..row.len() {
+                        row[i] = row[i].wrapping_add(row[i - 1]);
+                    }
+                }
+            }
+        }
+    }
+
+    /// Hand every sample of `raw` (`w`×`h`, row-major, in order) to `f` as a float. Samples a short
+    /// `raw` does not have are not reported.
+    pub(crate) fn for_each_sample(&self, raw: &[u8], w: usize, h: usize, mut f: impl FnMut(usize, f32)) {
+        let n = w.saturating_mul(h);
+        match self.depth {
+            1 => {
+                let rowb = w.div_ceil(8);
+                for y in 0..h {
+                    for x in 0..w {
+                        let b = raw.get(y * rowb + x / 8).copied().unwrap_or(0);
+                        // 1 = black.
+                        f(y * w + x, if b & (0x80 >> (x % 8)) != 0 { 0.0 } else { 1.0 });
+                    }
+                }
+            }
+            16 => raw.as_chunks::<2>().0.iter().take(n).enumerate().for_each(|(i, c)| f(i, u16::from_be_bytes([c[0], c[1]]) as f32 / 65535.0)),
+            // NaN reads as 0, +inf as white (1.0, like the integer depths' maximum), -inf as 0.
+            32 => raw.as_chunks::<4>().0.iter().take(n).enumerate().for_each(|(i, c)| f(i, finite_sample(f32::from_be_bytes([c[0], c[1], c[2], c[3]])))),
+            _ => raw.iter().take(n).enumerate().for_each(|(i, &b)| f(i, b as f32 / 255.0)),
+        }
+    }
+
+    /// Convert colour values (the document mode's channels, missing ones 0) to RGB.
+    pub(crate) fn rgb_from(&self, v: [f32; 4]) -> [f32; 3] {
+        let g = |k: usize| v.get(k).copied().unwrap_or(0.0);
+        let rgb = match self.mode {
+            ColorMode::Rgb => [g(0), g(1), g(2)],
+            ColorMode::Cmyk => {
+                // Stored inverted (1 = no ink).
+                let k = g(3);
+                [g(0) * k, g(1) * k, g(2) * k]
+            }
+            ColorMode::Indexed if self.palette.len() >= 768 => {
+                let idx = (g(0) * 255.0).round() as usize & 255;
+                [self.palette[idx] as f32 / 255.0, self.palette[256 + idx] as f32 / 255.0, self.palette[512 + idx] as f32 / 255.0]
+            }
+            ColorMode::Lab => lab_to_rgb(g(0) * 100.0, g(1) * 255.0 - 128.0, g(2) * 255.0 - 128.0),
+            _ => [g(0); 3],
+        };
+        if self.depth == 32 && self.mode != ColorMode::Lab { rgb.map(srgb_encode) } else { rgb }
+    }
+
+    /// Write merged-image channel `c` (raw bytes) into the result: the first three colour channels
+    /// and the alpha channel into their slot of a pixel, the fourth CMYK channel into `black`.
+    fn store_merged_channel(&self, c: usize, raw: &[u8], data: &mut [[f32; 4]], black: &mut Option<Vec<f32>>) {
+        let (w, h, cc) = (self.width as usize, self.height as usize, self.mode.color_channels());
+        if c < cc.min(3) {
+            self.for_each_sample(raw, w, h, |i, v| {
+                if let Some(p) = data.get_mut(i) {
+                    p[c] = v;
+                }
+            });
+        } else if c == 3 && c < cc {
+            if let Some(k) = black {
+                self.for_each_sample(raw, w, h, |i, v| {
+                    if let Some(o) = k.get_mut(i) {
+                        *o = v;
+                    }
+                });
+            }
+        } else if c == cc && self.merged_alpha {
+            self.for_each_sample(raw, w, h, |i, v| {
+                if let Some(p) = data.get_mut(i) {
+                    p[3] = v;
+                }
+            });
+        }
+    }
+
+    /// The merged (flattened) image.
+    pub fn composite(&self) -> Result<Pixels> {
+        self.composite_with_budget(DECODE_BUDGET)
+    }
+
+    /// [`Self::composite`] with at most `limit` bytes live at once. The channels are written
+    /// straight into the result, so the peak is the result (16 bytes a pixel), the CMYK black
+    /// channel, and the one buffer a channel (or, for ZIP, all channels) decodes through.
+    pub(crate) fn composite_with_budget(&self, limit: u64) -> Result<Pixels> {
+        let mut budget = Budget::new(limit);
+        let (w, h) = (self.width as usize, self.height as usize);
+        let n = decode_pixels(w, h)?;
+        let mut r = Reader::at(&self.data, self.merged_offset);
+        let comp = r.u16()?;
+        let nch = self.channels as usize;
+        let cc = self.mode.color_channels();
+        let want = (cc + usize::from(self.merged_alpha)).min(nch);
+        let rowb = self.row_bytes(w);
+        let size = rowb.checked_mul(h).ok_or_else(|| too_large(w, h))?;
+        // The peak: the result, the CMYK black channel and what the channels decode through.
+        let black_bytes = if self.mode == ColorMode::Cmyk && want > 3 { 4 * n as u64 } else { 0 };
+        let transient = if matches!(comp, 2 | 3) { (size as u64).saturating_mul(want as u64) } else { size as u64 };
+        budget.check((16 * n as u64).saturating_add(black_bytes).saturating_add(transient))?;
+        // Opaque black until a channel says otherwise.
+        let mut data = budget.filled(n, [0.0f32, 0.0, 0.0, 1.0])?;
+        let mut black = if self.mode == ColorMode::Cmyk && want > 3 { Some(budget.filled(n, 0.0f32)?) } else { None };
+        let mut stream = self.open_planes(comp, &mut r, nch, want, (w, h), &mut budget)?;
+        for c in 0..want {
+            let raw = self.decode_plane(comp, &mut stream, &mut r, c, (w, h), &mut budget)?;
+            self.store_merged_channel(c, &raw, &mut data, &mut black);
+            release_bytes(&mut budget, raw);
+        }
+        for (i, p) in data.iter_mut().enumerate() {
+            let k = black.as_ref().and_then(|k| k.get(i)).copied().unwrap_or(0.0);
+            let [r, g, b] = self.rgb_from([p[0], p[1], p[2], k]);
+            *p = [r, g, b, p[3]];
+        }
+        Ok(Pixels { width: w as u32, height: h as u32, data })
+    }
+
+    /// One layer's pixels with its layer mask (and vector-less fill colour) applied to alpha.
+    /// `canvas`: document-sized with the layer in place; otherwise the layer's own bounds.
+    pub fn layer_pixels(&self, index: usize, canvas: bool) -> Result<Pixels> {
+        self.layer_pixels_with_budget(index, canvas, DECODE_BUDGET)
+    }
+
+    /// [`Self::layer_pixels`] with at most `limit` bytes live at once: the result (16 bytes a
+    /// pixel) with the channels written straight into it, the CMYK black channel, the one channel
+    /// being decoded, and the mask.
+    pub(crate) fn layer_pixels_with_budget(&self, index: usize, canvas: bool, limit: u64) -> Result<Pixels> {
+        let mut budget = Budget::new(limit);
+        let l = self.layers.get(index).ok_or_else(|| Error::Invalid(format!("no layer {index}")))?;
+        let doc = Rect { top: 0, left: 0, bottom: self.height as i32, right: self.width as i32 };
+        // Fill layers often have no pixel data: they cover the canvas (or the mask).
+        let fill_rect =
+            if l.fill.is_some() && !l.has_pixels() { l.mask.filter(|m| !m.rect.is_empty() && m.default_color == 0).map_or(doc, |m| m.rect) } else { l.rect };
+        let out_rect = if canvas {
+            doc
+        } else if fill_rect.is_empty() {
+            Rect { top: 0, left: 0, bottom: 1, right: 1 }
+        } else {
+            fill_rect
+        };
+        let (ow, oh) = (out_rect.width() as usize, out_rect.height() as usize);
+        let n = decode_pixels(ow, oh)?;
+        let src = fill_rect;
+        let (sw, sh) = (src.width() as usize, src.height() as usize);
+        // The peak: the result, then either the CMYK black channel with the channel being decoded,
+        // or the mask as floats with its bytes. Checked before anything is allocated.
+        let plane = |w: usize, h: usize| (self.row_bytes(w) as u64).saturating_mul(h as u64);
+        let mut pixels_peak = 0u64;
+        if l.has_pixels() && sw > 0 && sh > 0 {
+            pixels_peak = plane(sw, sh).saturating_add(if self.mode == ColorMode::Cmyk { 4 * n as u64 } else { 0 });
+        }
+        let mut mask_peak = 0u64;
+        if let Some(m) = l.mask.filter(|m| !m.disabled) {
+            let (mw, mh) = (m.rect.width() as usize, m.rect.height() as usize);
+            if mw > 0 && mh > 0 && l.channels.iter().any(|c| c.id == -2) {
+                mask_peak = plane(mw, mh).saturating_add((mw as u64).saturating_mul(mh as u64).saturating_mul(4));
+            }
+        }
+        budget.check((16 * n as u64).saturating_add(pixels_peak.max(mask_peak)))?;
+        let mut out = budget.filled(n, [0.0f32; 4])?;
+        if sw > 0 && sh > 0 {
+            // The source rows / columns that land inside the output (64-bit: file bounds can span
+            // the whole i32 range).
+            let span = |s0: i32, n: usize, o0: i32, on: usize| {
+                let off = i64::from(o0) - i64::from(s0);
+                let lo = off.clamp(0, n as i64);
+                let hi = (off + on as i64).clamp(lo, n as i64);
+                (lo as usize..hi as usize, off)
+            };
+            let (ys, oy) = span(src.top, sh, out_rect.top, oh);
+            let (xs, ox) = span(src.left, sw, out_rect.left, ow);
+            let dest = |y: usize, x: usize| (y as i64 - oy) as usize * ow + (x as i64 - ox) as usize;
+            let fill = l.fill.map(|c| c.map(|v| v as f32));
+            match fill {
+                Some(f) if !l.has_pixels() => {
+                    for y in ys {
+                        for x in xs.clone() {
+                            if let Some(p) = out.get_mut(dest(y, x)) {
+                                *p = [f[0], f[1], f[2], 1.0];
+                            }
+                        }
+                    }
+                }
+                _ => {
+                    // Opaque unless there is an alpha channel.
+                    for y in ys.clone() {
+                        for x in xs.clone() {
+                            if let Some(p) = out.get_mut(dest(y, x)) {
+                                p[3] = 1.0;
+                            }
+                        }
+                    }
+                    let cc = self.mode.color_channels();
+                    let mut black: Option<Vec<f32>> = None;
+                    if l.has_pixels() {
+                        for c in &l.channels {
+                            let slot = match c.id {
+                                -1 => 3,
+                                id if id >= 0 && (id as usize) < cc => id as usize,
+                                _ => continue,
+                            };
+                            let raw = self.channel_bytes(c.offset, c.len, sw, sh, &mut budget)?;
+                            // The fourth CMYK channel is the black plate, not a slot of the result.
+                            let to_black = c.id == 3;
+                            if to_black && black.is_none() {
+                                black = Some(budget.filled(out.len(), 0.0f32)?);
+                            }
+                            // Samples arrive in row-major order of the source.
+                            let (mut sy, mut sx) = (0usize, 0usize);
+                            self.for_each_sample(&raw, sw, sh, |_, v| {
+                                if ys.contains(&sy) && xs.contains(&sx) {
+                                    let d = dest(sy, sx);
+                                    if to_black {
+                                        if let Some(o) = black.as_mut().and_then(|k| k.get_mut(d)) {
+                                            *o = v;
+                                        }
+                                    } else if let Some(p) = out.get_mut(d) {
+                                        p[slot] = v;
+                                    }
+                                }
+                                sx += 1;
+                                if sx == sw {
+                                    sx = 0;
+                                    sy += 1;
+                                }
+                            });
+                            release_bytes(&mut budget, raw);
+                        }
+                    }
+                    for y in ys {
+                        for x in xs.clone() {
+                            let d = dest(y, x);
+                            let k = black.as_ref().and_then(|k| k.get(d)).copied().unwrap_or(0.0);
+                            if let Some(p) = out.get_mut(d) {
+                                let [r, g, b] = self.rgb_from([p[0], p[1], p[2], k]);
+                                *p = [r, g, b, p[3]];
+                            }
+                        }
+                    }
+                    if let Some(k) = black {
+                        budget.release(k.len() as u64 * 4);
+                    }
+                }
+            }
+        }
+        self.apply_layer_mask(l, out_rect, &mut out, &mut budget)?;
+        Ok(Pixels { width: ow as u32, height: oh as u32, data: out })
+    }
+
+    /// Apply the raster mask to alpha, including its default outside the mask bounds.
+    fn apply_layer_mask(&self, l: &Layer, out_rect: Rect, out: &mut [[f32; 4]], budget: &mut Budget) -> Result<()> {
+        let (ow, oh) = (out_rect.width() as usize, out_rect.height() as usize);
+        // Layer mask: multiplies alpha (also outside the mask rect, by its default colour).
+        if let Some(m) = l.mask.filter(|m| !m.disabled) {
+            let mc = l.channels.iter().find(|c| c.id == -2);
+            let (mw, mh) = (m.rect.width() as usize, m.rect.height() as usize);
+            let mask = match mc {
+                Some(c) if mw > 0 && mh > 0 => Some(self.channel_floats(c.offset, c.len, mw, mh, budget)?),
+                _ => None,
+            };
+            let def = m.default_color as f32 / 255.0;
+            // The factor outside the mask rect, or everywhere when there is no mask data.
+            let outside = if m.inverted { 1.0 - def } else { def };
+            let scale = |px: &mut [[f32; 4]], v: f32| {
+                if v != 1.0 {
+                    for p in px {
+                        p[3] *= v;
+                    }
+                }
+            };
+            match &mask {
+                None => scale(out, outside),
+                Some(mk) => {
+                    // The columns of the output that fall inside the mask rect (the same for every row).
+                    let lo = (i64::from(m.rect.left) - i64::from(out_rect.left)).clamp(0, ow as i64);
+                    let hi = (i64::from(m.rect.right) - i64::from(out_rect.left)).clamp(lo, ow as i64);
+                    let (lo, hi) = (lo as usize, hi as usize);
+                    for (y, row) in out.chunks_exact_mut(ow.max(1)).take(oh).enumerate() {
+                        let py = i64::from(out_rect.top) + y as i64;
+                        #[cfg(test)]
+                        counters::bump(&counters::INSIDE);
+                        if py < i64::from(m.rect.top) || py >= i64::from(m.rect.bottom) {
+                            scale(row, outside);
+                            continue;
+                        }
+                        let (left, rest) = row.split_at_mut(lo);
+                        let (mid, right) = rest.split_at_mut(hi - lo);
+                        scale(left, outside);
+                        scale(right, outside);
+                        // The mask row under `mid`: its first column is output column `lo`.
+                        let base = (py - i64::from(m.rect.top)) as usize * mw + (i64::from(out_rect.left) + lo as i64 - i64::from(m.rect.left)) as usize;
+                        for (i, p) in mid.iter_mut().enumerate() {
+                            let v = mk.get(base + i).copied().unwrap_or(def);
+                            p[3] *= if m.inverted { 1.0 - v } else { v };
+                        }
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+/// The pixel data of a run of planes, as prepared by `Psd::open_planes`.
+enum PlaneStream {
+    Raw,
+    /// RLE row byte counts of every plane, plane after plane.
+    Rle(Vec<usize>),
+    /// The inflated ZIP data of all planes.
+    Zip(Vec<u8>),
+}
+
+/// PackBits decoding of one row (appends exactly `row` bytes, zero-padded).
+pub(crate) fn unpack_bits(src: &[u8], row: usize, out: &mut Vec<u8>) -> Result<()> {
+    let start = out.len();
+    let mut i = 0;
+    while i < src.len() && out.len() - start < row {
+        let n = src[i] as i8;
+        i += 1;
+        if n >= 0 {
+            let k = n as usize + 1;
+            let s = src.get(i..i + k).ok_or(Error::Truncated)?;
+            out.extend_from_slice(s);
+            i += k;
+        } else if n != -128 {
+            let k = (1 - n as isize) as usize;
+            let v = *src.get(i).ok_or(Error::Truncated)?;
+            out.extend(std::iter::repeat_n(v, k));
+            i += 1;
+        }
+    }
+    out.resize(start + row, 0);
+    Ok(())
+}
+
+/// PackBits encoding of one row.
+pub(crate) fn pack_bits(src: &[u8]) -> Vec<u8> {
+    let mut out = vec![];
+    let mut i = 0;
+    while i < src.len() {
+        // run of identical bytes
+        let mut run = 1;
+        while i + run < src.len() && src[i + run] == src[i] && run < 128 {
+            run += 1;
+        }
+        if run >= 2 {
+            out.push((1 - run as isize) as i8 as u8);
+            out.push(src[i]);
+            i += run;
+            continue;
+        }
+        // literal run
+        let start = i;
+        let mut n = 0;
+        while i < src.len() && n < 128 {
+            if i + 1 < src.len() && src[i + 1] == src[i] {
+                break;
+            }
+            i += 1;
+            n += 1;
+        }
+        if n == 0 {
+            i += 1;
+            n = 1;
+        }
+        out.push((n - 1) as u8);
+        out.extend_from_slice(&src[start..start + n]);
+    }
+    out
+}
+
+pub(crate) fn srgb_encode(v: f32) -> f32 {
+    if v <= 0.003_130_8 { v * 12.92 } else { 1.055 * v.powf(1.0 / 2.4) - 0.055 }
+}
+
+/// CIE L*a*b* (D50) to sRGB (D65 via the Bradford-adapted matrix), clamped.
+pub(crate) fn lab_to_rgb(l: f32, a: f32, b: f32) -> [f32; 3] {
+    let fy = (l + 16.0) / 116.0;
+    let fx = fy + a / 500.0;
+    let fz = fy - b / 200.0;
+    let f = |t: f32| if t > 6.0 / 29.0 { t * t * t } else { 3.0 * (6.0f32 / 29.0).powi(2) * (t - 4.0 / 29.0) };
+    let (x, y, z) = (0.964_22 * f(fx), f(fy), 0.825_21 * f(fz));
+    // XYZ (D50) → linear sRGB.
+    let r = 3.133_856 * x - 1.616_867 * y - 0.490_615 * z;
+    let g = -0.978_768 * x + 1.916_142 * y + 0.033_454 * z;
+    let bb = 0.071_945 * x - 0.228_991 * y + 1.405_243 * z;
+    [r, g, bb].map(|v| srgb_encode(v.clamp(0.0, 1.0)))
+}
diff --git a/crates/psd/src/placed.rs b/crates/psd/src/placed.rs
index dff525a89..981f4ff23 100644
--- a/crates/psd/src/placed.rs
+++ b/crates/psd/src/placed.rs
@@ -16,6 +16,13 @@ use crate::{Pixels, SmartObject};
 /// from the file's transform, which is untrusted.
 pub const MAX_BAKE_PIXELS: u64 = 1 << 24;
 
+/// The bake's rasterising budget, in bounding-box pixels visited over all mesh triangles, as a
+/// multiple of the output pixel count. A sane warp visits about 2× the output; a hostile mesh
+/// that makes every triangle cover the whole output would visit thousands of times more.
+const BAKE_WORK_FACTOR: u64 = 8;
+/// The smallest budget, so tiny outputs are never refused for rounding at the triangle edges.
+const MIN_BAKE_WORK: u64 = 1 << 20;
+
 /// A placed layer's warp.
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Warp {
@@ -305,7 +312,8 @@ impl SmartObject {
     /// Bake the content (straight RGBA) as placed: warped and mapped by the quad, rendered at
     /// `k` pixels per document pixel (into `size` pixels when given; see [`Self::placed_size`]).
     /// Returns the pixels and their document-space origin. `None` when the content is empty or
-    /// the baked image would exceed [`MAX_BAKE_PIXELS`].
+    /// the baked image would exceed [`MAX_BAKE_PIXELS`] or the mesh needs more rasterising work than
+    /// the budget allows (see [`BAKE_WORK_FACTOR`]).
     pub fn render_placed(&self, content: &Pixels, k: f64, size: Option<(u32, u32)>) -> Option<(Pixels, [f64; 2])> {
         let (cw, ch) = (content.width as f64, content.height as f64);
         if content.width == 0 || content.height == 0 {
@@ -352,6 +360,12 @@ impl SmartObject {
             o
         };
         let idx = |i: usize, j: usize| j * (n + 1) + i;
+        // A sane mesh's triangles each span about one grid cell (ow/n by oh/n), rounded out to
+        // whole pixels. A thin output (16384×1) stacks every grid row onto the same pixel row, so
+        // allow each of the 2n² triangles about two cells' extent along each axis, with margin.
+        let rounding = (4 * n as u64).saturating_mul((ow as u64).saturating_add(oh as u64).saturating_add(n as u64));
+        let budget = (count as u64).saturating_mul(BAKE_WORK_FACTOR).max(MIN_BAKE_WORK).saturating_add(rounding);
+        let mut work = 0u64;
         for j in 0..n {
             for i in 0..n {
                 for tri in [[idx(i, j), idx(i + 1, j), idx(i + 1, j + 1)], [idx(i, j), idx(i + 1, j + 1), idx(i, j + 1)]] {
@@ -368,6 +382,10 @@ impl SmartObject {
                     let x1 = (a[0].max(b[0]).max(c[0]).ceil() as usize).min(ow);
                     let y0 = a[1].min(b[1]).min(c[1]).floor().max(0.0) as usize;
                     let y1 = (a[1].max(b[1]).max(c[1]).ceil() as usize).min(oh);
+                    work = work.saturating_add((x1.saturating_sub(x0) as u64).saturating_mul(y1.saturating_sub(y0) as u64));
+                    if work > budget {
+                        return None;
+                    }
                     for y in y0..y1 {
                         for x in x0..x1 {
                             let (px, py) = (x as f64 + 0.5, y as f64 + 0.5);
@@ -510,4 +528,37 @@ mod tests {
         assert!(s.render_placed(&content, 1.0, Some((16384, 16384))).is_none());
         assert!(s.render_placed(&content, 1.0, Some((u32::MAX, u32::MAX))).is_none());
     }
+
+    #[test]
+    fn a_mesh_that_makes_every_triangle_cover_the_output_is_refused() {
+        // A 48×48 custom mesh whose patch corners scatter over the four corners of the
+        // content, so most of the 4608 triangles span the whole 2048² output.
+        let (cols, rows) = (48usize, 48usize);
+        let stride = cols * 3 + 1;
+        let mut mesh = vec![[0.0, 0.0]; stride * (rows * 3 + 1)];
+        for j in 0..=rows {
+            for i in 0..=cols {
+                if let Some(p) = mesh.get_mut(j * 3 * stride + i * 3) {
+                    let h = (i * 7 + j * 13 + i * j * 5) % 4;
+                    *p = [if h & 1 == 0 { 0.0 } else { 16.0 }, if h & 2 == 0 { 0.0 } else { 16.0 }];
+                }
+            }
+        }
+        let warp = Warp { style: "warpCustom".into(), bounds: [0.0, 0.0, 16.0, 16.0], cols, rows, mesh, ..Default::default() };
+        let s = SmartObject { uuid: "x".into(), quad: [[0.0, 0.0], [2048.0, 0.0], [2048.0, 2048.0], [0.0, 2048.0]], size: None, warp: Some(warp) };
+        let content = Pixels { width: 16, height: 16, data: vec![[1.0, 0.0, 0.0, 1.0]; 256] };
+        assert!(s.render_placed(&content, 1.0, Some((2048, 2048))).is_none());
+    }
+
+    #[test]
+    fn a_thin_output_is_not_refused_for_rounding() {
+        let s = SmartObject {
+            uuid: "x".into(),
+            quad: [[0.0, 0.0], [16384.0, 0.0], [16384.0, 1.0], [0.0, 1.0]],
+            size: None,
+            warp: Some(Warp { style: "warpArc".into(), bounds: [0.0, 0.0, 16.0, 16.0], bend: 20.0, ..Default::default() }),
+        };
+        let content = Pixels { width: 16, height: 16, data: vec![[1.0, 0.0, 0.0, 1.0]; 256] };
+        assert!(s.render_placed(&content, 1.0, Some((16384, 1))).is_some());
+    }
 }
diff --git a/crates/psd/src/tests.rs b/crates/psd/src/tests.rs
index 60283b229..074976510 100644
--- a/crates/psd/src/tests.rs
+++ b/crates/psd/src/tests.rs
@@ -1,6 +1,9 @@
 use super::write::*;
 use super::*;
 
+mod integration;
+mod opt;
+
 fn gradient(w: u32, h: u32) -> Vec<[f32; 4]> {
     (0..w * h).map(|i| [(i % w) as f32 / (w - 1).max(1) as f32, (i / w) as f32 / (h - 1).max(1) as f32, 0.25, 1.0]).collect()
 }
diff --git a/crates/psd/src/tests_integration.rs b/crates/psd/src/tests/integration.rs
similarity index 98%
rename from crates/psd/src/tests_integration.rs
rename to crates/psd/src/tests/integration.rs
index a2b48b20c..ee40aee16 100644
--- a/crates/psd/src/tests_integration.rs
+++ b/crates/psd/src/tests/integration.rs
@@ -2,9 +2,9 @@
 //! the limit, a NaN text transform), a damaged layer section, and a tiny file claiming a huge
 //! image. Each ends in a clean result or a clean error, on a 2 MiB stack, never a panic.
 
-use super::memory_tests::with_merged;
-use super::write::*;
-use super::*;
+use crate::memory_tests::with_merged;
+use crate::write::*;
+use crate::*;
 
 /// Run `f` on a 2 MiB thread; a panic or stack overflow in it fails the test.
 fn on_small_stack<T: Send + 'static>(f: impl FnOnce() -> T + Send + 'static) -> T {
diff --git a/crates/psd/src/tests_opt.rs b/crates/psd/src/tests/opt.rs
similarity index 99%
rename from crates/psd/src/tests_opt.rs
rename to crates/psd/src/tests/opt.rs
index f129480c1..908026d07 100644
--- a/crates/psd/src/tests_opt.rs
+++ b/crates/psd/src/tests/opt.rs
@@ -1,10 +1,12 @@
 //! The optimised decode / mask / placed-bake paths against the implementations they replaced
 //! (kept below verbatim as references), and counters for the work they no longer do.
 
-use super::counters::{self, INSIDE, QUAD, SCRATCH};
-use super::placed::{Warp, square_to_quad};
-use super::write::*;
-use super::*;
+use std::borrow::Cow;
+
+use crate::counters::{self, INSIDE, QUAD, SCRATCH};
+use crate::placed::{Warp, square_to_quad};
+use crate::write::*;
+use crate::*;
 
 // ------------------------------------------------------------------ the replaced code
 
diff --git a/crates/raster/Cargo.toml b/crates/raster/Cargo.toml
index e27d55317..7cd4fbe5a 100644
--- a/crates/raster/Cargo.toml
+++ b/crates/raster/Cargo.toml
@@ -13,3 +13,4 @@ workspace = true
 effectcraft-geom = { workspace = true }
 effectcraft-color = { workspace = true }
 rayon = { workspace = true }
+tempfile = { workspace = true }
diff --git a/crates/raster/src/blur.rs b/crates/raster/src/blur.rs
index 1c065d77b..c8689a7b6 100644
--- a/crates/raster/src/blur.rs
+++ b/crates/raster/src/blur.rs
@@ -1,5 +1,5 @@
-//! Blurs: separable box passes (exact running sums) approximating Gaussians, plus directional
-//! and radial (spin/zoom) blurs.
+//! Blurs: separable box passes (exact running sums) approximating Gaussians, a sampled Gaussian
+//! kernel for small sigmas, plus directional and radial (spin/zoom) blurs.
 //!
 //! Box passes run straight on row-major pixels: horizontal passes per row, vertical passes over
 //! blocks of rows with a per-column running sum (no transposes), ping-ponging between two
@@ -157,6 +157,50 @@ pub fn gaussian_blur(img: &Image, sigma_x: f64, sigma_y: f64, repeat: bool) -> I
     box_passes(img, &rx, &ry, repeat)
 }
 
+/// Below this sigma (pixels) three integer-radius box passes are too coarse (sigma under ~0.6 is
+/// a no-op and the result steps between a few shapes), so [`gaussian_blur_exact`] is used instead.
+const EXACT_SIGMA_BELOW: f64 = 3.0;
+
+/// True when a Gaussian of these per-axis sigmas should use [`gaussian_blur_exact`].
+pub fn gaussian_is_exact(sigma_x: f64, sigma_y: f64) -> bool {
+    sigma_x.max(sigma_y) < EXACT_SIGMA_BELOW
+}
+
+/// One separable pass of a sampled Gaussian (radius 3 sigma) along x or y.
+fn gauss_pass(img: &Image, sigma: f64, vertical: bool, repeat: bool) -> Image {
+    // Below 1e-3 the kernel is the identity in f64; tiny sigmas would also make 2σ² underflow to 0 (NaN taps).
+    if sigma.is_nan() || sigma <= 1e-3 || img.is_empty() {
+        return img.clone();
+    }
+    let r = (sigma * 3.0).ceil() as i64;
+    let mut k: Vec<f64> = (-r..=r).map(|i| (-((i * i) as f64) / (2.0 * sigma * sigma)).exp()).collect();
+    let total: f64 = k.iter().sum();
+    k.iter_mut().for_each(|v| *v /= total);
+    let w = img.width as usize;
+    let mut out = Image::new(img.width, img.height);
+    out.rows_mut().for_each(|(y, row)| {
+        for x in 0..w {
+            let mut acc = [0.0f64; 4];
+            for (i, wt) in k.iter().enumerate() {
+                let d = i as i64 - r;
+                let (sx, sy) = if vertical { (x as i64, y as i64 + d) } else { (x as i64 + d, y as i64) };
+                let p = if repeat { img.get_clamped(sx, sy) } else { img.get(sx, sy) };
+                for c in 0..4 {
+                    acc[c] += p[c] as f64 * wt;
+                }
+            }
+            row[x] = acc.map(|v| v as f32);
+        }
+    });
+    out
+}
+
+/// Gaussian blur as a true sampled kernel, continuous in sigma (for small sigmas, see
+/// [`gaussian_is_exact`]).
+pub fn gaussian_blur_exact(img: &Image, sigma_x: f64, sigma_y: f64, repeat: bool) -> Image {
+    gauss_pass(&gauss_pass(img, sigma_x, false, repeat), sigma_y, true, repeat)
+}
+
 /// Motion blur along `angle_deg` (0 = vertical in AE's Directional Blur, measured clockwise from
 /// up) over `length` pixels.
 pub fn directional_blur(img: &Image, angle_deg: f64, length: f64) -> Image {
@@ -203,7 +247,9 @@ pub fn radial_blur(img: &Image, center: (f64, f64), amount: f64, zoom: bool) ->
                     let (s, c) = (t * amount).to_radians().sin_cos();
                     (center.0 + vx * c - vy * s, center.1 + vx * s + vy * c)
                 };
-                let p = img.sample_bilinear(sx, sy);
+                // Samples outside the image repeat its edge: After Effects' Radial Blur keeps a
+                // layer's edges (cases 713, 829) instead of fading them toward transparency.
+                let p = img.sample_bilinear(sx.clamp(0.5, (img.width as f64 - 0.5).max(0.5)), sy.clamp(0.5, (img.height as f64 - 0.5).max(0.5)));
                 for ch in 0..4 {
                     acc[ch] += p[ch];
                 }
@@ -228,6 +274,17 @@ mod tests {
         assert!(b.get(32, 32)[3] < 0.05);
     }
 
+    #[test]
+    fn vanishing_or_nan_sigma_leaves_the_image_unchanged() {
+        let mut img = Image::new(5, 5);
+        img.set(2, 2, [1.0, 0.5, 0.25, 1.0]);
+        for s in [1e-200, f64::MIN_POSITIVE, f64::NAN] {
+            let b = gaussian_blur_exact(&img, s, s, false);
+            assert!(b.data.iter().all(|p| p.iter().all(|v| v.is_finite())), "sigma {s}");
+            assert_eq!(b, img, "sigma {s}");
+        }
+    }
+
     #[test]
     fn flat_image_stays_flat_with_repeat() {
         let img = Image::filled(20, 10, [0.5, 0.5, 0.5, 1.0]);
diff --git a/crates/raster/src/channels3d.rs b/crates/raster/src/channels3d.rs
index b84b64b79..ae2d38303 100644
--- a/crates/raster/src/channels3d.rs
+++ b/crates/raster/src/channels3d.rs
@@ -127,12 +127,7 @@ impl AuxChannels {
     pub fn crypto_rank_planes(&self, layer: &str) -> Vec<(&[f32], &[f32])> {
         let mut out = vec![];
         for k in 0.. {
-            let (r, g, b, a) = (
-                self.get(&format!("{layer}{k:02}.R")),
-                self.get(&format!("{layer}{k:02}.G")),
-                self.get(&format!("{layer}{k:02}.B")),
-                self.get(&format!("{layer}{k:02}.A")),
-            );
+            let (r, g, b, a) = (self.rank(layer, k, 'R'), self.rank(layer, k, 'G'), self.rank(layer, k, 'B'), self.rank(layer, k, 'A'));
             let (Some(r), Some(g)) = (r, g) else { break };
             out.push((r, g));
             if let (Some(b), Some(a)) = (b, a) {
@@ -142,12 +137,58 @@ impl AuxChannels {
         out
     }
 
+    /// The plane `{layer}{k:02}.{comp}`: the layer name matches case-sensitively (layers
+    /// `Crypto_A` and `crypto_a` are different layers), the component letter either case.
+    fn rank(&self, layer: &str, k: usize, comp: char) -> Option<&[f32]> {
+        let tail = format!("{k:02}.{comp}");
+        self.channels.iter().find(|(n, _)| n.strip_prefix(layer).is_some_and(|rest| rest.eq_ignore_ascii_case(&tail))).map(|(_, v)| v.as_slice())
+    }
+
     /// Rank pairs (id, coverage) of Cryptomatte layer `layer` at aux pixel index `i`. For a
     /// loop over pixels, use [`AuxChannels::crypto_rank_planes`] once instead.
     pub fn crypto_ranks(&self, layer: &str, i: usize) -> Vec<(f32, f32)> {
         self.crypto_rank_planes(layer).iter().map(|(id, c)| (id[i], c[i])).collect()
     }
 
+    /// The Cryptomatte layer an effect asking for `want` (`CryptoObject`, …) reads: an exact
+    /// match, else one ending in it (`ViewLayer.CryptoObject`), else the first layer.
+    pub fn resolve_crypto_layer(&self, want: &str) -> Option<String> {
+        let layers = self.crypto_layers();
+        layers.iter().find(|l| l.as_str() == want || l.ends_with(want)).or(layers.first()).cloned()
+    }
+
+    /// [`AuxChannels::resolve_crypto_layer`] with a layer named in full first: the layer called
+    /// exactly `name` when it is not empty and the footage has it (`Crypto_Material`, a name an
+    /// imported After Effects project carries), else the layer for `want`.
+    /// The name as given is tried first (EXR channel names may carry spaces), then trimmed.
+    pub fn resolve_crypto_layer_named(&self, name: &str, want: &str) -> Option<String> {
+        let layers = self.crypto_layers();
+        for name in [name, name.trim()] {
+            if !name.is_empty() && layers.iter().any(|l| l == name) {
+                return Some(name.to_string());
+            }
+        }
+        self.resolve_crypto_layer(want)
+    }
+
+    /// The ID (its hash, `f32::to_bits`) with the most coverage at aux pixel `i` of Cryptomatte
+    /// layer `layer`, summed over the ranks it appears in. Ties go to the lower rank; IDs with
+    /// no positive coverage don't count. `None` when nothing covers the pixel.
+    pub fn crypto_id_at(&self, layer: &str, i: usize) -> Option<u32> {
+        let mut ids: Vec<(u32, f32)> = vec![];
+        for (id, cov) in self.crypto_rank_planes(layer) {
+            let (Some(id), Some(&c)) = (id.get(i), cov.get(i)) else { continue };
+            if c > 0.0 {
+                match ids.iter_mut().find(|(h, _)| *h == id.to_bits()) {
+                    Some((_, sum)) => *sum += c,
+                    None => ids.push((id.to_bits(), c)),
+                }
+            }
+        }
+        // `min_by` keeps the first of equal elements: a tie goes to the lower rank.
+        ids.into_iter().min_by(|a, b| b.1.total_cmp(&a.1)).map(|(h, _)| h)
+    }
+
     /// Aux pixel index of a layer-space point (nearest; `None` outside).
     #[inline]
     pub fn index_at(&self, lx: f64, ly: f64) -> Option<usize> {
@@ -211,6 +252,41 @@ pub fn crypto_float(hash: u32) -> f32 {
 mod tests {
     use super::*;
 
+    /// The picked ID: most coverage (summed over ranks), ties to the lower rank, nothing when
+    /// no rank covers the pixel; layers resolve as the Cryptomatte effect does.
+    #[test]
+    fn crypto_id_at_takes_the_top_coverage_and_layers_resolve_by_suffix() {
+        let mut a = AuxChannels::new(4, 1, 1.0);
+        let f = |n: &str| crypto_float(crypto_hash(n));
+        let (x, y, z) = (f("x"), f("y"), f("z"));
+        for (c, v) in [("R", [x, x, x, x]), ("G", [0.3, 0.5, 0.0, 0.2]), ("B", [y, y, y, y]), ("A", [0.6, 0.5, 0.0, 0.3])] {
+            a.channels.push((format!("ViewLayer.CryptoObject00.{c}"), v.to_vec()));
+        }
+        for (c, v) in [("R", [z, z, z, x]), ("G", [0.1, 0.0, -1.0, 0.2])] {
+            a.channels.push((format!("ViewLayer.CryptoObject01.{c}"), v.to_vec()));
+        }
+        a.channels.push(("Other00.R".into(), vec![0.0; 4]));
+        let l = a.resolve_crypto_layer("CryptoObject").unwrap();
+        assert_eq!(l, "ViewLayer.CryptoObject");
+        assert_eq!(a.resolve_crypto_layer("CryptoMaterial").as_deref(), Some("Other"), "falls back to the first");
+        let at = |i| a.crypto_id_at(&l, i);
+        assert_eq!([at(0), at(1), at(2), at(3), at(9)], [Some(crypto_hash("y")), Some(crypto_hash("x")), None, Some(crypto_hash("x")), None]);
+        assert_eq!(AuxChannels::new(1, 1, 1.0).resolve_crypto_layer("CryptoObject"), None);
+        // A layer named in full wins; an empty or missing name falls back to `want`.
+        assert_eq!(a.resolve_crypto_layer_named("Other", "CryptoObject").as_deref(), Some("Other"));
+        assert_eq!(a.resolve_crypto_layer_named(" Other ", "CryptoObject").as_deref(), Some("Other"));
+        assert_eq!(a.resolve_crypto_layer_named("", "CryptoObject").as_deref(), Some("ViewLayer.CryptoObject"));
+        assert_eq!(a.resolve_crypto_layer_named("Crypto_Name", "CryptoObject").as_deref(), Some("ViewLayer.CryptoObject"));
+        assert_eq!(AuxChannels::new(1, 1, 1.0).resolve_crypto_layer_named("Other", "CryptoObject"), None);
+        // A layer whose name ends in a space is matched as named, before the trimmed name.
+        let mut b = AuxChannels::new(1, 1, 1.0);
+        for l in ["Mat", "Mat "] {
+            b.channels.push((format!("{l}00.R"), vec![0.0]));
+        }
+        assert_eq!(b.resolve_crypto_layer_named("Mat ", "CryptoObject").as_deref(), Some("Mat "));
+        assert_eq!(b.resolve_crypto_layer_named(" Mat", "CryptoObject").as_deref(), Some("Mat"));
+    }
+
     #[test]
     fn murmur3_reference_values() {
         // Published MurmurHash3_x86_32 test vectors.
@@ -274,4 +350,22 @@ mod tests {
         }
         assert!(a.crypto_rank_planes("CryptoObject").is_empty());
     }
+
+    /// Layers whose names differ only in case stay separate: `Crypto_A` and `crypto_a` each read
+    /// their own ranks (lowercase component letters still match), and picking agrees.
+    #[test]
+    fn crypto_layers_differing_in_case_read_their_own_planes() {
+        let mut a = AuxChannels::new(1, 1, 1.0);
+        let f = |n: &str| crypto_float(crypto_hash(n));
+        for (n, v) in [("Crypto_A00.R", f("upper")), ("Crypto_A00.G", 1.0), ("crypto_a00.r", f("lower")), ("crypto_a00.g", 1.0)] {
+            a.channels.push((n.into(), vec![v]));
+        }
+        assert_eq!(a.crypto_layers(), vec!["Crypto_A".to_string(), "crypto_a".to_string()]);
+        assert_eq!(a.resolve_crypto_layer_named("crypto_a", "CryptoObject").as_deref(), Some("crypto_a"));
+        assert_eq!(a.crypto_rank_planes("crypto_a")[0].0, &[f("lower")][..]);
+        assert_eq!(a.crypto_rank_planes("Crypto_A")[0].0, &[f("upper")][..]);
+        assert_eq!(a.crypto_id_at("crypto_a", 0), Some(crypto_hash("lower")));
+        assert_eq!(a.crypto_id_at("Crypto_A", 0), Some(crypto_hash("upper")));
+        assert!(a.crypto_rank_planes("CRYPTO_A").is_empty());
+    }
 }
diff --git a/crates/raster/src/flow.rs b/crates/raster/src/flow.rs
index feb033d65..180b235bf 100644
--- a/crates/raster/src/flow.rs
+++ b/crates/raster/src/flow.rs
@@ -51,6 +51,21 @@ impl Flow {
     }
 }
 
+/// The `Plane::luma` of `a` and `b` packed into one image (`a` in the red channel, `b` in the
+/// green; the rest zero). A device block matcher takes this as its input rather than computing
+/// the luma itself: the weighted sum is not reproducible on a device, which may contract
+/// `a·b + c` into a fused multiply-add, and the search's near-tie choices would then differ.
+pub fn luma_pair(a: &Image, b: &Image) -> Image {
+    let luma = |p: &[f32; 4]| 0.2126 * p[0] + 0.7152 * p[1] + 0.0722 * p[2] + 0.25 * p[3];
+    let mut out = Image::new(a.width, a.height);
+    out.data.par_iter_mut().enumerate().for_each(|(i, q)| {
+        let la = a.data.get(i).map(luma).unwrap_or(0.0);
+        let lb = b.data.get(i).map(luma).unwrap_or(0.0);
+        *q = [la, lb, 0.0, 0.0];
+    });
+    out
+}
+
 /// A single-channel plane.
 struct Plane {
     w: usize,
diff --git a/crates/raster/src/inpaint.rs b/crates/raster/src/inpaint.rs
index 15bdaa0dd..8b7127b4d 100644
--- a/crates/raster/src/inpaint.rs
+++ b/crates/raster/src/inpaint.rs
@@ -34,6 +34,7 @@
 use rayon::prelude::*;
 
 use crate::Image;
+use crate::Px;
 use crate::flow::{Flow, block_flow};
 
 /// Fill method.
@@ -562,23 +563,31 @@ pub fn patch_fill(img: &Image, hole: &[bool], init: Option<&Image>, patch: usize
 
 // ------------------------------------------------------------------ flow-guided propagation
 
-/// Block flow from `a` to `b` with the tiles that touch either hole replaced by the membrane
-/// interpolation of the surrounding motion (flow completion).
+/// Block flow `a` → `b` (tile 8, search radius 6) with the tiles that touch either hole replaced
+/// by the membrane interpolation of the surrounding motion (flow completion).
 fn completed_flow(a: &Image, b: &Image, hole_a: &[bool], hole_b: &[bool]) -> Flow {
-    let mut f = block_flow(a, b, 8, 6);
+    let f = block_flow(a, b, 8, 6);
+    complete_flow(f, hole_a, hole_b, a.width as usize, a.height as usize)
+}
+
+/// The completion half of `completed_flow`: the tiles of `f` (a `block_flow` of `w × h`) that
+/// touch either hole become the harmonic interpolation of the surrounding motion. Split out so a
+/// hardware backend can compute the block matching itself and hand the raw field here; the
+/// completion is cheap (the field is a `cols × rows` grid) and stays on the CPU.
+pub fn complete_flow(mut f: Flow, hole_a: &[bool], hole_b: &[bool], w: usize, h: usize) -> Flow {
     if f.v.is_empty() {
         return f;
     }
-    let (w, bs) = (a.width as usize, f.block as usize);
+    let bs = f.block as usize;
     let mut known = vec![true; f.v.len()];
     for (i, k) in known.iter_mut().enumerate() {
         let (c, r) = (i % f.cols, i / f.cols);
         // A tile is unreliable when any pixel within it (and a block's margin) is a hole.
         let (x0, y0) = ((c * bs).saturating_sub(bs / 2), (r * bs).saturating_sub(bs / 2));
-        let (x1, y1) = (((c + 1) * bs + bs / 2).min(w), ((r + 1) * bs + bs / 2).min(a.height as usize));
+        let (x1, y1) = (((c + 1) * bs + bs / 2).min(w), ((r + 1) * bs + bs / 2).min(h));
         'tile: for y in y0..y1 {
             for x in x0..x1 {
-                if hole_a[y * w + x] || hole_b[y * w + x] {
+                if hole_a.get(y * w + x).copied().unwrap_or(true) || hole_b.get(y * w + x).copied().unwrap_or(true) {
                     *k = false;
                     break 'tile;
                 }
@@ -597,48 +606,514 @@ fn completed_flow(a: &Image, b: &Image, hole_a: &[bool], hole_b: &[bool]) -> Flo
     f
 }
 
+/// A hole mask packed into 64-bit words (1 bit per pixel) to keep the per-frame cost
+/// down across a whole range (#2570).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct HoleMask {
+    pub words: Vec<u64>,
+    pub len: usize,
+}
+
+impl HoleMask {
+    /// Pack one `bool` a pixel into 64-bit words.
+    pub fn from_vec(hole: &[bool]) -> Self {
+        let mut words = vec![0u64; hole.len().div_ceil(64)];
+        for (i, &h) in hole.iter().enumerate() {
+            if h {
+                words[i / 64] |= 1u64 << (i % 64);
+            }
+        }
+        HoleMask { words, len: hole.len() }
+    }
+    /// An all-known mask of `n` pixels.
+    pub fn zeros(n: usize) -> Self {
+        HoleMask { words: vec![0u64; n.div_ceil(64)], len: n }
+    }
+    /// Whether pixel `i` is in the hole. `words` and `len` are public, so a mask whose words are
+    /// shorter than `len` reads the missing pixels as known instead of panicking.
+    pub fn get(&self, i: usize) -> bool {
+        i < self.len && self.words.get(i / 64).is_some_and(|w| (w >> (i % 64)) & 1 == 1)
+    }
+    /// Mark pixel `i` as missing (`true`) or known (`false`). A pixel outside the mask is ignored.
+    pub fn set(&mut self, i: usize, v: bool) {
+        if i >= self.len {
+            return;
+        }
+        let Some(w) = self.words.get_mut(i / 64) else {
+            return;
+        };
+        if v {
+            *w |= 1u64 << (i % 64);
+        } else {
+            *w &= !(1u64 << (i % 64));
+        }
+    }
+    /// Whether any pixel is in the hole.
+    pub fn any(&self) -> bool {
+        self.words.iter().any(|&w| w != 0)
+    }
+    /// Unpack to one `bool` a pixel.
+    pub fn to_vec(&self) -> Vec<bool> {
+        (0..self.len).map(|i| self.get(i)).collect()
+    }
+}
+
+/// Where a fill's input frames live. `Memory` keeps them in RAM (tests, small ranges);
+/// `Spilled` stores them on disk and reads them on demand, so a whole range costs ~0 RAM.
+#[derive(Clone)]
+pub enum Frames {
+    Memory(Vec<Image>),
+    Spilled(SpillHandle),
+}
+
+impl Frames {
+    /// The number of frames in the range.
+    pub fn len(&self) -> usize {
+        match self {
+            Frames::Memory(v) => v.len(),
+            Frames::Spilled(h) => h.n,
+        }
+    }
+    /// Whether the range has no frames.
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+    /// Frame `k`: a clone from RAM, or a decode from the spill.
+    pub fn get(&self, k: usize) -> Image {
+        match self {
+            Frames::Memory(v) => v[k].clone(),
+            Frames::Spilled(h) => h.get(k),
+        }
+    }
+    /// Frame size without decoding a whole image.
+    pub fn size(&self) -> Option<(usize, usize)> {
+        match self {
+            Frames::Memory(v) => v.first().map(|i| (i.width as usize, i.height as usize)),
+            Frames::Spilled(h) => Some((h.w, h.h)),
+        }
+    }
+    /// Bilinear sample of one pixel. A spilled frame reads only the 2x2 support from disk, so
+    /// the hot trace path never decodes or clones a whole frame (#2570).
+    pub fn sample(&self, k: usize, x: f64, y: f64) -> Px {
+        match self {
+            Frames::Memory(v) => v[k].sample_bilinear_clamped(x, y),
+            Frames::Spilled(h) => h.sample(k, x, y),
+        }
+    }
+    /// Directory of the spill file, so a secondary spill can live beside it.
+    pub fn scratch_dir(&self) -> Option<std::path::PathBuf> {
+        match self {
+            Frames::Memory(_) => None,
+            Frames::Spilled(h) => h.dir().map(std::path::Path::to_path_buf),
+        }
+    }
+    /// Whether a read or write of a spilled frame failed.
+    pub fn has_error(&self) -> bool {
+        match self {
+            Frames::Memory(_) => false,
+            Frames::Spilled(h) => h.has_error(),
+        }
+    }
+    /// Take the first spill failure, clearing it.
+    pub fn take_error(&self) -> Option<String> {
+        match self {
+            Frames::Memory(_) => None,
+            Frames::Spilled(h) => h.take_error(),
+        }
+    }
+    /// The error slot shared by every spill in this fill, so a caller holding a clone of the
+    /// input handle also sees failures in the propagated-frame spill.
+    pub fn error_cell(&self) -> Option<std::sync::Arc<std::sync::Mutex<Option<String>>>> {
+        match self {
+            Frames::Memory(_) => None,
+            Frames::Spilled(h) => Some(h.error_cell()),
+        }
+    }
+}
+
+/// A spill file holding `n` frames of `w x h` pixels at `bpc` bits per channel.
+/// Frames are read back on demand. The file is shared (reference-counted), so it lives until the
+/// last clone is dropped (#2570 review).
+#[derive(Clone)]
+pub struct SpillHandle {
+    inner: std::sync::Arc<SpillInner>,
+    pub w: usize,
+    pub h: usize,
+    pub n: usize,
+    pub bpc: u8,
+}
+
+struct SpillInner {
+    /// The folder the spill was created in (`None`: the system temporary folder), so the fill's
+    /// other spills go beside it.
+    dir: Option<std::path::PathBuf>,
+    /// An anonymous temporary file: it has no name in `dir`, and the system reclaims it when the
+    /// last handle closes, even when the app is killed or runs out of memory partway through a
+    /// fill, so a multi-gigabyte scratch file is never left in the user's folder (#2570 review).
+    /// Every read and write is positioned on this one handle: several trace threads read the same
+    /// file at once, and a shared file offset would need a lock around every read (#2570).
+    file: std::fs::File,
+    /// Shared with any secondary spill so one probe reports every scratch failure.
+    error: std::sync::Arc<std::sync::Mutex<Option<String>>>,
+}
+
+impl SpillHandle {
+    /// The folder the spill lives in (`None`: the system temporary folder).
+    pub fn dir(&self) -> Option<&std::path::Path> {
+        self.inner.dir.as_deref()
+    }
+
+    /// Bytes a pixel in the spill: RGBA `u8`, or four `f32` above 8 bits a channel.
+    fn bytes_per_px(&self) -> usize {
+        if self.bpc <= 8 { 4 } else { 16 }
+    }
+
+    /// Record a scratch failure in the shared slot, keeping the first.
+    pub fn record_error(&self, message: String) {
+        if let Ok(mut e) = self.inner.error.lock()
+            && e.is_none()
+        {
+            *e = Some(message);
+        }
+    }
+
+    /// The error slot shared with any secondary spill.
+    pub fn error_cell(&self) -> std::sync::Arc<std::sync::Mutex<Option<String>>> {
+        std::sync::Arc::clone(&self.inner.error)
+    }
+
+    /// Whether a read or write failed (`true` when the slot is poisoned).
+    pub fn has_error(&self) -> bool {
+        self.inner.error.lock().map(|e| e.is_some()).unwrap_or(true)
+    }
+
+    /// Take the first failure, clearing it.
+    pub fn take_error(&self) -> Option<String> {
+        self.inner.error.lock().ok().and_then(|mut e| e.take())
+    }
+
+    /// Read one whole frame from the spill, reporting a short or failed read.
+    fn load_frame(&self, k: usize) -> Image {
+        let mut img = Image::new(self.w as u32, self.h as u32);
+        let Some(px) = self.w.checked_mul(self.h) else {
+            self.record_error("spill: pixel count overflow".into());
+            return img;
+        };
+        let bytes_per_px = self.bytes_per_px();
+        let Some(off) = k.checked_mul(px).and_then(|v| v.checked_mul(bytes_per_px)) else {
+            self.record_error(format!("spill: offset overflow for frame {k}"));
+            return img;
+        };
+        let Some(len) = px.checked_mul(bytes_per_px) else {
+            self.record_error("spill: frame size overflow".into());
+            return img;
+        };
+        let mut buf = vec![0u8; len];
+        if let Err(e) = self.read_at(off as u64, &mut buf) {
+            self.record_error(format!("spill: {e}"));
+            return img;
+        }
+        if self.bpc <= 8 {
+            for (i, p) in img.data.iter_mut().enumerate() {
+                let j = i * 4;
+                p[0] = buf[j] as f32 / 255.0;
+                p[1] = buf[j + 1] as f32 / 255.0;
+                p[2] = buf[j + 2] as f32 / 255.0;
+                p[3] = buf[j + 3] as f32 / 255.0;
+            }
+        } else {
+            for (i, p) in img.data.iter_mut().enumerate() {
+                let base = i * 16;
+                for c in 0..4 {
+                    let mut b = [0u8; 4];
+                    b.copy_from_slice(&buf[base + c * 4..base + c * 4 + 4]);
+                    p[c] = f32::from_bits(u32::from_le_bytes(b));
+                }
+            }
+        }
+        img
+    }
+
+    /// Read a whole frame, decoding it.
+    pub fn get(&self, k: usize) -> Image {
+        self.load_frame(k)
+    }
+
+    /// A positioned read: `pread`/`seek_read` use the shared handle without touching a shared
+    /// file offset, so tracing threads do not serialise on the file.
+    fn read_at(&self, off: u64, buf: &mut [u8]) -> std::io::Result<()> {
+        let file = &self.inner.file;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::FileExt;
+            file.read_exact_at(buf, off)
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::fs::FileExt;
+            let mut done = 0usize;
+            while done < buf.len() {
+                match file.seek_read(&mut buf[done..], off.saturating_add(done as u64)) {
+                    Ok(0) => return Err(std::io::ErrorKind::UnexpectedEof.into()),
+                    Ok(n) => done += n,
+                    Err(e) if e.kind() == std::io::ErrorKind::Interrupted => {}
+                    Err(e) => return Err(e),
+                }
+            }
+            Ok(())
+        }
+        // Elsewhere, seek the shared handle. Spills are only made natively: wasm keeps the
+        // propagated frames in RAM and has no file system to spill the input to.
+        #[cfg(not(any(unix, windows)))]
+        {
+            use std::io::{Read, Seek, SeekFrom};
+            let mut f = file;
+            f.seek(SeekFrom::Start(off))?;
+            f.read_exact(buf)
+        }
+    }
+
+    /// A positioned write on the same handle as `read_at`, so the propagation workers can store
+    /// their frames at once and the file never needs a name to be reopened by.
+    fn write_at(&self, off: u64, buf: &[u8]) -> std::io::Result<()> {
+        let file = &self.inner.file;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::FileExt;
+            file.write_all_at(buf, off)
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::fs::FileExt;
+            let mut done = 0usize;
+            while done < buf.len() {
+                match file.seek_write(&buf[done..], off.saturating_add(done as u64)) {
+                    Ok(0) => return Err(std::io::ErrorKind::WriteZero.into()),
+                    Ok(n) => done += n,
+                    Err(e) if e.kind() == std::io::ErrorKind::Interrupted => {}
+                    Err(e) => return Err(e),
+                }
+            }
+            Ok(())
+        }
+        #[cfg(not(any(unix, windows)))]
+        {
+            use std::io::{Seek, SeekFrom, Write};
+            let mut f = file;
+            f.seek(SeekFrom::Start(off))?;
+            f.write_all(buf)
+        }
+    }
+
+    /// One pixel decoded from `buf` at index `i` (transparent if `buf` is short).
+    fn px_at(&self, buf: &[u8], i: usize) -> Px {
+        if self.bpc <= 8 {
+            let j = i * 4;
+            [
+                buf.get(j).copied().unwrap_or(0) as f32 / 255.0,
+                buf.get(j + 1).copied().unwrap_or(0) as f32 / 255.0,
+                buf.get(j + 2).copied().unwrap_or(0) as f32 / 255.0,
+                buf.get(j + 3).copied().unwrap_or(0) as f32 / 255.0,
+            ]
+        } else {
+            let base = i * 16;
+            let mut p = [0.0f32; 4];
+            for (c, v) in p.iter_mut().enumerate() {
+                let at = base + c * 4;
+                let Some(b) = buf.get(at..at + 4).and_then(|s| <[u8; 4]>::try_from(s).ok()) else {
+                    return [0.0; 4];
+                };
+                *v = f32::from_bits(u32::from_le_bytes(b));
+            }
+            p
+        }
+    }
+
+    /// The two horizontally adjacent pixels (`x`, `x + 1`, both clamped) of row `y` (clamped),
+    /// read straight from the spill file.
+    fn edge(&self, k: usize, y: i64, x: i64) -> Option<(Px, Px)> {
+        let (w, h) = (self.w, self.h);
+        if w == 0 || h == 0 || k >= self.n {
+            return None;
+        }
+        let (iw, ih) = (i64::try_from(w).ok()?, i64::try_from(h).ok()?);
+        let y = y.clamp(0, ih - 1) as usize;
+        let xa = x.clamp(0, iw - 1) as usize;
+        let xb = x.saturating_add(1).clamp(0, iw - 1) as usize;
+        let bpp = self.bytes_per_px();
+        let off = k
+            .checked_mul(w)
+            .and_then(|v| v.checked_mul(h))
+            .and_then(|v| v.checked_add(y.checked_mul(w)?))
+            .and_then(|v| v.checked_add(xa))
+            .and_then(|v| v.checked_mul(bpp));
+        let Some(off) = off.and_then(|v| u64::try_from(v).ok()) else {
+            self.record_error("spill: sample offset overflow".into());
+            return None;
+        };
+        // One read covers both pixels unless the right edge clamps them together. A stack buffer
+        // keeps the per-sample allocation out of the trace loop.
+        let len = (xb - xa + 1) * bpp;
+        let mut held = [0u8; 32];
+        let buf = held.get_mut(..len)?;
+        if let Err(e) = self.read_at(off, buf) {
+            self.record_error(format!("spill: {e}"));
+            return None;
+        }
+        let a = self.px_at(buf, 0);
+        let b = if xb > xa { self.px_at(buf, 1) } else { a };
+        Some((a, b))
+    }
+
+    /// Bilinear sample of one pixel, reading only its 2x2 support. Matches
+    /// `Image::sample_bilinear_clamped` exactly, with the same edge clamping.
+    pub fn sample(&self, k: usize, x: f64, y: f64) -> Px {
+        let fx = x - 0.5;
+        let fy = y - 0.5;
+        let (x0, y0) = (fx.floor(), fy.floor());
+        let (tx, ty) = ((fx - x0) as f32, (fy - y0) as f32);
+        // `as i64` saturates NaN and out-of-range values, as in `sample_bilinear_clamped`.
+        let (x0, y0) = (x0 as i64, y0 as i64);
+        let (Some((a, b)), Some((c, d))) = (self.edge(k, y0, x0), self.edge(k, y0.saturating_add(1), x0)) else {
+            return [0.0; 4];
+        };
+        let mut o = [0.0; 4];
+        for i in 0..4 {
+            let top = a[i] + (b[i] - a[i]) * tx;
+            let bot = c[i] + (d[i] - c[i]) * tx;
+            o[i] = top + (bot - top) * ty;
+        }
+        o
+    }
+
+    /// Write frame `k` into the spill, reporting a disk error.
+    pub fn write_frame(&self, k: usize, img: &Image) -> std::result::Result<(), String> {
+        if k >= self.n {
+            return Err(format!("spill: frame {k} out of range (n = {})", self.n));
+        }
+        if img.width as usize != self.w || img.height as usize != self.h {
+            return Err(format!("spill: frame {k} is {}x{}, expected {}x{}", img.width, img.height, self.w, self.h));
+        }
+        let bytes_per_px = self.bytes_per_px();
+        let px = self.w.checked_mul(self.h).ok_or("overflow")?;
+        let off = k.checked_mul(px).and_then(|v| v.checked_mul(bytes_per_px)).ok_or("overflow")?;
+        let buf = if self.bpc <= 8 {
+            let mut buf = vec![0u8; px * 4];
+            for (i, p) in img.data.iter().enumerate() {
+                buf[i * 4] = (p[0] * 255.0).round().clamp(0.0, 255.0) as u8;
+                buf[i * 4 + 1] = (p[1] * 255.0).round().clamp(0.0, 255.0) as u8;
+                buf[i * 4 + 2] = (p[2] * 255.0).round().clamp(0.0, 255.0) as u8;
+                buf[i * 4 + 3] = (p[3] * 255.0).round().clamp(0.0, 255.0) as u8;
+            }
+            buf
+        } else {
+            let mut buf = vec![0u8; px * 16];
+            for (i, p) in img.data.iter().enumerate() {
+                let base = i * 16;
+                for c in 0..4 {
+                    buf[base + c * 4..base + c * 4 + 4].copy_from_slice(&p[c].to_le_bytes());
+                }
+            }
+            buf
+        };
+        self.write_at(off as u64, &buf).map_err(|e| format!("spill: {e}"))
+    }
+
+    /// Create a spill file. `dir` lets the caller keep scratch next to the output (so a
+    /// RAM-backed `/tmp` does not defeat the point of spilling); `None` uses the temp dir.
+    pub fn create_in(dir: Option<&std::path::Path>, w: usize, h: usize, n: usize, bpc: u8) -> std::io::Result<Self> {
+        Self::create_in_with_error(dir, w, h, n, bpc, None)
+    }
+
+    /// `error`: share an existing error slot, so a secondary spill reports through the same
+    /// handle the caller already watches (#2570 review).
+    pub fn create_in_with_error(
+        dir: Option<&std::path::Path>,
+        w: usize,
+        h: usize,
+        n: usize,
+        bpc: u8,
+        error: Option<std::sync::Arc<std::sync::Mutex<Option<String>>>>,
+    ) -> std::io::Result<Self> {
+        let bytes_per_px: usize = if bpc <= 8 { 4 } else { 16 };
+        let total = n
+            .checked_mul(w)
+            .and_then(|v| v.checked_mul(h))
+            .and_then(|v| v.checked_mul(bytes_per_px))
+            .ok_or(std::io::Error::new(std::io::ErrorKind::InvalidInput, "overflow"))?;
+        // Anonymous, so nothing is left behind if `set_len` fails below or the app never gets
+        // to clean up.
+        let file = match dir {
+            Some(d) => {
+                std::fs::create_dir_all(d)?;
+                tempfile::tempfile_in(d)?
+            }
+            None => tempfile::tempfile()?,
+        };
+        file.set_len(total as u64)?;
+        let error = error.unwrap_or_else(|| std::sync::Arc::new(std::sync::Mutex::new(None)));
+        let inner = std::sync::Arc::new(SpillInner { dir: dir.map(std::path::Path::to_path_buf), file, error });
+        Ok(SpillHandle { inner, w, h, n, bpc })
+    }
+
+    /// Create a spill in the system temporary directory.
+    pub fn create(w: usize, h: usize, n: usize, bpc: u8) -> std::io::Result<Self> {
+        Self::create_in(None, w, h, n, bpc)
+    }
+}
+
 /// The input of a sequence fill.
+#[derive(Clone)]
 pub struct FillInput {
-    /// Frames (premultiplied RGBA, all the same size).
-    pub frames: Vec<Image>,
-    /// Per frame, `true` where the pixel is missing.
-    pub holes: Vec<Vec<bool>>,
+    /// Frames (premultiplied RGBA, all the same size), in RAM or spilled to disk.
+    pub frames: Frames,
+    /// Per frame, packed hole mask (`true` where the pixel is missing).
+    pub holes: Vec<HoleMask>,
     /// Complete images for some frames: (frame index, image).
     pub references: Vec<(usize, Image)>,
 }
 
-/// Trace pixel (x, y) of frame `t` through `flows` (`step` = +1 forward with `fwd`, −1 backward
-/// with `bwd`) to the nearest frame where it is visible: (sampled colour, frames travelled).
-fn trace(
-    t: usize,
+/// Shared frame and flow data for tracing pixels through a sequence.
+struct TraceContext<'a> {
+    fwd: &'a [Flow],
+    bwd: &'a [Flow],
+    known: &'a (dyn Fn(usize, i64, i64) -> bool + Sync),
+    frames: &'a Frames,
+    ref_images: &'a [Option<Image>],
+    w: usize,
+    h: usize,
+    max: usize,
+}
+
+/// Starting frame, point, and direction for a flow trace.
+struct TraceStart {
+    frame: usize,
     x: f64,
     y: f64,
     step: i64,
-    fwd: &[Flow],
-    bwd: &[Flow],
-    known: &dyn Fn(usize, i64, i64) -> bool,
-    frames: &[&Image],
-    max: usize,
-) -> Option<([f32; 4], usize)> {
-    let n = frames.len();
-    let (w, h) = (frames[0].width as f64, frames[0].height as f64);
-    let (mut px, mut py) = (x, y);
-    let mut k = t as i64;
-    for d in 1..=max {
-        let v = if step > 0 {
+}
+
+/// Trace a point to the nearest visible frame: (sampled colour, frames travelled).
+fn trace(context: &TraceContext<'_>, start: TraceStart) -> Option<([f32; 4], usize)> {
+    let n = context.frames.len();
+    let (w, h) = (context.w as f64, context.h as f64);
+    let (mut px, mut py) = (start.x, start.y);
+    let mut k = start.frame as i64;
+    for d in 1..=context.max {
+        let v = if start.step > 0 {
             if k as usize + 1 >= n {
                 return None;
             }
-            fwd[k as usize].at(px, py)
+            context.fwd[k as usize].at(px, py)
         } else {
             if k == 0 {
                 return None;
             }
-            bwd[k as usize - 1].at(px, py)
+            context.bwd[k as usize - 1].at(px, py)
         };
         px += v[0] as f64;
         py += v[1] as f64;
-        k += step;
+        k += start.step;
         if px < 0.0 || py < 0.0 || px >= w || py >= h {
             return None;
         }
@@ -646,137 +1121,419 @@ fn trace(
         let (x0, y0) = ((px - 0.5).floor() as i64, (py - 0.5).floor() as i64);
         let ok = [(x0, y0), (x0 + 1, y0), (x0, y0 + 1), (x0 + 1, y0 + 1)]
             .iter()
-            .all(|&(xx, yy)| known(k as usize, xx.clamp(0, w as i64 - 1), yy.clamp(0, h as i64 - 1)));
+            .all(|&(xx, yy)| (context.known)(k as usize, xx.clamp(0, w as i64 - 1), yy.clamp(0, h as i64 - 1)));
         if ok {
-            return Some((frames[k as usize].sample_bilinear_clamped(px, py), d));
+            let img = if let Some(r) = &context.ref_images[k as usize] {
+                r.sample_bilinear_clamped(px, py)
+            } else {
+                // Samples a pixel; never clones a whole spilled frame (the trace hot path).
+                context.frames.sample(k as usize, px, py)
+            };
+            return Some((img, d));
         }
     }
     None
 }
 
-/// Fill a range of frames. `progress(done, total)` returns `false` to cancel (→ `None`).
+/// A hardware backend for the fill's stages (the GPU compositor implements it; see
+/// `effectcraft_render::Accelerator::inpaint`). Every method has the CPU implementation as its
+/// default, so a backend that cannot take a stage returns the CPU's work and the fill stays
+/// correct — only slower.
+///
+/// The orchestration ([`fill_sequence_with`]) stays on the CPU: the sequence's frame-to-frame
+/// coupling is sequential, and only the per-frame and per-pair work is worth offloading.
+///
+/// **A backend must be safe to call concurrently.** [`fill_sequence_with`] runs the stages of
+/// independent frames and frame pairs in parallel (`rayon`), so `membrane`, `flow` and `patch`
+/// may all be entered from several threads at once — a backend that owns a device must serialise
+/// its use of it (the GPU compositor's per-call encoder does; a backend whose device cannot be
+/// used from several threads must lock).
+pub trait FillBackend: Send + Sync {
+    /// [`membrane_fill`]: the `hole` pixels take the harmonic interpolation of their border.
+    fn membrane(&self, img: &Image, hole: &[bool]) -> Image {
+        membrane_fill(img, hole)
+    }
+    /// `membrane_core`: harmonic interpolation of `data`'s unknown pixels in place (`known` is
+    /// true where the pixel is known).
+    fn membrane_known(&self, data: &mut [[f32; 4]], known: &[bool], w: usize, h: usize) {
+        membrane_core(data, known, w, h)
+    }
+    /// `completed_flow`: block flow `a` → `b` with the tiles touching either hole replaced by
+    /// the membrane interpolation of the surrounding motion.
+    fn flow(&self, a: &Image, b: &Image, hole_a: &[bool], hole_b: &[bool]) -> Flow {
+        completed_flow(a, b, hole_a, hole_b)
+    }
+    /// [`patch_fill`]: PatchMatch synthesis of `img`'s `hole` (`init`: a starting guess, e.g. the
+    /// previous frame's fill warped here).
+    fn patch(&self, img: &Image, hole: &[bool], init: Option<&Image>, patch: usize, seed: u32) -> Image {
+        patch_fill(img, hole, init, patch, seed)
+    }
+}
+
+/// The CPU backend: every stage is the reference implementation.
+pub struct CpuFill;
+
+impl FillBackend for CpuFill {}
+
+/// Holds the propagated frames between the parallel propagation pass and the sequential
+/// synthesis pass. Native builds spill them beside the input, so a whole range is never
+/// resident at once (#2570); wasm keeps them in memory (it has no shared file system).
+enum PropStore {
+    #[cfg(not(target_arch = "wasm32"))]
+    Spilled(SpillHandle),
+    #[cfg(target_arch = "wasm32")]
+    Memory(std::sync::Mutex<Vec<Option<Image>>>),
+}
+
+impl PropStore {
+    /// Open the propagated-frame store: spilled natively, in RAM on wasm.
+    fn new(
+        dir: Option<&std::path::Path>,
+        w: usize,
+        h: usize,
+        n: usize,
+        error: Option<std::sync::Arc<std::sync::Mutex<Option<String>>>>,
+    ) -> std::io::Result<Self> {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            // 32-bit floats: propagating quantized input would lose quality (#2570).
+            Ok(PropStore::Spilled(SpillHandle::create_in_with_error(dir, w, h, n, 32, error)?))
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            let _ = (dir, w, h, error);
+            Ok(PropStore::Memory(std::sync::Mutex::new((0..n).map(|_| None).collect())))
+        }
+    }
+
+    /// Store frame `k`, reporting a spill write failure.
+    fn put(&self, k: usize, img: Image) -> std::result::Result<(), String> {
+        match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            PropStore::Spilled(h) => h.write_frame(k, &img),
+            #[cfg(target_arch = "wasm32")]
+            PropStore::Memory(v) => {
+                let mut v = v.lock().map_err(|_| "propagation store poisoned".to_string())?;
+                if let Some(slot) = v.get_mut(k) {
+                    *slot = Some(img);
+                }
+                Ok(())
+            }
+        }
+    }
+
+    /// Read a stored frame without consuming it (a frame can be shared by two flows).
+    fn get(&self, k: usize) -> Image {
+        match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            PropStore::Spilled(h) => h.get(k),
+            #[cfg(target_arch = "wasm32")]
+            PropStore::Memory(v) => v.lock().ok().and_then(|v| v.get(k).cloned()).flatten().unwrap_or_default(),
+        }
+    }
+
+    /// Read a propagated frame once, freeing it where the backing store allows it.
+    fn take(&self, k: usize) -> Image {
+        match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            PropStore::Spilled(h) => h.get(k),
+            #[cfg(target_arch = "wasm32")]
+            PropStore::Memory(v) => v.lock().ok().and_then(|mut v| v.get_mut(k).and_then(Option::take)).unwrap_or_default(),
+        }
+    }
+
+    /// Record a failure in the spill, so the caller reports it instead of a bare cancellation.
+    fn record_error(&self, message: String) {
+        match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            PropStore::Spilled(h) => h.record_error(message),
+            #[cfg(target_arch = "wasm32")]
+            PropStore::Memory(_) => {
+                let _ = message;
+            }
+        }
+    }
+
+    /// Whether the spill failed (always `false` on wasm, which keeps frames in RAM).
+    fn has_error(&self) -> bool {
+        match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            PropStore::Spilled(h) => h.has_error(),
+            #[cfg(target_arch = "wasm32")]
+            PropStore::Memory(_) => false,
+        }
+    }
+}
+
+/// Publish a scratch failure through the input spill's shared error slot, so the caller reports
+/// the disk error instead of a bare cancellation.
+fn record_spill_error(cell: &Option<std::sync::Arc<std::sync::Mutex<Option<String>>>>, message: String) {
+    if let Some(cell) = cell
+        && let Ok(mut e) = cell.lock()
+        && e.is_none()
+    {
+        *e = Some(message);
+    }
+}
+
+/// Membrane-fill every frame and return the forward/backward flow for each neighbouring pair.
+/// The filled frames are written to a scratch spill, so the flow pass never holds the range in
+/// RAM (#2570).
+#[allow(clippy::too_many_arguments)]
+fn flow_pairs(
+    n: usize,
+    w: usize,
+    h: usize,
+    holes: &[HoleMask],
+    is_ref: &[bool],
+    ref_images: &[Option<Image>],
+    frames: &Frames,
+    prop_dir: Option<&std::path::Path>,
+    error_cell: Option<std::sync::Arc<std::sync::Mutex<Option<String>>>>,
+    backend: &dyn FillBackend,
+) -> Option<Vec<(Flow, Flow)>> {
+    let store = match PropStore::new(prop_dir, w, h, n, error_cell.clone()) {
+        Ok(s) => s,
+        Err(e) => {
+            record_spill_error(&error_cell, format!("spill: {e}"));
+            return None;
+        }
+    };
+    let pre = (0..n).into_par_iter().try_for_each(|t| {
+        let base = if is_ref[t] { ref_images[t].clone().unwrap_or_default() } else { frames.get(t) };
+        let img = backend.membrane(&base, &holes[t].to_vec());
+        store.put(t, img)
+    });
+    if let Err(e) = pre {
+        record_spill_error(&error_cell, e);
+        return None;
+    }
+    if frames.has_error() {
+        return None;
+    }
+    let pairs: Vec<(Flow, Flow)> = (0..n.saturating_sub(1))
+        .into_par_iter()
+        .map(|i| {
+            let a = store.get(i);
+            let b = store.get(i + 1);
+            let ha = holes[i].to_vec();
+            let hb = holes[i + 1].to_vec();
+            (backend.flow(&a, &b, &ha, &hb), backend.flow(&b, &a, &hb, &ha))
+        })
+        .collect();
+    let store_failed = store.has_error();
+    drop(store);
+    if store_failed || frames.has_error() { None } else { Some(pairs) }
+}
+
+/// Fill a range of frames on the CPU. `progress(done, total)` returns `false` to cancel
+/// (→ `None`).
 pub fn fill_sequence(input: &FillInput, o: &FillOpts, progress: &mut dyn FnMut(usize, usize) -> bool) -> Option<Vec<Image>> {
+    fill_sequence_with(input.clone(), o, &CpuFill, progress, None)
+}
+
+/// [`fill_sequence`] with a hardware backend for the stages it can take (see [`FillBackend`]).
+pub fn fill_sequence_with(
+    mut input: FillInput,
+    o: &FillOpts,
+    backend: &dyn FillBackend,
+    progress: &mut dyn FnMut(usize, usize) -> bool,
+    mut sink: Option<&mut dyn FnMut(usize, &Image) -> Result<(), String>>,
+) -> Option<Vec<Image>> {
     let n = input.frames.len();
     if n == 0 {
         return Some(vec![]);
     }
-    let (w, h) = (input.frames[0].width as usize, input.frames[0].height as usize);
+    let (w, h) = input.frames.size().unwrap_or((0, 0));
+    if w == 0 || h == 0 {
+        return Some(vec![]);
+    }
     // Steps: flows (1) + propagation (1) + per-frame synthesis (n).
     let total = n + 2;
+    let streaming = sink.is_some();
     if o.method == FillMethod::EdgeBlend {
         let mut out = Vec::with_capacity(n);
-        for (i, (f, hl)) in input.frames.iter().zip(&input.holes).enumerate() {
-            out.push(opaque_fill(membrane_fill(f, hl), hl));
+        for i in 0..n {
+            let f = input.frames.get(i);
+            // A failed read returns a black frame, which must never reach the sink.
+            if input.frames.has_error() {
+                return None;
+            }
+            let hl = input.holes[i].to_vec();
+            let img = opaque_fill(backend.membrane(&f, &hl), &hl);
+            if let Some(cb) = sink.as_mut()
+                && cb(i, &img).is_err()
+            {
+                return None;
+            }
+            if !streaming {
+                out.push(img);
+            }
             if !progress(i + 1, n) {
                 return None;
             }
         }
+        if input.frames.has_error() {
+            return None;
+        }
+        if streaming {
+            return Some(Vec::new());
+        }
         return Some(out);
     }
     // Reference frames make their frame fully known.
-    let mut frames: Vec<Image> = input.frames.clone();
-    let mut holes: Vec<Vec<bool>> = input.holes.clone();
+    let mut holes: Vec<HoleMask> = std::mem::take(&mut input.holes);
+    let references = std::mem::take(&mut input.references);
     let mut is_ref = vec![false; n];
-    for (k, img) in &input.references {
-        if *k < n && img.width as usize == w && img.height as usize == h {
-            frames[*k] = img.clone();
-            holes[*k] = vec![false; w * h];
-            is_ref[*k] = true;
+    let mut ref_images: Vec<Option<Image>> = vec![None; n];
+    for (k, img) in references {
+        if k < n && img.width as usize == w && img.height as usize == h {
+            ref_images[k] = Some(img);
+            holes[k] = HoleMask::zeros(w * h);
+            is_ref[k] = true;
         }
     }
-    // 1. Flows between membrane-filled neighbours, completed inside the holes.
-    let pre: Vec<Image> = frames.par_iter().zip(&holes).map(|(f, hl)| membrane_fill(f, hl)).collect();
-    let pairs: Vec<(Flow, Flow)> = (0..n.saturating_sub(1))
-        .into_par_iter()
-        .map(|i| (completed_flow(&pre[i], &pre[i + 1], &holes[i], &holes[i + 1]), completed_flow(&pre[i + 1], &pre[i], &holes[i + 1], &holes[i])))
-        .collect();
+    let prop_dir = input.frames.scratch_dir();
+    let error_cell = input.frames.error_cell();
+    // 1. Flows between membrane-filled neighbours, completed inside the holes. The
+    // membrane-filled frames are spilled too, so the flow pass does not hold the range.
+    let pairs = flow_pairs(n, w, h, &holes, &is_ref, &ref_images, &input.frames, prop_dir.as_deref(), error_cell.clone(), backend)?;
     let (fwd, bwd): (Vec<Flow>, Vec<Flow>) = pairs.into_iter().unzip();
     if !progress(1, total) {
         return None;
     }
-    // 2. Propagation (and the lighting-correction border ring).
-    let refs: Vec<&Image> = frames.iter().collect();
-    let known = |k: usize, x: i64, y: i64| !holes[k][y as usize * w + x as usize];
+    // 2. Propagation (and the lighting-correction border ring). The filled frames are
+    // spilled as they are produced, so only the leftover masks stay in RAM.
+    let store = match PropStore::new(prop_dir.as_deref(), w, h, n, error_cell.clone()) {
+        Ok(s) => s,
+        Err(e) => {
+            record_spill_error(&error_cell, format!("spill: {e}"));
+            return None;
+        }
+    };
+    let known = |k: usize, x: i64, y: i64| !holes[k].get(y as usize * w + x as usize);
+    let trace_context = TraceContext { fwd: &fwd, bwd: &bwd, known: &known, frames: &input.frames, ref_images: &ref_images, w, h, max: n };
     let ring_r = 2usize;
-    let propagated: Vec<(Image, Vec<bool>)> = (0..n)
+    let propagated_left: Vec<HoleMask> = (0..n)
         .into_par_iter()
         .map(|t| {
-            let mut img = frames[t].clone();
-            let mut left = holes[t].clone();
-            if is_ref[t] || !holes[t].iter().any(|b| *b) {
-                return (img, left);
+            // Once a frame failed to spill or read the fill is lost: stop tracing the rest (the
+            // masks are dropped below).
+            if store.has_error() || input.frames.has_error() {
+                return HoleMask::default();
             }
-            let sample = |i: usize| -> Option<[f32; 4]> {
-                let (x, y) = ((i % w) as f64 + 0.5, (i / w) as f64 + 0.5);
-                let f = trace(t, x, y, 1, &fwd, &bwd, &known, &refs, n);
-                let b = trace(t, x, y, -1, &fwd, &bwd, &known, &refs, n);
-                match (f, b) {
-                    (Some((a, da)), Some((c, dc))) => {
-                        let (wa, wc) = (1.0 / da as f32, 1.0 / dc as f32);
-                        Some(std::array::from_fn(|k| (a[k] * wa + c[k] * wc) / (wa + wc)))
+            let mut img = if is_ref[t] { ref_images[t].clone().unwrap_or_default() } else { input.frames.get(t) };
+            let mut left = holes[t].to_vec();
+            if !is_ref[t] && holes[t].any() {
+                let sample = |i: usize| -> Option<[f32; 4]> {
+                    let (x, y) = ((i % w) as f64 + 0.5, (i / w) as f64 + 0.5);
+                    let f = trace(&trace_context, TraceStart { frame: t, x, y, step: 1 });
+                    let b = trace(&trace_context, TraceStart { frame: t, x, y, step: -1 });
+                    match (f, b) {
+                        (Some((a, da)), Some((c, dc))) => {
+                            let (wa, wc) = (1.0 / da as f32, 1.0 / dc as f32);
+                            Some(std::array::from_fn(|k| (a[k] * wa + c[k] * wc) / (wa + wc)))
+                        }
+                        (Some((a, _)), None) | (None, Some((a, _))) => Some(a),
+                        _ => None,
                     }
-                    (Some((a, _)), None) | (None, Some((a, _))) => Some(a),
-                    _ => None,
+                };
+                let filled: Vec<(usize, [f32; 4])> = (0..w * h).filter(|&i| holes[t].get(i)).filter_map(|i| sample(i).map(|v| (i, v))).collect();
+                for (i, v) in &filled {
+                    img.data[*i] = *v;
+                    left[*i] = false;
                 }
-            };
-            let filled: Vec<(usize, [f32; 4])> = (0..w * h).filter(|&i| holes[t][i]).filter_map(|i| sample(i).map(|v| (i, v))).collect();
-            for (i, v) in &filled {
-                img.data[*i] = *v;
-                left[*i] = false;
-            }
-            // Lighting correction: membrane of the border mismatch, added to propagated pixels.
-            if o.lighting > 0.0 && !filled.is_empty() {
-                let grown = dilate(&holes[t], w, h, ring_r);
-                let mut diff = vec![[0.0f32; 4]; w * h];
-                let mut dk = vec![true; w * h];
-                for i in 0..w * h {
-                    if holes[t][i] {
-                        dk[i] = false;
-                    } else if grown[i]
-                        && let Some(v) = sample(i)
-                    {
-                        let a = frames[t].data[i];
-                        diff[i] = std::array::from_fn(|c| if c < 3 { a[c] - v[c] } else { 0.0 });
+                // Lighting correction: membrane of the border mismatch, added to propagated pixels.
+                // Non-hole pixels are untouched above, so `img` is still the original there.
+                if o.lighting > 0.0 && !filled.is_empty() {
+                    let grown = dilate(&holes[t].to_vec(), w, h, ring_r);
+                    let mut diff = vec![[0.0f32; 4]; w * h];
+                    let mut dk = vec![true; w * h];
+                    for i in 0..w * h {
+                        if holes[t].get(i) {
+                            dk[i] = false;
+                        } else if grown[i]
+                            && let Some(v) = sample(i)
+                        {
+                            let a = img.data[i];
+                            diff[i] = std::array::from_fn(|c| if c < 3 { a[c] - v[c] } else { 0.0 });
+                        }
                     }
-                }
-                membrane_core(&mut diff, &dk, w, h);
-                for (i, _) in &filled {
-                    for c in 0..3 {
-                        img.data[*i][c] += o.lighting * diff[*i][c];
+                    backend.membrane_known(&mut diff, &dk, w, h);
+                    for (i, _) in &filled {
+                        for c in 0..3 {
+                            img.data[*i][c] += o.lighting * diff[*i][c];
+                        }
                     }
                 }
             }
-            (img, left)
+            if let Err(e) = store.put(t, img) {
+                store.record_error(e);
+            }
+            HoleMask::from_vec(&left)
         })
         .collect();
+    if input.frames.has_error() || store.has_error() {
+        return None;
+    }
+    drop(input);
     if !progress(2, total) {
         return None;
     }
     // 3. Synthesis of what no frame shows.
     let mut out: Vec<Option<Image>> = vec![None; n];
-    let first = (0..n).find(|&t| propagated[t].1.iter().any(|b| *b));
+    let first = (0..n).find(|&t| propagated_left[t].any());
     let Some(t0) = first else {
-        return Some(propagated.into_iter().zip(&holes).map(|((img, _), hl)| opaque_fill(img, hl)).collect());
+        if streaming {
+            for t in 0..n {
+                let img = opaque_fill(take_checked(&store, t)?, &holes[t].to_vec());
+                if !stream_frame(&mut sink, t, Some(&img), &holes) {
+                    return None;
+                }
+            }
+            return Some(Vec::new());
+        }
+        let out: Vec<Image> = (0..n).map(|t| opaque_fill(store.take(t), &holes[t].to_vec())).collect();
+        if store.has_error() {
+            return None;
+        }
+        return Some(out);
     };
     // Frames before t0 are complete already.
-    for (t, slot) in out.iter_mut().enumerate().take(t0) {
-        *slot = Some(propagated[t].0.clone());
+    for t in 0..t0 {
+        let img = take_checked(&store, t)?;
+        if streaming {
+            if !stream_frame(&mut sink, t, Some(&img), &holes) {
+                return None;
+            }
+        } else {
+            out[t] = Some(img);
+        }
     }
     let mut done = 2;
-    out[t0] = Some(patch_fill(&propagated[t0].0, &propagated[t0].1, None, o.patch, o.seed));
+    let left0 = propagated_left[t0].to_vec();
+    out[t0] = Some(backend.patch(&take_checked(&store, t0)?, &left0, None, o.patch, o.seed));
+    if !stream_frame(&mut sink, t0, out[t0].as_ref(), &holes) {
+        return None;
+    }
     done += 1;
     if !progress(done, total) {
         return None;
     }
     for t in t0 + 1..n {
-        let (img, left) = &propagated[t];
-        if !left.iter().any(|b| *b) {
-            out[t] = Some(img.clone());
+        let complete = !propagated_left[t].any();
+        if complete {
+            out[t] = Some(take_checked(&store, t)?);
         } else {
+            let img = take_checked(&store, t)?;
+            let left = propagated_left[t].to_vec();
             // Warp the previous result here along the backward flow (t → t − 1).
             // Frames after `t0` are filled in order, so the previous one is set.
             let Some(prev) = out[t - 1].as_ref() else {
-                out[t] = Some(patch_fill(img, left, None, o.patch, o.seed));
+                out[t] = Some(backend.patch(&img, &left, None, o.patch, o.seed));
+                if !stream_frame(&mut sink, t, out[t].as_ref(), &holes) {
+                    return None;
+                }
                 continue;
             };
             let mut warped = img.clone();
@@ -789,15 +1546,47 @@ pub fn fill_sequence(input: &FillInput, o: &FillOpts, progress: &mut dyn FnMut(u
             }
             out[t] = Some(match o.method {
                 FillMethod::Surface => warped,
-                _ => patch_fill(img, left, Some(&warped), o.patch, o.seed),
+                _ => backend.patch(&img, &left, Some(&warped), o.patch, o.seed),
             });
         }
+        // Only the streaming sink has consumed the frame; a non-streaming result returns it.
+        if streaming && t >= 2 {
+            out[t - 2] = None;
+        }
+        if !stream_frame(&mut sink, t, out[t].as_ref(), &holes) {
+            return None;
+        }
         done += 1;
         if !progress(done, total) {
             return None;
         }
     }
-    Some(out.into_iter().zip(&holes).map(|(img, hl)| opaque_fill(img.unwrap_or_default(), hl)).collect())
+    if store.has_error() {
+        return None;
+    }
+    if streaming {
+        for slot in out.iter_mut() {
+            *slot = None;
+        }
+        return Some(Vec::new());
+    }
+    Some(out.into_iter().enumerate().map(|(i, img)| opaque_fill(img.unwrap_or_default(), &holes[i].to_vec())).collect())
+}
+
+/// Take frame `k` from the store, or `None` when the spill read failed. A failed read yields a
+/// black frame, which must never be emitted (#2570 review).
+fn take_checked(store: &PropStore, k: usize) -> Option<Image> {
+    let img = store.take(k);
+    (!store.has_error()).then_some(img)
+}
+
+/// Hand frame `t` to the streaming sink with its filled pixels made opaque. `true` when there is
+/// no sink or it accepted the frame.
+fn stream_frame(sink: &mut Option<&mut dyn FnMut(usize, &Image) -> Result<(), String>>, t: usize, img: Option<&Image>, holes: &[HoleMask]) -> bool {
+    let (Some(cb), Some(img)) = (sink.as_mut(), img) else {
+        return true;
+    };
+    cb(t, &opaque_fill(img.clone(), &holes[t].to_vec())).is_ok()
 }
 
 /// Filled pixels are opaque.
@@ -844,6 +1633,47 @@ mod tests {
         (0..w * h).map(|i| (x0..x0 + s).contains(&(i % w)) && (y0..y0 + s).contains(&(i / w))).collect()
     }
 
+    /// Packing and unpacking a hole mask round-trips every pixel.
+    #[test]
+    fn holemask_roundtrip() {
+        let v: Vec<bool> = (0..1000).map(|i| i % 3 == 0).collect();
+        let m = HoleMask::from_vec(&v);
+        assert_eq!(m.to_vec(), v);
+        for i in 0..v.len() {
+            assert_eq!(m.get(i), v[i]);
+        }
+    }
+
+    /// Packing round-trips where the last word is full, holds one bit or is one bit short, and
+    /// `set` builds the same mask; a mask whose public `words` are shorter than `len` reads and
+    /// writes without panicking (#2570 review).
+    #[test]
+    fn holemask_roundtrips_at_word_boundaries() {
+        for len in [1usize, 63, 64, 65, 127, 128, 129, 191, 192] {
+            let v: Vec<bool> = (0..len).map(|i| i % 3 == 0 || i == len - 1).collect();
+            let m = HoleMask::from_vec(&v);
+            assert_eq!(m.words.len(), len.div_ceil(64), "len {len}");
+            assert_eq!(m.to_vec(), v, "len {len}");
+            let mut s = HoleMask::zeros(len);
+            for (i, &h) in v.iter().enumerate() {
+                s.set(i, h);
+            }
+            assert_eq!(s, m, "len {len}: set builds the packed mask");
+            for i in 0..len {
+                s.set(i, false);
+            }
+            assert!(!s.any(), "len {len}: every pixel cleared");
+            // A pixel past the end is ignored.
+            s.set(len, true);
+            assert!(!s.get(len), "len {len}");
+            assert!(!s.any(), "len {len}");
+        }
+        let mut short = HoleMask { words: vec![], len: 100 };
+        assert!(!short.get(70));
+        short.set(70, true);
+        assert!(!short.any());
+    }
+
     #[test]
     fn membrane_matches_a_linear_ramp() {
         let (w, h) = (40u32, 30u32);
@@ -887,10 +1717,10 @@ mod tests {
             let gt = background(w, h, t as f32 * pan);
             let hole = rect_hole(w, h, 10 + 8 * t as u32, 22, 18);
             frames.push(cut(&gt, &hole));
-            holes.push(hole);
+            holes.push(HoleMask::from_vec(&hole));
             gts.push(gt);
         }
-        (FillInput { frames, holes, references: vec![] }, gts)
+        (FillInput { frames: Frames::Memory(frames), holes, references: vec![] }, gts)
     }
 
     #[test]
@@ -899,7 +1729,7 @@ mod tests {
             let (input, gts) = sequence(8, pan);
             let out = fill_sequence(&input, &FillOpts::default(), &mut |_, _| true).expect("fill");
             for t in 0..out.len() {
-                let db = psnr(&out[t], &gts[t], Some(&input.holes[t]));
+                let db = psnr(&out[t], &gts[t], Some(&input.holes[t].to_vec()));
                 assert!(db > 26.0, "frame {t} pan {pan}: {db:.1} dB");
                 assert_eq!(out[t].data[0][3], 1.0);
             }
@@ -907,7 +1737,7 @@ mod tests {
                 // Temporal consistency: on a static background the filled pixels agree between
                 // frames.
                 for t in 1..out.len() {
-                    let both: Vec<bool> = input.holes[t].iter().zip(&input.holes[t - 1]).map(|(a, b)| *a || *b).collect();
+                    let both: Vec<bool> = input.holes[t].to_vec().iter().zip(input.holes[t - 1].to_vec().iter()).map(|(a, b)| *a || *b).collect();
                     let db = psnr(&out[t], &out[t - 1], Some(&both));
                     assert!(db > 30.0, "frames {}–{t} differ: {db:.1} dB", t - 1);
                 }
@@ -921,14 +1751,14 @@ mod tests {
         let (w, h) = (80u32, 60u32);
         let gt = background(w, h, 0.0);
         let hole = rect_hole(w, h, 30, 20, 14);
-        let input = FillInput { frames: vec![cut(&gt, &hole); 4], holes: vec![hole.clone(); 4], references: vec![] };
+        let input = FillInput { frames: Frames::Memory(vec![cut(&gt, &hole); 4]), holes: vec![HoleMask::from_vec(&hole); 4], references: vec![] };
         let surf = fill_sequence(&input, &FillOpts { method: FillMethod::Surface, ..Default::default() }, &mut |_, _| true).expect("fill");
         for t in 1..4 {
             // Surface carries one fill through: identical frames.
             assert!(psnr(&surf[t], &surf[0], Some(&hole)) > 40.0);
         }
         let edge = fill_sequence(&input, &FillOpts { method: FillMethod::EdgeBlend, ..Default::default() }, &mut |_, _| true).expect("fill");
-        assert!(psnr(&edge[0], &membrane_fill(&input.frames[0], &hole), Some(&hole)) > 60.0);
+        assert!(psnr(&edge[0], &membrane_fill(&input.frames.get(0), &hole), Some(&hole)) > 60.0);
         // A clean reference frame recovers the background exactly.
         let mut with_ref = FillInput { frames: input.frames.clone(), holes: input.holes.clone(), references: vec![(2, gt.clone())] };
         let out = fill_sequence(&with_ref, &FillOpts::default(), &mut |_, _| true).expect("fill");
@@ -944,9 +1774,13 @@ mod tests {
     fn lighting_correction_absorbs_a_brightness_change() {
         // The background brightens over time; propagated pixels come from darker frames.
         let (mut input, mut gts) = sequence(6, 0.0);
+        let mut frames = match std::mem::replace(&mut input.frames, Frames::Memory(vec![])) {
+            Frames::Memory(v) => v,
+            _ => vec![],
+        };
         for t in 0..6 {
             let k = 1.0 + 0.06 * t as f32;
-            for img in [&mut input.frames[t], &mut gts[t]] {
+            for img in [&mut frames[t], &mut gts[t]] {
                 for p in &mut img.data {
                     for c in 0..3 {
                         p[c] *= k;
@@ -954,9 +1788,288 @@ mod tests {
                 }
             }
         }
+        input.frames = Frames::Memory(frames);
         let plain = fill_sequence(&input, &FillOpts::default(), &mut |_, _| true).expect("fill");
         let lit = fill_sequence(&input, &FillOpts { lighting: 1.0, ..Default::default() }, &mut |_, _| true).expect("fill");
-        let score = |o: &[Image]| (0..6).map(|t| psnr(&o[t], &gts[t], Some(&input.holes[t]))).sum::<f64>();
+        let score = |o: &[Image]| (0..6).map(|t| psnr(&o[t], &gts[t], Some(&input.holes[t].to_vec()))).sum::<f64>();
         assert!(score(&lit) > score(&plain), "lit {} vs plain {}", score(&lit), score(&plain));
     }
+
+    /// `SpillHandle::sample` reads only the 2x2 support; it must still agree with sampling the
+    /// decoded frame, including the edges and coordinates outside the image (#2570 review).
+    #[test]
+    fn spilled_samples_match_the_decoded_frame() {
+        let (w, h, n) = (7u32, 5u32, 3usize);
+        for bpc in [8u8, 32] {
+            let mut frames = Vec::new();
+            for k in 0..n {
+                let mut img = Image::new(w, h);
+                for (i, p) in img.data.iter_mut().enumerate() {
+                    *p = [(i % 7) as f32 / 7.0, (k * 3 + i % 5) as f32 / 5.0, 0.25, 1.0];
+                }
+                frames.push(img);
+            }
+            let spill = SpillHandle::create(w as usize, h as usize, n, bpc).expect("spill");
+            for (k, img) in frames.iter().enumerate() {
+                spill.write_frame(k, img).expect("write");
+            }
+            let spilled = Frames::Spilled(spill.clone());
+            assert!(!spilled.has_error());
+            for k in 0..n {
+                let decoded = spill.get(k);
+                for &(x, y) in &[(0.0, 0.0), (0.5, 0.5), (3.4, 2.6), (6.5, 4.5), (7.9, 5.9), (-1.0, -1.0), (2.25, 3.75)] {
+                    let a = spilled.sample(k, x, y);
+                    let b = decoded.sample_bilinear_clamped(x, y);
+                    for c in 0..4 {
+                        assert!((a[c] - b[c]).abs() <= 1e-6, "bpc {bpc} frame {k} at ({x}, {y}) channel {c}: {} vs {}", a[c], b[c]);
+                    }
+                }
+            }
+            assert!(!spilled.has_error(), "sampling a valid spill records no error");
+        }
+    }
+
+    /// The input's error slot is shared with the membrane and propagation spills, so one probe
+    /// reports any scratch failure (#2570 review).
+    #[test]
+    fn a_secondary_spill_reports_through_the_input_error_slot() {
+        let input = SpillHandle::create(4, 4, 2, 32).expect("input spill");
+        let prop = SpillHandle::create_in_with_error(None, 4, 4, 2, 32, Some(input.error_cell())).expect("prop spill");
+        prop.record_error("spill: No space left on device".into());
+        assert!(input.has_error());
+        assert_eq!(input.take_error().as_deref(), Some("spill: No space left on device"));
+        assert!(!prop.has_error(), "take clears the shared slot");
+    }
+
+    /// A spill whose scratch folder cannot be created is an error, not a silent fallback.
+    #[test]
+    fn a_spill_that_cannot_create_its_folder_is_an_error() {
+        let dir = tempfile::tempdir().expect("temp");
+        let file = dir.path().join("not-a-folder");
+        std::fs::write(&file, b"x").expect("write");
+        assert!(SpillHandle::create_in(Some(&file), 4, 4, 1, 32).is_err());
+    }
+
+    /// The scratch file has no name in its folder, so a fill that is killed partway through
+    /// leaves nothing behind, and every read and write still reaches the frames (#2570 review).
+    #[test]
+    fn a_spill_leaves_no_file_in_its_folder() {
+        let dir = tempfile::tempdir().expect("temp");
+        let spill = SpillHandle::create_in(Some(dir.path()), 4, 3, 2, 32).expect("spill");
+        let mut img = Image::new(4, 3);
+        for (i, p) in img.data.iter_mut().enumerate() {
+            *p = [i as f32 / 12.0, 0.5, 0.25, 1.0];
+        }
+        spill.write_frame(1, &img).expect("write");
+        assert_eq!(spill.get(1).data, img.data);
+        assert!(!spill.has_error());
+        assert_eq!(spill.dir(), Some(dir.path()));
+        assert_eq!(Frames::Spilled(spill.clone()).scratch_dir().as_deref(), Some(dir.path()));
+        // Elsewhere the file is unlinked as soon as it is made; Windows keeps a delete-on-close
+        // file listed until its last handle closes.
+        #[cfg(not(windows))]
+        assert_eq!(std::fs::read_dir(dir.path()).expect("list").count(), 0, "the open spill has a name in the folder");
+        drop(spill);
+        assert_eq!(std::fs::read_dir(dir.path()).expect("list").count(), 0, "scratch left in the folder");
+    }
+
+    /// The same frames spilled to 32 bpc scratch.
+    fn spill_frames(frames: &Frames) -> SpillHandle {
+        let (w, h) = frames.size().expect("size");
+        let spill = SpillHandle::create(w, h, frames.len(), 32).expect("spill");
+        for k in 0..frames.len() {
+            spill.write_frame(k, &frames.get(k)).expect("write");
+        }
+        spill
+    }
+
+    /// Every channel of every pixel, as bits.
+    fn bits(img: &Image) -> Vec<u32> {
+        img.data.iter().flatten().map(|v| v.to_bits()).collect()
+    }
+
+    /// A spilled range fills bit-identically to the same frames in RAM, streamed or returned: the
+    /// spill keeps 32-bit floats and samples the same 2x2 support (#2570, "no quality loss").
+    #[test]
+    fn a_spilled_range_fills_exactly_like_one_in_memory() {
+        let (input, _) = sequence(6, 1.0);
+        for method in [FillMethod::Object, FillMethod::Surface, FillMethod::EdgeBlend] {
+            let opts = FillOpts { method, lighting: 0.5, ..Default::default() };
+            let memory = fill_sequence(&input, &opts, &mut |_, _| true).expect("memory fill");
+            let spilled = FillInput { frames: Frames::Spilled(spill_frames(&input.frames)), holes: input.holes.clone(), references: vec![] };
+            let returned = fill_sequence(&spilled, &opts, &mut |_, _| true).expect("spilled fill");
+            let mut streamed = Vec::new();
+            let mut sink = |_: usize, img: &Image| -> Result<(), String> {
+                streamed.push(img.clone());
+                Ok(())
+            };
+            let rest = fill_sequence_with(spilled, &opts, &CpuFill, &mut |_, _| true, Some(&mut sink));
+            assert!(rest.is_some_and(|v| v.is_empty()), "{method:?}: the sink took every frame");
+            assert_eq!((memory.len(), returned.len(), streamed.len()), (6, 6, 6), "{method:?}");
+            for t in 0..6 {
+                assert!(bits(&returned[t]) == bits(&memory[t]), "{method:?} frame {t}: spilled fill differs from RAM");
+                assert!(bits(&streamed[t]) == bits(&memory[t]), "{method:?} frame {t}: streamed fill differs from RAM");
+            }
+        }
+    }
+
+    /// The sink sees every frame once and strictly in order, whichever stage finishes it: the
+    /// complete frames before the first synthesised one, the synthesised run, and Edge Blend.
+    #[test]
+    fn the_sink_sees_frames_in_order() {
+        let (input, gts) = sequence(8, 1.0);
+        let mut frames: Vec<Image> = (0..8).map(|k| input.frames.get(k)).collect();
+        let mut holes = input.holes.clone();
+        // The first two frames are clean, so they stream ahead of the first synthesised frame.
+        for k in 0..2 {
+            frames[k] = gts[k].clone();
+            holes[k] = HoleMask::zeros(frames[k].data.len());
+        }
+        let input = FillInput { frames: Frames::Spilled(spill_frames(&Frames::Memory(frames))), holes, references: vec![] };
+        for method in [FillMethod::Object, FillMethod::Surface, FillMethod::EdgeBlend] {
+            let mut seen = Vec::new();
+            let mut sink = |t: usize, _: &Image| -> Result<(), String> {
+                seen.push(t);
+                Ok(())
+            };
+            let out = fill_sequence_with(input.clone(), &FillOpts { method, ..Default::default() }, &CpuFill, &mut |_, _| true, Some(&mut sink));
+            assert!(out.is_some(), "{method:?}");
+            assert_eq!(seen, (0..8).collect::<Vec<_>>(), "{method:?}");
+        }
+    }
+
+    /// A spill that cannot be read fails the fill with the disk error in the slot the caller
+    /// probes, and the black fallback frame never reaches the sink (#2570 review).
+    #[test]
+    fn a_spill_read_failure_is_an_error_and_never_streamed() {
+        let (input, _) = sequence(4, 1.0);
+        let spill = spill_frames(&input.frames);
+        // Truncate the scratch under the fill: every read comes back short.
+        spill.inner.file.set_len(0).expect("truncate");
+        for method in [FillMethod::Object, FillMethod::Surface, FillMethod::EdgeBlend] {
+            let mut seen = Vec::new();
+            let mut sink = |t: usize, _: &Image| -> Result<(), String> {
+                seen.push(t);
+                Ok(())
+            };
+            let failed = FillInput { frames: Frames::Spilled(spill.clone()), holes: input.holes.clone(), references: vec![] };
+            let out = fill_sequence_with(failed, &FillOpts { method, ..Default::default() }, &CpuFill, &mut |_, _| true, Some(&mut sink));
+            assert!(out.is_none(), "{method:?}");
+            assert!(seen.is_empty(), "{method:?}: streamed frames {seen:?} from an unreadable spill");
+            let e = spill.take_error().expect("the read failure is recorded");
+            assert!(e.starts_with("spill:"), "{method:?}: {e}");
+        }
+    }
+
+    /// A scratch failure while the output streams stops the fill before the next frame reaches
+    /// the sink, and leaves the failure for the caller to report.
+    #[test]
+    fn a_spill_failure_mid_stream_stops_before_the_next_frame() {
+        let (input, _) = sequence(6, 1.0);
+        let spill = spill_frames(&input.frames);
+        let cell = spill.error_cell();
+        let mut seen = Vec::new();
+        let mut sink = |t: usize, _: &Image| -> Result<(), String> {
+            seen.push(t);
+            if t == 2 {
+                *cell.lock().unwrap() = Some("spill: injected".into());
+            }
+            Ok(())
+        };
+        let streamed = FillInput { frames: Frames::Spilled(spill.clone()), holes: input.holes.clone(), references: vec![] };
+        let out = fill_sequence_with(streamed, &FillOpts::default(), &CpuFill, &mut |_, _| true, Some(&mut sink));
+        assert!(out.is_none());
+        assert_eq!(seen, vec![0, 1, 2]);
+        assert_eq!(spill.take_error().as_deref(), Some("spill: injected"));
+    }
+
+    /// Once a propagated frame fails to spill, the other propagation workers stop instead of
+    /// tracing the rest of a range whose fill is already lost (#2570 review).
+    #[test]
+    fn propagation_stops_after_a_spill_failure() {
+        /// Fails the spill from inside the propagation stage (Lighting Correction's membrane).
+        struct FailInPropagation {
+            cell: std::sync::Arc<std::sync::Mutex<Option<String>>>,
+            calls: std::sync::atomic::AtomicUsize,
+        }
+        impl FillBackend for FailInPropagation {
+            fn membrane_known(&self, data: &mut [[f32; 4]], known: &[bool], w: usize, h: usize) {
+                self.calls.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                *self.cell.lock().unwrap() = Some("spill: injected".into());
+                membrane_core(data, known, w, h);
+            }
+        }
+        let (input, _) = sequence(6, 1.0);
+        let spill = spill_frames(&input.frames);
+        let backend = FailInPropagation { cell: spill.error_cell(), calls: std::sync::atomic::AtomicUsize::new(0) };
+        let input = FillInput { frames: Frames::Spilled(spill.clone()), holes: input.holes, references: vec![] };
+        let opts = FillOpts { lighting: 1.0, ..Default::default() };
+        // One worker, so the frames run one after another and the count is exact.
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(1).build().unwrap();
+        let out = pool.install(|| fill_sequence_with(input, &opts, &backend, &mut |_, _| true, None));
+        assert!(out.is_none());
+        assert_eq!(backend.calls.load(std::sync::atomic::Ordering::SeqCst), 1, "propagation kept going after the failure");
+        assert_eq!(spill.take_error().as_deref(), Some("spill: injected"));
+    }
+
+    /// Peak RSS of one synthetic fill, quoted in the PR. Ignored so CI does not run it. Run it
+    /// under `/usr/bin/time -v` and read `VmHWM` (`Maximum resident set size`):
+    ///
+    /// ```text
+    /// cargo test -p effectcraft-raster --lib measure_peak_rss --no-run
+    /// target/debug/deps/effectcraft_raster-* inpaint::tests::measure_peak_rss_of_a_fill \
+    ///     --ignored --exact --nocapture --test-threads=1
+    /// ```
+    ///
+    /// `RAYON_NUM_THREADS`, `MEASURE_LIGHTING=1` and `MEASURE_FRAMES` select the configuration.
+    /// Measured on 18 workers (2026-11-04): 90 frames of 640×360 peak at 340–470 MB across runs
+    /// (35 MB with one worker) and 600 frames at 582 MB, i.e. ~7 frames of scratch a worker, so
+    /// the guard budgets 8 (9 with Lighting Correction) (#2570).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    #[ignore = "memory measurement; run explicitly"]
+    fn measure_peak_rss_of_a_fill() {
+        let n: usize = std::env::var("MEASURE_FRAMES").ok().and_then(|v| v.parse().ok()).unwrap_or(90);
+        let (w, h) = (640u32, 360u32);
+        let spill = SpillHandle::create_in(None, w as usize, h as usize, n, 32).expect("spill");
+        let hole = rect_hole(w, h, 240, 120, 160);
+        let mut holes = Vec::with_capacity(n);
+        for k in 0..n {
+            let img = background(w, h, 2.0 * k as f32);
+            spill.write_frame(k, &img).expect("write");
+            holes.push(HoleMask::from_vec(&hole));
+        }
+        let input = FillInput { frames: Frames::Spilled(spill), holes, references: vec![] };
+        // MEASURE_LIGHTING=1 exercises the propagation ring too (one process per reading: VmHWM
+        // never goes down).
+        let lighting = std::env::var("MEASURE_LIGHTING").is_ok_and(|v| v == "1");
+        let opts = FillOpts { method: FillMethod::Surface, lighting: if lighting { 1.0 } else { 0.0 }, ..Default::default() };
+        let before = peak_rss_kb();
+        let started = std::time::Instant::now();
+        let mut sink = |_: usize, _: &Image| -> Result<(), String> { Ok(()) };
+        let out = fill_sequence_with(input, &opts, &CpuFill, &mut |_, _| true, Some(&mut sink));
+        eprintln!(
+            "measure_peak_rss: {n} frames of {w}x{h}, surface, lighting={}, {:.2}s, peak RSS {} KB -> {} KB",
+            if lighting { "on" } else { "off" },
+            started.elapsed().as_secs_f64(),
+            before.unwrap_or(0),
+            peak_rss_kb().unwrap_or(0)
+        );
+        assert!(out.is_some_and(|v| v.is_empty()), "the sink consumed every frame");
+    }
+
+    /// Peak resident set size of this process (`VmHWM`), in kilobytes.
+    #[cfg(target_os = "linux")]
+    fn peak_rss_kb() -> Option<u64> {
+        std::fs::read_to_string("/proc/self/status").ok()?.lines().find_map(|l| {
+            let v = l.strip_prefix("VmHWM:")?;
+            v.split_whitespace().next()?.parse().ok()
+        })
+    }
+
+    /// Peak resident set size is only measured on Linux.
+    #[cfg(not(target_os = "linux"))]
+    fn peak_rss_kb() -> Option<u64> {
+        None
+    }
 }
diff --git a/crates/raster/src/lib.rs b/crates/raster/src/lib.rs
index f17602829..fd2fd183b 100644
--- a/crates/raster/src/lib.rs
+++ b/crates/raster/src/lib.rs
@@ -12,16 +12,44 @@ pub mod flow;
 pub mod inpaint;
 pub mod scopes;
 pub mod warp;
+pub mod yuv;
 
 use effectcraft_color::{BlendMode, blend_pixel};
 use rayon::prelude::*;
 
-pub use blur::{box_blur, directional_blur, gaussian_blur, radial_blur};
+pub use blur::{box_blur, directional_blur, gaussian_blur, gaussian_blur_exact, gaussian_is_exact, radial_blur};
 pub use channels3d::AuxChannels;
-pub use warp::{Sampling, WarpOpts, accumulate_warp, composite_warp, composite_warp_reference, resample};
+pub use warp::{Sampling, WarpOpts, accumulate_warp, composite_warp, composite_warp_changed, composite_warp_reference, resample};
 
 pub type Px = [f32; 4];
 
+/// Maximum padded side in pixels — mirrors the project crate's `limits::MAX_SIZE` (30 000;
+/// raster sits below it in the layering and may not depend on it, so the two must stay equal).
+/// A padded side beyond the largest supported comp side has no render use.
+pub const MAX_PADDED_SIDE: u32 = 30_000;
+
+/// Clamp (colour ≤ alpha ≤ 1, NaN → 0) and round half up to `levels` steps (`inv` = 1 / levels):
+/// one pixel of an 8/16 bpc buffer. Values are non-negative after the clamp, so the integer
+/// conversion rounds like `round()` and vectorises.
+#[allow(clippy::manual_clamp)] // max/min map NaN to 0; clamp would keep NaN
+#[inline(always)]
+pub fn quantize_px(p: &mut Px, levels: f32, inv: f32) {
+    let a = round_half_up(p[3].max(0.0).min(1.0) * levels) * inv;
+    let hi = [a, a, a, a];
+    for c in 0..3 {
+        p[c] = round_half_up(p[c].max(0.0).min(hi[c]) * levels) * inv;
+    }
+    p[3] = a;
+}
+
+/// `v` (0..=65 535) rounded half up. The same either way; the fastest on each target: x86-64's
+/// baseline converts to integers in one instruction but has no `floor` (SSE4.1), while in wasm
+/// `floor` is one instruction and converting back from `u32` several (about 1.5× faster there).
+#[inline(always)]
+fn round_half_up(v: f32) -> f32 {
+    if cfg!(target_arch = "wasm32") { (v + 0.5).floor() } else { (v + 0.5) as u32 as f32 }
+}
+
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Image {
     pub width: u32,
@@ -138,13 +166,28 @@ impl Image {
         }
         o
     }
-    /// Copy with `pad` transparent pixels on every side.
+    /// The pad [`Image::padded`] applies for a requested `pad`: clamped so neither output side
+    /// exceeds [`MAX_PADDED_SIDE`]. At most `(MAX_PADDED_SIDE - side) / 2`, so
+    /// `side + 2 · pad ≤ MAX_PADDED_SIDE` and overflow is unreachable by construction (a side
+    /// already past the cap gets pad 0). Callers that track where the pixels went (a buffer
+    /// offset) must move by this, not by the requested pad.
+    pub fn effective_pad(&self, pad: u32) -> u32 {
+        pad.min(MAX_PADDED_SIDE.saturating_sub(self.width) / 2).min(MAX_PADDED_SIDE.saturating_sub(self.height) / 2)
+    }
+    /// Copy with [`Image::effective_pad`] transparent pixels on every side.
+    ///
+    /// The clamp keeps the output within the largest image the engine supports (a max-size comp
+    /// frame), so an unbounded pad cannot overflow or size a buffer past that. It is not a memory
+    /// budget: callers that pad by a derived, possibly large amount bound the area themselves
+    /// (`DOF_PAD_BUDGET` in render's `three_d/compose.rs`, `fits()` on the GPU path) or reject an
+    /// oversized pad first (`padded_size`); legitimate bounded pads are byte-identical.
     pub fn padded(&self, pad: u32) -> Image {
-        let mut out = Image::new(self.width + 2 * pad, self.height + 2 * pad);
+        let eff = self.effective_pad(pad);
+        let mut out = Image::new(self.width + 2 * eff, self.height + 2 * eff);
         let ow = out.width as usize;
         for y in 0..self.height as usize {
             let src = &self.data[y * self.width as usize..(y + 1) * self.width as usize];
-            let o = (y + pad as usize) * ow + pad as usize;
+            let o = (y + eff as usize) * ow + eff as usize;
             out.data[o..o + self.width as usize].copy_from_slice(src);
         }
         out
@@ -199,26 +242,54 @@ impl Image {
     }
     /// Straight-alpha 8-bit RGBA (sRGB-encoded values as stored).
     pub fn to_rgba8(&self) -> Vec<u8> {
-        let mut out = vec![0u8; self.data.len() * 4];
-        out.par_chunks_mut(4).zip(self.data.par_iter()).for_each(|(o, p)| {
+        self.map_rgba8(|o, p, _, _| {
             let a = p[3].clamp(0.0, 1.0);
             let inv = if a > 0.0 { 1.0 / p[3] } else { 0.0 };
             for c in 0..3 {
                 o[c] = ((p[c] * inv).clamp(0.0, 1.0) * 255.0 + 0.5) as u8;
             }
             o[3] = (a * 255.0 + 0.5) as u8;
-        });
-        out
+        })
+    }
+    /// [`Image::to_rgba8`] with the colour dithered ([`dither_u8`]); alpha is rounded.
+    pub fn to_rgba8_dithered(&self) -> Vec<u8> {
+        self.map_rgba8(|o, p, x, y| {
+            let a = p[3].clamp(0.0, 1.0);
+            let inv = if a > 0.0 { 1.0 / p[3] } else { 0.0 };
+            for c in 0..3 {
+                o[c] = dither_u8(p[c] * inv, x, y);
+            }
+            o[3] = (a * 255.0 + 0.5) as u8;
+        })
     }
     /// Composite over an opaque background colour and return opaque 8-bit RGBA.
     pub fn to_rgba8_over(&self, bg: [f32; 3]) -> Vec<u8> {
-        let mut out = vec![0u8; self.data.len() * 4];
-        out.par_chunks_mut(4).zip(self.data.par_iter()).for_each(|(o, p)| {
+        self.map_rgba8(|o, p, _, _| {
             let k = 1.0 - p[3].clamp(0.0, 1.0);
             for c in 0..3 {
                 o[c] = ((p[c] + bg[c] * k).clamp(0.0, 1.0) * 255.0 + 0.5) as u8;
             }
             o[3] = 255;
+        })
+    }
+    /// [`Image::to_rgba8_over`] with the colour dithered ([`dither_u8`]).
+    pub fn to_rgba8_over_dithered(&self, bg: [f32; 3]) -> Vec<u8> {
+        self.map_rgba8(|o, p, x, y| {
+            let k = 1.0 - p[3].clamp(0.0, 1.0);
+            for c in 0..3 {
+                o[c] = dither_u8(p[c] + bg[c] * k, x, y);
+            }
+            o[3] = 255;
+        })
+    }
+    /// 8-bit RGBA with each pixel written by `f` (given its x and y), row-parallel.
+    fn map_rgba8(&self, f: impl Fn(&mut [u8; 4], &Px, u32, u32) + Sync) -> Vec<u8> {
+        let mut out = vec![0u8; self.data.len() * 4];
+        let w = self.width.max(1) as usize;
+        out.par_chunks_mut(w * 4).zip(self.data.par_chunks(w)).enumerate().for_each(|(y, (o, row))| {
+            for (x, (o, p)) in o.as_chunks_mut::<4>().0.iter_mut().zip(row).enumerate() {
+                f(o, p, x as u32, y as u32);
+            }
         });
         out
     }
@@ -292,6 +363,22 @@ pub fn hash_noise(x: u32, y: u32, seed: u32) -> f32 {
     (h & 0x00ff_ffff) as f32 / 16_777_216.0
 }
 
+/// Seed of the output dither: fixed, so a frame converts to the same bytes every time.
+const DITHER_SEED: u32 = 0x5bd1_e995;
+
+/// A colour value in 0..1 as an 8-bit code, dithered by pixel position (#2022): the value is
+/// scaled to 0..255 and rounded up or down against a per-pixel hash threshold, so the codes of
+/// a smooth gradient average to the gradient instead of stepping in bands. A value already on
+/// an 8-bit code (anything rendered at 8 bpc) comes out unchanged. Deterministic: depends only
+/// on the value and the pixel position, never on a clock or a global generator.
+#[inline]
+pub fn dither_u8(v: f32, x: u32, y: u32) -> u8 {
+    let s = v.clamp(0.0, 1.0) * 255.0;
+    // The threshold stays inside (1e-4, 1 - 1e-4) so float error on an exact code can't flip it.
+    let t = hash_noise(x, y, DITHER_SEED) * (1.0 - 2e-4) + 1e-4;
+    (s + t).floor() as u8
+}
+
 /// A single-channel coverage mask.
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Mask {
@@ -316,6 +403,35 @@ impl Mask {
 mod tests {
     use super::*;
 
+    #[test]
+    fn dither_keeps_exact_codes_and_averages_the_rest() {
+        // A value on an 8-bit code is that code at every position.
+        for code in 0..=255u32 {
+            let v = code as f32 / 255.0;
+            for (x, y) in [(0, 0), (1, 0), (17, 3), (1919, 1079), (4095, 4095)] {
+                assert_eq!(dither_u8(v, x, y) as u32, code, "code {code} at ({x}, {y})");
+            }
+        }
+        // Out-of-range and NaN values saturate instead of wrapping.
+        assert_eq!((dither_u8(-3.0, 5, 5), dither_u8(7.0, 5, 5), dither_u8(f32::NAN, 5, 5)), (0, 255, 0));
+        // A value between two codes lands on both, in proportion: the mean over a block is the value.
+        let v = (100.0 + 0.3) / 255.0;
+        let n = 64u32;
+        let sum: u32 = (0..n * n).map(|i| dither_u8(v, i % n, i / n) as u32).sum();
+        let mean = sum as f32 / (n * n) as f32;
+        assert!((mean - 100.3).abs() < 0.03, "{mean}");
+        // Deterministic.
+        assert_eq!(dither_u8(v, 9, 4), dither_u8(v, 9, 4));
+    }
+
+    #[test]
+    fn dithered_conversions_match_the_plain_ones_on_exact_codes() {
+        let src: Vec<u8> = vec![255, 128, 0, 255, 10, 20, 30, 255, 0, 0, 0, 255, 1, 2, 3, 255];
+        let img = Image::from_rgba8(2, 2, &src);
+        assert_eq!(img.to_rgba8_dithered(), img.to_rgba8());
+        assert_eq!(img.to_rgba8_over_dithered([0.0; 3]), img.to_rgba8_over([0.0; 3]));
+    }
+
     #[test]
     fn rgba8_roundtrip() {
         let src: Vec<u8> = vec![255, 128, 0, 255, 10, 20, 30, 128, 0, 0, 0, 0, 1, 2, 3, 4];
@@ -354,4 +470,29 @@ mod tests {
             assert!((0.0..1.0).contains(&n));
         }
     }
+
+    #[test]
+    fn padded_bounds_hostile_pad_at_the_api() {
+        // Fail-before (#2092 class): before the clamp, a caller passing a hostile pad sized an
+        // oversized buffer here — the very OOM this guard exists to stop, now caught in padded().
+        // (Wide-flat source so the clamped-to-cap output stays a test-sized allocation.)
+        let mut img = Image::new(29_990, 2);
+        img.set(29_989, 1, [1.0, 0.0, 0.0, 1.0]);
+        let out = img.padded(u32::MAX);
+        // Width binds first: eff = (MAX_PADDED_SIDE - 29 990) / 2 = 5.
+        assert_eq!((out.width, out.height), (MAX_PADDED_SIDE, 12));
+        // The source lands intact at the clamped offset, not the requested one.
+        assert_eq!(out.get(29_994, 6), [1.0, 0.0, 0.0, 1.0]);
+        assert_eq!(out.get(0, 0), [0.0; 4]); // clamped pad region stays transparent
+    }
+
+    #[test]
+    fn padded_leaves_legit_pads_untouched() {
+        // Anti-over-clamp: an ordinary pad must round exactly, byte for byte.
+        let mut img = Image::new(8, 6);
+        img.set(3, 2, [1.0, 0.0, 0.0, 1.0]);
+        let out = img.padded(4);
+        assert_eq!((out.width, out.height), (16, 14));
+        assert_eq!(out.get(7, 6), [1.0, 0.0, 0.0, 1.0]); // (3+4, 2+4)
+    }
 }
diff --git a/crates/raster/src/warp.rs b/crates/raster/src/warp.rs
index 8b45761e4..9f6de31ce 100644
--- a/crates/raster/src/warp.rs
+++ b/crates/raster/src/warp.rs
@@ -57,7 +57,15 @@ fn half(src: &Image) -> Image {
 /// bilinear without bounds checks, integer-translation copies, inlined Normal blending); it
 /// matches [`composite_warp_reference`] to float rounding.
 pub fn composite_warp(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts) {
-    composite_warp_impl(dst, src, m, opts, true, None);
+    composite_warp_impl(dst, src, m, opts, true, None, None);
+}
+
+/// [`composite_warp`], also returning the destination pixels it changed when it knows them:
+/// `Some([x0, y0, x1, y1])` (half-open, empty when nothing was drawn) on the fast affine path,
+/// `None` otherwise. With `quantize` (an 8/16 bpc destination's levels), the fast path also
+/// quantises each pixel it blends ([`crate::quantize_px`]): exactly when this returns `Some`.
+pub fn composite_warp_changed(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts, quantize: Option<f32>) -> Option<[u32; 4]> {
+    composite_warp_impl(dst, src, m, opts, true, None, quantize)
 }
 
 /// `dst += warp(src) · weight` (plain sum, no blending): motion-blur sub-samples accumulate
@@ -65,7 +73,7 @@ pub fn composite_warp(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts) {
 pub fn accumulate_warp(dst: &mut Image, src: &Image, m: &Mat3, sampling: Sampling, weight: f32) {
     let opts = WarpOpts { sampling, ..Default::default() };
     if m.is_affine() && m.inverse().is_some_and(|i| i.is_affine()) {
-        composite_warp_impl(dst, src, m, &opts, true, Some(weight));
+        composite_warp_impl(dst, src, m, &opts, true, Some(weight), None);
         return;
     }
     let mut tmp = Image::new(dst.width, dst.height);
@@ -79,7 +87,7 @@ pub fn accumulate_warp(dst: &mut Image, src: &Image, m: &Mat3, sampling: Samplin
 
 /// The straightforward per-pixel implementation (reference for the fast path's tests).
 pub fn composite_warp_reference(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts) {
-    composite_warp_impl(dst, src, m, opts, false, None);
+    composite_warp_impl(dst, src, m, opts, false, None, None);
 }
 
 /// Bilinear blend of four taps (same operation order as [`Image::sample_bilinear`]).
@@ -94,9 +102,49 @@ fn bilerp(a: Px, b: Px, c: Px, d: Px, tx: f32, ty: f32) -> Px {
     o
 }
 
-/// Bilinear sample with an unchecked interior fast path.
+/// Side of the square source tiles of [`ClearTiles`].
+const TILE: usize = 16;
+
+/// Which `TILE`×`TILE` source tiles are fully transparent, the one-pixel apron to their right
+/// and below included: the four taps of a bilinear sample whose top-left tap lies in such a
+/// tile all have zero alpha, so the sample is transparent and draws nothing.
+struct ClearTiles {
+    cols: usize,
+    clear: Vec<bool>,
+}
+
+impl ClearTiles {
+    fn new(img: &Image) -> ClearTiles {
+        let (w, h) = (img.width as usize, img.height as usize);
+        let (cols, rows) = (w.div_ceil(TILE), h.div_ceil(TILE));
+        let clear = (0..rows)
+            .into_par_iter()
+            .flat_map_iter(|ty| {
+                let mut row_clear = vec![true; cols];
+                for y in ty * TILE..(ty * TILE + TILE + 1).min(h) {
+                    let row = &img.data[y * w..(y + 1) * w];
+                    for (tx, c) in row_clear.iter_mut().enumerate() {
+                        if *c {
+                            *c = row[tx * TILE..(tx * TILE + TILE + 1).min(w)].iter().all(|p| p[3] == 0.0);
+                        }
+                    }
+                }
+                row_clear
+            })
+            .collect();
+        ClearTiles { cols, clear }
+    }
+
+    #[inline(always)]
+    fn is_clear(&self, x: usize, y: usize) -> bool {
+        self.clear.get((y / TILE) * self.cols + x / TILE).copied().unwrap_or(false)
+    }
+}
+
+/// Bilinear sample with an unchecked interior fast path; `None` when every interior tap is in a
+/// [`ClearTiles`] tile (the sample would have zero alpha).
 #[inline(always)]
-fn sample_bilinear_fast(img: &Image, x: f64, y: f64) -> Px {
+fn sample_bilinear_fast(img: &Image, clear: &ClearTiles, x: f64, y: f64) -> Option<Px> {
     let fx = x - 0.5;
     let fy = y - 0.5;
     let x0 = fx.floor();
@@ -104,14 +152,17 @@ fn sample_bilinear_fast(img: &Image, x: f64, y: f64) -> Px {
     let (xi, yi) = (x0 as i64, y0 as i64);
     let (w, h) = (img.width as i64, img.height as i64);
     if xi >= 0 && yi >= 0 && xi + 1 < w && yi + 1 < h {
+        if clear.is_clear(xi as usize, yi as usize) {
+            return None;
+        }
         let tx = (fx - x0) as f32;
         let ty = (fy - y0) as f32;
         let i = yi as usize * w as usize + xi as usize;
         let row0 = &img.data[i..i + 2];
         let row1 = &img.data[i + w as usize..i + w as usize + 2];
-        return bilerp(row0[0], row0[1], row1[0], row1[1], tx, ty);
+        return Some(bilerp(row0[0], row0[1], row1[0], row1[1], tx, ty));
     }
-    img.sample_bilinear(x, y)
+    Some(img.sample_bilinear(x, y))
 }
 
 /// Index range `[lo, hi)` of `i` in `0..n` for which `p0 + i·s` may lie in `[min, max]`
@@ -127,20 +178,43 @@ fn span(p0: f64, s: f64, min: f64, max: f64, n: usize) -> (usize, usize) {
     if hi <= lo { (0, 0) } else { (lo as usize, hi as usize) }
 }
 
-/// Fast affine rows: `blend(dst, src, x, y)` is only called for visible source pixels.
-#[allow(clippy::too_many_arguments)]
-fn affine_rows(
-    dst: &mut Image,
-    img: &Image,
-    inv: &Mat3,
+/// Columns `[a, b)` of one destination row that a warp changed (`a == b`: none).
+#[derive(Clone, Copy)]
+struct RowSpan {
+    a: usize,
+    b: usize,
+}
+
+impl RowSpan {
+    const NONE: RowSpan = RowSpan { a: usize::MAX, b: 0 };
+    #[inline(always)]
+    fn add(&mut self, x: usize) {
+        self.a = self.a.min(x);
+        self.b = x + 1;
+    }
+}
+
+/// Union of changed pixels as `[x0, y0, x1, y1]` (half-open; `x0 >= x1` when empty).
+fn union(r: [usize; 4], q: [usize; 4]) -> [usize; 4] {
+    match (r[0] < r[2], q[0] < q[2]) {
+        (false, _) => q,
+        (_, false) => r,
+        _ => [r[0].min(q[0]), r[1].min(q[1]), r[2].max(q[2]), r[3].max(q[3])],
+    }
+}
+
+/// Sampling, blending and destination bounds for an affine row operation.
+struct AffineRows {
     sampling: Sampling,
-    op: f32,
-    x0: usize,
-    x1: usize,
-    y0: usize,
-    y1: usize,
-    blend: impl Fn(Px, Px, u32, u32) -> Px + Sync,
-) {
+    opacity: f32,
+    quantize: Option<f32>,
+    bounds: [usize; 4],
+}
+
+/// Blend visible source samples and return the rectangle of changed pixels.
+fn affine_rows(dst: &mut Image, img: &Image, inv: &Mat3, rows: AffineRows, blend: impl Fn(Px, Px, u32, u32) -> Px + Sync) -> [usize; 4] {
+    let AffineRows { sampling, opacity: op, quantize, bounds: [x0, x1, y0, y1] } = rows;
+    let levels = quantize.map(|l| (l, 1.0 / l));
     let w = dst.width as usize;
     let m = inv.0;
     let (iw, ih) = (img.width as f64, img.height as f64);
@@ -148,71 +222,104 @@ fn affine_rows(
     // Pure integer translation: every sample lands on a pixel centre, so all filters return the
     // source pixel itself (bicubic still clamps negatives, as in the reference).
     let int_tx = m[0][0] == 1.0 && m[1][1] == 1.0 && m[0][1] == 0.0 && m[1][0] == 0.0 && m[0][2].fract() == 0.0 && m[1][2].fract() == 0.0;
-    dst.data.par_chunks_mut(w).enumerate().skip(y0).take(y1 - y0).for_each(|(y, row)| {
-        let fy = y as f64 + 0.5;
-        let p0 = vec2(m[0][0] * (x0 as f64 + 0.5) + m[0][1] * fy + m[0][2], m[1][0] * (x0 as f64 + 0.5) + m[1][1] * fy + m[1][2]);
-        let n = x1 - x0;
-        let (ax, bx) = span(p0.x, step.x, -1.0, iw + 1.0, n);
-        let (ay, by) = span(p0.y, step.y, -1.0, ih + 1.0, n);
-        let (lo, hi) = (ax.max(ay), bx.min(by));
-        if lo >= hi {
-            return;
-        }
-        if int_tx {
-            let sy = y as i64 + m[1][2] as i64;
-            if sy < 0 || sy >= img.height as i64 {
-                return;
+    // Bilinear samples skip the transparent parts of the source (most of a thin shape's or a
+    // glow-padded layer's buffer) without reading them.
+    let clear = (sampling == Sampling::Bilinear && !int_tx).then(|| ClearTiles::new(img));
+    let empty = [usize::MAX, usize::MAX, 0, 0];
+    dst.data
+        .par_chunks_mut(w)
+        .enumerate()
+        .skip(y0)
+        .take(y1 - y0)
+        .map(|(y, row)| {
+            let mut changed = RowSpan::NONE;
+            let fy = y as f64 + 0.5;
+            let p0 = vec2(m[0][0] * (x0 as f64 + 0.5) + m[0][1] * fy + m[0][2], m[1][0] * (x0 as f64 + 0.5) + m[1][1] * fy + m[1][2]);
+            let n = x1 - x0;
+            let (ax, bx) = span(p0.x, step.x, -1.0, iw + 1.0, n);
+            let (ay, by) = span(p0.y, step.y, -1.0, ih + 1.0, n);
+            let (lo, hi) = (ax.max(ay), bx.min(by));
+            if lo >= hi {
+                return empty;
             }
-            let dx = m[0][2] as i64;
-            let srow = &img.data[sy as usize * img.width as usize..(sy as usize + 1) * img.width as usize];
-            let xa = (x0 as i64 + lo as i64).max(-dx).max(0) as usize;
-            let xb = ((x0 + hi) as i64).min(img.width as i64 - dx).max(0) as usize;
-            for x in xa..xb.max(xa) {
-                let mut s = srow[(x as i64 + dx) as usize];
-                if sampling == Sampling::Bicubic {
-                    s = [s[0].max(0.0), s[1].max(0.0), s[2].max(0.0), s[3].max(0.0)];
+            if int_tx {
+                let sy = y as i64 + m[1][2] as i64;
+                if sy < 0 || sy >= img.height as i64 {
+                    return empty;
                 }
-                if s[3] <= 0.0 {
-                    continue;
-                }
-                if op < 1.0 {
-                    for c in s.iter_mut() {
-                        *c *= op;
+                let dx = m[0][2] as i64;
+                let srow = &img.data[sy as usize * img.width as usize..(sy as usize + 1) * img.width as usize];
+                let xa = (x0 as i64 + lo as i64).max(-dx).max(0) as usize;
+                let xb = ((x0 + hi) as i64).min(img.width as i64 - dx).max(0) as usize;
+                for x in xa..xb.max(xa) {
+                    let mut s = srow[(x as i64 + dx) as usize];
+                    if sampling == Sampling::Bicubic {
+                        s = [s[0].max(0.0), s[1].max(0.0), s[2].max(0.0), s[3].max(0.0)];
                     }
+                    if s[3] <= 0.0 {
+                        continue;
+                    }
+                    if op < 1.0 {
+                        for c in s.iter_mut() {
+                            *c *= op;
+                        }
+                    }
+                    row[x] = blend(row[x], s, x as u32, y as u32);
+                    if let Some((l, inv)) = levels {
+                        crate::quantize_px(&mut row[x], l, inv);
+                    }
+                    changed.add(x);
                 }
-                row[x] = blend(row[x], s, x as u32, y as u32);
-            }
-            return;
-        }
-        for i in lo..hi {
-            let x = x0 + i;
-            let p = vec2(p0.x + step.x * i as f64, p0.y + step.y * i as f64);
-            if p.x < -1.0 || p.y < -1.0 || p.x > iw + 1.0 || p.y > ih + 1.0 {
-                continue;
-            }
-            let mut s = match sampling {
-                Sampling::Nearest => img.get(p.x.floor() as i64, p.y.floor() as i64),
-                Sampling::Bilinear => sample_bilinear_fast(img, p.x, p.y),
-                Sampling::Bicubic => img.sample_bicubic(p.x, p.y),
-            };
-            if s[3] <= 0.0 {
-                continue;
-            }
-            if op < 1.0 {
-                for c in s.iter_mut() {
-                    *c *= op;
+            } else {
+                for i in lo..hi {
+                    let x = x0 + i;
+                    let p = vec2(p0.x + step.x * i as f64, p0.y + step.y * i as f64);
+                    if p.x < -1.0 || p.y < -1.0 || p.x > iw + 1.0 || p.y > ih + 1.0 {
+                        continue;
+                    }
+                    let mut s = match (sampling, &clear) {
+                        (Sampling::Nearest, _) => img.get(p.x.floor() as i64, p.y.floor() as i64),
+                        (Sampling::Bilinear, Some(clear)) => match sample_bilinear_fast(img, clear, p.x, p.y) {
+                            Some(s) => s,
+                            None => continue,
+                        },
+                        (Sampling::Bilinear, None) => img.sample_bilinear(p.x, p.y),
+                        (Sampling::Bicubic, _) => img.sample_bicubic(p.x, p.y),
+                    };
+                    if s[3] <= 0.0 {
+                        continue;
+                    }
+                    if op < 1.0 {
+                        for c in s.iter_mut() {
+                            *c *= op;
+                        }
+                    }
+                    row[x] = blend(row[x], s, x as u32, y as u32);
+                    if let Some((l, inv)) = levels {
+                        crate::quantize_px(&mut row[x], l, inv);
+                    }
+                    changed.add(x);
                 }
             }
-            row[x] = blend(row[x], s, x as u32, y as u32);
-        }
-    });
+            if changed.a < changed.b { [changed.a, y, changed.b, y + 1] } else { empty }
+        })
+        .reduce(|| empty, union)
 }
 
-fn composite_warp_impl(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts, allow_fast: bool, accumulate: Option<f32>) {
+fn composite_warp_impl(
+    dst: &mut Image,
+    src: &Image,
+    m: &Mat3,
+    opts: &WarpOpts,
+    allow_fast: bool,
+    accumulate: Option<f32>,
+    quantize: Option<f32>,
+) -> Option<[u32; 4]> {
+    const NOTHING: Option<[u32; 4]> = Some([0; 4]);
     if src.is_empty() || dst.is_empty() || opts.opacity <= 0.0 {
-        return;
+        return NOTHING;
     }
-    let Some(inv) = m.inverse() else { return };
+    let Some(inv) = m.inverse() else { return NOTHING };
     // Minification: pick a pre-filtered level so sampling doesn't alias.
     let scale = m.mean_scale();
     let mut level_img;
@@ -239,7 +346,7 @@ fn composite_warp_impl(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts,
         area = area.intersect(&c);
     }
     if area.is_empty() {
-        return;
+        return NOTHING;
     }
     let (x0, x1) = (area.x0.max(0.0) as usize, area.x1.min(dst.width as f64) as usize);
     let (y0, y1) = (area.y0.max(0.0) as usize, area.y1.min(dst.height as f64) as usize);
@@ -247,25 +354,34 @@ fn composite_warp_impl(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts,
     let affine = inv.is_affine();
     let mode = opts.mode;
     let op = opts.opacity;
+    let changed = |r: [usize; 4]| Some(r.map(|v| v.min(u32::MAX as usize) as u32));
     if let Some(k) = accumulate
         && affine
     {
-        affine_rows(dst, img, &inv, opts.sampling, 1.0, x0, x1, y0, y1, |d, s, _, _| [d[0] + s[0] * k, d[1] + s[1] * k, d[2] + s[2] * k, d[3] + s[3] * k]);
-        return;
+        let r = affine_rows(dst, img, &inv, AffineRows { sampling: opts.sampling, opacity: 1.0, quantize: None, bounds: [x0, x1, y0, y1] }, |d, s, _, _| {
+            [d[0] + s[0] * k, d[1] + s[1] * k, d[2] + s[2] * k, d[3] + s[3] * k]
+        });
+        return changed(r);
     }
     if allow_fast && affine && !mode.is_stencil() {
-        match mode {
-            BlendMode::Normal => affine_rows(dst, img, &inv, opts.sampling, op, x0, x1, y0, y1, |d, s, _, _| {
-                let k = 1.0 - s[3];
-                [s[0] + d[0] * k, s[1] + d[1] * k, s[2] + d[2] * k, s[3] + d[3] * k]
-            }),
+        let r = match mode {
+            BlendMode::Normal => {
+                affine_rows(dst, img, &inv, AffineRows { sampling: opts.sampling, opacity: op, quantize, bounds: [x0, x1, y0, y1] }, |d, s, _, _| {
+                    let k = 1.0 - s[3];
+                    [s[0] + d[0] * k, s[1] + d[1] * k, s[2] + d[2] * k, s[3] + d[3] * k]
+                })
+            }
             BlendMode::Dissolve | BlendMode::DancingDissolve => {
                 let seed = opts.seed;
-                affine_rows(dst, img, &inv, opts.sampling, op, x0, x1, y0, y1, |d, s, x, y| blend_pixel(mode, d, s, hash_noise(x, y, seed)))
+                affine_rows(dst, img, &inv, AffineRows { sampling: opts.sampling, opacity: op, quantize, bounds: [x0, x1, y0, y1] }, |d, s, x, y| {
+                    blend_pixel(mode, d, s, hash_noise(x, y, seed))
+                })
             }
-            _ => affine_rows(dst, img, &inv, opts.sampling, op, x0, x1, y0, y1, |d, s, _, _| blend_pixel(mode, d, s, 0.5)),
-        }
-        return;
+            _ => affine_rows(dst, img, &inv, AffineRows { sampling: opts.sampling, opacity: op, quantize, bounds: [x0, x1, y0, y1] }, |d, s, _, _| {
+                blend_pixel(mode, d, s, 0.5)
+            }),
+        };
+        return changed(r);
     }
     dst.data.par_chunks_mut(w).enumerate().skip(y0).take(y1 - y0).for_each(|(y, row)| {
         let fy = y as f64 + 0.5;
@@ -312,6 +428,7 @@ fn composite_warp_impl(dst: &mut Image, src: &Image, m: &Mat3, opts: &WarpOpts,
             }
         }
     }
+    None
 }
 
 /// Resize with bilinear filtering (box pre-filter when shrinking).
@@ -394,6 +511,116 @@ mod tests {
         }
     }
 
+    /// A mostly transparent source: a thin ring with a few stray pixels (one with negative zero alpha).
+    fn sparse_image(w: u32, h: u32) -> Image {
+        let mut img = Image::new(w, h);
+        let (cx, cy, r) = (w as f32 / 2.0, h as f32 / 2.0, w.min(h) as f32 * 0.4);
+        for y in 0..h {
+            for x in 0..w {
+                let d = ((x as f32 + 0.5 - cx).hypot(y as f32 + 0.5 - cy) - r).abs();
+                if d < 1.5 {
+                    let a = 1.0 - d / 1.5;
+                    img.set(x, y, [0.2 * a, 0.6 * a, a, a]);
+                }
+            }
+        }
+        img.set(3, 2, [0.5, 0.5, 0.5, 0.5]);
+        img.set(w - 1, h - 1, [1.0; 4]);
+        img.set(w / 2, 1, [0.0, 0.0, 0.0, -0.0]);
+        img
+    }
+
+    #[test]
+    fn clear_tiles_hold_only_transparent_taps() {
+        let img = sparse_image(150, 97);
+        let clear = ClearTiles::new(&img);
+        let mut skipped = 0;
+        for y in 0..img.height as usize - 1 {
+            for x in 0..img.width as usize - 1 {
+                if clear.is_clear(x, y) {
+                    skipped += 1;
+                    for (dx, dy) in [(0, 0), (1, 0), (0, 1), (1, 1)] {
+                        assert_eq!(img.get(x as i64 + dx, y as i64 + dy)[3], 0.0, "tap ({}, {}) of a clear tile", x as i64 + dx, y as i64 + dy);
+                    }
+                }
+            }
+        }
+        assert!(skipped > 100 * 70, "the ring's empty middle is skipped: {skipped}");
+    }
+
+    /// The changed rectangle holds every pixel a warp changed, and the skipped transparent
+    /// samples leave the result as the reference path draws it.
+    #[test]
+    fn changed_rect_covers_the_changed_pixels() {
+        let src = sparse_image(90, 70);
+        let mats = [
+            Mat3::translate(vec2(7.0, 3.0)),
+            Mat3::translate(vec2(10.25, 4.5)),
+            Mat3::translate(vec2(60.0, 50.0)) * Mat3::rotate_deg(33.0) * Mat3::scale(vec2(0.9, 1.2)) * Mat3::translate(vec2(-45.0, -35.0)),
+            Mat3::translate(vec2(-30.0, -20.0)),
+            Mat3::scale(vec2(0.3, 0.3)),
+        ];
+        for (mi, m) in mats.iter().enumerate() {
+            for mode in [BlendMode::Normal, BlendMode::Add, BlendMode::Dissolve] {
+                let opts = WarpOpts { mode, seed: 3, ..Default::default() };
+                let before = test_image(120, 100, 4);
+                let mut a = before.clone();
+                let r = composite_warp_changed(&mut a, &src, m, &opts, None);
+                let Some([x0, y0, x1, y1]) = r else { panic!("mat {mi}: the fast path tracks what it changed") };
+                for (i, (p, q)) in a.data.iter().zip(&before.data).enumerate() {
+                    let (x, y) = (i as u32 % a.width, i as u32 / a.width);
+                    if p != q {
+                        assert!(x >= x0 && x < x1 && y >= y0 && y < y1, "mat {mi} {mode:?}: ({x}, {y}) changed outside {r:?}");
+                    }
+                }
+                let mut b = before.clone();
+                composite_warp_reference(&mut b, &src, m, &opts);
+                for (i, (p, q)) in a.data.iter().zip(&b.data).enumerate() {
+                    for c in 0..4 {
+                        assert!((p[c] - q[c]).abs() < 1e-4, "mat {mi} {mode:?} px {i}: {p:?} vs {q:?}");
+                    }
+                }
+            }
+        }
+        let mut dst = Image::new(10, 10);
+        assert_eq!(composite_warp_changed(&mut dst, &Image::new(4, 4), &Mat3::IDENTITY, &WarpOpts::default(), None), Some([u32::MAX, u32::MAX, 0, 0]));
+        let stencil = WarpOpts { mode: BlendMode::StencilAlpha, ..Default::default() };
+        assert_eq!(composite_warp_changed(&mut dst, &src, &Mat3::IDENTITY, &stencil, Some(255.0)), None, "stencils change the whole destination");
+    }
+
+    /// Quantising while blending equals blending, then quantising the changed rectangle of an
+    /// already quantised destination (what an 8/16 bpc comp did after every layer), bit for bit.
+    #[test]
+    fn quantize_while_blending_matches_quantizing_after() {
+        let src = sparse_image(90, 70);
+        let mats = [Mat3::translate(vec2(7.0, 3.0)), Mat3::translate(vec2(60.0, 50.0)) * Mat3::rotate_deg(33.0) * Mat3::translate(vec2(-45.0, -35.0))];
+        for m in &mats {
+            for mode in [BlendMode::Normal, BlendMode::Screen, BlendMode::Dissolve] {
+                for (levels, opacity) in [(255.0f32, 1.0), (32_768.0, 0.7)] {
+                    let mut before = test_image(120, 100, 8);
+                    for p in &mut before.data {
+                        crate::quantize_px(p, levels, 1.0 / levels);
+                    }
+                    let opts = WarpOpts { mode, opacity, seed: 5, ..Default::default() };
+                    let mut after = before.clone();
+                    let Some([x0, y0, x1, y1]) = composite_warp_changed(&mut after, &src, m, &opts, None) else { panic!("fast path") };
+                    for y in y0..y1 {
+                        for x in x0..x1 {
+                            let i = after.idx(x, y);
+                            crate::quantize_px(&mut after.data[i], levels, 1.0 / levels);
+                        }
+                    }
+                    let mut fused = before.clone();
+                    let r = composite_warp_changed(&mut fused, &src, m, &opts, Some(levels));
+                    assert_eq!(r, Some([x0, y0, x1, y1]));
+                    for (i, (p, q)) in fused.data.iter().zip(&after.data).enumerate() {
+                        assert_eq!(p.map(f32::to_bits), q.map(f32::to_bits), "{mode:?} {levels} px {i}");
+                    }
+                }
+            }
+        }
+    }
+
     /// Accumulating sub-samples equals warping each into its own image and summing.
     #[test]
     fn accumulate_matches_per_sample_images() {
diff --git a/crates/raster/src/yuv.rs b/crates/raster/src/yuv.rs
new file mode 100644
index 000000000..fdfbc0c0a
--- /dev/null
+++ b/crates/raster/src/yuv.rs
@@ -0,0 +1,60 @@
+//! 8-bit BT.709 limited-range 4:2:0, the H.264 export's input. Shared by the export and by the
+//! GPU compositor's tests, which hold its kernel to this function.
+
+use rayon::prelude::*;
+
+/// `v / 255` for every 8-bit `v` (the same values as dividing).
+pub const UNIT8: [f32; 256] = {
+    let mut t = [0.0; 256];
+    let mut i = 0;
+    while i < 256 {
+        t[i] = i as f32 / 255.0;
+        i += 1;
+    }
+    t
+};
+
+/// `v.round()` for `0 <= v < 2^23`, the range the colour conversions round in: truncation and
+/// the fraction are exact there, so this is `f32::round` without its libm call.
+#[inline(always)]
+pub fn round_pos(v: f32) -> f32 {
+    let t = v as u32 as f32;
+    if v - t >= 0.5 { t + 1.0 } else { t }
+}
+
+/// BT.709 limited-range 8-bit 4:2:0 from RGBA8 (2×2 chroma average; alpha ignored).
+pub fn rgba_to_yuv420(rgba: &[u8], w: usize, h: usize, y: &mut Vec<u8>, u: &mut Vec<u8>, v: &mut Vec<u8>) {
+    let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
+    y.resize(w * h, 0);
+    u.resize(cw * ch, 0);
+    v.resize(cw * ch, 0);
+    y.par_chunks_mut(w * 2).zip(u.par_chunks_mut(cw).zip(v.par_chunks_mut(cw))).enumerate().for_each(|(cy, (yr, (ur, vr)))| {
+        let mut acc = vec![(0f32, 0f32, 0f32); cw];
+        for (dy, yrow) in yr.chunks_exact_mut(w).enumerate() {
+            let src = &rgba[(cy * 2 + dy) * w * 4..][..w * 4];
+            for (x, (s, yo)) in src.as_chunks::<4>().0.iter().zip(yrow.iter_mut()).enumerate() {
+                let (r, g, b) = (UNIT8[s[0] as usize], UNIT8[s[1] as usize], UNIT8[s[2] as usize]);
+                let l = 0.2126 * r + 0.7152 * g + 0.0722 * b;
+                *yo = round_pos(16.0 + 219.0 * l).clamp(1.0, 254.0) as u8;
+                let a = &mut acc[x / 2];
+                a.0 += (b - l) / 1.8556;
+                a.1 += (r - l) / 1.5748;
+                a.2 += 1.0;
+            }
+        }
+        for (cx, a) in acc.iter().enumerate() {
+            ur[cx] = round_pos(128.0 + 224.0 * a.0 / a.2).clamp(1.0, 254.0) as u8;
+            vr[cx] = round_pos(128.0 + 224.0 * a.1 / a.2).clamp(1.0, 254.0) as u8;
+        }
+    });
+}
+
+/// The H.264 export's planes of `img` over `bg` (opaque): Y, then U and V, as
+/// [`crate::Image::to_rgba8_over`] + [`rgba_to_yuv420`] produce them.
+pub fn yuv420_over(img: &crate::Image, bg: [f32; 3]) -> Vec<u8> {
+    let (mut y, mut u, mut v) = (vec![], vec![], vec![]);
+    rgba_to_yuv420(&img.to_rgba8_over(bg), img.width as usize, img.height as usize, &mut y, &mut u, &mut v);
+    y.extend_from_slice(&u);
+    y.extend_from_slice(&v);
+    y
+}
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index db2fa9dd0..cd67e846a 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -19,10 +19,13 @@ effectcraft-raster = { workspace = true }
 effectcraft-path = { workspace = true }
 effectcraft-text = { workspace = true }
 effectcraft-effects = { workspace = true }
-lz4_flex = { version = "0.11", default-features = false, features = ["std", "safe-encode", "safe-decode", "checked-decode"] }
+lz4_flex = { version = "0.14", default-features = false, features = ["std", "safe-encode", "safe-decode", "checked-decode"] }
 effectcraft-model = { workspace = true }
 kurbo = { workspace = true }
 rayon = { workspace = true }
 web-time = { workspace = true }
 serde = { workspace = true }
 log = { workspace = true }
+
+[dev-dependencies]
+tempfile = { workspace = true }
diff --git a/crates/render/src/accel.rs b/crates/render/src/accel.rs
new file mode 100644
index 000000000..518e04412
--- /dev/null
+++ b/crates/render/src/accel.rs
@@ -0,0 +1,403 @@
+use super::frames::content_bounds;
+use super::fx_host::MAX_FX_DEPTH;
+use super::layers::StyledLayer;
+use super::opts::LayerTiming;
+use super::{
+    Arc, AutoPick, Buf, EffectCtx, EvalCtx, Image, ItemId, ItemKind, Layer, LayerSource, Mat3, MatteKind, Renderer, Tick, cache, color, masks, three_d, vec2,
+};
+
+/// Which compositor renders a frame (Project Settings ▸ Video Rendering and Effects).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Backend {
+    /// The CPU reference compositor (Mercury Software Only).
+    #[default]
+    Cpu,
+    /// The GPU compositor whenever an [`Accelerator`] is attached, whatever the project says.
+    Gpu,
+    /// The GPU compositor when an [`Accelerator`] is attached and the project's renderer is
+    /// Mercury GPU Acceleration (the viewer's choice); the CPU otherwise.
+    Auto,
+}
+
+impl Backend {
+    /// The backend `s` names, whatever case it is written in: the project's own values (`cpu`,
+    /// `gpu`, `auto`), the labels Project Settings ▸ Video Rendering and Effects draws
+    /// (`GPU Acceleration`, `Software Rendering`) and the older After Effects wording.
+    pub fn parse(s: &str) -> Option<Backend> {
+        match s.to_ascii_lowercase().as_str() {
+            "cpu" | "software" | "mercury software only" | "software rendering" => Some(Backend::Cpu),
+            "gpu" | "mercury gpu acceleration" | "gpu acceleration" => Some(Backend::Gpu),
+            "auto" => Some(Backend::Auto),
+            _ => None,
+        }
+    }
+}
+
+/// One effect of a GPU effect chain (see [`Accelerator::effects`]).
+pub struct FxStep<'x> {
+    pub spec: &'static effectcraft_effects::EffectSpec,
+    pub ctx: EffectCtx<'x>,
+}
+
+/// A GPU (or other hardware) backend for the compositor. The CPU [`Renderer`] stays the
+/// reference: an accelerator renders what it supports and returns `None` for the rest, which
+/// then runs on the CPU. Implemented by `effectcraft-gpu`.
+pub trait Accelerator: Send + Sync {
+    /// Adapter / backend name for status readouts ("Apple M2 (Metal)").
+    fn name(&self) -> String;
+    /// Render a top-level comp frame (what [`Renderer::comp_frame`] returns). `None` = not
+    /// handled (the CPU renders it).
+    fn comp_frame(&self, r: &Renderer, comp: ItemId, t: Tick) -> Option<Image>;
+    /// Render a top-level comp frame like [`Self::comp_frame`], composite it over `bg` and
+    /// convert it to the H.264 export's 8-bit BT.709 limited-range 4:2:0 (Y plane, then U and V
+    /// at half size; see `effectcraft_raster::yuv`). Every byte is within one level of the CPU
+    /// conversion of the same frame (a driver's arithmetic may move a value near a rounding
+    /// boundary). `None` = not handled (the caller renders and converts on the CPU).
+    fn comp_frame_yuv420(&self, _r: &Renderer, _comp: ItemId, _t: Tick, _bg: [f32; 3]) -> Option<Vec<u8>> {
+        None
+    }
+    /// The accelerator implements effect `id` with the CPU effect's semantics.
+    fn supports_effect(&self, id: &str) -> bool;
+    /// Run a chain of supported effects on `buf`, clamping and quantising to `levels` after
+    /// every effect when set (8/16 bpc). `None` = not handled.
+    fn effects(&self, chain: &[FxStep], buf: &Buf, levels: Option<f32>) -> Option<Buf>;
+    /// Rasterise and shade an Advanced 3D scene at its raster size (depth buffer, PBR, image
+    /// based light, shadow maps), with the CPU rasteriser's semantics
+    /// ([`three_d::adv::raster::render`]). `None` = not handled (the CPU renders it).
+    fn raster_3d(&self, _scene: &three_d::adv::Scene) -> Option<three_d::adv::Target> {
+        None
+    }
+    /// Render a whole prepared Advanced 3D run (every motion-blur sub-sample rasterised and
+    /// resolved, averaged, depth of field, encoding) with [`three_d::adv::render_prepared`]'s
+    /// semantics. `None` = not handled (the CPU path runs, using [`Self::raster_3d`]).
+    fn render_3d(&self, _run: &three_d::adv::Prepared) -> Option<three_d::adv::Rendered> {
+        None
+    }
+    /// A particle simulation backend (GPU particles) for the stepped particle effects, with
+    /// the CPU simulation's semantics. `None` = they simulate on the CPU.
+    fn particles(&self) -> Option<&dyn effectcraft_effects::psim::ParticleSim> {
+        None
+    }
+    /// A hardware backend for Content-Aware Fill's stages (the GPU compositor's kernels), with
+    /// the CPU fill's semantics. `None` = the fill runs on the CPU.
+    ///
+    /// The fill's input frames are read back to the CPU before it runs (analyses render on the
+    /// CPU by design, see `effectcraft_engine::background::offload::job_accel`), so a backend
+    /// here is about the fill's own work — PatchMatch and the flow's block matching today, one
+    /// stage at a time as each pays (`effectcraft_gpu::inpaint`) — not about compositing.
+    fn inpaint(&self) -> Option<&dyn effectcraft_raster::inpaint::FillBackend> {
+        None
+    }
+    /// Timing history [`Backend::Auto`] uses to send each comp's top-level frames to the
+    /// faster compositor. `None` = Auto always tries the accelerator first.
+    fn auto_pick(&self) -> Option<&AutoPick> {
+        None
+    }
+    /// Whether the accelerator can still render frames. `false` once it has stopped for good
+    /// (its device was lost or retired): every frame it is asked for falls back to the CPU, so
+    /// callers that limit frames in flight for it can stop doing so.
+    fn available(&self) -> bool {
+        true
+    }
+    /// Deferred readbacks: where a GPU readback cannot be waited for (WebGPU in a browser
+    /// worker), a frame renders in *passes*. A readback the accelerator does not have yet is
+    /// started, the step returns a cheap placeholder and the pass is marked missed
+    /// ([`Self::pass_missed`]); the caller waits for the readbacks in flight (asynchronously)
+    /// and renders the frame again, and the steps whose results arrived are served from them.
+    /// The frame is done after a pass with no miss. `frame_begin` forgets the previous frame's
+    /// results, `pass_begin` clears the miss. Synchronous accelerators never miss.
+    fn frame_begin(&self) {}
+    fn pass_begin(&self) {}
+    /// A rendered comp frame is done (the GPU pool ages sizes no frame asks for, and evicts
+    /// only those once full). The multi-frame render paths call it once per comp frame:
+    /// [`crate::passes::comp_frame`] (exports; a field-rendered output frame is two), the
+    /// export's 4:2:0 frames ([`Accelerator::comp_frame_yuv420`]), remote frames and the
+    /// preview workers. One-off renders (`Session::render`, single-frame export,
+    /// thumbnails) don't, so they don't advance the pool's clock. Without it the pool never
+    /// finds a stale size and keeps its first sizes, dropping newcomers.
+    fn frame_end(&self) {}
+    /// A render of many frames (an export) is done: drop what is kept only to speed up the
+    /// next frame (pooled working textures). Exports call it, even when they fail, panic or
+    /// are dropped; other multi-frame paths (preview, remote frames) don't, so there the pool
+    /// keeps up to its budget until the next export ends.
+    fn render_end(&self) {}
+    fn pass_missed(&self) -> bool {
+        false
+    }
+    /// Raised from a pass's first miss to its end (results computed meanwhile may hold
+    /// placeholders): give it to [`LayerCache::set_gate`] so they are not cached.
+    fn miss_gate(&self) -> Option<Arc<std::sync::atomic::AtomicBool>> {
+        None
+    }
+    /// With deferred readbacks: a future that resolves once the readbacks in flight have
+    /// landed (the browser delivers them from its event loop; natively the device is polled
+    /// before it returns, so the future is ready). `None` = nothing to wait for. See
+    /// [`passes::in_passes`].
+    fn settle(&self) -> Option<std::pin::Pin<Box<dyn std::future::Future<Output = ()> + '_>>> {
+        None
+    }
+}
+
+/// Where an effect stack runs (see [`Renderer::run_effects_on`]): a CPU buffer, or an image
+/// resident on an accelerator.
+pub trait FxTarget {
+    /// Run a chain of accelerator-supported effects (quantising after each to the bit depth).
+    /// `false` = not handled: the effects then run one by one through [`FxTarget::cpu`].
+    fn gpu(&mut self, steps: &[FxStep]) -> bool;
+    /// Run one CPU effect: `f` maps the buffer.
+    fn cpu(&mut self, f: &mut dyn FnMut(Buf) -> Buf);
+    /// Grow the buffer to cover its whole layer rectangle (`size` layer pixels from its own
+    /// corner, the `layer_size` handed to effects), as [`effectcraft_effects::Buf::cover`].
+    /// Authored buffers (text, shapes) only span their painted content; this gives the stack
+    /// the room a sized source's buffer already has (#659).
+    fn cover(&mut self, size: [f64; 2]) {
+        self.cpu(&mut |mut buf| {
+            buf.cover(size);
+            buf
+        });
+    }
+    /// Give the buffer the pixel-grid phase the layer rectangle's cover would
+    /// ([`effectcraft_effects::Buf::align`]): grows left/top by less than 64 pixels.
+    fn align(&mut self, size: [f64; 2]) {
+        self.cpu(&mut |mut buf| {
+            buf.align(size);
+            buf
+        });
+    }
+}
+
+/// The CPU effect target (GPU chains go through [`Accelerator::effects`]: upload, readback).
+pub(crate) struct CpuFx<'a> {
+    pub(crate) accel: Option<&'a dyn Accelerator>,
+    pub(crate) levels: Option<f32>,
+    pub(crate) buf: Option<Buf>,
+}
+
+impl FxTarget for CpuFx<'_> {
+    fn gpu(&mut self, steps: &[FxStep]) -> bool {
+        let (Some(a), Some(b)) = (self.accel, &self.buf) else { return false };
+        match a.effects(steps, b, self.levels) {
+            Some(out) => {
+                self.buf = Some(out);
+                true
+            }
+            None => false,
+        }
+    }
+    fn cpu(&mut self, f: &mut dyn FnMut(Buf) -> Buf) {
+        if let Some(b) = self.buf.take() {
+            self.buf = Some(f(b));
+        }
+    }
+}
+
+/// Hooks for accelerated compositors (`effectcraft-gpu`): the pieces of the CPU walk they reuse
+/// or fall back to. The CPU compositor itself is [`Renderer::comp_frame_cpu`].
+impl<'a> Renderer<'a> {
+    /// The project's colour pipeline.
+    pub fn pipe(&self) -> color::Pipe {
+        self.pipe
+    }
+
+    /// The colour pipeline of the top-level output steps: the project's, with no HDR step under
+    /// [`crate::RenderOpts::skip_hdr_step`] (the consumer decodes with
+    /// [`color::Pipe::output_linear`] or applies the step itself).
+    pub fn output_pipe(&self) -> color::Pipe {
+        if self.opts.skip_hdr_step { self.pipe.without_hdr_step() } else { self.pipe }
+    }
+
+    /// Nesting depth (0 = the top-level comp).
+    pub fn depth(&self) -> usize {
+        self.depth
+    }
+
+    /// The auxiliary 3D channels of comp `comp_id` at comp time `t` (depth, layer IDs, normals,
+    /// UVs, Cryptomatte; see `three_d::compose::aux_pass`), at the renderer's output scale.
+    pub fn comp_aux(&self, comp_id: ItemId, t: Tick) -> Option<effectcraft_raster::AuxChannels> {
+        let ctx = self.eval_ctx(comp_id, t)?;
+        Some(three_d::compose::aux_pass(self, &ctx))
+    }
+
+    /// The auxiliary channels effects on `layer` read ([`EffectHost::aux`]): its multi-layer
+    /// OpenEXR footage's at the layer's source time (Time Remap included), or a precomp's
+    /// generated 3D channels at its nested time. `None` for other layers.
+    pub fn layer_aux(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<effectcraft_raster::AuxChannels>> {
+        match &layer.source {
+            LayerSource::Footage { item } => {
+                let item = ctx.media_item(layer, *item);
+                let ItemKind::Footage(f) = &self.project.item(item)?.kind else { return None };
+                let a = self.read(|| self.footage.aux(item, f, ctx.source_time(layer)))?;
+                // Aux pixels per layer pixel (the layer is the footage at its nominal size). The
+                // planes are only copied when that changes the scale.
+                let scale = a.width as f64 / f.width as f64;
+                if f.width > 0 && a.width > 0 && a.scale != scale {
+                    let mut a = (*a).clone();
+                    a.scale = scale;
+                    return Some(Arc::new(a));
+                }
+                Some(a)
+            }
+            LayerSource::Comp { item } => {
+                if self.depth > MAX_FX_DEPTH || self.project.comp_contains(*item, ctx.comp_id) {
+                    return None;
+                }
+                self.nested().comp_aux(*item, ctx.nested_time(layer)).map(Arc::new)
+            }
+            _ => None,
+        }
+    }
+
+    /// Evaluation context of comp `comp_id` at comp time `t`.
+    pub fn eval_ctx(&self, comp_id: ItemId, t: Tick) -> Option<EvalCtx<'a>> {
+        Some(self.ctx(comp_id, self.project.comp(comp_id)?, t))
+    }
+
+    /// The layers drawn at the context time, bottom to top (solo, guides and visibility
+    /// applied).
+    pub fn visible_layers(&self, ctx: &EvalCtx<'a>) -> Vec<&'a Layer> {
+        let (comp, t) = (ctx.comp, ctx.time);
+        let any_solo = comp.any_solo();
+        comp.layers
+            .iter()
+            .rev()
+            .filter(|l| l.is_active_at(t) && l.has_video() && !l.environment && (!any_solo || l.switches.solo) && (self.opts.guides || !l.switches.guide))
+            .collect()
+    }
+
+    /// Draw a run of consecutive 3D layers into `canvas` (CPU).
+    pub fn draw_3d_run(&self, ctx: &EvalCtx<'a>, run: &[&Layer], canvas: &mut Image) {
+        three_d::compose::draw_run(self, ctx, run, canvas);
+    }
+
+    /// A run of consecutive 3D layers prepared for an accelerator (planes, lights, shadow
+    /// casters; see [`three_d::Run3d`]) at output size `out`. `None` = draw it with
+    /// [`Self::draw_3d_run`] (adjustment or wireframe layers in the run, Advanced 3D).
+    pub fn prepare_3d_run(&self, ctx: &EvalCtx<'a>, run: &[&Layer], out: (u32, u32)) -> Option<three_d::Run3d> {
+        three_d::compose::gpu_run(self, ctx, run, out)
+    }
+
+    /// A run of consecutive 3D layers of an Advanced 3D comp prepared for an accelerator's
+    /// compositor ([`three_d::adv::Prepared`]): rendered as one scene and composited (Normal,
+    /// premultiplied over) onto the canvas. `None` = not an Advanced 3D comp, or a layer needs the
+    /// 2D compositing path (blend mode, track matte, Preserve Transparency): draw it with
+    /// [`Self::draw_3d_run`].
+    pub fn prepare_adv_run<'p>(&'p self, ctx: &'p EvalCtx<'a>, run: &'p [&'p Layer], out: (u32, u32)) -> Option<three_d::adv::Prepared<'p, 'a>> {
+        three_d::adv::prepare_run(self, ctx, run, out)
+    }
+
+    /// A run of consecutive 3D layers of an Advanced 3D comp whose layers need the 2D
+    /// compositing path (blend mode, track matte, Preserve Transparency), split for an
+    /// accelerator's compositor ([`three_d::adv::SplitRun`]). `None` = [`Self::prepare_adv_run`]
+    /// covers it, or it isn't an Advanced 3D run.
+    pub fn split_adv_run<'p>(&'p self, ctx: &'p EvalCtx<'a>, run: &'p [&'p Layer], out: (u32, u32)) -> Option<three_d::adv::SplitRun<'p, 'a>> {
+        three_d::adv::split_run(self, ctx, run, out)
+    }
+
+    /// Whether the comp's 3D layers draw with the Advanced 3D renderer.
+    pub fn is_adv3d(&self, ctx: &EvalCtx) -> bool {
+        three_d::adv::active(self, ctx)
+    }
+
+    /// An Environment Light Background layer ready to draw on an accelerator
+    /// ([`three_d::SkyDraw`]; the CPU draws it in `draw_3d_run`). `None` = nothing to draw.
+    pub fn sky_draw(&self, ctx: &EvalCtx, layer: &Layer) -> Option<three_d::SkyDraw> {
+        three_d::compose::sky_draw(self, ctx, layer)
+    }
+
+    /// The pixels a Wireframe-quality layer sets (white, opaque) on a `size` canvas: its
+    /// bounds' outline, one pixel wide. Empty when the layer has no bounds.
+    pub fn wireframe_pixels(&self, ctx: &EvalCtx, layer: &Layer, size: (u32, u32)) -> Vec<(u32, u32)> {
+        let Some(b) = content_bounds(ctx, layer) else { return vec![] };
+        let s = self.opts.scale;
+        let (l2c, _) = ctx.layer_to_comp(layer);
+        let m = Mat3::scale(vec2(s, s)) * self.outer.map_or(l2c, |o| o * l2c);
+        let c = [(b[0], b[1]), (b[2], b[1]), (b[2], b[3]), (b[0], b[3])].map(|(x, y)| m.apply(vec2(x, y)));
+        let (w, h) = (size.0 as i64, size.1 as i64);
+        let mut out = vec![];
+        for i in 0..4 {
+            let (p, q) = (c[i], c[(i + 1) % 4]);
+            let n = ((q.x - p.x).abs().max((q.y - p.y).abs()) * 2.0).ceil().clamp(1.0, 1.0e5) as usize;
+            for j in 0..=n {
+                let t = j as f64 / n as f64;
+                let (x, y) = ((p.x + (q.x - p.x) * t).floor() as i64, (p.y + (q.y - p.y) * t).floor() as i64);
+                if x >= 0 && y >= 0 && x < w && y < h {
+                    out.push((x as u32, y as u32));
+                }
+            }
+        }
+        out
+    }
+
+    /// Run the layer's effect stack on `target` (an accelerator's resident image): GPU-capable
+    /// runs through [`FxTarget::gpu`], the others through [`FxTarget::cpu`], with the CPU's
+    /// parameters and environment. `adjustment`: the stack runs on the comp below (adjustment
+    /// layers).
+    pub fn run_effects_on(&self, ctx: &EvalCtx, layer: &Layer, adjustment: bool, target: &mut dyn FxTarget) {
+        // `target` is used as it is: the comp below for adjustment layers (the callers).
+        self.run_effect_stack(ctx, layer, crate::pipeline::EffectStack { adjustment, limit: usize::MAX, origin: [0.0; 2] }, None, target);
+    }
+
+    /// [`Renderer::run_effects_on`] for a (non-adjustment) layer's own pixels: `target` holds
+    /// them in effect space (as [`Renderer::layer_input`] hands them out) and the result stays
+    /// there. Returns the effect-space origin in layer coordinates (rebase by its negation).
+    pub fn run_layer_effects_on(&self, ctx: &EvalCtx, layer: &Layer, target: &mut dyn FxTarget) -> [f64; 2] {
+        let origin = ctx.effect_bounds(layer).1;
+        self.run_effect_stack(ctx, layer, crate::pipeline::EffectStack { adjustment: false, limit: usize::MAX, origin }, None, target);
+        origin
+    }
+
+    /// An adjustment layer's footprint (its source with masks applied, layer space): where
+    /// its effects show. `None` = the layer changes nothing.
+    pub fn adjustment_footprint(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
+        // Cached, so an accelerator sees the same buffer (and uploads it once) every frame.
+        let key = self.cache.and_then(|_| cache::footprint_key(ctx, layer, self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer)));
+        let key = self.mask_gate_key(ctx, layer, self.clipped_key(ctx, layer, key));
+        if let Some((b, _)) = self.cached(key) {
+            return Some(b);
+        }
+        let (foot, files) = self.recorded(key, |r| {
+            // (what the masks' expressions read, at shutter times too, goes to the buffer's files)
+            let ctx = &r.with_reads(ctx);
+            let mut foot = r.source(ctx, layer)?;
+            let _ = masks::apply(ctx, layer, &mut foot, r.mask_blur(ctx, layer));
+            Some(foot)
+        });
+        // The buffer the cache keeps (another worker's, if it kept one first).
+        Some(self.keep(key, Arc::new(foot?), &files).0)
+    }
+
+    /// Draw one 2D layer into `canvas` on the CPU (any kind: adjustment, wireframe, styled…).
+    pub fn draw_layer_cpu(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image) {
+        self.draw_layer(ctx, layer, canvas, false);
+    }
+
+    /// Draw a collapsed precomp layer into `canvas` on the CPU.
+    pub fn draw_collapsed_cpu(&self, ctx: &EvalCtx<'a>, layer: &'a Layer, collapsed: &crate::Collapsed, canvas: &mut Image) {
+        self.draw_collapsed(ctx, layer, collapsed, canvas, false);
+    }
+
+    /// The layer's finished buffers (styles included) in the blending space.
+    pub fn styled_layer(&self, ctx: &EvalCtx, layer: &Layer) -> Option<StyledLayer> {
+        let mut timing = self.profile.map(|_| LayerTiming { depth: self.depth, layer: layer.name.clone(), ..Default::default() });
+        let t0 = web_time::Instant::now();
+        let st = self.styled(ctx, layer, timing.as_mut()).map(|st| self.styled_to_blend(st));
+        if let (Some(prof), Some(mut timing)) = (self.profile, timing) {
+            timing.process_ms = t0.elapsed().as_secs_f64() * 1e3;
+            if let Ok(mut v) = prof.lock() {
+                v.push(timing);
+            }
+        }
+        st
+    }
+
+    /// Opacity the layer composites with (its Opacity × collapsed precomps' opacity).
+    pub fn layer_opacity(&self, ctx: &EvalCtx, layer: &Layer) -> f32 {
+        ctx.opacity(layer) as f32 * self.opacity_mul
+    }
+
+    /// The layer's track matte layer and kind, if it has a valid one.
+    pub fn track_matte<'c>(&self, ctx: &EvalCtx<'c>, layer: &Layer) -> Option<(&'c Layer, MatteKind)> {
+        layer.track_matte.and_then(|tm| ctx.comp.layer(tm.layer).filter(|m| m.id != layer.id).map(|m| (m, tm.kind)))
+    }
+}
diff --git a/crates/render/src/audio.rs b/crates/render/src/audio.rs
index 68be63fe4..00342847d 100644
--- a/crates/render/src/audio.rs
+++ b/crates/render/src/audio.rs
@@ -4,10 +4,13 @@
 //! (Effect > Audio, see [`effectcraft_effects::audio_fx`]) run on each layer's audio before
 //! its levels; Backwards plays the layer's [in, out) span reversed.
 //!
-//! Callers mix in short blocks (one video frame, or an audio device buffer). Effects and levels
-//! are evaluated once per block. To make the result independent of block boundaries, layer
-//! effects are run from a cleared state over a pre-roll of earlier audio and only the block's
-//! tail is kept — so preview playback and export produce identical samples.
+//! Callers mix in short blocks (one video frame, an audio device buffer, or a second of export).
+//! Effect parameters are evaluated once per block. Animated Audio Levels, and animated effects
+//! that work sample by sample (Stereo Mixer), are evaluated on a grid of comp samples every
+//! millisecond instead, so keyframed fades ramp smoothly whatever the block size. To make the
+//! result independent of block boundaries, layer effects are run from a cleared state over a
+//! pre-roll of earlier audio and only the block's tail is kept — so preview playback and export
+//! produce identical samples.
 //!
 //! Time-stretched layers are resampled nearest-sample; reversed (negative stretch) layers are
 //! silent for now.
@@ -25,7 +28,7 @@ const MAX_DEPTH: usize = 16;
 /// interleaved (L R L R …).
 pub fn mix_comp(project: &Project, footage: &dyn FootageSource, expr: Option<&dyn ExprHost>, comp: ItemId, start: Tick, frames: usize, rate: u32) -> Vec<f32> {
     let mut out = vec![0.0f32; frames * 2];
-    mix_into(project, footage, expr, comp, start, rate, &mut out, 1.0, 1.0, 0);
+    mix_into(&AudioSources { project, footage, expr, rate }, comp, start, &mut out, 0);
     out
 }
 
@@ -85,6 +88,20 @@ fn units_ceil(t: Tick, rate: u32) -> i64 {
     (n.div_euclid(d) + i128::from(n.rem_euclid(d) != 0)) as i64
 }
 
+/// Samples between evaluations of animated levels and per-sample effects: one millisecond, on
+/// a grid of comp sample indices so the result does not depend on where a block starts.
+fn param_step(rate: u32) -> i64 {
+    i64::from(rate / 1000).max(1)
+}
+
+/// Does any property of the group change over time?
+fn animated(g: &effectcraft_project::PropGroup) -> bool {
+    g.children.iter().any(|c| match c {
+        Node::Prop(p) => p.is_animated() || p.has_expression(),
+        Node::Group(sub) => animated(sub),
+    })
+}
+
 fn sample_tick(i: i64, rate: u32) -> Tick {
     // Keep the requested sample when the rate does not divide the tick clock.
     let t = Tick::from_units(i, i64::from(rate));
@@ -138,7 +155,9 @@ impl MixEnv<'_> {
             return out;
         }
         let m = b - a;
-        let speed = 100.0 / l.stretch;
+        // Within ±1 % to ±9900 % (#3247): a stretch of 1e-300 % set in memory read about
+        // usize::MAX source samples for one block.
+        let speed = 100.0 / l.effective_stretch();
         let src_n = ((m as f64 * speed).ceil() as usize).max(1);
         let lt = l.layer_time(sample_tick(i0 + a as i64, rate));
         let buf = match &l.source {
@@ -151,7 +170,7 @@ impl MixEnv<'_> {
                     return out;
                 }
                 let mut sub = vec![0.0f32; src_n * 2];
-                mix_into(self.project, self.footage, self.expr, *item, lt, rate, &mut sub, 1.0, 1.0, self.depth + 1);
+                mix_into(&AudioSources { project: self.project, footage: self.footage, expr: self.expr, rate }, *item, lt, &mut sub, self.depth + 1);
                 sub
             }
             _ => return out,
@@ -189,36 +208,82 @@ impl MixEnv<'_> {
     /// `i0 .. i0 + n`.
     fn layer_audio(&self, l: &Layer, i0: i64, n: usize) -> Vec<f32> {
         let t = sample_tick(i0, self.rate);
-        let fx: Vec<(&str, Params)> = audio_effect_groups(l).map(|(id, g)| (id, self.params(l, g, t))).collect();
+        let fx: Vec<(&str, &effectcraft_project::PropGroup, Params)> = audio_effect_groups(l).map(|(id, g)| (id, g, self.params(l, g, t))).collect();
         if fx.is_empty() {
             return self.layer_raw(l, i0, n, false);
         }
-        let reversed = fx.iter().any(|(id, _)| audio_fx::reverses(id));
-        let pre_s: f64 = fx.iter().map(|(id, p)| audio_fx::preroll(id, p)).sum();
+        let reversed = fx.iter().any(|(id, _, _)| audio_fx::reverses(id));
+        let pre_s: f64 = fx.iter().map(|(id, _, p)| audio_fx::preroll(id, p)).sum();
         let pre = (pre_s * self.rate as f64).ceil() as usize;
-        let mut buf = self.layer_raw(l, i0 - pre as i64, n + pre, reversed);
-        let start = l.layer_time(sample_tick(i0 - pre as i64, self.rate)).seconds();
-        for (id, p) in &fx {
-            audio_fx::process(id, p, &mut buf, self.rate, start);
+        let b0 = i0 - pre as i64;
+        let mut buf = self.layer_raw(l, b0, n + pre, reversed);
+        let start = l.layer_time(sample_tick(b0, self.rate)).seconds();
+        for (id, g, p) in &fx {
+            if audio_fx::per_sample(id) && animated(g) {
+                self.process_stepped(l, id, g, &mut buf, b0);
+            } else {
+                audio_fx::process(id, p, &mut buf, self.rate, start);
+            }
         }
         buf.drain(..pre * 2);
         buf
     }
+
+    /// Run per-sample effect `id` over `buf` (comp samples from `b0`) in pieces of the parameter
+    /// grid, each with the parameters at its first sample.
+    fn process_stepped(&self, l: &Layer, id: &str, g: &effectcraft_project::PropGroup, buf: &mut [f32], b0: i64) {
+        let step = param_step(self.rate);
+        let frames = buf.len() / 2;
+        let mut k = 0usize;
+        while k < frames {
+            let i = b0.saturating_add(k as i64);
+            let next = i.div_euclid(step).saturating_add(1).saturating_mul(step);
+            let end = usize::try_from(next.saturating_sub(b0)).unwrap_or(frames).clamp(k + 1, frames);
+            let t = sample_tick(i, self.rate);
+            if let Some(piece) = buf.get_mut(k * 2..end * 2) {
+                audio_fx::process(id, &self.params(l, g, t), piece, self.rate, l.layer_time(t).seconds());
+            }
+            k = end;
+        }
+    }
+
+    /// Linear gains (left, right) of the layer's Audio Levels for comp samples `i0 .. i0 + n`.
+    /// Animated levels are evaluated on the parameter grid and interpolated in dB in between.
+    fn level_gains(&self, l: &Layer, i0: i64, n: usize) -> Vec<[f32; 2]> {
+        let Some(pr) = l.props.sub("audio").and_then(|g| g.get("levels")) else { return vec![[1.0, 1.0]; n] };
+        let db = |i: i64| self.ctx(sample_tick(i, self.rate)).value(l, pr).as_vec2();
+        let gain = |[a, b]: [f64; 2]| [db_to_gain(a), db_to_gain(b)];
+        if !pr.is_animated() && !pr.has_expression() {
+            return vec![gain(db(i0)); n];
+        }
+        let step = param_step(self.rate);
+        let end = i0.saturating_add(n as i64);
+        let mut out = Vec::with_capacity(n);
+        let mut k = i0.div_euclid(step).saturating_mul(step);
+        let mut lo = db(k);
+        while k < end {
+            let hi = db(k.saturating_add(step));
+            for i in k.max(i0)..k.saturating_add(step).min(end) {
+                let f = (i - k) as f64 / step as f64;
+                out.push(gain([lo[0] + (hi[0] - lo[0]) * f, lo[1] + (hi[1] - lo[1]) * f]));
+            }
+            k = k.saturating_add(step);
+            lo = hi;
+        }
+        out
+    }
 }
 
-#[allow(clippy::too_many_arguments)]
-fn mix_into(
-    project: &Project,
-    footage: &dyn FootageSource,
-    expr: Option<&dyn ExprHost>,
-    comp_id: ItemId,
-    start: Tick,
+/// Shared inputs for composition audio mixing, including nested compositions.
+struct AudioSources<'a> {
+    project: &'a Project,
+    footage: &'a dyn FootageSource,
+    expr: Option<&'a dyn ExprHost>,
     rate: u32,
-    out: &mut [f32],
-    gl: f32,
-    gr: f32,
-    depth: usize,
-) {
+}
+
+fn mix_into(sources: &AudioSources<'_>, comp_id: ItemId, start: Tick, out: &mut [f32], depth: usize) {
+    let AudioSources { project, footage, expr, rate } = *sources;
     let Some(comp) = project.comp(comp_id) else { return };
     if depth >= MAX_DEPTH || rate == 0 {
         return;
@@ -228,7 +293,8 @@ fn mix_into(
     let any_solo = comp.layers.iter().any(|l| l.switches.solo && audible(project, l));
     let s0 = start.to_units_floor(rate as i64);
     for l in &comp.layers {
-        if !audible(project, l) || (any_solo && !l.switches.solo) || l.stretch <= 0.0 {
+        // The stretch the layer's time uses (#3247): 0 and NaN play at 100 %, as `layer_time`.
+        if !audible(project, l) || (any_solo && !l.switches.solo) || l.effective_stretch() <= 0.0 {
             continue;
         }
         // Sample range of the block that falls inside the layer's [in, out).
@@ -237,26 +303,18 @@ fn mix_into(
         if a >= b {
             continue;
         }
-        let t_a = sample_tick(s0 + a as i64, rate);
-        let (ll, lr) = levels(&env, l, t_a);
-        let (ll, lr) = (ll * gl, lr * gr);
-        if ll == 0.0 && lr == 0.0 {
+        let gains = env.level_gains(l, s0 + a as i64, b - a);
+        if gains.iter().all(|g| *g == [0.0, 0.0]) {
             continue;
         }
         let buf = env.layer_audio(l, s0 + a as i64, b - a);
-        for (i, f) in buf.as_chunks::<2>().0.iter().enumerate() {
-            out[(a + i) * 2] += f[0] * ll;
-            out[(a + i) * 2 + 1] += f[1] * lr;
+        for (i, (f, g)) in buf.as_chunks::<2>().0.iter().zip(&gains).enumerate() {
+            out[(a + i) * 2] += f[0] * g[0];
+            out[(a + i) * 2 + 1] += f[1] * g[1];
         }
     }
 }
 
-fn levels(env: &MixEnv, l: &Layer, t: Tick) -> (f32, f32) {
-    let Some(g) = l.props.sub("audio") else { return (1.0, 1.0) };
-    let [a, b] = env.ctx(t).v2(l, g, "levels", [0.0, 0.0]);
-    (db_to_gain(a), db_to_gain(b))
-}
-
 /// A min/max peak summary of interleaved stereo audio for waveform drawing: one entry per
 /// `bin` sample frames, `[min L, max L, min R, max R]`.
 pub fn peak_summary(samples: &[f32], bin: usize) -> Vec<[f32; 4]> {
@@ -351,7 +409,7 @@ mod tests {
             pr.value = effectcraft_project::Value::Vec2([-6.0206, -96.0]);
         }
         let mut comp = comp;
-        comp.layers = vec![l1, l2];
+        comp.layers = vec![l1, l2].into();
         let cid = p.add_item("C", effectcraft_color::Label::Sandstone, None, ItemKind::Comp(comp.into()));
         assert!(comp_has_audio(&p, cid));
         let rate = 1000;
@@ -397,11 +455,11 @@ mod tests {
         let base = Comp::new(64, 64, FrameRate::new(25, 1), Tick::from_seconds_f64(2.0));
         let tone = build::layer(&mut p, &base, "tone", LayerSource::Footage { item: fid }, (0, 0), None);
         let mut inner = base.clone();
-        inner.layers = vec![tone];
+        inner.layers = vec![tone].into();
         let inner_id = p.add_item("Inner", effectcraft_color::Label::Sandstone, None, ItemKind::Comp(inner.into()));
         let pre = build::layer(&mut p, &base, "pre", LayerSource::Comp { item: inner_id }, (64, 64), None);
         let mut outer = base.clone();
-        outer.layers = vec![pre];
+        outer.layers = vec![pre].into();
         let outer_id = p.add_item("Outer", effectcraft_color::Label::Sandstone, None, ItemKind::Comp(outer.into()));
         let rate = 8000;
         let t = Tick::from_seconds_f64(0.5);
@@ -428,7 +486,7 @@ mod tests {
         let mut tone = build::layer(&mut p, &base, "tone", LayerSource::Footage { item: fid }, (0, 0), None);
         tone.stretch = stretch;
         let mut comp = base.clone();
-        comp.layers = vec![tone];
+        comp.layers = vec![tone].into();
         let cid = p.add_item("C", effectcraft_color::Label::Sandstone, None, ItemKind::Comp(comp.into()));
         let n = 2000usize;
         let t = Tick::from_seconds_f64(0.5);
diff --git a/crates/render/src/cache.rs b/crates/render/src/cache.rs
index bae12d1e3..0756c47f2 100644
--- a/crates/render/src/cache.rs
+++ b/crates/render/src/cache.rs
@@ -22,27 +22,36 @@ use std::hash::{Hash, Hasher};
 use std::sync::{Arc, Mutex};
 
 use effectcraft_effects::Buf;
-use effectcraft_project::{ItemKind, Layer, LayerSource, Node, PropGroup};
+use effectcraft_keyframe::Value;
+use effectcraft_project::{FootageKind, ItemKind, Layer, LayerSource, Node, PropGroup};
 
+use crate::disk_cache::{EntryFiles, SharedVirtualFileId, VirtualFileId, layer_disk_key};
 use crate::eval::EvalCtx;
+use crate::reads::ReadFiles;
 
 mod dependencies;
 
 /// Thread-safe, memory-budgeted cache of processed layer buffers, optionally backed by the
 /// persistent [`DiskCache`](crate::disk_cache::DiskCache): a memory miss reads the disk, and
-/// buffers that were slow to render are written there (keys salted per project, see
-/// [`LayerCache::set_disk`]).
+/// buffers that were slow to render are written there with the source files they were made of
+/// (keys: [`crate::disk_cache::layer_disk_key`]; an entry is used only while its files are
+/// unchanged, #3184).
 pub struct LayerCache {
     inner: Mutex<Inner>,
-    disk: Mutex<Option<(Arc<crate::disk_cache::DiskCache>, u64)>>,
+    disk: Mutex<Option<Arc<crate::disk_cache::DiskCache>>>,
     /// Another persistent store when there is no disk cache (the browser's, [`PrefetchStore`]).
-    store: Mutex<Option<(Arc<dyn LayerStore>, u64)>>,
+    store: Mutex<Option<Arc<dyn LayerStore>>>,
+    /// Size and content hash of files served from memory (the browser file table), to store
+    /// and check the source files of persistent entries.
+    virtual_id: Mutex<Option<SharedVirtualFileId>>,
     /// While set, inserts are dropped (see [`LayerCache::set_gate`]).
     gate: Mutex<Option<Arc<std::sync::atomic::AtomicBool>>>,
 }
 
 struct Entry {
     buf: Arc<Buf>,
+    /// The source files the buffer was made of (see [`crate::reads`]).
+    files: Arc<ReadFiles>,
     bytes: usize,
     last_use: u64,
 }
@@ -54,7 +63,9 @@ struct Inner {
     clock: u64,
     hits: u64,
     misses: u64,
-    /// When each recent miss happened (to time the render that follows it).
+    /// When each recent miss happened, to time the render that follows it (the drop generation
+    /// a render's reads started at travels with its files instead, [`ReadFiles::since`]: two
+    /// renders of a key may overlap).
     missed_at: HashMap<u64, web_time::Instant>,
 }
 
@@ -80,6 +91,7 @@ impl LayerCache {
             inner: Mutex::new(Inner { map: HashMap::new(), bytes: 0, budget, clock: 0, hits: 0, misses: 0, missed_at: HashMap::new() }),
             disk: Mutex::new(None),
             store: Mutex::new(None),
+            virtual_id: Mutex::new(None),
             gate: Mutex::new(None),
         }
     }
@@ -98,107 +110,191 @@ impl LayerCache {
         self.gate.lock().ok().and_then(|g| g.as_ref().map(|g| g.load(std::sync::atomic::Ordering::Relaxed))).unwrap_or(false)
     }
 
-    /// Attach (or detach) the disk cache. `salt` separates projects and footage versions (see
-    /// `footage_salt`); keys on disk are `(salt, key)`.
-    pub fn set_disk(&self, disk: Option<(Arc<crate::disk_cache::DiskCache>, u64)>) {
+    /// Attach (or detach) the disk cache. It is used at once: its entries check their own
+    /// source files when read, so nothing has to be looked at first.
+    pub fn set_disk(&self, disk: Option<Arc<crate::disk_cache::DiskCache>>) {
         if let Ok(mut d) = self.disk.lock() {
             *d = disk;
         }
     }
 
-    /// Change the disk salt (after footage changed) keeping the attached disk cache.
-    pub fn set_disk_salt(&self, salt: u64) {
-        if let Ok(mut d) = self.disk.lock()
-            && let Some((_, s)) = d.as_mut()
-        {
-            *s = salt;
-        }
-    }
-
+    /// The attached disk cache, if any.
     pub fn disk(&self) -> Option<Arc<crate::disk_cache::DiskCache>> {
-        self.disk.lock().ok()?.as_ref().map(|d| d.0.clone())
+        self.disk.lock().ok()?.clone()
     }
 
     /// Attach (or detach) a [`LayerStore`] used when no disk cache is attached (the browser's
-    /// Origin Private File System through a [`PrefetchStore`]); `salt` as in
-    /// [`LayerCache::set_disk`].
-    pub fn set_store(&self, store: Option<(Arc<dyn LayerStore>, u64)>) {
+    /// Origin Private File System through a [`PrefetchStore`]).
+    pub fn set_store(&self, store: Option<Arc<dyn LayerStore>>) {
         if let Ok(mut s) = self.store.lock() {
             *s = store;
         }
     }
 
-    /// Change the store's salt (a new project or footage), keeping the store.
-    pub fn set_store_salt(&self, salt: u64) {
-        if let Ok(mut d) = self.store.lock()
-            && let Some((_, s)) = d.as_mut()
-        {
-            *s = salt;
+    /// Size and content hash of files served from memory (the browser file table): what a
+    /// persistent entry keeps for them and checks them against.
+    pub fn set_virtual_id(&self, id: Option<SharedVirtualFileId>) {
+        if let Ok(mut v) = self.virtual_id.lock() {
+            *v = id;
         }
     }
 
-    fn disk_key(&self, key: u64) -> Option<(Arc<dyn LayerStore>, u128)> {
-        let salted = |salt: u64| ((salt as u128) << 64) | key as u128;
-        if let Some((dc, salt)) = self.disk.lock().ok()?.as_ref() {
-            return Some((dc.clone() as Arc<dyn LayerStore>, salted(*salt)));
-        }
-        let s = self.store.lock().ok()?;
-        let (st, salt) = s.as_ref()?;
-        Some((st.clone(), salted(*salt)))
+    /// The attached virtual-file identity lookup, if any.
+    fn virtual_id(&self) -> Option<SharedVirtualFileId> {
+        self.virtual_id.lock().ok()?.clone()
     }
 
-    pub fn get(&self, key: u64) -> Option<Arc<Buf>> {
-        let mut g = self.inner.lock().ok()?;
-        g.clock += 1;
-        let now = g.clock;
-        match g.map.get_mut(&key) {
-            Some(e) => {
-                e.last_use = now;
-                let b = e.buf.clone();
-                g.hits += 1;
-                Some(b)
-            }
+    /// The persistent store behind the memory: the disk cache, else the other store.
+    fn persistent(&self) -> Option<Arc<dyn LayerStore>> {
+        if let Some(dc) = self.disk.lock().ok()?.as_ref() {
+            return Some(dc.clone() as Arc<dyn LayerStore>);
+        }
+        self.store.lock().ok()?.clone()
+    }
+
+    /// The buffer kept under `key` and the source files it was made of (see [`crate::reads`]).
+    /// A buffer from the disk cache or another store comes with the files its entry lists, after
+    /// they were found unchanged. A buffer made of a file dropped since its reads began (File ▸
+    /// Reload Footage) is never served: it is forgotten, and the lookup is a miss.
+    pub fn get(&self, key: u64) -> Option<(Arc<Buf>, Arc<ReadFiles>)> {
+        match self.kept(key, true) {
+            Some(found) => Some(found),
             None => {
+                let mut g = self.inner.lock().ok()?;
                 g.misses += 1;
-                if g.missed_at.len() > 4096 {
-                    g.missed_at.clear();
-                }
-                g.missed_at.insert(key, web_time::Instant::now());
                 drop(g);
-                // Disk cache: a hit comes back into memory.
-                let (dc, dk) = self.disk_key(key)?;
-                let buf = dc.get_layer(dk)?;
-                self.insert_mem(key, buf.clone());
-                Some(buf)
+                let store = self.persistent();
+                // (before the entry is read: what it is made of may be dropped meanwhile)
+                let since = store.as_ref().map_or(0, |s| s.drop_generation());
+                if let Ok(mut g) = self.inner.lock() {
+                    if g.missed_at.len() > 4096 {
+                        g.missed_at.clear();
+                    }
+                    g.missed_at.insert(key, web_time::Instant::now());
+                }
+                // Disk cache: a hit comes back into memory, read at generation `since`.
+                let store = store?;
+                let id = self.virtual_id();
+                let (buf, mut files) = store.get_layer(layer_disk_key(key), id.as_deref())?;
+                files.note_since(since);
+                let files = Arc::new(files);
+                Some(self.insert_mem(key, buf, files))
             }
         }
     }
 
-    pub fn insert(&self, key: u64, buf: Arc<Buf>) {
+    /// Keep `buf` under `key`, and return the buffer the cache holds for it: the one kept first
+    /// when another render of the same layer got there before (#1812: preview workers starting
+    /// together each rendered every layer; sharing the first buffer, the GPU compositor uploads
+    /// and packs it once instead of once per worker, which ran it out of memory). Renders don't
+    /// wait for each other: on the frame workers' shared thread pool a wait can end up under
+    /// the very work it waits for. `files`: the source files `buf` was made of (see
+    /// [`crate::reads`]); a buffer whose files can't all be named stays in memory. The files
+    /// returned are the ones the returned buffer was made of.
+    ///
+    /// The drop generation `buf`'s reads started at comes with `files` ([`ReadFiles::since`],
+    /// from [`LayerCache::drop_generation`] when the render began): a buffer made of a file
+    /// dropped since (File ▸ Reload Footage while it rendered) is kept neither on disk nor in
+    /// memory. A list that doesn't say counts as made before every drop. A buffer made of values
+    /// its key doesn't capture ([`ReadFiles::is_unkeyed`]) stays in memory.
+    pub fn insert(&self, key: u64, buf: Arc<Buf>, files: Arc<ReadFiles>) -> (Arc<Buf>, Arc<ReadFiles>) {
         if self.gated() {
-            return;
+            return (buf, files);
+        }
+        if let Some(kept) = self.kept(key, false) {
+            return kept;
+        }
+        let store = self.persistent();
+        let since = files.since().unwrap_or(0);
+        // (before the miss's time is taken: it may time another render of the key)
+        if store.as_ref().is_some_and(|s| s.dropped_since(&files, since)) {
+            return (buf, files);
         }
         let started = self.inner.lock().ok().and_then(|mut g| g.missed_at.remove(&key));
-        if let Some((dc, dk)) = self.disk_key(key) {
-            let slow = started.is_some_and(|t| t.elapsed().as_secs_f64() * 1e3 >= dc.min_layer_ms() as f64);
-            if slow {
-                dc.put_layer(dk, &buf);
+        if let Some(store) = store {
+            let id = self.virtual_id();
+            // (an incomplete list, or a file from memory without its identity: not stored)
+            if let Some(t) = started
+                && !files.is_unkeyed()
+                && t.elapsed().as_secs_f64() * 1e3 >= store.min_layer_ms() as f64
+                && let Some(entry) = EntryFiles::of(&files, id.as_deref())
+            {
+                store.put_layer(layer_disk_key(key), &buf, &entry, since);
             }
         }
-        self.insert_mem(key, buf);
+        self.insert_mem(key, buf, files)
     }
 
-    fn insert_mem(&self, key: u64, buf: Arc<Buf>) {
+    /// The buffer kept in memory under `key` with its files, if it is not made of a file dropped
+    /// since its reads began (one that is, is forgotten). `hit`: count it as a hit and as just
+    /// used. (A render that started before a drop may publish its buffer after the drop's
+    /// purge, Reload Footage clearing the cache while the buffer was being written: the check
+    /// here, not the order of the two, keeps it from being served.)
+    fn kept(&self, key: u64, hit: bool) -> Option<(Arc<Buf>, Arc<ReadFiles>)> {
+        let found = {
+            let mut g = self.inner.lock().ok()?;
+            g.clock += 1;
+            let now = g.clock;
+            let e = g.map.get_mut(&key)?;
+            if hit {
+                e.last_use = now;
+            }
+            (e.buf.clone(), e.files.clone())
+        };
+        if self.made_before_a_drop(&found.1) {
+            if let Ok(mut g) = self.inner.lock()
+                && g.map.get(&key).is_some_and(|e| Arc::ptr_eq(&e.files, &found.1))
+                && let Some(e) = g.map.remove(&key)
+            {
+                g.bytes = g.bytes.saturating_sub(e.bytes);
+            }
+            return None;
+        }
+        if hit && let Ok(mut g) = self.inner.lock() {
+            g.hits += 1;
+        }
+        Some(found)
+    }
+
+    /// Whether a buffer made of `files` holds a file as it was before a drop that came after its
+    /// reads began ([`ReadFiles::since`]; a list that doesn't say counts as made before every
+    /// drop).
+    fn made_before_a_drop(&self, files: &ReadFiles) -> bool {
+        self.persistent().is_some_and(|s| s.dropped_since(files, files.since().unwrap_or(0)))
+    }
+
+    /// The persistent store's drop generation now ([`LayerStore::drop_generation`]), taken by a
+    /// render before it starts reading (`None` without a store).
+    pub fn drop_generation(&self) -> Option<u64> {
+        self.persistent().map(|s| s.drop_generation())
+    }
+
+    /// See [`LayerCache::insert`]: the buffer kept under `key` and its files (`buf` and `files`,
+    /// unless one was kept first or `buf` is too large to keep).
+    fn insert_mem(&self, key: u64, buf: Arc<Buf>, files: Arc<ReadFiles>) -> (Arc<Buf>, Arc<ReadFiles>) {
         let bytes = buf.img.data.len() * std::mem::size_of::<effectcraft_raster::Px>();
-        let Ok(mut g) = self.inner.lock() else { return };
+        let Ok(mut g) = self.inner.lock() else { return (buf, files) };
         if bytes > g.budget / 4 {
-            return;
+            return (buf, files);
         }
         g.clock += 1;
         let now = g.clock;
-        if let Some(old) = g.map.insert(key, Entry { buf, bytes, last_use: now }) {
-            g.bytes -= old.bytes;
+        if let Some(e) = g.map.get_mut(&key) {
+            // (one made before a drop gives way: see [`LayerCache::kept`])
+            if !self.made_before_a_drop(&e.files) {
+                e.last_use = now;
+                return (e.buf.clone(), e.files.clone());
+            }
+            if let Some(old) = g.map.remove(&key) {
+                g.bytes = g.bytes.saturating_sub(old.bytes);
+            }
         }
+        // (checked again just before it is published: a drop may have come since `insert`
+        // checked; one that comes later is caught when the buffer is looked up)
+        if self.made_before_a_drop(&files) {
+            return (buf, files);
+        }
+        g.map.insert(key, Entry { buf: buf.clone(), files: files.clone(), bytes, last_use: now });
         g.bytes += bytes;
         if g.bytes > g.budget {
             // Evict least-recently used entries down to 3/4 of the budget.
@@ -214,6 +310,7 @@ impl LayerCache {
                 }
             }
         }
+        (buf, files)
     }
 
     /// The memory budget in bytes.
@@ -251,12 +348,28 @@ impl LayerCache {
     }
 }
 
-/// Persistent storage of layer buffers behind a [`LayerCache`] (keys salted per project).
+/// Persistent storage of layer buffers behind a [`LayerCache`] (keys:
+/// [`crate::disk_cache::layer_disk_key`]). Every entry keeps the source files its buffer was made
+/// of and is used only while they are unchanged (#3184).
 pub trait LayerStore: Send + Sync {
-    /// A stored buffer (synchronous: mid-render).
-    fn get_layer(&self, key: u128) -> Option<Arc<Buf>>;
-    /// Keep a buffer that was slow to render.
-    fn put_layer(&self, key: u128, buf: &Buf);
+    /// A stored buffer whose source files are unchanged, with those files (synchronous:
+    /// mid-render). An entry whose files changed, or damaged, is a miss and is dropped, so the
+    /// buffer rendered again replaces it. `virtual_id` names files served from memory.
+    fn get_layer(&self, key: u128, virtual_id: Option<VirtualFileId<'_>>) -> Option<(Arc<Buf>, ReadFiles)>;
+    /// Keep a buffer that was slow to render, with the source files it was made of. `since`: the
+    /// [`LayerStore::drop_generation`] when its render started (a buffer made of a file dropped
+    /// after that is refused).
+    fn put_layer(&self, key: u128, buf: &Buf, files: &EntryFiles, since: u64);
+    /// How many times files were dropped from the store (File ▸ Reload Footage,
+    /// [`crate::disk_cache::DiskCache::drop_files`]); `0` for a store that never drops.
+    fn drop_generation(&self) -> u64 {
+        0
+    }
+    /// Whether one of `files` was dropped after generation `since`: what was made of them is
+    /// from before the drop. `false` for a store that never drops.
+    fn dropped_since(&self, _files: &ReadFiles, _since: u64) -> bool {
+        false
+    }
     /// Buffers faster to render than this (ms) are not stored.
     fn min_layer_ms(&self) -> u64 {
         0
@@ -268,9 +381,10 @@ pub const PREFETCH_MIN_LAYER_MS: u64 = 20;
 
 /// A [`LayerStore`] over storage that can't be read in the middle of a render (the browser's
 /// Origin Private File System, read asynchronously). Lookups are served from buffers fetched
-/// before the frame ([`PrefetchStore::provide`]); the keys a render looked up and didn't find
-/// are recorded ([`PrefetchStore::take_misses`]) so the transport can fetch them before the next
-/// frame; buffers to store queue up as sealed entries ([`PrefetchStore::take_writes`]) for the
+/// before the frame ([`PrefetchStore::provide`]), once the files their entries list are found
+/// unchanged; the keys a render looked up and didn't find are recorded
+/// ([`PrefetchStore::take_misses`]) so the transport can fetch them before the next frame;
+/// buffers to store queue up as sealed entries ([`PrefetchStore::take_writes`]) for the
 /// transport to write after the frame. Fetched buffers are kept least recently used first, up
 /// to a byte budget.
 pub struct PrefetchStore {
@@ -279,9 +393,21 @@ pub struct PrefetchStore {
     min_ms: u64,
 }
 
+/// A fetched entry: the buffer, the source files it was made of, its last use.
+struct Fetched {
+    buf: Arc<Buf>,
+    files: Arc<EntryFiles>,
+    used: u64,
+}
+
+/// The memory a buffer's pixels take, in bytes.
+fn buf_bytes(b: &Buf) -> usize {
+    b.img.data.len().saturating_mul(std::mem::size_of::<effectcraft_raster::Px>())
+}
+
 #[derive(Default)]
 struct Prefetched {
-    ready: HashMap<u128, (Arc<Buf>, u64)>,
+    ready: HashMap<u128, Fetched>,
     bytes: usize,
     clock: u64,
     misses: Vec<u128>,
@@ -291,6 +417,22 @@ struct Prefetched {
     known: std::collections::HashSet<u128>,
 }
 
+impl Prefetched {
+    /// Records a missed key for prefetching, up to a fixed bound.
+    fn note_miss(&mut self, key: u128) {
+        if !self.misses.contains(&key) && self.misses.len() < 1024 {
+            self.misses.push(key);
+        }
+    }
+
+    /// Drops the prefetched entry for `key` and frees its bytes.
+    fn remove(&mut self, key: u128) {
+        if let Some(f) = self.ready.remove(&key) {
+            self.bytes = self.bytes.saturating_sub(buf_bytes(&f.buf));
+        }
+    }
+}
+
 impl Default for PrefetchStore {
     fn default() -> Self {
         PrefetchStore::new(256 << 20)
@@ -314,23 +456,21 @@ impl PrefetchStore {
     }
 
     /// A fetched entry (sealed bytes, [`crate::disk_cache::layer_entry`]) for `key`; `false`
-    /// when damaged.
+    /// when damaged or of another format. Its files are checked when the buffer is used.
     pub fn provide(&self, key: u128, entry: &[u8]) -> bool {
-        let Some(buf) = crate::disk_cache::read_layer_entry(entry) else { return false };
-        let bytes = buf.img.data.len() * std::mem::size_of::<effectcraft_raster::Px>();
+        let Some((buf, files)) = crate::disk_cache::read_layer_entry(entry) else { return false };
+        let buf = Arc::new(buf);
+        let bytes = buf_bytes(&buf);
         let Ok(mut s) = self.st.lock() else { return false };
         s.clock += 1;
-        let now = s.clock;
-        if let Some((old, _)) = s.ready.insert(key, (Arc::new(buf), now)) {
-            s.bytes -= old.img.data.len() * std::mem::size_of::<effectcraft_raster::Px>();
-        }
-        s.bytes += bytes;
+        let used = s.clock;
+        s.remove(key);
+        s.ready.insert(key, Fetched { buf, files: Arc::new(files), used });
+        s.bytes = s.bytes.saturating_add(bytes);
         s.known.insert(key);
         while s.bytes > self.budget {
-            let Some((&k, _)) = s.ready.iter().min_by_key(|(_, (_, t))| *t) else { break };
-            if let Some((b, _)) = s.ready.remove(&k) {
-                s.bytes -= b.img.data.len() * std::mem::size_of::<effectcraft_raster::Px>();
-            }
+            let Some(oldest) = s.ready.iter().min_by_key(|(_, f)| f.used).map(|(k, _)| *k) else { break };
+            s.remove(oldest);
         }
         true
     }
@@ -359,32 +499,46 @@ impl PrefetchStore {
 }
 
 impl LayerStore for PrefetchStore {
-    fn get_layer(&self, key: u128) -> Option<Arc<Buf>> {
+    /// The prefetched layer for `key` with its read files, or `None` when it is not ready.
+    fn get_layer(&self, key: u128, virtual_id: Option<VirtualFileId<'_>>) -> Option<(Arc<Buf>, ReadFiles)> {
+        let found = {
+            let mut s = self.st.lock().ok()?;
+            s.clock += 1;
+            let now = s.clock;
+            match s.ready.get_mut(&key) {
+                Some(f) => {
+                    f.used = now;
+                    Some((f.buf.clone(), f.files.clone()))
+                }
+                None => {
+                    s.note_miss(key);
+                    None
+                }
+            }
+        };
+        let (buf, files) = found?;
+        // (looked at without the lock: one call of the hook, or one `metadata`, per file)
+        let unchanged = files.unchanged(virtual_id);
         let mut s = self.st.lock().ok()?;
-        s.clock += 1;
-        let now = s.clock;
-        match s.ready.get_mut(&key) {
-            Some((b, t)) => {
-                *t = now;
-                let b = b.clone();
-                if !s.hits.contains(&key) {
-                    s.hits.push(key);
-                }
-                Some(b)
-            }
-            None => {
-                if !s.misses.contains(&key) && s.misses.len() < 1024 {
-                    s.misses.push(key);
-                }
-                None
-            }
+        if !unchanged {
+            // Made of files that changed since: forgotten, so the buffer rendered again is
+            // written over its entry.
+            s.remove(key);
+            s.known.remove(&key);
+            s.note_miss(key);
+            return None;
         }
+        if !s.hits.contains(&key) {
+            s.hits.push(key);
+        }
+        Some((buf, files.to_read_files()))
     }
 
-    fn put_layer(&self, key: u128, buf: &Buf) {
+    /// Queues the layer for writing to the persistent store the first time `key` is seen.
+    fn put_layer(&self, key: u128, buf: &Buf, files: &EntryFiles, _since: u64) {
         let Ok(mut s) = self.st.lock() else { return };
         if s.known.insert(key) {
-            s.writes.push((key, crate::disk_cache::layer_entry(buf)));
+            s.writes.push((key, crate::disk_cache::layer_entry(buf, files)));
         }
     }
 
@@ -445,7 +599,7 @@ fn time_dependent(layer: &Layer, effects: bool) -> bool {
     if matches!(layer.source, LayerSource::Shape)
         && let Some(c) = layer.props.sub("contents")
     {
-        return group_has(c, "wiggle");
+        return group_has(c, "wiggle") || group_has(c, "wiggler");
     }
     // Wiggly selectors move with time; Expression selectors evaluate per character (their
     // property value alone doesn't capture the result).
@@ -457,6 +611,12 @@ fn time_dependent(layer: &Layer, effects: bool) -> bool {
     false
 }
 
+/// A text layer with an Expression Selector: its amount is evaluated per character, and the
+/// layer's key holds only the first character's (see [`crate::reads::ReadFiles::is_unkeyed`]).
+pub(crate) fn per_character_expressions(layer: &Layer) -> bool {
+    matches!(layer.source, LayerSource::Text) && layer.props.sub("text").is_some_and(|t| group_has(t, "expressionSelector"))
+}
+
 fn group_has(g: &PropGroup, match_id: &str) -> bool {
     g.children.iter().any(|c| match c {
         Node::Group(sub) => sub.match_id == match_id || group_has(sub, match_id),
@@ -466,6 +626,19 @@ fn group_has(g: &PropGroup, match_id: &str) -> bool {
 
 /// Feed every property of `g` that can change over time (keyframes or expression) as its value
 /// at the context time. The static structure is hashed separately.
+/// Mix the collapsed-instance overrides that target `id` into a cache key. They replace values
+/// without editing the layer, so a key without them would reuse another instance's buffer.
+fn hash_overrides(h: &mut KeyHasher, ctx: &EvalCtx, id: effectcraft_project::LayerId) {
+    for o in ctx.property_overrides.iter().filter(|o| o.layer == id) {
+        o.prop.hash(h);
+        o.font.hash(h);
+        hash_debug(h, &o.value);
+    }
+    for m in ctx.media_overrides.iter().filter(|m| m.layer == id) {
+        m.item.hash(h);
+    }
+}
+
 fn hash_values(h: &mut KeyHasher, ctx: &EvalCtx, layer: &Layer, g: &PropGroup) {
     for c in &g.children {
         match c {
@@ -481,13 +654,14 @@ fn hash_values(h: &mut KeyHasher, ctx: &EvalCtx, layer: &Layer, g: &PropGroup) {
 }
 
 /// Cache key for the processed (source → masks → effects) buffer of `layer` at the context
-/// time, or `None` when the layer must not be cached (footage, precomps, cameras, adjustment
+/// time, or `None` when the layer must not be cached (movie footage, precomps, cameras, adjustment
 /// layers…).
 pub fn layer_key(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool) -> Option<u64> {
-    // Time effects see property values at other times. Keyframes are part of the hashed
-    // structure (and the layer time is folded in), but expressions may read other layers at
-    // those times, which the key cannot see: such layers are not cached.
-    if reads_other_times(layer) && layer.props.children.iter().any(|c| matches!(c, Node::Group(g) if g.match_id != "transform" && has_expression(g))) {
+    // Time effects (and CC Particle World's Birth Rate history) see property values at other
+    // times. Keyframes are part of the hashed structure (and the layer time is folded in), but
+    // expressions may read other layers at those times, which the key cannot see: such layers
+    // are not cached.
+    if history_unkeyable(layer, None) {
         return None;
     }
     key_with(ctx, layer, scale, draft, blur, false)
@@ -497,20 +671,62 @@ pub fn layer_key(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bo
 /// effects (see `Renderer::layer_input`). Unlike [`layer_key`], footage layers are cached here
 /// (keyed by item and source time), since Time effects read many neighbouring frames.
 pub fn input_key(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, effects: usize) -> Option<u64> {
-    if layer.switches.adjustment {
+    if layer.switches.adjustment || history_unkeyable(layer, Some(effects)) {
         return None;
     }
-    let base = key_any(ctx, layer, scale, draft, blur, true, Some(effects))?;
+    let base = key_any(ctx, layer, scale, draft, blur, true, EffectScope::First(effects))?;
     let mut h = KeyHasher(base ^ 0x5bd1_e995_7a3c_11d3);
     effects.hash(&mut h);
     Some(h.finish())
 }
 
-/// Does the layer run an effect that reads the layer at other times (Echo, Timewarp…)?
-fn reads_other_times(layer: &Layer) -> bool {
+/// Does the layer run (among its first `effects` effects, all when `None`) an effect that reads
+/// the layer at other times (Echo, Timewarp…) or its own parameters' history (CC Particle
+/// World's Birth Rate, #1373)?
+fn reads_other_times(layer: &Layer, effects: Option<usize>) -> bool {
     layer.switches.effects
         && layer.effects().is_some_and(|fx| {
-            fx.groups().any(|g| g.enabled && matches!(&g.kind, effectcraft_project::GroupKind::Effect { effect } if effect.starts_with("ec.time.")))
+            fx.groups().take(effects.unwrap_or(usize::MAX)).any(|g| {
+                g.enabled
+                    && matches!(&g.kind, effectcraft_project::GroupKind::Effect { effect }
+                        if effect.starts_with("ec.time.")
+                            || effectcraft_effects::reads_param_history(effect)
+                            || (!effect.starts_with("ec.") && effectcraft_effects::plugin::reads_other_times(effect)))
+            })
+        })
+}
+
+/// The layer reads values at other times (see [`reads_other_times`]) and has expressions
+/// (outside Transform), whose results at those times the key can't see.
+fn history_unkeyable(layer: &Layer, effects: Option<usize>) -> bool {
+    reads_other_times(layer, effects) && layer.props.children.iter().any(|c| matches!(c, Node::Group(g) if g.match_id != "transform" && has_expression(g)))
+}
+
+/// A still image (no proxy): its layer is cached like a text or shape layer, so the GPU
+/// compositor uploads it once, not every frame (#1812: four 21120 px plates re-uploaded by every
+/// preview worker ran the GPU out of memory). Movies and sequences stay in the media pool only.
+fn still_footage(ctx: &EvalCtx, item: effectcraft_project::ItemId) -> bool {
+    ctx.project.item(item).is_some_and(|it| it.proxy.is_none() && matches!(&it.kind, ItemKind::Footage(f) if f.kind == FootageKind::Still))
+}
+
+/// Does the layer have an animated mask that motion blur may draw at other times (Layer ▸ Mask ▸
+/// Motion Blur On, or Same As Layer with the layer blurred)?
+fn mask_motion_blur(ctx: &EvalCtx, layer: &Layer, blur: bool) -> bool {
+    use effectcraft_project::{GroupKind, MaskMotionBlur};
+    fn animated(g: &PropGroup) -> bool {
+        g.children.iter().any(|c| match c {
+            Node::Prop(p) => !p.keys.is_empty() || p.has_expression(),
+            Node::Group(sub) => animated(sub),
+        })
+    }
+    ctx.comp.enable_motion_blur
+        && layer.masks().is_some_and(|m| {
+            m.groups().any(|g| match g.kind {
+                GroupKind::Mask { motion_blur, .. } => {
+                    (motion_blur == MaskMotionBlur::On || (motion_blur == MaskMotionBlur::SameAsLayer && blur)) && animated(g)
+                }
+                _ => false,
+            })
         })
 }
 
@@ -521,26 +737,39 @@ fn has_expression(g: &PropGroup) -> bool {
     })
 }
 
+/// How far the effect stack reaches into a cache key. [`EffectScope::Footprint`] keys an
+/// adjustment layer's footprint — its source through its masks, without any effects — so the
+/// stack must not reach the key at all (#687).
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) enum EffectScope {
+    /// The whole stack (the processed layer).
+    All,
+    /// Only the first `n` effects (a layer's input, see [`input_key`]).
+    First(usize),
+    /// None of it (an adjustment layer's footprint).
+    Footprint,
+}
+
 /// Cache key for an adjustment layer's footprint (its source through its masks, see
 /// `Renderer::adjustment_footprint`): the GPU compositor then uploads it once, not every frame.
 pub fn footprint_key(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool) -> Option<u64> {
     // The footprint is the source through the masks, without the effects: a time-dependent
     // effect (Noise on a finishing adjustment layer) must not re-key it every frame (on the GPU,
-    // a full-frame re-upload per frame).
-    Some(derive(key_any(ctx, layer, scale, draft, blur, false, Some(0))?, 0xf007_9417))
+    // a full-frame re-upload per frame). Shutter, paint, the comp scene and effect dependencies
+    // stay out of this key too; a mask still does.
+    Some(derive(key_any(ctx, layer, scale, draft, blur, false, EffectScope::Footprint)?, 0xf007_9417))
 }
 
 fn key_with(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, footage: bool) -> Option<u64> {
     if layer.switches.adjustment {
         return None;
     }
-    key_any(ctx, layer, scale, draft, blur, footage, None)
+    key_any(ctx, layer, scale, draft, blur, footage, EffectScope::All)
 }
 
-/// `blur`: the layer is motion blurred in this render (`Renderer::mb_on`). `effects`: key only
-/// the first that many effects (a layer's input, see [`input_key`]).
-#[allow(clippy::too_many_arguments)]
-fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, footage: bool, effects: Option<usize>) -> Option<u64> {
+/// `blur`: the layer is motion blurred in this render (`Renderer::mb_on`). `effects`: how far
+/// the effect stack reaches into the key (see [`EffectScope`]).
+fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, footage: bool, effects: EffectScope) -> Option<u64> {
     let mut h = KeyHasher(0xcbf2_9ce4_8422_2325);
     ctx.comp.frame_rate.as_f64().to_bits().hash(&mut h);
     ctx.comp.enable_frame_blending.hash(&mut h);
@@ -552,14 +781,18 @@ fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, fo
             hash_debug(&mut h, s);
         }
         LayerSource::Text | LayerSource::Shape => {}
-        LayerSource::Footage { item } if footage => {
-            let it = ctx.project.item(*item)?;
+        LayerSource::Footage { item } if footage || still_footage(ctx, ctx.media_item(layer, *item)) => {
+            let item = ctx.media_item(layer, *item);
+            let it = ctx.project.item(item)?;
             let ItemKind::Footage(f) = &it.kind else { return None };
             hash_debug(&mut h, f);
             // A proxy (and its Use Proxy switch) changes the pixels.
             hash_debug(&mut h, &it.proxy);
             item.hash(&mut h);
-            ctx.source_time(layer).0.hash(&mut h);
+            // A still is the same at every time (unless a proxy, which may be a movie, stands in).
+            if f.kind != FootageKind::Still || it.proxy.is_some() {
+                ctx.source_time(layer).0.hash(&mut h);
+            }
             // Frame blending mixes neighbouring source frames.
             ctx.comp.enable_frame_blending.hash(&mut h);
         }
@@ -573,12 +806,18 @@ fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, fo
     scale.to_bits().hash(&mut h);
     draft.hash(&mut h);
     layer.id.hash(&mut h);
+    // Collapsed-instance overrides replace values without editing the nested layer, so mix them
+    // into the key: a Font override, effect parameter or any other source-affecting override
+    // must not reuse another instance's processed buffer.
+    hash_overrides(&mut h, ctx, layer.id);
     hash_debug(&mut h, &layer.source);
     // (Audio, Lock and Shy don't change pixels.)
     hash_debug(&mut h, &layer.switches.pixels());
     // Mask motion blur and effects that read the shutter depend on whether the layer is motion
-    // blurred in this render and on the comp's shutter.
-    if layer.masks().is_some_and(|m| !m.children.is_empty()) || layer.effects().is_some_and(|fx| !fx.children.is_empty()) {
+    // blurred in this render and on the comp's shutter. A footprint has no effects, so only its
+    // masks put the shutter in the key.
+    if layer.masks().is_some_and(|m| !m.children.is_empty()) || (effects != EffectScope::Footprint && layer.effects().is_some_and(|fx| !fx.children.is_empty()))
+    {
         blur.hash(&mut h);
         ctx.comp.enable_motion_blur.hash(&mut h);
         ctx.comp.shutter_angle.to_bits().hash(&mut h);
@@ -592,23 +831,29 @@ fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, fo
         {
             continue;
         }
+        // A footprint is its source through its masks: the effect stack is not in it at all.
         // A layer's input runs only its first effects: the later ones (a Puppet whose pins are
         // dragged, #212) don't change it, so it stays cached.
-        if let (Some(n), Node::Group(g)) = (effects, c)
+        if let Node::Group(g) = c
             && g.match_id == "effects"
         {
-            let mut first = g.clone();
-            let mut seen = 0;
-            first.children.retain(|e| match e {
-                Node::Prop(_) => true,
-                Node::Group(_) => {
-                    seen += 1;
-                    seen <= n
-                }
-            });
-            hash_debug(&mut h, &first);
-            hash_values(&mut h, ctx, layer, &first);
-            continue;
+            if effects == EffectScope::Footprint {
+                continue;
+            }
+            if let EffectScope::First(n) = effects {
+                let mut first = g.clone();
+                let mut seen = 0;
+                first.children.retain(|e| match e {
+                    Node::Prop(_) => true,
+                    Node::Group(_) => {
+                        seen += 1;
+                        seen <= n
+                    }
+                });
+                hash_debug(&mut h, &first);
+                hash_values(&mut h, ctx, layer, &first);
+                continue;
+            }
         }
         // Static structure: values, keyframes, expressions, enabled flags, effect ids, modes.
         hash_debug(&mut h, c);
@@ -617,7 +862,9 @@ fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, fo
         }
     }
     // Paint strokes appear and disappear with their Duration spans (not property values).
-    if layer.switches.effects
+    // A footprint does not include them.
+    if effects != EffectScope::Footprint
+        && layer.switches.effects
         && let Some(fx) = layer.effects()
     {
         let lt = layer.layer_time(ctx.time).seconds();
@@ -625,19 +872,39 @@ fn key_any(ctx: &EvalCtx, layer: &Layer, scale: f64, draft: bool, blur: bool, fo
             effectcraft_effects::paint::cache_key(g, lt).0.hash(&mut h);
         }
     }
-    if time_dependent(layer, effects != Some(0)) {
+    // Mask motion blur draws animated masks at the shutter's other times too: their values at
+    // this time don't tell two frames apart (a hold before a move).
+    if mask_motion_blur(ctx, layer, blur) {
+        layer.layer_time(ctx.time).0.hash(&mut h);
+    }
+    if time_dependent(layer, effects != EffectScope::Footprint) {
         layer.layer_time(ctx.time).0.hash(&mut h);
         // Effects also see the layer's time mapping.
         layer.start_time.0.hash(&mut h);
         layer.stretch.to_bits().hash(&mut h);
     }
     // Effects that see the comp camera or lights (#397) change when they or the layer move.
-    if reads_comp_scene(layer) {
+    if effects != EffectScope::Footprint && reads_comp_scene(layer) {
         hash_debug(&mut h, &crate::comp_scene(ctx, layer));
     }
     Some(h.finish())
 }
 
+/// Does the layer read another layer through an enabled effect's layer parameter (Gradient Wipe,
+/// Set Matte…)? Those layers are drawn by the reading layer's renderer, so the switches it
+/// passes down belong in the key (`Renderer::nested_look`).
+pub(crate) fn reads_layers(ctx: &EvalCtx, layer: &Layer) -> bool {
+    /// Whether any enabled layer-valued property of `layer` points at another layer.
+    fn reads(ctx: &EvalCtx, layer: &Layer, g: &PropGroup, depth: usize) -> bool {
+        depth < 32
+            && g.children.iter().any(|n| match n {
+                Node::Prop(p) => matches!(p.value, Value::Layer(_)) && ctx.value(layer, p).as_layer().is_some_and(|id| id != layer.id.0),
+                Node::Group(sub) => sub.enabled && reads(ctx, layer, sub, depth + 1),
+            })
+    }
+    layer.switches.effects && layer.effects().is_some_and(|fx| fx.groups().any(|g| g.enabled && reads(ctx, layer, g, 0)))
+}
+
 /// Does the layer run an effect that reads the comp camera or lights (Card Dance, CC Particle
 /// World…)?
 fn reads_comp_scene(layer: &Layer) -> bool {
@@ -668,3 +935,226 @@ pub fn derive(key: u64, i: u64) -> u64 {
     i.hash(&mut h);
     h.finish()
 }
+
+#[cfg(test)]
+mod shared_insert_tests {
+    use std::sync::Arc;
+
+    use super::LayerCache;
+    use effectcraft_effects::Buf;
+    use effectcraft_raster::Image;
+
+    /// Two renders of one layer kept under one key: both use the buffer kept first.
+    #[test]
+    fn the_buffer_kept_first_is_shared() {
+        let cache = LayerCache::default();
+        let buf = || Arc::new(Buf { img: Image::new(4, 4), offset: [0.0; 2], scale: 1.0 });
+        let (a, b) = (buf(), buf());
+        assert!(Arc::ptr_eq(&cache.insert(3, a.clone(), Default::default()).0, &a));
+        assert!(Arc::ptr_eq(&cache.insert(3, b, Default::default()).0, &a), "the later render gets the first buffer");
+        assert!(Arc::ptr_eq(&cache.get(3).unwrap().0, &a));
+    }
+
+    /// The browser's store (#3184): a fetched entry is used only while the files it lists are
+    /// unchanged (here from memory, through the hook), and comes with them; one made of files
+    /// that changed is dropped and counts as a miss, so the buffer rendered again is queued over
+    /// it. A buffer whose files can't all be named is not queued at all.
+    #[test]
+    fn the_prefetch_store_checks_the_files_of_its_entries() {
+        use super::{LayerStore, PrefetchStore};
+        use crate::disk_cache::{EntryFiles, layer_disk_key, layer_entry};
+        use crate::reads::{FileStamp, ReadFile, ReadFiles};
+        let buf = || Buf { img: Image::new(2, 2), offset: [0.0; 2], scale: 1.0 };
+        let files: ReadFiles = [ReadFile::new("/v.png", FileStamp::Virtual)].into_iter().collect();
+        let (one, two) = (|_: &str| Some((3, 1)), |_: &str| Some((3, 2)));
+        let entry = layer_entry(&buf(), &EntryFiles::of(&files, Some(&one)).unwrap());
+        let store = PrefetchStore::new(1 << 20).with_min_ms(0);
+        assert!(store.provide(5, &entry));
+        assert!(!store.provide(6, b"damaged"));
+        let (_, got) = store.get_layer(5, Some(&one)).unwrap();
+        assert_eq!(got, files);
+        assert_eq!(store.take_hits(), [5]);
+        // The file changed: a miss, forgotten, and the new buffer is queued over it.
+        assert!(store.get_layer(5, Some(&two)).is_none());
+        assert!(!store.has(5));
+        assert_eq!(store.take_misses(), [5]);
+        store.put_layer(5, &buf(), &EntryFiles::of(&files, Some(&two)).unwrap(), 0);
+        assert_eq!(store.take_writes().len(), 1, "written over the changed entry");
+        // Through the layer cache: a hit reports its files; incomplete lists are not queued.
+        let cache = LayerCache::default();
+        let store = Arc::new(PrefetchStore::new(1 << 20).with_min_ms(0));
+        cache.set_store(Some(store.clone()));
+        cache.set_virtual_id(Some(Arc::new(one)));
+        assert!(store.provide(layer_disk_key(9), &entry));
+        let (_, from_store) = cache.get(9).unwrap();
+        assert!(*from_store == files && from_store.is_complete());
+        let mut incomplete = files.clone();
+        incomplete.mark_incomplete();
+        assert!(cache.get(10).is_none());
+        cache.insert(10, Arc::new(buf()), Arc::new(incomplete));
+        assert!(cache.get(11).is_none());
+        cache.insert(11, Arc::new(buf()), Arc::new(files.clone()));
+        let written: Vec<u128> = store.take_writes().into_iter().map(|w| w.0).collect();
+        assert_eq!(written, [layer_disk_key(11)], "only the buffer whose files are all named");
+    }
+
+    /// A layer buffer whose render started before Reload Footage dropped its file (#3184) is
+    /// not written to the disk cache when it is kept afterwards; one whose render started after
+    /// the drop is.
+    #[test]
+    fn a_buffer_rendered_across_a_drop_is_not_written() {
+        use crate::disk_cache::{DiskCache, Kind, layer_disk_key};
+        use crate::reads::{FileStamp, ReadFile, ReadLog};
+        let dir = tempfile::tempdir().unwrap();
+        let dc = DiskCache::open(dir.path(), 1 << 30).unwrap();
+        dc.set_min_layer_ms(0);
+        let cache = LayerCache::default();
+        cache.set_disk(Some(dc.clone()));
+        let buf = || Arc::new(Buf { img: Image::new(2, 2), offset: [0.0; 2], scale: 1.0 });
+        // A render's files, read after it took the drop generation (`Renderer::recorded`).
+        let render = || {
+            let log = ReadLog::starting_at(cache.drop_generation().unwrap());
+            move || {
+                log.note(ReadFile::new("/a.png", FileStamp::Native { len: 3, modified: Some(1) }));
+                Arc::new(log.into_files())
+            }
+        };
+        // The miss starts the render; the file is reloaded before the buffer is kept.
+        assert!(cache.get(1).is_none());
+        let a = render();
+        dc.drop_files(["/a.png"]);
+        dc.flush();
+        // Another render of the same key starts after the drop, while the first one still runs
+        // (its miss must not lend the first render its generation).
+        assert!(cache.get(1).is_none());
+        let b = render();
+        let (stale, _) = cache.insert(1, buf(), a());
+        dc.flush();
+        assert!(!dc.contains(Kind::Layer, layer_disk_key(1)), "made of the file as it was before the drop");
+        // Not kept in memory either: the second render keeps its own buffer, and writes it.
+        let fresh = buf();
+        let (kept, _) = cache.insert(1, fresh.clone(), b());
+        assert!(Arc::ptr_eq(&kept, &fresh) && !Arc::ptr_eq(&kept, &stale));
+        // A render of another key after the drop.
+        assert!(cache.get(2).is_none());
+        cache.insert(2, buf(), render()());
+        dc.flush();
+        assert!(dc.contains(Kind::Layer, layer_disk_key(1)), "the render after the drop");
+        assert!(dc.contains(Kind::Layer, layer_disk_key(2)));
+        // A list that doesn't say when its reads began counts as made before the drop.
+        assert!(cache.get(3).is_none());
+        cache.insert(3, buf(), Arc::new([ReadFile::new("/a.png", FileStamp::Native { len: 3, modified: Some(1) })].into_iter().collect()));
+        dc.flush();
+        assert!(!dc.contains(Kind::Layer, layer_disk_key(3)));
+        drop((cache, dc));
+    }
+
+    /// A disk cache whose layer writes stop at a barrier until the test lets them go on.
+    struct PausedWrites {
+        dc: Arc<crate::disk_cache::DiskCache>,
+        arrived: std::sync::Barrier,
+        go_on: std::sync::Barrier,
+    }
+
+    impl super::LayerStore for PausedWrites {
+        fn get_layer(&self, key: u128, virtual_id: Option<crate::disk_cache::VirtualFileId<'_>>) -> Option<(Arc<Buf>, crate::reads::ReadFiles)> {
+            super::LayerStore::get_layer(&*self.dc, key, virtual_id)
+        }
+        fn put_layer(&self, key: u128, buf: &Buf, files: &crate::disk_cache::EntryFiles, since: u64) {
+            self.arrived.wait();
+            self.go_on.wait();
+            super::LayerStore::put_layer(&*self.dc, key, buf, files, since);
+        }
+        fn drop_generation(&self) -> u64 {
+            self.dc.drop_generation()
+        }
+        fn dropped_since(&self, files: &crate::reads::ReadFiles, since: u64) -> bool {
+            self.dc.dropped_since(files, since)
+        }
+    }
+
+    /// Reload Footage while a render from before it is writing its buffer: the cache is cleared
+    /// and the file dropped after the buffer passed its check, before it is kept. The buffer
+    /// then reaches memory after the purge, but it is never served, and a render after the drop
+    /// keeps its own buffer (#3191 review).
+    #[test]
+    fn a_buffer_kept_after_the_purge_of_a_reload_is_not_served() {
+        use crate::reads::{FileStamp, ReadFile, ReadLog};
+        let dir = tempfile::tempdir().unwrap();
+        let dc = crate::disk_cache::DiskCache::open(dir.path(), 1 << 30).unwrap();
+        let store = Arc::new(PausedWrites { dc: dc.clone(), arrived: std::sync::Barrier::new(2), go_on: std::sync::Barrier::new(2) });
+        let cache = Arc::new(LayerCache::default());
+        cache.set_store(Some(store.clone()));
+        let buf = || Arc::new(Buf { img: Image::new(2, 2), offset: [0.0; 2], scale: 1.0 });
+        let files = |cache: &LayerCache| {
+            let log = ReadLog::starting_at(cache.drop_generation().unwrap());
+            log.note(ReadFile::new("/a.png", FileStamp::Native { len: 3, modified: Some(1) }));
+            Arc::new(log.into_files())
+        };
+        // The old render: a miss, its reads, then its insert, which stops in the disk write.
+        assert!(cache.get(1).is_none());
+        let old_files = files(&cache);
+        let old = buf();
+        let writer = {
+            let (cache, old) = (cache.clone(), old.clone());
+            std::thread::spawn(move || cache.insert(1, old, old_files))
+        };
+        store.arrived.wait();
+        // Reload Footage meanwhile: the layer cache is purged and the file dropped.
+        cache.clear();
+        dc.drop_files(["/a.png"]);
+        dc.flush();
+        store.go_on.wait();
+        let _ = writer.join().unwrap();
+        dc.flush();
+        assert!(!dc.contains(crate::disk_cache::Kind::Layer, crate::disk_cache::layer_disk_key(1)), "not on disk");
+        assert!(cache.get(1).is_none(), "the old pixels are not served from memory");
+        // A render after the drop keeps its own buffer.
+        let fresh = buf();
+        let new_files = files(&cache);
+        let mut kept = None;
+        std::thread::scope(|s| {
+            s.spawn(|| {
+                store.arrived.wait();
+                store.go_on.wait();
+            });
+            kept = Some(cache.insert(1, fresh.clone(), new_files).0);
+        });
+        let kept = kept.unwrap();
+        assert!(Arc::ptr_eq(&kept, &fresh) && !Arc::ptr_eq(&kept, &old));
+        assert!(Arc::ptr_eq(&cache.get(1).unwrap().0, &fresh));
+    }
+
+    /// A render that gets another render's buffer gets that buffer's files too (#3184): when a
+    /// file changed between the two reads, its frame lists the file with both identities, so the
+    /// list is incomplete and the frame is not kept on disk with the new identity and the old
+    /// pixels.
+    #[test]
+    fn the_buffer_kept_first_brings_its_files() {
+        use crate::reads::{FileStamp, ReadFile, ReadFiles, ReadLog};
+        use crate::{NoFootage, RenderOpts, Renderer};
+        let cache = LayerCache::default();
+        let buf = || Arc::new(Buf { img: Image::new(4, 4), offset: [0.0; 2], scale: 1.0 });
+        let files = |len| Arc::new([ReadFile::new("/a.png", FileStamp::Native { len, modified: Some(1) })].into_iter().collect::<ReadFiles>());
+        let (first, second) = (files(1), files(2));
+        let a = buf();
+        cache.insert(3, a.clone(), first.clone());
+        let project = effectcraft_project::Project::default();
+        let log = ReadLog::new();
+        let mut r = Renderer::new(&project, &NoFootage, RenderOpts::default());
+        r.cache = Some(&cache);
+        r.reads = Some(&log);
+        // (what `Renderer::recorded` noted for the second render)
+        log.note_all(&second);
+        let (kept, kept_files) = r.keep(Some(3), buf(), &second);
+        assert!(Arc::ptr_eq(&kept, &a));
+        assert_eq!(kept_files, first);
+        assert!(!log.files().is_complete());
+        // The same files: nothing changes.
+        let same = ReadLog::new();
+        r.reads = Some(&same);
+        same.note_all(&first);
+        let _ = r.keep(Some(3), buf(), &files(1));
+        assert!(same.files().is_complete());
+    }
+}
diff --git a/crates/render/src/cache/dependencies.rs b/crates/render/src/cache/dependencies.rs
index 483b19da3..dc4216098 100644
--- a/crates/render/src/cache/dependencies.rs
+++ b/crates/render/src/cache/dependencies.rs
@@ -3,12 +3,18 @@
 //! cyclic/over-budget graphs or expressions sampled at unknown times.
 use super::{KeyHasher, hash_debug, hash_values};
 use crate::EvalCtx;
-use effectcraft_project::{ItemId, ItemKind, Layer, LayerId, LayerSource, Node, PropGroup};
+use effectcraft_project::{ItemId, ItemKind, Layer, LayerId, LayerSource, LightKind, Node, PropGroup};
 use std::hash::Hash;
 
-pub(super) fn hash(h: &mut KeyHasher, ctx: &EvalCtx, layer: &Layer, effects: Option<usize>) -> Option<()> {
-    let mut deps = Dependencies { h, path: vec![(ctx.comp_id, layer.id)], remaining: 1024, other_times: super::reads_other_times(layer) };
-    deps.effects(ctx, layer, effects)
+pub(super) fn hash(h: &mut KeyHasher, ctx: &EvalCtx, layer: &Layer, effects: super::EffectScope) -> Option<()> {
+    // A footprint runs no effects: nothing they read is in its pixels or its key.
+    let limit = match effects {
+        super::EffectScope::Footprint => return Some(()),
+        super::EffectScope::All => None,
+        super::EffectScope::First(n) => Some(n),
+    };
+    let mut deps = Dependencies { h, path: vec![(ctx.comp_id, layer.id)], remaining: 1024, other_times: super::reads_other_times(layer, None) };
+    deps.effects(ctx, layer, limit)
 }
 
 struct Dependencies<'a> {
@@ -21,7 +27,7 @@ struct Dependencies<'a> {
 impl Dependencies<'_> {
     fn effects(&mut self, ctx: &EvalCtx, layer: &Layer, limit: Option<usize>) -> Option<()> {
         let previous = self.other_times;
-        self.other_times |= super::reads_other_times(layer);
+        self.other_times |= super::reads_other_times(layer, None);
         if layer.switches.effects
             && let Some(fx) = layer.effects()
         {
@@ -63,19 +69,82 @@ impl Dependencies<'_> {
         Some(())
     }
 
+    /// What a referenced 3D model or primitive layer's solo render depends on: the layer itself
+    /// (geometry, materials, switches, in/out), its animated values and transform at the time,
+    /// the mesh item, the comp's camera (with its depth of field) and its lights at the time
+    /// (the lights are off in draft 3D, and the renderer setting changes the pixels), the model's
+    /// layer time while it plays an animation clip, and the in/out gate (outside the range the
+    /// read is transparent). An Environment light's image can be any layer's render: with one on
+    /// the read is not cached. Comp size and render scale are in the owner's key already.
+    fn soloed_model(&mut self, ctx: &EvalCtx, layer: &Layer) -> Option<()> {
+        self.remaining = self.remaining.checked_sub(1)?;
+        // Expressions sampled at other times: not cacheable, as in the ordinary path.
+        if (self.other_times || super::reads_other_times(layer, None)) && super::has_expression(&layer.props) {
+            return None;
+        }
+        hash_debug(self.h, layer);
+        // An overridden clip plays on the layer clock and a keyed one from its key: the same
+        // selection at the same time can pose differently.
+        super::hash_overrides(self.h, ctx, layer.id);
+        hash_values(self.h, ctx, layer, &layer.props);
+        hash_debug(self.h, &ctx.world_matrix(layer));
+        if let Some(item) = layer.source.item() {
+            hash_debug(self.h, &ctx.project.item(item));
+        }
+        // The solo render goes through the comp's camera and lights. The camera's depth of
+        // field blurs it (focus, aperture, iris, highlights) — none of that is in the
+        // projection hashed above.
+        hash_debug(self.h, &ctx.camera());
+        hash_debug(self.h, &crate::three_d::active_camera(ctx).dof);
+        hash_debug(self.h, &crate::three_d::light::lights_at(ctx));
+        hash_debug(self.h, &ctx.comp.draft_3d);
+        hash_debug(self.h, &ctx.comp.renderer);
+        // An Environment light's image lights Advanced 3D models (its source can be any
+        // layer's render, or any environment layer) — too open-ended to hash: while one is
+        // on (and lighting: Draft 3D lights nothing), don't cache the read.
+        if ctx.comp.renderer == effectcraft_project::Renderer::Advanced3D
+            && !ctx.comp.draft_3d
+            && ctx.comp.layers.iter().any(|l| {
+                l.is_light() && l.switches.video && l.is_active_at(ctx.time) && matches!(l.source, LayerSource::Light { kind: LightKind::Environment })
+            })
+        {
+            return None;
+        }
+        // A model with an animation clip selected is posed at its layer time (Animation Speed
+        // and Looping are static, hashed above): every time is its own entry. Without one the
+        // pose is the same at every time: keep the static key.
+        if layer.props.sub("geometryOptions").map_or(0, |g| ctx.e(layer, g, "animation")) != 0 {
+            layer.layer_time(ctx.time).0.hash(self.h);
+        }
+        // Outside the layer's in/out range the read is transparent: fold the gate in, so a
+        // static model renders once inside it and again when it leaves.
+        layer.is_active_at(ctx.time).hash(self.h);
+        Some(())
+    }
+
     fn layer(&mut self, ctx: &EvalCtx, layer: &Layer) -> Option<()> {
         let id = (ctx.comp_id, layer.id);
         if self.path.len() > crate::MAX_FX_DEPTH || self.path.contains(&id) {
             return None;
         }
+        // A referenced 3D model or primitive layer renders through the comp's camera and lights
+        // (an effect layer parameter reads it that way — Create 3D Layer Instance): hash what
+        // moves its pixels, so the owner keeps a cache entry that changes when any of it does.
+        if layer.source.is_model() {
+            self.soloed_model(ctx, layer)?;
+            return Some(());
+        }
         self.remaining = self.remaining.checked_sub(1)?;
-        if (self.other_times || super::reads_other_times(layer)) && super::has_expression(&layer.props) {
+        if (self.other_times || super::reads_other_times(layer, None)) && super::has_expression(&layer.props) {
             return None;
         }
         self.path.push(id);
         // Include transforms/parents as well as pixels: selected-layer anchors and
         // continuously rasterized sources can depend on them.
         hash_debug(self.h, layer);
+        // A referenced layer's static values can be overridden by the collapsed instance without
+        // editing it (`hash_values` only sees animated ones), so the owner's key needs them too.
+        super::hash_overrides(self.h, ctx, layer.id);
         hash_values(self.h, ctx, layer, &layer.props);
         hash_debug(self.h, &ctx.world_matrix(layer));
         // A cached owner never runs this layer's effects, so the comp camera and lights its
@@ -87,7 +156,11 @@ impl Dependencies<'_> {
             layer.layer_time(ctx.time).0.hash(self.h);
         }
         match layer.source {
-            LayerSource::Solid { item } | LayerSource::Footage { item } | LayerSource::Comp { item } => {
+            LayerSource::Solid { item } | LayerSource::Footage { item } | LayerSource::Comp { item } | LayerSource::Model { item } => {
+                let item = match layer.source {
+                    LayerSource::Footage { .. } => ctx.media_item(layer, item),
+                    _ => item,
+                };
                 let source = ctx.project.item(item);
                 hash_debug(self.h, &source);
                 if let Some(source) = source {
diff --git a/crates/render/src/color.rs b/crates/render/src/color.rs
index abfa791e8..c423665d2 100644
--- a/crates/render/src/color.rs
+++ b/crates/render/src/color.rs
@@ -21,7 +21,7 @@
 
 use effectcraft_color::{ColorSpace, Conversion};
 use effectcraft_project::{Footage, HdrMode, ProjectSettings};
-use effectcraft_raster::Image;
+use effectcraft_raster::{Image, quantize_px};
 use rayon::prelude::*;
 
 /// The colour pipeline of a project (see the module docs).
@@ -117,6 +117,26 @@ impl Pipe {
         Conversion::new(ws, self.linear, self.out, false)
     }
 
+    /// The pipe without the HDR step (Clip), as [`crate::RenderOpts::skip_hdr_step`] renders
+    /// with: [`Pipe::output`] converts to the output space as it is.
+    pub fn without_hdr_step(self) -> Pipe {
+        Pipe { hdr: HdrMode::Clip, ..self }
+    }
+
+    /// The top-level frame of a [`Pipe::without_hdr_step`] render (output-encoded, straight colour)
+    /// → linear light in the output space's primaries: the output space's curve, or the Working
+    /// Gamma's when unmanaged (sRGB at 2.2, a pure 2.4 power curve at 2.4). The identity for a
+    /// linear output (ACES).
+    pub fn output_linear(&self) -> Conversion {
+        Conversion::linearize(self.output_linear_space())
+    }
+
+    /// The space whose primaries and white the frame of [`Pipe::output_linear`] is in: the output
+    /// space, or the Working Gamma's (sRGB or Rec. 709, the same primaries) when unmanaged.
+    pub fn output_linear_space(&self) -> ColorSpace {
+        if self.space.is_some() { self.out } else { self.curve() }
+    }
+
     /// Output with HDR compand / tone mapping (standard-dynamic-range outputs only): working
     /// space → linear output primaries, the HDR curve, then the output's encoding.
     pub fn output_hdr(&self) -> Option<(Option<Conversion>, HdrMode, Conversion)> {
@@ -218,27 +238,6 @@ pub fn quantize(img: &mut Image, levels: f32) {
     quantize_rect(img, PxRect { x0: 0, y0: 0, x1: img.width, y1: img.height }, levels);
 }
 
-/// Clamp (colour ≤ alpha ≤ 1, NaN → 0) and round half up; values are non-negative after the
-/// clamp, so the integer conversion rounds like `round()` and vectorises.
-#[allow(clippy::manual_clamp)] // max/min map NaN to 0; clamp would keep NaN
-#[inline(always)]
-fn quantize_px(p: &mut [f32; 4], levels: f32, inv: f32) {
-    let a = round_half_up(p[3].max(0.0).min(1.0) * levels) * inv;
-    let hi = [a, a, a, a];
-    for c in 0..3 {
-        p[c] = round_half_up(p[c].max(0.0).min(hi[c]) * levels) * inv;
-    }
-    p[3] = a;
-}
-
-/// `v` (0..=65 535) rounded half up. The same either way; the fastest on each target: x86-64's
-/// baseline converts to integers in one instruction but has no `floor` (SSE4.1), while in wasm
-/// `floor` is one instruction and converting back from `u32` several (about 1.5× faster there).
-#[inline(always)]
-fn round_half_up(v: f32) -> f32 {
-    if cfg!(target_arch = "wasm32") { (v + 0.5).floor() } else { (v + 0.5) as u32 as f32 }
-}
-
 /// [`quantize`] restricted to a rectangle (already clamped to the image), row-parallel.
 fn quantize_rect(img: &mut Image, r: PxRect, levels: f32) {
     if r.x0 >= r.x1 || r.y0 >= r.y1 {
@@ -248,7 +247,17 @@ fn quantize_rect(img: &mut Image, r: PxRect, levels: f32) {
     let w = img.width as usize;
     let (x0, x1) = (r.x0 as usize, r.x1 as usize);
     img.data[r.y0 as usize * w..r.y1 as usize * w].par_chunks_mut(w).for_each(|row| {
-        for p in &mut row[x0..x1] {
+        // Runs of all-zero pixels (+0.0 in every channel) quantise to themselves: skip them a
+        // cache line at a time (sparse shape, precomp and glow buffers are mostly empty).
+        let (blocks, rest) = row[x0..x1].as_chunks_mut::<4>();
+        for b in blocks {
+            if b.as_flattened().iter().fold(0, |a, v| a | v.to_bits()) != 0 {
+                for p in b {
+                    quantize_px(p, levels, inv);
+                }
+            }
+        }
+        for p in rest {
             quantize_px(p, levels, inv);
         }
     });
@@ -307,6 +316,39 @@ pub fn output_hdr(img: &mut Image, to_linear: Option<Conversion>, mode: HdrMode,
 
 #[cfg(test)]
 mod tests {
+    use super::*;
+
+    /// Skipping all-zero runs leaves every pixel as quantising it one by one does, bit for bit
+    /// (negative zeros and lone pixels in empty runs included).
+    #[test]
+    fn quantize_skips_only_zero_runs() {
+        let mut img = Image::new(23, 7);
+        for (i, p) in img.data.iter_mut().enumerate() {
+            *p = match i % 11 {
+                0 => [0.3, -0.2, 0.71, 0.9],
+                3 => [-0.0, 0.0, 0.0, 0.0],
+                5 => [0.0, 0.0, 0.0, -0.0],
+                7 => [1.7, 0.4, f32::NAN, 0.5],
+                _ => [0.0; 4],
+            };
+        }
+        for levels in [255.0f32, 32_768.0] {
+            let mut want = img.clone();
+            for p in &mut want.data {
+                quantize_px(p, levels, 1.0 / levels);
+            }
+            for r in [PxRect { x0: 0, y0: 0, x1: 23, y1: 7 }, PxRect { x0: 3, y0: 1, x1: 20, y1: 6 }] {
+                let mut got = img.clone();
+                quantize_rect(&mut got, r, levels);
+                for (i, (g, p)) in got.data.iter().zip(&img.data).enumerate() {
+                    let (x, y) = (i as u32 % 23, i as u32 / 23);
+                    let w = if x >= r.x0 && x < r.x1 && y >= r.y0 && y < r.y1 { want.data[i] } else { *p };
+                    assert_eq!(g.map(f32::to_bits), w.map(f32::to_bits), "{levels} {r:?} px ({x}, {y})");
+                }
+            }
+        }
+    }
+
     /// Both forms `round_half_up` picks between agree on everything quantising feeds it:
     /// 0..=levels, exact halves included.
     #[test]
diff --git a/crates/render/src/disk_cache.rs b/crates/render/src/disk_cache.rs
index 4140b7923..f509a5896 100644
--- a/crates/render/src/disk_cache.rs
+++ b/crates/render/src/disk_cache.rs
@@ -2,19 +2,33 @@
 //! and layer cache entries kept on disk between sessions, like After Effects' disk cache.
 //!
 //! * Entries are files keyed by a 128-bit content hash (`<folder>/v1/<kind>/<2 hex>/<32 hex>.ecc`):
-//!   frames by the hash of the composition's content (the comp and everything it uses, footage
-//!   files' size and modification time included) plus frame, scale and view; layer buffers by
-//!   the layer cache's content key salted with the project's footage fingerprint. A changed
-//!   project therefore never reads stale pixels: its keys simply change.
-//! * Payloads are LZ4-compressed (`lz4_flex`, MIT): frames as 8-bit premultiplied RGBA, layer
-//!   buffers as `f32` RGBA with the bytes shuffled into planes (exact, so cached and fresh
-//!   renders are bit-identical), Roto Brush / Object Matte segmentations as
+//!   frames by the hash of the composition's content as it is in memory (the comp and what it can
+//!   draw, footage items with their settings and paths, and what its expressions can read; no
+//!   file is looked at, [`comp_content_key`]) plus frame, scale and view; layer buffers by the
+//!   layer cache's content key (which names the footage items a buffer uses with their settings
+//!   and paths) and the renderer version ([`layer_disk_key`]). A changed project therefore never
+//!   reads stale pixels: its keys simply change, and an edit elsewhere keeps them.
+//! * Frame and layer entries keep the source files they were made of (footage, and the font
+//!   files text is drawn with), each with the size and modification time it was read with
+//!   ([`EntryFiles`], #3184). An entry is used only while those files are unchanged: a handful
+//!   of `metadata` calls when it is read, never a scan of the project's files. A frame or
+//!   buffer whose files can't all be named is not stored (text in a family that isn't installed
+//!   or with fallback glyphs, footage refused by automation read roots, …). File ▸ Reload
+//!   Footage deletes the entries made of the reloaded files ([`DiskCache::drop_files`]): a file
+//!   replaced by one of the same size and time is read again.
+//! * Payloads are LZ4-compressed (`lz4_flex`, MIT): frames as 8-bit premultiplied RGBA (or, for
+//!   32 bpc viewer frames, half-float RGBA with the bytes shuffled into planes; the entry
+//!   header's format byte tells them apart: 2 and 3, both with their source files first), layer
+//!   buffers (format 4, their source files first) as `f32` RGBA with the bytes shuffled into
+//!   planes (exact, so cached and fresh renders are bit-identical), Roto Brush / Object Matte segmentations as
 //!   `FrameSeg::to_bytes` (keyed by their content-keyed chain key and scale, so they are
 //!   reused whenever the same frames, settings and prompt come back, also after a restart). Every file ends in a checksum; damaged files read as misses and
 //!   are deleted.
-//! * Size limit with least-recently-used eviction. The in-memory index is rebuilt from the
-//!   folder when the cache opens (file modification times order it), so the cache survives
-//!   restarts; reads refresh a file's time.
+//! * Size limit with least-recently-used eviction, down to 90% of the limit so the eviction scan
+//!   runs once per tenth of the limit written, not on every write. The limit shrinks to keep
+//!   free space on the cache's disk ([`DiskCache::set_disk_space`]). The in-memory index is
+//!   rebuilt from the folder when the cache opens (file modification times order it), so the
+//!   cache survives restarts; reads refresh a file's time.
 //! * Safe concurrent access: writes go to a unique temporary file that is renamed into place
 //!   (atomic on every desktop OS), so readers in this or another process never see a partial
 //!   entry; a missing or damaged file is just a miss. Writes run on a background thread with a
@@ -22,18 +36,28 @@
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::{Arc, Condvar, Mutex};
 
 use effectcraft_effects::Buf;
 use effectcraft_raster::Image;
 
+use crate::reads::ReadFiles;
+
+mod entry_files;
+pub use entry_files::{EntryFile, EntryFiles, EntryStamp};
+
 /// File format version (part of the folder layout).
 const VERSION: &str = "v1";
 const MAGIC: &[u8; 4] = b"ECDC";
-/// Pending writes before new ones are dropped.
+/// Pending layer and matte writes before new ones are dropped.
 #[cfg(not(target_arch = "wasm32"))]
 const QUEUE_LIMIT: usize = 64;
+/// Pending frame bytes before new frames are dropped. Frames have their own lane, written
+/// before layer buffers: a burst of large layer writes used to fill the shared queue and drop
+/// frames, so a fully cached comp came back with gaps in its blue bar.
+#[cfg(not(target_arch = "wasm32"))]
+const FRAME_QUEUE_BYTES: usize = 1 << 30;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum Kind {
@@ -69,17 +93,41 @@ pub struct Frame8 {
     pub rgba: Vec<u8>,
 }
 
+/// A cached 32 bpc viewer frame: premultiplied RGBA half floats (IEEE binary16 bits), four
+/// per pixel.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FrameF16 {
+    pub width: u32,
+    pub height: u32,
+    pub rgba: Vec<u16>,
+}
+
+/// The entry header's format byte: segmentations (and 8-bit frames and layer buffers before
+/// #3184).
+const FORMAT_RGBA8: u8 = 0;
+/// Frame entries: their source files ([`EntryFiles`]), then 8-bit or half-float pixels. The
+/// formats before them (0: 8-bit, 1: half float, without files) read as misses and are deleted.
+const FORMAT_RGBA8_FILES: u8 = 2;
+const FORMAT_F16_FILES: u8 = 3;
+/// Layer entries: their source files ([`EntryFiles`]), then the buffer. The format before it
+/// (0, without files) reads as a miss and is deleted.
+const FORMAT_LAYER_FILES: u8 = 4;
+
 /// Counters for tests, the Info panel and `cache.diskStats`.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct DiskStats {
     pub entries: usize,
     pub bytes: u64,
     pub max_bytes: u64,
+    /// The limit in effect: `max_bytes`, or less when the disk is short of free space.
+    pub limit_bytes: u64,
     pub hits: u64,
     pub misses: u64,
     pub writes: u64,
     pub evictions: u64,
     pub dropped: u64,
+    /// Writes that failed (a full disk, permissions).
+    pub failed: u64,
 }
 
 struct Meta {
@@ -157,15 +205,17 @@ impl DiskIndex {
         v.into_iter().map(|e| e.1).collect()
     }
 
-    /// Remove least recently used entries until the total fits `max` bytes; returns them (the
-    /// caller deletes their files).
+    /// When the total exceeds `max` bytes, remove least recently used entries down to 90% of
+    /// it (so the sort runs once per tenth of `max` written, not on every write); returns them
+    /// (the caller deletes their files).
     pub fn evict(&mut self, max: u64) -> Vec<(Kind, u128)> {
         if self.total <= max {
             return vec![];
         }
+        let target = max - max / 10;
         let mut out = vec![];
         for k in self.lru_order() {
-            if self.total <= max {
+            if self.total <= target {
                 break;
             }
             self.remove(k.0, k.1);
@@ -192,7 +242,7 @@ pub struct LayerPrefetch {
 const PREFETCH_RECENT: usize = 512;
 
 impl LayerPrefetch {
-    /// A frame's layer-cache misses (salted keys).
+    /// A frame's layer-cache misses (disk keys, [`layer_disk_key`]).
     pub fn note_misses(&mut self, keys: impl IntoIterator<Item = u128>) {
         for k in keys {
             self.recent.retain(|x| *x != k);
@@ -213,27 +263,107 @@ impl LayerPrefetch {
 
 #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
 enum Job {
-    Write(Kind, u128, Vec<u8>),
+    /// Kind, key, header format byte, payload.
+    Write(Kind, u128, u8, Vec<u8>),
+    /// Delete the frame and layer entries made of these files ([`DiskCache::drop_files`]).
+    Drop(Vec<Arc<str>>),
 }
 
 struct Queue {
+    /// Frame writes (taken first) and their payload bytes.
+    frames: std::collections::VecDeque<Job>,
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    frame_bytes: usize,
+    /// Layer and matte writes.
     jobs: std::collections::VecDeque<Job>,
     busy: bool,
+    /// Keys of frames queued or being written.
+    pending_frames: std::collections::HashSet<u128>,
+    /// The drops so far (under the queue's lock: a write is queued either before a drop, which
+    /// then sweeps it, or after it, when this refuses it if it was made from before).
+    drops: Drops,
+}
+
+/// Files dropped from the cache files beyond this are not remembered one by one: everything made
+/// before the drop that forgot them is refused instead.
+const MAX_DROPPED_PATHS: usize = 1 << 16;
+
+/// The [`DiskCache::drop_files`] calls so far: their number (the drop generation) and the last one
+/// of each file. An entry made of a file read before that file's last drop (its render started at
+/// an earlier generation) holds the pixels from before and is refused.
+#[derive(Default)]
+struct Drops {
+    generation: u64,
+    last: HashMap<Arc<str>, u64>,
+    /// Everything made before this generation is refused (the per-file record was forgotten).
+    floor: u64,
+}
+
+impl Drops {
+    /// Notes that the given paths were dropped, bumping the generation and tracking them for later checks.
+    fn record(&mut self, paths: &[Arc<str>]) {
+        self.generation = self.generation.saturating_add(1);
+        if self.last.len().saturating_add(paths.len()) > MAX_DROPPED_PATHS {
+            self.last.clear();
+            self.floor = self.generation;
+            return;
+        }
+        for p in paths {
+            self.last.insert(p.clone(), self.generation);
+        }
+    }
+
+    /// Whether something made of `paths`, whose reads started at generation `since`, read one of
+    /// them before it was dropped.
+    fn stale<'a>(&self, mut paths: impl Iterator<Item = &'a Arc<str>>, since: u64) -> bool {
+        since < self.floor || paths.any(|p| self.last.get(p).is_some_and(|g| *g > since))
+    }
+}
+
+impl Queue {
+    /// Takes the next queued job, frames first, and releases the bytes it held.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn pop(&mut self) -> Option<Job> {
+        if let Some(j) = self.frames.pop_front() {
+            if let Job::Write(_, _, _, p) = &j {
+                self.frame_bytes = self.frame_bytes.saturating_sub(p.len());
+            }
+            return Some(j);
+        }
+        self.jobs.pop_front()
+    }
+    fn is_empty(&self) -> bool {
+        self.frames.is_empty() && self.jobs.is_empty()
+    }
 }
 
 pub struct DiskCache {
     dir: PathBuf,
     index: Mutex<DiskIndex>,
     max_bytes: AtomicU64,
+    /// The size free disk space allows (`u64::MAX` = unknown), see [`DiskCache::set_disk_space`].
+    disk_cap: AtomicU64,
+    /// Free space is limiting the cache (warned once per episode).
+    space_limited: AtomicBool,
+    /// The free space the cache leaves on its disk ([`disk_reserve`]); 0 = unknown.
+    reserve: AtomicU64,
     hits: AtomicU64,
     misses: AtomicU64,
     writes: AtomicU64,
     evictions: AtomicU64,
     dropped: AtomicU64,
+    failed: AtomicU64,
+    /// Source files looked at to check frame and layer entries ([`DiskCache::file_checks`]).
+    file_checks: AtomicU64,
+    /// Frame and layer entries compressed for a queued write ([`DiskCache::encodes`]).
+    encodes: AtomicU64,
     tmp_counter: AtomicU64,
     queue: Arc<(Mutex<Queue>, Condvar)>,
     /// Layer buffers that took less than this to render are not written (ms).
     min_layer_ms: AtomicU64,
+    /// Files whose entries are being deleted ([`DiskCache::drop_files`]), each with the number
+    /// of drops of it pending: until then an entry made of one is a miss.
+    dropping: Mutex<HashMap<Arc<str>, u32>>,
 }
 
 /// FNV-1a 128-bit (content keys).
@@ -270,6 +400,23 @@ fn checksum(data: &[u8]) -> u64 {
     h
 }
 
+/// The least free space the disk cache leaves on its disk.
+pub const MIN_DISK_RESERVE: u64 = 2 << 30;
+/// The most free space the disk cache leaves on its disk: 5% of a large disk is far more than
+/// the system needs to keep working (on a 4 TB disk it held a 20 GB cache at 0 with 190 GB free).
+pub const MAX_DISK_RESERVE: u64 = 10 << 30;
+/// Below this much room left by free disk space, frame and layer writes are refused before they
+/// are encoded ([`DiskCache::accepts_writes`]): a few frames would fill it, and the rest would be
+/// compressed only to be refused.
+const MIN_WRITE_ROOM: u64 = 64 << 20;
+
+/// The free space the disk cache leaves on a disk of `total` bytes: 5% of it, at least 2 GB and
+/// at most 10 GB. It keeps the cache from filling the disk; the cache's size is the user's
+/// Maximum Disk Cache Size (After Effects has that maximum and no reserve).
+pub fn disk_reserve(total: u64) -> u64 {
+    (total / 20).clamp(MIN_DISK_RESERVE, MAX_DISK_RESERVE)
+}
+
 /// The platform's default disk cache folder.
 pub fn default_folder() -> PathBuf {
     let home = std::env::var_os("HOME").map(PathBuf::from);
@@ -298,16 +445,35 @@ impl DiskCache {
             dir,
             index: Mutex::new(DiskIndex::default()),
             max_bytes: AtomicU64::new(max_bytes),
+            disk_cap: AtomicU64::new(u64::MAX),
+            space_limited: AtomicBool::new(false),
+            reserve: AtomicU64::new(0),
             hits: AtomicU64::new(0),
             misses: AtomicU64::new(0),
             writes: AtomicU64::new(0),
             evictions: AtomicU64::new(0),
             dropped: AtomicU64::new(0),
+            failed: AtomicU64::new(0),
+            file_checks: AtomicU64::new(0),
+            encodes: AtomicU64::new(0),
             tmp_counter: AtomicU64::new(0),
-            queue: Arc::new((Mutex::new(Queue { jobs: Default::default(), busy: false }), Condvar::new())),
+            queue: Arc::new((
+                Mutex::new(Queue {
+                    frames: Default::default(),
+                    frame_bytes: 0,
+                    jobs: Default::default(),
+                    busy: cfg!(not(target_arch = "wasm32")),
+                    pending_frames: Default::default(),
+                    drops: Drops::default(),
+                }),
+                Condvar::new(),
+            )),
             min_layer_ms: AtomicU64::new(30),
+            dropping: Mutex::new(HashMap::new()),
         });
         dc.rescan();
+        // Shrinking a large cache deletes many files: the writer thread does it.
+        #[cfg(target_arch = "wasm32")]
         dc.evict();
         #[cfg(not(target_arch = "wasm32"))]
         {
@@ -331,7 +497,7 @@ impl DiskCache {
                 let Ok(files) = std::fs::read_dir(shard.path()) else { continue };
                 for f in files.flatten() {
                     let p = f.path();
-                    let name = p.file_name().and_then(|n| n.to_str()).unwrap_or("");
+                    let name = p.file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("");
                     if name.contains(".tmp") {
                         // A writer that died mid-write; old temporaries are removed.
                         if f.metadata().and_then(|m| m.modified()).is_ok_and(|t| t.elapsed().is_ok_and(|e| e.as_secs() > 600)) {
@@ -371,6 +537,62 @@ impl DiskCache {
         self.evict();
     }
 
+    /// The limit in effect: the setting, or less when the disk is short of free space.
+    pub fn limit_bytes(&self) -> u64 {
+        self.max_bytes().min(self.disk_cap.load(Ordering::Relaxed))
+    }
+
+    /// The cache's disk: `(total, available)` bytes, `None` = unknown. The cache leaves
+    /// [`disk_reserve`] free (5% of the disk, at least 2 GB and at most 10 GB), evicting when it
+    /// must.
+    pub fn set_disk_space(&self, space: Option<(u64, u64)>) {
+        let mut reserve = 0;
+        let cap = match space {
+            // (a disk reported as 0 bytes, such as an automount map, is unknown)
+            Some((total, available)) if total > 0 => {
+                reserve = disk_reserve(total);
+                let used = self.index.lock().map(|g| g.total()).unwrap_or_default();
+                // The cache's own files count as free: below the reserve it gives space back.
+                used.saturating_add(available).saturating_sub(reserve)
+            }
+            _ => u64::MAX,
+        };
+        self.reserve.store(reserve, Ordering::Relaxed);
+        self.disk_cap.store(cap, Ordering::Relaxed);
+        let limited = cap < self.max_bytes();
+        if self.space_limited.swap(limited, Ordering::Relaxed) != limited && limited {
+            log::warn!("disk cache at {}: little free disk space, limiting the cache to {} MB", self.folder().display(), cap >> 20);
+        }
+        self.evict();
+    }
+
+    /// Whether frame and layer writes are worth encoding now: `false` while free disk space
+    /// holds the limit at 0 or under 64 MB (a limit the setting asks for is always used). Two
+    /// atomic reads, so writes check it before they spend time converting and compressing
+    /// pixels that [`DiskCache::write_format`] would refuse anyway. (Whether a given entry fits
+    /// is known only once it is compressed: `write_format` decides.)
+    pub fn accepts_writes(&self) -> bool {
+        let (max, limit) = (self.max_bytes(), self.limit_bytes());
+        limit > 0 && (limit >= MIN_WRITE_ROOM || limit == max)
+    }
+
+    /// The free space the cache leaves on its disk ([`disk_reserve`]), once the disk's size is
+    /// known ([`DiskCache::set_disk_space`]).
+    pub fn reserve_bytes(&self) -> Option<u64> {
+        Some(self.reserve.load(Ordering::Relaxed)).filter(|r| *r > 0)
+    }
+
+    /// Frame and layer entries compressed for writing so far (tests: a write refused up front
+    /// costs no encode).
+    pub fn encodes(&self) -> u64 {
+        self.encodes.load(Ordering::Relaxed)
+    }
+
+    /// Count one entry compressed for a queued write.
+    fn count_encode(&self) {
+        self.encodes.fetch_add(1, Ordering::Relaxed);
+    }
+
     /// Layer buffers faster to render than this are not worth a disk write.
     pub fn set_min_layer_ms(&self, ms: u64) {
         self.min_layer_ms.store(ms, Ordering::Relaxed);
@@ -384,6 +606,11 @@ impl DiskCache {
         self.index.lock().is_ok_and(|g| g.contains(kind, key))
     }
 
+    /// A frame write is queued or in progress.
+    pub fn frame_pending(&self, key: u128) -> bool {
+        self.queue.0.lock().is_ok_and(|q| q.pending_frames.contains(&key))
+    }
+
     /// Keys of one kind (unordered).
     pub fn keys(&self, kind: Kind) -> Vec<u128> {
         self.index.lock().map(|g| g.keys(kind)).unwrap_or_default()
@@ -395,11 +622,13 @@ impl DiskCache {
             entries,
             bytes,
             max_bytes: self.max_bytes(),
+            limit_bytes: self.limit_bytes(),
             hits: self.hits.load(Ordering::Relaxed),
             misses: self.misses.load(Ordering::Relaxed),
             writes: self.writes.load(Ordering::Relaxed),
             evictions: self.evictions.load(Ordering::Relaxed),
             dropped: self.dropped.load(Ordering::Relaxed),
+            failed: self.failed.load(Ordering::Relaxed),
         }
     }
 
@@ -421,8 +650,10 @@ impl DiskCache {
         #[cfg(target_arch = "wasm32")]
         {
             q.jobs.clear();
+            q.frames.clear();
+            q.pending_frames.clear();
         }
-        while !q.jobs.is_empty() || q.busy {
+        while !q.is_empty() || q.busy {
             q = match cv.wait(q) {
                 Ok(q) => q,
                 Err(_) => return,
@@ -431,36 +662,105 @@ impl DiskCache {
     }
 
     fn read(&self, kind: Kind, key: u128) -> Option<Vec<u8>> {
+        self.read_entry(kind, key).map(|(_, p)| p)
+    }
+
+    /// An entry's payload and its header's format byte.
+    fn read_entry(&self, kind: Kind, key: u128) -> Option<(u8, Vec<u8>)> {
+        let entry = self.load(kind, key);
+        match &entry {
+            Some(_) => self.hit(kind, key),
+            None => _ = self.misses.fetch_add(1, Ordering::Relaxed),
+        }
+        entry
+    }
+
+    /// An entry's payload and format byte, without counting it as a hit or miss. A damaged file
+    /// is deleted; a missing one forgotten.
+    fn load(&self, kind: Kind, key: u128) -> Option<(u8, Vec<u8>)> {
         if !self.contains(kind, key) {
-            self.misses.fetch_add(1, Ordering::Relaxed);
             return None;
         }
         let path = self.path(kind, key);
         let data = std::fs::read(&path).ok();
-        let ok = data.as_deref().and_then(|d| verify(d, kind));
-        match ok {
-            Some(payload) => {
-                let payload = payload.to_vec();
-                self.hits.fetch_add(1, Ordering::Relaxed);
-                if let Ok(mut g) = self.index.lock() {
-                    g.touch(kind, key);
-                }
-                // Persist the recency for the next session (best effort).
-                if let Ok(f) = std::fs::File::options().append(true).open(&path) {
-                    let _ = f.set_modified(std::time::SystemTime::now());
-                }
-                Some(payload)
-            }
-            None => {
-                self.misses.fetch_add(1, Ordering::Relaxed);
-                // Gone (another process evicted it) or damaged: forget it.
-                if data.is_some() {
-                    let _ = std::fs::remove_file(&path);
-                }
-                self.forget(kind, key);
-                None
+        let ok = data.as_deref().and_then(|d| Some((*d.get(5)?, verify(d, kind)?.to_vec())));
+        if ok.is_none() {
+            // Gone (another process evicted it) or damaged: forget it.
+            if data.is_some() {
+                let _ = std::fs::remove_file(&path);
             }
+            self.forget(kind, key);
         }
+        ok
+    }
+
+    /// Count a hit: the entry becomes the most recently used, also for the next session.
+    fn hit(&self, kind: Kind, key: u128) {
+        self.hits.fetch_add(1, Ordering::Relaxed);
+        if let Ok(mut g) = self.index.lock() {
+            g.touch(kind, key);
+        }
+        // Persist the recency for the next session (best effort).
+        if let Ok(f) = std::fs::File::options().append(true).open(self.path(kind, key)) {
+            let _ = f.set_modified(std::time::SystemTime::now());
+        }
+    }
+
+    /// An entry of `kind` and `format` whose source files are unchanged, decoded by `decode`,
+    /// with those files. An entry whose files changed, of the format before #3184, or damaged,
+    /// is a miss and is deleted (it renders again and is stored anew). A frame entry of the
+    /// other current frame format (8-bit and half-float frames have keys of their own) is a miss
+    /// and stays.
+    fn get_checked<T>(
+        &self,
+        kind: Kind,
+        key: u128,
+        format: u8,
+        virtual_id: Option<VirtualFileId<'_>>,
+        decode: impl FnOnce(&[u8]) -> Option<T>,
+    ) -> Option<(T, ReadFiles)> {
+        let miss = || {
+            self.misses.fetch_add(1, Ordering::Relaxed);
+            None
+        };
+        // (before the file is read: the writer may finish a drop's sweep between the read and the
+        // check below, and a drop may start meanwhile)
+        let drops = self.drops_now();
+        let Some((found, payload)) = self.load(kind, key) else { return miss() };
+        if found != format {
+            let other_frame_format = kind == Kind::Frame && (found == FORMAT_RGBA8_FILES || found == FORMAT_F16_FILES);
+            if !other_frame_format {
+                self.discard(kind, key);
+            }
+            return miss();
+        }
+        let Some((files, body)) = EntryFiles::decode(&payload) else {
+            self.discard(kind, key);
+            return miss();
+        };
+        self.file_checks.fetch_add(files.len() as u64, Ordering::Relaxed);
+        if self.made_of_dropped(&files, &drops) || !files.unchanged(virtual_id) {
+            self.discard(kind, key);
+            return miss();
+        }
+        let Some(value) = decode(body) else {
+            self.discard(kind, key);
+            return miss();
+        };
+        self.hit(kind, key);
+        Some((value, files.to_read_files()))
+    }
+
+    /// Source files looked at so far to check frame and layer entries before using them (one per
+    /// file a read entry lists; tests).
+    pub fn file_checks(&self) -> u64 {
+        self.file_checks.load(Ordering::Relaxed)
+    }
+
+    /// A valid file whose payload does not decode: delete it, as a damaged one.
+    fn discard(&self, kind: Kind, key: u128) {
+        let _ = std::fs::remove_file(self.path(kind, key));
+        self.forget(kind, key);
     }
 
     fn forget(&self, kind: Kind, key: u128) {
@@ -469,55 +769,96 @@ impl DiskCache {
         }
     }
 
-    fn enqueue(&self, kind: Kind, key: u128, payload: Vec<u8>) {
+    /// Queue a write; `false` when it was dropped (a full queue).
+    fn enqueue(&self, kind: Kind, key: u128, payload: Vec<u8>) -> bool {
+        self.enqueue_format(kind, key, FORMAT_RGBA8, payload, None)
+    }
+
+    /// [`DiskCache::enqueue`] with the entry's header format byte. `made`: the source files of a
+    /// frame or layer entry and the drop generation its reads started at
+    /// ([`DiskCache::drop_generation`]); refused (`false`) when one of them was dropped since.
+    fn enqueue_format(&self, kind: Kind, key: u128, format: u8, payload: Vec<u8>, made: Option<(&EntryFiles, u64)>) -> bool {
+        let stale = |q: &Queue| made.is_some_and(|(files, since)| q.drops.stale(files.files().iter().map(|f| &f.path), since));
         #[cfg(target_arch = "wasm32")]
         {
-            self.write_now(kind, key, &payload);
+            if self.queue.0.lock().is_ok_and(|q| stale(&q)) {
+                return false;
+            }
+            self.write_format(kind, key, format, &payload);
+            true
         }
         #[cfg(not(target_arch = "wasm32"))]
         {
             let (m, cv) = &*self.queue;
-            let Ok(mut q) = m.lock() else { return };
-            if q.jobs.len() >= QUEUE_LIMIT {
+            let Ok(mut q) = m.lock() else { return false };
+            if stale(&q) {
+                return false;
+            }
+            let full = match kind {
+                Kind::Frame => q.frame_bytes.saturating_add(payload.len()) > FRAME_QUEUE_BYTES,
+                _ => q.jobs.len() >= QUEUE_LIMIT,
+            };
+            if full {
                 self.dropped.fetch_add(1, Ordering::Relaxed);
-                return;
+                return false;
+            }
+            if kind == Kind::Frame {
+                q.pending_frames.insert(key);
+                q.frame_bytes = q.frame_bytes.saturating_add(payload.len());
+                q.frames.push_back(Job::Write(kind, key, format, payload));
+            } else {
+                q.jobs.push_back(Job::Write(kind, key, format, payload));
             }
-            q.jobs.push_back(Job::Write(kind, key, payload));
             cv.notify_all();
+            true
         }
     }
 
     /// Write an entry now (atomic rename), then evict down to the limit.
-    fn write_now(&self, kind: Kind, key: u128, payload: &[u8]) {
+    fn write_format(&self, kind: Kind, key: u128, format: u8, payload: &[u8]) {
         if self.contains(kind, key) {
             return;
         }
         let path = self.path(kind, key);
         let Some(parent) = path.parent() else { return };
-        if std::fs::create_dir_all(parent).is_err() {
+        if let Err(e) = std::fs::create_dir_all(parent) {
+            self.write_failed(&e);
             return;
         }
-        let data = seal(kind, payload);
+        let data = seal_format(kind, format, payload);
+        // An entry that cannot fit would be evicted straight away.
+        if data.len() as u64 > self.limit_bytes() {
+            return;
+        }
+        // Make room first, so the cache never exceeds its limit (or the free-space reserve).
+        self.evict_to(self.limit_bytes().saturating_sub(data.len() as u64));
         let n = self.tmp_counter.fetch_add(1, Ordering::Relaxed);
         let tmp = parent.join(format!("{key:032x}.tmp.{}.{n}", std::process::id()));
-        if std::fs::write(&tmp, &data).is_err() {
-            let _ = std::fs::remove_file(&tmp);
-            return;
-        }
-        if std::fs::rename(&tmp, &path).is_err() {
+        if let Err(e) = std::fs::write(&tmp, &data).and_then(|()| std::fs::rename(&tmp, &path)) {
             let _ = std::fs::remove_file(&tmp);
+            self.write_failed(&e);
             return;
         }
         self.writes.fetch_add(1, Ordering::Relaxed);
         if let Ok(mut g) = self.index.lock() {
             g.insert(kind, key, data.len() as u64);
         }
-        self.evict();
+    }
+
+    /// Count a failed write; the first one is logged (a full disk shouldn't go unnoticed).
+    fn write_failed(&self, e: &std::io::Error) {
+        if self.failed.fetch_add(1, Ordering::Relaxed) == 0 {
+            log::warn!("disk cache at {}: a write failed: {e}", self.folder().display());
+        }
     }
 
     /// Remove least recently used entries until the cache fits its limit.
     fn evict(&self) {
-        let max = self.max_bytes();
+        self.evict_to(self.limit_bytes());
+    }
+
+    /// Remove least recently used entries until the cache fits `max` bytes.
+    fn evict_to(&self, max: u64) {
         let victims = match self.index.lock() {
             Ok(mut g) => g.evict(max),
             Err(_) => return,
@@ -528,37 +869,229 @@ impl DiskCache {
         }
     }
 
+    /// Delete the frame and layer entries made of any of `paths` (File ▸ Reload Footage: a file
+    /// replaced by one with the same size and modification time must be read again, which the
+    /// check on hit can't tell). The index knows keys, not files, so the writer thread reads the
+    /// files section at the start of each frame and layer entry (no pixels) and deletes the
+    /// entries that list one of `paths`, after the writes queued before (those are swept too);
+    /// until it is done, an entry made of one of them is a miss. Entries are deleted for good,
+    /// so they don't come back after a restart. Nothing else in the cache is touched.
+    ///
+    /// A render that was under way meanwhile may still offer an entry made of one of `paths` as
+    /// it was before: it is refused, see [`DiskCache::drop_generation`].
+    pub fn drop_files(&self, paths: impl IntoIterator<Item = impl Into<Arc<str>>>) {
+        let paths: Vec<Arc<str>> = paths.into_iter().map(Into::into).collect();
+        if paths.is_empty() {
+            return;
+        }
+        {
+            let mut d = self.dropping.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            for p in &paths {
+                let n = d.entry(p.clone()).or_default();
+                *n = n.saturating_add(1);
+            }
+        }
+        #[cfg_attr(target_arch = "wasm32", allow(unused_variables))]
+        let (m, cv) = &*self.queue;
+        match m.lock() {
+            Ok(mut q) => {
+                q.drops.record(&paths);
+                #[cfg(not(target_arch = "wasm32"))]
+                {
+                    // (never refused for a full queue)
+                    q.jobs.push_back(Job::Drop(paths));
+                    cv.notify_all();
+                    return;
+                }
+            }
+            // (no writer thread to take the job any more)
+            Err(poisoned) => poisoned.into_inner().drops.record(&paths),
+        }
+        self.sweep(&paths);
+    }
+
+    /// The number of [`DiskCache::drop_files`] calls so far. A render takes it before it starts
+    /// reading and hands it to `put_frame` / `put_layer` with what it made: an entry listing a
+    /// file dropped after that is refused (the render may have read the file as it was before).
+    pub fn drop_generation(&self) -> u64 {
+        self.queue.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).drops.generation
+    }
+
+    /// Whether one of `files` was dropped after generation `since` ([`DiskCache::drop_generation`]),
+    /// or after the earlier generation the list's own reads started at ([`ReadFiles::since`]: a
+    /// buffer made by an earlier render, from memory): what was made of them then is from before
+    /// the drop (shown, never stored).
+    pub fn dropped_since(&self, files: &ReadFiles, since: u64) -> bool {
+        let since = files.since().map_or(since, |s| s.min(since));
+        self.queue.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).drops.stale(files.files().iter().map(|f| &f.path), since)
+    }
+
+    /// Whether a [`DiskCache::drop_files`] is pending.
+    pub fn is_dropping(&self) -> bool {
+        !self.dropping.lock().unwrap_or_else(std::sync::PoisonError::into_inner).is_empty()
+    }
+
+    /// The drop generation and the files being dropped now, taken before an entry is read
+    /// (see [`DiskCache::made_of_dropped`]).
+    fn drops_now(&self) -> (u64, Vec<Arc<str>>) {
+        let generation = self.drop_generation();
+        let d = self.dropping.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        (generation, d.keys().cloned().collect())
+    }
+
+    /// An entry read after [`DiskCache::drops_now`] gave `drops` that is made of a file whose
+    /// drop was pending then (its sweep may have ended since, after the entry was read) or that
+    /// was dropped since.
+    fn made_of_dropped(&self, files: &EntryFiles, drops: &(u64, Vec<Arc<str>>)) -> bool {
+        let (since, pending) = drops;
+        let paths = || files.files().iter().map(|f| &f.path);
+        paths().any(|p| pending.contains(p)) || self.queue.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner).drops.stale(paths(), *since)
+    }
+
+    /// The writer's part of [`DiskCache::drop_files`]: delete the entries made of `paths`, then
+    /// end their drop.
+    fn sweep(&self, paths: &[Arc<str>]) {
+        let set: std::collections::HashSet<&str> = paths.iter().map(|p| &**p).collect();
+        for kind in [Kind::Frame, Kind::Layer] {
+            for key in self.keys(kind) {
+                if self.entry_files(kind, key).is_some_and(|f| f.files().iter().any(|f| set.contains(&*f.path))) {
+                    self.discard(kind, key);
+                }
+            }
+        }
+        let mut d = self.dropping.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        for p in paths {
+            if let Some(n) = d.get_mut(p) {
+                *n = n.saturating_sub(1);
+                if *n == 0 {
+                    d.remove(p);
+                }
+            }
+        }
+    }
+
+    /// The source files a frame or layer entry lists, read from the start of its file (the
+    /// whole file only when the list is longer than that). `None` when it has none to read (an
+    /// earlier format, gone, damaged): such an entry is never used anyway.
+    fn entry_files(&self, kind: Kind, key: u128) -> Option<EntryFiles> {
+        use std::io::Read;
+        const HEAD: u64 = 64 << 10;
+        let parse = |d: &[u8]| {
+            let format = *d.get(5)?;
+            let ours = d.get(..4)? == MAGIC && *d.get(4)? == kind.tag();
+            if !ours || !matches!(format, FORMAT_RGBA8_FILES | FORMAT_F16_FILES | FORMAT_LAYER_FILES) {
+                return None;
+            }
+            EntryFiles::decode(d.get(8..)?).map(|(files, _)| files)
+        };
+        let path = self.path(kind, key);
+        let mut head = Vec::new();
+        std::fs::File::open(&path).ok()?.take(HEAD).read_to_end(&mut head).ok()?;
+        parse(&head).or_else(|| if head.len() as u64 == HEAD { parse(&std::fs::read(&path).ok()?) } else { None })
+    }
+
     // ------------------------------------------------------------ typed entries
 
-    pub fn get_frame(&self, key: u128) -> Option<Frame8> {
-        let p = self.read(Kind::Frame, key)?;
-        decode_frame(&p)
+    /// An 8-bit frame whose source files are unchanged (see [`DiskCache::get_checked`]), with
+    /// those files; `None` for a half-float entry of that key, which
+    /// [`DiskCache::get_frame_f16`] reads. `virtual_id` names files served from memory.
+    pub fn get_frame(&self, key: u128, virtual_id: Option<VirtualFileId<'_>>) -> Option<(Frame8, ReadFiles)> {
+        self.get_checked(Kind::Frame, key, FORMAT_RGBA8_FILES, virtual_id, decode_frame)
     }
 
-    /// Queue a frame for writing (8-bit premultiplied RGBA, `width * height * 4` bytes).
-    pub fn put_frame(&self, key: u128, width: u32, height: u32, rgba: &[u8]) {
-        if self.contains(Kind::Frame, key) || rgba.len() != width as usize * height as usize * 4 {
+    /// A half-float frame (32 bpc viewer frames), as [`DiskCache::get_frame`].
+    pub fn get_frame_f16(&self, key: u128, virtual_id: Option<VirtualFileId<'_>>) -> Option<(FrameF16, ReadFiles)> {
+        self.get_checked(Kind::Frame, key, FORMAT_F16_FILES, virtual_id, decode_frame_f16)
+    }
+
+    /// Queue a half-float frame for writing (`width * height * 4` binary16 values) with the
+    /// source files it was made of. `true` when it is on disk or queued; `false` when refused
+    /// (wrong size, a full queue, no room on the disk, files that can't be checked later: see
+    /// [`EntryFiles::of`]; a file dropped after `since`, the [`DiskCache::drop_generation`] the
+    /// render started at).
+    #[allow(clippy::too_many_arguments)]
+    pub fn put_frame_f16(
+        &self,
+        key: u128,
+        width: u32,
+        height: u32,
+        rgba: &[u16],
+        files: &ReadFiles,
+        virtual_id: Option<VirtualFileId<'_>>,
+        since: u64,
+    ) -> bool {
+        if rgba.len() as u64 != width as u64 * height as u64 * 4 {
+            return false;
+        }
+        let Some(files) = EntryFiles::of(files, virtual_id) else { return false };
+        if self.contains(Kind::Frame, key) {
+            return true;
+        }
+        // (no room on the disk: refused before the pixels are compressed)
+        if !self.accepts_writes() {
+            return false;
+        }
+        self.count_encode();
+        let payload = with_files(&files, encode_frame_f16(width, height, rgba));
+        self.enqueue_format(Kind::Frame, key, FORMAT_F16_FILES, payload, Some((&files, since)))
+    }
+
+    /// Write a half-float frame synchronously (tests); a list that can't be stored is not.
+    pub fn put_frame_f16_now(&self, key: u128, width: u32, height: u32, rgba: &[u16], files: &ReadFiles) {
+        if let Some(files) = EntryFiles::of(files, None) {
+            self.write_format(Kind::Frame, key, FORMAT_F16_FILES, &with_files(&files, encode_frame_f16(width, height, rgba)));
+        }
+    }
+
+    /// Queue a frame for writing (8-bit premultiplied RGBA, `width * height * 4` bytes) with the
+    /// source files it was made of. `true` when it is on disk or queued; `false` when refused
+    /// (wrong size, a full queue, no room on the disk, files that can't be checked later: see
+    /// [`EntryFiles::of`]; a file dropped after `since`, the [`DiskCache::drop_generation`] the
+    /// render started at).
+    #[allow(clippy::too_many_arguments)]
+    pub fn put_frame(&self, key: u128, width: u32, height: u32, rgba: &[u8], files: &ReadFiles, virtual_id: Option<VirtualFileId<'_>>, since: u64) -> bool {
+        if rgba.len() as u64 != width as u64 * height as u64 * 4 {
+            return false;
+        }
+        let Some(files) = EntryFiles::of(files, virtual_id) else { return false };
+        if self.contains(Kind::Frame, key) {
+            return true;
+        }
+        // (no room on the disk: refused before the pixels are compressed)
+        if !self.accepts_writes() {
+            return false;
+        }
+        self.count_encode();
+        let payload = with_files(&files, encode_frame(width, height, rgba));
+        self.enqueue_format(Kind::Frame, key, FORMAT_RGBA8_FILES, payload, Some((&files, since)))
+    }
+
+    /// A layer buffer (key: [`layer_disk_key`]) whose source files are unchanged, with those
+    /// files, as [`DiskCache::get_checked`]: an entry whose files changed, damaged, or of the
+    /// format before #3184 is a miss and is deleted, so the buffer renders again and replaces it.
+    /// `virtual_id` names files served from memory.
+    pub fn get_layer(&self, key: u128, virtual_id: Option<VirtualFileId<'_>>) -> Option<(Buf, ReadFiles)> {
+        self.get_checked(Kind::Layer, key, FORMAT_LAYER_FILES, virtual_id, decode_layer)
+    }
+
+    /// Queue a layer buffer for writing with the source files it was made of (see
+    /// [`EntryFiles::of`]: a buffer whose files can't all be named must not be stored). Refused
+    /// when one of them was dropped after `since`, the [`DiskCache::drop_generation`] its render
+    /// started at.
+    pub fn put_layer(&self, key: u128, buf: &Buf, files: &EntryFiles, since: u64) {
+        // (no room on the disk: refused before the buffer is compressed)
+        if self.contains(Kind::Layer, key) || !self.accepts_writes() {
             return;
         }
-        self.enqueue(Kind::Frame, key, encode_frame(width, height, rgba));
+        self.count_encode();
+        let _ = self.enqueue_format(Kind::Layer, key, FORMAT_LAYER_FILES, with_files(files, encode_layer(buf)), Some((files, since)));
     }
 
-    pub fn get_layer(&self, key: u128) -> Option<Buf> {
-        let p = self.read(Kind::Layer, key)?;
-        decode_layer(&p)
-    }
-
-    /// Queue a layer buffer for writing.
-    pub fn put_layer(&self, key: u128, buf: &Buf) {
-        if self.contains(Kind::Layer, key) {
-            return;
+    /// Write a layer buffer synchronously (tests); a list that can't be stored is not.
+    pub fn put_layer_now(&self, key: u128, buf: &Buf, files: &ReadFiles) {
+        if let Some(files) = EntryFiles::of(files, None) {
+            self.write_format(Kind::Layer, key, FORMAT_LAYER_FILES, &with_files(&files, encode_layer(buf)));
         }
-        self.enqueue(Kind::Layer, key, encode_layer(buf));
-    }
-
-    /// Write a layer buffer synchronously (tests).
-    pub fn put_layer_now(&self, key: u128, buf: &Buf) {
-        self.write_now(Kind::Layer, key, &encode_layer(buf));
     }
 
     /// A segmentation (chain key, scale) written by [`DiskCache::put_seg`].
@@ -574,23 +1107,76 @@ impl DiskCache {
         if self.contains(Kind::Matte, k) {
             return;
         }
-        self.enqueue(Kind::Matte, k, lz4_flex::compress_prepend_size(&seg.to_bytes()));
+        let _ = self.enqueue(Kind::Matte, k, lz4_flex::compress_prepend_size(&seg.to_bytes()));
     }
 
-    /// Write a frame synchronously (tests).
-    pub fn put_frame_now(&self, key: u128, width: u32, height: u32, rgba: &[u8]) {
-        self.write_now(Kind::Frame, key, &encode_frame(width, height, rgba));
+    /// Make the frame at key `from` the frame at key `to` too (an edit that can't change it gave
+    /// its comp a new content key): a hard link to the same file, or a copy where the file system
+    /// has no links. `false` when `from` isn't cached, `to` already is, or the file system
+    /// refused. (Entries don't contain their key, so the same file serves both.)
+    pub fn link_frame(&self, from: u128, to: u128) -> bool {
+        // (while files are being dropped, `from` may be made of one: it renders again instead)
+        if !self.contains(Kind::Frame, from) || self.contains(Kind::Frame, to) || self.is_dropping() {
+            return false;
+        }
+        let (src, dst) = (self.path(Kind::Frame, from), self.path(Kind::Frame, to));
+        let Some(parent) = dst.parent() else { return false };
+        let n = self.tmp_counter.fetch_add(1, Ordering::Relaxed);
+        let tmp = parent.join(format!("{to:032x}.tmp.{}.{n}", std::process::id()));
+        let linked = std::fs::create_dir_all(parent)
+            .and_then(|()| std::fs::hard_link(&src, &tmp).or_else(|_| std::fs::copy(&src, &tmp).map(|_| ())))
+            .and_then(|()| std::fs::metadata(&tmp))
+            .and_then(|m| std::fs::rename(&tmp, &dst).map(|()| m.len()));
+        let bytes = match linked {
+            Ok(bytes) => bytes,
+            Err(_) => {
+                // (gone meanwhile: another process evicted it)
+                let _ = std::fs::remove_file(&tmp);
+                return false;
+            }
+        };
+        // (a link shares its file, but counts in full: the cache only ever errs small)
+        self.evict_to(self.limit_bytes().saturating_sub(bytes));
+        if let Ok(mut g) = self.index.lock() {
+            g.insert(Kind::Frame, to, bytes);
+        }
+        true
+    }
+
+    /// Write a frame synchronously (tests); a list that can't be stored is not.
+    pub fn put_frame_now(&self, key: u128, width: u32, height: u32, rgba: &[u8], files: &ReadFiles) {
+        if let Some(files) = EntryFiles::of(files, None) {
+            self.write_format(Kind::Frame, key, FORMAT_RGBA8_FILES, &with_files(&files, encode_frame(width, height, rgba)));
+        }
     }
 }
 
+/// A frame or layer entry's payload: its source files, then its pixels.
+fn with_files(files: &EntryFiles, pixels: Vec<u8>) -> Vec<u8> {
+    let mut out = Vec::with_capacity(pixels.len() + 64);
+    files.encode(&mut out);
+    out.extend_from_slice(&pixels);
+    out
+}
+
+/// The writer thread: evicts to the limit at open, then drains the job queue until the cache is dropped.
 #[cfg(not(target_arch = "wasm32"))]
 fn writer(dc: std::sync::Weak<DiskCache>, q: Arc<(Mutex<Queue>, Condvar)>) {
     let (m, cv) = &*q;
+    // The eviction at open (a lower limit than the folder holds), off the opening thread;
+    // `busy` starts set, so `flush` waits for it.
+    if let Some(cache) = dc.upgrade() {
+        cache.evict();
+    }
+    if let Ok(mut g) = m.lock() {
+        g.busy = false;
+    }
+    cv.notify_all();
     loop {
         let job = {
             let Ok(mut g) = m.lock() else { return };
             loop {
-                if let Some(j) = g.jobs.pop_front() {
+                if let Some(j) = g.pop() {
                     g.busy = true;
                     break j;
                 }
@@ -604,55 +1190,88 @@ fn writer(dc: std::sync::Weak<DiskCache>, q: Arc<(Mutex<Queue>, Condvar)>) {
             }
         };
         let Some(cache) = dc.upgrade() else { return };
-        match job {
-            Job::Write(kind, key, payload) => cache.write_now(kind, key, &payload),
-        }
+        let written = match job {
+            Job::Write(kind, key, format, payload) => {
+                cache.write_format(kind, key, format, &payload);
+                (kind == Kind::Frame).then_some(key)
+            }
+            Job::Drop(paths) => {
+                cache.sweep(&paths);
+                None
+            }
+        };
         drop(cache);
         if let Ok(mut g) = m.lock() {
             g.busy = false;
+            if let Some(key) = written {
+                g.pending_frames.remove(&key);
+            }
         }
         cv.notify_all();
     }
 }
 
-/// An entry file's bytes: header (magic, kind), payload, checksum.
-pub fn seal(kind: Kind, payload: &[u8]) -> Vec<u8> {
+/// An entry file's bytes: header (magic, kind, the format byte: [`FORMAT_RGBA8`] for
+/// segmentations, [`FORMAT_RGBA8_FILES`] / [`FORMAT_F16_FILES`] for frames,
+/// [`FORMAT_LAYER_FILES`] for layer buffers), payload, checksum.
+fn seal_format(kind: Kind, format: u8, payload: &[u8]) -> Vec<u8> {
     let mut data = Vec::with_capacity(payload.len() + 16);
     data.extend_from_slice(MAGIC);
     data.push(kind.tag());
-    data.extend_from_slice(&[0, 0, 0]);
+    data.extend_from_slice(&[format, 0, 0]);
     data.extend_from_slice(payload);
     let sum = checksum(&data);
     data.extend_from_slice(&sum.to_le_bytes());
     data
 }
 
-/// A sealed frame entry ([`seal`] of the encoded frame): what the browser's frame workers
-/// write to the Origin Private File System.
-pub fn frame_entry(width: u32, height: u32, rgba: &[u8]) -> Vec<u8> {
-    seal(Kind::Frame, &encode_frame(width, height, rgba))
+/// A sealed 8-bit frame entry with the source files it was made of: what the browser's frame
+/// workers write to the Origin Private File System. `None` when the frame must not be stored
+/// (its files can't be checked later, see [`EntryFiles::of`]; or a wrong size).
+pub fn frame_entry(width: u32, height: u32, rgba: &[u8], files: &ReadFiles, virtual_id: Option<VirtualFileId<'_>>) -> Option<Vec<u8>> {
+    if rgba.len() as u64 != width as u64 * height as u64 * 4 {
+        return None;
+    }
+    let files = EntryFiles::of(files, virtual_id)?;
+    Some(seal_format(Kind::Frame, FORMAT_RGBA8_FILES, &with_files(&files, encode_frame(width, height, rgba))))
 }
 
-/// A frame from a sealed entry's bytes (`None` when damaged).
-pub fn read_frame_entry(data: &[u8]) -> Option<Frame8> {
-    decode_frame(verify(data, Kind::Frame)?)
+/// The frame of a sealed entry's bytes, if its source files are unchanged. `None` when damaged,
+/// of another format, or made of files that changed since: a miss, to be rendered again.
+pub fn read_frame_entry(data: &[u8], virtual_id: Option<VirtualFileId<'_>>) -> Option<Frame8> {
+    let payload = verify(data, Kind::Frame)?;
+    if data.get(5) != Some(&FORMAT_RGBA8_FILES) {
+        return None;
+    }
+    let (files, pixels) = EntryFiles::decode(payload)?;
+    if !files.unchanged(virtual_id) {
+        return None;
+    }
+    decode_frame(pixels)
 }
 
-/// A sealed layer-buffer entry: what the browser's frame workers write to the Origin Private
-/// File System (`layers/<32 hex>.ecc`).
-pub fn layer_entry(buf: &Buf) -> Vec<u8> {
-    seal(Kind::Layer, &encode_layer(buf))
+/// A sealed layer-buffer entry with the source files it was made of: what the browser's frame
+/// workers write to the Origin Private File System (`layers/<32 hex>.ecc`).
+pub fn layer_entry(buf: &Buf, files: &EntryFiles) -> Vec<u8> {
+    seal_format(Kind::Layer, FORMAT_LAYER_FILES, &with_files(files, encode_layer(buf)))
 }
 
-/// A layer buffer from a sealed entry's bytes (`None` when damaged).
-pub fn read_layer_entry(data: &[u8]) -> Option<Buf> {
-    decode_layer(verify(data, Kind::Layer)?)
+/// A layer buffer and its source files from a sealed entry's bytes (`None` when damaged or of
+/// another format). The files are not looked at here: the store checks them when the buffer is
+/// used ([`EntryFiles::unchanged`]).
+pub fn read_layer_entry(data: &[u8]) -> Option<(Buf, EntryFiles)> {
+    let payload = verify(data, Kind::Layer)?;
+    if data.get(5) != Some(&FORMAT_LAYER_FILES) {
+        return None;
+    }
+    let (files, body) = EntryFiles::decode(payload)?;
+    Some((decode_layer(body)?, files))
 }
 
 /// The disk key of a segmentation: its chain key and scale.
 fn seg_key(key: u64, scale: f64) -> u128 {
     let mut h = Hash128::default();
-    h.write(b"segmentation-v1");
+    h.write(b"segmentation-v2");
     h.write_u64(key);
     h.write_u64(scale.to_bits());
     h.finish()
@@ -668,11 +1287,20 @@ impl effectcraft_effects::roto::SegStore for DiskCache {
 }
 
 impl crate::cache::LayerStore for DiskCache {
-    fn get_layer(&self, key: u128) -> Option<Arc<Buf>> {
-        DiskCache::get_layer(self, key).map(Arc::new)
+    /// The layer for `key` from the disk cache, or `None` when it is missing or stale.
+    fn get_layer(&self, key: u128, virtual_id: Option<VirtualFileId<'_>>) -> Option<(Arc<Buf>, ReadFiles)> {
+        DiskCache::get_layer(self, key, virtual_id).map(|(b, f)| (Arc::new(b), f))
     }
-    fn put_layer(&self, key: u128, buf: &Buf) {
-        DiskCache::put_layer(self, key, buf);
+    /// Queues a layer write on the disk cache.
+    fn put_layer(&self, key: u128, buf: &Buf, files: &EntryFiles, since: u64) {
+        DiskCache::put_layer(self, key, buf, files, since);
+    }
+    /// The current drop generation of the disk cache.
+    fn drop_generation(&self) -> u64 {
+        DiskCache::drop_generation(self)
+    }
+    fn dropped_since(&self, files: &ReadFiles, since: u64) -> bool {
+        DiskCache::dropped_since(self, files, since)
     }
     fn min_layer_ms(&self) -> u64 {
         DiskCache::min_layer_ms(self)
@@ -719,6 +1347,46 @@ fn decode_frame(p: &[u8]) -> Option<Frame8> {
     (rgba.len() == w as usize * h as usize * 4).then_some(Frame8 { width: w, height: h, rgba })
 }
 
+/// Half floats with their low and high bytes in planes (per channel), then LZ4: the high bytes
+/// (sign, exponent) repeat a lot, mixed with the low ones LZ4 finds little.
+fn encode_frame_f16(w: u32, h: u32, rgba: &[u16]) -> Vec<u8> {
+    use rayon::prelude::*;
+    let n = rgba.len() / 4;
+    let mut planes = vec![0u8; n * 8];
+    // Plane (byte k, channel c) at (k · 4 + c) · n.
+    planes.par_chunks_mut(n.max(1)).enumerate().for_each(|(plane, out)| {
+        let (k, c) = (plane / 4, plane % 4);
+        for (o, px) in out.iter_mut().zip(rgba.as_chunks::<4>().0) {
+            *o = px[c].to_le_bytes()[k];
+        }
+    });
+    let mut out = Vec::with_capacity(planes.len() / 3 + 16);
+    out.extend_from_slice(&w.to_le_bytes());
+    out.extend_from_slice(&h.to_le_bytes());
+    out.extend_from_slice(&lz4_flex::compress_prepend_size(&planes));
+    out
+}
+
+fn decode_frame_f16(p: &[u8]) -> Option<FrameF16> {
+    if p.len() < 8 {
+        return None;
+    }
+    let w = u32::from_le_bytes(p[0..4].try_into().ok()?);
+    let h = u32::from_le_bytes(p[4..8].try_into().ok()?);
+    let n = (w as usize).checked_mul(h as usize)?;
+    let planes = lz4_flex::decompress_size_prepended(&p[8..]).ok()?;
+    if planes.len() != n.checked_mul(8)? {
+        return None;
+    }
+    let mut rgba = vec![0u16; n * 4];
+    for (i, px) in rgba.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+        for (c, v) in px.iter_mut().enumerate() {
+            *v = u16::from_le_bytes([planes[c * n + i], planes[(4 + c) * n + i]]);
+        }
+    }
+    Some(FrameF16 { width: w, height: h, rgba })
+}
+
 fn encode_layer(b: &Buf) -> Vec<u8> {
     let (w, h) = (b.img.width, b.img.height);
     let n = b.img.data.len();
@@ -742,6 +1410,7 @@ fn encode_layer(b: &Buf) -> Vec<u8> {
     out
 }
 
+/// Decodes a stored layer payload into a buffer, or `None` when it is too short or damaged.
 fn decode_layer(p: &[u8]) -> Option<Buf> {
     if p.len() < 32 {
         return None;
@@ -752,8 +1421,8 @@ fn decode_layer(p: &[u8]) -> Option<Buf> {
     let offset = [f(8)?, f(16)?];
     let scale = f(24)?;
     let planes = lz4_flex::decompress_size_prepended(&p[32..]).ok()?;
-    let n = w as usize * h as usize;
-    if planes.len() != n * 16 {
+    let n = (w as usize).checked_mul(h as usize)?;
+    if planes.len() != n.checked_mul(16)? {
         return None;
     }
     let mut img = Image::new(w, h);
@@ -772,103 +1441,107 @@ fn decode_layer(p: &[u8]) -> Option<Buf> {
 // ---------------------------------------------------------------- content keys
 
 /// Bump when rendering changes in a way that makes old disk entries wrong.
-const RENDER_VERSION: &str = "effectcraft-render-2";
+const RENDER_VERSION: &str = "effectcraft-render-6";
 
+/// Feeds the `Debug` form of `v` into the hash, followed by a separator byte.
 fn hash_debug(h: &mut Hash128, v: &impl std::fmt::Debug) {
     h.write(format!("{v:?}").as_bytes());
     h.write(&[0xff]);
 }
 
-/// A file's size and modification time (so edited footage gets new keys).
-fn file_stamp(h: &mut Hash128, path: &str) {
-    if path.is_empty() {
-        return;
-    }
-    if let Ok(md) = std::fs::metadata(path) {
-        h.write_u64(md.len());
-        if let Ok(t) = md.modified()
-            && let Ok(d) = t.duration_since(std::time::UNIX_EPOCH)
-        {
-            h.write_u64(d.as_nanos() as u64);
-        }
-    }
-}
+/// Size and content hash of a path that has no native metadata (the browser file table).
+pub type VirtualFileId<'a> = &'a (dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync);
 
-fn footage_stamp(h: &mut Hash128, f: &effectcraft_project::Footage) {
-    file_stamp(h, &f.path);
-    for p in &f.sequence {
-        file_stamp(h, p);
-    }
-}
+/// A [`VirtualFileId`] a cache can keep (the browser file table's identities).
+pub type SharedVirtualFileId = Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>;
 
-/// Salt for layer cache keys on disk: the renderer version and every footage file's identity
-/// (layer keys name footage items, not file contents).
-pub fn footage_salt(project: &effectcraft_project::Project) -> u64 {
+/// Layer entries with their source files (#3184), part of every layer disk key: entries of the
+/// earlier format (keyed by a project-wide footage salt instead) are never looked up again;
+/// least recently used, they are evicted.
+const LAYER_ENTRY_VERSION: &[u8] = b"layer-entry-files-2";
+
+/// Disk key of a layer buffer: the layer cache's content key ([`crate::cache::layer_key`] and
+/// the keys derived from it), the layer entry format and the renderer version. The content key
+/// comes from memory alone: it names the footage items the buffer uses with their settings and
+/// paths, so two projects only share an entry for the same pixels of the same files; whether
+/// those files still hold what the buffer was made of is checked when the entry is read
+/// ([`EntryFiles`]). No file is looked at here.
+pub fn layer_disk_key(key: u64) -> u128 {
     let mut h = Hash128::default();
+    h.write(LAYER_ENTRY_VERSION);
     h.write(RENDER_VERSION.as_bytes());
-    for (id, it) in &project.items {
-        if let effectcraft_project::ItemKind::Footage(f) = &it.kind {
-            h.write_u64(id.0);
-            hash_debug(&mut h, f);
-            footage_stamp(&mut h, f);
-        }
-    }
-    let v = h.finish();
-    (v as u64) ^ ((v >> 64) as u64)
+    h.write_u64(key);
+    h.finish()
 }
 
-/// Content key of a composition's pixels: project render settings, the comp and everything it
-/// uses (nested comps, footage, solids, their proxies and Use Proxy switches, footage and proxy
-/// files' size and time). With expressions in play (which can read any comp) the whole project
-/// counts. Switches that don't change pixels (Audio, Lock, Shy, Hide Shy Layers) don't count.
+/// Content key of a composition's pixels, from the project in memory alone (no file is looked
+/// at: the frame entries check their own source files when read, see [`EntryFiles`]): project
+/// render settings, the comp and the items it can draw (nested comps, footage items with their
+/// settings and paths, solids, Media Replacement footage, their proxies and Use Proxy switches;
+/// [`effectcraft_project::Project::pixel_reach`]). With expressions among them, everything those
+/// expressions can read counts too: every layer of their comps, markers, the comps and footage
+/// they name with literal names (and which items have those names), or the whole project when
+/// they compute a name or reach items another way. An edit to an item the comp can't reach keeps
+/// its key and its frames on disk (#3184, #1492). Switches that don't change pixels (Audio, Lock,
+/// Shy, Hide Shy Layers) don't count, and neither do markers unless an expression can read them.
 pub fn comp_content_key(project: &effectcraft_project::Project, comp: effectcraft_project::ItemId) -> u128 {
-    use effectcraft_project::{ItemKind, LayerSource};
+    comp_content_key_for_renderer(project, comp, RENDER_VERSION)
+}
+
+/// The content key of `comp` for one renderer: its settings, the comps and footage it uses, and the renderer name.
+fn comp_content_key_for_renderer(project: &effectcraft_project::Project, comp: effectcraft_project::ItemId, renderer: &str) -> u128 {
+    use effectcraft_project::ItemKind;
     let mut h = Hash128::default();
-    h.write(RENDER_VERSION.as_bytes());
+    h.write(renderer.as_bytes());
     hash_debug(&mut h, &project.settings);
-    let mut seen = std::collections::BTreeSet::new();
-    let mut stack = vec![comp];
-    let mut expressions = false;
-    while let Some(id) = stack.pop() {
-        if !seen.insert(id) {
-            continue;
-        }
-        let Some(it) = project.item(id) else { continue };
-        if let ItemKind::Comp(c) = &it.kind {
-            for l in &c.layers {
-                if let LayerSource::Comp { item } | LayerSource::Footage { item } | LayerSource::Solid { item } = l.source {
-                    stack.push(item);
-                }
-                if !expressions {
-                    l.props.walk("", &mut |_, p| expressions |= p.expr.is_some());
-                }
-            }
-        }
+    let heard = project.heard_layers();
+    let reach = project.pixel_reach(comp, &heard);
+    // Expressions can read any layer of the comps they reach, hidden or not, and their markers
+    // (#1083); without them, layers that can't change the picture (music, hidden layers nothing
+    // reads) don't count.
+    let expressions = reach.expressions;
+    let silent = |id, c: &effectcraft_project::Comp| if expressions { Default::default() } else { project.silent_layers(id, c, &heard) };
+    // (the names expressions look items up by: which items have them now)
+    if !reach.names.is_empty() {
+        hash_debug(&mut h, &reach.names);
     }
-    let ids: Vec<effectcraft_project::ItemId> = if expressions { project.items.keys().copied().collect() } else { seen.into_iter().collect() };
+    let ids: Vec<effectcraft_project::ItemId> = match reach.items {
+        Some(items) => items.into_iter().collect(),
+        None => project.items.keys().copied().collect(),
+    };
     for id in ids {
         let Some(it) = project.item(id) else { continue };
         h.write_u64(id.0);
         h.write(it.name.as_bytes());
         match &it.kind {
-            ItemKind::Comp(c) => hash_debug(&mut h, &c.pixel_form()),
+            ItemKind::Comp(c) => {
+                let quiet = silent(id, c);
+                let heard = |l| heard.contains(id, l);
+                if quiet.is_empty() {
+                    hash_debug(&mut h, &c.pixel_form_with(expressions, &heard));
+                } else {
+                    let mut pic = (**c).clone();
+                    pic.layers.retain(|l| !quiet.contains(&l.id));
+                    hash_debug(&mut h, &pic.pixel_form_with(expressions, &heard));
+                }
+            }
             k => hash_debug(&mut h, k),
         }
-        if let ItemKind::Footage(f) = &it.kind {
-            footage_stamp(&mut h, f);
-        }
         hash_debug(&mut h, &it.proxy);
-        if let Some(px) = &it.proxy {
-            footage_stamp(&mut h, &px.footage);
-        }
     }
     h.write_u64(comp.0);
     h.finish()
 }
 
+/// Frame entries with their source files (#3184), part of every frame key: entries of the
+/// earlier format (keyed by footage stamps instead) are never looked up again; least recently
+/// used, they are evicted.
+const FRAME_ENTRY_VERSION: &[u8] = b"frame-entry-files-2";
+
 /// Disk key of one viewer frame.
 pub fn frame_key(content: u128, frame: i64, scale_milli: u32, view: u64) -> u128 {
     let mut h = Hash128::default();
+    h.write(FRAME_ENTRY_VERSION);
     h.write(&content.to_le_bytes());
     h.write_u64(frame as u64);
     h.write_u64(scale_milli as u64);
@@ -886,6 +1559,26 @@ mod tests {
         d
     }
 
+    /// A linked frame reads back as the original under its new key, survives the original's
+    /// eviction, and is never linked over an existing entry or from a missing one.
+    #[test]
+    fn link_frame_serves_a_frame_under_a_new_key() {
+        let dc = DiskCache::open(tmpdir("link"), 1 << 30).unwrap();
+        let rgba: Vec<u8> = (0..16).collect();
+        dc.put_frame_now(1, 2, 2, &rgba, &ReadFiles::default());
+        assert!(dc.link_frame(1, 2));
+        assert_eq!(dc.get_frame(2, None).map(|f| f.0).map(|f| f.rgba), Some(rgba.clone()));
+        assert!(!dc.link_frame(1, 2), "already there");
+        assert!(!dc.link_frame(3, 4), "nothing to link");
+        assert!(!dc.contains(Kind::Frame, 4));
+        dc.put_frame_now(5, 2, 2, &[7; 16], &ReadFiles::default());
+        assert!(!dc.link_frame(5, 2), "an existing entry stays");
+        assert_eq!(dc.get_frame(2, None).map(|f| f.0).map(|f| f.rgba), Some(rgba.clone()));
+        let _ = std::fs::remove_file(dc.path(Kind::Frame, 1));
+        dc.forget(Kind::Frame, 1);
+        assert_eq!(dc.get_frame(2, None).map(|f| f.0).map(|f| f.rgba), Some(rgba), "the link outlives the original");
+    }
+
     fn buf(seed: u32, w: u32, h: u32) -> Buf {
         let mut img = Image::new(w, h);
         for (i, p) in img.data.iter_mut().enumerate() {
@@ -918,17 +1611,63 @@ mod tests {
     #[test]
     fn frame_entries_round_trip_and_names_parse() {
         let rgba: Vec<u8> = (0..4 * 6 * 3).map(|i| (i * 7 % 256) as u8).collect();
-        let e = frame_entry(6, 3, &rgba);
-        assert_eq!(read_frame_entry(&e), Some(Frame8 { width: 6, height: 3, rgba: rgba.clone() }));
+        let files: ReadFiles = [crate::reads::ReadFile::new("/v.png", crate::reads::FileStamp::Virtual)].into_iter().collect();
+        let (one, two) = (|_: &str| Some((4, 1)), |_: &str| Some((4, 2)));
+        assert!(frame_entry(6, 3, &rgba, &files, None).is_none(), "a file from memory needs its identity");
+        assert!(frame_entry(6, 3, &rgba[1..], &files, Some(&one)).is_none(), "a wrong size");
+        let e = frame_entry(6, 3, &rgba, &files, Some(&one)).unwrap();
+        assert_eq!(read_frame_entry(&e, Some(&one)), Some(Frame8 { width: 6, height: 3, rgba: rgba.clone() }));
+        assert!(read_frame_entry(&e, Some(&two)).is_none(), "the file changed");
+        let mut incomplete = files.clone();
+        incomplete.mark_incomplete();
+        assert!(frame_entry(6, 3, &rgba, &incomplete, Some(&one)).is_none(), "an incomplete list is not stored");
         let mut bad = e.clone();
         bad[20] ^= 1;
-        assert!(read_frame_entry(&bad).is_none());
+        assert!(read_frame_entry(&bad, Some(&one)).is_none());
+        // An entry of the format before #3184 (pixels without files) is never read.
+        assert!(read_frame_entry(&seal_format(Kind::Frame, FORMAT_RGBA8, &encode_frame(6, 3, &rgba)), Some(&one)).is_none());
         let key = 0x0123_4567_89ab_cdef_0011_2233_4455_6677u128;
         assert_eq!(parse_entry_name(&entry_name(key)), Some(key));
         assert_eq!(parse_entry_name("abc.ecc"), None);
         assert_eq!(parse_entry_name(&format!("{key:032x}.tmp.1")), None);
     }
 
+    /// Half-float frames (32 bpc viewer frames) round-trip bit for bit, over-range values,
+    /// negatives and odd sizes included; they and 8-bit frames never read as each other; a
+    /// damaged half-float entry is a miss and is deleted; they count toward the size limit.
+    #[test]
+    fn half_float_frames_round_trip() {
+        let dir = tmpdir("f16");
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        let (w, h) = (7u32, 5u32);
+        // 4.0, 16.0, -0.25, 65504 and a spread of bit patterns.
+        let rgba: Vec<u16> = (0..w * h * 4).map(|i| [0x4400, 0x4c00, 0xb400, 0x7bff][i as usize % 4] ^ ((i * 37) as u16 & 0x03ff)).collect();
+        dc.put_frame_f16_now(1, w, h, &rgba, &ReadFiles::default());
+        assert_eq!(dc.get_frame_f16(1, None).map(|f| f.0), Some(FrameF16 { width: w, height: h, rgba: rgba.clone() }));
+        assert!(dc.get_frame(1, None).map(|f| f.0).is_none(), "not an 8-bit frame");
+        dc.put_frame_now(2, 2, 2, &[9; 16], &ReadFiles::default());
+        assert!(dc.get_frame_f16(2, None).map(|f| f.0).is_none() && dc.contains(Kind::Frame, 2), "an 8-bit entry stays valid");
+        assert_eq!(dc.get_frame(2, None).map(|f| f.0).unwrap().rgba, vec![9; 16]);
+        assert!(dc.stats().bytes > 0);
+        // Reopened, still there (format byte persisted).
+        drop(dc);
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        assert_eq!(dc.get_frame_f16(1, None).map(|f| f.0).unwrap().rgba, rgba);
+        // A sealed entry with a payload of the wrong size: deleted on read.
+        let p = dc.path(Kind::Frame, 3);
+        std::fs::create_dir_all(p.parent().unwrap()).unwrap();
+        std::fs::write(&p, seal_format(Kind::Frame, FORMAT_F16_FILES, &with_files(&EntryFiles::default(), encode_frame_f16(w, h + 1, &rgba[..])))).unwrap();
+        dc.rescan();
+        assert!(dc.contains(Kind::Frame, 3));
+        assert!(dc.get_frame_f16(3, None).map(|f| f.0).is_none());
+        assert!(!dc.contains(Kind::Frame, 3) && !p.exists());
+        // Wrong lengths are not written.
+        dc.put_frame_f16(4, w, h, &rgba[1..], &ReadFiles::default(), None, 0);
+        dc.flush();
+        assert!(!dc.contains(Kind::Frame, 4));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// Segmentations round-trip by (chain key, scale), survive a reopen (rescan), are bounded by
     /// the size limit like every entry, and a damaged file is a miss.
     #[test]
@@ -965,21 +1704,112 @@ mod tests {
     fn hit_miss_and_exact_round_trip() {
         let dir = tmpdir("hit");
         let dc = DiskCache::open(&dir, 1 << 30).unwrap();
-        assert!(dc.get_layer(42).is_none());
+        assert!(dc.get_layer(42, None).is_none());
         let b = buf(1, 33, 17);
-        dc.put_layer(42, &b);
+        dc.put_layer(42, &b, &EntryFiles::default(), 0);
         dc.flush();
-        let back = dc.get_layer(42).unwrap();
+        let (back, files) = dc.get_layer(42, None).unwrap();
+        assert!(files.is_empty() && files.is_complete());
         assert_eq!(back.img, b.img);
         assert_eq!((back.offset, back.scale), (b.offset, b.scale));
         let rgba: Vec<u8> = (0..20 * 10 * 4).map(|i| (i % 251) as u8).collect();
-        dc.put_frame(7, 20, 10, &rgba);
+        assert!(dc.put_frame(7, 20, 10, &rgba, &ReadFiles::default(), None, 0));
+        assert!(!dc.put_frame(8, 2, 2, &[0; 3], &ReadFiles::default(), None, 0), "a wrong-size frame is refused");
         dc.flush();
-        assert_eq!(dc.get_frame(7).unwrap().rgba, rgba);
+        assert_eq!(dc.get_frame(7, None).map(|f| f.0).unwrap().rgba, rgba);
         let st = dc.stats();
         assert_eq!((st.entries, st.hits, st.misses, st.writes), (2, 2, 1, 2));
         // Wrong kind is a miss.
-        assert!(dc.get_frame(42).is_none());
+        assert!(dc.get_frame(42, None).map(|f| f.0).is_none());
+    }
+
+    /// Music doesn't change a comp's disk keys (adding it to the timeline kept no blue frame);
+    /// hiding a clip does. Importing music keeps them too.
+    #[test]
+    fn music_keeps_the_disk_keys() {
+        use effectcraft_project::{Comp, Footage, FootageKind, ItemKind, LayerSource, Project, Solid, build};
+        use effectcraft_time::{FrameRate, Tick};
+        let mut p = Project::default();
+        let comp = Comp::new(64, 64, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+        let cid = p.add_item("Main", Default::default(), None, ItemKind::Comp(comp.clone().into()));
+        let sid = p.add_item("Solid", Default::default(), None, ItemKind::Solid(Solid { color: [1.0, 0.0, 0.0], width: 64, height: 64, pixel_aspect: 1.0 }));
+        let clip = build::layer(&mut p, &comp, "Clip", LayerSource::Solid { item: sid }, (64, 64), None);
+        let clip_id = clip.id;
+        p.comp_mut(cid).unwrap().layers.push(clip);
+        let key = comp_content_key(&p, cid);
+        let song = p.add_item(
+            "song.wav",
+            Default::default(),
+            None,
+            ItemKind::Footage(Footage { kind: FootageKind::Audio, has_video: false, has_audio: true, ..Default::default() }),
+        );
+        assert_eq!(comp_content_key(&p, cid), key, "importing music");
+        let music = build::layer(&mut p, &comp, "Music", LayerSource::Footage { item: song }, (64, 64), None);
+        p.comp_mut(cid).unwrap().layers.insert(0, music);
+        assert_eq!(comp_content_key(&p, cid), key, "music on the timeline");
+        p.comp_mut(cid).unwrap().layer_mut(clip_id).unwrap().switches.video = false;
+        assert_ne!(comp_content_key(&p, cid), key, "a hidden clip");
+    }
+
+    /// An expression that reads a 3D model layer's source (`thisComp.layer("Model").source.name`)
+    /// gives a new key when the model item is renamed: the frames on disk hold the old name.
+    #[test]
+    fn renaming_a_model_an_expression_reads_changes_the_disk_key() {
+        use effectcraft_project::{Comp, Expression, Footage, FootageKind, ItemKind, LayerSource, Project, Solid, build};
+        use effectcraft_time::{FrameRate, Tick};
+        let mut p = Project::default();
+        let comp = Comp::new(64, 64, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+        let cid = p.add_item("Main", Default::default(), None, ItemKind::Comp(comp.clone().into()));
+        let model = p.add_item("chair.glb", Default::default(), None, ItemKind::Footage(Footage { kind: FootageKind::Model, ..Default::default() }));
+        let sid = p.add_item("Solid", Default::default(), None, ItemKind::Solid(Solid { color: [1.0, 0.0, 0.0], width: 64, height: 64, pixel_aspect: 1.0 }));
+        let mut m = build::layer(&mut p, &comp, "Model", LayerSource::Model { item: model }, (64, 64), None);
+        m.switches.video = false;
+        let mut s = build::layer(&mut p, &comp, "Reader", LayerSource::Solid { item: sid }, (64, 64), None);
+        s.props.prop_mut("transform/opacity").unwrap().expr =
+            Some(Expression { text: "thisComp.layer(\"Model\").source.name.length * 10".into(), enabled: true });
+        p.comp_mut(cid).unwrap().layers.extend([s, m]);
+        let key = comp_content_key(&p, cid);
+        p.item_mut(model).unwrap().name = "table.glb".into();
+        assert_ne!(comp_content_key(&p, cid), key, "the expression reads the model's name");
+    }
+
+    /// A burst of layer writes never crowds out frames: every frame of a fully cached comp is
+    /// on disk afterwards (the blue bar came back with gaps).
+    #[test]
+    fn frames_are_kept_when_layer_writes_fill_the_queue() {
+        let dir = tmpdir("burst");
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        for k in 0..300 {
+            dc.put_layer(10_000 + k, &buf(1, 64, 64), &EntryFiles::default(), 0);
+        }
+        let rgba = vec![7u8; 32 * 32 * 4];
+        for k in 0..300 {
+            dc.put_frame(k, 32, 32, &rgba, &ReadFiles::default(), None, 0);
+        }
+        dc.flush();
+        assert!((0..300).all(|k| dc.contains(Kind::Frame, k)), "every frame written");
+    }
+
+    #[test]
+    fn previous_renderer_frames_are_not_reused() {
+        use effectcraft_project::{Comp, ItemKind, Project};
+        use effectcraft_time::{FrameRate, Tick};
+
+        let mut project = Project::default();
+        let comp = Comp::new(2, 2, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+        let id = project.add_item("Cached composition", effectcraft_color::Label::None, None, ItemKind::Comp(comp.into()));
+        let key = frame_key(comp_content_key(&project, id), 0, 1000, 0);
+        let previous_key = frame_key(comp_content_key_for_renderer(&project, id, "effectcraft-render-5"), 0, 1000, 0);
+        let dir = tmpdir("previous-renderer");
+        {
+            let cache = DiskCache::open(&dir, 1 << 30).unwrap();
+            cache.put_frame_now(previous_key, 2, 2, &[9; 16], &ReadFiles::default());
+        }
+        let cache = DiskCache::open(&dir, 1 << 30).unwrap();
+        assert_eq!(cache.get_frame(previous_key, None).map(|f| f.0).unwrap().rgba, vec![9; 16]);
+        assert!(cache.get_frame(key, None).map(|f| f.0).is_none());
+        cache.put_frame_now(key, 2, 2, &[17; 16], &ReadFiles::default());
+        assert_eq!(cache.get_frame(key, None).map(|f| f.0).unwrap().rgba, vec![17; 16]);
     }
 
     #[test]
@@ -987,16 +1817,16 @@ mod tests {
         let dir = tmpdir("persist");
         {
             let dc = DiskCache::open(&dir, 1 << 30).unwrap();
-            dc.put_layer_now(1, &buf(1, 8, 8));
-            dc.put_frame_now(2, 2, 2, &[9; 16]);
+            dc.put_layer_now(1, &buf(1, 8, 8), &ReadFiles::default());
+            dc.put_frame_now(2, 2, 2, &[9; 16], &ReadFiles::default());
         }
         let dc = DiskCache::open(&dir, 1 << 30).unwrap();
         assert_eq!(dc.stats().entries, 2);
         assert!(dc.contains(Kind::Layer, 1) && dc.contains(Kind::Frame, 2));
-        assert_eq!(dc.get_frame(2).unwrap().rgba, vec![9; 16]);
+        assert_eq!(dc.get_frame(2, None).map(|f| f.0).unwrap().rgba, vec![9; 16]);
         dc.clear();
         assert_eq!(dc.stats().entries, 0);
-        assert!(dc.get_frame(2).is_none());
+        assert!(dc.get_frame(2, None).map(|f| f.0).is_none());
         let again = DiskCache::open(&dir, 1 << 30).unwrap();
         assert_eq!(again.stats().entries, 0);
     }
@@ -1006,14 +1836,14 @@ mod tests {
         let dir = tmpdir("lru");
         let dc = DiskCache::open(&dir, u64::MAX).unwrap();
         for k in 0..6u128 {
-            dc.put_layer_now(k, &buf(k as u32, 64, 64));
+            dc.put_layer_now(k, &buf(k as u32, 64, 64), &ReadFiles::default());
         }
         let per = dc.stats().bytes / 6;
         // Touch 0 so it is the most recently used.
-        assert!(dc.get_layer(0).is_some());
-        dc.set_max_bytes(per * 3 + per / 2);
+        assert!(dc.get_layer(0, None).is_some());
+        dc.set_max_bytes(per * 3 + per * 3 / 4);
         let st = dc.stats();
-        assert!(st.bytes <= per * 3 + per / 2, "{st:?}");
+        assert!(st.bytes <= per * 3 + per * 3 / 4, "{st:?}");
         assert_eq!(st.entries, 3);
         assert!(dc.contains(Kind::Layer, 0), "recently used survives");
         assert!(!dc.contains(Kind::Layer, 1) && !dc.contains(Kind::Layer, 2) && !dc.contains(Kind::Layer, 3));
@@ -1022,8 +1852,143 @@ mod tests {
         let files = walk(&dir);
         assert_eq!(files, 3);
         // New writes keep evicting.
-        dc.put_layer_now(99, &buf(9, 64, 64));
-        assert!(dc.stats().bytes <= per * 3 + per / 2);
+        dc.put_layer_now(99, &buf(9, 64, 64), &ReadFiles::default());
+        assert!(dc.stats().bytes <= per * 3 + per * 3 / 4);
+    }
+
+    #[test]
+    fn eviction_goes_down_to_ninety_percent_in_lru_order() {
+        let mut ix = DiskIndex::default();
+        for k in 0..10u128 {
+            ix.insert(Kind::Layer, k, 100);
+        }
+        assert!(ix.touch(Kind::Layer, 0));
+        // Over 950: down to 855, least recently used first.
+        ix.insert(Kind::Layer, 10, 100);
+        assert_eq!(ix.evict(950), vec![(Kind::Layer, 1), (Kind::Layer, 2), (Kind::Layer, 3)]);
+        assert_eq!(ix.total(), 800);
+        // The slack absorbs the next write without another scan.
+        ix.insert(Kind::Layer, 11, 100);
+        assert!(ix.evict(950).is_empty());
+    }
+
+    #[test]
+    fn free_disk_space_caps_the_limit() {
+        let dir = tmpdir("space");
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        for k in 0..4u128 {
+            dc.put_layer_now(k, &buf(k as u32, 64, 64), &ReadFiles::default());
+        }
+        let used = dc.stats().bytes;
+        // Unknown space: the setting alone.
+        dc.set_disk_space(None);
+        assert_eq!(dc.stats().limit_bytes, 1 << 30);
+        // A disk reported as 0 bytes is unknown.
+        dc.set_disk_space(Some((0, 0)));
+        assert_eq!(dc.stats().limit_bytes, 1 << 30);
+        // 100 GB disk, 5 GB reserved (5%, between the 2 GB floor and the 10 GB cap), exactly
+        // 5 GB free: the cache may not grow.
+        dc.set_disk_space(Some((100 << 30, 5 << 30)));
+        let st = dc.stats();
+        assert_eq!((st.max_bytes, st.limit_bytes), (1 << 30, used));
+        dc.put_layer_now(9, &buf(9, 64, 64), &ReadFiles::default());
+        let st = dc.stats();
+        assert!(st.bytes <= st.limit_bytes && st.bytes <= used - used / 10 && st.evictions > 0, "{st:?}");
+        assert!(dc.contains(Kind::Layer, 9), "the new entry is the most recently used");
+        // Below the reserve the cache gives its space back, and skips writes that can't fit.
+        dc.set_disk_space(Some((100 << 30, 4 << 30)));
+        dc.put_layer_now(10, &buf(10, 64, 64), &ReadFiles::default());
+        let st = dc.stats();
+        assert_eq!((st.limit_bytes, st.entries, st.bytes), (0, 0, 0), "{st:?}");
+        // Plenty of space again: back to the setting.
+        dc.set_disk_space(Some((100 << 30, 50 << 30)));
+        assert_eq!(dc.stats().limit_bytes, 1 << 30);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The reserve is 5% of the disk, at least 2 GB and at most 10 GB: a large disk with plenty
+    /// free keeps the user's size. (A 4 TB disk with 190 GB free reserved 200 GB, held a 20 GB
+    /// cache at 0, and every write was refused.)
+    #[test]
+    fn a_large_disk_reserves_at_most_ten_gb() {
+        const GB: u64 = 1 << 30;
+        assert_eq!(disk_reserve(4096 * GB), 10 * GB);
+        assert_eq!(disk_reserve(100 * GB), 5 * GB);
+        assert_eq!(disk_reserve(32 * GB), 2 * GB);
+        assert_eq!(disk_reserve(1), 2 * GB);
+        let dir = tmpdir("space-large");
+        let dc = DiskCache::open(&dir, 20 * GB).unwrap();
+        dc.set_disk_space(Some((4096 * GB, 190 * GB)));
+        let st = dc.stats();
+        assert_eq!((st.max_bytes, st.limit_bytes), (20 * GB, 20 * GB), "{st:?}");
+        assert!(dc.accepts_writes());
+        assert_eq!(dc.reserve_bytes(), Some(10 * GB));
+        // Just above the 10 GB reserve: the cache may use what is left above it.
+        dc.set_disk_space(Some((4096 * GB, 15 * GB)));
+        assert_eq!(dc.stats().limit_bytes, 5 * GB);
+        // A small disk still keeps 2 GB free: 3 GB free leaves 1 GB for the cache.
+        dc.set_disk_space(Some((32 * GB, 3 * GB)));
+        assert_eq!(dc.stats().limit_bytes, GB);
+        // Below the floor: nothing.
+        dc.set_disk_space(Some((32 * GB, GB)));
+        assert_eq!(dc.stats().limit_bytes, 0);
+        assert!(!dc.accepts_writes());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A write the free disk space refuses is refused before its pixels are compressed: the
+    /// frame workers spent about 8 ms per frame and 14 ms per layer encoding entries that were
+    /// then refused (`limit_bytes=0`).
+    #[test]
+    fn no_encode_while_the_disk_has_no_room() {
+        const GB: u64 = 1 << 30;
+        let dir = tmpdir("space-no-encode");
+        let dc = DiskCache::open(&dir, 20 * GB).unwrap();
+        // 4 TB disk, 1 GB free: under the 10 GB reserve, the limit is 0.
+        dc.set_disk_space(Some((4096 * GB, GB)));
+        assert_eq!(dc.stats().limit_bytes, 0);
+        let rgba = vec![7u8; 16 * 16 * 4];
+        assert!(!dc.put_frame(1, 16, 16, &rgba, &ReadFiles::default(), None, 0), "refused");
+        assert!(!dc.put_frame_f16(2, 16, 16, &[0x3c00u16; 16 * 16 * 4], &ReadFiles::default(), None, 0), "refused");
+        dc.put_layer(3, &buf(3, 16, 16), &EntryFiles::default(), 0);
+        dc.flush();
+        assert_eq!(dc.encodes(), 0, "nothing compressed");
+        assert_eq!(dc.stats().entries, 0);
+        // 32 MB of room above the reserve: a few frames would fill it, the rest would be
+        // compressed only to be refused. Not worth encoding either.
+        dc.set_disk_space(Some((4096 * GB, 10 * GB + (32 << 20))));
+        assert_eq!(dc.stats().limit_bytes, 32 << 20);
+        assert!(!dc.accepts_writes());
+        assert!(!dc.put_frame(1, 16, 16, &rgba, &ReadFiles::default(), None, 0), "refused");
+        dc.put_layer(3, &buf(3, 16, 16), &EntryFiles::default(), 0);
+        assert_eq!(dc.encodes(), 0, "nothing compressed");
+        // A small limit the setting asks for (not free space) is used.
+        dc.set_disk_space(None);
+        dc.set_max_bytes(32 << 20);
+        assert!(dc.accepts_writes());
+        dc.set_max_bytes(20 * GB);
+        // Room again: the same writes are compressed and stored.
+        dc.set_disk_space(Some((4096 * GB, 500 * GB)));
+        assert!(dc.put_frame(1, 16, 16, &rgba, &ReadFiles::default(), None, 0));
+        assert!(dc.put_frame_f16(2, 16, 16, &[0x3c00u16; 16 * 16 * 4], &ReadFiles::default(), None, 0));
+        dc.put_layer(3, &buf(3, 16, 16), &EntryFiles::default(), 0);
+        dc.flush();
+        assert_eq!(dc.encodes(), 3);
+        assert_eq!(dc.stats().entries, 3);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn failed_writes_are_counted() {
+        let dir = tmpdir("failed");
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        // A file where the layers folder should be: every layer write fails.
+        std::fs::write(dir.join(VERSION).join(Kind::Layer.dir()), b"x").unwrap();
+        dc.put_layer_now(1, &buf(1, 8, 8), &ReadFiles::default());
+        dc.put_layer_now(2, &buf(2, 8, 8), &ReadFiles::default());
+        let st = dc.stats();
+        assert_eq!((st.failed, st.writes, st.entries), (2, 0, 0));
+        let _ = std::fs::remove_dir_all(&dir);
     }
 
     fn walk(d: &Path) -> usize {
@@ -1045,13 +2010,13 @@ mod tests {
     fn damaged_files_are_misses() {
         let dir = tmpdir("damaged");
         let dc = DiskCache::open(&dir, 1 << 30).unwrap();
-        dc.put_frame_now(5, 4, 4, &[1; 64]);
+        dc.put_frame_now(5, 4, 4, &[1; 64], &ReadFiles::default());
         let p = dc.path(Kind::Frame, 5);
         let mut d = std::fs::read(&p).unwrap();
         let n = d.len();
         d[n / 2] ^= 0xff;
         std::fs::write(&p, d).unwrap();
-        assert!(dc.get_frame(5).is_none());
+        assert!(dc.get_frame(5, None).map(|f| f.0).is_none());
         assert!(!dc.contains(Kind::Frame, 5));
         assert!(!p.exists());
     }
@@ -1069,8 +2034,8 @@ mod tests {
                     for i in 0..20u128 {
                         let k = i % 5;
                         let w = if t % 2 == 0 { &a } else { &b };
-                        w.put_layer_now(k, &buf(k as u32, 16, 16));
-                        if let Some(x) = w.get_layer(k) {
+                        w.put_layer_now(k, &buf(k as u32, 16, 16), &ReadFiles::default());
+                        if let Some((x, _)) = w.get_layer(k, None) {
                             assert_eq!(x.img, buf(k as u32, 16, 16).img);
                         }
                     }
@@ -1079,7 +2044,358 @@ mod tests {
         });
         b.rescan();
         for k in 0..5u128 {
-            assert_eq!(b.get_layer(k).unwrap().img, buf(k as u32, 16, 16).img);
+            assert_eq!(b.get_layer(k, None).unwrap().0.img, buf(k as u32, 16, 16).img);
         }
     }
+
+    /// Replaced bytes of a path with no native metadata (the browser file table) change neither
+    /// the comp key nor a layer's disk key (both from memory): the frame and layer entries made
+    /// of them check the hook's size and content hash when read and are misses, deleted (#1253,
+    /// #3184).
+    #[test]
+    fn virtual_file_bytes_are_checked_by_the_entries_not_the_keys() {
+        use effectcraft_project::build;
+        use effectcraft_project::{Comp, Footage, ItemKind, LayerSource, Project};
+        use effectcraft_time::{FrameRate, Tick};
+
+        let mut p = Project::default();
+        let f = Footage { path: "/virtual.mov".into(), width: 16, height: 9, duration: Tick::from_seconds_f64(1.0), has_video: true, ..Default::default() };
+        let fid = p.add_item("virtual.mov", effectcraft_color::Label::None, None, ItemKind::Footage(f));
+        let mut comp = Comp::new(16, 9, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+        comp.layers = vec![build::layer(&mut p, &comp, "clip", LayerSource::Footage { item: fid }, (16, 9), None)].into();
+        let cid = p.add_item("C", effectcraft_color::Label::None, None, ItemKind::Comp(comp.into()));
+
+        let id = |mark: u64| move |path: &str| (path == "/virtual.mov").then_some((8, mark));
+        let (one, two) = (id(1), id(2));
+        let dc = DiskCache::open(tmpdir("virtual"), 1 << 30).unwrap();
+        let k = frame_key(comp_content_key(&p, cid), 0, 1000, 0);
+        let files: ReadFiles = [crate::reads::ReadFile::new("/virtual.mov", crate::reads::FileStamp::Virtual)].into_iter().collect();
+        assert!(dc.put_frame(k, 1, 1, &[1, 2, 3, 4], &files, Some(&one), 0));
+        dc.flush();
+        assert!(dc.get_frame(k, Some(&one)).is_some_and(|(_, f)| f == files));
+        assert!(dc.get_frame(k, Some(&two)).is_none() && !dc.contains(Kind::Frame, k), "replaced: a miss, deleted");
+        // A layer buffer made of it.
+        let lk = layer_disk_key(7);
+        dc.put_layer(lk, &buf(1, 4, 4), &EntryFiles::of(&files, Some(&one)).unwrap(), 0);
+        dc.flush();
+        assert!(dc.get_layer(lk, Some(&one)).is_some_and(|(b, f)| b.img == buf(1, 4, 4).img && f == files && f.is_complete()));
+        assert!(dc.get_layer(lk, None).is_none() && !dc.contains(Kind::Layer, lk), "no identity: a miss, deleted");
+        dc.put_layer(lk, &buf(1, 4, 4), &EntryFiles::of(&files, Some(&one)).unwrap(), 0);
+        dc.flush();
+        assert!(dc.get_layer(lk, Some(&two)).is_none() && !dc.contains(Kind::Layer, lk), "replaced: a miss, deleted");
+        // The browser's sealed layer entries carry the same list.
+        let e = layer_entry(&buf(2, 3, 2), &EntryFiles::of(&files, Some(&one)).unwrap());
+        let (b, list) = read_layer_entry(&e).unwrap();
+        assert!(b.img == buf(2, 3, 2).img && list.unchanged(Some(&one)) && !list.unchanged(Some(&two)));
+        assert!(read_layer_entry(&seal_format(Kind::Layer, FORMAT_RGBA8, &encode_layer(&buf(2, 3, 2)))).is_none(), "the format before #3184");
+        let mut bad = e.clone();
+        bad[12] ^= 1;
+        assert!(read_layer_entry(&bad).is_none(), "damaged");
+    }
+
+    /// Layer disk keys come from the layer cache's key alone (no file, no project-wide salt) and
+    /// differ per key.
+    #[test]
+    fn layer_disk_keys_need_no_files() {
+        assert_eq!(layer_disk_key(1), layer_disk_key(1));
+        assert_ne!(layer_disk_key(1), layer_disk_key(2));
+        // Not the layout of the salted keys before #3184 (`salt << 64 | key`).
+        assert_ne!(layer_disk_key(1) as u64, 1);
+    }
+
+    /// A layer entry is used only while the files it lists are what the buffer was made of: a
+    /// new size, a new time, a missing file that is back, a file replaced by a folder, a damaged
+    /// files section and the format before #3184 are misses, and the entry is deleted so the
+    /// buffer is rendered and stored again. A buffer whose files can't all be named is not
+    /// stored. Only the listed files are looked at.
+    #[test]
+    fn layer_entries_check_their_files() {
+        use crate::reads::{FileStamp, ReadFile};
+        let dir = tmpdir("layer-check");
+        let src = dir.join("src");
+        std::fs::create_dir_all(&src).unwrap();
+        let file = |name: &str, bytes: &[u8]| {
+            let p = src.join(name);
+            std::fs::write(&p, bytes).unwrap();
+            p.to_string_lossy().to_string()
+        };
+        let (a, b) = (file("a.png", b"aa"), file("b.png", b"bb"));
+        let gone = src.join("gone.png").to_string_lossy().to_string();
+        let read = |paths: &[&str]| -> ReadFiles { paths.iter().map(|p| ReadFile::new(*p, FileStamp::native(p).unwrap_or(FileStamp::Missing))).collect() };
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        dc.put_layer_now(1, &buf(1, 4, 4), &read(&[&a]));
+        dc.put_layer_now(2, &buf(2, 4, 4), &read(&[&b, &gone]));
+        dc.put_layer_now(3, &buf(3, 4, 4), &read(&[&b]));
+        let (one, files) = dc.get_layer(1, None).unwrap();
+        assert!(one.img == buf(1, 4, 4).img && files == read(&[&a]) && files.is_complete());
+        assert_eq!(dc.file_checks(), 1, "only the file of that buffer");
+        // a.png gets a new size: entry 1 is a miss and deleted, the others stay.
+        std::fs::write(&a, b"aaa").unwrap();
+        assert!(dc.get_layer(1, None).is_none() && !dc.contains(Kind::Layer, 1));
+        assert!(dc.get_layer(2, None).is_some() && dc.get_layer(3, None).is_some());
+        // b.png gets a new time only.
+        let t = std::fs::metadata(&b).unwrap().modified().unwrap() + std::time::Duration::from_secs(7);
+        std::fs::File::options().append(true).open(&b).unwrap().set_modified(t).unwrap();
+        assert!(dc.get_layer(3, None).is_none() && !dc.contains(Kind::Layer, 3));
+        assert!(dc.get_layer(2, None).is_none(), "b.png is listed there too");
+        // A missing file that is back.
+        dc.put_layer_now(4, &buf(4, 4, 4), &read(&[&gone]));
+        assert!(dc.get_layer(4, None).is_some(), "missing, still missing");
+        file("gone.png", b"g");
+        assert!(dc.get_layer(4, None).is_none() && !dc.contains(Kind::Layer, 4), "back");
+        // A file replaced by a folder (unreadable).
+        let c = file("c.png", b"cc");
+        dc.put_layer_now(5, &buf(5, 4, 4), &read(&[&c]));
+        std::fs::remove_file(&c).unwrap();
+        std::fs::create_dir(&c).unwrap();
+        assert!(dc.get_layer(5, None).is_none() && !dc.contains(Kind::Layer, 5));
+        // Written again after the miss: a hit with the new identity.
+        dc.put_layer_now(1, &buf(9, 4, 4), &read(&[&a]));
+        assert_eq!(dc.get_layer(1, None).map(|l| l.0.img), Some(buf(9, 4, 4).img));
+        // The format before #3184 (no files): a miss, deleted.
+        dc.write_format(Kind::Layer, 6, FORMAT_RGBA8, &encode_layer(&buf(6, 4, 4)));
+        assert!(dc.contains(Kind::Layer, 6));
+        assert!(dc.get_layer(6, None).is_none() && !dc.contains(Kind::Layer, 6));
+        // A valid checksum over a damaged files section, or over a cut buffer: misses, deleted.
+        let mut payload = vec![];
+        payload.extend_from_slice(&3u32.to_le_bytes());
+        payload.extend_from_slice(&encode_layer(&buf(7, 4, 4)));
+        dc.write_format(Kind::Layer, 7, FORMAT_LAYER_FILES, &payload);
+        assert!(dc.get_layer(7, None).is_none() && !dc.contains(Kind::Layer, 7));
+        let mut cut = vec![];
+        EntryFiles::default().encode(&mut cut);
+        cut.extend_from_slice(&encode_layer(&buf(8, 4, 4))[..40]);
+        dc.write_format(Kind::Layer, 8, FORMAT_LAYER_FILES, &cut);
+        assert!(dc.get_layer(8, None).is_none() && !dc.contains(Kind::Layer, 8));
+        // A damaged file on disk.
+        dc.put_layer_now(9, &buf(9, 4, 4), &ReadFiles::default());
+        let p = dc.path(Kind::Layer, 9);
+        let mut d = std::fs::read(&p).unwrap();
+        let n = d.len();
+        d[n / 2] ^= 0xff;
+        std::fs::write(&p, d).unwrap();
+        assert!(dc.get_layer(9, None).is_none() && !dc.contains(Kind::Layer, 9) && !p.exists());
+        // Buffers whose files can't all be named are not stored.
+        let mut incomplete = read(&[&a]);
+        incomplete.mark_incomplete();
+        dc.put_layer_now(10, &buf(10, 4, 4), &incomplete);
+        assert!(!dc.contains(Kind::Layer, 10));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A frame entry is used only while the files it lists are what it was made of: a new size,
+    /// a new time, a missing file that is back, a file replaced by a folder are misses, and the
+    /// entry is deleted so the frame is rendered and stored again. Only the listed files are
+    /// looked at. Entries of the format before #3184 are misses and deleted.
+    #[test]
+    fn frame_entries_check_their_files() {
+        use crate::reads::{FileStamp, ReadFile};
+        let dir = tmpdir("check");
+        let src = dir.join("src");
+        std::fs::create_dir_all(&src).unwrap();
+        let file = |name: &str, bytes: &[u8]| {
+            let p = src.join(name);
+            std::fs::write(&p, bytes).unwrap();
+            p.to_string_lossy().to_string()
+        };
+        let (a, b) = (file("a.png", b"aa"), file("b.png", b"bb"));
+        let gone = src.join("gone.png").to_string_lossy().to_string();
+        let read = |paths: &[&str]| -> ReadFiles { paths.iter().map(|p| ReadFile::new(*p, FileStamp::native(p).unwrap_or(FileStamp::Missing))).collect() };
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        dc.put_frame_now(1, 1, 1, &[1; 4], &read(&[&a]));
+        dc.put_frame_now(2, 1, 1, &[2; 4], &read(&[&b, &gone]));
+        dc.put_frame_now(3, 1, 1, &[3; 4], &read(&[&b]));
+        assert_eq!(dc.get_frame(1, None).map(|f| f.1), Some(read(&[&a])));
+        assert_eq!(dc.file_checks(), 1, "only the file of that frame");
+        // a.png gets a new size: frame 1 is a miss and deleted, the others stay.
+        std::fs::write(&a, b"aaa").unwrap();
+        assert!(dc.get_frame(1, None).is_none() && !dc.contains(Kind::Frame, 1));
+        assert!(dc.get_frame(2, None).is_some() && dc.get_frame(3, None).is_some());
+        // b.png gets a new time only.
+        let t = std::fs::metadata(&b).unwrap().modified().unwrap() + std::time::Duration::from_secs(7);
+        std::fs::File::options().append(true).open(&b).unwrap().set_modified(t).unwrap();
+        assert!(dc.get_frame(3, None).is_none() && !dc.contains(Kind::Frame, 3));
+        assert!(dc.get_frame(2, None).is_none(), "b.png is listed there too");
+        // A missing file that is back.
+        dc.put_frame_now(4, 1, 1, &[4; 4], &read(&[&gone]));
+        assert!(dc.get_frame(4, None).is_some(), "missing, still missing");
+        file("gone.png", b"g");
+        assert!(dc.get_frame(4, None).is_none() && !dc.contains(Kind::Frame, 4), "back");
+        // A file replaced by a folder (unreadable).
+        let c = file("c.png", b"cc");
+        dc.put_frame_now(5, 1, 1, &[5; 4], &read(&[&c]));
+        std::fs::remove_file(&c).unwrap();
+        std::fs::create_dir(&c).unwrap();
+        assert!(dc.get_frame(5, None).is_none() && !dc.contains(Kind::Frame, 5));
+        // Written again after the miss: a hit with the new identity.
+        let fresh = file("d.png", b"dd");
+        dc.put_frame_now(1, 1, 1, &[9; 4], &read(&[&fresh]));
+        assert_eq!(dc.get_frame(1, None).map(|f| f.0.rgba), Some(vec![9; 4]));
+        // The format before #3184 (no files): a miss, deleted.
+        dc.write_format(Kind::Frame, 6, FORMAT_RGBA8, &encode_frame(1, 1, &[6; 4]));
+        assert!(dc.contains(Kind::Frame, 6));
+        assert!(dc.get_frame(6, None).is_none() && !dc.contains(Kind::Frame, 6));
+        // A valid checksum over a damaged files section: a miss, deleted.
+        let mut payload = vec![];
+        payload.extend_from_slice(&3u32.to_le_bytes());
+        payload.extend_from_slice(&encode_frame(1, 1, &[7; 4]));
+        dc.write_format(Kind::Frame, 7, FORMAT_RGBA8_FILES, &payload);
+        assert!(dc.get_frame(7, None).is_none() && !dc.contains(Kind::Frame, 7));
+        // Frames whose files can't all be named are not stored.
+        let mut incomplete = read(&[&fresh]);
+        incomplete.mark_incomplete();
+        assert!(!dc.put_frame(8, 1, 1, &[8; 4], &incomplete, None, 0));
+        dc.flush();
+        assert!(!dc.contains(Kind::Frame, 8));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Reload Footage drops the entries made of the reloaded files (#3184): a file replaced by
+    /// one with the same size and modification time passes the check on hit, so only the drop
+    /// makes the next use a miss. Entries of other files stay; an entry written after the drop
+    /// is used; a layer entry and one written while the drop waits in the queue are dropped too;
+    /// the drop survives a restart (the files are gone).
+    #[test]
+    fn dropped_files_take_their_entries_with_them() {
+        use crate::reads::{FileStamp, ReadFile};
+        let dir = tmpdir("drop");
+        let src = dir.join("src");
+        std::fs::create_dir_all(&src).unwrap();
+        let file = |name: &str, bytes: &[u8]| {
+            let p = src.join(name);
+            std::fs::write(&p, bytes).unwrap();
+            p.to_string_lossy().to_string()
+        };
+        let (a, b) = (file("a.png", b"aa"), file("b.png", b"bb"));
+        let read = |paths: &[&str]| -> ReadFiles { paths.iter().map(|p| ReadFile::new(*p, FileStamp::native(p).unwrap())).collect() };
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        dc.put_frame_now(1, 1, 1, &[1; 4], &read(&[&a]));
+        dc.put_frame_now(2, 1, 1, &[2; 4], &read(&[&b]));
+        dc.put_frame_now(3, 1, 1, &[3; 4], &read(&[&a, &b]));
+        dc.put_layer_now(4, &buf(4, 2, 2), &read(&[&a]));
+        // a.png gets other bytes of the same size and its old time back: the check can't tell.
+        let t = std::fs::metadata(&a).unwrap().modified().unwrap();
+        std::fs::write(&a, b"AA").unwrap();
+        std::fs::File::options().append(true).open(&a).unwrap().set_modified(t).unwrap();
+        assert!(dc.get_frame(1, None).is_some(), "same size and time: still a hit");
+        // A frame queued (not written yet) when the drop comes is dropped too.
+        assert!(dc.put_frame(5, 1, 1, &[5; 4], &read(&[&a]), None, 0));
+        dc.drop_files([a.clone()]);
+        dc.flush();
+        assert!(!dc.is_dropping());
+        for (kind, key) in [(Kind::Frame, 1), (Kind::Frame, 3), (Kind::Layer, 4), (Kind::Frame, 5)] {
+            assert!(!dc.contains(kind, key), "{kind:?} {key} made of a.png is gone");
+        }
+        assert!(dc.get_frame(1, None).is_none() && dc.get_layer(4, None).is_none());
+        assert_eq!(dc.get_frame(2, None).map(|f| f.0.rgba), Some(vec![2; 4]), "b.png's frame stays");
+        // Written again from the reloaded file: used.
+        dc.put_frame_now(1, 1, 1, &[9; 4], &read(&[&a]));
+        assert_eq!(dc.get_frame(1, None).map(|f| f.0.rgba), Some(vec![9; 4]));
+        // The drop is for good: a new session on the folder finds what is left.
+        drop(dc);
+        let dc = DiskCache::open(&dir, 1 << 30).unwrap();
+        assert_eq!(dc.keys(Kind::Frame).into_iter().collect::<std::collections::BTreeSet<_>>(), [1, 2].into());
+        assert!(dc.keys(Kind::Layer).is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A render under way when Reload Footage drops its files offers its entries after the drop
+    /// (#3184), when the writer has already deleted the old ones: made of the files as they were,
+    /// they are refused, frames and layer buffers alike. What the same render made of other files
+    /// is stored, and so is what a render that started after the drop makes.
+    #[test]
+    fn entries_made_before_a_drop_are_refused_after_it() {
+        use crate::reads::{FileStamp, ReadFile};
+        let dir = tmpdir("drop-in-flight");
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = |name: &str| {
+            let p = dir.join(name);
+            std::fs::write(&p, name.as_bytes()).unwrap();
+            p.to_string_lossy().to_string()
+        };
+        let (a, b) = (file("a.png"), file("b.png"));
+        let read = |paths: &[&str]| -> ReadFiles { paths.iter().map(|p| ReadFile::new(*p, FileStamp::native(p).unwrap())).collect() };
+        let dc = DiskCache::open(dir.join("cache"), 1 << 30).unwrap();
+        // The render starts (and reads a.png and b.png), then a.png is reloaded.
+        let before = dc.drop_generation();
+        dc.drop_files([a.clone()]);
+        dc.flush();
+        assert!(!dc.is_dropping());
+        assert!(dc.dropped_since(&read(&[&a]), before) && !dc.dropped_since(&read(&[&b]), before));
+        assert!(!dc.put_frame(1, 1, 1, &[1; 4], &read(&[&a, &b]), None, before), "a frame from before the drop");
+        assert!(!dc.put_frame_f16(2, 1, 1, &[1; 4], &read(&[&a]), None, before));
+        dc.put_layer(3, &buf(3, 2, 2), &EntryFiles::of(&read(&[&a]), None).unwrap(), before);
+        assert!(dc.put_frame(4, 1, 1, &[4; 4], &read(&[&b]), None, before), "b.png wasn't dropped");
+        dc.flush();
+        assert!(!dc.contains(Kind::Frame, 1) && !dc.contains(Kind::Frame, 2) && !dc.contains(Kind::Layer, 3));
+        assert!(dc.get_frame(1, None).is_none() && dc.get_layer(3, None).is_none());
+        assert_eq!(dc.get_frame(4, None).map(|f| f.0.rgba), Some(vec![4; 4]));
+        // A render that starts after the drop reads the reloaded file: stored and served.
+        let after = dc.drop_generation();
+        assert!(after > before && !dc.dropped_since(&read(&[&a]), after));
+        assert!(dc.put_frame(5, 1, 1, &[5; 4], &read(&[&a]), None, after));
+        dc.put_layer(6, &buf(6, 2, 2), &EntryFiles::of(&read(&[&a]), None).unwrap(), after);
+        dc.flush();
+        assert_eq!(dc.get_frame(5, None).map(|f| f.0.rgba), Some(vec![5; 4]));
+        assert!(dc.get_layer(6, None).is_some());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The record of dropped files is bounded: past it, everything made before the drop that
+    /// forgot the record is refused, and what is made after it is stored.
+    #[test]
+    fn the_record_of_dropped_files_is_bounded() {
+        let mut d = Drops::default();
+        let a: Arc<str> = "/a.png".into();
+        d.record(std::slice::from_ref(&a));
+        assert!(d.stale([&a].into_iter(), 0) && !d.stale([&a].into_iter(), 1));
+        let many: Vec<Arc<str>> = (0..=MAX_DROPPED_PATHS).map(|i| format!("/f{i}").into()).collect();
+        d.record(&many);
+        assert!(d.last.is_empty(), "forgotten, not grown");
+        let other: Arc<str> = "/other.png".into();
+        assert!(d.stale([&other].into_iter(), 1), "made before the drop that forgot the record");
+        assert!(!d.stale([&a].into_iter(), 2), "made after it");
+    }
+
+    /// While a drop waits, an entry made of a dropped file is a miss (and deleted), and frames
+    /// aren't linked to new keys.
+    #[test]
+    fn entries_of_a_pending_drop_are_misses() {
+        use crate::reads::{FileStamp, ReadFile};
+        let dir = tmpdir("drop-pending");
+        std::fs::create_dir_all(&dir).unwrap();
+        let a = dir.join("a.png");
+        std::fs::write(&a, b"aa").unwrap();
+        let a = a.to_string_lossy().to_string();
+        let files: ReadFiles = [ReadFile::new(a.as_str(), FileStamp::native(&a).unwrap())].into_iter().collect();
+        let dc = DiskCache::open(dir.join("cache"), 1 << 30).unwrap();
+        dc.put_frame_now(1, 1, 1, &[1; 4], &files);
+        dc.dropping.lock().unwrap().insert(a.as_str().into(), 1);
+        assert!(!dc.link_frame(1, 2));
+        assert!(dc.get_frame(1, None).is_none() && !dc.contains(Kind::Frame, 1));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// An entry read while its file's drop was pending is a miss even when the writer ends the
+    /// sweep between the read and the check (it deleted the file, but its bytes were read), and
+    /// so is one read before a drop that starts meanwhile. Found under load: a stale hit.
+    #[test]
+    fn a_sweep_ending_during_a_read_never_makes_a_hit() {
+        use crate::reads::{FileStamp, ReadFile};
+        let dir = tmpdir("drop-race");
+        let dc = DiskCache::open(dir.join("cache"), 1 << 30).unwrap();
+        let files = EntryFiles::of(&[ReadFile::new("/a.png", FileStamp::Missing)].into_iter().collect(), None).unwrap();
+        // Read while the drop is pending; the sweep ends before the check.
+        dc.dropping.lock().unwrap().insert("/a.png".into(), 1);
+        let drops = dc.drops_now();
+        dc.dropping.lock().unwrap().clear();
+        assert!(dc.made_of_dropped(&files, &drops));
+        // Read before a drop that starts (and ends) before the check.
+        let drops = dc.drops_now();
+        dc.drop_files(["/a.png"]);
+        dc.flush();
+        assert!(dc.made_of_dropped(&files, &drops));
+        assert!(!dc.made_of_dropped(&files, &dc.drops_now()), "read after the drop: used");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/render/src/disk_cache/entry_files.rs b/crates/render/src/disk_cache/entry_files.rs
new file mode 100644
index 000000000..a36ca1033
--- /dev/null
+++ b/crates/render/src/disk_cache/entry_files.rs
@@ -0,0 +1,276 @@
+//! The source files a frame entry on disk was made of (#3184): stored with the pixels, checked
+//! when the entry is used. Only the files that frame read are looked at, never every file of the
+//! project.
+//!
+//! Layout (little endian), before the frame's pixel payload:
+//! `u32 count`, then per file `u32 path length`, the path (UTF-8), a tag byte and its fields:
+//! `0` a file on disk (`u64 size`, `u8 has time`, `i128 time`: nanoseconds since the Unix epoch,
+//! negative before it), `1` bytes from the browser's file table (`u64 size`, `u64 content
+//! hash`), `2` a file that could not be read.
+
+use std::sync::Arc;
+
+use super::VirtualFileId;
+use crate::reads::{FileStamp, MAX_READ_FILES, ReadFile, ReadFiles};
+
+/// Longest path an entry stores (bytes): a longer one is not a path this app opened.
+const MAX_PATH_BYTES: usize = 1 << 16;
+
+/// A file's identity as a frame entry keeps it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum EntryStamp {
+    /// Size and modification time (nanoseconds since the Unix epoch, negative before it) on
+    /// disk.
+    Native { len: u64, modified: Option<i128> },
+    /// Size and content hash from the [`VirtualFileId`] hook (the browser's file table).
+    Virtual { len: u64, hash: u64 },
+    /// It could not be read when the frame was made: it still must not be readable.
+    Missing,
+}
+
+/// One file of a frame entry.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct EntryFile {
+    pub path: Arc<str>,
+    pub stamp: EntryStamp,
+}
+
+/// Every file a frame entry was made of.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct EntryFiles(Vec<EntryFile>);
+
+impl EntryFiles {
+    /// The list to store for a frame that read `files`: `None` when the frame can't be checked
+    /// against its files later (the list is incomplete, or a file from memory has no identity),
+    /// so the frame must not be stored. Native stamps are the ones the files were read with,
+    /// never a fresh look at the disk (a file changed during the render keeps the old one).
+    pub fn of(files: &ReadFiles, virtual_id: Option<VirtualFileId<'_>>) -> Option<EntryFiles> {
+        if !files.is_complete() {
+            return None;
+        }
+        let mut out = Vec::with_capacity(files.len());
+        for f in files.files() {
+            let stamp = match f.stamp {
+                FileStamp::Native { len, modified } => EntryStamp::Native { len, modified },
+                FileStamp::Virtual => {
+                    let (len, hash) = virtual_id.and_then(|id| id(&f.path))?;
+                    EntryStamp::Virtual { len, hash }
+                }
+                FileStamp::Missing => EntryStamp::Missing,
+            };
+            out.push(EntryFile { path: f.path.clone(), stamp });
+        }
+        Some(EntryFiles(out))
+    }
+
+    /// The listed files.
+    pub fn files(&self) -> &[EntryFile] {
+        &self.0
+    }
+
+    /// The number of listed files.
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    /// Whether no files are listed.
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    /// The files as a render reports them (to keep with the frame in memory).
+    pub fn to_read_files(&self) -> ReadFiles {
+        self.0
+            .iter()
+            .map(|f| {
+                let stamp = match f.stamp {
+                    EntryStamp::Native { len, modified } => FileStamp::Native { len, modified },
+                    EntryStamp::Virtual { .. } => FileStamp::Virtual,
+                    EntryStamp::Missing => FileStamp::Missing,
+                };
+                ReadFile::new(f.path.clone(), stamp)
+            })
+            .collect()
+    }
+
+    /// Whether every file still is what the frame was made of: one `metadata` call per file
+    /// (and the hook for files from memory).
+    pub fn unchanged(&self, virtual_id: Option<VirtualFileId<'_>>) -> bool {
+        self.0.iter().all(|f| file_unchanged(f, virtual_id))
+    }
+
+    /// Appends the list to `out` in little-endian binary form.
+    pub(super) fn encode(&self, out: &mut Vec<u8>) {
+        out.extend_from_slice(&(self.0.len() as u32).to_le_bytes());
+        for f in &self.0 {
+            out.extend_from_slice(&(f.path.len() as u32).to_le_bytes());
+            out.extend_from_slice(f.path.as_bytes());
+            match f.stamp {
+                EntryStamp::Native { len, modified } => {
+                    out.push(0);
+                    out.extend_from_slice(&len.to_le_bytes());
+                    out.push(u8::from(modified.is_some()));
+                    out.extend_from_slice(&modified.unwrap_or(0).to_le_bytes());
+                }
+                EntryStamp::Virtual { len, hash } => {
+                    out.push(1);
+                    out.extend_from_slice(&len.to_le_bytes());
+                    out.extend_from_slice(&hash.to_le_bytes());
+                }
+                EntryStamp::Missing => out.push(2),
+            }
+        }
+    }
+
+    /// The list at the start of `p` and what follows it; `None` when it is damaged.
+    pub(super) fn decode(p: &[u8]) -> Option<(EntryFiles, &[u8])> {
+        let mut r = Reader(p);
+        let n = r.u32()? as usize;
+        if n > MAX_READ_FILES {
+            return None;
+        }
+        let mut out = Vec::with_capacity(n);
+        for _ in 0..n {
+            let len = r.u32()? as usize;
+            if len > MAX_PATH_BYTES {
+                return None;
+            }
+            let path: Arc<str> = std::str::from_utf8(r.take(len)?).ok()?.into();
+            let stamp = match r.u8()? {
+                0 => {
+                    let len = r.u64()?;
+                    let has = r.u8()?;
+                    let t = r.i128()?;
+                    match has {
+                        0 => EntryStamp::Native { len, modified: None },
+                        1 => EntryStamp::Native { len, modified: Some(t) },
+                        _ => return None,
+                    }
+                }
+                1 => EntryStamp::Virtual { len: r.u64()?, hash: r.u64()? },
+                2 => EntryStamp::Missing,
+                _ => return None,
+            };
+            out.push(EntryFile { path, stamp });
+        }
+        Some((EntryFiles(out), r.0))
+    }
+}
+
+/// Whether the file still matches its stored stamp, by its native stamp or by its in-memory identity.
+fn file_unchanged(f: &EntryFile, virtual_id: Option<VirtualFileId<'_>>) -> bool {
+    let from_memory = || virtual_id.and_then(|id| id(&f.path));
+    match f.stamp {
+        EntryStamp::Native { len, modified } => FileStamp::native(&f.path) == Some(FileStamp::Native { len, modified }),
+        EntryStamp::Virtual { len, hash } => from_memory() == Some((len, hash)),
+        // (a folder at the path is still not a file to read)
+        EntryStamp::Missing => !std::fs::metadata(&*f.path).is_ok_and(|m| m.is_file()) && from_memory().is_none(),
+    }
+}
+
+/// Reads little-endian fields off the front of a byte slice.
+struct Reader<'a>(&'a [u8]);
+
+impl<'a> Reader<'a> {
+    /// Takes the next `n` bytes, or `None` when fewer remain.
+    fn take(&mut self, n: usize) -> Option<&'a [u8]> {
+        let head = self.0.get(..n)?;
+        self.0 = self.0.get(n..)?;
+        Some(head)
+    }
+    /// Reads one byte.
+    fn u8(&mut self) -> Option<u8> {
+        self.take(1)?.first().copied()
+    }
+    /// Reads a little-endian `u32`.
+    fn u32(&mut self) -> Option<u32> {
+        Some(u32::from_le_bytes(self.take(4)?.try_into().ok()?))
+    }
+    /// Reads a little-endian `u64`.
+    fn u64(&mut self) -> Option<u64> {
+        Some(u64::from_le_bytes(self.take(8)?.try_into().ok()?))
+    }
+    /// Reads a little-endian `i128`.
+    fn i128(&mut self) -> Option<i128> {
+        Some(i128::from_le_bytes(self.take(16)?.try_into().ok()?))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A sample list of native, missing and virtual files for the tests.
+    fn files() -> ReadFiles {
+        [
+            ReadFile::new("/a.png", FileStamp::Native { len: 3, modified: Some(9) }),
+            ReadFile::new("/b.png", FileStamp::Native { len: 4, modified: None }),
+            // Before 1970, and past where `u64` nanoseconds end (2554).
+            ReadFile::new("/d.png", FileStamp::Native { len: 5, modified: Some(-86_400_000_000_000) }),
+            ReadFile::new("/e.png", FileStamp::Native { len: 6, modified: Some(i128::from(u64::MAX) + 1) }),
+            ReadFile::new("/c.png", FileStamp::Missing),
+            ReadFile::new("/v.mov", FileStamp::Virtual),
+        ]
+        .into_iter()
+        .collect()
+    }
+
+    #[test]
+    fn lists_round_trip_and_damage_is_caught() {
+        let id = |p: &str| (p == "/v.mov").then_some((8, 77));
+        let list = EntryFiles::of(&files(), Some(&id)).unwrap();
+        assert_eq!(list.files()[5].stamp, EntryStamp::Virtual { len: 8, hash: 77 });
+        let mut bytes = vec![];
+        list.encode(&mut bytes);
+        bytes.extend_from_slice(b"rest");
+        let (back, rest) = EntryFiles::decode(&bytes).unwrap();
+        assert_eq!((back, rest), (list.clone(), &b"rest"[..]));
+        assert_eq!(list.to_read_files(), files());
+        // Every truncation is caught (never a panic, never a shorter list).
+        let mut plain = vec![];
+        list.encode(&mut plain);
+        for n in 0..plain.len() {
+            assert!(EntryFiles::decode(&plain[..n]).is_none(), "cut at {n}");
+        }
+        // Bad tags and counts.
+        let mut bad = plain.clone();
+        bad[0..4].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(EntryFiles::decode(&bad).is_none());
+    }
+
+    #[test]
+    fn frames_that_cant_be_checked_are_not_stored() {
+        let mut incomplete = files();
+        incomplete.mark_incomplete();
+        let id = |_: &str| Some((1, 1));
+        assert!(EntryFiles::of(&incomplete, Some(&id)).is_none(), "an incomplete list");
+        assert!(EntryFiles::of(&files(), None).is_none(), "a file from memory without the hook");
+        assert!(EntryFiles::of(&ReadFiles::default(), None).is_some_and(|l| l.is_empty()), "a frame that reads no file");
+    }
+
+    #[test]
+    fn the_check_looks_at_the_listed_files() {
+        let dir = std::env::temp_dir().join(format!("effectcraft-entry-files-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let p = dir.join("f.bin");
+        std::fs::write(&p, b"abc").unwrap();
+        let path = p.to_string_lossy().to_string();
+        let gone = dir.join("gone.bin").to_string_lossy().to_string();
+        let stamp = FileStamp::native(&path).unwrap();
+        let read: ReadFiles = [ReadFile::new(path.as_str(), stamp), ReadFile::new(gone.as_str(), FileStamp::Missing)].into_iter().collect();
+        let list = EntryFiles::of(&read, None).unwrap();
+        assert!(list.unchanged(None));
+        std::fs::write(&p, b"abcd").unwrap();
+        assert!(!list.unchanged(None), "a new size");
+        std::fs::write(&gone, b"x").unwrap();
+        let list = EntryFiles::of(&[ReadFile::new(gone.as_str(), FileStamp::Missing)].into_iter().collect(), None).unwrap();
+        assert!(!list.unchanged(None), "a missing file that is back");
+        let v: ReadFiles = [ReadFile::new("/v", FileStamp::Virtual)].into_iter().collect();
+        let one = |_: &str| Some((1, 1));
+        let two = |_: &str| Some((1, 2));
+        let list = EntryFiles::of(&v, Some(&one)).unwrap();
+        assert!(list.unchanged(Some(&one)) && !list.unchanged(Some(&two)) && !list.unchanged(None));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/render/src/eval.rs b/crates/render/src/eval.rs
index 8a193b87a..41e6132d3 100644
--- a/crates/render/src/eval.rs
+++ b/crates/render/src/eval.rs
@@ -39,17 +39,37 @@ pub struct EvalCtx<'a> {
     /// Footage frames for expressions that read rendered pixels (`sampleImage`): the renderer's
     /// own source while rendering; `None` renders footage as transparent.
     pub footage: Option<&'a dyn crate::FootageSource>,
+    /// Property values overridden by the Essential Properties of a collapsed precomp instance.
+    pub property_overrides: &'a [crate::PropertyOverride],
+    /// Media Replacement values overridden by the Essential Properties of a collapsed precomp
+    /// instance.
+    pub media_overrides: &'a [crate::MediaOverride],
+    /// Where the source files of what expressions render (`sampleImage`) are noted: the
+    /// renderer's [`Renderer::reads`](crate::Renderer::reads) while rendering.
+    pub reads: Option<&'a crate::reads::ReadLog>,
 }
 
 impl<'a> EvalCtx<'a> {
+    /// A context for `comp` at `time` with no expressions, footage, overrides or read log.
     pub fn new(project: &'a Project, comp_id: ItemId, comp: &'a Comp, time: Tick) -> EvalCtx<'a> {
-        EvalCtx { project, comp_id, comp, time, expr: None, footage: None }
+        EvalCtx { project, comp_id, comp, time, expr: None, footage: None, property_overrides: &[], media_overrides: &[], reads: None }
     }
     pub fn at(&self, time: Tick) -> EvalCtx<'a> {
         EvalCtx { time, ..*self }
     }
     /// Value of a property at the context time (keyframes, then expression).
     pub fn value(&self, layer: &Layer, prop: &Property) -> Value {
+        // A collapsed precomp instance's Essential Property override replaces the base value;
+        // its expression (if any) still runs, and sees the overrides of this context.
+        if let Some(o) = self.property_overrides.iter().rev().find(|o| o.layer == layer.id && o.prop == prop.uid) {
+            let v = o.value(layer, prop, self.time);
+            if prop.has_expression()
+                && let Some(h) = self.expr
+            {
+                return h.eval(self, layer, prop, &v).unwrap_or(v);
+            }
+            return v;
+        }
         // Separated Position reads as the combination of X/Y/Z Position.
         if prop.match_id == "position"
             && let Some(tr) = layer.transform()
@@ -60,7 +80,13 @@ impl<'a> EvalCtx<'a> {
             let y = tr.get("positionY").map(|p| self.value(layer, p).as_f64()).unwrap_or(0.0);
             return Value::Vec3([self.value(layer, px).as_f64(), y, z]);
         }
-        let lt = layer.layer_time(self.time);
+        self.value_at_layer_time(layer, prop, layer.layer_time(self.time))
+    }
+    /// [`Self::value`] with the keyframes read at layer time `lt` exactly, rather than at the
+    /// context time mapped through the layer's start and stretch (which rounds under a
+    /// fractional stretch: a Hold key at `lt` could read its previous value). An expression
+    /// still runs at the context time.
+    pub fn value_at_layer_time(&self, layer: &Layer, prop: &Property, lt: Tick) -> Value {
         let v = prop.value_at(lt);
         if prop.has_expression()
             && let Some(h) = self.expr
@@ -139,13 +165,15 @@ impl<'a> EvalCtx<'a> {
     /// Source pixel aspect relative to the comp's: non-square footage (or solids, or precomps
     /// with another pixel aspect) is stretched horizontally by this factor in the comp.
     pub fn par_ratio(&self, layer: &Layer) -> f64 {
-        let par = match &layer.source {
-            LayerSource::Footage { item } | LayerSource::Solid { item } | LayerSource::Comp { item } => match self.project.item(*item).map(|i| &i.kind) {
-                Some(effectcraft_project::ItemKind::Footage(f)) => f.pixel_aspect,
-                Some(effectcraft_project::ItemKind::Solid(s)) => s.pixel_aspect,
-                Some(effectcraft_project::ItemKind::Comp(c)) => c.pixel_aspect,
-                _ => 1.0,
-            },
+        let item = match &layer.source {
+            LayerSource::Footage { item } => Some(self.media_item(layer, *item)),
+            LayerSource::Solid { item } | LayerSource::Comp { item } => Some(*item),
+            _ => None,
+        };
+        let par = match item.and_then(|item| self.project.item(item)).map(|i| &i.kind) {
+            Some(effectcraft_project::ItemKind::Footage(f)) => f.pixel_aspect,
+            Some(effectcraft_project::ItemKind::Solid(s)) => s.pixel_aspect,
+            Some(effectcraft_project::ItemKind::Comp(c)) => c.pixel_aspect,
             _ => 1.0,
         };
         let r = par / if self.comp.pixel_aspect > 0.0 { self.comp.pixel_aspect } else { 1.0 };
@@ -179,13 +207,7 @@ impl<'a> EvalCtx<'a> {
         // Auto-orient (along path / towards camera) replaces Orientation.
         let orient = crate::three_d::camera::auto_orient_3d(self, layer, p)
             .unwrap_or_else(|| Mat4::orientation(Vec3::from(self.v3(layer, tr, "orientation", [0.0; 3]))));
-        Mat4::translate(p)
-            * orient
-            * Mat4::rotate_z(rz)
-            * Mat4::rotate_y(ry)
-            * Mat4::rotate_x(rx)
-            * Mat4::scale(Vec3::from(scale) / 100.0)
-            * Mat4::translate(-Vec3::from(anchor))
+        Mat4::translate(p) * orient * Mat4::rotation_xyz(rx, ry, rz) * Mat4::scale(Vec3::from(scale) / 100.0) * Mat4::translate(-Vec3::from(anchor))
     }
 
     /// Layer space → comp (world) space, including parents.
@@ -231,9 +253,27 @@ impl<'a> EvalCtx<'a> {
             (Mat3([[m[0][0], m[0][1], m[0][3]], [m[1][0], m[1][1], m[1][3]], [0.0, 0.0, 1.0]]), 0.0)
         }
     }
+    /// The footage item a layer uses, honouring this instance's Media Replacement override.
+    pub fn media_item(&self, layer: &Layer, item: ItemId) -> ItemId {
+        self.media_overrides.iter().rev().find(|m| m.layer == layer.id).map_or(item, |m| m.item)
+    }
+
+    /// Size of a layer's source in layer pixels, honouring Media Replacement.
+    pub fn source_size(&self, layer: &Layer) -> (u32, u32) {
+        let item = match &layer.source {
+            LayerSource::Footage { item } => Some(self.media_item(layer, *item)),
+            LayerSource::Comp { item } | LayerSource::Solid { item } => Some(*item),
+            _ => None,
+        };
+        match layer.source {
+            LayerSource::Null => (100, 100),
+            _ => item.and_then(|item| self.project.item(item)).and_then(|i| i.dimensions()).unwrap_or((0, 0)),
+        }
+    }
+
     /// [`effect_bounds`] of a layer of this comp.
     pub fn effect_bounds(&self, layer: &Layer) -> ([f64; 2], [f64; 2]) {
-        effect_bounds(self.project, self.comp, layer)
+        effect_bounds_of(self.comp, self.source_size(layer))
     }
     /// Effect space (see [`effect_bounds`]) → comp matrix.
     pub fn effect_to_comp(&self, layer: &Layer) -> Mat3 {
@@ -242,6 +282,20 @@ impl<'a> EvalCtx<'a> {
     }
 }
 
+impl crate::PropertyOverride {
+    fn value(&self, layer: &Layer, prop: &Property, time: Tick) -> Value {
+        if self.font {
+            // A Font control merges only the font into the target text, as
+            // `essential::with_overrides` does.
+            let mut value = prop.value_at(layer.layer_time(time));
+            effectcraft_project::essential::merge_font(&mut value, &self.value);
+            value
+        } else {
+            self.value.clone()
+        }
+    }
+}
+
 /// The protected regions of a comp (Responsive Design — Time markers), merged, sorted and
 /// clamped to the comp, in seconds.
 pub fn protected_regions(comp: &Comp) -> Vec<(f64, f64)> {
@@ -315,7 +369,11 @@ pub fn responsive_source_time(comp: &Comp, stretch: f64, elapsed: f64) -> Option
 /// surrounds. Effects work in **effect space**, measured from that corner (After Effects' layer
 /// space for effect points: a shape layer's default effect point is its bounds' centre).
 pub fn effect_bounds(project: &Project, comp: &Comp, layer: &Layer) -> ([f64; 2], [f64; 2]) {
-    match source_size(project, layer) {
+    effect_bounds_of(comp, source_size(project, layer))
+}
+
+fn effect_bounds_of(comp: &Comp, size: (u32, u32)) -> ([f64; 2], [f64; 2]) {
+    match size {
         (0, _) => {
             let (w, h) = (comp.width as f64, comp.height as f64);
             ([w, h], [-w / 2.0, -h / 2.0])
@@ -324,6 +382,24 @@ pub fn effect_bounds(project: &Project, comp: &Comp, layer: &Layer) -> ([f64; 2]
     }
 }
 
+/// The layer's source time range in layer time seconds as (first, end) for
+/// [`effectcraft_effects::EffectEnv::layer_span`]: footage and nested comps last their item's
+/// duration from layer time 0. With Time Remap layer time is no longer source time, so the layer's
+/// visible span (in to out point, in layer time) is reported instead. `None` for sources without
+/// a duration (stills, solids, text, shapes...).
+pub fn layer_span(project: &Project, layer: &Layer) -> Option<(f64, f64)> {
+    let span = if layer.props.get("timeRemap").is_some() {
+        let (a, b) = (layer.layer_time(layer.in_point).seconds(), layer.layer_time(layer.out_point).seconds());
+        (a.min(b), a.max(b))
+    } else {
+        match &layer.source {
+            LayerSource::Footage { item } | LayerSource::Comp { item } => (0.0, project.item(*item)?.duration()?.seconds()),
+            _ => return None,
+        }
+    };
+    (span.0.is_finite() && span.1.is_finite() && span.1 > span.0).then_some(span)
+}
+
 /// Size of a layer's source in layer pixels.
 pub fn source_size(project: &Project, layer: &Layer) -> (u32, u32) {
     match &layer.source {
diff --git a/crates/render/src/footage.rs b/crates/render/src/footage.rs
new file mode 100644
index 000000000..6b7fdcbf8
--- /dev/null
+++ b/crates/render/src/footage.rs
@@ -0,0 +1,259 @@
+use super::{Arc, AtomicBool, Footage, Image, ItemId, ItemKind, Ordering, Tick};
+use crate::reads::ReadLog;
+
+/// How a [`FootageSource`] hands over float footage (OpenEXR, float TIFF), whose values are
+/// linear light: encoded with a curve, as the compositor takes footage, or as stored. Other
+/// footage is decoded the same way whatever it says. Interpret Footage ▸ Preserve RGB always
+/// reads the values as stored.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum FloatCurve {
+    /// The sRGB curve (managed projects, and Working Gamma 2.2).
+    #[default]
+    Srgb,
+    /// A pure 2.4 power curve (no working space, Working Gamma 2.4).
+    Gamma24,
+    /// The linear values as stored (Interpret As Linear Light encodes them afterwards).
+    Linear,
+}
+
+/// Supplies decoded footage frames (implemented by the media layer).
+pub trait FootageSource: Send + Sync {
+    /// The frame of `item` at source time `t`, straight from the file (any size).
+    fn frame(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<Image>>;
+    /// [`FootageSource::frame`] for a render that shows it at `width` × `height`, at most half its
+    /// size: either that frame or, when the source can make it more cheaply than the whole frame
+    /// (movies, see `effectcraft-media`), the frame already resampled to that size as
+    /// [`effectcraft_raster::resample`] would.
+    fn frame_at_size(&self, item: ItemId, footage: &Footage, t: Tick, _width: u32, _height: u32) -> Option<Arc<Image>> {
+        self.frame(item, footage, t)
+    }
+    /// [`FootageSource::frame`] (`size: None`) or [`FootageSource::frame_at_size`] with float
+    /// footage handed over as `float` says ([`FootageSource::frame`] uses [`FloatCurve::Srgb`]).
+    /// Sources without float footage can leave the default, which ignores `float`.
+    fn frame_with(&self, item: ItemId, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) -> Option<Arc<Image>> {
+        let _ = float;
+        match size {
+            Some((w, h)) => self.frame_at_size(item, footage, t, w, h),
+            None => self.frame(item, footage, t),
+        }
+    }
+    /// `frames` interleaved stereo sample frames of `item`'s audio from source time `t` at
+    /// `rate` Hz (`None` when unavailable). The first sample is `t.to_units_floor(rate)`;
+    /// a sample boundary uses the earliest representable tick that selects that sample.
+    fn audio(&self, _item: ItemId, _footage: &Footage, _t: Tick, _frames: usize, _rate: u32) -> Option<Vec<f32>> {
+        None
+    }
+    /// Auxiliary 3D channels of `item` at source time `t` (multi-layer OpenEXR: depth, IDs,
+    /// Cryptomatte, any named channel), with `scale` relative to the file's pixels. `None` when
+    /// the footage has none.
+    fn aux(&self, _item: ItemId, _footage: &Footage, _t: Tick) -> Option<Arc<effectcraft_raster::AuxChannels>> {
+        None
+    }
+    /// The footage files (by [`Footage::path`]) whose channels effects of the project read
+    /// through [`FootageSource::aux`] (EXtractoR, Cryptomatte and the other 3D Channel effects),
+    /// replacing the set given before. A source that decodes a file's picture and its channels
+    /// separately can decode both at once for these from the first frame on. Sources that don't
+    /// ignore it.
+    fn set_aux_footage(&self, _paths: &[String]) {}
+    /// The parsed 3D model of a [`effectcraft_project::FootageKind::Model`] item (Advanced 3D).
+    fn model(&self, _item: ItemId, _footage: &Footage) -> Option<Arc<effectcraft_model::Model>> {
+        None
+    }
+    /// Set the decoded-frame cache budget in bytes (Settings ▸ Memory & CPU); sources without
+    /// a cache ignore it.
+    fn set_cache_budget(&self, _bytes: usize) {}
+    /// Drop the decoded frames it keeps (Edit ▸ Purge ▸ All Memory / Image Cache Memory): the
+    /// next reads decode again. Sources without a cache ignore it.
+    fn purge(&self) {}
+    /// The file at `path` changed on disk (Reload Footage): drop what it keeps of it (decoded
+    /// frames, open decoders, parsed models), so the next reads see the new contents. Sources
+    /// without a cache ignore it.
+    fn forget(&self, _path: &str) {}
+    /// Settings ▸ Disk ▸ Conformed Audio Folder: where decoded audio is kept between reads
+    /// (`None` = off); sources that don't decode audio ignore it.
+    fn set_conform_folder(&self, _folder: Option<std::path::PathBuf>) {}
+    /// The decoded-frame cache budget in bytes, if the source has a cache.
+    fn cache_budget(&self) -> Option<usize> {
+        None
+    }
+    /// Vector footage (SVG, PDF, Illustrator, EPS: [`is_vector_footage`]) rasterised at `scale` ×
+    /// its size as [`vector_fit`] draws it, for Continuously Rasterize. `None` when the footage
+    /// is not vector or cannot be read.
+    fn vector_frame(&self, _item: ItemId, _footage: &Footage, _scale: f64) -> Option<Arc<Image>> {
+        None
+    }
+    /// Run `f`, which reads frames from this source, as work that can be called off: once
+    /// `cancel` is set, long decodes it starts (a movie seeking back to a keyframe and decoding
+    /// forward) stop early and their frames come back `None`. Sources that can't stop a decode
+    /// just run `f`. See [`CancellableFootage`].
+    fn cancellable(&self, _cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
+        f()
+    }
+    /// Reads through this source have been called off: frames may have come back `None` that
+    /// exist, so what was made from them must not be kept.
+    fn called_off(&self) -> bool {
+        false
+    }
+    /// Run `f`, which reads from this source on this thread, noting in `reads` every source file
+    /// those reads use, with its identity as read (see [`crate::reads`]): the file a frame was
+    /// decoded from, also when it comes from the source's own memory cache (without reading the
+    /// file again). Sources that can't tell which files they read keep the default, which marks
+    /// `reads` incomplete.
+    fn recording(&self, reads: &ReadLog, f: &mut dyn FnMut()) {
+        reads.mark_incomplete();
+        f()
+    }
+    /// Why `footage` shows no picture although its file is there: a read of it failed because
+    /// no decoder handles its codec, profile, chroma format or bit depth, or the stream is damaged
+    /// (e.g. "H.264 (High 4:2:2) isn't supported by the built-in decoder: ..."). `None` while it
+    /// decodes, and for sources that don't track failures. Stays set until the file is forgotten.
+    fn problem(&self, _footage: &Footage) -> Option<String> {
+        None
+    }
+    /// Missing files and [`Self::problem`] of what `item` shows: its proxy's while Use Proxy shows the proxy
+    /// instead (the reason then says it is the proxy's), else the footage item's own. A
+    /// composition has one only through its proxy.
+    fn item_problem(&self, item: &effectcraft_project::Item) -> Option<String> {
+        match item.proxy.as_deref().filter(|px| px.enabled && px.footage.has_video) {
+            Some(px) => {
+                missing_problem(&px.footage, "Use Set Proxy to locate the proxy file.").or_else(|| self.problem(&px.footage)).map(|why| format!("Proxy: {why}"))
+            }
+            None => match &item.kind {
+                ItemKind::Footage(f) => missing_problem(f, "Use File ▸ Dependencies ▸ Relink Missing Footage or Replace Footage.").or_else(|| self.problem(f)),
+                _ => None,
+            },
+        }
+    }
+}
+
+/// A known offline source, without filesystem access while painting or querying.
+fn missing_problem(f: &Footage, remedy: &str) -> Option<String> {
+    (f.missing && !f.path.is_empty() && f.kind != effectcraft_project::FootageKind::Data).then(|| format!("Missing footage: {}. {remedy}", f.path))
+}
+
+/// Inventory warning, including an unused proxy or an original currently replaced by a proxy.
+/// Viewer warnings instead use `item_problem`, which follows the active render source.
+pub fn missing_item_problem(item: &effectcraft_project::Item) -> Option<String> {
+    if let ItemKind::Footage(f) = &item.kind
+        && let Some(why) = missing_problem(f, "Use File ▸ Dependencies ▸ Relink Missing Footage or Replace Footage.")
+    {
+        return Some(why);
+    }
+    item.proxy.as_ref().and_then(|p| missing_problem(&p.footage, "Use Set Proxy to locate the proxy file.")).map(|why| format!("Proxy: {why}"))
+}
+
+/// A render's view of a [`FootageSource`] whose frame reads can be called off with `cancel`
+/// (a viewer frame nobody waits for any more, #329). Every read goes through
+/// [`FootageSource::cancellable`] on its own, so reads made for this render on another thread
+/// (a parallel loop) answer to this render's flag, and reads for other renders never do.
+pub struct CancellableFootage<'a> {
+    pub inner: &'a dyn FootageSource,
+    pub cancel: Arc<AtomicBool>,
+}
+
+impl CancellableFootage<'_> {
+    fn read<R>(&self, f: impl FnOnce() -> Option<R>) -> Option<R> {
+        if self.cancel.load(Ordering::Relaxed) {
+            return None;
+        }
+        let (mut f, mut out) = (Some(f), None);
+        self.inner.cancellable(&self.cancel, &mut || out = f.take().and_then(|f| f()));
+        out
+    }
+}
+
+impl FootageSource for CancellableFootage<'_> {
+    fn frame(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<Image>> {
+        self.read(|| self.inner.frame(item, footage, t))
+    }
+    fn frame_at_size(&self, item: ItemId, footage: &Footage, t: Tick, width: u32, height: u32) -> Option<Arc<Image>> {
+        self.read(|| self.inner.frame_at_size(item, footage, t, width, height))
+    }
+    fn audio(&self, item: ItemId, footage: &Footage, t: Tick, frames: usize, rate: u32) -> Option<Vec<f32>> {
+        self.inner.audio(item, footage, t, frames, rate)
+    }
+    fn aux(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<effectcraft_raster::AuxChannels>> {
+        self.inner.aux(item, footage, t)
+    }
+    fn set_aux_footage(&self, paths: &[String]) {
+        self.inner.set_aux_footage(paths)
+    }
+    fn model(&self, item: ItemId, footage: &Footage) -> Option<Arc<effectcraft_model::Model>> {
+        self.inner.model(item, footage)
+    }
+    fn set_cache_budget(&self, bytes: usize) {
+        self.inner.set_cache_budget(bytes)
+    }
+    fn purge(&self) {
+        self.inner.purge()
+    }
+    fn forget(&self, path: &str) {
+        self.inner.forget(path)
+    }
+    fn set_conform_folder(&self, folder: Option<std::path::PathBuf>) {
+        self.inner.set_conform_folder(folder)
+    }
+    fn cache_budget(&self) -> Option<usize> {
+        self.inner.cache_budget()
+    }
+    fn vector_frame(&self, item: ItemId, footage: &Footage, scale: f64) -> Option<Arc<Image>> {
+        self.inner.vector_frame(item, footage, scale)
+    }
+    fn cancellable(&self, cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
+        self.inner.cancellable(cancel, f)
+    }
+    fn called_off(&self) -> bool {
+        self.cancel.load(Ordering::Relaxed) || self.inner.called_off()
+    }
+    /// Runs `f` with the inner source, collecting the files it reads into `reads`.
+    fn recording(&self, reads: &ReadLog, f: &mut dyn FnMut()) {
+        self.inner.recording(reads, f)
+    }
+    fn problem(&self, footage: &Footage) -> Option<String> {
+        self.inner.problem(footage)
+    }
+    fn frame_with(&self, item: ItemId, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) -> Option<Arc<Image>> {
+        self.read(|| self.inner.frame_with(item, footage, t, size, float))
+    }
+}
+
+/// Footage that can be rasterised at any scale: SVG, PDF, Illustrator and EPS files, and a
+/// placed page of an After Effects project (its codec is not stored there).
+pub fn is_vector_footage(f: &Footage) -> bool {
+    matches!(f.codec.as_str(), "SVG" | "PDF" | "AI" | "EPS") || f.placed_page
+}
+
+/// How vector footage `f` is drawn at `scale` × its size: the image size, and the x and y scale
+/// from document pixels (`doc` = the document's width and height, `own` = its pixel size, the
+/// size rounded up) to image pixels.
+///
+/// Footage from an After Effects project ([`Footage::placed_page`]) fills its stored size, which
+/// can round or measure the page differently: the layer's anchor and masks are measured against
+/// that size, and the renderer resamples a reduced-resolution frame to it, so drawn at its own
+/// size the art was scaled by the width ratio alone at full resolution (off against the masks)
+/// and stretched to the stored aspect below 3/4 resolution (#3099). Other footage is drawn 1:1 at
+/// the document's own size, as it always was.
+pub fn vector_fit(f: &Footage, doc: [f64; 2], own: (u32, u32), scale: f64) -> ((u32, u32), [f64; 2]) {
+    let scale = if scale.is_finite() && scale > 0.0 { scale } else { 1.0 };
+    let side = |px: u32| (f64::from(px) * scale).ceil().clamp(1.0, f64::from(u32::MAX)) as u32;
+    let size = (f.width, f.height);
+    let fills = f.placed_page && size != own && size.0 > 0 && size.1 > 0 && doc.iter().all(|d| d.is_finite() && *d > 0.0);
+    if !fills {
+        return ((side(own.0), side(own.1)), [scale, scale]);
+    }
+    ((side(size.0), side(size.1)), [scale * f64::from(size.0) / doc[0], scale * f64::from(size.1) / doc[1]])
+}
+
+/// No footage available (renders footage layers as transparent).
+pub struct NoFootage;
+
+impl FootageSource for NoFootage {
+    /// Always `None`: there is no footage.
+    fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
+        None
+    }
+    /// Reads no files.
+    fn recording(&self, _: &ReadLog, f: &mut dyn FnMut()) {
+        f()
+    }
+}
diff --git a/crates/render/src/frames.rs b/crates/render/src/frames.rs
new file mode 100644
index 000000000..20c655694
--- /dev/null
+++ b/crates/render/src/frames.rs
@@ -0,0 +1,166 @@
+use super::footage::NoFootage;
+use super::opts::RenderOpts;
+use super::{Arc, EvalCtx, Footage, FrameBlend, FrameRate, Image, ItemId, Layer, LayerSource, Project, Renderer, TICKS_PER_SECOND, Tick, shapes, text};
+use rayon::prelude::*;
+
+/// The layer's frame blending mode, if the comp's Enable Frame Blending switch is on.
+/// One field of an interlaced frame as a full frame: the field's lines (`parity` 0 = even /
+/// upper, 1 = odd / lower) kept, the other lines interpolated from their neighbours.
+pub fn field_frame(img: &Image, parity: usize) -> Image {
+    let (w, h) = (img.width as usize, img.height as usize);
+    let mut out = img.clone();
+    if h < 2 {
+        return out;
+    }
+    for y in 0..h {
+        if y % 2 == parity {
+            continue;
+        }
+        let above = y.checked_sub(1);
+        let below = (y + 1 < h).then_some(y + 1);
+        for x in 0..w {
+            let px = match (above, below) {
+                (Some(a), Some(b)) => {
+                    let (p, q) = (img.data[a * w + x], img.data[b * w + x]);
+                    [(p[0] + q[0]) * 0.5, (p[1] + q[1]) * 0.5, (p[2] + q[2]) * 0.5, (p[3] + q[3]) * 0.5]
+                }
+                (Some(a), None) => img.data[a * w + x],
+                (None, Some(b)) => img.data[b * w + x],
+                (None, None) => img.data[y * w + x],
+            };
+            out.data[y * w + x] = px;
+        }
+    }
+    out
+}
+
+/// Interpret Footage ▸ Cineon Settings ▸ Logarithmic Conversion converts the log code values of
+/// a decoded (premultiplied) frame of `f` to the Current Gamma. When the conversion does not
+/// apply, the frame is returned unchanged.
+pub fn cineon_frame(img: Arc<Image>, f: &Footage) -> Arc<Image> {
+    if !f.cineon_applies() {
+        return img;
+    }
+    let cs = f.cineon;
+    let mut out = (*img).clone();
+    out.data.par_iter_mut().for_each(|p| {
+        let a = p[3];
+        let c = if a > 1e-6 { [p[0] / a, p[1] / a, p[2] / a] } else { [0.0; 3] }.map(|v| cs.convert(v));
+        *p = [c[0] * a, c[1] * a, c[2] * a, a];
+    });
+    Arc::new(out)
+}
+
+/// Interpret Footage ▸ Invert Alpha and Interpret As Linear Light on decoded (premultiplied)
+/// pixels; linear light is encoded in `space` ([`color::Pipe::linear_footage_space`]).
+pub fn interpret_pixels(img: &Image, f: &Footage, space: effectcraft_color::ColorSpace) -> Image {
+    let linear = f.linear_light_applies();
+    if !f.invert_alpha && !linear {
+        return img.clone();
+    }
+    let mut out = img.clone();
+    for p in out.data.iter_mut() {
+        let a = p[3];
+        let mut c = if a > 1e-6 { [p[0] / a, p[1] / a, p[2] / a] } else { [0.0; 3] };
+        if linear {
+            // The file's values are linear light: encode them like the rest of the footage.
+            c = c.map(|v| space.encode(v));
+        }
+        let a = if f.invert_alpha { 1.0 - a } else { a };
+        *p = [c[0] * a, c[1] * a, c[2] * a, a];
+    }
+    out
+}
+
+pub(crate) fn frame_blend_mode(ctx: &EvalCtx, layer: &Layer) -> FrameBlend {
+    if ctx.comp.enable_frame_blending { layer.switches.frame_blend } else { FrameBlend::Off }
+}
+
+/// Position of source time `t` among frames at `rate`: the frame at or before `t` and the
+/// fraction (0..1) of the way to the next frame. Exact (integer tick arithmetic), so frames that
+/// line up exactly report a fraction of 0.
+pub fn frame_position(t: Tick, rate: FrameRate) -> (i64, f64) {
+    // A project file can carry a zero or negative rate; there are no frames to land between.
+    if rate.num <= 0 || rate.den <= 0 {
+        return (0, 0.0);
+    }
+    let num = t.0 as i128 * rate.num as i128;
+    let den = TICKS_PER_SECOND as i128 * rate.den as i128;
+    (num.div_euclid(den) as i64, num.rem_euclid(den) as f64 / den as f64)
+}
+
+/// Blend two neighbouring frames `w` of the way from `a` to `b`: a cross-fade (Frame Mix) or a
+/// motion-compensated interpolation (Pixel Motion).
+pub fn blend_frames(mode: FrameBlend, a: &Image, b: &Image, w: f32) -> Image {
+    match mode {
+        FrameBlend::PixelMotion => effectcraft_raster::flow::interpolate(a, b, w),
+        _ => effectcraft_raster::flow::mix(a, b, w),
+    }
+}
+
+/// Convenience: render one frame of a comp with no footage source.
+/// Adaptive motion-blur sample count for a layer whose corners travel `travel` output pixels
+/// during the shutter: one sample per pixel, clamped to Samples Per Frame … Adaptive Sample Limit.
+pub fn adaptive_samples(travel: f64, per_frame: u32, limit: u32) -> usize {
+    let lo = per_frame.clamp(2, 64) as f64;
+    let hi = (limit.clamp(16, 256) as f64).max(lo);
+    travel.ceil().clamp(lo, hi) as usize
+}
+
+/// A region of interest `[x, y, w, h]` lies within a `w`×`h` comp frame.
+pub fn roi_inside(r: [f64; 4], w: u32, h: u32) -> bool {
+    r[0] >= 0.0 && r[1] >= 0.0 && r[0] + r[2] <= w as f64 + 1e-6 && r[1] + r[3] <= h as f64 + 1e-6
+}
+
+/// The Extended Viewer's region of interest: the comp frame grown by `margin` × its size on every
+/// side (`margin` = 1 shows a pasteboard one comp wide around the frame), intersected with the
+/// `visible` comp-space rectangle `[x0, y0, x1, y1]` and snapped outward to whole 16 px steps from the frame edges
+/// so panning re-renders rarely. `None` when the visible area lies inside the frame.
+pub fn extended_region(w: u32, h: u32, visible: [f64; 4], margin: f64) -> Option<[f64; 4]> {
+    let (w, h) = (w as f64, h as f64);
+    let (mx, my) = (w * margin, h * margin);
+    let snap_lo = |v: f64| (v / 16.0).floor() * 16.0;
+    let snap_hi = |v: f64| (v / 16.0).ceil() * 16.0;
+    let x0 = snap_lo(visible[0].max(-mx)).min(0.0);
+    let y0 = snap_lo(visible[1].max(-my)).min(0.0);
+    let x1 = w + snap_hi(visible[2].min(w + mx) - w).max(0.0);
+    let y1 = h + snap_hi(visible[3].min(h + my) - h).max(0.0);
+    if x0 >= 0.0 && y0 >= 0.0 && x1 <= w && y1 <= h {
+        return None;
+    }
+    Some([x0, y0, x1 - x0, y1 - y0])
+}
+
+/// The size of a `width` x `height` comp frame rendered at `scale` (both compositors, and the
+/// frame size Composition Settings shows for a Resolution).
+pub fn frame_size(width: u32, height: u32, scale: f64) -> (u32, u32) {
+    (((width as f64 * scale).round() as u32).max(1), ((height as f64 * scale).round() as u32).max(1))
+}
+
+pub fn render_frame(project: &Project, comp: ItemId, t: Tick, scale: f64) -> Image {
+    Renderer::new(project, &NoFootage, RenderOpts { scale, ..Default::default() }).comp_frame(comp, t)
+}
+
+/// Layer-space bounds `[x0, y0, x1, y1]` of a layer's content at the context time (source size
+/// for solids/footage/precomps, glyph bounds for text, painted bounds for shapes). Used for viewer
+/// handles and hit testing.
+pub fn content_bounds(ctx: &EvalCtx, layer: &effectcraft_project::Layer) -> Option<[f64; 4]> {
+    match &layer.source {
+        LayerSource::Text => {
+            let glyphs = text::glyph_paths(ctx, layer);
+            let paths: Vec<_> = glyphs.into_iter().map(|g| g.0).collect();
+            effectcraft_path::bounds(&paths).map(|r| [r.x0, r.y0, r.x1, r.y1])
+        }
+        LayerSource::Shape => layer.props.sub("contents").and_then(|c| shapes::content_bounds(ctx, layer, c)).map(|r| [r.x0, r.y0, r.x1, r.y1]),
+        LayerSource::Camera | LayerSource::Light { .. } => None,
+        _ => {
+            let (w, h) = ctx.source_size(layer);
+            (w > 0 && h > 0).then_some([0.0, 0.0, w as f64, h as f64])
+        }
+    }
+}
+
+/// A mask/shape path as a kurbo path (for drawing overlays).
+pub fn kurbo_path(sp: &effectcraft_keyframe::ShapePath) -> kurbo::BezPath {
+    effectcraft_path::to_kurbo(sp)
+}
diff --git a/crates/render/src/fx_host.rs b/crates/render/src/fx_host.rs
new file mode 100644
index 000000000..3a6f1a34c
--- /dev/null
+++ b/crates/render/src/fx_host.rs
@@ -0,0 +1,200 @@
+use super::{Arc, Buf, EffectHost, EvalCtx, ItemKind, Layer, LayerPixels, LayerSource, Params, Renderer, Tick, three_d};
+
+/// Layer parameters and audio for effects (see [`effectcraft_effects::EffectHost`]). What it
+/// hands out is in effect space (see [`effect_bounds`]): the other layer's for its pixels, the
+/// running layer's for its own frames and the comp scene.
+pub(crate) struct FxHost<'r, 'a, 'c> {
+    pub(crate) r: &'r Renderer<'a>,
+    pub(crate) ctx: &'c EvalCtx<'a>,
+    pub(crate) layer: &'c Layer,
+    /// Where the stack's effect space starts in layer coordinates (zero on adjustment layers,
+    /// whose effects run on the comp below).
+    pub(crate) origin: [f64; 2],
+    /// Index of the effect being rendered (bounds `self_at` to effects before it).
+    pub(crate) index: usize,
+    pub(crate) original: Option<&'c Buf>,
+}
+
+impl FxHost<'_, '_, '_> {
+    /// Another layer's pixels for a layer parameter, in its effect space; `layer_space`: `buf`
+    /// is still in layer space (its source or its content).
+    fn pixels(&self, other: &Layer, mut buf: Buf, layer_space: bool) -> LayerPixels {
+        let (size, origin) = self.ctx.effect_bounds(other);
+        if layer_space {
+            buf.rebase(origin);
+        }
+        LayerPixels { buf, size }
+    }
+}
+
+/// The comp's camera and first light relative to `layer`, in its layer pixels (see
+/// [`EffectHost::comp_scene`]): the comp camera's view of the layer (as if 3D at its transform),
+/// brought back into the layer's own pixel grid through the inverse of how the layer itself
+/// composites.
+pub(crate) fn comp_scene(ctx: &EvalCtx, layer: &Layer) -> Option<effectcraft_effects::CompScene> {
+    let world = ctx.world_matrix(layer);
+    let (cam, _, _) = ctx.camera();
+    let p = (cam * world).0;
+    let back = ctx.layer_to_comp(layer).0.inverse()?.0;
+    let rows = [p[0], p[1], p[3]];
+    let camera: [[f64; 4]; 3] = std::array::from_fn(|i| std::array::from_fn(|j| (0..3).map(|k| back[i][k] * rows[k][j]).sum()));
+    let inv = world.inverse();
+    let light = three_d::light::lights_at(ctx).first().and_then(|l| {
+        let inv = inv.as_ref()?;
+        let pos = inv.apply(l.pos);
+        let dir = inv.apply_vec(l.dir);
+        let len = (dir.x * dir.x + dir.y * dir.y + dir.z * dir.z).sqrt().max(1e-12);
+        let kind = match l.kind {
+            effectcraft_project::LightKind::Parallel => 0,
+            effectcraft_project::LightKind::Ambient => 2,
+            _ => 1,
+        };
+        Some(effectcraft_effects::CompLight { pos: [pos.x, pos.y, pos.z], dir: [dir.x / len, dir.y / len, dir.z / len], color: l.color, kind })
+    });
+    let camera_layer = ctx.comp.active_camera(ctx.time).is_some();
+    Some(effectcraft_effects::CompScene { camera: Some(camera), camera_layer, light })
+}
+
+/// Nesting limit for effects that render layers (other layers, other times).
+pub(crate) const MAX_FX_DEPTH: usize = 8;
+
+impl EffectHost for FxHost<'_, '_, '_> {
+    fn original(&self) -> Option<&Buf> {
+        self.original
+    }
+
+    fn particles(&self) -> Option<&dyn effectcraft_effects::psim::ParticleSim> {
+        self.r.active_accel().and_then(|a| a.particles())
+    }
+    fn layer(&self, id: u64, masks_and_effects: bool) -> Option<LayerPixels> {
+        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
+        if (other.id == self.layer.id && masks_and_effects) || self.r.depth > MAX_FX_DEPTH {
+            return None;
+        }
+        let sub = self.r.nested();
+        // A 3D model or primitive layer has no 2D source of its own: an effect referencing one
+        // reads it as After Effects does — the layer rendered on its own through the comp's
+        // camera (Create 3D Layer Instance's effect), in the layer's effect space (the
+        // comp, centred on the layer's anchor).
+        if other.source.is_model() {
+            let buf = sub.solo_3d(self.ctx, other);
+            return Some(self.pixels(other, buf, false));
+        }
+        // The cached layer buffer is shared; effects get their own copy.
+        let buf = if masks_and_effects { (*sub.content_buf(self.ctx, other)?).clone() } else { sub.source(self.ctx, other)? };
+        Some(self.pixels(other, buf, true))
+    }
+
+    fn layer_masks(&self, id: u64) -> Option<LayerPixels> {
+        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
+        if self.r.depth > MAX_FX_DEPTH {
+            return None;
+        }
+        let sub = self.r.nested();
+        let buf = (*sub.layer_input(self.ctx, other, 0)?).clone();
+        Some(self.pixels(other, buf, false))
+    }
+
+    /// The audio of footage layer `id` from `start`, or `None` when the layer is not footage.
+    fn audio(&self, id: u64, start: f64, frames: usize, rate: u32) -> Option<Vec<f32>> {
+        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
+        let LayerSource::Footage { item } = &other.source else { return None };
+        let item = self.ctx.media_item(other, *item);
+        let ItemKind::Footage(f) = &self.r.project.item(item)?.kind else { return None };
+        if !f.has_audio {
+            return None;
+        }
+        let st = other.layer_time(Tick::from_seconds_f64(start));
+        self.r.read(|| self.r.footage.audio(item, f, st, frames, rate))
+    }
+
+    fn self_at(&self, layer_time: f64, effects: usize) -> Option<Buf> {
+        if self.r.depth > MAX_FX_DEPTH || self.layer.switches.adjustment {
+            return None;
+        }
+        let n = effects.min(self.index);
+        let t = self.layer.comp_time(Tick::from_seconds_f64(layer_time));
+        let sub = self.r.nested();
+        sub.layer_input(&self.ctx.at(t), self.layer, n).map(|b| (*b).clone())
+    }
+
+    fn aux(&self) -> Option<Arc<effectcraft_raster::AuxChannels>> {
+        self.r.layer_aux(self.ctx, self.layer)
+    }
+
+    fn params_at(&self, layer_time: f64) -> Option<Params> {
+        let g = self.layer.effects()?.groups().nth(self.index)?;
+        let ctx = self.ctx.at(self.layer.comp_time(Tick::from_seconds_f64(layer_time)));
+        Some(effectcraft_effects::flatten_params(g, &mut |pr| ctx.value(self.layer, pr)))
+    }
+
+    fn param_at(&self, effect_index: usize, id: &str, layer_time: f64) -> Option<effectcraft_keyframe::Value> {
+        // Only the one property: a simulation samples it at every step. Its keyframes are read
+        // at the requested layer time exactly (mapping it to comp time and back rounds under a
+        // fractional stretch, so a Hold key there could read its previous value).
+        let p = effect_param(self.layer, effect_index, id)?;
+        let lt = Tick::from_seconds_f64(layer_time);
+        Some(self.ctx.at(self.layer.comp_time(lt)).value_at_layer_time(self.layer, p, lt))
+    }
+
+    fn param_is_static(&self, effect_index: usize, id: &str) -> bool {
+        effect_param(self.layer, effect_index, id).is_some_and(|p| p.keys.is_empty() && !p.has_expression())
+    }
+
+    fn comp_scene(&self) -> Option<effectcraft_effects::CompScene> {
+        Some(comp_scene(self.ctx, self.layer)?.rebased(self.origin))
+    }
+
+    fn layer_at(&self, id: u64, comp_time: f64, masks_and_effects: bool) -> Option<LayerPixels> {
+        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
+        if (other.id == self.layer.id && masks_and_effects) || !comp_time.is_finite() || self.r.depth > MAX_FX_DEPTH {
+            return None;
+        }
+        let ctx = self.ctx.at(Tick::from_seconds_f64(comp_time));
+        let sub = self.r.nested();
+        Some(if masks_and_effects {
+            self.pixels(other, (*sub.content_buf(&ctx, other)?).clone(), true)
+        } else if other.id == self.layer.id {
+            self.pixels(other, sub.source(&ctx, other)?, true)
+        } else {
+            // Preserve other-layer reads: time effects historically see source + masks.
+            self.pixels(other, (*sub.layer_input(&ctx, other, 0)?).clone(), false)
+        })
+    }
+}
+
+/// Parameter `id` (a flattened id: match ids joined by `/`) of effect `effect_index` in
+/// `layer`'s stack.
+fn effect_param<'a>(layer: &'a Layer, effect_index: usize, id: &str) -> Option<&'a effectcraft_project::Property> {
+    let mut g = layer.effects()?.groups().nth(effect_index)?;
+    let mut path = id.split('/').peekable();
+    while let Some(m) = path.next() {
+        if path.peek().is_none() {
+            return g.children.iter().find_map(|c| match c {
+                effectcraft_project::Node::Prop(p) if p.match_id == m => Some(p),
+                _ => None,
+            });
+        }
+        g = g.children.iter().find_map(|c| match c {
+            effectcraft_project::Node::Group(sg) if sg.match_id == m => Some(sg),
+            _ => None,
+        })?;
+    }
+    None
+}
+
+/// The Essential Properties overrides of a precomp layer, evaluated at the context time.
+pub fn essential_overrides(ctx: &EvalCtx, layer: &Layer) -> Vec<effectcraft_project::essential::Override> {
+    use effectcraft_project::essential;
+    let over = essential::overridden(layer);
+    let Some(g) = essential::group(layer).filter(|_| !over.is_empty()) else { return vec![] };
+    let mut out = vec![];
+    g.walk("", &mut |_, p| {
+        if over.contains(&p.uid)
+            && let Some(control) = essential::control_of(&p.match_id)
+        {
+            out.push(essential::Override { control, value: ctx.value(layer, p) });
+        }
+    });
+    out
+}
diff --git a/crates/render/src/layers.rs b/crates/render/src/layers.rs
new file mode 100644
index 000000000..df976a857
--- /dev/null
+++ b/crates/render/src/layers.rs
@@ -0,0 +1,658 @@
+use super::frames::adaptive_samples;
+use super::opts::{LayerTiming, Through};
+use super::{
+    Arc, BlendMode, Buf, Comp, EvalCtx, Image, IndexedParallelIterator, IntoParallelRefIterator, IntoParallelRefMutIterator, Layer, LayerSource, Mat3,
+    MatteKind, ParallelIterator, Quality, Region, Renderer, Sampling, Tick, WarpOpts, cache, color, composite_warp_changed, masks, styles, vec2,
+};
+
+/// Blend policy for placing a layer, including optional output-depth quantization.
+struct PlacementBlend {
+    mode: BlendMode,
+    opacity: f32,
+    quantize: Option<f32>,
+}
+
+/// A motion-blur shutter: the comp's, or for a collapsed precomp's layers the outermost
+/// containing comp's (they are drawn into its frames).
+#[derive(Clone, Copy)]
+struct Shutter {
+    /// Shutter angle and phase as fractions of a frame.
+    angle: f64,
+    phase: f64,
+    /// Frame duration (seconds).
+    frame: f64,
+    /// Samples Per Frame and Adaptive Sample Limit.
+    samples: u32,
+    limit: u32,
+}
+
+impl Shutter {
+    /// Seconds from the frame time to sub-sample `i` of `n`, spread over the open shutter.
+    fn offset(&self, i: usize, n: usize) -> f64 {
+        let f = if n > 1 { i as f64 / (n - 1) as f64 } else { 0.0 };
+        (self.phase + self.angle * f) * self.frame
+    }
+}
+
+/// `files` (a content's) with the files of the buffers made of it that the layer cache kept:
+/// `files` itself when they are all its own.
+fn with_kept_files(files: Arc<crate::reads::ReadFiles>, kept: &[Arc<crate::reads::ReadFiles>]) -> Arc<crate::reads::ReadFiles> {
+    if kept.iter().all(|f| Arc::ptr_eq(f, &files)) {
+        return files;
+    }
+    let mut all = (*files).clone();
+    kept.iter().for_each(|f| all.extend(f));
+    Arc::new(all)
+}
+
+impl<'a> Renderer<'a> {
+    /// The layer with its styles: exterior passes and body (cached per pass).
+    pub(crate) fn styled(&self, ctx: &EvalCtx, layer: &Layer, mut timing: Option<&mut LayerTiming>) -> Option<StyledLayer> {
+        let (content, ckey, files) = self.content_buf_timed(ctx, layer, timing.as_deref_mut())?;
+        if !styles::active(ctx, layer) {
+            return Some(StyledLayer { passes: vec![], body: content.clone(), content, key: ckey, ckey, plain: true, files });
+        }
+        let modes = styles::pass_modes(ctx, layer);
+        let key = ckey.map(|k| cache::styles_key(ctx, layer, k));
+        // (a cached body or pass may have been made of other files than the content: another
+        // worker's, or one from disk; the styled layer lists the files of every buffer it holds)
+        if let Some((body, body_files)) = self.cached(key) {
+            let mut kept_files = vec![body_files];
+            let passes: Option<Vec<_>> = modes
+                .iter()
+                .enumerate()
+                .map(|(i, m)| {
+                    self.cached(key.map(|k| cache::derive(k, i as u64 + 1))).map(|(b, f)| {
+                        kept_files.push(f);
+                        (b, *m)
+                    })
+                })
+                .collect();
+            if let Some(passes) = passes {
+                let files = with_kept_files(files, &kept_files);
+                return Some(StyledLayer { passes, body, content, key, ckey, plain: false, files });
+            }
+        }
+        let t0 = web_time::Instant::now();
+        let size = ctx.source_size(layer);
+        let layer_size = if size.0 == 0 { [ctx.comp.width as f64, ctx.comp.height as f64] } else { [size.0 as f64, size.1 as f64] };
+        let st = styles::render(ctx, layer, &content, layer_size);
+        if let Some(t) = timing {
+            t.cached = false;
+            t.effects.push(("layerStyles".into(), t0.elapsed().as_secs_f64() * 1e3));
+        }
+        // The buffers the cache keeps (another worker's, if it kept them first), made of the
+        // content's files; the styled layer then lists the files of every buffer it holds.
+        let mut kept_files = vec![];
+        let (body, f) = self.keep(key, Arc::new(st.body), &files);
+        kept_files.push(f);
+        let passes: Vec<_> = st
+            .passes
+            .into_iter()
+            .enumerate()
+            .map(|(i, (b, m))| {
+                let (b, f) = self.keep(key.map(|k| cache::derive(k, i as u64 + 1)), Arc::new(b), &files);
+                kept_files.push(f);
+                (b, m)
+            })
+            .collect();
+        let files = with_kept_files(files, &kept_files);
+        Some(StyledLayer { passes, body, content, key, ckey, plain: false, files })
+    }
+
+    /// The styled layer's buffers in the blending space.
+    pub(crate) fn styled_to_blend(&self, st: StyledLayer) -> StyledLayer {
+        if self.pipe.to_blend().is_none() {
+            return st;
+        }
+        let body = self.to_blend(st.body, st.key, &st.files);
+        let content = if st.plain { body.clone() } else { self.to_blend(st.content, st.ckey, &st.files) };
+        let passes =
+            st.passes.into_iter().enumerate().map(|(i, (b, m))| (self.to_blend(b, st.key.map(|k| cache::derive(k, i as u64 + 1)), &st.files), m)).collect();
+        StyledLayer { passes, body, content, ..st }
+    }
+
+    pub(crate) fn sampling(&self, layer: &Layer) -> effectcraft_raster::Sampling {
+        if self.quality(layer) == Quality::Draft {
+            // Draft quality: no interpolation (nearest neighbour), as After Effects' Draft.
+            effectcraft_raster::Sampling::Nearest
+        } else if self.opts.draft {
+            effectcraft_raster::Sampling::Bilinear
+        } else if layer.switches.sampling == Sampling::Bicubic {
+            effectcraft_raster::Sampling::Bicubic
+        } else {
+            effectcraft_raster::Sampling::Bilinear
+        }
+    }
+
+    /// The region of interest of a top-level 2D frame: (x, y) offset of the output in output
+    /// pixels and its size. `None` renders the whole comp (no ROI, or a nested comp).
+    pub(crate) fn roi_offset(&self) -> Option<(f64, f64, u32, u32)> {
+        let r = self.opts.roi.filter(|_| self.top)?;
+        let s = self.opts.scale;
+        if r[2] <= 0.0 || r[3] <= 0.0 {
+            return None;
+        }
+        Some(((r[0] * s).round(), (r[1] * s).round(), ((r[2] * s).round() as u32).max(1), ((r[3] * s).round() as u32).max(1)))
+    }
+
+    /// The region of interest's offset in output pixels for 3D projection (0 without one).
+    pub(crate) fn out_offset(&self) -> (f64, f64) {
+        self.roi_offset().map_or((0.0, 0.0), |(x, y, _, _)| (x, y))
+    }
+
+    /// Scaled comp pixel → output pixel: the region of interest's offset.
+    fn out_matrix(&self) -> Mat3 {
+        match self.roi_offset() {
+            Some((x, y, _, _)) => Mat3::translate(vec2(-x, -y)),
+            None => Mat3::IDENTITY,
+        }
+    }
+
+    /// Buffer pixel → output pixel matrix for the layer at the context time.
+    fn buf_matrix(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> Mat3 {
+        let (l2c, _) = ctx.layer_to_comp(layer);
+        self.place_matrix(self.outer.map_or(l2c, |o| o * l2c), buf)
+    }
+
+    /// Buffer pixel → output pixel matrix for a layer → (top-level) comp matrix.
+    fn place_matrix(&self, l2c: Mat3, buf: &Buf) -> Mat3 {
+        let s = self.opts.scale;
+        self.out_matrix()
+            * Mat3::scale(vec2(s, s))
+            * l2c
+            * Mat3::scale(vec2(1.0 / buf.scale, 1.0 / buf.scale))
+            * Mat3::translate(vec2(-buf.offset[0], -buf.offset[1]))
+    }
+
+    /// The collapsed precomp layers this comp is drawn through, outermost first.
+    fn links(&self) -> impl Iterator<Item = &Through<'a>> {
+        self.through.iter().map_while(Option::as_ref)
+    }
+
+    /// The shutter of a layer's motion blur: its comp's, or for a collapsed precomp's layers the
+    /// outermost containing comp's.
+    fn shutter(&self, ctx: &EvalCtx) -> Shutter {
+        let c: &Comp = match self.links().next() {
+            Some(l) => l.comp,
+            None => ctx.comp,
+        };
+        Shutter {
+            angle: c.shutter_angle / 360.0,
+            phase: c.shutter_phase / 360.0,
+            frame: c.frame_duration().seconds(),
+            samples: c.motion_blur_samples,
+            limit: c.motion_blur_adaptive_limit,
+        }
+    }
+
+    /// Whether a layer moves within the shutter: its own motion blur, or that of a collapsed
+    /// precomp layer it is drawn through.
+    fn blurred(&self, ctx: &EvalCtx, layer: &Layer) -> bool {
+        self.mb_on(ctx, layer) || (!self.through_lost && self.links().any(|l| l.blur))
+    }
+
+    /// The collapsed precomps' matrix (nested comp → the frame's comp) and the nested comp's time
+    /// `dt` seconds into the outermost comp's shutter: each precomp layer moves if it is motion
+    /// blurred, and times map down through each one (stretch, time remapping).
+    fn outer_at(&self, ctx: &EvalCtx, dt: f64) -> (Option<Mat3>, Tick) {
+        let shift = Tick::from_seconds_f64(dt);
+        let mut outer: Option<Mat3> = None;
+        let mut t: Option<Tick> = None;
+        for l in self.links() {
+            let at = EvalCtx { comp_id: l.comp_id, comp: l.comp, time: t.unwrap_or(l.time + shift), ..*ctx };
+            let (m, _) = if l.blur { at.layer_to_comp(l.layer) } else { EvalCtx { time: l.time, ..at }.layer_to_comp(l.layer) };
+            outer = Some(outer.map_or(m, |o| o * m));
+            t = Some(at.nested_time(l.layer));
+        }
+        (outer, t.unwrap_or(ctx.time + shift))
+    }
+
+    /// [`Self::buf_matrix`] for the motion-blur sub-sample `dt` seconds into the shutter: the
+    /// layer moves if it is motion blurred, the collapsed precomps above it if theirs are.
+    fn buf_matrix_at(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, dt: f64) -> Mat3 {
+        if self.through_lost || self.links().next().is_none() {
+            return self.buf_matrix(&ctx.at(ctx.time + Tick::from_seconds_f64(dt)), layer, buf);
+        }
+        let (outer, t) = self.outer_at(ctx, dt);
+        let lctx = if self.mb_on(ctx, layer) { ctx.at(t) } else { *ctx };
+        let (l2c, _) = lctx.layer_to_comp(layer);
+        self.place_matrix(outer.map_or(l2c, |o| o * l2c), buf)
+    }
+
+    /// Shape and text content that animates within the shutter (paths, Trim Paths, text
+    /// animators…) of a motion-blurred layer: the times its source is drawn at and averaged,
+    /// Samples Per Frame of them, as After Effects does for shape layers. `None` when the content
+    /// holds still (compared through its cache key, which leaves the transform out).
+    pub(crate) fn content_times(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Vec<Tick>> {
+        if !matches!(layer.source, LayerSource::Shape | LayerSource::Text) || !self.mb_on(ctx, layer) {
+            return None;
+        }
+        let sh = self.shutter(ctx);
+        if sh.angle <= 0.0 {
+            return None;
+        }
+        let n = if self.opts.draft { 4 } else { (sh.samples as usize).clamp(2, 64) };
+        let times: Vec<Tick> = (0..n).map(|i| self.outer_at(ctx, sh.offset(i, n)).1).collect();
+        let key = |t: Tick| cache::layer_key(&ctx.at(t), layer, 1.0, false, false);
+        let k0 = key(*times.first()?)?;
+        let moves = [times.get(n / 2), times.last()].into_iter().flatten().any(|t| key(*t) != Some(k0));
+        moves.then_some(times)
+    }
+
+    /// The layer's source drawn at each of `times` and averaged (premultiplied) on the union of
+    /// their bounds. Content that also changes its raster scale within the shutter, or would need
+    /// an outsized buffer, is drawn once.
+    pub(crate) fn blurred_source(&self, ctx: &EvalCtx, layer: &Layer, times: &[Tick]) -> Option<Buf> {
+        let bufs: Vec<Buf> = times.iter().filter_map(|t| self.source(&ctx.at(*t), layer)).collect();
+        let scale = bufs.first()?.scale;
+        // Pixel = layer point × scale + offset: with the largest offset every buffer lands at
+        // x + (off - its offset) ≥ 0.
+        let off = [0, 1].map(|i| bufs.iter().map(|b| b.offset[i]).fold(f64::MIN, f64::max));
+        let w = bufs.iter().map(|b| off[0] - b.offset[0] + b.img.width as f64).fold(0.0, f64::max).ceil();
+        let h = bufs.iter().map(|b| off[1] - b.offset[1] + b.img.height as f64).fold(0.0, f64::max).ceil();
+        if bufs.iter().any(|b| (b.scale - scale).abs() > 1e-9) || !(w * h).is_finite() || w * h > (1u64 << 26) as f64 {
+            return self.source(ctx, layer);
+        }
+        let mut acc = Image::new(w as u32, h as u32);
+        let k = 1.0 / bufs.len() as f32;
+        for b in &bufs {
+            let m = Mat3::translate(vec2(off[0] - b.offset[0], off[1] - b.offset[1]));
+            effectcraft_raster::accumulate_warp(&mut acc, &b.img, &m, effectcraft_raster::Sampling::Bilinear, k);
+        }
+        Some(Buf { img: acc, offset: off, scale })
+    }
+
+    /// A processed-layer cache key that also covers content motion blur (the averaged source
+    /// depends on the content at every sub-sample).
+    pub(crate) fn content_key(&self, ctx: &EvalCtx, layer: &Layer, key: Option<u64>) -> Option<u64> {
+        let k = self.mask_gate_key(ctx, layer, key)?;
+        // A layer that reads other layers through its effects' layer parameters gets them drawn
+        // by this renderer: the switches it passes down (Switches Affect Nested Comps, the
+        // precomp layers above, motion blur on) change those pixels, not just the layers' own.
+        let k = if cache::reads_layers(ctx, layer) { cache::derive(k, self.nested_look()) } else { k };
+        let Some(times) = self.content_times(ctx, layer) else { return Some(k) };
+        times.iter().try_fold(cache::derive(k, 0x6d62_6c72), |d, t| Some(cache::derive(d, cache::layer_key(&ctx.at(*t), layer, 1.0, false, false)?)))
+    }
+
+    /// Whether a layer is motion blurred: the render options, the comp's switch and the layer's
+    /// switch (limited by the precomp layers above when switches affect nested comps). Layer
+    /// motion, mask motion blur, effects that read the shutter and Advanced 3D all ask this.
+    pub(crate) fn mb_on(&self, ctx: &EvalCtx, layer: &Layer) -> bool {
+        self.opts.motion_blur && ctx.comp.enable_motion_blur && self.layer_motion_blur(layer)
+    }
+
+    /// What a layer's mask motion blur may do in this render (see [`masks::MaskBlur`]).
+    pub(crate) fn mask_blur(&self, ctx: &EvalCtx, layer: &Layer) -> masks::MaskBlur {
+        masks::MaskBlur {
+            allowed: self.opts.motion_blur && ctx.comp.enable_motion_blur && self.inherited.is_none_or(|(_, mb)| mb),
+            layer: self.layer_motion_blur(layer),
+            samples: if self.opts.draft { 4 } else { ctx.comp.motion_blur_samples as usize },
+        }
+    }
+
+    /// A cache key of a masked layer's buffer, told apart when mask motion blur can't run at all
+    /// in this render ([`Self::mask_blur`]'s gate: the render options, the precomp layers above).
+    /// The key has the layer's own motion blur state, but a mask set to On blurs without it.
+    pub(crate) fn mask_gate_key(&self, ctx: &EvalCtx, layer: &Layer, key: Option<u64>) -> Option<u64> {
+        let k = key?;
+        let masked = layer.masks().is_some_and(|m| !m.children.is_empty());
+        Some(if masked && !self.mask_blur(ctx, layer).allowed { cache::derive(k, 0x6d62_6f66) } else { k })
+    }
+
+    /// Motion-blur sub-samples for a layer buffer (1 = no motion blur). As in After Effects, a 2D
+    /// layer gets about one sample per output pixel its corners travel during the shutter,
+    /// at least Samples Per Frame and at most the comp's Adaptive Sample Limit; a layer that
+    /// does not move within the shutter is drawn once.
+    fn mb_samples(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> usize {
+        if !self.blurred(ctx, layer) {
+            return 1;
+        }
+        let travel = self.shutter_travel(ctx, layer, buf);
+        if travel < 1e-3 {
+            return 1;
+        }
+        if self.opts.draft {
+            return 4;
+        }
+        let sh = self.shutter(ctx);
+        adaptive_samples(travel, sh.samples, sh.limit)
+    }
+
+    /// Largest distance (output pixels) a corner of the layer buffer moves during the shutter,
+    /// measured along the path at a few points.
+    fn shutter_travel(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> f64 {
+        let sh = self.shutter(ctx);
+        let (w, h) = (buf.img.width as f64, buf.img.height as f64);
+        let corners = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h), (w * 0.5, h * 0.5)];
+        const PROBES: usize = 8;
+        let mut prev: Option<Vec<effectcraft_geom::Vec2>> = None;
+        let mut travel = vec![0.0f64; corners.len()];
+        for i in 0..PROBES {
+            let m = self.buf_matrix_at(ctx, layer, buf, sh.offset(i, PROBES));
+            let pts: Vec<_> = corners.iter().map(|&(x, y)| m.apply(vec2(x, y))).collect();
+            if let Some(p) = &prev {
+                for (k, (a, b)) in p.iter().zip(&pts).enumerate() {
+                    travel[k] += (b.x - a.x).hypot(b.y - a.y);
+                }
+            }
+            prev = Some(pts);
+        }
+        travel.into_iter().fold(0.0, f64::max)
+    }
+
+    /// Canvas pixels that compositing `buf` for `layer` can change: the transformed buffer's
+    /// bounds plus the resampling footprint. Stencil/silhouette modes, motion blur and
+    /// perspective fall back to the whole canvas.
+    ///
+    /// A quantised buffer placed pixel-exactly (integer translation, Normal, 100%) over a blank
+    /// canvas leaves exactly its own (quantised) pixels: nothing to re-quantise.
+    fn footprint(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, opacity: f32, blank: bool) -> Region {
+        if layer.blend_mode.is_stencil() || self.mb_samples(ctx, layer, buf) > 1 {
+            return Region::Full;
+        }
+        let m = self.buf_matrix(ctx, layer, buf);
+        if !m.is_affine() {
+            return Region::Full;
+        }
+        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
+        let k = &m.0;
+        let integral = |v: f64| v == v.round();
+        if blank
+            && layer.blend_mode == BlendMode::Normal
+            && opacity == 1.0
+            && !matte
+            && !layer.preserve_transparency
+            && self.pipe.to_blend().is_none()
+            && k[0][0] == 1.0
+            && k[1][1] == 1.0
+            && k[0][1] == 0.0
+            && k[1][0] == 0.0
+            && integral(k[0][2])
+            && integral(k[1][2])
+        {
+            return Region::Empty;
+        }
+        let (w, h) = (buf.img.width as f64, buf.img.height as f64);
+        let c = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h)].map(|(x, y)| m.apply(vec2(x, y)));
+        let (x0, x1) = (c.iter().map(|p| p.x).fold(f64::INFINITY, f64::min), c.iter().map(|p| p.x).fold(f64::NEG_INFINITY, f64::max));
+        let (y0, y1) = (c.iter().map(|p| p.y).fold(f64::INFINITY, f64::min), c.iter().map(|p| p.y).fold(f64::NEG_INFINITY, f64::max));
+        color::PxRect::covering(x0, y0, x1, y1, 3.0).map_or(Region::Full, Region::Rect)
+    }
+
+    /// How a processed layer buffer lands in the output: one buffer → output matrix, or one per
+    /// motion-blur sub-sample (averaged), with the layer's sampling filter and dissolve seed.
+    pub fn placement(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> Placement {
+        let samples = self.mb_samples(ctx, layer, buf);
+        let (sampling, seed) = (self.sampling(layer), layer.id.0 as u32);
+        if samples <= 1 {
+            return Placement { matrices: vec![self.buf_matrix(ctx, layer, buf)], sampling, seed };
+        }
+        let sh = self.shutter(ctx);
+        let matrices = (0..samples).map(|i| self.buf_matrix_at(ctx, layer, buf, sh.offset(i, samples))).collect();
+        Placement { matrices, sampling, seed }
+    }
+
+    /// Draw a processed layer into `target` (transform, motion blur) with `mode`/`opacity`.
+    pub(crate) fn place(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, target: &mut Image, mode: BlendMode, opacity: f32) {
+        self.place_changed(ctx, layer, buf, target, PlacementBlend { mode, opacity, quantize: None });
+    }
+
+    /// [`Self::place`], returning the target pixels it changed when the warp tracked them (then
+    /// also quantised to `quantize` levels; see [`composite_warp_changed`]).
+    fn place_changed(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, target: &mut Image, blend: PlacementBlend) -> Option<[u32; 4]> {
+        let PlacementBlend { mode, opacity, quantize } = blend;
+        let pl = self.placement(ctx, layer, buf);
+        let opts = WarpOpts { sampling: pl.sampling, opacity, mode, seed: pl.seed, clip: None };
+        if let [m] = pl.matrices.as_slice() {
+            return composite_warp_changed(target, &buf.img, m, &opts, quantize);
+        }
+        // Sub-samples sum straight into one buffer (each warp is row-parallel).
+        let mut acc = Image::new(target.width, target.height);
+        let k = 1.0 / pl.matrices.len() as f32;
+        for m in &pl.matrices {
+            effectcraft_raster::accumulate_warp(&mut acc, &buf.img, m, opts.sampling, k);
+        }
+        target.blend_from(&acc, mode, opacity, pl.seed);
+        None
+    }
+
+    /// Draw a 2D layer into `canvas`; returns the region it may have changed.
+    pub(crate) fn draw_layer(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image, blank: bool) -> Region {
+        let opacity = ctx.opacity(layer) as f32 * self.opacity_mul;
+        if self.quality(layer) == Quality::Wireframe && !layer.switches.adjustment {
+            self.draw_wireframe(ctx, layer, canvas);
+            return Region::Full;
+        }
+        if opacity <= 0.0 && !layer.switches.adjustment {
+            return Region::Empty;
+        }
+        if layer.switches.adjustment {
+            self.draw_adjustment(ctx, layer, canvas, opacity);
+            return Region::Full;
+        }
+        let mut timing = self.profile.map(|_| LayerTiming { depth: self.depth, layer: layer.name.clone(), ..Default::default() });
+        let t0 = web_time::Instant::now();
+        let Some(st) = self.styled(ctx, layer, timing.as_mut()) else { return Region::Empty };
+        let st = self.styled_to_blend(st);
+        let t1 = web_time::Instant::now();
+        let changed = if st.plain {
+            // Pixels the warp tracks are quantised as it blends them (nothing left to do); the
+            // footprint is still needed when it doesn't, or when no pixel needs quantising.
+            let footprint = self.footprint(ctx, layer, &st.body, opacity, blank);
+            let quantize = if footprint == Region::Empty { None } else { self.pipe.levels };
+            match self.composite_layer(ctx, layer, &st.body, canvas, opacity, quantize) {
+                Some(_) if quantize.is_some() => Region::Empty,
+                drawn => narrow(footprint, drawn),
+            }
+        } else {
+            self.composite_styled(ctx, layer, &st, canvas, opacity);
+            Region::Full
+        };
+        if let (Some(prof), Some(mut timing)) = (self.profile, timing) {
+            timing.process_ms = (t1 - t0).as_secs_f64() * 1e3;
+            timing.composite_ms = t1.elapsed().as_secs_f64() * 1e3;
+            if let Ok(mut v) = prof.lock() {
+                v.push(timing);
+            }
+        }
+        changed
+    }
+
+    /// Composite a styled layer: exterior passes with their own modes, then the body with the
+    /// layer's mode; the layer's opacity fades the whole stack. Knockout clears what is below the
+    /// layer's content; switched-off R/G/B channels keep the values below.
+    fn composite_styled(&self, ctx: &EvalCtx, layer: &Layer, st: &StyledLayer, canvas: &mut Image, opacity: f32) {
+        let bl = styles::blending(ctx, layer);
+        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
+        if matte || layer.preserve_transparency {
+            let mut iso = Image::new(canvas.width, canvas.height);
+            for (b, m) in &st.passes {
+                self.place(ctx, layer, b, &mut iso, *m, 1.0);
+            }
+            self.place(ctx, layer, &st.body, &mut iso, BlendMode::Normal, 1.0);
+            self.composite_iso(ctx, layer, iso, canvas, opacity);
+            return;
+        }
+        let mut tmp = canvas.clone();
+        if bl.knockout > 0 {
+            let mut k = Image::new(canvas.width, canvas.height);
+            self.place(ctx, layer, &st.content, &mut k, BlendMode::Normal, 1.0);
+            tmp.data.par_iter_mut().zip(k.data.par_iter()).for_each(|(p, q)| {
+                let keep = 1.0 - q[3].clamp(0.0, 1.0);
+                for c in p.iter_mut() {
+                    *c *= keep;
+                }
+            });
+        }
+        for (b, m) in &st.passes {
+            self.place(ctx, layer, b, &mut tmp, *m, 1.0);
+        }
+        self.place(ctx, layer, &st.body, &mut tmp, layer.blend_mode, 1.0);
+        let ch = bl.channels;
+        canvas.data.par_iter_mut().zip(tmp.data.par_iter()).for_each(|(c, t)| {
+            for i in 0..4 {
+                let v = if i < 3 && !ch[i] { c[i] } else { t[i] };
+                c[i] += (v - c[i]) * opacity;
+            }
+        });
+    }
+
+    /// Composite a plain layer; returns the canvas pixels it changed when they are known (then
+    /// also quantised to `quantize` levels).
+    fn composite_layer(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, canvas: &mut Image, opacity: f32, quantize: Option<f32>) -> Option<[u32; 4]> {
+        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
+        if !matte && !layer.preserve_transparency {
+            return self.place_changed(ctx, layer, buf, canvas, PlacementBlend { mode: layer.blend_mode, opacity, quantize });
+        }
+        // Render in isolation, then matte / preserve transparency, then blend.
+        let mut iso = Image::new(canvas.width, canvas.height);
+        self.place(ctx, layer, buf, &mut iso, BlendMode::Normal, 1.0);
+        self.composite_iso(ctx, layer, iso, canvas, opacity);
+        None
+    }
+
+    /// Apply the track matte / preserve transparency to an isolated layer render, then blend.
+    pub(crate) fn composite_iso(&self, ctx: &EvalCtx, layer: &Layer, iso: Image, canvas: &mut Image, opacity: f32) {
+        self.composite_iso_with(ctx, layer, iso, canvas, opacity, None);
+    }
+
+    /// [`Self::composite_iso`] with the track matte's pixels already drawn (`matte`, e.g. a 3D
+    /// matte seen through the camera); otherwise the matte layer is placed in 2D.
+    pub(crate) fn composite_iso_with(&self, ctx: &EvalCtx, layer: &Layer, mut iso: Image, canvas: &mut Image, opacity: f32, matte_img: Option<Image>) {
+        self.apply_track_matte(ctx, layer, &mut iso, matte_img);
+        if layer.preserve_transparency {
+            iso.data.par_iter_mut().zip(canvas.data.par_iter()).for_each(|(p, q)| {
+                for c in p.iter_mut() {
+                    *c *= q[3];
+                }
+            });
+        }
+        canvas.blend_from(&iso, layer.blend_mode, opacity, layer.id.0 as u32);
+    }
+
+    /// Multiply `img` (comp-sized) by the layer's track matte, if it has one; `matte_img` as in
+    /// [`Self::composite_iso_with`].
+    fn apply_track_matte(&self, ctx: &EvalCtx, layer: &Layer, img: &mut Image, matte_img: Option<Image>) {
+        let matte = layer.track_matte.and_then(|tm| ctx.comp.layer(tm.layer).filter(|m| m.id != layer.id).map(|m| (m, tm.kind)));
+        if let Some((m, kind)) = matte {
+            let mimg = match matte_img {
+                Some(i) if i.width == img.width && i.height == img.height => i,
+                _ => {
+                    let mut mimg = Image::new(img.width, img.height);
+                    if m.is_active_at(ctx.time)
+                        && let Some(mb) = self.layer_buf(ctx, m)
+                    {
+                        let mo = ctx.opacity(m) as f32;
+                        self.place(ctx, m, &mb, &mut mimg, BlendMode::Normal, mo);
+                    }
+                    mimg
+                }
+            };
+            img.data.par_iter_mut().zip(mimg.data.par_iter()).for_each(|(p, q)| {
+                let k = match kind {
+                    MatteKind::Alpha => q[3],
+                    MatteKind::AlphaInverted => 1.0 - q[3],
+                    MatteKind::Luma => effectcraft_color::luminance(q[0], q[1], q[2]),
+                    MatteKind::LumaInverted => 1.0 - effectcraft_color::luminance(q[0], q[1], q[2]),
+                }
+                .clamp(0.0, 1.0);
+                for c in p.iter_mut() {
+                    *c *= k;
+                }
+            });
+        }
+    }
+
+    /// Adjustment layer: effects applied to the comp below, limited to the layer's footprint
+    /// and its track matte, and blended back in the layer's blend mode.
+    fn draw_adjustment(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image, opacity: f32) {
+        let Some(mut foot) = self.source(ctx, layer) else { return };
+        let _ = masks::apply(ctx, layer, &mut foot, self.mask_blur(ctx, layer));
+        let mut matte = Image::new(canvas.width, canvas.height);
+        self.place(ctx, layer, &foot, &mut matte, BlendMode::Normal, 1.0);
+        self.apply_track_matte(ctx, layer, &mut matte, None);
+        let o = self.roi_offset().map(|(x, y, _, _)| [-x, -y]).unwrap_or([0.0; 2]);
+        let mut below = Buf { img: canvas.clone(), offset: o, scale: self.opts.scale };
+        // Effects run in the working space, not the linear blending space.
+        if let Some(c) = self.pipe.from_blend() {
+            color::convert(&mut below.img, &c);
+        }
+        let mut adjusted = self.apply_effects(ctx, layer, below, true);
+        // An effect that changed the frame (Motion Tile's Output size): back onto the canvas.
+        if let Some((dx, dy)) =
+            effectcraft_effects::adjustment_crop(adjusted.offset, o, (adjusted.img.width, adjusted.img.height), (canvas.width, canvas.height))
+        {
+            adjusted.img = adjusted.img.crop(dx, dy, canvas.width, canvas.height);
+        }
+        if let Some(c) = self.pipe.to_blend() {
+            color::convert(&mut adjusted.img, &c);
+        }
+        if adjusted.img.width != canvas.width || adjusted.img.height != canvas.height {
+            return;
+        }
+        if layer.blend_mode != BlendMode::Normal {
+            // The adjusted comp is a layer in that mode over the comp below, as in After Effects:
+            // an adjustment layer with no effects in Screen screens the comp with itself (#2618).
+            let mut iso = adjusted.img;
+            iso.data.par_iter_mut().zip(matte.data.par_iter()).for_each(|(p, m)| {
+                for c in p.iter_mut() {
+                    *c *= m[3];
+                }
+            });
+            canvas.blend_from(&iso, layer.blend_mode, opacity, layer.id.0 as u32);
+            return;
+        }
+        canvas.data.par_iter_mut().zip(adjusted.img.data.par_iter()).zip(matte.data.par_iter()).for_each(|((c, a), m)| {
+            let k = m[3] * opacity;
+            for i in 0..4 {
+                c[i] += (a[i] - c[i]) * k;
+            }
+        });
+    }
+}
+
+/// A layer ready to composite (see [`Renderer::styled_layer`]).
+pub struct StyledLayer {
+    /// Exterior style passes (Drop Shadow, Outer Glow) with their blend modes.
+    pub passes: Vec<(Arc<Buf>, BlendMode)>,
+    pub body: Arc<Buf>,
+    /// Pre-style pixels (knockout shape).
+    pub content: Arc<Buf>,
+    /// Styled cache key (the content key when plain).
+    pub(crate) key: Option<u64>,
+    /// Content cache key.
+    ckey: Option<u64>,
+    /// No layer styles: composite `body` the usual way.
+    pub plain: bool,
+    /// The source files the layer's buffers were made of (see [`crate::reads`]).
+    pub(crate) files: Arc<crate::reads::ReadFiles>,
+}
+
+/// Where a layer buffer lands (see [`Renderer::placement`]).
+#[derive(Clone, Debug)]
+pub struct Placement {
+    /// Buffer pixel → output pixel; several = motion-blur sub-samples (equal weights).
+    pub matrices: Vec<Mat3>,
+    pub sampling: effectcraft_raster::Sampling,
+    /// Dissolve noise seed.
+    pub seed: u32,
+}
+
+/// The part of `footprint` a warp actually changed (`drawn`, see [`composite_warp_changed`]):
+/// pixels it left alone are still quantised.
+fn narrow(footprint: Region, drawn: Option<[u32; 4]>) -> Region {
+    let Some([x0, y0, x1, y1]) = drawn else { return footprint };
+    if x0 >= x1 || y0 >= y1 {
+        return Region::Empty;
+    }
+    let r = color::PxRect { x0, y0, x1, y1 };
+    match footprint {
+        Region::Empty => Region::Empty,
+        Region::Full => Region::Rect(r),
+        Region::Rect(f) => {
+            let q = color::PxRect { x0: r.x0.max(f.x0), y0: r.y0.max(f.y0), x1: r.x1.min(f.x1), y1: r.y1.min(f.y1) };
+            if q.x0 >= q.x1 || q.y0 >= q.y1 { Region::Empty } else { Region::Rect(q) }
+        }
+    }
+}
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 54948c8dd..fd378c591 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -17,6 +17,7 @@ use color::Region;
 pub mod eval;
 pub mod masks;
 pub mod passes;
+pub mod reads;
 pub mod shapes;
 pub mod styles;
 pub mod text;
@@ -32,558 +33,35 @@ use effectcraft_effects::{Buf, EffectCtx, EffectEnv, EffectHost, LayerPixels, Pa
 use effectcraft_geom::{Mat3, Mat4, vec2};
 use effectcraft_project::{Comp, Footage, FootageKind, FrameBlend, GroupKind, ItemId, ItemKind, Layer, LayerSource, MatteKind, Project, Quality, Sampling};
 pub use effectcraft_raster::Image;
-use effectcraft_raster::{WarpOpts, composite_warp};
+use effectcraft_raster::{WarpOpts, composite_warp_changed};
 use effectcraft_time::{FrameRate, TICKS_PER_SECOND, Tick};
 pub use eval::{EvalCtx, ExprHost, effect_bounds, source_size};
 use rayon::prelude::*;
 
-/// How a [`FootageSource`] hands over float footage (OpenEXR, float TIFF), whose values are
-/// linear light: encoded with a curve, as the compositor takes footage, or as stored. Other
-/// footage is decoded the same way whatever it says. Interpret Footage ▸ Preserve RGB always
-/// reads the values as stored.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
-pub enum FloatCurve {
-    /// The sRGB curve (managed projects, and Working Gamma 2.2).
-    #[default]
-    Srgb,
-    /// A pure 2.4 power curve (no working space, Working Gamma 2.4).
-    Gamma24,
-    /// The linear values as stored (Interpret As Linear Light encodes them afterwards).
-    Linear,
-}
+mod accel;
+mod footage;
+mod frames;
+mod fx_host;
+mod layers;
+mod opts;
+mod pipeline;
 
-/// Supplies decoded footage frames (implemented by the media layer).
-pub trait FootageSource: Send + Sync {
-    /// The frame of `item` at source time `t`, straight from the file (any size).
-    fn frame(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<Image>>;
-    /// [`FootageSource::frame`] for a render that shows it at `width` × `height`, at most half its
-    /// size: either that frame or, when the source can make it more cheaply than the whole frame
-    /// (movies, see `effectcraft-media`), the frame already resampled to that size as
-    /// [`effectcraft_raster::resample`] would.
-    fn frame_at_size(&self, item: ItemId, footage: &Footage, t: Tick, _width: u32, _height: u32) -> Option<Arc<Image>> {
-        self.frame(item, footage, t)
-    }
-    /// [`FootageSource::frame`] (`size: None`) or [`FootageSource::frame_at_size`] with float
-    /// footage handed over as `float` says ([`FootageSource::frame`] uses [`FloatCurve::Srgb`]).
-    /// Sources without float footage can leave the default, which ignores `float`.
-    fn frame_with(&self, item: ItemId, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) -> Option<Arc<Image>> {
-        let _ = float;
-        match size {
-            Some((w, h)) => self.frame_at_size(item, footage, t, w, h),
-            None => self.frame(item, footage, t),
-        }
-    }
-    /// `frames` interleaved stereo sample frames of `item`'s audio from source time `t` at
-    /// `rate` Hz (`None` when unavailable). The first sample is `t.to_units_floor(rate)`;
-    /// a sample boundary uses the earliest representable tick that selects that sample.
-    fn audio(&self, _item: ItemId, _footage: &Footage, _t: Tick, _frames: usize, _rate: u32) -> Option<Vec<f32>> {
-        None
-    }
-    /// Auxiliary 3D channels of `item` at source time `t` (multi-layer OpenEXR: depth, IDs,
-    /// Cryptomatte, any named channel), with `scale` relative to the file's pixels. `None` when
-    /// the footage has none.
-    fn aux(&self, _item: ItemId, _footage: &Footage, _t: Tick) -> Option<Arc<effectcraft_raster::AuxChannels>> {
-        None
-    }
-    /// The parsed 3D model of a [`effectcraft_project::FootageKind::Model`] item (Advanced 3D).
-    fn model(&self, _item: ItemId, _footage: &Footage) -> Option<Arc<effectcraft_model::Model>> {
-        None
-    }
-    /// Set the decoded-frame cache budget in bytes (Settings ▸ Memory & CPU); sources without
-    /// a cache ignore it.
-    fn set_cache_budget(&self, _bytes: usize) {}
-    /// Drop the decoded frames it keeps (Edit ▸ Purge ▸ All Memory / Image Cache Memory): the
-    /// next reads decode again. Sources without a cache ignore it.
-    fn purge(&self) {}
-    /// The file at `path` changed on disk (Reload Footage): drop what it keeps of it (decoded
-    /// frames, open decoders, parsed models), so the next reads see the new contents. Sources
-    /// without a cache ignore it.
-    fn forget(&self, _path: &str) {}
-    /// Settings ▸ Disk ▸ Conformed Audio Folder: where decoded audio is kept between reads
-    /// (`None` = off); sources that don't decode audio ignore it.
-    fn set_conform_folder(&self, _folder: Option<std::path::PathBuf>) {}
-    /// The decoded-frame cache budget in bytes, if the source has a cache.
-    fn cache_budget(&self) -> Option<usize> {
-        None
-    }
-    /// Vector footage (SVG) rasterised at `scale` × its pixel size, for Continuously Rasterize.
-    /// `None` when the footage is not vector or cannot be read.
-    fn vector_frame(&self, _item: ItemId, _footage: &Footage, _scale: f64) -> Option<Arc<Image>> {
-        None
-    }
-    /// Run `f`, which reads frames from this source, as work that can be called off: once
-    /// `cancel` is set, long decodes it starts (a movie seeking back to a keyframe and decoding
-    /// forward) stop early and their frames come back `None`. Sources that can't stop a decode
-    /// just run `f`. See [`CancellableFootage`].
-    fn cancellable(&self, _cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
-        f()
-    }
-    /// Reads through this source have been called off: frames may have come back `None` that
-    /// exist, so what was made from them must not be kept.
-    fn called_off(&self) -> bool {
-        false
-    }
-    /// Why `footage` shows no picture although its file is there: a read of it failed because
-    /// no decoder handles its codec, profile, chroma format or bit depth, or the stream is damaged
-    /// (e.g. "H.264 (High 4:2:2) isn't supported by the built-in decoder: ..."). `None` while it
-    /// decodes, and for sources that don't track failures. Stays set until the file is forgotten.
-    fn problem(&self, _footage: &Footage) -> Option<String> {
-        None
-    }
-}
-
-/// A render's view of a [`FootageSource`] whose frame reads can be called off with `cancel`
-/// (a viewer frame nobody waits for any more, #329). Every read goes through
-/// [`FootageSource::cancellable`] on its own, so reads made for this render on another thread
-/// (a parallel loop) answer to this render's flag, and reads for other renders never do.
-pub struct CancellableFootage<'a> {
-    pub inner: &'a dyn FootageSource,
-    pub cancel: Arc<AtomicBool>,
-}
-
-impl CancellableFootage<'_> {
-    fn read<R>(&self, f: impl FnOnce() -> Option<R>) -> Option<R> {
-        if self.cancel.load(Ordering::Relaxed) {
-            return None;
-        }
-        let (mut f, mut out) = (Some(f), None);
-        self.inner.cancellable(&self.cancel, &mut || out = f.take().and_then(|f| f()));
-        out
-    }
-}
-
-impl FootageSource for CancellableFootage<'_> {
-    fn frame(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<Image>> {
-        self.read(|| self.inner.frame(item, footage, t))
-    }
-    fn frame_at_size(&self, item: ItemId, footage: &Footage, t: Tick, width: u32, height: u32) -> Option<Arc<Image>> {
-        self.read(|| self.inner.frame_at_size(item, footage, t, width, height))
-    }
-    fn audio(&self, item: ItemId, footage: &Footage, t: Tick, frames: usize, rate: u32) -> Option<Vec<f32>> {
-        self.inner.audio(item, footage, t, frames, rate)
-    }
-    fn aux(&self, item: ItemId, footage: &Footage, t: Tick) -> Option<Arc<effectcraft_raster::AuxChannels>> {
-        self.inner.aux(item, footage, t)
-    }
-    fn model(&self, item: ItemId, footage: &Footage) -> Option<Arc<effectcraft_model::Model>> {
-        self.inner.model(item, footage)
-    }
-    fn set_cache_budget(&self, bytes: usize) {
-        self.inner.set_cache_budget(bytes)
-    }
-    fn purge(&self) {
-        self.inner.purge()
-    }
-    fn forget(&self, path: &str) {
-        self.inner.forget(path)
-    }
-    fn set_conform_folder(&self, folder: Option<std::path::PathBuf>) {
-        self.inner.set_conform_folder(folder)
-    }
-    fn cache_budget(&self) -> Option<usize> {
-        self.inner.cache_budget()
-    }
-    fn vector_frame(&self, item: ItemId, footage: &Footage, scale: f64) -> Option<Arc<Image>> {
-        self.inner.vector_frame(item, footage, scale)
-    }
-    fn cancellable(&self, cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
-        self.inner.cancellable(cancel, f)
-    }
-    fn called_off(&self) -> bool {
-        self.cancel.load(Ordering::Relaxed) || self.inner.called_off()
-    }
-    fn problem(&self, footage: &Footage) -> Option<String> {
-        self.inner.problem(footage)
-    }
-    fn frame_with(&self, item: ItemId, footage: &Footage, t: Tick, size: Option<(u32, u32)>, float: FloatCurve) -> Option<Arc<Image>> {
-        self.read(|| self.inner.frame_with(item, footage, t, size, float))
-    }
-}
-
-/// Footage that can be rasterised at any scale (SVG).
-pub fn is_vector_footage(f: &Footage) -> bool {
-    matches!(f.codec.as_str(), "SVG" | "PDF" | "AI" | "EPS")
-}
-
-/// Layer parameters and audio for effects (see [`effectcraft_effects::EffectHost`]). What it
-/// hands out is in effect space (see [`effect_bounds`]): the other layer's for its pixels, the
-/// running layer's for its own frames and the comp scene.
-struct FxHost<'r, 'a, 'c> {
-    r: &'r Renderer<'a>,
-    ctx: &'c EvalCtx<'a>,
-    layer: &'c Layer,
-    /// Where the stack's effect space starts in layer coordinates (zero on adjustment layers,
-    /// whose effects run on the comp below).
-    origin: [f64; 2],
-    /// Index of the effect being rendered (bounds `self_at` to effects before it).
-    index: usize,
-    original: Option<&'c Buf>,
-}
-
-impl FxHost<'_, '_, '_> {
-    /// Another layer's pixels for a layer parameter, in its effect space; `layer_space`: `buf`
-    /// is still in layer space (its source or its content).
-    fn pixels(&self, other: &Layer, mut buf: Buf, layer_space: bool) -> LayerPixels {
-        let (size, origin) = self.ctx.effect_bounds(other);
-        if layer_space {
-            buf.rebase(origin);
-        }
-        LayerPixels { buf, size }
-    }
-}
-
-/// The comp's camera and first light relative to `layer`, in its layer pixels (see
-/// [`EffectHost::comp_scene`]): the comp camera's view of the layer (as if 3D at its transform),
-/// brought back into the layer's own pixel grid through the inverse of how the layer itself
-/// composites.
-pub(crate) fn comp_scene(ctx: &EvalCtx, layer: &Layer) -> Option<effectcraft_effects::CompScene> {
-    let world = ctx.world_matrix(layer);
-    let (cam, _, _) = ctx.camera();
-    let p = (cam * world).0;
-    let back = ctx.layer_to_comp(layer).0.inverse()?.0;
-    let rows = [p[0], p[1], p[3]];
-    let camera: [[f64; 4]; 3] = std::array::from_fn(|i| std::array::from_fn(|j| (0..3).map(|k| back[i][k] * rows[k][j]).sum()));
-    let inv = world.inverse();
-    let light = three_d::light::lights_at(ctx).first().and_then(|l| {
-        let inv = inv.as_ref()?;
-        let pos = inv.apply(l.pos);
-        let dir = inv.apply_vec(l.dir);
-        let len = (dir.x * dir.x + dir.y * dir.y + dir.z * dir.z).sqrt().max(1e-12);
-        let kind = match l.kind {
-            effectcraft_project::LightKind::Parallel => 0,
-            effectcraft_project::LightKind::Ambient => 2,
-            _ => 1,
-        };
-        Some(effectcraft_effects::CompLight { pos: [pos.x, pos.y, pos.z], dir: [dir.x / len, dir.y / len, dir.z / len], color: l.color, kind })
-    });
-    let camera_layer = ctx.comp.active_camera(ctx.time).is_some();
-    Some(effectcraft_effects::CompScene { camera: Some(camera), camera_layer, light })
-}
-
-/// Nesting limit for effects that render layers (other layers, other times).
-const MAX_FX_DEPTH: usize = 8;
-
-impl EffectHost for FxHost<'_, '_, '_> {
-    fn original(&self) -> Option<&Buf> {
-        self.original
-    }
-
-    fn particles(&self) -> Option<&dyn effectcraft_effects::psim::ParticleSim> {
-        self.r.active_accel().and_then(|a| a.particles())
-    }
-    fn layer(&self, id: u64, masks_and_effects: bool) -> Option<LayerPixels> {
-        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
-        if (other.id == self.layer.id && masks_and_effects) || self.r.depth > MAX_FX_DEPTH {
-            return None;
-        }
-        let sub = self.r.nested();
-        // The cached layer buffer is shared; effects get their own copy.
-        let buf = if masks_and_effects { (*sub.content_buf(self.ctx, other)?).clone() } else { sub.source(self.ctx, other)? };
-        Some(self.pixels(other, buf, true))
-    }
-
-    fn layer_masks(&self, id: u64) -> Option<LayerPixels> {
-        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
-        if self.r.depth > MAX_FX_DEPTH {
-            return None;
-        }
-        let sub = self.r.nested();
-        let buf = (*sub.layer_input(self.ctx, other, 0)?).clone();
-        Some(self.pixels(other, buf, false))
-    }
-
-    fn audio(&self, id: u64, start: f64, frames: usize, rate: u32) -> Option<Vec<f32>> {
-        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
-        let LayerSource::Footage { item } = &other.source else { return None };
-        let ItemKind::Footage(f) = &self.r.project.item(*item)?.kind else { return None };
-        if !f.has_audio {
-            return None;
-        }
-        let st = other.layer_time(Tick::from_seconds_f64(start));
-        self.r.footage.audio(*item, f, st, frames, rate)
-    }
-
-    fn self_at(&self, layer_time: f64, effects: usize) -> Option<Buf> {
-        if self.r.depth > MAX_FX_DEPTH || self.layer.switches.adjustment {
-            return None;
-        }
-        let n = effects.min(self.index);
-        let t = self.layer.comp_time(Tick::from_seconds_f64(layer_time));
-        let sub = self.r.nested();
-        sub.layer_input(&self.ctx.at(t), self.layer, n).map(|b| (*b).clone())
-    }
-
-    fn aux(&self) -> Option<Arc<effectcraft_raster::AuxChannels>> {
-        match &self.layer.source {
-            LayerSource::Footage { item } => {
-                let ItemKind::Footage(f) = &self.r.project.item(*item)?.kind else { return None };
-                let a = self.r.footage.aux(*item, f, self.ctx.source_time(self.layer))?;
-                // Aux pixels per layer pixel (the layer is the footage at its nominal size).
-                if f.width > 0 && a.width > 0 {
-                    let mut a = (*a).clone();
-                    a.scale = a.width as f64 / f.width as f64;
-                    return Some(Arc::new(a));
-                }
-                Some(a)
-            }
-            LayerSource::Comp { item } => {
-                if self.r.depth > MAX_FX_DEPTH || self.r.project.comp_contains(*item, self.ctx.comp_id) {
-                    return None;
-                }
-                self.r.nested().comp_aux(*item, self.ctx.nested_time(self.layer)).map(Arc::new)
-            }
-            _ => None,
-        }
-    }
-
-    fn params_at(&self, layer_time: f64) -> Option<Params> {
-        let g = self.layer.effects()?.groups().nth(self.index)?;
-        let ctx = self.ctx.at(self.layer.comp_time(Tick::from_seconds_f64(layer_time)));
-        Some(effectcraft_effects::flatten_params(g, &mut |pr| ctx.value(self.layer, pr)))
-    }
-
-    fn comp_scene(&self) -> Option<effectcraft_effects::CompScene> {
-        Some(comp_scene(self.ctx, self.layer)?.rebased(self.origin))
-    }
-
-    fn layer_at(&self, id: u64, comp_time: f64, masks_and_effects: bool) -> Option<LayerPixels> {
-        let other = self.ctx.layer(effectcraft_project::LayerId(id))?;
-        if (other.id == self.layer.id && masks_and_effects) || !comp_time.is_finite() || self.r.depth > MAX_FX_DEPTH {
-            return None;
-        }
-        let ctx = self.ctx.at(Tick::from_seconds_f64(comp_time));
-        let sub = self.r.nested();
-        Some(if masks_and_effects {
-            self.pixels(other, (*sub.content_buf(&ctx, other)?).clone(), true)
-        } else if other.id == self.layer.id {
-            self.pixels(other, sub.source(&ctx, other)?, true)
-        } else {
-            // Preserve other-layer reads: time effects historically see source + masks.
-            self.pixels(other, (*sub.layer_input(&ctx, other, 0)?).clone(), false)
-        })
-    }
-}
-
-/// The Essential Properties overrides of a precomp layer, evaluated at the context time.
-pub fn essential_overrides(ctx: &EvalCtx, layer: &Layer) -> Vec<effectcraft_project::essential::Override> {
-    use effectcraft_project::essential;
-    let over = essential::overridden(layer);
-    let Some(g) = essential::group(layer).filter(|_| !over.is_empty()) else { return vec![] };
-    let mut out = vec![];
-    g.walk("", &mut |_, p| {
-        if over.contains(&p.uid)
-            && let Some(control) = essential::control_of(&p.match_id)
-        {
-            out.push(essential::Override { control, value: ctx.value(layer, p) });
-        }
-    });
-    out
-}
-
-/// No footage available (renders footage layers as transparent).
-pub struct NoFootage;
-impl FootageSource for NoFootage {
-    fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
-        None
-    }
-}
-
-/// Which compositor renders a frame (Project Settings ▸ Video Rendering and Effects).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Backend {
-    /// The CPU reference compositor (Mercury Software Only).
-    #[default]
-    Cpu,
-    /// The GPU compositor whenever an [`Accelerator`] is attached, whatever the project says.
-    Gpu,
-    /// The GPU compositor when an [`Accelerator`] is attached and the project's renderer is
-    /// Mercury GPU Acceleration (the viewer's choice); the CPU otherwise.
-    Auto,
-}
-
-impl Backend {
-    pub fn parse(s: &str) -> Option<Backend> {
-        match s.to_ascii_lowercase().as_str() {
-            "cpu" | "software" | "mercury software only" => Some(Backend::Cpu),
-            "gpu" | "mercury gpu acceleration" => Some(Backend::Gpu),
-            "auto" => Some(Backend::Auto),
-            _ => None,
-        }
-    }
-}
-
-/// One effect of a GPU effect chain (see [`Accelerator::effects`]).
-pub struct FxStep<'x> {
-    pub spec: &'static effectcraft_effects::EffectSpec,
-    pub ctx: EffectCtx<'x>,
-}
-
-/// A GPU (or other hardware) backend for the compositor. The CPU [`Renderer`] stays the
-/// reference: an accelerator renders what it supports and returns `None` for the rest, which
-/// then runs on the CPU. Implemented by `effectcraft-gpu`.
-pub trait Accelerator: Send + Sync {
-    /// Adapter / backend name for status readouts ("Apple M2 (Metal)").
-    fn name(&self) -> String;
-    /// Render a top-level comp frame (what [`Renderer::comp_frame`] returns). `None` = not
-    /// handled (the CPU renders it).
-    fn comp_frame(&self, r: &Renderer, comp: ItemId, t: Tick) -> Option<Image>;
-    /// The accelerator implements effect `id` with the CPU effect's semantics.
-    fn supports_effect(&self, id: &str) -> bool;
-    /// Run a chain of supported effects on `buf`, clamping and quantising to `levels` after
-    /// every effect when set (8/16 bpc). `None` = not handled.
-    fn effects(&self, chain: &[FxStep], buf: &Buf, levels: Option<f32>) -> Option<Buf>;
-    /// Rasterise and shade an Advanced 3D scene at its raster size (depth buffer, PBR, image
-    /// based light, shadow maps), with the CPU rasteriser's semantics
-    /// ([`three_d::adv::raster::render`]). `None` = not handled (the CPU renders it).
-    fn raster_3d(&self, _scene: &three_d::adv::Scene) -> Option<three_d::adv::Target> {
-        None
-    }
-    /// Render a whole prepared Advanced 3D run (every motion-blur sub-sample rasterised and
-    /// resolved, averaged, depth of field, encoding) with [`three_d::adv::render_prepared`]'s
-    /// semantics. `None` = not handled (the CPU path runs, using [`Self::raster_3d`]).
-    fn render_3d(&self, _run: &three_d::adv::Prepared) -> Option<three_d::adv::Rendered> {
-        None
-    }
-    /// A particle simulation backend (GPU particles) for the stepped particle effects, with
-    /// the CPU simulation's semantics. `None` = they simulate on the CPU.
-    fn particles(&self) -> Option<&dyn effectcraft_effects::psim::ParticleSim> {
-        None
-    }
-    /// Timing history [`Backend::Auto`] uses to send each comp's top-level frames to the
-    /// faster compositor. `None` = Auto always tries the accelerator first.
-    fn auto_pick(&self) -> Option<&AutoPick> {
-        None
-    }
-    /// Whether the accelerator can still render frames. `false` once it has stopped for good
-    /// (its device was lost or retired): every frame it is asked for falls back to the CPU, so
-    /// callers that limit frames in flight for it can stop doing so.
-    fn available(&self) -> bool {
-        true
-    }
-    /// Deferred readbacks: where a GPU readback cannot be waited for (WebGPU in a browser
-    /// worker), a frame renders in *passes*. A readback the accelerator does not have yet is
-    /// started, the step returns a cheap placeholder and the pass is marked missed
-    /// ([`Self::pass_missed`]); the caller waits for the readbacks in flight (asynchronously)
-    /// and renders the frame again, and the steps whose results arrived are served from them.
-    /// The frame is done after a pass with no miss. `frame_begin` forgets the previous frame's
-    /// results, `pass_begin` clears the miss. Synchronous accelerators never miss.
-    fn frame_begin(&self) {}
-    fn pass_begin(&self) {}
-    fn pass_missed(&self) -> bool {
-        false
-    }
-    /// Raised from a pass's first miss to its end (results computed meanwhile may hold
-    /// placeholders): give it to [`LayerCache::set_gate`] so they are not cached.
-    fn miss_gate(&self) -> Option<Arc<std::sync::atomic::AtomicBool>> {
-        None
-    }
-    /// With deferred readbacks: a future that resolves once the readbacks in flight have
-    /// landed (the browser delivers them from its event loop; natively the device is polled
-    /// before it returns, so the future is ready). `None` = nothing to wait for. See
-    /// [`passes::in_passes`].
-    fn settle(&self) -> Option<std::pin::Pin<Box<dyn std::future::Future<Output = ()> + '_>>> {
-        None
-    }
-}
-
-/// Where an effect stack runs (see [`Renderer::run_effects_on`]): a CPU buffer, or an image
-/// resident on an accelerator.
-pub trait FxTarget {
-    /// Run a chain of accelerator-supported effects (quantising after each to the bit depth).
-    /// `false` = not handled: the effects then run one by one through [`FxTarget::cpu`].
-    fn gpu(&mut self, steps: &[FxStep]) -> bool;
-    /// Run one CPU effect: `f` maps the buffer.
-    fn cpu(&mut self, f: &mut dyn FnMut(Buf) -> Buf);
-    /// Grow the buffer to cover its whole layer rectangle (`size` layer pixels from its own
-    /// corner, the `layer_size` handed to effects), as [`effectcraft_effects::Buf::cover`].
-    /// Authored buffers (text, shapes) only span their painted content; this gives the stack
-    /// the room a sized source's buffer already has (#659).
-    fn cover(&mut self, size: [f64; 2]) {
-        self.cpu(&mut |mut buf| {
-            buf.cover(size);
-            buf
-        });
-    }
-}
-
-/// The CPU effect target (GPU chains go through [`Accelerator::effects`]: upload, readback).
-struct CpuFx<'a> {
-    accel: Option<&'a dyn Accelerator>,
-    levels: Option<f32>,
-    buf: Option<Buf>,
-}
-
-impl FxTarget for CpuFx<'_> {
-    fn gpu(&mut self, steps: &[FxStep]) -> bool {
-        let (Some(a), Some(b)) = (self.accel, &self.buf) else { return false };
-        match a.effects(steps, b, self.levels) {
-            Some(out) => {
-                self.buf = Some(out);
-                true
-            }
-            None => false,
-        }
-    }
-    fn cpu(&mut self, f: &mut dyn FnMut(Buf) -> Buf) {
-        if let Some(b) = self.buf.take() {
-            self.buf = Some(f(b));
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, serde::Serialize, serde::Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct RenderOpts {
-    /// Output scale relative to comp pixels (1 = Full, 0.5 = Half…).
-    pub scale: f64,
-    pub motion_blur: bool,
-    /// Render guide layers (viewer only). Only the top-level comp's own guide layers: nested
-    /// comps (precomps, collapsed precomps, comps read by effects) never draw theirs, as in
-    /// After Effects (see [`Renderer::nested_opts`]).
-    pub guides: bool,
-    /// Draft quality: fewer motion-blur samples, bilinear only.
-    pub draft: bool,
-    /// 3D view camera override (viewer Front/Top/Custom views); None = the comp's active camera.
-    pub view: Option<three_d::CameraState>,
-    /// CPU or GPU compositor (the GPU needs [`Renderer::accel`]).
-    pub backend: Backend,
-    /// Region of interest `[x, y, w, h]` in comp pixels (viewer only): the top-level frame covers
-    /// just this rectangle, and only its pixels are composited.
-    pub roi: Option<[f64; 4]>,
-    /// Which proxies stand in for footage and compositions (Render Settings ▸ Proxy Use).
-    pub proxy: effectcraft_project::render_queue::ProxyUse,
-    /// Switches Affect Nested Comps (Settings ▸ General): a precomp layer's Quality and Motion
-    /// Blur switches also limit the layers of the nested comp (Draft/Wireframe or motion blur off
-    /// propagate down; they never raise a nested layer's own setting).
-    pub nested_switches: bool,
-    /// Realtime Shadows in Draft (Settings ▸ 3D): draft renders (`draft`) still cast shadows.
-    pub draft_shadows: bool,
-}
-
-impl RenderOpts {
-    /// Whether 3D layers cast shadows in this render.
-    pub fn shadows(&self) -> bool {
-        !self.draft || self.draft_shadows
-    }
-}
-
-impl Default for RenderOpts {
-    fn default() -> Self {
-        RenderOpts {
-            scale: 1.0,
-            motion_blur: true,
-            guides: false,
-            draft: false,
-            view: None,
-            roi: None,
-            backend: Backend::Cpu,
-            nested_switches: true,
-            draft_shadows: true,
-            proxy: effectcraft_project::render_queue::ProxyUse::CurrentSettings,
-        }
-    }
-}
+pub use accel::{Accelerator, Backend, FxStep, FxTarget};
+pub use footage::{CancellableFootage, FloatCurve, FootageSource, NoFootage, is_vector_footage, missing_item_problem, vector_fit};
+pub use frames::{
+    adaptive_samples, blend_frames, cineon_frame, content_bounds, extended_region, field_frame, frame_position, frame_size, interpret_pixels, kurbo_path,
+    render_frame, roi_inside,
+};
+#[cfg(test)]
+use fx_host::FxHost;
+use fx_host::MAX_FX_DEPTH;
+pub(crate) use fx_host::comp_scene;
+pub use fx_host::essential_overrides;
+pub use layers::{Placement, StyledLayer};
+pub(crate) use opts::Collapse3d;
+pub use opts::{LayerTiming, RenderOpts};
+use opts::{MAX_THROUGH, Through};
+pub use pipeline::{Collapsed, MediaOverride, PropertyOverride};
 
 pub struct Renderer<'a> {
     pub project: &'a Project,
@@ -592,6 +70,10 @@ pub struct Renderer<'a> {
     pub opts: RenderOpts,
     /// Processed-layer cache shared across frames (see [`cache`]). `None` renders everything.
     pub cache: Option<&'a LayerCache>,
+    /// Where the source files this render reads are noted (see [`reads`]): the frame's own,
+    /// from the footage source and from the buffers the layer cache serves. `None` records
+    /// nothing for the frame (buffers kept in the layer cache still record theirs).
+    pub reads: Option<&'a reads::ReadLog>,
     /// Optional per-layer timing sink (`frame --bench` / perf readouts).
     pub profile: Option<&'a std::sync::Mutex<Vec<LayerTiming>>>,
     /// GPU backend used when [`RenderOpts::backend`] asks for it.
@@ -620,1885 +102,9 @@ pub struct Renderer<'a> {
     through: [Option<Through<'a>>; MAX_THROUGH],
     /// More collapsed levels than [`MAX_THROUGH`]: their motion is not blurred.
     through_lost: bool,
-    /// Rasterise 3D text and shapes whole, never only the part the output shows
-    /// ([`Renderer::raster_clip`]; tests compare against it).
+    /// Layer-space consumers must not use the viewport raster optimization.
     pub(crate) whole_raster: bool,
 }
 
-/// One collapsed precomp layer a nested comp is drawn through.
-#[derive(Clone, Copy)]
-struct Through<'a> {
-    comp_id: ItemId,
-    comp: &'a Comp,
-    /// The containing comp's time at this frame.
-    time: Tick,
-    layer: &'a Layer,
-    /// The precomp layer is motion blurred: its own motion blurs the nested layers.
-    blur: bool,
-}
-
-/// Collapsed precomps within collapsed precomps that motion blur follows (more than
-/// [`Renderer::collapsed`]'s nesting limit).
-const MAX_THROUGH: usize = 16;
-
-/// A motion-blur shutter: the comp's, or for a collapsed precomp's layers the outermost
-/// containing comp's (they are drawn into its frames).
-#[derive(Clone, Copy)]
-struct Shutter {
-    /// Shutter angle and phase as fractions of a frame.
-    angle: f64,
-    phase: f64,
-    /// Frame duration (seconds).
-    frame: f64,
-    /// Samples Per Frame and Adaptive Sample Limit.
-    samples: u32,
-    limit: u32,
-}
-
-impl Shutter {
-    /// Seconds from the frame time to sub-sample `i` of `n`, spread over the open shutter.
-    fn offset(&self, i: usize, n: usize) -> f64 {
-        let f = if n > 1 { i as f64 / (n - 1) as f64 } else { 0.0 };
-        (self.phase + self.angle * f) * self.frame
-    }
-}
-
-/// How a collapsed precomp's 3D layers are placed in the parent (see `Renderer::collapse_into`).
-#[derive(Clone, Copy)]
-pub(crate) struct Collapse3d<'a> {
-    /// Nested comp world → parent world (the precomp layer's world transform).
-    pub world: Mat4,
-    /// The parent's camera.
-    pub cam: three_d::CameraState,
-    /// The outermost comp's context (its lights light the nested layers).
-    pub parent: EvalCtx<'a>,
-}
-
-/// Time spent on one layer of one frame (milliseconds).
-#[derive(Clone, Debug, Default)]
-pub struct LayerTiming {
-    pub depth: usize,
-    pub layer: String,
-    /// Source + masks + effects (cache lookup only, on a hit).
-    pub process_ms: f64,
-    /// Per effect: (effect id, ms). Empty on a cache hit.
-    pub effects: Vec<(String, f64)>,
-    /// Transform + matte + blend.
-    pub composite_ms: f64,
-    /// The processed buffer came from the layer cache.
-    pub cached: bool,
-}
-
-impl<'a> Renderer<'a> {
-    pub fn new(project: &'a Project, footage: &'a dyn FootageSource, opts: RenderOpts) -> Renderer<'a> {
-        Renderer {
-            project,
-            footage,
-            expr: None,
-            opts,
-            cache: None,
-            profile: None,
-            accel: None,
-            depth: 0,
-            pipe: color::Pipe::of(&project.settings),
-            outer: None,
-            opacity_mul: 1.0,
-            collapse3d: None,
-            inherited: None,
-            defer_dof: false,
-            top: true,
-            through: [None; MAX_THROUGH],
-            through_lost: false,
-            whole_raster: false,
-        }
-    }
-
-    /// The layer cache to keep this render's buffers in: none once its footage reads were
-    /// called off, as they may have come back empty ([`FootageSource::called_off`], #329).
-    fn cache_to_keep(&self) -> Option<&'a LayerCache> {
-        self.cache.filter(|_| !self.footage.called_off())
-    }
-
-    /// A layer's Quality switch, limited by the precomp layers above it when
-    /// [`RenderOpts::nested_switches`] is on.
-    pub fn quality(&self, layer: &Layer) -> Quality {
-        let rank = |q: Quality| match q {
-            Quality::Best => 0,
-            Quality::Draft => 1,
-            Quality::Wireframe => 2,
-        };
-        match self.inherited {
-            Some((q, _)) if rank(q) > rank(layer.switches.quality) => q,
-            _ => layer.switches.quality,
-        }
-    }
-
-    /// A layer's Motion Blur switch, limited by the precomp layers above it.
-    pub(crate) fn layer_motion_blur(&self, layer: &Layer) -> bool {
-        layer.switches.motion_blur && self.inherited.is_none_or(|(_, mb)| mb)
-    }
-
-    /// The renderer for the nested comp of precomp layer `layer`: its switches pass down when
-    /// [`RenderOpts::nested_switches`] is on.
-    fn nested_through(&self, layer: &Layer) -> Renderer<'a> {
-        let mut sub = self.nested();
-        if self.opts.nested_switches {
-            sub.inherited = Some((self.quality(layer), self.layer_motion_blur(layer)));
-        }
-        sub
-    }
-
-    /// The render options one level down (precomps, collapsed precomps, comps read by effects):
-    /// guide layers render only in their own comp, never when it is nested.
-    fn nested_opts(&self) -> RenderOpts {
-        RenderOpts { guides: false, ..self.opts }
-    }
-
-    /// A renderer for nested work (precomps, layers read by effects): one level deeper.
-    fn nested(&self) -> Renderer<'a> {
-        Renderer {
-            opts: self.nested_opts(),
-            depth: self.depth + 1,
-            outer: None,
-            opacity_mul: 1.0,
-            collapse3d: None,
-            defer_dof: false,
-            top: false,
-            through: [None; MAX_THROUGH],
-            through_lost: false,
-            // Effects read other layers through it in layer space (layer parameters, Echo…):
-            // they need the whole layer, not the part this frame shows (see `raster_clip`).
-            whole_raster: true,
-            ..*self
-        }
-    }
-
-    /// A precomp layer's nested comp for an accelerator to render resident (no CPU render and
-    /// upload of the nested frame): the renderer one level down, the comp, its time and the
-    /// buffer scale, exactly as [`Self::layer_source`]'s comp branch would render it. `None`
-    /// when that branch does more (composition proxy, Essential Properties overrides, frame
-    /// blending, recursion) or draws nothing (outside the nested comp's span): use the CPU path.
-    pub fn precomp_source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<(Renderer<'a>, ItemId, Tick, f64)> {
-        let LayerSource::Comp { item } = layer.source else { return None };
-        if layer.switches.adjustment || self.project.comp_contains(item, ctx.comp_id) {
-            return None;
-        }
-        let nc = self.project.comp(item)?;
-        let lt = ctx.nested_time(layer);
-        if self.content_times(ctx, layer).is_some() {
-            return None;
-        }
-        if !nc.covers(lt) || self.proxy_for(item).is_some() || !essential_overrides(ctx, layer).is_empty() || frame_blend_mode(ctx, layer) != FrameBlend::Off {
-            return None;
-        }
-        let s = self.opts.scale;
-        let bs = if s < 1.0 && nc.preserve_resolution { 1.0 } else { s };
-        let base = self.nested_through(layer);
-        Some((Renderer { opts: RenderOpts { scale: bs, ..base.opts }, ..base }, item, lt, bs))
-    }
-
-    /// The nested comp of a precomp layer whose transformations collapse into this comp: the
-    /// Collapse Transformations switch is on and the layer has no masks, effects or layer
-    /// styles (those force a flattened render of the precomp, as in After Effects).
-    pub fn collapsed(&self, ctx: &EvalCtx, layer: &Layer) -> Option<ItemId> {
-        if !layer.switches.collapse || layer.switches.adjustment || self.depth > 12 {
-            return None;
-        }
-        let LayerSource::Comp { item } = &layer.source else { return None };
-        if self.project.comp_contains(*item, ctx.comp_id) || self.project.comp(*item).is_none() {
-            return None;
-        }
-        if layer.masks().is_some_and(|m| !m.children.is_empty()) {
-            return None;
-        }
-        if layer.switches.effects && layer.effects().is_some_and(|fx| fx.groups().any(|g| g.enabled)) {
-            return None;
-        }
-        if styles::active(ctx, layer) {
-            return None;
-        }
-        // Instance overrides (Essential Properties) need the nested comp rendered on its own.
-        if !effectcraft_project::essential::overridden(layer).is_empty() {
-            return None;
-        }
-        Some(*item)
-    }
-
-    /// A renderer and context that draw a collapsed precomp's layers straight into this comp:
-    /// their transforms are concatenated with the precomp layer's (one resample, no
-    /// rasterisation at the precomp's bounds), their opacity multiplied by `opacity`, and their
-    /// 3D layers use this comp's camera and lights.
-    pub fn collapse_into(&self, ctx: &EvalCtx<'a>, layer: &'a Layer, item: ItemId, opacity: f32) -> Option<(Renderer<'a>, EvalCtx<'a>)> {
-        let nc = self.project.comp(item)?;
-        let t = ctx.nested_time(layer);
-        if !nc.covers(t) {
-            return None;
-        }
-        let nctx = EvalCtx { comp_id: item, comp: nc, time: t, ..*ctx };
-        let (l2c, _) = ctx.layer_to_comp(layer);
-        let outer = Some(self.outer.map_or(l2c, |o| o * l2c));
-        let world = ctx.world_matrix(layer);
-        let c3 = Collapse3d {
-            world: self.collapse3d.map_or(world, |c| c.world * world),
-            cam: three_d::compose::camera_for(self, ctx),
-            parent: self.collapse3d.map_or(*ctx, |c| c.parent),
-        };
-        // Motion blur follows the precomp layer's own motion too.
-        let link = Through { comp_id: ctx.comp_id, comp: ctx.comp, time: ctx.time, layer, blur: self.mb_on(ctx, layer) };
-        let mut through = self.through;
-        let slot = through.iter_mut().find(|t| t.is_none());
-        let through_lost = self.through_lost || slot.is_none();
-        if let Some(slot) = slot {
-            *slot = Some(link);
-        }
-        Some((
-            Renderer { opts: self.nested_opts(), depth: self.depth + 1, outer, opacity_mul: opacity, collapse3d: Some(c3), through, through_lost, ..*self },
-            nctx,
-        ))
-    }
-
-    pub(crate) fn opacity_mul(&self) -> f32 {
-        self.opacity_mul
-    }
-
-    /// Draw a collapsed 2D precomp layer: nested layers blend straight into `canvas` with their
-    /// own modes (Normal precomp, no matte); otherwise they are drawn into an isolated buffer
-    /// that then takes the precomp layer's track matte, Preserve Transparency and blend mode.
-    /// Returns the region left to re-quantise (nested layers drawn straight into `canvas`
-    /// quantise their own footprints).
-    fn draw_collapsed(&self, ctx: &EvalCtx<'a>, layer: &Layer, item: ItemId, canvas: &mut Image, blank: bool) -> Region {
-        let opacity = ctx.opacity(layer) as f32 * self.opacity_mul;
-        if opacity <= 0.0 {
-            return Region::Empty;
-        }
-        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
-        if layer.blend_mode == BlendMode::Normal && !matte && !layer.preserve_transparency {
-            if let Some((sub, nctx)) = self.collapse_into(ctx, layer, item, opacity) {
-                sub.draw_comp(&nctx, canvas, blank);
-            }
-            return Region::Empty;
-        }
-        let Some((sub, nctx)) = self.collapse_into(ctx, layer, item, 1.0) else { return Region::Empty };
-        let mut iso = Image::new(canvas.width, canvas.height);
-        sub.draw_comp(&nctx, &mut iso, true);
-        self.composite_iso(ctx, layer, iso, canvas, opacity);
-        Region::Full
-    }
-
-    /// Whether `layer`'s processed buffer (source → masks → effects) is cached and the same as
-    /// one frame earlier: drawing it from the layer cache (an accelerator uploads it once) beats
-    /// re-running its effects every frame.
-    pub fn layer_is_static(&self, ctx: &EvalCtx, layer: &Layer) -> bool {
-        if self.cache.is_none() {
-            return false;
-        }
-        let (scale, draft, blur) = (self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer));
-        let prev = ctx.time - ctx.comp.frame_rate.frame_duration();
-        let before = ctx.at(prev);
-        let now = self.clipped_key(ctx, layer, cache::layer_key(ctx, layer, scale, draft, blur));
-        now.is_some() && now == self.clipped_key(&before, layer, cache::layer_key(&before, layer, scale, draft, blur))
-    }
-
-    /// Rasterisation scale of a layer's source: the output scale, or — for text and shape layers,
-    /// which are always continuously rasterised (#390, #751), and Continuously Rasterize vector
-    /// footage — the output scale times the layer's on-screen scale (quarter-octave steps, rounded
-    /// up, so vector content is drawn at its final size and stays sharp when scaled up).
-    pub fn raster_scale(&self, ctx: &EvalCtx, layer: &Layer) -> f64 {
-        let s = self.opts.scale;
-        let continuous = match layer.source {
-            LayerSource::Text | LayerSource::Shape => true,
-            LayerSource::Footage { item } => {
-                layer.switches.collapse && matches!(self.project.item(item).map(|i| &i.kind), Some(ItemKind::Footage(f)) if is_vector_footage(f))
-            }
-            _ => false,
-        };
-        if !continuous {
-            return s;
-        }
-        let (l2c, _) = ctx.layer_to_comp(layer);
-        let m = self.outer.map_or(l2c, |o| o * l2c);
-        let a = layer.transform().map(|tr| ctx.v3(layer, tr, "anchor", [0.0; 3])).unwrap_or([0.0; 3]);
-        let p0 = m.apply(vec2(a[0], a[1]));
-        let px = m.apply(vec2(a[0] + 1.0, a[1]));
-        let py = m.apply(vec2(a[0], a[1] + 1.0));
-        let k = ((px.x - p0.x).hypot(px.y - p0.y)).max((py.x - p0.x).hypot(py.y - p0.y));
-        if !k.is_finite() || k <= 1e-6 {
-            return s;
-        }
-        // The step is rounded up past rounding noise only: an unscaled layer whose position isn't
-        // a whole number maps the unit vectors to lengths a hair over 1, which must stay 1 (#390:
-        // rounded up to 2^¼, unscaled text was drawn larger and resampled, softer).
-        let mut k = 2f64.powf((k.log2() * 4.0 - 1e-6).ceil() / 4.0).clamp(1.0 / 16.0, 64.0);
-        // Keep the buffer within about 16 million pixels (of the part the output shows, when
-        // only that is rasterised: see `raster_clip`).
-        if let Some(b) = content_bounds(ctx, layer) {
-            let b = match self.raster_clip(ctx, layer) {
-                Some(c) => {
-                    let r = kurbo::Rect::new(b[0], b[1], b[2], b[3]).intersect(c);
-                    [r.x0, r.y0, r.x1, r.y1]
-                }
-                None => b,
-            };
-            let area = ((b[2] - b[0]) * (b[3] - b[1])).max(1.0) * s * s;
-            k = k.min((16.0e6 / area).sqrt().max(1.0));
-        }
-        s * k
-    }
-
-    /// The layer-space part of a 3D text or shape layer the output shows, when only that part
-    /// needs rasterising (#1388: text close to the camera was rasterised whole at up to 16
-    /// million pixels, a quarter gigabyte per frame worker, though the frame showed a fraction
-    /// of it; behind the camera it was rasterised and not drawn). `None` rasterises it whole:
-    /// whenever pixels outside the frame can matter — effects, layer styles, masks, motion blur,
-    /// depth of field, lights (shadows and transmission), Advanced 3D, per-character 3D, a
-    /// collapsed 2D transform — or the visible part can't be bounded (see
-    /// [`three_d::compose::visible_clip`]).
-    pub(crate) fn raster_clip(&self, ctx: &EvalCtx, layer: &Layer) -> Option<kurbo::Rect> {
-        if self.whole_raster || !layer.is_3d() || !matches!(layer.source, LayerSource::Text | LayerSource::Shape) || self.outer.is_some() {
-            return None;
-        }
-        if (layer.switches.effects && layer.effects().is_some_and(|fx| !fx.children.is_empty()))
-            || layer.masks().is_some_and(|m| !m.children.is_empty())
-            || styles::active(ctx, layer)
-            || ctx.comp.layers.iter().any(|l| matches!(l.source, LayerSource::Light { .. }))
-            || self.is_adv3d(ctx)
-            || (matches!(layer.source, LayerSource::Text) && text::per_char_3d(ctx, layer))
-        {
-            return None;
-        }
-        let v = three_d::compose::visible_clip(self, ctx, layer)?;
-        if v.area() <= 0.0 {
-            // Behind the camera.
-            return Some(v);
-        }
-        let b = content_bounds(ctx, layer).map(|b| kurbo::Rect::new(b[0], b[1], b[2], b[3]))?;
-        if v.x0 <= b.x0 && v.y0 <= b.y0 && v.x1 >= b.x1 && v.y1 >= b.y1 {
-            return None;
-        }
-        // Whole cells of a layer-space grid whose cell is about a quarter of the part that shows,
-        // rounded down to a power of two: a moving camera keeps one raster (and its cache entry)
-        // while that part stays within the same cells, and a dolly changes the grid only at each
-        // doubling. The cells cover at most about 2.25 times the part that shows. Worth it only
-        // when it leaves out at least half of the content.
-        let c = 2f64.powf(((v.width().max(v.height()) / 4.0).max(1e-6)).log2().floor());
-        let snap = |v: f64, up: bool| if up { (v / c).ceil() * c } else { (v / c).floor() * c };
-        // (Not cut to the content bounds: a stroke or a glyph's padding reaches past them.)
-        let cells = kurbo::Rect::new(snap(v.x0, false), snap(v.y0, false), snap(v.x1, true), snap(v.y1, true));
-        (cells.is_finite() && cells.intersect(b).area() <= b.area() * 0.5).then_some(cells)
-    }
-
-    /// A layer content cache key that also names the part rasterised ([`Self::raster_clip`]).
-    fn clipped_key(&self, ctx: &EvalCtx, layer: &Layer, key: Option<u64>) -> Option<u64> {
-        let k = key?;
-        Some(match self.raster_clip(ctx, layer) {
-            Some(c) => [c.x0, c.y0, c.x1, c.y1].iter().fold(cache::derive(k, 0xc11b), |d, v| cache::derive(d, (v * 16.0).round() as i64 as u64)),
-            None => k,
-        })
-    }
-
-    /// Draw a Wireframe-quality layer: its bounds as a one-pixel outline.
-    fn draw_wireframe(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image) {
-        for (x, y) in self.wireframe_pixels(ctx, layer, (canvas.width, canvas.height)) {
-            canvas.set(x, y, [1.0, 1.0, 1.0, 1.0]);
-        }
-    }
-
-    fn ctx(&self, comp_id: ItemId, comp: &'a Comp, t: Tick) -> EvalCtx<'a> {
-        EvalCtx { project: self.project, comp_id, comp, time: t, expr: self.expr, footage: Some(self.footage) }
-    }
-
-    /// This renderer with another accelerator (or none): the passes of
-    /// [`passes::in_passes`] render with the accelerator, its CPU fallback without.
-    pub fn with_accel(&self, accel: Option<&'a dyn Accelerator>) -> Renderer<'a> {
-        Renderer { accel, ..*self }
-    }
-
-    /// The accelerator to use for this render, if any (see [`Backend`]).
-    pub fn active_accel(&self) -> Option<&'a dyn Accelerator> {
-        let a = self.accel?;
-        match self.opts.backend {
-            Backend::Cpu => None,
-            Backend::Gpu => Some(a),
-            Backend::Auto => self.project.settings.gpu_acceleration.then_some(a),
-        }
-    }
-
-    /// Render a composition at comp time `t` (transparent background, comp size × scale).
-    /// Top-level frames go to the GPU when [`Self::active_accel`] is set and handles them.
-    pub fn comp_frame(&self, comp_id: ItemId, t: Tick) -> Image {
-        // Classic 3D runs composite on the GPU too (M12.7), so Auto sends 3D comps there as well;
-        // Auto renders each comp on whichever compositor measured faster ([`AutoPick`]).
-        if self.depth == 0
-            && let Some(a) = self.active_accel()
-        {
-            let auto = self.frame_auto(a, comp_id, false);
-            if auto.is_none_or(|(p, key)| p.choose(key)) {
-                let t0 = web_time::Instant::now();
-                if let Some(img) = a.comp_frame(self, comp_id, t) {
-                    if let Some((p, key)) = auto {
-                        p.record(key, true, t0.elapsed().as_secs_f64() * 1e3);
-                    }
-                    return img;
-                }
-                if let Some((p, key)) = auto {
-                    p.declined(key);
-                }
-            }
-            let t0 = web_time::Instant::now();
-            let img = self.comp_frame_cpu(comp_id, t);
-            if let Some((p, key)) = auto {
-                p.record(key, false, t0.elapsed().as_secs_f64() * 1e3);
-            }
-            return img;
-        }
-        self.comp_frame_cpu(comp_id, t)
-    }
-
-    /// The Auto timing history and key for a top-level frame of `comp` (`None` unless the
-    /// backend is [`Backend::Auto`] and the accelerator keeps history).
-    pub fn frame_auto(&self, a: &'a dyn Accelerator, comp: ItemId, display: bool) -> Option<(&'a AutoPick, AutoKey)> {
-        if self.opts.backend != Backend::Auto || self.opts.roi.is_some() {
-            return None;
-        }
-        Some((a.auto_pick()?, AutoKey::new(comp, self.opts.scale, display)))
-    }
-
-    /// [`Self::comp_frame`] on the CPU compositor only.
-    pub fn comp_frame_cpu(&self, comp_id: ItemId, t: Tick) -> Image {
-        let Some(comp) = self.project.comp(comp_id) else { return Image::new(1, 1) };
-        let s = self.opts.scale;
-        let w = ((comp.width as f64 * s).round() as u32).max(1);
-        let h = ((comp.height as f64 * s).round() as u32).max(1);
-        // Region of interest on a comp with 3D layers: render the frame and crop it. A region
-        // reaching past the comp frame (the Extended Viewer) renders Classic 3D natively — the
-        // planes project through the offset camera — and Advanced 3D as the frame, padded.
-        if self.depth == 0
-            && let Some(r) = self.opts.roi
-            && comp.has_3d()
-            && (roi_inside(r, comp.width, comp.height) || comp.renderer == effectcraft_project::Renderer::Advanced3D)
-        {
-            let full = Renderer { opts: RenderOpts { roi: None, ..self.opts }, ..*self }.comp_frame(comp_id, t);
-            let (x0, y0) = ((r[0] * s).round() as i64, (r[1] * s).round() as i64);
-            let (rw, rh) = (((r[2] * s).round() as u32).max(1), ((r[3] * s).round() as u32).max(1));
-            let mut out = Image::new(rw, rh);
-            for y in 0..rh as i64 {
-                let sy = y + y0;
-                if sy < 0 || sy >= full.height as i64 {
-                    continue;
-                }
-                for x in 0..rw as i64 {
-                    let sx = x + x0;
-                    if sx >= 0 && sx < full.width as i64 {
-                        out.data[(y * rw as i64 + x) as usize] = full.data[(sy * full.width as i64 + sx) as usize];
-                    }
-                }
-            }
-            return out;
-        }
-        let (w, h) = match self.roi_offset() {
-            Some((_, _, rw, rh)) => (rw, rh),
-            None => (w, h),
-        };
-        let mut canvas = Image::new(w, h);
-        if self.depth > 16 {
-            return canvas;
-        }
-        let ctx = self.ctx(comp_id, comp, t);
-        self.draw_comp(&ctx, &mut canvas, true);
-        // The canvas is already quantised after every layer; only re-encoding changes it.
-        if let Some(c) = self.pipe.from_blend() {
-            color::convert(&mut canvas, &c);
-            self.pipe.quantize(&mut canvas);
-        }
-        // The top-level comp leaves the working space for the (sRGB) display / output.
-        if self.depth == 0
-            && let Some(c) = self.pipe.output()
-        {
-            color::convert(&mut canvas, &c);
-            self.pipe.quantize(&mut canvas);
-        }
-        if self.depth == 0
-            && let Some((lin, mode, enc)) = self.pipe.output_hdr()
-        {
-            color::output_hdr(&mut canvas, lin, mode, enc);
-            self.pipe.quantize(&mut canvas);
-        }
-        canvas
-    }
-
-    /// Draw a comp's layers (bottom to top) into `canvas` (blending space).
-    /// `blank`: the canvas is fully transparent (lets the first layer skip re-quantising).
-    fn draw_comp(&self, ctx: &EvalCtx<'a>, canvas: &mut Image, mut blank: bool) {
-        // Bottom-to-top, with runs of consecutive 3D layers depth-sorted (farthest first).
-        let visible = self.visible_layers(ctx);
-        let mut i = 0;
-        while i < visible.len() {
-            if visible[i].is_3d() {
-                let mut j = i;
-                while j < visible.len() && visible[j].is_3d() {
-                    j += 1;
-                }
-                three_d::compose::draw_run(self, ctx, &visible[i..j], canvas);
-                i = j;
-                self.pipe.quantize(canvas);
-                blank = false;
-            } else {
-                let changed = match self.collapsed(ctx, visible[i]) {
-                    Some(item) => self.draw_collapsed(ctx, visible[i], item, canvas, blank),
-                    None => self.draw_layer(ctx, visible[i], canvas, blank),
-                };
-                i += 1;
-                // 8/16 bpc: the comp is an integer buffer after every layer (only the pixels the
-                // layer touched need re-quantising).
-                self.pipe.quantize_region(canvas, changed);
-                blank = false;
-            }
-        }
-    }
-
-    /// Evaluate an effect instance's parameters.
-    fn effect_params(&self, ctx: &EvalCtx, layer: &Layer, g: &effectcraft_project::PropGroup) -> Params {
-        // Nested groups (Paint strokes, Puppet meshes and pins) are flattened too.
-        effectcraft_effects::flatten_params(g, &mut |pr| ctx.value(layer, pr))
-    }
-
-    fn apply_effects(&self, ctx: &EvalCtx, layer: &Layer, buf: Buf, adjustment: bool) -> Buf {
-        self.apply_effects_timed(ctx, layer, buf, adjustment, usize::MAX, None)
-    }
-
-    /// Run the first `limit` effects of the layer's stack (by position; disabled ones count) on
-    /// `buf` (layer space, or the comp below for an adjustment layer).
-    fn apply_effects_timed(&self, ctx: &EvalCtx, layer: &Layer, mut buf: Buf, adjustment: bool, limit: usize, timing: Option<&mut Vec<(String, f64)>>) -> Buf {
-        // The comp below an adjustment layer is not in its layer space: it stays as it is.
-        let origin = if adjustment { [0.0; 2] } else { ctx.effect_bounds(layer).1 };
-        buf.rebase(origin);
-        let mut out = self.effect_space_stack(ctx, layer, buf, adjustment, limit, timing, origin);
-        out.rebase([-origin[0], -origin[1]]);
-        out
-    }
-
-    /// [`Renderer::apply_effects_timed`] on a buffer already in effect space (measured from
-    /// `origin`, in layer coordinates); the result stays in effect space.
-    #[allow(clippy::too_many_arguments)]
-    fn effect_space_stack(
-        &self,
-        ctx: &EvalCtx,
-        layer: &Layer,
-        buf: Buf,
-        adjustment: bool,
-        limit: usize,
-        timing: Option<&mut Vec<(String, f64)>>,
-        origin: [f64; 2],
-    ) -> Buf {
-        let mut t = CpuFx { accel: self.active_accel(), levels: self.pipe.levels, buf: Some(buf) };
-        self.run_effect_stack(ctx, layer, adjustment, limit, timing, origin, &mut t);
-        t.buf.unwrap_or_else(|| Buf { img: Image::new(1, 1), offset: [0.0; 2], scale: self.opts.scale })
-    }
-
-    /// Run the layer's video effect stack on `target` (in effect space, measured from `origin`
-    /// in layer coordinates): runs of GPU-capable effects go to [`FxTarget::gpu`] (when an
-    /// accelerator is active and supports them), the rest to [`FxTarget::cpu`] one by one
-    /// (quantised to the bit depth after each).
-    #[allow(clippy::too_many_arguments)]
-    fn run_effect_stack(
-        &self,
-        ctx: &EvalCtx,
-        layer: &Layer,
-        adjustment: bool,
-        limit: usize,
-        mut timing: Option<&mut Vec<(String, f64)>>,
-        origin: [f64; 2],
-        target: &mut dyn FxTarget,
-    ) {
-        if !layer.switches.effects {
-            return;
-        }
-        let Some(fx) = layer.effects() else { return };
-        let lt = layer.layer_time(ctx.time);
-        let layer_size = ctx.effect_bounds(layer).0;
-        // #659: an authored layer's buffer spans only its painted content while the stack works
-        // on the layer's whole region (`layer_size`): give the buffer the room a sized source
-        // already has, so tiling or displacement can place pixels outside the content instead
-        // of losing them at its edge. Only when something will actually run, and not for an
-        // adjustment layer, whose buffer is the comp below and already spans it.
-        if !adjustment
-            && fx.groups().any(|g| g.enabled && matches!(&g.kind, GroupKind::Effect { effect } if effectcraft_effects::find(effect).is_some_and(|s| !effectcraft_effects::audio_fx::is_audio_effect(s.id)))) {
-            target.cover(layer_size);
-        }
-        let mut mask_shapes = masks::shapes(ctx, layer);
-        if origin != [0.0; 2] {
-            for q in mask_shapes.iter_mut().flat_map(|m| m.points.iter_mut()) {
-                *q = [q[0] - origin[0], q[1] - origin[1]];
-            }
-        }
-        // Capture once, before preceding effects can expand or replace the input. An
-        // adjustment stack's original is the comp below, not its solid source.
-        let needs_original =
-            fx.groups().take(limit).any(|g| g.enabled && matches!(&g.kind, GroupKind::Effect { effect } if effect == "ec.channel.cccomposite"));
-        let mut original = None;
-        if needs_original {
-            target.cpu(&mut |buf| {
-                original = Some(buf.clone());
-                buf
-            });
-        }
-        let host = FxHost { r: self, ctx, layer, origin, index: 0, original: original.as_ref() };
-        let env = EffectEnv {
-            masks: &mask_shapes,
-            host: Some(&host),
-            comp_time: ctx.time.seconds(),
-            frame_rate: ctx.comp.frame_rate.as_f64(),
-            effect_index: 0,
-            working_space: self.pipe.space,
-            working_linear: self.pipe.linear,
-            shutter: self.mb_on(ctx, layer).then_some((ctx.comp.shutter_angle, ctx.comp.shutter_phase, ctx.comp.motion_blur_samples)),
-        };
-        // Video effects in stack order (index, group, spec); disabled and audio effects skipped.
-        let stack: Vec<(usize, &effectcraft_project::PropGroup, &'static effectcraft_effects::EffectSpec)> = fx
-            .groups()
-            .enumerate()
-            .take_while(|(i, _)| *i < limit)
-            .filter(|(_, g)| g.enabled)
-            .filter_map(|(i, g)| match &g.kind {
-                GroupKind::Effect { effect } => effectcraft_effects::find(effect).map(|s| (i, g, s)),
-                _ => None,
-            })
-            .filter(|(_, _, s)| !effectcraft_effects::audio_fx::is_audio_effect(s.id))
-            .collect();
-        let accel = self.active_accel();
-        let mut k = 0;
-        while k < stack.len() {
-            let (i, g, spec) = stack[k];
-            // A run of GPU effects goes to the accelerator in one go.
-            if let Some(a) = accel
-                && spec.gpu
-                && a.supports_effect(spec.id)
-            {
-                let run: Vec<_> = stack[k..].iter().take_while(|(_, _, s)| s.gpu && a.supports_effect(s.id)).collect();
-                let params: Vec<Params> = run.iter().map(|(_, g, _)| self.effect_params(ctx, layer, g)).collect();
-                let hosts: Vec<_> = run.iter().map(|(i, _, _)| FxHost { index: *i, ..host }).collect();
-                let steps: Vec<FxStep> = run
-                    .iter()
-                    .zip(&params)
-                    .zip(&hosts)
-                    .map(|(((i, g, s), params), host)| FxStep {
-                        spec: s,
-                        ctx: EffectCtx {
-                            params,
-                            time: lt.seconds(),
-                            layer_size,
-                            seed: g.uid as u32,
-                            adjustment,
-                            env: EffectEnv { host: Some(host), effect_index: *i, ..env },
-                        },
-                    })
-                    .collect();
-                let t0 = web_time::Instant::now();
-                if target.gpu(&steps) {
-                    if let Some(v) = timing.as_deref_mut() {
-                        let ms = t0.elapsed().as_secs_f64() * 1e3 / run.len() as f64;
-                        v.extend(run.iter().map(|(_, _, s)| (format!("{} (gpu)", s.id), ms)));
-                    }
-                    k += run.len();
-                    continue;
-                }
-            }
-            k += 1;
-            let params = self.effect_params(ctx, layer, g);
-            let host = FxHost { index: i, ..host };
-            let env = EffectEnv { host: Some(&host), effect_index: i, ..env };
-            let ectx = EffectCtx { params: &params, time: lt.seconds(), layer_size, seed: g.uid as u32, adjustment, env };
-            let t0 = web_time::Instant::now();
-            target.cpu(&mut |buf| {
-                let mut buf = effectcraft_effects::apply(spec, &ectx, buf);
-                // 8/16 bpc effects write integer pixels.
-                self.pipe.quantize(&mut buf.img);
-                buf
-            });
-            if let Some(v) = timing.as_deref_mut() {
-                v.push((spec.id.to_string(), t0.elapsed().as_secs_f64() * 1e3));
-            }
-        }
-    }
-
-    /// Source pixels of a layer in layer space (before masks/effects).
-    fn source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Buf> {
-        let s = self.opts.scale;
-        match &layer.source {
-            LayerSource::Solid { item } => {
-                let ItemKind::Solid(sol) = &self.project.item(*item)?.kind else { return None };
-                let w = ((sol.width as f64 * s).ceil() as u32).max(1);
-                let h = ((sol.height as f64 * s).ceil() as u32).max(1);
-                if layer.switches.adjustment {
-                    return Some(Buf { img: Image::filled(w, h, [1.0; 4]), offset: [0.0; 2], scale: s });
-                }
-                let mut c = sol.color;
-                if let Some(conv) = self.pipe.authored_in() {
-                    c = conv.apply(c);
-                }
-                let px = self.pipe.quantize_px([c[0], c[1], c[2], 1.0]);
-                Some(Buf { img: Image::filled(w, h, px), offset: [0.0; 2], scale: s })
-            }
-            LayerSource::Comp { item } => {
-                if self.project.comp_contains(*item, ctx.comp_id) {
-                    return None;
-                }
-                // A composition proxy (a rendered still or movie) stands in for the comp.
-                // Nothing before the nested comp starts or after it ends.
-                let lt = ctx.nested_time(layer);
-                if !self.project.comp(*item).is_some_and(|nc| nc.covers(lt)) {
-                    return None;
-                }
-                if let Some(pf) = self.proxy_for(*item)
-                    && let Some(nc) = self.project.comp(*item)
-                {
-                    let img = self.footage.frame_with(*item, pf, lt, None, self.pipe.float_encoding())?;
-                    return Some(self.footage_buf(&img, pf, nc.width, nc.height));
-                }
-                // Essential Properties overrides render the nested comp with this instance's
-                // values.
-                let ov = essential_overrides(ctx, layer);
-                let tmp = if ov.is_empty() { None } else { effectcraft_project::essential::with_overrides(self.project, *item, &ov) };
-                // Preserve resolution when nested: drawn at full size even when this comp renders
-                // smaller (the buffer's scale places it).
-                let full = s < 1.0 && self.project.comp(*item).is_some_and(|nc| nc.preserve_resolution);
-                let bs = if full { 1.0 } else { s };
-                let base = self.nested_through(layer);
-                let base = Renderer { opts: RenderOpts { scale: bs, ..base.opts }, ..base };
-                let sub = match &tmp {
-                    Some(p) => Renderer { project: p, ..base },
-                    None => base,
-                };
-                // Frame blending between the nested comp's frames (time-stretched/remapped).
-                let mode = frame_blend_mode(ctx, layer);
-                if mode != FrameBlend::Off
-                    && let Some(nc) = self.project.comp(*item)
-                {
-                    let (i, w) = frame_position(lt, nc.frame_rate);
-                    if w > 1e-6 {
-                        let a = sub.comp_frame(*item, nc.frame_rate.tick_of(i));
-                        let b = sub.comp_frame(*item, nc.frame_rate.tick_of(i + 1));
-                        return Some(Buf { img: blend_frames(mode, &a, &b, w as f32), offset: [0.0; 2], scale: bs });
-                    }
-                }
-                Some(Buf { img: sub.comp_frame(*item, lt), offset: [0.0; 2], scale: bs })
-            }
-            LayerSource::Footage { item } => {
-                let it = self.project.item(*item)?;
-                let ItemKind::Footage(f) = &it.kind else { return None };
-                if !f.has_video {
-                    return None;
-                }
-                // Continuously rasterised vector footage: drawn at the on-screen scale.
-                if layer.switches.collapse && is_vector_footage(f) {
-                    let k = self.raster_scale(ctx, layer);
-                    if let Some(img) = self.footage.vector_frame(*item, f, k) {
-                        let mut buf = Buf { img: (*img).clone(), offset: [0.0; 2], scale: k };
-                        if let Some(c) = self.pipe.media_in(f) {
-                            color::convert(&mut buf.img, &c);
-                        }
-                        return Some(buf);
-                    }
-                }
-                let lt = ctx.source_time(layer);
-                // The proxy is decoded instead, at its own size, and fills the footage's frame.
-                let proxy = self.proxy_for(*item);
-                let pf = proxy.unwrap_or(f);
-                let size = self.reduced_size(f.width, f.height).filter(|_| proxy.is_none());
-                let img = self.footage_frame(ctx, layer, *item, pf, lt, size)?;
-                Some(self.footage_buf(&img, pf, f.width, f.height))
-            }
-            LayerSource::Text => Some(self.authored(text::render_in(ctx, layer, self.raster_scale(ctx, layer), self.raster_clip(ctx, layer)))),
-            LayerSource::Shape => layer
-                .props
-                .sub("contents")
-                .map(|c| self.authored(shapes::render_in(ctx, layer, c, self.raster_scale(ctx, layer), self.raster_clip(ctx, layer)))),
-            _ => None,
-        }
-    }
-
-    /// The proxy footage used for `item` under this render's Proxy Use, if any.
-    pub fn proxy_for(&self, item: ItemId) -> Option<&'a Footage> {
-        let it = self.project.item(item)?;
-        let px = it.proxy.as_deref()?;
-        (self.opts.proxy.uses(matches!(it.kind, ItemKind::Comp(_)), px.enabled) && px.footage.has_video).then_some(&px.footage)
-    }
-
-    /// A decoded frame of `f` as a layer buffer covering `w`×`h` layer pixels (the footage's
-    /// nominal size; proxies are scaled up to it), converted from its colour profile.
-    fn footage_buf(&self, img: &Image, f: &Footage, w: u32, h: u32) -> Buf {
-        let s = self.opts.scale;
-        let k = if img.width > 0 { w.max(1) as f64 / img.width as f64 } else { 1.0 };
-        // Keep native pixels when downsampling is small; resample otherwise.
-        let mut buf = match self.reduced_size(w, h) {
-            // The source resampled it already (`FootageSource::frame_at_size`).
-            Some(size) if (img.width, img.height) == size => Buf { img: img.clone(), offset: [0.0; 2], scale: s },
-            Some((rw, rh)) if k <= 1.0 + 1e-9 => Buf { img: effectcraft_raster::resample(img, rw, rh), offset: [0.0; 2], scale: s },
-            _ => Buf { img: img.clone(), offset: [0.0; 2], scale: 1.0 / k },
-        };
-        if let Some(c) = self.pipe.media_in(f) {
-            color::convert(&mut buf.img, &c);
-        }
-        buf
-    }
-
-    /// The size of `w` × `h` layer pixels in this render when it is reduced enough that footage
-    /// is resampled to it (below 3/4 scale).
-    fn reduced_size(&self, w: u32, h: u32) -> Option<(u32, u32)> {
-        let s = self.opts.scale;
-        (s < 0.75).then(|| (((w as f64 * s).round() as u32).max(1), ((h as f64 * s).round() as u32).max(1)))
-    }
-
-    /// Authored colours into the working space (linear working spaces).
-    fn authored(&self, mut buf: Buf) -> Buf {
-        if let Some(c) = self.pipe.authored_in() {
-            color::convert(&mut buf.img, &c);
-        }
-        buf
-    }
-
-    /// A footage frame at source time `t`, frame-blended between the two nearest source frames
-    /// when the layer's Frame Blending switch (and the comp's Enable Frame Blending) is on and
-    /// `t` falls between frames (footage rate ≠ comp rate, time stretch, time remapping).
-    /// `size`: a plain frame may come resampled to it ([`FootageSource::frame_at_size`]).
-    fn footage_frame(&self, ctx: &EvalCtx, layer: &Layer, item: ItemId, f: &Footage, t: Tick, size: Option<(u32, u32)>) -> Option<Arc<Image>> {
-        // Interpret Footage ▸ Separate Fields: each field is a frame at twice the rate.
-        if f.fields != effectcraft_project::FieldOrder::Off && matches!(f.kind, FootageKind::Video | FootageKind::Sequence) {
-            let field_rate = FrameRate::new(f.frame_rate.num * 2, f.frame_rate.den);
-            let i = field_rate.frame_at(t).max(0);
-            let img = self.footage.frame_with(item, f, f.frame_rate.tick_of(i / 2), None, self.pipe.float_curve(f))?;
-            let dominant_upper = f.fields == effectcraft_project::FieldOrder::UpperFirst;
-            // Upper field = even lines (0, 2, …).
-            let parity = if (i % 2 == 0) == dominant_upper { 0 } else { 1 };
-            return Some(Arc::new(interpret_pixels(&field_frame(&img, parity), f, self.pipe.linear_footage_space(f))));
-        }
-        // Interpretation is per pixel but not linear: it runs on the frame before resampling.
-        let size = size.filter(|_| !(f.invert_alpha || f.linear_light_applies()));
-        let img = self.footage_frame_raw(ctx, layer, item, f, t, size)?;
-        if f.invert_alpha || f.linear_light_applies() { Some(Arc::new(interpret_pixels(&img, f, self.pipe.linear_footage_space(f)))) } else { Some(img) }
-    }
-
-    fn footage_frame_raw(&self, ctx: &EvalCtx, layer: &Layer, item: ItemId, f: &Footage, t: Tick, size: Option<(u32, u32)>) -> Option<Arc<Image>> {
-        let mode = frame_blend_mode(ctx, layer);
-        let float = self.pipe.float_curve(f);
-        if mode != FrameBlend::Off && matches!(f.kind, FootageKind::Video | FootageKind::Sequence) {
-            let (i, w) = frame_position(t, f.frame_rate);
-            if w > 1e-6 {
-                // Blended frames are cached (Pixel Motion is expensive).
-                let key = self.cache.map(|_| {
-                    use std::hash::{Hash, Hasher};
-                    let mut h = std::collections::hash_map::DefaultHasher::new();
-                    (0x00f8_a3e5_u64, item, i, (w as f32).to_bits(), mode as u8, f.frame_rate.num, f.frame_rate.den, &f.path, float).hash(&mut h);
-                    h.finish()
-                });
-                if let (Some(c), Some(k)) = (self.cache, key)
-                    && let Some(b) = c.get(k)
-                {
-                    return Some(Arc::new(b.img.clone()));
-                }
-                let a = self.footage.frame_with(item, f, f.frame_rate.tick_of(i), None, float);
-                let b = self.footage.frame_with(item, f, f.frame_rate.tick_of(i + 1), None, float);
-                if let (Some(a), Some(b)) = (a, b) {
-                    let img = blend_frames(mode, &a, &b, w as f32);
-                    if let (Some(c), Some(k)) = (self.cache_to_keep(), key) {
-                        c.insert(k, Arc::new(Buf { img: img.clone(), offset: [0.0; 2], scale: 1.0 }));
-                    }
-                    return Some(Arc::new(img));
-                }
-            }
-        }
-        self.footage.frame_with(item, f, t, size, float)
-    }
-
-    /// Source → masks, clamped/quantised to the project depth.
-    fn masked_source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Buf> {
-        let mut buf = match self.content_times(ctx, layer) {
-            Some(times) => self.blurred_source(ctx, layer, &times)?,
-            None => self.source(ctx, layer)?,
-        };
-        // A solid is filled with a quantised colour: only masks can take it off the grid.
-        let solid = matches!(layer.source, LayerSource::Solid { .. });
-        if masks::apply(ctx, layer, &mut buf, self.mask_blur(ctx, layer)) || !solid {
-            self.pipe.quantize(&mut buf.img);
-        }
-        Some(buf)
-    }
-
-    /// Fully processed layer buffer (source → masks → effects → layer styles, flattened).
-    /// Served from the layer cache when the layer's content key matches.
-    pub fn layer_buf(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
-        self.layer_buf_keyed(ctx, layer).map(|(b, _)| b)
-    }
-
-    /// [`Self::layer_buf`] in the blending space (linear with Blend Colors Using 1.0 Gamma).
-    pub fn blend_layer_buf(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
-        let (b, k) = self.layer_buf_keyed(ctx, layer)?;
-        Some(self.to_blend(b, k))
-    }
-
-    /// A buffer converted to the blending space (cached under a key derived from `key`).
-    pub(crate) fn to_blend(&self, b: Arc<Buf>, key: Option<u64>) -> Arc<Buf> {
-        let Some(c) = self.pipe.to_blend() else { return b };
-        let key = key.map(|k| cache::derive(k, 0x1ea7));
-        if let (Some(cache), Some(k)) = (self.cache, key)
-            && let Some(x) = cache.get(k)
-        {
-            return x;
-        }
-        let mut nb = (*b).clone();
-        color::convert(&mut nb.img, &c);
-        let nb = Arc::new(nb);
-        if let (Some(cache), Some(k)) = (self.cache_to_keep(), key) {
-            cache.insert(k, nb.clone());
-        }
-        nb
-    }
-
-    fn layer_buf_keyed(&self, ctx: &EvalCtx, layer: &Layer) -> Option<(Arc<Buf>, Option<u64>)> {
-        let st = self.styled(ctx, layer, None)?;
-        if st.passes.is_empty() {
-            return Some((st.body, st.key));
-        }
-        let key = st.key.map(|k| cache::derive(k, 0xf1a7));
-        if let (Some(c), Some(k)) = (self.cache, key)
-            && let Some(b) = c.get(k)
-        {
-            return Some((b, key));
-        }
-        let flat = Arc::new(styles::Styled { passes: st.passes.iter().map(|(b, m)| ((**b).clone(), *m)).collect(), body: (*st.body).clone() }.flatten());
-        if let (Some(c), Some(k)) = (self.cache_to_keep(), key) {
-            c.insert(k, flat.clone());
-        }
-        Some((flat, key))
-    }
-
-    /// A layer's source pixels at the context time, before masks, effects and the transform
-    /// (what the motion tracker analyses, like After Effects' Layer panel). `None` for layers
-    /// without pixels.
-    pub fn layer_source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Buf> {
-        // The whole layer, not the part the frame shows (see `raster_clip`).
-        Renderer { whole_raster: true, ..*self }.source(ctx, layer)
-    }
-
-    /// Layer pixels after source → masks → effects (no layer styles).
-    pub fn content_buf(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
-        self.content_buf_timed(ctx, layer, None).map(|(b, _)| b)
-    }
-
-    fn content_buf_timed(&self, ctx: &EvalCtx, layer: &Layer, mut timing: Option<&mut LayerTiming>) -> Option<(Arc<Buf>, Option<u64>)> {
-        let key = self.cache.and_then(|_| cache::layer_key(ctx, layer, self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer)));
-        let key = self.content_key(ctx, layer, self.clipped_key(ctx, layer, key));
-        if let (Some(c), Some(k)) = (self.cache, key)
-            && let Some(b) = c.get(k)
-        {
-            if let Some(t) = timing.as_deref_mut() {
-                t.cached = true;
-            }
-            return Some((b, key));
-        }
-        let buf = self.masked_source(ctx, layer)?;
-        let buf = Arc::new(self.apply_effects_timed(ctx, layer, buf, false, usize::MAX, timing.map(|t| &mut t.effects)));
-        if let (Some(c), Some(k)) = (self.cache_to_keep(), key) {
-            c.insert(k, buf.clone());
-        }
-        Some((buf, key))
-    }
-
-    /// A layer's input at the context time: source → masks → its first `effects` effects
-    /// (what Time effects read at neighbouring times), in effect space (see [`effect_bounds`]):
-    /// what effect `effects` sees. Served from / stored in the layer cache under its own key,
-    /// so scrubbing reuses frames rendered for earlier output frames.
-    pub fn layer_input(&self, ctx: &EvalCtx, layer: &Layer, effects: usize) -> Option<Arc<Buf>> {
-        let key = self.cache.and_then(|_| cache::input_key(ctx, layer, self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer), effects));
-        let key = self.content_key(ctx, layer, self.clipped_key(ctx, layer, key));
-        if let (Some(c), Some(k)) = (self.cache, key)
-            && let Some(b) = c.get(k)
-        {
-            return Some(b);
-        }
-        let mut buf = self.masked_source(ctx, layer)?;
-        let origin = ctx.effect_bounds(layer).1;
-        buf.rebase(origin);
-        if effects > 0 {
-            buf = self.effect_space_stack(ctx, layer, buf, false, effects, None, origin);
-        }
-        let buf = Arc::new(buf);
-        if let (Some(c), Some(k)) = (self.cache_to_keep(), key) {
-            c.insert(k, buf.clone());
-        }
-        Some(buf)
-    }
-
-    /// The layer with its styles: exterior passes and body (cached per pass).
-    fn styled(&self, ctx: &EvalCtx, layer: &Layer, mut timing: Option<&mut LayerTiming>) -> Option<StyledLayer> {
-        let (content, ckey) = self.content_buf_timed(ctx, layer, timing.as_deref_mut())?;
-        if !styles::active(ctx, layer) {
-            return Some(StyledLayer { passes: vec![], body: content.clone(), content, key: ckey, ckey, plain: true });
-        }
-        let modes = styles::pass_modes(ctx, layer);
-        let key = ckey.map(|k| cache::styles_key(ctx, layer, k));
-        if let (Some(c), Some(k)) = (self.cache, key)
-            && let Some(body) = c.get(k)
-        {
-            let passes: Option<Vec<_>> = modes.iter().enumerate().map(|(i, m)| c.get(cache::derive(k, i as u64 + 1)).map(|b| (b, *m))).collect();
-            if let Some(passes) = passes {
-                return Some(StyledLayer { passes, body, content, key, ckey, plain: false });
-            }
-        }
-        let t0 = web_time::Instant::now();
-        let size = source_size(self.project, layer);
-        let layer_size = if size.0 == 0 { [ctx.comp.width as f64, ctx.comp.height as f64] } else { [size.0 as f64, size.1 as f64] };
-        let st = styles::render(ctx, layer, &content, layer_size);
-        if let Some(t) = timing {
-            t.cached = false;
-            t.effects.push(("layerStyles".into(), t0.elapsed().as_secs_f64() * 1e3));
-        }
-        let body = Arc::new(st.body);
-        let passes: Vec<_> = st.passes.into_iter().map(|(b, m)| (Arc::new(b), m)).collect();
-        if let (Some(c), Some(k)) = (self.cache_to_keep(), key) {
-            c.insert(k, body.clone());
-            for (i, (b, _)) in passes.iter().enumerate() {
-                c.insert(cache::derive(k, i as u64 + 1), b.clone());
-            }
-        }
-        Some(StyledLayer { passes, body, content, key, ckey, plain: false })
-    }
-
-    /// The styled layer's buffers in the blending space.
-    fn styled_to_blend(&self, st: StyledLayer) -> StyledLayer {
-        if self.pipe.to_blend().is_none() {
-            return st;
-        }
-        let body = self.to_blend(st.body, st.key);
-        let content = if st.plain { body.clone() } else { self.to_blend(st.content, st.ckey) };
-        let passes = st.passes.into_iter().enumerate().map(|(i, (b, m))| (self.to_blend(b, st.key.map(|k| cache::derive(k, i as u64 + 1))), m)).collect();
-        StyledLayer { passes, body, content, ..st }
-    }
-
-    fn sampling(&self, layer: &Layer) -> effectcraft_raster::Sampling {
-        if self.quality(layer) == Quality::Draft {
-            // Draft quality: no interpolation (nearest neighbour), as After Effects' Draft.
-            effectcraft_raster::Sampling::Nearest
-        } else if self.opts.draft {
-            effectcraft_raster::Sampling::Bilinear
-        } else if layer.switches.sampling == Sampling::Bicubic {
-            effectcraft_raster::Sampling::Bicubic
-        } else {
-            effectcraft_raster::Sampling::Bilinear
-        }
-    }
-
-    /// The region of interest of a top-level 2D frame: (x, y) offset of the output in output
-    /// pixels and its size. `None` renders the whole comp (no ROI, or a nested comp).
-    pub(crate) fn roi_offset(&self) -> Option<(f64, f64, u32, u32)> {
-        let r = self.opts.roi.filter(|_| self.top)?;
-        let s = self.opts.scale;
-        if r[2] <= 0.0 || r[3] <= 0.0 {
-            return None;
-        }
-        Some(((r[0] * s).round(), (r[1] * s).round(), ((r[2] * s).round() as u32).max(1), ((r[3] * s).round() as u32).max(1)))
-    }
-
-    /// The region of interest's offset in output pixels for 3D projection (0 without one).
-    pub(crate) fn out_offset(&self) -> (f64, f64) {
-        self.roi_offset().map_or((0.0, 0.0), |(x, y, _, _)| (x, y))
-    }
-
-    /// Scaled comp pixel → output pixel: the region of interest's offset.
-    fn out_matrix(&self) -> Mat3 {
-        match self.roi_offset() {
-            Some((x, y, _, _)) => Mat3::translate(vec2(-x, -y)),
-            None => Mat3::IDENTITY,
-        }
-    }
-
-    /// Buffer pixel → output pixel matrix for the layer at the context time.
-    fn buf_matrix(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> Mat3 {
-        let (l2c, _) = ctx.layer_to_comp(layer);
-        self.place_matrix(self.outer.map_or(l2c, |o| o * l2c), buf)
-    }
-
-    /// Buffer pixel → output pixel matrix for a layer → (top-level) comp matrix.
-    fn place_matrix(&self, l2c: Mat3, buf: &Buf) -> Mat3 {
-        let s = self.opts.scale;
-        self.out_matrix()
-            * Mat3::scale(vec2(s, s))
-            * l2c
-            * Mat3::scale(vec2(1.0 / buf.scale, 1.0 / buf.scale))
-            * Mat3::translate(vec2(-buf.offset[0], -buf.offset[1]))
-    }
-
-    /// The collapsed precomp layers this comp is drawn through, outermost first.
-    fn links(&self) -> impl Iterator<Item = &Through<'a>> {
-        self.through.iter().map_while(Option::as_ref)
-    }
-
-    /// The shutter of a layer's motion blur: its comp's, or for a collapsed precomp's layers the
-    /// outermost containing comp's.
-    fn shutter(&self, ctx: &EvalCtx) -> Shutter {
-        let c: &Comp = match self.links().next() {
-            Some(l) => l.comp,
-            None => ctx.comp,
-        };
-        Shutter {
-            angle: c.shutter_angle / 360.0,
-            phase: c.shutter_phase / 360.0,
-            frame: c.frame_duration().seconds(),
-            samples: c.motion_blur_samples,
-            limit: c.motion_blur_adaptive_limit,
-        }
-    }
-
-    /// Whether a layer moves within the shutter: its own motion blur, or that of a collapsed
-    /// precomp layer it is drawn through.
-    fn blurred(&self, ctx: &EvalCtx, layer: &Layer) -> bool {
-        self.mb_on(ctx, layer) || (!self.through_lost && self.links().any(|l| l.blur))
-    }
-
-    /// The collapsed precomps' matrix (nested comp → the frame's comp) and the nested comp's time
-    /// `dt` seconds into the outermost comp's shutter: each precomp layer moves if it is motion
-    /// blurred, and times map down through each one (stretch, time remapping).
-    fn outer_at(&self, ctx: &EvalCtx, dt: f64) -> (Option<Mat3>, Tick) {
-        let shift = Tick::from_seconds_f64(dt);
-        let mut outer: Option<Mat3> = None;
-        let mut t: Option<Tick> = None;
-        for l in self.links() {
-            let at = EvalCtx { comp_id: l.comp_id, comp: l.comp, time: t.unwrap_or(l.time + shift), ..*ctx };
-            let (m, _) = if l.blur { at.layer_to_comp(l.layer) } else { EvalCtx { time: l.time, ..at }.layer_to_comp(l.layer) };
-            outer = Some(outer.map_or(m, |o| o * m));
-            t = Some(at.nested_time(l.layer));
-        }
-        (outer, t.unwrap_or(ctx.time + shift))
-    }
-
-    /// [`Self::buf_matrix`] for the motion-blur sub-sample `dt` seconds into the shutter: the
-    /// layer moves if it is motion blurred, the collapsed precomps above it if theirs are.
-    fn buf_matrix_at(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, dt: f64) -> Mat3 {
-        if self.through_lost || self.links().next().is_none() {
-            return self.buf_matrix(&ctx.at(ctx.time + Tick::from_seconds_f64(dt)), layer, buf);
-        }
-        let (outer, t) = self.outer_at(ctx, dt);
-        let lctx = if self.mb_on(ctx, layer) { ctx.at(t) } else { *ctx };
-        let (l2c, _) = lctx.layer_to_comp(layer);
-        self.place_matrix(outer.map_or(l2c, |o| o * l2c), buf)
-    }
-
-    /// Shape and text content that animates within the shutter (paths, Trim Paths, text
-    /// animators…) of a motion-blurred layer: the times its source is drawn at and averaged,
-    /// Samples Per Frame of them, as After Effects does for shape layers. `None` when the content
-    /// holds still (compared through its cache key, which leaves the transform out).
-    fn content_times(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Vec<Tick>> {
-        if !matches!(layer.source, LayerSource::Shape | LayerSource::Text) || !self.mb_on(ctx, layer) {
-            return None;
-        }
-        let sh = self.shutter(ctx);
-        if sh.angle <= 0.0 {
-            return None;
-        }
-        let n = if self.opts.draft { 4 } else { (sh.samples as usize).clamp(2, 64) };
-        let times: Vec<Tick> = (0..n).map(|i| self.outer_at(ctx, sh.offset(i, n)).1).collect();
-        let key = |t: Tick| cache::layer_key(&ctx.at(t), layer, 1.0, false, false);
-        let k0 = key(*times.first()?)?;
-        let moves = [times.get(n / 2), times.last()].into_iter().flatten().any(|t| key(*t) != Some(k0));
-        moves.then_some(times)
-    }
-
-    /// The layer's source drawn at each of `times` and averaged (premultiplied) on the union of
-    /// their bounds. Content that also changes its raster scale within the shutter, or would need
-    /// an outsized buffer, is drawn once.
-    fn blurred_source(&self, ctx: &EvalCtx, layer: &Layer, times: &[Tick]) -> Option<Buf> {
-        let bufs: Vec<Buf> = times.iter().filter_map(|t| self.source(&ctx.at(*t), layer)).collect();
-        let scale = bufs.first()?.scale;
-        // Pixel = layer point × scale + offset: with the largest offset every buffer lands at
-        // x + (off - its offset) ≥ 0.
-        let off = [0, 1].map(|i| bufs.iter().map(|b| b.offset[i]).fold(f64::MIN, f64::max));
-        let w = bufs.iter().map(|b| off[0] - b.offset[0] + b.img.width as f64).fold(0.0, f64::max).ceil();
-        let h = bufs.iter().map(|b| off[1] - b.offset[1] + b.img.height as f64).fold(0.0, f64::max).ceil();
-        if bufs.iter().any(|b| (b.scale - scale).abs() > 1e-9) || !(w * h).is_finite() || w * h > (1u64 << 26) as f64 {
-            return self.source(ctx, layer);
-        }
-        let mut acc = Image::new(w as u32, h as u32);
-        let k = 1.0 / bufs.len() as f32;
-        for b in &bufs {
-            let m = Mat3::translate(vec2(off[0] - b.offset[0], off[1] - b.offset[1]));
-            effectcraft_raster::accumulate_warp(&mut acc, &b.img, &m, effectcraft_raster::Sampling::Bilinear, k);
-        }
-        Some(Buf { img: acc, offset: off, scale })
-    }
-
-    /// A processed-layer cache key that also covers content motion blur (the averaged source
-    /// depends on the content at every sub-sample).
-    fn content_key(&self, ctx: &EvalCtx, layer: &Layer, key: Option<u64>) -> Option<u64> {
-        let k = key?;
-        let Some(times) = self.content_times(ctx, layer) else { return Some(k) };
-        times.iter().try_fold(cache::derive(k, 0x6d62_6c72), |d, t| Some(cache::derive(d, cache::layer_key(&ctx.at(*t), layer, 1.0, false, false)?)))
-    }
-
-    /// Whether a layer is motion blurred: the render options, the comp's switch and the layer's
-    /// switch (limited by the precomp layers above when switches affect nested comps). Layer
-    /// motion, mask motion blur, effects that read the shutter and Advanced 3D all ask this.
-    pub(crate) fn mb_on(&self, ctx: &EvalCtx, layer: &Layer) -> bool {
-        self.opts.motion_blur && ctx.comp.enable_motion_blur && self.layer_motion_blur(layer)
-    }
-
-    /// What a layer's mask motion blur may do in this render (see [`masks::MaskBlur`]).
-    fn mask_blur(&self, ctx: &EvalCtx, layer: &Layer) -> masks::MaskBlur {
-        masks::MaskBlur {
-            allowed: self.opts.motion_blur && ctx.comp.enable_motion_blur && self.inherited.is_none_or(|(_, mb)| mb),
-            layer: self.layer_motion_blur(layer),
-            samples: if self.opts.draft { 4 } else { ctx.comp.motion_blur_samples as usize },
-        }
-    }
-
-    /// Motion-blur sub-samples for a layer buffer (1 = no motion blur). As in After Effects, a 2D
-    /// layer gets about one sample per output pixel its corners travel during the shutter,
-    /// at least Samples Per Frame and at most the comp's Adaptive Sample Limit; a layer that
-    /// does not move within the shutter is drawn once.
-    fn mb_samples(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> usize {
-        if !self.blurred(ctx, layer) {
-            return 1;
-        }
-        let travel = self.shutter_travel(ctx, layer, buf);
-        if travel < 1e-3 {
-            return 1;
-        }
-        if self.opts.draft {
-            return 4;
-        }
-        let sh = self.shutter(ctx);
-        adaptive_samples(travel, sh.samples, sh.limit)
-    }
-
-    /// Largest distance (output pixels) a corner of the layer buffer moves during the shutter,
-    /// measured along the path at a few points.
-    fn shutter_travel(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> f64 {
-        let sh = self.shutter(ctx);
-        let (w, h) = (buf.img.width as f64, buf.img.height as f64);
-        let corners = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h), (w * 0.5, h * 0.5)];
-        const PROBES: usize = 8;
-        let mut prev: Option<Vec<effectcraft_geom::Vec2>> = None;
-        let mut travel = vec![0.0f64; corners.len()];
-        for i in 0..PROBES {
-            let m = self.buf_matrix_at(ctx, layer, buf, sh.offset(i, PROBES));
-            let pts: Vec<_> = corners.iter().map(|&(x, y)| m.apply(vec2(x, y))).collect();
-            if let Some(p) = &prev {
-                for (k, (a, b)) in p.iter().zip(&pts).enumerate() {
-                    travel[k] += (b.x - a.x).hypot(b.y - a.y);
-                }
-            }
-            prev = Some(pts);
-        }
-        travel.into_iter().fold(0.0, f64::max)
-    }
-
-    /// Canvas pixels that compositing `buf` for `layer` can change: the transformed buffer's
-    /// bounds plus the resampling footprint. Stencil/silhouette modes, motion blur and
-    /// perspective fall back to the whole canvas.
-    ///
-    /// A quantised buffer placed pixel-exactly (integer translation, Normal, 100%) over a blank
-    /// canvas leaves exactly its own (quantised) pixels: nothing to re-quantise.
-    fn footprint(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, opacity: f32, blank: bool) -> Region {
-        if layer.blend_mode.is_stencil() || self.mb_samples(ctx, layer, buf) > 1 {
-            return Region::Full;
-        }
-        let m = self.buf_matrix(ctx, layer, buf);
-        if !m.is_affine() {
-            return Region::Full;
-        }
-        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
-        let k = &m.0;
-        let integral = |v: f64| v == v.round();
-        if blank
-            && layer.blend_mode == BlendMode::Normal
-            && opacity == 1.0
-            && !matte
-            && !layer.preserve_transparency
-            && self.pipe.to_blend().is_none()
-            && k[0][0] == 1.0
-            && k[1][1] == 1.0
-            && k[0][1] == 0.0
-            && k[1][0] == 0.0
-            && integral(k[0][2])
-            && integral(k[1][2])
-        {
-            return Region::Empty;
-        }
-        let (w, h) = (buf.img.width as f64, buf.img.height as f64);
-        let c = [(0.0, 0.0), (w, 0.0), (0.0, h), (w, h)].map(|(x, y)| m.apply(vec2(x, y)));
-        let (x0, x1) = (c.iter().map(|p| p.x).fold(f64::INFINITY, f64::min), c.iter().map(|p| p.x).fold(f64::NEG_INFINITY, f64::max));
-        let (y0, y1) = (c.iter().map(|p| p.y).fold(f64::INFINITY, f64::min), c.iter().map(|p| p.y).fold(f64::NEG_INFINITY, f64::max));
-        color::PxRect::covering(x0, y0, x1, y1, 3.0).map_or(Region::Full, Region::Rect)
-    }
-
-    /// How a processed layer buffer lands in the output: one buffer → output matrix, or one per
-    /// motion-blur sub-sample (averaged), with the layer's sampling filter and dissolve seed.
-    pub fn placement(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf) -> Placement {
-        let samples = self.mb_samples(ctx, layer, buf);
-        let (sampling, seed) = (self.sampling(layer), layer.id.0 as u32);
-        if samples <= 1 {
-            return Placement { matrices: vec![self.buf_matrix(ctx, layer, buf)], sampling, seed };
-        }
-        let sh = self.shutter(ctx);
-        let matrices = (0..samples).map(|i| self.buf_matrix_at(ctx, layer, buf, sh.offset(i, samples))).collect();
-        Placement { matrices, sampling, seed }
-    }
-
-    /// Draw a processed layer into `target` (transform, motion blur) with `mode`/`opacity`.
-    fn place(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, target: &mut Image, mode: BlendMode, opacity: f32) {
-        let pl = self.placement(ctx, layer, buf);
-        let opts = WarpOpts { sampling: pl.sampling, opacity, mode, seed: pl.seed, clip: None };
-        if let [m] = pl.matrices.as_slice() {
-            composite_warp(target, &buf.img, m, &opts);
-            return;
-        }
-        // Sub-samples sum straight into one buffer (each warp is row-parallel).
-        let mut acc = Image::new(target.width, target.height);
-        let k = 1.0 / pl.matrices.len() as f32;
-        for m in &pl.matrices {
-            effectcraft_raster::accumulate_warp(&mut acc, &buf.img, m, opts.sampling, k);
-        }
-        target.blend_from(&acc, mode, opacity, pl.seed);
-    }
-
-    /// Draw a 2D layer into `canvas`; returns the region it may have changed.
-    fn draw_layer(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image, blank: bool) -> Region {
-        let opacity = ctx.opacity(layer) as f32 * self.opacity_mul;
-        if self.quality(layer) == Quality::Wireframe && !layer.switches.adjustment {
-            self.draw_wireframe(ctx, layer, canvas);
-            return Region::Full;
-        }
-        if opacity <= 0.0 && !layer.switches.adjustment {
-            return Region::Empty;
-        }
-        if layer.switches.adjustment {
-            self.draw_adjustment(ctx, layer, canvas, opacity);
-            return Region::Full;
-        }
-        let mut timing = self.profile.map(|_| LayerTiming { depth: self.depth, layer: layer.name.clone(), ..Default::default() });
-        let t0 = web_time::Instant::now();
-        let Some(st) = self.styled(ctx, layer, timing.as_mut()) else { return Region::Empty };
-        let st = self.styled_to_blend(st);
-        let t1 = web_time::Instant::now();
-        let changed = if st.plain {
-            self.composite_layer(ctx, layer, &st.body, canvas, opacity);
-            self.footprint(ctx, layer, &st.body, opacity, blank)
-        } else {
-            self.composite_styled(ctx, layer, &st, canvas, opacity);
-            Region::Full
-        };
-        if let (Some(prof), Some(mut timing)) = (self.profile, timing) {
-            timing.process_ms = (t1 - t0).as_secs_f64() * 1e3;
-            timing.composite_ms = t1.elapsed().as_secs_f64() * 1e3;
-            if let Ok(mut v) = prof.lock() {
-                v.push(timing);
-            }
-        }
-        changed
-    }
-
-    /// Composite a styled layer: exterior passes with their own modes, then the body with the
-    /// layer's mode; the layer's opacity fades the whole stack. Knockout clears what is below the
-    /// layer's content; switched-off R/G/B channels keep the values below.
-    fn composite_styled(&self, ctx: &EvalCtx, layer: &Layer, st: &StyledLayer, canvas: &mut Image, opacity: f32) {
-        let bl = styles::blending(ctx, layer);
-        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
-        if matte || layer.preserve_transparency {
-            let mut iso = Image::new(canvas.width, canvas.height);
-            for (b, m) in &st.passes {
-                self.place(ctx, layer, b, &mut iso, *m, 1.0);
-            }
-            self.place(ctx, layer, &st.body, &mut iso, BlendMode::Normal, 1.0);
-            self.composite_iso(ctx, layer, iso, canvas, opacity);
-            return;
-        }
-        let mut tmp = canvas.clone();
-        if bl.knockout > 0 {
-            let mut k = Image::new(canvas.width, canvas.height);
-            self.place(ctx, layer, &st.content, &mut k, BlendMode::Normal, 1.0);
-            tmp.data.par_iter_mut().zip(k.data.par_iter()).for_each(|(p, q)| {
-                let keep = 1.0 - q[3].clamp(0.0, 1.0);
-                for c in p.iter_mut() {
-                    *c *= keep;
-                }
-            });
-        }
-        for (b, m) in &st.passes {
-            self.place(ctx, layer, b, &mut tmp, *m, 1.0);
-        }
-        self.place(ctx, layer, &st.body, &mut tmp, layer.blend_mode, 1.0);
-        let ch = bl.channels;
-        canvas.data.par_iter_mut().zip(tmp.data.par_iter()).for_each(|(c, t)| {
-            for i in 0..4 {
-                let v = if i < 3 && !ch[i] { c[i] } else { t[i] };
-                c[i] += (v - c[i]) * opacity;
-            }
-        });
-    }
-
-    fn composite_layer(&self, ctx: &EvalCtx, layer: &Layer, buf: &Buf, canvas: &mut Image, opacity: f32) {
-        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
-        if !matte && !layer.preserve_transparency {
-            self.place(ctx, layer, buf, canvas, layer.blend_mode, opacity);
-            return;
-        }
-        // Render in isolation, then matte / preserve transparency, then blend.
-        let mut iso = Image::new(canvas.width, canvas.height);
-        self.place(ctx, layer, buf, &mut iso, BlendMode::Normal, 1.0);
-        self.composite_iso(ctx, layer, iso, canvas, opacity);
-    }
-
-    /// Apply the track matte / preserve transparency to an isolated layer render, then blend.
-    fn composite_iso(&self, ctx: &EvalCtx, layer: &Layer, iso: Image, canvas: &mut Image, opacity: f32) {
-        self.composite_iso_with(ctx, layer, iso, canvas, opacity, None);
-    }
-
-    /// [`Self::composite_iso`] with the track matte's pixels already drawn (`matte`, e.g. a 3D
-    /// matte seen through the camera); otherwise the matte layer is placed in 2D.
-    pub(crate) fn composite_iso_with(&self, ctx: &EvalCtx, layer: &Layer, mut iso: Image, canvas: &mut Image, opacity: f32, matte_img: Option<Image>) {
-        self.apply_track_matte(ctx, layer, &mut iso, matte_img);
-        if layer.preserve_transparency {
-            iso.data.par_iter_mut().zip(canvas.data.par_iter()).for_each(|(p, q)| {
-                for c in p.iter_mut() {
-                    *c *= q[3];
-                }
-            });
-        }
-        canvas.blend_from(&iso, layer.blend_mode, opacity, layer.id.0 as u32);
-    }
-
-    /// Multiply `img` (comp-sized) by the layer's track matte, if it has one; `matte_img` as in
-    /// [`Self::composite_iso_with`].
-    fn apply_track_matte(&self, ctx: &EvalCtx, layer: &Layer, img: &mut Image, matte_img: Option<Image>) {
-        let matte = layer.track_matte.and_then(|tm| ctx.comp.layer(tm.layer).filter(|m| m.id != layer.id).map(|m| (m, tm.kind)));
-        if let Some((m, kind)) = matte {
-            let mimg = match matte_img {
-                Some(i) if i.width == img.width && i.height == img.height => i,
-                _ => {
-                    let mut mimg = Image::new(img.width, img.height);
-                    if m.is_active_at(ctx.time)
-                        && let Some(mb) = self.layer_buf(ctx, m)
-                    {
-                        let mo = ctx.opacity(m) as f32;
-                        self.place(ctx, m, &mb, &mut mimg, BlendMode::Normal, mo);
-                    }
-                    mimg
-                }
-            };
-            img.data.par_iter_mut().zip(mimg.data.par_iter()).for_each(|(p, q)| {
-                let k = match kind {
-                    MatteKind::Alpha => q[3],
-                    MatteKind::AlphaInverted => 1.0 - q[3],
-                    MatteKind::Luma => effectcraft_color::luminance(q[0], q[1], q[2]),
-                    MatteKind::LumaInverted => 1.0 - effectcraft_color::luminance(q[0], q[1], q[2]),
-                }
-                .clamp(0.0, 1.0);
-                for c in p.iter_mut() {
-                    *c *= k;
-                }
-            });
-        }
-    }
-
-    /// Adjustment layer: effects applied to the comp below, limited to the layer's footprint
-    /// and its track matte.
-    fn draw_adjustment(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image, opacity: f32) {
-        let Some(mut foot) = self.source(ctx, layer) else { return };
-        let _ = masks::apply(ctx, layer, &mut foot, self.mask_blur(ctx, layer));
-        let mut matte = Image::new(canvas.width, canvas.height);
-        self.place(ctx, layer, &foot, &mut matte, BlendMode::Normal, 1.0);
-        self.apply_track_matte(ctx, layer, &mut matte, None);
-        let o = self.roi_offset().map(|(x, y, _, _)| [-x, -y]).unwrap_or([0.0; 2]);
-        let mut below = Buf { img: canvas.clone(), offset: o, scale: self.opts.scale };
-        // Effects run in the working space, not the linear blending space.
-        if let Some(c) = self.pipe.from_blend() {
-            color::convert(&mut below.img, &c);
-        }
-        let mut adjusted = self.apply_effects(ctx, layer, below, true);
-        if let Some(c) = self.pipe.to_blend() {
-            color::convert(&mut adjusted.img, &c);
-        }
-        if adjusted.img.width != canvas.width || adjusted.img.height != canvas.height {
-            return;
-        }
-        canvas.data.par_iter_mut().zip(adjusted.img.data.par_iter()).zip(matte.data.par_iter()).for_each(|((c, a), m)| {
-            let k = m[3] * opacity;
-            for i in 0..4 {
-                c[i] += (a[i] - c[i]) * k;
-            }
-        });
-    }
-}
-
-/// A layer ready to composite (see [`Renderer::styled_layer`]).
-pub struct StyledLayer {
-    /// Exterior style passes (Drop Shadow, Outer Glow) with their blend modes.
-    pub passes: Vec<(Arc<Buf>, BlendMode)>,
-    pub body: Arc<Buf>,
-    /// Pre-style pixels (knockout shape).
-    pub content: Arc<Buf>,
-    /// Styled cache key (the content key when plain).
-    key: Option<u64>,
-    /// Content cache key.
-    ckey: Option<u64>,
-    /// No layer styles: composite `body` the usual way.
-    pub plain: bool,
-}
-
-/// Where a layer buffer lands (see [`Renderer::placement`]).
-#[derive(Clone, Debug)]
-pub struct Placement {
-    /// Buffer pixel → output pixel; several = motion-blur sub-samples (equal weights).
-    pub matrices: Vec<Mat3>,
-    pub sampling: effectcraft_raster::Sampling,
-    /// Dissolve noise seed.
-    pub seed: u32,
-}
-
-/// Hooks for accelerated compositors (`effectcraft-gpu`): the pieces of the CPU walk they reuse
-/// or fall back to. The CPU compositor itself is [`Renderer::comp_frame_cpu`].
-impl<'a> Renderer<'a> {
-    /// The project's colour pipeline.
-    pub fn pipe(&self) -> color::Pipe {
-        self.pipe
-    }
-
-    /// Nesting depth (0 = the top-level comp).
-    pub fn depth(&self) -> usize {
-        self.depth
-    }
-
-    /// The auxiliary 3D channels of comp `comp_id` at comp time `t` (depth, layer IDs, normals,
-    /// UVs, Cryptomatte; see `three_d::compose::aux_pass`), at the renderer's output scale.
-    pub fn comp_aux(&self, comp_id: ItemId, t: Tick) -> Option<effectcraft_raster::AuxChannels> {
-        let ctx = self.eval_ctx(comp_id, t)?;
-        Some(three_d::compose::aux_pass(self, &ctx))
-    }
-
-    /// Evaluation context of comp `comp_id` at comp time `t`.
-    pub fn eval_ctx(&self, comp_id: ItemId, t: Tick) -> Option<EvalCtx<'a>> {
-        Some(self.ctx(comp_id, self.project.comp(comp_id)?, t))
-    }
-
-    /// The layers drawn at the context time, bottom to top (solo, guides and visibility
-    /// applied).
-    pub fn visible_layers(&self, ctx: &EvalCtx<'a>) -> Vec<&'a Layer> {
-        let (comp, t) = (ctx.comp, ctx.time);
-        let any_solo = comp.layers.iter().any(|l| l.switches.solo && l.source.is_av());
-        comp.layers
-            .iter()
-            .rev()
-            .filter(|l| l.is_active_at(t) && l.has_video() && !l.environment && (!any_solo || l.switches.solo) && (self.opts.guides || !l.switches.guide))
-            .collect()
-    }
-
-    /// Draw a run of consecutive 3D layers into `canvas` (CPU).
-    pub fn draw_3d_run(&self, ctx: &EvalCtx<'a>, run: &[&Layer], canvas: &mut Image) {
-        three_d::compose::draw_run(self, ctx, run, canvas);
-    }
-
-    /// A run of consecutive 3D layers prepared for an accelerator (planes, lights, shadow
-    /// casters; see [`three_d::Run3d`]) at output size `out`. `None` = draw it with
-    /// [`Self::draw_3d_run`] (adjustment or wireframe layers in the run, Advanced 3D).
-    pub fn prepare_3d_run(&self, ctx: &EvalCtx<'a>, run: &[&Layer], out: (u32, u32)) -> Option<three_d::Run3d> {
-        three_d::compose::gpu_run(self, ctx, run, out)
-    }
-
-    /// A run of consecutive 3D layers of an Advanced 3D comp prepared for an accelerator's
-    /// compositor ([`three_d::adv::Prepared`]): rendered as one scene and composited (Normal,
-    /// premultiplied over) onto the canvas. `None` = not an Advanced 3D comp, or a layer needs the
-    /// 2D compositing path (blend mode, track matte, Preserve Transparency): draw it with
-    /// [`Self::draw_3d_run`].
-    pub fn prepare_adv_run<'p>(&'p self, ctx: &'p EvalCtx<'a>, run: &'p [&'p Layer], out: (u32, u32)) -> Option<three_d::adv::Prepared<'p, 'a>> {
-        three_d::adv::prepare_run(self, ctx, run, out)
-    }
-
-    /// A run of consecutive 3D layers of an Advanced 3D comp whose layers need the 2D
-    /// compositing path (blend mode, track matte, Preserve Transparency), split for an
-    /// accelerator's compositor ([`three_d::adv::SplitRun`]). `None` = [`Self::prepare_adv_run`]
-    /// covers it, or it isn't an Advanced 3D run.
-    pub fn split_adv_run<'p>(&'p self, ctx: &'p EvalCtx<'a>, run: &'p [&'p Layer], out: (u32, u32)) -> Option<three_d::adv::SplitRun<'p, 'a>> {
-        three_d::adv::split_run(self, ctx, run, out)
-    }
-
-    /// Whether the comp's 3D layers draw with the Advanced 3D renderer.
-    pub fn is_adv3d(&self, ctx: &EvalCtx) -> bool {
-        three_d::adv::active(self, ctx)
-    }
-
-    /// An Environment Light Background layer ready to draw on an accelerator
-    /// ([`three_d::SkyDraw`]; the CPU draws it in `draw_3d_run`). `None` = nothing to draw.
-    pub fn sky_draw(&self, ctx: &EvalCtx, layer: &Layer) -> Option<three_d::SkyDraw> {
-        three_d::compose::sky_draw(self, ctx, layer)
-    }
-
-    /// The pixels a Wireframe-quality layer sets (white, opaque) on a `size` canvas: its
-    /// bounds' outline, one pixel wide. Empty when the layer has no bounds.
-    pub fn wireframe_pixels(&self, ctx: &EvalCtx, layer: &Layer, size: (u32, u32)) -> Vec<(u32, u32)> {
-        let Some(b) = content_bounds(ctx, layer) else { return vec![] };
-        let s = self.opts.scale;
-        let (l2c, _) = ctx.layer_to_comp(layer);
-        let m = Mat3::scale(vec2(s, s)) * self.outer.map_or(l2c, |o| o * l2c);
-        let c = [(b[0], b[1]), (b[2], b[1]), (b[2], b[3]), (b[0], b[3])].map(|(x, y)| m.apply(vec2(x, y)));
-        let (w, h) = (size.0 as i64, size.1 as i64);
-        let mut out = vec![];
-        for i in 0..4 {
-            let (p, q) = (c[i], c[(i + 1) % 4]);
-            let n = ((q.x - p.x).abs().max((q.y - p.y).abs()) * 2.0).ceil().clamp(1.0, 1.0e5) as usize;
-            for j in 0..=n {
-                let t = j as f64 / n as f64;
-                let (x, y) = ((p.x + (q.x - p.x) * t).floor() as i64, (p.y + (q.y - p.y) * t).floor() as i64);
-                if x >= 0 && y >= 0 && x < w && y < h {
-                    out.push((x as u32, y as u32));
-                }
-            }
-        }
-        out
-    }
-
-    /// Run the layer's effect stack on `target` (an accelerator's resident image): GPU-capable
-    /// runs through [`FxTarget::gpu`], the others through [`FxTarget::cpu`], with the CPU's
-    /// parameters and environment. `adjustment`: the stack runs on the comp below (adjustment
-    /// layers).
-    pub fn run_effects_on(&self, ctx: &EvalCtx, layer: &Layer, adjustment: bool, target: &mut dyn FxTarget) {
-        // `target` is used as it is: the comp below for adjustment layers (the callers).
-        self.run_effect_stack(ctx, layer, adjustment, usize::MAX, None, [0.0; 2], target);
-    }
-
-    /// [`Renderer::run_effects_on`] for a (non-adjustment) layer's own pixels: `target` holds
-    /// them in effect space (as [`Renderer::layer_input`] hands them out) and the result stays
-    /// there. Returns the effect-space origin in layer coordinates (rebase by its negation).
-    pub fn run_layer_effects_on(&self, ctx: &EvalCtx, layer: &Layer, target: &mut dyn FxTarget) -> [f64; 2] {
-        let origin = ctx.effect_bounds(layer).1;
-        self.run_effect_stack(ctx, layer, false, usize::MAX, None, origin, target);
-        origin
-    }
-
-    /// An adjustment layer's footprint (its source with masks applied, layer space): where
-    /// its effects show. `None` = the layer changes nothing.
-    pub fn adjustment_footprint(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
-        // Cached, so an accelerator sees the same buffer (and uploads it once) every frame.
-        let key = self.clipped_key(
-            ctx,
-            layer,
-            self.cache.and_then(|_| cache::footprint_key(ctx, layer, self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer))),
-        );
-        if let (Some(c), Some(k)) = (self.cache, key)
-            && let Some(b) = c.get(k)
-        {
-            return Some(b);
-        }
-        let mut foot = self.source(ctx, layer)?;
-        let _ = masks::apply(ctx, layer, &mut foot, self.mask_blur(ctx, layer));
-        let foot = Arc::new(foot);
-        if let (Some(c), Some(k)) = (self.cache_to_keep(), key) {
-            c.insert(k, foot.clone());
-        }
-        Some(foot)
-    }
-
-    /// Draw one 2D layer into `canvas` on the CPU (any kind: adjustment, wireframe, styled…).
-    pub fn draw_layer_cpu(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image) {
-        self.draw_layer(ctx, layer, canvas, false);
-    }
-
-    /// Draw a collapsed precomp layer into `canvas` on the CPU.
-    pub fn draw_collapsed_cpu(&self, ctx: &EvalCtx<'a>, layer: &Layer, item: ItemId, canvas: &mut Image) {
-        self.draw_collapsed(ctx, layer, item, canvas, false);
-    }
-
-    /// The layer's finished buffers (styles included) in the blending space.
-    pub fn styled_layer(&self, ctx: &EvalCtx, layer: &Layer) -> Option<StyledLayer> {
-        let mut timing = self.profile.map(|_| LayerTiming { depth: self.depth, layer: layer.name.clone(), ..Default::default() });
-        let t0 = web_time::Instant::now();
-        let st = self.styled(ctx, layer, timing.as_mut()).map(|st| self.styled_to_blend(st));
-        if let (Some(prof), Some(mut timing)) = (self.profile, timing) {
-            timing.process_ms = t0.elapsed().as_secs_f64() * 1e3;
-            if let Ok(mut v) = prof.lock() {
-                v.push(timing);
-            }
-        }
-        st
-    }
-
-    /// Opacity the layer composites with (its Opacity × collapsed precomps' opacity).
-    pub fn layer_opacity(&self, ctx: &EvalCtx, layer: &Layer) -> f32 {
-        ctx.opacity(layer) as f32 * self.opacity_mul
-    }
-
-    /// The layer's track matte layer and kind, if it has a valid one.
-    pub fn track_matte<'c>(&self, ctx: &EvalCtx<'c>, layer: &Layer) -> Option<(&'c Layer, MatteKind)> {
-        layer.track_matte.and_then(|tm| ctx.comp.layer(tm.layer).filter(|m| m.id != layer.id).map(|m| (m, tm.kind)))
-    }
-}
-
-/// The layer's frame blending mode, if the comp's Enable Frame Blending switch is on.
-/// One field of an interlaced frame as a full frame: the field's lines (`parity` 0 = even /
-/// upper, 1 = odd / lower) kept, the other lines interpolated from their neighbours.
-pub fn field_frame(img: &Image, parity: usize) -> Image {
-    let (w, h) = (img.width as usize, img.height as usize);
-    let mut out = img.clone();
-    if h < 2 {
-        return out;
-    }
-    for y in 0..h {
-        if y % 2 == parity {
-            continue;
-        }
-        let above = y.checked_sub(1);
-        let below = (y + 1 < h).then_some(y + 1);
-        for x in 0..w {
-            let px = match (above, below) {
-                (Some(a), Some(b)) => {
-                    let (p, q) = (img.data[a * w + x], img.data[b * w + x]);
-                    [(p[0] + q[0]) * 0.5, (p[1] + q[1]) * 0.5, (p[2] + q[2]) * 0.5, (p[3] + q[3]) * 0.5]
-                }
-                (Some(a), None) => img.data[a * w + x],
-                (None, Some(b)) => img.data[b * w + x],
-                (None, None) => img.data[y * w + x],
-            };
-            out.data[y * w + x] = px;
-        }
-    }
-    out
-}
-
-/// Interpret Footage ▸ Invert Alpha and Interpret As Linear Light on decoded (premultiplied)
-/// pixels; linear light is encoded in `space` ([`color::Pipe::linear_footage_space`]).
-pub fn interpret_pixels(img: &Image, f: &Footage, space: effectcraft_color::ColorSpace) -> Image {
-    let linear = f.linear_light_applies();
-    if !f.invert_alpha && !linear {
-        return img.clone();
-    }
-    let mut out = img.clone();
-    for p in out.data.iter_mut() {
-        let a = p[3];
-        let mut c = if a > 1e-6 { [p[0] / a, p[1] / a, p[2] / a] } else { [0.0; 3] };
-        if linear {
-            // The file's values are linear light: encode them like the rest of the footage.
-            c = c.map(|v| space.encode(v));
-        }
-        let a = if f.invert_alpha { 1.0 - a } else { a };
-        *p = [c[0] * a, c[1] * a, c[2] * a, a];
-    }
-    out
-}
-
-fn frame_blend_mode(ctx: &EvalCtx, layer: &Layer) -> FrameBlend {
-    if ctx.comp.enable_frame_blending { layer.switches.frame_blend } else { FrameBlend::Off }
-}
-
-/// Position of source time `t` among frames at `rate`: the frame at or before `t` and the
-/// fraction (0..1) of the way to the next frame. Exact (integer tick arithmetic), so frames that
-/// line up exactly report a fraction of 0.
-pub fn frame_position(t: Tick, rate: FrameRate) -> (i64, f64) {
-    let num = t.0 as i128 * rate.num as i128;
-    let den = TICKS_PER_SECOND as i128 * rate.den as i128;
-    (num.div_euclid(den) as i64, num.rem_euclid(den) as f64 / den as f64)
-}
-
-/// Blend two neighbouring frames `w` of the way from `a` to `b`: a cross-fade (Frame Mix) or a
-/// motion-compensated interpolation (Pixel Motion).
-pub fn blend_frames(mode: FrameBlend, a: &Image, b: &Image, w: f32) -> Image {
-    match mode {
-        FrameBlend::PixelMotion => effectcraft_raster::flow::interpolate(a, b, w),
-        _ => effectcraft_raster::flow::mix(a, b, w),
-    }
-}
-
-/// Convenience: render one frame of a comp with no footage source.
-/// Adaptive motion-blur sample count for a layer whose corners travel `travel` output pixels
-/// during the shutter: one sample per pixel, clamped to Samples Per Frame … Adaptive Sample Limit.
-pub fn adaptive_samples(travel: f64, per_frame: u32, limit: u32) -> usize {
-    let lo = per_frame.clamp(2, 64) as f64;
-    let hi = (limit.clamp(16, 256) as f64).max(lo);
-    travel.ceil().clamp(lo, hi) as usize
-}
-
-/// A region of interest `[x, y, w, h]` lies within a `w`×`h` comp frame.
-pub fn roi_inside(r: [f64; 4], w: u32, h: u32) -> bool {
-    r[0] >= 0.0 && r[1] >= 0.0 && r[0] + r[2] <= w as f64 + 1e-6 && r[1] + r[3] <= h as f64 + 1e-6
-}
-
-/// The Extended Viewer's region of interest: the comp frame grown by `margin` × its size on every
-/// side (`margin` = 1 shows a pasteboard one comp wide around the frame), intersected with the
-/// `visible` comp-space rectangle `[x0, y0, x1, y1]` and snapped outward to whole 16 px steps from the frame edges
-/// so panning re-renders rarely. `None` when the visible area lies inside the frame.
-pub fn extended_region(w: u32, h: u32, visible: [f64; 4], margin: f64) -> Option<[f64; 4]> {
-    let (w, h) = (w as f64, h as f64);
-    let (mx, my) = (w * margin, h * margin);
-    let snap_lo = |v: f64| (v / 16.0).floor() * 16.0;
-    let snap_hi = |v: f64| (v / 16.0).ceil() * 16.0;
-    let x0 = snap_lo(visible[0].max(-mx)).min(0.0);
-    let y0 = snap_lo(visible[1].max(-my)).min(0.0);
-    let x1 = w + snap_hi(visible[2].min(w + mx) - w).max(0.0);
-    let y1 = h + snap_hi(visible[3].min(h + my) - h).max(0.0);
-    if x0 >= 0.0 && y0 >= 0.0 && x1 <= w && y1 <= h {
-        return None;
-    }
-    Some([x0, y0, x1 - x0, y1 - y0])
-}
-
-pub fn render_frame(project: &Project, comp: ItemId, t: Tick, scale: f64) -> Image {
-    Renderer::new(project, &NoFootage, RenderOpts { scale, ..Default::default() }).comp_frame(comp, t)
-}
-
 #[cfg(test)]
 mod tests;
-#[cfg(test)]
-mod tests_auto;
-#[cfg(test)]
-mod tests_remap;
-#[cfg(test)]
-mod tests_roi;
-#[cfg(test)]
-mod tests_styles;
-
-/// Layer-space bounds `[x0, y0, x1, y1]` of a layer's content at the context time (source size
-/// for solids/footage/precomps, glyph bounds for text, painted bounds for shapes). Used for viewer
-/// handles and hit testing.
-pub fn content_bounds(ctx: &EvalCtx, layer: &effectcraft_project::Layer) -> Option<[f64; 4]> {
-    match &layer.source {
-        LayerSource::Text => {
-            let glyphs = text::glyph_paths(ctx, layer);
-            let paths: Vec<_> = glyphs.into_iter().map(|g| g.0).collect();
-            effectcraft_path::bounds(&paths).map(|r| [r.x0, r.y0, r.x1, r.y1])
-        }
-        LayerSource::Shape => layer.props.sub("contents").and_then(|c| shapes::content_bounds(ctx, layer, c)).map(|r| [r.x0, r.y0, r.x1, r.y1]),
-        LayerSource::Camera | LayerSource::Light { .. } => None,
-        _ => {
-            let (w, h) = source_size(ctx.project, layer);
-            (w > 0 && h > 0).then_some([0.0, 0.0, w as f64, h as f64])
-        }
-    }
-}
-
-/// A mask/shape path as a kurbo path (for drawing overlays).
-pub fn kurbo_path(sp: &effectcraft_keyframe::ShapePath) -> kurbo::BezPath {
-    effectcraft_path::to_kurbo(sp)
-}
-#[cfg(test)]
-mod tests_audio_fx;
-#[cfg(test)]
-mod tests_aux;
-#[cfg(test)]
-mod tests_collapse;
-#[cfg(test)]
-mod tests_color;
-#[cfg(test)]
-mod tests_footage_size;
-#[cfg(test)]
-mod tests_frame_blend;
-#[cfg(test)]
-mod tests_guides;
-#[cfg(test)]
-mod tests_mask_blur;
-#[cfg(test)]
-mod tests_mask_expansion;
-#[cfg(test)]
-mod tests_nested;
-#[cfg(test)]
-mod tests_paint;
-#[cfg(test)]
-mod tests_raster_clip;
-#[cfg(test)]
-mod tests_time;
diff --git a/crates/render/src/masks.rs b/crates/render/src/masks.rs
index bb91ef71d..e6ba0a6fb 100644
--- a/crates/render/src/masks.rs
+++ b/crates/render/src/masks.rs
@@ -5,7 +5,7 @@ use effectcraft_geom::{Mat3, vec2};
 use effectcraft_keyframe::Value;
 use effectcraft_path::{FillRule, Join};
 use effectcraft_project::{FeatherFalloff, GroupKind, Layer, MaskMode, MaskMotionBlur};
-use effectcraft_raster::{Mask, box_blur, gaussian_blur};
+use effectcraft_raster::{Mask, box_blur};
 use rayon::prelude::*;
 
 use crate::eval::EvalCtx;
@@ -60,40 +60,213 @@ fn coverage(ctx: &EvalCtx, layer: &Layer, g: &effectcraft_project::PropGroup, bu
     coverage_at(ctx, layer, g, buf)
 }
 
+/// The largest feather taken, in buffer pixels (larger and non-finite values are clamped).
+const MAX_FEATHER_PX: f64 = 1.0e6;
+/// Smooth falloff (After Effects' default), measured on After Effects 2026 renders (feather 100,
+/// 300 and 1000; red value along rows, columns and the corner diagonal of a feathered rect mask):
+/// the edge is blurred separably by three box passes, each `2r + 1` pixels wide with
+/// `r = round(SMOOTH_BOX_RADIUS * feather)`. That is a quadratic B-spline reaching about
+/// 1.11 x feather either side of the path (finite support; a Gaussian of any width misses the
+/// measured profile by 3/255 or more, this kernel by less than 1/255).
+const SMOOTH_BOX_RADIUS: f64 = 0.37;
+/// Up to this box radius (buffer pixels) a feather is blurred at the buffer's resolution. A wider
+/// one is blurred on a grid coarser per axis, about `COARSE_RADIUS` grid pixels per box: a wide
+/// blur is smooth, so the coarse grid loses nothing visible, and the padding stays about
+/// 3 x `COARSE_RADIUS` grid pixels. (Box passes cost the same at any radius; the coarse grid
+/// bounds the padded area, i.e. memory.)
+const FULL_RES_RADIUS: usize = 48;
+const COARSE_RADIUS: usize = 32;
+/// The largest padded grid (pixels). A grid that would be bigger (a huge buffer) is coarsened
+/// (`grid`) until it fits, so the padding, and with it the feather of a mask edge outside the
+/// buffer, is never dropped.
+const MAX_GRID_PX: usize = 1 << 26;
+/// The coarsest factor `grid` tries before giving up on the padding (unreachable for any buffer
+/// that fits in memory: 1024 x 1024 buffer pixels per grid pixel).
+const MAX_COARSEN: usize = 1024;
+/// Padding for a variable-width feather, which is rasterised at the buffer's resolution.
+const MAX_VARIABLE_PAD: usize = 256;
+
+/// One axis of the grid a feathered mask is rasterised and blurred on: `step` buffer pixels per
+/// grid pixel, `pad` grid pixels on each side of the buffer, and the box radii in grid pixels.
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct Axis {
+    step: usize,
+    pad: usize,
+    /// Radii of the box passes (Smooth: three; Linear: one, the others 0).
+    radii: [usize; 3],
+}
+
+impl Axis {
+    /// `feather` in buffer pixels. The pad covers the blur's whole support, so the coverage of
+    /// the path outside the buffer reaches into it as on an unbounded plane.
+    fn new(feather: f64, linear: bool, full_res_only: bool) -> Axis {
+        let f = if feather.is_finite() { feather.clamp(0.0, MAX_FEATHER_PX) } else { 0.0 };
+        let none = Axis { step: 1, pad: 0, radii: [0; 3] };
+        if f <= 0.0 {
+            return none;
+        }
+        let cap = |pad: usize| if full_res_only { pad.min(MAX_VARIABLE_PAD) } else { pad };
+        if linear {
+            // Linear falloff (not measured against After Effects): one box pass, a straight ramp
+            // `feather` pixels wide across the edge, as before. Not quite unchanged: a ramp wider
+            // than about `4 x FULL_RES_RADIUS` pixels is now blurred on the coarse grid and
+            // resampled bilinearly (a smooth ramp, so the difference is a rounding of the ramp).
+            let r = (f / 2.0).round().max(1.0) as usize;
+            let step = if full_res_only || r <= 2 * FULL_RES_RADIUS { 1 } else { r.div_ceil(2 * COARSE_RADIUS) };
+            let rg = ((r as f64 / step as f64).round() as usize).max(1);
+            return Axis { step, pad: cap(rg), radii: [rg, 0, 0] };
+        }
+        let r = (SMOOTH_BOX_RADIUS * f).round() as usize;
+        if r == 0 {
+            return none;
+        }
+        if full_res_only || r <= FULL_RES_RADIUS {
+            return Axis { step: 1, pad: cap(3 * r + 1), radii: [r; 3] };
+        }
+        // On a coarse grid the three windows (2 rg + 1 grid pixels each) should still add up to
+        // 3 (2r + 1) buffer pixels: of a few steps take the one that comes closest, and spread
+        // the radii over the passes.
+        let want = 3 * (2 * r + 1);
+        let s0 = r.div_ceil(COARSE_RADIUS);
+        let fit = |s: usize| -> (usize, usize) {
+            let sum = ((want as f64 / s as f64 - 3.0) / 2.0).round().max(0.0) as usize;
+            let got = (2 * sum + 3).saturating_mul(s);
+            (sum, got.abs_diff(want))
+        };
+        let (step, sum) = (s0..=s0 + (s0 / 2).min(8)).map(|s| (s, fit(s))).min_by_key(|&(s, (_, e))| (e, s)).map_or((s0, fit(s0).0), |(s, (sum, _))| (s, sum));
+        let radii = [0, 1, 2].map(|i| sum / 3 + usize::from(i < sum % 3));
+        Axis { step, pad: sum + 1, radii }
+    }
+
+    fn blurs(&self) -> bool {
+        self.radii.iter().any(|&r| r > 0)
+    }
+
+    /// The same blur on a grid `k` times coarser: radii and padding scaled down (a blurring
+    /// axis keeps at least one grid pixel of radius), the padding still covering the support.
+    fn coarser(self, k: usize) -> Axis {
+        if k <= 1 {
+            return self;
+        }
+        let blurs = self.blurs();
+        let mut radii = self.radii.map(|r| (r as f64 / k as f64).round() as usize);
+        if blurs && radii.iter().all(|&r| r == 0) {
+            radii[0] = 1;
+        }
+        let support = radii.iter().fold(0usize, |a, &r| a.saturating_add(r)).saturating_add(1);
+        let pad = if self.pad == 0 { 0 } else { self.pad.div_ceil(k).max(support) };
+        Axis { step: self.step.saturating_mul(k), pad, radii }
+    }
+
+    /// Grid pixels for `n` buffer pixels.
+    fn len(&self, n: u32) -> Option<usize> {
+        (n as usize).div_ceil(self.step).checked_add(self.pad.checked_mul(2)?)
+    }
+}
+
+/// Resamples a grid coverage (`gw` wide) back to the `w x h` buffer: bilinear between the grid
+/// pixel centres (an exact copy when both steps are 1).
+fn crop(grid: &Mask, ax: Axis, ay: Axis, w: u32, h: u32) -> Mask {
+    let (gw, gh) = (grid.width as usize, grid.height as usize);
+    let mut out = Mask::new(w, h, 0.0);
+    let at = |x: usize, y: usize| grid.data.get(y.saturating_mul(gw).saturating_add(x)).copied().unwrap_or(0.0);
+    // Grid coordinate of a buffer pixel centre, as (index, fraction) on that axis.
+    let map = |i: u32, a: Axis, n: usize| -> (usize, usize, f32) {
+        let u = (i as f64 + 0.5) / a.step as f64 + a.pad as f64 - 0.5;
+        let u = u.clamp(0.0, n.saturating_sub(1) as f64);
+        let i0 = u.floor() as usize;
+        (i0, (i0 + 1).min(n.saturating_sub(1)), (u - i0 as f64) as f32)
+    };
+    let xs: Vec<(usize, usize, f32)> = (0..w).map(|x| map(x, ax, gw)).collect();
+    out.data.par_chunks_mut(w.max(1) as usize).enumerate().for_each(|(y, row)| {
+        let (y0, y1, fy) = map(y as u32, ay, gh);
+        for (o, &(x0, x1, fx)) in row.iter_mut().zip(&xs) {
+            let top = at(x0, y0) + (at(x1, y0) - at(x0, y0)) * fx;
+            let bottom = at(x0, y1) + (at(x1, y1) - at(x0, y1)) * fx;
+            *o = top + (bottom - top) * fy;
+        }
+    });
+    out
+}
+
 fn coverage_at(ctx: &EvalCtx, layer: &Layer, g: &effectcraft_project::PropGroup, buf: &Buf) -> Option<Mask> {
     let Value::Path(sp) = ctx.group_value(layer, g, "path")? else { return None };
-    let path = effectcraft_path::to_kurbo(&sp);
-    let (w, h) = (buf.img.width, buf.img.height);
     let m = Mat3::translate(vec2(buf.offset[0], buf.offset[1])) * Mat3::scale(vec2(buf.scale, buf.scale));
     let exp = ctx.f(layer, g, "expansion", 0.0);
     let linear = matches!(g.kind, GroupKind::Mask { feather_falloff: FeatherFalloff::Linear, .. });
+    let feather = ctx.v2(layer, g, "feather", [0.0; 2]);
+    let feather = [feather[0] * buf.scale, feather[1] * buf.scale];
+    Some(feathered(&sp, &m, (buf.img.width, buf.img.height), exp, feather, linear, MAX_GRID_PX))
+}
+
+/// The padded grid for a `w x h` buffer: the axes as given, or coarsened together (by 2, 4, …)
+/// until the grid has at most `max_px` pixels. `None` without a blur (or, unreachably, when even
+/// the coarsest grid is too big).
+fn grid(w: u32, h: u32, ax: Axis, ay: Axis, max_px: usize) -> Option<(u32, u32, Axis, Axis)> {
+    if !(ax.blurs() || ay.blurs()) {
+        return None;
+    }
+    let mut k = 1usize;
+    while k <= MAX_COARSEN {
+        let (cx, cy) = (ax.coarser(k), ay.coarser(k));
+        if let (Some(gw), Some(gh)) = (cx.len(w), cy.len(h))
+            && gw.checked_mul(gh).is_some_and(|n| n <= max_px)
+            && let (Ok(gw), Ok(gh)) = (u32::try_from(gw), u32::try_from(gh))
+        {
+            return Some((gw, gh, cx, cy));
+        }
+        k = k.saturating_mul(2);
+    }
+    None
+}
+
+/// Coverage of the mask path `sp` (layer -> buffer `m`) on a `w x h` buffer, expanded by `exp`
+/// and feathered by `feather` buffer pixels per axis, on a padded grid of at most `max_px` pixels.
+fn feathered(sp: &effectcraft_keyframe::ShapePath, m: &Mat3, (w, h): (u32, u32), exp: f64, feather: [f64; 2], linear: bool, max_px: usize) -> Mask {
+    let path = effectcraft_path::to_kurbo(sp);
     // Variable-width feather (Mask Feather tool points): expansion and the per-point feather
     // are applied together from the signed distance to the path.
     let variable = !sp.feather.is_empty();
+    // The feather blurs the mask's own edge, also where the path lies outside the layer (After
+    // Effects: a feathered mask just below a layer still fades into it). So a feathered mask is
+    // rasterised on a grid padded by the blur's reach, blurred there and cropped to the buffer.
+    // A variable feather scales its point radii by the mean scale: it stays at full resolution
+    // (unless the grid has to be coarsened to fit `max_px`).
+    let (ax, ay) = (Axis::new(feather[0], linear, variable), Axis::new(feather[1], linear, variable));
+    let blurred = ax.blurs() || ay.blurs();
+    let grid = grid(w, h, ax, ay, max_px);
+    // Without the grid (no blur, or, unreachably, a grid too big even at the coarsest step):
+    // blurred within the buffer at its resolution.
+    let unpadded = |f: f64| Axis { pad: 0, ..Axis::new(f, linear, true) };
+    let (gw, gh, gx, gy) = grid.unwrap_or_else(|| (w, h, unpadded(feather[0]), unpadded(feather[1])));
+    // Buffer pixels -> grid pixels.
+    let to_grid = Mat3::scale(vec2(1.0 / gx.step as f64, 1.0 / gy.step as f64)) * Mat3::translate(vec2((gx.pad * gx.step) as f64, (gy.pad * gy.step) as f64));
+    let mg = to_grid * *m;
     let mut cov = if variable {
-        effectcraft_path::feather::variable_feather_coverage(&sp, &m, w, h, exp, linear)
+        effectcraft_path::feather::variable_feather_coverage(sp, &mg, gw, gh, exp, linear)
     } else if exp.abs() > 0.01 {
         // Expansion offsets the outline itself (round joins). Offset Paths' geometry stays right
         // when the expansion exceeds a curvature radius, where a fill + stroke blend leaves a
         // ring around an uncovered middle (growing) or islands (shrinking).
         let grown = effectcraft_path::offset::offset_path(&path, exp, Join::Round, 4.0);
-        effectcraft_path::fill_coverage(std::slice::from_ref(&grown), &m, w, h, FillRule::NonZero)
+        effectcraft_path::fill_coverage(std::slice::from_ref(&grown), &mg, gw, gh, FillRule::NonZero)
     } else {
-        effectcraft_path::fill_coverage(std::slice::from_ref(&path), &m, w, h, FillRule::NonZero)
+        effectcraft_path::fill_coverage(std::slice::from_ref(&path), &mg, gw, gh, FillRule::NonZero)
     };
-    let feather = ctx.v2(layer, g, "feather", [0.0; 2]);
-    if feather[0] > 0.0 || feather[1] > 0.0 {
-        let img = cov.to_image();
-        let b = if linear {
-            // One box pass: a straight ramp `feather` pixels wide across the edge.
-            let r = |f: f64| ((f * buf.scale / 2.0).round() as usize).max(if f > 0.0 { 1 } else { 0 });
-            box_blur(&img, r(feather[0]), r(feather[1]), 1, false)
-        } else {
-            gaussian_blur(&img, feather[0] * buf.scale / 2.0, feather[1] * buf.scale / 2.0, false)
-        };
-        cov = Mask::from_alpha(&b);
+    if blurred {
+        // Separable box passes (the corner of a feathered rect is the product of its edges).
+        let mut img = cov.to_image();
+        for (rx, ry) in gx.radii.into_iter().zip(gy.radii) {
+            if rx > 0 || ry > 0 {
+                img = box_blur(&img, rx, ry, 1, false);
+            }
+        }
+        cov = Mask::from_alpha(&img);
     }
-    Some(cov)
+    if grid.is_some() {
+        cov = crop(&cov, gx, gy, w, h);
+    }
+    cov
 }
 
 /// The layer's enabled masks at the context time, flattened to polylines in layer space (for
@@ -133,7 +306,9 @@ pub fn apply(ctx: &EvalCtx, layer: &Layer, buf: &mut Buf, blur: MaskBlur) -> boo
     if list.is_empty() {
         return false;
     }
-    // Masks may extend past the source: grow the buffer to cover them when feather/expansion pads.
+    // Masks may extend past the source: the buffer keeps its size (pixels outside the layer stay
+    // empty), but a feathered mask is blurred on a padded grid, so the feather of an edge outside
+    // the buffer still reaches into it (`coverage_at`).
     let n = (buf.img.width * buf.img.height) as usize;
     let first_sub = matches!(list[0].kind, GroupKind::Mask { mode: MaskMode::Subtract, .. });
     let mut acc = vec![if first_sub { 1.0f32 } else { 0.0 }; n];
@@ -169,3 +344,48 @@ pub fn apply(ctx: &EvalCtx, layer: &Layer, buf: &mut Buf, blur: MaskBlur) -> boo
     buf.img.mul_mask(&acc);
     true
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use effectcraft_keyframe::ShapePath;
+
+    /// CodeRabbit on #1874: an 8192 x 8192 layer with a 40 px Smooth feather needs a padded
+    /// grid larger than `MAX_GRID_PX`; it used to fall back to the unpadded buffer, so an Add mask
+    /// just outside the layer covered nothing and the whole layer vanished. The grid is now
+    /// coarsened instead and keeps a pad that covers the blur.
+    #[test]
+    fn a_grid_too_big_is_coarsened_and_keeps_its_padding() {
+        let a = Axis::new(40.0, false, false);
+        assert!(a.len(8192).zip(a.len(8192)).is_some_and(|(x, y)| x * y > MAX_GRID_PX), "the full-resolution grid is over the limit");
+        let (gw, gh, gx, gy) = grid(8192, 8192, a, a, MAX_GRID_PX).expect("a padded grid");
+        assert!((gw as usize) * (gh as usize) <= MAX_GRID_PX);
+        for g in [gx, gy] {
+            assert!(g.step > 1 && g.pad > 0 && g.blurs(), "{g:?}");
+            // The pad covers the blur's support (the three boxes' radii) in buffer pixels.
+            assert!(g.pad * g.step >= g.radii.iter().sum::<usize>() * g.step, "{g:?}");
+        }
+        // A grid that fits is not touched.
+        assert_eq!(grid(200, 100, a, a, MAX_GRID_PX).map(|g| g.2), Some(a));
+    }
+
+    /// The same failure at a testable size: a 200 x 100 buffer, a 40 px feather and a grid limit
+    /// just below the full-resolution padded grid. The Add mask lies just right of the buffer
+    /// (x 210..260); its feather still fades into the layer, close to the full-resolution result.
+    #[test]
+    fn a_coarsened_grid_still_feathers_a_mask_outside_the_buffer() {
+        let sp = ShapePath::rect([235.0, 50.0], 50.0, 200.0);
+        let m = Mat3::IDENTITY;
+        let full = feathered(&sp, &m, (200, 100), 0.0, [40.0, 40.0], false, MAX_GRID_PX);
+        let a = Axis::new(40.0, false, false);
+        let limit = a.len(200).zip(a.len(100)).map_or(0, |(x, y)| x * y) - 1;
+        let coarse = feathered(&sp, &m, (200, 100), 0.0, [40.0, 40.0], false, limit);
+        let at = |c: &Mask, x: usize, y: usize| c.data.get(y * 200 + x).copied().unwrap_or(-1.0);
+        assert!(at(&full, 199, 50) > 0.25, "full resolution: {}", at(&full, 199, 50));
+        assert!(at(&coarse, 199, 50) > 0.2, "the soft fade survives the coarse grid: {}", at(&coarse, 199, 50));
+        for x in [150, 170, 180, 190, 199] {
+            assert!((at(&coarse, x, 50) - at(&full, x, 50)).abs() < 0.05, "x {x}: coarse {} full {}", at(&coarse, x, 50), at(&full, x, 50));
+        }
+        assert!(at(&coarse, 100, 50) < 0.01, "far from the mask stays clear");
+    }
+}
diff --git a/crates/render/src/opts.rs b/crates/render/src/opts.rs
new file mode 100644
index 000000000..352f85983
--- /dev/null
+++ b/crates/render/src/opts.rs
@@ -0,0 +1,103 @@
+use super::accel::Backend;
+use super::{Comp, EvalCtx, ItemId, Layer, Mat4, Tick, three_d};
+
+#[derive(Clone, Copy, Debug, serde::Serialize, serde::Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct RenderOpts {
+    /// Output scale relative to comp pixels (1 = Full, 0.5 = Half…).
+    pub scale: f64,
+    pub motion_blur: bool,
+    /// Render guide layers (viewer only). Only the top-level comp's own guide layers: nested
+    /// comps (precomps, collapsed precomps, comps read by effects) never draw theirs, as in
+    /// After Effects (see `Renderer::nested_opts`).
+    pub guides: bool,
+    /// Draft quality: fewer motion-blur samples, bilinear only.
+    pub draft: bool,
+    /// 3D view camera override (viewer Front/Top/Custom views); None = the comp's active camera.
+    pub view: Option<three_d::CameraState>,
+    /// CPU or GPU compositor (the GPU needs [`Renderer::accel`]).
+    pub backend: Backend,
+    /// Region of interest `[x, y, w, h]` in comp pixels (viewer only): the top-level frame covers
+    /// just this rectangle, and only its pixels are composited.
+    pub roi: Option<[f64; 4]>,
+    /// Which proxies stand in for footage and compositions (Render Settings ▸ Proxy Use).
+    pub proxy: effectcraft_project::render_queue::ProxyUse,
+    /// Switches Affect Nested Comps (Settings ▸ General): a precomp layer's Quality and Motion
+    /// Blur switches also limit the layers of the nested comp (Draft/Wireframe or motion blur off
+    /// propagate down; they never raise a nested layer's own setting).
+    pub nested_switches: bool,
+    /// Realtime Shadows in Draft (Settings ▸ 3D): draft renders (`draft`) still cast shadows.
+    pub draft_shadows: bool,
+    /// No HDR step: the top-level comp leaves the working space for the output space without
+    /// Project Settings ▸ HDR (compand / tone mapping), so over-range values stay. The consumer
+    /// decodes the frame with [`crate::color::Pipe::output_linear`] (float outputs: OpenEXR)
+    /// or applies the step itself. Part of the viewer's frame keys (`opts_hash`).
+    pub skip_hdr_step: bool,
+}
+
+impl RenderOpts {
+    /// Whether 3D layers cast shadows in this render.
+    pub fn shadows(&self) -> bool {
+        !self.draft || self.draft_shadows
+    }
+}
+
+impl Default for RenderOpts {
+    fn default() -> Self {
+        RenderOpts {
+            scale: 1.0,
+            motion_blur: true,
+            guides: false,
+            draft: false,
+            view: None,
+            roi: None,
+            backend: Backend::Cpu,
+            nested_switches: true,
+            draft_shadows: true,
+            skip_hdr_step: false,
+            proxy: effectcraft_project::render_queue::ProxyUse::CurrentSettings,
+        }
+    }
+}
+
+/// One collapsed precomp layer a nested comp is drawn through.
+#[derive(Clone, Copy)]
+pub(crate) struct Through<'a> {
+    pub(crate) comp_id: ItemId,
+    pub(crate) comp: &'a Comp,
+    /// The containing comp's time at this frame.
+    pub(crate) time: Tick,
+    pub(crate) layer: &'a Layer,
+    /// The precomp layer is motion blurred: its own motion blurs the nested layers.
+    pub(crate) blur: bool,
+}
+
+/// Collapsed precomps within collapsed precomps that motion blur follows (more than
+/// [`Renderer::collapsed`]'s nesting limit).
+pub(crate) const MAX_THROUGH: usize = 16;
+
+/// How a collapsed precomp's 3D layers are placed in the parent (see `Renderer::collapse_into`).
+#[derive(Clone, Copy)]
+pub(crate) struct Collapse3d<'a> {
+    /// Nested comp world → parent world (the precomp layer's world transform).
+    pub world: Mat4,
+    /// The parent's camera.
+    pub cam: three_d::CameraState,
+    /// The outermost comp's context (its lights light the nested layers).
+    pub parent: EvalCtx<'a>,
+}
+
+/// Time spent on one layer of one frame (milliseconds).
+#[derive(Clone, Debug, Default)]
+pub struct LayerTiming {
+    pub depth: usize,
+    pub layer: String,
+    /// Source + masks + effects (cache lookup only, on a hit).
+    pub process_ms: f64,
+    /// Per effect: (effect id, ms). Empty on a cache hit.
+    pub effects: Vec<(String, f64)>,
+    /// Transform + matte + blend.
+    pub composite_ms: f64,
+    /// The processed buffer came from the layer cache.
+    pub cached: bool,
+}
diff --git a/crates/render/src/passes.rs b/crates/render/src/passes.rs
index 5f0373b84..37c94fff4 100644
--- a/crates/render/src/passes.rs
+++ b/crates/render/src/passes.rs
@@ -59,11 +59,25 @@ pub async fn in_passes<'a, T>(accel: Option<&'a dyn Accelerator>, mut render: im
     Passed { value: render(None), passes: MAX_PASSES + 1, accelerated: false }
 }
 
+/// Ends the frame for the accelerator ([`Accelerator::frame_end`]) when dropped: also when the
+/// render panics or the future is dropped between passes.
+struct FrameEnd<'a>(&'a dyn Accelerator);
+impl Drop for FrameEnd<'_> {
+    fn drop(&mut self) {
+        self.0.frame_end();
+    }
+}
+
 /// A top-level comp frame through [`in_passes`] ([`Renderer::comp_frame`] in passes). Backend
 /// Auto picks CPU or GPU for the whole frame (all its passes) and is timed as a whole, as the
-/// frame workers do.
+/// frame workers do. Ends the frame for the accelerator ([`Accelerator::frame_end`]) on every
+/// exit, including a panic.
 pub async fn comp_frame(r: &Renderer<'_>, comp: ItemId, t: Tick) -> Image {
-    let Some(a) = r.accel.filter(|a| a.miss_gate().is_some()) else { return r.comp_frame(comp, t) };
+    let Some(a) = r.accel else { return r.comp_frame(comp, t) };
+    let _end = FrameEnd(a);
+    if a.miss_gate().is_none() {
+        return r.comp_frame(comp, t);
+    }
     let mut opts = r.opts;
     let mut auto = None;
     if opts.backend == Backend::Auto {
diff --git a/crates/render/src/pipeline.rs b/crates/render/src/pipeline.rs
new file mode 100644
index 000000000..5966ebf2e
--- /dev/null
+++ b/crates/render/src/pipeline.rs
@@ -0,0 +1,1211 @@
+use super::accel::{Accelerator, Backend, CpuFx, FxStep, FxTarget};
+use super::footage::{FootageSource, is_vector_footage};
+use super::frames::{blend_frames, cineon_frame, content_bounds, field_frame, frame_blend_mode, frame_position, frame_size, interpret_pixels, roi_inside};
+use super::fx_host::{FxHost, essential_overrides};
+use super::opts::{Collapse3d, LayerTiming, MAX_THROUGH, RenderOpts, Through};
+use super::reads::{ReadFiles, ReadLog};
+use super::{
+    Arc, AutoKey, AutoPick, BlendMode, Buf, Comp, EffectCtx, EffectEnv, EvalCtx, Footage, FootageKind, FrameBlend, FrameRate, GroupKind, Image, ItemId,
+    ItemKind, Layer, LayerCache, LayerSource, Params, Project, Quality, Region, Renderer, Tick, cache, color, masks, shapes, styles, text, three_d, vec2,
+};
+use effectcraft_keyframe::Value;
+use effectcraft_project::LayerId;
+
+/// Coordinate space and stack range shared by CPU and accelerated effect evaluation.
+#[derive(Clone, Copy)]
+pub(crate) struct EffectStack {
+    pub adjustment: bool,
+    pub limit: usize,
+    pub origin: [f64; 2],
+}
+
+/// A property value an Essential Properties override gives a layer of a collapsed precomp.
+#[derive(Clone, Debug)]
+pub struct PropertyOverride {
+    pub(crate) layer: LayerId,
+    pub(crate) prop: u64,
+    pub(crate) value: Value,
+    /// A Font control changes only the font of the target text, not its text.
+    pub(crate) font: bool,
+}
+
+/// A Media Replacement an Essential Properties override gives a footage layer of a collapsed
+/// precomp.
+#[derive(Clone, Copy, Debug)]
+pub struct MediaOverride {
+    pub(crate) layer: LayerId,
+    pub(crate) item: ItemId,
+}
+
+impl MediaOverride {
+    /// A Media Replacement of `layer`'s footage by `item`.
+    pub fn new(layer: LayerId, item: ItemId) -> Self {
+        MediaOverride { layer, item }
+    }
+}
+
+/// A collapsed precomp layer: the nested comp and the instance overrides that apply to it.
+pub struct Collapsed {
+    pub item: ItemId,
+    pub(crate) property_overrides: Vec<PropertyOverride>,
+    pub(crate) media_overrides: Vec<MediaOverride>,
+}
+
+/// The property and media overrides of a collapsed precomp layer. `None` when its Essential
+/// Properties group or the source comp's definitions are missing (the flattened path then
+/// preserves the old behaviour).
+fn collapsed_instance(ctx: &EvalCtx, layer: &Layer, item: ItemId) -> Option<(Vec<PropertyOverride>, Vec<MediaOverride>)> {
+    use effectcraft_project::essential::{self, ControlType, EgKind};
+    let over = essential::overridden(layer);
+    if over.is_empty() {
+        return Some((vec![], vec![]));
+    }
+    let g = essential::group(layer)?;
+    let eg = ctx.project.comp(item)?.essential.as_ref()?;
+    let mut property = vec![];
+    let mut fonts: Vec<PropertyOverride> = vec![];
+    let mut media = vec![];
+    g.walk("", &mut |_, p| {
+        if !over.contains(&p.uid) {
+            return;
+        }
+        let Some(control) = essential::control_of(&p.match_id) else { return };
+        let Some(ctl) = eg.resolve(control) else { return };
+        let value = ctx.value(layer, p);
+        match &ctl.kind {
+            EgKind::Property { .. } => {
+                let font = ctl.as_type == Some(ControlType::Font);
+                for (layer, prop) in ctl.kind.targets() {
+                    let o = PropertyOverride { layer, prop, value: value.clone(), font };
+                    if font { fonts.push(o) } else { property.push(o) }
+                }
+            }
+            EgKind::Media { layer: target } => {
+                let Value::Scalar(id) = value else { return };
+                let item = ItemId(id.max(0.0) as u64);
+                if matches!(ctx.project.item(item).map(|i| &i.kind), Some(ItemKind::Footage(_))) {
+                    media.push(MediaOverride { layer: *target, item });
+                }
+            }
+            _ => {}
+        }
+    });
+    // A Font control merges into the text its instance shows, after a whole-value (Text) override
+    // of the same property, as `essential::with_overrides` does: keep one entry per property.
+    for f in fonts {
+        match property.iter_mut().rev().find(|o| o.layer == f.layer && o.prop == f.prop) {
+            Some(o) => effectcraft_project::essential::merge_font(&mut o.value, &f.value),
+            None => property.push(f),
+        }
+    }
+    Some((property, media))
+}
+
+impl<'a> Renderer<'a> {
+    /// A renderer over `project` and `footage` with the given options.
+    pub fn new(project: &'a Project, footage: &'a dyn FootageSource, opts: RenderOpts) -> Renderer<'a> {
+        Renderer {
+            project,
+            footage,
+            expr: None,
+            opts,
+            cache: None,
+            reads: None,
+            profile: None,
+            accel: None,
+            depth: 0,
+            pipe: color::Pipe::of(&project.settings),
+            outer: None,
+            opacity_mul: 1.0,
+            collapse3d: None,
+            inherited: None,
+            defer_dof: false,
+            top: true,
+            through: [None; MAX_THROUGH],
+            through_lost: false,
+            whole_raster: false,
+        }
+    }
+
+    /// The layer cache to keep this render's buffers in: none once its footage reads were
+    /// called off, as they may have come back empty ([`FootageSource::called_off`], #329).
+    pub(crate) fn cache_to_keep(&self) -> Option<&'a LayerCache> {
+        self.cache.filter(|_| !self.footage.called_off())
+    }
+
+    /// `read`, a read of this render's footage source, with the files it uses noted in
+    /// [`Renderer::reads`] (see [`FootageSource::recording`]).
+    pub(crate) fn read<R>(&self, read: impl FnOnce() -> Option<R>) -> Option<R> {
+        let Some(log) = self.reads else { return read() };
+        let (mut read, mut out) = (Some(read), None);
+        self.footage.recording(log, &mut || out = read.take().and_then(|f| f()));
+        out
+    }
+
+    /// `ctx` noting what it reads (fonts, `sampleImage`) in this render's [`Renderer::reads`]:
+    /// a context made by an outer render carries that render's log, not the one of the buffer
+    /// [`Renderer::recorded`] makes.
+    pub(crate) fn with_reads<'c>(&'c self, ctx: &EvalCtx<'c>) -> EvalCtx<'c> {
+        EvalCtx { reads: self.reads, ..*ctx }
+    }
+
+    /// The buffer the layer cache keeps under `key`, with the files it was made of noted in
+    /// [`Renderer::reads`].
+    pub(crate) fn cached(&self, key: Option<u64>) -> Option<(Arc<Buf>, Arc<ReadFiles>)> {
+        let (buf, files) = self.cache?.get(key?)?;
+        if let Some(log) = self.reads {
+            log.note_all(&files);
+        }
+        Some((buf, files))
+    }
+
+    /// Keep `buf`, made of `files`, under `key` (see [`Renderer::recorded`]): the buffer the cache
+    /// keeps (another worker's, if it kept one first), or `buf` when nothing is kept, with the
+    /// files that buffer was made of. Another worker's files are noted in [`Renderer::reads`]
+    /// too: its pixels are the ones this render uses (a file that changed between the two reads
+    /// then has two identities, and the list is incomplete).
+    pub(crate) fn keep(&self, key: Option<u64>, buf: Arc<Buf>, files: &Arc<ReadFiles>) -> (Arc<Buf>, Arc<ReadFiles>) {
+        let (Some(c), Some(k)) = (self.cache_to_keep(), key) else { return (buf, files.clone()) };
+        let (kept, kept_files) = c.insert(k, buf, files.clone());
+        if !Arc::ptr_eq(&kept_files, files)
+            && let Some(log) = self.reads
+        {
+            log.note_all(&kept_files);
+        }
+        (kept, kept_files)
+    }
+
+    /// Run `make`, which makes a buffer to keep under `key` in the layer cache, on this renderer
+    /// with its reads noted apart: what `make` returns and the files it read (from the footage
+    /// source, or the files of cached buffers it used), which go to [`Renderer::reads`] too. A
+    /// cached buffer then reports the files it was made of whichever render uses it. Without a
+    /// cache or a key, `make` runs on this renderer as it is (no files: nothing is kept).
+    pub(crate) fn recorded<T>(&self, key: Option<u64>, make: impl FnOnce(&Renderer<'_>) -> T) -> (T, Arc<ReadFiles>) {
+        if key.is_none() || self.cache.is_none() {
+            return (make(self), Arc::default());
+        }
+        // (the generation before any read: a file dropped while `make` runs makes it stale)
+        let log = self.cache.and_then(LayerCache::drop_generation).map_or_else(ReadLog::new, ReadLog::starting_at);
+        let out = make(&Renderer { reads: Some(&log), ..*self });
+        let files = log.into_files();
+        if let Some(own) = self.reads {
+            own.note_all(&files);
+        }
+        (out, Arc::new(files))
+    }
+
+    /// A layer's Quality switch, limited by the precomp layers above it when
+    /// [`RenderOpts::nested_switches`] is on.
+    pub fn quality(&self, layer: &Layer) -> Quality {
+        let rank = |q: Quality| match q {
+            Quality::Best => 0,
+            Quality::Draft => 1,
+            Quality::Wireframe => 2,
+        };
+        match self.inherited {
+            Some((q, _)) if rank(q) > rank(layer.switches.quality) => q,
+            _ => layer.switches.quality,
+        }
+    }
+
+    /// What this renderer passes down to the layers it draws beyond their own switches
+    /// ([`RenderOpts::nested_switches`], the switches inherited from the precomp layers above,
+    /// motion blur on): part of the cache key of a buffer that reads other layers.
+    pub(crate) fn nested_look(&self) -> u64 {
+        let inherited = match self.inherited {
+            None => 0,
+            Some((q, mb)) => {
+                let q = match q {
+                    Quality::Best => 0,
+                    Quality::Draft => 1,
+                    Quality::Wireframe => 2,
+                };
+                1 + q * 2 + u64::from(mb)
+            }
+        };
+        0x6e65_7374_0000_0000 | inherited << 2 | u64::from(self.opts.nested_switches) << 1 | u64::from(self.opts.motion_blur)
+    }
+
+    /// A layer's Motion Blur switch, limited by the precomp layers above it.
+    pub(crate) fn layer_motion_blur(&self, layer: &Layer) -> bool {
+        layer.switches.motion_blur && self.inherited.is_none_or(|(_, mb)| mb)
+    }
+
+    /// The renderer for the nested comp of precomp layer `layer`: its switches pass down when
+    /// [`RenderOpts::nested_switches`] is on.
+    fn nested_through(&self, layer: &Layer) -> Renderer<'a> {
+        let mut sub = self.nested();
+        if self.opts.nested_switches {
+            sub.inherited = Some((self.quality(layer), self.layer_motion_blur(layer)));
+        }
+        sub
+    }
+
+    /// The render options one level down (precomps, collapsed precomps, comps read by effects):
+    /// guide layers render only in their own comp, never when it is nested.
+    fn nested_opts(&self) -> RenderOpts {
+        RenderOpts { guides: false, ..self.opts }
+    }
+
+    /// A renderer for nested work (precomps, layers read by effects): one level deeper.
+    pub(crate) fn nested(&self) -> Renderer<'a> {
+        Renderer {
+            opts: self.nested_opts(),
+            depth: self.depth + 1,
+            outer: None,
+            opacity_mul: 1.0,
+            collapse3d: None,
+            defer_dof: false,
+            top: false,
+            through: [None; MAX_THROUGH],
+            through_lost: false,
+            // Effects and nested renders need whole layer-space pixels.
+            whole_raster: true,
+            ..*self
+        }
+    }
+
+    /// A precomp layer's nested comp for an accelerator to render resident (no CPU render and
+    /// upload of the nested frame): the renderer one level down, the comp, its time and the
+    /// buffer scale, exactly as [`Self::layer_source`]'s comp branch would render it. `None`
+    /// when that branch does more (composition proxy, Essential Properties overrides, frame
+    /// blending, recursion) or draws nothing (outside the nested comp's span): use the CPU path.
+    pub fn precomp_source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<(Renderer<'a>, ItemId, Tick, f64)> {
+        let LayerSource::Comp { item } = layer.source else { return None };
+        if layer.switches.adjustment || self.project.comp_contains(item, ctx.comp_id) {
+            return None;
+        }
+        let nc = self.project.comp(item)?;
+        let lt = ctx.nested_time(layer);
+        if self.content_times(ctx, layer).is_some() {
+            return None;
+        }
+        if !nc.covers(lt) || self.proxy_for(item).is_some() || !essential_overrides(ctx, layer).is_empty() || frame_blend_mode(ctx, layer) != FrameBlend::Off {
+            return None;
+        }
+        let s = self.opts.scale;
+        let bs = if s < 1.0 && nc.preserve_resolution { 1.0 } else { s };
+        let base = self.nested_through(layer);
+        Some((Renderer { opts: RenderOpts { scale: bs, ..base.opts }, ..base }, item, lt, bs))
+    }
+
+    /// The nested comp of a precomp layer whose transformations collapse into this comp: the
+    /// Collapse Transformations switch is on and the layer has no masks, effects or layer
+    /// styles (those force a flattened render of the precomp, as in After Effects). Essential
+    /// Properties overrides travel with it and are applied as the nested layers are evaluated,
+    /// so the nested comp is not rasterised at its frame.
+    pub fn collapsed(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Collapsed> {
+        if !layer.switches.collapse || layer.switches.adjustment || self.depth > 12 {
+            return None;
+        }
+        let LayerSource::Comp { item } = &layer.source else { return None };
+        if self.project.comp_contains(*item, ctx.comp_id) || self.project.comp(*item).is_none() {
+            return None;
+        }
+        if layer.masks().is_some_and(|m| !m.children.is_empty()) {
+            return None;
+        }
+        if layer.switches.effects && layer.effects().is_some_and(|fx| fx.groups().any(|g| g.enabled)) {
+            return None;
+        }
+        if styles::active(ctx, layer) {
+            return None;
+        }
+        // A composition proxy or frame blending is drawn by the flattened path (`precomp_source`);
+        // collapsing renders the nested comp directly and would ignore both.
+        if self.proxy_for(*item).is_some() || frame_blend_mode(ctx, layer) != FrameBlend::Off {
+            return None;
+        }
+        let (property_overrides, media_overrides) = collapsed_instance(ctx, layer, *item)?;
+        Some(Collapsed { item: *item, property_overrides, media_overrides })
+    }
+
+    /// A renderer and context that draw a collapsed precomp's layers straight into this comp:
+    /// their transforms are concatenated with the precomp layer's (one resample, no
+    /// rasterisation at the precomp's bounds), their opacity multiplied by `opacity`, and their
+    /// 3D layers use this comp's camera and lights.
+    pub fn collapse_into<'p>(&self, ctx: &EvalCtx<'a>, layer: &'a Layer, collapsed: &'p Collapsed, opacity: f32) -> Option<(Renderer<'p>, EvalCtx<'p>)>
+    where
+        'a: 'p,
+    {
+        let item = collapsed.item;
+        let nc = self.project.comp(item)?;
+        let t = ctx.nested_time(layer);
+        if !nc.covers(t) {
+            return None;
+        }
+        let nctx = EvalCtx {
+            comp_id: item,
+            comp: nc,
+            time: t,
+            property_overrides: &collapsed.property_overrides,
+            media_overrides: &collapsed.media_overrides,
+            ..*ctx
+        };
+        let (l2c, _) = ctx.layer_to_comp(layer);
+        let outer = Some(self.outer.map_or(l2c, |o| o * l2c));
+        let world = ctx.world_matrix(layer);
+        let c3 = Collapse3d {
+            world: self.collapse3d.map_or(world, |c| c.world * world),
+            cam: three_d::compose::camera_for(self, ctx),
+            parent: self.collapse3d.map_or(*ctx, |c| c.parent),
+        };
+        // Motion blur follows the precomp layer's own motion too.
+        let link = Through { comp_id: ctx.comp_id, comp: ctx.comp, time: ctx.time, layer, blur: self.mb_on(ctx, layer) };
+        let mut through = self.through;
+        let slot = through.iter_mut().find(|t| t.is_none());
+        let through_lost = self.through_lost || slot.is_none();
+        if let Some(slot) = slot {
+            *slot = Some(link);
+        }
+        Some((
+            Renderer { opts: self.nested_opts(), depth: self.depth + 1, outer, opacity_mul: opacity, collapse3d: Some(c3), through, through_lost, ..*self },
+            nctx,
+        ))
+    }
+
+    pub(crate) fn opacity_mul(&self) -> f32 {
+        self.opacity_mul
+    }
+
+    /// Draw a collapsed 2D precomp layer: nested layers blend straight into `canvas` with their
+    /// own modes (Normal precomp, no matte); otherwise they are drawn into an isolated buffer
+    /// that then takes the precomp layer's track matte, Preserve Transparency and blend mode.
+    /// Returns the region left to re-quantise (nested layers drawn straight into `canvas`
+    /// quantise their own footprints).
+    pub(crate) fn draw_collapsed(&self, ctx: &EvalCtx<'a>, layer: &'a Layer, collapsed: &Collapsed, canvas: &mut Image, blank: bool) -> Region {
+        let opacity = ctx.opacity(layer) as f32 * self.opacity_mul;
+        if opacity <= 0.0 {
+            return Region::Empty;
+        }
+        let matte = layer.track_matte.is_some_and(|tm| tm.layer != layer.id && ctx.comp.layer(tm.layer).is_some());
+        if layer.blend_mode == BlendMode::Normal && !matte && !layer.preserve_transparency {
+            if let Some((sub, nctx)) = self.collapse_into(ctx, layer, collapsed, opacity) {
+                sub.draw_comp(&nctx, canvas, blank);
+            }
+            return Region::Empty;
+        }
+        let Some((sub, nctx)) = self.collapse_into(ctx, layer, collapsed, 1.0) else { return Region::Empty };
+        let mut iso = Image::new(canvas.width, canvas.height);
+        sub.draw_comp(&nctx, &mut iso, true);
+        self.composite_iso(ctx, layer, iso, canvas, opacity);
+        Region::Full
+    }
+
+    /// Whether `layer`'s processed buffer (source → masks → effects) is cached and the same as
+    /// one frame earlier: drawing it from the layer cache (an accelerator uploads it once) beats
+    /// re-running its effects every frame.
+    pub fn layer_is_static(&self, ctx: &EvalCtx, layer: &Layer) -> bool {
+        if self.cache.is_none() {
+            return false;
+        }
+        let (scale, draft, blur) = (self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer));
+        let prev = ctx.time - ctx.comp.frame_rate.frame_duration();
+        let before = ctx.at(prev);
+        let now = self.clipped_key(ctx, layer, cache::layer_key(ctx, layer, scale, draft, blur));
+        now.is_some() && now == self.clipped_key(&before, layer, cache::layer_key(&before, layer, scale, draft, blur))
+    }
+
+    /// Rasterisation scale of a layer's source: the output scale, or — for text and shape layers,
+    /// which are always continuously rasterised (#390, #751), and Continuously Rasterize vector
+    /// footage — the output scale times the layer's on-screen scale (quarter-octave steps, rounded
+    /// up, so vector content is drawn at its final size and stays sharp when scaled up).
+    pub fn raster_scale(&self, ctx: &EvalCtx, layer: &Layer) -> f64 {
+        let s = self.opts.scale;
+        let continuous = match layer.source {
+            LayerSource::Text | LayerSource::Shape => true,
+            LayerSource::Footage { item } => {
+                let item = ctx.media_item(layer, item);
+                layer.switches.collapse && matches!(self.project.item(item).map(|i| &i.kind), Some(ItemKind::Footage(f)) if is_vector_footage(f))
+            }
+            _ => false,
+        };
+        if !continuous {
+            return s;
+        }
+        let (l2c, _) = ctx.layer_to_comp(layer);
+        let m = self.outer.map_or(l2c, |o| o * l2c);
+        let a = layer.transform().map(|tr| ctx.v3(layer, tr, "anchor", [0.0; 3])).unwrap_or([0.0; 3]);
+        let p0 = m.apply(vec2(a[0], a[1]));
+        let px = m.apply(vec2(a[0] + 1.0, a[1]));
+        let py = m.apply(vec2(a[0], a[1] + 1.0));
+        let k = ((px.x - p0.x).hypot(px.y - p0.y)).max((py.x - p0.x).hypot(py.y - p0.y));
+        if !k.is_finite() || k <= 1e-6 {
+            return s;
+        }
+        // The step is rounded up past rounding noise only: an unscaled layer whose position isn't
+        // a whole number maps the unit vectors to lengths a hair over 1, which must stay 1 (#390:
+        // rounded up to 2^¼, unscaled text was drawn larger and resampled, softer).
+        let mut k = 2f64.powf((k.log2() * 4.0 - 1e-6).ceil() / 4.0).clamp(1.0 / 16.0, 64.0);
+        // Keep the buffer within about 16 million pixels (of the part the output shows, when
+        // only that is rasterised: see `raster_clip`).
+        if let Some(b) = content_bounds(ctx, layer) {
+            let b = match self.raster_clip(ctx, layer) {
+                Some(c) => {
+                    let r = kurbo::Rect::new(b[0], b[1], b[2], b[3]).intersect(c);
+                    [r.x0, r.y0, r.x1, r.y1]
+                }
+                None => b,
+            };
+            let area = ((b[2] - b[0]) * (b[3] - b[1])).max(1.0) * s * s;
+            k = k.min((16.0e6 / area).sqrt().max(1.0));
+        }
+        s * k
+    }
+
+    /// The layer-space part of a 3D text or shape layer the output shows, when only that part
+    /// needs rasterising (#1388: text close to the camera was rasterised whole at up to 16
+    /// million pixels, a quarter gigabyte per frame worker, though the frame showed a fraction
+    /// of it; behind the camera it was rasterised and not drawn). `None` rasterises it whole:
+    /// whenever pixels outside the frame can matter — effects, layer styles, masks, motion blur,
+    /// depth of field, lights (shadows and transmission), Advanced 3D, per-character 3D, a
+    /// collapsed 2D transform — or the visible part can't be bounded (see
+    /// [`three_d::compose::visible_clip`]).
+    pub(crate) fn raster_clip(&self, ctx: &EvalCtx, layer: &Layer) -> Option<kurbo::Rect> {
+        if self.whole_raster || !layer.is_3d() || !matches!(layer.source, LayerSource::Text | LayerSource::Shape) || self.outer.is_some() {
+            return None;
+        }
+        if (layer.switches.effects && layer.effects().is_some_and(|fx| !fx.children.is_empty()))
+            || layer.masks().is_some_and(|m| !m.children.is_empty())
+            || styles::active(ctx, layer)
+            || ctx.comp.layers.iter().any(|l| matches!(l.source, LayerSource::Light { .. }))
+            || self.is_adv3d(ctx)
+            || (matches!(layer.source, LayerSource::Text) && text::per_char_3d(ctx, layer))
+        {
+            return None;
+        }
+        let v = three_d::compose::visible_clip(self, ctx, layer)?;
+        if v.area() <= 0.0 {
+            // Behind the camera.
+            return Some(v);
+        }
+        let b = content_bounds(ctx, layer).map(|b| kurbo::Rect::new(b[0], b[1], b[2], b[3]))?;
+        if v.x0 <= b.x0 && v.y0 <= b.y0 && v.x1 >= b.x1 && v.y1 >= b.y1 {
+            return None;
+        }
+        // Whole cells of a layer-space grid whose cell is about a quarter of the part that shows,
+        // rounded down to a power of two: a moving camera keeps one raster (and its cache entry)
+        // while that part stays within the same cells, and a dolly changes the grid only at each
+        // doubling. The cells cover at most about 2.25 times the part that shows. Worth it only
+        // when it leaves out at least half of the content.
+        let c = 2f64.powf(((v.width().max(v.height()) / 4.0).max(1e-6)).log2().floor());
+        let snap = |v: f64, up: bool| if up { (v / c).ceil() * c } else { (v / c).floor() * c };
+        // (Not cut to the content bounds: a stroke or a glyph's padding reaches past them.)
+        let cells = kurbo::Rect::new(snap(v.x0, false), snap(v.y0, false), snap(v.x1, true), snap(v.y1, true));
+        (cells.is_finite() && cells.intersect(b).area() <= b.area() * 0.5).then_some(cells)
+    }
+
+    /// A layer content cache key that also names the part rasterised ([`Self::raster_clip`]).
+    pub(crate) fn clipped_key(&self, ctx: &EvalCtx, layer: &Layer, key: Option<u64>) -> Option<u64> {
+        let k = key?;
+        Some(match self.raster_clip(ctx, layer) {
+            Some(c) => [c.x0, c.y0, c.x1, c.y1].iter().fold(cache::derive(k, 0xc11b), |d, v| cache::derive(d, (v * 16.0).round() as i64 as u64)),
+            None => k,
+        })
+    }
+
+    /// Draw a Wireframe-quality layer: its bounds as a one-pixel outline.
+    pub(crate) fn draw_wireframe(&self, ctx: &EvalCtx, layer: &Layer, canvas: &mut Image) {
+        for (x, y) in self.wireframe_pixels(ctx, layer, (canvas.width, canvas.height)) {
+            canvas.set(x, y, [1.0, 1.0, 1.0, 1.0]);
+        }
+    }
+
+    /// The evaluation context of `comp` at `t`, carrying this renderer's expressions, footage and read log.
+    pub(crate) fn ctx(&self, comp_id: ItemId, comp: &'a Comp, t: Tick) -> EvalCtx<'a> {
+        EvalCtx {
+            project: self.project,
+            comp_id,
+            comp,
+            time: t,
+            expr: self.expr,
+            footage: Some(self.footage),
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: self.reads,
+        }
+    }
+
+    /// This renderer with another accelerator (or none): the passes of
+    /// [`passes::in_passes`] render with the accelerator, its CPU fallback without.
+    pub fn with_accel(&self, accel: Option<&'a dyn Accelerator>) -> Renderer<'a> {
+        Renderer { accel, ..*self }
+    }
+
+    /// The accelerator to use for this render, if any (see [`Backend`]).
+    pub fn active_accel(&self) -> Option<&'a dyn Accelerator> {
+        let a = self.accel?;
+        match self.opts.backend {
+            Backend::Cpu => None,
+            Backend::Gpu => Some(a),
+            Backend::Auto => self.project.settings.gpu_acceleration.then_some(a),
+        }
+    }
+
+    /// Render a composition at comp time `t` (transparent background, comp size × scale).
+    /// Top-level frames go to the GPU when [`Self::active_accel`] is set and handles them.
+    pub fn comp_frame(&self, comp_id: ItemId, t: Tick) -> Image {
+        // Classic 3D runs composite on the GPU too (M12.7), so Auto sends 3D comps there as well;
+        // Auto renders each comp on whichever compositor measured faster ([`AutoPick`]).
+        if self.depth == 0
+            && let Some(a) = self.active_accel()
+        {
+            let auto = self.frame_auto(a, comp_id, false);
+            if auto.is_none_or(|(p, key)| p.choose(key)) {
+                let t0 = web_time::Instant::now();
+                if let Some(img) = a.comp_frame(self, comp_id, t) {
+                    if let Some((p, key)) = auto {
+                        p.record(key, true, t0.elapsed().as_secs_f64() * 1e3);
+                    }
+                    return img;
+                }
+                if let Some((p, key)) = auto {
+                    p.declined(key);
+                }
+            }
+            let t0 = web_time::Instant::now();
+            let img = self.comp_frame_cpu(comp_id, t);
+            if let Some((p, key)) = auto {
+                p.record(key, false, t0.elapsed().as_secs_f64() * 1e3);
+            }
+            return img;
+        }
+        self.comp_frame_cpu(comp_id, t)
+    }
+
+    /// The Auto timing history and key for a top-level frame of `comp` (`None` unless the
+    /// backend is [`Backend::Auto`] and the accelerator keeps history).
+    pub fn frame_auto(&self, a: &'a dyn Accelerator, comp: ItemId, display: bool) -> Option<(&'a AutoPick, AutoKey)> {
+        if self.opts.backend != Backend::Auto || self.opts.roi.is_some() {
+            return None;
+        }
+        Some((a.auto_pick()?, AutoKey::new(comp, self.opts.scale, display)))
+    }
+
+    /// [`Self::comp_frame`] on the CPU compositor only.
+    pub fn comp_frame_cpu(&self, comp_id: ItemId, t: Tick) -> Image {
+        let Some(comp) = self.project.comp(comp_id) else { return Image::new(1, 1) };
+        let s = self.opts.scale;
+        let (w, h) = frame_size(comp.width, comp.height, s);
+        // Region of interest on a comp with 3D layers: render the frame and crop it. A region
+        // reaching past the comp frame (the Extended Viewer) renders Classic 3D natively — the
+        // planes project through the offset camera — and Advanced 3D as the frame, padded.
+        if self.depth == 0
+            && let Some(r) = self.opts.roi
+            && comp.has_3d()
+            && (roi_inside(r, comp.width, comp.height) || comp.renderer == effectcraft_project::Renderer::Advanced3D)
+        {
+            let full = Renderer { opts: RenderOpts { roi: None, ..self.opts }, ..*self }.comp_frame(comp_id, t);
+            let (x0, y0) = ((r[0] * s).round() as i64, (r[1] * s).round() as i64);
+            let (rw, rh) = (((r[2] * s).round() as u32).max(1), ((r[3] * s).round() as u32).max(1));
+            let mut out = Image::new(rw, rh);
+            for y in 0..rh as i64 {
+                let sy = y + y0;
+                if sy < 0 || sy >= full.height as i64 {
+                    continue;
+                }
+                for x in 0..rw as i64 {
+                    let sx = x + x0;
+                    if sx >= 0 && sx < full.width as i64 {
+                        out.data[(y * rw as i64 + x) as usize] = full.data[(sy * full.width as i64 + sx) as usize];
+                    }
+                }
+            }
+            return out;
+        }
+        let (w, h) = match self.roi_offset() {
+            Some((_, _, rw, rh)) => (rw, rh),
+            None => (w, h),
+        };
+        let mut canvas = Image::new(w, h);
+        if self.depth > 16 {
+            return canvas;
+        }
+        let ctx = self.ctx(comp_id, comp, t);
+        self.draw_comp(&ctx, &mut canvas, true);
+        // The canvas is already quantised after every layer; only re-encoding changes it.
+        if let Some(c) = self.pipe.from_blend() {
+            color::convert(&mut canvas, &c);
+            self.pipe.quantize(&mut canvas);
+        }
+        // The top-level comp leaves the working space for the (sRGB) display / output.
+        let out = self.output_pipe();
+        if self.depth == 0
+            && let Some(c) = out.output()
+        {
+            color::convert(&mut canvas, &c);
+            self.pipe.quantize(&mut canvas);
+        }
+        if self.depth == 0
+            && let Some((lin, mode, enc)) = out.output_hdr()
+        {
+            color::output_hdr(&mut canvas, lin, mode, enc);
+            self.pipe.quantize(&mut canvas);
+        }
+        canvas
+    }
+
+    /// Draw a comp's layers (bottom to top) into `canvas` (blending space).
+    /// `blank`: the canvas is fully transparent (lets the first layer skip re-quantising).
+    fn draw_comp(&self, ctx: &EvalCtx<'a>, canvas: &mut Image, mut blank: bool) {
+        // Bottom-to-top, with runs of consecutive 3D layers depth-sorted (farthest first).
+        let visible = self.visible_layers(ctx);
+        let mut i = 0;
+        while i < visible.len() {
+            if visible[i].is_3d() {
+                let mut j = i;
+                while j < visible.len() && visible[j].is_3d() {
+                    j += 1;
+                }
+                three_d::compose::draw_run(self, ctx, &visible[i..j], canvas);
+                i = j;
+                self.pipe.quantize(canvas);
+                blank = false;
+            } else {
+                let changed = match self.collapsed(ctx, visible[i]) {
+                    Some(collapsed) => self.draw_collapsed(ctx, visible[i], &collapsed, canvas, blank),
+                    None => self.draw_layer(ctx, visible[i], canvas, blank),
+                };
+                i += 1;
+                // 8/16 bpc: the comp is an integer buffer after every layer (only the pixels the
+                // layer touched need re-quantising).
+                self.pipe.quantize_region(canvas, changed);
+                blank = false;
+            }
+        }
+    }
+
+    /// Evaluate an effect instance's parameters.
+    fn effect_params(&self, ctx: &EvalCtx, layer: &Layer, g: &effectcraft_project::PropGroup) -> Params {
+        // Nested groups (Paint strokes, Puppet meshes and pins) are flattened too.
+        effectcraft_effects::flatten_params(g, &mut |pr| ctx.value(layer, pr))
+    }
+
+    pub(crate) fn apply_effects(&self, ctx: &EvalCtx, layer: &Layer, buf: Buf, adjustment: bool) -> Buf {
+        self.apply_effects_timed(ctx, layer, buf, adjustment, usize::MAX, None)
+    }
+
+    /// Run the first `limit` effects of the layer's stack (by position; disabled ones count) on
+    /// `buf` (layer space, or the comp below for an adjustment layer).
+    fn apply_effects_timed(&self, ctx: &EvalCtx, layer: &Layer, mut buf: Buf, adjustment: bool, limit: usize, timing: Option<&mut Vec<(String, f64)>>) -> Buf {
+        // The comp below an adjustment layer is not in its layer space: it stays as it is.
+        let origin = if adjustment { [0.0; 2] } else { ctx.effect_bounds(layer).1 };
+        buf.rebase(origin);
+        let mut out = self.effect_space_stack(ctx, layer, buf, EffectStack { adjustment, limit, origin }, timing);
+        out.rebase([-origin[0], -origin[1]]);
+        out
+    }
+
+    /// [`Renderer::apply_effects_timed`] on a buffer already in effect space (measured from
+    /// `origin`, in layer coordinates); the result stays in effect space.
+    fn effect_space_stack(&self, ctx: &EvalCtx, layer: &Layer, buf: Buf, stack: EffectStack, timing: Option<&mut Vec<(String, f64)>>) -> Buf {
+        let mut t = CpuFx { accel: self.active_accel(), levels: self.pipe.levels, buf: Some(buf) };
+        self.run_effect_stack(ctx, layer, stack, timing, &mut t);
+        t.buf.unwrap_or_else(|| Buf { img: Image::new(1, 1), offset: [0.0; 2], scale: self.opts.scale })
+    }
+
+    /// Run the layer's video effect stack on `target` (in effect space, measured from `origin`
+    /// in layer coordinates): runs of GPU-capable effects go to [`FxTarget::gpu`] (when an
+    /// accelerator is active and supports them), the rest to [`FxTarget::cpu`] one by one
+    /// (quantised to the bit depth after each).
+    pub(crate) fn run_effect_stack(
+        &self,
+        ctx: &EvalCtx,
+        layer: &Layer,
+        stack: EffectStack,
+        mut timing: Option<&mut Vec<(String, f64)>>,
+        target: &mut dyn FxTarget,
+    ) {
+        let EffectStack { adjustment, limit, origin } = stack;
+        if !layer.switches.effects {
+            return;
+        }
+        let Some(fx) = layer.effects() else { return };
+        let lt = layer.layer_time(ctx.time);
+        let layer_size = ctx.effect_bounds(layer).0;
+        // #659 / #1205: an authored layer's buffer spans only its painted content. Effects that
+        // place pixels outside it grow the buffer themselves, by exactly what they need
+        // (`layer_cover_pad`: CC Tiler, CC Smear, CC Mosaic sharp) instead of a blanket cover of
+        // the whole layer rectangle on every stack — which paid a comp-sized texture per layer,
+        // per frame in flight, for glow and blur that never use the extra room. The buffer still
+        // takes the cover's pixel-grid phase: a downscaled layer resamples along that grid.
+        // Effects not known to stay inside their own margins (Twirl, Bulge, Transform, ...) still
+        // get the cover: they move content past the painted bounds without growing the buffer.
+        let video = || {
+            fx.groups().filter(|g| g.enabled).filter_map(|g| match &g.kind {
+                GroupKind::Effect { effect } => effectcraft_effects::find(effect).filter(|s| !effectcraft_effects::audio_fx::is_audio_effect(s.id)),
+                _ => None,
+            })
+        };
+        if !adjustment && video().next().is_some() {
+            if video().all(|s| s.skips_cover()) {
+                target.align(layer_size);
+            } else {
+                target.cover(layer_size);
+            }
+        }
+        let mut mask_shapes = masks::shapes(ctx, layer);
+        if origin != [0.0; 2] {
+            for q in mask_shapes.iter_mut().flat_map(|m| m.points.iter_mut()) {
+                *q = [q[0] - origin[0], q[1] - origin[1]];
+            }
+        }
+        // Capture once, before preceding effects can expand or replace the input. An
+        // adjustment stack's original is the comp below, not its solid source.
+        let needs_original =
+            fx.groups().take(limit).any(|g| g.enabled && matches!(&g.kind, GroupKind::Effect { effect } if effect == "ec.channel.cccomposite"));
+        let mut original = None;
+        if needs_original {
+            target.cpu(&mut |buf| {
+                original = Some(buf.clone());
+                buf
+            });
+        }
+        let host = FxHost { r: self, ctx, layer, origin, index: 0, original: original.as_ref() };
+        let env = EffectEnv {
+            masks: &mask_shapes,
+            host: Some(&host),
+            comp_time: ctx.time.seconds(),
+            frame_rate: ctx.comp.frame_rate.as_f64(),
+            effect_index: 0,
+            working_space: self.pipe.space,
+            working_linear: self.pipe.linear,
+            float_depth: self.pipe.levels.is_none(),
+            shutter: self.mb_on(ctx, layer).then_some((ctx.comp.shutter_angle, ctx.comp.shutter_phase, ctx.comp.motion_blur_samples)),
+            layer_span: crate::eval::layer_span(self.project, layer),
+        };
+        // Video effects in stack order (index, group, spec); disabled and audio effects skipped.
+        let stack: Vec<(usize, &effectcraft_project::PropGroup, &'static effectcraft_effects::EffectSpec)> = fx
+            .groups()
+            .enumerate()
+            .take_while(|(i, _)| *i < limit)
+            .filter(|(_, g)| g.enabled)
+            .filter_map(|(i, g)| match &g.kind {
+                GroupKind::Effect { effect } => effectcraft_effects::find(effect).map(|s| (i, g, s)),
+                _ => None,
+            })
+            .filter(|(_, _, s)| !effectcraft_effects::audio_fx::is_audio_effect(s.id))
+            .collect();
+        let accel = self.active_accel();
+        let mut k = 0;
+        while k < stack.len() {
+            let (i, g, spec) = stack[k];
+            // A run of GPU effects goes to the accelerator in one go.
+            if let Some(a) = accel
+                && spec.gpu
+                && a.supports_effect(spec.id)
+            {
+                let run: Vec<_> = stack[k..].iter().take_while(|(_, _, s)| s.gpu && a.supports_effect(s.id)).collect();
+                let params: Vec<Params> = run.iter().map(|(_, g, _)| self.effect_params(ctx, layer, g)).collect();
+                let hosts: Vec<_> = run.iter().map(|(i, _, _)| FxHost { index: *i, ..host }).collect();
+                let steps: Vec<FxStep> = run
+                    .iter()
+                    .zip(&params)
+                    .zip(&hosts)
+                    .map(|(((i, g, s), params), host)| FxStep {
+                        spec: s,
+                        ctx: EffectCtx {
+                            params,
+                            time: lt.seconds(),
+                            layer_size,
+                            seed: g.uid as u32,
+                            adjustment,
+                            env: EffectEnv { host: Some(host), effect_index: *i, ..env },
+                        },
+                    })
+                    .collect();
+                let t0 = web_time::Instant::now();
+                if target.gpu(&steps) {
+                    if let Some(v) = timing.as_deref_mut() {
+                        let ms = t0.elapsed().as_secs_f64() * 1e3 / run.len() as f64;
+                        v.extend(run.iter().map(|(_, _, s)| (format!("{} (gpu)", s.id), ms)));
+                    }
+                    k += run.len();
+                    continue;
+                }
+            }
+            k += 1;
+            let params = self.effect_params(ctx, layer, g);
+            let host = FxHost { index: i, ..host };
+            let env = EffectEnv { host: Some(&host), effect_index: i, ..env };
+            let ectx = EffectCtx { params: &params, time: lt.seconds(), layer_size, seed: g.uid as u32, adjustment, env };
+            let t0 = web_time::Instant::now();
+            target.cpu(&mut |buf| {
+                let mut buf = effectcraft_effects::apply(spec, &ectx, buf);
+                // 8/16 bpc effects write integer pixels.
+                self.pipe.quantize(&mut buf.img);
+                buf
+            });
+            if let Some(v) = timing.as_deref_mut() {
+                v.push((spec.id.to_string(), t0.elapsed().as_secs_f64() * 1e3));
+            }
+        }
+    }
+
+    /// Source pixels of a layer in layer space (before masks/effects).
+    pub(crate) fn source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Buf> {
+        let s = self.opts.scale;
+        match &layer.source {
+            LayerSource::Solid { item } => {
+                let ItemKind::Solid(sol) = &self.project.item(*item)?.kind else { return None };
+                let w = ((sol.width as f64 * s).ceil() as u32).max(1);
+                let h = ((sol.height as f64 * s).ceil() as u32).max(1);
+                if layer.switches.adjustment {
+                    return Some(Buf { img: Image::filled(w, h, [1.0; 4]), offset: [0.0; 2], scale: s });
+                }
+                let mut c = sol.color;
+                if let Some(conv) = self.pipe.authored_in() {
+                    c = conv.apply(c);
+                }
+                let px = self.pipe.quantize_px([c[0], c[1], c[2], 1.0]);
+                Some(Buf { img: Image::filled(w, h, px), offset: [0.0; 2], scale: s })
+            }
+            LayerSource::Comp { item } => {
+                if self.project.comp_contains(*item, ctx.comp_id) {
+                    return None;
+                }
+                // A composition proxy (a rendered still or movie) stands in for the comp. It is
+                // decoded like footage: its Separate Fields, Invert Alpha and Interpret As Linear
+                // Light settings and the layer's Frame Blending apply. Nothing before the nested
+                // comp starts or after it ends.
+                let lt = ctx.nested_time(layer);
+                if !self.project.comp(*item).is_some_and(|nc| nc.covers(lt)) {
+                    return None;
+                }
+                if let Some(pf) = self.proxy_for(*item)
+                    && let Some(nc) = self.project.comp(*item)
+                {
+                    let img = self.footage_frame(ctx, layer, *item, pf, lt, None)?;
+                    return Some(self.footage_buf(&img, pf, nc.width, nc.height));
+                }
+                // Essential Properties overrides render the nested comp with this instance's
+                // values.
+                let ov = essential_overrides(ctx, layer);
+                let tmp = if ov.is_empty() { None } else { effectcraft_project::essential::with_overrides(self.project, *item, &ov) };
+                // Preserve resolution when nested: drawn at full size even when this comp renders
+                // smaller (the buffer's scale places it).
+                let full = s < 1.0 && self.project.comp(*item).is_some_and(|nc| nc.preserve_resolution);
+                let bs = if full { 1.0 } else { s };
+                let base = self.nested_through(layer);
+                let base = Renderer { opts: RenderOpts { scale: bs, ..base.opts }, ..base };
+                let sub = match &tmp {
+                    Some(p) => Renderer { project: p, ..base },
+                    None => base,
+                };
+                // Frame blending between the nested comp's frames (time-stretched/remapped).
+                let mode = frame_blend_mode(ctx, layer);
+                if mode != FrameBlend::Off
+                    && let Some(nc) = self.project.comp(*item)
+                {
+                    let (i, w) = frame_position(lt, nc.frame_rate);
+                    if w > 1e-6 {
+                        let a = sub.comp_frame(*item, nc.frame_rate.tick_of(i));
+                        let b = sub.comp_frame(*item, nc.frame_rate.tick_of(i + 1));
+                        return Some(Buf { img: blend_frames(mode, &a, &b, w as f32), offset: [0.0; 2], scale: bs });
+                    }
+                }
+                Some(Buf { img: sub.comp_frame(*item, lt), offset: [0.0; 2], scale: bs })
+            }
+            LayerSource::Footage { item } => {
+                let item = ctx.media_item(layer, *item);
+                let it = self.project.item(item)?;
+                let ItemKind::Footage(f) = &it.kind else { return None };
+                if !f.has_video {
+                    return None;
+                }
+                // Continuously rasterised vector footage: drawn at the on-screen scale.
+                if layer.switches.collapse && is_vector_footage(f) {
+                    let k = self.raster_scale(ctx, layer);
+                    if let Some(img) = self.read(|| self.footage.vector_frame(item, f, k)) {
+                        let mut buf = Buf { img: (*img).clone(), offset: [0.0; 2], scale: k };
+                        if let Some(c) = self.pipe.media_in(f) {
+                            color::convert(&mut buf.img, &c);
+                        }
+                        return Some(buf);
+                    }
+                }
+                let lt = ctx.source_time(layer);
+                // The proxy is decoded instead, at its own size, and fills the footage's frame.
+                let proxy = self.proxy_for(item);
+                let pf = proxy.unwrap_or(f);
+                let size = self.reduced_size(f.width, f.height).filter(|_| proxy.is_none());
+                let img = self.footage_frame(ctx, layer, item, pf, lt, size)?;
+                Some(self.footage_buf(&img, pf, f.width, f.height))
+            }
+            // (the font files go to this render's log, which `ctx` may not carry: see
+            // [`Renderer::with_reads`])
+            LayerSource::Text => {
+                // An Expression Selector evaluates per character: its results at other characters
+                // than the first are not in the layer's cache key (an amount reading a footage
+                // item's size by name, `textIndex == 1 ? 0 : footage("ref.png").width`), so the
+                // buffer is kept in memory only, never on disk (the frame's key covers them).
+                if cache::per_character_expressions(layer)
+                    && let Some(log) = self.reads
+                {
+                    log.mark_unkeyed();
+                }
+                Some(self.authored(text::render_in(&self.with_reads(ctx), layer, self.raster_scale(ctx, layer), self.raster_clip(ctx, layer))))
+            }
+            LayerSource::Shape => layer
+                .props
+                .sub("contents")
+                .map(|c| self.authored(shapes::render_in(ctx, layer, c, self.raster_scale(ctx, layer), self.raster_clip(ctx, layer)))),
+            _ => None,
+        }
+    }
+
+    /// The proxy footage used for `item` under this render's Proxy Use, if any.
+    pub fn proxy_for(&self, item: ItemId) -> Option<&'a Footage> {
+        let it = self.project.item(item)?;
+        let px = it.proxy.as_deref()?;
+        (self.opts.proxy.uses(matches!(it.kind, ItemKind::Comp(_)), px.enabled) && px.footage.has_video).then_some(&px.footage)
+    }
+
+    /// A decoded frame of `f` as a layer buffer covering `w`×`h` layer pixels (the footage's
+    /// nominal size; proxies are scaled up to it), converted from its colour profile.
+    fn footage_buf(&self, img: &Image, f: &Footage, w: u32, h: u32) -> Buf {
+        let s = self.opts.scale;
+        let k = if img.width > 0 { w.max(1) as f64 / img.width as f64 } else { 1.0 };
+        // Keep native pixels when downsampling is small; resample otherwise.
+        let mut buf = match self.reduced_size(w, h) {
+            // The source resampled it already (`FootageSource::frame_at_size`).
+            Some(size) if (img.width, img.height) == size => Buf { img: img.clone(), offset: [0.0; 2], scale: s },
+            Some((rw, rh)) if k <= 1.0 + 1e-9 => Buf { img: effectcraft_raster::resample(img, rw, rh), offset: [0.0; 2], scale: s },
+            _ => Buf { img: img.clone(), offset: [0.0; 2], scale: 1.0 / k },
+        };
+        if let Some(c) = self.pipe.media_in(f) {
+            color::convert(&mut buf.img, &c);
+        }
+        buf
+    }
+
+    /// The size of `w` × `h` layer pixels in this render when it is reduced enough that footage
+    /// is resampled to it (below 3/4 scale).
+    fn reduced_size(&self, w: u32, h: u32) -> Option<(u32, u32)> {
+        let s = self.opts.scale;
+        (s < 0.75).then(|| (((w as f64 * s).round() as u32).max(1), ((h as f64 * s).round() as u32).max(1)))
+    }
+
+    /// Authored colours into the working space (linear working spaces).
+    fn authored(&self, mut buf: Buf) -> Buf {
+        if let Some(c) = self.pipe.authored_in() {
+            color::convert(&mut buf.img, &c);
+        }
+        buf
+    }
+
+    /// A footage frame at source time `t`, frame-blended between the two nearest source frames
+    /// when the layer's Frame Blending switch (and the comp's Enable Frame Blending) is on and
+    /// `t` falls between frames (footage rate ≠ comp rate, time stretch, time remapping).
+    /// `size`: a plain frame may come resampled to it ([`FootageSource::frame_at_size`]).
+    fn footage_frame(&self, ctx: &EvalCtx, layer: &Layer, item: ItemId, f: &Footage, t: Tick, size: Option<(u32, u32)>) -> Option<Arc<Image>> {
+        // Interpret Footage ▸ Separate Fields: each field is a frame at twice the rate.
+        if f.fields != effectcraft_project::FieldOrder::Off && matches!(f.kind, FootageKind::Video | FootageKind::Sequence) {
+            let field_rate = FrameRate::new(f.frame_rate.num * 2, f.frame_rate.den);
+            let i = field_rate.frame_at(t).max(0);
+            let img = cineon_frame(self.read(|| self.footage.frame_with(item, f, f.frame_rate.tick_of(i / 2), None, self.pipe.float_curve(f)))?, f);
+            let dominant_upper = f.fields == effectcraft_project::FieldOrder::UpperFirst;
+            // Upper field = even lines (0, 2, …).
+            let parity = if (i % 2 == 0) == dominant_upper { 0 } else { 1 };
+            return Some(Arc::new(interpret_pixels(&field_frame(&img, parity), f, self.pipe.linear_footage_space(f))));
+        }
+        // Interpretation is per pixel but not linear: it runs on the frame before resampling.
+        let per_pixel = f.invert_alpha || f.linear_light_applies();
+        let size = size.filter(|_| !(per_pixel || f.cineon_applies()));
+        let img = self.footage_frame_raw(ctx, layer, item, f, t, size)?;
+        if per_pixel { Some(Arc::new(interpret_pixels(&img, f, self.pipe.linear_footage_space(f)))) } else { Some(img) }
+    }
+
+    /// The footage frame at source time `t` after frame blending: the average of the source frames one comp frame spans, else a blend of the two neighbouring frames, else the plain frame.
+    /// Log scans are converted first, and blended frames are cached.
+    fn footage_frame_raw(&self, ctx: &EvalCtx, layer: &Layer, item: ItemId, f: &Footage, t: Tick, size: Option<(u32, u32)>) -> Option<Arc<Image>> {
+        let mode = frame_blend_mode(ctx, layer);
+        let float = self.pipe.float_curve(f);
+        if mode != FrameBlend::Off && matches!(f.kind, FootageKind::Video | FootageKind::Sequence) {
+            let (i, w) = frame_position(t, f.frame_rate);
+            if w > 1e-6 {
+                // Blended frames are cached (Pixel Motion is expensive).
+                let key = self.cache.map(|_| {
+                    use std::hash::{Hash, Hasher};
+                    let mut h = std::collections::hash_map::DefaultHasher::new();
+                    (0x00f8_a3e5_u64, item, i, (w as f32).to_bits(), mode as u8, f.frame_rate.num, f.frame_rate.den, &f.path, float).hash(&mut h);
+                    // Every file of a sequence: the key must tell two projects apart whose items
+                    // share an id and a first frame (on disk, no project-wide salt does, #3184).
+                    f.sequence.hash(&mut h);
+                    (f.alpha as u8).hash(&mut h);
+                    if f.alpha == effectcraft_project::AlphaMode::Premultiplied {
+                        f.premul_color.map(f32::to_bits).hash(&mut h);
+                    }
+                    if f.cineon_applies() {
+                        let c = &f.cineon;
+                        [c.converted_black, c.converted_white, c.black, c.white, c.gamma, c.rolloff].map(f32::to_bits).hash(&mut h);
+                    }
+                    h.finish()
+                });
+                if let Some((b, _)) = self.cached(key) {
+                    return Some(Arc::new(b.img.clone()));
+                }
+                // Log scans are converted before they blend: the conversion is not linear.
+                let ((a, b), files) = self.recorded(key, |r| {
+                    let frame = |i| r.read(|| r.footage.frame_with(item, f, f.frame_rate.tick_of(i), None, float)).map(|a| cineon_frame(a, f));
+                    (frame(i), frame(i + 1))
+                });
+                if let (Some(a), Some(b)) = (a, b) {
+                    let img = blend_frames(mode, &a, &b, w as f32);
+                    let _kept = self.keep(key, Arc::new(Buf { img: img.clone(), offset: [0.0; 2], scale: 1.0 }), &files);
+                    return Some(Arc::new(img));
+                }
+            }
+        }
+        self.read(|| self.footage.frame_with(item, f, t, size, float)).map(|img| cineon_frame(img, f))
+    }
+
+    /// Source → masks, clamped/quantised to the project depth.
+    fn masked_source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Buf> {
+        let mut buf = match self.content_times(ctx, layer) {
+            Some(times) => self.blurred_source(ctx, layer, &times)?,
+            None => self.source(ctx, layer)?,
+        };
+        // A solid is filled with a quantised colour: only masks can take it off the grid.
+        let solid = matches!(layer.source, LayerSource::Solid { .. });
+        if masks::apply(ctx, layer, &mut buf, self.mask_blur(ctx, layer)) || !solid {
+            self.pipe.quantize(&mut buf.img);
+        }
+        Some(buf)
+    }
+
+    /// Fully processed layer buffer (source → masks → effects → layer styles, flattened).
+    /// Served from the layer cache when the layer's content key matches.
+    pub fn layer_buf(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
+        self.layer_buf_keyed(ctx, layer).map(|(b, _, _)| b)
+    }
+
+    /// [`Self::layer_buf`] in the blending space (linear with Blend Colors Using 1.0 Gamma).
+    pub fn blend_layer_buf(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
+        let (b, k, files) = self.layer_buf_keyed(ctx, layer)?;
+        Some(self.to_blend(b, k, &files))
+    }
+
+    /// A buffer converted to the blending space (cached under a key derived from `key`, with
+    /// `files`, the source files `b` was made of).
+    pub(crate) fn to_blend(&self, b: Arc<Buf>, key: Option<u64>, files: &Arc<ReadFiles>) -> Arc<Buf> {
+        let Some(c) = self.pipe.to_blend() else { return b };
+        let key = key.map(|k| cache::derive(k, 0x1ea7));
+        if let Some((x, _)) = self.cached(key) {
+            return x;
+        }
+        let mut nb = (*b).clone();
+        color::convert(&mut nb.img, &c);
+        self.keep(key, Arc::new(nb), files).0
+    }
+
+    /// The flattened layer buffer, its cache key and the source files it was made of.
+    fn layer_buf_keyed(&self, ctx: &EvalCtx, layer: &Layer) -> Option<(Arc<Buf>, Option<u64>, Arc<ReadFiles>)> {
+        let st = self.styled(ctx, layer, None)?;
+        if st.passes.is_empty() {
+            return Some((st.body, st.key, st.files));
+        }
+        let key = st.key.map(|k| cache::derive(k, 0xf1a7));
+        if let Some((b, files)) = self.cached(key) {
+            return Some((b, key, files));
+        }
+        let flat = Arc::new(styles::Styled { passes: st.passes.iter().map(|(b, m)| ((**b).clone(), *m)).collect(), body: (*st.body).clone() }.flatten());
+        let (flat, files) = self.keep(key, flat, &st.files);
+        Some((flat, key, files))
+    }
+
+    /// A layer's source pixels at the context time, before masks, effects and the transform
+    /// (what the motion tracker analyses, like After Effects' Layer panel). `None` for layers
+    /// without pixels.
+    pub fn layer_source(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Buf> {
+        Renderer { whole_raster: true, ..*self }.source(ctx, layer)
+    }
+
+    /// Layer-space pixels after masks and effects, including content outside the viewport.
+    /// Expression sampleImage reads this rather than the frame-oriented clipped buffer.
+    pub fn layer_content(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
+        Renderer { whole_raster: true, ..*self }.content_buf(ctx, layer)
+    }
+
+    /// A 3D model or primitive layer rendered on its own, through the comp's camera: what an
+    /// effect layer parameter reads when it references one, as After Effects, which renders 3D
+    /// layers through the active camera. The comp's pixels at this render's scale; the layer's
+    /// blend mode, track matte and video switch don't apply (a source read, not a composite —
+    /// the solo clone of a 3D track matte, see `three_d::adv`).
+    pub(crate) fn solo_3d(&self, ctx: &EvalCtx, layer: &Layer) -> Buf {
+        let s = self.opts.scale;
+        let w = ((ctx.comp.width as f64 * s).ceil() as u32).max(1);
+        let h = ((ctx.comp.height as f64 * s).ceil() as u32).max(1);
+        let mut canvas = Image::new(w, h);
+        // Outside the layer's in/out points there is nothing to read: the copy is transparent
+        // there, like any other layer reference (the 3D pipelines don't gate on the range).
+        if !layer.is_active_at(ctx.time) {
+            return Buf { img: canvas, offset: [0.0; 2], scale: s };
+        }
+        let mut solo = layer.clone();
+        solo.track_matte = None;
+        solo.blend_mode = effectcraft_color::BlendMode::Normal;
+        solo.preserve_transparency = false;
+        solo.switches.video = true;
+        three_d::compose::draw_run(self, ctx, &[&solo], &mut canvas);
+        Buf { img: canvas, offset: [0.0; 2], scale: s }
+    }
+
+    /// Layer pixels after source → masks → effects (no layer styles).
+    pub fn content_buf(&self, ctx: &EvalCtx, layer: &Layer) -> Option<Arc<Buf>> {
+        self.content_buf_timed(ctx, layer, None).map(|(b, _, _)| b)
+    }
+
+    /// [`Self::content_buf`], its cache key and the source files it was made of.
+    pub(crate) fn content_buf_timed(
+        &self,
+        ctx: &EvalCtx,
+        layer: &Layer,
+        mut timing: Option<&mut LayerTiming>,
+    ) -> Option<(Arc<Buf>, Option<u64>, Arc<ReadFiles>)> {
+        let key = self.cache.and_then(|_| cache::layer_key(ctx, layer, self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer)));
+        let key = self.content_key(ctx, layer, self.clipped_key(ctx, layer, key));
+        if let Some((b, files)) = self.cached(key) {
+            if let Some(t) = timing.as_deref_mut() {
+                t.cached = true;
+            }
+            return Some((b, key, files));
+        }
+        let (buf, files) = self.recorded(key, |r| {
+            // (what expressions read while it is made, at shutter times too, goes to its files)
+            let ctx = &r.with_reads(ctx);
+            let buf = r.masked_source(ctx, layer)?;
+            Some(r.apply_effects_timed(ctx, layer, buf, false, usize::MAX, timing.map(|t| &mut t.effects)))
+        });
+        let (buf, files) = self.keep(key, Arc::new(buf?), &files);
+        Some((buf, key, files))
+    }
+
+    /// A layer's input at the context time: source → masks → its first `effects` effects
+    /// (what Time effects read at neighbouring times), in effect space (see [`effect_bounds`]):
+    /// what effect `effects` sees. Served from / stored in the layer cache under its own key,
+    /// so scrubbing reuses frames rendered for earlier output frames.
+    pub fn layer_input(&self, ctx: &EvalCtx, layer: &Layer, effects: usize) -> Option<Arc<Buf>> {
+        // The Layer panel, analysis tools and effect inputs read the whole layer, not the viewport.
+        Renderer { whole_raster: true, ..*self }.whole_layer_input(ctx, layer, effects)
+    }
+
+    fn whole_layer_input(&self, ctx: &EvalCtx, layer: &Layer, effects: usize) -> Option<Arc<Buf>> {
+        let key = self.cache.and_then(|_| cache::input_key(ctx, layer, self.raster_scale(ctx, layer), self.opts.draft, self.mb_on(ctx, layer), effects));
+        let key = self.content_key(ctx, layer, self.clipped_key(ctx, layer, key));
+        if let Some((b, _)) = self.cached(key) {
+            return Some(b);
+        }
+        let (buf, files) = self.recorded(key, |r| {
+            let ctx = &r.with_reads(ctx);
+            let mut buf = r.masked_source(ctx, layer)?;
+            let origin = ctx.effect_bounds(layer).1;
+            buf.rebase(origin);
+            if effects > 0 {
+                buf = r.effect_space_stack(ctx, layer, buf, EffectStack { adjustment: false, limit: effects, origin }, None);
+            }
+            Some(buf)
+        });
+        Some(self.keep(key, Arc::new(buf?), &files).0)
+    }
+}
diff --git a/crates/render/src/reads.rs b/crates/render/src/reads.rs
new file mode 100644
index 000000000..ed97e50fd
--- /dev/null
+++ b/crates/render/src/reads.rs
@@ -0,0 +1,348 @@
+//! The source files a render read: which footage files its pixels came from, each with its
+//! identity (size and modification time) as it was when it was read.
+//!
+//! A [`FootageSource`](crate::FootageSource) that knows which files it opens notes them while
+//! [`FootageSource::recording`](crate::FootageSource::recording) runs; the renderer collects them
+//! in a [`ReadLog`] ([`Renderer::reads`](crate::Renderer::reads)). Buffers in the layer cache keep
+//! the files they were made of, so a frame served from memory reports the same files as the
+//! render that made it, without touching the disk.
+//!
+//! The list is what a cache entry on disk has to check before it is used: a handful of files per
+//! frame, never every file of every footage item.
+
+use std::sync::{Arc, Mutex, PoisonError};
+
+/// The identity of a file as a render read it (frame and layer entries on disk store it, see
+/// [`EntryFiles`](crate::disk_cache::EntryFiles)).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub enum FileStamp {
+    /// A file on disk: its size in bytes and its modification time (nanoseconds since the Unix
+    /// epoch, negative before it; `None` only where the file system has none).
+    Native { len: u64, modified: Option<i128> },
+    /// Bytes given from memory instead of the file system (the browser's file table): their
+    /// identity is the size and content hash a
+    /// [`VirtualFileId`](crate::disk_cache::VirtualFileId) gives for the path.
+    Virtual,
+    /// The file could not be read (missing, not a regular file, no permission). What was made
+    /// without it changes once it can be read again.
+    Missing,
+}
+
+impl FileStamp {
+    /// The identity of a file from metadata the caller already has (of an open file).
+    pub fn of_metadata(md: &std::fs::Metadata) -> FileStamp {
+        FileStamp::Native { len: md.len(), modified: md.modified().ok().map(epoch_nanos) }
+    }
+
+    /// The identity of the file at `path` now: one `metadata` call. `None` when the file system
+    /// can't describe it (missing, or a path served from memory).
+    pub fn native(path: &str) -> Option<FileStamp> {
+        std::fs::metadata(path).ok().map(|md| FileStamp::of_metadata(&md))
+    }
+}
+
+/// `t` in nanoseconds since the Unix epoch, negative before it: every time a file system can
+/// store fits (`i128` nanoseconds span far more than any `SystemTime`), saturating otherwise.
+pub fn epoch_nanos(t: std::time::SystemTime) -> i128 {
+    let nanos = |d: std::time::Duration| i128::try_from(d.as_nanos()).unwrap_or(i128::MAX);
+    match t.duration_since(std::time::UNIX_EPOCH) {
+        Ok(after) => nanos(after),
+        Err(before) => nanos(before.duration()).saturating_neg(),
+    }
+}
+
+/// One file a render read.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct ReadFile {
+    pub path: Arc<str>,
+    pub stamp: FileStamp,
+}
+
+impl ReadFile {
+    /// A file read with the given path and stamp.
+    pub fn new(path: impl Into<Arc<str>>, stamp: FileStamp) -> ReadFile {
+        ReadFile { path: path.into(), stamp }
+    }
+}
+
+/// At most this many files are listed per render or cached buffer; more mark the list
+/// incomplete (a comp reading more files than this for one frame is not checked file by file).
+pub const MAX_READ_FILES: usize = 4096;
+
+/// The files a render (or one cached buffer) read, each once, sorted by path.
+///
+/// Incomplete when it can't say for sure: a footage source that doesn't tell what it reads, a
+/// buffer from a store that doesn't keep its files, more than [`MAX_READ_FILES`] files, or one
+/// file read with two identities (it changed during the render). A cache entry whose list is
+/// incomplete can't be checked against the files, so it must not outlive the session.
+///
+/// It also carries where its reads come from, which equality and hashing ignore: the drop
+/// generation the earliest of them started at ([`ReadFiles::since`]), and whether a layer cache
+/// key can't capture what it was made of ([`ReadFiles::is_unkeyed`]).
+#[derive(Clone, Debug, Default)]
+pub struct ReadFiles {
+    files: Vec<ReadFile>,
+    incomplete: bool,
+    /// The disk cache's drop generation ([`DiskCache::drop_generation`]) when the earliest read
+    /// behind the list started; `None` when nothing says (a list built by hand).
+    ///
+    /// [`DiskCache::drop_generation`]: crate::disk_cache::DiskCache::drop_generation
+    since: Option<u64>,
+    /// Made of values a layer's cache key doesn't capture (a text Expression Selector evaluates
+    /// per character): such a buffer is not stored on disk.
+    unkeyed: bool,
+}
+
+impl PartialEq for ReadFiles {
+    /// The same files with the same identities (where the reads come from doesn't count).
+    fn eq(&self, other: &Self) -> bool {
+        self.files == other.files && self.incomplete == other.incomplete
+    }
+}
+
+impl Eq for ReadFiles {}
+
+impl std::hash::Hash for ReadFiles {
+    /// Hashes what [`PartialEq`] compares.
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.files.hash(state);
+        self.incomplete.hash(state);
+    }
+}
+
+impl ReadFiles {
+    /// Note a file read (once per path).
+    pub fn add(&mut self, file: ReadFile) {
+        match self.files.binary_search_by(|f| f.path.cmp(&file.path)) {
+            Ok(i) => {
+                if self.files.get(i).is_some_and(|f| f.stamp != file.stamp) {
+                    self.incomplete = true;
+                }
+            }
+            Err(i) => {
+                if self.files.len() >= MAX_READ_FILES {
+                    self.incomplete = true;
+                } else {
+                    self.files.insert(i, file);
+                }
+            }
+        }
+    }
+
+    /// Note every file of `other` (whether it is incomplete or unkeyed, and its generation).
+    pub fn extend(&mut self, other: &ReadFiles) {
+        self.incomplete |= other.incomplete;
+        self.unkeyed |= other.unkeyed;
+        if let Some(g) = other.since {
+            self.note_since(g);
+        }
+        for f in &other.files {
+            self.add(f.clone());
+        }
+    }
+
+    /// Some files read may be missing from the list (see [`ReadFiles`]).
+    pub fn mark_incomplete(&mut self) {
+        self.incomplete = true;
+    }
+
+    /// Whether the list names every file read.
+    pub fn is_complete(&self) -> bool {
+        !self.incomplete
+    }
+
+    /// The drop generation the earliest read behind the list started at (`None`: unknown). A
+    /// buffer made of a file dropped after it holds that file as it was before the drop.
+    pub fn since(&self) -> Option<u64> {
+        self.since
+    }
+
+    /// A read behind the list started at drop generation `generation` (the earliest one counts).
+    pub fn note_since(&mut self, generation: u64) {
+        self.since = Some(self.since.map_or(generation, |s| s.min(generation)));
+    }
+
+    /// Made of values a layer cache key doesn't capture (see [`ReadFiles::is_unkeyed`]).
+    pub fn mark_unkeyed(&mut self) {
+        self.unkeyed = true;
+    }
+
+    /// Made of values a layer cache key doesn't capture: kept in memory, never stored on disk as
+    /// a layer buffer. (A frame's key captures them: frame entries are not affected.)
+    pub fn is_unkeyed(&self) -> bool {
+        self.unkeyed
+    }
+
+    /// The files, sorted by path.
+    pub fn files(&self) -> &[ReadFile] {
+        &self.files
+    }
+
+    /// The identity `path` was read with.
+    pub fn get(&self, path: &str) -> Option<FileStamp> {
+        let i = self.files.binary_search_by(|f| (*f.path).cmp(path)).ok()?;
+        self.files.get(i).map(|f| f.stamp)
+    }
+
+    /// The number of files in the list.
+    pub fn len(&self) -> usize {
+        self.files.len()
+    }
+
+    /// Whether the list holds no files.
+    pub fn is_empty(&self) -> bool {
+        self.files.is_empty()
+    }
+}
+
+impl FromIterator<ReadFile> for ReadFiles {
+    /// Collects files into a list, adding each in turn.
+    fn from_iter<I: IntoIterator<Item = ReadFile>>(iter: I) -> Self {
+        let mut out = ReadFiles::default();
+        for f in iter {
+            out.add(f);
+        }
+        out
+    }
+}
+
+/// Collects the files a render reads, from any thread (the layers of a frame render in
+/// parallel).
+#[derive(Debug, Default)]
+pub struct ReadLog {
+    files: Mutex<ReadFiles>,
+}
+
+impl ReadLog {
+    /// An empty read log.
+    pub fn new() -> ReadLog {
+        ReadLog::default()
+    }
+
+    /// An empty read log for reads that start at drop generation `generation` (see
+    /// [`ReadFiles::since`]).
+    pub fn starting_at(generation: u64) -> ReadLog {
+        let mut files = ReadFiles::default();
+        files.note_since(generation);
+        ReadLog { files: Mutex::new(files) }
+    }
+
+    /// Locks the file list, recovering from a poisoned lock.
+    fn lock(&self) -> std::sync::MutexGuard<'_, ReadFiles> {
+        self.files.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// Note a file read.
+    pub fn note(&self, file: ReadFile) {
+        self.lock().add(file);
+    }
+
+    /// Note every file of `files` (and whether it is incomplete).
+    pub fn note_all(&self, files: &ReadFiles) {
+        if files.is_empty() && files.is_complete() && files.since.is_none() && !files.unkeyed {
+            return;
+        }
+        self.lock().extend(files);
+    }
+
+    /// Some files read can't be listed (see [`ReadFiles`]).
+    pub fn mark_incomplete(&self) {
+        self.lock().mark_incomplete();
+    }
+
+    /// What is read is made of values a layer cache key doesn't capture
+    /// ([`ReadFiles::is_unkeyed`]).
+    pub fn mark_unkeyed(&self) {
+        self.lock().mark_unkeyed();
+    }
+
+    /// The files noted so far.
+    pub fn files(&self) -> ReadFiles {
+        self.lock().clone()
+    }
+
+    /// The files noted.
+    pub fn into_files(self) -> ReadFiles {
+        self.files.into_inner().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A native file with the given length for the tests.
+    fn file(path: &str, len: u64) -> ReadFile {
+        ReadFile::new(path, FileStamp::Native { len, modified: Some(7) })
+    }
+
+    #[test]
+    fn files_are_listed_once_sorted_by_path() {
+        let files: ReadFiles = [file("/b", 1), file("/a", 2), file("/b", 1)].into_iter().collect();
+        assert_eq!(files.files().iter().map(|f| &*f.path).collect::<Vec<_>>(), ["/a", "/b"]);
+        assert!(files.is_complete());
+        assert_eq!(files.get("/a"), Some(FileStamp::Native { len: 2, modified: Some(7) }));
+        assert_eq!(files.get("/c"), None);
+    }
+
+    /// A file read twice with different identities changed during the render: the list can't
+    /// vouch for what was made of it.
+    #[test]
+    fn a_file_read_with_two_identities_makes_the_list_incomplete() {
+        let files: ReadFiles = [file("/a", 1), file("/a", 2)].into_iter().collect();
+        assert_eq!(files.len(), 1);
+        assert!(!files.is_complete());
+    }
+
+    /// Modification times keep their full value: before 1970 (not "no time") and past 2554
+    /// (where `u64` nanoseconds end), so two such files never look alike.
+    #[test]
+    fn modification_times_are_kept_whole() {
+        use std::time::{Duration, UNIX_EPOCH};
+        let day = Duration::from_secs(86_400);
+        assert_eq!(epoch_nanos(UNIX_EPOCH), 0);
+        assert_eq!(epoch_nanos(UNIX_EPOCH - day), -86_400_000_000_000);
+        let far = 600 * 365 * day;
+        if let Some(t) = UNIX_EPOCH.checked_add(far) {
+            assert_eq!(epoch_nanos(t), i128::try_from(far.as_nanos()).unwrap());
+        }
+        let dir = std::env::temp_dir().join(format!("effectcraft-stamp-1969-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let (a, b) = (dir.join("a.bin"), dir.join("b.bin"));
+        let mut stamps = vec![];
+        for (p, back) in [(&a, day), (&b, 2 * day)] {
+            std::fs::write(p, b"abc").unwrap();
+            let f = std::fs::File::options().write(true).open(p).unwrap();
+            if f.set_modified(UNIX_EPOCH - back).is_err() {
+                // (a file system that can't store times before 1970)
+                let _ = std::fs::remove_dir_all(&dir);
+                return;
+            }
+            drop(f);
+            stamps.push(FileStamp::native(&p.to_string_lossy()).unwrap());
+        }
+        assert!(matches!(stamps[0], FileStamp::Native { modified: Some(t), .. } if t < 0), "{:?}", stamps[0]);
+        assert_ne!(stamps[0], stamps[1], "two files from before 1970 with the same size");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_list_is_bounded() {
+        let files: ReadFiles = (0..MAX_READ_FILES + 3).map(|i| file(&format!("/f{i:06}"), 1)).collect();
+        assert_eq!(files.len(), MAX_READ_FILES);
+        assert!(!files.is_complete(), "files past the bound make the list incomplete, never silently short");
+    }
+
+    #[test]
+    fn incompleteness_carries_over() {
+        let mut part = ReadFiles::default();
+        part.mark_incomplete();
+        let log = ReadLog::new();
+        log.note(file("/a", 1));
+        log.note_all(&part);
+        let all = log.into_files();
+        assert_eq!(all.len(), 1);
+        assert!(!all.is_complete());
+    }
+}
diff --git a/crates/render/src/shapes.rs b/crates/render/src/shapes.rs
index 2808f283b..df92846ce 100644
--- a/crates/render/src/shapes.rs
+++ b/crates/render/src/shapes.rs
@@ -2,8 +2,8 @@
 //! with the After Effects stacking semantics:
 //!
 //! - path operators (Trim Paths, Round Corners, Offset Paths, Pucker & Bloat, Twist, Zig Zag,
-//!   Wiggle Paths, Merge Paths, Repeater) act on all paths above them in the same group, including
-//!   the paths of nested groups;
+//!   Wiggle Paths, Wiggle Transform, Merge Paths, Repeater) act on all paths above them in the
+//!   same group, including the paths of nested groups;
 //! - paint items (fills, strokes, gradient fills/strokes) paint the paths above them, *as modified
 //!   by every operator in the stack* — a Trim Paths below a Stroke still trims it;
 //! - items higher in the list draw on top;
@@ -17,7 +17,9 @@ use effectcraft_keyframe::{Gradient, Value};
 use effectcraft_path::{BezPath, Cap, FillRule, Join, StrokeStyle, ops, varstroke};
 use effectcraft_project::{Layer, Node, PropGroup};
 use effectcraft_raster::{Image, Mask};
+use effectcraft_text::selectors::{self, Wiggly};
 use rayon::prelude::*;
+use std::collections::{HashMap, HashSet};
 
 use crate::eval::EvalCtx;
 
@@ -185,9 +187,75 @@ fn used_slots(live: &[usize], draws: &[Draw]) -> Vec<usize> {
     v
 }
 
+/// Wiggle Transform: moves the live slots by a random offset of the Transform group's Anchor
+/// Point, Position, Scale and Rotation (the most each one wiggles), changing over time. Its
+/// Wiggles/Second, Correlation, Temporal Phase, Spatial Phase and Random Seed work as the Wiggly
+/// Selector's do, with each Repeater copy (`copy_of`) as one unit: the copies of a Repeater above
+/// the operation move on their own as far as Correlation allows, and the copies of a Repeater
+/// below it move as one. The four transformations of one operation move together.
+fn wiggle_transform(ctx: &EvalCtx, layer: &Layer, g: &PropGroup, arena: &mut [BezPath], live: &[usize], copy_of: &HashMap<usize, usize>, draws: &mut [Draw]) {
+    let Some(tr) = g.sub("transform") else { return };
+    let w = Wiggly {
+        max: 1.0,
+        min: -1.0,
+        wiggles_per_second: ctx.f(layer, g, "speed", 2.0),
+        correlation: ctx.f(layer, g, "correlation", 50.0) / 100.0,
+        temporal_phase: ctx.f(layer, g, "phase", 0.0),
+        spatial_phase: ctx.f(layer, g, "spatialPhase", 0.0),
+        lock_dimensions: false,
+        seed: ctx.f(layer, g, "seed", 0.0).round() as i64 as u64,
+    };
+    let anchor = ctx.v2(layer, tr, "anchor", [0.0; 2]);
+    let pos = ctx.v2(layer, tr, "position", [0.0; 2]);
+    let scale = ctx.v2(layer, tr, "scale", [0.0; 2]);
+    let rot = ctx.f(layer, tr, "rotation", 0.0);
+    let t = layer.layer_time(ctx.time).seconds();
+    let matrix = |k: usize| {
+        let (x, y) = (selectors::wiggly_value(&w, t, k, 0), selectors::wiggly_value(&w, t, k, 1));
+        Mat3::translate(vec2(pos[0] * x, pos[1] * y))
+            * Mat3::rotate_deg(rot * x)
+            * Mat3::scale(vec2(1.0 + scale[0] * x / 100.0, 1.0 + scale[1] * y / 100.0))
+            * Mat3::translate(vec2(-anchor[0] * x, -anchor[1] * y))
+    };
+    let mut by_copy: HashMap<usize, Mat3> = HashMap::new();
+    let mut done: HashSet<usize> = HashSet::new();
+    for &s in live {
+        if !done.insert(s) {
+            continue;
+        }
+        let k = copy_of.get(&s).copied().unwrap_or(0);
+        let m = *by_copy.entry(k).or_insert_with(|| matrix(k));
+        arena[s] = mat_path(&arena[s], &m);
+    }
+    // A paint above the operation whose paths all moved by one matrix moves its gradient and
+    // stroke scale with them, as a group transform does. A paint over copies that moved by
+    // different matrices stays one paint (its fill rule and opacity apply to all of them at once)
+    // and keeps its gradient and stroke scale.
+    for d in draws {
+        let mut ms = d.slots.iter().map(|s| done.contains(s).then(|| by_copy.get(&copy_of.get(s).copied().unwrap_or(0)).copied()).flatten());
+        let Some(Some(m)) = ms.next() else { continue };
+        if ms.all(|x| x == Some(m)) {
+            d.xf = m * d.xf;
+        }
+    }
+}
+
 /// Collect the draws of a contents group and the path slots live at its end (in group space).
 /// `arena` holds every path slot; operators rewrite slots in place.
 fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<BezPath>) -> (Vec<Draw>, Vec<usize>) {
+    collect_in(ctx, layer, contents, arena, &mut Copies::default())
+}
+
+/// The Repeater copy each path slot belongs to, for Wiggle Transform: `of` maps a slot a Repeater
+/// made to its copy's id (slots no Repeater made are copy 0). Ids are unique across the layer's
+/// groups, so copies made in a nested group stay apart in the groups around it.
+#[derive(Default)]
+struct Copies {
+    of: HashMap<usize, usize>,
+    next: usize,
+}
+
+fn collect_in(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<BezPath>, copy_ids: &mut Copies) -> (Vec<Draw>, Vec<usize>) {
     let mut draws: Vec<Draw> = Vec::new();
     let mut live: Vec<usize> = Vec::new();
     let opacity = |g: &PropGroup| (ctx.f(layer, g, "opacity", 100.0) / 100.0) as f32;
@@ -201,7 +269,20 @@ fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<B
             "rect" => {
                 let size = ctx.v2(layer, g, "size", [100.0; 2]);
                 let pos = ctx.v2(layer, g, "position", [0.0; 2]);
-                let p = effectcraft_path::rect(size, pos, ctx.f(layer, g, "roundness", 0.0));
+                let p = if ctx.b(layer, g, "perCorner") {
+                    effectcraft_path::rect_radii(
+                        size,
+                        pos,
+                        [
+                            ctx.f(layer, g, "topLeftRoundness", 0.0),
+                            ctx.f(layer, g, "topRightRoundness", 0.0),
+                            ctx.f(layer, g, "bottomRightRoundness", 0.0),
+                            ctx.f(layer, g, "bottomLeftRoundness", 0.0),
+                        ],
+                    )
+                } else {
+                    effectcraft_path::rect(size, pos, ctx.f(layer, g, "roundness", 0.0))
+                };
                 push_shape(ctx, layer, g, p, arena, &mut live);
             }
             "ellipse" => {
@@ -211,16 +292,16 @@ fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<B
             }
             "star" => {
                 let star = ctx.e(layer, g, "type") == 0;
-                let p = effectcraft_path::polystar(
+                let p = effectcraft_path::polystar(effectcraft_path::Polystar {
                     star,
-                    ctx.f(layer, g, "points", 5.0),
-                    ctx.v2(layer, g, "position", [0.0; 2]),
-                    ctx.f(layer, g, "rotation", 0.0),
-                    ctx.f(layer, g, "innerRadius", 50.0),
-                    ctx.f(layer, g, "outerRadius", 100.0),
-                    ctx.f(layer, g, "innerRoundness", 0.0),
-                    ctx.f(layer, g, "outerRoundness", 0.0),
-                );
+                    points: ctx.f(layer, g, "points", 5.0),
+                    pos: ctx.v2(layer, g, "position", [0.0; 2]),
+                    rotation: ctx.f(layer, g, "rotation", 0.0),
+                    inner: ctx.f(layer, g, "innerRadius", 50.0),
+                    outer: ctx.f(layer, g, "outerRadius", 100.0),
+                    inner_round: ctx.f(layer, g, "innerRoundness", 0.0),
+                    outer_round: ctx.f(layer, g, "outerRoundness", 0.0),
+                });
                 push_shape(ctx, layer, g, p, arena, &mut live);
             }
             "path" => {
@@ -324,11 +405,13 @@ fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<B
                     speed: ctx.f(layer, g, "speed", 2.0),
                     correlation: ctx.f(layer, g, "correlation", 50.0),
                     phase_deg: ctx.f(layer, g, "phase", 0.0),
+                    spatial_phase_deg: ctx.f(layer, g, "spatialPhase", 0.0),
                     seed: ctx.f(layer, g, "seed", 0.0),
                 };
                 let t = layer.layer_time(ctx.time).seconds();
                 apply(arena, &live, |p| ops::wiggle(p, &w, t));
             }
+            "wiggler" => wiggle_transform(ctx, layer, g, arena, &live, &copy_ids.of, &mut draws),
             "merge" => {
                 let mode = ops::MergeMode::from_index(ctx.e(layer, g, "mode"));
                 let input: Vec<BezPath> = live.iter().map(|&i| arena[i].clone()).collect();
@@ -341,7 +424,7 @@ fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<B
             }
             "group" => {
                 let Some(inner) = g.sub("contents") else { continue };
-                let (cd, cl) = collect(ctx, layer, inner, arena);
+                let (cd, cl) = collect_in(ctx, layer, inner, arena, copy_ids);
                 let (m, op) = g.sub("transform").map(|t| group_matrix(ctx, layer, t)).unwrap_or((Mat3::IDENTITY, 1.0));
                 for i in used_slots(&cl, &cd) {
                     arena[i] = mat_path(&arena[i], &m);
@@ -378,12 +461,20 @@ fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<B
                 // Each copy gets its own transformed slots, so operators below the repeater act on
                 // the repeated geometry (copy order: original first).
                 let mut copy_maps: Vec<std::collections::HashMap<usize, usize>> = Vec::with_capacity(n);
+                // Each copy of each earlier copy (a second Repeater) gets an id of its own.
+                let mut ids: HashMap<(usize, usize), usize> = HashMap::new();
                 for i in 0..n {
                     let m = step(i as f64 + offset);
                     let mut map = std::collections::HashMap::new();
                     for &s in &base_slots {
                         arena.push(mat_path(&arena[s], &m));
                         map.insert(s, arena.len() - 1);
+                        let base = copy_ids.of.get(&s).copied().unwrap_or(0);
+                        let id = *ids.entry((i, base)).or_insert_with(|| {
+                            copy_ids.next += 1;
+                            copy_ids.next
+                        });
+                        copy_ids.of.insert(arena.len() - 1, id);
                     }
                     live.extend(base_live.iter().map(|s| map[s]));
                     copy_maps.push(map);
@@ -395,7 +486,10 @@ fn collect(ctx: &EvalCtx, layer: &Layer, contents: &PropGroup, arena: &mut Vec<B
                 }
                 for i in order {
                     let m = step(i as f64 + offset);
-                    let t = if n > 1 { i as f32 / (n - 1) as f32 } else { 0.0 };
+                    // Copy i's opacity moves 1 / Copies of the way from Start to End Opacity per
+                    // copy, so the last copy stops one step short of End Opacity (After Effects
+                    // 2026, case 709: 3 copies, End Opacity 40 give 100 %, 80 %, 60 %).
+                    let t = if copies > 0.0 { (i as f64 / copies) as f32 } else { 0.0 };
                     let opk = so + (eo - so) * t;
                     let partial = if i + 1 == n && copies.fract() > 0.0 { copies.fract() as f32 } else { 1.0 };
                     for d in &base_draws {
diff --git a/crates/render/src/shapes/tests.rs b/crates/render/src/shapes/tests.rs
index 1dbf67a7a..ba7028a25 100644
--- a/crates/render/src/shapes/tests.rs
+++ b/crates/render/src/shapes/tests.rs
@@ -150,6 +150,28 @@ fn operators_below_repeater_act_on_copies() {
     assert!((coverage(&img) - 3.0 * 24.0 * 24.0).abs() < 30.0, "{}", coverage(&img));
 }
 
+/// After Effects 2026 (case 709): a 400 × 200 rectangle with Fill, then a Repeater of 3 copies
+/// (Position 150, 60, Rotation 10, Scale 90 / 80, End Opacity 40) gives the copies 100 %, 80 %
+/// and 60 % opacity (EffectCraft gave 70 % and 40 %). The points are comp pixels where AE shows
+/// only the last copy, only the middle one, and both.
+#[test]
+fn repeater_copy_opacity_matches_after_effects() {
+    let (p, cid) = shape_comp_sized(1920, 1080, |ids| {
+        let mut rep = build::shape_repeater(ids, 3.0, [150.0, 60.0]);
+        set(&mut rep, "transform/rotation", Value::Scalar(10.0));
+        set(&mut rep, "transform/scale", Value::Vec2([90.0, 80.0]));
+        set(&mut rep, "transform/endOpacity", Value::Scalar(40.0));
+        let items = vec![build::shape_rect(ids, [400.0, 200.0], [0.0, 0.0], 0.0), build::shape_fill(ids, [0.0, 1.0, 0.0, 1.0]), rep];
+        vec![build::shape_group(ids, "Group 1", items)]
+    });
+    let img = frame(&p, cid);
+    // AE's green over its red layer, 153, 153, 204, 235 and 255 of 255.
+    for (x, y, want) in [(1360, 700, 0.6), (1300, 620, 0.6), (1220, 560, 0.8), (1180, 630, 0.92), (1100, 600, 1.0)] {
+        let a = alpha(&img, x, y);
+        assert!((a - want).abs() < 2.0 / 255.0, "({x}, {y}): {a} vs AE {want}");
+    }
+}
+
 #[test]
 fn repeater_then_merge_unites_copies() {
     let (p, cid) = shape_comp(|ids| {
@@ -258,6 +280,24 @@ fn round_corners_clip_corner_pixels() {
     assert!((coverage(&img) - std::f32::consts::PI * 400.0).abs() < 15.0, "{}", coverage(&img));
 }
 
+/// Wiggle Paths' Spatial Phase changes the drawn shape; a whole turn draws it as at 0°.
+#[test]
+fn wiggle_paths_spatial_phase_renders() {
+    let render = |phase: f64| {
+        let (p, cid) = shape_comp(|ids| {
+            vec![
+                build::shape_ellipse(ids, [60.0, 60.0], [0.0, 0.0]),
+                op(ids, "wiggle", &[("size", Value::Scalar(8.0)), ("correlation", Value::Scalar(0.0)), ("spatialPhase", Value::Scalar(phase))]),
+                build::shape_fill(ids, RED),
+            ]
+        });
+        render_frame(&p, cid, Tick::from_seconds_f64(0.5), 1.0).data
+    };
+    let zero = render(0.0);
+    assert!(render(90.0) != zero, "Spatial Phase 90° draws the shape of 0°");
+    assert!(render(360.0) == zero, "Spatial Phase 360° draws another shape than 0°");
+}
+
 #[test]
 fn wiggle_paths_vary_over_time_deterministically() {
     let (p, cid) = shape_comp(|ids| {
@@ -270,6 +310,202 @@ fn wiggle_paths_vary_over_time_deterministically() {
     assert_ne!(a.data, c.data);
 }
 
+/// Alpha-weighted centroid of the pixels in columns `x0..x1`.
+fn centroid(img: &Image, x0: i64, x1: i64) -> [f32; 2] {
+    let (mut sx, mut sy, mut sa) = (0.0, 0.0, 0.0);
+    for x in x0..x1 {
+        for y in 0..img.height as i64 {
+            let a = alpha(img, x, y);
+            sx += a * x as f32;
+            sy += a * y as f32;
+            sa += a;
+        }
+    }
+    [sx / sa, sy / sa]
+}
+
+fn wiggle_transform(ids: &mut Ids, params: &[(&str, Value)]) -> PropGroup {
+    op(ids, "wiggler", params)
+}
+
+#[test]
+fn wiggle_transform_moves_paths_over_time() {
+    let run = |position: [f64; 2], t: f64| {
+        let (p, cid) = shape_comp(|ids| {
+            let w = wiggle_transform(ids, &[("transform/position", Value::Vec2(position))]);
+            vec![build::shape_rect(ids, [20.0, 20.0], [0.0, 0.0], 0.0), w, build::shape_fill(ids, RED)]
+        });
+        render_frame(&p, cid, Tick::from_seconds_f64(t), 1.0)
+    };
+    // The defaults wiggle nothing: the square stays centered on pixel 99.5, 49.5.
+    let rest = [99.5, 49.5];
+    assert_eq!(centroid(&run([0.0, 0.0], 0.37), 0, 200), rest);
+    let a = run([15.0, 15.0], 0.37);
+    assert_eq!(a.data, run([15.0, 15.0], 0.37).data, "the same time gives the same frame");
+    let b = run([15.0, 15.0], 1.21);
+    let (ca, cb) = (centroid(&a, 0, 200), centroid(&b, 0, 200));
+    assert!(ca != rest && ca != cb, "{ca:?} {cb:?}");
+    for c in [ca, cb] {
+        assert!((c[0] - rest[0]).abs() <= 15.01 && (c[1] - rest[1]).abs() <= 15.01, "{c:?}");
+    }
+    // A translation keeps the square's area.
+    assert!((coverage(&a) - 400.0).abs() < 1.0, "{}", coverage(&a));
+    // The layer cache keys a layer with a Wiggle Transform by time.
+    let (p, cid) = shape_comp(|ids| vec![build::shape_rect(ids, [20.0, 20.0], [0.0, 0.0], 0.0), wiggle_transform(ids, &[]), build::shape_fill(ids, RED)]);
+    let comp = p.comp(cid).unwrap();
+    let key = |t: f64| crate::cache::layer_key(&crate::eval::EvalCtx::new(&p, cid, comp, Tick::from_seconds_f64(t)), &comp.layers[0], 1.0, false, false);
+    assert_ne!(key(0.37), key(1.21));
+}
+
+#[test]
+fn wiggle_transform_scales_and_rotates() {
+    let run = |params: &[(&str, Value)]| {
+        let (p, cid) = shape_comp(|ids| {
+            let w = wiggle_transform(ids, params);
+            vec![build::shape_rect(ids, [40.0, 40.0], [0.0, 0.0], 0.0), w, build::shape_fill(ids, RED)]
+        });
+        render_frame(&p, cid, Tick::from_seconds_f64(0.37), 1.0)
+    };
+    let scaled = coverage(&run(&[("transform/scale", Value::Vec2([50.0, 50.0]))]));
+    assert!((scaled - 1600.0).abs() > 20.0, "{scaled}");
+    let rotated = run(&[("transform/rotation", Value::Scalar(45.0))]);
+    assert!((coverage(&rotated) - 1600.0).abs() < 2.0, "{}", coverage(&rotated));
+    assert!(alpha(&rotated, 81, 31) < 0.5 || alpha(&rotated, 119, 31) < 0.5, "a corner turned away");
+}
+
+/// A gradient above a Wiggle Transform moves with the paths it paints, as under a group transform.
+#[test]
+fn wiggle_transform_moves_the_gradient_with_the_path() {
+    let (p, cid) = shape_comp(|ids| {
+        let g = Gradient { colors: vec![(0.0, [0.0, 0.0, 0.0, 1.0]), (1.0, [1.0, 1.0, 1.0, 1.0])], opacities: vec![(0.0, 1.0), (1.0, 1.0)] };
+        vec![
+            build::shape_rect(ids, [40.0, 40.0], [0.0, 0.0], 0.0),
+            build::shape_gradient_fill(ids, false, [-20.0, 0.0], [20.0, 0.0], g),
+            wiggle_transform(ids, &[("transform/position", Value::Vec2([60.0, 0.0]))]),
+        ]
+    });
+    let img = render_frame(&p, cid, Tick::from_seconds_f64(0.37), 1.0);
+    let cols: Vec<i64> = (0..200).filter(|&x| alpha(&img, x, 50) > 0.99).collect();
+    let (l, r) = (cols[0], cols[cols.len() - 1]);
+    assert!((l - 80).abs() > 3, "the square moved: {l}");
+    let (cl, cr) = (img.get(l, 50), img.get(r, 50));
+    assert!(cl[0] < 0.1 && cr[0] > 0.9, "the ramp runs edge to edge: {cl:?} {cr:?}");
+}
+
+/// A gradient that paints every copy of a Repeater moves with the copies when they wiggle alike
+/// (Correlation 100).
+#[test]
+fn wiggle_transform_moves_a_gradient_shared_by_repeater_copies() {
+    let (p, cid) = shape_comp(|ids| {
+        let g = Gradient { colors: vec![(0.0, [0.0, 0.0, 0.0, 1.0]), (1.0, [1.0, 1.0, 1.0, 1.0])], opacities: vec![(0.0, 1.0), (1.0, 1.0)] };
+        vec![
+            build::shape_rect(ids, [20.0, 20.0], [-60.0, 0.0], 0.0),
+            build::shape_repeater(ids, 3.0, [60.0, 0.0]),
+            build::shape_gradient_fill(ids, false, [0.0, -10.0], [0.0, 10.0], g),
+            wiggle_transform(ids, &[("correlation", Value::Scalar(100.0)), ("transform/position", Value::Vec2([0.0, 15.0]))]),
+        ]
+    });
+    let img = render_frame(&p, cid, Tick::from_seconds_f64(0.9), 1.0);
+    for cx in [40, 100, 160] {
+        let rows: Vec<i64> = (0..100).filter(|&y| alpha(&img, cx, y) > 0.99).collect();
+        let (t, b) = (rows[0], rows[rows.len() - 1]);
+        assert!((t - 40).abs() > 3, "copy at {cx} moved: {t}");
+        let (ct, cb) = (img.get(cx, t), img.get(cx, b));
+        assert!(ct[0] < 0.1 && cb[0] > 0.9, "copy at {cx}: {ct:?} {cb:?}");
+    }
+}
+
+/// A gradient over copies that wiggle on their own keeps its place: every copy shows the ramp's
+/// middle at the group's origin row.
+#[test]
+fn wiggle_transform_keeps_a_gradient_over_copies_wiggling_apart() {
+    let (p, cid) = shape_comp(|ids| {
+        let g = Gradient { colors: vec![(0.0, [0.0, 0.0, 0.0, 1.0]), (1.0, [1.0, 1.0, 1.0, 1.0])], opacities: vec![(0.0, 1.0), (1.0, 1.0)] };
+        vec![
+            build::shape_rect(ids, [20.0, 40.0], [-60.0, 0.0], 0.0),
+            build::shape_repeater(ids, 3.0, [60.0, 0.0]),
+            build::shape_gradient_fill(ids, false, [0.0, -20.0], [0.0, 20.0], g),
+            wiggle_transform(ids, &[("correlation", Value::Scalar(0.0)), ("transform/position", Value::Vec2([0.0, 15.0]))]),
+        ]
+    });
+    let img = render_frame(&p, cid, Tick::from_seconds_f64(0.9), 1.0);
+    for cx in [40, 100, 160] {
+        let c = img.get(cx, 50);
+        assert!(c[3] > 0.99 && (c[0] - 0.5).abs() < 0.05, "copy at {cx}: {c:?}");
+    }
+}
+
+/// Copies wiggling on their own under one 50 % fill stay one paint: where they overlap, the fill
+/// covers them once.
+#[test]
+fn wiggle_transform_keeps_one_fill_over_overlapping_copies() {
+    let (p, cid) = shape_comp(|ids| {
+        let mut fill = build::shape_fill(ids, RED);
+        set(&mut fill, "opacity", Value::Scalar(50.0));
+        vec![
+            build::shape_rect(ids, [40.0, 40.0], [-20.0, 0.0], 0.0),
+            build::shape_repeater(ids, 3.0, [20.0, 0.0]),
+            fill,
+            wiggle_transform(ids, &[("correlation", Value::Scalar(0.0)), ("transform/position", Value::Vec2([0.0, 15.0]))]),
+        ]
+    });
+    let img = render_frame(&p, cid, Tick::from_seconds_f64(0.9), 1.0);
+    let top = img.data.iter().map(|px| px[3]).fold(0.0f32, f32::max);
+    assert!((top - 0.5).abs() < 0.01, "{top}");
+}
+
+/// A long stack of Repeaters, each cleared by a zero-copy Repeater, still renders the last Repeater's copies.
+#[test]
+fn long_repeater_stack_with_cleared_copies_renders() {
+    let (p, cid) = shape_comp(|ids| {
+        let mut items = vec![];
+        for _ in 0..70 {
+            items.push(build::shape_rect(ids, [20.0, 20.0], [0.0, 0.0], 0.0));
+            items.push(build::shape_repeater(ids, 3.0, [10.0, 0.0]));
+            items.push(build::shape_repeater(ids, 0.0, [10.0, 0.0]));
+        }
+        items.push(build::shape_rect(ids, [20.0, 20.0], [0.0, 0.0], 0.0));
+        items.push(build::shape_repeater(ids, 3.0, [30.0, 0.0]));
+        items.push(wiggle_transform(ids, &[("correlation", Value::Scalar(0.0)), ("transform/position", Value::Vec2([0.0, 15.0]))]));
+        items.push(build::shape_fill(ids, RED));
+        items
+    });
+    let img = render_frame(&p, cid, Tick::from_seconds_f64(0.37), 1.0);
+    assert!((coverage(&img) - 1200.0).abs() < 2.0, "{}", coverage(&img));
+}
+
+/// Copies a Repeater makes above a Wiggle Transform wiggle on their own (Correlation 0) or as one
+/// (Correlation 100); with the Wiggle Transform above the Repeater every copy wiggles the same.
+#[test]
+fn wiggle_transform_and_repeater_order() {
+    let offsets = |wiggle_first: bool, correlation: f64| {
+        let (p, cid) = shape_comp(|ids| {
+            let rect = build::shape_rect(ids, [20.0, 20.0], [-60.0, 0.0], 0.0);
+            let rep = build::shape_repeater(ids, 3.0, [60.0, 0.0]);
+            let w = wiggle_transform(ids, &[("correlation", Value::Scalar(correlation)), ("transform/position", Value::Vec2([0.0, 15.0]))]);
+            let fill = build::shape_fill(ids, RED);
+            if wiggle_first { vec![rect, w, rep, fill] } else { vec![rect, rep, w, fill] }
+        });
+        let img = render_frame(&p, cid, Tick::from_seconds_f64(0.37), 1.0);
+        [(0, 70), (70, 130), (130, 200)].map(|(x0, x1)| centroid(&img, x0, x1)[1] - 50.0)
+    };
+    let own = offsets(false, 0.0);
+    assert!((own[0] - own[1]).abs() > 0.5 || (own[1] - own[2]).abs() > 0.5, "copies wiggle on their own: {own:?}");
+    // A Repeater inside a group above the Wiggle Transform: its copies still wiggle on their own.
+    let (p, cid) = shape_comp(|ids| {
+        let inner = vec![build::shape_rect(ids, [20.0, 20.0], [-60.0, 0.0], 0.0), build::shape_repeater(ids, 3.0, [60.0, 0.0]), build::shape_fill(ids, RED)];
+        let group = build::shape_group(ids, "Repeated", inner);
+        vec![group, wiggle_transform(ids, &[("correlation", Value::Scalar(0.0)), ("transform/position", Value::Vec2([0.0, 15.0]))])]
+    });
+    let img = render_frame(&p, cid, Tick::from_seconds_f64(0.37), 1.0);
+    let nested = [(0, 70), (70, 130), (130, 200)].map(|(x0, x1)| centroid(&img, x0, x1)[1] - 50.0);
+    assert!((nested[0] - nested[1]).abs() > 0.5 || (nested[1] - nested[2]).abs() > 0.5, "nested copies: {nested:?}");
+    for same in [offsets(false, 100.0), offsets(true, 0.0)] {
+        assert!(same[0].abs() > 0.5, "{same:?}");
+        assert!((same[0] - same[1]).abs() < 0.05 && (same[1] - same[2]).abs() < 0.05, "copies wiggle as one: {same:?}");
+    }
+}
+
 #[test]
 fn zigzag_and_twist_render() {
     let (p, cid) = shape_comp(|ids| {
@@ -479,3 +715,33 @@ fn miter_corner_still_fits_its_buffer() {
     let b = shape_buf(&p, cid);
     assert!(b.img.height as f64 >= 50.0 + 20.0 * 4.0 * 0.5, "{}", b.img.height);
 }
+
+#[test]
+fn rect_per_corner_roundness_rounds_the_named_corners() {
+    let render = |per_corner: bool, radii: [f64; 4], roundness: f64| {
+        let (p, cid) = shape_comp_sized(200, 100, move |ids| {
+            let mut g = build::shape_rect(ids, [100.0, 100.0], [0.0, 0.0], roundness);
+            g.prop_mut("perCorner").unwrap().value = Value::Bool(per_corner);
+            for (m, v) in
+                [("topLeftRoundness", radii[0]), ("topRightRoundness", radii[1]), ("bottomRightRoundness", radii[2]), ("bottomLeftRoundness", radii[3])]
+            {
+                g.prop_mut(m).unwrap().value = Value::Scalar(v);
+            }
+            vec![g, build::shape_fill(ids, RED)]
+        });
+        frame(&p, cid)
+    };
+    // Only the top-left corner rounds: its corner pixels fade, the other three stay filled.
+    let img = render(true, [30.0, 0.0, 0.0, 0.0], 0.0);
+    assert!(alpha(&img, 52, 2) < 0.1, "top-left rounds: {}", alpha(&img, 52, 2));
+    for (x, y) in [(148, 2), (148, 98), (52, 98)] {
+        assert!(alpha(&img, x, y) > 0.9, "({x},{y}) stays square: {}", alpha(&img, x, y));
+    }
+    // The checkbox off ignores the four values (the single Roundness still rules).
+    let off = render(false, [30.0; 4], 0.0);
+    assert!((coverage(&off) - 100.0 * 100.0).abs() < 20.0, "{}", coverage(&off));
+    // Four equal per-corner radii render like the same Roundness.
+    let per = render(true, [25.0; 4], 0.0);
+    let uni = render(false, [0.0; 4], 25.0);
+    assert!((coverage(&per) - coverage(&uni)).abs() < 5.0, "{} vs {}", coverage(&per), coverage(&uni));
+}
diff --git a/crates/render/src/tests.rs b/crates/render/src/tests.rs
index 72dd26507..e507a1504 100644
--- a/crates/render/src/tests.rs
+++ b/crates/render/src/tests.rs
@@ -6,6 +6,27 @@ use effectcraft_time::{FrameRate, Tick};
 
 use crate::render_frame;
 
+mod audio_fx;
+mod auto;
+mod aux_channels;
+mod collapse;
+mod color;
+mod footage_size;
+mod frame_blend;
+mod guides;
+mod mask_blur;
+mod mask_expansion;
+mod mask_feather;
+mod motion_tile;
+mod nested;
+mod paint;
+mod raster_clip;
+mod remap;
+mod roi;
+mod stretch_limits;
+mod styles;
+mod time;
+
 fn setup() -> (Project, ItemId, Comp) {
     let mut p = Project::default();
     // Exact float maths; 8/16 bpc quantisation has its own tests (tests_color).
@@ -187,6 +208,32 @@ fn track_matte_limits_an_adjustment_layer() {
     }
 }
 
+/// An adjustment layer's blend mode blends the adjusted comp onto the comp below, inside its
+/// footprint: with no effects, Screen screens a 0.25 grey with itself, Multiply darkens it,
+/// Normal leaves it, and Opacity mixes toward the result (#2618).
+#[test]
+fn adjustment_layer_blends_in_its_mode() {
+    for (mode, opacity, want) in
+        [(BlendMode::Normal, 100.0, 0.25), (BlendMode::Screen, 100.0, 0.4375), (BlendMode::Multiply, 100.0, 0.0625), (BlendMode::Screen, 50.0, 0.34375)]
+    {
+        let (mut p, cid, comp) = setup();
+        let mut adj = solid(&mut p, &comp, [1.0, 1.0, 1.0], 100, 100);
+        adj.props.prop_mut("transform/position").unwrap().value = Value::Vec3([50.0, 50.0, 0.0]);
+        adj.props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(opacity);
+        adj.switches.adjustment = true;
+        adj.blend_mode = mode;
+        let bg = solid(&mut p, &comp, [0.25, 0.25, 0.25], 200, 100);
+        let c = p.comp_mut(cid).unwrap();
+        c.layers.push(adj);
+        c.layers.push(bg);
+        let img = render_frame(&p, cid, Tick::ZERO, 1.0);
+        let (inside, outside) = (img.get(50, 50), img.get(150, 50));
+        assert!((inside[0] - want).abs() < 1e-4, "{mode:?} {opacity}: {inside:?}");
+        assert!((outside[0] - 0.25).abs() < 1e-4, "{mode:?} {opacity}: outside the footprint {outside:?}");
+        assert_eq!(inside[3], 1.0, "{mode:?} keeps the comp opaque");
+    }
+}
+
 #[test]
 fn shape_layer_draws_fill_and_stroke() {
     let (mut p, cid, comp) = setup();
@@ -254,6 +301,22 @@ fn effects_run_in_pipeline() {
     assert!(c[1] > 0.99 && c[0] < 0.01, "{c:?}");
 }
 
+/// After Effects 2026, sRGB working space (not linearised), Tint at its defaults on full-frame
+/// solids: the effect sees the encoded solid colour and weights it Rec. 601.
+#[test]
+fn tint_in_an_srgb_working_space_matches_after_effects_greys() {
+    for (col, want) in [([1.0, 0.0, 0.0], 76.0), ([0.0, 1.0, 0.0], 150.0), ([0.0, 0.0, 1.0], 29.0), ([0.5, 0.5, 0.5], 128.0)] {
+        let (mut p, cid, comp) = setup();
+        p.settings.working_space = Some(effectcraft_color::ColorSpace::Srgb);
+        let mut l = solid(&mut p, &comp, col, 200, 100);
+        add_effect(&mut p, &mut l, "ec.color.tint", [200.0, 100.0], &[]);
+        p.comp_mut(cid).unwrap().layers.push(l);
+        let o = render_frame(&p, cid, Tick::ZERO, 1.0).get(100, 50);
+        let want = want / 255.0;
+        assert!(o[..3].iter().all(|v| (v - want).abs() <= 1.0 / 255.0), "{col:?}: {o:?} vs {want}");
+    }
+}
+
 /// Card Dance's Comp Camera through the default comp camera reproduces a 2D layer in place.
 #[test]
 fn card_dance_comp_camera_matches_the_default_view() {
@@ -267,7 +330,7 @@ fn card_dance_comp_camera_matches_the_default_view() {
     assert!(img.get(10, 50)[3] < 0.01);
 }
 
-/// A black 2D solid with CC Particle World, under a camera layer panned right by `pan` px.
+/// A black 2D solid with Particle Emitter 3D, under a camera layer panned right by `pan` px.
 fn particle_world_scene(pan: f64) -> (Project, ItemId) {
     let (mut p, cid, comp) = setup();
     let mut l = solid(&mut p, &comp, [0.0, 0.0, 0.0], 200, 100);
@@ -279,7 +342,7 @@ fn particle_world_scene(pan: f64) -> (Project, ItemId) {
         let Value::Vec3(v) = pr.value else { panic!("{path}: {:?}", pr.value) };
         pr.value = Value::Vec3([v[0] + pan, v[1], v[2]]);
     }
-    p.comp_mut(cid).unwrap().layers = vec![cam, l];
+    p.comp_mut(cid).unwrap().layers = vec![cam, l].into();
     (p, cid)
 }
 
@@ -297,7 +360,7 @@ fn particles_x(img: &crate::Image) -> f32 {
     sx / m
 }
 
-/// #397: CC Particle World on a 2D layer is seen through the comp's camera layer, and the layer
+/// #397: Particle Emitter 3D on a 2D layer is seen through the comp's camera layer, and the layer
 /// cache notices the camera moving.
 #[test]
 fn particle_world_follows_the_comp_camera() {
@@ -312,6 +375,347 @@ fn particle_world_follows_the_comp_camera() {
     assert!(b < a - 20.0, "panning the camera right moves the particles left: {a} -> {b}");
 }
 
+/// A black solid with Particle Emitter 3D whose Birth Rate is 3 until layer time `cut`, then 0 a
+/// frame later (`None`: 3 throughout); the layer starts at comp time `start`, stretched `stretch` %.
+fn burst_scene(cut: Option<f64>, start: f64, stretch: f64) -> (Project, ItemId) {
+    burst_scene_keys(cut, start, stretch, false)
+}
+
+/// [`burst_scene`]; `hold`: Hold keys, 3 until `cut` and 0 from `cut` exactly.
+fn burst_scene_keys(cut: Option<f64>, start: f64, stretch: f64, hold: bool) -> (Project, ItemId) {
+    let (mut p, cid, comp) = setup();
+    let mut l = solid(&mut p, &comp, [0.0, 0.0, 0.0], 200, 100);
+    let vals = [("birthRate", Value::Scalar(3.0)), ("longevity", Value::Scalar(1.0)), ("particle/particleType", Value::Enum(2))];
+    add_effect(&mut p, &mut l, "ec.sim.ccparticleworld", [200.0, 100.0], &vals);
+    if let Some(cut) = cut {
+        let fx = l.props.sub_mut("effects").unwrap().children.iter_mut().find_map(|c| match c {
+            effectcraft_project::Node::Group(g) => Some(g),
+            _ => None,
+        });
+        let fx = fx.unwrap();
+        let rate = fx.prop_mut("birthRate").unwrap();
+        let key = |t: f64, v: f64| Keyframe::new(Tick::from_seconds_f64(t), Value::Scalar(v));
+        rate.keys = if hold { vec![key(0.0, 3.0).hold(), key(cut, 0.0).hold()] } else { vec![key(0.0, 3.0), key(cut, 3.0), key(cut + 1.0 / 30.0, 0.0)] };
+    }
+    l.start_time = Tick::from_seconds_f64(start);
+    l.in_point = l.start_time;
+    l.out_point = Tick::from_seconds_f64(4.0);
+    l.stretch = stretch;
+    p.comp_mut(cid).unwrap().layers = vec![l].into();
+    (p, cid)
+}
+
+/// Total light in a frame.
+fn light(img: &crate::Image) -> f32 {
+    img.data.iter().map(|p| p[0] + p[1] + p[2]).sum()
+}
+
+/// #1373: a Birth Rate keyed down to 0 stops new births; the particles already born live on
+/// until their Longevity runs out (they vanished the frame the rate reached 0).
+#[test]
+fn particle_world_keeps_a_burst_after_birth_rate_drops_to_zero() {
+    let (keyed, cid) = burst_scene(Some(0.5), 0.0, 100.0);
+    let (constant, _) = burst_scene(None, 0.0, 100.0);
+    let at = Tick::from_seconds_f64;
+    assert_same(&render_cached(&keyed, cid, at(0.4), None), &render_cached(&constant, cid, at(0.4), None), "during the burst");
+    let (k, c) = (light(&render_cached(&keyed, cid, at(0.9), None)), light(&render_cached(&constant, cid, at(0.9), None)));
+    assert!(k > 1.0 && k < c, "the burst is still drawn, with no new births: {k} vs {c}");
+    // Longevity 1 s (± 20 %): gone by 1.9 s.
+    assert_eq!(light(&render_cached(&keyed, cid, at(1.9), None)), 0.0);
+}
+
+/// The burst's history: moving an earlier key changes a later frame whose Birth Rate is the
+/// same (0), cached or not, and offset or stretched layers sample their own layer times.
+#[test]
+fn particle_world_birth_rate_history_with_the_layer_cache_and_time_mapping() {
+    let at = Tick::from_seconds_f64;
+    let (long, cid) = burst_scene(Some(0.5), 0.0, 100.0);
+    let (short, _) = burst_scene(Some(0.25), 0.0, 100.0);
+    let cache = crate::LayerCache::default();
+    let a = render_cached(&long, cid, at(0.9), Some(&cache));
+    let b = render_cached(&short, cid, at(0.9), Some(&cache));
+    assert_same(&b, &render_cached(&short, cid, at(0.9), None), "cached render after an earlier key moved");
+    assert!(light(&b) > 1.0 && light(&b) < light(&a), "a shorter burst: {} vs {}", light(&b), light(&a));
+    let plain = render_cached(&long, cid, at(0.9), None);
+    let (late, _) = burst_scene(Some(0.5), 0.5, 100.0);
+    assert_same(&render_cached(&late, cid, at(1.4), None), &plain, "a layer starting at 0.5 s");
+    let (slow, _) = burst_scene(Some(0.5), 0.0, 200.0);
+    assert_same(&render_cached(&slow, cid, at(1.8), None), &plain, "a layer stretched 200 %");
+}
+
+/// The Birth Rate history is read at exact layer times: under a fractional stretch, mapping a
+/// layer time to comp time and back rounds down a tick, so a Hold cut at 0.5 s read its
+/// previous value at the step starting there (six extra births).
+#[test]
+fn particle_world_reads_a_hold_cut_at_its_exact_layer_time_under_any_stretch() {
+    use crate::{EffectHost, FxHost, NoFootage, RenderOpts, Renderer};
+    let plain = {
+        let (p, cid) = burst_scene_keys(Some(0.5), 0.0, 100.0, true);
+        render_cached(&p, cid, Tick::from_seconds_f64(0.9), None)
+    };
+    assert!(light(&plain) > 1.0, "the burst is drawn");
+    for stretch in [33.3, 133.33, 200.0] {
+        let (p, cid) = burst_scene_keys(Some(0.5), 0.0, stretch, true);
+        let c = p.comp(cid).unwrap();
+        let l = &c.layers[0];
+        let ctx = crate::eval::EvalCtx::new(&p, cid, c, Tick::ZERO);
+        let renderer = Renderer::new(&p, &NoFootage, RenderOpts::default());
+        let host = FxHost { r: &renderer, ctx: &ctx, layer: l, origin: [0.0; 2], index: Default::default(), original: None };
+        let rate = |t: f64| host.param_at(0, "birthRate", t).unwrap().as_f64();
+        assert_eq!((rate(0.5 - 1.0 / 60.0), rate(0.5)), (3.0, 0.0), "stretch {stretch} %");
+        assert!(!host.param_is_static(0, "birthRate"));
+        let t = l.comp_time(Tick::from_seconds_f64(0.9));
+        assert_same(&render_cached(&p, cid, t, None), &plain, &format!("stretch {stretch} %"));
+    }
+}
+
+/// An expression that reads a Controller layer's Opacity (÷ 25) before layer time 0.5 s and is
+/// 0 after (a stand-in for the expression engine).
+struct ControllerRate;
+
+impl crate::eval::ExprHost for ControllerRate {
+    fn eval(&self, ctx: &crate::eval::EvalCtx, layer: &effectcraft_project::Layer, _: &effectcraft_project::Property, _: &Value) -> Result<Value, String> {
+        if layer.layer_time(ctx.time).seconds() >= 0.5 {
+            return Ok(Value::Scalar(0.0));
+        }
+        let c = ctx.comp.layers.iter().find(|l| l.name == "Controller").ok_or("no controller")?;
+        let opacity = c.props.prop("transform/opacity").ok_or("no opacity")?;
+        Ok(Value::Scalar(ctx.value(c, opacity).as_f64() / 25.0))
+    }
+}
+
+/// An expression that reads a file (as `sampleImage` does, into [`EvalCtx::reads`]) and keeps
+/// the value.
+///
+/// [`EvalCtx::reads`]: crate::eval::EvalCtx::reads
+struct ReadsAFile;
+
+impl crate::eval::ExprHost for ReadsAFile {
+    fn eval(&self, ctx: &crate::eval::EvalCtx, _: &effectcraft_project::Layer, _: &effectcraft_project::Property, value: &Value) -> Result<Value, String> {
+        if let Some(log) = ctx.reads {
+            log.note(crate::reads::ReadFile::new("/sampled.png", crate::reads::FileStamp::Native { len: 3, modified: Some(1) }));
+        }
+        Ok(value.clone())
+    }
+}
+
+/// What expressions read while a cached buffer is made (a mask expression, which mask motion
+/// blur also runs at shutter times the cache key doesn't see) goes to that buffer's files, not
+/// only to the frame's (#3184): a later render served the buffer lists the file too. Content,
+/// a Time effect's input and an adjustment layer's footprint.
+#[test]
+fn what_expressions_read_goes_to_the_files_of_the_buffer_they_make() {
+    use crate::reads::ReadLog;
+    use crate::{NoFootage, RenderOpts, Renderer};
+    let (mut p, cid, comp) = setup();
+    for adjustment in [false, true] {
+        let mut l = solid(&mut p, &comp, [1.0, 1.0, 1.0], 200, 100);
+        l.switches.adjustment = adjustment;
+        let mut next = p.next_id;
+        let m = build::mask(&mut Ids(&mut next), "Mask 1", ShapePath::rect([50.0, 50.0], 40.0, 40.0), MaskMode::Add, [255, 255, 0]);
+        p.next_id = next;
+        l.props.sub_mut("masks").unwrap().children.push(m.into());
+        l.props.prop_mut("masks/#1/path").unwrap().expr = Some(effectcraft_project::Expression { text: "sampled".into(), enabled: true });
+        p.comp_mut(cid).unwrap().layers.push(l);
+    }
+    let cache = crate::LayerCache::default();
+    let c = p.comp(cid).unwrap();
+    let (content, adjustment) = (&c.layers[0], &c.layers[1]);
+    // `make`, rendered once with the expressions (the files go to `log`) and then served from
+    // the cache to a render without them: the files that render lists.
+    let files_served = |what: &str, make: &dyn Fn(&Renderer, &crate::eval::EvalCtx) -> bool| {
+        let log = ReadLog::new();
+        let mut r = Renderer::new(&p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&ReadsAFile);
+        r.cache = Some(&cache);
+        r.reads = Some(&log);
+        assert!(make(&r, &r.ctx(cid, c, Tick::ZERO)), "{what}");
+        assert!(log.files().get("/sampled.png").is_some(), "{what}: the frame lists the file");
+        let hits = cache.stats().hits;
+        let served = ReadLog::new();
+        r.expr = None;
+        r.reads = Some(&served);
+        assert!(make(&r, &r.ctx(cid, c, Tick::ZERO)), "{what}");
+        assert!(cache.stats().hits > hits, "{what}: served from the cache");
+        served.into_files()
+    };
+    let files = files_served("content", &|r, ctx| r.content_buf(ctx, content).is_some());
+    assert!(files.get("/sampled.png").is_some(), "content: {files:?}");
+    let files = files_served("input", &|r, ctx| r.layer_input(ctx, content, 0).is_some());
+    assert!(files.get("/sampled.png").is_some(), "input: {files:?}");
+    let files = files_served("footprint", &|r, ctx| r.adjustment_footprint(ctx, adjustment).is_some());
+    assert!(files.get("/sampled.png").is_some(), "footprint: {files:?}");
+}
+
+/// A text Expression Selector whose Amount is 0 for the first character and the width of the
+/// footage item named `ref.png` for the others (`textIndex == 1 ? 0 : footage("ref.png").width`).
+struct WidthOfRef;
+
+impl crate::eval::ExprHost for WidthOfRef {
+    fn eval(&self, _: &crate::eval::EvalCtx, _: &effectcraft_project::Layer, _: &effectcraft_project::Property, value: &Value) -> Result<Value, String> {
+        Ok(value.clone())
+    }
+    fn eval_text_selector(
+        &self,
+        ctx: &crate::eval::EvalCtx,
+        _: &effectcraft_project::Layer,
+        _: &effectcraft_project::Property,
+        index: usize,
+        _: usize,
+        _: [f64; 3],
+    ) -> Result<[f64; 3], String> {
+        let width = ctx.project.items.values().find(|i| i.name == "ref.png").and_then(|i| i.dimensions()).map_or(0.0, |d| d.0 as f64);
+        Ok([if index == 1 { 0.0 } else { width }; 3])
+    }
+}
+
+/// A text layer whose Expression Selector reads a footage item's size for every character but
+/// the first: the layer's key holds the first character's amount only, so its buffer is not
+/// stored on disk. Reopened over the same disk cache after the footage's width changed (16 to
+/// 64), the frame matches one rendered without a cache.
+#[test]
+fn a_text_expression_selector_is_not_served_from_the_disk_cache() {
+    use crate::disk_cache::{DiskCache, Kind};
+    use crate::{LayerCache, NoFootage, RenderOpts, Renderer};
+    let project = |width: u32| {
+        let (mut p, cid, comp) = setup();
+        let f = effectcraft_project::Footage { has_video: true, width, height: 16, ..Default::default() };
+        p.add_item("ref.png", Label::None, None, ItemKind::Footage(f));
+        let mut l = build::layer(&mut p, &comp, "Text", LayerSource::Text, (200, 100), None);
+        l.props.prop_mut("text/sourceText").unwrap().value = Value::Text(Box::new(TextDoc { text: "HH".into(), size: 60.0, ..Default::default() }));
+        let mut next = p.next_id;
+        let mut ids = Ids(&mut next);
+        let mut props = build::text_anim_props(&mut ids, "opacity", false);
+        for pr in &mut props {
+            pr.value = Value::Scalar(0.0);
+        }
+        let mut animator = build::text_animator(&mut ids, "Animator 1", props);
+        let sel = build::expression_selector(&mut ids, "Expression Selector 1");
+        p.next_id = next;
+        animator.sub_mut("selectors").unwrap().children.push(sel.into());
+        l.props.group_mut("text/animators").unwrap().children.push(animator.into());
+        p.comp_mut(cid).unwrap().layers.push(l);
+        (p, cid)
+    };
+    let render = |p: &Project, cid: ItemId, cache: Option<&LayerCache>| {
+        let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&WidthOfRef);
+        r.cache = cache;
+        r.comp_frame(cid, Tick::ZERO)
+    };
+    let dir = tempfile::tempdir().unwrap();
+    let dc = DiskCache::open(dir.path(), 1 << 30).unwrap();
+    dc.set_min_layer_ms(0);
+    // First session: the 16 px wide footage.
+    let (p16, cid) = project(16);
+    let cache = LayerCache::default();
+    cache.set_disk(Some(dc.clone()));
+    let first = render(&p16, cid, Some(&cache));
+    dc.flush();
+    assert!(first.data.iter().any(|px| px[3] > 0.5), "the text renders");
+    // Reopened with a fresh memory cache, the footage now 64 px wide.
+    let (p64, cid) = project(64);
+    let uncached = render(&p64, cid, None);
+    assert_ne!(uncached.data, first.data, "the second character's opacity follows the width");
+    let reopened = LayerCache::default();
+    reopened.set_disk(Some(dc.clone()));
+    assert_eq!(render(&p64, cid, Some(&reopened)).data, uncached.data, "not the buffer from before the change");
+    assert!(dc.keys(Kind::Layer).is_empty(), "the text layer's buffer is not on disk");
+}
+
+/// A Birth Rate expression reading another layer: changing that layer changes the history but
+/// not the current rate (0) nor this layer's properties, which is all the layer cache key sees.
+/// Particle Emitter 3D layers with expressions therefore aren't layer cached.
+#[test]
+fn particle_world_with_a_birth_rate_expression_is_not_served_from_the_layer_cache() {
+    let scene = |opacity: f64| {
+        let (mut p, cid) = burst_scene(None, 0.0, 100.0);
+        let comp = p.comp(cid).unwrap().clone();
+        let mut ctl = solid(&mut p, &comp, [0.0, 0.0, 0.0], 10, 10);
+        ctl.name = "Controller".into();
+        ctl.switches.video = false;
+        ctl.props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(opacity);
+        let c = p.comp_mut(cid).unwrap();
+        let fx = c.layers[0].props.sub_mut("effects").unwrap().children.iter_mut().find_map(|n| match n {
+            effectcraft_project::Node::Group(g) => Some(g),
+            _ => None,
+        });
+        fx.unwrap().prop_mut("birthRate").unwrap().expr = Some(effectcraft_project::Expression { text: "controller".into(), enabled: true });
+        c.layers.push(ctl);
+        (p, cid)
+    };
+    let render = |p: &Project, cid: ItemId, cache: Option<&crate::LayerCache>| {
+        let mut r = crate::Renderer::new(p, &crate::NoFootage, crate::RenderOpts::default());
+        r.expr = Some(&ControllerRate);
+        r.cache = cache;
+        r.comp_frame(cid, Tick::from_seconds_f64(0.9))
+    };
+    let ((many, cid), (few, _)) = (scene(75.0), scene(25.0));
+    let cache = crate::LayerCache::default();
+    let a = render(&many, cid, Some(&cache));
+    let b = render(&few, cid, Some(&cache));
+    assert_same(&b, &render(&few, cid, None), "cached render after the controller changed");
+    assert!(light(&b) > 1.0 && light(&b) < light(&a), "fewer births: {} vs {}", light(&b), light(&a));
+}
+
+/// A grey solid (Liquid Particles shades its blobs from it) with effect `id` (CC Particle Systems
+/// II, Liquid Particles): Birth Rate `rate`,
+/// or keyed 3 until 0.5 s and 0 a frame later (`None`); Longevity 1 s.
+fn system_scene(id: &str, rate: Option<f64>) -> (Project, ItemId) {
+    let (mut p, cid, comp) = setup();
+    let mut l = solid(&mut p, &comp, [0.5, 0.5, 0.5], 200, 100);
+    let vals = [("birthRate", Value::Scalar(rate.unwrap_or(3.0))), ("longevity", Value::Scalar(1.0))];
+    add_effect(&mut p, &mut l, id, [200.0, 100.0], &vals);
+    if rate.is_none() {
+        let fx = l.props.sub_mut("effects").unwrap().children.iter_mut().find_map(|c| match c {
+            effectcraft_project::Node::Group(g) => Some(g),
+            _ => None,
+        });
+        let key = |t: f64, v: f64| Keyframe::new(Tick::from_seconds_f64(t), Value::Scalar(v));
+        fx.unwrap().prop_mut("birthRate").unwrap().keys = vec![key(0.0, 3.0), key(0.5, 3.0), key(0.5 + 1.0 / 30.0, 0.0)];
+    }
+    p.comp_mut(cid).unwrap().layers = vec![l].into();
+    (p, cid)
+}
+
+/// #1373 for Particle Emitter 2D and Liquid Particles through the renderer: a keyed burst
+/// draws as the constant rate during it, still draws after the rate drops to 0 (unlike a rate
+/// of 0 throughout), and draws as nothing born once Longevity has run out.
+#[test]
+fn particle_systems_ii_and_mr_mercury_keep_a_burst_after_birth_rate_drops_to_zero() {
+    let at = Tick::from_seconds_f64;
+    for id in ["ec.sim.ccparticlesystems2", "ec.sim.ccmrmercury"] {
+        let (keyed, cid) = system_scene(id, None);
+        let (constant, _) = system_scene(id, Some(3.0));
+        let (none, _) = system_scene(id, Some(0.0));
+        assert_same(&render_cached(&keyed, cid, at(0.4), None), &render_cached(&constant, cid, at(0.4), None), &format!("{id}: during the burst"));
+        let (k, z) = (render_cached(&keyed, cid, at(0.9), None), render_cached(&none, cid, at(0.9), None));
+        assert!((light(&k) - light(&z)).abs() > 1.0, "{id}: the burst is still drawn: {} vs {}", light(&k), light(&z));
+        assert_same(&render_cached(&keyed, cid, at(1.9), None), &render_cached(&none, cid, at(1.9), None), &format!("{id}: gone after Longevity"));
+    }
+}
+
+/// A Birth Rate expression on any of the stepped particle systems keeps the layer out of the
+/// layer cache (its key can't see what the expression returned at earlier times); without one
+/// the layer is cached.
+#[test]
+fn stepped_particle_layers_with_a_birth_rate_expression_are_not_layer_cached() {
+    for id in ["ec.sim.ccparticleworld", "ec.sim.ccparticlesystems2", "ec.sim.ccmrmercury"] {
+        let (mut p, cid) = system_scene(id, Some(2.0));
+        let key = |p: &Project| {
+            let c = p.comp(cid).unwrap();
+            crate::cache::layer_key(&crate::eval::EvalCtx::new(p, cid, c, Tick::from_seconds_f64(0.9)), &c.layers[0], 1.0, false, false)
+        };
+        assert!(key(&p).is_some(), "{id}: cached without an expression");
+        let fx = p.comp_mut(cid).unwrap().layers[0].props.sub_mut("effects").unwrap().children.iter_mut().find_map(|c| match c {
+            effectcraft_project::Node::Group(g) => Some(g),
+            _ => None,
+        });
+        fx.unwrap().prop_mut("birthRate").unwrap().expr = Some(effectcraft_project::Expression { text: "time < 0.5 ? 3 : 0".into(), enabled: true });
+        assert!(key(&p).is_none(), "{id}: not cached with a Birth Rate expression");
+    }
+}
+
 // ------------------------------------------------------------------------------ layer cache
 
 fn render_cached(p: &Project, cid: ItemId, t: Tick, cache: Option<&crate::LayerCache>) -> crate::Image {
@@ -377,7 +781,7 @@ fn cache_scene() -> (Project, ItemId) {
         vec![Keyframe::new(Tick::ZERO, Value::Vec3([20.0, 70.0, 0.0])), Keyframe::new(Tick::from_seconds_f64(1.0), Value::Vec3([120.0, 70.0, 0.0]))];
     add_effect_200(&mut p, &mut text, "ec.blur.gaussian", &[("blurriness", Value::Scalar(6.0))]);
     let c = p.comp_mut(cid).unwrap();
-    c.layers = vec![text, shape, bg];
+    c.layers = vec![text, shape, bg].into();
     (p, cid)
 }
 
@@ -557,6 +961,41 @@ fn effects_read_layer_params() {
     assert!(px[2] > 0.99 && px[0] < 0.01, "{px:?}");
 }
 
+/// A cached layer whose effect reads a precomp layer: how the precomp's layers render depends on
+/// Switches Affect Nested Comps (the precomp layer's Draft quality passes down) and on the
+/// switches the reading layer's own comp inherits, so the key must tell them apart (a buffer
+/// made under the other setting, from memory or disk, is stale).
+#[test]
+fn a_cached_layer_reading_a_precomp_is_keyed_by_the_nested_switches() {
+    let (mut p, cid, comp) = setup();
+    let mut inner = Comp::new(200, 100, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+    // A rotated square off the pixel grid: Draft (nearest) and Best (bilinear) sampling differ.
+    let mut dot = solid(&mut p, &inner, [1.0, 1.0, 1.0], 40, 40);
+    dot.props.prop_mut("transform/position").unwrap().value = Value::Vec3([100.3, 50.6, 0.0]);
+    dot.props.prop_mut("transform/rotation").unwrap().value = Value::Scalar(30.0);
+    inner.layers.push(dot);
+    let iid = p.add_item("Inner", Label::Sandstone, None, ItemKind::Comp(inner.into()));
+    let mut pre = build::layer(&mut p, &comp, "Inner", LayerSource::Comp { item: iid }, (200, 100), None);
+    pre.switches.video = false;
+    pre.switches.quality = effectcraft_project::Quality::Draft;
+    let mut top = solid(&mut p, &comp, [1.0, 0.0, 0.0], 200, 100);
+    add_effect_200(&mut p, &mut top, "ec.channel.blend", &[("blendWithLayer", Value::Layer(Some(pre.id.0)))]);
+    let c = p.comp_mut(cid).unwrap();
+    c.layers.push(top);
+    c.layers.push(pre);
+    let frame = |nested_switches: bool, cache: Option<&crate::LayerCache>| {
+        let mut r = crate::Renderer::new(&p, &crate::NoFootage, crate::RenderOpts { nested_switches, ..Default::default() });
+        r.cache = cache;
+        r.comp_frame(cid, Tick::ZERO).data
+    };
+    let (on, off) = (frame(true, None), frame(false, None));
+    assert!(on != off, "the precomp layer's Draft quality passes down");
+    let cache = crate::LayerCache::default();
+    assert!(frame(true, Some(&cache)) == on);
+    assert!(frame(false, Some(&cache)) == off, "not the buffer made with switches affecting nested comps");
+    assert!(frame(true, Some(&cache)) == on, "and back");
+}
+
 /// Records whether the GPU compositor was asked to draw a frame.
 struct ProbeAccel(std::sync::atomic::AtomicBool);
 impl crate::Accelerator for ProbeAccel {
@@ -575,6 +1014,71 @@ impl crate::Accelerator for ProbeAccel {
     }
 }
 
+/// Counts [`Accelerator::frame_end`] and optionally panics inside [`Accelerator::comp_frame`].
+struct EndAccel {
+    ends: std::sync::atomic::AtomicUsize,
+    panic: std::sync::atomic::AtomicBool,
+}
+impl crate::Accelerator for EndAccel {
+    fn name(&self) -> String {
+        "end".into()
+    }
+    fn comp_frame(&self, _r: &crate::Renderer, _comp: ItemId, _t: Tick) -> Option<crate::Image> {
+        if self.panic.load(std::sync::atomic::Ordering::SeqCst) {
+            panic!("comp_frame");
+        }
+        Some(crate::Image::new(1, 1))
+    }
+    fn supports_effect(&self, _id: &str) -> bool {
+        false
+    }
+    fn effects(&self, _chain: &[crate::FxStep], _buf: &crate::Buf, _levels: Option<f32>) -> Option<crate::Buf> {
+        None
+    }
+    fn frame_end(&self) {
+        self.ends.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+    }
+}
+
+#[test]
+fn comp_frame_ends_the_frame_when_the_render_panics() {
+    use std::panic::{AssertUnwindSafe, catch_unwind};
+    use std::sync::atomic::Ordering;
+    let (mut p, cid, comp) = setup();
+    let l = solid(&mut p, &comp, [1.0, 0.0, 0.0], 50, 50);
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let a = EndAccel { ends: Default::default(), panic: true.into() };
+    let mut r = crate::Renderer::new(&p, &crate::NoFootage, crate::RenderOpts { backend: crate::Backend::Gpu, ..Default::default() });
+    r.accel = Some(&a);
+    assert!(catch_unwind(AssertUnwindSafe(|| crate::passes::block_on(crate::passes::comp_frame(&r, cid, Tick::ZERO)))).is_err());
+    assert_eq!(a.ends.load(Ordering::SeqCst), 1);
+    a.panic.store(false, Ordering::SeqCst);
+    a.ends.store(0, Ordering::SeqCst);
+    let _ = crate::passes::block_on(crate::passes::comp_frame(&r, cid, Tick::ZERO));
+    assert_eq!(a.ends.load(Ordering::SeqCst), 1);
+}
+
+/// The renderer labels Project Settings ▸ Video Rendering and Effects draws parse back as the
+/// backend they name (in any case), and the older spellings still work.
+#[test]
+fn renderer_labels_parse_back_and_keep_the_older_spellings() {
+    use crate::Backend;
+    for (label, backend) in [
+        ("GPU Acceleration", Backend::Gpu),
+        ("gpu acceleration", Backend::Gpu),
+        ("Mercury GPU Acceleration", Backend::Gpu),
+        ("gpu", Backend::Gpu),
+        ("Software Rendering", Backend::Cpu),
+        ("software rendering", Backend::Cpu),
+        ("Mercury Software Only", Backend::Cpu),
+        ("cpu", Backend::Cpu),
+        ("Auto", Backend::Auto),
+    ] {
+        assert_eq!(Backend::parse(label), Some(backend), "{label}");
+    }
+    assert_eq!(Backend::parse("Vulkan"), None);
+}
+
 #[test]
 fn auto_backend_sends_2d_and_3d_comps_to_the_gpu() {
     let (mut p, cid, comp) = setup();
@@ -617,7 +1121,7 @@ fn edge_pinning_displaces_all_of_a_centred_shape_layer() {
         p.comp_mut(cid).unwrap().layers.push(l.clone());
         let plain = render_frame(&p, cid, Tick::ZERO, 1.0);
         add_effect_200(&mut p, &mut l, id, &vals);
-        p.comp_mut(cid).unwrap().layers = vec![l];
+        p.comp_mut(cid).unwrap().layers = vec![l].into();
         let warped = render_frame(&p, cid, Tick::ZERO, 1.0);
         // Alpha change per comp quadrant (TL, TR, BL, BR): the rectangle's edges move in each.
         let mut q = [0.0f32; 4];
@@ -651,7 +1155,7 @@ fn default_effect_points_sit_at_the_centre_of_a_shape_layer() {
         p.comp_mut(cid).unwrap().layers.push(l.clone());
         let plain = render_frame(&p, cid, Tick::ZERO, 1.0);
         add_effect_200(&mut p, &mut l, id, &vals);
-        p.comp_mut(cid).unwrap().layers = vec![l];
+        p.comp_mut(cid).unwrap().layers = vec![l].into();
         let warped = render_frame(&p, cid, Tick::ZERO, 1.0);
         // Alpha change per comp quadrant (TL, TR, BL, BR): the top and bottom edges move in each.
         let mut q = [0.0f32; 4];
@@ -666,6 +1170,54 @@ fn default_effect_points_sit_at_the_centre_of_a_shape_layer() {
     }
 }
 
+/// #687: an adjustment layer's footprint (its source through its masks) must not be keyed by
+/// its effect stack. Noise on a finishing adjustment changes every frame, and letting that
+/// reach the key re-rendered and re-uploaded a full-frame buffer every frame. A moving mask
+/// must still re-key it, and the cached buffer must follow the mask.
+#[test]
+fn adjustment_footprint_key_ignores_the_effect_stack() {
+    let (mut p, cid, comp) = setup();
+    let mut adj = solid(&mut p, &comp, [1.0, 1.0, 1.0], 200, 100);
+    adj.switches.adjustment = true;
+    add_effect_200(&mut p, &mut adj, "ec.noise.noise", &[("amount", Value::Scalar(50.0))]);
+    let key = |p: &Project, t: f64| {
+        let c = p.comp(cid).unwrap();
+        crate::cache::footprint_key(&crate::EvalCtx::new(p, cid, c, Tick::from_seconds_f64(t)), &c.layers[0], 1.0, false, false).unwrap()
+    };
+    let mut next = p.next_id;
+    let mut m = build::mask(&mut Ids(&mut next), "Mask 1", ShapePath::rect([50.0, 50.0], 40.0, 40.0), MaskMode::Add, [255, 255, 0]);
+    p.next_id = next;
+    m.prop_mut("path").unwrap().keys = vec![
+        Keyframe::new(Tick::ZERO, Value::Path(ShapePath::rect([50.0, 50.0], 40.0, 40.0))),
+        Keyframe::new(Tick::from_seconds_f64(1.0), Value::Path(ShapePath::rect([150.0, 50.0], 40.0, 40.0))),
+    ];
+    // Effects alone must not put the shutter in the footprint key. Masks, added below, may.
+    p.comp_mut(cid).unwrap().layers.push(adj.clone());
+    let bare = key(&p, 0.0);
+    p.comp_mut(cid).unwrap().shutter_angle = 90.0;
+    assert_eq!(bare, key(&p, 0.0), "the comp shutter must not re-key a footprint");
+    p.comp_mut(cid).unwrap().shutter_angle = 180.0;
+    p.comp_mut(cid).unwrap().layers[0].props.sub_mut("masks").unwrap().children.push(m.into());
+    let foot = |p: &Project, t: f64| {
+        let c = p.comp(cid).unwrap();
+        let mut r = crate::Renderer::new(p, &crate::NoFootage, crate::RenderOpts::default());
+        let cache = crate::LayerCache::default();
+        r.cache = Some(&cache);
+        let layer = c.layers[0].clone();
+        let b = r.adjustment_footprint(&crate::EvalCtx::new(p, cid, c, Tick::from_seconds_f64(t)), &layer).unwrap();
+        b.img.get(50, 50)
+    };
+    assert_ne!(key(&p, 0.0), key(&p, 0.5), "an animated mask path must re-key the footprint");
+    assert_ne!(key(&p, 0.0), key(&p, 1.0));
+    assert_ne!(foot(&p, 0.0), foot(&p, 1.0), "the moved mask must reach the cached footprint");
+    assert_eq!(key(&p, 1.0), key(&p, 1.5), "a per-frame effect on the adjustment re-keyed its footprint");
+    assert_eq!(key(&p, 1.0), key(&p, 3.5), "the footprint key followed the clock past the mask");
+    assert_eq!(foot(&p, 1.0), foot(&p, 3.5));
+    let before = key(&p, 0.0);
+    p.comp_mut(cid).unwrap().layers[0].props.prop_mut("effects/#1/amount").unwrap().value = Value::Scalar(90.0);
+    assert_eq!(before, key(&p, 0.0), "editing an effect parameter must not re-key the footprint");
+}
+
 /// #659: a tiling effect on a text layer tiles across the layer's whole region. The glyphs
 /// were cut off at their own bounding box: the effect computed over the comp-sized layer rect
 /// but wrote into the painted (glyph-bounds) buffer alone. Tiling shrinks each copy, so the
@@ -680,7 +1232,7 @@ fn effects_on_text_reach_past_the_text_bounds() {
     let plain = render_frame(&p, cid, Tick::ZERO, 1.0);
     let painted = plain.data.iter().filter(|px| px[3] > 0.5).count();
     add_effect_200(&mut p, &mut l, "ec.distort.cctiler", &[("scale", Value::Scalar(25.0))]);
-    p.comp_mut(cid).unwrap().layers = vec![l];
+    p.comp_mut(cid).unwrap().layers = vec![l].into();
     let tiled = render_frame(&p, cid, Tick::ZERO, 1.0);
     let (mut lo, mut hi) = (u32::MAX, 0u32);
     for y in 0..100 {
@@ -693,11 +1245,11 @@ fn effects_on_text_reach_past_the_text_bounds() {
     }
     assert!(
         painted > 50 && hi.saturating_sub(lo) > 100,
-        "CC Tiler tiles the glyphs across the layer region, not just its text bounds: {painted} painted, x-span {lo}..{hi}"
+        "Scaled Tiles tiles the glyphs across the layer region, not just its text bounds: {painted} painted, x-span {lo}..{hi}"
     );
 }
 
-/// #658: CC Smear drags text glyphs beyond the text layer's own bounds. Pixels smeared past
+/// #658: Directional Smear drags text glyphs beyond the text layer's own bounds. Pixels smeared past
 /// the painted rectangle used to fall off its edge, so the liquid trail never appeared.
 #[test]
 fn cc_smear_trails_text_past_its_bounds() {
@@ -714,9 +1266,9 @@ fn cc_smear_trails_text_past_its_bounds() {
         "ec.distort.ccsmear",
         &[("from", Value::Vec2([110.0, 45.0])), ("to", Value::Vec2([185.0, 45.0])), ("reach", Value::Scalar(100.0)), ("radius", Value::Scalar(40.0))],
     );
-    p.comp_mut(cid).unwrap().layers = vec![l];
+    p.comp_mut(cid).unwrap().layers = vec![l].into();
     let smeared = right(&render_frame(&p, cid, Tick::ZERO, 1.0));
-    assert!(plain > 40 && smeared > plain + 25, "CC Smear trails the glyphs past the text bounds: right edge {plain} → {smeared}");
+    assert!(plain > 40 && smeared > plain + 25, "Directional Smear trails the glyphs past the text bounds: right edge {plain} → {smeared}");
 }
 
 /// A layer parameter pointing at a shape layer sees all of it (in its effect space), and the
@@ -737,7 +1289,7 @@ fn layer_parameters_see_a_whole_shape_layer() {
     let matte_id = shape.id;
     let mut s = solid(&mut p, &comp, [0.0, 0.0, 1.0], 200, 100);
     add_effect_200(&mut p, &mut s, "ec.channel.setmatte", &[("takeMatteFromLayer", Value::Layer(Some(matte_id.0)))]);
-    p.comp_mut(cid).unwrap().layers = vec![s, shape];
+    p.comp_mut(cid).unwrap().layers = vec![s, shape].into();
     let f = render_frame(&p, cid, Tick::ZERO, 1.0);
     // The matte covers x 50..150, y 25..75: kept inside (all four quadrants), gone outside.
     for (x, y) in [(60, 30), (140, 30), (60, 70), (140, 70)] {
@@ -827,7 +1379,7 @@ fn self_inputs_share_source_semantics_across_effects_and_times() {
         "ec.channel.blend",
         &[("blendWithLayer", Value::Layer(Some(id))), ("blendWithLayerSource", Value::Enum(0)), ("blendWithOriginal", Value::Scalar(0.0))],
     );
-    p.comp_mut(cid).unwrap().layers = vec![l];
+    p.comp_mut(cid).unwrap().layers = vec![l].into();
     let c = p.comp(cid).unwrap();
     let ctx = crate::eval::EvalCtx::new(&p, cid, c, Tick::ZERO);
     assert!(crate::cache::input_key(&ctx, &c.layers[0], 1.0, false, false, 1).is_some());
@@ -845,7 +1397,7 @@ fn timed_source_reads_preserve_other_layer_masks() {
     let mask = build::mask(&mut Ids(&mut next), "Left", ShapePath::rect([50.0, 50.0], 80.0, 80.0), MaskMode::Add, [255, 255, 0]);
     p.next_id = next;
     other.props.sub_mut("masks").unwrap().children.push(mask.into());
-    p.comp_mut(cid).unwrap().layers = vec![owner.clone(), other.clone()];
+    p.comp_mut(cid).unwrap().layers = vec![owner.clone(), other.clone()].into();
     let ctx = crate::EvalCtx::new(&p, cid, p.comp(cid).unwrap(), Tick::ZERO);
     let renderer = crate::Renderer::new(&p, &crate::NoFootage, crate::RenderOpts::default());
     let host = crate::FxHost { r: &renderer, ctx: &ctx, layer: &owner, origin: [0.0; 2], index: Default::default(), original: None };
@@ -866,7 +1418,7 @@ fn layer_dependencies_remain_cacheable_and_invalidate_only_related_edits() {
     let unrelated = solid(&mut p, &comp, [0.2, 0.3, 0.4], 200, 100);
     add_effect_200(&mut p, &mut source, "ec.channel.blend", &[("blendWithLayer", Value::Layer(Some(third.id.0))), ("blendWithOriginal", Value::Scalar(0.0))]);
     add_effect_200(&mut p, &mut owner, "ec.channel.blend", &[("blendWithLayer", Value::Layer(Some(source.id.0))), ("blendWithOriginal", Value::Scalar(0.0))]);
-    p.comp_mut(cid).unwrap().layers = vec![owner, source, third, unrelated];
+    p.comp_mut(cid).unwrap().layers = vec![owner, source, third, unrelated].into();
     let key = |p: &Project, time: f64, limit| {
         let comp = p.comp(cid).unwrap();
         let ctx = crate::EvalCtx::new(p, cid, comp, Tick::from_seconds_f64(time));
@@ -907,12 +1459,12 @@ fn precomp_dependencies_hash_nested_sources_and_evaluated_animation() {
     child.props.prop_mut("transform/opacity").unwrap().keys =
         vec![Keyframe::new(Tick::ZERO, Value::Scalar(100.0)), Keyframe::new(Tick::from_seconds_f64(1.0), Value::Scalar(50.0))];
     let mut nested = comp.clone();
-    nested.layers = vec![child];
+    nested.layers = vec![child].into();
     let nested_id = p.add_item("Nested", Label::Sandstone, None, ItemKind::Comp(nested.into()));
     let pre = build::layer(&mut p, &comp, "Precomp", LayerSource::Comp { item: nested_id }, (200, 100), None);
     let mut owner = solid(&mut p, &comp, [1.0, 0.0, 0.0], 200, 100);
     add_effect_200(&mut p, &mut owner, "ec.channel.blend", &[("blendWithLayer", Value::Layer(Some(pre.id.0))), ("blendWithOriginal", Value::Scalar(0.0))]);
-    p.comp_mut(cid).unwrap().layers = vec![owner, pre];
+    p.comp_mut(cid).unwrap().layers = vec![owner, pre].into();
     let key = |p: &Project, time| {
         let c = p.comp(cid).unwrap();
         crate::cache::layer_key(&crate::EvalCtx::new(p, cid, c, time), &c.layers[0], 1.0, false, false).unwrap()
@@ -972,7 +1524,7 @@ fn solo_excludes_other_layers_outside_the_soloed_layers_range() {
     assert_eq!(second.get(100, 50), [0.0, 0.0, 1.0, 1.0], "only B inside its range");
 }
 
-/// #1252: a layer blended with a CC Particle World layer, under a camera panned by `pan` px.
+/// #1252: a layer blended with a Particle Emitter 3D layer, under a camera panned by `pan` px.
 fn scene_reader_dependency(pan: f64) -> (Project, ItemId) {
     let (mut p, cid, comp) = setup();
     let mut source = solid(&mut p, &comp, [0.0, 0.0, 0.0], 200, 100);
@@ -987,7 +1539,7 @@ fn scene_reader_dependency(pan: f64) -> (Project, ItemId) {
         let Value::Vec3(v) = pr.value else { panic!("{path}: {:?}", pr.value) };
         pr.value = Value::Vec3([v[0] + pan, v[1], v[2]]);
     }
-    p.comp_mut(cid).unwrap().layers = vec![cam, owner, source];
+    p.comp_mut(cid).unwrap().layers = vec![cam, owner, source].into();
     (p, cid)
 }
 
@@ -1010,3 +1562,441 @@ fn a_selected_layer_reading_the_comp_scene_invalidates_its_owner() {
     let (a, b) = (particles_x(&here), particles_x(&panned));
     assert!(b < a - 20.0, "the blended particles follow the camera: {a} -> {b}");
 }
+
+/// #1812: preview workers that render a layer at once end up with one buffer (the one kept
+/// first), so the GPU compositor uploads and packs it once, not once per worker.
+#[test]
+fn workers_rendering_a_layer_at_once_share_one_buffer() {
+    let (mut p, cid, comp) = setup();
+    let mut l = solid(&mut p, &comp, [0.2, 0.5, 0.8], 1600, 1200);
+    add_effect(&mut p, &mut l, "ec.blur.gaussian", [1600.0, 1200.0], &[("blurriness", Value::Scalar(60.0))]);
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let cache = crate::LayerCache::default();
+    let start = std::sync::Barrier::new(8);
+    let bufs: Vec<_> = std::thread::scope(|s| {
+        let hs: Vec<_> = (0..8)
+            .map(|_| {
+                s.spawn(|| {
+                    let mut r = crate::Renderer::new(&p, &crate::NoFootage, crate::RenderOpts::default());
+                    r.cache = Some(&cache);
+                    let c = p.comp(cid).unwrap();
+                    let ctx = r.eval_ctx(cid, Tick::ZERO).unwrap();
+                    start.wait();
+                    r.layer_buf(&ctx, &c.layers[0]).unwrap()
+                })
+            })
+            .collect();
+        hs.into_iter().map(|h| h.join().unwrap()).collect()
+    });
+    assert!(bufs.iter().all(|b| std::sync::Arc::ptr_eq(b, &bufs[0])), "one shared buffer");
+    assert_eq!(cache.stats().entries, 1);
+}
+
+// ------------------------------------------------------------------------------ 3D layer instances
+
+/// A red triangle in the Z = 0 plane (the engine instance3d tests' glTF, buffer embedded as a
+/// data URI), parsed in memory: a FootageSource that knows one model item.
+const TRIANGLE: &str = r#"{
+  "asset": {"version": "2.0"},
+  "scenes": [{"nodes": [0]}],
+  "nodes": [{"mesh": 0}],
+  "meshes": [{"primitives": [{"attributes": {"POSITION": 0, "NORMAL": 1}, "material": 0}]}],
+  "materials": [{"pbrMetallicRoughness": {"baseColorFactor": [1.0, 0.0, 0.0, 1.0]}}],
+  "buffers": [{"byteLength": 72, "uri": "data:application/octet-stream;base64,AACAvwAAgL8AAAAAAACAPwAAgL8AAAAAAAAAAAAAgD8AAAAAAAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/"}],
+  "bufferViews": [
+    {"buffer": 0, "byteOffset": 0, "byteLength": 36},
+    {"buffer": 0, "byteOffset": 36, "byteLength": 36}
+  ],
+  "accessors": [
+    {"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": 3, "min": [-1.0, -1.0, 0.0], "max": [1.0, 1.0, 0.0]},
+    {"bufferView": 1, "componentType": 5126, "type": "VEC3", "count": 3}
+  ]
+}"#;
+
+struct SoloModels;
+
+impl crate::FootageSource for SoloModels {
+    fn frame(&self, _: ItemId, _: &effectcraft_project::Footage, _: Tick) -> Option<std::sync::Arc<crate::Image>> {
+        None
+    }
+    fn model(&self, _: ItemId, f: &effectcraft_project::Footage) -> Option<std::sync::Arc<effectcraft_model::Model>> {
+        effectcraft_model::load(&f.path, TRIANGLE.as_bytes(), &|_| None).ok().map(std::sync::Arc::new)
+    }
+}
+
+/// A red triangle 3D model, a camera panned right by `pan` px and, on top of the stack, the
+/// copy: a solid with a 3D Layer Instance effect referencing the model.
+fn instance_scene(pan: f64) -> (Project, ItemId) {
+    let (mut p, cid, comp) = setup();
+    // Models are Advanced 3D (layer.newModel switches a Classic comp over).
+    p.comp_mut(cid).unwrap().renderer = effectcraft_project::Renderer::Advanced3D;
+    let mid = p.add_item(
+        "Triangle",
+        Label::Red,
+        None,
+        ItemKind::Footage(effectcraft_project::Footage {
+            path: "Triangle.gltf".into(),
+            kind: effectcraft_project::FootageKind::Model,
+            frame_rate: FrameRate::FPS_30,
+            codec: "glTF".into(),
+            ..Default::default()
+        }),
+    );
+    let model = build::layer(&mut p, &comp, "Triangle", LayerSource::Model { item: mid }, (200, 100), None);
+    let mut cam = build::layer(&mut p, &comp, "Camera", LayerSource::Camera, (200, 100), None);
+    for path in ["transform/position", "transform/poi"] {
+        let pr = cam.props.prop_mut(path).unwrap();
+        let Value::Vec3(v) = pr.value else { panic!("{path}: {:?}", pr.value) };
+        pr.value = Value::Vec3([v[0] + pan, v[1], v[2]]);
+    }
+    let mut owner = solid(&mut p, &comp, [1.0, 1.0, 1.0], 200, 100);
+    add_effect_200(&mut p, &mut owner, "ec.3d.instance3d", &[("layer", Value::Layer(Some(model.id.0)))]);
+    p.comp_mut(cid).unwrap().layers = vec![cam, owner, model].into();
+    (p, cid)
+}
+
+fn render_models(p: &Project, cid: ItemId, t: Tick, cache: Option<&crate::LayerCache>) -> crate::Image {
+    let mut r = crate::Renderer::new(p, &SoloModels, crate::RenderOpts::default());
+    r.cache = cache;
+    r.comp_frame(cid, t)
+}
+
+/// The coverage-weighted centre of the triangle (x): where its drawn pixels are, lit or not.
+fn cover_x(img: &crate::Image) -> f32 {
+    let (mut m, mut sx) = (0.0, 0.0);
+    for y in 0..img.height {
+        for x in 0..img.width {
+            let a = img.get(x as i64, y as i64)[3];
+            m += a;
+            sx += a * x as f32;
+        }
+    }
+    assert!(m > 1.0, "the triangle is drawn");
+    sx / m
+}
+
+/// Create 3D Layer Instance: the copy (the owner) is cached, and its key covers what the
+/// referenced model's solo render depends on — the camera, and the model's in/out gate.
+#[test]
+fn an_instance_of_a_model_is_cached_and_follows_the_camera() {
+    let t = Tick::from_seconds_f64(1.0);
+    let (p, cid) = instance_scene(0.0);
+    let (q, _) = instance_scene(40.0);
+    let key_at = |p: &Project, t: Tick| {
+        let c = p.comp(cid).unwrap();
+        crate::cache::layer_key(&crate::EvalCtx::new(p, cid, c, t), &c.layers[1], 1.0, false, false).unwrap()
+    };
+    assert_ne!(key_at(&p, t), key_at(&q, t), "moving the camera changes the copy's key");
+    // The same layer at a later time, outside its in/out range: the read turns transparent.
+    let mut out = p.clone();
+    out.comp_mut(cid).unwrap().layers[2].out_point = Tick::from_seconds_f64(0.5);
+    assert_ne!(key_at(&out, Tick::from_seconds_f64(0.25)), key_at(&out, t), "leaving the model's in/out range changes the copy's key");
+    // Two renders of one time: the second is served from the cache.
+    let cache = crate::LayerCache::default();
+    let here = render_models(&p, cid, t, Some(&cache));
+    let again = render_models(&p, cid, t, Some(&cache));
+    assert_same(&again, &render_models(&p, cid, t, None), "the second render is the cached one");
+    assert!(cache.stats().hits > 0, "the copy was served from the cache");
+    // Panning the camera: the copy (and the model) move with it.
+    let panned = render_models(&q, cid, t, Some(&cache));
+    assert_same(&panned, &render_models(&q, cid, t, None), "cached render after the camera moved");
+    let (a, b) = (cover_x(&here), cover_x(&panned));
+    assert!(b < a - 20.0, "panning the camera right moves the copy left: {a} -> {b}");
+}
+
+/// The camera's depth of field blurs the solo render (focus, aperture, iris, highlights) —
+/// none of it is in the projection matrix: changing any of it must change the copy's key, or
+/// it would serve the un-blurred pixels.
+#[test]
+fn the_copy_key_covers_the_cameras_depth_of_field() {
+    let t = Tick::from_seconds_f64(1.0);
+    let (p, cid) = instance_scene(0.0);
+    let set_dof = |p: &Project, on: bool, focus: f64, aperture: f64| {
+        let mut q = p.clone();
+        let cam = &mut q.comp_mut(cid).unwrap().layers[0];
+        for (path, v) in
+            [("cameraOptions/dof", Value::Bool(on)), ("cameraOptions/focusDistance", Value::Scalar(focus)), ("cameraOptions/aperture", Value::Scalar(aperture))]
+        {
+            cam.props.prop_mut(path).unwrap().value = v;
+        }
+        q
+    };
+    let key_at = |p: &Project| {
+        let c = p.comp(cid).unwrap();
+        crate::cache::layer_key(&crate::EvalCtx::new(p, cid, c, t), &c.layers[1], 1.0, false, false).unwrap()
+    };
+    let ka = key_at(&set_dof(&p, true, 500.0, 20.0));
+    let kb = key_at(&set_dof(&p, true, 500.0, 40.0)); // aperture
+    let kc = key_at(&set_dof(&p, true, 700.0, 20.0)); // focus
+    let kd = key_at(&set_dof(&p, false, 500.0, 20.0)); // the switch off
+    assert!(ka != kb && ka != kc && ka != kd && kb != kc, "aperture, focus and the switch each change the key");
+}
+
+/// A model with an animation clip selected is posed at its layer time: every time is its own
+/// entry. Without one (the default) the pose is the same at every time: one key inside the
+/// in/out range, as before.
+#[test]
+fn the_copy_key_covers_an_animated_models_layer_time() {
+    let (p, cid) = instance_scene(0.0);
+    let (t0, t1) = (Tick::from_seconds_f64(0.5), Tick::from_seconds_f64(1.0));
+    let key_at = |p: &Project, t: Tick| {
+        let c = p.comp(cid).unwrap();
+        crate::cache::layer_key(&crate::EvalCtx::new(p, cid, c, t), &c.layers[1], 1.0, false, false).unwrap()
+    };
+    assert_eq!(key_at(&p, t0), key_at(&p, t1), "a model without a clip keeps one key across times");
+    let mut q = p.clone();
+    q.comp_mut(cid).unwrap().layers[2].props.prop_mut("geometryOptions/animation").unwrap().value = Value::Enum(1);
+    assert_ne!(key_at(&q, t0), key_at(&q, t1), "an animated model's key follows its layer time");
+    // Two times and back: each is rendered fresh, none served another time's pixels.
+    let cache = crate::LayerCache::default();
+    let first = render_models(&q, cid, t0, Some(&cache));
+    let second = render_models(&q, cid, t1, Some(&cache));
+    assert_eq!(cache.stats().hits, 0, "the second time is not served the first time's pixels");
+    assert_same(&second, &render_models(&q, cid, t1, None), "the second time is a fresh render");
+    let again = render_models(&q, cid, t0, Some(&cache));
+    assert_eq!(cache.stats().hits, 1, "the first time is served on the way back");
+    assert_same(&again, &first, "the way back is the first time's pixels");
+}
+
+/// An Environment light's image lights Advanced 3D models — its source can be any layer's
+/// render: with one on, the read is not cached, so changes to it cannot reuse stale pixels.
+#[test]
+fn an_environment_light_makes_the_copy_uncached() {
+    let (p, cid) = instance_scene(0.0);
+    let mut q = p.clone();
+    let comp = q.comp(cid).unwrap().clone();
+    let env = build::layer(&mut q, &comp, "Env", LayerSource::Light { kind: effectcraft_project::LightKind::Environment }, (200, 100), None);
+    q.comp_mut(cid).unwrap().layers.insert(0, env);
+    let t = Tick::from_seconds_f64(1.0);
+    let key_at = |p: &Project| {
+        let c = p.comp(cid).unwrap();
+        crate::cache::layer_key(&crate::EvalCtx::new(p, cid, c, t), &c.layers[2], 1.0, false, false)
+    };
+    assert!(key_at(&q).is_none(), "with an Environment light the read is not cached");
+    let cache = crate::LayerCache::default();
+    let a = render_models(&q, cid, t, Some(&cache));
+    let b = render_models(&q, cid, t, Some(&cache));
+    assert_same(&a, &b, "two fresh renders agree");
+    assert_eq!(cache.stats().hits, 0, "nothing is served from the cache");
+    // The light off (not lighting): the cache comes back.
+    q.comp_mut(cid).unwrap().layers[0].switches.video = false;
+    assert!(key_at(&q).is_some(), "the light off, the read is cached again");
+}
+
+// ------------------------------------------------------------------- keyed model animation clips
+
+/// [`TRIANGLE`] with one 1 s clip: its node slides from x = -1 to x = +1 (linear).
+const SLIDING_TRIANGLE: &str = r#"{
+  "asset": {"version": "2.0"},
+  "scenes": [{"nodes": [0]}],
+  "nodes": [{"mesh": 0}],
+  "meshes": [{"primitives": [{"attributes": {"POSITION": 0, "NORMAL": 1}, "material": 0}]}],
+  "materials": [{"pbrMetallicRoughness": {"baseColorFactor": [1.0, 0.0, 0.0, 1.0]}}],
+  "animations": [{"samplers": [{"input": 2, "output": 3, "interpolation": "LINEAR"}], "channels": [{"sampler": 0, "target": {"node": 0, "path": "translation"}}]}],
+  "buffers": [{"byteLength": 104, "uri": "data:application/octet-stream;base64,AACAvwAAgL8AAAAAAACAPwAAgL8AAAAAAAAAAAAAgD8AAAAAAAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/AAAAAAAAAAAAAIA/AAAAAAAAgD8AAIC/AAAAAAAAAAAAAIA/AAAAAAAAAAA="}],
+  "bufferViews": [
+    {"buffer": 0, "byteOffset": 0, "byteLength": 36},
+    {"buffer": 0, "byteOffset": 36, "byteLength": 36},
+    {"buffer": 0, "byteOffset": 72, "byteLength": 8},
+    {"buffer": 0, "byteOffset": 80, "byteLength": 24}
+  ],
+  "accessors": [
+    {"bufferView": 0, "componentType": 5126, "type": "VEC3", "count": 3, "min": [-1.0, -1.0, 0.0], "max": [1.0, 1.0, 0.0]},
+    {"bufferView": 1, "componentType": 5126, "type": "VEC3", "count": 3},
+    {"bufferView": 2, "componentType": 5126, "type": "SCALAR", "count": 2, "min": [0.0], "max": [1.0]},
+    {"bufferView": 3, "componentType": 5126, "type": "VEC3", "count": 2}
+  ]
+}"#;
+
+struct SlidingModels;
+
+impl crate::FootageSource for SlidingModels {
+    fn frame(&self, _: ItemId, _: &effectcraft_project::Footage, _: Tick) -> Option<std::sync::Arc<crate::Image>> {
+        None
+    }
+    fn model(&self, _: ItemId, f: &effectcraft_project::Footage) -> Option<std::sync::Arc<effectcraft_model::Model>> {
+        effectcraft_model::load(&f.path, SLIDING_TRIANGLE.as_bytes(), &|_| None).ok().map(std::sync::Arc::new)
+    }
+}
+
+fn clip_comp() -> Comp {
+    let mut c = Comp::new(200, 100, FrameRate::FPS_30, Tick::from_seconds_f64(6.0));
+    c.renderer = effectcraft_project::Renderer::Advanced3D;
+    c
+}
+
+/// The sliding triangle at 20 px a model unit. `keys` key Geometry Options ▸ Animation as
+/// (layer seconds, popup value); with none, clip 1 is selected statically.
+fn sliding_model(p: &mut Project, comp: &Comp, keys: &[(f64, u32)], looping: bool) -> effectcraft_project::Layer {
+    let footage = effectcraft_project::Footage {
+        path: "Sliding.gltf".into(),
+        kind: effectcraft_project::FootageKind::Model,
+        frame_rate: FrameRate::FPS_30,
+        codec: "glTF".into(),
+        ..Default::default()
+    };
+    let mid = p.add_item("Sliding", Label::Red, None, ItemKind::Footage(footage));
+    let mut l = build::layer(p, comp, "Sliding", LayerSource::Model { item: mid }, (200, 100), None);
+    l.props.prop_mut("geometryOptions/unitScale").unwrap().value = Value::Scalar(20.0);
+    l.props.prop_mut("geometryOptions/loopAnimation").unwrap().value = Value::Bool(looping);
+    let clip = l.props.prop_mut("geometryOptions/animation").unwrap();
+    clip.value = Value::Enum(1);
+    clip.keys = keys.iter().map(|&(t, v)| Keyframe::new(Tick::from_seconds_f64(t), Value::Enum(v)).hold()).collect();
+    l
+}
+
+fn clip_scene(keys: &[(f64, u32)], looping: bool, stretch: f64, start: f64) -> (Project, ItemId) {
+    let (mut p, mut comp) = (Project::default(), clip_comp());
+    p.settings.bit_depth = effectcraft_project::BitDepth::Bpc32;
+    let mut l = sliding_model(&mut p, &comp, keys, looping);
+    l.stretch = stretch;
+    l.start_time = Tick::from_seconds_f64(start);
+    comp.layers = vec![l].into();
+    let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    (p, cid)
+}
+
+fn clip_frame(p: &Project, cid: ItemId, t: Tick) -> crate::Image {
+    crate::Renderer::new(p, &SlidingModels, crate::RenderOpts::default()).comp_frame(cid, t)
+}
+
+/// The pose of the clip `elapsed` seconds in: clip 1 selected statically, played on the layer
+/// clock.
+fn clip_pose(looping: bool, elapsed: f64) -> crate::Image {
+    let (p, cid) = clip_scene(&[], looping, 100.0, 0.0);
+    clip_frame(&p, cid, Tick::from_seconds_f64(elapsed))
+}
+
+fn assert_poses(p: &Project, cid: ItemId, looping: bool, cases: &[(f64, f64)]) {
+    for &(t, elapsed) in cases {
+        let at = clip_frame(p, cid, Tick::from_seconds_f64(t));
+        assert_same(&at, &clip_pose(looping, elapsed), &format!("at {t}s the clip is {elapsed}s in"));
+    }
+}
+
+#[test]
+fn a_static_clip_plays_on_the_layer_clock() {
+    let xs: Vec<f32> = [0.0, 0.25, 0.75, 1.0].iter().map(|&e| cover_x(&clip_pose(false, e))).collect();
+    assert!(xs.windows(2).all(|w| w[1] > w[0] + 5.0), "the clip slides the triangle right: {xs:?}");
+    assert_same(&clip_pose(true, 1.25), &clip_pose(true, 0.25), "a looping clip wraps on the layer clock");
+}
+
+#[test]
+fn a_clip_keyed_on_later_starts_from_its_first_frame() {
+    let (p, cid) = clip_scene(&[(0.0, 0), (3.0, 1)], false, 100.0, 0.0);
+    assert_poses(&p, cid, false, &[(3.0, 0.0), (3.25, 0.25), (3.75, 0.75), (4.0, 1.0), (5.0, 1.0)]);
+}
+
+#[test]
+fn a_looping_clip_keyed_on_later_loops_from_its_activation() {
+    let (p, cid) = clip_scene(&[(0.0, 0), (2.5, 1)], true, 100.0, 0.0);
+    assert_poses(&p, cid, true, &[(2.75, 0.25), (3.75, 0.25)]);
+}
+
+#[test]
+fn a_clip_reselected_after_none_restarts() {
+    let (p, cid) = clip_scene(&[(0.0, 1), (1.5, 0), (3.0, 1)], false, 100.0, 0.0);
+    assert_poses(&p, cid, false, &[(0.5, 0.5), (3.25, 0.25)]);
+}
+
+#[test]
+fn a_repeated_key_of_the_same_clip_does_not_restart_it() {
+    let (p, cid) = clip_scene(&[(0.0, 0), (2.0, 1), (3.0, 1)], false, 100.0, 0.0);
+    assert_poses(&p, cid, false, &[(2.5, 0.5), (3.25, 1.25)]);
+}
+
+#[test]
+fn seeking_a_keyed_clip_poses_it_the_same_in_any_order() {
+    let (p, cid) = clip_scene(&[(0.0, 0), (3.0, 1)], false, 100.0, 0.0);
+    let cache = crate::LayerCache::default();
+    let mut r = crate::Renderer::new(&p, &SlidingModels, crate::RenderOpts::default());
+    r.cache = Some(&cache);
+    for (t, elapsed) in [(4.0, 1.0), (3.25, 0.25), (3.0, 0.0), (3.75, 0.75), (3.25, 0.25), (4.0, 1.0)] {
+        let at = r.comp_frame(cid, Tick::from_seconds_f64(t));
+        assert_same(&at, &clip_pose(false, elapsed), &format!("seek to {t}s: the clip is {elapsed}s in"));
+    }
+}
+
+#[test]
+fn a_stretched_layer_times_its_clip_from_activation_in_layer_time() {
+    let (p, cid) = clip_scene(&[(0.0, 0), (1.5, 1)], false, 200.0, 0.0);
+    let t = p.comp(cid).unwrap().layers[0].comp_time(Tick::from_seconds_f64(1.75));
+    assert_same(&clip_frame(&p, cid, t), &clip_pose(false, 0.25), "layer time 1.75 s: the clip is 0.25 s in");
+}
+
+#[test]
+fn a_reversed_layer_times_its_clip_from_activation_in_layer_time() {
+    let (p, cid) = clip_scene(&[(0.0, 0), (3.0, 1)], false, -100.0, 5.0);
+    let l = &p.comp(cid).unwrap().layers[0];
+    let t = l.comp_time(Tick::from_seconds_f64(3.25));
+    assert!(l.is_active_at(t), "the reversed layer is on at {t:?}");
+    assert_same(&clip_frame(&p, cid, t), &clip_pose(false, 0.25), "layer time 3.25 s: the clip is 0.25 s in");
+}
+
+#[test]
+fn an_expression_driven_clip_keeps_the_layer_clock() {
+    let (mut p, cid) = clip_scene(&[(0.0, 0), (2.5, 1)], true, 100.0, 0.0);
+    let clip = p.comp_mut(cid).unwrap().layers[0].props.prop_mut("geometryOptions/animation").unwrap();
+    clip.expr = Some(effectcraft_project::Expression { text: "value".into(), enabled: true });
+    assert_poses(&p, cid, true, &[(3.25, 3.25)]);
+    assert!((cover_x(&clip_pose(true, 3.25)) - cover_x(&clip_pose(true, 0.75))).abs() > 5.0, "the layer clock and the activation clock disagree");
+}
+
+/// The sliding model keyed None, then clip 1 at 3 s, in a collapsed 3D precomp; `overridden`
+/// sets the clip through its Essential Property, and `copy` adds a 3D Layer Instance of it.
+fn collapsed_clip_scene(overridden: bool, copy: bool) -> (Project, ItemId) {
+    use effectcraft_project::essential::{self, EgControl, EgKind, EssentialGraphics};
+    let mut p = Project::default();
+    p.settings.bit_depth = effectcraft_project::BitDepth::Bpc32;
+    let (mut inner, mut outer) = (clip_comp(), clip_comp());
+    let model = sliding_model(&mut p, &inner, &[(0.0, 0), (3.0, 1)], false);
+    let prop = model.props.prop("geometryOptions/animation").unwrap().uid;
+    let kind = EgKind::Property { layer: model.id, prop, links: vec![] };
+    inner.essential = Some(EssentialGraphics { controls: vec![EgControl { id: 1, name: "Clip".into(), kind, as_type: None }], ..Default::default() });
+    let mut layers = vec![];
+    if copy {
+        let mut owner = solid(&mut p, &inner, [1.0, 1.0, 1.0], 200, 100);
+        add_effect_200(&mut p, &mut owner, "ec.3d.instance3d", &[("layer", Value::Layer(Some(model.id.0)))]);
+        layers.push(owner);
+    }
+    layers.push(model);
+    inner.layers = layers.into();
+    let iid = p.add_item("Inner", Label::Sandstone, None, ItemKind::Comp(inner.into()));
+    let mut pre = build::layer(&mut p, &outer, "Inner", LayerSource::Comp { item: iid }, (200, 100), None);
+    pre.switches.three_d = true;
+    pre.switches.collapse = true;
+    if overridden {
+        let mut ids = Ids(&mut p.next_id);
+        let control = ids.prop(&essential::match_id(1), "Clip", Value::Enum(1));
+        let mut group = ids.group(essential::GROUP, "Essential Properties");
+        group.kind = effectcraft_project::GroupKind::Essential { overridden: vec![control.uid] };
+        group.children.push(control.into());
+        pre.props.children.push(group.into());
+    }
+    outer.layers = vec![pre].into();
+    let cid = p.add_item("Outer", Label::Sandstone, None, ItemKind::Comp(outer.into()));
+    (p, cid)
+}
+
+#[test]
+fn an_essential_property_override_of_the_clip_keeps_the_layer_clock() {
+    let (p, cid) = collapsed_clip_scene(true, false);
+    assert_poses(&p, cid, false, &[(1.0, 1.0), (3.25, 3.25)]);
+    assert!((cover_x(&clip_pose(false, 3.25)) - cover_x(&clip_pose(false, 0.25))).abs() > 5.0, "the layer clock and the activation clock disagree");
+}
+
+/// The keyed clip and its override select the same clip at 3.25 s but pose it 0.25 s and
+/// 3.25 s in: a 3D Layer Instance of one is not served the other's pixels.
+#[test]
+fn a_copy_of_an_overridden_clip_is_not_served_the_keyed_clips_pixels() {
+    let t = Tick::from_seconds_f64(3.25);
+    let cache = crate::LayerCache::default();
+    let render = |(p, cid): &(Project, ItemId), cache: Option<&crate::LayerCache>| {
+        let mut r = crate::Renderer::new(p, &SlidingModels, crate::RenderOpts::default());
+        r.cache = cache;
+        r.comp_frame(*cid, t)
+    };
+    let (keyed, overridden) = (collapsed_clip_scene(false, true), collapsed_clip_scene(true, true));
+    assert_same(&render(&keyed, Some(&cache)), &render(&keyed, None), "the keyed clip's copy");
+    assert_same(&render(&overridden, Some(&cache)), &render(&overridden, None), "the overridden clip's copy");
+}
diff --git a/crates/render/src/tests_audio_fx.rs b/crates/render/src/tests/audio_fx.rs
similarity index 82%
rename from crates/render/src/tests_audio_fx.rs
rename to crates/render/src/tests/audio_fx.rs
index aced8208e..a6c85f2de 100644
--- a/crates/render/src/tests_audio_fx.rs
+++ b/crates/render/src/tests/audio_fx.rs
@@ -2,7 +2,7 @@
 
 use std::sync::Arc;
 
-use effectcraft_keyframe::Value;
+use effectcraft_keyframe::{Keyframe, Value};
 use effectcraft_project::build::{self, Ids};
 use effectcraft_project::{Comp, Footage, FootageKind, ItemId, ItemKind, LayerSource, Project, Solid};
 use effectcraft_time::{FrameRate, Tick};
@@ -78,7 +78,7 @@ fn comp_with(id: Option<&str>, vals: &[(&str, Value)], solid: bool) -> (Project,
         l.props.sub_mut("effects").unwrap().children.push(g.into());
     }
     let mut comp = comp;
-    comp.layers = vec![l];
+    comp.layers = vec![l].into();
     let cid = p.add_item("C", effectcraft_color::Label::Sandstone, None, ItemKind::Comp(comp.into()));
     (p, cid)
 }
@@ -148,6 +148,42 @@ fn stereo_mixer_pans() {
     assert!(m.chunks(2).all(|f| f[0].abs() < 1e-6 && (f[1] - 0.5).abs() < 1e-6), "{:?}", &m[..4]);
 }
 
+/// Key `prop` of layer 0 (`effect`: in its first effect, else in Audio) from `a` at 0 s to `b` at 1 s.
+fn key(p: &mut Project, cid: ItemId, effect: bool, prop: &str, a: Value, b: Value) {
+    let l = &mut p.comp_mut(cid).unwrap().layers[0];
+    let g = if effect { l.props.sub_mut("effects").unwrap().children[0].as_group_mut().unwrap() } else { l.props.sub_mut("audio").unwrap() };
+    g.get_mut(prop).unwrap().keys = vec![Keyframe::new(Tick::ZERO, a), Keyframe::new(Tick::from_seconds_f64(1.0), b)];
+}
+
+/// Left samples of a mix of constant 0.5 audio over the layer's 1 s, in blocks of `block` samples.
+fn left_ramp(p: &Project, cid: ItemId, block: usize) -> Vec<f32> {
+    fn half(_: f64) -> (f32, f32) {
+        (0.5, 0.5)
+    }
+    let mut m = vec![];
+    for k in 0..SR as usize / block {
+        m.extend(mix(p, &Signal(half), cid, (k * block) as f64 / SR as f64, block));
+    }
+    m.iter().step_by(2).copied().collect()
+}
+
+/// Keyframed Audio Levels and Stereo Mixer levels ramp smoothly inside a block (export mixes one
+/// second at a time), instead of holding the value at the block's first sample.
+#[test]
+fn animated_levels_ramp_within_a_block() {
+    let (mut levels, lc) = comp_with(None, &[], false);
+    key(&mut levels, lc, false, "levels", Value::Vec2([-60.0, -60.0]), Value::Vec2([0.0, 0.0]));
+    let (mut mixer, mc) = comp_with(Some("ec.audio.stereomixer"), &[], false);
+    key(&mut mixer, mc, true, "leftLevel", Value::Scalar(0.0), Value::Scalar(100.0));
+    for (name, p, cid, mid) in [("levels", &levels, lc, 0.5 * 10f32.powf(-1.5)), ("stereo mixer", &mixer, mc, 0.25)] {
+        let one = left_ramp(p, cid, SR as usize);
+        assert!(one.windows(2).all(|w| w[1] >= w[0]), "{name}: not monotonic");
+        assert!(one[100] < one[4000] && one[4000] < one[7900], "{name}: {} {} {}", one[100], one[4000], one[7900]);
+        assert!((one[4000] / mid - 1.0).abs() < 0.05, "{name}: {} at 0.5 s, want {mid}", one[4000]);
+        assert_eq!(one, left_ramp(p, cid, 320), "{name}: block size changes the result");
+    }
+}
+
 #[test]
 fn tone_makes_a_solid_audible_at_its_frequency() {
     let mut vals: Vec<(&str, Value)> = vec![("frequency1", Value::Scalar(500.0))];
@@ -236,7 +272,7 @@ fn audio_spectrum_follows_time_through_the_layer_cache() {
     g.prop_mut("audioLayer").unwrap().value = Value::Layer(Some(a.id.0));
     s.props.sub_mut("effects").unwrap().children.push(g.into());
     let mut comp = comp;
-    comp.layers = vec![s, a];
+    comp.layers = vec![s, a].into();
     let cid = p.add_item("C", effectcraft_color::Label::Sandstone, None, ItemKind::Comp(comp.into()));
 
     let src = Signal(late_tone);
diff --git a/crates/render/src/tests_auto.rs b/crates/render/src/tests/auto.rs
similarity index 66%
rename from crates/render/src/tests_auto.rs
rename to crates/render/src/tests/auto.rs
index c34321cea..22f1a6215 100644
--- a/crates/render/src/tests_auto.rs
+++ b/crates/render/src/tests/auto.rs
@@ -9,31 +9,31 @@ use effectcraft_time::{FrameRate, Tick};
 
 use crate::{Accelerator, AutoKey, AutoPick, Backend, NoFootage, RenderOpts, Renderer};
 
-/// An accelerator that takes `delay` per frame (or declines with `handle = false`) and keeps
-/// Auto timing history.
-struct TimedAccel {
-    delay: std::time::Duration,
+/// An accelerator that returns a representative pixel (or declines) and keeps Auto history.
+struct MockAccel {
     handle: bool,
     calls: AtomicUsize,
     pick: AutoPick,
 }
 
-impl TimedAccel {
-    fn new(ms: u64, handle: bool) -> TimedAccel {
-        TimedAccel { delay: std::time::Duration::from_millis(ms), handle, calls: Default::default(), pick: Default::default() }
+impl MockAccel {
+    /// Construct a renderer stand-in without making assumptions about scheduling or speed.
+    fn new(handle: bool) -> MockAccel {
+        MockAccel { handle, calls: Default::default(), pick: Default::default() }
     }
+    /// Number of full-frame requests dispatched to this accelerator.
     fn calls(&self) -> usize {
         self.calls.load(Ordering::SeqCst)
     }
 }
 
-impl Accelerator for TimedAccel {
+impl Accelerator for MockAccel {
     fn name(&self) -> String {
         "timed".into()
     }
+    /// Count dispatched frames and return the same centre pixel as the CPU fixture.
     fn comp_frame(&self, _r: &Renderer, _comp: ItemId, _t: Tick) -> Option<crate::Image> {
         self.calls.fetch_add(1, Ordering::SeqCst);
-        std::thread::sleep(self.delay);
         // The centre of the comp, as the CPU draws it (a red solid).
         self.handle.then(|| {
             let mut img = crate::Image::new(200, 100);
@@ -52,6 +52,7 @@ impl Accelerator for TimedAccel {
     }
 }
 
+/// A small red solid whose centre pixel is shared by the CPU and mock GPU fixtures.
 fn project() -> (Project, ItemId) {
     let mut p = Project::default();
     p.settings.gpu_acceleration = true;
@@ -64,7 +65,7 @@ fn project() -> (Project, ItemId) {
 }
 
 /// Render `n` frames with `backend`; how many the accelerator was asked for.
-fn frames(p: &Project, cid: ItemId, a: &TimedAccel, backend: Backend, n: usize) -> usize {
+fn frames(p: &Project, cid: ItemId, a: &MockAccel, backend: Backend, n: usize) -> usize {
     let before = a.calls();
     for _ in 0..n {
         let mut r = Renderer::new(p, &NoFootage, RenderOpts { backend, ..Default::default() });
@@ -76,50 +77,60 @@ fn frames(p: &Project, cid: ItemId, a: &TimedAccel, backend: Backend, n: usize)
     a.calls() - before
 }
 
+/// Drive the production selector with measured costs supplied by the test, not the OS clock.
+fn measured_frames(pick: &AutoPick, key: AutoKey, cpu_ms: f64, gpu_ms: f64, n: usize) -> usize {
+    (0..n)
+        .filter(|_| {
+            let gpu = pick.choose(key);
+            pick.record(key, gpu, if gpu { gpu_ms } else { cpu_ms });
+            gpu
+        })
+        .count()
+}
+
+/// A slower GPU is periodically re-probed; explicit GPU and Software Only ignore that history.
 #[test]
 fn auto_backend_moves_light_comps_to_the_cpu() {
-    // A light comp on a slow accelerator: after the warm-up (three frames on
-    // each side) Auto renders on the CPU, re-measuring the accelerator now and then.
     let (p, cid) = project();
-    // Several times the CPU's frame time (unoptimised test builds are slow).
-    let t0 = std::time::Instant::now();
-    for _ in 0..3 {
-        Renderer::new(&p, &NoFootage, RenderOpts::default()).comp_frame(cid, Tick::ZERO);
-    }
-    let cpu_ms = t0.elapsed().as_millis() as u64 / 3;
-    let slow = TimedAccel::new((cpu_ms * 5).max(20), true);
+    let slow = MockAccel::new(true);
+    let key = AutoKey::new(cid, 1.0, false);
     let n = 6 + 2 * AutoPick::REPROBE as usize;
-    let asked = frames(&p, cid, &slow, Backend::Auto, n);
+    let asked = measured_frames(&slow.pick, key, 1.0, 20.0, n);
     assert!((3..=5).contains(&asked), "asked the slow accelerator {asked} times in {n} frames");
-    let s = slow.pick.stats(AutoKey::new(cid, 1.0, false)).unwrap();
+    let s = slow.pick.stats(key).unwrap();
     assert!(s.gpu_ms.unwrap() > s.cpu_ms.unwrap(), "{s:?}");
-    // Backend::Gpu ignores the history; Software Only never asks.
+    // Check renderer wiring with known history before a real measurement can change it.
+    assert_eq!(frames(&p, cid, &slow, Backend::Auto, 1), 0);
     assert_eq!(frames(&p, cid, &slow, Backend::Gpu, 3), 3);
     let mut sw = p.clone();
     sw.settings.gpu_acceleration = false;
     assert_eq!(frames(&sw, cid, &slow, Backend::Auto, 3), 0);
 }
 
+/// Faster, tied and slightly noisier GPU costs stay on the GPU except during warm-up/probes.
 #[test]
 fn auto_backend_keeps_fast_accelerators() {
-    // As fast as the CPU (ties stay on the accelerator): every frame but the CPU warm-up and
-    // re-probes.
     let (p, cid) = project();
-    let fast = TimedAccel::new(0, true);
-    let asked = frames(&p, cid, &fast, Backend::Auto, 40);
-    assert!(asked >= 36, "asked {asked} of 40");
+    for gpu_ms in [1.0, 5.0, 5.5] {
+        let fast = MockAccel::new(true);
+        let asked = measured_frames(&fast.pick, AutoKey::new(cid, 1.0, false), 5.0, gpu_ms, 40);
+        assert!(asked >= 36, "asked {asked} of 40 for GPU cost {gpu_ms}");
+        assert_eq!(frames(&p, cid, &fast, Backend::Auto, 1), 1);
+    }
 }
 
+/// A declining accelerator is retried only periodically while the CPU supplies frames.
 #[test]
 fn auto_backend_falls_back_when_the_accelerator_declines() {
     let (p, cid) = project();
-    let declining = TimedAccel::new(0, false);
+    let declining = MockAccel::new(false);
     let n = 2 * AutoPick::REPROBE as usize;
     let asked = frames(&p, cid, &declining, Backend::Auto, n);
     // Asked first, then only on the periodic re-probes.
     assert!((1..=4).contains(&asked), "asked {asked} times in {n} frames");
 }
 
+/// Periodic probes detect a formerly slow GPU becoming faster, without mixing cache keys.
 #[test]
 fn auto_pick_follows_changing_costs() {
     let pick = AutoPick::default();
diff --git a/crates/render/src/tests_aux.rs b/crates/render/src/tests/aux_channels.rs
similarity index 100%
rename from crates/render/src/tests_aux.rs
rename to crates/render/src/tests/aux_channels.rs
diff --git a/crates/render/src/tests_collapse.rs b/crates/render/src/tests/collapse.rs
similarity index 80%
rename from crates/render/src/tests_collapse.rs
rename to crates/render/src/tests/collapse.rs
index 797960033..4104e0b38 100644
--- a/crates/render/src/tests_collapse.rs
+++ b/crates/render/src/tests/collapse.rs
@@ -3,7 +3,7 @@
 use effectcraft_color::{BlendMode, Label};
 use effectcraft_keyframe::{TextDoc, Value};
 use effectcraft_project::build::{self, Ids};
-use effectcraft_project::{BitDepth, Comp, ItemId, ItemKind, Layer, LayerSource, Project, Quality, Solid};
+use effectcraft_project::{BitDepth, Comp, FrameBlend, ItemId, ItemKind, Layer, LayerSource, Project, Quality, Solid};
 use effectcraft_time::{FrameRate, Tick};
 
 use crate::{EvalCtx, Image, NoFootage, RenderOpts, Renderer, render_frame};
@@ -53,17 +53,17 @@ fn scene(collapse: bool, flatten: bool) -> (Project, ItemId) {
         a.parent = Some(null.id);
         b.parent = Some(null.id);
         let mut c = outer.clone();
-        c.layers = vec![null, b, a, bg];
+        c.layers = vec![null, b, a, bg].into();
         p.add_item("Outer", Label::Sandstone, None, ItemKind::Comp(c.into()))
     } else {
         let mut inner = inner;
-        inner.layers = vec![b, a];
+        inner.layers = vec![b, a].into();
         let iid = p.add_item("Inner", Label::Sandstone, None, ItemKind::Comp(inner.into()));
         let mut pre = build::layer(&mut p, &outer, "Inner", LayerSource::Comp { item: iid }, (100, 100), None);
         xf(&mut pre);
         pre.switches.collapse = collapse;
         let mut c = outer.clone();
-        c.layers = vec![pre, bg];
+        c.layers = vec![pre, bg].into();
         p.add_item("Outer", Label::Sandstone, None, ItemKind::Comp(c.into()))
     };
     (p, cid)
@@ -110,6 +110,75 @@ fn masks_on_a_collapsed_layer_force_a_flattened_render() {
     assert!(max_diff(&a, &b) < 1e-4, "{}", max_diff(&a, &b));
 }
 
+/// #1747: the flattened path honours a composition proxy and frame blending; a collapsed layer
+/// renders the nested comp directly and ignores both, so such a layer must not collapse.
+#[test]
+fn proxy_and_frame_blending_keep_a_precomp_on_the_flattened_path() {
+    let (mut p, cid) = scene(true, false);
+    let id = p.comp(cid).unwrap().layers[0].id;
+    let collapses = |p: &Project| {
+        let r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        let ctx = EvalCtx::new(p, cid, p.comp(cid).unwrap(), Tick::ZERO);
+        r.collapsed(&ctx, ctx.comp.layer(id).unwrap()).is_some()
+    };
+    assert!(collapses(&p), "a plain precomp collapses");
+    // Frame blending needs both the comp's switch and the layer's.
+    p.comp_mut(cid).unwrap().enable_frame_blending = true;
+    p.comp_mut(cid).unwrap().layers[0].switches.frame_blend = FrameBlend::FrameMix;
+    assert!(!collapses(&p), "frame blending keeps the flattened path");
+    p.comp_mut(cid).unwrap().enable_frame_blending = false;
+    p.comp_mut(cid).unwrap().layers[0].switches.frame_blend = FrameBlend::Off;
+    // A composition proxy stands in for the precomp's pixels.
+    let LayerSource::Comp { item } = p.comp(cid).unwrap().layers[0].source else { panic!("a precomp layer") };
+    let proxy =
+        effectcraft_project::Proxy { footage: effectcraft_project::Footage { has_video: true, width: 32, height: 32, ..Default::default() }, enabled: true };
+    p.item_mut(item).unwrap().proxy = Some(Box::new(proxy));
+    assert!(!collapses(&p), "a proxy keeps the flattened path");
+}
+
+/// #1747: an effect on B that reads A must not reuse its cached buffer when two collapsed
+/// instances give A different static overrides (`hash_values` only sees animated values).
+#[test]
+fn referenced_layer_overrides_change_the_owner_cache_key() {
+    let mut p = project();
+    let comp = Comp::new(100, 100, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+    let a = solid(&mut p, &comp, [1.0, 1.0, 1.0], (40, 40), [30.0, 50.0, 0.0]);
+    let aid = a.id;
+    let mut b = solid(&mut p, &comp, [1.0, 1.0, 1.0], (100, 100), [50.0, 50.0, 0.0]);
+    let bid = b.id;
+    let mut next = p.next_id;
+    let mut ids = Ids(&mut next);
+    let spec = effectcraft_effects::find("ec.channel.setmatte").unwrap();
+    let mut fx = effectcraft_effects::instantiate(spec, &mut ids, spec.name, [100.0, 100.0]);
+    fx.prop_mut("takeMatteFromLayer").unwrap().value = Value::Layer(Some(a.id.0));
+    p.next_id = next;
+    b.props.sub_mut("effects").unwrap().children.push(fx.into());
+    let mut c = comp;
+    c.layers = vec![b, a].into();
+    let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(c.into()));
+    let comp = p.comp(cid).unwrap();
+    let b = comp.layer(bid).unwrap();
+    let opacity = comp.layer(aid).unwrap().props.prop("transform/opacity").unwrap().uid;
+    let key = |value: f64| {
+        let overrides = [crate::PropertyOverride { layer: aid, prop: opacity, value: Value::Scalar(value), font: false }];
+        let ctx = EvalCtx {
+            project: &p,
+            comp_id: cid,
+            comp,
+            time: Tick::ZERO,
+            expr: None,
+            footage: None,
+            property_overrides: &overrides,
+            media_overrides: &[],
+            reads: None,
+        };
+        crate::cache::layer_key(&ctx, b, 1.0, false, false)
+    };
+    let (opaque, half) = (key(100.0), key(50.0));
+    assert!(opaque.is_some(), "the owner is cacheable");
+    assert_ne!(opaque, half, "A's static override changes B's key");
+}
+
 #[test]
 fn collapsed_3d_layers_join_the_parent_scene() {
     // Parent: a red 3D solid at z = 0 above (in the stack) a collapsed 3D precomp holding a
@@ -122,7 +191,7 @@ fn collapsed_3d_layers_join_the_parent_scene() {
         let mut blue = solid(&mut p, &inner, [0.0, 0.0, 1.0], (60, 60), [100.0, 100.0, -200.0]);
         blue.switches.three_d = true;
         let mut inner = inner;
-        inner.layers = vec![blue];
+        inner.layers = vec![blue].into();
         let iid = p.add_item("Inner", Label::Sandstone, None, ItemKind::Comp(inner.into()));
         let mut pre = build::layer(&mut p, &outer, "Inner", LayerSource::Comp { item: iid }, (200, 200), None);
         pre.switches.three_d = true;
@@ -130,7 +199,7 @@ fn collapsed_3d_layers_join_the_parent_scene() {
         let mut red = solid(&mut p, &outer, [1.0, 0.0, 0.0], (100, 100), [100.0, 100.0, 0.0]);
         red.switches.three_d = true;
         let mut c = outer;
-        c.layers = vec![red, pre];
+        c.layers = vec![red, pre].into();
         let cid = p.add_item("Outer", Label::Sandstone, None, ItemKind::Comp(c.into()));
         render_frame(&p, cid, Tick::ZERO, 1.0).get(100, 100)
     };
@@ -168,11 +237,11 @@ fn scaled_square(cr: bool, via_parent: bool) -> Image {
         set(&mut null, "transform/scale", Value::Vec3([800.0, 800.0, 100.0]));
         set(&mut l, "transform/position", Value::Vec3([0.0, 0.0, 0.0]));
         l.parent = Some(null.id);
-        c.layers = vec![l, null];
+        c.layers = vec![l, null].into();
     } else {
         set(&mut l, "transform/position", Value::Vec3([100.3, 100.3, 0.0]));
         set(&mut l, "transform/scale", Value::Vec3([800.0, 800.0, 100.0]));
-        c.layers = vec![l];
+        c.layers = vec![l].into();
     }
     let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(c.into()));
     render_frame(&p, cid, Tick::ZERO, 1.0)
@@ -201,7 +270,7 @@ fn wireframe_quality_draws_the_layer_bounds() {
     let mut l = solid(&mut p, &comp, [1.0, 0.0, 0.0], (40, 40), [50.0, 50.0, 0.0]);
     l.switches.quality = Quality::Wireframe;
     let mut c = comp;
-    c.layers = vec![l];
+    c.layers = vec![l].into();
     let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(c.into()));
     let img = render_frame(&p, cid, Tick::ZERO, 1.0);
     assert_eq!(img.get(50, 50)[3], 0.0, "no fill");
@@ -212,7 +281,7 @@ fn wireframe_quality_draws_the_layer_bounds() {
     let mut l = solid(&mut p, &comp, [1.0, 1.0, 1.0], (40, 40), [50.5, 50.0, 0.0]);
     l.switches.quality = Quality::Draft;
     let mut c = comp;
-    c.layers = vec![l];
+    c.layers = vec![l].into();
     let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(c.into()));
     let img = render_frame(&p, cid, Tick::ZERO, 1.0);
     assert!(img.data.iter().all(|q| q[3] == 0.0 || q[3] == 1.0));
@@ -230,13 +299,13 @@ fn collapsed_precomp_of_another_size_renders_through_the_parent_camera() {
         let mut blue = solid(&mut p, &inner, [0.0, 0.0, 1.0], (40, 40), [500.0, 300.0, 0.0]);
         blue.switches.three_d = true;
         let mut inner = inner;
-        inner.layers = vec![blue];
+        inner.layers = vec![blue].into();
         let iid = p.add_item("Scene", Label::Sandstone, None, ItemKind::Comp(inner.into()));
         let mut pre = build::layer(&mut p, &outer, "Scene", LayerSource::Comp { item: iid }, (1000, 600), None);
         pre.switches.three_d = three_d_precomp;
         pre.switches.collapse = true;
         let mut c = outer.clone();
-        c.layers = vec![pre];
+        c.layers = vec![pre].into();
         if camera {
             let cam = build::layer(&mut p, &outer, "Camera", LayerSource::Camera, (300, 200), None);
             c.layers.insert(0, cam);
@@ -267,7 +336,7 @@ fn text_scaled_up_stays_sharp_without_the_switch() {
         set(&mut l, "transform/scale", Value::Vec3([scale, scale, 100.0]));
         assert!(!l.switches.collapse);
         let mut c = comp;
-        c.layers = vec![l];
+        c.layers = vec![l].into();
         let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(c.into()));
         render_frame(&p, cid, Tick::ZERO, 1.0)
     };
@@ -291,7 +360,7 @@ fn unscaled_text_rasterises_at_the_output_scale() {
     let mut comp = Comp::new(240, 160, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
     let mut l = build::layer(&mut p, &comp, "Text", LayerSource::Text, (240, 160), None);
     l.props.prop_mut("text/sourceText").unwrap().value = Value::Text(Box::new(TextDoc { text: "HE".into(), size: 30.0, ..Default::default() }));
-    comp.layers = vec![l];
+    comp.layers = vec![l].into();
     let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.into()));
     for i in 0..500 {
         let pos = [3.1 + i as f64 * 0.37, 7.3 + i as f64 * 0.29, 0.0];
@@ -327,7 +396,7 @@ fn effects_on_a_scaled_shape_follow_its_scale() {
         set(&mut l, "transform/position", Value::Vec3([100.0, 100.0, 0.0]));
         set(&mut l, "transform/scale", Value::Vec3([scale, scale, 100.0]));
         let mut c = comp;
-        c.layers = vec![l];
+        c.layers = vec![l].into();
         let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(c.into()));
         render_frame(&p, cid, Tick::ZERO, 1.0)
     };
diff --git a/crates/render/src/tests_color.rs b/crates/render/src/tests/color.rs
similarity index 86%
rename from crates/render/src/tests_color.rs
rename to crates/render/src/tests/color.rs
index 29e4d62c2..4e5cff574 100644
--- a/crates/render/src/tests_color.rs
+++ b/crates/render/src/tests/color.rs
@@ -339,3 +339,49 @@ fn float_footage_is_encoded_once_with_the_working_gamma() {
         assert_eq!(render(2.4, Some(ColorSpace::Srgb), linear_light), srgb);
     }
 }
+
+/// `RenderOpts::skip_hdr_step` (float outputs) skips Project Settings ▸ HDR: its top-level frame
+/// is the Clip frame in every mode, while other renders keep compand / tone mapping.
+#[test]
+fn skip_hdr_step_frames_are_the_clip_frames() {
+    use effectcraft_project::HdrMode;
+    for depth in [BitDepth::Bpc8, BitDepth::Bpc16, BitDepth::Bpc32] {
+        let (mut p, cid, _) = setup(depth);
+        p.settings.working_space = Some(ColorSpace::Srgb);
+        p.settings.linearize = true;
+        add_solid(&mut p, cid, [4.0, 2.0, 0.5], BlendMode::Normal, 100.0);
+        let frame = |p: &Project, skip_hdr_step: bool| {
+            Renderer::new(p, &crate::NoFootage, RenderOpts { skip_hdr_step, ..Default::default() }).comp_frame(cid, Tick::ZERO)
+        };
+        let clip = frame(&p, false);
+        assert_eq!(clip.data, frame(&p, true).data, "{depth:?} Clip");
+        for mode in [HdrMode::Compand, HdrMode::ToneMap] {
+            p.settings.hdr = mode;
+            assert_eq!(frame(&p, true).data, clip.data, "{depth:?} {mode:?}");
+            assert_ne!(frame(&p, false).data, clip.data, "{depth:?} {mode:?} keeps the HDR step");
+        }
+    }
+}
+
+/// `Pipe::output_linear` decodes with the output space's curve (the Working Gamma's when
+/// unmanaged) and undoes `Pipe::output` exactly where the primaries match.
+#[test]
+fn output_linear_decodes_with_the_output_curve() {
+    use effectcraft_color::Conversion;
+    use effectcraft_project::ProjectSettings;
+    let pipe = |ws: Option<ColorSpace>, out: Option<ColorSpace>, gamma: f64| {
+        crate::color::Pipe::of(&ProjectSettings { working_space: ws, output_space: out, working_gamma: gamma, ..Default::default() })
+    };
+    assert_eq!(pipe(None, None, 2.2).output_linear(), Conversion::linearize(ColorSpace::Srgb));
+    assert_eq!(pipe(None, Some(ColorSpace::DisplayP3), 2.4).output_linear(), Conversion::linearize(ColorSpace::Rec709), "unmanaged: the Working Gamma");
+    assert_eq!(pipe(Some(ColorSpace::Srgb), None, 2.4).output_linear(), Conversion::linearize(ColorSpace::Srgb));
+    assert_eq!(pipe(Some(ColorSpace::Srgb), Some(ColorSpace::Rec709), 2.2).output_linear(), Conversion::linearize(ColorSpace::Rec709));
+    // Linear light in, linear light out: 4.0 stays 4.0 through output + output_linear.
+    let p = pipe(Some(ColorSpace::Rec709), Some(ColorSpace::Srgb), 2.2);
+    let p = crate::color::Pipe { linear: true, ..p };
+    let enc = p.output().unwrap().apply([4.0, 1.0, 0.25]);
+    let lin = p.output_linear().apply(enc);
+    for (got, want) in lin.into_iter().zip([4.0, 1.0, 0.25]) {
+        assert!((got - want).abs() <= 1e-5 * want, "{lin:?}");
+    }
+}
diff --git a/crates/render/src/tests_footage_size.rs b/crates/render/src/tests/footage_size.rs
similarity index 73%
rename from crates/render/src/tests_footage_size.rs
rename to crates/render/src/tests/footage_size.rs
index 88df726e9..065941d8a 100644
--- a/crates/render/src/tests_footage_size.rs
+++ b/crates/render/src/tests/footage_size.rs
@@ -81,3 +81,28 @@ fn reduced_renders_take_footage_resampled_by_the_source() {
     Renderer::new(&p, &sized, RenderOpts { scale: 0.5, ..Default::default() }).comp_frame(cid, Tick::ZERO);
     assert!(sized.sizes.unwrap().into_inner().unwrap().is_empty());
 }
+
+/// #1812: a still's layer is kept in the layer cache across times (its texture then uploads to
+/// the GPU once, not every frame); a movie's is fetched again at every time.
+#[test]
+fn still_layers_are_cached_across_times_and_movies_are_not() {
+    for (kind, fetches) in [(FootageKind::Still, 1), (FootageKind::Video, 3)] {
+        let (mut p, cid) = project(BitDepth::Bpc8, false);
+        let Some(LayerSource::Footage { item }) = p.comp(cid).map(|c| c.layers[0].source.clone()) else { panic!("footage layer") };
+        if let Some(ItemKind::Footage(f)) = p.item_mut(item).map(|it| &mut it.kind) {
+            f.kind = kind;
+        }
+        let cache = crate::LayerCache::default();
+        let src = Clip { sizes: Some(Mutex::default()) };
+        let opts = RenderOpts { scale: 0.5, ..Default::default() };
+        for t in [0.0, 0.25, 0.5] {
+            let t = Tick::from_seconds_f64(t);
+            let mut r = Renderer::new(&p, &src, opts);
+            r.cache = Some(&cache);
+            let frame = r.comp_frame(cid, t);
+            assert_eq!(frame, Renderer::new(&p, &src, opts).comp_frame(cid, t), "{kind:?} at {t:?}");
+        }
+        // (each uncached render above fetches once more)
+        assert_eq!(src.sizes.unwrap().into_inner().unwrap().len(), fetches + 3, "{kind:?}");
+    }
+}
diff --git a/crates/render/src/tests_frame_blend.rs b/crates/render/src/tests/frame_blend.rs
similarity index 96%
rename from crates/render/src/tests_frame_blend.rs
rename to crates/render/src/tests/frame_blend.rs
index 6cfbdb11b..ac3555af1 100644
--- a/crates/render/src/tests_frame_blend.rs
+++ b/crates/render/src/tests/frame_blend.rs
@@ -167,3 +167,10 @@ fn time_stretched_precomp_frame_mixes() {
     let img = crate::render_frame(&p, cid, FrameRate::FPS_30.tick_of(1), 1.0);
     assert!(img.get(12, 10)[3] < 1e-3 && (img.get(17, 10)[3] - 1.0).abs() < 1e-3 && (img.get(22, 10)[3] - 1.0).abs() < 1e-3 && img.get(27, 10)[3] < 1e-3);
 }
+
+#[test]
+fn frame_position_survives_degenerate_rates() {
+    for rate in [FrameRate { num: 24, den: 0 }, FrameRate { num: 0, den: 1 }, FrameRate { num: -24, den: 1 }] {
+        assert_eq!(frame_position(Tick(1_000_000), rate), (0, 0.0));
+    }
+}
diff --git a/crates/render/src/tests_guides.rs b/crates/render/src/tests/guides.rs
similarity index 98%
rename from crates/render/src/tests_guides.rs
rename to crates/render/src/tests/guides.rs
index cb9851250..44f3fc7b0 100644
--- a/crates/render/src/tests_guides.rs
+++ b/crates/render/src/tests/guides.rs
@@ -40,7 +40,7 @@ fn scene(nest: Nest) -> (Project, ItemId, ItemId) {
     guide.switches.guide = true;
     let bg = solid(&mut p, &inner, [1.0, 0.0, 0.0], (100, 100), three_d);
     let mut inner = inner;
-    inner.layers = vec![guide, bg];
+    inner.layers = vec![guide, bg].into();
     let iid = p.add_item("Inner", Label::Sandstone, None, ItemKind::Comp(inner.into()));
     let mut outer = Comp::new(100, 100, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
     if matches!(nest, Nest::CollapsedAdvanced) {
@@ -49,7 +49,7 @@ fn scene(nest: Nest) -> (Project, ItemId, ItemId) {
     let mut pre = build::layer(&mut p, &outer, "Inner", LayerSource::Comp { item: iid }, (100, 100), None);
     pre.switches.collapse = !matches!(nest, Nest::Precomp);
     pre.switches.three_d = three_d;
-    outer.layers = vec![pre];
+    outer.layers = vec![pre].into();
     let oid = p.add_item("Outer", Label::Sandstone, None, ItemKind::Comp(outer.into()));
     (p, iid, oid)
 }
diff --git a/crates/render/src/tests/mask_blur.rs b/crates/render/src/tests/mask_blur.rs
new file mode 100644
index 000000000..5f3ff4e2a
--- /dev/null
+++ b/crates/render/src/tests/mask_blur.rs
@@ -0,0 +1,106 @@
+//! Mask motion blur follows the renderer's motion blur gate: the render options (Render
+//! Settings ▸ Motion Blur, previews), the comp's switch and the precomp layers above.
+
+use effectcraft_color::Label;
+use effectcraft_keyframe::{Keyframe, ShapePath, Value};
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{Comp, GroupKind, ItemId, ItemKind, LayerSource, MaskMode, MaskMotionBlur, Node, Project, Solid};
+use effectcraft_time::{FrameRate, Tick};
+
+use crate::{NoFootage, RenderOpts, Renderer};
+
+/// A white 100×100 solid whose rect mask jumps from x 10 (frame 0) to x 50 (frame 1), Mask
+/// Motion Blur On, the layer's own switch off. Rendered half way, unblurred the mask covers x
+/// 30..50; blurred over the shutter it reaches down to x ≈ 20.
+fn project(comp_blur: bool) -> (Project, ItemId) {
+    let mut p = Project::default();
+    let mut comp = Comp::new(100, 100, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    comp.enable_motion_blur = comp_blur;
+    let sid = p.add_item("S", Label::Red, None, ItemKind::Solid(Solid { color: [1.0; 3], width: 100, height: 100, pixel_aspect: 1.0 }));
+    let mut l = build::layer(&mut p, &comp, "S", LayerSource::Solid { item: sid }, (100, 100), None);
+    let mut next = p.next_id;
+    let mut m = build::mask(&mut Ids(&mut next), "Mask 1", ShapePath::rect([20.0, 50.0], 20.0, 100.0), MaskMode::Add, [255, 0, 0]);
+    p.next_id = next;
+    if let GroupKind::Mask { motion_blur, .. } = &mut m.kind {
+        *motion_blur = MaskMotionBlur::On;
+    }
+    let path = m.get_mut("path").unwrap();
+    path.keys = vec![
+        Keyframe::new(Tick::ZERO, Value::Path(ShapePath::rect([20.0, 50.0], 20.0, 100.0))),
+        Keyframe::new(FrameRate::FPS_30.tick_of(1), Value::Path(ShapePath::rect([60.0, 50.0], 20.0, 100.0))),
+    ];
+    l.props.sub_mut("masks").unwrap().children.push(Node::Group(m));
+    l.switches.motion_blur = false;
+    let cid = p.add_item("C", Label::Sandstone, None, ItemKind::Comp(comp.into()));
+    p.comp_mut(cid).unwrap().layers.push(l);
+    (p, cid)
+}
+
+fn alpha_at_25(p: &Project, cid: ItemId, motion_blur: bool) -> f32 {
+    let half = Tick::from_seconds_f64(0.5 / 30.0);
+    Renderer::new(p, &NoFootage, RenderOpts { motion_blur, ..Default::default() }).comp_frame(cid, half).get(25, 50)[3]
+}
+
+/// A mask that holds from frame 0 to 2, then moves: frames 1 and 2 have the same mask value, but at
+/// frame 2 the shutter already sees it move. The layer cache must not serve frame 1's layer there.
+#[test]
+fn mask_motion_blur_keys_the_layer_cache_by_time() {
+    let (mut p, cid) = project(true);
+    let rect = |x: f64| Value::Path(ShapePath::rect([x, 50.0], 20.0, 100.0));
+    let l = &mut p.comp_mut(cid).unwrap().layers[0];
+    let Some(Node::Group(m)) = l.props.sub_mut("masks").unwrap().children.first_mut() else { panic!("mask") };
+    m.get_mut("path").unwrap().keys = vec![
+        Keyframe::new(Tick::ZERO, rect(20.0)),
+        Keyframe::new(FrameRate::FPS_30.tick_of(2), rect(20.0)),
+        Keyframe::new(FrameRate::FPS_30.tick_of(3), rect(60.0)),
+    ];
+    let cache = crate::LayerCache::default();
+    let render = |t: Tick, cached: bool| {
+        let mut r = Renderer::new(&p, &NoFootage, RenderOpts { motion_blur: true, ..Default::default() });
+        r.cache = cached.then_some(&cache);
+        r.comp_frame(cid, t)
+    };
+    let (f1, f2) = (FrameRate::FPS_30.tick_of(1), FrameRate::FPS_30.tick_of(2));
+    assert_ne!(render(f1, false), render(f2, false), "the shutter at frame 2 sees the move");
+    render(f1, true);
+    assert_eq!(render(f2, true), render(f2, false));
+}
+
+#[test]
+fn mask_motion_blur_follows_the_render_and_the_comp() {
+    let (p, cid) = project(true);
+    let a = alpha_at_25(&p, cid, true);
+    assert!(a > 0.05 && a < 0.95, "blurred: {a}");
+    assert!(alpha_at_25(&p, cid, false) < 0.01, "Render Settings ▸ Motion Blur off");
+    let (p, cid) = project(false);
+    assert!(alpha_at_25(&p, cid, true) < 0.01, "the comp's switch off");
+}
+
+/// Whether mask motion blur may run at all (the render options, Switches Affect Nested Comps with
+/// a precomp layer's switch off) is part of the layer cache key, also for a layer whose own
+/// switch is off: a buffer made with the gate open must not serve a render with it closed.
+#[test]
+fn the_mask_motion_blur_gate_keys_the_layer_cache() {
+    let (mut p, inner) = project(true);
+    let mut outer = Comp::new(100, 100, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    outer.enable_motion_blur = true;
+    let mut pre = build::layer(&mut p, &outer, "Inner", LayerSource::Comp { item: inner }, (100, 100), None);
+    pre.switches.motion_blur = false;
+    outer.layers.push(pre);
+    let oid = p.add_item("Outer", Label::Sandstone, None, ItemKind::Comp(outer.into()));
+    let half = Tick::from_seconds_f64(0.5 / 30.0);
+    let cache = crate::LayerCache::default();
+    let render = |cid: ItemId, opts: RenderOpts, cached: bool| {
+        let mut r = Renderer::new(&p, &NoFootage, opts);
+        r.cache = cached.then_some(&cache);
+        r.comp_frame(cid, half).data
+    };
+    let on = RenderOpts { motion_blur: true, nested_switches: true, ..Default::default() };
+    let off = RenderOpts { nested_switches: false, ..on };
+    assert!(render(oid, on, false) != render(oid, off, false), "the precomp layer's switch closes the gate");
+    assert!(render(oid, off, true) == render(oid, off, false));
+    assert!(render(oid, on, true) == render(oid, on, false), "not the buffer blurred with the gate open");
+    let still = RenderOpts { motion_blur: false, ..on };
+    assert!(render(inner, on, true) == render(inner, on, false));
+    assert!(render(inner, still, true) == render(inner, still, false), "Render Settings ▸ Motion Blur off");
+}
diff --git a/crates/render/src/tests_mask_expansion.rs b/crates/render/src/tests/mask_expansion.rs
similarity index 100%
rename from crates/render/src/tests_mask_expansion.rs
rename to crates/render/src/tests/mask_expansion.rs
diff --git a/crates/render/src/tests/mask_feather.rs b/crates/render/src/tests/mask_feather.rs
new file mode 100644
index 000000000..db04b1f9f
--- /dev/null
+++ b/crates/render/src/tests/mask_feather.rs
@@ -0,0 +1,251 @@
+//! A feathered mask blurs its own edge, also where the path lies outside the layer: the feather
+//! of a mask partly or wholly outside the layer reaches into it (After Effects), instead of the
+//! coverage stopping at the layer edge.
+
+use effectcraft_color::Label;
+use effectcraft_keyframe::{ShapePath, Value};
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{BitDepth, Comp, FeatherFalloff, GroupKind, ItemId, ItemKind, Layer, LayerSource, MaskMode, Node, Project, Solid};
+use effectcraft_time::{FrameRate, Tick};
+
+use crate::render_frame;
+
+fn solid(p: &mut Project, comp: &Comp, color: [f32; 3], w: u32, h: u32) -> Layer {
+    let sid = p.add_item("Solid", Label::Red, None, ItemKind::Solid(Solid { color, width: w, height: h, pixel_aspect: 1.0 }));
+    build::layer(p, comp, "Solid", LayerSource::Solid { item: sid }, (w, h), None)
+}
+
+fn add_mask(p: &mut Project, l: &mut Layer, rect: ShapePath, feather: [f64; 2], linear: bool) {
+    let mut next = p.next_id;
+    let mut m = build::mask(&mut Ids(&mut next), "Mask 1", rect, MaskMode::Add, [255, 255, 0]);
+    p.next_id = next;
+    m.get_mut("feather").unwrap().value = Value::Vec2(feather);
+    if linear && let GroupKind::Mask { feather_falloff, .. } = &mut m.kind {
+        *feather_falloff = FeatherFalloff::Linear;
+    }
+    l.props.sub_mut("masks").unwrap().children.push(Node::Group(m));
+}
+
+/// Coverage at signed distance `d` inside an edge blurred by three box passes `w` pixels wide
+/// (the Smooth falloff: an Irwin-Hall n = 3 distribution function, support +-1.5 w).
+fn edge(d: f64, w: f64) -> f64 {
+    let t = (d / w + 1.5).clamp(0.0, 3.0);
+    if t < 1.0 {
+        t * t * t / 6.0
+    } else if t < 2.0 {
+        (-2.0 * t * t * t + 9.0 * t * t - 9.0 * t + 3.0) / 6.0
+    } else {
+        1.0 - (3.0 - t).powi(3) / 6.0
+    }
+}
+
+/// The box window of the Smooth falloff for `feather` pixels: `2 round(0.37 feather) + 1`.
+fn window(feather: f64) -> f64 {
+    2.0 * (0.37 * feather).round() + 1.0
+}
+
+/// Coverage at pixel centre `x` of the span `a..b` feathered by `feather` (one axis).
+fn span(x: f64, a: f64, b: f64, feather: f64) -> f64 {
+    let w = window(feather);
+    edge(x - a, w) + edge(b - x, w) - 1.0
+}
+
+/// A white 200×100 solid (32 bpc) with one Add mask.
+fn white_with_mask(rect: ShapePath, feather: [f64; 2], linear: bool, scale: f64) -> effectcraft_raster::Image {
+    let mut p = Project::default();
+    p.settings.bit_depth = BitDepth::Bpc32;
+    let comp = Comp::new(200, 100, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+    let mut l = solid(&mut p, &comp, [1.0; 3], 200, 100);
+    add_mask(&mut p, &mut l, rect, feather, linear);
+    p.comp_mut(cid).unwrap().layers.push(l);
+    render_frame(&p, cid, Tick::ZERO, scale)
+}
+
+#[test]
+fn a_feathered_mask_outside_a_solid_reaches_into_it() {
+    // The mask spans x 210..260, right of the layer (x 0..200); feather 40 = three 31 px boxes.
+    let img = white_with_mask(ShapePath::rect([235.0, 50.0], 50.0, 200.0), [40.0, 40.0], false, 1.0);
+    for x in [150i64, 170, 180, 199] {
+        let want = span(x as f64 + 0.5, 210.0, 260.0, 40.0) * span(50.5, -50.0, 150.0, 40.0);
+        let got = img.get(x, 50)[3] as f64;
+        assert!((got - want).abs() < 0.01, "x {x}: alpha {got}, the box kernel gives {want}");
+    }
+    assert!(img.get(199, 50)[3] > 0.25, "the feather reaches the layer edge");
+    // Finite support: nothing beyond 1.5 windows (46.5 px) from the edge.
+    assert!(img.get(160, 50)[3] == 0.0 && img.get(100, 50)[3] == 0.0);
+    // Without feather the mask hides the layer.
+    let hard = white_with_mask(ShapePath::rect([235.0, 50.0], 50.0, 200.0), [0.0, 0.0], false, 1.0);
+    assert!(hard.data.iter().all(|p| p[3] == 0.0));
+    // A linear falloff ramps over the feather width: 20 px either side of the edge at x 210.
+    let lin = white_with_mask(ShapePath::rect([235.0, 50.0], 50.0, 200.0), [40.0, 40.0], true, 1.0);
+    let a = lin.get(199, 50)[3];
+    assert!((a - 0.24).abs() < 0.04, "linear: {a}");
+    assert!(lin.get(185, 50)[3] < 0.01);
+    // At half resolution the same layer pixel gets the same coverage.
+    let half = white_with_mask(ShapePath::rect([235.0, 50.0], 50.0, 200.0), [40.0, 40.0], false, 0.5);
+    assert!((half.get(99, 25)[3] - img.get(198, 50)[3]).abs() < 0.02, "{} {}", half.get(99, 25)[3], img.get(198, 50)[3]);
+}
+
+#[test]
+fn a_feathered_mask_larger_than_the_layer_keeps_the_layer_edges() {
+    // The mask covers the layer and 100 px around it: the layer edges are inside the mask and
+    // stay opaque (they used to fade, as if the layer edge were the mask edge).
+    let img = white_with_mask(ShapePath::rect([100.0, 50.0], 400.0, 300.0), [40.0, 40.0], false, 1.0);
+    for (x, y) in [(0i64, 0i64), (0, 50), (199, 99), (100, 0)] {
+        assert!(img.get(x, y)[3] > 0.99, "({x}, {y}): {}", img.get(x, y)[3]);
+    }
+    // A mask edge inside the layer is feathered as before: half coverage on the edge.
+    let inner = white_with_mask(ShapePath::rect([100.0, 50.0], 100.0, 400.0), [40.0, 40.0], false, 1.0);
+    assert!((inner.get(50, 50)[3] - 0.5).abs() < 0.03, "{}", inner.get(50, 50)[3]);
+    assert!(inner.get(100, 50)[3] > 0.98);
+}
+
+#[test]
+fn huge_and_broken_feathers_stay_bounded() {
+    for f in [1.0e5, 1.0e9, f64::INFINITY, f64::NAN, -5.0] {
+        let img = white_with_mask(ShapePath::rect([235.0, 50.0], 50.0, 200.0), [f, f], false, 1.0);
+        assert!(img.data.iter().all(|p| p[3].is_finite() && (0.0..=1.0).contains(&p[3])), "feather {f}");
+        let img = white_with_mask(ShapePath::rect([235.0, 50.0], 50.0, 200.0), [f, 10.0], true, 1.0);
+        assert!(img.data.iter().all(|p| p[3].is_finite() && (0.0..=1.0).contains(&p[3])), "linear feather {f}");
+    }
+}
+
+/// Case 398 of the .aep corpus, built in EffectCraft's own model: a 1920×1080 comp at 8 bpc, a
+/// red solid, above it an adjustment layer of comp size with a Gradient Ramp at its defaults and
+/// one Add mask entirely below the layer (1920×200 centred at [960, 1250]) with feather 1000.
+fn case_398(with_mask: bool) -> (Project, ItemId) {
+    let mut p = Project::default();
+    assert_eq!(p.settings.bit_depth, BitDepth::Bpc8, "After Effects' default depth");
+    let comp = Comp::new(1920, 1080, FrameRate::FPS_30, Tick::from_seconds_f64(5.0));
+    let cid = p.add_item("C", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+    let red = solid(&mut p, &comp, [1.0, 0.0, 0.0], 1920, 1080);
+    let mut adj = solid(&mut p, &comp, [1.0; 3], 1920, 1080);
+    adj.switches.adjustment = true;
+    let spec = effectcraft_effects::find("ec.generate.gradientramp").unwrap();
+    let mut next = p.next_id;
+    let ramp = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), spec.name, [1920.0, 1080.0]);
+    p.next_id = next;
+    adj.props.sub_mut("effects").unwrap().children.push(ramp.into());
+    if with_mask {
+        add_mask(&mut p, &mut adj, ShapePath::rect([960.0, 1250.0], 1920.0, 200.0), [1000.0, 1000.0], false);
+    }
+    let c = p.comp_mut(cid).unwrap();
+    c.layers.push(adj);
+    c.layers.push(red);
+    (p, cid)
+}
+
+fn rgb8(img: &effectcraft_raster::Image, x: i64, y: i64) -> [i32; 3] {
+    let px = img.get(x, y);
+    [0, 1, 2].map(|c| (px[c].clamp(0.0, 1.0) * 255.0).round() as i32)
+}
+
+#[test]
+fn case_398_a_feathered_mask_below_an_adjustment_layer_reaches_into_it() {
+    let t = Tick::from_seconds_f64(1.0);
+    let (p, cid) = case_398(true);
+    let img = render_frame(&p, cid, t, 1.0);
+    // The ramp alone (no mask): what the adjustment layer mixes in.
+    let (q, qid) = case_398(false);
+    let ramp = render_frame(&q, qid, t, 1.0);
+    // After Effects 2026, 8 bpc, the render of 398 at 1 s.
+    let ae = [
+        ((960, 0), [255, 0, 0]),
+        ((960, 300), [254, 0, 0]),
+        ((960, 540), [250, 5, 5]),
+        ((960, 800), [248, 20, 20]),
+        ((960, 1000), [252, 40, 40]),
+        ((960, 1079), [255, 47, 47]),
+        ((100, 1079), [255, 29, 29]),
+    ];
+    let mut report = Vec::new();
+    for ((x, y), want_ae) in ae {
+        let got = rgb8(&img, x, y);
+        // 1. The coverage is the mask's Smooth falloff (three 741 px boxes for feather 1000),
+        //    blurred from the mask edge outside the layer (on the coarse grid); the result is the
+        //    red mixed toward the ramp by it.
+        let c = span(x as f64 + 0.5, 0.0, 1920.0, 1000.0) * span(y as f64 + 0.5, 1150.0, 1350.0, 1000.0);
+        let r = ramp.get(x, y);
+        let want = [0, 1, 2].map(|k| {
+            let red = if k == 0 { 1.0 } else { 0.0 };
+            ((red + (r[k] as f64 - red) * c) * 255.0).round() as i32
+        });
+        for k in 0..3 {
+            assert!((got[k] - want[k]).abs() <= 2, "({x}, {y}): {got:?}, the box coverage {c:.4} gives {want:?}");
+        }
+        // 2. After Effects: within 2 levels per channel.
+        for k in 0..3 {
+            assert!((got[k] - want_ae[k]).abs() <= 2, "({x}, {y}): EffectCraft {got:?}, After Effects {want_ae:?}");
+        }
+        report.push(format!("({x},{y}) ec {got:?} ae {want_ae:?}"));
+    }
+    println!("398: {}", report.join("; "));
+    // The mask covers nothing of the layer itself, but its feather does: the top stays (nearly) red.
+    assert!(rgb8(&img, 960, 0)[0] >= 253 && rgb8(&img, 960, 0)[1] == 0);
+    assert!(rgb8(&img, 960, 1079)[1] > 25, "the feather reaches the bottom edge");
+}
+
+/// After Effects 2026 (sRGB, 32 bpc): a red 1920x1080 solid with a 1000x600 Add mask centred at
+/// [960, 540] (left edge at x 460), feather `f` on both axes; coverage along the row y 540 from
+/// x 160 to 760 in steps of 20 (8-bit values / 255).
+const AE_FEATHER_100: [(i64, f64); 11] =
+    [(360, 0.0), (380, 0.016), (400, 0.059), (420, 0.153), (440, 0.31), (460, 0.506), (480, 0.698), (500, 0.855), (520, 0.945), (540, 0.988), (560, 1.0)];
+const AE_FEATHER_300: [(i64, f64); 31] = [
+    (160, 0.0),
+    (180, 0.004),
+    (200, 0.008),
+    (220, 0.012),
+    (240, 0.024),
+    (260, 0.035),
+    (280, 0.055),
+    (300, 0.078),
+    (320, 0.11),
+    (340, 0.149),
+    (360, 0.192),
+    (380, 0.247),
+    (400, 0.306),
+    (420, 0.369),
+    (440, 0.435),
+    (460, 0.502),
+    (480, 0.569),
+    (500, 0.635),
+    (520, 0.698),
+    (540, 0.757),
+    (560, 0.808),
+    (580, 0.851),
+    (600, 0.89),
+    (620, 0.922),
+    (640, 0.945),
+    (660, 0.965),
+    (680, 0.976),
+    (700, 0.988),
+    (720, 0.992),
+    (740, 0.996),
+    (760, 1.0),
+];
+
+#[test]
+fn the_smooth_feather_falloff_matches_after_effects() {
+    for (f, ae) in [(100.0, &AE_FEATHER_100[..]), (300.0, &AE_FEATHER_300[..])] {
+        let mut p = Project::default();
+        p.settings.bit_depth = BitDepth::Bpc32;
+        let comp = Comp::new(1920, 1080, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+        let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+        let mut l = solid(&mut p, &comp, [1.0, 0.0, 0.0], 1920, 1080);
+        add_mask(&mut p, &mut l, ShapePath::rect([960.0, 540.0], 1000.0, 600.0), [f, f], false);
+        p.comp_mut(cid).unwrap().layers.push(l);
+        let img = render_frame(&p, cid, Tick::ZERO, 1.0);
+        let mut worst = 0.0f64;
+        for &(x, want) in ae {
+            let got = img.get(x, 540)[3] as f64;
+            // Tolerance 2/255 on the 8-bit After Effects values.
+            assert!((got - want).abs() <= 2.0 / 255.0, "feather {f}, x {x}: {got:.4}, After Effects {want}");
+            worst = worst.max((got - want).abs());
+        }
+        // The corner is the product of its two edges (a separable blur): 0.25 for both feathers.
+        let corner = img.get(460, 240)[3] as f64;
+        assert!((corner - 0.251).abs() <= 2.0 / 255.0, "feather {f}: corner {corner}");
+        println!("feather {f}: largest deviation from After Effects {:.2}/255", worst * 255.0);
+    }
+}
diff --git a/crates/render/src/tests/motion_tile.rs b/crates/render/src/tests/motion_tile.rs
new file mode 100644
index 000000000..28faca73c
--- /dev/null
+++ b/crates/render/src/tests/motion_tile.rs
@@ -0,0 +1,169 @@
+//! Motion Tile's Output Width / Height on adjustment layers and on full-frame layers, with a
+//! Transform after it that scales the tiled result into view (#1727, #1991).
+
+use effectcraft_color::Label;
+use effectcraft_keyframe::Value;
+use effectcraft_project::build::{self, Ids};
+use effectcraft_project::{Comp, ItemId, ItemKind, Layer, LayerSource, Project, Solid};
+use effectcraft_time::{FrameRate, Tick};
+
+use crate::{Image, render_frame};
+
+const W: u32 = 200;
+const H: u32 = 100;
+
+fn solid(p: &mut Project, comp: &Comp, color: [f32; 3], w: u32, h: u32, pos: [f64; 2]) -> Layer {
+    let sid = p.add_item("Solid", Label::Red, None, ItemKind::Solid(Solid { color, width: w, height: h, pixel_aspect: 1.0 }));
+    let mut l = build::layer(p, comp, "Solid", LayerSource::Solid { item: sid }, (w, h), None);
+    l.props.prop_mut("transform/position").unwrap().value = Value::Vec3([pos[0], pos[1], 0.0]);
+    l
+}
+
+/// A white frame with a red 20×20 square in its top-left corner.
+fn picture(p: &mut Project, comp: &Comp) -> Vec<Layer> {
+    vec![solid(p, comp, [1.0, 0.0, 0.0], 20, 20, [10.0, 10.0]), solid(p, comp, [1.0, 1.0, 1.0], W, H, [100.0, 50.0])]
+}
+
+/// Motion Tile (Output `out` %) then Transform (Scale `scale` %), on `l`.
+fn tile_then_scale(p: &mut Project, l: &mut Layer, out: f64, scale: f64) {
+    let size = [W as f64, H as f64];
+    for (id, vals) in [
+        ("ec.stylize.motiontile", vec![("outputWidth", Value::Scalar(out)), ("outputHeight", Value::Scalar(out))]),
+        ("ec.distort.transform", vec![("scaleHeight", Value::Scalar(scale)), ("scaleWidth", Value::Scalar(scale))]),
+    ] {
+        let spec = effectcraft_effects::find(id).unwrap();
+        let mut next = p.next_id;
+        let mut g = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), spec.name, size);
+        p.next_id = next;
+        for (k, v) in vals {
+            g.prop_mut(k).unwrap().value = v;
+        }
+        l.props.sub_mut("effects").unwrap().children.push(g.into());
+    }
+}
+
+fn comp() -> (Project, ItemId, Comp) {
+    let mut p = Project::default();
+    p.settings.bit_depth = effectcraft_project::BitDepth::Bpc32;
+    let comp = Comp::new(W, H, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+    (p, cid, comp)
+}
+
+/// The picture under an adjustment layer carrying the two effects.
+fn adjustment_scene(out: f64, scale: f64) -> (Project, ItemId) {
+    let (mut p, cid, comp) = comp();
+    let mut adj = solid(&mut p, &comp, [1.0, 1.0, 1.0], W, H, [100.0, 50.0]);
+    adj.switches.adjustment = true;
+    tile_then_scale(&mut p, &mut adj, out, scale);
+    let mut layers = vec![adj];
+    layers.extend(picture(&mut p, &comp));
+    p.comp_mut(cid).unwrap().layers = layers.into();
+    (p, cid)
+}
+
+/// The picture as a full-frame precomp layer carrying the two effects.
+fn layer_scene(out: f64, scale: f64) -> (Project, ItemId) {
+    let (mut p, cid, comp) = comp();
+    let inner = Comp::new(W, H, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+    let iid = p.add_item("Picture", Label::Sandstone, None, ItemKind::Comp(inner.clone().into()));
+    let layers = picture(&mut p, &inner);
+    p.comp_mut(iid).unwrap().layers = layers.into();
+    let mut pre = build::layer(&mut p, &comp, "Picture", LayerSource::Comp { item: iid }, (W, H), None);
+    tile_then_scale(&mut p, &mut pre, out, scale);
+    p.comp_mut(cid).unwrap().layers.push(pre);
+    (p, cid)
+}
+
+fn is(img: &Image, x: i64, y: i64, want: [f32; 4], what: &str) {
+    let got = img.get(x, y);
+    assert!(got.iter().zip(want).all(|(a, b)| (a - b).abs() < 0.02), "{what}: ({x}, {y}) is {got:?}, want {want:?}");
+}
+
+const RED: [f32; 4] = [1.0, 0.0, 0.0, 1.0];
+const WHITE: [f32; 4] = [1.0; 4];
+const CLEAR: [f32; 4] = [0.0; 4];
+
+/// Output 300 % then Scale 50 % about the frame centre: comp pixel (x, y) shows the tiled frame
+/// at (100 + 2(x − 100), 50 + 2(y − 50)), so the red square repeats every 100 × 50 pixels and
+/// the frame is covered edge to edge, the tiles from beyond the frame included.
+fn assert_tiled(img: &Image, what: &str) {
+    for (x, y) in [(55, 30), (155, 30), (55, 80), (155, 80)] {
+        is(img, x, y, RED, what);
+    }
+    for (x, y) in [(5, 5), (195, 5), (5, 95), (195, 95), (100, 50), (100, 5)] {
+        is(img, x, y, WHITE, what);
+    }
+}
+
+#[test]
+fn adjustment_motion_tile_output_spreads_tiles_past_the_frame() {
+    let (p, cid) = adjustment_scene(300.0, 50.0);
+    assert_tiled(&render_frame(&p, cid, Tick::ZERO, 1.0), "adjustment, Output 300 %");
+}
+
+#[test]
+fn layer_motion_tile_output_spreads_tiles_past_the_frame() {
+    let (p, cid) = layer_scene(300.0, 50.0);
+    assert_tiled(&render_frame(&p, cid, Tick::ZERO, 1.0), "full-frame layer, Output 300 %");
+}
+
+/// Output under 100 % crops: only the centre 50 % of the frame is left, the rest is transparent
+/// (After Effects shows the comp background there).
+#[test]
+fn adjustment_motion_tile_output_under_100_crops_the_frame() {
+    let (p, cid) = adjustment_scene(50.0, 100.0);
+    let img = render_frame(&p, cid, Tick::ZERO, 1.0);
+    is(&img, 100, 50, WHITE, "inside the kept centre");
+    is(&img, 60, 30, WHITE, "inside the kept centre");
+    for (x, y) in [(5, 5), (10, 10), (195, 95), (45, 50), (100, 20)] {
+        is(&img, x, y, CLEAR, "outside the kept centre");
+    }
+}
+
+/// The After Effects 2026 frames in #1727: a 1920×1080 red solid under an adjustment layer with
+/// Motion Tile (Output 910 × 340 %, then 90 × 340 %) and Transform (Scale 12 %, Position 1361, 540).
+/// The tiled frame, 9.1 × 3.4 comps scaled to 12 %, is a 2097 × 441 band centred on (1361, 540):
+/// x 313–1920 (cut by the frame), y 320–760; at 90 % a 207-pixel column, x 1257–1465.
+#[test]
+fn adjustment_motion_tile_matches_the_after_effects_frames() {
+    for (out_w, x0, x1) in [(910.0, 313.0, 1920.0), (90.0, 1257.0, 1465.0)] {
+        let mut p = Project::default();
+        p.settings.bit_depth = effectcraft_project::BitDepth::Bpc32;
+        let comp = Comp::new(1920, 1080, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
+        let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+        let red = solid(&mut p, &comp, [1.0, 0.0, 0.0], 1920, 1080, [960.0, 540.0]);
+        let mut adj = solid(&mut p, &comp, [1.0, 1.0, 1.0], 1920, 1080, [960.0, 540.0]);
+        adj.switches.adjustment = true;
+        for (id, vals) in [
+            ("ec.stylize.motiontile", vec![("outputWidth", Value::Scalar(out_w)), ("outputHeight", Value::Scalar(340.0))]),
+            (
+                "ec.distort.transform",
+                vec![("scaleHeight", Value::Scalar(12.0)), ("scaleWidth", Value::Scalar(12.0)), ("position", Value::Vec2([1361.0, 540.0]))],
+            ),
+        ] {
+            let spec = effectcraft_effects::find(id).unwrap();
+            let mut next = p.next_id;
+            let mut g = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), spec.name, [1920.0, 1080.0]);
+            p.next_id = next;
+            for (k, v) in vals {
+                g.prop_mut(k).unwrap().value = v;
+            }
+            adj.props.sub_mut("effects").unwrap().children.push(g.into());
+        }
+        p.comp_mut(cid).unwrap().layers = vec![adj, red].into();
+        // Quarter resolution: comp pixel (x, y) is output pixel (x / 4, y / 4).
+        let img = render_frame(&p, cid, Tick::ZERO, 0.25);
+        let at = |x: f64, y: f64| img.get((x / 4.0) as i64, (y / 4.0) as i64);
+        let what = format!("Output {out_w} %");
+        for (x, y) in [(x0 + 8.0, 540.0), (x1 - 8.0, 540.0), (1361.0, 328.0), (1361.0, 752.0)] {
+            assert_eq!(at(x, y), RED, "{what}: ({x}, {y}) is red");
+        }
+        for (x, y) in [(x0 - 8.0, 540.0), (1361.0, 312.0), (1361.0, 768.0), (100.0, 100.0)] {
+            assert_eq!(at(x, y), CLEAR, "{what}: ({x}, {y}) is empty");
+        }
+        if x1 < 1920.0 {
+            assert_eq!(at(x1 + 8.0, 540.0), CLEAR, "{what}: right of the column");
+        }
+    }
+}
diff --git a/crates/render/src/tests_nested.rs b/crates/render/src/tests/nested.rs
similarity index 100%
rename from crates/render/src/tests_nested.rs
rename to crates/render/src/tests/nested.rs
diff --git a/crates/render/src/tests_paint.rs b/crates/render/src/tests/paint.rs
similarity index 100%
rename from crates/render/src/tests_paint.rs
rename to crates/render/src/tests/paint.rs
diff --git a/crates/render/src/tests_raster_clip.rs b/crates/render/src/tests/raster_clip.rs
similarity index 95%
rename from crates/render/src/tests_raster_clip.rs
rename to crates/render/src/tests/raster_clip.rs
index da0b40884..8bcadb7ee 100644
--- a/crates/render/src/tests_raster_clip.rs
+++ b/crates/render/src/tests/raster_clip.rs
@@ -307,3 +307,17 @@ fn layers_with_effects_rasterise_whole() {
     p.comp_mut(cid).unwrap().layers[0].props.sub_mut("effects").unwrap().children.push(g.into());
     assert_eq!(raster_px(&p, cid, false), raster_px(&p, cid, true));
 }
+
+/// The Layer panel and analysis tools consume layer-space inputs, even with no effects.
+#[test]
+fn layer_panel_input_reads_the_whole_layer_behind_the_camera() {
+    let (p, cid) = scene(|p, c| shape3(p, c, [W as f64 / 2.0, H as f64 / 2.0, -zoom() - 200.0]));
+    let r = Renderer::new(&p, &NoFootage, RenderOpts::default());
+    let ctx = r.eval_ctx(cid, Tick::ZERO).unwrap();
+    let layer = &p.comp(cid).unwrap().layers[0];
+    let mut whole = Renderer::new(&p, &NoFootage, RenderOpts::default());
+    whole.whole_raster = true;
+    let expected = whole.layer_input(&ctx, layer, 0).unwrap();
+    assert!(expected.img.data.iter().any(|pixel| pixel[3] > 0.5));
+    assert_eq!(r.layer_input(&ctx, layer, 0).unwrap().img, expected.img);
+}
diff --git a/crates/render/src/tests_remap.rs b/crates/render/src/tests/remap.rs
similarity index 72%
rename from crates/render/src/tests_remap.rs
rename to crates/render/src/tests/remap.rs
index 67b6ebef7..8d3cd8b63 100644
--- a/crates/render/src/tests_remap.rs
+++ b/crates/render/src/tests/remap.rs
@@ -63,3 +63,24 @@ fn time_remap_picks_the_source_frame() {
     assert!(img.get(90, 50)[3] > 0.99, "frozen at the end position");
     assert!(img.get(10, 50)[3] < 0.01);
 }
+
+#[test]
+fn layer_span_is_the_source_duration_in_layer_time() {
+    let mut p = Project::default();
+    let outer = Comp::new(100, 100, FrameRate::FPS_30, s(4.0));
+    let inner = Comp::new(100, 100, FrameRate::FPS_30, s(2.5));
+    let iid = p.add_item("Inner", Label::Sandstone, None, ItemKind::Comp(inner.into()));
+    let sid = p.add_item("S", Label::Red, None, ItemKind::Solid(Solid { color: [1.0, 1.0, 1.0], width: 10, height: 10, pixel_aspect: 1.0 }));
+    let mut pre = build::layer(&mut p, &outer, "Inner", LayerSource::Comp { item: iid }, (100, 100), None);
+    let sol = build::layer(&mut p, &outer, "S", LayerSource::Solid { item: sid }, (10, 10), None);
+    let (first, end) = crate::eval::layer_span(&p, &pre).expect("a nested comp has a duration");
+    assert!(first.abs() < 1e-9 && (end - 2.5).abs() < 1e-9);
+    assert_eq!(crate::eval::layer_span(&p, &sol), None, "solids have no duration");
+    // Time Remap: layer time is not source time any more, the visible span is reported.
+    let mut next = p.next_id;
+    let tr = Ids(&mut next).prop("timeRemap", "Time Remap", Value::Scalar(0.0));
+    p.next_id = next;
+    pre.props.children.push(Node::Prop(tr));
+    let (first, end) = crate::eval::layer_span(&p, &pre).expect("a remapped layer has a visible span");
+    assert!(end > first);
+}
diff --git a/crates/render/src/tests_roi.rs b/crates/render/src/tests/roi.rs
similarity index 98%
rename from crates/render/src/tests_roi.rs
rename to crates/render/src/tests/roi.rs
index 9182817cf..a9892d9c7 100644
--- a/crates/render/src/tests_roi.rs
+++ b/crates/render/src/tests/roi.rs
@@ -29,7 +29,7 @@ fn project(three_d: bool) -> (Project, effectcraft_project::ItemId) {
         }
         layers.push(l);
     }
-    p.comp_mut(cid).unwrap().layers = layers;
+    p.comp_mut(cid).unwrap().layers = layers.into();
     (p, cid)
 }
 
diff --git a/crates/render/src/tests/stretch_limits.rs b/crates/render/src/tests/stretch_limits.rs
new file mode 100644
index 000000000..17bdff317
--- /dev/null
+++ b/crates/render/src/tests/stretch_limits.rs
@@ -0,0 +1,96 @@
+//! A project file whose layers carry a time stretch outside ±1 % to ±9900 % (1e-300 %, 0,
+//! 1e300 %…) opens with the stretch brought into that range, and a frame of it draws and its audio
+//! mixes with bounded source reads. Before, a stretch of 1e-300 % asked the footage for about
+//! `usize::MAX` samples and the mix overflowed or tried a huge allocation, aborting the app (#3247).
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use effectcraft_color::Label;
+use effectcraft_project::{Footage, FootageKind, ItemId, ItemKind, LayerSource, Project, build, limits};
+use effectcraft_time::Tick;
+
+use super::{setup, solid};
+use crate::{FootageSource, Image, audio::mix_comp, render_frame};
+
+/// Silent audio footage that records the longest read asked of it and refuses a read past a
+/// thousand seconds (so a runaway read can't take the machine's memory: the mix then fills the
+/// read with silence itself).
+#[derive(Default)]
+struct Probe {
+    longest: AtomicUsize,
+}
+
+impl FootageSource for Probe {
+    fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
+        None
+    }
+    fn audio(&self, _: ItemId, _: &Footage, _: Tick, frames: usize, rate: u32) -> Option<Vec<f32>> {
+        self.longest.fetch_max(frames, Ordering::Relaxed);
+        (frames <= rate as usize * 1000).then(|| vec![0.0; frames * 2])
+    }
+}
+
+/// The project file of a comp holding a red solid and a sound, both with their stretch set to
+/// `stretch` in the file text.
+fn file_with_stretch(stretch: f64) -> (String, ItemId) {
+    let (mut p, cid, comp) = setup();
+    let red = solid(&mut p, &comp, [1.0, 0.0, 0.0], 200, 100);
+    let f = Footage {
+        path: "tone.wav".into(),
+        kind: FootageKind::Audio,
+        has_audio: true,
+        frame_rate: comp.frame_rate,
+        duration: Tick::from_seconds_f64(10.0),
+        ..Default::default()
+    };
+    let fid = p.add_item("tone.wav", Label::SeaFoam, None, ItemKind::Footage(f));
+    let sound = build::layer(&mut p, &comp, "sound", LayerSource::Footage { item: fid }, (0, 0), None);
+    let c = p.comp_mut(cid).unwrap();
+    c.layers.push(red);
+    c.layers.push(sound);
+    // Both layers are at 100 %; `{:e}` writes a JSON number for any finite value, and NaN is
+    // written as null, as serializing the project writes it.
+    let text = p.to_json();
+    assert_eq!(text.matches("\"stretch\": 100.0").count(), 2);
+    let value = if stretch.is_nan() { "null".to_string() } else { format!("{stretch:e}") };
+    (text.replace("\"stretch\": 100.0", &format!("\"stretch\": {value}")), cid)
+}
+
+#[test]
+fn a_file_with_an_extreme_stretch_opens_in_range_draws_and_mixes_with_bounded_reads() {
+    for (stored, opened) in
+        [(1e-300, 1.0), (-1e-300, -1.0), (0.0, 100.0), (1e300, limits::MAX_STRETCH), (-1e300, -limits::MAX_STRETCH), (0.5, 1.0), (f64::NAN, 100.0)]
+    {
+        let (text, cid) = file_with_stretch(stored);
+        let (p, notes) = Project::from_json_repaired(&text).unwrap();
+        assert!(notes.iter().filter(|n| n.contains("time stretch")).count() == 2, "{stored}: {notes:?}");
+        let c = p.comp(cid).unwrap();
+        assert!(c.layers.iter().all(|l| l.stretch == opened), "{stored}: {:?}", c.layers.iter().map(|l| l.stretch).collect::<Vec<_>>());
+        // A frame draws: the solid has no keys and keeps its in and out points, so it is red.
+        let img = render_frame(&p, cid, Tick::ZERO, 1.0);
+        assert_eq!(img.get(10, 10), [1.0, 0.0, 0.0, 1.0], "{stored}");
+        // The audio mixes, reading at most 100 source samples per comp sample (a stretch of 1 %).
+        let (rate, n) = (8000, 4000);
+        let probe = Probe::default();
+        let mixed = mix_comp(&p, &probe, None, cid, Tick::from_seconds_f64(0.5), n, rate);
+        assert_eq!(mixed.len(), n * 2, "{stored}");
+        assert!(probe.longest.load(Ordering::Relaxed) <= 100 * n + 1, "{stored}: a read of {} samples", probe.longest.load(Ordering::Relaxed));
+    }
+}
+
+/// A stretch set in memory (not through a file, so not repaired) mixes as the clamped stretch the
+/// layer's time uses: before, 1e-300 % read about `usize::MAX` source samples and overflowed.
+#[test]
+fn an_in_memory_extreme_stretch_mixes_with_bounded_reads() {
+    for stretch in [1e-300, 0.0, f64::NAN, 1e300] {
+        let (text, cid) = file_with_stretch(100.0);
+        let (mut p, _) = Project::from_json_repaired(&text).unwrap();
+        p.comp_mut(cid).unwrap().layers.iter_mut().for_each(|l| l.stretch = stretch);
+        let (rate, n) = (8000, 4000);
+        let probe = Probe::default();
+        let mixed = mix_comp(&p, &probe, None, cid, Tick::from_seconds_f64(0.5), n, rate);
+        assert_eq!(mixed.len(), n * 2, "{stretch}");
+        assert!(probe.longest.load(Ordering::Relaxed) <= 100 * n + 1, "{stretch}: a read of {} samples", probe.longest.load(Ordering::Relaxed));
+    }
+}
diff --git a/crates/render/src/tests_styles.rs b/crates/render/src/tests/styles.rs
similarity index 86%
rename from crates/render/src/tests_styles.rs
rename to crates/render/src/tests/styles.rs
index 147ff1590..a9de6fb52 100644
--- a/crates/render/src/tests_styles.rs
+++ b/crates/render/src/tests/styles.rs
@@ -44,7 +44,7 @@ fn scene(color: [f32; 3], bg: Option<[f32; 3]>, f: impl FnOnce(&mut Project, &Co
     if let Some(bg) = bg {
         layers.push(solid(&mut p, &comp, bg, 200, 100));
     }
-    p.comp_mut(cid).unwrap().layers = layers;
+    p.comp_mut(cid).unwrap().layers = layers.into();
     (p, cid)
 }
 
@@ -475,3 +475,66 @@ fn gradient_glow_uses_gradient() {
     let px = img.straight(121, 50);
     assert!(px[0] > px[2], "near the edge the glow takes the gradient's start colour {px:?}");
 }
+
+/// #1812 (review of #1928): a styled layer rendered by several workers at once shares its body and
+/// style passes, as unstyled layers share their buffer.
+#[test]
+fn workers_styling_a_layer_at_once_share_its_buffers() {
+    let (p, cid) = scene([1.0; 3], None, |p, c, l| {
+        add(p, c, l, "dropShadow");
+        add(p, c, l, "stroke");
+    });
+    let cache = crate::LayerCache::default();
+    let start = std::sync::Barrier::new(8);
+    let styled: Vec<_> = std::thread::scope(|s| {
+        let hs: Vec<_> = (0..8)
+            .map(|_| {
+                s.spawn(|| {
+                    let mut r = Renderer::new(&p, &NoFootage, RenderOpts::default());
+                    r.cache = Some(&cache);
+                    let ctx = r.eval_ctx(cid, Tick::ZERO).unwrap();
+                    start.wait();
+                    r.styled_layer(&ctx, &p.comp(cid).unwrap().layers[0]).unwrap()
+                })
+            })
+            .collect();
+        hs.into_iter().map(|h| h.join().unwrap()).collect()
+    });
+    let first = &styled[0];
+    assert!(!first.passes.is_empty(), "the drop shadow is a pass");
+    for st in &styled {
+        assert!(std::sync::Arc::ptr_eq(&st.body, &first.body), "one body");
+        assert!(st.passes.iter().zip(&first.passes).all(|(a, b)| std::sync::Arc::ptr_eq(&a.0, &b.0)), "one set of passes");
+    }
+}
+
+/// A styled layer served from the cache lists the files of the body and passes it was served,
+/// not only its content's (#3184): one made of other files (another worker's, or from disk,
+/// whose list can't vouch for them) passes that on to the buffers made of it (flattened, in the
+/// blending space), which are then not kept on disk as complete.
+#[test]
+fn a_cached_styled_layer_lists_the_files_of_its_cached_buffers() {
+    let (p, cid) = scene([1.0; 3], None, |p, c, l| add(p, c, l, "dropShadow"));
+    let layer = &p.comp(cid).unwrap().layers[0];
+    let styled = |cache: &crate::LayerCache| {
+        let mut r = Renderer::new(&p, &NoFootage, RenderOpts::default());
+        r.cache = Some(cache);
+        let ctx = r.eval_ctx(cid, Tick::ZERO).unwrap();
+        r.styled_layer(&ctx, layer).unwrap()
+    };
+    let first = styled(&crate::LayerCache::default());
+    assert!(first.files.is_complete() && !first.passes.is_empty());
+    let key = first.key.unwrap();
+    // Body and passes kept with a list that can't vouch for them; the content renders again.
+    let cache = crate::LayerCache::default();
+    let mut unsure = crate::reads::ReadFiles::default();
+    unsure.mark_incomplete();
+    let unsure = std::sync::Arc::new(unsure);
+    cache.insert(key, first.body.clone(), unsure.clone());
+    for (i, (b, _)) in first.passes.iter().enumerate() {
+        cache.insert(crate::cache::derive(key, i as u64 + 1), b.clone(), unsure.clone());
+    }
+    let hit = styled(&cache);
+    assert!(std::sync::Arc::ptr_eq(&hit.body, &first.body), "the cached body");
+    assert!(!hit.files.is_complete(), "{:?}", hit.files);
+}
diff --git a/crates/render/src/tests_time.rs b/crates/render/src/tests/time.rs
similarity index 67%
rename from crates/render/src/tests_time.rs
rename to crates/render/src/tests/time.rs
index 8739140de..f959401bb 100644
--- a/crates/render/src/tests_time.rs
+++ b/crates/render/src/tests/time.rs
@@ -1,7 +1,10 @@
 //! Time effects through the renderer: neighbouring frames via `EffectHost::self_at`, and the
 //! layer cache staying correct while scrubbing.
 
+use std::sync::Arc;
+
 use effectcraft_color::Label;
+use effectcraft_effects::plugin::{EffectPlugin, PluginFrame, PluginManifest, PluginParams, register_plugin};
 use effectcraft_keyframe::{Keyframe, ShapePath, Value};
 use effectcraft_project::build::{self, Ids};
 use effectcraft_project::{Comp, ItemId, ItemKind, LayerSource, MaskMode, Project, Solid};
@@ -134,7 +137,17 @@ fn input_keys_ignore_later_effects() {
     }
     let key = |p: &Project| {
         let comp = p.comp(cid).unwrap();
-        let ctx = crate::EvalCtx { project: p, comp_id: cid, comp, time: Tick::from_seconds_f64(0.5), expr: None, footage: None };
+        let ctx = crate::EvalCtx {
+            project: p,
+            comp_id: cid,
+            comp,
+            time: Tick::from_seconds_f64(0.5),
+            expr: None,
+            footage: None,
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: None,
+        };
         let l = &comp.layers[0];
         (crate::cache::input_key(&ctx, l, 1.0, false, false, 1), crate::cache::input_key(&ctx, l, 1.0, false, false, 2))
     };
@@ -147,3 +160,89 @@ fn input_keys_ignore_later_effects() {
     set(&mut p, "effects/#1/blurriness", 8.0);
     assert_ne!(key(&p).0, one);
 }
+
+/// A plug-in that reads the layer's neighbouring frames (WebAssembly ABI 2) makes its layer's
+/// cache key depend on the layer time, even when the source and every property are static. A
+/// plug-in that does not keeps the old key (#1977: a static layer stays cached across a scrub).
+#[test]
+fn abi2_plugin_layers_key_on_layer_time() {
+    struct NeighbourReader {
+        m: PluginManifest,
+    }
+
+    impl EffectPlugin for NeighbourReader {
+        fn manifest(&self) -> &PluginManifest {
+            &self.m
+        }
+
+        fn render(&self, _frame: &mut PluginFrame, _params: &PluginParams, _time: f64) -> Result<(), String> {
+            Ok(())
+        }
+
+        fn reads_other_times(&self) -> bool {
+            true
+        }
+    }
+
+    struct Plain {
+        m: PluginManifest,
+    }
+
+    impl EffectPlugin for Plain {
+        fn manifest(&self) -> &PluginManifest {
+            &self.m
+        }
+
+        fn render(&self, _frame: &mut PluginFrame, _params: &PluginParams, _time: f64) -> Result<(), String> {
+            Ok(())
+        }
+    }
+
+    /// A static white solid with one plug-in effect, registered by `plugin`.
+    fn plugin_scene(plugin: Arc<dyn EffectPlugin>) -> (Project, ItemId) {
+        let mut p = Project::default();
+        let comp = Comp::new(200, 100, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+        let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+        let sid = p.add_item("Solid", Label::Red, None, ItemKind::Solid(Solid { color: [1.0, 1.0, 1.0], width: 200, height: 100, pixel_aspect: 1.0 }));
+        let mut l = build::layer(&mut p, &comp, "Solid", LayerSource::Solid { item: sid }, (200, 100), None);
+        let spec = register_plugin(plugin).unwrap();
+        let mut next = p.next_id;
+        let g = effectcraft_effects::instantiate(spec, &mut Ids(&mut next), spec.name, [200.0, 100.0]);
+        p.next_id = next;
+        l.props.sub_mut("effects").unwrap().children.push(g.into());
+        p.comp_mut(cid).unwrap().layers.push(l);
+        (p, cid)
+    }
+
+    fn key(p: &Project, cid: ItemId, t: f64) -> Option<u64> {
+        let comp = p.comp(cid).unwrap();
+        let ctx = crate::EvalCtx {
+            project: p,
+            comp_id: cid,
+            comp,
+            time: Tick::from_seconds_f64(t),
+            expr: None,
+            footage: None,
+            property_overrides: &[],
+            media_overrides: &[],
+            reads: None,
+        };
+        crate::cache::layer_key(&ctx, &comp.layers[0], 1.0, false, false)
+    }
+
+    let manifest = |id: &str| PluginManifest {
+        api: 2,
+        id: id.into(),
+        name: "Key".into(),
+        category: "Test Plug-ins".into(),
+        version: "1".into(),
+        author: String::new(),
+        description: String::new(),
+        params: vec![],
+    };
+
+    let (plain, c1) = plugin_scene(Arc::new(Plain { m: manifest("org.test.render.time-key.plain") }));
+    assert_eq!(key(&plain, c1, 0.25), key(&plain, c1, 0.5), "a plain plug-in keeps the old key");
+    let (reader, c2) = plugin_scene(Arc::new(NeighbourReader { m: manifest("org.test.render.time-key.reader") }));
+    assert_ne!(key(&reader, c2, 0.25), key(&reader, c2, 0.5), "an ABI 2 plug-in keys on the layer time");
+}
diff --git a/crates/render/src/tests_mask_blur.rs b/crates/render/src/tests_mask_blur.rs
deleted file mode 100644
index 12b88bbba..000000000
--- a/crates/render/src/tests_mask_blur.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-//! Mask motion blur follows the renderer's motion blur gate: the render options (Render
-//! Settings ▸ Motion Blur, previews), the comp's switch and the precomp layers above.
-
-use effectcraft_color::Label;
-use effectcraft_keyframe::{Keyframe, ShapePath, Value};
-use effectcraft_project::build::{self, Ids};
-use effectcraft_project::{Comp, GroupKind, ItemId, ItemKind, LayerSource, MaskMode, MaskMotionBlur, Node, Project, Solid};
-use effectcraft_time::{FrameRate, Tick};
-
-use crate::{NoFootage, RenderOpts, Renderer};
-
-/// A white 100×100 solid whose rect mask jumps from x 10 (frame 0) to x 50 (frame 1), Mask
-/// Motion Blur On, the layer's own switch off. Rendered half way, unblurred the mask covers x
-/// 30..50; blurred over the shutter it reaches down to x ≈ 20.
-fn project(comp_blur: bool) -> (Project, ItemId) {
-    let mut p = Project::default();
-    let mut comp = Comp::new(100, 100, FrameRate::FPS_30, Tick::from_seconds_f64(1.0));
-    comp.enable_motion_blur = comp_blur;
-    let sid = p.add_item("S", Label::Red, None, ItemKind::Solid(Solid { color: [1.0; 3], width: 100, height: 100, pixel_aspect: 1.0 }));
-    let mut l = build::layer(&mut p, &comp, "S", LayerSource::Solid { item: sid }, (100, 100), None);
-    let mut next = p.next_id;
-    let mut m = build::mask(&mut Ids(&mut next), "Mask 1", ShapePath::rect([20.0, 50.0], 20.0, 100.0), MaskMode::Add, [255, 0, 0]);
-    p.next_id = next;
-    if let GroupKind::Mask { motion_blur, .. } = &mut m.kind {
-        *motion_blur = MaskMotionBlur::On;
-    }
-    let path = m.get_mut("path").unwrap();
-    path.keys = vec![
-        Keyframe::new(Tick::ZERO, Value::Path(ShapePath::rect([20.0, 50.0], 20.0, 100.0))),
-        Keyframe::new(FrameRate::FPS_30.tick_of(1), Value::Path(ShapePath::rect([60.0, 50.0], 20.0, 100.0))),
-    ];
-    l.props.sub_mut("masks").unwrap().children.push(Node::Group(m));
-    l.switches.motion_blur = false;
-    let cid = p.add_item("C", Label::Sandstone, None, ItemKind::Comp(comp.into()));
-    p.comp_mut(cid).unwrap().layers.push(l);
-    (p, cid)
-}
-
-fn alpha_at_25(p: &Project, cid: ItemId, motion_blur: bool) -> f32 {
-    let half = Tick::from_seconds_f64(0.5 / 30.0);
-    Renderer::new(p, &NoFootage, RenderOpts { motion_blur, ..Default::default() }).comp_frame(cid, half).get(25, 50)[3]
-}
-
-#[test]
-fn mask_motion_blur_follows_the_render_and_the_comp() {
-    let (p, cid) = project(true);
-    let a = alpha_at_25(&p, cid, true);
-    assert!(a > 0.05 && a < 0.95, "blurred: {a}");
-    assert!(alpha_at_25(&p, cid, false) < 0.01, "Render Settings ▸ Motion Blur off");
-    let (p, cid) = project(false);
-    assert!(alpha_at_25(&p, cid, true) < 0.01, "the comp's switch off");
-}
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 2aa93ecfa..3a2110e0d 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -12,7 +12,7 @@ use effectcraft_geom::{Mat3, Mat4, Vec3, vec2, vec3};
 use effectcraft_keyframe::{Justify, TextDoc, Value};
 use effectcraft_path::{BezPath, FillRule, StrokeStyle};
 use effectcraft_project::{Layer, PropGroup};
-use effectcraft_raster::Image;
+use effectcraft_raster::{Image, Mask};
 use effectcraft_text::path_text::{self, PathMeasure};
 use effectcraft_text::selectors::{self, BasedOn, Mode, Range, Shape, Wiggly};
 use effectcraft_text::{CharGlyph, TextLayout, char_glyph_style, layout_doc};
@@ -42,7 +42,8 @@ pub struct CharXf {
     pub stroke_hsb: [f64; 3],
     pub stroke_opacity: f64,
     pub stroke_width: f64,
-    /// Tracking (1/1000 em) added before / after the character.
+    /// Tracking (pixels: an animator's Tracking Amount, as After Effects) added before / after
+    /// the character.
     pub track_before: f64,
     pub track_after: f64,
     /// Line Anchor (percent) and the selection weight it was set with.
@@ -187,6 +188,14 @@ pub fn range_value_of(f: f64, offset: f64, units_index: bool, n: usize) -> f64 {
     if units_index { (v * n as f64).round() } else { v * 100.0 }
 }
 
+/// Whether property `uid` of `layer` is a Range Selector's Start, End or Offset while its Units
+/// are Index: the value is then a count of characters (words, lines), not a percentage.
+pub fn in_index_units(layer: &Layer, uid: effectcraft_project::Uid) -> bool {
+    let Some(sel) = layer.props.parent_of(uid).filter(|g| g.match_id == "rangeSelector") else { return false };
+    let is_range_value = sel.props().any(|p| p.uid == uid && matches!(p.match_id.as_str(), "start" | "end" | "offset"));
+    is_range_value && sel.prop("advanced/units").is_some_and(|u| u.value == Value::Enum(1))
+}
+
 /// Selection of every glyph by an animator's selectors, per dimension.
 pub fn animator_selection(ctx: &EvalCtx, layer: &Layer, anim: &PropGroup, lay: &TextLayout) -> Vec<[f64; 3]> {
     let sels: Vec<&PropGroup> = anim.sub("selectors").map(|s| s.groups().filter(|g| g.enabled).collect()).unwrap_or_default();
@@ -234,6 +243,13 @@ pub fn animator_selection(ctx: &EvalCtx, layer: &Layer, anim: &PropGroup, lay: &
             }
             "expressionSelector" => {
                 let Some(prop) = sel.get("amount") else { continue };
+                // Evaluated per character (`textIndex`): the layer's cache key holds the amount
+                // for the first character only, so the buffer must not outlive the session.
+                if prop.has_expression()
+                    && let Some(log) = ctx.reads
+                {
+                    log.mark_unkeyed();
+                }
                 let stat = ctx.v3(layer, sel, "amount", [100.0; 3]);
                 Box::new(move |i, n, prev| {
                     let pv = prev.map(|x| x * 100.0);
@@ -279,11 +295,13 @@ pub fn char_transforms(ctx: &EvalCtx, layer: &Layer, text: &PropGroup, lay: &Tex
         let pos = get("position").map(|v| c3(v, 0.0));
         let anchor = get("anchor").map(|v| c3(v, 0.0));
         let scale = get("scale").map(|v| c3(v, 100.0));
-        let rot = get1("rotation");
-        let rx = get1("rotationX");
-        let ry = get1("rotationY");
-        let skew = get1("skew");
-        let skew_axis = get1("skewAxis");
+        let angles = CharacterAngles {
+            rotation: get1("rotation"),
+            rotation_x: get1("rotationX"),
+            rotation_y: get1("rotationY"),
+            skew: get1("skew"),
+            skew_axis: get1("skewAxis"),
+        };
         let op = get1("opacity");
         let fill = props.get("fillColor").map(|p| ctx.value(layer, p).as_color());
         let stroke = props.get("strokeColor").map(|p| ctx.value(layer, p).as_color());
@@ -330,23 +348,12 @@ pub fn char_transforms(ctx: &EvalCtx, layer: &Layer, text: &PropGroup, lay: &Tex
                     c.scale[d] *= 1.0 + (s[d] / 100.0 - 1.0) * k3[d];
                 }
             }
-            if let Some(r) = rot {
-                c.rotation += r * k;
-            }
-            if let Some(r) = rx {
-                c.rotation_x += r * k;
-            }
-            if let Some(r) = ry {
-                c.rotation_y += r * k;
-            }
-            if let Some(s) = skew {
-                c.skew += s * k;
-            }
-            if let Some(a) = skew_axis {
-                c.skew_axis = a;
-            }
+            angles.apply(c, k);
             if let Some(o) = op {
-                c.opacity *= 1.0 + (o / 100.0 - 1.0) * k;
+                // Blend toward this animator's value, so a later animator can show characters an
+                // earlier one hid (Lottie files rely on it: Opacity 0 % on every character, then
+                // animators at 100 % that sweep in). With one animator this is the same as before.
+                c.opacity += (o - c.opacity) * k;
             }
             if let Some(f) = fill {
                 c.fill = Some(f);
@@ -373,17 +380,7 @@ pub fn char_transforms(ctx: &EvalCtx, layer: &Layer, text: &PropGroup, lay: &Tex
             if let Some(w) = sw {
                 c.stroke_width += w * k;
             }
-            if let Some(t) = tracking {
-                let t = t * k;
-                match tracking_type {
-                    1 => c.track_before += t,
-                    2 => c.track_after += t,
-                    _ => {
-                        c.track_before += t * 0.5;
-                        c.track_after += t * 0.5;
-                    }
-                }
-            }
+            apply_tracking(c, tracking, tracking_type, k);
             if let Some(a) = line_anchor
                 && k.abs() >= c.line_anchor_k
             {
@@ -424,6 +421,50 @@ pub fn char_transforms(ctx: &EvalCtx, layer: &Layer, text: &PropGroup, lay: &Tex
     out
 }
 
+/// Optional animator orientation properties; an omitted property leaves the glyph unchanged.
+struct CharacterAngles {
+    rotation: Option<f64>,
+    rotation_x: Option<f64>,
+    rotation_y: Option<f64>,
+    skew: Option<f64>,
+    skew_axis: Option<f64>,
+}
+
+impl CharacterAngles {
+    fn apply(&self, c: &mut CharXf, k: f64) {
+        if let Some(r) = self.rotation {
+            c.rotation += r * k;
+        }
+        if let Some(r) = self.rotation_x {
+            c.rotation_x += r * k;
+        }
+        if let Some(r) = self.rotation_y {
+            c.rotation_y += r * k;
+        }
+        if let Some(s) = self.skew {
+            c.skew += s * k;
+        }
+        if let Some(a) = self.skew_axis {
+            c.skew_axis = a;
+        }
+    }
+}
+
+/// Distribute selected tracking before and/or after a glyph according to Tracking Type.
+fn apply_tracking(c: &mut CharXf, tracking: Option<f64>, tracking_type: u32, k: f64) {
+    if let Some(t) = tracking {
+        let t = t * k;
+        match tracking_type {
+            1 => c.track_before += t,
+            2 => c.track_after += t,
+            _ => {
+                c.track_before += t * 0.5;
+                c.track_after += t * 0.5;
+            }
+        }
+    }
+}
+
 /// Character Offset / Character Value substitution (None = unchanged).
 pub fn substitute(ch: char, x: &CharXf) -> Option<char> {
     if ch.is_whitespace() {
@@ -479,6 +520,10 @@ pub struct PlacedGlyph {
     pub fill: [f32; 4],
     pub stroke: [f32; 4],
     pub stroke_width: f64,
+    pub join: effectcraft_path::Join,
+    /// Faux Bold (or synthetic bold for a family without a bold face): how far the outline grows
+    /// on every side, in character space (0 when not bold).
+    pub bold: f64,
     /// The character's style fills it (Character panel fill on).
     pub apply_fill: bool,
     /// Index of the character in the text.
@@ -498,8 +543,30 @@ impl PlacedGlyph {
     pub fn path(&self) -> BezPath {
         effectcraft_path::transform(std::slice::from_ref(&self.local), &self.m2()).remove(0)
     }
+    /// [`Self::bold`] in layer space.
+    fn bold_in_layer(&self) -> f64 {
+        self.bold * self.m2().mean_scale()
+    }
+    /// Whether [`Self::bold`] grows the outline as evenly in layer space as in character space:
+    /// no bold, or a matrix that only rotates and scales uniformly.
+    fn bold_is_even(&self) -> bool {
+        let [[a, b, _], [c, d, _], _] = self.m2().0;
+        let n = a * a + b * b + c * c + d * d;
+        self.bold == 0.0 || ((a * a + c * c - b * b - d * d).abs() <= 1e-9 * n && (a * b + c * d).abs() <= 1e-9 * n)
+    }
 }
 
+/// How far a circle of radius `r` reaches along x and along y once mapped by `m`.
+fn axis_reach(m: &Mat3, r: f64) -> [f64; 2] {
+    let [[a, b, _], [c, d, _], _] = m.0;
+    [r * a.hypot(b), r * c.hypot(d)]
+}
+
+/// How far Faux Bold grows a glyph's outline on every side, as a fraction of its size: Inter
+/// Regular grown by this has about the stems of Inter Bold, so synthetic bold stands in for a
+/// missing bold face.
+const FAUX_BOLD_RADIUS: f64 = 0.03;
+
 /// Laid-out, animated text of a layer at the context time.
 pub struct TextGeom {
     pub doc: TextDoc,
@@ -578,11 +645,73 @@ fn align_index(j: Justify) -> u8 {
     }
 }
 
+/// Note the font files `lay` is drawn with in [`EvalCtx::reads`] (#3184), each with its identity
+/// as its bytes were read, so a cache entry of the text is checked against them. What the
+/// files can't vouch for makes the list incomplete: a family that is not installed (installing
+/// it changes the text), a character drawn with a fallback face or with none (another installed
+/// font could take it), a font from memory.
+fn note_fonts(ctx: &EvalCtx, lay: &TextLayout) {
+    note_layout_fonts(ctx, &lay.styles, &lay.layout);
+}
+
+/// A character put in by Character Offset or Character Value (`ch`, in style `st`), outside a
+/// relayout: its outline and advance, with the font it is drawn with noted as [`note_fonts`] does
+/// (the run's face may not have it: a fallback face then draws it).
+fn substituted_glyph(ctx: &EvalCtx, st: &effectcraft_keyframe::CharStyle, ch: char) -> (BezPath, f64) {
+    if ctx.reads.is_some() {
+        // (the layout `char_glyph_style` makes, served from the layout cache there)
+        let lay = effectcraft_text::layout_text(&ch.to_string(), &effectcraft_text::text_style(st), &effectcraft_text::ParagraphStyle::default());
+        note_layout_fonts(ctx, std::slice::from_ref(st), &lay);
+    }
+    char_glyph_style(st, ch)
+}
+
+/// [`note_fonts`] for `layout`, whose glyphs' runs index `styles`.
+fn note_layout_fonts(ctx: &EvalCtx, styles: &[effectcraft_keyframe::CharStyle], layout: &effectcraft_text::Layout) {
+    use crate::reads::{FileStamp, ReadFile};
+    use effectcraft_text::fonts;
+    let Some(log) = ctx.reads else { return };
+    let resolved: Vec<fonts::Resolved> = styles.iter().map(|s| fonts::resolve(&s.font, &s.style)).collect();
+    if resolved.iter().any(|r| r.missing) {
+        log.mark_incomplete();
+    }
+    // Each run's face, glyphs or not: an empty paragraph's face sets its line's metrics (in a
+    // box, the first baseline that places every later line).
+    let mut faces: Vec<fonts::FaceId> = Vec::new();
+    for r in &resolved {
+        if !faces.contains(&r.face) {
+            faces.push(r.face);
+        }
+    }
+    for g in &layout.glyphs {
+        if g.id == 0 || resolved.get(g.run).is_none_or(|r| r.face != g.face) {
+            log.mark_incomplete();
+        }
+        if !faces.contains(&g.face) {
+            faces.push(g.face);
+        }
+    }
+    for id in faces {
+        let face = fonts::face(id);
+        match &face.info.data {
+            fonts::FaceData::Static(_) => {}
+            fonts::FaceData::Shared(_) => log.mark_incomplete(),
+            fonts::FaceData::File(_) => {
+                if let Some((path, meta)) = face.file_read() {
+                    let stamp = meta.map_or(FileStamp::Missing, FileStamp::of_metadata);
+                    log.note(ReadFile::new(path.to_string_lossy().as_ref(), stamp));
+                }
+            }
+        }
+    }
+}
+
 /// Lay out and animate a text layer.
 pub fn text_geom(ctx: &EvalCtx, layer: &Layer) -> Option<TextGeom> {
     let doc = source_text(ctx, layer)?;
     let text = layer.props.sub("text")?;
     let lay = layout_doc(&doc);
+    note_fonts(ctx, &lay);
     let xfs = char_transforms(ctx, layer, text, &lay);
     let three = per_char_3d(ctx, layer);
     let more = text.sub("moreOptions");
@@ -605,6 +734,7 @@ pub fn text_geom(ctx: &EvalCtx, layer: &Layer) -> Option<TextGeom> {
         // Same character count: the style runs still line up.
         let d2 = TextDoc { text: chars.into_iter().collect(), ..doc.clone() };
         let l2 = layout_doc(&d2);
+        note_fonts(ctx, &l2);
         let by_char: std::collections::HashMap<usize, CharXf> = lay.glyphs.iter().zip(&xfs).map(|(g, x)| (g.char_index, *x)).collect();
         let x2: Vec<CharXf> = l2.glyphs.iter().map(|g| by_char.get(&g.char_index).copied().unwrap_or_default()).collect();
         subs = vec![None; l2.glyphs.len()];
@@ -639,10 +769,12 @@ pub fn text_geom(ctx: &EvalCtx, layer: &Layer) -> Option<TextGeom> {
         let (mut la, mut la_k) = (50.0 * f64::from(align_index(justify)), 0.0);
         for gi in li_start..li_end {
             let x = &xfs[gi];
-            let em = lay.styles.get(lay.glyphs[gi].run).map_or(doc.size, |s| s.size) / 1000.0;
-            pen += x.track_before * em;
+            // An animator's Tracking Amount is in pixels, whatever the font size (After Effects
+            // 2026: Amount 30 adds 30 px between selected characters at 80 px and at 40 px), unlike
+            // the Character panel's tracking in 1/1000 em.
+            pen += x.track_before;
             shift[gi] = pen;
-            pen += x.track_after * em + vadv[gi];
+            pen += x.track_after + vadv[gi];
             if x.line_anchor_k > la_k {
                 la = x.line_anchor;
                 la_k = x.line_anchor_k;
@@ -727,7 +859,7 @@ pub fn text_geom(ctx: &EvalCtx, layer: &Layer) -> Option<TextGeom> {
         // Outline (substituted characters aligned in the original slot).
         let (outline, adv) = match subs[gi] {
             Some(c) => {
-                let (p, a) = char_glyph_style(st, c);
+                let (p, a) = substituted_glyph(ctx, st, c);
                 let dx = match x.char_align {
                     0 => 0.0,
                     2 => g.advance - a,
@@ -750,9 +882,12 @@ pub fn text_geom(ctx: &EvalCtx, layer: &Layer) -> Option<TextGeom> {
         };
         // Outline relative to the pivot.
         let local = kurbo::Affine::translate((o[0] - pivot[0], o[1] - pivot[1])) * outline;
-        let char_m = Mat4::rotate_z(x.rotation)
+        // Rx · Ry · Rz (Z turns first): the order After Effects gives a 3D layer's X / Y / Z
+        // Rotation too. #1876 moves layers to it with a helper, `Mat4::rotation_xyz`; once both
+        // land, this should call that helper (one convention, one place).
+        let char_m = Mat4::rotate_x(x.rotation_x)
             * Mat4::rotate_y(x.rotation_y)
-            * Mat4::rotate_x(x.rotation_x)
+            * Mat4::rotate_z(x.rotation)
             * Mat4::from_mat3_affine(&Mat3::skew_deg(-x.skew, x.skew_axis))
             * Mat4::scale(Vec3::from(x.scale) / 100.0)
             * Mat4::translate(-Vec3::from(x.anchor));
@@ -777,6 +912,8 @@ pub fn text_geom(ctx: &EvalCtx, layer: &Layer) -> Option<TextGeom> {
             fill,
             stroke,
             stroke_width: (base_stroke_w + x.stroke_width).max(0.0),
+            join: path_join(doc.line_join),
+            bold: if g.synth_bold { FAUX_BOLD_RADIUS * g.size } else { 0.0 },
             apply_fill: st.apply_fill,
             char_index: g.char_index,
             rest,
@@ -791,6 +928,15 @@ pub fn glyph_paths(ctx: &EvalCtx, layer: &Layer) -> Vec<(BezPath, CharXf)> {
     text_geom(ctx, layer).map(|t| t.glyphs.iter().map(|g| (g.path(), g.xf)).collect()).unwrap_or_default()
 }
 
+fn path_join(j: effectcraft_keyframe::LineJoin) -> effectcraft_path::Join {
+    use effectcraft_keyframe::LineJoin;
+    match j {
+        LineJoin::Miter => effectcraft_path::Join::Miter,
+        LineJoin::Round => effectcraft_path::Join::Round,
+        LineJoin::Bevel => effectcraft_path::Join::Bevel,
+    }
+}
+
 /// One paint pass of a glyph: fill (false) or stroke (true).
 type Pass = (usize, bool);
 
@@ -826,17 +972,41 @@ fn passes(geom: &TextGeom) -> Vec<Pass> {
     v
 }
 
+/// Coverage of the outline grown by `d` on every side (shrunk when `d` is negative): the fill
+/// merged with, or cut by, a round stroke `2|d|` wide, which keeps the edges anti-aliased.
+fn grown_coverage(paths: &[BezPath], mm: &Mat3, w: u32, h: u32, d: f64) -> Mask {
+    let mut cov = effectcraft_path::fill_coverage(paths, mm, w, h, FillRule::NonZero);
+    if d.abs() < 1e-9 {
+        return cov;
+    }
+    let st = StrokeStyle { width: 2.0 * d.abs(), join: effectcraft_path::Join::Round, ..Default::default() };
+    let ring = effectcraft_path::stroke_coverage(paths, &st, mm, w, h);
+    for (c, r) in cov.data.iter_mut().zip(&ring.data) {
+        *c = if d > 0.0 { c.max(*r) } else { c.min(1.0 - r) };
+    }
+    cov
+}
+
 /// Rasterize one pass of a glyph — or of a run of glyphs painted alike, as one outline — (paths
 /// mapped into target pixels by `m`) into a premultiplied patch over the target rect, blurred
-/// when the character has Blur.
-fn raster_pass(g: &PlacedGlyph, stroke: bool, paths: &[BezPath], m: &Mat3, rect: [i64; 4], blur_px: [f64; 2]) -> Image {
+/// when the character has Blur. `bold` is the glyph's Faux Bold in the paths' space.
+fn raster_pass(g: &PlacedGlyph, stroke: bool, paths: &[BezPath], m: &Mat3, rect: [i64; 4], blur_px: [f64; 2], bold: f64) -> Image {
     let (w, h) = ((rect[2] - rect[0]) as u32, (rect[3] - rect[1]) as u32);
     let mm = Mat3::translate(vec2(-rect[0] as f64, -rect[1] as f64)) * *m;
-    let cov = if stroke {
-        let st = StrokeStyle { width: g.stroke_width, join: effectcraft_path::Join::Round, ..Default::default() };
+    let cov = if stroke && bold > 0.0 {
+        // The stroke of the bold outline: the band between it grown and shrunk by half the width.
+        let half = g.stroke_width / 2.0;
+        let mut outer = grown_coverage(paths, &mm, w, h, bold + half);
+        let inner = grown_coverage(paths, &mm, w, h, bold - half);
+        for (o, i) in outer.data.iter_mut().zip(&inner.data) {
+            *o = o.min(1.0 - i);
+        }
+        outer
+    } else if stroke {
+        let st = StrokeStyle { width: g.stroke_width, join: g.join, ..Default::default() };
         effectcraft_path::stroke_coverage(paths, &st, &mm, w, h)
     } else {
-        effectcraft_path::fill_coverage(paths, &mm, w, h, FillRule::NonZero)
+        grown_coverage(paths, &mm, w, h, bold)
     };
     let col = if stroke { g.stroke } else { g.fill };
     let op = (g.xf.opacity / 100.0).clamp(0.0, 1.0) as f32;
@@ -892,10 +1062,16 @@ fn runs(geom: &TextGeom) -> Vec<(Vec<usize>, bool)> {
         if g.xf.opacity <= 0.0 {
             continue;
         }
+        // A run grows its outline in layer space by one radius, which matches each glyph grown in
+        // its own space only when the bold stays round there.
         if geom.blend == BlendMode::Normal
             && solid_fill(g, stroke)
+            && g.bold_is_even()
             && let Some((run, false)) = out.last_mut()
-            && run.last().is_some_and(|&p| solid_fill(&geom.glyphs[p], false) && geom.glyphs[p].fill == g.fill)
+            && run.last().is_some_and(|&p| {
+                let q = &geom.glyphs[p];
+                solid_fill(q, false) && q.fill == g.fill && q.bold_is_even() && (q.bold_in_layer() - g.bold_in_layer()).abs() < 1e-6
+            })
         {
             run.push(gi);
             continue;
@@ -917,28 +1093,31 @@ fn draw_glyphs(geom: &TextGeom, img: &mut Image, to_px: &Mat3, s: f64, only: Opt
         // One glyph is drawn from its own outline; a run from its glyphs' outlines in layer
         // space, all wound the same way so overlaps add up instead of cancelling (NonZero).
         let local = Cow::Borrowed(std::slice::from_ref(&g.local));
-        let (paths, m): (Cow<[BezPath]>, Mat3) = match (only, run.as_slice()) {
-            (Some(_), _) => (local, *to_px),
-            (None, [_]) => (local, *to_px * g.m2()),
+        let (paths, m, bold): (Cow<[BezPath]>, Mat3, f64) = match (only, run.as_slice()) {
+            (Some(_), _) => (local, *to_px, g.bold),
+            (None, [_]) => (local, *to_px * g.m2(), g.bold),
             (None, _) => {
                 let wound = |p: BezPath| if kurbo::Shape::area(&p) < 0.0 { p.reverse_subpaths() } else { p };
-                (Cow::Owned(run.iter().map(|&gi| wound(geom.glyphs[gi].path())).collect()), *to_px)
+                (Cow::Owned(run.iter().map(|&gi| wound(geom.glyphs[gi].path())).collect()), *to_px, g.bold_in_layer())
             }
         };
         let Some(b) = effectcraft_path::bounds(&paths) else { continue };
         let blur = [g.xf.blur[0] * s, g.xf.blur[1] * s];
-        let pad = g.stroke_width * m.mean_scale() + 2.0 + blur[0].max(blur[1]) * 1.5;
+        // Stroke and bold grow the outline in the paths' space: under a non-uniform `m` they reach
+        // further along one axis than the other.
+        let [px, py] = axis_reach(&m, g.stroke_width + 2.0 * bold);
+        let pad = 2.0 + blur[0].max(blur[1]) * 1.5;
         let r = m.map_rect(&effectcraft_geom::Rect::new(b.x0, b.y0, b.x1, b.y1));
         let rect = [
-            ((r.x0 - pad).floor() as i64).max(0),
-            ((r.y0 - pad).floor() as i64).max(0),
-            ((r.x1 + pad).ceil() as i64).min(w),
-            ((r.y1 + pad).ceil() as i64).min(h),
+            ((r.x0 - px - pad).floor() as i64).max(0),
+            ((r.y0 - py - pad).floor() as i64).max(0),
+            ((r.x1 + px + pad).ceil() as i64).min(w),
+            ((r.y1 + py + pad).ceil() as i64).min(h),
         ];
         if rect[2] <= rect[0] || rect[3] <= rect[1] {
             continue;
         }
-        let patch = raster_pass(g, stroke, &paths, &m, rect, blur);
+        let patch = raster_pass(g, stroke, &paths, &m, rect, blur, bold);
         blit(img, &patch, [rect[0], rect[1]], if only.is_some() { BlendMode::Normal } else { geom.blend });
     }
 }
@@ -988,8 +1167,9 @@ pub fn render_in(ctx: &EvalCtx, layer: &Layer, s: f64, clip: Option<kurbo::Rect>
     let mut bounds: Option<kurbo::Rect> = None;
     for g in &geom.glyphs {
         if let Some(b) = effectcraft_path::bounds(&[g.path()]) {
+            let [bx, by] = axis_reach(&g.m2(), 2.0 * g.bold);
             let pad = g.stroke_width + 2.0 + g.xf.blur[0].max(g.xf.blur[1]) * 1.5;
-            let b = b.inflate(pad, pad);
+            let b = b.inflate(pad + bx, pad + by);
             bounds = Some(bounds.map_or(b, |a| a.union(b)));
         }
     }
@@ -1012,7 +1192,7 @@ pub fn per_char_planes(ctx: &EvalCtx, layer: &Layer, s: f64) -> Vec<(Buf, Mat4)>
             continue;
         }
         let Some(b) = effectcraft_path::bounds(std::slice::from_ref(&g.local)) else { continue };
-        let pad = g.stroke_width + 2.0 + g.xf.blur[0].max(g.xf.blur[1]) * 1.5;
+        let pad = g.stroke_width + 2.0 * g.bold + 2.0 + g.xf.blur[0].max(g.xf.blur[1]) * 1.5;
         let b = b.inflate(pad, pad);
         let w = ((b.width() * s).ceil() as u32 + 4).clamp(1, 4096);
         let h = ((b.height() * s).ceil() as u32 + 4).clamp(1, 4096);
diff --git a/crates/render/src/text/tests.rs b/crates/render/src/text/tests.rs
index 020e08517..9b52d3098 100644
--- a/crates/render/src/text/tests.rs
+++ b/crates/render/src/text/tests.rs
@@ -99,6 +99,24 @@ fn range_based_on_words_and_lines() {
     assert_eq!(s, vec![0.0, 1.0, 1.0, 0.0, 0.0, 0.0, 0.0], "{s:?}");
 }
 
+/// With Units = Index a Range Selector's Start, End and Offset are character counts, not
+/// percentages (#1814); the selector's other values, and other selectors, are unaffected.
+#[test]
+fn index_units_mark_start_end_and_offset() {
+    let (mut p, _cid, comp) = setup(400, 200);
+    let mut l = text_layer(&mut p, &comp, doc("ABCDEFG", 30.0));
+    animator(&mut p, &mut l, &["opacity"], &["range", "wiggly"]);
+    let uid = |l: &Layer, path: &str| l.props.prop(path).unwrap_or_else(|| panic!("no {path}")).uid;
+    let base = "text/animators/#1/selectors/#1";
+    let range_values = ["start", "end", "offset"].map(|k| uid(&l, &format!("{base}/{k}")));
+    assert!(range_values.iter().all(|u| !in_index_units(&l, *u)), "Percentage, the default");
+    set(&mut l, &format!("{base}/advanced/units"), Value::Enum(1));
+    assert!(range_values.iter().all(|u| in_index_units(&l, *u)));
+    assert!(!in_index_units(&l, uid(&l, &format!("{base}/advanced/amount"))), "Amount stays a percentage");
+    assert!(!in_index_units(&l, uid(&l, "text/animators/#1/properties/opacity")));
+    assert!(!in_index_units(&l, uid(&l, "transform/opacity")));
+}
+
 #[test]
 fn range_start_end_and_offset_are_capped() {
     let (mut p, cid, comp) = setup(400, 200);
@@ -202,9 +220,9 @@ fn tracking_line_anchor_and_character_offset() {
     animator(&mut p, &mut l, &["tracking", "lineAnchor"], &["range"]);
     p.comp_mut(cid).unwrap().layers.push(l);
     let w0 = bounds_of(&glyph_paths(&ctx(&p, cid, 0.0), &p.comp(cid).unwrap().layers[0]));
-    set(&mut p.comp_mut(cid).unwrap().layers[0], "text/animators/#1/properties/tracking", Value::Scalar(500.0));
+    set(&mut p.comp_mut(cid).unwrap().layers[0], "text/animators/#1/properties/tracking", Value::Scalar(20.0));
     let w1 = bounds_of(&glyph_paths(&ctx(&p, cid, 0.0), &p.comp(cid).unwrap().layers[0]));
-    // 4 chars × 500/1000 em × 40 px: the last glyph moves ~ 3.5 × 20 px further (before & after).
+    // Tracking Amount 20 (pixels, as After Effects): the last glyph moves ~ 3.5 × 20 px further (before & after).
     assert!((w1.width() - w0.width() - 3.0 * 20.0).abs() < 1.5, "{} {}", w0.width(), w1.width());
     assert!((w1.x0 - w0.x0 - 10.0).abs() < 1.0, "first char shifts by half its tracking: {} {}", w0.x0, w1.x0);
     // Line Anchor 100%: tracking grows to the left.
@@ -244,10 +262,10 @@ fn tracking_grows_from_each_paragraphs_alignment() {
         p.comp_mut(cid).unwrap().layers.push(l);
         glyph_paths(&ctx(&p, cid, 0.0), &p.comp(cid).unwrap().layers[0])
     };
-    // 4 chars × 500/1000 em × 40 px: 20 px of tracking each, half before and half after.
+    // Tracking Amount 20 (pixels): 20 px of tracking each, half before and half after.
     for (justify, x0, centre, x1) in [(Justify::Left, 10.0, 40.0, 70.0), (Justify::Center, -30.0, 0.0, 30.0), (Justify::Right, -70.0, -40.0, -10.0)] {
         let d = TextDoc { justify, ..doc("ABCD", 40.0) };
-        let (w0, w1) = (bounds_of(&tracked(d.clone(), 0.0)), bounds_of(&tracked(d, 500.0)));
+        let (w0, w1) = (bounds_of(&tracked(d.clone(), 0.0)), bounds_of(&tracked(d, 20.0)));
         let got = [w1.x0 - w0.x0, w1.center().x - w0.center().x, w1.x1 - w0.x1];
         assert!(got.iter().zip([x0, centre, x1]).all(|(g, w)| (g - w).abs() < 1.0), "{justify:?}: moved {got:?}, want {:?}", [x0, centre, x1]);
     }
@@ -259,11 +277,36 @@ fn tracking_grows_from_each_paragraphs_alignment() {
         let (a, b): (Vec<_>, Vec<_>) = paths.into_iter().partition(|g| bounds_of(std::slice::from_ref(g)).center().y < 10.0);
         [bounds_of(&a), bounds_of(&b)]
     };
-    let ([a0, b0], [a1, b1]) = (lines(tracked(d.clone(), 0.0)), lines(tracked(d, 500.0)));
+    let ([a0, b0], [a1, b1]) = (lines(tracked(d.clone(), 0.0)), lines(tracked(d, 20.0)));
     assert!((a1.x0 - a0.x0 - 10.0).abs() < 1.0, "the left paragraph grows right: {} {}", a0.x0, a1.x0);
     assert!((b1.x1 - b0.x1 + 10.0).abs() < 1.0, "the right paragraph grows left: {} {}", b0.x1, b1.x1);
 }
 
+/// #1798: After Effects adds Tracking Amount in absolute pixels between neighbouring characters,
+/// independent of font size.
+#[test]
+fn text_animator_tracking_amount_uses_pixels_independent_of_font_size() {
+    let width_diff = |font_size: f64, amount: f64| {
+        let (mut p, cid, comp) = setup(2000, 400);
+        let mut l = text_layer(&mut p, &comp, doc("ABCDE", font_size));
+        animator(&mut p, &mut l, &["tracking"], &["range"]);
+        set(&mut l, "text/animators/#1/properties/tracking", Value::Scalar(amount));
+        p.comp_mut(cid).unwrap().layers.push(l);
+        let w = bounds_of(&glyph_paths(&ctx(&p, cid, 0.0), &p.comp(cid).unwrap().layers[0])).width();
+        let (mut p0, cid0, comp0) = setup(2000, 400);
+        let l0 = text_layer(&mut p0, &comp0, doc("ABCDE", font_size));
+        p0.comp_mut(cid0).unwrap().layers.push(l0);
+        let w0 = bounds_of(&glyph_paths(&ctx(&p0, cid0, 0.0), &p0.comp(cid0).unwrap().layers[0])).width();
+        w - w0
+    };
+    // 5 characters = 4 gaps. In After Effects, Tracking Amount 100 adds 100 px per gap = 400 px total width delta,
+    // regardless of whether font size is 50 px or 200 px.
+    let diff_50 = width_diff(50.0, 100.0);
+    let diff_200 = width_diff(200.0, 100.0);
+    assert!((diff_50 - 400.0).abs() < 1.0, "font_size 50 px width delta: {diff_50}");
+    assert!((diff_200 - 400.0).abs() < 1.0, "font_size 200 px width delta: {diff_200}");
+}
+
 #[test]
 fn anchor_grouping_line_rotates_around_line_centre() {
     let (mut p, cid, comp) = setup(600, 300);
@@ -461,6 +504,37 @@ fn per_character_3d_projects_characters() {
     assert!(b[2] - b[0] < flat[2] - flat[0] && b[2] > b[0] + 10, "{b:?} {flat:?}");
 }
 
+/// After Effects 2026 (case 931: "H", 400 px, per-character 3D, X / Y / Z Rotation 40 / 30 /
+/// 20): a character turns like a 3D layer, Rx · Ry · Rz (Z first), so its matrix is the same
+/// product as a layer's X / Y / Z Rotation. The render then matches AE (3 of 5184 grid points
+/// off at edges; with Rz · Ry · Rx 23).
+#[test]
+fn per_character_rotation_turns_z_first_as_a_3d_layer() {
+    let (mut p, cid, comp) = setup(400, 300);
+    let mut l = text_layer(&mut p, &comp, doc("H", 80.0));
+    l.switches.three_d = true;
+    animator(&mut p, &mut l, &["rotation"], &["range"]);
+    let mut next = p.next_id;
+    let mut extra = build::text_anim_props(&mut Ids(&mut next), "rotation", true);
+    p.next_id = next;
+    let props: &mut PropGroup = l.props.group_mut("text/animators/#1/properties").unwrap();
+    props.children.retain(|c| c.match_id() != "rotation");
+    props.children.extend(extra.drain(..).map(Into::into));
+    for (id, v) in [("rotationX", 40.0), ("rotationY", 30.0), ("rotation", 20.0)] {
+        props.get_mut(id).unwrap().value = Value::Scalar(v);
+    }
+    l.props.sub_mut("text").unwrap().get_mut("perChar3d").unwrap().value = Value::Bool(true);
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let geom = text_geom(&ctx(&p, cid, 0.0), &p.comp(cid).unwrap().layers[0]).unwrap();
+    let g = &geom.glyphs[0];
+    let want = Mat4::rotate_x(40.0) * Mat4::rotate_y(30.0) * Mat4::rotate_z(20.0);
+    for r in 0..3 {
+        for c in 0..3 {
+            assert!((g.m.0[r][c] - want.0[r][c]).abs() < 1e-9, "row {r} col {c}: {:?} vs {:?}", g.m.0, want.0);
+        }
+    }
+}
+
 #[test]
 fn keyframed_selector_animates() {
     let (mut p, cid, comp) = setup(400, 200);
@@ -474,6 +548,22 @@ fn keyframed_selector_animates() {
     assert_eq!(selection(&p, cid, 1.0, 1), vec![0.0; 4]);
 }
 
+#[test]
+fn a_later_animator_opacity_shows_characters_an_earlier_one_hid() {
+    let (mut p, cid, comp) = setup(400, 200);
+    let mut l = text_layer(&mut p, &comp, doc("ABCD", 40.0));
+    animator(&mut p, &mut l, &["opacity"], &["range"]);
+    set(&mut l, "text/animators/#1/properties/opacity", Value::Scalar(0.0));
+    animator(&mut p, &mut l, &["opacity"], &["range"]);
+    set(&mut l, "text/animators/#2/properties/opacity", Value::Scalar(60.0));
+    set(&mut l, "text/animators/#2/selectors/#1/end", Value::Scalar(50.0));
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let glyphs = glyph_paths(&ctx(&p, cid, 0.0), &p.comp(cid).unwrap().layers[0]);
+    let opacity: Vec<f64> = glyphs.iter().map(|g| (g.1.opacity * 1000.0).round() / 1000.0).collect();
+    // The second animator selects "AB" only: they come back at 60 %, "CD" stay hidden.
+    assert_eq!(opacity, [60.0, 60.0, 0.0, 0.0]);
+}
+
 #[test]
 fn caret_follows_animators_and_path_text() {
     let (mut p, cid, comp) = setup(400, 400);
@@ -524,6 +614,8 @@ fn touching_glyphs_join_without_a_seam() {
             fill,
             stroke: [0.0; 4],
             stroke_width: 0.0,
+            join: effectcraft_path::Join::Miter,
+            bold: 0.0,
             apply_fill: true,
             char_index: 0,
             rest: [0.0; 2],
@@ -551,6 +643,65 @@ fn touching_glyphs_join_without_a_seam() {
     assert!(multiply[3] < 0.9, "{multiply:?}");
 }
 
+/// #1676: Faux Bold, and the synthetic bold of a style the family has no face for, are drawn.
+#[test]
+fn faux_bold_and_synthetic_bold_thicken_the_glyphs() {
+    // Total alpha and the alpha bounding box of a rendered word.
+    let ink = |d: TextDoc| {
+        let (mut p, cid, comp) = setup(400, 120);
+        let mut l = text_layer(&mut p, &comp, TextDoc { text: "Hamburg".into(), size: 60.0, ..d });
+        set(&mut l, "transform/position", Value::Vec3([40.0, 85.0, 0.0]));
+        p.comp_mut(cid).unwrap().layers.push(l);
+        let img = crate::render_frame(&p, cid, Tick::ZERO, 1.0);
+        (img.data.iter().map(|px| px[3]).sum::<f32>(), alpha_bbox(&img).unwrap())
+    };
+    let (plain, pb) = ink(TextDoc::default());
+    let (bold, bb) = ink(TextDoc { faux_bold: true, ..Default::default() });
+    assert!(bold > plain * 1.15, "faux bold adds ink: {plain} → {bold}");
+    // 0.03 em = 1.8 px on every side.
+    let grow = (bb[2] - bb[0]) - (pb[2] - pb[0]);
+    assert!((3..=6).contains(&grow), "and widens the word by about 3.6 px: {pb:?} → {bb:?}");
+    // Bundled Inter has no Bold Italic face: the italic face is drawn with synthetic bold.
+    let (italic, _) = ink(TextDoc { style: "Italic".into(), ..Default::default() });
+    let (bold_italic, _) = ink(TextDoc { style: "Bold Italic".into(), ..Default::default() });
+    assert!(bold_italic > italic * 1.15, "Bold Italic is bolder than Italic: {italic} → {bold_italic}");
+    // A stroke follows the bold outline: as wide as before, moved out with it.
+    let stroked = TextDoc { apply_fill: false, apply_stroke: true, stroke: [1.0; 4], stroke_width: 4.0, ..Default::default() };
+    let (ring, rb) = ink(stroked.clone());
+    let (bold_ring, brb) = ink(TextDoc { faux_bold: true, ..stroked });
+    assert!(bold_ring > ring * 0.95 && bold_ring < ring * 1.3, "the stroke keeps its width: {ring} → {bold_ring}");
+    assert!(brb[0] < rb[0] && brb[2] > rb[2], "{rb:?} → {brb:?}");
+}
+
+/// #1676: under a non-uniform character Scale the bold is grown in the character's space, so it
+/// reaches further along the stretched axis; it is neither clipped nor grown evenly in a run.
+#[test]
+fn faux_bold_under_a_non_uniform_scale() {
+    use kurbo::Shape;
+    let glyph = |x0: f64| PlacedGlyph {
+        local: kurbo::Rect::new(x0, 4.0, x0 + 4.0, 16.0).to_path(0.1),
+        m: Mat4::scale(vec3(9.0, 1.0, 1.0)),
+        xf: CharXf::default(),
+        fill: [1.0; 4],
+        stroke: [0.0; 4],
+        stroke_width: 0.0,
+        join: effectcraft_path::Join::Miter,
+        bold: 2.0,
+        apply_fill: true,
+        char_index: 0,
+        rest: [0.0; 2],
+    };
+    let geom = |glyphs| TextGeom { doc: TextDoc::default(), glyphs, fill_stroke: 0, blend: BlendMode::Normal };
+    assert_eq!(runs(&geom(vec![glyph(2.0), glyph(6.0)])).len(), 2, "bold glyphs stretched unevenly are drawn one by one");
+    // x 6..10 → 54..90, grown by 2 × 9 = 18 → 36..108; y 4..16 grown by 2 → 2..18.
+    let mut img = crate::Image::new(120, 24);
+    draw_glyphs(&geom(vec![glyph(6.0)]), &mut img, &Mat3::IDENTITY, 1.0, None);
+    for (x, y) in [(37, 10), (106, 10), (70, 3)] {
+        assert!(img.get(x, y)[3] > 0.99, "bold ink at ({x}, {y}): {:?}", img.get(x, y));
+    }
+    assert!(img.get(34, 10)[3] < 0.01 && img.get(110, 10)[3] < 0.01 && img.get(70, 0)[3] < 0.01);
+}
+
 /// #1011: what dragging a Range Selector bar to fraction `f` of the text writes.
 #[test]
 fn range_bar_drag_values() {
@@ -564,3 +715,90 @@ fn range_bar_drag_values() {
     assert_eq!(range_value_of(3.6 / 7.0, 0.0, true, 7), 4.0);
     assert_eq!(range_value_of(3.6 / 7.0, 2.0 / 7.0, true, 7), 2.0, "less a 2-character Offset");
 }
+
+/// Text names the font files it is drawn with (#3184), with their identity as they were read, so
+/// a cache entry of it is checked against them; what the files can't vouch for (a family that
+/// isn't installed) leaves the list incomplete.
+#[test]
+fn text_notes_the_font_files_it_draws_with() {
+    use crate::reads::{FileStamp, ReadLog};
+    use effectcraft_text::fonts::{self, FaceData, FaceInfo, FontSource};
+    struct OneFile(std::path::PathBuf);
+    impl FontSource for OneFile {
+        fn faces(&self) -> Vec<FaceInfo> {
+            vec![FaceInfo {
+                family: "Reads Test Sans".into(),
+                style: "Regular".into(),
+                weight: 400,
+                italic: false,
+                index: 0,
+                data: FaceData::File(self.0.clone()),
+                origin: "system",
+                native_family: None,
+                full_name: "Reads Test Sans Regular".into(),
+                postscript: None,
+                variable: false,
+                instances: vec![],
+            }]
+        }
+    }
+    // (a fresh directory, removed when the test ends, panicking or not)
+    let dir = tempfile::tempdir().unwrap();
+    let font = dir.path().join("reads-test-sans.ttf");
+    std::fs::write(&font, fonts::INTER_REGULAR).unwrap();
+    fonts::add_source(&OneFile(font.clone()));
+    let stamp = FileStamp::native(&font.to_string_lossy()).unwrap();
+    // (`value`: a Character Value animator puts that character in for every one)
+    let files_with = |family: &str, value: Option<char>| {
+        let (mut p, cid, comp) = setup(200, 80);
+        let mut l =
+            text_layer(&mut p, &comp, TextDoc { text: "Hi there\rtwo".into(), font: family.into(), style: "Regular".into(), size: 30.0, ..Default::default() });
+        if let Some(c) = value {
+            animator(&mut p, &mut l, &["characterValue"], &["range"]);
+            set(&mut l, "text/animators/#1/properties/characterValue", Value::Scalar(c as u32 as f64));
+        }
+        p.comp_mut(cid).unwrap().layers.push(l);
+        let log = ReadLog::new();
+        let c = EvalCtx { reads: Some(&log), ..ctx(&p, cid, 0.0) };
+        assert!(text_geom(&c, &p.comp(cid).unwrap().layers[0]).is_some());
+        log.into_files()
+    };
+    let files_of = |family: &str| files_with(family, None);
+    let files = files_of("Reads Test Sans");
+    assert!(files.is_complete(), "{files:?}");
+    assert_eq!(files.files().len(), 1, "{files:?}");
+    assert_eq!(files.get(&font.to_string_lossy()), Some(stamp));
+    // The bundled family reads no file.
+    let files = files_of(effectcraft_text::fonts::DEFAULT_FAMILY);
+    assert!(files.is_complete() && files.is_empty(), "{files:?}");
+    // A family that isn't installed falls back: installing it would change the text.
+    assert!(!files_of("No Such Family 3184").is_complete());
+    // A substituted character the face has is drawn with it: the same one file.
+    let files = files_with("Reads Test Sans", Some('B'));
+    assert!(files.is_complete(), "{files:?}");
+    assert_eq!(files.get(&font.to_string_lossy()), Some(stamp));
+    // One it lacks (Inter has no CJK) is drawn with a fallback face, or none: another installed
+    // font could take it, so the list can't vouch for the text.
+    assert!(!files_with("Reads Test Sans", Some('\u{4e2d}')).is_complete());
+    // An empty first paragraph in the face draws no glyph, but in a box its face sets the first
+    // baseline that places the lines after it: the file is read all the same.
+    let (mut p, cid, comp) = setup(200, 80);
+    let base = TextDoc {
+        text: "\rHi".into(),
+        font: fonts::DEFAULT_FAMILY.into(),
+        style: "Regular".into(),
+        size: 30.0,
+        box_size: Some([180.0, 60.0]),
+        ..Default::default()
+    };
+    let first = effectcraft_keyframe::CharStyle { font: "Reads Test Sans".into(), ..base.base_style() };
+    let runs = vec![effectcraft_keyframe::StyleRun { len: 1, style: first }, effectcraft_keyframe::StyleRun { len: 2, style: base.base_style() }];
+    let l = text_layer(&mut p, &comp, TextDoc { runs, ..base });
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let log = ReadLog::new();
+    let c = EvalCtx { reads: Some(&log), ..ctx(&p, cid, 0.0) };
+    assert!(text_geom(&c, &p.comp(cid).unwrap().layers[0]).is_some());
+    let files = log.into_files();
+    assert!(files.is_complete(), "{files:?}");
+    assert_eq!(files.get(&font.to_string_lossy()), Some(stamp), "{files:?}");
+}
diff --git a/crates/render/src/three_d/mod.rs b/crates/render/src/three_d.rs
similarity index 93%
rename from crates/render/src/three_d/mod.rs
rename to crates/render/src/three_d.rs
index bccfc3e05..f2cc1c70a 100644
--- a/crates/render/src/three_d/mod.rs
+++ b/crates/render/src/three_d.rs
@@ -2,7 +2,7 @@
 //! compositor for runs of 3D layers.
 //!
 //! The 2D compositor (`Renderer::comp_frame`) walks the layer stack bottom-to-top; each run of
-//! consecutive 3D layers is handed to [`compose::draw_run`] as a group (2D layers break 3D
+//! consecutive 3D layers is handed to `compose::draw_run` as a group (2D layers break 3D
 //! groups, as in After Effects).
 
 pub mod adv;
diff --git a/crates/render/src/three_d/adv/mod.rs b/crates/render/src/three_d/adv.rs
similarity index 100%
rename from crates/render/src/three_d/adv/mod.rs
rename to crates/render/src/three_d/adv.rs
diff --git a/crates/render/src/three_d/adv/raster.rs b/crates/render/src/three_d/adv/raster.rs
index 972a627bb..1c37a6267 100644
--- a/crates/render/src/three_d/adv/raster.rs
+++ b/crates/render/src/three_d/adv/raster.rs
@@ -8,9 +8,12 @@
 //! (already sorted back to front) are then shaded per fragment and blended over, depth-tested
 //! against the opaque surfaces.
 
+use std::cmp::Reverse;
+use std::collections::BinaryHeap;
+
 use rayon::prelude::*;
 
-use super::scene::{Scene, ShadowMap, Vertex};
+use super::scene::{EnvInfo, Scene, ShadowMap, Vertex};
 use super::shade::{Frag, sample, shade};
 
 /// A rendered target at raster size.
@@ -422,11 +425,114 @@ fn shadow_raster(s: &Scene, m: &ShadowMap, casters: &[usize]) -> Vec<f32> {
     d
 }
 
-/// Build the shadow maps of every shadow-casting light (lights marked `shadow == 0`).
+/// Hard cap on the shadow depth texels one render allocates (f32 depth texels).
+/// Quality map sizes derive from the raster resolution, and both the resolution and
+/// the light count come from the project, so without a scene-wide budget an
+/// arbitrarily large comp with arbitrarily many casting lights (point lights cost
+/// six faces) could balloon the allocation. 26 M texels (≈ 104 MB) holds one point
+/// light's full 2048-texel cube (6 × 2048² ≈ 25.2 M) and stays under WebGPU's default
+/// 128 MiB storage-binding limit; adapters with less fall back to the CPU raster.
+pub(crate) const MAX_SHADOW_TEXELS: u64 = 26_000_000;
+
+/// Long side of a quality shadow map: one map texel per output pixel, to a power of
+/// two, clamped to 512..4096 (raster sizes are user data and may be absurd). Draft
+/// (interactive fast-preview) renders keep the flat 512 budget, unchanged.
+pub(crate) fn shadow_map_size(width: u32, height: u32, draft: bool) -> u32 {
+    if draft {
+        return 512;
+    }
+    let side = width.max(height).clamp(512, 4096);
+    let mut size = 512u32;
+    while size < side {
+        size *= 2;
+    }
+    size
+}
+
+/// Per-face size of a point light's cube map: the full map size, since each face spans
+/// 90° and anything smaller is coarser than a spot light's map in the same comp (a
+/// point light low over a floor shows exactly that as stair-steps), capped at 2048 so
+/// one cube fits [`MAX_SHADOW_TEXELS`]. Draft keeps half the map size as before.
+pub(crate) fn shadow_point_face_size(size: u32, draft: bool) -> u32 {
+    if draft { (size / 2).max(1) } else { size.min(2048) }
+}
+
+/// Per-light map sizes (`None` = this light gets no shadow map). `kinds`: 0 = no
+/// shadows (costs nothing), 1 = single map (spot/parallel), 2 = point cube (budgeted
+/// as its six faces). Lights start at their full size; while the scene exceeds
+/// [`MAX_SHADOW_TEXELS`] the largest map above its floor is halved (power-of-two
+/// steps, the earliest light first on ties), and once every light is at its floor the
+/// last lights lose their shadows entirely. Deterministic, and O(n log n) in the
+/// light count: each light is halved at most a handful of times and dropped once.
+pub(crate) fn shadow_sizes(width: u32, height: u32, draft: bool, kinds: &[u32]) -> Vec<Option<u32>> {
+    let base = shadow_map_size(width, height, draft);
+    let faces = |k: u32| -> u64 { if k == 2 { 6 } else { 1 } };
+    let floor = |k: u32| -> u32 { if k == 2 { 128 } else { 512 } };
+    let mut sizes: Vec<u32> = kinds
+        .iter()
+        .map(|&k| match k {
+            0 => 0,
+            2 => shadow_point_face_size(base, draft),
+            _ => base,
+        })
+        .collect();
+    let cost = |z: u32, k: u32| -> u64 { (z as u64) * (z as u64) * faces(k) };
+    let mut total: u64 = sizes.iter().zip(kinds).map(|(&z, &k)| cost(z, k)).sum();
+    // Largest size first, then the lowest index.
+    let mut heap: BinaryHeap<(u32, Reverse<usize>)> =
+        sizes.iter().zip(kinds).enumerate().filter(|(_, (z, k))| **z > floor(**k)).map(|(i, (&z, _))| (z, Reverse(i))).collect();
+    while total > MAX_SHADOW_TEXELS {
+        let Some((z, Reverse(i))) = heap.pop() else { break };
+        let k = kinds[i];
+        total -= cost(z, k) - cost(z / 2, k);
+        sizes[i] = z / 2;
+        if z / 2 > floor(k) {
+            heap.push((z / 2, Reverse(i)));
+        }
+    }
+    for i in (0..sizes.len()).rev() {
+        if total <= MAX_SHADOW_TEXELS {
+            break;
+        }
+        total -= cost(sizes[i], kinds[i]);
+        sizes[i] = 0;
+    }
+    sizes.into_iter().map(|z| (z > 0).then_some(z)).collect()
+}
+
+/// The Environment light's shadow map: one orthographic map over the scene's bounding sphere
+/// from its dominant direction (the light travels from the bright region into the scene), like
+/// a parallel light's.
+fn env_shadow_map(e: EnvInfo, centre: [f64; 3], radius: f64, size: u32) -> ShadowMap {
+    // After Effects' environment-light shadows are soft out of the box, and this
+    // map covers the whole scene bounding sphere — not the view — so its texels
+    // can be coarse (all the more in a draft render's flat 512 budget). A
+    // penumbra of at least eight output pixels, or four map texels where those
+    // are coarser, keeps the edge smooth at any map resolution; Shadow Diffusion
+    // widens it further, as for the other lights.
+    let texel = 2.0 * radius / size as f64;
+    let soft = (4.0 * texel).max(8.0) + (e.shadow_diffusion as f64 * 0.5).min(24.0);
+    let sun = e.sun.map(|v| v as f64);
+    let dir = [-sun[0], -sun[1], -sun[2]];
+    let eye = [centre[0] + sun[0] * radius * 2.0, centre[1] + sun[1] * radius * 2.0, centre[2] + sun[2] * radius * 2.0];
+    let hint = if dir[1].abs() < 0.9 { [0.0, 1.0, 0.0] } else { [0.0, 0.0, 1.0] };
+    let focal = (size as f64 * 0.5 / radius) as f32;
+    ShadowMap { view: basis(eye, dir, hint), focal, ortho: true, size, offset: 0, bias: 1.5, radius: soft as f32 }
+}
+
+/// Build the shadow maps of every shadow-casting light (lights marked `shadow == 0`), and of
+/// the Environment light when it casts shadows and its image has a dominant direction (marked
+/// `env.shadow == 0`, `env.sun != [0; 3]`): one map from that direction, like a parallel light.
 pub(crate) fn shadow_maps(s: &mut Scene, draft: bool) {
     let casters: Vec<usize> = (0..s.indices.len() / 3)
         .filter(|&t| s.materials.get(s.vertices[s.indices[3 * t] as usize].material as usize).is_some_and(|m| m.casts_shadows))
         .collect();
+    // The Environment light casts a shadow when marked and its image has a dominant direction;
+    // with nothing to cast one, its mark is cleared either way.
+    let env_shadow = !casters.is_empty() && s.env.is_some_and(|e| e.shadow == 0 && e.sun != [0.0; 3]);
+    if !env_shadow && let Some(e) = &mut s.env {
+        e.shadow = -1;
+    }
     if casters.is_empty() {
         for l in &mut s.lights {
             l.shadow = -1;
@@ -443,15 +549,39 @@ pub(crate) fn shadow_maps(s: &mut Scene, draft: bool) {
     }
     let centre = [0, 1, 2].map(|k| (lo[k] + hi[k]) * 0.5);
     let radius = ((hi[0] - lo[0]).powi(2) + (hi[1] - lo[1]).powi(2) + (hi[2] - lo[2]).powi(2)).sqrt() * 0.5 + 1.0;
-    let size = if draft { 512 } else { 1024 };
+    // Map sizes come from the raster (a quality map gives ~one texel per output
+    // pixel); the per-light budget keeps the scene allocation bounded because
+    // comp size and light count are user input (point lights cost six faces).
+    let kinds: Vec<u32> = s
+        .lights
+        .iter()
+        .map(|l| {
+            if l.shadow != 0 {
+                0
+            } else if l.kind > 1 {
+                2
+            } else {
+                1
+            }
+        })
+        // The Environment light's map is a single orthographic one.
+        .chain(std::iter::once(if env_shadow { 1 } else { 0 }))
+        .collect();
+    let sizes = shadow_sizes(s.width, s.height, draft, &kinds);
     let mut maps: Vec<ShadowMap> = vec![];
     for li in 0..s.lights.len() {
+        let Some(size) = sizes.get(li).copied().flatten() else {
+            s.lights[li].shadow = -1;
+            continue;
+        };
         if s.lights[li].shadow != 0 {
             s.lights[li].shadow = -1;
             continue;
         }
         let l = s.lights[li];
         let first = maps.len() as i32;
+        // Penumbra width in output pixels (the shader turns it into a tap reach at
+        // the receiver); the sampling bias is deliberately independent of it.
         let soft = 1.0 + (l.shadow_diffusion * 0.5).min(24.0);
         let pos = l.pos.map(|v| v as f64);
         let dir = l.dir.map(|v| v as f64);
@@ -468,7 +598,7 @@ pub(crate) fn shadow_maps(s: &mut Scene, draft: bool) {
                 maps.push(ShadowMap { view: basis(pos, dir, hint), focal, ortho: false, size, offset: 0, bias: 1.5, radius: soft });
             }
             _ => {
-                let fs = size / 2;
+                let fs = size;
                 for (f, d) in [
                     ([1.0, 0.0, 0.0], [0.0, 1.0, 0.0]),
                     ([-1.0, 0.0, 0.0], [0.0, 1.0, 0.0]),
@@ -483,6 +613,25 @@ pub(crate) fn shadow_maps(s: &mut Scene, draft: bool) {
         }
         s.lights[li].shadow = first;
     }
+    // The Environment light's shadow: one orthographic map over the scene from its dominant
+    // direction (the light travels from the bright region into the scene), after the lights'.
+    if env_shadow && let Some(e) = s.env {
+        match sizes.get(s.lights.len()).copied().flatten() {
+            Some(size) => {
+                let first = maps.len() as i32;
+                maps.push(env_shadow_map(e, centre, radius, size));
+                if let Some(e) = &mut s.env {
+                    e.shadow = first;
+                }
+            }
+            // The texel budget dropped it.
+            None => {
+                if let Some(e) = &mut s.env {
+                    e.shadow = -1;
+                }
+            }
+        }
+    }
     let texels: Vec<Vec<f32>> = maps.par_iter().map(|m| shadow_raster(s, m, &casters)).collect();
     for (m, t) in maps.iter_mut().zip(texels) {
         m.offset = s.shadow_texels.len() as u32;
diff --git a/crates/render/src/three_d/adv/scene.rs b/crates/render/src/three_d/adv/scene.rs
index b75d5af7c..6d2b071d5 100644
--- a/crates/render/src/three_d/adv/scene.rs
+++ b/crates/render/src/three_d/adv/scene.rs
@@ -18,7 +18,8 @@ use std::sync::Arc;
 use effectcraft_effects::Buf;
 use effectcraft_geom::{Mat4, Vec3, vec3};
 use effectcraft_model::{self as model, Primitive};
-use effectcraft_project::{ItemKind, Layer, LayerSource, LightKind, PrimitiveKind};
+use effectcraft_project::{ItemKind, Layer, LayerSource, LightKind, PrimitiveKind, Property};
+use effectcraft_time::Tick;
 
 use super::shade::srgb_to_linear;
 use crate::three_d::camera::{CameraState, NEAR};
@@ -157,7 +158,8 @@ pub struct ShadowMap {
     pub offset: u32,
     /// Depth bias in texels (scaled by the texel footprint at the receiver).
     pub bias: f32,
-    /// PCF spread (texels).
+    /// Penumbra width (output pixels) requested by Shadow Diffusion; the shader
+    /// converts it to a tap reach via the receiver's texel footprint.
     pub radius: f32,
 }
 
@@ -171,6 +173,24 @@ pub struct EnvInfo {
     pub intensity: f32,
     /// Radians about the vertical axis.
     pub rotation: f32,
+    /// Unit direction from the scene towards the environment's dominant (radiance-weighted)
+    /// bright region — the direction its shadow is cast from, like a parallel light's
+    /// `to_light`. `[0; 3]` when the image is directionless (uniform, or opposing bright
+    /// regions that cancel) or the light casts no shadow (nothing reads it then): no shadow.
+    pub sun: [f32; 3],
+    /// The image's directional (key) fraction — `|Σ dir·radiance| / Σ radiance` over the
+    /// sphere, 0 for a uniform image and near 1 for a single bright spot. An Environment
+    /// light's shadow occludes only this much of its light: the key lobe is blocked where
+    /// the map says so, the remaining fill keeps shining, so the shadow stays partial the
+    /// way After Effects renders an area-light shadow (a broad environment like the default
+    /// studio shadows softly, a lone bright spot on black almost fully).
+    pub key: f32,
+    /// Shadow map index into [`Scene::shadows`]: 0 marked (assigned by `raster::shadow_maps`),
+    /// -1 casts no shadow. Gated by the light's Cast Shadows.
+    pub shadow: i32,
+    pub shadow_darkness: f32,
+    /// The light's Shadow Diffusion (the penumbra width the shadow map's PCF widens to).
+    pub shadow_diffusion: f32,
 }
 
 #[derive(Clone, Debug, Default)]
@@ -438,6 +458,26 @@ pub fn model_to_layer(unit_scale: f64) -> Mat4 {
     Mat4::scale(vec3(unit_scale, -unit_scale, -unit_scale))
 }
 
+/// Layer time the selected clip started at: the last key that changed the selection, so a clip
+/// keyed on later plays from its first frame. Before any change, the layer clock; likewise under
+/// an expression or an Essential Property override, as the keys don't say when those switch.
+fn clip_start(ctx: &EvalCtx, layer: &Layer, prop: &Property, lt: Tick) -> Tick {
+    if prop.has_expression() || ctx.property_overrides.iter().any(|o| o.layer == layer.id && o.prop == prop.uid) {
+        return Tick::ZERO;
+    }
+    let mut keys = prop.keys.iter().filter(|k| !k.muted && k.time <= lt);
+    let Some(first) = keys.next() else { return Tick::ZERO };
+    let (mut clip, mut start) = (first.value.as_enum(), Tick::ZERO);
+    for k in keys {
+        let v = k.value.as_enum();
+        if v != clip {
+            (clip, start) = (v, k.time);
+        }
+    }
+    start
+}
+
+/// Adds a model layer to the Advanced 3D scene with its material options, opacity and world transform.
 fn model_layer(r: &Renderer, ctx: &EvalCtx, layer: &Layer, b: &mut Builder) {
     let lin = b.s.linear_io;
     let (opts, prim_mat) = model_options(ctx, layer, lin);
@@ -448,12 +488,14 @@ fn model_layer(r: &Renderer, ctx: &EvalCtx, layer: &Layer, b: &mut Builder) {
         LayerSource::Model { item } => {
             let Some(it) = r.project.item(*item) else { return };
             let ItemKind::Footage(f) = &it.kind else { return };
-            let Some(m) = r.footage.model(*item, f) else { return };
+            let Some(m) = r.read(|| r.footage.model(*item, f)) else { return };
             let unit = geo.map_or(1.0, |g| ctx.f(layer, g, "unitScale", 1.0));
             let clip = geo.map_or(0, |g| ctx.e(layer, g, "animation")) as usize;
             let clip = clip.checked_sub(1).filter(|c| *c < m.animations.len());
             let speed = geo.map_or(100.0, |g| ctx.f(layer, g, "animationSpeed", 100.0)) / 100.0;
-            let mut t = layer.layer_time(ctx.time).seconds() * speed;
+            let lt = layer.layer_time(ctx.time);
+            let start = geo.and_then(|g| g.get("animation")).map_or(Tick::ZERO, |p| clip_start(ctx, layer, p, lt));
+            let mut t = (lt - start).seconds() * speed;
             if let Some(c) = clip {
                 let d = m.animations[c].duration();
                 let looping = geo.is_none_or(|g| ctx.b(layer, g, "loopAnimation"));
@@ -571,7 +613,7 @@ pub fn extruded_meshes(ctx: &EvalCtx, layer: &Layer, p: &model::extrude::Extrude
                         groups.push((vec![g.local.clone()], c, g.m, usize::from(!stroke_on_top), g.xf.surface_colors(c)));
                     }
                     if g.stroke_width > 0.0 && g.stroke[3] * op > 0.0 {
-                        let st = effectcraft_path::StrokeStyle { width: g.stroke_width, join: effectcraft_path::Join::Round, ..Default::default() };
+                        let st = effectcraft_path::StrokeStyle { width: g.stroke_width, join: g.join, ..Default::default() };
                         if let Some(region) = crate::shapes::stroke_region(std::slice::from_ref(&g.local), &st) {
                             let c = [g.stroke[0], g.stroke[1], g.stroke[2], g.stroke[3] * op];
                             groups.push((vec![region], c, g.m, usize::from(stroke_on_top), g.xf.surface_colors(c)));
@@ -610,12 +652,13 @@ pub fn extruded_meshes(ctx: &EvalCtx, layer: &Layer, p: &model::extrude::Extrude
     out
 }
 
+/// Adds an extruded layer to the Advanced 3D scene with its card material, opacity and world transform.
 fn extruded_layer(r: &Renderer, ctx: &EvalCtx, layer: &Layer, p: &model::extrude::ExtrudeParams, b: &mut Builder) {
     let base = card_material(ctx, layer);
     let opacity = (ctx.opacity(layer) as f32 * r.opacity_mul()).clamp(0.0, 1.0);
     let world = b.outer * ctx.world_matrix(layer);
     let lin = b.s.linear_io;
-    for (mesh, c, local) in extruded_meshes(ctx, layer, p) {
+    for (mesh, c, local) in extruded_meshes(&r.with_reads(ctx), layer, p) {
         let l = |v: f32| if lin { v } else { srgb_to_linear(v) };
         let m = b.material(Material {
             base: [l(c[0]), l(c[1]), l(c[2]), c[3]],
@@ -653,13 +696,14 @@ fn card(b: &mut Builder, buf: &Buf, world: Mat4, mut mat: Material) {
     b.emit(&p, m, &|_| world);
 }
 
+/// Adds a flat card layer to the Advanced 3D scene with its material, opacity and world transform.
 fn card_layer(r: &Renderer, ctx: &EvalCtx, layer: &Layer, b: &mut Builder) {
     let mut mat = card_material(ctx, layer);
     mat.opacity = (ctx.opacity(layer) as f32 * r.opacity_mul()).clamp(0.0, 1.0);
     let world = b.outer * ctx.world_matrix(layer);
     if crate::text::per_char_3d(ctx, layer) {
-        for (buf, m) in crate::text::per_char_planes(ctx, layer, r.opts.scale) {
-            let buf = r.to_blend(Arc::new(buf), None);
+        for (buf, m) in crate::text::per_char_planes(&r.with_reads(ctx), layer, r.opts.scale) {
+            let buf = r.to_blend(Arc::new(buf), None, &Arc::default());
             card(b, &buf, world * m, mat);
         }
         return;
@@ -669,9 +713,20 @@ fn card_layer(r: &Renderer, ctx: &EvalCtx, layer: &Layer, b: &mut Builder) {
     }
 }
 
-/// Evaluated lights: (scene lights, ambient sum, environment light (layer, intensity × colour,
-/// rotation)).
-fn lights(ctx: &EvalCtx, lin: bool) -> (Vec<Light>, [f32; 3], Option<(Option<u64>, [f32; 3], f32)>) {
+/// The evaluated Environment light: its image source, intensity × colour, rotation, and
+/// shadow settings (After Effects' Light Settings shows Cast Shadows for Environment lights).
+#[derive(Clone, Copy)]
+pub(crate) struct EnvLight {
+    src: Option<u64>,
+    color: [f32; 3],
+    rot: f32,
+    casts_shadows: bool,
+    shadow_darkness: f64,
+    shadow_diffusion: f64,
+}
+
+/// Evaluated lights: (scene lights, ambient sum, environment light).
+fn lights(ctx: &EvalCtx, lin: bool) -> (Vec<Light>, [f32; 3], Option<EnvLight>) {
     let mut out = vec![];
     let mut ambient = [0.0f32; 3];
     let mut env = None;
@@ -692,7 +747,14 @@ fn lights(ctx: &EvalCtx, lin: bool) -> (Vec<Light>, [f32; 3], Option<(Option<u64
                 if env.is_none() {
                     let src = g.get("source").and_then(|p| ctx.value(layer, p).as_layer());
                     let rot = ctx.f(layer, g, "rotation", 0.0).to_radians() as f32;
-                    env = Some((src, color, rot));
+                    env = Some(EnvLight {
+                        src,
+                        color,
+                        rot,
+                        casts_shadows: ctx.b(layer, g, "castsShadows"),
+                        shadow_darkness: ctx.f(layer, g, "shadowDarkness", 100.0).clamp(0.0, 100.0) / 100.0,
+                        shadow_diffusion: ctx.f(layer, g, "shadowDiffusion", 0.0).max(0.0),
+                    });
                 }
             }
             _ => {
@@ -782,8 +844,54 @@ pub fn irradiance_map(sw: u32, sh: u32, src: &[[f32; 4]], w: u32, h: u32) -> Vec
     out
 }
 
+/// The environment image's dominant direction and key strength: the mean texel direction
+/// weighted by the radiance the light actually emits — solid-angle weighted, rotation applied,
+/// each texel's channels scaled by `tint` (the light's colour, `[1; 3]` for a white one) — or
+/// `([0; 3], 0.0)` when that radiance is directionless (a uniform environment cancels to zero,
+/// and opposing bright regions that cancel leave no mean either — though a chromatic one need
+/// not stay directionless once tinted: a red light over equally bright red and blue opposite
+/// regions removes the blue pull and points at the red one). The mean of a single bright spot
+/// on black points straight at it; a gradient points somewhere between its ends. The returned
+/// key fraction is the mean vector's length over the radiance weight — how directional the
+/// image is, 0 (uniform) to ~1 (a lone spot) — and is the most of its light an Environment
+/// light's shadow can remove.
+pub(crate) fn dominant_direction(w: u32, h: u32, d: &[[f32; 4]], tint: [f32; 3], rot: f32) -> ([f32; 3], f32) {
+    use super::shade::equirect_dir;
+    let (mut x, mut y, mut z) = (0.0f32, 0.0f32, 0.0f32);
+    let mut weight = 0.0f32;
+    for (i, p) in d.iter().enumerate() {
+        let (tx, ty) = ((i % w as usize) as u32, (i / w as usize) as u32);
+        let (u, v) = ((tx as f32 + 0.5) / w as f32, (ty as f32 + 0.5) / h as f32);
+        // Tinted radiance × solid angle (∝ sin θ): the shadow must follow the light the
+        // environment emits, not the raw texels.
+        let lum = (p[0] * tint[0] + p[1] * tint[1] + p[2] * tint[2]) * (v * std::f32::consts::PI).sin();
+        let dir = equirect_dir(u, v, rot);
+        x += dir[0] * lum;
+        y += dir[1] * lum;
+        z += dir[2] * lum;
+        weight += lum.abs();
+    }
+    // Under 1 % directional, the image is uniform to the eye: no dominant region to shadow
+    // from. A non-finite sum (a NaN or infinite texel) is garbage, not a direction: none then.
+    let len = (x * x + y * y + z * z).sqrt();
+    if !weight.is_finite() || !len.is_finite() || weight <= 1e-9 || len < weight * 0.01 {
+        return ([0.0; 3], 0.0);
+    }
+    ([x / len, y / len, z / len], (len / weight).clamp(0.0, 1.0))
+}
+
 /// Prefilter an environment image into the scene's textures.
-pub(crate) fn add_environment(b: &mut Builder, w: u32, h: u32, data: Vec<[f32; 4]>, intensity: [f32; 3], rotation: f32) {
+pub(crate) fn add_environment(b: &mut Builder, env: &EnvLight, w: u32, h: u32, data: Vec<[f32; 4]>) {
+    // Intensity × colour folded into the radiance (one scalar on the GPU): tint the texels.
+    // A white (or off) light leaves them as they are.
+    let k = (env.color[0] + env.color[1] + env.color[2]) / 3.0;
+    let tint = if k > 0.0 && (env.color[0] != env.color[1] || env.color[1] != env.color[2]) { env.color.map(|c| c / k) } else { [1.0, 1.0, 1.0] };
+    // The shadow direction and key strength from the full-resolution image, before the mip
+    // chain averages it — only a shadow-casting light reads them, so only one pays for the
+    // pass — and weighted by the tint, so the shadow follows the radiance the light emits:
+    // opposing chromatic regions that cancel untinted need not cancel once the colour removes
+    // one of them (a red light over equally bright red and blue sides shadows from the red).
+    let (sun, key) = if env.casts_shadows { dominant_direction(w, h, &data, tint, env.rot) } else { ([0.0; 3], 0.0) };
     // Radiance level 0 at most 1024 wide.
     let (mut w, mut h, mut d) = (w, h, data);
     while w > 1024 {
@@ -806,10 +914,7 @@ pub(crate) fn add_environment(b: &mut Builder, w: u32, h: u32, data: Vec<[f32; 4
     let (sw, sh, sd) = small.unwrap_or((w, h, d));
     let irr = irradiance_map(sw, sh, &sd, 32, 16);
     let ii = b.texture_from(32, 16, [0, 1], irr.into_iter()) as u32;
-    // Intensity × colour folded into the radiance (one scalar on the GPU): tint the texels.
-    let k = (intensity[0] + intensity[1] + intensity[2]) / 3.0;
-    if k > 0.0 && (intensity[0] != intensity[1] || intensity[1] != intensity[2]) {
-        let tint = intensity.map(|c| c / k);
+    if tint != [1.0, 1.0, 1.0] {
         for t in first..=ii {
             let ti = b.s.textures[t as usize];
             for p in &mut b.s.texels[ti.offset as usize..(ti.offset + ti.width * ti.height) as usize] {
@@ -819,16 +924,45 @@ pub(crate) fn add_environment(b: &mut Builder, w: u32, h: u32, data: Vec<[f32; 4
             }
         }
     }
-    b.s.env = Some(EnvInfo { radiance: first, mips: levels, irradiance: ii, intensity: k, rotation });
+    b.s.env = Some(EnvInfo {
+        radiance: first,
+        mips: levels,
+        irradiance: ii,
+        intensity: k,
+        rotation: env.rot,
+        sun,
+        key,
+        // Marked; `raster::shadow_maps` assigns the map (a directionless image casts none).
+        shadow: if env.casts_shadows { 0 } else { -1 },
+        shadow_darkness: env.shadow_darkness as f32,
+        shadow_diffusion: env.shadow_diffusion as f32,
+    });
 }
 
-/// The environment layer's pixels as linear straight RGBA.
-fn env_pixels(r: &Renderer, ctx: &EvalCtx, src: Option<u64>, lin: bool) -> Option<(u32, u32, Vec<[f32; 4]>)> {
+/// The Environment light's image: `Absent` when the light has no Source and the comp has no
+/// Environment Layer (the default studio environment applies — After Effects "uses a default
+/// environment map" for an Environment light too), `Image` when the source renders, `Failed`
+/// when a selected or found source produced no pixels (a deleted layer, missing footage, a
+/// failed decode). A failed source must not silently become the default environment — that
+/// would relight and reshadow the scene behind the user's back — so, like any layer whose
+/// source fails renders nothing, it contributes nothing (#2436).
+enum EnvPixels {
+    Absent,
+    Image((u32, u32, Vec<[f32; 4]>)),
+    Failed,
+}
+
+fn env_pixels(r: &Renderer, ctx: &EvalCtx, src: Option<u64>, lin: bool) -> EnvPixels {
     let layer = match src {
-        Some(id) => ctx.comp.layer(effectcraft_project::LayerId(id))?,
-        None => ctx.comp.layers.iter().find(|l| l.environment && l.is_active_at(ctx.time))?,
+        Some(id) => ctx.comp.layer(effectcraft_project::LayerId(id)),
+        None => ctx.comp.layers.iter().find(|l| l.environment && l.is_active_at(ctx.time)),
     };
-    let buf = r.blend_layer_buf(ctx, layer)?;
+    let Some(layer) = layer else {
+        // A set Source that resolves to no layer (deleted) failed; an unset one with no
+        // Environment Layer is simply unconfigured.
+        return if src.is_some() { EnvPixels::Failed } else { EnvPixels::Absent };
+    };
+    let Some(buf) = r.blend_layer_buf(ctx, layer) else { return EnvPixels::Failed };
     let img = &buf.img;
     let data = img
         .data
@@ -842,7 +976,43 @@ fn env_pixels(r: &Renderer, ctx: &EvalCtx, src: Option<u64>, lin: bool) -> Optio
             if lin { [s[0], s[1], s[2], 1.0] } else { [srgb_to_linear(s[0]), srgb_to_linear(s[1]), srgb_to_linear(s[2]), 1.0] }
         })
         .collect();
-    Some((img.width, img.height, data))
+    EnvPixels::Image((img.width, img.height, data))
+}
+
+/// The default environment when the light has no Source and no Environment Layer: a dim studio
+/// gradient, bright above and toward the initial camera, dark below and behind — After
+/// Effects "uses a default environment map" for an Environment light too, and its default
+/// casts shadows out of the box. The solid-angle-weighted mean is 0.3, a soft studio ambience
+/// (a mean of 1 would act like a 100 % white Ambient light and wash the whole scene out, which
+/// is not what After Effects' default looks like); the light's colour × intensity still scales
+/// the overall level, and its Rotation turns the key around the scene (#2436).
+pub(crate) fn default_environment() -> (u32, u32, Vec<[f32; 4]>) {
+    use super::shade::{dot, equirect_dir};
+    // The key region's centre: three quarters up, two thirds toward the viewer (the default
+    // camera looks +z from -z).
+    let key = [0.0f32, -0.75, -0.66];
+    let (w, h) = (8u32, 4u32);
+    let mut data = Vec::with_capacity((w * h) as usize);
+    let (mut mean, mut weight) = (0.0f32, 0.0f32);
+    for y in 0..h {
+        let v = (y as f32 + 0.5) / h as f32;
+        let sa = (v * std::f32::consts::PI).sin();
+        for x in 0..w {
+            let u = (x as f32 + 0.5) / w as f32;
+            let l = 0.15 + 1.2 * dot(equirect_dir(u, v, 0.0), key).max(0.0);
+            data.push([l, l, l, 1.0]);
+            mean += l * sa;
+            weight += sa;
+        }
+    }
+    // A dim studio: scale the gradient to a weighted mean of exactly 0.3.
+    let k = if mean.is_finite() && mean > 1e-6 { 0.3 * weight / mean } else { 1.0 };
+    for p in &mut data {
+        for c in 0..3 {
+            p[c] *= k;
+        }
+    }
+    (w, h, data)
 }
 
 /// Supersampling factor: 2×2 unless draft or very large.
@@ -856,8 +1026,8 @@ fn emit_layer<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, layer: &Layer, b: &mut Bu
     if layer.environment || layer.switches.adjustment || ctx.opacity(layer) <= 0.0 || !layer.has_video() {
         return;
     }
-    if let Some(item) = r.collapsed(ctx, layer) {
-        collapsed_layer(r, ctx, layer, item, b);
+    if let Some(collapsed) = r.collapsed(ctx, layer) {
+        collapsed_layer(r, ctx, layer, &collapsed, b);
     } else if layer.source.is_model() {
         model_layer(r, ctx, layer, b);
     } else if matches!(layer.source, LayerSource::Text | LayerSource::Shape)
@@ -873,13 +1043,13 @@ fn emit_layer<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, layer: &Layer, b: &mut Bu
 /// (meshes, extrusions, cards) placed by the precomp layer's world transform, so they
 /// intersect, occlude and shadow the parent's layers. Nested 2D layers lie on the precomp
 /// layer's plane; nested lights and cameras are ignored (the parent's light the scene).
-fn collapsed_layer<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, layer: &Layer, item: effectcraft_project::ItemId, b: &mut Builder) {
+fn collapsed_layer<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, layer: &Layer, collapsed: &crate::Collapsed, b: &mut Builder) {
     let op = ctx.opacity(layer) as f32 * r.opacity_mul();
-    let Some((sub, nctx)) = r.collapse_into(ctx, layer, item, op) else { return };
+    let Some((sub, nctx)) = r.collapse_into(ctx, layer, collapsed, op) else { return };
     let saved = b.outer;
     b.outer = saved * ctx.world_matrix(layer);
     let t = nctx.time;
-    let any_solo = nctx.comp.layers.iter().any(|l| l.switches.solo && l.source.is_av());
+    let any_solo = nctx.comp.any_solo();
     for l in nctx.comp.layers.iter().rev() {
         if !l.is_active_at(t)
             || l.is_light()
@@ -934,10 +1104,23 @@ pub(crate) fn build_at(r: &Renderer, ctx: &EvalCtx, sub: Option<&EvalCtx>, run:
         let (ls, amb, env) = lights(ctx, lin);
         b.s.lights = ls;
         b.s.ambient = amb;
-        if let Some((src, k, rot)) = env
-            && let Some((w, h, d)) = env_pixels(r, ctx, src, lin)
-        {
-            add_environment(&mut b, w, h, d, k, rot);
+        if let Some(env) = env {
+            match env_pixels(r, ctx, env.src, lin) {
+                EnvPixels::Image((w, h, d)) => add_environment(&mut b, &env, w, h, d),
+                // No Source and no Environment Layer: the default environment, a soft studio
+                // gradient of the light's colour × intensity — After Effects "uses a default
+                // environment map" for an Environment light — so the light always lights the
+                // scene per its parameters, and its dominant region casts shadows (#2436).
+                EnvPixels::Absent => {
+                    let (w, h, d) = default_environment();
+                    add_environment(&mut b, &env, w, h, d)
+                }
+                // A selected or found source that produced no pixels (deleted layer, missing
+                // footage, failed decode): no environment at all — the light contributes
+                // nothing, exactly like a layer whose source failed renders nothing, never a
+                // silent swap to the default studio's lighting and shadows (#2436).
+                EnvPixels::Failed => {}
+            }
         }
         if r.opts.shadows() {
             super::raster::shadow_maps(&mut b.s, r.opts.draft);
@@ -946,6 +1129,9 @@ pub(crate) fn build_at(r: &Renderer, ctx: &EvalCtx, sub: Option<&EvalCtx>, run:
             for l in &mut b.s.lights {
                 l.shadow = -1;
             }
+            if let Some(e) = &mut b.s.env {
+                e.shadow = -1;
+            }
         }
     }
     // Camera matrices.
diff --git a/crates/render/src/three_d/adv/shade.rs b/crates/render/src/three_d/adv/shade.rs
index 666f2e445..820e8fecf 100644
--- a/crates/render/src/three_d/adv/shade.rs
+++ b/crates/render/src/three_d/adv/shade.rs
@@ -82,9 +82,20 @@ pub fn f_schlick(f0: [f32; 3], v_h: f32) -> [f32; 3] {
     [f0[0] + (1.0 - f0[0]) * k, f0[1] + (1.0 - f0[1]) * k, f0[2] + (1.0 - f0[2]) * k]
 }
 
+/// Surface parameters used by the direct-light BRDF after texture sampling.
+#[derive(Clone, Copy)]
+pub struct BrdfSurface {
+    pub base: [f32; 3],
+    pub metallic: f32,
+    pub roughness: f32,
+    pub specular: f32,
+    pub diffuse: f32,
+}
+
 /// Cook–Torrance BRDF × N·L × π for one light: (diffuse colour factor, specular colour).
 /// Returned as the reflected fraction of the light's irradiance.
-pub fn brdf(base: [f32; 3], metallic: f32, rough: f32, spec_k: f32, diff_k: f32, n: [f32; 3], v: [f32; 3], l: [f32; 3]) -> [f32; 3] {
+pub fn brdf(surface: BrdfSurface, n: [f32; 3], v: [f32; 3], l: [f32; 3]) -> [f32; 3] {
+    let BrdfSurface { base, metallic, roughness: rough, specular: spec_k, diffuse: diff_k } = surface;
     let n_l = dot(n, l);
     if n_l <= 0.0 {
         return [0.0; 3];
@@ -206,36 +217,145 @@ pub fn shadow_coord(m: &ShadowMap, p: [f32; 3]) -> Option<(f32, f32, f32)> {
     }
 }
 
-/// Fraction of light reaching `p` through shadow map `m` (1 = lit), PCF over a 5×5 grid
-/// spread over `radius` texels.
-pub fn shadow_factor(m: &ShadowMap, texels: &[f32], p: [f32; 3], n_l: f32) -> f32 {
+/// Integer tap jitter hash: pure u32 bit math so the WGSL backend computes
+/// bit-identical jitter from the same inputs (a float hash would diverge between
+/// backends and break CPU/GPU parity).
+fn tap_hash(x: i32, y: i32) -> u32 {
+    let mut h = (x as u32).wrapping_mul(0x9E37_79B9) ^ (y as u32).wrapping_mul(0x85EB_CA6B);
+    h ^= h >> 16;
+    h = h.wrapping_mul(0x2545_F491);
+    h ^= h >> 15;
+    h
+}
+
+/// The jitter of tap (`i`, `j`), each axis in [−0.5, 0.5): [`tap_hash`] values at the four
+/// corners of the receiver's 1/8-texel lattice cell (`cx`, `cy`), blended bilinearly by the
+/// receiver's position in the cell (`wx`, `wy`). The jitter is continuous in the receiver's
+/// map position, so a position that differs between backends in its last bits moves the
+/// taps by an amount proportional to that difference and does not switch them to another
+/// cell's jitter.
+fn tap_jitter(cx: i32, cy: i32, wx: f32, wy: f32, i: i32, j: i32) -> (f32, f32) {
+    let corner = |dx: i32, dy: i32| -> (f32, f32) {
+        let h = tap_hash(cx.wrapping_add(dx).wrapping_add(i.wrapping_mul(7919)), cy.wrapping_add(dy).wrapping_add(j.wrapping_mul(7919)));
+        (((h & 0xFFFF) as f32) * (1.0 / 65536.0) - 0.5, (((h >> 16) & 0xFFFF) as f32) * (1.0 / 65536.0) - 0.5)
+    };
+    let (c00, c10, c01, c11) = (corner(0, 0), corner(1, 0), corner(0, 1), corner(1, 1));
+    let ax = c00.0 + (c10.0 - c00.0) * wx;
+    let bx = c01.0 + (c11.0 - c01.0) * wx;
+    let ay = c00.1 + (c10.1 - c00.1) * wx;
+    let by = c01.1 + (c11.1 - c01.1) * wx;
+    (ax + (bx - ax) * wy, ay + (by - ay) * wy)
+}
+
+/// Upper bound of the PCF grid's taps per axis. The grid grows with the reach so taps
+/// stay about one texel apart for moderate penumbrae; the cap bounds the per-fragment
+/// cost of very wide ones (bilinear taps still overlap and the jitter dithers the rest).
+const PCF_MAX_TAPS: i32 = 10;
+
+/// Steepest receiver-plane slope the PCF extrapolates, in texel footprints of depth per
+/// texel (about 89°). Steeper planes are edge-on to the light, where their depth runs
+/// away; they are clamped to this slope.
+const PLANE_SLOPE_MAX: f32 = 64.0;
+
+/// Fraction of light reaching `p` through shadow map `m` (1 = lit). `ng` is the
+/// receiver's geometric (not normal-mapped) normal facing the viewer.
+///
+/// PCF over an N×N tap grid (5 ≤ N ≤ `PCF_MAX_TAPS`) spread over a reach derived
+/// from `radius` (the wanted penumbra in output pixels) divided by the receiver's
+/// texel footprint, each tap jittered by [`tap_jitter`] (an integer hash of the
+/// receiver's sub-texel lattice and the tap index, blended across the receiver's
+/// lattice cell), and each tap comparing against the four
+/// nearest texel centres with bilinear weights. The jitter detaches the tap grid
+/// from the texel axes (axis-aligned binary taps are what stair-step a straight
+/// shadow edge), and keying it below texel size keeps the dither finer than an
+/// output pixel even where one texel covers several. The bilinear compare makes
+/// each tap's contribution vary smoothly inside a texel instead of snapping.
+///
+/// Every texel is compared against the depth the receiver's own plane has at that
+/// texel's centre, not the receiver point's depth: a wide kernel on a surface tilted
+/// towards the light would otherwise see its own nearer depth and shadow itself.
+/// With that, the bias stays at texel scale; a diffusion-scaled bias lifts shadows
+/// off their casters.
+pub fn shadow_factor(m: &ShadowMap, texels: &[f32], p: [f32; 3], ng: [f32; 3], n_l: f32) -> f32 {
     let Some((u, v, z)) = shadow_coord(m, p) else { return 1.0 };
     let size = m.size as i64;
-    // Slope-scaled bias (world units are pixels).
-    // Texel footprint (world units) × PCF reach, steeper for grazing light.
+    // Slope-scaled bias at texel scale (world units are pixels), steeper for
+    // grazing light: it absorbs depth-raster error and the gap between the shading
+    // normal's plane and the faceted surface the map rasterised.
     let texel = if m.ortho { 1.0 / m.focal } else { z.abs() / m.focal };
-    let bias = m.bias * texel * (1.0 + m.radius) * (1.0 + 3.0 * (1.0 - n_l.clamp(0.0, 1.0)));
-    let step = m.radius / 2.0;
+    let bias = m.bias * texel * (1.0 + 3.0 * (1.0 - n_l.clamp(0.0, 1.0)));
+    let at = |xi: i64, yi: i64| -> f32 {
+        if xi < 0 || yi < 0 || xi >= size || yi >= size {
+            return f32::INFINITY; // outside the map: the light was never blocked there (WGSL mirrors this with a large finite depth)
+        }
+        texels.get(m.offset as usize + (yi * size + xi) as usize).copied().unwrap_or(f32::INFINITY)
+    };
+    // The receiver plane in light space as the slope of its depth across the map, in
+    // texel footprints per texel (`tx`, `ty`; depth grows along −t), clamped where the
+    // plane grazes the light. `den0` is the plane normal against the light ray through
+    // the receiver (the depth axis for an orthographic map), negative while it faces it.
+    let w = &m.view;
+    let nv = [0, 1, 2].map(|r| w[r][0] * ng[0] + w[r][1] * ng[1] + w[r][2] * ng[2]);
+    let c = m.size as f32 * 0.5;
+    let den0 = if m.ortho { nv[2] } else { nv[0] * ((u - c) / m.focal) + nv[1] * ((v - c) / m.focal) + nv[2] };
+    let (tx, ty) = if den0 < -1e-6 {
+        ((nv[0] / den0).clamp(-PLANE_SLOPE_MAX, PLANE_SLOPE_MAX), (nv[1] / den0).clamp(-PLANE_SLOPE_MAX, PLANE_SLOPE_MAX))
+    } else {
+        (0.0, 0.0)
+    };
+    // 1 where texel (xi, yi) does not occlude the receiver plane at the texel's centre.
+    // Perspective depth is not linear across the map but its inverse is, so that
+    // compare runs on 1/depth (inv · (texel + bias) ≥ 1) without a division; a plane
+    // whose inverse depth reaches 0 has left the light's side and cannot be occluded.
+    let (iz, iq) = (1.0 / z, 1.0 / (m.focal * z));
+    let open = |xi: i64, yi: i64| -> f32 {
+        let s = at(xi, yi) + bias;
+        let g = tx * (xi as f32 + 0.5 - u) + ty * (yi as f32 + 0.5 - v);
+        let lit = if m.ortho {
+            z - g * texel <= s
+        } else {
+            let inv = iz + g * iq;
+            inv <= 0.0 || inv * s >= 1.0
+        };
+        if lit { 1.0 } else { 0.0 }
+    };
+    // `radius` is the wanted penumbra in output pixels; converting it through the
+    // receiver's texel footprint keeps the penumbra width in output pixels at any
+    // map resolution (and lets perspective penumbra grow with distance from the light).
+    // At least two texels: a hard edge then ramps across two texels, which hides the
+    // texel steps of the binary depth compare where one texel spans several output
+    // pixels (receivers grazing the light); a one-texel ramp leaves a sawtooth.
+    let mut reach = (m.radius / texel).clamp(2.0, 256.0);
+    if !reach.is_finite() {
+        reach = 1.0;
+    }
+    let n = (reach.ceil() as i32 + 1).clamp(5, PCF_MAX_TAPS);
+    let step = reach / (n - 1) as f32;
+    let half = (n - 1) as f32 * 0.5;
+    let (gu, gv) = (u * 8.0, v * 8.0);
+    let (cx, cy) = (gu.floor() as i32, gv.floor() as i32);
+    let (wx, wy) = (gu - gu.floor(), gv - gv.floor());
     let mut lit = 0.0;
-    for j in -2..=2 {
-        for i in -2..=2 {
-            let x = (u + i as f32 * step).floor() as i64;
-            let y = (v + j as f32 * step).floor() as i64;
-            if x < 0 || y < 0 || x >= size || y >= size {
-                lit += 1.0;
-                continue;
-            }
-            let d = texels[m.offset as usize + (y * size + x) as usize];
-            if z - bias <= d {
-                lit += 1.0;
-            }
+    for j in 0..n {
+        for i in 0..n {
+            let (jx, jy) = tap_jitter(cx, cy, wx, wy, i, j);
+            let (su, sv) = (u + ((i as f32 - half) + jx) * step, v + ((j as f32 - half) + jy) * step);
+            // Texel (x, y) holds the depth at its centre (x + 0.5, y + 0.5); each of the
+            // four is compared against the receiver plane at that centre.
+            let (tu, tv) = (su - 0.5, sv - 0.5);
+            let (fx, fy) = (tu - tu.floor(), tv - tv.floor());
+            let (x0, y0) = (tu.floor() as i64, tv.floor() as i64);
+            let (h00, h10, h01, h11) = (open(x0, y0), open(x0 + 1, y0), open(x0, y0 + 1), open(x0 + 1, y0 + 1));
+            let a = h00 + (h10 - h00) * fx;
+            let b = h01 + (h11 - h01) * fx;
+            lit += a + (b - a) * fy;
         }
     }
-    lit / 25.0
+    lit / (n * n) as f32
 }
 
 /// The visibility of light `li` at `p` (1 = unshadowed), darkened by Shadow Darkness.
-pub fn light_shadow(s: &Scene, l: &Light, p: [f32; 3], n_l: f32) -> f32 {
+pub fn light_shadow(s: &Scene, l: &Light, p: [f32; 3], ng: [f32; 3], n_l: f32) -> f32 {
     if l.shadow < 0 {
         return 1.0;
     }
@@ -258,10 +378,27 @@ pub fn light_shadow(s: &Scene, l: &Light, p: [f32; 3], n_l: f32) -> f32 {
         s.shadows.get(first)
     };
     let Some(m) = m else { return 1.0 };
-    let f = shadow_factor(m, &s.shadow_texels, p, n_l);
+    let f = shadow_factor(m, &s.shadow_texels, p, ng, n_l);
     1.0 - l.shadow_darkness * (1.0 - f)
 }
 
+/// The visibility of the Environment light at `p` (1 = unshadowed), darkened by its Shadow
+/// Darkness — but only by the image's key fraction: the shadow map occludes the dominant
+/// (key) lobe, while the environment's fill keeps shining on the shadowed surface, so an
+/// Environment light's shadow stays partial the way After Effects renders an area-light
+/// shadow (a broad environment like the default studio shadows softly, a lone bright spot
+/// on black almost fully). A directionless image (or a non-casting light) has no map
+/// and shades unshadowed.
+pub fn env_shadow(s: &Scene, e: &EnvInfo, p: [f32; 3], ng: [f32; 3], n: [f32; 3]) -> f32 {
+    if e.shadow < 0 || e.sun == [0.0; 3] {
+        return 1.0;
+    }
+    let Some(m) = s.shadows.get(e.shadow as usize) else { return 1.0 };
+    let n_l = dot(n, e.sun).clamp(0.0, 1.0);
+    let f = shadow_factor(m, &s.shadow_texels, p, ng, n_l);
+    1.0 - e.shadow_darkness * e.key * (1.0 - f)
+}
+
 /// Unit direction from `p` to light `l`, and the distance (infinite for a parallel light).
 fn to_light(l: &Light, p: [f32; 3]) -> ([f32; 3], f32) {
     if l.kind == 0 {
@@ -367,6 +504,8 @@ pub fn shade(s: &Scene, f: &Frag) -> Option<[f32; 4]> {
     if !f.front {
         n = scale(n, -1.0);
     }
+    // Shadow lookups follow the geometric surface, not the normal map.
+    let ng = n;
     if let Some(t) = tex(m.tex_normal) {
         let tn = [(t[0] * 2.0 - 1.0) * m.normal_scale, (t[1] * 2.0 - 1.0) * m.normal_scale, t[2] * 2.0 - 1.0];
         let tg = [f.tangent[0], f.tangent[1], f.tangent[2]];
@@ -392,8 +531,8 @@ pub fn shade(s: &Scene, f: &Frag) -> Option<[f32; 4]> {
         if n_l <= 0.0 {
             continue;
         }
-        let sh = if m.receives_shadows { light_shadow(s, l, f.pos, n_l) } else { 1.0 };
-        let b = brdf(rgb, metallic, rough, m.specular_k, m.diffuse_k, n, v, to_l);
+        let sh = if m.receives_shadows { light_shadow(s, l, f.pos, ng, n_l) } else { 1.0 };
+        let b = brdf(BrdfSurface { base: rgb, metallic, roughness: rough, specular: m.specular_k, diffuse: m.diffuse_k }, n, v, to_l);
         for c in 0..3 {
             out[c] += b[c] * l.color[c] * k * sh;
         }
@@ -407,9 +546,11 @@ pub fn shade(s: &Scene, f: &Frag) -> Option<[f32; 4]> {
         let (irr, spec) = env_light(s, e, n, r, rough);
         let f0 = [mix(0.04 * m.specular_k, rgb[0], metallic), mix(0.04 * m.specular_k, rgb[1], metallic), mix(0.04 * m.specular_k, rgb[2], metallic)];
         let (a, b) = env_brdf(n_v, rough);
+        // The Environment light's shadow darkens its own diffuse and specular.
+        let sh = if m.receives_shadows { env_shadow(s, e, f.pos, ng, n) } else { 1.0 };
         for c in 0..3 {
             let fs = f0[c] * a + b;
-            out[c] += (irr[c] * rgb[c] * (1.0 - fs) * (1.0 - metallic) * m.diffuse_k + spec[c] * fs) * ao;
+            out[c] += (irr[c] * rgb[c] * (1.0 - fs) * (1.0 - metallic) * m.diffuse_k + spec[c] * fs) * ao * sh;
         }
     }
     let c = add(out, emissive);
@@ -433,7 +574,11 @@ fn shadow_only(s: &Scene, m: &Material, f: &Frag, alpha: f32) -> [f32; 4] {
         if n_l <= 0.0 {
             continue;
         }
-        amount = amount.max(1.0 - light_shadow(s, l, f.pos, n_l));
+        amount = amount.max(1.0 - light_shadow(s, l, f.pos, n, n_l));
+    }
+    // The Environment light's shadow counts too (it reaches every surface: no falloff).
+    if let Some(e) = &s.env {
+        amount = amount.max(1.0 - env_shadow(s, e, f.pos, n, n));
     }
     [0.0, 0.0, 0.0, alpha * amount]
 }
diff --git a/crates/render/src/three_d/adv/tests.rs b/crates/render/src/three_d/adv/tests.rs
index 694a5c2be..88e805882 100644
--- a/crates/render/src/three_d/adv/tests.rs
+++ b/crates/render/src/three_d/adv/tests.rs
@@ -2,7 +2,7 @@ use effectcraft_keyframe::Value;
 use effectcraft_project::{Comp, ItemId, ItemKind, LayerSource, LightKind, PrimitiveKind, Project, Renderer as R3, build};
 use effectcraft_time::{FrameRate, Tick};
 
-use super::scene::{Material, Scene, TexInfo, Vertex, irradiance_map};
+use super::scene::{Material, Scene, TexInfo, Vertex, dominant_direction, irradiance_map};
 use super::shade::{self, PI};
 use super::*;
 use crate::{NoFootage, RenderOpts, Renderer};
@@ -16,7 +16,7 @@ fn brdf_matches_cook_torrance_formula() {
     let v = shade::norm([0.3, 0.1, 1.0]);
     let l = shade::norm([-0.4, 0.2, 1.0]);
     let (base, metal, rough) = ([0.8, 0.4, 0.2], 0.3f32, 0.45f32);
-    let got = shade::brdf(base, metal, rough, 1.0, 1.0, n, v, l);
+    let got = shade::brdf(shade::BrdfSurface { base, metallic: metal, roughness: rough, specular: 1.0, diffuse: 1.0 }, n, v, l);
     let h = shade::norm([v[0] + l[0], v[1] + l[1], v[2] + l[2]]);
     let (nv, nl, nh, vh) = (shade::dot(n, v), shade::dot(n, l), shade::dot(n, h), shade::dot(v, h));
     let a2 = (rough * rough).powi(2);
@@ -30,9 +30,9 @@ fn brdf_matches_cook_torrance_formula() {
         assert!((got[c] - expect).abs() < 1e-5, "channel {c}: {} vs {expect}", got[c]);
     }
     // No light from behind the surface.
-    assert_eq!(shade::brdf(base, metal, rough, 1.0, 1.0, n, v, [0.0, 0.0, -1.0]), [0.0; 3]);
+    assert_eq!(shade::brdf(shade::BrdfSurface { base, metallic: metal, roughness: rough, specular: 1.0, diffuse: 1.0 }, n, v, [0.0, 0.0, -1.0]), [0.0; 3]);
     // A white rough dielectric lit head-on reflects about its base colour (π folded in).
-    let w = shade::brdf([1.0; 3], 0.0, 1.0, 1.0, 1.0, n, n, n);
+    let w = shade::brdf(shade::BrdfSurface { base: [1.0; 3], metallic: 0.0, roughness: 1.0, specular: 1.0, diffuse: 1.0 }, n, n, n);
     assert!(w[0] > 0.95 && w[0] < 1.05, "{w:?}");
 }
 
@@ -67,6 +67,90 @@ fn constant_environment_has_constant_irradiance() {
     assert!(irr[16][0] > 0.9 && irr[15 * 32 + 16][0] < 0.1, "{:?} {:?}", irr[16], irr[15 * 32 + 16]);
 }
 
+/// A NaN or infinite texel poisons the sums (every NaN comparison is false, so the thresholds
+/// alone would pass it through as a NaN direction); an infinite one even where sin θ = 0 turns
+/// into NaN. Either way the sum is garbage, not a direction: no sun and no key, so no shadow
+/// (#2436).
+#[test]
+fn a_non_finite_environment_has_no_sun_direction() {
+    let nan = vec![[f32::NAN; 4]; 8 * 4];
+    assert_eq!(dominant_direction(8, 4, &nan, [1.0; 3], 0.0), ([0.0; 3], 0.0));
+    let inf = vec![[f32::INFINITY, 0.0, 0.0, 1.0]; 8 * 4];
+    assert_eq!(dominant_direction(8, 4, &inf, [1.0; 3], 0.0), ([0.0; 3], 0.0));
+}
+
+/// The key fraction: a uniform image is directionless (key 0), a lone bright spot on black is
+/// almost fully directional, and a broad gradient sits in between — the soft studio default
+/// shadows visibly but keeps most of its light as fill (#2436).
+#[test]
+fn environment_key_strength_tracks_directionality() {
+    let uniform = vec![[0.5f32, 0.5, 0.5, 1.0]; 8 * 4];
+    assert_eq!(dominant_direction(8, 4, &uniform, [1.0; 3], 0.0).1, 0.0);
+    let mut spot = vec![[0.0f32; 4]; 64 * 32];
+    spot[16 * 64 + 32] = [1.0, 1.0, 1.0, 1.0];
+    let (_, key) = dominant_direction(64, 32, &spot, [1.0; 3], 0.0);
+    assert!(key > 0.95, "a lone spot is almost fully directional: {key}");
+    let (w, h, d) = scene::default_environment();
+    let (_, key) = dominant_direction(w, h, &d, [1.0; 3], 0.0);
+    assert!((0.35..0.55).contains(&key), "the default studio is a broad key with fill: {key}");
+}
+
+/// #2436 review: a non-uniform image can be directionless too — two equal bright spots at
+/// opposite azimuths pull the radiance-weighted mean in opposite directions and cancel,
+/// leaving no dominant region to shadow from (under 1 % directional): no sun, no key, so no
+/// shadow, just like a uniform image. Tilt the balance and a direction re-emerges, pointing
+/// at the brighter spot.
+#[test]
+fn opposing_bright_regions_cancel_to_no_shadow() {
+    let (w, h) = (64u32, 32u32);
+    let mut opposed = vec![[0.0f32; 4]; (w * h) as usize];
+    // Rows 15 and 16 mirror about the equator (v = 0.484375 / 0.515625), and columns 16 and 48
+    // sit half a width apart (u = 0.2578125 / 0.7578125): the two texel-centre directions are
+    // exactly opposite — equal solid-angle weight, opposite pull.
+    let (a, b) = ((15 * w + 16) as usize, (16 * w + 48) as usize);
+    opposed[a] = [1.0, 1.0, 1.0, 1.0];
+    opposed[b] = [1.0, 1.0, 1.0, 1.0];
+    assert_eq!(dominant_direction(w, h, &opposed, [1.0; 3], 0.0), ([0.0; 3], 0.0));
+    // One side twice as bright: the mean points at the brighter spot with its share of the
+    // weight (key = 1/3 — two parts against one).
+    let mut tilted = opposed.clone();
+    tilted[a] = [2.0, 2.0, 2.0, 1.0];
+    let (sun, key) = dominant_direction(w, h, &tilted, [1.0; 3], 0.0);
+    assert!(sun != [0.0; 3] && key > 0.3, "the brighter side wins: {sun:?} key {key}");
+    let want = shade::equirect_dir(16.5 / 64.0, 15.5 / 32.0, 0.0);
+    let dot = sun[0] * want[0] + sun[1] * want[1] + sun[2] * want[2];
+    assert!(dot > 0.999, "the sun points at the brighter spot: {sun:?} vs {want:?}");
+}
+
+/// #2436 review: the sun follows the tinted radiance, not the raw texels — equally bright red
+/// and blue regions on exactly opposite texels cancel to a white light (no shadow), but the
+/// red light's tint removes the blue side's pull, so the mean points straight at the red one
+/// (a blue light, at the blue one): the shadow lands where the emitted light comes from.
+#[test]
+fn a_coloured_light_shadows_from_the_region_it_tints() {
+    let (w, h) = (64u32, 32u32);
+    let mut opposed = vec![[0.0f32; 4]; (w * h) as usize];
+    // Rows 15 and 16 mirror about the equator, columns 16 and 48 half a width apart: the two
+    // texel-centre directions are exactly opposite — equal solid-angle weight, opposite pull.
+    let (a, b) = ((15 * w + 16) as usize, (16 * w + 48) as usize);
+    opposed[a] = [1.0, 0.0, 0.0, 1.0];
+    opposed[b] = [0.0, 0.0, 1.0, 1.0];
+    // To a white light the channel sums are equal: they cancel, no shadow.
+    assert_eq!(dominant_direction(w, h, &opposed, [1.0; 3], 0.0), ([0.0; 3], 0.0));
+    // A red light's tint zeroes the blue texel's weight: the red one becomes a lone spot.
+    // (Any positive scale of the tint — the normalised [3, 0, 0] included — points the same
+    // way; only the channel ratios matter.)
+    let (sun, key) = dominant_direction(w, h, &opposed, [1.0, 0.0, 0.0], 0.0);
+    let want = shade::equirect_dir(16.5 / 64.0, 15.5 / 32.0, 0.0);
+    let dot = sun[0] * want[0] + sun[1] * want[1] + sun[2] * want[2];
+    assert!(dot > 0.999 && key > 0.95, "the red side wins: {sun:?} key {key}");
+    // A blue light points at the blue one instead.
+    let (sun, _) = dominant_direction(w, h, &opposed, [0.0, 0.0, 1.0], 0.0);
+    let want = shade::equirect_dir(48.5 / 64.0, 16.5 / 32.0, 0.0);
+    let dot = sun[0] * want[0] + sun[1] * want[1] + sun[2] * want[2];
+    assert!(dot > 0.999, "the blue side wins: {sun:?}");
+}
+
 #[test]
 fn equirect_round_trip_and_env_brdf() {
     for (u, v) in [(0.1f32, 0.2f32), (0.5, 0.5), (0.9, 0.7)] {
@@ -337,6 +421,365 @@ fn cards_and_environment_light() {
     assert_eq!(lit.data[80 * 120 + 110][3], 0.0);
 }
 
+/// An Environment light with no Source and no Environment Layer lights the scene with a flat
+/// default environment of its colour × intensity — After Effects "uses a default environment
+/// map" for an Environment light — not nothing at all (#2436).
+#[test]
+fn environment_light_without_a_source_lights_the_scene() {
+    let (mut p, cid) = project(120, 90);
+    let sid = p.add_item(
+        "S",
+        Default::default(),
+        None,
+        ItemKind::Solid(effectcraft_project::Solid { color: [0.5, 0.5, 0.5], width: 60, height: 40, pixel_aspect: 1.0 }),
+    );
+    add(&mut p, cid, LayerSource::Solid { item: sid }, |l| l.switches.three_d = true);
+    let unlit = render(&p, cid);
+    let c = unlit.data[20 * 120 + 30];
+    assert!((c[0] - 0.5).abs() < 0.01 && c[3] > 0.99, "unlit card keeps its colour: {c:?}");
+    // No Source, no Environment Layer: the light still lights the card (a flat white
+    // environment at the light's colour × intensity; a card's Material Options shade it).
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |_| {});
+    let lit = render(&p, cid);
+    let c2 = lit.data[20 * 120 + 30];
+    assert!((c2[0] - c[0]).abs() > 0.05 && c2[3] > 0.99, "the light has an effect: {c2:?} vs {c:?}");
+    // The light's parameters drive it: half intensity darkens towards zero intensity's black.
+    set(p.comp_mut(cid).unwrap().layers.first_mut().unwrap(), "lightOptions/intensity", Value::Scalar(50.0));
+    let half = render(&p, cid);
+    let c3 = half.data[20 * 120 + 30];
+    assert!(c3[0] < c2[0] - 0.02, "half intensity lights less: {c3:?} vs {c2:?}");
+    set(p.comp_mut(cid).unwrap().layers.first_mut().unwrap(), "lightOptions/intensity", Value::Scalar(0.0));
+    let dark = render(&p, cid);
+    let c4 = dark.data[20 * 120 + 30];
+    assert!(c4[0] < 0.02 && c4[3] > 0.99, "zero intensity lights nothing: {c4:?}");
+    // And its colour tints the light red.
+    set(p.comp_mut(cid).unwrap().layers.first_mut().unwrap(), "lightOptions/intensity", Value::Scalar(100.0));
+    set(p.comp_mut(cid).unwrap().layers.first_mut().unwrap(), "lightOptions/color", Value::Color([1.0, 0.0, 0.0, 1.0]));
+    let red = render(&p, cid);
+    let c5 = red.data[20 * 120 + 30];
+    assert!(c5[0] > 0.15 && c5[1] < 0.05 && c5[2] < 0.05, "red environment: {c5:?}");
+}
+
+/// #2436 review: a selected or auto-picked environment source that fails to render (missing
+/// footage, a deleted layer) must not silently swap in the default studio environment — the
+/// light contributes nothing, exactly like a layer whose source failed renders nothing. Only a
+/// light with no Source at all (and no Environment Layer in the comp) uses the default.
+#[test]
+fn a_failed_environment_source_lights_nothing() {
+    let (mut p, cid) = project(120, 90);
+    let sid = p.add_item(
+        "S",
+        Default::default(),
+        None,
+        ItemKind::Solid(effectcraft_project::Solid { color: [1.0, 1.0, 1.0], width: 60, height: 40, pixel_aspect: 1.0 }),
+    );
+    add(&mut p, cid, LayerSource::Solid { item: sid }, |l| l.switches.three_d = true);
+    let unlit = render(&p, cid);
+    // The Environment Layer's footage is unreadable (missing; NoFootage serves no frames).
+    let fid = p.add_item(
+        "F",
+        Default::default(),
+        None,
+        ItemKind::Footage(effectcraft_project::Footage {
+            path: "missing.exr".into(),
+            kind: effectcraft_project::FootageKind::Still,
+            width: 64,
+            height: 32,
+            pixel_aspect: 1.0,
+            duration: Tick::from_seconds_f64(1.0),
+            has_video: true,
+            missing: true,
+            ..Default::default()
+        }),
+    );
+    add(&mut p, cid, LayerSource::Footage { item: fid }, |l| {
+        l.switches.three_d = true;
+        l.environment = true;
+    });
+    let env_layer = p.comp(cid).unwrap().layers.iter().find(|l| l.environment).unwrap().id;
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    fn light(p: &mut Project, cid: ItemId) -> &mut effectcraft_project::Layer {
+        p.comp_mut(cid).unwrap().layers.iter_mut().find(|l| l.is_light()).unwrap()
+    }
+    // Auto-picked Environment Layer, unreadable: the light is off — no studio default, no
+    // default-environment shadow either.
+    let failed = render(&p, cid);
+    assert_eq!(failed.data, unlit.data, "an unreadable Environment Layer lights nothing");
+    // The light's Source set to that unreadable layer: same.
+    set(light(&mut p, cid), "lightOptions/source", Value::Layer(Some(env_layer.0)));
+    let failed = render(&p, cid);
+    assert_eq!(failed.data, unlit.data, "an unreadable selected Source lights nothing");
+    // The Source pointing at a deleted layer: same.
+    set(light(&mut p, cid), "lightOptions/source", Value::Layer(Some(999_999)));
+    let failed = render(&p, cid);
+    assert_eq!(failed.data, unlit.data, "a deleted selected Source lights nothing");
+    // Contrast: with no Source and no Environment Layer, the default studio still lights it.
+    let comp = p.comp_mut(cid).unwrap();
+    comp.layers.retain(|l| l.is_light() || !l.environment);
+    set(comp.layers.iter_mut().find(|l| l.is_light()).unwrap(), "lightOptions/source", Value::Layer(None));
+    let lit = render(&p, cid);
+    let (c, c2) = (unlit.data[20 * 120 + 30], lit.data[20 * 120 + 30]);
+    assert!(c2[3] > 0.99 && (c2[0] - c[0]).abs() > 0.05, "the unconfigured light still lights: {c2:?} vs {c:?}");
+}
+
+/// #2436: an Environment light's Cast Shadows works like After Effects' — its image's dominant
+/// (brightest) region shadows the scene. A bright disc above the image's centre, turned to
+/// shine from up and behind the camera (rotation 180°), shadows a sphere onto the floor below
+/// it; Cast Shadows off lights it evenly.
+#[test]
+fn environment_lights_cast_shadows() {
+    let (mut p, cid) = project(200, 150);
+    // The floor facing the camera, a sphere in front of it casting shadows only.
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Plane }, |l| {
+        set(l, "geometryOptions/width", Value::Scalar(400.0));
+        set(l, "geometryOptions/height", Value::Scalar(400.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 110.0]));
+        set(l, "materialOptions/baseColor", Value::Color([1.0, 1.0, 1.0, 1.0]));
+    });
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Sphere }, |l| {
+        set(l, "geometryOptions/radius", Value::Scalar(30.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 50.0]));
+        set(l, "materialOptions/castsShadows", Value::Enum(2));
+    });
+    // The Environment Layer: a tight bright key above the image's centre, on black — a
+    // full-comp rect keeps the layer buffer full-size, the radial gradient is the key.
+    add(&mut p, cid, LayerSource::Shape, |l| {
+        l.switches.three_d = true;
+        let mut next = 10_000u64;
+        let ids = &mut build::Ids(&mut next);
+        let rect = build::shape_rect(ids, [200.0, 150.0], [0.0, 0.0], 0.0);
+        let key = build::shape_gradient_fill(
+            ids,
+            true,
+            [0.0, -30.0],
+            [0.0, 5.0],
+            effectcraft_keyframe::Gradient { colors: vec![(0.0, [1.0, 1.0, 1.0, 1.0]), (1.0, [0.0, 0.0, 0.0, 1.0])], opacities: vec![(0.0, 1.0), (1.0, 1.0)] },
+        );
+        let g = build::shape_group(ids, "Key", vec![rect, key]);
+        l.props.sub_mut("contents").unwrap().children.push(g.into());
+        l.environment = true;
+    });
+    // Turned 180°, the key shines from up and behind the camera onto the sphere and floor.
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/rotation", Value::Scalar(180.0));
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    // The shadow lands below the sphere on the floor: its core is the darkest floor pixel
+    // below the sphere; the lit floor is the sample to the left. The frame is sRGB-encoded,
+    // so the ratios below are gamma-compressed (a linear halving reads as ~0.73).
+    let luma = |img: &crate::Image, x: usize, y: usize| (img.data[y * 200 + x][0] + img.data[y * 200 + x][1] + img.data[y * 200 + x][2]) / 3.0;
+    let img = render(&p, cid);
+    let side = luma(&img, 25, 75);
+    let (mut core, mut cx, mut cy) = (f32::INFINITY, 0usize, 0usize);
+    for y in 100..150 {
+        for x in 60..140 {
+            if luma(&img, x, y) < core {
+                core = luma(&img, x, y);
+                cx = x;
+                cy = y;
+            }
+        }
+    }
+    assert!(side > 0.1, "the floor is lit: {side}");
+    assert!(core < side * 0.65, "the key shadows the sphere onto the floor: {core} vs {side} at ({cx}, {cy})");
+    // Cast Shadows off: the floor is lit everywhere, core included.
+    let comp = p.comp_mut(cid).unwrap();
+    set(&mut comp.layers[0], "lightOptions/castsShadows", Value::Bool(false));
+    let img = render(&p, cid);
+    let mid = luma(&img, cx, cy);
+    assert!(mid > side * 0.9, "no shadow without Cast Shadows: {mid} vs {side}");
+}
+
+/// #2436: a uniform environment has no dominant region, so even with Cast Shadows on it casts
+/// nothing — the render is the same as with the option off.
+#[test]
+fn a_uniform_environment_casts_no_shadow() {
+    let (mut p, cid) = project(120, 90);
+    let card = p.add_item(
+        "S",
+        Default::default(),
+        None,
+        ItemKind::Solid(effectcraft_project::Solid { color: [1.0, 1.0, 1.0], width: 60, height: 40, pixel_aspect: 1.0 }),
+    );
+    add(&mut p, cid, LayerSource::Solid { item: card }, |l| l.switches.three_d = true);
+    let env = p.add_item(
+        "E",
+        Default::default(),
+        None,
+        ItemKind::Solid(effectcraft_project::Solid { color: [1.0, 1.0, 1.0], width: 64, height: 32, pixel_aspect: 1.0 }),
+    );
+    add(&mut p, cid, LayerSource::Solid { item: env }, |l| {
+        l.environment = true;
+        l.switches.three_d = true;
+    });
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    let casting = render(&p, cid);
+    let comp = p.comp_mut(cid).unwrap();
+    set(&mut comp.layers[0], "lightOptions/castsShadows", Value::Bool(false));
+    let off = render(&p, cid);
+    assert!(casting.data[20 * 120 + 30][0] > 0.3, "the card is lit");
+    assert_eq!(casting.data, off.data, "a directionless image casts no shadow");
+}
+
+/// #2436 review: a chromatic environment under a coloured light — equally bright red and blue
+/// regions on exactly opposite sides of the image cancel to a white light (it casts no
+/// shadow), but the red Environment light's tint removes the blue region's pull, so the red
+/// one becomes the key and casts the shadow the user asked for, from the red side.
+#[test]
+fn a_red_light_shadows_from_the_red_region_of_a_chromatic_environment() {
+    let (mut p, cid) = project(200, 150);
+    // The floor facing the camera, a sphere in front of it casting shadows only.
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Plane }, |l| {
+        set(l, "geometryOptions/width", Value::Scalar(400.0));
+        set(l, "geometryOptions/height", Value::Scalar(400.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 110.0]));
+        set(l, "materialOptions/baseColor", Value::Color([1.0, 1.0, 1.0, 1.0]));
+    });
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Sphere }, |l| {
+        set(l, "geometryOptions/radius", Value::Scalar(30.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 50.0]));
+        set(l, "materialOptions/castsShadows", Value::Enum(2));
+    });
+    // The Environment Layer: a black background with a red square and an equally bright blue
+    // one at exactly antipodal image positions (the blue is the point mirror of the red through
+    // the antipodal map x -> x + w/2, y -> h - y: centres (14.5, 44.5) and (114.5, 105.5) in a
+    // 200x150 image, 20x20 each) — equal solid-angle weight, opposite pull. The red sits up,
+    // left and toward the camera; the blue down, right and away from it.
+    add(&mut p, cid, LayerSource::Shape, |l| {
+        l.environment = true;
+        let mut next = 10_000u64;
+        let ids = &mut build::Ids(&mut next);
+        // Contents stack like the AE timeline — the first group is on top — so the background
+        // goes in last, under the red and blue squares (and its full-comp rect keeps the
+        // layer buffer full-size: a shape layer's buffer otherwise crops to its content).
+        let red_rect = build::shape_rect(ids, [20.0, 20.0], [-85.5, -30.5], 0.0);
+        let red_fill = build::shape_fill(ids, [1.0, 0.0, 0.0, 1.0]);
+        let red = build::shape_group(ids, "Red", vec![red_rect, red_fill]);
+        let blue_rect = build::shape_rect(ids, [20.0, 20.0], [14.5, 30.5], 0.0);
+        let blue_fill = build::shape_fill(ids, [0.0, 0.0, 1.0, 1.0]);
+        let blue = build::shape_group(ids, "Blue", vec![blue_rect, blue_fill]);
+        let bg_rect = build::shape_rect(ids, [200.0, 150.0], [0.0, 0.0], 0.0);
+        let bg_fill = build::shape_fill(ids, [0.0, 0.0, 0.0, 1.0]);
+        let bg = build::shape_group(ids, "BG", vec![bg_rect, bg_fill]);
+        for g in [red, blue, bg] {
+            l.props.sub_mut("contents").unwrap().children.push(g.into());
+        }
+    });
+    // A white light over the chromatic image: the regions cancel — Cast Shadows changes
+    // nothing, exactly like a directionless image.
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    let white_casting = render(&p, cid);
+    let comp = p.comp_mut(cid).unwrap();
+    set(comp.layers.iter_mut().find(|l| l.is_light()).unwrap(), "lightOptions/castsShadows", Value::Bool(false));
+    let white_off = render(&p, cid);
+    assert_eq!(white_casting.data, white_off.data, "a white light sees no dominant region in the opposed red and blue");
+    // The red light: the tint removes the blue region, the red one shadows the sphere onto the
+    // floor below and right of it (the shadow falls opposite the red region).
+    let comp = p.comp_mut(cid).unwrap();
+    let light = comp.layers.iter_mut().find(|l| l.is_light()).unwrap();
+    set(light, "lightOptions/color", Value::Color([1.0, 0.0, 0.0, 1.0]));
+    set(light, "lightOptions/castsShadows", Value::Bool(true));
+    let img = render(&p, cid);
+    let chan = |img: &crate::Image, x: usize, y: usize| img.data[y * 200 + x][0];
+    let side = chan(&img, 25, 75);
+    let (mut core, mut cx) = (f32::INFINITY, 0usize);
+    for y in 100..150 {
+        for x in 60..170 {
+            if chan(&img, x, y) < core {
+                core = chan(&img, x, y);
+                cx = x;
+            }
+        }
+    }
+    assert!(side > 0.1, "the floor is lit red: {side}");
+    assert!(core < side * 0.65, "the red region shadows the sphere onto the floor: {core} vs {side} at x {cx}");
+    assert!(cx > 100, "the shadow is opposite the red region (right of the sphere): {cx}");
+}
+
+/// #2436: the default environment (no Source, no Environment Layer) is a dim studio — a mean
+/// of 0.3, not the 1.0 that would act like a 100 % white Ambient light and wash the scene out
+/// (After Effects' default does not) — and directional: its dominant region points up and
+/// toward the initial camera, so a shadow-casting Environment light casts soft, partial
+/// shadows out of the box, like After Effects' default.
+#[test]
+fn default_environment_keeps_the_level_and_points_up() {
+    let (w, h, d) = scene::default_environment();
+    assert_eq!((w, h), (8, 4));
+    let (mut mean, mut weight) = (0.0f32, 0.0f32);
+    for (i, p) in d.iter().enumerate() {
+        let v = ((i / w as usize) as f32 + 0.5) / h as f32;
+        let sa = (v * PI).sin();
+        mean += (p[0] + p[1] + p[2]) / 3.0 * sa;
+        weight += sa;
+    }
+    assert!((mean / weight - 0.3).abs() < 0.01, "dim studio mean: {}", mean / weight);
+    let (sun, key) = dominant_direction(w, h, &d, [1.0; 3], 0.0);
+    assert!(sun[1] < -0.5, "the key is up: {sun:?}");
+    assert!(sun[2] < -0.3, "the key is toward the camera: {sun:?}");
+    assert!(sun[0].abs() < 0.1, "symmetric left-right: {sun:?}");
+    assert!((0.35..0.55).contains(&key), "a broad key with fill: {key}");
+    // No texel clips past white at the default intensity (the fog of a mean-1 environment).
+    assert!(d.iter().all(|p| p[0] <= 1.0 && p[0] > 0.0), "0 < radiance <= 1");
+}
+
+/// #2436: with no Source and no Environment Layer, the Environment light's default environment
+/// casts soft, partial shadows like After Effects' default environment map — a sphere shadows
+/// the plane behind it, darkening part of the light while the fill keeps the floor visible
+/// (an area-light shadow, not the pitch black a point light casts); Cast Shadows off lights
+/// the floor evenly.
+#[test]
+fn the_default_environment_casts_shadows() {
+    let (mut p, cid) = project(200, 150);
+    // The floor facing the camera, a sphere in front of it casting shadows only.
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Plane }, |l| {
+        set(l, "geometryOptions/width", Value::Scalar(400.0));
+        set(l, "geometryOptions/height", Value::Scalar(400.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 120.0]));
+        set(l, "materialOptions/baseColor", Value::Color([1.0, 1.0, 1.0, 1.0]));
+    });
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Sphere }, |l| {
+        set(l, "geometryOptions/radius", Value::Scalar(30.0));
+        set(l, "transform/position", Value::Vec3([100.0, 45.0, 50.0]));
+        set(l, "materialOptions/castsShadows", Value::Enum(2));
+    });
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    // The default key (up and toward the camera) drops the shadow below the sphere: the core
+    // is the darkest floor pixel below it, the lit floor the sample to the left.
+    let luma = |img: &crate::Image, x: usize, y: usize| (img.data[y * 200 + x][0] + img.data[y * 200 + x][1] + img.data[y * 200 + x][2]) / 3.0;
+    let img = render(&p, cid);
+    let side = luma(&img, 30, 100);
+    let (mut core, mut cx, mut cy) = (f32::INFINITY, 0usize, 0usize);
+    for y in 110..150 {
+        for x in 80..120 {
+            if luma(&img, x, y) < core {
+                core = luma(&img, x, y);
+                cx = x;
+                cy = y;
+            }
+        }
+    }
+    assert!(side > 0.1, "the floor is lit: {side}");
+    // Partial: the key lobe is occluded (a clear darkening) but the fill keeps shining —
+    // not the pitch black a point light's shadow would cast at the same darkness. The frame
+    // is sRGB-encoded, so the ratios are gamma-compressed (a linear halving reads as ~0.73).
+    assert!(core < side * 0.8, "the default environment shadows the sphere onto the floor: {core} vs {side} at ({cx}, {cy})");
+    assert!(core > side * 0.45, "an area-light shadow, partial like After Effects': {core} vs {side}");
+    // Cast Shadows off: the floor is lit everywhere, core included.
+    let comp = p.comp_mut(cid).unwrap();
+    set(&mut comp.layers[0], "lightOptions/castsShadows", Value::Bool(false));
+    let img = render(&p, cid);
+    let mid = luma(&img, cx, cy);
+    assert!(mid > side * 0.9, "no shadow without Cast Shadows: {mid} vs {side}");
+}
+
 #[test]
 fn depth_of_field_blurs_out_of_focus_surfaces() {
     let mut img = Image::new(64, 64);
@@ -370,7 +813,17 @@ fn extruded_text_renders_as_a_mesh() {
         set(l, "geometryOptions/bevelStyle", Value::Enum(1));
         set(l, "transform/rotationY", Value::Scalar(40.0));
     });
-    let ctx = crate::EvalCtx { project: &p, comp_id: cid, comp: p.comp(cid).unwrap(), time: Tick::ZERO, expr: None, footage: None };
+    let ctx = crate::EvalCtx {
+        project: &p,
+        comp_id: cid,
+        comp: p.comp(cid).unwrap(),
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let l = &ctx.comp.layers[0];
     let params = scene::extrusion_params(&ctx, l).unwrap();
     let meshes = scene::extruded_meshes(&ctx, l, &params);
@@ -409,7 +862,17 @@ fn shape_surface_items_colour_the_extruded_surfaces() {
         set(l, "geometryOptions/extrusionDepth", Value::Scalar(40.0));
         set(l, "transform/position", Value::Vec3([100.0, 100.0, 0.0]));
     });
-    let ctx = crate::EvalCtx { project: &p, comp_id: cid, comp: p.comp(cid).unwrap(), time: Tick::ZERO, expr: None, footage: None };
+    let ctx = crate::EvalCtx {
+        project: &p,
+        comp_id: cid,
+        comp: p.comp(cid).unwrap(),
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let l = &ctx.comp.layers[0];
     let params = scene::extrusion_params(&ctx, l).unwrap();
     let meshes = scene::extruded_meshes(&ctx, l, &params);
@@ -445,7 +908,17 @@ fn text_animators_colour_the_extruded_surfaces() {
         set(l, "geometryOptions/extrusionDepth", Value::Scalar(30.0));
         set(l, "geometryOptions/bevelStyle", Value::Enum(1));
     });
-    let ctx = crate::EvalCtx { project: &p, comp_id: cid, comp: p.comp(cid).unwrap(), time: Tick::ZERO, expr: None, footage: None };
+    let ctx = crate::EvalCtx {
+        project: &p,
+        comp_id: cid,
+        comp: p.comp(cid).unwrap(),
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let l = &ctx.comp.layers[0];
     let params = scene::extrusion_params(&ctx, l).unwrap();
     let meshes = scene::extruded_meshes(&ctx, l, &params);
@@ -643,7 +1116,17 @@ fn extruded_strokes_render_as_bevelled_meshes() {
         set(l, "geometryOptions/extrusionDepth", Value::Scalar(20.0));
         set(l, "geometryOptions/bevelStyle", Value::Enum(1));
     });
-    let ctx = crate::EvalCtx { project: &p, comp_id: cid, comp: p.comp(cid).unwrap(), time: Tick::ZERO, expr: None, footage: None };
+    let ctx = crate::EvalCtx {
+        project: &p,
+        comp_id: cid,
+        comp: p.comp(cid).unwrap(),
+        time: Tick::ZERO,
+        expr: None,
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let l = &ctx.comp.layers[0];
     let params = scene::extrusion_params(&ctx, l).unwrap();
     let meshes = scene::extruded_meshes(&ctx, l, &params);
@@ -681,3 +1164,440 @@ fn stroke_regions_are_rings() {
     assert_eq!(outlines.len(), 1);
     assert_eq!(outlines[0].holes.len(), 1);
 }
+
+// ---------------------------------------------------------------- shadow quality
+
+use super::raster::{MAX_SHADOW_TEXELS, shadow_map_size, shadow_point_face_size, shadow_sizes};
+use super::scene::ShadowMap;
+
+/// Geometric normal of a receiver squarely facing a `flat_map` light (which looks along +z).
+const FACING: [f32; 3] = [0.0, 0.0, -1.0];
+
+/// Identity-view orthographic map: map coords are world x, y × `focal` offset by
+/// `size/2` (`focal` texels per world unit).
+fn flat_map(size: u32, focal: f32, radius: f32) -> ShadowMap {
+    ShadowMap { view: [[1.0, 0.0, 0.0, 0.0], [0.0, 1.0, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0]], focal, ortho: true, size, offset: 0, bias: 1.5, radius }
+}
+
+/// Wall: texel columns ≥ a quarter of the map at depth 10, the rest unoccluded (1000).
+/// Its edge sits at world x = −size / (4·focal).
+fn wall_map(size: u32, focal: f32, radius: f32) -> (ShadowMap, Vec<f32>) {
+    let texels: Vec<f32> = (0..size * size).map(|i| if i % size >= size / 4 { 10.0 } else { 1000.0 }).collect();
+    (flat_map(size, focal, radius), texels)
+}
+
+/// Luma of a render of `cid` with its top layer (a light) set to cast shadows or not,
+/// at the given Shadow Diffusion.
+fn render_light_luma(p: &mut Project, cid: ItemId, casting: bool, diffusion: f64) -> Vec<f32> {
+    let comp = p.comp_mut(cid).unwrap();
+    set(&mut comp.layers[0], "lightOptions/castsShadows", Value::Bool(casting));
+    set(&mut comp.layers[0], "lightOptions/shadowDiffusion", Value::Scalar(diffusion));
+    render(p, cid).data.iter().map(|q| (q[0] + q[1] + q[2]) / 3.0).collect()
+}
+
+#[test]
+fn shadow_map_size_tracks_raster_resolution() {
+    assert_eq!(shadow_map_size(640, 360, false), 1024);
+    assert_eq!(shadow_map_size(1920, 1080, false), 2048);
+    assert_eq!(shadow_map_size(3840, 2160, false), 4096);
+    // Clamped to the pow2 range: small or absurd rasters stay inside 512..4096.
+    assert_eq!(shadow_map_size(64, 64, false), 512);
+    assert_eq!(shadow_map_size(0, 0, false), 512);
+    assert_eq!(shadow_map_size(u32::MAX, u32::MAX, false), 4096);
+    assert_eq!(shadow_map_size(7, 100000, false), 4096);
+    // The fast-preview (draft) budget stays at 512 regardless, so interactivity is
+    // untouched by the quality path's new sizing.
+    assert_eq!(shadow_map_size(3840, 2160, true), 512);
+    assert_eq!(shadow_map_size(0, 0, true), 512);
+}
+
+#[test]
+fn shadow_point_faces_are_capped() {
+    // Cube faces take the full map size up to 2048 (one 2048 cube ≈ 25 M f32 texels).
+    assert_eq!(shadow_point_face_size(4096, false), 2048);
+    assert_eq!(shadow_point_face_size(2048, false), 2048);
+    assert_eq!(shadow_point_face_size(1024, false), 1024);
+    assert_eq!(shadow_point_face_size(512, false), 512);
+    // Draft keeps the historical half-size face.
+    assert_eq!(shadow_point_face_size(512, true), 256);
+}
+
+fn budget_texels(sizes: &[Option<u32>], kinds: &[u32]) -> u64 {
+    sizes.iter().zip(kinds).map(|(s, &k)| s.map(|z| (z as u64) * (z as u64) * if k == 2 { 6 } else { 1 }).unwrap_or(0)).sum()
+}
+
+#[test]
+fn shadow_sizes_stay_within_the_scene_budget() {
+    // Within budget a light gets its full size: one 4K point cube keeps 2048 faces.
+    assert_eq!(shadow_sizes(4096, 2160, false, &[2]), vec![Some(2048)]);
+    // Several cubes overflow: deterministically halved (largest first, earliest light
+    // on ties) until inside: three or four settle at 1024, five push two to 512.
+    assert_eq!(shadow_sizes(4096, 2160, false, &[2; 3]), vec![Some(1024); 3]);
+    assert_eq!(shadow_sizes(4096, 2160, false, &[2; 4]), vec![Some(1024); 4]);
+    let sizes = shadow_sizes(4096, 2160, false, &[2; 5]);
+    assert_eq!(sizes, vec![Some(512), Some(512), Some(1024), Some(1024), Some(1024)]);
+    assert!(budget_texels(&sizes, &[2; 5]) <= MAX_SHADOW_TEXELS);
+    // A hostile light count can never break the cap; sizes only shrink or drop to None.
+    let many = vec![2u32; 1000];
+    let sizes = shadow_sizes(3840, 2160, false, &many);
+    assert_eq!(sizes.len(), 1000);
+    assert!(budget_texels(&sizes, &many) <= MAX_SHADOW_TEXELS);
+    assert!(sizes.iter().flatten().all(|&z| (128..=2048).contains(&z)));
+    // Deterministic: same inputs, same plan.
+    assert_eq!(sizes, shadow_sizes(3840, 2160, false, &many));
+    // Non-point lights and a modest scene keep full quality sizes.
+    assert_eq!(shadow_sizes(1920, 1080, false, &[1; 2]), vec![Some(2048), Some(2048)]);
+    // A light that casts nothing costs nothing: it stays None and leaves its
+    // full-size budget to the lights that do cast.
+    assert_eq!(shadow_sizes(640, 360, false, &[0, 1]), vec![None, Some(1024)]);
+    assert!(shadow_sizes(640, 360, false, &[0; 500]).iter().all(Option::is_none));
+}
+
+#[test]
+fn diffusion_does_not_lift_a_deep_shadow() {
+    // Shadow Diffusion may widen the penumbra but must not scale the depth bias: a
+    // point deep inside a shadow stays fully shadowed at any diffusion.
+    let (m, texels) = wall_map(64, 1.0, 1.0);
+    let deep = [0.0f32, 0.0, 13.5]; // u = 32: ±16 texels of margin around the edge at 16; z − bias 12 > 10
+    let hard = shade::shadow_factor(&m, &texels, deep, FACING, 1.0);
+    assert!(hard < 0.01, "deep shadow at radius 1: {hard}");
+    let wide = shade::shadow_factor(&flat_map(64, 1.0, 25.0), &texels, deep, FACING, 1.0);
+    assert!(wide < 0.01, "deep shadow at radius 25 (bias must not grow with radius): {wide}");
+}
+
+#[test]
+fn pcf_varies_within_a_texel() {
+    // Nearest-texel PCF snaps the edge to texel boundaries: two receivers 1/20 texel
+    // apart get bit-identical factors, which is what stair-steps straight edges.
+    // The filtering must produce coverage that varies within a single texel.
+    let (m, texels) = wall_map(64, 1.0, 2.0);
+    let mut pairs = 0;
+    let mut varying = 0;
+    let mut u = -17.0f32;
+    while u < -15.3 {
+        let a = shade::shadow_factor(&m, &texels, [u, 0.0, 13.5], FACING, 1.0);
+        let b = shade::shadow_factor(&m, &texels, [u + 0.05, 0.0, 13.5], FACING, 1.0);
+        pairs += 1;
+        if (a - b).abs() > 1e-6 {
+            varying += 1;
+        }
+        assert!((0.0..=1.0).contains(&a) && (0.0..=1.0).contains(&b), "{a} {b}");
+        u += 0.05;
+    }
+    assert!(pairs >= 30);
+    assert_eq!(varying, pairs, "coverage varies inside every texel along the edge");
+}
+
+#[test]
+fn wide_diffusion_keeps_shadow_depth_and_contact() {
+    // Scene: camera-facing floor, sphere casting, point light behind the camera and
+    // off to the upper right so most of the shadow lands beside the sphere, not
+    // behind it. Raising Shadow Diffusion must neither wash the shadow out (a
+    // diffusion-scaled bias leaks light into it) nor move where it touches.
+    let (mut p, cid) = project(200, 150);
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Plane }, |l| {
+        set(l, "geometryOptions/width", Value::Scalar(400.0));
+        set(l, "geometryOptions/height", Value::Scalar(400.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 200.0]));
+        set(l, "materialOptions/baseColor", Value::Color([1.0, 1.0, 1.0, 1.0]));
+    });
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Sphere }, |l| {
+        set(l, "geometryOptions/radius", Value::Scalar(30.0));
+        set(l, "transform/position", Value::Vec3([100.0, 75.0, 50.0]));
+        set(l, "materialOptions/castsShadows", Value::Enum(1));
+    });
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Point }, |l| {
+        set(l, "transform/position", Value::Vec3([180.0, 20.0, -300.0]));
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    let noshadow = render_light_luma(&mut p, cid, false, 0.0);
+    let d0 = render_light_luma(&mut p, cid, true, 0.0);
+    let d40 = render_light_luma(&mut p, cid, true, 40.0);
+    // Per-column darkening vs the shadowless render: depth (max darkening) and the
+    // deepest dark row (contact edge). Diffusion may blur the edge but must keep the
+    // shadow dark (no bias leak) and keep it where it touches (no lift).
+    let dep = |img: &[f32], x: usize| -> f32 { (20..140).map(|y| noshadow[y * 200 + x] - img[y * 200 + x]).fold(0.0f32, f32::max) };
+    let cols: Vec<usize> = (30..170).filter(|&x| dep(&d0, x) > 0.1).collect();
+    assert!(cols.len() > 30, "shadow covers many columns: {}", cols.len());
+    // Core depth: the 90th-percentile darkening over the d0 shadow's pixels. A blur
+    // only softens the rim and leaves the core dark; a bias leak lightens all of it.
+    let shadow_px: Vec<usize> = (20..140).flat_map(|y| (30..170).map(move |x| y * 200 + x)).filter(|&i| noshadow[i] - d0[i] > 0.1).collect();
+    let core = |img: &[f32]| -> f32 {
+        let mut v: Vec<f32> = shadow_px.iter().map(|&i| noshadow[i] - img[i]).collect();
+        v.sort_by(f32::total_cmp);
+        v[v.len() * 9 / 10]
+    };
+    let (core0, core40) = (core(&d0), core(&d40));
+    // Width of the shadow across its centre row: a diffusion-scaled bias shrinks the
+    // shadow (light leaks under its edges), while a correct filter keeps the extent
+    // and only softens the boundary (threshold crossings move at most with the
+    // penumbra, not with the bias).
+    let width = |img: &[f32]| -> f32 {
+        (30..130)
+            .map(|y| {
+                let dark: Vec<bool> = (0..200).map(|x| noshadow[y * 200 + x] - img[y * 200 + x] > 0.06).collect();
+                match (dark.iter().position(|&d| d), dark.iter().rposition(|&d| d)) {
+                    (Some(l), Some(r)) if r > l => (r - l) as f32,
+                    _ => 0.0,
+                }
+            })
+            .fold(0.0f32, f32::max)
+    };
+    let (w0, w40) = (width(&d0), width(&d40));
+    let wratio = w40 / w0;
+    assert!(w0 > 20.0, "shadow is wide enough to judge: {w0}");
+    assert!(core40 >= 0.9 * core0, "diffusion 40 keeps the shadow core dark: {core40:.4} vs {core0:.4}");
+    assert!(wratio >= 0.8, "diffusion 40 does not shrink the shadow: width {w40} vs {w0}");
+}
+
+#[test]
+fn penumbra_dithers_along_a_straight_edge() {
+    // Receivers at the same distance from a straight edge, one texel apart along it.
+    // A fixed tap grid gives each the same coverage, so the penumbra repeats texel by
+    // texel (stair-steps and bands); the jitter, keyed below texel size, must vary it.
+    let (m, texels) = wall_map(64, 1.0, 6.0);
+    let distinct = |vs: &[f32]| -> usize {
+        let mut bits: Vec<u32> = vs.iter().map(|v| v.to_bits()).collect();
+        bits.sort_unstable();
+        bits.dedup();
+        bits.len()
+    };
+    let along: Vec<f32> = (0..32).map(|k| shade::shadow_factor(&m, &texels, [-16.0, -16.0 + k as f32, 13.5], FACING, 1.0)).collect();
+    assert!(distinct(&along) >= 16, "coverage along the edge takes {} distinct values", distinct(&along));
+    // And finer than a texel: where one texel spans several output pixels (a grazing
+    // floor), dither keyed per texel would show as texel-sized blocks of grain.
+    let within: Vec<f32> = (0..8).map(|k| shade::shadow_factor(&m, &texels, [-16.0, 0.0625 + k as f32 * 0.125, 13.5], FACING, 1.0)).collect();
+    assert!(distinct(&within) >= 4, "coverage inside one texel takes {} distinct values", distinct(&within));
+}
+
+#[test]
+fn penumbra_jitter_is_continuous_across_its_lattice() {
+    // Receiver pairs 1/5000 texel either side of a line of the 1/8-texel jitter lattice,
+    // across u and across v, inside the penumbra. The GPU places a receiver within a few
+    // ulps of the CPU, so coverage that jumps at a lattice line differs between the two
+    // backends there; both sides of each line must agree within one 8-bit level.
+    let (m, texels) = wall_map(64, 1.0, 6.0);
+    let f = |p: [f32; 2]| shade::shadow_factor(&m, &texels, [p[0], p[1], 13.5], FACING, 1.0);
+    let mut worst = 0.0f32;
+    for k in 0..16 {
+        let line = k as f32 * 0.125;
+        for (a, b) in [([-16.0 + line - 2e-4, 0.3], [-16.0 + line + 2e-4, 0.3]), ([-16.3, line - 2e-4], [-16.3, line + 2e-4])] {
+            let (fa, fb) = (f(a), f(b));
+            assert!(fa > 0.05 && fa < 0.95, "{a:?} lies in the penumbra: {fa}");
+            worst = worst.max((fa - fb).abs());
+        }
+    }
+    assert!(worst < 1.0 / 255.0, "coverage jumps by {worst} across a jitter lattice line");
+}
+
+#[test]
+fn penumbra_width_is_independent_of_map_resolution() {
+    // One wall (edge at world x = −16) in a 64-texel map at 1 texel per world unit and
+    // a 256-texel map at 4. Shadow Diffusion sets the penumbra in output pixels (world
+    // units here), so a finer map must not narrow it.
+    let width = |size: u32, focal: f32| -> f32 {
+        let (m, texels) = wall_map(size, focal, 8.0);
+        let xs: Vec<f32> = (0..400).map(|k| -30.0 + k as f32 * 0.07).collect();
+        let f: Vec<f32> = xs.iter().map(|&x| shade::shadow_factor(&m, &texels, [x, 0.0, 13.5], FACING, 1.0)).collect();
+        let first_below = |t: f32| f.iter().position(|&v| v < t).map_or(f32::NAN, |i| xs[i]);
+        first_below(0.1) - first_below(0.9)
+    };
+    let (w64, w256) = (width(64, 1.0), width(256, 4.0));
+    assert!(w64 > 4.0 && w64 < 12.0, "penumbra spans about the requested 8 units: {w64}");
+    assert!((w256 / w64 - 1.0).abs() < 0.25, "same penumbra at any map resolution: {w64} vs {w256}");
+}
+
+#[test]
+fn tilted_receivers_do_not_shadow_themselves() {
+    // A receiver plane z = 100 + 4x (76° from the light, n·l ≈ 0.24), each texel holding
+    // its depth half a texel off-centre the way a rasteriser can. Wide taps must compare
+    // against the plane rather than the receiver point, and the slope-scaled bias must
+    // absorb the half-texel error, at every diffusion.
+    let (size, g) = (128u32, 4.0f32);
+    let c = size as f32 * 0.5;
+    let texels: Vec<f32> = (0..size * size).map(|i| 100.0 + g * ((i % size) as f32 - c)).collect();
+    let len = (1.0 + g * g).sqrt();
+    let (ng, n_l) = ([g / len, 0.0, -1.0 / len], 1.0 / len);
+    for radius in [1.0f32, 6.0, 25.0] {
+        let m = flat_map(size, 1.0, radius);
+        for k in 0..40 {
+            let x = -20.0 + k as f32 * 0.97;
+            let f = shade::shadow_factor(&m, &texels, [x, 3.3, 100.0 + g * x], ng, n_l);
+            assert!(f > 0.99, "radius {radius}, x {x}: lit tilted receiver shadowed itself ({f})");
+        }
+    }
+}
+
+#[test]
+fn lit_casters_do_not_shadow_themselves() {
+    // A sphere and a turned cube that cast shadows, lit by each light kind: the lit
+    // surface must render as bright as with shadows off at any Shadow Diffusion (a
+    // wide kernel on a surface tilted to the light must not see its own depth).
+    // 640×360: faces then span enough texels that near-grazing ones exercise the
+    // receiver plane's slope limit.
+    for (prim, rot_y) in [(PrimitiveKind::Sphere, 0.0), (PrimitiveKind::Cube, 35.0)] {
+        for kind in [LightKind::Point, LightKind::Spot, LightKind::Parallel] {
+            let (mut p, cid) = project(640, 360);
+            add(&mut p, cid, LayerSource::Primitive { kind: prim }, |l| {
+                set(l, "transform/position", Value::Vec3([320.0, 180.0, 100.0]));
+                if prim == PrimitiveKind::Sphere {
+                    set(l, "geometryOptions/radius", Value::Scalar(120.0));
+                } else {
+                    for k in ["width", "height", "depth"] {
+                        set(l, &format!("geometryOptions/{k}"), Value::Scalar(216.0));
+                    }
+                    set(l, "transform/rotationX", Value::Scalar(-25.0));
+                }
+                set(l, "transform/rotationY", Value::Scalar(rot_y));
+                set(l, "materialOptions/baseColor", Value::Color([1.0, 1.0, 1.0, 1.0]));
+                set(l, "materialOptions/castsShadows", Value::Enum(1));
+            });
+            add(&mut p, cid, LayerSource::Light { kind }, |l| {
+                set(l, "transform/position", Value::Vec3([-280.0, -108.0, -600.0]));
+                if let Some(poi) = l.props.prop_mut("transform/pointOfInterest") {
+                    poi.value = Value::Vec3([320.0, 180.0, 100.0]);
+                }
+            });
+            let noshadow = render_light_luma(&mut p, cid, false, 0.0);
+            let lit: Vec<usize> = (0..noshadow.len()).filter(|&i| noshadow[i] > 0.15).collect();
+            assert!(lit.len() > 10_000, "{prim:?} {kind:?}: lit area {}", lit.len());
+            for diffusion in [0.0, 20.0, 48.0] {
+                let img = render_light_luma(&mut p, cid, true, diffusion);
+                let dark = lit.iter().filter(|&&i| img[i] < 0.9 * noshadow[i]).count() as f32 / lit.len() as f32;
+                assert!(dark <= 0.02, "{prim:?} {kind:?} diffusion {diffusion}: {:.1} % of the lit surface self-shadowed", dark * 100.0);
+            }
+        }
+    }
+}
+
+#[test]
+fn shadow_sizes_match_the_halve_largest_rule_and_scale_to_many_lights() {
+    // The specification `shadow_sizes` implements, step by step: halve the largest map
+    // above its floor (earliest light on ties) until the scene fits, then drop maps
+    // from the last light.
+    let spec = |w: u32, h: u32, draft: bool, kinds: &[u32]| -> Vec<Option<u32>> {
+        let base = shadow_map_size(w, h, draft);
+        let mut sizes: Vec<u32> = kinds
+            .iter()
+            .map(|&k| {
+                if k == 0 {
+                    0
+                } else if k == 2 {
+                    shadow_point_face_size(base, draft)
+                } else {
+                    base
+                }
+            })
+            .collect();
+        let total = |s: &[u32]| -> u64 { s.iter().zip(kinds).map(|(&z, &k)| (z as u64) * (z as u64) * if k == 2 { 6 } else { 1 }).sum() };
+        while total(&sizes) > MAX_SHADOW_TEXELS {
+            let pick = (0..sizes.len()).filter(|&i| sizes[i] > if kinds[i] == 2 { 128 } else { 512 }).max_by_key(|&i| (sizes[i], std::cmp::Reverse(i)));
+            match pick {
+                Some(i) => sizes[i] /= 2,
+                None => match sizes.iter().rposition(|&z| z > 0) {
+                    Some(i) => sizes[i] = 0,
+                    None => break,
+                },
+            }
+        }
+        sizes.into_iter().map(|z| (z > 0).then_some(z)).collect()
+    };
+    let mut seed = 0x2545_F491u32;
+    for case in 0..300 {
+        seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+        let n = (seed >> 8) as usize % 40;
+        let kinds: Vec<u32> = (0..n)
+            .map(|_| {
+                seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+                (seed >> 16) % 3
+            })
+            .collect();
+        let (w, h, draft) = ([640, 1920, 3840, 8000][case % 4], [360, 1080, 2160, 100][case % 4], case % 7 == 0);
+        assert_eq!(shadow_sizes(w, h, draft, &kinds), spec(w, h, draft, &kinds), "case {case}: {kinds:?}");
+    }
+    // A hostile light count stays fast (n log n) and inside the budget.
+    let many = vec![2u32; 100_000];
+    let sizes = shadow_sizes(3840, 2160, false, &many);
+    assert!(budget_texels(&sizes, &many) <= MAX_SHADOW_TEXELS);
+}
+
+#[test]
+fn wide_penumbrae_are_smooth() {
+    // Coverage at a fixed distance across a wide penumbra, sampled along a straight
+    // edge, should be one smooth value plus fine dither. A 5×5 grid stretched over a
+    // 20-texel reach leaves gaps the jitter turns into coarse grain (σ ≈ 0.04, ten
+    // 8-bit levels); the grid grows with the reach to keep it below 0.02.
+    let (m, texels) = wall_map(256, 1.0, 20.0);
+    for off in [-5.0f32, 0.0, 5.0] {
+        let vs: Vec<f32> = (0..200).map(|k| shade::shadow_factor(&m, &texels, [-64.0 + off, -100.0 + k as f32, 13.5], FACING, 1.0)).collect();
+        let mean = vs.iter().sum::<f32>() / vs.len() as f32;
+        let sd = (vs.iter().map(|v| (v - mean).powi(2)).sum::<f32>() / vs.len() as f32).sqrt();
+        assert!(sd < 0.02, "offset {off}: penumbra grain σ = {sd:.4}");
+    }
+}
+
+#[test]
+fn hard_edges_ramp_over_two_texels() {
+    // At Shadow Diffusion 0 the edge still ramps across about two texels (10–90 %):
+    // where one texel spans several output pixels (a floor grazing a point light) a
+    // one-texel ramp leaves the binary compare's texel steps visible as a sawtooth.
+    let (m, texels) = wall_map(64, 1.0, 1.0);
+    for v0 in [0.0f32, 0.3, 7.6] {
+        let xs: Vec<f32> = (0..400).map(|k| -20.0 + k as f32 * 0.02).collect();
+        let f: Vec<f32> = xs.iter().map(|&x| shade::shadow_factor(&m, &texels, [x, v0, 13.5], FACING, 1.0)).collect();
+        let first_below = |t: f32| f.iter().position(|&v| v < t).map_or(f32::NAN, |i| xs[i]);
+        let w = first_below(0.1) - first_below(0.9);
+        assert!((1.7..3.0).contains(&w), "v {v0}: hard edge ramps over {w} texels");
+    }
+}
+
+// ---------------------------------------------------------------- the After Effects look (#2436)
+
+/// #2436: an Environment light with every option at its default renders like After Effects':
+/// a dim studio that leaves the lit floor a mid gray instead of washing it out to white (the
+/// fog of a mean-1 default), a partial shadow (the key lobe occluded, the fill still shining —
+/// not the pitch black a point light casts), and a soft edge in both quality and draft renders
+/// (the map's texel grid never shows through as stair-steps).
+#[test]
+fn environment_shadows_match_the_after_effects_look() {
+    let (mut p, cid) = project(800, 600);
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Plane }, |l| {
+        set(l, "geometryOptions/width", Value::Scalar(1200.0));
+        set(l, "geometryOptions/height", Value::Scalar(900.0));
+        set(l, "transform/position", Value::Vec3([400.0, 300.0, 300.0]));
+        set(l, "materialOptions/baseColor", Value::Color([1.0, 1.0, 1.0, 1.0]));
+    });
+    add(&mut p, cid, LayerSource::Primitive { kind: PrimitiveKind::Sphere }, |l| {
+        set(l, "geometryOptions/radius", Value::Scalar(80.0));
+        set(l, "transform/position", Value::Vec3([400.0, 300.0, 120.0]));
+        set(l, "materialOptions/castsShadows", Value::Enum(2));
+    });
+    add(&mut p, cid, LayerSource::Light { kind: LightKind::Environment }, |l| {
+        set(l, "lightOptions/castsShadows", Value::Bool(true));
+    });
+    let luma = |img: &crate::Image, x: usize, y: usize| (img.data[y * 800 + x][0] + img.data[y * 800 + x][1] + img.data[y * 800 + x][2]) / 3.0;
+    for (name, opts) in [("quality", RenderOpts::default()), ("draft", RenderOpts { draft: true, ..Default::default() })] {
+        let img = Renderer::new(&p, &NoFootage, opts).comp_frame(cid, Tick::ZERO);
+        // The shadow core: the darkest pixel of the lower half (the key drops the shadow
+        // below the sphere); the lit floor is the mean of the band to its left.
+        let (mut core, mut cx, mut cy) = (f32::INFINITY, 0usize, 0usize);
+        for y in 420..580 {
+            for x in 300..500 {
+                if luma(&img, x, y) < core {
+                    core = luma(&img, x, y);
+                    cx = x;
+                    cy = y;
+                }
+            }
+        }
+        let lit: f32 = (60..260).map(|x| luma(&img, x, cy)).sum::<f32>() / 200.0;
+        assert!(lit > 0.15 && lit < 0.85, "{name}: the lit floor is a mid gray, no white fog: {lit}");
+        // The frame is sRGB-encoded, so the ratio is gamma-compressed (a linear halving
+        // reads as ~0.73): partial means clearly darker than lit, far from black.
+        assert!(core > lit * 0.45 && core < lit * 0.85, "{name}: a partial area-light shadow: core {core} vs lit {lit}");
+        // The edge's 10-90 % ramp from the lit plateau (left) down into the shadow.
+        let first_below = |t: f32| (260..cx).position(|x| luma(&img, x, cy) < core + (lit - core) * t).map(|i| 260 + i);
+        let w = (first_below(0.1).unwrap() as f32) - (first_below(0.9).unwrap() as f32);
+        assert!(w >= 3.5, "{name}: the edge ramps over {w} px (After Effects' env shadows are soft)");
+    }
+}
diff --git a/crates/render/src/three_d/bokeh.rs b/crates/render/src/three_d/bokeh.rs
index 12bcbcf37..098f095d0 100644
--- a/crates/render/src/three_d/bokeh.rs
+++ b/crates/render/src/three_d/bokeh.rs
@@ -289,16 +289,24 @@ pub fn progressive_blur(img: &Image, iris: &Iris, radius: &[f32]) -> Image {
         return bokeh_blur(img, iris, levels[0] as f64);
     }
     let (lo, hi, n) = (levels[0], levels[levels.len() - 1], levels.len());
-    let blurred: Vec<Image> = levels.par_iter().map(|&r| bokeh_blur(img, iris, r as f64)).collect();
+    // A pixel blends only the two levels around its radius, so the levels are made in order and
+    // only that pair is held: peak memory stays a few images whatever the level count, rather
+    // than one image per level. Each level's blur is parallel over its rows.
     let mut out = Image::new(img.width, img.height);
-    out.data.par_iter_mut().enumerate().for_each(|(i, o)| {
-        let r = radius[i];
-        let f = ((r - lo) / (hi - lo) * (n - 1) as f32).clamp(0.0, (n - 1) as f32);
-        let k = (f.floor() as usize).min(n - 2);
-        let t = f - k as f32;
-        let (a, b) = (blurred[k].data[i], blurred[k + 1].data[i]);
-        *o = [0, 1, 2, 3].map(|c| a[c] + (b[c] - a[c]) * t);
-    });
+    let mut below = bokeh_blur(img, iris, lo as f64);
+    for (k, &r) in levels.iter().enumerate().skip(1) {
+        let above = bokeh_blur(img, iris, r as f64);
+        out.data.par_iter_mut().enumerate().for_each(|(i, o)| {
+            let f = ((radius[i] - lo) / (hi - lo) * (n - 1) as f32).clamp(0.0, (n - 1) as f32);
+            let kk = (f.floor() as usize).min(n - 2);
+            if kk + 1 == k {
+                let t = f - kk as f32;
+                let (a, b) = (below.data[i], above.data[i]);
+                *o = [0, 1, 2, 3].map(|c| a[c] + (b[c] - a[c]) * t);
+            }
+        });
+        below = above;
+    }
     out
 }
 
diff --git a/crates/render/src/three_d/camera.rs b/crates/render/src/three_d/camera.rs
index 5e1f983b2..6aee50a78 100644
--- a/crates/render/src/three_d/camera.rs
+++ b/crates/render/src/three_d/camera.rs
@@ -37,7 +37,8 @@ pub struct Dof {
 impl Dof {
     /// Circle-of-confusion diameter (comp pixels) for a point at camera depth `z`.
     pub fn coc(&self, z: f64) -> f64 {
-        if z <= NEAR || self.focus <= 0.0 {
+        // No defocus can be measured against a non-finite focus or depth, so it counts as in focus.
+        if !z.is_finite() || z <= NEAR || !self.focus.is_finite() || self.focus <= 0.0 {
             return 0.0;
         }
         self.aperture * (z - self.focus).abs() / z * self.blur_level
@@ -116,12 +117,15 @@ pub fn basis_view(eye: Vec3, forward: Vec3, down_hint: Vec3) -> Mat4 {
     Mat4([[r.x, r.y, r.z, 0.0], [d.x, d.y, d.z, 0.0], [f.x, f.y, f.z, 0.0], [0.0, 0.0, 0.0, 1.0]]) * Mat4::translate(-eye)
 }
 
-/// Orientation angles (degrees, AE order X→Y→Z with Z = 0) that point +z along `dir`.
+/// Orientation angles (degrees, [`Mat4::orientation`]'s order) that point +z along `dir` with
+/// the layer's x axis kept level (no roll): the pitch about x, then the turn about the world's
+/// vertical axis, written as Orientation.
 pub fn orientation_for(dir: Vec3) -> [f64; 3] {
     let d = dir.normalize();
-    let x = (-d.y).clamp(-1.0, 1.0).asin().to_degrees();
-    let y = d.x.atan2(d.z).to_degrees();
-    [norm360(x), norm360(y), 0.0]
+    let pitch = (-d.y).clamp(-1.0, 1.0).asin().to_degrees();
+    let yaw = d.x.atan2(d.z).to_degrees();
+    let o = (Mat4::rotate_y(yaw) * Mat4::rotate_x(pitch)).orientation_angles();
+    [norm360(o.x), norm360(o.y), norm360(o.z)]
 }
 
 fn norm360(a: f64) -> f64 {
@@ -176,7 +180,7 @@ pub fn layer_rotation(ctx: &EvalCtx, layer: &Layer) -> Mat4 {
     let rx = ctx.f(layer, tr, "rotationX", 0.0);
     let ry = ctx.f(layer, tr, "rotationY", 0.0);
     let rz = ctx.f(layer, tr, "rotation", 0.0);
-    Mat4::orientation(Vec3::from(o)) * Mat4::rotate_z(rz) * Mat4::rotate_y(ry) * Mat4::rotate_x(rx)
+    Mat4::orientation(Vec3::from(o)) * Mat4::rotation_xyz(rx, ry, rz)
 }
 
 /// World matrix of a layer's parent chain (identity when unparented).
@@ -241,6 +245,53 @@ fn path_tangent(ctx: &EvalCtx, layer: &Layer) -> Option<Vec3> {
         .filter(|k| **k <= ctx.time)
         .find_map(|&k| dir(pos(k) - pos(k - dt)))
         .or_else(|| keys.iter().filter(|k| **k > ctx.time).find_map(|&k| dir(pos(k + dt) - pos(k))))
+        .or_else(|| {
+            // An expression has no keys to fall back on: sample it instead.
+            let expr = dims.iter().any(|m| tr.get(m).is_some_and(|p| p.has_expression()));
+            expr.then(|| sampled_tangent(ctx, layer, &pos, dt, true).or_else(|| sampled_tangent(ctx, layer, &pos, dt, false))).flatten()
+        })
+}
+
+/// Samples spent on each phase of [`sampled_tangent`]: it runs per layer per frame.
+const MOTION_SEARCH_STEPS: u32 = 12;
+
+/// Direction of the motion nearest to the context time, before it (`earlier`) or after it, for a
+/// position with no keyframes to fall back on (an expression). Steps 1, 2, 4, ... frames away
+/// (within the layer's in/out points) until the position differs from the current one, then
+/// bisects down to `dt` the moment the motion stopped (or started), so the heading kept is the
+/// one at the end of the motion whichever frame is shown.
+fn sampled_tangent(ctx: &EvalCtx, layer: &Layer, pos: &dyn Fn(effectcraft_time::Tick) -> Vec3, dt: effectcraft_time::Tick, earlier: bool) -> Option<Vec3> {
+    let here = pos(ctx.time);
+    let moved = |t| (pos(t) - here).length() > 1e-9;
+    let limit = if earlier { layer.in_point.min(ctx.time) } else { layer.out_point.max(ctx.time) };
+    let mut step = ctx.comp.frame_duration().max(dt);
+    let (mut still, mut away) = (ctx.time, None);
+    for _ in 0..MOTION_SEARCH_STEPS {
+        let t = if earlier { (ctx.time - step).max(limit) } else { (ctx.time + step).min(limit) };
+        if moved(t) {
+            away = Some(t);
+            break;
+        }
+        still = t;
+        if t == limit {
+            break;
+        }
+        step = step + step;
+    }
+    let mut away = away?;
+    for _ in 0..MOTION_SEARCH_STEPS {
+        if (still - away).abs() <= dt {
+            break;
+        }
+        let mid = away + (still - away).mul_ratio(1, 2);
+        if moved(mid) {
+            away = mid;
+        } else {
+            still = mid;
+        }
+    }
+    let d = if earlier { here - pos(away) } else { pos(away) - here };
+    (d.length() > 1e-9 && d.length().is_finite()).then(|| d.normalize())
 }
 
 /// Auto-Orient ▸ Orient Along Path for 2D layers: extra Z rotation in degrees.
@@ -313,22 +364,27 @@ pub fn layer_camera(ctx: &EvalCtx, cam: &Layer) -> CameraState {
     let (eye, fwd, down) = layer_frame(ctx, cam);
     let opts = cam.props.sub("cameraOptions");
     let zoom = opts.map(|g| ctx.f(cam, g, "zoom", 1000.0)).unwrap_or(1000.0).max(1e-3);
-    let dof = opts.filter(|g| ctx.b(cam, g, "dof")).map(|g| Dof {
-        focus: ctx.f(cam, g, "focusDistance", zoom),
-        aperture: ctx.f(cam, g, "aperture", default_aperture(w)).max(0.0),
-        blur_level: ctx.f(cam, g, "blurLevel", 100.0).max(0.0) / 100.0,
-        iris: super::bokeh::Iris {
-            sides: super::bokeh::Iris::sides_of_shape(ctx.e(cam, g, "irisShape")),
-            rotation: ctx.f(cam, g, "irisRotation", 0.0),
-            roundness: ctx.f(cam, g, "irisRoundness", 0.0) / 100.0,
-            aspect: ctx.f(cam, g, "irisAspectRatio", 1.0).max(0.01),
-            fringe: ctx.f(cam, g, "irisDiffractionFringe", 0.0).max(0.0) / 100.0,
-        },
-        highlight: super::bokeh::Highlight {
-            gain: ctx.f(cam, g, "highlightGain", 0.0).clamp(0.0, 100.0) / 100.0,
-            threshold: ctx.f(cam, g, "highlightThreshold", 255.0).clamp(0.0, 255.0) / 255.0,
-            saturation: ctx.f(cam, g, "highlightSaturation", 0.0).clamp(0.0, 100.0) / 100.0,
-        },
+    let dof = opts.filter(|g| ctx.b(cam, g, "dof")).map(|g| {
+        // A non-finite Focus Distance would make every blur radius non-finite; use the value the
+        // property defaults to (the zoom plane) instead.
+        let focus = ctx.f(cam, g, "focusDistance", zoom);
+        Dof {
+            focus: if focus.is_finite() { focus } else { zoom },
+            aperture: ctx.f(cam, g, "aperture", default_aperture(w)).max(0.0),
+            blur_level: ctx.f(cam, g, "blurLevel", 100.0).max(0.0) / 100.0,
+            iris: super::bokeh::Iris {
+                sides: super::bokeh::Iris::sides_of_shape(ctx.e(cam, g, "irisShape")),
+                rotation: ctx.f(cam, g, "irisRotation", 0.0),
+                roundness: ctx.f(cam, g, "irisRoundness", 0.0) / 100.0,
+                aspect: ctx.f(cam, g, "irisAspectRatio", 1.0).max(0.01),
+                fringe: ctx.f(cam, g, "irisDiffractionFringe", 0.0).max(0.0) / 100.0,
+            },
+            highlight: super::bokeh::Highlight {
+                gain: ctx.f(cam, g, "highlightGain", 0.0).clamp(0.0, 100.0) / 100.0,
+                threshold: ctx.f(cam, g, "highlightThreshold", 255.0).clamp(0.0, 255.0) / 255.0,
+                saturation: ctx.f(cam, g, "highlightSaturation", 0.0).clamp(0.0, 100.0) / 100.0,
+            },
+        }
     });
     CameraState { view: basis_view(eye, fwd, down), eye, zoom, ortho: false, dof }
 }
@@ -408,7 +464,7 @@ impl View3D {
         }
     }
     pub fn from_id(s: &str) -> Option<View3D> {
-        let k: String = s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase();
+        let k: String = s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase();
         View3D::ALL.into_iter().find(|v| v.id().eq_ignore_ascii_case(&k) || v.label().replace(' ', "").eq_ignore_ascii_case(&k))
     }
     pub fn is_ortho(self) -> bool {
diff --git a/crates/render/src/three_d/compose.rs b/crates/render/src/three_d/compose.rs
index 1f17e3314..8713833c3 100644
--- a/crates/render/src/three_d/compose.rs
+++ b/crates/render/src/three_d/compose.rs
@@ -18,7 +18,7 @@ use std::sync::Arc;
 use effectcraft_color::{BlendMode, blend_pixel};
 use effectcraft_effects::Buf;
 use effectcraft_geom::{Mat3, Mat4, Vec3, vec3};
-use effectcraft_project::{Layer, LightKind, MatteKind};
+use effectcraft_project::{Layer, LightKind, MatteKind, limits};
 use effectcraft_raster::{Image, Px, hash_noise};
 use effectcraft_time::Tick;
 use rayon::prelude::*;
@@ -241,34 +241,33 @@ fn mb_samples(r: &Renderer, ctx: &EvalCtx, layer: &Layer) -> usize {
 }
 
 /// Prepare a layer (buffer, geometry, material). `None` when it shows nothing.
-pub(crate) fn prepare<'a>(r: &Renderer, ctx: &EvalCtx<'a>, layer: &'a Layer, order: usize, out: (u32, u32), in_run: bool) -> Option<Item<'a>> {
+pub(crate) fn prepare<'a>(r: &Renderer, ctx: &EvalCtx<'_>, layer: &'a Layer, order: usize, out: (u32, u32), in_run: bool) -> Option<Item<'a>> {
     let buf = r.blend_layer_buf(ctx, layer)?;
-    prepare_with(r, ctx, layer, order, out, in_run, buf, Mat4::IDENTITY)
+    prepare_with(r, ctx, layer, order, out, in_run, PlaneInput { buf, local: Mat4::IDENTITY })
 }
 
 /// Prepare a layer as planes: one per character for per-character 3D text, else one.
-pub(crate) fn prepare_all<'a>(r: &Renderer, ctx: &EvalCtx<'a>, layer: &'a Layer, order: usize, out: (u32, u32), in_run: bool) -> Vec<Item<'a>> {
+pub(crate) fn prepare_all<'a>(r: &Renderer, ctx: &EvalCtx<'_>, layer: &'a Layer, order: usize, out: (u32, u32), in_run: bool) -> Vec<Item<'a>> {
     if crate::text::per_char_3d(ctx, layer) {
-        return crate::text::per_char_planes(ctx, layer, r.opts.scale)
+        return crate::text::per_char_planes(&r.with_reads(ctx), layer, r.opts.scale)
             .into_iter()
-            .filter_map(|(buf, m)| prepare_with(r, ctx, layer, order, out, in_run, r.to_blend(Arc::new(buf), None), m))
+            .filter_map(|(buf, m)| {
+                prepare_with(r, ctx, layer, order, out, in_run, PlaneInput { buf: r.to_blend(Arc::new(buf), None, &Arc::default()), local: m })
+            })
             .collect();
     }
     prepare(r, ctx, layer, order, out, in_run).into_iter().collect()
 }
 
-/// Prepare a plane showing `buf`, whose space maps into the layer through `local`.
-#[allow(clippy::too_many_arguments)]
-fn prepare_with<'a>(
-    r: &Renderer,
-    ctx: &EvalCtx<'a>,
-    layer: &'a Layer,
-    order: usize,
-    out: (u32, u32),
-    in_run: bool,
-    mut buf: Arc<Buf>,
+/// A processed plane and its mapping into the layer's coordinate system.
+struct PlaneInput {
+    buf: Arc<Buf>,
     local: Mat4,
-) -> Option<Item<'a>> {
+}
+
+/// Prepare the plane's geometry, motion samples and material.
+fn prepare_with<'a>(r: &Renderer, ctx: &EvalCtx<'_>, layer: &'a Layer, order: usize, out: (u32, u32), in_run: bool, plane: PlaneInput) -> Option<Item<'a>> {
+    let PlaneInput { mut buf, local } = plane;
     if buf.img.is_empty() {
         return None;
     }
@@ -336,12 +335,45 @@ fn prepare_with<'a>(
 }
 
 /// Blur radius (buffer pixels) of every buffer pixel of a plane at `world` (layer → world), from
-/// its camera depth: the circle of confusion over the on-screen size of one layer pixel there.
-fn dof_radii(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, buf: &Buf) -> Vec<f32> {
-    dof_radii_at(cam, dof, world, (buf.img.width as usize, buf.img.height as usize), buf.offset, buf.scale)
+/// its camera depth: the circle of confusion over the on-screen size of one layer pixel there, at
+/// most `cap` ([`dof_radius_cap`]).
+fn dof_radii(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, buf: &Buf, cap: f64) -> Vec<f32> {
+    dof_radii_at(cam, dof, world, (buf.img.width as usize, buf.img.height as usize), buf.offset, buf.scale, cap)
 }
 
-fn dof_radii_at(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, (w, h): (usize, usize), offset: [f64; 2], scale: f64) -> Vec<f32> {
+/// Pixels a padded blur buffer may have: the ~16 million layer buffers are held to
+/// ([`crate::Renderer::raster_scale`]), or twice the buffer when that is larger, so a big buffer
+/// can still be blurred. The blur holds a few images of this size at once whatever its level
+/// count ([`super::bokeh::progressive_blur`]), so blurring a small plane costs no more memory than
+/// blurring a large layer.
+const DOF_PAD_BUDGET: f64 = 16.0e6;
+
+/// Comp pixels per buffer pixel below which a plane isn't blurred. Such a plane covers almost no
+/// screen area (a 0%-scaled layer, one at an extreme distance), while its radius in buffer
+/// pixels grows without bound as it shrinks: blurring it would cost the most for the least.
+const DOF_MIN_SCREEN_SCALE: f64 = 1e-3;
+
+/// The largest blur radius (buffer pixels) of a `w`×`h` buffer: the one whose padded copy just
+/// fits [`DOF_PAD_BUDGET`]. The circle of confusion has no bound of its own (a focus distance far
+/// beyond the scene, a near-zero layer scale), so memory sets the limit; ordinary bokeh stays far
+/// below it and is never clamped.
+pub(super) fn dof_radius_cap(dof: &super::camera::Dof, w: u32, h: u32) -> f64 {
+    let (w, h) = (w as f64, h as f64);
+    let budget = DOF_PAD_BUDGET.max(2.0 * w * h);
+    // (w + 2p)·(h + 2p) = budget, solved for the padding p.
+    let pad = (((w - h) * (w - h) + 4.0 * budget).sqrt() - (w + h)) / 4.0;
+    ((pad - 2.0) / iris_stretch(dof)).max(0.0)
+}
+
+pub(super) fn dof_radii_at(
+    cam: &CameraState,
+    dof: &super::camera::Dof,
+    world: Mat4,
+    (w, h): (usize, usize),
+    offset: [f64; 2],
+    scale: f64,
+    cap: f64,
+) -> Vec<f32> {
     let s = scale.max(1e-9);
     let sx = world.apply_vec(vec3(1.0, 0.0, 0.0)).length().max(1e-9);
     let at = |x: f64, y: f64| cam.depth(world.apply(vec3((x - offset[0]) / s, (y - offset[1]) / s, 0.0)));
@@ -355,31 +387,48 @@ fn dof_radii_at(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, (w, h)
             if z <= super::camera::NEAR {
                 continue;
             }
-            // coc · ½ / (zoom / z · sx) · scale
-            *o = (dof.coc(z) * 0.5 * z / (cam.zoom * sx) * s) as f32;
+            // coc · ½ / (zoom / z · sx) · scale. Infinity clamps to the cap like any large radius,
+            // so the blur keeps growing with defocus; only NaN, which has no defocus, stays sharp.
+            let r = dof.coc(z) * 0.5 * z / (cam.zoom * sx) * s;
+            *o = if r.is_nan() || cam.zoom * sx / (z * s) < DOF_MIN_SCREEN_SCALE { 0.0 } else { r.min(cap) as f32 };
         }
     });
     out
 }
 
+/// How much the iris' aspect ratio stretches a blur radius along its longer axis.
+fn iris_stretch(dof: &super::camera::Dof) -> f64 {
+    let a = dof.iris.aspect.clamp(0.01, 100.0).sqrt();
+    a.max(1.0 / a)
+}
+
 /// The padding [`dof_blur`] gives a buffer whose largest blur radius is `rmax`.
 fn dof_pad(dof: &super::camera::Dof, rmax: f64) -> u32 {
-    let a = dof.iris.aspect.clamp(0.01, 100.0).sqrt().max(1.0 / dof.iris.aspect.clamp(0.01, 100.0).sqrt());
-    (rmax * a).ceil() as u32 + 2
+    ((rmax * iris_stretch(dof)).ceil() as u32).saturating_add(2)
+}
+
+/// The size of `img` padded by `pad` on every side, or `None` past [`limits::MAX_SIZE`] on a side:
+/// [`DOF_PAD_BUDGET`] bounds the area, so a long thin buffer could still outgrow a side.
+fn padded_size(img: &Image, pad: u32) -> Option<(u32, u32)> {
+    let grow = |n: u32| n.saturating_add(pad.saturating_mul(2));
+    let (w, h) = (grow(img.width), grow(img.height));
+    (w <= limits::MAX_SIZE && h <= limits::MAX_SIZE).then_some((w, h))
 }
 
 /// [`dof_blur`] planned for an accelerator: the padding, radius map and levels, and the padded
 /// buffer's layer-space bounds. `None` when nothing blurs.
 fn dof_plan(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, buf: &Buf) -> Option<(PlaneDof, [f64; 4])> {
-    let radii = dof_radii(cam, dof, world, buf);
+    let cap = dof_radius_cap(dof, buf.img.width, buf.img.height);
+    let radii = dof_radii(cam, dof, world, buf, cap);
     let rmax = radii.iter().copied().fold(0.0f32, f32::max) as f64;
     if rmax <= 0.3 {
         return None;
     }
     let pad = dof_pad(dof, rmax);
-    let (w, h) = (buf.img.width as usize + 2 * pad as usize, buf.img.height as usize + 2 * pad as usize);
+    let (wp, hp) = padded_size(&buf.img, pad)?;
+    let (w, h) = (wp as usize, hp as usize);
     let offset = [buf.offset[0] + pad as f64, buf.offset[1] + pad as f64];
-    let radius = dof_radii_at(cam, dof, world, (w, h), offset, buf.scale);
+    let radius = dof_radii_at(cam, dof, world, (w, h), offset, buf.scale, cap);
     let levels = super::bokeh::blur_levels(&radius)?;
     let s = buf.scale.max(1e-9);
     let bounds = [-offset[0] / s, -offset[1] / s, (w as f64 - offset[0]) / s, (h as f64 - offset[1]) / s];
@@ -388,16 +437,20 @@ fn dof_plan(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, buf: &Buf)
 
 /// Depth of field for one plane: highlights boosted, then a bokeh-shaped blur by depth.
 fn dof_blur(cam: &CameraState, dof: &super::camera::Dof, world: Mat4, buf: Arc<Buf>) -> Arc<Buf> {
-    let radii = dof_radii(cam, dof, world, &buf);
+    let cap = dof_radius_cap(dof, buf.img.width, buf.img.height);
+    let radii = dof_radii(cam, dof, world, &buf, cap);
     let rmax = radii.iter().copied().fold(0.0f32, f32::max) as f64;
     if rmax <= 0.3 {
         return buf;
     }
     let pad = dof_pad(dof, rmax);
+    if padded_size(&buf.img, pad).is_none() {
+        return buf;
+    }
     let mut padded = buf.img.padded(pad);
     super::bokeh::boost_highlights(&mut padded, &dof.highlight);
     let pbuf = Buf { img: padded, offset: [buf.offset[0] + pad as f64, buf.offset[1] + pad as f64], scale: buf.scale };
-    let pr = dof_radii(cam, dof, world, &pbuf);
+    let pr = dof_radii(cam, dof, world, &pbuf, cap);
     // The (cached, shared) layer buffer stays untouched; the blurred copy is per frame.
     Arc::new(Buf { img: super::bokeh::progressive_blur(&pbuf.img, &dof.iris, &pr), offset: pbuf.offset, scale: pbuf.scale })
 }
@@ -498,8 +551,8 @@ fn gather<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, run: &[&'a Layer], out: (u32,
         .flat_map_iter(|(i, l)| {
             // Stack order with room for a collapsed precomp's layers in between.
             let i = i * 1024;
-            if let Some(item) = r.collapsed(ctx, l) {
-                return collapsed_items(r, ctx, l, item, i, out);
+            if let Some(collapsed) = r.collapsed(ctx, l) {
+                return collapsed_items(r, ctx, l, &collapsed, i, out);
             }
             let mut its = prepare_all(r, ctx, l, i, out, true);
             if !its.is_empty() {
@@ -518,6 +571,7 @@ fn gather<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, run: &[&'a Layer], out: (u32,
         extra = ctx
             .comp
             .layers
+            .as_arcs()
             .par_iter()
             .filter(|l| l.switches.three_d && l.has_video() && l.is_active_at(ctx.time) && !in_run.contains(&l.id) && !l.switches.adjustment)
             .filter(|l| Material::of(ctx, l).casts_shadows != 0)
@@ -532,20 +586,13 @@ fn gather<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, run: &[&'a Layer], out: (u32,
 /// 3D space (world = precomp layer's world × nested world), depth-sorted with the run, so they
 /// intersect the parent's 3D layers; nested 2D layers lie on the precomp layer's plane in stack
 /// order. (Nested adjustment layers are skipped here.)
-fn collapsed_items<'a>(
-    r: &Renderer<'a>,
-    ctx: &EvalCtx<'a>,
-    layer: &'a Layer,
-    item: effectcraft_project::ItemId,
-    order: usize,
-    out: (u32, u32),
-) -> Vec<Item<'a>> {
+fn collapsed_items<'a>(r: &Renderer<'a>, ctx: &EvalCtx<'a>, layer: &'a Layer, collapsed: &crate::Collapsed, order: usize, out: (u32, u32)) -> Vec<Item<'a>> {
     let op = ctx.opacity(layer) as f32 * r.opacity_mul();
-    let Some((sub, nctx)) = r.collapse_into(ctx, layer, item, op) else { return vec![] };
+    let Some((sub, nctx)) = r.collapse_into(ctx, layer, collapsed, op) else { return vec![] };
     let t = nctx.time;
-    let any_solo = nctx.comp.layers.iter().any(|l| l.switches.solo && l.source.is_av());
-    let nested: Vec<&'a Layer> = nctx
-        .comp
+    let Some(nc) = r.project.comp(collapsed.item) else { return vec![] };
+    let any_solo = nc.any_solo();
+    let nested: Vec<&'a Layer> = nc
         .layers
         .iter()
         .rev()
@@ -694,6 +741,13 @@ fn shade_texel(it: &Item, g: &Geo, u: f64, v: f64, t: Px, lights: &[LightState],
     [lit[0] * a, lit[1] * a, lit[2] * a, a]
 }
 
+/// Samples per side of the Shadow Diffusion kernel for a penumbra radius of `r_px` caster pixels:
+/// odd, at least 3, and enough that neighbouring samples are at most 1.5 pixels apart, up to 15.
+pub(crate) fn shadow_taps(r_px: f64) -> u32 {
+    let n = ((2.0 * r_px / 1.5).ceil() as u32).clamp(3, 15);
+    n | 1
+}
+
 /// RGB transmittance of light `l` reaching `p` past caster `c` (1 = unoccluded).
 fn occlusion(c: &Item, p: Vec3, l: &LightState) -> [f32; 3] {
     const FAR: f64 = 1.0e6;
@@ -721,11 +775,17 @@ fn occlusion(c: &Item, p: Vec3, l: &LightState) -> [f32; 3] {
     if r * c.buf.scale < 0.5 {
         px = c.texel(hit.x, hit.y);
     } else {
-        for j in -1..=1 {
-            for i in -1..=1 {
-                let q = c.texel(hit.x + i as f64 * r * 0.66, hit.y + j as f64 * r * 0.66);
+        // Box filter over the penumbra square: n × n cell centres, dense enough that a wide
+        // diffusion blurs the caster instead of stamping copies of it (#2444).
+        let n = shadow_taps(r * c.buf.scale);
+        let step = 2.0 * r / n as f64;
+        let h = (n / 2) as i32;
+        let w = 1.0 / (n * n) as f32;
+        for j in -h..=h {
+            for i in -h..=h {
+                let q = c.texel(hit.x + f64::from(i) * step, hit.y + f64::from(j) * step);
                 for k in 0..4 {
-                    px[k] += q[k] / 9.0;
+                    px[k] += q[k] * w;
                 }
             }
         }
@@ -749,7 +809,7 @@ fn occlusion(c: &Item, p: Vec3, l: &LightState) -> [f32; 3] {
 
 /// A Classic 3D run prepared for an accelerator ([`Renderer::prepare_3d_run`]): every plane
 /// with its geometry, material and buffer, ready for the per-pixel depth sort, lighting and
-/// ray-cast shadows of [`draw_run`] on another device.
+/// ray-cast shadows of `draw_run` on another device.
 #[derive(Clone, Debug)]
 pub struct Run3d {
     /// Drawn planes in stack order, then shadow casters from outside the run (`draw` false).
@@ -899,7 +959,7 @@ pub(crate) fn aux_pass(r: &Renderer, ctx: &EvalCtx) -> effectcraft_raster::AuxCh
                     if nv[2] > 0.0 {
                         nv = nv.map(|v| -v);
                     }
-                    let (sw, sh) = crate::source_size(r.project, it.layer);
+                    let (sw, sh) = ctx.source_size(it.layer);
                     let size = if sw == 0 { [ctx.comp.width as f64, ctx.comp.height as f64] } else { [sw as f64, sh as f64] };
                     (number(it.layer), source_id(it.layer), crypto_hash(&it.layer.name), crypto_hash(&source_name(it.layer)), nv, size)
                 })
@@ -1017,7 +1077,7 @@ pub(crate) fn environment_rotation(ctx: &EvalCtx) -> f32 {
         .to_radians() as f32
 }
 
-/// An Environment Light Background layer ready to draw (see [`draw_sky`]): the layer's
+/// An Environment Light Background layer ready to draw (see `draw_sky`): the layer's
 /// buffer in the blending space, its opacity and the camera's view rays. Also handed to an
 /// accelerator's compositor (`Renderer::sky_draw`).
 #[derive(Clone)]
diff --git a/crates/render/src/three_d/tests.rs b/crates/render/src/three_d/tests.rs
index 9f1dbb344..026929623 100644
--- a/crates/render/src/three_d/tests.rs
+++ b/crates/render/src/three_d/tests.rs
@@ -13,10 +13,15 @@ const W: u32 = 200;
 const H: u32 = 100;
 
 fn setup() -> (Project, ItemId, Comp) {
+    setup_sized(W, H)
+}
+
+/// [`setup`] with a `w`×`h` comp.
+fn setup_sized(w: u32, h: u32) -> (Project, ItemId, Comp) {
     let mut p = Project::default();
     // Exact float maths; 8/16 bpc quantisation has its own tests (tests_color).
     p.settings.bit_depth = effectcraft_project::BitDepth::Bpc32;
-    let comp = Comp::new(W, H, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
+    let comp = Comp::new(w, h, FrameRate::FPS_30, Tick::from_seconds_f64(2.0));
     let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
     (p, cid, comp)
 }
@@ -344,10 +349,37 @@ fn shadow_darkness_and_accepts_off() {
     assert!(close(v, 0.5, 1e-3), "no shadow accepted: {v}");
 }
 
+#[test]
+fn shadow_diffusion_is_a_soft_ramp_not_copies() {
+    // #2444: a wide Shadow Diffusion stamped 3 × 3 copies of the caster, so the penumbra stepped
+    // through three flat levels instead of ramping smoothly from lit to shadowed.
+    let (mut p, cid, comp) = setup();
+    let mut recv = solid3(&mut p, &comp, [1.0, 1.0, 1.0], 400, 200, [100.0, 50.0, 100.0]);
+    no_specular(&mut recv);
+    let mut caster = solid3(&mut p, &comp, [1.0, 1.0, 1.0], 100, 200, [40.0, 50.0, 0.0]);
+    set(&mut caster, "materialOptions/castsShadows", Value::Enum(2)); // Only: invisible caster
+    let mut l = light(&mut p, &comp, LightKind::Parallel, [100.0, 50.0, -500.0]);
+    set(&mut l, "transform/poi", Value::Vec3([100.0, 50.0, 0.0]));
+    set(&mut l, "lightOptions/castsShadows", Value::Bool(true));
+    // 100 px to the caster over the parallel light's 1000: a 15 px penumbra radius.
+    set(&mut l, "lightOptions/shadowDiffusion", Value::Scalar(150.0));
+    push(&mut p, cid, l);
+    push(&mut p, cid, caster);
+    push(&mut p, cid, recv);
+    let img = render(&p, cid);
+    let row: Vec<f32> = (0..i64::from(W)).map(|x| img.get(x, 50)[0]).collect();
+    // The row crosses both vertical edges of the caster's shadow: lit, ramp, shadowed, ramp, lit.
+    assert!(row.iter().any(|v| *v < 0.01) && close(row[W as usize - 1], 0.5, 1e-3), "shadow and light: {row:?}");
+    let ramp = row.iter().filter(|v| **v > 0.02 && **v < 0.48).count();
+    assert!(ramp >= 16, "two penumbras several pixels wide: {row:?}");
+    let step = row.windows(2).map(|w| (w[1] - w[0]).abs()).fold(0.0f32, f32::max);
+    assert!(step < 0.08, "no jumps between copies of the caster (largest step {step}): {row:?}");
+}
+
 // ---------------------------------------------------------------- cameras
 
 fn camera(p: &mut Project, comp: &Comp) -> Layer {
-    build::layer(p, comp, "Camera", LayerSource::Camera, (W, H), None)
+    build::layer(p, comp, "Camera", LayerSource::Camera, (comp.width, comp.height), None)
 }
 
 #[test]
@@ -423,9 +455,155 @@ fn depth_of_field_blurs_out_of_focus_layers() {
     assert!(b.get(66, 50)[3] > 0.01);
 }
 
+/// A non-finite Focus Distance doesn't reach the blur: the camera focuses on the property's
+/// default plane (`zoom`) instead.
+#[test]
+fn dof_falls_back_when_focus_distance_is_not_finite() {
+    for bad in [f64::NAN, f64::INFINITY, f64::NEG_INFINITY] {
+        let (mut p, cid, comp) = setup();
+        let mut cam = camera(&mut p, &comp);
+        set(&mut cam, "cameraOptions/dof", Value::Bool(true));
+        set(&mut cam, "cameraOptions/aperture", Value::Scalar(60.0));
+        set(&mut cam, "cameraOptions/focusDistance", Value::Scalar(bad));
+        let s = solid3(&mut p, &comp, [1.0, 1.0, 1.0], 60, 60, [100.0, 50.0, 0.0]);
+        push(&mut p, cid, cam);
+        push(&mut p, cid, s);
+        let cp = p.comp(cid).unwrap();
+        let ctx = crate::EvalCtx::new(&p, cid, cp, Tick::ZERO);
+        let cs = crate::three_d::camera::layer_camera(&ctx, &cp.layers[0]);
+        let f = cs.dof.unwrap().focus;
+        assert!((f - zoom()).abs() < 1e-9, "{bad}: evaluated to {f}, expected the fallback to zoom {}", zoom());
+        // The z = 0 plane is in focus: hard edge, finite pixels.
+        let img = render(&p, cid);
+        assert!(img.get(71, 50)[3] > 0.99 && img.get(69, 50)[3] < 0.01, "{bad}: the edge should be hard");
+        assert!(img.data.iter().all(|px| px.iter().all(|c| c.is_finite())), "{bad}: non-finite pixels");
+    }
+}
+
+/// The Classic 3D blur stays bounded for degenerate inputs: a 0%-scaled 3D layer off the focal
+/// plane (e.g. the first frame of a scale-in) or a huge but finite Focus Distance asks for a
+/// radius of billions of buffer pixels, whose padded buffer can't be allocated.
+#[test]
+fn dof_blur_radius_is_bounded_for_degenerate_inputs() {
+    let scene = |focus: f64, scale: f64| {
+        let (mut p, cid, comp) = setup();
+        let mut cam = camera(&mut p, &comp);
+        set(&mut cam, "cameraOptions/dof", Value::Bool(true));
+        set(&mut cam, "cameraOptions/aperture", Value::Scalar(60.0));
+        set(&mut cam, "cameraOptions/focusDistance", Value::Scalar(focus));
+        let mut s = solid3(&mut p, &comp, [1.0, 1.0, 1.0], 60, 60, [100.0, 50.0, 0.0]);
+        set(&mut s, "transform/scale", Value::Vec3([scale, scale, 100.0]));
+        push(&mut p, cid, cam);
+        push(&mut p, cid, s);
+        render(&p, cid)
+    };
+    let finite = |img: &effectcraft_raster::Image| img.data.iter().all(|px| px.iter().all(|c| c.is_finite()));
+    // A 0%-scaled layer 10 px off the focal plane: an ordinary defocus times 1/sx (sx = 1e-9).
+    assert!(finite(&scene(zoom() + 10.0, 0.0)), "zero-scaled: non-finite pixels");
+    // Huge but finite Focus Distances (typed in, or a large expression result): the blur is as
+    // large as the buffer budget allows, never refused (which would render the layer sharp).
+    // 1e307 overflows the circle of confusion itself to infinity: still the largest blur.
+    for focus in [1.0e12, 1.0e307] {
+        let img = scene(focus, 100.0);
+        assert!(finite(&img), "focus {focus:e}: non-finite pixels");
+        assert!(img.get(100, 50)[3] < 0.5, "focus {focus:e}: the layer should be spread out, not sharp ({})", img.get(100, 50)[3]);
+    }
+}
+
+/// The blur radius map of a plane: a 0%-scaled plane is degenerate on screen and isn't blurred;
+/// any other radius stays within the buffer budget's cap.
+#[test]
+fn dof_radii_skip_degenerate_planes_and_respect_the_cap() {
+    let radii = |focus: f64, scale: f64| {
+        let (mut p, cid, comp) = setup();
+        let mut cam = camera(&mut p, &comp);
+        set(&mut cam, "cameraOptions/dof", Value::Bool(true));
+        set(&mut cam, "cameraOptions/aperture", Value::Scalar(60.0));
+        set(&mut cam, "cameraOptions/focusDistance", Value::Scalar(focus));
+        let mut s = solid3(&mut p, &comp, [1.0, 1.0, 1.0], 60, 60, [100.0, 50.0, 0.0]);
+        set(&mut s, "transform/scale", Value::Vec3([scale, scale, 100.0]));
+        push(&mut p, cid, cam);
+        push(&mut p, cid, s);
+        let cp = p.comp(cid).unwrap();
+        let ctx = crate::EvalCtx::new(&p, cid, cp, Tick::ZERO);
+        let cs = super::camera::layer_camera(&ctx, &cp.layers[0]);
+        let dof = cs.dof.unwrap();
+        let cap = super::compose::dof_radius_cap(&dof, 60, 60);
+        (super::compose::dof_radii_at(&cs, &dof, ctx.world_matrix(&cp.layers[1]), (60, 60), [0.0; 2], 1.0, cap), cap)
+    };
+    let (r, _) = radii(zoom() + 10.0, 0.0);
+    assert!(r.iter().all(|&r| r == 0.0), "a 0%-scaled plane is not blurred");
+    let (r, cap) = radii(1.0e12, 100.0);
+    assert!(cap > 1000.0, "a 60×60 buffer may blur by well over 1000 px: {cap}");
+    assert!(r.iter().all(|&r| r as f64 <= cap && r as f64 > cap - 1.0), "huge focus: every radius at the cap {cap}");
+}
+
+/// Two layers that look the same on screen (400×100 at 100%, 1600×400 at 25%) at the same depth
+/// blur by the same amount on screen: the radius bound must not depend on the layer's scale.
+#[test]
+fn dof_blur_is_independent_of_layer_scale() {
+    let ramp = |w: u32, h: u32, scale: f64| {
+        let (mut p, cid, comp) = setup_sized(800, 400);
+        let zoom = 800.0 * 50.0 / 36.0;
+        let mut cam = camera(&mut p, &comp);
+        set(&mut cam, "cameraOptions/dof", Value::Bool(true));
+        set(&mut cam, "cameraOptions/aperture", Value::Scalar(200.0));
+        // coc = aperture·|z − f| / z: a 40 px comp radius on the z = 0 plane (depth = zoom).
+        set(&mut cam, "cameraOptions/focusDistance", Value::Scalar(zoom + 2.0 * 40.0 * zoom / 200.0));
+        let mut s = solid3(&mut p, &comp, [1.0, 1.0, 1.0], w, h, [400.0, 200.0, 0.0]);
+        set(&mut s, "transform/scale", Value::Vec3([scale, scale, 100.0]));
+        push(&mut p, cid, cam);
+        push(&mut p, cid, s);
+        let img = render(&p, cid);
+        soft_count(&img, (0..400).map(|x| (x, 200)))
+    };
+    let (full, quarter) = (ramp(400, 100, 100.0), ramp(1600, 400, 25.0));
+    assert!(full > 60, "the out-of-focus edge should be soft: {full}");
+    assert!(full.abs_diff(quarter) <= 2, "same on-screen layer, same depth: {full} px at 100% vs {quarter} px at 25%");
+}
+
+/// The same frame at Full and Half resolution shows the same blur (in comp pixels). The radius
+/// (~100 px) is large so that any bound that depends on the resolution would show.
+#[test]
+fn dof_blur_matches_across_render_resolutions() {
+    let (mut p, cid, comp) = setup_sized(800, 400);
+    let zoom = 800.0 * 50.0 / 36.0;
+    let mut cam = camera(&mut p, &comp);
+    set(&mut cam, "cameraOptions/dof", Value::Bool(true));
+    set(&mut cam, "cameraOptions/aperture", Value::Scalar(200.0));
+    set(&mut cam, "cameraOptions/focusDistance", Value::Scalar(2.0 * zoom));
+    let s = solid3(&mut p, &comp, [1.0, 1.0, 1.0], 400, 100, [400.0, 200.0, 0.0]);
+    push(&mut p, cid, cam);
+    push(&mut p, cid, s);
+    let ramp = |scale: f64| {
+        let img = render_frame(&p, cid, Tick::ZERO, scale);
+        let (w, h) = (img.width as i64, img.height as i64);
+        soft_count(&img, (0..w / 2).map(|x| (x, h / 2))) as f64 / scale
+    };
+    let (full, half) = (ramp(1.0), ramp(0.5));
+    assert!(full > 150.0, "a ~100 px radius must not be clamped: {full} comp px");
+    assert!((full - half).abs() <= 4.0, "Full {full} vs Half {half} comp px");
+}
+
+/// `Dof::coc` treats a non-finite focus or depth as in focus.
+#[test]
+fn dof_coc_is_zero_for_non_finite_inputs() {
+    let d = |focus: f64| super::camera::Dof { focus, aperture: 50.0, blur_level: 1.0, iris: Default::default(), highlight: Default::default() };
+    for bad in [f64::NAN, f64::INFINITY, f64::NEG_INFINITY] {
+        assert_eq!(d(bad).coc(500.0), 0.0, "focus {bad}");
+        assert_eq!(d(400.0).coc(bad), 0.0, "depth {bad}");
+    }
+    assert!(d(400.0).coc(500.0) > 0.0);
+}
+
+/// Pixels among `pts` whose alpha is strictly between 0.05 and 0.95.
+fn soft_count(img: &effectcraft_raster::Image, pts: impl Iterator<Item = (i64, i64)>) -> usize {
+    pts.filter(|&(x, y)| (0.05..0.95).contains(&img.get(x, y)[3])).count()
+}
+
 /// Pixels in column `x` whose alpha is strictly between 0.05 and 0.95.
 fn soft_px(img: &effectcraft_raster::Image, x: i64) -> usize {
-    (0..img.height as i64).filter(|&y| (0.05..0.95).contains(&img.get(x, y)[3])).count()
+    soft_count(img, (0..img.height as i64).map(|y| (x, y)))
 }
 
 #[test]
diff --git a/crates/render/src/three_d/tests_orient.rs b/crates/render/src/three_d/tests_orient.rs
index 06f2599dc..bbecc7fc0 100644
--- a/crates/render/src/three_d/tests_orient.rs
+++ b/crates/render/src/three_d/tests_orient.rs
@@ -8,6 +8,7 @@ use effectcraft_project::{AutoOrient, Comp, ItemId, ItemKind, Layer, LayerSource
 use effectcraft_time::{FrameRate, Tick};
 
 use super::active_camera;
+use super::camera::auto_orient_2d;
 use crate::EvalCtx;
 
 fn setup() -> (Project, ItemId, Comp) {
@@ -78,6 +79,69 @@ fn orient_along_path_keeps_the_last_heading_at_and_after_the_end() {
     }
 }
 
+/// #1650: the same end-of-path flip when Position has no keyframes of its own and is driven by
+/// an expression (e.g. `pointOnPath()` fed by a keyframed slider on another layer): once the
+/// motion stops there are no Position keys to fall back on, and the heading snapped to 0 degrees.
+#[test]
+fn orient_along_path_keeps_the_last_heading_when_position_is_an_expression() {
+    /// Stand-in for an expression: holds, moves 100 px left over 0.5..1 s, then holds again (like
+    /// a slider going from 0% to 100%).
+    struct LeftThenHold;
+    impl crate::ExprHost for LeftThenHold {
+        fn eval(&self, ctx: &EvalCtx, _: &Layer, prop: &effectcraft_project::Property, value: &Value) -> Result<Value, String> {
+            if prop.match_id != "position" {
+                return Ok(value.clone());
+            }
+            let s = ((ctx.time.seconds() - 0.5) * 2.0).clamp(0.0, 1.0);
+            Ok(Value::Vec3([150.0 - 100.0 * s, 50.0, 0.0]))
+        }
+    }
+    for three_d in [false, true] {
+        let (mut p, cid, comp) = setup();
+        let mut l = solid(&mut p, &comp, three_d, [150.0, 50.0, 0.0]);
+        l.auto_orient = AutoOrient::AlongPath;
+        let pos = l.props.prop_mut("transform/position").unwrap();
+        assert!(pos.keys.is_empty(), "the fixture must have no Position keyframes");
+        pos.expr = Some(effectcraft_project::Expression { text: "left then hold".into(), enabled: true });
+        p.comp_mut(cid).unwrap().layers.push(l);
+        let c = p.comp(cid).unwrap();
+        for secs in [0.2, 0.75, 1.0, 1.0 + 1.0 / 30.0, 1.2, 1.9] {
+            let ctx = EvalCtx { expr: Some(&LeftThenHold), ..EvalCtx::new(&p, cid, c, Tick::from_seconds_f64(secs)) };
+            let x_axis = ctx.world_matrix(&c.layers[0]).apply_vec(vec3(1.0, 0.0, 0.0));
+            // Moving left (-x): the layer's x axis points left before the motion starts and after it stops.
+            assert!((x_axis.x + 1.0).abs() < 1e-6 && x_axis.y.abs() < 1e-6 && x_axis.z.abs() < 1e-6, "3d={three_d} t={secs}: {x_axis:?}");
+        }
+    }
+}
+
+/// #1650 on a curved path: the heading kept once an expression stops moving is the one at the end
+/// of the motion, the same on every later frame, not whatever earlier point a coarse search lands on.
+#[test]
+fn orient_along_a_curved_expression_path_keeps_the_end_heading() {
+    /// Quarter circle over 0..1 s: heading 0 degrees at the start, 90 degrees (down) at the end.
+    struct Arc;
+    impl crate::ExprHost for Arc {
+        fn eval(&self, ctx: &EvalCtx, _: &Layer, prop: &effectcraft_project::Property, value: &Value) -> Result<Value, String> {
+            if prop.match_id != "position" {
+                return Ok(value.clone());
+            }
+            let a = ctx.time.seconds().clamp(0.0, 1.0) * std::f64::consts::FRAC_PI_2;
+            Ok(Value::Vec3([100.0 * a.sin(), 100.0 - 100.0 * a.cos(), 0.0]))
+        }
+    }
+    let (mut p, cid, comp) = setup();
+    let mut l = solid(&mut p, &comp, false, [0.0, 0.0, 0.0]);
+    l.auto_orient = AutoOrient::AlongPath;
+    l.props.prop_mut("transform/position").unwrap().expr = Some(effectcraft_project::Expression { text: "arc".into(), enabled: true });
+    p.comp_mut(cid).unwrap().layers.push(l);
+    let c = p.comp(cid).unwrap();
+    for frame in [31, 33, 37, 45, 59] {
+        let ctx = EvalCtx { expr: Some(&Arc), ..EvalCtx::new(&p, cid, c, Tick::from_seconds_f64(frame as f64 / 30.0)) };
+        let deg = auto_orient_2d(&ctx, &c.layers[0]);
+        assert!((deg - 90.0).abs() < 0.5, "frame {frame}: {deg}");
+    }
+}
+
 #[test]
 fn layers_parented_to_a_camera_follow_its_rotation() {
     let (mut p, cid, comp) = setup();
@@ -151,3 +215,264 @@ fn layer_cache_is_independent_of_camera_lights_and_view() {
     assert_ne!(third, second);
     assert!(cache.stats().hits > 0, "the cache was actually used");
 }
+
+/// A 1920 × 1080 comp with a full-frame 3D solid whose transform `set` changes (and an optional
+/// one-node camera at the default camera's place), as the After Effects reference cases.
+fn ae_frame(set: impl Fn(&mut Layer), camera: Option<([f64; 3], [f64; 3])>) -> (Project, ItemId) {
+    let mut p = Project::default();
+    let comp = Comp::new(1920, 1080, FrameRate::FPS_25, Tick::from_seconds_f64(5.0));
+    let cid = p.add_item("C", Label::Sandstone, None, ItemKind::Comp(comp.clone().into()));
+    let sid = p.add_item("L", Label::Red, None, ItemKind::Solid(Solid { color: [1.0, 0.0, 0.0], width: 1920, height: 1080, pixel_aspect: 1.0 }));
+    let mut l = build::layer(&mut p, &comp, "L", LayerSource::Solid { item: sid }, (1920, 1080), None);
+    l.switches.three_d = true;
+    set(&mut l);
+    let mut layers = vec![];
+    if let Some((orientation, rotation)) = camera {
+        let mut cam = build::layer(&mut p, &comp, "K", LayerSource::Camera, (1920, 1080), None);
+        cam.auto_orient = AutoOrient::Off;
+        cam.props.prop_mut("transform/position").unwrap().value = Value::Vec3([960.0, 540.0, -1920.0 * 50.0 / 36.0]);
+        cam.props.prop_mut("transform/orientation").unwrap().value = Value::Vec3(orientation);
+        for (m, v) in [("transform/rotationX", rotation[0]), ("transform/rotationY", rotation[1]), ("transform/rotation", rotation[2])] {
+            cam.props.prop_mut(m).unwrap().value = Value::Scalar(v);
+        }
+        cam.props.prop_mut("cameraOptions/zoom").unwrap().value = Value::Scalar(1920.0 * 50.0 / 36.0);
+        layers.push(cam);
+    }
+    layers.push(l);
+    p.comp_mut(cid).unwrap().layers = layers.into();
+    (p, cid)
+}
+
+/// Whether comp pixel (x, y) shows the solid, from its layer → comp mapping.
+fn covers(p: &Project, cid: ItemId, secs: f64, x: u32, y: u32) -> bool {
+    let c = p.comp(cid).unwrap();
+    let ctx = EvalCtx::new(p, cid, c, Tick::from_seconds_f64(secs));
+    let l = c.layers.last().unwrap();
+    let inv = ctx.layer_to_comp(l).0.inverse().unwrap();
+    let u = inv.apply(effectcraft_geom::vec2(x as f64 + 0.5, y as f64 + 0.5));
+    (0.0..=1920.0).contains(&u.x) && (0.0..=1080.0).contains(&u.y)
+}
+
+fn check_points(p: &Project, cid: ItemId, secs: f64, case: &str, pts: &[(u32, u32, bool)]) {
+    for &(x, y, red) in pts {
+        assert_eq!(covers(p, cid, secs, x, y), red, "case {case}: pixel ({x}, {y}) should be {}", if red { "red" } else { "black" });
+    }
+}
+
+fn set3(l: &mut Layer, m: &str, v: [f64; 3]) {
+    l.props.prop_mut(m).unwrap().value = Value::Vec3(v);
+}
+
+fn set1(l: &mut Layer, m: &str, v: f64) {
+    l.props.prop_mut(m).unwrap().value = Value::Scalar(v);
+}
+
+/// Orientation and X/Y/Z Rotation compose as `Rx · Ry · Rz` (Z turns the layer first), and
+/// Orientation comes before the axis rotations, in layers and cameras alike. The points are
+/// sampled from After Effects 2026 renders of the synthetic cases (each at least 3 px from an
+/// edge; red = the solid covers the pixel), a third of them where the old Z · Y · X order differed.
+#[test]
+fn rotation_order_matches_after_effects() {
+    // 488: Orientation [10, 20, 30].
+    let (p, cid) = ae_frame(|l| set3(l, "transform/orientation", [10.0, 20.0, 30.0]), None);
+    check_points(
+        &p,
+        cid,
+        1.0,
+        "488",
+        &[
+            (328, 687, false),
+            (416, 764, false),
+            (209, 237, true),
+            (548, 861, false),
+            (1899, 425, false),
+            (87, 462, true),
+            (162, 581, false),
+            (662, 948, false),
+            (682, 849, true),
+            (618, 413, true),
+            (1380, 181, true),
+            (605, 378, true),
+            (1830, 518, true),
+            (559, 197, true),
+            (1760, 843, true),
+            (550, 823, true),
+            (572, 952, false),
+            (272, 963, false),
+            (268, 761, false),
+            (628, 1073, false),
+            (218, 721, false),
+            (256, 807, false),
+            (225, 881, false),
+            (167, 637, false),
+        ],
+    );
+    // 800: X / Y / Z Rotation 10 / 20 / 30.
+    let (p, cid) = ae_frame(
+        |l| {
+            set1(l, "transform/rotationX", 10.0);
+            set1(l, "transform/rotationY", 20.0);
+            set1(l, "transform/rotation", 30.0);
+        },
+        None,
+    );
+    check_points(
+        &p,
+        cid,
+        1.0,
+        "800",
+        &[
+            (104, 450, true),
+            (755, 1002, false),
+            (1407, 149, false),
+            (271, 66, true),
+            (288, 54, true),
+            (113, 393, true),
+            (204, 174, true),
+            (1790, 360, false),
+            (1414, 324, true),
+            (682, 343, true),
+            (1147, 153, true),
+            (345, 446, true),
+            (1516, 542, true),
+            (666, 25, true),
+            (1327, 1065, true),
+            (778, 267, true),
+            (1588, 5, false),
+            (1706, 147, false),
+            (357, 978, false),
+            (97, 689, false),
+            (1483, 79, false),
+            (433, 848, false),
+            (255, 802, false),
+            (636, 1057, false),
+        ],
+    );
+    // 801: Orientation [0, 30, 0] with X Rotation 40 (Orientation first).
+    let (p, cid) = ae_frame(
+        |l| {
+            set3(l, "transform/orientation", [0.0, 30.0, 0.0]);
+            set1(l, "transform/rotationX", 40.0);
+        },
+        None,
+    );
+    check_points(
+        &p,
+        cid,
+        1.0,
+        "801",
+        &[
+            (1356, 35, true),
+            (1762, 19, true),
+            (190, 227, true),
+            (108, 182, true),
+            (502, 832, true),
+            (1539, 203, true),
+            (722, 812, true),
+            (1872, 76, true),
+            (1166, 165, true),
+            (1640, 380, true),
+            (629, 619, true),
+            (1796, 574, true),
+            (1767, 311, true),
+            (1432, 421, true),
+            (1819, 425, true),
+            (283, 252, true),
+            (563, 1062, false),
+            (428, 963, false),
+            (77, 417, false),
+            (47, 833, false),
+            (995, 933, false),
+            (159, 839, false),
+            (827, 947, false),
+            (564, 908, false),
+        ],
+    );
+    // 804: a one-node camera with Orientation [4, 6, 30]; 805: the same as X / Y / Z Rotation.
+    for (case, cam) in [("804", ([4.0, 6.0, 30.0], [0.0; 3])), ("805", ([0.0; 3], [4.0, 6.0, 30.0]))] {
+        let (p, cid) = ae_frame(|_| {}, Some(cam));
+        check_points(
+            &p,
+            cid,
+            1.0,
+            case,
+            &[
+                (204, 410, false),
+                (1077, 38, false),
+                (60, 492, false),
+                (1732, 752, true),
+                (265, 475, false),
+                (1743, 821, true),
+                (1417, 1043, true),
+                (1559, 944, true),
+                (1280, 310, true),
+                (702, 984, true),
+                (1072, 893, true),
+                (370, 1042, true),
+                (1353, 570, true),
+                (1178, 136, true),
+                (1201, 289, true),
+                (1241, 605, true),
+                (75, 337, false),
+                (71, 138, false),
+                (352, 24, false),
+                (1764, 109, false),
+                (186, 338, false),
+                (1835, 668, false),
+                (211, 269, false),
+                (157, 143, false),
+            ],
+        );
+    }
+}
+
+/// Keyed Orientation turns along the shortest arc between the keys (case 802: [0, 0, 0] at 0 s
+/// to [60, 80, 40] at 2 s, linear; points from the After Effects render at 1 s, a third of them
+/// where blending each angle on its own differed).
+#[test]
+fn keyed_orientation_renders_as_after_effects() {
+    let (p, cid) = ae_frame(
+        |l| {
+            l.props.prop_mut("transform/orientation").unwrap().keys =
+                vec![Keyframe::new(Tick::ZERO, Value::Vec3([0.0; 3])), Keyframe::new(Tick::from_seconds_f64(2.0), Value::Vec3([60.0, 80.0, 40.0]))];
+        },
+        None,
+    );
+    check_points(
+        &p,
+        cid,
+        1.0,
+        "802",
+        &[
+            (1880, 472, false),
+            (1598, 191, false),
+            (248, 285, true),
+            (1157, 51, false),
+            (1628, 129, false),
+            (357, 37, true),
+            (1865, 891, true),
+            (1915, 946, true),
+            (1728, 1021, true),
+            (1178, 665, true),
+            (1303, 631, true),
+            (1339, 954, true),
+            (910, 891, true),
+            (1257, 1002, true),
+            (1349, 890, true),
+            (1388, 551, true),
+            (356, 500, false),
+            (490, 1058, false),
+            (524, 829, false),
+            (73, 29, false),
+            (393, 769, false),
+            (1867, 124, false),
+            (42, 733, false),
+            (648, 1007, false),
+        ],
+    );
+    // The value After Effects reads back half-way.
+    let c = p.comp(cid).unwrap();
+    let v = c.layers[0].props.prop("transform/orientation").unwrap().value_at(Tick::from_seconds_f64(1.0)).as_vec3();
+    let want = [30.6186, 35.7617, 28.4317];
+    assert!((0..3).all(|i| (v[i] - want[i]).abs() < 1e-3), "{v:?}");
+}
diff --git a/crates/sam2/Cargo.toml b/crates/sam2/Cargo.toml
new file mode 100644
index 000000000..e45cc8def
--- /dev/null
+++ b/crates/sam2/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "effectcraft-sam2"
+description = "SAM 2.1 (Hiera) video object tracker for the Roto Brush: a Rust port of the Hugging Face transformers implementation, native only, weights downloaded by the user"
+version.workspace = true
+edition.workspace = true
+license = "Apache-2.0"
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+effectcraft-segment = { workspace = true }
+rayon = { workspace = true }
+log = { workspace = true }
+
+# Native only (D1): candle is not built for wasm32, where this crate is empty.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+candle-core = "=0.9.2"
+candle-nn = "=0.9.2"
+# The optional GPU path (wgpu compute, any vendor); the CPU path stays the reference.
+wgpu = { workspace = true }
+pollster = { workspace = true }
+bytemuck = { workspace = true }
+half = "2.7"
diff --git a/crates/sam2/NOTICE b/crates/sam2/NOTICE
new file mode 100644
index 000000000..2dcb613fa
--- /dev/null
+++ b/crates/sam2/NOTICE
@@ -0,0 +1,11 @@
+EffectCraft SAM 2 (effectcraft-sam2)
+Copyright the EffectCraft contributors.
+
+This crate is a Rust port of the SAM 2 implementation in Hugging Face `transformers`
+(`models/sam2` and `models/sam2_video`), Copyright 2025 The HuggingFace Inc. team, which in turn
+implements "SAM 2: Segment Anything in Images and Videos" by Meta AI (facebookresearch/sam2).
+Both are licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0).
+
+Each ported source file states that it is a modified work (Apache-2.0 section 4(b)).
+Model weights are not part of this crate; they are downloaded by the user from the official
+`facebook/sam2.1-hiera-*` repositories (Apache-2.0).
diff --git a/crates/sam2/examples/gpu_matmul.rs b/crates/sam2/examples/gpu_matmul.rs
new file mode 100644
index 000000000..29d2bcee5
--- /dev/null
+++ b/crates/sam2/examples/gpu_matmul.rs
@@ -0,0 +1,164 @@
+//! A spike for the GPU path (plan phase 6): how fast is a plain tiled WGSL matrix multiply on this
+//! machine's GPU, against the candle CPU matmul the encoder uses today? Candle has no AMD/Vulkan
+//! backend; this measures what hand-written wgpu kernels could reach on the shapes SAM 2 needs.
+//!
+//! `cargo run --release -p effectcraft-sam2 --example gpu_matmul`
+
+use std::time::Instant;
+
+use candle_core::{Device, Tensor};
+use wgpu::util::DeviceExt;
+
+const SHADER: &str = r#"
+struct P { m: u32, n: u32, k: u32, pad: u32 }
+@group(0) @binding(0) var<storage, read> a: array<f32>;
+@group(0) @binding(1) var<storage, read> b: array<f32>;
+@group(0) @binding(2) var<storage, read_write> c: array<f32>;
+@group(0) @binding(3) var<uniform> p: P;
+var<workgroup> sa: array<f32, 1024>;
+var<workgroup> sb: array<f32, 1024>;
+@compute @workgroup_size(16, 16)
+fn main(@builtin(workgroup_id) wg: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let row0 = wg.y * 64u;
+    let col0 = wg.x * 64u;
+    let tid = li.y * 16u + li.x;
+    var acc: array<f32, 16>;
+    for (var i = 0u; i < 16u; i++) { acc[i] = 0.0; }
+    for (var kt = 0u; kt < p.k; kt += 16u) {
+        for (var i = 0u; i < 4u; i++) {
+            let idx = tid + i * 256u;
+            let r = idx / 16u;
+            let cc = idx % 16u;
+            let gr = row0 + r;
+            let gc = kt + cc;
+            var va = 0.0;
+            if (gr < p.m && gc < p.k) { va = a[gr * p.k + gc]; }
+            sa[idx] = va;
+            let r2 = idx / 64u;
+            let c2 = idx % 64u;
+            let gr2 = kt + r2;
+            let gc2 = col0 + c2;
+            var vb = 0.0;
+            if (gr2 < p.k && gc2 < p.n) { vb = b[gr2 * p.n + gc2]; }
+            sb[idx] = vb;
+        }
+        workgroupBarrier();
+        for (var kk = 0u; kk < 16u; kk++) {
+            var ar: array<f32, 4>;
+            var br: array<f32, 4>;
+            for (var i = 0u; i < 4u; i++) {
+                ar[i] = sa[(li.y * 4u + i) * 16u + kk];
+                br[i] = sb[kk * 64u + li.x * 4u + i];
+            }
+            for (var i = 0u; i < 4u; i++) {
+                for (var j = 0u; j < 4u; j++) { acc[i * 4u + j] += ar[i] * br[j]; }
+            }
+        }
+        workgroupBarrier();
+    }
+    for (var i = 0u; i < 4u; i++) {
+        for (var j = 0u; j < 4u; j++) {
+            let gr = row0 + li.y * 4u + i;
+            let gc = col0 + li.x * 4u + j;
+            if (gr < p.m && gc < p.n) { c[gr * p.n + gc] = acc[i * 4u + j]; }
+        }
+    }
+}
+"#;
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // wgpu's environment variables apply (`WGPU_BACKEND`, `WGPU_POWER_PREF`, ...), as for SAM 2's own instance
+    let instance = wgpu::Instance::new(wgpu::InstanceDescriptor::new_without_display_handle().with_env());
+    let power_preference = wgpu::PowerPreference::from_env().unwrap_or(wgpu::PowerPreference::HighPerformance);
+    let adapter = pollster::block_on(instance.request_adapter(&wgpu::RequestAdapterOptions { power_preference, ..Default::default() }))?;
+    println!("adapter: {:?}", adapter.get_info().name);
+    let (device, queue) = pollster::block_on(adapter.request_device(&wgpu::DeviceDescriptor { required_limits: adapter.limits(), ..Default::default() }))?;
+    let module = device.create_shader_module(wgpu::ShaderModuleDescriptor { label: None, source: wgpu::ShaderSource::Wgsl(SHADER.into()) });
+    let pipeline = device.create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
+        label: None,
+        layout: None,
+        module: &module,
+        entry_point: Some("main"),
+        compilation_options: Default::default(),
+        cache: None,
+    });
+    // (name, m, k, n): the matmul shapes of SAM 2's encoder and memory attention
+    let shapes = [
+        ("hiera block 0 qkv", 65536usize, 96usize, 288usize),
+        ("hiera block 0 mlp in", 65536, 96, 384),
+        ("hiera global attention q.kT (one head)", 4096, 96, 4096),
+        ("memory attention q.kT (full bank)", 4096, 256, 28736),
+    ];
+    for (name, m, k, n) in shapes {
+        let a = Tensor::randn(0f32, 1.0, (m, k), &Device::Cpu)?;
+        let b = Tensor::randn(0f32, 1.0, (k, n), &Device::Cpu)?;
+        let av = a.flatten_all()?.to_vec1::<f32>()?;
+        let bv = b.flatten_all()?.to_vec1::<f32>()?;
+        let ba = device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: None,
+            contents: bytemuck::cast_slice(&av),
+            usage: wgpu::BufferUsages::STORAGE,
+        });
+        let bb = device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: None,
+            contents: bytemuck::cast_slice(&bv),
+            usage: wgpu::BufferUsages::STORAGE,
+        });
+        let bc = device.create_buffer(&wgpu::BufferDescriptor {
+            label: None,
+            size: (m * n * 4) as u64,
+            usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_SRC,
+            mapped_at_creation: false,
+        });
+        let params = [m as u32, n as u32, k as u32, 0];
+        let bp = device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: None,
+            contents: bytemuck::cast_slice(&params),
+            usage: wgpu::BufferUsages::UNIFORM,
+        });
+        let bg = device.create_bind_group(&wgpu::BindGroupDescriptor {
+            label: None,
+            layout: &pipeline.get_bind_group_layout(0),
+            entries: &[
+                wgpu::BindGroupEntry { binding: 0, resource: ba.as_entire_binding() },
+                wgpu::BindGroupEntry { binding: 1, resource: bb.as_entire_binding() },
+                wgpu::BindGroupEntry { binding: 2, resource: bc.as_entire_binding() },
+                wgpu::BindGroupEntry { binding: 3, resource: bp.as_entire_binding() },
+            ],
+        });
+        let run = |reps: usize| {
+            let mut enc = device.create_command_encoder(&Default::default());
+            for _ in 0..reps {
+                let mut pass = enc.begin_compute_pass(&Default::default());
+                pass.set_pipeline(&pipeline);
+                pass.set_bind_group(0, &bg, &[]);
+                pass.dispatch_workgroups(n.div_ceil(64) as u32, m.div_ceil(64) as u32, 1);
+            }
+            queue.submit([enc.finish()]);
+            let _ = device.poll(wgpu::PollType::wait_indefinitely());
+        };
+        run(1);
+        let reps = 5;
+        let t = Instant::now();
+        run(reps);
+        let gpu = t.elapsed().as_secs_f64() / reps as f64;
+        let flops = 2.0 * m as f64 * k as f64 * n as f64;
+        // the CPU: candle's matmul, as the encoder uses it
+        let _ = a.matmul(&b)?;
+        let t = Instant::now();
+        let cpu_reps = 3;
+        for _ in 0..cpu_reps {
+            let _ = a.matmul(&b)?;
+        }
+        let cpu = t.elapsed().as_secs_f64() / cpu_reps as f64;
+        println!(
+            "{name:<42} gpu {:>7.1} ms ({:>6.0} GFLOPS)   cpu {:>7.1} ms ({:>5.0} GFLOPS)   x{:.1}",
+            gpu * 1e3,
+            flops / gpu / 1e9,
+            cpu * 1e3,
+            flops / cpu / 1e9,
+            cpu / gpu
+        );
+    }
+    Ok(())
+}
diff --git a/crates/sam2/examples/op_bench.rs b/crates/sam2/examples/op_bench.rs
new file mode 100644
index 000000000..4e2b5b4a3
--- /dev/null
+++ b/crates/sam2/examples/op_bench.rs
@@ -0,0 +1,68 @@
+//! Times the tensor operations a Hiera block is made of, at the sizes of its first (biggest) block.
+//! `cargo run --release -p effectcraft-sam2 --example op_bench`
+
+use std::time::Instant;
+
+use candle_core::{DType, Device, Tensor};
+use candle_nn::{Linear, Module};
+
+fn time<T>(name: &str, mut f: impl FnMut() -> T) {
+    let _ = f();
+    let n = 5;
+    let t = Instant::now();
+    for _ in 0..n {
+        let _ = f();
+    }
+    println!("{name:<44} {:>8.1} ms", t.elapsed().as_secs_f64() * 1e3 / n as f64);
+}
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let d = Device::Cpu;
+    // block 0: 1 x 256 x 256 x 96 activations, windows of 8 x 8
+    let x = Tensor::randn(0f32, 1.0, (1, 256, 256, 96), &d)?;
+    let w = Tensor::randn(0f32, 0.1, (288, 96), &d)?;
+    let b = Tensor::zeros(288, DType::F32, &d)?;
+    let lin = Linear::new(w, Some(b));
+    let flat = x.reshape((65536, 96))?;
+    time("linear 65536x96 -> 288 (qkv)", || lin.forward(&flat).unwrap());
+    let big = Tensor::randn(0f32, 1.0, (65536, 384), &d)?;
+    time("gelu_erf on 65536 x 384", || big.gelu_erf().unwrap());
+    time("relu on 65536 x 384", || big.relu().unwrap());
+    time("add 65536 x 384", || (&big + &big).unwrap());
+    let xs = x.clone();
+    time("permute+contiguous (window partition)", || x.reshape((1, 32, 8, 32, 8, 96)).unwrap().permute((0, 1, 3, 2, 4, 5)).unwrap().contiguous().unwrap());
+    let lnw = Tensor::ones(96, DType::F32, &d)?;
+    let lnb = Tensor::zeros(96, DType::F32, &d)?;
+    time("fused layer_norm 256x256x96", || candle_nn::ops::layer_norm(&xs, &lnw, &lnb, 1e-6).unwrap());
+    // windowed attention: 1024 windows x 64 tokens x 96 dims, one head
+    let q = Tensor::randn(0f32, 1.0, (1024, 1, 64, 96), &d)?;
+    let kt = Tensor::randn(0f32, 1.0, (1024, 1, 96, 64), &d)?;
+    time("batched matmul 1024 x (64x96)(96x64)", || q.matmul(&kt).unwrap());
+    let sc = Tensor::randn(0f32, 1.0, (1024, 1, 64, 64), &d)?;
+    time("softmax_last_dim 1024x64x64", || candle_nn::ops::softmax_last_dim(&sc).unwrap());
+    let v = Tensor::randn(0f32, 1.0, (1024, 1, 64, 96), &d)?;
+    time("batched matmul 1024 x (64x64)(64x96)", || sc.matmul(&v).unwrap());
+    // the MLP matmuls
+    let w1 = Linear::new(Tensor::randn(0f32, 0.1, (384, 96), &d)?, Some(Tensor::zeros(384, DType::F32, &d)?));
+    time("linear 65536x96 -> 384 (mlp in)", || w1.forward(&flat).unwrap());
+    let w2 = Linear::new(Tensor::randn(0f32, 0.1, (96, 384), &d)?, Some(Tensor::zeros(96, DType::F32, &d)?));
+    time("linear 65536x384 -> 96 (mlp out)", || w2.forward(&big).unwrap());
+    // block 1 (the first stage change): pooling and the wide projections
+    let p1 = Tensor::randn(0f32, 1.0, (1, 192, 256, 256), &d)?;
+    time("max_pool2d 2x2 on 1 x 192 x 256 x 256", || p1.max_pool2d_with_stride(2, 2).unwrap());
+    let p2 = Tensor::randn(0f32, 1.0, (1024, 192, 8, 8), &d)?;
+    time("max_pool2d 2x2 on 1024 x 192 x 8 x 8", || p2.max_pool2d_with_stride(2, 2).unwrap());
+    let nhwc = Tensor::randn(0f32, 1.0, (1, 256, 256, 192), &d)?;
+    time("permute NHWC -> NCHW + contiguous (192ch)", || nhwc.permute((0, 3, 1, 2)).unwrap().contiguous().unwrap());
+    let w3 = Linear::new(Tensor::randn(0f32, 0.1, (192, 96), &d)?, Some(Tensor::zeros(192, DType::F32, &d)?));
+    time("linear 65536x96 -> 192 (block 1 proj)", || w3.forward(&flat).unwrap());
+    time("NHWC 2x2 max via reshape + max(2), max(3)", || nhwc.reshape((1, 128, 2, 128, 2, 192)).unwrap().max(2).unwrap().max(3).unwrap());
+    time("NHWC 2x2 max via two strided maxes of narrowed", || {
+        let a = nhwc.reshape((1, 128, 2, 256, 192)).unwrap();
+        let m = a.narrow(2, 0, 1).unwrap().maximum(&a.narrow(2, 1, 1).unwrap()).unwrap().squeeze(2).unwrap();
+        let b = m.reshape((1, 128, 128, 2, 192)).unwrap();
+        b.narrow(3, 0, 1).unwrap().maximum(&b.narrow(3, 1, 1).unwrap()).unwrap().squeeze(3).unwrap()
+    });
+    println!("threads: {}", std::thread::available_parallelism().map_or(1, |n| n.get()));
+    Ok(())
+}
diff --git a/crates/sam2/examples/sam2_bench.rs b/crates/sam2/examples/sam2_bench.rs
new file mode 100644
index 000000000..0b51dd668
--- /dev/null
+++ b/crates/sam2/examples/sam2_bench.rs
@@ -0,0 +1,126 @@
+//! Timing of the SAM 2 image path on this machine: load, encode one frame, decode a click.
+//!
+//! `cargo run -p effectcraft-sam2 --example sam2_bench -- [MODEL_DIR]` (default `sam2-tiny`).
+//! Prints a message and exits when the weights are not there.
+
+use std::time::Instant;
+
+use candle_core::{DType, Device, Tensor};
+use effectcraft_sam2::model::ImageModel;
+use effectcraft_sam2::prompt::Prompt;
+
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("sam2_bench: {e}");
+        std::process::exit(1);
+    }
+}
+
+fn run() -> Result<(), Box<dyn std::error::Error>> {
+    let dir = std::env::args().nth(1).unwrap_or_else(|| "sam2-tiny".to_string());
+    let file = std::path::Path::new(&dir).join("model.safetensors");
+    if !file.exists() {
+        println!("no weights at {} (download facebook/sam2.1-hiera-tiny first)", file.display());
+        return Ok(());
+    }
+    let t = Instant::now();
+    let model = ImageModel::open(&file)?;
+    println!("load: {:.2} s", t.elapsed().as_secs_f64());
+    let pixels = Tensor::randn(0f32, 1.0, (1, 3, 1024, 1024), &Device::Cpu)?.to_dtype(DType::F32)?;
+    for run in 0..3 {
+        let t = Instant::now();
+        let enc = model.encode(&pixels)?;
+        let encode = t.elapsed().as_secs_f64();
+        let prompt = Prompt { points: vec![([512.0, 512.0], true)], bbox: None };
+        let t = Instant::now();
+        let out = model.segment(&enc, &prompt, true)?;
+        println!("run {run}: encode {encode:.2} s, click {:.0} ms, masks {:?}", t.elapsed().as_secs_f64() * 1e3, out.masks.dims());
+    }
+    // Where the encode time goes: patch embedding, then each Hiera block.
+    let hiera = &model.vision.hiera;
+    let t = Instant::now();
+    let mut x = hiera.patch_embed(&pixels)?;
+    println!("patch embed: {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    for (i, b) in hiera.blocks.iter().enumerate() {
+        let t = Instant::now();
+        x = b.forward(&x)?;
+        println!("block {i}: {:.0} ms, out {:?}", t.elapsed().as_secs_f64() * 1e3, x.dims());
+    }
+    // The rest of the encode: the neck (1x1 convolutions, top-down sums) and its sine position encodings.
+    let stages = hiera.forward(&pixels)?;
+    let t = Instant::now();
+    let _ = model.vision.neck.forward(&stages)?;
+    println!("neck (convolutions + positions): {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    let t = Instant::now();
+    for (h, w) in [(32, 32), (64, 64), (128, 128), (256, 256)] {
+        let _ = effectcraft_sam2::neck::sine_position(128, h, w)?;
+    }
+    println!("sine positions for the four levels: {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    // What a tracked frame adds to the encode: memory attention over the memory bank (7 memory frames and
+    // 16 object pointers of 4 tokens), then the memory encoder.
+    let weights = effectcraft_sam2::weights::Weights::open(&file)?;
+    let attn = effectcraft_sam2::memattn::MemoryAttention::load(&weights)?;
+    let cur = Tensor::randn(0f32, 1.0, (4096, 256), &Device::Cpu)?;
+    let cur_pos = Tensor::randn(0f32, 1.0, (4096, 256), &Device::Cpu)?;
+    let m = 7 * 4096 + 64;
+    let mem = Tensor::randn(0f32, 1.0, (m, 64), &Device::Cpu)?;
+    let mem_pos = Tensor::randn(0f32, 1.0, (m, 64), &Device::Cpu)?;
+    for run in 0..2 {
+        let t = Instant::now();
+        let _ = attn.forward(&cur, &cur_pos, &mem, &mem_pos, 64)?;
+        println!("memory attention (run {run}, {m} memory tokens): {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    }
+    // The same two costs on the GPU (wgpu kernels), when there is one.
+    match effectcraft_sam2::gpu::Gpu::shared() {
+        Ok(gpu) => {
+            println!("GPU: {}", gpu.adapter_name());
+            let enc = effectcraft_sam2::gpu::encoder::GpuEncoder::load(gpu.clone(), &weights, model.vision.hiera.clone())?;
+            let gattn = effectcraft_sam2::gpu::memattn::GpuMemoryAttention::load(gpu, &weights)?;
+            for run in 0..3 {
+                let t = Instant::now();
+                let _ = enc.encode(&pixels)?;
+                let encode = t.elapsed().as_secs_f64() * 1e3;
+                let t = Instant::now();
+                let _ = gattn.forward(&cur, &cur_pos, &mem, &mem_pos, 64)?;
+                println!("GPU run {run}: encode {encode:.0} ms, memory attention (full bank) {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+            }
+        }
+        Err(e) => println!("no GPU: {e}"),
+    }
+    // A whole tracked frame (encode, memory attention, decode, memory encoding) through the video session, on each backend.
+    struct Same(Tensor);
+    impl effectcraft_sam2::session::FrameSource for Same {
+        fn num_frames(&self) -> usize {
+            12
+        }
+        fn frame(&self, _i: usize) -> effectcraft_sam2::Result<Tensor> {
+            Ok(self.0.clone())
+        }
+    }
+    for backend in [effectcraft_sam2::session::Backend::Cpu, effectcraft_sam2::session::Backend::Gpu] {
+        let Ok(vm) = effectcraft_sam2::session::VideoModel::load_with(&weights, backend) else { continue };
+        let vm = std::sync::Arc::new(vm);
+        let mut tracker = effectcraft_sam2::session::VideoTracker::new(vm.clone(), Box::new(Same(pixels.clone())))?;
+        let obj = effectcraft_sam2::session::ObjectId(1);
+        let t = Instant::now();
+        tracker.prompt(0, obj, &Prompt { points: vec![([512.0, 512.0], true)], bbox: None })?;
+        println!("{:?} ({}): prompt frame {:.0} ms", backend, vm.device_name(), t.elapsed().as_secs_f64() * 1e3);
+        let mut last = Instant::now();
+        let mut times = vec![];
+        tracker.propagate(0, effectcraft_sam2::session::Direction::Forward, None, &effectcraft_sam2::session::Cancel::new(), &mut |m| {
+            if m.frame > 0 {
+                times.push(last.elapsed().as_secs_f64() * 1e3);
+            }
+            last = Instant::now();
+        })?;
+        println!(
+            "{:?}: tracked frames {:.0} ms each (first {:.0}, last {:.0})",
+            backend,
+            times.iter().sum::<f64>() / times.len().max(1) as f64,
+            times.first().copied().unwrap_or(0.0),
+            times.last().copied().unwrap_or(0.0)
+        );
+    }
+    println!("threads: {}", std::thread::available_parallelism().map_or(1, |n| n.get()));
+    Ok(())
+}
diff --git a/crates/sam2/src/decoder.rs b/crates/sam2/src/decoder.rs
new file mode 100644
index 000000000..bb9f67d43
--- /dev/null
+++ b/crates/sam2/src/decoder.rs
@@ -0,0 +1,399 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2/modeling_sam2.py`
+// (Sam2Attention, Sam2TwoWayAttentionBlock, Sam2TwoWayTransformer, Sam2MaskDecoder; Apache-2.0,
+// Copyright The HuggingFace Inc. team) to Rust on candle. See NOTICE.
+//! The two-way mask decoder: output tokens and prompt tokens attend to the image and back, then
+//! hyper-networks turn the mask tokens into masks over the up-scaled image embedding.
+//! One object per call (batch 1, one point batch).
+
+use candle_core::{D, Tensor};
+use candle_nn::{Linear, ops::sigmoid, ops::softmax};
+
+use crate::nn::{LayerNorm, apply, gelu, layer_norm, linear};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+const DIM: usize = 256;
+const MASK_TOKENS: usize = 4;
+
+struct Attention {
+    q: Linear,
+    k: Linear,
+    v: Linear,
+    o: Linear,
+    heads: usize,
+    scale: f64,
+}
+
+impl Attention {
+    fn load(w: &Weights, prefix: &str, downsample: usize, heads: usize) -> Result<Attention> {
+        let inner = DIM / downsample;
+        Ok(Attention {
+            q: linear(w, &format!("{prefix}.q_proj"), DIM, inner)?,
+            k: linear(w, &format!("{prefix}.k_proj"), DIM, inner)?,
+            v: linear(w, &format!("{prefix}.v_proj"), DIM, inner)?,
+            o: linear(w, &format!("{prefix}.o_proj"), inner, DIM)?,
+            heads,
+            scale: ((inner / heads) as f64).powf(-0.5),
+        })
+    }
+
+    /// `q`: `[1, nq, 256]`, `k` and `v`: `[1, nk, 256]`.
+    fn forward(&self, q: &Tensor, k: &Tensor, v: &Tensor) -> Result<Tensor> {
+        let split = |t: Tensor| -> Result<Tensor> { Ok(t.reshape((1, (), self.heads, t.dim(2)? / self.heads))?.transpose(1, 2)?.contiguous()?) };
+        let (q, k, v) = (split(apply(&self.q, q)?)?, split(apply(&self.k, k)?)?, split(apply(&self.v, v)?)?);
+        let att = softmax(&(q.matmul(&k.transpose(2, 3)?.contiguous()?)? * self.scale)?, D::Minus1)?;
+        let out = att.matmul(&v)?.transpose(1, 2)?.contiguous()?;
+        let (n, h, d) = (out.dim(1)?, out.dim(2)?, out.dim(3)?);
+        apply(&self.o, &out.reshape((1, n, h * d))?)
+    }
+}
+
+/// Feed-forward with ReLU, `Sam2FeedForward`: `proj_in`, `layers`, `proj_out`.
+pub struct FeedForward {
+    proj_in: Linear,
+    layers: Vec<Linear>,
+    proj_out: Linear,
+    sigmoid_output: bool,
+}
+
+impl FeedForward {
+    pub fn load(w: &Weights, prefix: &str, input: usize, hidden: usize, output: usize, num_layers: usize, sigmoid_output: bool) -> Result<FeedForward> {
+        Ok(FeedForward {
+            proj_in: linear(w, &format!("{prefix}.proj_in"), input, hidden)?,
+            layers: (0..num_layers.saturating_sub(2)).map(|i| linear(w, &format!("{prefix}.layers.{i}"), hidden, hidden)).collect::<Result<_>>()?,
+            proj_out: linear(w, &format!("{prefix}.proj_out"), hidden, output)?,
+            sigmoid_output,
+        })
+    }
+
+    pub fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        let mut x = apply(&self.proj_in, x)?.relu()?;
+        for l in &self.layers {
+            x = apply(l, &x)?.relu()?;
+        }
+        let x = apply(&self.proj_out, &x)?;
+        Ok(if self.sigmoid_output { sigmoid(&x)? } else { x })
+    }
+}
+
+struct Block {
+    self_attn: Attention,
+    ln1: LayerNorm,
+    token_to_image: Attention,
+    ln2: LayerNorm,
+    mlp: FeedForward,
+    ln3: LayerNorm,
+    ln4: LayerNorm,
+    image_to_token: Attention,
+    skip_first_pe: bool,
+}
+
+impl Block {
+    fn forward(&self, queries: &Tensor, keys: &Tensor, query_pe: &Tensor, key_pe: &Tensor) -> Result<(Tensor, Tensor)> {
+        let mut queries = if self.skip_first_pe {
+            self.self_attn.forward(queries, queries, queries)?
+        } else {
+            let q = (queries + query_pe)?;
+            (queries + self.self_attn.forward(&q, &q, queries)?)?
+        };
+        queries = self.ln1.forward(&queries)?;
+        let (q, k) = ((&queries + query_pe)?, (keys + key_pe)?);
+        queries = self.ln2.forward(&(&queries + self.token_to_image.forward(&q, &k, keys)?)?)?;
+        queries = self.ln3.forward(&(&queries + self.mlp.forward(&queries)?)?)?;
+        let (q, k) = ((&queries + query_pe)?, (keys + key_pe)?);
+        let keys = self.ln4.forward(&(keys + self.image_to_token.forward(&k, &q, &queries)?)?)?;
+        Ok((queries, keys))
+    }
+}
+
+/// What the decoder returns for one object.
+pub struct DecoderOutput {
+    /// Mask logits `[1, k, 4 * GRID, 4 * GRID]` (`k` is 3 for multimask output, else 1).
+    pub masks: Tensor,
+    /// Predicted IoU per mask `[1, k]`.
+    pub iou: Tensor,
+    /// The output tokens of the chosen masks `[1, k, 256]` (the object pointer is made from these).
+    pub sam_tokens: Tensor,
+    /// Object-presence logit `[1, 1]` (negative: the object is not in the frame).
+    pub object_score: Tensor,
+}
+
+pub struct MaskDecoder {
+    obj_token: Tensor,
+    iou_token: Tensor,
+    mask_tokens: Tensor,
+    layers: Vec<Block>,
+    final_attn: Attention,
+    final_ln: LayerNorm,
+    up1: (Tensor, Tensor),
+    up2: (Tensor, Tensor),
+    up_ln: LayerNorm,
+    conv_s0: (Tensor, Tensor),
+    conv_s1: (Tensor, Tensor),
+    hyper: Vec<FeedForward>,
+    iou_head: FeedForward,
+    obj_head: FeedForward,
+}
+
+fn conv_w(w: &Weights, name: &str, i: usize, o: usize, k: usize, transposed: bool) -> Result<(Tensor, Tensor)> {
+    let shape = if transposed { [i, o, k, k] } else { [o, i, k, k] };
+    Ok((w.get(&format!("{name}.weight"), &shape)?, w.get(&format!("{name}.bias"), &[o])?))
+}
+
+fn add_bias(x: Tensor, b: &Tensor) -> Result<Tensor> {
+    Ok(x.broadcast_add(&b.reshape((1, b.dim(0)?, 1, 1))?)?)
+}
+
+/// `conv_transpose2d` with a 2 x 2 kernel, stride 2, no padding, on tokens `[h * w, c]` (the image
+/// laid out row by row) with weight `[c, o, 2, 2]`, as one matrix product plus a pixel shuffle:
+/// every input pixel owns its own 2 x 2 output block, so there is no overlap to add up. Returns
+/// `[1, o, 2h, 2w]` without the bias. candle's transposed convolution takes about twice as long.
+fn conv_transpose_2x2(tokens: &Tensor, h: usize, w: usize, weight: &Tensor) -> Result<Tensor> {
+    let (c, o, kh, kw) = weight.dims4()?;
+    if (kh, kw) != (2, 2) || tokens.dims() != [h * w, c] {
+        return Err(Error::Input(format!("a 2x2 transposed convolution got tokens {:?} for a {c}x{o}x{kh}x{kw} weight on {h}x{w}", tokens.dims())));
+    }
+    let y = tokens.matmul(&weight.reshape((c, o * 4))?)?; // [h * w, (o, 2, 2)]
+    Ok(y.reshape((h, w, o, 2, 2))?.permute((2, 0, 3, 1, 4))?.contiguous()?.reshape((1, o, 2 * h, 2 * w))?)
+}
+
+/// The same convolution on an image `[1, c, h, w]`.
+fn conv_transpose_2x2_image(x: &Tensor, weight: &Tensor) -> Result<Tensor> {
+    let (_, c, h, w) = x.dims4()?;
+    conv_transpose_2x2(&x.reshape((c, h * w))?.t()?.contiguous()?, h, w, weight)
+}
+
+impl MaskDecoder {
+    pub fn load(w: &Weights) -> Result<MaskDecoder> {
+        let layers = (0..2)
+            .map(|i| {
+                let p = format!("mask_decoder.transformer.layers.{i}");
+                Ok(Block {
+                    self_attn: Attention::load(w, &format!("{p}.self_attn"), 1, 8)?,
+                    ln1: layer_norm(w, &format!("{p}.layer_norm1"), DIM, 1e-5)?,
+                    token_to_image: Attention::load(w, &format!("{p}.cross_attn_token_to_image"), 2, 8)?,
+                    ln2: layer_norm(w, &format!("{p}.layer_norm2"), DIM, 1e-5)?,
+                    mlp: FeedForward::load(w, &format!("{p}.mlp"), DIM, 2048, DIM, 2, false)?,
+                    ln3: layer_norm(w, &format!("{p}.layer_norm3"), DIM, 1e-5)?,
+                    ln4: layer_norm(w, &format!("{p}.layer_norm4"), DIM, 1e-5)?,
+                    image_to_token: Attention::load(w, &format!("{p}.cross_attn_image_to_token"), 2, 8)?,
+                    skip_first_pe: i == 0,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        Ok(MaskDecoder {
+            obj_token: w.get("mask_decoder.obj_score_token.weight", &[1, DIM])?,
+            iou_token: w.get("mask_decoder.iou_token.weight", &[1, DIM])?,
+            mask_tokens: w.get("mask_decoder.mask_tokens.weight", &[MASK_TOKENS, DIM])?,
+            layers,
+            final_attn: Attention::load(w, "mask_decoder.transformer.final_attn_token_to_image", 2, 8)?,
+            final_ln: layer_norm(w, "mask_decoder.transformer.layer_norm_final_attn", DIM, 1e-5)?,
+            up1: conv_w(w, "mask_decoder.upscale_conv1", DIM, DIM / 4, 2, true)?,
+            up2: conv_w(w, "mask_decoder.upscale_conv2", DIM / 4, DIM / 8, 2, true)?,
+            up_ln: layer_norm(w, "mask_decoder.upscale_layer_norm", DIM / 4, 1e-6)?,
+            conv_s0: conv_w(w, "mask_decoder.conv_s0", DIM, DIM / 8, 1, false)?,
+            conv_s1: conv_w(w, "mask_decoder.conv_s1", DIM, DIM / 4, 1, false)?,
+            hyper: (0..MASK_TOKENS)
+                .map(|i| FeedForward::load(w, &format!("mask_decoder.output_hypernetworks_mlps.{i}"), DIM, DIM, DIM / 8, 3, false))
+                .collect::<Result<_>>()?,
+            iou_head: FeedForward::load(w, "mask_decoder.iou_prediction_head", DIM, DIM, MASK_TOKENS, 3, true)?,
+            obj_head: FeedForward::load(w, "mask_decoder.pred_obj_score_head", DIM, DIM, 1, 3, false)?,
+        })
+    }
+
+    /// Project the two highest-resolution neck levels to the decoder's skip features
+    /// (`conv_s0` on the 4x level, `conv_s1` on the 2x level), `[1, 32, 4g, 4g]` and `[1, 64, 2g, 2g]`.
+    pub fn high_res(&self, level0: &Tensor, level1: &Tensor) -> Result<(Tensor, Tensor)> {
+        let s0 = add_bias(level0.conv2d(&self.conv_s0.0, 0, 1, 1, 1)?, &self.conv_s0.1)?;
+        let s1 = add_bias(level1.conv2d(&self.conv_s1.0, 0, 1, 1, 1)?, &self.conv_s1.1)?;
+        Ok((s0, s1))
+    }
+
+    /// Predict masks. `image` and `pos`: `[1, 256, g, g]` (the lowest-resolution level with the
+    /// no-memory embedding already added when there is no memory), `sparse`: `[1, n, 256]`,
+    /// `dense`: `[1, 256, g, g]`, `high`: the skip features from [`MaskDecoder::high_res`].
+    pub fn forward(&self, image: &Tensor, pos: &Tensor, sparse: &Tensor, dense: &Tensor, high: &(Tensor, Tensor), multimask: bool) -> Result<DecoderOutput> {
+        self.forward_with(image, pos, sparse, dense, high, multimask, true)
+    }
+
+    /// [`MaskDecoder::forward`]; `matmul_upscale` picks the matrix-product transposed convolutions
+    /// (the normal path) or candle's `conv_transpose2d` (the reference the tests compare with).
+    #[allow(clippy::too_many_arguments)]
+    fn forward_with(
+        &self,
+        image: &Tensor,
+        pos: &Tensor,
+        sparse: &Tensor,
+        dense: &Tensor,
+        high: &(Tensor, Tensor),
+        multimask: bool,
+        matmul_upscale: bool,
+    ) -> Result<DecoderOutput> {
+        let (_, c, g, gw) = image.dims4()?;
+        if c != DIM || g != gw {
+            return Err(Error::Input(format!("image embedding must be 256 x g x g, got {:?}", image.dims())));
+        }
+        let output_tokens = Tensor::cat(&[&self.obj_token, &self.iou_token, &self.mask_tokens], 0)?.unsqueeze(0)?;
+        let tokens = Tensor::cat(&[&output_tokens, sparse], 1)?;
+        let image = (image + dense)?;
+        let flat = |t: &Tensor| -> Result<Tensor> { Ok(t.flatten_from(2)?.transpose(1, 2)?.contiguous()?) };
+        let (mut keys, key_pe) = (flat(&image)?, flat(pos)?);
+        let mut queries = tokens.clone();
+        for l in &self.layers {
+            (queries, keys) = l.forward(&queries, &keys, &tokens, &key_pe)?;
+        }
+        let (q, k) = ((&queries + &tokens)?, (&keys + &key_pe)?);
+        let queries = self.final_ln.forward(&(&queries + self.final_attn.forward(&q, &k, &keys)?)?)?;
+
+        let iou_out = queries.narrow(1, 1, 1)?.squeeze(1)?;
+        let mask_tokens_out = queries.narrow(1, 2, MASK_TOKENS)?;
+        let obj_out = queries.narrow(1, 0, 1)?.squeeze(1)?;
+
+        let (s0, s1) = high;
+        let up = if matmul_upscale {
+            // the keys are already the image's tokens, row by row: no transpose needed
+            conv_transpose_2x2(&keys.reshape((g * g, DIM))?, g, g, &self.up1.0)?
+        } else {
+            keys.transpose(1, 2)?.contiguous()?.reshape((1, DIM, g, g))?.conv_transpose2d(&self.up1.0, 0, 0, 2, 1)?
+        };
+        let up = add_bias(up, &self.up1.1)?;
+        let up = (up + s1)?;
+        let up = self.up_ln.forward(&up.permute((0, 2, 3, 1))?)?.permute((0, 3, 1, 2))?.contiguous()?;
+        let up = gelu(&up)?;
+        let up = if matmul_upscale { conv_transpose_2x2_image(&up, &self.up2.0)? } else { up.conv_transpose2d(&self.up2.0, 0, 0, 2, 1)? };
+        let up = (add_bias(up, &self.up2.1)? + s0)?;
+        let up = gelu(&up)?;
+
+        let hyper: Vec<Tensor> = self.hyper.iter().enumerate().map(|(i, m)| m.forward(&mask_tokens_out.narrow(1, i, 1)?.squeeze(1)?)).collect::<Result<_>>()?;
+        let hyper = Tensor::stack(&hyper, 1)?;
+        let (_, uc, uh, uw) = up.dims4()?;
+        let masks = hyper.matmul(&up.reshape((1, uc, uh * uw))?)?.reshape((1, MASK_TOKENS, uh, uw))?;
+        let iou = self.iou_head.forward(&iou_out)?;
+        let object_score = self.obj_head.forward(&obj_out)?;
+
+        let (masks, iou, sam_tokens) = if multimask {
+            (masks.narrow(1, 1, 3)?, iou.narrow(1, 1, 3)?, mask_tokens_out.narrow(1, 1, 3)?)
+        } else {
+            let (m, i) = dynamic_single(&masks, &iou)?;
+            (m, i, mask_tokens_out.narrow(1, 0, 1)?)
+        };
+        Ok(DecoderOutput { masks, iou, sam_tokens, object_score })
+    }
+}
+
+/// Single-mask output with the stability fallback (`_dynamic_multimask_via_stability`): if the
+/// first mask token's mask is unstable, use the best of the other three.
+fn dynamic_single(masks: &Tensor, iou: &Tensor) -> Result<(Tensor, Tensor)> {
+    const DELTA: f32 = 0.05;
+    const THRESH: f32 = 0.98;
+    let single = masks.narrow(1, 0, 1)?;
+    let single_iou = iou.narrow(1, 0, 1)?;
+    let logits = single.flatten_all()?.to_vec1::<f32>()?;
+    let area_i = logits.iter().filter(|v| **v > DELTA).count() as f32;
+    let area_u = logits.iter().filter(|v| **v > -DELTA).count() as f32;
+    let stability = if area_u > 0.0 { area_i / area_u } else { 1.0 };
+    if stability >= THRESH {
+        return Ok((single, single_iou));
+    }
+    let multi_iou = iou.narrow(1, 1, 3)?.flatten_all()?.to_vec1::<f32>()?;
+    let best = multi_iou.iter().enumerate().fold((0usize, f32::NEG_INFINITY), |b, (i, v)| if *v > b.1 { (i, *v) } else { b }).0;
+    Ok((masks.narrow(1, 1 + best, 1)?, iou.narrow(1, 1 + best, 1)?))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use candle_core::{DType, Device};
+
+    use super::*;
+
+    fn max_diff(a: &Tensor, b: &Tensor) -> f32 {
+        assert_eq!(a.dims(), b.dims());
+        (a - b).unwrap().abs().unwrap().flatten_all().unwrap().max(0).unwrap().to_scalar::<f32>().unwrap()
+    }
+
+    /// The matrix-product form equals `conv_transpose2d` (kernel 2, stride 2, no padding, the only
+    /// variant the decoder uses) to rounding, for the decoder's two sizes and for odd ones.
+    #[test]
+    fn matmul_transposed_convolution_matches_conv_transpose2d() {
+        let d = &Device::Cpu;
+        // (in channels, out channels, height, width)
+        let cases =
+            [(256, 64, 64, 64), (64, 32, 128, 128), (256, 64, 16, 16), (3, 5, 7, 11), (5, 3, 1, 9), (4, 2, 9, 1), (1, 1, 1, 1), (17, 1, 3, 5), (1, 19, 6, 2)];
+        for (c, o, h, w) in cases {
+            for (std, scale) in [(1.0, 0.05), (30.0, 3.0)] {
+                let x = Tensor::randn(0f32, std, (1, c, h, w), d).unwrap();
+                let k = Tensor::randn(0f32, scale, (c, o, 2, 2), d).unwrap();
+                let want = x.conv_transpose2d(&k, 0, 0, 2, 1).unwrap();
+                let got = conv_transpose_2x2_image(&x, &k).unwrap();
+                // 1e-6 of the largest output value (at least 1e-6 absolute): float rounding only
+                let peak = want.abs().unwrap().flatten_all().unwrap().max(0).unwrap().to_scalar::<f32>().unwrap();
+                let tol = 1e-6 * peak.max(1.0);
+                let diff = max_diff(&want, &got);
+                assert!(diff <= tol, "c{c} o{o} {h}x{w} std {std}: max diff {diff:e} > {tol:e}");
+            }
+        }
+    }
+
+    #[test]
+    fn matmul_transposed_convolution_edge_values() {
+        let d = &Device::Cpu;
+        // zeros, a single hot pixel and negative values land in the right 2x2 block
+        let k = Tensor::randn(0f32, 1.0, (3, 2, 2, 2), d).unwrap();
+        let zero = Tensor::zeros((1, 3, 4, 5), DType::F32, d).unwrap();
+        assert_eq!(max_diff(&zero.conv_transpose2d(&k, 0, 0, 2, 1).unwrap(), &conv_transpose_2x2_image(&zero, &k).unwrap()), 0.0);
+        let mut v = vec![0f32; 3 * 4 * 5];
+        v[2 * 20 + 3 * 5 + 1] = -7.5;
+        let hot = Tensor::from_vec(v, (1, 3, 4, 5), d).unwrap();
+        assert!(max_diff(&hot.conv_transpose2d(&k, 0, 0, 2, 1).unwrap(), &conv_transpose_2x2_image(&hot, &k).unwrap()) <= 1e-6);
+        // other kernels are refused, not computed wrongly
+        let k3 = Tensor::zeros((3, 2, 3, 3), DType::F32, d).unwrap();
+        assert!(conv_transpose_2x2_image(&hot, &k3).is_err());
+    }
+
+    /// Random weights for every tensor the decoder asks for, found by loading until nothing is missing.
+    fn random_decoder() -> MaskDecoder {
+        let d = &Device::Cpu;
+        let mut map: HashMap<String, Tensor> = HashMap::new();
+        for _ in 0..1000 {
+            match MaskDecoder::load(&Weights::from_map(map.clone()).unwrap()) {
+                Ok(m) => return m,
+                Err(Error::Weights(m)) => {
+                    let name = m.split('`').nth(1).unwrap().to_string();
+                    let shape: Vec<usize> = match m.split("expected [").nth(1) {
+                        Some(e) => e.trim_end_matches(']').split(',').map(|s| s.trim().parse().unwrap()).collect(),
+                        None => vec![1],
+                    };
+                    let t = if name.contains("layer_norm") && name.ends_with("weight") {
+                        Tensor::ones(shape, DType::F32, d)
+                    } else {
+                        Tensor::randn(0f32, 0.05, shape, d)
+                    };
+                    map.insert(name, t.unwrap());
+                }
+                Err(e) => panic!("{e}"),
+            }
+        }
+        panic!("the decoder kept asking for tensors");
+    }
+
+    #[test]
+    fn decoder_output_is_the_same_with_either_transposed_convolution() {
+        let d = &Device::Cpu;
+        let dec = random_decoder();
+        let g = 16;
+        let r = |dims: &[usize]| Tensor::randn(0f32, 1.0, dims, d).unwrap();
+        let (image, pos, dense) = (r(&[1, DIM, g, g]), r(&[1, DIM, g, g]), r(&[1, DIM, g, g]));
+        let sparse = r(&[1, 3, DIM]);
+        let high = dec.high_res(&r(&[1, DIM, 4 * g, 4 * g]), &r(&[1, DIM, 2 * g, 2 * g])).unwrap();
+        for multimask in [false, true] {
+            let a = dec.forward_with(&image, &pos, &sparse, &dense, &high, multimask, false).unwrap();
+            let b = dec.forward_with(&image, &pos, &sparse, &dense, &high, multimask, true).unwrap();
+            assert!(max_diff(&a.masks, &b.masks) <= 2e-5, "masks differ by {:e}", max_diff(&a.masks, &b.masks));
+            assert!(max_diff(&a.iou, &b.iou) <= 1e-5);
+            assert!(max_diff(&a.sam_tokens, &b.sam_tokens) <= 1e-5);
+            assert!(max_diff(&a.object_score, &b.object_score) <= 1e-5);
+        }
+    }
+}
diff --git a/crates/sam2/src/gpu.rs b/crates/sam2/src/gpu.rs
new file mode 100644
index 000000000..852cc1a08
--- /dev/null
+++ b/crates/sam2/src/gpu.rs
@@ -0,0 +1,497 @@
+// Original work for EffectCraft (wgpu compute kernels); the maths follows the Hugging Face
+// `transformers` SAM 2 implementation (Apache-2.0, see NOTICE).
+//! An optional GPU path for the heavy parts of SAM 2 (the Hiera backbone, the neck and the memory
+//! attention), as wgpu compute kernels: it runs on AMD, NVIDIA and Intel alike, where candle has
+//! no backend for the first. The CPU path stays the reference: every kernel is tested against it,
+//! and any GPU failure (no adapter, an out-of-memory error, a lost device) is an `Err` the caller
+//! answers by running the CPU path.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex, PoisonError};
+
+use wgpu::util::DeviceExt;
+
+use crate::{Error, Result};
+
+const SHADER: &str = concat!(include_str!("gpu/kernels.wgsl"), include_str!("gpu/kernels_ops.wgsl"));
+/// Words in a kernel's parameter block.
+const PARAM_WORDS: usize = 24;
+
+/// A buffer of f32 on the GPU (cheap to clone: it is a handle).
+#[derive(Clone)]
+pub struct Buf {
+    pub(crate) buffer: wgpu::Buffer,
+    /// Elements (f32).
+    pub len: usize,
+    /// Two half-precision values per 32-bit word (a weight matrix only; `len` still counts values).
+    pub(crate) f16: bool,
+}
+
+/// One strided matrix operand: `(offset, batch stride, row stride, column stride)` in elements.
+#[derive(Clone, Copy, Debug)]
+pub struct Strides {
+    pub offset: usize,
+    pub batch: usize,
+    pub row: usize,
+    pub col: usize,
+}
+
+impl Strides {
+    /// A row-major `[rows, cols]` matrix (one batch).
+    pub fn row_major(cols: usize) -> Strides {
+        Strides { offset: 0, batch: 0, row: cols, col: 1 }
+    }
+}
+
+/// What to do to a matrix product after the multiplication.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub enum Act {
+    #[default]
+    None,
+    Gelu,
+    Relu,
+}
+
+/// A batched matrix product `C[b] = act(alpha * A[b] . B[b] + bias) (+ residual)`.
+pub struct Matmul<'a> {
+    pub m: usize,
+    pub n: usize,
+    pub k: usize,
+    pub batch: usize,
+    pub a: (&'a Buf, Strides),
+    pub b: (&'a Buf, Strides),
+    pub bias: Option<&'a Buf>,
+    pub c: (&'a Buf, Strides),
+    pub residual: Option<&'a Buf>,
+    pub alpha: f32,
+    pub act: Act,
+}
+
+/// The GPU device and its compiled kernels.
+pub struct Gpu {
+    device: wgpu::Device,
+    queue: wgpu::Queue,
+    module: wgpu::ShaderModule,
+    pipelines: Mutex<HashMap<&'static str, Arc<wgpu::ComputePipeline>>>,
+    encoder: Mutex<Option<wgpu::CommandEncoder>>,
+    turn: Mutex<()>,
+    error: Arc<Mutex<Option<String>>>,
+    adapter: String,
+}
+
+fn words(v: &[u32]) -> [u32; PARAM_WORDS] {
+    let mut out = [0u32; PARAM_WORDS];
+    for (o, x) in out.iter_mut().zip(v) {
+        *o = *x;
+    }
+    out
+}
+
+fn u32_of(v: usize, what: &str) -> Result<u32> {
+    u32::try_from(v).map_err(|_| Error::Compute(format!("{what} {v} does not fit a GPU index")))
+}
+
+/// Whether weight matrices are kept on the GPU in half precision (`EFFECTCRAFT_SAM2_F16=1`).
+pub fn half_weights() -> bool {
+    std::env::var("EFFECTCRAFT_SAM2_F16").is_ok_and(|v| matches!(v.trim(), "1" | "on" | "true"))
+}
+
+/// The process's one GPU device, once something has asked for it.
+static DEVICE: std::sync::OnceLock<std::result::Result<Arc<Gpu>, String>> = std::sync::OnceLock::new();
+
+/// The adapter SAM 2 refused and its instance, kept for the life of the process, as the device made on it used to be.
+/// Dropping them crashed the tests with a segmentation fault on WSL2's OpenGL driver (Mesa 23.2 on D3D12). At most one:
+/// [`Gpu::new`] runs once.
+static REFUSED: std::sync::OnceLock<(wgpu::Instance, wgpu::Adapter)> = std::sync::OnceLock::new();
+
+/// SAM 2's wgpu instance reads wgpu's environment variables (`WGPU_BACKEND`, `WGPU_VALIDATION`,
+/// `WGPU_ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER`…), as the render context's does, so both choose among the same adapters.
+fn instance_descriptor() -> wgpu::InstanceDescriptor {
+    wgpu::InstanceDescriptor::new_without_display_handle().with_env()
+}
+
+/// Why SAM 2 does not use an adapter, if it does not: a software one (the CPU path is faster), or one without compute
+/// shaders (OpenGL ES 3.0, for one), where every kernel would fail validation. Checked before a device is made there.
+fn refusal(name: &str, backend: wgpu::Backend, device_type: wgpu::DeviceType, downlevel: wgpu::DownlevelFlags) -> Option<String> {
+    if device_type == wgpu::DeviceType::Cpu {
+        return Some(format!("only a software adapter ({name}) is available"));
+    }
+    (!downlevel.contains(wgpu::DownlevelFlags::COMPUTE_SHADERS)).then(|| format!("the GPU adapter {name} ({backend:?}) has no compute shaders"))
+}
+
+impl Gpu {
+    /// The process's one GPU device, created on first use. Several devices at once upset some Vulkan loaders
+    /// (a crash when two threads create or drop them together), and one is all SAM 2 needs: models come and go,
+    /// the device stays. An error (no GPU) is remembered too.
+    pub fn shared() -> Result<Arc<Gpu>> {
+        // The message alone is kept, so the error says "SAM 2 compute:" once.
+        let keep = |e: Error| match e {
+            Error::Compute(m) => m,
+            e => e.to_string(),
+        };
+        DEVICE.get_or_init(|| Gpu::new().map(Arc::new).map_err(keep)).clone().map_err(Error::Compute)
+    }
+
+    /// Whether the shared device has been looked for yet, and found: `None` before anything has asked
+    /// for it (this never creates it, so a caller that only wants to describe the GPU does not stall
+    /// on the adapter and shader compilation), then `Some(true)` or `Some(false)` (no GPU).
+    pub fn probe() -> Option<bool> {
+        DEVICE.get().map(|d| d.is_ok())
+    }
+
+    /// A device on the best real GPU (high performance unless `WGPU_POWER_PREF` says otherwise; see [`refusal`] for the
+    /// adapters the CPU path runs instead of).
+    fn new() -> Result<Gpu> {
+        let instance = wgpu::Instance::new(instance_descriptor());
+        let power_preference = wgpu::PowerPreference::from_env().unwrap_or(wgpu::PowerPreference::HighPerformance);
+        let adapter = pollster::block_on(instance.request_adapter(&wgpu::RequestAdapterOptions { power_preference, ..Default::default() }))
+            .map_err(|e| Error::Compute(format!("no GPU adapter: {e}")))?;
+        let info = adapter.get_info();
+        if let Some(why) = refusal(&info.name, info.backend, info.device_type, adapter.get_downlevel_capabilities().flags) {
+            let _ = REFUSED.set((instance, adapter));
+            return Err(Error::Compute(why));
+        }
+        let (device, queue) = pollster::block_on(adapter.request_device(&wgpu::DeviceDescriptor {
+            label: Some("effectcraft sam2"),
+            required_limits: adapter.limits(),
+            ..Default::default()
+        }))
+        .map_err(|e| Error::Compute(format!("no GPU device: {e}")))?;
+        let error: Arc<Mutex<Option<String>>> = Arc::default();
+        let sink = error.clone();
+        device.on_uncaptured_error(Arc::new(move |e| {
+            log::error!("sam2 gpu: {e}");
+            sink.lock().unwrap_or_else(PoisonError::into_inner).get_or_insert_with(|| e.to_string());
+        }));
+        let sink = error.clone();
+        device.set_device_lost_callback(move |reason, message| {
+            sink.lock().unwrap_or_else(PoisonError::into_inner).get_or_insert_with(|| format!("GPU device lost ({reason:?}): {message}"));
+        });
+        let module = device.create_shader_module(wgpu::ShaderModuleDescriptor { label: Some("sam2 kernels"), source: wgpu::ShaderSource::Wgsl(SHADER.into()) });
+        Ok(Gpu { device, queue, module, pipelines: Mutex::default(), encoder: Mutex::new(None), turn: Mutex::new(()), error, adapter: info.name })
+    }
+
+    /// One GPU pass at a time: a caller holds this while it queues, flushes and reads back a whole job, so
+    /// two threads never interleave their dispatches in one command stream.
+    pub fn exclusive(&self) -> std::sync::MutexGuard<'_, ()> {
+        self.turn.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    pub fn adapter_name(&self) -> &str {
+        &self.adapter
+    }
+
+    fn take_error(&self) -> Result<()> {
+        match self.error.lock().unwrap_or_else(PoisonError::into_inner).take() {
+            Some(e) => Err(Error::Compute(format!("GPU: {e}"))),
+            None => Ok(()),
+        }
+    }
+
+    pub fn upload(&self, data: &[f32]) -> Buf {
+        // `write_buffer` instead of a mapped-at-creation buffer: on a lost or out-of-memory device the latter panics inside wgpu,
+        // while this records the error for `take_error`.
+        let buffer = self.device.create_buffer(&wgpu::BufferDescriptor {
+            label: None,
+            size: (data.len().max(1) as u64) * 4,
+            usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_SRC | wgpu::BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        if !data.is_empty() {
+            self.queue.write_buffer(&buffer, 0, bytemuck::cast_slice(data));
+        }
+        Buf { buffer, len: data.len(), f16: false }
+    }
+
+    /// A weight matrix: stored as half precision (half the memory) when `EFFECTCRAFT_SAM2_F16` asks for it and every
+    /// value fits, as f32 otherwise.
+    pub fn upload_weights(&self, data: &[f32]) -> Buf {
+        if !half_weights() || data.is_empty() || data.iter().any(|v| v.abs() > 60_000.0) {
+            return self.upload(data);
+        }
+        self.upload_f16(data)
+    }
+
+    /// `data` as half precision, two values per word.
+    pub(crate) fn upload_f16(&self, data: &[f32]) -> Buf {
+        let words: Vec<u32> = data
+            .chunks(2)
+            .map(|p| {
+                let lo = half::f16::from_f32(p.first().copied().unwrap_or(0.0)).to_bits();
+                let hi = half::f16::from_f32(p.get(1).copied().unwrap_or(0.0)).to_bits();
+                u32::from(lo) | (u32::from(hi) << 16)
+            })
+            .collect();
+        let buffer = self.device.create_buffer(&wgpu::BufferDescriptor {
+            label: None,
+            size: (words.len() as u64) * 4,
+            usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_SRC | wgpu::BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        self.queue.write_buffer(&buffer, 0, bytemuck::cast_slice(&words));
+        Buf { buffer, len: data.len(), f16: true }
+    }
+
+    /// A zeroed buffer of `len` elements.
+    pub fn zeros(&self, len: usize) -> Result<Buf> {
+        let bytes = (len.max(1) as u64).checked_mul(4).ok_or_else(|| Error::Budget("GPU buffer size overflows".into()))?;
+        if bytes > self.device.limits().max_buffer_size || bytes > self.device.limits().max_storage_buffer_binding_size {
+            return Err(Error::Budget(format!("a {} MB GPU buffer is over this GPU's limit", bytes >> 20)));
+        }
+        let buffer = self.device.create_buffer(&wgpu::BufferDescriptor {
+            label: None,
+            size: bytes,
+            usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_SRC | wgpu::BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        Ok(Buf { buffer, len, f16: false })
+    }
+
+    fn pipeline(&self, entry: &'static str) -> Arc<wgpu::ComputePipeline> {
+        let mut map = self.pipelines.lock().unwrap_or_else(PoisonError::into_inner);
+        map.entry(entry)
+            .or_insert_with(|| {
+                Arc::new(self.device.create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
+                    label: Some(entry),
+                    layout: None,
+                    module: &self.module,
+                    entry_point: Some(entry),
+                    compilation_options: Default::default(),
+                    cache: None,
+                }))
+            })
+            .clone()
+    }
+
+    /// Queue one dispatch of `entry`. `bindings` are the kernel's buffers by binding index.
+    pub(crate) fn run(&self, entry: &'static str, bindings: &[(u32, &Buf)], params: &[u32], groups: (u32, u32, u32)) {
+        let pipeline = self.pipeline(entry);
+        let uniform = self.device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: None,
+            contents: bytemuck::cast_slice(&words(params)),
+            usage: wgpu::BufferUsages::UNIFORM,
+        });
+        let mut entries: Vec<wgpu::BindGroupEntry<'_>> =
+            bindings.iter().map(|(i, b)| wgpu::BindGroupEntry { binding: *i, resource: b.buffer.as_entire_binding() }).collect();
+        entries.push(wgpu::BindGroupEntry { binding: 5, resource: uniform.as_entire_binding() });
+        let group = self.device.create_bind_group(&wgpu::BindGroupDescriptor { label: None, layout: &pipeline.get_bind_group_layout(0), entries: &entries });
+        let mut slot = self.encoder.lock().unwrap_or_else(PoisonError::into_inner);
+        let enc = slot.get_or_insert_with(|| self.device.create_command_encoder(&Default::default()));
+        let mut pass = enc.begin_compute_pass(&Default::default());
+        pass.set_pipeline(&pipeline);
+        pass.set_bind_group(0, &group, &[]);
+        pass.dispatch_workgroups(groups.0, groups.1, groups.2);
+    }
+
+    /// Submit what is queued and wait for it to finish.
+    pub fn flush(&self) -> Result<()> {
+        let enc = self.encoder.lock().unwrap_or_else(PoisonError::into_inner).take();
+        if let Some(enc) = enc {
+            self.queue.submit([enc.finish()]);
+        }
+        let _ = self.device.poll(wgpu::PollType::wait_indefinitely());
+        self.take_error()
+    }
+
+    /// Copy a buffer back to the CPU (after submitting everything queued).
+    pub fn download(&self, buf: &Buf) -> Result<Vec<f32>> {
+        let bytes = buf.len as u64 * 4;
+        if bytes == 0 {
+            return Ok(vec![]);
+        }
+        let staging = self.device.create_buffer(&wgpu::BufferDescriptor {
+            label: None,
+            size: bytes,
+            usage: wgpu::BufferUsages::MAP_READ | wgpu::BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        let mut enc =
+            self.encoder.lock().unwrap_or_else(PoisonError::into_inner).take().unwrap_or_else(|| self.device.create_command_encoder(&Default::default()));
+        enc.copy_buffer_to_buffer(&buf.buffer, 0, &staging, 0, bytes);
+        self.queue.submit([enc.finish()]);
+        let (tx, rx) = std::sync::mpsc::channel();
+        staging.map_async(wgpu::MapMode::Read, .., move |r| {
+            let _ = tx.send(r);
+        });
+        let _ = self.device.poll(wgpu::PollType::wait_indefinitely());
+        self.take_error()?;
+        rx.recv().map_err(|_| Error::Compute("GPU readback never completed".into()))?.map_err(|e| Error::Compute(format!("GPU readback: {e}")))?;
+        let out = {
+            let view = staging.get_mapped_range(..).map_err(|e| Error::Compute(format!("GPU readback: {e}")))?;
+            bytemuck::cast_slice::<u8, f32>(&view).to_vec()
+        };
+        staging.unmap();
+        Ok(out)
+    }
+
+    /// Queue `C[b] = act(alpha * A[b] . B[b] + bias) (+ residual)`.
+    pub fn matmul(&self, op: &Matmul<'_>) -> Result<()> {
+        let (a, sa) = op.a;
+        let (b, sb) = op.b;
+        let (c, sc) = op.c;
+        if op.m == 0 || op.n == 0 || op.batch == 0 {
+            return Ok(());
+        }
+        if sc.col != 1 {
+            return Err(Error::Input(format!("matmul output needs a column stride of 1, got {}", sc.col)));
+        }
+        // bounds: the last element each operand touches must lie inside its buffer
+        let last = |s: Strides, rows: usize, cols: usize| {
+            s.offset.checked_add((op.batch - 1).checked_mul(s.batch)?)?.checked_add((rows - 1).checked_mul(s.row)?)?.checked_add((cols - 1).checked_mul(s.col)?)
+        };
+        for (name, buf, s, rows, cols) in [("A", a, sa, op.m, op.k), ("B", b, sb, op.k, op.n), ("C", c, sc, op.m, op.n)] {
+            if name != "C" && op.k == 0 {
+                continue;
+            }
+            let last = last(s, rows, cols).ok_or_else(|| Error::Input(format!("matmul operand {name} layout overflows its element index")))?;
+            if last >= buf.len {
+                return Err(Error::Input(format!("matmul operand {name} reaches element {last} of a {}-element buffer", buf.len)));
+            }
+        }
+        if op.bias.is_some_and(|bias| bias.len < op.n) || op.residual.is_some_and(|r| r.len < c.len) {
+            return Err(Error::Input("matmul bias or residual is too small".into()));
+        }
+        let flags = u32::from(op.bias.is_some())
+            | (match op.act {
+                Act::None => 0,
+                Act::Gelu => 1,
+                Act::Relu => 2,
+            } << 1)
+            | (u32::from(op.residual.is_some()) << 3);
+        let params = [
+            u32_of(op.m, "m")?,
+            u32_of(op.n, "n")?,
+            u32_of(op.k, "k")?,
+            u32_of(op.batch, "batch")?,
+            u32_of(sa.offset, "a offset")?,
+            u32_of(sa.batch, "a batch")?,
+            u32_of(sa.row, "a row")?,
+            u32_of(sa.col, "a col")?,
+            u32_of(sb.offset, "b offset")?,
+            u32_of(sb.batch, "b batch")?,
+            u32_of(sb.row, "b row")?,
+            u32_of(sb.col, "b col")?,
+            u32_of(sc.offset, "c offset")?,
+            u32_of(sc.batch, "c batch")?,
+            u32_of(sc.row, "c row")?,
+            flags,
+            op.alpha.to_bits(),
+        ];
+        let dummy;
+        let bias = match op.bias {
+            Some(b) => b,
+            None => {
+                dummy = self.upload(&[0.0]);
+                &dummy
+            }
+        };
+        // a buffer is never bound twice in one dispatch (read and read-write), so no residual means a dummy
+        let dummy_res;
+        let res = match op.residual {
+            Some(r) => r,
+            None => {
+                dummy_res = self.upload(&[0.0]);
+                &dummy_res
+            }
+        };
+        self.run(
+            if b.f16 { "matmul_w16" } else { "matmul" },
+            &[(0, a), (1, b), (2, bias), (3, c), (4, res)],
+            &params,
+            (u32_of(op.n.div_ceil(64), "groups")?, u32_of(op.m.div_ceil(64), "groups")?, u32_of(op.batch, "batch")?),
+        );
+        Ok(())
+    }
+}
+
+pub mod encoder;
+pub mod memattn;
+pub mod memenc;
+mod ops;
+
+/// A linear layer's weight `[out, in]` and bias `[out]` on the GPU.
+pub struct GLinear {
+    pub(crate) w: Buf,
+    pub(crate) b: Buf,
+    pub(crate) inp: usize,
+    pub(crate) out: usize,
+}
+
+/// A layer norm's scale and shift on the GPU.
+pub struct GNorm {
+    pub(crate) w: Buf,
+    pub(crate) b: Buf,
+}
+
+fn flat(t: candle_core::Tensor) -> Result<Vec<f32>> {
+    Ok(t.flatten_all()?.to_vec1::<f32>()?)
+}
+
+impl GLinear {
+    /// From `{name}.weight` (`[out, in]`) and `{name}.bias`.
+    pub fn load(g: &Gpu, w: &crate::weights::Weights, name: &str, inp: usize, out: usize) -> Result<GLinear> {
+        Ok(GLinear {
+            w: g.upload_weights(&flat(w.get(&format!("{name}.weight"), &[out, inp])?)?),
+            b: g.upload(&flat(w.get(&format!("{name}.bias"), &[out])?)?),
+            inp,
+            out,
+        })
+    }
+
+    /// As [`GLinear::load`], with output channel `j` scaled by `scale[j]` (the memory fuser's layer scale).
+    pub fn load_scaled(g: &Gpu, w: &crate::weights::Weights, name: &str, inp: usize, out: usize, scale: &[f32]) -> Result<GLinear> {
+        if scale.len() != out {
+            return Err(Error::Weights(format!("`{name}`: {} scales for {out} outputs", scale.len())));
+        }
+        let mut wt = flat(w.get(&format!("{name}.weight"), &[out, inp])?)?;
+        let mut bias = flat(w.get(&format!("{name}.bias"), &[out])?)?;
+        for (j, s) in scale.iter().enumerate() {
+            if let Some(row) = wt.get_mut(j * inp..(j + 1) * inp) {
+                row.iter_mut().for_each(|v| *v *= s);
+            }
+            if let Some(b) = bias.get_mut(j) {
+                *b *= s;
+            }
+        }
+        Ok(GLinear { w: g.upload_weights(&wt), b: g.upload(&bias), inp, out })
+    }
+
+    /// A 1 x 1 convolution (`[out, in, 1, 1]`) as a linear layer over channels-last tokens.
+    pub fn load_conv1x1(g: &Gpu, w: &crate::weights::Weights, name: &str, inp: usize, out: usize) -> Result<GLinear> {
+        Ok(GLinear {
+            w: g.upload_weights(&flat(w.get(&format!("{name}.weight"), &[out, inp, 1, 1])?)?),
+            b: g.upload(&flat(w.get(&format!("{name}.bias"), &[out])?)?),
+            inp,
+            out,
+        })
+    }
+}
+
+impl GNorm {
+    pub fn load(g: &Gpu, w: &crate::weights::Weights, name: &str, dim: usize) -> Result<GNorm> {
+        Ok(GNorm { w: g.upload(&flat(w.get(&format!("{name}.weight"), &[dim])?)?), b: g.upload(&flat(w.get(&format!("{name}.bias"), &[dim])?)?) })
+    }
+}
+
+impl Gpu {
+    /// `out = act(x . W^T + bias) (+ residual)` for `rows` rows of `l.inp` values.
+    pub fn linear(&self, x: &Buf, rows: usize, l: &GLinear, out: &Buf, act: Act, residual: Option<&Buf>) -> Result<()> {
+        // the weight is stored [out, in]: B[k][j] = w[j * in + k]
+        self.matmul(&Matmul {
+            m: rows,
+            n: l.out,
+            k: l.inp,
+            batch: 1,
+            a: (x, Strides::row_major(l.inp)),
+            b: (&l.w, Strides { offset: 0, batch: 0, row: 1, col: l.inp }),
+            bias: Some(&l.b),
+            c: (out, Strides::row_major(l.out)),
+            residual,
+            alpha: 1.0,
+            act,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/sam2/src/gpu/encoder.rs b/crates/sam2/src/gpu/encoder.rs
new file mode 100644
index 000000000..a33f9069c
--- /dev/null
+++ b/crates/sam2/src/gpu/encoder.rs
@@ -0,0 +1,289 @@
+// Original work for EffectCraft; the maths follows the Hugging Face `transformers` SAM 2
+// implementation (Apache-2.0, see NOTICE).
+//! The vision encoder on the GPU: patch embedding, the Hiera blocks and the neck, with the decoder's two
+//! skip convolutions. Activations stay on the GPU between the kernels; only the three tensors the rest of
+//! the model needs come back.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex, PoisonError};
+
+use candle_core::{Device, Tensor};
+
+use super::{Act, Buf, GLinear, GNorm, Gpu, Matmul, Strides};
+use crate::hiera::{BlockPlan, Hiera, HieraConfig};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+struct GBlock {
+    plan: BlockPlan,
+    norm1: GNorm,
+    qkv: GLinear,
+    proj: GLinear,
+    norm2: GNorm,
+    mlp_in: GLinear,
+    mlp_out: GLinear,
+    block_proj: Option<GLinear>,
+}
+
+/// What the rest of the model takes from the encoder (CPU tensors, NCHW).
+pub struct GpuFeatures {
+    /// The lowest-resolution neck level `[1, 256, 64, 64]`.
+    pub low: Tensor,
+    /// The decoder's skip features: `conv_s0` of the highest level `[1, 32, 256, 256]` and `conv_s1` of the
+    /// next `[1, 64, 128, 128]`.
+    pub high: (Tensor, Tensor),
+}
+
+pub struct GpuEncoder {
+    gpu: Arc<Gpu>,
+    cfg: HieraConfig,
+    patch_w: Buf,
+    patch_b: Buf,
+    blocks: Vec<GBlock>,
+    stage_ends: Vec<usize>,
+    neck: Vec<GLinear>,
+    top_down: Vec<usize>,
+    skip0: GLinear,
+    skip1: GLinear,
+    /// The position embedding of each grid size, uploaded on first use.
+    pos: Mutex<HashMap<(usize, usize), Buf>>,
+    /// The CPU backbone, which owns the position embedding tables.
+    cpu: Arc<Hiera>,
+    eps: f32,
+}
+
+impl GpuEncoder {
+    /// Upload the backbone, the neck and the skip convolutions. `cpu` supplies the position embedding.
+    pub fn load(gpu: Arc<Gpu>, w: &Weights, cpu: Arc<Hiera>) -> Result<GpuEncoder> {
+        let cfg = cpu.config().clone();
+        let flat = |t: Tensor| -> Result<Vec<f32>> { Ok(t.flatten_all()?.to_vec1::<f32>()?) };
+        let hidden = cfg.embed_dims.first().copied().unwrap_or(96);
+        let mut blocks = vec![];
+        for (total, plan) in BlockPlan::all(&cfg)?.into_iter().enumerate() {
+            let p = format!("vision_encoder.backbone.blocks.{total}");
+            blocks.push(GBlock {
+                plan,
+                norm1: GNorm::load(&gpu, w, &format!("{p}.layer_norm1"), plan.dim)?,
+                qkv: GLinear::load(&gpu, w, &format!("{p}.attn.qkv"), plan.dim, plan.dim_out * 3)?,
+                proj: GLinear::load(&gpu, w, &format!("{p}.attn.proj"), plan.dim_out, plan.dim_out)?,
+                norm2: GNorm::load(&gpu, w, &format!("{p}.layer_norm2"), plan.dim_out)?,
+                mlp_in: GLinear::load(&gpu, w, &format!("{p}.mlp.proj_in"), plan.dim_out, plan.dim_out * cfg.mlp_ratio)?,
+                mlp_out: GLinear::load(&gpu, w, &format!("{p}.mlp.proj_out"), plan.dim_out * cfg.mlp_ratio, plan.dim_out)?,
+                block_proj: (plan.dim != plan.dim_out).then(|| GLinear::load(&gpu, w, &format!("{p}.proj"), plan.dim, plan.dim_out)).transpose()?,
+            });
+        }
+        let mut stage_ends = vec![];
+        let mut n = 0;
+        for b in &cfg.blocks {
+            n += b;
+            stage_ends.push(n.saturating_sub(1));
+        }
+        let channels: Vec<usize> = cfg.embed_dims.iter().rev().copied().collect();
+        let neck = channels
+            .iter()
+            .enumerate()
+            .map(|(j, c)| GLinear::load_conv1x1(&gpu, w, &format!("vision_encoder.neck.convs.{j}"), *c, 256))
+            .collect::<Result<Vec<_>>>()?;
+        Ok(GpuEncoder {
+            patch_w: gpu.upload(&flat(w.get("vision_encoder.backbone.patch_embed.projection.weight", &[hidden, 3, 7, 7])?)?),
+            patch_b: gpu.upload(&flat(w.get("vision_encoder.backbone.patch_embed.projection.bias", &[hidden])?)?),
+            skip0: GLinear::load_conv1x1(&gpu, w, "mask_decoder.conv_s0", 256, 32)?,
+            skip1: GLinear::load_conv1x1(&gpu, w, "mask_decoder.conv_s1", 256, 64)?,
+            gpu,
+            eps: cfg.eps as f32,
+            cfg,
+            blocks,
+            stage_ends,
+            neck,
+            top_down: vec![2, 3],
+            pos: Mutex::default(),
+            cpu,
+        })
+    }
+
+    fn linear(&self, x: &Buf, rows: usize, l: &GLinear, out: &Buf, act: Act, residual: Option<&Buf>) -> Result<()> {
+        self.gpu.linear(x, rows, l, out, act, residual)
+    }
+
+    fn norm(&self, x: &Buf, rows: usize, dim: usize, n: &GNorm) -> Result<Buf> {
+        let out = self.gpu.zeros(rows * dim)?;
+        self.gpu.layernorm(x, &n.w, &n.b, &out, rows, dim, self.eps, false)?;
+        Ok(out)
+    }
+
+    fn pos_buffer(&self, h: usize, w: usize) -> Result<Buf> {
+        let mut map = self.pos.lock().unwrap_or_else(PoisonError::into_inner);
+        if let Some(b) = map.get(&(h, w)) {
+            return Ok(b.clone());
+        }
+        let table = self.cpu.pos(h, w)?.flatten_all()?.to_vec1::<f32>()?;
+        let buf = self.gpu.upload(&table);
+        map.insert((h, w), buf.clone());
+        Ok(buf)
+    }
+
+    /// One Hiera block on `[h * w, dim]` tokens; returns the new tokens and grid size.
+    fn block(&self, b: &GBlock, x: &Buf, h: usize, w: usize) -> Result<(Buf, usize, usize)> {
+        let g = &self.gpu;
+        let BlockPlan { dim, dim_out, heads, window, query_stride } = b.plan;
+        let n = h * w;
+        let normed = self.norm(x, n, dim, &b.norm1)?;
+        // the skip connection: from the block's input, or (stage change) its projection, pooled with the queries
+        let (oh, ow) = query_stride.map_or((h, w), |s| (h / s, w / s));
+        if query_stride.is_some_and(|s| s != 2) {
+            return Err(Error::Input("only a query stride of 2 is supported on the GPU".into()));
+        }
+        let residual = match (&b.block_proj, query_stride) {
+            (Some(p), Some(_)) => {
+                let proj = g.zeros(n * dim_out)?;
+                self.linear(&normed, n, p, &proj, Act::None, None)?;
+                let pooled = g.zeros(oh * ow * dim_out)?;
+                g.maxpool2(&proj, &pooled, 1, h, w, dim_out, (n * dim_out, w * dim_out, dim_out))?;
+                pooled
+            }
+            (Some(p), None) => {
+                let proj = g.zeros(n * dim_out)?;
+                self.linear(&normed, n, p, &proj, Act::None, None)?;
+                proj
+            }
+            (None, _) => x.clone(),
+        };
+        // windows (or the whole grid for global attention)
+        let (hw, nwin, t, win_h, win_w) = if window > 0 {
+            let (nwx, nwy) = (w.div_ceil(window), h.div_ceil(window));
+            let buf = g.zeros(nwx * nwy * window * window * dim)?;
+            g.window_partition(&normed, &buf, h, w, dim, window)?;
+            (buf, nwx * nwy, window * window, window, window)
+        } else {
+            (normed, 1, n, h, w)
+        };
+        let tok = nwin * t;
+        let qkv = g.zeros(tok * 3 * dim_out)?;
+        self.linear(&hw, tok, &b.qkv, &qkv, Act::None, None)?;
+        // queries, pooled when the stage changes
+        let (q_buf, q_rs, tq) = match query_stride {
+            Some(s) => {
+                let (qh, qw) = (win_h / s, win_w / s);
+                let pooled = g.zeros(nwin * qh * qw * dim_out)?;
+                g.maxpool2(&qkv, &pooled, nwin, win_h, win_w, dim_out, (t * 3 * dim_out, win_w * 3 * dim_out, 3 * dim_out))?;
+                (pooled, dim_out, qh * qw)
+            }
+            None => (qkv.clone(), 3 * dim_out, t),
+        };
+        let hd = dim_out / heads.max(1);
+        let scale = (hd as f32).powf(-0.5);
+        let scores = g.zeros(nwin * tq * t)?;
+        let attn = g.zeros(nwin * tq * dim_out)?;
+        for hh in 0..heads {
+            g.matmul(&Matmul {
+                m: tq,
+                n: t,
+                k: hd,
+                batch: nwin,
+                a: (&q_buf, Strides { offset: hh * hd, batch: tq * q_rs, row: q_rs, col: 1 }),
+                b: (&qkv, Strides { offset: dim_out + hh * hd, batch: t * 3 * dim_out, row: 1, col: 3 * dim_out }),
+                bias: None,
+                c: (&scores, Strides { offset: 0, batch: tq * t, row: t, col: 1 }),
+                residual: None,
+                alpha: scale,
+                act: Act::None,
+            })?;
+            g.softmax(&scores, nwin * tq, t)?;
+            g.matmul(&Matmul {
+                m: tq,
+                n: hd,
+                k: t,
+                batch: nwin,
+                a: (&scores, Strides { offset: 0, batch: tq * t, row: t, col: 1 }),
+                b: (&qkv, Strides { offset: 2 * dim_out + hh * hd, batch: t * 3 * dim_out, row: 3 * dim_out, col: 1 }),
+                bias: None,
+                c: (&attn, Strides { offset: hh * hd, batch: tq * dim_out, row: dim_out, col: 1 }),
+                residual: None,
+                alpha: 1.0,
+                act: Act::None,
+            })?;
+        }
+        let projected = g.zeros(nwin * tq * dim_out)?;
+        self.linear(&attn, nwin * tq, &b.proj, &projected, Act::None, None)?;
+        let attn_img = if window > 0 {
+            let ws = window / query_stride.unwrap_or(1);
+            let img = g.zeros(oh * ow * dim_out)?;
+            g.window_unpartition(&projected, &img, oh, ow, dim_out, ws)?;
+            img
+        } else {
+            projected
+        };
+        let n2 = oh * ow;
+        let x2 = g.zeros(n2 * dim_out)?;
+        g.add(&residual, &attn_img, &x2, n2 * dim_out)?;
+        let normed2 = self.norm(&x2, n2, dim_out, &b.norm2)?;
+        let hidden = g.zeros(n2 * b.mlp_in.out)?;
+        self.linear(&normed2, n2, &b.mlp_in, &hidden, Act::Gelu, None)?;
+        let out = g.zeros(n2 * dim_out)?;
+        self.linear(&hidden, n2, &b.mlp_out, &out, Act::None, Some(&x2))?;
+        Ok((out, oh, ow))
+    }
+
+    /// Encode normalised `[1, 3, H, W]` pixels (`H` and `W` multiples of 32).
+    pub fn encode(&self, pixels: &Tensor) -> Result<GpuFeatures> {
+        let g = &self.gpu;
+        let _turn = g.exclusive();
+        let (_, c, ph, pw) = pixels.dims4()?;
+        let window0 = self.cfg.windows.first().copied().unwrap_or(8);
+        if c != 3 || ph == 0 || pw == 0 || ph % 4 != 0 || pw % 4 != 0 || (ph / 4) % window0 != 0 || (pw / 4) % window0 != 0 {
+            return Err(Error::Input(format!("image size {pw}x{ph} does not fit the encoder")));
+        }
+        let hidden = self.cfg.embed_dims.first().copied().unwrap_or(96);
+        let px = g.upload(&pixels.contiguous()?.flatten_all()?.to_vec1::<f32>()?);
+        let (mut h, mut w) = (ph / 4, pw / 4);
+        let tokens = g.zeros(h * w * hidden)?;
+        g.patch_embed(&px, &self.patch_w, &self.patch_b, &tokens, (ph, pw, hidden))?;
+        let mut x = g.zeros(h * w * hidden)?;
+        g.add(&tokens, &self.pos_buffer(h, w)?, &x, h * w * hidden)?;
+        let mut stages: Vec<(Buf, usize, usize, usize)> = vec![];
+        for (i, b) in self.blocks.iter().enumerate() {
+            let (nx, nh, nw) = self.block(b, &x, h, w)?;
+            (x, h, w) = (nx, nh, nw);
+            // submit per block so the GPU can free the previous block's intermediates (Large would otherwise run out of memory)
+            g.flush()?;
+            if self.stage_ends.contains(&i) {
+                stages.push((x.clone(), h, w, b.plan.dim_out));
+            }
+        }
+        // the neck, from the lowest resolution up: lateral 1x1 convolutions, and the top-down sum on the levels that have it
+        let n = self.neck.len();
+        if stages.len() != n {
+            return Err(Error::Compute("the backbone returned the wrong number of stages".into()));
+        }
+        let mut levels: Vec<(Buf, usize, usize)> = vec![];
+        let mut prev: Option<(Buf, usize, usize)> = None;
+        for i in (0..n).rev() {
+            let (buf, sh, sw, _) = &stages[i];
+            let conv = self.neck.get(n - 1 - i).ok_or_else(|| Error::Compute("missing neck convolution".into()))?;
+            let lateral = g.zeros(sh * sw * 256)?;
+            self.linear(buf, sh * sw, conv, &lateral, Act::None, None)?;
+            let cur = match (&prev, self.top_down.contains(&i) && i != n - 1) {
+                (Some((p, _, _)), true) => {
+                    let sum = g.zeros(sh * sw * 256)?;
+                    g.upsample_add(&lateral, p, &sum, *sh, *sw, 256)?;
+                    sum
+                }
+                _ => lateral,
+            };
+            prev = Some((cur.clone(), *sh, *sw));
+            levels.push((cur, *sh, *sw));
+        }
+        // levels: lowest resolution first. The decoder needs the third (64 x 64) and the skip convolutions of the last two.
+        let [_, (l2, h2, w2), (l1, h1, w1), (l0, h0, w0)] = <[_; 4]>::try_from(levels).map_err(|_| Error::Compute("the neck must have four levels".into()))?;
+        let s0 = g.zeros(h0 * w0 * 32)?;
+        self.linear(&l0, h0 * w0, &self.skip0, &s0, Act::None, None)?;
+        let s1 = g.zeros(h1 * w1 * 64)?;
+        self.linear(&l1, h1 * w1, &self.skip1, &s1, Act::None, None)?;
+        g.flush()?;
+        let nchw = |buf: &Buf, hh: usize, ww: usize, ch: usize| -> Result<Tensor> {
+            let v = g.download(buf)?;
+            Ok(Tensor::from_vec(v, (1, hh, ww, ch), &Device::Cpu)?.permute((0, 3, 1, 2))?.contiguous()?)
+        };
+        Ok(GpuFeatures { low: nchw(&l2, h2, w2, 256)?, high: (nchw(&s0, h0, w0, 32)?, nchw(&s1, h1, w1, 64)?) })
+    }
+}
diff --git a/crates/sam2/src/gpu/kernels.wgsl b/crates/sam2/src/gpu/kernels.wgsl
new file mode 100644
index 000000000..faea20e76
--- /dev/null
+++ b/crates/sam2/src/gpu/kernels.wgsl
@@ -0,0 +1,165 @@
+// SAM 2 compute kernels (f32). Original work for EffectCraft; the maths follows the Hugging Face
+// `transformers` SAM 2 implementation (Apache-2.0, see NOTICE).
+//
+// Every kernel reads its parameters from one uniform: 24 u32 words (floats are bit-cast).
+
+struct P { v: array<vec4<u32>, 6> }
+@group(0) @binding(0) var<storage, read> in0: array<f32>;
+@group(0) @binding(1) var<storage, read> in1: array<f32>;
+@group(0) @binding(2) var<storage, read> in2: array<f32>;
+@group(0) @binding(3) var<storage, read_write> out0: array<f32>;
+@group(0) @binding(4) var<storage, read> in3: array<f32>;
+@group(0) @binding(5) var<uniform> p: P;
+
+fn u(i: u32) -> u32 { return p.v[i / 4u][i % 4u]; }
+fn f(i: u32) -> f32 { return bitcast<f32>(u(i)); }
+
+// erf, Abramowitz and Stegun 7.1.26 (abs error 1.5e-7).
+fn erf_(x: f32) -> f32 {
+    let s = select(1.0, -1.0, x < 0.0);
+    let a = abs(x);
+    let t = 1.0 / (1.0 + 0.3275911 * a);
+    let y = 1.0 - (((((1.061405429 * t - 1.453152027) * t) + 1.421413741) * t - 0.284496736) * t + 0.254829592) * t * exp(-a * a);
+    return s * y;
+}
+fn gelu_(x: f32) -> f32 { return (erf_(x * 0.70710678) + 1.0) * 0.5 * x; }
+
+// ---------------------------------------------------------------- strided batched matmul
+// C[b] = act(alpha * A[b] (m x k) . B[b] (k x n) + bias) (+ residual), with free strides for A and B.
+//  words: 0 m, 1 n, 2 k, 3 batch, 4 a_off, 5 a_bs, 6 a_rs, 7 a_cs, 8 b_off, 9 b_bs, 10 b_rs, 11 b_cs,
+//         12 c_off, 13 c_bs, 14 c_rs, 15 flags (bit0 bias, bits 1-2 act: 1 gelu 2 relu, bit3 residual),
+//         16 alpha (f32)
+//  in0 = A, in1 = B, in2 = bias (n), out0 = C, in3 = residual (same layout as C)
+var<workgroup> sa: array<f32, 1024>;
+var<workgroup> sb: array<f32, 1024>;
+
+@compute @workgroup_size(16, 16)
+fn matmul(@builtin(workgroup_id) wg: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let m = u(0u); let n = u(1u); let k = u(2u);
+    let a_base = u(4u) + wg.z * u(5u);
+    let b_base = u(8u) + wg.z * u(9u);
+    let a_rs = u(6u); let a_cs = u(7u); let b_rs = u(10u); let b_cs = u(11u);
+    let row0 = wg.y * 64u;
+    let col0 = wg.x * 64u;
+    let tid = li.y * 16u + li.x;
+    let a_k_contig = a_cs == 1u;
+    let b_n_contig = b_cs == 1u;
+    var acc: array<f32, 16>;
+    for (var i = 0u; i < 16u; i++) { acc[i] = 0.0; }
+    for (var kt = 0u; kt < k; kt += 16u) {
+        for (var i = 0u; i < 4u; i++) {
+            let idx = tid + i * 256u;
+            var r: u32; var c: u32;
+            if (a_k_contig) { r = idx / 16u; c = idx % 16u; } else { r = idx % 64u; c = idx / 64u; }
+            let gr = row0 + r; let gc = kt + c;
+            var va = 0.0;
+            if (gr < m && gc < k) { va = in0[a_base + gr * a_rs + gc * a_cs]; }
+            sa[r * 16u + c] = va;
+            var r2: u32; var c2: u32;
+            if (b_n_contig) { r2 = idx / 64u; c2 = idx % 64u; } else { r2 = idx % 16u; c2 = idx / 16u; }
+            let gr2 = kt + r2; let gc2 = col0 + c2;
+            var vb = 0.0;
+            if (gr2 < k && gc2 < n) { vb = in1[b_base + gr2 * b_rs + gc2 * b_cs]; }
+            sb[r2 * 64u + c2] = vb;
+        }
+        workgroupBarrier();
+        for (var kk = 0u; kk < 16u; kk++) {
+            var ar: array<f32, 4>;
+            var br: array<f32, 4>;
+            for (var i = 0u; i < 4u; i++) {
+                ar[i] = sa[(li.y * 4u + i) * 16u + kk];
+                br[i] = sb[kk * 64u + li.x * 4u + i];
+            }
+            for (var i = 0u; i < 4u; i++) {
+                for (var j = 0u; j < 4u; j++) { acc[i * 4u + j] += ar[i] * br[j]; }
+            }
+        }
+        workgroupBarrier();
+    }
+    let flags = u(15u);
+    let alpha = f(16u);
+    let c_base = u(12u) + wg.z * u(13u);
+    let c_rs = u(14u);
+    let act = (flags >> 1u) & 3u;
+    for (var i = 0u; i < 4u; i++) {
+        for (var j = 0u; j < 4u; j++) {
+            let gr = row0 + li.y * 4u + i;
+            let gc = col0 + li.x * 4u + j;
+            if (gr < m && gc < n) {
+                var v = acc[i * 4u + j] * alpha;
+                if ((flags & 1u) != 0u) { v += in2[gc]; }
+                if (act == 1u) { v = gelu_(v); } else if (act == 2u) { v = max(v, 0.0); }
+                let idx = c_base + gr * c_rs + gc;
+                if ((flags & 8u) != 0u) { v += in3[idx]; }
+                out0[idx] = v;
+            }
+        }
+    }
+}
+
+// The same, with B (a weight matrix) stored as half precision, two values per word.
+@group(0) @binding(1) var<storage, read> w16: array<u32>;
+
+@compute @workgroup_size(16, 16)
+fn matmul_w16(@builtin(workgroup_id) wg: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let m = u(0u); let n = u(1u); let k = u(2u);
+    let a_base = u(4u) + wg.z * u(5u);
+    let b_base = u(8u) + wg.z * u(9u);
+    let a_rs = u(6u); let a_cs = u(7u); let b_rs = u(10u); let b_cs = u(11u);
+    let row0 = wg.y * 64u;
+    let col0 = wg.x * 64u;
+    let tid = li.y * 16u + li.x;
+    let a_k_contig = a_cs == 1u;
+    let b_n_contig = b_cs == 1u;
+    var acc: array<f32, 16>;
+    for (var i = 0u; i < 16u; i++) { acc[i] = 0.0; }
+    for (var kt = 0u; kt < k; kt += 16u) {
+        for (var i = 0u; i < 4u; i++) {
+            let idx = tid + i * 256u;
+            var r: u32; var c: u32;
+            if (a_k_contig) { r = idx / 16u; c = idx % 16u; } else { r = idx % 64u; c = idx / 64u; }
+            let gr = row0 + r; let gc = kt + c;
+            var va = 0.0;
+            if (gr < m && gc < k) { va = in0[a_base + gr * a_rs + gc * a_cs]; }
+            sa[r * 16u + c] = va;
+            var r2: u32; var c2: u32;
+            if (b_n_contig) { r2 = idx / 64u; c2 = idx % 64u; } else { r2 = idx % 16u; c2 = idx / 16u; }
+            let gr2 = kt + r2; let gc2 = col0 + c2;
+            var vb = 0.0;
+            if (gr2 < k && gc2 < n) { let bi = b_base + gr2 * b_rs + gc2 * b_cs; vb = unpack2x16float(w16[bi >> 1u])[bi & 1u]; }
+            sb[r2 * 64u + c2] = vb;
+        }
+        workgroupBarrier();
+        for (var kk = 0u; kk < 16u; kk++) {
+            var ar: array<f32, 4>;
+            var br: array<f32, 4>;
+            for (var i = 0u; i < 4u; i++) {
+                ar[i] = sa[(li.y * 4u + i) * 16u + kk];
+                br[i] = sb[kk * 64u + li.x * 4u + i];
+            }
+            for (var i = 0u; i < 4u; i++) {
+                for (var j = 0u; j < 4u; j++) { acc[i * 4u + j] += ar[i] * br[j]; }
+            }
+        }
+        workgroupBarrier();
+    }
+    let flags = u(15u);
+    let alpha = f(16u);
+    let c_base = u(12u) + wg.z * u(13u);
+    let c_rs = u(14u);
+    let act = (flags >> 1u) & 3u;
+    for (var i = 0u; i < 4u; i++) {
+        for (var j = 0u; j < 4u; j++) {
+            let gr = row0 + li.y * 4u + i;
+            let gc = col0 + li.x * 4u + j;
+            if (gr < m && gc < n) {
+                var v = acc[i * 4u + j] * alpha;
+                if ((flags & 1u) != 0u) { v += in2[gc]; }
+                if (act == 1u) { v = gelu_(v); } else if (act == 2u) { v = max(v, 0.0); }
+                let idx = c_base + gr * c_rs + gc;
+                if ((flags & 8u) != 0u) { v += in3[idx]; }
+                out0[idx] = v;
+            }
+        }
+    }
+}
diff --git a/crates/sam2/src/gpu/kernels_ops.wgsl b/crates/sam2/src/gpu/kernels_ops.wgsl
new file mode 100644
index 000000000..419476600
--- /dev/null
+++ b/crates/sam2/src/gpu/kernels_ops.wgsl
@@ -0,0 +1,206 @@
+
+// ---------------------------------------------------------------- helpers
+// A 1-D index over n items spread on a 2-D grid of 256-thread groups (a dimension holds 65535 groups).
+fn gid1(wg: vec3<u32>, nw: vec3<u32>, li: vec3<u32>) -> u32 { return (wg.y * nw.x + wg.x) * 256u + li.x; }
+
+var<workgroup> red: array<f32, 64>;
+
+// Sum of `red` over the workgroup (64 threads), for a caller that has filled it; all threads get the result.
+fn reduce_sum(li: u32) -> f32 {
+    workgroupBarrier();
+    for (var st = 32u; st > 0u; st = st / 2u) {
+        if (li < st) { red[li] += red[li + st]; }
+        workgroupBarrier();
+    }
+    let r = red[0];
+    workgroupBarrier();
+    return r;
+}
+
+fn reduce_max(li: u32) -> f32 {
+    workgroupBarrier();
+    for (var st = 32u; st > 0u; st = st / 2u) {
+        if (li < st) { red[li] = max(red[li], red[li + st]); }
+        workgroupBarrier();
+    }
+    let r = red[0];
+    workgroupBarrier();
+    return r;
+}
+
+// ---------------------------------------------------------------- layer norm over the last dimension
+//  words: 0 rows, 1 cols, 2 eps (f32), 3 gelu (1: apply GELU to the result). in0 x, in1 weight, in2 bias, out0 y. One workgroup per row.
+@compute @workgroup_size(64)
+fn layernorm(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let row = wg.y * nw.x + wg.x;
+    let rows = u(0u); let cols = u(1u);
+    if (row >= rows) { return; }
+    let base = row * cols;
+    var s = 0.0;
+    for (var c = li.x; c < cols; c += 64u) { s += in0[base + c]; }
+    red[li.x] = s;
+    let mean = reduce_sum(li.x) / f32(cols);
+    var q = 0.0;
+    for (var c = li.x; c < cols; c += 64u) { let d = in0[base + c] - mean; q += d * d; }
+    red[li.x] = q;
+    let inv = inverseSqrt(reduce_sum(li.x) / f32(cols) + f(2u));
+    for (var c = li.x; c < cols; c += 64u) {
+        var y = (in0[base + c] - mean) * inv * in1[c] + in2[c];
+        if (u(3u) == 1u) { y = gelu_(y); }
+        out0[base + c] = y;
+    }
+}
+
+// ---------------------------------------------------------------- convolution over channels-last [H, W, Ci]
+//  words: 0 n (output elements), 1 H, 2 W, 3 Ci, 4 Co, 5 Ho, 6 Wo, 7 k, 8 stride, 9 pad, 10 groups.
+//  in0 input, in1 weight [Co, Ci / groups, k, k], in2 bias [Co]; output [Ho, Wo, Co].
+@compute @workgroup_size(256)
+fn conv2d(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let H = u(1u); let W = u(2u); let Ci = u(3u); let Co = u(4u); let Wo = u(6u);
+    let k = u(7u); let stride = u(8u); let pad = i32(u(9u)); let groups = u(10u);
+    let co = i % Co; let t = i / Co;
+    let ox = t % Wo; let oy = t / Wo;
+    let cig = Ci / groups;
+    let g0 = co / (Co / groups);
+    var acc = in2[co];
+    for (var c = 0u; c < cig; c++) {
+        let ci = g0 * cig + c;
+        for (var ky = 0u; ky < k; ky++) {
+            let iy = i32(oy * stride + ky) - pad;
+            if (iy < 0 || iy >= i32(H)) { continue; }
+            for (var kx = 0u; kx < k; kx++) {
+                let ix = i32(ox * stride + kx) - pad;
+                if (ix < 0 || ix >= i32(W)) { continue; }
+                acc += in0[(u32(iy) * W + u32(ix)) * Ci + ci] * in1[((co * cig + c) * k + ky) * k + kx];
+            }
+        }
+    }
+    out0[i] = acc;
+}
+
+// ---------------------------------------------------------------- softmax over rows, in place on out0
+//  words: 0 rows, 1 cols. One workgroup per row.
+@compute @workgroup_size(64)
+fn softmax(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let row = wg.y * nw.x + wg.x;
+    let rows = u(0u); let cols = u(1u);
+    if (row >= rows) { return; }
+    let base = row * cols;
+    var mx = -3.0e38;
+    for (var c = li.x; c < cols; c += 64u) { mx = max(mx, out0[base + c]); }
+    red[li.x] = mx;
+    let m = reduce_max(li.x);
+    var s = 0.0;
+    for (var c = li.x; c < cols; c += 64u) { let e = exp(out0[base + c] - m); out0[base + c] = e; s += e; }
+    red[li.x] = s;
+    let inv = 1.0 / reduce_sum(li.x);
+    for (var c = li.x; c < cols; c += 64u) { out0[base + c] = out0[base + c] * inv; }
+}
+
+// ---------------------------------------------------------------- elementwise add: out0 = in0 + in1 (n items)
+@compute @workgroup_size(256)
+fn add(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i < u(0u)) { out0[i] = in0[i] + in1[i]; }
+}
+
+// ---------------------------------------------------------------- windows
+//  words: 0 n (output elements), 1 H, 2 W, 3 C, 4 ws, 5 windows across (nwx)
+//  window_partition: [H, W, C] -> [nwin, ws, ws, C] (zero padded); window_unpartition: the inverse.
+@compute @workgroup_size(256)
+fn window_partition(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let H = u(1u); let W = u(2u); let C = u(3u); let ws = u(4u); let nwx = u(5u);
+    let c = i % C; var t = i / C;
+    let x = t % ws; t = t / ws;
+    let y = t % ws; let win = t / ws;
+    let gy = (win / nwx) * ws + y;
+    let gx = (win % nwx) * ws + x;
+    var v = 0.0;
+    if (gy < H && gx < W) { v = in0[(gy * W + gx) * C + c]; }
+    out0[i] = v;
+}
+
+@compute @workgroup_size(256)
+fn window_unpartition(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let W = u(2u); let C = u(3u); let ws = u(4u); let nwx = u(5u);
+    let c = i % C; let t = i / C;
+    let gx = t % W; let gy = t / W;
+    let win = (gy / ws) * nwx + gx / ws;
+    out0[i] = in0[((win * ws + gy % ws) * ws + gx % ws) * C + c];
+}
+
+// ---------------------------------------------------------------- 2 x 2 max pool over [nb, h, w, c] tokens
+//  words: 0 n (output elements), 1 nb, 2 h, 3 w, 4 c, 5 src image stride, 6 src row stride, 7 src token stride
+//  (so it can read the q third of a qkv buffer in place). Output [nb, h/2, w/2, c] contiguous.
+@compute @workgroup_size(256)
+fn maxpool2(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let h = u(2u); let w = u(3u); let c = u(4u);
+    let oh = h / 2u; let ow = w / 2u;
+    let ch = i % c; var t = i / c;
+    let ox = t % ow; t = t / ow;
+    let oy = t % oh; let img = t / oh;
+    let base = img * u(5u) + (oy * 2u) * u(6u) + (ox * 2u) * u(7u) + ch;
+    out0[i] = max(max(in0[base], in0[base + u(7u)]), max(in0[base + u(6u)], in0[base + u(6u) + u(7u)]));
+}
+
+// ---------------------------------------------------------------- patch embedding: 7 x 7 stride 4 pad 3 convolution
+//  words: 0 n (output elements), 1 H, 2 W, 3 Co, 4 Ho, 5 Wo. in0 pixels [3, H, W], in1 weight [Co, 3, 7, 7],
+//  in2 bias [Co]. Output [Ho, Wo, Co].
+@compute @workgroup_size(256)
+fn patch_embed(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let H = u(1u); let W = u(2u); let Co = u(3u); let Wo = u(5u);
+    let co = i % Co; let t = i / Co;
+    let ox = t % Wo; let oy = t / Wo;
+    var acc = in2[co];
+    for (var ci = 0u; ci < 3u; ci++) {
+        for (var ky = 0u; ky < 7u; ky++) {
+            let iy = i32(oy * 4u + ky) - 3;
+            if (iy < 0 || iy >= i32(H)) { continue; }
+            for (var kx = 0u; kx < 7u; kx++) {
+                let ix = i32(ox * 4u + kx) - 3;
+                if (ix < 0 || ix >= i32(W)) { continue; }
+                acc += in0[ci * H * W + u32(iy) * W + u32(ix)] * in1[((co * 3u + ci) * 7u + ky) * 7u + kx];
+            }
+        }
+    }
+    out0[i] = acc;
+}
+
+// ---------------------------------------------------------------- rotary position encoding on [rows, cols]
+//  words: 0 n (= rows * cols), 1 cols, 2 table rows, 3 rows rotated (the rest is copied). in0 x, in1 cos, in2 sin
+//  (tables [table rows, cols]); pairs (x0, x1) -> (x0 c - x1 s, x1 c + x0 s).
+@compute @workgroup_size(256)
+fn rope(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let cols = u(1u);
+    let row = i / cols; let col = i % cols;
+    if (row >= u(3u)) { out0[i] = in0[i]; return; }
+    let t = (row % u(2u)) * cols + col;
+    let x = in0[i];
+    var pair = 0.0;
+    if ((col & 1u) == 1u) { pair = in0[i - 1u]; } else { pair = in0[i + 1u]; }
+    if ((col & 1u) == 0u) { out0[i] = x * in1[t] - pair * in2[t]; } else { out0[i] = x * in1[t] + pair * in2[t]; }
+}
+
+// ---------------------------------------------------------------- neck: lateral + nearest 2x upsample of prev
+//  words: 0 n (output elements), 1 h, 2 w, 3 c. in0 lateral [h, w, c], in1 prev [h/2, w/2, c].
+@compute @workgroup_size(256)
+fn upsample_add(@builtin(workgroup_id) wg: vec3<u32>, @builtin(num_workgroups) nw: vec3<u32>, @builtin(local_invocation_id) li: vec3<u32>) {
+    let i = gid1(wg, nw, li);
+    if (i >= u(0u)) { return; }
+    let w = u(2u); let c = u(3u);
+    let ch = i % c; let t = i / c;
+    let x = t % w; let y = t / w;
+    out0[i] = in0[i] + in1[(((y / 2u) * (w / 2u)) + x / 2u) * c + ch];
+}
diff --git a/crates/sam2/src/gpu/memattn.rs b/crates/sam2/src/gpu/memattn.rs
new file mode 100644
index 000000000..38c5139a7
--- /dev/null
+++ b/crates/sam2/src/gpu/memattn.rs
@@ -0,0 +1,184 @@
+// Original work for EffectCraft; the maths follows the Hugging Face `transformers` SAM 2 video
+// implementation (Apache-2.0, see NOTICE).
+//! Memory attention on the GPU: four layers of self-attention over the current frame and cross-attention to
+//! the memory bank, with axial rotary position encoding. The attention is one head of 256 channels; the
+//! score matrix against a full memory bank is 4096 x 28736 floats, which stays on the GPU.
+
+use std::sync::Arc;
+
+use candle_core::{Device, Tensor};
+
+use super::{Act, Buf, GLinear, GNorm, Gpu, Matmul, Strides};
+use crate::memattn::{GRID, rope_tables};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+const DIM: usize = 256;
+const LAYERS: usize = 4;
+
+struct GAttn {
+    q: GLinear,
+    k: GLinear,
+    v: GLinear,
+    o: GLinear,
+}
+
+struct GLayer {
+    self_attn: GAttn,
+    cross: GAttn,
+    ln1: GNorm,
+    ln2: GNorm,
+    ln3: GNorm,
+    lin1: GLinear,
+    lin2: GLinear,
+}
+
+pub struct GpuMemoryAttention {
+    gpu: Arc<Gpu>,
+    layers: Vec<GLayer>,
+    final_ln: GNorm,
+    cos: Buf,
+    sin: Buf,
+}
+
+fn attn(g: &Gpu, w: &Weights, prefix: &str, kv: usize) -> Result<GAttn> {
+    Ok(GAttn {
+        q: GLinear::load(g, w, &format!("{prefix}.q_proj"), DIM, DIM)?,
+        k: GLinear::load(g, w, &format!("{prefix}.k_proj"), kv, DIM)?,
+        v: GLinear::load(g, w, &format!("{prefix}.v_proj"), kv, DIM)?,
+        o: GLinear::load(g, w, &format!("{prefix}.o_proj"), DIM, DIM)?,
+    })
+}
+
+impl GpuMemoryAttention {
+    pub fn load(gpu: Arc<Gpu>, w: &Weights) -> Result<GpuMemoryAttention> {
+        let layers = (0..LAYERS)
+            .map(|i| {
+                let p = format!("memory_attention.layers.{i}");
+                Ok(GLayer {
+                    self_attn: attn(&gpu, w, &format!("{p}.self_attn"), DIM)?,
+                    cross: attn(&gpu, w, &format!("{p}.cross_attn_image"), 64)?,
+                    ln1: GNorm::load(&gpu, w, &format!("{p}.layer_norm1"), DIM)?,
+                    ln2: GNorm::load(&gpu, w, &format!("{p}.layer_norm2"), DIM)?,
+                    ln3: GNorm::load(&gpu, w, &format!("{p}.layer_norm3"), DIM)?,
+                    lin1: GLinear::load(&gpu, w, &format!("{p}.linear1"), DIM, 2048)?,
+                    lin2: GLinear::load(&gpu, w, &format!("{p}.linear2"), 2048, DIM)?,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        let (cos, sin) = rope_tables(10000.0)?;
+        let flat = |t: Tensor| -> Result<Vec<f32>> { Ok(t.flatten_all()?.to_vec1::<f32>()?) };
+        Ok(GpuMemoryAttention {
+            final_ln: GNorm::load(&gpu, w, "memory_attention.layer_norm", DIM)?,
+            cos: gpu.upload(&flat(cos)?),
+            sin: gpu.upload(&flat(sin)?),
+            layers,
+            gpu,
+        })
+    }
+
+    fn norm(&self, x: &Buf, rows: usize, n: &GNorm) -> Result<Buf> {
+        let out = self.gpu.zeros(rows * DIM)?;
+        self.gpu.layernorm(x, &n.w, &n.b, &out, rows, DIM, 1e-5, false)?;
+        Ok(out)
+    }
+
+    fn rope(&self, x: &Buf, rows: usize, rotated: usize) -> Result<Buf> {
+        let out = self.gpu.zeros(rows * DIM)?;
+        self.gpu.rope(x, &self.cos, &self.sin, &out, rows, DIM, GRID * GRID, rotated)?;
+        Ok(out)
+    }
+
+    /// `softmax(q . k^T / 16) . v` for `[nq, 256]` queries and `[nk, 256]` keys and values, through `scores`
+    /// (at least `nq * nk` elements); returns `[nq, 256]`.
+    fn attention(&self, q: &Buf, k: &Buf, v: &Buf, nq: usize, nk: usize, scores: &Buf) -> Result<Buf> {
+        let g = &self.gpu;
+        g.matmul(&Matmul {
+            m: nq,
+            n: nk,
+            k: DIM,
+            batch: 1,
+            a: (q, Strides::row_major(DIM)),
+            b: (k, Strides { offset: 0, batch: 0, row: 1, col: DIM }),
+            bias: None,
+            c: (scores, Strides::row_major(nk)),
+            residual: None,
+            alpha: (DIM as f32).powf(-0.5),
+            act: Act::None,
+        })?;
+        g.softmax(scores, nq, nk)?;
+        let out = g.zeros(nq * DIM)?;
+        g.matmul(&Matmul {
+            m: nq,
+            n: DIM,
+            k: nk,
+            batch: 1,
+            a: (scores, Strides::row_major(nk)),
+            b: (v, Strides::row_major(DIM)),
+            bias: None,
+            c: (&out, Strides::row_major(DIM)),
+            residual: None,
+            alpha: 1.0,
+            act: Act::None,
+        })?;
+        Ok(out)
+    }
+
+    /// As [`crate::memattn::MemoryAttention::forward`]: `current` and `current_pos` `[4096, 256]`, `memory` and
+    /// `memory_pos` `[M, 64]`, the last `num_pointers` memory rows being object pointers (not rotated).
+    pub fn forward(&self, current: &Tensor, current_pos: &Tensor, memory: &Tensor, memory_pos: &Tensor, num_pointers: usize) -> Result<Tensor> {
+        let g = &self.gpu;
+        let _turn = g.exclusive();
+        let n = GRID * GRID;
+        if current.dims() != [n, DIM] || current_pos.dims() != [n, DIM] {
+            return Err(Error::Input(format!("current features must be [{n}, {DIM}], got {:?}", current.dims())));
+        }
+        let (m, md) = memory.dims2()?;
+        if md != 64 || memory_pos.dims() != [m, 64] {
+            return Err(Error::Input(format!("memory must be [M, 64] with a matching position encoding, got {:?}", memory.dims())));
+        }
+        let rotated = m.checked_sub(num_pointers).ok_or_else(|| Error::Input("more object pointers than memory tokens".into()))?;
+        if rotated % n != 0 {
+            return Err(Error::Input(format!("memory length {rotated} is not a multiple of {n}")));
+        }
+        let flat = |t: &Tensor| -> Result<Vec<f32>> { Ok(t.contiguous()?.flatten_all()?.to_vec1::<f32>()?) };
+        let mut x = g.upload(&flat(&(current + (current_pos * 0.1)?)?)?);
+        let mem = g.upload(&flat(memory)?);
+        let keys_in = g.upload(&flat(&(memory + memory_pos)?)?);
+        let scores = g.zeros(n * n.max(m))?;
+        for l in &self.layers {
+            // self-attention over the frame
+            let q_in = self.norm(&x, n, &l.ln1)?;
+            let (q, k, v) = (g.zeros(n * DIM)?, g.zeros(n * DIM)?, g.zeros(n * DIM)?);
+            g.linear(&q_in, n, &l.self_attn.q, &q, Act::None, None)?;
+            g.linear(&q_in, n, &l.self_attn.k, &k, Act::None, None)?;
+            g.linear(&q_in, n, &l.self_attn.v, &v, Act::None, None)?;
+            let (q, k) = (self.rope(&q, n, n)?, self.rope(&k, n, n)?);
+            let a = self.attention(&q, &k, &v, n, n, &scores)?;
+            let x1 = g.zeros(n * DIM)?;
+            g.linear(&a, n, &l.self_attn.o, &x1, Act::None, Some(&x))?;
+            // cross-attention to the memory bank
+            let q_in = self.norm(&x1, n, &l.ln2)?;
+            let q = g.zeros(n * DIM)?;
+            g.linear(&q_in, n, &l.cross.q, &q, Act::None, None)?;
+            let q = self.rope(&q, n, n)?;
+            let (k, v) = (g.zeros(m * DIM)?, g.zeros(m * DIM)?);
+            g.linear(&keys_in, m, &l.cross.k, &k, Act::None, None)?;
+            g.linear(&mem, m, &l.cross.v, &v, Act::None, None)?;
+            let k = self.rope(&k, m, rotated)?;
+            let a = self.attention(&q, &k, &v, n, m, &scores)?;
+            let x2 = g.zeros(n * DIM)?;
+            g.linear(&a, n, &l.cross.o, &x2, Act::None, Some(&x1))?;
+            // feed-forward
+            let f_in = self.norm(&x2, n, &l.ln3)?;
+            let hidden = g.zeros(n * 2048)?;
+            g.linear(&f_in, n, &l.lin1, &hidden, Act::Relu, None)?;
+            let x3 = g.zeros(n * DIM)?;
+            g.linear(&hidden, n, &l.lin2, &x3, Act::None, Some(&x2))?;
+            x = x3;
+        }
+        let out = self.norm(&x, n, &self.final_ln)?;
+        g.flush()?;
+        Ok(Tensor::from_vec(g.download(&out)?, (n, DIM), &Device::Cpu)?)
+    }
+}
diff --git a/crates/sam2/src/gpu/memenc.rs b/crates/sam2/src/gpu/memenc.rs
new file mode 100644
index 000000000..2cfa693d0
--- /dev/null
+++ b/crates/sam2/src/gpu/memenc.rs
@@ -0,0 +1,127 @@
+// Original work for EffectCraft; the maths follows the Hugging Face `transformers` SAM 2 video
+// implementation (Apache-2.0, see NOTICE).
+//! The memory encoder on the GPU: the mask is down-sampled by four strided convolutions, fused with the
+//! frame's features by two ConvNeXt-style blocks, and projected to the 64 channels of a memory.
+
+use std::sync::Arc;
+
+use candle_core::{Device, Tensor};
+
+use super::{Act, Buf, GLinear, GNorm, Gpu};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+struct GConv {
+    w: Buf,
+    b: Buf,
+    ci: usize,
+    co: usize,
+    k: usize,
+}
+
+struct GFuser {
+    dw: GConv,
+    norm: GNorm,
+    pw1: GLinear,
+    /// The layer scale is folded into this layer's weights.
+    pw2: GLinear,
+}
+
+pub struct GpuMemoryEncoder {
+    gpu: Arc<Gpu>,
+    down: Vec<(GConv, GNorm)>,
+    final_conv: GLinear,
+    feature_projection: GLinear,
+    fuser: Vec<GFuser>,
+    projection: GLinear,
+}
+
+fn conv(g: &Gpu, w: &Weights, name: &str, ci: usize, co: usize, k: usize, groups: usize) -> Result<GConv> {
+    let flat = |t: Tensor| -> Result<Vec<f32>> { Ok(t.flatten_all()?.to_vec1::<f32>()?) };
+    Ok(GConv {
+        w: g.upload(&flat(w.get(&format!("{name}.weight"), &[co, ci / groups, k, k])?)?),
+        b: g.upload(&flat(w.get(&format!("{name}.bias"), &[co])?)?),
+        ci,
+        co,
+        k,
+    })
+}
+
+impl GpuMemoryEncoder {
+    pub fn load(gpu: Arc<Gpu>, w: &Weights) -> Result<GpuMemoryEncoder> {
+        let mut down = vec![];
+        let mut ch = 1;
+        for i in 0..4 {
+            let out = ch * 4;
+            let p = format!("memory_encoder.mask_downsampler.layers.{i}");
+            down.push((conv(&gpu, w, &format!("{p}.conv"), ch, out, 3, 1)?, GNorm::load(&gpu, w, &format!("{p}.layer_norm"), out)?));
+            ch = out;
+        }
+        let fuser = (0..2)
+            .map(|i| {
+                let p = format!("memory_encoder.memory_fuser.layers.{i}");
+                let scale = w.get(&format!("{p}.scale"), &[256])?.flatten_all()?.to_vec1::<f32>()?;
+                Ok(GFuser {
+                    dw: conv(&gpu, w, &format!("{p}.depthwise_conv"), 256, 256, 7, 256)?,
+                    norm: GNorm::load(&gpu, w, &format!("{p}.layer_norm"), 256)?,
+                    pw1: GLinear::load(&gpu, w, &format!("{p}.pointwise_conv1"), 256, 1024)?,
+                    pw2: GLinear::load_scaled(&gpu, w, &format!("{p}.pointwise_conv2"), 1024, 256, &scale)?,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        Ok(GpuMemoryEncoder {
+            final_conv: GLinear::load_conv1x1(&gpu, w, "memory_encoder.mask_downsampler.final_conv", 256, 256)?,
+            feature_projection: GLinear::load_conv1x1(&gpu, w, "memory_encoder.feature_projection", 256, 256)?,
+            projection: GLinear::load_conv1x1(&gpu, w, "memory_encoder.projection", 256, 64)?,
+            down,
+            fuser,
+            gpu,
+        })
+    }
+
+    /// `features`: `[1, 256, 64, 64]`; `mask`: `[1, 1, 1024, 1024]` already scaled (`20 m - 10`). Returns the raw
+    /// memory tokens `[4096, 64]` (the occlusion embedding and bfloat16 rounding are the caller's).
+    pub fn encode(&self, features: &Tensor, mask: &Tensor) -> Result<Tensor> {
+        let g = &self.gpu;
+        let _turn = g.exclusive();
+        let flat = |t: &Tensor| -> Result<Vec<f32>> { Ok(t.contiguous()?.flatten_all()?.to_vec1::<f32>()?) };
+        if features.dims() != [1, 256, 64, 64] || mask.dims() != [1, 1, 1024, 1024] {
+            return Err(Error::Input(format!("memory encoder input shapes {:?} / {:?}", features.dims(), mask.dims())));
+        }
+        let tokens = features.permute((0, 2, 3, 1))?.contiguous()?;
+        let ftok = g.upload(&flat(&tokens)?);
+        let mut cur = g.upload(&flat(mask)?);
+        let (mut h, mut w) = (1024usize, 1024usize);
+        for (c, ln) in &self.down {
+            let (ho, wo) = (h / 2, w / 2);
+            let raw = g.zeros(ho * wo * c.co)?;
+            g.conv2d(&cur, &c.w, &c.b, &raw, (h, w, c.ci, c.co), c.k, 2, 1, 1)?;
+            let normed = g.zeros(ho * wo * c.co)?;
+            g.layernorm(&raw, &ln.w, &ln.b, &normed, ho * wo, c.co, 1e-6, true)?;
+            (cur, h, w) = (normed, ho, wo);
+        }
+        let n = h * w;
+        if n != 4096 {
+            return Err(Error::Compute(format!("the mask down-sampler ended at {w}x{h}, not 64x64")));
+        }
+        let m = g.zeros(n * 256)?;
+        g.linear(&cur, n, &self.final_conv, &m, Act::None, None)?;
+        let mut x = g.zeros(n * 256)?;
+        g.linear(&ftok, n, &self.feature_projection, &x, Act::None, Some(&m))?;
+        for b in &self.fuser {
+            let d = g.zeros(n * 256)?;
+            g.conv2d(&x, &b.dw.w, &b.dw.b, &d, (h, w, 256, 256), 7, 1, 3, 256)?;
+            let normed = g.zeros(n * 256)?;
+            g.layernorm(&d, &b.norm.w, &b.norm.b, &normed, n, 256, 1e-6, false)?;
+            let hidden = g.zeros(n * 1024)?;
+            g.linear(&normed, n, &b.pw1, &hidden, Act::Gelu, None)?;
+            let next = g.zeros(n * 256)?;
+            g.linear(&hidden, n, &b.pw2, &next, Act::None, Some(&x))?;
+            x = next;
+        }
+        let out = g.zeros(n * 64)?;
+        g.linear(&x, n, &self.projection, &out, Act::None, None)?;
+        g.flush()?;
+        Ok(Tensor::from_vec(g.download(&out)?, (n, 64), &Device::Cpu)?)
+    }
+}
diff --git a/crates/sam2/src/gpu/ops.rs b/crates/sam2/src/gpu/ops.rs
new file mode 100644
index 000000000..08143724e
--- /dev/null
+++ b/crates/sam2/src/gpu/ops.rs
@@ -0,0 +1,219 @@
+//! The non-matmul kernels, as methods of [`Gpu`] (each queues one dispatch).
+
+use super::{Buf, Gpu};
+use crate::{Error, Result};
+
+fn n32(v: usize, what: &str) -> Result<u32> {
+    u32::try_from(v).map_err(|_| Error::Compute(format!("{what} {v} does not fit a GPU index")))
+}
+
+/// A 2-D grid of groups covering `groups` (a dimension holds 65535).
+fn grid(groups: usize) -> Result<(u32, u32, u32)> {
+    let gx = groups.clamp(1, 65535);
+    Ok((n32(gx, "groups")?, n32(groups.div_ceil(gx).max(1), "groups")?, 1))
+}
+
+/// One 256-thread group per 256 items.
+fn items(n: usize) -> Result<(u32, u32, u32)> {
+    grid(n.div_ceil(256))
+}
+
+fn need(buf: &Buf, len: usize, what: &str) -> Result<()> {
+    if buf.len < len {
+        return Err(Error::Input(format!("{what}: a buffer of {} elements is smaller than the {len} needed", buf.len)));
+    }
+    Ok(())
+}
+
+impl Gpu {
+    /// `y = layer_norm(x) * weight + bias` over the last dimension of a `[rows, cols]` buffer.
+    #[allow(clippy::too_many_arguments)]
+    pub fn layernorm(&self, x: &Buf, weight: &Buf, bias: &Buf, y: &Buf, rows: usize, cols: usize, eps: f32, gelu: bool) -> Result<()> {
+        need(x, rows * cols, "layernorm x")?;
+        need(y, rows * cols, "layernorm y")?;
+        need(weight, cols, "layernorm weight")?;
+        need(bias, cols, "layernorm bias")?;
+        self.run(
+            "layernorm",
+            &[(0, x), (1, weight), (2, bias), (3, y)],
+            &[n32(rows, "rows")?, n32(cols, "cols")?, eps.to_bits(), u32::from(gelu)],
+            grid(rows)?,
+        );
+        Ok(())
+    }
+
+    /// Softmax over each of `rows` rows of `cols`, in place.
+    pub fn softmax(&self, x: &Buf, rows: usize, cols: usize) -> Result<()> {
+        need(x, rows * cols, "softmax")?;
+        self.run("softmax", &[(3, x)], &[n32(rows, "rows")?, n32(cols, "cols")?], grid(rows)?);
+        Ok(())
+    }
+
+    /// A convolution over channels-last `[h, w, ci]` with weight `[co, ci / groups, k, k]` and bias `[co]`,
+    /// output `[ho, wo, co]` (`groups == ci == co` is depthwise).
+    #[allow(clippy::too_many_arguments)]
+    pub fn conv2d(
+        &self,
+        x: &Buf,
+        weight: &Buf,
+        bias: &Buf,
+        out: &Buf,
+        dims: (usize, usize, usize, usize),
+        k: usize,
+        stride: usize,
+        pad: usize,
+        groups: usize,
+    ) -> Result<()> {
+        let (h, w, ci, co) = dims;
+        if k == 0 || stride == 0 || groups == 0 || ci % groups != 0 || co % groups != 0 || h + 2 * pad < k || w + 2 * pad < k {
+            return Err(Error::Input(format!("a {k}x{k} convolution (stride {stride}, groups {groups}) does not fit {w}x{h}x{ci} -> {co}")));
+        }
+        let (ho, wo) = ((h + 2 * pad - k) / stride + 1, (w + 2 * pad - k) / stride + 1);
+        need(x, h * w * ci, "conv2d input")?;
+        need(weight, co * (ci / groups) * k * k, "conv2d weight")?;
+        need(bias, co, "conv2d bias")?;
+        need(out, ho * wo * co, "conv2d output")?;
+        let n = ho * wo * co;
+        self.run(
+            "conv2d",
+            &[(0, x), (1, weight), (2, bias), (3, out)],
+            &[
+                n32(n, "n")?,
+                n32(h, "h")?,
+                n32(w, "w")?,
+                n32(ci, "ci")?,
+                n32(co, "co")?,
+                n32(ho, "ho")?,
+                n32(wo, "wo")?,
+                n32(k, "k")?,
+                n32(stride, "stride")?,
+                n32(pad, "pad")?,
+                n32(groups, "groups")?,
+            ],
+            items(n)?,
+        );
+        Ok(())
+    }
+
+    /// `out = a + b` over `n` elements.
+    pub fn add(&self, a: &Buf, b: &Buf, out: &Buf, n: usize) -> Result<()> {
+        need(a, n, "add a")?;
+        need(b, n, "add b")?;
+        need(out, n, "add out")?;
+        self.run("add", &[(0, a), (1, b), (3, out)], &[n32(n, "n")?], items(n)?);
+        Ok(())
+    }
+
+    /// `[h, w, c]` to `[windows, ws, ws, c]`, zero padded at the bottom and right.
+    pub fn window_partition(&self, x: &Buf, out: &Buf, h: usize, w: usize, c: usize, ws: usize) -> Result<()> {
+        if ws == 0 {
+            return Err(Error::Input("window size 0".into()));
+        }
+        let (nwx, nwy) = (w.div_ceil(ws), h.div_ceil(ws));
+        let n = nwx * nwy * ws * ws * c;
+        need(x, h * w * c, "window_partition input")?;
+        need(out, n, "window_partition output")?;
+        self.run(
+            "window_partition",
+            &[(0, x), (3, out)],
+            &[n32(n, "n")?, n32(h, "h")?, n32(w, "w")?, n32(c, "c")?, n32(ws, "ws")?, n32(nwx, "windows")?],
+            items(n)?,
+        );
+        Ok(())
+    }
+
+    /// The inverse of [`Gpu::window_partition`] (the padding is dropped).
+    pub fn window_unpartition(&self, x: &Buf, out: &Buf, h: usize, w: usize, c: usize, ws: usize) -> Result<()> {
+        if ws == 0 {
+            return Err(Error::Input("window size 0".into()));
+        }
+        let (nwx, nwy) = (w.div_ceil(ws), h.div_ceil(ws));
+        need(x, nwx * nwy * ws * ws * c, "window_unpartition input")?;
+        need(out, h * w * c, "window_unpartition output")?;
+        self.run(
+            "window_unpartition",
+            &[(0, x), (3, out)],
+            &[n32(h * w * c, "n")?, n32(h, "h")?, n32(w, "w")?, n32(c, "c")?, n32(ws, "ws")?, n32(nwx, "windows")?],
+            items(h * w * c)?,
+        );
+        Ok(())
+    }
+
+    /// 2 x 2 max pool of `nb` images of `[h, w, c]` tokens (`h` and `w` even) read with the given strides
+    /// (image, row, token) so it can pool one third of a qkv buffer in place; output contiguous.
+    #[allow(clippy::too_many_arguments)]
+    pub fn maxpool2(&self, x: &Buf, out: &Buf, nb: usize, h: usize, w: usize, c: usize, strides: (usize, usize, usize)) -> Result<()> {
+        if !h.is_multiple_of(2) || !w.is_multiple_of(2) {
+            return Err(Error::Input(format!("maxpool2 needs even sizes, got {w}x{h}")));
+        }
+        let n = nb * (h / 2) * (w / 2) * c;
+        let last = (nb.saturating_sub(1)) * strides.0 + (h - 1) * strides.1 + (w - 1) * strides.2 + c;
+        need(x, last, "maxpool2 input")?;
+        need(out, n, "maxpool2 output")?;
+        self.run(
+            "maxpool2",
+            &[(0, x), (3, out)],
+            &[
+                n32(n, "n")?,
+                n32(nb, "nb")?,
+                n32(h, "h")?,
+                n32(w, "w")?,
+                n32(c, "c")?,
+                n32(strides.0, "stride")?,
+                n32(strides.1, "stride")?,
+                n32(strides.2, "stride")?,
+            ],
+            items(n)?,
+        );
+        Ok(())
+    }
+
+    /// The patch embedding: `[3, h, w]` pixels, weight `[co, 3, 7, 7]`, bias `[co]`; output `[h/4, w/4, co]`.
+    pub fn patch_embed(&self, pixels: &Buf, weight: &Buf, bias: &Buf, out: &Buf, (h, w, co): (usize, usize, usize)) -> Result<()> {
+        let (ho, wo) = ((h + 6 - 7) / 4 + 1, (w + 6 - 7) / 4 + 1);
+        need(pixels, 3 * h * w, "patch_embed pixels")?;
+        need(weight, co * 3 * 49, "patch_embed weight")?;
+        need(bias, co, "patch_embed bias")?;
+        need(out, ho * wo * co, "patch_embed output")?;
+        let n = ho * wo * co;
+        self.run(
+            "patch_embed",
+            &[(0, pixels), (1, weight), (2, bias), (3, out)],
+            &[n32(n, "n")?, n32(h, "h")?, n32(w, "w")?, n32(co, "co")?, n32(ho, "ho")?, n32(wo, "wo")?],
+            items(n)?,
+        );
+        Ok(())
+    }
+
+    /// Rotary encoding of `[rows, cols]`: rows below `rotated` are rotated with the `[table_rows, cols]`
+    /// tables (row `r` uses table row `r % table_rows`), the rest copied.
+    #[allow(clippy::too_many_arguments)]
+    pub fn rope(&self, x: &Buf, cos: &Buf, sin: &Buf, out: &Buf, rows: usize, cols: usize, table_rows: usize, rotated: usize) -> Result<()> {
+        if !cols.is_multiple_of(2) || table_rows == 0 {
+            return Err(Error::Input("rope needs an even width and a table".into()));
+        }
+        need(x, rows * cols, "rope input")?;
+        need(out, rows * cols, "rope output")?;
+        need(cos, table_rows * cols, "rope cos")?;
+        need(sin, table_rows * cols, "rope sin")?;
+        self.run(
+            "rope",
+            &[(0, x), (1, cos), (2, sin), (3, out)],
+            &[n32(rows * cols, "n")?, n32(cols, "cols")?, n32(table_rows, "table")?, n32(rotated.min(rows), "rotated")?],
+            items(rows * cols)?,
+        );
+        Ok(())
+    }
+
+    /// `out = lateral + nearest_upsample_2x(prev)` for `[h, w, c]` (`h` and `w` even).
+    pub fn upsample_add(&self, lateral: &Buf, prev: &Buf, out: &Buf, h: usize, w: usize, c: usize) -> Result<()> {
+        if !h.is_multiple_of(2) || !w.is_multiple_of(2) {
+            return Err(Error::Input(format!("upsample_add needs even sizes, got {w}x{h}")));
+        }
+        need(lateral, h * w * c, "upsample_add lateral")?;
+        need(prev, h / 2 * (w / 2) * c, "upsample_add prev")?;
+        need(out, h * w * c, "upsample_add out")?;
+        self.run("upsample_add", &[(0, lateral), (1, prev), (3, out)], &[n32(h * w * c, "n")?, n32(h, "h")?, n32(w, "w")?, n32(c, "c")?], items(h * w * c)?);
+        Ok(())
+    }
+}
diff --git a/crates/sam2/src/gpu/tests.rs b/crates/sam2/src/gpu/tests.rs
new file mode 100644
index 000000000..09297f542
--- /dev/null
+++ b/crates/sam2/src/gpu/tests.rs
@@ -0,0 +1,489 @@
+//! Each kernel against a plain CPU computation. They skip when there is no GPU.
+
+use std::sync::{Mutex, PoisonError};
+
+use super::*;
+
+/// The one device the tests share (several devices at once upset the Vulkan loader), held for the whole
+/// test so the tests take turns.
+pub(crate) struct Shared(#[allow(dead_code)] std::sync::MutexGuard<'static, ()>, Arc<Gpu>);
+
+impl std::ops::Deref for Shared {
+    type Target = Gpu;
+    fn deref(&self) -> &Gpu {
+        &self.1
+    }
+}
+
+pub(crate) fn gpu() -> Option<Shared> {
+    static TURN: Mutex<()> = Mutex::new(());
+    let guard = TURN.lock().unwrap_or_else(PoisonError::into_inner);
+    match Gpu::shared() {
+        Ok(g) => Some(Shared(guard, g)),
+        Err(e) => {
+            eprintln!("skipped: {e}");
+            None
+        }
+    }
+}
+
+/// Deterministic pseudo-random values in -1..1.
+pub(crate) fn noise(n: usize, seed: u32) -> Vec<f32> {
+    let mut s = seed.wrapping_mul(2654435761).wrapping_add(1);
+    (0..n)
+        .map(|_| {
+            s ^= s << 13;
+            s ^= s >> 17;
+            s ^= s << 5;
+            (s % 20001) as f32 / 10000.0 - 1.0
+        })
+        .collect()
+}
+
+pub(crate) fn assert_close(got: &[f32], want: &[f32], tol: f32, what: &str) {
+    assert_eq!(got.len(), want.len(), "{what}: length");
+    let worst = got.iter().zip(want).map(|(a, b)| (a - b).abs()).fold(0f32, f32::max);
+    assert!(worst <= tol, "{what}: max abs error {worst} (tolerance {tol})");
+}
+
+fn gelu(x: f32) -> f32 {
+    use candle_core::{Device, Tensor};
+    let t = Tensor::new(&[x], &Device::Cpu).and_then(|t| t.gelu_erf()).and_then(|t| t.to_vec1::<f32>());
+    t.map(|v| v[0]).unwrap_or(f32::NAN)
+}
+
+/// `C[b][i][j] = sum_k A[b][i][k] * B[b][k][j]` by the definition, with the strides given.
+#[allow(clippy::too_many_arguments)]
+fn naive(a: &[f32], sa: Strides, b: &[f32], sb: Strides, m: usize, n: usize, k: usize, batch: usize) -> Vec<f32> {
+    let mut c = vec![0f32; batch * m * n];
+    for z in 0..batch {
+        for i in 0..m {
+            for j in 0..n {
+                let mut acc = 0f32;
+                for l in 0..k {
+                    acc += a[sa.offset + z * sa.batch + i * sa.row + l * sa.col] * b[sb.offset + z * sb.batch + l * sb.row + j * sb.col];
+                }
+                c[z * m * n + i * n + j] = acc;
+            }
+        }
+    }
+    c
+}
+
+#[test]
+fn matmul_matches_the_definition_for_awkward_sizes_and_strides() {
+    let Some(g) = gpu() else { return };
+    // (m, n, k, batch): not multiples of the 64 x 64 x 16 tile, and degenerate ones
+    for (m, n, k, batch) in [(100, 50, 37, 1), (1, 1, 1, 1), (65, 129, 17, 2), (64, 64, 16, 1), (3, 200, 96, 3), (130, 7, 300, 1)] {
+        let (av, bv) = (noise(batch * m * k, 1), noise(batch * k * n, 2));
+        let (a, b) = (g.upload(&av), g.upload(&bv));
+        let c = g.zeros(batch * m * n).unwrap();
+        let (sa, sb) = (Strides { offset: 0, batch: m * k, row: k, col: 1 }, Strides { offset: 0, batch: k * n, row: n, col: 1 });
+        let sc = Strides { offset: 0, batch: m * n, row: n, col: 1 };
+        g.matmul(&Matmul { m, n, k, batch, a: (&a, sa), b: (&b, sb), bias: None, c: (&c, sc), residual: None, alpha: 1.0, act: Act::None }).unwrap();
+        g.flush().unwrap();
+        assert_close(&g.download(&c).unwrap(), &naive(&av, sa, &bv, sb, m, n, k, batch), 2e-4 * (k as f32).sqrt(), &format!("{m}x{n}x{k} x{batch}"));
+    }
+}
+
+#[test]
+fn matmul_rejects_nonunit_output_columns() {
+    let Some(g) = gpu() else { return };
+    let value = g.upload(&[1.0]);
+    let c = g.zeros(8).unwrap();
+    for col in [0, 2] {
+        let broadcast = Strides { offset: 0, batch: 0, row: 0, col: 0 };
+        let out = Strides { offset: 0, batch: 0, row: 4, col };
+        let op = Matmul {
+            m: 2,
+            n: 2,
+            k: 1,
+            batch: 1,
+            a: (&value, broadcast),
+            b: (&value, broadcast),
+            c: (&c, out),
+            bias: None,
+            residual: None,
+            alpha: 1.0,
+            act: Act::None,
+        };
+        assert!(matches!(g.matmul(&op), Err(Error::Input(_))), "output column stride {col}");
+    }
+}
+
+#[test]
+fn matmul_zero_inner_dimension_checks_output_and_writes_bias() {
+    let Some(g) = gpu() else { return };
+    let empty = g.upload(&[]);
+    let tiny = g.zeros(1).unwrap();
+    let bias = g.upload(&[3.0, 5.0]);
+    let mut op = Matmul {
+        m: 2,
+        n: 2,
+        k: 0,
+        batch: 1,
+        a: (&empty, Strides::row_major(0)),
+        b: (&empty, Strides::row_major(2)),
+        c: (&tiny, Strides::row_major(2)),
+        bias: Some(&bias),
+        residual: None,
+        alpha: 1.0,
+        act: Act::None,
+    };
+    assert!(matches!(g.matmul(&op), Err(Error::Input(_))), "C is written even when K is zero");
+    let c = g.zeros(4).unwrap();
+    op.c = (&c, Strides::row_major(2));
+    g.matmul(&op).unwrap();
+    g.flush().unwrap();
+    assert_eq!(g.download(&c).unwrap(), [3.0, 5.0, 3.0, 5.0]);
+}
+
+#[test]
+fn matmul_rejects_overflowing_operand_offsets() {
+    let Some(g) = gpu() else { return };
+    let value = g.upload(&[1.0]);
+    let c = g.zeros(4).unwrap();
+    let broadcast = Strides { offset: 0, batch: 0, row: 0, col: 0 };
+    let out = Strides { offset: usize::MAX, batch: 0, row: 1, col: 1 };
+    let op = Matmul {
+        m: 2,
+        n: 1,
+        k: 1,
+        batch: 1,
+        a: (&value, broadcast),
+        b: (&value, broadcast),
+        c: (&c, out),
+        bias: None,
+        residual: None,
+        alpha: 1.0,
+        act: Act::None,
+    };
+    assert!(matches!(g.matmul(&op), Err(Error::Input(_))));
+}
+
+#[test]
+fn matmul_with_transposed_operands_bias_activation_and_residual() {
+    let Some(g) = gpu() else { return };
+    let (m, n, k) = (70, 90, 41);
+    let (av, wv, bias, res) = (noise(m * k, 3), noise(n * k, 4), noise(n, 5), noise(m * n, 6));
+    let (a, w, bi, r) = (g.upload(&av), g.upload(&wv), g.upload(&bias), g.upload(&res));
+    let c = g.zeros(m * n).unwrap();
+    // B is a weight stored [n, k] (a linear layer): B[k][j] = w[j * k + l]
+    let sb = Strides { offset: 0, batch: 0, row: 1, col: k };
+    let sa = Strides::row_major(k);
+    g.matmul(&Matmul {
+        m,
+        n,
+        k,
+        batch: 1,
+        a: (&a, sa),
+        b: (&w, sb),
+        bias: Some(&bi),
+        c: (&c, Strides::row_major(n)),
+        residual: Some(&r),
+        alpha: 0.5,
+        act: Act::Gelu,
+    })
+    .unwrap();
+    g.flush().unwrap();
+    let base = naive(&av, sa, &wv, sb, m, n, k, 1);
+    let want: Vec<f32> = base.iter().enumerate().map(|(i, v)| gelu(v * 0.5 + bias[i % n]) + res[i]).collect();
+    assert_close(&g.download(&c).unwrap(), &want, 1e-3, "linear + gelu + residual");
+    // relu, and a transposed A (m contiguous)
+    let at: Vec<f32> = (0..k * m).map(|i| av[(i % m) * k + i / m]).collect();
+    let (a2, c2) = (g.upload(&at), g.zeros(m * n).unwrap());
+    g.matmul(&Matmul {
+        m,
+        n,
+        k,
+        batch: 1,
+        a: (&a2, Strides { offset: 0, batch: 0, row: 1, col: m }),
+        b: (&w, sb),
+        bias: None,
+        c: (&c2, Strides::row_major(n)),
+        residual: None,
+        alpha: 1.0,
+        act: Act::Relu,
+    })
+    .unwrap();
+    g.flush().unwrap();
+    let want: Vec<f32> = base.iter().map(|v| v.max(0.0)).collect();
+    assert_close(&g.download(&c2).unwrap(), &want, 1e-3, "transposed A, relu");
+}
+
+#[test]
+fn matmul_refuses_operands_that_overrun_their_buffers() {
+    let Some(g) = gpu() else { return };
+    let (a, b, c) = (g.upload(&[1.0; 6]), g.upload(&[1.0; 6]), g.zeros(4).unwrap());
+    let ok = Matmul {
+        m: 2,
+        n: 2,
+        k: 3,
+        batch: 1,
+        a: (&a, Strides::row_major(3)),
+        b: (&b, Strides::row_major(2)),
+        bias: None,
+        c: (&c, Strides::row_major(2)),
+        residual: None,
+        alpha: 1.0,
+        act: Act::None,
+    };
+    assert!(g.matmul(&ok).is_ok());
+    let too_big = Matmul { m: 2, n: 2, k: 4, ..ok };
+    assert!(matches!(g.matmul(&too_big), Err(Error::Input(_))));
+    assert!(g.zeros(usize::MAX / 2).is_err());
+    g.flush().unwrap();
+}
+
+// ---------------------------------------------------------------- the other kernels
+
+fn run_and_read(g: &Gpu, out: &Buf) -> Vec<f32> {
+    g.flush().unwrap();
+    g.download(out).unwrap()
+}
+
+#[test]
+fn layernorm_and_softmax_match_the_definition() {
+    let Some(g) = gpu() else { return };
+    for (rows, cols) in [(7, 96), (1, 1), (300, 768), (70_000, 8)] {
+        let x = noise(rows * cols, 7);
+        let (w, b) = (noise(cols, 8), noise(cols, 9));
+        let (gx, gw, gb, gy) = (g.upload(&x), g.upload(&w), g.upload(&b), g.zeros(rows * cols).unwrap());
+        g.layernorm(&gx, &gw, &gb, &gy, rows, cols, 1e-6, false).unwrap();
+        let want: Vec<f32> = x
+            .chunks(cols)
+            .flat_map(|r| {
+                let mean = r.iter().sum::<f32>() / cols as f32;
+                let var = r.iter().map(|v| (v - mean).powi(2)).sum::<f32>() / cols as f32;
+                r.iter().enumerate().map(|(i, v)| (v - mean) / (var + 1e-6).sqrt() * w[i] + b[i]).collect::<Vec<_>>()
+            })
+            .collect();
+        assert_close(&run_and_read(&g, &gy), &want, 2e-4, &format!("layernorm {rows}x{cols}"));
+    }
+    for (rows, cols) in [(5, 64), (3, 1), (100, 4096), (2, 28736), (70_000, 64)] {
+        let x = noise(rows * cols, 10).iter().map(|v| v * 6.0).collect::<Vec<_>>();
+        let gx = g.upload(&x);
+        g.softmax(&gx, rows, cols).unwrap();
+        let want: Vec<f32> = x
+            .chunks(cols)
+            .flat_map(|r| {
+                let m = r.iter().cloned().fold(f32::MIN, f32::max);
+                let e: Vec<f32> = r.iter().map(|v| (v - m).exp()).collect();
+                let s: f32 = e.iter().sum();
+                e.into_iter().map(|v| v / s).collect::<Vec<_>>()
+            })
+            .collect();
+        assert_close(&run_and_read(&g, &gx), &want, 1e-5, &format!("softmax {rows}x{cols}"));
+    }
+}
+
+#[test]
+fn windows_pooling_and_add_match_naive_loops() {
+    let Some(g) = gpu() else { return };
+    let (h, w, c, ws) = (13, 22, 5, 8);
+    let x = noise(h * w * c, 11);
+    let (nwx, nwy) = (w.div_ceil(ws), h.div_ceil(ws));
+    let (gx, parts, back) = (g.upload(&x), g.zeros(nwx * nwy * ws * ws * c).unwrap(), g.zeros(h * w * c).unwrap());
+    g.window_partition(&gx, &parts, h, w, c, ws).unwrap();
+    g.window_unpartition(&parts, &back, h, w, c, ws).unwrap();
+    let mut want = vec![0f32; nwx * nwy * ws * ws * c];
+    for win in 0..nwx * nwy {
+        for y in 0..ws {
+            for xx in 0..ws {
+                let (gy, gxx) = ((win / nwx) * ws + y, (win % nwx) * ws + xx);
+                for ch in 0..c {
+                    if gy < h && gxx < w {
+                        want[((win * ws + y) * ws + xx) * c + ch] = x[(gy * w + gxx) * c + ch];
+                    }
+                }
+            }
+        }
+    }
+    g.flush().unwrap();
+    assert_close(&g.download(&parts).unwrap(), &want, 0.0, "window_partition");
+    assert_close(&g.download(&back).unwrap(), &x, 0.0, "window round trip");
+    assert!(g.window_partition(&gx, &parts, h, w, c, 0).is_err());
+
+    // pooling a q third of a [nb, 8, 6, 3 * c] buffer in place
+    let (nb, ph, pw, pc) = (3, 8, 6, 4);
+    let qkv = noise(nb * ph * pw * 3 * pc, 12);
+    let (gq, out) = (g.upload(&qkv), g.zeros(nb * (ph / 2) * (pw / 2) * pc).unwrap());
+    g.maxpool2(&gq, &out, nb, ph, pw, pc, (ph * pw * 3 * pc, pw * 3 * pc, 3 * pc)).unwrap();
+    let mut want = vec![];
+    for img in 0..nb {
+        for oy in 0..ph / 2 {
+            for ox in 0..pw / 2 {
+                for ch in 0..pc {
+                    let at = |y: usize, xx: usize| qkv[((img * ph + y) * pw + xx) * 3 * pc + ch];
+                    want.push(at(2 * oy, 2 * ox).max(at(2 * oy, 2 * ox + 1)).max(at(2 * oy + 1, 2 * ox)).max(at(2 * oy + 1, 2 * ox + 1)));
+                }
+            }
+        }
+    }
+    assert_close(&run_and_read(&g, &out), &want, 0.0, "maxpool2");
+    assert!(g.maxpool2(&gq, &out, nb, 7, pw, pc, (1, 1, 1)).is_err());
+
+    let (a, b) = (noise(100_001, 13), noise(100_001, 14));
+    let (ga, gb, go) = (g.upload(&a), g.upload(&b), g.zeros(a.len()).unwrap());
+    g.add(&ga, &gb, &go, a.len()).unwrap();
+    let want: Vec<f32> = a.iter().zip(&b).map(|(x, y)| x + y).collect();
+    assert_close(&run_and_read(&g, &go), &want, 0.0, "add");
+}
+
+#[test]
+fn patch_embed_rope_and_upsample_match_the_cpu_definitions() {
+    use candle_core::{Device, Tensor};
+    let Some(g) = gpu() else { return };
+    // the 7 x 7 stride 4 convolution against candle's conv2d
+    let (h, w, co) = (64usize, 96usize, 8usize);
+    let (px, wt, bias) = (noise(3 * h * w, 15), noise(co * 147, 16), noise(co, 17));
+    let (gp, gw, gb) = (g.upload(&px), g.upload(&wt), g.upload(&bias));
+    let (ho, wo) = (h / 4, w / 4);
+    let out = g.zeros(ho * wo * co).unwrap();
+    g.patch_embed(&gp, &gw, &gb, &out, (h, w, co)).unwrap();
+    let t = Tensor::from_vec(px, (1, 3, h, w), &Device::Cpu).unwrap();
+    let k = Tensor::from_vec(wt, (co, 3, 7, 7), &Device::Cpu).unwrap();
+    let want =
+        t.conv2d(&k, 3, 4, 1, 1).unwrap().broadcast_add(&Tensor::from_vec(bias, (1, co, 1, 1), &Device::Cpu).unwrap()).unwrap().permute((0, 2, 3, 1)).unwrap();
+    assert_close(&run_and_read(&g, &out), &want.flatten_all().unwrap().to_vec1::<f32>().unwrap(), 2e-4, "patch_embed");
+
+    // rotary encoding: pairs rotated with row % table rows, later rows copied
+    let (rows, cols, table, rotated) = (37usize, 16usize, 10usize, 30usize);
+    let (x, cs, sn) = (noise(rows * cols, 18), noise(table * cols, 19), noise(table * cols, 20));
+    let (gx, gc, gs, go) = (g.upload(&x), g.upload(&cs), g.upload(&sn), g.zeros(rows * cols).unwrap());
+    g.rope(&gx, &gc, &gs, &go, rows, cols, table, rotated).unwrap();
+    let mut want = x.clone();
+    for r in 0..rotated {
+        for j in 0..cols / 2 {
+            let (x0, x1) = (x[r * cols + 2 * j], x[r * cols + 2 * j + 1]);
+            let (t0, t1) = ((r % table) * cols + 2 * j, (r % table) * cols + 2 * j + 1);
+            want[r * cols + 2 * j] = x0 * cs[t0] - x1 * sn[t0];
+            want[r * cols + 2 * j + 1] = x1 * cs[t1] + x0 * sn[t1];
+        }
+    }
+    assert_close(&run_and_read(&g, &go), &want, 1e-6, "rope");
+    assert!(g.rope(&gx, &gc, &gs, &go, rows, 15, table, rotated).is_err());
+
+    // neck: lateral + nearest upsample
+    let (h, w, c) = (6usize, 10usize, 7usize);
+    let (lat, prev) = (noise(h * w * c, 21), noise(h / 2 * (w / 2) * c, 22));
+    let (gl, gp2, go) = (g.upload(&lat), g.upload(&prev), g.zeros(h * w * c).unwrap());
+    g.upsample_add(&gl, &gp2, &go, h, w, c).unwrap();
+    let want: Vec<f32> = (0..h * w * c).map(|i| lat[i] + prev[((i / c / w / 2) * (w / 2) + (i / c % w) / 2) * c + i % c]).collect();
+    assert_close(&run_and_read(&g, &go), &want, 0.0, "upsample_add");
+}
+
+#[test]
+fn convolutions_and_the_layernorm_gelu_epilogue_match_candle() {
+    use candle_core::{Device, Tensor};
+    let Some(g) = gpu() else { return };
+    // (h, w, ci, co, k, stride, pad, groups): a strided 3 x 3, a depthwise 7 x 7, and a 1-channel input
+    for (h, w, ci, co, k, stride, pad, groups) in
+        [(9usize, 13usize, 3usize, 5usize, 3usize, 2usize, 1usize, 1usize), (10, 10, 4, 4, 7, 1, 3, 4), (16, 16, 1, 4, 3, 2, 1, 1)]
+    {
+        let (x, wt, b) = (noise(h * w * ci, 30), noise(co * (ci / groups) * k * k, 31), noise(co, 32));
+        let (gx, gw, gb) = (g.upload(&x), g.upload(&wt), g.upload(&b));
+        let (ho, wo) = ((h + 2 * pad - k) / stride + 1, (w + 2 * pad - k) / stride + 1);
+        let out = g.zeros(ho * wo * co).unwrap();
+        g.conv2d(&gx, &gw, &gb, &out, (h, w, ci, co), k, stride, pad, groups).unwrap();
+        // candle works on NCHW: bring the channels-last input over, convolve, bring the result back
+        let t = Tensor::from_vec(x, (1, h, w, ci), &Device::Cpu).unwrap().permute((0, 3, 1, 2)).unwrap().contiguous().unwrap();
+        let kern = Tensor::from_vec(wt, (co, ci / groups, k, k), &Device::Cpu).unwrap();
+        let want = t
+            .conv2d(&kern, pad, stride, 1, groups)
+            .unwrap()
+            .broadcast_add(&Tensor::from_vec(b, (1, co, 1, 1), &Device::Cpu).unwrap())
+            .unwrap()
+            .permute((0, 2, 3, 1))
+            .unwrap();
+        assert_close(
+            &run_and_read(&g, &out),
+            &want.flatten_all().unwrap().to_vec1::<f32>().unwrap(),
+            2e-4,
+            &format!("conv {k}x{k} stride {stride} groups {groups}"),
+        );
+    }
+    assert!(g.conv2d(&g.upload(&[0.0; 4]), &g.upload(&[0.0; 4]), &g.upload(&[0.0; 1]), &g.zeros(4).unwrap(), (2, 2, 1, 1), 5, 1, 0, 1).is_err());
+    // layer norm followed by GELU in the same pass
+    let (rows, cols) = (50usize, 96usize);
+    let (x, wt, b) = (noise(rows * cols, 33), noise(cols, 34), noise(cols, 35));
+    let (gx, gw, gb, gy) = (g.upload(&x), g.upload(&wt), g.upload(&b), g.zeros(rows * cols).unwrap());
+    g.layernorm(&gx, &gw, &gb, &gy, rows, cols, 1e-6, true).unwrap();
+    let want: Vec<f32> = x
+        .chunks(cols)
+        .flat_map(|r| {
+            let mean = r.iter().sum::<f32>() / cols as f32;
+            let var = r.iter().map(|v| (v - mean).powi(2)).sum::<f32>() / cols as f32;
+            r.iter().enumerate().map(|(i, v)| gelu((v - mean) / (var + 1e-6).sqrt() * wt[i] + b[i])).collect::<Vec<_>>()
+        })
+        .collect();
+    assert_close(&run_and_read(&g, &gy), &want, 1e-3, "layernorm + gelu");
+}
+
+#[test]
+fn half_precision_weights_give_the_same_product_to_half_precision() {
+    let Some(g) = gpu() else { return };
+    // odd sizes: the last word holds one value; the weight is a linear layer's [n, k]
+    let (m, n, k) = (70, 91, 41);
+    let (av, wv) = (noise(m * k, 3), noise(n * k, 4));
+    let (a, w16, w32) = (g.upload(&av), g.upload_f16(&wv), g.upload(&wv));
+    assert!(w16.f16 && w16.len == n * k);
+    let (c16, c32) = (g.zeros(m * n).unwrap(), g.zeros(m * n).unwrap());
+    let sb = Strides { offset: 0, batch: 0, row: 1, col: k };
+    for (w, c) in [(&w16, &c16), (&w32, &c32)] {
+        g.matmul(&Matmul {
+            m,
+            n,
+            k,
+            batch: 1,
+            a: (&a, Strides::row_major(k)),
+            b: (w, sb),
+            bias: None,
+            c: (c, Strides::row_major(n)),
+            residual: None,
+            alpha: 1.0,
+            act: Act::None,
+        })
+        .unwrap();
+    }
+    g.flush().unwrap();
+    let (got, want) = (g.download(&c16).unwrap(), g.download(&c32).unwrap());
+    // f16 keeps 11 bits: each weight is off by at most 2^-11 relative
+    assert_close(&got, &want, 2e-3 * (k as f32).sqrt(), "f16 vs f32 weights");
+    assert!(got != want, "the weights really were rounded to half precision");
+}
+
+/// The instance reads wgpu's environment variables, as the render context's does (#2900): with
+/// `WGPU_ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER=1` wgpu lists Mesa's Dozen, the only Vulkan driver on WSL2. Run in a
+/// child process, which has them set.
+#[test]
+fn the_instance_reads_the_wgpu_environment() {
+    const CHILD: &str = "EFFECTCRAFT_TEST_SAM2_WGPU_ENV_CHILD";
+    if std::env::var_os(CHILD).is_none() {
+        let out = std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "gpu::tests::the_instance_reads_the_wgpu_environment", "--nocapture"])
+            .env(CHILD, "1")
+            .env("WGPU_ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER", "1")
+            .env("WGPU_BACKEND", "vulkan")
+            .output()
+            .unwrap();
+        let stdout = String::from_utf8_lossy(&out.stdout);
+        assert!(out.status.success() && stdout.contains("1 passed"), "{stdout}\n{}", String::from_utf8_lossy(&out.stderr));
+        return;
+    }
+    let desc = instance_descriptor();
+    assert!(desc.flags.contains(wgpu::InstanceFlags::ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER), "{:?}", desc.flags);
+    assert_eq!(desc.backends, wgpu::Backends::VULKAN);
+}
+
+/// An adapter without compute shaders (a GL one, here) is refused before a device is made on it, with one error
+/// instead of a validation error per kernel; so is a software one.
+#[test]
+fn adapters_without_compute_shaders_are_refused() {
+    use wgpu::{Backend, DeviceType, DownlevelFlags};
+    assert_eq!(refusal("GPU", Backend::Vulkan, DeviceType::DiscreteGpu, DownlevelFlags::all()), None);
+    let gl = refusal("GPU", Backend::Gl, DeviceType::Other, DownlevelFlags::all() - DownlevelFlags::COMPUTE_SHADERS);
+    assert_eq!(gl.as_deref(), Some("the GPU adapter GPU (Gl) has no compute shaders"));
+    let software = refusal("llvmpipe", Backend::Vulkan, DeviceType::Cpu, DownlevelFlags::all());
+    assert_eq!(software.as_deref(), Some("only a software adapter (llvmpipe) is available"));
+}
diff --git a/crates/sam2/src/hiera.rs b/crates/sam2/src/hiera.rs
new file mode 100644
index 000000000..82862c829
--- /dev/null
+++ b/crates/sam2/src/hiera.rs
@@ -0,0 +1,449 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2/modeling_sam2.py`
+// (Sam2PatchEmbeddings, Sam2MultiScaleAttention, Sam2MultiScaleBlock, Sam2HieraDetModel;
+// Apache-2.0, Copyright The HuggingFace Inc. team) to Rust on candle. See NOTICE.
+//! The Hiera backbone: patch embedding, windowed positional embedding, and blocks with window or
+//! global attention and query pooling at the stage changes. Activations are NHWC like the reference.
+
+use candle_core::Tensor;
+use candle_nn::{Linear, ops::softmax_last_dim};
+
+use crate::nn::{LayerNorm, Mlp, apply, layer_norm, linear};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+/// Hiera hyper-parameters (the released SAM 2.1 sizes differ only here).
+#[derive(Clone, Debug, PartialEq)]
+pub struct HieraConfig {
+    pub embed_dims: Vec<usize>,
+    pub blocks: Vec<usize>,
+    pub heads: Vec<usize>,
+    pub windows: Vec<usize>,
+    pub global_blocks: Vec<usize>,
+    pub query_stride: usize,
+    pub query_pool_stages: usize,
+    pub mlp_ratio: usize,
+    pub eps: f64,
+    pub pos_background: usize,
+}
+
+impl HieraConfig {
+    /// `facebook/sam2.1-hiera-tiny`.
+    pub fn tiny() -> HieraConfig {
+        HieraConfig {
+            embed_dims: vec![96, 192, 384, 768],
+            blocks: vec![1, 2, 7, 2],
+            heads: vec![1, 2, 4, 8],
+            windows: vec![8, 4, 14, 7],
+            global_blocks: vec![5, 7, 9],
+            query_stride: 2,
+            query_pool_stages: 3,
+            mlp_ratio: 4,
+            eps: 1e-6,
+            pos_background: 7,
+        }
+    }
+
+    /// `facebook/sam2.1-hiera-small`: the same widths as Tiny with deeper third and fourth stages.
+    pub fn small() -> HieraConfig {
+        HieraConfig { blocks: vec![1, 2, 11, 2], global_blocks: vec![7, 10, 13], ..HieraConfig::tiny() }
+    }
+
+    /// `facebook/sam2.1-hiera-base-plus`.
+    pub fn base_plus() -> HieraConfig {
+        HieraConfig {
+            embed_dims: vec![112, 224, 448, 896],
+            blocks: vec![2, 3, 16, 3],
+            heads: vec![2, 4, 8, 16],
+            global_blocks: vec![12, 16, 20],
+            pos_background: 14,
+            ..HieraConfig::tiny()
+        }
+    }
+
+    /// `facebook/sam2.1-hiera-large`.
+    pub fn large() -> HieraConfig {
+        HieraConfig {
+            embed_dims: vec![144, 288, 576, 1152],
+            blocks: vec![2, 6, 36, 4],
+            heads: vec![2, 4, 8, 16],
+            windows: vec![8, 4, 16, 8],
+            global_blocks: vec![23, 33, 43],
+            ..HieraConfig::tiny()
+        }
+    }
+
+    /// The configuration of a released size.
+    pub fn for_size(size: crate::Size) -> HieraConfig {
+        match size {
+            crate::Size::Tiny => HieraConfig::tiny(),
+            crate::Size::Small => HieraConfig::small(),
+            crate::Size::BasePlus => HieraConfig::base_plus(),
+            crate::Size::Large => HieraConfig::large(),
+        }
+    }
+}
+
+fn at<T: Copy>(v: &[T], i: usize, what: &str) -> Result<T> {
+    v.get(i).copied().ok_or_else(|| Error::Weights(format!("Hiera config has no {what} for stage {i}")))
+}
+
+/// Max pool a `[B, H, W, C]` tensor by `stride` (kernel = stride, no padding, floor), without the
+/// permutes a pooling layer would need: it groups the cells and takes the maximum over each group.
+fn do_pool(x: &Tensor, stride: usize) -> Result<Tensor> {
+    let (b, h, w, c) = x.dims4()?;
+    if stride == 0 {
+        return Err(Error::Input("pool stride 0".into()));
+    }
+    let (oh, ow) = (h / stride, w / stride);
+    let x = if oh * stride != h || ow * stride != w { x.narrow(1, 0, oh * stride)?.narrow(2, 0, ow * stride)? } else { x.clone() };
+    Ok(x.contiguous()?.reshape((b, oh, stride, ow, stride, c))?.max(2)?.max(3)?.contiguous()?)
+}
+
+/// Split `[B, H, W, C]` into `[B * nH * nW, ws, ws, C]` windows, zero padding the bottom/right.
+fn window_partition(x: &Tensor, ws: usize) -> Result<(Tensor, (usize, usize))> {
+    let (b, h, w, c) = x.dims4()?;
+    if ws == 0 {
+        return Err(Error::Input("window size 0".into()));
+    }
+    let (ph, pw) = ((ws - h % ws) % ws, (ws - w % ws) % ws);
+    let x = x.pad_with_zeros(2, 0, pw)?.pad_with_zeros(1, 0, ph)?;
+    let (nh, nw) = ((h + ph) / ws, (w + pw) / ws);
+    let x = x.reshape((b, nh, ws, nw, ws, c))?.permute((0, 1, 3, 2, 4, 5))?.contiguous()?.reshape((b * nh * nw, ws, ws, c))?;
+    Ok((x, (h + ph, w + pw)))
+}
+
+fn window_unpartition(win: &Tensor, ws: usize, padded: (usize, usize), orig: (usize, usize)) -> Result<Tensor> {
+    if ws == 0 {
+        return Err(Error::Input("window size 0".into()));
+    }
+    let (nh, nw) = (padded.0 / ws, padded.1 / ws);
+    let (n, _, _, c) = win.dims4()?;
+    let b = n / (nh * nw).max(1);
+    let x = win.reshape((b, nh, nw, ws, ws, c))?.permute((0, 1, 3, 2, 4, 5))?.contiguous()?.reshape((b, padded.0, padded.1, c))?;
+    Ok(x.narrow(1, 0, orig.0)?.narrow(2, 0, orig.1)?.contiguous()?)
+}
+
+struct Attention {
+    qkv: Linear,
+    proj: Linear,
+    heads: usize,
+    scale: f64,
+    query_stride: Option<usize>,
+}
+
+impl Attention {
+    fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        let (b, h, w, _) = x.dims4()?;
+        let qkv = apply(&self.qkv, x)?.reshape((b, h * w, 3, self.heads, ()))?;
+        let part = |i: usize| -> Result<Tensor> { Ok(qkv.narrow(2, i, 1)?.squeeze(2)?) };
+        let (mut q, k, v) = (part(0)?, part(1)?, part(2)?);
+        let (mut oh, mut ow) = (h, w);
+        if let Some(s) = self.query_stride {
+            let pooled = do_pool(&q.reshape((b, h, w, ()))?, s)?;
+            (oh, ow) = (pooled.dim(1)?, pooled.dim(2)?);
+            q = pooled.reshape((b, oh * ow, self.heads, ()))?;
+        }
+        let q = q.transpose(1, 2)?.contiguous()?;
+        let k = k.transpose(1, 2)?.contiguous()?;
+        let v = v.transpose(1, 2)?.contiguous()?;
+        // Scaling the (small) queries first equals scaling the scores, and the fused softmax is
+        // much faster than the generic one on the 4096 x 4096 global-attention maps.
+        let att = (q * self.scale)?.matmul(&k.transpose(2, 3)?.contiguous()?)?;
+        let att = softmax_last_dim(&att)?;
+        let out = att.matmul(&v)?.transpose(1, 2)?.contiguous()?.reshape((b, oh, ow, ()))?;
+        apply(&self.proj, &out)
+    }
+}
+
+/// What a block is made of: its widths, heads, window (0: global attention) and query pooling.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct BlockPlan {
+    pub dim: usize,
+    pub dim_out: usize,
+    pub heads: usize,
+    pub window: usize,
+    pub query_stride: Option<usize>,
+}
+
+impl BlockPlan {
+    pub(crate) fn new(cfg: &HieraConfig, stage: usize, block_in_stage: usize, total: usize) -> Result<BlockPlan> {
+        let first = stage > 0 && block_in_stage == 0;
+        let dim = at(&cfg.embed_dims, if first { stage - 1 } else { stage }, "embed dim")?;
+        let dim_out = at(&cfg.embed_dims, stage, "embed dim")?;
+        let window = if first { at(&cfg.windows, stage - 1, "window")? } else { at(&cfg.windows, stage, "window")? };
+        let window = if cfg.global_blocks.contains(&total) { 0 } else { window };
+        let query_stride = (stage > 0 && stage <= cfg.query_pool_stages && block_in_stage == 0).then_some(cfg.query_stride);
+        Ok(BlockPlan { dim, dim_out, heads: at(&cfg.heads, stage, "heads")?, window, query_stride })
+    }
+
+    /// Every block of the backbone, in order.
+    pub(crate) fn all(cfg: &HieraConfig) -> Result<Vec<BlockPlan>> {
+        let mut out = vec![];
+        for (stage, n) in cfg.blocks.iter().enumerate() {
+            for b in 0..*n {
+                out.push(BlockPlan::new(cfg, stage, b, out.len())?);
+            }
+        }
+        Ok(out)
+    }
+}
+
+/// One Hiera block: pre-norm attention (window or global, optionally pooling the queries) and MLP.
+pub struct Block {
+    norm1: LayerNorm,
+    attn: Attention,
+    norm2: LayerNorm,
+    mlp: Mlp,
+    proj: Option<Linear>,
+    window: usize,
+    query_stride: Option<usize>,
+}
+
+impl Block {
+    fn load(w: &Weights, cfg: &HieraConfig, stage: usize, block_in_stage: usize, total: usize) -> Result<Block> {
+        let prefix = format!("vision_encoder.backbone.blocks.{total}");
+        let plan = BlockPlan::new(cfg, stage, block_in_stage, total)?;
+        let (dim, dim_out, heads) = (plan.dim, plan.dim_out, plan.heads);
+        Ok(Block {
+            norm1: layer_norm(w, &format!("{prefix}.layer_norm1"), dim, cfg.eps)?,
+            attn: Attention {
+                qkv: linear(w, &format!("{prefix}.attn.qkv"), dim, dim_out * 3)?,
+                proj: linear(w, &format!("{prefix}.attn.proj"), dim_out, dim_out)?,
+                heads,
+                scale: ((dim_out / heads.max(1)) as f64).powf(-0.5),
+                query_stride: plan.query_stride,
+            },
+            norm2: layer_norm(w, &format!("{prefix}.layer_norm2"), dim_out, cfg.eps)?,
+            mlp: Mlp::load(w, &format!("{prefix}.mlp"), dim_out, dim_out * cfg.mlp_ratio)?,
+            proj: (dim != dim_out).then(|| linear(w, &format!("{prefix}.proj"), dim, dim_out)).transpose()?,
+            window: plan.window,
+            query_stride: plan.query_stride,
+        })
+    }
+
+    pub fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        let h = self.norm1.forward(x)?;
+        let residual = match (&self.proj, self.query_stride) {
+            (Some(p), Some(s)) => do_pool(&apply(p, &h)?, s)?,
+            (Some(p), None) => apply(p, &h)?,
+            (None, _) => x.clone(),
+        };
+        let (hh, ww) = (h.dim(1)?, h.dim(2)?);
+        let mut ws = self.window;
+        let mut padded = (hh, ww);
+        let h = if ws > 0 {
+            let (win, pad) = window_partition(&h, ws)?;
+            padded = pad;
+            win
+        } else {
+            h
+        };
+        let mut h = self.attn.forward(&h)?;
+        let mut orig = (hh, ww);
+        if let Some(s) = self.query_stride {
+            ws /= s.max(1);
+            orig = (residual.dim(1)?, residual.dim(2)?);
+            if ws > 0 {
+                padded = (orig.0 + (ws - orig.0 % ws) % ws, orig.1 + (ws - orig.1 % ws) % ws);
+            }
+        }
+        if ws > 0 {
+            h = window_unpartition(&h, ws, padded, orig)?;
+        }
+        let h = (residual + h)?;
+        let m = self.mlp.forward(&self.norm2.forward(&h)?)?;
+        Ok((h + m)?)
+    }
+}
+
+/// PyTorch `F.interpolate(mode="bicubic", align_corners=False)` of `[C, in_h, in_w]` to `[C, out_h, out_w]`.
+fn bicubic_resize(src: &[f32], c: usize, in_hw: (usize, usize), out_hw: (usize, usize)) -> Vec<f32> {
+    const A: f32 = -0.75;
+    let near = |x: f32| ((A + 2.0) * x - (A + 3.0)) * x * x + 1.0;
+    let far = |x: f32| ((A * x - 5.0 * A) * x + 8.0 * A) * x - 4.0 * A;
+    let axis = |n_in: usize, n_out: usize| -> Vec<([usize; 4], [f32; 4])> {
+        let scale = n_in as f32 / n_out.max(1) as f32;
+        (0..n_out)
+            .map(|o| {
+                let s = (o as f32 + 0.5) * scale - 0.5;
+                let i0 = s.floor();
+                let t = s - i0;
+                let w = [far(t + 1.0), near(t), near(1.0 - t), far(2.0 - t)];
+                let last = n_in as i64 - 1;
+                let idx = [-1i64, 0, 1, 2].map(|d| (i0 as i64 + d).clamp(0, last.max(0)) as usize);
+                (idx, w)
+            })
+            .collect()
+    };
+    let (ys, xs) = (axis(in_hw.0, out_hw.0), axis(in_hw.1, out_hw.1));
+    let mut out = vec![0f32; c * out_hw.0 * out_hw.1];
+    for ch in 0..c {
+        let plane = src.get(ch * in_hw.0 * in_hw.1..(ch + 1) * in_hw.0 * in_hw.1).unwrap_or(&[]);
+        for (oy, (yi, yw)) in ys.iter().enumerate() {
+            for (ox, (xi, xw)) in xs.iter().enumerate() {
+                let mut acc = 0f32;
+                for (a, wy) in yi.iter().zip(yw) {
+                    for (b, wx) in xi.iter().zip(xw) {
+                        acc += plane.get(a * in_hw.1 + b).copied().unwrap_or(0.0) * wy * wx;
+                    }
+                }
+                if let Some(o) = out.get_mut((ch * out_hw.0 + oy) * out_hw.1 + ox) {
+                    *o = acc;
+                }
+            }
+        }
+    }
+    out
+}
+
+pub struct Hiera {
+    cfg: HieraConfig,
+    patch_w: Tensor,
+    patch_b: Tensor,
+    pos_embed: Vec<f32>,
+    pos_embed_window: Vec<f32>,
+    window0: usize,
+    hidden: usize,
+    pub blocks: Vec<Block>,
+    stage_ends: Vec<usize>,
+}
+
+impl Hiera {
+    pub fn load(w: &Weights, cfg: &HieraConfig) -> Result<Hiera> {
+        let hidden = at(&cfg.embed_dims, 0, "embed dim")?;
+        let window0 = at(&cfg.windows, 0, "window")?;
+        let bg = cfg.pos_background;
+        let mut blocks = vec![];
+        let mut stage_ends = vec![];
+        for (stage, n) in cfg.blocks.iter().enumerate() {
+            for b in 0..*n {
+                blocks.push(Block::load(w, cfg, stage, b, blocks.len())?);
+            }
+            stage_ends.push(blocks.len().saturating_sub(1));
+        }
+        let flat = |t: Tensor| -> Result<Vec<f32>> { Ok(t.flatten_all()?.to_vec1::<f32>()?) };
+        Ok(Hiera {
+            cfg: cfg.clone(),
+            patch_w: w.get("vision_encoder.backbone.patch_embed.projection.weight", &[hidden, 3, 7, 7])?,
+            patch_b: w.get("vision_encoder.backbone.patch_embed.projection.bias", &[hidden])?,
+            pos_embed: flat(w.get("vision_encoder.backbone.pos_embed", &[1, hidden, bg, bg])?)?,
+            pos_embed_window: flat(w.get("vision_encoder.backbone.pos_embed_window", &[1, hidden, window0, window0])?)?,
+            window0,
+            hidden,
+            blocks,
+            stage_ends,
+        })
+    }
+
+    /// Patch embedding of `[B, 3, H, W]` pixels: `[B, H/4, W/4, C]` (before the positional embedding).
+    pub(crate) fn config(&self) -> &HieraConfig {
+        &self.cfg
+    }
+
+    pub fn patch_embed(&self, pixels: &Tensor) -> Result<Tensor> {
+        let x = pixels.conv2d(&self.patch_w, 3, 4, 1, 1)?;
+        let x = x.broadcast_add(&self.patch_b.reshape((1, self.hidden, 1, 1))?)?;
+        Ok(x.permute((0, 2, 3, 1))?.contiguous()?)
+    }
+
+    /// Background embedding resized to the grid plus the tiled window embedding, `[1, H, W, C]`.
+    pub(crate) fn pos(&self, h: usize, w: usize) -> Result<Tensor> {
+        let bg = self.cfg.pos_background;
+        let big = bicubic_resize(&self.pos_embed, self.hidden, (bg, bg), (h, w));
+        let ws = self.window0.max(1);
+        let mut out = vec![0f32; h * w * self.hidden];
+        for c in 0..self.hidden {
+            for y in 0..h {
+                for x in 0..w {
+                    let tile = self.pos_embed_window.get((c * ws + y % ws) * ws + x % ws).copied().unwrap_or(0.0);
+                    let base = big.get((c * h + y) * w + x).copied().unwrap_or(0.0);
+                    if let Some(o) = out.get_mut((y * w + x) * self.hidden + c) {
+                        *o = base + tile;
+                    }
+                }
+            }
+        }
+        Ok(Tensor::from_vec(out, (1, h, w, self.hidden), &candle_core::Device::Cpu)?)
+    }
+
+    /// Run all blocks. Returns the output of the last block of each stage (NHWC).
+    pub fn forward(&self, pixels: &Tensor) -> Result<Vec<Tensor>> {
+        let (_, _, ph, pw) = pixels.dims4()?;
+        if ph == 0 || pw == 0 || ph % 4 != 0 || pw % 4 != 0 {
+            return Err(Error::Input(format!("image size {pw}x{ph} must be a positive multiple of 4")));
+        }
+        let mut x = self.patch_embed(pixels)?;
+        let (h, w) = (x.dim(1)?, x.dim(2)?);
+        if h % self.window0 != 0 || w % self.window0 != 0 {
+            return Err(Error::Input(format!("patch grid {w}x{h} must be a multiple of {}", self.window0)));
+        }
+        x = x.broadcast_add(&self.pos(h, w)?)?;
+        let mut stages = vec![];
+        for (i, b) in self.blocks.iter().enumerate() {
+            x = b.forward(&x)?;
+            if self.stage_ends.contains(&i) {
+                stages.push(x.clone());
+            }
+        }
+        Ok(stages)
+    }
+
+    /// Run the blocks, returning every block's output (for the stage-by-stage reference test).
+    pub fn forward_all(&self, pixels: &Tensor) -> Result<(Tensor, Vec<Tensor>)> {
+        let emb = self.patch_embed(pixels)?;
+        let (h, w) = (emb.dim(1)?, emb.dim(2)?);
+        let mut x = emb.broadcast_add(&self.pos(h, w)?)?;
+        let mut outs = vec![];
+        for b in &self.blocks {
+            x = b.forward(&x)?;
+            outs.push(x.clone());
+        }
+        Ok((emb, outs))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use candle_core::Device;
+
+    #[test]
+    fn bicubic_of_a_constant_is_that_constant() {
+        let out = bicubic_resize(&[2.5; 49], 1, (7, 7), (32, 32));
+        assert!(out.iter().all(|v| (v - 2.5).abs() < 1e-5));
+    }
+
+    #[test]
+    fn bicubic_identity_size_is_identity() {
+        let src: Vec<f32> = (0..49).map(|i| (i as f32 * 0.37).sin()).collect();
+        let out = bicubic_resize(&src, 1, (7, 7), (7, 7));
+        assert!(src.iter().zip(&out).all(|(a, b)| (a - b).abs() < 1e-5));
+    }
+
+    #[test]
+    fn windows_round_trip_with_padding() {
+        let x = Tensor::arange(0f32, 60.0, &Device::Cpu).unwrap().reshape((1, 5, 6, 2)).unwrap();
+        let (win, pad) = window_partition(&x, 4).unwrap();
+        assert_eq!((win.dims(), pad), (&[4, 4, 4, 2][..], (8, 8)));
+        let back = window_unpartition(&win, 4, pad, (5, 6)).unwrap();
+        let d = (back - x).unwrap().abs().unwrap().sum_all().unwrap().to_scalar::<f32>().unwrap();
+        assert_eq!(d, 0.0);
+    }
+
+    #[test]
+    fn pooling_equals_a_max_pool_layer_including_odd_sizes() {
+        let x = Tensor::randn(0f32, 1.0, (2, 7, 9, 5), &Device::Cpu).unwrap();
+        let want = x.permute((0, 3, 1, 2)).unwrap().contiguous().unwrap().max_pool2d_with_stride(2, 2).unwrap().permute((0, 2, 3, 1)).unwrap();
+        let got = do_pool(&x, 2).unwrap();
+        assert_eq!(got.dims(), want.dims());
+        let d = (got - want).unwrap().abs().unwrap().sum_all().unwrap().to_scalar::<f32>().unwrap();
+        assert_eq!(d, 0.0);
+        assert!(do_pool(&x, 0).is_err());
+    }
+
+    #[test]
+    fn zero_window_is_an_error_not_a_panic() {
+        let x = Tensor::zeros((1, 4, 4, 2), candle_core::DType::F32, &Device::Cpu).unwrap();
+        assert!(window_partition(&x, 0).is_err());
+    }
+}
diff --git a/crates/sam2/src/lib.rs b/crates/sam2/src/lib.rs
new file mode 100644
index 000000000..f2aba0390
--- /dev/null
+++ b/crates/sam2/src/lib.rs
@@ -0,0 +1,145 @@
+//! SAM 2.1 video object tracker (Hiera backbone) for the Roto Brush.
+//!
+//! A Rust port of the Hugging Face `transformers` SAM 2 implementation (Apache-2.0; see
+//! `NOTICE`). Native only: the crate is empty on wasm32 so L0–L4 still build for the web.
+//! Nothing here loads weights unless asked to; weights are never bundled.
+//!
+//! Modules are added stage by stage, each checked against reference tensors produced by
+//! `tools/sam2_reference.py`.
+#![cfg(not(target_arch = "wasm32"))]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use std::fmt;
+
+pub mod decoder;
+pub mod gpu;
+pub mod hiera;
+pub mod mask;
+pub mod memattn;
+pub mod memory;
+pub mod model;
+pub mod neck;
+pub mod nn;
+pub mod prompt;
+pub mod resize;
+pub mod session;
+pub mod track;
+pub mod weights;
+
+/// Everything that can go wrong in this crate. Never a panic.
+#[derive(Debug, Clone, PartialEq)]
+pub enum Error {
+    /// The weights file is missing a tensor, has the wrong shape, or contains non-finite values.
+    Weights(String),
+    /// The input (frame size, prompt, frame index) is unusable.
+    Input(String),
+    /// The work was cancelled by the caller.
+    Cancelled,
+    /// A time or memory budget was exceeded.
+    Budget(String),
+    /// A tensor operation failed (shape mismatch, out of memory, device error).
+    Compute(String),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::Weights(m) => write!(f, "SAM 2 weights: {m}"),
+            Error::Input(m) => write!(f, "SAM 2 input: {m}"),
+            Error::Cancelled => write!(f, "SAM 2: cancelled"),
+            Error::Budget(m) => write!(f, "SAM 2 budget: {m}"),
+            Error::Compute(m) => write!(f, "SAM 2 compute: {m}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+impl From<candle_core::Error> for Error {
+    fn from(e: candle_core::Error) -> Error {
+        Error::Compute(e.to_string())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+/// The released SAM 2.1 sizes. Only Tiny is wired up first; the others are configuration.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Size {
+    Tiny,
+    Small,
+    BasePlus,
+    Large,
+}
+
+impl Size {
+    /// The Hugging Face repository the official weights come from.
+    pub fn repo(self) -> &'static str {
+        match self {
+            Size::Tiny => "facebook/sam2.1-hiera-tiny",
+            Size::Small => "facebook/sam2.1-hiera-small",
+            Size::BasePlus => "facebook/sam2.1-hiera-base-plus",
+            Size::Large => "facebook/sam2.1-hiera-large",
+        }
+    }
+
+    /// The size a checkpoint is, from its tensors: the width of the patch embedding (96 for Tiny and Small, 112 for
+    /// Base+, 144 for Large) and the number of blocks (12 for Tiny, 16 for Small).
+    pub fn detect(w: &weights::Weights) -> Result<Size> {
+        let width = w.shape("vision_encoder.backbone.patch_embed.projection.weight").and_then(|s| s.first().copied());
+        Ok(match width {
+            Some(112) => Size::BasePlus,
+            Some(144) => Size::Large,
+            Some(96) if w.contains("vision_encoder.backbone.blocks.15.layer_norm1.weight") => Size::Small,
+            Some(96) => Size::Tiny,
+            _ => return Err(Error::Weights("this checkpoint is not a SAM 2.1 Hiera size (patch embedding width)".into())),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sizes_name_their_official_repositories() {
+        assert_eq!(Size::Tiny.repo(), "facebook/sam2.1-hiera-tiny");
+        assert!(Size::Large.repo().ends_with("large"));
+    }
+
+    #[test]
+    fn configs_match_the_released_sizes() {
+        let blocks = |s| hiera::HieraConfig::for_size(s).blocks.iter().sum::<usize>();
+        assert_eq!([Size::Tiny, Size::Small, Size::BasePlus, Size::Large].map(blocks), [12, 16, 24, 48]);
+        for s in [Size::Tiny, Size::Small, Size::BasePlus, Size::Large] {
+            let c = hiera::HieraConfig::for_size(s);
+            assert_eq!((c.embed_dims.len(), c.heads.len(), c.windows.len()), (4, 4, 4));
+            assert!(c.global_blocks.iter().all(|g| *g < blocks(s)));
+        }
+    }
+
+    #[test]
+    fn size_comes_from_the_patch_embedding_and_depth() {
+        use candle_core::{DType, Device, Tensor};
+        let make = |width: usize, deep: bool| {
+            let mut m = std::collections::HashMap::new();
+            m.insert("vision_encoder.backbone.patch_embed.projection.weight".to_string(), Tensor::zeros((width, 3, 7, 7), DType::F32, &Device::Cpu).unwrap());
+            if deep {
+                m.insert("vision_encoder.backbone.blocks.15.layer_norm1.weight".to_string(), Tensor::zeros(4, DType::F32, &Device::Cpu).unwrap());
+            }
+            weights::Weights::from_map(m).unwrap()
+        };
+        assert_eq!(Size::detect(&make(96, false)).unwrap(), Size::Tiny);
+        assert_eq!(Size::detect(&make(96, true)).unwrap(), Size::Small);
+        assert_eq!(Size::detect(&make(112, false)).unwrap(), Size::BasePlus);
+        assert_eq!(Size::detect(&make(144, false)).unwrap(), Size::Large);
+        assert!(Size::detect(&make(64, false)).is_err());
+        assert!(Size::detect(&weights::Weights::from_map(Default::default()).unwrap()).is_err());
+    }
+
+    #[test]
+    fn errors_say_what_failed() {
+        assert!(Error::Input("empty frame".into()).to_string().contains("empty frame"));
+        assert_eq!(Error::Cancelled.to_string(), "SAM 2: cancelled");
+    }
+}
diff --git a/crates/sam2/src/mask.rs b/crates/sam2/src/mask.rs
new file mode 100644
index 000000000..382f9b514
--- /dev/null
+++ b/crates/sam2/src/mask.rs
@@ -0,0 +1,227 @@
+// Modified work: wraps the ported SAM 2 image path behind EffectCraft's `MaskModel` interface
+// (Apache-2.0, see NOTICE).
+//! SAM 2 as a drop-in [`MaskModel`]: a frame and a prompt in, a foreground probability per pixel
+//! out. The frame's encoding is cached, so further strokes on the same frame cost one decode.
+
+use std::sync::{Arc, Mutex, PoisonError};
+
+use candle_core::{Device, Tensor};
+use effectcraft_segment::{MaskModel, ModelInfo, SAM2_TINY};
+
+use crate::model::Encoded;
+use crate::prompt::{INPUT_SIZE, Prompt};
+use crate::session::VideoModel;
+use crate::{Error, Result};
+
+/// Largest frame accepted (pixels per side and in total).
+const MAX_SIDE: usize = 16_384;
+const MAX_PIXELS: usize = 100_000_000;
+
+/// Resize `w x h` RGB (0..1) to the model input and normalise it: `[1, 3, 1024, 1024]`.
+pub fn preprocess(rgb: &[[f32; 3]], w: usize, h: usize) -> Result<Tensor> {
+    let pixels = validate_frame_size(w, h, rgb.len())?;
+    const MEAN: [f32; 3] = [0.485, 0.456, 0.406];
+    const STD: [f32; 3] = [0.229, 0.224, 0.225];
+    let mut planar = vec![0f32; 3 * pixels];
+    for (i, px) in rgb.iter().enumerate() {
+        for c in 0..3 {
+            let v = px.get(c).copied().unwrap_or(0.0);
+            if let Some(o) = planar.get_mut(c * pixels + i) {
+                *o = if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 };
+            }
+        }
+    }
+    let x = Tensor::from_vec(planar, (1, 3, h, w), &Device::Cpu)?.upsample_bilinear2d(INPUT_SIZE, INPUT_SIZE, false)?;
+    let mean = Tensor::from_slice(&MEAN, (1, 3, 1, 1), &Device::Cpu)?;
+    let std = Tensor::from_slice(&STD, (1, 3, 1, 1), &Device::Cpu)?;
+    Ok(x.broadcast_sub(&mean)?.broadcast_div(&std)?)
+}
+
+pub(crate) fn validate_frame_size(w: usize, h: usize, len: usize) -> Result<usize> {
+    w.checked_mul(h)
+        .filter(|n| *n > 0 && *n == len && w <= MAX_SIDE && h <= MAX_SIDE && *n <= MAX_PIXELS)
+        .ok_or_else(|| Error::Input(format!("a {w} x {h} frame needs {} pixels (at most {MAX_PIXELS}), got {len}", w.saturating_mul(h))))
+}
+
+fn fingerprint(rgb: &[[f32; 3]], w: usize, h: usize) -> u64 {
+    let mut hash = 0xcbf2_9ce4_8422_2325u64 ^ ((w as u64) << 32 | h as u64);
+    for px in rgb {
+        for v in px {
+            hash = (hash ^ u64::from(v.to_bits())).wrapping_mul(0x0100_0000_01b3);
+        }
+    }
+    hash
+}
+
+/// SAM 2 for single frames.
+pub struct Sam2Mask {
+    model: Arc<VideoModel>,
+    info: &'static ModelInfo,
+    last: Mutex<Option<(u64, Arc<Encoded>)>>,
+    used: Mutex<std::time::Instant>,
+    pub(crate) peak: std::sync::atomic::AtomicU64,
+}
+
+impl Sam2Mask {
+    pub fn new(model: Arc<VideoModel>) -> Sam2Mask {
+        Sam2Mask::with_info(model, &SAM2_TINY)
+    }
+
+    /// A model of a given registry entry (its size).
+    pub fn with_info(model: Arc<VideoModel>, info: &'static ModelInfo) -> Sam2Mask {
+        Sam2Mask { model, info, last: Mutex::new(None), used: Mutex::new(std::time::Instant::now()), peak: std::sync::atomic::AtomicU64::new(0) }
+    }
+
+    /// Note that the model is being used (for [`MaskModel::idle_secs`]).
+    pub(crate) fn touch(&self) {
+        *self.used.lock().unwrap_or_else(PoisonError::into_inner) = std::time::Instant::now();
+    }
+
+    /// The video model, for trackers built on the same weights.
+    pub fn video_model(&self) -> &Arc<VideoModel> {
+        &self.model
+    }
+
+    fn encoded(&self, rgb: &[[f32; 3]], w: usize, h: usize) -> Result<Arc<Encoded>> {
+        let key = fingerprint(rgb, w, h);
+        if let Some((k, e)) = self.last.lock().unwrap_or_else(PoisonError::into_inner).as_ref()
+            && *k == key
+        {
+            return Ok(e.clone());
+        }
+        let enc = Arc::new(self.model.encode(&preprocess(rgb, w, h)?)?);
+        *self.last.lock().unwrap_or_else(PoisonError::into_inner) = Some((key, enc.clone()));
+        Ok(enc)
+    }
+
+    fn probability(&self, rgb: &[[f32; 3]], w: usize, h: usize, prompt: &effectcraft_segment::Prompt) -> Result<Vec<f32>> {
+        let enc = self.encoded(rgb, w, h)?;
+        let (sx, sy) = (INPUT_SIZE as f32 / w as f32, INPUT_SIZE as f32 / h as f32);
+        let p = Prompt {
+            points: prompt.points.iter().map(|(c, fg)| ([c[0] * sx, c[1] * sy], *fg)).collect(),
+            bbox: prompt.bbox.map(|b| [b[0] * sx, b[1] * sy, b[2] * sx, b[3] * sy]),
+        };
+        if p.points.is_empty() && p.bbox.is_none() {
+            return Err(Error::Input("SAM 2 needs at least one point or a box".into()));
+        }
+        let multimask = p.points.len() + 2 * usize::from(p.bbox.is_some()) <= 1;
+        let out = self.model.image.segment(&enc, &p, multimask)?;
+        let ious = out.iou.flatten_all()?.to_vec1::<f32>()?;
+        let best = ious.iter().enumerate().fold((0usize, f32::NEG_INFINITY), |b, (i, v)| if *v > b.1 { (i, *v) } else { b }).0;
+        let logits = out.masks.narrow(1, best, 1)?.upsample_bilinear2d(h, w, false)?;
+        Ok(candle_nn::ops::sigmoid(&logits)?.flatten_all()?.to_vec1::<f32>()?)
+    }
+}
+
+impl MaskModel for Sam2Mask {
+    fn info(&self) -> &'static ModelInfo {
+        self.info
+    }
+
+    fn segment(&self, rgb: &[[f32; 3]], w: usize, h: usize, prompt: &effectcraft_segment::Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+        self.touch();
+        self.probability(rgb, w, h, prompt).map_err(|e| e.to_string())
+    }
+
+    fn tracker(&self) -> Option<&dyn effectcraft_segment::ObjectTracker> {
+        Some(self)
+    }
+
+    fn device_name(&self) -> Option<String> {
+        Some(self.model.device_name())
+    }
+
+    fn peak_state_bytes(&self) -> Option<u64> {
+        Some(self.peak.load(std::sync::atomic::Ordering::Relaxed))
+    }
+
+    fn idle_secs(&self) -> Option<f64> {
+        Some(self.used.lock().unwrap_or_else(PoisonError::into_inner).elapsed().as_secs_f64())
+    }
+}
+
+/// Verify the installed file against the registry and build the model.
+pub fn load(bytes: &[u8]) -> std::result::Result<Arc<Sam2Mask>, String> {
+    let got = effectcraft_segment::sha256::hex(bytes);
+    let Some(info) = SIZES.iter().find(|m| m.sha256 == got) else {
+        return Err(format!("SAM 2.1: the file does not match any published size (SHA-256 {got})"));
+    };
+    let w = crate::weights::Weights::from_bytes(bytes).map_err(|e| e.to_string())?;
+    let model = VideoModel::load_auto(&w).map_err(|e| e.to_string())?;
+    Ok(Arc::new(Sam2Mask::with_info(Arc::new(model), info)))
+}
+
+/// The size to suggest: Tiny. On the benchmark clips (`bench --roto`, 24 frames, a GPU) no larger size tracked better, they
+/// cost 1.0x (Small), 1.15x (Base+) and 1.7x (Large) the time, and Large lost the object after it re-entered the frame.
+pub fn recommended() -> &'static ModelInfo {
+    &SAM2_TINY
+}
+
+/// A one-line note for the Settings list: what was measured for this size, and what the bigger ones cost without a GPU.
+pub fn hint(id: &str) -> Option<String> {
+    hint_for(id, crate::gpu::Gpu::probe())
+}
+
+/// [`hint`] given whether a GPU is known (`None`: not looked for yet). The list is built on the
+/// Settings path, so it never creates the GPU device itself: that happens when a model is loaded,
+/// and after that the notes say whether one was found.
+fn hint_for(id: &str, gpu: Option<bool>) -> Option<String> {
+    Some(
+        match id {
+            "sam2.1-hiera-tiny" => "Recommended: the smallest download, and no larger size tracked better on the benchmark clips.",
+            "sam2.1-hiera-small" => "As fast as Tiny on a GPU and no better on the benchmark clips; worth a try on difficult footage.",
+            "sam2.1-hiera-base-plus" => match gpu {
+                Some(false) => "Slow without a GPU (several seconds a frame); none was found.",
+                Some(true) => "About 15% slower than Tiny on a GPU and no better on the benchmark clips.",
+                None => "About 15% slower than Tiny on a GPU and no better on the benchmark clips; several seconds a frame without one.",
+            },
+            "sam2.1-hiera-large" => match gpu {
+                Some(false) => "Slow without a GPU (many seconds a frame); none was found.",
+                Some(true) => {
+                    "About 1.7 times Tiny's time on a GPU; it lost the object after it re-entered in one benchmark clip. Try it on difficult footage."
+                }
+                None => "About 1.7 times Tiny's time on a GPU, many seconds a frame without one; it lost the object after it re-entered in one benchmark clip.",
+            },
+            _ => return None,
+        }
+        .to_string(),
+    )
+}
+
+/// The registry entries this crate loads.
+pub const SIZES: [&ModelInfo; 4] = [&SAM2_TINY, &effectcraft_segment::SAM2_SMALL, &effectcraft_segment::SAM2_BASE_PLUS, &effectcraft_segment::SAM2_LARGE];
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn preprocess_rejects_bad_frames_and_cleans_pixels() {
+        assert!(preprocess(&[], 0, 0).is_err());
+        assert!(preprocess(&[[0.0; 3]; 3], 2, 2).is_err());
+        assert!(preprocess(&[[0.5; 3]; 4], usize::MAX, 2).is_err());
+        let t = preprocess(&[[f32::NAN, 2.0, -1.0]; 4], 2, 2).unwrap();
+        assert_eq!(t.dims(), [1, 3, INPUT_SIZE, INPUT_SIZE]);
+        let v = t.flatten_all().unwrap().to_vec1::<f32>().unwrap();
+        assert!(v.iter().all(|x| x.is_finite()));
+    }
+
+    /// The Settings list asks for hints without creating the GPU device: before anything has loaded a
+    /// model there is no answer yet, and the notes say so rather than guess.
+    #[test]
+    fn hints_do_not_need_the_gpu_to_have_been_created() {
+        for id in ["sam2.1-hiera-base-plus", "sam2.1-hiera-large"] {
+            let (unknown, none, found) = (hint_for(id, None), hint_for(id, Some(false)), hint_for(id, Some(true)));
+            assert!(unknown.is_some() && none.is_some() && found.is_some());
+            assert!(none.as_deref().is_some_and(|h| h.contains("none was found")), "{id}: {none:?}");
+            assert!(unknown.as_deref().is_some_and(|h| h.contains("without one") && !h.contains("none was found")), "{id}: {unknown:?}");
+        }
+        assert!(hint_for("mobilesam", None).is_none());
+    }
+
+    #[test]
+    fn a_wrong_file_is_refused_before_parsing() {
+        let e = load(b"not the weights").err().unwrap_or_default();
+        assert!(e.contains("does not match"), "{e}");
+    }
+}
diff --git a/crates/sam2/src/memattn.rs b/crates/sam2/src/memattn.rs
new file mode 100644
index 000000000..d455f1ed1
--- /dev/null
+++ b/crates/sam2/src/memattn.rs
@@ -0,0 +1,173 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2_video/modeling_sam2_video.py`
+// (Sam2VideoMemoryAttention, Sam2VideoMemoryAttentionLayer, Sam2VideoRoPEAttention,
+// Sam2VideoVisionRotaryEmbedding; Apache-2.0, Copyright The HuggingFace Inc. team) to Rust on
+// candle. See NOTICE.
+//! Memory attention: the current frame's features attend to themselves and to the memory bank
+//! (memory frames plus object pointers) with axial 2-D rotary position encoding.
+
+use candle_core::{D, Device, Tensor};
+use candle_nn::{Linear, ops::softmax_last_dim};
+
+use crate::nn::{LayerNorm, apply, layer_norm, linear};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+const DIM: usize = 256;
+const LAYERS: usize = 4;
+/// Side of the feature grid the rotary encoding is defined on.
+pub const GRID: usize = 64;
+
+/// `cos` and `sin` of the axial rotary encoding for the `GRID x GRID` grid, each `[GRID², 256]`.
+pub(crate) fn rope_tables(theta: f32) -> Result<(Tensor, Tensor)> {
+    let freqs = DIM / 2 / 2; // per axis: head_dim / 4
+    let inv: Vec<f32> = (0..freqs).map(|i| 1.0 / theta.powf(i as f32 / freqs as f32)).collect();
+    let n = GRID * GRID;
+    let (mut cos, mut sin) = (vec![0f32; n * DIM], vec![0f32; n * DIM]);
+    for p in 0..n {
+        let (x, y) = ((p % GRID) as f32, (p / GRID) as f32);
+        for j in 0..DIM / 2 {
+            let f = if j < freqs { x * inv.get(j).copied().unwrap_or(0.0) } else { y * inv.get(j - freqs).copied().unwrap_or(0.0) };
+            for k in 0..2 {
+                if let (Some(c), Some(s)) = (cos.get_mut(p * DIM + 2 * j + k), sin.get_mut(p * DIM + 2 * j + k)) {
+                    *c = f.cos();
+                    *s = f.sin();
+                }
+            }
+        }
+    }
+    Ok((Tensor::from_vec(cos, (n, DIM), &Device::Cpu)?, Tensor::from_vec(sin, (n, DIM), &Device::Cpu)?))
+}
+
+/// `(x0, x1) -> (-x1, x0)` over adjacent pairs of the last dimension.
+fn rotate_pairwise(x: &Tensor) -> Result<Tensor> {
+    let (n, d) = x.dims2()?;
+    let pairs = x.reshape((n, d / 2, 2))?;
+    let (x1, x2) = (pairs.narrow(2, 0, 1)?.squeeze(2)?, pairs.narrow(2, 1, 1)?.squeeze(2)?);
+    Ok(Tensor::stack(&[&x2.neg()?, &x1], D::Minus1)?.reshape((n, d))?)
+}
+
+fn rope(x: &Tensor, cos: &Tensor, sin: &Tensor) -> Result<Tensor> {
+    Ok(((x * cos)? + (rotate_pairwise(x)? * sin)?)?)
+}
+
+struct RopeAttention {
+    q: Linear,
+    k: Linear,
+    v: Linear,
+    o: Linear,
+}
+
+impl RopeAttention {
+    fn load(w: &Weights, prefix: &str, kv_dim: usize) -> Result<RopeAttention> {
+        Ok(RopeAttention {
+            q: linear(w, &format!("{prefix}.q_proj"), DIM, DIM)?,
+            k: linear(w, &format!("{prefix}.k_proj"), kv_dim, DIM)?,
+            v: linear(w, &format!("{prefix}.v_proj"), kv_dim, DIM)?,
+            o: linear(w, &format!("{prefix}.o_proj"), DIM, DIM)?,
+        })
+    }
+
+    /// `query`: `[N, 256]`, `key`/`value`: `[M, kv]`. The first `M - exclude` keys are rotated
+    /// (their table is `cos`/`sin` tiled to length); the last `exclude` (object pointers) are not.
+    fn forward(&self, query: &Tensor, key: &Tensor, value: &Tensor, tables: &(Tensor, Tensor), exclude: usize) -> Result<Tensor> {
+        let (cos, sin) = tables;
+        let q = rope(&apply(&self.q, query)?, cos, sin)?;
+        let k = apply(&self.k, key)?;
+        let v = apply(&self.v, value)?;
+        let m = k.dim(0)?;
+        let rotated = m.checked_sub(exclude).ok_or_else(|| Error::Input("more object pointers than memory tokens".into()))?;
+        let k = if rotated == 0 {
+            k
+        } else {
+            let n = cos.dim(0)?;
+            let reps = if rotated == n {
+                1
+            } else if rotated % n == 0 {
+                rotated / n
+            } else {
+                return Err(Error::Input(format!("memory length {rotated} is not a multiple of {n}")));
+            };
+            let tile = |t: &Tensor| -> Result<Tensor> { Ok(Tensor::cat(&vec![t; reps], 0)?) };
+            let k_rot = rope(&k.narrow(0, 0, rotated)?, &tile(cos)?, &tile(sin)?)?;
+            if exclude == 0 { k_rot } else { Tensor::cat(&[&k_rot, &k.narrow(0, rotated, exclude)?], 0)? }
+        };
+        let scale = (DIM as f64).powf(-0.5);
+        let att = softmax_last_dim(&((q * scale)?.matmul(&k.t()?.contiguous()?)?))?;
+        apply(&self.o, &att.matmul(&v)?)
+    }
+}
+
+struct Layer {
+    self_attn: RopeAttention,
+    cross: RopeAttention,
+    ln1: LayerNorm,
+    ln2: LayerNorm,
+    ln3: LayerNorm,
+    lin1: Linear,
+    lin2: Linear,
+}
+
+pub struct MemoryAttention {
+    layers: Vec<Layer>,
+    final_ln: LayerNorm,
+    tables: (Tensor, Tensor),
+}
+
+impl MemoryAttention {
+    pub fn load(w: &Weights) -> Result<MemoryAttention> {
+        let layers = (0..LAYERS)
+            .map(|i| {
+                let p = format!("memory_attention.layers.{i}");
+                Ok(Layer {
+                    self_attn: RopeAttention::load(w, &format!("{p}.self_attn"), DIM)?,
+                    cross: RopeAttention::load(w, &format!("{p}.cross_attn_image"), 64)?,
+                    ln1: layer_norm(w, &format!("{p}.layer_norm1"), DIM, 1e-5)?,
+                    ln2: layer_norm(w, &format!("{p}.layer_norm2"), DIM, 1e-5)?,
+                    ln3: layer_norm(w, &format!("{p}.layer_norm3"), DIM, 1e-5)?,
+                    lin1: linear(w, &format!("{p}.linear1"), DIM, 2048)?,
+                    lin2: linear(w, &format!("{p}.linear2"), 2048, DIM)?,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        Ok(MemoryAttention { layers, final_ln: layer_norm(w, "memory_attention.layer_norm", DIM, 1e-5)?, tables: rope_tables(10000.0)? })
+    }
+
+    /// Condition the current frame on memory.
+    ///
+    /// `current` and `current_pos`: `[4096, 256]` (the lowest-resolution neck level and its
+    /// position encoding, one row per cell); `memory` and `memory_pos`: `[M, 64]` (memory frames
+    /// followed by `num_pointers` object-pointer tokens). Returns `[4096, 256]`.
+    pub fn forward(&self, current: &Tensor, current_pos: &Tensor, memory: &Tensor, memory_pos: &Tensor, num_pointers: usize) -> Result<Tensor> {
+        if current.dims() != [GRID * GRID, DIM] {
+            return Err(Error::Input(format!("current features must be [{}, {DIM}], got {:?}", GRID * GRID, current.dims())));
+        }
+        let keys_pos = (memory + memory_pos)?;
+        let mut out = (current + (current_pos * 0.1)?)?;
+        for l in &self.layers {
+            let q = l.ln1.forward(&out)?;
+            out = (&out + l.self_attn.forward(&q, &q, &q, &self.tables, 0)?)?;
+            let q = l.ln2.forward(&out)?;
+            out = (&out + l.cross.forward(&q, &keys_pos, memory, &self.tables, num_pointers)?)?;
+            let q = l.ln3.forward(&out)?;
+            out = (&out + apply(&l.lin2, &apply(&l.lin1, &q)?.relu()?)?)?;
+        }
+        self.final_ln.forward(&out)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rotation_is_pairwise_and_tables_start_at_identity() {
+        let x = Tensor::new(&[[1f32, 2.0, 3.0, 4.0]], &Device::Cpu).unwrap();
+        let r = rotate_pairwise(&x).unwrap().to_vec2::<f32>().unwrap();
+        assert_eq!(r, vec![vec![-2.0, 1.0, -4.0, 3.0]]);
+        let (cos, sin) = rope_tables(10000.0).unwrap();
+        // cell (0, 0): angle 0 everywhere
+        let c = cos.narrow(0, 0, 1).unwrap().to_vec2::<f32>().unwrap();
+        let s = sin.narrow(0, 0, 1).unwrap().to_vec2::<f32>().unwrap();
+        assert!(c[0].iter().all(|v| *v == 1.0) && s[0].iter().all(|v| *v == 0.0));
+    }
+}
diff --git a/crates/sam2/src/memory.rs b/crates/sam2/src/memory.rs
new file mode 100644
index 000000000..7a73fd5a3
--- /dev/null
+++ b/crates/sam2/src/memory.rs
@@ -0,0 +1,138 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2_video/modeling_sam2_video.py`
+// (Sam2VideoMemoryEncoder, Sam2VideoMaskDownSampler, Sam2VideoMemoryFuser; Apache-2.0, Copyright
+// The HuggingFace Inc. team) to Rust on candle. See NOTICE.
+//! The memory encoder: a frame's mask is down-sampled and fused with the frame's image features
+//! into a compact memory (64 channels on the 64 x 64 grid) plus its position encoding.
+
+use candle_core::Tensor;
+
+use crate::Result;
+use crate::neck::sine_position;
+use crate::nn::{LayerNorm, apply, apply_gelu, gelu, layer_norm, linear};
+use crate::weights::Weights;
+use candle_nn::Linear;
+
+struct Conv {
+    w: Tensor,
+    b: Tensor,
+    padding: usize,
+    stride: usize,
+    groups: usize,
+}
+
+impl Conv {
+    fn load(w: &Weights, name: &str, shape: &[usize], padding: usize, stride: usize, groups: usize) -> Result<Conv> {
+        let out = shape.first().copied().unwrap_or(0);
+        Ok(Conv { w: w.get(&format!("{name}.weight"), shape)?, b: w.get(&format!("{name}.bias"), &[out])?, padding, stride, groups })
+    }
+
+    fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        let y = x.conv2d(&self.w, self.padding, self.stride, 1, self.groups)?;
+        Ok(y.broadcast_add(&self.b.reshape((1, self.b.dim(0)?, 1, 1))?)?)
+    }
+}
+
+/// Layer norm over the channel dimension of `[B, C, H, W]`.
+fn norm_channels_first(ln: &LayerNorm, x: &Tensor) -> Result<Tensor> {
+    ln.forward(&x.permute((0, 2, 3, 1))?.contiguous()?)?.permute((0, 3, 1, 2))?.contiguous().map_err(Into::into)
+}
+
+struct FuserBlock {
+    depthwise: Conv,
+    norm: LayerNorm,
+    pw1: Linear,
+    pw2: Linear,
+    scale: Tensor,
+}
+
+impl FuserBlock {
+    fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        let h = norm_channels_first(&self.norm, &self.depthwise.forward(x)?)?;
+        let h = h.permute((0, 2, 3, 1))?.contiguous()?;
+        let h = apply(&self.pw2, &apply_gelu(&self.pw1, &h)?)?;
+        let h = h.broadcast_mul(&self.scale)?.permute((0, 3, 1, 2))?.contiguous()?;
+        Ok((x + h)?)
+    }
+}
+
+pub struct MemoryEncoder {
+    down: Vec<(Conv, LayerNorm)>,
+    final_conv: Conv,
+    feature_projection: Conv,
+    fuser: Vec<FuserBlock>,
+    projection: Conv,
+    occlusion: Tensor,
+}
+
+/// A frame's memory: `features` is `[HW, 64]` rounded through bfloat16 exactly as the reference
+/// stores it, `pos` is the `[HW, 64]` sine position encoding.
+pub struct Memory {
+    pub features: Tensor,
+    pub pos: Tensor,
+}
+
+impl MemoryEncoder {
+    pub fn load(w: &Weights) -> Result<MemoryEncoder> {
+        let mut down = vec![];
+        let mut ch = 1;
+        for i in 0..4 {
+            let out = ch * 4;
+            let p = format!("memory_encoder.mask_downsampler.layers.{i}");
+            down.push((Conv::load(w, &format!("{p}.conv"), &[out, ch, 3, 3], 1, 2, 1)?, layer_norm(w, &format!("{p}.layer_norm"), out, 1e-6)?));
+            ch = out;
+        }
+        let fuser = (0..2)
+            .map(|i| {
+                let p = format!("memory_encoder.memory_fuser.layers.{i}");
+                Ok(FuserBlock {
+                    depthwise: Conv::load(w, &format!("{p}.depthwise_conv"), &[256, 1, 7, 7], 3, 1, 256)?,
+                    norm: layer_norm(w, &format!("{p}.layer_norm"), 256, 1e-6)?,
+                    pw1: linear(w, &format!("{p}.pointwise_conv1"), 256, 1024)?,
+                    pw2: linear(w, &format!("{p}.pointwise_conv2"), 1024, 256)?,
+                    scale: w.get(&format!("{p}.scale"), &[256])?,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        Ok(MemoryEncoder {
+            down,
+            final_conv: Conv::load(w, "memory_encoder.mask_downsampler.final_conv", &[256, 256, 1, 1], 0, 1, 1)?,
+            feature_projection: Conv::load(w, "memory_encoder.feature_projection", &[256, 256, 1, 1], 0, 1, 1)?,
+            fuser,
+            projection: Conv::load(w, "memory_encoder.projection", &[64, 256, 1, 1], 0, 1, 1)?,
+            occlusion: w.get("occlusion_spatial_embedding_parameter", &[1, 64])?,
+        })
+    }
+
+    /// `features`: `[1, 256, g, g]` image features; `mask`: `[1, 1, 16 g, 16 g]` already scaled
+    /// (`20 * m - 10`). Returns the raw `[1, 64, g, g]` features and position encoding.
+    pub fn encode(&self, features: &Tensor, mask: &Tensor) -> Result<(Tensor, Tensor)> {
+        let mut m = mask.clone();
+        for (conv, ln) in &self.down {
+            m = gelu(&norm_channels_first(ln, &conv.forward(&m)?)?)?;
+        }
+        let m = self.final_conv.forward(&m)?;
+        let mut x = (self.feature_projection.forward(features)? + m)?;
+        for b in &self.fuser {
+            x = b.forward(&x)?;
+        }
+        let x = self.projection.forward(&x)?;
+        let pos = sine_position(32, x.dim(2)?, x.dim(3)?)?;
+        Ok((x, pos))
+    }
+
+    /// The memory kept for a frame: the encoder output, plus the occlusion embedding when the
+    /// object is absent, rounded through bfloat16 like the reference.
+    pub fn memory(&self, features: &Tensor, mask: &Tensor, object_present: bool) -> Result<Memory> {
+        let (x, _) = self.encode(features, mask)?;
+        self.finish(&x.flatten_from(2)?.squeeze(0)?.t()?.contiguous()?, object_present)
+    }
+
+    /// A memory from the encoder's raw tokens `[HW, 64]`: the occlusion embedding when the object is absent,
+    /// rounded through bfloat16, with the position encoding (shared by the CPU and GPU encoders).
+    pub fn finish(&self, tokens: &Tensor, object_present: bool) -> Result<Memory> {
+        let tokens = if object_present { tokens.clone() } else { tokens.broadcast_add(&self.occlusion)? };
+        let features = tokens.to_dtype(candle_core::DType::BF16)?.to_dtype(candle_core::DType::F32)?;
+        let pos = sine_position(32, 64, 64)?;
+        Ok(Memory { features, pos: pos.flatten_from(2)?.squeeze(0)?.t()?.contiguous()? })
+    }
+}
diff --git a/crates/sam2/src/model.rs b/crates/sam2/src/model.rs
new file mode 100644
index 000000000..36e30e310
--- /dev/null
+++ b/crates/sam2/src/model.rs
@@ -0,0 +1,87 @@
+// Modified work: ported from Hugging Face `transformers` `Sam2Model` (Apache-2.0, Copyright The
+// HuggingFace Inc. team) to Rust on candle. See NOTICE.
+//! The single-image model: encode a frame once, then decode any number of prompts against it.
+
+use std::path::Path;
+
+use candle_core::{Device, Tensor};
+
+use crate::decoder::{DecoderOutput, MaskDecoder};
+use crate::neck::{ImageFeatures, VisionEncoder};
+use crate::prompt::{INPUT_SIZE, Prompt, PromptEncoder};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+/// A frame after the vision encoder: reusable for every prompt on that frame.
+pub struct Encoded {
+    /// The three neck levels, highest resolution first (`[1, 256, 256, 256]`, `128`, `64`).
+    pub features: ImageFeatures,
+    /// The decoder's skip features from the two highest-resolution levels.
+    pub high: (Tensor, Tensor),
+}
+
+pub struct ImageModel {
+    pub vision: VisionEncoder,
+    pub prompt: PromptEncoder,
+    pub decoder: MaskDecoder,
+    no_memory: Tensor,
+    image_pos: Tensor,
+}
+
+impl ImageModel {
+    pub fn load(w: &Weights) -> Result<ImageModel> {
+        let prompt = PromptEncoder::load(w)?;
+        Ok(ImageModel {
+            vision: VisionEncoder::load(w)?,
+            decoder: MaskDecoder::load(w)?,
+            no_memory: w.get("no_memory_embedding", &[1, 1, 256])?.reshape((1, 256, 1, 1))?,
+            image_pos: prompt.image_positions()?,
+            prompt,
+        })
+    }
+
+    pub fn open(path: &Path) -> Result<ImageModel> {
+        ImageModel::load(&Weights::open(path)?)
+    }
+
+    /// Encode a normalised `[1, 3, 1024, 1024]` frame.
+    pub fn encode(&self, pixels: &Tensor) -> Result<Encoded> {
+        if pixels.dims() != [1, 3, INPUT_SIZE, INPUT_SIZE] {
+            return Err(Error::Input(format!("pixels must be [1, 3, {INPUT_SIZE}, {INPUT_SIZE}], got {:?}", pixels.dims())));
+        }
+        let features = self.vision.forward(pixels)?;
+        let (l0, l1) = match (features.features.first(), features.features.get(1)) {
+            (Some(a), Some(b)) => (a, b),
+            _ => return Err(Error::Compute("vision encoder returned too few levels".into())),
+        };
+        let high = self.decoder.high_res(l0, l1)?;
+        Ok(Encoded { features, high })
+    }
+
+    /// Prompt embeddings (sparse tokens, empty dense map) for a click/box prompt.
+    pub fn embed_prompt(&self, p: &Prompt) -> Result<(Tensor, Tensor)> {
+        Ok((self.prompt.sparse(p)?, self.prompt.dense_empty()?))
+    }
+
+    /// Decode masks for a prompt on an encoded frame.
+    pub fn segment(&self, enc: &Encoded, p: &Prompt, multimask: bool) -> Result<DecoderOutput> {
+        let low = enc.features.features.get(2).ok_or_else(|| Error::Compute("vision encoder returned too few levels".into()))?;
+        let image = low.broadcast_add(&self.no_memory)?;
+        let (sparse, dense) = self.embed_prompt(p)?;
+        self.decoder.forward(&image, &self.image_pos, &sparse, &dense, &enc.high, multimask)
+    }
+
+    /// Decode against an already memory-conditioned embedding `[1, 256, g, g]` (video tracking).
+    pub fn decode_embedded(&self, image: &Tensor, high: &(Tensor, Tensor), sparse: &Tensor, dense: &Tensor, multimask: bool) -> Result<DecoderOutput> {
+        self.decoder.forward(image, &self.image_pos, sparse, dense, high, multimask)
+    }
+
+    /// The learned embedding added to a frame's features when there is no memory yet.
+    pub fn no_memory(&self) -> &Tensor {
+        &self.no_memory
+    }
+
+    pub fn device(&self) -> Device {
+        Device::Cpu
+    }
+}
diff --git a/crates/sam2/src/neck.rs b/crates/sam2/src/neck.rs
new file mode 100644
index 000000000..50733fe79
--- /dev/null
+++ b/crates/sam2/src/neck.rs
@@ -0,0 +1,221 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2/modeling_sam2.py`
+// (Sam2VisionNeck, Sam2SinePositionEmbedding, Sam2VisionModel; Apache-2.0, Copyright The
+// HuggingFace Inc. team) to Rust on candle. See NOTICE.
+//! The feature pyramid neck on top of Hiera, and the vision encoder that joins them.
+
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+use candle_core::{Device, Tensor};
+
+use crate::hiera::{Hiera, HieraConfig};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+/// Sine position encoding `[1, 2 * num_pos_features, h, w]`, normalised (`Sam2SinePositionEmbedding`).
+/// Only small tables are retained globally; the neck owns its larger feature-pyramid tables.
+pub fn sine_position(num_pos_features: usize, h: usize, w: usize) -> Result<Tensor> {
+    static CACHE: OnceLock<PositionCache> = OnceLock::new();
+    CACHE.get_or_init(|| PositionCache::new(1024 * 1024 / size_of::<f32>())).get(num_pos_features, h, w)
+}
+
+const MAX_POSITION_ELEMENTS: usize = 128 * 1024 * 1024 / size_of::<f32>();
+
+struct PositionCache {
+    entries: Mutex<HashMap<(usize, usize, usize), Tensor>>,
+    max_elements: usize,
+}
+
+impl PositionCache {
+    fn new(max_elements: usize) -> Self {
+        Self { entries: Mutex::new(HashMap::new()), max_elements }
+    }
+
+    fn get(&self, features: usize, h: usize, w: usize) -> Result<Tensor> {
+        let key = (features, h, w);
+        if let Some(t) = self.entries.lock().unwrap_or_else(PoisonError::into_inner).get(&key) {
+            return Ok(t.clone());
+        }
+        let t = build_sine_position(features, h, w)?;
+        let count = t.elem_count();
+        if count <= self.max_elements {
+            let mut map = self.entries.lock().unwrap_or_else(PoisonError::into_inner);
+            let retained = map.values().fold(0usize, |n, t| n.saturating_add(t.elem_count()));
+            if map.len() >= 16 || retained.saturating_add(count) > self.max_elements {
+                map.clear();
+            }
+            map.insert(key, t.clone());
+        }
+        Ok(t)
+    }
+}
+
+fn build_sine_position(num_pos_features: usize, h: usize, w: usize) -> Result<Tensor> {
+    let count = num_pos_features.checked_mul(2).and_then(|n| n.checked_mul(h)).and_then(|n| n.checked_mul(w));
+    let count =
+        count.filter(|n| *n > 0 && *n <= MAX_POSITION_ELEMENTS).ok_or_else(|| Error::Input("sine position dimensions are empty or exceed 128 MiB".into()))?;
+    let eps = 1e-6f32;
+    let scale = 2.0 * std::f32::consts::PI;
+    let dim_t: Vec<f32> = (0..num_pos_features).map(|i| 10000f32.powf(2.0 * (i / 2) as f32 / num_pos_features as f32)).collect();
+    let axis = |n: usize, k: usize| -> Vec<f32> {
+        // value of one coordinate at index k of an axis of length n, over the feature dimension
+        let e = (k + 1) as f32 / (n as f32 + eps) * scale;
+        dim_t.iter().enumerate().map(|(i, d)| if i % 2 == 0 { (e / d).sin() } else { (e / d).cos() }).collect()
+    };
+    let (ys, xs): (Vec<_>, Vec<_>) = ((0..h).map(|k| axis(h, k)).collect(), (0..w).map(|k| axis(w, k)).collect());
+    let mut out = vec![0f32; count];
+    for y in 0..h {
+        for x in 0..w {
+            for f in 0..num_pos_features {
+                let (py, px) = (ys.get(y).and_then(|v| v.get(f)), xs.get(x).and_then(|v| v.get(f)));
+                if let (Some(py), Some(px)) = (py, px) {
+                    if let Some(o) = out.get_mut((f * h + y) * w + x) {
+                        *o = *py;
+                    }
+                    if let Some(o) = out.get_mut(((num_pos_features + f) * h + y) * w + x) {
+                        *o = *px;
+                    }
+                }
+            }
+        }
+    }
+    Ok(Tensor::from_vec(out, (1, 2 * num_pos_features, h, w), &Device::Cpu)?)
+}
+
+struct Conv1x1 {
+    w: Tensor,
+    b: Tensor,
+    out: usize,
+}
+
+impl Conv1x1 {
+    fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        Ok(x.conv2d(&self.w, 0, 1, 1, 1)?.broadcast_add(&self.b.reshape((1, self.out, 1, 1))?)?)
+    }
+}
+
+/// The FPN neck: a 1x1 conv per stage, top-down additions on the two lowest-resolution levels.
+pub struct Neck {
+    convs: Vec<Conv1x1>,
+    top_down: Vec<usize>,
+    pos_features: usize,
+    positions: PositionCache,
+}
+
+/// What the neck produces, both in the neck's own order (lowest resolution first, all four
+/// levels) as `[B, C, H, W]`.
+pub struct NeckOutput {
+    pub features: Vec<Tensor>,
+    pub positions: Vec<Tensor>,
+}
+
+impl Neck {
+    /// Position tables shared by the CPU and GPU paths, released with this neck.
+    pub(crate) fn position(&self, h: usize, w: usize) -> Result<Tensor> {
+        self.positions.get(self.pos_features, h, w)
+    }
+
+    pub fn load(w: &Weights, channels: &[usize], fpn: usize, top_down: &[usize]) -> Result<Neck> {
+        let convs = channels
+            .iter()
+            .enumerate()
+            .map(|(j, c)| {
+                Ok(Conv1x1 {
+                    w: w.get(&format!("vision_encoder.neck.convs.{j}.weight"), &[fpn, *c, 1, 1])?,
+                    b: w.get(&format!("vision_encoder.neck.convs.{j}.bias"), &[fpn])?,
+                    out: fpn,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        Ok(Neck { convs, top_down: top_down.to_vec(), pos_features: fpn / 2, positions: PositionCache::new(MAX_POSITION_ELEMENTS) })
+    }
+
+    /// `stages`: Hiera stage outputs, NHWC, highest resolution first.
+    pub fn forward(&self, stages: &[Tensor]) -> Result<NeckOutput> {
+        let n = self.convs.len().checked_sub(1).ok_or_else(|| Error::Weights("neck has no convolutions".into()))?;
+        if stages.len() != self.convs.len() {
+            return Err(Error::Input(format!("neck expects {} stages, got {}", self.convs.len(), stages.len())));
+        }
+        let (mut features, mut positions) = (vec![], vec![]);
+        let mut prev: Option<Tensor> = None;
+        for i in (0..=n).rev() {
+            let stage = stages.get(i).ok_or_else(|| Error::Input("missing stage".into()))?;
+            let conv = self.convs.get(n - i).ok_or_else(|| Error::Weights("missing neck convolution".into()))?;
+            let lateral = conv.forward(&stage.permute((0, 3, 1, 2))?.contiguous()?)?;
+            let cur = match (&prev, self.top_down.contains(&i) && i != n) {
+                (Some(p), true) => {
+                    let (h, w) = (p.dim(2)? * 2, p.dim(3)? * 2);
+                    (lateral + p.upsample_nearest2d(h, w)?)?
+                }
+                _ => lateral,
+            };
+            positions.push(self.position(cur.dim(2)?, cur.dim(3)?)?);
+            features.push(cur.clone());
+            prev = Some(cur);
+        }
+        Ok(NeckOutput { features, positions })
+    }
+}
+
+/// Hiera plus neck: `Sam2VisionModel`.
+pub struct VisionEncoder {
+    pub hiera: std::sync::Arc<Hiera>,
+    pub neck: Neck,
+    levels: usize,
+}
+
+/// The multi-scale image features the decoder and memory modules use, highest resolution first
+/// (256², 128², 64² for a 1024 input), `[B, C, H, W]`.
+pub struct ImageFeatures {
+    pub features: Vec<Tensor>,
+    pub positions: Vec<Tensor>,
+}
+
+impl VisionEncoder {
+    /// The encoder of whichever size the checkpoint is.
+    pub fn load(w: &Weights) -> Result<VisionEncoder> {
+        let cfg = HieraConfig::for_size(crate::Size::detect(w)?);
+        let channels: Vec<usize> = cfg.embed_dims.iter().rev().copied().collect();
+        Ok(VisionEncoder { hiera: std::sync::Arc::new(Hiera::load(w, &cfg)?), neck: Neck::load(w, &channels, 256, &[2, 3])?, levels: 3 })
+    }
+
+    pub fn forward(&self, pixels: &Tensor) -> Result<ImageFeatures> {
+        let stages = self.hiera.forward(pixels)?;
+        let out = self.neck.forward(&stages)?;
+        // keep the last `levels` of the neck order and reverse: high to low resolution
+        let keep = |v: Vec<Tensor>| -> Vec<Tensor> {
+            let skip = v.len().saturating_sub(self.levels);
+            v.into_iter().skip(skip).rev().collect()
+        };
+        Ok(ImageFeatures { features: keep(out.features), positions: keep(out.positions) })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn position_tables_reject_empty_overflowing_and_oversized_dimensions() {
+        for (features, h, w) in [(0, 1, 1), (1, 0, 1), (1, 1, 0), (usize::MAX, 2, 2), (128, usize::MAX, 2), (128, 1024, 1024)] {
+            assert!(matches!(sine_position(features, h, w), Err(Error::Input(_))), "{features}, {h}, {w}");
+        }
+    }
+
+    #[test]
+    fn position_cache_bounds_retained_elements_and_preserves_the_encoding() {
+        let neck = Neck { convs: vec![], top_down: vec![], pos_features: 2, positions: PositionCache::new(64) };
+        let cache = &neck.positions;
+        let first = neck.position(2, 4).unwrap();
+        assert_eq!(first.dims(), &[1, 4, 2, 4]);
+        assert_eq!(first.flatten_all().unwrap().to_vec1::<f32>().unwrap(), neck.position(2, 4).unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap());
+        neck.position(3, 4).unwrap();
+        let entries = cache.entries.lock().unwrap();
+        assert_eq!(entries.len(), 1, "older tables are evicted to fit the budget");
+        assert!(entries.values().map(Tensor::elem_count).sum::<usize>() <= 64);
+        drop(entries);
+        let large = neck.position(8, 8).unwrap();
+        assert_eq!(large.dims(), &[1, 4, 8, 8]);
+        assert_eq!(cache.entries.lock().unwrap().len(), 1, "a table over budget is returned without retention");
+    }
+}
diff --git a/crates/sam2/src/nn.rs b/crates/sam2/src/nn.rs
new file mode 100644
index 000000000..256a60da9
--- /dev/null
+++ b/crates/sam2/src/nn.rs
@@ -0,0 +1,171 @@
+// Modified work: small layers used by the ported SAM 2 modules (Apache-2.0, see NOTICE).
+//! Linear, layer norm and a few tensor helpers on candle.
+
+use candle_core::{CpuStorage, CustomOp1, CustomOp2, Layout, Shape, Tensor};
+use candle_nn::Linear;
+
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+pub fn linear(w: &Weights, prefix: &str, input: usize, output: usize) -> Result<Linear> {
+    Ok(Linear::new(w.get(&format!("{prefix}.weight"), &[output, input])?, Some(w.get(&format!("{prefix}.bias"), &[output])?)))
+}
+
+/// Layer norm over the last dimension using candle's fused kernel (much faster than the
+/// composed `candle_nn::LayerNorm` on large activations).
+pub struct LayerNorm {
+    weight: Tensor,
+    bias: Tensor,
+    eps: f32,
+}
+
+impl LayerNorm {
+    pub fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        Ok(candle_nn::ops::layer_norm(&x.contiguous()?, &self.weight, &self.bias, self.eps)?)
+    }
+}
+
+pub fn layer_norm(w: &Weights, prefix: &str, dim: usize, eps: f64) -> Result<LayerNorm> {
+    Ok(LayerNorm { weight: w.get(&format!("{prefix}.weight"), &[dim])?, bias: w.get(&format!("{prefix}.bias"), &[dim])?, eps: eps as f32 })
+}
+
+/// Two-layer MLP with exact (erf) GELU, as `Sam2FeedForward` with `num_layers = 2`.
+pub struct Mlp {
+    pub proj_in: Linear,
+    pub proj_out: Linear,
+}
+
+impl Mlp {
+    pub fn load(w: &Weights, prefix: &str, dim: usize, hidden: usize) -> Result<Mlp> {
+        Ok(Mlp { proj_in: linear(w, &format!("{prefix}.proj_in"), dim, hidden)?, proj_out: linear(w, &format!("{prefix}.proj_out"), hidden, dim)? })
+    }
+
+    pub fn forward(&self, x: &Tensor) -> Result<Tensor> {
+        apply(&self.proj_out, &apply_gelu(&self.proj_in, x)?)
+    }
+}
+
+/// `x + bias` (and, for [`bias_gelu`], then GELU) over rows of `x`, on all cores. Candle adds a bias
+/// on one thread, which cost more than the matmul it followed on the wide activations of the early
+/// Hiera blocks.
+struct BiasAdd {
+    gelu: bool,
+}
+
+impl CustomOp2 for BiasAdd {
+    fn name(&self) -> &'static str {
+        "bias_add_parallel"
+    }
+
+    fn cpu_fwd(&self, xs: &CpuStorage, xl: &Layout, bs: &CpuStorage, bl: &Layout) -> candle_core::Result<(CpuStorage, Shape)> {
+        use rayon::prelude::*;
+        let (CpuStorage::F32(x), CpuStorage::F32(b)) = (xs, bs) else { candle_core::bail!("bias_add_parallel needs f32") };
+        let (Some((x0, x1)), Some((b0, b1))) = (xl.contiguous_offsets(), bl.contiguous_offsets()) else {
+            candle_core::bail!("bias_add_parallel needs contiguous inputs")
+        };
+        let (x, b) = match (x.get(x0..x1), b.get(b0..b1)) {
+            (Some(x), Some(b)) if !b.is_empty() && x.len() % b.len() == 0 => (x, b),
+            _ => candle_core::bail!("bias_add_parallel: sizes do not fit"),
+        };
+        let cols = b.len();
+        let mut out = vec![0f32; x.len()];
+        let rows_per = (64 * 1024 / cols).max(1);
+        let gelu = self.gelu;
+        out.par_chunks_mut(rows_per * cols).zip(x.par_chunks(rows_per * cols)).for_each(|(o, i)| {
+            for (orow, irow) in o.chunks_mut(cols).zip(i.chunks(cols)) {
+                for ((a, v), bias) in orow.iter_mut().zip(irow).zip(b) {
+                    let y = v + bias;
+                    *a = if gelu { (candle_core::cpu::erf::erf_f32(y * std::f32::consts::FRAC_1_SQRT_2) + 1.0) * 0.5 * y } else { y };
+                }
+            }
+        });
+        Ok((CpuStorage::F32(out), xl.shape().clone()))
+    }
+}
+
+fn bias_op(x: &Tensor, bias: &Tensor, gelu: bool) -> Result<Tensor> {
+    if x.dtype() != candle_core::DType::F32 || !x.device().is_cpu() {
+        let y = x.broadcast_add(bias)?;
+        return Ok(if gelu { y.gelu_erf()? } else { y });
+    }
+    Ok(x.contiguous()?.apply_op2_no_bwd(&bias.contiguous()?, &BiasAdd { gelu })?)
+}
+
+fn matmul_bias(l: &Linear, x: &Tensor, gelu: bool) -> Result<Tensor> {
+    let dims = x.dims();
+    let (&last, lead) = dims.split_last().ok_or_else(|| Error::Compute("linear on a scalar".into()))?;
+    let rows: usize = lead.iter().product();
+    let y = x.reshape((rows, last))?.matmul(&l.weight().t()?)?;
+    let y = match l.bias() {
+        Some(b) => bias_op(&y, b, gelu)?,
+        None if gelu => y.gelu_erf()?,
+        None => y,
+    };
+    let mut out: Vec<usize> = lead.to_vec();
+    out.push(y.dim(1)?);
+    Ok(y.reshape(out)?)
+}
+
+/// Apply a linear layer to `[.., in]` through a flat 2-D matmul and a parallel bias add. Candle's
+/// `Linear::forward` broadcasts the weight over every leading dimension (copying it per window) and
+/// adds the bias on one thread: both slow on the 4-D activations of the backbone.
+pub fn apply(l: &Linear, x: &Tensor) -> Result<Tensor> {
+    matmul_bias(l, x, false)
+}
+
+/// [`apply`] followed by the exact GELU, in the same pass over the output.
+pub fn apply_gelu(l: &Linear, x: &Tensor) -> Result<Tensor> {
+    matmul_bias(l, x, true)
+}
+
+/// Exact (erf) GELU on all cores. Candle's own `gelu_erf` runs on one thread, which made it a third of
+/// the time of the Hiera blocks; this gives the same values (it calls the same `erf` per element).
+struct GeluErf;
+
+impl CustomOp1 for GeluErf {
+    fn name(&self) -> &'static str {
+        "gelu_erf_parallel"
+    }
+
+    fn cpu_fwd(&self, storage: &CpuStorage, layout: &Layout) -> candle_core::Result<(CpuStorage, Shape)> {
+        use rayon::prelude::*;
+        let CpuStorage::F32(data) = storage else { candle_core::bail!("gelu_erf_parallel needs f32") };
+        let Some((start, end)) = layout.contiguous_offsets() else { candle_core::bail!("gelu_erf_parallel needs a contiguous input") };
+        let src = data.get(start..end).ok_or_else(|| candle_core::Error::Msg("gelu_erf_parallel: layout outside the storage".into()))?;
+        let mut out = vec![0f32; src.len()];
+        const CHUNK: usize = 16 * 1024;
+        out.par_chunks_mut(CHUNK).zip(src.par_chunks(CHUNK)).for_each(|(o, i)| {
+            for (a, v) in o.iter_mut().zip(i) {
+                *a = (candle_core::cpu::erf::erf_f32(v * std::f32::consts::FRAC_1_SQRT_2) + 1.0) * 0.5 * v;
+            }
+        });
+        Ok((CpuStorage::F32(out), layout.shape().clone()))
+    }
+}
+
+/// Exact GELU of `x`, in parallel for f32 tensors.
+pub fn gelu(x: &Tensor) -> Result<Tensor> {
+    if x.dtype() != candle_core::DType::F32 || !x.device().is_cpu() {
+        return Ok(x.gelu_erf()?);
+    }
+    Ok(x.contiguous()?.apply_op1_no_bwd(&GeluErf)?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use candle_core::Device;
+
+    #[test]
+    fn the_parallel_gelu_equals_candles_bit_for_bit() {
+        let v: Vec<f32> = (0..101_000).map(|i| ((i as f32) * 0.00037).sin() * 6.0 - 0.5).collect();
+        let x = Tensor::from_vec(v, (101, 1000), &Device::Cpu).unwrap();
+        let (a, b) = (gelu(&x).unwrap(), x.gelu_erf().unwrap());
+        assert_eq!(a.flatten_all().unwrap().to_vec1::<f32>().unwrap(), b.flatten_all().unwrap().to_vec1::<f32>().unwrap());
+        // a transposed (non-contiguous) input works, and an empty one does too
+        let t = x.t().unwrap();
+        assert_eq!(gelu(&t).unwrap().dims(), t.dims());
+        let e = Tensor::zeros((0, 4), candle_core::DType::F32, &Device::Cpu).unwrap();
+        assert_eq!(gelu(&e).unwrap().elem_count(), 0);
+    }
+}
diff --git a/crates/sam2/src/prompt.rs b/crates/sam2/src/prompt.rs
new file mode 100644
index 000000000..23d9a7c99
--- /dev/null
+++ b/crates/sam2/src/prompt.rs
@@ -0,0 +1,237 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2/modeling_sam2.py`
+// (Sam2PositionalEmbedding, Sam2MaskEmbedding, Sam2PromptEncoder; Apache-2.0, Copyright The
+// HuggingFace Inc. team) to Rust on candle. See NOTICE.
+//! The prompt encoder: clicks and boxes become sparse tokens, a mask or "no mask" becomes a dense map.
+
+use candle_core::{Device, Tensor};
+
+use crate::nn::{LayerNorm, gelu, layer_norm};
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+/// Side of the (square) model input in pixels; prompts are given in these coordinates.
+pub const INPUT_SIZE: usize = 1024;
+/// Side of the image-embedding grid (input / 16).
+pub const GRID: usize = INPUT_SIZE / 16;
+const DIM: usize = 256;
+
+/// What the user pointed at, in model-input pixels (0..1024).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Prompt {
+    /// Clicks and whether each is foreground.
+    pub points: Vec<([f32; 2], bool)>,
+    /// A box `[x0, y0, x1, y1]`.
+    pub bbox: Option<[f32; 4]>,
+}
+
+impl Prompt {
+    /// Reject non-finite or absurd coordinates (they come from the user or an agent).
+    pub fn validate(&self) -> Result<()> {
+        let bad = |v: f32| !v.is_finite() || v.abs() > 4.0 * INPUT_SIZE as f32;
+        if self.points.iter().any(|(p, _)| p.iter().any(|v| bad(*v))) || self.bbox.is_some_and(|b| b.iter().any(|v| bad(*v))) {
+            return Err(Error::Input("prompt coordinates must be finite and near the frame".into()));
+        }
+        if self.points.len() > 64 {
+            return Err(Error::Input("at most 64 points per prompt".into()));
+        }
+        Ok(())
+    }
+}
+
+struct MaskEmbed {
+    conv: [(Tensor, Tensor, usize, usize); 3],
+    ln1: LayerNorm,
+    ln2: LayerNorm,
+}
+
+/// Sparse and dense prompt embeddings.
+pub struct PromptEncoder {
+    gauss: Vec<f32>,
+    point_embed: Vec<f32>,
+    not_a_point: Vec<f32>,
+    no_mask: Tensor,
+    mask: MaskEmbed,
+}
+
+fn rows(t: Tensor) -> Result<Vec<f32>> {
+    Ok(t.flatten_all()?.to_vec1::<f32>()?)
+}
+
+impl PromptEncoder {
+    pub fn load(w: &Weights) -> Result<PromptEncoder> {
+        let conv = |name: &str, i: usize, o: usize, k: usize, stride: usize| -> Result<(Tensor, Tensor, usize, usize)> {
+            Ok((
+                w.get(&format!("prompt_encoder.mask_embed.{name}.weight"), &[o, i, k, k])?,
+                w.get(&format!("prompt_encoder.mask_embed.{name}.bias"), &[o])?,
+                k,
+                stride,
+            ))
+        };
+        Ok(PromptEncoder {
+            gauss: rows(w.get("prompt_encoder.shared_embedding.positional_embedding", &[2, DIM / 2])?)?,
+            point_embed: rows(w.get("prompt_encoder.point_embed.weight", &[4, DIM])?)?,
+            not_a_point: rows(w.get("prompt_encoder.not_a_point_embed.weight", &[1, DIM])?)?,
+            no_mask: w.get("prompt_encoder.no_mask_embed.weight", &[1, DIM])?,
+            mask: MaskEmbed {
+                conv: [conv("conv1", 1, 4, 2, 2)?, conv("conv2", 4, 16, 2, 2)?, conv("conv3", 16, DIM, 1, 1)?],
+                ln1: layer_norm(w, "prompt_encoder.mask_embed.layer_norm1", 4, 1e-6)?,
+                ln2: layer_norm(w, "prompt_encoder.mask_embed.layer_norm2", 16, 1e-6)?,
+            },
+        })
+    }
+
+    /// Random-Fourier position encoding of coordinates already normalised to 0..1: `[n * 256]`.
+    fn fourier(&self, coords01: &[[f32; 2]]) -> Vec<f32> {
+        let half = DIM / 2;
+        let mut out = vec![0f32; coords01.len() * DIM];
+        for (n, c) in coords01.iter().enumerate() {
+            let (x, y) = (2.0 * c[0] - 1.0, 2.0 * c[1] - 1.0);
+            for j in 0..half {
+                let g0 = self.gauss.get(j).copied().unwrap_or(0.0);
+                let g1 = self.gauss.get(half + j).copied().unwrap_or(0.0);
+                let v = 2.0 * std::f32::consts::PI * (x * g0 + y * g1);
+                if let Some(o) = out.get_mut(n * DIM + j) {
+                    *o = v.sin();
+                }
+                if let Some(o) = out.get_mut(n * DIM + half + j) {
+                    *o = v.cos();
+                }
+            }
+        }
+        out
+    }
+
+    /// The position encoding of the whole `GRID x GRID` embedding, `[1, 256, GRID, GRID]`.
+    pub fn image_positions(&self) -> Result<Tensor> {
+        let coords: Vec<[f32; 2]> = (0..GRID * GRID).map(|i| [((i % GRID) as f32 + 0.5) / GRID as f32, ((i / GRID) as f32 + 0.5) / GRID as f32]).collect();
+        let flat = self.fourier(&coords);
+        Ok(Tensor::from_vec(flat, (GRID * GRID, DIM), &Device::Cpu)?.t()?.reshape((1, DIM, GRID, GRID))?.contiguous()?)
+    }
+
+    fn point_row(&self, i: usize) -> &[f32] {
+        self.point_embed.get(i * DIM..(i + 1) * DIM).unwrap_or(&[])
+    }
+
+    /// Sparse tokens `[1, n, 256]`; the pinned reference pads both click-only and box prompts.
+    pub fn sparse(&self, p: &Prompt) -> Result<Tensor> {
+        p.validate()?;
+        let norm = |c: [f32; 2]| [(c[0] + 0.5) / INPUT_SIZE as f32, (c[1] + 0.5) / INPUT_SIZE as f32];
+        let mut tokens: Vec<f32> = vec![];
+        let mut n = 0;
+        let mut push = |v: &[f32]| {
+            tokens.extend_from_slice(v);
+            n += 1;
+        };
+        let pts: Vec<[f32; 2]> = p.points.iter().map(|(c, _)| norm(*c)).collect();
+        let enc = self.fourier(&pts);
+        for (k, (_, fg)) in p.points.iter().enumerate() {
+            let e = enc.get(k * DIM..(k + 1) * DIM).unwrap_or(&[]);
+            let label_row = self.point_row(usize::from(*fg));
+            let v: Vec<f32> = e.iter().zip(label_row).map(|(a, b)| a + b).collect();
+            push(&v);
+        }
+        match p.bbox {
+            None => push(&self.not_a_point.clone()),
+            Some(b) => {
+                let corners = [norm([b[0], b[1]]), norm([b[2], b[3]])];
+                let enc = self.fourier(&corners);
+                for (k, row) in [2usize, 3].into_iter().enumerate() {
+                    let e = enc.get(k * DIM..(k + 1) * DIM).unwrap_or(&[]);
+                    let v: Vec<f32> = e.iter().zip(self.point_row(row)).map(|(a, b)| a + b).collect();
+                    push(&v);
+                }
+                // _embed_boxes adds its own no-point token, separately from _embed_points.
+                push(&self.not_a_point.clone());
+            }
+        }
+        Ok(Tensor::from_vec(tokens, (1, n, DIM), &Device::Cpu)?)
+    }
+
+    /// Tokens for "no prompt" on a tracked frame: the reference feeds one point labelled -1 and
+    /// then pads another, so two `not_a_point` tokens, `[1, 2, 256]`.
+    pub fn sparse_none(&self) -> Result<Tensor> {
+        let mut v = self.not_a_point.clone();
+        v.extend_from_slice(&self.not_a_point);
+        Ok(Tensor::from_vec(v, (1, 2, DIM), &Device::Cpu)?)
+    }
+
+    /// The dense embedding for "no mask prompt", `[1, 256, GRID, GRID]`.
+    pub fn dense_empty(&self) -> Result<Tensor> {
+        Ok(self.no_mask.reshape((1, DIM, 1, 1))?.broadcast_as((1, DIM, GRID, GRID))?.contiguous()?)
+    }
+
+    /// The dense embedding of a mask prompt `[1, 1, 4 * GRID, 4 * GRID]` (low-resolution logits).
+    pub fn dense_mask(&self, mask: &Tensor) -> Result<Tensor> {
+        let (c1, c2, c3) = (&self.mask.conv[0], &self.mask.conv[1], &self.mask.conv[2]);
+        let step = |x: &Tensor, c: &(Tensor, Tensor, usize, usize)| -> Result<Tensor> {
+            Ok(x.conv2d(&c.0, 0, c.3, 1, 1)?.broadcast_add(&c.1.reshape((1, c.1.dim(0)?, 1, 1))?)?)
+        };
+        let cl = |x: &Tensor, ln: &LayerNorm| -> Result<Tensor> { Ok(ln.forward(&x.permute((0, 2, 3, 1))?)?.permute((0, 3, 1, 2))?.contiguous()?) };
+        let x = gelu(&cl(&step(mask, c1)?, &self.mask.ln1)?)?;
+        let x = gelu(&cl(&step(&x, c2)?, &self.mask.ln2)?)?;
+        step(&x, c3)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A tiny deterministic checkpoint exercises token labels without downloading trained weights.
+    fn encoder() -> PromptEncoder {
+        let mut map = std::collections::HashMap::new();
+        for (name, shape) in [
+            ("shared_embedding.positional_embedding", vec![2, DIM / 2]),
+            ("no_mask_embed.weight", vec![1, DIM]),
+            ("mask_embed.conv1.weight", vec![4, 1, 2, 2]),
+            ("mask_embed.conv1.bias", vec![4]),
+            ("mask_embed.conv2.weight", vec![16, 4, 2, 2]),
+            ("mask_embed.conv2.bias", vec![16]),
+            ("mask_embed.conv3.weight", vec![DIM, 16, 1, 1]),
+            ("mask_embed.conv3.bias", vec![DIM]),
+            ("mask_embed.layer_norm1.weight", vec![4]),
+            ("mask_embed.layer_norm1.bias", vec![4]),
+            ("mask_embed.layer_norm2.weight", vec![16]),
+            ("mask_embed.layer_norm2.bias", vec![16]),
+        ] {
+            map.insert(format!("prompt_encoder.{name}"), Tensor::zeros(shape, candle_core::DType::F32, &Device::Cpu).unwrap());
+        }
+        let rows: Vec<f32> = (1..=4).flat_map(|row| vec![row as f32 * 10.0; DIM]).collect();
+        map.insert("prompt_encoder.point_embed.weight".into(), Tensor::from_vec(rows, (4, DIM), &Device::Cpu).unwrap());
+        map.insert("prompt_encoder.not_a_point_embed.weight".into(), Tensor::from_vec(vec![-1000.0f32; DIM], (1, DIM), &Device::Cpu).unwrap());
+        PromptEncoder::load(&Weights::from_map(map).unwrap()).unwrap()
+    }
+
+    /// Transformers 5.19.0 pads click-only prompts in _embed_points and boxes in _embed_boxes.
+    #[test]
+    fn box_and_click_tokens_match_the_pinned_reference_padding() {
+        let encoder = encoder();
+        let points = vec![([10.0, 20.0], false), ([30.0, 40.0], true)];
+        for points in [vec![], points.clone()] {
+            let sparse = encoder.sparse(&Prompt { points: points.clone(), bbox: Some([0.0, 0.0, 100.0, 100.0]) }).unwrap();
+            assert_eq!(sparse.dims(), &[1, points.len() + 3, DIM]);
+            let rows = sparse.to_vec3::<f32>().unwrap();
+            assert!(rows[0].last().unwrap().iter().all(|value| *value == -1000.0));
+            for (token, label) in rows[0].iter().zip(if points.is_empty() { vec![30.0, 40.0] } else { vec![10.0, 20.0, 30.0, 40.0] }) {
+                assert!(token[..DIM / 2].iter().all(|value| *value == label));
+                assert!(token[DIM / 2..].iter().all(|value| *value == label + 1.0));
+            }
+        }
+        let clicks = encoder.sparse(&Prompt { points, bbox: None }).unwrap();
+        assert_eq!(clicks.dims(), &[1, 3, DIM]);
+        assert!(clicks.to_vec3::<f32>().unwrap()[0][2].iter().all(|value| *value == -1000.0));
+        let none = encoder.sparse_none().unwrap();
+        assert_eq!(none.dims(), &[1, 2, DIM]);
+        assert!(none.flatten_all().unwrap().to_vec1::<f32>().unwrap().iter().all(|value| *value == -1000.0));
+    }
+
+    #[test]
+    fn hostile_prompts_are_rejected() {
+        let ok = Prompt { points: vec![([10.0, 20.0], true)], bbox: None };
+        assert!(ok.validate().is_ok());
+        assert!(Prompt { points: vec![([f32::NAN, 0.0], true)], bbox: None }.validate().is_err());
+        assert!(Prompt { points: vec![], bbox: Some([0.0, 0.0, f32::INFINITY, 5.0]) }.validate().is_err());
+        assert!(Prompt { points: vec![([1e9, 0.0], false)], bbox: None }.validate().is_err());
+        assert!(Prompt { points: vec![([1.0, 1.0], true); 65], bbox: None }.validate().is_err());
+    }
+}
diff --git a/crates/sam2/src/resize.rs b/crates/sam2/src/resize.rs
new file mode 100644
index 000000000..fdbcbab48
--- /dev/null
+++ b/crates/sam2/src/resize.rs
@@ -0,0 +1,124 @@
+// Modified work: the antialiased bilinear resize of PyTorch `F.interpolate(mode="bilinear",
+// antialias=True, align_corners=False)`, as used by the Hugging Face `transformers` SAM 2 mask path
+// (Apache-2.0 for the model code; the algorithm follows PyTorch's documented behaviour). See NOTICE.
+//! Resizing masks to and from the model's resolution.
+
+use candle_core::{Device, Tensor};
+
+use crate::Result;
+use crate::mask::validate_frame_size;
+use crate::prompt::INPUT_SIZE;
+
+/// For each output index: the first input index and the normalised triangle-filter weights.
+fn axis_weights(n_in: usize, n_out: usize) -> Vec<(usize, Vec<f32>)> {
+    let scale = n_in as f64 / n_out.max(1) as f64;
+    let support = if scale >= 1.0 { scale } else { 1.0 };
+    let invscale = if scale >= 1.0 { 1.0 / scale } else { 1.0 };
+    (0..n_out)
+        .map(|i| {
+            let center = scale * (i as f64 + 0.5);
+            let xmin = ((center - support + 0.5) as i64).max(0) as usize;
+            let xmax = (((center + support + 0.5) as i64).max(0) as usize).min(n_in);
+            let mut w: Vec<f32> = (xmin..xmax.max(xmin))
+                .map(|x| {
+                    let d = ((x as f64 - center + 0.5) * invscale).abs();
+                    if d < 1.0 { (1.0 - d) as f32 } else { 0.0 }
+                })
+                .collect();
+            let total: f32 = w.iter().sum();
+            if total > 0.0 {
+                w.iter_mut().for_each(|v| *v /= total);
+            }
+            (xmin, w)
+        })
+        .collect()
+}
+
+/// Antialiased bilinear resize of a row-major `h x w` image to `oh x ow`.
+pub fn antialias_bilinear(src: &[f32], (h, w): (usize, usize), (oh, ow): (usize, usize)) -> Result<Vec<f32>> {
+    validate_frame_size(w, h, src.len())?;
+    let out_len = validate_frame_size(ow, oh, oh.saturating_mul(ow))?;
+    let mid_len = validate_frame_size(ow, h, h.saturating_mul(ow))?;
+    let xs = axis_weights(w, ow);
+    let ys = axis_weights(h, oh);
+    // horizontal pass: h x ow
+    let mut mid = vec![0f32; mid_len];
+    for y in 0..h {
+        let row = src.get(y * w..(y + 1) * w).unwrap_or(&[]);
+        for (x, (x0, wt)) in xs.iter().enumerate() {
+            let acc: f32 = wt.iter().enumerate().map(|(k, a)| a * row.get(x0 + k).copied().unwrap_or(0.0)).sum();
+            if let Some(o) = mid.get_mut(y * ow + x) {
+                *o = acc;
+            }
+        }
+    }
+    // vertical pass: oh x ow
+    let mut out = vec![0f32; out_len];
+    for (y, (y0, wt)) in ys.iter().enumerate() {
+        for x in 0..ow {
+            let acc: f32 = wt.iter().enumerate().map(|(k, a)| a * mid.get((y0 + k) * ow + x).copied().unwrap_or(0.0)).sum();
+            if let Some(o) = out.get_mut(y * ow + x) {
+                *o = acc;
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// A binary mask of any size as the model's mask prompt: `[1, 1, 1024, 1024]` of 0 and 1 (resized
+/// like the reference: antialiased bilinear, then thresholded at one half).
+pub fn mask_to_model(mask: &[u8], w: usize, h: usize) -> Result<Tensor> {
+    validate_frame_size(w, h, mask.len())?;
+    let side = INPUT_SIZE;
+    let f: Vec<f32> = mask.iter().map(|v| f32::from(*v != 0)).collect();
+    let data = if (w, h) == (side, side) { f } else { antialias_bilinear(&f, (h, w), (side, side))?.into_iter().map(|v| f32::from(v >= 0.5)).collect() };
+    Ok(Tensor::from_vec(data, (1, 1, side, side), &Device::Cpu)?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn resize_rejects_overflowing_oversized_and_mismatched_grids() {
+        for (input, output) in [((usize::MAX, 2), (1, 1)), ((1, 1), (usize::MAX, 2)), ((1, 1), (16_385, 1)), ((0, 1), (1, 1))] {
+            assert!(antialias_bilinear(&[1.0], input, output).is_err(), "{input:?} to {output:?}");
+        }
+        assert!(mask_to_model(&[1], usize::MAX, 2).is_err());
+        assert!(mask_to_model(&[1], INPUT_SIZE, INPUT_SIZE).is_err());
+    }
+
+    #[test]
+    fn a_constant_stays_constant_and_weights_sum_to_one() {
+        let out = antialias_bilinear(&[3.0; 64 * 64], (64, 64), (16, 16)).unwrap();
+        assert!(out.iter().all(|v| (v - 3.0).abs() < 1e-5));
+        let up = antialias_bilinear(&[2.0; 16], (4, 4), (9, 7)).unwrap();
+        assert!(up.iter().all(|v| (v - 2.0).abs() < 1e-5));
+    }
+
+    #[test]
+    fn a_half_plane_blurs_over_the_filter_width() {
+        // 8 x 1: left half 0, right half 1, down to 2 x 1. The triangle filter is four pixels wide on
+        // each side, so the first output sees the ones at weights 0.375 and 0.125 of a total 3.5.
+        let src = [0., 0., 0., 0., 1., 1., 1., 1.];
+        let out = antialias_bilinear(&src, (1, 8), (1, 2)).unwrap();
+        assert!((out[0] - 0.5 / 3.5).abs() < 1e-6 && (out[1] - 3.0 / 3.5).abs() < 1e-6, "{out:?}");
+    }
+
+    #[test]
+    fn hostile_sizes_are_errors() {
+        assert!(antialias_bilinear(&[1.0; 4], (2, 2), (0, 3)).is_err());
+        assert!(antialias_bilinear(&[1.0; 5], (2, 2), (1, 1)).is_err());
+        assert!(mask_to_model(&[1; 3], 2, 2).is_err());
+        assert!(mask_to_model(&[], 0, 0).is_err());
+    }
+
+    #[test]
+    fn a_small_mask_becomes_a_model_sized_binary_mask() {
+        let m = mask_to_model(&[0, 1, 1, 0], 2, 2).unwrap();
+        assert_eq!(m.dims(), [1, 1, INPUT_SIZE, INPUT_SIZE]);
+        let v = m.flatten_all().unwrap().to_vec1::<f32>().unwrap();
+        assert!(v.iter().all(|x| *x == 0.0 || *x == 1.0));
+        assert!(v.iter().sum::<f32>() > 0.0);
+    }
+}
diff --git a/crates/sam2/src/session.rs b/crates/sam2/src/session.rs
new file mode 100644
index 000000000..0524ee89e
--- /dev/null
+++ b/crates/sam2/src/session.rs
@@ -0,0 +1,733 @@
+// Modified work: ported from Hugging Face `transformers` `models/sam2_video/modeling_sam2_video.py`
+// (Sam2VideoModel and Sam2VideoInferenceSession: memory-conditioned single-frame inference,
+// memory bank selection, object pointers, propagation; Apache-2.0, Copyright The HuggingFace
+// Inc. team) to Rust on candle. See NOTICE.
+//! The video tracker: per-object memory banks, prompts on any frame, propagation forwards and
+//! backwards with streaming results and cancellation.
+
+use std::collections::{BTreeMap, VecDeque};
+use std::path::Path;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use candle_core::{DType, Tensor};
+use candle_nn::{Linear, ops::sigmoid};
+
+use crate::decoder::FeedForward;
+use crate::gpu::Gpu;
+use crate::gpu::encoder::GpuEncoder;
+use crate::gpu::memattn::GpuMemoryAttention;
+use crate::gpu::memenc::GpuMemoryEncoder;
+use crate::memattn::MemoryAttention;
+use crate::memory::{Memory, MemoryEncoder};
+use crate::model::{Encoded, ImageModel};
+use crate::neck::ImageFeatures;
+use crate::nn::{apply, linear};
+use crate::prompt::{INPUT_SIZE, Prompt};
+use crate::resize::antialias_bilinear;
+use crate::weights::Weights;
+use crate::{Error, Result};
+
+/// Mask logit used where the object is absent (the reference's `NO_OBJ_SCORE`).
+const NO_OBJECT: f32 = -1024.0;
+/// Frames of memory the attention looks back over.
+const MEMORY_FRAMES: usize = 7;
+/// Object pointers kept per query.
+const MAX_POINTERS: usize = 16;
+/// Largest clip the session accepts.
+const MAX_FRAMES: usize = 1_000_000;
+const GRID: usize = 64;
+
+/// Frames of the clip, already resized to the model input and normalised: `[1, 3, 1024, 1024]`.
+pub trait FrameSource {
+    fn num_frames(&self) -> usize;
+    fn frame(&self, index: usize) -> Result<Tensor>;
+}
+
+/// Cooperative cancellation shared with the caller.
+#[derive(Clone, Default)]
+pub struct Cancel(Arc<AtomicBool>);
+
+impl Cancel {
+    pub fn new() -> Cancel {
+        Cancel::default()
+    }
+    pub fn cancel(&self) {
+        self.0.store(true, Ordering::Relaxed);
+    }
+    pub fn is_cancelled(&self) -> bool {
+        self.0.load(Ordering::Relaxed)
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct ObjectId(pub u32);
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Direction {
+    Forward,
+    Backward,
+}
+
+/// One object's mask on one frame.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FrameMask {
+    pub frame: usize,
+    pub object: ObjectId,
+    /// Mask logits at 256 x 256 (positive is inside the object); `-1024` everywhere when the
+    /// object is absent.
+    pub logits: Vec<f32>,
+    /// The model's own estimate of the mask quality (0..1).
+    pub iou: f32,
+    /// Object-presence logit; at or below zero the object is not in the frame.
+    pub object_score: f32,
+    pub occluded: bool,
+}
+
+/// Which device runs the heavy parts (the backbone, the neck and the memory attention).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Backend {
+    /// Candle on the CPU: the reference path.
+    Cpu,
+    /// wgpu compute on the GPU (any vendor); an error if there is none.
+    Gpu,
+    /// The GPU when there is a real one and it loads, else the CPU. The environment variable
+    /// `EFFECTCRAFT_SAM2_DEVICE` (`cpu`, `gpu` or `auto`) overrides the choice.
+    Auto,
+}
+
+/// The GPU path: kernels for the backbone and memory attention. Device failures disable it;
+/// memory-attention budget limits fall back to the CPU for that call only.
+struct GpuParts {
+    encoder: GpuEncoder,
+    attention: GpuMemoryAttention,
+    memory_encoder: GpuMemoryEncoder,
+    ok: AtomicBool,
+    adapter: String,
+}
+
+/// The weights of everything the video tracker needs.
+pub struct VideoModel {
+    gpu: Option<GpuParts>,
+    pub image: ImageModel,
+    memory_encoder: MemoryEncoder,
+    memory_attention: MemoryAttention,
+    temporal_pos: Vec<f32>,
+    no_object_pointer: Tensor,
+    pointer_proj: FeedForward,
+    pointer_time_proj: Linear,
+    /// `mask_downsample`: a 4 x 4 stride-4 convolution taking a mask prompt to the prompt encoder's resolution.
+    mask_down: (Tensor, Tensor),
+}
+
+impl VideoModel {
+    /// On the CPU: the reference path every test compares against.
+    pub fn load(w: &Weights) -> Result<VideoModel> {
+        VideoModel::load_with(w, Backend::Cpu)
+    }
+
+    /// On the GPU when there is one (see [`Backend::Auto`]).
+    pub fn load_auto(w: &Weights) -> Result<VideoModel> {
+        VideoModel::load_with(w, Backend::Auto)
+    }
+
+    pub fn load_with(w: &Weights, backend: Backend) -> Result<VideoModel> {
+        let backend = match (backend, std::env::var("EFFECTCRAFT_SAM2_DEVICE").ok().as_deref()) {
+            (Backend::Auto, Some("cpu")) => Backend::Cpu,
+            (Backend::Auto, Some("gpu")) => Backend::Gpu,
+            (b, _) => b,
+        };
+        let image = ImageModel::load(w)?;
+        let gpu = match backend {
+            Backend::Cpu => None,
+            Backend::Gpu => Some(Self::load_gpu(w, &image)?),
+            Backend::Auto => match Self::load_gpu(w, &image) {
+                Ok(g) => Some(g),
+                Err(e) => {
+                    log::info!("SAM 2 runs on the CPU: {e}");
+                    None
+                }
+            },
+        };
+        Ok(VideoModel {
+            gpu,
+            image,
+            memory_encoder: MemoryEncoder::load(w)?,
+            memory_attention: MemoryAttention::load(w)?,
+            temporal_pos: w.get("memory_temporal_positional_encoding", &[MEMORY_FRAMES, 1, 1, 64])?.flatten_all()?.to_vec1::<f32>()?,
+            no_object_pointer: w.get("no_object_pointer", &[1, 256])?,
+            pointer_proj: FeedForward::load(w, "object_pointer_proj", 256, 256, 256, 3, false)?,
+            pointer_time_proj: linear(w, "temporal_positional_encoding_projection_layer", 256, 64)?,
+            mask_down: (w.get("mask_downsample.weight", &[1, 1, 4, 4])?, w.get("mask_downsample.bias", &[1])?),
+        })
+    }
+
+    fn load_gpu(w: &Weights, image: &ImageModel) -> Result<GpuParts> {
+        let gpu = Gpu::shared()?;
+        Ok(GpuParts {
+            encoder: GpuEncoder::load(gpu.clone(), w, image.vision.hiera.clone())?,
+            attention: GpuMemoryAttention::load(gpu.clone(), w)?,
+            memory_encoder: GpuMemoryEncoder::load(gpu.clone(), w)?,
+            ok: AtomicBool::new(true),
+            adapter: gpu.adapter_name().to_string(),
+        })
+    }
+
+    /// The device the heavy parts run on now: the GPU's name, or "CPU".
+    pub fn device_name(&self) -> String {
+        match &self.gpu {
+            Some(g) if g.ok.load(Ordering::Relaxed) => g.adapter.clone(),
+            _ => "CPU".to_string(),
+        }
+    }
+
+    /// Run on the CPU from now on (a GPU that misbehaves, or the user's choice). Weights and results are
+    /// unchanged; only the device differs.
+    pub fn disable_gpu(&self) {
+        if let Some(g) = &self.gpu {
+            g.ok.store(false, Ordering::Relaxed);
+        }
+    }
+
+    fn gpu_failed(&self, what: &str, e: &Error) {
+        if let Some(g) = &self.gpu
+            && g.ok.swap(false, Ordering::Relaxed)
+        {
+            log::warn!("SAM 2 {what} failed on the GPU ({e}); the CPU takes over");
+        }
+    }
+
+    /// Encode a normalised `[1, 3, 1024, 1024]` frame on the GPU if it is working, else on the CPU.
+    pub fn encode(&self, pixels: &Tensor) -> Result<Encoded> {
+        if let Some(g) = self.gpu.as_ref().filter(|g| g.ok.load(Ordering::Relaxed)) {
+            match g.encoder.encode(pixels) {
+                Ok(f) => {
+                    let none = || Tensor::zeros((1, 0, 0, 0), DType::F32, &candle_core::Device::Cpu);
+                    let pos = self.image.vision.neck.position(GRID, GRID)?;
+                    let features = ImageFeatures { features: vec![none()?, none()?, f.low], positions: vec![none()?, none()?, pos] };
+                    return Ok(Encoded { features, high: f.high });
+                }
+                Err(e) => self.gpu_failed("encoding", &e),
+            }
+        }
+        self.image.encode(pixels)
+    }
+
+    /// The memory of a frame (its features and the scaled mask), on the GPU if it is working, else on the CPU.
+    fn memorize(&self, features: &Tensor, mask: &Tensor, present: bool) -> Result<Memory> {
+        if let Some(g) = self.gpu.as_ref().filter(|g| g.ok.load(Ordering::Relaxed)) {
+            match g.memory_encoder.encode(features, mask).and_then(|t| self.memory_encoder.finish(&t, present)) {
+                Ok(m) => return Ok(m),
+                Err(e) => self.gpu_failed("memory encoding", &e),
+            }
+        }
+        self.memory_encoder.memory(features, mask, present)
+    }
+
+    /// Memory attention on the GPU if it is working, else on the CPU.
+    fn attend(&self, current: &Tensor, current_pos: &Tensor, memory: &Tensor, memory_pos: &Tensor, pointers: usize) -> Result<Tensor> {
+        if let Some(g) = self.gpu.as_ref().filter(|g| g.ok.load(Ordering::Relaxed)) {
+            match g.attention.forward(current, current_pos, memory, memory_pos, pointers) {
+                Ok(t) => return Ok(t),
+                Err(Error::Budget(reason)) => log::info!("SAM 2 memory attention on the CPU for this call: {reason}"),
+                Err(e) => self.gpu_failed("memory attention", &e),
+            }
+        }
+        self.memory_attention.forward(current, current_pos, memory, memory_pos, pointers)
+    }
+
+    pub fn open(path: &Path) -> Result<VideoModel> {
+        VideoModel::load(&Weights::open(path)?)
+    }
+}
+
+/// What the tracker keeps for a frame it has processed.
+struct FrameOut {
+    memory: Memory,
+    /// `[1, 256]`
+    pointer: Tensor,
+    /// The mask of a conditioning frame (returned again, unchanged, when propagation passes it).
+    result: Option<FrameMask>,
+}
+
+#[derive(Default)]
+struct ObjectState {
+    cond: BTreeMap<usize, FrameOut>,
+    non_cond: BTreeMap<usize, FrameOut>,
+}
+
+struct FrameFeatures {
+    /// Lowest-resolution level `[1, 256, 64, 64]` and its position encoding.
+    low: Tensor,
+    pos: Tensor,
+    high: (Tensor, Tensor),
+}
+
+/// What a tracker may hold and take. A call that would exceed it stops with [`Error::Budget`].
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Budget {
+    /// Memory banks, results and cached frame features (bytes).
+    pub max_state_bytes: usize,
+    /// Wall-clock seconds one `propagate` call may take (`None`: no limit).
+    pub max_seconds: Option<f64>,
+}
+
+impl Default for Budget {
+    fn default() -> Budget {
+        Budget { max_state_bytes: 2 << 30, max_seconds: None }
+    }
+}
+
+/// Bytes of one stored frame: memory features and position encoding `[4096, 64]`, the pointer.
+const FRAME_BYTES: usize = 2 * GRID * GRID * 64 * 4 + 256 * 4;
+/// Bytes of a conditioning frame's kept result (`256 x 256` logits).
+const RESULT_BYTES: usize = 4 * GRID * 4 * GRID * 4;
+/// Bytes of one frame's cached neck features (lowest level and position, two skip levels).
+const FEATURE_BYTES: usize = (2 * 256 * GRID * GRID + 32 * 16 * GRID * GRID + 64 * 4 * GRID * GRID) * 4;
+
+pub struct VideoTracker<'a> {
+    model: Arc<VideoModel>,
+    frames: Box<dyn FrameSource + 'a>,
+    objects: BTreeMap<ObjectId, ObjectState>,
+    cache: VecDeque<(usize, Arc<FrameFeatures>)>,
+    budget: Budget,
+    peak: usize,
+}
+
+fn sine_embedding_1d(positions: &[f32], dim: usize) -> Result<Tensor> {
+    let half = dim / 2;
+    let dim_t: Vec<f32> = (0..half).map(|i| 10000f32.powf(2.0 * (i / 2) as f32 / half as f32)).collect();
+    let mut out = Vec::with_capacity(positions.len() * dim);
+    for p in positions {
+        out.extend(dim_t.iter().map(|d| (p / d).sin()));
+        out.extend(dim_t.iter().map(|d| (p / d).cos()));
+    }
+    Ok(Tensor::from_vec(out, (positions.len(), dim), &candle_core::Device::Cpu)?)
+}
+
+fn scalar(t: &Tensor) -> Result<f32> {
+    Ok(t.flatten_all()?.to_vec1::<f32>()?.first().copied().unwrap_or(0.0))
+}
+
+impl<'a> VideoTracker<'a> {
+    pub fn new(model: Arc<VideoModel>, frames: Box<dyn FrameSource + 'a>) -> Result<VideoTracker<'a>> {
+        let n = frames.num_frames();
+        if n == 0 || n > MAX_FRAMES {
+            return Err(Error::Input(format!("a clip needs between 1 and {MAX_FRAMES} frames, got {n}")));
+        }
+        Ok(VideoTracker { model, frames, objects: BTreeMap::new(), cache: VecDeque::new(), budget: Budget::default(), peak: 0 })
+    }
+
+    pub fn num_frames(&self) -> usize {
+        self.frames.num_frames()
+    }
+
+    /// Replace the limits (see [`Budget`]).
+    pub fn set_budget(&mut self, budget: Budget) {
+        self.budget = budget;
+    }
+
+    /// Bytes held now: stored frames, kept results and cached features.
+    pub fn state_bytes(&self) -> usize {
+        let frames: usize = self.objects.values().map(|o| (o.cond.len() + o.non_cond.len()) * FRAME_BYTES + o.cond.len() * RESULT_BYTES).sum();
+        frames + self.cache.len() * FEATURE_BYTES
+    }
+
+    /// The most [`VideoTracker::state_bytes`] reached so far.
+    pub fn peak_state_bytes(&self) -> usize {
+        self.peak
+    }
+
+    fn check_budget(&mut self) -> Result<()> {
+        let used = self.state_bytes();
+        self.peak = self.peak.max(used);
+        if used > self.budget.max_state_bytes {
+            return Err(Error::Budget(format!("the tracker holds {} MB, over its {} MB limit", used >> 20, self.budget.max_state_bytes >> 20)));
+        }
+        Ok(())
+    }
+
+    /// Forget every object and cached frame (the clip stays).
+    pub fn reset(&mut self) {
+        self.objects.clear();
+        self.cache.clear();
+    }
+
+    fn features(&mut self, frame: usize) -> Result<Arc<FrameFeatures>> {
+        if let Some((_, f)) = self.cache.iter().find(|(i, _)| *i == frame) {
+            return Ok(f.clone());
+        }
+        let pixels = self.frames.frame(frame)?;
+        let enc = self.model.encode(&pixels)?;
+        let (low, pos) = match (enc.features.features.get(2), enc.features.positions.get(2)) {
+            (Some(l), Some(p)) => (l.clone(), p.clone()),
+            _ => return Err(Error::Compute("vision encoder returned too few levels".into())),
+        };
+        let f = Arc::new(FrameFeatures { low, pos, high: enc.high });
+        self.cache.push_back((frame, f.clone()));
+        while self.cache.len() > 2 {
+            self.cache.pop_front();
+        }
+        Ok(f)
+    }
+
+    /// The memory bank for `frame`: memory frames and object pointers with their position
+    /// encodings, plus how many trailing tokens are pointers.
+    fn memory_bank(&self, obj: &ObjectState, frame: usize, reverse: bool) -> Result<(Tensor, Tensor, usize)> {
+        let (mut feats, mut poss) = (vec![], vec![]);
+        let temporal = |off: usize| -> Result<Tensor> {
+            // The reference indexes with `offset - 1`, so the conditioning frames (offset 0) use the last row.
+            let row = if off == 0 { MEMORY_FRAMES - 1 } else { off - 1 };
+            let v = self.model.temporal_pos.get(row * 64..(row + 1) * 64).ok_or_else(|| Error::Weights("temporal position table".into()))?;
+            Ok(Tensor::from_slice(v, (1, 64), &candle_core::Device::Cpu)?)
+        };
+        for out in obj.cond.values() {
+            feats.push(out.memory.features.clone());
+            poss.push(out.memory.pos.broadcast_add(&temporal(0)?)?);
+        }
+        for off in (1..MEMORY_FRAMES).rev() {
+            let prev = if reverse { frame.checked_add(off) } else { frame.checked_sub(off) };
+            if let Some(out) = prev.and_then(|p| obj.non_cond.get(&p)) {
+                feats.push(out.memory.features.clone());
+                poss.push(out.memory.pos.broadcast_add(&temporal(off)?)?);
+            }
+        }
+        // Object pointers: conditioning frames on the already-tracked side, then recent frames.
+        let n_frames = self.frames.num_frames();
+        let max_ptrs = n_frames.min(MAX_POINTERS);
+        let (mut offsets, mut pointers): (Vec<f32>, Vec<Tensor>) = (vec![], vec![]);
+        let sign = if reverse { -1.0f32 } else { 1.0 };
+        for (t, out) in &obj.cond {
+            if if reverse { *t >= frame } else { *t <= frame } {
+                offsets.push((frame as f32 - *t as f32) * sign);
+                pointers.push(out.pointer.clone());
+            }
+        }
+        for off in 1..max_ptrs {
+            let r = if reverse { frame.checked_add(off) } else { frame.checked_sub(off) };
+            let Some(r) = r.filter(|r| *r < n_frames) else { break };
+            if let Some(out) = obj.non_cond.get(&r) {
+                offsets.push(off as f32);
+                pointers.push(out.pointer.clone());
+            }
+        }
+        let mut n_pointer_tokens = 0;
+        if !pointers.is_empty() {
+            let max_diff = (max_ptrs.saturating_sub(1)).max(1) as f32;
+            let norm: Vec<f32> = offsets.iter().map(|o| o / max_diff).collect();
+            let pe = apply(&self.model.pointer_time_proj, &sine_embedding_1d(&norm, 256)?)?;
+            let ptrs = Tensor::cat(&pointers, 0)?; // [P, 256]
+            let p = ptrs.dim(0)?;
+            let tokens = ptrs.reshape((p * 4, 64))?;
+            let pe = pe.unsqueeze(1)?.broadcast_as((p, 4, 64))?.reshape((p * 4, 64))?;
+            n_pointer_tokens = p * 4;
+            feats.push(tokens);
+            poss.push(pe.contiguous()?);
+        }
+        if feats.is_empty() {
+            return Err(Error::Input("the object has no conditioning frame; add a prompt first".into()));
+        }
+        Ok((Tensor::cat(&feats, 0)?, Tensor::cat(&poss, 0)?, n_pointer_tokens))
+    }
+
+    /// Run the model on one frame for one object and store the result.
+    fn step(&mut self, id: ObjectId, frame: usize, prompt: Option<&Prompt>, reverse: bool, conditioning: bool) -> Result<FrameMask> {
+        // EFFECTCRAFT_SAM2_PROFILE=1 prints where a frame's time goes (stderr).
+        let profile = std::env::var_os("EFFECTCRAFT_SAM2_PROFILE").is_some();
+        let mut lap = std::time::Instant::now();
+        let mut mark = |what: &str| {
+            if profile {
+                eprintln!("sam2 frame {frame}: {what} {:.0} ms", lap.elapsed().as_secs_f64() * 1e3);
+            }
+            lap = std::time::Instant::now();
+        };
+        let feats = self.features(frame)?;
+        mark("encode");
+        let model = self.model.clone();
+        let tokens = |t: &Tensor| -> Result<Tensor> { Ok(t.flatten_from(2)?.squeeze(0)?.t()?.contiguous()?) };
+        let conditioned = if conditioning {
+            feats.low.broadcast_add(model.image.no_memory())?
+        } else {
+            let obj = self.objects.get(&id).ok_or_else(|| Error::Input("unknown object".into()))?;
+            let (mem, mem_pos, n_ptr) = self.memory_bank(obj, frame, reverse)?;
+            let out = model.attend(&tokens(&feats.low)?, &tokens(&feats.pos)?, &mem, &mem_pos, n_ptr)?;
+            out.t()?.contiguous()?.reshape((1, 256, GRID, GRID))?
+        };
+        mark("memory attention");
+        let num_points = prompt.map_or(0, |p| p.points.len() + 2 * usize::from(p.bbox.is_some()));
+        let multimask = num_points <= 1;
+        let sparse = match prompt {
+            Some(p) => model.image.prompt.sparse(p)?,
+            None => model.image.prompt.sparse_none()?,
+        };
+        let dense = model.image.prompt.dense_empty()?;
+        let out = model.image.decode_embedded(&conditioned, &feats.high, &sparse, &dense, multimask)?;
+
+        mark("decoder");
+        let score = scalar(&out.object_score)?;
+        let present = score > 0.0;
+        let ious = out.iou.flatten_all()?.to_vec1::<f32>()?;
+        let best = if multimask { ious.iter().enumerate().fold((0usize, f32::NEG_INFINITY), |b, (i, v)| if *v > b.1 { (i, *v) } else { b }).0 } else { 0 };
+        let low = out.masks.narrow(1, best, 1)?;
+        let low = if present { low } else { Tensor::full(NO_OBJECT, low.dims(), low.device())? };
+        let token = if multimask { out.sam_tokens.narrow(1, best, 1)? } else { out.sam_tokens.narrow(1, 0, 1)? }.squeeze(1)?;
+        let pointer = if present { model.pointer_proj.forward(&token)? } else { model.no_object_pointer.clone() };
+
+        let high = low.upsample_bilinear2d(INPUT_SIZE, INPUT_SIZE, false)?;
+        let for_memory = if prompt.is_some() { high.gt(0f32)?.to_dtype(DType::F32)? } else { sigmoid(&high)? };
+        let for_memory = ((for_memory * 20.0)? - 10.0)?;
+        mark("upsample and mask");
+        let memory = model.memorize(&feats.low, &for_memory, present)?;
+        mark("memory encoder");
+
+        let iou = ious.get(best).copied().unwrap_or(0.0);
+        let result = FrameMask { frame, object: id, logits: low.flatten_all()?.to_vec1::<f32>()?, iou, object_score: score, occluded: !present };
+        let state = self.objects.entry(id).or_default();
+        let entry = FrameOut { memory, pointer, result: conditioning.then(|| result.clone()) };
+        if conditioning {
+            state.non_cond.remove(&frame);
+            state.cond.insert(frame, entry);
+        } else {
+            state.non_cond.insert(frame, entry);
+            Self::prune(state, frame);
+        }
+        self.check_budget()?;
+        Ok(result)
+    }
+
+    /// Drop memories that no later frame in either direction can still look at.
+    fn prune(state: &mut ObjectState, frame: usize) {
+        let keep = |f: usize, cond: &BTreeMap<usize, FrameOut>| f.abs_diff(frame) <= MAX_POINTERS || cond.keys().any(|c| f.abs_diff(*c) <= MEMORY_FRAMES);
+        let doomed: Vec<usize> = state.non_cond.keys().copied().filter(|f| !keep(*f, &state.cond)).collect();
+        for f in doomed {
+            state.non_cond.remove(&f);
+        }
+    }
+
+    fn check_frame(&self, frame: usize) -> Result<()> {
+        if frame >= self.frames.num_frames() {
+            return Err(Error::Input(format!("frame {frame} is outside the clip of {} frames", self.frames.num_frames())));
+        }
+        Ok(())
+    }
+
+    /// Prompt an object on a frame (clicks and/or a box). The frame becomes one of the object's
+    /// conditioning frames when it has not been tracked yet; the mask comes back at once.
+    pub fn prompt(&mut self, frame: usize, object: ObjectId, prompt: &Prompt) -> Result<FrameMask> {
+        self.check_frame(frame)?;
+        prompt.validate()?;
+        if prompt.points.is_empty() && prompt.bbox.is_none() {
+            return Err(Error::Input("a prompt needs at least one point or a box".into()));
+        }
+        let tracked = self.objects.get(&object).is_some_and(|o| o.non_cond.contains_key(&frame));
+        if tracked {
+            // A correction on a tracked frame is conditioned on the memory like any tracked frame.
+            let reverse = false;
+            return self.step(object, frame, Some(prompt), reverse, false);
+        }
+        self.objects.entry(object).or_default();
+        self.step(object, frame, Some(prompt), false, true)
+    }
+
+    /// Prompt an object on a frame with a mask: `[1, 1, 1024, 1024]` of 0 and 1 (see
+    /// [`crate::resize::mask_to_model`]). The mask becomes the frame's output as it is (no decode of
+    /// the mask itself); the decoder only makes the object pointer. Like a click prompt, the frame is a
+    /// conditioning frame unless it has been tracked already.
+    pub fn prompt_mask(&mut self, frame: usize, object: ObjectId, mask: &Tensor) -> Result<FrameMask> {
+        self.check_frame(frame)?;
+        if mask.dims() != [1, 1, INPUT_SIZE, INPUT_SIZE] {
+            return Err(Error::Input(format!("a mask prompt must be [1, 1, {INPUT_SIZE}, {INPUT_SIZE}], got {:?}", mask.dims())));
+        }
+        let values = mask.flatten_all()?.to_vec1::<f32>()?;
+        if values.iter().any(|v| !v.is_finite()) {
+            return Err(Error::Input("a mask prompt must be finite".into()));
+        }
+        let tracked = self.objects.get(&object).is_some_and(|o| o.non_cond.contains_key(&frame));
+        self.objects.entry(object).or_default();
+        self.step_mask(object, frame, mask, &values, !tracked)
+    }
+
+    /// The reference's `_use_mask_as_output`: the mask is the output, the decoder makes the pointer.
+    fn step_mask(&mut self, id: ObjectId, frame: usize, mask: &Tensor, values: &[f32], conditioning: bool) -> Result<FrameMask> {
+        let feats = self.features(frame)?;
+        let model = self.model.clone();
+        let present = values.iter().any(|v| *v > 0.0);
+        let high = ((mask * 20.0)? - 10.0)?;
+        let low = antialias_bilinear(&high.flatten_all()?.to_vec1::<f32>()?, (INPUT_SIZE, INPUT_SIZE), (4 * GRID, 4 * GRID))?;
+        // The pointer: the decoder with the mask as its dense prompt and no clicks, on the frame's features
+        // without the no-memory embedding.
+        let down = mask.conv2d(&model.mask_down.0, 0, 4, 1, 1)?.broadcast_add(&model.mask_down.1.reshape((1, 1, 1, 1))?)?;
+        let dense = model.image.prompt.dense_mask(&down)?;
+        let out = model.image.decode_embedded(&feats.low, &feats.high, &model.image.prompt.sparse_none()?, &dense, true)?;
+        let ious = out.iou.flatten_all()?.to_vec1::<f32>()?;
+        let best = ious.iter().enumerate().fold((0usize, f32::NEG_INFINITY), |b, (i, v)| if *v > b.1 { (i, *v) } else { b }).0;
+        let token = out.sam_tokens.narrow(1, best, 1)?.squeeze(1)?;
+        let decoder_present = scalar(&out.object_score)? > 0.0;
+        let pointer = if decoder_present { model.pointer_proj.forward(&token)? } else { model.no_object_pointer.clone() };
+        let pointer = if present { pointer } else { model.no_object_pointer.clone() };
+        let memory = model.memorize(&feats.low, &high, present)?;
+        let score = if present { 10.0 } else { -10.0 };
+        let result = FrameMask { frame, object: id, logits: low, iou: 1.0, object_score: score, occluded: !present };
+        let state = self.objects.entry(id).or_default();
+        let entry = FrameOut { memory, pointer, result: conditioning.then(|| result.clone()) };
+        if conditioning {
+            state.non_cond.remove(&frame);
+            state.cond.insert(frame, entry);
+        } else {
+            state.non_cond.insert(frame, entry);
+            Self::prune(state, frame);
+        }
+        self.check_budget()?;
+        Ok(result)
+    }
+
+    /// Track every object from `start` through `max_frames` frames (the rest of the clip when
+    /// `None`) in `direction`, calling `out` for each object on each frame as it is finished.
+    pub fn propagate(&mut self, start: usize, direction: Direction, max_frames: Option<usize>, cancel: &Cancel, out: &mut dyn FnMut(FrameMask)) -> Result<()> {
+        self.propagate_objects(None, start, direction, max_frames, cancel, out)
+    }
+
+    /// [`VideoTracker::propagate`] for the listed objects only (`None`: every prompted object).
+    pub fn propagate_objects(
+        &mut self,
+        only: Option<&[ObjectId]>,
+        start: usize,
+        direction: Direction,
+        max_frames: Option<usize>,
+        cancel: &Cancel,
+        out: &mut dyn FnMut(FrameMask),
+    ) -> Result<()> {
+        self.check_frame(start)?;
+        let n = self.frames.num_frames();
+        let reverse = direction == Direction::Backward;
+        let span = max_frames.unwrap_or(n).min(n);
+        let ids: Vec<ObjectId> = self.objects.iter().filter(|(id, o)| !o.cond.is_empty() && only.is_none_or(|l| l.contains(id))).map(|(id, _)| *id).collect();
+        if ids.is_empty() {
+            return Err(Error::Input("no object has been prompted".into()));
+        }
+        let started = std::time::Instant::now();
+        for k in 0..=span {
+            let frame = if reverse { start.checked_sub(k) } else { Some(start + k).filter(|f| *f < n) };
+            let Some(frame) = frame else { break };
+            for id in &ids {
+                if cancel.is_cancelled() {
+                    return Err(Error::Cancelled);
+                }
+                if let Some(limit) = self.budget.max_seconds.filter(|l| started.elapsed().as_secs_f64() > *l) {
+                    return Err(Error::Budget(format!("tracking took more than {limit} s")));
+                }
+                let mask = self.mask_at(*id, frame, reverse)?;
+                out(mask);
+            }
+        }
+        Ok(())
+    }
+
+    /// Object `id` on `frame`: the result stored with its prompt there, else the tracker's step.
+    fn mask_at(&mut self, id: ObjectId, frame: usize, reverse: bool) -> Result<FrameMask> {
+        let stored = self.objects.get(&id).and_then(|o| o.cond.get(&frame)).and_then(|o| o.result.clone());
+        match stored {
+            Some(m) => Ok(m),
+            None => self.step(id, frame, None, reverse, false),
+        }
+    }
+
+    /// Track every listed object from its own prompted frame (`starts`: object, frame) in one pass
+    /// in `direction`, frame by frame with all the objects that have started: a frame is finished
+    /// for all of them before the next begins, so a caller that assembles the objects of a frame
+    /// does not hold frames waiting for a pass that has not got there. A backward pass leaves out
+    /// each object's own start frame (the forward pass reported it).
+    pub fn propagate_each(&mut self, starts: &[(ObjectId, usize)], direction: Direction, cancel: &Cancel, out: &mut dyn FnMut(FrameMask)) -> Result<()> {
+        let n = self.frames.num_frames();
+        for (id, start) in starts {
+            self.check_frame(*start)?;
+            if self.objects.get(id).is_none_or(|o| o.cond.is_empty()) {
+                return Err(Error::Input("no object has been prompted".into()));
+            }
+        }
+        if starts.is_empty() {
+            return Err(Error::Input("no object has been prompted".into()));
+        }
+        let reverse = direction == Direction::Backward;
+        let started = std::time::Instant::now();
+        for (id, frame) in pass_order(starts, n, reverse) {
+            if cancel.is_cancelled() {
+                return Err(Error::Cancelled);
+            }
+            if let Some(limit) = self.budget.max_seconds.filter(|l| started.elapsed().as_secs_f64() > *l) {
+                return Err(Error::Budget(format!("tracking took more than {limit} s")));
+            }
+            let mask = self.mask_at(id, frame, reverse)?;
+            out(mask);
+        }
+        Ok(())
+    }
+}
+
+/// The (object, frame) steps of [`VideoTracker::propagate_each`], in order: frame by frame from the
+/// first start (the last, backwards), each frame for the objects whose pass has reached it.
+fn pass_order(starts: &[(ObjectId, usize)], frames: usize, reverse: bool) -> impl Iterator<Item = (ObjectId, usize)> + '_ {
+    let first = if reverse { starts.iter().map(|s| s.1).max() } else { starts.iter().map(|s| s.1).min() };
+    let span = match first {
+        Some(f) if reverse => f + 1,
+        Some(f) => frames.saturating_sub(f),
+        None => 0,
+    };
+    (0..span).flat_map(move |k| {
+        let frame = if reverse { first.unwrap_or(0).saturating_sub(k) } else { first.unwrap_or(0) + k };
+        starts.iter().filter_map(move |(id, start)| {
+            let reached = if reverse { *start > frame } else { *start <= frame };
+            reached.then_some((*id, frame))
+        })
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn order(starts: &[(u32, usize)], frames: usize, reverse: bool) -> Vec<(u32, usize)> {
+        let starts: Vec<(ObjectId, usize)> = starts.iter().map(|(o, s)| (ObjectId(*o), *s)).collect();
+        pass_order(&starts, frames, reverse).map(|(o, f)| (o.0, f)).collect()
+    }
+
+    /// Forward, every frame is finished for all the objects that have started before the next frame
+    /// begins; an object joins the pass at its own start frame.
+    #[test]
+    fn the_forward_pass_goes_frame_by_frame_over_the_objects_that_have_started() {
+        assert_eq!(order(&[(1, 0), (2, 3)], 6, false), [(1, 0), (1, 1), (1, 2), (1, 3), (2, 3), (1, 4), (2, 4), (1, 5), (2, 5)]);
+        // Prompts on the same frame go together; the pass starts at the earliest start.
+        assert_eq!(order(&[(1, 2), (2, 2)], 4, false), [(1, 2), (2, 2), (1, 3), (2, 3)]);
+        assert_eq!(order(&[(1, 2)], 4, false), [(1, 2), (1, 3)]);
+    }
+
+    /// Backward, from the last start down to frame 0, leaving out each object's own start frame.
+    #[test]
+    fn the_backward_pass_goes_frame_by_frame_and_skips_each_objects_own_start() {
+        assert_eq!(order(&[(1, 0), (2, 3)], 6, true), [(2, 2), (2, 1), (2, 0)]);
+        assert_eq!(order(&[(1, 2), (2, 3)], 6, true), [(2, 2), (1, 1), (2, 1), (1, 0), (2, 0)]);
+        assert!(order(&[(1, 0)], 6, true).is_empty(), "nothing before frame 0");
+    }
+
+    /// A frame is finished for every object before the next begins, however far apart the prompts
+    /// are: the number of frames waiting for an object never grows with the clip.
+    #[test]
+    fn no_frame_waits_for_an_object_that_has_not_reached_it() {
+        let steps = order(&[(1, 0), (2, 1000)], 2000, false);
+        let mut waiting = 0usize;
+        let mut worst = 0usize;
+        let mut seen = std::collections::BTreeMap::<usize, usize>::new();
+        for (_, f) in steps {
+            let n = seen.entry(f).or_default();
+            *n += 1;
+            // From frame 1000 on, both objects report each frame back to back.
+            if f >= 1000 && *n == 2 {
+                waiting -= 1;
+            } else if f >= 1000 {
+                waiting += 1;
+            }
+            worst = worst.max(waiting);
+        }
+        assert!(worst <= 1, "{worst} frames waiting");
+    }
+}
diff --git a/crates/sam2/src/track.rs b/crates/sam2/src/track.rs
new file mode 100644
index 000000000..d7717b5d0
--- /dev/null
+++ b/crates/sam2/src/track.rs
@@ -0,0 +1,295 @@
+// Modified work: adapts the ported SAM 2 video tracker to EffectCraft's `ObjectTracker`
+// interface (Apache-2.0, see NOTICE).
+//! SAM 2 as the Roto Brush's object tracker: prompts on some frames, the whole clip tracked
+//! forwards and backwards, each frame reported as it is finished.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::rc::Rc;
+use std::sync::Arc;
+
+use candle_core::Tensor;
+use effectcraft_segment::{ClipFrame, ObjectTracker, TrackRequest, TrackedFrame};
+
+use crate::mask::{Sam2Mask, preprocess, validate_frame_size};
+use crate::prompt::{INPUT_SIZE, Prompt};
+use crate::resize::mask_to_model;
+use crate::session::{Cancel, Direction, FrameMask, FrameSource, ObjectId, VideoTracker};
+use crate::{Error, Result};
+
+/// Most frames one tracking request may cover.
+const MAX_CLIP: usize = 100_000;
+
+type Frames<'a> = &'a mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>;
+
+/// Feeds the host's frames to the tracker, remembering each frame's size for the output.
+struct Source<'a> {
+    first: i64,
+    count: usize,
+    fetch: RefCell<Frames<'a>>,
+    sizes: Rc<RefCell<HashMap<usize, (usize, usize)>>>,
+    /// Prompt frames fetched only to learn their size, kept for the encoder (taken on first use).
+    held: RefCell<Held>,
+}
+
+/// Most pixel data (in bytes) kept from the size check of the prompt frames; frames beyond it are
+/// fetched again when the tracker needs them.
+const HELD_BYTES: usize = 256 << 20;
+
+#[derive(Default)]
+struct Held {
+    frames: HashMap<usize, Arc<ClipFrame>>,
+    bytes: usize,
+}
+
+impl Held {
+    fn keep(&mut self, index: usize, f: &Arc<ClipFrame>) {
+        let bytes = f.rgb.len().saturating_mul(std::mem::size_of::<[f32; 3]>());
+        let fits = self.bytes.checked_add(bytes).filter(|t| *t <= HELD_BYTES);
+        if let (Some(total), false) = (fits, self.frames.contains_key(&index)) {
+            self.frames.insert(index, f.clone());
+            self.bytes = total;
+        }
+    }
+
+    fn take(&mut self, index: usize) -> Option<Arc<ClipFrame>> {
+        let f = self.frames.remove(&index)?;
+        self.bytes = self.bytes.saturating_sub(f.rgb.len().saturating_mul(std::mem::size_of::<[f32; 3]>()));
+        Some(f)
+    }
+}
+
+impl FrameSource for Source<'_> {
+    fn num_frames(&self) -> usize {
+        self.count
+    }
+
+    fn frame(&self, index: usize) -> Result<Tensor> {
+        let number = i64::try_from(index)
+            .ok()
+            .filter(|_| index < self.count)
+            .and_then(|offset| self.first.checked_add(offset))
+            .ok_or_else(|| Error::Input(format!("frame index {index} is outside the clip")))?;
+        let held = self.held.borrow_mut().take(index);
+        let f = match held {
+            Some(f) => f,
+            None => (self.fetch.borrow_mut())(number).ok_or_else(|| Error::Input(format!("frame {number} is not available")))?,
+        };
+        self.sizes.borrow_mut().insert(index, (f.w, f.h));
+        preprocess(&f.rgb, f.w, f.h)
+    }
+}
+
+fn to_frame(m: &FrameMask, size: (usize, usize)) -> Result<TrackedFrame> {
+    let (w, h) = size;
+    let logits = Tensor::from_slice(&m.logits, (1, 1, 256, 256), &candle_core::Device::Cpu)?;
+    let prob = candle_nn::ops::sigmoid(&logits.upsample_bilinear2d(h, w, false)?)?.flatten_all()?.to_vec1::<f32>()?;
+    let presence = 1.0 / (1.0 + (-m.object_score).exp());
+    Ok(TrackedFrame { prob, w, h, confidence: (presence * m.iou.clamp(0.0, 1.0)).clamp(0.0, 1.0), occluded: m.occluded })
+}
+
+/// Most objects one request may track.
+const MAX_OBJECTS: usize = 32;
+
+/// Every prompt as `(object, frame index, prompt)`, in frame order (then object order), after
+/// checking each prompt frame and recording its size in `source`. Frame order keeps the tracker's
+/// two-frame feature cache useful: all objects prompted on a frame are encoded together, so each
+/// prompt frame is encoded once however many objects there are. Objects do not influence each
+/// other, so the order of prompts across objects does not change any result.
+fn gather_prompts<'r>(req: &'r TrackRequest, source: &Source<'_>) -> Result<Vec<(usize, usize, &'r effectcraft_segment::Prompt)>> {
+    // Prompt coordinates are in the frame's pixels and the model works at 1024 x 1024, so the
+    // prompted frames' sizes are needed first.
+    let mut prompt_frames = vec![];
+    for (oi, prompts) in req.objects.iter().enumerate() {
+        for (frame, p) in prompts {
+            let idx = frame
+                .checked_sub(req.first)
+                .and_then(|offset| usize::try_from(offset).ok())
+                .filter(|i| *i < req.count)
+                .ok_or_else(|| Error::Input(format!("prompt frame {frame} is outside the clip")))?;
+            if !source.sizes.borrow().contains_key(&idx) {
+                let f = (source.fetch.borrow_mut())(*frame).ok_or_else(|| Error::Input(format!("frame {frame} is not available")))?;
+                validate_frame_size(f.w, f.h, f.rgb.len())?;
+                source.sizes.borrow_mut().insert(idx, (f.w, f.h));
+                source.held.borrow_mut().keep(idx, &f);
+            }
+            prompt_frames.push((oi, idx, p));
+        }
+    }
+    // stable: prompts of one object on one frame keep their order
+    prompt_frames.sort_by_key(|(oi, idx, _)| (*idx, *oi));
+    Ok(prompt_frames)
+}
+
+impl Sam2Mask {
+    fn run_track(&self, req: &TrackRequest, frames: Frames<'_>, cancel: &dyn Fn() -> bool, out: &mut dyn FnMut(usize, i64, TrackedFrame)) -> Result<()> {
+        if req.count == 0 || req.count > MAX_CLIP {
+            return Err(Error::Input(format!("a tracking request needs 1 to {MAX_CLIP} frames, got {}", req.count)));
+        }
+        req.first.checked_add((req.count - 1) as i64).ok_or_else(|| Error::Input("the clip's last frame overflows its frame number".into()))?;
+        if req.objects.is_empty() || req.objects.len() > MAX_OBJECTS || req.objects.iter().any(|o| o.is_empty()) {
+            return Err(Error::Input(format!("tracking needs 1 to {MAX_OBJECTS} objects, each with a prompt on at least one frame")));
+        }
+        let sizes = Rc::new(RefCell::new(HashMap::new()));
+        let source = Source { first: req.first, count: req.count, fetch: RefCell::new(frames), sizes: sizes.clone(), held: RefCell::default() };
+        let prompt_frames = gather_prompts(req, &source)?;
+        let mut tracker = VideoTracker::new(self.video_model().clone(), Box::new(source))?;
+        let object_id = |oi: usize| ObjectId(oi as u32 + 1);
+        // each object's first prompted frame: its pass starts there, forwards and backwards
+        let mut first_of: HashMap<usize, usize> = HashMap::new();
+        for (oi, idx, p) in prompt_frames {
+            if cancel() {
+                return Err(Error::Cancelled);
+            }
+            let (w, h) = sizes.borrow().get(&idx).copied().ok_or_else(|| Error::Compute("frame size unknown".into()))?;
+            // A prompt that is only a mask (probability per pixel of the frame) prompts with the mask.
+            if let (true, true, Some(m)) = (p.points.is_empty(), p.bbox.is_none(), p.mask.as_ref()) {
+                if m.len() != w * h {
+                    return Err(Error::Input(format!("a mask prompt of {} values does not fit a {w}x{h} frame", m.len())));
+                }
+                let binary: Vec<u8> = m.iter().map(|v| u8::from(*v >= 0.5)).collect();
+                tracker.prompt_mask(idx, object_id(oi), &mask_to_model(&binary, w, h)?)?;
+                let e = first_of.entry(oi).or_insert(idx);
+                *e = (*e).min(idx);
+                continue;
+            }
+            let (sx, sy) = (INPUT_SIZE as f32 / w as f32, INPUT_SIZE as f32 / h as f32);
+            let prompt = Prompt {
+                points: p.points.iter().map(|(c, fg)| ([c[0] * sx, c[1] * sy], *fg)).collect(),
+                bbox: p.bbox.map(|b| [b[0] * sx, b[1] * sy, b[2] * sx, b[3] * sy]),
+            };
+            tracker.prompt(idx, object_id(oi), &prompt)?;
+            let e = first_of.entry(oi).or_insert(idx);
+            *e = (*e).min(idx);
+        }
+        let mut starts: Vec<(ObjectId, usize)> = first_of.into_iter().map(|(oi, idx)| (object_id(oi), idx)).collect();
+        starts.sort_by_key(|(id, _)| id.0);
+        let flag = Cancel::new();
+        let mut failure: Option<Error> = None;
+        let mut emit = |m: FrameMask| {
+            if cancel() {
+                flag.cancel();
+            }
+            let oi = (m.object.0 as usize).saturating_sub(1);
+            match to_frame(&m, sizes.borrow().get(&m.frame).copied().unwrap_or((0, 0))) {
+                Ok(t) => out(oi, req.first + m.frame as i64, t),
+                Err(e) => {
+                    failure.get_or_insert(e);
+                    flag.cancel();
+                }
+            }
+        };
+        // One pass each way over all the objects, frame by frame, so the host can finish a frame (and
+        // let go of its masks) as soon as every object has it, however far apart the prompts are.
+        let passes = (|| {
+            tracker.propagate_each(&starts, Direction::Forward, &flag, &mut emit)?;
+            if starts.iter().any(|(_, start)| *start > 0) {
+                tracker.propagate_each(&starts, Direction::Backward, &flag, &mut emit)?;
+            }
+            Ok(())
+        })();
+        self.peak.store(tracker.peak_state_bytes() as u64, std::sync::atomic::Ordering::Relaxed);
+        // A frame that could not be converted cancelled the passes; that is the error to report, not
+        // the cancellation it caused.
+        match failure {
+            Some(e) => Err(e),
+            None => passes,
+        }
+    }
+}
+
+impl ObjectTracker for Sam2Mask {
+    fn track(
+        &self,
+        req: &TrackRequest,
+        frames: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+        cancel: &dyn Fn() -> bool,
+        out: &mut dyn FnMut(usize, i64, TrackedFrame),
+    ) -> effectcraft_segment::Result<()> {
+        self.touch();
+        let r = self.run_track(req, frames, cancel, out).map_err(|e| e.to_string());
+        self.touch();
+        r
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn source_rejects_overflowing_and_out_of_range_indices_before_fetching() {
+        let mut fetch = |_| panic!("invalid indices must not fetch a frame");
+        let source = Source { first: i64::MAX, count: 2, fetch: RefCell::new(&mut fetch), sizes: Default::default(), held: RefCell::default() };
+        assert!(matches!(source.frame(1), Err(Error::Input(_))));
+        assert!(matches!(source.frame(usize::MAX), Err(Error::Input(_))));
+    }
+
+    fn clip_frame(w: usize, h: usize) -> Arc<ClipFrame> {
+        Arc::new(ClipFrame { rgb: vec![[0.5, 0.25, 0.75]; w * h], w, h })
+    }
+
+    fn point_prompt() -> effectcraft_segment::Prompt {
+        effectcraft_segment::Prompt { points: vec![([1.0, 1.0], true)], bbox: None, mask: None }
+    }
+
+    /// Several objects prompted on the same frames: prompts come out frame by frame (so the
+    /// two-frame feature cache holds each prompt frame for all of its objects), and each prompt
+    /// frame is fetched from the host once, size check and encoding together.
+    #[test]
+    fn prompts_run_frame_major_and_each_prompt_frame_is_fetched_once() {
+        let frames_prompted = [10i64, 13, 16];
+        let req = TrackRequest { first: 10, count: 8, objects: (0..4).map(|_| frames_prompted.iter().map(|f| (*f, point_prompt())).collect()).collect() };
+        let fetched = RefCell::new(vec![]);
+        let mut fetch = |n: i64| {
+            fetched.borrow_mut().push(n);
+            Some(clip_frame(4, 3))
+        };
+        let source = Source { first: req.first, count: req.count, fetch: RefCell::new(&mut fetch), sizes: Default::default(), held: RefCell::default() };
+        let order: Vec<(usize, usize)> = gather_prompts(&req, &source).unwrap().into_iter().map(|(oi, idx, _)| (idx, oi)).collect();
+        let expected: Vec<(usize, usize)> = [0usize, 3, 6].iter().flat_map(|f| (0..4).map(move |o| (*f, o))).collect();
+        assert_eq!(order, expected);
+        assert_eq!(*fetched.borrow(), vec![10, 13, 16], "one size-check fetch per distinct prompt frame");
+        // the tracker's first look at each prompt frame reuses the frame already fetched
+        for idx in [0usize, 3, 6] {
+            source.frame(idx).unwrap();
+        }
+        assert_eq!(fetched.borrow().len(), 3, "encoding a prompt frame must not fetch it again");
+        // a held frame is handed over once; a second look fetches again
+        source.frame(0).unwrap();
+        assert_eq!(*fetched.borrow(), vec![10, 13, 16, 10]);
+    }
+
+    #[test]
+    fn prompts_of_one_object_on_one_frame_keep_their_order() {
+        let (mut a, mut b) = (point_prompt(), point_prompt());
+        a.points = vec![([1.0, 1.0], true)];
+        b.points = vec![([2.0, 2.0], false)];
+        let req = TrackRequest { first: 0, count: 3, objects: vec![vec![(2, a.clone()), (1, point_prompt()), (2, b.clone())]] };
+        let mut fetch = |_| Some(clip_frame(2, 2));
+        let source = Source { first: 0, count: 3, fetch: RefCell::new(&mut fetch), sizes: Default::default(), held: RefCell::default() };
+        let got = gather_prompts(&req, &source).unwrap();
+        assert_eq!(got.iter().map(|(_, i, _)| *i).collect::<Vec<_>>(), vec![1, 2, 2]);
+        assert_eq!(got[1].2.points, a.points);
+        assert_eq!(got[2].2.points, b.points);
+    }
+
+    #[test]
+    fn held_frames_are_bounded() {
+        let mut held = Held::default();
+        let big = Arc::new(ClipFrame { rgb: vec![[0.0; 3]; HELD_BYTES / 12 + 1], w: 1, h: HELD_BYTES / 12 + 1 });
+        held.keep(0, &big);
+        assert!(held.take(0).is_none(), "a frame over the cap is not kept");
+        let small = clip_frame(4, 4);
+        held.keep(1, &small);
+        assert!(held.take(1).is_some());
+        assert_eq!(held.bytes, 0);
+        // the cap is cumulative: frames that fit together are kept, the one that breaks it is not
+        let third = Arc::new(ClipFrame { rgb: vec![[0.0; 3]; HELD_BYTES / 12 / 3 + 1], w: 1, h: HELD_BYTES / 12 / 3 + 1 });
+        for i in 0..4 {
+            held.keep(i, &third);
+        }
+        assert_eq!(held.frames.len(), 2);
+        assert!(held.bytes <= HELD_BYTES);
+    }
+}
diff --git a/crates/sam2/src/weights.rs b/crates/sam2/src/weights.rs
new file mode 100644
index 000000000..ca246b143
--- /dev/null
+++ b/crates/sam2/src/weights.rs
@@ -0,0 +1,112 @@
+// Modified work: loads the safetensors checkpoint of Hugging Face `transformers` SAM 2
+// (Apache-2.0, Copyright The HuggingFace Inc. team). See NOTICE.
+//! Checkpoint loading with validation: every tensor is f32 and finite, every lookup checks its
+//! shape, so a truncated, mislabelled or poisoned file is an error, not a crash or garbage.
+
+use std::collections::HashMap;
+use std::path::Path;
+
+use candle_core::{DType, Device, Tensor};
+
+use crate::{Error, Result};
+
+/// Named tensors of one checkpoint.
+pub struct Weights {
+    map: HashMap<String, Tensor>,
+}
+
+impl Weights {
+    /// Read a `.safetensors` file; rejects non-finite values and unsupported dtypes.
+    pub fn open(path: &Path) -> Result<Weights> {
+        let map = candle_core::safetensors::load(path, &Device::Cpu).map_err(|e| Error::Weights(format!("{}: {e}", path.display())))?;
+        Weights::from_map(map)
+    }
+
+    /// Read a checkpoint held in memory (the installed file's bytes, already verified by the caller).
+    pub fn from_bytes(bytes: &[u8]) -> Result<Weights> {
+        let map = candle_core::safetensors::load_buffer(bytes, &Device::Cpu).map_err(|e| Error::Weights(e.to_string()))?;
+        Weights::from_map(map)
+    }
+
+    /// Validate an already-loaded set of tensors.
+    pub fn from_map(map: HashMap<String, Tensor>) -> Result<Weights> {
+        let mut out = HashMap::with_capacity(map.len());
+        for (name, t) in map {
+            let t = match t.dtype() {
+                DType::F32 => t,
+                DType::F16 | DType::BF16 | DType::F64 => t.to_dtype(DType::F32)?,
+                other => return Err(Error::Weights(format!("`{name}` has unsupported dtype {other:?}"))),
+            };
+            let flat = t.flatten_all()?.to_vec1::<f32>()?;
+            if flat.iter().any(|v| !v.is_finite()) {
+                return Err(Error::Weights(format!("`{name}` contains NaN or infinity")));
+            }
+            out.insert(name, t);
+        }
+        Ok(Weights { map: out })
+    }
+
+    pub fn contains(&self, name: &str) -> bool {
+        self.map.contains_key(name)
+    }
+
+    /// The shape of a tensor, if the checkpoint has it.
+    pub fn shape(&self, name: &str) -> Option<Vec<usize>> {
+        self.map.get(name).map(|t| t.dims().to_vec())
+    }
+
+    pub fn len(&self) -> usize {
+        self.map.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.map.is_empty()
+    }
+
+    /// The tensor `name`, which must have exactly `shape`.
+    pub fn get(&self, name: &str, shape: &[usize]) -> Result<Tensor> {
+        let t = self.map.get(name).ok_or_else(|| Error::Weights(format!("missing tensor `{name}`")))?;
+        if t.dims() != shape {
+            return Err(Error::Weights(format!("`{name}` has shape {:?}, expected {shape:?}", t.dims())));
+        }
+        Ok(t.clone())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn one(name: &str, t: Tensor) -> HashMap<String, Tensor> {
+        HashMap::from([(name.to_string(), t)])
+    }
+
+    #[test]
+    fn rejects_missing_wrong_shape_and_non_finite() {
+        let ok = Tensor::zeros((2, 3), DType::F32, &Device::Cpu).unwrap();
+        let w = Weights::from_map(one("a", ok)).unwrap();
+        assert!(w.get("a", &[2, 3]).is_ok());
+        assert!(matches!(w.get("a", &[3, 2]), Err(Error::Weights(_))));
+        assert!(matches!(w.get("b", &[1]), Err(Error::Weights(_))));
+        let bad = Tensor::new(&[1.0f32, f32::NAN], &Device::Cpu).unwrap();
+        assert!(matches!(Weights::from_map(one("n", bad)), Err(Error::Weights(_))));
+        let inf = Tensor::new(&[f32::INFINITY], &Device::Cpu).unwrap();
+        assert!(Weights::from_map(one("i", inf)).is_err());
+        let ints = Tensor::new(&[1u32], &Device::Cpu).unwrap();
+        assert!(Weights::from_map(one("u", ints)).is_err());
+    }
+
+    #[test]
+    fn a_truncated_file_is_an_error() {
+        let dir = std::env::temp_dir().join(format!("sam2-weights-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let p = dir.join("w.safetensors");
+        let t = Tensor::zeros((4, 4), DType::F32, &Device::Cpu).unwrap();
+        candle_core::safetensors::save(&one("x", t), &p).unwrap();
+        let bytes = std::fs::read(&p).unwrap();
+        std::fs::write(&p, &bytes[..bytes.len() - 8]).unwrap();
+        assert!(matches!(Weights::open(&p), Err(Error::Weights(_))));
+        assert!(matches!(Weights::open(&dir.join("absent")), Err(Error::Weights(_))));
+        std::fs::remove_dir_all(&dir).ok();
+    }
+}
diff --git a/crates/sam2/tests/it/figure.rs b/crates/sam2/tests/it/figure.rs
new file mode 100644
index 000000000..2ca4d0b13
--- /dev/null
+++ b/crates/sam2/tests/it/figure.rs
@@ -0,0 +1,77 @@
+use effectcraft_sam2::model::ImageModel;
+use effectcraft_sam2::prompt::Prompt;
+use effectcraft_sam2::weights::Weights;
+
+fn figure(w: usize, h: usize) -> (Vec<[f32; 3]>, Vec<bool>) {
+    let mut rgb = vec![[0f32; 3]; w * h];
+    let mut gt = vec![false; w * h];
+    let part = |x: f32, y: f32| -> Option<[f32; 3]> {
+        let (cx, _cy) = (128.0, 0.0);
+        let r = |x0: f32, y0: f32, x1: f32, y1: f32| x >= x0 && x < x1 && y >= y0 && y < y1;
+        if (x - cx).powi(2) + (y - 40.0).powi(2) < 18.0f32.powi(2) {
+            return Some([0.8, 0.6, 0.5]);
+        } // head
+        if r(104.0, 60.0, 152.0, 130.0) {
+            return Some([0.2, 0.3, 0.7 + 0.1 * (x / 7.0).sin()]);
+        } // torso
+        if r(76.0, 62.0, 104.0, 74.0) || r(152.0, 62.0, 180.0, 74.0) {
+            return Some([0.8, 0.6, 0.5]);
+        } // arms
+        if r(108.0, 130.0, 124.0, 210.0) || r(132.0, 130.0, 148.0, 210.0) {
+            return Some([0.15, 0.15, 0.2]);
+        } // legs
+        if r(102.0, 210.0, 126.0, 224.0) || r(130.0, 210.0, 154.0, 224.0) {
+            return Some([0.95, 0.95, 0.95]);
+        } // white shoes
+        None
+    };
+    for y in 0..h {
+        for x in 0..w {
+            let bg = 0.45 + 0.1 * (x as f32 / 11.0).sin() * (y as f32 / 9.0).cos();
+            let p = part(x as f32, y as f32);
+            rgb[y * w + x] = p.unwrap_or([bg, bg * 0.9, bg * 0.8]);
+            gt[y * w + x] = p.is_some();
+        }
+    }
+    (rgb, gt)
+}
+
+fn iou(p: &[f32], gt: &[bool]) -> f64 {
+    let (mut i, mut u) = (0usize, 0usize);
+    for (a, b) in p.iter().zip(gt) {
+        let a = *a > 0.0;
+        i += usize::from(a && *b);
+        u += usize::from(a || *b);
+    }
+    i as f64 / u.max(1) as f64
+}
+
+/// A multi-part figure (torso, head, legs, arms, white shoes in different colours): clicks alone make
+/// SAM 2 pick the torso and head, a box around the figure makes it cover all of it. This is why Roto
+/// Brush prompts the tracker with a box from the classic engine's matte (found on real footage, where
+/// the stroke frame came out partial).
+#[test]
+fn a_box_makes_sam2_cover_every_part_of_the_object() {
+    let wf = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../sam2-tiny/model.safetensors");
+    let wf = std::env::var_os("EFFECTCRAFT_SAM2_DIR").map_or(wf, |d| std::path::PathBuf::from(d).join("model.safetensors"));
+    if !wf.exists() {
+        eprintln!("skipped: no SAM 2 weights");
+        return;
+    }
+    let model = ImageModel::load(&Weights::open(&wf).unwrap()).unwrap();
+    let (w, h) = (256usize, 256usize);
+    let (rgb, gt) = figure(w, h);
+    let enc = model.encode(&effectcraft_sam2::mask::preprocess(&rgb, w, h).unwrap()).unwrap();
+    let s = 4.0f32;
+    let clicks = vec![([128.0 * s, 75.0 * s], true), ([128.0 * s, 100.0 * s], true), ([128.0 * s, 125.0 * s], true), ([20.0 * s, 20.0 * s], false)];
+    let mask = |p: &Prompt| -> (f64, f32) {
+        let out = model.segment(&enc, p, false).unwrap();
+        let m = out.masks.narrow(1, 0, 1).unwrap().upsample_bilinear2d(h, w, false).unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap();
+        (iou(&m, &gt), out.iou.flatten_all().unwrap().to_vec1::<f32>().unwrap()[0])
+    };
+    let (points_only, _) = mask(&Prompt { points: clicks.clone(), bbox: None });
+    let (boxed, predicted) = mask(&Prompt { points: clicks, bbox: Some([70.0 * s, 18.0 * s, 186.0 * s, 228.0 * s]) });
+    eprintln!("clicks only: IoU {points_only:.2}; with the box: IoU {boxed:.2} (predicted quality {predicted:.2})");
+    assert!(points_only < 0.6, "the clicks-only failure this test documents is gone ({points_only}): revisit the box prompt");
+    assert!(boxed > 0.95 && predicted > 0.7, "boxed IoU {boxed}, predicted {predicted}");
+}
diff --git a/crates/sam2/tests/it/main.rs b/crates/sam2/tests/it/main.rs
new file mode 100644
index 000000000..b8232c63f
--- /dev/null
+++ b/crates/sam2/tests/it/main.rs
@@ -0,0 +1,4 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod figure;
+mod reference;
diff --git a/crates/sam2/tests/it/reference.rs b/crates/sam2/tests/it/reference.rs
new file mode 100644
index 000000000..01648e329
--- /dev/null
+++ b/crates/sam2/tests/it/reference.rs
@@ -0,0 +1,805 @@
+//! Stage-by-stage comparison with the PyTorch / transformers reference (`tools/sam2_reference.py`).
+//!
+//! Needs the `facebook/sam2.1-hiera-tiny` weights (default `<repo>/sam2-tiny`, or the folder in
+//! `EFFECTCRAFT_SAM2_DIR`) and the fixture tensors (`<repo>/plan/sam2-ref/image.safetensors`, or
+//! `EFFECTCRAFT_SAM2_REF`). Without them every test here skips, so CI stays green.
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use candle_core::{Device, Tensor};
+use effectcraft_sam2::hiera::{Hiera, HieraConfig};
+use effectcraft_sam2::weights::Weights;
+
+fn repo() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..")
+}
+
+fn weights_file() -> PathBuf {
+    std::env::var_os("EFFECTCRAFT_SAM2_DIR").map_or_else(|| repo().join("sam2-tiny"), PathBuf::from).join("model.safetensors")
+}
+
+fn fixture_file() -> PathBuf {
+    std::env::var_os("EFFECTCRAFT_SAM2_REF").map_or_else(|| repo().join("plan/sam2-ref/image.safetensors"), PathBuf::from)
+}
+
+/// The weights and the reference tensors, or `None` (the test then skips).
+fn load() -> Option<(Weights, HashMap<String, Tensor>)> {
+    let (wf, rf) = (weights_file(), fixture_file());
+    if !wf.exists() || !rf.exists() {
+        eprintln!("skipped: SAM 2 weights or reference tensors not found ({} / {})", wf.display(), rf.display());
+        return None;
+    }
+    let w = Weights::open(&wf).unwrap();
+    let r = candle_core::safetensors::load(&rf, &Device::Cpu).unwrap();
+    note_size(&w);
+    Some((w, r))
+}
+
+fn max_abs(a: &Tensor, b: &Tensor) -> f32 {
+    assert_eq!(a.dims(), b.dims(), "shape mismatch");
+    (a - b).unwrap().abs().unwrap().flatten_all().unwrap().max(0).unwrap().to_scalar::<f32>().unwrap()
+}
+
+/// The largest magnitude in a tensor.
+fn peak(t: &Tensor) -> f32 {
+    t.abs().unwrap().flatten_all().unwrap().max(0).unwrap().to_scalar::<f32>().unwrap()
+}
+
+/// Set when the checkpoint is Base+ or Large (24 and 48 blocks): f32 rounding error is relative and accumulates with
+/// depth, and these backbones carry much larger activations (Large peaks at 140). Tiny and Small keep the strict bounds.
+static DEEP: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+
+fn note_size(w: &Weights) {
+    let size = effectcraft_sam2::Size::detect(w).unwrap();
+    DEEP.store(matches!(size, effectcraft_sam2::Size::BasePlus | effectcraft_sam2::Size::Large), std::sync::atomic::Ordering::Relaxed);
+}
+
+/// `base`, or for the deep backbones the larger of `base` and 5e-4 of the activations' peak.
+fn tol(base: f32, want: &Tensor) -> f32 {
+    if DEEP.load(std::sync::atomic::Ordering::Relaxed) { base.max(5e-4 * peak(want)) } else { base }
+}
+
+/// `base`, ×4 for the deep backbones.
+fn loose(base: f32) -> f32 {
+    if DEEP.load(std::sync::atomic::Ordering::Relaxed) { base * 4.0 } else { base }
+}
+
+/// f32 activations differ from PyTorch by accumulation order only; the Hiera blocks stay well
+/// inside this bound (measured max 2.6e-5, 2026-10-15).
+const HIERA_TOL: f32 = 1e-4;
+
+#[test]
+fn hiera_matches_pytorch_block_by_block() {
+    let Some((w, r)) = load() else { return };
+    let hiera = Hiera::load(&w, &HieraConfig::for_size(effectcraft_sam2::Size::detect(&w).unwrap())).unwrap();
+    let pixels = r.get("input.pixel_values").unwrap();
+    let (emb, blocks) = hiera.forward_all(pixels).unwrap();
+    let e = max_abs(&emb, r.get("vision_encoder.backbone.patch_embed.0").unwrap());
+    eprintln!("patch_embed max abs error {e:e}");
+    assert!(e < 1e-4, "patch embed error {e}");
+    assert_eq!(blocks.len(), HieraConfig::for_size(effectcraft_sam2::Size::detect(&w).unwrap()).blocks.iter().sum::<usize>());
+    for (i, b) in blocks.iter().enumerate() {
+        let want = r.get(&format!("vision_encoder.backbone.blocks.{i}.0")).unwrap();
+        let e = max_abs(b, want);
+        eprintln!("block {i}: max abs error {e:e}");
+        let t = tol(HIERA_TOL, want);
+        assert!(e < t, "block {i} error {e} (tolerance {t}, peak {})", peak(want));
+    }
+}
+
+#[test]
+fn hiera_is_deterministic_and_rejects_bad_sizes() {
+    let Some((w, r)) = load() else { return };
+    let hiera = Hiera::load(&w, &HieraConfig::for_size(effectcraft_sam2::Size::detect(&w).unwrap())).unwrap();
+    let pixels = r.get("input.pixel_values").unwrap();
+    let a = hiera.forward(pixels).unwrap();
+    let b = hiera.forward(pixels).unwrap();
+    assert_eq!(a.len(), 4);
+    for (x, y) in a.iter().zip(&b) {
+        assert_eq!(max_abs(x, y), 0.0);
+    }
+    let odd = pixels.narrow(2, 0, 1022).unwrap();
+    assert!(hiera.forward(&odd).is_err());
+}
+
+/// The neck adds 1x1 convolutions and nearest-neighbour sums to the Hiera output; the sine
+/// position encodings are exact functions of the grid size.
+const NECK_TOL: f32 = 1e-4;
+
+#[test]
+fn neck_and_vision_encoder_match_pytorch() {
+    let Some((w, r)) = load() else { return };
+    let enc = effectcraft_sam2::neck::VisionEncoder::load(&w).unwrap();
+    let pixels = r.get("input.pixel_values").unwrap();
+    let stages = enc.hiera.forward(pixels).unwrap();
+    let out = enc.neck.forward(&stages).unwrap();
+    assert_eq!((out.features.len(), out.positions.len()), (4, 4));
+    for (i, f) in out.features.iter().enumerate() {
+        let e = max_abs(f, r.get(&format!("vision_encoder.neck.{i}")).unwrap());
+        eprintln!("neck feature {i}: max abs error {e:e}");
+        let want = r.get(&format!("vision_encoder.neck.{i}")).unwrap();
+        assert!(e < tol(NECK_TOL, want), "neck feature {i} error {e} (peak {})", peak(want));
+    }
+    for (i, p) in out.positions.iter().enumerate() {
+        let e = max_abs(p, r.get(&format!("vision_encoder.neck.{}", i + 4)).unwrap());
+        eprintln!("neck position {i}: max abs error {e:e}");
+        assert!(e < NECK_TOL, "neck position {i} error {e}");
+    }
+    // The vision encoder keeps the three highest-resolution levels, highest first.
+    let feats = enc.forward(pixels).unwrap();
+    let dims: Vec<usize> = feats.features.iter().map(|f| f.dim(2).unwrap()).collect();
+    assert_eq!(dims, vec![256, 128, 64]);
+    let e = max_abs(feats.features.first().unwrap(), r.get("vision_encoder.neck.3").unwrap());
+    assert!(e < tol(NECK_TOL, r.get("vision_encoder.neck.3").unwrap()));
+}
+
+/// Click-prompted single image: prompt embeddings and decoder outputs against `Sam2Model`.
+const DECODER_TOL: f32 = 1e-3;
+
+#[test]
+fn prompt_encoder_and_decoder_match_pytorch() {
+    use effectcraft_sam2::model::ImageModel;
+    use effectcraft_sam2::prompt::Prompt;
+    let Some((w, r)) = load() else { return };
+    let model = ImageModel::load(&w).unwrap();
+    let pixels = r.get("input.pixel_values").unwrap();
+    let prompt = Prompt { points: vec![([460.0, 512.0], true)], bbox: None };
+
+    let (sparse, dense) = model.embed_prompt(&prompt).unwrap();
+    let want_sparse = r.get("prompt_encoder.0").unwrap().squeeze(0).unwrap();
+    let e = max_abs(&sparse, &want_sparse);
+    eprintln!("sparse prompt: max abs error {e:e}");
+    assert!(e < 1e-5, "sparse prompt error {e}");
+    let e = max_abs(&dense, r.get("prompt_encoder.1").unwrap());
+    assert!(e < 1e-6, "dense prompt error {e}");
+
+    let enc = model.encode(pixels).unwrap();
+    let out = model.segment(&enc, &prompt, true).unwrap();
+    let want_masks = r.get("mask_decoder.0").unwrap().squeeze(0).unwrap();
+    let e = max_abs(&out.masks, &want_masks);
+    eprintln!("masks: max abs error {e:e} (logit range {:?})", want_masks.flatten_all().unwrap().max(0).unwrap().to_scalar::<f32>());
+    assert!(e < loose(DECODER_TOL), "mask logits error {e}");
+    let e = max_abs(&out.iou, &r.get("mask_decoder.1").unwrap().squeeze(0).unwrap());
+    eprintln!("iou: max abs error {e:e}");
+    assert!(e < 1e-4, "iou error {e}");
+    let e = max_abs(&out.object_score, &r.get("mask_decoder.3").unwrap().squeeze(0).unwrap());
+    eprintln!("object score: max abs error {e:e}");
+    assert!(e < 1e-4, "object score error {e}");
+    let e = max_abs(&out.sam_tokens, &r.get("mask_decoder.2").unwrap().squeeze(0).unwrap());
+    assert!(e < loose(1e-4), "sam token error {e}");
+}
+
+fn video_fixture_file() -> PathBuf {
+    std::env::var_os("EFFECTCRAFT_SAM2_VIDEO_REF").map_or_else(|| repo().join("plan/sam2-ref/video.safetensors"), PathBuf::from)
+}
+
+/// The weights and the video reference tensors (`tools/sam2_video_reference.py`), or `None`.
+fn load_video() -> Option<(Weights, HashMap<String, Tensor>)> {
+    let (wf, rf) = (weights_file(), video_fixture_file());
+    if !wf.exists() || !rf.exists() {
+        eprintln!("skipped: SAM 2 weights or video reference tensors not found ({} / {})", wf.display(), rf.display());
+        return None;
+    }
+    let w = Weights::open(&wf).unwrap();
+    note_size(&w);
+    Some((w, candle_core::safetensors::load(&rf, &Device::Cpu).unwrap()))
+}
+
+/// Measured max 3.5e-6 (memory features), 2.6e-5 (memory attention), 2026-10-15.
+const MEMORY_TOL: f32 = 1e-4;
+
+#[test]
+fn memory_encoder_matches_pytorch() {
+    let Some((w, r)) = load_video() else { return };
+    let enc = effectcraft_sam2::memory::MemoryEncoder::load(&w).unwrap();
+    let (feat, pos) = enc.encode(r.get("mem.enc.vision_features").unwrap(), r.get("mem.enc.masks").unwrap()).unwrap();
+    let e = max_abs(&feat, r.get("mem.enc.out_features").unwrap());
+    eprintln!("memory features: max abs error {e:e}");
+    assert!(e < MEMORY_TOL, "memory feature error {e}");
+    let e = max_abs(&pos, r.get("mem.enc.out_pos").unwrap());
+    eprintln!("memory position encoding: max abs error {e:e}");
+    assert!(e < 1e-5, "memory position error {e}");
+}
+
+#[test]
+fn memory_attention_matches_pytorch() {
+    let Some((w, r)) = load_video() else { return };
+    let att = effectcraft_sam2::memattn::MemoryAttention::load(&w).unwrap();
+    let get = |k: &str| r.get(k).unwrap().squeeze(1).unwrap();
+    let pointers = r.get("mem.attn.num_pointers").unwrap().to_vec1::<f32>().unwrap()[0] as usize;
+    let out = att
+        .forward(
+            &get("mem.attn.current_vision_features"),
+            &get("mem.attn.current_vision_position_embeddings"),
+            &get("mem.attn.memory"),
+            &get("mem.attn.memory_posision_embeddings"),
+            pointers,
+        )
+        .unwrap();
+    let want = r.get("mem.attn.out").unwrap().squeeze(0).unwrap().squeeze(0).unwrap();
+    let e = max_abs(&out, &want);
+    eprintln!("memory attention: max abs error {e:e} (pointers {pointers})");
+    assert!(e < MEMORY_TOL, "memory attention error {e}");
+}
+
+/// Frames of the video fixture, served one at a time.
+struct Clip(Tensor);
+
+impl effectcraft_sam2::session::FrameSource for Clip {
+    fn num_frames(&self) -> usize {
+        self.0.dim(0).unwrap()
+    }
+    fn frame(&self, i: usize) -> effectcraft_sam2::Result<Tensor> {
+        Ok(self.0.narrow(0, i, 1)?.contiguous()?)
+    }
+}
+
+fn iou(a: &[f32], b: &[f32]) -> f64 {
+    let (mut i, mut u) = (0usize, 0usize);
+    for (x, y) in a.iter().zip(b) {
+        let (x, y) = (*x > 0.0, *y > 0.0);
+        i += usize::from(x && y);
+        u += usize::from(x || y);
+    }
+    if u == 0 { 1.0 } else { i as f64 / u as f64 }
+}
+
+/// Through the clip the memory bank feeds back on itself (bfloat16 memories, rotary attention), so
+/// the bound on logits is looser than for a single stage; the masks themselves must agree.
+/// Measured max 0.0038 over 9 frames forwards and backwards, 2026-10-15.
+const VIDEO_LOGIT_TOL: f32 = 0.02;
+const VIDEO_MIN_IOU: f64 = 0.995;
+
+fn check_video_tracking(backend: effectcraft_sam2::session::Backend) {
+    use effectcraft_sam2::prompt::Prompt;
+    use effectcraft_sam2::session::{Cancel, Direction, ObjectId, VideoModel, VideoTracker};
+    let Some((w, r)) = load_video() else { return };
+    let model = std::sync::Arc::new(match VideoModel::load_with(&w, backend) {
+        Ok(m) => m,
+        Err(e) => {
+            eprintln!("skipped: {e}");
+            return;
+        }
+    });
+    let clip = r.get("clip.pixel_values").unwrap().clone();
+    let mut tracker = VideoTracker::new(model, Box::new(Clip(clip))).unwrap();
+    let obj = ObjectId(1);
+    let first = tracker.prompt(2, obj, &Prompt { points: vec![([416.0, 512.0], true)], bbox: None }).unwrap();
+
+    let check = |tag: &str, m: &effectcraft_sam2::session::FrameMask| {
+        let want = r.get(&format!("video.{tag}.{}.pred_masks", m.frame)).unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap();
+        let want_score = r.get(&format!("video.{tag}.{}.score", m.frame)).unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap()[0];
+        let err = m.logits.iter().zip(&want).map(|(a, b)| (a - b).abs()).fold(0f32, f32::max);
+        let j = iou(&m.logits, &want);
+        eprintln!("{tag} frame {}: logit error {err:.4}, IoU {j:.4}, score {:.3} (want {want_score:.3})", m.frame, m.object_score);
+        assert!(j >= VIDEO_MIN_IOU, "{tag} frame {} IoU {j}", m.frame);
+        assert!(err < VIDEO_LOGIT_TOL, "{tag} frame {} logit error {err}", m.frame);
+        assert!((m.object_score - want_score).abs() < 0.05, "{tag} frame {} score {} vs {want_score}", m.frame, m.object_score);
+        assert_eq!(m.occluded, want_score <= 0.0);
+    };
+    check("prompt", &first);
+    let cancel = Cancel::new();
+    let mut fwd = vec![];
+    tracker.propagate(2, Direction::Forward, None, &cancel, &mut |m| fwd.push(m)).unwrap();
+    assert_eq!(fwd.iter().map(|m| m.frame).collect::<Vec<_>>(), vec![2, 3, 4, 5, 6]);
+    for m in &fwd {
+        check("fwd", m);
+    }
+    let mut rev = vec![];
+    tracker.propagate(2, Direction::Backward, None, &cancel, &mut |m| rev.push(m)).unwrap();
+    assert_eq!(rev.iter().map(|m| m.frame).collect::<Vec<_>>(), vec![2, 1, 0]);
+    for m in &rev {
+        check("rev", m);
+    }
+}
+
+#[test]
+fn video_tracking_matches_sam2_video_model() {
+    check_video_tracking(effectcraft_sam2::session::Backend::Cpu);
+}
+
+/// The same clip on the GPU: every frame's mask against `Sam2VideoModel`, forwards and backwards. The GPU path
+/// is within 1e-5 of PyTorch stage by stage; through the clip the bfloat16 memories can round the other way
+/// on a few values, so the bound on logits is the video one, and the masks must agree.
+#[test]
+fn video_tracking_on_the_gpu_matches_sam2_video_model() {
+    check_video_tracking(effectcraft_sam2::session::Backend::Gpu);
+}
+
+#[test]
+fn tracker_rejects_hostile_input_and_honours_cancel() {
+    use effectcraft_sam2::Error;
+    use effectcraft_sam2::prompt::Prompt;
+    use effectcraft_sam2::session::{Cancel, Direction, ObjectId, VideoModel, VideoTracker};
+    let Some((w, r)) = load_video() else { return };
+    let model = std::sync::Arc::new(VideoModel::load(&w).unwrap());
+    let clip = r.get("clip.pixel_values").unwrap().narrow(0, 0, 3).unwrap();
+    let mut t = VideoTracker::new(model.clone(), Box::new(Clip(clip.clone()))).unwrap();
+    let click = Prompt { points: vec![([416.0, 512.0], true)], bbox: None };
+    let obj = ObjectId(7);
+    // outside the clip, empty and non-finite prompts, nothing prompted yet
+    assert!(matches!(t.prompt(3, obj, &click), Err(Error::Input(_))));
+    assert!(matches!(t.prompt(0, obj, &Prompt::default()), Err(Error::Input(_))));
+    assert!(matches!(t.prompt(0, obj, &Prompt { points: vec![([f32::NAN, 1.0], true)], bbox: None }), Err(Error::Input(_))));
+    let mut sink = |_m| {};
+    assert!(matches!(t.propagate(0, Direction::Forward, None, &Cancel::new(), &mut sink), Err(Error::Input(_))));
+    assert!(matches!(t.propagate(9, Direction::Forward, None, &Cancel::new(), &mut sink), Err(Error::Input(_))));
+    // an empty clip is refused; a cancelled run stops with Cancelled and keeps the tracker usable
+    assert!(VideoTracker::new(model.clone(), Box::new(Clip(clip.narrow(0, 0, 0).unwrap()))).is_err());
+    t.prompt(0, obj, &click).unwrap();
+    let cancel = Cancel::new();
+    cancel.cancel();
+    assert!(matches!(t.propagate(0, Direction::Forward, None, &cancel, &mut sink), Err(Error::Cancelled)));
+    let mut seen = vec![];
+    t.propagate(0, Direction::Forward, Some(1), &Cancel::new(), &mut |m| seen.push(m.frame)).unwrap();
+    assert_eq!(seen, vec![0, 1]);
+    // a frame source that returns the wrong size is an error, not a crash
+    struct Bad;
+    impl effectcraft_sam2::session::FrameSource for Bad {
+        fn num_frames(&self) -> usize {
+            2
+        }
+        fn frame(&self, _i: usize) -> effectcraft_sam2::Result<Tensor> {
+            Ok(Tensor::zeros((1, 3, 64, 64), candle_core::DType::F32, &Device::Cpu)?)
+        }
+    }
+    let mut bad = VideoTracker::new(model, Box::new(Bad)).unwrap();
+    assert!(matches!(bad.prompt(0, obj, &click), Err(Error::Input(_))));
+}
+
+#[test]
+fn sam2_works_as_a_mask_model() {
+    use effectcraft_segment::{MaskModel, Prompt};
+    let Some((w, _)) = load() else { return };
+    let (fw, fh) = (256usize, 192usize);
+    let mut rgb = vec![[0f32; 3]; fw * fh];
+    let inside = |x: usize, y: usize| ((x as f32 - 120.0).powi(2) + (y as f32 - 96.0).powi(2)).sqrt() < 50.0;
+    for y in 0..fh {
+        for x in 0..fw {
+            let bg = 0.3 + 0.2 * (x as f32 / 9.0).sin() * (y as f32 / 7.0).cos();
+            rgb[y * fw + x] = if inside(x, y) { [0.85 + 0.1 * (x as f32 / 5.0).sin(), 0.4, 0.15] } else { [bg, bg * 0.8 + 0.1, bg * 0.6 + 0.3] };
+        }
+    }
+    let model = effectcraft_sam2::mask::Sam2Mask::new(std::sync::Arc::new(effectcraft_sam2::session::VideoModel::load(&w).unwrap()));
+    let prompt = Prompt { points: vec![([120.0, 96.0], true)], bbox: None, mask: None };
+    let p = model.segment(&rgb, fw, fh, &prompt).unwrap();
+    assert_eq!(p.len(), fw * fh);
+    assert!(p.iter().all(|v| (0.0..=1.0).contains(v)));
+    let (mut i, mut u) = (0usize, 0usize);
+    for y in 0..fh {
+        for x in 0..fw {
+            let (a, b) = (p[y * fw + x] > 0.5, inside(x, y));
+            i += usize::from(a && b);
+            u += usize::from(a || b);
+        }
+    }
+    let j = i as f64 / u as f64;
+    eprintln!("SAM 2 as a MaskModel: disc IoU {j:.3}");
+    assert!(j > 0.9, "IoU {j}");
+    // The same frame again is served from the cached encoding, and bad prompts are errors.
+    let again = model.segment(&rgb, fw, fh, &Prompt { points: vec![([20.0, 20.0], false), ([120.0, 96.0], true)], bbox: None, mask: None }).unwrap();
+    assert_eq!(again.len(), fw * fh);
+    assert!(model.segment(&rgb, fw, fh, &Prompt::default()).is_err());
+    assert!(model.segment(&rgb, fw + 1, fh, &prompt).is_err());
+}
+
+#[test]
+fn sam2_tracks_a_clip_through_the_object_tracker_interface() {
+    use effectcraft_segment::{ClipFrame, MaskModel, Prompt, TrackRequest};
+    let Some((w, _)) = load() else { return };
+    let (fw, fh, n) = (128usize, 96usize, 6usize);
+    let centre = |t: usize| (40.0 + 8.0 * t as f32, 48.0f32);
+    let inside = |t: usize, x: usize, y: usize| {
+        let c = centre(t);
+        ((x as f32 - c.0).powi(2) + (y as f32 - c.1).powi(2)).sqrt() < 26.0
+    };
+    let frames: Vec<std::sync::Arc<ClipFrame>> = (0..n)
+        .map(|t| {
+            let mut rgb = vec![[0f32; 3]; fw * fh];
+            for y in 0..fh {
+                for x in 0..fw {
+                    let bg = 0.3 + 0.2 * (x as f32 / 9.0).sin() * (y as f32 / 7.0).cos();
+                    rgb[y * fw + x] =
+                        if inside(t, x, y) { [0.85 + 0.1 * ((x as f32 - centre(t).0) / 5.0).sin(), 0.4, 0.15] } else { [bg, bg * 0.8 + 0.1, bg * 0.6 + 0.3] };
+                }
+            }
+            std::sync::Arc::new(ClipFrame { rgb, w: fw, h: fh })
+        })
+        .collect();
+    let model = effectcraft_sam2::mask::Sam2Mask::new(std::sync::Arc::new(effectcraft_sam2::session::VideoModel::load(&w).unwrap()));
+    assert!(model.tracker().is_some());
+    let c = centre(1);
+    let req = TrackRequest::single(100, n, vec![(101, Prompt { points: vec![([c.0, c.1], true)], bbox: None, mask: None })]);
+    let mut seen = std::collections::BTreeMap::new();
+    let mut get = |f: i64| frames.get((f - 100) as usize).cloned();
+    model
+        .tracker()
+        .unwrap()
+        .track(&req, &mut get, &|| false, &mut |o, f, t| {
+            assert_eq!(o, 0);
+            assert!(seen.insert(f, t).is_none(), "frame {f} reported twice");
+        })
+        .unwrap();
+    assert_eq!(seen.keys().copied().collect::<Vec<_>>(), (100..100 + n as i64).collect::<Vec<_>>());
+    for (f, t) in &seen {
+        assert_eq!((t.w, t.h, t.prob.len()), (fw, fh, fw * fh));
+        let k = (f - 100) as usize;
+        let (mut i, mut u) = (0usize, 0usize);
+        for y in 0..fh {
+            for x in 0..fw {
+                let (a, b) = (t.prob[y * fw + x] > 0.5, inside(k, x, y));
+                i += usize::from(a && b);
+                u += usize::from(a || b);
+            }
+        }
+        let j = i as f64 / u.max(1) as f64;
+        eprintln!("frame {f}: IoU {j:.3}, confidence {:.2}, occluded {}", t.confidence, t.occluded);
+        assert!(j > 0.85 && !t.occluded && t.confidence > 0.3, "frame {f}: IoU {j}");
+    }
+    // Cancelling before the work starts, and bad requests, are errors.
+    assert!(model.tracker().unwrap().track(&req, &mut get, &|| true, &mut |_, _, _| {}).is_err());
+    let none = TrackRequest::single(100, n, vec![]);
+    assert!(model.tracker().unwrap().track(&none, &mut get, &|| false, &mut |_, _, _| {}).is_err());
+    let outside = TrackRequest::single(100, n, vec![(500, Prompt { points: vec![([1.0, 1.0], true)], bbox: None, mask: None })]);
+    assert!(model.tracker().unwrap().track(&outside, &mut get, &|| false, &mut |_, _, _| {}).is_err());
+}
+
+/// Two objects in one pass: each follows its own disc, every frame is reported once per object, and
+/// objects may start on different frames.
+#[test]
+fn sam2_tracks_two_objects_in_one_pass() {
+    use effectcraft_segment::{ClipFrame, MaskModel, Prompt, TrackRequest};
+    let Some((w, _)) = load() else { return };
+    let (fw, fh, n) = (160usize, 120usize, 4usize);
+    // A red disc moving right and a blue one moving left, never touching.
+    let a = |t: usize| (36.0 + 6.0 * t as f32, 40.0f32);
+    let b = |t: usize| (124.0 - 6.0 * t as f32, 84.0f32);
+    let hit = |c: (f32, f32), x: usize, y: usize| ((x as f32 - c.0).powi(2) + (y as f32 - c.1).powi(2)).sqrt() < 20.0;
+    let frames: Vec<std::sync::Arc<ClipFrame>> = (0..n)
+        .map(|t| {
+            let mut rgb = vec![[0f32; 3]; fw * fh];
+            for y in 0..fh {
+                for x in 0..fw {
+                    let bg = 0.45 + 0.1 * (x as f32 / 9.0).sin() * (y as f32 / 7.0).cos();
+                    rgb[y * fw + x] = if hit(a(t), x, y) {
+                        [0.9, 0.15, 0.1]
+                    } else if hit(b(t), x, y) {
+                        [0.1, 0.25, 0.9]
+                    } else {
+                        [bg, bg * 0.9, bg * 0.8]
+                    };
+                }
+            }
+            std::sync::Arc::new(ClipFrame { rgb, w: fw, h: fh })
+        })
+        .collect();
+    let model = effectcraft_sam2::mask::Sam2Mask::new(std::sync::Arc::new(effectcraft_sam2::session::VideoModel::load(&w).unwrap()));
+    let click = |c: (f32, f32)| Prompt { points: vec![([c.0, c.1], true)], bbox: None, mask: None };
+    // object 0 is prompted on frame 0, object 1 on frame 2
+    let req = TrackRequest { first: 10, count: n, objects: vec![vec![(10, click(a(0)))], vec![(12, click(b(2)))]] };
+    let mut get = |f: i64| frames.get((f - 10) as usize).cloned();
+    let mut seen: std::collections::BTreeMap<(usize, i64), effectcraft_segment::TrackedFrame> = Default::default();
+    model.tracker().unwrap().track(&req, &mut get, &|| false, &mut |o, f, t| assert!(seen.insert((o, f), t).is_none(), "object {o} frame {f} twice")).unwrap();
+    assert_eq!(seen.len(), 2 * n, "{:?}", seen.keys().collect::<Vec<_>>());
+    for ((o, f), t) in &seen {
+        let k = (f - 10) as usize;
+        let c = if *o == 0 { a(k) } else { b(k) };
+        let (mut i, mut u) = (0usize, 0usize);
+        for y in 0..fh {
+            for x in 0..fw {
+                let (p, q) = (t.prob[y * fw + x] > 0.5, hit(c, x, y));
+                i += usize::from(p && q);
+                u += usize::from(p || q);
+            }
+        }
+        let j = i as f64 / u.max(1) as f64;
+        eprintln!("object {o} frame {f}: IoU {j:.3}, confidence {:.2}", t.confidence);
+        assert!(j > 0.85, "object {o} frame {f}: IoU {j}");
+    }
+    let too_many = TrackRequest { first: 10, count: n, objects: vec![vec![(10, click(a(0)))]; 40] };
+    assert!(model.tracker().unwrap().track(&too_many, &mut get, &|| false, &mut |_, _, _| {}).is_err());
+    let empty = TrackRequest { first: 10, count: n, objects: vec![] };
+    assert!(model.tracker().unwrap().track(&empty, &mut get, &|| false, &mut |_, _, _| {}).is_err());
+}
+
+/// A mask prompt instead of clicks: the mask is the prompt frame's output, and tracking forwards and
+/// backwards from it matches `Sam2VideoModel` given the same mask.
+#[test]
+fn mask_prompted_tracking_matches_sam2_video_model() {
+    use effectcraft_sam2::session::{Cancel, Direction, ObjectId, VideoModel, VideoTracker};
+    let Some((w, r)) = load_video() else { return };
+    let model = std::sync::Arc::new(VideoModel::load(&w).unwrap());
+    let mut tracker = VideoTracker::new(model, Box::new(Clip(r.get("clip.pixel_values").unwrap().clone()))).unwrap();
+    let obj = ObjectId(1);
+    let first = tracker.prompt_mask(2, obj, r.get("maskprompt.input").unwrap()).unwrap();
+    let check = |tag: &str, m: &effectcraft_sam2::session::FrameMask| {
+        let want = r.get(&format!("maskprompt.{tag}.{}.pred_masks", m.frame)).unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap();
+        let want_score = r.get(&format!("maskprompt.{tag}.{}.score", m.frame)).unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap()[0];
+        let err = m.logits.iter().zip(&want).map(|(a, b)| (a - b).abs()).fold(0f32, f32::max);
+        let j = iou(&m.logits, &want);
+        eprintln!("mask prompt {tag} frame {}: logit error {err:.4}, IoU {j:.4}, score {:.3} (want {want_score:.3})", m.frame, m.object_score);
+        assert!(j >= VIDEO_MIN_IOU, "{tag} frame {} IoU {j}", m.frame);
+        assert!(err < VIDEO_LOGIT_TOL, "{tag} frame {} logit error {err}", m.frame);
+        assert!((m.object_score - want_score).abs() < 0.05, "{tag} frame {} score {} vs {want_score}", m.frame, m.object_score);
+    };
+    check("prompt", &first);
+    let cancel = Cancel::new();
+    let mut fwd = vec![];
+    tracker.propagate(2, Direction::Forward, None, &cancel, &mut |m| fwd.push(m)).unwrap();
+    fwd.iter().for_each(|m| check("fwd", m));
+    let mut rev = vec![];
+    tracker.propagate(2, Direction::Backward, None, &cancel, &mut |m| rev.push(m)).unwrap();
+    rev.iter().for_each(|m| check("rev", m));
+    assert_eq!((fwd.len(), rev.len()), (5, 3));
+    // hostile masks are errors
+    let bad = Tensor::zeros((1, 1, 8, 8), candle_core::DType::F32, &Device::Cpu).unwrap();
+    assert!(tracker.prompt_mask(2, obj, &bad).is_err());
+    let nan = (Tensor::zeros((1, 1, 1024, 1024), candle_core::DType::F32, &Device::Cpu).unwrap() + f64::NAN).unwrap();
+    assert!(tracker.prompt_mask(2, obj, &nan).is_err());
+    assert!(tracker.prompt_mask(99, obj, r.get("maskprompt.input").unwrap()).is_err());
+}
+
+/// The tracker interface takes a mask as a prompt: the disc's true mask on frame 1 tracks the disc.
+#[test]
+fn a_mask_prompt_through_the_object_tracker_interface() {
+    use effectcraft_segment::{ClipFrame, MaskModel, Prompt, TrackRequest};
+    let Some((w, _)) = load() else { return };
+    let (fw, fh, n) = (128usize, 96usize, 4usize);
+    let centre = |t: usize| (40.0 + 8.0 * t as f32, 48.0f32);
+    let inside = |t: usize, x: usize, y: usize| ((x as f32 - centre(t).0).powi(2) + (y as f32 - centre(t).1).powi(2)).sqrt() < 26.0;
+    let frames: Vec<std::sync::Arc<ClipFrame>> = (0..n)
+        .map(|t| {
+            let mut rgb = vec![[0f32; 3]; fw * fh];
+            for y in 0..fh {
+                for x in 0..fw {
+                    let bg = 0.3 + 0.2 * (x as f32 / 9.0).sin() * (y as f32 / 7.0).cos();
+                    rgb[y * fw + x] = if inside(t, x, y) { [0.85, 0.4, 0.15] } else { [bg, bg * 0.8 + 0.1, bg * 0.6 + 0.3] };
+                }
+            }
+            std::sync::Arc::new(ClipFrame { rgb, w: fw, h: fh })
+        })
+        .collect();
+    let model = effectcraft_sam2::mask::Sam2Mask::new(std::sync::Arc::new(effectcraft_sam2::session::VideoModel::load(&w).unwrap()));
+    let mask: Vec<f32> = (0..fw * fh).map(|i| f32::from(inside(1, i % fw, i / fw))).collect();
+    let mut get = |f: i64| frames.get(f as usize).cloned();
+    let req = TrackRequest::single(0, n, vec![(1, Prompt { points: vec![], bbox: None, mask: Some(mask) })]);
+    let mut seen = std::collections::BTreeMap::new();
+    model
+        .tracker()
+        .unwrap()
+        .track(&req, &mut get, &|| false, &mut |_, f, t| {
+            seen.insert(f, t);
+        })
+        .unwrap();
+    assert_eq!(seen.len(), n);
+    for (f, t) in &seen {
+        let (mut i, mut u) = (0usize, 0usize);
+        for y in 0..fh {
+            for x in 0..fw {
+                let (a, b) = (t.prob[y * fw + x] > 0.5, inside(*f as usize, x, y));
+                i += usize::from(a && b);
+                u += usize::from(a || b);
+            }
+        }
+        let j = i as f64 / u.max(1) as f64;
+        eprintln!("mask-prompted frame {f}: IoU {j:.3}");
+        assert!(j > 0.85 && !t.occluded, "frame {f}: IoU {j}");
+    }
+    // a mask that does not fit the frame is an error
+    let bad = TrackRequest::single(0, n, vec![(1, Prompt { points: vec![], bbox: None, mask: Some(vec![1.0; 5]) })]);
+    assert!(model.tracker().unwrap().track(&bad, &mut get, &|| false, &mut |_, _, _| {}).is_err());
+}
+
+/// The same prompts on the same frames give the same masks, bit for bit, run after run (CPU).
+#[test]
+fn tracking_is_deterministic() {
+    use effectcraft_sam2::prompt::Prompt;
+    use effectcraft_sam2::session::{Cancel, Direction, ObjectId, VideoModel, VideoTracker};
+    let Some((w, r)) = load_video() else { return };
+    let model = std::sync::Arc::new(VideoModel::load(&w).unwrap());
+    let clip = r.get("clip.pixel_values").unwrap().narrow(0, 1, 3).unwrap();
+    let run = || {
+        let mut t = VideoTracker::new(model.clone(), Box::new(Clip(clip.clone()))).unwrap();
+        t.prompt(0, ObjectId(1), &Prompt { points: vec![([416.0, 512.0], true)], bbox: None }).unwrap();
+        let mut out = vec![];
+        t.propagate(0, Direction::Forward, None, &Cancel::new(), &mut |m| out.push(m)).unwrap();
+        out
+    };
+    let (a, b) = (run(), run());
+    assert_eq!(a.len(), 3);
+    for (x, y) in a.iter().zip(&b) {
+        assert_eq!(x.logits, y.logits, "frame {} differs between runs", x.frame);
+        assert_eq!((x.iou.to_bits(), x.object_score.to_bits()), (y.iou.to_bits(), y.object_score.to_bits()));
+    }
+}
+
+/// Hard limits: a tracker over its memory budget or past its time budget stops with Error::Budget.
+#[test]
+fn the_tracker_stops_at_its_budget() {
+    use effectcraft_sam2::Error;
+    use effectcraft_sam2::prompt::Prompt;
+    use effectcraft_sam2::session::{Budget, Cancel, Direction, ObjectId, VideoModel, VideoTracker};
+    let Some((w, r)) = load_video() else { return };
+    let model = std::sync::Arc::new(VideoModel::load(&w).unwrap());
+    let clip = r.get("clip.pixel_values").unwrap().narrow(0, 1, 3).unwrap();
+    let click = Prompt { points: vec![([416.0, 512.0], true)], bbox: None };
+    // memory: one frame's worth is more than a 1 MB limit
+    let mut t = VideoTracker::new(model.clone(), Box::new(Clip(clip.clone()))).unwrap();
+    t.set_budget(Budget { max_state_bytes: 1 << 20, max_seconds: None });
+    assert!(matches!(t.prompt(0, ObjectId(1), &click), Err(Error::Budget(_))));
+    // default limit: fine, and the bytes held are reported
+    let mut t = VideoTracker::new(model.clone(), Box::new(Clip(clip.clone()))).unwrap();
+    t.prompt(0, ObjectId(1), &click).unwrap();
+    let held = t.state_bytes();
+    assert!(held > 2 << 20 && held < 200 << 20, "{held}");
+    // time: a limit of zero stops the first propagation
+    t.set_budget(Budget { max_state_bytes: 2 << 30, max_seconds: Some(0.0) });
+    let r = t.propagate(0, Direction::Forward, None, &Cancel::new(), &mut |_| {});
+    assert!(matches!(r, Err(Error::Budget(_))), "{r:?}");
+}
+
+/// The GPU encoder (wgpu kernels, any vendor) against the CPU path and PyTorch on the same image. The two
+/// float implementations differ by accumulation order and the GPU's erf (1.5e-7), compounded through 12
+/// blocks. Measured (RX 7900 GRE, 2026-10-15): 6.8e-6 against PyTorch, 1.2e-5 against the CPU path.
+const GPU_TOL: f32 = 1e-4;
+
+#[test]
+fn gpu_encoder_matches_the_cpu_path_and_pytorch() {
+    use effectcraft_sam2::gpu::{Gpu, encoder::GpuEncoder};
+    use effectcraft_sam2::model::ImageModel;
+    let Some((w, r)) = load() else { return };
+    let gpu = match Gpu::shared() {
+        Ok(g) => g,
+        Err(e) => {
+            eprintln!("skipped: {e}");
+            return;
+        }
+    };
+    eprintln!("GPU: {}", gpu.adapter_name());
+    let model = ImageModel::load(&w).unwrap();
+    let pixels = r.get("input.pixel_values").unwrap();
+    let cpu = model.encode(pixels).unwrap();
+    let enc = GpuEncoder::load(gpu, &w, model.vision.hiera.clone()).unwrap();
+    let t = std::time::Instant::now();
+    let got = enc.encode(pixels).unwrap();
+    eprintln!("GPU encode (first run, includes shader compile): {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    let t = std::time::Instant::now();
+    let got = (enc.encode(pixels).unwrap(), got).0;
+    eprintln!("GPU encode: {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    let low_cpu = cpu.features.features.get(2).unwrap();
+    let e = max_abs(&got.low, low_cpu);
+    eprintln!("low level vs CPU: max abs error {e:e}");
+    assert!(e < tol(GPU_TOL, low_cpu), "low level error {e} (peak {})", peak(low_cpu));
+    let e = max_abs(&got.low, r.get("vision_encoder.neck.1").unwrap());
+    eprintln!("low level vs PyTorch: max abs error {e:e}");
+    assert!(e < tol(GPU_TOL, low_cpu), "low level vs PyTorch error {e}");
+    let (e0, e1) = (max_abs(&got.high.0, &cpu.high.0), max_abs(&got.high.1, &cpu.high.1));
+    eprintln!("skip features vs CPU: {e0:e} / {e1:e}");
+    assert!(e0 < tol(GPU_TOL, &cpu.high.0) && e1 < tol(GPU_TOL, &cpu.high.1), "skip feature errors {e0} / {e1}");
+}
+
+/// The GPU memory attention against PyTorch (the fixture's frame: one memory frame and four pointer tokens).
+/// Measured on the RX 7900 GRE, 2026-10-15; the CPU path is at 2.6e-5.
+const GPU_ATTN_TOL: f32 = 1e-3;
+
+#[test]
+fn gpu_memory_attention_matches_pytorch() {
+    use effectcraft_sam2::gpu::{Gpu, memattn::GpuMemoryAttention};
+    let Some((w, r)) = load_video() else { return };
+    let gpu = match Gpu::shared() {
+        Ok(g) => g,
+        Err(e) => {
+            eprintln!("skipped: {e}");
+            return;
+        }
+    };
+    let att = GpuMemoryAttention::load(gpu, &w).unwrap();
+    let get = |k: &str| r.get(k).unwrap().squeeze(1).unwrap();
+    let pointers = r.get("mem.attn.num_pointers").unwrap().to_vec1::<f32>().unwrap()[0] as usize;
+    let args = (
+        get("mem.attn.current_vision_features"),
+        get("mem.attn.current_vision_position_embeddings"),
+        get("mem.attn.memory"),
+        get("mem.attn.memory_posision_embeddings"),
+    );
+    let out = att.forward(&args.0, &args.1, &args.2, &args.3, pointers).unwrap();
+    let want = r.get("mem.attn.out").unwrap().squeeze(0).unwrap().squeeze(0).unwrap();
+    let e = max_abs(&out, &want);
+    eprintln!("GPU memory attention vs PyTorch: max abs error {e:e}");
+    assert!(e < GPU_ATTN_TOL, "GPU memory attention error {e}");
+    // a full bank (7 memory frames and 16 pointers of 4 tokens): the same maths on a bigger problem, against the CPU path
+    let cpu = effectcraft_sam2::memattn::MemoryAttention::load(&w).unwrap();
+    let m = 7 * 4096 + 64;
+    let mem = Tensor::randn(0f32, 1.0, (m, 64), &Device::Cpu).unwrap();
+    let mem_pos = Tensor::randn(0f32, 1.0, (m, 64), &Device::Cpu).unwrap();
+    let t = std::time::Instant::now();
+    let big = att.forward(&args.0, &args.1, &mem, &mem_pos, 64).unwrap();
+    eprintln!("GPU memory attention, full bank: {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    let want = cpu.forward(&args.0, &args.1, &mem, &mem_pos, 64).unwrap();
+    let e = max_abs(&big, &want);
+    eprintln!("full bank vs CPU: max abs error {e:e}");
+    assert!(e < GPU_ATTN_TOL, "full-bank error {e}");
+    // bad shapes are errors
+    assert!(att.forward(&args.0, &args.1, &mem, &mem_pos, m + 1).is_err());
+    assert!(att.forward(&args.0.narrow(0, 0, 10).unwrap(), &args.1, &mem, &mem_pos, 64).is_err());
+}
+
+/// The GPU can be switched off in the middle of a clip: the CPU takes over, the device name changes, and
+/// the masks still match `Sam2VideoModel` (the memory banks built on the GPU are read by the CPU path).
+#[test]
+fn switching_the_gpu_off_mid_clip_keeps_the_tracking_right() {
+    use effectcraft_sam2::prompt::Prompt;
+    use effectcraft_sam2::session::{Backend, Cancel, Direction, ObjectId, VideoModel, VideoTracker};
+    let Some((w, r)) = load_video() else { return };
+    let Ok(model) = VideoModel::load_with(&w, Backend::Gpu) else {
+        eprintln!("skipped: no GPU");
+        return;
+    };
+    let model = std::sync::Arc::new(model);
+    assert_ne!(model.device_name(), "CPU");
+    let mut t = VideoTracker::new(model.clone(), Box::new(Clip(r.get("clip.pixel_values").unwrap().clone()))).unwrap();
+    t.prompt(2, ObjectId(1), &Prompt { points: vec![([416.0, 512.0], true)], bbox: None }).unwrap();
+    let mut seen = vec![];
+    t.propagate(2, Direction::Forward, Some(1), &Cancel::new(), &mut |m| seen.push(m)).unwrap();
+    model.disable_gpu();
+    assert_eq!(model.device_name(), "CPU");
+    t.propagate(2, Direction::Forward, None, &Cancel::new(), &mut |m| seen.push(m)).unwrap();
+    let last = seen.last().unwrap();
+    assert_eq!(last.frame, 6);
+    let want = r.get("video.fwd.6.pred_masks").unwrap().flatten_all().unwrap().to_vec1::<f32>().unwrap();
+    let j = iou(&last.logits, &want);
+    assert!(j >= VIDEO_MIN_IOU, "frame 6 after the switch: IoU {j}");
+}
+
+/// The GPU memory encoder against the CPU one on the fixture's frame (a mask, the frame's features). The CPU
+/// path matches PyTorch to 3.5e-6; the GPU is held to the same output.
+#[test]
+fn gpu_memory_encoder_matches_the_cpu_one() {
+    use effectcraft_sam2::gpu::{Gpu, memenc::GpuMemoryEncoder};
+    let Some((w, r)) = load_video() else { return };
+    let Ok(gpu) = Gpu::shared() else {
+        eprintln!("skipped: no GPU");
+        return;
+    };
+    let cpu = effectcraft_sam2::memory::MemoryEncoder::load(&w).unwrap();
+    let enc = GpuMemoryEncoder::load(gpu, &w).unwrap();
+    let (features, mask) = (r.get("mem.enc.vision_features").unwrap(), r.get("mem.enc.masks").unwrap());
+    let t = std::time::Instant::now();
+    let got = enc.encode(features, mask).unwrap();
+    eprintln!("GPU memory encoder: {:.0} ms", t.elapsed().as_secs_f64() * 1e3);
+    let want = r.get("mem.enc.out_features").unwrap().flatten_from(2).unwrap().squeeze(0).unwrap().t().unwrap().contiguous().unwrap();
+    let e = max_abs(&got, &want);
+    eprintln!("GPU memory encoder vs PyTorch: max abs error {e:e}");
+    assert!(e < 1e-3, "memory encoder error {e}");
+    // the whole memory (with the occlusion embedding and bfloat16 rounding) equals the CPU one
+    let (a, b) = (cpu.finish(&got, false).unwrap(), cpu.memory(features, mask, false).unwrap());
+    let e = max_abs(&a.features, &b.features);
+    assert!(e < 0.05, "memory features differ by {e} (bfloat16 steps are 2^-8 of the value)");
+    assert_eq!(max_abs(&a.pos, &b.pos), 0.0);
+    // wrong shapes are errors
+    assert!(enc.encode(&features.narrow(1, 0, 8).unwrap(), mask).is_err());
+}
+
+/// The tracker reports the most memory it held (memory banks, kept results, cached frames), and the model
+/// reports it for the last tracking run.
+#[test]
+fn the_tracker_reports_its_peak_memory() {
+    use effectcraft_segment::{ClipFrame, MaskModel, Prompt, TrackRequest};
+    let Some((w, _)) = load() else { return };
+    let model = effectcraft_sam2::mask::Sam2Mask::new(std::sync::Arc::new(effectcraft_sam2::session::VideoModel::load(&w).unwrap()));
+    assert_eq!(model.peak_state_bytes(), Some(0));
+    let (fw, fh) = (64usize, 48usize);
+    let frame = std::sync::Arc::new(ClipFrame {
+        rgb: (0..fw * fh).map(|i| if (i % fw).abs_diff(32) < 12 && (i / fw).abs_diff(24) < 12 { [0.9, 0.2, 0.1] } else { [0.2, 0.3, 0.5] }).collect(),
+        w: fw,
+        h: fh,
+    });
+    let mut get = |_f: i64| Some(frame.clone());
+    let req = TrackRequest::single(0, 3, vec![(0, Prompt { points: vec![([32.0, 24.0], true)], bbox: None, mask: None })]);
+    model.tracker().unwrap().track(&req, &mut get, &|| false, &mut |_, _, _| {}).unwrap();
+    let peak = model.peak_state_bytes().unwrap();
+    // three stored frames (about 2 MB each) and the cached frame features
+    assert!(peak > 6 << 20 && peak < 400 << 20, "peak {peak}");
+}
diff --git a/crates/script/Cargo.toml b/crates/script/Cargo.toml
index 10c635ebc..6d03d1bdc 100644
--- a/crates/script/Cargo.toml
+++ b/crates/script/Cargo.toml
@@ -27,3 +27,6 @@ boa_engine = { workspace = true, features = ["js"] }
 [dev-dependencies]
 effectcraft-expr = { workspace = true }
 effectcraft-psd = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
+socket2 = "0.6"
diff --git a/crates/script/src/lib.rs b/crates/script/src/lib.rs
index 5c1f8cdbb..21774cb24 100644
--- a/crates/script/src/lib.rs
+++ b/crates/script/src/lib.rs
@@ -79,6 +79,7 @@ pub fn install(s: &mut Session) {
     s.script = Some(runner);
     s.script_ui.dispatch = Some(dispatch_ui);
     s.script_ui.tasks = Some(run_tasks);
+    s.script_ui.poll_render = Some(ui::poll_render_wait);
 }
 
 /// Run `code` as a one-off script named `name`.
@@ -88,28 +89,7 @@ pub fn run_code(s: &mut Session, code: &str, name: &str) -> Outcome {
 
 #[cfg(test)]
 mod tests;
-#[cfg(test)]
-mod tests_callable;
-#[cfg(test)]
-mod tests_ease_presets;
-#[cfg(test)]
-mod tests_include;
-#[cfg(test)]
-mod tests_panels;
-#[cfg(test)]
-mod tests_tasks;
-#[cfg(test)]
-mod tests_ui;
-#[cfg(test)]
-mod tests_ui_more;
 
 // #760: `$.evalFile` and `BridgeTalk`.
-#[cfg(test)]
-mod tests_evalfile;
 // `/browser/…` is the web editor's file table, an absolute path on wasm; on Windows it has no
 // drive, so the script runtime resolves it under the current drive, where the host holds nothing.
-#[cfg(test)]
-#[cfg(not(windows))]
-mod tests_services;
-#[cfg(test)]
-mod tests_ui_mouse;
diff --git a/crates/script/src/matchnames.rs b/crates/script/src/matchnames.rs
index 205697b60..01b3258fd 100644
--- a/crates/script/src/matchnames.rs
+++ b/crates/script/src/matchnames.rs
@@ -90,6 +90,44 @@ pub fn stroke_dash(name: &str) -> Option<&'static str> {
 
 const TEXT_ANIMATOR: &[(&str, &str)] = &[("selectors", "ADBE Text Selectors"), ("properties", "ADBE Text Animator Properties")];
 
+/// Animator property ids and their stable After Effects scripting names. Shared by lookup,
+/// `.matchName`, and `addProperty` so the same property has one name in every direction.
+pub const TEXT_ANIMATOR_PROPERTIES: &[(&str, &str)] = &[
+    ("anchor", "ADBE Text Anchor Point 3D"),
+    ("position", "ADBE Text Position 3D"),
+    ("scale", "ADBE Text Scale 3D"),
+    ("skew", "ADBE Text Skew"),
+    ("rotation", "ADBE Text Rotation"),
+    ("opacity", "ADBE Text Opacity"),
+    ("fillColor", "ADBE Text Fill Color"),
+    ("fillHue", "ADBE Text Fill Hue"),
+    ("fillSaturation", "ADBE Text Fill Saturation"),
+    ("fillBrightness", "ADBE Text Fill Brightness"),
+    ("fillOpacity", "ADBE Text Fill Opacity"),
+    ("strokeColor", "ADBE Text Stroke Color"),
+    ("strokeHue", "ADBE Text Stroke Hue"),
+    ("strokeSaturation", "ADBE Text Stroke Saturation"),
+    ("strokeBrightness", "ADBE Text Stroke Brightness"),
+    ("strokeOpacity", "ADBE Text Stroke Opacity"),
+    ("strokeWidth", "ADBE Text Stroke Width"),
+    ("tracking", "ADBE Text Tracking Amount"),
+    ("lineAnchor", "ADBE Text Line Anchor"),
+    ("lineSpacing", "ADBE Text Line Spacing"),
+    ("characterOffset", "ADBE Text Character Offset"),
+    ("characterValue", "ADBE Text Character Replace"),
+    ("blur", "ADBE Text Blur"),
+];
+
+/// Companion properties that exist below an animator but are not kinds `addProperty` accepts:
+/// they come with Tracking (Track Type), Skew (Skew Axis) and per-character 3D Rotation
+/// (X and Y Rotation). Lookup and `.matchName` know them; `addProperty` does not.
+pub const TEXT_ANIMATOR_COMPANIONS: &[(&str, &str)] = &[
+    ("trackingType", "ADBE Text Track Type"),
+    ("skewAxis", "ADBE Text Skew Axis"),
+    ("rotationX", "ADBE Text Rotation X"),
+    ("rotationY", "ADBE Text Rotation Y"),
+];
+
 const TEXT_SELECTORS: &[(&str, &str)] =
     &[("rangeSelector", "ADBE Text Selector"), ("wigglySelector", "ADBE Text Wiggly Selector"), ("expressionSelector", "ADBE Text Expressible Selector")];
 
@@ -111,7 +149,7 @@ const LIGHT: &[(&str, &str)] = &[
     ("falloff", "ADBE Light Falloff Type"),
     ("radius", "ADBE Light Falloff Start"),
     ("falloffDistance", "ADBE Light Falloff Distance"),
-    ("castsShadows", "ADBE Light Casts Shadows"),
+    ("castsShadows", "ADBE Casts Shadows"),
     ("shadowDarkness", "ADBE Light Shadow Darkness"),
     ("shadowDiffusion", "ADBE Light Shadow Diffusion"),
 ];
@@ -147,6 +185,7 @@ pub const SHAPE_ITEMS: &[(&str, &str)] = &[
     ("trim", "ADBE Vector Filter - Trim"),
     ("twist", "ADBE Vector Filter - Twist"),
     ("wiggle", "ADBE Vector Filter - Roughen"),
+    ("wiggler", "ADBE Vector Filter - Wiggler"),
     ("zigzag", "ADBE Vector Filter - Zigzag"),
 ];
 
@@ -208,7 +247,29 @@ const SHAPE_PROPS: &[(&str, &str, &str)] = &[
     ("pucker", "amount", "ADBE Vector PuckerBloat Amount"),
     ("twist", "angle", "ADBE Vector Twist Angle"),
     ("twist", "center", "ADBE Vector Twist Center"),
+    ("wiggler", "speed", "ADBE Vector Xform Temporal Freq"),
+    ("wiggler", "correlation", "ADBE Vector Correlation"),
+    ("wiggler", "phase", "ADBE Vector Temporal Phase"),
+    ("wiggler", "spatialPhase", "ADBE Vector Spatial Phase"),
+    ("wiggler", "seed", "ADBE Vector Random Seed"),
+    ("wiggler", "transform", "ADBE Vector Wiggler Transform"),
     ("merge", "mode", "ADBE Vector Merge Type"),
+    ("offset", "amount", "ADBE Vector Offset Amount"),
+    ("offset", "join", "ADBE Vector Offset Line Join"),
+    ("offset", "miter", "ADBE Vector Offset Miter Limit"),
+    ("offset", "copies", "ADBE Vector Offset Copies"),
+    ("offset", "copyOffset", "ADBE Vector Offset Copy Offset"),
+    ("zigzag", "size", "ADBE Vector Zigzag Size"),
+    ("zigzag", "ridges", "ADBE Vector Zigzag Detail"),
+    ("zigzag", "points", "ADBE Vector Zigzag Points"),
+    ("wiggle", "size", "ADBE Vector Roughen Size"),
+    ("wiggle", "detail", "ADBE Vector Roughen Detail"),
+    ("wiggle", "points", "ADBE Vector Roughen Points"),
+    ("wiggle", "speed", "ADBE Vector Temporal Freq"),
+    ("wiggle", "correlation", "ADBE Vector Correlation"),
+    ("wiggle", "phase", "ADBE Vector Temporal Phase"),
+    ("wiggle", "spatialPhase", "ADBE Vector Spatial Phase"),
+    ("wiggle", "seed", "ADBE Vector Random Seed"),
 ];
 
 /// Effects: our effect id → AE match name (the documented ones; the rest keep our id).
@@ -248,12 +309,12 @@ pub const EFFECTS: &[(&str, &str)] = &[
     ("ec.color.changetocolor", "ADBE Change To Color"),
     ("ec.color.colorama", "APC Colorama"),
     ("ec.color.leavecolor", "ADBE Leave Color"),
-    ("ec.color.photofilter", "ADBE Photo Filter"),
+    ("ec.color.photofilter", "ADBE PhotoFilterPS"),
     ("ec.color.vibrance", "ADBE Vibrance"),
     ("ec.color.lumetri", "ADBE Lumetri"),
-    ("ec.color.shadowhighlight", "ADBE Shadow/Highlight"),
-    ("ec.color.selectivecolor", "ADBE Selective Color"),
-    ("ec.color.gammapedestalgain", "ADBE Gamma/Pedestal/Gain"),
+    ("ec.color.shadowhighlight", "ADBE ShadowHighlight"),
+    ("ec.color.selectivecolor", "ADBE SelectiveColor"),
+    ("ec.color.gammapedestalgain", "ADBE Gamma/Pedestal/Gain2"),
     ("ec.color.equalize", "ADBE Equalize"),
     ("ec.color.autocontrast", "ADBE AutoContrast"),
     ("ec.color.autolevels", "ADBE AutoLevels"),
@@ -290,15 +351,15 @@ pub const EFFECTS: &[(&str, &str)] = &[
     ("ec.generate.grid", "ADBE Grid"),
     ("ec.generate.checkerboard", "ADBE Checkerboard"),
     ("ec.generate.circle", "ADBE Circle"),
-    ("ec.generate.ellipse", "ADBE Ellipse"),
+    ("ec.generate.ellipse", "ADBE ELLIPSE"),
     ("ec.generate.cellpattern", "ADBE Cell Pattern"),
     ("ec.generate.lensflare", "ADBE Lens Flare"),
-    ("ec.generate.vegas", "ADBE Vegas"),
-    ("ec.generate.writeon", "ADBE Write On"),
+    ("ec.generate.vegas", "APC Vegas"),
+    ("ec.generate.writeon", "ADBE Write-on"),
     ("ec.generate.audiospectrum", "ADBE AudSpect"),
     ("ec.generate.audiowaveform", "ADBE AudWave"),
     ("ec.generate.beam", "ADBE Laser"),
-    ("ec.generate.radiowaves", "ADBE Radio Waves"),
+    ("ec.generate.radiowaves", "APC Radio Waves"),
     ("ec.generate.scribble", "ADBE Scribble Fill"),
     ("ec.generate.paintbucket", "ADBE Paint Bucket"),
     ("ec.key.colorkey", "ADBE Color Key"),
@@ -310,12 +371,12 @@ pub const EFFECTS: &[(&str, &str)] = &[
     ("ec.key.spill", "ADBE Spill2"),
     ("ec.matte.simplechoker", "ADBE Simple Choker"),
     ("ec.matte.mattechoker", "ADBE Matte Choker"),
-    ("ec.noise.noise", "ADBE Noise"),
+    ("ec.noise.noise", "ADBE Noise2"),
     ("ec.noise.fractal", "ADBE Fractal Noise"),
     ("ec.noise.median", "ADBE Median"),
     ("ec.noise.addgrain", "VISINF Grain Implant"),
     ("ec.noise.dustscratches", "ADBE Dust & Scratches"),
-    ("ec.noise.turbulent", "ADBE Turbulent Noise"),
+    ("ec.noise.turbulent", "ADBE AIF Perlin Noise 3D"),
     ("ec.perspective.dropshadow", "ADBE Drop Shadow"),
     ("ec.perspective.radialshadow", "ADBE Radial Shadow"),
     ("ec.perspective.bevelalpha", "ADBE Bevel Alpha"),
@@ -340,32 +401,73 @@ pub const EFFECTS: &[(&str, &str)] = &[
     ("ec.time.echo", "ADBE Echo"),
     ("ec.time.posterizetime", "ADBE Posterize Time"),
     ("ec.time.timedisplacement", "ADBE Time Displacement"),
-    ("ec.time.timedifference", "ADBE Time Difference"),
-    ("ec.time.pixelmotionblur", "ADBE Pixel Motion Blur"),
+    ("ec.time.timedifference", "ADBE Difference"),
+    ("ec.time.pixelmotionblur", "ADBE OFMotionBlur"),
     ("ec.time.timewarp", "ADBE Timewarp"),
     ("ec.transition.linearwipe", "ADBE Linear Wipe"),
     ("ec.transition.radialwipe", "ADBE Radial Wipe"),
     ("ec.transition.venetian", "ADBE Venetian Blinds"),
     ("ec.transition.blockdissolve", "ADBE Block Dissolve"),
     ("ec.transition.gradientwipe", "ADBE Gradient Wipe"),
-    ("ec.transition.iriswipe", "ADBE Iris Wipe"),
+    ("ec.transition.iriswipe", "ADBE IRIS_WIPE"),
     ("ec.utility.applylut", "ADBE Apply Color LUT2"),
     ("ec.utility.cineon", "ADBE Cineon Converter2"),
-    ("ec.utility.growbounds", "ADBE Grow Bounds"),
+    ("ec.utility.growbounds", "ADBE GROW BOUNDS"),
 ];
 
 fn find<'a>(t: &'a [(&str, &'a str)], k: &str) -> Option<&'a str> {
     t.iter().find(|(a, _)| *a == k).map(|(_, b)| *b)
 }
 
+/// Effect match names that resolve to one of our effects but are not the name we emit (#3113):
+/// After Effects' hidden obsolete versions (`ADBE Noise`, `ADBE Photo Filter`), which its
+/// `addProperty` still accepts, and the names earlier EffectCraft versions emitted by mistake,
+/// which scripts written against them may use. Lookup only: `effect()` gives the `EFFECTS` name.
+const LEGACY_EFFECTS: &[(&str, &str)] = &[
+    ("ADBE Noise", "ec.noise.noise"),
+    ("ADBE Photo Filter", "ec.color.photofilter"),
+    ("ADBE Shadow/Highlight", "ec.color.shadowhighlight"),
+    ("ADBE Selective Color", "ec.color.selectivecolor"),
+    ("ADBE Gamma/Pedestal/Gain", "ec.color.gammapedestalgain"),
+    ("ADBE Vegas", "ec.generate.vegas"),
+    ("ADBE Write On", "ec.generate.writeon"),
+    ("ADBE Radio Waves", "ec.generate.radiowaves"),
+    ("ADBE Turbulent Noise", "ec.noise.turbulent"),
+    ("ADBE Time Difference", "ec.time.timedifference"),
+    ("ADBE Pixel Motion Blur", "ec.time.pixelmotionblur"),
+    ("ADBE Iris Wipe", "ec.transition.iriswipe"),
+];
+
 /// AE match name of an effect id (falls back to the id).
 pub fn effect(id: &str) -> String {
     find(EFFECTS, id).map(str::to_string).unwrap_or_else(|| id.to_string())
 }
 
-/// Our effect id for an AE effect match name.
+/// Our effect id for an AE effect match name (or a legacy one, see `LEGACY_EFFECTS`).
 pub fn effect_from_match(m: &str) -> Option<&'static str> {
-    EFFECTS.iter().find(|(_, b)| b.eq_ignore_ascii_case(m)).map(|(a, _)| *a)
+    EFFECTS
+        .iter()
+        .find(|(_, b)| b.eq_ignore_ascii_case(m))
+        .map(|(a, _)| *a)
+        .or_else(|| LEGACY_EFFECTS.iter().find(|(b, _)| b.eq_ignore_ascii_case(m)).map(|(_, a)| *a))
+}
+
+/// The current match name for a legacy name a script may still use: a `LEGACY_EFFECTS` effect
+/// name, one of its parameters (`ADBE Noise-0001` → `ADBE Noise2-0001`), or the light's Casts
+/// Shadows under its earlier name. `None` when `name` is not a legacy name.
+pub fn current_name(name: &str) -> Option<String> {
+    if name == "ADBE Light Casts Shadows" {
+        return Some("ADBE Casts Shadows".into());
+    }
+    let legacy = |m: &str| LEGACY_EFFECTS.iter().find(|(b, _)| b.eq_ignore_ascii_case(m)).map(|(_, id)| effect(id));
+    if let Some(m) = legacy(name) {
+        return Some(m);
+    }
+    let (fx, n) = name.rsplit_once('-')?;
+    if n.len() != 4 || !n.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    legacy(fx).map(|m| format!("{m}-{n}"))
 }
 
 /// Our shape item kind (`layer.addShapeItem`) for an AE match name, our match id or a display
@@ -393,6 +495,7 @@ pub fn shape_kind(name: &str) -> Option<&'static str> {
         "twist" => "twist",
         "zigzag" => "zigzag",
         "wigglepaths" => "wiggle",
+        "wiggletransform" => "wiggler",
         "mergepaths" => "merge",
         _ => return None,
     })
@@ -479,6 +582,9 @@ pub fn node(chain: &[&Node]) -> String {
         "text" if pid == "animators" => "ADBE Text Animator".into(),
         "text" if pid == "selectors" => find(TEXT_SELECTORS, id).map(str::to_string).unwrap_or_else(own),
         "text" if pid == "rangeSelector" => find(TEXT_RANGE_SELECTOR, id).map(str::to_string).unwrap_or_else(own),
+        "text" if pid == "properties" && chain.len() == 5 && chain.get(1).is_some_and(|n| n.match_id() == "animators") => {
+            find(TEXT_ANIMATOR_PROPERTIES, id).or_else(|| find(TEXT_ANIMATOR_COMPANIONS, id)).map(str::to_string).unwrap_or_else(own)
+        }
         "text" if grand.map(|g| g.match_id()) == Some("animators") => find(TEXT_ANIMATOR, id).map(str::to_string).unwrap_or_else(own),
         "cameraOptions" => find(CAMERA, id).map(str::to_string).unwrap_or_else(own),
         "lightOptions" => find(LIGHT, id).map(str::to_string).unwrap_or_else(own),
@@ -508,6 +614,56 @@ pub fn node(chain: &[&Node]) -> String {
 mod tests {
     use super::*;
 
+    /// After Effects 26.2's `app.effects` (first-party match names and categories), #3113.
+    const AE_EFFECTS: &str = include_str!("../tests/fixtures/ae-effect-match-names.tsv");
+
+    fn ae_effects() -> Vec<(&'static str, &'static str)> {
+        AE_EFFECTS.lines().filter(|l| !l.starts_with('#') && !l.is_empty()).map(|l| l.split_once('\t').unwrap_or((l, ""))).collect()
+    }
+
+    /// #3113: every effect match name we emit is one After Effects lists (case matters: its
+    /// `addProperty("ADBE Ellipse")` fails), and the current version, not a hidden obsolete one,
+    /// unless After Effects only has that one.
+    #[test]
+    fn effect_names_are_after_effects_names() {
+        let ae = ae_effects();
+        // Obsolete in After Effects without a current replacement (Puppet is added by its tool).
+        let only_obsolete = ["ADBE Color Key", "ADBE Luma Key", "ADBE FreePin3"];
+        for (id, m) in EFFECTS {
+            let Some((_, cat)) = ae.iter().find(|(n, _)| n == m) else { panic!("{id}: After Effects has no effect {m:?}") };
+            assert!(!cat.contains("Obsolete") || only_obsolete.contains(m), "{id}: {m:?} is After Effects' obsolete version");
+        }
+        assert_eq!(effect("ec.noise.noise"), "ADBE Noise2");
+        assert_eq!(effect("ec.time.pixelmotionblur"), "ADBE OFMotionBlur");
+        assert_eq!(effect("ec.generate.ellipse"), "ADBE ELLIPSE");
+        assert_eq!(effect("ec.color.photofilter"), "ADBE PhotoFilterPS");
+    }
+
+    /// #3113: the names earlier versions emitted (and After Effects' obsolete ones) still resolve,
+    /// but none shadows a current name.
+    #[test]
+    fn legacy_effect_names_still_resolve() {
+        for (old, id) in LEGACY_EFFECTS {
+            assert_eq!(effect_from_match(old), Some(*id));
+            assert!(!EFFECTS.iter().any(|(_, m)| m.eq_ignore_ascii_case(old)), "{old} is a current name");
+            assert_eq!(current_name(old), Some(effect(id)));
+        }
+        assert_eq!(effect_from_match("ADBE Pixel Motion Blur"), Some("ec.time.pixelmotionblur"));
+        assert_eq!(current_name("ADBE Noise-0001").as_deref(), Some("ADBE Noise2-0001"));
+        assert_eq!(current_name("ADBE Light Casts Shadows").as_deref(), Some("ADBE Casts Shadows"));
+        assert_eq!(current_name("ADBE Noise2-0001"), None);
+        assert_eq!(current_name("ADBE Noise-01"), None);
+        assert_eq!(current_name("ADBE Gaussian Blur 2"), None);
+    }
+
+    #[test]
+    fn light_casts_shadows_is_after_effects_name() {
+        let n = |m: &str| Node::from(effectcraft_project::PropGroup::new(1, m, m));
+        let (light, mat, casts) = (n("lightOptions"), n("materialOptions"), n("castsShadows"));
+        assert_eq!(node(&[&light, &casts]), "ADBE Casts Shadows");
+        assert_eq!(node(&[&mat, &casts]), "ADBE Casts Shadows");
+    }
+
     #[test]
     fn effect_names_round_trip() {
         for (id, m) in EFFECTS {
@@ -529,6 +685,30 @@ mod tests {
         assert_eq!(shape_kind("nope"), None);
     }
 
+    #[test]
+    fn text_animator_property_names_are_canonical_and_scoped() {
+        let n = |m: &str| Node::from(effectcraft_project::PropGroup::new(1, m, m));
+        let (text, animators, animator, properties) = (n("text"), n("animators"), n("animator"), n("properties"));
+        for (id, name) in TEXT_ANIMATOR_PROPERTIES {
+            let prop = n(id);
+            assert_eq!(node(&[&text, &animators, &animator, &properties, &prop]), *name);
+            assert_eq!(node(&[&properties, &prop]), *id, "an unrelated Properties group keeps its own ids");
+        }
+    }
+
+    /// #1063: the companions an animator property brings (Track Type, Skew Axis, X / Y Rotation)
+    /// have their After Effects names too, though `addProperty` does not accept them.
+    #[test]
+    fn text_animator_companions_have_after_effects_names() {
+        let n = |m: &str| Node::from(effectcraft_project::PropGroup::new(1, m, m));
+        let (text, animators, animator, properties) = (n("text"), n("animators"), n("animator"), n("properties"));
+        for (id, name) in TEXT_ANIMATOR_COMPANIONS {
+            let prop = n(id);
+            assert_eq!(node(&[&text, &animators, &animator, &properties, &prop]), *name);
+            assert!(!TEXT_ANIMATOR_PROPERTIES.iter().any(|(k, m)| k == id || m == name), "{id} is not an addProperty kind");
+        }
+    }
+
     #[test]
     fn text_range_selector_names() {
         let n = |m: &str| Node::from(effectcraft_project::PropGroup::new(1, m, m));
diff --git a/crates/script/src/model.rs b/crates/script/src/model.rs
index 90b03ae59..e662c1cdc 100644
--- a/crates/script/src/model.rs
+++ b/crates/script/src/model.rs
@@ -85,6 +85,7 @@ fn project(s: &Session) -> J {
         "workingSpace": p.settings.working_space.map(|w| format!("{w:?}")).unwrap_or_default(),
         "workingGamma": if p.settings.working_gamma_24() { 2.4 } else { 2.2 },
         "timeDisplayFrames": p.settings.time_display == effectcraft_project::TimeDisplayStyle::Frames,
+        "displayStartFrame": p.settings.frame_start,
         "renderQueue": p.render_queue.len(),
         "revision": s.revision,
     })
@@ -450,6 +451,9 @@ fn find_child<'a>(l: &'a Layer, g: &'a PropGroup, k: &str, depth: u8) -> Option<
     g.children
         .iter()
         .find(|n| chain_of(n) == k)
+        .or_else(|| matchnames::current_name(k).and_then(|m| g.children.iter().find(|n| chain_of(n) == m)))
+        // Match names that changed only in case (`ADBE Ellipse` is now `ADBE ELLIPSE`, #3113).
+        .or_else(|| g.children.iter().find(|n| chain_of(n).eq_ignore_ascii_case(k)))
         .or_else(|| g.children.iter().find(|n| n.name() == k))
         .or_else(|| g.children.iter().find(|n| n.match_id() == k))
         .or_else(|| g.children.iter().find(|n| n.name().eq_ignore_ascii_case(k)))
@@ -742,36 +746,12 @@ fn resolve_add(s: &Session, a: &J) -> R {
 /// A text animator property (`layer.addTextAnimatorProperty` key) from an After Effects match
 /// name or a display name.
 fn text_animator_property(name: &str) -> Option<&'static str> {
-    const AE: &[(&str, &str)] = &[
-        ("ADBE Text Anchor Point 3D", "anchor"),
-        ("ADBE Text Position 3D", "position"),
-        ("ADBE Text Scale 3D", "scale"),
-        ("ADBE Text Skew", "skew"),
-        ("ADBE Text Rotation", "rotation"),
-        ("ADBE Text Opacity", "opacity"),
-        ("ADBE Text Fill Color", "fillColor"),
-        ("ADBE Text Fill Hue", "fillHue"),
-        ("ADBE Text Fill Saturation", "fillSaturation"),
-        ("ADBE Text Fill Brightness", "fillBrightness"),
-        ("ADBE Text Fill Opacity", "fillOpacity"),
-        ("ADBE Text Stroke Color", "strokeColor"),
-        ("ADBE Text Stroke Hue", "strokeHue"),
-        ("ADBE Text Stroke Saturation", "strokeSaturation"),
-        ("ADBE Text Stroke Brightness", "strokeBrightness"),
-        ("ADBE Text Stroke Opacity", "strokeOpacity"),
-        ("ADBE Text Stroke Width", "strokeWidth"),
-        ("ADBE Text Tracking Amount", "tracking"),
-        ("ADBE Text Line Anchor", "lineAnchor"),
-        ("ADBE Text Line Spacing", "lineSpacing"),
-        ("ADBE Text Character Offset", "characterOffset"),
-        ("ADBE Text Character Replace", "characterValue"),
-        ("ADBE Text Blur", "blur"),
-    ];
-    if let Some((_, k)) = AE.iter().find(|(m, _)| m.eq_ignore_ascii_case(name)) {
+    let table = matchnames::TEXT_ANIMATOR_PROPERTIES;
+    if let Some((k, _)) = table.iter().find(|(_, m)| m.eq_ignore_ascii_case(name)) {
         return Some(k);
     }
     let n = loose(name);
-    AE.iter().map(|(_, k)| *k).find(|k| loose(k) == n || (n == "anchorpoint" && *k == "anchor") || (n == "trackingamount" && *k == "tracking"))
+    table.iter().map(|(k, _)| *k).find(|k| loose(k) == n || (n == "anchorpoint" && *k == "anchor") || (n == "trackingamount" && *k == "tracking"))
 }
 
 /// `app.findMenuCommandId(name)`: 1-based index of the command whose label matches (menu items
diff --git a/crates/script/src/prelude.js b/crates/script/src/prelude.js
index 2eeca86bf..b9108b2a1 100644
--- a/crates/script/src/prelude.js
+++ b/crates/script/src/prelude.js
@@ -98,6 +98,8 @@ var ImportAsType = __enum("ImportAsType", ["COMP_CROPPED_LAYERS", "FOOTAGE", "CO
 ImportAsType.COMPOSITION_CROPPED_LAYERS = ImportAsType.COMP_CROPPED_LAYERS;
 ImportAsType.COMPOSITION = ImportAsType.COMP;
 var TimeDisplayType = __enum("TimeDisplayType", ["FRAMES", "TIMECODE"], 2012);
+// After Effects' values (FC_START_0 = 2612), as in docsforadobe/Types-for-Adobe.
+var FramesCountType = __enum("FramesCountType", ["FC_START_0", "FC_START_1", "FC_TIMECODE_CONVERSION"], 2612);
 var LogType = __enum("LogType", ["ERRORS_ONLY", "ERRORS_AND_SETTINGS", "ERRORS_AND_PER_FRAME_INFO"], 3212);
 var KeyframeLabel = __enum("KeyframeLabel", ["NONE"], 0);
 
@@ -187,7 +189,12 @@ BridgeTalk.pump = function () { return false; };
 
 // ------------------------------------------------------------------ File / Folder
 
-function __join(a, b) { return a.replace(/[\/\\]+$/, "") + "/" + b; }
+function __trimPathSeparators(path) {
+  var end = path.length;
+  while (end > 0 && (path.charAt(end - 1) === "/" || path.charAt(end - 1) === "\\")) end--;
+  return path.slice(0, end);
+}
+function __join(a, b) { return __trimPathSeparators(a) + "/" + b; }
 
 function File(path) {
   if (!(this instanceof File)) return new File(path);
@@ -290,9 +297,9 @@ Folder.prototype = {
   get fsName() { return this.__path; },
   get fullName() { return this.__path; },
   get absoluteURI() { return this.__path; },
-  get name() { return this.__path.replace(/[\/\\]+$/, "").split(/[\/\\]/).pop(); },
+  get name() { return __trimPathSeparators(this.__path).split(/[\/\\]/).pop(); },
   get displayName() { return this.name; },
-  get path() { var p = this.__path.replace(/[\/\\]+$/, "").split(/[\/\\]/); p.pop(); return p.join("/"); },
+  get path() { var p = __trimPathSeparators(this.__path).split(/[\/\\]/); p.pop(); return p.join("/"); },
   get parent() { return new Folder(this.path); },
   get exists() { return JSON.parse(__file("isDir", this.__path)) === true; },
   toString: function () { return this.__path; },
@@ -418,7 +425,7 @@ function __callable(o) {
   delete f.length;
   Object.setPrototypeOf(f, Object.getPrototypeOf(o));
   var keys = Object.keys(o);
-  for (var i = 0; i < keys.length; i++) f[keys[i]] = o[keys[i]];
+  for (const elem of keys) f[elem] = o[elem];
   var self = new Proxy(f, {
     get: __attr.get,
     apply: function (t, thisArg, args) { return self.property(args[0]); },
@@ -471,7 +478,7 @@ function MarkerValue(comment, chapter, url, frameTarget, cuePointName, params) {
 }
 MarkerValue.prototype.getParameters = function () {
   var o = {};
-  for (var i = 0; i < this.__params.length; i++) o[this.__params[i][0]] = this.__params[i][1];
+  for (const elem of this.__params) o[elem[0]] = elem[1];
   return o;
 };
 MarkerValue.prototype.setParameters = function (o) {
@@ -511,8 +518,8 @@ TextDocument.prototype = {
   set text(v) { this.__text = String(v); this.__textSet = true; },
   __style: function (k, d) {
     if (k in this.__changed) return this.__changed[k];
-    if (this.__base && this.__base.first && k in this.__base.first) return this.__base.first[k];
-    if (this.__base && this.__base.para && k in this.__base.para) return this.__base.para[k];
+    if (this.__base?.first && k in this.__base.first) return this.__base.first[k];
+    if (this.__base?.para && k in this.__base.para) return this.__base.para[k];
     return d;
   },
   __set: function (k, v) { this.__changed[k] = v; },
@@ -578,14 +585,14 @@ TextDocument.prototype = {
   },
   get tsume() { return this.__style("tsume", 0); },
   set tsume(v) { this.__set("tsume", __num(v)); },
-  get boxText() { return !!(this.__base && this.__base.box_size); },
+  get boxText() { return !!this.__base?.box_size; },
   get pointText() { return !this.boxText; },
-  get boxTextSize() { return this.__base && this.__base.box_size ? this.__base.box_size.slice() : undefined; },
+  get boxTextSize() { return this.__base?.box_size ? this.__base.box_size.slice() : undefined; },
   set boxTextSize(v) {
     var p = this.boxTextPos || [0, 0];
     this.__set("box", [p[0], p[1], v[0], v[1]]);
   },
-  get boxTextPos() { return this.__base && this.__base.box_size ? this.__base.box_pos.slice() : undefined; },
+  get boxTextPos() { return this.__base?.box_size ? this.__base.box_pos.slice() : undefined; },
   get startIndent() { return this.__style("indentLeft", 0); },
   set startIndent(v) { this.__set("indentLeft", __num(v)); },
   get endIndent() { return this.__style("indentRight", 0); },
@@ -663,7 +670,7 @@ PropertyBase.prototype = {
   get isMask() { return !!this.__info().isMask; },
   get selected() {
     var c = __get("item", { id: this.__layer.__comp }).selectedProperties;
-    for (var i = 0; i < c.length; i++) if (c[i][0] === this.__layer.__id && c[i][1] === this.__uid) return true;
+    for (const elem of c) if (elem[0] === this.__layer.__id && elem[1] === this.__uid) return true;
     return false;
   },
   set selected(v) {
@@ -727,9 +734,8 @@ PropertyGroup.prototype.addProperty = function (name) {
   } else if (r.kind === "animator") {
     uid = __call("layer.addTextAnimator", { comp: L.__comp, layer: L.__id, properties: [] }).animator;
   } else if (r.kind === "animatorProperty") {
-    var before = this.numProperties;
-    __call("layer.addTextAnimatorProperty", { comp: L.__comp, layer: L.__id, animator: r.animator, property: r.property });
-    return this.property(before + 1);
+    var added = __call("layer.addTextAnimatorProperty", { comp: L.__comp, layer: L.__id, animator: r.animator, property: r.property });
+    return this.property(added.index);
   } else if (r.kind === "selector") {
     var n0 = this.numProperties;
     __call("layer.addTextSelector", { comp: L.__comp, layer: L.__id, animator: r.animator, kind: r.selector });
@@ -840,7 +846,7 @@ Property.prototype.property = function () { return null; };
     i = __num(i, "keyIndex");
     // Only the key asked for: fetching the whole list made every key call linear (#814).
     var r = i >= 1 && Math.floor(i) === i ? __get("keys", { comp: this.__layer.__comp, layer: this.__layer.__id, uid: this.__uid, index: i - 1 }) : null;
-    if (!r || !r.key) throw __err("keyIndex " + i + " is out of range 1.." + (r ? r.count : this.numKeys));
+    if (!r?.key) throw __err("keyIndex " + i + " is out of range 1.." + (r ? r.count : this.numKeys));
     return r.key;
   };
   // Script value → engine JSON for `prop.set` / `prop.addKey`.
@@ -851,13 +857,13 @@ Property.prototype.property = function () { return null; };
       return __get("textdoc", { comp: this.__layer.__comp, layer: this.__layer.__id, uid: this.__uid, time: time, attrs: td.__attrs() });
     }
     if (t === "SHAPE") {
-      if (!v || !v.vertices) throw __err("value must be a Shape");
+      if (!v?.vertices) throw __err("value must be a Shape");
       var n = v.vertices.length;
-      function fit(a) { var o = []; for (var i = 0; i < n; i++) o.push(a && a[i] ? [a[i][0], a[i][1]] : [0, 0]); return o; }
+      function fit(a) { var o = []; for (var i = 0; i < n; i++) o.push(a?.[i] ? [a[i][0], a[i][1]] : [0, 0]); return o; }
       return { vertices: fit(v.vertices), in_tangents: fit(v.inTangents), out_tangents: fit(v.outTangents), closed: v.closed !== false };
     }
     if (t === "LAYER_INDEX") {
-      var idx = v && v.__id !== undefined ? v.index : __num(v);
+      var idx = v?.__id !== undefined ? v.index : __num(v);
       if (!idx) return null;
       return this.__layer.containingComp.layer(idx).__id;
     }
@@ -869,8 +875,11 @@ Property.prototype.property = function () { return null; };
     }
     if (info.dims > 1) {
       if (!(v instanceof Array)) throw __err("value must be an array of " + info.dims + " numbers");
+      // After Effects rejects an array of the wrong length instead of truncating or broadcasting it
+      // (#1936). Two values for a 3-D property stay legal, as they are in After Effects: z is 0.
+      if (v.length !== info.dims && !(info.dims === 3 && v.length === 2)) throw __err("Array is not of the correct dimension");
       var o = [];
-      for (var d = 0; d < info.dims; d++) o.push(d < v.length ? __num(v[d]) : (d === 2 ? 0 : __num(v[v.length - 1])));
+      for (var d = 0; d < info.dims; d++) o.push(d < v.length ? __num(v[d]) : 0);
       return o;
     }
     if (v instanceof Array) throw __err("value must be a number, not an array");
@@ -1172,7 +1181,7 @@ Layer.prototype = {
   },
   get selectedProperties() {
     var c = this.containingComp.__info().selectedProperties, out = [];
-    for (var i = 0; i < c.length; i++) if (c[i][0] === this.__id) out.push(__propOf(this, __get("node", { comp: this.__comp, layer: this.__id, uid: c[i][1] })));
+    for (const elem of c) if (elem[0] === this.__id) out.push(__propOf(this, __get("node", { comp: this.__comp, layer: this.__id, uid: elem[1] })));
     return out;
   },
   get parent() { var p = this.__info().parent; return p === null ? null : __layer(this.__comp, p); },
@@ -1200,7 +1209,7 @@ Layer.prototype = {
     var before = this.containingComp.__info().layers;
     __call("edit.duplicate", this.__p());
     var after = this.containingComp.__info().layers;
-    for (var i = 0; i < after.length; i++) if (before.indexOf(after[i]) < 0) return __layer(this.__comp, after[i]);
+    for (const elem of after) if (before.indexOf(elem) < 0) return __layer(this.__comp, elem);
     return null;
   },
   copyToComp: function (comp) {
@@ -1301,7 +1310,14 @@ AVLayer.prototype.constructor = AVLayer;
   }
   P.sourcePointToComp = function (p) { return pointIn(this, p, true); };
   P.compPointToSource = function (p) { return pointIn(this, p, false); };
-  P.replaceSource = function () { throw __err("replaceSource is not supported yet"); };
+  // Replace the layer's source item, keeping every layer property (After Effects'
+  // AVLayer.replaceSource). `fixExpressions` is accepted for compatibility: only AV sources are
+  // replaced, so the property tree and the layer's name stay and expressions keep resolving.
+  P.replaceSource = function (newSource, fixExpressions) {
+    if (newSource?.__id === undefined) throw __err("replaceSource needs a project item");
+    __call("layer.replaceSource", { comp: this.__comp, layers: [this.__id], item: newSource.__id, fixExpressions: !!fixExpressions });
+    return null;
+  };
   P.openInViewer = function () { __call("layer.openLayer", this.__p1()); return null; };
 })();
 
@@ -1359,7 +1375,7 @@ LayerCollection.prototype = {
     return layer;
   },
   add: function (item, duration) {
-    if (!item || item.id === undefined) throw __err("add(): expected an item");
+    if (item?.id === undefined) throw __err("add(): expected an item");
     var l = this.__new(__call("layer.addItem", { comp: this.__comp, item: item.id, time: 0 }));
     return this.__dur(l, duration);
   },
@@ -1402,15 +1418,15 @@ LayerCollection.prototype = {
   },
   precompose: function (indices, name, moveAllAttributes) {
     var ids = this.__ids(), sel = [];
-    for (var i = 0; i < indices.length; i++) sel.push(ids[indices[i] - 1]);
+    for (const elem of indices) sel.push(ids[elem - 1]);
     var r = __call("layer.precompose", { comp: this.__comp, layers: sel, name: String(name), mode: moveAllAttributes === false ? "leave" : "move" });
     return __item(r.comp);
   },
   byName: function (name) {
     var ids = this.__ids();
-    for (var i = 0; i < ids.length; i++) {
-      var l = __get("layer", { comp: this.__comp, layer: ids[i] });
-      if (l.name === name) return __layer(this.__comp, ids[i]);
+    for (const elem of ids) {
+      var l = __get("layer", { comp: this.__comp, layer: elem });
+      if (l.name === name) return __layer(this.__comp, elem);
     }
     return null;
   },
@@ -1481,7 +1497,7 @@ Item.prototype = {
   get label() { return this.__info().label; },
   set label(v) { __call("project.setLabel", { items: [this.__id], label: __num(v, "label") }); },
   get parentFolder() { return __item(this.__info().parent); },
-  set parentFolder(f) { __call("project.move", { items: [this.__id], folder: f && f.__id ? f.__id : null }); },
+  set parentFolder(f) { __call("project.move", { items: [this.__id], folder: f?.__id ? f.__id : null }); },
   get selected() { return this.__info().selected; },
   set selected(v) {
     var selection = __get("project").selection;
@@ -1503,8 +1519,11 @@ function AVItem() {}
 AVItem.prototype = Object.create(Item.prototype);
 (function () {
   function def(name, get, set) { Object.defineProperty(AVItem.prototype, name, { get: get, set: set }); }
-  def("width", function () { return this.__info().width; }, function (v) { this.__settings({ width: Math.round(__num(v, "width")) }); });
-  def("height", function () { return this.__info().height; }, function (v) { this.__settings({ height: Math.round(__num(v, "height")) }); });
+  // `anchor: 0` (top left): After Effects' width and height setters resize the frame and leave the
+  // layers at their coordinates. Re-anchoring the old frame in the new one belongs to the
+  // Composition Settings dialog, which is what `comp.settings` defaults to (#1942).
+  def("width", function () { return this.__info().width; }, function (v) { this.__settings({ width: Math.round(__num(v, "width")), anchor: 0 }); });
+  def("height", function () { return this.__info().height; }, function (v) { this.__settings({ height: Math.round(__num(v, "height")), anchor: 0 }); });
   def("pixelAspect", function () { return this.__info().pixelAspect; }, function (v) { this.__settings({ pixelAspect: __num(v) }); });
   def("duration", function () { return this.__info().duration; }, function (v) { this.__settings({ duration: __num(v, "duration") }); });
   def("frameRate", function () { return this.__info().frameRate; }, function (v) { this.__settings({ frameRate: __num(v, "frameRate") }); });
@@ -1512,7 +1531,7 @@ AVItem.prototype = Object.create(Item.prototype);
   def("hasVideo", function () { return this.__info().hasVideo; });
   def("hasAudio", function () { return this.__info().hasAudio; });
   def("footageMissing", function () { return !!this.__info().footageMissing; });
-  def("useProxy", function () { var p = this.__info().proxy; return !!(p && p.enabled); }, function (v) {
+  def("useProxy", function () { var p = this.__info().proxy; return !!p?.enabled; }, function (v) {
     if (!this.__info().proxy) throw __err("\"" + this.name + "\" has no proxy");
     __call("file.useProxy", { item: this.__id, on: !!v });
   });
@@ -1549,9 +1568,9 @@ CompItem.prototype.constructor = CompItem;
   });
   def("activeCamera", function () {
     var ids = this.__info().layers;
-    for (var i = 0; i < ids.length; i++) {
-      var l = __get("layer", { comp: this.__id, layer: ids[i] });
-      if (l.kind === "camera" && l.enabled && l.active) return __layer(this.__id, ids[i]);
+    for (const elem of ids) {
+      var l = __get("layer", { comp: this.__id, layer: elem });
+      if (l.kind === "camera" && l.enabled && l.active) return __layer(this.__id, elem);
     }
     return null;
   });
@@ -1591,7 +1610,7 @@ CompItem.prototype.constructor = CompItem;
       if (a < 1 || a > ids.length || Math.floor(a) !== a) throw __err("layer index " + a + " is out of range 1.." + ids.length);
       return __layer(this.__id, ids[a - 1]);
     }
-    if (a && a.__id !== undefined && typeof b === "number") {
+    if (a?.__id !== undefined && typeof b === "number") {
       var j = a.index + b;
       return j >= 1 && j <= ids.length ? __layer(this.__id, ids[j - 1]) : null;
     }
@@ -1604,9 +1623,9 @@ CompItem.prototype.constructor = CompItem;
   P.__controllers = function () {
     var out = [];
     (function walk(list) {
-      for (var i = 0; i < list.length; i++) {
-        if (list[i].kind === "property" || list[i].kind === "mirror" || list[i].kind === "media") out.push(list[i]);
-        if (list[i].children) walk(list[i].children);
+      for (const elem of list) {
+        if (elem.kind === "property" || elem.kind === "mirror" || elem.kind === "media") out.push(elem);
+        if (elem.children) walk(elem.children);
       }
     })(this.__eg().controls);
     return out;
@@ -1687,7 +1706,8 @@ Object.defineProperty(FootageItem.prototype, "mainSource", {
     return this.__mainSource;
   },
 });
-FootageItem.prototype.replace = function (f) { __call("file.replaceFootage", { item: this.__id, path: __str(f) }); };
+// replace() swaps in one file, even a numbered still (replaceWithSequence brings a run), as in After Effects.
+FootageItem.prototype.replace = function (f) { __call("file.replaceFootage", { item: this.__id, path: __str(f), sequence: false }); };
 FootageItem.prototype.replaceWithSequence = function (f, forceAlphabetical) {
   __call("file.replaceFootage", { item: this.__id, path: __str(f), sequence: true, alphabetical: !!forceAlphabetical });
 };
@@ -1717,7 +1737,7 @@ FolderItem.prototype.constructor = FolderItem;
   Object.defineProperty(P, "numItems", { get: function () { return new ItemCollection(this.__id).length; } });
   Object.defineProperty(P, "parentFolder", {
     get: function () { return this.__id === 0 ? null : __item(this.__info().parent); },
-    set: function (f) { __call("project.move", { items: [this.__id], folder: f && f.__id ? f.__id : null }); },
+    set: function (f) { __call("project.move", { items: [this.__id], folder: f?.__id ? f.__id : null }); },
   });
   P.item = function (i) {
     var v = new ItemCollection(this.__id).__at(__num(i, "index"));
@@ -1761,7 +1781,7 @@ RenderQueueItem.prototype = {
   constructor: RenderQueueItem,
   __info: function () {
     var l = __call("renderQueue.list", {}).items;
-    for (var i = 0; i < l.length; i++) if (l[i].id === this.__id) return l[i];
+    for (const elem of l) if (elem.id === this.__id) return elem;
     throw __err("the render queue item no longer exists");
   },
   get comp() { return __item(this.__info().comp); },
@@ -1797,7 +1817,7 @@ RenderQueueItem.prototype = {
     var before = __call("renderQueue.list", {}).items.map(function (i) { return i.id; });
     __call("renderQueue.duplicate", { item: this.__id });
     var after = __call("renderQueue.list", {}).items;
-    for (var i = 0; i < after.length; i++) if (before.indexOf(after[i].id) < 0) return new RenderQueueItem(after[i].id);
+    for (const elem of after) if (before.indexOf(elem.id) < 0) return new RenderQueueItem(elem.id);
     return null;
   },
   applyTemplate: function () {},
@@ -1884,6 +1904,14 @@ Project.prototype = {
   set workingGamma(v) { __call("file.projectSettings", { workingGamma: __num(v) }); },
   get timeDisplayType() { return this.__info().timeDisplayFrames ? TimeDisplayType.FRAMES : TimeDisplayType.TIMECODE; },
   set timeDisplayType(v) { __call("file.projectSettings", { timeDisplay: v === TimeDisplayType.FRAMES ? "frames" : "timecode" }); },
+  get framesCountType() { return this.__info().displayStartFrame === 1 ? FramesCountType.FC_START_1 : FramesCountType.FC_START_0; },
+  set framesCountType(v) {
+    if (v === FramesCountType.FC_TIMECODE_CONVERSION) throw __err("framesCountType: Timecode Conversion is not supported, use FC_START_0 or FC_START_1");
+    if (v !== FramesCountType.FC_START_0 && v !== FramesCountType.FC_START_1) throw __err("Bad framesCountType value " + v);
+    __call("file.projectSettings", { frameStart: v === FramesCountType.FC_START_1 ? 1 : 0 });
+  },
+  get displayStartFrame() { return this.__info().displayStartFrame; },
+  set displayStartFrame(v) { __call("file.projectSettings", { frameStart: __num(v) }); },
   get expressionEngine() { return "javascript-1.0"; },
   set expressionEngine(v) {},
   item: function (i) {
@@ -1922,9 +1950,9 @@ Project.prototype = {
       }
     }
     var r = __call("file.import", args);
-    if (r.errors && r.errors.length) throw __err(r.errors.join("; "));
+    if (r.errors?.length) throw __err(r.errors.join("; "));
     // Composition imports create several footage items, but callers need the comp.
-    return __item(r.comps && r.comps.length ? r.comps[0] : r.items[0]);
+    return __item(r.comps?.length ? r.comps[0] : r.items[0]);
   },
   importFileWithDialog: function () { return null; },
   importPlaceholder: function (name, w, h, rate, dur) {
diff --git a/crates/script/src/runtime.rs b/crates/script/src/runtime.rs
index 192da5740..c23eaefb0 100644
--- a/crates/script/src/runtime.rs
+++ b/crates/script/src/runtime.rs
@@ -30,6 +30,8 @@ pub struct Outcome {
     /// The script is waiting in a modal ScriptUI dialog's `show()` (it goes on when the dialog
     /// closes; see [`crate::dispatch_ui`]).
     pub waiting: bool,
+    /// The native frontend owns the session while this host waits for its render worker.
+    pub render_host: Option<u32>,
 }
 
 /// An uncaught script error.
@@ -55,6 +57,9 @@ impl Outcome {
         if self.waiting {
             j["waiting"] = json!(true);
         }
+        if let Some(host) = self.render_host {
+            j["renderHost"] = json!(host);
+        }
         j
     }
 }
@@ -74,13 +79,16 @@ pub(crate) struct Active {
     /// Running on a script-host thread: modal dialogs hand the session back to the caller
     /// through this link while they wait.
     pub(crate) link: Option<crate::ui::Link>,
+    /// Captured at invocation start: the frontend resets its opt-in when the caller returns.
+    pub(crate) yield_renders: bool,
     /// The files `$.evalFile` is evaluating, outermost first.
     pub(crate) loading: Vec<std::path::PathBuf>,
 }
 
 impl Active {
     pub(crate) fn new(session: Session, name: &str, host: u32) -> Active {
-        Active { session, output: vec![], groups: vec![], name: name.to_string(), host, link: None, loading: vec![] }
+        let yield_renders = session.script_ui.yield_renders;
+        Active { session, output: vec![], groups: vec![], name: name.to_string(), host, link: None, yield_renders, loading: vec![] }
     }
 }
 
@@ -126,10 +134,17 @@ pub(crate) fn js_str(s: &str) -> JsValue {
 fn native_exec(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
     let id = arg_string(args, 0, ctx)?;
     let mut params = arg_json(args, 1, ctx)?;
-    if id == "script.run" || id == "file.runScript" {
+    if effectcraft_engine::commands::scripts::RUNS_SCRIPTS.contains(&id.as_str()) {
         return Err(throw("scripts can't run scripts"));
     }
     let keys = params.as_object_mut().and_then(|o| o.remove("__keys"));
+    let yield_render = id == "renderQueue.render"
+        && params.get("wait").and_then(J::as_bool).unwrap_or(true)
+        && with_active(|a| Ok(a.yield_renders && a.link.is_some())).unwrap_or(false);
+    if yield_render {
+        let object = params.as_object_mut().ok_or_else(|| throw("renderQueue.render needs an object of parameters"))?;
+        object.insert("wait".into(), json!(false));
+    }
     let r = with_active(|a| {
         Ok(match &keys {
             Some(k) => exec_on_keys(&mut a.session, &id, params, k),
@@ -137,7 +152,10 @@ fn native_exec(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsV
         })
     });
     match r {
-        Ok(Ok(v)) => Ok(js_str(&v.to_string())),
+        Ok(Ok(v)) => {
+            let v = if yield_render { crate::ui::wait_for_render(ctx, v).map_err(throw)? } else { v };
+            Ok(js_str(&v.to_string()))
+        }
         Ok(Err(e)) | Err(e) => Err(throw(e)),
     }
 }
@@ -710,7 +728,7 @@ pub(crate) fn outcome(output: Vec<String>, result: Result<J, ScriptError>) -> Ou
 /// don't block.
 ///
 /// ExtendScript's `#include` / `#includepath` are inlined first, and errors point at the file
-/// and line they came from ([`crate::include`]).
+/// and line they came from (`crate::include`).
 pub fn run(session: &mut Session, req: &ScriptRequest) -> Outcome {
     let expanded = match crate::include::expand(session, req.code, req.name) {
         Ok(x) => x,
@@ -718,6 +736,10 @@ pub fn run(session: &mut Session, req: &ScriptRequest) -> Outcome {
     };
     let Some(x) = expanded else { return run_expanded(session, req) };
     let mut out = run_expanded(session, &ScriptRequest { code: &x.code, name: req.name, console: req.console });
+    if let Some(host) = out.render_host {
+        crate::ui::keep_render_source_map(host, x);
+        return out;
+    }
     if let Some(e) = out.error.as_mut() {
         x.locate(e);
     }
diff --git a/crates/script/src/scriptui.js b/crates/script/src/scriptui.js
index af1e14b5e..ddfbc1f3e 100644
--- a/crates/script/src/scriptui.js
+++ b/crates/script/src/scriptui.js
@@ -213,7 +213,7 @@ function __uiResPlain(v) {
   if (v instanceof Array) return v.map(__uiResPlain);
   if (v && typeof v === "object" && v.__object) {
     var o = {};
-    for (var k = 0; k < v.__object.length; k++) o[v.__object[k][0]] = __uiResPlain(v.__object[k][1]);
+    for (const elem of v.__object) o[elem[0]] = __uiResPlain(elem[1]);
     return o;
   }
   return v;
@@ -222,8 +222,8 @@ function __uiResPlain(v) {
 // A resource's own properties and its child elements (in source order).
 function __uiResProps(res) {
   var props = {}, kids = [];
-  for (var k = 0; k < res.list.length; k++) {
-    var e = res.list[k];
+  for (const elem2 of res.list) {
+    var e = elem2;
     if (e[1] && typeof e[1] === "object" && e[1].__element) kids.push([e[0], { type: e[1].__element, list: e[1].list }]);
     else props[e[0]] = __uiResPlain(e[1]);
   }
@@ -239,17 +239,17 @@ function __uiApplyRes(c, res) {
   // Ranges before values, items before selections.
   if (props.minvalue !== undefined) c.minvalue = __num(props.minvalue);
   if (props.maxvalue !== undefined) c.maxvalue = __num(props.maxvalue);
-  if (props.items instanceof Array && c.items) for (var n = 0; n < props.items.length; n++) c.add("item", props.items[n]);
+  if (props.items instanceof Array && c.items) for (const elem of props.items) c.add("item", elem);
   for (var k in props) {
     if (__uiResSkip[k]) continue;
     var v = props[k];
     if (__uiSizes[k] && v instanceof Array) v = __dim(v[0], v[1]);
     c[k] = v;
   }
-  for (var j = 0; j < pk.kids.length; j++) {
-    var child = __uiAddRes(c, pk.kids[j][1]);
-    child.__key = pk.kids[j][0];
-    c[pk.kids[j][0]] = child;
+  for (const elem of pk.kids) {
+    var child = __uiAddRes(c, elem[1]);
+    child.__key = elem[0];
+    c[elem[0]] = child;
   }
   return c;
 }
@@ -268,7 +268,7 @@ Window.alert = function (s) { alert(s); };
 Window.confirm = function (s) { return confirm(s); };
 Window.prompt = function (m, d) { return prompt(m, d); };
 Window.find = function (type, title) {
-  for (var i = 0; i < __uiWins.length; i++) if (__uiWins[i].text === title) return __uiWins[i];
+  for (const elem of __uiWins) if (elem.text === title) return elem;
   return null;
 };
 
@@ -335,7 +335,7 @@ function __uiColor(c) {
   return null;
 }
 function __uiFontSize(f, g) {
-  var x = f && f.size !== undefined ? Number(f.size) : g && g.font && g.font.size !== undefined ? Number(g.font.size) : 12;
+  var x = f?.size !== undefined ? Number(f.size) : g?.font && g.font.size !== undefined ? Number(g.font.size) : 12;
   return x > 0 ? x : 12;
 }
 
@@ -371,11 +371,11 @@ function __uiGraphics() {
       this.__push({ op: "fill", color: brush ? brush.color : null, path: (path || this.currentPath).slice() });
     },
     strokePath: function (pen, path) {
-      this.__push({ op: "stroke", color: pen ? pen.color : null, width: pen && pen.lineWidth !== undefined ? pen.lineWidth : 1, path: (path || this.currentPath).slice() });
+      this.__push({ op: "stroke", color: pen ? pen.color : null, width: pen?.lineWidth !== undefined ? pen.lineWidth : 1, path: (path || this.currentPath).slice() });
     },
     drawString: function (text, pen, x, y, font) {
       var f = font || this.font;
-      this.__push({ op: "text", text: String(text), color: pen ? pen.color : null, x: __num(x || 0), y: __num(y || 0), size: __uiFontSize(f, this), style: String(f && f.style !== undefined ? f.style : "") });
+      this.__push({ op: "text", text: String(text), color: pen ? pen.color : null, x: __num(x || 0), y: __num(y || 0), size: __uiFontSize(f, this), style: String(f?.style !== undefined ? f.style : "") });
     },
     drawOSControl: function () { this.__push({ op: "os" }); },
     drawImage: function (img, x, y, w, h) { this.__push({ op: "image", image: __uiImageJson(img), x: __num(x || 0), y: __num(y || 0), w: w === undefined ? 0 : __num(w), h: h === undefined ? 0 : __num(h) }); },
@@ -384,7 +384,7 @@ function __uiGraphics() {
       var size = __uiFontSize(font, this);
       var lines = String(s).split("\n");
       var cw = size * 0.58, w = 0;
-      for (var i = 0; i < lines.length; i++) w = Math.max(w, Math.ceil(lines[i].length * cw));
+      for (const elem of lines) w = Math.max(w, Math.ceil(elem.length * cw));
       var n = lines.length;
       if (boundaryWidth > 0 && w > boundaryWidth) {
         n = Math.ceil(w / boundaryWidth) + lines.length - 1;
@@ -405,14 +405,14 @@ function __uiRunDraws(win) {
   })(win);
   if (!drawn.length) return;
   __uiLayout(win);
-  for (var k = 0; k < drawn.length; k++) {
-    var c = drawn[k];
+  for (const elem of drawn) {
+    var c = elem;
     c.__draw = [];
     c.graphics.__rec = c.__draw;
     try {
       c.onDraw.call(c, { type: "draw", target: c });
     } catch (e) {
-      try { writeLn("onDraw: " + (e && e.message ? e.message : e)); } catch (e2) {}
+      try { writeLn("onDraw: " + (e?.message ? e.message : e)); } catch (e2) {}
     }
     c.graphics.__rec = null;
   }
@@ -498,7 +498,7 @@ function __uiProto() {
       var arg = t === "image" || t === "iconbutton" ? text : typeof text === "object" && text !== null && !(text instanceof Array) ? "" : text;
       __uiInit(c, t, this.window, this, bounds, arg, props);
       if ((t === "dropdownlist" || t === "listbox") && text instanceof Array) {
-        for (var i = 0; i < text.length; i++) c.add("item", text[i]);
+        for (const elem of text) c.add("item", elem);
         c.text = "";
       }
       if (t === "slider" || t === "scrollbar") {
@@ -521,7 +521,7 @@ function __uiProto() {
       if (t === "checkbox" || t === "radiobutton") c.value = false;
       if (t === "edittext" && c.properties.multiline) c.__multiline = true;
       if (t === "edittext" && c.properties.readonly) c.__readonly = true;
-      if (c.properties && c.properties.name) c.name = c.properties.name;
+      if (c.properties?.name) c.name = c.properties.name;
       this.children.push(c);
       if (t === "tab" && this.type === "tabbedpanel" && this.__sel.length === 0) this.__sel = [this.children.length - 1];
       return c;
@@ -608,21 +608,21 @@ function __uiProto() {
     removeEventListener: function (name, fn, capture) {
       var k = String(name).toLowerCase();
       var m = capture ? this.__capture : this.__listeners;
-      if (m && m[k]) m[k] = m[k].filter(function (f) { return f !== fn; });
+      if (m?.[k]) m[k] = m[k].filter(function (f) { return f !== fn; });
     },
     dispatchEvent: function (e) { this.__fire("on" + String(e.type || e).charAt(0).toUpperCase() + String(e.type || e).slice(1)); },
     __fire: function (name) {
       var r;
       if (typeof this[name] === "function") r = this[name].call(this);
       var l = this.__listeners[name.slice(2).toLowerCase()];
-      if (l) for (var i = 0; i < l.length; i++) l[i].call(this, { type: name.slice(2).toLowerCase(), target: this });
+      if (l) for (const elem of l) elem.call(this, { type: name.slice(2).toLowerCase(), target: this });
       return r;
     },
     __handlers: function () {
       var out = [];
       var names = ["onClick", "onChange", "onChanging", "onDoubleClick", "onClose", "onShow", "onActivate", "onDeactivate", "onResize", "onDraw"];
-      for (var i = 0; i < names.length; i++) {
-        var n = names[i];
+      for (const elem of names) {
+        var n = elem;
         if (typeof this[n] === "function" || (this.__listeners[n.slice(2).toLowerCase()] || []).length) out.push(n);
       }
       return out;
@@ -634,8 +634,8 @@ function __uiProto() {
 (function () {
   var all = ["Window", "Panel", "Group", "Button", "IconButton", "StaticText", "EditText", "Checkbox", "RadioButton", "Slider",
     "Scrollbar", "Progressbar", "DropDownList", "ListBox", "TabbedPanel", "Tab", "ScriptUIImage"];
-  for (var i = 0; i < all.length; i++) {
-    var C = __ecGlobal[all[i]];
+  for (const elem of all) {
+    var C = __ecGlobal[elem];
     var p = __uiProto();
     for (var k in p) C.prototype[k] = p[k];
     Object.defineProperty(C.prototype, "bounds", {
@@ -737,15 +737,16 @@ function __uiMouseListeners(c, type, capture) {
 // The mouse events that reach a listener at `c`: its own, and its containers' (`inherited`).
 function __uiMouseWanted(c, inherited) {
   var out = inherited.slice();
-  for (var i = 0; i < __uiMouseKinds.length; i++) {
-    var t = __uiMouseKinds[i];
+  for (const elem of __uiMouseKinds) {
+    var t = elem;
     if (out.indexOf(t) < 0 && (__uiMouseListeners(c, t, false).length || __uiMouseListeners(c, t, true).length)) out.push(t);
   }
   return out;
 }
 
 // A ScriptUI MouseEvent. `v`: {x, y (relative to the target control), button (0 left, 1 middle,
-// 2 right), detail (click count), screenX, screenY, altKey, ctrlKey, metaKey, shiftKey}.
+// 2 right), buttons (held: 1 left, 2 right, 4 middle), detail (click count), screenX, screenY,
+// altKey, ctrlKey, metaKey, shiftKey}.
 function __uiMouseEvent(type, target, v) {
   var num = function (x, d) {
     x = Number(x);
@@ -765,6 +766,7 @@ function __uiMouseEvent(type, target, v) {
     timeStamp: new Date(),
     detail: num(v.detail, type === "mousemove" || type === "mouseover" || type === "mouseout" ? 0 : 1),
     button: num(v.button, 0),
+    buttons: num(v.buttons, 0),
     clientX: num(v.x, 0),
     clientY: num(v.y, 0),
     screenX: num(v.screenX, 0),
@@ -793,7 +795,7 @@ function __uiMouseFire(target, type, v) {
     var l = __uiMouseListeners(c, type, capture);
     e.currentTarget = c;
     e.eventPhase = phase;
-    for (var i = 0; i < l.length; i++) if (typeof l[i] === "function") l[i].call(c, e);
+    for (const elem of l) if (typeof elem === "function") elem.call(c, e);
   };
   var n = path.length - 1;
   for (var i = 0; i < n; i++) {
@@ -832,7 +834,7 @@ function __uiJson(c, inherited) {
     if (m) o.margins = m;
     if (typeof c.spacing === "number") o.spacing = c.spacing;
     var kids = c.children;
-    for (var i = 0; i < kids.length; i++) o.children.push(__uiJson(kids[i], mouse));
+    for (const elem of kids) o.children.push(__uiJson(elem, mouse));
   }
   if (c.alignment !== null && c.alignment !== undefined) o.alignment = __uiAlign(c.alignment);
   if (c.type === "checkbox" || c.type === "radiobutton") o.checked = !!c.value;
@@ -840,7 +842,7 @@ function __uiJson(c, inherited) {
     o.value = Number(c.value) || 0;
     o.min = Number(c.minvalue) || 0;
     o.max = Number(c.maxvalue);
-    if (!(o.max === o.max)) o.max = 100;
+    if (Number.isNaN(o.max)) o.max = 100;
   }
   if (c.items) {
     o.items = c.items.map(function (it) { return String(it.text); });
@@ -859,8 +861,8 @@ function __uiJson(c, inherited) {
 // The open windows of this script, for the host.
 function __uiSnapshot() {
   var out = [];
-  for (var i = 0; i < __uiWins.length; i++) {
-    var w = __uiWins[i];
+  for (const elem of __uiWins) {
+    var w = elem;
     if (w.__shown && !w.__closed) __uiRunDraws(w);
     out.push({ id: w.__wid, kind: w.__kind, title: String(w.text || ""), visible: !!w.__shown && !w.__closed, modal: !!w.__modal, root: __uiJson(w) });
   }
@@ -871,12 +873,12 @@ function __uiSnapshot() {
 
 function __uiOpenCount() {
   var n = 0;
-  for (var i = 0; i < __uiWins.length; i++) if (__uiWins[i].__shown && !__uiWins[i].__closed) n++;
+  for (const elem of __uiWins) if (elem.__shown && !elem.__closed) n++;
   return n;
 }
 
 function __uiWin(id) {
-  for (var i = 0; i < __uiWins.length; i++) if (__uiWins[i].__wid === id) return __uiWins[i];
+  for (const elem of __uiWins) if (elem.__wid === id) return elem;
   return null;
 }
 function __uiFind(c, id) {
@@ -910,11 +912,23 @@ function __uiDispatch(winId, id, kind, valueJson) {
     w.close(v === null ? 2 : v);
     return;
   }
+  // The host gave the window a new size (a docked panel's dock): take it, lay out, tell the script.
+  if (kind === "resize") {
+    var nw = Number(v && v[0]), nh = Number(v && v[1]);
+    var b = w.__ub || w.__lb;
+    if (nw > 0 && nh > 0 && (b[2] - b[0] !== nw || b[3] - b[1] !== nh)) {
+      w.__ub = [b[0], b[1], b[0] + nw, b[1] + nh];
+      __uiLayout(w);
+      w.__fire("onResizing");
+      w.__fire("onResize");
+    }
+    return;
+  }
   var c = __uiFind(w, id);
   if (!c || c.enabled === false) return;
   var radio = function () {
     var sib = c.parent ? c.parent.children : [];
-    for (var i = 0; i < sib.length; i++) if (sib[i] !== c && sib[i].type === "radiobutton") sib[i].value = false;
+    for (const elem of sib) if (elem !== c && elem.type === "radiobutton") elem.value = false;
     c.value = true;
   };
   // A mouse click carries the pointer's details ({x, y, button, detail, …keys}).
diff --git a/crates/script/src/socket.rs b/crates/script/src/socket.rs
index 4030332de..c024fcad5 100644
--- a/crates/script/src/socket.rs
+++ b/crates/script/src/socket.rs
@@ -51,10 +51,11 @@ mod imp {
     use std::collections::BTreeMap;
     use std::io::{ErrorKind, Read, Write};
     use std::net::{Shutdown, TcpListener, TcpStream, ToSocketAddrs};
+    use std::sync::atomic::{AtomicBool, Ordering};
     use std::sync::{Arc, Mutex};
     use std::time::{Duration, Instant};
 
-    use super::*;
+    use super::{J, err, json};
 
     enum Sock {
         Stream { s: TcpStream, buf: Vec<u8>, eof: bool },
@@ -65,9 +66,11 @@ mod imp {
     /// socket blocked on a slow peer doesn't hold up the others (#1248).
     struct Entry {
         sock: Mutex<Sock>,
-        /// A second handle on a stream, so `close` can shut it down while another call is
-        /// blocked reading or writing it.
+        /// A second handle on a stream, so `close` can wake a blocked read.
         wake: Option<TcpStream>,
+        /// Closed or unusable after a mode error. Writes poll it because Windows sends may not
+        /// be interrupted by shutdown alone; queued operations recheck it after locking.
+        closed: AtomicBool,
     }
 
     struct Table {
@@ -85,8 +88,8 @@ mod imp {
             Sock::Stream { s, .. } => s.try_clone().ok(),
             Sock::Listener(_) => None,
         };
-        let entry = Arc::new(Entry { sock: Mutex::new(s), wake });
-        let mut t = table().lock().unwrap_or_else(|e| e.into_inner());
+        let entry = Arc::new(Entry { sock: Mutex::new(s), wake, closed: AtomicBool::new(false) });
+        let mut t = table().lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         let id = t.next;
         t.next += 1;
         t.socks.insert(id, entry);
@@ -95,17 +98,29 @@ mod imp {
 
     /// The socket `id`, if open. The table is locked only for the lookup.
     fn get(id: u32) -> Option<Arc<Entry>> {
-        table().lock().unwrap_or_else(|e| e.into_inner()).socks.get(&id).cloned()
+        table().lock().unwrap_or_else(std::sync::PoisonError::into_inner).socks.get(&id).cloned()
     }
 
     /// Forget socket `id`; a call blocked on it fails at once.
     fn close(id: u32) {
-        let entry = table().lock().unwrap_or_else(|e| e.into_inner()).socks.remove(&id);
-        if let Some(w) = entry.as_ref().and_then(|e| e.wake.as_ref()) {
-            let _ = w.shutdown(Shutdown::Both);
+        let entry = table().lock().unwrap_or_else(std::sync::PoisonError::into_inner).socks.remove(&id);
+        if let Some(entry) = entry {
+            entry.closed.store(true, Ordering::Release);
+            if let Some(w) = &entry.wake {
+                let _ = w.shutdown(Shutdown::Both);
+            }
         }
     }
 
+    /// A test-only handle for establishing backpressure before exercising the public operations.
+    #[cfg(test)]
+    pub(super) fn test_stream(id: u32) -> TcpStream {
+        let entry = get(id).unwrap();
+        let sock = entry.sock.lock().unwrap();
+        let Sock::Stream { s, .. } = &*sock else { panic!("expected a stream") };
+        s.try_clone().unwrap()
+    }
+
     fn timeout(p: &J) -> Duration {
         Duration::from_secs_f64(p.get("timeout").and_then(J::as_f64).unwrap_or(10.0).clamp(0.0, 3600.0))
     }
@@ -150,7 +165,56 @@ mod imp {
         Ok(())
     }
 
+    /// A failed mode transition leaves the stream unusable; reject queued operations and wake I/O.
+    fn change_mode(s: &TcpStream, entry: &Entry, nonblocking: bool, mode: &impl Fn(&TcpStream, bool) -> std::io::Result<()>) -> std::io::Result<()> {
+        mode(s, nonblocking).map_err(|e| {
+            entry.closed.store(true, Ordering::Release);
+            let _ = s.shutdown(Shutdown::Both);
+            let action = if nonblocking { "enable nonblocking mode" } else { "restore blocking mode" };
+            std::io::Error::other(format!("socket is unusable: cannot {action}: {e}"))
+        })
+    }
+
+    /// Write with one deadline and an explicit close signal. On Windows, shutdown alone does
+    /// not reliably interrupt a blocking send, so never leave a send blocked inside the OS.
+    /// The caller holds this socket's lock; restore blocking mode or retire the connection.
+    fn write(s: &mut TcpStream, data: &[u8], limit: Duration, entry: &Entry, mode: &impl Fn(&TcpStream, bool) -> std::io::Result<()>) -> std::io::Result<()> {
+        change_mode(s, entry, true, mode)?;
+        let end = Instant::now() + limit;
+        let result = (|| {
+            let mut pending = data;
+            while !pending.is_empty() {
+                if entry.closed.load(Ordering::Acquire) {
+                    return Err(std::io::Error::new(ErrorKind::ConnectionAborted, "the socket was closed"));
+                }
+                let left = end.saturating_duration_since(Instant::now());
+                if left.is_zero() {
+                    return Err(std::io::Error::from(ErrorKind::TimedOut));
+                }
+                match s.write(pending) {
+                    Ok(0) => return Err(std::io::Error::from(ErrorKind::WriteZero)),
+                    Ok(n) => pending = pending.get(n..).ok_or_else(|| std::io::Error::from(ErrorKind::InvalidData))?,
+                    Err(e) if e.kind() == ErrorKind::WouldBlock => std::thread::sleep(left.min(Duration::from_millis(5))),
+                    Err(e) if e.kind() == ErrorKind::Interrupted => continue,
+                    Err(e) => return Err(e),
+                }
+            }
+            Ok(())
+        })();
+        match (result, change_mode(s, entry, false, mode)) {
+            (Err(write), Err(restore)) => Err(std::io::Error::other(format!("{restore}; write also failed: {write}"))),
+            (result, Ok(())) => result,
+            (Ok(()), Err(restore)) => Err(restore),
+        }
+    }
+
+    /// Dispatch an authorized operation without holding the socket table during I/O.
     pub(super) fn run(op: &str, id: u32, p: &J) -> J {
+        run_with_mode(op, id, p, TcpStream::set_nonblocking)
+    }
+
+    /// Dispatch with a mode setter so exceptional OS failures can be injected per operation.
+    pub(super) fn run_with_mode(op: &str, id: u32, p: &J, mode: impl Fn(&TcpStream, bool) -> std::io::Result<()>) -> J {
         let utf8 = p.get("encoding").and_then(J::as_str).is_some_and(|e| e.eq_ignore_ascii_case("utf-8") || e.eq_ignore_ascii_case("utf8"));
         match op {
             "open" => {
@@ -197,7 +261,16 @@ mod imp {
                         _ => err("the socket is not open"),
                     };
                 };
-                let mut sock = entry.sock.lock().unwrap_or_else(|e| e.into_inner());
+                let mut sock = entry.sock.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+                // Recheck after locking: close or a failed mode transition may have retired it
+                // while this caller waited with an Arc obtained from the table.
+                if entry.closed.load(Ordering::Acquire) {
+                    return match op {
+                        "connected" => json!({"value": false}),
+                        "eof" => json!({"value": true}),
+                        _ => err("the socket is closed or unusable"),
+                    };
+                }
                 match (op, &mut *sock) {
                     ("poll", Sock::Listener(l)) => match l.accept() {
                         Ok((s, peer)) => {
@@ -212,14 +285,18 @@ mod imp {
                     ("connected", Sock::Stream { s, buf, eof }) => {
                         if !*eof && buf.is_empty() {
                             // Peek without blocking to notice a closed peer.
-                            let _ = s.set_nonblocking(true);
+                            if let Err(e) = change_mode(s, &entry, true, &mode) {
+                                return err(e);
+                            }
                             let mut b = [0u8; 1];
                             match s.peek(&mut b) {
                                 Ok(0) => *eof = true,
                                 Err(e) if e.kind() != ErrorKind::WouldBlock => *eof = true,
                                 _ => {}
                             }
-                            let _ = s.set_nonblocking(false);
+                            if let Err(e) = change_mode(s, &entry, false, &mode) {
+                                return err(e);
+                            }
                         }
                         json!({"value": !(*eof && buf.is_empty())})
                     }
@@ -265,11 +342,8 @@ mod imp {
                         // A peer that stops reading fills the buffers: give up after `timeout`
                         // instead of blocking the script for good (#1248).
                         let limit = timeout(p).max(Duration::from_millis(1));
-                        if let Err(e) = s.set_write_timeout(Some(limit)) {
-                            return err(format!("cannot set the write timeout: {e}"));
-                        }
                         let data = p.get("data").and_then(J::as_str).unwrap_or("");
-                        match s.write_all(&encode(data, utf8)).and_then(|_| s.flush()) {
+                        match write(s, &encode(data, utf8), limit, &entry, &mode) {
                             Ok(()) => json!({"ok": true}),
                             Err(e) if matches!(e.kind(), ErrorKind::WouldBlock | ErrorKind::TimedOut) => err(format!(
                                 "write timed out after {} s: the other side isn't reading (some of the data may have been sent)",
@@ -289,6 +363,7 @@ mod imp {
 #[cfg(test)]
 #[cfg(not(target_arch = "wasm32"))]
 mod tests {
+    use std::io::{ErrorKind, Read, Write};
     use std::net::{TcpListener, TcpStream};
     use std::sync::mpsc;
     use std::time::{Duration, Instant};
@@ -301,6 +376,7 @@ mod tests {
     /// `host:port` and the accepted stream's keeper (drop it to let the connection go).
     fn stalled_peer() -> (String, mpsc::Sender<()>) {
         let l = TcpListener::bind("127.0.0.1:0").unwrap();
+        socket2::SockRef::from(&l).set_recv_buffer_size(4096).unwrap();
         let host = l.local_addr().unwrap().to_string();
         let (stop, wait) = mpsc::channel::<()>();
         std::thread::spawn(move || {
@@ -310,14 +386,46 @@ mod tests {
         (host, stop)
     }
 
+    /// Open a test connection through the production socket dispatcher.
     fn open(host: &str) -> u32 {
         let r = run("open", 0, &json!({"host": host, "timeout": 5}));
         r["id"].as_u64().unwrap_or_else(|| panic!("open {host}: {r}")) as u32
     }
 
-    /// More than the loopback buffers hold, so a peer that doesn't read stops the write.
-    fn big() -> String {
-        "x".repeat(64 * 1024 * 1024)
+    /// Fill bounded socket buffers nonblocking, rather than assuming a 64 MiB write stalls.
+    /// In particular, Windows may accept that entire write with its default send buffering.
+    /// Writes must stay blocked for [`SETTLED`] before the buffers count as full: on macOS the
+    /// accepted stream does not keep the listener's 4 KiB receive buffer (it gets about 114 KiB),
+    /// so the first `WouldBlock` only means the 4 KiB send buffer is full, and the send buffer then
+    /// drains into the peer's larger receive buffer.
+    fn backpressure(id: u32) {
+        const SETTLED: Duration = Duration::from_millis(200);
+        let mut stream = super::imp::test_stream(id);
+        socket2::SockRef::from(&stream).set_send_buffer_size(4096).unwrap();
+        stream.set_nonblocking(true).unwrap();
+        let start = Instant::now();
+        let chunk = [b'x'; 4096];
+        let mut sent = 0;
+        let mut blocked_since = None;
+        loop {
+            assert!(sent < 16 * 1024 * 1024 && start.elapsed() < Duration::from_secs(5), "could not establish backpressure");
+            match stream.write(&chunk) {
+                Ok(0) => panic!("peer closed while establishing backpressure"),
+                Ok(n) => {
+                    sent += n;
+                    blocked_since = None;
+                }
+                Err(e) if e.kind() == ErrorKind::WouldBlock => {
+                    if blocked_since.get_or_insert_with(Instant::now).elapsed() >= SETTLED {
+                        break;
+                    }
+                    std::thread::sleep(Duration::from_millis(5));
+                }
+                Err(e) if e.kind() == ErrorKind::Interrupted => continue,
+                Err(e) => panic!("establishing backpressure: {e}"),
+            }
+        }
+        stream.set_nonblocking(false).unwrap();
     }
 
     /// Run `f` on a thread; its result, or `None` if it takes longer than `limit`.
@@ -329,31 +437,36 @@ mod tests {
         rx.recv_timeout(limit).ok()
     }
 
+    /// A bounded write times out even when the peer never drains its receive buffer.
     #[test]
     fn a_write_to_a_peer_that_stops_reading_fails_after_the_timeout() {
         // #1248: it used to block for good.
         let (host, _keep) = stalled_peer();
         let id = open(&host);
-        let data = big();
+        backpressure(id);
+        let data = "x".repeat(64 * 1024);
         let t0 = Instant::now();
         let r = within(Duration::from_secs(20), move || run("write", id, &json!({"data": data, "timeout": 1}))).expect("the write gave up");
         assert!(r["error"].as_str().is_some_and(|e| e.contains("timed out")), "{r}");
-        assert!(t0.elapsed() < Duration::from_secs(15), "{:?}", t0.elapsed());
+        assert!(t0.elapsed() >= Duration::from_millis(500) && t0.elapsed() < Duration::from_secs(15), "{:?}", t0.elapsed());
         run("close", id, &J::Null);
     }
 
+    /// Closing a stalled stream interrupts its writer without blocking another socket.
     #[test]
     fn a_blocked_socket_doesnt_hold_up_the_others_and_close_interrupts_it() {
         let (host_a, _keep_a) = stalled_peer();
         let (host_b, _keep_b) = stalled_peer();
         let (a, b) = (open(&host_a), open(&host_b));
         // A write on A that would wait a minute.
-        let data = big();
+        backpressure(a);
+        let data = "x".repeat(64 * 1024);
         let (tx, blocked) = mpsc::channel();
         std::thread::spawn(move || {
             let _ = tx.send(run("write", a, &json!({"data": data, "timeout": 60})));
         });
         std::thread::sleep(Duration::from_millis(500));
+        assert!(matches!(blocked.try_recv(), Err(mpsc::TryRecvError::Empty)), "A must still be writing before close");
         // Socket B answers meanwhile (the table isn't locked by A's write).
         let r = within(Duration::from_secs(3), move || run("connected", b, &json!({}))).expect("socket B answered while A was blocked");
         assert_eq!(r["value"], true, "{r}");
@@ -363,4 +476,86 @@ mod tests {
         assert!(r.get("error").is_some(), "{r}");
         run("close", b, &J::Null);
     }
+
+    /// Failed mode changes retire the stream; subsequent I/O fails instead of using it.
+    #[test]
+    fn mode_restoration_failure_retires_streams() {
+        for (op, fail_nonblocking) in [("write", false), ("connected", false), ("write", true), ("connected", true)] {
+            let (host, _keep) = stalled_peer();
+            let id = open(&host);
+            let result = super::imp::run_with_mode(op, id, &json!({"data": "hello"}), |s, nonblocking| {
+                if nonblocking == fail_nonblocking { Err(std::io::Error::other("injected mode failure")) } else { s.set_nonblocking(nonblocking) }
+            });
+            assert!(result["error"].as_str().is_some_and(|e| e.contains("injected mode failure")), "{op}: {result}");
+            assert_eq!(run("connected", id, &J::Null)["value"], false, "{op}: broken socket remains connected");
+            assert_eq!(run("eof", id, &J::Null)["value"], true);
+            for operation in ["read", "readln", "write"] {
+                let r = run(operation, id, &json!({"count": 1, "timeout": 0.01, "data": "x"}));
+                assert!(r.get("error").is_some(), "{operation} must reject the unusable stream: {r}");
+            }
+            run("close", id, &J::Null);
+            run("close", id, &J::Null);
+        }
+    }
+
+    /// A preceding write error cannot hide the failure that makes the stream unusable.
+    #[test]
+    fn restoration_failure_preserves_the_write_error_too() {
+        let (host, _keep) = stalled_peer();
+        let id = open(&host);
+        let result = super::imp::run_with_mode("write", id, &json!({"data": "hello"}), |s, nonblocking| {
+            if nonblocking {
+                s.set_nonblocking(true)?;
+                s.shutdown(std::net::Shutdown::Write)
+            } else {
+                Err(std::io::Error::other("injected restore failure"))
+            }
+        });
+        let error = result["error"].as_str().unwrap();
+        assert!(error.contains("injected restore failure") && error.contains("write also failed"), "{error}");
+        assert_eq!(run("connected", id, &J::Null)["value"], false);
+        run("close", id, &J::Null);
+    }
+
+    /// Both outgoing and accepted sockets deliver complete data, then return to blocking reads.
+    #[test]
+    fn writes_deliver_all_data_and_restore_blocking_reads() {
+        for accepted in [false, true] {
+            let (id, mut peer) = if accepted {
+                let listener = run("listen", 0, &json!({"port": 0}));
+                let listener_id = listener["id"].as_u64().unwrap() as u32;
+                let peer = TcpStream::connect(("127.0.0.1", listener["port"].as_u64().unwrap() as u16)).unwrap();
+                let start = Instant::now();
+                let id = loop {
+                    if let Some(id) = run("poll", listener_id, &J::Null)["id"].as_u64() {
+                        break id as u32;
+                    }
+                    assert!(start.elapsed() < Duration::from_secs(5));
+                    std::thread::sleep(Duration::from_millis(1));
+                };
+                run("close", listener_id, &J::Null);
+                (id, peer)
+            } else {
+                let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+                let id = open(&listener.local_addr().unwrap().to_string());
+                (id, listener.accept().unwrap().0)
+            };
+            socket2::SockRef::from(&super::imp::test_stream(id)).set_send_buffer_size(4096).unwrap();
+            peer.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+            let reader = std::thread::spawn(move || {
+                let mut data = vec![0; 256 * 1024];
+                peer.read_exact(&mut data).unwrap();
+                assert!(data.iter().all(|b| *b == b'x'));
+                // A read on a socket accidentally left nonblocking would return before this.
+                std::thread::sleep(Duration::from_millis(100));
+                peer.write_all(b"ack").unwrap();
+            });
+            let r = within(Duration::from_secs(10), move || run("write", id, &json!({"data": "x".repeat(256 * 1024), "timeout": 5}))).unwrap();
+            assert_eq!(r["ok"], true, "{r}");
+            let r = run("read", id, &json!({"count": 3, "timeout": 2}));
+            assert_eq!(r["data"], "ack", "{r}");
+            run("close", id, &J::Null);
+            reader.join().unwrap();
+        }
+    }
 }
diff --git a/crates/script/src/tasks.rs b/crates/script/src/tasks.rs
index 563f3bbc0..8b5c0cd7a 100644
--- a/crates/script/src/tasks.rs
+++ b/crates/script/src/tasks.rs
@@ -208,7 +208,9 @@ pub(crate) fn run_tasks_at(session: &mut Session, now: Instant) -> J {
     if !running {
         #[cfg(not(target_arch = "wasm32"))]
         crate::ui::tick_threaded(session, now, &mut report);
-        crate::ui::tick_inline(session, now, &mut report);
+        if session.script_ui.render_host.is_none() {
+            crate::ui::tick_inline(session, now, &mut report);
+        }
         crate::ui::prune_task_hosts(session);
     }
     let errors: Vec<J> = report.errors.iter().map(|e| json!({"message": e.message, "line": e.line, "column": e.column, "file": e.file})).collect();
diff --git a/crates/script/src/tests.rs b/crates/script/src/tests.rs
index 6f87f7572..78a16e5d3 100644
--- a/crates/script/src/tests.rs
+++ b/crates/script/src/tests.rs
@@ -10,6 +10,21 @@ use serde_json::{Value, json};
 
 use crate::{Outcome, run_code};
 
+mod callable;
+mod ease_presets;
+mod evalfile;
+mod include;
+mod panels;
+#[cfg(not(target_arch = "wasm32"))]
+mod render_wait;
+#[cfg(not(windows))]
+mod services;
+mod startup;
+mod tasks;
+mod ui;
+mod ui_more;
+mod ui_mouse;
+
 fn session() -> Session {
     let mut s = Session { expr: Some(Arc::new(effectcraft_expr::Expressions)), expr_check: Some(effectcraft_expr::check_syntax), ..Default::default() };
     crate::install(&mut s);
@@ -126,6 +141,42 @@ fn fill_parameters_use_documented_match_names() {
     assert_eq!(o.result, json!("Color|All Masks|ADBE Fill-0007"));
 }
 
+/// #3113: effects carry After Effects' match names (`ADBE Noise2`, `ADBE OFMotionBlur`); the
+/// names earlier versions emitted still add and find the effect and its parameters.
+#[test]
+fn effects_use_after_effects_match_names_and_accept_legacy_ones() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"var c = app.project.items.addComp("N", 100, 100, 1, 1, 12); var l = c.layers.addSolid([1,1,1], "S", 100, 100, 1);
+           var fx = l.property("ADBE Effect Parade");
+           var a = fx.addProperty("ADBE Noise2"), b = fx.addProperty("ADBE Noise"), m = fx.addProperty("ADBE OFMotionBlur");
+           var p = fx.addProperty("ADBE Pixel Motion Blur");
+           [a.matchName, b.matchName, m.matchName, p.matchName, a.property("ADBE Noise2-0001").name,
+            fx.property("ADBE Noise").matchName, a.property("ADBE Noise-0001").name, fx.numProperties]"#,
+    );
+    assert_eq!(
+        o.result,
+        json!(["ADBE Noise2", "ADBE Noise2", "ADBE OFMotionBlur", "ADBE OFMotionBlur", "Amount of Noise", "ADBE Noise2", "Amount of Noise", 4])
+    );
+}
+
+/// #3113: names that changed only in case (`ADBE Ellipse` → `ADBE ELLIPSE`, `ADBE Grow Bounds` →
+/// `ADBE GROW BOUNDS`) still find the effect and its parameters.
+#[test]
+fn match_names_that_changed_case_still_find_effects_and_parameters() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"var c = app.project.items.addComp("E", 100, 100, 1, 1, 12); var l = c.layers.addSolid([1,1,1], "S", 100, 100, 1);
+           var fx = l.property("ADBE Effect Parade");
+           var e = fx.addProperty("ADBE Ellipse"), g = fx.addProperty("ADBE Grow Bounds");
+           [e.matchName, fx.property("ADBE Ellipse").matchName, e.property("ADBE Ellipse-0001").matchName,
+            g.matchName, fx.property("ADBE Grow Bounds").matchName, g.property("ADBE Grow Bounds-0001").matchName]"#,
+    );
+    assert_eq!(o.result, json!(["ADBE ELLIPSE", "ADBE ELLIPSE", "ADBE ELLIPSE-0001", "ADBE GROW BOUNDS", "ADBE GROW BOUNDS", "ADBE GROW BOUNDS-0001"]));
+}
+
 #[test]
 fn stroke_parameters_use_after_effects_match_names() {
     // #1405: `ADBE Stroke-0002` is Stroke's Color in After Effects, not All Masks.
@@ -258,6 +309,97 @@ fn an_undefined_name_mentioned_earlier_reports_its_use_in_the_reading_function()
     assert_eq!(e.line, Some(6), "{e:?}");
 }
 
+/// Scripts reach Wiggle Paths' properties, Spatial Phase included, by their match names.
+#[test]
+fn wiggle_paths_properties_by_match_name() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("W", 200, 200, 1, 2, 30);
+        var sh = c.layers.addShape();
+        var w = sh.property("ADBE Root Vectors Group").addProperty("ADBE Vector Filter - Roughen");
+        w.property("ADBE Vector Spatial Phase").setValue(45);
+        var names = [];
+        for (var i = 1; i <= w.numProperties; i++) names.push(w.property(i).matchName);
+        [w.matchName, w.property("ADBE Vector Spatial Phase").name, names]
+        "#,
+    );
+    assert_eq!(
+        o.result,
+        json!([
+            "ADBE Vector Filter - Roughen",
+            "Spatial Phase",
+            [
+                "ADBE Vector Roughen Size",
+                "ADBE Vector Roughen Detail",
+                "ADBE Vector Roughen Points",
+                "ADBE Vector Temporal Freq",
+                "ADBE Vector Correlation",
+                "ADBE Vector Temporal Phase",
+                "ADBE Vector Spatial Phase",
+                "ADBE Vector Random Seed"
+            ]
+        ])
+    );
+    let (_, c) = comp_named(&s, "W");
+    let sh = c.layers.iter().find(|l| l.props.sub("contents").is_some()).unwrap();
+    assert_eq!(sh.props.prop("contents/wiggle/spatialPhase").unwrap().value, KV::Scalar(45.0));
+}
+
+/// Scripts reach Offset Paths' and Zig Zag's properties by their match names.
+#[test]
+fn offset_paths_and_zig_zag_properties_by_match_name() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("O", 200, 200, 1, 2, 30);
+        var sh = c.layers.addShape();
+        var root = sh.property("ADBE Root Vectors Group");
+        root.addProperty("ADBE Vector Filter - Offset");
+        root.addProperty("ADBE Vector Filter - Zigzag");
+        var o = root.property("ADBE Vector Filter - Offset");
+        var z = root.property("ADBE Vector Filter - Zigzag");
+        var on = ["ADBE Vector Offset Amount", "ADBE Vector Offset Line Join", "ADBE Vector Offset Miter Limit",
+                  "ADBE Vector Offset Copies", "ADBE Vector Offset Copy Offset"];
+        var zn = ["ADBE Vector Zigzag Size", "ADBE Vector Zigzag Detail", "ADBE Vector Zigzag Points"];
+        var names = [];
+        for (var i = 0; i < on.length; i++) names.push([o.property(on[i]).matchName, o.property(on[i]).name]);
+        for (var j = 0; j < zn.length; j++) names.push([z.property(zn[j]).matchName, z.property(zn[j]).name]);
+        var before = [o.property("ADBE Vector Offset Amount").value, o.property("ADBE Vector Offset Line Join").value,
+                      z.property("ADBE Vector Zigzag Points").value];
+        o.property("ADBE Vector Offset Amount").setValue(-6);
+        o.property("ADBE Vector Offset Copies").setValue(3);
+        z.property("ADBE Vector Zigzag Detail").setValue(8);
+        [names, before, o.property("ADBE Vector Offset Nope") === null, z.property("ADBE Vector Zigzag Nope") === null]
+        "#,
+    );
+    assert_eq!(
+        o.result,
+        json!([
+            [
+                ["ADBE Vector Offset Amount", "Amount"],
+                ["ADBE Vector Offset Line Join", "Line Join"],
+                ["ADBE Vector Offset Miter Limit", "Miter Limit"],
+                ["ADBE Vector Offset Copies", "Copies"],
+                ["ADBE Vector Offset Copy Offset", "Copy Offset"],
+                ["ADBE Vector Zigzag Size", "Size"],
+                ["ADBE Vector Zigzag Detail", "Ridges per segment"],
+                ["ADBE Vector Zigzag Points", "Points"]
+            ],
+            [10, 1, 1],
+            true,
+            true
+        ])
+    );
+    let (_, c) = comp_named(&s, "O");
+    let sh = c.layers.iter().find(|l| l.props.sub("contents").is_some()).unwrap();
+    assert_eq!(sh.props.prop("contents/offset/amount").unwrap().value, KV::Scalar(-6.0));
+    assert_eq!(sh.props.prop("contents/offset/copies").unwrap().value, KV::Scalar(3.0));
+    assert_eq!(sh.props.prop("contents/zigzag/ridges").unwrap().value, KV::Scalar(8.0));
+}
+
 #[test]
 fn match_names_and_lookups() {
     let mut s = session();
@@ -321,6 +463,31 @@ fn match_names_and_lookups() {
     assert_eq!(sh.props.prop("contents/#1/contents/fill/color").unwrap().value, KV::Color([1.0, 0.0, 0.0, 1.0]));
 }
 
+/// Scripts add a Wiggle Transform by its match name or display name and reach its properties.
+#[test]
+fn wiggle_transform_by_match_name() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("W", 200, 200, 1, 2, 30);
+        var sh = c.layers.addShape();
+        var root = sh.property("ADBE Root Vectors Group");
+        var w = root.addProperty("ADBE Vector Filter - Wiggler");
+        var byName = root.addProperty("Wiggle Transform");
+        w.property("ADBE Vector Wiggler Transform").property("Position").setValue([20, 10]);
+        [
+          w.matchName, w.name, byName.matchName, w.property("ADBE Vector Xform Temporal Freq").value,
+          w.property("ADBE Vector Spatial Phase").name, w.property("ADBE Vector Wiggler Transform").name
+        ]
+        "#,
+    );
+    assert_eq!(o.result, json!(["ADBE Vector Filter - Wiggler", "Wiggle Transform 1", "ADBE Vector Filter - Wiggler", 2, "Spatial Phase", "Transform"]));
+    let (_, c) = comp_named(&s, "W");
+    let sh = c.layers.iter().find(|l| l.props.sub("contents").is_some()).unwrap();
+    assert_eq!(sh.props.prop("contents/wiggler/transform/position").unwrap().value, KV::Vec2([20.0, 10.0]));
+}
+
 #[test]
 fn keyframes_eases_and_interpolation() {
     let mut s = session();
@@ -444,6 +611,38 @@ fn layers_items_and_markers() {
     );
 }
 
+#[test]
+fn folder_paths_trim_trailing_separators() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var paths = ['', '/', '///', 'a/b/', 'a\\b\\/', 'a/b', 'a/\n'];
+        var result = paths.map(function (path) {
+          var folder = new Folder(path);
+          return [folder.name, folder.path, __join(path, 'child')];
+        });
+        // A long run followed by a non-separator used to cause quadratic regex backtracking.
+        var longPath = Array(20001).join('/') + 'x';
+        result.push([new Folder(longPath).name, new Folder(longPath).path.length, __join(longPath, 'child').length]);
+        result
+        "#,
+    );
+    assert_eq!(
+        o.result,
+        json!([
+            ["", "", "/child"],
+            ["", "", "/child"],
+            ["", "", "/child"],
+            ["b", "a", "a/b/child"],
+            ["b", "a", "a\\b/child"],
+            ["b", "a", "a/b/child"],
+            ["\n", "a", "a/\n/child"],
+            ["x", 19999, 20007]
+        ])
+    );
+}
+
 #[test]
 fn security_gate_for_files() {
     let dir = std::env::temp_dir().join(format!("ec-script-gate-{}", std::process::id()));
@@ -611,6 +810,26 @@ fn engine_entry_points() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// `app.project.framesCountType` / `displayStartFrame`: Project Settings ▸ Frame Count (#1807).
+#[test]
+fn frames_count_type_sets_the_project_frame_count() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        "var p = app.project; var a = [p.framesCountType === FramesCountType.FC_START_0, p.displayStartFrame]; p.framesCountType = FramesCountType.FC_START_1; a.concat([p.framesCountType === FramesCountType.FC_START_1, p.displayStartFrame]).join('|')",
+    );
+    assert_eq!(o.result, json!("true|0|true|1"));
+    // After Effects' enum values, so scripts that store the number keep working.
+    let o = ok(&mut s, "[FramesCountType.FC_START_0, FramesCountType.FC_START_1, FramesCountType.FC_TIMECODE_CONVERSION].join('|')");
+    assert_eq!(o.result, json!("2612|2613|2614"));
+    assert_eq!(s.project.settings.frame_start, 1);
+    ok(&mut s, "app.project.displayStartFrame = 0");
+    assert_eq!(s.project.settings.frame_start, 0);
+    let o = run_code(&mut s, "app.project.framesCountType = FramesCountType.FC_TIMECODE_CONVERSION", "test.jsx");
+    assert!(o.error.is_some_and(|e| e.message.contains("Timecode Conversion")));
+    assert_eq!(s.project.settings.frame_start, 0);
+}
+
 #[test]
 fn console_keeps_variables() {
     let mut s = session();
@@ -960,9 +1179,45 @@ fn footage_proxies_sequences_and_conform_rate() {
     let paths: Vec<String> =
         s.project.items.values().filter_map(|i| if let ItemKind::Footage(f) = &i.kind { Some(f.path.replace('\\', "/")) } else { None }).collect();
     assert!(paths.iter().any(|f| f.contains("take_")), "replaced with the take sequence: {paths:?}");
+    // replace() swaps in the one file, even a numbered still, as in After Effects.
+    ok(&mut s, &format!("app.project.item(1).replace(new File('{}'))", p("shot_0002.png")));
+    let kinds: Vec<_> =
+        s.project.items.values().filter_map(|i| if let ItemKind::Footage(f) = &i.kind { Some((f.kind, f.path.replace('\\', "/"))) } else { None }).collect();
+    assert!(kinds.iter().any(|(k, f)| *k == effectcraft_engine::project::FootageKind::Still && f.ends_with("shot_0002.png")), "{kinds:?}");
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// #813: `AVLayer.replaceSource` changes the source item and keeps the layer's name, timing and
+/// properties; a folder is not a source.
+#[test]
+fn av_layer_replace_source_keeps_the_layer() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var main = app.project.items.addComp("Main", 100, 100, 1, 5, 25);
+        var layer = main.layers.addSolid([1, 0, 0], "Old", 100, 100, 1);
+        layer.transform.position.setValue([10, 20]);
+        layer.startTime = 1;
+        var nested = app.project.items.addComp("Nested", 200, 100, 1, 3, 25);
+        layer.replaceSource(nested, false);
+        [layer.source.name, layer.source.width, layer.source.height, layer.source instanceof CompItem,
+         layer.name, layer.transform.position.value[0], layer.startTime, main.numLayers]
+        "#,
+    );
+    assert_eq!(o.result, json!(["Nested", 200, 100, true, "Old", 10, 1, 1]));
+    let bad = run_code(
+        &mut s,
+        r#"
+        var main = app.project.items.addComp("Other", 100, 100, 1, 2, 25);
+        var layer = main.layers.addSolid([1, 0, 0], "Layer", 100, 100, 1);
+        layer.replaceSource(app.project.items.addFolder("F"), false);
+        "#,
+        "replace-source.jsx",
+    );
+    assert!(bad.error.as_ref().is_some_and(|e| e.message.contains("folder")), "{bad:?}");
+}
+
 /// A flat green footage source, so `sampleImage` on a footage layer has known pixels.
 struct Flat;
 impl effectcraft_engine::render::FootageSource for Flat {
@@ -1585,3 +1840,112 @@ fn layer_property_resolves_transform_and_source_text_shortcuts() {
     let (_, c) = comp_named(&s, "x");
     assert_eq!(layer(c, "s").props.prop("transform/opacity").unwrap().value, KV::Scalar(25.0));
 }
+
+/// A text animator property added by its After Effects name is the one asked for, not its Tracking
+/// Type companion, and it can be found again by that name (#1063).
+#[test]
+fn scripted_text_animator_property_is_the_one_asked_for() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("Track", 960, 300, 1, 3, 30);
+        var t = c.layers.addText("MOVARA");
+        var a = t.property("ADBE Text Properties").property("ADBE Text Animators").addProperty("ADBE Text Animator");
+        var props = a.property("ADBE Text Animator Properties");
+        var added = props.addProperty("ADBE Text Tracking Amount");
+        added.setValue(20);
+        [added.name, props.property("ADBE Text Tracking Amount").value, props.property("ADBE Text Tracking Amount").name,
+         added.matchName, props.property(added.matchName).propertyIndex]
+        "#,
+    );
+    assert_eq!(o.result, json!(["Tracking Amount", 20, "Tracking Amount", "ADBE Text Tracking Amount", 2]));
+}
+
+/// The companion properties added with Tracking and Skew are found by their After Effects names,
+/// but cannot be added on their own (#1063).
+#[test]
+fn text_animator_companion_properties_resolve_by_name() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("Track", 960, 300, 1, 3, 30);
+        var t = c.layers.addText("MOVARA");
+        var props = t.property("ADBE Text Properties").property("ADBE Text Animators").addProperty("ADBE Text Animator").property("ADBE Text Animator Properties");
+        props.addProperty("ADBE Text Tracking Amount");
+        props.addProperty("ADBE Text Skew");
+        var type = props.property("ADBE Text Track Type");
+        var axis = props.property("ADBE Text Skew Axis");
+        var added = "";
+        try { props.addProperty("ADBE Text Track Type"); added = "added"; } catch (e) { added = "refused"; }
+        [type ? type.matchName : null, axis ? axis.matchName : null, added]
+        "#,
+    );
+    assert_eq!(o.result, json!(["ADBE Text Track Type", "ADBE Text Skew Axis", "refused"]));
+}
+
+/// #1936: an array whose length doesn't match the property's dimension is an error in After
+/// Effects, not a value to truncate or broadcast. Two values for a 3-D property stay legal.
+#[test]
+fn set_value_rejects_an_array_of_the_wrong_dimension() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("Dims", 640, 360, 1, 2, 30);
+        var l = c.layers.addSolid([1, 0, 0], "s", 640, 360, 1);
+        var ramp = l.property("ADBE Effect Parade").addProperty("ADBE Ramp").property("ADBE Ramp-0001");
+        function attempt(f) { try { f(); return "no error"; } catch (e) { return e.message; } }
+        var before = "" + ramp.value;
+        var tooMany = attempt(function () { ramp.setValue([1, 2, 3]); });
+        var tooFew = attempt(function () { ramp.setValue([1]); });
+        var untouched = "" + ramp.value;
+        ramp.setValue([7, 8]);
+        var keyed = attempt(function () { ramp.setValueAtTime(0, [1, 2, 3, 4]); });
+        // A 3-D property still takes two values, as it does in After Effects: z stays 0.
+        l.property("Position").setValue([120, 34]);
+        [tooMany, tooFew, untouched === before, "" + ramp.value, keyed, "" + l.property("Position").value]
+        "#,
+    );
+    assert_eq!(
+        o.result,
+        json!([
+            "Array is not of the correct dimension",
+            "Array is not of the correct dimension",
+            true,
+            "7,8",
+            "Array is not of the correct dimension",
+            "120,34,0"
+        ])
+    );
+    let (_, c) = comp_named(&s, "Dims");
+    assert_eq!(layer(c, "s").props.prop("transform/position").unwrap().value, KV::Vec3([120.0, 34.0, 0.0]));
+}
+
+/// #1942: the scripting width and height setters resize the frame only. Re-anchoring the old frame
+/// in the new one, which moves every unparented layer, belongs to the Composition Settings dialog.
+#[test]
+fn setting_comp_width_and_height_leaves_the_layers_where_they_are() {
+    let mut s = session();
+    let o = ok(
+        &mut s,
+        r#"
+        var c = app.project.items.addComp("w", 400, 200, 1, 1, 25);
+        var l = c.layers.addSolid([1, 1, 1], "s", 50, 50, 1, 1);
+        var pos = l.property("ADBE Transform Group").property("ADBE Position");
+        pos.setValue([100, 100]);
+        var k = c.layers.addSolid([1, 1, 1], "k", 50, 50, 1, 1);
+        var kpos = k.property("ADBE Transform Group").property("ADBE Position");
+        kpos.setValueAtTime(0, [10, 20]);
+        kpos.setValueAtTime(1, [30, 40]);
+        var before = "" + pos.value;
+        c.width = 800;
+        c.height = 400;
+        [before, "" + pos.value, "" + kpos.keyValue(1), "" + kpos.keyValue(2), c.width, c.height]
+        "#,
+    );
+    assert_eq!(o.result, json!(["100,100,0", "100,100,0", "10,20,0", "30,40,0", 800, 400]));
+    let (_, c) = comp_named(&s, "w");
+    assert_eq!(layer(c, "s").props.prop("transform/position").unwrap().value, KV::Vec3([100.0, 100.0, 0.0]));
+}
diff --git a/crates/script/src/tests_callable.rs b/crates/script/src/tests/callable.rs
similarity index 100%
rename from crates/script/src/tests_callable.rs
rename to crates/script/src/tests/callable.rs
diff --git a/crates/script/src/tests_ease_presets.rs b/crates/script/src/tests/ease_presets.rs
similarity index 94%
rename from crates/script/src/tests_ease_presets.rs
rename to crates/script/src/tests/ease_presets.rs
index 009cc59c6..3d1f95f31 100644
--- a/crates/script/src/tests_ease_presets.rs
+++ b/crates/script/src/tests/ease_presets.rs
@@ -90,7 +90,7 @@ fn per_key_methods_keep_the_key_selection_and_report_eases_as_they_play() {
     let r = ok(
         &mut s,
         r#"var comp = app.project.activeItem, p = comp.layer(1).transform.opacity;
-        // A linear side reports the speed it plays at (33.3 % influence).
+        // A linear side reports the speed it plays at (16.67 % influence, as After Effects).
         var lin = p.keyInTemporalEase(3)[0];
         p.setTemporalEaseAtKey(2, [new KeyframeEase(0, 50)], [new KeyframeEase(0, 75)]);
         p.setInterpolationTypeAtKey(3, KeyframeInterpolationType.HOLD, KeyframeInterpolationType.HOLD);
@@ -98,7 +98,7 @@ fn per_key_methods_keep_the_key_selection_and_report_eases_as_they_play() {
         var sel = comp.selectedProperties;
         [lin.speed, lin.influence, p.selectedKeys, sel.length, sel.length ? sel[0].name : ""]"#,
     );
-    assert!(close(r[0].as_f64().unwrap(), -100.0, 1e-9) && close(r[1].as_f64().unwrap(), 100.0 / 3.0, 1e-9), "{r}");
+    assert!(close(r[0].as_f64().unwrap(), -100.0, 1e-9) && close(r[1].as_f64().unwrap(), 100.0 / 6.0, 1e-9), "{r}");
     assert_eq!(r[2], json!([1, 3]), "the selection is the user's");
     assert_eq!((r[3].clone(), r[4].clone()), (json!(1), json!("Opacity")));
     assert_eq!(s.state.selected_keys, before);
@@ -608,3 +608,37 @@ fn presets_saved_by_the_old_core_panel_carry_over() {
     let win = open_panel(&mut s);
     assert_eq!(control(&mut s, win, "presets")["items"].as_array().unwrap().len(), 12);
 }
+
+/// #2465: the Linear preset sets Linear interpolation on every side it applies to, including the
+/// unused first-in and last-out sides; editing its speeds makes a Bezier curve.
+#[test]
+fn the_linear_preset_sets_linear_interpolation_and_edited_speeds_give_bezier() {
+    let store = Arc::new(MemoryConfig::default());
+    let mut s = session(&store);
+    let l = setup(&mut s);
+    animate(&mut s, l, "transform/opacity", &[(0.0, json!(0)), (1.0, json!(100)), (3.0, json!(20))]);
+    s.execute("prop.select", json!({"layer": l, "path": "transform/opacity"})).unwrap();
+    let win = open_panel(&mut s);
+    // Start from Bezier keys so Linear has something to restore.
+    ok(
+        &mut s,
+        r#"var p = app.project.activeItem.layer(1).transform.opacity, K = KeyframeInterpolationType;
+        for (var i = 1; i <= p.numKeys; i++) p.setInterpolationTypeAtKey(i, K.BEZIER, K.BEZIER);"#,
+    );
+    let op = prop(&s, l, "transform/opacity");
+    for (i, k) in op.keys.iter().enumerate() {
+        assert_eq!((k.in_interp, k.out_interp), (Interp::Bezier, Interp::Bezier), "initial key {i}");
+    }
+    let steps = s.history.undo.len();
+    set(&mut s, win, "presets", json!("Linear"));
+    assert_eq!(s.history.undo.len(), steps + 1, "one undo step");
+    let op = prop(&s, l, "transform/opacity");
+    for (i, k) in op.keys.iter().enumerate() {
+        assert_eq!((k.in_interp, k.out_interp), (Interp::Linear, Interp::Linear), "key {i}");
+    }
+    // Edited speeds make a custom Bezier curve even though Linear is still the selected preset.
+    select_keys(&mut s, l, &[("transform/opacity", 1.0)]);
+    apply_typed(&mut s, win, "In-Out", [33.0, 2.0, 33.0, 2.0]);
+    let k = &prop(&s, l, "transform/opacity").keys[1];
+    assert_eq!((k.in_interp, k.out_interp), (Interp::Bezier, Interp::Bezier));
+}
diff --git a/crates/script/src/tests_evalfile.rs b/crates/script/src/tests/evalfile.rs
similarity index 100%
rename from crates/script/src/tests_evalfile.rs
rename to crates/script/src/tests/evalfile.rs
diff --git a/crates/script/src/tests_include.rs b/crates/script/src/tests/include.rs
similarity index 100%
rename from crates/script/src/tests_include.rs
rename to crates/script/src/tests/include.rs
diff --git a/crates/script/src/tests_panels.rs b/crates/script/src/tests/panels.rs
similarity index 74%
rename from crates/script/src/tests_panels.rs
rename to crates/script/src/tests/panels.rs
index c398a3a3f..3318d060f 100644
--- a/crates/script/src/tests_panels.rs
+++ b/crates/script/src/tests/panels.rs
@@ -86,3 +86,27 @@ fn open_panels_open_again_at_the_next_launch() {
     let mut s = session(&store);
     assert_eq!(s.execute("window.restoreScriptPanels", json!({})).unwrap(), json!({"opened": [], "failed": []}));
 }
+
+/// A panel in a subfolder (Window ▸ Motion Kit ▸ Animate.jsx) is `Motion Kit/Animate.jsx`: it opens
+/// titled after its file and opens again at the next launch.
+#[test]
+fn a_panel_in_a_subfolder_opens_and_opens_again_at_the_next_launch() {
+    let store = Arc::new(MemoryConfig::default());
+    store.write(&format!("{PANELS_DIR}/Motion Kit/Animate.jsx"), PANEL).unwrap();
+    let mut s = session(&store);
+    let list = s.execute("file.scripts.list", json!({})).unwrap();
+    assert!(list.as_array().unwrap().iter().any(|e| e["name"] == "Motion Kit/Animate.jsx" && e["panel"] == true), "{list}");
+    let r = s.execute("window.scriptPanel", json!({"name": "Motion Kit/Animate.jsx"})).unwrap();
+    let w = s.script_ui.window(r["window"].as_u64().unwrap() as u32).unwrap();
+    assert_eq!((w.kind, w.title.as_str()), (WindowKind::Panel, "Animate"));
+    assert_eq!(remembered(&store), json!({"open": ["Motion Kit/Animate.jsx"]}));
+    // A saved name that leaves the folder, or goes two folders deep, fails and is forgotten.
+    store.write(OPEN_PANELS_FILE, &json!({"open": ["../Top.jsx", "Motion Kit/Animate.jsx", "a/b/c.jsx"]}).to_string()).unwrap();
+    drop(s);
+    let mut s = session(&store);
+    let r = s.execute("window.restoreScriptPanels", json!({})).unwrap();
+    assert_eq!(r["opened"], json!(["Motion Kit/Animate.jsx"]));
+    assert_eq!(r["failed"].as_array().unwrap().iter().map(|f| f["name"].as_str().unwrap()).collect::<Vec<_>>(), ["../Top.jsx", "a/b/c.jsx"]);
+    assert!(panel_window(&s, "Motion Kit/Animate.jsx").is_some());
+    assert_eq!(remembered(&store), json!({"open": ["Motion Kit/Animate.jsx"]}));
+}
diff --git a/crates/script/src/tests/render_wait.rs b/crates/script/src/tests/render_wait.rs
new file mode 100644
index 000000000..591bd211a
--- /dev/null
+++ b/crates/script/src/tests/render_wait.rs
@@ -0,0 +1,243 @@
+//! #3289: a native frontend may service the event loop while a script waits for rendering.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::{Duration, Instant};
+
+use effectcraft_engine::project::render_queue::OutputFormat;
+use effectcraft_engine::{ExportJob, ExportResult, Exporter, Session};
+use serde_json::{Value, json};
+
+/// A slow exporter without expensive frames. A bounded wait makes the old blocking path
+/// fail the assertions instead of hanging the test process.
+struct Gate {
+    entered: AtomicUsize,
+    permits: AtomicUsize,
+    failed: bool,
+}
+
+impl Exporter for Gate {
+    fn formats(&self) -> Vec<OutputFormat> {
+        vec![OutputFormat::H264]
+    }
+    fn export(&self, job: &ExportJob, progress: &mut dyn FnMut(u64, u64) -> bool) -> Result<ExportResult, String> {
+        let call = self.entered.fetch_add(1, Ordering::SeqCst) + 1;
+        let end = Instant::now() + Duration::from_secs(2);
+        while self.permits.load(Ordering::SeqCst) < call {
+            if !progress(0, 1) {
+                return Err(effectcraft_engine::render_queue::CANCELLED.into());
+            }
+            if Instant::now() > end {
+                return Err("test exporter timed out waiting for the frontend".into());
+            }
+            std::thread::sleep(Duration::from_millis(1));
+        }
+        if self.failed { Err("test encoder failure".into()) } else { Ok(ExportResult { path: job.path.into(), frames: 1, ..Default::default() }) }
+    }
+}
+
+fn session(permits: usize, failed: bool) -> (Session, Arc<Gate>) {
+    let gate = Arc::new(Gate { entered: AtomicUsize::new(0), permits: AtomicUsize::new(permits), failed });
+    let mut s = super::session();
+    s.exporter = Some(gate.clone());
+    s.execute("comp.new", json!({"name": "Render", "width": 16, "height": 16, "duration": 1})).unwrap();
+    let path = std::env::temp_dir().join(format!("ec-script-render-{}.mp4", std::process::id()));
+    s.execute("renderQueue.add", json!({"output": path.to_string_lossy()})).unwrap();
+    s.prefs.auto_save.enabled = false;
+    (s, gate)
+}
+
+fn finish(s: &mut Session) -> Value {
+    let end = Instant::now() + Duration::from_secs(3);
+    loop {
+        if let Some(result) = crate::ui::poll_render_wait(s) {
+            return result;
+        }
+        assert!(Instant::now() < end, "script did not resume");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+}
+
+#[test]
+fn render_yields_without_finishing_the_script_or_its_undo_group() {
+    let (mut s, gate) = session(0, false);
+    s.script_ui.yield_renders = true;
+    let before = s.history.undo.len();
+    let out = crate::run_code(
+        &mut s,
+        "app.beginUndoGroup('Render transaction'); app.project.activeItem.layers.addNull().name = 'Before'; $.writeln('before'); app.project.renderQueue.render(); app.project.activeItem.layers.addNull().name = 'After'; $.writeln('after'); app.endUndoGroup(); [42, app.project.renderQueue.rendering];",
+        "render.jsx",
+    );
+    assert!(out.error.is_none(), "{out:?}");
+    assert!(out.render_host.is_some(), "blocking render returned instead of yielding: {out:?}");
+    assert!(!out.waiting, "a render suspension is not a modal dialog");
+    assert!(out.output.is_empty(), "output belongs to the eventual reply");
+    assert_eq!(s.active_comp().unwrap().layers.len(), 1, "the continuation has not run");
+    assert!(crate::ui::poll_render_wait(&mut s).is_none());
+    assert!(!s.undo(), "undo cannot discard the suspended script's live edits");
+    assert!(s.execute("engine.batch", json!({"steps": [{"command": "layer.newNull"}]})).is_err());
+    assert!(s.execute("jobs.list", json!({})).is_err(), "status polling must not apply unrelated jobs");
+    // The frontend resets the invocation-only opt-in after script.run returns.
+    s.script_ui.yield_renders = false;
+    gate.permits.store(1, Ordering::SeqCst);
+    let done = finish(&mut s);
+    assert_eq!(done["ok"], true, "{done}");
+    assert_eq!(done["result"], json!([42, false]));
+    assert_eq!(done["output"], "before\nafter");
+    assert_eq!(s.project.render_queue[0].status.label(), "Done");
+    assert_eq!(s.history.undo.len(), before + 1, "one undo group spans the render");
+    assert_eq!(s.history.undo.last().unwrap().0, "Render transaction");
+    assert!(s.script_ui.render_host.is_none());
+    s.undo();
+    assert!(s.active_comp().unwrap().layers.is_empty());
+}
+
+#[test]
+fn a_second_render_keeps_the_same_script_pending() {
+    let (mut s, gate) = session(0, false);
+    s.script_ui.yield_renders = true;
+    let out = crate::run_code(
+        &mut s,
+        "app.project.renderQueue.render(); app.project.renderQueue.item(1).render = true; app.project.renderQueue.render(); 17;",
+        "twice.jsx",
+    );
+    let host = out.render_host.unwrap();
+    s.script_ui.yield_renders = false;
+    gate.permits.store(1, Ordering::SeqCst);
+    let end = Instant::now() + Duration::from_secs(3);
+    while gate.entered.load(Ordering::SeqCst) < 2 {
+        assert!(crate::ui::poll_render_wait(&mut s).is_none(), "no premature reply after the first render");
+        assert!(Instant::now() < end);
+        std::thread::sleep(Duration::from_millis(1));
+    }
+    assert_eq!(s.script_ui.render_host, Some(host));
+    gate.permits.store(2, Ordering::SeqCst);
+    assert_eq!(finish(&mut s)["result"], 17);
+}
+
+#[test]
+fn cancellation_and_encoder_failure_resume_with_terminal_statuses() {
+    for failed in [false, true] {
+        let (mut s, gate) = session(0, failed);
+        s.script_ui.yield_renders = true;
+        let out = crate::run_code(&mut s, "app.project.renderQueue.render(); [9, app.project.renderQueue.rendering];", "stopped.jsx");
+        assert!(out.render_host.is_some());
+        if failed {
+            gate.permits.store(1, Ordering::SeqCst);
+        } else {
+            s.stop_render();
+        }
+        let done = finish(&mut s);
+        assert_eq!(done["ok"], true, "the synchronous command reports status, not a thrown script error: {done}");
+        assert_eq!(done["result"], json!([9, false]));
+        assert_ne!(s.project.render_queue[0].status.label(), "Done");
+    }
+}
+
+#[test]
+fn headless_scripts_still_wait_and_start_errors_do_not_suspend() {
+    let (mut s, _) = session(1, false);
+    let out = crate::run_code(&mut s, "app.project.renderQueue.render(); [7, app.project.renderQueue.rendering];", "headless.jsx");
+    assert!(out.error.is_none(), "{out:?}");
+    assert_eq!(out.result, json!([7, false]));
+    assert!(out.render_host.is_none());
+    assert_eq!(s.project.render_queue[0].status.label(), "Done");
+    s.script_ui.yield_renders = true;
+    let out = crate::run_code(&mut s, "app.project.renderQueue.render();", "empty.jsx");
+    assert!(out.error.is_some());
+    assert!(out.render_host.is_none());
+    assert!(s.script_ui.render_host.is_none());
+}
+
+#[test]
+fn retained_palette_callbacks_can_yield_after_the_original_control_invocation() {
+    let (mut s, gate) = session(0, false);
+    s.script_ui.yield_renders = true;
+    let out = crate::run_code(
+        &mut s,
+        "var w = new Window('palette', 'Render'); var b = w.add('button', undefined, 'Go', {name:'go'}); b.onClick = function () { app.project.renderQueue.render(); $.writeln('resumed'); }; w.show();",
+        "palette-render.jsx",
+    );
+    assert!(out.error.is_none(), "{out:?}");
+    s.script_ui.yield_renders = false;
+    let result = s.execute("scriptui.click", json!({"widget": "go"})).unwrap();
+    assert!(result["renderHost"].is_number(), "{result}");
+    gate.permits.store(1, Ordering::SeqCst);
+    assert_eq!(finish(&mut s)["output"], "resumed");
+    let window = s.script_ui.windows[0].id;
+    s.execute("scriptui.close", json!({"window": window})).unwrap();
+}
+
+#[test]
+fn post_render_actions_complete_before_the_script_resumes() {
+    use effectcraft_engine::project::{Footage, FootageKind};
+    struct Probe;
+    impl effectcraft_engine::Importer for Probe {
+        fn probe(&self, path: &str) -> Result<Footage, String> {
+            Ok(Footage { path: path.into(), kind: FootageKind::Still, width: 16, height: 16, has_video: true, ..Default::default() })
+        }
+    }
+    for action in ["import", "setProxy"] {
+        let (mut s, gate) = session(0, false);
+        s.importer = Some(Arc::new(Probe));
+        let id = s.project.render_queue[0].id;
+        s.execute("renderQueue.setOutputModule", json!({"item": id, "postRenderAction": action})).unwrap();
+        let before = s.project.items.len();
+        let comp = s.active_comp_id().unwrap();
+        s.script_ui.yield_renders = true;
+        let out = crate::run_code(&mut s, "app.project.renderQueue.render(); 29;", "post-render.jsx");
+        assert!(out.render_host.is_some(), "{out:?}");
+        gate.permits.store(1, Ordering::SeqCst);
+        // A query must not consume updates while the edit guard is still active.
+        let end = Instant::now() + Duration::from_secs(3);
+        while s.is_rendering() {
+            assert!(Instant::now() < end);
+            std::thread::sleep(Duration::from_millis(1));
+        }
+        s.execute("renderQueue.list", json!({})).unwrap();
+        assert_eq!(s.project.items.len(), before);
+        assert_eq!(finish(&mut s)["result"], 29);
+        if action == "import" {
+            assert_eq!(s.project.items.len(), before + 1);
+        } else {
+            assert!(s.project.item(comp).unwrap().proxy.is_some());
+        }
+    }
+}
+
+#[test]
+fn deferred_errors_keep_their_included_source_location() {
+    let (mut s, gate) = session(0, false);
+    let dir = std::env::temp_dir().join(format!("ec-render-include-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("render.jsx"), "app.project.renderQueue.render();\nmissingAfterRender();").unwrap();
+    std::fs::write(dir.join("main.jsx"), "#include 'render.jsx'").unwrap();
+    s.script_ui.yield_renders = true;
+    let out = crate::run_code(&mut s, "#include 'render.jsx'", &dir.join("main.jsx").to_string_lossy());
+    assert!(out.render_host.is_some(), "{out:?}");
+    gate.permits.store(1, Ordering::SeqCst);
+    let done = finish(&mut s);
+    assert_eq!(done["ok"], false);
+    assert_eq!(done["error"]["line"], 2);
+    assert!(done["error"]["file"].as_str().unwrap().ends_with("render.jsx"), "{done}");
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn included_error_mapping_survives_a_modal_yield_after_rendering() {
+    let (mut s, gate) = session(0, false);
+    let dir = std::env::temp_dir().join(format!("ec-render-modal-include-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("render.jsx"), "app.project.renderQueue.render();\nvar d = new Window('dialog', 'Continue'); d.add('button', undefined, 'OK', {name:'ok'}); d.show();\nmissingAfterModal();").unwrap();
+    std::fs::write(dir.join("main.jsx"), "#include 'render.jsx'").unwrap();
+    s.script_ui.yield_renders = true;
+    let out = crate::run_code(&mut s, "#include 'render.jsx'", &dir.join("main.jsx").to_string_lossy());
+    assert!(out.render_host.is_some(), "{out:?}");
+    gate.permits.store(1, Ordering::SeqCst);
+    assert_eq!(finish(&mut s)["waiting"], true);
+    let done = s.execute("scriptui.click", json!({"widget": "ok"})).unwrap();
+    assert_eq!(done["ok"], false);
+    assert_eq!(done["error"]["line"], 3);
+    assert!(done["error"]["file"].as_str().unwrap().ends_with("render.jsx"), "{done}");
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/script/src/tests_services.rs b/crates/script/src/tests/services.rs
similarity index 100%
rename from crates/script/src/tests_services.rs
rename to crates/script/src/tests/services.rs
diff --git a/crates/script/src/tests/startup.rs b/crates/script/src/tests/startup.rs
new file mode 100644
index 000000000..67da833c5
--- /dev/null
+++ b/crates/script/src/tests/startup.rs
@@ -0,0 +1,290 @@
+//! Startup and Shutdown scripts, as in After Effects: the scripts in the user's `Scripts/Startup`
+//! and `Scripts/Shutdown` folders (in the settings folder) run in alphabetical order at launch and
+//! as the app quits, after the project is closed.
+
+use std::sync::Arc;
+
+use effectcraft_engine::Session;
+use effectcraft_engine::commands::scripts::{OPEN_PANELS_FILE, PANELS_DIR, SCRIPTS_DIR, SHUTDOWN_DIR, STARTUP_DIR};
+use effectcraft_engine::config::{ConfigStore, MemoryConfig};
+use effectcraft_engine::scriptui::WindowKind;
+use serde_json::json;
+
+fn session(store: &Arc<MemoryConfig>) -> Session {
+    let mut s = Session::default();
+    crate::install(&mut s);
+    s.config = Some(store.clone());
+    s
+}
+
+/// A script that appends `mark` to the `Startup Test` / `order` script setting.
+fn mark(mark: &str) -> String {
+    format!(
+        r#"var k = app.settings.haveSetting("Startup Test", "order") ? app.settings.getSetting("Startup Test", "order") : "";
+app.settings.saveSetting("Startup Test", "order", k + "{mark}");"#
+    )
+}
+
+fn setting(s: &mut Session, key: &str) -> serde_json::Value {
+    s.execute("script.settings.get", json!({"section": "Startup Test", "key": key})).unwrap()["value"].clone()
+}
+
+#[test]
+fn startup_scripts_run_in_alphabetical_order_and_a_failing_one_does_not_stop_the_rest() {
+    let store = Arc::new(MemoryConfig::default());
+    store.write(&format!("{STARTUP_DIR}/b.jsx"), &mark("b")).unwrap();
+    store.write(&format!("{STARTUP_DIR}/A.jsx"), &mark("A")).unwrap();
+    store.write(&format!("{STARTUP_DIR}/B2.jsx"), &mark("B")).unwrap();
+    store.write(&format!("{STARTUP_DIR}/C.js"), "throw new Error('no');").unwrap();
+    store.write(&format!("{STARTUP_DIR}/d.jsx"), &mark("d")).unwrap();
+    // Not scripts, or not in the Startup folder: not run.
+    store.write(&format!("{STARTUP_DIR}/notes.txt"), &mark("x")).unwrap();
+    store.write(&format!("{SCRIPTS_DIR}/Menu Script.jsx"), &mark("m")).unwrap();
+    store.write(&format!("{SHUTDOWN_DIR}/Quit.jsx"), &mark("q")).unwrap();
+    let mut s = session(&store);
+    let r = s.execute("file.runStartupScripts", json!({})).unwrap();
+    assert_eq!(r["ran"], json!(["A.jsx", "b.jsx", "B2.jsx", "d.jsx"]), "{r}");
+    let failed: Vec<&str> = r["failed"].as_array().unwrap().iter().map(|f| f["name"].as_str().unwrap()).collect();
+    assert_eq!(failed, ["C.js"]);
+    assert_eq!(setting(&mut s, "order"), "AbBd");
+    // The failing script is reported in a toast.
+    let events = s.drain_events();
+    assert!(events.iter().any(|e| matches!(e, effectcraft_engine::Event::Toast { message, error: true } if message.starts_with("C.js"))), "{events:?}");
+    // The Startup folder's scripts are not offered in File ▸ Scripts.
+    let list = s.execute("file.scripts.list", json!({})).unwrap();
+    assert!(list.as_array().unwrap().iter().all(|e| e["name"] != "b.jsx"), "{list}");
+}
+
+#[test]
+fn shutdown_scripts_run_after_the_project_is_closed() {
+    let store = Arc::new(MemoryConfig::default());
+    let probe = r#"app.settings.saveSetting("Startup Test", "items", String(app.project.numItems));"#;
+    store.write(&format!("{SHUTDOWN_DIR}/Save State.jsx"), probe).unwrap();
+    let mut s = session(&store);
+    s.execute("script.run", json!({"code": r#"app.project.items.addComp("Main", 64, 64, 1, 1, 24);"#})).unwrap();
+    assert!(!s.project.items.is_empty());
+    let r = s.execute("file.runShutdownScripts", json!({})).unwrap();
+    assert_eq!(r, json!({"ran": ["Save State.jsx"], "waiting": [], "failed": []}));
+    assert_eq!(setting(&mut s, "items"), "0");
+    assert!(s.project.items.is_empty());
+}
+
+#[test]
+fn a_startup_dialog_stays_open_and_its_script_goes_on_when_it_closes() {
+    let store = Arc::new(MemoryConfig::default());
+    store.write(&format!("{STARTUP_DIR}/A Dialog.jsx"), &format!("new Window('dialog', 'Welcome').show();\n{}", mark("A"))).unwrap();
+    store.write(&format!("{STARTUP_DIR}/B.jsx"), &mark("B")).unwrap();
+    let mut s = session(&store);
+    let r = s.execute("file.runStartupScripts", json!({})).unwrap();
+    assert_eq!(r, json!({"ran": ["B.jsx"], "waiting": ["A Dialog.jsx"], "failed": []}));
+    assert_eq!(setting(&mut s, "order"), "B");
+    assert!(s.script_ui.windows.iter().any(|w| w.modal && w.title == "Welcome"));
+    s.execute("scriptui.close", json!({})).unwrap();
+    assert_eq!(setting(&mut s, "order"), "BA");
+}
+
+#[test]
+fn startup_scripts_tasks_go_on_after_a_project_opens() {
+    use web_time::{Duration, Instant};
+    let store = Arc::new(MemoryConfig::default());
+    store.write(&format!("{STARTUP_DIR}/A Poll.jsx"), "app.scheduleTask('writeLn(\"poll\")', 100, true);").unwrap();
+    // A task scheduled after the script's dialog closes.
+    store.write(&format!("{STARTUP_DIR}/B Ask.jsx"), "new Window('dialog', 'Ask').show();\napp.scheduleTask('writeLn(\"ask\")', 100, true);").unwrap();
+    let mut s = session(&store);
+    s.execute("file.runStartupScripts", json!({})).unwrap();
+    s.execute("scriptui.close", json!({})).unwrap();
+    // The launch opens a project after the Startup scripts ran.
+    s.execute("file.closeProject", json!({})).unwrap();
+    let r = crate::tasks::run_tasks_at(&mut s, Instant::now() + Duration::from_millis(500));
+    assert_eq!(r["ran"], json!(2), "{r}");
+    // A script run from File ▸ Scripts still stops when the project closes.
+    s.execute("script.run", json!({"code": "app.scheduleTask('writeLn(\"menu\")', 100, true);", "name": "Menu.jsx"})).unwrap();
+    s.execute("file.closeProject", json!({})).unwrap();
+    let r = crate::tasks::run_tasks_at(&mut s, Instant::now() + Duration::from_millis(5000));
+    assert_eq!(r["ran"], json!(2), "{r}");
+}
+
+#[test]
+fn shutdown_dialogs_close_as_if_canceled() {
+    let store = Arc::new(MemoryConfig::default());
+    let code = r#"var a = new Window("dialog", "One").show();
+var b = new Window("dialog", "Two").show();
+app.settings.saveSetting("Startup Test", "shown", a + "," + b);"#;
+    store.write(&format!("{SHUTDOWN_DIR}/Ask.jsx"), code).unwrap();
+    // An error after the dialog closes is a failure.
+    store.write(&format!("{SHUTDOWN_DIR}/Broken.jsx"), "new Window('dialog', 'Three').show();\nthrow new Error('late');").unwrap();
+    let mut s = session(&store);
+    let r = s.execute("file.runShutdownScripts", json!({})).unwrap();
+    assert_eq!((&r["ran"], &r["waiting"]), (&json!(["Ask.jsx"]), &json!([])), "{r}");
+    assert_eq!(r["failed"][0]["name"], "Broken.jsx", "{r}");
+    assert!(r["failed"][0]["error"].as_str().is_some_and(|e| e.contains("late")), "{r}");
+    assert_eq!(setting(&mut s, "shown"), "2,2");
+    assert!(s.script_ui.windows.is_empty());
+}
+
+#[test]
+fn shutdown_closes_only_its_own_scripts_dialogs() {
+    let store = Arc::new(MemoryConfig::default());
+    store.write(&format!("{STARTUP_DIR}/Same.jsx"), &format!("new Window('dialog', 'Startup').show();\n{}", mark("S"))).unwrap();
+    store.write(&format!("{SHUTDOWN_DIR}/Same.jsx"), &format!("new Window('dialog', 'Shutdown').show();\n{}", mark("Q"))).unwrap();
+    let mut s = session(&store);
+    assert_eq!(s.execute("file.runStartupScripts", json!({})).unwrap()["waiting"], json!(["Same.jsx"]));
+    let r = s.execute("file.runShutdownScripts", json!({})).unwrap();
+    assert_eq!(r, json!({"ran": ["Same.jsx"], "waiting": [], "failed": []}));
+    // The Startup script's dialog is still open, and its script has not gone on.
+    assert_eq!(setting(&mut s, "order"), "Q");
+    let titles: Vec<&str> = s.script_ui.windows.iter().map(|w| w.title.as_str()).collect();
+    assert_eq!(titles, ["Startup"]);
+}
+
+#[test]
+fn oversized_scripts_are_not_run() {
+    let store = Arc::new(MemoryConfig::default());
+    let big = format!("{}\n{}", "//".repeat(8 << 20), mark("x"));
+    store.write(&format!("{STARTUP_DIR}/Big.jsx"), &big).unwrap();
+    let mut s = session(&store);
+    let r = s.execute("file.runStartupScripts", json!({})).unwrap();
+    assert_eq!(r["ran"], json!([]));
+    assert_eq!(r["failed"][0]["name"], "Big.jsx");
+    let events = s.drain_events();
+    assert!(events.iter().any(|e| matches!(e, effectcraft_engine::Event::Toast { message, error: true } if message.starts_with("Big.jsx"))), "{events:?}");
+    assert_eq!(setting(&mut s, "order"), "");
+}
+
+#[test]
+fn scripts_in_a_settings_folder_on_disk_include_files_beside_them() {
+    use effectcraft_engine::config::DirConfig;
+    let root = std::env::temp_dir().join(format!("ec-startup-include-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&root);
+    for (file, code) in [
+        (format!("{STARTUP_DIR}/lib/helper.jsx"), mark("i")),
+        (format!("{STARTUP_DIR}/Main.jsx"), format!("#include \"lib/helper.jsx\"\n{}", mark("m"))),
+        (format!("{SHUTDOWN_DIR}/Ask.jsx"), format!("new Window('dialog', 'Bye').show();\n{}", mark("q"))),
+    ] {
+        let path = root.join(file);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, code).unwrap();
+    }
+    let mut s = Session::default();
+    crate::install(&mut s);
+    s.config = Some(Arc::new(DirConfig::new(&root)));
+    let r = s.execute("file.runStartupScripts", json!({})).unwrap();
+    assert_eq!(r, json!({"ran": ["Main.jsx"], "waiting": [], "failed": []}));
+    assert_eq!(setting(&mut s, "order"), "im");
+    // A Shutdown script run as its file still has its dialog closed.
+    let r = s.execute("file.runShutdownScripts", json!({})).unwrap();
+    assert_eq!(r, json!({"ran": ["Ask.jsx"], "waiting": [], "failed": []}));
+    assert_eq!(setting(&mut s, "order"), "imq");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// A session with one comp, for checking that a refused command leaves the project open.
+fn session_with_comp(store: &Arc<MemoryConfig>) -> Session {
+    let mut s = session(store);
+    s.execute("script.run", json!({"code": r#"app.project.items.addComp("Main", 64, 64, 1, 1, 24);"#})).unwrap();
+    assert!(!s.project.items.is_empty());
+    s
+}
+
+const FOLDER_COMMANDS: [&str; 2] = ["file.runStartupScripts", "file.runShutdownScripts"];
+
+#[test]
+fn scripts_cannot_run_the_startup_or_shutdown_folders() {
+    let store = Arc::new(MemoryConfig::default());
+    for id in FOLDER_COMMANDS {
+        let mut s = session_with_comp(&store);
+        let r = s.execute("script.run", json!({"code": format!("app.run('{id}', {{}})")})).unwrap();
+        assert!(r["error"]["message"].as_str().is_some_and(|m| m.contains("scripts can't run scripts")), "{id}: {r}");
+        assert!(!s.project.items.is_empty(), "{id}");
+    }
+}
+
+#[test]
+fn command_scripts_cannot_run_the_startup_or_shutdown_folders() {
+    let store = Arc::new(MemoryConfig::default());
+    for id in FOLDER_COMMANDS {
+        let mut s = session_with_comp(&store);
+        let e = s.execute("file.runScript", json!({"steps": [{"command": id}]})).unwrap_err().to_string();
+        assert!(e.contains("scripts can't run scripts"), "{id}: {e}");
+        assert!(!s.project.items.is_empty(), "{id}");
+    }
+}
+
+#[test]
+fn batches_cannot_run_the_startup_or_shutdown_folders() {
+    let store = Arc::new(MemoryConfig::default());
+    for id in FOLDER_COMMANDS {
+        let mut s = session_with_comp(&store);
+        let e = s.execute("engine.batch", json!({"steps": [{"command": id}]})).unwrap_err().to_string();
+        assert!(e.contains("can't run inside a batch"), "{id}: {e}");
+        assert!(!s.project.items.is_empty(), "{id}");
+    }
+}
+
+/// A ScriptUI panel whose script appends `p` to the `Startup Test` / `order` setting each time it
+/// runs, remembered as open at the last quit.
+fn session_with_panel(store: &Arc<MemoryConfig>) -> Session {
+    store.write(&format!("{PANELS_DIR}/Mark Panel.jsx"), &format!("this.add('statictext', undefined, 'Mark');\n{}", mark("p"))).unwrap();
+    store.write(OPEN_PANELS_FILE, &json!({"open": ["Mark Panel.jsx"]}).to_string()).unwrap();
+    session(store)
+}
+
+fn panel_open(s: &Session) -> bool {
+    s.script_ui.windows.iter().any(|w| w.kind == WindowKind::Panel && w.script == "Mark Panel.jsx")
+}
+
+/// The commands that open ScriptUI panels, which run the panel's script.
+fn panel_commands() -> [(&'static str, serde_json::Value); 2] {
+    [("window.scriptPanel", json!({"name": "Mark Panel.jsx"})), ("window.restoreScriptPanels", json!({}))]
+}
+
+#[test]
+fn scripts_cannot_open_script_panels() {
+    for (id, params) in panel_commands() {
+        let store = Arc::new(MemoryConfig::default());
+        let mut s = session_with_panel(&store);
+        // Opened by the user: a script's call would only bring it forward.
+        s.execute("window.scriptPanel", json!({"name": "Mark Panel.jsx"})).unwrap();
+        let r = s.execute("script.run", json!({"code": format!("app.run('{id}', {params})")})).unwrap();
+        assert!(r["error"]["message"].as_str().is_some_and(|m| m.contains("scripts can't run scripts")), "{id}: {r}");
+        assert_eq!(setting(&mut s, "order"), "p", "{id}");
+        assert_eq!(store.read(OPEN_PANELS_FILE).unwrap_or_default(), json!({"open": ["Mark Panel.jsx"]}).to_string(), "{id}");
+    }
+}
+
+#[test]
+fn command_scripts_and_batches_cannot_open_script_panels() {
+    for (id, params) in panel_commands() {
+        let store = Arc::new(MemoryConfig::default());
+        let mut s = session_with_panel(&store);
+        let e = s.execute("file.runScript", json!({"steps": [{"command": id, "params": params}]})).unwrap_err().to_string();
+        assert!(e.contains("scripts can't run scripts"), "{id}: {e}");
+        let e = s.execute("engine.batch", json!({"steps": [{"command": id, "params": params}]})).unwrap_err().to_string();
+        assert!(e.contains("can't run inside a batch"), "{id}: {e}");
+        assert!(!panel_open(&s), "{id}");
+        assert_eq!(setting(&mut s, "order"), "", "{id}");
+    }
+}
+
+#[test]
+fn the_app_still_reopens_script_panels_at_launch() {
+    let store = Arc::new(MemoryConfig::default());
+    let mut s = session_with_panel(&store);
+    // As the desktop and web apps call it at launch.
+    let r = s.execute("window.restoreScriptPanels", json!({})).unwrap();
+    assert_eq!(r, json!({"opened": ["Mark Panel.jsx"], "failed": []}));
+    assert!(panel_open(&s));
+    assert_eq!(setting(&mut s, "order"), "p");
+}
+
+#[test]
+fn empty_or_missing_folders_run_nothing() {
+    let none = json!({"ran": [], "waiting": [], "failed": []});
+    let store = Arc::new(MemoryConfig::default());
+    let mut s = session(&store);
+    assert_eq!(s.execute("file.runStartupScripts", json!({})).unwrap(), none);
+    // A session without a settings folder.
+    let mut s = Session::default();
+    crate::install(&mut s);
+    assert_eq!(s.execute("file.runShutdownScripts", json!({})).unwrap(), none);
+}
diff --git a/crates/script/src/tests_tasks.rs b/crates/script/src/tests/tasks.rs
similarity index 100%
rename from crates/script/src/tests_tasks.rs
rename to crates/script/src/tests/tasks.rs
diff --git a/crates/script/src/tests_ui.rs b/crates/script/src/tests/ui.rs
similarity index 100%
rename from crates/script/src/tests_ui.rs
rename to crates/script/src/tests/ui.rs
diff --git a/crates/script/src/tests_ui_more.rs b/crates/script/src/tests/ui_more.rs
similarity index 98%
rename from crates/script/src/tests_ui_more.rs
rename to crates/script/src/tests/ui_more.rs
index 228a58016..c15aee0ae 100644
--- a/crates/script/src/tests_ui_more.rs
+++ b/crates/script/src/tests/ui_more.rs
@@ -222,7 +222,17 @@ fn position_now(s: &Session, layer: u64) -> [f64; 2] {
     let cid = s.active_comp_id().unwrap();
     let comp = s.project.comp(cid).unwrap();
     let l = comp.layer(effectcraft_engine::project::LayerId(layer)).unwrap();
-    let ctx = effectcraft_engine::render::EvalCtx { project: &s.project, comp_id: cid, comp, time: s.time(), expr: s.expr.as_deref(), footage: None };
+    let ctx = effectcraft_engine::render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: s.time(),
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     let v = ctx.value(l, l.props.prop("transform/position").unwrap()).components();
     [v[0], v[1]]
 }
diff --git a/crates/script/src/tests_ui_mouse.rs b/crates/script/src/tests/ui_mouse.rs
similarity index 100%
rename from crates/script/src/tests_ui_mouse.rs
rename to crates/script/src/tests/ui_mouse.rs
diff --git a/crates/script/src/ui.rs b/crates/script/src/ui.rs
index 082a16cac..ecf4cd28b 100644
--- a/crates/script/src/ui.rs
+++ b/crates/script/src/ui.rs
@@ -3,7 +3,8 @@
 //!
 //! * **Script files** (native builds) run on a *script-host thread*. The caller's session moves
 //!   to that thread while JavaScript runs and comes back whenever the script stops: at the end,
-//!   or while a modal dialog waits in `show()`. Each [`ScriptUiEvent`] moves the session there
+//!   while a modal dialog waits in `show()`, or while an opted-in frontend waits for rendering.
+//!   Each [`ScriptUiEvent`] moves the session there
 //!   again, runs the handler, and brings it back with the windows' new state. The host ends
 //!   when its last window closes. Only one side holds the session at a time, so nothing runs
 //!   concurrently and every edit is still an ordinary undoable engine command.
@@ -137,6 +138,8 @@ pub(crate) enum ToHost {
     /// script-host threads).
     #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
     Tick(Session, Instant),
+    /// Resume the suspended native render call, never a callback or scheduled task.
+    ResumeRender(Session),
 }
 
 impl ToHost {
@@ -145,7 +148,7 @@ impl ToHost {
         match self {
             #[cfg(not(target_arch = "wasm32"))]
             ToHost::Start(s) => s,
-            ToHost::Event(s, _) | ToHost::Tick(s, _) => s,
+            ToHost::Event(s, _) | ToHost::Tick(s, _) | ToHost::ResumeRender(s) => s,
         }
     }
 }
@@ -159,6 +162,7 @@ pub(crate) struct FromHost {
     done: bool,
     /// When its next scheduled task is due.
     next_due: Option<Instant>,
+    render_wait: bool,
 }
 
 /// The host thread's end of the hand-off.
@@ -177,6 +181,8 @@ struct HostEnd {
     /// [`effectcraft_engine::scriptui::ScriptUi::project_epoch`] when the host last ran.
     #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
     epoch: u64,
+    /// Retained across render yields so a later error still names its included source file.
+    source_map: Option<crate::include::Expanded>,
 }
 
 fn hosts() -> &'static std::sync::Mutex<BTreeMap<u32, HostEnd>> {
@@ -195,6 +201,7 @@ enum Wake {
     Event(ScriptUiEvent),
     #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
     Tick(Instant),
+    Render,
 }
 
 /// On the host thread: hand the session (with the windows' state and what the script printed)
@@ -206,18 +213,20 @@ fn yield_wait(outcome: crate::Outcome, windows: Vec<ScriptWindow>, done: bool) -
         match yield_wake(out, windows.clone(), done, None)? {
             Wake::Event(ev) => return Some(ev),
             Wake::Tick(_) => out = crate::Outcome { waiting: true, ..Default::default() },
+            Wake::Render => return None,
         }
     }
 }
 
 /// [`yield_wait`] that also wakes for the scheduled tasks due at `next_due`.
 fn yield_wake(outcome: crate::Outcome, windows: Vec<ScriptWindow>, done: bool, next_due: Option<Instant>) -> Option<Wake> {
+    let render_wait = outcome.render_host.is_some();
     let (session, link, name) = ACTIVE.with(|a| {
         let mut a = a.borrow_mut();
         let a = a.as_mut()?;
         Some((std::mem::take(&mut a.session), a.link.take()?, a.name.clone()))
     })?;
-    if link.tx.send(FromHost { session, outcome, windows, name, done, next_due }).is_err() {
+    if link.tx.send(FromHost { session, outcome, windows, name, done, next_due, render_wait }).is_err() {
         return None;
     }
     if done {
@@ -226,6 +235,7 @@ fn yield_wake(outcome: crate::Outcome, windows: Vec<ScriptWindow>, done: bool, n
     let (s, wake) = match link.rx.recv() {
         Ok(ToHost::Event(s, ev)) => (s, Wake::Event(ev)),
         Ok(ToHost::Tick(s, now)) => (s, Wake::Tick(now)),
+        Ok(ToHost::ResumeRender(s)) => (s, Wake::Render),
         _ => return None,
     };
     ACTIVE.with(|a| {
@@ -269,8 +279,9 @@ fn host_main(host: u32, name: String, code: String, link: Link) {
                 }
                 Some(Wake::Tick(now)) => {
                     let (ran, error) = crate::tasks::run_due(&mut ctx, host, now);
-                    out = crate::Outcome { result: json!(ran), output: settle(), error, waiting: false };
+                    out = crate::Outcome { result: json!(ran), output: settle(), error, ..Default::default() };
                 }
+                Some(Wake::Render) => break,
                 None => break,
             }
         }
@@ -283,15 +294,30 @@ fn host_main(host: u32, name: String, code: String, link: Link) {
     {
         let message = if body.is_err() { "the script engine stopped unexpectedly" } else { "the script ended" };
         let out = crate::Outcome { error: Some(ScriptError { message: message.into(), file, ..Default::default() }), ..Default::default() };
-        let _ = link.tx.send(FromHost { session: std::mem::take(&mut a.session), outcome: out, windows: vec![], name, done: true, next_due: None });
+        let _ = link.tx.send(FromHost {
+            session: std::mem::take(&mut a.session),
+            outcome: out,
+            windows: vec![],
+            name,
+            done: true,
+            next_due: None,
+            render_wait: false,
+        });
     }
 }
 
 /// Wait for the host to hand the session back; keep its link while it has windows open.
 fn receive(session: &mut Session, host: u32, end: HostEnd) -> crate::Outcome {
     match end.rx.recv() {
-        Ok(FromHost { session: s, outcome, windows, name, done, next_due }) => {
+        Ok(FromHost { session: s, mut outcome, windows, name, done, next_due, render_wait }) => {
             *session = s;
+            session.script_ui.render_host = render_wait.then_some(host);
+            if !render_wait
+                && let Some(map) = &end.source_map
+                && let Some(error) = &mut outcome.error
+            {
+                map.locate(error);
+            }
             publish(session, host, &name, windows);
             if done {
                 session.script_ui.windows.retain(|w| w.host != host);
@@ -324,7 +350,61 @@ pub(crate) fn run_threaded(session: &mut Session, req: &effectcraft_engine::Scri
         *session = msg.into_session();
         return crate::Outcome { error: Some(ScriptError { message: "the script host did not start".into(), ..Default::default() }), ..Default::default() };
     }
-    receive(session, host, HostEnd { tx: to_tx, rx: from_rx, next_due: None, epoch: 0 })
+    receive(session, host, HostEnd { tx: to_tx, rx: from_rx, next_due: None, epoch: 0, source_map: None })
+}
+
+/// Suspend only the JavaScript stack, not the window's event loop (#3289). Keep the output
+/// and open undo groups in `Active`: settling here would split the script's undo transaction.
+pub(crate) fn wait_for_render(ctx: &mut Context, mut result: J) -> Result<J, String> {
+    let host = with_active(|a| Ok(a.host))?;
+    let windows = snapshot(ctx);
+    let out = crate::Outcome { render_host: Some(host), ..Default::default() };
+    if !matches!(yield_wake(out, windows, false, None), Some(Wake::Render)) {
+        return Err("the frontend stopped waiting for the script's render".into());
+    }
+    with_active(|a| {
+        let list = a.session.execute_for_script("renderQueue.list", json!({})).map_err(|e| e.to_string())?;
+        let ids: Vec<J> = result["items"].as_array().into_iter().flatten().map(|i| i["id"].clone()).collect();
+        result["items"] = json!(list["items"].as_array().into_iter().flatten().filter(|i| ids.contains(&i["id"])).collect::<Vec<_>>());
+        result["rendering"] = list["rendering"].clone();
+        Ok(result)
+    })
+}
+
+pub(crate) fn keep_render_source_map(host: u32, map: crate::include::Expanded) {
+    if let Ok(mut h) = hosts().lock()
+        && let Some(end) = h.get_mut(&host)
+    {
+        end.source_map = Some(map);
+    }
+}
+
+/// Called by the native frontend while its normal editing/callback tick is paused. Polling
+/// applies terminal statuses and post-render actions before the suspended JS call returns.
+pub(crate) fn poll_render_wait(session: &mut Session) -> Option<J> {
+    let host = session.script_ui.render_host?;
+    // Only this completion boundary may apply the render's own import/proxy undo steps.
+    session.script_ui.render_host = None;
+    session.poll_render();
+    if session.is_rendering() {
+        session.script_ui.render_host = Some(host);
+        return None;
+    }
+    session.script_ui.render_host = None;
+    let fail = |message: &str| crate::Outcome { error: Some(ScriptError { message: message.into(), ..Default::default() }), ..Default::default() }.to_json();
+    let Some(end) = hosts().lock().ok().and_then(|mut h| h.remove(&host)) else {
+        return Some(fail("the script host stopped while rendering"));
+    };
+    if end.epoch != session.script_ui.project_epoch {
+        return Some(fail("the project changed while the script was rendering"));
+    }
+    if let Err(std::sync::mpsc::SendError(msg)) = end.tx.send(ToHost::ResumeRender(std::mem::take(session))) {
+        *session = msg.into_session();
+        return Some(fail("the script host stopped while rendering"));
+    }
+    let out = receive(session, host, end);
+    // A second render in this invocation keeps the original control reply pending.
+    out.render_host.is_none().then(|| out.to_json())
 }
 
 /// Record the windows a host published (named after the script that made them).
@@ -404,8 +484,14 @@ fn dispatch_inline(session: &mut Session, host: u32, name: &str, ev: &ScriptUiEv
 
 // ---------------------------------------------------------------- scheduled tasks
 
+/// Whether `host`'s tasks stop now that the project it ran with was closed: it has no window
+/// open and is not a Startup script's.
+fn ends_with_project(session: &Session, host: u32) -> bool {
+    !session.script_ui.windows.iter().any(|w| w.host == host) && !session.script_ui.startup_hosts.contains(&host)
+}
+
 /// Run the due tasks of the script-host threads; hosts without windows whose project was closed
-/// end.
+/// end, except Startup scripts' hosts.
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn tick_threaded(session: &mut Session, now: Instant, report: &mut crate::tasks::Report) {
     let epoch = session.script_ui.project_epoch;
@@ -413,8 +499,7 @@ pub(crate) fn tick_threaded(session: &mut Session, now: Instant, report: &mut cr
     if let Ok(mut h) = hosts().lock() {
         for host in session.script_ui.task_hosts.clone() {
             let Some(end) = h.get(&host) else { continue };
-            let windowless = !session.script_ui.windows.iter().any(|w| w.host == host);
-            if windowless && end.epoch != epoch {
+            if end.epoch != epoch && ends_with_project(session, host) {
                 // Dropping its end lets the host thread finish.
                 stale.extend(h.remove(&host));
             } else if end.next_due.is_some_and(|d| d <= now) {
@@ -424,6 +509,9 @@ pub(crate) fn tick_threaded(session: &mut Session, now: Instant, report: &mut cr
     }
     drop(stale);
     for host in due {
+        if session.script_ui.render_host.is_some() {
+            break;
+        }
         let Some(end) = hosts().lock().ok().and_then(|mut h| h.remove(&host)) else { continue };
         if let Err(std::sync::mpsc::SendError(msg)) = end.tx.send(ToHost::Tick(std::mem::take(session), now)) {
             *session = msg.into_session();
@@ -441,7 +529,7 @@ pub(crate) fn tick_threaded(session: &mut Session, now: Instant, report: &mut cr
 }
 
 /// Run the due tasks of the inline hosts on this thread (the Script Console, web runs); those
-/// without windows whose project was closed stop.
+/// without windows whose project was closed stop, except Startup scripts' hosts.
 pub(crate) fn tick_inline(session: &mut Session, now: Instant, report: &mut crate::tasks::Report) {
     for (host, name, epoch) in crate::tasks::hosts() {
         if !session.script_ui.task_hosts.contains(&host) {
@@ -449,7 +537,7 @@ pub(crate) fn tick_inline(session: &mut Session, now: Instant, report: &mut crat
         }
         let windowless = !session.script_ui.windows.iter().any(|w| w.host == host);
         let alive = host == CONSOLE_HOST || INLINE.with(|m| m.borrow().contains_key(&host));
-        if !alive || (windowless && epoch != session.script_ui.project_epoch) {
+        if !alive || (epoch != session.script_ui.project_epoch && ends_with_project(session, host)) {
             crate::tasks::drop_host(host);
             if host != CONSOLE_HOST && windowless {
                 drop_inline(host);
@@ -485,7 +573,7 @@ fn tick_inline_host(session: &mut Session, host: u32, name: &str, now: Instant)
     drop(guard);
     crate::tasks::set_epoch(host, session.script_ui.project_epoch);
     publish(session, host, name, windows);
-    crate::Outcome { result: json!(ran), output, error, waiting: false }
+    crate::Outcome { result: json!(ran), output, error, ..Default::default() }
 }
 
 /// Forget the session's task hosts that have ended (inline ones: that have no tasks left).
diff --git a/crates/script/tests/fixtures/ae-effect-match-names.tsv b/crates/script/tests/fixtures/ae-effect-match-names.tsv
new file mode 100644
index 000000000..341d82541
--- /dev/null
+++ b/crates/script/tests/fixtures/ae-effect-match-names.tsv
@@ -0,0 +1,343 @@
+# After Effects 26.2 app.effects: match name<TAB>category, first-party names only (ADBE, APC, VISINF).
+# Names only, read back from the running application (#3113). Categories "Obsolete"/"_Obsolete" are hidden legacy versions. "-" = no category.
+ADBE 3D Glasses	_Obsolete
+ADBE 3D Glasses2	Perspective
+ADBE 3D Tracker	Perspective
+ADBE 4ColorGradient	Generate
+ADBE AIF Perlin Noise 3D	Noise & Grain
+ADBE ATG Extract	Keying
+ADBE AUX CHANNEL EXTRACT	3D Channel
+ADBE Alpha Levels2	_Obsolete
+ADBE Alpha Levels3	_Obsolete
+ADBE Angle Control	Expression Controls
+ADBE Apply Color LUT	_Obsolete
+ADBE Apply Color LUT2	Utility
+ADBE Arithmetic	Channel
+ADBE Aud BT	Audio
+ADBE Aud Compressor	Audio
+ADBE Aud Delay	Audio
+ADBE Aud Distortion	Audio
+ADBE Aud Gate	Audio
+ADBE Aud HiLo	Audio
+ADBE Aud Modulator	Audio
+ADBE Aud Reverb	Audio
+ADBE Aud Reverse	Audio
+ADBE Aud Stereo Mixer	Audio
+ADBE Aud Tone	Audio
+ADBE AudSpect	Generate
+ADBE AudWave	Generate
+ADBE Aud_Flange	Audio
+ADBE AutoColor	Color Correction
+ADBE AutoContrast	Color Correction
+ADBE AutoLevels	Color Correction
+ADBE BEZMESH	Distort
+ADBE Basic 3D	Obsolete
+ADBE Basic Text2	Obsolete
+ADBE Bevel Alpha	Perspective
+ADBE Bevel Edges	Perspective
+ADBE Bilateral	Blur & Sharpen
+ADBE Black&White	Color Correction
+ADBE Blend	Channel
+ADBE Block Dissolve	Transition
+ADBE Box Blur	_Obsolete
+ADBE Box Blur2	Blur & Sharpen
+ADBE Brightness & Contrast	_Obsolete
+ADBE Brightness & Contrast 2	Color Correction
+ADBE Broadcast Colors	Color Correction
+ADBE Brush Strokes	Stylize
+ADBE Bulge	Distort
+ADBE CHANNEL MIXER	Color Correction
+ADBE CM Animated Shape 2	-
+ADBE CM Animated Shape 3	-
+ADBE CM Animated Shape Control	-
+ADBE CM AutoscrollHorizontal	-
+ADBE CM AutoscrollVertical	-
+ADBE CM CornerReveal	-
+ADBE CM CrackedTiles	-
+ADBE CM CropEdges	-
+ADBE CM DissolveUnmelt	-
+ADBE CM FadeInOutFrames	-
+ADBE CM FadeInOutmsec	-
+ADBE CM FlyToInset	-
+ADBE CM GridWipe	-
+ADBE CM InsetVideoFramed	-
+ADBE CM InsetVideoTorn	-
+ADBE CM LightLeaksMarkers	-
+ADBE CM LightLeaksRandom	-
+ADBE CM MoodLightAmorph	-
+ADBE CM MoodLightDigital	-
+ADBE CM MoodLightStreaks	-
+ADBE CM OpacityFlashMarkers	-
+ADBE CM OpacityFlashRandom	-
+ADBE CM ScaleBounceMarkers	-
+ADBE CM ScaleBounceRandom	-
+ADBE CM SlideVariable	-
+ADBE CM Spin	-
+ADBE CM Throw	-
+ADBE CM TransCard	-
+ADBE CM TransComplete	-
+ADBE CM TransCorner	-
+ADBE CM TransDirection	-
+ADBE CM TransDissolve	-
+ADBE CM TransFade	-
+ADBE CM TransFadeMask	-
+ADBE CM TransIris	-
+ADBE CM TransRadial	-
+ADBE CM TransSlide	-
+ADBE CM TransStretch	-
+ADBE CM TransWipe	-
+ADBE CM TransWipeFeath	-
+ADBE CM WiggleGelatin	-
+ADBE CM WigglePosition	-
+ADBE CM WiggleRotation	-
+ADBE CM WiggleScale	-
+ADBE CM WiggleShear	-
+ADBE CM Wigglerama	-
+ADBE CM Zoom2DSpin	-
+ADBE CM Zoom3DTumble	-
+ADBE CM ZoomBubble	-
+ADBE CM ZoomSpiral	-
+ADBE CM ZoomWobble	-
+ADBE Calculations	Channel
+ADBE Camera Lens Blur	Blur & Sharpen
+ADBE CameraShakeDeblur	Blur & Sharpen
+ADBE Cartoonify	Stylize
+ADBE Cell Pattern	Generate
+ADBE Change Color	Color Correction
+ADBE Change To Color	Color Correction
+ADBE Channel Blur	Blur & Sharpen
+ADBE Channel Combiner	Channel
+ADBE Checkbox Control	Expression Controls
+ADBE Checkerboard	Generate
+ADBE Cineon Converter	_Obsolete
+ADBE Cineon Converter2	Utility
+ADBE Circle	Generate
+ADBE Color Balance	_Obsolete
+ADBE Color Balance (HLS)	Color Correction
+ADBE Color Balance 2	Color Correction
+ADBE Color Control	Expression Controls
+ADBE Color Difference Key	Keying
+ADBE Color Emboss	Stylize
+ADBE Color Key	Obsolete
+ADBE Color Link	Color Correction
+ADBE Color Range	Keying
+ADBE Color Swirl	-
+ADBE Compander	Utility
+ADBE Compound Arithmetic	Channel
+ADBE Compound Blur	Blur & Sharpen
+ADBE Corner Pin	Distort
+ADBE CurvesCustom	Color Correction
+ADBE DE Bounce	-
+ADBE DE Bounce At Marker	-
+ADBE DE Bounce On Beat	-
+ADBE DE Bounce Random	-
+ADBE DE Follow	-
+ADBE DE Jiggle	-
+ADBE DE Jiggle At Marker	-
+ADBE DE Jiggle On Beat	-
+ADBE DE Jiggle Random	-
+ADBE DE Opacity Pulse	-
+ADBE DE Opacity Pulse At Marker	-
+ADBE DE Opacity Pulse On Beat	-
+ADBE DE Opacity Pulse Random	-
+ADBE DE Orbit	-
+ADBE DE Orbit 3D	-
+ADBE DE Oscillate	-
+ADBE DE Oscillate At Marker	-
+ADBE DE Oscillate On Beat	-
+ADBE DE Oscillate Random	-
+ADBE DE Pendulum	-
+ADBE DE Pendulum At Marker	-
+ADBE DE Pendulum On Beat	-
+ADBE DE Pendulum Random	-
+ADBE DE Pulse	-
+ADBE DE Pulse At Marker	-
+ADBE DE Pulse On Beat	-
+ADBE DE Pulse Random	-
+ADBE DE Random Fill Color	-
+ADBE DE Random Motion	-
+ADBE DE Random Motion 1D	-
+ADBE DE Random Opacity	-
+ADBE DE Random Rotation	-
+ADBE DE Random Rotation 3D	-
+ADBE DE Random Scale	-
+ADBE DE Swarm	-
+ADBE DE Wobble Bounce	-
+ADBE DE Wobble Bounce At Marker	-
+ADBE DE Wobble Bounce On Beat	-
+ADBE DE Wobble Bounce Random	-
+ADBE DE Z Spring	-
+ADBE DE Z Spring At Marker	-
+ADBE DEPTH FIELD	3D Channel
+ADBE DEPTH MATTE	3D Channel
+ADBE Deflicker	Color Correction
+ADBE Difference	Time
+ADBE Difference Matte2	Keying
+ADBE DigitalVideoLimiter	Color Correction
+ADBE Displacement Map	Distort
+ADBE Drop Shadow	Perspective
+ADBE Dropdown Control	Expression Controls
+ADBE Dust & Scratches	Noise & Grain
+ADBE ELLIPSE	Generate
+ADBE Easy Levels	_Obsolete
+ADBE Easy Levels2	Color Correction
+ADBE Echo	Time
+ADBE Emboss	Stylize
+ADBE Equalize	Color Correction
+ADBE Exposure	_Obsolete
+ADBE Exposure2	Color Correction
+ADBE Extract	Keying
+ADBE Eyedropper Fill	Generate
+ADBE FOG_3D	3D Channel
+ADBE Fast Blur	_Obsolete
+ADBE Fill	Generate
+ADBE Find Edges	Stylize
+ADBE Fractal	Generate
+ADBE Fractal Noise	Noise & Grain
+ADBE FreePin3	_Obsolete
+ADBE GROW BOUNDS	Utility
+ADBE Gamma/Pedestal/Gain2	Color Correction
+ADBE Gaussian Blur	Obsolete
+ADBE Gaussian Blur 2	Blur & Sharpen
+ADBE Geometry	_Obsolete
+ADBE Geometry2	Distort
+ADBE Getting Jiggy	-
+ADBE Glo2	Stylize
+ADBE Gradient Wipe	Transition
+ADBE Grid	Generate
+ADBE HDR ToneMap	Utility
+ADBE HUE SATURATION	Color Correction
+ADBE ID MATTE	3D Channel
+ADBE IRIS_WIPE	Transition
+ADBE Invert	Channel
+ADBE KeyCleaner	Keying
+ADBE LIQUIFY	Distort
+ADBE Laser	Generate
+ADBE Layer Control	Expression Controls
+ADBE Leave Color	Color Correction
+ADBE Lens Flare	Generate
+ADBE Lightning	Obsolete
+ADBE Lightning 2	Generate
+ADBE Linear Color Key2	Keying
+ADBE Linear Wipe	Transition
+ADBE Luma Key	Obsolete
+ADBE Lumetri	Color Correction
+ADBE MESH WARP	Distort
+ADBE Magnify	Distort
+ADBE Matte Choker	Matte
+ADBE Median	Noise & Grain
+ADBE Minimax	Channel
+ADBE Mirror	Distort
+ADBE Mosaic	Stylize
+ADBE Motion Blur	Blur & Sharpen
+ADBE Noise	_Obsolete
+ADBE Noise Alpha	_Obsolete
+ADBE Noise Alpha2	Noise & Grain
+ADBE Noise HLS	_Obsolete
+ADBE Noise HLS Auto	_Obsolete
+ADBE Noise HLS Auto2	Noise & Grain
+ADBE Noise HLS2	Noise & Grain
+ADBE Noise2	Noise & Grain
+ADBE Numbers2	Text
+ADBE OCIO CDL Transform	Color Correction
+ADBE OCIO Color Space Transform	Color Correction
+ADBE OCIO Display Transform	Color Correction
+ADBE OCIO FILE Transform	Color Correction
+ADBE OCIO Look Transform	Color Correction
+ADBE OFMotionBlur	Time
+ADBE Offset	Distort
+ADBE Optics Compensation	Distort
+ADBE PS Arbitrary Map	Color Correction
+ADBE PS Median	Noise & Grain
+ADBE PSL Bevel Emboss	_Obsolete
+ADBE PSL Drop Shadow	_Obsolete
+ADBE PSL Inner Glow	_Obsolete
+ADBE PSL Inner Shadow	_Obsolete
+ADBE PSL Outer Glow	_Obsolete
+ADBE PSL Solid Fill	_Obsolete
+ADBE Paint	_Obsolete
+ADBE Paint Bucket	Generate
+ADBE Param EQ	Audio
+ADBE Path Text	Obsolete
+ADBE Photo Filter	_Obsolete
+ADBE PhotoFilterPS	Color Correction
+ADBE Playgnd	Simulation
+ADBE Point Control	Expression Controls
+ADBE Point3D Control	Expression Controls
+ADBE Polar Coordinates	Distort
+ADBE Posterize	Stylize
+ADBE Posterize Time	Time
+ADBE Pro Levels	_Obsolete
+ADBE Pro Levels2	Color Correction
+ADBE ProfileToProfile	Utility
+ADBE RESHAPE	Distort
+ADBE Radial Blur	Blur & Sharpen
+ADBE Radial Shadow	Perspective
+ADBE Radial Wipe	Transition
+ADBE Ramp	Generate
+ADBE Reduce Interlace Flicker	Obsolete
+ADBE RefineMatte	_Obsolete
+ADBE RefineMatte2	Matte
+ADBE RefineRBMatte	Matte
+ADBE Remove Color Matting	Channel
+ADBE Ripple	Distort
+ADBE Rolling Shutter	Distort
+ADBE Roughen Edges	Stylize
+ADBE SCHMEAR	Distort
+ADBE Sample Image	-
+ADBE Samurai	_Obsolete
+ADBE Scatter	Stylize
+ADBE Scribble Fill	Generate
+ADBE SelectiveColor	Color Correction
+ADBE Separate XYZ Position	-
+ADBE Separate XYZ Scale	-
+ADBE Set Channels	Channel
+ADBE Set Matte2	_Obsolete
+ADBE Set Matte3	Channel
+ADBE ShadowHighlight	Color Correction
+ADBE Sharpen	Blur & Sharpen
+ADBE Shift Channels	Channel
+ADBE Simple Choker	Matte
+ADBE Slider Control	Expression Controls
+ADBE Smart Blur	Blur & Sharpen
+ADBE Solid Composite	Channel
+ADBE Spherize	Distort
+ADBE Spill Suppressor	Obsolete
+ADBE Spill2	Keying
+ADBE Stereo 3D Controls	-
+ADBE Strobe	Stylize
+ADBE Stroke	Generate
+ADBE SubspaceStabilizer	Distort
+ADBE Texturize	Stylize
+ADBE Three-Way Color Corrector	_Obsolete
+ADBE Threshold	_Obsolete
+ADBE Threshold2	Stylize
+ADBE Tile	Stylize
+ADBE Time Displacement	Time
+ADBE Timecode	Text
+ADBE Timewarp	Time
+ADBE Tint	Color Correction
+ADBE Tritone	Color Correction
+ADBE Turbulent Displace	Distort
+ADBE Twirl	Distort
+ADBE Unmult	Keying
+ADBE Unsharp Mask	_Obsolete
+ADBE Unsharp Mask2	Blur & Sharpen
+ADBE Upscale	Distort
+ADBE Venetian Blinds	Transition
+ADBE Vibrance	Color Correction
+ADBE WRPMESH	Distort
+ADBE Wave Warp	Distort
+ADBE Write-on	Generate
+APC CardDanceCam	Simulation
+APC CardWipeCam	Transition
+APC Caustics	Simulation
+APC Colorama	Color Correction
+APC Foam	Simulation
+APC Radio Waves	Generate
+APC Shatter	Simulation
+APC Vegas	Generate
+APC Wave World	Simulation
+VISINF Grain Duplication	Noise & Grain
+VISINF Grain Implant	Noise & Grain
+VISINF Grain Removal	Noise & Grain
diff --git a/crates/segment/Cargo.toml b/crates/segment/Cargo.toml
index 98f3d1a14..515635db5 100644
--- a/crates/segment/Cargo.toml
+++ b/crates/segment/Cargo.toml
@@ -10,6 +10,6 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
 ndarray = { version = "0.17", default-features = false, features = ["std"] }
 rayon = { workspace = true }
diff --git a/crates/segment/README.md b/crates/segment/README.md
index 79b1d996b..a95c92f93 100644
--- a/crates/segment/README.md
+++ b/crates/segment/README.md
@@ -12,7 +12,10 @@ Trained models for Roto Brush and face tracking, each kind behind one swappable
   depends on one model's layout. The classical face tracker stays built in as the fallback.
 - **`MODELS`**: the registry. Every entry must be open source under a licence compatible with
   EffectCraft's MIT OR Apache-2.0 (`ALLOWED_LICENCES`), with its task, authors, homepage, licence
-  URL, the official weights URL, size and SHA-256. `load` refuses anything else.
+  URL, an app download URL when available, size and SHA-256. `load` refuses anything else.
+  SAM 2 is Install from File only until a storytold-controlled mirror is available.
+  The checkpoint `source` stays separate from the app download URL, so file-install guidance and
+  licence notices identify the verified artifact even when app downloads are unavailable.
 - **Weights are never bundled.** They are downloaded on demand (or installed from a file) by the
   engine (`roto.model.*` / `face.model.*`, Settings ▸ Roto Brush / Face Tracking), verified
   against the registry's SHA-256 (`sha256`, dependency-free) and kept with a notice naming their
@@ -36,6 +39,10 @@ kernels at run time). No ML framework, no unsafe code.
 | id | Task | Model | Authors | Licence | File | Size |
 |---|---|---|---|---|---|---|
 | `mobilesam` | Roto Brush | [MobileSAM](https://github.com/ChaoningZhang/MobileSAM): Segment Anything with a 5M-parameter TinyViT encoder | Chaoning Zhang et al., building on Meta AI's Segment Anything and Microsoft's TinyViT | Apache-2.0 | `mobile_sam.pt` from the official repository | 40.7 MB |
+| `sam2.1-hiera-tiny` | Roto Brush | [SAM 2.1 Tiny](https://github.com/facebookresearch/sam2): Hiera-Tiny video object tracker with streaming memory | Meta AI (Nikhila Ravi et al.) | Apache-2.0 | `model.safetensors` of `facebook/sam2.1-hiera-tiny` (Hugging Face, pinned to a commit); loaded by `effectcraft-sam2` | 155.9 MB |
+| `sam2.1-hiera-small` | Roto Brush | [SAM 2.1 Small](https://github.com/facebookresearch/sam2): Hiera-Small video object tracker with streaming memory | Meta AI (Nikhila Ravi et al.) | Apache-2.0 | `model.safetensors` of `facebook/sam2.1-hiera-small` (Hugging Face, pinned to a commit); loaded by `effectcraft-sam2` | 184.3 MB |
+| `sam2.1-hiera-base-plus` | Roto Brush | [SAM 2.1 Base+](https://github.com/facebookresearch/sam2): Hiera-Base+ video object tracker with streaming memory | Meta AI (Nikhila Ravi et al.) | Apache-2.0 | `model.safetensors` of `facebook/sam2.1-hiera-base-plus` (Hugging Face, pinned to a commit); loaded by `effectcraft-sam2` | 323.5 MB |
+| `sam2.1-hiera-large` | Roto Brush | [SAM 2.1 Large](https://github.com/facebookresearch/sam2): Hiera-Large video object tracker with streaming memory | Meta AI (Nikhila Ravi et al.) | Apache-2.0 | `model.safetensors` of `facebook/sam2.1-hiera-large` (Hugging Face, pinned to a commit); loaded by `effectcraft-sam2` | 897.9 MB |
 | `mediapipe-face` | Face tracking | [MediaPipe Face Landmarker](https://developers.google.com/edge/mediapipe/solutions/vision/face_landmarker): BlazeFace detector and Face Mesh V2 | Google LLC | Apache-2.0 ([model card](https://storage.googleapis.com/mediapipe-assets/Model%20Card%20MediaPipe%20Face%20Mesh%20V2.pdf)) | `face_landmarker.task` (float16, version 1) from Google's model storage | 3.8 MB |
 
 How they were checked:
diff --git a/crates/segment/src/lib.rs b/crates/segment/src/lib.rs
index e04b7c336..7fc0e4ff6 100644
--- a/crates/segment/src/lib.rs
+++ b/crates/segment/src/lib.rs
@@ -14,8 +14,8 @@
 //!   so official weights load as published.
 //! - [`mobilesam`]: MobileSAM (Apache-2.0) and [`mediapipe`]: MediaPipe Face Landmarker
 //!   (Apache-2.0), in plain Rust ([`nn`] kernels on rayon).
-#![forbid(unsafe_code)]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
 
 pub mod face;
 pub mod mediapipe;
@@ -45,6 +45,77 @@ pub trait MaskModel: Send + Sync {
     fn info(&self) -> &'static ModelInfo;
     /// Foreground probability (0–1) of each pixel of a frame (straight RGB 0–1, row-major `w×h`).
     fn segment(&self, rgb: &[[f32; 3]], w: usize, h: usize, prompt: &Prompt) -> Result<Vec<f32>>;
+    /// A video tracker built on the same weights, if the model has one.
+    fn tracker(&self) -> Option<&dyn ObjectTracker> {
+        None
+    }
+    /// The most memory (bytes) the last tracking run held for its memory banks and cached frames (`None`: not tracked).
+    fn peak_state_bytes(&self) -> Option<u64> {
+        None
+    }
+    /// What runs the model: the GPU's name or "CPU" (`None`: it does not say).
+    fn device_name(&self) -> Option<String> {
+        None
+    }
+    /// Seconds since the model was last used (`None`: it does not track use, so it is never unloaded
+    /// for being idle). Large models free their memory after a quiet spell and load again on use.
+    fn idle_secs(&self) -> Option<f64> {
+        None
+    }
+}
+
+/// One decoded frame handed to a tracker (straight RGB 0–1, row-major `w×h`).
+#[derive(Clone, Debug, Default)]
+pub struct ClipFrame {
+    pub rgb: Vec<[f32; 3]>,
+    pub w: usize,
+    pub h: usize,
+}
+
+/// What to track: the clip's frames `first..first + count` (the host's frame numbers) and, for
+/// each object, its prompts on their frames. Objects are tracked in one pass, so the cost of
+/// encoding each frame is shared.
+#[derive(Clone, Debug)]
+pub struct TrackRequest {
+    pub first: i64,
+    pub count: usize,
+    /// One entry per object: its prompts, each on its frame.
+    pub objects: Vec<Vec<(i64, Prompt)>>,
+}
+
+impl TrackRequest {
+    /// A request for a single object.
+    pub fn single(first: i64, count: usize, prompts: Vec<(i64, Prompt)>) -> TrackRequest {
+        TrackRequest { first, count, objects: vec![prompts] }
+    }
+}
+
+/// A tracker's answer for one frame.
+#[derive(Clone, Debug, Default)]
+pub struct TrackedFrame {
+    /// Foreground probability of every pixel (`w×h`); all zero when the object is absent.
+    pub prob: Vec<f32>,
+    pub w: usize,
+    pub h: usize,
+    /// How sure the tracker is (0–1), for the timeline.
+    pub confidence: f32,
+    /// The object is not in this frame (occluded or out of view).
+    pub occluded: bool,
+}
+
+/// A video tracker with memory (SAM 2): given prompts on some frames, it follows the object
+/// through the clip in both directions. Optional: a [`MaskModel`] may offer one.
+pub trait ObjectTracker: Send + Sync {
+    /// Track the objects. `frames(i)` supplies frame `i` (`None`: unavailable); `cancel()` is polled
+    /// between frames; `out(object, i, result)` is called as soon as each object's frame is finished
+    /// (`object` indexes `req.objects`).
+    fn track(
+        &self,
+        req: &TrackRequest,
+        frames: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+        cancel: &dyn Fn() -> bool,
+        out: &mut dyn FnMut(usize, i64, TrackedFrame),
+    ) -> Result<()>;
 }
 
 /// What a model is for.
@@ -70,8 +141,10 @@ pub struct ModelInfo {
     pub licence_url: &'static str,
     /// The project's page.
     pub homepage: &'static str,
-    /// The official weights file.
+    /// App download URL; empty when only Install from File is available.
     pub url: &'static str,
+    /// Checkpoint source for manual installation and notices; never used by the app downloader.
+    pub source: &'static str,
     pub file_name: &'static str,
     pub size: u64,
     /// SHA-256 of the weights file (lower-case hex).
@@ -91,11 +164,82 @@ pub const MOBILE_SAM: ModelInfo = ModelInfo {
     licence_url: "https://github.com/ChaoningZhang/MobileSAM/blob/master/LICENSE",
     homepage: "https://github.com/ChaoningZhang/MobileSAM",
     url: "https://raw.githubusercontent.com/ChaoningZhang/MobileSAM/master/weights/mobile_sam.pt",
+    source: "https://raw.githubusercontent.com/ChaoningZhang/MobileSAM/master/weights/mobile_sam.pt",
     file_name: "mobile_sam.pt",
     size: 40_728_226,
     sha256: "6dbb90523a35330fedd7f1d3dfc66f995213d81b29a5ca8108dbcdd4e37d6c2f",
 };
 
+/// SAM 2.1 Tiny (Meta AI, Apache-2.0): a video object tracker with streaming memory. The weights are
+/// the Hugging Face `transformers` checkpoint, identified by SHA-256. Until a storytold mirror
+/// is available, install it from a file. `effectcraft-sam2` (native only) loads it, not [`load`].
+pub const SAM2_TINY: ModelInfo = ModelInfo {
+    id: "sam2.1-hiera-tiny",
+    task: Task::Mask,
+    name: "SAM 2.1 Tiny",
+    description: "Meta's Segment Anything Model 2 (Hiera-Tiny, 39M parameters). Follows the object through the clip with a streaming memory: it keeps tracking through occlusion and when the object leaves and re-enters the frame. Slower than MobileSAM on a CPU.",
+    authors: "Meta AI (Nikhila Ravi et al., SAM 2), Hugging Face transformers checkpoint",
+    licence: "Apache-2.0",
+    licence_url: "https://github.com/facebookresearch/sam2/blob/main/LICENSE",
+    homepage: "https://github.com/facebookresearch/sam2",
+    url: "",
+    source: "https://huggingface.co/facebook/sam2.1-hiera-tiny/blob/de431c4043854a71d8101e17995dfe596bf101a5/model.safetensors",
+    file_name: "sam2.1-hiera-tiny.safetensors",
+    size: 155_908_064,
+    sha256: "48c14467e5cf9e51870511feb72c89688e82dd74523142c0538b663e193ac2a7",
+};
+
+/// SAM 2.1 Small: the Small checkpoint, pinned to a commit like [`SAM2_TINY`].
+pub const SAM2_SMALL: ModelInfo = ModelInfo {
+    id: "sam2.1-hiera-small",
+    task: Task::Mask,
+    name: "SAM 2.1 Small",
+    description: "Meta's Segment Anything Model 2 (Hiera-Small, 46M parameters). The same streaming-memory tracker as SAM 2.1 Tiny with a larger backbone: a little more accurate on thin parts and busy backgrounds, a little slower.",
+    authors: "Meta AI (Nikhila Ravi et al., SAM 2), Hugging Face transformers checkpoint",
+    licence: "Apache-2.0",
+    licence_url: "https://github.com/facebookresearch/sam2/blob/main/LICENSE",
+    homepage: "https://github.com/facebookresearch/sam2",
+    url: "",
+    source: "https://huggingface.co/facebook/sam2.1-hiera-small/blob/ee5bba1d82bb8749febdf90f45e84b687142ba03/model.safetensors",
+    file_name: "sam2.1-hiera-small.safetensors",
+    size: 184_305_280,
+    sha256: "0a4067b11ce1e23d5229203f11c718a823060d15a4b23fa2372a7d4b77cbbc60",
+};
+
+/// SAM 2.1 Base+: the Base+ checkpoint, pinned to a commit like [`SAM2_TINY`].
+pub const SAM2_BASE_PLUS: ModelInfo = ModelInfo {
+    id: "sam2.1-hiera-base-plus",
+    task: Task::Mask,
+    name: "SAM 2.1 Base+",
+    description: "Meta's Segment Anything Model 2 (Hiera-Base+, 81M parameters). The same streaming-memory tracker as SAM 2.1 Tiny with a larger backbone: better on difficult footage; wants a GPU for comfortable speed.",
+    authors: "Meta AI (Nikhila Ravi et al., SAM 2), Hugging Face transformers checkpoint",
+    licence: "Apache-2.0",
+    licence_url: "https://github.com/facebookresearch/sam2/blob/main/LICENSE",
+    homepage: "https://github.com/facebookresearch/sam2",
+    url: "",
+    source: "https://huggingface.co/facebook/sam2.1-hiera-base-plus/blob/b7320756a13354e7530a63935656d35b2f91a290/model.safetensors",
+    file_name: "sam2.1-hiera-base-plus.safetensors",
+    size: 323_476_296,
+    sha256: "2012733a0de5d03efd1bba550a2847c4551be9ef2e0d497c83074df66189f780",
+};
+
+/// SAM 2.1 Large: the Large checkpoint, pinned to a commit like [`SAM2_TINY`].
+pub const SAM2_LARGE: ModelInfo = ModelInfo {
+    id: "sam2.1-hiera-large",
+    task: Task::Mask,
+    name: "SAM 2.1 Large",
+    description: "Meta's Segment Anything Model 2 (Hiera-Large, 224M parameters). The same streaming-memory tracker as SAM 2.1 Tiny with a larger backbone: the most accurate; about 900 MB and meant for a GPU.",
+    authors: "Meta AI (Nikhila Ravi et al., SAM 2), Hugging Face transformers checkpoint",
+    licence: "Apache-2.0",
+    licence_url: "https://github.com/facebookresearch/sam2/blob/main/LICENSE",
+    homepage: "https://github.com/facebookresearch/sam2",
+    url: "",
+    source: "https://huggingface.co/facebook/sam2.1-hiera-large/blob/665f8e2ad61cf5f53d65644ff27c8ee525124610/model.safetensors",
+    file_name: "sam2.1-hiera-large.safetensors",
+    size: 897_897_416,
+    sha256: "dc407dce21301fd94abb395c5099b4f2c455fdc8a8f261ac3d0ea6d4cd197230",
+};
+
 pub const FACE_LANDMARKER: ModelInfo = ModelInfo {
     id: "mediapipe-face",
     task: Task::Face,
@@ -106,13 +250,14 @@ pub const FACE_LANDMARKER: ModelInfo = ModelInfo {
     licence_url: "https://storage.googleapis.com/mediapipe-assets/Model%20Card%20MediaPipe%20Face%20Mesh%20V2.pdf",
     homepage: "https://developers.google.com/edge/mediapipe/solutions/vision/face_landmarker",
     url: "https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/1/face_landmarker.task",
+    source: "https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/1/face_landmarker.task",
     file_name: "face_landmarker.task",
     size: 3_758_596,
     sha256: "64184e229b263107bc2b804c6625db1341ff2bb731874b0bcc2fe6544e0bc9ff",
 };
 
 /// The trained models, besides the built-in classical engines.
-pub const MODELS: &[ModelInfo] = &[MOBILE_SAM, FACE_LANDMARKER];
+pub const MODELS: &[ModelInfo] = &[MOBILE_SAM, SAM2_TINY, SAM2_SMALL, SAM2_BASE_PLUS, SAM2_LARGE, FACE_LANDMARKER];
 
 /// The id of the built-in classical engines (graph cut segmenter, shape-model face tracker): no
 /// weights, always available.
@@ -144,21 +289,42 @@ pub fn load(id: &str, bytes: &[u8]) -> Result<Loaded> {
     if got != info.sha256 {
         return Err(format!("{}: the file does not match (SHA-256 {got}, expected {})", info.name, info.sha256));
     }
-    match id {
-        "mobilesam" => {
+    match loader(id) {
+        Some(Loader::MobileSam) => {
             let w = pt::read(bytes)?;
             Ok(Loaded::Mask(Arc::new(Sam { net: mobilesam::MobileSam::from_weights(&w)? })))
         }
-        "mediapipe-face" => Ok(Loaded::Face(Arc::new(mediapipe::FaceLandmarker::from_task(bytes)?))),
-        _ => Err(format!("no loader for `{id}`")),
+        Some(Loader::MediaPipe) => Ok(Loaded::Face(Arc::new(mediapipe::FaceLandmarker::from_task(bytes)?))),
+        Some(Loader::Desktop) => Err(format!("{} is loaded by the desktop application (effectcraft-sam2)", info.name)),
+        None => Err(format!("no loader for `{id}`")),
+    }
+}
+
+/// What builds a registered model.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Loader {
+    MobileSam,
+    MediaPipe,
+    /// Built outside this crate, by the desktop application (every SAM 2.1 size).
+    Desktop,
+}
+
+/// The loader for model `id`: one answer for every size of a family, so a new size cannot fall
+/// through to "no loader" while its sibling gets the helpful error.
+fn loader(id: &str) -> Option<Loader> {
+    match id {
+        "mobilesam" => Some(Loader::MobileSam),
+        "mediapipe-face" => Some(Loader::MediaPipe),
+        id if id.starts_with("sam2.1-hiera-") => Some(Loader::Desktop),
+        _ => None,
     }
 }
 
 /// The notice kept next to installed weights: what they are, who made them, their licence.
 pub fn notice(m: &ModelInfo) -> String {
     format!(
-        "{}\n\nAuthors: {}\nLicence: {} (full text: https://spdx.org/licenses/{}.html; as stated by the authors: {})\nSource: {}\nProject: {}\n\nDownloaded unmodified from the source above. EffectCraft runs it with its own implementation\nand is not affiliated with or endorsed by its authors.\n",
-        m.name, m.authors, m.licence, m.licence, m.licence_url, m.url, m.homepage
+        "{}\n\nAuthors: {}\nLicence: {} (full text: https://spdx.org/licenses/{}.html; as stated by the authors: {})\nSource: {}\nSHA-256: {}\nProject: {}\n\nInstalled unmodified. EffectCraft runs it with its own implementation\nand is not affiliated with or endorsed by its authors.\n",
+        m.name, m.authors, m.licence, m.licence, m.licence_url, m.source, m.sha256, m.homepage
     )
 }
 
@@ -260,13 +426,37 @@ mod tests {
         for m in MODELS {
             assert!(ALLOWED_LICENCES.contains(&m.licence), "{}", m.id);
             assert_eq!(m.sha256.len(), 64);
-            assert!(m.url.starts_with("https://") && m.licence_url.starts_with("https://") && m.homepage.starts_with("https://"));
+            assert!(m.url.is_empty() || m.url.starts_with("https://"));
+            assert!(m.source.starts_with("https://"));
+            assert!(m.licence_url.starts_with("https://") && m.homepage.starts_with("https://"));
             assert!(!m.authors.is_empty() && notice(m).contains(m.authors));
         }
+        assert_eq!(
+            models(Task::Mask).map(|m| m.id).collect::<Vec<_>>(),
+            ["mobilesam", "sam2.1-hiera-tiny", "sam2.1-hiera-small", "sam2.1-hiera-base-plus", "sam2.1-hiera-large"]
+        );
+        for model in [SAM2_TINY, SAM2_SMALL, SAM2_BASE_PLUS, SAM2_LARGE] {
+            assert!(model.url.is_empty(), "SAM 2 has no app download until a storytold mirror is available");
+            assert!(model.file_name.ends_with(".safetensors"));
+            assert!(model.source.contains("/blob/") && model.source.ends_with("/model.safetensors"));
+            assert!(notice(&model).contains(&format!("Source: {}", model.source)));
+            assert!(notice(&model).contains(model.sha256));
+        }
         assert_eq!(models(Task::Face).map(|m| m.id).collect::<Vec<_>>(), ["mediapipe-face"]);
         assert!(load("mediapipe-face", b"nope").err().is_some_and(|e| e.contains("does not match")));
         // A file that isn't the published one is refused before anything is parsed.
         assert!(load("mobilesam", b"not the weights").err().is_some_and(|e| e.contains("does not match")));
         assert!(load("nope", b"").is_err());
     }
+
+    /// Every registered model has a loader, so none falls through to "no loader" after its checksum
+    /// matches; every SAM 2.1 size is loaded by the desktop application.
+    #[test]
+    fn every_registered_model_has_a_loader() {
+        for m in MODELS {
+            let l = loader(m.id);
+            assert!(l.is_some(), "{} has no loader", m.id);
+            assert_eq!(l == Some(Loader::Desktop), m.id.starts_with("sam2.1-"), "{}", m.id);
+        }
+    }
 }
diff --git a/crates/segment/src/mobilesam.rs b/crates/segment/src/mobilesam.rs
index 22d98ba7c..6599b018a 100644
--- a/crates/segment/src/mobilesam.rs
+++ b/crates/segment/src/mobilesam.rs
@@ -191,7 +191,7 @@ impl Block {
                         v[t * dim + hh * hd..][..hd].copy_from_slice(&s[2 * hd..]);
                     }
                 }
-                nn::attention(&q, &k, &v, n, n, heads, hd, Some(&self.bias))
+                nn::attention(&q, &k, &v, nn::AttentionShape { query_tokens: n, key_tokens: n, heads, head_dim: hd }, Some(&self.bias))
             })
             .collect();
         // Un-window into the real grid, project, residual.
@@ -325,7 +325,7 @@ impl Attn {
     fn forward(&self, q: &[f32], nq: usize, k: &[f32], v: &[f32], nk: usize) -> Vec<f32> {
         let (q, k, v) = (self.q.forward(q, nq), self.k.forward(k, nk), self.v.forward(v, nk));
         let heads = 8;
-        let o = nn::attention(&q, &k, &v, nq, nk, heads, self.q.out / heads, None);
+        let o = nn::attention(&q, &k, &v, nn::AttentionShape { query_tokens: nq, key_tokens: nk, heads, head_dim: self.q.out / heads }, None);
         self.out.forward(&o, nq)
     }
 }
diff --git a/crates/segment/src/nn.rs b/crates/segment/src/nn.rs
index 4cf7a5344..713b392b8 100644
--- a/crates/segment/src/nn.rs
+++ b/crates/segment/src/nn.rs
@@ -334,9 +334,19 @@ pub fn softmax_rows(x: &mut [f32], n: usize) {
     }
 }
 
-/// Multi-head scaled dot-product attention of `nq` queries over `nk` keys/values, each `heads ×
-/// hd` wide (token-major, heads side by side), plus an optional per-head bias `[heads × nq × nk]`.
-pub fn attention(q: &[f32], k: &[f32], v: &[f32], nq: usize, nk: usize, heads: usize, hd: usize, bias: Option<&[f32]>) -> Vec<f32> {
+/// Token counts and channel layout shared by the query, key and value tensors.
+#[derive(Clone, Copy, Debug)]
+pub struct AttentionShape {
+    pub query_tokens: usize,
+    pub key_tokens: usize,
+    pub heads: usize,
+    pub head_dim: usize,
+}
+
+/// Multi-head scaled dot-product attention with token-major tensors, heads side by side,
+/// and an optional per-head bias `[heads × query_tokens × key_tokens]`.
+pub fn attention(q: &[f32], k: &[f32], v: &[f32], shape: AttentionShape, bias: Option<&[f32]>) -> Vec<f32> {
+    let AttentionShape { query_tokens: nq, key_tokens: nk, heads, head_dim: hd } = shape;
     let dim = heads * hd;
     let mut out = vec![0.0f32; nq * dim];
     if q.len() < nq * dim || k.len() < nk * dim || v.len() < nk * dim {
@@ -372,6 +382,37 @@ pub fn attention(q: &[f32], k: &[f32], v: &[f32], nq: usize, nk: usize, heads: u
 mod tests {
     use super::*;
 
+    #[test]
+    fn multi_head_cross_attention_matches_direct_sums() {
+        let shape = AttentionShape { query_tokens: 2, key_tokens: 3, heads: 2, head_dim: 2 };
+        let q = [1.0, -0.5, 0.25, 2.0, -1.0, 0.75, 1.5, -0.25];
+        let k = [0.5, 1.0, -0.5, 0.25, 1.5, -0.25, 0.75, 1.0, -1.0, 0.5, 2.0, -1.5];
+        let v = [1.0, 2.0, 3.0, 4.0, -1.0, 0.5, 1.5, -2.0, 0.25, 0.75, -0.5, 2.5];
+        let bias = [0.0, 0.5, -0.5, 1.0, 0.0, -1.0, -0.25, 0.25, 0.5, 0.0, -0.5, 1.0];
+        for bias in [None, Some(bias.as_slice())] {
+            let actual = attention(&q, &k, &v, shape, bias);
+            for query in 0..shape.query_tokens {
+                for head in 0..shape.heads {
+                    let mut scores: Vec<f32> = (0..shape.key_tokens)
+                        .map(|key| {
+                            let dot: f32 = (0..shape.head_dim).map(|channel| q[query * 4 + head * 2 + channel] * k[key * 4 + head * 2 + channel]).sum();
+                            dot / (shape.head_dim as f32).sqrt() + bias.map_or(0.0, |b| b[(head * 2 + query) * 3 + key])
+                        })
+                        .collect();
+                    let max = scores.iter().copied().fold(f32::NEG_INFINITY, f32::max);
+                    for score in &mut scores {
+                        *score = (*score - max).exp();
+                    }
+                    let total: f32 = scores.iter().sum();
+                    for channel in 0..shape.head_dim {
+                        let expected: f32 = scores.iter().enumerate().map(|(key, score)| score / total * v[key * 4 + head * 2 + channel]).sum();
+                        assert!((actual[query * 4 + head * 2 + channel] - expected).abs() < 1e-6);
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn gemm_matches_naive() {
         let (m, k, n) = (130, 17, 9);
diff --git a/crates/segment/src/pt.rs b/crates/segment/src/pt.rs
index d85ff80ca..35ed57297 100644
--- a/crates/segment/src/pt.rs
+++ b/crates/segment/src/pt.rs
@@ -6,6 +6,15 @@
 
 use std::collections::HashMap;
 
+const MAX_ARCHIVE_BYTES: usize = 1 << 30;
+const MAX_PICKLE_OPS: usize = 4_000_000;
+const MAX_TENSORS: usize = 1_000_000;
+const MAX_TENSOR_ELEMENTS: usize = 1 << 28;
+const MAX_ENTRY_BYTES: usize = 1 << 30;
+const MAX_PICKLE_NODES: usize = 4_000_000;
+const MAX_TOTAL_ELEMENTS: usize = 1 << 29;
+const MAX_TENSOR_DIMS: usize = 64;
+
 /// A tensor read from a checkpoint: its shape and its values as f32 (row-major, contiguous).
 #[derive(Clone, Debug, PartialEq)]
 pub struct Tensor {
@@ -38,6 +47,9 @@ struct Entry {
 
 /// The entries of a zip archive by name.
 fn zip_entries(b: &[u8]) -> Result<HashMap<String, Entry>> {
+    if b.len() > MAX_ARCHIVE_BYTES {
+        return Err("checkpoint exceeds the 1024 MiB archive limit".into());
+    }
     // End of central directory: the last `PK\x05\x06` (a comment may follow it).
     let eocd =
         (0..b.len().saturating_sub(21)).rev().find(|&i| b.get(i..i + 4) == Some(b"PK\x05\x06")).ok_or("not a zip archive (no end of central directory)")?;
@@ -96,6 +108,9 @@ fn read_entry<'a>(b: &'a [u8], e: &Entry) -> Result<std::borrow::Cow<'a, [u8]>>
     match e.method {
         0 => Ok(std::borrow::Cow::Borrowed(raw)),
         8 => {
+            if e.size > MAX_ENTRY_BYTES {
+                return Err("zip entry exceeds the size limit".into());
+            }
             miniz_oxide::inflate::decompress_to_vec_with_limit(raw, e.size.max(1)).map(std::borrow::Cow::Owned).map_err(|e| format!("bad deflate data: {e:?}"))
         }
         m => Err(format!("unsupported zip compression {m}")),
@@ -142,7 +157,58 @@ fn int_list(o: &Obj) -> Option<Vec<usize>> {
     }
 }
 
+/// Nodes in `o`, stopping once the count passes `budget`.
+fn nodes(o: &Obj, budget: usize) -> usize {
+    let kids: Vec<&Obj> = match o {
+        Obj::Tuple(v) | Obj::List(v) => v.iter().collect(),
+        Obj::Dict(v) => v.iter().flat_map(|(k, x)| [k, x]).collect(),
+        _ => return 1,
+    };
+    let mut n = 1;
+    for k in kids {
+        if n > budget {
+            break;
+        }
+        n += nodes(k, budget - n);
+    }
+    n
+}
+
+fn tensor_element_count(name: &str, offset: usize, size: &[usize], stride: &[usize], values_len: usize) -> Result<usize> {
+    if size.len() != stride.len() || size.len() > MAX_TENSOR_DIMS {
+        return Err(format!("{name}: invalid tensor dimensionality"));
+    }
+    let n = size
+        .iter()
+        .try_fold(1usize, |n, &dim| n.checked_mul(dim))
+        .filter(|n| *n <= MAX_TENSOR_ELEMENTS)
+        .ok_or_else(|| format!("{name}: tensor exceeds the element limit"))?;
+    if n == 0 {
+        return Ok(0);
+    }
+    let mut max_at = offset;
+    for (&dim, &step) in size.iter().zip(stride) {
+        max_at = max_at
+            .checked_add((dim - 1).checked_mul(step).ok_or_else(|| format!("{name}: tensor stride overflow"))?)
+            .ok_or_else(|| format!("{name}: tensor offset overflow"))?;
+    }
+    if max_at >= values_len {
+        return Err(format!("{name}: data out of range"));
+    }
+    Ok(n)
+}
+
 /// Run the pickle program and return its result.
+/// A memoized object, charged against the clone budget (memo reuse can otherwise grow trees exponentially).
+fn memo_get(memo: &HashMap<u64, Obj>, k: u64, cloned: &mut usize) -> Result<Obj> {
+    let o = memo.get(&k).ok_or("pickle: bad memo")?;
+    *cloned = cloned.saturating_add(nodes(o, MAX_PICKLE_NODES));
+    if *cloned > MAX_PICKLE_NODES {
+        return Err("pickle exceeds the object limit".into());
+    }
+    Ok(o.clone())
+}
+
 fn unpickle(p: &[u8]) -> Result<Obj> {
     let mut stack: Vec<Obj> = Vec::new();
     let mut memo: HashMap<u64, Obj> = HashMap::new();
@@ -166,7 +232,10 @@ fn unpickle(p: &[u8]) -> Result<Obj> {
         *i += n + 1;
         Ok(s)
     };
+    let mut op_count = 0usize;
+    let mut cloned = 0usize;
     loop {
+        op_count = op_count.checked_add(1).filter(|n| *n <= MAX_PICKLE_OPS).ok_or("pickle exceeds the opcode limit")?;
         let op = *p.get(i).ok_or("truncated pickle")?;
         i += 1;
         match op {
@@ -253,11 +322,11 @@ fn unpickle(p: &[u8]) -> Result<Obj> {
             }
             b'h' => {
                 let k = take(&mut i, 1)?[0] as u64;
-                stack.push(memo.get(&k).cloned().ok_or("pickle: bad memo")?);
+                stack.push(memo_get(&memo, k, &mut cloned)?);
             }
             b'j' => {
                 let s = take(&mut i, 4)?;
-                stack.push(memo.get(&(u32::from_le_bytes([s[0], s[1], s[2], s[3]]) as u64)).cloned().ok_or("pickle: bad memo")?);
+                stack.push(memo_get(&memo, u32::from_le_bytes([s[0], s[1], s[2], s[3]]) as u64, &mut cloned)?);
             }
             b't' => {
                 let items = pop_mark(&mut stack)?;
@@ -290,9 +359,10 @@ fn unpickle(p: &[u8]) -> Result<Obj> {
                 stack.push(match f {
                     Obj::Global(m, n) if m == "torch._utils" && n == "_rebuild_tensor_v2" => {
                         match (args.first(), args.get(1), args.get(2).and_then(int_list), args.get(3).and_then(int_list)) {
-                            (Some(Obj::Storage(dtype, key)), Some(Obj::Int(off)), Some(size), Some(stride)) => {
-                                Obj::Tensor { dtype: dtype.clone(), key: key.clone(), offset: usize::try_from(*off).unwrap_or(0), size, stride }
-                            }
+                            (Some(Obj::Storage(dtype, key)), Some(Obj::Int(off)), Some(size), Some(stride)) => match usize::try_from(*off) {
+                                Ok(offset) => Obj::Tensor { dtype: dtype.clone(), key: key.clone(), offset, size, stride },
+                                Err(_) => Obj::Other,
+                            },
                             _ => Obj::Other,
                         }
                     }
@@ -337,16 +407,24 @@ fn unpickle(p: &[u8]) -> Result<Obj> {
     }
 }
 
-/// Element bytes and conversion of a storage dtype.
-fn to_f32(dtype: &str, bytes: &[u8]) -> Option<Vec<f32>> {
+/// Bytes per element of a float storage dtype.
+fn elem_size(dtype: &str) -> Option<usize> {
     match dtype {
-        "FloatStorage" => Some(bytes.as_chunks::<4>().0.iter().map(|c| f32::from_le_bytes([c[0], c[1], c[2], c[3]])).collect()),
-        "HalfStorage" => Some(bytes.as_chunks::<2>().0.iter().map(|c| half_to_f32(u16::from_le_bytes([c[0], c[1]]))).collect()),
-        "BFloat16Storage" => Some(bytes.as_chunks::<2>().0.iter().map(|c| f32::from_bits((u16::from_le_bytes([c[0], c[1]]) as u32) << 16)).collect()),
+        "FloatStorage" => Some(4),
+        "HalfStorage" | "BFloat16Storage" => Some(2),
         _ => None,
     }
 }
 
+/// Element `i` of a storage (`i` must be below `bytes.len() / elem_size`).
+fn elem_f32(dtype: &str, bytes: &[u8], i: usize) -> f32 {
+    match dtype {
+        "FloatStorage" => f32::from_le_bytes([bytes[4 * i], bytes[4 * i + 1], bytes[4 * i + 2], bytes[4 * i + 3]]),
+        "HalfStorage" => half_to_f32(u16::from_le_bytes([bytes[2 * i], bytes[2 * i + 1]])),
+        _ => f32::from_bits((u16::from_le_bytes([bytes[2 * i], bytes[2 * i + 1]]) as u32) << 16),
+    }
+}
+
 pub(crate) fn half_to_f32(h: u16) -> f32 {
     let (s, e, m) = ((h >> 15) as u32, ((h >> 10) & 0x1f) as u32, (h & 0x3ff) as u32);
     let bits = match (e, m) {
@@ -382,22 +460,42 @@ pub fn read(bytes: &[u8]) -> Result<Weights> {
         Some((_, Obj::Dict(inner))) => inner.clone(),
         _ => dict,
     };
+    if dict.len() > MAX_TENSORS {
+        return Err("checkpoint exceeds the tensor count limit".into());
+    }
     let mut storages: HashMap<String, std::borrow::Cow<[u8]>> = HashMap::new();
     let mut out = Weights::new();
+    let mut total = 0usize;
+    let mut inflated = 0usize;
     for (k, v) in dict {
         let (Obj::Str(name), Obj::Tensor { dtype, key, offset, size, stride }) = (k, v) else { continue };
         if !storages.contains_key(&key) {
             let e = entries.get(&format!("{prefix}data/{key}")).ok_or_else(|| format!("missing storage {key}"))?;
+            if e.method == 8 {
+                inflated = inflated.saturating_add(e.size);
+                if inflated > MAX_ENTRY_BYTES {
+                    return Err("checkpoint exceeds the decompressed storage limit".into());
+                }
+            }
             storages.insert(key.clone(), read_entry(bytes, e)?);
         }
-        let Some(values) = storages.get(&key).and_then(|b| to_f32(&dtype, b)) else { continue };
-        let n: usize = size.iter().product();
-        // Gather (any strides) into a contiguous row-major tensor.
-        let mut data = Vec::with_capacity(n);
+        let (Some(esz), Some(values)) = (elem_size(&dtype), storages.get(&key)) else { continue };
+        // Check hostile stride math before allocating or indexing the backing storage.
+        let n = tensor_element_count(&name, offset, &size, &stride, values.len() / esz)?;
+        total = total.saturating_add(n);
+        if total > MAX_TOTAL_ELEMENTS {
+            return Err("checkpoint exceeds the total element limit".into());
+        }
+        let mut data = Vec::new();
+        data.try_reserve_exact(n).map_err(|_| format!("{name}: tensor allocation failed"))?;
         let mut idx = vec![0usize; size.len()];
         for _ in 0..n {
-            let at = offset + idx.iter().zip(&stride).map(|(i, s)| i * s).sum::<usize>();
-            data.push(*values.get(at).ok_or_else(|| format!("{name}: data out of range"))?);
+            let at = idx
+                .iter()
+                .zip(&stride)
+                .try_fold(offset, |at, (i, s)| i.checked_mul(*s).and_then(|v| at.checked_add(v)))
+                .ok_or_else(|| format!("{name}: tensor offset overflow"))?;
+            data.push(elem_f32(&dtype, values, at));
             for d in (0..idx.len()).rev() {
                 idx[d] += 1;
                 if idx[d] < size[d] {
@@ -490,6 +588,15 @@ mod tests {
         assert!(!w.contains_key("n"), "integer tensors are skipped");
     }
 
+    #[test]
+    fn rejects_tensor_shape_overflow_and_invalid_strides() {
+        assert!(tensor_element_count("bad", 0, &[usize::MAX, 2], &[1, 1], 16).is_err());
+        assert!(tensor_element_count("bad", 0, &[2, 2], &[usize::MAX, 1], 16).is_err());
+        assert!(tensor_element_count("bad", 0, &[2, 2], &[1], 16).is_err());
+        assert!(tensor_element_count("bad", usize::MAX, &[2], &[1], 16).is_err());
+        assert_eq!(tensor_element_count("empty", 0, &[0, usize::MAX], &[0, 0], 0), Ok(0));
+    }
+
     #[test]
     fn damaged_files_are_errors() {
         assert!(read(b"not a zip").is_err());
diff --git a/crates/segment/src/tflite.rs b/crates/segment/src/tflite.rs
index 9cd34c6da..34e85dfab 100644
--- a/crates/segment/src/tflite.rs
+++ b/crates/segment/src/tflite.rs
@@ -763,361 +763,4 @@ fn concat(parts: &[(&[f32], &Vec<usize>)], axis: usize) -> Result<Vec<f32>> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn same_padding_matches_tensorflow() {
-        // TensorFlow pads the extra row after: 128 → 64 with a 3×3 stride-2 window pads 0 before.
-        assert_eq!(same(128, 3, 2), (64, 0));
-        assert_eq!(same(128, 5, 2), (64, 1));
-        assert_eq!(same(16, 3, 1), (16, 1));
-        assert_eq!(same(7, 2, 2), (4, 0));
-        assert_eq!(window(1, 4, 2, 2), Ok((2, 0)));
-        assert!(window(1, 1, 2, 2).is_err());
-    }
-
-    #[test]
-    fn asymmetric_conv_padding() {
-        // A 3×3 stride-2 "same" conv on 4×4: pads nothing before, one after.
-        let x: Vec<f32> = (0..16).map(|v| v as f32).collect();
-        let ones = vec![1.0f32; 9];
-        let c = Conv { wt: ones.clone(), b: vec![0.0], inp: 1, out: 1, ks: 3, stride: 2, pad: 0 };
-        let y = c.forward_sized(&x, 4, 4, 2, 2, [0, 0]);
-        // Top-left window rows 0–2, cols 0–2; the bottom-right one is cut by the edge.
-        assert_eq!(y, vec![45.0, 39.0, 66.0, 50.0]);
-        let d = Depthwise { w: ones, b: vec![0.0], c: 1, ks: 3, stride: 2 };
-        assert_eq!(d.forward_sized(&x, 4, 4, 2, 2, [0, 0]), y);
-    }
-
-    #[test]
-    fn pool_pad_and_concat() {
-        let x: Vec<f32> = (0..16).map(|v| v as f32).collect();
-        assert_eq!(max_pool(&x, [4, 4], 1, [2, 2], [2, 2], [2, 2], [0, 0]), vec![5.0, 7.0, 13.0, 15.0]);
-        // Same padding on 3×3 → 2×2: the last window is cut by the edge.
-        let x3: Vec<f32> = (0..9).map(|v| v as f32).collect();
-        assert_eq!(max_pool(&x3, [3, 3], 1, [2, 2], [2, 2], [2, 2], [0, 0]), vec![4.0, 5.0, 7.0, 8.0]);
-        // Channel padding (residual connections widen the channels with zeros).
-        let p = pad(&[1.0, 2.0, 3.0, 4.0], &[1, 1, 2, 2], &[[0, 0], [0, 0], [0, 0], [0, 1]]).unwrap();
-        assert_eq!(p, vec![1.0, 2.0, 0.0, 3.0, 4.0, 0.0]);
-        let p = pad(&[1.0, 2.0], &[1, 2], &[[0, 0], [1, 0]]).unwrap();
-        assert_eq!(p, vec![0.0, 1.0, 2.0]);
-        let a = [1.0, 2.0, 3.0, 4.0];
-        let b = [5.0, 6.0];
-        let (sa, sb) = (vec![1, 2, 2], vec![1, 1, 2]);
-        assert_eq!(concat(&[(&a, &sa), (&b, &sb)], 1).unwrap(), vec![1.0, 2.0, 3.0, 4.0, 5.0, 6.0]);
-        let (sa, sb) = (vec![2, 2], vec![2, 1]);
-        assert_eq!(concat(&[(&a, &sa), (&b, &sb)], 1).unwrap(), vec![1.0, 2.0, 5.0, 3.0, 4.0, 6.0]);
-    }
-
-    #[test]
-    fn damaged_files_are_errors_not_panics() {
-        assert!(Model::read(b"").is_err());
-        assert!(Model::read(&[0xff; 64]).is_err());
-        // Every prefix and a few corruptions of a hand-made buffer.
-        let mut fb = vec![12, 0, 0, 0, 0, 0, 6, 0, 8, 0, 4, 0, 6, 0, 0, 0, 0, 0, 0, 0];
-        for n in 0..fb.len() {
-            let _ = Model::read(&fb[..n]);
-        }
-        for i in 0..fb.len() {
-            fb[i] ^= 0x5a;
-            let _ = Model::read(&fb);
-        }
-    }
-
-    /// A FlatBuffer value, to build small models in tests.
-    enum V {
-        Int(i32),
-        Byte(u8),
-        Table(Vec<(usize, V)>),
-        Ints(Vec<i32>),
-        Bytes(Vec<u8>),
-        Tables(Vec<V>),
-    }
-
-    fn put_u32(b: &mut [u8], at: usize, v: usize) {
-        b[at..at + 4].copy_from_slice(&(v as u32).to_le_bytes());
-    }
-
-    /// Append `v` (children after their parent, so every offset points forward); where it starts.
-    fn put(b: &mut Vec<u8>, v: &V) -> usize {
-        match v {
-            V::Table(fields) => {
-                let slots = fields.iter().map(|f| f.0 + 1).max().unwrap_or(0);
-                let vt = b.len();
-                let vt_len = 4 + 2 * slots;
-                b.resize(vt + vt_len, 0);
-                let t = b.len();
-                // Every field gets 8 bytes (the reader does not need alignment).
-                let t_len = 4 + 8 * fields.len();
-                b.resize(t + t_len, 0);
-                b[vt..vt + 2].copy_from_slice(&(vt_len as u16).to_le_bytes());
-                b[vt + 2..vt + 4].copy_from_slice(&(t_len as u16).to_le_bytes());
-                b[t..t + 4].copy_from_slice(&((t - vt) as i32).to_le_bytes());
-                for (k, (id, f)) in fields.iter().enumerate() {
-                    let at = t + 4 + 8 * k;
-                    b[vt + 4 + 2 * id..vt + 6 + 2 * id].copy_from_slice(&((at - t) as u16).to_le_bytes());
-                    match f {
-                        V::Int(i) => b[at..at + 4].copy_from_slice(&i.to_le_bytes()),
-                        V::Byte(x) => b[at] = *x,
-                        _ => {
-                            let child = put(b, f);
-                            put_u32(b, at, child - at);
-                        }
-                    }
-                }
-                t
-            }
-            V::Ints(xs) => {
-                let p = b.len();
-                b.extend((xs.len() as u32).to_le_bytes());
-                xs.iter().for_each(|x| b.extend(x.to_le_bytes()));
-                p
-            }
-            V::Bytes(xs) => {
-                let p = b.len();
-                b.extend((xs.len() as u32).to_le_bytes());
-                b.extend(xs);
-                p
-            }
-            V::Tables(ts) => {
-                let p = b.len();
-                b.extend((ts.len() as u32).to_le_bytes());
-                let slots = b.len();
-                b.resize(slots + 4 * ts.len(), 0);
-                for (i, t) in ts.iter().enumerate() {
-                    let child = put(b, t);
-                    put_u32(b, slots + 4 * i, child - (slots + 4 * i));
-                }
-                p
-            }
-            V::Int(_) | V::Byte(_) => b.len(),
-        }
-    }
-
-    /// A tensor: shape, type and its constant data (`Some(k)`: buffer `k` of the model's).
-    type T = (Vec<i32>, u8, Option<usize>);
-    /// An operator: code, inputs, outputs and its options' fields.
-    type O = (i32, Vec<i32>, Vec<i32>, Vec<(usize, V)>);
-
-    /// A `.tflite` file with one graph.
-    fn model(bufs: Vec<Vec<u8>>, tensors: Vec<T>, ops: Vec<O>, inputs: Vec<i32>, outputs: Vec<i32>) -> Vec<u8> {
-        let ts = tensors
-            .into_iter()
-            .enumerate()
-            .map(|(i, (shape, ty, buf))| {
-                let mut f = vec![(0, V::Ints(shape)), (1, V::Byte(ty)), (3, V::Bytes(format!("t{i}").into_bytes()))];
-                if let Some(k) = buf {
-                    f.push((2, V::Int(k as i32 + 1)));
-                }
-                V::Table(f)
-            })
-            .collect();
-        let mut codes = vec![];
-        let os = ops
-            .into_iter()
-            .map(|(code, ins, outs, opts)| {
-                let idx = codes.iter().position(|&c| c == code).unwrap_or_else(|| {
-                    codes.push(code);
-                    codes.len() - 1
-                });
-                V::Table(vec![(0, V::Int(idx as i32)), (1, V::Ints(ins)), (2, V::Ints(outs)), (4, V::Table(opts))])
-            })
-            .collect();
-        let g = V::Table(vec![(0, V::Tables(ts)), (1, V::Ints(inputs)), (2, V::Ints(outputs)), (3, V::Tables(os))]);
-        let buffers = std::iter::once(V::Table(vec![])).chain(bufs.into_iter().map(|d| V::Table(vec![(0, V::Bytes(d))]))).collect();
-        let codes = codes.into_iter().map(|c| V::Table(vec![(3, V::Int(c))])).collect();
-        let root = V::Table(vec![(1, V::Tables(codes)), (2, V::Tables(vec![g])), (4, V::Tables(buffers))]);
-        let mut b = vec![0u8; 4];
-        let r = put(&mut b, &root);
-        put_u32(&mut b, 0, r);
-        b
-    }
-
-    fn f32s(xs: &[f32]) -> Vec<u8> {
-        xs.iter().flat_map(|x| x.to_le_bytes()).collect()
-    }
-
-    /// Conv2DOptions / Pool2DOptions: padding (0 same, 1 valid) and stride.
-    fn window_opts(padding: u8, stride: i32) -> Vec<(usize, V)> {
-        vec![(0, V::Byte(padding)), (1, V::Int(stride)), (2, V::Int(stride))]
-    }
-
-    fn refused(bytes: &[u8], why: &str) {
-        let e = Model::read(bytes).err().unwrap_or_default();
-        assert!(e.contains(why), "refused for `{e}`, expected `{why}`");
-    }
-
-    #[test]
-    fn built_models_load_and_run() {
-        // A 3×3 stride-2 "same" conv on 4×4, then a RELU: as `asymmetric_conv_padding`.
-        let m = model(
-            vec![f32s(&[1.0; 9])],
-            vec![(vec![1, 4, 4, 1], FLOAT32, None), (vec![1, 3, 3, 1], FLOAT32, Some(0)), (vec![1, 2, 2, 1], FLOAT32, None), (vec![1, 2, 2, 1], FLOAT32, None)],
-            vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 2)), (op::RELU, vec![2], vec![3], vec![])],
-            vec![0],
-            vec![3],
-        );
-        let m = Model::read(&m).unwrap();
-        let c = m.cost().unwrap();
-        assert_eq!((c.macs, c.values, c.scratch, c.kernel), (2 * 2 * 9, 8, 2 * 9, 3));
-        // The input, the conv's output and its patch row, alive together.
-        assert_eq!(c.live, 16 + 4 + 2 * 9);
-        let x: Vec<f32> = (0..16).map(|v| v as f32).collect();
-        assert_eq!(m.run(&[&x]).unwrap(), vec![vec![45.0, 39.0, 66.0, 50.0]]);
-    }
-
-    /// #368: an 8 KB model whose CONV_2D needed a 512 GB scratch buffer aborted `run`.
-    #[test]
-    fn convolution_scratch_is_bounded() {
-        let w = 1 << 25;
-        let bomb = model(
-            vec![vec![0; 2 * 64 * 64]],
-            vec![(vec![1, 1, w, 1], FLOAT32, None), (vec![1, 64, 64, 1], FLOAT16, Some(0)), (vec![1, 1, w, 1], FLOAT32, None)],
-            vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
-            vec![0],
-            vec![2],
-        );
-        refused(&bomb, "kernel is too large");
-        // A small kernel over many channels: the patch row is `ow·3·3·cin`.
-        let (w, cin) = (1 << 20, 256);
-        let wide = model(
-            vec![vec![0; 2 * 9 * 256]],
-            vec![(vec![1, 1, w, cin], FLOAT32, None), (vec![1, 3, 3, cin], FLOAT16, Some(0)), (vec![1, 1, w, 1], FLOAT32, None)],
-            vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
-            vec![0],
-            vec![2],
-        );
-        refused(&wide, "working space is too large");
-    }
-
-    #[test]
-    fn kernel_sides_are_bounded() {
-        let k = MAX_KERNEL as i32 + 1;
-        let conv = model(
-            vec![vec![0; 2 * (k * k) as usize]],
-            vec![(vec![1, 40, 40, 1], FLOAT32, None), (vec![1, k, k, 1], FLOAT16, Some(0)), (vec![1, 40, 40, 1], FLOAT32, None)],
-            vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
-            vec![0],
-            vec![2],
-        );
-        refused(&conv, "kernel is too large");
-        let depthwise = model(
-            vec![vec![0; 2 * (k * k) as usize]],
-            vec![(vec![1, 40, 40, 1], FLOAT32, None), (vec![1, k, k, 1], FLOAT16, Some(0)), (vec![1, 40, 40, 1], FLOAT32, None)],
-            vec![(op::DEPTHWISE_CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
-            vec![0],
-            vec![2],
-        );
-        refused(&depthwise, "kernel is too large");
-        // A "same" pool takes any window: a huge one looped for billions of steps per output.
-        let mut opts = window_opts(0, 1);
-        opts.extend([(3, V::Int(i32::MAX)), (4, V::Int(i32::MAX))]);
-        let pool = model(
-            vec![],
-            vec![(vec![1, 8, 8, 1], FLOAT32, None), (vec![1, 8, 8, 1], FLOAT32, None)],
-            vec![(op::MAX_POOL_2D, vec![0], vec![1], opts)],
-            vec![0],
-            vec![1],
-        );
-        refused(&pool, "pooling window is too large");
-    }
-
-    #[test]
-    fn multiply_adds_are_bounded() {
-        // Three 16 → 16 pointwise convolutions over 4096×4096: 3·2³² multiply-adds.
-        let s = vec![1, 4096, 4096, 16];
-        let t = |buf| (s.clone(), FLOAT32, buf);
-        let m = model(
-            vec![vec![0; 2 * 16 * 16]],
-            vec![t(None), (vec![16, 1, 1, 16], FLOAT16, Some(0)), t(None), t(None), t(None)],
-            (0..3).map(|i| (op::CONV_2D, vec![if i == 0 { 0 } else { i + 1 }, 1, -1], vec![i + 2], window_opts(0, 1))).collect(),
-            vec![0],
-            vec![4],
-        );
-        refused(&m, "too many multiply-adds");
-    }
-
-    /// #368: 2000 RELUs over 2²⁵ values loaded fine, and one run took minutes.
-    #[test]
-    fn elementwise_work_is_bounded() {
-        let n = 2000;
-        let m = model(
-            vec![],
-            (0..=n).map(|_| (vec![1, 1 << 25], FLOAT32, None)).collect(),
-            (0..n).map(|i| (op::RELU, vec![i], vec![i + 1], vec![])).collect(),
-            vec![0],
-            vec![n],
-        );
-        refused(&m, "too much work");
-    }
-
-    #[test]
-    fn memory_alive_at_once_is_bounded() {
-        // Five outputs of 2²⁷ values each, all kept, besides the input.
-        let m = model(
-            vec![],
-            (0..6).map(|_| (vec![1, 1 << 27], FLOAT32, None)).collect(),
-            (1..6).map(|i| (op::RELU, vec![0], vec![i], vec![])).collect(),
-            vec![0],
-            (1..6).collect(),
-        );
-        refused(&m, "too much memory");
-    }
-
-    #[test]
-    fn shapes_computed_at_run_time_must_match_the_declared_ones() {
-        // PAD to 2³⁰ × 2³⁰ while declaring a 1×1 output.
-        let pads = vec![0, 1 << 30, 0, 1 << 30].into_iter().flat_map(i32::to_le_bytes).collect();
-        let pad = model(
-            vec![pads],
-            vec![(vec![1, 1], FLOAT32, None), (vec![2, 2], INT32, Some(0)), (vec![1, 1], FLOAT32, None)],
-            vec![(op::PAD, vec![0, 1], vec![2], vec![])],
-            vec![0],
-            vec![2],
-        );
-        refused(&pad, "padding disagrees");
-        // Many large parts concatenated into a small declared output.
-        let concat = model(
-            vec![],
-            vec![(vec![1, 1 << 27], FLOAT32, None), (vec![1, 2], FLOAT32, None)],
-            vec![(op::CONCATENATION, vec![0; 64], vec![1], vec![(0, V::Int(1))])],
-            vec![0],
-            vec![1],
-        );
-        refused(&concat, "parts disagree");
-        // A pool whose output claims more channels than its input has.
-        let pool = model(
-            vec![],
-            vec![(vec![1, 2, 2, 1], FLOAT32, None), (vec![1, 1, 1, 1 << 20], FLOAT32, None)],
-            vec![(op::MAX_POOL_2D, vec![0], vec![1], window_opts(1, 2).into_iter().chain([(3, V::Int(2)), (4, V::Int(2))]).collect())],
-            vec![0],
-            vec![1],
-        );
-        refused(&pool, "changes the channels");
-        // Dimensions may not hide behind a zero.
-        let zero = model(vec![], vec![(vec![0, 1 << 30, 1 << 30], FLOAT32, None)], vec![], vec![0], vec![0]);
-        refused(&zero, "tensor is too large");
-    }
-
-    #[test]
-    fn shared_weights_count_once_per_use() {
-        // One 128 KB buffer decoded for 2100 tensors would be 2100 copies of 2¹⁶ floats.
-        let m = model(vec![vec![0; 2 << 16]], (0..2100).map(|_| (vec![1, 1 << 16], FLOAT16, Some(0))).collect(), vec![], vec![], vec![]);
-        refused(&m, "weights are too large");
-    }
-
-    /// The official face models (`EFFECTCRAFT_FACE_LANDMARKER` = path to `face_landmarker.task`)
-    /// fit every budget with wide headroom.
-    #[test]
-    fn official_face_models_fit_the_budgets() {
-        let Some(path) = std::env::var_os("EFFECTCRAFT_FACE_LANDMARKER") else { return };
-        let bytes = std::fs::read(path).unwrap();
-        for name in [crate::mediapipe::DETECTOR, crate::mediapipe::MESH] {
-            let c = Model::read(&crate::pt::zip_file(&bytes, name).unwrap()).unwrap().cost().unwrap();
-            println!("{name}: {c:?}");
-            assert!(c.macs <= MAX_MACS / 8 && c.values <= MAX_VALUES / 8 && c.live <= MAX_LIVE / 8 && c.scratch <= MAX_SCRATCH / 8, "{name}: {c:?}");
-            assert!(c.kernel <= MAX_KERNEL as u64 / 4, "{name}: {c:?}");
-        }
-    }
-}
+mod tests;
diff --git a/crates/segment/src/tflite/tests.rs b/crates/segment/src/tflite/tests.rs
new file mode 100644
index 000000000..29a781d34
--- /dev/null
+++ b/crates/segment/src/tflite/tests.rs
@@ -0,0 +1,356 @@
+use super::*;
+
+#[test]
+fn same_padding_matches_tensorflow() {
+    // TensorFlow pads the extra row after: 128 → 64 with a 3×3 stride-2 window pads 0 before.
+    assert_eq!(same(128, 3, 2), (64, 0));
+    assert_eq!(same(128, 5, 2), (64, 1));
+    assert_eq!(same(16, 3, 1), (16, 1));
+    assert_eq!(same(7, 2, 2), (4, 0));
+    assert_eq!(window(1, 4, 2, 2), Ok((2, 0)));
+    assert!(window(1, 1, 2, 2).is_err());
+}
+
+#[test]
+fn asymmetric_conv_padding() {
+    // A 3×3 stride-2 "same" conv on 4×4: pads nothing before, one after.
+    let x: Vec<f32> = (0..16).map(|v| v as f32).collect();
+    let ones = vec![1.0f32; 9];
+    let c = Conv { wt: ones.clone(), b: vec![0.0], inp: 1, out: 1, ks: 3, stride: 2, pad: 0 };
+    let y = c.forward_sized(&x, 4, 4, 2, 2, [0, 0]);
+    // Top-left window rows 0–2, cols 0–2; the bottom-right one is cut by the edge.
+    assert_eq!(y, vec![45.0, 39.0, 66.0, 50.0]);
+    let d = Depthwise { w: ones, b: vec![0.0], c: 1, ks: 3, stride: 2 };
+    assert_eq!(d.forward_sized(&x, 4, 4, 2, 2, [0, 0]), y);
+}
+
+#[test]
+fn pool_pad_and_concat() {
+    let x: Vec<f32> = (0..16).map(|v| v as f32).collect();
+    assert_eq!(max_pool(&x, [4, 4], 1, [2, 2], [2, 2], [2, 2], [0, 0]), vec![5.0, 7.0, 13.0, 15.0]);
+    // Same padding on 3×3 → 2×2: the last window is cut by the edge.
+    let x3: Vec<f32> = (0..9).map(|v| v as f32).collect();
+    assert_eq!(max_pool(&x3, [3, 3], 1, [2, 2], [2, 2], [2, 2], [0, 0]), vec![4.0, 5.0, 7.0, 8.0]);
+    // Channel padding (residual connections widen the channels with zeros).
+    let p = pad(&[1.0, 2.0, 3.0, 4.0], &[1, 1, 2, 2], &[[0, 0], [0, 0], [0, 0], [0, 1]]).unwrap();
+    assert_eq!(p, vec![1.0, 2.0, 0.0, 3.0, 4.0, 0.0]);
+    let p = pad(&[1.0, 2.0], &[1, 2], &[[0, 0], [1, 0]]).unwrap();
+    assert_eq!(p, vec![0.0, 1.0, 2.0]);
+    let a = [1.0, 2.0, 3.0, 4.0];
+    let b = [5.0, 6.0];
+    let (sa, sb) = (vec![1, 2, 2], vec![1, 1, 2]);
+    assert_eq!(concat(&[(&a, &sa), (&b, &sb)], 1).unwrap(), vec![1.0, 2.0, 3.0, 4.0, 5.0, 6.0]);
+    let (sa, sb) = (vec![2, 2], vec![2, 1]);
+    assert_eq!(concat(&[(&a, &sa), (&b, &sb)], 1).unwrap(), vec![1.0, 2.0, 5.0, 3.0, 4.0, 6.0]);
+}
+
+#[test]
+fn damaged_files_are_errors_not_panics() {
+    assert!(Model::read(b"").is_err());
+    assert!(Model::read(&[0xff; 64]).is_err());
+    // Every prefix and a few corruptions of a hand-made buffer.
+    let mut fb = vec![12, 0, 0, 0, 0, 0, 6, 0, 8, 0, 4, 0, 6, 0, 0, 0, 0, 0, 0, 0];
+    for n in 0..fb.len() {
+        let _ = Model::read(&fb[..n]);
+    }
+    for i in 0..fb.len() {
+        fb[i] ^= 0x5a;
+        let _ = Model::read(&fb);
+    }
+}
+
+/// A FlatBuffer value, to build small models in tests.
+enum V {
+    Int(i32),
+    Byte(u8),
+    Table(Vec<(usize, V)>),
+    Ints(Vec<i32>),
+    Bytes(Vec<u8>),
+    Tables(Vec<V>),
+}
+
+fn put_u32(b: &mut [u8], at: usize, v: usize) {
+    b[at..at + 4].copy_from_slice(&(v as u32).to_le_bytes());
+}
+
+/// Append `v` (children after their parent, so every offset points forward); where it starts.
+fn put(b: &mut Vec<u8>, v: &V) -> usize {
+    match v {
+        V::Table(fields) => {
+            let slots = fields.iter().map(|f| f.0 + 1).max().unwrap_or(0);
+            let vt = b.len();
+            let vt_len = 4 + 2 * slots;
+            b.resize(vt + vt_len, 0);
+            let t = b.len();
+            // Every field gets 8 bytes (the reader does not need alignment).
+            let t_len = 4 + 8 * fields.len();
+            b.resize(t + t_len, 0);
+            b[vt..vt + 2].copy_from_slice(&(vt_len as u16).to_le_bytes());
+            b[vt + 2..vt + 4].copy_from_slice(&(t_len as u16).to_le_bytes());
+            b[t..t + 4].copy_from_slice(&((t - vt) as i32).to_le_bytes());
+            for (k, (id, f)) in fields.iter().enumerate() {
+                let at = t + 4 + 8 * k;
+                b[vt + 4 + 2 * id..vt + 6 + 2 * id].copy_from_slice(&((at - t) as u16).to_le_bytes());
+                match f {
+                    V::Int(i) => b[at..at + 4].copy_from_slice(&i.to_le_bytes()),
+                    V::Byte(x) => b[at] = *x,
+                    _ => {
+                        let child = put(b, f);
+                        put_u32(b, at, child - at);
+                    }
+                }
+            }
+            t
+        }
+        V::Ints(xs) => {
+            let p = b.len();
+            b.extend((xs.len() as u32).to_le_bytes());
+            xs.iter().for_each(|x| b.extend(x.to_le_bytes()));
+            p
+        }
+        V::Bytes(xs) => {
+            let p = b.len();
+            b.extend((xs.len() as u32).to_le_bytes());
+            b.extend(xs);
+            p
+        }
+        V::Tables(ts) => {
+            let p = b.len();
+            b.extend((ts.len() as u32).to_le_bytes());
+            let slots = b.len();
+            b.resize(slots + 4 * ts.len(), 0);
+            for (i, t) in ts.iter().enumerate() {
+                let child = put(b, t);
+                put_u32(b, slots + 4 * i, child - (slots + 4 * i));
+            }
+            p
+        }
+        V::Int(_) | V::Byte(_) => b.len(),
+    }
+}
+
+/// A tensor: shape, type and its constant data (`Some(k)`: buffer `k` of the model's).
+type T = (Vec<i32>, u8, Option<usize>);
+/// An operator: code, inputs, outputs and its options' fields.
+type O = (i32, Vec<i32>, Vec<i32>, Vec<(usize, V)>);
+
+/// A `.tflite` file with one graph.
+fn model(bufs: Vec<Vec<u8>>, tensors: Vec<T>, ops: Vec<O>, inputs: Vec<i32>, outputs: Vec<i32>) -> Vec<u8> {
+    let ts = tensors
+        .into_iter()
+        .enumerate()
+        .map(|(i, (shape, ty, buf))| {
+            let mut f = vec![(0, V::Ints(shape)), (1, V::Byte(ty)), (3, V::Bytes(format!("t{i}").into_bytes()))];
+            if let Some(k) = buf {
+                f.push((2, V::Int(k as i32 + 1)));
+            }
+            V::Table(f)
+        })
+        .collect();
+    let mut codes = vec![];
+    let os = ops
+        .into_iter()
+        .map(|(code, ins, outs, opts)| {
+            let idx = codes.iter().position(|&c| c == code).unwrap_or_else(|| {
+                codes.push(code);
+                codes.len() - 1
+            });
+            V::Table(vec![(0, V::Int(idx as i32)), (1, V::Ints(ins)), (2, V::Ints(outs)), (4, V::Table(opts))])
+        })
+        .collect();
+    let g = V::Table(vec![(0, V::Tables(ts)), (1, V::Ints(inputs)), (2, V::Ints(outputs)), (3, V::Tables(os))]);
+    let buffers = std::iter::once(V::Table(vec![])).chain(bufs.into_iter().map(|d| V::Table(vec![(0, V::Bytes(d))]))).collect();
+    let codes = codes.into_iter().map(|c| V::Table(vec![(3, V::Int(c))])).collect();
+    let root = V::Table(vec![(1, V::Tables(codes)), (2, V::Tables(vec![g])), (4, V::Tables(buffers))]);
+    let mut b = vec![0u8; 4];
+    let r = put(&mut b, &root);
+    put_u32(&mut b, 0, r);
+    b
+}
+
+fn f32s(xs: &[f32]) -> Vec<u8> {
+    xs.iter().flat_map(|x| x.to_le_bytes()).collect()
+}
+
+/// Conv2DOptions / Pool2DOptions: padding (0 same, 1 valid) and stride.
+fn window_opts(padding: u8, stride: i32) -> Vec<(usize, V)> {
+    vec![(0, V::Byte(padding)), (1, V::Int(stride)), (2, V::Int(stride))]
+}
+
+fn refused(bytes: &[u8], why: &str) {
+    let e = Model::read(bytes).err().unwrap_or_default();
+    assert!(e.contains(why), "refused for `{e}`, expected `{why}`");
+}
+
+#[test]
+fn built_models_load_and_run() {
+    // A 3×3 stride-2 "same" conv on 4×4, then a RELU: as `asymmetric_conv_padding`.
+    let m = model(
+        vec![f32s(&[1.0; 9])],
+        vec![(vec![1, 4, 4, 1], FLOAT32, None), (vec![1, 3, 3, 1], FLOAT32, Some(0)), (vec![1, 2, 2, 1], FLOAT32, None), (vec![1, 2, 2, 1], FLOAT32, None)],
+        vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 2)), (op::RELU, vec![2], vec![3], vec![])],
+        vec![0],
+        vec![3],
+    );
+    let m = Model::read(&m).unwrap();
+    let c = m.cost().unwrap();
+    assert_eq!((c.macs, c.values, c.scratch, c.kernel), (2 * 2 * 9, 8, 2 * 9, 3));
+    // The input, the conv's output and its patch row, alive together.
+    assert_eq!(c.live, 16 + 4 + 2 * 9);
+    let x: Vec<f32> = (0..16).map(|v| v as f32).collect();
+    assert_eq!(m.run(&[&x]).unwrap(), vec![vec![45.0, 39.0, 66.0, 50.0]]);
+}
+
+/// #368: an 8 KB model whose CONV_2D needed a 512 GB scratch buffer aborted `run`.
+#[test]
+fn convolution_scratch_is_bounded() {
+    let w = 1 << 25;
+    let bomb = model(
+        vec![vec![0; 2 * 64 * 64]],
+        vec![(vec![1, 1, w, 1], FLOAT32, None), (vec![1, 64, 64, 1], FLOAT16, Some(0)), (vec![1, 1, w, 1], FLOAT32, None)],
+        vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
+        vec![0],
+        vec![2],
+    );
+    refused(&bomb, "kernel is too large");
+    // A small kernel over many channels: the patch row is `ow·3·3·cin`.
+    let (w, cin) = (1 << 20, 256);
+    let wide = model(
+        vec![vec![0; 2 * 9 * 256]],
+        vec![(vec![1, 1, w, cin], FLOAT32, None), (vec![1, 3, 3, cin], FLOAT16, Some(0)), (vec![1, 1, w, 1], FLOAT32, None)],
+        vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
+        vec![0],
+        vec![2],
+    );
+    refused(&wide, "working space is too large");
+}
+
+#[test]
+fn kernel_sides_are_bounded() {
+    let k = MAX_KERNEL as i32 + 1;
+    let conv = model(
+        vec![vec![0; 2 * (k * k) as usize]],
+        vec![(vec![1, 40, 40, 1], FLOAT32, None), (vec![1, k, k, 1], FLOAT16, Some(0)), (vec![1, 40, 40, 1], FLOAT32, None)],
+        vec![(op::CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
+        vec![0],
+        vec![2],
+    );
+    refused(&conv, "kernel is too large");
+    let depthwise = model(
+        vec![vec![0; 2 * (k * k) as usize]],
+        vec![(vec![1, 40, 40, 1], FLOAT32, None), (vec![1, k, k, 1], FLOAT16, Some(0)), (vec![1, 40, 40, 1], FLOAT32, None)],
+        vec![(op::DEPTHWISE_CONV_2D, vec![0, 1, -1], vec![2], window_opts(0, 1))],
+        vec![0],
+        vec![2],
+    );
+    refused(&depthwise, "kernel is too large");
+    // A "same" pool takes any window: a huge one looped for billions of steps per output.
+    let mut opts = window_opts(0, 1);
+    opts.extend([(3, V::Int(i32::MAX)), (4, V::Int(i32::MAX))]);
+    let pool = model(
+        vec![],
+        vec![(vec![1, 8, 8, 1], FLOAT32, None), (vec![1, 8, 8, 1], FLOAT32, None)],
+        vec![(op::MAX_POOL_2D, vec![0], vec![1], opts)],
+        vec![0],
+        vec![1],
+    );
+    refused(&pool, "pooling window is too large");
+}
+
+#[test]
+fn multiply_adds_are_bounded() {
+    // Three 16 → 16 pointwise convolutions over 4096×4096: 3·2³² multiply-adds.
+    let s = vec![1, 4096, 4096, 16];
+    let t = |buf| (s.clone(), FLOAT32, buf);
+    let m = model(
+        vec![vec![0; 2 * 16 * 16]],
+        vec![t(None), (vec![16, 1, 1, 16], FLOAT16, Some(0)), t(None), t(None), t(None)],
+        (0..3).map(|i| (op::CONV_2D, vec![if i == 0 { 0 } else { i + 1 }, 1, -1], vec![i + 2], window_opts(0, 1))).collect(),
+        vec![0],
+        vec![4],
+    );
+    refused(&m, "too many multiply-adds");
+}
+
+/// #368: 2000 RELUs over 2²⁵ values loaded fine, and one run took minutes.
+#[test]
+fn elementwise_work_is_bounded() {
+    let n = 2000;
+    let m = model(
+        vec![],
+        (0..=n).map(|_| (vec![1, 1 << 25], FLOAT32, None)).collect(),
+        (0..n).map(|i| (op::RELU, vec![i], vec![i + 1], vec![])).collect(),
+        vec![0],
+        vec![n],
+    );
+    refused(&m, "too much work");
+}
+
+#[test]
+fn memory_alive_at_once_is_bounded() {
+    // Five outputs of 2²⁷ values each, all kept, besides the input.
+    let m = model(
+        vec![],
+        (0..6).map(|_| (vec![1, 1 << 27], FLOAT32, None)).collect(),
+        (1..6).map(|i| (op::RELU, vec![0], vec![i], vec![])).collect(),
+        vec![0],
+        (1..6).collect(),
+    );
+    refused(&m, "too much memory");
+}
+
+#[test]
+fn shapes_computed_at_run_time_must_match_the_declared_ones() {
+    // PAD to 2³⁰ × 2³⁰ while declaring a 1×1 output.
+    let pads = vec![0, 1 << 30, 0, 1 << 30].into_iter().flat_map(i32::to_le_bytes).collect();
+    let pad = model(
+        vec![pads],
+        vec![(vec![1, 1], FLOAT32, None), (vec![2, 2], INT32, Some(0)), (vec![1, 1], FLOAT32, None)],
+        vec![(op::PAD, vec![0, 1], vec![2], vec![])],
+        vec![0],
+        vec![2],
+    );
+    refused(&pad, "padding disagrees");
+    // Many large parts concatenated into a small declared output.
+    let concat = model(
+        vec![],
+        vec![(vec![1, 1 << 27], FLOAT32, None), (vec![1, 2], FLOAT32, None)],
+        vec![(op::CONCATENATION, vec![0; 64], vec![1], vec![(0, V::Int(1))])],
+        vec![0],
+        vec![1],
+    );
+    refused(&concat, "parts disagree");
+    // A pool whose output claims more channels than its input has.
+    let pool = model(
+        vec![],
+        vec![(vec![1, 2, 2, 1], FLOAT32, None), (vec![1, 1, 1, 1 << 20], FLOAT32, None)],
+        vec![(op::MAX_POOL_2D, vec![0], vec![1], window_opts(1, 2).into_iter().chain([(3, V::Int(2)), (4, V::Int(2))]).collect())],
+        vec![0],
+        vec![1],
+    );
+    refused(&pool, "changes the channels");
+    // Dimensions may not hide behind a zero.
+    let zero = model(vec![], vec![(vec![0, 1 << 30, 1 << 30], FLOAT32, None)], vec![], vec![0], vec![0]);
+    refused(&zero, "tensor is too large");
+}
+
+#[test]
+fn shared_weights_count_once_per_use() {
+    // One 128 KB buffer decoded for 2100 tensors would be 2100 copies of 2¹⁶ floats.
+    let m = model(vec![vec![0; 2 << 16]], (0..2100).map(|_| (vec![1, 1 << 16], FLOAT16, Some(0))).collect(), vec![], vec![], vec![]);
+    refused(&m, "weights are too large");
+}
+
+/// The official face models (`EFFECTCRAFT_FACE_LANDMARKER` = path to `face_landmarker.task`)
+/// fit every budget with wide headroom.
+#[test]
+fn official_face_models_fit_the_budgets() {
+    let Some(path) = std::env::var_os("EFFECTCRAFT_FACE_LANDMARKER") else { return };
+    let bytes = std::fs::read(path).unwrap();
+    for name in [crate::mediapipe::DETECTOR, crate::mediapipe::MESH] {
+        let c = Model::read(&crate::pt::zip_file(&bytes, name).unwrap()).unwrap().cost().unwrap();
+        println!("{name}: {c:?}");
+        assert!(c.macs <= MAX_MACS / 8 && c.values <= MAX_VALUES / 8 && c.live <= MAX_LIVE / 8 && c.scratch <= MAX_SCRATCH / 8, "{name}: {c:?}");
+        assert!(c.kernel <= MAX_KERNEL as u64 / 4, "{name}: {c:?}");
+    }
+}
diff --git a/crates/svg/src/color.rs b/crates/svg/src/color.rs
index ba4183e75..9ef5faa0a 100644
--- a/crates/svg/src/color.rs
+++ b/crates/svg/src/color.rs
@@ -179,7 +179,11 @@ pub fn parse_color(s: &str) -> Option<[f64; 4]> {
             return None;
         }
         let comp = |t: &str| -> Option<f64> {
-            Some(if let Some(p) = t.strip_suffix('%') { p.trim().parse::<f64>().ok()? / 100.0 } else { t.parse::<f64>().ok()? / 255.0 })
+            Some(if let Some(p) = t.strip_suffix('%') {
+                p.trim().parse::<f64>().ok().filter(|v| v.is_finite())? / 100.0
+            } else {
+                t.parse::<f64>().ok().filter(|v| v.is_finite())? / 255.0
+            })
         };
         let alpha = a.get(3).map_or(Some(1.0), |t| alpha(t))?;
         return Some([comp(a[0])?.clamp(0.0, 1.0), comp(a[1])?.clamp(0.0, 1.0), comp(a[2])?.clamp(0.0, 1.0), alpha]);
@@ -189,9 +193,9 @@ pub fn parse_color(s: &str) -> Option<[f64; 4]> {
         if a.len() < 3 {
             return None;
         }
-        let h = a[0].trim_end_matches("deg").parse::<f64>().ok()?.rem_euclid(360.0) / 360.0;
-        let s = a[1].trim_end_matches('%').parse::<f64>().ok()?.clamp(0.0, 100.0) / 100.0;
-        let l = a[2].trim_end_matches('%').parse::<f64>().ok()?.clamp(0.0, 100.0) / 100.0;
+        let h = a[0].trim_end_matches("deg").parse::<f64>().ok().filter(|v| v.is_finite())?.rem_euclid(360.0) / 360.0;
+        let s = a[1].trim_end_matches('%').parse::<f64>().ok().filter(|v| v.is_finite())?.clamp(0.0, 100.0) / 100.0;
+        let l = a[2].trim_end_matches('%').parse::<f64>().ok().filter(|v| v.is_finite())?.clamp(0.0, 100.0) / 100.0;
         let al = a.get(3).map_or(Some(1.0), |t| alpha(t))?;
         let [r, g, b] = hsl(h, s, l);
         return Some([r, g, b, al]);
@@ -208,7 +212,14 @@ fn split_args(s: &str) -> Vec<&str> {
 }
 
 fn alpha(t: &str) -> Option<f64> {
-    Some(if let Some(p) = t.strip_suffix('%') { p.parse::<f64>().ok()? / 100.0 } else { t.parse::<f64>().ok()? }.clamp(0.0, 1.0))
+    Some(
+        if let Some(p) = t.strip_suffix('%') {
+            p.parse::<f64>().ok().filter(|v| v.is_finite())? / 100.0
+        } else {
+            t.parse::<f64>().ok().filter(|v| v.is_finite())?
+        }
+        .clamp(0.0, 1.0),
+    )
 }
 
 /// CSS HSL → RGB (CSS Color 3 §4.2.4).
@@ -239,6 +250,22 @@ fn hsl(h: f64, s: f64, l: f64) -> [f64; 3] {
 mod tests {
     use super::parse_color;
 
+    #[test]
+    fn non_finite_rejected() {
+        for s in [
+            "rgb(nan,0,0)",
+            "rgb(inf,0,0)",
+            "rgba(0,0,0,nan)",
+            "rgba(0,0,0,inf)",
+            "hsl(nan,100%,50%)",
+            "hsl(120,nan%,50%)",
+            "hsl(120,100%,inf%)",
+            "hsl(120,100%,50%,nan)",
+        ] {
+            assert_eq!(parse_color(s), None, "{s}");
+        }
+    }
+
     #[test]
     fn colors() {
         assert_eq!(parse_color("#f00"), Some([1.0, 0.0, 0.0, 1.0]));
diff --git a/crates/svg/src/lib.rs b/crates/svg/src/lib.rs
index 24cc584e0..95c00a91a 100644
--- a/crates/svg/src/lib.rs
+++ b/crates/svg/src/lib.rs
@@ -392,7 +392,17 @@ enum PaintRef {
     Current,
 }
 
-/// A CSS rule: selector (type, class, id; `*`) with its specificity and declarations.
+/// The most selectors (each entry of a comma list counts) the `<style>` sheets of a document may
+/// hold (#2140).
+const MAX_CSS_SELECTORS: usize = 20_000;
+/// The most declarations the `<style>` sheets of a document may hold, each block counted once.
+const MAX_CSS_DECLARATIONS: usize = 50_000;
+
+/// The most matching work (candidate rules checked plus declarations applied) the elements of a
+/// document may cost, `<use>` copies included: a bound on elements x rules x declarations.
+const MAX_CSS_WORK: usize = 50_000_000;
+
+/// A CSS rule: selector (type, class, id; `*`) with its specificity and declaration block.
 #[derive(Clone, Debug)]
 struct Rule {
     tag: Option<String>,
@@ -400,7 +410,39 @@ struct Rule {
     id: Option<String>,
     specificity: u32,
     order: usize,
-    decls: Vec<(String, String)>,
+    /// Index into [`StyleSheet::blocks`]: every selector of a comma list shares one block.
+    block: usize,
+}
+
+/// The rules of a document's `<style>` sheets, indexed by the part of the selector an element
+/// must have (id, else first class, else type) so an element only checks rules that can match.
+#[derive(Default, Debug)]
+struct StyleSheet {
+    rules: Vec<Rule>,
+    blocks: Vec<Vec<(String, String)>>,
+    /// Declarations over all blocks.
+    decls: usize,
+    by_id: HashMap<String, Vec<usize>>,
+    by_class: HashMap<String, Vec<usize>>,
+    by_tag: HashMap<String, Vec<usize>>,
+    universal: Vec<usize>,
+}
+
+impl StyleSheet {
+    fn index(&mut self) {
+        for (i, r) in self.rules.iter().enumerate() {
+            let bucket = if let Some(id) = &r.id {
+                self.by_id.entry(id.clone()).or_default()
+            } else if let Some(c) = r.classes.first() {
+                self.by_class.entry(c.clone()).or_default()
+            } else if let Some(t) = &r.tag {
+                self.by_tag.entry(t.clone()).or_default()
+            } else {
+                &mut self.universal
+            };
+            bucket.push(i);
+        }
+    }
 }
 
 fn parse_decls(s: &str) -> Vec<(String, String)> {
@@ -428,57 +470,101 @@ fn strip_comments(s: &str) -> String {
     out
 }
 
-fn parse_css(css: &str, rules: &mut Vec<Rule>) {
+/// Splits one simple selector (`tag.class#id`) into its tag, classes and id.
+fn parse_compound(one: &str) -> (Option<String>, Vec<String>, Option<String>) {
+    let mut tag = None;
+    let mut classes = vec![];
+    let mut id = None;
+    let mut cur = String::new();
+    let mut kind = 't';
+    let flush = |kind: char, cur: &mut String, tag: &mut Option<String>, classes: &mut Vec<String>, id: &mut Option<String>| {
+        if !cur.is_empty() {
+            match kind {
+                '.' => classes.push(std::mem::take(cur)),
+                '#' => *id = Some(std::mem::take(cur)),
+                _ => {
+                    if cur != "*" {
+                        *tag = Some(std::mem::take(cur));
+                    }
+                    cur.clear();
+                }
+            }
+        }
+    };
+    for c in one.chars() {
+        if c == '.' || c == '#' {
+            flush(kind, &mut cur, &mut tag, &mut classes, &mut id);
+            kind = c;
+        } else {
+            cur.push(c);
+        }
+    }
+    flush(kind, &mut cur, &mut tag, &mut classes, &mut id);
+    (tag, classes, id)
+}
+
+/// Add the rules of one `<style>` sheet. Errs once the sheets exceed [`MAX_CSS_SELECTORS`] or
+/// [`MAX_CSS_DECLARATIONS`] (#2140).
+fn parse_css(css: &str, sheet: &mut StyleSheet) -> Result<(), Error> {
     let css = strip_comments(css);
     let mut rest = css.as_str();
     while let Some(open) = rest.find('{') {
         let sel = rest[..open].trim();
+        if sel.starts_with('@') {
+            // Skip the whole at-rule block, matching nested braces by depth.
+            let mut depth = 0usize;
+            let mut end = None;
+            for (i, c) in rest[open..].char_indices() {
+                match c {
+                    '{' => depth = depth.saturating_add(1),
+                    '}' => {
+                        depth = depth.saturating_sub(1);
+                        if depth == 0 {
+                            end = Some(open + i + 1);
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+            let Some(end) = end else { break };
+            rest = &rest[end..];
+            continue;
+        }
         let Some(close) = rest[open..].find('}') else { break };
         let body = &rest[open + 1..open + close];
         rest = &rest[open + close + 1..];
-        if sel.starts_with('@') {
-            continue;
+        let mut decls = parse_decls(body);
+        sheet.decls = sheet.decls.saturating_add(decls.len());
+        if sheet.decls > MAX_CSS_DECLARATIONS {
+            return Err(Error::Xml(format!("its <style> sheets hold more than {MAX_CSS_DECLARATIONS} declarations")));
         }
-        let decls = parse_decls(body);
+        // Stored with the rule's first accepted selector: a rule of unsupported selectors only
+        // (`a b{}`, repeated) adds no block.
+        let mut block = None;
         for one in sel.split(',') {
             let one = one.trim();
             // Only simple selectors (no combinators / pseudo-classes / attributes).
             if one.is_empty() || one.contains([' ', '>', '+', '~', ':', '[']) {
                 continue;
             }
-            let mut tag = None;
-            let mut classes = vec![];
-            let mut id = None;
-            let mut cur = String::new();
-            let mut kind = 't';
-            let flush = |kind: char, cur: &mut String, tag: &mut Option<String>, classes: &mut Vec<String>, id: &mut Option<String>| {
-                if !cur.is_empty() {
-                    match kind {
-                        '.' => classes.push(std::mem::take(cur)),
-                        '#' => *id = Some(std::mem::take(cur)),
-                        _ => {
-                            if cur != "*" {
-                                *tag = Some(std::mem::take(cur));
-                            }
-                            cur.clear();
-                        }
-                    }
-                }
-            };
-            for c in one.chars() {
-                if c == '.' || c == '#' {
-                    flush(kind, &mut cur, &mut tag, &mut classes, &mut id);
-                    kind = c;
-                } else {
-                    cur.push(c);
-                }
+            if sheet.rules.len() >= MAX_CSS_SELECTORS {
+                return Err(Error::Xml(format!("its <style> sheets hold more than {MAX_CSS_SELECTORS} selectors")));
             }
-            flush(kind, &mut cur, &mut tag, &mut classes, &mut id);
-            let specificity = id.is_some() as u32 * 100 + classes.len() as u32 * 10 + tag.is_some() as u32;
-            let order = rules.len();
-            rules.push(Rule { tag, classes, id, specificity, order, decls: decls.clone() });
+            let block = *block.get_or_insert_with(|| {
+                let i = sheet.blocks.len();
+                sheet.blocks.push(std::mem::take(&mut decls));
+                i
+            });
+            let (tag, classes, id) = parse_compound(one);
+            let specificity = (id.is_some() as u32 * 100)
+                .saturating_add(u32::try_from(classes.len()).unwrap_or(u32::MAX).saturating_mul(10))
+                .saturating_add(tag.is_some() as u32);
+            let order = sheet.rules.len();
+            sheet.rules.push(Rule { tag, classes, id, specificity, order, block });
         }
     }
+    Ok(())
 }
 
 const PROPS: &[&str] = &[
@@ -505,7 +591,9 @@ const PROPS: &[&str] = &[
 
 struct Parser<'a, 'i> {
     ids: HashMap<String, roxmltree::Node<'a, 'i>>,
-    rules: Vec<Rule>,
+    css: StyleSheet,
+    /// CSS matching work done so far; past [`MAX_CSS_WORK`] rules stop applying and the import errs.
+    css_work: std::cell::Cell<usize>,
     vw: f64,
     vh: f64,
     skipped: Vec<String>,
@@ -531,24 +619,7 @@ impl<'a, 'i> Parser<'a, 'i> {
                 out.insert(a.name().to_string(), a.value().to_string());
             }
         }
-        let tag = n.tag_name().name();
-        let classes: Vec<&str> = n.attribute("class").map(|c| c.split_whitespace().collect()).unwrap_or_default();
-        let id = n.attribute("id");
-        let mut matching: Vec<&Rule> = self
-            .rules
-            .iter()
-            .filter(|r| {
-                r.tag.as_deref().is_none_or(|t| t == tag)
-                    && r.id.as_deref().is_none_or(|i| Some(i) == id)
-                    && r.classes.iter().all(|c| classes.contains(&c.as_str()))
-            })
-            .collect();
-        matching.sort_by_key(|r| (r.specificity, r.order));
-        for r in matching {
-            for (k, v) in &r.decls {
-                out.insert(k.clone(), v.clone());
-            }
-        }
+        self.apply_rules(n, &mut out);
         if let Some(st) = n.attribute("style") {
             for (k, v) in parse_decls(st) {
                 out.insert(k, v);
@@ -557,6 +628,59 @@ impl<'a, 'i> Parser<'a, 'i> {
         out
     }
 
+    /// Charge `n` units of CSS work; false once the budget is spent.
+    fn charge_css(&self, n: usize) -> bool {
+        let w = self.css_work.get().saturating_add(n);
+        self.css_work.set(w);
+        w <= MAX_CSS_WORK
+    }
+
+    /// Apply the matching `<style>` rules to `out`, by specificity then source order.
+    fn apply_rules(&self, n: roxmltree::Node, out: &mut HashMap<String, String>) {
+        let css = &self.css;
+        if css.rules.is_empty() {
+            return;
+        }
+        // Splitting and sorting the class list is work too: charge its length first.
+        let class = n.attribute("class").unwrap_or_default();
+        if !self.charge_css(class.len()) {
+            return;
+        }
+        let tag = n.tag_name().name();
+        let mut classes: Vec<&str> = class.split_whitespace().collect();
+        classes.sort_unstable();
+        classes.dedup();
+        let id = n.attribute("id");
+        // Each rule sits in exactly one bucket and the classes are distinct: no rule twice.
+        let mut buckets: Vec<&Vec<usize>> = vec![&css.universal];
+        buckets.extend(id.and_then(|i| css.by_id.get(i)));
+        buckets.extend(classes.iter().filter_map(|c| css.by_class.get(*c)));
+        buckets.extend(css.by_tag.get(tag));
+        if !self.charge_css(buckets.iter().map(|b| b.len()).fold(0, usize::saturating_add)) {
+            return;
+        }
+        let candidates = || buckets.iter().flat_map(|b| b.iter()).filter_map(|&i| css.rules.get(i));
+        // A selector like `.z.z.z…` checks each of its classes: charge them too.
+        if !self.charge_css(candidates().map(|r| r.classes.len()).fold(0, usize::saturating_add)) {
+            return;
+        }
+        let mut matching: Vec<&Rule> = candidates()
+            .filter(|r| {
+                r.tag.as_deref().is_none_or(|t| t == tag)
+                    && r.id.as_deref().is_none_or(|i| Some(i) == id)
+                    && r.classes.iter().all(|c| classes.binary_search(&c.as_str()).is_ok())
+            })
+            .collect();
+        matching.sort_by_key(|r| (r.specificity, r.order));
+        let blocks: Vec<&Vec<(String, String)>> = matching.iter().filter_map(|r| css.blocks.get(r.block)).collect();
+        if !self.charge_css(blocks.iter().map(|b| b.len()).fold(0, usize::saturating_add)) {
+            return;
+        }
+        for (k, v) in blocks.into_iter().flatten() {
+            out.insert(k.clone(), v.clone());
+        }
+    }
+
     fn length(&self, s: &str, axis: char, font: f64) -> Option<f64> {
         let s = s.trim();
         let num_end = s.find(|c: char| !(c.is_ascii_digit() || matches!(c, '.' | '-' | '+' | 'e' | 'E'))).unwrap_or(s.len());
@@ -621,7 +745,11 @@ impl<'a, 'i> Parser<'a, 'i> {
         if let Some(c) = d.get("color").and_then(|v| parse_color(v)) {
             st.color = c;
         }
-        if let Some(v) = d.get("font-size").and_then(|v| self.length(v, 'o', st.font_size)) {
+        let font_size = d.get("font-size").and_then(|v| match v.trim().strip_suffix('%') {
+            Some(p) => p.trim().parse::<f64>().ok().map(|p| p / 100.0 * st.font_size),
+            None => self.length(v, 'o', st.font_size),
+        });
+        if let Some(v) = font_size.filter(|v| v.is_finite()) {
             st.font_size = v;
         }
         if let Some(p) = d.get("fill").and_then(|v| self.paint_ref(v)) {
@@ -1133,6 +1261,10 @@ fn xml_depth(text: &str) -> usize {
     max
 }
 
+/// Nodes a document may expand to: a few kilobytes of nested internal entities
+/// (`<!ENTITY b "&a;&a;…">`) otherwise expand to millions and exhaust memory.
+const MAX_XML_NODES: u32 = 4_000_000;
+
 /// Parse an SVG document.
 pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
     let text = String::from_utf8_lossy(bytes);
@@ -1140,27 +1272,39 @@ pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
     if xml_depth(text) > MAX_XML_DEPTH {
         return Err(Error::Xml(format!("elements nested more than {MAX_XML_DEPTH} levels deep")));
     }
-    let opts = roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() };
+    // DTDs stay allowed (Illustrator's SVGs declare entities), but expansion is bounded (#2129).
+    let opts = roxmltree::ParsingOptions { allow_dtd: true, nodes_limit: MAX_XML_NODES, ..Default::default() };
     let xml = roxmltree::Document::parse_with_options(text, opts).map_err(|e| Error::Xml(e.to_string()))?;
     let root = xml.root_element();
     if root.tag_name().name() != "svg" {
         return Err(Error::NotSvg);
     }
     let mut ids = HashMap::new();
-    let mut rules = vec![];
+    let mut css = StyleSheet::default();
     for n in root.descendants().filter(|n| n.is_element()) {
         if let Some(id) = n.attribute("id") {
             ids.entry(id.to_string()).or_insert(n);
         }
         if n.tag_name().name() == "style" {
-            let css: String = n.children().filter_map(|c| c.text()).collect();
-            parse_css(&css, &mut rules);
+            let text: String = n.children().filter_map(|c| c.text()).collect();
+            parse_css(&text, &mut css)?;
         }
     }
+    css.index();
     let vb = viewbox(root);
     // Room for generous reuse, and always for every element of the file itself.
     let budget = MAX_EXPANDED_ELEMENTS.max(root.descendants().filter(|n| n.is_element()).count().saturating_mul(2));
-    let mut p = Parser { ids, rules, vw: vb.map_or(300.0, |v| v.1), vh: vb.map_or(150.0, |v| v.2), skipped: vec![], work: 0, budget, using: vec![] };
+    let mut p = Parser {
+        ids,
+        css,
+        css_work: std::cell::Cell::new(0),
+        vw: vb.map_or(300.0, |v| v.1),
+        vh: vb.map_or(150.0, |v| v.2),
+        skipped: vec![],
+        work: 0,
+        budget,
+        using: vec![],
+    };
     let st = Style::default();
     let pct_or = |name: &str, axis: char, def: f64| -> f64 {
         match root.attribute(name) {
@@ -1200,6 +1344,10 @@ pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
         // Never a silently partial drawing.
         return Err(Error::Xml(format!("its <use> references expand to more than {} elements", p.budget)));
     }
+    if p.css_work.get() > MAX_CSS_WORK {
+        // Never a silently unstyled drawing.
+        return Err(Error::Xml(format!("matching its <style> rules takes more than {MAX_CSS_WORK} steps")));
+    }
     let transform = viewbox_transform(root, dw, dh);
     Ok(Doc {
         width: dw,
diff --git a/crates/svg/src/pathdata.rs b/crates/svg/src/pathdata.rs
index c8fa7f67f..7a2762db7 100644
--- a/crates/svg/src/pathdata.rs
+++ b/crates/svg/src/pathdata.rs
@@ -226,9 +226,18 @@ fn segment(l: &mut Lex, c: u8, base: Vec2, p: &mut BezPath, cur: &mut Point, las
             let sweep = l.flag()?;
             let e = pt(l)?;
             let arc = SvgArc { from: *cur, to: e, radii: Vec2::new(rx, ry), x_rotation: rot.to_radians(), large_arc: large, sweep };
-            match kurbo::Arc::from_svg_arc(&arc) {
-                Some(a) => a.to_cubic_beziers(0.1, |c1, c2, end| p.curve_to(c1, c2, end)),
-                None => p.line_to(e),
+            let mut last_end = None;
+            if let Some(a) = kurbo::Arc::from_svg_arc(&arc) {
+                // Scale tolerance with the radius so the segment count stays bounded.
+                let tol = 0.1_f64.max(a.radii.x.max(a.radii.y) * 1e-4);
+                a.to_cubic_beziers(tol, |c1, c2, end| {
+                    p.curve_to(c1, c2, end);
+                    last_end = Some(end);
+                });
+            }
+            // Degenerate arcs (e.g. huge radii) may emit nothing or stop short of the end point.
+            if last_end.is_none_or(|q| (q - e).hypot() > 1e-3 * (1.0 + e.to_vec2().hypot())) {
+                p.line_to(e);
             }
             *cur = e;
             *last_cubic = None;
@@ -261,6 +270,12 @@ mod tests {
     use super::*;
     use kurbo::PathEl;
 
+    #[test]
+    fn huge_arc_radius_stays_bounded() {
+        let p = parse_path_data("M0 0A1e36 1e36 0 1 1 1e30 0");
+        assert!(p.elements().len() < 1000, "got {} elements", p.elements().len());
+    }
+
     #[test]
     fn commands() {
         let p = parse_path_data("M10,10 L20,10 h10 v10 H10 z m5 5 l1-1.5.5.5e1 C 0 0 1 1 2 2 s3 3 4 4 Q1 1 2 2 t3 3 A5 5 0 0 1 20 20 a5 5 0 1010 0");
@@ -294,6 +309,18 @@ mod tests {
         assert!(parse_path_data("M0 0 L10 0 z 9 9").elements().len() <= 4);
     }
 
+    #[test]
+    fn huge_radius_arc_still_reaches_end_point() {
+        for d in ["M0 0 A1e20 1e20 0 0 1 10 0 L10 10", "M0 0 A1e20 1e20 0 1 1 10 0 L10 10", "M0 0 a1e20 1e20 0 0 1 10 0 L10 10"] {
+            let p = parse_path_data(d);
+            let reaches = p.elements().iter().any(|e| match e {
+                PathEl::LineTo(q) | PathEl::CurveTo(_, _, q) => (q.x - 10.0).abs() < 1e-6 && q.y.abs() < 1e-6,
+                _ => false,
+            });
+            assert!(reaches, "{d}: {:?}", p.elements());
+        }
+    }
+
     #[test]
     fn number_lists() {
         assert_eq!(numbers("0 0,100 50"), vec![0.0, 0.0, 100.0, 50.0]);
diff --git a/crates/svg/src/raster.rs b/crates/svg/src/raster.rs
index af59e33db..568b10b25 100644
--- a/crates/svg/src/raster.rs
+++ b/crates/svg/src/raster.rs
@@ -6,7 +6,7 @@ use effectcraft_raster::{Image, Mask};
 use kurbo::{Affine, Point, Shape as _};
 use rayon::prelude::*;
 
-use crate::{BlendMode, Doc, FillRule, Gradient, GradientKind, Group, Node, Paint, Shape, Spread};
+use crate::{BlendMode, Doc, FillRule, Gradient, GradientKind, Group, Node, Paint, Shape, SoftMask, Spread};
 
 fn mat3(a: Affine) -> Mat3 {
     let c = a.as_coeffs();
@@ -20,12 +20,47 @@ pub fn rasterize(doc: &Doc, w: u32, h: u32, scale: f64) -> Image {
 
 /// Rasterise `doc` with `m` mapping document pixels to image pixels.
 pub fn rasterize_with(doc: &Doc, w: u32, h: u32, m: Affine) -> Image {
-    let mut img = Image::new(w, h);
-    draw_group(&doc.root, m, 1.0, &mut img);
+    let mut budget = SurfaceBudget { live_bytes: 0, limit_bytes: MAX_LIVE_SURFACE_BYTES };
+    let Some(mut img) = budget.image(w, h, None) else { return Image::default() };
+    draw_group(&doc.root, m, 1.0, &mut img, &mut budget);
     img
 }
 
-fn draw_group(g: &Group, m: Affine, opacity: f64, dst: &mut Image) {
+/// Bound the simultaneously live offscreen image surfaces created by nested groups.
+const MAX_LIVE_SURFACE_BYTES: usize = 512 * 1024 * 1024;
+
+struct SurfaceBudget {
+    live_bytes: usize,
+    limit_bytes: usize,
+}
+
+impl SurfaceBudget {
+    fn image(&mut self, width: u32, height: u32, copy: Option<&Image>) -> Option<Image> {
+        let pixels = (width as usize).checked_mul(height as usize)?;
+        let bytes = pixels.checked_mul(std::mem::size_of::<[f32; 4]>())?;
+        let new_live = self.live_bytes.checked_add(bytes)?;
+        if new_live > self.limit_bytes {
+            return None;
+        }
+        let mut data = Vec::new();
+        data.try_reserve_exact(pixels).ok()?;
+        data.resize(pixels, [0.0; 4]);
+        if let Some(source) = copy {
+            if source.width != width || source.height != height || source.data.len() != pixels {
+                return None;
+            }
+            data.copy_from_slice(&source.data);
+        }
+        self.live_bytes = new_live;
+        Some(Image { width, height, data })
+    }
+
+    fn release(&mut self, image: &Image) {
+        self.live_bytes = self.live_bytes.saturating_sub(image.data.len().saturating_mul(std::mem::size_of::<[f32; 4]>()));
+    }
+}
+
+fn draw_group(g: &Group, m: Affine, opacity: f64, dst: &mut Image, budget: &mut SurfaceBudget) {
     let m = m * g.transform;
     let o = opacity * g.opacity;
     if o <= 0.0 {
@@ -38,51 +73,41 @@ fn draw_group(g: &Group, m: Affine, opacity: f64, dst: &mut Image) {
         || g.knockout;
     if !offscreen {
         for c in &g.children {
-            draw_node(c, m, o, dst);
+            draw_node(c, m, o, dst, budget);
         }
         return;
     }
+    draw_offscreen_group(g, m, o, dst, budget);
+}
+
+/// Draws a group through an offscreen buffer, then composites it onto `dst`.
+fn draw_offscreen_group(g: &Group, m: Affine, o: f64, dst: &mut Image, budget: &mut SurfaceBudget) {
     let only_clip = g.mask.is_none() && g.blend == BlendMode::Normal && o >= 1.0 && !g.knockout;
     // Draw the children on their own (isolated) or over a copy of the backdrop, keep what
     // every clip path covers and the soft mask lets through, then composite with the group's
     // opacity and blend mode.
-    let backdrop = if g.isolated { None } else { Some(dst.clone()) };
-    let mut tmp = match &backdrop {
-        Some(b) => b.clone(),
-        None => Image::new(dst.width, dst.height),
+    let backdrop = if g.isolated { None } else { budget.image(dst.width, dst.height, Some(dst)) };
+    if !g.isolated && backdrop.is_none() {
+        return;
+    }
+    let Some(mut tmp) = budget.image(dst.width, dst.height, backdrop.as_ref()) else {
+        release_backdrop(budget, backdrop.as_ref());
+        return;
     };
-    draw_children(g, m, &mut tmp, backdrop.as_ref());
+    draw_children(g, m, &mut tmp, backdrop.as_ref(), budget);
     if let Some(b) = &backdrop {
         if only_clip {
             // A non-isolated clipping group: the backdrop where the clip excludes the children.
-            let cov = clip_coverage(g, m, dst.width, dst.height);
-            dst.data.par_iter_mut().zip(tmp.data.par_iter()).zip(cov.par_iter()).for_each(|((d, t), c)| {
-                for i in 0..4 {
-                    d[i] = d[i] * (1.0 - c) + t[i] * c;
-                }
-            });
+            clip_onto_backdrop(g, m, dst, &tmp);
+            budget.release(&tmp);
+            release_backdrop(budget, backdrop.as_ref());
+            return;
+        }
+        if !strip_backdrop(g, m, b, &mut tmp, budget) {
+            budget.release(&tmp);
+            release_backdrop(budget, backdrop.as_ref());
             return;
         }
-        // Remove the backdrop's contribution (ISO 32000-1 §11.4.8): with the group's own
-        // alpha αg (its children alone), C = Cn + (Cn − C0)·(α0/αg − α0).
-        let mut solo = Image::new(dst.width, dst.height);
-        draw_children(g, m, &mut solo, None);
-        tmp.data.par_iter_mut().zip(b.data.par_iter()).zip(solo.data.par_iter()).for_each(|((t, b0), s)| {
-            let ag = s[3];
-            if ag <= 0.0 {
-                *t = [0.0; 4];
-                return;
-            }
-            let un = |c: &[f32; 4]| if c[3] > 0.0 { [c[0] / c[3], c[1] / c[3], c[2] / c[3]] } else { [0.0; 3] };
-            let (cn, c0, a0) = (un(t), un(b0), b0[3]);
-            let k = a0 / ag - a0;
-            let mut out = [0.0; 4];
-            for i in 0..3 {
-                out[i] = (cn[i] + (cn[i] - c0[i]) * k).clamp(0.0, 1.0) * ag;
-            }
-            out[3] = ag;
-            *t = out;
-        });
     }
     if !g.clip.is_empty() {
         let cov = clip_coverage(g, m, dst.width, dst.height);
@@ -92,24 +117,12 @@ fn draw_group(g: &Group, m: Affine, opacity: f64, dst: &mut Image) {
             }
         });
     }
-    if let Some(sm) = &g.mask {
-        let mut mk = Image::new(dst.width, dst.height);
-        draw_group(&sm.content, m, 1.0, &mut mk);
-        let bc = sm.backdrop.map(|v| v as f32);
-        let lum = sm.luminosity;
-        tmp.data.par_iter_mut().zip(mk.data.par_iter()).for_each(|(p, q)| {
-            let k = if lum {
-                // The mask group composited over its backdrop colour, then its luminosity.
-                let c = [0, 1, 2].map(|i| q[i] + bc[i] * (1.0 - q[3]));
-                0.3 * c[0] + 0.59 * c[1] + 0.11 * c[2]
-            } else {
-                q[3]
-            };
-            let k = k.clamp(0.0, 1.0);
-            for v in p.iter_mut() {
-                *v *= k;
-            }
-        });
+    if let Some(sm) = &g.mask
+        && !apply_soft_mask(sm, m, &mut tmp, budget)
+    {
+        budget.release(&tmp);
+        release_backdrop(budget, backdrop.as_ref());
+        return;
     }
     if g.blend == BlendMode::Normal {
         over(dst, &tmp, o as f32);
@@ -123,6 +136,80 @@ fn draw_group(g: &Group, m: Affine, opacity: f64, dst: &mut Image) {
             }
         });
     }
+    budget.release(&tmp);
+    release_backdrop(budget, backdrop.as_ref());
+}
+
+fn release_backdrop(budget: &mut SurfaceBudget, backdrop: Option<&Image>) {
+    if let Some(b) = backdrop {
+        budget.release(b);
+    }
+}
+
+/// A clipping group over a backdrop: the children where the clip covers, the backdrop elsewhere.
+fn clip_onto_backdrop(g: &Group, m: Affine, dst: &mut Image, tmp: &Image) {
+    let cov = clip_coverage(g, m, dst.width, dst.height);
+    dst.data.par_iter_mut().zip(tmp.data.par_iter()).zip(cov.par_iter()).for_each(|((d, t), c)| {
+        for i in 0..4 {
+            d[i] = d[i] * (1.0 - c) + t[i] * c;
+        }
+    });
+}
+
+/// Remove the backdrop's contribution (ISO 32000-1 §11.4.8): with the group's own
+/// alpha αg (its children alone), C = Cn + (Cn − C0)·(α0/αg − α0). Returns false when no
+/// scratch buffer is available.
+fn strip_backdrop(g: &Group, m: Affine, backdrop: &Image, tmp: &mut Image, budget: &mut SurfaceBudget) -> bool {
+    let Some(mut solo) = budget.image(tmp.width, tmp.height, None) else {
+        return false;
+    };
+    draw_children(g, m, &mut solo, None, budget);
+    tmp.data.par_iter_mut().zip(backdrop.data.par_iter()).zip(solo.data.par_iter()).for_each(|((t, b0), s)| {
+        let ag = s[3];
+        if ag <= 0.0 {
+            *t = [0.0; 4];
+            return;
+        }
+        let un = |c: &[f32; 4]| if c[3] > 0.0 { [c[0] / c[3], c[1] / c[3], c[2] / c[3]] } else { [0.0; 3] };
+        let (cn, c0, a0) = (un(t), un(b0), b0[3]);
+        let k = a0 / ag - a0;
+        let mut out = [0.0; 4];
+        for i in 0..3 {
+            out[i] = (cn[i] + (cn[i] - c0[i]) * k).clamp(0.0, 1.0) * ag;
+        }
+        out[3] = ag;
+        *t = out;
+    });
+    budget.release(&solo);
+    drop(solo);
+    true
+}
+
+/// Multiplies the group's pixels by its soft mask. Returns false when no scratch buffer is
+/// available.
+fn apply_soft_mask(sm: &SoftMask, m: Affine, tmp: &mut Image, budget: &mut SurfaceBudget) -> bool {
+    let Some(mut mk) = budget.image(tmp.width, tmp.height, None) else {
+        return false;
+    };
+    draw_group(&sm.content, m, 1.0, &mut mk, budget);
+    let bc = sm.backdrop.map(|v| v as f32);
+    let lum = sm.luminosity;
+    tmp.data.par_iter_mut().zip(mk.data.par_iter()).for_each(|(p, q)| {
+        let k = if lum {
+            // The mask group composited over its backdrop colour, then its luminosity.
+            let c = [0, 1, 2].map(|i| q[i] + bc[i] * (1.0 - q[3]));
+            0.3 * c[0] + 0.59 * c[1] + 0.11 * c[2]
+        } else {
+            q[3]
+        };
+        let k = k.clamp(0.0, 1.0);
+        for v in p.iter_mut() {
+            *v *= k;
+        }
+    });
+    budget.release(&mk);
+    drop(mk);
+    true
 }
 
 /// The product of a group's clip-path coverages.
@@ -142,19 +229,22 @@ fn clip_coverage(g: &Group, m: Affine, w: u32, h: u32) -> Vec<f32> {
 /// Draw a group's children into `dst`. Knockout groups composite each child with the
 /// group's initial backdrop (`backdrop`, or transparent) instead of with the children below:
 /// where the child has shape `f`, `dst = dst·(1 − f) + child + backdrop·(f − αchild)`.
-fn draw_children(g: &Group, m: Affine, dst: &mut Image, backdrop: Option<&Image>) {
+fn draw_children(g: &Group, m: Affine, dst: &mut Image, backdrop: Option<&Image>, budget: &mut SurfaceBudget) {
     if !g.knockout {
         for c in &g.children {
-            draw_node(c, m, 1.0, dst);
+            draw_node(c, m, 1.0, dst, budget);
         }
         return;
     }
     for c in &g.children {
-        let mut ci = Image::new(dst.width, dst.height);
-        draw_node(c, m, 1.0, &mut ci);
+        let Some(mut ci) = budget.image(dst.width, dst.height, None) else { return };
+        draw_node(c, m, 1.0, &mut ci, budget);
         // Shape: the child drawn fully opaque (constant opacities to 1).
-        let mut si = Image::new(dst.width, dst.height);
-        draw_node(&opaque(c), m, 1.0, &mut si);
+        let Some(mut si) = budget.image(dst.width, dst.height, None) else {
+            budget.release(&ci);
+            return;
+        };
+        draw_node(&opaque(c), m, 1.0, &mut si, budget);
         let zero = [0.0f32; 4];
         dst.data.par_iter_mut().enumerate().for_each(|(i, d)| {
             let (cp, f) = (ci.data[i], si.data[i][3].max(ci.data[i][3]));
@@ -166,6 +256,10 @@ fn draw_children(g: &Group, m: Affine, dst: &mut Image, backdrop: Option<&Image>
                 d[k] = d[k] * (1.0 - f) + cp[k] + b[k] * (f - cp[3]);
             }
         });
+        budget.release(&ci);
+        budget.release(&si);
+        drop(ci);
+        drop(si);
     }
 }
 
@@ -299,14 +393,15 @@ fn set_sat(c: [f32; 3], s: f32) -> [f32; 3] {
     c.map(|v| (v - mn) * s / (mx - mn))
 }
 
-fn draw_node(n: &Node, m: Affine, opacity: f64, dst: &mut Image) {
+fn draw_node(n: &Node, m: Affine, opacity: f64, dst: &mut Image, budget: &mut SurfaceBudget) {
     match n {
-        Node::Group(g) => draw_group(g, m, opacity, dst),
+        Node::Group(g) => draw_group(g, m, opacity, dst, budget),
         Node::Shape(s) => {
             if s.opacity < 1.0 && s.fill.is_some() && s.stroke.is_some() {
-                let mut tmp = Image::new(dst.width, dst.height);
+                let Some(mut tmp) = budget.image(dst.width, dst.height, None) else { return };
                 draw_shape(s, m, 1.0, &mut tmp);
                 over(dst, &tmp, (opacity * s.opacity) as f32);
+                budget.release(&tmp);
             } else {
                 draw_shape(s, m, opacity * s.opacity, dst);
             }
@@ -514,12 +609,12 @@ pub(crate) fn eval_stops(stops: &[(f64, [f64; 4])], t: f64) -> [f32; 4] {
     if t <= first.0 {
         return first.1.map(|v| v as f32);
     }
-    for w in stops.windows(2) {
-        let (a, b) = (w[0], w[1]);
-        if t <= b.0 {
-            let k = if b.0 > a.0 { (t - a.0) / (b.0 - a.0) } else { 1.0 };
-            return [0, 1, 2, 3].map(|i| (a.1[i] + (b.1[i] - a.1[i]) * k) as f32);
-        }
-    }
-    stops.last().map_or([0.0; 4], |s| s.1.map(|v| v as f32))
+    // Find the first upper stop (not the last duplicate): equal-offset segments retain the
+    // reference algorithm's exact-boundary behavior, while nearby values are interpolated from
+    // the preceding stop as before.
+    let upper = stops.partition_point(|stop| stop.0 < t);
+    let Some(b) = stops.get(upper) else { return stops.last().map_or([0.0; 4], |s| s.1.map(|v| v as f32)) };
+    let Some(a) = stops.get(upper.saturating_sub(1)) else { return first.1.map(|v| v as f32) };
+    let k = if b.0 > a.0 { (t - a.0) / (b.0 - a.0) } else { 1.0 };
+    [0, 1, 2, 3].map(|i| (a.1[i] + (b.1[i] - a.1[i]) * k) as f32)
 }
diff --git a/crates/svg/src/tests.rs b/crates/svg/src/tests.rs
index 93db715c1..06dfbd333 100644
--- a/crates/svg/src/tests.rs
+++ b/crates/svg/src/tests.rs
@@ -11,6 +11,25 @@ fn near(a: [f32; 4], b: [f32; 4], tol: f32) -> bool {
     (0..4).all(|i| (a[i] - b[i]).abs() <= tol)
 }
 
+#[test]
+fn gradient_stop_lookup_handles_duplicate_offsets() {
+    use crate::raster::eval_stops;
+    let stops = [(0.0, [0.0, 0.0, 0.0, 1.0]), (0.5, [1.0, 0.0, 0.0, 1.0]), (0.5, [0.0, 1.0, 0.0, 1.0]), (1.0, [0.0, 0.0, 1.0, 1.0])];
+    assert_eq!(eval_stops(&stops, 0.5), [1.0, 0.0, 0.0, 1.0]);
+    assert!(near(eval_stops(&stops, 0.5001), [0.0, 1.0, 0.0, 1.0], 3e-4));
+    assert_eq!(eval_stops(&stops, 0.75), [0.0, 0.5, 0.5, 1.0]);
+}
+
+#[test]
+fn raster_surface_budget_rejects_oversized_destination_before_allocation() {
+    let doc = parse(br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+    // 16,384² RGBA-f32 pixels exceed the bounded destination-surface budget; no giant
+    // allocation should be attempted and the caller receives an empty image.
+    let img = rasterize(&doc, 16_384, 16_384, 1.0);
+    assert!(img.data.is_empty());
+    assert_eq!((img.width, img.height), (0, 0));
+}
+
 #[test]
 fn basic_shapes_structure() {
     let d = parse(BASIC).unwrap();
@@ -201,6 +220,18 @@ fn transforms() {
     assert!((p.x - 6.0).abs() < 1e-9 && (p.y - 7.0).abs() < 1e-9);
 }
 
+#[test]
+fn nested_entities_are_refused_instead_of_expanding_without_bound() {
+    // #2129: each top-level `&b;` stays under roxmltree's per-reference cap but adds 12 500
+    // nodes, so 40 KB of references expands to 5 million.
+    let dtd = format!("<!ENTITY a \"{}\"><!ENTITY b \"{}\">", "<g/>".repeat(50), "&a;".repeat(250));
+    let bomb = format!("<?xml version=\"1.0\"?><!DOCTYPE svg [{dtd}]><svg xmlns=\"http://www.w3.org/2000/svg\">{}</svg>", "&b;".repeat(400));
+    assert!(matches!(crate::parse(bomb.as_bytes()), Err(crate::Error::Xml(_))));
+    // An ordinary entity, as Illustrator declares them, still parses.
+    let ok = "<?xml version=\"1.0\"?><!DOCTYPE svg [<!ENTITY w \"40\">]><svg xmlns=\"http://www.w3.org/2000/svg\"><rect width=\"&w;\" height=\"5\"/></svg>";
+    assert!(crate::parse(ok.as_bytes()).is_ok());
+}
+
 #[test]
 fn deep_nesting_errors_instead_of_overflowing_the_stack() {
     // 100 000 nested groups overflowed the XML parser's stack and aborted the process.
@@ -277,3 +308,141 @@ fn a_symbol_used_a_thousand_times_still_imports() {
     let doc = parse(svg.as_bytes()).unwrap();
     assert_eq!(depth_and_shapes(&doc.root).1, 3000);
 }
+
+/// An SVG with one `<style>` sheet and one rectangle per given class list.
+fn styled(css: &str, rects: &[&str]) -> Vec<u8> {
+    let rects: String = rects.iter().map(|attrs| format!(r#"<rect width="1" height="1" {attrs}/>"#)).collect();
+    format!(r#"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><style>{css}</style>{rects}</svg>"#).into_bytes()
+}
+
+#[test]
+fn comma_selector_lists_share_one_declaration_block() {
+    // Before #2140 every selector of a comma list got its own copy of the declaration block, so
+    // `a,a,a…{…}` stored selectors × declarations strings; one selector past the cap is refused.
+    let sels = vec!["rect"; MAX_CSS_SELECTORS + 1].join(",");
+    let decls: String = (0..10).map(|i| format!("p{i}:v;")).collect();
+    let svg = styled(&format!("{sels}{{fill:red;{decls}}}"), &[""]);
+    let e = parse(&svg).unwrap_err();
+    assert!(e.to_string().contains("selectors"), "{e}");
+}
+
+#[test]
+fn a_style_sheet_with_too_many_declarations_errors() {
+    let decls: String = (0..=MAX_CSS_DECLARATIONS).map(|i| format!("p{i}:v;")).collect();
+    let svg = styled(&format!("rect{{{decls}}}"), &[""]);
+    let e = parse(&svg).unwrap_err();
+    assert!(e.to_string().contains("declarations"), "{e}");
+}
+
+#[test]
+fn selector_lists_keep_the_css_cascade() {
+    let green = Some(Paint::Color([0.0, 1.0, 0.0]));
+    let blue = Some(Paint::Color([0.0, 0.0, 1.0]));
+    let red = Some(Paint::Color([1.0, 0.0, 0.0]));
+    let css = "rect, .b, #c { fill: #00ff00 } .b, .d { fill: #0000ff; stroke: #000000; stroke-width: 3 } rect.e, #c { fill: #ff0000 }";
+    let svg = styled(css, &["", r#"class="b""#, r#"id="c" class="b""#, r#"class="b" style="fill:#00ff00""#, r##"class="e" fill="#0000ff""##, r#"class="d""#]);
+    let doc = parse(&svg).unwrap();
+    let shapes = doc.flatten();
+    let fills: Vec<_> = shapes.iter().map(|s| s.2.fill.clone()).collect();
+    // Type selector; class beats type; id beats class; inline style beats every rule; a later,
+    // more specific rule beats the presentation attribute.
+    assert_eq!(fills, vec![green.clone(), blue.clone(), red.clone(), green, red, blue]);
+    assert!(shapes[0].2.stroke.is_none());
+    // The second list's block reaches both of its selectors.
+    for i in [1, 5] {
+        assert_eq!(shapes[i].2.stroke.as_ref().map(|s| s.width), Some(3.0), "shape {i}");
+    }
+}
+
+#[test]
+fn a_comma_list_stores_its_declarations_once() {
+    let sels = vec!["rect"; 1000].join(",");
+    let decls: String = (0..50).map(|i| format!("p{i}:v;")).collect();
+    let mut sheet = StyleSheet::default();
+    parse_css(&format!("{sels}{{{decls}}}"), &mut sheet).unwrap();
+    assert_eq!(sheet.rules.len(), 1000);
+    assert_eq!(sheet.blocks.len(), 1);
+    assert_eq!(sheet.decls, 50);
+}
+
+#[test]
+fn rules_of_unsupported_selectors_store_no_blocks() {
+    let mut sheet = StyleSheet::default();
+    parse_css(&"a b{}".repeat(100_000), &mut sheet).unwrap();
+    parse_css("a b{fill:red} a>b, rect{fill:blue} c:hover, d{fill:red}", &mut sheet).unwrap();
+    assert_eq!(sheet.rules.len(), 2);
+    assert_eq!(sheet.blocks.len(), 2);
+    assert!(sheet.rules.iter().all(|r| sheet.blocks.get(r.block).is_some_and(|b| b.len() == 1)));
+}
+
+#[test]
+fn huge_class_lists_count_against_the_matching_budget() {
+    // One rule, but a 1 MB class attribute re-split on each of 100 `<use>` copies (#2140).
+    let class = "a ".repeat(500_000);
+    let uses: String = (0..100).map(|i| format!(r##"<use href="#r" x="{i}"/>"##)).collect();
+    let svg = |uses: &str| {
+        format!(
+            r##"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><style>.z{{fill:red}}</style><defs><rect id="r" width="1" height="1" class="{class}"/></defs>{uses}</svg>"##
+        )
+    };
+    let e = parse(svg(&uses).as_bytes()).unwrap_err();
+    assert!(e.to_string().contains("<style> rules"), "{e}");
+    let few: String = uses.split_inclusive("/>").take(10).collect();
+    assert!(parse(svg(&few).as_bytes()).is_ok());
+}
+
+#[test]
+fn a_selector_with_many_classes_counts_against_the_matching_budget() {
+    // `.z.z.z…` lands in one class bucket, but each match checks every class it lists.
+    let rule = ".z".repeat(300_000);
+    let uses: String = (0..200).map(|i| format!(r##"<use href="#r" x="{i}"/>"##)).collect();
+    let svg = |uses: &str| {
+        format!(
+            r##"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><style>{rule}{{fill:red}}</style><defs><rect id="r" width="1" height="1" class="z"/></defs>{uses}</svg>"##
+        )
+    };
+    let e = parse(svg(&uses).as_bytes()).unwrap_err();
+    assert!(e.to_string().contains("<style> rules"), "{e}");
+    let few: String = uses.split_inclusive("/>").take(10).collect();
+    assert!(parse(svg(&few).as_bytes()).is_ok());
+}
+
+#[test]
+fn matching_work_past_the_budget_errors_without_doing_it() {
+    // Within both sheet caps, yet one rectangle would apply 10 000 x 5 001 declarations.
+    let sels = vec!["rect"; 10_000].join(",");
+    let decls: String = (0..5_001).map(|i| format!("p{i}:v;")).collect();
+    let svg = styled(&format!("{sels}{{{decls}}}"), &[""]);
+    let e = parse(&svg).unwrap_err();
+    assert!(e.to_string().contains("<style> rules"), "{e}");
+    // The same sheet styles an element it does not match at no cost.
+    let ok = styled(&format!("{}{{{decls}}}", vec!["circle"; 10_000].join(",")), &[""]);
+    assert!(parse(&ok).is_ok());
+}
+
+#[test]
+fn font_size_percentage_resolves_against_the_parent_font_size() {
+    for (body, expected) in [
+        (r#"<g font-size="200%"><rect width="1em" height="1em"/></g>"#, 32.0),
+        (r#"<g font-size="200%"><rect width="2ex" height="1em"/></g>"#, 32.0),
+        (r#"<g font-size="200%"><g font-size="200%"><rect width="1em" height="1em"/></g></g>"#, 64.0),
+    ] {
+        let svg = format!(r#"<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">{body}</svg>"#);
+        let d = parse(svg.as_bytes()).unwrap();
+        let shapes = d.flatten();
+        assert_eq!(shapes.len(), 1);
+        assert!(matches!(shapes[0].2.geom, Geom::Rect { w, .. } if w == expected), "{body}: {:?}", shapes[0].2.geom);
+    }
+}
+
+#[test]
+fn at_rule_blocks_are_skipped_by_brace_depth() {
+    let mut sheet = StyleSheet::default();
+    parse_css("@media print { .a{fill:#ff0000} .b{fill:#0000ff} } .c{fill:red}", &mut sheet).unwrap();
+    assert_eq!(sheet.rules.len(), 1);
+    assert_eq!(sheet.rules[0].classes, vec!["c".to_string()]);
+    let mut sheet = StyleSheet::default();
+    parse_css("@media x { @supports y { .c{} } .d{} } .e{fill:red}", &mut sheet).unwrap();
+    assert_eq!(sheet.rules.len(), 1);
+    assert_eq!(sheet.rules[0].classes, vec!["e".to_string()]);
+}
diff --git a/crates/text/src/font_dirs.rs b/crates/text/src/font_dirs.rs
index 0561d8f84..30694946b 100644
--- a/crates/text/src/font_dirs.rs
+++ b/crates/text/src/font_dirs.rs
@@ -150,7 +150,9 @@ impl Reader<'_> {
             let mut files: Vec<PathBuf> = rd
                 .flatten()
                 .map(|e| e.path())
-                .filter(|p| p.file_name().and_then(|n| n.to_str()).is_some_and(|n| n.ends_with(".conf") && n.starts_with(|c: char| c.is_ascii_digit())))
+                .filter(|p| {
+                    p.file_name().and_then(std::ffi::OsStr::to_str).is_some_and(|n| n.ends_with(".conf") && n.starts_with(|c: char| c.is_ascii_digit()))
+                })
                 .collect();
             files.sort();
             for f in files {
diff --git a/crates/text/src/fonts.rs b/crates/text/src/fonts.rs
index aeabf1872..d199bf0ff 100644
--- a/crates/text/src/fonts.rs
+++ b/crates/text/src/fonts.rs
@@ -116,7 +116,7 @@ fn walk(dir: &std::path::Path, depth: u32, out: &mut Vec<PathBuf>) {
             if depth < 8 {
                 walk(&p, depth + 1, out);
             }
-        } else if p.extension().and_then(|x| x.to_str()).is_some_and(|x| matches!(x.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc")) {
+        } else if p.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|x| matches!(x.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc")) {
             out.push(p);
         }
     }
@@ -158,11 +158,24 @@ fn info_from(n: FaceNames, data: FaceData, origin: &'static str) -> FaceInfo {
     }
 }
 
+/// A font file's bytes and its metadata from the same open file (so the metadata describes the
+/// bytes, not a later version of the file).
+fn read_with_metadata(path: &std::path::Path) -> std::io::Result<(Vec<u8>, std::fs::Metadata)> {
+    use std::io::Read;
+    let mut f = std::fs::File::open(path)?;
+    let meta = f.metadata()?;
+    let mut bytes = Vec::new();
+    f.read_to_end(&mut bytes)?;
+    Ok((bytes, meta))
+}
+
 /// A loaded (or loadable) face.
 pub struct Face {
     pub id: FaceId,
     pub info: FaceInfo,
     bytes: OnceLock<Option<FaceBytes>>,
+    /// The file's metadata as its bytes were read (a [`FaceData::File`] face, once loaded).
+    file_meta: OnceLock<std::fs::Metadata>,
     shaper: OnceLock<harfrust::ShaperData>,
 }
 
@@ -195,16 +208,29 @@ pub struct VMetrics {
 }
 
 impl Face {
+    /// The font file bytes, loaded once on first use, or `None` when they cannot be read.
     fn bytes(&self) -> Option<&[u8]> {
         self.bytes
             .get_or_init(|| match &self.info.data {
                 FaceData::Static(b) => Some(FaceBytes::Static(b)),
                 FaceData::Shared(b) => Some(FaceBytes::Shared(b.clone())),
-                FaceData::File(p) => std::fs::read(p).ok().map(|v| FaceBytes::Shared(Arc::new(v))),
+                FaceData::File(p) => {
+                    let (bytes, meta) = read_with_metadata(p).ok()?;
+                    let _ = self.file_meta.set(meta);
+                    Some(FaceBytes::Shared(Arc::new(bytes)))
+                }
             })
             .as_ref()
             .map(FaceBytes::get)
     }
+    /// The file a [`FaceData::File`] face is drawn from, with its metadata as its bytes were read
+    /// (`None` when it could not be read): what text drawn with the face was made of. Loads the
+    /// face. `None` for bundled faces and faces from memory.
+    pub fn file_read(&self) -> Option<(&std::path::Path, Option<&std::fs::Metadata>)> {
+        let FaceData::File(p) = &self.info.data else { return None };
+        let _ = self.bytes();
+        Some((p, self.file_meta.get()))
+    }
     /// The parsed font (None if the file is missing or unreadable).
     pub fn font(&self) -> Option<FontRef<'_>> {
         FontRef::from_index(self.bytes()?, self.info.index).ok()
@@ -292,15 +318,37 @@ impl Face {
 }
 
 struct Db {
+    fallback: Arc<Face>,
     faces: Vec<Arc<Face>>,
     scanned: bool,
 }
 
+/// Keep the compiled-in regular face available independently of discovery results.
+fn bundled_default_face() -> Arc<Face> {
+    let info =
+        read_faces_bytes(INTER_REGULAR).into_iter().next().map(|n| info_from(n, FaceData::Static(INTER_REGULAR), "bundled")).unwrap_or_else(|| FaceInfo {
+            family: DEFAULT_FAMILY.into(),
+            style: "Regular".into(),
+            weight: 400,
+            italic: false,
+            index: 0,
+            data: FaceData::Static(INTER_REGULAR),
+            origin: "bundled",
+            native_family: None,
+            full_name: "Inter Regular".into(),
+            postscript: Some("Inter-Regular".into()),
+            variable: false,
+            instances: Vec::new(),
+        });
+    Arc::new(Face { id: 0, info, bytes: OnceLock::new(), file_meta: OnceLock::new(), shaper: OnceLock::new() })
+}
+
 fn db() -> &'static RwLock<Db> {
     static DB: OnceLock<RwLock<Db>> = OnceLock::new();
     DB.get_or_init(|| {
-        let mut db = Db { faces: Vec::new(), scanned: false };
-        for b in [INTER_REGULAR, INTER_MEDIUM, INTER_SEMIBOLD, INTER_BOLD, INTER_ITALIC, JETBRAINS_MONO_REGULAR, NOTO_SERIF_REGULAR] {
+        let fallback = bundled_default_face();
+        let mut db = Db { faces: vec![fallback.clone()], fallback, scanned: false };
+        for b in [INTER_MEDIUM, INTER_SEMIBOLD, INTER_BOLD, INTER_ITALIC, JETBRAINS_MONO_REGULAR, NOTO_SERIF_REGULAR] {
             for n in read_faces_bytes(b) {
                 push(&mut db, info_from(n, FaceData::Static(b), "bundled"));
             }
@@ -309,9 +357,10 @@ fn db() -> &'static RwLock<Db> {
     })
 }
 
+/// Adds a face to the database and returns its id.
 fn push(db: &mut Db, info: FaceInfo) -> FaceId {
     let id = db.faces.len();
-    db.faces.push(Arc::new(Face { id, info, bytes: OnceLock::new(), shaper: OnceLock::new() }));
+    db.faces.push(Arc::new(Face { id, info, bytes: OnceLock::new(), file_meta: OnceLock::new(), shaper: OnceLock::new() }));
     id
 }
 
@@ -319,7 +368,7 @@ fn push(db: &mut Db, info: FaceInfo) -> FaceId {
 /// added.
 pub fn add_source(src: &dyn FontSource) -> usize {
     let faces = src.faces();
-    let mut d = db().write().unwrap_or_else(|e| e.into_inner());
+    let mut d = db().write().unwrap_or_else(std::sync::PoisonError::into_inner);
     let mut n = 0;
     for f in faces {
         let dup = d.faces.iter().any(|g| g.info.family.eq_ignore_ascii_case(&f.family) && g.info.style.eq_ignore_ascii_case(&f.style));
@@ -329,7 +378,7 @@ pub fn add_source(src: &dyn FontSource) -> usize {
         }
     }
     // A new face can belong to one of a script's usual families.
-    family_faces_cache().write().unwrap_or_else(|e| e.into_inner()).clear();
+    family_faces_cache().write().unwrap_or_else(std::sync::PoisonError::into_inner).clear();
     n
 }
 
@@ -337,9 +386,9 @@ pub fn add_source(src: &dyn FontSource) -> usize {
 pub fn add_font_data(data: Vec<u8>) -> Vec<FaceId> {
     let data = Arc::new(data);
     let names = read_faces_bytes(&data);
-    let mut d = db().write().unwrap_or_else(|e| e.into_inner());
+    let mut d = db().write().unwrap_or_else(std::sync::PoisonError::into_inner);
     let ids = names.into_iter().map(|n| push(&mut d, info_from(n, FaceData::Shared(data.clone()), "user"))).collect();
-    family_faces_cache().write().unwrap_or_else(|e| e.into_inner()).clear();
+    family_faces_cache().write().unwrap_or_else(std::sync::PoisonError::into_inner).clear();
     ids
 }
 
@@ -353,24 +402,79 @@ pub fn scan_system() -> usize {
     if system_scanned() {
         return 0;
     }
-    let _scan = SCAN.lock().unwrap_or_else(|e| e.into_inner());
+    let _scan = SCAN.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if system_scanned() {
         return 0;
     }
     let n = if cfg!(target_arch = "wasm32") { 0 } else { add_source(&DirectorySource::system()) };
-    db().write().unwrap_or_else(|e| e.into_inner()).scanned = true;
+    db().write().unwrap_or_else(std::sync::PoisonError::into_inner).scanned = true;
     n
 }
 
 /// Scan the system font folders again, adding fonts installed since the last scan (faces already
-/// known are kept, so font ids stay valid). Returns the number of faces added.
+/// known are kept, so font ids stay valid). Returns the number of faces added. This walks every
+/// fontconfig directory, so the UI calls [`start_rescan`] instead of running it on the frame thread.
 pub fn rescan_system() -> usize {
-    let _scan = SCAN.lock().unwrap_or_else(|e| e.into_inner());
+    let _scan = SCAN.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     let n = if cfg!(target_arch = "wasm32") { 0 } else { add_source(&DirectorySource::system()) };
-    db().write().unwrap_or_else(|e| e.into_inner()).scanned = true;
+    db().write().unwrap_or_else(std::sync::PoisonError::into_inner).scanned = true;
     n
 }
 
+/// A rescan started by [`start_rescan`], if one is in flight or finished and not yet polled.
+#[cfg(not(target_arch = "wasm32"))]
+static RESCAN: std::sync::Mutex<Option<std::thread::JoinHandle<usize>>> = std::sync::Mutex::new(None);
+
+/// Start [`rescan_system`] on a background thread. Returns false when a rescan is already
+/// running, the thread could not be spawned, or this build has no system font folders (wasm).
+pub fn start_rescan() -> bool {
+    #[cfg(target_arch = "wasm32")]
+    {
+        false
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut slot = RESCAN.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        if slot.as_ref().is_some_and(|h| !h.is_finished()) {
+            return false;
+        }
+        match std::thread::Builder::new().name("font-rescan".into()).spawn(rescan_system) {
+            Ok(handle) => {
+                *slot = Some(handle);
+                true
+            }
+            Err(_) => false,
+        }
+    }
+}
+
+/// Whether a background rescan is still walking the font folders.
+pub fn rescan_busy() -> bool {
+    #[cfg(target_arch = "wasm32")]
+    {
+        false
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        RESCAN.lock().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref().is_some_and(|h| !h.is_finished())
+    }
+}
+
+/// Faces added by the latest background rescan, once that thread has finished. `None` while it
+/// is still running or when nothing was started.
+pub fn poll_rescan() -> Option<usize> {
+    #[cfg(target_arch = "wasm32")]
+    {
+        None
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut slot = RESCAN.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let finished = slot.as_ref().is_some_and(std::thread::JoinHandle::is_finished);
+        if finished { slot.take().and_then(|h| h.join().ok()) } else { None }
+    }
+}
+
 /// Start the system font scan on a background thread, so the font menus are complete by the
 /// time someone opens them without the first open waiting for the scan. Native only; on wasm
 /// (no threads, no font folders) this does nothing.
@@ -388,21 +492,18 @@ pub fn scan_system_in_background() {
 }
 
 pub fn system_scanned() -> bool {
-    db().read().unwrap_or_else(|e| e.into_inner()).scanned
+    db().read().unwrap_or_else(std::sync::PoisonError::into_inner).scanned
 }
 
 /// A face by id (panics never: unknown ids give the default face).
 pub fn face(id: FaceId) -> Arc<Face> {
-    let d = db().read().unwrap_or_else(|e| e.into_inner());
-    // The bundled fonts are compiled in and always parse (`tests::bundled_families_and_resolution` checks them), so
-    // the database is never empty.
-    #[allow(clippy::expect_used)]
-    d.faces.get(id).or_else(|| d.faces.first()).cloned().expect("bundled fonts present")
+    let d = db().read().unwrap_or_else(std::sync::PoisonError::into_inner);
+    d.faces.get(id).cloned().unwrap_or_else(|| d.fallback.clone())
 }
 
 /// All faces (bundled first).
 pub fn all_faces() -> Vec<Arc<Face>> {
-    db().read().unwrap_or_else(|e| e.into_inner()).faces.clone()
+    db().read().unwrap_or_else(std::sync::PoisonError::into_inner).faces.clone()
 }
 
 /// Family names in the fonts' own languages: English family → native family (only families
@@ -633,6 +734,8 @@ enum FallbackScript {
     /// Sinhala (one family covers them all on Windows; elsewhere each has its own).
     Indic,
     Thai,
+    /// Georgian: Mkhedruli, Asomtavruli and Nuskhuri, and Mtavruli capitals.
+    Georgian,
     Other,
 }
 
@@ -661,6 +764,7 @@ fn script_of(c: char) -> FallbackScript {
         0x0590..=0x05FF | 0xFB1D..=0xFB4F => FallbackScript::Hebrew,
         0x0900..=0x0DFF | 0xA8E0..=0xA8FF => FallbackScript::Indic,
         0x0E00..=0x0E7F => FallbackScript::Thai,
+        0x10A0..=0x10FF | 0x1C90..=0x1CBF | 0x2D00..=0x2D2F => FallbackScript::Georgian,
         _ => FallbackScript::Other,
     }
 }
@@ -685,14 +789,28 @@ const JAPANESE_FAMILIES: &[&str] = &[
 ];
 /// Han ideograph families for Simplified Chinese, in the order the platforms' own fallback tables
 /// prefer them (Windows, macOS, then the Linux/Noto names). Missing ones cost one name lookup each.
-const SIMPLIFIED_CHINESE_FAMILIES: &[&str] =
-    &["Microsoft YaHei", "SimSun", "PingFang SC", "Noto Sans CJK SC", "Noto Sans SC", "Source Han Sans SC", "WenQuanYi Micro Hei"];
+/// `Hiragino Sans GB`, `Heiti SC` and `Songti SC` are the Simplified faces a macOS install without
+/// the on-demand PingFang has (macOS 27 on an English install ships them, not PingFang): without
+/// them Chinese Han text fell through to the Japanese face and drew Japanese glyph forms (#453).
+const SIMPLIFIED_CHINESE_FAMILIES: &[&str] = &[
+    "Microsoft YaHei",
+    "SimSun",
+    "PingFang SC",
+    "Hiragino Sans GB",
+    "Heiti SC",
+    "Songti SC",
+    "STSong",
+    "Noto Sans CJK SC",
+    "Noto Sans SC",
+    "Source Han Sans SC",
+    "WenQuanYi Micro Hei",
+];
 /// The same for Traditional Chinese. The two scripts share almost all of their code points but not
 /// the glyph forms (`东` against `東`'s neighbours, `直`, `骨`), so one list for both drew a
 /// Traditional interface with Simplified forms - the faces do not differ in *coverage*, which is
 /// what the fallback search checks, so the script has to pick the list.
 const TRADITIONAL_CHINESE_FAMILIES: &[&str] =
-    &["Microsoft JhengHei", "MingLiU", "PingFang TC", "Heiti TC", "Hiragino Sans CNS", "Noto Sans CJK TC", "Noto Sans TC", "Source Han Sans TC"];
+    &["Microsoft JhengHei", "MingLiU", "PingFang TC", "Heiti TC", "Hiragino Sans CNS", "Songti TC", "Noto Sans CJK TC", "Noto Sans TC", "Source Han Sans TC"];
 const KOREAN_FAMILIES: &[&str] = &["Malgun Gothic", "Gulim", "Apple SD Gothic Neo", "Noto Sans CJK KR", "Noto Sans KR", "Source Han Sans KR", "NanumGothic"];
 /// The platforms' plain text families for the other scripts the bundled fonts lack, in the same
 /// order (Windows, macOS, then the Linux/Noto names).
@@ -726,6 +844,7 @@ const INDIC_FAMILIES: &[&str] = &[
     "Noto Sans Sinhala",
 ];
 const THAI_FAMILIES: &[&str] = &["Leelawadee UI", "Tahoma", "Thonburi", "Noto Sans Thai", "Noto Sans Thai UI", "Loma", "Garuda"];
+const GEORGIAN_FAMILIES: &[&str] = &["Sylfaen", ".SF Georgian", "SF Georgian", "Noto Sans Georgian", "DejaVu Sans"];
 
 /// The CJK locale the host asked fallbacks to prefer, when it has one (see [`set_cjk_locale`]).
 static REQUESTED_CJK_LOCALE: RwLock<Option<String>> = RwLock::new(None);
@@ -739,28 +858,62 @@ static REQUESTED_CJK_LOCALE: RwLock<Option<String>> = RwLock::new(None);
 pub fn set_cjk_locale(tag: &str) {
     let tag = tag.trim().to_ascii_lowercase();
     let requested = if tag.is_empty() || tag == "c" || tag == "posix" { None } else { Some(tag) };
-    *REQUESTED_CJK_LOCALE.write().unwrap_or_else(|e| e.into_inner()) = requested;
+    *REQUESTED_CJK_LOCALE.write().unwrap_or_else(std::sync::PoisonError::into_inner) = requested;
     // The order of the CJK families follows the language, so a change of language drops the cached
     // fallbacks.
-    fallback_cache().write().unwrap_or_else(|e| e.into_inner()).clear();
-    family_faces_cache().write().unwrap_or_else(|e| e.into_inner()).clear();
+    fallback_cache().write().unwrap_or_else(std::sync::PoisonError::into_inner).clear();
+    family_faces_cache().write().unwrap_or_else(std::sync::PoisonError::into_inner).clear();
 }
 
 fn requested_cjk_locale() -> Option<String> {
-    REQUESTED_CJK_LOCALE.read().unwrap_or_else(|e| e.into_inner()).clone()
+    REQUESTED_CJK_LOCALE.read().unwrap_or_else(std::sync::PoisonError::into_inner).clone()
 }
 
 /// The CJK locale to use: [`set_cjk_locale`] when the host asked for one, otherwise the locale
 /// environment (`LANG`, `LC_ALL`, `LC_CTYPE`; `EFFECTCRAFT_CJK_LOCALE` overrides them).
 fn active_cjk_locale() -> String {
-    requested_cjk_locale().unwrap_or_else(|| {
-        ["EFFECTCRAFT_CJK_LOCALE", "LC_ALL", "LC_CTYPE", "LANG"]
-            .iter()
-            .filter_map(|k| std::env::var(k).ok())
-            .map(|v| v.trim().to_ascii_lowercase())
-            .find(|v| !v.is_empty() && v != "c" && v != "posix")
-            .unwrap_or_default()
-    })
+    requested_cjk_locale().unwrap_or_else(environment_cjk_locale)
+}
+
+/// Read the environment independently of another UI's process-wide language request.
+fn environment_cjk_locale() -> String {
+    ["EFFECTCRAFT_CJK_LOCALE", "LC_ALL", "LC_CTYPE", "LANG"]
+        .iter()
+        .filter_map(|k| std::env::var(k).ok())
+        .map(|v| v.trim().to_ascii_lowercase())
+        .find(|v| !v.is_empty() && v != "c" && v != "posix")
+        .unwrap_or_default()
+}
+
+/// The four distinct fallback policies, rather than unbounded user-supplied locale cache keys.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+enum CjkLocale {
+    Japanese,
+    Korean,
+    Simplified,
+    Traditional,
+}
+
+impl CjkLocale {
+    fn from_tag(tag: &str) -> Self {
+        let tag = tag.trim().to_ascii_lowercase();
+        if tag.starts_with("zh") {
+            if asks_traditional_chinese(&tag) { Self::Traditional } else { Self::Simplified }
+        } else if tag.starts_with("ko") {
+            Self::Korean
+        } else {
+            Self::Japanese
+        }
+    }
+
+    fn tag(self) -> &'static str {
+        match self {
+            Self::Japanese => "ja",
+            Self::Korean => "ko",
+            Self::Simplified => "zh-hans",
+            Self::Traditional => "zh-hant",
+        }
+    }
 }
 
 /// The CJK language to try first for Han ideographs. Japanese when nothing says otherwise: the
@@ -778,6 +931,7 @@ fn han_order_for(tag: &str) -> [FallbackScript; 3] {
 }
 
 /// The order for the locale in force ([`active_cjk_locale`]).
+#[cfg(test)]
 fn han_order() -> [FallbackScript; 3] {
     han_order_for(&active_cjk_locale())
 }
@@ -796,20 +950,16 @@ fn chinese_families_for(tag: &str) -> &'static [&'static str] {
     if asks_traditional_chinese(tag) { TRADITIONAL_CHINESE_FAMILIES } else { SIMPLIFIED_CHINESE_FAMILIES }
 }
 
-/// [`chinese_families_for`] for the locale in force ([`active_cjk_locale`]).
-fn chinese_families() -> &'static [&'static str] {
-    chinese_families_for(&active_cjk_locale())
-}
-
-fn families_for(s: FallbackScript) -> &'static [&'static str] {
+fn families_for(s: FallbackScript, locale: CjkLocale) -> &'static [&'static str] {
     match s {
         FallbackScript::Japanese => JAPANESE_FAMILIES,
-        FallbackScript::Han => chinese_families(),
+        FallbackScript::Han => chinese_families_for(locale.tag()),
         FallbackScript::Korean => KOREAN_FAMILIES,
         FallbackScript::Arabic => ARABIC_FAMILIES,
         FallbackScript::Hebrew => HEBREW_FAMILIES,
         FallbackScript::Indic => INDIC_FAMILIES,
         FallbackScript::Thai => THAI_FAMILIES,
+        FallbackScript::Georgian => GEORGIAN_FAMILIES,
         FallbackScript::Other => &[],
     }
 }
@@ -881,9 +1031,10 @@ fn fallback_cache() -> &'static RwLock<std::collections::HashMap<(u32, FaceId),
     CACHE.get_or_init(Default::default)
 }
 
-/// The results of [`family_faces`], per script and preferred face.
-fn family_faces_cache() -> &'static RwLock<std::collections::HashMap<(FallbackScript, FaceId), Arc<Vec<FaceId>>>> {
-    static CACHE: OnceLock<RwLock<std::collections::HashMap<(FallbackScript, FaceId), Arc<Vec<FaceId>>>>> = OnceLock::new();
+/// The results of [`family_faces`], per script, preferred face and captured language policy.
+/// A lookup that finishes after a language change cannot populate another language's entry.
+fn family_faces_cache() -> &'static RwLock<std::collections::HashMap<(FallbackScript, FaceId, CjkLocale), Arc<Vec<FaceId>>>> {
+    static CACHE: OnceLock<RwLock<std::collections::HashMap<(FallbackScript, FaceId, CjkLocale), Arc<Vec<FaceId>>>>> = OnceLock::new();
     CACHE.get_or_init(Default::default)
 }
 
@@ -893,6 +1044,27 @@ fn family_faces_cache() -> &'static RwLock<std::collections::HashMap<(FallbackSc
 /// loaded are tried after that (cheap), and any installed face that covers the character is tried
 /// last. `prefer` is returned when nothing covers it (the glyph renders as the missing-glyph box).
 pub fn fallback_for(c: char, prefer: FaceId) -> FaceId {
+    fallback_with_locale(c, prefer, || CjkLocale::from_tag(&active_cjk_locale()))
+}
+
+/// Choose a fallback for an explicit interface language, independent of concurrent global
+/// language changes. Empty, `c` and `posix` use the OS environment rather than the global request.
+pub fn fallback_for_locale(c: char, prefer: FaceId, tag: &str) -> FaceId {
+    let tag = tag.trim();
+    let locale = || {
+        if tag.is_empty() || tag.eq_ignore_ascii_case("c") || tag.eq_ignore_ascii_case("posix") {
+            CjkLocale::from_tag(&environment_cjk_locale())
+        } else {
+            CjkLocale::from_tag(tag)
+        }
+    };
+    fallback_with_locale(c, prefer, locale)
+}
+
+/// Keep a single language snapshot through the family-order lookup and cache insertion. `locale`
+/// is read only for a script with usual families: reading it takes a lock and may consult the
+/// environment, and layout asks for a fallback for every character.
+fn fallback_with_locale(c: char, prefer: FaceId, locale: impl FnOnce() -> CjkLocale) -> FaceId {
     let p = face(prefer);
     if p.has_char(c) || c.is_control() {
         return prefer;
@@ -913,7 +1085,7 @@ pub fn fallback_for(c: char, prefer: FaceId) -> FaceId {
         if cfg!(not(target_arch = "wasm32")) && !system_scanned() {
             scan_system();
         }
-        if let Some(&id) = family_faces(script, &p).iter().find(|&&id| face(id).has_char(c)) {
+        if let Some(&id) = family_faces(script, &p, locale()).iter().find(|&&id| face(id).has_char(c)) {
             return id;
         }
     }
@@ -924,7 +1096,7 @@ pub fn fallback_for(c: char, prefer: FaceId) -> FaceId {
         }
     }
     let key = (c as u32 >> 8, prefer);
-    if let Some(cached) = fallback_cache().read().unwrap_or_else(|e| e.into_inner()).get(&key).copied() {
+    if let Some(cached) = fallback_cache().read().unwrap_or_else(std::sync::PoisonError::into_inner).get(&key).copied() {
         match cached {
             Some(id) if face(id).has_char(c) => return id,
             Some(_) => {}
@@ -935,30 +1107,31 @@ pub fn fallback_for(c: char, prefer: FaceId) -> FaceId {
         scan_system();
     }
     let found = system_fallback(c, &p.info.style);
-    fallback_cache().write().unwrap_or_else(|e| e.into_inner()).insert(key, found);
+    fallback_cache().write().unwrap_or_else(std::sync::PoisonError::into_inner).insert(key, found);
     found.unwrap_or(prefer)
 }
 
 /// The script-aware part of [`fallback_for`]: the installed faces of the platform's usual families
 /// for `script`, in the order they are tried, each in the style of `prefer`. For CJK, the other CJK
 /// languages' families follow in the locale's order.
-fn family_faces(script: FallbackScript, prefer: &Face) -> Arc<Vec<FaceId>> {
-    if let Some(faces) = family_faces_cache().read().unwrap_or_else(|e| e.into_inner()).get(&(script, prefer.id)) {
+fn family_faces(script: FallbackScript, prefer: &Face, locale: CjkLocale) -> Arc<Vec<FaceId>> {
+    if let Some(faces) = family_faces_cache().read().unwrap_or_else(std::sync::PoisonError::into_inner).get(&(script, prefer.id, locale)) {
         return faces.clone();
     }
     let order: Vec<FallbackScript> = match script {
         FallbackScript::Other => vec![],
-        FallbackScript::Han => han_order().to_vec(),
+        FallbackScript::Han => han_order_for(locale.tag()).to_vec(),
         s if s.is_cjk() => {
             let mut v = vec![s];
-            v.extend(han_order().iter().copied().filter(|o| *o != s));
+            v.extend(han_order_for(locale.tag()).iter().copied().filter(|o| *o != s));
             v
         }
         s => vec![s],
     };
     let style = &prefer.info.style;
-    let faces: Arc<Vec<FaceId>> = Arc::new(order.into_iter().flat_map(families_for).filter_map(|fam| resolve_in(fam, style)).map(|r| r.face).collect());
-    family_faces_cache().write().unwrap_or_else(|e| e.into_inner()).insert((script, prefer.id), faces.clone());
+    let faces: Arc<Vec<FaceId>> =
+        Arc::new(order.into_iter().flat_map(|s| families_for(s, locale)).filter_map(|fam| resolve_in(fam, style)).map(|r| r.face).collect());
+    family_faces_cache().write().unwrap_or_else(std::sync::PoisonError::into_inner).insert((script, prefer.id, locale), faces.clone());
     faces
 }
 
@@ -972,363 +1145,4 @@ fn system_fallback(c: char, style: &str) -> Option<FaceId> {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn extra_font_dirs_come_from_a_path_list() {
-        assert!(extra_dirs(None).is_empty());
-        let v = std::env::join_paths(["/a/fonts", "/b/more"]).unwrap_or_default();
-        assert_eq!(extra_dirs(Some(&v)), vec![PathBuf::from("/a/fonts"), PathBuf::from("/b/more")]);
-        assert!(extra_dirs(Some(std::ffi::OsStr::new(""))).is_empty());
-    }
-
-    #[test]
-    fn bundled_families_and_resolution() {
-        let fams = families();
-        let inter = fams.iter().find(|(f, _)| f == "Inter").expect("Inter");
-        for s in ["Regular", "Medium", "SemiBold", "Bold", "Italic"] {
-            assert!(inter.1.iter().any(|x| x == s), "{s} in {:?}", inter.1);
-        }
-        assert!(fams.iter().any(|(f, _)| f == "Noto Serif"));
-        assert!(fams.iter().any(|(f, _)| f == "JetBrains Mono"));
-        let b = resolve("inter", "bold");
-        assert_eq!(face(b.face).info.style, "Bold");
-        assert!(!b.synth_bold);
-        let faces = all_faces();
-        assert!(faces.iter().any(|f| f.info.family == "Noto Serif" && f.info.style == "Regular" && f.info.origin == "bundled"));
-        // A real installed Bold Italic takes priority. Partial installed families can instead
-        // supply the nearest weight/slant, so neither synthesis flag is fixed by the OS.
-        for family in ["Noto Serif", "Inter"] {
-            let resolved = resolve(family, "Bold Italic");
-            let selected = face(resolved.face);
-            assert!(selected.info.family.eq_ignore_ascii_case(family));
-            assert!(!resolved.missing);
-            let candidates: Vec<_> = faces.iter().filter(|f| f.info.family.eq_ignore_ascii_case(family)).collect();
-            if let Some(exact) = candidates.iter().find(|f| f.info.style.eq_ignore_ascii_case("Bold Italic")) {
-                assert_eq!(resolved.face, exact.id, "real style wins for {family}");
-                assert!(!resolved.synth_bold && !resolved.synth_italic);
-            } else {
-                // Italic mismatch dominates any supported font weight distance.
-                let distance = |f: &Face| u32::from(f.info.weight.abs_diff(700)) + if f.info.italic { 0 } else { 1_000 };
-                let nearest = candidates.iter().map(|f| distance(f)).min().unwrap();
-                assert_eq!(distance(&selected), nearest, "closest available style for {family}");
-                assert_eq!(resolved.synth_bold, selected.info.weight <= 500);
-                assert_eq!(resolved.synth_italic, !selected.info.italic);
-            }
-        }
-    }
-
-    #[test]
-    fn missing_family_falls_back_to_inter() {
-        let r = resolve("No Such Font Family 123", "Regular");
-        assert_eq!(face(r.face).info.family, "Inter");
-        assert!(r.missing);
-    }
-
-    /// Native: the system scan reads name tables only and resolves families installed there.
-    #[test]
-    fn system_scan_finds_fonts() {
-        let t = std::time::Instant::now();
-        scan_system(); // (another test may have triggered the scan already)
-        let n = all_faces().iter().filter(|f| f.info.origin == "system").count();
-        eprintln!("system fonts: {n} faces in {:?}", t.elapsed());
-        assert_eq!(scan_system(), 0, "scans once");
-        if cfg!(target_os = "macos") {
-            assert!(n > 20, "{n}");
-            let r = resolve("Helvetica", "Bold");
-            assert_eq!(face(r.face).info.family, "Helvetica");
-            let l = crate::layout_text("Helvetica", &crate::TextStyle { family: "Helvetica".into(), size: 30.0, ..Default::default() }, &Default::default());
-            assert!(!l.missing_font && l.glyphs.iter().all(|g| g.id != 0));
-        }
-    }
-
-    #[test]
-    fn postscript_and_full_names_resolve() {
-        // Bundled Inter: name id 6 is `Inter-Bold`, name id 4 is `Inter Bold`.
-        let ps = resolve("Inter-Bold", "");
-        assert_eq!(face(ps.face).info.style, "Bold");
-        assert!(!ps.missing && !ps.synth_bold);
-        let full = resolve("inter semibold", "");
-        assert_eq!(face(full.face).info.style, "SemiBold");
-        assert!(!full.missing);
-        // A family name still wins over a name lookup.
-        assert_eq!(face(resolve("Inter", "Bold").face).info.style, "Bold");
-    }
-
-    /// #1563: a variable font's named instances are styles of its family. `fontStyle = "Black"`,
-    /// the instance's PostScript name (`font = "Figtree-Black"`) and its full name select the
-    /// instance's axis values instead of the default instance made bold synthetically, and the
-    /// font menus list every instance.
-    #[test]
-    fn variable_named_instances_resolve_and_list() {
-        const FAMILY: &str = "EffectCraft Instance Test";
-        let instances = [
-            ("Light", 300.0, Some("EffectCraftInstanceTest-Light")),
-            ("Regular", 400.0, Some("EffectCraftInstanceTest-Regular")),
-            ("Black", 900.0, Some("EffectCraftInstanceTest-Black")),
-            ("Extra Bold", 800.0, None),
-        ];
-        assert_eq!(add_font_data(crate::sfnt::test_font::variable(FAMILY, &instances, true)).len(), 1);
-        let wght = |r: &Resolved| instance_variations(r);
-        // By style name.
-        let black = resolve(FAMILY, "Black");
-        assert!(!black.missing && !black.synth_bold && !black.synth_italic, "{black:?}");
-        assert_eq!(wght(&black), vec![("wght".to_string(), 900.0)]);
-        assert_eq!(wght(&resolve(FAMILY, "regular")), vec![("wght".to_string(), 400.0)]);
-        // The face's own style is its default instance: no axis values to set.
-        let light = resolve(FAMILY, "Light");
-        assert_eq!((light.face, light.instance), (black.face, None));
-        // A style the family lacks takes the nearest instance's weight, no synthetic bold.
-        let bold = resolve(FAMILY, "Bold");
-        assert!(!bold.synth_bold, "{bold:?}");
-        assert_eq!(wght(&bold), vec![("wght".to_string(), 800.0)]);
-        // By PostScript name, the font's own and the derived one, and by full name.
-        let ps = resolve("EffectCraftInstanceTest-Black", "Regular");
-        assert!(!ps.missing && ps.face == black.face, "{ps:?}");
-        assert_eq!(wght(&ps), vec![("wght".to_string(), 900.0)]);
-        assert_eq!(wght(&resolve("EffectCraftInstanceTest-ExtraBold", "")), vec![("wght".to_string(), 800.0)]);
-        assert_eq!(wght(&resolve("effectcraft instance test extra bold", "")), vec![("wght".to_string(), 800.0)]);
-        // The font menu lists every instance, in weight order.
-        let fams = families();
-        let styles = &fams.iter().find(|(f, _)| f == FAMILY).unwrap().1;
-        assert_eq!(styles, &["Light", "Regular", "Extra Bold", "Black"]);
-        // Static fonts are untouched.
-        assert_eq!(resolve("Inter", "Bold").instance, None);
-    }
-
-    /// Axis values set on the text win over the instance's; the others keep the instance's.
-    #[test]
-    fn explicit_variations_override_the_instance() {
-        let base = vec![("wdth".to_string(), 75.0), ("wght".to_string(), 900.0)];
-        assert_eq!(merge_variations(&base, &[("wght".to_string(), 450.0)]), vec![("wdth".to_string(), 75.0), ("wght".to_string(), 450.0)]);
-        assert_eq!(merge_variations(&base, &[]), base);
-        assert_eq!(merge_variations(&[], &[("opsz".to_string(), 12.0)]), vec![("opsz".to_string(), 12.0)]);
-    }
-
-    #[test]
-    fn scripts_are_classified() {
-        assert_eq!(script_of('あ'), FallbackScript::Japanese);
-        assert_eq!(script_of('ｶ'), FallbackScript::Japanese);
-        assert_eq!(script_of('한'), FallbackScript::Korean);
-        assert_eq!(script_of('水'), FallbackScript::Han);
-        assert_eq!(script_of('、'), FallbackScript::Han);
-        assert_eq!(script_of('Ａ'), FallbackScript::Han);
-        assert_eq!(script_of('\u{20000}'), FallbackScript::Han);
-        assert_eq!(script_of('A'), FallbackScript::Other);
-        assert_eq!(script_of('م'), FallbackScript::Arabic);
-        assert_eq!(script_of('\u{fefb}'), FallbackScript::Arabic);
-        assert_eq!(script_of('\u{5d0}'), FallbackScript::Hebrew);
-        assert_eq!(script_of('क'), FallbackScript::Indic);
-        assert_eq!(script_of('த'), FallbackScript::Indic);
-        assert_eq!(script_of('ก'), FallbackScript::Thai);
-        assert_eq!(script_of('\u{feff}'), FallbackScript::Other, "the byte order mark is no Arabic letter");
-    }
-
-    /// Native: Arabic, Hebrew, Indic and Thai text in a Latin-only family falls back to the
-    /// platform's plain text family for its script (#394), not to the first installed face that
-    /// covers it (on Windows a calligraphic Arabic face sorts first). Skipped per script where no
-    /// family from its list is installed.
-    #[test]
-    fn other_scripts_fall_back_to_a_plain_system_family() {
-        scan_system();
-        let inter = resolve("Inter", "Regular").face;
-        for (c, families) in [('م', ARABIC_FAMILIES), ('א', HEBREW_FAMILIES), ('क', INDIC_FAMILIES), ('த', INDIC_FAMILIES), ('ก', THAI_FAMILIES)] {
-            let covering = families.iter().any(|n| resolve_in(n, "Regular").is_some_and(|r| face(r.face).has_char(c)));
-            if !covering {
-                eprintln!("{c}: no family from the list is installed; skipping");
-                continue;
-            }
-            let f = face(fallback_for(c, inter));
-            assert!(f.has_char(c), "{c}: {} lacks it", f.info.family);
-            assert!(families.iter().any(|n| f.info.family.eq_ignore_ascii_case(n)), "{c} → {}", f.info.family);
-        }
-    }
-
-    /// Native: Japanese text in a Latin-only family falls back to an installed Japanese family
-    /// (whichever the platform ships) instead of the missing-glyph box, without any layer having
-    /// loaded a CJK font first. Skipped where no family from the list is installed.
-    #[test]
-    fn cjk_falls_back_to_a_system_family() {
-        scan_system();
-        let inter = resolve("Inter", "Bold").face;
-        let installed = JAPANESE_FAMILIES.iter().any(|f| resolve_in(f, "Regular").is_some());
-        if !installed {
-            eprintln!("no Japanese family installed; skipping");
-            return;
-        }
-        for c in ['水', 'あ', 'ア', '。'] {
-            let id = fallback_for(c, inter);
-            let f = face(id);
-            assert!(f.has_char(c), "{c}: {} {} lacks it", f.info.family, f.info.style);
-            assert!(JAPANESE_FAMILIES.iter().any(|n| f.info.family.eq_ignore_ascii_case(n)), "{c} → {}", f.info.family);
-        }
-        // The bold cut of the fallback family is chosen for bold text when the family has one.
-        let f = face(fallback_for('水', inter));
-        let (w, _) = style_wants(&f.info.style);
-        let has_bold = all_faces().iter().any(|g| g.info.family == f.info.family && style_wants(&g.info.style).0 >= 600);
-        assert!(!has_bold || w >= 600, "{} {}", f.info.family, f.info.style);
-        // Cached: the second call is a lookup.
-        assert_eq!(fallback_for('水', inter), f.id);
-    }
-
-    /// A minimal TrueType font built in code (no font file in the repo): U+0020 and U+E000 map to
-    /// an empty glyph, U+E001 to a triangle.
-    fn blank_glyph_font() -> Vec<u8> {
-        test_font("Blank Glyph Test")
-    }
-
-    /// The blank-glyph test font under another family name.
-    fn test_font(family: &str) -> Vec<u8> {
-        fn u16s(v: &[u16]) -> Vec<u8> {
-            v.iter().flat_map(|x| x.to_be_bytes()).collect()
-        }
-        let delta_space = 1u16.wrapping_sub(0x20);
-        let cmap4 = {
-            let mut t = u16s(&[4, 0, 0, 6, 4, 1, 2]);
-            t.extend(u16s(&[0x20, 0xE001, 0xFFFF, 0, 0x20, 0xE000, 0xFFFF, delta_space, 0x2001, 1, 0, 0, 0]));
-            let len = t.len() as u16;
-            t[2..4].copy_from_slice(&len.to_be_bytes());
-            t
-        };
-        let mut cmap = u16s(&[0, 1, 3, 1, 0, 12]);
-        cmap.extend(cmap4);
-        // glyph 2: one contour of three on-curve points (100,0) (500,0) (300,600)
-        let mut glyf = u16s(&[1, 100, 0, 500, 600, 2, 0]);
-        glyf.extend([1u8, 1, 1]);
-        glyf.extend(u16s(&[100, 400, (-200i16) as u16, 0, 0, 600]));
-        glyf.push(0);
-        let loca = u16s(&[0, 0, 0, (glyf.len() / 2) as u16]);
-        let mut head = u16s(&[1, 0, 1, 0, 0, 0, 0x5F0F, 0x3CF5, 0, 1000]);
-        head.extend([0u8; 16]);
-        head.extend(u16s(&[100, 0, 500, 600, 0, 8, 2, 0, 0]));
-        let mut hhea = u16s(&[1, 0, 800, (-200i16) as u16, 0, 600, 0, 0, 500, 1, 0, 0]);
-        hhea.extend([0u8; 8]);
-        hhea.extend(u16s(&[0, 3]));
-        let hmtx = u16s(&[600, 0, 600, 0, 600, 0]);
-        let maxp = u16s(&[1, 0, 3, 3, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0]);
-        let strings: Vec<Vec<u8>> = [family, "Regular"].iter().map(|s| s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect()).collect();
-        let mut name = u16s(&[0, 2, 30]);
-        let mut off = 0;
-        for (id, st) in strings.iter().enumerate() {
-            name.extend(u16s(&[3, 1, 0x409, id as u16 + 1, st.len() as u16, off]));
-            off += st.len() as u16;
-        }
-        strings.iter().for_each(|st| name.extend(st));
-        let tables: [(&[u8; 4], Vec<u8>); 8] =
-            [(b"cmap", cmap), (b"glyf", glyf), (b"head", head), (b"hhea", hhea), (b"hmtx", hmtx), (b"loca", loca), (b"maxp", maxp), (b"name", name)];
-        let mut out = u16s(&[1, 0, tables.len() as u16, 128, 3, 0]);
-        let mut offset = 12 + 16 * tables.len();
-        let mut body = vec![];
-        for (tag, data) in &tables {
-            out.extend(*tag);
-            out.extend([0u8; 4]);
-            out.extend((offset as u32).to_be_bytes());
-            out.extend((data.len() as u32).to_be_bytes());
-            let padded = data.len().div_ceil(4) * 4;
-            body.extend(data);
-            body.resize(body.len() + padded - data.len(), 0);
-            offset += padded;
-        }
-        out.extend(body);
-        out
-    }
-
-    /// A face that maps a character to an empty glyph doesn't cover it, so fallback skips it
-    /// (#285); a blank space still counts, and a drawn glyph is found as before.
-    #[test]
-    fn an_empty_glyph_does_not_cover_its_character() {
-        let ids = add_font_data(blank_glyph_font());
-        let &[id] = ids.as_slice() else { panic!("one face expected: {ids:?}") };
-        let f = face(id);
-        assert_eq!(f.info.family, "Blank Glyph Test");
-        assert!(f.glyph('\u{e000}').is_some(), "the cmap maps it");
-        assert!(!f.has_char('\u{e000}'), "but its glyph is empty");
-        assert!(f.has_char('\u{e001}'), "a drawn glyph covers its character");
-        assert!(f.has_char(' '), "a space is blank by nature");
-        let inter = resolve("Inter", "Regular").face;
-        assert_ne!(fallback_for('\u{e000}', inter), id, "fallback never picks the empty glyph");
-        assert_eq!(fallback_for('\u{e001}', inter), id, "fallback finds the drawn one");
-    }
-
-    /// A Microsoft family that isn't installed renders in its installed metric-compatible
-    /// substitute instead of Inter, and still reports itself missing (#1677).
-    #[test]
-    fn microsoft_families_resolve_to_metric_compatible_substitutes() {
-        add_font_data(test_font("Carlito"));
-        add_font_data(test_font("Caladea"));
-        let calibri = resolve("Calibri", "Regular");
-        assert_eq!(face(calibri.face).info.family, "Carlito");
-        assert!(calibri.missing, "the original name stays missing for Find Missing Fonts");
-        let cambria = resolve("Cambria", "Bold");
-        assert_eq!(face(cambria.face).info.family, "Caladea");
-        assert!(cambria.missing);
-        let unknown = resolve("No Such Family 1677", "Regular");
-        assert_eq!(face(unknown.face).info.family, DEFAULT_FAMILY);
-        assert!(unknown.missing);
-    }
-
-    #[test]
-    fn the_han_order_follows_the_cjk_locale() {
-        // Chinese first for any Chinese tag, whether or not it names a script.
-        for tag in ["zh", "zh-CN", "zh_Hans", "ZH-Hant-TW.UTF-8", "zh_MO"] {
-            assert_eq!(han_order_for(tag)[0], FallbackScript::Han, "{tag}");
-        }
-        assert_eq!(han_order_for("ko-KR"), [FallbackScript::Korean, FallbackScript::Japanese, FallbackScript::Han]);
-        // Japanese, and anything else, keeps the Japanese face first for Han text.
-        for tag in ["ja_JP.UTF-8", "en-US", "de", ""] {
-            assert_eq!(han_order_for(tag), [FallbackScript::Japanese, FallbackScript::Han, FallbackScript::Korean], "{tag}");
-        }
-        // The host's request is what `han_order` reads (the ui test covers the effect on the
-        // registered fallbacks; this only checks that clearing it returns to the environment).
-        assert_eq!(requested_cjk_locale(), None, "tests run without a request");
-        assert_eq!(han_order(), han_order_for(&active_cjk_locale()));
-    }
-
-    #[test]
-    fn the_chinese_family_list_follows_the_script_the_locale_asks_for() {
-        for tag in ["zh", "zh-CN", "zh_Hans", "zh_CN.UTF-8", "zh-SG"] {
-            assert_eq!(chinese_families_for(tag), SIMPLIFIED_CHINESE_FAMILIES, "{tag}");
-        }
-        for tag in ["zh-Hant", "zh-Hant-TW", "zh_TW", "zh-HK", "zh_MO.UTF-8"] {
-            assert_eq!(chinese_families_for(tag), TRADITIONAL_CHINESE_FAMILIES, "{tag}");
-        }
-        // Each list carries its own script's faces and not the other's, which is the point of
-        // splitting them: `PingFang SC` covers the same code points as `PingFang TC`, so the
-        // fallback search would have kept it and drawn Simplified forms in a Traditional interface.
-        assert!(SIMPLIFIED_CHINESE_FAMILIES.iter().any(|f| f.contains("PingFang SC") && !f.contains("Source")));
-        assert!(!SIMPLIFIED_CHINESE_FAMILIES.iter().any(|f| f.contains("TC") || f.contains("JhengHei")));
-        assert!(TRADITIONAL_CHINESE_FAMILIES.iter().any(|f| f.contains("PingFang TC")));
-        assert!(!TRADITIONAL_CHINESE_FAMILIES.iter().any(|f| f.contains(" SC") || f.contains("YaHei") || f.contains("WenQuanYi")));
-        assert!(TRADITIONAL_CHINESE_FAMILIES.iter().any(|f| f.contains("Heiti TC") || f.contains("Hiragino Sans CNS")));
-        // The arm the fallback itself walks: Han hands over the list the locale's script picked.
-        assert_eq!(families_for(FallbackScript::Han), chinese_families_for(&active_cjk_locale()));
-        // Han text is the only thing these lists serve; the Japanese order does not change.
-        assert_eq!(han_order_for("ja_JP.UTF-8")[0], FallbackScript::Japanese);
-    }
-
-    #[test]
-    fn bundled_ui_fonts_cover_the_ukrainian_alphabet() {
-        const ALPHABET: &str = "АБВГҐДЕЄЖЗИІЇЙКЛМНОПРСТУФХЦЧШЩЬЮЯабвгґдеєжзиіїйклмнопрстуфхцчшщьюя’«»";
-        for (name, bytes) in
-            [("Inter Regular", INTER_REGULAR), ("Inter Medium", INTER_MEDIUM), ("Inter SemiBold", INTER_SEMIBOLD), ("JetBrains Mono", JETBRAINS_MONO_REGULAR)]
-        {
-            let font = FontRef::new(bytes).unwrap();
-            for c in ALPHABET.chars() {
-                assert!(covers(&font, c), "{name} cannot draw {c}");
-            }
-        }
-    }
-
-    #[test]
-    fn metrics_and_coverage() {
-        let f = face(resolve("Inter", "Regular").face);
-        let m = f.metrics(100.0);
-        assert!(m.ascent > 80.0 && m.ascent < 110.0, "{m:?}");
-        assert!(m.descent > 10.0 && m.descent < 40.0);
-        assert!(m.cap_height > 60.0 && m.cap_height < 80.0);
-        assert!(f.has_char('A') && f.has_char('Ж'));
-        assert!(!f.has_char('\u{5d0}'), "Inter has no Hebrew");
-        assert!(f.has_feature(b"liga") || f.has_feature(b"calt"));
-    }
-}
+mod tests;
diff --git a/crates/text/src/fonts/tests.rs b/crates/text/src/fonts/tests.rs
new file mode 100644
index 000000000..d95f07c6a
--- /dev/null
+++ b/crates/text/src/fonts/tests.rs
@@ -0,0 +1,569 @@
+use super::*;
+
+/// Run `test` again in a child process with `variable` set. The fixture faces below go into the
+/// process-global font database and its fallback caches, so only a process that runs one such test
+/// on its own can use them.
+#[cfg(not(target_arch = "wasm32"))]
+fn run_in_child(variable: &str, test: &str) {
+    let output = std::process::Command::new(std::env::current_exe().unwrap()).args(["--exact", test, "--nocapture"]).env(variable, "1").output().unwrap();
+    assert!(output.status.success(), "{}\n{}", String::from_utf8_lossy(&output.stdout), String::from_utf8_lossy(&output.stderr));
+}
+
+/// Concurrent language requests must neither choose another context's font nor reuse its
+/// cached family order. Synthetic fonts in a child process keep this independent of the host
+/// font installation and of other tests that exercise the process-global database/locale.
+#[test]
+#[cfg(not(target_arch = "wasm32"))]
+fn cjk_requests_keep_their_language_and_cache_entries() {
+    const CHILD: &str = "EFFECTCRAFT_TEST_ISOLATED_CJK";
+    if std::env::var_os(CHILD).is_none() {
+        run_in_child(CHILD, "fonts::tests::cjk_requests_keep_their_language_and_cache_entries");
+        return;
+    }
+    let families = [("ja", "Yu Gothic"), ("zh-hans", "Microsoft YaHei"), ("zh-hant", "Microsoft JhengHei"), ("ko", "Malgun Gothic")];
+    let mut expected = Vec::new();
+    {
+        let mut d = db().write().unwrap();
+        d.scanned = true; // This test process uses only bundled and synthetic fonts.
+        for (language, family) in families {
+            let mut data = test_font(family);
+            let table = data[12..12 + 8 * 16].as_chunks::<16>().0.iter().find(|t| &t[..4] == b"cmap").unwrap();
+            let cmap = u32::from_be_bytes(table[8..12].try_into().unwrap()) as usize + 12;
+            // Map 页 to the fixture's triangle glyph instead of its private-use range.
+            // All four fonts cover the probe, so coverage cannot choose the right language.
+            for (offset, value) in [(16, '页' as u16), (24, '页' as u16), (30, 2u16.wrapping_sub('页' as u16))] {
+                data[cmap + offset..cmap + offset + 2].copy_from_slice(&value.to_be_bytes());
+            }
+            let data = Arc::new(data);
+            let names = read_faces_bytes(&data).into_iter().next().unwrap();
+            let id = push(&mut d, info_from(names, FaceData::Shared(data), "test"));
+            expected.push((language, id));
+        }
+    }
+    let base = resolve("Inter", "Regular").face;
+    for &(_, id) in &expected {
+        assert!(face(id).has_char('页'));
+    }
+    // Force the original interleaving: Chinese starts, then Japanese replaces the global
+    // language before Chinese looks up its probe. The explicit request must still win.
+    set_cjk_locale("zh-hans");
+    set_cjk_locale("ja");
+    assert_eq!(fallback_for('页', base), expected[0].1);
+    assert_eq!(fallback_for_locale('页', base, "zh-hans"), expected[1].1);
+    // Do not clear the cache here: different policies must coexist in the same cache.
+    for _ in 0..3 {
+        for &(language, id) in &expected {
+            assert_eq!(fallback_for_locale('页', base, language), id, "{language}");
+        }
+    }
+    let barrier = Arc::new(std::sync::Barrier::new(expected.len()));
+    let threads: Vec<_> = expected
+        .into_iter()
+        .map(|(language, id)| {
+            let barrier = barrier.clone();
+            std::thread::spawn(move || {
+                barrier.wait();
+                for _ in 0..128 {
+                    set_cjk_locale(if language == "ja" { "zh-hans" } else { "ja" });
+                    assert_eq!(fallback_for_locale('页', base, language), id, "{language}");
+                }
+            })
+        })
+        .collect();
+    for thread in threads {
+        thread.join().unwrap();
+    }
+}
+
+/// #453: with a Chinese interface, a Han ideograph that both a Chinese and a Japanese face cover
+/// must reach the installed Simplified Chinese family first, or Chinese text in a composition is
+/// drawn with Japanese glyph forms. Fixture faces named after the macOS families keep this
+/// independent of the host's fonts and of rendering. Before the fix the Simplified list named none
+/// of the macOS faces a stock install has, so the walk below reached the Japanese face - the
+/// regression this guards.
+#[test]
+#[cfg(not(target_arch = "wasm32"))]
+fn zh_hans_han_fallback_puts_the_chinese_family_first() {
+    const CHILD: &str = "EFFECTCRAFT_TEST_ZH_HANS_ORDER";
+    if std::env::var_os(CHILD).is_none() {
+        run_in_child(CHILD, "fonts::tests::zh_hans_han_fallback_puts_the_chinese_family_first");
+        return;
+    }
+    let mut ids = Vec::new();
+    {
+        let mut d = db().write().unwrap();
+        d.scanned = true; // This test process uses only bundled and synthetic fonts.
+        // The Japanese face is added first, so scan order cannot be what picks the Chinese one.
+        for family in ["Hiragino Sans", "Hiragino Sans GB"] {
+            let mut data = test_font(family);
+            let table = data[12..12 + 8 * 16].as_chunks::<16>().0.iter().find(|t| &t[..4] == b"cmap").unwrap();
+            let cmap = u32::from_be_bytes(table[8..12].try_into().unwrap()) as usize + 12;
+            // Map 页 to the fixture's triangle glyph instead of its private-use range.
+            for (offset, value) in [(16, '页' as u16), (24, '页' as u16), (30, 2u16.wrapping_sub('页' as u16))] {
+                data[cmap + offset..cmap + offset + 2].copy_from_slice(&value.to_be_bytes());
+            }
+            let data = Arc::new(data);
+            let names = read_faces_bytes(&data).into_iter().next().unwrap();
+            ids.push(push(&mut d, info_from(names, FaceData::Shared(data), "test")));
+        }
+    }
+    let &[japanese, chinese] = ids.as_slice() else { panic!("two fixture faces expected: {ids:?}") };
+    let base = resolve("Inter", "Regular").face;
+    assert!(face(japanese).has_char('页') && face(chinese).has_char('页'));
+    // The fallback list itself, before any coverage check: the Chinese family comes first for
+    // zh-hans and second for ja, whether or not either face can draw the probe.
+    let zh_hans: Vec<FaceId> = family_faces(FallbackScript::Han, &face(base), CjkLocale::Simplified).to_vec();
+    assert_eq!(zh_hans, [chinese, japanese], "zh-hans tries the Chinese family first");
+    let ja: Vec<FaceId> = family_faces(FallbackScript::Han, &face(base), CjkLocale::Japanese).to_vec();
+    assert_eq!(ja, [japanese, chinese], "ja keeps the Japanese family first");
+    // ...and the face a layout actually gets for the shared ideograph.
+    assert_eq!(face(fallback_for_locale('页', base, "zh-hans")).info.family, "Hiragino Sans GB");
+    assert_eq!(face(fallback_for_locale('页', base, "ja")).info.family, "Hiragino Sans");
+}
+
+#[test]
+fn extra_font_dirs_come_from_a_path_list() {
+    assert!(extra_dirs(None).is_empty());
+    let v = std::env::join_paths(["/a/fonts", "/b/more"]).unwrap_or_default();
+    assert_eq!(extra_dirs(Some(&v)), vec![PathBuf::from("/a/fonts"), PathBuf::from("/b/more")]);
+    assert!(extra_dirs(Some(std::ffi::OsStr::new(""))).is_empty());
+}
+
+#[test]
+fn bundled_families_and_resolution() {
+    let fams = families();
+    let inter = fams.iter().find(|(f, _)| f == "Inter").expect("Inter");
+    for s in ["Regular", "Medium", "SemiBold", "Bold", "Italic"] {
+        assert!(inter.1.iter().any(|x| x == s), "{s} in {:?}", inter.1);
+    }
+    assert!(fams.iter().any(|(f, _)| f == "Noto Serif"));
+    assert!(fams.iter().any(|(f, _)| f == "JetBrains Mono"));
+    let b = resolve("inter", "bold");
+    assert_eq!(face(b.face).info.style, "Bold");
+    assert!(!b.synth_bold);
+    let faces = all_faces();
+    assert!(faces.iter().any(|f| f.info.family == "Noto Serif" && f.info.style == "Regular" && f.info.origin == "bundled"));
+    // A real installed Bold Italic — the face's own style, or a named instance of a variable
+    // face — takes priority. Partial installed families can instead supply the nearest
+    // weight/slant, so neither synthesis flag is fixed by the OS.
+    for family in ["Noto Serif", "Inter"] {
+        let resolved = resolve(family, "Bold Italic");
+        let selected = face(resolved.face);
+        assert!(selected.info.family.eq_ignore_ascii_case(family));
+        assert!(!resolved.missing);
+        let candidates: Vec<_> = faces.iter().filter(|f| f.info.family.eq_ignore_ascii_case(family)).collect();
+        let exact = candidates
+            .iter()
+            .find(|f| f.info.style.eq_ignore_ascii_case("Bold Italic"))
+            .or_else(|| candidates.iter().find(|f| f.info.instances.iter().any(|i| i.style.eq_ignore_ascii_case("Bold Italic"))));
+        if let Some(exact) = exact {
+            assert_eq!(resolved.face, exact.id, "real style wins for {family}");
+            let expected_instance = if exact.info.style.eq_ignore_ascii_case("Bold Italic") {
+                None
+            } else {
+                exact.info.instances.iter().position(|i| i.style.eq_ignore_ascii_case("Bold Italic")).and_then(|i| u16::try_from(i).ok())
+            };
+            assert_eq!(resolved.instance, expected_instance, "exact style instance for {family}");
+            assert!(!resolved.synth_bold && !resolved.synth_italic);
+        } else {
+            // Italic mismatch dominates any supported font weight distance. Named instances
+            // resolve at their effective weight and slant, not the face's defaults.
+            let selected_instance = resolved.instance.and_then(|i| selected.info.instances.get(usize::from(i)));
+            let selected_weight = selected_instance.map_or(selected.info.weight, |i| i.weight(selected.info.weight));
+            let selected_italic = selected_instance.map_or(selected.info.italic, |i| i.italic(selected.info.italic));
+            let distance = |weight: u16, italic: bool| u32::from(weight.abs_diff(700)) + if italic { 0 } else { 1_000 };
+            let nearest = candidates
+                .iter()
+                .flat_map(|f| {
+                    std::iter::once((f.info.weight, f.info.italic))
+                        .chain(f.info.instances.iter().map(move |i| (i.weight(f.info.weight), i.italic(f.info.italic))))
+                })
+                .map(|(weight, italic)| distance(weight, italic))
+                .min()
+                .unwrap();
+            assert_eq!(distance(selected_weight, selected_italic), nearest, "closest available style for {family}");
+            assert_eq!(resolved.synth_bold, selected_weight <= 500);
+            assert_eq!(resolved.synth_italic, !selected_italic);
+        }
+    }
+}
+
+#[test]
+fn missing_family_falls_back_to_inter() {
+    let r = resolve("No Such Font Family 123", "Regular");
+    assert_eq!(face(r.face).info.family, "Inter");
+    assert!(r.missing);
+}
+
+/// Native: the system scan reads name tables only and resolves families installed there.
+#[test]
+fn system_scan_finds_fonts() {
+    let t = std::time::Instant::now();
+    scan_system(); // (another test may have triggered the scan already)
+    let n = all_faces().iter().filter(|f| f.info.origin == "system").count();
+    eprintln!("system fonts: {n} faces in {:?}", t.elapsed());
+    assert_eq!(scan_system(), 0, "scans once");
+    // A minimum face count on Linux belongs with the native-fonts gate in #1591. A container
+    // that has fontconfig and only a handful of faces must still pass this portable test.
+    if cfg!(target_os = "macos") {
+        assert!(n > 20, "{n}");
+        let r = resolve("Helvetica", "Bold");
+        assert_eq!(face(r.face).info.family, "Helvetica");
+        let l = crate::layout_text("Helvetica", &crate::TextStyle { family: "Helvetica".into(), size: 30.0, ..Default::default() }, &Default::default());
+        assert!(!l.missing_font && l.glyphs.iter().all(|g| g.id != 0));
+    }
+}
+
+#[test]
+fn postscript_and_full_names_resolve() {
+    // Bundled Inter: name id 6 is `Inter-Bold`, name id 4 is `Inter Bold`.
+    let ps = resolve("Inter-Bold", "");
+    assert_eq!(face(ps.face).info.style, "Bold");
+    assert!(!ps.missing && !ps.synth_bold);
+    let full = resolve("inter semibold", "");
+    assert_eq!(face(full.face).info.style, "SemiBold");
+    assert!(!full.missing);
+    // A family name still wins over a name lookup.
+    assert_eq!(face(resolve("Inter", "Bold").face).info.style, "Bold");
+}
+
+/// #1563: a variable font's named instances are styles of its family. `fontStyle = "Black"`,
+/// the instance's PostScript name (`font = "Figtree-Black"`) and its full name select the
+/// instance's axis values instead of the default instance made bold synthetically, and the
+/// font menus list every instance.
+#[test]
+fn variable_named_instances_resolve_and_list() {
+    const FAMILY: &str = "EffectCraft Instance Test";
+    let instances = [
+        ("Light", 300.0, Some("EffectCraftInstanceTest-Light")),
+        ("Regular", 400.0, Some("EffectCraftInstanceTest-Regular")),
+        ("Black", 900.0, Some("EffectCraftInstanceTest-Black")),
+        ("Extra Bold", 800.0, None),
+        ("Bold Italic", 700.0, Some("EffectCraftInstanceTest-BoldItalic")),
+    ];
+    assert_eq!(add_font_data(crate::sfnt::test_font::variable(FAMILY, &instances, true)).len(), 1);
+    let wght = |r: &Resolved| instance_variations(r);
+    // By style name.
+    let black = resolve(FAMILY, "Black");
+    assert!(!black.missing && !black.synth_bold && !black.synth_italic, "{black:?}");
+    assert_eq!(wght(&black), vec![("wght".to_string(), 900.0)]);
+    assert_eq!(wght(&resolve(FAMILY, "regular")), vec![("wght".to_string(), 400.0)]);
+    // The face's own style is its default instance: no axis values to set.
+    let light = resolve(FAMILY, "Light");
+    assert_eq!((light.face, light.instance), (black.face, None));
+    // A style the family lacks takes the nearest instance's weight, no synthetic bold.
+    let bold = resolve(FAMILY, "Bold");
+    assert!(!bold.synth_bold, "{bold:?}");
+    assert_eq!(wght(&bold), vec![("wght".to_string(), 800.0)]);
+    // By PostScript name, the font's own and the derived one, and by full name.
+    let ps = resolve("EffectCraftInstanceTest-Black", "Regular");
+    assert!(!ps.missing && ps.face == black.face, "{ps:?}");
+    assert_eq!(wght(&ps), vec![("wght".to_string(), 900.0)]);
+    assert_eq!(wght(&resolve("EffectCraftInstanceTest-ExtraBold", "")), vec![("wght".to_string(), 800.0)]);
+    assert_eq!(wght(&resolve("effectcraft instance test extra bold", "")), vec![("wght".to_string(), 800.0)]);
+    // A named instance keeps its own index, so layout applies its axis values.
+    let bold_italic = resolve(FAMILY, "Bold Italic");
+    assert!(!bold_italic.missing && !bold_italic.synth_bold && !bold_italic.synth_italic);
+    assert_eq!((bold_italic.face, bold_italic.instance), (black.face, Some(4)));
+    assert_eq!(wght(&bold_italic), vec![("wght".to_string(), 700.0)]);
+    // The font menu lists every instance, in weight order.
+    let fams = families();
+    let styles = &fams.iter().find(|(f, _)| f == FAMILY).unwrap().1;
+    assert_eq!(styles, &["Light", "Regular", "Extra Bold", "Black", "Bold Italic"]);
+    // Static fonts are untouched.
+    assert_eq!(resolve("Inter", "Bold").instance, None);
+}
+
+/// Axis values set on the text win over the instance's; the others keep the instance's.
+#[test]
+fn explicit_variations_override_the_instance() {
+    let base = vec![("wdth".to_string(), 75.0), ("wght".to_string(), 900.0)];
+    assert_eq!(merge_variations(&base, &[("wght".to_string(), 450.0)]), vec![("wdth".to_string(), 75.0), ("wght".to_string(), 450.0)]);
+    assert_eq!(merge_variations(&base, &[]), base);
+    assert_eq!(merge_variations(&[], &[("opsz".to_string(), 12.0)]), vec![("opsz".to_string(), 12.0)]);
+}
+
+#[test]
+fn scripts_are_classified() {
+    assert_eq!(script_of('あ'), FallbackScript::Japanese);
+    assert_eq!(script_of('ｶ'), FallbackScript::Japanese);
+    assert_eq!(script_of('한'), FallbackScript::Korean);
+    assert_eq!(script_of('水'), FallbackScript::Han);
+    assert_eq!(script_of('、'), FallbackScript::Han);
+    assert_eq!(script_of('Ａ'), FallbackScript::Han);
+    assert_eq!(script_of('\u{20000}'), FallbackScript::Han);
+    assert_eq!(script_of('A'), FallbackScript::Other);
+    assert_eq!(script_of('م'), FallbackScript::Arabic);
+    assert_eq!(script_of('\u{fefb}'), FallbackScript::Arabic);
+    assert_eq!(script_of('\u{5d0}'), FallbackScript::Hebrew);
+    assert_eq!(script_of('क'), FallbackScript::Indic);
+    assert_eq!(script_of('த'), FallbackScript::Indic);
+    assert_eq!(script_of('ก'), FallbackScript::Thai);
+    assert_eq!(script_of('ა'), FallbackScript::Georgian);
+    assert_eq!(script_of('\u{1c90}'), FallbackScript::Georgian, "Mtavruli");
+    assert_eq!(script_of('\u{feff}'), FallbackScript::Other, "the byte order mark is no Arabic letter");
+}
+
+/// Native: Arabic, Hebrew, Indic and Thai text in a Latin-only family falls back to the
+/// platform's plain text family for its script (#394), not to the first installed face that
+/// covers it (on Windows a calligraphic Arabic face sorts first). Skipped per script where no
+/// family from its list is installed.
+#[test]
+fn other_scripts_fall_back_to_a_plain_system_family() {
+    scan_system();
+    let inter = resolve("Inter", "Regular").face;
+    for (c, families) in [('م', ARABIC_FAMILIES), ('א', HEBREW_FAMILIES), ('क', INDIC_FAMILIES), ('த', INDIC_FAMILIES), ('ก', THAI_FAMILIES)] {
+        let covering = families.iter().any(|n| resolve_in(n, "Regular").is_some_and(|r| face(r.face).has_char(c)));
+        if !covering {
+            eprintln!("{c}: no family from the list is installed; skipping");
+            continue;
+        }
+        let f = face(fallback_for(c, inter));
+        assert!(f.has_char(c), "{c}: {} lacks it", f.info.family);
+        assert!(families.iter().any(|n| f.info.family.eq_ignore_ascii_case(n)), "{c} → {}", f.info.family);
+    }
+}
+
+/// Native: Mkhedruli in a Latin-only family falls back to a family from the Georgian list,
+/// ahead of faces already loaded and of the scan order. Skipped where no family from the list
+/// is installed.
+#[test]
+fn georgian_falls_back_to_a_georgian_system_family() {
+    scan_system();
+    let c = 'ა';
+    if !GEORGIAN_FAMILIES.iter().any(|n| resolve_in(n, "Regular").is_some_and(|r| face(r.face).has_char(c))) {
+        eprintln!("no Georgian family from the list is installed; skipping");
+        return;
+    }
+    let f = face(fallback_for(c, resolve("Inter", "Regular").face));
+    assert!(f.has_char(c), "{} lacks it", f.info.family);
+    assert!(GEORGIAN_FAMILIES.iter().any(|n| f.info.family.eq_ignore_ascii_case(n)), "{c} → {}", f.info.family);
+}
+
+/// Native: Japanese text in a Latin-only family falls back to an installed Japanese family
+/// (whichever the platform ships) instead of the missing-glyph box, without any layer having
+/// loaded a CJK font first. Skipped where no family from the list is installed.
+#[test]
+fn cjk_falls_back_to_a_system_family() {
+    scan_system();
+    let inter = resolve("Inter", "Bold").face;
+    let installed = JAPANESE_FAMILIES.iter().any(|f| resolve_in(f, "Regular").is_some());
+    if !installed {
+        eprintln!("no Japanese family installed; skipping");
+        return;
+    }
+    for c in ['水', 'あ', 'ア', '。'] {
+        let id = fallback_for(c, inter);
+        let f = face(id);
+        assert!(f.has_char(c), "{c}: {} {} lacks it", f.info.family, f.info.style);
+        assert!(JAPANESE_FAMILIES.iter().any(|n| f.info.family.eq_ignore_ascii_case(n)), "{c} → {}", f.info.family);
+    }
+    // The bold cut of the fallback family is chosen for bold text when the family has one.
+    let f = face(fallback_for('水', inter));
+    let (w, _) = style_wants(&f.info.style);
+    let has_bold = all_faces().iter().any(|g| g.info.family == f.info.family && style_wants(&g.info.style).0 >= 600);
+    assert!(!has_bold || w >= 600, "{} {}", f.info.family, f.info.style);
+    // Cached: the second call is a lookup.
+    assert_eq!(fallback_for('水', inter), f.id);
+}
+
+/// A minimal TrueType font built in code (no font file in the repo): U+0020 and U+E000 map to
+/// an empty glyph, U+E001 to a triangle.
+fn blank_glyph_font() -> Vec<u8> {
+    test_font("Blank Glyph Test")
+}
+
+/// The blank-glyph test font under another family name.
+fn test_font(family: &str) -> Vec<u8> {
+    fn u16s(v: &[u16]) -> Vec<u8> {
+        v.iter().flat_map(|x| x.to_be_bytes()).collect()
+    }
+    let delta_space = 1u16.wrapping_sub(0x20);
+    let cmap4 = {
+        let mut t = u16s(&[4, 0, 0, 6, 4, 1, 2]);
+        t.extend(u16s(&[0x20, 0xE001, 0xFFFF, 0, 0x20, 0xE000, 0xFFFF, delta_space, 0x2001, 1, 0, 0, 0]));
+        let len = t.len() as u16;
+        t[2..4].copy_from_slice(&len.to_be_bytes());
+        t
+    };
+    let mut cmap = u16s(&[0, 1, 3, 1, 0, 12]);
+    cmap.extend(cmap4);
+    // glyph 2: one contour of three on-curve points (100,0) (500,0) (300,600)
+    let mut glyf = u16s(&[1, 100, 0, 500, 600, 2, 0]);
+    glyf.extend([1u8, 1, 1]);
+    glyf.extend(u16s(&[100, 400, (-200i16) as u16, 0, 0, 600]));
+    glyf.push(0);
+    let loca = u16s(&[0, 0, 0, (glyf.len() / 2) as u16]);
+    let mut head = u16s(&[1, 0, 1, 0, 0, 0, 0x5F0F, 0x3CF5, 0, 1000]);
+    head.extend([0u8; 16]);
+    head.extend(u16s(&[100, 0, 500, 600, 0, 8, 2, 0, 0]));
+    let mut hhea = u16s(&[1, 0, 800, (-200i16) as u16, 0, 600, 0, 0, 500, 1, 0, 0]);
+    hhea.extend([0u8; 8]);
+    hhea.extend(u16s(&[0, 3]));
+    let hmtx = u16s(&[600, 0, 600, 0, 600, 0]);
+    let maxp = u16s(&[1, 0, 3, 3, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0]);
+    let strings: Vec<Vec<u8>> = [family, "Regular"].iter().map(|s| s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect()).collect();
+    let mut name = u16s(&[0, 2, 30]);
+    let mut off = 0;
+    for (id, st) in strings.iter().enumerate() {
+        name.extend(u16s(&[3, 1, 0x409, id as u16 + 1, st.len() as u16, off]));
+        off += st.len() as u16;
+    }
+    strings.iter().for_each(|st| name.extend(st));
+    let tables: [(&[u8; 4], Vec<u8>); 8] =
+        [(b"cmap", cmap), (b"glyf", glyf), (b"head", head), (b"hhea", hhea), (b"hmtx", hmtx), (b"loca", loca), (b"maxp", maxp), (b"name", name)];
+    let mut out = u16s(&[1, 0, tables.len() as u16, 128, 3, 0]);
+    let mut offset = 12 + 16 * tables.len();
+    let mut body = vec![];
+    for (tag, data) in &tables {
+        out.extend(*tag);
+        out.extend([0u8; 4]);
+        out.extend((offset as u32).to_be_bytes());
+        out.extend((data.len() as u32).to_be_bytes());
+        let padded = data.len().div_ceil(4) * 4;
+        body.extend(data);
+        body.resize(body.len() + padded - data.len(), 0);
+        offset += padded;
+    }
+    out.extend(body);
+    out
+}
+
+/// A face that maps a character to an empty glyph doesn't cover it, so fallback skips it
+/// (#285); a blank space still counts, and a drawn glyph is found as before.
+#[test]
+fn an_empty_glyph_does_not_cover_its_character() {
+    let ids = add_font_data(blank_glyph_font());
+    let &[id] = ids.as_slice() else { panic!("one face expected: {ids:?}") };
+    let f = face(id);
+    assert_eq!(f.info.family, "Blank Glyph Test");
+    assert!(f.glyph('\u{e000}').is_some(), "the cmap maps it");
+    assert!(!f.has_char('\u{e000}'), "but its glyph is empty");
+    assert!(f.has_char('\u{e001}'), "a drawn glyph covers its character");
+    assert!(f.has_char(' '), "a space is blank by nature");
+    let inter = resolve("Inter", "Regular").face;
+    assert_ne!(fallback_for('\u{e000}', inter), id, "fallback never picks the empty glyph");
+    assert_eq!(fallback_for('\u{e001}', inter), id, "fallback finds the drawn one");
+}
+
+/// A missing Microsoft family uses its metric-compatible substitute instead of Inter and still
+/// reports itself missing (#1677). An installed original family takes precedence.
+#[test]
+fn microsoft_families_resolve_to_metric_compatible_substitutes() {
+    add_font_data(test_font("Carlito"));
+    add_font_data(test_font("Caladea"));
+    for (requested, style, substitute) in [("Calibri", "Regular", "Carlito"), ("Cambria", "Bold", "Caladea")] {
+        let alias = resolve_alias(requested, style).expect("the substitute is available");
+        assert_eq!(face(alias.face).info.family, substitute);
+        assert!(alias.missing, "the original name stays missing for Find Missing Fonts");
+
+        let resolved = resolve(requested, style);
+        let family = &face(resolved.face).info.family;
+        if family.eq_ignore_ascii_case(requested) {
+            assert!(!resolved.missing, "an installed original family is available");
+        } else {
+            assert_eq!(family, substitute);
+            assert!(resolved.missing);
+        }
+    }
+    let unknown = resolve("No Such Family 1677", "Regular");
+    assert_eq!(face(unknown.face).info.family, DEFAULT_FAMILY);
+    assert!(unknown.missing);
+}
+
+#[test]
+fn the_han_order_follows_the_cjk_locale() {
+    // Chinese first for any Chinese tag, whether or not it names a script.
+    for tag in ["zh", "zh-CN", "zh_Hans", "ZH-Hant-TW.UTF-8", "zh_MO"] {
+        assert_eq!(han_order_for(tag)[0], FallbackScript::Han, "{tag}");
+    }
+    assert_eq!(han_order_for("ko-KR"), [FallbackScript::Korean, FallbackScript::Japanese, FallbackScript::Han]);
+    // Japanese, and anything else, keeps the Japanese face first for Han text.
+    for tag in ["ja_JP.UTF-8", "en-US", "de", ""] {
+        assert_eq!(han_order_for(tag), [FallbackScript::Japanese, FallbackScript::Han, FallbackScript::Korean], "{tag}");
+    }
+    // The host's request is what `han_order` reads (the ui test covers the effect on the
+    // registered fallbacks; this only checks that clearing it returns to the environment).
+    assert_eq!(requested_cjk_locale(), None, "tests run without a request");
+    assert_eq!(han_order(), han_order_for(&active_cjk_locale()));
+}
+
+#[test]
+fn the_chinese_family_list_follows_the_script_the_locale_asks_for() {
+    for tag in ["zh", "zh-CN", "zh_Hans", "zh_CN.UTF-8", "zh-SG"] {
+        assert_eq!(chinese_families_for(tag), SIMPLIFIED_CHINESE_FAMILIES, "{tag}");
+    }
+    for tag in ["zh-Hant", "zh-Hant-TW", "zh_TW", "zh-HK", "zh_MO.UTF-8"] {
+        assert_eq!(chinese_families_for(tag), TRADITIONAL_CHINESE_FAMILIES, "{tag}");
+    }
+    // Each list carries its own script's faces and not the other's, which is the point of
+    // splitting them: `PingFang SC` covers the same code points as `PingFang TC`, so the
+    // fallback search would have kept it and drawn Simplified forms in a Traditional interface.
+    assert!(SIMPLIFIED_CHINESE_FAMILIES.iter().any(|f| f.contains("PingFang SC") && !f.contains("Source")));
+    assert!(!SIMPLIFIED_CHINESE_FAMILIES.iter().any(|f| f.contains("TC") || f.contains("JhengHei")));
+    assert!(TRADITIONAL_CHINESE_FAMILIES.iter().any(|f| f.contains("PingFang TC")));
+    assert!(!TRADITIONAL_CHINESE_FAMILIES.iter().any(|f| f.contains(" SC") || f.contains("YaHei") || f.contains("WenQuanYi")));
+    assert!(TRADITIONAL_CHINESE_FAMILIES.iter().any(|f| f.contains("Heiti TC") || f.contains("Hiragino Sans CNS")));
+    // The arm the fallback itself walks: Han hands over the list the locale's script picked.
+    assert_eq!(families_for(FallbackScript::Han, CjkLocale::from_tag(&active_cjk_locale())), chinese_families_for(&active_cjk_locale()));
+    // Han text is the only thing these lists serve; the Japanese order does not change.
+    assert_eq!(han_order_for("ja_JP.UTF-8")[0], FallbackScript::Japanese);
+}
+
+#[test]
+fn the_rendered_order_keeps_the_print_face_first() {
+    // A composed frame renders with these lists, so they keep the platform's print order: the
+    // interface prefers the platform's UI faces on its own (see `install_script_fallbacks` in
+    // the ui crate), and an existing project must not render differently because a window's
+    // chrome changed.
+    let pos = |list: &[&str], name: &str| list.iter().position(|f| *f == name).unwrap_or(usize::MAX);
+    assert!(
+        pos(JAPANESE_FAMILIES, "Yu Gothic") < pos(JAPANESE_FAMILIES, "Yu Gothic UI"),
+        "the print face must come before its UI sibling: {JAPANESE_FAMILIES:?}"
+    );
+    for name in ["Meiryo UI", "MS UI Gothic"] {
+        assert!(!JAPANESE_FAMILIES.contains(&name), "{name} belongs to the interface order, not this list");
+    }
+    assert_eq!(SIMPLIFIED_CHINESE_FAMILIES[0], "Microsoft YaHei");
+    assert_eq!(TRADITIONAL_CHINESE_FAMILIES[0], "Microsoft JhengHei");
+    for name in ["Microsoft YaHei UI", "Microsoft JhengHei UI", "PMingLiU"] {
+        assert!(
+            !SIMPLIFIED_CHINESE_FAMILIES.contains(&name) && !TRADITIONAL_CHINESE_FAMILIES.contains(&name),
+            "{name} belongs to the interface order, not these lists"
+        );
+    }
+}
+
+#[test]
+fn bundled_ui_fonts_cover_the_ukrainian_alphabet() {
+    const ALPHABET: &str = "АБВГҐДЕЄЖЗИІЇЙКЛМНОПРСТУФХЦЧШЩЬЮЯабвгґдеєжзиіїйклмнопрстуфхцчшщьюя’«»";
+    for (name, bytes) in
+        [("Inter Regular", INTER_REGULAR), ("Inter Medium", INTER_MEDIUM), ("Inter SemiBold", INTER_SEMIBOLD), ("JetBrains Mono", JETBRAINS_MONO_REGULAR)]
+    {
+        let font = FontRef::new(bytes).unwrap();
+        for c in ALPHABET.chars() {
+            assert!(covers(&font, c), "{name} cannot draw {c}");
+        }
+    }
+}
+
+#[test]
+fn metrics_and_coverage() {
+    let f = face(resolve("Inter", "Regular").face);
+    let m = f.metrics(100.0);
+    assert!(m.ascent > 80.0 && m.ascent < 110.0, "{m:?}");
+    assert!(m.descent > 10.0 && m.descent < 40.0);
+    assert!(m.cap_height > 60.0 && m.cap_height < 80.0);
+    assert!(f.has_char('A') && f.has_char('Ж'));
+    assert!(!f.has_char('\u{5d0}'), "Inter has no Hebrew");
+    assert!(f.has_feature(b"liga") || f.has_feature(b"calt"));
+}
+
+#[test]
+fn unknown_face_id_returns_bundled_default() {
+    let fallback = face(usize::MAX);
+    assert_eq!(fallback.id, 0);
+    assert_eq!(fallback.info.family, DEFAULT_FAMILY);
+    assert!(fallback.font().is_some());
+    assert!(Arc::ptr_eq(&fallback, &face(0)));
+}
diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs
index 2e863d1ae..4c0b5a436 100644
--- a/crates/text/src/layout.rs
+++ b/crates/text/src/layout.rs
@@ -20,7 +20,7 @@ use unicode_bidi::{BidiInfo, Level};
 
 use effectcraft_keyframe::{OpenType, text_doc::paragraph_ranges};
 
-use crate::fonts::{self, FaceId, Resolved};
+use crate::fonts::{self, FaceId, Resolved, VMetrics};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
 pub enum Caps {
@@ -399,7 +399,7 @@ enum Form {
 pub fn feature_substitutes(face: FaceId, tag: &[u8; 4], c: char) -> bool {
     static C: OnceLock<Mutex<HashMap<(FaceId, [u8; 4], char), bool>>> = OnceLock::new();
     let cache = C.get_or_init(Default::default);
-    if let Some(v) = cache.lock().unwrap_or_else(|e| e.into_inner()).get(&(face, *tag, c)) {
+    if let Some(v) = cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&(face, *tag, c)) {
         return *v;
     }
     let f = fonts::face(face);
@@ -419,7 +419,7 @@ pub fn feature_substitutes(face: FaceId, tag: &[u8; 4], c: char) -> bool {
             }
             _ => false,
         };
-    let mut m = cache.lock().unwrap_or_else(|e| e.into_inner());
+    let mut m = cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if m.len() > 100_000 {
         m.clear();
     }
@@ -565,6 +565,34 @@ fn space_item(glyphs: &mut [ShapedGlyph], style: &TextStyle, text: &str, para_st
     }
 }
 
+/// After Effects' first-baseline offset of paragraph (box) text for a face at nominal size
+/// `px`: the height of its lowercase `d`, in whole thousandths of an em. Measured in After
+/// Effects 2026 (case 818): the first baseline sits 69.50 px below the box top for Times New
+/// Roman at 100 px (its `d` is 1422/2048 em, 694.3 thousandths, rounded 695) and 71.60 px for
+/// Arial (1466/2048, 715.8, rounded 716), at 50 px half of that; superscript text keeps the
+/// line where normal text puts it and only raises its glyphs. `None` without a `d` outline.
+fn first_ascent(face: FaceId, px: f32) -> Option<f32> {
+    let f = fonts::face(face);
+    let gid = f.glyph('d')?;
+    let units = crate::outline_units(face, gid)?;
+    let top = kurbo::Shape::bounding_box(&*units).y1 as f32;
+    let em = (top / f.units_per_em() * 1000.0).round() / 1000.0;
+    plausible_first(em, px, f.metrics(px).ascent)
+}
+
+/// A `d` at least this fraction of the font ascent is a Latin lowercase ascender; a shorter one
+/// (a symbol or icon font's `d`) would put the first baseline almost at the box top, so the font
+/// ascent is used instead (the rule before the `d` height).
+const MIN_D_OF_ASCENT: f32 = 0.3;
+
+/// The first baseline `em * px` below the box top, if `em` (the `d` height in em) is plausible:
+/// finite, positive, under 4 em and at least [`MIN_D_OF_ASCENT`] of the font `ascent` (px).
+fn plausible_first(em: f32, px: f32, ascent: f32) -> Option<f32> {
+    let h = em * px;
+    let tall_enough = !(ascent.is_finite() && ascent > 0.0) || h >= MIN_D_OF_ASCENT * ascent;
+    (h.is_finite() && h > 0.0 && em < 4.0 && tall_enough).then_some(h)
+}
+
 struct ParaLine {
     range: Range<usize>,
     glyphs: Vec<Glyph>,
@@ -575,6 +603,9 @@ struct ParaLine {
     hang: (f32, f32),
     ascent: f32,
     descent: f32,
+    /// Where a box's first line puts its baseline below the box top ([`first_ascent`] of the
+    /// line's styles at their nominal size; the font ascent where a face has no `d`).
+    first: f32,
     /// Line advance (largest leading on the line).
     advance: f32,
     align: Align,
@@ -597,53 +628,394 @@ fn run_at(runs: &[(Range<usize>, TextStyle)], b: usize) -> usize {
 }
 
 /// Lay out one paragraph (no newlines) whose text starts at byte `base` of the whole string.
-fn paragraph(text: &str, base: usize, runs: &[(Range<usize>, TextStyle)], primaries: &[Resolved], para: &ParagraphStyle, width: Option<f32>) -> Vec<ParaLine> {
-    let rtl_para = para.rtl == Some(true);
-    let margins_for = |first: bool| -> (f32, f32) {
-        let fi = if first { para.indent_first } else { 0.0 };
-        if rtl_para { (para.indent_end, para.indent_start + fi) } else { (para.indent_start + fi, para.indent_end) }
-    };
-    let avail_for = |first: bool| -> Option<f32> {
-        let (l, r) = margins_for(first);
-        width.map(|w| (w - l - r).max(1.0))
-    };
-    let style_metrics = |si: usize| {
-        let st = &runs[si].1;
-        fonts::face(primaries[si].face).metrics(st.glyph_size())
-    };
-    let eff_align = |last: bool| -> Align {
-        if (last || width.is_none()) && para.align == Align::Justify {
-            if width.is_none() && para.justify_last == Align::Justify { Align::Left } else { para.justify_last }
-        } else {
-            para.align
-        }
-    };
-    if text.is_empty() {
-        let si = run_at(runs, base);
-        let pm = style_metrics(si);
-        return vec![ParaLine {
-            range: base..base,
-            glyphs: vec![],
-            carets: vec![(base, 0.0)],
-            content: 0.0,
-            left_trim: 0.0,
-            hang: (0.0, 0.0),
-            ascent: pm.ascent,
-            descent: pm.descent,
-            advance: runs[si].1.line_advance(),
-            align: eff_align(true),
-            avail: avail_for(true),
-            margins: margins_for(true),
-            underline: None,
-        }];
+/// Margins (left, right) of a paragraph's first or later lines.
+/// `rtl` is the resolved paragraph direction (an unset direction follows the text).
+fn margins_for(para: &ParagraphStyle, rtl: bool, first: bool) -> (f32, f32) {
+    let fi = if first { para.indent_first } else { 0.0 };
+    if rtl { (para.indent_end, para.indent_start + fi) } else { (para.indent_start + fi, para.indent_end) }
+}
+
+/// The width a line may fill (`None` for point text).
+fn avail_for(para: &ParagraphStyle, rtl: bool, width: Option<f32>, first: bool) -> Option<f32> {
+    let (l, r) = margins_for(para, rtl, first);
+    width.map(|w| (w - l - r).max(1.0))
+}
+
+/// The alignment of a line, justified lines that cannot stretch falling back to `justify_last`.
+fn align_for(para: &ParagraphStyle, rtl: bool, width: Option<f32>, last: bool) -> Align {
+    if rtl && width.is_none() && para.align == Align::Justify {
+        // Right-to-left point text with a justified paragraph sits flush at its start, the
+        // right (After Effects 2026, every justify code; left-to-right not measured).
+        Align::Right
+    } else if (last || width.is_none()) && para.align == Align::Justify {
+        if width.is_none() && para.justify_last == Align::Justify { Align::Left } else { para.justify_last }
+    } else {
+        para.align
     }
-    let default_level = para.rtl.map(|r| if r { Level::rtl() } else { Level::ltr() });
-    let bidi = BidiInfo::new(text, default_level);
-    let pinfo = &bidi.paragraphs[0];
-    let base_rtl = pinfo.level.is_rtl();
-    // per char: (byte, char, shaped char, face, rtl, form, run)
-    let chars: Vec<(usize, char, char, FaceId, bool, Form, usize)> = text
-        .char_indices()
+}
+
+fn style_metrics(primaries: &[Resolved], runs: &[(Range<usize>, TextStyle)], si: usize) -> VMetrics {
+    fonts::face(primaries[si].face).metrics(runs[si].1.glyph_size())
+}
+
+/// The baseline of a box's first line for style run `si`: the `d` height, else the font ascent.
+fn style_first(primaries: &[Resolved], runs: &[(Range<usize>, TextStyle)], si: usize) -> f32 {
+    let st = &runs[si].1;
+    first_ascent(primaries[si].face, st.size).unwrap_or_else(|| fonts::face(primaries[si].face).metrics(st.size).ascent)
+}
+
+/// A char's shaping inputs: (byte, char, shaped char, face, rtl, form, run).
+type CharInfo = (usize, char, char, FaceId, bool, Form, usize);
+
+/// The glyphs of one line in visual order, where its pen ended, the extent of each cluster by
+/// byte, and the underline span.
+struct Placed {
+    glyphs: Vec<Glyph>,
+    pen: f32,
+    extents: HashMap<usize, (f32, f32, bool)>,
+    underline: Option<(f32, f32)>,
+}
+
+/// A paragraph shaped and measured, ready to be broken into lines.
+struct Para<'a> {
+    text: &'a str,
+    base: usize,
+    runs: &'a [(Range<usize>, TextStyle)],
+    primaries: &'a [Resolved],
+    variation_ids: &'a [u32],
+    para: &'a ParagraphStyle,
+    width: Option<f32>,
+    bidi: BidiInfo<'a>,
+    base_rtl: bool,
+    chars: Vec<CharInfo>,
+    items: Vec<Item>,
+    /// Advance of the glyphs at each byte, and prefix sums over it.
+    char_adv: Vec<f32>,
+    prefix_adv: Vec<f64>,
+    previous_non_ws: Vec<usize>,
+}
+
+impl<'a> Para<'a> {
+    fn new(
+        text: &'a str,
+        base: usize,
+        runs: &'a [(Range<usize>, TextStyle)],
+        primaries: &'a [Resolved],
+        variation_ids: &'a [u32],
+        para: &'a ParagraphStyle,
+        width: Option<f32>,
+    ) -> Self {
+        let default_level = para.rtl.map(|r| if r { Level::rtl() } else { Level::ltr() });
+        let bidi = BidiInfo::new(text, default_level);
+        let base_rtl = bidi.paragraphs[0].level.is_rtl();
+        let chars = char_forms(text, base, runs, primaries, &bidi);
+        let items = build_items(text, &chars, runs);
+        // Prefix widths and the preceding non-whitespace boundary make candidate line widths O(1).
+        // Every-line composition evaluates O(n²) candidate breaks; summing each candidate's bytes
+        // or rescanning its trailing whitespace would otherwise add another factor of text length.
+        let mut char_adv = vec![0.0f32; text.len() + 1];
+        for it in &items {
+            for g in &it.glyphs {
+                char_adv[g.cluster.min(text.len())] += g.adv + g.pre;
+            }
+        }
+        let mut prefix_adv = vec![0.0f64; text.len() + 1];
+        for i in 0..text.len() {
+            prefix_adv[i + 1] = prefix_adv[i] + f64::from(char_adv[i]);
+        }
+        let mut previous_non_ws = vec![0usize; text.len() + 1];
+        let mut non_ws_end = 0usize;
+        for (b, c) in text.char_indices() {
+            previous_non_ws[b] = non_ws_end;
+            if !c.is_whitespace() {
+                non_ws_end = b + c.len_utf8();
+            }
+            previous_non_ws[b + c.len_utf8()] = non_ws_end;
+        }
+        Para { text, base, runs, primaries, variation_ids, para, width, bidi, base_rtl, chars, items, char_adv, prefix_adv, previous_non_ws }
+    }
+
+    fn range_w(&self, r: Range<usize>) -> f32 {
+        (self.prefix_adv[r.end] - self.prefix_adv[r.start]) as f32
+    }
+
+    fn trailing_ws(&self, r: &Range<usize>) -> (usize, f32) {
+        let end = self.previous_non_ws[r.end].max(r.start).min(r.end);
+        (end, (self.prefix_adv[r.end] - self.prefix_adv[end]) as f32)
+    }
+
+    /// Hanging punctuation widths (left, right) of a line's content.
+    fn hang_of(&self, r: &Range<usize>, ce: usize) -> (f32, f32) {
+        if !self.para.hanging || self.width.is_none() || r.start >= ce {
+            return (0.0, 0.0);
+        }
+        let first = self.text[r.start..ce].chars().next().filter(|c| is_hanging_open(*c)).map_or(0.0, |_| self.char_adv[r.start]);
+        let last = self.text[r.start..ce].char_indices().next_back().filter(|(_, c)| is_hanging_close(*c)).map_or(0.0, |(b, _)| self.char_adv[r.start + b]);
+        (first, last)
+    }
+
+    fn fits_w(&self, r: &Range<usize>) -> f32 {
+        let (ce, _) = self.trailing_ws(r);
+        let (hl, hr) = self.hang_of(r, ce);
+        self.range_w(r.start..ce) - hl - hr
+    }
+
+    fn line_avail(&self, line: usize) -> f32 {
+        avail_for(self.para, self.base_rtl, self.width, line == 0).unwrap_or(f32::MAX)
+    }
+
+    /// The byte ranges of the lines, for the wrap width.
+    fn break_ranges(&self) -> Vec<Range<usize>> {
+        if self.width.is_none() {
+            return std::iter::once(0..self.text.len()).collect();
+        }
+        let opps: Vec<usize> = unicode_linebreak::linebreaks(self.text).map(|(p, _)| p).collect();
+        let mut ranges = if self.para.every_line && opps.len() > 1 && opps.len() <= 1500 { self.optimal_breaks(&opps) } else { self.greedy_breaks(opps) };
+        ranges.retain(|r| !r.is_empty());
+        if ranges.is_empty() {
+            ranges.push(0..self.text.len());
+        }
+        ranges
+    }
+
+    /// Minimises the summed squared slack of every line but the last; with Justify All the last
+    /// line is stretched too, so its slack counts (After Effects then balances the lines: 4 / 4 / 4
+    /// words where the other modes break 6 / 6 / 1).
+    fn optimal_breaks(&self, opps: &[usize]) -> Vec<Range<usize>> {
+        let last_counts = self.para.align == Align::Justify && self.para.justify_last == Align::Justify;
+        let nodes: Vec<usize> = std::iter::once(0).chain(opps.iter().copied()).collect();
+        let m = nodes.len();
+        let mut best = vec![(f32::INFINITY, 0usize); m];
+        best[0] = (0.0, 0);
+        for j in 1..m {
+            for i in (0..j).rev() {
+                if !best[i].0.is_finite() {
+                    continue;
+                }
+                let r = nodes[i]..nodes[j];
+                let w = self.fits_w(&r);
+                let maxw = self.line_avail(usize::from(i != 0));
+                let over = w > maxw;
+                if over && i + 1 != j {
+                    break;
+                }
+                let slack = maxw - w;
+                let cost = if over {
+                    1e12 + w
+                } else if j == m - 1 && !last_counts {
+                    0.0
+                } else {
+                    slack * slack
+                };
+                let total = best[i].0 + cost;
+                if total < best[j].0 {
+                    best[j] = (total, i);
+                }
+            }
+        }
+        let mut ranges = Vec::new();
+        let mut j = m - 1;
+        while j > 0 {
+            let i = best[j].1;
+            ranges.push(nodes[i]..nodes[j]);
+            j = i;
+        }
+        ranges.reverse();
+        ranges
+    }
+
+    /// Breaks at each opportunity that still fits, else at the last one that did.
+    fn greedy_breaks(&self, opps: Vec<usize>) -> Vec<Range<usize>> {
+        let mut ranges = Vec::new();
+        let mut start = 0usize;
+        let mut last_ok: Option<usize> = None;
+        for p in opps {
+            loop {
+                let w = self.fits_w(&(start..p));
+                if w <= self.line_avail(ranges.len()) || last_ok.is_none() {
+                    last_ok = Some(p);
+                    break;
+                }
+                let Some(b) = last_ok.take() else { break };
+                ranges.push(start..b);
+                start = b;
+            }
+        }
+        ranges.push(start..self.text.len());
+        ranges
+    }
+
+    /// The line over byte range `r`: the `li`-th of the paragraph, `last` if it is the final one.
+    fn place_line(&self, li: usize, r: Range<usize>, last: bool) -> ParaLine {
+        let align = align_for(self.para, self.base_rtl, self.width, last);
+        let avail = avail_for(self.para, self.base_rtl, self.width, li == 0);
+        let (ce, tw) = self.trailing_ws(&r);
+        let hang = self.hang_of(&r, ce);
+        let content = self.range_w(r.start..ce);
+        // justification
+        let mut space_extra = 0.0;
+        if align == Align::Justify
+            && let Some(maxw) = avail
+        {
+            let spaces = self.text[r.start..ce].chars().filter(|c| *c == ' ').count();
+            if spaces > 0 {
+                space_extra = ((maxw - (content - hang.0 - hang.1)) / spaces as f32).max(0.0);
+            }
+        }
+        let placed = self.place_glyphs(&r, space_extra, ce);
+        let carets = self.carets(&r, &placed.extents, placed.pen);
+        let (asc, desc, adv, first) = self.line_metrics(&r, &placed.glyphs);
+        let content_w = if space_extra > 0.0 { avail.map_or(content, |a| a + hang.0 + hang.1) } else { content };
+        ParaLine {
+            range: self.base + r.start..self.base + r.end,
+            glyphs: placed.glyphs,
+            carets,
+            content: content_w,
+            left_trim: if self.base_rtl { tw } else { 0.0 },
+            hang,
+            ascent: asc,
+            descent: desc,
+            first,
+            advance: adv,
+            align,
+            avail,
+            margins: margins_for(self.para, self.base_rtl, li == 0),
+            underline: placed.underline,
+        }
+    }
+
+    fn place_glyphs(&self, r: &Range<usize>, space_extra: f32, ce: usize) -> Placed {
+        let (levels, vruns) = self.bidi.visual_runs(&self.bidi.paragraphs[0], r.clone());
+        let mut pen = 0.0f32;
+        let mut glyphs = Vec::new();
+        let mut extents: HashMap<usize, (f32, f32, bool)> = HashMap::new();
+        let mut underline: Option<(f32, f32)> = None;
+        for run in vruns {
+            let rtl = levels[run.start].is_rtl();
+            // Items are ordered and disjoint: binary-search both ends of the overlapping slice.
+            let run_limit = self.items.partition_point(|item| item.range.start < run.end);
+            let run_first = self.items[..run_limit].partition_point(|item| item.range.end <= run.start);
+            let mut idx: Vec<usize> = (run_first..run_limit).collect();
+            if rtl {
+                idx.reverse();
+            }
+            for k in idx {
+                for g in self.items[k].glyphs.iter().filter(|g| run.contains(&g.cluster)) {
+                    let st = &self.runs[g.run].1;
+                    let x0 = pen;
+                    pen += g.pre;
+                    glyphs.push(Glyph {
+                        face: g.face,
+                        id: g.id,
+                        x: pen + g.dx,
+                        y: -g.dy - g.rise,
+                        size: g.size,
+                        cluster: self.base + g.cluster,
+                        synth_bold: self.primaries[g.run].synth_bold || st.faux_bold,
+                        synth_italic: self.primaries[g.run].synth_italic || st.faux_italic,
+                        h_scale: st.h_scale,
+                        v_scale: st.v_scale,
+                        run: g.run,
+                        variations: self.variation_ids[g.run],
+                    });
+                    pen += g.adv;
+                    if space_extra > 0.0 && self.text[g.cluster..].starts_with(' ') && g.cluster < ce {
+                        pen += space_extra;
+                    }
+                    if st.underline && g.cluster < ce {
+                        let u = underline.get_or_insert((x0, pen));
+                        u.0 = u.0.min(x0);
+                        u.1 = u.1.max(pen);
+                    }
+                    let e = extents.entry(g.cluster).or_insert((x0, pen, self.items[k].rtl));
+                    e.0 = e.0.min(x0);
+                    e.1 = e.1.max(pen);
+                }
+            }
+        }
+        Placed { glyphs, pen, extents, underline }
+    }
+
+    /// Caret stops at each char boundary of the line, and at its end.
+    fn carets(&self, r: &Range<usize>, extents: &HashMap<usize, (f32, f32, bool)>, pen: f32) -> Vec<(usize, f32)> {
+        let mut carets = Vec::new();
+        let mut cluster_starts: Vec<usize> = extents.keys().copied().collect();
+        cluster_starts.sort_unstable();
+        let char_bytes: Vec<usize> = self.text[r.clone()].char_indices().map(|(b, _)| r.start + b).collect();
+        let mut char_index = 0usize;
+        for (ci, &cs) in cluster_starts.iter().enumerate() {
+            let (x0, x1, rtl) = extents[&cs];
+            let next = cluster_starts.get(ci + 1).copied().unwrap_or(r.end);
+            while char_index < char_bytes.len() && char_bytes[char_index] < cs {
+                char_index += 1;
+            }
+            let begin = char_index;
+            while char_index < char_bytes.len() && char_bytes[char_index] < next {
+                char_index += 1;
+            }
+            let count = (char_index - begin).max(1) as f32;
+            for (mi, b) in char_bytes[begin..char_index].iter().enumerate() {
+                let f = mi as f32 / count;
+                let x = if rtl { x1 - (x1 - x0) * f } else { x0 + (x1 - x0) * f };
+                carets.push((self.base + b, x));
+            }
+        }
+        // end of line caret
+        let end_x = match self.chars.iter().rev().find(|c| c.0 < r.end && c.0 >= r.start) {
+            Some(c) => {
+                let cs = cluster_starts.iter().rev().find(|s| **s <= c.0).copied();
+                match cs.and_then(|s| extents.get(&s)) {
+                    Some(&(x0, x1, rtl)) => {
+                        if rtl {
+                            x0
+                        } else {
+                            x1
+                        }
+                    }
+                    None => pen,
+                }
+            }
+            None => 0.0,
+        };
+        carets.push((self.base + r.end, end_x));
+        carets.sort_by_key(|c| c.0);
+        carets.dedup_by_key(|c| c.0);
+        carets
+    }
+
+    /// Ascent, descent and advance of the line: the tallest face and the largest leading on it.
+    fn line_metrics(&self, r: &Range<usize>, glyphs: &[Glyph]) -> (f32, f32, f32, f32) {
+        let (mut asc, mut desc, mut adv, mut first) = (0.0f32, 0.0f32, 0.0f32, 0.0f32);
+        let char_start = self.chars.partition_point(|c| c.0 < r.start);
+        let char_end = self.chars.partition_point(|c| c.0 < r.end);
+        let mut seen: Vec<usize> = self.chars[char_start..char_end].iter().map(|c| c.6).collect();
+        seen.sort_unstable();
+        seen.dedup();
+        if seen.is_empty() {
+            seen.push(self.chars.first().map_or(0, |c| c.6));
+        }
+        for &si in &seen {
+            let m = style_metrics(self.primaries, self.runs, si);
+            let rise = self.runs[si].1.rise();
+            asc = asc.max(m.ascent + rise.max(0.0));
+            desc = desc.max(m.descent - rise.min(0.0));
+            adv = adv.max(self.runs[si].1.line_advance());
+            first = first.max(style_first(self.primaries, self.runs, si));
+        }
+        for g in glyphs {
+            if g.face != self.primaries[g.run].face {
+                let m = fonts::face(g.face).metrics(g.size);
+                asc = asc.max(m.ascent);
+                desc = desc.max(m.descent);
+            }
+        }
+        (asc, desc, adv, first)
+    }
+}
+
+/// Each char with its shaped form, face, direction and run.
+fn char_forms(text: &str, base: usize, runs: &[(Range<usize>, TextStyle)], primaries: &[Resolved], bidi: &BidiInfo) -> Vec<CharInfo> {
+    text.char_indices()
         .map(|(b, c)| {
             let si = run_at(runs, base + b);
             let style = &runs[si].1;
@@ -669,13 +1041,15 @@ fn paragraph(text: &str, base: usize, runs: &[(Range<usize>, TextStyle)], primar
             }
             (b, c, sc, face, bidi.levels[b].is_rtl(), form, si)
         })
-        .collect();
-    // items: runs of equal (face, rtl, small, style)
+        .collect()
+}
+
+/// Runs of chars with the same face, direction, form, run and CJK vertical flag, shaped as one.
+fn build_items(text: &str, chars: &[CharInfo], runs: &[(Range<usize>, TextStyle)]) -> Vec<Item> {
+    let key = |c: &CharInfo| (c.3, c.4, c.5, c.6, runs.get(c.6).is_some_and(|run| run.1.vertical) && crate::is_cjk(c.1));
     let mut items: Vec<Item> = Vec::new();
     let mut i = 0;
     while i < chars.len() {
-        let key =
-            |c: &(usize, char, char, FaceId, bool, Form, usize)| (c.3, c.4, c.5, c.6, runs.get(c.6).is_some_and(|run| run.1.vertical) && crate::is_cjk(c.1));
         let k0 = key(&chars[i]);
         let mut j = i + 1;
         while j < chars.len() && key(&chars[j]) == k0 {
@@ -695,260 +1069,61 @@ fn paragraph(text: &str, base: usize, runs: &[(Range<usize>, TextStyle)], primar
         items.push(Item { range: chars[i].0..end, rtl, glyphs });
         i = j;
     }
-    // advance per char byte (cluster start)
-    let mut char_adv = vec![0.0f32; text.len() + 1];
-    for it in &items {
-        for g in &it.glyphs {
-            char_adv[g.cluster.min(text.len())] += g.adv + g.pre;
-        }
+    items
+}
+
+fn paragraph(
+    text: &str,
+    base: usize,
+    runs: &[(Range<usize>, TextStyle)],
+    primaries: &[Resolved],
+    variation_ids: &[u32],
+    para: &ParagraphStyle,
+    width: Option<f32>,
+) -> Vec<ParaLine> {
+    if text.is_empty() {
+        let si = run_at(runs, base);
+        let pm = style_metrics(primaries, runs, si);
+        // No text to resolve a direction from: the explicit one.
+        let rtl = para.rtl == Some(true);
+        return vec![ParaLine {
+            range: base..base,
+            glyphs: vec![],
+            carets: vec![(base, 0.0)],
+            content: 0.0,
+            left_trim: 0.0,
+            hang: (0.0, 0.0),
+            ascent: pm.ascent,
+            descent: pm.descent,
+            advance: runs[si].1.line_advance(),
+            first: style_first(primaries, runs, si),
+            align: align_for(para, rtl, width, true),
+            avail: avail_for(para, rtl, width, true),
+            margins: margins_for(para, rtl, true),
+            underline: None,
+        }];
     }
-    let range_w = |r: Range<usize>| -> f32 { char_adv[r].iter().sum() };
-    let trailing_ws = |r: &Range<usize>| -> (usize, f32) {
-        let mut end = r.end;
-        let mut w = 0.0;
-        for (b, c) in text[r.clone()].char_indices().rev() {
-            if !c.is_whitespace() {
-                break;
-            }
-            end = r.start + b;
-            w += char_adv[r.start + b];
-        }
-        (end, w)
-    };
-    // Hanging punctuation widths (left, right) of a line's content.
-    let hang_of = |r: &Range<usize>, ce: usize| -> (f32, f32) {
-        if !para.hanging || width.is_none() || r.start >= ce {
-            return (0.0, 0.0);
-        }
-        let first = text[r.start..ce].chars().next().filter(|c| is_hanging_open(*c)).map_or(0.0, |_| char_adv[r.start]);
-        let last = text[r.start..ce].char_indices().next_back().filter(|(_, c)| is_hanging_close(*c)).map_or(0.0, |(b, _)| char_adv[r.start + b]);
-        (first, last)
-    };
-    let fits_w = |r: &Range<usize>| -> f32 {
-        let (ce, _) = trailing_ws(r);
-        let (hl, hr) = hang_of(r, ce);
-        range_w(r.start..ce) - hl - hr
-    };
-    // line breaking
-    let mut ranges: Vec<Range<usize>> = Vec::new();
-    match width {
-        None => ranges.push(0..text.len()),
-        Some(_) => {
-            let opps: Vec<usize> = unicode_linebreak::linebreaks(text).map(|(p, _)| p).collect();
-            let avail = |line: usize| avail_for(line == 0).unwrap_or(f32::MAX);
-            if para.every_line && opps.len() > 1 && opps.len() <= 1500 {
-                // Minimise the summed squared slack of every line but the last.
-                let nodes: Vec<usize> = std::iter::once(0).chain(opps.iter().copied()).collect();
-                let m = nodes.len();
-                let mut best = vec![(f32::INFINITY, 0usize); m];
-                best[0] = (0.0, 0);
-                for j in 1..m {
-                    for i in (0..j).rev() {
-                        if !best[i].0.is_finite() {
-                            continue;
-                        }
-                        let r = nodes[i]..nodes[j];
-                        let w = fits_w(&r);
-                        let maxw = avail(usize::from(i != 0));
-                        let over = w > maxw;
-                        if over && i + 1 != j {
-                            break;
-                        }
-                        let slack = maxw - w;
-                        let cost = if over {
-                            1e12 + w
-                        } else if j == m - 1 {
-                            0.0
-                        } else {
-                            slack * slack
-                        };
-                        let total = best[i].0 + cost;
-                        if total < best[j].0 {
-                            best[j] = (total, i);
-                        }
-                    }
-                }
-                let mut j = m - 1;
-                while j > 0 {
-                    let i = best[j].1;
-                    ranges.push(nodes[i]..nodes[j]);
-                    j = i;
-                }
-                ranges.reverse();
-            } else {
-                let mut start = 0usize;
-                let mut last_ok: Option<usize> = None;
-                for p in opps {
-                    loop {
-                        let w = fits_w(&(start..p));
-                        if w <= avail(ranges.len()) || last_ok.is_none() {
-                            last_ok = Some(p);
-                            break;
-                        }
-                        let Some(b) = last_ok.take() else { break };
-                        ranges.push(start..b);
-                        start = b;
-                    }
-                }
-                ranges.push(start..text.len());
-            }
-            ranges.retain(|r| !r.is_empty());
-            if ranges.is_empty() {
-                ranges.push(0..text.len());
-            }
-        }
-    }
+    let p = Para::new(text, base, runs, primaries, variation_ids, para, width);
+    let ranges = p.break_ranges();
     let nlines = ranges.len();
-    let mut out = Vec::new();
-    for (li, r) in ranges.into_iter().enumerate() {
-        let last = li + 1 == nlines;
-        let align = eff_align(last);
-        let avail = avail_for(li == 0);
-        let (ce, tw) = trailing_ws(&r);
-        let hang = hang_of(&r, ce);
-        let content = range_w(r.start..ce);
-        // justification
-        let mut space_extra = 0.0;
-        if align == Align::Justify
-            && let Some(maxw) = avail
-        {
-            let spaces = text[r.start..ce].chars().filter(|c| *c == ' ').count();
-            if spaces > 0 {
-                space_extra = ((maxw - (content - hang.0 - hang.1)) / spaces as f32).max(0.0);
-            }
-        }
-        let (levels, vruns) = bidi.visual_runs(pinfo, r.clone());
-        let mut pen = 0.0f32;
-        let mut glyphs = Vec::new();
-        let mut extents: HashMap<usize, (f32, f32, bool)> = HashMap::new();
-        let mut underline: Option<(f32, f32)> = None;
-        for run in vruns {
-            let rtl = levels[run.start].is_rtl();
-            let mut idx: Vec<usize> = (0..items.len()).filter(|&k| items[k].range.start < run.end && items[k].range.end > run.start).collect();
-            if rtl {
-                idx.reverse();
-            }
-            for k in idx {
-                for g in items[k].glyphs.iter().filter(|g| run.contains(&g.cluster)) {
-                    let st = &runs[g.run].1;
-                    let x0 = pen;
-                    pen += g.pre;
-                    glyphs.push(Glyph {
-                        face: g.face,
-                        id: g.id,
-                        x: pen + g.dx,
-                        y: -g.dy - g.rise,
-                        size: g.size,
-                        cluster: base + g.cluster,
-                        synth_bold: primaries[g.run].synth_bold || st.faux_bold,
-                        synth_italic: primaries[g.run].synth_italic || st.faux_italic,
-                        h_scale: st.h_scale,
-                        v_scale: st.v_scale,
-                        run: g.run,
-                        variations: crate::variable::intern(&st.variations),
-                    });
-                    pen += g.adv;
-                    if space_extra > 0.0 && text[g.cluster..].starts_with(' ') && g.cluster < ce {
-                        pen += space_extra;
-                    }
-                    if st.underline && g.cluster < ce {
-                        let u = underline.get_or_insert((x0, pen));
-                        u.0 = u.0.min(x0);
-                        u.1 = u.1.max(pen);
-                    }
-                    let e = extents.entry(g.cluster).or_insert((x0, pen, items[k].rtl));
-                    e.0 = e.0.min(x0);
-                    e.1 = e.1.max(pen);
-                }
-            }
-        }
-        // caret stops for each char boundary in the line
-        let mut carets = Vec::new();
-        let mut cluster_starts: Vec<usize> = extents.keys().copied().collect();
-        cluster_starts.sort_unstable();
-        let char_bytes: Vec<usize> = text[r.clone()].char_indices().map(|(b, _)| r.start + b).collect();
-        for (ci, &cs) in cluster_starts.iter().enumerate() {
-            let (x0, x1, rtl) = extents[&cs];
-            let next = cluster_starts.get(ci + 1).copied().unwrap_or(r.end);
-            let members: Vec<usize> = char_bytes.iter().copied().filter(|b| *b >= cs && *b < next).collect();
-            let n = members.len().max(1) as f32;
-            for (mi, b) in members.iter().enumerate() {
-                let f = mi as f32 / n;
-                let x = if rtl { x1 - (x1 - x0) * f } else { x0 + (x1 - x0) * f };
-                carets.push((base + b, x));
-            }
-        }
-        // end of line caret
-        let end_x = match chars.iter().rev().find(|c| c.0 < r.end && c.0 >= r.start) {
-            Some(c) => {
-                let cs = cluster_starts.iter().rev().find(|s| **s <= c.0).copied();
-                match cs.and_then(|s| extents.get(&s)) {
-                    Some(&(x0, x1, rtl)) => {
-                        if rtl {
-                            x0
-                        } else {
-                            x1
-                        }
-                    }
-                    None => pen,
-                }
-            }
-            None => 0.0,
-        };
-        carets.push((base + r.end, end_x));
-        carets.sort_by_key(|c| c.0);
-        carets.dedup_by_key(|c| c.0);
-        // Line metrics: the tallest face and the largest leading on the line.
-        let (mut asc, mut desc, mut adv) = (0.0f32, 0.0f32, 0.0f32);
-        let mut seen: Vec<usize> = chars.iter().filter(|c| c.0 >= r.start && c.0 < r.end).map(|c| c.6).collect();
-        seen.sort_unstable();
-        seen.dedup();
-        if seen.is_empty() {
-            seen.push(chars.first().map_or(0, |c| c.6));
-        }
-        for &si in &seen {
-            let m = style_metrics(si);
-            let rise = runs[si].1.rise();
-            asc = asc.max(m.ascent + rise.max(0.0));
-            desc = desc.max(m.descent - rise.min(0.0));
-            adv = adv.max(runs[si].1.line_advance());
-        }
-        for g in &glyphs {
-            if g.face != primaries[g.run].face {
-                let m = fonts::face(g.face).metrics(g.size);
-                asc = asc.max(m.ascent);
-                desc = desc.max(m.descent);
-            }
-        }
-        let content_w = if space_extra > 0.0 { avail.map_or(content, |a| a + hang.0 + hang.1) } else { content };
-        out.push(ParaLine {
-            range: base + r.start..base + r.end,
-            glyphs,
-            carets,
-            content: content_w,
-            left_trim: if base_rtl { tw } else { 0.0 },
-            hang,
-            ascent: asc,
-            descent: desc,
-            advance: adv,
-            align,
-            avail,
-            margins: margins_for(li == 0),
-            underline,
-        });
-    }
-    out
+    ranges.into_iter().enumerate().map(|(li, r)| p.place_line(li, r, li + 1 == nlines)).collect()
 }
 
-/// Lay out `text` (paragraphs separated by CR, LF or CRLF) in one style.
 pub fn layout_uncached(text: &str, style: &TextStyle, para: &ParagraphStyle) -> Layout {
     layout_rich_uncached(text, &[(0..text.len(), style.clone())], std::slice::from_ref(para))
 }
 
+/// Maximum input size processed by one layout request. Above this, return an empty layout
+/// retaining the source length, so untrusted text cannot fan out into unbounded shaped data.
+const MAX_LAYOUT_BYTES: usize = 1 << 20;
+
 /// Lay out `text` with character style runs (byte ranges covering the text, in order; at least
 /// one) and paragraph settings (one per CR/LF/CRLF-separated paragraph; the last repeats). The wrap
 /// width is the first paragraph's.
 pub fn layout_rich_uncached(text: &str, runs: &[(Range<usize>, TextStyle)], paras: &[ParagraphStyle]) -> Layout {
+    if text.len() > MAX_LAYOUT_BYTES || runs.len() > MAX_LAYOUT_BYTES || paras.len() > MAX_LAYOUT_BYTES {
+        return Layout { text_len: text.len(), ..Default::default() };
+    }
     let fallback = [(0..text.len(), TextStyle::default())];
     let runs = if runs.is_empty() { &fallback[..] } else { runs };
     let default_para = ParagraphStyle::default();
@@ -957,10 +1132,8 @@ pub fn layout_rich_uncached(text: &str, runs: &[(Range<usize>, TextStyle)], para
     let primaries: Vec<Resolved> = runs.iter().map(|(_, s)| fonts::resolve(&s.family, &s.style)).collect();
     // A named instance of a variable font (`Figtree` `Black`, or `Figtree-Black`) sets the base
     // axis values; axes set explicitly in the style keep theirs.
-    let instanced: Vec<(Range<usize>, TextStyle)>;
-    let runs = if primaries.iter().any(|p| p.instance.is_some()) {
-        instanced = runs
-            .iter()
+    let instanced = primaries.iter().any(|p| p.instance.is_some()).then(|| {
+        runs.iter()
             .zip(&primaries)
             .map(|((r, s), p)| {
                 let base = fonts::instance_variations(p);
@@ -970,22 +1143,37 @@ pub fn layout_rich_uncached(text: &str, runs: &[(Range<usize>, TextStyle)], para
                 }
                 (r.clone(), s)
             })
-            .collect();
-        &instanced[..]
-    } else {
-        runs
-    };
+            .collect::<Vec<_>>()
+    });
+    let runs = instanced.as_deref().unwrap_or(runs);
+    // A location that cannot be interned would outline at the default; shape there too.
+    let cleared = runs.iter().any(|(_, s)| !s.variations.is_empty() && crate::variable::intern(&s.variations) == 0).then(|| {
+        runs.iter()
+            .map(|(r, s)| {
+                let mut s = s.clone();
+                if crate::variable::intern(&s.variations) == 0 {
+                    s.variations.clear();
+                }
+                (r.clone(), s)
+            })
+            .collect::<Vec<_>>()
+    });
+    let runs = cleared.as_deref().unwrap_or(runs);
+    let variation_ids: Vec<u32> = runs.iter().map(|(_, s)| crate::variable::intern(&s.variations)).collect();
     let mut lay = Layout { missing_font: primaries.iter().any(|p| p.missing), text_len: text.len(), ..Default::default() };
     let mut plines: Vec<(usize, ParaLine)> = Vec::new();
     for (pi, span) in paragraph_ranges(text).enumerate() {
         let p = text.get(span.bytes.clone()).unwrap_or_default();
-        plines.extend(paragraph(p, span.bytes.start, runs, &primaries, para_at(pi), width).into_iter().map(|l| (pi, l)));
+        plines.extend(paragraph(p, span.bytes.start, runs, &primaries, &variation_ids, para_at(pi), width).into_iter().map(|l| (pi, l)));
     }
     let mut baseline = 0.0f32;
     for (i, (pi, pl)) in plines.into_iter().enumerate() {
         let para = para_at(pi);
         if i == 0 {
-            baseline = if width.is_some() { pl.ascent } else { 0.0 };
+            // Vertical type keeps its first column at the font ascent (not measured in AE).
+            let vertical = runs.get(run_at(runs, pl.range.start)).is_some_and(|r| r.1.vertical)
+                || runs.iter().any(|r| r.1.vertical && r.0.start < pl.range.end && r.0.end > pl.range.start);
+            baseline = if width.is_some() { if vertical { pl.ascent } else { pl.first } } else { 0.0 };
         } else {
             let prev_para = lay.lines.last().map_or(pi, |l| l.para);
             let mut adv = pl.advance + para.leading;
@@ -994,17 +1182,7 @@ pub fn layout_rich_uncached(text: &str, runs: &[(Range<usize>, TextStyle)], para
             }
             baseline += adv;
         }
-        let shown = pl.content - pl.hang.0 - pl.hang.1;
-        let (ml, mr) = pl.margins;
-        let shift = match (pl.avail, pl.align) {
-            (None, Align::Left | Align::Justify) => ml,
-            (None, Align::Center) => -shown / 2.0 + (ml - mr) / 2.0,
-            (None, Align::Right) => -shown - mr,
-            (Some(_), Align::Left | Align::Justify) => ml,
-            (Some(a), Align::Center) => ml + (a - shown) / 2.0,
-            (Some(a), Align::Right) => ml + a - shown,
-        } - pl.left_trim
-            - pl.hang.0;
+        let shift = line_shift(&pl);
         let g0 = lay.glyphs.len();
         lay.glyphs.extend(pl.glyphs.into_iter().map(|mut g| {
             g.x += shift;
@@ -1033,6 +1211,27 @@ pub fn layout_rich_uncached(text: &str, runs: &[(Range<usize>, TextStyle)], para
     for i in 0..lay.lines.len() {
         lay.lines[i].para_end = lay.lines.get(i + 1).is_none_or(|n| n.para != lay.lines[i].para);
     }
+    set_bounds(&mut lay, width);
+    lay
+}
+
+/// Horizontal shift of a line from its paragraph's alignment, margins and hanging punctuation.
+fn line_shift(pl: &ParaLine) -> f32 {
+    let shown = pl.content - pl.hang.0 - pl.hang.1;
+    let (ml, mr) = pl.margins;
+    let shift = match (pl.avail, pl.align) {
+        (None, Align::Left | Align::Justify) => ml,
+        (None, Align::Center) => -shown / 2.0 + (ml - mr) / 2.0,
+        (None, Align::Right) => -shown - mr,
+        (Some(_), Align::Left | Align::Justify) => ml,
+        (Some(a), Align::Center) => ml + (a - shown) / 2.0,
+        (Some(a), Align::Right) => ml + a - shown,
+    };
+    shift - pl.left_trim - pl.hang.0
+}
+
+/// The layout's bounds: the lines' horizontal extent (and the wrap width), and their vertical extent.
+fn set_bounds(lay: &mut Layout, width: Option<f32>) {
     let (mut x0, mut x1) = (f32::MAX, f32::MIN);
     for l in &lay.lines {
         x0 = x0.min(l.x);
@@ -1045,7 +1244,6 @@ pub fn layout_rich_uncached(text: &str, runs: &[(Range<usize>, TextStyle)], para
     if let (Some(first), Some(last)) = (lay.lines.first(), lay.lines.last()) {
         lay.bounds = [x0, first.baseline - first.ascent, x1.max(x0), last.baseline + last.descent];
     }
-    lay
 }
 
 fn cache() -> &'static Mutex<HashMap<u64, (u64, Arc<Layout>)>> {
@@ -1060,6 +1258,9 @@ pub fn layout(text: &str, style: &TextStyle, para: &ParagraphStyle) -> Arc<Layou
 
 /// [`layout_rich_uncached`], cached by text, runs and paragraph settings.
 pub fn layout_rich(text: &str, runs: &[(Range<usize>, TextStyle)], paras: &[ParagraphStyle]) -> Arc<Layout> {
+    if text.len() > MAX_LAYOUT_BYTES || runs.len() > MAX_LAYOUT_BYTES || paras.len() > MAX_LAYOUT_BYTES {
+        return Arc::new(layout_rich_uncached(text, runs, paras));
+    }
     let mut h = std::collections::hash_map::DefaultHasher::new();
     text.hash(&mut h);
     runs.hash(&mut h);
@@ -1067,12 +1268,12 @@ pub fn layout_rich(text: &str, runs: &[(Range<usize>, TextStyle)], paras: &[Para
     let key = h.finish();
     static CLOCK: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
     let now = CLOCK.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-    if let Some(e) = cache().lock().unwrap_or_else(|e| e.into_inner()).get_mut(&key) {
+    if let Some(e) = cache().lock().unwrap_or_else(std::sync::PoisonError::into_inner).get_mut(&key) {
         e.0 = now;
         return e.1.clone();
     }
     let l = Arc::new(layout_rich_uncached(text, runs, paras));
-    let mut c = cache().lock().unwrap_or_else(|e| e.into_inner());
+    let mut c = cache().lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if c.len() >= 512 {
         // evict the oldest quarter
         let mut ages: Vec<u64> = c.values().map(|v| v.0).collect();
@@ -1091,363 +1292,4 @@ pub fn measure(text: &str, style: &TextStyle) -> f32 {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn st(size: f32) -> TextStyle {
-        TextStyle { size, ..Default::default() }
-    }
-
-    fn ids(text: &str, s: &TextStyle) -> Vec<u32> {
-        layout_uncached(text, s, &ParagraphStyle::default()).glyphs.iter().map(|g| g.id).collect()
-    }
-
-    fn ot(f: impl FnOnce(&mut OpenType)) -> TextStyle {
-        let mut s = st(100.0);
-        f(&mut s.opentype);
-        s
-    }
-
-    fn serif() -> TextStyle {
-        TextStyle { family: "Noto Serif".into(), ..st(100.0) }
-    }
-
-    #[test]
-    fn bundled_faces_list_their_features() {
-        let inter = fonts::face(fonts::resolve("Inter", "Regular").face).features();
-        for t in ["ss01", "dlig", "frac", "tnum", "sups", "ordn"] {
-            assert!(inter.iter().any(|f| f == t), "{t} in {inter:?}");
-        }
-        let serif = fonts::face(fonts::resolve("Noto Serif", "Regular").face).features();
-        for t in ["smcp", "c2sc", "onum", "lnum"] {
-            assert!(serif.iter().any(|f| f == t), "{t} in {serif:?}");
-        }
-    }
-
-    #[test]
-    fn opentype_features_substitute_glyphs() {
-        let plain = st(100.0);
-        // Stylistic sets, fractions, ordinals, figure widths and discretionary ligatures.
-        assert_ne!(ids("1234567890", &plain), ids("1234567890", &ot(|o| o.set_stylistic_set(1, true))), "ss01 alternate digits");
-        assert_eq!(ids("1234567890", &plain), ids("1234567890", &ot(|o| o.set_stylistic_set(20, true))), "Inter has no ss20");
-        assert_ne!(ids("1/2", &plain), ids("1/2", &ot(|o| o.fractions = true)), "frac");
-        assert_ne!(ids("1a 2o No", &plain), ids("1a 2o No", &ot(|o| o.ordinals = true)), "ordn");
-        let tab = measure("1111", &ot(|o| o.figure_width = effectcraft_keyframe::FigureWidth::Tabular));
-        let prop = measure("1111", &ot(|o| o.figure_width = effectcraft_keyframe::FigureWidth::Proportional));
-        assert!((tab - prop).abs() > 1.0, "tabular {tab} vs proportional {prop}");
-        // Old-style figures (Noto Serif).
-        let old = TextStyle { opentype: OpenType { figure_style: effectcraft_keyframe::FigureStyle::OldStyle, ..Default::default() }, ..serif() };
-        assert_ne!(ids("123", &serif()), ids("123", &old), "onum");
-        // Contextual alternates are on by default; turning them off can only keep or change glyphs.
-        let no_calt = ot(|o| o.contextual_alternates = false);
-        assert_eq!(ids("Hello", &plain).len(), ids("Hello", &no_calt).len());
-    }
-
-    #[test]
-    fn true_small_caps_and_superscripts_with_faux_fallback() {
-        // Noto Serif has smcp: lowercase letters take their own small-capital glyphs at full size.
-        let sc = TextStyle { caps: Caps::Small, ..serif() };
-        let l = layout_uncached("Ab", &sc, &ParagraphStyle::default());
-        let upper_b = ids("B", &serif())[0];
-        assert_ne!(l.glyphs[1].id, upper_b, "true small cap glyph, not a scaled capital");
-        assert_eq!(l.glyphs[1].size, 100.0);
-        // Inter has no smcp: a capital scaled down.
-        let faux = layout_uncached("Ab", &TextStyle { caps: Caps::Small, ..st(100.0) }, &ParagraphStyle::default());
-        assert_eq!(faux.glyphs[1].id, ids("B", &st(100.0))[0]);
-        assert!((faux.glyphs[1].size - 78.0).abs() < 0.01);
-        // All Small Caps: capitals become small capitals too (c2sc).
-        let all = TextStyle { opentype: OpenType { all_small_caps: true, ..Default::default() }, ..serif() };
-        let a = layout_uncached("AB", &all, &ParagraphStyle::default());
-        assert_ne!(a.glyphs[0].id, ids("A", &serif())[0]);
-        // Superscript: Inter's sups figures at full size on the baseline; letters it lacks are
-        // synthesized (smaller and raised).
-        let sup = TextStyle { script: Script::Super, ..st(100.0) };
-        let s2 = layout_uncached("2", &sup, &ParagraphStyle::default());
-        assert_ne!(s2.glyphs[0].id, ids("2", &st(100.0))[0]);
-        assert_eq!(s2.glyphs[0].size, 100.0);
-        assert_eq!(s2.glyphs[0].y, 0.0);
-        let sq = layout_uncached("q", &sup, &ParagraphStyle::default());
-        if !feature_substitutes(sq.glyphs[0].face, b"sups", 'q') {
-            assert!(sq.glyphs[0].size < 60.0 && sq.glyphs[0].y < -20.0, "{:?}", sq.glyphs[0]);
-        }
-        let sub = layout_uncached("2", &TextStyle { script: Script::Sub, ..st(100.0) }, &ParagraphStyle::default());
-        assert_ne!(sub.glyphs[0].id, s2.glyphs[0].id);
-    }
-
-    #[test]
-    fn kerning_and_ligatures_change_advances() {
-        let kern = measure("AVAVAV", &st(100.0));
-        let nokern = measure("AVAVAV", &TextStyle { kerning: false, ..st(100.0) });
-        assert!(kern < nokern - 5.0, "kerning tightens AV: {kern} vs {nokern}");
-        // tracking adds 1/1000 em per cluster
-        let tracked = measure("AVAVAV", &TextStyle { tracking: 100.0, ..st(100.0) });
-        assert!((tracked - kern - 6.0 * 10.0).abs() < 0.5, "{tracked} {kern}");
-    }
-
-    #[test]
-    fn point_text_alignment() {
-        let l = layout("Hello", &st(50.0), &ParagraphStyle { align: Align::Center, ..Default::default() });
-        let line = &l.lines[0];
-        assert!((line.x + line.width / 2.0).abs() < 0.01);
-        let r = layout("Hello", &st(50.0), &ParagraphStyle { align: Align::Right, ..Default::default() });
-        assert!((r.lines[0].x + r.lines[0].width).abs() < 0.01);
-        assert_eq!(l.glyphs.len(), 5);
-        assert!(l.bounds[1] < -30.0 && l.bounds[3] > 5.0, "{:?}", l.bounds);
-    }
-
-    #[test]
-    fn wraps_area_text_and_justifies() {
-        let p = ParagraphStyle { width: Some(300.0), align: Align::Justify, ..Default::default() };
-        let l = layout("the quick brown fox jumps over the lazy dog again and again", &st(40.0), &p);
-        assert!(l.lines.len() >= 3, "{}", l.lines.len());
-        for line in &l.lines[..l.lines.len() - 1] {
-            assert!((line.width - 300.0).abs() < 0.5, "justified to the box: {}", line.width);
-        }
-        // the lines tile the text
-        assert_eq!(l.lines[0].range.start, 0);
-        for w in l.lines.windows(2) {
-            assert_eq!(w[0].range.end, w[1].range.start);
-            assert!(w[1].baseline > w[0].baseline);
-        }
-        let left = layout("the quick brown fox jumps over the lazy dog", &st(40.0), &ParagraphStyle { width: Some(300.0), ..Default::default() });
-        assert!(left.lines.iter().all(|l| l.width <= 300.0 + 0.01));
-    }
-
-    #[test]
-    fn newlines_make_paragraphs_and_leading_adds() {
-        let l = layout("one\ntwo\n\nfour", &st(30.0), &ParagraphStyle::default());
-        assert_eq!(l.lines.len(), 4);
-        assert_eq!(l.lines[1].range, 4..7);
-        assert_eq!(l.lines[2].range, 8..8);
-        let gap = l.lines[1].baseline - l.lines[0].baseline;
-        let l2 = layout("one\ntwo", &st(30.0), &ParagraphStyle { leading: 10.0, ..Default::default() });
-        assert!((l2.lines[1].baseline - l2.lines[0].baseline - gap - 10.0).abs() < 1e-3);
-    }
-
-    #[test]
-    fn carets_and_hit_testing() {
-        let l = layout("abc\nde", &st(40.0), &ParagraphStyle::default());
-        let (x0, _, li0) = l.caret(0);
-        let (x1, _, _) = l.caret(1);
-        let (x3, _, _) = l.caret(3);
-        assert!(x0.abs() < 1e-3 && x1 > x0 && x3 > x1);
-        assert_eq!(li0, 0);
-        let (_, b4, li4) = l.caret(4);
-        assert_eq!(li4, 1);
-        assert!(b4 > 0.0);
-        assert_eq!(l.hit(x1 + 1.0, 0.0), 1);
-        assert_eq!(l.hit(1000.0, b4), 6);
-        let rects = l.selection_rects(1, 5);
-        assert_eq!(rects.len(), 2);
-    }
-
-    #[test]
-    fn bidi_reorders_rtl_runs() {
-        // Hebrew letters are laid out right-to-left: the first logical letter is rightmost.
-        let l = layout("ab \u{5d0}\u{5d1}\u{5d2} cd", &st(40.0), &ParagraphStyle::default());
-        let x_of = |byte: usize| l.glyphs.iter().find(|g| g.cluster == byte).map(|g| g.x).unwrap();
-        let alef = "ab ".len();
-        let gimel = alef + 4;
-        assert!(x_of(alef) > x_of(gimel), "alef right of gimel");
-        assert!(x_of(0) < x_of(gimel) && x_of(alef) < x_of("ab \u{5d0}\u{5d1}\u{5d2} ".len()));
-    }
-
-    #[test]
-    fn caps_and_small_caps() {
-        let s = st(50.0);
-        let up = measure("HELLO", &s);
-        let all = measure("hello", &TextStyle { caps: Caps::All, ..s.clone() });
-        assert!((up - all).abs() < 0.01);
-        let small = measure("hello", &TextStyle { caps: Caps::Small, ..s.clone() });
-        assert!(small < up * 0.9 && small > up * 0.6, "{small} {up}");
-        let l = layout("Hi", &TextStyle { baseline_shift: 10.0, underline: true, ..s }, &ParagraphStyle::default());
-        assert!((l.glyphs[0].y + 10.0).abs() < 1e-3);
-        assert_eq!(l.underlines.len(), 1);
-    }
-
-    #[test]
-    fn ligature_caret_interpolates() {
-        // Inter has an "fi"-like ligature only via calt in some versions; use "ffi" which most
-        // fonts ligate. Whatever shaping does, every char boundary has a caret.
-        let l = layout("office", &st(40.0), &ParagraphStyle::default());
-        let stops: Vec<usize> = l.lines[0].carets.iter().map(|c| c.0).collect();
-        assert_eq!(stops, vec![0, 1, 2, 3, 4, 5, 6]);
-        let xs: Vec<f32> = l.lines[0].carets.iter().map(|c| c.1).collect();
-        assert!(xs.windows(2).all(|w| w[1] >= w[0]), "{xs:?}");
-    }
-
-    #[test]
-    fn fallback_font_for_missing_glyphs() {
-        // Inter lacks Devanagari/Hebrew; Noto Serif lacks Hebrew too → glyphs still produced (notdef)
-        let l = layout("A\u{3b1}", &TextStyle { family: "Noto Serif".into(), ..st(40.0) }, &ParagraphStyle::default());
-        assert_eq!(l.glyphs.len(), 2);
-        assert!(l.glyphs.iter().all(|g| g.id != 0));
-    }
-
-    #[test]
-    fn empty_text_has_a_caret() {
-        let l = layout("", &st(40.0), &ParagraphStyle::default());
-        assert_eq!(l.lines.len(), 1);
-        assert_eq!(l.caret(0).0, 0.0);
-        assert!(l.bounds[3] > l.bounds[1]);
-    }
-
-    fn rich(text: &str, runs: &[(Range<usize>, TextStyle)], para: ParagraphStyle) -> Layout {
-        layout_rich_uncached(text, runs, &[para])
-    }
-
-    #[test]
-    fn mixed_sizes_share_a_baseline_and_take_the_largest_leading() {
-        let text = "small BIG\nnext";
-        let runs = [(0..6, st(20.0)), (6..9, st(80.0)), (9..text.len(), st(20.0))];
-        let l = rich(text, &runs, ParagraphStyle::default());
-        assert_eq!(l.lines.len(), 2);
-        let y0 = l.glyphs[0].y;
-        assert!(l.glyphs[..9].iter().all(|g| (g.y - y0).abs() < 1e-3), "one baseline per line");
-        assert!(l.glyphs[7].size > l.glyphs[0].size * 3.0);
-        // Line 2's advance is its own leading (20 px text: 24 px); line 1 is as tall as the big run.
-        assert!((l.lines[1].baseline - l.lines[0].baseline - 24.0).abs() < 1e-3, "{}", l.lines[1].baseline);
-        assert!(l.lines[0].ascent > 60.0);
-        // A big run on the second line pushes it down by its 120% leading.
-        let text2 = "aa\nBB";
-        let l2 = rich(text2, &[(0..3, st(20.0)), (3..5, st(80.0))], ParagraphStyle::default());
-        assert!((l2.lines[1].baseline - 96.0).abs() < 1e-3);
-        // Explicit leading wins over auto.
-        let mut fixed = st(20.0);
-        fixed.leading = Some(50.0);
-        let l3 = rich("a\nb", &[(0..3, fixed)], ParagraphStyle::default());
-        assert!((l3.lines[1].baseline - 50.0).abs() < 1e-3);
-    }
-
-    #[test]
-    fn super_subscript_tsume_and_kerning_metrics() {
-        let base = st(100.0);
-        let sup = TextStyle { script: Script::Super, ..base.clone() };
-        let sub = TextStyle { script: Script::Sub, ..base.clone() };
-        // A letter the font has no superior / inferior glyph for: synthesized.
-        let inter = fonts::resolve("Inter", "Regular").face;
-        let c = "qwkzvjxyQWK".chars().find(|&c| !feature_substitutes(inter, b"sups", c) && !feature_substitutes(inter, b"subs", c)).unwrap();
-        let text: String = ['x', c, 'y', c].iter().collect();
-        let l = rich(&text, &[(0..1, base.clone()), (1..2, sup), (2..3, base.clone()), (3..4, sub)], ParagraphStyle::default());
-        let g = &l.glyphs;
-        assert!((g[1].size - 58.3).abs() < 0.1);
-        assert!((g[1].y - (g[0].y - 33.3)).abs() < 0.1, "superscript raised by a third of the size");
-        assert!((g[3].y - (g[2].y + 33.3)).abs() < 0.1, "subscript lowered");
-        // Tsume removes side bearings; full tsume is narrower than none.
-        let w0 = measure("onion", &base);
-        let w1 = measure("onion", &TextStyle { tsume: 1.0, ..base.clone() });
-        assert!(w1 < w0 - 5.0, "{w1} vs {w0}");
-        // Manual kerning: +100/1000 em before each of the 5 later characters of AVAVAV, metrics off.
-        let nokern = measure("AVAVAV", &TextStyle { kerning: false, ..base.clone() });
-        let manual = measure("AVAVAV", &TextStyle { manual_kern: Some(100.0), ..base.clone() });
-        assert!((manual - nokern - 50.0).abs() < 0.5, "{manual} {nokern}");
-        let optical = measure("AVAVAV", &TextStyle { optical: true, ..base.clone() });
-        assert!(optical > 0.0 && (optical - nokern).abs() < 100.0);
-        // Horizontal scale stretches advances.
-        let wide = measure("onion", &TextStyle { h_scale: 2.0, ..base.clone() });
-        assert!((wide - 2.0 * w0).abs() < 0.5);
-        let l = layout("o", &TextStyle { h_scale: 2.0, v_scale: 0.5, ..base }, &ParagraphStyle::default());
-        assert_eq!((l.glyphs[0].h_scale, l.glyphs[0].v_scale), (2.0, 0.5));
-    }
-
-    #[test]
-    fn indents_and_paragraph_spacing() {
-        let s = st(20.0);
-        let text = "first paragraph here\nsecond one";
-        let p0 = ParagraphStyle { width: Some(400.0), indent_start: 30.0, indent_first: 15.0, space_after: 10.0, ..Default::default() };
-        let p1 = ParagraphStyle { width: Some(400.0), indent_end: 50.0, align: Align::Right, space_before: 7.0, ..Default::default() };
-        let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p0.clone(), p1]);
-        assert!((l.lines[0].x - 45.0).abs() < 1e-3, "left + first-line indent: {}", l.lines[0].x);
-        assert!((l.lines[1].x + l.lines[1].width - 350.0).abs() < 0.5, "right indent: {}", l.lines[1].x + l.lines[1].width);
-        assert!((l.lines[1].baseline - l.lines[0].baseline - (24.0 + 10.0 + 7.0)).abs() < 1e-3);
-        assert_eq!((l.lines[0].para, l.lines[1].para), (0, 1));
-        assert!(l.lines[0].para_end && l.lines[1].para_end);
-        // Wrapped lines after the first don't get the first-line indent.
-        let long = "word ".repeat(30);
-        let l = layout_rich_uncached(&long, &[(0..long.len(), s.clone())], &[p0]);
-        assert!(l.lines.len() > 2);
-        assert!((l.lines[1].x - 30.0).abs() < 1e-3);
-        assert!(l.lines.iter().all(|ln| ln.x + ln.width <= 400.0 + 0.5));
-        assert!(!l.lines[0].para_end);
-        // Point text: a right-aligned paragraph's end indent moves it left of the origin.
-        let l = layout_rich_uncached("abc", &[(0..3, s)], &[ParagraphStyle { align: Align::Right, indent_end: 12.0, ..Default::default() }]);
-        assert!((l.lines[0].x + l.lines[0].width + 12.0).abs() < 1e-3);
-    }
-
-    #[test]
-    fn justify_last_line_modes_and_every_line_composer() {
-        let text = "the quick brown fox jumps over the lazy dog and keeps running far";
-        let s = st(30.0);
-        let p = |last: Align| ParagraphStyle { width: Some(320.0), align: Align::Justify, justify_last: last, ..Default::default() };
-        let left = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Left)]);
-        let n = left.lines.len();
-        assert!(n >= 3);
-        assert!((left.lines[0].width - 320.0).abs() < 0.5);
-        assert!(left.lines[n - 1].width < 320.0 && left.lines[n - 1].x.abs() < 1e-3);
-        let center = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Center)]);
-        let lc = &center.lines[n - 1];
-        assert!((lc.x - (320.0 - lc.width) / 2.0).abs() < 0.5);
-        let right = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Right)]);
-        let lr = &right.lines[n - 1];
-        assert!((lr.x + lr.width - 320.0).abs() < 0.5);
-        let all = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Justify)]);
-        assert!((all.lines[n - 1].width - 320.0).abs() < 0.5, "justify all stretches the last line");
-        // Every-line composer: never worse (summed squared slack) than greedy breaking.
-        let slack = |l: &Layout| -> f32 { l.lines[..l.lines.len() - 1].iter().map(|ln| (320.0 - ln.width).powi(2)).sum() };
-        let greedy = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[ParagraphStyle { width: Some(320.0), ..Default::default() }]);
-        let every = layout_rich_uncached(text, &[(0..text.len(), s)], &[ParagraphStyle { width: Some(320.0), every_line: true, ..Default::default() }]);
-        assert!(slack(&every) <= slack(&greedy) + 1e-3, "{} vs {}", slack(&every), slack(&greedy));
-        assert!(every.lines.iter().all(|ln| ln.width <= 320.0 + 0.5));
-    }
-
-    #[test]
-    fn hanging_punctuation_overhangs_the_box() {
-        let s = st(40.0);
-        let text = "\"Hi.\"";
-        let p = ParagraphStyle { width: Some(400.0), hanging: true, ..Default::default() };
-        let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p]);
-        assert!(l.lines[0].x < -1.0, "opening quote hangs left: {}", l.lines[0].x);
-        let r = layout_rich_uncached(
-            text,
-            &[(0..text.len(), s)],
-            &[ParagraphStyle { width: Some(400.0), hanging: true, align: Align::Right, ..Default::default() }],
-        );
-        assert!(r.lines[0].x + r.lines[0].width > 401.0, "closing quote hangs right");
-    }
-
-    #[test]
-    fn rtl_paragraph_carets_run_right_to_left() {
-        let text = "\u{5d0}\u{5d1}\u{5d2}";
-        let l = layout_rich_uncached(text, &[(0..text.len(), st(40.0))], &[ParagraphStyle { rtl: Some(true), ..Default::default() }]);
-        let xs: Vec<f32> = l.lines[0].carets.iter().map(|c| c.1).collect();
-        assert_eq!(xs.len(), 4);
-        assert!(xs.windows(2).all(|w| w[1] < w[0]), "{xs:?}");
-        // Hit testing returns the logical position nearest the point.
-        assert_eq!(l.hit(xs[1] + 0.5, 0.0), 2);
-        assert_eq!(l.hit(xs[0] + 50.0, 0.0), 0);
-    }
-
-    /// #1563: text set in a named instance (`Black`) is laid out at the instance's axis values,
-    /// as if they had been set as variations; axes set on the text itself keep their values.
-    #[test]
-    fn named_instance_sets_the_base_variations() {
-        const FAMILY: &str = "EffectCraft Layout Instance Test";
-        fonts::add_font_data(crate::sfnt::test_font::variable(FAMILY, &[("Light", 300.0, None), ("Black", 900.0, None)], true));
-        let st = |style: &str, variations: Vec<(String, f32)>| TextStyle {
-            family: FAMILY.into(),
-            style: style.into(),
-            size: 50.0,
-            variations,
-            ..Default::default()
-        };
-        let coords = |l: &Layout| l.glyphs.iter().map(|g| crate::variable::coords(g.variations).to_vec()).collect::<Vec<_>>();
-        let black = layout_uncached("Hi", &st("Black", vec![]), &ParagraphStyle::default());
-        assert!(!black.glyphs.is_empty());
-        assert!(coords(&black).iter().all(|c| c == &[("wght".to_string(), 900.0)]), "{:?}", coords(&black));
-        let set = layout_uncached("Hi", &st("Black", vec![("wght".into(), 500.0)]), &ParagraphStyle::default());
-        assert!(coords(&set).iter().all(|c| c == &[("wght".to_string(), 500.0)]), "{:?}", coords(&set));
-        // A static family keeps no variations.
-        let inter = layout_uncached("Hi", &TextStyle::default(), &ParagraphStyle::default());
-        assert!(inter.glyphs.iter().all(|g| g.variations == 0));
-    }
-}
+mod tests;
diff --git a/crates/text/src/layout/tests.rs b/crates/text/src/layout/tests.rs
new file mode 100644
index 000000000..5792c1c16
--- /dev/null
+++ b/crates/text/src/layout/tests.rs
@@ -0,0 +1,496 @@
+use super::*;
+
+fn st(size: f32) -> TextStyle {
+    TextStyle { size, ..Default::default() }
+}
+
+fn ids(text: &str, s: &TextStyle) -> Vec<u32> {
+    layout_uncached(text, s, &ParagraphStyle::default()).glyphs.iter().map(|g| g.id).collect()
+}
+
+fn ot(f: impl FnOnce(&mut OpenType)) -> TextStyle {
+    let mut s = st(100.0);
+    f(&mut s.opentype);
+    s
+}
+
+fn serif() -> TextStyle {
+    TextStyle { family: "Noto Serif".into(), ..st(100.0) }
+}
+
+#[test]
+fn bundled_faces_list_their_features() {
+    let inter = fonts::face(fonts::resolve("Inter", "Regular").face).features();
+    for t in ["ss01", "dlig", "frac", "tnum", "sups", "ordn"] {
+        assert!(inter.iter().any(|f| f == t), "{t} in {inter:?}");
+    }
+    let serif = fonts::face(fonts::resolve("Noto Serif", "Regular").face).features();
+    for t in ["smcp", "c2sc", "onum", "lnum"] {
+        assert!(serif.iter().any(|f| f == t), "{t} in {serif:?}");
+    }
+}
+
+#[test]
+fn opentype_features_substitute_glyphs() {
+    let plain = st(100.0);
+    // Stylistic sets, fractions, ordinals, figure widths and discretionary ligatures.
+    assert_ne!(ids("1234567890", &plain), ids("1234567890", &ot(|o| o.set_stylistic_set(1, true))), "ss01 alternate digits");
+    assert_eq!(ids("1234567890", &plain), ids("1234567890", &ot(|o| o.set_stylistic_set(20, true))), "Inter has no ss20");
+    assert_ne!(ids("1/2", &plain), ids("1/2", &ot(|o| o.fractions = true)), "frac");
+    assert_ne!(ids("1a 2o No", &plain), ids("1a 2o No", &ot(|o| o.ordinals = true)), "ordn");
+    let tab = measure("1111", &ot(|o| o.figure_width = effectcraft_keyframe::FigureWidth::Tabular));
+    let prop = measure("1111", &ot(|o| o.figure_width = effectcraft_keyframe::FigureWidth::Proportional));
+    assert!((tab - prop).abs() > 1.0, "tabular {tab} vs proportional {prop}");
+    // Old-style figures (Noto Serif).
+    let old = TextStyle { opentype: OpenType { figure_style: effectcraft_keyframe::FigureStyle::OldStyle, ..Default::default() }, ..serif() };
+    assert_ne!(ids("123", &serif()), ids("123", &old), "onum");
+    // Contextual alternates are on by default; turning them off can only keep or change glyphs.
+    let no_calt = ot(|o| o.contextual_alternates = false);
+    assert_eq!(ids("Hello", &plain).len(), ids("Hello", &no_calt).len());
+}
+
+#[test]
+fn true_small_caps_and_superscripts_with_faux_fallback() {
+    // Noto Serif has smcp: lowercase letters take their own small-capital glyphs at full size.
+    let sc = TextStyle { caps: Caps::Small, ..serif() };
+    let l = layout_uncached("Ab", &sc, &ParagraphStyle::default());
+    let upper_b = ids("B", &serif())[0];
+    assert_ne!(l.glyphs[1].id, upper_b, "true small cap glyph, not a scaled capital");
+    assert_eq!(l.glyphs[1].size, 100.0);
+    // Inter has no smcp: a capital scaled down.
+    let faux = layout_uncached("Ab", &TextStyle { caps: Caps::Small, ..st(100.0) }, &ParagraphStyle::default());
+    assert_eq!(faux.glyphs[1].id, ids("B", &st(100.0))[0]);
+    assert!((faux.glyphs[1].size - 78.0).abs() < 0.01);
+    // All Small Caps: capitals become small capitals too (c2sc).
+    let all = TextStyle { opentype: OpenType { all_small_caps: true, ..Default::default() }, ..serif() };
+    let a = layout_uncached("AB", &all, &ParagraphStyle::default());
+    assert_ne!(a.glyphs[0].id, ids("A", &serif())[0]);
+    // Superscript: Inter's sups figures at full size on the baseline; letters it lacks are
+    // synthesized (smaller and raised).
+    let sup = TextStyle { script: Script::Super, ..st(100.0) };
+    let s2 = layout_uncached("2", &sup, &ParagraphStyle::default());
+    assert_ne!(s2.glyphs[0].id, ids("2", &st(100.0))[0]);
+    assert_eq!(s2.glyphs[0].size, 100.0);
+    assert_eq!(s2.glyphs[0].y, 0.0);
+    let sq = layout_uncached("q", &sup, &ParagraphStyle::default());
+    if !feature_substitutes(sq.glyphs[0].face, b"sups", 'q') {
+        assert!(sq.glyphs[0].size < 60.0 && sq.glyphs[0].y < -20.0, "{:?}", sq.glyphs[0]);
+    }
+    let sub = layout_uncached("2", &TextStyle { script: Script::Sub, ..st(100.0) }, &ParagraphStyle::default());
+    assert_ne!(sub.glyphs[0].id, s2.glyphs[0].id);
+}
+
+#[test]
+fn kerning_and_ligatures_change_advances() {
+    let kern = measure("AVAVAV", &st(100.0));
+    let nokern = measure("AVAVAV", &TextStyle { kerning: false, ..st(100.0) });
+    assert!(kern < nokern - 5.0, "kerning tightens AV: {kern} vs {nokern}");
+    // tracking adds 1/1000 em per cluster
+    let tracked = measure("AVAVAV", &TextStyle { tracking: 100.0, ..st(100.0) });
+    assert!((tracked - kern - 6.0 * 10.0).abs() < 0.5, "{tracked} {kern}");
+}
+
+#[test]
+fn point_text_alignment() {
+    let l = layout("Hello", &st(50.0), &ParagraphStyle { align: Align::Center, ..Default::default() });
+    let line = &l.lines[0];
+    assert!((line.x + line.width / 2.0).abs() < 0.01);
+    let r = layout("Hello", &st(50.0), &ParagraphStyle { align: Align::Right, ..Default::default() });
+    assert!((r.lines[0].x + r.lines[0].width).abs() < 0.01);
+    assert_eq!(l.glyphs.len(), 5);
+    assert!(l.bounds[1] < -30.0 && l.bounds[3] > 5.0, "{:?}", l.bounds);
+}
+
+#[test]
+fn wraps_area_text_and_justifies() {
+    let p = ParagraphStyle { width: Some(300.0), align: Align::Justify, ..Default::default() };
+    let l = layout("the quick brown fox jumps over the lazy dog again and again", &st(40.0), &p);
+    assert!(l.lines.len() >= 3, "{}", l.lines.len());
+    for line in &l.lines[..l.lines.len() - 1] {
+        assert!((line.width - 300.0).abs() < 0.5, "justified to the box: {}", line.width);
+    }
+    // the lines tile the text
+    assert_eq!(l.lines[0].range.start, 0);
+    for w in l.lines.windows(2) {
+        assert_eq!(w[0].range.end, w[1].range.start);
+        assert!(w[1].baseline > w[0].baseline);
+    }
+    let left = layout("the quick brown fox jumps over the lazy dog", &st(40.0), &ParagraphStyle { width: Some(300.0), ..Default::default() });
+    assert!(left.lines.iter().all(|l| l.width <= 300.0 + 0.01));
+}
+
+#[test]
+fn newlines_make_paragraphs_and_leading_adds() {
+    let l = layout("one\ntwo\n\nfour", &st(30.0), &ParagraphStyle::default());
+    assert_eq!(l.lines.len(), 4);
+    assert_eq!(l.lines[1].range, 4..7);
+    assert_eq!(l.lines[2].range, 8..8);
+    let gap = l.lines[1].baseline - l.lines[0].baseline;
+    let l2 = layout("one\ntwo", &st(30.0), &ParagraphStyle { leading: 10.0, ..Default::default() });
+    assert!((l2.lines[1].baseline - l2.lines[0].baseline - gap - 10.0).abs() < 1e-3);
+}
+
+#[test]
+fn carets_and_hit_testing() {
+    let l = layout("abc\nde", &st(40.0), &ParagraphStyle::default());
+    let (x0, _, li0) = l.caret(0);
+    let (x1, _, _) = l.caret(1);
+    let (x3, _, _) = l.caret(3);
+    assert!(x0.abs() < 1e-3 && x1 > x0 && x3 > x1);
+    assert_eq!(li0, 0);
+    let (_, b4, li4) = l.caret(4);
+    assert_eq!(li4, 1);
+    assert!(b4 > 0.0);
+    assert_eq!(l.hit(x1 + 1.0, 0.0), 1);
+    assert_eq!(l.hit(1000.0, b4), 6);
+    let rects = l.selection_rects(1, 5);
+    assert_eq!(rects.len(), 2);
+}
+
+#[test]
+fn bidi_reorders_rtl_runs() {
+    // Hebrew letters are laid out right-to-left: the first logical letter is rightmost.
+    let l = layout("ab \u{5d0}\u{5d1}\u{5d2} cd", &st(40.0), &ParagraphStyle::default());
+    let x_of = |byte: usize| l.glyphs.iter().find(|g| g.cluster == byte).map(|g| g.x).unwrap();
+    let alef = "ab ".len();
+    let gimel = alef + 4;
+    assert!(x_of(alef) > x_of(gimel), "alef right of gimel");
+    assert!(x_of(0) < x_of(gimel) && x_of(alef) < x_of("ab \u{5d0}\u{5d1}\u{5d2} ".len()));
+}
+
+#[test]
+fn caps_and_small_caps() {
+    let s = st(50.0);
+    let up = measure("HELLO", &s);
+    let all = measure("hello", &TextStyle { caps: Caps::All, ..s.clone() });
+    assert!((up - all).abs() < 0.01);
+    let small = measure("hello", &TextStyle { caps: Caps::Small, ..s.clone() });
+    assert!(small < up * 0.9 && small > up * 0.6, "{small} {up}");
+    let l = layout("Hi", &TextStyle { baseline_shift: 10.0, underline: true, ..s }, &ParagraphStyle::default());
+    assert!((l.glyphs[0].y + 10.0).abs() < 1e-3);
+    assert_eq!(l.underlines.len(), 1);
+}
+
+#[test]
+fn ligature_caret_interpolates() {
+    // Inter has an "fi"-like ligature only via calt in some versions; use "ffi" which most
+    // fonts ligate. Whatever shaping does, every char boundary has a caret.
+    let l = layout("office", &st(40.0), &ParagraphStyle::default());
+    let stops: Vec<usize> = l.lines[0].carets.iter().map(|c| c.0).collect();
+    assert_eq!(stops, vec![0, 1, 2, 3, 4, 5, 6]);
+    let xs: Vec<f32> = l.lines[0].carets.iter().map(|c| c.1).collect();
+    assert!(xs.windows(2).all(|w| w[1] >= w[0]), "{xs:?}");
+}
+
+#[test]
+fn fallback_font_for_missing_glyphs() {
+    // Inter lacks Devanagari/Hebrew; Noto Serif lacks Hebrew too → glyphs still produced (notdef)
+    let l = layout("A\u{3b1}", &TextStyle { family: "Noto Serif".into(), ..st(40.0) }, &ParagraphStyle::default());
+    assert_eq!(l.glyphs.len(), 2);
+    assert!(l.glyphs.iter().all(|g| g.id != 0));
+}
+
+#[test]
+fn empty_text_has_a_caret() {
+    let l = layout("", &st(40.0), &ParagraphStyle::default());
+    assert_eq!(l.lines.len(), 1);
+    assert_eq!(l.caret(0).0, 0.0);
+    assert!(l.bounds[3] > l.bounds[1]);
+}
+
+fn rich(text: &str, runs: &[(Range<usize>, TextStyle)], para: ParagraphStyle) -> Layout {
+    layout_rich_uncached(text, runs, &[para])
+}
+
+#[test]
+fn mixed_sizes_share_a_baseline_and_take_the_largest_leading() {
+    let text = "small BIG\nnext";
+    let runs = [(0..6, st(20.0)), (6..9, st(80.0)), (9..text.len(), st(20.0))];
+    let l = rich(text, &runs, ParagraphStyle::default());
+    assert_eq!(l.lines.len(), 2);
+    let y0 = l.glyphs[0].y;
+    assert!(l.glyphs[..9].iter().all(|g| (g.y - y0).abs() < 1e-3), "one baseline per line");
+    assert!(l.glyphs[7].size > l.glyphs[0].size * 3.0);
+    // Line 2's advance is its own leading (20 px text: 24 px); line 1 is as tall as the big run.
+    assert!((l.lines[1].baseline - l.lines[0].baseline - 24.0).abs() < 1e-3, "{}", l.lines[1].baseline);
+    assert!(l.lines[0].ascent > 60.0);
+    // A big run on the second line pushes it down by its 120% leading.
+    let text2 = "aa\nBB";
+    let l2 = rich(text2, &[(0..3, st(20.0)), (3..5, st(80.0))], ParagraphStyle::default());
+    assert!((l2.lines[1].baseline - 96.0).abs() < 1e-3);
+    // Explicit leading wins over auto.
+    let mut fixed = st(20.0);
+    fixed.leading = Some(50.0);
+    let l3 = rich("a\nb", &[(0..3, fixed)], ParagraphStyle::default());
+    assert!((l3.lines[1].baseline - 50.0).abs() < 1e-3);
+}
+
+#[test]
+fn super_subscript_tsume_and_kerning_metrics() {
+    let base = st(100.0);
+    let sup = TextStyle { script: Script::Super, ..base.clone() };
+    let sub = TextStyle { script: Script::Sub, ..base.clone() };
+    // A letter the font has no superior / inferior glyph for: synthesized.
+    let inter = fonts::resolve("Inter", "Regular").face;
+    let c = "qwkzvjxyQWK".chars().find(|&c| !feature_substitutes(inter, b"sups", c) && !feature_substitutes(inter, b"subs", c)).unwrap();
+    let text: String = ['x', c, 'y', c].iter().collect();
+    let l = rich(&text, &[(0..1, base.clone()), (1..2, sup), (2..3, base.clone()), (3..4, sub)], ParagraphStyle::default());
+    let g = &l.glyphs;
+    assert!((g[1].size - 58.3).abs() < 0.1);
+    assert!((g[1].y - (g[0].y - 33.3)).abs() < 0.1, "superscript raised by a third of the size");
+    assert!((g[3].y - (g[2].y + 33.3)).abs() < 0.1, "subscript lowered");
+    // Tsume removes side bearings; full tsume is narrower than none.
+    let w0 = measure("onion", &base);
+    let w1 = measure("onion", &TextStyle { tsume: 1.0, ..base.clone() });
+    assert!(w1 < w0 - 5.0, "{w1} vs {w0}");
+    // Manual kerning: +100/1000 em before each of the 5 later characters of AVAVAV, metrics off.
+    let nokern = measure("AVAVAV", &TextStyle { kerning: false, ..base.clone() });
+    let manual = measure("AVAVAV", &TextStyle { manual_kern: Some(100.0), ..base.clone() });
+    assert!((manual - nokern - 50.0).abs() < 0.5, "{manual} {nokern}");
+    let optical = measure("AVAVAV", &TextStyle { optical: true, ..base.clone() });
+    assert!(optical > 0.0 && (optical - nokern).abs() < 100.0);
+    // Horizontal scale stretches advances.
+    let wide = measure("onion", &TextStyle { h_scale: 2.0, ..base.clone() });
+    assert!((wide - 2.0 * w0).abs() < 0.5);
+    let l = layout("o", &TextStyle { h_scale: 2.0, v_scale: 0.5, ..base }, &ParagraphStyle::default());
+    assert_eq!((l.glyphs[0].h_scale, l.glyphs[0].v_scale), (2.0, 0.5));
+}
+
+#[test]
+fn indents_and_paragraph_spacing() {
+    let s = st(20.0);
+    let text = "first paragraph here\nsecond one";
+    let p0 = ParagraphStyle { width: Some(400.0), indent_start: 30.0, indent_first: 15.0, space_after: 10.0, ..Default::default() };
+    let p1 = ParagraphStyle { width: Some(400.0), indent_end: 50.0, align: Align::Right, space_before: 7.0, ..Default::default() };
+    let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p0.clone(), p1]);
+    assert!((l.lines[0].x - 45.0).abs() < 1e-3, "left + first-line indent: {}", l.lines[0].x);
+    assert!((l.lines[1].x + l.lines[1].width - 350.0).abs() < 0.5, "right indent: {}", l.lines[1].x + l.lines[1].width);
+    assert!((l.lines[1].baseline - l.lines[0].baseline - (24.0 + 10.0 + 7.0)).abs() < 1e-3);
+    assert_eq!((l.lines[0].para, l.lines[1].para), (0, 1));
+    assert!(l.lines[0].para_end && l.lines[1].para_end);
+    // Wrapped lines after the first don't get the first-line indent.
+    let long = "word ".repeat(30);
+    let l = layout_rich_uncached(&long, &[(0..long.len(), s.clone())], &[p0]);
+    assert!(l.lines.len() > 2);
+    assert!((l.lines[1].x - 30.0).abs() < 1e-3);
+    assert!(l.lines.iter().all(|ln| ln.x + ln.width <= 400.0 + 0.5));
+    assert!(!l.lines[0].para_end);
+    // Point text: a right-aligned paragraph's end indent moves it left of the origin.
+    let l = layout_rich_uncached("abc", &[(0..3, s)], &[ParagraphStyle { align: Align::Right, indent_end: 12.0, ..Default::default() }]);
+    assert!((l.lines[0].x + l.lines[0].width + 12.0).abs() < 1e-3);
+}
+
+#[test]
+fn justify_last_line_modes_and_every_line_composer() {
+    let text = "the quick brown fox jumps over the lazy dog and keeps running far";
+    let s = st(30.0);
+    let p = |last: Align| ParagraphStyle { width: Some(320.0), align: Align::Justify, justify_last: last, ..Default::default() };
+    let left = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Left)]);
+    let n = left.lines.len();
+    assert!(n >= 3);
+    assert!((left.lines[0].width - 320.0).abs() < 0.5);
+    assert!(left.lines[n - 1].width < 320.0 && left.lines[n - 1].x.abs() < 1e-3);
+    let center = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Center)]);
+    let lc = &center.lines[n - 1];
+    assert!((lc.x - (320.0 - lc.width) / 2.0).abs() < 0.5);
+    let right = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Right)]);
+    let lr = &right.lines[n - 1];
+    assert!((lr.x + lr.width - 320.0).abs() < 0.5);
+    let all = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Justify)]);
+    assert!((all.lines[n - 1].width - 320.0).abs() < 0.5, "justify all stretches the last line");
+    // Every-line composer: never worse (summed squared slack) than greedy breaking.
+    let slack = |l: &Layout| -> f32 { l.lines[..l.lines.len() - 1].iter().map(|ln| (320.0 - ln.width).powi(2)).sum() };
+    let greedy = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[ParagraphStyle { width: Some(320.0), ..Default::default() }]);
+    let every = layout_rich_uncached(text, &[(0..text.len(), s)], &[ParagraphStyle { width: Some(320.0), every_line: true, ..Default::default() }]);
+    assert!(slack(&every) <= slack(&greedy) + 1e-3, "{} vs {}", slack(&every), slack(&greedy));
+    assert!(every.lines.iter().all(|ln| ln.width <= 320.0 + 0.5));
+}
+
+#[test]
+fn hanging_punctuation_overhangs_the_box() {
+    let s = st(40.0);
+    let text = "\"Hi.\"";
+    let p = ParagraphStyle { width: Some(400.0), hanging: true, ..Default::default() };
+    let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p]);
+    assert!(l.lines[0].x < -1.0, "opening quote hangs left: {}", l.lines[0].x);
+    let r =
+        layout_rich_uncached(text, &[(0..text.len(), s)], &[ParagraphStyle { width: Some(400.0), hanging: true, align: Align::Right, ..Default::default() }]);
+    assert!(r.lines[0].x + r.lines[0].width > 401.0, "closing quote hangs right");
+}
+
+#[test]
+fn oversized_layout_requests_are_bounded_without_caching() {
+    let text = "a".repeat(MAX_LAYOUT_BYTES + 1);
+    let layout = layout(&text, &TextStyle::default(), &ParagraphStyle::default());
+    assert_eq!(layout.text_len, text.len());
+    assert!(layout.lines.is_empty() && layout.glyphs.is_empty());
+    assert!(layout_rich_uncached("ok", &[], &[]).lines.len() == 1);
+}
+
+#[test]
+fn rtl_paragraph_carets_run_right_to_left() {
+    let text = "\u{5d0}\u{5d1}\u{5d2}";
+    let l = layout_rich_uncached(text, &[(0..text.len(), st(40.0))], &[ParagraphStyle { rtl: Some(true), ..Default::default() }]);
+    let xs: Vec<f32> = l.lines[0].carets.iter().map(|c| c.1).collect();
+    assert_eq!(xs.len(), 4);
+    assert!(xs.windows(2).all(|w| w[1] < w[0]), "{xs:?}");
+    // Hit testing returns the logical position nearest the point.
+    assert_eq!(l.hit(xs[1] + 0.5, 0.0), 2);
+    assert_eq!(l.hit(xs[0] + 50.0, 0.0), 0);
+}
+
+/// #1563: text set in a named instance (`Black`) is laid out at the instance's axis values,
+/// as if they had been set as variations; axes set on the text itself keep their values.
+#[test]
+fn named_instance_sets_the_base_variations() {
+    const FAMILY: &str = "EffectCraft Layout Instance Test";
+    fonts::add_font_data(crate::sfnt::test_font::variable(FAMILY, &[("Light", 300.0, None), ("Black", 900.0, None)], true));
+    let st =
+        |style: &str, variations: Vec<(String, f32)>| TextStyle { family: FAMILY.into(), style: style.into(), size: 50.0, variations, ..Default::default() };
+    let coords = |l: &Layout| l.glyphs.iter().map(|g| crate::variable::coords(g.variations).to_vec()).collect::<Vec<_>>();
+    let black = layout_uncached("Hi", &st("Black", vec![]), &ParagraphStyle::default());
+    assert!(!black.glyphs.is_empty());
+    assert!(coords(&black).iter().all(|c| c == &[("wght".to_string(), 900.0)]), "{:?}", coords(&black));
+    let set = layout_uncached("Hi", &st("Black", vec![("wght".into(), 500.0)]), &ParagraphStyle::default());
+    assert!(coords(&set).iter().all(|c| c == &[("wght".to_string(), 500.0)]), "{:?}", coords(&set));
+    // A static family keeps no variations.
+    let inter = layout_uncached("Hi", &TextStyle::default(), &ParagraphStyle::default());
+    assert!(inter.glyphs.iter().all(|g| g.variations == 0));
+}
+
+/// After Effects 2026 (case 818): box text's first baseline is the `d` height (in whole
+/// thousandths of an em) below the box top, at the nominal size also for superscript, whose
+/// glyphs are then raised. EffectCraft used the font ascent of the drawn size (plus the
+/// superscript rise): 89.1 px instead of 69.5 for Times New Roman at 100 px, and the
+/// superscript glyphs 15.8 px low.
+#[test]
+fn box_text_first_baseline_is_the_d_height_as_after_effects() {
+    let boxed = ParagraphStyle { width: Some(600.0), ..Default::default() };
+    // The rule on a bundled face (works everywhere).
+    for (family, size) in [("Inter", 100.0f32), ("Noto Serif", 50.0)] {
+        let s = TextStyle { family: family.into(), ..st(size) };
+        let r = fonts::resolve(family, "Regular");
+        let f = fonts::face(r.face);
+        let d = crate::outline_units(r.face, f.glyph('d').unwrap()).unwrap();
+        let em = (kurbo::Shape::bounding_box(&*d).y1 as f32 / f.units_per_em() * 1000.0).round() / 1000.0;
+        let l = layout("Hxg", &s, &boxed);
+        assert!((l.lines[0].baseline - em * size).abs() < 1e-3, "{family}: {} vs {}", l.lines[0].baseline, em * size);
+        assert!(l.lines[0].baseline < l.lines[0].ascent, "{family}: below the full ascent");
+    }
+    // After Effects' numbers, where the real fonts are installed.
+    for (family, ae_normal) in [("Times New Roman", 69.5008f32), ("Arial", 71.5988)] {
+        let r = fonts::resolve(family, "Regular");
+        if fonts::face(r.face).info.family != family {
+            continue;
+        }
+        for (size, script, glyph_baseline) in
+            [(100.0, Script::Normal, ae_normal), (50.0, Script::Normal, ae_normal / 2.0), (100.0, Script::Super, ae_normal - 100.0 * SCRIPT_OFFSET)]
+        {
+            let s = TextStyle { family: family.into(), script, ..st(size) };
+            let l = layout("Hxg", &s, &boxed);
+            let drawn = l.glyphs[0].y;
+            assert!((drawn - glyph_baseline).abs() < 0.15, "{family} {size} {script:?}: {drawn} vs AE {glyph_baseline}");
+        }
+    }
+}
+
+/// CodeRabbit on #1875: a face whose `d` is very short (a symbol or icon font) would put the
+/// first baseline almost at the box top; below 0.3 of the ascent the font ascent is used.
+#[test]
+fn a_short_d_falls_back_to_the_font_ascent() {
+    // Latin faces: the `d` is about 0.7 em, the ascent about 0.9 em.
+    let near = |v: Option<f32>, want: f32| v.is_some_and(|v| (v - want).abs() < 1e-3);
+    assert!(near(plausible_first(0.7, 100.0, 90.0), 70.0));
+    // A `d` a tenth of the ascent: not a lowercase ascender.
+    assert_eq!(plausible_first(0.09, 100.0, 90.0), None);
+    assert_eq!(plausible_first(0.26, 100.0, 90.0), None);
+    assert!(near(plausible_first(0.28, 100.0, 90.0), 28.0));
+    // Broken values stay rejected; an unusable ascent does not reject a sane `d`.
+    for (em, px) in [(0.0, 100.0), (-0.5, 100.0), (f32::NAN, 100.0), (5.0, 100.0), (0.7, f32::INFINITY)] {
+        assert_eq!(plausible_first(em, px, 90.0), None, "{em} {px}");
+    }
+    assert!(near(plausible_first(0.7, 100.0, f32::NAN), 70.0));
+    // The bundled faces keep the `d` rule.
+    for family in ["Inter", "Noto Serif"] {
+        let r = fonts::resolve(family, "Regular");
+        assert!(first_ascent(r.face, 100.0).is_some(), "{family}");
+    }
+}
+
+/// After Effects 2026 (EXPORTER t6): with Justify All and the every-line composer, a box that
+/// the other justifications break into lines of 6, 6 and 1 words breaks 4 / 4 / 4, so the
+/// stretched last line is not a lone word; word positions then match AE to 1 px.
+#[test]
+fn justify_all_balances_the_lines_with_the_every_line_composer() {
+    let text = "one two three four five six seven eight nine ten eleven twelve";
+    let s = st(30.0);
+    let words = |l: &Layout| -> Vec<usize> { l.lines.iter().map(|ln| text[ln.range.clone()].split_whitespace().count()).collect() };
+    let p = |last: Align| ParagraphStyle { width: Some(450.0), align: Align::Justify, justify_last: last, every_line: true, ..Default::default() };
+    let left = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p(Align::Left)]);
+    let all = layout_rich_uncached(text, &[(0..text.len(), s)], &[p(Align::Justify)]);
+    let (wl, wa) = (words(&left), words(&all));
+    assert!(wl.last().copied().unwrap_or(0) < *wl.first().unwrap_or(&0), "{wl:?}");
+    let (lo, hi) = (wa.iter().min().copied().unwrap_or(0), wa.iter().max().copied().unwrap_or(0));
+    assert!(hi - lo <= 1, "Justify All balances the lines: {wa:?} (left-justified: {wl:?})");
+}
+
+/// After Effects 2026 (EXPORTER read-back t7): right-to-left point text with any justified
+/// code (justify last left / centre / right, justify all) sits flush right at its anchor, as
+/// right-aligned text does.
+#[test]
+fn rtl_point_text_with_a_justified_paragraph_is_flush_at_its_start() {
+    let text = "Right to left";
+    let s = st(30.0);
+    let at = |align: Align, last: Align| {
+        let p = ParagraphStyle { align, justify_last: last, rtl: Some(true), ..Default::default() };
+        let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p]);
+        (l.lines[0].x, l.lines[0].x + l.lines[0].width)
+    };
+    let right = at(Align::Right, Align::Left);
+    for last in [Align::Left, Align::Center, Align::Right, Align::Justify] {
+        let got = at(Align::Justify, last);
+        assert!((got.0 - right.0).abs() < 1e-3 && (got.1 - right.1).abs() < 1e-3, "{last:?}: {got:?} vs right-aligned {right:?}");
+    }
+}
+
+/// The same holds when the direction is unset and the text itself resolves right to left.
+#[test]
+fn detected_rtl_point_text_with_a_justified_paragraph_is_flush_at_its_start() {
+    let text = "\u{5d0}\u{5d1}\u{5d2} \u{5d3}\u{5d4}";
+    let s = st(30.0);
+    let at = |align: Align| {
+        let p = ParagraphStyle { align, justify_last: Align::Left, rtl: None, ..Default::default() };
+        let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p]);
+        (l.lines[0].x, l.lines[0].x + l.lines[0].width)
+    };
+    let (right, got) = (at(Align::Right), at(Align::Justify));
+    assert!((got.0 - right.0).abs() < 1e-3 && (got.1 - right.1).abs() < 1e-3, "{got:?} vs right-aligned {right:?}");
+}
+
+/// Indents follow the resolved direction too: detected right-to-left text puts its start
+/// indent on the right, as an explicit right-to-left paragraph does.
+#[test]
+fn detected_rtl_text_takes_its_indents_on_the_rtl_sides() {
+    let text = "\u{5d0}\u{5d1}\u{5d2} \u{5d3}\u{5d4}";
+    let s = st(30.0);
+    let at = |rtl: Option<bool>| {
+        let p = ParagraphStyle { align: Align::Justify, justify_last: Align::Left, indent_start: 20.0, rtl, ..Default::default() };
+        let l = layout_rich_uncached(text, &[(0..text.len(), s.clone())], &[p]);
+        (l.lines[0].x, l.lines[0].x + l.lines[0].width)
+    };
+    let (explicit, detected) = (at(Some(true)), at(None));
+    assert!((detected.0 - explicit.0).abs() < 1e-3 && (detected.1 - explicit.1).abs() < 1e-3, "{detected:?} vs {explicit:?}");
+}
+
+/// Only the first line's own runs decide whether box text starts at the font ascent: a
+/// vertical run further down leaves a horizontal first line on its `d`-height baseline.
+#[test]
+fn a_later_vertical_run_keeps_the_first_line_baseline() {
+    let text = "Top\nside";
+    let horiz = st(40.0);
+    let vert = TextStyle { vertical: true, ..horiz.clone() };
+    let p = ParagraphStyle { width: Some(400.0), ..Default::default() };
+    let plain = layout_rich_uncached(text, &[(0..text.len(), horiz.clone())], std::slice::from_ref(&p));
+    let mixed = layout_rich_uncached(text, &[(0..4, horiz), (4..text.len(), vert)], &[p]);
+    assert!((mixed.lines[0].baseline - plain.lines[0].baseline).abs() < 1e-3, "{} vs {}", mixed.lines[0].baseline, plain.lines[0].baseline);
+}
diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs
index 187167527..8cc8e3264 100644
--- a/crates/text/src/lib.rs
+++ b/crates/text/src/lib.rs
@@ -54,7 +54,7 @@ impl OutlinePen for Pen {
 pub(crate) fn outline_units(face: FaceId, gid: u32) -> Option<Arc<BezPath>> {
     static C: OnceLock<Mutex<HashMap<(FaceId, u32), Option<Arc<BezPath>>>>> = OnceLock::new();
     let c = C.get_or_init(Default::default);
-    if let Some(v) = c.lock().unwrap_or_else(|e| e.into_inner()).get(&(face, gid)) {
+    if let Some(v) = c.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&(face, gid)) {
         return v.clone();
     }
     let f = fonts::face(face);
@@ -64,7 +64,7 @@ pub(crate) fn outline_units(face: FaceId, gid: u32) -> Option<Arc<BezPath>> {
         g.draw(DrawSettings::unhinted(Size::unscaled(), LocationRef::default()), &mut pen).ok()?;
         Some(Arc::new(pen.0))
     });
-    let mut m = c.lock().unwrap_or_else(|e| e.into_inner());
+    let mut m = c.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if m.len() > 50_000 {
         m.clear();
     }
@@ -659,7 +659,9 @@ mod tests {
         let doc = TextDoc { text: "ab cd".into(), size: 20.0, box_size: Some([200.0, 100.0]), box_pos: [-100.0, -50.0], ..Default::default() };
         let l = layout_doc(&doc);
         let (a, _) = l.caret(0);
-        assert!((a.x + 100.0).abs() < 1e-6 && (a.y + 50.0).abs() < 1.0, "{a:?}");
+        // The first baseline sits the `d` height below the box top (After Effects), so the
+        // caret, which spans the font's full ascent, starts a little above the box.
+        assert!((a.x + 100.0).abs() < 1e-6 && a.y + 50.0 < 0.0 && a.y + 50.0 > -0.35 * 20.0, "{a:?}");
         // Vertical: characters run down a column, carets are horizontal.
         let v = layout_doc(&TextDoc { text: "abc\nde".into(), size: 20.0, vertical: true, ..Default::default() });
         let ys: Vec<f64> = v.glyphs.iter().filter(|g| g.line_index == 0).map(|g| g.origin.y).collect();
diff --git a/crates/text/src/selectors.rs b/crates/text/src/selectors.rs
index e3a422460..fcecfd814 100644
--- a/crates/text/src/selectors.rs
+++ b/crates/text/src/selectors.rs
@@ -71,6 +71,15 @@ impl Mode {
     pub fn combine(self, acc: f64, v: f64) -> f64 {
         let r = match self {
             Mode::Add => acc + v,
+            // Subtracting more than is selected leaves nothing, not a negative selection (After
+            // Effects 2026: a Subtract selector over unselected characters leaves their
+            // Tracking at 0, EXPORTER read-back t8).
+            // Intended for every animator property, not only Tracking: selectors combine into one
+            // selection per character for the whole animator (`render::text::animator_selection`),
+            // which then scales each of its properties, as in After Effects, where selectors
+            // belong to the animator. The read-back observed that selection through Tracking;
+            // Opacity, Position and the rest were not measured separately.
+            Mode::Subtract if acc >= 0.0 => (acc - v).max(0.0),
             Mode::Subtract => acc - v,
             Mode::Intersect => acc * v,
             Mode::Min => acc.min(v),
@@ -352,6 +361,9 @@ mod tests {
         // A lone Subtract inverts.
         assert_eq!(Mode::Subtract.combine(Mode::Subtract.initial(), 1.0), 0.0);
         assert_eq!(Mode::Subtract.combine(Mode::Subtract.initial(), 0.0), 1.0);
+        // Subtracting from what is not selected leaves 0, not a negative selection (AE t8).
+        assert_eq!(Mode::Subtract.combine(0.0, 1.0), 0.0);
+        assert_eq!(Mode::Subtract.combine(0.25, 1.0), 0.0);
         assert_eq!(Mode::from_index(5), Mode::Difference);
     }
 
diff --git a/crates/text/src/sfnt.rs b/crates/text/src/sfnt.rs
index 753bbdd2c..a5e3907ce 100644
--- a/crates/text/src/sfnt.rs
+++ b/crates/text/src/sfnt.rs
@@ -201,13 +201,21 @@ fn native_name(b: &[u8], id: u16) -> Option<String> {
     let count = be16(b, 2)? as usize;
     let storage = be16(b, 4)? as usize;
     for i in 0..count {
-        let r = 6 + i * 12;
-        let (plat, enc, lang, nid, len, off) =
-            (be16(b, r)?, be16(b, r + 2)?, be16(b, r + 4)?, be16(b, r + 6)?, be16(b, r + 8)? as usize, be16(b, r + 10)? as usize);
+        let r = 6usize.checked_add(i.checked_mul(12)?)?;
+        let (plat, enc, lang, nid, len, off) = (
+            be16(b, r)?,
+            be16(b, r.checked_add(2)?)?,
+            be16(b, r.checked_add(4)?)?,
+            be16(b, r.checked_add(6)?)?,
+            be16(b, r.checked_add(8)?)? as usize,
+            be16(b, r.checked_add(10)?)? as usize,
+        );
         if nid != id || plat != 3 || !(enc == 1 || enc == 10) || lang == 0x409 {
             continue;
         }
-        let raw = b.get(storage + off..storage + off + len)?;
+        let start = storage.checked_add(off)?;
+        let end = start.checked_add(len)?;
+        let raw = b.get(start..end)?;
         let u: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
         let s = String::from_utf16_lossy(&u);
         if !s.trim().is_empty() {
@@ -221,32 +229,45 @@ fn native_name(b: &[u8], id: u16) -> Option<String> {
 fn name_string(b: &[u8], id: u16) -> Option<String> {
     let count = be16(b, 2)? as usize;
     let storage = be16(b, 4)? as usize;
-    let mut best: Option<(u8, String)> = None;
+    let mut cands: Vec<(u8, u16, u16, &[u8])> = Vec::new();
     for i in 0..count {
-        let r = 6 + i * 12;
+        let r = 6usize.checked_add(i.checked_mul(12)?)?;
         let (plat, enc, lang, nid, len, off) =
             (be16(b, r)?, be16(b, r + 2)?, be16(b, r + 4)?, be16(b, r + 6)?, be16(b, r + 8)? as usize, be16(b, r + 10)? as usize);
         if nid != id {
             continue;
         }
-        let raw = b.get(storage + off..storage + off + len)?;
-        let (rank, s) = match plat {
+        let start = storage.checked_add(off)?;
+        let end = start.checked_add(len)?;
+        let raw = b.get(start..end)?;
+        let rank = match plat {
             3 if enc == 1 || enc == 10 => {
-                let u: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
-                (if lang == 0x409 { 0 } else { 1 }, String::from_utf16_lossy(&u))
+                if lang == 0x409 {
+                    0
+                } else {
+                    1
+                }
             }
-            0 => {
-                let u: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
-                (2, String::from_utf16_lossy(&u))
-            }
-            1 if enc == 0 => (3, raw.iter().map(|&c| if c < 128 { c as char } else { '?' }).collect()),
+            0 => 2,
+            1 if enc == 0 => 3,
             _ => continue,
         };
-        if best.as_ref().is_none_or(|(r0, _)| rank < *r0) {
-            best = Some((rank, s));
-        }
+        cands.push((rank, plat, enc, raw));
     }
-    best.map(|(_, s)| s).filter(|s| !s.trim().is_empty())
+    // Best rank first; a blank record falls through to the next. Decoding is lazy, so aliased
+    // records are not decoded once a usable one is found.
+    cands.sort_by_key(|c| c.0);
+    cands.into_iter().find_map(|(_, plat, enc, raw)| {
+        let s = match (plat, enc) {
+            (3, 1 | 10) | (0, _) => {
+                let u: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
+                String::from_utf16_lossy(&u)
+            }
+            (1, 0) => raw.iter().map(|&c| if c < 128 { c as char } else { '?' }).collect(),
+            _ => return None,
+        };
+        (!s.trim().is_empty()).then_some(s)
+    })
 }
 
 /// Synthetic font files for tests: just `name` and `fvar`, enough for the scan and the resolver.
@@ -367,6 +388,28 @@ mod tests {
     /// The scan marks a face with an `fvar` table that declares axes as variable, reading only
     /// the table directory and the fvar header; a static font, an fvar without axes and a
     /// truncated fvar are not.
+    #[test]
+    fn name_table_offsets_are_checked_and_duplicate_records_do_not_repeat_decode() {
+        let valid = names_font("Name Bounds", None);
+        let mut invalid = valid.clone();
+        // name record storage offset near u16::MAX must be rejected rather than overflowing
+        // when combined with its length (the name table starts at byte 28 in this fixture).
+        invalid[28 + 6 + 10] = 0xFF;
+        invalid[28 + 6 + 11] = 0xFF;
+        assert!(read_faces_bytes(&invalid).is_empty());
+
+        // Repeated aliases for one id retain the same selected name and do not change the face.
+        let mut duplicated = valid;
+        let count = u16::from_be_bytes([duplicated[28 + 2], duplicated[28 + 3]]);
+        let first = duplicated[28 + 6..28 + 18].to_vec();
+        for i in 1..count as usize {
+            duplicated[28 + 6 + i * 12..28 + 18 + i * 12].copy_from_slice(&first);
+        }
+        let faces = read_faces_bytes(&duplicated);
+        assert_eq!(faces.len(), 1);
+        assert_eq!((faces[0].family.as_str(), faces[0].style.as_str()), ("Name Bounds", "Regular"));
+    }
+
     #[test]
     fn detects_variable_faces_from_fvar() {
         let v = read_faces_bytes(&names_font("Var Test", Some(Some(1))));
diff --git a/crates/text/src/variable.rs b/crates/text/src/variable.rs
index fc9d7ab42..559343352 100644
--- a/crates/text/src/variable.rs
+++ b/crates/text/src/variable.rs
@@ -4,6 +4,19 @@
 use std::collections::HashMap;
 use std::sync::{Arc, Mutex, OnceLock};
 
+/// Keep process-wide variation storage bounded; id 0 is the safe default location when full.
+const MAX_INTERNED_LOCATIONS: usize = 8192;
+const MAX_AXES_PER_LOCATION: usize = 32;
+const MAX_AXIS_TAG_BYTES: usize = 16;
+
+type CoordKey = Vec<(String, u32)>;
+
+#[derive(Default)]
+struct Table {
+    values: Vec<Arc<Vec<(String, f32)>>>,
+    by_coords: HashMap<CoordKey, u32>,
+}
+
 use kurbo::BezPath;
 use skrifa::instance::{LocationRef, Size};
 use skrifa::outline::DrawSettings;
@@ -14,15 +27,27 @@ use crate::{CharGlyph, Pen};
 
 /// Intern a set of axis values (0 for none), so `Copy` glyphs can carry them.
 pub fn intern(coords: &[(String, f32)]) -> u32 {
-    if coords.is_empty() {
+    if coords.is_empty() || coords.len() > MAX_AXES_PER_LOCATION || coords.iter().any(|(tag, v)| tag.len() > MAX_AXIS_TAG_BYTES || !v.is_finite()) {
         return 0;
     }
-    let mut t = table().lock().unwrap_or_else(|e| e.into_inner());
-    if let Some(i) = t.iter().position(|c| c.as_slice() == coords) {
-        return i as u32 + 1;
+    // Axis order is not significant. Canonicalize it once so equivalent locations share one key.
+    let mut key: CoordKey = coords.iter().map(|(tag, v)| (tag.clone(), if *v == 0.0 { 0 } else { v.to_bits() })).collect();
+    key.sort_unstable_by(|a, b| a.0.cmp(&b.0));
+    if key.windows(2).any(|w| w[0].0 == w[1].0) {
+        return 0;
     }
-    t.push(Arc::new(coords.to_vec()));
-    t.len() as u32
+    let mut t = table().lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    if let Some(id) = t.by_coords.get(&key) {
+        return *id;
+    }
+    if t.values.len() >= MAX_INTERNED_LOCATIONS {
+        return 0;
+    }
+    let Some(id) = u32::try_from(t.values.len()).ok().and_then(|n| n.checked_add(1)) else { return 0 };
+    let value = Arc::new(key.iter().map(|(tag, bits)| (tag.clone(), f32::from_bits(*bits))).collect());
+    t.values.push(value);
+    t.by_coords.insert(key, id);
+    id
 }
 
 /// The axis values of an interned id (empty for 0).
@@ -30,11 +55,11 @@ pub fn coords(id: u32) -> Arc<Vec<(String, f32)>> {
     if id == 0 {
         return Arc::new(Vec::new());
     }
-    table().lock().unwrap_or_else(|e| e.into_inner()).get(id as usize - 1).cloned().unwrap_or_default()
+    table().lock().unwrap_or_else(std::sync::PoisonError::into_inner).values.get(id as usize - 1).cloned().unwrap_or_default()
 }
 
-fn table() -> &'static Mutex<Vec<Arc<Vec<(String, f32)>>>> {
-    static T: OnceLock<Mutex<Vec<Arc<Vec<(String, f32)>>>>> = OnceLock::new();
+fn table() -> &'static Mutex<Table> {
+    static T: OnceLock<Mutex<Table>> = OnceLock::new();
     T.get_or_init(Default::default)
 }
 
@@ -84,7 +109,7 @@ pub fn outline_units_at(face: FaceId, gid: u32, coords: &[(String, f32)]) -> Opt
     let c = C.get_or_init(Default::default);
     // Quantise to 1/100 of a unit so animation frames reuse outlines.
     let key: Key = (face, gid, coords.iter().map(|(t, v)| (t.clone(), (v * 100.0).round() as i32)).collect());
-    if let Some(v) = c.lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
+    if let Some(v) = c.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&key) {
         return v.clone();
     }
     let f = fonts::face(face);
@@ -95,7 +120,7 @@ pub fn outline_units_at(face: FaceId, gid: u32, coords: &[(String, f32)]) -> Opt
         g.draw(DrawSettings::unhinted(Size::unscaled(), LocationRef::from(&loc)), &mut pen).ok()?;
         Some(Arc::new(pen.0))
     });
-    let mut m = c.lock().unwrap_or_else(|e| e.into_inner());
+    let mut m = c.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if m.len() > 20_000 {
         m.clear();
     }
@@ -197,6 +222,9 @@ mod tests {
         let id = intern(&[("wght".into(), 700.0)]);
         assert_eq!(intern(&[("wght".into(), 700.0)]), id);
         assert_eq!(coords(id).as_slice(), &[("wght".to_string(), 700.0)]);
+        assert_eq!(intern(&[("wdth".into(), 20.0), ("wght".into(), 700.0)]), intern(&[("wght".into(), 700.0), ("wdth".into(), 20.0)]));
+        assert_eq!(intern(&[("wght".into(), f32::NAN)]), 0);
+        assert_eq!(intern(&vec![("wght".into(), 1.0); MAX_AXES_PER_LOCATION + 1]), 0);
         let Some((face, axes)) = find_variable_face() else {
             eprintln!("no variable font installed: skipped");
             return;
diff --git a/crates/text/tests/it/main.rs b/crates/text/tests/it/main.rs
new file mode 100644
index 000000000..c22600d8b
--- /dev/null
+++ b/crates/text/tests/it/main.rs
@@ -0,0 +1,5 @@
+//! The crate's shared integration-test binary (each module is a former `tests/<name>.rs`).
+//! `system_font_menu` is separate: it asserts that no system font scan has run in its process.
+
+mod script_fallback;
+mod vertical_punctuation;
diff --git a/crates/text/tests/script_fallback.rs b/crates/text/tests/it/script_fallback.rs
similarity index 100%
rename from crates/text/tests/script_fallback.rs
rename to crates/text/tests/it/script_fallback.rs
diff --git a/crates/text/tests/vertical_punctuation.rs b/crates/text/tests/it/vertical_punctuation.rs
similarity index 100%
rename from crates/text/tests/vertical_punctuation.rs
rename to crates/text/tests/it/vertical_punctuation.rs
diff --git a/crates/time/src/lib.rs b/crates/time/src/lib.rs
index 7a64a82bb..9bc625d10 100644
--- a/crates/time/src/lib.rs
+++ b/crates/time/src/lib.rs
@@ -198,7 +198,9 @@ impl FrameRate {
                 return r;
             }
         }
-        FrameRate::new((fps * 1000.0).round() as i64, 1000)
+        let num = (fps * 1000.0).round() as i64;
+        // A tiny positive rate must not round to the invalid 0/1 rate.
+        FrameRate::new(if fps > 0.0 { num.max(1) } else { num }, 1000)
     }
 
     pub fn as_f64(self) -> f64 {
@@ -387,7 +389,11 @@ pub fn format_time(t: Tick, rate: FrameRate, drop_frame: bool, display: TimeDisp
             let rem = Tick(abs.rem_euclid(TICKS_PER_SECOND)).to_units_floor(sample_rate);
             format!("{sign}{:02}:{:02}:{:02}:{rem:05}", secs / 3600, (secs / 60) % 60, secs % 60)
         }
-        TimeDisplay::Seconds => format!("{:.3}", t.seconds()),
+        TimeDisplay::Seconds => {
+            let s = t.seconds();
+            // A value that rounds to zero must not print a sign ("-0.000").
+            format!("{:.3}", if (s * 1000.0).round() == 0.0 { 0.0 } else { s })
+        }
     }
 }
 
@@ -533,6 +539,21 @@ pub const SAMPLE_RATES: [i64; 6] = [32_000, 44_100, 48_000, 88_200, 96_000, 192_
 mod tests {
     use super::*;
 
+    #[test]
+    fn from_f64_tiny_positive_fps_is_nonzero() {
+        let r = FrameRate::from_f64(0.0001);
+        assert!(r.num > 0 && r.den > 0, "got {r:?}");
+    }
+
+    #[test]
+    fn seconds_display_has_no_negative_zero() {
+        for t in [Tick(-1), Tick(0), Tick(-100)] {
+            assert_eq!(format_time(t, FrameRate::FPS_30, false, TimeDisplay::Seconds, 48000), "0.000");
+        }
+        let one = Tick(-TICKS_PER_SECOND);
+        assert_eq!(format_time(one, FrameRate::FPS_30, false, TimeDisplay::Seconds, 48000), "-1.000");
+    }
+
     #[test]
     fn frame_rate_constructors_accept_extreme_numbers() {
         assert_eq!(FrameRate::new(i64::MIN, 1), FrameRate { num: i64::MIN, den: 1 });
diff --git a/crates/track/src/camtrack/mod.rs b/crates/track/src/camtrack.rs
similarity index 90%
rename from crates/track/src/camtrack/mod.rs
rename to crates/track/src/camtrack.rs
index e8cd28da8..ea4f89a3f 100644
--- a/crates/track/src/camtrack/mod.rs
+++ b/crates/track/src/camtrack.rs
@@ -67,8 +67,9 @@ pub struct Track2D {
 }
 
 impl Track2D {
+    /// Exclusive end frame, saturated when the track exceeds the frame index range.
     pub fn end(&self) -> u32 {
-        self.start + self.pts.len() as u32
+        u32::try_from(self.pts.len()).ok().and_then(|n| self.start.checked_add(n)).unwrap_or(u32::MAX)
     }
     /// Position on frame `k` when the track covers it.
     pub fn at(&self, k: u32) -> Option<[f64; 2]> {
@@ -483,3 +484,52 @@ pub fn point_color(id: u32) -> [f32; 3] {
     // Bright, slightly desaturated.
     [0.25 + 0.75 * r, 0.25 + 0.75 * g, 0.25 + 0.75 * b]
 }
+
+#[cfg(test)]
+mod validation_tests {
+    use super::*;
+
+    fn tracks() -> CameraTracks {
+        CameraTracks { size: [1920.0, 1080.0], factor: 1.0, frame_duration: 1.0 / 30.0, frames: 3, ..Default::default() }
+    }
+
+    #[test]
+    fn track_end_saturates_instead_of_wrapping() {
+        assert_eq!(Track2D { start: u32::MAX, pts: vec![[0.0; 2]], ..Default::default() }.end(), u32::MAX);
+        assert_eq!(Track2D { start: 3, pts: vec![[0.0; 2]; 2], ..Default::default() }.end(), 5);
+    }
+
+    #[test]
+    fn solve_rejects_large_frame_count_before_allocating() {
+        let t = CameraTracks { frames: u32::MAX, ..tracks() };
+        let error = solve(&t, &SolveSettings::default(), None).unwrap_err();
+        assert!(error.0.contains("frame or track count"));
+    }
+
+    #[test]
+    fn solve_rejects_overflowing_and_out_of_clip_tracks() {
+        for start in [u32::MAX, 2] {
+            let t = CameraTracks { tracks: vec![Track2D { start, pts: vec![[0.0; 2]; 3], ..Default::default() }], ..tracks() };
+            let error = solve(&t, &SolveSettings::default(), None).unwrap_err();
+            assert!(error.0.contains("frame range"));
+        }
+    }
+
+    #[test]
+    fn solve_rejects_non_finite_track_positions() {
+        let t = CameraTracks { tracks: vec![Track2D { pts: vec![[f32::NAN, 0.0]; 3], ..Default::default() }], ..tracks() };
+        let error = solve(&t, &SolveSettings::default(), None).unwrap_err();
+        assert!(error.0.contains("finite"));
+    }
+
+    #[test]
+    fn solve_rejects_invalid_dimensions_timing_and_scale() {
+        for t in [
+            CameraTracks { size: [f64::NAN, 1080.0], ..tracks() },
+            CameraTracks { frame_duration: 0.0, ..tracks() },
+            CameraTracks { factor: f64::INFINITY, ..tracks() },
+        ] {
+            assert!(solve(&t, &SolveSettings::default(), None).is_err());
+        }
+    }
+}
diff --git a/crates/track/src/camtrack/bundle.rs b/crates/track/src/camtrack/bundle.rs
index 077f04b71..a4412dbce 100644
--- a/crates/track/src/camtrack/bundle.rs
+++ b/crates/track/src/camtrack/bundle.rs
@@ -10,9 +10,9 @@
 
 use rayon::prelude::*;
 
-use super::Distortion;
 use super::geometry::Pose;
-use super::linalg::*;
+use super::linalg::{M3, V3, add, cholesky_solve, conjugate_gradient, dot, inv3, mm, mtv, mv, rodrigues, scale, skew, sub};
+use super::{Distortion, SolveError};
 
 /// A camera in the adjustment.
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -52,6 +52,7 @@ pub struct BaOpts {
     pub fixed: Vec<bool>,
     /// Huber threshold (pixels).
     pub huber: f64,
+    /// Maximum LM iterations (at most 1000).
     pub max_iter: usize,
     /// Adjust the shared radial distortion `(k1, k2)` too.
     pub distortion: bool,
@@ -76,21 +77,89 @@ fn huber(e2: f64, k: f64) -> f64 {
     if e2 <= k * k { e2 } else { 2.0 * k * e2.sqrt() - k * k }
 }
 
-/// Residual (pixels) of one observation, `None` behind the camera.
+// Bound the temporary systems before any input-sized allocation. Includes dense matrices
+// for the main system, trial copies and both Rayon phases, plus per-point/observation data.
+const MAX_BA_BYTES: usize = 256 * 1024 * 1024;
+const MAX_BA_CAMERAS: usize = 4096;
+const MAX_BA_POINTS: usize = 200_000;
+const MAX_BA_OBSERVATIONS: usize = 1_000_000;
+
+fn valid_camera(c: &BaCam) -> bool {
+    c.f.is_finite()
+        && c.f > 0.0
+        && c.pose.r.iter().flatten().chain(&c.pose.c).all(|v| v.is_finite())
+        && [c.dist.k1, c.dist.k2, c.dist.radius].iter().all(|v| v.is_finite())
+}
+
+fn validate(cams: &[BaCam], pts: &[V3], obs: &[BaObs], o: &BaOpts) -> Result<(), SolveError> {
+    if cams.len() > MAX_BA_CAMERAS || pts.len() > MAX_BA_POINTS || obs.len() > MAX_BA_OBSERVATIONS {
+        return Err(SolveError("bundle adjustment input exceeds the supported size".into()));
+    }
+    if !o.huber.is_finite() || o.huber <= 0.0 || o.max_iter > 1000 || matches!(o.focal, FocalMode::PerCamera(k) if !k.is_finite() || k < 0.0) {
+        return Err(SolveError("invalid bundle adjustment options".into()));
+    }
+    if cams.iter().any(|c| !valid_camera(c)) || pts.iter().flatten().any(|v| !v.is_finite()) {
+        return Err(SolveError("bundle adjustment cameras and points must be finite, with positive focal lengths".into()));
+    }
+    for ob in obs {
+        if cams.get(ob.cam as usize).is_none() || pts.get(ob.pt as usize).is_none() {
+            return Err(SolveError("bundle adjustment observation index is out of range".into()));
+        }
+        if ob.uv.iter().any(|v| !v.is_finite()) {
+            return Err(SolveError("bundle adjustment observations must be finite".into()));
+        }
+    }
+    Ok(())
+}
+
+fn matrix_len(n: usize, npts: usize, nobs: usize) -> Result<usize, SolveError> {
+    let threads = rayon::current_num_threads();
+    let build_workers = if n <= 700 && npts > 64 { threads.clamp(1, 16) } else { 0 };
+    let schur_workers = if n <= 1200 && npts >= 64 && threads > 1 { threads.clamp(1, 8) } else { 0 };
+    // The two worker phases do not coexist; allow the larger phase plus main/trial buffers.
+    let copies = 4 + build_workers.max(schur_workers);
+    let len = n.checked_mul(n);
+    let bytes = len
+        .and_then(|v| v.checked_add(n))
+        .and_then(|v| v.checked_mul(size_of::<f64>()))
+        .and_then(|v| v.checked_mul(copies))
+        .and_then(|v| npts.checked_mul(320).and_then(|p| v.checked_add(p)))
+        .and_then(|v| nobs.checked_mul(2 * 9 * size_of::<(usize, V3)>() + size_of::<BaObs>() + 2 * size_of::<u32>()).and_then(|p| v.checked_add(p)));
+    match (len, bytes) {
+        (Some(len), Some(bytes)) if bytes <= MAX_BA_BYTES => Ok(len),
+        _ => Err(SolveError("bundle adjustment exceeds its 256 MiB workspace budget; use fewer cameras or observations".into())),
+    }
+}
+
+/// Residual (pixels), or `None` for an invalid or behind-camera projection.
 pub fn residual(c: &BaCam, x: V3, uv: [f64; 2]) -> Option<[f64; 2]> {
+    if !valid_camera(c) || x.iter().chain(&uv).any(|v| !v.is_finite()) {
+        return None;
+    }
+    project_residual(c, x, uv)
+}
+
+fn project_residual(c: &BaCam, x: V3, uv: [f64; 2]) -> Option<[f64; 2]> {
     let p = c.pose.to_cam(x);
-    if p[2] <= 1e-9 {
+    if p[2] <= 1e-9 || p.iter().any(|v| !v.is_finite()) {
         return None;
     }
     let q = c.dist.distort([c.f * p[0] / p[2], c.f * p[1] / p[2]]);
-    Some([q[0] - uv[0], q[1] - uv[1]])
+    let r = [q[0] - uv[0], q[1] - uv[1]];
+    r.iter().all(|v| v.is_finite()).then_some(r)
 }
 
-/// Total robust cost.
-pub fn cost(cams: &[BaCam], pts: &[V3], obs: &[BaObs], o: &BaOpts) -> f64 {
+/// Total robust cost. Rejects invalid inputs before starting parallel evaluation.
+pub fn cost(cams: &[BaCam], pts: &[V3], obs: &[BaObs], o: &BaOpts) -> Result<f64, SolveError> {
+    validate(cams, pts, obs, o)?;
+    let c = validated_cost(cams, pts, obs, o);
+    if c.is_finite() { Ok(c) } else { Err(SolveError("bundle adjustment cost is not finite".into())) }
+}
+
+fn validated_cost(cams: &[BaCam], pts: &[V3], obs: &[BaObs], o: &BaOpts) -> f64 {
     let c: f64 = obs
         .par_iter()
-        .map(|ob| match residual(&cams[ob.cam as usize], pts[ob.pt as usize], ob.uv) {
+        .map(|ob| match cams.get(ob.cam as usize).zip(pts.get(ob.pt as usize)).and_then(|(c, x)| project_residual(c, *x, ob.uv)) {
             Some(r) => huber(r[0] * r[0] + r[1] * r[1], o.huber),
             None => BEHIND,
         })
@@ -147,8 +216,52 @@ fn layout(ncam: usize, o: &BaOpts) -> Layout {
     Layout { start, fidx, shared, dist, n, rot_only: o.fix_centers }
 }
 
+// Six pose parameters, one shared OR per-camera focal parameter, two distortion parameters.
+const MAX_CAMERA_JACOBIAN_ENTRIES: usize = 6 + 1 + 2;
+type CameraJacobianEntry = (usize, [f64; 2]);
+
+/// Keeps the current parameter set on the stack. Extra parameters spill rather than panic
+/// if a future extension grows beyond the inline capacity.
+struct CameraJacobian {
+    entries: [CameraJacobianEntry; MAX_CAMERA_JACOBIAN_ENTRIES],
+    len: usize,
+    overflow: Vec<CameraJacobianEntry>,
+}
+
+impl CameraJacobian {
+    fn new() -> Self {
+        Self { entries: [(0, [0.0; 2]); MAX_CAMERA_JACOBIAN_ENTRIES], len: 0, overflow: Vec::new() }
+    }
+
+    fn clear(&mut self) {
+        self.len = 0;
+        self.overflow.clear();
+    }
+
+    fn push(&mut self, entry: CameraJacobianEntry) {
+        if self.overflow.is_empty() {
+            if let Some(slot) = self.entries.get_mut(self.len) {
+                *slot = entry;
+                self.len += 1;
+                return;
+            }
+            self.overflow.extend_from_slice(&self.entries);
+        }
+        self.overflow.push(entry);
+    }
+
+    fn as_slice(&self) -> &[CameraJacobianEntry] {
+        if self.overflow.is_empty() {
+            // len only grows after a successful get_mut, so it cannot exceed capacity.
+            self.entries.get(..self.len).unwrap_or_default()
+        } else {
+            &self.overflow
+        }
+    }
+}
+
 /// Camera-side Jacobian entries of one observation: (parameter index, d r / d param).
-fn cam_jac(l: &Layout, ci: usize, c: &BaCam, xc: V3, a: &[[f64; 3]; 2], p: [f64; 2], out: &mut Vec<(usize, [f64; 2])>) {
+fn cam_jac(l: &Layout, ci: usize, c: &BaCam, xc: V3, a: &[[f64; 3]; 2], p: [f64; 2], out: &mut CameraJacobian) {
     out.clear();
     let s = l.start[ci];
     if s != usize::MAX {
@@ -174,16 +287,186 @@ fn cam_jac(l: &Layout, ci: usize, c: &BaCam, xc: V3, a: &[[f64; 3]; 2], p: [f64;
     }
 }
 
+struct PtSys {
+    v: M3,
+    bp: V3,
+    w: Vec<(usize, V3)>,
+}
+
+struct PreconditionerBlock {
+    start: usize,
+    dim: usize,
+    inverse: Vec<f64>,
+}
+
+fn camera_preconditioner(u: &[f64], l: &Layout) -> Option<Vec<PreconditionerBlock>> {
+    let mut ranges = Vec::new();
+    let pose_dim = if l.rot_only { 3 } else { 6 };
+    for (&pose, &focal) in l.start.iter().zip(&l.fidx) {
+        if pose != usize::MAX {
+            ranges.push((pose, pose_dim + usize::from(focal != usize::MAX)));
+        } else if focal != usize::MAX {
+            ranges.push((focal, 1));
+        }
+    }
+    if let Some(start) = l.shared.or(l.dist) {
+        ranges.push((start, l.n - start));
+    }
+    ranges
+        .into_iter()
+        .map(|(start, dim)| {
+            let mut matrix = Vec::with_capacity(dim * dim);
+            for i in 0..dim {
+                for j in 0..dim {
+                    matrix.push(*u.get((start + i) * l.n + start + j)?);
+                }
+            }
+            let mut inverse = vec![0.0; dim * dim];
+            for col in 0..dim {
+                let mut a = matrix.clone();
+                let mut b = vec![0.0; dim];
+                *b.get_mut(col)? = 1.0;
+                if !cholesky_solve(&mut a, dim, &mut b) {
+                    return None;
+                }
+                for (row, value) in b.into_iter().enumerate() {
+                    inverse[row * dim + col] = value;
+                }
+            }
+            Some(PreconditionerBlock { start, dim, inverse })
+        })
+        .collect()
+}
+
+/// Apply the point-eliminated system without materialising W V^-1 W^T.
+fn iterative_schur(u: &[f64], rhs: &[f64], systems: &[PtSys], vinv: &[Option<M3>], l: &Layout) -> Option<Vec<f64>> {
+    if l.n == 0 || l.n.checked_mul(l.n) != Some(u.len()) || rhs.len() != l.n || systems.len() != vinv.len() {
+        return None;
+    }
+    let blocks = camera_preconditioner(u, l)?;
+    // U contains camera blocks, global parameters and the focal prior. Store its nonzeros
+    // once; all subsequent products are linear in these and the point-camera connections.
+    let rows: Vec<Vec<(usize, f64)>> =
+        u.chunks_exact(l.n).map(|row| row.iter().enumerate().filter(|(_, v)| **v != 0.0).map(|(i, v)| (i, *v)).collect()).collect();
+    let mut reduced_rhs = rhs.to_vec();
+    for (ps, vi) in systems.iter().zip(vinv) {
+        let Some(vi) = vi else { continue };
+        let vb = mv(vi, ps.bp);
+        for (i, w) in &ps.w {
+            *reduced_rhs.get_mut(*i)? -= dot(*w, vb);
+        }
+    }
+    conjugate_gradient(
+        &reduced_rhs,
+        |x, y| {
+            for (i, row) in rows.iter().enumerate() {
+                y[i] = row.iter().map(|(j, v)| v * x[*j]).sum();
+            }
+            for (ps, vi) in systems.iter().zip(vinv) {
+                let Some(vi) = vi else { continue };
+                let q = ps.w.iter().fold([0.0; 3], |q, (i, w)| add(q, scale(*w, x[*i])));
+                let q = mv(vi, q);
+                for (i, w) in &ps.w {
+                    y[*i] -= dot(*w, q);
+                }
+            }
+        },
+        |r, z| {
+            z.fill(0.0);
+            for block in &blocks {
+                for i in 0..block.dim {
+                    z[block.start + i] = (0..block.dim).map(|j| block.inverse[i * block.dim + j] * r[block.start + j]).sum();
+                }
+            }
+        },
+    )
+}
+
+/// Smooth per-camera log focal lengths in the normal equations.
+fn add_focal_prior(cams: &[BaCam], o: &BaOpts, l: &Layout, s_mat: &mut [f64], bc: &mut [f64]) {
+    let n = l.n;
+    // Focal prior.
+    if let FocalMode::PerCamera(k) = o.focal {
+        for i in 0..cams.len().saturating_sub(1) {
+            let r = k * (cams[i].f.ln() - cams[i + 1].f.ln());
+            let (a, b) = (l.fidx[i], l.fidx[i + 1]);
+            let ia = (a != usize::MAX).then_some(a);
+            let ib = (b != usize::MAX).then_some(b);
+            for (idx, g) in [(ia, k), (ib, -k)] {
+                let Some(x) = idx else { continue };
+                bc[x] -= g * r;
+                for (idy, h) in [(ia, k), (ib, -k)] {
+                    if let Some(y) = idy {
+                        s_mat[x * n + y] += g * h;
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Eliminate the points into the camera system explicitly (`S -= W V^-1 W^T`, `rhs -= W V^-1 bp`).
+fn reduce_points(systems: &[PtSys], vinv: &[Option<M3>], n: usize, s: &mut [f64], rhs: &mut [f64]) {
+    let npts = systems.len();
+    let reduce = |range: std::ops::Range<usize>, s: &mut [f64], rhs: &mut [f64]| {
+        for j in range {
+            let (Some(vi), ps) = (&vinv[j], &systems[j]) else { continue };
+            let vb = mv(vi, ps.bp);
+            let wv: Vec<V3> = ps.w.iter().map(|(_, w)| mv(vi, *w)).collect();
+            for (a, (ia, wa)) in ps.w.iter().enumerate() {
+                rhs[*ia] -= dot(*wa, vb);
+                for (ib, wb) in &ps.w[a..] {
+                    let d = dot(wv[a], *wb);
+                    s[ia * n + ib] -= d;
+                    if ia != ib {
+                        s[ib * n + ia] -= d;
+                    }
+                }
+            }
+        }
+    };
+    let chunks = rayon::current_num_threads().clamp(1, 8);
+    if n <= 1200 && npts >= 64 && chunks > 1 {
+        let per = npts.div_ceil(chunks);
+        let parts: Vec<(Vec<f64>, Vec<f64>)> = (0..chunks)
+            .into_par_iter()
+            .map(|t| {
+                let (mut ds, mut dr) = (vec![0.0; n * n], vec![0.0; n]);
+                reduce(t * per..((t + 1) * per).min(npts), &mut ds, &mut dr);
+                (ds, dr)
+            })
+            .collect();
+        for (ds, dr) in parts {
+            s.par_iter_mut().zip(ds.par_iter()).for_each(|(x, y)| *x += y);
+            for (x, y) in rhs.iter_mut().zip(dr) {
+                *x += y;
+            }
+        }
+    } else {
+        reduce(0..npts, s, rhs);
+    }
+}
+
 /// Run Levenberg–Marquardt. `cams` and `pts` are updated in place.
-pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) -> BaReport {
+/// Invalid inputs or workspaces exceeding 256 MiB return an error before mutation.
+pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) -> Result<BaReport, SolveError> {
+    validate(cams, pts, obs, o)?;
+    adjust_impl(cams, pts, obs, o, true)
+}
+
+fn adjust_impl(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts, allow_iterative: bool) -> Result<BaReport, SolveError> {
     let l = layout(cams.len(), o);
+    let matrix_len = matrix_len(l.n, pts.len(), obs.len())?;
     let npts = pts.len();
     // Observations by point.
     let mut by_pt: Vec<Vec<u32>> = vec![vec![]; npts];
     for (i, ob) in obs.iter().enumerate() {
         by_pt[ob.pt as usize].push(i as u32);
     }
-    let mut cur = cost(cams, pts, obs, o);
+    let mut cur = validated_cost(cams, pts, obs, o);
+    if !cur.is_finite() {
+        return Err(SolveError("bundle adjustment cost is not finite".into()));
+    }
     let initial = cur;
     let t0 = web_time::Instant::now();
     let mut tries = 0usize;
@@ -191,7 +474,7 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
     let mut lambda = 1e-4;
     let mut iters = 0;
     if l.n == 0 && o.fix_points {
-        return BaReport { initial_cost: initial, cost: cur, iterations: 0 };
+        return Ok(BaReport { initial_cost: initial, cost: cur, iterations: 0 });
     }
     let n = l.n;
     let parallel = n <= 700;
@@ -199,14 +482,9 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
         iters += 1;
         // ---- Normal equations (Gauss–Newton with IRLS weights).
         // Per point: V (3×3), bp (3), W entries (cam-side index → 3).
-        struct PtSys {
-            v: [[f64; 3]; 3],
-            bp: V3,
-            w: Vec<(usize, V3)>,
-        }
         let build_point = |j: usize, s_acc: &mut Vec<f64>, bc: &mut Vec<f64>| -> PtSys {
             let mut ps = PtSys { v: [[0.0; 3]; 3], bp: [0.0; 3], w: vec![] };
-            let mut jc: Vec<(usize, [f64; 2])> = Vec::with_capacity(8);
+            let mut jc = CameraJacobian::new();
             for &oi in &by_pt[j] {
                 let ob = &obs[oi as usize];
                 let ci = ob.cam as usize;
@@ -231,6 +509,7 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
                     jc.push((g, [dk[0][0], dk[1][0]]));
                     jc.push((g + 1, [dk[0][1], dk[1][1]]));
                 }
+                let jc = jc.as_slice();
                 // Point Jacobian: A R.
                 let jx = if o.fix_points {
                     [[0.0; 3]; 2]
@@ -239,9 +518,9 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
                     let r1 = mtv(&c.pose.r, a[1]);
                     [r0, r1]
                 };
-                for (ia, ja) in &jc {
+                for (ia, ja) in jc.iter() {
                     bc[*ia] -= w * (ja[0] * r[0] + ja[1] * r[1]);
-                    for (ib, jb) in &jc {
+                    for (ib, jb) in jc.iter() {
                         s_acc[ia * n + ib] += w * (ja[0] * jb[0] + ja[1] * jb[1]);
                     }
                 }
@@ -252,7 +531,7 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
                             ps.v[a1][b1] += w * (jx[0][a1] * jx[0][b1] + jx[1][a1] * jx[1][b1]);
                         }
                     }
-                    for (ia, ja) in &jc {
+                    for (ia, ja) in jc.iter() {
                         let wv =
                             [w * (ja[0] * jx[0][0] + ja[1] * jx[1][0]), w * (ja[0] * jx[0][1] + ja[1] * jx[1][1]), w * (ja[0] * jx[0][2] + ja[1] * jx[1][2])];
                         // Each observation of a point is on another camera: only the shared focal
@@ -274,12 +553,12 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
             let parts: Vec<(Vec<f64>, Vec<f64>, Vec<PtSys>)> = (0..chunks)
                 .into_par_iter()
                 .map(|t| {
-                    let (mut s, mut b) = (vec![0.0; n * n], vec![0.0; n]);
+                    let (mut s, mut b) = (vec![0.0; matrix_len], vec![0.0; n]);
                     let v = (t * per..((t + 1) * per).min(npts)).map(|j| build_point(j, &mut s, &mut b)).collect();
                     (s, b, v)
                 })
                 .collect();
-            let mut s = vec![0.0; n * n];
+            let mut s = vec![0.0; matrix_len];
             let mut b = vec![0.0; n];
             let mut sys = Vec::with_capacity(npts);
             for (ps, pb, pv) in parts {
@@ -293,32 +572,19 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
             }
             (s, b, sys)
         } else {
-            let mut s = vec![0.0; n * n];
+            let mut s = vec![0.0; matrix_len];
             let mut b = vec![0.0; n];
             let sys = (0..npts).map(|j| build_point(j, &mut s, &mut b)).collect();
             (s, b, sys)
         };
-        // Focal prior.
-        if let FocalMode::PerCamera(k) = o.focal {
-            for i in 0..cams.len().saturating_sub(1) {
-                let r = k * (cams[i].f.ln() - cams[i + 1].f.ln());
-                let (a, b) = (l.fidx[i], l.fidx[i + 1]);
-                let ia = (a != usize::MAX).then_some(a);
-                let ib = (b != usize::MAX).then_some(b);
-                for (idx, g) in [(ia, k), (ib, -k)] {
-                    let Some(x) = idx else { continue };
-                    bc[x] -= g * r;
-                    for (idy, h) in [(ia, k), (ib, -k)] {
-                        if let Some(y) = idy {
-                            s_mat[x * n + y] += g * h;
-                        }
-                    }
-                }
-            }
-        }
+        add_focal_prior(cams, o, &l, &mut s_mat, &mut bc);
         let base_s = s_mat.clone();
         let base_bc = bc.clone();
         let mean_diag = ((0..n).map(|i| base_s[i * n + i]).sum::<f64>() / n.max(1) as f64).max(1e-12);
+        let schur_pairs = systems.iter().fold(0usize, |sum, ps| sum.saturating_add(ps.w.len().saturating_mul(ps.w.len().saturating_add(1)) / 2));
+        // Reserve the iterative solve for expensive long-track reductions; small systems
+        // retain the direct path and its rounding. Failed solves use the direct path too.
+        let mut use_iterative = allow_iterative && !o.fix_points && n >= 120 && schur_pairs > 4_000_000;
         // ---- Try steps with increasing damping.
         let mut accepted = false;
         for _try in 0..12 {
@@ -346,50 +612,26 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
                     })
                     .collect()
             };
-            if !o.fix_points {
-                let reduce = |range: std::ops::Range<usize>, s: &mut [f64], rhs: &mut [f64]| {
-                    for j in range {
-                        let (Some(vi), ps) = (&vinv[j], &systems[j]) else { continue };
-                        let vb = mv(vi, ps.bp);
-                        let wv: Vec<V3> = ps.w.iter().map(|(_, w)| mv(vi, *w)).collect();
-                        for (a, (ia, wa)) in ps.w.iter().enumerate() {
-                            rhs[*ia] -= dot(*wa, vb);
-                            for (ib, wb) in &ps.w[a..] {
-                                let d = dot(wv[a], *wb);
-                                s[ia * n + ib] -= d;
-                                if ia != ib {
-                                    s[ib * n + ia] -= d;
-                                }
-                            }
-                        }
-                    }
-                };
-                let chunks = rayon::current_num_threads().clamp(1, 8);
-                if n <= 1200 && npts >= 64 && chunks > 1 {
-                    let per = npts.div_ceil(chunks);
-                    let parts: Vec<(Vec<f64>, Vec<f64>)> = (0..chunks)
-                        .into_par_iter()
-                        .map(|t| {
-                            let (mut ds, mut dr) = (vec![0.0; n * n], vec![0.0; n]);
-                            reduce(t * per..((t + 1) * per).min(npts), &mut ds, &mut dr);
-                            (ds, dr)
-                        })
-                        .collect();
-                    for (ds, dr) in parts {
-                        s.par_iter_mut().zip(ds.par_iter()).for_each(|(x, y)| *x += y);
-                        for (x, y) in rhs.iter_mut().zip(dr) {
-                            *x += y;
-                        }
-                    }
-                } else {
-                    reduce(0..npts, &mut s, &mut rhs);
+            let iterative_step = if use_iterative { iterative_schur(&s, &rhs, &systems, &vinv, &l) } else { None };
+            if dbg && use_iterative {
+                eprintln!("ba iterative n={n} pairs={schur_pairs} solved={}", iterative_step.is_some());
+            }
+            if use_iterative && iterative_step.is_none() {
+                use_iterative = false;
+            }
+            let dc = if let Some(dc) = iterative_step {
+                dc
+            } else {
+                if !o.fix_points {
+                    reduce_points(&systems, &vinv, n, &mut s, &mut rhs);
                 }
-            }
-            let mut dc = rhs;
-            if n > 0 && !cholesky_solve(&mut s, n, &mut dc) {
-                lambda *= 10.0;
-                continue;
-            }
+                let mut dc = rhs;
+                if n > 0 && !cholesky_solve(&mut s, n, &mut dc) {
+                    lambda *= 10.0;
+                    continue;
+                }
+                dc
+            };
             // Apply.
             let mut nc: Vec<BaCam> = cams.to_vec();
             for (i, c) in nc.iter_mut().enumerate() {
@@ -424,7 +666,11 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
                     *x = add(*x, mv(vi, b));
                 });
             }
-            let c2 = cost(&nc, &np, obs, o);
+            if nc.iter().any(|c| !valid_camera(c)) || np.iter().flatten().any(|v| !v.is_finite()) {
+                lambda *= 4.0;
+                continue;
+            }
+            let c2 = validated_cost(&nc, &np, obs, o);
             if c2.is_finite() && c2 < cur {
                 cams.copy_from_slice(&nc);
                 pts.copy_from_slice(&np);
@@ -443,7 +689,7 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
                             t0.elapsed().as_secs_f64()
                         );
                     }
-                    return BaReport { initial_cost: initial, cost: cur, iterations: iters };
+                    return Ok(BaReport { initial_cost: initial, cost: cur, iterations: iters });
                 }
                 break;
             }
@@ -456,13 +702,208 @@ pub fn adjust(cams: &mut [BaCam], pts: &mut [V3], obs: &[BaObs], o: &BaOpts) ->
     if dbg {
         eprintln!("ba n={} pts={} obs={} iters={iters} tries={tries} {:.2}s cost {initial:.1} -> {cur:.1}", l.n, npts, obs.len(), t0.elapsed().as_secs_f64());
     }
-    BaReport { initial_cost: initial, cost: cur, iterations: iters }
+    Ok(BaReport { initial_cost: initial, cost: cur, iterations: iters })
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::camtrack::geometry::Rng;
+    use crate::camtrack::linalg::{I3, log_rot, mt, norm};
+
+    #[test]
+    fn long_track_adjustment_matches_direct_reprojections_and_outliers() {
+        rayon::ThreadPoolBuilder::new().num_threads(1).build().unwrap().install(|| {
+            for (focal, fix_centers, distortion) in
+                [(FocalMode::Fixed, false, false), (FocalMode::Shared, false, true), (FocalMode::PerCamera(30.0), false, true), (FocalMode::Shared, true, true)]
+            {
+                let mut rng = Rng(71);
+                let mut noise = || (rng.next_u64() % 100_000) as f64 / 100_000.0 - 0.5;
+                let truth: Vec<V3> = (0..320).map(|_| [noise() * 8.0, noise() * 5.0, 10.0 + noise() * 5.0]).collect();
+                let true_cams: Vec<_> = (0..60)
+                    .map(|i| BaCam {
+                        pose: Pose {
+                            r: rodrigues([0.001 * i as f64, -0.003 * i as f64, 0.0]),
+                            c: if fix_centers { [0.0; 3] } else { [0.03 * i as f64, 0.01 * (i as f64).sin(), 0.0] },
+                        },
+                        f: if matches!(focal, FocalMode::PerCamera(_)) { 900.0 * (1.0 + 0.05 * (i as f64 * 0.07).sin()) } else { 900.0 },
+                        dist: if distortion { Distortion { k1: 0.015, k2: -0.005, radius: 1100.0 } } else { Distortion::NONE },
+                    })
+                    .collect();
+                let mut obs = Vec::new();
+                for (ci, c) in true_cams.iter().enumerate() {
+                    for (pi, p) in truth.iter().enumerate() {
+                        let mut uv = residual(c, *p, [0.0; 2]).unwrap();
+                        uv[0] += noise() * 0.05;
+                        uv[1] += noise() * 0.05;
+                        if (ci * truth.len() + pi).is_multiple_of(37) {
+                            uv[0] += 25.0;
+                            uv[1] -= 30.0;
+                        }
+                        obs.push(BaObs { cam: ci as u32, pt: pi as u32, uv });
+                    }
+                }
+                let mut cams = true_cams.clone();
+                for c in cams.iter_mut().skip(2) {
+                    c.pose.r = mm(&rodrigues([0.001, -0.001, 0.0005]), &c.pose.r);
+                    if !fix_centers {
+                        c.pose.c = add(c.pose.c, [0.002, -0.003, 0.001]);
+                    }
+                }
+                let mut pts: Vec<_> = truth.iter().map(|p| add(*p, [0.01, -0.01, 0.005])).collect();
+                let (mut direct_cams, mut direct_pts) = (cams.clone(), pts.clone());
+                let opts = BaOpts { focal, fix_centers, distortion, fixed: (0..60).map(|i| i < 2).collect(), max_iter: 10, ..Default::default() };
+                let report = adjust(&mut cams, &mut pts, &obs, &opts).unwrap();
+                let direct = adjust_impl(&mut direct_cams, &mut direct_pts, &obs, &opts, false).unwrap();
+                assert!((report.cost - direct.cost).abs() < 1e-5 * direct.cost.max(1.0));
+                for ob in &obs {
+                    let a = residual(&cams[ob.cam as usize], pts[ob.pt as usize], ob.uv).unwrap();
+                    let b = residual(&direct_cams[ob.cam as usize], direct_pts[ob.pt as usize], ob.uv).unwrap();
+                    assert!((a[0] - b[0]).hypot(a[1] - b[1]) < 0.001);
+                    assert_eq!(a[0].hypot(a[1]) <= 4.0, b[0].hypot(b[1]) <= 4.0);
+                }
+                for (a, b) in cams.iter().zip(direct_cams) {
+                    assert!(norm(sub(a.pose.c, b.pose.c)) < 0.001);
+                    assert!(norm(log_rot(&mm(&a.pose.r, &mt(&b.pose.r)))) < 1e-4);
+                    assert!((a.f - b.f).abs() < 1e-4 * b.f);
+                    assert!((a.dist.k1 - b.dist.k1).abs() < 1e-4 && (a.dist.k2 - b.dist.k2).abs() < 1e-4);
+                }
+            }
+        });
+    }
+
+    #[test]
+    fn matrix_free_schur_matches_explicit_system_and_rejects_bad_preconditioner() {
+        let l = layout(20, &BaOpts::default());
+        let n = l.n;
+        let mut u = vec![0.0; n * n];
+        for i in 0..n {
+            u[i * n + i] = 10.0;
+        }
+        let systems: Vec<_> = (0..80)
+            .map(|j| PtSys {
+                v: I3,
+                bp: [0.01, -0.02, 0.03],
+                w: (0..n).map(|i| (i, [((j * 13 + i * 7) % 19) as f64 * 0.001 - 0.009, (i % 7) as f64 * 0.001, (j % 11) as f64 * 0.001])).collect(),
+            })
+            .collect();
+        let vinv = vec![Some(I3); systems.len()];
+        let rhs: Vec<_> = (0..n).map(|i| (i % 7) as f64 - 3.0).collect();
+        let x = iterative_schur(&u, &rhs, &systems, &vinv, &l).unwrap();
+        let mut explicit = u.clone();
+        let mut reduced_rhs = rhs.clone();
+        for ps in &systems {
+            for (i, a) in &ps.w {
+                reduced_rhs[*i] -= dot(*a, ps.bp);
+                for (j, b) in &ps.w {
+                    explicit[i * n + j] -= dot(*a, *b);
+                }
+            }
+        }
+        let mut direct = reduced_rhs.clone();
+        let mut factor = explicit.clone();
+        assert!(cholesky_solve(&mut factor, n, &mut direct));
+        for (a, b) in x.iter().zip(direct) {
+            assert!((a - b).abs() < 1e-9);
+        }
+        let mut error2 = 0.0;
+        for (i, row) in explicit.chunks_exact(n).enumerate() {
+            let ax: f64 = row.iter().zip(&x).map(|(a, x)| a * x).sum();
+            error2 += (ax - reduced_rhs[i]).powi(2);
+        }
+        assert!(error2 < 1e-18 * reduced_rhs.iter().map(|v| v * v).sum::<f64>());
+        u[0] = -1.0;
+        assert!(iterative_schur(&u, &rhs, &systems, &vinv, &l).is_none());
+    }
+
+    fn test_camera() -> BaCam {
+        BaCam { pose: Pose::IDENTITY, f: 900.0, dist: Distortion::NONE }
+    }
+
+    #[test]
+    fn cost_rejects_invalid_observation_indices() {
+        for (cam, pt) in [(1, 0), (0, 1)] {
+            let obs = [BaObs { cam, pt, uv: [0.0; 2] }];
+            assert!(cost(&[test_camera()], &[[0.0, 0.0, 5.0]], &obs, &BaOpts::default()).is_err());
+        }
+    }
+
+    #[test]
+    fn adjust_rejects_invalid_observation_without_mutating_inputs() {
+        for (cam, pt) in [(1, 0), (0, 1)] {
+            let mut cams = [test_camera()];
+            let mut pts = [[0.0, 0.0, 5.0]];
+            let before = (cams, pts);
+            let obs = [BaObs { cam, pt, uv: [0.0; 2] }];
+            assert!(adjust(&mut cams, &mut pts, &obs, &BaOpts::default()).is_err());
+            assert_eq!((cams, pts), before);
+        }
+    }
+
+    #[test]
+    fn residual_rejects_non_finite_inputs_and_projection_overflow() {
+        let cam = test_camera();
+        assert!(residual(&cam, [0.0, 0.0, f64::NAN], [0.0; 2]).is_none());
+        assert!(residual(&cam, [0.0, 0.0, 5.0], [f64::INFINITY, 0.0]).is_none());
+        for bad in [
+            BaCam { f: f64::NAN, ..cam },
+            BaCam { dist: Distortion { k1: f64::INFINITY, ..Distortion::NONE }, ..cam },
+            BaCam { pose: Pose { c: [f64::NAN; 3], ..Pose::IDENTITY }, ..cam },
+            BaCam { pose: Pose { r: [[f64::INFINITY; 3]; 3], ..Pose::IDENTITY }, ..cam },
+        ] {
+            assert!(residual(&bad, [0.0, 0.0, 5.0], [0.0; 2]).is_none());
+        }
+        assert!(residual(&cam, [f64::MAX, 0.0, 1.0], [0.0; 2]).is_none());
+    }
+
+    #[test]
+    fn adjustment_rejects_non_finite_points_observations_and_options() {
+        let cam = test_camera();
+        let pts = [[0.0, 0.0, 5.0]];
+        let obs = [BaObs { cam: 0, pt: 0, uv: [0.0; 2] }];
+        assert!(cost(&[cam], &[[f64::NAN, 0.0, 5.0]], &obs, &BaOpts::default()).is_err());
+        assert!(cost(&[cam], &pts, &[BaObs { uv: [f64::NAN; 2], ..obs[0] }], &BaOpts::default()).is_err());
+        for opts in [
+            BaOpts { huber: f64::NAN, ..Default::default() },
+            BaOpts { huber: 0.0, ..Default::default() },
+            BaOpts { focal: FocalMode::PerCamera(f64::INFINITY), ..Default::default() },
+            BaOpts { max_iter: usize::MAX, ..Default::default() },
+        ] {
+            let mut trial_pts = pts;
+            assert!(adjust(&mut [cam], &mut trial_pts, &obs, &opts).is_err());
+        }
+    }
+
+    #[test]
+    fn matrix_workspace_is_checked_and_bounded_before_allocation() {
+        assert!(matrix_len(usize::MAX, 0, 0).is_err());
+        assert!(matrix_len(1, usize::MAX, 0).is_err());
+        assert!(matrix_len(1, 0, usize::MAX).is_err());
+        let mut cams = vec![test_camera(); 1000];
+        assert!(adjust(&mut cams, &mut [], &[], &BaOpts::default()).is_err());
+        assert!(matrix_len(6, 1000, 1000).is_ok());
+        assert!(matrix_len(955, 900, 160 * 900).is_ok());
+    }
+
+    #[test]
+    fn camera_jacobian_keeps_extra_parameters_and_resets() {
+        let mut jac = CameraJacobian::new();
+        let count = MAX_CAMERA_JACOBIAN_ENTRIES + 3;
+        for i in 0..count {
+            jac.push((i, [i as f64, -(i as f64)]));
+        }
+        assert_eq!(jac.as_slice().iter().count(), count);
+        for (i, entry) in jac.as_slice().iter().enumerate() {
+            assert_eq!(*entry, (i, [i as f64, -(i as f64)]));
+        }
+        jac.clear();
+        assert_eq!(jac.as_slice().iter().count(), 0);
+        for i in 0..MAX_CAMERA_JACOBIAN_ENTRIES {
+            jac.push((i, [1.0, 2.0]));
+        }
+        assert_eq!(jac.as_slice().iter().count(), MAX_CAMERA_JACOBIAN_ENTRIES);
+        assert!(jac.overflow.is_empty());
+    }
 
     #[test]
     fn bundle_adjustment_converges_from_noise() {
@@ -493,7 +934,7 @@ mod tests {
         let mut fixed = vec![false; 6];
         fixed[0] = true;
         fixed[1] = true;
-        let rep = adjust(&mut cams, &mut pts, &obs, &BaOpts { fixed, max_iter: 50, ..Default::default() });
+        let rep = adjust(&mut cams, &mut pts, &obs, &BaOpts { fixed, max_iter: 50, ..Default::default() }).unwrap();
         let rms = (rep.cost / obs.len() as f64).sqrt();
         assert!(rms < 1e-4, "{rep:?}");
     }
diff --git a/crates/track/src/camtrack/features.rs b/crates/track/src/camtrack/features.rs
index 1775a304f..246febda4 100644
--- a/crates/track/src/camtrack/features.rs
+++ b/crates/track/src/camtrack/features.rs
@@ -61,15 +61,24 @@ impl TrackAnalyzer {
 
     /// Analyse the next frame.
     pub fn push(&mut self, frame: &Frame) {
-        let (max_side, want) = self.params();
+        let (max_side, _) = self.params();
         let factor = analysis_factor(frame.img.width, frame.img.height, max_side);
-        self.factor = factor as f64;
         let pyr = GrayPyramid::from_image(frame.img, frame.offset, factor, 4);
+        let prev = self.prev.take();
+        self.push_pyramid(prev.as_ref(), &pyr);
+        self.prev = Some(pyr);
+    }
+
+    /// Track using caller-owned consecutive pyramids. The caller retains the full pyramid
+    /// for the next frame; standalone camera analysis uses the same path through `push`.
+    pub(crate) fn push_pyramid(&mut self, prev: Option<&GrayPyramid>, pyr: &GrayPyramid) {
+        let (_, want) = self.params();
+        self.factor = pyr.factor;
         let k = self.frame;
-        match &self.prev {
+        match prev {
             Some(prev) if prev.width() == pyr.width() && prev.height() == pyr.height() && prev.offset == pyr.offset => {
                 let pts: Vec<[f64; 2]> = self.active.iter().map(|a| a.1).collect();
-                let q = track(prev, &pyr, &pts, None, &LkOpts { radius: 6, iterations: 30, epsilon: 0.005, fb_max: 0.5, ..Default::default() });
+                let q = track(prev, pyr, &pts, None, &LkOpts { radius: 6, iterations: 30, epsilon: 0.005, fb_max: 0.5, ..Default::default() });
                 let mut next = Vec::with_capacity(self.active.len());
                 for ((ti, _), q) in self.active.iter().zip(q) {
                     if let Some(q) = q {
@@ -101,14 +110,13 @@ impl TrackAnalyzer {
                 !occ.get(cy * gw + cx).copied().unwrap_or(true)
             };
             let opts = CornerOpts { max_features: want - self.active.len().min(want), min_distance: md, quality: 0.001, window: 2, border: 8 };
-            for p in good_features(&pyr, &opts, Some(&free)) {
+            for p in good_features(pyr, &opts, Some(&free)) {
                 let l = pyr.to_layer(p);
                 let id = self.tracks.len() as u32;
                 self.tracks.push(Track2D { id, start: k, pts: vec![[l[0] as f32, l[1] as f32]] });
                 self.active.push((id as usize, p));
             }
         }
-        self.prev = Some(pyr);
         self.frame += 1;
     }
 
diff --git a/crates/track/src/camtrack/geometry.rs b/crates/track/src/camtrack/geometry.rs
index 6956ac2b5..3ce32a397 100644
--- a/crates/track/src/camtrack/geometry.rs
+++ b/crates/track/src/camtrack/geometry.rs
@@ -5,7 +5,10 @@
 //! All image points here are **normalised** (calibrated) coordinates `x = (u − c) / f`.
 //! A camera is `(R, C)` with `X_cam = R (X − C)`.
 
-use super::linalg::*;
+use super::linalg::{
+    I3, M3, V3, add, col, cross, det3, dot, from_cols, madd, mm, mscale, mt, mtv, mv, nearest_rotation, normalize, null_vector, outer, scale, sub, svd3,
+    sym_eigen,
+};
 
 /// A deterministic xorshift generator for RANSAC samples.
 pub struct Rng(pub u64);
@@ -204,8 +207,8 @@ pub fn triangulate(views: &[(Pose, [f64; 2])]) -> Option<V3> {
     for (p, x) in views {
         let t = p.t();
         let rows = [[p.r[0][0], p.r[0][1], p.r[0][2], t[0]], [p.r[1][0], p.r[1][1], p.r[1][2], t[1]], [p.r[2][0], p.r[2][1], p.r[2][2], t[2]]];
-        let a0: Vec<f64> = (0..4).map(|j| x[0] * rows[2][j] - rows[0][j]).collect();
-        let a1: Vec<f64> = (0..4).map(|j| x[1] * rows[2][j] - rows[1][j]).collect();
+        let a0 = [0, 1, 2, 3].map(|j| x[0] * rows[2][j] - rows[0][j]);
+        let a1 = [0, 1, 2, 3].map(|j| x[1] * rows[2][j] - rows[1][j]);
         for a in [a0, a1] {
             let nrm = a.iter().map(|v| v * v).sum::<f64>().sqrt().max(1e-300);
             for i in 0..4 {
@@ -244,6 +247,9 @@ pub fn reproj2(pose: &Pose, x: V3, o: [f64; 2]) -> Option<f64> {
 /// Pick the essential decomposition with the most points in front of both cameras; returns
 /// the second camera (the first is the identity) and that count.
 pub fn select_pose(cands: &[(M3, V3)], x1: &[[f64; 2]], x2: &[[f64; 2]]) -> Option<(Pose, usize)> {
+    if x1.len() != x2.len() || x1.is_empty() || x1.iter().chain(x2).flatten().any(|v| !v.is_finite()) {
+        return None;
+    }
     let mut best: Option<(Pose, usize)> = None;
     for (r, t) in cands {
         let p2 = Pose::from_rt(*r, *t);
@@ -361,6 +367,7 @@ pub fn procrustes(a: &[V3], b: &[V3]) -> Option<M3> {
 
 #[cfg(test)]
 mod tests {
+    use super::super::linalg::{log_rot, norm, rodrigues};
     use super::*;
 
     fn scene() -> (Vec<V3>, Pose) {
@@ -380,6 +387,14 @@ mod tests {
         [c[0] / c[2], c[1] / c[2]]
     }
 
+    #[test]
+    fn pose_selection_rejects_mismatched_or_non_finite_correspondences() {
+        let candidates = [(I3, [0.1, 0.0, 0.0])];
+        assert!(select_pose(&candidates, &[[0.0; 2]], &[]).is_none());
+        assert!(select_pose(&candidates, &[], &[[0.0; 2]]).is_none());
+        assert!(select_pose(&candidates, &[[f64::NAN, 0.0]], &[[0.0; 2]]).is_none());
+    }
+
     #[test]
     fn essential_recovers_relative_pose() {
         let (pts, p2) = scene();
diff --git a/crates/track/src/camtrack/linalg.rs b/crates/track/src/camtrack/linalg.rs
index 2efc14556..0e5ff8982 100644
--- a/crates/track/src/camtrack/linalg.rs
+++ b/crates/track/src/camtrack/linalg.rs
@@ -145,6 +145,33 @@ pub fn slerp(a: &M3, b: &M3, t: f64) -> M3 {
 /// `max(m, n) × n` (rows beyond `m` belong to zero padding), `s` is sorted descending and `V`
 /// is `n × n` (columns are the right singular vectors).
 pub fn svd(a: &[f64], m: usize, n: usize) -> (Vec<f64>, Vec<f64>, Vec<f64>) {
+    let rows = m.max(n);
+    let (mut u, mut s, v) = jacobi_factors(a, m, n);
+    for (j, sj) in s.iter().enumerate() {
+        if *sj > 1e-300 {
+            for r in 0..rows {
+                u[r * n + j] /= sj;
+            }
+        }
+    }
+    // Sort descending.
+    let mut order: Vec<usize> = (0..n).collect();
+    order.sort_by(|&a, &b| s[b].total_cmp(&s[a]));
+    let (mut u2, mut v2) = (vec![0.0; rows * n], vec![0.0; n * n]);
+    for (k, &j) in order.iter().enumerate() {
+        for r in 0..rows {
+            u2[r * n + k] = u[r * n + j];
+        }
+        for r in 0..n {
+            v2[r * n + k] = v[r * n + j];
+        }
+    }
+    s = order.iter().map(|&j| s[j]).collect();
+    (u2, s, v2)
+}
+
+// Unnormalised and unsorted factors; full SVD and null-space queries share every sweep.
+fn jacobi_factors(a: &[f64], m: usize, n: usize) -> (Vec<f64>, Vec<f64>, Vec<f64>) {
     let rows = m.max(n);
     let mut u = vec![0.0; rows * n];
     u[..m * n].copy_from_slice(&a[..m * n]);
@@ -192,28 +219,8 @@ pub fn svd(a: &[f64], m: usize, n: usize) -> (Vec<f64>, Vec<f64>, Vec<f64>) {
             break;
         }
     }
-    let mut s: Vec<f64> = (0..n).map(|j| (0..rows).map(|r| u[r * n + j] * u[r * n + j]).sum::<f64>().sqrt()).collect();
-    for (j, sj) in s.iter().enumerate() {
-        if *sj > 1e-300 {
-            for r in 0..rows {
-                u[r * n + j] /= sj;
-            }
-        }
-    }
-    // Sort descending.
-    let mut order: Vec<usize> = (0..n).collect();
-    order.sort_by(|&a, &b| s[b].total_cmp(&s[a]));
-    let (mut u2, mut v2) = (vec![0.0; rows * n], vec![0.0; n * n]);
-    for (k, &j) in order.iter().enumerate() {
-        for r in 0..rows {
-            u2[r * n + k] = u[r * n + j];
-        }
-        for r in 0..n {
-            v2[r * n + k] = v[r * n + j];
-        }
-    }
-    s = order.iter().map(|&j| s[j]).collect();
-    (u2, s, v2)
+    let s: Vec<f64> = (0..n).map(|j| (0..rows).map(|r| u[r * n + j] * u[r * n + j]).sum::<f64>().sqrt()).collect();
+    (u, s, v)
 }
 
 /// SVD of a 3 × 3 matrix: (U, singular values descending, V) with `m = U diag(s) Vᵀ`.
@@ -235,8 +242,10 @@ pub fn svd3(m: &M3) -> (M3, V3, M3) {
 /// The unit vector `x` minimising `|A x|` (`m × n` row-major): the right singular vector of
 /// the smallest singular value.
 pub fn null_vector(a: &[f64], m: usize, n: usize) -> Vec<f64> {
-    let (_, _, v) = svd(a, m, n);
-    (0..n).map(|r| v[r * n + n - 1]).collect()
+    let (_, s, v) = jacobi_factors(a, m, n);
+    // The full SVD uses a stable descending sort: the last of equal minima wins.
+    let smallest = (0..n).min_by(|&i, &j| s[i].total_cmp(&s[j]).then_with(|| j.cmp(&i))).unwrap_or(0);
+    (0..n).map(|r| v[r * n + smallest]).collect()
 }
 
 /// Eigen-decomposition of a symmetric `n × n` matrix (cyclic Jacobi): eigenvalues ascending
@@ -317,9 +326,29 @@ fn dot_n(a: &[f64], b: &[f64]) -> f64 {
 /// Solve `A x = b` for a symmetric positive definite `A` (`n × n`, row-major) in place by
 /// Cholesky factorisation. Returns false when `A` is not positive definite.
 pub fn cholesky_solve(a: &mut [f64], n: usize, b: &mut [f64]) -> bool {
+    if n.checked_mul(n) != Some(a.len()) || b.len() != n {
+        return false;
+    }
+    let mut band = n.saturating_sub(1);
+    if b.iter().all(|v| v.is_finite()) {
+        band = 0;
+        'bandwidth: for i in (0..n).rev() {
+            for j in 0..i.saturating_sub(band) {
+                if a[i * n + j] != 0.0 {
+                    band = i - j;
+                    // Wide systems (including shared global parameters) use the dense path.
+                    if band >= n / 2 {
+                        band = n.saturating_sub(1);
+                        break 'bandwidth;
+                    }
+                    break;
+                }
+            }
+        }
+    }
     for j in 0..n {
         let mut d = a[j * n + j];
-        for k in 0..j {
+        for k in j.saturating_sub(band)..j {
             d -= a[j * n + k] * a[j * n + k];
         }
         if d <= 0.0 || !d.is_finite() {
@@ -330,14 +359,24 @@ pub fn cholesky_solve(a: &mut [f64], n: usize, b: &mut [f64]) -> bool {
         let (head, tail) = a.split_at_mut((j + 1) * n);
         let rowj = &head[j * n..j * n + j];
         // Rows below j (sequential: per-column parallel dispatch costs more than it saves).
-        for row in tail.chunks_mut(n) {
-            row[j] = (row[j] - dot_n(&row[..j], rowj)) / d;
+        for (off, row) in tail.chunks_mut(n).take(band).enumerate() {
+            // Removing full groups of four zero products preserves dot_n's lane order.
+            let start = (j + 1 + off).saturating_sub(band) / 4 * 4;
+            row[j] = (row[j] - dot_n(&row[start..j], &rowj[start..])) / d;
         }
     }
     // Forward: L y = b.
     for i in 0..n {
         let mut s = b[i];
-        for k in 0..i {
+        let start = i.saturating_sub(band);
+        // Subtracting signed-zero products can change -0.0 to +0.0. Preserve those
+        // operations when the accumulator is zero; nonzero values are unaffected.
+        if s == 0.0 {
+            for k in 0..start {
+                s -= a[i * n + k] * b[k];
+            }
+        }
+        for k in start..i {
             s -= a[i * n + k] * b[k];
         }
         b[i] = s / a[i * n + i];
@@ -345,14 +384,74 @@ pub fn cholesky_solve(a: &mut [f64], n: usize, b: &mut [f64]) -> bool {
     // Back: Lᵀ x = y.
     for i in (0..n).rev() {
         let mut s = b[i];
-        for k in i + 1..n {
+        let end = i.saturating_add(band).saturating_add(1).min(n);
+        for k in i + 1..end {
             s -= a[k * n + i] * b[k];
         }
+        if s == 0.0 {
+            for k in end..n {
+                s -= a[k * n + i] * b[k];
+            }
+        }
         b[i] = s / a[i * n + i];
     }
     b.iter().all(|v| v.is_finite())
 }
 
+/// Preconditioned conjugate gradients with an independently recomputed residual check.
+/// Failure to converge (or non-finite/non-positive curvature) requests the direct fallback.
+pub(crate) fn conjugate_gradient(rhs: &[f64], apply: impl Fn(&[f64], &mut [f64]), precondition: impl Fn(&[f64], &mut [f64])) -> Option<Vec<f64>> {
+    let n = rhs.len();
+    let norm2 = dot_n(rhs, rhs);
+    if !norm2.is_finite() {
+        return None;
+    }
+    if rhs.iter().all(|v| *v == 0.0) {
+        return Some(vec![0.0; n]);
+    }
+    let tolerance2 = norm2 * 1e-22;
+    if tolerance2 == 0.0 {
+        return None;
+    }
+    let mut x = vec![0.0; n];
+    let mut r = rhs.to_vec();
+    let mut z = vec![0.0; n];
+    let mut ap = vec![0.0; n];
+    precondition(&r, &mut z);
+    let mut p = z.clone();
+    let mut rz = dot_n(&r, &z);
+    for _ in 0..n.saturating_mul(2).min(512) {
+        if !rz.is_finite() || rz <= 0.0 {
+            return None;
+        }
+        apply(&p, &mut ap);
+        let curvature = dot_n(&p, &ap);
+        if !curvature.is_finite() || curvature <= 0.0 {
+            return None;
+        }
+        let alpha = rz / curvature;
+        for i in 0..n {
+            x[i] += alpha * p[i];
+            r[i] -= alpha * ap[i];
+        }
+        if dot_n(&r, &r) <= tolerance2 {
+            apply(&x, &mut ap);
+            for i in 0..n {
+                ap[i] = rhs[i] - ap[i];
+            }
+            return (x.iter().all(|v| v.is_finite()) && dot_n(&ap, &ap) <= 100.0 * tolerance2).then_some(x);
+        }
+        precondition(&r, &mut z);
+        let next_rz = dot_n(&r, &z);
+        let beta = next_rz / rz;
+        for i in 0..n {
+            p[i] = z[i] + beta * p[i];
+        }
+        rz = next_rz;
+    }
+    None
+}
+
 /// A similarity transform `x ↦ s R x + t`.
 #[derive(Clone, Copy, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
 pub struct Similarity {
@@ -404,16 +503,16 @@ pub fn umeyama(src: &[V3], dst: &[V3]) -> Option<Similarity> {
     Some(Similarity { s, r, t })
 }
 
-/// Euler angles (degrees) `[x, y, z]` with `m = Rz(z) Ry(y) Rx(x)` (After Effects' Orientation
-/// order: X, then Y, then Z applied to the vector).
+/// Euler angles (degrees) `[x, y, z]` with `m = Rx(x) Ry(y) Rz(z)`: After Effects' Orientation
+/// order (Z is applied to the vector first, then Y, then X; see `effectcraft_geom::Mat4::orientation`).
 pub fn euler_xyz(m: &M3) -> V3 {
-    let sy = (-m[2][0]).clamp(-1.0, 1.0);
+    let sy = m[0][2].clamp(-1.0, 1.0);
     let y = sy.asin();
-    let (x, z) = if sy.abs() < 0.999_999 { (m[2][1].atan2(m[2][2]), m[1][0].atan2(m[0][0])) } else { ((-m[1][2]).atan2(m[1][1]), 0.0) };
+    let (x, z) = if sy.abs() < 0.999_999 { ((-m[1][2]).atan2(m[2][2]), (-m[0][1]).atan2(m[0][0])) } else { (m[2][1].atan2(m[1][1]), 0.0) };
     [x.to_degrees(), y.to_degrees(), z.to_degrees()]
 }
 
-/// `Rz(z) Ry(y) Rx(x)` from degrees.
+/// `Rx(x) Ry(y) Rz(z)` from degrees.
 pub fn from_euler_xyz(e: V3) -> M3 {
     let (sx, cx) = e[0].to_radians().sin_cos();
     let (sy, cy) = e[1].to_radians().sin_cos();
@@ -421,13 +520,150 @@ pub fn from_euler_xyz(e: V3) -> M3 {
     let rx = [[1.0, 0.0, 0.0], [0.0, cx, -sx], [0.0, sx, cx]];
     let ry = [[cy, 0.0, sy], [0.0, 1.0, 0.0], [-sy, 0.0, cy]];
     let rz = [[cz, -sz, 0.0], [sz, cz, 0.0], [0.0, 0.0, 1.0]];
-    mm(&rz, &mm(&ry, &rx))
+    mm(&rx, &mm(&ry, &rz))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    fn dense_cholesky_reference(a: &mut [f64], n: usize, b: &mut [f64]) -> bool {
+        for j in 0..n {
+            let mut d = a[j * n + j];
+            for k in 0..j {
+                d -= a[j * n + k] * a[j * n + k];
+            }
+            if d <= 0.0 || !d.is_finite() {
+                return false;
+            }
+            let d = d.sqrt();
+            a[j * n + j] = d;
+            let (head, tail) = a.split_at_mut((j + 1) * n);
+            let rowj = &head[j * n..j * n + j];
+            // Rows below j (sequential: per-column parallel dispatch costs more than it saves).
+            for row in tail.chunks_mut(n) {
+                row[j] = (row[j] - dot_n(&row[..j], rowj)) / d;
+            }
+        }
+        // Forward: L y = b.
+        for i in 0..n {
+            let mut s = b[i];
+            for k in 0..i {
+                s -= a[i * n + k] * b[k];
+            }
+            b[i] = s / a[i * n + i];
+        }
+        // Back: Lᵀ x = y.
+        for i in (0..n).rev() {
+            let mut s = b[i];
+            for k in i + 1..n {
+                s -= a[k * n + i] * b[k];
+            }
+            b[i] = s / a[i * n + i];
+        }
+        b.iter().all(|v| v.is_finite())
+    }
+
+    #[test]
+    fn banded_cholesky_is_bit_identical_to_dense() {
+        for n in [1usize, 2, 3, 4, 5, 6, 7, 8, 13, 31, 65, 127] {
+            for width in [0usize, 1, 2, 5, 11, n - 1] {
+                for seed in 0..3 {
+                    for scale in [1.0, 1e-100, 1e100] {
+                        let mut a = vec![0.0; n * n];
+                        for i in 0..n {
+                            for j in 0..i {
+                                let value = if i - j <= width {
+                                    (((i * 13 + j * 17 + seed) % 23) as f64 - 11.0) / 128.0
+                                } else if (i + j) % 2 == 0 {
+                                    -0.0
+                                } else {
+                                    0.0
+                                };
+                                a[i * n + j] = value;
+                                a[j * n + i] = value;
+                            }
+                        }
+                        for i in 0..n {
+                            a[i * n + i] = a[i * n..(i + 1) * n].iter().map(|v| v.abs()).sum::<f64>() + 1.0;
+                        }
+                        for value in &mut a {
+                            *value *= scale;
+                        }
+                        let mut rhs: Vec<f64> = (0..n).map(|i| if i % 7 == 0 { -0.0 } else { ((i * 5 + seed) % 17) as f64 - 8.0 }).collect();
+                        let (mut reference_a, mut reference_rhs) = (a.clone(), rhs.clone());
+                        assert!(dense_cholesky_reference(&mut reference_a, n, &mut reference_rhs));
+                        assert!(cholesky_solve(&mut a, n, &mut rhs));
+                        assert_eq!(
+                            rhs.iter().map(|v| v.to_bits()).collect::<Vec<_>>(),
+                            reference_rhs.iter().map(|v| v.to_bits()).collect::<Vec<_>>(),
+                            "n={n} width={width} seed={seed} scale={scale}"
+                        );
+                        assert_eq!(
+                            a.iter().map(|v| v.to_bits()).collect::<Vec<_>>(),
+                            reference_a.iter().map(|v| v.to_bits()).collect::<Vec<_>>(),
+                            "factor n={n} width={width}"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn banded_cholesky_preserves_underflow_and_signed_zero() {
+        let n = 8;
+        let mut a = vec![0.0; n * n];
+        for i in 0..n {
+            for j in 0..n {
+                a[i * n + j] = if i == j {
+                    1e300
+                } else if (i + j) % 2 == 0 {
+                    -0.0
+                } else {
+                    0.0
+                };
+            }
+        }
+        let mut rhs = vec![-1e-300, 1e-300, -0.0, 0.0, -1e-300, 1e-300, 0.0, -0.0];
+        let (mut original, mut expected) = (a.clone(), rhs.clone());
+        assert!(dense_cholesky_reference(&mut original, n, &mut expected));
+        assert!(cholesky_solve(&mut a, n, &mut rhs));
+        assert_eq!(rhs.iter().map(|v| v.to_bits()).collect::<Vec<_>>(), expected.iter().map(|v| v.to_bits()).collect::<Vec<_>>());
+    }
+
+    #[test]
+    fn cholesky_rejects_invalid_dimensions_without_indexing() {
+        assert!(!cholesky_solve(&mut [], usize::MAX, &mut []));
+        assert!(!cholesky_solve(&mut [1.0], 2, &mut [1.0, 1.0]));
+        assert!(!cholesky_solve(&mut [1.0], 1, &mut []));
+        assert!(cholesky_solve(&mut [], 0, &mut []));
+    }
+
+    #[test]
+    fn conjugate_gradient_checks_residual_and_bad_curvature() {
+        let n = 64;
+        let rhs: Vec<f64> = (0..n).map(|i| (i % 11) as f64 - 5.0).collect();
+        let apply = |x: &[f64], y: &mut [f64]| {
+            for i in 0..n {
+                y[i] = 4.0 * x[i] + if i > 0 { x[i - 1] } else { 0.0 } + if i + 1 < n { x[i + 1] } else { 0.0 };
+            }
+        };
+        let x = conjugate_gradient(&rhs, apply, |r, z| {
+            for (r, z) in r.iter().zip(z) {
+                *z = *r / 4.0;
+            }
+        })
+        .unwrap();
+        let mut product = vec![0.0; n];
+        apply(&x, &mut product);
+        let residual: f64 = rhs.iter().zip(product).map(|(b, ax)| (b - ax).powi(2)).sum();
+        assert!(residual < 1e-18 * dot_n(&rhs, &rhs));
+        assert!(conjugate_gradient(&[1.0], |x, y| y[0] = -x[0], |r, z| z.copy_from_slice(r)).is_none());
+        assert!(conjugate_gradient(&[f64::NAN], |_, _| {}, |_, _| {}).is_none());
+        assert_eq!(conjugate_gradient(&[0.0], |_, _| {}, |_, _| {}).unwrap(), vec![0.0]);
+    }
+
     #[test]
     fn svd_reconstructs() {
         let a = [3.0, 1.0, 2.0, -1.0, 4.0, 0.5, 2.0, 2.0, 7.0, 0.1, -3.0, 1.0];
@@ -441,6 +677,20 @@ mod tests {
         assert!(s[0] >= s[1] && s[1] >= s[2]);
     }
 
+    #[test]
+    fn null_vector_matches_full_svd_bits_including_ties() {
+        for (m, n) in [(0, 0), (1, 1), (3, 3), (8, 9), (9, 9), (20, 3), (100, 9)] {
+            for scale in [0.0, 1e-100, 1.0, 1e100] {
+                let a: Vec<f64> = (0..m * n).map(|i| (((i * 37) % 31) as f64 - 15.0) * scale).collect();
+                let (_, _, v) = svd(&a, m, n);
+                let expected: Vec<_> = (0..n).map(|r| v[r * n + n - 1].to_bits()).collect();
+                assert_eq!(null_vector(&a, m, n).iter().map(|v| v.to_bits()).collect::<Vec<_>>(), expected);
+            }
+        }
+        let a = [1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0];
+        assert_eq!(null_vector(&a, 3, 3), vec![0.0, 0.0, 1.0]);
+    }
+
     #[test]
     fn rotations_round_trip() {
         let w = [0.3, -1.2, 0.7];
diff --git a/crates/track/src/camtrack/solver.rs b/crates/track/src/camtrack/solver.rs
index a4e2c21e6..8e212127b 100644
--- a/crates/track/src/camtrack/solver.rs
+++ b/crates/track/src/camtrack/solver.rs
@@ -7,7 +7,7 @@ use rayon::prelude::*;
 
 use super::bundle::{self, BaCam, BaObs, BaOpts, FocalMode};
 use super::geometry::{self, Pose};
-use super::linalg::*;
+use super::linalg::{V3, add, log_rot, mm, mt, mtv, mv, norm, normalize, rodrigues, scale, slerp, sub, sym_eigen};
 use super::{CameraSolve, CameraTracks, Distortion, ShotType, SolveMethod, SolveSettings, SolvedFrame, SolvedPoint};
 use crate::fit::{Model, ransac};
 
@@ -42,13 +42,54 @@ struct Data {
     noise_bits: std::sync::atomic::AtomicU64,
 }
 
+// Input budgets apply before building the duplicated per-frame/per-track lookup tables.
+const MAX_SOLVE_FRAMES: usize = 100_000;
+const MAX_SOLVE_TRACKS: usize = 200_000;
+const MAX_SOLVE_OBSERVATIONS: usize = 2_000_000;
+
+fn validate_tracks(t: &CameraTracks) -> Result<(), SolveError> {
+    if t.frames as usize > MAX_SOLVE_FRAMES || t.tracks.len() > MAX_SOLVE_TRACKS {
+        return err("camera tracks exceed the supported frame or track count");
+    }
+    if t.size.iter().any(|v| !v.is_finite() || *v <= 0.0)
+        || !t.factor.is_finite()
+        || t.factor < 0.0
+        || !t.start.is_finite()
+        || !t.frame_duration.is_finite()
+        || t.frame_duration <= 0.0
+    {
+        return err("camera tracks have invalid dimensions, timing or analysis scale");
+    }
+    let mut count = 0usize;
+    for tr in &t.tracks {
+        count = count
+            .checked_add(tr.pts.len())
+            .filter(|n| *n <= MAX_SOLVE_OBSERVATIONS)
+            .ok_or_else(|| SolveError("camera tracks exceed the supported observation count".into()))?;
+        let end = u32::try_from(tr.pts.len()).ok().and_then(|n| tr.start.checked_add(n));
+        if end.is_none_or(|end| end > t.frames) {
+            return err("camera track extends beyond the clip's frame range");
+        }
+        if tr.pts.iter().flatten().any(|v| !v.is_finite()) {
+            return err("camera track positions must be finite");
+        }
+    }
+    Ok(())
+}
+
 impl Data {
-    fn new(t: &CameraTracks, deleted: &[u32]) -> Data {
+    fn new(t: &CameraTracks, deleted: &[u32]) -> Result<Data, SolveError> {
+        validate_tracks(t)?;
+        if deleted.len() > MAX_SOLVE_TRACKS {
+            return err("too many deleted camera track ids");
+        }
         let n = t.frames as usize;
         let c = [t.size[0] * 0.5, t.size[1] * 0.5];
         let del: HashSet<u32> = deleted.iter().copied().collect();
         let mut tracks = vec![];
-        let mut by_frame = vec![vec![]; n];
+        let mut by_frame = Vec::new();
+        by_frame.try_reserve_exact(n).map_err(|_| SolveError("not enough memory for camera track frames".into()))?;
+        by_frame.resize_with(n, Vec::new);
         for tr in t.tracks.iter().filter(|tr| !del.contains(&tr.id) && tr.pts.len() >= 3) {
             let ti = tracks.len() as u32;
             let pts: Vec<[f64; 2]> = tr.pts.iter().map(|p| [p[0] as f64 - c[0], p[1] as f64 - c[1]]).collect();
@@ -60,7 +101,7 @@ impl Data {
             tracks.push((tr.id, tr.start as usize, pts));
         }
         let noise = (0.5 * t.factor).max(0.5);
-        Data { n, w: t.size[0], tracks, by_frame, noise_bits: std::sync::atomic::AtomicU64::new(noise.to_bits()) }
+        Ok(Data { n, w: t.size[0], tracks, by_frame, noise_bits: std::sync::atomic::AtomicU64::new(noise.to_bits()) })
     }
     fn at(&self, ti: u32, k: usize) -> Option<[f64; 2]> {
         let (_, s, p) = &self.tracks[ti as usize];
@@ -174,10 +215,10 @@ impl Recon {
     }
 
     /// Bundle-adjust the cameras of `frames` (the first stays fixed) and their points.
-    fn adjust(&mut self, d: &Data, frames: &[usize], cfg: &Cfg, focal: FocalMode, iters: usize) -> f64 {
+    fn adjust(&mut self, d: &Data, frames: &[usize], cfg: &Cfg, focal: FocalMode, iters: usize) -> Result<f64, SolveError> {
         let (mut cams, mut pts, obs, ids) = self.observations(d, frames);
         if obs.is_empty() {
-            return f64::INFINITY;
+            return Ok(f64::INFINITY);
         }
         let mut fixed = vec![false; cams.len()];
         fixed[0] = true;
@@ -186,14 +227,14 @@ impl Recon {
             &mut pts,
             &obs,
             &BaOpts { focal, fix_points: false, fix_centers: cfg.kind == Kind::Tripod, fixed, huber: d.huber(), max_iter: iters, distortion: cfg.distortion },
-        );
+        )?;
         for (k, c) in frames.iter().zip(&cams) {
             self.cams.insert(*k, *c);
         }
         for (ti, x) in ids.iter().zip(&pts) {
             self.pts.insert(*ti, *x);
         }
-        rep.cost
+        Ok(rep.cost)
     }
 
     /// Mark observations above the inlier threshold as outliers; drop points left with fewer
@@ -302,8 +343,12 @@ impl Recon {
                 break;
             }
             let mut cams = vec![start];
-            bundle::adjust(&mut cams, &mut pts.clone(), &obs, &opts(d.inlier_thr() * 4.0));
-            bundle::adjust(&mut cams, &mut pts.clone(), &obs, &opts(d.huber()));
+            if bundle::adjust(&mut cams, &mut pts.clone(), &obs, &opts(d.inlier_thr() * 4.0)).is_err() {
+                return false;
+            }
+            if bundle::adjust(&mut cams, &mut pts.clone(), &obs, &opts(d.huber())).is_err() {
+                return false;
+            }
             let inl = obs.iter().filter(|o| bundle::residual(&cams[0], pts[o.pt as usize], o.uv).is_some_and(|r| r[0] * r[0] + r[1] * r[1] <= thr2)).count();
             if best.as_ref().is_none_or(|b| inl > b.0) {
                 best = Some((inl, cams[0]));
@@ -317,7 +362,9 @@ impl Recon {
         let keep: Vec<BaObs> =
             obs.iter().filter(|o| bundle::residual(&cam, pts[o.pt as usize], o.uv).is_some_and(|r| r[0] * r[0] + r[1] * r[1] <= thr2)).copied().collect();
         let mut cams = vec![cam];
-        bundle::adjust(&mut cams, &mut pts.clone(), &keep, &opts(d.huber()));
+        if bundle::adjust(&mut cams, &mut pts.clone(), &keep, &opts(d.huber())).is_err() {
+            return false;
+        }
         for o in &obs {
             let ok = bundle::residual(&cams[0], pts[o.pt as usize], o.uv).is_some_and(|r| r[0] * r[0] + r[1] * r[1] <= thr2);
             if !ok {
@@ -471,10 +518,11 @@ fn grow(d: &Data, kfs: &[usize], j: usize, init: &(Pose, HashMap<u32, V3>), f: f
     r.pts = init.1.clone();
     let inner = |r: &mut Recon, frames: &[usize]| {
         let focal = if cfg.per_frame_f && frames.len() > 2 { FocalMode::PerCamera(F_PRIOR) } else { FocalMode::Fixed };
-        r.adjust(d, frames, cfg, focal, 10);
+        r.adjust(d, frames, cfg, focal, 10)?;
         r.reject(d);
+        Ok::<(), SolveError>(())
     };
-    inner(&mut r, &[a, b]);
+    inner(&mut r, &[a, b]).ok()?;
     let order: Vec<usize> = kfs[1..j].iter().chain(&kfs[j + 1..]).copied().collect();
     let mut done = 0;
     for k in order {
@@ -491,11 +539,11 @@ fn grow(d: &Data, kfs: &[usize], j: usize, init: &(Pose, HashMap<u32, V3>), f: f
         done += 1;
         let frames: Vec<usize> = r.cams.keys().copied().collect();
         if done % 3 == 0 || frames.len() <= 6 {
-            inner(&mut r, &frames);
+            inner(&mut r, &frames).ok()?;
         }
     }
     let frames: Vec<usize> = r.cams.keys().copied().collect();
-    inner(&mut r, &frames);
+    inner(&mut r, &frames).ok()?;
     (r.cams.len() >= 2 && r.pts.len() >= 8).then_some(r)
 }
 
@@ -531,10 +579,10 @@ fn grow_tripod(d: &Data, kfs: &[usize], f: f64, cfg: &Cfg, cancel: Option<&Atomi
     r.triangulate(d, Kind::Tripod, 0.0, 20.0);
     let frames: Vec<usize> = r.cams.keys().copied().collect();
     let focal = if cfg.per_frame_f && frames.len() > 2 { FocalMode::PerCamera(F_PRIOR) } else { FocalMode::Fixed };
-    r.adjust(d, &frames, cfg, focal, 15);
+    r.adjust(d, &frames, cfg, focal, 15).ok()?;
     r.reject(d);
     r.triangulate(d, Kind::Tripod, 0.0, 1.0);
-    r.adjust(d, &frames, cfg, focal, 15);
+    r.adjust(d, &frames, cfg, focal, 15).ok()?;
     (r.cams.len() >= 2 && r.pts.len() >= 8).then_some(r)
 }
 
@@ -684,7 +732,7 @@ pub fn solve(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBoo
     for pass in 0..2 {
         let und = (pass > 0).then(|| undistorted(tracks, &dist));
         let c = solve_core(und.as_ref().unwrap_or(tracks), s, cancel)?;
-        let d = Data::new(tracks, &s.deleted);
+        let d = Data::new(tracks, &s.deleted)?;
         d.set_noise(c.d.noise());
         let mut r = c.r;
         for cam in r.cams.values_mut() {
@@ -699,10 +747,10 @@ pub fn solve(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBoo
         // The pinhole solve's outliers include the distorted frame edges: start from all
         // observations (the Huber loss keeps real outliers in check), then reject again.
         r.outliers.clear();
-        r.adjust(&d, &frames, &cfg, c.focal, 30);
+        r.adjust(&d, &frames, &cfg, c.focal, 30)?;
         r.outliers.clear();
         r.reject(&d);
-        r.adjust(&d, &frames, &cfg, c.focal, 30);
+        r.adjust(&d, &frames, &cfg, c.focal, 30)?;
         dist = r.cams[&frames[0]].dist;
         for cam in r.cams.values_mut() {
             cam.dist = dist;
@@ -742,7 +790,7 @@ pub fn solve(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBoo
 }
 
 fn solve_core(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBool>) -> Result<Core, SolveError> {
-    let d = Data::new(tracks, &s.deleted);
+    let d = Data::new(tracks, &s.deleted)?;
     if d.n < 2 {
         return err("the clip must be at least two frames long");
     }
@@ -848,7 +896,7 @@ fn solve_core(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBo
     lap("tripod");
     // Keyframes: adjust with the focal length free, reject, re-triangulate, adjust again.
     let kf_frames: Vec<usize> = r.cams.keys().copied().collect();
-    r.adjust(&d, &kf_frames, &cfg, focal, 40);
+    r.adjust(&d, &kf_frames, &cfg, focal, 40)?;
     r.reject(&d);
     // Re-estimate the tracking noise from the inlier residuals (robustly, from their median:
     // for 2D Gaussian noise of deviation σ the median distance is 1.1774 σ), then tighten the
@@ -876,9 +924,9 @@ fn solve_core(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBo
         r.reject(&d);
     }
     r.triangulate(&d, kind, 1.0, 1.0);
-    r.adjust(&d, &kf_frames, &cfg, focal, 40);
+    r.adjust(&d, &kf_frames, &cfg, focal, 40)?;
     r.reject(&d);
-    r.adjust(&d, &kf_frames, &cfg, focal, 20);
+    r.adjust(&d, &kf_frames, &cfg, focal, 20)?;
     if cancelled() {
         return err("cancelled");
     }
@@ -910,7 +958,7 @@ fn solve_core(tracks: &CameraTracks, s: &SolveSettings, cancel: Option<&AtomicBo
     let all: Vec<usize> = r.cams.keys().copied().collect();
     r.reject(&d);
     if all.len() <= 160 {
-        r.adjust(&d, &all, &cfg, focal, 25);
+        r.adjust(&d, &all, &cfg, focal, 25)?;
         r.reject(&d);
     } else {
         // Points only (cameras fixed) would be cheap but the keyframe solution is already
diff --git a/crates/track/src/face.rs b/crates/track/src/face.rs
index 45c7c4baa..708a05c4f 100644
--- a/crates/track/src/face.rs
+++ b/crates/track/src/face.rs
@@ -186,9 +186,16 @@ fn to_layer(c: [f64; 2], b: f64, roll_deg: f64, q: [f64; 2]) -> [f64; 2] {
 
 /// Layer pixels → face frame.
 fn to_face(c: [f64; 2], b: f64, roll_deg: f64, p: [f64; 2]) -> [f64; 2] {
+    face_mapper(c, b, roll_deg)(p)
+}
+
+/// [`to_face`] with the rotation worked out once, for mapping many points.
+fn face_mapper(c: [f64; 2], b: f64, roll_deg: f64) -> impl Fn([f64; 2]) -> [f64; 2] {
     let (sn, cs) = roll_deg.to_radians().sin_cos();
-    let d = [(p[0] - c[0]) / b, (p[1] - c[1]) / b];
-    [cs * d[0] + sn * d[1], -sn * d[0] + cs * d[1]]
+    move |p| {
+        let d = [(p[0] - c[0]) / b, (p[1] - c[1]) / b];
+        [cs * d[0] + sn * d[1], -sn * d[0] + cs * d[1]]
+    }
 }
 
 /// A synthetic face's landmarks in layer pixels.
@@ -547,6 +554,32 @@ fn fit_from_face(face: &Face, topo: &Topology, offset: [f64; 2]) -> Option<FaceF
     Some(FaceFit { landmarks, detected, outline, center, height: b, roll })
 }
 
+/// Find the first skin pixel in successive rings around the predicted center.
+fn nearest_skin(skin: &[bool], size: (usize, usize), center: (usize, usize), radius: i64) -> Option<(usize, usize)> {
+    let (w, h) = size;
+    let (ci, cj) = center;
+    for r in 0..radius {
+        for dj in -r..=r {
+            for di in -r..=r {
+                if di.abs() != r && dj.abs() != r {
+                    continue;
+                }
+                let (i, j) = (ci as i64 + di, cj as i64 + dj);
+                if i >= 0 && j >= 0 && (i as usize) < w && (j as usize) < h && skin[j as usize * w + i as usize] {
+                    return Some((i as usize, j as usize));
+                }
+            }
+        }
+    }
+    None
+}
+
+struct FaceGeometry {
+    center: [f64; 2],
+    height: f64,
+    roll: f64,
+}
+
 /// A pixel window of a frame in layer coordinates.
 struct Window {
     x0: i64,
@@ -578,6 +611,44 @@ impl Window {
     }
 }
 
+/// Per pixel of a `w × h` window: not skin and inside `poly` (even-odd rule, same comparisons as
+/// [`crate::mask::inside_polygon`] at `layer(i, j)`). A scanline crosses the polygon at the same
+/// edges for every pixel of a row, so the crossings are found once per row and each pixel's
+/// parity follows from how many lie right of it.
+fn non_skin_inside(poly: &[[f64; 2]], skin: &[bool], layer: impl Fn(usize, usize) -> [f64; 2], w: usize, h: usize) -> Vec<bool> {
+    let mut feat = vec![false; w * h];
+    let n = poly.len();
+    if n < 3 {
+        return feat;
+    }
+    let mut xs: Vec<f64> = Vec::with_capacity(n);
+    for j in 0..h {
+        let y = layer(0, j)[1];
+        xs.clear();
+        let mut prev = poly[n - 1];
+        for &cur in poly {
+            let (a, b) = (cur, prev);
+            if (a[1] > y) != (b[1] > y) {
+                xs.push((b[0] - a[0]) * (y - a[1]) / (b[1] - a[1]) + a[0]);
+            }
+            prev = cur;
+        }
+        if xs.is_empty() {
+            continue;
+        }
+        xs.sort_by(f64::total_cmp);
+        let mut left = 0;
+        for i in 0..w {
+            let x = layer(i, j)[0];
+            while left < xs.len() && xs[left] <= x {
+                left += 1;
+            }
+            feat[j * w + i] = (xs.len() - left) % 2 == 1 && !skin[j * w + i];
+        }
+    }
+    feat
+}
+
 fn median(v: &mut [f32]) -> f32 {
     v.sort_by(f32::total_cmp);
     v[v.len() / 2]
@@ -752,6 +823,53 @@ impl FaceTracker {
         Some(fit)
     }
 
+    /// Connected dark features inside the fitted face, in normalized face coordinates.
+    fn feature_blobs(&self, frame: &Frame, win: &Window, skin: &[bool], luma: &[f32], outline: &[[f64; 2]], geometry: FaceGeometry) -> Vec<Blob> {
+        let FaceGeometry { center, height: b, roll } = geometry;
+        let (w, h) = (win.w, win.h);
+        // Non-skin components inside the face outline (shrunk a little: anti-aliased edges).
+        let inner: Vec<[f64; 2]> = outline.iter().map(|p| [center[0] + 0.9 * (p[0] - center[0]), center[1] + 0.9 * (p[1] - center[1])]).collect();
+        let feat = non_skin_inside(&inner, skin, |i, j| win.layer(frame, i, j), w, h);
+        let min_area = (0.0006 * b * b).max(2.0) as usize;
+        let mut seen = vec![false; w * h];
+        let mut blobs: Vec<Blob> = vec![];
+        let skin_luma = self.skin.med[0] as f64;
+        let to_face = face_mapper(center, b, roll);
+        for j0 in 0..h {
+            for i0 in 0..w {
+                if !feat[j0 * w + i0] || seen[j0 * w + i0] {
+                    continue;
+                }
+                let mut st = vec![(i0, j0)];
+                seen[j0 * w + i0] = true;
+                let mut pts = vec![];
+                while let Some((i, j)) = st.pop() {
+                    let q = to_face(win.layer(frame, i, j));
+                    pts.push((q, skin_luma - luma[j * w + i] as f64));
+                    for dj in -1i64..=1 {
+                        for di in -1i64..=1 {
+                            let (a, c) = (i as i64 + di, j as i64 + dj);
+                            if a < 0 || c < 0 || a as usize >= w || c as usize >= h {
+                                continue;
+                            }
+                            let (a, c) = (a as usize, c as usize);
+                            if feat[c * w + a] && !seen[c * w + a] {
+                                seen[c * w + a] = true;
+                                st.push((a, c));
+                            }
+                        }
+                    }
+                }
+                if pts.len() >= min_area {
+                    let n = pts.len() as f64;
+                    let centroid = [pts.iter().map(|p| p.0[0]).sum::<f64>() / n, pts.iter().map(|p| p.0[1]).sum::<f64>() / n];
+                    blobs.push(Blob { pts, centroid });
+                }
+            }
+        }
+        blobs
+    }
+
     fn fit(&self, frame: &Frame) -> Option<FaceFit> {
         let pv = &self.prev;
         let b0 = pv.height;
@@ -769,22 +887,7 @@ impl FaceTracker {
         }
         // Seed: the skin pixel nearest the predicted centre.
         let (ci, cj) = win.cell(frame, pv.center)?;
-        let mut seed = None;
-        'search: for r in 0..(0.6 * b0).ceil() as i64 {
-            for dj in -r..=r {
-                for di in -r..=r {
-                    if di.abs() != r && dj.abs() != r {
-                        continue;
-                    }
-                    let (i, j) = (ci as i64 + di, cj as i64 + dj);
-                    if i >= 0 && j >= 0 && (i as usize) < w && (j as usize) < h && skin[j as usize * w + i as usize] {
-                        seed = Some((i as usize, j as usize));
-                        break 'search;
-                    }
-                }
-            }
-        }
-        let (si, sj) = seed?;
+        let (si, sj) = nearest_skin(&skin, (w, h), (ci, cj), (0.6 * b0).ceil() as i64)?;
         // Flood fill (4-connected).
         let mut comp = vec![false; w * h];
         let mut stack = vec![(si, sj)];
@@ -855,52 +958,7 @@ impl FaceTracker {
             roll += 180.0;
         }
         let b = major;
-        // Non-skin components inside the face outline (shrunk a little: anti-aliased edges).
-        let inner: Vec<[f64; 2]> = outline.iter().map(|p| [center[0] + 0.9 * (p[0] - center[0]), center[1] + 0.9 * (p[1] - center[1])]).collect();
-        let mut feat = vec![false; w * h];
-        for j in 0..h {
-            for i in 0..w {
-                if !skin[j * w + i] && crate::mask::inside_polygon(&inner, win.layer(frame, i, j)) {
-                    feat[j * w + i] = true;
-                }
-            }
-        }
-        let min_area = (0.0006 * b * b).max(2.0) as usize;
-        let mut seen = vec![false; w * h];
-        let mut blobs: Vec<Blob> = vec![];
-        let skin_luma = self.skin.med[0] as f64;
-        for j0 in 0..h {
-            for i0 in 0..w {
-                if !feat[j0 * w + i0] || seen[j0 * w + i0] {
-                    continue;
-                }
-                let mut st = vec![(i0, j0)];
-                seen[j0 * w + i0] = true;
-                let mut pts = vec![];
-                while let Some((i, j)) = st.pop() {
-                    let q = to_face(center, b, roll, win.layer(frame, i, j));
-                    pts.push((q, skin_luma - luma[j * w + i] as f64));
-                    for dj in -1i64..=1 {
-                        for di in -1i64..=1 {
-                            let (a, c) = (i as i64 + di, j as i64 + dj);
-                            if a < 0 || c < 0 || a as usize >= w || c as usize >= h {
-                                continue;
-                            }
-                            let (a, c) = (a as usize, c as usize);
-                            if feat[c * w + a] && !seen[c * w + a] {
-                                seen[c * w + a] = true;
-                                st.push((a, c));
-                            }
-                        }
-                    }
-                }
-                if pts.len() >= min_area {
-                    let n = pts.len() as f64;
-                    let centroid = [pts.iter().map(|p| p.0[0]).sum::<f64>() / n, pts.iter().map(|p| p.0[1]).sum::<f64>() / n];
-                    blobs.push(Blob { pts, centroid });
-                }
-            }
-        }
+        let blobs = self.feature_blobs(frame, &win, &skin, &luma, &outline, FaceGeometry { center, height: b, roll });
         // Match components to features near their expected positions.
         let ex = &self.expect;
         let mean_of = |ids: &[usize]| {
@@ -1174,6 +1232,35 @@ mod tests {
         assert!(err < 0.06 * 50.0, "max error {err}");
     }
 
+    #[test]
+    fn row_crossings_match_the_point_in_polygon_test() {
+        let (w, h) = (97, 83);
+        let off = [13.0, 7.0];
+        let layer = |i: usize, j: usize| [(20 + i) as f64 + 0.5 - off[0] + 0.25, (11 + j) as f64 + 0.5 - off[1]];
+        let star: Vec<[f64; 2]> = (0..48)
+            .map(|k| {
+                let a = k as f64 / 48.0 * std::f64::consts::TAU;
+                let r = 30.0 + 9.0 * (5.0 * a).sin() + 3.0 * (k % 3) as f64;
+                [50.0 + a.cos() * r, 40.0 + a.sin() * r * 1.3]
+            })
+            .collect();
+        // Vertices on pixel-centre rows and columns exercise the tie cases.
+        let tied: Vec<[f64; 2]> = vec![[10.0, 5.0], [70.0, 5.0], [70.0, 60.5], [40.0, 30.5], [10.0, 60.5], [10.0, 5.0]];
+        for poly in [star, tied, vec![[1.0, 1.0], [5.0, 5.0]]] {
+            let skin: Vec<bool> = (0..w * h).map(|i| (i * 7 + i / w) % 5 == 0).collect();
+            let got = non_skin_inside(&poly, &skin, layer, w, h);
+            let mut inside = 0;
+            for j in 0..h {
+                for i in 0..w {
+                    let want = !skin[j * w + i] && crate::mask::inside_polygon(&poly, layer(i, j));
+                    assert_eq!(got[j * w + i], want, "({i}, {j})");
+                    inside += want as usize;
+                }
+            }
+            assert!(inside > 0 || poly.len() < 3);
+        }
+    }
+
     #[test]
     fn tracks_a_moving_rotating_synthetic_face() {
         let (w, h) = (320, 240);
diff --git a/crates/track/src/klt.rs b/crates/track/src/klt.rs
index a4566c79a..c947bd4d1 100644
--- a/crates/track/src/klt.rs
+++ b/crates/track/src/klt.rs
@@ -254,6 +254,42 @@ impl Default for LkOpts {
     }
 }
 
+/// Bilinear taps shared by every pixel of a `(2r+1)²` window centred at `c`: the fractional
+/// offset is the same for the whole window, and the column/row indices are clamped like
+/// [`Plane::at`] (edges repeated). Row indices are pre-multiplied by the plane width.
+#[derive(Default)]
+struct Taps {
+    xs: Vec<[usize; 2]>,
+    ys: Vec<[usize; 2]>,
+    t: [f32; 2],
+}
+
+impl Taps {
+    fn set(&mut self, p: &Plane, c: [f64; 2], r: i32) {
+        debug_assert_eq!(p.ch, 1);
+        let (fx, fy) = (c[0] - 0.5, c[1] - 0.5);
+        let (x0, y0) = (fx.floor(), fy.floor());
+        self.t = [(fx - x0) as f32, (fy - y0) as f32];
+        const FAR: f64 = (1u64 << 40) as f64;
+        let (xi, yi) = (x0.clamp(-FAR, FAR) as isize, y0.clamp(-FAR, FAR) as isize);
+        let (wm, hm) = (p.w as isize - 1, p.h as isize - 1);
+        let r = r as isize;
+        self.xs.clear();
+        self.ys.clear();
+        self.xs.extend((-r..=r).map(|d| [(xi + d).clamp(0, wm) as usize, (xi + d + 1).clamp(0, wm) as usize]));
+        self.ys.extend((-r..=r).map(|d| [(yi + d).clamp(0, hm) as usize * p.w, (yi + d + 1).clamp(0, hm) as usize * p.w]));
+    }
+}
+
+/// [`Plane::sample`]'s bilinear form on pre-resolved taps.
+#[inline(always)]
+fn bilerp(d: &[f32], x: [usize; 2], y: [usize; 2], t: [f32; 2]) -> f32 {
+    let (a, b, c, e) = (d[y[0] + x[0]], d[y[0] + x[1]], d[y[1] + x[0]], d[y[1] + x[1]]);
+    let top = a + (b - a) * t[0];
+    let bot = c + (e - c) * t[0];
+    top + (bot - top) * t[1]
+}
+
 fn lk_point(a: &GrayPyramid, b: &GrayPyramid, p: [f64; 2], guess: [f64; 2], o: &LkOpts) -> Option<[f64; 2]> {
     let top = a.levels.len().min(b.levels.len()).checked_sub(1)?;
     let r = o.radius;
@@ -263,7 +299,7 @@ fn lk_point(a: &GrayPyramid, b: &GrayPyramid, p: [f64; 2], guess: [f64; 2], o: &
     let mut win = vec![0.0f32; ((2 * r + 1) * (2 * r + 1)) as usize];
     let mut wgx = win.clone();
     let mut wgy = win.clone();
-    let mut v1 = [0.0f32];
+    let mut taps = Taps::default();
     for l in (0..=top).rev() {
         let s = (1u32 << l) as f64;
         let (ia, ib) = (&a.levels[l], &b.levels[l]);
@@ -274,15 +310,12 @@ fn lk_point(a: &GrayPyramid, b: &GrayPyramid, p: [f64; 2], guess: [f64; 2], o: &
         }
         let (mut gxx, mut gxy, mut gyy) = (0.0f64, 0.0f64, 0.0f64);
         let mut k = 0;
-        for dy in -r..=r {
-            for dx in -r..=r {
-                let (x, y) = (c[0] + dx as f64, c[1] + dy as f64);
-                ia.sample(x, y, &mut v1);
-                win[k] = v1[0];
-                gx.sample(x, y, &mut v1);
-                wgx[k] = v1[0];
-                gy.sample(x, y, &mut v1);
-                wgy[k] = v1[0];
+        taps.set(ia, c, r);
+        for &y in &taps.ys {
+            for &x in &taps.xs {
+                win[k] = bilerp(&ia.data, x, y, taps.t);
+                wgx[k] = bilerp(&gx.data, x, y, taps.t);
+                wgy[k] = bilerp(&gy.data, x, y, taps.t);
                 let (ix, iy) = (wgx[k] as f64, wgy[k] as f64);
                 gxx += ix * ix;
                 gxy += ix * iy;
@@ -300,10 +333,10 @@ fn lk_point(a: &GrayPyramid, b: &GrayPyramid, p: [f64; 2], guess: [f64; 2], o: &
         for _ in 0..o.iterations {
             let (mut bx, mut by) = (0.0f64, 0.0f64);
             let mut k = 0;
-            for dy in -r..=r {
-                for dx in -r..=r {
-                    ib.sample(c[0] + g[0] + v[0] + dx as f64, c[1] + g[1] + v[1] + dy as f64, &mut v1);
-                    let diff = (win[k] - v1[0]) as f64;
+            taps.set(ib, [c[0] + g[0] + v[0], c[1] + g[1] + v[1]], r);
+            for &y in &taps.ys {
+                for &x in &taps.xs {
+                    let diff = (win[k] - bilerp(&ib.data, x, y, taps.t)) as f64;
                     bx += diff * wgx[k] as f64;
                     by += diff * wgy[k] as f64;
                     k += 1;
@@ -397,6 +430,87 @@ mod tests {
         im
     }
 
+    /// The per-pixel `Plane::sample` implementation `lk_point` replaced, kept as the oracle.
+    fn lk_point_ref(a: &GrayPyramid, b: &GrayPyramid, p: [f64; 2], guess: [f64; 2], o: &LkOpts) -> Option<[f64; 2]> {
+        let top = a.levels.len().min(b.levels.len()).checked_sub(1)?;
+        let r = o.radius;
+        let n = ((2 * r + 1) * (2 * r + 1)) as f64;
+        let s0 = (1u32 << top) as f64;
+        let mut g = [guess[0] / s0, guess[1] / s0];
+        let mut win = vec![0.0f32; ((2 * r + 1) * (2 * r + 1)) as usize];
+        let mut wgx = win.clone();
+        let mut wgy = win.clone();
+        let mut v1 = [0.0f32];
+        for l in (0..=top).rev() {
+            let s = (1u32 << l) as f64;
+            let (ia, ib) = (&a.levels[l], &b.levels[l]);
+            let (gx, gy) = &a.grads[l];
+            let c = [p[0] / s, p[1] / s];
+            if c[0] < -1.0 || c[1] < -1.0 || c[0] > ia.w as f64 + 1.0 || c[1] > ia.h as f64 + 1.0 {
+                return None;
+            }
+            let (mut gxx, mut gxy, mut gyy) = (0.0f64, 0.0f64, 0.0f64);
+            let mut k = 0;
+            for dy in -r..=r {
+                for dx in -r..=r {
+                    let (x, y) = (c[0] + dx as f64, c[1] + dy as f64);
+                    ia.sample(x, y, &mut v1);
+                    win[k] = v1[0];
+                    gx.sample(x, y, &mut v1);
+                    wgx[k] = v1[0];
+                    gy.sample(x, y, &mut v1);
+                    wgy[k] = v1[0];
+                    let (ix, iy) = (wgx[k] as f64, wgy[k] as f64);
+                    gxx += ix * ix;
+                    gxy += ix * iy;
+                    gyy += iy * iy;
+                    k += 1;
+                }
+            }
+            let det = gxx * gyy - gxy * gxy;
+            let tr = 0.5 * (gxx + gyy);
+            let mineig = (tr - (0.25 * (gxx - gyy).powi(2) + gxy * gxy).sqrt()) / n;
+            if mineig < o.min_eigen || det.abs() < 1e-18 {
+                return None;
+            }
+            let mut v = [0.0f64; 2];
+            for _ in 0..o.iterations {
+                let (mut bx, mut by) = (0.0f64, 0.0f64);
+                let mut k = 0;
+                for dy in -r..=r {
+                    for dx in -r..=r {
+                        ib.sample(c[0] + g[0] + v[0] + dx as f64, c[1] + g[1] + v[1] + dy as f64, &mut v1);
+                        let diff = (win[k] - v1[0]) as f64;
+                        bx += diff * wgx[k] as f64;
+                        by += diff * wgy[k] as f64;
+                        k += 1;
+                    }
+                }
+                let nx = (gyy * bx - gxy * by) / det;
+                let ny = (gxx * by - gxy * bx) / det;
+                v[0] += nx;
+                v[1] += ny;
+                if !(v[0].is_finite() && v[1].is_finite()) {
+                    return None;
+                }
+                if nx * nx + ny * ny < o.epsilon * o.epsilon {
+                    break;
+                }
+            }
+            if l > 0 {
+                g = [2.0 * (g[0] + v[0]), 2.0 * (g[1] + v[1])];
+            } else {
+                g = [g[0] + v[0], g[1] + v[1]];
+            }
+        }
+        let q = [p[0] + g[0], p[1] + g[1]];
+        let l0 = &b.levels[0];
+        if q[0] < 0.0 || q[1] < 0.0 || q[0] > l0.w as f64 || q[1] > l0.h as f64 {
+            return None;
+        }
+        Some(q)
+    }
+
     #[test]
     fn klt_recovers_a_shift() {
         let a = GrayPyramid::from_image(&img(0.0, 0.0), [0.0; 2], 1, 3);
@@ -411,6 +525,35 @@ mod tests {
         assert!(errs[errs.len() / 2] < 0.1, "median error {}", errs[errs.len() / 2]);
     }
 
+    #[test]
+    fn window_taps_match_per_pixel_sampling_bit_for_bit() {
+        let a = GrayPyramid::from_image(&img(0.0, 0.0), [0.0; 2], 1, 3);
+        let b = GrayPyramid::from_image(&img(6.3, -4.2), [0.0; 2], 1, 3);
+        let mut pts = vec![];
+        for y in (-3..125).step_by(3) {
+            for x in (-3..165).step_by(3) {
+                pts.push([x as f64 + 0.37 * ((x * 7 + y) % 3) as f64, y as f64 + 0.5 * ((x + y * 5) % 2) as f64]);
+            }
+        }
+        pts.extend([[0.0, 0.0], [160.0, 120.0], [80.0, 60.0], [0.5, 0.5], [159.5, 119.5]]);
+        let (mut tracked, mut lost) = (0, 0);
+        for (i, p) in pts.iter().enumerate() {
+            for o in [LkOpts::default(), LkOpts { radius: 3, iterations: 5, ..Default::default() }] {
+                let g = [(i % 5) as f64 - 2.0, (i % 3) as f64 - 1.0];
+                let (new, old) = (lk_point(&a, &b, *p, g, &o), lk_point_ref(&a, &b, *p, g, &o));
+                match (new, old) {
+                    (Some(n), Some(o)) => {
+                        assert_eq!([n[0].to_bits(), n[1].to_bits()], [o[0].to_bits(), o[1].to_bits()], "{p:?}");
+                        tracked += 1;
+                    }
+                    (None, None) => lost += 1,
+                    (n, o) => panic!("{p:?}: {n:?} vs {o:?}"),
+                }
+            }
+        }
+        assert!(tracked > 500 && lost > 0, "{tracked} tracked, {lost} lost");
+    }
+
     #[test]
     fn features_respect_the_region_and_spacing() {
         let a = GrayPyramid::from_image(&img(0.0, 0.0), [0.0; 2], 1, 2);
diff --git a/crates/track/src/lib.rs b/crates/track/src/lib.rs
index fe36bc096..8867bfcb8 100644
--- a/crates/track/src/lib.rs
+++ b/crates/track/src/lib.rs
@@ -201,7 +201,7 @@ fn ncc(plane: &Plane, p: &Patch, c: [f64; 2], a: [f64; 2]) -> f64 {
     }
     let ch = p.ch;
     let (mut s, mut s2, mut st) = (0.0f64, 0.0f64, 0.0f64);
-    let identity = (a[0] - 1.0).abs() < 1e-9 && a[1].abs() < 1e-9;
+    let identity = is_identity(a);
     let fx = c[0] - 0.5;
     let fy = c[1] - 0.5;
     let (bx, by) = (fx.floor(), fy.floor());
@@ -256,12 +256,114 @@ fn ncc(plane: &Plane, p: &Patch, c: [f64; 2], a: [f64; 2]) -> f64 {
     (st / (var * p.ss).sqrt()).clamp(-1.0, 1.0)
 }
 
+fn is_identity(a: [f64; 2]) -> bool {
+    (a[0] - 1.0).abs() < 1e-9 && a[1].abs() < 1e-9
+}
+
+/// The bilinear taps of every template pixel at `c + A u`. Candidates `c + (i, j)` with integer
+/// `(i, j)` give each pixel the same fractional offsets, so one table serves them all and a
+/// candidate is integer-indexed lerps (the arithmetic of `Plane::sample`) with one bounds check.
+struct Taps {
+    /// Offset (in samples) of the top-left tap per template pixel from the one at `base`.
+    off: Vec<isize>,
+    w: Vec<[f32; 2]>,
+    base: isize,
+    /// Tap bounding box (x0, y0, x1, y1) in plane pixels at the reference, `+1` taps included.
+    bb: [isize; 4],
+}
+
+impl Taps {
+    fn new(plane: &Plane, p: &Patch, c: [f64; 2], a: [f64; 2]) -> Option<Taps> {
+        let n = ((2 * p.r[0] + 1) * (2 * p.r[1] + 1)) as usize;
+        let (mut off, mut w) = (Vec::with_capacity(n), Vec::with_capacity(n));
+        let (rx, ry) = ((c[0] - 0.5).floor(), (c[1] - 0.5).floor());
+        if !(rx.abs() < 1e9 && ry.abs() < 1e9) {
+            return None;
+        }
+        let (rx, ry) = (rx as isize, ry as isize);
+        let mut bb = [isize::MAX, isize::MAX, isize::MIN, isize::MIN];
+        for gy in -p.r[1]..=p.r[1] {
+            for gx in -p.r[0]..=p.r[0] {
+                let (ux, uy) = (gx as f64, gy as f64);
+                let fx = c[0] + a[0] * ux - a[1] * uy - 0.5;
+                let fy = c[1] + a[1] * ux + a[0] * uy - 0.5;
+                let (x0, y0) = (fx.floor(), fy.floor());
+                if !(x0.abs() < 1e9 && y0.abs() < 1e9) {
+                    return None;
+                }
+                let (dx, dy) = (x0 as isize - rx, y0 as isize - ry);
+                bb = [bb[0].min(dx), bb[1].min(dy), bb[2].max(dx + 1), bb[3].max(dy + 1)];
+                off.push((dy * plane.w as isize + dx) * plane.ch as isize);
+                w.push([(fx - x0) as f32, (fy - y0) as f32]);
+            }
+        }
+        let base = (ry * plane.w as isize + rx) * plane.ch as isize;
+        Some(Taps { off, w, base, bb: [bb[0] + rx, bb[1] + ry, bb[2] + rx, bb[3] + ry] })
+    }
+
+    /// The correlation at `c + (i, j)`, or `None` when a tap leaves the plane.
+    fn ncc(&self, plane: &Plane, p: &Patch, i: isize, j: isize) -> Option<f64> {
+        if self.bb[0] + i < 0 || self.bb[1] + j < 0 || self.bb[2] + i >= plane.w as isize || self.bb[3] + j >= plane.h as isize {
+            return None;
+        }
+        let ch = p.ch;
+        let row = plane.w * ch;
+        let b = self.base + (j * plane.w as isize + i) * ch as isize;
+        let d = &plane.data;
+        let (mut s, mut s2, mut st) = (0.0f64, 0.0f64, 0.0f64);
+        let mut k = 0;
+        for (o, t) in self.off.iter().zip(&self.w) {
+            let i00 = (b + o) as usize;
+            let (i10, i01) = (i00 + ch, i00 + row);
+            for cc in 0..ch {
+                let top = d[i00 + cc] + (d[i10 + cc] - d[i00 + cc]) * t[0];
+                let bot = d[i01 + cc] + (d[i01 + ch + cc] - d[i01 + cc]) * t[0];
+                let x = (top + (bot - top) * t[1]) as f64;
+                s += x;
+                s2 += x * x;
+                st += x * p.zm[k] as f64;
+                k += 1;
+            }
+        }
+        let n = p.zm.len() as f64;
+        let var = s2 - s * s / n;
+        if var <= 1e-12 {
+            return Some(0.0);
+        }
+        Some((st / (var * p.ss).sqrt()).clamp(-1.0, 1.0))
+    }
+}
+
+/// `ncc` of one template at integer offsets from a reference centre, through a [`Taps`] table
+/// when the shape is not the identity (the identity has its own fast path in `ncc`).
+struct Scorer<'a> {
+    plane: &'a Plane,
+    p: &'a Patch,
+    c: [f64; 2],
+    a: [f64; 2],
+    taps: Option<Taps>,
+}
+
+impl<'a> Scorer<'a> {
+    fn new(plane: &'a Plane, p: &'a Patch, c: [f64; 2], a: [f64; 2]) -> Scorer<'a> {
+        let taps = if is_identity(a) || p.ss <= 1e-12 { None } else { Taps::new(plane, p, c, a) };
+        Scorer { plane, p, c, a, taps }
+    }
+
+    /// The correlation at the reference centre plus `(i, j)` pixels.
+    fn at(&self, i: i32, j: i32) -> f64 {
+        self.taps
+            .as_ref()
+            .and_then(|t| t.ncc(self.plane, self.p, i as isize, j as isize))
+            .unwrap_or_else(|| ncc(self.plane, self.p, [self.c[0] + i as f64, self.c[1] + j as f64], self.a))
+    }
+}
+
 /// The pre-processed pixels around one point: a pyramid of a crop. Plane coordinates are image
 /// pixels minus `origin`, divided by `2^level`.
 struct Crop {
     origin: [f64; 2],
     levels: Vec<Plane>,
-    grad0: (Plane, Plane),
 }
 
 impl Crop {
@@ -280,13 +382,12 @@ impl Crop {
         if opts.enhance {
             p = p.enhance();
         }
-        let grad0 = p.gradients();
         let mut lv = vec![p];
         for _ in 0..levels {
             let d = lv.last().map(Plane::downsample).unwrap_or_default();
             lv.push(d);
         }
-        Crop { origin: [x0, y0], levels: lv, grad0 }
+        Crop { origin: [x0, y0], levels: lv }
     }
     fn to_level(&self, p: [f64; 2], k: usize) -> [f64; 2] {
         let s = (1u32 << k) as f64;
@@ -298,6 +399,12 @@ impl Crop {
     }
 }
 
+/// Largest distance (in top-level pixels, per axis) between the best coarse match and the
+/// motion prediction for which the fine stage searches only ±1 pixel per level.
+const SMALL_MOTION: f64 = 1.0;
+/// Lowest coarse NCC score of the best match for which the fine stage may search only ±1.
+const RELIABLE_SCORE: f64 = 0.8;
+
 /// Per-point tracking state.
 #[derive(Clone, Debug)]
 struct PointState {
@@ -372,13 +479,15 @@ impl PointState {
         let (rx, ry) = ((range[0] / s).ceil() as i32, (range[1] / s).ceil() as i32);
         let plane = &crop.levels[top];
         let tpl = &self.templates[top];
+        let scorer = Scorer::new(plane, tpl, ctop, self.shape);
         let shape = self.shape;
         let mut cands: Vec<(f64, [f64; 2])> = (-ry..=ry)
             .into_par_iter()
             .flat_map_iter(|j| {
+                let scorer = &scorer;
                 (-rx..=rx).map(move |i| {
                     let c = [ctop[0] + i as f64, ctop[1] + j as f64];
-                    (ncc(plane, tpl, c, shape), c)
+                    (scorer.at(i, j), c)
                 })
             })
             .collect();
@@ -396,7 +505,10 @@ impl PointState {
                 break;
             }
         }
-        // Fine: refine each seed down the pyramid in a 5 × 5 neighbourhood.
+        // Fine: refine each seed down the pyramid. A good motion prediction plus a reliable coarse
+        // match only needs a 3 × 3 neighbourhood per level; otherwise keep 5 × 5.
+        let near = cands[0].0 >= RELIABLE_SCORE && seeds.first().is_some_and(|c| (c[0] - cp[0]).abs() <= SMALL_MOTION && (c[1] - cp[1]).abs() <= SMALL_MOTION);
+        let rr: i32 = if near { 1 } else { 2 };
         let mut best = (f64::MIN, sc);
         for seed in seeds {
             let mut c = seed;
@@ -405,14 +517,15 @@ impl PointState {
                 c = [c[0] * 2.0, c[1] * 2.0];
                 let (pl, tp) = (&crop.levels[k], &self.templates[k]);
                 // Start from the projected match; neighbours must beat it (no drift on ties).
-                let mut lb = (ncc(pl, tp, c, shape), c);
-                for j in -2..=2 {
-                    for i in -2..=2 {
+                let scorer = Scorer::new(pl, tp, c, shape);
+                let mut lb = (scorer.at(0, 0), c);
+                for j in -rr..=rr {
+                    for i in -rr..=rr {
                         if i == 0 && j == 0 {
                             continue;
                         }
                         let q = [c[0] + i as f64, c[1] + j as f64];
-                        let v = ncc(pl, tp, q, shape);
+                        let v = scorer.at(i, j);
                         if v > lb.0 + 1e-9 {
                             lb = (v, q);
                         }
@@ -431,15 +544,16 @@ impl PointState {
         // Sub-pixel (and shape) refinement.
         let (mut c, mut a) = (c0, shape);
         if opts.subpixel {
+            let mut grad = Grad::around(&crop.levels[0], c0, shape, self.templates[0].r);
             let mut ok = false;
             if opts.track_shape
-                && let Some((cr, ar)) = lk_refine(&crop, &self.templates[0], c0, shape, true)
+                && let Some((cr, ar)) = lk_refine(&crop, &mut grad, &self.templates[0], c0, shape, true)
             {
                 (c, a) = (cr, ar);
                 ok = true;
             }
             if !ok {
-                if let Some((cr, _)) = lk_refine(&crop, &self.templates[0], c0, shape, false) {
+                if let Some((cr, _)) = lk_refine(&crop, &mut grad, &self.templates[0], c0, shape, false) {
                     c = cr;
                 } else {
                     c = parabolic(&crop.levels[0], &self.templates[0], c0, shape);
@@ -506,12 +620,52 @@ fn parabolic(plane: &Plane, p: &Patch, c: [f64; 2], a: [f64; 2]) -> [f64; 2] {
     [c[0] + off(f(-1.0, 0.0), f(1.0, 0.0)), c[1] + off(f(0.0, -1.0), f(0.0, 1.0))]
 }
 
+/// Level-0 gradients of a crop, computed only where `lk_refine` reads them: valid on the pixel
+/// rectangle `valid` (x0, y0, x1, y1, inclusive) and zero elsewhere.
+struct Grad {
+    gx: Plane,
+    gy: Plane,
+    valid: [isize; 4],
+}
+
+impl Grad {
+    /// Extra pixels around the first window of taps, for the drift of the refinement. A window that
+    /// still runs out is replaced by the full gradients.
+    const MARGIN: isize = 6;
+
+    fn full(plane: &Plane) -> Grad {
+        let (gx, gy) = plane.gradients();
+        Grad { gx, gy, valid: [isize::MIN, isize::MIN, isize::MAX, isize::MAX] }
+    }
+
+    fn around(plane: &Plane, c: [f64; 2], a: [f64; 2], r: [i32; 2]) -> Grad {
+        let [x0, y0, x1, y1] = Grad::taps(c, a, r);
+        let m = Grad::MARGIN;
+        let clip = |v: isize, hi: usize| v.clamp(0, (hi as isize - 1).max(0)) as usize;
+        let rect = [clip(x0 - m, plane.w), clip(y0 - m, plane.h), clip(x1 + m, plane.w), clip(y1 + m, plane.h)];
+        let (gx, gy) = plane.gradients_in(rect);
+        Grad { gx, gy, valid: rect.map(|v| v as isize) }
+    }
+
+    /// The pixels read by sampling the template window at `c` with shape `a` (bilinear taps).
+    fn taps(c: [f64; 2], a: [f64; 2], r: [i32; 2]) -> [isize; 4] {
+        let ex = (a[0].abs() * r[0] as f64 + a[1].abs() * r[1] as f64) * (1.0 + 1e-9) + 1e-9;
+        let ey = (a[1].abs() * r[0] as f64 + a[0].abs() * r[1] as f64) * (1.0 + 1e-9) + 1e-9;
+        let px = |v: f64| v.clamp(-1e9, 1e9).floor() as isize;
+        [px(c[0] - ex - 0.5), px(c[1] - ey - 0.5), px(c[0] + ex - 0.5) + 1, px(c[1] + ey - 0.5) + 1]
+    }
+
+    fn covers(&self, c: [f64; 2], a: [f64; 2], r: [i32; 2]) -> bool {
+        let t = Grad::taps(c, a, r);
+        t[0] >= self.valid[0] && t[1] >= self.valid[1] && t[2] <= self.valid[2] && t[3] <= self.valid[3]
+    }
+}
+
 /// Forward-additive Lucas–Kanade (Gauss–Newton) alignment of the level-0 template with gain and
 /// bias: minimise Σ (I(c + A u) − g T(u) − b)² over the centre `c` and, with `shape`, the
 /// similarity `A`. Returns `None` when it diverges.
-fn lk_refine(crop: &Crop, p: &Patch, c0: [f64; 2], a0: [f64; 2], shape: bool) -> Option<([f64; 2], [f64; 2])> {
+fn lk_refine(crop: &Crop, grad: &mut Grad, p: &Patch, c0: [f64; 2], a0: [f64; 2], shape: bool) -> Option<([f64; 2], [f64; 2])> {
     let plane = &crop.levels[0];
-    let (gxp, gyp) = &crop.grad0;
     let ch = p.ch;
     let (mut c, mut a) = (c0, a0);
     let mut g = 1.0f64;
@@ -546,6 +700,10 @@ fn lk_refine(crop: &Crop, p: &Patch, c0: [f64; 2], a0: [f64; 2], shape: bool) ->
     let np = if shape { 6 } else { 4 };
     let (mut v, mut vx, mut vy) = ([0.0f32; 3], [0.0f32; 3], [0.0f32; 3]);
     for _ in 0..30 {
+        if !grad.covers(c, a, p.r) {
+            *grad = Grad::full(plane);
+        }
+        let (gxp, gyp) = (&grad.gx, &grad.gy);
         let mut h = [[0.0f64; 6]; 6];
         let mut rhs = [0.0f64; 6];
         let mut k = 0;
diff --git a/crates/track/src/mask.rs b/crates/track/src/mask.rs
index e1e133409..898c80f28 100644
--- a/crates/track/src/mask.rs
+++ b/crates/track/src/mask.rs
@@ -44,6 +44,19 @@ pub fn bounds(p: &[[f64; 2]]) -> [f64; 4] {
     b
 }
 
+/// Crop `img` to `region` (layer pixels), with the layer offset of the crop's origin: the part
+/// of the frame the tracker reads. `None` when the region leaves too little of the frame.
+fn crop_region(img: &Image, off: [f64; 2], region: [f64; 4]) -> Option<(Image, [f64; 2])> {
+    let x0 = (region[0] + off[0]).floor().max(0.0) as i64;
+    let y0 = (region[1] + off[1]).floor().max(0.0) as i64;
+    let x1 = ((region[2] + off[0]).ceil() as i64).min(img.width as i64);
+    let y1 = ((region[3] + off[1]).ceil() as i64).min(img.height as i64);
+    if x1 <= x0 + 8 || y1 <= y0 + 8 {
+        return None;
+    }
+    Some((img.crop(x0, y0, (x1 - x0) as u32, (y1 - y0) as u32), [off[0] - x0 as f64, off[1] - y0 as f64]))
+}
+
 /// Mask tracker state.
 #[derive(Clone, Debug)]
 pub struct MaskTracker {
@@ -52,8 +65,8 @@ pub struct MaskTracker {
     pub outline: Vec<[f64; 2]>,
     /// The last frame-to-frame motion (a constant-velocity guess for the next frame).
     velocity: Homography,
-    prev: Option<Image>,
-    prev_offset: [f64; 2],
+    /// The previous frame cropped to the region the next step reads, with its layer offset.
+    prev: Option<(Image, [f64; 2])>,
     /// Features used on the last step (layer pixels), for display and tests.
     pub last_features: usize,
 }
@@ -72,44 +85,39 @@ pub struct MaskStep {
 impl MaskTracker {
     /// Start on `frame` with the mask `outline` (a closed polyline in layer pixels).
     pub fn new(model: Model, outline: Vec<[f64; 2]>, frame: &Frame) -> MaskTracker {
-        MaskTracker { model, outline, velocity: Homography::IDENTITY, prev: Some(frame.img.clone()), prev_offset: frame.offset, last_features: 0 }
+        let mut t = MaskTracker { model, outline, velocity: Homography::IDENTITY, prev: None, last_features: 0 };
+        t.prev = t.region().and_then(|r| crop_region(frame.img, frame.offset, r));
+        t
+    }
+
+    /// Crop region (layer pixels) of the next step: the mask plus room for its motion.
+    fn region(&self) -> Option<[f64; 4]> {
+        let b = bounds(&self.outline);
+        if !(b[0].is_finite() && b[2] > b[0] && b[3] > b[1]) {
+            return None;
+        }
+        let margin = (0.35 * (b[2] - b[0]).max(b[3] - b[1])).max(32.0);
+        Some([b[0] - margin, b[1] - margin, b[2] + margin, b[3] + margin])
     }
 
     /// Track into `frame` (the next frame in either direction). `None` when the mask's pixels
     /// can't be followed (no texture, or the mask left the frame).
     pub fn step(&mut self, frame: &Frame) -> Option<MaskStep> {
-        let prev = self.prev.take()?;
-        let res = self.step_inner(&prev, self.prev_offset, frame);
-        self.prev = Some(frame.img.clone());
-        self.prev_offset = frame.offset;
-        let r = res?;
-        self.outline = self.outline.iter().map(|p| r.motion.apply(*p)).collect();
-        self.velocity = r.motion;
-        Some(r)
+        let (ca, oa) = self.prev.take()?;
+        let res = self.step_inner(ca, oa, frame);
+        if let Some(r) = &res {
+            self.outline = self.outline.iter().map(|p| r.motion.apply(*p)).collect();
+            self.velocity = r.motion;
+        }
+        self.prev = self.region().and_then(|r| crop_region(frame.img, frame.offset, r));
+        res
     }
 
-    fn step_inner(&mut self, prev: &Image, prev_off: [f64; 2], frame: &Frame) -> Option<MaskStep> {
+    fn step_inner(&mut self, ca: Image, oa: [f64; 2], frame: &Frame) -> Option<MaskStep> {
         let b = bounds(&self.outline);
-        if !(b[0].is_finite() && b[2] > b[0] && b[3] > b[1]) {
-            return None;
-        }
         let (bw, bh) = (b[2] - b[0], b[3] - b[1]);
-        // Crop region (layer pixels): the mask plus room for its motion.
-        let margin = (0.35 * bw.max(bh)).max(32.0);
-        let (lx0, ly0, lx1, ly1) = (b[0] - margin, b[1] - margin, b[2] + margin, b[3] + margin);
-        // Both frames share one plane coordinate system: crop in the frames' image pixels.
-        let crop = |img: &Image, off: [f64; 2]| {
-            let x0 = (lx0 + off[0]).floor().max(0.0) as i64;
-            let y0 = (ly0 + off[1]).floor().max(0.0) as i64;
-            let x1 = ((lx1 + off[0]).ceil() as i64).min(img.width as i64);
-            let y1 = ((ly1 + off[1]).ceil() as i64).min(img.height as i64);
-            if x1 <= x0 + 8 || y1 <= y0 + 8 {
-                return None;
-            }
-            Some((img.crop(x0, y0, (x1 - x0) as u32, (y1 - y0) as u32), [off[0] - x0 as f64, off[1] - y0 as f64]))
-        };
-        let (ca, oa) = crop(prev, prev_off)?;
-        let (cb, ob) = crop(frame.img, frame.offset)?;
+        // Both frames share one plane coordinate system: the crops are in image pixels.
+        let (cb, ob) = crop_region(frame.img, frame.offset, self.region()?)?;
         let factor = analysis_factor(ca.width.max(cb.width), ca.height.max(cb.height), 720);
         // Pyramids must share coordinates: use a common origin (layer pixels → plane).
         let levels = 3;
@@ -219,4 +227,20 @@ mod tests {
             assert!(err < 1.5, "frame {f}: max vertex error {err}");
         }
     }
+
+    #[test]
+    fn follows_the_disk_through_a_frame_offset() {
+        let off = [40.0, -25.0];
+        let pose = |f: usize| Homography([[1.0, 0.0, 140.0 + 5.0 * f as f64], [0.0, 1.0, 110.0 - 3.0 * f as f64], [0.0, 0.0, 1.0]]);
+        let ring: Vec<[f64; 2]> = (0..24).map(|i| (i as f64 * 15.0).to_radians()).map(|a| [40.0 * a.cos(), 40.0 * a.sin()]).collect();
+        let layer = |f: usize| -> Vec<[f64; 2]> { ring.iter().map(|p| pose(f).apply(*p)).map(|q| [q[0] - off[0], q[1] - off[1]]).collect() };
+        let f0 = frame(&pose(0));
+        let mut mt = MaskTracker::new(Model::Translation, layer(0), &Frame { img: &f0, offset: off });
+        for f in 1..6 {
+            let img = frame(&pose(f));
+            mt.step(&Frame { img: &img, offset: off }).expect("tracked");
+            let err = mt.outline.iter().zip(&layer(f)).map(|(a, b)| (a[0] - b[0]).hypot(a[1] - b[1])).fold(0.0, f64::max);
+            assert!(err < 1.0, "frame {f}: max vertex error {err}");
+        }
+    }
 }
diff --git a/crates/track/src/plane.rs b/crates/track/src/plane.rs
index bd2d987d6..ff15d08b2 100644
--- a/crates/track/src/plane.rs
+++ b/crates/track/src/plane.rs
@@ -191,15 +191,32 @@ impl Plane {
 
     /// Central-difference gradients `(d/dx, d/dy)`.
     pub fn gradients(&self) -> (Plane, Plane) {
+        self.gradients_in([0, 0, self.w.saturating_sub(1), self.h.saturating_sub(1)])
+    }
+
+    /// The gradients of the pixels in `[x0, y0, x1, y1]` (inclusive, within the plane); all other
+    /// pixels of the returned planes stay zero.
+    pub fn gradients_in(&self, [x0, y0, x1, y1]: [usize; 4]) -> (Plane, Plane) {
         let mut gx = Plane::new(self.w, self.h, self.ch);
         let mut gy = Plane::new(self.w, self.h, self.ch);
-        for y in 0..self.h {
-            for x in 0..self.w {
-                for c in 0..self.ch {
-                    let (xi, yi) = (x as isize, y as isize);
-                    let i = self.idx(x, y) + c;
-                    gx.data[i] = 0.5 * (self.at(xi + 1, yi, c) - self.at(xi - 1, yi, c));
-                    gy.data[i] = 0.5 * (self.at(xi, yi + 1, c) - self.at(xi, yi - 1, c));
+        if self.w == 0 || self.h == 0 {
+            return (gx, gy);
+        }
+        let (ch, row) = (self.ch, self.w * self.ch);
+        for y in y0..=y1.min(self.h - 1) {
+            for x in x0..=x1.min(self.w - 1) {
+                let i = self.idx(x, y);
+                if x > 0 && y > 0 && x + 1 < self.w && y + 1 < self.h {
+                    for c in i..i + ch {
+                        gx.data[c] = 0.5 * (self.data[c + ch] - self.data[c - ch]);
+                        gy.data[c] = 0.5 * (self.data[c + row] - self.data[c - row]);
+                    }
+                } else {
+                    for c in 0..ch {
+                        let (xi, yi) = (x as isize, y as isize);
+                        gx.data[i + c] = 0.5 * (self.at(xi + 1, yi, c) - self.at(xi - 1, yi, c));
+                        gy.data[i + c] = 0.5 * (self.at(xi, yi + 1, c) - self.at(xi, yi - 1, c));
+                    }
                 }
             }
         }
@@ -240,4 +257,27 @@ mod tests {
         assert_eq!(Plane::from_image(&img, Channel::Saturation, 0, 0, 2, 2).data[0], 1.0);
         assert_eq!(Channel::from_name("luminance"), Some(Channel::Luminance));
     }
+
+    #[test]
+    fn gradient_window_and_interior_path_match_the_clamped_definition() {
+        let mut p = Plane::new(11, 9, 3);
+        for (i, v) in p.data.iter_mut().enumerate() {
+            *v = ((i * 7919) % 101) as f32 / 37.0;
+        }
+        let (gx, gy) = p.gradients();
+        let rect = [2, 1, 8, 6];
+        let (wx, wy) = p.gradients_in(rect);
+        for y in 0..p.h {
+            for x in 0..p.w {
+                for c in 0..3 {
+                    let (xi, yi, i) = (x as isize, y as isize, p.idx(x, y) + c);
+                    assert_eq!(gx.data[i].to_bits(), (0.5 * (p.at(xi + 1, yi, c) - p.at(xi - 1, yi, c))).to_bits());
+                    assert_eq!(gy.data[i].to_bits(), (0.5 * (p.at(xi, yi + 1, c) - p.at(xi, yi - 1, c))).to_bits());
+                    let inside = (rect[0]..=rect[2]).contains(&x) && (rect[1]..=rect[3]).contains(&y);
+                    assert_eq!(wx.data[i], if inside { gx.data[i] } else { 0.0 });
+                    assert_eq!(wy.data[i], if inside { gy.data[i] } else { 0.0 });
+                }
+            }
+        }
+    }
 }
diff --git a/crates/track/src/roto/mod.rs b/crates/track/src/roto.rs
similarity index 65%
rename from crates/track/src/roto/mod.rs
rename to crates/track/src/roto.rs
index 4efb43359..3bab65dff 100644
--- a/crates/track/src/roto/mod.rs
+++ b/crates/track/src/roto.rs
@@ -31,6 +31,7 @@
 //! deterministic function of its *chain*: the base frame's strokes, then every frame's strokes
 //! on the way out to it ([`RotoData::chain_keys`]).
 
+pub mod bench;
 pub mod gmm;
 pub mod matting;
 pub mod maxflow;
@@ -87,6 +88,15 @@ pub struct Stroke {
     pub frame: i64,
     pub radius: f64,
     pub points: Vec<[f64; 2]>,
+    /// Which object of the instance the stroke belongs to (0 for the first, and for every older project).
+    /// With a tracker each object is followed on its own and the mattes are combined; the classic engine
+    /// treats all foreground strokes as one object.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub object: u32,
+}
+
+fn is_zero(v: &u32) -> bool {
+    *v == 0
 }
 
 /// A Roto Brush instance's user data: strokes, the base frame and the segmentation span
@@ -129,6 +139,18 @@ impl RotoData {
         v.dedup();
         v
     }
+    /// The objects that have a foreground stroke, in order.
+    pub fn objects(&self) -> Vec<u32> {
+        let mut v: Vec<u32> = self.strokes.iter().filter(|s| s.kind == StrokeKind::Fg).map(|s| s.object).collect();
+        v.sort_unstable();
+        v.dedup();
+        v
+    }
+    /// The strokes of `object` on `frame`: its own foreground, background and box strokes, and the Refine Edge
+    /// strokes (which belong to the whole matte).
+    pub fn strokes_of(&self, frame: i64, object: u32) -> Vec<&Stroke> {
+        self.strokes.iter().filter(|s| s.frame == frame && (s.object == object || matches!(s.kind, StrokeKind::Refine | StrokeKind::RefineErase))).collect()
+    }
     pub fn in_span(&self, f: i64) -> bool {
         self.base.is_some() && f >= self.span[0] && f <= self.span[1]
     }
@@ -223,14 +245,40 @@ pub struct FrameSeg {
 }
 
 impl FrameSeg {
+    /// The union of several objects' segmentations of one frame (the largest keeps its colour models). The
+    /// parts must share one size; any that does not is ignored.
+    pub fn union(parts: Vec<FrameSeg>) -> FrameSeg {
+        let Some(first) = parts.first() else { return FrameSeg::default() };
+        let (w, h) = (first.w, first.h);
+        let mut parts: Vec<FrameSeg> = parts.into_iter().filter(|p| p.w == w && p.h == h && p.matte.len() == w * h).collect();
+        parts.sort_by_key(|p| std::cmp::Reverse(p.area()));
+        let mut it = parts.into_iter();
+        let Some(mut out) = it.next() else { return FrameSeg::default() };
+        for p in it {
+            for (a, b) in out.matte.iter_mut().zip(&p.matte) {
+                *a = (*a).max(*b);
+            }
+            for (a, b) in out.refine.iter_mut().zip(&p.refine) {
+                *a = (*a).max(*b);
+            }
+        }
+        out
+    }
+
     pub fn empty(w: usize, h: usize) -> FrameSeg {
-        FrameSeg { w, h, matte: vec![0; w * h], refine: vec![0; w * h], ..Default::default() }
+        let Some(n) = w.checked_mul(h).filter(|n| *n <= rle::MAX_PLANE_BYTES) else {
+            return FrameSeg::default();
+        };
+        FrameSeg { w, h, matte: vec![0; n], refine: vec![0; n], ..Default::default() }
     }
     pub fn area(&self) -> usize {
         self.matte.iter().filter(|v| **v != 0).count()
     }
     /// Centroid of the matte (pixels), if any.
     pub fn centroid(&self) -> Option<[f64; 2]> {
+        if self.w == 0 || self.w.checked_mul(self.h)? > self.matte.len() {
+            return None;
+        }
         let (mut sx, mut sy, mut n) = (0.0, 0.0, 0.0);
         for (i, v) in self.matte.iter().enumerate() {
             if *v != 0 {
@@ -246,8 +294,18 @@ impl FrameSeg {
     /// Worker to the page): `ECSG`, width, height (u32 LE), the colour models as JSON (length
     /// prefixed), then the matte and the Refine Edge band run-length encoded (u16 LE run, byte).
     pub fn to_bytes(&self) -> Vec<u8> {
+        let Some(pixels) = self.w.checked_mul(self.h).filter(|n| *n <= rle::MAX_PLANE_BYTES) else {
+            return Vec::new();
+        };
+        if self.matte.len() != pixels || self.refine.len() != pixels || self.w > u32::MAX as usize || self.h > u32::MAX as usize {
+            return Vec::new();
+        }
         let models = serde_json::to_vec(&(&self.fg, &self.bg)).unwrap_or_default();
-        let mut out = Vec::with_capacity(16 + models.len() + 64);
+        let Some(header_len) = 16usize.checked_add(models.len()) else { return Vec::new() };
+        let mut out = Vec::new();
+        if out.try_reserve(header_len.saturating_add(64)).is_err() {
+            return Vec::new();
+        }
         out.extend_from_slice(b"ECSG");
         out.extend_from_slice(&(self.w as u32).to_le_bytes());
         out.extend_from_slice(&(self.h as u32).to_le_bytes());
@@ -261,6 +319,9 @@ impl FrameSeg {
                 while i + n < plane.len() && plane[i + n] == v && n < u16::MAX as usize {
                     n += 1;
                 }
+                if out.try_reserve(3).is_err() {
+                    return Vec::new();
+                }
                 out.extend_from_slice(&(n as u16).to_le_bytes());
                 out.push(v);
                 i += n;
@@ -277,23 +338,40 @@ impl FrameSeg {
         let u = |i: usize| u32::from_le_bytes([b[i], b[i + 1], b[i + 2], b[i + 3]]) as usize;
         let (w, h, ml) = (u(4), u(8), u(12));
         let n = w.checked_mul(h)?;
-        let models = b.get(16..16 + ml)?;
+        if n > rle::MAX_PLANE_BYTES || w == 0 || h == 0 {
+            return None;
+        }
+        let models_end = 16usize.checked_add(ml)?;
+        let models = b.get(16..models_end)?;
         let (fg, bg): (Gmm, Gmm) = serde_json::from_slice(models).ok()?;
-        let mut rest = &b[16 + ml..];
+        let mut rest = b.get(models_end..)?;
+        // Each run covers at most u16::MAX pixels; refuse before reserving a plane the input can't fill.
+        if rest.len() < n.div_ceil(usize::from(u16::MAX)).saturating_mul(6) {
+            return None;
+        }
         let mut plane = || -> Option<Vec<u8>> {
-            let mut v = Vec::with_capacity(n);
+            let mut v = Vec::new();
+            v.try_reserve_exact(n).ok()?;
             while v.len() < n {
                 if rest.len() < 3 {
                     return None;
                 }
-                let run = u16::from_le_bytes([rest[0], rest[1]]) as usize;
-                v.resize(v.len() + run, rest[2]);
-                rest = &rest[3..];
+                let run = u16::from_le_bytes([*rest.first()?, *rest.get(1)?]) as usize;
+                let next = v.len().checked_add(run)?;
+                if run == 0 || next > n {
+                    return None;
+                }
+                let value = *rest.get(2)?;
+                v.resize(next, value);
+                rest = rest.get(3..)?;
             }
             (v.len() == n).then_some(v)
         };
         let matte = plane()?;
         let refine = plane()?;
+        if !rest.is_empty() {
+            return None;
+        }
         Some(FrameSeg { w, h, matte, refine, fg, bg })
     }
 }
@@ -303,38 +381,76 @@ pub fn rgb_of(img: &Image) -> Vec<[f32; 3]> {
     img.data.par_iter().map(|p| if p[3] > 1e-6 { [p[0] / p[3], p[1] / p[3], p[2] / p[3]] } else { [0.0; 3] }).collect()
 }
 
-/// Pixels covered by `strokes` (of the given kinds) at `scale`.
-pub fn rasterize(strokes: &[&Stroke], kinds: &[StrokeKind], scale: f64, w: usize, h: usize) -> Vec<bool> {
-    let mut m = vec![false; w * h];
-    for s in strokes.iter().filter(|s| kinds.contains(&s.kind)) {
-        let r = (s.radius * scale).max(0.5);
-        let pts: Vec<[f64; 2]> = s.points.iter().map(|p| [p[0] * scale, p[1] * scale]).collect();
-        let segs: Vec<([f64; 2], [f64; 2])> = if pts.len() == 1 { vec![(pts[0], pts[0])] } else { pts.windows(2).map(|w| (w[0], w[1])).collect() };
-        for (a, b) in segs {
-            let x0 = (a[0].min(b[0]) - r).floor().max(0.0) as usize;
-            let x1 = ((a[0].max(b[0]) + r).ceil().max(0.0) as usize).min(w);
-            let y0 = (a[1].min(b[1]) - r).floor().max(0.0) as usize;
-            let y1 = ((a[1].max(b[1]) + r).ceil().max(0.0) as usize).min(h);
-            let d = [b[0] - a[0], b[1] - a[1]];
-            let l2 = d[0] * d[0] + d[1] * d[1];
-            for y in y0..y1 {
-                for x in x0..x1 {
-                    let p = [x as f64 + 0.5, y as f64 + 0.5];
-                    let t = if l2 > 0.0 { (((p[0] - a[0]) * d[0] + (p[1] - a[1]) * d[1]) / l2).clamp(0.0, 1.0) } else { 0.0 };
-                    let q = [a[0] + d[0] * t, a[1] + d[1] * t];
-                    if (p[0] - q[0]).hypot(p[1] - q[1]) <= r {
-                        m[y * w + x] = true;
-                    }
+/// A stroke's radius and segments at `scale`.
+fn segments(s: &Stroke, scale: f64) -> (f64, Vec<([f64; 2], [f64; 2])>) {
+    let pts: Vec<[f64; 2]> = s.points.iter().map(|p| [p[0] * scale, p[1] * scale]).collect();
+    let segs = match pts.as_slice() {
+        [p] => vec![(*p, *p)],
+        _ => pts.windows(2).map(|w| (w[0], w[1])).collect(),
+    };
+    ((s.radius * scale).max(0.5), segs)
+}
+
+/// Distance from `p` to the segment `a`–`b`.
+fn segment_distance(p: [f64; 2], a: [f64; 2], b: [f64; 2]) -> f64 {
+    let d = [b[0] - a[0], b[1] - a[1]];
+    let l2 = d[0] * d[0] + d[1] * d[1];
+    let t = if l2 > 0.0 { (((p[0] - a[0]) * d[0] + (p[1] - a[1]) * d[1]) / l2).clamp(0.0, 1.0) } else { 0.0 };
+    (p[0] - a[0] - d[0] * t).hypot(p[1] - a[1] - d[1] * t)
+}
+
+/// Call `paint` with every pixel `s` covers at `scale`.
+fn sweep(s: &Stroke, scale: f64, w: usize, h: usize, mut paint: impl FnMut(usize)) {
+    let (r, segs) = segments(s, scale);
+    for (a, b) in segs {
+        let x0 = (a[0].min(b[0]) - r).floor().max(0.0) as usize;
+        let x1 = ((a[0].max(b[0]) + r).ceil().max(0.0) as usize).min(w);
+        let y0 = (a[1].min(b[1]) - r).floor().max(0.0) as usize;
+        let y1 = ((a[1].max(b[1]) + r).ceil().max(0.0) as usize).min(h);
+        for y in y0..y1 {
+            for x in x0..x1 {
+                if segment_distance([x as f64 + 0.5, y as f64 + 0.5], a, b) <= r {
+                    paint(y * w + x);
                 }
             }
         }
     }
+}
+
+/// Pixels covered by `strokes` (of the given kinds) at `scale`.
+pub fn rasterize(strokes: &[&Stroke], kinds: &[StrokeKind], scale: f64, w: usize, h: usize) -> Vec<bool> {
+    let mut m = vec![false; w * h];
+    for s in strokes.iter().filter(|s| kinds.contains(&s.kind)) {
+        sweep(s, scale, w, h, |i| m[i] = true);
+    }
     m
 }
 
-/// Hard constraints: 1 = foreground, 2 = background, 0 = free.
-const HARD_FG: u8 = 1;
-const HARD_BG: u8 = 2;
+/// What a pair of opposing strokes (add / remove) leaves on each pixel.
+const ON: u8 = 1;
+const OFF: u8 = 2;
+
+/// [`ON`] where an `on` stroke covers a pixel, [`OFF`] where an `off` stroke does, 0 elsewhere.
+/// Strokes apply in drawing order, so where they overlap the last one painted wins: a stroke
+/// corrects the ones before it.
+pub fn resolve(strokes: &[&Stroke], on: StrokeKind, off: StrokeKind, scale: f64, w: usize, h: usize) -> Vec<u8> {
+    let mut m = vec![0; w * h];
+    for s in strokes {
+        let v = if s.kind == on {
+            ON
+        } else if s.kind == off {
+            OFF
+        } else {
+            continue;
+        };
+        sweep(s, scale, w, h, |i| m[i] = v);
+    }
+    m
+}
+
+/// Hard constraints: foreground, background, else free.
+const HARD_FG: u8 = ON;
+const HARD_BG: u8 = OFF;
 
 /// Graph-cut energy weights.
 const GAMMA: f64 = 50.0;
@@ -371,7 +487,9 @@ fn beta(img: &[[f32; 3]], free: &[bool], w: usize, h: usize) -> f64 {
 
 /// One min-cut over the `free` pixels; others keep `labels`. `prior`: P(foreground) per pixel
 /// and how much it weighs against the colour models.
-fn cut(img: &[[f32; 3]], w: usize, h: usize, labels: &mut [u8], free: &[bool], hard: &[u8], fg: &Gmm, bg: &Gmm, prior: Option<(&[f32], f64)>) {
+fn cut(img: &[[f32; 3]], size: (usize, usize), labels: &mut [u8], free: &[bool], hard: &[u8], models: (&Gmm, &Gmm), prior: Option<(&[f32], f64)>) {
+    let (w, h) = size;
+    let (fg, bg) = models;
     let mut idx = vec![u32::MAX; w * h];
     let mut nodes = vec![];
     for i in 0..w * h {
@@ -586,6 +704,36 @@ pub struct Prior {
     pub weight: f64,
 }
 
+/// Fit foreground/background colour models from strokes and the propagated matte.
+fn initial_models(rgb: &[[f32; 3]], hard: &[u8], fgs: &[bool], strokes: &[&Stroke], prior: Option<&Prior>, opts: &SegOpts, size: (usize, usize)) -> (Gmm, Gmm) {
+    let (w, h) = size;
+    // Initial colour models: the strokes (and the propagated matte).
+    match prior {
+        Some(p) => {
+            let fgc = samples(rgb, |i| (hard[i] == HARD_FG) || (hard[i] == 0 && p.soft[i] >= 0.5));
+            let bgc = samples(rgb, |i| (hard[i] == HARD_BG) || (hard[i] == 0 && p.soft[i] < 0.5));
+            let f = Gmm::fit(&fgc, COMPONENTS, MAX_SAMPLES);
+            let b = Gmm::fit(&bgc, COMPONENTS, MAX_SAMPLES);
+            (if f.is_empty() { p.fg.clone() } else { f }, if b.is_empty() { p.bg.clone() } else { b })
+        }
+        None => {
+            let fgc = samples(rgb, |i| hard[i] == HARD_FG);
+            let mut bgc = samples(rgb, |i| hard[i] == HARD_BG);
+            if bgc.is_empty() {
+                // No background strokes: what is far from the foreground strokes.
+                let d = matting::distance(fgs, w, h);
+                let r = strokes.iter().filter(|s| s.kind == StrokeKind::Fg).map(|s| s.radius).fold(1.0, f64::max) * opts.scale;
+                let far = (4.0 * r).max(0.25 * w.max(h) as f64) as f32;
+                bgc = samples(rgb, |i| d[i] > far);
+                if bgc.is_empty() {
+                    bgc = samples(rgb, |i| hard[i] != HARD_FG);
+                }
+            }
+            (Gmm::fit(&fgc, COMPONENTS, MAX_SAMPLES), Gmm::fit(&bgc, COMPONENTS, MAX_SAMPLES))
+        }
+    }
+}
+
 /// Segment a frame from its strokes (and a propagated prior): GrabCut iterations on a reduced
 /// copy, then a full-resolution cut in a band around the boundary.
 pub fn segment(img: &Image, strokes: &[&Stroke], prior: Option<&Prior>, opts: &SegOpts, refine_radius: f64) -> FrameSeg {
@@ -594,50 +742,14 @@ pub fn segment(img: &Image, strokes: &[&Stroke], prior: Option<&Prior>, opts: &S
         return FrameSeg::empty(w, h);
     }
     let rgb = rgb_of(img);
-    let fgs = rasterize(strokes, &[StrokeKind::Fg], opts.scale, w, h);
-    let bgs = rasterize(strokes, &[StrokeKind::Bg], opts.scale, w, h);
-    let hard: Vec<u8> = fgs
-        .iter()
-        .zip(&bgs)
-        .map(|(f, b)| {
-            if *b {
-                HARD_BG
-            } else if *f {
-                HARD_FG
-            } else {
-                0
-            }
-        })
-        .collect();
+    let hard = resolve(strokes, StrokeKind::Fg, StrokeKind::Bg, opts.scale, w, h);
+    let fgs: Vec<bool> = hard.iter().map(|v| *v == HARD_FG).collect();
+    let bgs: Vec<bool> = hard.iter().map(|v| *v == HARD_BG).collect();
     // A warped matte is uncertain by about the search radius: blur it. A model's matte is not.
     let soft_prior: Option<Vec<f32>> =
         prior.map(|p| if p.weight > PRIOR { p.soft.clone() } else { matting::gauss(&p.soft, w, h, (opts.search_radius * opts.scale / 4.0).max(1.0)) });
     let pw = prior.map_or(PRIOR, |p| p.weight);
-    // Initial colour models: the strokes (and the propagated matte).
-    let (fg0, bg0) = match prior {
-        Some(p) => {
-            let fgc = samples(&rgb, |i| (hard[i] == HARD_FG) || (hard[i] == 0 && p.soft[i] >= 0.5));
-            let bgc = samples(&rgb, |i| (hard[i] == HARD_BG) || (hard[i] == 0 && p.soft[i] < 0.5));
-            let f = Gmm::fit(&fgc, COMPONENTS, MAX_SAMPLES);
-            let b = Gmm::fit(&bgc, COMPONENTS, MAX_SAMPLES);
-            (if f.is_empty() { p.fg.clone() } else { f }, if b.is_empty() { p.bg.clone() } else { b })
-        }
-        None => {
-            let fgc = samples(&rgb, |i| hard[i] == HARD_FG);
-            let mut bgc = samples(&rgb, |i| hard[i] == HARD_BG);
-            if bgc.is_empty() {
-                // No background strokes: what is far from the foreground strokes.
-                let d = matting::distance(&fgs, w, h);
-                let r = strokes.iter().filter(|s| s.kind == StrokeKind::Fg).map(|s| s.radius).fold(1.0, f64::max) * opts.scale;
-                let far = (4.0 * r).max(0.25 * w.max(h) as f64) as f32;
-                bgc = samples(&rgb, |i| d[i] > far);
-                if bgc.is_empty() {
-                    bgc = samples(&rgb, |i| hard[i] != HARD_FG);
-                }
-            }
-            (Gmm::fit(&fgc, COMPONENTS, MAX_SAMPLES), Gmm::fit(&bgc, COMPONENTS, MAX_SAMPLES))
-        }
-    };
+    let (fg0, bg0) = initial_models(&rgb, &hard, &fgs, strokes, prior, opts, (w, h));
     let iters = if opts.best { 4 } else { 3 };
     let work = if opts.best { 960 } else { 480 };
     let f = w.max(h).div_ceil(work).max(1);
@@ -685,7 +797,7 @@ pub fn segment(img: &Image, strokes: &[&Stroke], prior: Option<&Prior>, opts: &S
         };
         let free = vec![true; cw * ch];
         for it in 0..iters {
-            cut(&crgb, cw, ch, &mut cl, &free, &chard, &fgm, &bgm, cprior.as_deref().map(|c| (c, pw)));
+            cut(&crgb, (cw, ch), &mut cl, &free, &chard, (&fgm, &bgm), cprior.as_deref().map(|c| (c, pw)));
             if it + 1 < iters {
                 let (a, b) = fit_models(&crgb, &cl);
                 if !a.is_empty() && !b.is_empty() {
@@ -707,11 +819,11 @@ pub fn segment(img: &Image, strokes: &[&Stroke], prior: Option<&Prior>, opts: &S
         let sd = matting::signed_distance(&labels, w, h);
         let band = f as f32 + 1.5;
         let free: Vec<bool> = sd.iter().map(|d| d.abs() <= band).collect();
-        cut(&rgb, w, h, &mut labels, &free, &hard, &fgm, &bgm, soft_prior.as_deref().map(|c| (c, pw)));
+        cut(&rgb, (w, h), &mut labels, &free, &hard, (&fgm, &bgm), soft_prior.as_deref().map(|c| (c, pw)));
     } else {
         let free = vec![true; w * h];
         for it in 0..iters {
-            cut(&rgb, w, h, &mut labels, &free, &hard, &fgm, &bgm, soft_prior.as_deref().map(|c| (c, pw)));
+            cut(&rgb, (w, h), &mut labels, &free, &hard, (&fgm, &bgm), soft_prior.as_deref().map(|c| (c, pw)));
             if it + 1 < iters {
                 let (a, b) = fit_models(&rgb, &labels);
                 if !a.is_empty() && !b.is_empty() {
@@ -744,8 +856,7 @@ fn core_of(soft: &[f32], w: usize, h: usize, r: f64) -> Vec<bool> {
 fn finish(_img: &Image, rgb: &[[f32; 3]], labels: Vec<u8>, strokes: &[&Stroke], warped_refine: Option<&[u8]>, opts: &SegOpts, refine_radius: f64) -> FrameSeg {
     let (w, h) = (_img.width as usize, _img.height as usize);
     let (fg, bg) = fit_models(rgb, &labels);
-    let add = rasterize(strokes, &[StrokeKind::Refine], opts.scale, w, h);
-    let erase = rasterize(strokes, &[StrokeKind::RefineErase], opts.scale, w, h);
+    let painted = resolve(strokes, StrokeKind::Refine, StrokeKind::RefineErase, opts.scale, w, h);
     let near: Option<Vec<f32>> = warped_refine.filter(|r| r.iter().any(|v| *v != 0)).map(|_| matting::signed_distance(&labels, w, h));
     let rr = (refine_radius * opts.scale + 2.0) as f32;
     let refine: Vec<u8> = (0..w * h)
@@ -754,7 +865,7 @@ fn finish(_img: &Image, rgb: &[[f32; 3]], labels: Vec<u8>, strokes: &[&Stroke],
                 (Some(r), Some(sd)) => r[i] != 0 && sd[i].abs() <= rr,
                 _ => false,
             };
-            ((carried || add[i]) && !erase[i]) as u8
+            ((carried && painted[i] != OFF) || painted[i] == ON) as u8
         })
         .collect();
     FrameSeg { w, h, matte: labels, refine, fg, bg }
@@ -790,6 +901,87 @@ pub fn warp_prior(prev_img: &Image, prev: &FrameSeg, next_img: &Image, opts: &Se
     Prior { soft: res.iter().map(|r| r.0).collect(), fg: prev.fg.clone(), bg: prev.bg.clone(), refine: res.iter().map(|r| r.1).collect(), weight: PRIOR }
 }
 
+/// The inputs of a band re-cut on one (sub)image of `size`.
+struct Band<'a> {
+    size: (usize, usize),
+    rgb: &'a [[f32; 3]],
+    /// The warped soft matte (the prior, before blurring).
+    soft: &'a [f32],
+    free: &'a [bool],
+    seeds: &'a [bool],
+}
+
+/// Graph cut of the free pixels with the blurred prior, then [`clean`].
+fn cut_band(b: &Band, labels: &mut [u8], sigma: f64, models: (&Gmm, &Gmm)) {
+    let (w, h) = b.size;
+    let soft = matting::gauss(b.soft, w, h, sigma);
+    cut(b.rgb, b.size, labels, b.free, &vec![0u8; w * h], models, Some((&soft, PRIOR)));
+    clean(labels, b.seeds, &vec![false; w * h], w, h);
+}
+
+/// The half-open rectangle `[x0, y0, x1, y1)` around the pixels with `sd >= -r` (the band
+/// `|sd| <= r` and the core `sd > r`), grown by `pad` and clipped to the frame; `None` when
+/// there are none.
+fn band_rect(sd: &[f32], size: (usize, usize), r: f32, pad: usize) -> Option<[usize; 4]> {
+    let (w, h) = size;
+    let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0, 0);
+    for (i, d) in sd.iter().enumerate() {
+        if *d >= -r {
+            let (x, y) = (i % w.max(1), i / w.max(1));
+            (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+        }
+    }
+    (x0 <= x1).then(|| [x0.saturating_sub(pad), y0.saturating_sub(pad), x1.saturating_add(pad + 1).min(w), y1.saturating_add(pad + 1).min(h)])
+}
+
+/// The pixels of `rect` (row-major) of a `w`-wide plane.
+fn crop_of<T: Copy>(src: &[T], w: usize, rect: [usize; 4]) -> Vec<T> {
+    let [x0, y0, x1, y1] = rect;
+    (y0..y1).flat_map(|y| src.get(y * w + x0..y * w + x1).unwrap_or(&[]).iter().copied()).collect()
+}
+
+/// Re-cut the band `|sd| <= r` around the edge of `labels` (the warped matte) with `soft` as the
+/// prior; outside it the labels stay. `models`: the colour models, fitted on the whole frame when
+/// `None`. With `crop` the cut runs on the bounding box of the band and the core, padded by the
+/// reach of the prior blur: outside that box every pixel is background more than `r` from the
+/// edge, the free pixels, their neighbours and the seeds are the same, and every free pixel sees
+/// the same blur window as on the full frame.
+fn recut_band(rgb: &[[f32; 3]], size: (usize, usize), labels: &mut [u8], soft: &[f32], r: f32, models: Option<(&Gmm, &Gmm)>, crop: bool) {
+    let (w, h) = size;
+    let fitted;
+    let models = match models {
+        Some(m) => m,
+        None => {
+            fitted = fit_models(rgb, labels);
+            (&fitted.0, &fitted.1)
+        }
+    };
+    let sd = matting::signed_distance(labels, w, h);
+    let free: Vec<bool> = sd.iter().map(|d| d.abs() <= r).collect();
+    // The seeds of `core_of(soft, ..)`: `labels` is `soft >= 0.5`, so this is its core.
+    let core: Vec<bool> = sd.iter().map(|d| *d > r).collect();
+    let seeds: Vec<bool> = if core.iter().any(|c| *c) { core } else { labels.iter().map(|v| *v != 0).collect() };
+    let sigma = (r as f64 / 4.0).max(1.0);
+    let full = [0, 0, w, h];
+    let rect = if crop { band_rect(&sd, size, r, matting::gauss_reach(sigma).max(1)) } else { Some(full) };
+    // No band and no core: there is no foreground, so nothing is free and `clean` keeps all.
+    let Some(rect) = rect else { return };
+    if rect == full {
+        cut_band(&Band { size, rgb, soft, free: &free, seeds: &seeds }, labels, sigma, models);
+        return;
+    }
+    let [x0, y0, x1, y1] = rect;
+    let cw = x1 - x0;
+    let (rgb_c, soft_c, free_c, seeds_c) = (crop_of(rgb, w, rect), crop_of(soft, w, rect), crop_of(&free, w, rect), crop_of(&seeds, w, rect));
+    let mut cl = crop_of(labels, w, rect);
+    cut_band(&Band { size: (cw, y1 - y0), rgb: &rgb_c, soft: &soft_c, free: &free_c, seeds: &seeds_c }, &mut cl, sigma, models);
+    for (y, row) in (y0..y1).zip(cl.chunks(cw.max(1))) {
+        if let Some(dst) = labels.get_mut(y * w + x0..y * w + x1) {
+            dst.copy_from_slice(row);
+        }
+    }
+}
+
 /// Propagate the previous frame's segmentation to the next frame: warp it, then re-cut in a
 /// band of Search Radius pixels around the warped boundary. Strokes on the next frame re-cut
 /// the whole frame with the warped matte as a soft prior instead.
@@ -801,15 +993,9 @@ pub fn propagate(prev_img: &Image, prev: &FrameSeg, next_img: &Image, strokes: &
     }
     let rgb = rgb_of(next_img);
     let mut labels: Vec<u8> = prior.soft.iter().map(|v| (*v >= 0.5) as u8).collect();
-    let sd = matting::signed_distance(&labels, w, h);
     let r = (opts.search_radius * opts.scale).max(2.0) as f32;
-    let free: Vec<bool> = sd.iter().map(|d| d.abs() <= r).collect();
-    let hard = vec![0u8; w * h];
-    let soft = matting::gauss(&prior.soft, w, h, (r as f64 / 4.0).max(1.0));
-    let (fg, bg) = if prev.fg.is_empty() || prev.bg.is_empty() { fit_models(&rgb, &labels) } else { (prev.fg.clone(), prev.bg.clone()) };
-    cut(&rgb, w, h, &mut labels, &free, &hard, &fg, &bg, Some((&soft, PRIOR)));
-    let seeds = core_of(&prior.soft, w, h, r as f64);
-    clean(&mut labels, &seeds, &vec![false; w * h], w, h);
+    let models = (!prev.fg.is_empty() && !prev.bg.is_empty()).then_some((&prev.fg, &prev.bg));
+    recut_band(&rgb, (w, h), &mut labels, &prior.soft, r, models, true);
     finish(next_img, &rgb, labels, strokes, Some(&prior.refine), opts, refine_radius)
 }
 
@@ -833,21 +1019,130 @@ fn points_along(s: &Stroke, scale: f64, max: usize) -> Vec<[f32; 2]> {
     out
 }
 
-/// A model's prompt from the strokes: points along the foreground and background strokes, and
-/// the box of a [`StrokeKind::Box`] stroke (matte pixels).
-pub fn stroke_prompt(strokes: &[&Stroke], scale: f64) -> Prompt {
+/// A tracker's prompt from a frame's strokes (points along the foreground and background strokes,
+/// in frame pixels at `scale`).
+///
+/// SAM 2 was trained on a handful of clicks: with sixteen or more points it doubts its own mask
+/// (measured: confidence 0.25 with 16 points, 0.00 with 32, 0.99 with 1 to 7), so this picks at
+/// most [`TRACKER_FG_POINTS`] foreground and [`TRACKER_BG_POINTS`] background points, spread
+/// along the strokes. Like [`stroke_prompt`], later corrections win over earlier paint.
+pub fn tracker_prompt(strokes: &[&Stroke], scale: f64, w: usize, h: usize) -> Prompt {
+    let hard = resolve(strokes, StrokeKind::Fg, StrokeKind::Bg, scale, w, h);
+    let prompt = stroke_prompt(strokes, &hard, scale, w, h);
     let mut points = vec![];
-    for (kind, fg) in [(StrokeKind::Fg, true), (StrokeKind::Bg, false)] {
+    for (fg, max) in [(true, TRACKER_FG_POINTS), (false, TRACKER_BG_POINTS)] {
+        let all: Vec<[f32; 2]> = prompt.points.iter().filter_map(|(p, label)| (*label == fg).then_some(*p)).collect();
+        let n = all.len().min(max);
+        // evenly spaced picks, keeping the first and the last
+        points.extend((0..n).filter_map(|i| all.get(if n > 1 { i * (all.len() - 1) / (n - 1) } else { all.len() / 2 }).map(|p| (*p, fg))));
+    }
+    Prompt { points, ..prompt }
+}
+
+/// [`tracker_prompt`] plus a box around the classic engine's matte of the same strokes. Clicks alone
+/// make SAM 2 pick the part they land on (a torso, not the legs and shoes: measured IoU 0.41 on a
+/// multi-part figure, against 1.00 with the box); the box says how far the object reaches. A box
+/// stroke the user drew wins over the matte's.
+pub fn tracker_prompt_boxed(strokes: &[&Stroke], scale: f64, classic: &FrameSeg) -> Prompt {
+    let mut p = tracker_prompt(strokes, scale, classic.w, classic.h);
+    if p.bbox.is_none() {
+        let (w, h) = (classic.w, classic.h);
+        let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0usize, 0usize);
+        for (i, v) in classic.matte.iter().enumerate() {
+            if *v != 0 && w > 0 {
+                let (x, y) = (i % w, i / w);
+                (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+            }
+        }
+        if x0 <= x1 {
+            let (mx, my) = (((x1 - x0) as f32 * 0.05).max(4.0), ((y1 - y0) as f32 * 0.05).max(4.0));
+            p.bbox = Some([(x0 as f32 - mx).max(0.0), (y0 as f32 - my).max(0.0), (x1 as f32 + 1.0 + mx).min(w as f32), (y1 as f32 + 1.0 + my).min(h as f32)]);
+        }
+    }
+    p
+}
+
+/// Most foreground / background points a tracker prompt carries.
+pub const TRACKER_FG_POINTS: usize = 3;
+pub const TRACKER_BG_POINTS: usize = 3;
+
+/// A frame's segmentation from a tracker's probability map: the map is the shape prior of the
+/// same graph cut as everywhere else, so the strokes stay hard constraints and the edges snap
+/// to colour. An absent object gives an empty matte (strokes on the frame still win); a map of
+/// the wrong size is ignored.
+pub fn segment_tracked(img: &Image, strokes: &[&Stroke], prob: Vec<f32>, occluded: bool, opts: &SegOpts, refine_radius: f64) -> FrameSeg {
+    let (w, h) = (img.width as usize, img.height as usize);
+    if prob.len() != w * h || w == 0 || h == 0 {
+        return segment(img, strokes, None, opts, refine_radius);
+    }
+    let has_fg = strokes.iter().any(|s| s.kind == StrokeKind::Fg);
+    if (occluded || !prob.iter().any(|p| *p >= 0.5)) && !has_fg {
+        return FrameSeg::empty(w, h);
+    }
+    let prior = Prior { soft: prob, fg: Gmm::default(), bg: Gmm::default(), refine: vec![0; w * h], weight: MODEL_PRIOR };
+    segment(img, strokes, Some(&prior), opts, refine_radius)
+}
+
+/// A model's prompt from the strokes: points along the foreground and background strokes, but
+/// not where a later stroke of the other kind painted over them (`hard`, from [`resolve`]), and
+/// the box of a [`StrokeKind::Box`] stroke (matte pixels). A stroke painted over at every point
+/// sampled along it, but not everywhere, is prompted from the middle of what is left of it.
+pub fn stroke_prompt(strokes: &[&Stroke], hard: &[u8], scale: f64, w: usize, h: usize) -> Prompt {
+    let mut points = vec![];
+    for (kind, own, other) in [(StrokeKind::Fg, HARD_FG, HARD_BG), (StrokeKind::Bg, HARD_BG, HARD_FG)] {
         let ss: Vec<&&Stroke> = strokes.iter().filter(|s| s.kind == kind).collect();
         let per = (16 / ss.len().max(1)).max(1);
         for s in ss {
-            points.extend(points_along(s, scale, per).into_iter().map(|p| (p, fg)));
+            let along = points_along(s, scale, per);
+            let mut kept: Vec<[f32; 2]> = along.iter().copied().filter(|p| owner(hard, w, h, *p) != Some(other)).collect();
+            if kept.is_empty() && !along.is_empty() {
+                kept.extend(deepest_owned(s, hard, own, scale, w, h));
+            }
+            points.extend(kept.into_iter().map(|p| (p, kind == StrokeKind::Fg)));
         }
     }
     let bbox = strokes.iter().filter(|s| s.kind == StrokeKind::Box).find_map(|s| box_of(s, scale));
     Prompt { points, bbox, ..Default::default() }
 }
 
+/// The value of `hard` under the point `p` (`None` outside the frame).
+fn owner(hard: &[u8], w: usize, h: usize, p: [f32; 2]) -> Option<u8> {
+    if !(p[0] >= 0.0 && p[1] >= 0.0) {
+        return None;
+    }
+    let (x, y) = (p[0] as usize, p[1] as usize);
+    if x >= w || y >= h {
+        return None;
+    }
+    hard.get(y * w + x).copied()
+}
+
+/// The centre of the pixel deepest inside what `s` still owns (where `hard` is `own` under it),
+/// if anything.
+fn deepest_owned(s: &Stroke, hard: &[u8], own: u8, scale: f64, w: usize, h: usize) -> Option<[f32; 2]> {
+    let mut owned = vec![];
+    sweep(s, scale, w, h, |i| {
+        if hard.get(i) == Some(&own) {
+            owned.push((i % w, i / w));
+        }
+    });
+    let (x0, x1) = (owned.iter().map(|p| p.0).min()?, owned.iter().map(|p| p.0).max()?);
+    let (y0, y1) = (owned.iter().map(|p| p.1).min()?, owned.iter().map(|p| p.1).max()?);
+    // One pixel of margin all round, so depth is measured to the nearest pixel it doesn't own.
+    let (cw, ch) = (x1 - x0 + 3, y1 - y0 + 3);
+    let at = |(x, y): (usize, usize)| (y - y0 + 1) * cw + (x - x0 + 1);
+    let mut free = vec![true; cw * ch];
+    for p in &owned {
+        if let Some(v) = free.get_mut(at(*p)) {
+            *v = false;
+        }
+    }
+    let depth = matting::distance(&free, cw, ch);
+    let d = |p: &(usize, usize)| depth.get(at(*p)).copied().unwrap_or(0.0);
+    let (x, y) = owned.iter().copied().max_by(|a, b| d(a).total_cmp(&d(b)))?;
+    Some([x as f32 + 0.5, y as f32 + 0.5])
+}
+
 /// The box `[x0, y0, x1, y1]` (matte pixels) of a box stroke: its first two points as opposite
 /// corners; `None` when they are missing, not finite or the box is empty.
 fn box_of(s: &Stroke, scale: f64) -> Option<[f32; 4]> {
@@ -857,8 +1152,18 @@ fn box_of(s: &Stroke, scale: f64) -> Option<[f32; 4]> {
 }
 
 /// Add a prior matte to a prompt: its box (a little larger; unless the prompt has one), up to
-/// four points spread through its core, and the matte itself.
-fn add_prior_prompt(prompt: &mut Prompt, soft: &[f32], w: usize, h: usize) -> bool {
+/// four points spread through its core, and the matte itself, all with this frame's strokes
+/// (`hard`, from [`resolve`]) painted over it.
+fn add_prior_prompt(prompt: &mut Prompt, soft: &[f32], hard: &[u8], w: usize, h: usize) -> bool {
+    let soft: Vec<f32> = soft
+        .iter()
+        .enumerate()
+        .map(|(i, v)| match hard.get(i) {
+            Some(&HARD_FG) => 1.0,
+            Some(&HARD_BG) => 0.0,
+            _ => *v,
+        })
+        .collect();
     let bin: Vec<u8> = soft.iter().map(|v| (*v >= 0.5) as u8).collect();
     let (mut x0, mut y0, mut x1, mut y1) = (usize::MAX, usize::MAX, 0usize, 0usize);
     for (i, v) in bin.iter().enumerate() {
@@ -888,7 +1193,7 @@ fn add_prior_prompt(prompt: &mut Prompt, soft: &[f32], w: usize, h: usize) -> bo
         }
     }
     prompt.points.extend(picks.into_iter().map(|i| ([(i % w) as f32 + 0.5, (i / w) as f32 + 0.5], true)));
-    prompt.mask = Some(soft.to_vec());
+    prompt.mask = Some(soft);
     true
 }
 
@@ -897,9 +1202,10 @@ fn add_prior_prompt(prompt: &mut Prompt, soft: &[f32], w: usize, h: usize) -> bo
 pub fn segment_with(img: &Image, strokes: &[&Stroke], prior: Option<&Prior>, opts: &SegOpts, refine_radius: f64, model: Option<&dyn MaskModel>) -> FrameSeg {
     let (w, h) = (img.width as usize, img.height as usize);
     let Some(m) = model.filter(|_| w > 0 && h > 0) else { return segment(img, strokes, prior, opts, refine_radius) };
-    let mut prompt = stroke_prompt(strokes, opts.scale);
+    let hard = resolve(strokes, StrokeKind::Fg, StrokeKind::Bg, opts.scale, w, h);
+    let mut prompt = stroke_prompt(strokes, &hard, opts.scale, w, h);
     if let Some(p) = prior {
-        add_prior_prompt(&mut prompt, &p.soft, w, h);
+        add_prior_prompt(&mut prompt, &p.soft, &hard, w, h);
     }
     if !prompt.points.iter().any(|(_, fg)| *fg) {
         return segment(img, strokes, prior, opts, refine_radius);
@@ -929,8 +1235,9 @@ pub fn propagate_with(
     let (w, h) = (next_img.width as usize, next_img.height as usize);
     let Some(m) = model.filter(|_| w > 0 && h > 0) else { return propagate(prev_img, prev, next_img, strokes, opts, refine_radius) };
     let prior = warp_prior(prev_img, prev, next_img, opts);
-    let mut prompt = stroke_prompt(strokes, opts.scale);
-    if !add_prior_prompt(&mut prompt, &prior.soft, w, h) {
+    let hard = resolve(strokes, StrokeKind::Fg, StrokeKind::Bg, opts.scale, w, h);
+    let mut prompt = stroke_prompt(strokes, &hard, opts.scale, w, h);
+    if !add_prior_prompt(&mut prompt, &prior.soft, &hard, w, h) {
         return propagate(prev_img, prev, next_img, strokes, opts, refine_radius);
     }
     match m.segment(&rgb_of(next_img), w, h, &prompt) {
diff --git a/crates/track/src/roto/bench.rs b/crates/track/src/roto/bench.rs
new file mode 100644
index 000000000..98ada3903
--- /dev/null
+++ b/crates/track/src/roto/bench.rs
@@ -0,0 +1,447 @@
+//! Roto Brush benchmark: synthetic clips with known mattes (movement, colour change, occlusion,
+//! leaving and re-entering the frame) and the metrics that compare trackers on them.
+//!
+//! Needs no weights: the classical engine always runs, and a trained [`MaskModel`] (MobileSAM,
+//! later SAM 2) is added when the caller has one. `effectcraft-cli bench --roto` prints the table.
+
+use effectcraft_raster::Image;
+use std::sync::Arc;
+
+use effectcraft_segment::{ClipFrame, MaskModel, TrackRequest};
+use serde::Serialize;
+use web_time::Instant;
+
+use super::{FrameSeg, SegOpts, Stroke, StrokeKind, iou, propagate_with, rgb_of, segment_tracked, segment_with, tracker_prompt_boxed};
+
+pub const W: u32 = 200;
+pub const H: u32 = 150;
+const R: f64 = 32.0;
+
+/// A clip with the true matte of the visible object on every frame.
+#[derive(Clone)]
+pub struct Scenario {
+    pub name: String,
+    pub what: String,
+    /// Frame size in pixels (the synthetic clips are `W × H`; a real clip has its own).
+    pub w: usize,
+    pub h: usize,
+    pub frames: Vec<Image>,
+    /// Visible-object matte per frame (`w × h`, 0/1); empty when the object is out of view.
+    pub truth: Vec<Vec<u8>>,
+    /// Frame the strokes are painted on.
+    pub base: usize,
+    pub strokes: Vec<Stroke>,
+}
+
+/// One tracker's result on one scenario.
+#[derive(Clone, Debug, Serialize)]
+pub struct Run {
+    pub scenario: String,
+    pub tracker: String,
+    pub mean_iou: f64,
+    pub min_iou: f64,
+    /// Mean IoU between consecutive mattes minus the same for the truth, as a loss (0 is steady).
+    pub flicker: f64,
+    pub secs_per_frame: f64,
+    /// Mean IoU over the frames after the object's last absence (re-appearance), if it had one.
+    pub after_return: Option<f64>,
+    pub per_frame: Vec<f64>,
+    /// Correction rounds needed before every frame reaches the target IoU (`>N`: not within N); set by
+    /// [`with_fixes`], `None` when not measured.
+    pub fixes: Option<String>,
+    /// The most memory (MB) the tracker held for its memory banks and cached frames (trackers that have none: `None`).
+    pub peak_mb: Option<f64>,
+    /// The matte of every frame (not serialised).
+    #[serde(skip)]
+    pub mattes: Vec<Vec<u8>>,
+}
+
+fn noise(x: f64, y: f64, seed: u32) -> f64 {
+    fn h(i: i64, j: i64, s: u32) -> f64 {
+        let mut v = (i.wrapping_mul(73856093) ^ j.wrapping_mul(19349663) ^ i64::from(s).wrapping_mul(83492791)) as u64;
+        v ^= v >> 13;
+        v = v.wrapping_mul(0x5bd1e995);
+        v ^= v >> 15;
+        (v % 10_000) as f64 / 10_000.0
+    }
+    let mut out = 0.0;
+    for (cell, amp) in [(9.0, 0.6), (3.5, 0.4)] {
+        let (fx, fy) = (x / cell, y / cell);
+        let (i, j) = (fx.floor() as i64, fy.floor() as i64);
+        let (tx, ty) = (fx - i as f64, fy - j as f64);
+        let (sx, sy) = (tx * tx * (3.0 - 2.0 * tx), ty * ty * (3.0 - 2.0 * ty));
+        let a = h(i, j, seed) + (h(i + 1, j, seed) - h(i, j, seed)) * sx;
+        let b = h(i, j + 1, seed) + (h(i + 1, j + 1, seed) - h(i, j + 1, seed)) * sx;
+        out += amp * (a + (b - a) * sy);
+    }
+    out
+}
+
+/// What a frame shows: the disk centre, an optional occluding bar `[x0, y0, x1, y1]` and a
+/// brightness gain applied to the whole frame.
+#[derive(Clone, Copy)]
+struct Look {
+    c: [f64; 2],
+    bar: Option<[f64; 4]>,
+    gain: f32,
+}
+
+fn render(l: Look) -> (Image, Vec<u8>) {
+    let mut img = Image::new(W, H);
+    let mut gt = vec![0u8; (W * H) as usize];
+    for y in 0..H {
+        for x in 0..W {
+            let p = [f64::from(x) + 0.5, f64::from(y) + 0.5];
+            let d = (p[0] - l.c[0]).hypot(p[1] - l.c[1]);
+            let a = (R + 0.5 - d).clamp(0.0, 1.0) as f32;
+            let n = noise(p[0] - l.c[0], p[1] - l.c[1], 11);
+            let f = [(0.75 + 0.25 * n) as f32, (0.35 + 0.3 * n) as f32, (0.1 + 0.15 * n) as f32];
+            let (bn, bm) = (noise(p[0], p[1], 5), noise(p[0] * 1.7, p[1] * 1.7, 9));
+            let b = [(0.05 + 0.25 * bm) as f32, (0.3 + 0.4 * bn) as f32, (0.45 + 0.4 * bm) as f32];
+            let mut px = [0.0f32; 3];
+            for k in 0..3 {
+                px[k] = f[k] * a + b[k] * (1.0 - a);
+            }
+            let under_bar = l.bar.is_some_and(|r| p[0] >= r[0] && p[0] < r[2] && p[1] >= r[1] && p[1] < r[3]);
+            if under_bar {
+                let t = noise(p[0] * 0.8, p[1] * 0.8, 23) as f32;
+                px = [0.15 + 0.1 * t, 0.15 + 0.1 * t, 0.2 + 0.1 * t];
+            }
+            let g = l.gain;
+            img.set(x, y, [(px[0] * g).min(1.0), (px[1] * g).min(1.0), (px[2] * g).min(1.0), 1.0]);
+            if let Some(v) = gt.get_mut((y * W + x) as usize) {
+                *v = (d <= R && !under_bar) as u8;
+            }
+        }
+    }
+    (img, gt)
+}
+
+fn line(kind: StrokeKind, frame: i64, a: [f64; 2], b: [f64; 2], radius: f64) -> Stroke {
+    let pt = |k: u32| {
+        let t = f64::from(k) / 10.0;
+        [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t]
+    };
+    Stroke { kind, frame, radius, points: (0..=10).map(pt).collect(), object: 0 }
+}
+
+/// The strokes an artist would paint on the base frame: one through the disk, two around it.
+fn strokes_for(c: [f64; 2]) -> Vec<Stroke> {
+    vec![
+        line(StrokeKind::Fg, 0, [c[0] - 18.0, c[1] - 6.0], [c[0] + 18.0, c[1] + 6.0], 5.0),
+        line(StrokeKind::Bg, 0, [c[0] - 50.0, c[1] - 45.0], [c[0] + 50.0, c[1] - 45.0], 5.0),
+        line(StrokeKind::Bg, 0, [c[0] + 50.0, c[1] + 45.0], [c[0] - 45.0, c[1] + 45.0], 5.0),
+    ]
+}
+
+fn scenario(name: &'static str, what: &'static str, n: usize, look: impl Fn(usize) -> Look) -> Scenario {
+    let (mut frames, mut truth) = (Vec::with_capacity(n), Vec::with_capacity(n));
+    for f in 0..n {
+        let (img, gt) = render(look(f));
+        frames.push(img);
+        truth.push(gt);
+    }
+    Scenario { name: name.to_string(), what: what.to_string(), w: W as usize, h: H as usize, frames, truth, base: 0, strokes: strokes_for(look(0).c) }
+}
+
+/// A scenario from the user's own clip: frames and their true mattes (0/1, same size as the frames). The strokes
+/// are made from the first frame with an object: a short foreground stroke through its centre and background
+/// strokes along the top and bottom edges where the truth is empty. Nothing is bundled: the clip stays with the
+/// user (a licensed dataset, say), and so does its licence.
+pub fn scenario_from(name: &str, frames: Vec<Image>, truth: Vec<Vec<u8>>) -> std::result::Result<Scenario, String> {
+    let first = frames.first().ok_or("a clip needs at least one frame")?;
+    let (w, h) = (first.width as usize, first.height as usize);
+    if w == 0
+        || h == 0
+        || frames.len() != truth.len()
+        || frames.iter().any(|f| (f.width as usize, f.height as usize) != (w, h))
+        || truth.iter().any(|t| t.len() != w * h)
+    {
+        return Err("frames and truth masks must be the same size and count".into());
+    }
+    let base = truth.iter().position(|t| t.iter().any(|v| *v != 0)).ok_or("no frame has the object in its truth mask")?;
+    let t = truth.get(base).map(Vec::as_slice).unwrap_or(&[]);
+    let (mut x0, mut x1, mut sx, mut sy, mut n) = (usize::MAX, 0usize, 0.0f64, 0.0f64, 0.0f64);
+    for i in t.iter().enumerate().filter(|(_, v)| **v != 0).map(|(i, _)| i) {
+        let (x, y) = (i % w, i / w);
+        (x0, x1) = (x0.min(x), x1.max(x));
+        sx += x as f64 + 0.5;
+        sy += y as f64 + 0.5;
+        n += 1.0;
+    }
+    let (cx, cy) = (sx / n, sy / n);
+    let reach = (((x1 - x0) as f64) * 0.15).max(2.0);
+    let radius = ((w.min(h) as f64) * 0.03).max(3.0);
+    let mut strokes = vec![line(StrokeKind::Fg, base as i64, [cx - reach, cy], [cx + reach, cy], radius)];
+    for y in [h as f64 * 0.04, h as f64 * 0.96] {
+        let row = y as usize;
+        let free = t.get(row * w..(row + 1) * w).is_some_and(|r| r.iter().all(|v| *v == 0));
+        if free {
+            strokes.push(line(StrokeKind::Bg, base as i64, [w as f64 * 0.05, y], [w as f64 * 0.95, y], radius));
+        }
+    }
+    Ok(Scenario { name: name.to_string(), what: "a clip supplied by the user".to_string(), w, h, frames, truth, base, strokes })
+}
+
+/// The benchmark clips, `n` frames each (at least 12, so every event happens).
+pub fn scenarios(n: usize) -> Vec<Scenario> {
+    let n = n.clamp(12, 240);
+    let k = n as f64 / 24.0;
+    let drift = move |f: usize| {
+        let t = f as f64 / k;
+        [60.0 + 3.1 * t, 70.0 + 1.3 * t + 4.0 * (t * 0.3).sin()]
+    };
+    vec![
+        scenario("move", "disk drifts across a textured background", n, move |f| Look { c: drift(f), bar: None, gain: 1.0 }),
+        scenario("light", "same motion while the whole frame brightens by 40 %", n, move |f| Look {
+            c: drift(f),
+            bar: None,
+            gain: 1.0 + 0.4 * f as f32 / n as f32,
+        }),
+        scenario("occlusion", "a bar crosses and hides most of the disk, then clears it", n, move |f| {
+            let t = f as f64 / n as f64;
+            let c = drift(f);
+            let x = -40.0 + 320.0 * ((t - 0.3) / 0.4).clamp(0.0, 1.0);
+            Look { c, bar: (0.3..0.7).contains(&t).then_some([x - 40.0, 0.0, x + 40.0, f64::from(H)]), gain: 1.0 }
+        }),
+        scenario("reenter", "disk leaves through the right edge and comes back", n, move |f| {
+            let t = f as f64 / n as f64;
+            let x = 60.0 + 190.0 * (1.0 - (2.0 * t - 1.0).powi(2));
+            Look { c: [x, 70.0 + 4.0 * (t * 6.0).sin()], bar: None, gain: 1.0 }
+        }),
+    ]
+}
+
+fn metrics(sc: &Scenario, tracker: &str, mattes: &[Vec<u8>], secs: f64) -> Run {
+    let per_frame: Vec<f64> = mattes.iter().zip(&sc.truth).map(|(m, t)| iou(m, t)).collect();
+    let n = per_frame.len().max(1) as f64;
+    let steady = |v: &[Vec<u8>]| {
+        let pairs: Vec<f64> = v.windows(2).filter_map(|w| Some(iou(w.first()?, w.get(1)?))).collect();
+        pairs.iter().sum::<f64>() / pairs.len().max(1) as f64
+    };
+    let last_gap = sc.truth.iter().rposition(|t| t.iter().all(|v| *v == 0));
+    let after_return = last_gap.and_then(|g| {
+        let tail = per_frame.get(g + 1..)?;
+        (!tail.is_empty()).then(|| tail.iter().sum::<f64>() / tail.len() as f64)
+    });
+    Run {
+        scenario: sc.name.clone(),
+        tracker: tracker.to_string(),
+        mean_iou: per_frame.iter().sum::<f64>() / n,
+        min_iou: per_frame.iter().copied().fold(1.0, f64::min),
+        flicker: (steady(&sc.truth) - steady(mattes)).max(0.0),
+        secs_per_frame: secs / n,
+        after_return,
+        per_frame,
+        fixes: None,
+        peak_mb: None,
+        mattes: mattes.to_vec(),
+    }
+}
+
+/// Segment the base frame from the strokes and propagate to the end of the clip, as the Roto
+/// Brush does, with `model` (or none: the classical engine).
+pub fn run_flow(sc: &Scenario, tracker: &str, model: Option<&dyn MaskModel>) -> Run {
+    let opts = SegOpts::default();
+    let start = Instant::now();
+    let refs: Vec<&Stroke> = sc.strokes.iter().filter(|s| s.frame == sc.base as i64).collect();
+    let mut segs: Vec<Option<FrameSeg>> = vec![None; sc.frames.len()];
+    if let Some(first) = sc.frames.get(sc.base) {
+        let base = segment_with(first, &refs, None, &opts, 0.0, model);
+        if let Some(slot) = segs.get_mut(sc.base) {
+            *slot = Some(base);
+        }
+    }
+    for f in sc.base + 1..sc.frames.len() {
+        let (Some(prev_img), Some(img)) = (sc.frames.get(f - 1), sc.frames.get(f)) else { break };
+        let Some(Some(prev)) = segs.get(f - 1) else { break };
+        let here: Vec<&Stroke> = sc.strokes.iter().filter(|s| s.frame == f as i64).collect();
+        let next = propagate_with(prev_img, prev, img, &here, &opts, 0.0, model);
+        if let Some(slot) = segs.get_mut(f) {
+            *slot = Some(next);
+        }
+    }
+    let secs = start.elapsed().as_secs_f64();
+    let empty = vec![0u8; sc.w * sc.h];
+    let mattes: Vec<Vec<u8>> = segs.into_iter().map(|s| s.map_or_else(|| empty.clone(), |s| s.matte)).collect();
+    metrics(sc, tracker, &mattes, secs)
+}
+
+/// Follow the object through the whole clip with the model's video tracker, as the Roto Brush's
+/// tracking pass does (prompt from the strokes, probability maps refined by the same graph cut).
+/// `None` when the model has no tracker or the tracker fails.
+pub fn run_tracker(sc: &Scenario, tracker: &str, model: &dyn MaskModel) -> Option<Run> {
+    let t = model.tracker()?;
+    let opts = SegOpts::default();
+    let at = |f: usize| -> Vec<&Stroke> { sc.strokes.iter().filter(|s| s.frame == f as i64).collect() };
+    let clip: Vec<Arc<ClipFrame>> = sc.frames.iter().map(|i| Arc::new(ClipFrame { rgb: rgb_of(i), w: i.width as usize, h: i.height as usize })).collect();
+    // a prompt per stroke frame: a few clicks and the box of the classic matte (as Chain::track does)
+    let mut prompts = vec![];
+    for f in 0..sc.frames.len() {
+        let strokes = at(f);
+        let Some(img) = sc.frames.get(f).filter(|_| strokes.iter().any(|s| s.kind == StrokeKind::Fg)) else { continue };
+        prompts.push((f as i64, tracker_prompt_boxed(&strokes, 1.0, &super::segment(img, &strokes, None, &opts, 0.0))));
+    }
+    let req = TrackRequest::single(0, sc.frames.len(), prompts);
+    let start = Instant::now();
+    let mut mattes: Vec<Vec<u8>> = vec![vec![0u8; sc.w * sc.h]; sc.frames.len()];
+    let mut get = |f: i64| usize::try_from(f).ok().and_then(|i| clip.get(i).cloned());
+    let r = t.track(&req, &mut get, &|| false, &mut |_, f, tf| {
+        let (Ok(i), true) = (usize::try_from(f), tf.prob.len() == sc.w * sc.h) else { return };
+        let Some(img) = sc.frames.get(i) else { return };
+        let strokes = at(i);
+        if let Some(slot) = mattes.get_mut(i) {
+            *slot = segment_tracked(img, &strokes, tf.prob, tf.occluded, &opts, 0.0).matte;
+        }
+    });
+    r.ok()?;
+    let mut run = metrics(sc, tracker, &mattes, start.elapsed().as_secs_f64());
+    run.peak_mb = model.peak_state_bytes().map(|b| b as f64 / (1 << 20) as f64);
+    Some(run)
+}
+
+/// The correction a user would paint on frame `f` where `pred` is wrong: a short foreground stroke through
+/// the true object's centre, and a background stroke at the centroid of all false-positive pixels.
+fn correction(sc: &Scenario, f: usize, pred: &[u8]) -> Vec<Stroke> {
+    let truth = sc.truth.get(f).map(Vec::as_slice).unwrap_or(&[]);
+    let centre = |keep: &dyn Fn(usize) -> bool| -> Option<[f64; 2]> {
+        let (mut sx, mut sy, mut n) = (0.0, 0.0, 0.0);
+        for i in (0..truth.len().min(pred.len())).filter(|i| keep(*i)) {
+            sx += (i % sc.w.max(1)) as f64 + 0.5;
+            sy += (i / sc.w.max(1)) as f64 + 0.5;
+            n += 1.0;
+        }
+        (n > 0.0).then(|| [sx / n, sy / n])
+    };
+    let mut out = vec![];
+    if let Some(c) = centre(&|i| truth.get(i).is_some_and(|v| *v != 0)) {
+        out.push(line(StrokeKind::Fg, f as i64, [c[0] - 12.0, c[1]], [c[0] + 12.0, c[1]], 5.0));
+    }
+    if let Some(c) = centre(&|i| pred.get(i).is_some_and(|v| *v != 0) && truth.get(i).is_some_and(|v| *v == 0)) {
+        out.push(line(StrokeKind::Bg, f as i64, [c[0] - 6.0, c[1]], [c[0] + 6.0, c[1]], 6.0));
+    }
+    out
+}
+
+/// Repeat `run` on `sc`, each time painting the correction a user would on the first frame under `target` IoU,
+/// until every frame reaches it or `max` correction rounds were needed. Sets `fixes` on the first run's result:
+/// the number of rounds (each can add foreground and background strokes), or `>max`.
+pub fn with_fixes(sc: &Scenario, target: f64, max: usize, run: &dyn Fn(&Scenario) -> Option<Run>) -> Option<Run> {
+    let mut cur = sc.clone();
+    let mut first: Option<Run> = None;
+    for k in 0..=max {
+        let r = run(&cur)?;
+        let bad = r.per_frame.iter().position(|v| *v < target);
+        let first_run = first.get_or_insert_with(|| r.clone());
+        let Some(f) = bad else {
+            first_run.fixes = Some(k.to_string());
+            break;
+        };
+        if k == max {
+            first_run.fixes = Some(format!(">{max}"));
+            break;
+        }
+        let pred = r.mattes.get(f).cloned().unwrap_or_default();
+        let fix = correction(&cur, f, &pred);
+        if fix.is_empty() {
+            first_run.fixes = Some(format!(">{max}"));
+            break;
+        }
+        cur.strokes.extend(fix);
+    }
+    first
+}
+
+/// A fixed-width table of the runs, grouped by scenario.
+pub fn table(runs: &[Run]) -> String {
+    let mut out = format!(
+        "{:<10} {:<12} {:>8} {:>8} {:>8} {:>10} {:>9} {:>6} {:>7}\n",
+        "clip", "tracker", "meanIoU", "minIoU", "flicker", "after ret.", "s/frame", "fixes", "peakMB"
+    );
+    for r in runs {
+        let back = r.after_return.map_or_else(|| "-".to_string(), |v| format!("{v:.3}"));
+        out.push_str(&format!(
+            "{:<10} {:<12} {:>8.3} {:>8.3} {:>8.3} {:>10} {:>9.3} {:>6} {:>7}\n",
+            r.scenario,
+            r.tracker,
+            r.mean_iou,
+            r.min_iou,
+            r.flicker,
+            back,
+            r.secs_per_frame,
+            r.fixes.as_deref().unwrap_or("-"),
+            r.peak_mb.map_or_else(|| "-".to_string(), |v| format!("{v:.0}"))
+        ));
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn area(v: &[u8]) -> usize {
+        v.iter().filter(|x| **x != 0).count()
+    }
+
+    #[test]
+    fn scenarios_have_the_events_they_claim() {
+        let all = scenarios(24);
+        assert_eq!(all.len(), 4);
+        for s in &all {
+            assert_eq!((s.frames.len(), s.truth.len()), (24, 24), "{}", s.name);
+        }
+        let full = all.first().map(|s| area(&s.truth[0])).unwrap_or(0);
+        assert!(full > 3000, "{full}");
+        let occ = all.iter().find(|s| s.name == "occlusion").map(|s| s.truth.iter().map(|t| area(t)).min().unwrap_or(0)).unwrap_or(full);
+        assert!(occ < full / 2, "occluded minimum {occ} of {full}");
+        let gone = all.iter().find(|s| s.name == "reenter").map(|s| s.truth.iter().filter(|t| area(t) == 0).count()).unwrap_or(0);
+        assert!(gone > 0, "the disk never leaves");
+        assert!(all.iter().find(|s| s.name == "reenter").is_some_and(|s| area(s.truth.last().map_or(&[][..], |v| v)) > 0), "it must come back");
+    }
+
+    #[test]
+    fn classical_tracks_plain_motion_and_the_table_lists_it() {
+        let all = scenarios(24);
+        let Some(sc) = all.first() else { return };
+        let run = run_flow(sc, "classical", None);
+        assert!(run.mean_iou > 0.9, "mean IoU {}", run.mean_iou);
+        assert_eq!(run.per_frame.len(), 24);
+        assert!(table(&[run]).contains("classical"));
+    }
+
+    #[test]
+    fn corrections_are_counted_until_every_frame_reaches_the_target() {
+        let all = scenarios(24);
+        let classical = |s: &Scenario| Some(run_flow(s, "classical", None));
+        // plain motion needs none
+        let easy = all.iter().find(|s| s.name == "move").and_then(|s| with_fixes(s, 0.9, 6, &classical)).unwrap();
+        assert_eq!(easy.fixes.as_deref(), Some("0"));
+        // after the disk has left and returned the classic engine has lost it: it needs a correction (or never gets there)
+        let hard = all.iter().find(|s| s.name == "reenter").and_then(|s| with_fixes(s, 0.9, 6, &classical)).unwrap();
+        assert_ne!(hard.fixes.as_deref(), Some("0"), "{:?}", hard.fixes);
+        assert!(table(&[easy, hard]).contains("fixes"));
+    }
+
+    #[test]
+    fn a_users_clip_becomes_a_scenario_and_bad_ones_are_refused() {
+        let all = scenarios(24);
+        let src = all.iter().find(|s| s.name == "move").unwrap();
+        let sc = scenario_from("mine", src.frames.clone(), src.truth.clone()).unwrap();
+        assert_eq!((sc.w, sc.h, sc.base), (W as usize, H as usize, 0));
+        assert!(sc.strokes.iter().any(|s| s.kind == StrokeKind::Fg) && sc.strokes.iter().any(|s| s.kind == StrokeKind::Bg));
+        let run = run_flow(&sc, "classical", None);
+        assert!(run.mean_iou > 0.9, "{}", run.mean_iou);
+        assert!(scenario_from("x", vec![], vec![]).is_err());
+        assert!(scenario_from("x", src.frames.clone(), src.truth[..3].to_vec()).is_err());
+        assert!(scenario_from("x", src.frames.clone(), vec![vec![0; sc.w * sc.h]; src.frames.len()]).is_err(), "no object anywhere");
+        let mut short = src.truth.clone();
+        short[0].pop();
+        assert!(scenario_from("x", src.frames.clone(), short).is_err());
+    }
+
+    #[test]
+    fn tiny_clip_requests_are_clamped() {
+        assert!(scenarios(0).iter().all(|s| s.frames.len() == 12));
+    }
+}
diff --git a/crates/track/src/roto/matting.rs b/crates/track/src/roto/matting.rs
index 439d9c43e..ff6e33162 100644
--- a/crates/track/src/roto/matting.rs
+++ b/crates/track/src/roto/matting.rs
@@ -45,36 +45,46 @@ fn dt1(f: &[f32], d: &mut [f32], v: &mut [usize], z: &mut [f64]) {
     }
 }
 
+/// Scratch vectors (`f`, `v`, `z`) for `dt1` over a line of `n` samples; sized per pass so a
+/// 1 x N image does not allocate N-sized buffers for each of its N one-pixel rows.
+fn line_scratch(n: usize) -> (Vec<f32>, Vec<usize>, Vec<f64>) {
+    (vec![0.0; n], vec![0; n], vec![0.0; n + 1])
+}
+
 /// Euclidean distance from every pixel to the nearest pixel where `seed` is true (BIG.sqrt()
 /// when there is none).
 pub fn distance(seed: &[bool], w: usize, h: usize) -> Vec<f32> {
     if w == 0 || h == 0 {
         return vec![];
     }
-    let mut g: Vec<f32> = seed.iter().map(|s| if *s { 0.0 } else { BIG }).collect();
-    // Columns.
-    let cols: Vec<Vec<f32>> = (0..w)
-        .into_par_iter()
-        .map(|x| {
-            let f: Vec<f32> = (0..h).map(|y| g[y * w + x]).collect();
-            let mut d = vec![0.0; h];
-            let (mut v, mut z) = (vec![0usize; h], vec![0.0f64; h + 1]);
-            dt1(&f, &mut d, &mut v, &mut z);
-            d
-        })
-        .collect();
-    for (x, c) in cols.iter().enumerate() {
-        for y in 0..h {
-            g[y * w + x] = c[y];
-        }
-    }
-    // Rows.
-    g.par_chunks_mut(w).for_each(|row| {
-        let f = row.to_vec();
-        let (mut v, mut z) = (vec![0usize; w], vec![0.0f64; w + 1]);
-        dt1(&f, row, &mut v, &mut z);
-    });
-    g.par_iter_mut().for_each(|v| *v = v.sqrt());
+    // dt1 needs its input intact while it writes the output, so each line goes through scratch
+    // (`f`, `v`, `z`) that rayon creates once per work split, not once per line. The column pass
+    // runs on a transposed copy so that every column is a contiguous chunk.
+    // Columns: `t[x * h + y]` is pixel (x, y).
+    let mut t = vec![0.0f32; w * h];
+    t.par_chunks_mut(h).enumerate().for_each_init(
+        || line_scratch(h),
+        |(f, v, z), (x, col)| {
+            for (y, fv) in f.iter_mut().enumerate() {
+                *fv = if seed.get(y * w + x).copied().unwrap_or(false) { 0.0 } else { BIG };
+            }
+            dt1(f, col, v, z);
+        },
+    );
+    // Rows, then the square root.
+    let mut g = vec![0.0f32; w * h];
+    g.par_chunks_mut(w).enumerate().for_each_init(
+        || line_scratch(w),
+        |(f, v, z), (y, row)| {
+            for (x, fv) in f.iter_mut().enumerate() {
+                *fv = t[x * h + y];
+            }
+            dt1(f, row, v, z);
+            for d in row.iter_mut() {
+                *d = d.sqrt();
+            }
+        },
+    );
     g
 }
 
@@ -135,13 +145,21 @@ pub fn box_mean(src: &[f32], w: usize, h: usize, r: usize) -> Vec<f32> {
     out
 }
 
+/// Box radius of [`gauss`]: three passes of it match the variance, 3·((2r+1)² − 1)/12 = σ².
+/// `None` when the blur is a copy.
+fn gauss_box(sigma: f64) -> Option<usize> {
+    (sigma >= 0.3).then(|| (((4.0 * sigma * sigma + 1.0).sqrt() - 1.0) / 2.0).round().max(1.0) as usize)
+}
+
+/// How far (pixels, per axis) [`gauss`] reaches: an output pixel depends only on the input
+/// within this distance.
+pub fn gauss_reach(sigma: f64) -> usize {
+    gauss_box(sigma).map_or(0, |r| 3 * r)
+}
+
 /// Approximate Gaussian blur (three box passes) with standard deviation `sigma` pixels.
 pub fn gauss(src: &[f32], w: usize, h: usize, sigma: f64) -> Vec<f32> {
-    if sigma < 0.3 {
-        return src.to_vec();
-    }
-    // Box radius whose three passes match the variance: 3·((2r+1)² − 1)/12 = σ².
-    let r = (((4.0 * sigma * sigma + 1.0).sqrt() - 1.0) / 2.0).round().max(1.0) as usize;
+    let Some(r) = gauss_box(sigma) else { return src.to_vec() };
     let a = box_mean(src, w, h, r);
     let b = box_mean(&a, w, h, r);
     box_mean(&b, w, h, r)
@@ -200,7 +218,8 @@ pub fn guided_filter(img: &[[f32; 3]], p: &[f32], w: usize, h: usize, r: usize,
 /// (K. He, J. Sun and X. Tang, "Fast Matting Using Large Kernel Matting Laplacian Matrices",
 /// CVPR 2010): `(L·x)ᵢ = Σ_{k∋i} (xᵢ − a_kᵀIᵢ − b_k)` with `(a_k, b_k)` the ridge-regression
 /// fit of `x` to the colours in window k.
-pub fn closed_form(img: &[[f32; 3]], init: &[f32], known: &[bool], w: usize, h: usize, r: usize, eps: f32, iters: usize) -> Vec<f32> {
+pub fn closed_form(img: &[[f32; 3]], init: &[f32], known: &[bool], size: (usize, usize), r: usize, eps: f32, iters: usize) -> Vec<f32> {
+    let (w, h) = size;
     let n = w * h;
     if n == 0 || known.iter().all(|k| *k) {
         return init.to_vec();
@@ -430,6 +449,88 @@ pub fn motion_blur(a: &[f32], w: usize, h: usize, v: [f64; 2], samples: usize) -
 mod tests {
     use super::*;
 
+    #[test]
+    fn line_scratch_is_sized_to_the_line_not_the_image() {
+        let (f, v, z) = line_scratch(1);
+        assert_eq!((f.len(), v.len(), z.len()), (1, 1, 2));
+        // A 1 x N image: every row job needs one sample, every column job N.
+        let (w, h) = (1usize, 50_000usize);
+        let seed: Vec<bool> = (0..w * h).map(|i| i == 777).collect();
+        let d = distance(&seed, w, h);
+        let r = distance_reference(&seed, w, h);
+        assert!(d.iter().zip(&r).all(|(a, b)| a.to_bits() == b.to_bits()));
+    }
+
+    /// The distance transform as it was before the scratch reuse (one set of vectors per line).
+    fn distance_reference(seed: &[bool], w: usize, h: usize) -> Vec<f32> {
+        if w == 0 || h == 0 {
+            return vec![];
+        }
+        let mut g: Vec<f32> = seed.iter().map(|s| if *s { 0.0 } else { BIG }).collect();
+        let cols: Vec<Vec<f32>> = (0..w)
+            .map(|x| {
+                let f: Vec<f32> = (0..h).map(|y| g[y * w + x]).collect();
+                let mut d = vec![0.0; h];
+                let (mut v, mut z) = (vec![0usize; h], vec![0.0f64; h + 1]);
+                dt1(&f, &mut d, &mut v, &mut z);
+                d
+            })
+            .collect();
+        for (x, c) in cols.iter().enumerate() {
+            for y in 0..h {
+                g[y * w + x] = c[y];
+            }
+        }
+        for row in g.chunks_mut(w) {
+            let f = row.to_vec();
+            let (mut v, mut z) = (vec![0usize; w], vec![0.0f64; w + 1]);
+            dt1(&f, row, &mut v, &mut z);
+        }
+        g.iter().map(|v| v.sqrt()).collect()
+    }
+
+    #[test]
+    fn distance_is_bit_identical_to_the_per_line_version() {
+        let disk =
+            |w: usize, h: usize, cx: f64, cy: f64, r: f64| -> Vec<bool> { (0..w * h).map(|i| ((i % w) as f64 - cx).hypot((i / w) as f64 - cy) <= r).collect() };
+        let cases: Vec<(usize, usize, Vec<bool>)> = vec![
+            (64, 48, disk(64, 48, 30.0, 20.0, 11.0)),
+            (64, 48, disk(64, 48, 30.0, 20.0, 11.0).iter().map(|b| !b).collect()),
+            (97, 1, (0..97).map(|i| i % 13 == 0).collect()),
+            (1, 97, (0..97).map(|i| i % 17 == 5).collect()),
+            (40, 30, vec![true; 1200]),
+            (40, 30, vec![false; 1200]),
+            (40, 30, (0..1200).map(|i| i % 40 == 39 || i / 40 == 0).collect()),
+            (333, 211, (0..333 * 211).map(|i| (i * 7919) % 1031 == 0).collect()),
+        ];
+        for (w, h, seed) in cases {
+            let a = distance(&seed, w, h);
+            let b = distance_reference(&seed, w, h);
+            assert_eq!(a.len(), b.len());
+            for (i, (x, y)) in a.iter().zip(&b).enumerate() {
+                assert_eq!(x.to_bits(), y.to_bits(), "{w}x{h} pixel {i}: {x} vs {y}");
+            }
+        }
+        assert!(distance(&[], 0, 5).is_empty());
+    }
+
+    /// `cargo test --release -p effectcraft-track distance_bench -- --ignored --nocapture`
+    /// (set `RAYON_NUM_THREADS` to compare thread counts).
+    #[test]
+    #[ignore]
+    fn distance_bench() {
+        let (w, h) = (1920, 1080);
+        let seed: Vec<bool> = (0..w * h).map(|i| ((i % w) as f64 - 960.0).hypot((i / w) as f64 - 540.0) <= 300.0).collect();
+        let mut times = vec![];
+        for _ in 0..15 {
+            let t = std::time::Instant::now();
+            std::hint::black_box(distance(&seed, w, h));
+            times.push(t.elapsed().as_secs_f64() * 1000.0);
+        }
+        times.sort_by(f64::total_cmp);
+        eprintln!("distance 1080p, {} threads: median {:.2} ms", rayon::current_num_threads(), times[times.len() / 2]);
+    }
+
     #[test]
     fn distance_matches_brute_force() {
         let (w, h) = (23, 17);
diff --git a/crates/track/src/roto/refine.rs b/crates/track/src/roto/refine.rs
index 2a498e286..71f9261b2 100644
--- a/crates/track/src/roto/refine.rs
+++ b/crates/track/src/roto/refine.rs
@@ -123,7 +123,7 @@ pub fn matte_alpha(
             q[j] = if band[j] { q[j].clamp(0.0, 1.0) } else { cp[j] };
         }
         if p.higher_quality {
-            q = matting::closed_form(&cimg, &q, &outside, cw, ch, 1, 1e-5 * (1.0 + p.smooth.max(0.0)) as f32, 50);
+            q = matting::closed_form(&cimg, &q, &outside, (cw, ch), 1, 1e-5 * (1.0 + p.smooth.max(0.0)) as f32, 50);
         }
         // Refine Edge Matte adjustments.
         if p.smooth > 1.0 {
@@ -177,7 +177,8 @@ pub fn matte_alpha(
 /// Decontaminate edge colours of `rgb` in place for the matte `alpha` (see
 /// [`matting::decontaminate`]); returns the decontamination map. `band`: the Refine Edge band
 /// (pixels where decontamination always applies).
-pub fn decontaminate(rgb: &mut [[f32; 3]], alpha: &[f32], band: &[u8], w: usize, h: usize, p: &MatteParams, band_radius: f64, scale: f64) -> Vec<f32> {
+pub fn decontaminate(rgb: &mut [[f32; 3]], alpha: &[f32], band: &[u8], size: (usize, usize), p: &MatteParams, band_radius: f64, scale: f64) -> Vec<f32> {
+    let (w, h) = size;
     if !p.decontaminate {
         return vec![0.0; w * h];
     }
diff --git a/crates/track/src/roto/rle.rs b/crates/track/src/roto/rle.rs
index 308b2689a..914bcad83 100644
--- a/crates/track/src/roto/rle.rs
+++ b/crates/track/src/roto/rle.rs
@@ -17,6 +17,10 @@ pub fn base64_encode(data: &[u8]) -> String {
 }
 
 pub fn base64_decode(s: &str) -> Option<Vec<u8>> {
+    base64_decode_bounded(s, usize::MAX)
+}
+
+fn base64_decode_bounded(s: &str, max_bytes: usize) -> Option<Vec<u8>> {
     let val = |c: u8| -> Option<u32> {
         Some(match c {
             b'A'..=b'Z' => (c - b'A') as u32,
@@ -27,13 +31,25 @@ pub fn base64_decode(s: &str) -> Option<Vec<u8>> {
             _ => return None,
         })
     };
-    let bytes: Vec<u8> = s.bytes().filter(|c| !c.is_ascii_whitespace()).collect();
-    if !bytes.len().is_multiple_of(4) {
+    let significant = s.bytes().filter(|c| !c.is_ascii_whitespace()).count();
+    let max_encoded = max_bytes.checked_add(2).and_then(|n| n.checked_div(3)).and_then(|n| n.checked_mul(4)).unwrap_or(usize::MAX);
+    if !significant.is_multiple_of(4) || significant > max_encoded {
         return None;
     }
-    let mut out = Vec::with_capacity(bytes.len() / 4 * 3);
+    let mut bytes = Vec::new();
+    bytes.try_reserve_exact(significant).ok()?;
+    bytes.extend(s.bytes().filter(|c| !c.is_ascii_whitespace()));
+    let decoded_len = bytes.len().checked_div(4)?.checked_mul(3)?;
+    if decoded_len > max_bytes.saturating_add(2) {
+        return None;
+    }
+    let mut out = Vec::new();
+    out.try_reserve_exact(decoded_len.min(max_bytes)).ok()?;
     for c in bytes.chunks(4) {
         let pad = c.iter().rev().take_while(|b| **b == b'=').count();
+        if pad > 2 || c[..4 - pad].contains(&b'=') {
+            return None;
+        }
         let mut n = 0u32;
         for (i, b) in c.iter().enumerate() {
             n |= if *b == b'=' { 0 } else { val(*b)? } << (18 - 6 * i);
@@ -96,36 +112,66 @@ pub fn encode(values: &[u8]) -> String {
     base64_encode(&out)
 }
 
-/// Decode [`encode`]'s output (None when malformed).
-pub fn decode(s: &str) -> Option<Vec<u8>> {
-    let data = base64_decode(s)?;
-    let mut pos = 0;
-    let n = get(&data, &mut pos)? as usize;
-    if n > 1 << 30 {
+/// Decode [`encode`]'s output (None when malformed or larger than the caller's validated plane).
+pub fn decode_bounded(s: &str, max_len: usize) -> Option<Vec<u8>> {
+    let encoded_limit = max_len.saturating_mul(16).saturating_add(128);
+    if s.len() > encoded_limit {
         return None;
     }
-    let mut out = Vec::with_capacity(n);
+    // An alternating byte plane takes at most one value byte and a ten-byte varint per
+    // pixel, plus the declared-length varint.
+    let decoded_limit = max_len.saturating_mul(11).saturating_add(10);
+    let data = base64_decode_bounded(s, decoded_limit)?;
+    let mut pos = 0;
+    let n = usize::try_from(get(&data, &mut pos)?).ok()?;
+    if n > max_len {
+        return None;
+    }
+    let mut out = Vec::new();
+    out.try_reserve_exact(n).ok()?;
     while out.len() < n {
         let v = *data.get(pos)?;
         pos += 1;
-        let run = get(&data, &mut pos)? as usize;
-        if out.len() + run > n {
+        let run = usize::try_from(get(&data, &mut pos)?).ok()?;
+        let next = out.len().checked_add(run)?;
+        if run == 0 || next > n {
             return None;
         }
-        out.resize(out.len() + run, v);
+        out.resize(next, v);
     }
     Some(out)
 }
 
+/// Decode [`encode`]'s output, capped at the standard matte-plane limit.
+pub fn decode(s: &str) -> Option<Vec<u8>> {
+    decode_bounded(s, MAX_PLANE_BYTES)
+}
+
+/// Maximum frozen matte plane size (256 MiB at one byte per pixel).
+pub const MAX_PLANE_BYTES: usize = 256 * 1024 * 1024;
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn refuses_oversized_and_zero_runs_before_expansion() {
+        let mut declared = Vec::new();
+        put(&mut declared, 1024);
+        declared.extend_from_slice(&[255, 0x80, 0x08]); // 1024-byte run
+        assert!(decode_bounded(&base64_encode(&declared), 16).is_none());
+        let mut zero_run = Vec::new();
+        put(&mut zero_run, 1);
+        zero_run.extend_from_slice(&[0, 0]);
+        assert!(decode_bounded(&base64_encode(&zero_run), 16).is_none());
+        assert!(decode_bounded(&"A".repeat(100_000), 16).is_none());
+    }
+
     #[test]
     fn round_trips() {
         for n in [0usize, 1, 2, 3, 4, 5, 100, 1000] {
             let v: Vec<u8> = (0..n).map(|i| ((i / 7) % 3) as u8 * 100).collect();
-            assert_eq!(decode(&encode(&v)).unwrap(), v);
+            assert_eq!(decode(&encode(&v)).unwrap(), v, "RLE n={n}");
             let raw: Vec<u8> = (0..n).map(|i| (i * 31) as u8).collect();
             assert_eq!(base64_decode(&base64_encode(&raw)).unwrap(), raw);
         }
diff --git a/crates/track/src/roto/tests.rs b/crates/track/src/roto/tests.rs
index 65d1743f9..e50dbbce8 100644
--- a/crates/track/src/roto/tests.rs
+++ b/crates/track/src/roto/tests.rs
@@ -65,7 +65,13 @@ pub(crate) fn frame_at(c: [f64; 2]) -> (Image, Vec<u8>) {
 }
 
 fn line(kind: StrokeKind, frame: i64, a: [f64; 2], b: [f64; 2], radius: f64) -> Stroke {
-    Stroke { kind, frame, radius, points: (0..=10).map(|k| [a[0] + (b[0] - a[0]) * k as f64 / 10.0, a[1] + (b[1] - a[1]) * k as f64 / 10.0]).collect() }
+    Stroke {
+        kind,
+        frame,
+        radius,
+        points: (0..=10).map(|k| [a[0] + (b[0] - a[0]) * k as f64 / 10.0, a[1] + (b[1] - a[1]) * k as f64 / 10.0]).collect(),
+        object: 0,
+    }
 }
 
 /// The strokes an artist would paint on frame `f`: one through the disk, one around it.
@@ -95,6 +101,21 @@ fn strokes_segment_the_base_frame() {
     assert!(bytes.len() < seg.w * seg.h / 4, "{} bytes", bytes.len());
     assert!(FrameSeg::from_bytes(&bytes[..bytes.len() - 1]).is_none());
     assert!(FrameSeg::from_bytes(b"nope").is_none());
+
+    // Untrusted plane dimensions and run lengths are rejected before allocation/resize.
+    let mut hostile = b"ECSG".to_vec();
+    hostile.extend_from_slice(&u32::MAX.to_le_bytes());
+    hostile.extend_from_slice(&u32::MAX.to_le_bytes());
+    hostile.extend_from_slice(&0u32.to_le_bytes());
+    assert!(FrameSeg::from_bytes(&hostile).is_none());
+    let mut overrun = bytes.clone();
+    let plane_at = 16 + u32::from_le_bytes(bytes[12..16].try_into().unwrap()) as usize;
+    overrun[plane_at..plane_at + 2].copy_from_slice(&u16::MAX.to_le_bytes());
+    assert!(FrameSeg::from_bytes(&overrun).is_none());
+    let mut trailing = bytes.clone();
+    trailing.push(0);
+    assert!(FrameSeg::from_bytes(&trailing).is_none());
+    assert_eq!(FrameSeg::empty(usize::MAX, 2), FrameSeg::default());
 }
 
 #[test]
@@ -167,6 +188,28 @@ fn a_correction_stroke_fixes_a_bad_frame() {
     assert!(iou(&next.matte, &gt2) > 0.93);
 }
 
+/// A stroke corrects the ones painted before it: foreground over an earlier background stroke
+/// restores the area, and background over that removes it again.
+#[test]
+fn later_strokes_override_earlier_ones() {
+    let c = center(0);
+    let (img, gt) = frame_at(c);
+    let spot = [c[0], c[1] + 20.0];
+    let i = spot[1] as usize * W as usize + spot[0] as usize;
+    let red = line(StrokeKind::Bg, 0, [spot[0] - 6.0, spot[1]], [spot[0] + 6.0, spot[1]], 6.0);
+    let green = Stroke { kind: StrokeKind::Fg, ..red.clone() };
+    let seg = |st: &[Stroke]| segment(&img, &st.iter().collect::<Vec<_>>(), None, &SegOpts::default(), 0.0);
+    let mut st = base_strokes(0);
+    st.push(red.clone());
+    assert_eq!(seg(&st).matte[i], 0, "background over the disk removes it");
+    st.push(green);
+    let restored = seg(&st);
+    assert_eq!(restored.matte[i], 1, "foreground over the background stroke restores it");
+    assert!(iou(&restored.matte, &gt) > 0.95, "IoU {}", iou(&restored.matte, &gt));
+    st.push(red);
+    assert_eq!(seg(&st).matte[i], 0, "background again removes it again");
+}
+
 /// A soft-edged disk (alpha ramp over `width` pixels) over a background.
 fn soft_frame(c: [f64; 2], width: f64, fg: [f32; 3], bg: [f32; 3]) -> (Image, Vec<f32>) {
     let mut img = Image::new(W, H);
@@ -194,6 +237,7 @@ fn ring(frame: i64, c: [f64; 2], r: f64, radius: f64) -> Stroke {
         frame,
         radius,
         points: (0..=48).map(|k| k as f64 / 48.0 * std::f64::consts::TAU).map(|a| [c[0] + r * a.cos(), c[1] + r * a.sin()]).collect(),
+        object: 0,
     }
 }
 
@@ -231,7 +275,7 @@ fn refine_edge_recovers_a_soft_edge_and_decontaminates() {
     assert!(frac as f64 > 0.6 * n as f64, "{frac}/{n} fractional");
     // Decontamination: edge pixels' colour is the foreground's, not a blue blend.
     let mut col = rgb.clone();
-    let map = decontaminate(&mut col, &a, &seg.refine, W as usize, H as usize, &p, 9.0, 1.0);
+    let map = decontaminate(&mut col, &a, &seg.refine, (W as usize, H as usize), &p, 9.0, 1.0);
     let (mut blue_before, mut blue_after, mut m) = (0.0f64, 0.0f64, 0usize);
     for i in 0..a.len() {
         if a[i] > 0.2 && a[i] < 0.8 {
@@ -250,6 +294,31 @@ fn refine_edge_recovers_a_soft_edge_and_decontaminates() {
     assert!(a2.iter().zip(&seg.matte).all(|(x, y)| (*x - *y as f32).abs() < 1e-6));
 }
 
+/// Refine Edge strokes correct each other the same way: refine over an earlier erase restores
+/// the band there.
+#[test]
+fn later_refine_strokes_override_earlier_erases() {
+    let c = [100.0, 75.0];
+    let (img, _) = soft_frame(c, 10.0, [0.9, 0.25, 0.1], [0.1, 0.3, 0.9]);
+    let spot = [c[0] + R, c[1]];
+    let i = spot[1] as usize * W as usize + spot[0] as usize;
+    let erase = Stroke { kind: StrokeKind::RefineErase, frame: 0, radius: 6.0, points: vec![spot], object: 0 };
+    let refine = Stroke { kind: StrokeKind::Refine, ..erase.clone() };
+    let band = |st: &[Stroke]| segment(&img, &st.iter().collect::<Vec<_>>(), None, &SegOpts::default(), 9.0).refine[i];
+    let mut st = vec![
+        line(StrokeKind::Fg, 0, [c[0] - 15.0, c[1]], [c[0] + 15.0, c[1]], 5.0),
+        line(StrokeKind::Bg, 0, [c[0] - 60.0, c[1] - 55.0], [c[0] + 60.0, c[1] - 55.0], 5.0),
+        ring(0, c, R, 9.0),
+    ];
+    assert_eq!(band(&st), 1);
+    st.push(erase.clone());
+    assert_eq!(band(&st), 0, "erase removes the band");
+    st.push(refine);
+    assert_eq!(band(&st), 1, "refine over the erase restores it");
+    st.push(erase);
+    assert_eq!(band(&st), 0, "erase again removes it again");
+}
+
 #[test]
 fn reduce_chatter_and_motion_blur_use_the_neighbours() {
     let (w, h) = (40usize, 20usize);
@@ -327,7 +396,7 @@ fn roto_perf_1080p() {
     let mut seg2 = next.clone();
     let c = center(1);
     let ring: Vec<[f64; 2]> = (0..=64).map(|k| k as f64 / 64.0 * std::f64::consts::TAU).map(|t| [(c[0] + R * t.cos()) * s, (c[1] + R * t.sin()) * s]).collect();
-    let st = [Stroke { kind: StrokeKind::Refine, frame: 1, radius: 20.0, points: ring }];
+    let st = [Stroke { kind: StrokeKind::Refine, frame: 1, radius: 20.0, points: ring, object: 0 }];
     let r = rasterize(&st.iter().collect::<Vec<_>>(), &[StrokeKind::Refine], 1.0, 1920, 1080);
     seg2.refine = r.iter().map(|v| *v as u8).collect();
     let rgb = rgb_of(&b);
@@ -358,9 +427,8 @@ impl effectcraft_segment::MaskModel for FakeModel {
 }
 
 /// A grey bar on a two-tone background whose halves match the bar's halves: colour alone can't
-/// find its edge, a model can.
-#[test]
-fn a_model_prior_shapes_the_cut_and_bad_models_are_ignored() {
+/// find its edge, a model can. The frame, its truth and the bar's rectangle.
+fn bar_frame() -> (Image, Vec<u8>, [usize; 4]) {
     let (w, h) = (160usize, 100usize);
     let rect = [40, 30, 120, 70];
     let mut img = Image::new(w as u32, h as u32);
@@ -375,6 +443,12 @@ fn a_model_prior_shapes_the_cut_and_bad_models_are_ignored() {
             gt[y * w + x] = inside as u8;
         }
     }
+    (img, gt, rect)
+}
+
+#[test]
+fn a_model_prior_shapes_the_cut_and_bad_models_are_ignored() {
+    let (img, gt, rect) = bar_frame();
     let st = [line(StrokeKind::Fg, 0, [50.0, 50.0], [110.0, 50.0], 4.0)];
     let refs: Vec<&Stroke> = st.iter().collect();
     let opts = SegOpts::default();
@@ -433,20 +507,326 @@ fn mobilesam_segments_and_propagates_the_disk() {
 /// ignores it; a prior's box does not replace it.
 #[test]
 fn box_stroke_is_the_model_box_prompt() {
-    let fg = Stroke { kind: StrokeKind::Fg, frame: 0, radius: 2.0, points: vec![[50.0, 40.0]] };
-    let bx = Stroke { kind: StrokeKind::Box, frame: 0, radius: 0.0, points: vec![[80.0, 60.0], [20.0, 10.0]] };
-    let p = stroke_prompt(&[&fg, &bx], 0.5);
+    let fg = Stroke { kind: StrokeKind::Fg, frame: 0, radius: 2.0, points: vec![[50.0, 40.0]], object: 0 };
+    let bx = Stroke { kind: StrokeKind::Box, frame: 0, radius: 0.0, points: vec![[80.0, 60.0], [20.0, 10.0]], object: 0 };
+    let p = stroke_prompt(&[&fg, &bx], &[], 0.5, 0, 0);
     assert_eq!(p.bbox, Some([10.0, 5.0, 40.0, 30.0]));
     assert_eq!(p.points, vec![([25.0, 20.0], true)]);
     // Degenerate or non-finite boxes are no prompt.
     for pts in [vec![[20.0, 10.0]], vec![[20.0, 10.0], [20.0, 50.0]], vec![[f64::NAN, 10.0], [80.0, 60.0]]] {
         let b = Stroke { points: pts, ..bx.clone() };
-        assert_eq!(stroke_prompt(&[&fg, &b], 1.0).bbox, None);
+        assert_eq!(stroke_prompt(&[&fg, &b], &[], 1.0, 0, 0).bbox, None);
     }
     assert!(!StrokeKind::Box.is_segmentation());
     assert!(rasterize(&[&bx], &[StrokeKind::Fg, StrokeKind::Bg], 1.0, 100, 80).iter().all(|v| !v));
-    let mut q = stroke_prompt(&[&fg, &bx], 1.0);
+    let mut q = stroke_prompt(&[&fg, &bx], &[], 1.0, 0, 0);
     let soft: Vec<f32> = (0..100 * 80).map(|i| ((i % 100) < 10) as u8 as f32).collect();
-    assert!(add_prior_prompt(&mut q, &soft, 100, 80));
+    assert!(add_prior_prompt(&mut q, &soft, &[], 100, 80));
     assert_eq!(q.bbox, Some([20.0, 10.0, 80.0, 60.0]));
 }
+
+/// A model is never prompted against the latest correction: stroke points that a later stroke
+/// of the other kind painted over are dropped, and the propagated matte's points and mask leave
+/// out what this frame's background strokes removed.
+#[test]
+fn model_prompts_follow_the_latest_stroke() {
+    let green = Stroke { kind: StrokeKind::Fg, frame: 0, radius: 4.0, points: vec![[50.0, 40.0]], object: 0 };
+    let red = Stroke { kind: StrokeKind::Bg, ..green.clone() };
+    let (w, h) = (100, 80);
+    let prompt = |st: &[&Stroke]| stroke_prompt(st, &resolve(st, StrokeKind::Fg, StrokeKind::Bg, 1.0, w, h), 1.0, w, h).points;
+    assert_eq!(prompt(&[&green, &red]), vec![([50.0, 40.0], false)]);
+    assert_eq!(prompt(&[&green, &red, &green]), vec![([50.0, 40.0], true); 2]);
+    let soft: Vec<f32> = (0..w * h).map(|i| ((i % w) < 50) as u8 as f32).collect();
+    let erase = Stroke { kind: StrokeKind::Bg, frame: 0, radius: 15.0, points: vec![[25.0, 40.0]], object: 0 };
+    let hard = resolve(&[&erase], StrokeKind::Fg, StrokeKind::Bg, 1.0, w, h);
+    let mut q = Prompt::default();
+    assert!(add_prior_prompt(&mut q, &soft, &hard, w, h));
+    assert!(!q.points.is_empty());
+    assert!(q.points.iter().all(|(p, fg)| *fg && owner(&hard, w, h, *p) != Some(HARD_BG)), "{:?}", q.points);
+    let mask = q.mask.unwrap();
+    assert!(hard.iter().zip(&mask).all(|(hd, m)| *hd != HARD_BG || *m == 0.0));
+}
+
+/// A stand-in model that counts its calls; its foreground is a fixed rectangle.
+struct CountingModel([usize; 4], std::sync::atomic::AtomicUsize);
+
+impl effectcraft_segment::MaskModel for CountingModel {
+    fn info(&self) -> &'static effectcraft_segment::ModelInfo {
+        &effectcraft_segment::MOBILE_SAM
+    }
+    fn segment(&self, _: &[[f32; 3]], w: usize, h: usize, _: &Prompt) -> Result<Vec<f32>, String> {
+        self.1.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let [x0, y0, x1, y1] = self.0;
+        Ok((0..w * h).map(|i| ((i % w) >= x0 && (i % w) < x1 && (i / w) >= y0 && (i / w) < y1) as u8 as f32 * 0.98 + 0.01).collect())
+    }
+}
+
+/// A small background correction in the middle of a large foreground dot removes the only point
+/// sampled along the dot, but most of the dot is still foreground: the model is still prompted
+/// with it, from a point inside what is left. A dot painted over completely prompts nothing.
+#[test]
+fn a_correction_keeps_the_model_prompted_with_what_is_left() {
+    let (img, gt, rect) = bar_frame();
+    let (w, h) = (img.width as usize, img.height as usize);
+    let dot = Stroke { kind: StrokeKind::Fg, frame: 0, radius: 15.0, points: vec![[80.0, 50.0]], object: 0 };
+    let tap = Stroke { kind: StrokeKind::Bg, radius: 2.0, ..dot.clone() };
+    let refs = [&dot, &tap];
+    let model = CountingModel(rect, Default::default());
+    let seg = segment_with(&img, &refs, None, &SegOpts::default(), 0.0, Some(&model));
+    assert_eq!(model.1.load(std::sync::atomic::Ordering::Relaxed), 1, "the model was prompted");
+    assert!(iou(&seg.matte, &gt) > 0.95, "IoU {}", iou(&seg.matte, &gt));
+    let hard = resolve(&refs, StrokeKind::Fg, StrokeKind::Bg, 1.0, w, h);
+    let fg: Vec<[f32; 2]> = stroke_prompt(&refs, &hard, 1.0, w, h).points.into_iter().filter(|p| p.1).map(|p| p.0).collect();
+    let [q] = fg.as_slice() else { panic!("one foreground point, got {fg:?}") };
+    let r = (q[0] - 80.0).hypot(q[1] - 50.0);
+    assert!(r > 5.0 && r < 13.0, "{q:?} sits inside what is left of the dot");
+    assert_eq!(hard[q[1] as usize * w + q[0] as usize], HARD_FG);
+    let cover = Stroke { radius: 16.0, ..tap };
+    let refs = [&dot, &cover];
+    let hard = resolve(&refs, StrokeKind::Fg, StrokeKind::Bg, 1.0, w, h);
+    assert!(stroke_prompt(&refs, &hard, 1.0, w, h).points.iter().all(|p| !p.1));
+}
+
+#[test]
+fn tracker_prompts_carry_a_handful_of_points() {
+    let st = base_strokes(0);
+    let refs: Vec<&Stroke> = st.iter().collect();
+    let p = tracker_prompt(&refs, 1.0, W as usize, H as usize);
+    let (fg, bg) = (p.points.iter().filter(|(_, f)| *f).count(), p.points.iter().filter(|(_, f)| !*f).count());
+    assert!((1..=TRACKER_FG_POINTS).contains(&fg) && (1..=TRACKER_BG_POINTS).contains(&bg), "{fg} fg, {bg} bg");
+    // a long, finely sampled stroke still gives at most the limit, and an empty one gives none
+    let long = Stroke { kind: StrokeKind::Fg, frame: 0, radius: 2.0, points: (0..400).map(|i| [i as f64 * 0.4, 50.0]).collect(), object: 0 };
+    assert!(tracker_prompt(&[&long], 1.0, W as usize, H as usize).points.len() <= TRACKER_FG_POINTS);
+    assert!(tracker_prompt(&[], 1.0, W as usize, H as usize).points.is_empty());
+}
+
+/// Tracker clicks follow the same correction order as the classic matte and model prompts.
+#[test]
+fn tracker_prompts_follow_latest_corrections_and_keep_remaining_foreground() {
+    let (w, h) = (100, 80);
+    let green = Stroke { kind: StrokeKind::Fg, frame: 0, radius: 15.0, points: vec![[50.0, 40.0]], object: 0 };
+    let red = Stroke { kind: StrokeKind::Bg, radius: 16.0, ..green.clone() };
+    for strokes in [&[&green, &red][..], &[&red, &green][..]] {
+        let classic = FrameSeg::empty(w, h);
+        for prompt in [tracker_prompt(strokes, 1.0, w, h), tracker_prompt_boxed(strokes, 1.0, &classic)] {
+            let expected = std::ptr::eq(strokes[1], &green);
+            assert_eq!(prompt.points.iter().any(|(_, fg)| *fg), expected, "{:?}", prompt.points);
+            let hard = resolve(strokes, StrokeKind::Fg, StrokeKind::Bg, 1.0, w, h);
+            for (point, fg) in &prompt.points {
+                assert_eq!(owner(&hard, w, h, *point), Some(if *fg { HARD_FG } else { HARD_BG }));
+            }
+            assert!(!prompt.points.is_empty());
+        }
+    }
+    // A small correction removes the sampled centre, while most of the foreground dot remains.
+    let tap = Stroke { radius: 2.0, ..red };
+    let strokes = [&green, &tap];
+    let hard = resolve(&strokes, StrokeKind::Fg, StrokeKind::Bg, 1.0, w, h);
+    for prompt in [tracker_prompt(&strokes, 1.0, w, h), tracker_prompt_boxed(&strokes, 1.0, &FrameSeg::empty(w, h))] {
+        assert!(prompt.points.iter().any(|(_, fg)| *fg));
+        assert!(prompt.points.iter().any(|(_, fg)| !*fg));
+        for (point, fg) in &prompt.points {
+            assert_eq!(owner(&hard, w, h, *point), Some(if *fg { HARD_FG } else { HARD_BG }));
+        }
+        assert!(prompt.points.iter().filter(|(_, fg)| *fg).count() <= TRACKER_FG_POINTS);
+        assert!(prompt.points.iter().filter(|(_, fg)| !*fg).count() <= TRACKER_BG_POINTS);
+    }
+}
+
+#[test]
+fn tracked_segmentation_handles_absent_objects_and_bad_maps() {
+    let (img, gt) = frame_at(center(0));
+    let st = base_strokes(0);
+    let refs: Vec<&Stroke> = st.iter().collect();
+    let opts = SegOpts::default();
+    let n = (W * H) as usize;
+    // a good map (the true disk) reproduces it, with the strokes as constraints
+    let soft: Vec<f32> = gt.iter().map(|v| f32::from(*v)).collect();
+    let seg = segment_tracked(&img, &refs, soft, false, &opts, 0.0);
+    assert!(iou(&seg.matte, &gt) > 0.95);
+    // an absent object (no strokes on the frame) is an empty matte, whatever the map says
+    let none = segment_tracked(&img, &[], vec![1.0; n], true, &opts, 0.0);
+    assert_eq!(none.area(), 0);
+    assert_eq!(segment_tracked(&img, &[], vec![0.0; n], false, &opts, 0.0).area(), 0);
+    // a map of the wrong size is ignored: the strokes alone segment the frame
+    let wrong = segment_tracked(&img, &refs, vec![1.0; 3], false, &opts, 0.0);
+    assert!(iou(&wrong.matte, &gt) > 0.95);
+}
+
+#[test]
+fn tracker_prompts_carry_the_box_of_the_classic_matte() {
+    let (img, gt) = frame_at(center(0));
+    let st = base_strokes(0);
+    let refs: Vec<&Stroke> = st.iter().collect();
+    let classic = segment(&img, &refs, None, &SegOpts::default(), 0.0);
+    let p = tracker_prompt_boxed(&refs, 1.0, &classic);
+    let b = p.bbox.expect("a box");
+    let c = center(0);
+    // the box reaches the disk's edges, with a margin
+    assert!(b[0] <= (c[0] - R) as f32 && b[0] > (c[0] - R) as f32 - 12.0, "{b:?}");
+    assert!(b[2] >= (c[0] + R) as f32 && b[2] < (c[0] + R) as f32 + 12.0, "{b:?}");
+    assert!(b[1] <= (c[1] - R) as f32 && b[3] >= (c[1] + R) as f32, "{b:?}");
+    assert!(iou(&classic.matte, &gt) > 0.95);
+    // no matte, no box; a box the user drew wins
+    let none = tracker_prompt_boxed(&refs, 1.0, &FrameSeg::empty(W as usize, H as usize));
+    assert_eq!(none.bbox, None);
+    let bx = Stroke { kind: StrokeKind::Box, frame: 0, radius: 0.0, points: vec![[10.0, 10.0], [50.0, 60.0]], object: 0 };
+    let mut with_box: Vec<&Stroke> = refs.clone();
+    with_box.push(&bx);
+    assert_eq!(tracker_prompt_boxed(&with_box, 1.0, &classic).bbox, Some([10.0, 10.0, 50.0, 60.0]));
+}
+
+#[test]
+fn strokes_carry_an_object_and_old_data_is_object_zero() {
+    // saved before objects existed: no field, and the field is not written for object 0
+    let old = r#"{"base":0,"span":[0,4],"strokes":[{"kind":"fg","frame":0,"radius":3.0,"points":[[1.0,2.0]]}]}"#;
+    let d = RotoData::from_json(old);
+    assert_eq!(d.strokes.first().map(|s| s.object), Some(0));
+    assert!(!d.to_json().contains("object"), "{}", d.to_json());
+    // the keys of existing projects do not change
+    let same = RotoData::from_json(&d.to_json());
+    assert_eq!(d.chain_keys(1), same.chain_keys(1));
+
+    let mut d = d;
+    d.add(Stroke { kind: StrokeKind::Fg, frame: 0, radius: 3.0, points: vec![[9.0, 9.0]], object: 2 }, 4, [0, 10]);
+    d.add(Stroke { kind: StrokeKind::Bg, frame: 0, radius: 3.0, points: vec![[0.0, 0.0]], object: 2 }, 4, [0, 10]);
+    d.add(Stroke { kind: StrokeKind::Refine, frame: 0, radius: 3.0, points: vec![[5.0, 5.0]], object: 0 }, 4, [0, 10]);
+    assert_eq!(d.objects(), vec![0, 2]);
+    assert!(d.to_json().contains("\"object\":2"));
+    assert_eq!(RotoData::from_json(&d.to_json()), d);
+    // an object's own strokes, plus the Refine Edge strokes that belong to the whole matte
+    assert_eq!(d.strokes_of(0, 2).len(), 3);
+    assert_eq!(d.strokes_of(0, 0).len(), 2);
+    assert!(d.strokes_of(0, 1).len() == 1);
+    // moving a stroke to another object changes the frame keys (the tracked frames are stale)
+    let before = d.chain_keys(1);
+    if let Some(s) = d.strokes.first_mut() {
+        s.object = 1;
+    }
+    assert_ne!(before, d.chain_keys(1));
+}
+
+#[test]
+fn the_union_of_objects_is_their_largest_extent() {
+    let seg = |cells: &[usize]| {
+        let mut s = FrameSeg::empty(4, 1);
+        for c in cells {
+            s.matte[*c] = 255;
+        }
+        s
+    };
+    let u = FrameSeg::union(vec![seg(&[0]), seg(&[2, 3]), seg(&[3])]);
+    assert_eq!(u.matte, vec![255, 0, 255, 255]);
+    assert_eq!(FrameSeg::union(vec![]).w, 0);
+    // a part of another size is ignored
+    let odd = FrameSeg::empty(2, 2);
+    assert_eq!(FrameSeg::union(vec![seg(&[1]), odd]).matte, vec![0, 255, 0, 0]);
+}
+
+/// A scene for the band re-cut: `rgb` of a `w`×`h` frame where the foreground is `inside`, with
+/// a background that turns red left of `x = 30` (far from most shapes), and a soft prior that is
+/// `inside` shifted by (3, 2) px with an edge `soft_edge` px wide.
+fn band_scene(w: usize, h: usize, inside: &dyn Fn(f64, f64) -> f64, soft_edge: f64) -> (Vec<[f32; 3]>, Vec<f32>) {
+    let mut rgb = vec![[0.0f32; 3]; w * h];
+    let mut soft = vec![0.0f32; w * h];
+    for y in 0..h {
+        for x in 0..w {
+            let (px, py) = (x as f64 + 0.5, y as f64 + 0.5);
+            let a = inside(px, py).clamp(0.0, 1.0) as f32;
+            let f = fg_color(px, py);
+            let b = if px < 30.0 { [0.9, 0.1, 0.1] } else { bg_color(px, py) };
+            rgb[y * w + x] = [f[0] * a + b[0] * (1.0 - a), f[1] * a + b[1] * (1.0 - a), f[2] * a + b[2] * (1.0 - a)];
+            soft[y * w + x] = (inside(px - 3.0, py - 2.0) / soft_edge + 0.5).clamp(0.0, 1.0) as f32;
+        }
+    }
+    (rgb, soft)
+}
+
+#[test]
+fn band_crop_matches_the_full_frame() {
+    let (w, h) = (200usize, 150usize);
+    // Signed coverage: > 0.5 inside, falling off by 1 per pixel across the edge.
+    let disk = |cx: f64, cy: f64, r: f64| move |x: f64, y: f64| r + 0.5 - (x - cx).hypot(y - cy);
+    let mid = disk(120.0, 80.0, 30.0);
+    let corner = disk(185.0, 10.0, 28.0);
+    let donut = move |x: f64, y: f64| (40.0 + 0.5 - (x - 110.0).hypot(y - 75.0)).min((x - 110.0).hypot(y - 75.0) - 14.0 + 0.5);
+    let nothing = |_: f64, _: f64| -10.0;
+    let shapes: [(&str, &dyn Fn(f64, f64) -> f64, f32, f64); 8] = [
+        ("disk", &mid, 8.0, 1.0),
+        ("frame corner", &corner, 8.0, 1.0),
+        ("donut", &donut, 6.0, 1.0),
+        ("r = 2, soft edge", &mid, 2.0, 3.0),
+        // A prior edge wider than the band: the blur sees prior values outside it.
+        ("r = 2, wide soft edge", &mid, 2.0, 10.0),
+        ("r = 3, wide soft edge at the corner", &corner, 3.0, 14.0),
+        ("r = 12, soft edge", &mid, 12.0, 4.0),
+        ("no foreground", &nothing, 8.0, 1.0),
+    ];
+    let mut changed = 0;
+    for (name, inside, r, edge) in shapes {
+        let (rgb, soft) = band_scene(w, h, inside, edge);
+        let start: Vec<u8> = soft.iter().map(|v| (*v >= 0.5) as u8).collect();
+        let fitted = fit_models(&rgb, &start);
+        // Equal models leave the cut to the prior and the smoothness term, which makes it
+        // sensitive to the blurred prior.
+        for models in [None, Some((&fitted.0, &fitted.1)), Some((&fitted.1, &fitted.1))] {
+            let (mut full, mut crop) = (start.clone(), start.clone());
+            recut_band(&rgb, (w, h), &mut full, &soft, r, models, false);
+            recut_band(&rgb, (w, h), &mut crop, &soft, r, models, true);
+            let diff = full.iter().zip(&crop).filter(|(a, b)| a != b).count();
+            assert_eq!(diff, 0, "{name}, models {}: {diff} pixels differ", if models.is_some() { "given" } else { "fitted" });
+            changed += full.iter().zip(&start).filter(|(a, b)| a != b).count();
+        }
+    }
+    // The cut did move edges (the prior is offset from the shapes).
+    assert!(changed > 100, "{changed}");
+}
+
+/// Padded by the blur's reach, the crop blurs the prior exactly as the full frame does at every
+/// band pixel (up to the summation rounding of the box sums); a 1 px pad does not when the prior
+/// edge is wider than the band.
+#[test]
+fn band_rect_pad_covers_the_prior_blur() {
+    let (w, h) = (200usize, 150usize);
+    let mid = |x: f64, y: f64| 30.5 - (x - 120.0).hypot(y - 80.0);
+    let corner = |x: f64, y: f64| 28.5 - (x - 185.0).hypot(y - 10.0);
+    let cases: [(&dyn Fn(f64, f64) -> f64, f32, f64); 4] = [(&mid, 8.0, 1.0), (&mid, 2.0, 10.0), (&corner, 3.0, 14.0), (&mid, 12.0, 30.0)];
+    for (inside, r, edge) in cases {
+        let (_, soft) = band_scene(w, h, inside, edge);
+        let labels: Vec<u8> = soft.iter().map(|v| (*v >= 0.5) as u8).collect();
+        let sd = matting::signed_distance(&labels, w, h);
+        let sigma = (r as f64 / 4.0).max(1.0);
+        let full = matting::gauss(&soft, w, h, sigma);
+        let worst = |pad: usize| -> f32 {
+            let rect = band_rect(&sd, (w, h), r, pad).unwrap();
+            let [x0, y0, x1, y1] = rect;
+            let blurred = matting::gauss(&crop_of(&soft, w, rect), x1 - x0, y1 - y0, sigma);
+            let mut worst = 0.0f32;
+            for y in y0..y1 {
+                for x in x0..x1 {
+                    if sd[y * w + x].abs() <= r {
+                        worst = worst.max((blurred[(y - y0) * (x1 - x0) + x - x0] - full[y * w + x]).abs());
+                    }
+                }
+            }
+            worst
+        };
+        let reach = matting::gauss_reach(sigma);
+        assert!(worst(reach) < 1e-6, "r {r}, edge {edge}: {}", worst(reach));
+        if edge > 2.0 * r as f64 {
+            assert!(worst(1) > 1e-4, "r {r}, edge {edge}: a 1 px pad should differ, {}", worst(1));
+        }
+    }
+}
+
+#[test]
+fn propagate_survives_empty_frames() {
+    let opts = SegOpts::default();
+    for (w, h) in [(4u32, 0u32), (0, 4), (0, 0)] {
+        let img = Image::new(w, h);
+        let prev = FrameSeg::empty(w as usize, h as usize);
+        let next = propagate(&img, &prev, &img, &[], &opts, 0.0);
+        assert_eq!((next.w, next.h), (w as usize, h as usize));
+        assert!(next.matte.is_empty());
+    }
+}
diff --git a/crates/track/src/stabilize.rs b/crates/track/src/stabilize.rs
index 9769fcbd0..092fc4ab4 100644
--- a/crates/track/src/stabilize.rs
+++ b/crates/track/src/stabilize.rs
@@ -156,10 +156,27 @@ impl Analyzer {
 
     /// Analyse the next frame.
     pub fn push(&mut self, frame: &Frame) {
+        self.push_impl(frame, !self.opts.detailed);
+    }
+
+    fn push_impl(&mut self, frame: &Frame, share_pyramid: bool) {
+        let share_pyramid = share_pyramid && !self.opts.detailed;
         let (max_side, max_feat) = if self.opts.detailed { (960, 700) } else { (480, 350) };
         let factor = analysis_factor(frame.img.width, frame.img.height, max_side);
-        let pyr = GrayPyramid::from_image(frame.img, frame.offset, factor, 3);
-        self.trajectories.push(frame);
+        let mut pyr = GrayPyramid::from_image(frame.img, frame.offset, factor, if share_pyramid { 4 } else { 3 });
+        if share_pyramid {
+            self.trajectories.push_pyramid(self.prev.as_ref(), &pyr);
+        } else {
+            // Detailed analysis uses different downsampling factors for motion and trajectories.
+            self.trajectories.push(frame);
+        }
+        // Motion tracking historically used only three extra levels. Temporarily remove
+        // the trajectory tracker's fourth level without cloning any planes or gradients.
+        let extra = if share_pyramid && pyr.levels.len() > 4 { pyr.levels.pop().zip(pyr.grads.pop()) } else { None };
+        if share_pyramid && let Some(prev) = &mut self.prev {
+            prev.levels.truncate(4);
+            prev.grads.truncate(4);
+        }
         let mut fm = FrameMotion::default();
         if let Some(prev) = &self.prev
             && prev.width() == pyr.width()
@@ -195,6 +212,10 @@ impl Analyzer {
                 fm.points = round_pts(&inl, 48);
             }
         }
+        if let Some((level, grad)) = extra {
+            pyr.levels.push(level);
+            pyr.grads.push(grad);
+        }
         self.frames.push(fm);
         self.prev = Some(pyr);
     }
@@ -833,6 +854,65 @@ mod tests {
         tot / cnt.max(1) as f64
     }
 
+    #[test]
+    fn shared_pyramid_preserves_motion_and_trajectory_bits() {
+        rayon::ThreadPoolBuilder::new().num_threads(1).build().unwrap().install(|| {
+            for (size, detailed) in [([321.0, 181.0], false), ([997.0, 565.0], false), ([97.0, 63.0], false), ([1281.0, 721.0], true)] {
+                let mut scene = Scene::new(12);
+                scene.size = size;
+                let mut shared = Analyzer::new(size, AnalyzeOpts { detailed });
+                let mut separate = Analyzer::new(size, AnalyzeOpts { detailed });
+                for k in 0..12 {
+                    // Also cover partial downsample blocks, an offset/size change and the
+                    // resulting reset of active features halfway through the clip.
+                    if k == 6 {
+                        scene.size = [size[0] + 7.0, size[1] + 5.0];
+                    }
+                    let img = scene.frame(k);
+                    let frame = Frame { img: &img, offset: if k < 6 { [2.25, -3.5] } else { [-1.75, 4.5] } };
+                    shared.push(&frame);
+                    separate.push_impl(&frame, false);
+                }
+                let a = shared.finish(0.123456789012345, 1.0 / 24.0);
+                let b = separate.finish(0.123456789012345, 1.0 / 24.0);
+                assert!(!a.tracks.is_empty(), "exercise live trajectories: {size:?}, detailed={detailed}");
+                assert!(a.frames.iter().any(|f| f.features > 0));
+                assert_eq!(a.to_json(), b.to_json(), "{size:?}, detailed={detailed}");
+                for (a, b) in a.frames.iter().zip(&b.frames) {
+                    for (a, b) in a.t.iter().chain(&a.s).chain(&a.h).zip(b.t.iter().chain(&b.s).chain(&b.h)) {
+                        assert_eq!(a.to_bits(), b.to_bits());
+                    }
+                }
+            }
+        });
+    }
+
+    /// `cargo test --release -p effectcraft-track subspace_plan_bench -- --ignored --nocapture`
+    /// (`RAYON_NUM_THREADS=1` for one thread): `plan()` of a 300-frame synthetic parallax shot.
+    #[test]
+    #[ignore]
+    fn subspace_plan_bench() {
+        let n = 300;
+        let scene = Scene::new(n);
+        let mut an = Analyzer::new(scene.size, AnalyzeOpts::default());
+        for t in 0..n {
+            let img = scene.frame(t);
+            an.push(&Frame { img: &img, offset: [0.0; 2] });
+        }
+        let a = an.finish(0.0, 1.0 / 24.0);
+        for ripple in [Ripple::Automatic, Ripple::Enhanced] {
+            let s = StabSettings { method: Method::SubspaceWarp, ripple, framing: Framing::StabilizeOnly, fps: 24.0, ..Default::default() };
+            let mut times = vec![];
+            for _ in 0..5 {
+                let t = std::time::Instant::now();
+                std::hint::black_box(plan(&a, &s));
+                times.push(t.elapsed().as_secs_f64() * 1000.0);
+            }
+            times.sort_by(f64::total_cmp);
+            eprintln!("plan {ripple:?}, {} tracks, {} threads: median {:.1} ms", a.tracks.len(), rayon::current_num_threads(), times[2]);
+        }
+    }
+
     #[test]
     fn subspace_warp_beats_perspective_on_parallax() {
         let n = 48;
diff --git a/crates/track/src/subspace.rs b/crates/track/src/subspace.rs
index 66b674b53..9c7d5ceeb 100644
--- a/crates/track/src/subspace.rs
+++ b/crates/track/src/subspace.rs
@@ -205,24 +205,75 @@ impl Default for MeshOpts {
     }
 }
 
-/// Normal equations `AᵀA x = Aᵀb`, accumulated row by row.
+/// Normal equations `AᵀA x = Aᵀb`, accumulated row by row. `AᵀA` is symmetric and banded (every
+/// row couples unknowns at most `bw` apart), so only its lower band is stored: entry `(i, j)`
+/// with `i − bw ≤ j ≤ i` sits at `i * (bw + 1) + j + bw − i`.
 struct Normal {
-    n: usize,
+    bw: usize,
     a: Vec<f64>,
     b: Vec<f64>,
 }
 
 impl Normal {
     fn row(&mut self, coefs: &[(usize, f64)], rhs: f64, w: f64) {
+        let width = self.bw + 1;
         for (ia, ca) in coefs {
             self.b[*ia] += w * ca * rhs;
             for (ib, cb) in coefs {
-                self.a[ia * self.n + ib] += w * ca * cb;
+                if ib <= ia {
+                    self.a[ia * width + ib + self.bw - ia] += w * ca * cb;
+                }
             }
         }
     }
 }
 
+/// Cholesky solve of `A x = b` for the banded `Normal::a`, in place. Returns false when `A` is not
+/// positive definite.
+fn cholesky_band(a: &mut [f64], n: usize, bw: usize, b: &mut [f64]) -> bool {
+    let w = bw + 1;
+    for j in 0..n {
+        let kj = j.saturating_sub(bw);
+        let rowj = j * w + kj + bw - j;
+        let mut d = a[j * w + bw];
+        for v in &a[rowj..j * w + bw] {
+            d -= v * v;
+        }
+        if d <= 0.0 || !d.is_finite() {
+            return false;
+        }
+        let d = d.sqrt();
+        a[j * w + bw] = d;
+        for i in j + 1..(j + bw + 1).min(n) {
+            let ki = i - bw.min(i);
+            let mut s = a[i * w + j + bw - i];
+            let len = j - ki;
+            let (head, tail) = a.split_at_mut(i * w);
+            let li = &tail[ki + bw - i..ki + bw - i + len];
+            let lj = &head[j * w + ki + bw - j..j * w + ki + bw - j + len];
+            for (x, y) in li.iter().zip(lj) {
+                s -= x * y;
+            }
+            a[i * w + j + bw - i] = s / d;
+        }
+    }
+    for i in 0..n {
+        let mut s = b[i];
+        for k in i.saturating_sub(bw)..i {
+            s -= a[i * w + k + bw - i] * b[k];
+        }
+        b[i] = s / a[i * w + bw];
+    }
+    for i in (0..n).rev() {
+        let mut s = b[i];
+        for k in i + 1..(i + bw + 1).min(n) {
+            s -= a[k * w + i + bw - k] * b[k];
+        }
+        b[i] = s / a[i * w + bw];
+    }
+    b.iter().all(|v| v.is_finite())
+}
+
 /// Fit the content-preserving warp of one frame: `pairs` are (source position, wanted
 /// stabilised position) of its features; `base` is the frame's perspective correction (source →
 /// stabilised), the prior.
@@ -230,7 +281,9 @@ pub fn solve_mesh(size: [f64; 2], o: &MeshOpts, pairs: &[([f64; 2], [f64; 2])],
     let mut m = Mesh::from_homography(o.cols, o.rows, size, base);
     let nv = (m.cols + 1) * (m.rows + 1);
     let n = 2 * nv;
-    let mut ne = Normal { n, a: vec![0.0; n * n], b: vec![0.0; n] };
+    // A cell couples its four corners and, through the triangles, vertices up to `cols + 2` apart.
+    let bw = (2 * (m.cols + 2) + 1).min(n - 1);
+    let mut ne = Normal { bw, a: vec![0.0; n * (bw + 1)], b: vec![0.0; n] };
     // Prior.
     for k in 0..nv {
         let v = m.verts[k];
@@ -247,7 +300,7 @@ pub fn solve_mesh(size: [f64; 2], o: &MeshOpts, pairs: &[([f64; 2], [f64; 2])],
         let ks = [m.idx(i, j), m.idx(i + 1, j), m.idx(i, j + 1), m.idx(i + 1, j + 1)];
         let w = [(1.0 - u) * (1.0 - v), u * (1.0 - v), (1.0 - u) * v, u * v];
         for d in 0..2 {
-            let coefs: Vec<(usize, f64)> = ks.iter().zip(w).map(|(k, w)| (2 * k + d, w)).collect();
+            let coefs: [(usize, f64); 4] = std::array::from_fn(|c| (2 * ks[c] + d, w[c]));
             ne.row(&coefs, src[d], 1.0);
         }
         used += 1;
@@ -277,7 +330,7 @@ pub fn solve_mesh(size: [f64; 2], o: &MeshOpts, pairs: &[([f64; 2], [f64; 2])],
         }
     }
     let mut x = ne.b;
-    if cholesky_solve(&mut ne.a, n, &mut x) {
+    if cholesky_band(&mut ne.a, n, bw, &mut x) {
         for k in 0..nv {
             m.verts[k] = [x[2 * k], x[2 * k + 1]];
         }
@@ -285,6 +338,150 @@ pub fn solve_mesh(size: [f64; 2], o: &MeshOpts, pairs: &[([f64; 2], [f64; 2])],
     m
 }
 
+/// Reduce the symmetric `a` (row-major `n × n`, consumed) to tridiagonal form `T = Qᵀ A Q` by
+/// Householder reflections. Returns the diagonal of `T`, its off-diagonal (`off[i] = T[i][i+1]`)
+/// and `Qᵀ` (row-major: row `j` is column `j` of `Q`).
+///
+/// Step `k` picks the reflector `H = I − β v vᵀ` that maps column `k` below the diagonal onto a
+/// multiple of the first unit vector, and applies it to the trailing block `B` from both sides
+/// as the symmetric rank-2 update `B −= v wᵀ + w vᵀ` with `p = β B v`, `w = p − (β pᵀv / 2) v`.
+fn householder_tridiagonal(mut a: Vec<f64>, n: usize) -> (Vec<f64>, Vec<f64>, Vec<f64>) {
+    let mut qt = vec![0.0; n * n];
+    for i in 0..n {
+        qt[i * n + i] = 1.0;
+    }
+    let mut v = vec![0.0; n];
+    let mut p = vec![0.0; n];
+    let mut u = vec![0.0; n];
+    for k in 0..n.saturating_sub(2) {
+        let s = k + 1;
+        let len = n - s;
+        for i in 0..len {
+            v[i] = a[(s + i) * n + k];
+        }
+        let norm = v[..len].iter().map(|x| x * x).sum::<f64>().sqrt();
+        if norm == 0.0 {
+            continue;
+        }
+        let alpha = if v[0] >= 0.0 { -norm } else { norm };
+        v[0] -= alpha;
+        let beta = 2.0 / v[..len].iter().map(|x| x * x).sum::<f64>();
+        for i in 0..len {
+            let row = &a[(s + i) * n + s..(s + i) * n + n];
+            p[i] = beta * row.iter().zip(&v[..len]).map(|(x, y)| x * y).sum::<f64>();
+        }
+        let half = 0.5 * beta * p[..len].iter().zip(&v[..len]).map(|(x, y)| x * y).sum::<f64>();
+        for i in 0..len {
+            p[i] -= half * v[i];
+        }
+        // `p` now holds `w`.
+        for i in 0..len {
+            let row = &mut a[(s + i) * n + s..(s + i) * n + n];
+            for (j, x) in row.iter_mut().enumerate() {
+                *x -= v[i] * p[j] + p[i] * v[j];
+            }
+        }
+        a[s * n + k] = alpha;
+        a[k * n + s] = alpha;
+        // Q ← Q H: with rows of Qᵀ, row j −= β v_j (Σ_l v_l row l).
+        u.fill(0.0);
+        for (l, vl) in v[..len].iter().enumerate() {
+            for (x, q) in u.iter_mut().zip(&qt[(s + l) * n..(s + l + 1) * n]) {
+                *x += vl * q;
+            }
+        }
+        for (j, vj) in v[..len].iter().enumerate() {
+            for (q, x) in qt[(s + j) * n..(s + j + 1) * n].iter_mut().zip(&u) {
+                *q -= beta * vj * x;
+            }
+        }
+    }
+    let diag = (0..n).map(|i| a[i * n + i]).collect();
+    let off = (0..n.saturating_sub(1)).map(|i| a[(i + 1) * n + i]).collect();
+    (diag, off, qt)
+}
+
+/// One implicit symmetric QR step with the Wilkinson shift on the unreduced block `lo..=hi` of
+/// the tridiagonal `(diag, off)`: a Givens rotation of rows/columns `k, k+1` for `k = lo..hi`
+/// first introduces, then chases down a bulge below the subdiagonal. The rotations are applied to
+/// the rows of `qt` as well.
+fn wilkinson_qr_step(diag: &mut [f64], off: &mut [f64], qt: &mut [f64], n: usize, lo: usize, hi: usize) {
+    // The eigenvalue of the trailing 2×2 block nearer its last diagonal entry.
+    let t = off[hi - 1];
+    let half = 0.5 * (diag[hi - 1] - diag[hi]);
+    let sign = if half >= 0.0 { 1.0 } else { -1.0 };
+    let shift = diag[hi] - t * t / (half + sign * half.hypot(t));
+    let (mut x, mut z) = (diag[lo] - shift, off[lo]);
+    for k in lo..hi {
+        let r = x.hypot(z);
+        let (c, s) = if r == 0.0 { (1.0, 0.0) } else { (x / r, z / r) };
+        if k > lo {
+            off[k - 1] = r;
+        }
+        let (a, b, d) = (diag[k], off[k], diag[k + 1]);
+        diag[k] = c * c * a + 2.0 * c * s * b + s * s * d;
+        diag[k + 1] = s * s * a - 2.0 * c * s * b + c * c * d;
+        off[k] = c * s * (d - a) + (c * c - s * s) * b;
+        if k + 1 < hi {
+            // The rotation spreads `off[k+1]` into the bulge at (k+2, k).
+            x = off[k];
+            z = s * off[k + 1];
+            off[k + 1] *= c;
+        }
+        let (top, bottom) = qt.split_at_mut((k + 1) * n);
+        for (p, q) in top[k * n..].iter_mut().zip(&mut bottom[..n]) {
+            let (pk, qk) = (*p, *q);
+            *p = c * pk + s * qk;
+            *q = c * qk - s * pk;
+        }
+    }
+}
+
+/// Symmetric eigen-decomposition: Householder reduction to tridiagonal form, then implicit QR
+/// steps with the Wilkinson shift and deflation of negligible off-diagonal entries (the method of
+/// Golub & Van Loan, *Matrix Computations*, ch. 8: Householder tridiagonalisation and the
+/// symmetric QR algorithm). Same contract as `sym_eigen`: eigenvalues ascending, eigenvectors as
+/// the columns of a row-major matrix. `None` for non-finite input, a size mismatch or no
+/// convergence within `30 n` steps; the caller then falls back to Jacobi.
+fn sym_eigen_qr(a: &[f64], n: usize) -> Option<(Vec<f64>, Vec<f64>)> {
+    if a.len() != n * n || a.iter().any(|x| !x.is_finite()) {
+        return None;
+    }
+    let (mut diag, mut off, mut qt) = householder_tridiagonal(a.to_vec(), n);
+    let mut budget = 30 * n.max(1);
+    let mut hi = n.saturating_sub(1);
+    while hi > 0 {
+        for i in 0..hi {
+            if off[i].abs() <= f64::EPSILON * (diag[i].abs() + diag[i + 1].abs()) {
+                off[i] = 0.0;
+            }
+        }
+        if off[hi - 1] == 0.0 {
+            hi -= 1;
+            continue;
+        }
+        let mut lo = hi - 1;
+        while lo > 0 && off[lo - 1] != 0.0 {
+            lo -= 1;
+        }
+        budget = budget.checked_sub(1)?;
+        wilkinson_qr_step(&mut diag, &mut off, &mut qt, n, lo, hi);
+    }
+    if diag.iter().chain(&qt).any(|x| !x.is_finite()) {
+        return None;
+    }
+    let mut order: Vec<usize> = (0..n).collect();
+    order.sort_by(|&x, &y| diag[x].total_cmp(&diag[y]));
+    let vals = order.iter().map(|&j| diag[j]).collect();
+    let mut vecs = vec![0.0; n * n];
+    for (k, &j) in order.iter().enumerate() {
+        for r in 0..n {
+            vecs[r * n + k] = qt[j * n + r];
+        }
+    }
+    Some((vals, vecs))
+}
+
 /// Gaussian weights of the frames `lo..=hi` around `t`.
 fn gauss(lo: usize, hi: usize, t: usize, sigma: f64) -> Vec<f64> {
     let g: Vec<f64> = (lo..=hi).map(|j| (-((j as f64 - t as f64).powi(2)) / (2.0 * sigma * sigma)).exp()).collect();
@@ -336,7 +533,7 @@ pub fn smooth_trajectories(tracks: &[Track2D], frames: usize, sigma: f64, rank:
                     gram[b * m + a] = s;
                 }
             }
-            let (_, vecs) = sym_eigen(&gram, m);
+            let (_, vecs) = sym_eigen_qr(&gram, m).unwrap_or_else(|| sym_eigen(&gram, m));
             // C[q][c] = vecs[c][m − 1 − q] (largest first).
             let cmat: Vec<Vec<f64>> = (0..k).map(|q| (0..m).map(|c| vecs[c * m + (m - 1 - q)]).collect()).collect();
             let g = gauss(lo, hi, t, sigma.max(1e-6));
@@ -444,4 +641,155 @@ mod tests {
         }
         assert!(err_mesh < 0.35 * err_h, "{err_mesh} vs {err_h}");
     }
+
+    fn lcg(seed: &mut u64) -> f64 {
+        *seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+        (*seed >> 11) as f64 / (1u64 << 53) as f64 - 0.5
+    }
+
+    /// Checks an eigen-decomposition of `a` directly: `A v = λ v` per column, `VᵀV = I`, values
+    /// ascending; `tol` relative to the largest |entry| of `a`.
+    fn check_eigen(a: &[f64], n: usize, vals: &[f64], vecs: &[f64], tol: f64, what: &str) {
+        let scale = a.iter().fold(0.0f64, |m, x| m.max(x.abs())).max(f64::MIN_POSITIVE);
+        assert!(vals.windows(2).all(|w| w[0] <= w[1]), "{what}: values not ascending");
+        for k in 0..n {
+            for i in 0..n {
+                let av: f64 = (0..n).map(|j| a[i * n + j] * vecs[j * n + k]).sum();
+                let r = (av - vals[k] * vecs[i * n + k]).abs();
+                assert!(r <= tol * scale, "{what}: residual {r} at ({i}, {k})");
+            }
+            for l in 0..n {
+                let d: f64 = (0..n).map(|i| vecs[i * n + k] * vecs[i * n + l]).sum();
+                let want = if k == l { 1.0 } else { 0.0 };
+                assert!((d - want).abs() < 1e-10, "{what}: VᵀV ({k}, {l}) = {d}");
+            }
+        }
+    }
+
+    fn random_symmetric(n: usize, seed: &mut u64, scale: impl Fn(usize) -> f64) -> Vec<f64> {
+        let mut a = vec![0.0; n * n];
+        for i in 0..n {
+            for j in 0..=i {
+                let v = lcg(seed) * scale(i) * scale(j);
+                a[i * n + j] = v;
+                a[j * n + i] = v;
+            }
+        }
+        a
+    }
+
+    #[test]
+    fn qr_eigen_matches_jacobi_on_random_matrices() {
+        use crate::camtrack::linalg::sym_eigen;
+        let mut seed = 3;
+        for n in [1, 2, 3, 7, 20, 61] {
+            for _ in 0..3 {
+                let a = random_symmetric(n, &mut seed, |_| 1.0);
+                let (vals, vecs) = sym_eigen_qr(&a, n).unwrap();
+                check_eigen(&a, n, &vals, &vecs, 1e-12, &format!("random n {n}"));
+                let (v0, _) = sym_eigen(&a, n);
+                for (x, y) in vals.iter().zip(&v0) {
+                    assert!((x - y).abs() < 1e-11, "n {n}: {x} vs {y}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn qr_eigen_handles_special_matrices() {
+        let mut seed = 5;
+        let n = 6;
+        let mut identity = vec![0.0; n * n];
+        let mut blocks = vec![0.0; n * n];
+        for i in 0..n {
+            identity[i * n + i] = 1.0;
+            // Two equal 3×3 blocks: every eigenvalue twice.
+            for j in 0..n {
+                if i / 3 == j / 3 {
+                    blocks[i * n + j] = [[2.0, 1.0, 0.0], [1.0, 3.0, 1.0], [0.0, 1.0, 4.0]][i % 3][j % 3];
+                }
+            }
+        }
+        let cases: Vec<(&str, usize, Vec<f64>)> = vec![
+            ("identity", n, identity),
+            ("repeated blocks", n, blocks),
+            ("zero", n, vec![0.0; n * n]),
+            ("1x1", 1, vec![-4.5]),
+            ("0x0", 0, vec![]),
+            // Rows and columns scaled from 1e-8 to 1e8.
+            ("badly scaled", 9, random_symmetric(9, &mut seed, |i| 10f64.powi(2 * i as i32 - 8))),
+            ("tridiagonal 1-2-1", 30, (0..900usize).map(|k| [0.0, 1.0, 2.0][2 - (k / 30).abs_diff(k % 30).min(2)]).collect()),
+        ];
+        for (what, n, a) in cases {
+            let (vals, vecs) = sym_eigen_qr(&a, n).unwrap();
+            check_eigen(&a, n, &vals, &vecs, 1e-12, what);
+        }
+        let (vals, _) = sym_eigen_qr(&[1.0, 0.0, 0.0, 1.0], 2).unwrap();
+        assert_eq!(vals, vec![1.0, 1.0]);
+        // Non-finite input or a size mismatch: None (the caller falls back to Jacobi) at once.
+        let mut nan = random_symmetric(8, &mut seed, |_| 1.0);
+        nan[9] = f64::NAN;
+        assert!(sym_eigen_qr(&nan, 8).is_none());
+        assert!(sym_eigen_qr(&[f64::INFINITY], 1).is_none());
+        assert!(sym_eigen_qr(&[1.0, 2.0, 3.0], 2).is_none());
+    }
+
+    #[test]
+    fn qr_eigen_keeps_the_leading_subspace_of_gram_like_matrices() {
+        use crate::camtrack::linalg::sym_eigen;
+        let mut seed = 7;
+        for n in [1, 2, 5, 31, 61] {
+            // Large magnitudes like a trajectory Gram matrix, with a low-rank part.
+            let rank = 3.min(n);
+            let f: Vec<f64> = (0..n * rank).map(|_| 300.0 * lcg(&mut seed)).collect();
+            let mut a = vec![0.0; n * n];
+            for i in 0..n {
+                for j in 0..n {
+                    a[i * n + j] = (0..rank).map(|k| f[i * rank + k] * f[j * rank + k]).sum::<f64>() * 40.0;
+                }
+            }
+            let (v0, e0) = sym_eigen(&a, n);
+            let (v1, e1) = sym_eigen_qr(&a, n).unwrap();
+            check_eigen(&a, n, &v1, &e1, 1e-12, &format!("gram n {n}"));
+            let top = v0[n - 1].abs().max(1.0);
+            for k in 0..n {
+                assert!((v0[k] - v1[k]).abs() < 1e-9 * top, "n {n} value {k}: {} vs {}", v0[k], v1[k]);
+            }
+            // The leading subspace (distinct eigenvalues, compared as a projector: signs and the
+            // basis are free).
+            for i in 0..n {
+                for j in 0..n {
+                    let p0: f64 = (0..rank).map(|q| e0[i * n + n - 1 - q] * e0[j * n + n - 1 - q]).sum();
+                    let p1: f64 = (0..rank).map(|q| e1[i * n + n - 1 - q] * e1[j * n + n - 1 - q]).sum();
+                    assert!((p0 - p1).abs() < 1e-9, "n {n} projector ({i},{j}): {p0} vs {p1}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn band_cholesky_matches_dense() {
+        let mut seed = 11;
+        for (n, bw) in [(1, 0), (6, 2), (40, 7), (40, 39)] {
+            let mut dense = vec![0.0; n * n];
+            let mut band = vec![0.0; n * (bw + 1)];
+            for i in 0..n {
+                for j in i.saturating_sub(bw)..=i {
+                    let v = if i == j { 4.0 * bw as f64 + 2.0 + lcg(&mut seed) } else { lcg(&mut seed) };
+                    dense[i * n + j] = v;
+                    dense[j * n + i] = v;
+                    band[i * (bw + 1) + j + bw - i] = v;
+                }
+            }
+            let b: Vec<f64> = (0..n).map(|_| 10.0 * lcg(&mut seed)).collect();
+            let (mut x0, mut x1) = (b.clone(), b);
+            assert!(cholesky_solve(&mut dense, n, &mut x0));
+            assert!(cholesky_band(&mut band, n, bw, &mut x1));
+            for (a, b) in x0.iter().zip(&x1) {
+                assert!((a - b).abs() < 1e-10, "{a} vs {b}");
+            }
+        }
+        let mut band = vec![-1.0, 0.0, 0.0, 1.0];
+        assert!(!cholesky_band(&mut band, 2, 1, &mut [1.0, 1.0]));
+    }
 }
diff --git a/crates/track/src/tests.rs b/crates/track/src/tests.rs
index 886478d1e..c019996f5 100644
--- a/crates/track/src/tests.rs
+++ b/crates/track/src/tests.rs
@@ -93,6 +93,55 @@ fn dist(a: [f64; 2], b: [f64; 2]) -> f64 {
     ((a[0] - b[0]).powi(2) + (a[1] - b[1]).powi(2)).sqrt()
 }
 
+fn bits(v: &Option<([f64; 2], [f64; 2])>) -> Option<[u64; 4]> {
+    v.map(|(c, a)| [c[0].to_bits(), c[1].to_bits(), a[0].to_bits(), a[1].to_bits()])
+}
+
+#[test]
+fn scorer_matches_ncc_for_integer_offsets() {
+    let pose = Pose { c: [60.0, 50.0], rot: 0.0, scale: 1.0 };
+    let img = frame(120, 100, pose, 20.0, 0.02, 1, None);
+    let crop = Crop::new(&Frame::new(&img), &TrackOptions::default(), [60.0, 50.0], [40.0, 30.0], 1);
+    for (lvl, c, a) in [(0, [30.3, 25.9], [0.97, 0.21]), (0, [12.0, 9.5], [1.2, -0.3]), (1, [20.4, 14.2], [0.8, 0.0]), (0, [30.3, 25.9], [1.0, 0.0])] {
+        let plane = &crop.levels[lvl];
+        let r = [7, 5];
+        let patch = Patch::sample(plane, c, a, r);
+        let sc = Scorer::new(plane, &patch, [c[0] + 0.3, c[1] - 0.45], a);
+        for j in -9..=9 {
+            for i in -9..=9 {
+                let q = [c[0] + 0.3 + i as f64, c[1] - 0.45 + j as f64];
+                assert_eq!(sc.at(i, j).to_bits(), ncc(plane, &patch, q, a).to_bits(), "level {lvl} {a:?} ({i}, {j})");
+            }
+        }
+    }
+}
+
+#[test]
+fn lk_refine_with_a_gradient_window_equals_the_full_gradients() {
+    let pose = Pose { c: [100.0, 90.0], rot: 5.0, scale: 1.05 };
+    let (img0, img1) = (frame(200, 180, pose, 30.0, 0.02, 1, None), frame(200, 180, Pose { c: [103.2, 88.1], rot: 6.5, scale: 1.08 }, 30.0, 0.02, 2, None));
+    let (opts, r) = (TrackOptions::default(), [24, 24]);
+    let (c0, a0) = ([100.0, 90.0], [1.0, 0.0]);
+    let tpl = Crop::new(&Frame::new(&img0), &opts, c0, [60.0, 60.0], 0);
+    let crop = Crop::new(&Frame::new(&img1), &opts, c0, [60.0, 60.0], 0);
+    let plane = &crop.levels[0];
+    let patch = Patch::sample(&tpl.levels[0], tpl.to_level(c0, 0), a0, r);
+    let mid = crop.to_level(c0, 0);
+    // Starts within the window, and far enough off that the iterations leave it (even near the edge).
+    for (d, edge) in [([0.0, 0.0], false), ([1.3, -0.8], false), ([4.0, 5.0], false), ([9.0, -9.0], false), ([0.0, 0.0], true)] {
+        let start = if edge { [4.0, 4.0] } else { [mid[0] + d[0], mid[1] + d[1]] };
+        for shape in [true, false] {
+            let (mut full, mut win) = (Grad::full(plane), Grad::around(plane, start, a0, r));
+            let x = lk_refine(&crop, &mut full, &patch, start, a0, shape);
+            let y = lk_refine(&crop, &mut win, &patch, start, a0, shape);
+            assert_eq!(bits(&x), bits(&y), "{d:?} edge {edge} shape {shape}");
+            // A window that misses the taps altogether is replaced by the full gradients.
+            let mut off = Grad::around(plane, [start[0] + 15.0, start[1] + 15.0], a0, r);
+            assert_eq!(bits(&x), bits(&lk_refine(&crop, &mut off, &patch, start, a0, shape)), "{d:?} edge {edge} shape {shape}: missed window");
+        }
+    }
+}
+
 #[test]
 fn recovers_translation_path_subpixel() {
     let path = |f: usize| {
@@ -114,6 +163,27 @@ fn recovers_translation_path_subpixel() {
     assert!(worst < 0.25, "worst error {worst} px");
 }
 
+#[test]
+fn recovers_after_sudden_jumps_the_prediction_misses() {
+    // Alternating large steps defeat the velocity prediction, so the fine stage must keep its
+    // wider neighbourhood; smooth frames in between use the narrow one.
+    let path = |f: usize| {
+        let t = f as f64;
+        let jump = [0.0, 7.0, -5.0, 9.0, -8.0, 6.0, -7.0, 8.0];
+        let j = jump[f % jump.len()];
+        Pose { c: [120.0 + 1.5 * t + j, 100.0 + 1.1 * t - 0.6 * j], rot: 0.0, scale: 1.0 }
+    };
+    let f0 = frame(360, 260, path(0), 40.0, 0.02, 0, None);
+    let mut tr = Tracker::new(TrackOptions::default(), &[spec(path(0).c, 31.0, 91.0)], &Frame::new(&f0));
+    for f in 1..24 {
+        let img = frame(360, 260, path(f), 40.0, 0.02, f as u32, None);
+        let r = tr.step(&Frame::new(&img))[0];
+        let e = dist(r.center, path(f).c);
+        assert!(e < 0.3, "frame {f}: error {e} px");
+        assert_eq!(r.status, Status::Tracked);
+    }
+}
+
 #[test]
 fn layer_offset_and_channels() {
     let pose = |f: usize| Pose { c: [120.0 + 3.3 * f as f64, 100.0 - 1.7 * f as f64], rot: 0.0, scale: 1.0 };
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index be02fef5e..1576907cb 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -11,6 +11,7 @@ workspace = true
 
 [dependencies]
 craft-ui = { workspace = true }
+craft-quit = { workspace = true, features = ["egui"] }
 effectcraft-time = { workspace = true }
 effectcraft-geom = { workspace = true }
 effectcraft-color = { workspace = true }
@@ -22,23 +23,39 @@ effectcraft-render = { workspace = true }
 effectcraft-engine = { workspace = true }
 effectcraft-gpu = { workspace = true }
 egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
+egui_extras = { workspace = true }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 rayon = { workspace = true }
 web-time = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
+# Half-float viewer frames of 32 bpc projects (F16C is picked at run time).
+half = { workspace = true }
+bytemuck = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# Floating panels open in OS windows of their own on desktop; the web keeps them in the page.
+craft-ui = { workspace = true, features = ["native-windows"] }
+craft-update = { workspace = true }
+# Waits for the display pass's error scopes (immediately ready on native wgpu).
+pollster = { workspace = true }
 sys-locale = { workspace = true }
 
 [dev-dependencies]
+# Fonts for kittest: the workspace `egui` features are what test roots resolve, but stating them
+# here documents the requirement (kittest's own dev-dependencies do not propagate to consumers).
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 egui_kittest = { workspace = true, features = ["eframe", "wgpu"] }
-pollster = "0.4"
+pollster = "1"
+effectcraft-segment = { workspace = true }
 effectcraft-host = { workspace = true }
+effectcraft-media = { workspace = true }
 exr = { workspace = true }
+tempfile = { workspace = true }
 
 [build-dependencies]
 serde_json = { workspace = true }
diff --git a/crates/ui-egui/build.rs b/crates/ui-egui/build.rs
index c5276ebf5..e9bca58c7 100644
--- a/crates/ui-egui/build.rs
+++ b/crates/ui-egui/build.rs
@@ -1,8 +1,7 @@
-//! Bake the contributor credits into the binary as static Rust tables (craftrules
-//! standards/contributors.md). Nothing is read at run time.
+//! Bake the contributor credits into the binary as static Rust tables. Nothing is read at run time.
 //!
-//! - contributors/contributors.json: commit stats per GitHub username, generated by craftrules
-//!   scripts/contributors.py, which also marks whose people.toml entry it verified.
+//! - contributors/contributors.json: commit stats per GitHub username, with a mark for whose
+//!   people.toml entry is verified.
 //! - contributors/people.toml: the names people chose for themselves. A name is used only when the
 //!   JSON says the entry was verified (`people_entry`).
 //!
diff --git a/crates/ui-egui/examples/cache_bench.rs b/crates/ui-egui/examples/cache_bench.rs
new file mode 100644
index 000000000..828075249
--- /dev/null
+++ b/crates/ui-egui/examples/cache_bench.rs
@@ -0,0 +1,177 @@
+//! Background caching benchmark: how fast the RAM preview fills a comp, and where the time goes.
+//!
+//! `cargo run --release -p effectcraft-ui-egui --example cache_bench -- [options]`
+//!
+//! Without `--project` it builds a comp like a typical edit: eight 1080p30 H.264 clips one after
+//! another (encoded once into `target/cache-bench/media` with the Render Queue, no committed
+//! media) under an adjustment layer with Gaussian Blur. It then fills the comp's RAM preview the
+//! way idle caching does, through [`Frames`], and prints frames per second with the decoder,
+//! footage-cache and disk-cache counters.
+//!
+//! Options: `--project P --comp C` (a saved project's comp instead), `--scale S` (render scale,
+//! default 0.5: a viewer at half size), `--frames N` (frames to cache, default the whole comp),
+//! `--slots N` (frames in flight, at least 1, default one per frame thread as the app does when
+//! idle),
+//! `--disk` (with a fresh disk cache in `target/cache-bench/disk`), `--no-adjustment`.
+
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::ItemId;
+use effectcraft_engine::render::RenderOpts;
+use effectcraft_ui_egui::frames::{FrameKey, Frames, RenderSource, opts_hash};
+use serde_json::{Value, json};
+
+fn arg(name: &str) -> Option<String> {
+    let a: Vec<String> = std::env::args().collect();
+    a.iter().position(|x| x == name).and_then(|i| a.get(i + 1).cloned())
+}
+
+fn run(s: &mut Session, cmd: &str, p: Value) -> Value {
+    s.execute(cmd, p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
+}
+
+/// Eight copies of one generated clip (separate files: separate decoders, as with real clips).
+fn clips(dir: &std::path::Path) -> Vec<String> {
+    let media = dir.join("media");
+    std::fs::create_dir_all(&media).expect("media folder");
+    let first = media.join("clip0.mp4");
+    if !first.exists() {
+        eprintln!("encoding the source clip (once)…");
+        let mut s = effectcraft_host::session();
+        run(&mut s, "comp.new", json!({"name": "Src", "width": 1920, "height": 1080, "frameRate": 30, "duration": 4.25}));
+        let l = run(&mut s, "layer.newSolid", json!({"color": "#808080"}))["layer"].clone();
+        run(&mut s, "effect.apply", json!({"layers": [l], "effect": "Fractal Noise"}));
+        run(&mut s, "prop.addKey", json!({"layer": l, "path": "effects/#1/evolution", "time": 0.0, "value": 0.0}));
+        run(&mut s, "prop.addKey", json!({"layer": l, "path": "effects/#1/evolution", "time": 4.25, "value": 720.0}));
+        run(&mut s, "renderQueue.add", json!({"comp": "Src", "format": "h264", "output": first.to_string_lossy()}));
+        run(&mut s, "renderQueue.render", json!({"wait": true}));
+    }
+    (0..8)
+        .map(|i| {
+            let p = media.join(format!("clip{i}.mp4"));
+            if !p.exists() {
+                std::fs::copy(&first, &p).expect("copy clip");
+            }
+            p.to_string_lossy().to_string()
+        })
+        .collect()
+}
+
+fn main() {
+    let dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target/cache-bench");
+    let mut s = effectcraft_host::session();
+    let pool = Arc::new(effectcraft_media::MediaPool::new());
+    s.footage = pool.clone();
+    if std::env::args().any(|a| a == "--disk") {
+        let disk = dir.join("disk");
+        if let Err(e) = std::fs::remove_dir_all(&disk)
+            && e.kind() != std::io::ErrorKind::NotFound
+        {
+            eprintln!("can't clear the disk cache at {}: {e}", disk.display());
+            std::process::exit(2);
+        }
+        s.prefs.disk.disk_cache_enabled = true;
+        s.prefs.disk.disk_cache_folder = disk.to_string_lossy().to_string();
+        s.configure_disk_cache();
+    }
+    let cid = match arg("--project") {
+        Some(p) => {
+            run(&mut s, "file.open", json!({"path": p}));
+            let comp = match arg("--comp") {
+                Some(c) => s.project.comps().find(|(id, _)| s.project.item(**id).is_some_and(|it| it.name == c) || id.0.to_string() == c).map(|(id, _)| *id),
+                None => s.active_comp_id(),
+            };
+            comp.unwrap_or_else(|| {
+                eprintln!("no such composition: {}", arg("--comp").unwrap_or_else(|| "(no active comp; pass --comp)".into()));
+                std::process::exit(2)
+            })
+        }
+        None => {
+            let paths = clips(&dir);
+            let cid = ItemId(
+                run(&mut s, "comp.new", json!({"name": "Edit", "width": 1920, "height": 1080, "frameRate": 30, "duration": 34}))["comp"]
+                    .as_u64()
+                    .expect("comp"),
+            );
+            let items = run(&mut s, "file.import", json!({"paths": paths}))["items"].clone();
+            for (i, item) in items.as_array().expect("items").iter().enumerate() {
+                let l = run(&mut s, "layer.addItem", json!({"item": item}))["layer"].as_u64().expect("layer");
+                let c = Arc::make_mut(&mut s.project).comp_mut(cid).expect("comp");
+                let fr = c.frame_rate;
+                let l = c.layer_mut(effectcraft_engine::project::LayerId(l)).expect("layer");
+                let at = fr.tick_of(i as i64 * 1275 / 10);
+                (l.start_time, l.in_point, l.out_point) = (at, at, fr.tick_of((i as i64 + 1) * 1275 / 10));
+            }
+            if !std::env::args().any(|a| a == "--no-adjustment") {
+                let adj = run(&mut s, "layer.newAdjustment", json!({}))["layer"].clone();
+                run(&mut s, "effect.apply", json!({"layers": [adj], "effect": "Gaussian Blur"}));
+                run(&mut s, "prop.set", json!({"layer": adj, "path": "effects/#1/blurriness", "value": 4.0}));
+            }
+            cid
+        }
+    };
+    let comp = s.project.comp(cid).expect("comp").clone();
+    let total = comp.frame_rate.frame_at(comp.duration);
+    let n = arg("--frames").and_then(|v| v.parse().ok()).unwrap_or(total).min(total);
+    let scale: f64 = arg("--scale").and_then(|v| v.parse().ok()).unwrap_or(0.5);
+
+    let frames = Frames::default();
+    // (as Cache Frames When Idle: one frame per frame thread, see `app/prefetch.rs`)
+    let slots: usize = arg("--slots").and_then(|v| v.parse().ok()).map(|n: usize| n.max(1)).unwrap_or(frames.parallelism().max(1));
+    // Room for every frame: this measures speed, not eviction.
+    frames.set_budget(64 << 30);
+    let opts = RenderOpts { scale, motion_blur: true, ..Default::default() };
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: s.footage.clone(),
+        expr: s.expr.clone(),
+        layer_cache: s.layer_cache.clone(),
+        gpu: None,
+        gpu_display: false,
+        disk: s.disk_cache.clone(),
+    };
+    let series = FrameKey {
+        revision: 1,
+        content: frames.content_of(&src.project, 1, cid),
+        comp: cid.0,
+        frame: 0,
+        scale: (scale * 1000.0).round() as u32,
+        view: 0,
+        opts: opts_hash(&opts),
+    };
+
+    eprintln!("caching {n} frames of {}×{} at scale {scale} with {slots} in flight…", comp.width, comp.height);
+    let (gop0, t0) = (effectcraft_media::gop_stats(), Instant::now());
+    let mut next = 0;
+    loop {
+        while next < n && frames.inflight() < slots {
+            frames.request_background(&src, FrameKey { frame: next, ..series }, cid, comp.frame_rate.tick_of(next), opts);
+            next += 1;
+        }
+        if next >= n && frames.inflight() == 0 {
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(1));
+    }
+    let secs = t0.elapsed().as_secs_f64();
+    let gop = effectcraft_media::gop_stats();
+    let cached = frames.cached_frames(&series).len();
+    println!("frames cached     {cached}/{n} in {secs:.2} s: {:.1} frames/s, {:.1} ms each", cached as f64 / secs, secs * 1000.0 / cached.max(1) as f64);
+    println!(
+        "video decoding    {:.2} s in decoders, {} samples decoded, {} seeks, {} cache hits",
+        (gop.decode_ns - gop0.decode_ns) as f64 / 1e9,
+        gop.decoded - gop0.decoded,
+        gop.seeks - gop0.seeks,
+        gop.hits - gop0.hits
+    );
+    let p = pool.stats();
+    println!("footage cache     {} hits, {} misses, {} frames ({} MB) kept", p.hits, p.misses, p.frames, p.bytes >> 20);
+    if let Some(dc) = &s.disk_cache {
+        // (writes finish on the disk cache's own thread)
+        dc.flush();
+        let d = dc.stats();
+        println!("disk cache        {} written, {} dropped, {} entries ({} MB)", d.writes, d.dropped, d.entries, d.bytes >> 20);
+    }
+}
diff --git a/crates/ui-egui/src/a11y.rs b/crates/ui-egui/src/a11y.rs
new file mode 100644
index 000000000..b8f88ae23
--- /dev/null
+++ b/crates/ui-egui/src/a11y.rs
@@ -0,0 +1,248 @@
+//! Accessibility helpers (docs/gaps.md gap 25): names, roles and states for the widgets the app
+//! paints itself, and the small pieces of list keyboard handling the panels share.
+//!
+//! egui builds an AccessKit node for every widget that can take the keyboard focus, but a widget
+//! made with `ui.interact` has no name and no role until the panel says what it is. These helpers
+//! write that onto the widget's node *after* the widget is made each frame (egui rebuilds the
+//! tree every pass), and keep whatever egui already put there (its role for a `DragValue`, the
+//! numeric value of a `Slider`).
+//!
+//! Names are the same translated strings the panel draws (`i18n::tr`), never hard-coded English.
+//! `tests/it/ui_accessibility_audit.rs` walks the tree and fails on an unnamed control in the panels
+//! that have had their pass.
+
+use egui::accesskit::{HasPopup, Role, Toggled};
+use egui::{Context, Id, Response};
+
+/// Set `f` on `r`'s AccessKit node (nothing when AccessKit is off). egui only fills a node's
+/// bounds and actions for widgets that can take the keyboard focus; a widget that cannot (the
+/// non-current rows of a list) still needs both, or assistive technology cannot place or click it.
+fn node(r: &Response, f: impl FnOnce(&mut egui::accesskit::Node)) {
+    r.ctx.accesskit_node_builder(r.id, |n| {
+        n.set_bounds(egui::accesskit::Rect { x0: r.rect.min.x.into(), y0: r.rect.min.y.into(), x1: r.rect.max.x.into(), y1: r.rect.max.y.into() });
+        if r.sense.is_focusable() {
+            n.add_action(egui::accesskit::Action::Focus);
+        }
+        if r.sense.senses_click() {
+            n.add_action(egui::accesskit::Action::Click);
+        }
+        f(n);
+    });
+}
+
+/// Give `r`'s node a role and leave its name to the caller.
+pub(crate) fn role(r: &Response, role: Role) {
+    node(r, |n| n.set_role(role));
+}
+
+/// Give `r`'s node a role and a name.
+pub(crate) fn role_name(r: &Response, role: Role, label: &str) {
+    node(r, |n| {
+        n.set_role(role);
+        n.set_label(label);
+    });
+}
+
+/// Name `r`'s node (`label`), keeping the role egui gave it (spin button, slider, text input).
+pub(crate) fn name(r: &Response, label: &str) {
+    node(r, |n| n.set_label(label));
+}
+
+/// Give `r`'s node a current value and keep the name it already has.
+pub(crate) fn value(r: &Response, value: &str) {
+    node(r, |n| n.set_value(value));
+}
+
+/// Name `r`'s node and give it a current value (a spin button's or a text field's text).
+pub(crate) fn name_value(r: &Response, label: &str, value: &str) {
+    node(r, |n| {
+        n.set_label(label);
+        n.set_value(value);
+    });
+}
+
+/// A push button; `enabled` false marks it disabled for assistive technology (it stays visible).
+pub(crate) fn button(r: &Response, label: &str, enabled: bool) {
+    node(r, |n| {
+        n.set_role(Role::Button);
+        n.set_label(label);
+        if !enabled {
+            n.set_disabled();
+        }
+    });
+}
+
+/// A button that opens a menu or popup: `open` is whether it is open now.
+pub(crate) fn menu_button(r: &Response, label: &str, open: bool) {
+    node(r, |n| {
+        n.set_role(Role::Button);
+        n.set_label(label);
+        n.set_has_popup(HasPopup::Menu);
+        n.set_expanded(open);
+    });
+}
+
+/// A button that shows or hides something (a twirl): `expanded` is the state it leads to from.
+pub(crate) fn disclosure(r: &Response, label: &str, expanded: bool) {
+    node(r, |n| {
+        n.set_role(Role::Button);
+        n.set_label(label);
+        n.set_expanded(expanded);
+    });
+}
+
+/// A check box.
+pub(crate) fn check_box(r: &Response, label: &str, checked: bool, enabled: bool) {
+    node(r, |n| {
+        n.set_role(Role::CheckBox);
+        n.set_label(label);
+        n.set_toggled(if checked { Toggled::True } else { Toggled::False });
+        if !enabled {
+            n.set_disabled();
+        }
+    });
+}
+
+/// A drop-down: `label` says what it sets and `value` is what it is set to.
+pub(crate) fn combo_box(r: &Response, label: &str, value: &str, enabled: bool) {
+    node(r, |n| {
+        n.set_role(Role::ComboBox);
+        n.set_label(label);
+        n.set_value(value);
+        n.set_has_popup(HasPopup::Menu);
+        n.set_expanded(false);
+        if !enabled {
+            n.set_disabled();
+        }
+    });
+}
+
+/// A row of a tree: selected, its depth (`level`, 1 at the top), whether it is open (`None` for a
+/// leaf) and its place among its siblings.
+pub(crate) fn tree_item(r: &Response, label: &str, selected: bool, level: usize, expanded: Option<bool>) {
+    node(r, |n| {
+        n.set_role(Role::TreeItem);
+        n.set_label(label);
+        n.set_selected(selected);
+        n.set_level(level);
+        if let Some(open) = expanded {
+            n.set_expanded(open);
+        }
+    });
+}
+
+/// An entry of a flat list: `position` is its 1-based place among `size`.
+pub(crate) fn list_item(r: &Response, label: &str, selected: bool, position: usize, size: usize) {
+    node(r, |n| {
+        n.set_role(Role::ListItem);
+        n.set_label(label);
+        n.set_selected(selected);
+        n.set_position_in_set(position);
+        n.set_size_of_set(size);
+    });
+}
+
+/// An entry of a menu or popup list; `checked` is `Some` for an entry that is on or off.
+pub(crate) fn menu_item(r: &Response, label: &str, checked: Option<bool>) {
+    node(r, |n| {
+        n.set_label(label);
+        match checked {
+            Some(on) => {
+                n.set_role(Role::MenuItemCheckBox);
+                n.set_toggled(if on { Toggled::True } else { Toggled::False });
+            }
+            None => n.set_role(Role::MenuItem),
+        }
+    });
+}
+
+/// A text field with a name (and its text as the value).
+pub(crate) fn text_input(r: &Response, label: &str, text: &str) {
+    node(r, |n| {
+        n.set_role(Role::TextInput);
+        n.set_label(label);
+        n.set_value(text);
+    });
+}
+
+/// A progress bar: `fraction` 0..=1 and the sentence it shows.
+pub(crate) fn progress(r: &Response, label: &str, fraction: f32) {
+    node(r, |n| {
+        n.set_role(Role::ProgressIndicator);
+        n.set_label(label);
+        n.set_min_numeric_value(0.0);
+        n.set_max_numeric_value(1.0);
+        n.set_numeric_value(f64::from(fraction.clamp(0.0, 1.0)));
+    });
+}
+
+// ------------------------------------------------------------------------------------------
+// Things a panel paints that are not controls
+
+/// Make `rect` a node of the tree (egui paints text and shapes into the painter and leaves them
+/// out of it) and give it a role and a name. Not focusable: it is for assistive technology to
+/// read, not for the keyboard.
+fn static_node(ui: &egui::Ui, id: Id, rect: egui::Rect, role: Role, label: &str, value: Option<&str>) {
+    let r = ui.interact(rect, id, egui::Sense::hover());
+    node(&r, |n| {
+        n.set_role(role);
+        n.set_label(label);
+        if let Some(v) = value {
+            n.set_value(v);
+        }
+    });
+}
+
+/// A read-out painted at `rect` (a colour channel, the time, a status line): `label` is the whole
+/// sentence it shows, e.g. "Red: 128".
+pub(crate) fn readout(ui: &egui::Ui, id: Id, rect: egui::Rect, label: &str) {
+    static_node(ui, id, rect, Role::Label, label, None);
+}
+
+/// A picture with no text of its own (a colour swatch, a scope, a waveform): `label` says what it
+/// shows in a few words.
+pub(crate) fn graphic(ui: &egui::Ui, id: Id, rect: egui::Rect, label: &str) {
+    static_node(ui, id, rect, Role::Image, label, None);
+}
+
+/// A log or console output (newest line last): `label` says which, `text` is what it holds.
+pub(crate) fn log(ui: &egui::Ui, id: Id, rect: egui::Rect, label: &str, text: &str) {
+    static_node(ui, id, rect, Role::Log, label, Some(text));
+}
+
+/// A toggle button (it stays pressed while it is on).
+pub(crate) fn toggle_button(r: &Response, label: &str, on: bool) {
+    node(r, |n| {
+        n.set_role(Role::Button);
+        n.set_label(label);
+        n.set_toggled(if on { Toggled::True } else { Toggled::False });
+    });
+}
+
+// ------------------------------------------------------------------------------------------
+// List keyboard handling
+
+/// Ask for the keyboard focus on widget `id` once it is drawn (a list moves its focus to the row
+/// the arrow keys reached, which may not be focusable, or drawn, until the next pass). `key`
+/// names the list.
+pub(crate) fn focus_next_pass(ctx: &Context, key: &str, id: Id) {
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data_mut(|d| d.insert_temp(Id::unique(("a11y-pending-focus", key)), (id, pass)));
+}
+
+/// True once, for the widget `focus_next_pass` named for list `key`: the caller then requests the
+/// focus. A request nobody answers within a few passes is dropped.
+pub(crate) fn take_pending_focus(ctx: &Context, key: &str, id: Id) -> bool {
+    let slot = Id::unique(("a11y-pending-focus", key));
+    let now = ctx.cumulative_pass_nr();
+    let Some((want, at)) = ctx.data(|d| d.get_temp::<(Id, u64)>(slot)) else { return false };
+    if now > at.saturating_add(4) {
+        ctx.data_mut(|d| d.remove::<(Id, u64)>(slot));
+        return false;
+    }
+    if want != id || now == at {
+        return false;
+    }
+    ctx.data_mut(|d| d.remove::<(Id, u64)>(slot));
+    true
+}
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
new file mode 100644
index 000000000..66387bc31
--- /dev/null
+++ b/crates/ui-egui/src/app.rs
@@ -0,0 +1,189 @@
+use super::clock::AppClock;
+use super::hooks::Hooks;
+use super::state::{FrameWindow, PlaybackPass, ShotTarget};
+use super::*;
+
+mod clipboard;
+mod files;
+mod frame;
+mod gpu;
+mod input;
+mod playback;
+mod prefetch;
+mod prefs;
+mod screenshot;
+mod viewer_frames;
+mod window;
+
+pub use gpu::{GPU_PREPARING, GpuBuild};
+#[cfg(test)]
+pub(crate) use screenshot::{MAX_PENDING_SHOTS, SCREENSHOT_SETTLE_PASSES, SCREENSHOT_SETTLE_S, SCREENSHOT_TIMEOUT_S};
+
+impl EffectcraftApp {
+    /// The window title as of the last tick (`EffectCraft - <project>`, ` *` while modified). The
+    /// app sends it as `ViewportCommand::Title`, which eframe on the web ignores: that host writes
+    /// it to `document.title`.
+    pub fn window_title(&self) -> &str {
+        &self.window_title
+    }
+
+    /// Build the app around `session`.
+    /// Loads and applies the workspaces saved in the session's config directory (a failed load is reported in
+    /// `ui.status`), initializes the default UI, playback and render state, and registers the frontend's commands as
+    /// shortcutable `UiCommand`s on the session.
+    pub fn new(session: Session) -> Self {
+        let mut ui = UiState::default();
+        let workspace_store = workspace_state::WorkspaceStore::load(session.config.as_deref(), &mut ui);
+        EffectcraftApp {
+            session,
+            ui,
+            workspace_store,
+            tokens: Tokens::for_kind(Default::default()),
+            auto: Default::default(),
+            frames: Frames::default(),
+            playback: Playback::default(),
+            dialog: None,
+            hooks: Hooks::default(),
+            fps: 60.0,
+            clock: AppClock::default(),
+            now: 0.0,
+            last_time: 0.0,
+            styled: false,
+            fonts_ready: false,
+            styled_language: "",
+            focused: true,
+            input_active: false,
+            last_pointer_down: false,
+            draw_geom: None,
+            geometry_epoch: 0,
+            ime_tracker: egui::ImeContextTracker::new(),
+            ui_pass_seq: 0,
+            want_paint: false,
+            synthetic_in_flight: false,
+            synthetic_in_flight_events: vec![],
+            last_viewer_scale: None,
+            control_rx: None,
+            deferred: vec![],
+            synthetic: vec![],
+            forwarded: ForwardedInput::default(),
+            input_waiters: vec![],
+            job_waiters: vec![],
+            script_waiters: vec![],
+            pending_screenshots: vec![],
+            shot_bytes: 0,
+            last_activity: (0.0, 0),
+            last_edit: (0.0, 0),
+            toast: None,
+            viewer_tex: None,
+            passive_tex: std::collections::HashMap::new(),
+            viewer_native: None,
+            viewer_shown: None,
+            crypto_probe_busy: Default::default(),
+            viewer_image: None,
+            viewer_f16: None,
+            window_wgpu: None,
+            display_gpu: None,
+            display_gpu_failed: false,
+            viewer_bake: Default::default(),
+            snapshot_bake: Default::default(),
+            snapshot_f16: None,
+            viewer_readback: Default::default(),
+            wgpu: None,
+            gpu: None,
+            gpu_checked: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            gpu_build: None,
+            gpu_failures: None,
+            gpu_failure_applied: None,
+            footage_watcher: None,
+            footage_watch_key: None,
+            device_lost_close: None,
+            dialog_answers: std::sync::mpsc::channel(),
+            file_dialogs: FileDialogsUp::default(),
+            command_inbox: None,
+            pointer_comp: None,
+            dialog_state: Default::default(),
+            integrated_titlebar: false,
+            audio: None,
+            scrub: None,
+            meter: Default::default(),
+            expression_diagnostics: Default::default(),
+            waveforms: Default::default(),
+            last_reveal: None,
+            applied_prefs: None,
+            recovery: None,
+            dock_rects: vec![],
+            native_viewports: vec![],
+            unpublished_viewports: vec![],
+            pending_panel_raise: None,
+            home_thumbs: Default::default(),
+            home_thumb_saved: None,
+            window_title: String::new(),
+            template_thumbs: Default::default(),
+            template_list: None,
+            updates_rt: updates_ui::Runtime::default(),
+        }
+        .with_ui_commands()
+    }
+
+    /// Offer the frontend's commands (tools, timeline navigation…) for keyboard shortcuts.
+    fn with_ui_commands(mut self) -> Self {
+        let cmds = menus::UI_COMMANDS
+            .iter()
+            .map(|c| effectcraft_engine::shortcuts::UiCommand { id: c.id.into(), label: c.label.into(), shortcut: c.shortcut.map(str::to_string), scope: None })
+            .collect();
+        self.session.set_ui_commands(cmds);
+        self
+    }
+
+    pub fn with_control(mut self, rx: Receiver<ControlRequest>) -> Self {
+        self.control_rx = Some(rx);
+        self
+    }
+}
+
+impl eframe::App for EffectcraftApp {
+    fn on_exit(&mut self) {
+        self.save_workspace_state();
+        // Clean exit: no crash recovery next launch (unless the graphics device was lost with
+        // unsaved changes, which are in the auto-save it offers).
+        if self.device_lost_close != Some(true) {
+            self.session.end_recovery();
+        }
+    }
+
+    /// Feed pending synthetic input into `raw_input` only once fonts are ready (so a non-drawing pass never consumes
+    /// a batch), then prepare pointer wrapping; ending a numeric scrub clears the history merge key so the next edit
+    /// starts a new undo step.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
+        raw_input.events.append(&mut self.forwarded.events);
+        raw_input.dropped_files.append(&mut self.forwarded.files);
+        let injected = self.synthetic_in_flight || !self.synthetic.is_empty();
+        // Only a pass that can draw may receive synthetic input: `Context::run_ui` applies
+        // everything the hook feeds to its input state, so a pass that cannot draw (fonts still
+        // installing) would consume a batch it could not put back — putting it back would apply
+        // the click/key state twice. The queue waits here for the first pass that draws.
+        if self.fonts_ready {
+            self.feed_synthetic(raw_input);
+        }
+        if pointer_wrap::prepare_input(ctx, raw_input, injected) {
+            self.session.history.merge_key = None;
+        }
+    }
+
+    /// The logic-only tick: run `tick`, close the IME pass with `finish_ime_logic` and, last, hand a close to the
+    /// platform quit (`panels::unsaved::quit_on_close`). It does not read pass-time
+    /// input state (events, pointer and time are stale here), only the viewport information eframe refreshed.
+    fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
+        // Never `ctx.input(|i| i.time)` here: `Context::run_logic` leaves events, pointer state and
+        // time at the previous full pass's values (only the viewport information is refreshed).
+        self.tick(ctx, frame);
+        self.finish_ime_logic(ctx);
+        crate::panels::unsaved::quit_on_close(ctx);
+    }
+
+    /// Draw one UI pass through `draw`.
+    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
+        self.draw(ui, frame);
+    }
+}
diff --git a/crates/ui-egui/src/app/clipboard.rs b/crates/ui-egui/src/app/clipboard.rs
new file mode 100644
index 000000000..23b5080e0
--- /dev/null
+++ b/crates/ui-egui/src/app/clipboard.rs
@@ -0,0 +1,63 @@
+#[cfg(test)]
+use super::*;
+
+/// Put `width` × `height` straight-alpha RGBA8 pixels on the system clipboard (Composition ▸ Copy
+/// Frame to Clipboard). The pixel count is checked first: egui's image constructor panics on a
+/// size that doesn't match its buffer.
+pub(super) fn copy_image(ctx: &egui::Context, width: u32, height: u32, rgba: &[u8]) -> Result<(), String> {
+    let (w, h) = (width as usize, height as usize);
+    if w == 0 || h == 0 || w.checked_mul(h).and_then(|n| n.checked_mul(4)) != Some(rgba.len()) {
+        return Err(format!("cannot copy a malformed {width}×{height} image to the clipboard"));
+    }
+    ctx.copy_image(egui::ColorImage::from_rgba_unmultiplied([w, h], rgba));
+    Ok(())
+}
+
+#[cfg(test)]
+mod copy_frame_tests {
+    use super::*;
+
+    fn copied(output: &egui::FullOutput) -> Vec<&egui::ColorImage> {
+        output
+            .platform_output
+            .commands
+            .iter()
+            .filter_map(|c| match c {
+                egui::OutputCommand::CopyImage(image) => Some(image),
+                _ => None,
+            })
+            .collect()
+    }
+
+    /// Composition ▸ Copy Frame to Clipboard puts the rendered frame on the system clipboard.
+    #[test]
+    fn copy_frame_puts_the_frame_on_the_clipboard() {
+        let mut session = Session::default();
+        session.execute("comp.new", json!({"name": "Copy", "width": 8, "height": 6, "duration": 1})).unwrap();
+        session.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+        let mut app = EffectcraftApp::new(session);
+        let ctx = egui::Context::default();
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            crate::menus::invoke(&mut app, ui.ctx(), "comp.copyFrame", json!({})).unwrap();
+            app.handle_events(ui.ctx());
+        });
+        output.textures_delta.clear();
+        let images = copied(&output);
+        assert_eq!(images.len(), 1);
+        assert_eq!(images[0].size, [8, 6]);
+        assert!(images[0].pixels.iter().all(|p| *p == egui::Color32::from_rgb(255, 0, 0)));
+    }
+
+    /// A malformed image never reaches egui's panicking constructor.
+    #[test]
+    fn a_malformed_image_is_an_error_not_a_crash() {
+        let ctx = egui::Context::default();
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            assert!(copy_image(ui.ctx(), 4, 4, &[0; 10]).is_err());
+            assert!(copy_image(ui.ctx(), 0, 4, &[]).is_err());
+            assert!(copy_image(ui.ctx(), u32::MAX, u32::MAX, &[0; 4]).is_err());
+        });
+        output.textures_delta.clear();
+        assert!(copied(&output).is_empty());
+    }
+}
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
new file mode 100644
index 000000000..b1beab972
--- /dev/null
+++ b/crates/ui-egui/src/app/files.rs
@@ -0,0 +1,11 @@
+use super::{Dialog, EffectcraftApp};
+
+impl EffectcraftApp {
+    /// Show the crash-recovery dialog for a previous run that didn't exit cleanly.
+    pub fn offer_recovery(&mut self, r: effectcraft_engine::autosave::Recovery) {
+        if r.autosave.is_some() {
+            self.recovery = Some(r);
+            self.dialog = Some(Dialog::Recovery);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/frame.rs b/crates/ui-egui/src/app/frame.rs
new file mode 100644
index 000000000..c3a5bfbf6
--- /dev/null
+++ b/crates/ui-egui/src/app/frame.rs
@@ -0,0 +1,691 @@
+use super::clipboard::copy_image;
+use super::window::fit_window;
+use super::*;
+
+impl EffectcraftApp {
+    /// Completed, non-discarded UI passes since launch.
+    pub fn ui_passes(&self) -> u64 {
+        self.ui_pass_seq
+    }
+
+    // ---------------------------------------------------------------- control channel
+
+    pub(crate) fn raise_for_control(&mut self, ctx: &egui::Context) {
+        ctx.request_repaint();
+    }
+
+    /// Handle the control channel for this tick: drain queued requests plus previously deferred ones, run each
+    /// through `control::handle`, answer `Done` immediately, retry `Retry` until its three-second deadline, hold
+    /// input/job/screenshot replies until their event happens and finish job waiters. Retry timeouts and refused
+    /// screenshots are answered as `{"ok": false, "error": ...}`; the receiver is kept for the next tick.
+    fn drain_control(&mut self, ctx: &egui::Context, now: f64) {
+        let Some(rx) = self.control_rx.take() else { return };
+        let mut reqs: Vec<(ControlRequest, f64)> = std::mem::take(&mut self.deferred);
+        while let Ok(req) = rx.try_recv() {
+            reqs.push((req, now + 3.0));
+        }
+        for (req, deadline) in reqs {
+            let reply = req.reply.clone();
+            match control::handle(self, ctx, &req, now) {
+                control::Outcome::Done(v) => {
+                    let _ = reply.send(v);
+                }
+                control::Outcome::Retry(msg) => {
+                    if now < deadline {
+                        self.deferred.push((req, deadline));
+                        ctx.request_repaint();
+                    } else {
+                        let _ = reply.send(json!({"ok": false, "error": msg}));
+                    }
+                }
+                control::Outcome::AfterInput => {
+                    self.input_waiters.push(reply);
+                    // The reply waits for a real UI pass: a hidden window must run one.
+                    self.want_paint = true;
+                }
+                control::Outcome::AwaitJobs(w) => {
+                    self.job_waiters.push((w, reply));
+                    ctx.request_repaint();
+                }
+                control::Outcome::AwaitScript(host) => {
+                    self.script_waiters.push((host, reply));
+                    ctx.request_repaint();
+                }
+                control::Outcome::Screenshot { path, target } => {
+                    // A covered or minimized window presents no frames (macOS skips its redraws), so
+                    // a screenshot would never arrive and nothing would tick its timeout. The
+                    // hidden-window capture path (a pending screenshot forces a pass in 0.37) needs
+                    // a native platform run before this gate is removed; the web build never paints
+                    // a hidden tab.
+                    if ctx.input(|i| i.viewport().occluded == Some(true) || i.viewport().minimized == Some(true)) {
+                        let _ = reply.send(json!({"ok": false, "error": "window is covered or minimized: call ui.focus first (render.frame renders comp pixels without the window)"}));
+                        continue;
+                    }
+                    self.admit_screenshot(ctx, path, target, reply);
+                }
+            }
+        }
+        self.control_rx = Some(rx);
+        self.finish_job_waiters(ctx);
+    }
+
+    /// Reply to the control requests whose offloaded jobs ended.
+    fn finish_job_waiters(&mut self, ctx: &egui::Context) {
+        if self.job_waiters.is_empty() {
+            return;
+        }
+        let script_busy = self.session.script_ui.render_host.is_some();
+        if !script_busy {
+            self.session.poll_render();
+            self.session.poll_offload();
+        }
+        let waiters = std::mem::take(&mut self.job_waiters);
+        for (w, reply) in waiters {
+            // Completed native snapshots are immutable, so even a later suspended script
+            // cannot delay their replies. Other completions can edit its open undo group.
+            if (script_busy && w.render.is_none()) || w.pending(self) {
+                self.job_waiters.push((w, reply));
+            } else {
+                let v = w.finish(self);
+                let _ = reply.send(v);
+            }
+        }
+        if !self.job_waiters.is_empty() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(50));
+        }
+    }
+
+    /// A suspended script still owns its undo groups. Only its render, inspection and Stop
+    /// run until the continuation reaches its next real script boundary; no scheduled callback
+    /// or background analysis may edit the document in the middle of the group.
+    fn tick_script_render(&mut self, ctx: &egui::Context) {
+        let Some(host) = self.session.script_ui.render_host else { return };
+        let result = match self.session.script_ui.poll_render {
+            Some(poll) => poll(&mut self.session),
+            None => {
+                self.session.script_ui.render_host = None;
+                Some(json!({"ok": false, "error": {"message": "The script render waiter is unavailable."}}))
+            }
+        };
+        if let Some(result) = result {
+            if let Some(message) = result["error"]["message"].as_str() {
+                self.ui.status = message.to_string();
+            } else if let Some(output) = result["output"].as_str().filter(|s| !s.is_empty()) {
+                self.ui.status = output.lines().last().unwrap_or(output).to_string();
+            }
+            self.script_waiters.retain(|(id, reply)| {
+                if *id == host {
+                    let _ = reply.send(json!({"ok": true, "result": result}));
+                    false
+                } else {
+                    true
+                }
+            });
+        }
+        // Do not interpret a close as permission to abandon the still-running script. Once
+        // Stop finishes it, the normal unsaved-changes prompt can handle a new close request.
+        if ctx.input(|i| i.viewport().close_requested()) {
+            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+        }
+        self.drain_control(ctx, self.now);
+        ctx.request_repaint_after(std::time::Duration::from_millis(50));
+    }
+
+    // ---------------------------------------------------------------- frame
+
+    /// Apply the engine events drained this tick: open a comp, show a toast, open a URL, run a frontend command,
+    /// purge frame caches or copy an image; command and clipboard failures go to `app.ui.status`.
+    pub(crate) fn handle_events(&mut self, ctx: &egui::Context) {
+        for ev in self.session.drain_events() {
+            match ev {
+                effectcraft_engine::Event::OpenComp(c) => {
+                    panels::viewers::on_open_comp(self, c);
+                    self.ui.timeline.pps = None;
+                }
+                effectcraft_engine::Event::Toast { message, .. } => self.toast = Some((message, self.now)),
+                effectcraft_engine::Event::OpenUrl(url) => ctx.open_url(egui::OpenUrl::new_tab(url)),
+                // Frames are keyed by content: an edit keeps those of comps it doesn't touch.
+                effectcraft_engine::Event::ProjectChanged { .. } => {}
+                effectcraft_engine::Event::Frontend { command, params } => {
+                    if let Err(e) = crate::menus::frontend(self, ctx, &command, params) {
+                        self.ui.status = e;
+                    }
+                }
+                effectcraft_engine::Event::PurgeCaches => self.frames.clear(),
+                effectcraft_engine::Event::CopyImage { width, height, rgba } => {
+                    if let Err(e) = copy_image(ctx, width, height, &rgba) {
+                        self.ui.status = e;
+                    }
+                }
+            }
+        }
+    }
+
+    /// The app's only non-paint entry: one tick of background work.
+    ///
+    /// This runs for every eframe logic callback, including the logic-only ticks of a hidden
+    /// window (which never reach [`Self::draw`]). It must therefore do no input handling, no
+    /// layout and no presentation: engine/job queues, autosave, playback, audio, the control
+    /// channel, screenshots and the close guard. Everything here is idempotent for a pass that
+    /// `Context::request_discard` replays.
+    pub fn tick(&mut self, ctx: &egui::Context, frame: &eframe::Frame) {
+        self.now = self.clock.now();
+        // The compositor exists before the first paint and while hidden (device-loss handling
+        // must run there too).
+        self.init_gpu(ctx, frame);
+        self.apply_gpu_failure(ctx);
+        if self.gpu_failure_applied == Some(true) {
+            self.close_after_device_loss(ctx);
+            // On macOS the app quits through `-[NSApplication terminate:]` instead of closing the
+            // window while AppKit's run loop is running (#341).
+            craft_quit::on_close_request(ctx);
+            return;
+        }
+        if self.session.script_ui.render_host.is_some() {
+            self.tick_script_render(ctx);
+            return;
+        }
+        // Focus comes from the fresh viewport copy; a full pass's `InputState::focused` is only a
+        // fallback (a logic-only tick leaves it at the previous pass's value).
+        let focused = ctx.input(|i| i.viewport().focused.or(Some(i.focused)));
+        self.focused = focused.unwrap_or(self.focused);
+        // The interface language's fallback fonts are installed in `draw` (fonts need a pass), but
+        // commands handled here use the right catalog already.
+        let language = crate::i18n::language(self);
+        crate::i18n::set_current(language);
+        // #1089: a font-menu rescan runs off the UI thread. Poll it on the logic tick so the
+        // status and the menu update even when the window is not painting.
+        crate::panels::text_panels::poll_font_rescan(self, ctx);
+        if self.styled_language != language {
+            self.want_paint = true;
+        }
+        // Frames and worker completions wake the app even while it is hidden.
+        self.frames.set_context(ctx);
+        updates_ui::tick(self, ctx);
+        if self.session.render_job.is_some() {
+            self.session.poll_render();
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+        if self.session.track_job.is_some() {
+            self.session.poll_track();
+            ctx.request_repaint_after(std::time::Duration::from_millis(50));
+        }
+        if self.session.mask_job.is_some() {
+            self.session.poll_mask_track();
+            ctx.request_repaint_after(std::time::Duration::from_millis(50));
+        }
+        // Background tasks (Content-Aware Fill, Scene Edit Detection, imports).
+        if !self.session.tasks.is_empty() {
+            self.session.poll_jobs();
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+        // Analyses running in a worker (the web app).
+        if !self.session.offloaded.is_empty() {
+            self.session.poll_offload();
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+        // Plug-in Library: a finished job's toast (also polled with Roto, for other frontends).
+        self.session.poll_library();
+        // Warp Stabilizer: finish analyses and start queued (re-)analyses in the background.
+        if self.session.warp_job.is_some() || !self.session.warp_pending.is_empty() {
+            self.session.poll_warp(true);
+            self.session.poll_roto(true);
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+        // Roto Brush propagation and Object Matte tracking / Freeze: finish jobs (a Freeze writes
+        // its mattes) and start queued ones in the background.
+        if self.session.roto_job.is_some() || !self.session.roto_pending.is_empty() {
+            self.session.poll_roto(true);
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+        // 3D Camera Tracker: likewise (tracking, then solving).
+        if self.session.camera_job.is_some() || !self.session.camera_pending.is_empty() {
+            self.session.poll_camera(true);
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+        self.run_script_tasks(ctx);
+        if self.session.script_ui.render_host.is_some() {
+            self.tick_script_render(ctx);
+            return;
+        }
+        self.run_dialog_answers();
+        if self.session.script_ui.render_host.is_some() {
+            self.tick_script_render(ctx);
+            return;
+        }
+        self.handle_events(ctx);
+        if self.session.script_ui.render_host.is_some() {
+            self.tick_script_render(ctx);
+            return;
+        }
+        if let Some(rx) = self.command_inbox.take() {
+            while let Ok(id) = rx.try_recv() {
+                if let Err(e) = menus::invoke(self, ctx, &id, json!({})) {
+                    self.ui.status = e;
+                }
+            }
+            self.command_inbox = Some(rx);
+        }
+        if self.session.script_ui.render_host.is_some() {
+            self.tick_script_render(ctx);
+            return;
+        }
+        // A close request (the window's button, Quit, `app.quit`) must be answered while hidden.
+        // An answered file dialog can change the project, so the answers above run first. The host
+        // calls `panels::unsaved::quit_on_close` last in its `logic`.
+        panels::unsaved::on_close_requested(self, ctx);
+        let title = panels::unsaved::window_title(self);
+        if title != self.window_title {
+            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
+            self.window_title = title;
+        }
+        self.tick_autosave(ctx);
+        self.tick_workspace_autosave(ctx);
+        let now = self.now;
+        prefs_live::tick(self, ctx, now);
+        // Playback advances without a paint (its frames and the audio clock are background work).
+        // Idle prefetch keeps its old condition: it only runs once a viewer has drawn.
+        if (self.playback.playing || self.last_viewer_scale.is_some())
+            && let Some(cid) = self.session.active_comp_id()
+        {
+            let (scale, active) = (self.last_viewer_scale.unwrap_or(1.0), self.input_active);
+            self.advance_playback(ctx, scale, now, active, cid);
+        }
+        self.drain_control(ctx, now);
+        // A clean project may have passed the close guard before a control script created
+        // unsaved edits and suspended. Cancel that same tick's close before the host handles it.
+        if self.session.script_ui.render_host.is_some() {
+            self.tick_script_render(ctx);
+            return;
+        }
+        // Screenshot completion, deadlines and issuance are app-side work: the callback only
+        // stores pixels and wakes this viewport.
+        self.tick_screenshots(ctx);
+        // Time-based FPS readout over UI passes (a hidden logic-only tick is not a frame).
+        let dt = (now - self.last_time) as f32;
+        if dt > 0.0 && dt < 2.0 {
+            self.fps = self.fps * 0.9 + (1.0 / dt).min(480.0) * 0.1;
+        }
+        self.last_time = now;
+        // A hidden window paints when work needs a UI pass: queued input and waits, a settled
+        // screenshot, or playback into a child viewport.
+        let focused = self.focused;
+        let child_viewports = !self.ui.dock.layout.floating.is_empty() || prefs_live::video_preview_active(self, focused);
+        let paint = self.want_paint
+            || !self.synthetic.is_empty()
+            || !self.input_waiters.is_empty()
+            || self.pending_screenshots.iter().any(|s| s.slot.is_none())
+            || (self.playback.playing && child_viewports);
+        if paint {
+            self.request_hidden_paint(ctx);
+        }
+    }
+
+    /// Ask the host for a UI pass even when the window is minimized or occluded.
+    ///
+    /// Native eframe honours `RequestPaintWhileHidden`; the shared web backend does not carry it
+    /// yet (a browser does not paint a hidden tab), so the web build only requests a normal
+    /// repaint and hidden web screenshots/input remain unqualified.
+    fn request_hidden_paint(&mut self, ctx: &egui::Context) {
+        self.want_paint = false;
+        #[cfg(not(target_arch = "wasm32"))]
+        ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
+        ctx.request_repaint();
+    }
+
+    /// Install the theme and fonts for the current language. Fonts need a real pass: the pass
+    /// that installs them draws nothing, and the next pass draws with them (the two-pass warm-up
+    /// the app has always had). Never call this from a logic-only tick.
+    fn ui_setup(&mut self, ctx: &egui::Context) {
+        panels::viewer_text::install_hooks(ctx);
+        let language = crate::i18n::language(self);
+        crate::i18n::set_current(language);
+        if (!self.styled || self.styled_language != language) && self.synthetic_in_flight {
+            // The install needs a pass that draws nothing, but this pass has already applied a
+            // synthetic batch: defer the theme/font install by one pass instead of dropping the
+            // input (feeds are only put into a pass that can draw).
+            ctx.request_repaint();
+            return;
+        }
+        if !self.styled || self.styled_language != language {
+            theme::install(ctx, &self.tokens, language);
+            self.styled_language = language;
+            if !self.styled {
+                fit_window(ctx);
+                self.styled = true;
+            }
+            self.fonts_ready = false;
+            ctx.request_repaint();
+        } else if !self.fonts_ready {
+            // The pass after the install draws: egui has the new font definitions by now.
+            self.fonts_ready = true;
+            ctx.request_repaint();
+        }
+    }
+
+    /// One UI pass: setup, input-driven shortcuts, layout and painting. Called from
+    /// `eframe::App::ui` and by tests with the root `Ui`.
+    pub fn draw(&mut self, ui: &mut egui::Ui, frame: &eframe::Frame) {
+        panels::viewer_text::begin_ui(ui.ctx());
+        self.draw_inner(ui, frame);
+        // All exits, including fonts/device loss, observe this pass's real custom availability.
+        panels::viewer_text::finish_ime(self, ui);
+    }
+
+    /// Context creators install these hooks before the first full pass.
+    pub fn install_ime_reset_hooks(ctx: &egui::Context) {
+        panels::viewer_text::install_hooks(ctx);
+    }
+
+    /// Host wrappers call this after their last logic mutation, without replaying UI events.
+    pub fn finish_ime_logic(&self, ctx: &egui::Context) {
+        panels::viewer_text::finish_logic(self, ctx);
+    }
+
+    /// One UI pass after the IME begin hook: close on an applied GPU failure, run `ui_setup`, skip drawing until
+    /// fonts are ready, draw the frame, finish pointer wrapping, pump queued wasm frames, record input activity,
+    /// publish the completed pass's geometry and pass sequence, acknowledge applied synthetic input and answer
+    /// `AfterInput` replies only after a non-discarded pass. Requests repaints while frames are in flight.
+    fn draw_inner(&mut self, ui: &mut egui::Ui, frame: &eframe::Frame) {
+        let ctx = ui.ctx().clone();
+        if self.gpu_failure_applied == Some(true) {
+            self.close_after_device_loss(&ctx);
+            return;
+        }
+        self.ui_setup(&ctx);
+        if !self.fonts_ready {
+            // A pass that installs fonts draws nothing. No synthetic batch is in flight here (the
+            // hook feeds input only to a ready app), and events egui already applied are never
+            // fed again: that would double the pointer/key state of one click.
+            ctx.request_repaint();
+            return;
+        }
+        panels::crypto_pick::pass_start(self, &ctx);
+        self.frame(ui);
+        panels::crypto_pick::upkeep(self, &ctx);
+        #[cfg(not(target_arch = "wasm32"))]
+        pointer_wrap::finish_native(&ctx, frame);
+        // wasm32: no frame threads; render queued frames now, between UI frames.
+        if cfg!(target_arch = "wasm32") && self.frames.pump(std::time::Duration::from_millis(if self.playback.playing { 24 } else { 40 })) {
+            ctx.request_repaint();
+        }
+        // Input belongs to this known UI phase: record it for the next tick.
+        let active = ctx.input(|i| !i.events.is_empty() || i.pointer.any_down() || i.pointer.is_moving());
+        self.input_active = active;
+        self.last_pointer_down = ctx.input(|i| i.pointer.any_down());
+        // Geometry of a completed pass (a discarded pass is laid out again; only the final one
+        // describes the surface the next capture will see). Window position is irrelevant.
+        if !ctx.will_discard() {
+            let rect = ctx.content_rect();
+            let ppp = ctx.pixels_per_point();
+            let changed = self.draw_geom.is_none_or(|g| g.rect.size() != rect.size() || g.ppp != ppp);
+            if changed {
+                self.geometry_epoch = self.geometry_epoch.wrapping_add(1);
+            }
+            self.draw_geom = Some(DrawGeometry { rect, ppp, epoch: self.geometry_epoch });
+            self.ui_pass_seq = self.ui_pass_seq.saturating_add(1);
+        }
+        // A batch is acknowledged once a UI pass applied it, even if layout was later discarded.
+        self.mark_synthetic_applied();
+        // `AfterInput` replies wait for the final (non-discarded) pass that applied the last
+        // synthetic event: a hidden request is answered only after its forced pass, and a pass
+        // egui throws away cannot produce an early success reply.
+        if !ctx.will_discard() && self.synthetic.is_empty() {
+            for w in self.input_waiters.drain(..) {
+                let _ = w.send(json!({"ok": true, "result": null}));
+            }
+        } else if !self.input_waiters.is_empty() {
+            self.want_paint = true;
+            ctx.request_repaint();
+        }
+        if self.frames.inflight() > 0 {
+            ctx.request_repaint_after(std::time::Duration::from_millis(30));
+        }
+    }
+
+    /// The panels, menus, dialogs and overlays of one pass.
+    fn frame(&mut self, ui: &mut egui::Ui) {
+        let ctx = ui.ctx().clone();
+        if self.session.script_ui.render_host.is_some() {
+            self.auto.begin_frame();
+            ui.vertical_centered(|ui| {
+                ui.add_space(32.0);
+                ui.heading("Rendering script");
+                ui.label("The script will continue when rendering finishes. Editing is paused to preserve its undo group.");
+                if let Some(progress) = self.session.render_progress() {
+                    ui.label(format!("{} / {} frames", progress.done, progress.total));
+                }
+                let stop = ui.button("Stop Render");
+                self.auto.add("scriptRender.stop", stop.rect, "Stop Render");
+                if stop.clicked() {
+                    self.session.stop_render();
+                }
+            });
+            return;
+        }
+        // Only a viewer that draws in *this* pass records a scale: a closed viewer, the Home
+        // screen or another comp must stop idle prefetch at a stale scale.
+        self.last_viewer_scale = None;
+        self.apply_prefs(&ctx);
+        // Video Preview is a second viewport: only a real pass can update it.
+        prefs_live::frame(self, &ctx);
+        self.auto.begin_frame();
+        panels::viewer_tools::clear_sample_source(&ctx);
+        if let Some(rect) = crate::color_picker::take_automation(&ctx) {
+            self.auto.add("colorPicker.eyedropper", rect, "Eyedropper");
+        }
+        let tab_had_widget_focus = ctx.egui_wants_keyboard_input();
+        menus::handle_shortcuts(self, &ctx);
+        if !ctx.input(|i| i.pointer.primary_down()) {
+            self.ui.viewer.property_interacting = false;
+        }
+        let t = self.tokens;
+        let full = ui.max_rect();
+        if self.dialog.is_some() {
+            ui.disable();
+            // A dialog that edits what is behind it live (Preview) leaves the window at full
+            // brightness: clicks still don't reach it, but the canvas is not greyed out.
+            if self.dialog == Some(Dialog::GradientEditor) || panels::live_preview::active(self) {
+                ui.set_opacity(1.0);
+            }
+        }
+        ui.painter().rect_filled(full, 0.0, t.app_bg);
+        let mut top = full.min.y;
+        if self.ui.show_menu_bar {
+            let mb = egui::Rect::from_min_size(full.min, egui::vec2(full.width(), 24.0));
+            let mut child = ui.new_child(egui::UiBuilder::new().max_rect(mb));
+            child.painter().rect_filled(mb, 0.0, t.header_bg);
+            menus::menu_bar(self, &mut child);
+            top = mb.max.y;
+        }
+        let header_h = 40.0;
+        let header = egui::Rect::from_min_size(egui::pos2(full.min.x, top), egui::vec2(full.width(), header_h));
+        header::show(self, ui, header);
+        let body = egui::Rect::from_min_max(egui::pos2(full.min.x + 4.0, header.max.y + 2.0), egui::pos2(full.max.x - 4.0, full.max.y - 4.0));
+        crate::color_picker::note_dialog(&ctx, self.dialog);
+        // After the shortcuts, menus and header, which can replace the project (New, Open).
+        self.ui.timeline.scope_links(self.session.script_ui.project_epoch);
+        self.dock_area(ui, body);
+        #[cfg(not(target_arch = "wasm32"))]
+        prefs_live::dropped_files(self, ui, full);
+        if !tab_had_widget_focus {
+            menus::handle_tab_shortcut(self, &ctx);
+        }
+        panels::precomp::mini_flowchart(self, &ctx);
+        panels::home::capture_thumbnail(self);
+        panels::dialogs::show(self, &ctx);
+        updates_ui::show(self, &ctx);
+        panels::scriptui_view::sync_panels(self);
+        panels::scriptui_view::show_windows(self, &ctx);
+        panels::learn::coach(self, &ctx);
+        let lift = panels::media_panels::import_card(self, ui, full);
+        self.draw_toast(ui, full, lift);
+    }
+
+    /// Workspace-layout auto-save: a background write that also runs while hidden, once the
+    /// pointer has lifted.
+    fn tick_workspace_autosave(&mut self, ctx: &egui::Context) {
+        if self.session.config.is_none() || !self.workspace_store.has_changes(&self.ui) || self.last_pointer_down {
+            return;
+        }
+        if self.workspace_store.due(self.now) {
+            self.save_workspace_state();
+        }
+        if self.workspace_store.has_changes(&self.ui) {
+            ctx.request_repaint_after(std::time::Duration::from_secs(1));
+        }
+    }
+
+    pub(super) fn save_workspace_state(&mut self) {
+        if let Err(error) = self.workspace_store.save(self.session.config.as_deref(), &self.ui) {
+            if self.workspace_store.error.as_ref() != Some(&error) {
+                log::warn!("{error}");
+                self.ui.status = error.clone();
+            }
+            self.workspace_store.error = Some(error);
+        }
+    }
+
+    /// Sets the status line and restarts its 5 s, also when the same text is still showing (a
+    /// message set again would otherwise keep the time it was first shown).
+    pub(crate) fn say(&mut self, ctx: &egui::Context, msg: String) {
+        ctx.data_mut(|d| d.remove::<(f64, String)>(egui::Id::unique("status-since")));
+        self.ui.status = msg;
+    }
+
+    /// The status message or the latest toast, bottom left (`lift` points higher while the
+    /// Importing card is there).
+    fn draw_toast(&mut self, ui: &mut egui::Ui, full: egui::Rect, lift: f32) {
+        let now = self.now;
+        // A message cleared before its time (a click on it, Esc, another pick) forgets its time, so
+        // the same message shown again later gets its own 5 s.
+        if self.ui.status.is_empty() {
+            ui.data_mut(|d| d.remove::<(f64, String)>(egui::Id::unique("status-since")));
+        }
+        let msg = if !self.ui.status.is_empty() {
+            Some(self.ui.status.clone())
+        } else {
+            self.toast.as_ref().filter(|(_, at)| now - at < 4.0).map(|(m, _)| m.clone())
+        };
+        if let Some(m) = msg {
+            let t = &self.tokens;
+            let galley = ui.painter().layout_no_wrap(m.clone(), Tokens::ui(12.0), t.text);
+            let r = egui::Rect::from_min_size(egui::pos2(full.min.x + 16.0, full.max.y - 44.0 - lift), galley.size() + egui::vec2(24.0, 14.0));
+            ui.painter().rect_filled(r, 6.0, t.panel_bg);
+            ui.painter().rect_stroke(r, 6.0, egui::Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
+            ui.painter().galley(r.min + egui::vec2(12.0, 7.0), galley, t.text);
+            self.auto.add("toast", r, &m);
+            let resp = ui.interact(r, egui::Id::unique("toast"), egui::Sense::click());
+            if resp.clicked() {
+                self.ui.status.clear();
+                self.toast = None;
+            }
+            // "Preparing the GPU compositor…" stays until the compositor is attached (tens of
+            // seconds on a cold shader cache), not 5 s: `finish_gpu_build` clears it, and the
+            // worker's repaint brings that frame, so nothing needs to tick meanwhile. A click
+            // still dismisses it.
+            if self.ui.status == crate::GPU_PREPARING && self.gpu_initializing() {
+                return;
+            }
+            ui.ctx().request_repaint_after(std::time::Duration::from_millis(500));
+            if !self.ui.status.is_empty() {
+                // Each message gets its own 5 s (a new one doesn't inherit the old one's time).
+                let key = egui::Id::unique("status-since");
+                let shown = ui.data(|d| d.get_temp::<(f64, String)>(key)).filter(|(_, m)| *m == self.ui.status);
+                let since = shown.map_or(now, |(t, _)| t);
+                ui.data_mut(|d| d.insert_temp(key, (since, self.ui.status.clone())));
+                if now - since > 5.0 {
+                    self.ui.status.clear();
+                    ui.data_mut(|d| d.remove::<(f64, String)>(key));
+                }
+            }
+        }
+    }
+}
+
+impl EffectcraftApp {
+    /// Scripts' `app.scheduleTask` tasks that are due (repeating ones keep a ScriptUI panel
+    /// fresh): errors as a toast, the last line printed in the status bar, and a repaint when
+    /// the next one is due.
+    fn run_script_tasks(&mut self, ctx: &egui::Context) {
+        if self.session.script_ui.task_hosts.is_empty() {
+            return;
+        }
+        let previous_comp = self.session.active_comp_id();
+        let Some(r) = effectcraft_engine::scriptui::ScriptUi::run_tasks(&mut self.session) else { return };
+        if self.session.active_comp_id().is_some() && self.session.active_comp_id() != previous_comp {
+            self.ui.start_screen = false;
+        }
+        if let Some(msg) = r["errors"].as_array().and_then(|e| e.first()).and_then(|e| e["message"].as_str()) {
+            self.toast = Some((format!("Scheduled script task: {msg}"), self.now));
+        } else if let Some(line) = r["output"].as_array().and_then(|o| o.last()).and_then(|l| l.as_str()) {
+            self.ui.status = line.to_string();
+        }
+        if let Some(next) = r["next"].as_u64() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(next));
+        }
+    }
+
+    /// Auto-save a dirty project when the interval has passed (Settings ▸ Project ▸ Auto-Save).
+    fn tick_autosave(&mut self, ctx: &egui::Context) {
+        // Monotonic app time: a wall-clock jump must not skip or repeat an auto-save.
+        let now = self.now;
+        if let Some(Err(e)) = self.session.autosave_tick(now) {
+            self.ui.status = e.to_string();
+        }
+        if self.session.prefs.auto_save.enabled {
+            ctx.request_repaint_after(std::time::Duration::from_secs(30));
+        }
+        // File ▸ Watch Folder: look for new projects every 10 seconds.
+        if self.session.state.watch_folder.is_some() {
+            let key = egui::Id::unique("watchFolder.lastPoll");
+            let last: f64 = ctx.data(|d| d.get_temp(key)).unwrap_or(0.0);
+            if now - last >= 10.0 {
+                ctx.data_mut(|d| d.insert_temp(key, now));
+                match self.session.execute("file.watchFolder.poll", serde_json::json!({})) {
+                    Ok(r) => {
+                        if let Some(n) = r["rendered"].as_array().map(Vec::len).filter(|n| *n > 0) {
+                            self.ui.status = format!("Watch Folder: rendered {n} project(s)");
+                        }
+                    }
+                    Err(e) => self.ui.status = e.to_string(),
+                }
+            }
+            ctx.request_repaint_after(std::time::Duration::from_secs(10));
+        }
+        self.tick_footage_reload(ctx);
+    }
+
+    /// One background worker tracks source availability and optional content reloads. It wakes
+    /// the UI only for changes; availability remains enabled when automatic reload is off.
+    fn tick_footage_reload(&mut self, ctx: &egui::Context) {
+        use effectcraft_engine::footage_reload;
+        if self.session.project.items.is_empty() && self.footage_watcher.is_none() {
+            return;
+        }
+        if self.footage_watcher.is_none() {
+            let wake = ctx.clone();
+            self.footage_watcher = footage_reload::Watcher::start(self.session.services.clone(), move || wake.request_repaint());
+        }
+        let Some(watcher) = &mut self.footage_watcher else { return };
+        watcher.set_focused(self.focused);
+        // Which files are watched follows the project and the preference, not the frame.
+        let key = (self.session.revision, self.session.prefs.import.auto_reload_footage.clone(), self.session.disk_cache.is_some());
+        if self.footage_watch_key.as_ref() != Some(&key) {
+            self.footage_watch_key = Some(key);
+            watcher.update(&self.session);
+        }
+        let before = self.session.revision;
+        if let Some(scan) = watcher.take() {
+            match scan.apply(&mut self.session) {
+                Ok(result) if result.get("stale").and_then(serde_json::Value::as_bool) == Some(true) => watcher.recheck(),
+                Err(e) => self.ui.status = e.to_string(),
+                _ => {}
+            }
+        }
+        if self.session.revision != before {
+            self.footage_watch_key = Some((self.session.revision, self.session.prefs.import.auto_reload_footage.clone(), self.session.disk_cache.is_some()));
+            watcher.update(&self.session);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/gpu.rs b/crates/ui-egui/src/app/gpu.rs
new file mode 100644
index 000000000..c9849e921
--- /dev/null
+++ b/crates/ui-egui/src/app/gpu.rs
@@ -0,0 +1,348 @@
+use super::{Arc, EffectcraftApp, RenderSource, gpu_failure, menus, panels};
+
+/// The status line while the GPU compositor's worker thread is still building its pipelines
+/// (see [`EffectcraftApp::init_gpu`]).
+pub const GPU_PREPARING: &str = "Preparing the GPU compositor… (compositing on the CPU until it is ready)";
+/// What the compositor's worker thread hands back: the compositor, why the device can't run it,
+/// or the payload of a panic in the graphics backend.
+pub type GpuBuild = std::thread::Result<Result<effectcraft_gpu::Gpu, String>>;
+
+impl EffectcraftApp {
+    pub fn render_source(&self) -> RenderSource {
+        RenderSource {
+            project: self.session.project.clone(),
+            footage: self.session.footage.clone(),
+            expr: self.session.expr.clone(),
+            layer_cache: self.session.layer_cache.clone(),
+            gpu: self.gpu.clone(),
+            gpu_display: self.gpu_display(),
+            disk: self.session.disk_cache.clone(),
+        }
+    }
+
+    /// Keep GPU-composited viewer frames on the GPU (drawn from their texture). The browser can't
+    /// read frames back (its thread can't wait for the GPU), so there the viewer shows GPU frames
+    /// directly whenever it draws them plainly (RGB, no exposure, no region of interest); the
+    /// desktop reads them back (see [`frames::RenderSource::gpu_display`]).
+    fn gpu_display(&self) -> bool {
+        let v = &self.session.state.viewer;
+        cfg!(target_arch = "wasm32")
+            && v.channel == effectcraft_engine::viewer::Channel::Rgb
+            && v.exposure == 0.0
+            && self.session.state.region_of_interest.is_none()
+            && self.ui.viewer.extended.is_none()
+    }
+
+    /// The UI draws its panels and handles input such as dropped files. Until the fonts are
+    /// installed (the first frames) it draws nothing, and that input goes unhandled.
+    pub fn is_ready(&self) -> bool {
+        self.fonts_ready
+    }
+
+    /// Provide the executable/embedding host's device notifications. The host installs the
+    /// handlers once; this frontend never replaces handlers on a borrowed device.
+    pub fn set_gpu_failure_bridge(&mut self, bridge: gpu_failure::GpuFailureBridge) {
+        if let Some(gpu) = &self.gpu {
+            bridge.forward_to(gpu.context().device_failure_notifier());
+        }
+        self.gpu_failures = Some(bridge);
+    }
+
+    pub(super) fn apply_gpu_failure(&mut self, ctx: &egui::Context) {
+        let Some(bridge) = &self.gpu_failures else { return };
+        // Readback deadlines can retire the compositor without a host device notification.
+        if let Some(gpu) = &self.gpu
+            && let Err(reason) = gpu.context().check_health()
+        {
+            bridge.report(&reason, false);
+        }
+        let Some(failure) = bridge.failure() else { return };
+        if self.gpu_failure_applied == Some(failure.presentation_lost) {
+            return;
+        }
+        self.gpu_failure_applied = Some(failure.presentation_lost);
+        self.gpu_checked = true;
+        self.frames.retire_gpu();
+        self.session.accel = None;
+        self.session.accel_note = Some(format!("GPU preview retired: {}", failure.reason));
+        self.session.layer_cache.clear();
+        self.gpu = None;
+        if let Some(rs) = &self.wgpu {
+            let mut renderer = rs.renderer.write();
+            if let Some((id, _, _)) = &self.viewer_native {
+                renderer.free_texture(id);
+            }
+            for (_, texture) in self.passive_tex.values() {
+                match texture {
+                    panels::viewers::PassiveTexture::Gpu(id, _) => renderer.free_texture(id),
+                    panels::viewers::PassiveTexture::Baked(b) => {
+                        if let Some(id) = b.id() {
+                            renderer.free_texture(&id);
+                        }
+                    }
+                    panels::viewers::PassiveTexture::Cpu(_) => {}
+                }
+            }
+            drop(renderer);
+        }
+        // The display pass's textures: half-float frames go through the CPU from now on.
+        self.viewer_bake.free(self.window_wgpu.as_ref());
+        self.snapshot_bake.free(self.window_wgpu.as_ref());
+        self.display_gpu = None;
+        self.window_wgpu = None;
+        self.viewer_native = None;
+        self.passive_tex.retain(|_, (_, texture)| matches!(texture, panels::viewers::PassiveTexture::Cpu(_)));
+        self.viewer_shown = match &self.viewer_f16 {
+            // A half-float frame stays on screen through the CPU pass.
+            Some(_) => self.viewer_shown.map(|(_, key)| (None, key)),
+            None => self.viewer_tex.as_ref().map(|(texture, key, _)| (Some(texture.id()), *key)),
+        };
+        self.viewer_image = None;
+        // Old completion closures retain only their detached slot, not the replacement.
+        self.viewer_readback = Default::default();
+        self.wgpu = None;
+        self.ui.status = if failure.presentation_lost {
+            "Graphics device lost. The project is still open; presentation requires restarting the application.".into()
+        } else {
+            "Shared GPU preview disabled; CPU compositing remains available.".into()
+        };
+        log::warn!("GPU preview retired: {}", failure.reason);
+        ctx.request_repaint();
+    }
+
+    /// After the graphics device is lost, eframe's renderer cannot draw again: any mesh makes
+    /// egui-wgpu panic on the main thread when it cannot stage its index buffer (#591). Draw
+    /// nothing from then on, auto-save a project with unsaved changes (keeping the crash
+    /// recovery marker, so the next launch offers it) and close the window.
+    pub(super) fn close_after_device_loss(&mut self, ctx: &egui::Context) {
+        if self.device_lost_close.is_some() {
+            return;
+        }
+        let keep_recovery = self.session.is_dirty();
+        let saved = keep_recovery.then(|| match self.session.autosave_now().and_then(|path| self.session.autosave_wait().map(|()| path)) {
+            Ok(path) => {
+                log::warn!("graphics device lost: auto-saved {path}; the next launch offers to recover it");
+                Ok(path)
+            }
+            Err(e) => {
+                log::error!("graphics device lost: {e}");
+                Err(e.to_string())
+            }
+        });
+        self.device_lost_close = Some(keep_recovery);
+        log::warn!("graphics device lost: closing the window");
+        if let Some(tell) = &self.hooks.device_lost {
+            tell(saved);
+        }
+        ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+    }
+
+    /// Run the commands whose non-blocking file dialogs have been answered.
+    pub(crate) fn run_dialog_answers(&mut self) {
+        while let Ok(answer) = self.dialog_answers.1.try_recv() {
+            self.file_dialogs.answered();
+            menus::dialog_answered(self, answer);
+        }
+    }
+
+    /// Set up the GPU compositor on egui-wgpu's device (once). Without an adapter that runs
+    /// compute shaders (WebGL2, software GL) everything stays on the CPU.
+    ///
+    /// On the desktop the compositor is built on a worker thread. Its compute pipelines (about
+    /// 235 of them) take tens of seconds to compile on a cold shader cache (first launch, after
+    /// an OS update, after an update that changed a shader), and eframe shows the window only
+    /// once the first frame has painted, so building them here kept the window from appearing
+    /// at all. Until the worker is done the viewer composites on the CPU, as it does without a
+    /// GPU, and the status bar says so; the browser has no threads and builds it in place.
+    pub(crate) fn init_gpu(&mut self, ctx: &egui::Context, frame: &eframe::Frame) {
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.gpu_build.is_some() {
+            self.finish_gpu_build(frame.wgpu_render_state());
+            return;
+        }
+        if self.gpu_checked {
+            return;
+        }
+        self.gpu_checked = true;
+        if self.gpu_failures.as_ref().is_some_and(|bridge| bridge.failure().is_some()) {
+            return;
+        }
+        let Some(rs) = frame.wgpu_render_state() else { return };
+        // The display pass needs only this device, not the compositor (which may take tens of
+        // seconds to build, or fail).
+        self.window_wgpu = Some(rs.clone());
+        // Help ▸ System Compatibility Report names the adapter and backend the window got.
+        let info = rs.adapter.get_info();
+        self.session.window_adapter = Some(format!(
+            "{} ({:?}, {:?}{})",
+            info.name,
+            info.backend,
+            info.device_type,
+            if info.driver.is_empty() { String::new() } else { format!(", {} {}", info.driver, info.driver_info) }
+        ));
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.spawn_gpu_build(ctx, rs) {
+            return;
+        }
+        // In place (the browser, or no thread to be had): nothing to wake later.
+        let _ = ctx;
+        // Backend validation can panic on shader compilation even when device creation
+        // succeeded. Keep the document and the egui renderer, and use CPU compositing.
+        let built = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| effectcraft_gpu::Gpu::new(&rs.adapter, rs.device.clone(), rs.queue.clone())));
+        self.attach_gpu(built, Some(rs));
+    }
+
+    /// Start building the compositor on a `gpu-compositor` worker thread, which hands its result
+    /// back to [`Self::finish_gpu_build`] and wakes the UI. False when no thread could be spawned
+    /// (the caller then builds it in place).
+    #[cfg(not(target_arch = "wasm32"))]
+    fn spawn_gpu_build(&mut self, ctx: &egui::Context, rs: &eframe::egui_wgpu::RenderState) -> bool {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let (adapter, device, queue) = (rs.adapter.clone(), rs.device.clone(), rs.queue.clone());
+        let gate = self.hooks.before_gpu_build.take();
+        let wake = ctx.clone();
+        let spawned = std::thread::Builder::new().name("gpu-compositor".into()).spawn(move || {
+            // Backend validation can panic on shader compilation even when device creation
+            // succeeded: the panic stays on this thread and arrives as a result.
+            let built = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+                if let Some(gate) = gate {
+                    gate();
+                }
+                effectcraft_gpu::Gpu::new(&adapter, device, queue)
+            }));
+            // No receiver: the window closed, or the device failed, while this was running.
+            let _ = tx.send(built);
+            wake.request_repaint();
+        });
+        if let Err(e) = spawned {
+            log::warn!("no worker thread for the GPU compositor ({e}); building it on the UI thread");
+            return false;
+        }
+        self.gpu_build = Some(rx);
+        self.session.accel_note = Some(GPU_PREPARING.into());
+        if self.ui.status.is_empty() {
+            self.ui.status = GPU_PREPARING.into();
+        }
+        true
+    }
+
+    /// Take the worker's result when it has arrived ([`Self::init_gpu`]). `rs`: the window's
+    /// device, which a compositor that built is attached to.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn finish_gpu_build(&mut self, rs: Option<&eframe::egui_wgpu::RenderState>) {
+        let Some(rx) = &self.gpu_build else { return };
+        let built = match rx.try_recv() {
+            Ok(built) => built,
+            Err(std::sync::mpsc::TryRecvError::Empty) => return,
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
+                Err(Box::new("the compositor's worker thread ended without a result") as Box<dyn std::any::Any + Send>)
+            }
+        };
+        self.gpu_build = None;
+        if self.ui.status == GPU_PREPARING {
+            self.ui.status.clear();
+        }
+        // The device failed while the compositor was being built: it stays detached, and
+        // `apply_gpu_failure` has already said why the viewer is on the CPU.
+        if self.gpu_failure_applied.is_some() || self.gpu_failures.as_ref().is_some_and(|bridge| bridge.failure().is_some()) {
+            return;
+        }
+        self.attach_gpu(built, rs);
+    }
+
+    /// Attach a built compositor to the viewer, or record why there is none. Keeps the document
+    /// and the egui renderer either way; without a compositor the viewer composites on the CPU.
+    fn attach_gpu(&mut self, built: GpuBuild, rs: Option<&eframe::egui_wgpu::RenderState>) {
+        match built {
+            Ok(Ok(g)) => {
+                if let Some(bridge) = &self.gpu_failures {
+                    bridge.forward_to(g.context().device_failure_notifier());
+                    if bridge.failure().is_some() {
+                        return;
+                    }
+                }
+                let Some(rs) = rs else {
+                    self.session.accel_note = Some("GPU compositor unavailable: the window has no wgpu device".into());
+                    return;
+                };
+                log::info!("GPU compositor: {}", effectcraft_engine::render::Accelerator::name(&g));
+                self.session.accel_note = None;
+                self.session.accel = Some(Arc::new(g.clone()));
+                self.gpu = Some(g);
+                self.wgpu = Some(rs.clone());
+            }
+            Ok(Err(e)) => {
+                log::info!("GPU compositor unavailable: {e}");
+                self.session.accel_note = Some(format!("GPU compositor unavailable: {e}"));
+            }
+            Err(e) => {
+                let reason = e.downcast_ref::<String>().map(String::as_str).or_else(|| e.downcast_ref::<&str>().copied()).unwrap_or("backend panicked");
+                log::warn!("GPU compositor setup failed; using CPU compositing: {reason}");
+                self.session.accel_note = Some(format!("GPU compositor setup failed: {reason}"));
+            }
+        }
+    }
+
+    /// Whether the GPU compositor is still being built on its worker thread (the viewer is on
+    /// the CPU meanwhile). Always false in the browser, which builds it with the first frame.
+    pub fn gpu_initializing(&self) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.gpu_build.is_some()
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            false
+        }
+    }
+
+    /// The viewer shows a frame composited on the GPU (drawn from its wgpu texture).
+    pub fn viewer_on_gpu(&self) -> bool {
+        matches!((&self.viewer_shown, &self.viewer_native), (Some(s), Some(n)) if s.1 == n.1)
+    }
+
+    /// The GPU compositor's adapter, when the viewer has one.
+    pub fn gpu_adapter(&self) -> Option<String> {
+        self.gpu.as_ref().map(effectcraft_engine::render::Accelerator::name)
+    }
+}
+
+#[cfg(test)]
+mod gpu_failure_tests {
+    use super::*;
+    use crate::{FrameKey, ItemId, RenderOpts, Session, Tick, json};
+
+    #[test]
+    fn host_failure_preserves_document_undo_and_cpu_pixels_and_detaches_late_readbacks() {
+        let mut session = Session::default();
+        let comp = ItemId(session.execute("comp.new", json!({"name": "Recovery", "width": 4, "height": 4, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+        session.execute("layer.newSolid", json!({"comp": comp.0, "color": "#ff0000"})).unwrap();
+        let before = session.render(comp, Tick::ZERO, RenderOpts::default());
+        let project = session.project.clone();
+        let revision = session.revision;
+        let prefs = serde_json::to_value(&session.prefs).unwrap();
+        let mut app = EffectcraftApp::new(session);
+        let ctx = egui::Context::default();
+        let bridge = gpu_failure::GpuFailureBridge::new(&ctx);
+        app.set_gpu_failure_bridge(bridge.clone());
+        let late_slot = app.viewer_readback.1.clone();
+        let key = FrameKey { revision, content: 1, comp: comp.0, frame: 0, scale: 1000, view: 0, opts: 0 };
+        app.viewer_readback.0 = Some(key);
+        bridge.report("synthetic host device failure", true);
+        app.apply_gpu_failure(&ctx);
+        assert!(Arc::ptr_eq(&project, &app.session.project));
+        assert_eq!(app.session.revision, revision);
+        assert_eq!(serde_json::to_value(&app.session.prefs).unwrap(), prefs);
+        assert!(app.gpu_checked, "failed device cannot be initialized again next frame");
+        assert!(app.session.accel.is_none());
+        assert!(app.ui.status.contains("presentation requires restarting"));
+        assert_eq!(app.session.render(comp, Tick::ZERO, RenderOpts::default()).data, before.data);
+        *late_slot.lock().unwrap() = Some((key, Arc::new(egui::ColorImage::new([1, 1], vec![egui::Color32::RED]))));
+        assert!(app.viewer_readback.0.is_none());
+        assert!(app.viewer_readback.1.lock().unwrap().is_none(), "a late completion cannot refill the replacement slot");
+        app.session.execute("edit.undo", json!({})).unwrap();
+        assert!(app.session.project.comp(comp).unwrap().layers.is_empty());
+        app.session.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(app.session.render(comp, Tick::ZERO, RenderOpts::default()).data, before.data);
+    }
+}
diff --git a/crates/ui-egui/src/app/input.rs b/crates/ui-egui/src/app/input.rs
new file mode 100644
index 000000000..18a30c254
--- /dev/null
+++ b/crates/ui-egui/src/app/input.rs
@@ -0,0 +1,60 @@
+use super::*;
+
+impl EffectcraftApp {
+    /// Feed this frame's share of the queued synthetic input (control channel `ui.click`,
+    /// `ui.drag`…) into `raw_input`. Pointer events go one per frame so egui sees press → moves
+    /// → release as a real gesture.
+    ///
+    /// Only one batch is ever moved out at a time, even when the host prepares several hidden
+    /// logic-only iterations before the forced UI pass: eframe keeps the last prepared raw input
+    /// and would otherwise apply a whole drag or click as one burst. A batch is released by the
+    /// first UI pass that applies it ([`Self::mark_synthetic_applied`]). Callers must not feed a
+    /// pass that cannot draw (fonts still installing): egui applies what it receives, so putting
+    /// an applied batch back would apply its pointer/key state twice.
+    pub fn feed_synthetic(&mut self, raw_input: &mut egui::RawInput) {
+        if self.synthetic_in_flight || self.synthetic.is_empty() {
+            return;
+        }
+        // Pointer events go one per frame so egui sees press → moves → release as a real drag.
+        let pointer = |e: &egui::Event| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerButton { .. } | egui::Event::MouseWheel { .. });
+        let n = if pointer(&self.synthetic[0]) {
+            1
+        } else {
+            self.synthetic
+                .iter()
+                .position(|e| pointer(e) || matches!(e, egui::Event::Key { pressed: false, .. }))
+                .map_or(self.synthetic.len(), |i| if pointer(&self.synthetic[i]) { i.max(1) } else { i + 1 })
+        };
+        let batch: Vec<egui::Event> = self.synthetic.drain(..n).collect();
+        raw_input.events.extend(batch.iter().cloned());
+        self.synthetic_in_flight_events.extend(batch);
+        self.synthetic_in_flight = true;
+    }
+
+    /// Clear the single-pending-batch guard: a UI pass has applied the injected batch.
+    ///
+    /// [`EffectcraftApp::draw`] calls this itself; harnesses that feed synthetic input
+    /// themselves (the headless kittest tests) call it after each pass they ran.
+    pub fn mark_synthetic_applied(&mut self) {
+        self.synthetic_in_flight_events.clear();
+        self.synthetic_in_flight = false;
+    }
+
+    /// The events of the injected batch that no UI pass has applied yet.
+    pub fn pending_synthetic_events(&self) -> &[egui::Event] {
+        &self.synthetic_in_flight_events
+    }
+
+    /// Whether a synthetic batch is waiting for its UI pass.
+    pub fn synthetic_in_flight(&self) -> bool {
+        self.synthetic_in_flight
+    }
+}
+
+impl EffectcraftApp {
+    /// Take the pending synthetic input (from `ui.click`, `ui.key`, …). Hosts that don't call
+    /// [`eframe::App::raw_input_hook`] (the headless test harness) feed these in themselves.
+    pub fn take_synthetic_input(&mut self) -> Vec<egui::Event> {
+        std::mem::take(&mut self.synthetic)
+    }
+}
diff --git a/crates/ui-egui/src/app/playback.rs b/crates/ui-egui/src/app/playback.rs
new file mode 100644
index 000000000..d40bc69ff
--- /dev/null
+++ b/crates/ui-egui/src/app/playback.rs
@@ -0,0 +1,192 @@
+use super::*;
+
+impl EffectcraftApp {
+    // ---------------------------------------------------------------- playback
+
+    pub fn play(&mut self, now: f64) {
+        let sc = self.session.prefs.preview.current;
+        self.play_with(now, sc);
+    }
+
+    /// Start the preview of a Preview panel shortcut (its range, play-from, rate, skip,
+    /// resolution, loop, caching, full screen and include options).
+    pub fn play_with(&mut self, now: f64, sc: effectcraft_engine::preview::PreviewShortcut) {
+        let Some(c) = self.session.active_comp_arc() else { return };
+        let preset = self.session.prefs.preview.get(sc).clone();
+        let plan = effectcraft_engine::preview::plan(&preset, &c, self.session.time());
+        let fr = c.frame_rate;
+        if plan.video {
+            self.session.set_time(fr.tick_of(plan.first));
+        }
+        let restore_max = preset.full_screen.then_some(self.ui.maximized);
+        let viewer = panels::viewers::active_panel(self);
+        if preset.full_screen && self.ui.dock.is_docked(viewer) {
+            self.ui.maximized = Some(viewer);
+        }
+        self.playback = Playback {
+            playing: true,
+            start_wall: now,
+            start_time: fr.tick_of(plan.first),
+            start_frame: plan.first,
+            shown: 0,
+            waiting: false,
+            fps: plan.fps,
+            shortcut: sc,
+            plan: Some(plan),
+            caching: plan.cache_first && plan.video,
+            res: preset.resolution.factor(preset.custom_resolution),
+            overlays: preset.include_overlays,
+            layer_controls: preset.include_layer_controls,
+            restore_max,
+            audio_frame: (!plan.video).then_some(plan.first),
+            audio_held: false,
+            starting: false,
+            starting_since: now,
+            first_cached: None,
+            shown_at: Default::default(),
+        };
+        if !self.playback.caching {
+            if plan.video {
+                let audible = self.audio_plays();
+                self.playback.audio_held = audible;
+                self.playback.starting = audible;
+            } else {
+                self.start_audio(fr.tick_of(plan.first));
+            }
+        }
+    }
+
+    /// The preview includes audio at the comp's frame rate and the comp has something audible.
+    fn audio_plays(&self) -> bool {
+        let (Some(pl), Some(cid)) = (self.playback.plan, self.session.active_comp_id()) else { return false };
+        let Some(c) = self.session.project.comp(cid) else { return false };
+        // A preview at another frame rate plays slower or faster than real time: silent.
+        pl.audio && (pl.fps - c.frame_rate.as_f64()).abs() <= 0.01 && effectcraft_engine::render::audio::comp_has_audio(&self.session.project, cid)
+    }
+
+    /// Start audio preview from comp time `t` when [`Self::audio_plays`] and an output device
+    /// opens.
+    pub(super) fn start_audio(&mut self, t: Tick) {
+        self.audio = None;
+        self.meter.clipped = [false; 2];
+        let (Some(pl), Some(cid)) = (self.playback.plan, self.session.active_comp_id()) else { return };
+        let Some(c) = self.session.project.comp_arc(cid).filter(|_| self.audio_plays()) else { return };
+        let out = audio::AudioOutput::from_prefs(&self.session.prefs);
+        let Some(dev) = self.hooks.audio_device.as_ref().and_then(|f| f(&out)) else { return };
+        let mix = self.session.prefs.audio.preview_sample_rate;
+        let fr = c.frame_rate;
+        match audio::AudioPlayback::start(dev, self.render_source(), cid, t, fr.tick_of(pl.start), fr.tick_of(pl.end + 1), pl.looping, mix) {
+            Ok(a) => self.audio = Some(a),
+            Err(e) => log::warn!("audio preview: {e}"),
+        }
+    }
+
+    /// Audio scrubbing: play the frame of `comp` at `t` (see [`audio::AudioScrub`]), opening the
+    /// output on first use. Silent comps and missing devices do nothing.
+    pub fn scrub_audio(&mut self, comp: ItemId, t: Tick, now: f64) {
+        if self.playback.playing || !effectcraft_engine::render::audio::comp_has_audio(&self.session.project, comp) {
+            return;
+        }
+        if self.scrub.is_none() {
+            let out = audio::AudioOutput::from_prefs(&self.session.prefs);
+            let Some(dev) = self.hooks.audio_device.as_ref().and_then(|f| f(&out)) else { return };
+            match audio::AudioScrub::open(dev, now) {
+                Ok(s) => self.scrub = Some(s),
+                Err(e) => {
+                    log::warn!("audio scrubbing: {e}");
+                    return;
+                }
+            }
+        }
+        let src = self.render_source();
+        let mix = self.session.prefs.audio.preview_sample_rate;
+        if let Some(s) = &mut self.scrub {
+            s.play(&src, comp, t, mix, now);
+        }
+    }
+
+    pub fn stop(&mut self) {
+        let was = std::mem::replace(&mut self.playback.playing, false);
+        self.audio = None;
+        self.playback.caching = false;
+        self.playback.starting = false;
+        if !was {
+            return;
+        }
+        if let Some(m) = self.playback.restore_max.take() {
+            self.ui.maximized = m;
+        }
+        let Some(pl) = self.playback.plan else { return };
+        let move_time = self.session.prefs.preview.get(self.playback.shortcut).move_time_to_preview_time;
+        if !move_time {
+            self.session.set_time(pl.origin);
+        } else if let Some(f) = self.playback.audio_frame
+            && let Some(c) = self.session.active_comp()
+        {
+            let t = c.frame_rate.tick_of(f);
+            self.session.set_time(t);
+        }
+    }
+
+    pub fn toggle_play(&mut self, now: f64) {
+        let sc = self.session.prefs.preview.current;
+        self.toggle_play_with(now, sc);
+    }
+
+    /// A preview shortcut pressed: start its preview, or stop the running one. While Cache
+    /// Before Playback is still rendering, "If caching, play cached frames" plays what is
+    /// cached so far instead of stopping.
+    pub fn toggle_play_with(&mut self, now: f64, sc: effectcraft_engine::preview::PreviewShortcut) {
+        if !self.playback.playing {
+            self.play_with(now, sc);
+            return;
+        }
+        if self.playback.caching && self.session.prefs.preview.get(self.playback.shortcut).play_cached_frames && self.play_cached(now) {
+            return;
+        }
+        self.stop();
+    }
+
+    /// Cut the caching preview down to the frames cached from its first frame on and play them.
+    fn play_cached(&mut self, now: f64) -> bool {
+        let (Some(mut pl), Some(cid)) = (self.playback.plan, self.session.active_comp_id()) else { return false };
+        let scale = self.viewer_shown.as_ref().map(|(_, k)| k.scale as f64 / 1000.0).unwrap_or(1.0);
+        let series = self.frame_series(cid, scale);
+        let mut last = None;
+        let mut f = pl.first;
+        while f <= pl.end && self.frames.is_cached(&FrameKey { frame: f, ..series }) {
+            last = Some(f);
+            f += pl.step;
+        }
+        let Some(last) = last else { return false };
+        pl.end = last;
+        pl.start = pl.first;
+        self.playback.plan = Some(pl);
+        self.playback.caching = false;
+        self.playback.start_wall = now;
+        self.playback.start_frame = pl.first;
+        let t = self.session.active_comp().map(|c| c.frame_rate.tick_of(pl.first)).unwrap_or_default();
+        self.start_audio(t);
+        true
+    }
+
+    /// A preview plays with Video off in the Preview panel (audio only): the current time stays
+    /// put, so the viewer and Timeline say so instead of looking stuck (#1118). The frame under
+    /// the audible sample, when one is known.
+    pub fn video_preview_off(&self) -> Option<Option<i64>> {
+        let p = self.playback.plan.filter(|_| self.playback.playing)?;
+        (!p.video).then_some(self.playback.audio_frame)
+    }
+
+    /// The viewer shows grids, guides and safe margins (hidden while a preview without
+    /// Include Overlays plays).
+    pub fn overlays_visible(&self) -> bool {
+        !self.playback.playing || self.playback.overlays
+    }
+
+    /// The viewer shows layer handles and paths (View ▸ Show Layer Controls, and Include Layer
+    /// Controls while a preview plays).
+    pub fn layer_controls_visible(&self) -> bool {
+        self.ui.viewer.show_layer_controls && (!self.playback.playing || self.playback.layer_controls)
+    }
+}
diff --git a/crates/ui-egui/src/app/prefetch.rs b/crates/ui-egui/src/app/prefetch.rs
new file mode 100644
index 000000000..50638b708
--- /dev/null
+++ b/crates/ui-egui/src/app/prefetch.rs
@@ -0,0 +1,550 @@
+use super::{EffectcraftApp, FrameKey, FrameWindow, ItemId, PlaybackPass, audio, frames};
+
+/// Seconds without a project change before paused prefetch resumes (see
+/// [`EffectcraftApp::editing`]).
+const EDIT_QUIET: f64 = 0.3;
+
+/// Longest a preview with sound holds its first frame, once that frame is cached, waiting for the
+/// frames ahead (seconds, #947). A frame ahead that never gets cached mustn't hold it for ever:
+/// the sound starts from the first frame anyway, and the preview goes on as a stalled one does.
+const STARTUP_WAIT: f64 = 2.0;
+
+/// Longest a preview with sound holds its first frame in all (seconds, #947). The first frame
+/// itself can take a while (a heavy comp, a busy machine), and [`STARTUP_WAIT`] counts only from
+/// when it is cached; but one that never gets cached (larger than the RAM preview, which the size
+/// estimate can't always tell) mustn't hold it for ever. The preview then goes on as a stalled
+/// one does: its sound starts once the frames are cached.
+const STARTUP_LIMIT: f64 = 10.0;
+
+/// How many frames from the first a preview with sound waits for before it starts (#947): the
+/// prefetch's `ahead`, but no more than its `window` requests from the current frame (offsets
+/// `0..window`), and no more than fit in the RAM preview `budget` (90 %, as for the prefetch) at
+/// `frame_bytes`, the size frames really render at; at least the current frame, which the viewer
+/// always requests. Waiting for a frame that is never requested, or that can't stay cached with
+/// the others, would hold the first frame for ever.
+fn startup_frames(ahead: i64, window: i64, budget: usize, frame_bytes: usize) -> i64 {
+    let fit = (budget as f64 * 0.9 / frame_bytes.max(1) as f64) as i64;
+    ahead.min(window).min(fit).max(1)
+}
+
+/// Whether frame `f` comes after the current frame `cur` and before the sound's frame `target` in
+/// play order. A looping preview whose sound is at a lower frame than the picture has wrapped
+/// to the loop's start, so the frames up to the end and then from the start count; otherwise
+/// (and always without a loop) only the frames strictly between them do.
+fn between_picture_and_sound(cur: i64, f: i64, target: i64, looping: bool) -> bool {
+    if target >= cur || !looping { cur < f && f < target } else { f > cur || f < target }
+}
+
+impl EffectcraftApp {
+    /// RAM preview: advance at the preview's frame rate when frames are cached; otherwise hold
+    /// and keep rendering ahead (the green cache bar fills, then playback runs in real time).
+    pub(super) fn advance_playback(&mut self, ctx: &egui::Context, scale: f64, now: f64, input_active: bool, cid: ItemId) {
+        let Some(c) = self.session.project.comp_arc(cid) else { return };
+        let fr = c.frame_rate;
+        let plan = self.playback.plan.filter(|_| self.playback.playing);
+        let (wa, wb) = match plan {
+            Some(p) => (p.start, p.end),
+            None => (fr.frame_at(c.work_area.0), fr.frame_at(c.work_area.1 - c.frame_duration())),
+        };
+        let looping = plan.is_none_or(|p| p.looping);
+        let video = plan.is_none_or(|p| p.video);
+        // Prefetch ahead.
+        let cur = fr.frame_at(self.session.time());
+        // While the sound drives a video preview, frames are rendered and kept ahead of what it
+        // plays rather than of the picture, which drops frames behind it when rendering can't
+        // keep up (#2473).
+        let lead = if video { self.sound_frame(fr, wa, wb, plan.map_or(1, |p| p.step)).unwrap_or(cur) } else { cur };
+        let ahead = self.prefetch_ahead(ctx, now);
+        let queued = self.frames.inflight();
+        let series = self.frame_series(cid, scale);
+        // The preview's position orders prefetch and eviction (#595).
+        let playhead = plan.filter(|p| p.video).map(|p| frames::Playhead { series, cur: lead, start: p.start, end: p.end, step: p.step, looping: p.looping });
+        self.frames.set_playhead(playhead);
+        let pass = PlaybackPass {
+            ctx,
+            comp: &c,
+            cid,
+            scale,
+            now,
+            frame_rate: fr,
+            series,
+            plan,
+            window: FrameWindow { first: wa, last: wb },
+            cur,
+            video,
+            looping,
+            ahead,
+            queued,
+        };
+        if self.cache_preview(&pass) {
+            return;
+        }
+        let step = plan.map_or(1, |p| p.step);
+        let fit_ahead = self.frames_that_fit(&c, scale) - 1;
+        self.prefetch_playback(&PlaybackPass { cur: lead, ..pass }, fit_ahead);
+        self.pump_meters(ctx, now);
+        if !self.playback.playing {
+            self.cache_when_idle(ctx, &c, &series, now, input_active, (wa, wb));
+            return;
+        }
+        let fit = self.frames_that_fit(&c, scale);
+        if self.hold_first_frame(&pass, fit) {
+            return;
+        }
+        self.start_held_audio(&pass, fit);
+        if self.advance_audio_clock(&pass, step) {
+            return;
+        }
+        self.advance_frame_clock(&pass, step);
+    }
+
+    /// While paused (scrubbing, editing) the viewer's frame comes first: prefetch only a few
+    /// frames, only once it is done, and not while edits keep coming (a layer dragged in the
+    /// viewer): those frames would be stale at the next step and would hold the CPU and GPU
+    /// the next viewer frame needs.
+    fn prefetch_ahead(&mut self, ctx: &egui::Context, now: f64) -> i64 {
+        if self.playback.playing {
+            (self.frames_parallelism() * 2).max(4) as i64
+        } else if self.frames.urgent_pending() {
+            0
+        } else if let Some(wait) = self.editing(now) {
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64(wait));
+            0
+        } else {
+            // Keep workers available for a newly edited viewer frame. Running obsolete
+            // background renders cannot be preempted by the priority queue.
+            self.frames_parallelism().saturating_sub(1).min(2) as i64
+        }
+    }
+
+    /// Cache Before Playback: the range in play order, then start the clock. A range larger than
+    /// the RAM preview budget is cut to the frames that fit (caching more would evict the first
+    /// ones and never finish). Returns true when this pass handled the preview.
+    fn cache_preview(&mut self, pass: &PlaybackPass<'_>) -> bool {
+        let PlaybackPass { ctx, comp, cid, scale, now, frame_rate: fr, series, plan, ahead, mut queued, .. } = *pass;
+        if !self.playback.caching {
+            return false;
+        }
+        let Some(p) = plan else { return false };
+        let mut all = true;
+        let n = (p.end - p.start) / p.step + 1;
+        let fit = self.frames_that_fit(comp, scale);
+        if n > fit {
+            let mut cut = p;
+            (cut.start, cut.end) = (p.first, (p.first + (fit - 1) * p.step).min(p.end));
+            self.playback.plan = Some(cut);
+            self.toast = Some((format!("Preview cut to {fit} of {n} frames: no more fit in the RAM preview (Settings ▸ Memory & CPU)"), now));
+            ctx.request_repaint();
+            return true;
+        }
+        let order: Vec<i64> = (0..n).filter_map(|k| p.frame_after(p.first, k)).collect();
+        for f in order {
+            if self.frames.is_cached(&FrameKey { frame: f, ..series }) {
+                continue;
+            }
+            all = false;
+            if queued < ahead as usize {
+                self.request_frame(cid, f, scale);
+                queued += 1;
+            }
+        }
+        self.playback.waiting = !all;
+        if all {
+            self.playback.caching = false;
+            self.playback.start_wall = now;
+            self.playback.start_frame = p.first;
+            self.session.set_time(fr.tick_of(p.first));
+            self.start_audio(fr.tick_of(p.first));
+        }
+        ctx.request_repaint();
+        true
+    }
+
+    /// Never further ahead than the RAM preview holds: those frames would evict the ones the
+    /// preview shows first, or be evicted before it gets there (#595). The window starts at the
+    /// first uncached frame ahead: after a loop or a restart the frames just ahead are cached,
+    /// and a window from the playhead left the workers idle until it came near the end of the
+    /// cached run. It stays ahead × 3 frames wide: workers spread over the whole preview render
+    /// frames with different layers at once (on the GPU, an atlas each: #1812).
+    fn prefetch_playback(&self, pass: &PlaybackPass<'_>, fit_ahead: i64) {
+        let PlaybackPass { cid, scale, plan, cur, ahead, series, mut queued, video, .. } = *pass;
+        let FrameWindow { first: wa, last: wb } = pass.window;
+        let frame = |k: i64| match plan {
+            Some(p) => p.frame_after(cur, k),
+            None => {
+                let f = cur + k;
+                Some(if f > wb { wa + (f - wb - 1).rem_euclid((wb - wa + 1).max(1)) } else { f })
+            }
+        };
+        let cached = self.frames.cached_frames(&series);
+        let uncached = |f: i64| cached.binary_search(&f).is_err();
+        let first = match plan.filter(|_| self.playback.playing) {
+            Some(p) => (0..fit_ahead.min((p.end - p.start) / p.step.max(1) + 1))
+                .map_while(|k| frame(k).map(|f| (k, f)))
+                .find(|&(_, f)| uncached(f))
+                .map_or(0, |(k, _)| k),
+            None => 0,
+        };
+        for k in first..(first + ahead * 3).min(fit_ahead) {
+            if queued >= ahead as usize || !video {
+                break;
+            }
+            let Some(f) = frame(k) else { break };
+            if uncached(f) {
+                self.request_frame(cid, f, scale);
+                queued += 1;
+            }
+        }
+    }
+
+    /// Advance the audio or scrub output and feed its latest peaks to the level meter; an idle scrub is closed after
+    /// one second. With no source but an active meter, drive the meter to silence and request a repaint.
+    fn pump_meters(&mut self, ctx: &egui::Context, now: f64) {
+        if let Some(a) = &mut self.audio {
+            a.pump();
+            self.meter.update(a.feed.take_peaks(), now);
+        } else if let Some(s) = &mut self.scrub {
+            // Scrubbing: the meters follow the snippets; an idle second closes the output.
+            s.pump();
+            self.meter.update(s.feed.take_peaks(), now);
+            if now - s.last_used > 1.0 {
+                self.scrub = None;
+            }
+            ctx.request_repaint_after(std::time::Duration::from_millis(50));
+        } else if self.meter.active() {
+            self.meter.update([0.0; 2], now);
+            ctx.request_repaint();
+        }
+    }
+
+    /// Starting a preview with sound: hold the first frame until the frames ahead are cached, then
+    /// start the sound from that same frame (see `Playback::starting`). Without an output device
+    /// the picture plays on its own clock from it. How many frames ahead: only ones
+    /// `prefetch_playback` requests and that fit in the RAM preview at the size they really render
+    /// (an Extended Viewer frame is larger than the comp), so the wait always ends. Returns true
+    /// while it holds the first frame.
+    fn hold_first_frame(&mut self, pass: &PlaybackPass<'_>, fit: i64) -> bool {
+        let PlaybackPass { ctx, comp, scale, now, plan, series, cur, ahead, frame_rate: fr, .. } = *pass;
+        if !self.playback.starting {
+            return false;
+        }
+        let Some(p) = plan else { return false };
+        self.playback.start_wall = now;
+        self.playback.start_frame = cur;
+        // `prefetch_playback` requests every uncached frame of offsets 0..window from here.
+        let window = (ahead * 3).min(fit - 1);
+        let need = self.frames.get(&FrameKey { frame: cur, ..series }).map(|img| startup_frames(ahead, window, self.frames.budget(), img.bytes()));
+        if need.is_some() && self.playback.first_cached.is_none() {
+            self.playback.first_cached = Some(now);
+        }
+        // Don't wait for frames the RAM preview can't hold (not even one frame fits), for the
+        // frames ahead longer than STARTUP_WAIT once the first is in, nor longer than
+        // STARTUP_LIMIT in all (a frame that never gets cached).
+        let give_up = (self.frames.budget() as f64) < self.frame_bytes(comp, scale)
+            || self.playback.first_cached.is_some_and(|t| now - t >= STARTUP_WAIT)
+            || now - self.playback.starting_since >= STARTUP_LIMIT;
+        if !give_up && !need.is_some_and(|n| self.cached_ahead(&p, &series, cur, n)) {
+            self.playback.waiting = true;
+            ctx.request_repaint();
+            return true;
+        }
+        self.playback.starting = false;
+        self.playback.waiting = false;
+        // Not on a frame that isn't cached: the picture couldn't show where the sound starts. The
+        // preview goes on silently, and the sound starts once frames are cached.
+        if need.is_some() {
+            self.playback.audio_held = false;
+            self.start_audio(fr.tick_of(cur));
+        }
+        false
+    }
+
+    /// Held sound starts once the frames ahead are cached (see `Playback::audio_held`): the
+    /// prefetch's `ahead` when the silent preview keeps real time, else the rest of the preview.
+    fn start_held_audio(&mut self, pass: &PlaybackPass<'_>, fit: i64) {
+        let PlaybackPass { now, plan, series, cur, ahead, frame_rate: fr, .. } = *pass;
+        if !self.playback.audio_held {
+            return;
+        }
+        let Some(p) = plan else { return };
+        // No more than the prefetch requests: offsets below `fit - 1` (`advance_playback`).
+        let need = ahead.min(fit - 1).max(1);
+        if (self.playback.keeps_up(now) && self.cached_ahead(&p, &series, cur, need)) || self.cached_ahead(&p, &series, cur, fit) {
+            self.playback.audio_held = false;
+            self.playback.start_wall = now;
+            self.playback.start_frame = cur;
+            self.start_audio(fr.tick_of(cur));
+        }
+    }
+
+    /// Audio clock drives playback: show the frame under the audible sample. Returns true when
+    /// the audio path handled this pass (including stopping at the end).
+    fn advance_audio_clock(&mut self, pass: &PlaybackPass<'_>, step: i64) -> bool {
+        let PlaybackPass { ctx, now, series, video, frame_rate: fr, cur, .. } = *pass;
+        let FrameWindow { first: wa, last: wb } = pass.window;
+        let Some(a) = &self.audio else { return false };
+        if a.finished() {
+            if video {
+                self.session.set_time(fr.tick_of(wb));
+            } else {
+                self.playback.audio_frame = Some(wb);
+            }
+            self.stop();
+            return true;
+        }
+        let snap = |f: i64| wa + (f - wa).div_euclid(step) * step;
+        let target = snap(audio::frame_of_sample(a.clock(), a.rate, fr).clamp(wa, wb));
+        if !video {
+            self.playback.audio_frame = Some(target);
+        } else if self.frames.is_cached(&FrameKey { frame: target, ..series }) {
+            self.playback.waiting = false;
+            if target != cur {
+                self.session.set_time(fr.tick_of(target));
+                self.playback.frame_shown(now);
+            }
+        } else {
+            // Rendering can't keep up: the sound plays on and the picture drops frames, showing
+            // the latest one rendered up to the sound, while `advance_playback` renders ahead of
+            // the sound (#2473). Stopping the sound instead and starting it again once frames were
+            // cached chopped it into bursts that played as distortion (#3260).
+            self.playback.waiting = true;
+            if let Some(f) = self.latest_cached_before(pass, target).filter(|&f| f != cur) {
+                self.session.set_time(fr.tick_of(f));
+                self.playback.frame_shown(now);
+            }
+        }
+        ctx.request_repaint();
+        true
+    }
+
+    /// The frame under the audible sample while the sound drives the preview, kept in the
+    /// preview's range and on its frame step; `None` without sound.
+    fn sound_frame(&self, fr: effectcraft_engine::time::FrameRate, wa: i64, wb: i64, step: i64) -> Option<i64> {
+        let a = self.audio.as_ref()?;
+        let step = step.max(1);
+        Some(wa + (audio::frame_of_sample(a.clock(), a.rate, fr).clamp(wa, wb) - wa).div_euclid(step) * step)
+    }
+
+    /// The last cached frame after the current one and before `target`, in play order: what a
+    /// preview behind its sound shows (`None` when no such frame is cached). The walk stops at
+    /// the first frame that isn't before the sound's, which it can step over without meeting
+    /// (a picture off the plan's frame step) or never reach (a sound behind the picture).
+    fn latest_cached_before(&self, pass: &PlaybackPass<'_>, target: i64) -> Option<i64> {
+        let PlaybackPass { plan, series, cur, window, looping, .. } = *pass;
+        let cached = self.frames.cached_frames(&series);
+        let mut best = None;
+        for k in 1..=(window.last - window.first + 1).max(1) {
+            let Some(f) = plan.map_or(Some(cur + k), |p| p.frame_after(cur, k)) else { break };
+            if !between_picture_and_sound(cur, f, target, looping) {
+                break;
+            }
+            if cached.binary_search(&f).is_ok() {
+                best = Some(f);
+            }
+        }
+        best
+    }
+
+    /// The wall clock advances the preview when no audio device drives it, and shows the target
+    /// frame (or holds when it is not cached yet).
+    fn advance_frame_clock(&mut self, pass: &PlaybackPass<'_>, step: i64) {
+        let PlaybackPass { ctx, now, plan, video, looping, frame_rate: fr, cur, series, .. } = *pass;
+        let FrameWindow { first: wa, last: wb } = pass.window;
+        let elapsed = now - self.playback.start_wall;
+        // The plan carries the rate the preview was started with (and `play_with` copies it to
+        // `Playback::fps`). Deriving the frame from the plan keeps a logic-only tick correct even
+        // when a host/test supplies only the plan; a stale duplicate cannot hold playback open.
+        let fps = plan.map_or(self.playback.fps, |p| p.fps);
+        let n = ((elapsed * fps) / step as f64).floor() as i64;
+        let target = match plan {
+            Some(p) => p.frame_after(self.playback.start_frame, n),
+            None => {
+                let t = self.playback.start_frame + n;
+                if t <= wb {
+                    Some(t)
+                } else if looping {
+                    Some(wa + (t - wa).rem_euclid((wb - wa + 1).max(1)))
+                } else {
+                    None
+                }
+            }
+        };
+        let Some(target) = target else {
+            if video {
+                self.session.set_time(fr.tick_of(wb));
+            } else {
+                self.playback.audio_frame = Some(wb);
+            }
+            self.stop();
+            return;
+        };
+        if !video {
+            // Audio-only preview without an audio device: the clock runs, the time stays.
+            self.playback.audio_frame = Some(target);
+            ctx.request_repaint();
+            return;
+        }
+        if self.frames.is_cached(&FrameKey { frame: target, ..series }) {
+            self.playback.waiting = false;
+            if target != cur {
+                self.session.set_time(fr.tick_of(target));
+                self.playback.frame_shown(now);
+            }
+        } else {
+            // Not cached yet: hold the clock at the current frame (cache first, then play).
+            self.playback.waiting = true;
+            let next = plan.and_then(|p| p.frame_after(cur, 1)).unwrap_or(if cur + 1 > wb { wa } else { cur + 1 });
+            if self.frames.is_cached(&FrameKey { frame: next, ..series }) {
+                self.session.set_time(fr.tick_of(next));
+            }
+            self.playback.start_wall = now;
+            self.playback.start_frame = fr.frame_at(self.session.time());
+        }
+        ctx.request_repaint();
+    }
+
+    /// While the project keeps changing (an edit within [`EDIT_QUIET`] seconds), how long until
+    /// it counts as settled.
+    fn editing(&mut self, now: f64) -> Option<f64> {
+        if self.last_edit.1 != self.session.revision {
+            self.last_edit = (now, self.session.revision);
+        }
+        let left = EDIT_QUIET - (now - self.last_edit.0);
+        (left > 0.0).then_some(left)
+    }
+
+    /// Composition ▸ Preview ▸ Cache Frames When Idle: after a second without input or edits,
+    /// render the work area's frames (from the current time on, then from its start) in the
+    /// background, a few at a time, until it is cached or the RAM preview budget is full.
+    fn cache_when_idle(
+        &mut self,
+        ctx: &egui::Context,
+        comp: &effectcraft_engine::project::Comp,
+        series: &FrameKey,
+        now: f64,
+        input_active: bool,
+        (wa, wb): (i64, i64),
+    ) {
+        let active = input_active;
+        if active || self.last_activity.1 != self.session.revision {
+            self.last_activity = (now, self.session.revision);
+        }
+        if !self.ui.cache_when_idle || self.frames.urgent_pending() {
+            return;
+        }
+        let quiet = now - self.last_activity.0;
+        if quiet < 1.0 {
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64(1.0 - quiet));
+            return;
+        }
+        // Frames an edit kept in RAM are on disk under the comp's previous content only.
+        // Again soon while frames wait to be written (a refused write is retried then).
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.frames.persist_missing(&self.render_source(), series, &self.frame_opts(ItemId(series.comp), series.scale as f64 / 1000.0)) {
+            ctx.request_repaint_after(std::time::Duration::from_millis(500));
+        }
+        // An empty work area has nothing to cache.
+        let n = wb - wa + 1;
+        if n < 1 {
+            return;
+        }
+        let cur = comp.frame_rate.frame_at(self.session.time()).clamp(wa, wb);
+        // The viewer's exact factor (1/3, not the key's 0.333): it shows these frames.
+        let scale = frames::render_scale(series.scale, comp.resolution.factor());
+        let fit = self.frames_that_fit(comp, scale).min(n);
+        // One thread each (`Frames::request_background`), so every frame thread takes one.
+        let slots = self.frames_parallelism().max(1);
+        let mut queued = self.frames.inflight();
+        let mut pending = false;
+        for k in 0..fit {
+            let f = wa + (cur - wa + k).rem_euclid(n);
+            if self.frames.is_cached(&FrameKey { frame: f, ..*series }) {
+                continue;
+            }
+            pending = true;
+            if queued >= slots {
+                break;
+            }
+            self.request_frame_background(ItemId(series.comp), f, scale);
+            queued += 1;
+        }
+        if pending {
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+    }
+
+    /// How many viewer frames of `comp` at `scale` the RAM preview budget holds (90 % of it,
+    /// at least one).
+    /// The frames of `plan` from `cur` to its end, or as many as fit in the RAM preview, are
+    /// cached: sound can play from `cur` in real time.
+    fn cached_ahead(&self, plan: &effectcraft_engine::preview::PreviewPlan, series: &FrameKey, cur: i64, fit: i64) -> bool {
+        let cached = self.frames.cached_frames(series);
+        (0..fit).map_while(|k| plan.frame_after(cur, k)).take_while(|f| *f >= cur).all(|f| cached.binary_search(&f).is_ok())
+    }
+
+    fn frames_that_fit(&self, comp: &effectcraft_engine::project::Comp, scale: f64) -> i64 {
+        ((self.frames.budget() as f64 * 0.9 / self.frame_bytes(comp, scale)) as i64).max(1)
+    }
+
+    /// Bytes of one comp-sized viewer frame at `scale` (Extended Viewer frames are larger; 32 bpc
+    /// frames are half floats, twice the bytes of 8-bit ones).
+    fn frame_bytes(&self, comp: &effectcraft_engine::project::Comp, scale: f64) -> f64 {
+        let side = |n: u32| (n as f64 * scale).ceil().max(1.0);
+        side(comp.width) * side(comp.height) * frames::frame_pixel_bytes(&self.session.project.settings) as f64
+    }
+
+    fn frames_parallelism(&self) -> usize {
+        if cfg!(target_arch = "wasm32") {
+            // frame workers render one frame each; without them frames render one at a time
+            // on the UI thread (`Frames::pump`)
+            return self.frames.remote_slots().max(1);
+        }
+        self.frames.parallelism()
+    }
+}
+
+#[cfg(test)]
+mod startup_tests {
+    use super::{between_picture_and_sound, startup_frames};
+
+    /// The frames a preview behind its sound may show are only those before the sound's frame in
+    /// play order, so the picture is never ahead of the sound (#2473).
+    #[test]
+    fn a_dropped_frame_preview_never_shows_past_the_sound() {
+        // Sound ahead of the picture: only the frames between them.
+        assert!(between_picture_and_sound(10, 12, 14, false));
+        assert!(!between_picture_and_sound(10, 14, 14, false), "not the sound's own frame");
+        assert!(!between_picture_and_sound(10, 15, 14, true), "nor one past it, stepped over off the grid");
+        assert!(!between_picture_and_sound(10, 10, 14, true), "nor the current frame");
+        // A looping preview whose sound wrapped to the start: the end of the loop, then its start.
+        assert!(between_picture_and_sound(90, 95, 3, true));
+        assert!(between_picture_and_sound(90, 1, 3, true));
+        assert!(!between_picture_and_sound(90, 3, 3, true));
+        assert!(!between_picture_and_sound(90, 50, 3, true), "the wrapped walk stops before reaching the picture again");
+        // Without a loop, a sound behind the picture allows nothing ahead of it.
+        assert!(!between_picture_and_sound(90, 95, 3, false));
+        assert!(!between_picture_and_sound(90, 1, 3, false));
+        // The sound on the picture's frame: nothing.
+        assert!(!between_picture_and_sound(10, 11, 10, true));
+    }
+
+    /// The frames a preview with sound waits for are always requested and fit together (#947).
+    #[test]
+    fn startup_waits_only_for_frames_it_requests_and_can_keep() {
+        // A 64×36 frame: 9216 bytes. A 46 080-byte budget fits 4 of them (90 %); the prefetch
+        // window then requests offsets 0..3, so the start needs those 3, not 4 it never asks for.
+        let frame = 64 * 36 * 4;
+        let fit = 4;
+        let window = (32i64 * 3).min(fit - 1);
+        assert_eq!(startup_frames(32, window, 46_080, frame), 3);
+        // A roomy budget: the prefetch's `ahead` frames.
+        assert_eq!(startup_frames(8, 24, 100_000_000, frame), 8);
+        // Extended Viewer: a 160×120 comp renders 320×248 frames. 952 320 bytes fit 11 comp-sized
+        // frames but only 2 real ones (90 %): wait for 2, not 4.
+        assert_eq!(startup_frames(4, 11, 952_320, 320 * 248 * 4), 2);
+        // Nothing fits, or no window: still the current frame, never 0.
+        assert_eq!(startup_frames(8, 0, 0, frame), 1);
+        // A zero frame size counts as 1 byte: no division by zero.
+        assert_eq!(startup_frames(8, 24, 10, 0), 8);
+    }
+}
diff --git a/crates/ui-egui/src/app/prefs.rs b/crates/ui-egui/src/app/prefs.rs
new file mode 100644
index 000000000..6fc424e01
--- /dev/null
+++ b/crates/ui-egui/src/app/prefs.rs
@@ -0,0 +1,166 @@
+use super::{EffectcraftApp, Tokens, json, theme};
+
+impl EffectcraftApp {
+    /// Apply changed settings: theme and brightness, label colours, tool tips, preview caches.
+    pub fn apply_prefs(&mut self, ctx: &egui::Context) {
+        // Sync with System re-applies when the system appearance changes (the host wakes the UI;
+        // nothing polls).
+        let system = if self.session.prefs.appearance.appearance_mode == "auto" { self.system_light(ctx) } else { None };
+        if self.applied_prefs == Some((self.session.prefs_revision, system)) {
+            return;
+        }
+        self.applied_prefs = Some((self.session.prefs_revision, system));
+        let p = &self.session.prefs;
+        self.ui.theme = theme::ThemeKind::from_name(p.appearance.resolved_theme(system)).unwrap_or_default();
+        self.tokens = Tokens::from_prefs(p, self.ui.theme);
+        theme::apply_visuals(ctx, &self.tokens);
+        ctx.set_theme(theme::theme_preference(&p.appearance.appearance_mode, self.ui.theme.is_light()));
+        let tips = p.general.show_tool_tips;
+        ctx.all_styles_mut(|s| s.interaction.tooltip_delay = if tips { 0.5 } else { f32::INFINITY });
+        // Settings ▸ Appearance ▸ UI Scale (#284). egui's own Ctrl+= / Ctrl+- / Ctrl+0 zoom stays
+        // off: Ctrl+0 is Window ▸ Project, and the scale is a setting.
+        ctx.options_mut(|o| o.zoom_with_keyboard = false);
+        ctx.set_zoom_factor(p.appearance.ui_scale as f32 / 100.0);
+        self.ui.cache_when_idle = p.previews.cache_frames_when_idle;
+        self.ui.viewer.fast_preview = p.previews.fast_previews;
+        self.frames.set_budget(p.cache_budgets(self.session.sys_memory).preview);
+    }
+
+    /// Change settings from the UI (applied next frame and saved).
+    pub fn set_pref(&mut self, key: &str, value: serde_json::Value) -> Result<(), String> {
+        self.session.prefs.set(key, value)?;
+        self.session.prefs_changed();
+        self.session.save_prefs();
+        Ok(())
+    }
+
+    /// Show theme `k`: the appearance mode becomes its family's (Dark or Light), and `k` that
+    /// family's theme.
+    pub fn set_theme(&mut self, ctx: &egui::Context, k: theme::ThemeKind) {
+        if let Err(e) = self.set_pref("appearance.theme", json!(k.name())) {
+            self.ui.status = e;
+        }
+        self.apply_prefs(ctx);
+    }
+
+    /// The system appearance: light (`Some(true)`), dark, or unknown. The host's answer (the Linux
+    /// desktop portal) wins over egui's, which Wayland compositors often leave empty.
+    pub fn system_light(&self, ctx: &egui::Context) -> Option<bool> {
+        self.hooks.system_theme.as_ref().and_then(|read| read(ctx)).or_else(|| ctx.system_theme()).map(|t| t == egui::Theme::Light)
+    }
+
+    /// The Tools bar's appearance button (`view.theme.toggle`): Sync with System, then Light, then
+    /// Dark, then Sync with System again. The light and dark theme choices are kept.
+    pub fn cycle_appearance(&mut self, ctx: &egui::Context) {
+        let next = match self.session.prefs.appearance.appearance_mode.as_str() {
+            "auto" => "light",
+            "light" => "dark",
+            _ => "auto",
+        };
+        if let Err(e) = self.set_pref("appearance.appearanceMode", json!(next)) {
+            self.ui.status = e;
+        }
+        self.apply_prefs(ctx);
+    }
+}
+
+#[cfg(test)]
+mod appearance_tests {
+    use super::*;
+    use crate::menus;
+    use crate::theme::ThemeKind;
+
+    fn app() -> EffectcraftApp {
+        EffectcraftApp::new(effectcraft_engine::Session::default())
+    }
+
+    /// The Tools bar's appearance button: Sync with System, Light, Dark, then Sync with System
+    /// again, showing the saved theme of each family without losing either choice.
+    #[test]
+    fn appearance_button_cycles_modes_without_losing_theme_choices() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        app.hooks.system_theme = Some(Box::new(|_| Some(egui::Theme::Dark)));
+        app.set_pref("appearance.darkTheme", json!("darker")).unwrap();
+        app.apply_prefs(&ctx);
+        assert_eq!(app.ui.theme, ThemeKind::Darker);
+        for (mode, shown) in [("auto", ThemeKind::Darker), ("light", ThemeKind::Light), ("dark", ThemeKind::Darker), ("auto", ThemeKind::Darker)] {
+            menus::invoke(&mut app, &ctx, "view.theme.toggle", json!({})).unwrap();
+            assert_eq!(app.session.prefs.appearance.appearance_mode, mode);
+            assert_eq!(app.ui.theme, shown, "{mode}");
+            assert_eq!(app.tokens.kind, shown);
+            assert_eq!(app.session.prefs.appearance.dark_theme, "darker");
+            assert_eq!(app.session.prefs.appearance.light_theme, "light");
+        }
+    }
+
+    /// Sync with System follows the host's answer (the Linux portal) when it changes, and falls
+    /// back to Dark when nothing reports a system appearance.
+    #[test]
+    fn auto_follows_a_stubbed_system_theme() {
+        use std::sync::{Arc, Mutex};
+        let ctx = egui::Context::default();
+        let mut app = app();
+        let system = Arc::new(Mutex::new(Some(egui::Theme::Light)));
+        let read = Arc::clone(&system);
+        app.hooks.system_theme = Some(Box::new(move |_| *read.lock().unwrap_or_else(std::sync::PoisonError::into_inner)));
+        app.set_pref("appearance.appearanceMode", json!("auto")).unwrap();
+        app.apply_prefs(&ctx);
+        assert_eq!(app.ui.theme, ThemeKind::Light);
+        *system.lock().unwrap() = Some(egui::Theme::Dark);
+        app.apply_prefs(&ctx);
+        assert_eq!(app.ui.theme, ThemeKind::Dark, "a system change applies without a settings change");
+        *system.lock().unwrap() = None;
+        app.apply_prefs(&ctx);
+        assert_eq!(app.ui.theme, ThemeKind::Dark);
+        // A fixed mode ignores the system.
+        *system.lock().unwrap() = Some(egui::Theme::Light);
+        app.set_pref("appearance.appearanceMode", json!("dark")).unwrap();
+        app.apply_prefs(&ctx);
+        assert_eq!(app.ui.theme, ThemeKind::Dark);
+    }
+
+    /// Sync with System leaves egui's theme preference at System, so egui never gives the native
+    /// window an appearance of its own (on macOS that stops system appearance changes reaching
+    /// the app, #642); egui's light and dark styles both carry the resolved theme. Fixed modes
+    /// pin the window to their family.
+    #[test]
+    fn auto_mode_leaves_the_native_window_following_the_system() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        app.hooks.system_theme = Some(Box::new(|_| Some(egui::Theme::Light)));
+        app.set_pref("appearance.appearanceMode", json!("auto")).unwrap();
+        app.apply_prefs(&ctx);
+        assert_eq!(app.ui.theme, ThemeKind::Light);
+        assert_eq!(ctx.options(|o| o.theme_preference), egui::ThemePreference::System);
+        for theme in [egui::Theme::Light, egui::Theme::Dark] {
+            assert_eq!(ctx.style_of(theme).visuals.panel_fill, app.tokens.panel_bg, "{theme:?}");
+        }
+        // egui asks the window to follow the system, never to take Light or Dark.
+        let mut out = ctx.run_ui(egui::RawInput::default(), |_| {});
+        out.textures_delta.clear();
+        let cmds = out.viewport_output.values().flat_map(|v| v.commands.iter()).collect::<Vec<_>>();
+        assert!(!cmds.iter().any(|c| matches!(c, egui::ViewportCommand::SetTheme(t) if t != &egui::SystemTheme::SystemDefault)), "{cmds:?}");
+        for (mode, pref) in [("light", egui::ThemePreference::Light), ("dark", egui::ThemePreference::Dark)] {
+            app.set_pref("appearance.appearanceMode", json!(mode)).unwrap();
+            app.apply_prefs(&ctx);
+            assert_eq!(ctx.options(|o| o.theme_preference), pref, "{mode}");
+            assert_eq!(ctx.global_style().visuals.panel_fill, app.tokens.panel_bg, "{mode}");
+        }
+    }
+
+    /// Picking a theme (`view.theme.*`, `ui.set {theme}`) fixes the mode to its family.
+    #[test]
+    fn picking_a_theme_fixes_its_mode() {
+        let ctx = egui::Context::default();
+        let mut app = app();
+        app.set_pref("appearance.appearanceMode", json!("auto")).unwrap();
+        menus::invoke(&mut app, &ctx, "view.theme.light", json!({})).unwrap();
+        assert_eq!(app.session.prefs.appearance.appearance_mode, "light");
+        assert_eq!(app.ui.theme, ThemeKind::Light);
+        menus::invoke(&mut app, &ctx, "view.theme.darker", json!({})).unwrap();
+        assert_eq!(app.session.prefs.appearance.appearance_mode, "dark");
+        assert_eq!(app.session.prefs.appearance.dark_theme, "darker");
+        assert_eq!(app.ui.theme, ThemeKind::Darker);
+    }
+}
diff --git a/crates/ui-egui/src/app/screenshot.rs b/crates/ui-egui/src/app/screenshot.rs
new file mode 100644
index 000000000..bf7dace0d
--- /dev/null
+++ b/crates/ui-egui/src/app/screenshot.rs
@@ -0,0 +1,394 @@
+use super::{DrawGeometry, EffectcraftApp, PendingShot, Sender, ShotTarget, control, json};
+
+/// How long a screenshot request waits for a frame, from admission (app clock seconds).
+pub(crate) const SCREENSHOT_TIMEOUT_S: f64 = 8.0;
+
+/// Seconds between a screenshot's admission and the earliest capture: the UI settles first.
+pub(crate) const SCREENSHOT_SETTLE_S: f64 = 0.35;
+
+/// Final (non-discarded) UI passes a screenshot waits for after admission before it is issued.
+pub(crate) const SCREENSHOT_SETTLE_PASSES: u64 = 3;
+
+/// Geometry changes a queued screenshot may retry before it reports an error.
+const SCREENSHOT_MAX_RETRIES: u32 = 4;
+
+/// Outstanding screenshot requests (queued or waiting for their pixels).
+pub(crate) const MAX_PENDING_SHOTS: usize = 4;
+
+/// One capture's pixels: 128 MiB.
+const MAX_SHOT_BYTES: usize = 128 * 1024 * 1024;
+
+/// Every pending capture's reserved pixels together: 256 MiB.
+const MAX_SHOT_TOTAL_BYTES: usize = 256 * 1024 * 1024;
+
+/// Whether a captured image's dimensions match `rect` at `ppp`.
+///
+/// The surface may be smaller than requested when the adapter-limit fit (fork E2) applies, but a
+/// different aspect ratio means the pixels came from another layout than the one issued.
+fn shot_image_matches(image: &egui::ColorImage, rect: egui::Rect, ppp: f32) -> bool {
+    let [w, h] = image.size;
+    if w == 0 || h == 0 || !ppp.is_finite() || ppp <= 0.0 {
+        return false;
+    }
+    let ew = (rect.width() as f64 * ppp as f64).max(1.0);
+    let eh = (rect.height() as f64 * ppp as f64).max(1.0);
+    let want = ew / eh;
+    let got = w as f64 / h as f64;
+    (got - want).abs() <= 0.02 * want.max(1.0)
+}
+
+impl EffectcraftApp {
+    /// The geometry of the last completed UI pass, if one ran.
+    pub fn draw_geometry(&self) -> Option<DrawGeometry> {
+        self.draw_geom
+    }
+
+    // ---------------------------------------------------------------- screenshots
+
+    /// The root surface geometry a screenshot is admitted against.
+    ///
+    /// The last completed pass's geometry is authoritative. Before any pass, only the viewport's
+    /// `inner_rect` (the client surface a capture returns) is accepted: `outer_rect` also covers
+    /// the title bar and window frame, so a capture issued against it would be cropped and
+    /// validated against a different rectangle than the callback delivers. A request that arrives
+    /// before the geometry is known is refused with an actionable error, and the pass that would
+    /// establish it is requested.
+    fn current_geometry(&self, ctx: &egui::Context) -> Option<DrawGeometry> {
+        if let Some(g) = self.draw_geom {
+            return Some(g);
+        }
+        let rect = ctx.input(|i| i.viewport().inner_rect)?;
+        (rect.width() > 0.0 && rect.height() > 0.0).then_some(DrawGeometry { rect, ppp: ctx.pixels_per_point(), epoch: self.geometry_epoch })
+    }
+
+    /// The point rectangle a request captures: its crop, clamped to the window, or all of it.
+    fn shot_target_rect(geom: &DrawGeometry, crop: Option<[f32; 4]>) -> Option<egui::Rect> {
+        let r = match crop {
+            Some([x, y, w, h]) if [x, y, w, h].iter().all(|v| v.is_finite()) => {
+                egui::Rect::from_min_size(geom.rect.min + egui::vec2(x, y), egui::vec2(w.max(0.0), h.max(0.0))).intersect(geom.rect)
+            }
+            Some(_) => return None,
+            None => geom.rect,
+        };
+        (r.width() > 0.0 && r.height() > 0.0).then_some(r)
+    }
+
+    /// The screen-point crop `target` names right now (a panel's or element's current rectangle),
+    /// or an actionable error when it is not on screen. Resolved at issuance, never stored from
+    /// admission: the UI may move while it settles.
+    fn shot_crop(&self, target: &ShotTarget, geom: &DrawGeometry) -> Result<Option<egui::Rect>, String> {
+        let crop = match target {
+            ShotTarget::Window => None,
+            ShotTarget::Rect(r) => Some(*r),
+            ShotTarget::Panel(p) => {
+                let id = format!("panel.{}", p.id());
+                let found = self.auto.find(&id).ok_or_else(|| format!("the {} panel is not on screen", p.title()))?;
+                Some(found.rect)
+            }
+            ShotTarget::Id(id) => Some(self.auto.find(id).ok_or_else(|| format!("no element `{id}` is on screen"))?.rect),
+        };
+        Self::shot_target_rect(geom, crop).map(Some).ok_or_else(|| "the screenshot area is empty or not a finite rectangle".to_string())
+    }
+
+    /// `target` as a crop relative to `geom`'s origin: what the image's own pixels are cut with.
+    fn shot_relative_crop(&self, target: &ShotTarget, geom: &DrawGeometry) -> Result<Option<[f32; 4]>, String> {
+        let Some(r) = self.shot_crop(target, geom)? else { return Ok(None) };
+        Ok(Some([r.min.x - geom.rect.min.x, r.min.y - geom.rect.min.y, r.width(), r.height()]))
+    }
+
+    /// Pixel bytes `rect` takes at `ppp`, checked (`width * height * 4`).
+    fn shot_pixel_bytes(rect: egui::Rect, ppp: f32) -> Option<usize> {
+        if !ppp.is_finite() || ppp <= 0.0 {
+            return None;
+        }
+        let w = (rect.width() as f64 * ppp as f64).ceil().max(1.0) as usize;
+        let h = (rect.height() as f64 * ppp as f64).ceil().max(1.0) as usize;
+        w.checked_mul(h)?.checked_mul(4)
+    }
+
+    /// Reserve and queue one `ui.screenshot`, or reply with an actionable error.
+    pub(crate) fn admit_screenshot(&mut self, ctx: &egui::Context, path: Option<String>, target: ShotTarget, reply: Sender<serde_json::Value>) {
+        let Some(geom) = self.current_geometry(ctx) else {
+            let _ = reply.send(
+                json!({"ok": false, "error": "the window geometry is not known yet (it is recorded by a completed UI pass; retry after the next frame)"}),
+            );
+            // Ask for the pass that records it.
+            self.want_paint = true;
+            ctx.request_repaint();
+            return;
+        };
+        if self.pending_screenshots.len() >= MAX_PENDING_SHOTS {
+            let _ = reply.send(json!({"ok": false, "error": format!("too many screenshots are pending (at most {MAX_PENDING_SHOTS})")}));
+            return;
+        }
+        if let Err(e) = self.shot_crop(&target, &geom) {
+            let _ = reply.send(json!({"ok": false, "error": e}));
+            return;
+        }
+        // The capture is always the whole surface (the crop is applied when the PNG is written),
+        // so the reservation and the per-image bound follow the surface's actual dimensions.
+        let Some(bytes) = Self::shot_pixel_bytes(geom.rect, geom.ppp) else {
+            let _ = reply.send(json!({"ok": false, "error": "the screenshot area is too large to reserve"}));
+            return;
+        };
+        if bytes > MAX_SHOT_BYTES {
+            let _ = reply
+                .send(json!({"ok": false, "error": format!("the screenshot would need about {bytes} bytes, over the {MAX_SHOT_BYTES}-byte per-image limit")}));
+            return;
+        }
+        if self.shot_bytes.checked_add(bytes).is_none_or(|n| n > MAX_SHOT_TOTAL_BYTES) {
+            let _ = reply.send(json!({"ok": false, "error": format!("the screenshot would exceed the {MAX_SHOT_TOTAL_BYTES}-byte pending-image budget")}));
+            return;
+        }
+        self.shot_bytes += bytes;
+        self.pending_screenshots.push(PendingShot {
+            path,
+            target,
+            crop: None,
+            reply,
+            deadline: self.now + SCREENSHOT_TIMEOUT_S,
+            settle_at: self.now + SCREENSHOT_SETTLE_S,
+            admitted: geom,
+            admitted_pass: self.ui_pass_seq,
+            issued: None,
+            slot: None,
+            reserved_bytes: bytes,
+            attempts: 0,
+        });
+        // A queued capture needs a settled UI pass before it can be issued.
+        self.want_paint = true;
+    }
+
+    /// Re-reserve request `i` against `geom` after a surface change; false when it no longer fits.
+    fn refresh_shot_reservation(&mut self, i: usize, geom: &DrawGeometry) -> bool {
+        let Some(bytes) = Self::shot_pixel_bytes(geom.rect, geom.ppp) else { return false };
+        if bytes > MAX_SHOT_BYTES {
+            return false;
+        }
+        let released = self.shot_bytes.saturating_sub(self.pending_screenshots[i].reserved_bytes);
+        if released.checked_add(bytes).is_none_or(|n| n > MAX_SHOT_TOTAL_BYTES) {
+            return false;
+        }
+        self.shot_bytes = released + bytes;
+        self.pending_screenshots[i].reserved_bytes = bytes;
+        true
+    }
+
+    /// Reply with an error to request `i` and release its reservation.
+    fn fail_shot(&mut self, i: usize, message: impl Into<String>) {
+        let shot = self.pending_screenshots.remove(i);
+        self.shot_bytes = self.shot_bytes.saturating_sub(shot.reserved_bytes);
+        let _ = shot.reply.send(json!({"ok": false, "error": message.into()}));
+    }
+
+    /// Collect completed captures, enforce timeouts and issue every settled request.
+    ///
+    /// Runs from [`Self::tick`] only: the callback stores pixels in its slot and wakes the
+    /// viewport, and everything that can write a file or reply happens here, on the app thread.
+    pub(super) fn tick_screenshots(&mut self, ctx: &egui::Context) {
+        let Some(geom) = self.current_geometry(ctx) else { return };
+        self.drain_completed_screenshots(geom);
+        self.timeout_screenshots();
+        self.issue_screenshots(ctx, geom);
+        // 4. Wake up for the earliest deadline even when no further pass is otherwise needed: an
+        //    issued capture whose callback never arrives (hidden window, display asleep, renderer
+        //    failure) would otherwise never reach its timeout. This is a timer, not a paint
+        //    request: the issued screenshot command already forces the frame it needs.
+        if let Some(next) = self.pending_screenshots.iter().map(|s| s.deadline).reduce(f64::min) {
+            let wait = (next - self.now).max(0.001);
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64(wait));
+        }
+    }
+
+    /// 1. Drain completed slots. A completion whose surface epoch changed since issuance is
+    ///    discarded even if the geometry changed back: it was cropped with another frame's
+    ///    pixels-per-point.
+    fn drain_completed_screenshots(&mut self, geom: DrawGeometry) {
+        let mut i = 0;
+        while i < self.pending_screenshots.len() {
+            let taken = self.pending_screenshots.get(i).and_then(|s| s.slot.as_ref()).and_then(craft_ui::capture::CaptureSlot::take);
+            let Some(result) = taken else {
+                i += 1;
+                continue;
+            };
+            let issued = self.pending_screenshots[i].issued;
+            match result {
+                Ok(image) => {
+                    if issued.is_none_or(|g| g.epoch != geom.epoch) {
+                        self.pending_screenshots[i].slot = None;
+                        self.pending_screenshots[i].issued = None;
+                        if self.pending_screenshots[i].attempts >= SCREENSHOT_MAX_RETRIES {
+                            self.fail_shot(i, "the window resized while the screenshot was being taken");
+                        } else if !self.refresh_shot_reservation(i, &geom) {
+                            self.fail_shot(i, "the resized window is too large to capture within the screenshot budget");
+                        } else {
+                            let settle_at = self.now + SCREENSHOT_SETTLE_S;
+                            let passes = self.ui_pass_seq;
+                            let s = &mut self.pending_screenshots[i];
+                            s.attempts += 1;
+                            s.admitted = geom;
+                            s.admitted_pass = passes;
+                            s.settle_at = settle_at;
+                            i += 1;
+                        }
+                        continue;
+                    }
+                    let Some(issued) = issued else {
+                        i += 1;
+                        continue;
+                    };
+                    if !shot_image_matches(&image, issued.rect, issued.ppp) {
+                        self.fail_shot(i, "the screenshot's pixels do not match the window it was taken from");
+                        continue;
+                    }
+                    // The returned image can be smaller than requested (the E2 adapter-limit fit),
+                    // so the crop uses the image's own scale, never the issued ppp.
+                    let [iw, ih] = image.size;
+                    let (sx, sy) = (iw as f64 / issued.rect.width() as f64, ih as f64 / issued.rect.height() as f64);
+                    if !(sx.is_finite() && sx > 0.0 && sy.is_finite() && sy > 0.0) {
+                        self.fail_shot(i, "the screenshot's size does not describe the window it was taken from");
+                        continue;
+                    }
+                    let shot = self.pending_screenshots.remove(i);
+                    self.shot_bytes = self.shot_bytes.saturating_sub(shot.reserved_bytes);
+                    if let Some(path) = shot.path.as_deref()
+                        && let Err(error) = self.session.refuse_export(path)
+                    {
+                        let _ = shot.reply.send(json!({"ok": false, "error": error.to_string()}));
+                        continue;
+                    }
+                    let r = control::save_screenshot(&image, shot.path.as_deref(), shot.crop, [sx, sy]);
+                    let _ = shot.reply.send(r);
+                }
+                Err(e) => {
+                    self.fail_shot(i, e.to_string());
+                }
+            }
+        }
+    }
+
+    /// 2. Timeouts: a late callback finds its slot cancelled and writes nothing.
+    fn timeout_screenshots(&mut self) {
+        let mut i = 0;
+        while i < self.pending_screenshots.len() {
+            if self.now > self.pending_screenshots[i].deadline {
+                self.fail_shot(i, "no frame was presented (window hidden or display asleep)");
+            } else {
+                i += 1;
+            }
+        }
+    }
+
+    /// 3. Issue settled requests. The command itself requests the paint; a request still
+    ///    waiting for its passes needs `want_paint` so a hidden window keeps painting.
+    fn issue_screenshots(&mut self, ctx: &egui::Context, geom: DrawGeometry) {
+        let mut i = 0;
+        while i < self.pending_screenshots.len() {
+            if self.pending_screenshots[i].slot.is_some() {
+                i += 1;
+                continue;
+            }
+            if geom.epoch != self.pending_screenshots[i].admitted.epoch {
+                if self.pending_screenshots[i].attempts >= SCREENSHOT_MAX_RETRIES {
+                    self.fail_shot(i, "the window kept resizing before the screenshot could be taken");
+                    continue;
+                }
+                if !self.refresh_shot_reservation(i, &geom) {
+                    self.fail_shot(i, "the resized window is too large to capture within the screenshot budget");
+                    continue;
+                }
+                let (now, passes) = (self.now, self.ui_pass_seq);
+                let s = &mut self.pending_screenshots[i];
+                s.attempts += 1;
+                s.admitted = geom;
+                s.admitted_pass = passes;
+                s.settle_at = now + SCREENSHOT_SETTLE_S;
+                self.want_paint = true;
+                i += 1;
+                continue;
+            }
+            let settled = self.ui_pass_seq >= self.pending_screenshots[i].admitted_pass.saturating_add(SCREENSHOT_SETTLE_PASSES)
+                && self.now >= self.pending_screenshots[i].settle_at;
+            if !settled {
+                self.want_paint = true;
+                i += 1;
+                continue;
+            }
+            // Resolve the crop now, against the settled UI: an element that moved since admission
+            // is captured where it is, and its rectangle is relative to this issued surface.
+            let target = self.pending_screenshots[i].target.clone();
+            let crop = match self.shot_relative_crop(&target, &geom) {
+                Ok(c) => c,
+                Err(e) => {
+                    self.fail_shot(i, e);
+                    continue;
+                }
+            };
+            let (slot, callback) = craft_ui::capture::CaptureSlot::new(ctx, egui::ViewportId::ROOT, MAX_SHOT_BYTES);
+            ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(callback));
+            let s = &mut self.pending_screenshots[i];
+            s.slot = Some(slot);
+            s.issued = Some(geom);
+            s.crop = crop;
+            i += 1;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Footage, FootageKind, ItemKind};
+    use std::sync::Arc;
+
+    #[test]
+    fn queued_screenshots_recheck_sources_when_the_capture_completes() {
+        let dir = std::env::temp_dir().join(format!("effectcraft-pending-shot-protection-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        for kind in ["footage", "project", "free"] {
+            let path = dir.join(format!("{kind}.png"));
+            let text = path.to_string_lossy().into_owned();
+            let mut app = EffectcraftApp::new(Session::default());
+            let ctx = egui::Context::default();
+            let geom = DrawGeometry { rect: egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(2.0, 2.0)), ppp: 1.0, epoch: 0 };
+            app.draw_geom = Some(geom);
+            assert!(app.session.refuse_export(&text).is_ok());
+            let (tx, rx) = std::sync::mpsc::channel();
+            app.admit_screenshot(&ctx, Some(text.clone()), ShotTarget::Window, tx);
+            let (slot, callback) = craft_ui::capture::CaptureSlot::new(&ctx, egui::ViewportId::ROOT, MAX_SHOT_BYTES);
+            let shot = app.pending_screenshots.last_mut().unwrap();
+            shot.issued = Some(geom);
+            shot.slot = Some(slot);
+            // The destination becomes protected after admission, before pixels arrive.
+            let original = match kind {
+                "footage" => {
+                    std::fs::write(&path, b"SOURCE FOOTAGE").unwrap();
+                    let footage = Footage { path: text.clone(), kind: FootageKind::Still, ..Default::default() };
+                    Arc::make_mut(&mut app.session.project).add_item("clip", effectcraft_engine::color::Label::None, None, ItemKind::Footage(footage));
+                    Some(std::fs::read(&path).unwrap())
+                }
+                "project" => {
+                    app.session.execute("file.saveAs", json!({"path": text})).unwrap();
+                    Some(std::fs::read(&path).unwrap())
+                }
+                _ => None,
+            };
+            callback.complete(Arc::new(egui::ColorImage::filled([2, 2], egui::Color32::RED)));
+            app.drain_completed_screenshots(geom);
+            let reply = rx.try_recv().unwrap();
+            if let Some(original) = original {
+                assert_eq!(reply["ok"], false, "{kind}: {reply}");
+                assert!(reply["error"].as_str().unwrap_or_default().contains(kind), "{reply}");
+                assert_eq!(std::fs::read(&path).unwrap(), original);
+            } else {
+                assert_eq!(reply["ok"], true, "{reply}");
+                assert!(std::fs::read(&path).unwrap().starts_with(b"\x89PNG\r\n\x1a\n"));
+            }
+            assert!(app.pending_screenshots.is_empty());
+            assert_eq!(app.shot_bytes, 0);
+            std::fs::remove_file(path).unwrap();
+        }
+        std::fs::remove_dir(dir).unwrap();
+    }
+}
diff --git a/crates/ui-egui/src/app/viewer_frames.rs b/crates/ui-egui/src/app/viewer_frames.rs
new file mode 100644
index 000000000..a1a0faaf5
--- /dev/null
+++ b/crates/ui-egui/src/app/viewer_frames.rs
@@ -0,0 +1,233 @@
+use super::*;
+
+impl EffectcraftApp {
+    /// The size of the viewer frame's texture (CPU frames; fitted to the GPU's texture limit).
+    pub fn viewer_texture_size(&self) -> Option<[usize; 2]> {
+        self.viewer_tex.as_ref().map(|(t, _, _)| t.size())
+    }
+
+    /// The viewer's current pixels as 8-bit premultiplied RGBA, reading a GPU frame back the
+    /// first time something asks for it. A half-float frame (32 bpc) is converted the first time:
+    /// as rendered with Project Settings ▸ HDR, without the viewer's exposure or display colour.
+    ///
+    /// The browser can't wait for the GPU: there the first call starts an asynchronous readback
+    /// and returns `None`; a later call (the next frame) has the pixels.
+    pub fn viewer_pixels(&mut self) -> Option<Arc<egui::ColorImage>> {
+        if self.viewer_image.is_none()
+            && let Some(f) = &self.viewer_f16
+        {
+            let pass = effectcraft_engine::viewer::DisplayPass::new(effectcraft_engine::viewer::Channel::Rgb, false, 0.0, f.encoding, None);
+            self.viewer_image = Some(Arc::new(f.to_color_image(&pass)));
+        }
+        let to_image = |bytes: Vec<u8>, w: u32, h: u32| {
+            let px = bytes.as_chunks::<4>().0.iter().map(|c| egui::Color32::from_rgba_premultiplied(c[0], c[1], c[2], c[3])).collect();
+            Arc::new(egui::ColorImage::new([w as usize, h as usize], px))
+        };
+        if self.viewer_image.is_none()
+            && let (Some((_, key, f)), Some(g)) = (&self.viewer_native, &self.gpu)
+            && self.viewer_shown.as_ref().map(|s| s.1) == Some(*key)
+        {
+            if cfg!(target_arch = "wasm32") {
+                let ready = self.viewer_readback.1.lock().ok().and_then(|mut r| r.take_if(|r| r.0 == *key));
+                if let Some((_, img)) = ready {
+                    self.viewer_image = Some(img);
+                } else if self.viewer_readback.0 != Some(*key) {
+                    self.viewer_readback.0 = Some(*key);
+                    let (slot, k, (w, h)) = (self.viewer_readback.1.clone(), *key, (f.width, f.height));
+                    let ctx = self.frames.context();
+                    g.read_display_async(f, move |bytes| {
+                        if let (Some(b), Ok(mut s)) = (bytes, slot.lock()) {
+                            *s = Some((k, to_image(b, w, h)));
+                        }
+                        if let Some(c) = ctx {
+                            c.request_repaint();
+                        }
+                    });
+                }
+            } else if let Some(bytes) = g.read_display(f) {
+                self.viewer_image = Some(to_image(bytes, f.width, f.height));
+            }
+        }
+        self.viewer_image.clone()
+    }
+
+    /// The half-float frame on screen (32 bpc projects), for float readouts.
+    pub fn viewer_f16(&self) -> Option<&Arc<frames::F16Frame>> {
+        self.viewer_f16.as_ref()
+    }
+
+    /// The texture the Composition viewer's display pass drew last (half-float frames, or 8-bit
+    /// frames with exposure, a channel view or display colour), when it ran on the GPU.
+    pub fn viewer_display_texture(&self) -> Option<egui::TextureId> {
+        self.viewer_bake.id()
+    }
+
+    /// The display pass's pipelines on egui-wgpu's device, made the first time (desktop; the
+    /// browser's viewer converts on the CPU for now). `None` without a device.
+    pub(crate) fn display_gpu(&mut self) -> Option<Arc<crate::display_gpu::DisplayGpu>> {
+        if cfg!(target_arch = "wasm32") || self.display_gpu_failed {
+            return None;
+        }
+        if self.display_gpu.is_none() {
+            let rs = self.window_wgpu.as_ref()?;
+            match crate::display_gpu::DisplayGpu::try_new(&rs.device) {
+                Ok(g) => self.display_gpu = Some(Arc::new(g)),
+                Err(e) => {
+                    log::warn!("the viewer's display pass runs on the CPU: {e}");
+                    self.display_gpu_failed = true;
+                }
+            }
+        }
+        self.display_gpu.clone()
+    }
+
+    /// The viewer's Resolution: the active composition's (saved with the project).
+    pub fn viewer_res(&self) -> state::Resolution {
+        self.session.active_comp().map(|c| c.resolution).unwrap_or_default()
+    }
+
+    /// The render scale used by the viewer right now.
+    pub fn viewer_scale(&self, zoom: f32, ppp: f32) -> f64 {
+        // The preview's Resolution (when not Auto) while it plays.
+        if self.playback.playing
+            && let Some(f) = self.playback.res
+        {
+            return state::Resolution::from_factor(f.into()).scale(zoom, ppp);
+        }
+        // Auto follows the zoom alike while playing and paused, so frames cached while scrubbing
+        // play back, and frames cached by a preview stay on screen when it stops.
+        let res = self.viewer_res();
+        let full = res.scale(zoom, ppp);
+        // Fast Previews ▸ Adaptive Resolution / Fast Draft: lower resolution while dragging.
+        let (_, k) = self.session.state.viewer.fast_previews.render(self.ui.viewer.interacting || self.ui.viewer.property_interacting);
+        if k < 1.0 && res.is_auto() {
+            return full.min((full * 0.5).max(self.session.prefs.adaptive_limit()));
+        }
+        full
+    }
+
+    /// The cache key of viewer frame `frame` of `comp` at `scale` (see [`Self::frame_series`]).
+    pub fn frame_key(&self, comp: ItemId, frame: i64, scale: f64) -> FrameKey {
+        FrameKey { frame, ..self.frame_series(comp, scale) }
+    }
+
+    /// The key of frame 0 of `comp`'s viewer frames at `scale` (the content, view and render
+    /// options are the same for every frame: loops compute this once).
+    pub fn frame_series(&self, comp: ItemId, scale: f64) -> FrameKey {
+        FrameKey {
+            revision: self.session.revision,
+            content: self.frames.content_of(&self.session.project, self.session.revision, comp),
+            comp: comp.0,
+            frame: 0,
+            scale: (scale * 1000.0).round() as u32,
+            view: self.view_hash(comp),
+            opts: frames::opts_hash(&self.frame_opts(comp, scale)) ^ self.roto_model_stamp(),
+        }
+    }
+
+    /// Changes when the Roto Brush model in use does: a frame drawn with the classic fallback while the model loaded
+    /// is not the frame the model gives, so the two must not share a cache entry.
+    fn roto_model_stamp(&self) -> u64 {
+        use std::hash::{Hash, Hasher};
+        let Some(id) = self.session.models_roto_active() else { return 0 };
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        id.hash(&mut h);
+        h.finish() | 1
+    }
+
+    /// The frame series the viewer of `comp` shows now (its scale, view and options, for the
+    /// comp's current content): what the cache bars count.
+    pub fn shown_series(&self, comp: ItemId) -> FrameKey {
+        let scale = self.viewer_shown.as_ref().filter(|(_, k)| k.comp == comp.0).map_or(1000, |(_, k)| k.scale);
+        self.frame_series(comp, scale as f64 / 1000.0)
+    }
+
+    /// The frame series a preview with options `o` plays: at its Resolution, or the one the
+    /// viewer shows with Auto (it follows the zoom). The Preview panel's cache bar counts it.
+    pub fn preview_series(&self, comp: ItemId, o: &effectcraft_engine::preview::PreviewPreset) -> FrameKey {
+        match o.resolution.factor(o.custom_resolution) {
+            Some(n) => self.frame_series(comp, 1.0 / f64::from(n)),
+            None => self.shown_series(comp),
+        }
+    }
+
+    /// Hash of the comp viewer's 3D view camera (0 for the active camera view).
+    pub fn view_hash(&self, comp: ItemId) -> u64 {
+        use std::hash::{Hash, Hasher};
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        // The region of interest changes what is rendered too.
+        let roi = self.viewer_region(comp);
+        if let Some(r) = roi {
+            r.map(f64::to_bits).hash(&mut h);
+        }
+        let Some(cam) = self.session.view_camera(comp) else { return if roi.is_some() { h.finish() | 1 } else { 0 } };
+        for row in cam.view.0 {
+            for v in row {
+                v.to_bits().hash(&mut h);
+            }
+        }
+        cam.zoom.to_bits().hash(&mut h);
+        cam.ortho.hash(&mut h);
+        h.finish() | 1
+    }
+
+    /// The comp-space region viewer frames of `comp` cover: the region of interest, else the
+    /// Extended Viewer's area (frame plus pasteboard), else `None` (the whole frame).
+    pub fn viewer_region(&self, comp: ItemId) -> Option<[f64; 4]> {
+        if self.session.active_comp_id() != Some(comp) {
+            return None;
+        }
+        self.session.state.region_of_interest.or(self.ui.viewer.extended)
+    }
+
+    /// Request a prefetch frame render (no-op if cached/in flight).
+    pub fn request_frame(&self, comp: ItemId, frame: i64, scale: f64) {
+        self.request_frame_with(comp, frame, scale, frames::Frames::request);
+    }
+
+    /// Request the frame on screen: rendered before any queued prefetch.
+    pub fn request_frame_urgent(&self, comp: ItemId, frame: i64, scale: f64) {
+        self.request_frame_with(comp, frame, scale, frames::Frames::request_urgent);
+    }
+
+    /// Request a frame nobody waits for (Cache Frames When Idle): rendered on one thread
+    /// (`Frames::request_background`).
+    pub fn request_frame_background(&self, comp: ItemId, frame: i64, scale: f64) {
+        self.request_frame_with(comp, frame, scale, frames::Frames::request_background);
+    }
+
+    /// Render options of viewer frames of `comp` at `scale`.
+    pub fn frame_opts(&self, comp: ItemId, scale: f64) -> RenderOpts {
+        let (draft, _) = self.session.state.viewer.fast_previews.render(self.ui.viewer.interacting || self.ui.viewer.property_interacting);
+        let roi = self.viewer_region(comp);
+        RenderOpts {
+            scale,
+            motion_blur: true,
+            guides: true,
+            draft: self.ui.viewer.fast_preview || draft,
+            view: self.session.view_camera(comp),
+            roi,
+            backend: effectcraft_engine::render::Backend::Auto,
+            nested_switches: self.session.prefs.general.switches_affect_nested_comps,
+            draft_shadows: self.session.prefs.three_d.realtime_shadows,
+            // 32 bpc: half-float frames without the HDR step; the display pass applies it after
+            // the viewer's exposure (#2797).
+            skip_hdr_step: frames::f16_frames(&self.session.project.settings),
+            proxy: Default::default(),
+        }
+    }
+
+    fn request_frame_with(
+        &self,
+        comp: ItemId,
+        frame: i64,
+        scale: f64,
+        request: fn(&frames::Frames, &frames::RenderSource, FrameKey, ItemId, Tick, RenderOpts),
+    ) {
+        let Some(c) = self.session.project.comp(comp) else { return };
+        let key = self.frame_key(comp, frame, scale);
+        let t = c.frame_rate.tick_of(frame);
+        let opts = self.frame_opts(comp, scale);
+        request(&self.frames, &self.render_source(), key, comp, t, opts);
+    }
+}
diff --git a/crates/ui-egui/src/app/window.rs b/crates/ui-egui/src/app/window.rs
new file mode 100644
index 000000000..7326b9f32
--- /dev/null
+++ b/crates/ui-egui/src/app/window.rs
@@ -0,0 +1,167 @@
+use super::*;
+
+impl EffectcraftApp {
+    /// Keep the saved workspaces for the next session (see [`EffectcraftApp::new`]): After
+    /// Effects' saved workspaces last until they are deleted (#320). `Err` when they weren't
+    /// written (#696): the change applies for this session and a later save retries it, but until
+    /// then a restart brings back what is on disk.
+    pub(crate) fn store_saved_workspaces(&mut self) -> Result<(), String> {
+        let Err(error) = self.workspace_store.save_now(self.session.config.as_deref(), &self.ui) else { return Ok(()) };
+        let message = format!("Workspace changes couldn't be saved and may be lost after a restart: {error}");
+        log::warn!("{message}");
+        self.ui.status = message.clone();
+        // The raw error, so the background retry doesn't report the same failure again.
+        self.workspace_store.error = Some(error);
+        Err(message)
+    }
+
+    pub fn set_workspace(&mut self, name: &str) {
+        // Learn: the Home screen's Learn tab (tutorials) in the Composition panel. Leaving it for
+        // another workspace closes the Home screen again: it stayed over every workspace until a
+        // project was created (#272).
+        if name == "Learn" {
+            self.ui.start_screen = true;
+            self.ui.home_learn = true;
+            self.ui.home_templates = false;
+        } else if self.ui.workspace == "Learn" {
+            self.ui.start_screen = false;
+            self.ui.home_learn = false;
+        }
+        self.ui.workspace = name.to_string();
+        self.ui.dock = self.ui.saved_workspaces.get(name).cloned().unwrap_or_else(|| dock::Workspace::new(dock::workspace(name)));
+        self.ui.maximized = None;
+    }
+
+    /// Built-in workspaces followed by the saved ones (Window ▸ Workspace ▸ Save as New Workspace).
+    pub fn workspace_names(&self) -> Vec<String> {
+        let mut v: Vec<String> = dock::WORKSPACES.iter().map(|s| s.to_string()).collect();
+        v.extend(self.saved_workspace_names());
+        v
+    }
+
+    /// The workspaces the user saved under a new name (built-ins whose changes were saved are
+    /// not repeated), in name order.
+    pub fn saved_workspace_names(&self) -> Vec<String> {
+        self.ui.saved_workspaces.keys().filter(|k| !dock::WORKSPACES.contains(&k.as_str())).cloned().collect()
+    }
+
+    /// The open Gradient Editor's draft (`panels::gradient_editor`): what OK would set.
+    pub fn gradient_draft(&self) -> &panels::gradient_editor::Draft {
+        &self.dialog_state.gradient
+    }
+
+    /// The open Gradient Editor's draft, to edit (tests and automation; the editor's own fields
+    /// do the same).
+    pub fn gradient_draft_mut(&mut self) -> &mut panels::gradient_editor::Draft {
+        &mut self.dialog_state.gradient
+    }
+
+    /// The open settings dialog's draft and Preview state (`panels::dialogs`): Solid, Camera,
+    /// Light and Composition Settings keep what OK would apply here.
+    pub fn dialog_state(&self) -> &panels::dialogs::DialogState {
+        &self.dialog_state
+    }
+
+    /// The open settings dialog's draft, to edit (tests and automation; the dialog's own fields
+    /// do the same).
+    pub fn dialog_state_mut(&mut self) -> &mut panels::dialogs::DialogState {
+        &mut self.dialog_state
+    }
+
+    /// Show panel `p` (opening it in its usual place if it is closed), bring it to the front and
+    /// give it the focus: Window ▸ `<panel>`.
+    pub fn show_panel(&mut self, p: PanelKind) {
+        if !self.ui.dock.is_floating(p) && self.ui.maximized.is_some_and(|m| m != p) {
+            self.ui.maximized = None;
+        }
+        self.raise_panel(p);
+        self.ui.focused = p;
+    }
+
+    /// Bring panel `p` to the front of its group, opening it if it is closed, without moving the
+    /// focus (a comp opening brings up its viewer, an effect applied brings up Effect Controls).
+    /// A closed panel goes back where it was; one never laid out goes to its usual place: the
+    /// Composition panel in the centre with the Layer panel and other viewers (with none of
+    /// those left, above the Timeline), Layer and the viewers beside the Composition panel, and
+    /// so on.
+    pub fn raise_panel(&mut self, p: PanelKind) {
+        if !self.ui.dock.is_open(p) {
+            let docked = |q: &PanelKind| self.ui.dock.is_docked(*q);
+            let near = match p {
+                PanelKind::Composition => self
+                    .ui
+                    .dock
+                    .panels()
+                    .into_iter()
+                    .find(|q| matches!(q, PanelKind::Layer | PanelKind::Viewer(_) | PanelKind::Flowchart | PanelKind::Footage) && docked(q)),
+                PanelKind::Layer | PanelKind::Flowchart | PanelKind::Viewer(_) => Some(PanelKind::Composition),
+                PanelKind::RenderQueue => Some(PanelKind::Timeline),
+                PanelKind::EffectControls | PanelKind::History => Some(PanelKind::Project),
+                _ => Some(PanelKind::EffectsPresets),
+            }
+            .filter(|q| self.ui.dock.is_open(*q));
+            let mut workspace = self.ui.dock.clone();
+            let known = workspace.hidden.iter().any(|(q, _)| *q == p);
+            let opened = if p == PanelKind::Composition && near.is_none() && !known && self.ui.dock.is_docked(PanelKind::Timeline) {
+                workspace
+                    .apply(
+                        craft_ui::docking::Action::OpenAt {
+                            panel: p,
+                            anchor: PanelKind::Timeline,
+                            placement: craft_ui::docking::Placement::Split(craft_ui::docking::Zone::Top),
+                        },
+                        dock::permissions,
+                    )
+                    .map(|_| ())
+            } else if known {
+                workspace.set_visible(p, true, near, dock::permissions)
+            } else {
+                workspace.apply(craft_ui::docking::Action::Open { panel: p, anchor: near }, dock::permissions).map(|_| ())
+            };
+            match opened {
+                Ok(()) => self.ui.dock = workspace,
+                Err(e) => {
+                    self.ui.status = format!("can't open {}: {e}", p.title());
+                    return;
+                }
+            }
+        }
+        let _ = self.ui.dock.apply(craft_ui::docking::Action::Activate { panel: p }, dock::permissions);
+        if self.ui.dock.is_floating(p) {
+            self.pending_panel_raise = Some(p);
+        }
+    }
+}
+
+/// Maximize a first window that doesn't fit the screen, which fits it to the space beside the
+/// taskbar or dock. The 1680 × 1020 window on a smaller screen is only shrunk to the monitor's
+/// size, so with its title bar it ran under the taskbar and cut menus off at the bottom of the
+/// screen (#269).
+pub(super) fn fit_window(ctx: &egui::Context) {
+    let (monitor, window) = ctx.input(|i| (i.viewport().monitor_size, i.viewport().outer_rect.or(i.viewport().inner_rect)));
+    if let (Some(monitor), Some(window)) = (monitor, window)
+        && overflows_screen(window.size(), monitor)
+    {
+        ctx.send_viewport_cmd(egui::ViewportCommand::Maximized(true));
+    }
+}
+
+/// Whether a window `size` leaves no room on a `monitor` for a taskbar or dock (points).
+fn overflows_screen(size: egui::Vec2, monitor: egui::Vec2) -> bool {
+    const TASKBAR: f32 = 64.0;
+    size.x > monitor.x || size.y > monitor.y - TASKBAR
+}
+
+#[cfg(test)]
+mod fit_window_tests {
+    use super::overflows_screen;
+    use egui::vec2;
+
+    #[test]
+    fn a_window_taller_than_the_screen_beside_its_taskbar_overflows() {
+        // The default window on a 1366 × 768 laptop (shrunk to the monitor) and on 1080p.
+        assert!(overflows_screen(vec2(1366.0, 799.0), vec2(1366.0, 768.0)));
+        assert!(overflows_screen(vec2(1680.0, 1051.0), vec2(1920.0, 1080.0)));
+        assert!(!overflows_screen(vec2(1680.0, 1051.0), vec2(2560.0, 1440.0)));
+    }
+}
diff --git a/crates/ui-egui/src/audio.rs b/crates/ui-egui/src/audio.rs
index 7972e6942..fbfe4b8af 100644
--- a/crates/ui-egui/src/audio.rs
+++ b/crates/ui-egui/src/audio.rs
@@ -532,7 +532,7 @@ mod tests {
         let item = p.add_item("long.flac", Label::SeaFoam, None, ItemKind::Footage(footage));
         let mut comp = Comp::new(64, 36, FrameRate::new(30, 1), Tick::from_seconds_f64(10.0));
         let layer = build::layer(&mut p, &comp, "long.flac", LayerSource::Footage { item }, (0, 0), None);
-        comp.layers = vec![layer];
+        comp.layers = vec![layer].into();
         let cid = p.add_item("Comp", Label::Sandstone, None, ItemKind::Comp(comp.into()));
         let src = RenderSource {
             project: Arc::new(p),
diff --git a/crates/ui-egui/src/clock.rs b/crates/ui-egui/src/clock.rs
new file mode 100644
index 000000000..184c8421c
--- /dev/null
+++ b/crates/ui-egui/src/clock.rs
@@ -0,0 +1,71 @@
+use super::*;
+
+/// The application's monotonic clock, in seconds.
+///
+/// Neither `ctx.input(|i| i.time)` nor `RawInput::time` is valid in a logic-only tick:
+/// `Context::run_logic` copies only the viewport information, so both are the previous full
+/// pass's values. Playback, auto-save, screenshot deadlines and the control channel measure time
+/// with this clock instead. Native and web use the same [`web_time::Instant`] source; tests
+/// inject [`AppClock::manual`] and advance it.
+#[derive(Clone, Debug)]
+pub struct AppClock {
+    origin: web_time::Instant,
+    manual: Option<f64>,
+}
+
+impl AppClock {
+    /// The host's monotonic clock.
+    pub fn real() -> Self {
+        Self { origin: web_time::Instant::now(), manual: None }
+    }
+
+    /// A clock tests advance explicitly with [`AppClock::advance`].
+    pub fn manual() -> Self {
+        Self { origin: web_time::Instant::now(), manual: Some(0.0) }
+    }
+
+    /// Seconds since the clock started (monotonic on native and in the browser).
+    pub fn now(&self) -> f64 {
+        match self.manual {
+            Some(t) => t,
+            None => self.origin.elapsed().as_secs_f64(),
+        }
+    }
+
+    /// Move a manual clock forward; a real clock ignores this.
+    pub fn advance(&mut self, seconds: f64) {
+        if let Some(t) = &mut self.manual {
+            *t = (*t + seconds.max(0.0)).max(0.0);
+        }
+    }
+
+    /// Whether the clock is test-driven.
+    pub fn is_manual(&self) -> bool {
+        self.manual.is_some()
+    }
+}
+
+impl Default for AppClock {
+    /// The real monotonic clock (`Self::real()`).
+    fn default() -> Self {
+        Self::real()
+    }
+}
+
+impl EffectcraftApp {
+    /// The app clock's value at the last tick.
+    pub fn now(&self) -> f64 {
+        self.now
+    }
+
+    /// The clock itself (tests advance a manual clock).
+    pub fn clock_mut(&mut self) -> &mut AppClock {
+        &mut self.clock
+    }
+
+    /// Use a test-driven clock from now on.
+    pub fn use_manual_clock(&mut self) {
+        self.clock = AppClock::manual();
+        self.now = 0.0;
+    }
+}
diff --git a/crates/ui-egui/src/color_picker.rs b/crates/ui-egui/src/color_picker.rs
index efaae6d7f..d434538e6 100644
--- a/crates/ui-egui/src/color_picker.rs
+++ b/crates/ui-egui/src/color_picker.rs
@@ -1,6 +1,7 @@
 //! The colour picker every colour input opens, laid out like After Effects' Color Picker: a
 //! square and a slider for the channel chosen with the H / S / B / R / G / B buttons, the new
-//! colour over the original, the HSB and RGB values, the hex code, and OK / Cancel.
+//! colour over the original, the HSB and RGB values, the hex code with an eyedropper that samples
+//! the Composition viewer, and OK / Cancel.
 //!
 //! Colours are sRGB components (0–1), as the project stores them. Changes apply as they are made
 //! (After Effects' Preview); Cancel or Escape goes back to the colour the picker opened with.
@@ -16,7 +17,7 @@ use crate::widgets::{open_popup, popup_is_open, pressed_outside, select_all};
 /// user picks a colour.
 pub fn srgb_color_button(ui: &mut Ui, c: &mut [f32; 3]) -> Response {
     let (rect, mut resp) = ui.allocate_exact_size(ui.spacing().interact_size, Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::ColorButton, ui.is_enabled(), srgb_hex(*c)));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ColorWell, ui.is_enabled(), srgb_hex(*c)));
     let stroke = if resp.hovered() { ui.visuals().widgets.hovered.fg_stroke } else { ui.visuals().widgets.inactive.bg_stroke };
     ui.painter().rect_filled(rect, 2.0, srgb32(*c));
     ui.painter().rect_stroke(rect, 2.0, stroke, StrokeKind::Inside);
@@ -30,35 +31,55 @@ pub fn srgb_color_button(ui: &mut Ui, c: &mut [f32; 3]) -> Response {
 }
 
 /// The colour picker as a popup at `pos`, bound to `c`, opened with [`open_popup`]. Returns true
-/// when the colour changed (Cancel, Escape and the original swatch change it back).
+/// when the colour changed (Cancel, Escape and the original swatch change it back; the eyedropper
+/// changes it to the colour it samples).
 pub fn color_popup(ui: &mut Ui, id: egui::Id, pos: egui::Pos2, c: &mut [f32; 3]) -> bool {
     if !popup_is_open(ui, id) {
         return false;
     }
     let orig_id = id.with("original");
     let original = ui.data_mut(|d| *d.get_temp_mut_or_insert_with(orig_id, || *c));
+    // Read before a sample is taken: the press that samples the viewer lands outside the picker, and
+    // must not close it.
+    let armed = armed_for(ui.ctx(), id);
+    let mut sampled = false;
+    if let Some(rgb) = take_sample(ui.ctx(), id)
+        && rgb != *c
+    {
+        *c = rgb;
+        sampled = true;
+    }
     let mut out = Outcome::default();
     let area = egui::Area::new(id.with("area")).order(egui::Order::Foreground).fixed_pos(pos + vec2(0.0, 4.0)).show(ui.ctx(), |ui| {
         egui::Frame::popup(ui.style()).show(ui, |ui| out = color_picker(ui, id, c, original));
     });
-    // Escape is the picker's: consume it, so nothing later this pass takes it too.
+    // Escape is the picker's: consume it, so nothing later this pass takes it too. While the
+    // eyedropper is armed, Escape cancels it and the picker stays open.
     if ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
-        out.close = Some(false);
+        if armed {
+            disarm(ui.ctx(), id);
+        } else {
+            out.close = Some(false);
+        }
     }
+    // A press outside closes the picker, unless it is the armed eyedropper's press on the viewer.
+    let on_viewer = armed && eyedropper_point(ui.ctx()).is_some();
     // A press in the pass that first draws the picker must not close it: an Area's rect is only
     // at its requested position from its second pass on (the first pass reports it at the
     // origin), so the click that just opened the picker would be read as a press outside it and
     // the picker would flash and close in that one frame (#1476).
     let pass_id = id.with("open-pass");
     let drawn_before = ui.data(|d| d.get_temp::<u64>(pass_id)).is_some_and(|p| p < ui.ctx().cumulative_pass_nr());
-    if drawn_before && pressed_outside(ui.ctx(), &area.response) {
+    if drawn_before && pressed_outside(ui.ctx(), &area.response) && !on_viewer {
         out.close.get_or_insert(true);
     }
+    note_overlay(ui.ctx(), area.response.rect);
     if let Some(keep) = out.close {
         if !keep && *c != original {
             *c = original;
             out.changed = true;
         }
+        disarm(ui.ctx(), id);
         ui.data_mut(|d| {
             d.insert_temp(id.with("open"), false);
             d.remove::<[f32; 3]>(orig_id);
@@ -67,6 +88,7 @@ pub fn color_popup(ui: &mut Ui, id: egui::Id, pos: egui::Pos2, c: &mut [f32; 3])
             d.remove::<u64>(open_pass_id());
         });
     } else {
+        refresh_armed(ui.ctx(), id);
         // Still open after this pass: dialogs leave Escape to the picker (see `open_recently`).
         let pass = ui.ctx().cumulative_pass_nr();
         ui.data_mut(|d| {
@@ -74,11 +96,13 @@ pub fn color_popup(ui: &mut Ui, id: egui::Id, pos: egui::Pos2, c: &mut [f32; 3])
             d.insert_temp(open_pass_id(), pass);
         });
     }
-    out.changed
+    out.changed || sampled
 }
 
+/// The `egui::Id` of the pass number in which a colour picker last stayed open, which
+/// [`open_recently`] uses to keep Escape for the picker rather than the dialog under it.
 fn open_pass_id() -> egui::Id {
-    egui::Id::new("color-picker-open-pass")
+    egui::Id::unique("color-picker-open-pass")
 }
 
 /// A colour picker is open: it was drawn, and stayed open, in this pass or the last one (so one
@@ -90,6 +114,196 @@ pub fn open_recently(ctx: &egui::Context) -> bool {
     pass.is_some_and(|p| p.saturating_add(1) >= ctx.cumulative_pass_nr())
 }
 
+/// The armed eyedropper of a picker: the picker's popup id, the pass it was last drawn in, and the
+/// colour the viewer sampled for it, if one is waiting for the picker's next draw. It lives in the
+/// egui context, since the viewer that samples has no picker in hand.
+#[derive(Clone, Copy)]
+struct Armed {
+    popup: egui::Id,
+    pass: u64,
+    sample: Option<[f32; 3]>,
+    dialog: Option<crate::Dialog>,
+}
+
+fn armed_key() -> egui::Id {
+    egui::Id::unique("color-picker-eyedropper")
+}
+
+fn dialog_key() -> egui::Id {
+    egui::Id::unique("color-picker-dialog")
+}
+
+/// Record the modal before drawing the viewer. A picker may sample behind its own dialog, but
+/// a new, unrelated modal must block it from its very first pass, before its rect is known.
+pub(crate) fn note_dialog(ctx: &egui::Context, dialog: Option<crate::Dialog>) {
+    ctx.data_mut(|data| data.insert_temp(dialog_key(), dialog));
+}
+
+fn current_dialog(ctx: &egui::Context) -> Option<crate::Dialog> {
+    ctx.data(|data| data.get_temp::<Option<crate::Dialog>>(dialog_key())).flatten()
+}
+
+/// The armed eyedropper, if its picker was drawn in this pass or the last: one whose picker stops
+/// being drawn (its dialog gone) lapses.
+fn armed_record(ctx: &egui::Context) -> Option<Armed> {
+    let armed: Option<Armed> = ctx.data(|d| d.get_temp(armed_key()));
+    let pass = ctx.cumulative_pass_nr();
+    armed.filter(|a| a.pass.saturating_add(1) >= pass)
+}
+
+fn armed_for(ctx: &egui::Context, popup: egui::Id) -> bool {
+    armed_record(ctx).is_some_and(|a| a.popup == popup)
+}
+
+/// Some picker's eyedropper is armed: a press on the Composition viewer samples the frame for it.
+pub fn eyedropper_armed(ctx: &egui::Context) -> bool {
+    armed_record(ctx).is_some()
+}
+
+fn arm(ctx: &egui::Context, popup: egui::Id) {
+    let pass = ctx.cumulative_pass_nr();
+    let dialog = current_dialog(ctx);
+    ctx.data_mut(|d| d.insert_temp(armed_key(), Armed { popup, pass, sample: None, dialog }));
+}
+
+fn disarm(ctx: &egui::Context, popup: egui::Id) {
+    let armed: Option<Armed> = ctx.data(|d| d.get_temp(armed_key()));
+    if armed.is_some_and(|a| a.popup == popup) {
+        ctx.data_mut(|d| d.remove::<Armed>(armed_key()));
+    }
+}
+
+/// Keeps `popup`'s eyedropper armed while its picker is drawn.
+fn refresh_armed(ctx: &egui::Context, popup: egui::Id) {
+    if let Some(armed) = armed_record(ctx).filter(|a| a.popup == popup) {
+        let pass = ctx.cumulative_pass_nr();
+        ctx.data_mut(|d| d.insert_temp(armed_key(), Armed { pass, ..armed }));
+    }
+}
+
+/// The colour the viewer sampled for `popup`, once: taking it disarms the eyedropper.
+fn take_sample(ctx: &egui::Context, popup: egui::Id) -> Option<[f32; 3]> {
+    let armed = armed_record(ctx).filter(|a| a.popup == popup)?;
+    let sample = armed.sample?;
+    disarm(ctx, popup);
+    Some(sample)
+}
+
+/// The viewer sampled `rgb` for the armed picker, which takes it on its next draw.
+pub fn deliver_sample(ctx: &egui::Context, rgb: [f32; 3]) {
+    if let Some(armed) = armed_record(ctx) {
+        ctx.data_mut(|d| d.insert_temp(armed_key(), Armed { sample: Some(rgb), ..armed }));
+        ctx.request_repaint();
+    }
+}
+
+fn viewer_key() -> egui::Id {
+    egui::Id::unique("color-picker-viewer")
+}
+
+/// The Composition viewer's rect as it was drawn this pass: where an armed eyedropper samples.
+pub fn note_viewer(ctx: &egui::Context, rect: Rect) {
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data_mut(|d| d.insert_temp(viewer_key(), (pass, rect)));
+}
+
+fn overlay_key() -> egui::Id {
+    egui::Id::unique("color-picker-overlays")
+}
+
+/// A popup or dialog drawn over the viewer: a press inside `rect` is not a sample.
+pub fn note_overlay(ctx: &egui::Context, rect: Rect) {
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data_mut(|d| {
+        // This pass's and the last's: the viewer may be drawn before an overlay in a pass.
+        let mut rects = d.get_temp::<Vec<(u64, Rect)>>(overlay_key()).unwrap_or_default();
+        rects.retain(|(p, _)| p.saturating_add(1) >= pass);
+        rects.push((pass, rect));
+        d.insert_temp(overlay_key(), rects);
+    });
+}
+
+/// Whether `pos` is over a popup or dialog drawn this pass or the last.
+fn overlaid(ctx: &egui::Context, pos: egui::Pos2) -> bool {
+    let pass = ctx.cumulative_pass_nr();
+    let rects: Option<Vec<(u64, Rect)>> = ctx.data(|d| d.get_temp(overlay_key()));
+    rects.unwrap_or_default().iter().any(|(p, r)| p.saturating_add(1) >= pass && r.contains(pos))
+}
+
+/// Where an armed eyedropper samples: the pointer, if it is over the viewer and not over a popup or
+/// dialog. The pointer is read rather than the viewer's responses, since a modal dialog over the
+/// viewer takes its clicks.
+pub fn eyedropper_point(ctx: &egui::Context) -> Option<egui::Pos2> {
+    if armed_record(ctx).is_some_and(|armed| armed.dialog != current_dialog(ctx)) {
+        return None;
+    }
+    let viewer: Option<(u64, Rect)> = ctx.data(|d| d.get_temp(viewer_key()));
+    let viewer = viewer.filter(|(p, _)| p.saturating_add(1) >= ctx.cumulative_pass_nr())?.1;
+    let pos = ctx.input(|i| i.pointer.interact_pos())?;
+    (viewer.contains(pos) && !overlaid(ctx, pos)).then_some(pos)
+}
+
+/// The press that samples for an armed eyedropper this frame, if there is one.
+pub fn sample_press(ctx: &egui::Context) -> Option<egui::Pos2> {
+    if ctx.input(|i| i.pointer.primary_pressed()) { eyedropper_point(ctx) } else { None }
+}
+
+fn automation_key() -> egui::Id {
+    egui::Id::unique("color-picker-eyedropper-rect")
+}
+
+/// The eyedropper's rect, for the automation registry; [`take_automation`] hands it over.
+fn note_automation(ctx: &egui::Context, rect: Rect) {
+    ctx.data_mut(|d| d.insert_temp(automation_key(), rect));
+}
+
+/// The eyedropper rect the last picker drawing noted, once. Pickers have no registry in hand, so the
+/// app registers it each frame.
+pub fn take_automation(ctx: &egui::Context) -> Option<Rect> {
+    ctx.data_mut(|d| {
+        let rect = d.get_temp::<Rect>(automation_key());
+        d.remove::<Rect>(automation_key());
+        rect
+    })
+}
+
+/// The eyedropper of the hex row. A press arms it, or disarms it while armed; the next press on the
+/// Composition viewer then samples the colour under the pointer into this picker.
+fn eyedropper(ui: &mut Ui, popup: egui::Id) {
+    let armed = armed_for(ui.ctx(), popup);
+    let (rect, resp) = ui.allocate_exact_size(vec2(18.0, 18.0), Sense::click());
+    let resp = resp.on_hover_text(tr("Eyedropper: click, then click in the Composition panel"));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, resp.enabled(), "Eyedropper"));
+    let fill = if armed {
+        ui.visuals().selection.bg_fill
+    } else if resp.hovered() {
+        ui.visuals().widgets.hovered.bg_fill
+    } else {
+        Color32::TRANSPARENT
+    };
+    ui.painter().rect_filled(rect, 2.0, fill);
+    let col = if armed { ui.visuals().selection.stroke.color } else { ui.visuals().strong_text_color() };
+    draw_pipette(ui.painter(), rect, col);
+    if resp.clicked() {
+        if armed {
+            disarm(ui.ctx(), popup);
+        } else {
+            arm(ui.ctx(), popup);
+        }
+    }
+    note_automation(ui.ctx(), rect);
+}
+
+/// A pipette: a diagonal glass tube with a bulb at the top right and a tip at the bottom left, drawn
+/// within `rect`.
+pub fn draw_pipette(p: &egui::Painter, rect: Rect, col: Color32) {
+    let r = rect.shrink(rect.width() * 0.2);
+    let at = |x: f32, y: f32| pos2(r.min.x + x * r.width(), r.min.y + y * r.height());
+    p.line_segment([at(0.08, 0.92), at(0.62, 0.38)], Stroke::new(2.2, col));
+    p.circle_filled(at(0.76, 0.24), r.width() * 0.2, col);
+    p.line_segment([at(0.5, 0.3), at(0.7, 0.5)], Stroke::new(1.4, col));
+}
+
 /// What the picker did this frame.
 #[derive(Default)]
 struct Outcome {
@@ -175,6 +389,12 @@ impl Pick {
 const SQUARE: f32 = 200.0;
 const SLIDER_W: f32 = 16.0;
 
+/// The colour picker popup's contents: saturation/value square, channel slider, number fields for
+/// H/S/B and R/G/B, a hex field and an original-colour swatch, plus OK and Cancel. `*c` is updated
+/// as the UI changes and `original` is what Cancel (or the swatch) restores. The chosen channel
+/// and the HSV/RGB pair are remembered in egui temp data so reopening keeps the hue when
+/// saturation or value reaches zero. Returns what the picker did this frame; it never runs a
+/// command itself.
 fn color_picker(ui: &mut Ui, id: egui::Id, c: &mut [f32; 3], original: [f32; 3]) -> Outcome {
     let state_id = id.with("pick");
     let mut pick = match ui.data(|d| d.get_temp::<([f32; 3], [f32; 3])>(state_id)) {
@@ -183,7 +403,7 @@ fn color_picker(ui: &mut Ui, id: egui::Id, c: &mut [f32; 3], original: [f32; 3])
         None => Pick { hsv: rgb_to_hsv(*c), rgb: *c },
     };
     // The slider's channel is remembered between pickers, as After Effects does.
-    let chan_id = egui::Id::new("color-picker-channel");
+    let chan_id = egui::Id::unique("color-picker-channel");
     let mut chan = ui.data(|d| d.get_temp::<usize>(chan_id)).and_then(|i| CHANS.get(i).map(|c| c.0)).unwrap_or(Chan::H);
     let before = pick;
     let mut out = Outcome::default();
@@ -247,6 +467,7 @@ fn color_picker(ui: &mut Ui, id: egui::Id, c: &mut [f32; 3], original: [f32; 3])
                 if hex_field(ui, id.with("hex"), &mut rgb) {
                     pick = Pick { hsv: keep_hue(rgb_to_hsv(rgb), pick.hsv), rgb };
                 }
+                eyedropper(ui, id);
             });
         });
     });
@@ -268,7 +489,7 @@ const CHANS: [(Chan, &str); 6] = [(Chan::H, "H"), (Chan::S, "S"), (Chan::V, "B")
 /// Drag or click on the square to set its two channels.
 fn square(ui: &mut Ui, chan: Chan, pick: &mut Pick) {
     let (rect, resp) = ui.allocate_exact_size(vec2(SQUARE, SQUARE), Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Slider, true, "Color field"));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Slider, true, "Color field"));
     let (x, y) = chan.square();
     if let Some(p) = resp.interact_pointer_pos().filter(|_| resp.is_pointer_button_down_on()) {
         *pick = pick.at(chan, (p.x - rect.min.x) / rect.width(), 1.0 - (p.y - rect.min.y) / rect.height());
@@ -297,7 +518,7 @@ fn square(ui: &mut Ui, chan: Chan, pick: &mut Pick) {
 /// Drag or click on the slider to set `chan`; arrows on both sides mark its value.
 fn slider(ui: &mut Ui, chan: Chan, pick: &mut Pick) {
     let (outer, resp) = ui.allocate_exact_size(vec2(SLIDER_W + 12.0, SQUARE), Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Slider, true, "Color slider"));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Slider, true, "Color slider"));
     let bar = Rect::from_center_size(outer.center(), vec2(SLIDER_W, SQUARE));
     if let Some(p) = resp.interact_pointer_pos().filter(|_| resp.is_pointer_button_down_on()) {
         *pick = pick.set(chan, 1.0 - (p.y - bar.min.y) / bar.height());
@@ -332,10 +553,10 @@ fn slider(ui: &mut Ui, chan: Chan, pick: &mut Pick) {
 fn swatches(ui: &mut Ui, new: [f32; 3], original: [f32; 3]) -> bool {
     let (rect, _) = ui.allocate_exact_size(vec2(64.0, 64.0), Sense::hover());
     let (top, bottom) = rect.split_top_bottom_at_fraction(0.5);
-    let new_resp = ui.interact(top, ui.id().with("new-swatch"), Sense::hover());
-    new_resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, true, "New color"));
-    let old = ui.interact(bottom, ui.id().with("original-swatch"), Sense::click()).on_hover_text(tr("Original color: click to go back to it"));
-    old.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Original color"));
+    let new_resp = ui.interact(top, ui.scope_id().with("new-swatch"), Sense::hover());
+    new_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Unknown, true, "New color"));
+    let old = ui.interact(bottom, ui.scope_id().with("original-swatch"), Sense::click()).on_hover_text(tr("Original color: click to go back to it"));
+    old.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Original color"));
     ui.painter().rect_filled(top, 0.0, srgb32(new));
     ui.painter().rect_filled(bottom, 0.0, srgb32(original));
     ui.painter().rect_stroke(rect, 0.0, ui.visuals().widgets.inactive.bg_stroke, StrokeKind::Outside);
@@ -439,3 +660,214 @@ pub fn hsv_to_rgb([h, s, v]: [f32; 3]) -> [f32; 3] {
     };
     [f(5.0), f(3.0), f(1.0)]
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sampling_viewer() -> egui_kittest::Harness<'static, crate::EffectcraftApp> {
+        let mut session = effectcraft_engine::Session::default();
+        session.execute("comp.new", serde_json::json!({"width": 320, "height": 180, "duration": 2})).unwrap();
+        session.execute("layer.newSolid", serde_json::json!({"color": "#204060"})).unwrap();
+        let mut harness = egui_kittest::Harness::builder().with_size(vec2(1200.0, 800.0)).build_eframe(|_| crate::EffectcraftApp::new(session));
+        settle_sampling_viewer(&mut harness);
+        harness
+    }
+
+    fn settle_sampling_viewer(harness: &mut egui_kittest::Harness<'_, crate::EffectcraftApp>) {
+        for _ in 0..200 {
+            harness.step();
+            if harness.state().frames.inflight() == 0 && harness.state().viewer_image.is_some() {
+                harness.run_steps(3);
+                return;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        panic!("the synthetic viewer frame did not arrive");
+    }
+
+    fn press_sampling_viewer(harness: &mut egui_kittest::Harness<'_, crate::EffectcraftApp>) -> Option<[f32; 3]> {
+        let ctx = harness.ctx.clone();
+        arm(&ctx, egui::Id::unique("test-popup"));
+        let point = crate::panels::viewer::comp_to_screen(&ctx, [20.0, 20.0]).unwrap();
+        harness.event(egui::Event::PointerMoved(point));
+        harness.event(egui::Event::PointerButton { pos: point, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+        harness.step();
+        let sample = ctx.data(|data| data.get_temp::<Armed>(armed_key())).and_then(|armed| armed.sample);
+        harness.event(egui::Event::PointerButton { pos: point, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+        harness.step();
+        sample
+    }
+
+    #[test]
+    fn popup_eyedropper_samples_the_displayed_channel_and_exposure() {
+        let mut harness = sampling_viewer();
+        harness.state_mut().session.state.viewer.channel = effectcraft_engine::viewer::Channel::Green;
+        let green = press_sampling_viewer(&mut harness).unwrap();
+        assert!(green.iter().all(|value| (*value - 64.0 / 255.0).abs() < 0.01), "{green:?}");
+        let options = &mut harness.state_mut().session.state.viewer;
+        options.channel = effectcraft_engine::viewer::Channel::Rgb;
+        options.exposure = 1.0;
+        let exposed = press_sampling_viewer(&mut harness).unwrap();
+        let mut expected = [[32, 64, 96, 255]];
+        let encoding = effectcraft_engine::viewer::FrameEncoding::of(&harness.state().session.project.settings, false);
+        effectcraft_engine::viewer::DisplayPass::new(effectcraft_engine::viewer::Channel::Rgb, false, 1.0, encoding, None).apply_rgba8(&mut expected);
+        for (actual, expected) in exposed.iter().zip(expected[0]) {
+            assert!((*actual - expected as f32 / 255.0).abs() < 0.01, "{exposed:?}");
+        }
+    }
+
+    #[test]
+    fn popup_eyedropper_samples_snapshot_and_refuses_wireframe() {
+        let mut harness = sampling_viewer();
+        harness.state_mut().session.execute("view.takeSnapshot", serde_json::json!({})).unwrap();
+        harness.state_mut().session.execute("layer.newSolid", serde_json::json!({"color": "#a0b0c0"})).unwrap();
+        settle_sampling_viewer(&mut harness);
+        harness.event(egui::Event::Key { key: egui::Key::F5, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE });
+        // Let the snapshot texture's discard passes finish before arming this synthetic picker.
+        harness.step();
+        let snapshot = press_sampling_viewer(&mut harness).unwrap();
+        for (actual, expected) in snapshot.iter().zip([32, 64, 96]) {
+            assert!((*actual - expected as f32 / 255.0).abs() < 0.01, "{snapshot:?}");
+        }
+        let options = &mut harness.state_mut().session.state.viewer;
+        options.show_snapshot = false;
+        options.fast_previews = effectcraft_engine::commands::viewer_cmds::FastPreviews::Wireframe;
+        harness.event(egui::Event::Key { key: egui::Key::F5, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE });
+        assert_eq!(press_sampling_viewer(&mut harness), None, "wireframe must not sample an old pixel frame");
+    }
+
+    /// A 32 bpc project whose solid is about 4.0 in linear light (white +2 stops), in half-float viewer
+    /// frames; `hdr`: Project Settings ▸ HDR (with an sRGB working space).
+    fn hdr_viewer(hdr: &str) -> egui_kittest::Harness<'static, crate::EffectcraftApp> {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", serde_json::json!({"width": 320, "height": 180, "duration": 2})).unwrap();
+        s.execute("file.projectSettings", serde_json::json!({"bitDepth": 32, "workingSpace": "srgb", "hdr": hdr})).unwrap();
+        let lid = s.execute("layer.newSolid", serde_json::json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("effect.apply", serde_json::json!({"layers": [lid], "effect": "Exposure"})).unwrap();
+        s.execute("prop.set", serde_json::json!({"layer": lid, "path": "effects/#1/master/exposure", "value": 2.0})).unwrap();
+        let mut harness = egui_kittest::Harness::builder().with_size(vec2(1200.0, 800.0)).build_eframe(|_| crate::EffectcraftApp::new(s));
+        for _ in 0..400 {
+            harness.step();
+            if harness.state().frames.inflight() == 0 && harness.state().viewer_f16.is_some() {
+                harness.run_steps(3);
+                return harness;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        panic!("the half-float viewer frame did not arrive");
+    }
+
+    /// The linear light of the frame's first pixel (sRGB-encoded).
+    fn linear_of(harness: &egui_kittest::Harness<'_, crate::EffectcraftApp>) -> f32 {
+        let p = harness.state().viewer_f16.as_ref().unwrap().pixel(0).unwrap();
+        effectcraft_engine::color::srgb_to_linear(p[0] / p[3])
+    }
+
+    fn exposed(harness: &mut egui_kittest::Harness<'_, crate::EffectcraftApp>, stops: f32) -> f32 {
+        harness.state_mut().session.state.viewer.exposure = stops;
+        harness.run_steps(2);
+        press_sampling_viewer(harness).unwrap()[0]
+    }
+
+    /// #2797: in 32 bpc the viewer's exposure reaches values above 1.0. White +2 stops (about 4.0)
+    /// is white at 0 EV and still white at -2 EV (the 8-bit viewer showed 0.25 there), and at -3 EV
+    /// it is an eighth of its linear light.
+    #[test]
+    fn viewer_exposure_reaches_over_range_values_in_32_bpc() {
+        let mut harness = hdr_viewer("clip");
+        let l = linear_of(&harness);
+        assert!(l > 3.9, "the frame keeps the over-range value: {l}");
+        let srgb = |l: f32| effectcraft_engine::color::linear_to_srgb(l);
+        assert!((exposed(&mut harness, 0.0) - 1.0).abs() < 0.01);
+        assert!((exposed(&mut harness, -2.0) - 1.0).abs() < 0.01, "-2 EV");
+        let v = exposed(&mut harness, -3.0);
+        assert!((v - srgb(l / 8.0)).abs() < 0.01 && v < 0.8, "-3 EV: {v}");
+        // The 8-bit image other panels read: as rendered (clipped), without the exposure.
+        let img = harness.state_mut().viewer_pixels().unwrap();
+        assert_eq!(img.pixels[0].to_array(), [255, 255, 255, 255]);
+        // A 32 bpc snapshot keeps the range too.
+        harness.state_mut().session.execute("view.takeSnapshot", serde_json::json!({})).unwrap();
+        harness.state_mut().session.state.viewer.show_snapshot = true;
+        let v = exposed(&mut harness, -3.0);
+        assert!((v - srgb(l / 8.0)).abs() < 0.01, "snapshot at -3 EV: {v}");
+    }
+
+    /// Compand runs after the exposure: at -3 EV the 4.0 white is about 0.5, under the knee, so it
+    /// shows as that (companding first left 0.99, darkened to 0.12). At 0 EV it is companded as
+    /// before.
+    #[test]
+    fn compand_follows_the_viewer_exposure() {
+        let mut harness = hdr_viewer("compand");
+        assert_eq!(harness.state().viewer_f16.as_ref().unwrap().encoding.hdr, effectcraft_engine::project::HdrMode::Compand);
+        let srgb = |l: f32| effectcraft_engine::color::linear_to_srgb(l);
+        let l = linear_of(&harness);
+        let at0 = exposed(&mut harness, 0.0);
+        let want = srgb(effectcraft_engine::render::color::compand(l));
+        assert!((at0 - want).abs() < 0.01, "0 EV: {at0} vs {want}");
+        let v = exposed(&mut harness, -3.0);
+        assert!((v - srgb(l / 8.0)).abs() < 0.01 && v < 0.8, "-3 EV: {v}");
+        // Other panels' 8-bit image is the companded frame, as the render was.
+        let img = harness.state_mut().viewer_pixels().unwrap();
+        assert!((img.pixels[0].r() as f32 / 255.0 - want).abs() < 0.01);
+        // A passive viewer gets the half-float frame through the same pass (no channel or exposure
+        // of its own; on the CPU without a device): the companded frame.
+        let ctx = harness.ctx.clone();
+        let (key, f) = (harness.state().viewer_shown.unwrap().1, harness.state().viewer_f16.clone().unwrap());
+        crate::panels::viewers::set_texture(harness.state_mut(), &ctx, 7, key, crate::frames::FrameImage::CpuF16(f), None, 0);
+        let Some((_, crate::panels::viewers::PassiveTexture::Cpu(tex))) = harness.state().passive_tex.get(&7) else { panic!("no passive texture") };
+        assert_eq!(tex.size(), [320, 180]);
+        let f = harness.state().viewer_f16.clone().unwrap();
+        let crate::frames::FrameImage::Cpu(shown) = crate::panels::viewers::cpu_passive_image(harness.state(), crate::frames::FrameImage::CpuF16(f), None)
+        else {
+            panic!("an 8-bit image")
+        };
+        assert!((shown.pixels[0].r() as f32 / 255.0 - want).abs() < 0.01, "the passive viewer shows the companded frame: {:?}", shown.pixels[0]);
+    }
+
+    #[test]
+    fn a_new_modal_backdrop_cannot_deliver_a_pending_sample() {
+        let mut harness = sampling_viewer();
+        harness.state_mut().dialog = Some(crate::Dialog::About);
+        assert_eq!(press_sampling_viewer(&mut harness), None, "the first modal pass must already exclude its backdrop");
+    }
+
+    #[test]
+    fn a_picker_can_sample_behind_its_own_dialog_but_not_a_new_modal() {
+        let ctx = egui::Context::default();
+        let point = pos2(20.0, 20.0);
+        let mut output = ctx.run_ui(egui::RawInput { events: vec![egui::Event::PointerMoved(point)], ..Default::default() }, |ui| {
+            let ctx = ui.ctx();
+            note_dialog(ctx, Some(crate::Dialog::SolidSettings));
+            note_viewer(ctx, Rect::from_min_size(pos2(0.0, 0.0), vec2(320.0, 180.0)));
+            note_overlay(ctx, Rect::from_min_size(pos2(100.0, 100.0), vec2(120.0, 80.0)));
+            arm(ctx, egui::Id::unique("test-picker"));
+            assert_eq!(eyedropper_point(ctx), Some(point));
+            note_dialog(ctx, Some(crate::Dialog::About));
+            assert_eq!(eyedropper_point(ctx), None);
+        });
+        output.textures_delta.clear();
+    }
+
+    #[test]
+    fn armed_eyedropper_takes_one_sample_then_disarms() {
+        let ctx = egui::Context::default();
+        let popup = egui::Id::unique("test-picker");
+        arm(&ctx, popup);
+        assert!(eyedropper_armed(&ctx));
+        assert_eq!(take_sample(&ctx, popup), None);
+        deliver_sample(&ctx, [0.1, 0.2, 0.3]);
+        assert_eq!(take_sample(&ctx, popup), Some([0.1, 0.2, 0.3]));
+        assert!(!eyedropper_armed(&ctx));
+        assert_eq!(take_sample(&ctx, popup), None);
+    }
+
+    #[test]
+    fn points_over_a_dialog_are_not_samples() {
+        let ctx = egui::Context::default();
+        let dialog = Rect::from_min_size(pos2(100.0, 100.0), vec2(120.0, 80.0));
+        note_overlay(&ctx, dialog);
+        assert!(overlaid(&ctx, pos2(150.0, 150.0)));
+        assert!(!overlaid(&ctx, pos2(20.0, 20.0)));
+    }
+}
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 15493ad79..f7aecdfcb 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -9,18 +9,19 @@
 //! - `ui.inspect`: UI state + summary; `ui.elements {prefix?}`: registered widgets (id, label, rect)
 //! - `ui.set {tool?, workspace?, theme?, focused?, viewer?: {zoom, res, pan, grid, …}, timeline?: {pps, start, graphEditor, showModes}}`
 //! - `ui.panel.show {panel}` / `ui.panel.close {panel}`
-//! - `ui.click {id | x,y, button?, count?, modifiers?}` / `ui.move {x,y}` / `ui.scroll {x,y,dx,dy}`
+//! - `ui.click {id | x,y, button?, count?, modifiers?}` / `ui.move {x,y}` / `ui.scroll {x,y,dx,dy,unit?,source?,pinch?}`
 //! - `ui.drag {from:{id|x,y}, to:{id|x,y}, steps?, modifiers?}`: synthetic press-move-release
 //! - `ui.key {key, command?, shift?, alt?, ctrl?}` / `ui.type {text}`
 //! - `ui.viewer.locate {x, y}`: screen point of a comp pixel; `ui.viewer.hit {x, y}`: comp pixel at a screen point
 //! - `ui.timeline.locate {layer, time?}`: screen point of a layer bar (at a comp time)
 //! - `ui.playback {action: play|stop|toggle}`
-//! - `ui.screenshot {path?, panel?, id?}`: PNG of the window (or one panel / element)
+//! - `ui.screenshot {path?, panel?, id?}`: PNG of the window (or one panel / element, resolved when the capture is issued)
 //! - `render.frame {comp?, time?, max_side?, path?, base64?}`: PNG of a comp frame rendered by the session
 //! - `ui.resize {width, height}` / `ui.focus` / `app.quit {force?}` (a modified project asks to save first unless `force`)
 //!
 //! The full reference with examples is `docs/control-protocol.md`.
 
+use std::sync::Arc;
 use std::sync::mpsc::Sender;
 
 use serde_json::{Value, json};
@@ -39,6 +40,8 @@ pub struct ControlRequest {
 }
 
 impl ControlRequest {
+    /// Creates a request for `method` with `params`, returning it with the channel that will
+    /// receive the UI thread's reply.
     pub fn new(method: impl Into<String>, params: Value) -> (Self, std::sync::mpsc::Receiver<Value>) {
         let (tx, rx) = std::sync::mpsc::channel();
         (Self { method: method.into(), params, reply: tx }, rx)
@@ -53,10 +56,13 @@ pub enum Outcome {
     AfterInput,
     Screenshot {
         path: Option<String>,
-        crop: Option<[f32; 4]>,
+        /// The panel/element identity to capture, resolved again when the capture is issued.
+        target: crate::ShotTarget,
     },
     /// Reply once background jobs end (a `wait: true` command whose job runs in a worker).
     AwaitJobs(JobWaiter),
+    /// A script yielded its session for rendering; reply after its continuation returns.
+    AwaitScript(u32),
 }
 
 /// A `wait: true` engine command whose job was sent to the session's offload (the browser's
@@ -70,6 +76,8 @@ pub struct JobWaiter {
     pub jobs: Vec<String>,
     /// Absolute completion-log position when it started (including evicted entries).
     pub log_cursor: usize,
+    /// The exact native render, not the reusable `jobs.list` identifier.
+    pub render: Option<Arc<effectcraft_engine::render_queue::JobShared>>,
 }
 
 /// Commands that block with `wait` (and its default).
@@ -78,34 +86,74 @@ fn waits(command: &str, params: &Value) -> bool {
     params.get("wait").and_then(Value::as_bool).unwrap_or(default)
 }
 
-/// Run an engine command. A waiting command (`wait: true`) whose job the session offloads
-/// runs with `wait: false` instead, and the reply waits for the job ([`Outcome::AwaitJobs`]),
-/// so the browser's UI keeps drawing while it runs.
+/// Run an engine command. A waiting offloaded command or native render runs with `wait: false`
+/// instead, and the reply waits for the job ([`Outcome::AwaitJobs`]), keeping the UI responsive.
 fn execute_engine(app: &mut EffectcraftApp, id: &str, params: Value) -> Result<Outcome, String> {
-    if !app.session.offloads() || !waits(id, &params) {
-        return app.session.execute_checked(id, params).map(ok).map_err(|e| e.to_string());
+    if !(app.session.offloads() || (cfg!(not(target_arch = "wasm32")) && id == "renderQueue.render")) || !waits(id, &params) {
+        let result = app.session.execute_checked(id, params);
+        return result.map(script_outcome).map_err(|e| e.to_string());
     }
     let before: Vec<String> = app.session.jobs().into_iter().map(|j| j.id).collect();
     let log_cursor = app.session.offload_log_start.saturating_add(app.session.offload_log.len());
     let mut p = params.clone();
-    p["wait"] = json!(false);
+    p.as_object_mut().ok_or("command params must be an object")?.insert("wait".into(), json!(false));
     let result = app.session.execute_checked(id, p).map_err(|e| e.to_string())?;
     let jobs: Vec<String> = app.session.jobs().into_iter().map(|j| j.id).filter(|j| !before.contains(j)).collect();
-    if jobs.is_empty() {
-        return Ok(ok(result));
+    let render = if cfg!(not(target_arch = "wasm32")) && id == "renderQueue.render" && !app.session.offloads() {
+        app.session.render_job.as_ref().map(|job| {
+            job.shared.retain_reply_items(result["items"].as_array().cloned().unwrap_or_default());
+            job.shared.clone()
+        })
+    } else {
+        None
+    };
+    Ok(JobWaiter { command: id.to_string(), params, result, jobs, log_cursor, render }.into_outcome())
+}
+
+fn script_outcome(result: Value) -> Outcome {
+    match result.get("renderHost").and_then(Value::as_u64).and_then(|id| u32::try_from(id).ok()) {
+        Some(host) => Outcome::AwaitScript(host),
+        None => ok(result),
+    }
+}
+
+/// Suspended scripts retain open undo groups. Let the UI inspect and stop the render, but
+/// never fold an unrelated edit, another script or a project replacement into that group.
+pub(crate) fn check_script_render(app: &EffectcraftApp, id: &str) -> Result<(), String> {
+    if app.session.script_ui.render_host.is_some() && !effectcraft_engine::scriptui::allowed_during_render(id) {
+        Err(effectcraft_engine::scriptui::RENDER_WAIT_MESSAGE.into())
+    } else {
+        Ok(())
     }
-    Ok(Outcome::AwaitJobs(JobWaiter { command: id.to_string(), params, result, jobs, log_cursor }))
 }
 
 impl JobWaiter {
+    fn into_outcome(self) -> Outcome {
+        // A finished but unpolled native worker still needs its completion boundary even
+        // when jobs() no longer lists it. Already-polled commands have their final result.
+        if self.jobs.is_empty() && self.render.is_none() { ok(self.result) } else { Outcome::AwaitJobs(self) }
+    }
+
     /// Whether its jobs are still running.
     pub fn pending(&self, app: &EffectcraftApp) -> bool {
+        if let Some(render) = &self.render {
+            return !render.reply_finished() && app.session.render_job.as_ref().is_some_and(|job| Arc::ptr_eq(render, &job.shared));
+        }
         app.session.jobs().iter().any(|j| self.jobs.contains(&j.id))
     }
 
     /// The reply: what the blocking command would have returned (`running: false`, the final
     /// progress, render items and analysis status), or the job's error.
     pub fn finish(self, app: &mut EffectcraftApp) -> Value {
+        if let Some(render) = self.render {
+            let Some(items) = render.completed_items() else {
+                return json!({"ok": false, "error": "render result unavailable: the project or render job was replaced before completion"});
+            };
+            let mut result = self.result;
+            result["items"] = json!(items);
+            result["rendering"] = json!(false);
+            return json!({"ok": true, "result": result});
+        }
         let s = &mut app.session;
         s.poll_render();
         let error = s
@@ -169,309 +217,536 @@ fn point(app: &EffectcraftApp, p: &Value) -> Result<egui::Pos2, String> {
     Ok(egui::pos2(x as f32, y as f32))
 }
 
-pub fn handle(app: &mut EffectcraftApp, ctx: &egui::Context, req: &ControlRequest) -> Outcome {
+/// Dispatches one control request on the UI thread. Replies are `{"ok": true, "result": …}`
+/// or `{"ok": false, "error": …}`; an unknown method is an error. Some methods answer with
+/// [`Outcome::Retry`], [`Outcome::AfterInput`], [`Outcome::Screenshot`] or
+/// [`Outcome::AwaitJobs`] instead of replying in this call.
+pub fn handle(app: &mut EffectcraftApp, ctx: &egui::Context, req: &ControlRequest, now: f64) -> Outcome {
     let p = &req.params;
-    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    if app.session.script_ui.render_host.is_some()
+        && !matches!(
+            req.method.as_str(),
+            "engine.execute" | "ui.menu.invoke" | "engine.commands" | "ui.menu.list" | "ui.inspect" | "ui.elements" | "ui.resize" | "ui.focus"
+        )
+    {
+        return err(effectcraft_engine::scriptui::RENDER_WAIT_MESSAGE);
+    }
     match req.method.as_str() {
-        "engine.execute" | "ui.menu.invoke" => {
-            let Some(id) = s("command").or(s("id")) else { return err("missing `command`") };
-            let params = p.get("params").cloned().filter(|v| !v.is_null()).unwrap_or(json!({}));
-            // `engine.execute` runs engine commands exactly as headless (never opens a dialog, e.g.
-            // `comp.new {}` creates a default comp); UI-only ids (`tool.*`, `view.*`, `window.*`,
-            // `playback.*` …) and `ui.menu.invoke` go through the menu dispatcher like a click.
-            let r = if req.method == "engine.execute" && effectcraft_engine::find_command(id).is_some() {
-                execute_engine(app, id, params)
-            } else {
-                crate::menus::invoke(app, ctx, id, params).map(ok)
-            };
-            match r {
-                Ok(o) => o,
-                Err(e) => {
-                    app.ui.status = e.clone();
-                    err(e)
-                }
-            }
-        }
-        "engine.commands" => match app.session.execute("command.list", json!({"filter": p.get("filter"), "enabledOnly": p.get("enabledOnly")})) {
-            Ok(v) => ok(v),
-            Err(e) => err(e),
-        },
+        "engine.execute" | "ui.menu.invoke" => execute_command(app, ctx, &req.method, p),
+        "engine.commands" => engine_commands(app, p),
         "ui.menu.list" => ok(serde_json::to_value(crate::menus::menu_items(app)).unwrap_or_default()),
         "ui.inspect" => ok(inspect(app, ctx)),
-        "ui.elements" => {
-            let prefix = s("prefix").unwrap_or("");
-            ok(serde_json::to_value(app.auto.query(prefix)).unwrap_or_default())
-        }
-        "ui.set" => {
-            if let Some(t) = s("tool") {
-                match Tool::from_name(t) {
-                    Some(t) => app.ui.tool = t,
-                    None => return err(format!("unknown tool `{t}`")),
-                }
-            }
-            if let Some(w) = s("workspace") {
-                match crate::dock::WORKSPACES.iter().find(|x| x.eq_ignore_ascii_case(w)) {
-                    Some(w) => app.set_workspace(w),
-                    None => return err(format!("unknown workspace `{w}`")),
-                }
-            }
-            if let Some(th) = s("theme") {
-                match crate::theme::ThemeKind::from_name(th) {
-                    Some(k) => app.set_theme(ctx, k),
-                    None => return err("unknown theme (dark, darker, light)"),
-                }
-            }
-            if let Some(f) = s("focused").and_then(PanelKind::from_name) {
-                app.ui.focused = f;
-            }
-            if let Some(v) = p.get("viewer") {
-                if let Some(z) = v.get("zoom") {
-                    app.ui.viewer.zoom = z.as_f64().map(|z| z as f32);
-                }
-                // The active comp's Resolution (`view.res.*`), saved with the project.
-                if let Some(r) = v.get("res").and_then(Value::as_str) {
-                    let Some(res) = Resolution::ALL.into_iter().find(|x| x.label().eq_ignore_ascii_case(r)) else {
-                        return err(format!("unknown resolution `{r}` (auto, full, half, third, quarter)"));
-                    };
-                    if let Some(cid) = app.session.active_comp_id()
-                        && let Err(e) = app.session.set_resolution(cid, res)
-                    {
-                        return err(e);
-                    }
-                }
-                if let Some(Value::Array(a)) = v.get("pan") {
-                    app.ui.viewer.pan = [a.first().and_then(Value::as_f64).unwrap_or(0.0) as f32, a.get(1).and_then(Value::as_f64).unwrap_or(0.0) as f32];
-                }
-                for (k, slot) in [
-                    ("grid", &mut app.ui.viewer.grid),
-                    ("rulers", &mut app.ui.viewer.rulers),
-                    ("safeMargins", &mut app.ui.viewer.safe_margins),
-                    ("transparencyGrid", &mut app.ui.viewer.transparency_grid),
-                ] {
-                    if let Some(b) = v.get(k).and_then(Value::as_bool) {
-                        *slot = b;
-                    }
-                }
-            }
-            if let Some(tl) = p.get("timeline") {
-                if let Some(v) = tl.get("pps") {
-                    app.ui.timeline.pps = v.as_f64();
-                }
-                if let Some(v) = tl.get("start").and_then(Value::as_f64) {
-                    app.ui.timeline.start = v;
-                }
-                if let Some(v) = tl.get("graphEditor").and_then(Value::as_bool) {
-                    app.ui.timeline.graph_editor = v;
-                }
-                if let Some(v) = tl.get("showModes").and_then(Value::as_bool) {
-                    app.ui.timeline.show_modes = v;
-                }
-                if let Some(Value::Array(a)) = tl.get("openLayers") {
-                    app.ui.timeline.open_layers = a.iter().filter_map(Value::as_u64).collect();
-                }
-                if let Some(Value::Array(a)) = tl.get("openGroups") {
-                    app.ui.timeline.open_groups = a.iter().filter_map(Value::as_u64).collect();
-                }
-            }
-            if let Some(b) = p.get("menuBar").and_then(Value::as_bool) {
-                app.ui.show_menu_bar = b;
-            }
-            // Project panel optional columns, e.g. ["type", "duration", "path", "comment"].
-            if let Some(Value::Array(a)) = p.get("projectColumns") {
-                let mut cols = vec![];
-                for k in a.iter().filter_map(Value::as_str) {
-                    crate::panels::project::set_column(&mut cols, k, true);
-                }
-                app.ui.project_columns = cols;
-            }
-            // Wiggler / Smoother / Motion Sketch settings (fields of `AnimToolsState`).
-            if let Some(Value::Object(m)) = p.get("animTools") {
-                let mut cur = serde_json::to_value(&app.ui.anim_tools).unwrap_or_default();
-                for (k, v) in m {
-                    cur[k] = v.clone();
-                }
-                match serde_json::from_value(cur) {
-                    Ok(v) => app.ui.anim_tools = v,
-                    Err(e) => return err(format!("animTools: {e}")),
-                }
-            }
-            if let Some(b) = p.get("home").and_then(Value::as_bool) {
-                app.ui.start_screen = b;
-            }
-            // Home screen tab: "home", "templates" or "learn".
-            if let Some(tab) = p.get("homeTab").and_then(Value::as_str) {
-                app.ui.home_learn = tab == "learn";
-                app.ui.home_templates = tab == "templates";
-            }
-            ok(Value::Null)
-        }
-        "ui.panel.show" | "ui.panel.close" => {
-            let Some(panel) = s("panel").and_then(PanelKind::from_name) else { return err("unknown `panel`") };
-            if req.method == "ui.panel.show" {
-                app.show_panel(panel);
-            } else {
-                app.ui.dock.close(panel);
-            }
-            ok(Value::Null)
-        }
-        "ui.click" | "ui.move" => {
-            let pos = match point(app, p) {
-                Ok(p) => p,
-                Err(e) if e.starts_with(RETRY) => return Outcome::Retry(e.trim_start_matches(RETRY).to_string()),
-                Err(e) => return err(e),
-            };
-            let m = modifiers(p);
-            // egui keeps the modifiers from `ModifiersChanged` (not the ones on a pointer event)
-            // and the synthetic events arrive one per frame: hold them for the whole gesture.
-            app.synthetic.push(egui::Event::ModifiersChanged(m));
-            app.synthetic.push(egui::Event::PointerMoved(pos));
-            if req.method == "ui.click" {
-                let button = match s("button") {
-                    Some("right") => egui::PointerButton::Secondary,
-                    Some("middle") => egui::PointerButton::Middle,
-                    _ => egui::PointerButton::Primary,
-                };
-                let count = p.get("count").and_then(Value::as_u64).unwrap_or(1);
-                for _ in 0..count {
-                    app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: true, modifiers: m });
-                    app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: false, modifiers: m });
-                }
-            }
-            app.synthetic.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
-            Outcome::AfterInput
-        }
-        "ui.drag" => {
-            let (Some(from), Some(to)) = (p.get("from"), p.get("to")) else { return err("need `from` and `to`") };
-            let (a, b) = match (point(app, from), point(app, to)) {
-                (Ok(a), Ok(b)) => (a, b),
-                (Err(e), _) | (_, Err(e)) if e.starts_with(RETRY) => return Outcome::Retry(e.trim_start_matches(RETRY).to_string()),
-                (Err(e), _) | (_, Err(e)) => return err(e),
-            };
-            let steps = p.get("steps").and_then(Value::as_u64).unwrap_or(12).max(2);
-            let m = modifiers(p);
-            app.synthetic.push(egui::Event::ModifiersChanged(m));
-            app.synthetic.push(egui::Event::PointerMoved(a));
-            app.synthetic.push(egui::Event::PointerButton { pos: a, button: egui::PointerButton::Primary, pressed: true, modifiers: m });
-            for i in 1..=steps {
-                let f = i as f32 / steps as f32;
-                app.synthetic.push(egui::Event::PointerMoved(a + (b - a) * f));
-            }
-            app.synthetic.push(egui::Event::PointerButton { pos: b, button: egui::PointerButton::Primary, pressed: false, modifiers: m });
-            app.synthetic.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
-            Outcome::AfterInput
-        }
-        "ui.scroll" => {
-            let pos = match point(app, p) {
-                Ok(p) => p,
-                Err(e) => return err(e),
-            };
-            let dx = p.get("dx").and_then(Value::as_f64).unwrap_or(0.0) as f32;
-            let dy = p.get("dy").and_then(Value::as_f64).unwrap_or(0.0) as f32;
-            app.synthetic.push(egui::Event::PointerMoved(pos));
-            app.synthetic.push(egui::Event::MouseWheel {
-                unit: egui::MouseWheelUnit::Point,
-                delta: egui::vec2(dx, dy),
-                modifiers: modifiers(p),
-                phase: egui::TouchPhase::Move,
-            });
-            app.synthetic.push(egui::Event::PointerButton {
-                pos: egui::pos2(-100.0, -100.0),
-                button: egui::PointerButton::Extra1,
-                pressed: false,
-                modifiers: Default::default(),
-            });
-            Outcome::AfterInput
-        }
-        "ui.key" => {
-            let Some(name) = s("key") else { return err("missing `key`") };
-            let Some((mut m, key)) = crate::menus::parse_shortcut(name) else { return err(format!("unknown key `{name}`")) };
-            let extra = modifiers(p);
-            m |= extra;
-            let physical_key = name.starts_with("Physical+").then_some(key);
-            app.synthetic.push(egui::Event::Key { key, physical_key, pressed: true, repeat: false, modifiers: m });
-            app.synthetic.push(egui::Event::Key { key, physical_key, pressed: false, repeat: false, modifiers: m });
-            Outcome::AfterInput
-        }
-        "ui.type" => {
-            let Some(text) = s("text") else { return err("missing `text`") };
-            app.synthetic.push(egui::Event::Text(text.to_string()));
-            app.synthetic.push(egui::Event::Key { key: egui::Key::F35, physical_key: None, pressed: false, repeat: false, modifiers: Default::default() });
-            Outcome::AfterInput
-        }
-        "ui.viewer.locate" => {
-            let (Some(x), Some(y)) = (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) else {
-                return err("need `x`, `y` (comp pixels)");
-            };
-            match crate::panels::viewer::comp_to_screen(ctx, [x as f32, y as f32]) {
-                Some(pt) => ok(json!({"x": pt.x, "y": pt.y})),
-                None => Outcome::Retry("the composition viewer is not visible".into()),
-            }
-        }
-        "ui.viewer.hit" => {
-            let pos = match point(app, p) {
-                Ok(p) => p,
-                Err(e) => return err(e),
-            };
-            match crate::panels::viewer::screen_to_comp(ctx, pos) {
-                Some(c) => ok(json!({"x": c[0], "y": c[1]})),
-                None => err("the composition viewer is not visible"),
-            }
-        }
-        "ui.timeline.locate" => {
-            let Some(l) = p.get("layer").and_then(Value::as_u64) else { return err("need `layer` (id)") };
-            match crate::panels::timeline::locate(app, l, p.get("time").and_then(Value::as_f64)) {
-                Some((x, y)) => ok(json!({"x": x, "y": y})),
-                None => Outcome::Retry("layer not visible in the timeline".into()),
-            }
-        }
-        "ui.playback" => {
-            let now = ctx.input(|i| i.time);
-            match s("action").unwrap_or("toggle") {
-                "play" => app.play(now),
-                "stop" => app.stop(),
-                "status" => {}
-                _ => app.toggle_play(now),
-            }
-            ok(
-                json!({"playing": app.playback.playing, "time": app.session.time().seconds(), "audio": app.audio.is_some(), "levelsDb": app.meter.level_db, "peaksDb": app.meter.peak_db}),
-            )
-        }
-        "ui.screenshot" => {
-            let crop = s("panel").and_then(PanelKind::from_name).and_then(|pk| app.auto.find(&format!("panel.{}", pk.id())).map(|e| e.rect));
-            let crop = crop.or_else(|| s("id").and_then(|id| app.auto.find(id).map(|e| e.rect)));
-            // Bring the window on screen so a frame is presented, without taking keyboard focus.
-            app.raise_for_control(ctx);
-            Outcome::Screenshot { path: s("path").map(str::to_string), crop }
-        }
+        "ui.elements" => elements(app, p),
+        "ui.set" => set_ui(app, ctx, p),
+        "ui.panel.show" | "ui.panel.close" => panel(app, &req.method, p),
+        "ui.click" | "ui.move" => click_or_move(app, &req.method, p),
+        "ui.drag" => drag(app, p),
+        "ui.scroll" => scroll(app, p),
+        "ui.key" => key(app, p),
+        "ui.type" => type_text(app, p),
+        "ui.viewer.locate" => viewer_locate(ctx, p),
+        "ui.viewer.hit" => viewer_hit(app, ctx, p),
+        "ui.timeline.locate" => timeline_locate(app, p),
+        "ui.playback" => playback(app, p, now),
+        "ui.screenshot" => screenshot(app, ctx, p),
         "render.frame" => render_frame(app, p),
-        "ui.resize" => {
-            let w = p.get("width").and_then(Value::as_f64).unwrap_or(1600.0) as f32;
-            let h = p.get("height").and_then(Value::as_f64).unwrap_or(1000.0) as f32;
-            ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(egui::vec2(w, h)));
-            ok(Value::Null)
-        }
-        "ui.focus" => {
-            // Explicit request: activate the app and take keyboard focus.
-            ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
-            ok(Value::Null)
-        }
-        "app.quit" => {
-            // A modified project asks to save first unless `force: true`.
-            if p.get("force").and_then(Value::as_bool).unwrap_or(false) {
-                app.dialog_state.unsaved.quitting = true;
-            }
-            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
-            ok(Value::Null)
-        }
+        "ui.resize" => resize(ctx, p),
+        "ui.focus" => focus(ctx),
+        "app.quit" => quit(app, ctx, p),
         m => err(format!("unknown method `{m}`")),
     }
 }
 
-/// `render.frame {comp?, time?, max_side?, path?, base64?}`: render a comp frame through the session
+/// Runs `engine.execute` or `ui.menu.invoke`. `engine.execute` with a known engine command id
+/// goes through [`execute_engine`] (so a `wait: true` job can be offloaded); every other id,
+/// and every `ui.menu.invoke`, goes through the menu dispatcher. A failure is copied to the
+/// status line.
+fn execute_command(app: &mut EffectcraftApp, ctx: &egui::Context, method: &str, p: &Value) -> Outcome {
+    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    let Some(id) = s("command").or(s("id")) else { return err("missing `command`") };
+    if let Err(e) = check_script_render(app, id) {
+        return err(e);
+    }
+    let params = p.get("params").cloned().filter(|v| !v.is_null()).unwrap_or(json!({}));
+    // Only this invocation opts in: CLI, lifecycle scripts and the inline console retain
+    // their synchronous contract. Its host remembers the opt-in across successive renders.
+    let previous = app.session.script_ui.yield_renders;
+    app.session.script_ui.yield_renders = cfg!(not(target_arch = "wasm32")) && id == "script.run";
+    // `engine.execute` runs engine commands exactly as headless (never opens a dialog, e.g.
+    // `comp.new {}` creates a default comp); UI-only ids (`tool.*`, `view.*`, `window.*`,
+    // `playback.*` …) and `ui.menu.invoke` go through the menu dispatcher like a click.
+    let r = if (method == "engine.execute" && effectcraft_engine::find_command(id).is_some())
+        || (id == "renderQueue.render" && params.get("wait").and_then(Value::as_bool) == Some(true))
+    {
+        execute_engine(app, id, params)
+    } else {
+        crate::menus::invoke(app, ctx, id, params).map(script_outcome)
+    };
+    app.session.script_ui.yield_renders = previous;
+    match r {
+        Ok(o) => o,
+        Err(e) => {
+            app.ui.status = e.clone();
+            err(e)
+        }
+    }
+}
+
+/// Replies with `command.list`'s result, forwarding `filter` and `enabledOnly`.
+fn engine_commands(app: &mut EffectcraftApp, p: &Value) -> Outcome {
+    match app.session.execute("command.list", json!({"filter": p.get("filter"), "enabledOnly": p.get("enabledOnly")})) {
+        Ok(v) => ok(v),
+        Err(e) => err(e),
+    }
+}
+
+/// Replies with the automation elements whose id starts with `prefix` (all when empty), as
+/// `{id, label, rect}` records.
+fn elements(app: &EffectcraftApp, p: &Value) -> Outcome {
+    let prefix = p.get("prefix").and_then(Value::as_str).unwrap_or("");
+    ok(serde_json::to_value(app.auto.query(prefix)).unwrap_or_default())
+}
+
+/// Explicit request: activate the app and take keyboard focus.
+fn focus(ctx: &egui::Context) -> Outcome {
+    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+    ok(Value::Null)
+}
+
+/// Applies `ui.set` in order: tool, workspace, theme, focused panel, viewer settings, then the
+/// layout fields ([`set_ui_layout`]). An unknown tool, workspace or theme name, or an invalid
+/// viewer value, replies with an error after the earlier fields were already applied.
+fn set_ui(app: &mut EffectcraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    if let Some(t) = s("tool") {
+        match Tool::from_name(t) {
+            Some(t) => app.ui.tool = t,
+            None => return err(format!("unknown tool `{t}`")),
+        }
+    }
+    if let Some(w) = s("workspace") {
+        match crate::dock::WORKSPACES.iter().find(|x| x.eq_ignore_ascii_case(w)) {
+            Some(w) => app.set_workspace(w),
+            None => return err(format!("unknown workspace `{w}`")),
+        }
+    }
+    if let Some(th) = s("theme") {
+        match crate::theme::ThemeKind::from_name(th) {
+            Some(k) => app.set_theme(ctx, k),
+            None => return err("unknown theme (dark, darker, light)"),
+        }
+    }
+    if let Some(f) = s("focused").and_then(PanelKind::from_name) {
+        app.ui.focused = f;
+    }
+    if let Some(v) = p.get("viewer")
+        && let Err(e) = apply_viewer(app, v)
+    {
+        return err(e);
+    }
+    set_ui_layout(app, p)
+}
+
+/// The remaining `ui.set` fields, applied in the same order after the viewer settings.
+fn set_ui_layout(app: &mut EffectcraftApp, p: &Value) -> Outcome {
+    if let Some(tl) = p.get("timeline") {
+        apply_timeline(app, tl);
+    }
+    if let Some(b) = p.get("menuBar").and_then(Value::as_bool) {
+        app.ui.show_menu_bar = b;
+    }
+    // Project panel optional columns, e.g. ["type", "duration", "path", "comment"].
+    if let Some(Value::Array(a)) = p.get("projectColumns") {
+        apply_project_columns(app, a);
+    }
+    // Wiggler / Smoother / Motion Sketch settings (fields of `AnimToolsState`).
+    if let Some(Value::Object(m)) = p.get("animTools")
+        && let Err(e) = apply_anim_tools(app, m)
+    {
+        return err(e);
+    }
+    if let Some(b) = p.get("home").and_then(Value::as_bool) {
+        app.ui.start_screen = b;
+    }
+    // Home screen tab: "home", "templates" or "learn".
+    if let Some(tab) = p.get("homeTab").and_then(Value::as_str) {
+        app.ui.home_learn = tab == "learn";
+        app.ui.home_templates = tab == "templates";
+    }
+    ok(Value::Null)
+}
+
+/// Applies viewer `zoom`, the active comp's `res` (stored in the project), `pan` and the
+/// `grid`, `rulers`, `safeMargins` and `transparencyGrid` toggles. An unknown resolution name
+/// is an error; a resolution change without an active comp is ignored.
+fn apply_viewer(app: &mut EffectcraftApp, v: &Value) -> Result<(), String> {
+    if let Some(z) = v.get("zoom") {
+        app.ui.viewer.zoom = z.as_f64().map(|z| z as f32);
+    }
+    // The active comp's Resolution (`view.res.*`), saved with the project.
+    if let Some(r) = v.get("res").and_then(Value::as_str) {
+        let Some(res) = Resolution::ALL.into_iter().find(|x| x.label().eq_ignore_ascii_case(r)) else {
+            return Err(format!("unknown resolution `{r}` (auto, full, half, third, quarter)"));
+        };
+        if let Some(cid) = app.session.active_comp_id()
+            && let Err(e) = app.session.set_resolution(cid, res)
+        {
+            return Err(e.to_string());
+        }
+    }
+    if let Some(Value::Array(a)) = v.get("pan") {
+        app.ui.viewer.pan = [a.first().and_then(Value::as_f64).unwrap_or(0.0) as f32, a.get(1).and_then(Value::as_f64).unwrap_or(0.0) as f32];
+    }
+    for (k, slot) in [
+        ("grid", &mut app.ui.viewer.grid),
+        ("rulers", &mut app.ui.viewer.rulers),
+        ("safeMargins", &mut app.ui.viewer.safe_margins),
+        ("transparencyGrid", &mut app.ui.viewer.transparency_grid),
+    ] {
+        if let Some(b) = v.get(k).and_then(Value::as_bool) {
+            *slot = b;
+        }
+    }
+    Ok(())
+}
+
+/// Applies timeline `pps`, `start`, `graphEditor`, `showModes`, `openLayers` and `openGroups`
+/// to the UI state, leaving absent fields unchanged.
+fn apply_timeline(app: &mut EffectcraftApp, tl: &Value) {
+    if let Some(v) = tl.get("pps") {
+        app.ui.timeline.pps = v.as_f64();
+    }
+    if let Some(v) = tl.get("start").and_then(Value::as_f64) {
+        app.ui.timeline.start = v;
+    }
+    if let Some(v) = tl.get("graphEditor").and_then(Value::as_bool) {
+        app.ui.timeline.graph_editor = v;
+    }
+    if let Some(v) = tl.get("showModes").and_then(Value::as_bool) {
+        app.ui.timeline.show_modes = v;
+    }
+    if let Some(Value::Array(a)) = tl.get("openLayers") {
+        app.ui.timeline.open_layers = a.iter().filter_map(Value::as_u64).collect();
+    }
+    if let Some(Value::Array(a)) = tl.get("openGroups") {
+        app.ui.timeline.open_groups = a.iter().filter_map(Value::as_u64).collect();
+    }
+}
+
+/// Replaces the Project panel's optional columns with the names in `a`, in the canonical
+/// `COLUMNS` order; unknown names are kept, sorted after the known ones.
+fn apply_project_columns(app: &mut EffectcraftApp, a: &[Value]) {
+    let mut cols = vec![];
+    for k in a.iter().filter_map(Value::as_str) {
+        crate::panels::project::set_column(&mut cols, k, true);
+    }
+    app.ui.project_columns = cols;
+}
+
+/// Merges `m` over the current Wiggler/Smoother/Motion Sketch settings by round-tripping them
+/// through JSON. A value of the wrong type is an error and leaves the settings unchanged.
+fn apply_anim_tools(app: &mut EffectcraftApp, m: &serde_json::Map<String, Value>) -> Result<(), String> {
+    let mut cur = serde_json::to_value(&app.ui.anim_tools).unwrap_or_default();
+    for (k, v) in m {
+        cur[k] = v.clone();
+    }
+    match serde_json::from_value(cur) {
+        Ok(v) => {
+            app.ui.anim_tools = v;
+            Ok(())
+        }
+        Err(e) => Err(format!("animTools: {e}")),
+    }
+}
+
+/// Shows (`ui.panel.show`) or closes (`ui.panel.close`) the named panel; an unknown panel name
+/// is an error.
+fn panel(app: &mut EffectcraftApp, method: &str, p: &Value) -> Outcome {
+    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    let Some(panel) = s("panel").and_then(PanelKind::from_name) else { return err("unknown `panel`") };
+    if method == "ui.panel.show" {
+        app.show_panel(panel);
+    } else {
+        app.close_panel(panel);
+    }
+    ok(Value::Null)
+}
+
+/// The number of synthetic events a gesture queues: `2 * count + 3` for `ui.click` (`count`
+/// 1..=512), or 3 for `ui.move`. An out-of-range `count` or an overflow is an error.
+fn click_gesture_events(method: &str, p: &Value) -> Result<usize, String> {
+    if method != "ui.click" {
+        return Ok(3);
+    }
+    const MAX_CLICK_COUNT: u64 = 512;
+    let count = p.get("count").and_then(Value::as_u64).unwrap_or(1);
+    if count == 0 || count > MAX_CLICK_COUNT {
+        return Err(format!("`count` must be between 1 and {MAX_CLICK_COUNT}"));
+    }
+    usize::try_from(count).ok().and_then(|n| n.checked_mul(2)).and_then(|n| n.checked_add(3)).ok_or_else(|| "click event count overflow".to_string())
+}
+
+/// Queues a click or a plain move at `{id}`'s centre (`fx`/`fy` within its rect, default 0.5)
+/// or at `{x, y}`, holding the request's modifiers across the whole gesture. An element that is
+/// not on screen returns [`Outcome::Retry`]; the gesture is size-checked against the 4096-event
+/// queue limit before anything is pushed. Replies [`Outcome::AfterInput`].
+fn click_or_move(app: &mut EffectcraftApp, method: &str, p: &Value) -> Outcome {
+    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    let pos = match point(app, p) {
+        Ok(p) => p,
+        Err(e) if e.starts_with(RETRY) => return Outcome::Retry(e.trim_start_matches(RETRY).to_string()),
+        Err(e) => return err(e),
+    };
+    let m = modifiers(p);
+    // Validate the complete gesture before mutating the queue; the loopback control
+    // channel is externally reachable and must not amplify tiny requests into huge work.
+    const MAX_PENDING_EVENTS: usize = 4096;
+    let pending = app.synthetic.len();
+    let gesture_events = match click_gesture_events(method, p) {
+        Ok(events) => events,
+        Err(e) => return err(e),
+    };
+    if pending.checked_add(gesture_events).is_none_or(|n| n > MAX_PENDING_EVENTS) {
+        return err("synthetic input queue is full");
+    }
+    // egui keeps the modifiers from `ModifiersChanged` (not the ones on a pointer event)
+    // and the synthetic events arrive one per frame: hold them for the whole gesture.
+    app.synthetic.push(egui::Event::ModifiersChanged(m));
+    app.synthetic.push(egui::Event::PointerMoved(pos));
+    if method == "ui.click" {
+        let button = match s("button") {
+            Some("right") => egui::PointerButton::Secondary,
+            Some("middle") => egui::PointerButton::Middle,
+            _ => egui::PointerButton::Primary,
+        };
+        let count = p.get("count").and_then(Value::as_u64).unwrap_or(1);
+        for _ in 0..count {
+            app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: true, modifiers: m });
+            app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: false, modifiers: m });
+        }
+    }
+    app.synthetic.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    Outcome::AfterInput
+}
+
+/// Queues a primary-button drag from `from` to `to` over `steps` interpolated moves (default
+/// 12, at least 2, at most 2048), with the request's modifiers. Both endpoints are resolved
+/// first (an unseen element returns [`Outcome::Retry`]) and the event count is checked against
+/// the 4096-event queue limit. Replies [`Outcome::AfterInput`].
+fn drag(app: &mut EffectcraftApp, p: &Value) -> Outcome {
+    let (Some(from), Some(to)) = (p.get("from"), p.get("to")) else { return err("need `from` and `to`") };
+    let (a, b) = match (point(app, from), point(app, to)) {
+        (Ok(a), Ok(b)) => (a, b),
+        (Err(e), _) | (_, Err(e)) if e.starts_with(RETRY) => return Outcome::Retry(e.trim_start_matches(RETRY).to_string()),
+        (Err(e), _) | (_, Err(e)) => return err(e),
+    };
+    let steps = p.get("steps").and_then(Value::as_u64).unwrap_or(12).max(2);
+    const MAX_PENDING_EVENTS: usize = 4096;
+    const MAX_DRAG_STEPS: u64 = 2048;
+    if steps > MAX_DRAG_STEPS {
+        return err(format!("`steps` must be at most {MAX_DRAG_STEPS}"));
+    }
+    let Some(gesture_events) = usize::try_from(steps).ok().and_then(|n| n.checked_add(5)) else { return err("drag event count overflow") };
+    if app.synthetic.len().checked_add(gesture_events).is_none_or(|n| n > MAX_PENDING_EVENTS) {
+        return err("synthetic input queue is full");
+    }
+    let m = modifiers(p);
+    app.synthetic.push(egui::Event::ModifiersChanged(m));
+    app.synthetic.push(egui::Event::PointerMoved(a));
+    app.synthetic.push(egui::Event::PointerButton { pos: a, button: egui::PointerButton::Primary, pressed: true, modifiers: m });
+    for i in 1..=steps {
+        let f = i as f32 / steps as f32;
+        app.synthetic.push(egui::Event::PointerMoved(a + (b - a) * f));
+    }
+    app.synthetic.push(egui::Event::PointerButton { pos: b, button: egui::PointerButton::Primary, pressed: false, modifiers: m });
+    app.synthetic.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    Outcome::AfterInput
+}
+
+/// Queues a move to the target point, a wheel event of `dx`, `dy` (`unit`: points or lines) with
+/// the request's modifiers, a pinch's zoom factor, and a released Extra1 button. Replies
+/// [`Outcome::AfterInput`].
+fn scroll(app: &mut EffectcraftApp, p: &Value) -> Outcome {
+    let pos = match point(app, p) {
+        Ok(p) => p,
+        Err(e) => return err(e),
+    };
+    let dx = p.get("dx").and_then(Value::as_f64).unwrap_or(0.0) as f32;
+    let dy = p.get("dy").and_then(Value::as_f64).unwrap_or(0.0) as f32;
+    let line = p.get("unit").and_then(Value::as_str) == Some("line");
+    let unit = if line { egui::MouseWheelUnit::Line } else { egui::MouseWheelUnit::Point };
+    // Without a `source`, a scroll in lines is a mouse wheel and one in points comes from an
+    // unnamed device, as on Windows, Linux and the web.
+    let source = match p.get("source").and_then(Value::as_str) {
+        Some("trackpad") => egui::MouseWheelSource::Trackpad,
+        Some("wheel") => egui::MouseWheelSource::Wheel,
+        _ if line => egui::MouseWheelSource::Wheel,
+        _ => egui::MouseWheelSource::Unknown,
+    };
+    app.synthetic.push(egui::Event::PointerMoved(pos));
+    if dx != 0.0 || dy != 0.0 {
+        app.synthetic.push(egui::Event::MouseWheel { unit, delta: egui::vec2(dx, dy), modifiers: modifiers(p), phase: egui::TouchPhase::Move, source });
+    }
+    if let Some(pinch) = p.get("pinch").and_then(Value::as_f64).filter(|z| z.is_finite() && *z > 0.0) {
+        app.synthetic.push(egui::Event::Zoom(pinch as f32));
+    }
+    app.synthetic.push(egui::Event::PointerButton {
+        pos: egui::pos2(-100.0, -100.0),
+        button: egui::PointerButton::Extra1,
+        pressed: false,
+        modifiers: Default::default(),
+    });
+    Outcome::AfterInput
+}
+
+/// Queues a press and release of `key`, whose name may carry a shortcut (`Cmd+Shift+Z`); the
+/// separate `modifiers` flags are added. A `Physical+` prefix makes the key positional. An
+/// unknown key name is an error.
+fn key(app: &mut EffectcraftApp, p: &Value) -> Outcome {
+    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    let Some(name) = s("key") else { return err("missing `key`") };
+    let Some((mut m, key)) = crate::menus::parse_shortcut(name) else { return err(format!("unknown key `{name}`")) };
+    let extra = modifiers(p);
+    m |= extra;
+    let physical_key = name.starts_with("Physical+").then_some(key);
+    app.synthetic.push(egui::Event::Key { key, physical_key, pressed: true, repeat: false, modifiers: m });
+    app.synthetic.push(egui::Event::Key { key, physical_key, pressed: false, repeat: false, modifiers: m });
+    Outcome::AfterInput
+}
+
+/// Queues a text event with `text`, followed by a released F35 key. Missing `text` is an
+/// error.
+fn type_text(app: &mut EffectcraftApp, p: &Value) -> Outcome {
+    let Some(text) = p.get("text").and_then(Value::as_str) else { return err("missing `text`") };
+    app.synthetic.push(egui::Event::Text(text.to_string()));
+    app.synthetic.push(egui::Event::Key { key: egui::Key::F35, physical_key: None, pressed: false, repeat: false, modifiers: Default::default() });
+    Outcome::AfterInput
+}
+
+/// Converts comp pixel `x`, `y` to a screen point with the viewer's current transform, or
+/// returns [`Outcome::Retry`] while the viewer is not visible.
+fn viewer_locate(ctx: &egui::Context, p: &Value) -> Outcome {
+    let (Some(x), Some(y)) = (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) else {
+        return err("need `x`, `y` (comp pixels)");
+    };
+    match crate::panels::viewer::comp_to_screen(ctx, [x as f32, y as f32]) {
+        Some(pt) => ok(json!({"x": pt.x, "y": pt.y})),
+        None => Outcome::Retry("the composition viewer is not visible".into()),
+    }
+}
+
+/// Converts a point (`{id}`, or `{x, y}`) to comp pixels; replies with an error when the
+/// viewer is not visible.
+fn viewer_hit(app: &mut EffectcraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    let pos = match point(app, p) {
+        Ok(p) => p,
+        Err(e) => return err(e),
+    };
+    match crate::panels::viewer::screen_to_comp(ctx, pos) {
+        Some(c) => ok(json!({"x": c[0], "y": c[1]})),
+        None => err("the composition viewer is not visible"),
+    }
+}
+
+/// Returns the screen point at `time` seconds on the ruler row of layer `layer`'s bar;
+/// without a numeric `time`, returns the bar's centre. Returns [`Outcome::Retry`] when the bar
+/// is unavailable, or a numeric `time` is supplied but the ruler is unavailable or malformed.
+fn timeline_locate(app: &EffectcraftApp, p: &Value) -> Outcome {
+    let Some(l) = p.get("layer").and_then(Value::as_u64) else { return err("need `layer` (id)") };
+    match crate::panels::timeline::locate(app, l, p.get("time").and_then(Value::as_f64)) {
+        Some((x, y)) => ok(json!({"x": x, "y": y})),
+        None => Outcome::Retry("layer not visible in the timeline".into()),
+    }
+}
+
+/// Applies `action` (`play`, `stop`, `status`, else toggle) at `now` and replies with the
+/// playing state, current time in seconds, whether audio is present and the meter's level and
+/// peak in dB.
+fn playback(app: &mut EffectcraftApp, p: &Value, now: f64) -> Outcome {
+    let action = p.get("action").and_then(Value::as_str).unwrap_or("toggle");
+    match action {
+        "play" => app.play(now),
+        "stop" => app.stop(),
+        "status" => {}
+        _ => app.toggle_play(now),
+    }
+    ok(
+        json!({"playing": app.playback.playing, "time": app.session.time().seconds(), "audio": app.audio.is_some(), "levelsDb": app.meter.level_db, "peaksDb": app.meter.peak_db}),
+    )
+}
+
+/// Resolves the capture target — a named panel, an element id, or the whole window — and
+/// returns [`Outcome::Retry`] while a requested panel or element is not registered, so a
+/// missing target is never silently captured as the window. Requests a repaint without raising
+/// or focusing the window and returns [`Outcome::Screenshot`]; the target is resolved again
+/// when the capture is issued.
+fn screenshot(app: &mut EffectcraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    let s = |k: &str| p.get(k).and_then(Value::as_str);
+    // A file the project reads is never the output.
+    if let Some(path) = s("path")
+        && let Err(e) = app.session.refuse_export(path)
+    {
+        return err(e);
+    }
+    // The panel/element is an identity, not a rectangle: it is resolved when the capture
+    // is issued (after the UI settles), so a panel that moves meanwhile is not cropped
+    // with its old rectangle.
+    let target = match s("panel") {
+        Some(name) => match PanelKind::from_name(name) {
+            Some(pk) => crate::ShotTarget::Panel(pk),
+            None => return err(format!("unknown panel `{name}`")),
+        },
+        None => s("id").map_or(crate::ShotTarget::Window, |id| crate::ShotTarget::Id(id.to_string())),
+    };
+    // Asking for one element and silently capturing the whole window would hide a missing
+    // panel: wait for it like any other not-yet-laid-out control.
+    let missing = match &target {
+        crate::ShotTarget::Panel(pk) => app.auto.find(&format!("panel.{}", pk.id())).is_none(),
+        crate::ShotTarget::Id(id) => app.auto.find(id).is_none(),
+        crate::ShotTarget::Window | crate::ShotTarget::Rect(_) => false,
+    };
+    if missing {
+        return Outcome::Retry(match &target {
+            crate::ShotTarget::Panel(pk) => format!("the {} panel is not on screen", pk.title()),
+            crate::ShotTarget::Id(id) => format!("no element `{id}` is on screen"),
+            crate::ShotTarget::Window | crate::ShotTarget::Rect(_) => "the element is not on screen".into(),
+        });
+    }
+    // Request a repaint without raising the window or taking keyboard focus.
+    app.raise_for_control(ctx);
+    Outcome::Screenshot { path: s("path").map(str::to_string), target }
+}
+
+/// Asks the viewport for an inner size of `width`×`height` pixels (default 1600×1000).
+fn resize(ctx: &egui::Context, p: &Value) -> Outcome {
+    let w = p.get("width").and_then(Value::as_f64).unwrap_or(1600.0) as f32;
+    let h = p.get("height").and_then(Value::as_f64).unwrap_or(1000.0) as f32;
+    ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(egui::vec2(w, h)));
+    ok(Value::Null)
+}
+
+/// Sends the viewport close request. `force: true` marks the unsaved-changes state as
+/// quitting, so a modified project closes without the save prompt.
+fn quit(app: &mut EffectcraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    // A modified project asks to save first unless `force: true`.
+    if p.get("force").and_then(Value::as_bool).unwrap_or(false) {
+        app.dialog_state.unsaved.quitting = true;
+    }
+    ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+    ok(Value::Null)
+}
+
+/// `render.frame {comp?, time?, max_side?, path?, base64?, write?}`: render a comp frame through the session
 /// (independent of the viewer zoom/resolution) and return it as PNG, written to `path` (default a
-/// temp file) or inline as base64 when `base64: true`.
+/// temp file) or inline as base64 when `base64: true`. `write: true` with `base64: true` does both.
 fn render_frame(app: &EffectcraftApp, p: &Value) -> Outcome {
     let s = &app.session;
+    // A file the project reads is never the output (checked before rendering).
+    if let Some(path) = p.get("path").and_then(Value::as_str)
+        && let Err(e) = s.refuse_export(path)
+    {
+        return err(e);
+    }
     let cid = match s.resolve_comp(p.get("comp")) {
         Ok(c) => c,
         Err(e) => return err(e),
@@ -490,7 +765,7 @@ fn render_frame(app: &EffectcraftApp, p: &Value) -> Outcome {
     let mut out = json!({"comp": cid.0, "time": t.seconds(), "width": w, "height": h});
     // (the web has no file system: inline unless a path is given)
     let inline = p.get("base64").and_then(Value::as_bool).unwrap_or(cfg!(target_arch = "wasm32") && p.get("path").is_none());
-    if inline {
+    if inline && !p.get("write").and_then(Value::as_bool).unwrap_or(false) {
         out["png"] = json!(base64(&png));
         return ok(out);
     }
@@ -499,7 +774,10 @@ fn render_frame(app: &EffectcraftApp, p: &Value) -> Outcome {
         .and_then(Value::as_str)
         .map(str::to_string)
         .unwrap_or_else(|| std::env::temp_dir().join(format!("effectcraft-frame-{}.png", std::process::id())).to_string_lossy().to_string());
-    match std::fs::write(&path, png) {
+    if inline {
+        out["png"] = json!(base64(&png));
+    }
+    match s.write_output(&path, &png) {
         Ok(()) => {
             out["path"] = json!(path);
             ok(out)
@@ -525,8 +803,13 @@ pub fn base64(data: &[u8]) -> String {
     s
 }
 
+/// Builds the `ui.inspect` reply: window size and pixels per point, fps, UI state with the
+/// active comp's viewer resolution, playback and time, active comp, selected layer/key counts,
+/// registered element count, keyboard focus (egui id, rect, automation ids and rect
+/// candidates), fresh window focus, workspace storage error, open dialog and last frame time.
 pub fn inspect(app: &EffectcraftApp, ctx: &egui::Context) -> Value {
-    let size = ctx.content_rect().size();
+    // A logic-only tick refreshes the viewport information but not `InputState`'s screen rect.
+    let size = ctx.input(|i| i.viewport().inner_rect).map_or_else(|| ctx.content_rect().size(), |r| r.size());
     let keyboard_focus = ctx.memory(|m| m.focused()).map(|id| {
         let response = ctx.read_response(id);
         let rect = response.as_ref().map(|r| [r.rect.min.x, r.rect.min.y, r.rect.width(), r.rect.height()]);
@@ -559,7 +842,9 @@ pub fn inspect(app: &EffectcraftApp, ctx: &egui::Context) -> Value {
         "selectedKeys": app.session.state.selected_keys.len(),
         "elements": app.auto.previous.len(),
         "keyboardFocus": keyboard_focus,
-        "windowFocused": ctx.input(|i| i.focused),
+        // Fresh viewport focus only: in a logic-only tick `InputState::focused` still holds the
+        // previous full pass's value, and the app field is that same fresh value.
+        "windowFocused": ctx.input(|i| i.viewport().focused).unwrap_or(app.focused),
         "workspaceStorageError": app.workspace_store.error,
         "dialog": app.dialog.map(|d| format!("{d:?}")),
         "renderMs": app.frames.last_ms.lock().map(|v| *v).unwrap_or(0.0),
@@ -567,21 +852,37 @@ pub fn inspect(app: &EffectcraftApp, ctx: &egui::Context) -> Value {
 }
 
 /// Save a screenshot (optionally cropped to a rect in points) as PNG; returns the reply JSON.
-pub fn save_screenshot(ctx: &egui::Context, image: &egui::ColorImage, path: Option<&str>, crop: Option<[f32; 4]>) -> Value {
-    let ppp = ctx.pixels_per_point();
+///
+/// `crop` is relative to the image's own origin (the issued surface's top-left corner), and
+/// `scale` is the returned image's pixels per point in x and y, derived from the image size and
+/// the issued rect. The image can be smaller than requested when the adapter-limit fit (E2)
+/// applies, so its own scale — never the issued or current pixels-per-point — cuts the crop:
+/// any other scale reads a shifted or rescaled region.
+pub fn save_screenshot(image: &egui::ColorImage, path: Option<&str>, crop: Option<[f32; 4]>, scale: [f64; 2]) -> Value {
     let [w, h] = image.size;
+    let [sx, sy] = scale;
+    if w == 0 || h == 0 || !sx.is_finite() || sx <= 0.0 || !sy.is_finite() || sy <= 0.0 {
+        return json!({"ok": false, "error": "the screenshot has no pixels to save"});
+    }
+    if image.pixels.len() != w.saturating_mul(h) {
+        return json!({"ok": false, "error": "the screenshot's pixels do not match its dimensions"});
+    }
+    let px = |v: f64, s: f64| (v * s).max(0.0) as usize;
     let (x0, y0, cw, ch) = match crop {
-        Some([x, y, cw, ch]) => {
-            let x0 = ((x * ppp) as usize).min(w);
-            let y0 = ((y * ppp) as usize).min(h);
-            (x0, y0, ((cw * ppp) as usize).min(w - x0), ((ch * ppp) as usize).min(h - y0))
+        Some([x, y, cw, ch]) if [x, y, cw, ch].iter().all(|v| v.is_finite()) => {
+            let x0 = px(x as f64, sx).min(w);
+            let y0 = px(y as f64, sy).min(h);
+            (x0, y0, px(cw as f64, sx).min(w - x0), px(ch as f64, sy).min(h - y0))
         }
+        Some(_) => return json!({"ok": false, "error": "the screenshot crop is not a finite rectangle"}),
         None => (0, 0, w, h),
     };
-    let mut rgba = Vec::with_capacity(cw * ch * 4);
+    let mut rgba = Vec::with_capacity(cw.saturating_mul(ch).saturating_mul(4));
     for y in y0..y0 + ch {
         for x in x0..x0 + cw {
-            let c = image.pixels[y * w + x];
+            let Some(c) = image.pixels.get(y * w + x) else {
+                return json!({"ok": false, "error": "the screenshot's pixels do not match its dimensions"});
+            };
             rgba.extend_from_slice(&[c.r(), c.g(), c.b(), 255]);
         }
     }
@@ -655,6 +956,26 @@ pub fn encode_png(rgba: &[u8], w: u32, h: u32) -> Result<Vec<u8>, String> {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn a_native_render_with_no_running_jobs_still_checks_its_own_completion() {
+        let waiter = super::JobWaiter {
+            command: "renderQueue.render".into(),
+            params: serde_json::json!({}),
+            result: serde_json::json!({"rendering": true, "items": []}),
+            jobs: vec![],
+            log_cursor: 0,
+            render: Some(std::sync::Arc::new(effectcraft_engine::render_queue::JobShared::default())),
+        };
+        let super::Outcome::AwaitJobs(waiter) = waiter.into_outcome() else {
+            panic!("a finished native render must still pass through completion polling");
+        };
+        let mut app = crate::EffectcraftApp::new(effectcraft_engine::Session::default());
+        assert!(!waiter.pending(&app));
+        let reply = waiter.finish(&mut app);
+        assert_eq!(reply["ok"], false, "an abandoned render cannot silently report a replacement project's queue");
+        assert!(reply["error"].as_str().unwrap().contains("replaced before completion"));
+    }
+
     #[test]
     fn base64_rfc4648_vectors() {
         for (i, o) in [("", ""), ("f", "Zg=="), ("fo", "Zm8="), ("foo", "Zm9v"), ("foob", "Zm9vYg=="), ("fooba", "Zm9vYmE="), ("foobar", "Zm9vYmFy")] {
diff --git a/crates/ui-egui/src/credits.rs b/crates/ui-egui/src/credits.rs
index 77357e876..381131fc5 100644
--- a/crates/ui-egui/src/credits.rs
+++ b/crates/ui-egui/src/credits.rs
@@ -1,7 +1,6 @@
 //! The About window's credits: every contributor (GitHub login always; display and real names only
 //! with recorded consent) and the AI models that helped. The tables are baked into the binary by
-//! build.rs from contributors/contributors.json (craftrules standards/contributors.md); nothing is
-//! read at run time.
+//! build.rs from contributors/contributors.json; nothing is read at run time.
 
 use crate::i18n::{tr, tr_args};
 use std::cmp::Ordering;
@@ -241,12 +240,12 @@ impl Default for View {
 /// About ▸ Contributors: a name toggle, a sort, and the list as a grab bag or a table. Every
 /// control registers an automation id under `about.credits.`.
 pub fn contributors_ui(ui: &mut egui::Ui, auto: &mut Registry) {
-    let id = egui::Id::new("credits_view");
+    let id = egui::Id::unique("credits_view");
     let mut v = ui.data_mut(|d| d.get_temp::<View>(id)).unwrap_or_default();
     ui.horizontal_wrapped(|ui| {
         ui.label(tr("Show"));
         for m in NameMode::ALL {
-            let r = ui.selectable_label(v.names == m, m.label());
+            let r = ui.selectable_label(v.names == m, tr(m.label()));
             auto.add(&format!("about.credits.show.{}", m.id()), r.rect, m.label());
             if r.clicked() {
                 v.names = m;
@@ -254,9 +253,9 @@ pub fn contributors_ui(ui: &mut egui::Ui, auto: &mut Registry) {
         }
         ui.separator();
         ui.label(tr("Sort"));
-        let combo = egui::ComboBox::from_id_salt("credits_sort").selected_text(v.key.label().0).show_ui(ui, |ui| {
+        let combo = craft_ui::ComboBox::from_id_salt("credits_sort").selected_text(tr(v.key.label().0)).show_ui(ui, |ui| {
             for k in SortKey::ALL {
-                let r = ui.selectable_label(v.key == k, k.label().0);
+                let r = ui.selectable_label(v.key == k, tr(k.label().0));
                 auto.add(&format!("about.credits.sort.{}", k.id()), r.rect, k.label().0);
                 if r.clicked() {
                     v.key = k;
@@ -285,12 +284,14 @@ pub fn contributors_ui(ui: &mut egui::Ui, auto: &mut Registry) {
     let list = sorted(CONTRIBUTORS, v.names, v.key, v.ascending);
     ui.label(RichText::new(tr_args("{} contributors · {} commits", &[&(list.len()), &(group(TOTAL_COMMITS))])).small().weak());
     ui.separator();
-    egui::ScrollArea::both().auto_shrink([false, false]).show(ui, |ui| {
-        if list.is_empty() {
-            ui.label(tr("No contributor data was built into this copy."));
-        } else if v.table {
-            table(ui, &list, &mut v, auto);
-        } else {
+    if list.is_empty() {
+        ui.label(tr("No contributor data was built into this copy."));
+    } else if v.table {
+        // The table scrolls vertically itself, under a fixed header; it only scrolls sideways once
+        // its columns are dragged wider than the window.
+        egui::ScrollArea::horizontal().auto_shrink([false, false]).show(ui, |ui| table(ui, &list, &mut v, auto));
+    } else {
+        egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
             ui.horizontal_wrapped(|ui| {
                 for (i, c) in list.iter().enumerate() {
                     if i > 0 {
@@ -300,42 +301,153 @@ pub fn contributors_ui(ui: &mut egui::Ui, auto: &mut Registry) {
                     auto.add(&format!("about.credits.contributor.{}", c.login), r.rect, &c.name(v.names));
                 }
             });
-        }
-    });
+        });
+    }
     ui.data_mut(|d| d.insert_temp(id, v));
 }
 
-fn table(ui: &mut egui::Ui, list: &[&Contributor], v: &mut View, auto: &mut Registry) {
-    egui::Grid::new("credits_table").striped(true).num_columns(SortKey::ALL.len()).show(ui, |ui| {
-        for k in SortKey::ALL {
-            let arrow = if v.key == k { if v.ascending { " ▲" } else { " ▼" } } else { "" };
-            let r = ui.button(RichText::new(format!("{}{arrow}", k.label().1)).strong()).on_hover_text(k.label().0);
-            auto.add(&format!("about.credits.header.{}", k.id()), r.rect, k.label().0);
-            if r.clicked() {
-                if v.key == k {
-                    v.ascending = !v.ascending;
-                } else {
-                    v.key = k;
-                    v.ascending = k.default_ascending();
-                }
+/// How the contributor table's spare width is shared out: all of it to Name.
+const CONTRIBUTOR_GROW: [f32; 10] = [1.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0];
+
+/// How the model table's spare width is shared out: to Company and Model, the text columns.
+const MODEL_GROW: [f32; 6] = [1.0, 2.0, 0.0, 0.0, 0.0, 0.0];
+
+/// The narrowest a column can be dragged.
+const MIN_COLUMN: f32 = 28.0;
+
+/// The width a column needs for its header and its widest cell.
+fn natural(ui: &egui::Ui, header: RichText, cells: impl Iterator<Item = String>) -> f32 {
+    let measure = |text: egui::WidgetText| text.into_galley(ui, Some(egui::TextWrapMode::Extend), f32::INFINITY, egui::TextStyle::Body).size().x;
+    let widest = cells.map(|c| measure(c.into())).fold(measure(header.into()), f32::max);
+    widest + 2.0 * ui.spacing().button_padding.x
+}
+
+/// Opening column widths: each column's natural width, with the spare room shared out by `grow`,
+/// so the columns fill `room` exactly. When there is too little room, only the growing columns
+/// give way, each in proportion to its width above [`MIN_COLUMN`], and none goes below that.
+fn fit_widths(natural: &[f32], grow: &[f32], room: f32) -> Vec<f32> {
+    let spare = room - natural.iter().sum::<f32>();
+    let weight = grow.iter().sum::<f32>();
+    let slack = |w: f32| (w - MIN_COLUMN).max(0.0);
+    let flexible: f32 = natural.iter().zip(grow).filter(|(_, g)| **g > 0.0).map(|(w, _)| slack(*w)).sum();
+    natural
+        .iter()
+        .zip(grow)
+        .map(|(w, g)| {
+            if *g > 0.0 && spare >= 0.0 {
+                w + spare * g / weight
+            } else if *g > 0.0 && flexible > 0.0 {
+                w - (-spare).min(flexible) * slack(*w) / flexible
+            } else {
+                *w
             }
-        }
-        ui.end_row();
-        for c in list {
-            let r = ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login)).on_hover_text(c.summary());
-            auto.add(&format!("about.credits.contributor.{}", c.login), r.rect, &c.name(v.names));
-            ui.label(group(c.prs));
-            ui.label(group(c.commits));
-            ui.label(group(c.lines_added));
-            ui.label(group(c.lines_deleted));
-            ui.label(signed(c.lines_delta()));
-            ui.label(group(c.binary_added));
-            ui.label(group(c.binary_deleted));
-            ui.label(day(c.first_commit));
-            ui.label(day(c.last_commit));
-            ui.end_row();
-        }
-    });
+        })
+        .collect()
+}
+
+/// A striped table whose columns open at [`fit_widths`], so it fills the width and nothing scrolls
+/// sideways. Every column, the last included, can be dragged wider or narrower at its right edge:
+/// only a table dragged wider than the window scrolls sideways. Text too long for its column is
+/// clipped. When a column's natural width or the window changes, the columns go back to a new fit,
+/// dropping any dragged widths.
+fn fitted_table<'a>(ui: &'a mut egui::Ui, id: &str, natural: &[f32], grow: &[f32]) -> egui_extras::TableBuilder<'a> {
+    // Every cell is followed by the item gap, and the vertical scrollbar keeps its margins.
+    let s = ui.spacing();
+    let gaps = s.item_spacing.x * natural.len() as f32;
+    let bar = s.scroll.bar_width + s.scroll.bar_inner_margin + s.scroll.bar_outer_margin;
+    let widths = fit_widths(natural, grow, (ui.available_width() - gaps - bar).max(0.0));
+    // The table keeps its own column widths, so a change in what they were fitted to has to clear
+    // them. A longer name can leave the fit itself unchanged, and scrolling can nudge the available
+    // width, so this compares the natural widths and the clip rect, which scrolling never moves.
+    let fit = egui::Id::unique(("credits_fit", id));
+    let measured = (natural.to_vec(), ui.clip_rect().width());
+    let refit = ui.data_mut(|d| d.get_temp::<(Vec<f32>, f32)>(fit)).as_ref() != Some(&measured);
+    ui.data_mut(|d| d.insert_temp(fit, measured));
+    let mut t = egui_extras::TableBuilder::new(ui).id_salt(id).striped(true).resizable(true).auto_shrink([false, false]).max_scroll_height(f32::INFINITY);
+    if refit {
+        t.reset();
+    }
+    for w in widths {
+        t = t.column(egui_extras::Column::initial(w).at_least(MIN_COLUMN).clip(true));
+    }
+    t
+}
+
+/// Add a cell's widget right-aligned (counts, dates) or left-aligned (names), vertically centred.
+fn aligned<R>(ui: &mut egui::Ui, right: bool, add: impl FnOnce(&mut egui::Ui) -> R) -> R {
+    let layout = if right { egui::Layout::right_to_left(egui::Align::Center) } else { egui::Layout::left_to_right(egui::Align::Center) };
+    ui.with_layout(layout, add).inner
+}
+
+fn row_height(ui: &egui::Ui) -> f32 {
+    ui.text_style_height(&egui::TextStyle::Body) + 6.0
+}
+
+/// A contributor-table header. The sorted column is highlighted; its direction shows on the
+/// toolbar's ▲/▼ button, so no arrow widens the column.
+fn header_text(k: SortKey) -> RichText {
+    RichText::new(k.label().1).strong()
+}
+
+/// One contributor's table cells after the name, in `SortKey::ALL` order.
+fn cells(c: &Contributor) -> [String; 9] {
+    [
+        group(c.prs),
+        group(c.commits),
+        group(c.lines_added),
+        group(c.lines_deleted),
+        signed(c.lines_delta()),
+        group(c.binary_added),
+        group(c.binary_deleted),
+        day(c.first_commit).to_string(),
+        day(c.last_commit).to_string(),
+    ]
+}
+
+fn table(ui: &mut egui::Ui, list: &[&Contributor], v: &mut View, auto: &mut Registry) {
+    let h = row_height(ui);
+    let rows: Vec<[String; 9]> = list.iter().map(|c| cells(c)).collect();
+    let widths: Vec<f32> = SortKey::ALL
+        .iter()
+        .enumerate()
+        .map(|(i, &k)| match i.checked_sub(1) {
+            None => natural(ui, header_text(k), list.iter().map(|c| c.name(v.names))),
+            Some(col) => natural(ui, header_text(k), rows.iter().filter_map(|r| r.get(col).cloned())),
+        })
+        .collect();
+    fitted_table(ui, "credits_table", &widths, &CONTRIBUTOR_GROW)
+        .header(h + 4.0, |mut header| {
+            for k in SortKey::ALL {
+                header.col(|ui| {
+                    let text = header_text(k);
+                    let r = aligned(ui, k != SortKey::Name, |ui| ui.selectable_label(v.key == k, text)).on_hover_text(tr(k.label().0));
+                    auto.add(&format!("about.credits.header.{}", k.id()), r.rect, k.label().0);
+                    if r.clicked() {
+                        if v.key == k {
+                            v.ascending = !v.ascending;
+                        } else {
+                            v.key = k;
+                            v.ascending = k.default_ascending();
+                        }
+                    }
+                });
+            }
+        })
+        .body(|mut body| {
+            for (c, cells) in list.iter().zip(rows) {
+                body.row(h, |mut row| {
+                    row.col(|ui| {
+                        let r = aligned(ui, false, |ui| ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login))).on_hover_text(c.summary());
+                        auto.add(&format!("about.credits.contributor.{}", c.login), r.rect, &c.name(v.names));
+                    });
+                    for text in cells {
+                        row.col(|ui| {
+                            aligned(ui, true, |ui| ui.label(text));
+                        });
+                    }
+                });
+            }
+        });
 }
 
 /// About ▸ Models: AI models credited in Co-Authored-By trailers.
@@ -345,22 +457,45 @@ pub fn models_ui(ui: &mut egui::Ui) {
         return;
     }
     let assisted: u64 = MODELS.iter().map(|m| m.commits).max().unwrap_or(0).max(1);
-    egui::ScrollArea::both().auto_shrink([false, false]).show(ui, |ui| {
-        egui::Grid::new("credits_models").striped(true).num_columns(6).show(ui, |ui| {
-            for h in ["Company", "Model", "Version", "Commits", "% of all commits", "Lines +/−"] {
-                ui.label(RichText::new(h).strong());
-            }
-            ui.end_row();
-            for m in MODELS {
-                ui.label(m.company);
-                ui.label(m.model);
-                ui.label(m.version);
-                ui.label(group(m.commits));
-                ui.label(format!("{:.0}%", 100.0 * m.commits as f64 / TOTAL_COMMITS.max(assisted) as f64));
-                ui.label(format!("+{} / −{}", group(m.lines_added), group(m.lines_deleted)));
-                ui.end_row();
-            }
-        });
+    let h = row_height(ui);
+    let titles = ["Company", "Model", "Version", "Commits", "% of all commits", "Lines +/−"];
+    // Company, Model and Version read as text; the counts line up on the right.
+    let right = [false, false, false, true, true, true];
+    let rows: Vec<[String; 6]> = MODELS
+        .iter()
+        .map(|m| {
+            [
+                m.company.to_string(),
+                m.model.to_string(),
+                m.version.to_string(),
+                group(m.commits),
+                format!("{:.0}%", 100.0 * m.commits as f64 / TOTAL_COMMITS.max(assisted) as f64),
+                format!("+{} / −{}", group(m.lines_added), group(m.lines_deleted)),
+            ]
+        })
+        .collect();
+    let widths: Vec<f32> =
+        titles.iter().enumerate().map(|(i, title)| natural(ui, RichText::new(*title).strong(), rows.iter().filter_map(|r| r.get(i).cloned()))).collect();
+    egui::ScrollArea::horizontal().auto_shrink([false, false]).show(ui, |ui| {
+        fitted_table(ui, "credits_models", &widths, &MODEL_GROW)
+            .header(h + 4.0, |mut header| {
+                for (title, r) in titles.into_iter().zip(right) {
+                    header.col(|ui| {
+                        aligned(ui, r, |ui| ui.label(RichText::new(title).strong()));
+                    });
+                }
+            })
+            .body(|mut body| {
+                for cells in rows {
+                    body.row(h, |mut row| {
+                        for (text, r) in cells.into_iter().zip(right) {
+                            row.col(|ui| {
+                                aligned(ui, r, |ui| ui.label(text));
+                            });
+                        }
+                    });
+                }
+            });
     });
 }
 
@@ -433,4 +568,131 @@ mod tests {
         assert_eq!(day("2026-10-07T18:45:23Z"), "2026-10-07");
         assert_eq!(day(""), "—");
     }
+
+    #[test]
+    fn columns_fill_the_room_and_spare_width_goes_to_growing_columns() {
+        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 300.0), [200.0, 40.0, 60.0]);
+        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 2.0, 0.0], 230.0), [110.0, 60.0, 60.0]);
+        let w = fit_widths(&[123.0, 45.5, 67.25], &[1.0, 0.0, 2.0], 512.0);
+        assert!((w.iter().sum::<f32>() - 512.0).abs() < 0.01, "a fitted table neither scrolls nor leaves a gap: {w:?}");
+    }
+
+    #[test]
+    fn too_little_room_shrinks_only_growing_columns() {
+        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 150.0), [50.0, 40.0, 60.0]);
+        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 0.0), [MIN_COLUMN, 40.0, 60.0]);
+        assert_eq!(fit_widths(&[100.0, 40.0], &[0.0, 0.0], 50.0), [100.0, 40.0]);
+    }
+
+    #[test]
+    fn a_column_at_the_minimum_leaves_the_shortfall_to_the_others() {
+        let w = fit_widths(&[100.0, 300.0, 50.0], &[1.0, 1.0, 0.0], 140.0);
+        assert!((w.iter().sum::<f32>() - 140.0).abs() < 0.01, "the columns still fit the room: {w:?}");
+        assert!(w.iter().all(|c| *c >= MIN_COLUMN), "no column goes below the minimum: {w:?}");
+        assert_eq!(fit_widths(&[100.0, 300.0, 50.0], &[1.0, 1.0, 0.0], 0.0), [MIN_COLUMN, MIN_COLUMN, 50.0]);
+    }
+
+    const WINDOW: f32 = 640.5;
+    const NATURAL: [f32; 3] = [120.0, 80.0, 80.0];
+    const GROW: [f32; 3] = [1.0, 0.0, 0.0];
+
+    /// One frame of a table long enough to scroll; the rects of its header cells.
+    fn table_frame(ctx: &egui::Context, width: f32, natural: &[f32], events: Vec<egui::Event>) -> Vec<egui::Rect> {
+        scrolled_frame(ctx, width, natural, 0.0, events)
+    }
+
+    /// [`table_frame`], scrolled `offset` points sideways.
+    fn scrolled_frame(ctx: &egui::Context, width: f32, natural: &[f32], offset: f32, events: Vec<egui::Event>) -> Vec<egui::Rect> {
+        let screen_rect = Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(width, 300.0)));
+        let raw = egui::RawInput { screen_rect, events, ..Default::default() };
+        let mut cells = Vec::new();
+        let out = ctx.run_ui(raw, |ui| {
+            cells.clear();
+            egui::ScrollArea::horizontal().auto_shrink([false, false]).horizontal_scroll_offset(offset).show(ui, |ui| {
+                fitted_table(ui, "test", natural, &GROW)
+                    .header(20.0, |mut header| {
+                        for _ in natural {
+                            header.col(|ui| cells.push(ui.max_rect()));
+                        }
+                    })
+                    .body(|mut body| {
+                        for _ in 0..40 {
+                            body.row(20.0, |mut row| {
+                                for _ in natural {
+                                    row.col(|ui| {
+                                        ui.label("x");
+                                    });
+                                }
+                            });
+                        }
+                    });
+            });
+        });
+        out.drop_without_applying_deltas();
+        cells
+    }
+
+    /// A new context with the table open and settled, and the rects of its header cells.
+    fn opened_table() -> (egui::Context, Vec<egui::Rect>) {
+        let ctx = egui::Context::default();
+        table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
+        let cells = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
+        (ctx, cells)
+    }
+
+    /// Drags a column's right edge, which runs midway through the gap after `cell`, then lets go.
+    fn drag_edge(ctx: &egui::Context, cell: egui::Rect, by: f32) {
+        use egui::{Event, Modifiers, PointerButton};
+        let start = egui::pos2(cell.right() + 4.0, cell.center().y);
+        let halfway = start + egui::vec2(by / 2.0, 0.0);
+        let end = start + egui::vec2(by, 0.0);
+        let moved = Event::PointerMoved;
+        let button = |pos, pressed| Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+        for event in [moved(start), button(start, true), moved(halfway), moved(end), button(end, false)] {
+            table_frame(ctx, WINDOW, &NATURAL, vec![event]);
+        }
+    }
+
+    #[test]
+    fn every_column_can_be_dragged_at_its_right_edge_and_stays_there() {
+        let (_, opened) = opened_table();
+        for (dragged, cell) in opened.iter().enumerate() {
+            let (ctx, _) = opened_table();
+            drag_edge(&ctx, *cell, -30.0);
+            table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
+            let after = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
+            for (column, (was, now)) in opened.iter().zip(&after).enumerate() {
+                let want = if column == dragged { was.width() - 30.0 } else { was.width() };
+                assert!((now.width() - want).abs() < 1.0, "dragging column {dragged}: column {column} is {now:?}, was {was:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn a_changed_fit_replaces_the_column_widths() {
+        let (ctx, opened) = opened_table();
+        drag_edge(&ctx, opened[0], -30.0);
+        let longer_name = table_frame(&ctx, WINDOW, &[200.0, 80.0, 80.0], Vec::new());
+        assert!((longer_name[0].width() - opened[0].width()).abs() < 1.0, "a longer name drops a dragged width: {longer_name:?}");
+        let wider = table_frame(&ctx, WINDOW, &[120.0, 200.0, 80.0], Vec::new());
+        let widths: Vec<f32> = wider.iter().map(|c| c.width().round()).collect();
+        assert!(widths.ends_with(&[200.0, 80.0]), "a longer cell widens its column: {widths:?}");
+        assert!(wider[2].right() < WINDOW, "the table still fits the window: {wider:?}");
+        let narrower = table_frame(&ctx, 400.0, &NATURAL, Vec::new());
+        assert!(narrower[2].right() < 400.0, "a narrower window refits the table: {narrower:?}");
+    }
+
+    #[test]
+    fn scrolling_sideways_keeps_dragged_widths() {
+        let (ctx, opened) = opened_table();
+        drag_edge(&ctx, opened[0], 100.0);
+        table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
+        let dragged = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
+        assert!((dragged[0].width() - opened[0].width() - 100.0).abs() < 1.0, "the drag took: {dragged:?}");
+        for offset in [13.3, 27.77, 41.1, 0.6] {
+            scrolled_frame(&ctx, WINDOW, &NATURAL, offset, Vec::new());
+            let scrolled = scrolled_frame(&ctx, WINDOW, &NATURAL, offset, Vec::new());
+            assert!((scrolled[0].width() - dragged[0].width()).abs() < 1.0, "scrolled {offset}: {scrolled:?}");
+        }
+    }
 }
diff --git a/crates/ui-egui/src/display_gpu.rs b/crates/ui-egui/src/display_gpu.rs
new file mode 100644
index 000000000..f9ddc4aad
--- /dev/null
+++ b/crates/ui-egui/src/display_gpu.rs
@@ -0,0 +1,492 @@
+//! The viewer's display pass on egui-wgpu's device (#2797): a rendered frame (half floats for 32
+//! bpc projects, RGBA8 otherwise) goes through Show Channel, exposure, the pending HDR step and
+//! the display colour (`effectcraft_engine::viewer::DisplayPass`) into one premultiplied RGBA8
+//! texture with mips per viewer, which egui draws like the GPU compositor's frames (native
+//! texture, the Viewer Zoom Quality sampler).
+//!
+//! This is not the compositor's `Gpu` (which may be missing): it needs only egui-wgpu's device.
+//! Without one (no adapter, headless tests, the device retired) the same pass runs on the CPU
+//! (`DisplayPass::pixel`). The shader (`display_gpu.wgsl`) repeats the CPU steps operation by
+//! operation; the tests below hold it to them.
+
+use std::sync::Arc;
+
+use effectcraft_engine::viewer::{Channel, DisplayPass, PassColor, PassConv, PassCurve};
+use eframe::egui_wgpu;
+use eframe::wgpu;
+
+use crate::frames::F16Frame;
+
+const UNIFORM_BYTES: usize = 12 * 16;
+
+/// A frame for the display pass.
+#[derive(Clone)]
+pub enum Source {
+    F16(Arc<F16Frame>),
+    Rgba8(Arc<egui::ColorImage>),
+}
+
+impl Source {
+    fn same(&self, o: &Source) -> bool {
+        match (self, o) {
+            (Source::F16(a), Source::F16(b)) => Arc::ptr_eq(a, b),
+            (Source::Rgba8(a), Source::Rgba8(b)) => Arc::ptr_eq(a, b),
+            _ => false,
+        }
+    }
+
+    pub fn size(&self) -> [usize; 2] {
+        match self {
+            Source::F16(f) => f.size(),
+            Source::Rgba8(c) => c.size,
+        }
+    }
+
+    /// A half-float frame past the texture limit goes through the CPU pass: the display
+    /// conversion (exposure, HDR) comes before the averaging down, as with the 8-bit mips, and
+    /// the GPU would average the scene-linear values first.
+    pub fn needs_cpu_pass(&self, max_side: usize) -> bool {
+        matches!(self, Source::F16(_)) && crate::frames::fit_factor(self.size(), max_side, 1) > 1
+    }
+}
+
+/// The pass's uniform block (`Params` in the shader).
+pub fn uniform(pass: &DisplayPass) -> [u8; UNIFORM_BYTES] {
+    let channel = match pass.channel {
+        Channel::Rgb => 0u32,
+        Channel::Red => 1,
+        Channel::Green => 2,
+        Channel::Blue => 3,
+        Channel::Alpha => 4,
+        Channel::RgbStraight => 5,
+    };
+    let hdr = match pass.encoding.hdr {
+        effectcraft_engine::project::HdrMode::Clip => 0u32,
+        effectcraft_engine::project::HdrMode::Compand => 1,
+        effectcraft_engine::project::HdrMode::ToneMap => 2,
+    };
+    let curve = pass.encoding.curve;
+    let none = PassConv { from: PassCurve::Linear, matrix: None, to: PassCurve::Linear };
+    let (kind, quantize, first, second, lut_n) = match &pass.color {
+        None => (0u32, false, none, None, 2u32),
+        Some(PassColor::Convs { first, quantize, second }) => (1, *quantize, *first, *second, 2),
+        Some(PassColor::Lut(l)) => (2, false, none, None, l.size.max(2) as u32),
+    };
+    let s = second.unwrap_or(none);
+    let mat = |m: Option<[[f32; 3]; 3]>| {
+        let m = m.unwrap_or([[1.0, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]]);
+        m.map(|r| [r[0], r[1], r[2], 0.0])
+    };
+    let [x24, xm2, xm1] = effectcraft_engine::viewer::SHADER_EXPONENTS;
+    let u = |v: u32| v.to_le_bytes();
+    let f = |v: f32| v.to_le_bytes();
+    let mut b = Vec::with_capacity(UNIFORM_BYTES);
+    for v in [
+        channel,
+        pass.colorized as u32,
+        curve.id(),
+        hdr,
+        kind,
+        quantize as u32,
+        second.is_some() as u32,
+        lut_n,
+        first.from.id(),
+        first.to.id(),
+        s.from.id(),
+        s.to.id(),
+    ] {
+        b.extend(u(v));
+    }
+    for v in [
+        pass.gain,
+        curve.decode_param(),
+        first.matrix.is_some() as u32 as f32,
+        s.matrix.is_some() as u32 as f32,
+        first.from.decode_param(),
+        first.to.encode_param(),
+        s.from.decode_param(),
+        s.to.encode_param(),
+        curve.encode_param(),
+        x24,
+        xm2,
+        xm1,
+    ] {
+        b.extend(f(v));
+    }
+    for row in mat(first.matrix).into_iter().chain(mat(s.matrix)) {
+        for v in row {
+            b.extend(f(v));
+        }
+    }
+    let mut out = [0u8; UNIFORM_BYTES];
+    out.copy_from_slice(&b);
+    out
+}
+
+/// Mip levels of a full chain for a `w` × `h` texture.
+fn mip_levels(w: u32, h: u32) -> u32 {
+    32 - w.max(h).max(1).leading_zeros()
+}
+
+/// The display pass's pipelines on one device (made once, kept with the app).
+pub struct DisplayGpu {
+    bake: wgpu::RenderPipeline,
+    mip: wgpu::RenderPipeline,
+    bake_layout: wgpu::BindGroupLayout,
+    mip_layout: wgpu::BindGroupLayout,
+    no_lut: wgpu::TextureView,
+    max_side: u32,
+}
+
+impl DisplayGpu {
+    /// The pipelines, or why the device would not make them (a shader a backend rejects): the
+    /// viewer then runs the pass on the CPU instead of showing nothing.
+    pub fn try_new(device: &wgpu::Device) -> Result<DisplayGpu, String> {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let internal = device.push_error_scope(wgpu::ErrorFilter::Internal);
+            let validation = device.push_error_scope(wgpu::ErrorFilter::Validation);
+            let made = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| DisplayGpu::new(device)));
+            let validation = pollster::block_on(validation.pop());
+            let internal = pollster::block_on(internal.pop());
+            if let Some(e) = validation.or(internal) {
+                return Err(format!("the display pass's pipelines: {e}"));
+            }
+            made.map_err(|_| "the display pass's pipelines: the backend panicked".to_string())
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            Ok(DisplayGpu::new(device))
+        }
+    }
+
+    pub fn new(device: &wgpu::Device) -> DisplayGpu {
+        let module = device.create_shader_module(wgpu::ShaderModuleDescriptor {
+            label: Some("viewer display pass"),
+            source: wgpu::ShaderSource::Wgsl(include_str!("display_gpu.wgsl").into()),
+        });
+        let tex = |binding: u32, dim: wgpu::TextureViewDimension, filterable: bool| wgpu::BindGroupLayoutEntry {
+            binding,
+            visibility: wgpu::ShaderStages::FRAGMENT,
+            ty: wgpu::BindingType::Texture { sample_type: wgpu::TextureSampleType::Float { filterable }, view_dimension: dim, multisampled: false },
+            count: None,
+        };
+        let uniform = wgpu::BindGroupLayoutEntry {
+            binding: 0,
+            visibility: wgpu::ShaderStages::FRAGMENT,
+            ty: wgpu::BindingType::Buffer { ty: wgpu::BufferBindingType::Uniform, has_dynamic_offset: false, min_binding_size: None },
+            count: None,
+        };
+        let bake_layout = device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+            label: Some("viewer display pass"),
+            entries: &[uniform, tex(1, wgpu::TextureViewDimension::D2, false), tex(2, wgpu::TextureViewDimension::D3, false)],
+        });
+        let mip_layout = device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+            label: Some("viewer display mips"),
+            entries: &[tex(1, wgpu::TextureViewDimension::D2, false)],
+        });
+        let pipeline = |label: &str, layout: &wgpu::BindGroupLayout, entry: &str| {
+            let pl =
+                device.create_pipeline_layout(&wgpu::PipelineLayoutDescriptor { label: Some(label), bind_group_layouts: &[Some(layout)], immediate_size: 0 });
+            device.create_render_pipeline(&wgpu::RenderPipelineDescriptor {
+                label: Some(label),
+                layout: Some(&pl),
+                vertex: wgpu::VertexState { module: &module, entry_point: Some("vs"), buffers: &[], compilation_options: Default::default() },
+                fragment: Some(wgpu::FragmentState {
+                    module: &module,
+                    entry_point: Some(entry),
+                    targets: &[Some(wgpu::ColorTargetState { format: wgpu::TextureFormat::Rgba8Unorm, blend: None, write_mask: wgpu::ColorWrites::ALL })],
+                    compilation_options: Default::default(),
+                }),
+                primitive: wgpu::PrimitiveState::default(),
+                depth_stencil: None,
+                multisample: wgpu::MultisampleState::default(),
+                multiview_mask: None,
+                cache: None,
+            })
+        };
+        let no_lut = device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("viewer display LUT (none)"),
+            size: wgpu::Extent3d { width: 1, height: 1, depth_or_array_layers: 1 },
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D3,
+            format: wgpu::TextureFormat::Rgba32Float,
+            usage: wgpu::TextureUsages::TEXTURE_BINDING,
+            view_formats: &[],
+        });
+        DisplayGpu {
+            bake: pipeline("viewer display pass", &bake_layout, "fs"),
+            mip: pipeline("viewer display mips", &mip_layout, "mip"),
+            bake_layout,
+            mip_layout,
+            no_lut: no_lut.create_view(&Default::default()),
+            max_side: device.limits().max_texture_dimension_2d,
+        }
+    }
+
+    /// The largest texture side the device takes.
+    pub fn max_side(&self) -> usize {
+        self.max_side as usize
+    }
+
+    /// `src` in a texture (half floats or RGBA8), averaged down by `k` first when `k > 1`
+    /// (8-bit frames past the texture limit, #201; half-float ones never get here, see
+    /// [`Source::needs_cpu_pass`]): `reuse` when it has the size and format (a playing
+    /// preview's frames), else a new one.
+    fn upload(&self, device: &wgpu::Device, queue: &wgpu::Queue, src: &Source, k: usize, reuse: Option<wgpu::Texture>) -> wgpu::Texture {
+        let write = |w: u32, h: u32, format: wgpu::TextureFormat, bytes: &[u8]| {
+            let (w, h) = (w.max(1), h.max(1));
+            let fits = |t: &wgpu::Texture| t.width() == w && t.height() == h && t.format() == format;
+            let tex = reuse.clone().filter(fits).unwrap_or_else(|| {
+                device.create_texture(&wgpu::TextureDescriptor {
+                    label: Some("viewer frame (display pass input)"),
+                    size: wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
+                    mip_level_count: 1,
+                    sample_count: 1,
+                    dimension: wgpu::TextureDimension::D2,
+                    format,
+                    usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST,
+                    view_formats: &[],
+                })
+            });
+            let px = if format == wgpu::TextureFormat::Rgba16Float { 8 } else { 4 };
+            if bytes.len() as u64 >= w as u64 * h as u64 * px as u64 {
+                queue.write_texture(
+                    wgpu::TexelCopyTextureInfo { texture: &tex, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+                    bytes,
+                    wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(w * px), rows_per_image: Some(h) },
+                    wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
+                );
+            }
+            tex
+        };
+        let f16 = wgpu::TextureFormat::Rgba16Float;
+        let rgba8 = wgpu::TextureFormat::Rgba8Unorm;
+        match src {
+            Source::F16(f) => {
+                debug_assert_eq!(k, 1, "half-float frames past the texture limit take the CPU pass");
+                write(f.width, f.height, f16, bytemuck::cast_slice(f.bits()))
+            }
+            Source::Rgba8(c) if k > 1 => {
+                let c = crate::frames::fit_texture_by((**c).clone(), usize::MAX, k);
+                write(c.size[0] as u32, c.size[1] as u32, rgba8, c.as_raw())
+            }
+            Source::Rgba8(c) => write(c.size[0] as u32, c.size[1] as u32, rgba8, c.as_raw()),
+        }
+    }
+
+    fn lut(&self, device: &wgpu::Device, queue: &wgpu::Queue, lut: &effectcraft_engine::color::icc::Lut3d) -> wgpu::Texture {
+        let n = lut.size.max(2) as u32;
+        let tex = device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("viewer display LUT"),
+            size: wgpu::Extent3d { width: n, height: n, depth_or_array_layers: n },
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D3,
+            format: wgpu::TextureFormat::Rgba32Float,
+            usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST,
+            view_formats: &[],
+        });
+        // data[(r · n + g) · n + b]: x = b, y = g, z = r.
+        let mut texels: Vec<f32> = Vec::with_capacity((n * n * n * 4) as usize);
+        for i in 0..(n * n * n) as usize {
+            let v = lut.data.get(i).copied().unwrap_or_default();
+            texels.extend([v[0], v[1], v[2], 1.0]);
+        }
+        queue.write_texture(
+            wgpu::TexelCopyTextureInfo { texture: &tex, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+            bytemuck::cast_slice(&texels),
+            wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(n * 16), rows_per_image: Some(n) },
+            wgpu::Extent3d { width: n, height: n, depth_or_array_layers: n },
+        );
+        tex
+    }
+
+    /// The display texture for `input`: premultiplied RGBA8, a full mip chain.
+    fn output(device: &wgpu::Device, w: u32, h: u32) -> wgpu::Texture {
+        device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("viewer frame (displayed)"),
+            size: wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
+            mip_level_count: mip_levels(w, h),
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D2,
+            format: wgpu::TextureFormat::Rgba8Unorm,
+            usage: wgpu::TextureUsages::RENDER_ATTACHMENT | wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_SRC,
+            view_formats: &[],
+        })
+    }
+
+    /// Run the pass from `input` into level 0 of `out`, then fill its mips.
+    fn run(
+        &self,
+        device: &wgpu::Device,
+        queue: &wgpu::Queue,
+        input: &wgpu::Texture,
+        out: &wgpu::Texture,
+        params: &[u8; UNIFORM_BYTES],
+        lut: Option<&wgpu::Texture>,
+    ) {
+        use wgpu::util::DeviceExt as _;
+        let buf = device.create_buffer_init(&wgpu::util::BufferInitDescriptor {
+            label: Some("viewer display pass"),
+            contents: params,
+            usage: wgpu::BufferUsages::UNIFORM,
+        });
+        let input_view = input.create_view(&Default::default());
+        let lut_view = lut.map(|l| l.create_view(&Default::default()));
+        let bake = device.create_bind_group(&wgpu::BindGroupDescriptor {
+            label: Some("viewer display pass"),
+            layout: &self.bake_layout,
+            entries: &[
+                wgpu::BindGroupEntry { binding: 0, resource: buf.as_entire_binding() },
+                wgpu::BindGroupEntry { binding: 1, resource: wgpu::BindingResource::TextureView(&input_view) },
+                wgpu::BindGroupEntry { binding: 2, resource: wgpu::BindingResource::TextureView(lut_view.as_ref().unwrap_or(&self.no_lut)) },
+            ],
+        });
+        let level = |l: u32| out.create_view(&wgpu::TextureViewDescriptor { base_mip_level: l, mip_level_count: Some(1), ..Default::default() });
+        let mut enc = device.create_command_encoder(&wgpu::CommandEncoderDescriptor { label: Some("viewer display pass") });
+        let pass = |enc: &mut wgpu::CommandEncoder, target: &wgpu::TextureView, pipeline: &wgpu::RenderPipeline, bg: &wgpu::BindGroup| {
+            let mut p = enc.begin_render_pass(&wgpu::RenderPassDescriptor {
+                label: Some("viewer display pass"),
+                color_attachments: &[Some(wgpu::RenderPassColorAttachment {
+                    view: target,
+                    depth_slice: None,
+                    resolve_target: None,
+                    ops: wgpu::Operations { load: wgpu::LoadOp::Clear(wgpu::Color::TRANSPARENT), store: wgpu::StoreOp::Store },
+                })],
+                ..Default::default()
+            });
+            p.set_pipeline(pipeline);
+            p.set_bind_group(0, bg, &[]);
+            p.draw(0..3, 0..1);
+        };
+        pass(&mut enc, &level(0), &self.bake, &bake);
+        for l in 1..out.mip_level_count() {
+            let above = level(l - 1);
+            let bg = device.create_bind_group(&wgpu::BindGroupDescriptor {
+                label: Some("viewer display mips"),
+                layout: &self.mip_layout,
+                entries: &[wgpu::BindGroupEntry { binding: 1, resource: wgpu::BindingResource::TextureView(&above) }],
+            });
+            pass(&mut enc, &level(l), &self.mip, &bg);
+        }
+        queue.submit([enc.finish()]);
+    }
+}
+
+/// One viewer's displayed texture (the Composition viewer, a passive viewer, the snapshot): the
+/// frame it was made from and the pass's uniform, so it runs again only when either changes.
+#[derive(Default)]
+pub struct Bake {
+    source: Option<Source>,
+    /// Averaged down by this for the texture limit (1: not).
+    factor: usize,
+    input: Option<wgpu::Texture>,
+    output: Option<wgpu::Texture>,
+    id: Option<egui::TextureId>,
+    params: Option<[u8; UNIFORM_BYTES]>,
+    lut: Option<(Arc<effectcraft_engine::color::icc::Lut3d>, wgpu::Texture)>,
+    smooth: Option<bool>,
+    /// How often the pass ran (tests).
+    runs: u64,
+}
+
+impl Bake {
+    /// The egui texture showing `src` through `pass` (sampled with the Viewer Zoom Quality's
+    /// sampler for `smooth`), running the pass again when the frame or the pass changed.
+    pub fn show(&mut self, rs: &egui_wgpu::RenderState, gpu: &DisplayGpu, src: &Source, pass: &DisplayPass, smooth: bool) -> Option<egui::TextureId> {
+        if src.needs_cpu_pass(gpu.max_side()) {
+            return None;
+        }
+        let (device, queue) = (&rs.device, &rs.queue);
+        let params = uniform(pass);
+        let new_source = !self.source.as_ref().is_some_and(|s| s.same(src));
+        if new_source {
+            self.factor = crate::frames::fit_factor(src.size(), gpu.max_side(), 1);
+            self.input = Some(gpu.upload(device, queue, src, self.factor, self.input.take()));
+            self.source = Some(src.clone());
+        }
+        let lut = match &pass.color {
+            Some(PassColor::Lut(l)) => Some(l.clone()),
+            _ => None,
+        };
+        // A new LUT (another profile, Preserve RGB, another display) has the same size, so the
+        // uniform alone doesn't tell: it reruns the pass itself.
+        let new_lut = match (&lut, &self.lut) {
+            (Some(l), Some((have, _))) if Arc::ptr_eq(l, have) => false,
+            (Some(l), _) => {
+                self.lut = Some((l.clone(), gpu.lut(device, queue, l)));
+                true
+            }
+            (None, had) => {
+                let changed = had.is_some();
+                self.lut = None;
+                changed
+            }
+        };
+        let input = self.input.as_ref()?;
+        let (w, h) = (input.width(), input.height());
+        let resized = self.output.as_ref().is_none_or(|o| o.width() != w || o.height() != h);
+        if resized {
+            self.output = Some(DisplayGpu::output(device, w, h));
+        }
+        let output = self.output.as_ref()?;
+        if new_source || resized || new_lut || self.params != Some(params) {
+            gpu.run(device, queue, input, output, &params, self.lut.as_ref().map(|(_, t)| t));
+            self.params = Some(params);
+            self.runs += 1;
+        }
+        let view = output.create_view(&Default::default());
+        let sampler = || crate::panels::viewer::zoom_sampler(smooth);
+        let mut ren = rs.renderer.write();
+        let id = match self.id {
+            Some(id) if !resized && self.smooth == Some(smooth) => id,
+            Some(id) => {
+                ren.update_egui_texture_from_wgpu_texture_with_sampler_options(device, &view, sampler(), id);
+                id
+            }
+            None => ren.register_native_texture_with_sampler_options(device, &view, sampler()),
+        };
+        self.id = Some(id);
+        self.smooth = Some(smooth);
+        Some(id)
+    }
+
+    /// The texture egui draws, once [`Bake::show`] made it.
+    pub fn id(&self) -> Option<egui::TextureId> {
+        self.id
+    }
+
+    /// The frame shown (the one last given to [`Bake::show`]).
+    pub fn source(&self) -> Option<&Source> {
+        self.source.as_ref()
+    }
+
+    /// The texture coordinates of the frame in its texture (see `frames::fitted_uv`).
+    pub fn uv(&self) -> egui::Rect {
+        let size = self.source.as_ref().map_or([1, 1], Source::size);
+        crate::frames::fitted_uv(size, self.factor.max(1))
+    }
+
+    /// Give the texture back to the renderer.
+    pub fn free(&mut self, rs: Option<&egui_wgpu::RenderState>) {
+        if let (Some(id), Some(rs)) = (self.id.take(), rs) {
+            rs.renderer.write().free_texture(&id);
+        }
+        *self = Bake::default();
+    }
+
+    /// How often the pass ran for this slot.
+    pub fn runs(&self) -> u64 {
+        self.runs
+    }
+
+    /// The displayed texture (tests read it back).
+    pub fn texture(&self) -> Option<&wgpu::Texture> {
+        self.output.as_ref()
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/display_gpu.wgsl b/crates/ui-egui/src/display_gpu.wgsl
new file mode 100644
index 000000000..7e8163431
--- /dev/null
+++ b/crates/ui-egui/src/display_gpu.wgsl
@@ -0,0 +1,314 @@
+// The viewer's display pass (#2797): a rendered frame (premultiplied, encoded in the output
+// space; Rgba16Float for 32 bpc frames, Rgba8Unorm otherwise) → the premultiplied RGBA8 texture
+// the viewer draws. Line by line the same operations as `effectcraft_engine::viewer::DisplayPass`
+// (its `pixel` is this shader's CPU reference and fallback):
+// unpremultiply → decode, × 2^stops, Compand / Tone Map, encode → clamp → display colour →
+// Show Channel, premultiply → floor(v · 255 + 0.5).
+
+struct Params {
+    // channel (0 RGB, 1 R, 2 G, 3 B, 4 A, 5 RGB Straight), colorized, frame curve, HDR step
+    // (0 none, 1 Compand, 2 Tone Map)
+    ids0: vec4<u32>,
+    // display colour (0 none, 1 conversions, 2 LUT), 8-bit device numbers, a second conversion,
+    // LUT size
+    ids1: vec4<u32>,
+    // curves: first conversion's decode and encode, second conversion's decode and encode
+    ids2: vec4<u32>,
+    // gain (2^stops), frame curve's gamma, first / second conversion has a matrix (1.0)
+    vals0: vec4<f32>,
+    // gammas of the ids2 curves (encoding: 1 / gamma)
+    vals1: vec4<f32>,
+    // 1 / the frame curve's gamma, 1 / 2.4, 1 / PQ m2, 1 / PQ m1: divided on the CPU, as the
+    // reference does, so the exponents are the same bits
+    vals2: vec4<f32>,
+    m1: array<vec4<f32>, 3>,
+    m2: array<vec4<f32>, 3>,
+};
+
+@group(0) @binding(0) var<uniform> P: Params;
+@group(0) @binding(1) var frame: texture_2d<f32>;
+@group(0) @binding(2) var lut: texture_3d<f32>;
+
+@vertex
+fn vs(@builtin(vertex_index) i: u32) -> @builtin(position) vec4<f32> {
+    // One triangle covering the target.
+    let x = f32((i << 1u) & 2u);
+    let y = f32(i & 2u);
+    return vec4<f32>(x * 2.0 - 1.0, 1.0 - y * 2.0, 0.0, 1.0);
+}
+
+// The curves take the gamma to decode with, or 1 / gamma to encode with.
+// SMPTE ST 2084 and BT.2100 HLG (effectcraft_color::space), linear 1.0 = reference white.
+const PQ_M1: f32 = 0.1593017578125;
+const PQ_M2: f32 = 78.84375;
+const PQ_C1: f32 = 0.8359375;
+const PQ_C2: f32 = 18.8515625;
+const PQ_C3: f32 = 18.6875;
+const PQ_WHITE: f32 = 0.0203;
+const HLG_A: f32 = 0.17883277;
+const HLG_B: f32 = 0.28466892;
+const HLG_C: f32 = 0.55991073;
+const HLG_REFERENCE: f32 = 0.26496256;
+
+fn power(a: f32, g: f32) -> f32 {
+    if (a <= 0.0) {
+        return 0.0;
+    }
+    return pow(a, g);
+}
+
+fn copysign(m: f32, v: f32) -> f32 {
+    if (v < 0.0) {
+        return -m;
+    }
+    return m;
+}
+
+fn decode(curve: u32, g: f32, v: f32) -> f32 {
+    let a = abs(v);
+    var l = a;
+    switch curve {
+        case 1u: {
+            if (a <= 0.04045) {
+                l = a / 12.92;
+            } else {
+                l = power((a + 0.055) / 1.055, 2.4);
+            }
+        }
+        case 2u: {
+            l = power(a, g);
+        }
+        case 3u: {
+            let p = power(min(a, 1.0), P.vals2.z);
+            l = power(max(p - PQ_C1, 0.0) / (PQ_C2 - PQ_C3 * p), P.vals2.w) / PQ_WHITE;
+        }
+        case 4u: {
+            var e: f32;
+            if (a <= 0.5) {
+                e = a * a / 3.0;
+            } else {
+                e = (exp((a - HLG_C) / HLG_A) + HLG_B) / 12.0;
+            }
+            l = e / HLG_REFERENCE;
+        }
+        default: {}
+    }
+    return copysign(l, v);
+}
+
+fn encode(curve: u32, g: f32, v: f32) -> f32 {
+    let a = abs(v);
+    var e = a;
+    switch curve {
+        case 1u: {
+            if (a <= 0.0031308) {
+                e = a * 12.92;
+            } else {
+                e = 1.055 * power(a, P.vals2.y) - 0.055;
+            }
+        }
+        case 2u: {
+            e = power(a, g);
+        }
+        case 3u: {
+            let y = power(a * PQ_WHITE, PQ_M1);
+            e = power((PQ_C1 + PQ_C2 * y) / (1.0 + PQ_C3 * y), PQ_M2);
+        }
+        case 4u: {
+            let s = a * HLG_REFERENCE;
+            if (s <= 1.0 / 12.0) {
+                e = sqrt(3.0 * s);
+            } else {
+                e = HLG_A * log(12.0 * s - HLG_B) + HLG_C;
+            }
+        }
+        default: {}
+    }
+    return copysign(e, v);
+}
+
+fn decode3(curve: u32, g: f32, c: vec3<f32>) -> vec3<f32> {
+    return vec3<f32>(decode(curve, g, c.x), decode(curve, g, c.y), decode(curve, g, c.z));
+}
+
+fn encode3(curve: u32, g: f32, c: vec3<f32>) -> vec3<f32> {
+    return vec3<f32>(encode(curve, g, c.x), encode(curve, g, c.y), encode(curve, g, c.z));
+}
+
+fn mat_mul(m: array<vec4<f32>, 3>, l: vec3<f32>) -> vec3<f32> {
+    return vec3<f32>(
+        m[0].x * l.x + m[0].y * l.y + m[0].z * l.z,
+        m[1].x * l.x + m[1].y * l.y + m[1].z * l.z,
+        m[2].x * l.x + m[2].y * l.y + m[2].z * l.z,
+    );
+}
+
+// effectcraft_render::color::compand
+fn compand(v: f32) -> f32 {
+    let k = 0.8;
+    if (v <= k) {
+        return v;
+    }
+    return k + (1.0 - k) * (1.0 - exp(-(v - k) / (1.0 - k)));
+}
+
+// effectcraft_render::color::tone_map (extended Reinhard of Rec. 709 luminance, white 4.0)
+fn tone_map(c: vec3<f32>) -> vec3<f32> {
+    let w = 4.0;
+    let l = 0.2126 * c.x + 0.7152 * c.y + 0.0722 * c.z;
+    if (l <= 0.0) {
+        return c;
+    }
+    let lm = l * (1.0 + l / (w * w)) / (1.0 + l);
+    let k = lm / l;
+    return c * k;
+}
+
+fn lut_at(n: u32, r: u32, g: u32, b: u32) -> vec3<f32> {
+    return textureLoad(lut, vec3<u32>(b, g, r), 0).xyz;
+}
+
+// effectcraft_engine::viewer::lut_eval: trilinear in the same order.
+fn lut_eval(c: vec3<f32>) -> vec3<f32> {
+    let n = P.ids1.w;
+    let x = clamp(c, vec3<f32>(0.0), vec3<f32>(1.0)) * f32(n - 1u);
+    let k = min(vec3<u32>(floor(x)), vec3<u32>(n - 2u));
+    let f = x - vec3<f32>(k);
+    var out = vec3<f32>(0.0);
+    for (var corner = 0u; corner < 8u; corner++) {
+        let d = vec3<u32>((corner >> 2u) & 1u, (corner >> 1u) & 1u, corner & 1u);
+        var wr = 1.0 - f.x;
+        if (d.x == 1u) {
+            wr = f.x;
+        }
+        var wg = 1.0 - f.y;
+        if (d.y == 1u) {
+            wg = f.y;
+        }
+        var wb = 1.0 - f.z;
+        if (d.z == 1u) {
+            wb = f.z;
+        }
+        let w = wr * wg * wb;
+        out = out + w * lut_at(n, k.x + d.x, k.y + d.y, k.z + d.z);
+    }
+    return out;
+}
+
+fn display_colour(c: vec3<f32>) -> vec3<f32> {
+    var o = c;
+    if (P.ids1.x == 2u) {
+        o = lut_eval(c);
+    } else if (P.ids1.x == 1u) {
+        o = decode3(P.ids2.x, P.vals1.x, o);
+        if (P.vals0.z == 1.0) {
+            o = mat_mul(P.m1, o);
+        }
+        o = encode3(P.ids2.y, P.vals1.y, o);
+        if (P.ids1.y == 1u) {
+            o = floor(clamp(o, vec3<f32>(0.0), vec3<f32>(1.0)) * 255.0 + 0.5) / 255.0;
+        }
+        if (P.ids1.z == 1u) {
+            o = decode3(P.ids2.z, P.vals1.z, o);
+            if (P.vals0.w == 1.0) {
+                o = mat_mul(P.m2, o);
+            }
+            o = encode3(P.ids2.w, P.vals1.w, o);
+        }
+    }
+    return clamp(o, vec3<f32>(0.0), vec3<f32>(1.0));
+}
+
+fn q(v: f32) -> f32 {
+    return floor(clamp(v, 0.0, 1.0) * 255.0 + 0.5) / 255.0;
+}
+
+@fragment
+fn fs(@builtin(position) pos: vec4<f32>) -> @location(0) vec4<f32> {
+    let s = textureLoad(frame, vec2<i32>(floor(pos.xy)), 0);
+    // Frames are never NaN here: `frames::F16Frame` and 8-bit frames hold finite values only
+    // (the NaN test is the reference's, kept for safety; WGSL may drop it). Alpha is clamped to
+    // 0..1 first, as `display_pixel` and `DisplayPass::pixel` do (the compositor's alpha never
+    // exceeds 1).
+    var a = s.w;
+    if (!(a == a)) {
+        a = 0.0;
+    }
+    a = clamp(a, 0.0, 1.0);
+    var c = vec3<f32>(0.0);
+    if (a > 0.0) {
+        c = s.xyz / a;
+    }
+    let channel = P.ids0.x;
+    let curve = P.ids0.z;
+    let g = P.vals0.y;
+    let gain = P.vals0.x;
+    let light = gain != 1.0 || P.ids0.w != 0u;
+    // Premultiplied channels without exposure or HDR step: straight from the frame.
+    var pm = clamp(s.xyz, vec3<f32>(0.0), vec3<f32>(a));
+    if (light) {
+        var l = decode3(curve, g, c) * gain;
+        if (P.ids0.w == 1u) {
+            l = vec3<f32>(compand(l.x), compand(l.y), compand(l.z));
+        } else if (P.ids0.w == 2u) {
+            l = tone_map(l);
+        }
+        c = encode3(curve, P.vals2.x, l);
+    }
+    c = clamp(c, vec3<f32>(0.0), vec3<f32>(1.0));
+    if (light) {
+        pm = c * a;
+    }
+    if (channel == 0u || channel == 5u) {
+        if (P.ids1.x != 0u) {
+            c = display_colour(c);
+            pm = c * a;
+        }
+        if (channel == 5u) {
+            return vec4<f32>(q(c.x), q(c.y), q(c.z), 1.0);
+        }
+        return vec4<f32>(q(pm.x), q(pm.y), q(pm.z), q(a));
+    }
+    if (channel == 4u) {
+        var v = a;
+        if (gain != 1.0) {
+            v = encode(curve, P.vals2.x, decode(curve, g, a) * gain);
+        }
+        let e = q(v);
+        return vec4<f32>(e, e, e, 1.0);
+    }
+    let v = q(pm[channel - 1u]);
+    if (P.ids0.y == 1u) {
+        var o = vec4<f32>(0.0, 0.0, 0.0, 1.0);
+        o[channel - 1u] = v;
+        return o;
+    }
+    return vec4<f32>(v, v, v, 1.0);
+}
+
+// The next mip level of the displayed texture (`frame` = the level above): each texel the mean
+// of the premultiplied texels it covers, 2 × 2, and at the right / bottom edge of a level above
+// of odd size also its last column / row (3 wide or high), so no texel of the frame is dropped
+// (the level sizes are the GPU's, rounded down). Rounded as the pass rounds.
+@fragment
+fn mip(@builtin(position) pos: vec4<f32>) -> @location(0) vec4<f32> {
+    let above = vec2<i32>(textureDimensions(frame));
+    let size = max(above / 2, vec2<i32>(1));
+    let p = vec2<i32>(floor(pos.xy));
+    let lo = min(p * 2, above - vec2<i32>(1));
+    var hi = min(p * 2 + vec2<i32>(2), above);
+    if (p.x == size.x - 1) {
+        hi.x = above.x;
+    }
+    if (p.y == size.y - 1) {
+        hi.y = above.y;
+    }
+    var s = vec4<f32>(0.0);
+    for (var y = lo.y; y < hi.y; y++) {
+        for (var x = lo.x; x < hi.x; x++) {
+            s = s + textureLoad(frame, vec2<i32>(x, y), 0);
+        }
+    }
+    let n = f32((hi.x - lo.x) * (hi.y - lo.y));
+    return floor(s / n * 255.0 + 0.5) / 255.0;
+}
diff --git a/crates/ui-egui/src/display_gpu/tests.rs b/crates/ui-egui/src/display_gpu/tests.rs
new file mode 100644
index 000000000..b77e34576
--- /dev/null
+++ b/crates/ui-egui/src/display_gpu/tests.rs
@@ -0,0 +1,584 @@
+//! The display pass on a real device (any wgpu adapter; CI runs lavapipe), held to its CPU
+//! reference `DisplayPass::pixel`. Skips without an adapter.
+
+use std::sync::{Arc, Mutex};
+
+use effectcraft_engine::project::HdrMode;
+use effectcraft_engine::render::Image;
+use effectcraft_engine::viewer::{Channel, DisplayColor, DisplayPass, FrameEncoding, PassCurve, SimProfile, Simulation};
+use eframe::egui_wgpu;
+use eframe::wgpu;
+
+use super::{DisplayGpu, Source};
+use crate::frames::F16Frame;
+
+/// One device at a time (tests run in parallel).
+static DEVICE: Mutex<()> = Mutex::new(());
+
+struct Dev {
+    instance: wgpu::Instance,
+    adapter: wgpu::Adapter,
+    device: wgpu::Device,
+    queue: wgpu::Queue,
+    /// A software rasterizer (lavapipe / llvmpipe, as CI has): its pow / exp / division round
+    /// differently again, so exact comparisons allow 1 LSB on a few bytes there.
+    cpu: bool,
+}
+
+fn device() -> Option<Dev> {
+    let instance = wgpu::Instance::new(wgpu::InstanceDescriptor::new_without_display_handle().with_env());
+    let adapter = pollster::block_on(instance.request_adapter(&wgpu::RequestAdapterOptions::default())).ok()?;
+    let (device, queue) =
+        pollster::block_on(adapter.request_device(&wgpu::DeviceDescriptor { label: Some("display pass tests"), ..Default::default() })).ok()?;
+    let info = adapter.get_info();
+    eprintln!("display pass tests on {:?} ({:?})", info.name, info.device_type);
+    // (macOS CI runners' Metal is a virtual "Apple Paravirtual device": it rounds like a software one)
+    let cpu = info.device_type == wgpu::DeviceType::Cpu || info.name.contains("Paravirtual");
+    Some(Dev { cpu, instance, adapter, device, queue })
+}
+
+/// `compare`'s result is exact, or (software rasterizers) at most 1 LSB on at most 1 % of bytes.
+fn exact_enough(d: &Dev, (n, max): (usize, i32), bytes: usize) -> bool {
+    (n, max) == (0, 0) || d.cpu && max <= 1 && n * 100 <= bytes
+}
+
+/// egui-wgpu's render state on the test device, as eframe hands it to the app.
+fn render_state(d: &Dev) -> egui_wgpu::RenderState {
+    let renderer = egui_wgpu::Renderer::new(&d.device, wgpu::TextureFormat::Rgba8Unorm, egui_wgpu::RendererOptions::default());
+    egui_wgpu::RenderState {
+        adapter: d.adapter.clone(),
+        available_adapters: vec![d.adapter.clone()],
+        instance: d.instance.clone(),
+        device: d.device.clone(),
+        queue: d.queue.clone(),
+        target_format: wgpu::TextureFormat::Rgba8Unorm,
+        renderer: Arc::new(egui::mutex::RwLock::new(renderer)),
+    }
+}
+
+/// A 17³ LUT that mixes channels and bends the curve (as an ICC profile's device does).
+fn test_lut(k: f64) -> Arc<effectcraft_engine::color::icc::Lut3d> {
+    Arc::new(effectcraft_engine::color::icc::Lut3d::bake(17, |c| {
+        [c[0].powf(1.3) * 0.9 + c[1] * 0.1, c[1] * 0.8 + c[2] * 0.2, (c[2] * 0.7 + c[0] * 0.3).sqrt() * k]
+    }))
+}
+
+fn read(d: &Dev, tex: &wgpu::Texture, level: u32) -> (Vec<[u8; 4]>, [u32; 2]) {
+    let (w, h) = ((tex.width() >> level).max(1), (tex.height() >> level).max(1));
+    let stride = (w * 4).div_ceil(256) * 256;
+    let buf = d.device.create_buffer(&wgpu::BufferDescriptor {
+        label: None,
+        size: (stride * h) as u64,
+        usage: wgpu::BufferUsages::MAP_READ | wgpu::BufferUsages::COPY_DST,
+        mapped_at_creation: false,
+    });
+    let mut e = d.device.create_command_encoder(&Default::default());
+    e.copy_texture_to_buffer(
+        wgpu::TexelCopyTextureInfo { texture: tex, mip_level: level, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+        wgpu::TexelCopyBufferInfo { buffer: &buf, layout: wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(stride), rows_per_image: Some(h) } },
+        wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
+    );
+    d.queue.submit([e.finish()]);
+    buf.slice(..).map_async(wgpu::MapMode::Read, |r| r.expect("map"));
+    d.device.poll(wgpu::PollType::wait_indefinitely()).expect("poll");
+    let data = buf.slice(..).get_mapped_range().expect("mapped").to_vec();
+    let mut out = Vec::with_capacity((w * h) as usize);
+    for y in 0..h {
+        let row = &data[(y * stride) as usize..][..(w * 4) as usize];
+        out.extend(row.as_chunks::<4>().0.iter().copied());
+    }
+    (out, [w, h])
+}
+
+/// The pass on the device: level 0 of the displayed texture, and the texture.
+fn bake(d: &Dev, gpu: &DisplayGpu, src: &Source, pass: &DisplayPass) -> (Vec<[u8; 4]>, wgpu::Texture) {
+    let k = crate::frames::fit_factor(src.size(), gpu.max_side(), 1);
+    let input = gpu.upload(&d.device, &d.queue, src, k, None);
+    let out = DisplayGpu::output(&d.device, input.width(), input.height());
+    let lut = match &pass.color {
+        Some(effectcraft_engine::viewer::PassColor::Lut(l)) => Some(gpu.lut(&d.device, &d.queue, l)),
+        _ => None,
+    };
+    gpu.run(&d.device, &d.queue, &input, &out, &super::uniform(pass), lut.as_ref());
+    (read(d, &out, 0).0, out)
+}
+
+fn frame(px: &[[f32; 4]], w: u32, encoding: FrameEncoding) -> Arc<F16Frame> {
+    let mut img = Image::new(w, px.len() as u32 / w);
+    img.data.copy_from_slice(px);
+    Arc::new(F16Frame::from_image(&img, encoding))
+}
+
+/// GPU output against the reference on the frame's own (half-float) values: the number of
+/// bytes that differ and the largest difference.
+fn compare(got: &[[u8; 4]], f: &F16Frame, pass: &DisplayPass) -> (usize, i32) {
+    let (mut n, mut max) = (0, 0);
+    for (i, g) in got.iter().enumerate() {
+        let want = pass.pixel(f.pixel(i).expect("pixel"));
+        for c in 0..4 {
+            let d = (g[c] as i32 - want[c] as i32).abs();
+            if d > 0 {
+                n += 1;
+                max = max.max(d);
+            }
+        }
+    }
+    (n, max)
+}
+
+const SRGB: FrameEncoding = FrameEncoding { curve: PassCurve::Srgb, hdr: HdrMode::Clip };
+
+fn grey(l: f32) -> [f32; 4] {
+    let e = PassCurve::Srgb.encode(l);
+    [e, e, e, 1.0]
+}
+
+/// The issue's values (4.0 at -2 EV is white, 0.5 at +1 EV is white) and the HDR golden table,
+/// bit for bit on the GPU.
+#[test]
+fn hdr_values_on_the_gpu() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    let ls = [0.25f32, 0.5, 1.0, 2.0, 4.0, 16.0];
+    let f = frame(&ls.map(grey), 6, SRGB);
+    let want: [[u8; 6]; 5] = [
+        [137, 188, 255, 255, 255, 255],
+        [99, 137, 188, 255, 255, 255],
+        [71, 99, 137, 188, 255, 255],
+        [34, 49, 71, 99, 137, 255],
+        [188, 255, 255, 255, 255, 255],
+    ];
+    for (stops, w) in [0.0f32, -1.0, -2.0, -4.0, 1.0].into_iter().zip(want) {
+        let pass = DisplayPass::new(Channel::Rgb, false, stops, SRGB, None);
+        let (got, _) = bake(&d, &gpu, &Source::F16(f.clone()), &pass);
+        let r: Vec<u8> = got.iter().map(|p| p[0]).collect();
+        assert!(r.iter().zip(w).all(|(g, w)| *g == w || d.cpu && g.abs_diff(w) <= 1), "{stops} EV: {r:?} vs {w:?}");
+        let c = compare(&got, &f, &pass);
+        assert!(c == (0, 0) || d.cpu && c.1 <= 1, "{stops} EV: {c:?}");
+    }
+}
+
+/// Exposure 0 on half floats: bit for bit the reference, and the bytes the 8-bit viewer showed
+/// for values in 0..1 (at least 97.9 % equal, never more than 1 apart: the half-float storage).
+#[test]
+fn exposure_zero_parity_on_the_gpu() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    let pass = DisplayPass::new(Channel::Rgb, false, 0.0, SRGB, None);
+    for alpha in [1.0f32, 0.5] {
+        let img = crate::frames::tests::parity_frame(alpha);
+        let f = Arc::new(F16Frame::from_image(&img, SRGB));
+        let (got, _) = bake(&d, &gpu, &Source::F16(f.clone()), &pass);
+        let c = compare(&got, &f, &pass);
+        assert!(exact_enough(&d, c, got.len() * 4), "alpha {alpha}: {c:?}");
+        let old = crate::frames::to_color_image(&img);
+        let (mut same, mut max) = (0, 0);
+        for (g, o) in got.iter().zip(&old.pixels) {
+            let o = o.to_array();
+            for c in 0..3 {
+                same += (g[c] == o[c]) as usize;
+                max = max.max((g[c] as i32 - o[c] as i32).abs());
+            }
+            assert_eq!(g[3], o[3]);
+        }
+        let share = same as f64 / (got.len() * 3) as f64;
+        eprintln!("GPU, alpha {alpha}: {:.2} % of colour bytes as before, max {max}", share * 100.0);
+        assert!(share >= 0.979 && max <= 1, "alpha {alpha}: {share}, max {max}");
+    }
+    // The issue's two values, exactly.
+    let f = frame(&[grey(4.0), grey(0.5)], 2, SRGB);
+    let (m2, _) = bake(&d, &gpu, &Source::F16(f.clone()), &DisplayPass::new(Channel::Rgb, false, -2.0, SRGB, None));
+    let (p1, _) = bake(&d, &gpu, &Source::F16(f), &DisplayPass::new(Channel::Rgb, false, 1.0, SRGB, None));
+    let white = |p: [u8; 4]| p.iter().all(|c| *c == 255 || d.cpu && *c >= 254);
+    assert!(white(m2[0]) && white(p1[1]), "{:?} {:?}", m2[0], p1[1]);
+}
+
+/// Every pass setting the viewer has, against the reference on the same half-float input:
+/// exposure, HDR step (after exposure), Show Channel, curves and display colour.
+#[test]
+fn the_shader_is_the_reference() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    // 64 × 64: colours 0..2 in every channel, alpha 1, 0.5 and a few others, some over range.
+    let px: Vec<[f32; 4]> = (0..64 * 64)
+        .map(|i| {
+            let (x, y) = (i % 64, i / 64);
+            let a = [1.0, 0.5, 0.25, 0.8, 1.0, 1.0, 0.0, 1.0][y % 8];
+            // Row 5: negative values too (32 bpc frames can hold them).
+            let lo = if y % 8 == 5 { 0.75 } else { 0.0 };
+            let v = |k: usize| ((x * 7 + y * k) % 64) as f32 / 32.0 - lo;
+            [v(3) * a, v(5) * a, v(11) * a, a]
+        })
+        .collect();
+    let dcs = [
+        None,
+        DisplayColor::new(
+            Some(effectcraft_engine::project::ColorSpace::Srgb),
+            false,
+            effectcraft_engine::project::ColorSpace::Srgb,
+            true,
+            effectcraft_engine::project::ColorSpace::DisplayP3,
+            Simulation::default(),
+            &Default::default(),
+        ),
+        DisplayColor::new(
+            Some(effectcraft_engine::project::ColorSpace::Srgb),
+            false,
+            effectcraft_engine::project::ColorSpace::Srgb,
+            true,
+            effectcraft_engine::project::ColorSpace::Srgb,
+            Simulation { profile: SimProfile::Rec709, preserve_rgb: false },
+            &Default::default(),
+        ),
+        DisplayColor::new(
+            Some(effectcraft_engine::project::ColorSpace::Srgb),
+            false,
+            effectcraft_engine::project::ColorSpace::Srgb,
+            true,
+            effectcraft_engine::project::ColorSpace::DisplayP3,
+            Simulation { profile: SimProfile::Mac18, preserve_rgb: true },
+            &Default::default(),
+        ),
+        // A LUT-based My Custom RGB profile.
+        Some(DisplayColor::from_lut(test_lut(1.0))),
+    ];
+    let (mut report, mut off, mut total) = (vec![], 0usize, 0usize);
+    for curve in [PassCurve::Srgb, PassCurve::Gamma(2.4), PassCurve::Linear, PassCurve::Pq, PassCurve::Hlg] {
+        for hdr in [HdrMode::Clip, HdrMode::Compand, HdrMode::ToneMap] {
+            let enc = FrameEncoding { curve, hdr };
+            let f = frame(&px, 64, enc);
+            for stops in [0.0f32, 1.0, -2.0, 2.5] {
+                for (ci, dc) in dcs.iter().enumerate() {
+                    for (channel, colorized) in
+                        [(Channel::Rgb, false), (Channel::RgbStraight, false), (Channel::Red, false), (Channel::Green, true), (Channel::Alpha, false)]
+                    {
+                        if ci > 0 && !matches!(channel, Channel::Rgb) {
+                            continue;
+                        }
+                        let pass = DisplayPass::new(channel, colorized, stops, enc, dc.as_ref());
+                        let (got, _) = bake(&d, &gpu, &Source::F16(f.clone()), &pass);
+                        let (n, max) = compare(&got, &f, &pass);
+                        // The device's pow / exp / ln / division are not the CPU's to the last
+                        // bit: a value on a rounding tie can land either side of it.
+                        // PQ's exponent of 78.8 magnifies those last bits most.
+                        // Software rasterizers (CI's lavapipe) differ more.
+                        let share = if matches!(curve, PassCurve::Pq | PassCurve::Hlg) { 5 } else { 1 } * if d.cpu { 5 } else { 1 };
+                        assert!(max <= 1 && n * 100 <= got.len() * 4 * share, "{curve:?} {hdr:?} {stops} EV {channel:?} dc {ci}: {n} bytes off, max {max}");
+                        off += n;
+                        total += got.len() * 4;
+                        if n > 0 {
+                            report.push(format!("{curve:?} {hdr:?} {stops} {channel:?} {ci}: {n}"));
+                        }
+                    }
+                }
+            }
+        }
+    }
+    eprintln!("{off} of {total} bytes 1 LSB off the reference: {report:?}");
+}
+
+/// 8-bit frames go through the same pass (exposure before the display colour there too), equal
+/// to the CPU pass on their bytes.
+#[test]
+fn rgba8_frames_match_the_cpu_pass() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    let px: Vec<egui::Color32> = (0..256 * 16)
+        .map(|i| {
+            let (x, y) = (i % 256, i / 256);
+            let a = [255u8, 128, 64, 200][y % 4];
+            let c = |k: usize| ((x * k + y) % 256) as u32 * a as u32 / 255;
+            egui::Color32::from_rgba_premultiplied(c(1) as u8, c(3) as u8, c(7) as u8, a)
+        })
+        .collect();
+    let img = Arc::new(egui::ColorImage::new([256, 16], px));
+    let dc = DisplayColor::new(
+        Some(effectcraft_engine::project::ColorSpace::Srgb),
+        false,
+        effectcraft_engine::project::ColorSpace::Srgb,
+        true,
+        effectcraft_engine::project::ColorSpace::DisplayP3,
+        Simulation::default(),
+        &Default::default(),
+    );
+    for stops in [0.0f32, 1.0, -1.5] {
+        for dc in [None, dc.as_ref()] {
+            let pass = DisplayPass::new(Channel::Rgb, false, stops, SRGB, dc);
+            let (got, _) = bake(&d, &gpu, &Source::Rgba8(img.clone()), &pass);
+            let mut want: Vec<[u8; 4]> = img.pixels.iter().map(|c| c.to_array()).collect();
+            pass.apply_rgba8(&mut want);
+            let off = got.iter().zip(&want).flat_map(|(g, w)| (0..4).map(move |c| (g[c] as i32 - w[c] as i32).abs())).filter(|d| *d > 0).collect::<Vec<_>>();
+            eprintln!("8-bit, {stops} EV, dc {}: {} bytes 1 LSB off", dc.is_some(), off.len());
+            assert!(off.iter().all(|d| *d <= 1) && off.len() * 100 <= got.len() * 4, "{stops} EV, dc {}: {off:?}", dc.is_some());
+            if stops == 0.0 && dc.is_none() {
+                assert_eq!(got, want, "nothing to change: the frame's bytes");
+            }
+        }
+    }
+}
+
+/// The mips: each texel the rounded mean of the 2 × 2 texels above it, and at the edge of an
+/// odd-sized level above also of its last column / row, so no frame pixel is dropped.
+#[test]
+fn mips_average_the_level_above() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    let px: Vec<[f32; 4]> = (0..37 * 21).map(|i| [(i % 37) as f32 / 36.0, (i / 37) as f32 / 20.0, 0.3, 1.0]).collect();
+    let f = frame(&px, 37, SRGB);
+    let (_, tex) = bake(&d, &gpu, &Source::F16(f), &DisplayPass::new(Channel::Rgb, false, 0.5, SRGB, None));
+    assert_eq!(tex.mip_level_count(), 6);
+    for l in 1..tex.mip_level_count() {
+        let (above, [aw, ah]) = read(&d, &tex, l - 1);
+        let (got, [w, h]) = read(&d, &tex, l);
+        for y in 0..h {
+            for x in 0..w {
+                let (x0, y0) = ((x * 2).min(aw - 1), (y * 2).min(ah - 1));
+                let x1 = if x == w - 1 { aw } else { (x * 2 + 2).min(aw) };
+                let y1 = if y == h - 1 { ah } else { (y * 2 + 2).min(ah) };
+                let n = ((x1 - x0) * (y1 - y0)) as f32;
+                let want: [u8; 4] = std::array::from_fn(|c| {
+                    let s: f32 =
+                        (y0..y1).flat_map(|yy| (x0..x1).map(move |xx| (xx, yy))).map(|(xx, yy)| above[(yy * aw + xx) as usize][c] as f32 / 255.0).sum();
+                    (s / n * 255.0 + 0.5).floor() as u8
+                });
+                let g = got[(y * w + x) as usize];
+                assert!((0..4).all(|c| (g[c] as i32 - want[c] as i32).abs() <= 1), "level {l} ({x}, {y}): {g:?} vs {want:?}");
+            }
+        }
+    }
+}
+
+/// One egui frame through egui_wgpu's renderer into an offscreen target (eframe minus the
+/// swapchain): RGBA8 of the framebuffer.
+fn render_egui(
+    d: &Dev,
+    renderer: &mut egui_wgpu::Renderer,
+    ctx: &egui::Context,
+    size_pts: [f32; 2],
+    ppp: f32,
+    ui_fn: &mut dyn FnMut(&mut egui::Ui),
+) -> (Vec<[u8; 4]>, [u32; 2]) {
+    ctx.set_pixels_per_point(ppp);
+    let raw = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(size_pts[0], size_pts[1]))), ..Default::default() };
+    let mut first = ctx.run_ui(raw.clone(), |ui| ui_fn(ui));
+    let mut out = ctx.run_ui(raw, |ui| ui_fn(ui));
+    for o in [&mut first, &mut out] {
+        for (id, delta) in o.textures_delta.set.iter().flat_map(|(id, v)| v.iter().map(move |d| (id, d))) {
+            renderer.update_texture(&d.device, &d.queue, *id, delta);
+        }
+        for id in &o.textures_delta.free {
+            renderer.free_texture(id);
+        }
+        o.textures_delta.clear();
+    }
+    let jobs = ctx.tessellate(out.shapes, out.pixels_per_point);
+    let size = [(size_pts[0] * ppp).round() as u32, (size_pts[1] * ppp).round() as u32];
+    let sd = egui_wgpu::ScreenDescriptor { size_in_pixels: size, pixels_per_point: out.pixels_per_point };
+    let target = d.device.create_texture(&wgpu::TextureDescriptor {
+        label: Some("framebuffer"),
+        size: wgpu::Extent3d { width: size[0], height: size[1], depth_or_array_layers: 1 },
+        mip_level_count: 1,
+        sample_count: 1,
+        dimension: wgpu::TextureDimension::D2,
+        format: wgpu::TextureFormat::Rgba8Unorm,
+        usage: wgpu::TextureUsages::RENDER_ATTACHMENT | wgpu::TextureUsages::COPY_SRC,
+        view_formats: &[],
+    });
+    let view = target.create_view(&Default::default());
+    let mut enc = d.device.create_command_encoder(&Default::default());
+    let user = renderer.update_buffers(&d.device, &d.queue, &mut enc, &jobs, &sd);
+    {
+        let pass = enc.begin_render_pass(&wgpu::RenderPassDescriptor {
+            label: Some("egui"),
+            color_attachments: &[Some(wgpu::RenderPassColorAttachment {
+                view: &view,
+                depth_slice: None,
+                resolve_target: None,
+                ops: wgpu::Operations { load: wgpu::LoadOp::Clear(wgpu::Color::TRANSPARENT), store: wgpu::StoreOp::Store },
+            })],
+            ..Default::default()
+        });
+        let mut pass = pass.forget_lifetime();
+        renderer.render(&mut pass, &jobs, &sd);
+    }
+    d.queue.submit(user.into_iter().chain([enc.finish()]));
+    (read(d, &target, 0).0, size)
+}
+
+/// The displayed texture drawn by egui as the viewer draws it (native texture, the Faster
+/// sampler: nearest): at 2 pixels per point, zoomed 8× and 13.37× with the frame past every
+/// edge of a clip rect, each screen pixel shows the texel under its centre; and over egui's
+/// checkerboard, half-transparent pixels blend premultiplied.
+#[test]
+fn the_displayed_texture_lands_where_the_viewer_draws_it() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    let mut renderer =
+        egui_wgpu::Renderer::new(&d.device, wgpu::TextureFormat::Rgba8Unorm, egui_wgpu::RendererOptions { dithering: false, ..Default::default() });
+    let ctx = egui::Context::default();
+    let (tw, th) = (64u32, 32u32);
+    let px: Vec<[f32; 4]> = (0..tw * th).map(|i| [(i % tw) as f32 / 63.0, (i / tw) as f32 / 31.0, 1.0, 1.0]).collect();
+    let f = frame(&px, tw, SRGB);
+    let pass = DisplayPass::new(Channel::Rgb, false, -1.0, SRGB, None);
+    let (texels, tex) = bake(&d, &gpu, &Source::F16(f), &pass);
+    let id =
+        renderer.register_native_texture_with_sampler_options(&d.device, &tex.create_view(&Default::default()), crate::panels::viewer::zoom_sampler(false));
+    let ppp = 2.0f32;
+    let clip = egui::Rect::from_min_max(egui::pos2(50.0, 40.0), egui::pos2(350.0, 260.0));
+    for (zoom, origin) in [(2.0f32, egui::pos2(80.0, 60.0)), (8.0, egui::pos2(-100.0, -60.0)), (13.37, egui::pos2(-151.3, -77.7))] {
+        let rect = egui::Rect::from_min_size(origin, egui::vec2(tw as f32 * zoom, th as f32 * zoom));
+        let mut ui_fn = |ui: &mut egui::Ui| {
+            let p = ui.painter().with_clip_rect(clip);
+            p.image(id, rect, egui::Rect::from_min_max(egui::pos2(0.0, 0.0), egui::pos2(1.0, 1.0)), egui::Color32::WHITE);
+        };
+        let (out, sz) = render_egui(&d, &mut renderer, &ctx, [400.0, 300.0], ppp, &mut ui_fn);
+        let (mut bad, mut drawn) = (0, 0);
+        for y in 0..sz[1] {
+            for x in 0..sz[0] {
+                let (cx, cy) = ((x as f32 + 0.5) / ppp, (y as f32 + 0.5) / ppp);
+                let (u, v) = ((cx - rect.min.x) / zoom, (cy - rect.min.y) / zoom);
+                // Centres within a hair of a texel or clip edge can go either way.
+                let near = |t: f32| (t - t.round()).abs() < 0.01;
+                if near(u)
+                    || near(v)
+                    || near(cx * ppp - clip.min.x * ppp)
+                    || !clip.contains(egui::pos2(cx, cy))
+                    || u < 0.0
+                    || v < 0.0
+                    || u >= tw as f32
+                    || v >= th as f32
+                {
+                    continue;
+                }
+                drawn += 1;
+                let want = texels[(v as u32 * tw + u as u32) as usize];
+                let got = out[(y * sz[0] + x) as usize];
+                if (0..4).any(|c| (got[c] as i32 - want[c] as i32).abs() > 1) {
+                    bad += 1;
+                }
+            }
+        }
+        assert!(drawn > 1000, "{drawn}");
+        assert_eq!(bad, 0, "zoom {zoom}, origin {origin:?}: {bad} of {drawn} pixels wrong");
+    }
+    renderer.free_texture(&id);
+    // Alpha 0.5 over a checkerboard.
+    let src = [0.5f32, 0.25, 0.0, 0.5];
+    let f = frame(&[src; 256], 16, SRGB);
+    let (texels, tex) = bake(&d, &gpu, &Source::F16(f), &DisplayPass::new(Channel::Rgb, false, 0.0, SRGB, None));
+    let id =
+        renderer.register_native_texture_with_sampler_options(&d.device, &tex.create_view(&Default::default()), crate::panels::viewer::zoom_sampler(false));
+    let (c1, c2) = (egui::Color32::from_gray(0x66), egui::Color32::from_gray(0x99));
+    let mut ui_fn = |ui: &mut egui::Ui| {
+        let p = ui.painter();
+        for j in 0..8 {
+            for i in 0..8 {
+                let r = egui::Rect::from_min_size(egui::pos2(i as f32 * 8.0, j as f32 * 8.0), egui::vec2(8.0, 8.0));
+                p.rect_filled(r, 0.0, if (i + j) % 2 == 0 { c1 } else { c2 });
+            }
+        }
+        p.image(
+            id,
+            egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(64.0, 64.0)),
+            egui::Rect::from_min_max(egui::pos2(0.0, 0.0), egui::pos2(1.0, 1.0)),
+            egui::Color32::WHITE,
+        );
+    };
+    let (out, sz) = render_egui(&d, &mut renderer, &ctx, [64.0, 64.0], 2.0, &mut ui_fn);
+    let s = texels[0];
+    let mut bad = 0;
+    for y in 0..sz[1] {
+        for x in 0..sz[0] {
+            let (i, j) = (x / 16, y / 16);
+            let dst = if (i + j) % 2 == 0 { 0x66 } else { 0x99 } as f32;
+            let want: [u8; 3] = std::array::from_fn(|c| (s[c] as f32 + dst * (1.0 - s[3] as f32 / 255.0)).round() as u8);
+            let got = out[(y * sz[0] + x) as usize];
+            if (0..3).any(|c| (got[c] as i32 - want[c] as i32).abs() > 1) {
+                bad += 1;
+            }
+        }
+    }
+    assert_eq!(bad, 0, "alpha over the checkerboard: {bad} pixels off");
+}
+
+/// Timings at 4K (`cargo test -- --ignored display_pass_timings --nocapture`): the f32 → half
+/// conversion of a frame, today's f32 → RGBA8 conversion, and the display pass.
+#[test]
+#[ignore = "timing, not a check"]
+fn display_pass_timings() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let img = Image::filled(3840, 2160, [0.7, 1.9, 0.2, 1.0]);
+    let time = |f: &mut dyn FnMut()| {
+        let mut v: Vec<f64> = (0..9)
+            .map(|_| {
+                let t = std::time::Instant::now();
+                f();
+                t.elapsed().as_secs_f64() * 1000.0
+            })
+            .collect();
+        v.sort_by(f64::total_cmp);
+        v[4]
+    };
+    let f16 = time(&mut || drop(F16Frame::from_image(&img, SRGB)));
+    let rgba8 = time(&mut || drop(crate::frames::to_color_image(&img)));
+    eprintln!("4K: f32 → f16 {f16:.2} ms, f32 → RGBA8 {rgba8:.2} ms (medians of 9)");
+    let Some(d) = device() else { return };
+    let gpu = DisplayGpu::new(&d.device);
+    let f = Arc::new(F16Frame::from_image(&img, SRGB));
+    let input = gpu.upload(&d.device, &d.queue, &Source::F16(f), 1, None);
+    let out = DisplayGpu::output(&d.device, 3840, 2160);
+    let params = super::uniform(&DisplayPass::new(Channel::Rgb, false, -1.0, FrameEncoding { curve: PassCurve::Srgb, hdr: HdrMode::ToneMap }, None));
+    let pass = time(&mut || {
+        gpu.run(&d.device, &d.queue, &input, &out, &params, None);
+        d.device.poll(wgpu::PollType::wait_indefinitely()).expect("poll");
+    });
+    let f = Arc::new(F16Frame::from_image(&img, SRGB));
+    let mut kept = Some(gpu.upload(&d.device, &d.queue, &Source::F16(f.clone()), 1, None));
+    let upload = time(&mut || {
+        kept = Some(gpu.upload(&d.device, &d.queue, &Source::F16(f.clone()), 1, kept.take()));
+        d.device.poll(wgpu::PollType::wait_indefinitely()).expect("poll");
+    });
+    let cpu = time(&mut || drop(f.to_color_image(&DisplayPass::new(Channel::Rgb, false, -1.0, SRGB, None))));
+    eprintln!("4K: half-float upload into the kept texture {upload:.2} ms; the pass on the CPU (no device) {cpu:.2} ms");
+    eprintln!("4K: display pass with mips, submit to idle {pass:.2} ms");
+}
+
+/// `Bake::show` on egui-wgpu's render state: it runs the pass again when the frame, the pass's
+/// settings or the LUT change (a new LUT of the same size included: another ICC profile,
+/// Preserve RGB, another display), and only then; the texture id stays.
+#[test]
+fn bakes_run_again_when_frame_pass_or_lut_change() {
+    let _g = DEVICE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(d) = device() else { return eprintln!("no wgpu adapter: skipping") };
+    let gpu = DisplayGpu::new(&d.device);
+    let rs = render_state(&d);
+    let px: Vec<[f32; 4]> = (0..16).map(|i| [i as f32 / 15.0, 0.4, 0.7, 1.0]).collect();
+    let f = frame(&px, 4, SRGB);
+    let lut = |k: f64| DisplayColor::from_lut(test_lut(k));
+    let (l1, l2) = (lut(1.0), lut(0.5));
+    let pass = |stops: f32, dc: &DisplayColor| DisplayPass::new(Channel::Rgb, false, stops, SRGB, Some(dc));
+    let mut b = super::Bake::default();
+    let id = b.show(&rs, &gpu, &Source::F16(f.clone()), &pass(0.0, &l1), true).unwrap();
+    let first = read(&d, b.texture().unwrap(), 0).0;
+    assert_eq!(b.runs(), 1);
+    b.show(&rs, &gpu, &Source::F16(f.clone()), &pass(0.0, &l1), true);
+    assert_eq!(b.runs(), 1, "nothing changed");
+    assert_eq!(b.show(&rs, &gpu, &Source::F16(f.clone()), &pass(0.0, &l2), true), Some(id));
+    assert_eq!(b.runs(), 2, "a new LUT of the same size");
+    let second = read(&d, b.texture().unwrap(), 0).0;
+    assert_ne!(first, second);
+    let want: Vec<[u8; 4]> = (0..16).map(|i| pass(0.0, &l2).pixel(f.pixel(i).unwrap())).collect();
+    assert!(second.iter().zip(&want).all(|(g, w)| (0..4).all(|c| g[c].abs_diff(w[c]) <= 1)), "{second:?} vs {want:?}");
+    b.show(&rs, &gpu, &Source::F16(f.clone()), &pass(-1.0, &l2), true);
+    assert_eq!(b.runs(), 3, "another exposure");
+    b.show(&rs, &gpu, &Source::F16(frame(&px, 4, SRGB)), &pass(-1.0, &l2), true);
+    assert_eq!(b.runs(), 4, "another frame");
+    b.free(Some(&rs));
+    assert!(b.id().is_none());
+}
diff --git a/crates/ui-egui/src/dock.rs b/crates/ui-egui/src/dock.rs
index ae66eaebe..f126db257 100644
--- a/crates/ui-egui/src/dock.rs
+++ b/crates/ui-egui/src/dock.rs
@@ -1,11 +1,14 @@
-//! Docking: a tree of splits and tab groups. Panels are rounded frames separated by
-//! thin gutters; each group has a tab strip (active tab bright, with a panel menu "≡"); the focused
-//! panel gets a blue outline. Gutters drag to resize; workspaces are serialized trees.
+//! EffectCraft's panels and built-in workspaces in craft-ui's shared docking model
+//! ([`craft_ui::docking`]): splits, tab groups, After Effects' stacked panels and floating
+//! windows. craft-ui owns the layout model, its validation and every transaction; EffectCraft
+//! owns the panel ids, the built-in workspaces and the decorations of its tabs (the comp tabs of
+//! the Timeline, label swatches and viewer locks).
 
 use egui::{Align2, Rect, Sense, Stroke, pos2, vec2};
 use serde::{Deserialize, Serialize};
 
-use craft_ui::layout::{ResizeHandle, ResizeHandleStyle, SplitAxis, SplitSize as SharedSplitSize, split_rect};
+pub use craft_ui::docking::{Floating, Node, PanelState, Permissions, StackEntry};
+pub use craft_ui::layout::{SplitAxis, SplitSize};
 
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
@@ -121,7 +124,7 @@ impl PanelKind {
             PanelKind::EssentialGraphics => "Essential Graphics",
             PanelKind::ScriptPanel(_) => "ScriptUI Panel",
             PanelKind::Viewer(_) => "Composition",
-            PanelKind::LumetriScopes => "Lumetri Scopes",
+            PanelKind::LumetriScopes => "Video Scopes",
             PanelKind::Footage => "Footage",
             PanelKind::MediaBrowser => "Media Browser",
             PanelKind::Metadata => "Metadata",
@@ -134,6 +137,13 @@ impl PanelKind {
     pub fn id(self) -> String {
         format!("{self:?}")
     }
+    /// The shortcut scope of the panel: an additional viewer is a Composition panel.
+    pub fn shortcut_scope(self) -> String {
+        match self {
+            PanelKind::Viewer(_) => PanelKind::Composition.id(),
+            p => p.id(),
+        }
+    }
     pub fn from_name(s: &str) -> Option<PanelKind> {
         let n = s.to_ascii_lowercase().replace([' ', '_', '-', '&'], "");
         Self::ALL.iter().copied().find(|p| format!("{p:?}").to_ascii_lowercase() == n || p.title().to_ascii_lowercase().replace([' ', '&', '-'], "") == n)
@@ -161,117 +171,39 @@ impl PanelKind {
     }
 }
 
-#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
-pub enum SplitSize {
-    Ratio(f32),
-    /// First child has a fixed size in points.
-    FixedA(f32),
-    /// Second child has a fixed size in points.
-    FixedB(f32),
+/// The docked tree plus floating windows.
+pub type Layout = craft_ui::docking::Layout<PanelKind>;
+/// What a workspace saves: the layout, closed panels with where each goes back, and the lock.
+pub type Workspace = craft_ui::docking::Workspace<PanelKind>;
+
+/// What may happen to a panel. Every panel moves, floats and closes, as in After Effects
+/// (the Composition panel too: Window ▸ Composition reopens it); the last docked group staying
+/// docked is checked per transaction ([`crate::dock_ui`]).
+pub fn permissions(_panel: &PanelKind) -> Permissions {
+    Permissions::default()
 }
 
-impl SplitSize {
-    fn shared(self) -> SharedSplitSize {
-        match self {
-            Self::Ratio(value) => SharedSplitSize::Ratio(value),
-            Self::FixedA(value) => SharedSplitSize::FixedFirst(value),
-            Self::FixedB(value) => SharedSplitSize::FixedSecond(value),
-        }
-    }
+/// A tab group.
+pub fn tabs(p: &[PanelKind], active: usize) -> Node<PanelKind> {
+    Node::Tabs { panels: p.to_vec(), active }
+}
+/// Stacked panels: (panel, open, height). Open entries share the stack's height in proportion to
+/// their heights; an entry without one counts as craft-ui's `DockStyle::min_pane` (40).
+pub fn stack(e: &[(PanelKind, bool, Option<f32>)]) -> Node<PanelKind> {
+    Node::Stack { entries: e.iter().map(|&(panel, open, height)| StackEntry { panel, open, height }).collect() }
+}
+/// Two frames side by side.
+pub fn hsplit(size: SplitSize, a: Node<PanelKind>, b: Node<PanelKind>) -> Node<PanelKind> {
+    Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(a), second: Box::new(b) }
+}
+/// Two frames one above the other.
+pub fn vsplit(size: SplitSize, a: Node<PanelKind>, b: Node<PanelKind>) -> Node<PanelKind> {
+    Node::Split { axis: SplitAxis::Vertical, size, first: Box::new(a), second: Box::new(b) }
 }
 
-/// One frame in a [`DockNode::Stack`]: a header with one tab per panel (a panel dropped onto a
-/// stacked panel joins its frame as a tab, as in After Effects).
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(from = "StackEntryRepr")]
-pub struct StackEntry {
-    pub panels: Vec<PanelKind>,
-    /// The shown tab.
-    pub active: usize,
-    pub open: bool,
-    /// Content height when open (set by dragging the gaps); `None` = share the remaining height.
-    pub height: Option<f32>,
-}
-
-/// A saved [`StackEntry`]: workspaces saved before stacked frames held tabs name one `panel`.
-#[derive(Deserialize)]
-struct StackEntryRepr {
-    #[serde(default)]
-    panel: Option<PanelKind>,
-    #[serde(default)]
-    panels: Vec<PanelKind>,
-    #[serde(default)]
-    active: usize,
-    open: bool,
-    #[serde(default)]
-    height: Option<f32>,
-}
-
-impl From<StackEntryRepr> for StackEntry {
-    fn from(r: StackEntryRepr) -> StackEntry {
-        let mut panels = r.panels;
-        if let Some(p) = r.panel
-            && !panels.contains(&p)
-        {
-            panels.insert(0, p);
-        }
-        let active = r.active.min(panels.len().saturating_sub(1));
-        StackEntry { panels, active, open: r.open, height: r.height }
-    }
-}
-
-impl StackEntry {
-    /// A frame showing just `panel`.
-    pub fn new(panel: PanelKind, open: bool, height: Option<f32>) -> StackEntry {
-        StackEntry { panels: vec![panel], active: 0, open, height }
-    }
-    pub fn contains(&self, p: PanelKind) -> bool {
-        self.panels.contains(&p)
-    }
-    /// The frame's shown panel.
-    pub fn shown(&self) -> Option<PanelKind> {
-        self.panels.get(self.active).or(self.panels.first()).copied()
-    }
-    /// Show `p` (one of its tabs).
-    fn show(&mut self, p: PanelKind) {
-        if let Some(i) = self.panels.iter().position(|x| *x == p) {
-            self.active = i;
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub enum DockNode {
-    /// `vertical`: children stacked top/bottom; else side by side.
-    Split {
-        vertical: bool,
-        size: SplitSize,
-        a: Box<DockNode>,
-        b: Box<DockNode>,
-    },
-    Tabs {
-        panels: Vec<PanelKind>,
-        active: usize,
-    },
-    /// After Effects' stacked panels (e.g. the Default workspace's right column): each panel has
-    /// a header row; clicking it expands or collapses the panel in place, and dragging the gap
-    /// between two open panels resizes them.
-    Stack {
-        entries: Vec<StackEntry>,
-    },
-}
-
-fn tabs(p: &[PanelKind], active: usize) -> DockNode {
-    DockNode::Tabs { panels: p.to_vec(), active }
-}
-fn stack(e: &[(PanelKind, bool, Option<f32>)]) -> DockNode {
-    DockNode::Stack { entries: e.iter().map(|&(panel, open, height)| StackEntry::new(panel, open, height)).collect() }
-}
-fn hsplit(size: SplitSize, a: DockNode, b: DockNode) -> DockNode {
-    DockNode::Split { vertical: false, size, a: Box::new(a), b: Box::new(b) }
-}
-fn vsplit(size: SplitSize, a: DockNode, b: DockNode) -> DockNode {
-    DockNode::Split { vertical: true, size, a: Box::new(a), b: Box::new(b) }
+/// A workspace of just `root`, with no floating windows.
+pub fn docked(root: Node<PanelKind>) -> Workspace {
+    Workspace::new(Layout { root: Some(root), floating: Vec::new() })
 }
 
 /// The built-in workspaces: After Effects 2026's (Window ▸ Workspace), less Libraries (an Adobe
@@ -296,24 +228,36 @@ pub const WORKSPACES: &[&str] = &[
     "Undocked Panels",
 ];
 
-/// The floating panels a workspace starts with (Undocked Panels), in points for a window of
-/// about 1680×1020 (they are kept inside the window when drawn).
-pub fn workspace_floating(name: &str) -> Vec<Floating> {
+/// The floating windows a workspace starts with (Undocked Panels), in points for a window of
+/// about 1680×1020 (craft-ui keeps them inside the window when drawn). Each window has a fixed
+/// id, so a built-in layout built again is the same set of windows.
+fn workspace_floating(name: &str) -> Vec<Floating<PanelKind>> {
     use PanelKind::*;
-    let f = |panels: &[PanelKind], rect: [f32; 4]| Floating { panels: panels.to_vec(), active: 0, rect };
+    let f = |id: u64, panels: &[PanelKind], rect: [f32; 4]| Floating::single(panels.to_vec(), 0, rect).with_id(id);
     match name {
         "Undocked Panels" => vec![
-            f(&[Project, EffectControls], [24.0, 110.0, 320.0, 420.0]),
-            f(&[Preview, Info, Audio], [1330.0, 110.0, 320.0, 300.0]),
-            f(&[EffectsPresets, Properties, Character, Paragraph], [1330.0, 430.0, 320.0, 360.0]),
-            f(&[Timeline, RenderQueue], [24.0, 640.0, 1280.0, 340.0]),
+            f(1, &[Project, EffectControls], [24.0, 110.0, 320.0, 420.0]),
+            f(2, &[Preview, Info, Audio], [1330.0, 110.0, 320.0, 300.0]),
+            f(3, &[EffectsPresets, Properties, Character, Paragraph], [1330.0, 430.0, 320.0, 360.0]),
+            f(4, &[Timeline, RenderQueue], [24.0, 640.0, 1280.0, 340.0]),
         ],
         _ => vec![],
     }
 }
 
-/// The default layout of a named workspace.
-pub fn workspace(name: &str) -> DockNode {
+/// The height of a frame's tab strip ([`Tokens::tab_h`]).
+pub const TAB_STRIP: f32 = 30.0;
+/// The height of Default's Preview frame: its tab strip over a 46-point body that fits the
+/// playback controls.
+pub const PREVIEW_FRAME: f32 = TAB_STRIP + 46.0;
+
+/// The built-in layout of a named workspace (an unknown name gets Default's).
+pub fn workspace(name: &str) -> Layout {
+    Layout { root: Some(workspace_root(name)), floating: workspace_floating(name) }
+}
+
+/// The docked tree of a named workspace.
+fn workspace_root(name: &str) -> Node<PanelKind> {
     use PanelKind::*;
     use SplitSize::*;
     let right = |p: &[PanelKind], q: &[PanelKind]| vsplit(Ratio(0.45), tabs(p, 0), tabs(q, 0));
@@ -321,45 +265,45 @@ pub fn workspace(name: &str) -> DockNode {
         "Animation" => vsplit(
             Ratio(0.55),
             hsplit(
-                FixedA(300.0),
+                FixedFirst(300.0),
                 tabs(&[Project, EffectControls], 1),
-                hsplit(FixedB(300.0), tabs(&[Composition, Layer], 0), right(&[Info, Preview, Audio], &[EffectsPresets, Smoother, Wiggler, MotionSketch])),
+                hsplit(FixedSecond(300.0), tabs(&[Composition, Layer], 0), right(&[Info, Preview, Audio], &[EffectsPresets, Smoother, Wiggler, MotionSketch])),
             ),
             tabs(&[Timeline, RenderQueue], 0),
         ),
         "Effects" => vsplit(
             Ratio(0.58),
             hsplit(
-                FixedA(340.0),
+                FixedFirst(340.0),
                 tabs(&[EffectControls, Project], 0),
-                hsplit(FixedB(300.0), tabs(&[Composition, Layer], 0), right(&[Info, Preview], &[EffectsPresets])),
+                hsplit(FixedSecond(300.0), tabs(&[Composition, Layer], 0), right(&[Info, Preview], &[EffectsPresets])),
             ),
             tabs(&[Timeline, RenderQueue], 0),
         ),
         "Motion Tracking" => vsplit(
             Ratio(0.6),
             hsplit(
-                FixedA(300.0),
+                FixedFirst(300.0),
                 tabs(&[Project, EffectControls], 0),
-                hsplit(FixedB(300.0), tabs(&[Layer, Composition], 0), right(&[Info, Preview], &[Tracker])),
+                hsplit(FixedSecond(300.0), tabs(&[Layer, Composition], 0), right(&[Info, Preview], &[Tracker])),
             ),
             tabs(&[Timeline], 0),
         ),
         "Paint" => vsplit(
             Ratio(0.6),
             hsplit(
-                FixedA(300.0),
+                FixedFirst(300.0),
                 tabs(&[Project, EffectControls], 0),
-                hsplit(FixedB(300.0), tabs(&[Layer, Composition], 0), right(&[Paint, Info], &[Brushes, Preview])),
+                hsplit(FixedSecond(300.0), tabs(&[Layer, Composition], 0), right(&[Paint, Info], &[Brushes, Preview])),
             ),
             tabs(&[Timeline], 0),
         ),
         "Text" => vsplit(
             Ratio(0.58),
             hsplit(
-                FixedA(300.0),
+                FixedFirst(300.0),
                 tabs(&[Project, EffectControls], 0),
-                hsplit(FixedB(300.0), tabs(&[Composition], 0), right(&[Character, Paragraph], &[Align, Preview, EffectsPresets])),
+                hsplit(FixedSecond(300.0), tabs(&[Composition], 0), right(&[Character, Paragraph], &[Align, Preview, EffectsPresets])),
             ),
             tabs(&[Timeline], 0),
         ),
@@ -367,31 +311,35 @@ pub fn workspace(name: &str) -> DockNode {
         // Review: a large viewer with the markers and the project beside it.
         "Review" => vsplit(
             Ratio(0.66),
-            hsplit(FixedA(280.0), tabs(&[Project, Markers], 0), hsplit(FixedB(260.0), tabs(&[Composition, Layer], 0), right(&[Preview, Info], &[Audio]))),
+            hsplit(
+                FixedFirst(280.0),
+                tabs(&[Project, Markers], 0),
+                hsplit(FixedSecond(260.0), tabs(&[Composition, Layer], 0), right(&[Preview, Info], &[Audio])),
+            ),
             tabs(&[Timeline, RenderQueue], 0),
         ),
         // Essential Graphics: the Properties panel (After Effects' successor to the Essential
         // Graphics panel) full height on the right, type panels beside the viewer.
         "Essential Graphics" => hsplit(
-            FixedB(320.0),
+            FixedSecond(320.0),
             vsplit(
                 Ratio(0.58),
                 hsplit(
-                    FixedA(280.0),
+                    FixedFirst(280.0),
                     tabs(&[Project, EffectControls], 0),
-                    hsplit(FixedB(260.0), tabs(&[Composition, Layer], 0), right(&[Character, Paragraph], &[Align, Preview])),
+                    hsplit(FixedSecond(260.0), tabs(&[Composition, Layer], 0), right(&[Character, Paragraph], &[Align, Preview])),
                 ),
                 tabs(&[Timeline], 0),
             ),
-            stack(&[(Properties, true, None), (EffectsPresets, false, None)]),
+            tabs(&[Properties, EffectsPresets], 0),
         ),
         // Color: wide Effect Controls for grading effects, Info for colour readouts.
         "Color" => vsplit(
             Ratio(0.6),
             hsplit(
-                FixedA(360.0),
+                FixedFirst(360.0),
                 tabs(&[EffectControls, Project], 0),
-                hsplit(FixedB(340.0), tabs(&[Composition, Layer], 0), right(&[LumetriScopes, Info, Preview], &[EffectsPresets])),
+                hsplit(FixedSecond(340.0), tabs(&[Composition, Layer], 0), right(&[LumetriScopes, Info, Preview], &[EffectsPresets])),
             ),
             tabs(&[Timeline], 0),
         ),
@@ -401,19 +349,19 @@ pub fn workspace(name: &str) -> DockNode {
         "Small Screen" => vsplit(
             Ratio(0.55),
             hsplit(
-                FixedA(240.0),
+                FixedFirst(240.0),
                 tabs(&[Project, EffectControls], 0),
-                hsplit(FixedB(240.0), tabs(&[Composition], 0), tabs(&[Info, Preview, EffectsPresets], 1)),
+                hsplit(FixedSecond(240.0), tabs(&[Composition], 0), tabs(&[Info, Preview, EffectsPresets], 1)),
             ),
             tabs(&[Timeline], 0),
         ),
         "All Panels" => vsplit(
             Ratio(0.55),
             hsplit(
-                FixedA(300.0),
+                FixedFirst(300.0),
                 tabs(&[Project, EffectControls, Flowchart, History, MediaBrowser, Metadata], 0),
                 hsplit(
-                    FixedB(300.0),
+                    FixedSecond(300.0),
                     tabs(&[Composition, Layer, Footage], 0),
                     right(
                         &[Info, Preview, Audio, Align, Character, Paragraph, LumetriScopes],
@@ -439,475 +387,130 @@ pub fn workspace(name: &str) -> DockNode {
         "Standard" => vsplit(
             Ratio(0.56),
             hsplit(
-                FixedA(300.0),
+                FixedFirst(300.0),
                 tabs(&[Project, EffectControls], 0),
-                hsplit(FixedB(290.0), tabs(&[Composition, Layer], 0), right(&[Info, Audio], &[Preview, EffectsPresets])),
+                hsplit(FixedSecond(290.0), tabs(&[Composition, Layer], 0), right(&[Info, Audio], &[Preview, EffectsPresets])),
             ),
             tabs(&[Timeline, RenderQueue], 0),
         ),
         // Default (as in After Effects): Project/Effect Controls | Composition over the Timeline,
-        // and a full-height right column with Preview above the Properties panel.
+        // and a full-height right column: a short Preview frame above the Properties frame.
         _ => hsplit(
-            FixedB(300.0),
-            vsplit(Ratio(0.56), hsplit(FixedA(300.0), tabs(&[Project, EffectControls], 0), tabs(&[Composition, Layer], 0)), tabs(&[Timeline, RenderQueue], 0)),
-            stack(&[(Preview, true, Some(46.0)), (Properties, true, None), (Align, false, None), (Audio, false, None), (EffectsPresets, false, None)]),
+            FixedSecond(300.0),
+            vsplit(
+                Ratio(0.56),
+                hsplit(FixedFirst(300.0), tabs(&[Project, EffectControls], 0), tabs(&[Composition, Layer], 0)),
+                tabs(&[Timeline, RenderQueue], 0),
+            ),
+            vsplit(FixedFirst(PREVIEW_FRAME), tabs(&[Preview], 0), tabs(&[Properties, Align, Audio, EffectsPresets], 0)),
         ),
     }
 }
 
-impl DockNode {
-    /// Every panel in the tree.
-    pub fn panels(&self, out: &mut Vec<PanelKind>) {
-        match self {
-            DockNode::Split { a, b, .. } => {
-                a.panels(out);
-                b.panels(out);
-            }
-            DockNode::Tabs { panels, .. } => out.extend(panels.iter().copied()),
-            DockNode::Stack { entries } => out.extend(entries.iter().flat_map(|e| e.panels.iter().copied())),
-        }
-    }
-    pub fn contains(&self, p: PanelKind) -> bool {
-        let mut v = Vec::new();
-        self.panels(&mut v);
-        v.contains(&p)
-    }
-    /// The tabs of the group `p` is in, in order.
-    pub fn group_of(&self, p: PanelKind) -> Option<&[PanelKind]> {
-        match self {
-            DockNode::Split { a, b, .. } => a.group_of(p).or_else(|| b.group_of(p)),
-            DockNode::Tabs { panels, .. } => panels.contains(&p).then_some(panels.as_slice()),
-            DockNode::Stack { entries } => entries.iter().find(|e| e.contains(p)).map(|e| e.panels.as_slice()),
-        }
-    }
-    /// Make `p` the active tab of its group. Returns false if not present.
-    pub fn activate(&mut self, p: PanelKind) -> bool {
-        if !crate::dock_shared::valid_tree(self) {
-            return false;
-        }
-        match self {
-            DockNode::Split { a, b, .. } => a.activate(p) || b.activate(p),
-            DockNode::Tabs { panels, active } => {
-                if let Some(i) = panels.iter().position(|x| *x == p) {
-                    *active = i;
-                    true
-                } else {
-                    false
-                }
-            }
-            DockNode::Stack { entries } => match entries.iter_mut().find(|e| e.contains(p)) {
-                Some(e) => {
-                    e.show(p);
-                    e.open = true;
-                    true
-                }
-                None => false,
-            },
-        }
-    }
-    /// Expand or collapse a stacked panel's frame (showing `p`). Returns false if `p` is not in
-    /// a stack.
-    pub fn toggle_stacked(&mut self, p: PanelKind) -> bool {
-        if !crate::dock_shared::valid_tree(self) {
-            return false;
-        }
-        match self {
-            DockNode::Split { a, b, .. } => a.toggle_stacked(p) || b.toggle_stacked(p),
-            DockNode::Tabs { .. } => false,
-            DockNode::Stack { entries } => match entries.iter_mut().find(|e| e.contains(p)) {
-                Some(e) => {
-                    e.show(p);
-                    e.open = !e.open;
-                    true
-                }
-                None => false,
-            },
-        }
-    }
+/// Queries on a workspace that EffectCraft's menus, commands and panels ask.
+pub trait WorkspaceExt {
+    /// `p` is in the docked tree.
+    fn is_docked(&self, p: PanelKind) -> bool;
+    /// `p` is in a floating window.
+    fn is_floating(&self, p: PanelKind) -> bool;
+    /// `p` is open, docked or floating.
+    fn is_open(&self, p: PanelKind) -> bool;
+    /// `p` shows: the front tab of its group, an open stacked panel, not in a minimized window.
+    fn is_visible(&self, p: PanelKind) -> bool;
+    /// The panels of the tab group holding `p` (a stacked panel is a group of its own).
+    fn group_of(&self, p: PanelKind) -> Vec<PanelKind>;
+    /// Every open panel, docked first.
+    fn panels(&self) -> Vec<PanelKind>;
+}
 
-    pub fn is_visible(&self, p: PanelKind) -> bool {
-        match self {
-            DockNode::Split { a, b, .. } => a.is_visible(p) || b.is_visible(p),
-            DockNode::Tabs { panels, active } => panels.get(*active) == Some(&p),
-            DockNode::Stack { entries } => entries.iter().any(|e| e.open && e.shown() == Some(p)),
+pub(crate) fn node_panels(node: &Node<PanelKind>, out: &mut Vec<PanelKind>) {
+    match node {
+        Node::Split { first, second, .. } => {
+            node_panels(first, out);
+            node_panels(second, out);
         }
-    }
-    /// Close a panel (remove its tab; empty groups collapse their split).
-    pub fn close(&mut self, p: PanelKind) {
-        if !crate::dock_shared::valid_for_close(self) {
-            return;
-        }
-        if let DockNode::Split { a, b, .. } = self {
-            a.close(p);
-            b.close(p);
-            let empty = |n: &DockNode| match n {
-                DockNode::Tabs { panels, .. } => panels.is_empty(),
-                DockNode::Stack { entries } => entries.is_empty(),
-                DockNode::Split { .. } => false,
-            };
-            if empty(a) {
-                *self = (**b).clone();
-            } else if empty(b) {
-                *self = (**a).clone();
-            }
-        } else if let DockNode::Tabs { panels, active } = self {
-            let shown = panels.get(*active).copied();
-            panels.retain(|x| *x != p);
-            *active = shown.and_then(|shown| panels.iter().position(|x| *x == shown)).unwrap_or((*active).min(panels.len().saturating_sub(1)));
-        } else if let DockNode::Stack { entries } = self {
-            for e in entries.iter_mut() {
-                let shown = e.shown();
-                e.panels.retain(|x| *x != p);
-                e.active = shown.and_then(|shown| e.panels.iter().position(|x| *x == shown)).unwrap_or(e.active.min(e.panels.len().saturating_sub(1)));
-            }
-            entries.retain(|e| !e.panels.is_empty());
-        }
-    }
-    /// Add a panel as a tab next to `near` (or into the first group).
-    pub fn open_near(&mut self, p: PanelKind, near: PanelKind) {
-        if !crate::dock_shared::valid_tree(self) {
-            return;
-        }
-        if self.contains(p) {
-            self.activate(p);
-            return;
-        }
-        fn add(n: &mut DockNode, p: PanelKind, near: PanelKind) -> bool {
-            match n {
-                DockNode::Split { a, b, .. } => add(a, p, near) || add(b, p, near),
-                DockNode::Tabs { panels, active } => {
-                    if panels.contains(&near) {
-                        panels.push(p);
-                        *active = panels.len() - 1;
-                        true
-                    } else {
-                        false
-                    }
-                }
-                DockNode::Stack { entries } => match entries.iter().position(|e| e.contains(near)) {
-                    Some(i) => {
-                        entries.insert(i + 1, StackEntry::new(p, true, None));
-                        true
-                    }
-                    None => false,
-                },
+        Node::Tabs { panels, .. } => out.extend(panels.iter().copied()),
+        Node::Stack { entries } => out.extend(entries.iter().map(|e| e.panel)),
+        Node::Dock { columns, .. } => {
+            for group in columns.iter().flat_map(|c| c.groups.iter()) {
+                out.extend(group.panels.iter().copied());
             }
         }
-        fn add_first(n: &mut DockNode, p: PanelKind) -> bool {
-            match n {
-                DockNode::Split { a, b, .. } => add_first(a, p) || add_first(b, p),
-                DockNode::Tabs { panels, active } if !panels.is_empty() => {
-                    panels.push(p);
-                    *active = panels.len() - 1;
-                    true
-                }
-                DockNode::Stack { entries } if !entries.is_empty() => {
-                    entries.push(StackEntry::new(p, true, None));
-                    true
-                }
-                _ => false,
-            }
-        }
-        if self.panel_count() == 0 {
-            // Every panel was closed: there is no anchor, so the panel becomes the whole dock.
-            *self = tabs(&[p], 0);
-        } else if !add(self, p, near) && !add(self, p, PanelKind::EffectsPresets) && !add(self, p, PanelKind::Project) {
-            // None of the anchors is docked (e.g. Minimal with Timeline closed): use the first group.
-            add_first(self, p);
-        }
+        _ => {}
     }
 }
 
-/// Where a dragged panel tab lands on a group: as a tab (center) or split off to one side.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub enum Zone {
-    Center,
-    Left,
-    Right,
-    Top,
-    Bottom,
+fn node_group(node: &Node<PanelKind>, p: PanelKind) -> Option<Vec<PanelKind>> {
+    match node {
+        Node::Split { first, second, .. } => node_group(first, p).or_else(|| node_group(second, p)),
+        Node::Tabs { panels, .. } => panels.contains(&p).then(|| panels.clone()),
+        Node::Stack { entries } => entries.iter().any(|e| e.panel == p).then(|| vec![p]),
+        Node::Dock { columns, .. } => columns.iter().flat_map(|c| c.groups.iter()).find(|g| g.panels.contains(&p)).map(|g| g.panels.clone()),
+        _ => None,
+    }
 }
 
-impl Zone {
-    pub(crate) fn shared(self) -> craft_ui::docking::Zone {
-        match self {
-            Self::Center => craft_ui::docking::Zone::Center,
-            Self::Left => craft_ui::docking::Zone::Left,
-            Self::Right => craft_ui::docking::Zone::Right,
-            Self::Top => craft_ui::docking::Zone::Top,
-            Self::Bottom => craft_ui::docking::Zone::Bottom,
+impl WorkspaceExt for Workspace {
+    fn is_docked(&self, p: PanelKind) -> bool {
+        self.layout.root.as_ref().is_some_and(|root| node_group(root, p).is_some())
+    }
+    fn is_floating(&self, p: PanelKind) -> bool {
+        self.layout.floating.iter().any(|w| w.contains(&p))
+    }
+    fn is_open(&self, p: PanelKind) -> bool {
+        self.layout.contains(&p)
+    }
+    fn is_visible(&self, p: PanelKind) -> bool {
+        self.layout.panel_state(&p) == PanelState::Front
+    }
+    fn group_of(&self, p: PanelKind) -> Vec<PanelKind> {
+        self.layout.root.iter().chain(self.layout.floating.iter().map(|w| &w.root)).find_map(|node| node_group(node, p)).unwrap_or_default()
+    }
+    fn panels(&self) -> Vec<PanelKind> {
+        let mut out = Vec::new();
+        for node in self.layout.root.iter().chain(self.layout.floating.iter().map(|w| &w.root)) {
+            node_panels(node, &mut out);
+        }
+        out
+    }
+}
+
+/// Every panel a workspace names: open, or closed with a recorded place.
+pub fn referenced_panels(workspace: &Workspace) -> Vec<PanelKind> {
+    let mut out = workspace.panels();
+    out.extend(workspace.hidden.iter().map(|(p, _)| *p));
+    if let Some(saved) = &workspace.saved {
+        for node in saved.root.iter().chain(saved.floating.iter().map(|w| &w.root)) {
+            node_panels(node, &mut out);
         }
     }
-
-    pub fn from_name(s: &str) -> Option<Zone> {
-        Some(match s.to_ascii_lowercase().as_str() {
-            "center" | "tab" => Zone::Center,
-            "left" => Zone::Left,
-            "right" => Zone::Right,
-            "top" => Zone::Top,
-            "bottom" => Zone::Bottom,
-            _ => return None,
-        })
-    }
+    out
 }
 
-/// The drop zone for a pointer at `pos` over a group `rect` (with a `tab_h` tab strip): the tab
-/// strip and the middle of the group are Center; within a quarter of the size from an edge,
-/// the nearest edge.
-pub fn drop_zone(rect: Rect, tab_h: f32, pos: egui::Pos2) -> Zone {
-    match craft_ui::docking::drop_zone(rect, tab_h, pos) {
-        Some(craft_ui::docking::Zone::Left) => Zone::Left,
-        Some(craft_ui::docking::Zone::Right) => Zone::Right,
-        Some(craft_ui::docking::Zone::Top) => Zone::Top,
-        Some(craft_ui::docking::Zone::Bottom) => Zone::Bottom,
-        _ => Zone::Center,
-    }
-}
-
-/// The shared preview region, or an empty rectangle for invalid geometry.
-pub fn zone_rect(rect: Rect, zone: Zone) -> Rect {
-    craft_ui::docking::zone_rect(rect, zone.shared()).unwrap_or(Rect::NOTHING)
-}
-
-/// A panel group floating over the dock (undocked).
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Floating {
-    pub panels: Vec<PanelKind>,
-    pub active: usize,
-    /// [x, y, w, h] in points.
-    pub rect: [f32; 4],
-}
-
-/// A floating group moved out of the main window into its own native window (which can sit on
-/// another monitor): the group holding `panel` shows there.
-#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
-pub struct PanelWindow {
-    pub panel: PanelKind,
-    /// The window's [x, y] outer position and [w, h] inner size, in desktop points.
-    pub rect: [f32; 4],
-}
-
-/// The smallest and largest native panel window, in points.
-pub const PANEL_WINDOW_MIN: [f32; 2] = [160.0, 100.0];
-pub const PANEL_WINDOW_MAX: f32 = 16_384.0;
-/// The farthest a native panel window may sit from the desktop origin, in points.
-pub const PANEL_WINDOW_MAX_POS: f32 = 100_000.0;
-
-impl PanelWindow {
-    /// The rect made safe to hand to the windowing system: finite, with a size within
-    /// [`PANEL_WINDOW_MIN`]..=[`PANEL_WINDOW_MAX`] and a position within
-    /// ±[`PANEL_WINDOW_MAX_POS`] (hostile workspace files and bad monitor reports included).
-    pub fn sanitized(rect: [f32; 4]) -> [f32; 4] {
-        let finite = |v: f32, fallback: f32| if v.is_finite() { v } else { fallback };
-        let [x, y, w, h] = rect;
-        [
-            finite(x, 0.0).clamp(-PANEL_WINDOW_MAX_POS, PANEL_WINDOW_MAX_POS),
-            finite(y, 0.0).clamp(-PANEL_WINDOW_MAX_POS, PANEL_WINDOW_MAX_POS),
-            finite(w, 420.0).clamp(PANEL_WINDOW_MIN[0], PANEL_WINDOW_MAX),
-            finite(h, 320.0).clamp(PANEL_WINDOW_MIN[1], PANEL_WINDOW_MAX),
-        ]
-    }
-}
-
-impl DockNode {
-    /// Insert panel `p` relative to the group that holds `anchor`: as a tab next to it
-    /// (Center) or in a new group split off to one side. In a stack, the group is `anchor`'s
-    /// frame: Center adds a tab to that frame and Top / Bottom add a frame above or below it
-    /// (#302); Left / Right split the column. `p` is removed from its old place first. Returns
-    /// false (tree unchanged) if `anchor` isn't docked or is `p` itself alone.
-    pub fn dock_panel(&mut self, p: PanelKind, anchor: PanelKind, zone: Zone) -> bool {
-        if !crate::dock_shared::valid_tree(self) || p == anchor || !self.contains(anchor) {
-            return false;
+/// The automation id of the gap below stacked panel `p`: `dock.gutter.<path>s<i>`, with the
+/// stack's split path (`a`/`b` per level) and the entry's index.
+pub fn stack_gutter_id(layout: &Layout, p: PanelKind) -> Option<String> {
+    fn rec(node: &Node<PanelKind>, p: PanelKind, path: &mut String, depth: usize) -> Option<String> {
+        if depth > craft_ui::docking::MAX_DEPTH {
+            return None;
         }
-        let before = self.clone();
-        self.close(p);
-        fn rec(n: &mut DockNode, p: PanelKind, anchor: PanelKind, zone: Zone) -> bool {
-            let here = match n {
-                DockNode::Split { a, b, .. } => return rec(a, p, anchor, zone) || rec(b, p, anchor, zone),
-                DockNode::Tabs { panels, .. } => panels.contains(&anchor),
-                DockNode::Stack { entries } => entries.iter().any(|e| e.contains(anchor)),
-            };
-            if !here {
-                return false;
+        match node {
+            Node::Split { first, second, .. } => {
+                path.push('a');
+                if let Some(id) = rec(first, p, path, depth + 1) {
+                    return Some(id);
+                }
+                path.pop();
+                path.push('b');
+                let found = rec(second, p, path, depth + 1);
+                path.pop();
+                found
             }
-            match (zone, &mut *n) {
-                (Zone::Center, DockNode::Tabs { panels, active }) => {
-                    let i = panels.iter().position(|x| *x == anchor).map_or(panels.len(), |i| i + 1);
-                    panels.insert(i, p);
-                    *active = i;
-                }
-                (Zone::Center, DockNode::Stack { entries }) => {
-                    let Some(e) = entries.iter_mut().find(|e| e.contains(anchor)) else { return false };
-                    let i = e.panels.iter().position(|x| *x == anchor).map_or(e.panels.len(), |i| i + 1);
-                    e.panels.insert(i, p);
-                    e.active = i;
-                    e.open = true;
-                }
-                (Zone::Top | Zone::Bottom, DockNode::Stack { entries }) => {
-                    let Some(i) = entries.iter().position(|e| e.contains(anchor)) else { return false };
-                    let at = if zone == Zone::Top { i } else { i + 1 };
-                    entries.insert(at, StackEntry::new(p, true, None));
-                }
-                (z, node) => {
-                    let new = tabs(&[p], 0);
-                    let old = std::mem::replace(node, tabs(&[], 0));
-                    let vertical = matches!(z, Zone::Top | Zone::Bottom);
-                    let (a, b) = if matches!(z, Zone::Left | Zone::Top) { (new, old) } else { (old, new) };
-                    *node = DockNode::Split { vertical, size: SplitSize::Ratio(0.5), a: Box::new(a), b: Box::new(b) };
-                }
-            }
-            true
-        }
-        if rec(self, p, anchor, zone) {
-            true
-        } else {
-            *self = before;
-            false
-        }
-    }
-
-    /// Move panel `p` into the group that holds `anchor` as a tab before `before` (one of that
-    /// group's panels) or last, and show it. False (tree unchanged) if `anchor` isn't docked.
-    pub fn insert_tab(&mut self, p: PanelKind, anchor: PanelKind, before: Option<PanelKind>) -> bool {
-        if !crate::dock_shared::valid_tree(self) {
-            return false;
-        }
-        if p == anchor || !self.contains(anchor) {
-            return false;
-        }
-        let saved = self.clone();
-        self.close(p);
-        fn rec(n: &mut DockNode, p: PanelKind, anchor: PanelKind, before: Option<PanelKind>) -> bool {
-            match n {
-                DockNode::Split { a, b, .. } => rec(a, p, anchor, before) || rec(b, p, anchor, before),
-                DockNode::Tabs { panels, active } if panels.contains(&anchor) => {
-                    let i = before.and_then(|b| panels.iter().position(|x| *x == b)).unwrap_or(panels.len());
-                    panels.insert(i, p);
-                    *active = i;
-                    true
-                }
-                DockNode::Stack { entries } => {
-                    // A tab of the anchor's frame.
-                    let Some(e) = entries.iter_mut().find(|e| e.contains(anchor)) else { return false };
-                    let i = before.and_then(|b| e.panels.iter().position(|x| *x == b)).unwrap_or(e.panels.len());
-                    e.panels.insert(i, p);
-                    e.active = i;
-                    e.open = true;
-                    true
-                }
-                _ => false,
-            }
-        }
-        if rec(self, p, anchor, before) {
-            true
-        } else {
-            *self = saved;
-            false
-        }
-    }
-
-    /// Path of the group containing `p` (as in [`Group::path`]; stacks add `sN`).
-    pub fn path_of(&self, p: PanelKind) -> Option<String> {
-        fn rec(n: &DockNode, p: PanelKind, path: &str) -> Option<String> {
-            match n {
-                DockNode::Split { a, b, .. } => rec(a, p, &format!("{path}a")).or_else(|| rec(b, p, &format!("{path}b"))),
-                DockNode::Tabs { panels, .. } => panels.contains(&p).then(|| path.to_string()),
-                DockNode::Stack { entries } => entries.iter().position(|e| e.contains(p)).map(|i| format!("{path}s{i}")),
-            }
-        }
-        rec(self, p, "")
-    }
-
-    /// Number of panels in the tree.
-    pub fn panel_count(&self) -> usize {
-        let mut v = vec![];
-        self.panels(&mut v);
-        v.len()
-    }
-}
-
-/// A full layout: the docked tree plus floating panels (what a workspace saves).
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct Layout {
-    pub root: DockNode,
-    #[serde(default)]
-    pub floating: Vec<Floating>,
-}
-
-impl Layout {
-    /// Apply a shared transaction without replacing the persisted app schema.
-    pub fn apply(&mut self, action: craft_ui::docking::Action<PanelKind>) -> Result<(), String> {
-        crate::dock_shared::encode(&self.root, &self.floating)?.validate().map_err(|error| error.to_string())?;
-        let moving_to_float = match &action {
-            craft_ui::docking::Action::Float { panel, .. } => Some(*panel),
-            craft_ui::docking::Action::Move { panel, anchor, .. } if self.floating.iter().any(|group| group.panels.contains(anchor)) => Some(*panel),
+            Node::Stack { entries } => entries.iter().position(|e| e.panel == p).map(|i| format!("dock.gutter.{path}s{i}")),
             _ => None,
-        };
-        if moving_to_float.is_some_and(|panel| self.root.contains(panel) && self.root.panel_count() <= 1) {
-            return Err("the last docked panel must remain in the workspace".into());
         }
-        crate::dock_shared::apply(self, action)
     }
-
-    /// Undock an existing panel; the final docked panel stays in the workspace.
-    pub fn float(&mut self, p: PanelKind, rect: [f32; 4]) -> bool {
-        self.apply(craft_ui::docking::Action::Float { panel: p, rect }).is_ok()
-    }
-
-    /// Close an existing floating panel and collapse its empty group.
-    pub fn unfloat(&mut self, p: PanelKind) -> bool {
-        crate::dock_shared::unfloat(self, p)
-    }
-
-    /// Move or reorder a docked/floating tab through the shared transaction.
-    pub fn insert_tab(&mut self, p: PanelKind, anchor: PanelKind, before: Option<PanelKind>) -> bool {
-        if !crate::dock_shared::valid_tree(&self.root) {
-            return false;
-        }
-        self.apply(craft_ui::docking::Action::Move { panel: p, anchor, placement: craft_ui::docking::Placement::Tab { before } }).is_ok()
-    }
-
-    /// Dock a panel beside an anchor; floating destinations accept tabs only.
-    pub fn dock(&mut self, p: PanelKind, anchor: PanelKind, zone: Zone) -> bool {
-        if !crate::dock_shared::valid_tree(&self.root) {
-            return false;
-        }
-        self.apply(craft_ui::docking::Action::Move { panel: p, anchor, placement: craft_ui::docking::Placement::Split(zone.shared()) }).is_ok()
-    }
-
-    pub fn contains(&self, p: PanelKind) -> bool {
-        self.root.contains(p) || self.floating.iter().any(|group| group.panels.contains(&p))
-    }
-}
-
-/// One laid-out tab group.
-pub struct Group {
-    pub path: String,
-    pub rect: Rect,
-    pub content: Rect,
-    pub panels: Vec<PanelKind>,
-    pub active: usize,
-    /// In a [`DockNode::Stack`]: whether the panel is expanded.
-    pub stacked: Option<bool>,
-}
-
-/// Actions produced by interacting with the dock chrome.
-#[derive(Debug, Clone, PartialEq)]
-pub enum DockAction {
-    Activate(PanelKind),
-    /// Expand/collapse a stacked panel.
-    ToggleStacked(PanelKind),
-    Focus(PanelKind),
-    Close(PanelKind),
-    PanelMenu(PanelKind, egui::Pos2),
-    /// A tab started being dragged (re-dock or undock).
-    BeginDrag(PanelKind),
-    /// The tab's lock was toggled (Composition / Timeline viewer lock).
-    ToggleLock(PanelKind),
-    /// A document tab of a panel was clicked (the Timeline's tab of comp `id`).
-    ActivateDoc(PanelKind, u64),
-    /// A document tab's close button (or middle click): close that document (comp `id`).
-    CloseDoc(PanelKind, u64),
+    rec(layout.root.as_ref()?, p, &mut String::new(), 0)
 }
 
 /// One document a panel shows as a tab of its own (the Timeline: one tab per open comp, as in
@@ -916,447 +519,181 @@ pub enum DockAction {
 pub struct DocTab {
     pub id: u64,
     pub title: String,
-    pub deco: Option<TabDeco>,
+    /// The comp's label colour.
+    pub swatch: egui::Color32,
     /// The document the panel shows now.
     pub active: bool,
 }
 
-/// What a group's tabs show: labels, the comp swatch / close / lock decorations and the panels
-/// that show one tab per document.
-pub struct TabInfo<'a> {
-    pub title: &'a dyn Fn(PanelKind) -> String,
-    pub decos: &'a [(PanelKind, TabDeco)],
-    pub docs: &'a [(PanelKind, Vec<DocTab>)],
+/// What the Timeline's comp tabs did this frame.
+#[derive(Debug, Clone, PartialEq)]
+pub enum DocAction {
+    /// Show comp `id`.
+    Activate(u64),
+    /// Close comp `id`'s Timeline (its ×, or a middle click).
+    Close(u64),
 }
 
-/// What drawing a group's chrome produced: actions and where each panel's tabs are (a panel with
-/// document tabs spans all of them; tabs hidden behind the overflow chevron are left out).
-#[derive(Default)]
-pub struct Chrome {
-    pub actions: Vec<DockAction>,
-    pub tabs: Vec<(PanelKind, Rect)>,
+/// Room around a tab's label, as craft-ui gives its dock tabs.
+const TAB_PADDING: f32 = 24.0;
+/// Width of the » button that lists the comp tabs with no room in the strip.
+const DOC_OVERFLOW: f32 = 22.0;
+/// Room for the × after a comp's name. Every comp tab keeps it, so a tab keeps its width when it
+/// is shown or hovered.
+const DOC_CLOSE: f32 = 16.0;
+
+/// A comp tab's text: the label swatch, then the name, as the panel tabs with a swatch show it.
+fn doc_job(doc: &DocTab, font: &egui::FontId, color: egui::Color32) -> egui::text::LayoutJob {
+    let mut job = egui::text::LayoutJob::default();
+    job.append("\u{25a0} ", 0.0, egui::TextFormat::simple(font.clone(), doc.swatch));
+    job.append(&doc.title, 0.0, egui::TextFormat::simple(font.clone(), color));
+    job
 }
 
-/// After Effects-style extras on a tab that shows a composition (Composition, Timeline): a close
-/// button (×), the item's label colour as a small square and the viewer lock.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct TabDeco {
-    pub swatch: egui::Color32,
-    pub locked: bool,
-    /// Close button and lock (Composition, Timeline); Effect Controls shows just the swatch.
-    pub viewer: bool,
+/// The width of one line of `job` at the fonts' current size.
+fn text_width(ctx: &egui::Context, job: egui::text::LayoutJob) -> f32 {
+    ctx.fonts_mut(|f| f.layout_job(job)).size().x
 }
 
-/// Lay out the tree into group rects (with `gap` gutters) and handle gutter dragging.
-pub fn layout(ui: &mut egui::Ui, node: &mut DockNode, rect: Rect, t: &Tokens, path: &str, out: &mut Vec<Group>, reg: &mut crate::automation::Registry) {
-    let mut actions = Vec::new();
-    layout_with_actions(ui, node, rect, t, path, out, reg, &mut actions);
-    for action in actions {
-        crate::dock_shared::apply_tree(node, action);
-    }
+/// The width each comp tab asks for in the Timeline group's tab row.
+pub fn doc_widths(ctx: &egui::Context, docs: &[DocTab], font: &egui::FontId) -> Vec<f32> {
+    docs.iter().map(|d| text_width(ctx, doc_job(d, font, egui::Color32::WHITE)) + TAB_PADDING + DOC_CLOSE).collect()
 }
 
-/// Lay out chrome while returning mutations for the application's UI command route.
-pub fn layout_with_actions(
+/// The × of comp tab `doc` at `rect`, clipped to `clip`; true when clicked. `shown` is the comp
+/// the Timeline shows while it is the group's shown panel. Automation:
+/// `panel.tab.Timeline.<comp>.close`, and `panel.tab.Timeline.close` for the shown comp's.
+fn doc_close(
     ui: &mut egui::Ui,
-    node: &mut DockNode,
     rect: Rect,
-    t: &Tokens,
-    path: &str,
-    out: &mut Vec<Group>,
+    clip: Rect,
+    doc: &DocTab,
+    shown: bool,
+    style: &craft_ui::docking::DockStyle,
     reg: &mut crate::automation::Registry,
-    actions: &mut Vec<craft_ui::docking::Action<PanelKind>>,
-) {
-    layout_inner(ui, node, rect, t, path, &[], out, reg, actions);
+) -> bool {
+    let timeline = PanelKind::Timeline.id();
+    let hit = ui.interact(rect.expand(2.0), egui::Id::unique(("comp-tab-close", doc.id)), Sense::click());
+    hit.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, hit.enabled(), "Close"));
+    let cc = if hit.hovered() { style.text } else { style.inactive_text };
+    let k = 3.5;
+    let painter = ui.painter().with_clip_rect(clip);
+    painter.line_segment([rect.center() + vec2(-k, -k), rect.center() + vec2(k, k)], Stroke::new(1.2, cc));
+    painter.line_segment([rect.center() + vec2(-k, k), rect.center() + vec2(k, -k)], Stroke::new(1.2, cc));
+    reg.add_response(&format!("panel.tab.{timeline}.{}.close", doc.id), &hit, "Close");
+    if shown {
+        reg.add_response(&format!("panel.tab.{timeline}.close"), &hit, "Close");
+    }
+    hit.clicked()
 }
 
-fn layout_inner(
+/// Draw the Timeline's comp tabs into `strip`, the part of the Timeline group's tab row after its
+/// panel tabs. Each is a tab like the panel tabs: the comp's label swatch and name, then a ×
+/// that closes the comp's Timeline: always on the shown comp while the Timeline is the group's
+/// shown panel (`selected`), on the other comp tabs while the pointer is over them. Tabs that do
+/// not fit go to a » menu at the end; the shown comp's tab always stays in the row. Shift+, and
+/// Shift+. step through every open comp. Automation: `panel.tab.Timeline.<comp>`, the ×s (see
+/// [`doc_close`]), `panel.tab.Timeline.more` for », and `panel.tab.Timeline.more.<comp>` for its
+/// items.
+pub fn doc_tabs(
     ui: &mut egui::Ui,
-    node: &mut DockNode,
-    rect: Rect,
-    t: &Tokens,
-    path: &str,
-    tree_path: &[bool],
-    out: &mut Vec<Group>,
+    strip: Rect,
+    docs: &[DocTab],
+    selected: bool,
+    style: &craft_ui::docking::DockStyle,
     reg: &mut crate::automation::Registry,
-    actions: &mut Vec<craft_ui::docking::Action<PanelKind>>,
-) {
-    match node {
-        DockNode::Tabs { panels, active } => {
-            let tab_h = if panels.len() == 1 && panels[0].compact() { 8.0 } else { t.tab_h };
-            let content = Rect::from_min_max(pos2(rect.min.x, rect.min.y + tab_h), rect.max);
-            out.push(Group { path: path.to_string(), rect, content, panels: panels.clone(), active: *active, stacked: None });
-        }
-        DockNode::Stack { entries } => {
-            // A header for every entry; the open panels' bodies share the rest.
-            let head = t.tab_h;
-            let g = t.gap;
-            let n = entries.len() as f32;
-            let avail = rect.height() - n * head - (n - 1.0).max(0.0) * g;
-            let bodies = stack_bodies(entries, avail);
-            let mut y = rect.min.y;
-            let mut drag = None;
-            for (i, e) in entries.iter().enumerate() {
-                let body = bodies.get(i).copied().unwrap_or(0.0);
-                let r = Rect::from_min_max(pos2(rect.min.x, y), pos2(rect.max.x, (y + head + body).min(rect.max.y)));
-                let content = Rect::from_min_max(pos2(r.min.x, r.min.y + head), r.max);
-                let group = format!("{path}s{i}");
-                // The gap below a panel resizes the open panels on either side of it.
-                let above = entries.get(..=i).and_then(|s| s.iter().rposition(|x| x.open));
-                let below = entries.get(i + 1..).and_then(|s| s.iter().position(|x| x.open)).map(|k| i + 1 + k);
-                if let (Some(above), Some(below)) = (above, below) {
-                    let gap = Rect::from_min_max(pos2(rect.min.x, r.max.y), pos2(rect.max.x, r.max.y + g));
-                    if let Some(d) = gutter(ui, gap, true, &group, t, reg) {
-                        drag = Some((above, below, d));
-                    }
-                }
-                out.push(Group { path: group, rect: r, content, panels: e.panels.clone(), active: e.active, stacked: Some(e.open) });
-                y = r.max.y + g;
-            }
-            if let Some((above, below, d)) = drag {
-                let mut proposed = entries.clone();
-                resize_stacked(&mut proposed, &bodies, above, below, d);
-                for (before, after) in entries.iter().zip(proposed) {
-                    if before.height != after.height
-                        && let Some(panel) = after.shown()
-                    {
-                        actions.push(craft_ui::docking::Action::ResizeStack { panel, height: after.height });
-                    }
-                }
-            }
-        }
-        DockNode::Split { vertical, size, a, b } => {
-            let axis = if *vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal };
-            let Some(split) = split_rect(rect, axis, size.shared(), t.gap, 20.0) else { return };
-            let response = resize_handle(split.divider, *vertical, path, t).value(split.first_size(), 0.0..=split.available()).show(ui);
-            reg.add(&format!("dock.gutter.{path}"), response.response.rect, "gutter");
-            if response.delta != 0.0
-                && let Some(resized) = split.resized(size.shared(), response.delta, 40.0)
-            {
-                actions.push(craft_ui::docking::Action::ResizeSplit { path: tree_path.to_vec(), size: resized });
-            }
-            let mut first_path = tree_path.to_vec();
-            first_path.push(false);
-            let mut second_path = tree_path.to_vec();
-            second_path.push(true);
-            layout_inner(ui, a, split.first, t, &format!("{path}a"), &first_path, out, reg, actions);
-            layout_inner(ui, b, split.second, t, &format!("{path}b"), &second_path, out, reg, actions);
-        }
-    }
-}
-
-/// A gap between dock areas that drags to resize them (`vertical`: up and down), with a slightly
-/// larger hit area than the gap. Returns the drag this frame.
-fn gutter(ui: &mut egui::Ui, gap: Rect, vertical: bool, path: &str, t: &Tokens, reg: &mut crate::automation::Registry) -> Option<f32> {
-    let response = resize_handle(gap, vertical, path, t).show(ui);
-    reg.add(&format!("dock.gutter.{path}"), response.response.rect, "gutter");
-    (response.delta != 0.0).then_some(response.delta)
-}
-
-fn resize_handle(gap: Rect, vertical: bool, path: &str, t: &Tokens) -> ResizeHandle<'static> {
-    let axis = if vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal };
-    let style = ResizeHandleStyle { hovered: t.focus.gamma_multiply(0.4), dragged: t.focus.gamma_multiply(0.9), focused: t.focus };
-    let label = if vertical { crate::i18n::tr("Height:") } else { crate::i18n::tr("Width:") };
-    ResizeHandle::new(egui::Id::new(("dock-gutter", path.to_string())), axis, gap, label, style)
-}
-
-/// The least body height of an open stacked panel (when the stack has room for it).
-const STACK_MIN: f32 = 40.0;
-
-/// An open stacked panel without a height of its own: it shares the room the others leave.
-fn flexible(e: &StackEntry) -> bool {
-    e.open && !e.height.is_some_and(f32::is_finite)
-}
-
-/// The body heights of a stack's panels in `avail` points (headers and gaps taken out). Open
-/// panels with a height keep it and the others share the rest; when no panel takes the rest, or
-/// there is too little room, the heights grow or shrink in proportion (down to [`STACK_MIN`]) so
-/// the open panels fill the stack.
-fn stack_bodies(entries: &[StackEntry], avail: f32) -> Vec<f32> {
-    let avail = if avail.is_finite() { avail.max(0.0) } else { 0.0 };
-    let open = entries.iter().filter(|e| e.open).count();
-    let min = STACK_MIN.min(avail / open.max(1) as f32);
-    let fixed: Vec<f32> = entries.iter().filter(|e| e.open && !flexible(e)).filter_map(|e| e.height).map(|h| h.max(min)).collect();
-    let flex = open.saturating_sub(fixed.len());
-    let k = fixed.len() as f32;
-    // What the panels with a height may take, and how much of it lies above their minimum.
-    let room = avail - flex as f32 * min;
-    let sum: f32 = fixed.iter().sum();
-    let (excess, target) = (sum - k * min, (room - k * min).max(0.0));
-    let fit = flex == 0 || sum > room;
-    let size = |h: f32| match (fit, excess > 0.0) {
-        (false, _) => h,
-        (true, true) => min + (h - min) / excess * target,
-        (true, false) => min + target / k.max(1.0),
-    };
-    let used: f32 = fixed.iter().map(|&h| size(h)).sum();
-    let share = (avail - used).max(0.0) / flex.max(1) as f32;
-    entries
-        .iter()
-        .map(|e| match (e.open, flexible(e)) {
-            (false, _) => 0.0,
-            (true, true) => share,
-            (true, false) => size(e.height.unwrap_or(min).max(min)),
-        })
-        .collect()
-}
-
-/// `v` held to `lo..=hi`, never panicking: when the room is too small for both minimums
-/// (`hi < lo`), `lo` wins; a non-finite `v` gives `lo`.
-#[cfg(test)]
-fn clamp_ordered(v: f32, lo: f32, hi: f32) -> f32 {
-    let lo = if lo.is_finite() { lo } else { 0.0 };
-    let hi = if hi.is_finite() { hi.max(lo) } else { lo };
-    if v.is_finite() { v.max(lo).min(hi) } else { lo }
-}
-
-/// The size of a split's first side in `avail` points (both sides keep 20 pt when there is room).
-/// `f32::clamp` panics when its bounds cross, which a split shorter than 40 pt did (#306).
-#[cfg(test)]
-fn split_first(size: SplitSize, avail: f32) -> f32 {
-    let avail = if avail.is_finite() { avail.max(0.0) } else { 0.0 };
-    let first = match size {
-        SplitSize::Ratio(r) => avail * r,
-        SplitSize::FixedA(px) => px.min(avail - 20.0),
-        SplitSize::FixedB(px) => avail - px.min(avail - 20.0),
-    };
-    let lo = 20.0_f32.min(avail);
-    clamp_ordered(first, lo, avail - 20.0).min(avail)
-}
-
-/// Drag the gap between the open stacked panels `above` and `below` (laid out at `bodies`) by
-/// `d` points: one grows as much as the other shrinks, neither below [`STACK_MIN`]. The new sizes
-/// become the panels' heights, except that the last panel without one keeps sharing the rest
-/// (so the stack still fills its column when the window is resized).
-fn resize_stacked(entries: &mut [StackEntry], bodies: &[f32], above: usize, below: usize, d: f32) {
-    let (Some(&a), Some(&b)) = (bodies.get(above), bodies.get(below)) else { return };
-    let pair = a + b;
-    let lo = STACK_MIN.min(pair / 2.0);
-    let na = (a + d).max(lo).min(pair - lo);
-    for (i, h) in [(above, na), (below, pair - na)] {
-        let last_flexible = entries.iter().filter(|e| flexible(e)).count() == 1;
-        if let Some(e) = entries.get_mut(i)
-            && !(last_flexible && flexible(e))
-        {
-            e.height = Some(h);
-        }
-    }
-}
-
-/// Draw a group's frame + tab strip: one tab per panel, or per document for panels that show
-/// several (the Timeline's comps). Tab labels may name the comp or layer they show (After
-/// Effects style).
-pub fn draw_group_chrome(ui: &mut egui::Ui, g: &Group, t: &Tokens, reg: &mut crate::automation::Registry, info: &TabInfo) -> Chrome {
-    struct Entry {
-        panel: PanelKind,
-        doc: Option<u64>,
-        label: String,
-        deco: Option<TabDeco>,
-        /// The group's shown tab.
-        active: bool,
-        /// The document its panel shows (even behind another tab).
-        shown_doc: bool,
-    }
-    let mut out = Chrome::default();
-    let painter = ui.painter().clone();
-    painter.rect_filled(g.rect, t.radius, t.panel_bg);
-    let active_panel = g.panels.get(g.active).copied();
-    let compact = g.panels.len() == 1 && g.panels[0].compact();
-    if compact {
-        // grip dots
-        let c = pos2(g.rect.center().x, g.rect.min.y + 4.0);
-        for dx in [-4.0, 0.0, 4.0] {
-            painter.circle_filled(c + vec2(dx, 0.0), 1.0, t.text_faint);
-        }
-    } else {
-        let mut entries: Vec<Entry> = vec![];
-        for (pi, p) in g.panels.iter().enumerate() {
-            let shown = pi == g.active;
-            match info.docs.iter().find(|(k, d)| k == p && !d.is_empty()) {
-                Some((_, docs)) => entries.extend(docs.iter().map(|d| Entry {
-                    panel: *p,
-                    doc: Some(d.id),
-                    label: d.title.clone(),
-                    deco: d.deco,
-                    active: shown && d.active,
-                    shown_doc: d.active,
-                })),
-                None => entries.push(Entry {
-                    panel: *p,
-                    doc: None,
-                    label: (info.title)(*p),
-                    deco: info.decos.iter().find(|(k, _)| k == p).map(|(_, d)| *d),
-                    active: shown,
-                    shown_doc: false,
-                }),
-            }
-        }
-        let ai = entries.iter().position(|e| e.active).unwrap_or(0);
-        let strip = Rect::from_min_size(g.rect.min, vec2(g.rect.width(), t.tab_h));
-        if t.gradients {
-            // Settings ▸ Appearance ▸ Use Gradients.
-            crate::theme::gradient_rect(&painter, strip.shrink2(vec2(t.radius, 0.0)), t.grad_top(t.panel_bg), t.panel_bg);
-        }
-        let activate = |e: &Entry| match e.doc {
-            Some(id) => DockAction::ActivateDoc(e.panel, id),
-            None => DockAction::Activate(e.panel),
+) -> Vec<DocAction> {
+    let mut out = Vec::new();
+    let timeline = PanelKind::Timeline.id();
+    let widths = doc_widths(ui.ctx(), docs, &style.font);
+    let active = docs.iter().position(|d| d.active).unwrap_or(0);
+    let fit = craft_ui::tabs::fit_whole(&widths, active, strip.width(), DOC_OVERFLOW);
+    let clip = strip.intersect(ui.clip_rect());
+    let mid = strip.center().y;
+    let mut x = strip.min.x;
+    for (index, width) in &fit.shown {
+        let Some(doc) = docs.get(*index) else { continue };
+        let tab = Rect::from_min_size(pos2(x, strip.min.y), vec2(*width, strip.height()));
+        x += width;
+        let on = selected && doc.active;
+        let color = if on { style.text } else { style.inactive_text };
+        let mut job = doc_job(doc, &style.font, color);
+        job.wrap = egui::text::TextWrapping {
+            max_width: (tab.width() - TAB_PADDING - DOC_CLOSE).max(0.0),
+            max_rows: 1,
+            break_anywhere: true,
+            overflow_character: Some('\u{2026}'),
         };
-        let close = |e: &Entry| match e.doc {
-            Some(id) => DockAction::CloseDoc(e.panel, id),
-            None => DockAction::Close(e.panel),
-        };
-        let mut x = strip.min.x + 12.0;
-        let text_y = strip.min.y + 16.0;
-        for (k, e) in entries.iter().enumerate() {
-            let p = &e.panel;
-            // A collapsed stacked panel's header is plain text (no underline or panel menu).
-            let is_active = k == ai && g.stacked != Some(false);
-            let galley = painter.layout_no_wrap(e.label.clone(), Tokens::ui(12.0), if is_active { t.tab_text_active } else { t.tab_text });
-            let menu_w = if is_active { 20.0 } else { 0.0 };
-            // The lock belongs to the panel: on its shown document's tab only.
-            let lock = e.deco.is_some_and(|d| d.viewer) && (e.doc.is_none() || is_active);
-            // × (active tab only), swatch and lock before the label.
-            let deco_w = match e.deco {
-                Some(d) if d.viewer => (if is_active { 16.0 } else { 0.0 }) + 14.0 + if lock { 16.0 } else { 0.0 },
-                Some(_) => 14.0,
-                None => 0.0,
-            };
-            let w = galley.size().x + 16.0 + menu_w + deco_w;
-            if x + w > strip.max.x - 20.0 && k > ai {
-                let r = Rect::from_min_size(pos2(strip.max.x - 22.0, strip.min.y + 6.0), vec2(18.0, 20.0));
-                let resp = ui.interact(r, egui::Id::new(("tab-overflow", g.path.clone())), Sense::click());
-                icons::paint(&painter, r.shrink(4.0).translate(vec2(-2.0, 0.0)), Icon::ChevronRight, t.tab_text);
-                icons::paint(&painter, r.shrink(4.0).translate(vec2(2.0, 0.0)), Icon::ChevronRight, t.tab_text);
-                crate::widgets::focus_outline(ui, &resp, t);
-                reg.add_response(&format!("panel.overflow.{}", g.path), &resp, "More tabs");
-                if resp.clicked()
-                    && let Some(next) = entries.get((ai + 1) % entries.len())
-                {
-                    out.actions.push(activate(next));
-                }
-                break;
+        let galley = ui.fonts_mut(|f| f.layout_job(job));
+        let label_end = tab.min.x + TAB_PADDING * 0.5 + galley.size().x;
+        let resp = craft_ui::tabs::Tab::new(egui::Id::unique(("comp-tab", doc.id)), &doc.title, on).focus_stroke(Stroke::new(1.0, style.accent)).show_at(
+            ui,
+            tab,
+            |ui, response| {
+                let painter = ui.painter().with_clip_rect(tab.intersect(clip));
+                painter.rect_filled(tab, 0.0, if on || response.hovered() { style.active_background } else { style.tab_background });
+                painter.galley(pos2(tab.min.x + TAB_PADDING * 0.5, mid - galley.size().y * 0.5), galley.clone(), color);
+            },
+        );
+        let resp = if galley.elided { resp.on_hover_text(&doc.title) } else { resp };
+        reg.add_response(&format!("panel.tab.{timeline}.{}", doc.id), &resp, &doc.title);
+        // After the tab, so the × takes the clicks over it.
+        if on || ui.rect_contains_pointer(tab.intersect(clip)) {
+            let cr = Rect::from_center_size(pos2(label_end + DOC_CLOSE / 2.0, mid), vec2(10.0, 10.0));
+            if doc_close(ui, cr, tab.intersect(clip), doc, on, style, reg) {
+                out.push(DocAction::Close(doc.id));
             }
-            let tab = Rect::from_min_size(pos2(x, strip.min.y), vec2(w, t.tab_h));
-            match out.tabs.iter_mut().find(|(q, _)| q == p) {
-                Some((_, r)) => *r = r.union(tab),
-                None => out.tabs.push((*p, tab)),
-            }
-            let resp = ui.interact(tab, egui::Id::new(("tab", g.path.clone(), k)), Sense::click_and_drag());
-            if resp.drag_started() {
-                out.actions.push(DockAction::BeginDrag(*p));
-            }
-            // A document tab also answers to the panel's id while it is the shown one.
-            let auto_id = match e.doc {
-                Some(id) => format!("panel.tab.{}.{id}", p.id()),
-                None => format!("panel.tab.{}", p.id()),
-            };
-            reg.add_response(&auto_id, &resp, &e.label);
-            if e.shown_doc {
-                reg.add_response(&format!("panel.tab.{}", p.id()), &resp, &e.label);
-            }
-            let mut label_x = tab.min.x + 8.0;
-            if let Some(d) = e.deco {
-                let mut dx = tab.min.x + 6.0;
-                if is_active && d.viewer {
-                    let cr = Rect::from_center_size(pos2(dx + 5.0, text_y), vec2(10.0, 10.0));
-                    let cresp = ui.interact(cr.expand(2.0), egui::Id::new(("tab-close", g.path.clone(), k)), Sense::click());
-                    let cc = if cresp.hovered() { t.tab_text_active } else { t.tab_text };
-                    let kk = 3.5;
-                    painter.line_segment([cr.center() + vec2(-kk, -kk), cr.center() + vec2(kk, kk)], Stroke::new(1.2, cc));
-                    painter.line_segment([cr.center() + vec2(-kk, kk), cr.center() + vec2(kk, -kk)], Stroke::new(1.2, cc));
-                    reg.add_response(&format!("panel.tab.{}.close", p.id()), &cresp, "Close");
-                    crate::widgets::focus_outline(ui, &cresp, t);
-                    if cresp.clicked() {
-                        out.actions.push(close(e));
-                    }
-                    dx += 16.0;
-                }
-                let sw = Rect::from_center_size(pos2(dx + 5.0, text_y), vec2(9.0, 9.0));
-                painter.rect_filled(sw, 1.0, d.swatch);
-                dx += 14.0;
-                label_x = dx;
-                if lock {
-                    let lr = Rect::from_center_size(pos2(dx + 6.0, text_y), vec2(12.0, 12.0));
-                    let lresp = ui.interact(lr.expand(2.0), egui::Id::new(("tab-lock", g.path.clone(), k)), Sense::click());
-                    let lc = if d.locked {
-                        t.tab_text_active
-                    } else if lresp.hovered() {
-                        t.tab_text
-                    } else {
-                        t.text_faint
-                    };
-                    icons::paint(&painter, lr, Icon::Lock, lc);
-                    reg.add_response(&format!("panel.tab.{}.lock", p.id()), &lresp, if d.locked { "Unlock" } else { "Lock" });
-                    crate::widgets::focus_outline(ui, &lresp, t);
-                    if lresp.clicked() {
-                        out.actions.push(DockAction::ToggleLock(*p));
-                    }
-                    label_x = dx + 16.0;
-                }
-            }
-            let label_w = galley.size().x;
-            let col = if is_active || resp.hovered() { t.tab_text_active } else { t.tab_text };
-            painter.galley_with_override_text_color(pos2(label_x, text_y - galley.size().y / 2.0), galley, col);
-            if is_active {
-                let mr = Rect::from_center_size(pos2(label_x + label_w + 12.0, text_y), vec2(12.0, 10.0));
-                let mresp = ui.interact(mr.expand(3.0), egui::Id::new(("tab-menu", g.path.clone())), Sense::click());
-                reg.add_response(&format!("panel.menu.{}", p.id()), &mresp, "panel menu");
-                let mc = if mresp.hovered() { t.tab_text_active } else { t.tab_text };
-                for dy in [-3.5, 0.0, 3.5] {
-                    painter.line_segment([pos2(mr.min.x, mr.center().y + dy), pos2(mr.max.x, mr.center().y + dy)], Stroke::new(1.5, mc));
-                }
-                let uy = strip.min.y + 23.0;
-                painter.line_segment([pos2(label_x, uy), pos2(mr.max.x, uy)], Stroke::new(1.0, t.tab_text_active));
-                crate::widgets::focus_outline(ui, &mresp, t);
-                if mresp.clicked() {
-                    out.actions.push(DockAction::PanelMenu(*p, mr.left_bottom()));
-                }
-            }
-            crate::widgets::focus_outline(ui, &resp, t);
-            if resp.clicked() {
-                // A stacked frame's shown tab expands / collapses it; another tab shows that
-                // panel (expanding the frame).
-                if g.stacked.is_some() && (k == ai || entries.len() == 1) {
-                    out.actions.push(DockAction::ToggleStacked(*p));
-                } else {
-                    out.actions.push(activate(e));
-                }
-                out.actions.push(DockAction::Focus(*p));
-            }
-            if resp.middle_clicked() {
-                out.actions.push(close(e));
-            }
-            x += w + 8.0;
         }
-        // A stacked panel's whole header bar expands/collapses it, not just its name (as in After
-        // Effects): the frame with its shown tab.
-        if g.stacked.is_some()
-            && let Some(e) = entries.get(ai).or(entries.first())
-        {
-            let rest = Rect::from_min_max(pos2((x - 8.0).max(strip.min.x), strip.min.y), strip.max);
-            if rest.width() > 0.0 {
-                let resp = ui.interact(rest, egui::Id::new(("tab-rest", g.path.clone())), Sense::click());
-                reg.add(&format!("panel.header.{}", e.panel.id()), rest, &e.label);
-                if resp.clicked() {
-                    out.actions.push(DockAction::ToggleStacked(e.panel));
-                    out.actions.push(DockAction::Focus(e.panel));
-                }
-            }
+        if resp.clicked() {
+            out.push(DocAction::Activate(doc.id));
+        }
+        if resp.middle_clicked() {
+            out.push(DocAction::Close(doc.id));
         }
     }
-    // clicking anywhere in the panel focuses it; a press on another of its tabs waits for that
-    // tab's click, which focuses the panel actually chosen (a text edit stays open in Character)
-    let at = ui.input(|i| i.pointer.interact_pos());
-    if let Some(p) = active_panel
-        && ui.rect_contains_pointer(g.rect)
-        && ui.input(|i| i.pointer.any_pressed())
-        && !out.tabs.iter().any(|(q, r)| *q != p && at.is_some_and(|a| r.contains(a)))
-    {
-        out.actions.push(DockAction::Focus(p));
+    if !fit.overflow.is_empty() && fit.overflow_width > 0.0 {
+        let more = Rect::from_min_size(pos2(x, strip.min.y), vec2(fit.overflow_width, strip.height()));
+        let resp = ui.interact(more, egui::Id::unique("comp-tabs-more"), Sense::click());
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, resp.enabled(), "More compositions"));
+        reg.add_response(&format!("panel.tab.{timeline}.more"), &resp, "More compositions");
+        let color = if resp.hovered() { style.text } else { style.inactive_text };
+        ui.painter().with_clip_rect(more.intersect(clip)).text(more.center(), Align2::CENTER_CENTER, "\u{bb}", style.font.clone(), color);
+        egui::Popup::menu(&resp).show(|ui| {
+            egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
+                for index in &fit.overflow {
+                    let Some(doc) = docs.get(*index) else { continue };
+                    let item = ui.button(doc_job(doc, &style.font, style.text));
+                    item.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, item.enabled(), &doc.title));
+                    reg.add_response(&format!("panel.tab.{timeline}.more.{}", doc.id), &item, &doc.title);
+                    if item.clicked() {
+                        out.push(DocAction::Activate(doc.id));
+                        ui.close();
+                    }
+                }
+            });
+        });
     }
     out
 }
 
+/// A viewer lock button (Composition viewers and the Timeline keep their comp while locked): a
+/// closed padlock while locked, an open one while unlocked.
+/// Returns true when clicked. Automation: `panel.tab.<panel>.lock`.
+pub fn lock_button(ui: &mut egui::Ui, rect: Rect, panel: PanelKind, locked: bool, t: &Tokens, reg: &mut crate::automation::Registry) -> bool {
+    let resp = ui.interact(rect, egui::Id::unique(("tab-lock", panel.id())), Sense::click());
+    let color = if locked {
+        t.tab_text_active
+    } else if resp.hovered() {
+        t.tab_text
+    } else {
+        t.text_faint
+    };
+    icons::paint(ui.painter(), rect.shrink(2.0), if locked { Icon::Lock } else { Icon::LockOpen }, color);
+    reg.add_response(&format!("panel.tab.{}.lock", panel.id()), &resp, if locked { "Unlock" } else { "Lock" });
+    crate::widgets::focus_outline(ui, &resp, t);
+    resp.clicked()
+}
+
 /// Placeholder body for panels that are not implemented yet.
 pub fn placeholder(ui: &mut egui::Ui, rect: Rect, t: &Tokens, text: &str) {
     ui.painter().text(rect.center(), Align2::CENTER_CENTER, text, Tokens::ui(12.0), t.text_faint);
@@ -1365,438 +702,101 @@ pub fn placeholder(ui: &mut egui::Ui, rect: Rect, t: &Tokens, text: &str) {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use PanelKind::*;
+    use craft_ui::docking::{Action, Placement, Zone};
 
-    /// The original split clamp panicked whenever 0 < available < 40. Run the actual dock
-    /// layout without the app's last-resort panic guard so that regression cannot be hidden.
+    fn apply(w: &mut Workspace, action: Action<PanelKind>) {
+        w.apply(action, permissions).unwrap();
+    }
+
+    /// Only the title changes: existing saved workspace layouts still deserialize.
     #[test]
-    fn tiny_split_layouts_stay_inside_their_parent() {
-        let ctx = egui::Context::default();
-        let tokens = Tokens::for_kind(crate::theme::ThemeKind::Dark);
-        for extent in [20.0, 0.0, 1.0, 5.0, 15.0, 35.0, 39.9, 40.0, 80.0] {
-            for vertical in [false, true] {
-                for size in [SplitSize::Ratio(0.5), SplitSize::FixedA(300.0), SplitSize::FixedB(300.0)] {
-                    let rect = Rect::from_min_size(egui::Pos2::ZERO, egui::Vec2::splat(extent));
-                    let mut node =
-                        DockNode::Split { vertical, size, a: Box::new(tabs(&[PanelKind::Project], 0)), b: Box::new(tabs(&[PanelKind::Composition], 0)) };
-                    let mut groups = vec![];
-                    let mut registry = crate::automation::Registry::default();
-                    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| layout(ui, &mut node, rect, &tokens, "", &mut groups, &mut registry));
-                    output.textures_delta.clear();
-                    assert_eq!(groups.len(), 2);
-                    for group in groups {
-                        assert!(rect.contains_rect(group.rect), "{extent}, {vertical}: {:?}", group.rect);
-                        assert!(group.rect.width() >= 0.0 && group.rect.height() >= 0.0);
-                    }
-                }
+    fn scopes_label_is_descriptive_and_its_saved_identity_stays_compatible() {
+        let panel: PanelKind = serde_json::from_str("\"LumetriScopes\"").unwrap();
+        assert_eq!(panel, LumetriScopes);
+        assert_eq!(panel.title(), "Video Scopes");
+        assert_eq!(panel.id(), "LumetriScopes");
+        assert_eq!(serde_json::to_string(&panel).unwrap(), "\"LumetriScopes\"");
+    }
+
+    #[test]
+    fn after_effects_workspaces_exist_with_their_core_panels() {
+        for name in WORKSPACES {
+            let w = Workspace::new(workspace(name));
+            w.validate().unwrap_or_else(|e| panic!("{name}: {e}"));
+            assert!(w.is_docked(Composition), "{name}");
+            if *name != "Undocked Panels" {
+                assert!(w.is_docked(Timeline), "{name}");
             }
         }
-    }
-
-    #[test]
-    fn open_near_in_an_empty_dock_makes_the_panel_the_dock() {
-        for p in [PanelKind::Composition, PanelKind::Timeline, PanelKind::Project] {
-            let mut d = tabs(&[], 0);
-            d.open_near(p, PanelKind::EffectsPresets);
-            assert!(d.is_visible(p));
-            assert_eq!(d.panel_count(), 1);
+        let all = Workspace::new(workspace("All Panels"));
+        for p in PanelKind::ALL.iter().filter(|p| !matches!(p, ScriptConsole | EssentialGraphics | MaskInterpolation)) {
+            assert!(all.is_open(*p), "All Panels lacks {p:?}");
         }
-    }
-
-    #[test]
-    fn open_near_without_any_anchor_uses_the_first_group() {
-        let mut d = tabs(&[PanelKind::Composition], 0);
-        d.open_near(PanelKind::Timeline, PanelKind::EffectsPresets);
-        assert!(d.is_visible(PanelKind::Timeline));
-        assert_eq!(d.panel_count(), 2);
-    }
-
-    #[test]
-    fn stacked_panels_toggle_open_close() {
-        use PanelKind::*;
-        let mut d = stack(&[(Preview, true, Some(46.0)), (Properties, true, None), (Align, false, None)]);
-        assert!(d.is_visible(Properties) && !d.is_visible(Align));
-        assert!(d.toggle_stacked(Align));
-        assert!(d.is_visible(Align));
-        assert!(d.toggle_stacked(Align) && !d.is_visible(Align));
-        // Showing a collapsed panel expands it; opening a new panel near one inserts after it.
-        assert!(d.activate(Align) && d.is_visible(Align));
-        d.open_near(Info, Properties);
-        let mut v = vec![];
-        d.panels(&mut v);
-        assert_eq!(v, [Preview, Properties, Info, Align]);
-        d.close(Preview);
-        assert!(!d.contains(Preview));
-        assert!(!d.toggle_stacked(Timeline));
-    }
-
-    fn entry(panel: PanelKind, open: bool, height: Option<f32>) -> StackEntry {
-        StackEntry::new(panel, open, height)
-    }
-
-    fn close_to(a: &[f32], b: &[f32]) -> bool {
-        a.len() == b.len() && a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-3)
-    }
-
-    #[test]
-    fn stacked_panels_fill_their_column() {
-        use PanelKind::*;
-        // A panel with a height keeps it; the open ones without share the rest.
-        let s = [entry(Preview, true, Some(100.0)), entry(Properties, true, None), entry(Align, false, None), entry(Audio, true, None)];
-        assert!(close_to(&stack_bodies(&s, 500.0), &[100.0, 200.0, 0.0, 200.0]));
-        // Too little room: the heights shrink so the others keep their minimum.
-        let s = [entry(Preview, true, Some(500.0)), entry(Properties, true, None)];
-        assert!(close_to(&stack_bodies(&s, 300.0), &[260.0, STACK_MIN]));
-        // Nothing to take the rest: the heights grow in proportion (above the minimum) to fill.
-        let s = [entry(Preview, true, Some(100.0)), entry(Properties, true, Some(300.0)), entry(Align, false, Some(80.0))];
-        assert!(close_to(&stack_bodies(&s, 600.0), &[137.5, 462.5, 0.0]));
-        let s = [entry(Preview, true, Some(46.0)), entry(Properties, false, None)];
-        assert!(close_to(&stack_bodies(&s, 600.0), &[600.0, 0.0]));
-        // Hostile sizes never make a body negative or non-finite.
-        for avail in [-50.0, 0.0, 10.0, f32::NAN, f32::INFINITY] {
-            for h in [None, Some(-5.0), Some(f32::NAN), Some(f32::INFINITY), Some(1e30), Some(f32::MAX)] {
-                let s = [entry(Preview, true, h), entry(Properties, true, Some(60.0)), entry(Align, false, h)];
-                let b = stack_bodies(&s, avail);
-                assert!(b.iter().all(|x| x.is_finite() && *x >= 0.0), "{avail} {h:?}: {b:?}");
+        // No built-in workspace uses accordions: right columns are frames split vertically.
+        fn no_stack(node: &Node<PanelKind>) -> bool {
+            match node {
+                Node::Split { first, second, .. } => no_stack(first) && no_stack(second),
+                Node::Stack { .. } => false,
+                _ => true,
             }
         }
-        assert!(stack_bodies(&[], 100.0).is_empty());
-    }
-
-    #[test]
-    fn dragging_a_stack_gap_trades_height_between_its_neighbours() {
-        use PanelKind::*;
-        let mut s = vec![entry(Preview, true, Some(46.0)), entry(Properties, true, None), entry(Align, false, None)];
-        let bodies = stack_bodies(&s, 800.0);
-        resize_stacked(&mut s, &bodies, 0, 1, 100.0);
-        // Preview keeps its new height; Properties, the only panel without one, takes the rest.
-        assert_eq!(s[0].height, Some(146.0));
-        assert_eq!(s[1].height, None);
-        assert!(close_to(&stack_bodies(&s, 800.0), &[146.0, 654.0, 0.0]));
-        // Neither side goes below the minimum.
-        for (d, want) in [(-1000.0, STACK_MIN), (1000.0, 800.0 - STACK_MIN)] {
-            let bodies = stack_bodies(&s, 800.0);
-            resize_stacked(&mut s, &bodies, 0, 1, d);
-            assert!(close_to(&stack_bodies(&s, 800.0)[..1], &[want]), "{d}");
-        }
-        // Two sharing panels: the upper one gets a height, the lower one keeps sharing.
-        let mut s = vec![entry(Preview, true, None), entry(Align, false, None), entry(Properties, true, None)];
-        let bodies = stack_bodies(&s, 400.0);
-        resize_stacked(&mut s, &bodies, 0, 2, 50.0);
-        assert_eq!((s[0].height, s[2].height), (Some(250.0), None));
-        assert!(close_to(&stack_bodies(&s, 400.0), &[250.0, 0.0, 150.0]));
-        // Out-of-range indices change nothing.
-        let before = s.clone();
-        resize_stacked(&mut s, &bodies, 0, 9, 50.0);
-        assert_eq!(s, before);
-    }
-
-    #[test]
-    fn default_workspace_has_ae_right_column_stack() {
-        let d = workspace("Default");
-        assert!(d.is_visible(PanelKind::Properties) && d.is_visible(PanelKind::Preview));
-        assert!(d.contains(PanelKind::EffectsPresets) && !d.is_visible(PanelKind::EffectsPresets));
-    }
-
-    #[test]
-    fn workspaces_contain_core_panels() {
-        for w in WORKSPACES {
-            let d = workspace(w);
-            let floating: Vec<PanelKind> = workspace_floating(w).into_iter().flat_map(|f| f.panels).collect();
-            assert!(d.contains(PanelKind::Timeline) || floating.contains(&PanelKind::Timeline), "{w}");
-            assert!(d.contains(PanelKind::Composition) || d.contains(PanelKind::Layer), "{w}");
-            // A panel is in one place only.
-            let mut all = vec![];
-            d.panels(&mut all);
-            all.extend(floating);
-            let n = all.len();
-            all.sort_by_key(|p| p.id());
-            all.dedup();
-            assert_eq!(all.len(), n, "{w} has a panel twice");
+        for name in WORKSPACES {
+            let layout = workspace(name);
+            assert!(layout.root.iter().chain(layout.floating.iter().map(|f| &f.root)).all(no_stack), "{name}");
         }
     }
 
     #[test]
-    fn after_effects_workspaces_exist() {
-        // Window ▸ Workspace in After Effects 2026, less Libraries (an Adobe service).
-        for w in [
-            "Default",
-            "Review",
-            "Learn",
-            "Small Screen",
-            "Standard",
-            "All Panels",
-            "Animation",
-            "Essential Graphics",
-            "Color",
-            "Effects",
-            "Minimal",
-            "Motion Tracking",
-            "Paint",
-            "Text",
-            "Undocked Panels",
-        ] {
-            assert!(WORKSPACES.contains(&w), "{w}");
-        }
-        assert!(!WORKSPACES.contains(&"Libraries"));
-        // Layouts differ from Default (except Learn, which is Default plus the Home screen).
-        let def = workspace("Default");
-        for w in WORKSPACES.iter().filter(|w| !matches!(**w, "Default" | "Learn")) {
-            assert_ne!(workspace(w), def, "{w} falls back to Default");
-        }
-        assert!(workspace("Essential Graphics").contains(PanelKind::Properties));
-        assert!(workspace("Color").contains(PanelKind::EffectControls));
-        assert!(!workspace_floating("Undocked Panels").is_empty());
-        // Every built-in workspace is in Window ▸ Workspace.
-        let menu: Vec<String> = effectcraft_engine::menus::entries()
-            .into_iter()
-            .filter(|(_, e)| e.command == "window.workspace")
-            .filter_map(|(_, e)| e.params.get("name").and_then(|v| v.as_str()).map(str::to_string))
-            .collect();
-        for w in WORKSPACES {
-            assert!(menu.iter().any(|m| m == w), "{w} missing from Window > Workspace");
-        }
-    }
-
-    #[test]
-    fn short_splits_lay_out_without_panicking() {
-        // #306: a split 0 < avail < 40 pt tall made `f32::clamp` panic (its bounds crossed).
-        for avail in [0.0, 5.0, 19.0, 20.0, 30.0, 39.0, 40.0, 41.0, -10.0, f32::NAN, f32::INFINITY] {
-            for size in [SplitSize::Ratio(0.5), SplitSize::Ratio(f32::NAN), SplitSize::FixedA(300.0), SplitSize::FixedB(300.0), SplitSize::FixedA(-5.0)] {
-                let f = split_first(size, avail);
-                assert!(f.is_finite() && f >= 0.0, "{size:?} {avail}: {f}");
-                if avail.is_finite() && avail > 0.0 {
-                    assert!(f <= avail, "{size:?} {avail}: {f}");
-                }
-            }
-        }
-        assert_eq!(split_first(SplitSize::FixedA(300.0), 30.0), 20.0);
-        assert_eq!(split_first(SplitSize::Ratio(0.5), 200.0), 100.0);
-        assert_eq!(clamp_ordered(5.0, 40.0, -4.0), 40.0);
-        // Every workspace, laid out in rects too short and too narrow for its minimums.
-        let ctx = egui::Context::default();
-        let t = Tokens::for_kind(crate::theme::ThemeKind::Dark);
-        for w in WORKSPACES {
-            for (wd, ht) in [(30.0, 30.0), (800.0, 36.0), (800.0, 45.0), (36.0, 600.0), (1.0, 1.0), (0.0, 0.0)] {
-                let mut node = workspace(w);
-                let mut frame = ctx.run_ui(egui::RawInput::default(), |ui| {
-                    let mut out = vec![];
-                    let mut reg = crate::automation::Registry::default();
-                    layout(ui, &mut node, Rect::from_min_size(pos2(0.0, 0.0), vec2(wd, ht)), &t, "", &mut out, &mut reg);
-                    assert!(!out.is_empty(), "{w}");
-                });
-                frame.textures_delta.clear();
-            }
-        }
-    }
-
-    #[test]
-    fn drop_zone_math() {
-        let r = Rect::from_min_size(pos2(100.0, 100.0), vec2(400.0, 300.0));
-        let tab = 28.0;
-        assert_eq!(drop_zone(r, tab, pos2(300.0, 110.0)), Zone::Center, "tab strip");
-        assert_eq!(drop_zone(r, tab, r.center()), Zone::Center);
-        assert_eq!(drop_zone(r, tab, pos2(120.0, 250.0)), Zone::Left);
-        assert_eq!(drop_zone(r, tab, pos2(490.0, 250.0)), Zone::Right);
-        assert_eq!(drop_zone(r, tab, pos2(300.0, 140.0)), Zone::Top);
-        assert_eq!(drop_zone(r, tab, pos2(300.0, 390.0)), Zone::Bottom);
-        // Corners go to the nearer edge.
-        assert_eq!(drop_zone(r, tab, pos2(105.0, 395.0)), Zone::Left);
-        assert_eq!(zone_rect(r, Zone::Right), Rect::from_min_max(pos2(300.0, 100.0), r.max));
-        assert_eq!(zone_rect(r, Zone::Top).height(), 150.0);
-        assert_eq!(zone_rect(r, Zone::Center), r);
-    }
-
-    #[test]
-    fn dock_panel_splits_and_inserts_tabs() {
-        use PanelKind::*;
-        let mut d = workspace("Standard");
-        let n = d.panel_count();
-        // Tab next to an anchor.
-        assert!(d.dock_panel(Info, Timeline, Zone::Center));
-        assert_eq!(d.panel_count(), n);
-        let p = d.path_of(Timeline).unwrap();
-        assert_eq!(d.path_of(Info).unwrap(), p);
-        assert!(d.is_visible(Info));
-        // Split to the right of the Composition group: a new single-tab group beside it.
-        assert!(d.dock_panel(Info, Composition, Zone::Right));
-        let comp_path = d.path_of(Composition).unwrap();
-        let info_path = d.path_of(Info).unwrap();
-        assert_eq!(comp_path.len(), info_path.len());
-        assert!(comp_path.ends_with('a') && info_path.ends_with('b'));
-        assert!(d.is_visible(Info));
-        // Top: the new group comes first in a vertical split.
-        assert!(d.dock_panel(Audio, Timeline, Zone::Top));
-        assert!(d.path_of(Audio).unwrap().ends_with('a'));
-        // Dropping a panel on itself or an undocked anchor changes nothing.
-        let before = d.clone();
-        assert!(!d.dock_panel(Audio, Audio, Zone::Left));
-        assert!(!d.dock_panel(Audio, Tracker, Zone::Left));
-        assert_eq!(d, before);
-        // Into a stack: a tab of the anchor's frame (#302).
-        let mut s = workspace("Default");
-        let props = s.path_of(Properties).unwrap();
-        assert!(s.dock_panel(Tracker, Properties, Zone::Center));
-        assert_eq!(s.path_of(Tracker), Some(props.clone()));
-        assert!(s.is_visible(Tracker) && !s.is_visible(Properties));
-        assert!(s.activate(Properties) && s.is_visible(Properties));
-        // Top / Bottom: a frame of its own above / below the anchor's, not a split column.
-        assert!(s.dock_panel(Info, Properties, Zone::Bottom));
-        let below = s.path_of(Info).unwrap();
-        assert_ne!(below, props);
-        assert_eq!(s.path_of(Properties), Some(props.clone()));
-        assert!(s.dock_panel(Info, Properties, Zone::Top));
-        assert_eq!(s.path_of(Info), Some(props.clone()), "above Properties: its frame's index");
-        // Closing a tab keeps the frame; closing the frame's last tab removes it.
-        s.close(Tracker);
-        assert!(s.contains(Properties) && !s.contains(Tracker));
-        // A tab dragged onto a stacked frame's tab strip joins that frame.
-        let mut t = workspace("Default");
-        assert!(t.insert_tab(Info, Preview, None));
-        assert_eq!(t.path_of(Info), t.path_of(Preview));
-        // Moving the only panel of a group collapses its split.
-        let mut m = hsplit(SplitSize::Ratio(0.5), tabs(&[Project], 0), tabs(&[Composition], 0));
-        assert!(m.dock_panel(Project, Composition, Zone::Center));
-        assert_eq!(m, tabs(&[Composition, Project], 1));
-    }
-
-    /// #302: workspaces saved when each stacked frame held one `panel` still load.
-    #[test]
-    fn old_stack_entries_load() {
-        let e: StackEntry = serde_json::from_str(r#"{"panel":"Preview","open":true,"height":46.0}"#).unwrap();
-        assert_eq!(e, StackEntry::new(PanelKind::Preview, true, Some(46.0)));
-        let s = serde_json::to_string(&workspace("Default")).unwrap();
-        assert_eq!(serde_json::from_str::<DockNode>(&s).unwrap(), workspace("Default"));
-    }
-
-    #[test]
-    fn floating_layout_round_trips() {
-        use PanelKind::*;
-        let mut l = Layout { root: workspace("Standard"), floating: vec![] };
-        assert!(l.float(Info, [200.0, 150.0, 320.0, 240.0]));
-        assert!(!l.root.contains(Info) && l.contains(Info));
-        // Tab another panel into the floating group, then dock it back.
-        assert!(l.dock(Audio, Info, Zone::Center));
-        assert_eq!(l.floating[0].panels, [Info, Audio]);
-        assert!(!l.dock(Audio, Info, Zone::Left), "floating groups only take tabs");
-        assert!(l.dock(Info, Timeline, Zone::Bottom));
-        assert_eq!(l.floating[0].panels, [Audio]);
-        assert!(l.root.contains(Info));
-        let s = serde_json::to_string(&l).unwrap();
-        let back: Layout = serde_json::from_str(&s).unwrap();
-        assert_eq!(back, l);
-        // A workspace saved before floating panels existed still loads.
-        let old: Layout = serde_json::from_str(&format!("{{\"root\": {}}}", serde_json::to_string(&l.root).unwrap())).unwrap();
-        assert!(old.floating.is_empty());
-        // The last docked panel can't float.
-        let mut one = Layout { root: tabs(&[Timeline], 0), floating: vec![] };
-        assert!(!one.float(Timeline, [0.0; 4]));
-        assert!(l.unfloat(Audio) && l.floating.is_empty());
-    }
-
-    #[test]
-    fn close_and_open() {
-        let mut d = workspace("Default");
-        d.close(PanelKind::Paragraph);
-        assert!(!d.contains(PanelKind::Paragraph));
-        d.open_near(PanelKind::Tracker, PanelKind::EffectsPresets);
-        assert!(d.is_visible(PanelKind::Tracker));
-        let s = serde_json::to_string(&d).unwrap();
-        let back: DockNode = serde_json::from_str(&s).unwrap();
-        assert_eq!(back, d);
-        assert_eq!(PanelKind::from_name("effects & presets"), Some(PanelKind::EffectsPresets));
-    }
-
-    /// Ported from #630 (Ni-zav): the reporter's reproduction on the Minimal workspace.
-    #[test]
-    fn window_panels_reopen_after_last_panel_is_closed() {
-        use PanelKind::*;
-        for reopen in [Composition, Timeline, Project] {
-            let mut d = workspace("Minimal");
-            d.close(Composition);
-            d.close(Timeline);
-            assert_eq!(d.panel_count(), 0);
-            d.open_near(reopen, EffectsPresets);
-            assert_eq!(d.panel_count(), 1);
-            assert!(d.is_visible(reopen), "{reopen:?} must be visible");
-        }
-        let mut d = tabs(&[Audio], 0);
-        d.open_near(History, Project);
-        assert_eq!(d, tabs(&[Audio, History], 1));
-        let mut d = workspace("Minimal");
-        d.open_near(EffectsPresets, Timeline);
-        assert_eq!(d.path_of(EffectsPresets), d.path_of(Timeline));
-    }
-
-    #[test]
-    fn closing_earlier_inactive_tab_keeps_the_shown_panel() {
-        use PanelKind::*;
-        let mut d = tabs(&[Properties, Align, EffectsPresets], 1);
-        d.close(Properties);
-        assert!(d.is_visible(Align), "closing an inactive tab keeps the shown panel");
-        assert!(!d.is_visible(EffectsPresets));
-        assert_eq!(d.panel_count(), 2);
-    }
-
-    #[test]
-    fn closing_active_tab_keeps_existing_neighbor_choice() {
-        use PanelKind::*;
-        for (active, closed, shown) in [(0, Properties, Align), (1, Align, EffectsPresets), (2, EffectsPresets, Align)] {
-            let mut d = tabs(&[Properties, Align, EffectsPresets], active);
-            d.close(closed);
-            assert!(d.is_visible(shown), "active {active}: {closed:?} -> {shown:?}");
-        }
-    }
-
-    #[test]
-    fn close_normalizes_invalid_active_and_collapses_empty_splits() {
-        use PanelKind::*;
-        let mut d = tabs(&[Properties, Align, EffectsPresets], usize::MAX);
-        d.close(History);
-        assert!(d.is_visible(EffectsPresets));
-        d.close(Properties);
-        assert!(d.is_visible(EffectsPresets));
-        d.close(EffectsPresets);
-        assert!(d.is_visible(Align));
-        d.close(Align);
-        assert_eq!(d, tabs(&[], 0));
-        let mut d = DockNode::Split { vertical: true, size: SplitSize::Ratio(0.5), a: Box::new(tabs(&[Properties], 0)), b: Box::new(tabs(&[Align], 0)) };
-        d.close(Properties);
-        assert_eq!(d, tabs(&[Align], 0));
-        d.close(Align);
-        assert_eq!(d, tabs(&[], 0));
-    }
-
-    #[test]
-    fn removing_earlier_inactive_floating_tab_keeps_the_shown_panel() {
-        use PanelKind::*;
-        let mut layout = Layout {
-            root: tabs(&[Composition], 0),
-            floating: vec![Floating { panels: vec![Properties, Align, EffectsPresets], active: 1, rect: [0.0, 0.0, 300.0, 200.0] }],
+    fn default_right_column_is_a_short_preview_frame_over_the_properties_frame() {
+        let default = workspace("Default");
+        let Some(Node::Split { second, size: SplitSize::FixedSecond(300.0), .. }) = &default.root else { panic!("{default:?}") };
+        let Node::Split { axis: SplitAxis::Vertical, size: SplitSize::FixedFirst(PREVIEW_FRAME), first, second } = second.as_ref() else {
+            panic!("{second:?}")
         };
-        assert!(layout.unfloat(Properties));
-        let f = &layout.floating[0];
-        assert_eq!(f.panels.get(f.active), Some(&Align));
-        assert!(layout.root.is_visible(Composition));
+        assert_eq!(**first, tabs(&[Preview], 0));
+        assert_eq!(**second, tabs(&[Properties, Align, Audio, EffectsPresets], 0));
+        let mut w = Workspace::new(default);
+        assert!(w.is_visible(Preview) && w.is_visible(Properties) && !w.is_visible(Align));
+        // The Properties frame takes tabs; the Preview frame stays a frame of its own.
+        apply(&mut w, Action::Move { panel: Project, anchor: Properties, placement: Placement::Tab { before: None } });
+        assert_eq!(w.group_of(Project), vec![Properties, Align, Audio, EffectsPresets, Project]);
+        assert_eq!(w.group_of(Preview), vec![Preview]);
     }
 
     #[test]
-    fn floating_removal_keeps_active_neighbor_and_handles_invalid_index() {
-        use PanelKind::*;
-        for (active, closed, shown) in
-            [(0, Properties, Align), (1, Align, EffectsPresets), (2, EffectsPresets, Align), (usize::MAX, Properties, EffectsPresets)]
-        {
-            let mut layout = Layout {
-                root: tabs(&[Composition], 0),
-                floating: vec![Floating { panels: vec![Properties, Align, EffectsPresets], active, rect: [0.0, 0.0, 300.0, 200.0] }],
-            };
-            assert!(layout.unfloat(closed));
-            let f = &layout.floating[0];
-            assert_eq!(f.panels.get(f.active), Some(&shown));
-            for p in [Properties, Align, EffectsPresets] {
-                layout.unfloat(p);
-            }
-            assert!(layout.floating.is_empty());
-            assert!(!layout.unfloat(History));
-        }
+    fn panels_split_off_and_join_tab_groups() {
+        let mut w = docked(hsplit(SplitSize::FixedFirst(300.0), tabs(&[Project, EffectControls], 0), tabs(&[Composition, Layer], 0)));
+        apply(&mut w, Action::Move { panel: EffectControls, anchor: Composition, placement: Placement::Split(Zone::Right) });
+        assert_eq!(w.group_of(EffectControls), vec![EffectControls]);
+        assert_eq!(w.group_of(Project), vec![Project]);
+        apply(&mut w, Action::Move { panel: EffectControls, anchor: Composition, placement: Placement::Tab { before: Some(Layer) } });
+        assert_eq!(w.group_of(Composition), vec![Composition, EffectControls, Layer]);
+        assert!(w.is_visible(EffectControls));
+        // A rejected move (onto itself, onto a closed panel) changes nothing.
+        let before = w.clone();
+        assert!(w.apply(Action::Move { panel: Project, anchor: Info, placement: Placement::Split(Zone::Left) }, permissions).is_err());
+        assert_eq!(w, before);
+    }
+
+    #[test]
+    fn closed_panels_reopen_where_they_were_docked_or_floating() {
+        let mut w = Workspace::new(workspace("Standard"));
+        apply(&mut w, Action::Close { panel: Info });
+        assert!(!w.is_open(Info));
+        w.set_visible(Info, true, None, permissions).unwrap();
+        assert_eq!(w.group_of(Info), vec![Info, Audio]);
+        apply(&mut w, Action::Float { panel: Audio, rect: [40.0, 50.0, 300.0, 200.0] });
+        apply(&mut w, Action::Close { panel: Audio });
+        w.set_visible(Audio, true, None, permissions).unwrap();
+        assert!(w.is_floating(Audio));
+        // Closing an earlier, inactive tab keeps the shown panel.
+        let mut w = docked(tabs(&[Properties, Align, EffectsPresets], 2));
+        apply(&mut w, Action::Close { panel: Properties });
+        assert!(w.is_visible(EffectsPresets));
+        // A panel never laid out opens beside its anchor.
+        apply(&mut w, Action::Open { panel: History, anchor: Some(Align) });
+        assert_eq!(w.group_of(History), vec![Align, EffectsPresets, History]);
+        assert_eq!(referenced_panels(&w).iter().filter(|p| **p == Properties).count(), 1, "the closed panel is still known");
     }
 }
diff --git a/crates/ui-egui/src/dock_shared.rs b/crates/ui-egui/src/dock_shared.rs
deleted file mode 100644
index 4f090e219..000000000
--- a/crates/ui-egui/src/dock_shared.rs
+++ /dev/null
@@ -1,312 +0,0 @@
-//! Convert the persisted workspace schema to shared docking transactions.
-
-use craft_ui::docking::{Action, Floating as SharedFloating, Layout as SharedLayout, Node, Placement, StackEntry as SharedStackEntry};
-use craft_ui::layout::{SplitAxis, SplitSize as SharedSplitSize};
-
-use crate::dock::{DockNode, Floating, Layout, PanelKind, SplitSize, StackEntry};
-
-const MAX_DEPTH: usize = 32;
-const MAX_NODES: usize = 4096;
-const MAX_PANELS: usize = 128;
-
-fn encode_node(node: &DockNode, depth: usize, count: &mut usize) -> Result<Node<PanelKind>, String> {
-    *count = count.saturating_add(1);
-    if depth > MAX_DEPTH || *count > MAX_NODES {
-        return Err("workspace dock tree exceeds supported limits".into());
-    }
-    Ok(match node {
-        DockNode::Tabs { panels, active } => {
-            if panels.len() > MAX_PANELS {
-                return Err("too many workspace tabs".into());
-            }
-            Node::Tabs { panels: panels.clone(), active: *active }
-        }
-        DockNode::Stack { entries } => {
-            if entries.len() > MAX_PANELS {
-                return Err("too many workspace stack entries".into());
-            }
-            if entries.iter().any(|entry| entry.panels.is_empty() || entry.active >= entry.panels.len() || entry.panels.len() > MAX_PANELS) {
-                return Err("invalid stacked tab selection".into());
-            }
-            Node::Stack {
-                entries: entries
-                    .iter()
-                    .flat_map(|entry| entry.panels.iter().map(move |panel| SharedStackEntry { panel: *panel, open: entry.open, height: entry.height }))
-                    .collect(),
-            }
-        }
-        DockNode::Split { vertical, size, a, b } => Node::Split {
-            axis: if *vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal },
-            size: match *size {
-                SplitSize::Ratio(value) => SharedSplitSize::Ratio(value),
-                SplitSize::FixedA(value) => SharedSplitSize::FixedFirst(value),
-                SplitSize::FixedB(value) => SharedSplitSize::FixedSecond(value),
-            },
-            first: Box::new(encode_node(a, depth.saturating_add(1), count)?),
-            second: Box::new(encode_node(b, depth.saturating_add(1), count)?),
-        },
-    })
-}
-
-fn decode_node(node: Node<PanelKind>) -> DockNode {
-    match node {
-        Node::Tabs { panels, active } => DockNode::Tabs { panels, active },
-        Node::Stack { entries } => {
-            DockNode::Stack { entries: entries.into_iter().map(|entry| StackEntry::new(entry.panel, entry.open, entry.height)).collect() }
-        }
-        Node::Split { axis, size, first, second } => DockNode::Split {
-            vertical: axis == SplitAxis::Vertical,
-            size: match size {
-                SharedSplitSize::Ratio(value) => SplitSize::Ratio(value),
-                SharedSplitSize::FixedFirst(value) => SplitSize::FixedA(value),
-                SharedSplitSize::FixedSecond(value) => SplitSize::FixedB(value),
-            },
-            a: Box::new(decode_node(*first)),
-            b: Box::new(decode_node(*second)),
-        },
-    }
-}
-
-pub(crate) fn encode(root: &DockNode, floating: &[Floating]) -> Result<SharedLayout<PanelKind>, String> {
-    if floating.len() > MAX_PANELS || floating.iter().any(|group| group.panels.len() > MAX_PANELS) {
-        return Err("too many floating workspace panels".into());
-    }
-    let root = if matches!(root, DockNode::Tabs { panels, active: 0 } if panels.is_empty()) { None } else { Some(encode_node(root, 0, &mut 0)?) };
-    Ok(SharedLayout {
-        root,
-        floating: floating.iter().map(|group| SharedFloating { panels: group.panels.clone(), active: group.active, rect: group.rect }).collect(),
-    })
-}
-
-pub(crate) fn decode(layout: SharedLayout<PanelKind>) -> Layout {
-    Layout {
-        root: layout.root.map(decode_node).unwrap_or_else(|| DockNode::Tabs { panels: vec![], active: 0 }),
-        floating: layout.floating.into_iter().map(|group| Floating { panels: group.panels, active: group.active, rect: group.rect }).collect(),
-    }
-}
-
-/// Restore app-owned accordion tab frames after shared validation/transactions.
-/// The shared model represents individual stack panels; grouping stays in the persisted app schema.
-fn restore_frames(node: &mut DockNode, original: &DockNode) {
-    fn collect(node: &DockNode, out: &mut Vec<StackEntry>) {
-        match node {
-            DockNode::Split { a, b, .. } => {
-                collect(a, out);
-                collect(b, out);
-            }
-            DockNode::Stack { entries } => out.extend(entries.iter().cloned()),
-            DockNode::Tabs { .. } => {}
-        }
-    }
-    fn restore(node: &mut DockNode, frames: &[StackEntry]) {
-        match node {
-            DockNode::Split { a, b, .. } => {
-                restore(a, frames);
-                restore(b, frames);
-            }
-            DockNode::Stack { entries } => {
-                let mut result: Vec<StackEntry> = Vec::new();
-                for entry in std::mem::take(entries) {
-                    let Some(panel) = entry.shown() else { continue };
-                    let old = frames.iter().find(|frame| frame.contains(panel));
-                    if let Some(last) = result.last_mut()
-                        && old.is_some_and(|frame| last.panels.iter().all(|p| frame.contains(*p)))
-                    {
-                        last.panels.push(panel);
-                        if old.and_then(StackEntry::shown) == Some(panel) {
-                            last.active = last.panels.len().saturating_sub(1);
-                        }
-                    } else {
-                        result.push(entry);
-                    }
-                }
-                for entry in &mut result {
-                    if let Some(old) = frames.iter().find(|frame| entry.panels.iter().all(|panel| frame.contains(*panel))) {
-                        entry.active = old
-                            .shown()
-                            .and_then(|shown| entry.panels.iter().position(|panel| *panel == shown))
-                            .unwrap_or(old.active.min(entry.panels.len().saturating_sub(1)));
-                    }
-                }
-                *entries = result;
-            }
-            DockNode::Tabs { .. } => {}
-        }
-    }
-    let mut frames = Vec::new();
-    collect(original, &mut frames);
-    restore(node, &frames);
-}
-
-pub(crate) fn apply(layout: &mut Layout, action: Action<PanelKind>) -> Result<(), String> {
-    let mut shared = encode(&layout.root, &layout.floating)?;
-    // Validate the same shared command first. Native stack insertion then retains tabs inside
-    // their accordion frame, including the existing before/after insertion policy.
-    shared.apply(action.clone()).map_err(|error| error.to_string())?;
-    let mut proposed = decode(shared);
-    restore_frames(&mut proposed.root, &layout.root);
-    match action {
-        Action::Move { panel, anchor, placement } | Action::OpenAt { panel, anchor, placement } if layout.root.contains(anchor) => {
-            fn stacked(node: &DockNode, p: PanelKind) -> bool {
-                match node {
-                    DockNode::Split { a, b, .. } => stacked(a, p) || stacked(b, p),
-                    DockNode::Stack { entries } => entries.iter().any(|e| e.contains(p)),
-                    _ => false,
-                }
-            }
-            if stacked(&layout.root, anchor) {
-                let mut native = layout.clone();
-                native.unfloat(panel);
-                let applied = match placement {
-                    Placement::Tab { before } => native.root.insert_tab(panel, anchor, before),
-                    Placement::Split(zone) => native.root.dock_panel(
-                        panel,
-                        anchor,
-                        match zone {
-                            craft_ui::docking::Zone::Left => crate::dock::Zone::Left,
-                            craft_ui::docking::Zone::Right => crate::dock::Zone::Right,
-                            craft_ui::docking::Zone::Top => crate::dock::Zone::Top,
-                            craft_ui::docking::Zone::Bottom => crate::dock::Zone::Bottom,
-                            craft_ui::docking::Zone::Center => crate::dock::Zone::Center,
-                        },
-                    ),
-                };
-                if !applied {
-                    return Err("stacked panel move failed".into());
-                }
-                proposed = native;
-            }
-        }
-        Action::Activate { panel } => {
-            proposed.root.activate(panel);
-        }
-        Action::SetStackOpen { panel, open } => {
-            fn set(node: &mut DockNode, p: PanelKind, open: bool) {
-                match node {
-                    DockNode::Split { a, b, .. } => {
-                        set(a, p, open);
-                        set(b, p, open);
-                    }
-                    DockNode::Stack { entries } => {
-                        if let Some(e) = entries.iter_mut().find(|e| e.contains(p)) {
-                            e.open = open;
-                        }
-                    }
-                    _ => {}
-                }
-            }
-            set(&mut proposed.root, panel, open);
-        }
-        Action::ResizeStack { panel, height } => {
-            fn set(node: &mut DockNode, p: PanelKind, h: Option<f32>) {
-                match node {
-                    DockNode::Split { a, b, .. } => {
-                        set(a, p, h);
-                        set(b, p, h);
-                    }
-                    DockNode::Stack { entries } => {
-                        if let Some(e) = entries.iter_mut().find(|e| e.contains(p)) {
-                            e.height = h;
-                        }
-                    }
-                    _ => {}
-                }
-            }
-            set(&mut proposed.root, panel, height);
-        }
-        _ => {}
-    }
-    encode(&proposed.root, &proposed.floating)?.validate().map_err(|error| error.to_string())?;
-    *layout = proposed;
-    Ok(())
-}
-
-pub(crate) fn apply_tree(root: &mut DockNode, action: Action<PanelKind>) -> bool {
-    if !valid_tree(root) {
-        return false;
-    }
-    let mut layout = Layout { root: root.clone(), floating: vec![] };
-    if apply(&mut layout, action).is_err() {
-        return false;
-    }
-    *root = layout.root;
-    true
-}
-
-pub(crate) fn valid_tree(root: &DockNode) -> bool {
-    encode(root, &[]).is_ok_and(|shared| shared.validate().is_ok())
-}
-
-pub(crate) fn valid_for_close(root: &DockNode) -> bool {
-    fn normalize(node: &mut Node<PanelKind>) {
-        match node {
-            Node::Tabs { panels, active } => *active = (*active).min(panels.len().saturating_sub(1)),
-            Node::Split { first, second, .. } => {
-                normalize(first);
-                normalize(second);
-            }
-            Node::Stack { .. } => {}
-        }
-    }
-    let Ok(mut shared) = encode(root, &[]) else { return false };
-    if let Some(root) = &mut shared.root {
-        normalize(root);
-    }
-    shared.validate().is_ok()
-}
-
-pub(crate) fn unfloat(layout: &mut Layout, panel: PanelKind) -> bool {
-    let Ok(mut shared) = encode(&layout.root, &layout.floating) else { return false };
-    let mut found = false;
-    for group in &mut shared.floating {
-        if group.panels.contains(&panel) {
-            group.active = group.active.min(group.panels.len().saturating_sub(1));
-            found = true;
-        }
-    }
-    if !found || shared.apply(Action::Close { panel }).is_err() {
-        return false;
-    }
-    let mut proposed = decode(shared);
-    restore_frames(&mut proposed.root, &layout.root);
-    *layout = proposed;
-    true
-}
-
-#[cfg(test)]
-mod stacked_frame_tests {
-    use super::*;
-    use crate::dock::Zone;
-    #[test]
-    fn stacked_tabs_survive_shared_resize_activate_float_and_close() {
-        let mut root = crate::dock::workspace("Default");
-        assert!(root.dock_panel(PanelKind::Info, PanelKind::Properties, Zone::Center));
-        fn group(node: &DockNode) -> Option<&StackEntry> {
-            match node {
-                DockNode::Split { a, b, .. } => group(a).or_else(|| group(b)),
-                DockNode::Stack { entries } => entries.iter().find(|e| e.contains(PanelKind::Properties)),
-                _ => None,
-            }
-        }
-        let before = group(&root).unwrap().clone();
-        assert!(before.contains(PanelKind::Info));
-        let mut layout = Layout { root, floating: vec![] };
-        layout.apply(Action::ResizeSplit { path: vec![], size: SharedSplitSize::Ratio(0.6) }).unwrap();
-        assert_eq!(group(&layout.root).unwrap(), &before);
-        layout.apply(Action::Activate { panel: PanelKind::Properties }).unwrap();
-        assert_eq!(group(&layout.root).unwrap().shown(), Some(PanelKind::Properties));
-        let original_frame = group(&layout.root).unwrap().clone();
-        layout.apply(Action::OpenAt { panel: PanelKind::History, anchor: PanelKind::Properties, placement: Placement::Tab { before: None } }).unwrap();
-        let opened = group(&layout.root).unwrap();
-        assert!(opened.contains(PanelKind::History));
-        assert!(opened.contains(PanelKind::Info));
-        assert_eq!(opened.shown(), Some(PanelKind::History));
-        assert_eq!(opened.height, original_frame.height);
-        layout.apply(Action::Close { panel: PanelKind::History }).unwrap();
-        layout.apply(Action::Float { panel: PanelKind::Info, rect: [20.0, 20.0, 300.0, 300.0] }).unwrap();
-        assert_eq!(group(&layout.root).unwrap().panels, vec![PanelKind::Properties]);
-        layout.apply(Action::Close { panel: PanelKind::Info }).unwrap();
-        assert!(layout.floating.is_empty());
-        assert_eq!(group(&layout.root).unwrap().panels, vec![PanelKind::Properties]);
-    }
-}
diff --git a/crates/ui-egui/src/dock_ui.rs b/crates/ui-egui/src/dock_ui.rs
index a92d376e9..6523ff757 100644
--- a/crates/ui-egui/src/dock_ui.rs
+++ b/crates/ui-egui/src/dock_ui.rs
@@ -1,25 +1,318 @@
-//! The dock area: lays out the docked tree (or the maximized panel), draws each group's chrome
-//! and body, floating (undocked) panel groups over it, and tab drag-and-drop: drag a tab onto a
-//! group to tab it there (center) or split it off to a side (After Effects' drop zones, with a
-//! highlight of where it will land); hold Cmd/Ctrl when releasing, or drop outside every group,
-//! to float it. `` ` `` maximizes the panel under the pointer. A floating group can also move
-//! out of the main window into its own native window ([`EffectcraftApp::set_panel_window`]),
-//! which can sit on another monitor.
+//! EffectCraft's panels in craft-ui's shared docking. craft-ui draws the frames, tab strips,
+//! stacked panels, floating windows, dividers and drop previews and owns the gestures (drag a tab
+//! onto a group to tab it there or split it off to a side; hold Cmd/Ctrl at the release, or drop
+//! outside every group, to float it). EffectCraft draws the panel bodies, the ≡ panel menu, the
+//! Timeline's comp tabs and the viewer locks in each group header, and runs every layout change
+//! through its command path (`window.dockAction`), so pointer, menu and control-channel changes
+//! share one route.
 
-use egui::{Color32, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use crate::state::UiState;
+use craft_ui::docking::{
+    Action, Divider, DockArea, DockCommand, DockContent, DockError, DockEvent, DockStyle, FloatSpace, Floating, Hit, Node, ResizeEdge, UiDock,
+};
+use egui::{Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use serde_json::{Value, json};
 
-use crate::dock::{self, DockAction, DockNode, Group, Layout, PanelKind, PanelWindow};
+use crate::dock::{self, DocAction, DocTab, PanelKind, Workspace, WorkspaceExt as _};
+use crate::icons::{self, Icon};
+use crate::theme::Tokens;
 use crate::{EffectcraftApp, panels};
-use craft_ui::docking::{Action, DropTarget, resolve_drop};
 
-fn drag_id() -> egui::Id {
-    egui::Id::new("dock-tab-drag")
+/// The dock area's egui id; `DockArea::hit_rects` and `float_space` read by it.
+pub fn area_id() -> egui::Id {
+    egui::Id::unique("effectcraft-docking")
+}
+
+/// Width of the ≡ panel menu button at the end of each tab strip.
+const MENU_W: f32 = 26.0;
+/// Width of the viewer lock before it.
+const LOCK_W: f32 = 18.0;
+
+/// The smallest and largest native panel window, in points.
+pub const PANEL_WINDOW_MIN: [f32; 2] = [160.0, 100.0];
+pub const PANEL_WINDOW_MAX: f32 = 16_384.0;
+/// The farthest a native panel window may sit from the desktop origin, in points.
+pub const PANEL_WINDOW_MAX_POS: f32 = 100_000.0;
+
+/// A native panel window's desktop rect made safe to hand to the windowing system: finite, with
+/// a size within [`PANEL_WINDOW_MIN`]..=[`PANEL_WINDOW_MAX`] and a position within
+/// ±[`PANEL_WINDOW_MAX_POS`] (hostile workspace files and bad monitor reports included).
+pub fn sanitized_window_rect(rect: [f32; 4]) -> [f32; 4] {
+    let finite = |v: f32, fallback: f32| if v.is_finite() { v } else { fallback };
+    let [x, y, w, h] = rect;
+    [
+        finite(x, 0.0).clamp(-PANEL_WINDOW_MAX_POS, PANEL_WINDOW_MAX_POS),
+        finite(y, 0.0).clamp(-PANEL_WINDOW_MAX_POS, PANEL_WINDOW_MAX_POS),
+        finite(w, 420.0).clamp(PANEL_WINDOW_MIN[0], PANEL_WINDOW_MAX),
+        finite(h, 320.0).clamp(PANEL_WINDOW_MIN[1], PANEL_WINDOW_MAX),
+    ]
+}
+
+/// How long to wait for the main window to report its frame before migrated native windows
+/// keep their places as they are, in seconds.
+const FRAME_REPORT_WAIT: f64 = 2.0;
+
+/// Moves the native rects of [`UiState::native_outer`]'s windows from the OS window's outer
+/// position to its content position, by the main window's frame offset (`inner` less `outer`,
+/// the main window's desktop rects): the earlier version's windows had the same OS title bar.
+/// Without a report by [`FRAME_REPORT_WAIT`] (a backend without window positions), the places
+/// stay as they are.
+pub(crate) fn native_outer_to_content(ui: &mut UiState, outer: Option<Rect>, inner: Option<Rect>, now: f64) {
+    let offset = match (outer, inner) {
+        (Some(outer), Some(inner)) if outer.min.is_finite() && inner.min.is_finite() => inner.min - outer.min,
+        _ if now < FRAME_REPORT_WAIT => return,
+        _ => egui::Vec2::ZERO,
+    };
+    let ids = std::mem::take(&mut ui.native_outer);
+    for window in ui.dock.layout.floating.iter_mut().filter(|w| ids.contains(&w.id)) {
+        if let Some([x, y, w, h]) = window.native {
+            window.native = Some(sanitized_window_rect([x + offset.x, y + offset.y, w, h]));
+        }
+    }
+}
+
+/// A new floating group's default rect near the centre of `screen`.
+pub fn default_float_rect(screen: Rect) -> [f32; 4] {
+    let c = screen.center();
+    [c.x - 210.0, c.y - 160.0, 420.0, 320.0]
+}
+
+/// A panel named by its title or id ("Effect Controls", "EffectControls") or its serialized
+/// form (`{"Viewer": 2}`).
+fn panel_param(value: &Value) -> Result<PanelKind, String> {
+    match value.as_str() {
+        Some(name) => PanelKind::from_name(name).ok_or(format!("unknown panel `{name}`")),
+        None => serde_json::from_value::<PanelKind>(value.clone()).map_err(|_| "unknown `panel`".to_string()),
+    }
+}
+
+fn check_raw_action(action: &Action<PanelKind>) -> Result<(), String> {
+    if matches!(action, Action::Open { .. } | Action::OpenAt { .. }) {
+        return Err("use the panel open commands to preserve viewer and ScriptUI lifecycle callbacks".into());
+    }
+    Ok(())
+}
+
+/// The docking commands: `window.dockAction {action}`, craft-ui's `window.panel.*` commands,
+/// `ui.dock` and `ui.dock.reset`. `None` for any other id.
+pub(crate) fn route(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
+    match id {
+        "window.dockAction" => Some((|| {
+            let value = params.get("action").cloned().ok_or("missing docking action")?;
+            let action: Action<PanelKind> = serde_json::from_value(value).map_err(|error| format!("invalid docking action: {error}"))?;
+            check_raw_action(&action)?;
+            app.apply_dock(action)?;
+            Ok(Value::Null)
+        })()),
+        "ui.dock.reset" => {
+            let name = app.ui.workspace.clone();
+            app.set_workspace(&name);
+            Some(Ok(json!({"docking": app.ui.dock})))
+        }
+        "ui.dock" => Some((|| {
+            let mut tagged = if params.is_object() { params.clone() } else { json!({}) };
+            if let Some(fields) = tagged.as_object_mut() {
+                fields.insert("command".into(), json!("ui.dock"));
+            }
+            let command: DockCommand<PanelKind> = serde_json::from_value(tagged).map_err(|error| format!("invalid ui.dock params: {error}"))?;
+            app.run_dock_command(ctx, command)?;
+            Ok(json!({"docking": app.ui.dock}))
+        })()),
+        _ if id.starts_with("window.panel.") && DockCommand::<PanelKind>::IDS.contains(&id) => Some((|| {
+            let mut tagged = if params.is_object() { params.clone() } else { json!({}) };
+            if let Some(fields) = tagged.as_object_mut() {
+                fields.insert("command".into(), json!(id));
+                // EffectCraft's panel names ("Effect Controls") as well as craft-ui's ids.
+                for key in ["panel", "anchor", "before"] {
+                    if let Some(name) = fields.get(key).and_then(Value::as_str) {
+                        let panel = PanelKind::from_name(name).ok_or(format!("unknown panel `{name}`"))?;
+                        fields.insert(key.into(), json!(panel));
+                    }
+                }
+            }
+            let command: DockCommand<PanelKind> = serde_json::from_value(tagged).map_err(|error| format!("invalid docking command: {error}"))?;
+            app.run_dock_command(ctx, command)?;
+            Ok(Value::Null)
+        })()),
+        "window.panelWindow" => Some((|| {
+            let panel = panel_param(params.get("panel").ok_or("panelWindow: need `panel`")?).map_err(|e| format!("panelWindow: {e}"))?;
+            let window = match params.get("window") {
+                None | Some(Value::Null) => None,
+                Some(value) => Some(value.as_bool().ok_or("panelWindow: `window` must be true or false")?),
+            };
+            let window = app.set_panel_window(ctx, panel, window)?;
+            Ok(json!({"window": window}))
+        })()),
+        _ => None,
+    }
 }
 
 impl EffectcraftApp {
+    /// A layout action from the dock area or a menu, through the command path the control
+    /// channel uses.
     pub(crate) fn dock_command(&mut self, ctx: &egui::Context, action: Action<PanelKind>) -> Result<(), String> {
         let value = serde_json::to_value(action).map_err(|error| error.to_string())?;
-        crate::menus::invoke(self, ctx, "window.dockAction", serde_json::json!({"action": value})).map(|_| ())
+        crate::menus::invoke(self, ctx, "window.dockAction", json!({"action": value})).map(|_| ())
+    }
+
+    /// Run a craft-ui docking command on the current workspace, all or nothing. Named
+    /// workspaces and Reset are EffectCraft's own (`window.workspace`, `window.resetWorkspace`).
+    pub(crate) fn run_dock_command(&mut self, ctx: &egui::Context, command: DockCommand<PanelKind>) -> Result<(), String> {
+        if let DockCommand::Layout { action } | DockCommand::UiDock(UiDock::Action { action }) = &command {
+            check_raw_action(action)?;
+        }
+        if command.is_app_owned() {
+            if matches!(command, DockCommand::ResetWorkspace {}) {
+                let name = self.ui.workspace.clone();
+                self.set_workspace(&name);
+                return Ok(());
+            }
+            return Err("use the window.workspace commands for named workspaces".into());
+        }
+        // A closed panel opens through EffectCraft's own path, which puts it in its usual place
+        // and runs the viewer and ScriptUI lifecycles.
+        let shown = match &command {
+            DockCommand::Activate { panel } | DockCommand::UiDock(UiDock::Operation(craft_ui::docking::DockOperation::Open { panel })) => Some(*panel),
+            DockCommand::UiDock(UiDock::Operation(craft_ui::docking::DockOperation::Activate { panel })) => Some(*panel),
+            _ => None,
+        };
+        if let Some(panel) = shown.filter(|panel| !self.ui.dock.is_open(*panel)) {
+            self.show_panel(panel);
+            return Ok(());
+        }
+        let space = craft_ui::docking::float_space(ctx, area_id()).unwrap_or_else(|| FloatSpace::new(ctx.content_rect()));
+        match command.to_actions(&self.ui.dock, false, &space) {
+            Ok(actions) => self.apply_dock_all(actions),
+            // Showing a hidden panel at an edge, and Lock, change more than the layout.
+            Err(DockError::NotAllowed) => {
+                let mut workspace = self.ui.dock.clone();
+                let closed = command.apply(&mut workspace, false, &space, dock::permissions).map_err(|error| error.to_string())?;
+                self.commit_workspace(workspace, &closed, true);
+                Ok(())
+            }
+            Err(error) => Err(error.to_string()),
+        }
+    }
+
+    pub fn apply_dock(&mut self, action: Action<PanelKind>) -> Result<(), String> {
+        self.apply_dock_all(vec![action])
+    }
+
+    /// Apply `actions` all or none. No move or float may empty the docked tree, so a floating
+    /// panel always has somewhere to dock back to; closing the last docked panel stays allowed.
+    pub(crate) fn apply_dock_all(&mut self, actions: Vec<Action<PanelKind>>) -> Result<(), String> {
+        let mut workspace = self.ui.dock.clone();
+        let mut relocating = false;
+        let mut closed = Vec::new();
+        for action in actions {
+            relocating |= matches!(
+                &action,
+                Action::Move { .. }
+                    | Action::Float { .. }
+                    | Action::MoveGroup { .. }
+                    | Action::MoveWindow { .. }
+                    | Action::MovePanel { .. }
+                    | Action::MoveColumn { .. }
+            );
+            let closing = matches!(&action, Action::Close { .. } | Action::CloseGroup { .. } | Action::CloseWindow { .. } | Action::CloseOthers { .. });
+            let docked = workspace.layout.root.is_some();
+            closed.extend(workspace.apply(action, dock::permissions).map_err(|error| error.to_string())?);
+            if !closing && docked && workspace.layout.root.is_none() {
+                return Err("the last docked panel must remain in the workspace".into());
+            }
+        }
+        self.commit_workspace(workspace, &closed, relocating);
+        Ok(())
+    }
+
+    /// Take a changed workspace and release the state of the panels it closed: a ScriptUI
+    /// panel's script window closes (its onClose runs), a viewer forgets its comp.
+    fn commit_workspace(&mut self, workspace: Workspace, closed: &[PanelKind], relocating: bool) {
+        self.ui.dock = workspace;
+        for &p in closed {
+            if let PanelKind::ScriptPanel(id) = p
+                && self.session.script_ui.window(id).is_some()
+                && let Err(e) = self.session.execute("scriptui.close", json!({"window": id}))
+            {
+                self.ui.status = e.to_string();
+            }
+            panels::viewers::on_close(self, p);
+        }
+        if relocating || self.ui.maximized.is_some_and(|m| !self.ui.dock.is_docked(m)) {
+            self.ui.maximized = None;
+        }
+    }
+
+    /// Close a panel wherever it is (docked or floating). A rejected close changes nothing.
+    pub fn close_panel(&mut self, p: PanelKind) {
+        if self.ui.dock.is_open(p) {
+            let _ = self.apply_dock(Action::Close { panel: p });
+        }
+    }
+
+    /// Toggle the maximized panel (`p`, or none). Only a docked frame maximizes.
+    pub fn toggle_maximize(&mut self, p: PanelKind) {
+        self.ui.maximized = if self.ui.maximized == Some(p) || !self.ui.dock.is_docked(p) { None } else { Some(p) };
+    }
+
+    /// The panel whose body is under `pos` (from the last frame), else the focused one.
+    pub fn panel_at(&self, pos: Option<egui::Pos2>) -> PanelKind {
+        pos.and_then(|p| self.dock_rects.iter().rev().find(|(_, r)| r.contains(p)).map(|(k, _)| *k)).unwrap_or(self.ui.focused)
+    }
+
+    /// Whether panel `p` is in a floating window with a desktop place: its own OS window on
+    /// desktop (craft-ui `native-windows`); on the web and in embedded viewports the window
+    /// stays in the page and the place is kept for a desktop session.
+    pub fn in_panel_window(&self, p: PanelKind) -> bool {
+        self.ui.dock.layout.floating.iter().any(|w| w.contains(&p) && w.native.is_some())
+    }
+
+    /// Move panel `p` into a floating window of its own, which on desktop is an OS window that
+    /// can go on another monitor, or back into the main window (`window` false), where it joins
+    /// the first docked group. `None` toggles. A docked panel is undocked first, and its window
+    /// opens over the panel's place in the main window. Returns whether `p` is now in a window
+    /// of its own.
+    pub fn set_panel_window(&mut self, ctx: &egui::Context, p: PanelKind, window: Option<bool>) -> Result<bool, String> {
+        let current = self.in_panel_window(p);
+        let window = window.unwrap_or(!current);
+        if window == current {
+            return Ok(current);
+        }
+        if !window {
+            // On desktop every floating window is an OS window, so the way back is docking.
+            let anchor = self.ui.dock.layout.root.as_ref().and_then(|root| {
+                let mut panels = Vec::new();
+                dock::node_panels(root, &mut panels);
+                panels.into_iter().find(|panel| *panel != p)
+            });
+            let actions = match anchor {
+                Some(anchor) => vec![Action::Move { panel: p, anchor, placement: craft_ui::docking::Placement::Tab { before: None } }],
+                // Nothing is docked: the panel becomes the docked layout.
+                None => vec![Action::Close { panel: p }, Action::Open { panel: p, anchor: None }],
+            };
+            let mut workspace = self.ui.dock.clone();
+            // One transaction, so the panel is never reported closed and keeps its state.
+            let closed = workspace.apply_all(actions, dock::permissions).map_err(|_| format!("can't dock {}", p.title()))?;
+            self.commit_workspace(workspace, &closed, true);
+            return Ok(false);
+        }
+        if !self.ui.dock.is_floating(p) {
+            if !self.ui.dock.is_docked(p) {
+                return Err(format!("{} is not open", p.title()));
+            }
+            let rect = default_float_rect(ctx.input_for(egui::ViewportId::ROOT, |i| i.content_rect()));
+            self.apply_dock(Action::Float { panel: p, rect }).map_err(|_| format!("can't undock {}", p.title()))?;
+        }
+        let Some([x, y, w, h]) = self.ui.dock.layout.floating.iter().find(|f| f.contains(&p)).map(|f| f.rect) else {
+            return Err(format!("can't undock {}", p.title()));
+        };
+        let origin = ctx.input_for(egui::ViewportId::ROOT, |i| i.viewport().inner_rect.map(|r| r.min)).unwrap_or(pos2(0.0, 0.0));
+        let rect = sanitized_window_rect([origin.x + x, origin.y + y, w, h]);
+        self.apply_dock(Action::SetNative { panel: p, rect: Some(rect) })?;
+        if self.ui.maximized == Some(p) {
+            self.ui.maximized = None;
+        }
+        Ok(true)
     }
 
     /// Tab labels that name what the panel shows, as After Effects does: "Composition Intro",
@@ -41,126 +334,54 @@ impl EffectcraftApp {
         }
         let Some(comp) = self.session.active_comp() else { return out };
         if let Some(l) = self.session.state.selected_layers.first().and_then(|id| comp.layer(*id)) {
-            out.push((PanelKind::EffectControls, format!("Effect Controls {}", l.name)));
-            out.push((PanelKind::Properties, format!("Properties: {}", l.name)));
+            out.push((PanelKind::EffectControls, format!("{} {}", crate::i18n::command_label("window.panel", "Effect Controls"), l.name)));
+            out.push((PanelKind::Properties, format!("{}: {}", crate::i18n::command_label("window.panel", "Properties"), l.name)));
         }
         out
     }
 
     /// A comp's label colour as a tab swatch (faint without a label).
-    fn comp_swatch(&self, cid: effectcraft_engine::project::ItemId) -> Color32 {
+    fn comp_swatch(&self, cid: effectcraft_engine::project::ItemId) -> egui::Color32 {
         match self.session.project.item(cid).map(|i| i.label) {
             Some(l) if l != effectcraft_engine::color::Label::None => self.tokens.label(l),
             _ => self.tokens.text_faint,
         }
     }
 
-    /// The Timeline's tabs: one per open comp, as in After Effects (opening a precomp adds a tab
-    /// next to its parent's instead of replacing it).
-    fn tab_docs(&self) -> Vec<(PanelKind, Vec<dock::DocTab>)> {
+    /// The Timeline's comp tabs: one per open comp, as in After Effects (opening a precomp adds a
+    /// tab next to its parent's instead of replacing it).
+    fn tab_docs(&self) -> Vec<DocTab> {
         let st = &self.session.state;
-        let locked = self.ui.locked_tabs.contains(&PanelKind::Timeline.id());
-        let docs = st
-            .open_comps
+        st.open_comps
             .iter()
             .filter_map(|id| {
                 let it = self.session.project.item(*id).filter(|i| i.as_comp().is_some())?;
-                let deco = dock::TabDeco { swatch: self.comp_swatch(*id), locked, viewer: true };
-                Some(dock::DocTab { id: id.0, title: it.name.clone(), deco: Some(deco), active: st.active_comp == Some(*id) })
+                Some(DocTab { id: id.0, title: it.name.clone(), swatch: self.comp_swatch(*id), active: st.active_comp == Some(*id) })
             })
-            .collect();
-        vec![(PanelKind::Timeline, docs)]
+            .collect()
     }
 
-    /// The Composition and Timeline tabs' close button, label-colour swatch and viewer lock.
-    fn tab_decos(&self) -> Vec<(PanelKind, dock::TabDeco)> {
-        let Some(cid) = self.session.active_comp_id() else { return vec![] };
-        let swatch = self.comp_swatch(cid);
-        let mut v: Vec<(PanelKind, dock::TabDeco)> =
-            vec![(PanelKind::Timeline, dock::TabDeco { swatch, locked: self.ui.locked_tabs.contains(&PanelKind::Timeline.id()), viewer: true })];
-        // Every Composition viewer: its comp's swatch and its own lock.
+    /// The label-colour swatch before a tab's name: each Composition viewer's comp, and Effect
+    /// Controls' (and with Use Label Color for Related Tabs, Properties') selected layer.
+    fn tab_swatches(&self) -> Vec<(PanelKind, egui::Color32)> {
+        let mut v = Vec::new();
         for id in std::iter::once(0).chain(self.ui.viewers.keys().copied().filter(|v| *v != 0)) {
-            let p = panels::viewers::panel(id);
             let swatch = panels::viewers::comp_of(self, id).map_or(self.tokens.text_faint, |c| self.comp_swatch(c));
-            v.push((p, dock::TabDeco { swatch, locked: self.ui.locked_tabs.contains(&p.id()), viewer: true }));
+            v.push((panels::viewers::panel(id), swatch));
         }
-        // Effect Controls carries the selected layer's label colour.
         if let Some(l) = self.session.active_comp().and_then(|c| self.session.state.selected_layers.first().and_then(|id| c.layer(*id)))
             && l.label != effectcraft_engine::color::Label::None
         {
-            v.push((PanelKind::EffectControls, dock::TabDeco { swatch: self.tokens.label(l.label), locked: false, viewer: false }));
+            v.push((PanelKind::EffectControls, self.tokens.label(l.label)));
+            if self.session.prefs.appearance.use_label_color_for_tabs {
+                v.push((PanelKind::Properties, self.tokens.label(l.label)));
+            }
         }
         v
     }
 
-    /// Settings ▸ Appearance ▸ Use Label Color for Related Tabs: the Composition and Timeline
-    /// tabs carry their comp's label colour, Effect Controls and Properties the layer's.
-    fn label_tab_marks(&self, ui: &egui::Ui) {
-        if !self.session.prefs.appearance.use_label_color_for_tabs {
-            return;
-        }
-        let Some(cid) = self.session.active_comp_id() else { return };
-        let comp_label = self.session.project.item(cid).map(|i| i.label);
-        let layer_label = self.session.active_comp().and_then(|c| self.session.state.selected_layers.first().and_then(|l| c.layer(*l))).map(|l| l.label);
-        // (the Composition, Timeline and Effect Controls tabs carry their swatch already)
-        let _ = comp_label;
-        for (p, label) in [(PanelKind::Properties, layer_label)] {
-            let (Some(label), Some(e)) = (label, self.auto.find(&format!("panel.tab.{}", p.id()))) else { continue };
-            if label == effectcraft_engine::color::Label::None {
-                continue;
-            }
-            let r = Rect::from_min_size(pos2(e.rect[0] + 2.0, e.rect[1] + 9.0), vec2(4.0, (e.rect[3] - 16.0).max(6.0)));
-            ui.painter().rect_filled(r, 1.0, self.tokens.label(label));
-        }
-    }
-
-    /// Edit the full layout (docked tree + floating groups) with a [`Layout`] operation.
-    pub fn edit_layout(&mut self, f: impl FnOnce(&mut Layout) -> bool) -> bool {
-        let Ok(shared) = crate::dock_shared::encode(&self.ui.dock, &self.ui.floating) else { return false };
-        if shared.validate().is_err() {
-            return false;
-        }
-        let mut l = Layout { root: self.ui.dock.clone(), floating: self.ui.floating.clone() };
-        if !f(&mut l) {
-            return false;
-        }
-        self.ui.dock = l.root;
-        self.ui.floating = l.floating;
-        if self.ui.maximized.is_some_and(|m| !self.ui.dock.contains(m)) {
-            self.ui.maximized = None;
-        }
-        true
-    }
-
-    /// Close a panel wherever it is (docked or floating).
-    pub fn close_panel(&mut self, p: PanelKind) {
-        // Commit the layout first: rejected closes must not release viewer or script state.
-        if !self.edit_layout(|layout| layout.apply(Action::Close { panel: p }).is_ok()) {
-            return;
-        }
-        // Closing a ScriptUI panel closes its script window (its script's onClose runs).
-        if let PanelKind::ScriptPanel(id) = p
-            && self.session.script_ui.window(id).is_some()
-            && let Err(e) = self.session.execute("scriptui.close", serde_json::json!({"window": id}))
-        {
-            self.ui.status = e.to_string();
-        }
-        panels::viewers::on_close(self, p);
-        if self.ui.maximized == Some(p) {
-            self.ui.maximized = None;
-        }
-    }
-
-    /// Toggle the maximized panel (`p`, or none).
-    pub fn toggle_maximize(&mut self, p: PanelKind) {
-        self.ui.maximized = if self.ui.maximized == Some(p) || !self.ui.dock.contains(p) { None } else { Some(p) };
-    }
-
-    /// The docked panel whose group is under `pos` (from the last frame), else the focused one.
-    pub fn panel_at(&self, pos: Option<egui::Pos2>) -> PanelKind {
-        pos.and_then(|p| self.dock_rects.iter().rev().find(|(_, r)| r.contains(p)).map(|(k, _)| *k)).unwrap_or(self.ui.focused)
-    }
-
+    /// Draw panel `p`'s body in `rect`: register its automation region, put the Composition Navigator above an active
+    /// viewer when a nested-comp flow exists, then call the panel's `show` and (for a viewer) the sketch overlay.
     fn panel_body(&mut self, ui: &mut egui::Ui, p: PanelKind, rect: Rect) {
         self.auto.add(&format!("panel.{}", p.id()), rect, p.title());
         let mut content = rect.shrink(1.0);
@@ -183,9 +404,34 @@ impl EffectcraftApp {
         }
     }
 
+    /// A press in a panel (its body, tab or group header) focuses it; another Composition viewer
+    /// also becomes the active one.
+    pub(crate) fn focus_panel(&mut self, ctx: &egui::Context, p: PanelKind) {
+        self.ui.focused = p;
+        panels::viewer_text::panel_clicked(self, ctx, p);
+        if let Some(id) = panels::viewers::id_of(p) {
+            panels::viewers::activate(self, ctx, id);
+        }
+    }
+
+    /// Whether floating panels' OS windows take no input: a dialog of the app's own or a
+    /// command's OS file dialog is up. egui's `Modal` blocks only the window it is in.
+    pub(crate) fn floats_blocked(&mut self, ctx: &egui::Context) -> bool {
+        let (focused, now) = ctx.input(|i| (i.focused || i.raw.viewports.values().any(|v| v.focused == Some(true)), i.time));
+        let file_dialog = self.file_dialogs.up(focused, now);
+        self.dialog.is_some() || panels::dialogs::modal_open(ctx) || file_dialog
+    }
+
+    /// Draw the Home screen or workspace in `body`. Shared craft-ui docking owns the dock tree,
+    /// group chrome, tab dragging and floating native windows; this adapter draws panel bodies,
+    /// applies the returned events/actions and shows the panel menu.
     pub(crate) fn dock_area(&mut self, ui: &mut egui::Ui, body: Rect) {
         let t = self.tokens;
         let ctx = ui.ctx().clone();
+        if !self.ui.native_outer.is_empty() {
+            let (outer, inner, now) = ctx.input_for(egui::ViewportId::ROOT, |i| (i.viewport().outer_rect, i.viewport().inner_rect, i.time));
+            native_outer_to_content(&mut self.ui, outer, inner, now);
+        }
         if self.ui.start_screen {
             // Home covers the whole workspace, as in After Effects (the panels wait behind it).
             let mut child = ui.new_child(egui::UiBuilder::new().max_rect(body).id_salt("home"));
@@ -193,454 +439,492 @@ impl EffectcraftApp {
             panels::home::show(self, &mut child, body);
             return;
         }
-        // The maximized panel fills the area; the tree is kept as it is.
-        let maximized = self.ui.maximized.filter(|m| self.ui.dock.contains(*m));
-        let mut dock = match maximized {
-            Some(m) => DockNode::Tabs { panels: vec![m], active: 0 },
-            None => std::mem::replace(&mut self.ui.dock, DockNode::Tabs { panels: vec![], active: 0 }),
-        };
-        let mut groups = Vec::new();
-        let mut layout_actions = Vec::new();
-        dock::layout_with_actions(ui, &mut dock, body, &t, "", &mut groups, &mut self.auto, &mut layout_actions);
-        let mut actions = Vec::new();
-        let titles = self.tab_titles();
-        let decos = self.tab_decos();
+        let style = dock_style(ui, &t);
+        let maximized = self.ui.maximized.filter(|m| self.ui.dock.is_docked(*m));
+        let mut area = DockArea::new(area_id()).float_bounds(body).maximized(maximized).locked(self.ui.dock.locked).input_blocked(self.floats_blocked(&ctx));
+        if let Some(panel) = self.pending_panel_raise.take() {
+            area = area.raise_panel(panel);
+        }
+        let layout = self.ui.dock.layout.clone();
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(body).id_salt("effectcraft-dock-area"));
+        child.set_clip_rect(body.intersect(ui.clip_rect()));
         let docs = self.tab_docs();
-        let title = |p: PanelKind| titles.iter().find(|(k, _)| *k == p).map(|(_, s)| s.clone()).unwrap_or_else(|| p.title().to_string());
-        let info = dock::TabInfo { title: &title, decos: &decos, docs: &docs };
-        // Where each group's tabs are (tab drags show where a tab will land between them).
-        let mut tab_rects: Vec<(String, Vec<(PanelKind, Rect)>)> = vec![];
-        for g in &groups {
-            let c = dock::draw_group_chrome(ui, g, &t, &mut self.auto, &info);
-            actions.extend(c.actions);
-            tab_rects.push((g.path.clone(), c.tabs));
+        let ime = NativeIme::new(&layout.floating, &self.unpublished_viewports);
+        let mut content = EffectContent {
+            titles: self.tab_titles(),
+            swatches: self.tab_swatches(),
+            docs,
+            ctx: ctx.clone(),
+            style: style.clone(),
+            app: self,
+            tokens: t,
+            doc_actions: Vec::new(),
+            locks: Vec::new(),
+            menu: None,
+            bodies: Vec::new(),
+            ime,
+        };
+        let mut output = area.show_content(&mut child, &layout, &style, &mut content);
+        let EffectContent { doc_actions, locks, menu, bodies, ime, .. } = content;
+        self.dock_rects = bodies;
+        self.unpublished_viewports = ime.unpublished();
+        // A window that closed or docked takes its composition with it.
+        let previous = std::mem::replace(&mut self.native_viewports, ime.begun());
+        let gone: Vec<_> = previous.into_iter().filter(|v| !self.native_viewports.contains(v)).collect();
+        for viewport in gone {
+            panels::viewer_text::end_viewport(self, &ctx, viewport);
         }
-        self.label_tab_marks(ui);
-        if maximized.is_none() {
-            self.ui.dock = dock;
+        self.forward_window_input(&ctx, std::mem::take(&mut output.forwarded_events), std::mem::take(&mut output.window_files));
+        if let Some(panel) = output.focused {
+            self.focus_panel(&ctx, panel);
         }
-        self.dock_rects = groups.iter().filter_map(|g| Some((*g.panels.get(g.active)?, g.rect))).collect();
-        for g in &groups {
-            let Some(p) = g.panels.get(g.active).copied() else { continue };
-            if g.content.height() < 2.0 {
-                continue; // a collapsed stacked panel: header only
-            }
-            self.panel_body(ui, p, g.content);
+        if let Some(error) = output.error {
+            self.ui.status = error.to_string();
         }
-        for g in &groups {
-            if g.panels.get(g.active) == Some(&self.ui.focused) {
-                ui.painter().rect_stroke(g.rect, 0.0, Stroke::new(1.0, t.focus), StrokeKind::Inside);
+        for event in output.events {
+            if let DockEvent::ToggleMaximize { panel } = event {
+                self.toggle_maximize(panel);
             }
         }
-        // Floating groups over the dock.
-        let mut float_groups: Vec<Group> = vec![];
-        let layers = ctx.memory(|memory| memory.layer_ids().collect::<Vec<_>>());
-        let mut floating_order: Vec<_> = (0..self.ui.floating.len()).collect();
-        floating_order.sort_by_key(|index| {
-            self.ui
-                .floating
-                .get(*index)
-                .and_then(|group| group.panels.first())
-                .and_then(|panel| {
-                    let id = egui::Id::new(("floating-panel", panel.id()));
-                    layers.iter().position(|layer| layer.id == id)
-                })
-                .unwrap_or(usize::MAX)
-        });
-        // A native window is kept only for a panel that still floats.
-        let ui_state = &mut self.ui;
-        ui_state.panel_windows.retain(|w| ui_state.floating.iter().any(|group| group.panels.contains(&w.panel)));
-        for i in floating_order {
-            // Groups in their own native window take no tab drops from the main window.
-            if let Some(window) = self.ui.floating.get(i).and_then(|group| self.panel_window_of(&group.panels)) {
-                self.panel_window(&ctx, i, window, &info, &mut actions);
-                continue;
-            }
-            if let Some((g, tabs)) = self.floating_window(&ctx, i, &info, &mut actions) {
-                tab_rects.push((g.path.clone(), tabs));
-                float_groups.push(g);
+        for action in output.actions {
+            if let Err(error) = self.dock_command(&ctx, action) {
+                self.ui.status = error;
             }
         }
-        for action in layout_actions {
-            let _ = self.dock_command(&ctx, action);
+        for p in locks {
+            if !self.ui.locked_tabs.remove(&p.id()) {
+                self.ui.locked_tabs.insert(p.id().to_string());
+            }
         }
-        for a in actions {
-            match a {
-                DockAction::Activate(p) => {
-                    let _ = self.dock_command(&ctx, Action::Activate { panel: p });
-                }
-                DockAction::ToggleStacked(p) => {
-                    let _ = self.dock_command(&ctx, Action::SetStackOpen { panel: p, open: !self.ui.dock.is_visible(p) });
-                }
-                DockAction::Focus(p) => {
-                    self.ui.focused = p;
-                    panels::viewer_text::panel_clicked(self, &ctx, p);
-                    // A click in (or on the tab of) another Composition viewer makes it active.
-                    if let Some(id) = panels::viewers::id_of(p) {
-                        panels::viewers::activate(self, &ctx, id);
-                    }
-                }
-                DockAction::Close(p) => {
-                    let _ = self.dock_command(&ctx, Action::Close { panel: p });
-                }
-                DockAction::PanelMenu(p, pos) => {
-                    ctx.data_mut(|d| d.insert_temp(egui::Id::new("panel-menu"), (p, pos)));
-                }
-                DockAction::BeginDrag(p) => ctx.data_mut(|d| {
-                    d.insert_temp(drag_id(), p);
-                }),
-                DockAction::ToggleLock(p) => {
-                    if !self.ui.locked_tabs.remove(&p.id()) {
-                        self.ui.locked_tabs.insert(p.id().to_string());
-                    }
-                }
+        for action in doc_actions {
+            let result = match action {
                 // The Timeline's comp tabs: show that comp / close its Timeline.
-                DockAction::ActivateDoc(p, id) => {
-                    let _ = self.dock_command(&ctx, Action::Activate { panel: p });
-                    if self.session.state.active_comp.map(|c| c.0) != Some(id) {
-                        let _ = crate::menus::invoke(self, &ctx, "comp.open", serde_json::json!({"comp": id}));
+                DocAction::Activate(id) => {
+                    let _ = self.apply_dock(Action::Activate { panel: PanelKind::Timeline });
+                    self.focus_panel(&ctx, PanelKind::Timeline);
+                    if self.session.state.active_comp.map(|c| c.0) == Some(id) {
+                        Ok(Value::Null)
+                    } else {
+                        crate::menus::invoke(self, &ctx, "comp.open", json!({"comp": id}))
                     }
                 }
-                DockAction::CloseDoc(_, id) => {
-                    let _ = crate::menus::invoke(self, &ctx, "comp.close", serde_json::json!({"comp": id}));
-                }
+                DocAction::Close(id) => crate::menus::invoke(self, &ctx, "comp.close", json!({"comp": id})),
+            };
+            if let Err(error) = result {
+                self.ui.status = error;
             }
         }
-        self.tab_drag(&ctx, &groups, &float_groups, &tab_rects);
+        if let Some(open) = menu {
+            ctx.data_mut(|d| d.insert_temp::<panels::OpenPanelMenu>(egui::Id::unique("panel-menu"), open));
+            // the owner window draws it on its next pass
+            ctx.request_repaint();
+        }
+        drop_menu_of_closed_window(&ctx, &self.native_viewports);
+        let hits = DockArea::<PanelKind>::hit_rects(&ctx, area_id());
+        self.register_dock_hits(&hits);
         panels::panel_menu_popup(self, ui);
     }
 
-    /// One floating group: a window with a tab strip (drag the empty strip to move it, the
-    /// corner to resize it) and the active panel's body.
-    fn floating_window(
-        &mut self,
-        ctx: &egui::Context,
-        i: usize,
-        info: &dock::TabInfo,
-        actions: &mut Vec<DockAction>,
-    ) -> Option<(Group, Vec<(PanelKind, Rect)>)> {
-        let t = self.tokens;
-        let f = self.ui.floating.get(i)?.clone();
-        let screen = ctx.content_rect();
-        let mut rect = Rect::from_min_size(pos2(f.rect[0], f.rect[1]), vec2(f.rect[2].max(160.0), f.rect[3].max(100.0)));
-        // Keep the strip reachable.
-        rect = rect.translate(vec2(
-            (screen.min.x - rect.min.x).max(0.0) + (screen.max.x - 40.0 - rect.min.x).min(0.0),
-            (screen.min.y - rect.min.y).max(0.0) + (screen.max.y - 30.0 - rect.min.y).min(0.0),
-        ));
-        let id = egui::Id::new(("floating-panel", f.panels.first().map(|p| p.id()).unwrap_or_default()));
-        let mut group = None;
-        // Not constrained to the window: the group is drawn where its rect says (the clamp above
-        // keeps its strip reachable), so it follows the pointer past the window's edges.
-        egui::Area::new(id).order(egui::Order::Middle).fixed_pos(rect.min).constrain(false).interactable(true).show(ctx, |ui| {
-            let (r, _) = ui.allocate_exact_size(rect.size(), Sense::hover());
-            ui.painter().rect_filled(r.expand(1.0), t.radius, Color32::from_black_alpha(90));
-            let strip = Rect::from_min_size(r.min, vec2(r.width(), t.tab_h));
-            // Move by the strip (tabs, registered later, take precedence over it).
-            // (`id.with("move")` is the id of the `Area`'s own background widget.)
-            let mv = ui.interact(strip, id.with("strip"), Sense::drag());
-            self.auto.add(&format!("panel.float.{i}.move"), strip, "Move floating panel");
-            let mut nr = r;
-            if mv.dragged() {
-                nr = nr.translate(mv.drag_delta());
-            }
-            let g = Group {
-                path: format!("f{i}"),
-                rect: r,
-                content: Rect::from_min_max(pos2(r.min.x, r.min.y + t.tab_h), r.max),
-                panels: f.panels.clone(),
-                active: f.active.min(f.panels.len().saturating_sub(1)),
-                stacked: None,
+    /// Keys and dropped files that reach a floating panel's own OS window go to the main
+    /// window's next frame ([`crate::EffectcraftApp::raw_input_hook`]), so its shortcuts and
+    /// file import handle them. Text is not forwarded, and nothing is while a text field in
+    /// the main window has the keyboard.
+    fn forward_window_input(&mut self, ctx: &egui::Context, events: Vec<egui::Event>, files: Vec<craft_ui::docking::WindowFiles<PanelKind>>) {
+        let typing = ctx.egui_wants_keyboard_input();
+        let events = events.into_iter().filter(|event| !typing && !matches!(event, egui::Event::Text(_) | egui::Event::Ime(_)));
+        self.forwarded.events.extend(events);
+        if handed_over_to_the_timeline(files.iter().map(|window| (window.panel, !window.dropped.is_empty()))) {
+            self.forwarded.dropped_on_timeline = true;
+        }
+        self.forwarded.files.extend(files.into_iter().flat_map(|window| window.dropped));
+        if !self.forwarded.events.is_empty() || !self.forwarded.files.is_empty() {
+            ctx.request_repaint();
+        }
+    }
+
+    /// Automation ids for craft-ui's gesture sources: `panel.tab.<Panel>`, `panel.drag.<Panel>`
+    /// (the group's drag bar), `panel.border.<Panel>` (the top border above its tabs),
+    /// `panel.tabs.more.<Panel>`, `panel.header.<Panel>` (a stacked panel's open/close button),
+    /// `panel.float.<n>.move`, `.close`, `.resize` (bottom-right
+    /// corner) and `.resize.<Edge>`, `dock.gutter.<path>` (`a`/`b` per split level; a stack's gap
+    /// below entry `i` adds `s<i>`), `dock.corner.<outer>.<inner>` where two dividers meet, and
+    /// the same inside floating window `n` as `panel.float.<n>.gutter.…` and `.corner.…`.
+    fn register_dock_hits(&mut self, hits: &[(Hit<PanelKind>, Rect)]) {
+        let window = |panel: &PanelKind| self.ui.dock.layout.floating.iter().position(|window| window.contains(panel));
+        // Tabs are labelled as drawn: "Composition Intro", not "Composition".
+        let titles = self.tab_titles();
+        let title = |panel: &PanelKind| titles.iter().find(|(p, _)| p == panel).map_or_else(|| panel.title().to_string(), |(_, t)| t.clone());
+        let mut found = Vec::new();
+        for (hit, rect) in hits {
+            let entry = match hit {
+                Hit::Tab(panel) => (format!("panel.tab.{}", panel.id()), title(panel)),
+                Hit::DragBar(panel) => (format!("panel.drag.{}", panel.id()), "Move panel group".into()),
+                Hit::Border(panel) => (format!("panel.border.{}", panel.id()), "Move panel group".into()),
+                Hit::Overflow(panel) => (format!("panel.tabs.more.{}", panel.id()), "More tabs".into()),
+                Hit::StackToggle(panel) => (format!("panel.header.{}", panel.id()), title(panel)),
+                Hit::Title(panel) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.move"), "Move floating panel".into()),
+                    None => continue,
+                },
+                Hit::Close(panel) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.close"), "Close floating panel".into()),
+                    None => continue,
+                },
+                Hit::Resize(panel, edge) => match window(panel) {
+                    Some(index) if *edge == ResizeEdge::BottomRight => (format!("panel.float.{index}.resize"), "Resize floating panel".into()),
+                    Some(index) => (format!("panel.float.{index}.resize.{edge:?}"), "Resize floating panel".into()),
+                    None => continue,
+                },
+                Hit::Divider(Divider::Split(path)) => (format!("dock.gutter.{}", path_id(path)), "gutter".into()),
+                Hit::Divider(Divider::Stack(panel)) => match dock::stack_gutter_id(&self.ui.dock.layout, *panel) {
+                    Some(id) => (id, "gutter".into()),
+                    None => continue,
+                },
+                Hit::Divider(Divider::Intersection(outer, inner)) => (format!("dock.corner.{}.{}", path_id(outer), path_id(inner)), "gutter corner".into()),
+                Hit::Divider(Divider::WindowSplit(panel, path)) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.gutter.{}", path_id(path)), "gutter".into()),
+                    None => continue,
+                },
+                Hit::Divider(Divider::WindowIntersection(panel, outer, inner)) => match window(panel) {
+                    Some(index) => (format!("panel.float.{index}.corner.{}.{}", path_id(outer), path_id(inner)), "gutter corner".into()),
+                    None => continue,
+                },
+                _ => continue,
             };
-            let c = dock::draw_group_chrome(ui, &g, &t, &mut self.auto, info);
-            actions.extend(c.actions);
-            if let Some(p) = g.panels.get(g.active).copied() {
-                self.panel_body(ui, p, g.content);
-            }
-            ui.painter().rect_stroke(r, t.radius, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
-            if g.panels.get(g.active) == Some(&self.ui.focused) {
-                ui.painter().rect_stroke(r, t.radius, Stroke::new(1.0, t.focus), StrokeKind::Inside);
-            }
-            // Resize from the corner.
-            let grip = Rect::from_min_max(r.max - vec2(14.0, 14.0), r.max);
-            let rs = ui.interact(grip, id.with("resize"), Sense::click_and_drag());
-            rs.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, rs.enabled(), crate::i18n::tr("Resize floating panel")));
-            self.auto.add_response(&format!("panel.float.{i}.resize"), &rs, "Resize floating panel");
-            for k in 0..3 {
-                let o = 4.0 + k as f32 * 4.0;
-                ui.painter().line_segment([pos2(r.max.x - o, r.max.y - 2.0), pos2(r.max.x - 2.0, r.max.y - o)], Stroke::new(1.0, t.text_faint));
-            }
-            if rs.hovered() || rs.dragged() {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::ResizeNwSe);
-            }
-            let delta = floating_resize_delta(ui, &rs);
-            if rs.has_focus() {
-                ui.painter().rect_stroke(grip, 2.0, Stroke::new(1.5, t.focus), StrokeKind::Inside);
-            }
-            if delta != egui::Vec2::ZERO {
-                nr = Rect::from_min_size(nr.min, (nr.size() + delta).max(vec2(160.0, 100.0)));
-            }
-            if nr != r
-                && let Some(panel) = f.panels.first().copied()
-            {
-                let _ = self.dock_command(ctx, Action::MoveFloating { panel, rect: [nr.min.x, nr.min.y, nr.width(), nr.height()] });
-            }
-            group = Some((g, c.tabs));
-        });
-        group
-    }
-
-    /// The native window a floating group (its `panels`) shows in, if any.
-    pub(crate) fn panel_window_of(&self, panels: &[PanelKind]) -> Option<PanelWindow> {
-        self.ui.panel_windows.iter().find(|w| panels.contains(&w.panel)).copied()
-    }
-
-    /// Whether panel `p` shows in its own native window.
-    pub fn in_panel_window(&self, p: PanelKind) -> bool {
-        self.ui.floating.iter().any(|group| group.panels.contains(&p) && self.panel_window_of(&group.panels).is_some())
-    }
-
-    /// The viewport panel `p` is drawn in: its native window's, or the main window's (also when
-    /// the platform embeds viewports, as the browser build does).
-    pub(crate) fn panel_viewport(&self, ctx: &egui::Context, p: PanelKind) -> egui::ViewportId {
-        if ctx.embed_viewports() {
-            return egui::ViewportId::ROOT;
+            found.push((entry, *rect, DockArea::hit_id(area_id(), hit)));
         }
-        self.ui
-            .floating
+        // The widget id lets keyboard focus on a divider or grip map to its element.
+        for ((id, label), rect, widget) in found {
+            self.auto.add(&id, rect, &label);
+            if let Some(element) = self.auto.elements.last_mut() {
+                element.response_id = Some(widget);
+            }
+        }
+    }
+}
+
+/// A split path as `a`/`b` per level (first/second child).
+fn path_id(path: &[bool]) -> String {
+    path.iter().map(|second| if *second { 'b' } else { 'a' }).collect()
+}
+
+/// After Effects' window is all frames: drops on all four window edges, Ctrl/Cmd-drag undocks,
+/// a release over no target floats, and a floating window's title bar only moves it.
+fn dock_style(ui: &egui::Ui, t: &Tokens) -> DockStyle {
+    let mut style = DockStyle::from_ui(ui);
+    style.side_edge_zones = true;
+    style.new_dock_zones = false;
+    style.maximize_item = true;
+    style.close_others_item = true;
+    style.command_press_floats = true;
+    style.float_on_empty_drop = true;
+    style.title_bar_docks = false;
+    style.float_hint = true;
+    style.wheel_selects_tabs = true;
+    style.middle_click_closes_tabs = true;
+    style.float_label = "Undock Panel".into();
+    style.float_group_label = "Undock Frame".into();
+    style.close_group_label = "Close Frame".into();
+    style.tab_height = t.tab_h;
+    style.gap = t.gap;
+    style.background = t.panel_bg;
+    style.tab_background = t.panel_bg;
+    style.active_background = t.panel_bg;
+    style.floating_background = t.panel_bg;
+    style.text = t.tab_text_active;
+    style.inactive_text = t.tab_text;
+    style.accent = t.focus;
+    style.font = Tokens::ui(12.0);
+    style
+}
+
+/// Panels with a viewer lock: the Composition viewers and the Timeline keep their comp while
+/// locked.
+fn has_lock(panel: PanelKind) -> bool {
+    matches!(panel, PanelKind::Composition | PanelKind::Viewer(_) | PanelKind::Timeline)
+}
+
+/// EffectCraft's side of the dock area for one frame.
+struct EffectContent<'a> {
+    app: &'a mut EffectcraftApp,
+    tokens: Tokens,
+    titles: Vec<(PanelKind, String)>,
+    swatches: Vec<(PanelKind, egui::Color32)>,
+    docs: Vec<DocTab>,
+    /// Measures the comp tabs for their width in the tab row.
+    ctx: egui::Context,
+    style: DockStyle,
+    doc_actions: Vec<DocAction>,
+    /// Viewer locks clicked.
+    locks: Vec<PanelKind>,
+    /// The ≡ button clicked: its panel, where its menu opens and the viewport it was clicked in.
+    menu: Option<panels::OpenPanelMenu>,
+    /// Where each panel body was drawn, in drawing order (floating windows last).
+    bodies: Vec<(PanelKind, Rect)>,
+    /// Where each native window's IME descriptor is set up and published.
+    ime: NativeIme,
+}
+
+/// Which body of a native floating window publishes its IME descriptor.
+///
+/// Each OS window is an egui pass of its own. `viewer_text::finish_ime` publishes what the pass's
+/// text editor recorded, and with nothing recorded it clears the composition and the preedit. A
+/// window with another group before the Viewer that published after every body would clear the
+/// preedit before the Viewer drew, and the Viewer's publication would then be a new context that
+/// interrupts the composition, every pass. So a window publishes after the body in which its
+/// editor has recorded its geometry and after its last body.
+pub(crate) struct NativeIme {
+    /// The bodies each native window draws this pass, as its layout says.
+    expected: Vec<(egui::ViewportId, usize)>,
+    /// The bodies each native window has drawn so far, in the order the windows began.
+    drawn: Vec<(egui::ViewportId, usize)>,
+    /// Windows that drew their panel menu this pass.
+    menu_drawn: Vec<egui::ViewportId>,
+    /// Windows that published this pass.
+    published: Vec<egui::ViewportId>,
+}
+
+impl NativeIme {
+    /// `unpublished` are the windows that drew last pass but never published: the layout's count
+    /// was too high for them, so they publish after every body this pass.
+    pub(crate) fn new(floating: &[Floating<PanelKind>], unpublished: &[egui::ViewportId]) -> Self {
+        let expected = floating
             .iter()
-            .find(|group| group.panels.contains(&p))
-            .and_then(|group| self.panel_window_of(&group.panels))
-            .map_or(egui::ViewportId::ROOT, |w| panel_window_id(w.panel))
-    }
-
-    /// Move panel `p` (and the floating group it is in) into its own native window, which can be
-    /// placed on another monitor, or back into the main window (`window` false; it floats there
-    /// where it was before). `None` toggles. A docked panel is undocked first. The window opens
-    /// over the place the panel had in the main window. Returns whether `p` is now in a window.
-    pub fn set_panel_window(&mut self, ctx: &egui::Context, p: PanelKind, window: Option<bool>) -> Result<bool, String> {
-        let group_of = |app: &Self| app.ui.floating.iter().find(|group| group.panels.contains(&p)).map(|group| (group.panels.clone(), group.rect));
-        let current = self.in_panel_window(p);
-        let window = window.unwrap_or(!current);
-        if window == current {
-            return Ok(current);
-        }
-        if !window {
-            if let Some((panels, _)) = group_of(self) {
-                self.ui.panel_windows.retain(|w| !panels.contains(&w.panel));
-            }
-            return Ok(false);
-        }
-        if group_of(self).is_none() {
-            if !self.ui.dock.contains(p) {
-                return Err(format!("{} is not open", p.title()));
-            }
-            let rect = default_float_rect(ctx.input_for(egui::ViewportId::ROOT, |i| i.content_rect()));
-            if !self.edit_layout(|layout| layout.float(p, rect)) {
-                return Err(format!("can't undock {}", p.title()));
-            }
-        }
-        let Some((_, [x, y, w, h])) = group_of(self) else { return Err(format!("can't undock {}", p.title())) };
-        // Over the panel's place in the main window (its content's position on the desktop).
-        let origin = ctx.input_for(egui::ViewportId::ROOT, |i| i.viewport().inner_rect.map(|r| r.min)).unwrap_or(pos2(0.0, 0.0));
-        let rect = PanelWindow::sanitized([origin.x + x, origin.y + y, w, h]);
-        ctx.data_mut(|d| d.remove::<[f32; 4]>(panel_window_spawn_id(p)));
-        self.ui.panel_windows.push(PanelWindow { panel: p, rect });
-        if self.ui.maximized == Some(p) {
-            self.ui.maximized = None;
-        }
-        Ok(true)
-    }
-
-    /// One floating group in its own native window: the group's tab strip and active panel fill
-    /// the window. Closing the window brings the group back into the main window.
-    fn panel_window(&mut self, ctx: &egui::Context, i: usize, window: PanelWindow, info: &dock::TabInfo, actions: &mut Vec<DockAction>) {
-        let t = self.tokens;
-        let Some(f) = self.ui.floating.get(i).cloned() else { return };
-        let active = f.active.min(f.panels.len().saturating_sub(1));
-        let Some(shown) = f.panels.get(active).copied() else { return };
-        // The window opens at its saved place; after that the window system owns its position and
-        // size (handing them back every frame would fight the user dragging it).
-        let spawn_id = panel_window_spawn_id(window.panel);
-        let spawn = ctx.data_mut(|d| *d.get_temp_mut_or_insert_with(spawn_id, || PanelWindow::sanitized(window.rect)));
-        let builder = egui::ViewportBuilder::default()
-            .with_title((info.title)(shown))
-            .with_position([spawn[0], spawn[1]])
-            .with_inner_size([spawn[2], spawn[3]])
-            .with_min_inner_size(dock::PANEL_WINDOW_MIN);
-        let mut closed = false;
-        let mut placed = None;
-        ctx.show_viewport_immediate(panel_window_id(window.panel), builder, |ui, class| {
-            let native = matches!(class, egui::ViewportClass::Immediate | egui::ViewportClass::Deferred);
-            egui::CentralPanel::default().frame(egui::Frame::NONE.fill(t.panel_bg)).show(ui, |ui| {
-                let r = ui.max_rect();
-                let g = Group {
-                    path: format!("w{i}"),
-                    rect: r,
-                    content: Rect::from_min_max(pos2(r.min.x, (r.min.y + t.tab_h).min(r.max.y)), r.max),
-                    panels: f.panels.clone(),
-                    active,
-                    stacked: None,
-                };
-                let c = dock::draw_group_chrome(ui, &g, &t, &mut self.auto, info);
-                // Tabs can't be dragged between native windows yet.
-                actions.extend(c.actions.into_iter().filter(|a| !matches!(a, DockAction::BeginDrag(_))));
-                self.panel_body(ui, shown, g.content);
-                if shown == self.ui.focused {
-                    ui.painter().rect_stroke(r, 0.0, Stroke::new(1.0, t.focus), StrokeKind::Inside);
-                }
-                if native {
-                    panels::panel_menu_popup(self, ui);
-                }
-            });
-            // An embedded window (no native windows on this platform) reads the main window's
-            // input: its close request and place aren't this window's.
-            if native {
-                closed = ui.input(|i| i.viewport().close_requested());
-                placed = ui.input(|i| {
-                    let v = i.viewport();
-                    let inner = v.inner_rect?;
-                    let min = v.outer_rect.map_or(pos2(window.rect[0], window.rect[1]), |outer| outer.min);
-                    Some([min.x, min.y, inner.width(), inner.height()])
-                });
-            }
-        });
-        if closed {
-            self.ui.panel_windows.retain(|w| !f.panels.contains(&w.panel));
-            ctx.data_mut(|d| d.remove::<[f32; 4]>(spawn_id));
-            return;
-        }
-        // Remember where the window is, so the workspace reopens it there.
-        if let Some(rect) = placed.map(PanelWindow::sanitized)
-            && rect != window.rect
-            && let Some(w) = self.ui.panel_windows.iter_mut().find(|w| w.panel == window.panel)
-        {
-            w.rect = rect;
-        }
-    }
-
-    /// A tab being dragged. Over a tab strip (or the middle of a group) it shows where the tab
-    /// will land: an insertion mark between two tabs (a drop there reorders a group's own tabs
-    /// too); near a group's edge, the half it will split off. On release it lands there (or
-    /// floats with Cmd/Ctrl or outside every group).
-    fn tab_drag(&mut self, ctx: &egui::Context, groups: &[Group], floats: &[Group], tab_rects: &[(String, Vec<(PanelKind, Rect)>)]) {
-        let Some(p) = ctx.data(|d| d.get_temp::<PanelKind>(drag_id())) else { return };
-        let t = self.tokens;
-        let canceled =
-            ctx.input(|input| input.key_pressed(egui::Key::Escape) || !input.focused || (!input.pointer.primary_down() && !input.pointer.primary_released()));
-        if canceled || (!self.ui.dock.contains(p) && !self.ui.floating.iter().any(|group| group.panels.contains(&p))) {
-            ctx.data_mut(|data| data.remove::<PanelKind>(drag_id()));
-            return;
-        }
-        let Some(pos) = ctx.pointer_latest_pos() else { return };
-        // The shared resolver receives groups in paint order; a floating group occludes the dock.
-        let targets: Vec<_> = groups
-            .iter()
-            .map(|g| (g, false))
-            .chain(floats.iter().map(|g| (g, true)))
-            .filter_map(|(g, floating)| {
-                Some(DropTarget {
-                    anchor: *g.panels.get(g.active)?,
-                    rect: g.rect,
-                    tab_strip: Some(Rect::from_min_max(g.rect.min, pos2(g.rect.max.x, g.content.min.y))),
-                    tabs: {
-                        let mut tabs = tab_rects.iter().find(|(path, _)| *path == g.path).map(|(_, tabs)| tabs.clone()).unwrap_or_default();
-                        for panel in &g.panels {
-                            if !tabs.iter().any(|(candidate, _)| candidate == panel) {
-                                tabs.push((*panel, Rect::NOTHING));
-                            }
-                        }
-                        tabs
-                    },
-                    allow_splits: !floating,
-                    accepts_tabs: true,
-                })
+            .filter_map(|window| {
+                let viewport = window_viewport(window.id)?;
+                let count = if unpublished.contains(&viewport) { 0 } else { window_bodies(window) };
+                Some((viewport, count))
             })
             .collect();
-        let over_group = targets.iter().any(|target| target.rect.contains(pos));
-        let float_drop = ctx.input(|i| i.modifiers.command);
-        let plan = (!float_drop).then(|| resolve_drop(&p, pos, &targets)).flatten();
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("dock-drop")));
-        if let Some(proposal) = &plan {
-            let preview = proposal.preview.shrink(2.0);
-            painter.rect_filled(preview, t.radius, t.focus.gamma_multiply(0.18));
-            painter.rect_stroke(preview, t.radius, Stroke::new(2.0, t.focus), StrokeKind::Inside);
-            if let Some(mark) = proposal.insertion {
-                insertion_mark(&painter, mark.center().x, mark, t.focus);
+        Self { expected, drawn: Vec::new(), menu_drawn: Vec::new(), published: Vec::new() }
+    }
+
+    /// Count a body of `viewport` that starts drawing. True for the window's first body: its
+    /// pass sets up the IME before it.
+    pub(crate) fn begin_body(&mut self, viewport: egui::ViewportId) -> bool {
+        match self.drawn.iter_mut().find(|(v, _)| *v == viewport) {
+            Some((_, n)) => {
+                *n = n.saturating_add(1);
+                false
+            }
+            None => {
+                self.drawn.push((viewport, 1));
+                true
             }
         }
-        // Ghost of the dragged tab.
-        let g = painter.layout_no_wrap(p.title().to_string(), crate::theme::Tokens::ui(12.0), Color32::WHITE);
-        let gr = Rect::from_min_size(pos + vec2(12.0, 10.0), g.size() + vec2(16.0, 8.0));
-        painter.rect_filled(gr, 4.0, t.focus.gamma_multiply(0.85));
-        painter.galley(gr.min + vec2(8.0, 4.0), g, Color32::WHITE);
-        ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
-        ctx.request_repaint();
-        if ctx.input(|i| i.pointer.primary_released()) {
-            ctx.data_mut(|d| d.remove::<PanelKind>(drag_id()));
-            let ok = match plan {
-                Some(proposal) => self.dock_command(ctx, Action::Move { panel: p, anchor: proposal.anchor, placement: proposal.placement }).is_ok(),
-                None if float_drop || !over_group => {
-                    let r = [pos.x - 40.0, pos.y - 12.0, 420.0, 320.0];
-                    self.dock_command(ctx, Action::Float { panel: p, rect: r }).is_ok()
-                }
-                None => false,
-            };
-            if ok {
-                self.ui.focused = p;
-                self.show_panel(p);
+    }
+
+    /// Whether the body of `viewport` that just drew publishes the IME descriptor: once the
+    /// window's editor has `recorded` its geometry this pass, and after the window's last body.
+    /// A window the layout does not name publishes after every body.
+    pub(crate) fn publishes(&mut self, viewport: egui::ViewportId, recorded: bool) -> bool {
+        let drawn = self.drawn.iter().find(|(v, _)| *v == viewport).map_or(0, |(_, n)| *n);
+        let expected = self.expected.iter().find(|(v, _)| *v == viewport).map_or(0, |(_, n)| *n);
+        let publishes = recorded || drawn >= expected;
+        if publishes && !self.published.contains(&viewport) {
+            self.published.push(viewport);
+        }
+        publishes
+    }
+
+    /// Whether the body of `viewport` that just drew is the one that draws the window's panel
+    /// menu: after the window's last body, once per pass.
+    pub(crate) fn menu_turn(&mut self, viewport: egui::ViewportId) -> bool {
+        let drawn = self.drawn.iter().find(|(v, _)| *v == viewport).map_or(0, |(_, n)| *n);
+        let expected = self.expected.iter().find(|(v, _)| *v == viewport).map_or(0, |(_, n)| *n);
+        let turn = drawn >= expected && !self.menu_drawn.contains(&viewport);
+        if turn {
+            self.menu_drawn.push(viewport);
+        }
+        turn
+    }
+
+    /// The native windows whose pass began.
+    pub(crate) fn begun(&self) -> Vec<egui::ViewportId> {
+        self.drawn.iter().map(|(v, _)| *v).collect()
+    }
+
+    /// The native windows that drew bodies but did not publish.
+    pub(crate) fn unpublished(&self) -> Vec<egui::ViewportId> {
+        self.drawn.iter().map(|(v, _)| *v).filter(|v| !self.published.contains(v)).collect()
+    }
+}
+
+/// A panel menu left open by a panel window that has since closed has nowhere to draw: drop it.
+/// `windows` are the panel windows that drew this pass.
+pub(crate) fn drop_menu_of_closed_window(ctx: &egui::Context, windows: &[egui::ViewportId]) {
+    let id = egui::Id::unique("panel-menu");
+    ctx.data_mut(|d| {
+        if d.get_temp::<panels::OpenPanelMenu>(id).is_some_and(|(_, _, owner)| owner != egui::ViewportId::ROOT && !windows.contains(&owner)) {
+            d.remove::<panels::OpenPanelMenu>(id);
+        }
+    });
+}
+
+/// The OS window craft-ui opens for the floating window `id`.
+#[cfg(not(target_arch = "wasm32"))]
+fn window_viewport(id: u64) -> Option<egui::ViewportId> {
+    Some(DockArea::<PanelKind>::window_viewport(area_id(), id))
+}
+
+/// The web keeps floating windows in the page.
+#[cfg(target_arch = "wasm32")]
+fn window_viewport(_id: u64) -> Option<egui::ViewportId> {
+    None
+}
+
+/// The panel bodies craft-ui draws in a floating window: the active panel of each group and each
+/// open stack entry. A minimized window shows its bar only.
+fn window_bodies(window: &Floating<PanelKind>) -> usize {
+    if window.minimized {
+        return 0;
+    }
+    let mut count = 0usize;
+    let mut nodes = vec![&window.root];
+    while let Some(node) = nodes.pop() {
+        match node {
+            Node::Split { first, second, .. } => nodes.extend([&**first, &**second]),
+            Node::Tabs { panels, active } => count = count.saturating_add(usize::from(panels.get(*active).is_some())),
+            Node::Stack { entries } => count = count.saturating_add(entries.iter().filter(|e| e.open).count()),
+            _ => {}
+        }
+    }
+    count
+}
+
+impl EffectContent<'_> {
+    fn header_width(&self, active: PanelKind, strip_width: f32) -> f32 {
+        let lock = if has_lock(active) { LOCK_W } else { 0.0 };
+        (lock + MENU_W).min(strip_width * 2.0 / 3.0).max(MENU_W)
+    }
+
+    /// Whether the group of `panels` shows comp tabs: it holds the Timeline and comps are open.
+    fn has_doc_tabs(&self, panels: &[PanelKind]) -> bool {
+        panels.contains(&PanelKind::Timeline) && !self.docs.is_empty()
+    }
+}
+
+impl DockContent<PanelKind> for EffectContent<'_> {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &PanelKind) {
+        let t = self.tokens;
+        let rect = ui.max_rect();
+        self.bodies.push((*panel, rect));
+        // A floating panel's OS window is a pass of its own: its text IME descriptor is set up
+        // before its first body and published after its bodies (the main window does both in
+        // `draw`).
+        let viewport = ui.ctx().viewport_id();
+        let native = viewport != egui::ViewportId::ROOT && !ui.ctx().embed_viewports();
+        if native && self.ime.begin_body(viewport) {
+            panels::viewer_text::begin_ui(ui.ctx());
+        }
+        self.app.panel_body(ui, *panel, rect);
+        if native && self.ime.publishes(viewport, panels::viewer_text::ime_recorded(ui.ctx())) {
+            panels::viewer_text::finish_ime(self.app, ui);
+        }
+        // The ≡ menu of a panel in its own OS window is drawn by that window's pass, after its
+        // last body, at that window's coordinates.
+        if native && self.ime.menu_turn(viewport) {
+            panels::panel_menu_area(self.app, ui);
+        }
+        // The body fills its frame; allocating it lets a floated panel keep its full size.
+        ui.allocate_rect(rect, Sense::hover());
+        // Painted after the body so child backgrounds cannot hide the focus outline.
+        if self.app.ui.focused == *panel {
+            ui.painter().rect_stroke(rect, 0.0, Stroke::new(1.0, t.focus), StrokeKind::Inside);
+        }
+    }
+
+    fn logical_label(&self, panel: &PanelKind) -> String {
+        let title = panel.title();
+        // The Window menu names most panels; `Markers` is only in the panel catalog, and the two
+        // panels in neither (`History`, `ScriptUI Panel`) keep their English names.
+        let listed = crate::i18n::command_label("window.panel", title);
+        if listed == title { crate::i18n::tr(title).to_string() } else { listed.to_string() }
+    }
+
+    /// The tab names what the panel shows ("Composition Intro"), after the label swatch of its
+    /// comp or layer. With comps open, the Timeline's own tab is just "Timeline"; each comp has a
+    /// tab of its own after the group's panel tabs.
+    fn label(&mut self, _ui: &egui::Ui, panel: &PanelKind, logical: &str, font: &egui::FontId, color: egui::Color32) -> egui::WidgetText {
+        let title = self.titles.iter().find(|(p, _)| p == panel).map_or(logical, |(_, s)| s.as_str());
+        let Some((_, swatch)) = self.swatches.iter().find(|(p, _)| p == panel) else { return title.into() };
+        let mut job = egui::text::LayoutJob::default();
+        job.append("■ ", 0.0, egui::TextFormat::simple(font.clone(), *swatch));
+        job.append(title, 0.0, egui::TextFormat::simple(font.clone(), color));
+        job.into()
+    }
+
+    fn group_header_width(&self, _panels: &[PanelKind], active: &PanelKind, _floating: bool, strip_width: f32) -> f32 {
+        self.header_width(*active, strip_width)
+    }
+
+    /// The viewer lock and the ≡ panel menu of the shown panel.
+    fn group_header(&mut self, ui: &mut egui::Ui, _panels: &[PanelKind], active: &PanelKind, _floating: bool) {
+        let t = self.tokens;
+        let header = ui.max_rect();
+        let menu = Rect::from_min_max(pos2((header.max.x - MENU_W).max(header.min.x), header.min.y), header.max);
+        if has_lock(*active) {
+            let lock = Rect::from_center_size(pos2(menu.min.x - LOCK_W / 2.0, header.center().y), vec2(14.0, 14.0));
+            let locked = self.app.ui.locked_tabs.contains(&active.id());
+            if dock::lock_button(ui, lock, *active, locked, &t, &mut self.app.auto) {
+                self.locks.push(*active);
             }
         }
+        let rect = Rect::from_center_size(menu.center(), vec2(18.0, 18.0));
+        let response = ui.interact(rect, egui::Id::unique(("panel-menu-button", active.id())), Sense::click());
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, response.enabled(), "panel menu"));
+        self.app.auto.add_response(&format!("panel.menu.{}", active.id()), &response, "panel menu");
+        let color = if response.hovered() { t.tab_text_active } else { t.tab_text };
+        icons::paint(ui.painter(), Rect::from_center_size(rect.center(), vec2(16.0, 16.0)), Icon::Hamburger, color);
+        crate::widgets::focus_outline(ui, &response, &t);
+        if response.clicked() {
+            self.app.ui.focused = *active;
+            self.menu = Some((*active, rect.left_bottom(), ui.ctx().viewport_id()));
+        }
+    }
+
+    fn group_extra_tabs_width(&self, panels: &[PanelKind], _active: &PanelKind, _floating: bool) -> f32 {
+        if !self.has_doc_tabs(panels) {
+            return 0.0;
+        }
+        dock::doc_widths(&self.ctx, &self.docs, &self.style.font).iter().sum()
+    }
+
+    /// The Timeline's comp tabs, after its group's panel tabs whichever panel is shown.
+    fn group_extra_tabs(&mut self, ui: &mut egui::Ui, panels: &[PanelKind], active: &PanelKind, _floating: bool) {
+        if self.has_doc_tabs(panels) {
+            let selected = *active == PanelKind::Timeline;
+            self.doc_actions.extend(dock::doc_tabs(ui, ui.max_rect(), &self.docs, selected, &self.style, &mut self.app.auto));
+        }
     }
 }
 
-/// The insertion mark of a tab drag: a bar between two tabs at `x`, with caps.
-fn insertion_mark(painter: &egui::Painter, x: f32, strip: Rect, col: Color32) {
-    let (y0, y1) = (strip.min.y + 3.0, strip.max.y - 2.0);
-    painter.line_segment([pos2(x, y0), pos2(x, y1)], Stroke::new(2.5, col));
-    for (y, d) in [(y0, 1.0), (y1, -1.0)] {
-        painter.add(egui::Shape::convex_polygon(vec![pos2(x - 4.5, y), pos2(x + 4.5, y), pos2(x, y + 5.0 * d)], col, Stroke::NONE));
+/// Whether a handed-over *drop* named the Timeline. A floating window reports its hovered files
+/// too, so a drag that only passes over the Timeline window must not count: its flag would survive
+/// and send the next drop somewhere else. The panel comes from the window, which the main window's
+/// pointer can never reach (#2661).
+fn handed_over_to_the_timeline(drops: impl Iterator<Item = (PanelKind, bool)>) -> bool {
+    drops.into_iter().any(|(panel, has_files)| has_files && matches!(panel, PanelKind::Timeline))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A drop handed over by a floating window says which panel it landed on; only the Timeline
+    /// turns it into a layer instead of a project item. A window that only saw the file hover over
+    /// it carries no files and must not count, or its flag would outlive the drag (#2661).
+    #[test]
+    fn only_a_timeline_drop_is_handed_over_to_the_timeline() {
+        let cases = [
+            (vec![(PanelKind::Timeline, true)], true),
+            (vec![(PanelKind::Project, true)], false),
+            (vec![(PanelKind::Timeline, false)], false),
+            (vec![(PanelKind::Project, true), (PanelKind::Timeline, true)], true),
+            (vec![], false),
+        ];
+        for (windows, want) in cases {
+            assert_eq!(handed_over_to_the_timeline(windows.into_iter()), want, "{want}");
+        }
     }
 }
-
-/// The native window of the floating group whose window entry names `panel`.
-pub fn panel_window_id(panel: PanelKind) -> egui::ViewportId {
-    egui::ViewportId::from_hash_of(("effectcraft-panel-window", panel.id()))
-}
-
-/// Where a native panel window was told to open (kept for as long as it stays open).
-fn panel_window_spawn_id(panel: PanelKind) -> egui::Id {
-    egui::Id::new(("panel-window-spawn", panel.id()))
-}
-
-/// A new floating group's default rect near the centre of `screen`.
-pub fn default_float_rect(screen: Rect) -> [f32; 4] {
-    let c = screen.center();
-    [c.x - 210.0, c.y - 160.0, 420.0, 320.0]
-}
-
-/// A corner is a two-axis resize control; focused arrows belong to it and Tab moves on.
-fn floating_resize_delta(ui: &mut egui::Ui, response: &egui::Response) -> egui::Vec2 {
-    if response.drag_started() {
-        response.request_focus();
-    }
-    let mut delta = if response.dragged() { response.drag_delta() } else { egui::Vec2::ZERO };
-    if response.has_focus() {
-        ui.memory_mut(|memory| {
-            memory.set_focus_lock_filter(response.id, egui::EventFilter { horizontal_arrows: true, vertical_arrows: true, ..Default::default() })
-        });
-        ui.input_mut(|input| {
-            for (key, amount) in [
-                (egui::Key::ArrowLeft, vec2(-8.0, 0.0)),
-                (egui::Key::ArrowRight, vec2(8.0, 0.0)),
-                (egui::Key::ArrowUp, vec2(0.0, -8.0)),
-                (egui::Key::ArrowDown, vec2(0.0, 8.0)),
-            ] {
-                if input.consume_key(egui::Modifiers::NONE, key) {
-                    delta += amount;
-                }
-            }
-        });
-    }
-    if response.enabled() { delta } else { egui::Vec2::ZERO }
-}
diff --git a/crates/ui-egui/src/frames.rs b/crates/ui-egui/src/frames.rs
index 059bc3a03..8bfcd73e8 100644
--- a/crates/ui-egui/src/frames.rs
+++ b/crates/ui-egui/src/frames.rs
@@ -1,7 +1,8 @@
 //! Background frame rendering and the RAM preview cache.
 //!
 //! Frames render on a dedicated thread pool from immutable `Arc<Project>` snapshots, so the UI
-//! never waits for the compositor. Results land in a memory-budgeted cache keyed by the comp's
+//! never waits for the compositor (a playing preview's frames and idle caching on one thread
+//! each, so the frames started first are done first). Results land in a memory-budgeted cache keyed by the comp's
 //! *content* ([`comp_content`]: the comp and everything it uses), frame, scale, view and render
 //! options; the timeline draws the cached range as the green cache bar. An edit keeps the frames
 //! of every comp it doesn't touch, and undo finds the frames of the state it returns to.
@@ -14,39 +15,62 @@
 //! egui frames, within a time budget.
 //!
 //! With the disk cache on (Settings ▸ Media & Disk Cache), every CPU-rendered frame is also
-//! written to disk under a content key (the comp's content hash, frame, scale, view and render
-//! options), and a job first looks there: frames survive restarts and project reopenings. The
-//! timeline shows disk-only frames as a blue cache bar.
+//! written to disk under a content key (the comp's content hash from the project in memory,
+//! frame, scale, view and render options) with the source files it read, and a job first looks
+//! there: frames survive restarts and project reopenings. An entry is used only while the files
+//! it lists are unchanged, checked by the frame worker when it reads the entry (a frame whose
+//! files can't all be named is shown but not stored). The timeline shows disk-only frames as a
+//! blue cache bar (present entries; their files are checked only when a frame is used).
 //!
 //! With Mercury GPU Acceleration (a [`Gpu`] on egui-wgpu's device and the project's renderer set
 //! to the GPU) frames stay on the GPU: the compositor writes an RGBA8 texture that the viewer
 //! registers with egui-wgpu and draws directly; pixels are read back only when something needs
 //! them (Info panel, eyedroppers, histograms).
+//!
+//! 32 bpc projects keep half-float frames on the desktop ([`F16Frame`], rendered without the HDR
+//! step): twice the bytes of an 8-bit frame, so the RAM preview holds half as many. The disk
+//! cache keeps them as half-float entries.
 
 use std::collections::{BTreeSet, HashMap, HashSet, VecDeque};
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex};
 
-use effectcraft_engine::project::{Comp, ItemId, ItemKind, LayerSource, Node, Project, PropGroup};
+use effectcraft_engine::project::{Comp, Heard, ItemId, ItemKind, Node, Project, PropGroup};
 use effectcraft_engine::render::disk_cache::{self, DiskCache};
+use effectcraft_engine::render::reads::{ReadFiles, ReadLog};
 use effectcraft_engine::render::{CancellableFootage, ExprHost, FootageSource, LayerCache, RenderOpts, Renderer};
 use effectcraft_engine::time::Tick;
-use effectcraft_gpu::{DisplayFrame, Gpu};
+use effectcraft_gpu::{DisplayFrame, FrameError, Gpu};
 use rayon::prelude::*;
 
 /// Comp identities (and the project snapshots behind them) the RAM preview keeps frames of.
 const MAX_KEEPERS: usize = 64;
 
 /// GPU frames kept for RAM preview (bytes of video memory) at first. wgpu can't tell how much
-/// video memory there is: each time the device runs out, the budget halves (to
-/// [`MIN_GPU_BUDGET`]) and the frame renders on the CPU (#106).
+/// video memory there is: allocation pressure halves the budget (to [`MIN_GPU_BUDGET`])
+/// and the frame renders on the CPU (#106). One burst is counted once; successful GPU
+/// renders gradually restore the budget after pressure subsides.
 const GPU_BUDGET: usize = 1 << 30;
 const MIN_GPU_BUDGET: usize = 64 << 20;
+const GPU_PRESSURE_COOLDOWN: std::time::Duration = std::time::Duration::from_secs(5);
+const GPU_RECOVERY_INTERVAL: std::time::Duration = std::time::Duration::from_secs(30);
+/// The window's frame gaps that adapt [`Queue::gpu_limit`] while a preview plays: a longer one
+/// is a stall, shorter ones for a while are smooth.
+const UI_STALL: std::time::Duration = std::time::Duration::from_millis(100);
+const UI_SMOOTH: std::time::Duration = std::time::Duration::from_millis(50);
+/// How long the window must stay smooth before one more lane composites on the GPU, and before it
+/// tries again a limit that stalled.
+const GPU_LANE_STEP: std::time::Duration = std::time::Duration::from_millis(500);
+const GPU_LANE_RETRY: std::time::Duration = std::time::Duration::from_secs(10);
 
-/// A rendered viewer frame: CPU pixels or a GPU texture.
+mod f16;
+pub use f16::{F16_PIXEL_BYTES, F16Frame};
+
+/// A rendered viewer frame: 8-bit CPU pixels, half-float CPU pixels (32 bpc) or a GPU texture.
 #[derive(Clone)]
 pub enum FrameImage {
     Cpu(Arc<egui::ColorImage>),
+    CpuF16(Arc<F16Frame>),
     Gpu(Arc<DisplayFrame>),
 }
 
@@ -54,11 +78,14 @@ impl FrameImage {
     pub fn size(&self) -> [usize; 2] {
         match self {
             FrameImage::Cpu(c) => c.size,
+            FrameImage::CpuF16(f) => f.size(),
             FrameImage::Gpu(f) => [f.width as usize, f.height as usize],
         }
     }
-    fn bytes(&self) -> usize {
-        self.size()[0] * self.size()[1] * 4
+    /// Bytes the frame holds in the RAM preview (GPU frames: without their mips).
+    pub fn bytes(&self) -> usize {
+        let [w, h] = self.size();
+        w * h * if matches!(self, FrameImage::CpuF16(_)) { F16_PIXEL_BYTES } else { 4 }
     }
     fn is_gpu(&self) -> bool {
         matches!(self, FrameImage::Gpu(_))
@@ -141,8 +168,41 @@ impl Playhead {
     }
 }
 
+/// A frame in the RAM preview and the source files it was made of (`None`: unknown, a frame
+/// rendered elsewhere or kept on the GPU), so it can be written to the disk cache later
+/// ([`Frames::persist_missing`]).
+struct Cached {
+    img: FrameImage,
+    /// (the browser's frames are stored by its frame workers, not from here)
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    files: Option<Arc<ReadFiles>>,
+    /// The disk cache its render started with and that cache's drop generation then: the frame
+    /// is written to that cache only, and only while none of its files was dropped since
+    /// (`None`: rendered without a disk cache, or elsewhere; never written from here).
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    since: Option<DiskSince>,
+}
+
+/// A disk cache and its drop generation ([`DiskCache::drop_generation`]) when a render started.
+#[derive(Clone)]
+struct DiskSince(std::sync::Weak<DiskCache>, u64);
+
+impl DiskSince {
+    /// A marker for the drop generation of `dc` at the time of a render.
+    fn of(dc: &Arc<DiskCache>, generation: u64) -> DiskSince {
+        DiskSince(Arc::downgrade(dc), generation)
+    }
+
+    /// The generation, when `dc` is the cache it was taken from (the weak reference keeps that
+    /// cache's address from being reused by another).
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    fn for_cache(&self, dc: &Arc<DiskCache>) -> Option<u64> {
+        std::ptr::eq(self.0.as_ptr(), Arc::as_ptr(dc)).then_some(self.1)
+    }
+}
+
 struct Cache {
-    map: HashMap<FrameKey, FrameImage>,
+    map: HashMap<FrameKey, Cached>,
     order: VecDeque<FrameKey>,
     bytes: usize,
     /// Bytes of GPU frames (also counted in `bytes`).
@@ -150,15 +210,26 @@ struct Cache {
     budget: usize,
     /// Bytes of GPU frames to keep at most ([`GPU_BUDGET`]).
     gpu_budget: usize,
+    gpu_pressure: Option<web_time::Instant>,
+    gpu_adjusted: Option<web_time::Instant>,
     /// The playing preview, if any: evictions spare the frames it shows next.
     playhead: Option<Playhead>,
+    /// Scale of the frame on screen (the newest urgent request): frames of other scales go first.
+    scale: Option<u32>,
 }
 
 impl Cache {
+    /// A frame without its source files (tests).
+    #[cfg(test)]
     fn insert(&mut self, k: FrameKey, img: FrameImage) {
+        self.insert_with(k, img, None, None);
+    }
+    /// [`Cache::insert`] with the source files the frame was made of and the disk cache's drop
+    /// generation when its render started.
+    fn insert_with(&mut self, k: FrameKey, img: FrameImage, files: Option<Arc<ReadFiles>>, since: Option<DiskSince>) {
         let (sz, gpu) = (img.bytes(), img.is_gpu());
-        if let Some(old) = self.map.insert(k, img) {
-            self.forget(&old);
+        if let Some(old) = self.map.insert(k, Cached { img, files, since }) {
+            self.forget(&old.img);
         } else {
             self.order.push_back(k);
         }
@@ -173,8 +244,14 @@ impl Cache {
     /// recently shown of the frames it doesn't reach, then the one it reaches last. Plain LRU
     /// evicted the frames just ahead of the playhead first (rendered a while ago, not shown yet)
     /// to keep the ones just shown, so a preview longer than the cache played into a gap that
-    /// prefetch kept refilling while it evicted the next frames (#595).
+    /// prefetch kept refilling while it evicted the next frames (#595). Frames of another scale
+    /// than the one on screen go first (a zoom or resolution change).
     fn victim(&self) -> Option<usize> {
+        if let Some(s) = self.scale
+            && let Some(i) = self.order.iter().position(|k| k.scale != s)
+        {
+            return Some(i);
+        }
         let Some(p) = &self.playhead else { return (!self.order.is_empty()).then_some(0) };
         let mut farthest: Option<(i64, usize)> = None;
         for (i, k) in self.order.iter().enumerate() {
@@ -186,29 +263,50 @@ impl Cache {
         }
         farthest.map(|(_, i)| i)
     }
-    /// Video memory: drop the oldest GPU frames past their own budget.
+    /// Video memory: drop the oldest GPU frames past their own budget, frames of another scale
+    /// than the one on screen first (a zoom or resolution change).
     fn evict_gpu(&mut self) {
         while self.gpu_bytes > self.gpu_budget {
-            let Some(i) = self.order.iter().position(|k| self.map.get(k).is_some_and(FrameImage::is_gpu)) else { break };
+            let is_gpu = |k: &FrameKey| self.map.get(k).is_some_and(|c| c.img.is_gpu());
+            let other_scale = self.order.iter().position(|k| Some(k.scale) != self.scale && is_gpu(k));
+            let Some(i) = other_scale.or_else(|| self.order.iter().position(is_gpu)) else { break };
             if let Some(old) = self.order.remove(i) {
                 self.remove(&old);
             }
         }
     }
-    /// The GPU ran out of memory: keep half as many GPU frames from now on.
+    /// Several workers failing in one burst must not halve the shared budget repeatedly.
     fn gpu_out_of_memory(&mut self) {
-        self.gpu_budget = (self.gpu_budget / 2).max(MIN_GPU_BUDGET);
+        let now = web_time::Instant::now();
+        if self.gpu_pressure.is_none_or(|last| now.duration_since(last) >= GPU_PRESSURE_COOLDOWN) {
+            self.gpu_budget = (self.gpu_budget / 2).max(MIN_GPU_BUDGET);
+            self.gpu_adjusted = Some(now);
+        }
+        self.gpu_pressure = Some(now);
         self.evict_gpu();
     }
-    fn forget(&mut self, img: &FrameImage) {
-        self.bytes -= img.bytes();
-        if img.is_gpu() {
-            self.gpu_bytes -= img.bytes();
+    fn gpu_succeeded(&mut self) {
+        let now = web_time::Instant::now();
+        if self.gpu_pressure.is_some_and(|last| now.duration_since(last) >= GPU_RECOVERY_INTERVAL)
+            && self.gpu_adjusted.is_some_and(|last| now.duration_since(last) >= GPU_RECOVERY_INTERVAL)
+        {
+            self.gpu_budget = self.gpu_budget.saturating_add(MIN_GPU_BUDGET).min(GPU_BUDGET);
+            self.gpu_adjusted = Some(now);
         }
     }
+    fn gpu_ready(&self) -> bool {
+        self.gpu_pressure.is_none_or(|last| last.elapsed() >= GPU_PRESSURE_COOLDOWN)
+    }
+    fn forget(&mut self, img: &FrameImage) {
+        self.bytes = self.bytes.saturating_sub(img.bytes());
+        if img.is_gpu() {
+            self.gpu_bytes = self.gpu_bytes.saturating_sub(img.bytes());
+        }
+    }
+    /// Removes the entry for `k` and releases its image.
     fn remove(&mut self, k: &FrameKey) {
         if let Some(i) = self.map.remove(k) {
-            self.forget(&i);
+            self.forget(&i.img);
         }
     }
     /// Shown again: last in line for eviction.
@@ -227,6 +325,19 @@ impl Cache {
         }
         self.order.retain(|k| !gone.contains(&k.content));
     }
+    /// Move the frames of identity `from` that `keep` accepts to identity `to` (in place in the
+    /// eviction order), unless `to` already has them.
+    fn carry(&mut self, from: u64, to: u64, keep: impl Fn(i64) -> bool) {
+        for k in self.order.iter_mut().filter(|k| k.content == from && keep(k.frame)) {
+            let moved = FrameKey { content: to, ..*k };
+            if !self.map.contains_key(&moved)
+                && let Some(img) = self.map.remove(k)
+            {
+                self.map.insert(moved, img);
+                *k = moved;
+            }
+        }
+    }
     fn evict_to_budget(&mut self) {
         while self.bytes > self.budget {
             let Some(old) = self.victim().and_then(|i| self.order.remove(i)) else { break };
@@ -258,7 +369,9 @@ pub struct RenderSource {
 /// ([`Frames::identity`]).
 type Identity = (u64, Option<Arc<Project>>);
 
-/// Content keys of (project revision, comp), computed once per revision.
+/// Disk-cache content keys ([`disk_cache::comp_content_key`]) of (project revision, comp). They
+/// come from the project in memory alone: the files a frame read are checked by its entry
+/// when it is read (#3184).
 type ContentKeys = Arc<Mutex<HashMap<(u64, u64), u128>>>;
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -268,6 +381,7 @@ struct ContentKeyJobs {
     pending: VecDeque<(Arc<Project>, u64, u64)>,
 }
 
+/// The content key of `comp` at `revision`, memoised per revision.
 fn content_key(keys: &ContentKeys, project: &Project, revision: u64, comp: u64) -> u128 {
     if let Some(k) = keys.lock().ok().and_then(|m| m.get(&(revision, comp)).copied()) {
         return k;
@@ -288,28 +402,26 @@ fn content_key(keys: &ContentKeys, project: &Project, revision: u64, comp: u64)
 /// hands out), and by value the project settings and the footage, solids and proxies it uses.
 /// With expressions in its comps (which can read anything) every item counts.
 pub fn comp_content(project: &Project, comp: ItemId) -> u64 {
-    comp_content_with(project, comp, |_, c| Arc::as_ptr(c))
+    comp_content_with(project, comp, project, |_, c| c, true)
 }
 
-/// Whether two versions of a comp draw the same pixels. Markers only count when an expression
-/// could read them (`markers_count`).
-fn same_pixels(a: &Comp, b: &Comp, markers_count: bool) -> bool {
-    if markers_count { a.same_pixels(b) } else { a.same_pixels_ignoring_markers(b) }
+/// Frame ranges (inclusive) of `comp` in `new` that may draw differently than in `old`
+/// ([`Project::dirty_spans`]), a frame wider either side for rounding.
+fn dirty_frames(old: &Project, new: &Project, comp: ItemId, heard: &Heard, outside: bool) -> Option<Vec<(i64, i64)>> {
+    let fr = new.comp(comp)?.frame_rate;
+    Some(new.dirty_spans(old, comp, heard, outside)?.into_iter().map(|(s, e)| (fr.frame_at(s).saturating_sub(1), fr.frame_at(e).saturating_add(1))).collect())
 }
 
-/// Whether a layer anywhere in the project has an expression, which can read markers.
-fn project_has_expressions(project: &Project) -> bool {
-    fn has_expression(g: &PropGroup) -> bool {
-        g.children.iter().any(|c| match c {
-            Node::Prop(p) => p.expr.is_some(),
-            Node::Group(sub) => has_expression(sub),
-        })
-    }
-    project.items.values().any(|i| matches!(&i.kind, ItemKind::Comp(c) if c.layers.iter().any(|l| has_expression(&l.props))))
-}
-
-/// [`comp_content`] with each comp's address given by `addr`.
-fn comp_content_with(project: &Project, comp: ItemId, addr: impl Fn(ItemId, &Arc<Comp>) -> *const Comp) -> u64 {
+/// [`comp_content`] with each comp's version selected for both its sources and its address.
+/// Sources removed by undo are read from `base`. Only the comps and items it draws count unless
+/// `everything` and an expression (which can read any item) is among them.
+fn comp_content_with<'a>(
+    project: &'a Project,
+    comp: ItemId,
+    base: &'a Project,
+    version: impl Fn(ItemId, &'a Arc<Comp>) -> &'a Arc<Comp>,
+    everything: bool,
+) -> u64 {
     use std::hash::{Hash, Hasher};
     fn has_expression(g: &PropGroup) -> bool {
         g.children.iter().any(|c| match c {
@@ -319,6 +431,7 @@ fn comp_content_with(project: &Project, comp: ItemId, addr: impl Fn(ItemId, &Arc
     }
     let mut h = std::collections::hash_map::DefaultHasher::new();
     format!("{:?}", project.settings).hash(&mut h);
+    let item = |id| project.item(id).or_else(|| base.item(id));
     let mut seen = BTreeSet::new();
     let mut stack = vec![comp];
     let mut expressions = false;
@@ -326,24 +439,26 @@ fn comp_content_with(project: &Project, comp: ItemId, addr: impl Fn(ItemId, &Arc
         if !seen.insert(id) {
             continue;
         }
-        let Some(ItemKind::Comp(c)) = project.item(id).map(|i| &i.kind) else { continue };
+        let Some(ItemKind::Comp(c)) = item(id).map(|i| &i.kind) else { continue };
+        let c = version(id, c);
         for l in &c.layers {
-            if let LayerSource::Comp { item } | LayerSource::Footage { item } | LayerSource::Solid { item } = l.source {
+            // (a 3D model's item too)
+            if let Some(item) = l.source.item() {
                 stack.push(item);
             }
-            expressions = expressions || has_expression(&l.props);
+            expressions = expressions || (everything && has_expression(&l.props));
         }
     }
     let ids: Vec<ItemId> = if expressions { project.items.keys().copied().collect() } else { seen.into_iter().collect() };
     for id in ids {
-        let Some(it) = project.item(id) else { continue };
+        let Some(it) = item(id) else { continue };
         id.0.hash(&mut h);
         if expressions {
             // (`comp("Name")`, `footage("Name")`)
             it.name.hash(&mut h);
         }
         match &it.kind {
-            ItemKind::Comp(c) => (addr(id, c) as usize).hash(&mut h),
+            ItemKind::Comp(c) => (Arc::as_ptr(version(id, c)) as usize).hash(&mut h),
             k => format!("{k:?}").hash(&mut h),
         }
         format!("{:?}", it.proxy).hash(&mut h);
@@ -368,6 +483,25 @@ fn frame_disk_key(keys: &ContentKeys, project: &Project, key: &FrameKey, opts_ha
     disk_cache::frame_key(content, key.frame, key.scale, key.view ^ opts_hash)
 }
 
+/// Queue `img` for the disk cache under `dk` with the source files it was made of. `false` when
+/// refused: a GPU frame (no CPU pixels), files that can't be checked when the entry is read
+/// (an incomplete list, #3184: the frame is shown, not stored), a full queue, a file dropped
+/// (File ▸ Reload Footage) after `since`, the drop generation its render started at; no room on
+/// the disk (checked first: the conversion and compression would be wasted).
+fn put_disk_frame(dc: &DiskCache, dk: u128, img: &FrameImage, files: &ReadFiles, virtual_id: Option<disk_cache::VirtualFileId<'_>>, since: u64) -> bool {
+    if !files.is_complete() || !dc.accepts_writes() {
+        return false;
+    }
+    match img {
+        FrameImage::Cpu(img) => {
+            let rgba: Vec<u8> = img.pixels.iter().flat_map(|c| c.to_array()).collect();
+            dc.put_frame(dk, img.size[0] as u32, img.size[1] as u32, &rgba, files, virtual_id, since)
+        }
+        FrameImage::CpuF16(f) => dc.put_frame_f16(dk, f.width, f.height, f.bits(), files, virtual_id, since),
+        FrameImage::Gpu(_) => false,
+    }
+}
+
 /// A frame for a [`RemoteFrames`] renderer.
 pub struct RemoteJob {
     pub project: Arc<Project>,
@@ -437,10 +571,17 @@ pub struct Frames {
     #[cfg(not(target_arch = "wasm32"))]
     /// None if the OS refused the threads: jobs then go to rayon's global pool.
     pool: Option<rayon::ThreadPool>,
+    #[cfg(not(target_arch = "wasm32"))]
+    /// One thread each, for a playing preview's frames and idle caching (see [`Queue::idle_lanes`]). Empty if
+    /// the OS refused the threads: those frames then render on `pool` too.
+    lanes: Vec<rayon::ThreadPool>,
     ctx: Option<egui::Context>,
     /// Render time of the last viewer (urgent) frame in ms, for the Info panel / perf readout.
     pub last_ms: Arc<Mutex<f64>>,
     content_keys: ContentKeys,
+    /// Size and content hash for paths with no native metadata (the browser's file table): to
+    /// store and check the files of disk entries.
+    virtual_id: Option<Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>>,
     #[cfg(not(target_arch = "wasm32"))]
     content_key_jobs: Arc<Mutex<ContentKeyJobs>>,
     gpu_retired: Arc<AtomicBool>,
@@ -455,16 +596,64 @@ pub struct Frames {
     /// Where frames render instead of the UI thread (wasm32), and how many it is rendering.
     remote: Option<Arc<dyn RemoteFrames>>,
     remote_busy: Arc<Mutex<usize>>,
+    /// Disk keys [`Frames::persist_missing`] is converting (the disk cache tracks them once
+    /// queued, so an evicted or refused frame is written again).
+    #[cfg(not(target_arch = "wasm32"))]
+    persisted: Arc<Mutex<HashSet<u128>>>,
+    /// The disk limit and how often each disk key was written under it: a frame is rewritten
+    /// once after an eviction, not again (a disk cache smaller than the RAM preview, or a frame
+    /// that can't fit, would otherwise be rewritten on every idle pass). A new limit resets it.
+    #[cfg(not(target_arch = "wasm32"))]
+    written: Arc<Mutex<(u64, HashMap<u128, u8>)>>,
+    /// Edits whose kept frames are still to be found on disk under the new content key
+    /// ([`Frames::carry_disk`]), oldest first.
+    #[cfg(not(target_arch = "wasm32"))]
+    disk_carries: Arc<Mutex<VecDeque<DiskCarry>>>,
+    /// A carry job is scheduled or running: at most one at a time, draining the edits in order.
+    #[cfg(not(target_arch = "wasm32"))]
+    carry_scheduled: Arc<AtomicBool>,
+    /// The disk series (scale, view and options hash) each comp's frames are cached in.
+    #[cfg(not(target_arch = "wasm32"))]
+    disk_series: Arc<Mutex<HashMap<u64, Vec<(u32, u64)>>>>,
 }
 
+/// An edit's kept frames, to find on disk under the comp's new content key: those of `comp` in
+/// `from` outside `dirty` (inclusive frame ranges) also draw `to`'s.
+#[cfg(not(target_arch = "wasm32"))]
+struct DiskCarry {
+    comp: u64,
+    from: Arc<Project>,
+    to: Arc<Project>,
+    dirty: Vec<(i64, i64)>,
+}
+
+/// Disk series remembered per comp (see [`Frames::disk_series`]).
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_DISK_SERIES: usize = 8;
+
 impl Default for Frames {
     fn default() -> Self {
         #[cfg(not(target_arch = "wasm32"))]
         let threads = std::thread::available_parallelism().map(|n| n.get()).unwrap_or(4).clamp(2, 16);
+        #[cfg(not(target_arch = "wasm32"))]
+        let lanes: Vec<rayon::ThreadPool> = (0..threads)
+            .map_while(|i| {
+                rayon::ThreadPoolBuilder::new()
+                    .num_threads(1)
+                    .thread_name(move |_| format!("ec-preview-{i}"))
+                    .panic_handler(|_| log::error!("a frame render panicked; that frame was skipped"))
+                    .build()
+                    .ok()
+            })
+            .collect();
+        #[cfg(not(target_arch = "wasm32"))]
+        let queue = Queue { idle_lanes: (0..lanes.len()).collect(), lanes: lanes.len(), gpu_limit: 1, ..Default::default() };
+        #[cfg(target_arch = "wasm32")]
+        let queue = Queue::default();
         Frames {
-            cache: Arc::new(Mutex::new(Cache { map: HashMap::new(), order: VecDeque::new(), bytes: 0, gpu_bytes: 0, budget: 3 << 30, gpu_budget: GPU_BUDGET, playhead: None })),
+            cache: Arc::new(Mutex::new(Cache { map: HashMap::new(), order: VecDeque::new(), bytes: 0, gpu_bytes: 0, budget: 3 << 30, gpu_budget: GPU_BUDGET, gpu_pressure: None, gpu_adjusted: None, playhead: None, scale: None })),
             inflight: Arc::new(Mutex::new(HashSet::new())),
-            queue: Arc::new(Mutex::new(Queue::default())),
+            queue: Arc::new(Mutex::new(queue)),
             #[cfg(not(target_arch = "wasm32"))]
             // A panicking job would abort the whole process (rayon's default for `spawn`): log it
             // and lose only that frame (the panic hook has logged the message).
@@ -474,9 +663,12 @@ impl Default for Frames {
                 .panic_handler(|_| log::error!("a frame render panicked; that frame was skipped"))
                 .build()
                 .ok(),
+            #[cfg(not(target_arch = "wasm32"))]
+            lanes,
             ctx: None,
             last_ms: Arc::new(Mutex::new(0.0)),
             content_keys: Arc::default(),
+            virtual_id: None,
             #[cfg(not(target_arch = "wasm32"))]
             content_key_jobs: Arc::default(),
             gpu_retired: Arc::default(),
@@ -485,25 +677,56 @@ impl Default for Frames {
             keepers: Mutex::default(),
             remote: None,
             remote_busy: Arc::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            persisted: Arc::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            written: Arc::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            disk_carries: Arc::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            carry_scheduled: Arc::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            disk_series: Arc::default(),
         }
     }
 }
 
+/// Whether viewer frames of a project with `settings` are half floats ([`F16Frame`], rendered
+/// with `RenderOpts::skip_hdr_step`): 32 bpc on the desktop. The browser's frames (its frame
+/// worker's RGBA8, the GPU compositor's display textures) stay 8-bit for now.
+pub fn f16_frames(settings: &effectcraft_engine::project::ProjectSettings) -> bool {
+    cfg!(not(target_arch = "wasm32")) && settings.bit_depth.levels().is_none()
+}
+
+/// Bytes per pixel of the viewer frames of a project with `settings` (see [`f16_frames`]).
+pub fn frame_pixel_bytes(settings: &effectcraft_engine::project::ProjectSettings) -> usize {
+    if f16_frames(settings) { F16_PIXEL_BYTES } else { 4 }
+}
+
+/// A rendered frame as a cached viewer frame: half floats for `skip_hdr_step` renders (see
+/// [`f16_frames`]), else 8-bit.
+pub fn cpu_frame(img: &effectcraft_engine::render::Image, project: &Project, opts: &RenderOpts) -> FrameImage {
+    if opts.skip_hdr_step {
+        let encoding = effectcraft_engine::viewer::FrameEncoding::of(&project.settings, true);
+        FrameImage::CpuF16(Arc::new(F16Frame::from_image(img, encoding)))
+    } else {
+        FrameImage::Cpu(Arc::new(to_color_image(img)))
+    }
+}
+
 /// Premultiplied f32 → egui premultiplied Color32 (alpha kept, so the viewer can show the
 /// transparency grid or the comp background colour underneath).
 pub fn to_color_image(img: &effectcraft_engine::render::Image) -> egui::ColorImage {
-    let px: Vec<egui::Color32> = img
-        .data
-        .par_iter()
-        .map(|p| {
-            let a = p[3].clamp(0.0, 1.0);
-            let c = |v: f32| (v.clamp(0.0, a) * 255.0 + 0.5) as u8;
-            egui::Color32::from_rgba_premultiplied(c(p[0]), c(p[1]), c(p[2]), (a * 255.0 + 0.5) as u8)
-        })
-        .collect();
+    let px: Vec<egui::Color32> = img.data.par_iter().map(|p| display_pixel(*p)).collect();
     egui::ColorImage::new([img.width as usize, img.height as usize], px)
 }
 
+pub(crate) fn display_pixel(pixel: [f32; 4]) -> egui::Color32 {
+    let alpha = if pixel[3].is_nan() { 0.0 } else { pixel[3].clamp(0.0, 1.0) };
+    let component = |value: f32| (value.clamp(0.0, alpha) * 255.0 + 0.5) as u8;
+    egui::Color32::from_rgba_premultiplied(component(pixel[0]), component(pixel[1]), component(pixel[2]), (alpha * 255.0 + 0.5) as u8)
+}
+
 /// The whole factor an image of `size` is averaged down by for a texture: at least `min_k`, and
 /// the smallest that fits its sides in `max_side` (frames of comps wider than the GPU's texture
 /// limit, #201).
@@ -596,7 +819,7 @@ impl Frames {
     pub fn retire_gpu(&self) {
         self.gpu_retired.store(true, Ordering::Release);
         if let Ok(mut cache) = self.cache.lock() {
-            let keys: Vec<_> = cache.map.iter().filter_map(|(key, image)| image.is_gpu().then_some(*key)).collect();
+            let keys: Vec<_> = cache.map.iter().filter_map(|(key, c)| c.img.is_gpu().then_some(*key)).collect();
             for key in keys {
                 cache.remove(&key);
             }
@@ -631,7 +854,7 @@ impl Frames {
     /// The cached frame, which becomes the most recently used.
     pub fn get(&self, k: &FrameKey) -> Option<FrameImage> {
         let mut c = self.cache.lock().ok()?;
-        let img = c.map.get(k).cloned()?;
+        let img = c.map.get(k).map(|c| c.img.clone())?;
         c.touch(k);
         Some(img)
     }
@@ -667,7 +890,7 @@ impl Frames {
             })
             .max_by_key(|k| k.revision)
             .copied()?;
-        let img = c.map.get(&newest).cloned()?;
+        let img = c.map.get(&newest).map(|c| c.img.clone())?;
         c.touch(&newest);
         Some((newest, img))
     }
@@ -720,17 +943,54 @@ impl Frames {
     fn identity(&self, project: &Arc<Project>, comp: ItemId) -> Identity {
         let plain = comp_content(project, comp);
         let Ok(mut bases) = self.bases.lock() else { return (plain, None) };
-        // Markers can only change pixels through expressions, which read them.
-        let markers_count = project_has_expressions(project);
+        // Markers are pixels only to the expressions that read them (#1083).
+        let markers = project.reads_markers();
+        // Whose audio is drawn, before or after the edit (a waveform added or removed counts).
+        let heard = bases.get(&comp.0).map_or_else(|| project.heard_layers(), |(_, base)| project.heard_layers().union(&base.heard_layers()));
         if let Some((base_id, base)) = bases.get(&comp.0)
             && *base_id != plain
-            && comp_content_with(project, comp, |id, c| match base.item(id).map(|i| &i.kind) {
-                Some(ItemKind::Comp(b)) if Arc::ptr_eq(b, c) || same_pixels(b, c, markers_count) => Arc::as_ptr(b),
-                _ => Arc::as_ptr(c),
-            }) == *base_id
+            && comp_content_with(
+                project,
+                comp,
+                project,
+                |id, c| match base.item(id).map(|i| &i.kind) {
+                    Some(ItemKind::Comp(b)) if Arc::ptr_eq(b, c) || b.same_pixels_with(c, markers, &|l| heard.contains(id, l)) => b,
+                    _ => c,
+                },
+                true,
+            ) == *base_id
         {
             return (*base_id, Some(base.clone()));
         }
+        // Only comps changed (not the footage, solids or settings they draw): its frames outside
+        // the spans the edit reaches (and a frame either side for rounding) keep drawing the same
+        // pixels, so a nudge, cut or trim, here or in a precomp, recaches only the frames it
+        // touched (#1641). Expressions can read anything at any time, so with them a change
+        // elsewhere in the project (another comp, an item's name) reaches the frames of the
+        // layers that have one.
+        let base_comp = |id: ItemId| bases.get(&comp.0).and_then(|(_, base)| base.item(id)).map(|i| &i.kind);
+        let base_tree = |id, c| match base_comp(id) {
+            Some(ItemKind::Comp(b)) if id == comp || Arc::ptr_eq(b, c) || b.same_pixels_with(c, markers, &|l| heard.contains(id, l)) => b,
+            _ => c,
+        };
+        let base_comps = |id, c| match base_comp(id) {
+            Some(ItemKind::Comp(b)) => b,
+            _ => c,
+        };
+        if let Some((base_id, base)) = bases.get(&comp.0)
+            && comp_content_with(project, comp, base, base_comps, false) == comp_content_with(base, comp, base, |_, c| c, false)
+            && let Some(dirty) = dirty_frames(base, project, comp, &heard, comp_content_with(project, comp, base, base_tree, true) != *base_id)
+            && let Ok(mut cache) = self.cache.lock()
+        {
+            cache.carry(*base_id, plain, |f| !dirty.iter().any(|(lo, hi)| (*lo..=*hi).contains(&f)));
+            #[cfg(not(target_arch = "wasm32"))]
+            if let Ok(mut q) = self.disk_carries.lock() {
+                if q.len() >= MAX_KEEPERS {
+                    q.pop_front();
+                }
+                q.push_back(DiskCarry { comp: comp.0, from: base.clone(), to: project.clone(), dirty });
+            }
+        }
         if bases.len() > MAX_KEEPERS {
             bases.clear();
         }
@@ -758,7 +1018,12 @@ impl Frames {
     /// Frames of the series of `base` in the disk cache but not in RAM — the blue cache bar.
     /// `opts` are the viewer's render options (part of the disk key). Native queries return
     /// no blue frames until the content key is ready; hashing never blocks timeline painting.
-    pub fn disk_frames(&self, src: &RenderSource, base: &FrameKey, frames: i64, opts: &RenderOpts) -> Vec<i64> {
+    pub fn disk_frames(&self, src: &RenderSource, base: &FrameKey, range: std::ops::Range<i64>, opts: &RenderOpts) -> Vec<i64> {
+        let start = range.start.clamp(0, 100_000);
+        let end = range.end.clamp(0, 100_000);
+        if start >= end {
+            return vec![];
+        }
         let remote = self.remote.as_ref().filter(|r| r.disk());
         let contains = |k: u128| match (&src.disk, remote) {
             (Some(dc), _) => dc.contains(disk_cache::Kind::Frame, k),
@@ -769,6 +1034,11 @@ impl Frames {
             return vec![];
         }
         #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.note_disk_series(base.comp, base.scale, base.view ^ opts_hash(opts));
+            self.carry_disk(src);
+        }
+        #[cfg(not(target_arch = "wasm32"))]
         let content = {
             let known = self.content_keys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&(base.revision, base.comp)).copied();
             let Some(content) = known else {
@@ -781,12 +1051,159 @@ impl Frames {
         let content = content_key(&self.content_keys, &src.project, base.revision, base.comp);
         let ram: HashSet<i64> = self.cached_frames(base).into_iter().collect();
         let oh = opts_hash(opts);
-        (0..frames.clamp(0, 100_000))
-            .filter(|f| !ram.contains(f))
-            .filter(|f| contains(disk_cache::frame_key(content, *f, base.scale, base.view ^ oh)))
-            .collect()
+        (start..end).filter(|f| !ram.contains(f)).filter(|f| contains(disk_cache::frame_key(content, *f, base.scale, base.view ^ oh))).collect()
     }
 
+    /// Write the RAM frames of `base`'s series that the disk cache lacks: frames an edit kept
+    /// (written under the comp's previous content key) and writes the disk cache dropped. They
+    /// are converted on the frame pool, each queued once. `true` while there may be more to
+    /// write (a content key being computed, frames being converted): call again soon, since a
+    /// refused write is only retried by a later call. Disk keys hash `opts` the way the worker
+    /// writes them (`base.opts` also carries the Roto Brush model stamp). Only frames that know
+    /// every source file they were made of are written (an entry is checked against them).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn persist_missing(&self, src: &RenderSource, base: &FrameKey, opts: &RenderOpts) -> bool {
+        let Some(dc) = src.disk.clone() else { return false };
+        let oh = opts_hash(opts);
+        self.note_disk_series(base.comp, base.scale, base.view ^ oh);
+        self.carry_disk(src);
+        // Free disk space leaves the cache (next to) no room: nothing would be stored, so nothing
+        // is converted (a refusal doesn't count as a try, so every idle pass would convert them
+        // all again). A later idle pass writes them once there is room (`prefs_live::memory_watch`
+        // keeps frames coming meanwhile).
+        if !dc.accepts_writes() {
+            return false;
+        }
+        let known = self.content_keys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&(base.revision, base.comp)).copied();
+        let Some(content) = known else {
+            self.request_content_key(src.project.clone(), base.revision, base.comp);
+            return true;
+        };
+        let (missing, converting): (Vec<(u128, FrameImage, Arc<ReadFiles>, u64)>, bool) = {
+            let (Ok(c), Ok(mut queued), Ok(mut written)) = (self.cache.lock(), self.persisted.lock(), self.written.lock()) else { return false };
+            if queued.len() > 100_000 {
+                queued.clear();
+            }
+            let limit = dc.limit_bytes();
+            if written.0 != limit || written.1.len() > 100_000 {
+                *written = (limit, HashMap::new());
+            }
+            let missing = c
+                .map
+                .iter()
+                .filter(|(k, _)| k.same_series(base))
+                .filter_map(|(k, c)| {
+                    // (GPU frames have no CPU pixels to write; a frame that can't name its files
+                    // can't be checked when read)
+                    let files = c.files.as_ref().filter(|f| f.is_complete() && !c.img.is_gpu())?;
+                    // (only with the generation its render started at, for this cache: a frame
+                    // made of a file Reload Footage dropped since holds the pixels from before)
+                    let since = c.since.as_ref().and_then(|s| s.for_cache(&dc)).filter(|s| !dc.dropped_since(files, *s))?;
+                    let dk = disk_cache::frame_key(content, k.frame, k.scale, k.view ^ oh);
+                    let tries = written.1.get(&dk).copied().unwrap_or(0);
+                    (tries < 2 && !dc.contains(disk_cache::Kind::Frame, dk) && !dc.frame_pending(dk) && queued.insert(dk))
+                        .then(|| (dk, c.img.clone(), files.clone(), since))
+                })
+                .collect();
+            (missing, !queued.is_empty())
+        };
+        if missing.is_empty() {
+            return converting;
+        }
+        let (persisted, written, virtual_id) = (self.persisted.clone(), self.written.clone(), self.virtual_id.clone());
+        let work = move || {
+            for (dk, img, files, since) in missing {
+                // (accepted: the disk cache tracks it until written, and it counts as a try;
+                // refused by a full queue: retried, without counting)
+                let accepted = put_disk_frame(&dc, dk, &img, &files, virtual_id.as_deref(), since);
+                if accepted && let Ok(mut w) = written.lock() {
+                    let n = w.1.entry(dk).or_default();
+                    *n = n.saturating_add(1);
+                }
+                if let Ok(mut q) = persisted.lock() {
+                    q.remove(&dk);
+                }
+            }
+        };
+        match &self.pool {
+            Some(pool) => pool.spawn(work),
+            None => rayon::spawn(work),
+        }
+        true
+    }
+
+    /// Remember that `comp`'s frames are cached on disk at `scale` with view and options hash
+    /// `view` (the most recent [`MAX_DISK_SERIES`]).
+    #[cfg(not(target_arch = "wasm32"))]
+    fn note_disk_series(&self, comp: u64, scale: u32, view: u64) {
+        if let Ok(mut m) = self.disk_series.lock() {
+            let v = m.entry(comp).or_default();
+            if v.first() != Some(&(scale, view)) {
+                v.retain(|s| *s != (scale, view));
+                v.insert(0, (scale, view));
+                v.truncate(MAX_DISK_SERIES);
+            }
+        }
+    }
+
+    /// Find the frames edits kept ([`Frames::identity`]) on disk under their comps' new content
+    /// keys: link each kept frame of every disk series of the comp to its new key, on the frame
+    /// pool, oldest edit first.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn carry_disk(&self, src: &RenderSource) {
+        let Some(dc) = src.disk.clone() else { return };
+        let pending = |q: &Mutex<VecDeque<DiskCarry>>| q.lock().is_ok_and(|q| !q.is_empty());
+        // (called on every paint: one job drains every carry queued meanwhile)
+        if !pending(&self.disk_carries) || self.carry_scheduled.swap(true, Ordering::AcqRel) {
+            return;
+        }
+        let (carries, scheduled, series, ctx) = (self.disk_carries.clone(), self.carry_scheduled.clone(), self.disk_series.clone(), self.ctx.clone());
+        let work = move || {
+            let mut linked = false;
+            loop {
+                let todo: Vec<DiskCarry> = carries.lock().map(|mut q| q.drain(..).collect()).unwrap_or_default();
+                if todo.is_empty() {
+                    scheduled.store(false, Ordering::Release);
+                    // (a carry queued after the drain and before the store: keep it, unless a new job took it)
+                    if pending(&carries) && !scheduled.swap(true, Ordering::AcqRel) {
+                        continue;
+                    }
+                    break;
+                }
+                for c in todo {
+                    // (a panicking carry is skipped: the others still carry, and the flag is
+                    // still cleared below)
+                    let carry = || {
+                        let Some(series) = series.lock().ok().and_then(|m| m.get(&c.comp).cloned()) else { return false };
+                        let comp = ItemId(c.comp);
+                        let n = c.to.comp(comp).map_or(0, |k| k.frame_rate.frame_at(k.duration)).clamp(0, 100_000);
+                        let key = |p: &Project| disk_cache::comp_content_key(p, comp);
+                        let (a, b) = (key(&c.from), key(&c.to));
+                        if a == b {
+                            return false;
+                        }
+                        let mut linked = false;
+                        for f in (0..n).filter(|f| !c.dirty.iter().any(|(lo, hi)| (*lo..=*hi).contains(f))) {
+                            for (scale, view) in &series {
+                                linked |= dc.link_frame(disk_cache::frame_key(a, f, *scale, *view), disk_cache::frame_key(b, f, *scale, *view));
+                            }
+                        }
+                        linked
+                    };
+                    linked |= std::panic::catch_unwind(std::panic::AssertUnwindSafe(carry)).unwrap_or(false);
+                }
+            }
+            if linked && let Some(ctx) = &ctx {
+                ctx.request_repaint();
+            }
+        };
+        match &self.pool {
+            Some(pool) => pool.spawn(work),
+            None => rayon::spawn(work),
+        }
+    }
+
+    /// Queues a background hash of `comp` at `revision`, coalescing rapid edits so only a bounded number of snapshots are kept.
     #[cfg(not(target_arch = "wasm32"))]
     fn request_content_key(&self, project: Arc<Project>, revision: u64, comp: u64) {
         let mut jobs = self.content_key_jobs.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
@@ -839,6 +1256,7 @@ impl Frames {
         self.cache.lock().map(|c| c.budget).unwrap_or(0)
     }
 
+    /// Drops every cached frame and purges the remote server, if there is one.
     pub fn clear(&self) {
         if let Some(r) = &self.remote {
             r.purge();
@@ -848,10 +1266,12 @@ impl Frames {
             c.order.clear();
             c.bytes = 0;
             c.gpu_bytes = 0;
+            c.gpu_budget = GPU_BUDGET;
+            c.gpu_pressure = None;
+            c.gpu_adjusted = None;
         }
-        // Disk keys hash the footage files' size and time, but are remembered per revision; a
-        // file reloaded from disk without a new revision (a re-rendered image sequence) must be
-        // keyed again, or the disk cache serves the frames from before.
+        // (the disk keys of a revision don't depend on files: a file changed on disk is caught
+        // when its frames' entries are read; they are forgotten with the frames all the same)
         if let Ok(mut k) = self.content_keys.lock() {
             k.clear();
         }
@@ -865,26 +1285,86 @@ impl Frames {
             c.playhead = playhead;
         }
         let Ok(mut q) = self.queue.lock() else { return };
+        // A preview starting or stopping moves the queued prefetch frames between the lanes and
+        // the pool (see [`Queue::idle_lanes`]).
+        #[cfg(not(target_arch = "wasm32"))]
+        let moved = q.playhead.is_some() != playhead.is_some();
         q.playhead = playhead;
-        let Some(p) = playhead else { return };
-        let Ok(mut inf) = self.inflight.lock() else { return };
-        q.jobs.retain(|j| {
-            let gone = !j.urgent && j.key.same_series(&p.series) && p.ahead(&j.key).is_none();
-            if gone {
-                inf.remove(&j.key);
+        // (called once per frame of the window while a preview plays)
+        let more_gpu = q.ui_frame(playhead.map(|_| web_time::Instant::now()));
+        if let Some(p) = playhead
+            && let Ok(mut inf) = self.inflight.lock()
+        {
+            q.jobs.retain(|j| {
+                let gone = !j.urgent && j.key.same_series(&p.series) && p.ahead(&j.key).is_none();
+                if gone {
+                    inf.remove(&j.key);
+                }
+                !gone
+            });
+        }
+        // A lane more may composite: one that stopped at the limit starts again.
+        #[cfg(not(target_arch = "wasm32"))]
+        if more_gpu && !moved {
+            self.start_lanes(&mut q, 1);
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = more_gpu;
+        #[cfg(not(target_arch = "wasm32"))]
+        if moved {
+            self.start_lanes(&mut q, usize::MAX);
+            let pool_jobs = q.jobs.iter().filter(|j| !q.on_lane(j)).count().min(self.parallelism());
+            drop(q);
+            for _ in 0..pool_jobs {
+                self.start_pool();
             }
-            !gone
-        });
+        }
+    }
+
+    /// Start up to `n` idle lanes on the queued jobs (see [`Queue::idle_lanes`]).
+    #[cfg(not(target_arch = "wasm32"))]
+    fn start_lanes(&self, q: &mut Queue, n: usize) {
+        if self.remote.is_some() {
+            return;
+        }
+        let jobs = q.jobs.iter().filter(|j| q.on_lane(j)).count();
+        for _ in 0..n.min(jobs) {
+            let Some(lane) = q.idle_lanes.pop() else { break };
+            let Some(pool) = self.lanes.get(lane) else { break };
+            let w = self.worker();
+            pool.spawn(move || w.drain(Some(lane)));
+        }
+    }
+
+    /// Have a pool thread render the queued jobs that are the pool's.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn start_pool(&self) {
+        if self.remote.is_some() {
+            return;
+        }
+        let w = self.worker();
+        let job = move || w.drain(None);
+        match &self.pool {
+            Some(pool) => pool.spawn(job),
+            None => rayon::spawn(job),
+        }
     }
 
     /// Queue a prefetch frame (no-op if cached or already queued/rendering).
     pub fn request(&self, src: &RenderSource, key: FrameKey, comp: ItemId, t: Tick, opts: RenderOpts) {
-        self.request_with(src, key, comp, t, opts, false);
+        self.request_with(src, key, comp, t, opts, Want::Prefetch);
+    }
+
+    /// Queue a frame nobody waits for (Cache Frames When Idle): as [`Frames::request`], but it
+    /// renders on a lane, one thread, and leaves the pool to the viewer's frame (see
+    /// [`Queue::idle_lanes`]).
+    pub fn request_background(&self, src: &RenderSource, key: FrameKey, comp: ItemId, t: Tick, opts: RenderOpts) {
+        self.request_with(src, key, comp, t, opts, Want::Background);
     }
 
     /// Queue the frame the viewer is showing: it jumps ahead of every prefetch job.
     pub fn request_urgent(&self, src: &RenderSource, key: FrameKey, comp: ItemId, t: Tick, opts: RenderOpts) {
-        self.request_with(src, key, comp, t, opts, true);
+        self.request_with(src, key, comp, t, opts, Want::Viewer);
     }
 
     /// An urgent (viewer) frame is queued or rendering.
@@ -892,8 +1372,21 @@ impl Frames {
         self.queue.lock().map(|q| q.urgent_running > 0 || q.jobs.iter().any(|j| j.urgent)).unwrap_or(false)
     }
 
-    fn request_with(&self, src: &RenderSource, key: FrameKey, comp: ItemId, t: Tick, opts: RenderOpts, urgent: bool) {
-        if self.is_cached(&key) {
+    fn request_with(&self, src: &RenderSource, key: FrameKey, comp: ItemId, t: Tick, opts: RenderOpts, want: Want) {
+        let urgent = want == Want::Viewer;
+        // The frame on screen sets the scale evictions keep: a prefetch or a passive viewer at
+        // another zoom must not evict the active viewer's frames.
+        let cached = self
+            .cache
+            .lock()
+            .map(|mut c| {
+                if urgent {
+                    c.scale = Some(key.scale);
+                }
+                c.map.contains_key(&key)
+            })
+            .unwrap_or(false);
+        if cached {
             return;
         }
         let Ok(mut q) = self.queue.lock() else { return };
@@ -932,22 +1425,32 @@ impl Frames {
             }
         }
         if !inf.insert(key) {
+            drop(inf);
+            drop(q);
+            // Queued for a lane and now the viewer's frame: it is the pool's.
+            #[cfg(not(target_arch = "wasm32"))]
+            if urgent {
+                self.start_pool();
+            }
             return;
         }
         q.seq += 1;
         let seq = q.seq;
-        q.jobs.push(Job { key, src: src.clone(), comp, t, opts, urgent, seq, cancel: Arc::default() });
+        let job = Job { key, src: src.clone(), comp, t, opts, urgent, background: want == Want::Background, seq, cancel: Arc::default() };
+        // A lane's frame: a busy lane takes the next job when it is done, an idle one starts now.
+        #[cfg(not(target_arch = "wasm32"))]
+        let on_lane = q.on_lane(&job);
+        q.jobs.push(job);
+        #[cfg(not(target_arch = "wasm32"))]
+        if on_lane {
+            self.start_lanes(&mut q, 1);
+        }
         drop(inf);
         drop(q);
+        // One spawn per job; each spawn renders whichever queued jobs matter most right now.
         #[cfg(not(target_arch = "wasm32"))]
-        if self.remote.is_none() {
-            let w = self.worker();
-            // One spawn per job; each spawn renders whichever queued jobs matter most right now.
-            let job = move || w.drain();
-            match &self.pool {
-                Some(pool) => pool.spawn(job),
-                None => rayon::spawn(job),
-            }
+        if !on_lane {
+            self.start_pool();
         }
         #[cfg(target_arch = "wasm32")]
         if let Some(ctx) = &self.ctx {
@@ -956,6 +1459,7 @@ impl Frames {
         }
     }
 
+    /// A render worker sharing this cache's queue, cache and in-flight set.
     fn worker(&self) -> Worker {
         Worker {
             queue: self.queue.clone(),
@@ -964,10 +1468,17 @@ impl Frames {
             ctx: self.ctx.clone(),
             last: self.last_ms.clone(),
             content_keys: self.content_keys.clone(),
+            virtual_id: self.virtual_id.clone(),
             gpu_retired: self.gpu_retired.clone(),
         }
     }
 
+    /// Browser file table: `id` gives the size and content hash of a path served from memory,
+    /// stored with the disk entries of the frames that read it and checked when they are read.
+    pub fn set_virtual_id(&mut self, id: Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>) {
+        self.virtual_id = Some(id);
+    }
+
     /// Render frames with `remote` from now on (`None`: on this thread again).
     pub fn set_remote(&mut self, remote: Option<Arc<dyn RemoteFrames>>) {
         self.remote = remote;
@@ -1023,8 +1534,10 @@ impl Frames {
             let gpu_here = job.src.gpu.is_some() && job.src.gpu_display && !(remote.gpu() && comp_has_effects(&job.src.project, job.comp));
             if gpu_here {
                 let t0 = web_time::Instant::now();
-                if let Some(img) = w.render_gpu(&job) {
-                    w.finish(&job, img, t0);
+                // (A frame kept on the GPU is not written to the disk cache: its files are not
+                // needed.)
+                if let Some((img, _files)) = w.render_gpu(&job) {
+                    w.finish(&job, img, None, None, t0);
                     continue;
                 }
             }
@@ -1047,7 +1560,7 @@ impl Frames {
                     match r {
                         Ok(f) => {
                             let img = egui::ColorImage::from_rgba_premultiplied([f.width as usize, f.height as usize], &f.rgba);
-                            fw.finish_key(key, urgent, FrameImage::Cpu(Arc::new(img)), t0);
+                            fw.finish_key(key, urgent, FrameImage::Cpu(Arc::new(img)), None, None, t0);
                         }
                         Err(e) => {
                             // Not rendered (a stale revision, a lost worker): the viewer asks again.
@@ -1076,7 +1589,7 @@ impl Frames {
         }
         let t0 = web_time::Instant::now();
         let w = self.worker();
-        while w.run_next() {
+        while w.run_next(None) {
             if t0.elapsed() >= budget {
                 break;
             }
@@ -1093,6 +1606,7 @@ struct Worker {
     ctx: Option<egui::Context>,
     last: Arc<Mutex<f64>>,
     content_keys: ContentKeys,
+    virtual_id: Option<Arc<dyn Fn(&str) -> Option<(u64, u64)> + Send + Sync>>,
     gpu_retired: Arc<AtomicBool>,
 }
 
@@ -1113,6 +1627,17 @@ impl Drop for Draining {
     }
 }
 
+/// A lane's hold on one of the [`Queue::gpu_limit`] GPU slots (see [`Queue::gpu_lanes`]), given back when dropped,
+/// even by a panic.
+struct GpuSlot<'a>(&'a Mutex<Queue>);
+
+impl Drop for GpuSlot<'_> {
+    fn drop(&mut self) {
+        let mut q = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        q.gpu_lanes = q.gpu_lanes.saturating_sub(1);
+    }
+}
+
 impl Worker {
     /// Render queued jobs, most important first, until the queue is empty.
     ///
@@ -1122,38 +1647,59 @@ impl Worker {
     /// every UI frame, so renders piled up on every thread until memory ran out (#647). A spawn
     /// that lands inside a render returns at once instead; the render below it takes the queued
     /// jobs when it is done, so each thread renders one frame at a time.
+    ///
+    /// `lane`: the lane this runs on (see [`Queue::idle_lanes`]), `None` on the pool.
     #[cfg(not(target_arch = "wasm32"))]
-    fn drain(&self) {
+    fn drain(&self, lane: Option<usize>) {
         if DRAINING.get() {
             return;
         }
         DRAINING.set(true);
         let _reset = Draining;
-        while self.run_next() {}
+        while self.run_next(lane) {}
     }
 
-    /// Render the queued job that matters most right now. `false` when the queue was empty.
-    fn run_next(&self) -> bool {
+    /// Render the queued job that matters most right now, on lane `lane` (`None`: on
+    /// the pool, or the UI thread). `false` when the queue had no job for it; the lane is then
+    /// idle again.
+    fn run_next(&self, lane: Option<usize>) -> bool {
         let Worker { queue, content_keys, .. } = self;
-        let job = {
+        // (asked before the queue's lock: it takes the cache's)
+        let gpu = lane.is_some() && self.gpu_ready();
+        let (job, mut slot) = {
             let Ok(mut q) = queue.lock() else { return false };
-            let Some(i) = q.best() else { return false };
+            let Some(i) = q.next(lane.is_some(), gpu) else {
+                q.idle_lanes.extend(lane);
+                return false;
+            };
             let job = q.jobs.swap_remove(i);
+            let slot = (gpu && q.gpu_job(&job)).then(|| {
+                q.gpu_lanes += 1;
+                GpuSlot(queue)
+            });
             q.running.insert(job.key);
             if job.urgent {
                 q.urgent_running += 1;
                 q.urgent_cancels.push((job.key, job.cancel.clone()));
             }
-            job
+            (job, slot)
         };
         let t0 = web_time::Instant::now();
-        let disk = job.src.disk.as_ref().map(|dc| (dc.clone(), frame_disk_key(content_keys, &job.src.project, &job.key, opts_hash(&job.opts))));
-        let from_disk = disk.as_ref().and_then(|(dc, k)| dc.get_frame(*k));
+        // (the drop generation before the frame reads anything: File ▸ Reload Footage meanwhile
+        // makes what it read from a reloaded file stale)
+        let disk =
+            job.src.disk.as_ref().map(|dc| (dc.clone(), frame_disk_key(content_keys, &job.src.project, &job.key, opts_hash(&job.opts)), dc.drop_generation()));
+        let from_disk = disk.as_ref().and_then(|(dc, k, _)| self.disk_frame(dc, *k, &job));
         let disk_hit = from_disk.is_some();
-        let ci = match from_disk {
-            Some(f) => FrameImage::Cpu(Arc::new(egui::ColorImage::from_rgba_premultiplied([f.width as usize, f.height as usize], &f.rgba))),
+        if disk_hit {
+            // Nothing for the GPU to do: another lane may composite meanwhile.
+            slot = None;
+        }
+        // `files`: the source files the frame was made of (see `render::reads`).
+        let (ci, files) = match from_disk {
+            Some(hit) => hit,
             None => match self.render_guarded(&job).filter(|_| !job.cancel.load(Ordering::Relaxed)) {
-                Some(ci) => ci,
+                Some(rendered) => rendered,
                 // Called off (frames it read may be missing) or failed: not cached, and not
                 // "in progress" forever: the viewer asks for it again.
                 None => {
@@ -1162,32 +1708,63 @@ impl Worker {
                 }
             },
         };
+        let mut files = files;
+        if let Some((dc, _, since)) = &disk
+            && dc.dropped_since(&files, *since)
+        {
+            // Made of a file as it was before File ▸ Reload Footage dropped it: shown, but its
+            // list can't vouch for it, so neither this worker nor `persist_missing` stores it.
+            files.mark_incomplete();
+        }
+        let files = Arc::new(files);
         // Publish the shared frame and wake the viewer before optional RGBA conversion
         // and compression. Persistence still runs on this worker, using the same snapshot.
-        self.finish(&job, ci.clone(), t0);
-        if !disk_hit && let (Some((dc, k)), FrameImage::Cpu(img)) = (&disk, &ci) {
-            let rgba: Vec<u8> = img.pixels.iter().flat_map(|c| c.to_array()).collect();
-            dc.put_frame(*k, img.size[0] as u32, img.size[1] as u32, &rgba);
-            if let Some(ctx) = &self.ctx {
-                ctx.request_repaint();
-            }
+        let since = disk.as_ref().map(|(dc, _, since)| DiskSince::of(dc, *since));
+        self.finish(&job, ci.clone(), Some(files.clone()), since, t0);
+        // The GPU's part is done; storing it on disk is the CPU's.
+        drop(slot);
+        if !disk_hit
+            && let Some((dc, k, since)) = &disk
+            && put_disk_frame(dc, *k, &ci, &files, self.virtual_id.as_deref(), *since)
+            && let Some(ctx) = &self.ctx
+        {
+            ctx.request_repaint();
         }
         true
     }
 
-    /// Store a finished frame and release its job.
-    fn finish(&self, job: &Job, img: FrameImage, t0: web_time::Instant) {
-        self.finish_key(job.key, job.urgent, img, t0);
+    /// The frame of `job` from the disk cache (key `k`), if its entry is there and the source
+    /// files it lists are unchanged (checked here, on the frame worker: a few `metadata` calls
+    /// for that frame's files). An entry whose files changed is deleted: the frame renders again
+    /// and its new entry replaces it.
+    fn disk_frame(&self, dc: &DiskCache, k: u128, job: &Job) -> Option<(FrameImage, ReadFiles)> {
+        let virtual_id = self.virtual_id.as_deref();
+        // Half-float frames (32 bpc) have entries of their own (their key has the options).
+        if job.opts.skip_hdr_step {
+            let (f, files) = dc.get_frame_f16(k, virtual_id)?;
+            let encoding = effectcraft_engine::viewer::FrameEncoding::of(&job.src.project.settings, true);
+            Some((FrameImage::CpuF16(Arc::new(F16Frame::from_bits(f.width, f.height, f.rgba, encoding))), files))
+        } else {
+            let (f, files) = dc.get_frame(k, virtual_id)?;
+            Some((FrameImage::Cpu(Arc::new(egui::ColorImage::from_rgba_premultiplied([f.width as usize, f.height as usize], &f.rgba))), files))
+        }
     }
 
-    fn finish_key(&self, key: FrameKey, urgent: bool, img: FrameImage, t0: web_time::Instant) {
+    /// Store a finished frame (with the source files it was made of, when known) and release its
+    /// job.
+    fn finish(&self, job: &Job, img: FrameImage, files: Option<Arc<ReadFiles>>, since: Option<DiskSince>, t0: web_time::Instant) {
+        self.finish_key(job.key, job.urgent, img, files, since, t0);
+    }
+
+    /// Stores a finished frame in the cache with its read files, records the render time for urgent jobs, then releases the job.
+    fn finish_key(&self, key: FrameKey, urgent: bool, img: FrameImage, files: Option<Arc<ReadFiles>>, since: Option<DiskSince>, t0: web_time::Instant) {
         if urgent && let Ok(mut l) = self.last.lock() {
             *l = t0.elapsed().as_secs_f64() * 1000.0;
         }
         if let Ok(mut c) = self.cache.lock()
             && (!img.is_gpu() || !self.gpu_retired.load(Ordering::Acquire))
         {
-            c.insert(key, img);
+            c.insert_with(key, img, files, since);
         }
         self.release(key, urgent);
     }
@@ -1212,42 +1789,78 @@ impl Worker {
     }
 
     /// [`Worker::render_job`], again on the CPU if it panicked (the panic hook has logged it);
-    /// `None` if that panicked too.
-    fn render_guarded(&self, job: &Job) -> Option<FrameImage> {
-        let attempt = |gpu: bool| std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.render_job(job, gpu))).ok();
-        attempt(true).or_else(|| {
+    /// `None` if that panicked too. With the source files the frame was made of.
+    fn render_guarded(&self, job: &Job) -> Option<(FrameImage, ReadFiles)> {
+        let attempt = |gpu: bool| {
+            let files = ReadLog::new();
+            let img = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.render_job(job, gpu, &files))).ok()?;
+            Some((img, files.into_files()))
+        };
+        let img = attempt(true).or_else(|| {
             log::error!("a frame render panicked (frame {})", job.key.frame);
             job.src.gpu.as_ref().and_then(|_| attempt(false))
-        })
+        });
+        // A preview frame is done: the GPU pool ages the sizes it did not ask for.
+        if let Some(g) = &job.src.gpu {
+            effectcraft_engine::render::Accelerator::frame_end(g);
+        }
+        img
     }
 
     /// A failed scoped attempt retries on CPU. Retired contexts cannot recover by reducing
     /// their budget; only a healthy device's allocation failure uses the upstream backoff.
-    fn gpu_attempt_failed(&self, gpu: &Gpu, e: &str) {
+    fn gpu_attempt_failed(&self, gpu: &Gpu, e: &FrameError) {
         if gpu.context().check_health().is_err() {
             log::warn!("the GPU context is retired ({e}); the frame renders on the CPU");
             return;
         }
+        // Not memory pressure: keeping fewer GPU frames wouldn't help (#1319).
+        if let FrameError::Validation(_) = e {
+            log::warn!("the GPU rejected the frame ({e}); it renders on the CPU, the next frame tries the GPU again");
+            return;
+        }
         log::warn!("the GPU ran out of memory ({e}); the frame renders on the CPU and fewer GPU frames are kept");
         if let Ok(mut c) = self.cache.lock() {
             c.gpu_out_of_memory();
         }
     }
 
-    /// The frame on the GPU, kept there for the viewer, if the compositor can do it alone.
-    fn render_gpu(&self, job: &Job) -> Option<FrameImage> {
-        if self.gpu_retired.load(Ordering::Acquire) {
+    /// Tells the cache that a GPU render succeeded.
+    fn gpu_succeeded(&self) {
+        if let Ok(mut c) = self.cache.lock() {
+            c.gpu_succeeded();
+        }
+    }
+
+    /// Whether GPU rendering is available and has not been retired.
+    fn gpu_ready(&self) -> bool {
+        !self.gpu_retired.load(Ordering::Acquire) && self.cache.lock().is_ok_and(|c| c.gpu_ready())
+    }
+
+    /// The frame on the GPU, kept there for the viewer, if the compositor can do it alone, with
+    /// the source files it was made of.
+    fn render_gpu(&self, job: &Job) -> Option<(FrameImage, ReadFiles)> {
+        if !self.gpu_ready() {
             return None;
         }
         let g = job.src.gpu.as_ref()?;
         let footage = job.footage();
+        let files = ReadLog::new();
         let mut r = Renderer::new(&job.src.project, &footage, job.opts);
         r.expr = job.src.expr.as_deref();
         r.cache = Some(&job.src.layer_cache);
+        r.reads = Some(&files);
         r.accel = Some(g as &dyn effectcraft_engine::render::Accelerator);
         r.active_accel()?;
-        match g.within_memory(|| g.render_display(&r, job.comp, job.t)) {
-            Ok(f) => f.map(|f| FrameImage::Gpu(Arc::new(f))),
+        let f = g.within_memory(|| g.render_display(&r, job.comp, job.t));
+        effectcraft_engine::render::Accelerator::frame_end(g);
+        match f {
+            Ok(f) => {
+                if f.is_some() {
+                    self.gpu_succeeded();
+                }
+                f.map(|f| (FrameImage::Gpu(Arc::new(f)), files.into_files()))
+            }
             Err(e) => {
                 self.gpu_attempt_failed(g, &e);
                 None
@@ -1255,12 +1868,14 @@ impl Worker {
         }
     }
 
-    /// Render a frame; `gpu: false` keeps it off the GPU compositor.
-    fn render_job(&self, job: &Job, gpu: bool) -> FrameImage {
+    /// Render a frame; `gpu: false` keeps it off the GPU compositor. The source files it reads
+    /// are noted in `files` (a GPU attempt that falls back to the CPU notes both renders').
+    fn render_job(&self, job: &Job, gpu: bool, files: &ReadLog) -> FrameImage {
         let footage = job.footage();
         let mut r = Renderer::new(&job.src.project, &footage, job.opts);
         r.expr = job.src.expr.as_deref();
-        let gpu_allowed = gpu && !self.gpu_retired.load(Ordering::Acquire);
+        r.reads = Some(files);
+        let gpu_allowed = gpu && self.gpu_ready();
         // A failed GPU attempt may have populated intermediate entries before its scope
         // reported failure. The CPU retry must compute its own pixels from the snapshot.
         r.cache = gpu_allowed.then_some(job.src.layer_cache.as_ref());
@@ -1280,11 +1895,12 @@ impl Worker {
                 let t0 = web_time::Instant::now();
                 match g.within_memory(|| g.render_display(&r, job.comp, job.t)) {
                     Ok(Some(f)) => {
+                        self.gpu_succeeded();
                         if let Some((p, key)) = auto {
                             // Time the GPU's work, not just its recording.
                             g.wait();
                             if g.context().check_health().is_err() {
-                                return self.render_job(job, false);
+                                return self.render_job(job, false, files);
                             }
                             p.record(key, true, t0.elapsed().as_secs_f64() * 1000.0);
                         }
@@ -1297,31 +1913,42 @@ impl Worker {
                     }
                     Err(e) => {
                         self.gpu_attempt_failed(g, &e);
-                        return self.render_job(job, false);
+                        return self.render_job(job, false, files);
                     }
                 }
             }
             let t0 = web_time::Instant::now();
-            let img = to_color_image(&r.comp_frame_cpu(job.comp, job.t));
+            let img = cpu_frame(&r.comp_frame_cpu(job.comp, job.t), &job.src.project, &job.opts);
             if let Some((p, key)) = auto {
                 p.record(key, false, t0.elapsed().as_secs_f64() * 1000.0);
             }
-            return FrameImage::Cpu(Arc::new(img));
+            return img;
         }
         if let Some(g) = gpu {
             // The GPU composites and the frame is read back.
             return match g.within_memory(|| r.comp_frame(job.comp, job.t)) {
-                Ok(img) => FrameImage::Cpu(Arc::new(to_color_image(&img))),
+                Ok(img) => {
+                    self.gpu_succeeded();
+                    cpu_frame(&img, &job.src.project, &job.opts)
+                }
                 Err(e) => {
                     self.gpu_attempt_failed(g, &e);
-                    self.render_job(job, false)
+                    self.render_job(job, false, files)
                 }
             };
         }
-        FrameImage::Cpu(Arc::new(to_color_image(&r.comp_frame(job.comp, job.t))))
+        cpu_frame(&r.comp_frame(job.comp, job.t), &job.src.project, &job.opts)
     }
 }
 
+/// Who asked for a frame (see [`Frames::request_with`]).
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Want {
+    Viewer,
+    Prefetch,
+    Background,
+}
+
 struct Job {
     key: FrameKey,
     src: RenderSource,
@@ -1329,6 +1956,8 @@ struct Job {
     t: Tick,
     opts: RenderOpts,
     urgent: bool,
+    /// Nobody waits for it (see [`Frames::request_background`]).
+    background: bool,
     seq: u64,
     /// Set when the viewer no longer waits for this frame (see [`Frames::request_urgent`]).
     cancel: Arc<AtomicBool>,
@@ -1351,18 +1980,117 @@ struct Queue {
     seq: u64,
     /// The playing preview, if any: its prefetch renders nearest first.
     playhead: Option<Playhead>,
+    /// How many lanes there are, and the ones not rendering. A lane is one thread that renders
+    /// one frame at a time. The frames of a playing preview and the frames nobody waits for
+    /// (Cache Frames When Idle) render on the lanes; the pool keeps the viewer's frame and the
+    /// few frames prefetched around it while paused. On the pool a frame's parallel work is
+    /// shared: a thread that took a piece of one frame and waited inside it started rendering
+    /// the queued frames on top, and went back to its piece only once the queue was empty. The
+    /// frames a preview started first, the ones right ahead of the playhead, were done last:
+    /// the preview stood still on a gap while the frames further ahead turned green. Idle
+    /// caching left the same gaps, and held up the viewer's frame when it shared a piece.
+    lanes: usize,
+    idle_lanes: Vec<usize>,
+    /// Lanes compositing a frame on the GPU, at most [`Queue::gpu_limit`]. The GPU is the
+    /// viewer's device: each lane records, submits and reads back a whole frame on it, and the
+    /// window can't draw until that work is done. With a lane per core on a GPU that can't keep
+    /// up, the window froze for hundreds of milliseconds at a time while a preview played, and
+    /// the preview jumped ahead when it came back (#3345). The other lanes go on with the frames
+    /// that don't need the GPU (the disk cache's, or all of them while the GPU is out of memory
+    /// or retired); the pool and the viewer's frame are not counted.
+    gpu_lanes: usize,
+    /// How many lanes may composite on the GPU at a time (at least 1, see [`Queue::ui_frame`]).
+    gpu_limit: usize,
+    /// The limit that last stalled the window: tried again only after [`GPU_LANE_RETRY`].
+    gpu_stalled_at: usize,
+    /// While a preview plays: the window's last frame, and since when it has been smooth.
+    ui_last: Option<web_time::Instant>,
+    ui_smooth_since: Option<web_time::Instant>,
+    /// Tests: as if there were a GPU compositor (no adapter is there).
+    #[cfg(test)]
+    fake_gpu: bool,
 }
 
 impl Queue {
+    /// Whether `j` renders on a lane (else on the pool).
+    fn on_lane(&self, j: &Job) -> bool {
+        self.lanes > 0 && !j.urgent && (j.background || self.playhead.is_some())
+    }
+
+    /// The job a lane (`lane`) or the pool renders next: the [`Queue::best`] of its own. `gpu`:
+    /// the GPU composites (a lane's frames), so a lane takes no GPU frame while
+    /// [`Queue::gpu_limit`] lanes are compositing.
+    fn next(&self, lane: bool, gpu: bool) -> Option<usize> {
+        let gpu_full = gpu && self.gpu_lanes >= self.gpu_limit.max(1);
+        self.best_of(|j| self.on_lane(j) == lane && !(gpu_full && self.gpu_job(j)))
+    }
+
+    /// The window drew a frame at `now` (`None`: no preview plays). A window that stalls with
+    /// lanes compositing gets fewer of them: the GPU can't keep up with them and the window. One
+    /// that stays smooth while every allowed lane composites gets one more, up to all of them: a
+    /// GPU that keeps up renders the preview on every lane. A limit that stalled is tried again
+    /// only after a longer smooth spell, so the window doesn't stall over and over. `true` when
+    /// one more lane may composite.
+    fn ui_frame(&mut self, now: Option<web_time::Instant>) -> bool {
+        let Some(now) = now else {
+            self.ui_last = None;
+            return false;
+        };
+        let limit = self.gpu_limit.max(1);
+        let gap = self.ui_last.map(|last| now.saturating_duration_since(last));
+        self.ui_last = Some(now);
+        let Some(gap) = gap else {
+            self.ui_smooth_since = Some(now);
+            return false;
+        };
+        if gap > UI_STALL && self.gpu_lanes > 0 {
+            self.gpu_stalled_at = limit;
+            self.gpu_limit = (limit / 2).max(1);
+            self.ui_smooth_since = Some(now);
+        } else if gap > UI_SMOOTH {
+            self.ui_smooth_since = Some(now);
+        } else {
+            let since = *self.ui_smooth_since.get_or_insert(now);
+            let wait = if limit + 1 >= self.gpu_stalled_at && self.gpu_stalled_at > 0 { GPU_LANE_RETRY } else { GPU_LANE_STEP };
+            if self.gpu_lanes >= limit && limit < self.lanes && now.saturating_duration_since(since) >= wait {
+                self.gpu_limit = limit + 1;
+                self.ui_smooth_since = Some(now);
+                return true;
+            }
+        }
+        false
+    }
+
+    /// Whether `j` is composited on the GPU when the GPU is ready: there is a GPU compositor and
+    /// the frame's renderer uses it (as `Renderer::active_accel` decides: Software Only keeps
+    /// every frame on the CPU).
+    fn gpu_job(&self, j: &Job) -> bool {
+        let adapter = j.src.gpu.is_some();
+        #[cfg(test)]
+        let adapter = adapter || self.fake_gpu;
+        adapter
+            && match j.opts.backend {
+                effectcraft_engine::render::Backend::Cpu => false,
+                effectcraft_engine::render::Backend::Gpu => true,
+                effectcraft_engine::render::Backend::Auto => j.src.project.settings.gpu_acceleration,
+            }
+    }
+
     /// The job that matters most: urgent first (newest), then, while a preview plays, the
     /// prefetch frame it reaches first, then prefetch in request order. In request order alone,
     /// frames asked for again after an eviction (the ones right ahead of the playhead) waited
     /// behind every frame further ahead (#595).
     fn best(&self) -> Option<usize> {
+        self.best_of(|_| true)
+    }
+
+    /// [`Queue::best`] among the jobs `of` accepts.
+    fn best_of(&self, of: impl Fn(&Job) -> bool) -> Option<usize> {
         let p = self.playhead.as_ref();
         self.jobs
             .iter()
             .enumerate()
+            .filter(|(_, j)| of(j))
             .max_by_key(|(_, j)| {
                 let near = if j.urgent { None } else { p.and_then(|p| p.ahead(&j.key)) };
                 (j.urgent, near.is_some(), near.map_or(0, |d| -d), if j.urgent { j.seq as i64 } else { -(j.seq as i64) })
@@ -1371,653 +2099,13 @@ impl Queue {
     }
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn disk_indicator_does_not_hash_on_ui_thread_and_coalesces_edits() {
-        use std::sync::mpsc;
-        use std::time::{Duration, Instant};
-        struct Disk(u128);
-        impl RemoteFrames for Disk {
-            fn slots(&self) -> usize {
-                1
-            }
-            fn disk(&self) -> bool {
-                true
-            }
-            fn disk_contains(&self, key: u128) -> bool {
-                self.0 == key
-            }
-            fn start(&self, _: RemoteJob, done: RemoteDone) {
-                done(Err("test has no renderer".into()));
-            }
-        }
-        let mut s = effectcraft_engine::Session::default();
-        s.execute("comp.new", serde_json::json!({"width":32,"height":18,"duration":1})).unwrap();
-        let cid = s.active_comp_id().unwrap();
-        let opts = RenderOpts::default();
-        let stored = disk_cache::frame_key(disk_cache::comp_content_key(&s.project, cid), 2, 1000, opts_hash(&opts));
-        let mut frames = Frames { pool: Some(rayon::ThreadPoolBuilder::new().num_threads(1).build().unwrap()), ..Default::default() };
-        frames.set_remote(Some(Arc::new(Disk(stored))));
-        let (entered, started) = mpsc::channel();
-        let (release, wait) = mpsc::channel();
-        frames.pool.as_ref().unwrap().spawn(move || {
-            entered.send(()).unwrap();
-            wait.recv_timeout(Duration::from_secs(5)).unwrap();
-        });
-        started.recv_timeout(Duration::from_secs(3)).unwrap();
-        let src = RenderSource {
-            project: s.project.clone(),
-            footage: s.footage.clone(),
-            expr: None,
-            layer_cache: Arc::default(),
-            gpu: None,
-            gpu_display: false,
-            disk: None,
-        };
-        let mut base = key(1, 0, 0);
-        base.comp = cid.0;
-        for revision in 1..50 {
-            base.revision = revision;
-            assert!(frames.disk_frames(&src, &base, 30, &opts).is_empty());
-        }
-        assert!(frames.content_keys.lock().unwrap().is_empty(), "painting computed a content hash while the worker was blocked");
-        assert_eq!(frames.content_key_jobs.lock().unwrap().pending.len(), 1);
-        release.send(()).unwrap();
-        let until = Instant::now() + Duration::from_secs(3);
-        while !frames.content_keys.lock().unwrap().contains_key(&(base.revision, base.comp)) {
-            assert!(Instant::now() < until);
-            std::thread::sleep(Duration::from_millis(1));
-        }
-        assert_eq!(frames.disk_frames(&src, &base, 30, &opts), vec![2], "the blue indicator must return once its key is ready");
-        assert_eq!(frames.content_keys.lock().unwrap().len(), 1, "superseded revisions were hashed");
-    }
-
-    /// Frames larger than the texture limit are averaged down by a whole factor (#201: an
-    /// 11000×2200 comp at Full resolution against an 8192 limit).
-    #[test]
-    fn frames_over_the_texture_limit_are_averaged_down() {
-        assert_eq!(fitted_size([11000, 2200], 8192), [5500, 1100]);
-        assert_eq!(fitted_size([8192, 100], 8192), [8192, 100]);
-        assert_eq!(fitted_size([30000, 30000], 16384), [15000, 15000]);
-        assert_eq!(fitted_size([0, 0], 0), [0, 0]);
-        // 5×2 (three columns of white, then black) into 2 px: 3×2 blocks (the last one 2×2).
-        let w = egui::Color32::WHITE;
-        let b = egui::Color32::from_rgba_premultiplied(0, 0, 0, 255);
-        let img = egui::ColorImage::new([5, 2], vec![w, w, w, b, b, w, w, w, b, b]);
-        let out = fit_texture(img.clone(), 2);
-        assert_eq!(out.size, [2, 1]);
-        assert_eq!(out.pixels, vec![w, b]);
-        assert_eq!(fit_texture(img.clone(), 5).pixels, img.pixels);
-        let mixed = fit_texture(egui::ColorImage::new([2, 1], vec![w, b]), 1);
-        assert_eq!(mixed.pixels, vec![egui::Color32::from_rgba_premultiplied(128, 128, 128, 255)]);
-    }
-
-    #[test]
-    fn retirement_reaches_existing_workers_and_keeps_cpu_frames_and_completion_live() {
-        let frames = Frames::default();
-        let worker = frames.worker();
-        let first = key(1, 0, 0);
-        insert(&frames, first);
-        frames.retire_gpu();
-        assert!(worker.gpu_retired.load(Ordering::Acquire), "already queued workers share retirement");
-        assert!(frames.is_cached(&first), "healthy materialized CPU frames survive");
-        let next = key(1, 1, 0);
-        frames.inflight.lock().unwrap().insert(next);
-        frames.queue.lock().unwrap().running.insert(next);
-        worker.finish_key(next, false, img(), web_time::Instant::now());
-        assert!(frames.is_cached(&next), "CPU retry can still publish");
-        assert_eq!(frames.inflight(), 0);
-        assert!(frames.queue.lock().unwrap().running.is_empty());
-    }
-
-    fn key(content: u64, frame: i64, opts: u64) -> FrameKey {
-        FrameKey { revision: content, content, comp: 1, frame, scale: 1000, view: 0, opts }
-    }
-
-    fn img() -> FrameImage {
-        FrameImage::Cpu(Arc::new(egui::ColorImage::new([2, 2], vec![egui::Color32::BLACK; 4])))
-    }
-
-    fn insert(f: &Frames, k: FrameKey) {
-        f.cache.lock().unwrap().insert(k, img());
-    }
-
-    /// A frame whose render panics (a GPU out of memory used to, on every frame thread) is
-    /// released, not left "in progress" forever, so the viewer can ask for it again (#106).
-    #[test]
-    fn a_frame_whose_render_panics_is_released() {
-        use effectcraft_engine::Session;
-        use effectcraft_engine::project::{Footage, FootageKind};
-        use effectcraft_engine::render::Image;
-        use serde_json::json;
-        use std::sync::atomic::{AtomicUsize, Ordering};
-        #[derive(Default)]
-        struct Explodes(AtomicUsize);
-        impl FootageSource for Explodes {
-            fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
-                self.0.fetch_add(1, Ordering::SeqCst);
-                panic!("a decoder bug");
-            }
-        }
-        let mut s = Session::default();
-        let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
-        let clip = Footage { kind: FootageKind::Still, width: 8, height: 8, has_video: true, ..Default::default() };
-        let item = Arc::make_mut(&mut s.project).add_item("clip.png", Default::default(), None, ItemKind::Footage(clip));
-        s.execute("layer.addItem", json!({"item": item.0})).unwrap();
-        let footage = Arc::new(Explodes::default());
-        let src = RenderSource {
-            project: s.project.clone(),
-            footage: footage.clone(),
-            expr: None,
-            layer_cache: Arc::default(),
-            gpu: None,
-            gpu_display: false,
-            disk: None,
-        };
-        let f = Frames::default();
-        let key = FrameKey { revision: s.revision, content: f.content_of(&s.project, s.revision, cid), ..key(0, 0, 0) };
-        let key = FrameKey { comp: cid.0, ..key };
-        f.request(&src, key, cid, Tick::ZERO, RenderOpts::default());
-        for _ in 0..1000 {
-            if f.inflight() == 0 {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert!(footage.0.load(Ordering::SeqCst) > 0, "the render reached the footage");
-        assert_eq!(f.inflight(), 0, "released");
-        assert!(!f.is_cached(&key));
-    }
-
-    /// #647: a pool thread waiting inside a render (on a parallel loop) never starts another
-    /// frame render on top of it. Dragging a layer queues a frame every UI frame; renders used to
-    /// nest on every thread, each holding its buffers, until memory ran out.
-    #[test]
-    fn a_waiting_render_never_starts_another_on_its_thread() {
-        use effectcraft_engine::Session;
-        use effectcraft_engine::project::{Footage, FootageKind};
-        use effectcraft_engine::render::Image;
-        use effectcraft_engine::time::FrameRate;
-        use serde_json::json;
-        use std::cell::Cell;
-        use std::sync::atomic::AtomicUsize;
-        thread_local! {
-            static DEPTH: Cell<usize> = const { Cell::new(0) };
-        }
-        /// A decoder that works in parallel, as the renderer does: its thread joins the loop and
-        /// may wait for the parts other threads took.
-        #[derive(Default)]
-        struct Parallel {
-            calls: AtomicUsize,
-            deepest: AtomicUsize,
-        }
-        impl FootageSource for Parallel {
-            fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
-                let d = DEPTH.get() + 1;
-                DEPTH.set(d);
-                self.deepest.fetch_max(d, Ordering::SeqCst);
-                self.calls.fetch_add(1, Ordering::SeqCst);
-                (0..64).into_par_iter().for_each(|_| std::thread::sleep(std::time::Duration::from_millis(1)));
-                DEPTH.set(d - 1);
-                Some(Arc::new(Image::new(4, 4)))
-            }
-        }
-        let mut s = Session::default();
-        let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 10})).unwrap()["comp"].as_u64().unwrap());
-        let clip = Footage {
-            kind: FootageKind::Video,
-            width: 4,
-            height: 4,
-            has_video: true,
-            frame_rate: FrameRate::FPS_30,
-            duration: Tick::from_seconds_f64(10.0),
-            ..Default::default()
-        };
-        let item = Arc::make_mut(&mut s.project).add_item("clip.mov", Default::default(), None, ItemKind::Footage(clip));
-        s.execute("layer.addItem", json!({"item": item.0})).unwrap();
-        let footage = Arc::new(Parallel::default());
-        let src = RenderSource {
-            project: s.project.clone(),
-            footage: footage.clone(),
-            expr: None,
-            layer_cache: Arc::default(),
-            gpu: None,
-            gpu_display: false,
-            disk: None,
-        };
-        let f = Frames::default();
-        let content = f.content_of(&s.project, s.revision, cid);
-        let frames = 60;
-        for frame in 0..frames {
-            let key = FrameKey { revision: s.revision, content, comp: cid.0, frame, scale: 1000, view: 0, opts: 0 };
-            f.request(&src, key, cid, FrameRate::FPS_30.tick_of(frame), RenderOpts::default());
-        }
-        for _ in 0..4000 {
-            if f.inflight() == 0 {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert_eq!(f.inflight(), 0, "every queued frame rendered");
-        assert!(footage.calls.load(Ordering::SeqCst) >= frames as usize);
-        assert_eq!(footage.deepest.load(Ordering::SeqCst), 1, "renders nested on a waiting thread");
-    }
-
-    /// #329: scrubbing a long movie, the viewer frame of every step the pointer passed started
-    /// rendering and seeked the movie's decoder in turn; the frame under the pointer waited for
-    /// all of them. A newer viewer frame of another time calls off the one rendering, which is
-    /// not cached (its footage may be missing).
-    #[test]
-    fn a_newer_viewer_frame_calls_off_the_one_rendering() {
-        use effectcraft_engine::Session;
-        use effectcraft_engine::project::{Footage, FootageKind};
-        use effectcraft_engine::render::Image;
-        use effectcraft_engine::time::FrameRate;
-        use serde_json::json;
-        use std::cell::RefCell;
-        thread_local! {
-            static CANCEL: RefCell<Option<Arc<AtomicBool>>> = const { RefCell::new(None) };
-        }
-        /// A movie whose first frames take a long seek, which a called-off read gives up.
-        #[derive(Default)]
-        struct Seeking {
-            seeking: AtomicBool,
-            called_off: AtomicBool,
-        }
-        impl FootageSource for Seeking {
-            fn cancellable(&self, cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
-                let prev = CANCEL.replace(Some(cancel.clone()));
-                f();
-                CANCEL.set(prev);
-            }
-            fn frame(&self, _: ItemId, _: &Footage, t: Tick) -> Option<Arc<Image>> {
-                if t < Tick::from_seconds_f64(0.25) {
-                    self.seeking.store(true, Ordering::SeqCst);
-                    for _ in 0..1000 {
-                        if CANCEL.with_borrow(|c| c.as_ref().is_some_and(|c| c.load(Ordering::SeqCst))) {
-                            self.called_off.store(true, Ordering::SeqCst);
-                            return None;
-                        }
-                        std::thread::sleep(std::time::Duration::from_millis(5));
-                    }
-                }
-                Some(Arc::new(Image::new(4, 4)))
-            }
-        }
-        let mut s = Session::default();
-        let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 10})).unwrap()["comp"].as_u64().unwrap());
-        let clip = Footage {
-            kind: FootageKind::Video,
-            width: 4,
-            height: 4,
-            has_video: true,
-            frame_rate: FrameRate::FPS_30,
-            duration: Tick::from_seconds_f64(10.0),
-            ..Default::default()
-        };
-        let item = Arc::make_mut(&mut s.project).add_item("clip.mov", Default::default(), None, ItemKind::Footage(clip));
-        s.execute("layer.addItem", json!({"item": item.0})).unwrap();
-        let footage = Arc::new(Seeking::default());
-        let src = RenderSource {
-            project: s.project.clone(),
-            footage: footage.clone(),
-            expr: None,
-            layer_cache: Arc::default(),
-            gpu: None,
-            gpu_display: false,
-            disk: None,
-        };
-        let f = Frames::default();
-        let content = f.content_of(&s.project, s.revision, cid);
-        let key = |frame| FrameKey { revision: s.revision, content, comp: cid.0, frame, scale: 1000, view: 0, opts: 0 };
-        f.request_urgent(&src, key(0), cid, Tick::ZERO, RenderOpts::default());
-        for _ in 0..1000 {
-            if footage.seeking.load(Ordering::SeqCst) {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(2));
-        }
-        assert!(footage.seeking.load(Ordering::SeqCst), "the first frame's render reached the footage");
-        f.request_urgent(&src, key(150), cid, FrameRate::FPS_30.tick_of(150), RenderOpts::default());
-        for _ in 0..1000 {
-            if f.inflight() == 0 {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert!(footage.called_off.load(Ordering::SeqCst), "the superseded frame's seek ran on");
-        assert!(f.is_cached(&key(150)), "the newest frame rendered");
-        assert!(!f.is_cached(&key(0)), "a called-off frame is not cached");
-        assert_eq!(f.inflight(), 0, "released");
-    }
-
-    /// #284: scrubbing asks for a viewer frame at every step; a newer one drops the comp's viewer
-    /// frames still waiting (they would all render first), but not prefetch frames or another
-    /// comp's viewer frame.
-    #[test]
-    fn a_newer_viewer_frame_drops_the_ones_still_waiting() {
-        /// Starts nothing, so every request stays queued.
-        struct Idle;
-        impl RemoteFrames for Idle {
-            fn slots(&self) -> usize {
-                0
-            }
-            fn start(&self, _: RemoteJob, _: RemoteDone) {}
-        }
-        let mut f = Frames::default();
-        f.set_remote(Some(Arc::new(Idle)));
-        let src = RenderSource {
-            project: Arc::default(),
-            footage: Arc::new(effectcraft_engine::render::NoFootage),
-            expr: None,
-            layer_cache: Arc::default(),
-            gpu: None,
-            gpu_display: false,
-            disk: None,
-        };
-        let request = |k: FrameKey, urgent: bool| f.request_with(&src, k, ItemId(k.comp), Tick::ZERO, RenderOpts::default(), urgent);
-        let other = FrameKey { comp: 2, ..key(1, 0, 0) };
-        request(other, true);
-        request(key(1, 20, 0), false);
-        for frame in 0..10 {
-            request(key(1, frame, 0), true);
-        }
-        let mut queued: Vec<(u64, i64, bool)> = f.queue.lock().unwrap().jobs.iter().map(|j| (j.key.comp, j.key.frame, j.urgent)).collect();
-        queued.sort();
-        assert_eq!(queued, [(1, 9, true), (1, 20, false), (2, 0, false)]);
-        assert_eq!(f.inflight(), 3, "dropped frames aren't in flight: the viewer can ask again");
-    }
-
-    /// Each time the GPU runs out of memory, half as many GPU frames are kept, down to a floor.
-    #[test]
-    fn running_out_of_video_memory_halves_the_gpu_frame_budget() {
-        let f = Frames::default();
-        let mut c = f.cache.lock().unwrap();
-        assert_eq!(c.gpu_budget, GPU_BUDGET);
-        c.gpu_out_of_memory();
-        assert_eq!(c.gpu_budget, GPU_BUDGET / 2);
-        for _ in 0..20 {
-            c.gpu_out_of_memory();
-        }
-        assert_eq!(c.gpu_budget, MIN_GPU_BUDGET);
-    }
-
-    #[test]
-    fn least_recently_shown_frames_go_first() {
-        let f = Frames::default();
-        f.set_budget(3 * 16);
-        for i in 0..3 {
-            insert(&f, key(1, i, 0));
-        }
-        // Frame 0 is shown again, so frame 1 is now the oldest.
-        assert!(f.get(&key(1, 0, 0)).is_some());
-        insert(&f, key(1, 3, 0));
-        assert!(f.is_cached(&key(1, 0, 0)) && !f.is_cached(&key(1, 1, 0)));
-        assert!(f.is_cached(&key(1, 2, 0)) && f.is_cached(&key(1, 3, 0)));
-    }
-
-    fn playhead(cur: i64, looping: bool) -> Playhead {
-        Playhead { series: key(1, 0, 0), cur, start: 0, end: 99, step: 1, looping }
-    }
-
-    /// #595: a playing preview's cache is full. The frames just ahead of the playhead were
-    /// rendered before the ones just shown, so plain LRU evicted them first and the preview
-    /// played into a gap. Frames the preview no longer reaches go first, then the ones it
-    /// reaches last.
-    #[test]
-    fn a_full_cache_keeps_the_frames_just_ahead_of_the_playhead() {
-        let f = Frames::default();
-        f.set_budget(4 * 16);
-        // Prefetch rendered 11..=13, then 10 was shown (the most recently used).
-        for i in [11, 12, 13, 10] {
-            insert(&f, key(1, i, 0));
-        }
-        let cached = |f: &Frames| f.cached_frames(&key(1, 0, 0));
-        f.set_playhead(Some(playhead(10, false)));
-        // The next frame rendered is the one the preview reaches last: the frames just ahead stay.
-        insert(&f, key(1, 14, 0));
-        assert_eq!(cached(&f), [10, 11, 12, 13]);
-        // Without looping, a frame behind the playhead goes before any frame ahead of it.
-        f.set_playhead(Some(playhead(12, false)));
-        insert(&f, key(1, 14, 0));
-        assert_eq!(cached(&f), [10, 12, 13, 14]);
-        // Looping, the frame just behind is the one reached last.
-        f.set_playhead(Some(playhead(13, true)));
-        insert(&f, key(1, 0, 0));
-        assert_eq!(cached(&f), [0, 10, 13, 14]);
-        // Stopped: least recently shown first again.
-        f.set_playhead(None);
-        insert(&f, key(1, 50, 0));
-        assert!(!f.is_cached(&key(1, 13, 0)) && f.is_cached(&key(1, 50, 0)));
-    }
-
-    /// #595: prefetch renders the frames the preview reaches first, whatever order they were
-    /// asked for in (a frame evicted and asked for again waited behind every frame further
-    /// ahead); queued frames the preview no longer reaches are dropped and not left in flight.
-    #[test]
-    fn prefetch_renders_the_frames_the_playhead_reaches_first() {
-        struct Idle;
-        impl RemoteFrames for Idle {
-            fn slots(&self) -> usize {
-                0
-            }
-            fn start(&self, _: RemoteJob, _: RemoteDone) {}
-        }
-        let mut f = Frames::default();
-        f.set_remote(Some(Arc::new(Idle)));
-        let src = RenderSource {
-            project: Arc::default(),
-            footage: Arc::new(effectcraft_engine::render::NoFootage),
-            expr: None,
-            layer_cache: Arc::default(),
-            gpu: None,
-            gpu_display: false,
-            disk: None,
-        };
-        for frame in [40, 30, 20, 5, 12, 11] {
-            f.request(&src, key(1, frame, 0), ItemId(1), Tick::ZERO, RenderOpts::default());
-        }
-        f.request(&src, FrameKey { comp: 2, ..key(1, 1, 0) }, ItemId(2), Tick::ZERO, RenderOpts::default());
-        f.set_playhead(Some(playhead(10, false)));
-        let mut order = vec![];
-        loop {
-            let mut q = f.queue.lock().unwrap();
-            let Some(i) = q.best() else { break };
-            let j = q.jobs.swap_remove(i);
-            order.push((j.key.comp, j.key.frame));
-        }
-        assert_eq!(order, [(1, 11), (1, 12), (1, 20), (1, 30), (1, 40), (2, 1)]);
-        assert_eq!(f.inflight(), 6, "frame 5, behind the playhead, is no longer in flight");
-    }
-
-    #[test]
-    fn frames_are_keyed_by_content_and_series_are_kept_apart() {
-        let f = Frames::default();
-        insert(&f, key(1, 0, 0));
-        insert(&f, key(2, 0, 0));
-        insert(&f, key(2, 1, 7));
-        // Other content or render options (Draft, shadows…) are another series.
-        assert_eq!(f.cached_frames(&key(2, 0, 0)), vec![0]);
-        assert_eq!(f.cached_frames(&key(2, 0, 7)), vec![1]);
-        // A later revision with the same content finds the frame (an edit elsewhere, an undo).
-        assert!(f.is_cached(&FrameKey { revision: 99, ..key(1, 0, 0) }));
-        assert!(!f.is_cached(&key(3, 0, 0)));
-    }
-
-    #[test]
-    fn live_edits_present_the_newest_completed_revision_without_going_backwards() {
-        let f = Frames::default();
-        let shown = key(1, 0, 0);
-        let newest = key(3, 0, 0);
-        let wanted = key(5, 0, 0);
-        insert(&f, shown);
-        insert(&f, newest);
-        insert(&f, key(2, 0, 0)); // Older worker finishes after the newer one.
-        let displayed = f.get_for_viewer(&wanted, Some(&shown)).unwrap().0;
-        assert_eq!(displayed, newest);
-        assert!(f.get_for_viewer(&wanted, Some(&displayed)).is_none(), "never replay an older completion");
-        insert(&f, wanted);
-        assert_eq!(f.get_for_viewer(&wanted, Some(&displayed)).unwrap().0, wanted, "settle on the exact final edit");
-        // Undo reuses the content of an earlier revision immediately.
-        let undo = FrameKey { revision: 6, ..shown };
-        let reused = f.get_for_viewer(&undo, Some(&wanted)).unwrap().0;
-        assert_eq!(reused.content, shown.content);
-        assert_eq!(reused.revision, undo.revision);
-    }
-
-    #[test]
-    fn live_edits_do_not_substitute_other_times_views_or_render_settings() {
-        let f = Frames::default();
-        let shown = key(1, 0, 0);
-        let wanted = key(3, 0, 0);
-        let done = key(2, 0, 0);
-        for mismatch in [
-            FrameKey { comp: 9, ..done },
-            FrameKey { frame: 1, ..done },
-            FrameKey { scale: 500, ..done },
-            FrameKey { view: 1, ..done },
-            FrameKey { opts: 1, ..done },
-            FrameKey { revision: 4, ..done },
-        ] {
-            f.clear();
-            insert(&f, mismatch);
-            assert!(f.get_for_viewer(&wanted, Some(&shown)).is_none(), "wrong candidate: {mismatch:?}");
-        }
-        f.clear();
-        insert(&f, done);
-        assert!(f.get_for_viewer(&wanted, None).is_none(), "no stale content on opening a viewer");
-        assert!(f.get_for_viewer(&wanted, Some(&FrameKey { comp: 9, ..shown })).is_none());
-        assert!(f.get_for_viewer(&wanted, Some(&FrameKey { frame: 1, ..shown })).is_none());
-        assert!(f.get_for_viewer(&wanted, Some(&FrameKey { view: 1, ..shown })).is_none());
-    }
-
-    #[test]
-    fn an_edit_keeps_the_frames_of_comps_it_does_not_touch() {
-        use effectcraft_engine::Session;
-        use serde_json::json;
-        let mut s = Session::default();
-        let a = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
-        let b = ItemId(s.execute("comp.new", json!({"name": "B", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
-        let f = Frames::default();
-        let at = |s: &Session, c: ItemId| f.content_of(&s.project, s.revision, c);
-        let (a0, b0) = (at(&s, a), at(&s, b));
-        // Edit B: A's content (and frames) stay, B's change.
-        s.execute("layer.newSolid", json!({"comp": b.0, "color": "#ff0000"})).unwrap();
-        assert_eq!(at(&s, a), a0);
-        assert_ne!(at(&s, b), b0);
-        // Undo: B is back to the content its old frames were rendered for.
-        s.execute("edit.undo", json!({})).unwrap();
-        assert_eq!(at(&s, b), b0);
-    }
-
-    #[test]
-    fn a_long_drag_keeps_a_bounded_number_of_states() {
-        use effectcraft_engine::Session;
-        use serde_json::json;
-        let mut s = Session::default();
-        let a = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
-        let f = Frames::default();
-        let mut last = None;
-        for i in 0..200 {
-            s.execute("comp.settings", json!({"width": 8 + i, "merge": "drag"})).unwrap();
-            let k = FrameKey { content: f.content_of(&s.project, s.revision, a), ..key(0, 0, 0) };
-            insert(&f, k);
-            last = Some(k);
-        }
-        // The snapshots and the frames kept stay bounded (a dropped identity's frames go with it,
-        // so a later state that reuses its addresses can't be shown an old frame).
-        assert!(f.keepers.lock().unwrap().1.len() <= MAX_KEEPERS);
-        assert!(f.cache.lock().unwrap().map.len() <= MAX_KEEPERS);
-        assert!(f.is_cached(&last.unwrap()), "the current state's frame stays");
-    }
-
-    #[test]
-    fn an_identity_keeps_its_comps_so_an_edit_in_place_still_changes_it() {
-        use effectcraft_engine::Session;
-        use serde_json::json;
-        let mut s = Session::default();
-        let a = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
-        // A project nothing else holds (no undo history): make_mut would edit the comp in place,
-        // at the same address, if the identity hadn't kept a snapshot holding it.
-        let mut p = Arc::new((*s.project).clone());
-        drop(s);
-        let f = Frames::default();
-        let before = f.content_of(&p, 1, a);
-        let comp = Arc::make_mut(&mut p).comp_mut(a).unwrap();
-        comp.width = 16;
-        assert_ne!(f.content_of(&p, 2, a), before);
-    }
-
-    /// Audio, Lock and Shy (and Hide Shy Layers) don't change pixels: toggling them, in the comp
-    /// or a comp it nests, keeps its frames, also when toggled back (#103).
-    #[test]
-    fn audio_lock_and_shy_switches_keep_the_frames() {
-        use effectcraft_engine::Session;
-        use serde_json::json;
-        let mut s = Session::default();
-        let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
-        let inner = ItemId(id(s.execute("comp.new", json!({"name": "Inner", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
-        let solid = id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": "#ff0000"})).unwrap(), "layer");
-        let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
-        let nested = id(s.execute("layer.addItem", json!({"comp": outer.0, "item": inner.0})).unwrap(), "layer");
-        let f = Frames::default();
-        let at = |s: &Session| f.content_of(&s.project, s.revision, outer);
-        let o0 = at(&s);
-        let switch = |s: &mut Session, comp: ItemId, layer: u64, sw: &str, v: bool| {
-            s.execute("layer.setSwitch", json!({"comp": comp.0, "layers": [layer], "switch": sw, "value": v})).unwrap();
-        };
-        for (comp, layer, sw) in [(outer, nested, "audio"), (outer, nested, "lock"), (outer, nested, "shy"), (inner, solid, "audio"), (inner, solid, "shy")] {
-            // Audio off; Lock and Shy on.
-            switch(&mut s, comp, layer, sw, sw != "audio");
-            assert_eq!(at(&s), o0, "{sw} on in {comp:?}");
-        }
-        s.execute("comp.setSwitch", json!({"comp": outer.0, "switch": "hideShy", "value": true})).unwrap();
-        assert_eq!(at(&s), o0, "Hide Shy Layers");
-        switch(&mut s, outer, nested, "audio", true);
-        switch(&mut s, outer, nested, "lock", false);
-        assert_eq!(at(&s), o0, "toggled back");
-        // Switches that change pixels still do.
-        switch(&mut s, inner, solid, "video", false);
-        let o1 = at(&s);
-        assert_ne!(o1, o0, "Video");
-        switch(&mut s, outer, nested, "audio", false);
-        assert_eq!(at(&s), o1, "a mute after a real edit keeps that edit's frames");
-        switch(&mut s, inner, solid, "video", true);
-        assert_ne!(at(&s), o1);
-    }
-
-    #[test]
-    fn markers_keep_the_frames() {
-        use effectcraft_engine::Session;
-        use serde_json::json;
-        let mut s = Session::default();
-        let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
-        let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
-        let solid = id(s.execute("layer.newSolid", json!({"comp": outer.0, "color": "#ff0000"})).unwrap(), "layer");
-        let f = Frames::default();
-        let at = |s: &Session| f.content_of(&s.project, s.revision, outer);
-        let o0 = at(&s);
-        s.execute("layer.addMarker", json!({"comp": outer.0, "layers": [solid], "time": 0.5, "comment": "beat"})).unwrap();
-        assert_eq!(at(&s), o0, "a marker changes no pixels, so it keeps the frames");
-    }
-
-    #[test]
-    fn markers_count_when_an_expression_can_read_them() {
-        use effectcraft_engine::Session;
-        use serde_json::json;
-        let mut s = Session::default();
-        let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
-        let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
-        let solid = id(s.execute("layer.newSolid", json!({"comp": outer.0, "color": "#ff0000"})).unwrap(), "layer");
-        s.execute("prop.setExpression", json!({"comp": outer.0, "layer": solid, "path": "transform/opacity", "expression": "1"})).unwrap();
-        let f = Frames::default();
-        let at = |s: &Session| f.content_of(&s.project, s.revision, outer);
-        let o0 = at(&s);
-        s.execute("layer.addMarker", json!({"comp": outer.0, "layers": [solid], "time": 0.5, "comment": "beat"})).unwrap();
-        assert_ne!(at(&s), o0, "an expression can read the marker, so the frames change");
-    }
+/// The render scale a viewer frame's key stands for: it keeps thousandths, but the viewer
+/// renders every n-th pixel, and 0.333 is not 1/3 (2 pixels off by row 1000 at Third). The
+/// comp's own factor decides when two factors share the thousandths (from 1/34).
+pub(crate) fn render_scale(thousandths: u32, factor: Option<u8>) -> f64 {
+    let n = factor.map(f64::from).filter(|n| (1000.0 / n).round() == f64::from(thousandths));
+    1.0 / n.unwrap_or_else(|| (1000.0 / f64::from(thousandths.max(1))).round()).max(1.0)
 }
+
+#[cfg(test)]
+pub(crate) mod tests;
diff --git a/crates/ui-egui/src/frames/f16.rs b/crates/ui-egui/src/frames/f16.rs
new file mode 100644
index 000000000..5d00f0ca6
--- /dev/null
+++ b/crates/ui-egui/src/frames/f16.rs
@@ -0,0 +1,91 @@
+//! Half-float viewer frames (32 bpc projects on the desktop, #2797): the RAM preview keeps the
+//! rendered frame's full range, without the HDR step, so viewer exposure, Compand / Tone Map and
+//! the display colour run on it in the display pass (`crate::display_gpu`), in that order.
+
+use effectcraft_engine::render::Image;
+use effectcraft_engine::viewer::{DisplayPass, FrameEncoding};
+use half::f16;
+use half::slice::{HalfBitsSliceExt, HalfFloatSliceExt};
+use rayon::prelude::*;
+
+/// Values converted per piece: 16 KB of input, so the piece stays in L1 while its non-finite
+/// values are fixed up.
+const BLOCK: usize = 4096;
+
+/// A premultiplied RGBA frame in half floats, encoded in the output space as rendered (values
+/// above 1.0 kept), with how it is encoded. Never NaN or infinite (see [`F16Frame::from_image`]):
+/// the display pass relies on it.
+pub struct F16Frame {
+    pub width: u32,
+    pub height: u32,
+    /// RGBA, row by row, as IEEE binary16 bits.
+    data: Vec<u16>,
+    pub encoding: FrameEncoding,
+}
+
+/// Bytes per pixel of a half-float frame.
+pub const F16_PIXEL_BYTES: usize = 8;
+
+/// Half floats that are NaN become 0, infinities ±65504 (one pass, no branches on the data).
+fn finite(bits: &mut [u16]) {
+    for b in bits {
+        let v = *b;
+        let special = v & 0x7c00 == 0x7c00;
+        let fixed = if v & 0x03ff != 0 { 0 } else { (v & 0x8000) | 0x7bff };
+        *b = if special { fixed } else { v };
+    }
+}
+
+impl F16Frame {
+    /// A rendered frame in half floats. NaN becomes 0 (NaN alpha is transparent, as in
+    /// `display_pixel`) and values past the half-float range become ±65504.
+    pub fn from_image(img: &Image, encoding: FrameEncoding) -> F16Frame {
+        let src = img.data.as_flattened();
+        // A zeroed allocation: fresh pages from the OS, no fill pass.
+        let mut data = vec![0u16; src.len()];
+        data.par_chunks_mut(BLOCK).zip(src.par_chunks(BLOCK)).for_each(|(out, inp)| {
+            out.reinterpret_cast_mut::<f16>().convert_from_f32_slice(inp);
+            finite(out);
+        });
+        F16Frame { width: img.width, height: img.height, data, encoding }
+    }
+
+    /// A frame from binary16 bits (the disk cache), made finite as [`F16Frame::from_image`] does.
+    pub fn from_bits(width: u32, height: u32, mut data: Vec<u16>, encoding: FrameEncoding) -> F16Frame {
+        data.resize(width as usize * height as usize * 4, 0);
+        data.par_chunks_mut(BLOCK).for_each(finite);
+        F16Frame { width, height, data, encoding }
+    }
+
+    /// The pixels as binary16 bits (RGBA, row by row).
+    pub fn bits(&self) -> &[u16] {
+        &self.data
+    }
+
+    pub fn size(&self) -> [usize; 2] {
+        [self.width as usize, self.height as usize]
+    }
+
+    pub fn bytes(&self) -> usize {
+        self.data.len() * 2
+    }
+
+    /// Pixel `i` (row-major) as `f32`.
+    pub fn pixel(&self, i: usize) -> Option<[f32; 4]> {
+        let p = self.data.get(i.checked_mul(4)?..i * 4 + 4)?;
+        Some([0, 1, 2, 3].map(|k| f16::from_bits(p[k]).to_f32()))
+    }
+
+    /// The frame through `pass` on the CPU (no GPU, or a single sample).
+    pub fn to_color_image(&self, pass: &DisplayPass) -> egui::ColorImage {
+        let px: Vec<egui::Color32> = self
+            .data
+            .par_chunks(4)
+            .map(|p| {
+                let [r, g, b, a] = pass.pixel([0, 1, 2, 3].map(|k| f16::from_bits(p[k]).to_f32()));
+                egui::Color32::from_rgba_premultiplied(r, g, b, a)
+            })
+            .collect();
+        egui::ColorImage::new(self.size(), px)
+    }
+}
diff --git a/crates/ui-egui/src/frames/tests.rs b/crates/ui-egui/src/frames/tests.rs
new file mode 100644
index 000000000..d980f8565
--- /dev/null
+++ b/crates/ui-egui/src/frames/tests.rs
@@ -0,0 +1,3125 @@
+use super::*;
+use effectcraft_engine::project::LayerSource;
+
+#[test]
+fn render_scales_are_the_factors_the_thousandths_stand_for() {
+    assert_eq!(render_scale(333, Some(3)), 1.0 / 3.0);
+    assert_eq!(render_scale(333, None), 1.0 / 3.0);
+    assert_eq!(render_scale(167, Some(6)), 1.0 / 6.0);
+    assert_eq!((render_scale(1000, None), render_scale(500, None), render_scale(250, Some(4))), (1.0, 0.5, 0.25));
+    // 1/34 and 1/35 are both 29 thousandths: the comp's factor decides.
+    assert_eq!((render_scale(29, Some(35)), render_scale(29, Some(34))), (1.0 / 35.0, 1.0 / 34.0));
+    assert_eq!(render_scale(29, Some(2)), 1.0 / 34.0);
+}
+
+#[test]
+fn converting_a_frame_with_nan_alpha_keeps_the_viewer_alive() {
+    let image = effectcraft_engine::render::Image::filled(1, 1, [0.5, 0.25, 0.1, f32::NAN]);
+    assert_eq!(to_color_image(&image).pixels, [egui::Color32::TRANSPARENT]);
+}
+
+/// Frames without the HDR step (`RenderOpts::skip_hdr_step`) never share a RAM or disk
+/// cache key with the HDR-mapped frames of the same options.
+#[test]
+fn frames_without_the_hdr_step_have_keys_of_their_own() {
+    let opts = RenderOpts::default();
+    assert_ne!(opts_hash(&opts), opts_hash(&RenderOpts { skip_hdr_step: true, ..opts }));
+}
+
+struct ProbeDisk {
+    keys: Mutex<HashSet<u128>>,
+    probes: std::sync::atomic::AtomicUsize,
+}
+
+impl RemoteFrames for ProbeDisk {
+    fn slots(&self) -> usize {
+        0
+    }
+
+    fn disk(&self) -> bool {
+        true
+    }
+
+    fn disk_contains(&self, key: u128) -> bool {
+        self.probes.fetch_add(1, Ordering::Relaxed);
+        self.keys.lock().unwrap().contains(&key)
+    }
+
+    fn start(&self, _: RemoteJob, _: RemoteDone) {}
+}
+
+fn disk_fixture(stored_frames: &[i64]) -> (Frames, RenderSource, FrameKey, RenderOpts, Arc<ProbeDisk>, u128) {
+    let mut session = effectcraft_engine::Session::default();
+    session.execute("comp.new", serde_json::json!({"width": 32, "height": 18, "duration": 1})).unwrap();
+    let comp = session.active_comp_id().unwrap();
+    let opts = RenderOpts::default();
+    let content = 1234;
+    let mut base = key(1, 0, opts_hash(&opts));
+    base.revision = 7;
+    base.comp = comp.0;
+    let disk = Arc::new(ProbeDisk { keys: Mutex::new(HashSet::new()), probes: 0.into() });
+    disk.keys.lock().unwrap().extend(stored_frames.iter().map(|frame| disk_cache::frame_key(content, *frame, base.scale, base.view ^ opts_hash(&opts))));
+    let mut frames = Frames::default();
+    frames.set_remote(Some(disk.clone()));
+    frames.content_keys.lock().unwrap().insert((base.revision, base.comp), content);
+    let source = RenderSource {
+        project: session.project.clone(),
+        footage: session.footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    (frames, source, base, opts, disk, content)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn disk_indicator_does_not_hash_on_ui_thread_and_coalesces_edits() {
+    use std::sync::mpsc;
+    use std::time::{Duration, Instant};
+    struct Disk(u128);
+    impl RemoteFrames for Disk {
+        fn slots(&self) -> usize {
+            1
+        }
+        fn disk(&self) -> bool {
+            true
+        }
+        fn disk_contains(&self, key: u128) -> bool {
+            self.0 == key
+        }
+        fn start(&self, _: RemoteJob, done: RemoteDone) {
+            done(Err("test has no renderer".into()));
+        }
+    }
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", serde_json::json!({"width":32,"height":18,"duration":1})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let opts = RenderOpts::default();
+    let stored = disk_cache::frame_key(disk_cache::comp_content_key(&s.project, cid), 2, 1000, opts_hash(&opts));
+    let mut frames = Frames { pool: Some(rayon::ThreadPoolBuilder::new().num_threads(1).build().unwrap()), ..Default::default() };
+    frames.set_remote(Some(Arc::new(Disk(stored))));
+    let (entered, started) = mpsc::channel();
+    let (release, wait) = mpsc::channel();
+    frames.pool.as_ref().unwrap().spawn(move || {
+        entered.send(()).unwrap();
+        wait.recv_timeout(Duration::from_secs(5)).unwrap();
+    });
+    started.recv_timeout(Duration::from_secs(3)).unwrap();
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: s.footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    let mut base = key(1, 0, 0);
+    base.comp = cid.0;
+    for revision in 1..50 {
+        base.revision = revision;
+        assert!(frames.disk_frames(&src, &base, 0..30, &opts).is_empty());
+    }
+    assert!(frames.content_keys.lock().unwrap().is_empty(), "painting computed a content hash while the worker was blocked");
+    assert_eq!(frames.content_key_jobs.lock().unwrap().pending.len(), 1);
+    release.send(()).unwrap();
+    let until = Instant::now() + Duration::from_secs(3);
+    while !frames.content_keys.lock().unwrap().contains_key(&(base.revision, base.comp)) {
+        assert!(Instant::now() < until);
+        std::thread::sleep(Duration::from_millis(1));
+    }
+    assert_eq!(frames.disk_frames(&src, &base, 0..30, &opts), vec![2], "the blue indicator must return once its key is ready");
+    assert_eq!(frames.content_keys.lock().unwrap().len(), 1, "superseded revisions were hashed");
+}
+
+#[test]
+fn disk_indicator_range_tracks_live_membership() {
+    let (frames, src, base, opts, disk, _) = disk_fixture(&[10, 12]);
+    assert_eq!(frames.disk_frames(&src, &base, 10..13, &opts), vec![10, 12]);
+    assert_eq!(disk.probes.load(Ordering::Relaxed), 3);
+
+    disk.keys.lock().unwrap().insert(disk_cache::frame_key(1234, 11, base.scale, base.view ^ opts_hash(&opts)));
+    assert_eq!(frames.disk_frames(&src, &base, 10..13, &opts), vec![10, 11, 12]);
+
+    insert(&frames, FrameKey { frame: 11, ..base });
+    disk.probes.store(0, Ordering::Relaxed);
+    assert_eq!(frames.disk_frames(&src, &base, 10..13, &opts), vec![10, 12]);
+    assert_eq!(disk.probes.load(Ordering::Relaxed), 2);
+
+    disk.keys.lock().unwrap().remove(&disk_cache::frame_key(1234, 12, base.scale, base.view ^ opts_hash(&opts)));
+    assert_eq!(frames.disk_frames(&src, &base, 10..13, &opts), vec![10]);
+
+    let mut revised = base;
+    revised.revision += 1;
+    frames.content_keys.lock().unwrap().insert((revised.revision, revised.comp), 5678);
+    assert!(frames.disk_frames(&src, &revised, 10..13, &opts).is_empty());
+
+    let changed = FrameKey { scale: base.scale + 1, ..base };
+    assert!(frames.disk_frames(&src, &changed, 10..13, &opts).is_empty());
+    let changed = FrameKey { view: base.view + 1, ..base };
+    assert!(frames.disk_frames(&src, &changed, 10..13, &opts).is_empty());
+    assert!(frames.disk_frames(&src, &base, 10..13, &RenderOpts { draft: true, ..opts }).is_empty());
+}
+
+#[test]
+fn disk_indicator_range_is_bounded() {
+    let (frames, src, base, opts, disk, _) = disk_fixture(&[0, 1, 99_999]);
+    assert_eq!(frames.disk_frames(&src, &base, -5..2, &opts), vec![0, 1]);
+    assert_eq!(disk.probes.load(Ordering::Relaxed), 2);
+    disk.probes.store(0, Ordering::Relaxed);
+    assert_eq!(frames.disk_frames(&src, &base, 99_999..i64::MAX, &opts), vec![99_999]);
+    assert_eq!(disk.probes.load(Ordering::Relaxed), 1);
+    disk.probes.store(0, Ordering::Relaxed);
+    assert!(frames.disk_frames(&src, &base, 2..2, &opts).is_empty());
+    // Written as a struct literal: `3..2` trips clippy::reversed_empty_ranges.
+    let reversed = std::ops::Range { start: 3, end: 2 };
+    assert!(frames.disk_frames(&src, &base, reversed, &opts).is_empty());
+    assert_eq!(disk.probes.load(Ordering::Relaxed), 0);
+}
+
+/// Frames larger than the texture limit are averaged down by a whole factor (#201: an
+/// 11000×2200 comp at Full resolution against an 8192 limit).
+#[test]
+fn frames_over_the_texture_limit_are_averaged_down() {
+    assert_eq!(fitted_size([11000, 2200], 8192), [5500, 1100]);
+    assert_eq!(fitted_size([8192, 100], 8192), [8192, 100]);
+    assert_eq!(fitted_size([30000, 30000], 16384), [15000, 15000]);
+    assert_eq!(fitted_size([0, 0], 0), [0, 0]);
+    // 5×2 (three columns of white, then black) into 2 px: 3×2 blocks (the last one 2×2).
+    let w = egui::Color32::WHITE;
+    let b = egui::Color32::from_rgba_premultiplied(0, 0, 0, 255);
+    let img = egui::ColorImage::new([5, 2], vec![w, w, w, b, b, w, w, w, b, b]);
+    let out = fit_texture(img.clone(), 2);
+    assert_eq!(out.size, [2, 1]);
+    assert_eq!(out.pixels, vec![w, b]);
+    assert_eq!(fit_texture(img.clone(), 5).pixels, img.pixels);
+    let mixed = fit_texture(egui::ColorImage::new([2, 1], vec![w, b]), 1);
+    assert_eq!(mixed.pixels, vec![egui::Color32::from_rgba_premultiplied(128, 128, 128, 255)]);
+}
+
+#[test]
+fn retirement_reaches_existing_workers_and_keeps_cpu_frames_and_completion_live() {
+    let frames = Frames::default();
+    let worker = frames.worker();
+    let first = key(1, 0, 0);
+    insert(&frames, first);
+    frames.retire_gpu();
+    assert!(worker.gpu_retired.load(Ordering::Acquire), "already queued workers share retirement");
+    assert!(frames.is_cached(&first), "healthy materialized CPU frames survive");
+    let next = key(1, 1, 0);
+    frames.inflight.lock().unwrap().insert(next);
+    frames.queue.lock().unwrap().running.insert(next);
+    worker.finish_key(next, false, img(), None, None, web_time::Instant::now());
+    assert!(frames.is_cached(&next), "CPU retry can still publish");
+    assert_eq!(frames.inflight(), 0);
+    assert!(frames.queue.lock().unwrap().running.is_empty());
+}
+
+fn key(content: u64, frame: i64, opts: u64) -> FrameKey {
+    FrameKey { revision: content, content, comp: 1, frame, scale: 1000, view: 0, opts }
+}
+
+fn img() -> FrameImage {
+    FrameImage::Cpu(Arc::new(egui::ColorImage::new([2, 2], vec![egui::Color32::BLACK; 4])))
+}
+
+fn insert(f: &Frames, k: FrameKey) {
+    f.cache.lock().unwrap().insert(k, img());
+}
+
+/// A frame whose render panics (a GPU out of memory used to, on every frame thread) is
+/// released, not left "in progress" forever, so the viewer can ask for it again (#106).
+#[test]
+fn a_frame_whose_render_panics_is_released() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Footage, FootageKind};
+    use effectcraft_engine::render::Image;
+    use serde_json::json;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    #[derive(Default)]
+    struct Explodes(AtomicUsize);
+    impl FootageSource for Explodes {
+        fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            panic!("a decoder bug");
+        }
+    }
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    let clip = Footage { kind: FootageKind::Still, width: 8, height: 8, has_video: true, ..Default::default() };
+    let item = Arc::make_mut(&mut s.project).add_item("clip.png", Default::default(), None, ItemKind::Footage(clip));
+    s.execute("layer.addItem", json!({"item": item.0})).unwrap();
+    let footage = Arc::new(Explodes::default());
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    let f = Frames::default();
+    let key = FrameKey { revision: s.revision, content: f.content_of(&s.project, s.revision, cid), ..key(0, 0, 0) };
+    let key = FrameKey { comp: cid.0, ..key };
+    f.request(&src, key, cid, Tick::ZERO, RenderOpts::default());
+    for _ in 0..1000 {
+        if f.inflight() == 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(footage.0.load(Ordering::SeqCst) > 0, "the render reached the footage");
+    assert_eq!(f.inflight(), 0, "released");
+    assert!(!f.is_cached(&key));
+}
+
+/// #647: a pool thread waiting inside a render (on a parallel loop) never starts another
+/// frame render on top of it. Dragging a layer queues a frame every UI frame; renders used to
+/// nest on every thread, each holding its buffers, until memory ran out.
+#[test]
+fn a_waiting_render_never_starts_another_on_its_thread() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Footage, FootageKind};
+    use effectcraft_engine::render::Image;
+    use effectcraft_engine::time::FrameRate;
+    use serde_json::json;
+    use std::cell::Cell;
+    use std::sync::atomic::AtomicUsize;
+    thread_local! {
+        static DEPTH: Cell<usize> = const { Cell::new(0) };
+    }
+    /// A decoder that works in parallel, as the renderer does: its thread joins the loop and
+    /// may wait for the parts other threads took.
+    #[derive(Default)]
+    struct Parallel {
+        calls: AtomicUsize,
+        deepest: AtomicUsize,
+    }
+    impl FootageSource for Parallel {
+        fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
+            let d = DEPTH.get() + 1;
+            DEPTH.set(d);
+            self.deepest.fetch_max(d, Ordering::SeqCst);
+            self.calls.fetch_add(1, Ordering::SeqCst);
+            (0..64).into_par_iter().for_each(|_| std::thread::sleep(std::time::Duration::from_millis(1)));
+            DEPTH.set(d - 1);
+            Some(Arc::new(Image::new(4, 4)))
+        }
+    }
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 10})).unwrap()["comp"].as_u64().unwrap());
+    let clip = Footage {
+        kind: FootageKind::Video,
+        width: 4,
+        height: 4,
+        has_video: true,
+        frame_rate: FrameRate::FPS_30,
+        duration: Tick::from_seconds_f64(10.0),
+        ..Default::default()
+    };
+    let item = Arc::make_mut(&mut s.project).add_item("clip.mov", Default::default(), None, ItemKind::Footage(clip));
+    s.execute("layer.addItem", json!({"item": item.0})).unwrap();
+    let footage = Arc::new(Parallel::default());
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    let f = Frames::default();
+    let content = f.content_of(&s.project, s.revision, cid);
+    let frames = 60;
+    for frame in 0..frames {
+        let key = FrameKey { revision: s.revision, content, comp: cid.0, frame, scale: 1000, view: 0, opts: 0 };
+        f.request(&src, key, cid, FrameRate::FPS_30.tick_of(frame), RenderOpts::default());
+    }
+    for _ in 0..4000 {
+        if f.inflight() == 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(f.inflight(), 0, "every queued frame rendered");
+    assert!(footage.calls.load(Ordering::SeqCst) >= frames as usize);
+    assert_eq!(footage.deepest.load(Ordering::SeqCst), 1, "renders nested on a waiting thread");
+}
+
+/// #329: scrubbing a long movie, the viewer frame of every step the pointer passed started
+/// rendering and seeked the movie's decoder in turn; the frame under the pointer waited for
+/// all of them. A newer viewer frame of another time calls off the one rendering, which is
+/// not cached (its footage may be missing).
+#[test]
+fn a_newer_viewer_frame_calls_off_the_one_rendering() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Footage, FootageKind};
+    use effectcraft_engine::render::Image;
+    use effectcraft_engine::time::FrameRate;
+    use serde_json::json;
+    use std::cell::RefCell;
+    thread_local! {
+        static CANCEL: RefCell<Option<Arc<AtomicBool>>> = const { RefCell::new(None) };
+    }
+    /// A movie whose first frames take a long seek, which a called-off read gives up.
+    #[derive(Default)]
+    struct Seeking {
+        seeking: AtomicBool,
+        called_off: AtomicBool,
+    }
+    impl FootageSource for Seeking {
+        fn cancellable(&self, cancel: &Arc<AtomicBool>, f: &mut dyn FnMut()) {
+            let prev = CANCEL.replace(Some(cancel.clone()));
+            f();
+            CANCEL.set(prev);
+        }
+        fn frame(&self, _: ItemId, _: &Footage, t: Tick) -> Option<Arc<Image>> {
+            if t < Tick::from_seconds_f64(0.25) {
+                self.seeking.store(true, Ordering::SeqCst);
+                for _ in 0..1000 {
+                    if CANCEL.with_borrow(|c| c.as_ref().is_some_and(|c| c.load(Ordering::SeqCst))) {
+                        self.called_off.store(true, Ordering::SeqCst);
+                        return None;
+                    }
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+            }
+            Some(Arc::new(Image::new(4, 4)))
+        }
+    }
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 10})).unwrap()["comp"].as_u64().unwrap());
+    let clip = Footage {
+        kind: FootageKind::Video,
+        width: 4,
+        height: 4,
+        has_video: true,
+        frame_rate: FrameRate::FPS_30,
+        duration: Tick::from_seconds_f64(10.0),
+        ..Default::default()
+    };
+    let item = Arc::make_mut(&mut s.project).add_item("clip.mov", Default::default(), None, ItemKind::Footage(clip));
+    s.execute("layer.addItem", json!({"item": item.0})).unwrap();
+    let footage = Arc::new(Seeking::default());
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    let f = Frames::default();
+    let content = f.content_of(&s.project, s.revision, cid);
+    let key = |frame| FrameKey { revision: s.revision, content, comp: cid.0, frame, scale: 1000, view: 0, opts: 0 };
+    f.request_urgent(&src, key(0), cid, Tick::ZERO, RenderOpts::default());
+    for _ in 0..1000 {
+        if footage.seeking.load(Ordering::SeqCst) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    assert!(footage.seeking.load(Ordering::SeqCst), "the first frame's render reached the footage");
+    f.request_urgent(&src, key(150), cid, FrameRate::FPS_30.tick_of(150), RenderOpts::default());
+    for _ in 0..1000 {
+        if f.inflight() == 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(footage.called_off.load(Ordering::SeqCst), "the superseded frame's seek ran on");
+    assert!(f.is_cached(&key(150)), "the newest frame rendered");
+    assert!(!f.is_cached(&key(0)), "a called-off frame is not cached");
+    assert_eq!(f.inflight(), 0, "released");
+}
+
+/// #284: scrubbing asks for a viewer frame at every step; a newer one drops the comp's viewer
+/// frames still waiting (they would all render first), but not prefetch frames or another
+/// comp's viewer frame.
+#[test]
+fn a_newer_viewer_frame_drops_the_ones_still_waiting() {
+    /// Starts nothing, so every request stays queued.
+    struct Idle;
+    impl RemoteFrames for Idle {
+        fn slots(&self) -> usize {
+            0
+        }
+        fn start(&self, _: RemoteJob, _: RemoteDone) {}
+    }
+    let mut f = Frames::default();
+    f.set_remote(Some(Arc::new(Idle)));
+    let src = RenderSource {
+        project: Arc::default(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    let request = |k: FrameKey, urgent: bool| {
+        f.request_with(&src, k, ItemId(k.comp), Tick::ZERO, RenderOpts::default(), if urgent { Want::Viewer } else { Want::Prefetch })
+    };
+    let other = FrameKey { comp: 2, ..key(1, 0, 0) };
+    request(other, true);
+    request(key(1, 20, 0), false);
+    for frame in 0..10 {
+        request(key(1, frame, 0), true);
+    }
+    let mut queued: Vec<(u64, i64, bool)> = f.queue.lock().unwrap().jobs.iter().map(|j| (j.key.comp, j.key.frame, j.urgent)).collect();
+    queued.sort();
+    assert_eq!(queued, [(1, 9, true), (1, 20, false), (2, 0, false)]);
+    assert_eq!(f.inflight(), 3, "dropped frames aren't in flight: the viewer can ask again");
+}
+
+/// One OOM burst halves once; separate episodes back off to a floor and healthy GPU work recovers.
+#[test]
+fn running_out_of_video_memory_halves_the_gpu_frame_budget() {
+    let f = Frames::default();
+    let mut c = f.cache.lock().unwrap();
+    assert_eq!(c.gpu_budget, GPU_BUDGET);
+    assert!(c.gpu_ready());
+    c.gpu_out_of_memory();
+    assert!(!c.gpu_ready(), "allocation failures must not be retried for every frame");
+    assert_eq!(c.gpu_budget, GPU_BUDGET / 2);
+    for _ in 0..20 {
+        c.gpu_out_of_memory();
+    }
+    assert_eq!(c.gpu_budget, GPU_BUDGET / 2, "one burst must not collapse the shared budget");
+    for _ in 0..20 {
+        c.gpu_pressure = None;
+        c.gpu_out_of_memory();
+    }
+    assert_eq!(c.gpu_budget, MIN_GPU_BUDGET);
+    let before = web_time::Instant::now() - GPU_RECOVERY_INTERVAL;
+    c.gpu_pressure = Some(before);
+    assert!(c.gpu_ready(), "GPU attempts resume after the cooldown");
+    c.gpu_adjusted = Some(before);
+    c.gpu_succeeded();
+    assert_eq!(c.gpu_budget, 2 * MIN_GPU_BUDGET);
+    c.gpu_succeeded();
+    assert_eq!(c.gpu_budget, 2 * MIN_GPU_BUDGET, "recovery is paced");
+    drop(c);
+    f.clear();
+    assert_eq!(f.cache.lock().unwrap().gpu_budget, GPU_BUDGET);
+}
+
+#[test]
+fn least_recently_shown_frames_go_first() {
+    let f = Frames::default();
+    f.set_budget(3 * 16);
+    for i in 0..3 {
+        insert(&f, key(1, i, 0));
+    }
+    // Frame 0 is shown again, so frame 1 is now the oldest.
+    assert!(f.get(&key(1, 0, 0)).is_some());
+    insert(&f, key(1, 3, 0));
+    assert!(f.is_cached(&key(1, 0, 0)) && !f.is_cached(&key(1, 1, 0)));
+    assert!(f.is_cached(&key(1, 2, 0)) && f.is_cached(&key(1, 3, 0)));
+}
+
+fn playhead(cur: i64, looping: bool) -> Playhead {
+    Playhead { series: key(1, 0, 0), cur, start: 0, end: 99, step: 1, looping }
+}
+
+/// #595: a playing preview's cache is full. The frames just ahead of the playhead were
+/// rendered before the ones just shown, so plain LRU evicted them first and the preview
+/// played into a gap. Frames the preview no longer reaches go first, then the ones it
+/// reaches last.
+#[test]
+fn a_full_cache_keeps_the_frames_just_ahead_of_the_playhead() {
+    let f = Frames::default();
+    f.set_budget(4 * 16);
+    // Prefetch rendered 11..=13, then 10 was shown (the most recently used).
+    for i in [11, 12, 13, 10] {
+        insert(&f, key(1, i, 0));
+    }
+    let cached = |f: &Frames| f.cached_frames(&key(1, 0, 0));
+    f.set_playhead(Some(playhead(10, false)));
+    // The next frame rendered is the one the preview reaches last: the frames just ahead stay.
+    insert(&f, key(1, 14, 0));
+    assert_eq!(cached(&f), [10, 11, 12, 13]);
+    // Without looping, a frame behind the playhead goes before any frame ahead of it.
+    f.set_playhead(Some(playhead(12, false)));
+    insert(&f, key(1, 14, 0));
+    assert_eq!(cached(&f), [10, 12, 13, 14]);
+    // Looping, the frame just behind is the one reached last.
+    f.set_playhead(Some(playhead(13, true)));
+    insert(&f, key(1, 0, 0));
+    assert_eq!(cached(&f), [0, 10, 13, 14]);
+    // Stopped: least recently shown first again.
+    f.set_playhead(None);
+    insert(&f, key(1, 50, 0));
+    assert!(!f.is_cached(&key(1, 13, 0)) && f.is_cached(&key(1, 50, 0)));
+}
+
+/// A frame source that queues jobs and never renders them: the tests check the queue.
+struct Idle;
+impl RemoteFrames for Idle {
+    fn slots(&self) -> usize {
+        0
+    }
+    fn start(&self, _: RemoteJob, _: RemoteDone) {}
+}
+
+fn idle_source() -> RenderSource {
+    RenderSource {
+        project: Arc::default(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    }
+}
+
+/// #595: prefetch renders the frames the preview reaches first, whatever order they were
+/// asked for in (a frame evicted and asked for again waited behind every frame further
+/// ahead); queued frames the preview no longer reaches are dropped and not left in flight.
+#[test]
+fn prefetch_renders_the_frames_the_playhead_reaches_first() {
+    let mut f = Frames::default();
+    f.set_remote(Some(Arc::new(Idle)));
+    let src = idle_source();
+    for frame in [40, 30, 20, 5, 12, 11] {
+        f.request(&src, key(1, frame, 0), ItemId(1), Tick::ZERO, RenderOpts::default());
+    }
+    f.request(&src, FrameKey { comp: 2, ..key(1, 1, 0) }, ItemId(2), Tick::ZERO, RenderOpts::default());
+    f.set_playhead(Some(playhead(10, false)));
+    let mut order = vec![];
+    loop {
+        let mut q = f.queue.lock().unwrap();
+        let Some(i) = q.best() else { break };
+        let j = q.jobs.swap_remove(i);
+        order.push((j.key.comp, j.key.frame));
+    }
+    assert_eq!(order, [(1, 11), (1, 12), (1, 20), (1, 30), (1, 40), (2, 1)]);
+    assert_eq!(f.inflight(), 6, "frame 5, behind the playhead, is no longer in flight");
+}
+
+/// A decoder that works in parallel, as the renderer does, in a comp that shows it.
+#[derive(Default)]
+struct ParallelClip {
+    started: std::sync::atomic::AtomicUsize,
+    /// Frames started by the time frame 1 was done.
+    started_at_first: std::sync::atomic::AtomicUsize,
+    /// Frames decoding now, and the most at a time.
+    active: std::sync::atomic::AtomicUsize,
+    most_active: std::sync::atomic::AtomicUsize,
+}
+
+impl FootageSource for ParallelClip {
+    fn frame(&self, _: ItemId, _: &effectcraft_engine::project::Footage, t: Tick) -> Option<Arc<effectcraft_engine::render::Image>> {
+        self.started.fetch_add(1, Ordering::SeqCst);
+        let active = self.active.fetch_add(1, Ordering::SeqCst) + 1;
+        self.most_active.fetch_max(active, Ordering::SeqCst);
+        (0..16).into_par_iter().for_each(|_| (0..4).into_par_iter().for_each(|_| std::thread::sleep(std::time::Duration::from_millis(1))));
+        if effectcraft_engine::time::FrameRate::FPS_30.frame_at(t) == 1 {
+            self.started_at_first.store(self.started.load(Ordering::SeqCst), Ordering::SeqCst);
+        }
+        self.active.fetch_sub(1, Ordering::SeqCst);
+        Some(Arc::new(effectcraft_engine::render::Image::new(4, 4)))
+    }
+}
+
+/// A 10 s comp of a [`ParallelClip`]: the frame cache, the clip, the render source, the comp
+/// and the key of its frame 0.
+fn parallel_clip() -> (Frames, Arc<ParallelClip>, RenderSource, ItemId, FrameKey) {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Footage, FootageKind};
+    use effectcraft_engine::time::FrameRate;
+    use serde_json::json;
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 10})).unwrap()["comp"].as_u64().unwrap());
+    let clip = Footage {
+        kind: FootageKind::Video,
+        width: 4,
+        height: 4,
+        has_video: true,
+        frame_rate: FrameRate::FPS_30,
+        duration: Tick::from_seconds_f64(10.0),
+        ..Default::default()
+    };
+    let item = Arc::make_mut(&mut s.project).add_item("clip.mov", Default::default(), None, ItemKind::Footage(clip));
+    s.execute("layer.addItem", json!({"item": item.0})).unwrap();
+    let footage = Arc::new(ParallelClip::default());
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: None,
+    };
+    let f = Frames::default();
+    let series = FrameKey { revision: s.revision, content: f.content_of(&s.project, s.revision, cid), comp: cid.0, frame: 0, scale: 1000, view: 0, opts: 0 };
+    (f, footage, src, cid, series)
+}
+
+fn wait_for_renders(f: &Frames) {
+    for _ in 0..8000 {
+        if f.inflight() == 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(f.inflight(), 0, "every queued frame rendered");
+}
+
+/// A playing preview's frames render side by side, and each works in parallel: a render
+/// waiting for its own parallel work took over pieces of the frames started after it, and
+/// its frame was done only once theirs were. The frames right ahead of the playhead, started
+/// first, came last: the preview stood still while the frames further ahead turned green.
+/// Cache Frames When Idle left the same gaps.
+#[test]
+fn frames_started_first_are_done_first() {
+    use effectcraft_engine::time::FrameRate;
+    for playing in [true, false] {
+        let (f, footage, src, cid, series) = parallel_clip();
+        let frames = 60;
+        if playing {
+            f.set_playhead(Some(Playhead { series, cur: 0, start: 0, end: 299, step: 1, looping: false }));
+        }
+        for frame in 1..=frames {
+            let (key, t) = (FrameKey { frame, ..series }, FrameRate::FPS_30.tick_of(frame));
+            if playing {
+                f.request(&src, key, cid, t, RenderOpts::default());
+            } else {
+                f.request_background(&src, key, cid, t, RenderOpts::default());
+            }
+            if frame == 1 {
+                // Its parallel work has started (and idle threads have taken pieces of it).
+                std::thread::sleep(std::time::Duration::from_millis(3));
+            }
+        }
+        wait_for_renders(&f);
+        assert_eq!(f.cached_frames(&series).len(), frames as usize);
+        let before = footage.started_at_first.load(Ordering::SeqCst);
+        assert!(before <= 2 * f.parallelism(), "{before} frames were started before the first one was done (playing: {playing})");
+    }
+}
+
+/// Prefetch frames queued when a preview starts or stops, or that become the viewer's
+/// frame, still render: they change hands between the lanes and the pool.
+#[test]
+fn queued_frames_render_when_a_preview_starts_or_stops() {
+    use effectcraft_engine::time::FrameRate;
+    let (f, _, src, cid, series) = parallel_clip();
+    let playhead = Playhead { series, cur: 0, start: 0, end: 299, step: 1, looping: false };
+    let request = |frames: std::ops::Range<i64>| {
+        for frame in frames {
+            f.request(&src, FrameKey { frame, ..series }, cid, FrameRate::FPS_30.tick_of(frame), RenderOpts::default());
+        }
+    };
+    // Queued for the pool, then a preview starts.
+    request(1..40);
+    f.set_playhead(Some(playhead));
+    // Queued for the lanes, then the preview stops.
+    request(40..80);
+    f.set_playhead(None);
+    wait_for_renders(&f);
+    // Queued for the lanes, then the viewer shows one of them.
+    for frame in 80..120 {
+        f.request_background(&src, FrameKey { frame, ..series }, cid, FrameRate::FPS_30.tick_of(frame), RenderOpts::default());
+    }
+    f.request_urgent(&src, FrameKey { frame: 119, ..series }, cid, FrameRate::FPS_30.tick_of(119), RenderOpts::default());
+    wait_for_renders(&f);
+    assert_eq!(f.cached_frames(&series).len(), 119);
+}
+
+/// Waits for the lanes to be idle (after their last frame they give back their GPU slot) and
+/// checks every GPU slot was given back.
+fn wait_for_idle_lanes(f: &Frames) {
+    for _ in 0..2000 {
+        let q = f.queue.lock().unwrap();
+        if q.idle_lanes.len() == f.lanes.len() {
+            break;
+        }
+        drop(q);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let q = f.queue.lock().unwrap();
+    assert_eq!(q.idle_lanes.len(), f.lanes.len(), "every lane is idle again");
+    assert_eq!(q.gpu_lanes, 0, "every lane gave its GPU slot back");
+}
+
+/// Plays a preview of `frames` frames of a [`parallel_clip`] as the viewer renders them (the
+/// project's renderer: `backend` Auto) or with `backend`, as if there were a GPU compositor
+/// (`gpu`), `retired` or with the project on Mercury Software Only (`!gpu_acceleration`), and
+/// waits for them: the frame cache and the most frames that rendered at a time.
+fn play_preview(gpu: bool, retired: bool, backend: effectcraft_engine::render::Backend, gpu_acceleration: bool) -> (Frames, usize) {
+    use effectcraft_engine::time::FrameRate;
+    let (f, footage, mut src, cid, series) = parallel_clip();
+    Arc::make_mut(&mut src.project).settings.gpu_acceleration = gpu_acceleration;
+    f.queue.lock().unwrap().fake_gpu = gpu;
+    if retired {
+        f.retire_gpu();
+    }
+    let opts = RenderOpts { backend, ..RenderOpts::default() };
+    f.set_playhead(Some(Playhead { series, cur: 0, start: 0, end: 299, step: 1, looping: false }));
+    let frames = 24;
+    for frame in 1..=frames {
+        f.request(&src, FrameKey { frame, ..series }, cid, FrameRate::FPS_30.tick_of(frame), opts);
+    }
+    wait_for_renders(&f);
+    assert_eq!(f.cached_frames(&series).len(), frames as usize);
+    wait_for_idle_lanes(&f);
+    let most = footage.most_active.load(Ordering::SeqCst);
+    (f, most)
+}
+
+/// Every lane composited a playing preview's frame on the GPU at the same time, on the device
+/// the window draws with: the window froze for hundreds of milliseconds and the preview jumped
+/// ahead (#3345). A preview starts on one GPU lane (see [`Queue::ui_frame`]).
+#[test]
+fn a_preview_composites_on_a_few_lanes_at_a_time() {
+    use effectcraft_engine::render::Backend;
+    for backend in [Backend::Auto, Backend::Gpu] {
+        let (_, most) = play_preview(true, false, backend, true);
+        assert!(most <= 1, "{most} lanes composited on the GPU at once ({backend:?})");
+    }
+}
+
+/// Frames that render on the CPU use every lane: with no GPU compositor, with the GPU retired,
+/// and with Mercury Software Only (the project's renderer, or the CPU backend).
+#[test]
+fn frames_on_the_cpu_render_on_every_lane() {
+    use effectcraft_engine::render::Backend;
+    for (gpu, retired, backend, gpu_acceleration) in
+        [(false, false, Backend::Auto, true), (true, true, Backend::Auto, true), (true, false, Backend::Auto, false), (true, false, Backend::Cpu, true)]
+    {
+        let (f, most) = play_preview(gpu, retired, backend, gpu_acceleration);
+        if f.lanes.len() > 2 {
+            assert!(most > 2, "frames on the CPU rendered on {most} lanes at a time ({gpu} {retired} {backend:?} {gpu_acceleration})");
+        }
+    }
+}
+
+/// A queue of `lanes` lanes, `busy` of them compositing on the GPU.
+fn gpu_queue(lanes: usize, busy: usize) -> Queue {
+    Queue { lanes, gpu_lanes: busy, gpu_limit: 1, ..Default::default() }
+}
+
+/// Window frames every `gap` ms from `t` for `ms` ms; the time after the last.
+fn ui_frames(q: &mut Queue, t: web_time::Instant, gap: u64, ms: u64) -> web_time::Instant {
+    let mut t = t;
+    for _ in 0..ms / gap {
+        t += std::time::Duration::from_millis(gap);
+        q.ui_frame(Some(t));
+    }
+    t
+}
+
+/// A GPU that keeps up with the window gets every lane, one more each half second the window
+/// stays smooth with every allowed lane compositing.
+#[test]
+fn a_smooth_window_gives_the_gpu_every_lane() {
+    let mut q = gpu_queue(8, 0);
+    let t = web_time::Instant::now();
+    q.ui_frame(Some(t));
+    // Nothing compositing: the limit isn't what holds the preview back.
+    let t = ui_frames(&mut q, t, 16, 2000);
+    assert_eq!(q.gpu_limit, 1);
+    let mut t = t;
+    for _ in 0..20 {
+        q.gpu_lanes = q.gpu_limit;
+        t = ui_frames(&mut q, t, 16, 520);
+    }
+    assert_eq!(q.gpu_limit, 8, "no more than the lanes");
+}
+
+/// A window that stalls while lanes composite halves the limit, and the limit that stalled is
+/// tried again only after a long smooth spell; a window that is only slow keeps the limit.
+#[test]
+fn a_stalling_window_takes_lanes_from_the_gpu() {
+    let mut q = gpu_queue(8, 4);
+    q.gpu_limit = 4;
+    let t = web_time::Instant::now();
+    q.ui_frame(Some(t));
+    let t = ui_frames(&mut q, t, 300, 300);
+    assert_eq!((q.gpu_limit, q.gpu_stalled_at), (2, 4));
+    let t = ui_frames(&mut q, t, 80, 5000);
+    assert_eq!(q.gpu_limit, 2, "a slow (not stalling) window keeps the limit");
+    q.gpu_lanes = 2;
+    let t = ui_frames(&mut q, t, 16, 600);
+    assert_eq!(q.gpu_limit, 3);
+    q.gpu_lanes = 3;
+    let t = ui_frames(&mut q, t, 16, 2000);
+    assert_eq!(q.gpu_limit, 3, "4 stalled: it waits longer");
+    ui_frames(&mut q, t, 16, 10_000);
+    assert_eq!(q.gpu_limit, 4);
+    // A stall with nothing compositing isn't the GPU's.
+    let mut q = gpu_queue(8, 0);
+    q.gpu_limit = 4;
+    let t = web_time::Instant::now();
+    q.ui_frame(Some(t));
+    ui_frames(&mut q, t, 500, 500);
+    assert_eq!(q.gpu_limit, 4);
+    // Never below one lane; a stopped preview's pause is no stall.
+    let mut q = gpu_queue(8, 1);
+    let t = web_time::Instant::now();
+    q.ui_frame(Some(t));
+    ui_frames(&mut q, t, 400, 400);
+    assert_eq!(q.gpu_limit, 1);
+    q.gpu_limit = 2;
+    q.ui_frame(None);
+    q.ui_frame(Some(t + std::time::Duration::from_secs(5)));
+    assert_eq!(q.gpu_limit, 2);
+}
+
+/// A preview that stops while lanes composite: their frames finish, the queued ones move to the
+/// pool and render, the viewer's frame is not held up, and every GPU slot is given back.
+#[test]
+fn a_preview_stopping_mid_render_gives_the_gpu_slots_back() {
+    use effectcraft_engine::time::FrameRate;
+    let (f, _, src, cid, series) = parallel_clip();
+    f.queue.lock().unwrap().fake_gpu = true;
+    let opts = RenderOpts { backend: effectcraft_engine::render::Backend::Auto, ..RenderOpts::default() };
+    f.set_playhead(Some(Playhead { series, cur: 0, start: 0, end: 299, step: 1, looping: false }));
+    for frame in 1..=24 {
+        f.request(&src, FrameKey { frame, ..series }, cid, FrameRate::FPS_30.tick_of(frame), opts);
+    }
+    std::thread::sleep(std::time::Duration::from_millis(20));
+    f.set_playhead(None);
+    f.request_urgent(&src, FrameKey { frame: 100, ..series }, cid, FrameRate::FPS_30.tick_of(100), opts);
+    wait_for_renders(&f);
+    assert_eq!(f.cached_frames(&series).len(), 25);
+    wait_for_idle_lanes(&f);
+}
+
+/// The cache is full. A zoom (or preview-resolution) change left the frames of the old
+/// size to the plain least-recently-shown order, so the frames of the zoom the viewer is back
+/// at went before the ones of the abandoned zoom. The other size's frames go first, then the
+/// order is as before.
+#[test]
+fn a_size_change_evicts_frames_of_other_sizes_first() {
+    let mut f = Frames::default();
+    f.set_remote(Some(Arc::new(Idle)));
+    f.set_budget(4 * 16);
+    let at = |frame, scale| FrameKey { scale, ..key(1, frame, 0) };
+    // 100% (frames 0..=1) is cached, then 50% (2..=3): the 100% frames are the oldest.
+    for (frame, scale) in [(0, 1000), (1, 1000), (2, 500), (3, 500)] {
+        insert(&f, at(frame, scale));
+    }
+    // A passive viewer at 50% asks for a frame: that doesn't change which size is kept.
+    f.request(&idle_source(), at(9, 500), ItemId(1), Tick::ZERO, RenderOpts::default());
+    // Back at 100%: the viewer asks for frame 4.
+    f.request_urgent(&idle_source(), at(4, 1000), ItemId(1), Tick::ZERO, RenderOpts::default());
+    f.request(&idle_source(), at(10, 500), ItemId(1), Tick::ZERO, RenderOpts::default());
+    insert(&f, at(4, 1000));
+    assert!(
+        f.is_cached(&at(0, 1000)) && f.is_cached(&at(1, 1000)) && !f.is_cached(&at(2, 500)) && f.is_cached(&at(3, 500)),
+        "the first frame of the old size goes, not the cached ones of the current size"
+    );
+    insert(&f, at(5, 1000));
+    assert!(!f.is_cached(&at(3, 500)), "then the last frame of the old size");
+    assert_eq!(f.cached_frames(&at(0, 1000)), [0, 1, 4, 5]);
+    // No other size left: least recently shown first again.
+    insert(&f, at(6, 1000));
+    assert_eq!(f.cached_frames(&at(0, 1000)), [1, 4, 5, 6]);
+}
+
+#[test]
+fn frames_are_keyed_by_content_and_series_are_kept_apart() {
+    let f = Frames::default();
+    insert(&f, key(1, 0, 0));
+    insert(&f, key(2, 0, 0));
+    insert(&f, key(2, 1, 7));
+    // Other content or render options (Draft, shadows…) are another series.
+    assert_eq!(f.cached_frames(&key(2, 0, 0)), vec![0]);
+    assert_eq!(f.cached_frames(&key(2, 0, 7)), vec![1]);
+    // A later revision with the same content finds the frame (an edit elsewhere, an undo).
+    assert!(f.is_cached(&FrameKey { revision: 99, ..key(1, 0, 0) }));
+    assert!(!f.is_cached(&key(3, 0, 0)));
+}
+
+#[test]
+fn live_edits_present_the_newest_completed_revision_without_going_backwards() {
+    let f = Frames::default();
+    let shown = key(1, 0, 0);
+    let newest = key(3, 0, 0);
+    let wanted = key(5, 0, 0);
+    insert(&f, shown);
+    insert(&f, newest);
+    insert(&f, key(2, 0, 0)); // Older worker finishes after the newer one.
+    let displayed = f.get_for_viewer(&wanted, Some(&shown)).unwrap().0;
+    assert_eq!(displayed, newest);
+    assert!(f.get_for_viewer(&wanted, Some(&displayed)).is_none(), "never replay an older completion");
+    insert(&f, wanted);
+    assert_eq!(f.get_for_viewer(&wanted, Some(&displayed)).unwrap().0, wanted, "settle on the exact final edit");
+    // Undo reuses the content of an earlier revision immediately.
+    let undo = FrameKey { revision: 6, ..shown };
+    let reused = f.get_for_viewer(&undo, Some(&wanted)).unwrap().0;
+    assert_eq!(reused.content, shown.content);
+    assert_eq!(reused.revision, undo.revision);
+}
+
+#[test]
+fn live_edits_do_not_substitute_other_times_views_or_render_settings() {
+    let f = Frames::default();
+    let shown = key(1, 0, 0);
+    let wanted = key(3, 0, 0);
+    let done = key(2, 0, 0);
+    for mismatch in [
+        FrameKey { comp: 9, ..done },
+        FrameKey { frame: 1, ..done },
+        FrameKey { scale: 500, ..done },
+        FrameKey { view: 1, ..done },
+        FrameKey { opts: 1, ..done },
+        FrameKey { revision: 4, ..done },
+    ] {
+        f.clear();
+        insert(&f, mismatch);
+        assert!(f.get_for_viewer(&wanted, Some(&shown)).is_none(), "wrong candidate: {mismatch:?}");
+    }
+    f.clear();
+    insert(&f, done);
+    assert!(f.get_for_viewer(&wanted, None).is_none(), "no stale content on opening a viewer");
+    assert!(f.get_for_viewer(&wanted, Some(&FrameKey { comp: 9, ..shown })).is_none());
+    assert!(f.get_for_viewer(&wanted, Some(&FrameKey { frame: 1, ..shown })).is_none());
+    assert!(f.get_for_viewer(&wanted, Some(&FrameKey { view: 1, ..shown })).is_none());
+}
+
+#[test]
+fn an_edit_keeps_the_frames_of_comps_it_does_not_touch() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let a = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    let b = ItemId(s.execute("comp.new", json!({"name": "B", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    let f = Frames::default();
+    let at = |s: &Session, c: ItemId| f.content_of(&s.project, s.revision, c);
+    let (a0, b0) = (at(&s, a), at(&s, b));
+    // Edit B: A's content (and frames) stay, B's change.
+    s.execute("layer.newSolid", json!({"comp": b.0, "color": "#ff0000"})).unwrap();
+    assert_eq!(at(&s, a), a0);
+    assert_ne!(at(&s, b), b0);
+    // Undo: B is back to the content its old frames were rendered for.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(at(&s, b), b0);
+}
+
+#[test]
+fn a_long_drag_keeps_a_bounded_number_of_states() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let a = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    let f = Frames::default();
+    let mut last = None;
+    for i in 0..200 {
+        s.execute("comp.settings", json!({"width": 8 + i, "merge": "drag"})).unwrap();
+        let k = FrameKey { content: f.content_of(&s.project, s.revision, a), ..key(0, 0, 0) };
+        insert(&f, k);
+        last = Some(k);
+    }
+    // The snapshots and the frames kept stay bounded (a dropped identity's frames go with it,
+    // so a later state that reuses its addresses can't be shown an old frame).
+    assert!(f.keepers.lock().unwrap().1.len() <= MAX_KEEPERS);
+    assert!(f.cache.lock().unwrap().map.len() <= MAX_KEEPERS);
+    assert!(f.is_cached(&last.unwrap()), "the current state's frame stays");
+}
+
+#[test]
+fn an_identity_keeps_its_comps_so_an_edit_in_place_still_changes_it() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let a = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    // A project nothing else holds (no undo history): make_mut would edit the comp in place,
+    // at the same address, if the identity hadn't kept a snapshot holding it.
+    let mut p = Arc::new((*s.project).clone());
+    drop(s);
+    let f = Frames::default();
+    let before = f.content_of(&p, 1, a);
+    let comp = Arc::make_mut(&mut p).comp_mut(a).unwrap();
+    comp.width = 16;
+    assert_ne!(f.content_of(&p, 2, a), before);
+}
+
+/// Audio, Lock and Shy (and Hide Shy Layers) don't change pixels: toggling them, in the comp
+/// or a comp it nests, keeps its frames, also when toggled back (#103).
+#[test]
+fn audio_lock_and_shy_switches_keep_the_frames() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let inner = ItemId(id(s.execute("comp.new", json!({"name": "Inner", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
+    let solid = id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": "#ff0000"})).unwrap(), "layer");
+    let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
+    let nested = id(s.execute("layer.addItem", json!({"comp": outer.0, "item": inner.0})).unwrap(), "layer");
+    let f = Frames::default();
+    let at = |s: &Session| f.content_of(&s.project, s.revision, outer);
+    let o0 = at(&s);
+    let switch = |s: &mut Session, comp: ItemId, layer: u64, sw: &str, v: bool| {
+        s.execute("layer.setSwitch", json!({"comp": comp.0, "layers": [layer], "switch": sw, "value": v})).unwrap();
+    };
+    for (comp, layer, sw) in [(outer, nested, "audio"), (outer, nested, "lock"), (outer, nested, "shy"), (inner, solid, "audio"), (inner, solid, "shy")] {
+        // Audio off; Lock and Shy on.
+        switch(&mut s, comp, layer, sw, sw != "audio");
+        assert_eq!(at(&s), o0, "{sw} on in {comp:?}");
+    }
+    s.execute("comp.setSwitch", json!({"comp": outer.0, "switch": "hideShy", "value": true})).unwrap();
+    assert_eq!(at(&s), o0, "Hide Shy Layers");
+    switch(&mut s, outer, nested, "audio", true);
+    switch(&mut s, outer, nested, "lock", false);
+    assert_eq!(at(&s), o0, "toggled back");
+    // Switches that change pixels still do.
+    switch(&mut s, inner, solid, "video", false);
+    let o1 = at(&s);
+    assert_ne!(o1, o0, "Video");
+    switch(&mut s, outer, nested, "audio", false);
+    assert_eq!(at(&s), o1, "a mute after a real edit keeps that edit's frames");
+    switch(&mut s, inner, solid, "video", true);
+    assert_ne!(at(&s), o1);
+}
+
+/// A cut or trim recaches only the frames of the layers it touched (#1641), and those of the
+/// layers the change reaches (here a child of the trimmed layer).
+#[test]
+fn an_edit_keeps_the_frames_outside_the_layers_it_changed() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let comp = ItemId(id(s.execute("comp.new", json!({"name": "Edit", "width": 8, "height": 8, "duration": 10})).unwrap(), "comp"));
+    let a = id(s.execute("layer.newSolid", json!({"comp": comp.0, "color": "#ff0000"})).unwrap(), "layer");
+    let b = id(s.execute("layer.newSolid", json!({"comp": comp.0, "color": "#00ff00"})).unwrap(), "layer");
+    s.execute("layer.timing", json!({"layers": [a], "in": 0, "out": 4})).unwrap();
+    s.execute("layer.timing", json!({"layers": [b], "in": 4, "out": 10})).unwrap();
+    let (fr, out) = s.project.comp(comp).map(|c| (c.frame_rate, c.layers.iter().find(|l| l.id.0 == a).unwrap().out_point)).unwrap();
+    let frames: Vec<i64> = (0..fr.frame_at(Tick::from_seconds_f64(10.0))).collect();
+    let f = Frames::default();
+    let cache_all = |s: &Session| {
+        let c = f.content_of(&s.project, s.revision, comp);
+        frames.iter().for_each(|&n| insert(&f, key(c, n, 0)));
+        c
+    };
+    let cached = |c: u64| frames.iter().filter(|&&n| f.is_cached(&key(c, n, 0))).copied().collect::<Vec<_>>();
+    let before = cache_all(&s);
+    s.execute("time.set", json!({"time": 2.0})).unwrap();
+    s.execute("edit.splitLayer", json!({"layers": [a]})).unwrap();
+    let after = f.content_of(&s.project, s.revision, comp);
+    assert_ne!(after, before);
+    let kept: Vec<i64> = (0..fr.frame_at(Tick::from_seconds_f64(2.0)) - 1).chain(fr.frame_at(out) + 2..frames.len() as i64).collect();
+    assert_eq!(cached(after), kept, "the copy's half (and one frame either side) renders again; the rest stay");
+
+    s.execute("layer.setParent", json!({"layers": [b], "parent": a})).unwrap();
+    let parented = cache_all(&s);
+    s.execute("layer.timing", json!({"layers": [a], "out": 1})).unwrap();
+    // The cut (1–2 s) and the trimmed layer's child (4–10 s) render again, a frame either side;
+    // the split's copy (2–4 s) stays.
+    assert_eq!(cached(f.content_of(&s.project, s.revision, comp)), (0..=27).chain(62..=117).collect::<Vec<_>>(), "the trimmed layer's child moves where it is");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(f.content_of(&s.project, s.revision, comp), parented);
+    assert_eq!(cached(parented).len(), frames.len(), "undo finds every earlier frame");
+}
+
+/// Every frame an edit keeps renders as a fresh render of the edited project does: Solo
+/// hides the other layers at every frame, and a camera reaches the frames whose shutter
+/// samples it (#1641 review).
+#[test]
+fn the_frames_an_edit_keeps_match_a_fresh_render() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    // Cache every frame of `comp`, run `edit`, check the frames kept against fresh renders.
+    fn kept(s: &mut Session, comp: ItemId, edit: serde_json::Value) -> Vec<i64> {
+        let (fr, n) = s.project.comp(comp).map(|c| (c.frame_rate, c.frame_rate.frame_at(c.duration))).unwrap();
+        let f = Frames::default();
+        let before = f.content_of(&s.project, s.revision, comp);
+        (0..n).for_each(|i| insert(&f, key(before, i, 0)));
+        let old = s.project.clone();
+        s.execute(edit["cmd"].as_str().unwrap(), edit["params"].clone()).unwrap();
+        let after = f.content_of(&s.project, s.revision, comp);
+        let kept: Vec<i64> = (0..n).filter(|&i| f.is_cached(&key(after, i, 0))).collect();
+        let render = |p, i| Renderer::new(p, &NoFootage, RenderOpts::default()).comp_frame(comp, fr.tick_of(i));
+        for &i in &kept {
+            assert_eq!(render(&old, i), render(&s.project, i), "kept frame {i} draws other pixels now");
+        }
+        kept
+    }
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let mut s = Session::default();
+
+    // Solo on a 2–3 s layer hides the 10 s underlay everywhere; turning it off shows it again.
+    let comp = ItemId(id(s.execute("comp.new", json!({"name": "Solo", "width": 8, "height": 8, "duration": 10})).unwrap(), "comp"));
+    s.execute("layer.newSolid", json!({"comp": comp.0, "color": "#ff0000"})).unwrap();
+    let short = id(s.execute("layer.newSolid", json!({"comp": comp.0, "color": "#00ff00"})).unwrap(), "layer");
+    s.execute("layer.timing", json!({"layers": [short], "in": 2, "out": 3})).unwrap();
+    let solo = |on: bool| json!({"cmd": "layer.setSwitch", "params": {"layers": [short], "switch": "solo", "value": on}});
+    assert_eq!(kept(&mut s, comp, solo(true)), Vec::<i64>::new());
+    assert_eq!(kept(&mut s, comp, solo(false)), Vec::<i64>::new());
+
+    // The work area is a preview and render range: setting it (B, N) keeps every frame, on
+    // disk too.
+    let n = s.project.comp(comp).map(|c| c.frame_rate.frame_at(c.duration)).unwrap();
+    let disk = |s: &Session| effectcraft_engine::render::disk_cache::comp_content_key(&s.project, comp);
+    let d0 = disk(&s);
+    let work_area = |start: f64, end: f64| json!({"cmd": "comp.workArea", "params": {"comp": comp.0, "start": start, "end": end}});
+    assert_eq!(kept(&mut s, comp, work_area(1.0, 4.0)), (0..n).collect::<Vec<_>>());
+    assert_eq!(kept(&mut s, comp, work_area(2.0, 3.0)), (0..n).collect::<Vec<_>>());
+    assert_eq!(disk(&s), d0, "the disk cache keeps them");
+
+    // A 2–3 s camera over a 4 s motion-blurred 3D layer, shutter 720° at phase 360°: a frame
+    // samples 1 to 3 frames ahead, so moving the camera reaches the 3 frames before it.
+    let comp = ItemId(id(
+        s.execute("comp.new", json!({"name": "Cam", "width": 16, "height": 16, "duration": 4, "frameRate": 30, "shutterAngle": 720, "shutterPhase": 360}))
+            .unwrap(),
+        "comp",
+    ));
+    let plane = id(s.execute("layer.newSolid", json!({"comp": comp.0, "color": "#ff0000"})).unwrap(), "layer");
+    for sw in ["threeD", "motionBlur"] {
+        s.execute("layer.setSwitch", json!({"layers": [plane], "switch": sw, "value": true})).unwrap();
+    }
+    let cam = id(s.execute("layer.newCamera", json!({"comp": comp.0})).unwrap(), "layer");
+    s.execute("layer.timing", json!({"layers": [cam], "in": 2, "out": 3})).unwrap();
+    let moved = kept(&mut s, comp, json!({"cmd": "prop.set", "params": {"comp": comp.0, "layer": cam, "path": "transform/position", "value": [40, 8, -30]}}));
+    assert!(moved.contains(&0) && moved.contains(&100), "frames far from the camera stay: {moved:?}");
+    assert!(!(56..=91).any(|f| moved.contains(&f)), "frames whose shutter samples the camera render again: {moved:?}");
+}
+
+#[test]
+fn short_solid_additions_and_removals_keep_unaffected_frames() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let comp = ItemId(s.execute("comp.new", json!({"width": 8, "height": 8, "frameRate": 30, "duration": 20})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    let f = Frames::default();
+    let cache_all = |s: &Session| {
+        let content = f.content_of(&s.project, s.revision, comp);
+        (0..600).for_each(|n| insert(&f, key(content, n, 0)));
+    };
+    let cached = |s: &Session| f.cached_frames(&key(f.content_of(&s.project, s.revision, comp), 0, 0));
+    // 2–3 s, a quarter frame of the default shutter and a frame of rounding either side.
+    let kept: Vec<i64> = (0..=57).chain(92..600).collect();
+    cache_all(&s);
+    let solid = s.execute("layer.newSolid", json!({"color": "#00ff00"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.timing", json!({"layers": [solid], "in": 2, "out": 3})).unwrap();
+    assert_eq!(cached(&s), kept, "adding a source invalidates only frames 58..=91");
+    cache_all(&s);
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(cached(&s), (0..600).collect::<Vec<_>>(), "undoing the addition restores every frame");
+    s.execute("edit.redo", json!({})).unwrap();
+    s.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(cached(&s), (0..600).collect::<Vec<_>>(), "redoing the addition restores every frame");
+    s.execute("edit.clear", json!({"layers": [solid]})).unwrap();
+    assert_eq!(cached(&s), kept, "removing its layer invalidates the same span");
+}
+
+#[test]
+fn adding_a_source_does_not_hide_changes_to_existing_dependencies() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    for (command, params) in [
+        ("layer.settings", json!({"comp": "Outer", "layer": "Underlay", "color": "#0000ff"})),
+        ("prop.set", json!({"comp": "Inner", "layer": "Inner solid", "path": "transform/opacity", "value": 40})),
+    ] {
+        let mut s = Session::default();
+        let comp = ItemId(
+            s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "frameRate": 30, "duration": 20})).unwrap()["comp"].as_u64().unwrap(),
+        );
+        s.execute("layer.newSolid", json!({"name": "Underlay", "color": "#ff0000"})).unwrap();
+        s.execute("comp.new", json!({"name": "Inner", "width": 8, "height": 8, "duration": 20})).unwrap();
+        s.execute("layer.newSolid", json!({"name": "Inner solid", "color": "#00ff00"})).unwrap();
+        s.execute("comp.open", json!({"comp": "Outer"})).unwrap();
+        s.execute("layer.addItem", json!({"item": "Inner"})).unwrap();
+        let f = Frames::default();
+        let before = f.content_of(&s.project, s.revision, comp);
+        (0..600).for_each(|n| insert(&f, key(before, n, 0)));
+        s.execute(command, params).unwrap();
+        let solid = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("layer.timing", json!({"layers": [solid], "in": 2, "out": 3})).unwrap();
+        let after = f.content_of(&s.project, s.revision, comp);
+        assert!(f.cached_frames(&key(after, 0, 0)).is_empty(), "{command} changes pixels outside the added layer");
+    }
+}
+
+/// Adding, moving or deleting a marker (Num* while a preview plays) keeps the cached frames:
+/// the sound would otherwise stop at the next frame that has to be rendered again (#1083).
+/// Only expressions that read markers make them part of the pixels.
+#[test]
+fn markers_keep_the_frames_unless_an_expression_reads_them() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let inner = ItemId(id(s.execute("comp.new", json!({"name": "Inner", "width": 8, "height": 8, "duration": 2})).unwrap(), "comp"));
+    let solid = id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": "#ff0000"})).unwrap(), "layer");
+    let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "duration": 2})).unwrap(), "comp"));
+    id(s.execute("layer.addItem", json!({"comp": outer.0, "item": inner.0})).unwrap(), "layer");
+    let f = Frames::default();
+    let at = |s: &Session, c: ItemId| f.content_of(&s.project, s.revision, c);
+    let (o0, i0) = (at(&s, outer), at(&s, inner));
+    s.execute("comp.addMarker", json!({"comp": inner.0, "time": 0.5, "comment": "beat"})).unwrap();
+    s.execute("comp.addMarker", json!({"comp": outer.0, "time": 1.0})).unwrap();
+    s.execute("comp.addMarker", json!({"comp": outer.0, "time": 1.5})).unwrap();
+    assert_eq!((at(&s, outer), at(&s, inner)), (o0, i0), "comp markers");
+    s.execute("markers.set", json!({"comp": inner.0, "layer": solid, "new": true, "time": 0.25})).unwrap();
+    assert_eq!((at(&s, outer), at(&s, inner)), (o0, i0), "layer marker");
+    // An expression reading markers makes them count again.
+    s.execute("prop.setExpression", json!({"comp": inner.0, "layer": solid, "path": "transform/opacity", "expression": "thisComp.marker.numKeys"})).unwrap();
+    let (o1, i1) = (at(&s, outer), at(&s, inner));
+    assert_ne!(o1, o0);
+    s.execute("comp.addMarker", json!({"comp": inner.0, "time": 1.0})).unwrap();
+    assert_ne!(at(&s, inner), i1, "marker read by an expression");
+    assert_ne!(at(&s, outer), o1, "marker read by an expression in a nested comp");
+}
+
+/// A protected time marker with a duration sets the comp's timing (Responsive Design), so it
+/// changes the frames even though plain markers do not; and any expression, which can read
+/// markers, makes every marker count.
+#[test]
+fn timing_markers_and_expressions_still_change_the_frames() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 8, "height": 8, "duration": 1})).unwrap(), "comp"));
+    let solid = id(s.execute("layer.newSolid", json!({"comp": outer.0, "color": "#ff0000"})).unwrap(), "layer");
+    let f = Frames::default();
+    let at = |s: &Session| f.content_of(&s.project, s.revision, outer);
+    let o0 = at(&s);
+    s.execute("layer.addMarker", json!({"comp": outer.0, "layers": [solid], "time": 0.5, "comment": "beat"})).unwrap();
+    assert_eq!(at(&s), o0, "a plain marker changes no pixels, so it keeps the frames");
+    s.execute("comp.addMarker", json!({"comp": outer.0, "time": 0.25})).unwrap();
+    s.execute("markers.set", json!({"comp": outer.0, "index": 0, "duration": 0.25, "protected": true})).unwrap();
+    let o1 = at(&s);
+    assert_ne!(o1, o0, "a protected time marker with a duration sets the timing");
+    s.execute("prop.setExpression", json!({"comp": outer.0, "layer": solid, "path": "transform/opacity", "expression": "1"})).unwrap();
+    let o2 = at(&s);
+    s.execute("layer.addMarker", json!({"comp": outer.0, "layers": [solid], "time": 0.75})).unwrap();
+    assert_ne!(at(&s), o2, "an expression can read the marker, so the frames change");
+}
+
+const SRGB: effectcraft_engine::viewer::FrameEncoding =
+    effectcraft_engine::viewer::FrameEncoding { curve: effectcraft_engine::viewer::PassCurve::Srgb, hdr: effectcraft_engine::project::HdrMode::Clip };
+
+/// Half floats keep over-range values (the point of #2797); NaN becomes 0 and values past the
+/// half-float range ±65504.
+#[test]
+fn half_float_frames_keep_over_range_values() {
+    let mut img = effectcraft_engine::render::Image::new(3, 1);
+    img.data.copy_from_slice(&[[4.0, 16.0, 1.825, 1.0], [70_000.0, f32::NAN, -f32::INFINITY, 0.5], [0.1, -0.25, 1000.0, f32::NAN]]);
+    let f = F16Frame::from_image(&img, SRGB);
+    assert_eq!(f.pixel(0), Some([4.0, 16.0, half::f16::from_f32(1.825).to_f32(), 1.0]));
+    assert_eq!(f.pixel(1), Some([65504.0, 0.0, -65504.0, 0.5]));
+    let p = f.pixel(2).unwrap();
+    assert_eq!((p[2], p[3]), (1000.0, 0.0));
+    assert!((p[0] - 0.1).abs() < 1e-4 && (p[1] + 0.25).abs() < 1e-4);
+    assert_eq!(f.bytes(), 3 * F16_PIXEL_BYTES);
+}
+
+/// Oversized half-float frames take the CPU pass: display conversion, then averaging down. Linear
+/// 8 and 0 alternating in Clip mode at -2 EV is white and black (byte 128 averaged); averaging the
+/// scene values first would give 4.0 x 0.25 = 1.0, byte 255.
+#[test]
+fn oversized_half_float_frames_convert_before_averaging() {
+    use crate::display_gpu::Source;
+    use effectcraft_engine::viewer::{Channel, DisplayPass};
+    let mut img = effectcraft_engine::render::Image::new(2, 1);
+    img.data.copy_from_slice(&[[8.0, 8.0, 8.0, 1.0], [0.0, 0.0, 0.0, 1.0]]);
+    let lin =
+        effectcraft_engine::viewer::FrameEncoding { curve: effectcraft_engine::viewer::PassCurve::Linear, hdr: effectcraft_engine::project::HdrMode::Clip };
+    let f = Arc::new(F16Frame::from_image(&img, lin));
+    let pass = DisplayPass::new(Channel::Rgb, false, -2.0, lin, None);
+    let src = Source::F16(f.clone());
+    assert!(src.needs_cpu_pass(1) && !src.needs_cpu_pass(2));
+    assert!(!Source::Rgba8(Arc::new(egui::ColorImage::new([2, 1], vec![egui::Color32::WHITE; 2]))).needs_cpu_pass(1), "8-bit frames are averaged on the GPU");
+    let out = fit_texture_by(f.to_color_image(&pass), 1, 1);
+    assert_eq!(out.size, [1, 1]);
+    assert_eq!(out.pixels[0].to_array(), [128, 128, 128, 255]);
+}
+
+/// 65 536 colours spread over 0..1 (each channel on its own 16-bit grid), premultiplied by
+/// `alpha`: the 8-bit parity input.
+pub(crate) fn parity_frame(alpha: f32) -> effectcraft_engine::render::Image {
+    let mut img = effectcraft_engine::render::Image::new(256, 256);
+    for (i, p) in img.data.iter_mut().enumerate() {
+        let v = |k: usize| ((i * k) % 65_536) as f32 / 65_535.0;
+        *p = [v(1) * alpha, v(7_919) * alpha, v(104_729) * alpha, alpha];
+    }
+    img
+}
+
+/// At 0 EV the half-float viewer shows the bytes of the old 8-bit frames for values in 0..1: at
+/// least 97.9 % of the colour bytes equal (alpha all), never more than 1 apart. The rest is the
+/// half-float storage.
+#[test]
+fn half_float_frames_show_what_8_bit_frames_showed() {
+    use effectcraft_engine::viewer::{Channel, DisplayPass};
+    let pass = DisplayPass::new(Channel::Rgb, false, 0.0, SRGB, None);
+    for alpha in [1.0f32, 0.5] {
+        let img = parity_frame(alpha);
+        let f = F16Frame::from_image(&img, SRGB);
+        let new = f.to_color_image(&pass);
+        let old = to_color_image(&img);
+        let (mut same, mut total, mut max) = (0, 0, 0);
+        for (n, o) in new.pixels.iter().zip(&old.pixels) {
+            let (n, o) = (n.to_array(), o.to_array());
+            assert_eq!(n[3], o[3]);
+            for c in 0..3 {
+                total += 1;
+                same += (n[c] == o[c]) as usize;
+                max = max.max((n[c] as i32 - o[c] as i32).abs());
+            }
+        }
+        let share = same as f64 / total as f64;
+        eprintln!("alpha {alpha}: {:.2} % of colour bytes equal, max {max}", share * 100.0);
+        assert!(share >= 0.979 && max <= 1, "alpha {alpha}: {share} equal, max {max}");
+    }
+}
+
+/// The RAM preview counts half-float frames at 8 bytes a pixel: in a budget of three 8-bit
+/// frames, a half-float frame of the same size takes the room of two.
+#[test]
+fn half_float_frames_count_twice_the_bytes() {
+    let f16 = || FrameImage::CpuF16(Arc::new(F16Frame::from_image(&effectcraft_engine::render::Image::new(2, 2), SRGB)));
+    assert_eq!(f16().bytes(), 32);
+    assert_eq!(img().bytes(), 16);
+    let frames = Frames::default();
+    frames.set_budget(48);
+    for i in 0..3 {
+        frames.cache.lock().unwrap().insert(key(1, i, 0), img());
+    }
+    assert_eq!(frames.cached_frames(&key(1, 0, 0)).len(), 3);
+    frames.cache.lock().unwrap().insert(key(2, 0, 0), f16());
+    let c = frames.cache.lock().unwrap();
+    assert!(c.bytes <= 48, "{}", c.bytes);
+    assert_eq!(c.map.len(), 2, "the half-float frame took two 8-bit frames' room");
+}
+
+/// 32 bpc viewer frames go to the disk cache as half floats and come back from it bit for bit
+/// in a new session (over-range values kept); the timeline's disk bar sees them.
+#[test]
+fn half_float_frames_survive_in_the_disk_cache() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    // Removed on drop, a failed assertion included.
+    let dir = tempfile::tempdir().unwrap();
+    let disk = DiskCache::open(dir.path(), 1 << 30).unwrap();
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"width": 16, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("file.projectSettings", json!({"bitDepth": 32, "workingSpace": "srgb", "hdr": "compand"})).unwrap();
+    let lid = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layers": [lid], "effect": "Exposure"})).unwrap();
+    s.execute("prop.set", json!({"layer": lid, "path": "effects/#1/master/exposure", "value": 2.0})).unwrap();
+    let src = |disk: &Arc<DiskCache>| RenderSource {
+        project: s.project.clone(),
+        footage: s.footage.clone(),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: Some(disk.clone()),
+    };
+    let opts = RenderOpts { skip_hdr_step: true, ..Default::default() };
+    let shown = |f: &Frames, disk: &Arc<DiskCache>| {
+        let key = FrameKey {
+            revision: s.revision,
+            content: f.content_of(&s.project, s.revision, cid),
+            comp: cid.0,
+            frame: 0,
+            scale: 1000,
+            view: 0,
+            opts: opts_hash(&opts),
+        };
+        f.request_urgent(&src(disk), key, cid, Tick::ZERO, opts);
+        wait_for_renders(f);
+        match f.get(&key) {
+            Some(FrameImage::CpuF16(img)) => (key, img),
+            _ => panic!("a half-float frame"),
+        }
+    };
+    let first = Frames::default();
+    let (key, rendered) = shown(&first, &disk);
+    assert!(rendered.pixel(0).unwrap()[0] > 1.0, "over range, without the HDR step");
+    // The worker releases the frame before it queues the disk write: wait for the entry, not
+    // only for the queue to drain.
+    for _ in 0..400 {
+        disk.flush();
+        if disk.stats().entries >= 1 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(disk.stats().entries, 1, "written as a frame entry");
+    // The timeline's blue bar: on disk, not in this (new) RAM cache.
+    let again = Frames::default();
+    let key2 = FrameKey { content: again.content_of(&s.project, s.revision, cid), ..key };
+    for _ in 0..200 {
+        if !again.disk_frames(&src(&disk), &key2, 0..1, &opts).is_empty() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(again.disk_frames(&src(&disk), &key2, 0..1, &opts), vec![0]);
+    let hits = disk.stats().hits;
+    let (_, read) = shown(&again, &disk);
+    assert_eq!(disk.stats().hits, hits + 1, "read from the disk cache");
+    assert_eq!(read.bits(), rendered.bits());
+    assert_eq!(read.encoding, rendered.encoding);
+}
+
+/// The oracle for [`Comp::changed_spans`]: every frame an edit keeps renders the same in the edited
+/// project. Moves, trims, splits, deletes and duplicates of moving clips, under adjustment
+/// layers, with seeded noise, motion blur, mattes, parents and effects that read other times.
+#[test]
+fn kept_frames_render_the_same() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::render::render_frame;
+    use serde_json::{Value as Json, json};
+    fn run(s: &mut Session, cmd: &str, p: Json) -> Json {
+        s.execute(cmd, p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
+    }
+    /// Set a layer's start, in and out (frames).
+    fn timing(s: &mut Session, cid: ItemId, l: u64, start: i64, inp: i64, out: i64) {
+        let c = Arc::make_mut(&mut s.project).comp_mut(cid).unwrap();
+        let fr = c.frame_rate;
+        let l = c.layer_mut(effectcraft_engine::project::LayerId(l)).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (fr.tick_of(start), fr.tick_of(inp), fr.tick_of(out));
+    }
+    /// A 10×10 solid moving across the comp.
+    fn solid(s: &mut Session, color: &str) -> u64 {
+        let l = run(s, "layer.newSolid", json!({"color": color, "width": 10, "height": 10}))["layer"].as_u64().unwrap();
+        run(s, "prop.addKey", json!({"layer": l, "path": "transform/position", "time": 0.0, "value": [0.0, 4.0, 0.0]}));
+        run(s, "prop.addKey", json!({"layer": l, "path": "transform/position", "time": 1.5, "value": [16.0, 12.0, 0.0]}));
+        l
+    }
+    fn split(s: &mut Session, cid: ItemId, l: u64, at: i64) {
+        let fr = s.project.comp(cid).unwrap().frame_rate;
+        s.set_time(fr.tick_of(at));
+        run(s, "edit.splitLayer", json!({"layers": [l]}));
+    }
+    fn adjustment(s: &mut Session, cid: ItemId, effect: &str) -> u64 {
+        let l = run(s, "layer.newAdjustment", json!({}))["layer"].as_u64().unwrap();
+        run(s, "effect.apply", json!({"layers": [l], "effect": effect}));
+        timing(s, cid, l, 0, 10, 35);
+        l
+    }
+    /// Echo reaching 9 frames back, three times (past the shutter margin).
+    fn long_echo(s: &mut Session, l: u64) {
+        run(s, "effect.apply", json!({"layers": [l], "effect": "Echo"}));
+        run(s, "prop.set", json!({"layer": l, "path": "effects/#1/echoTime", "value": -0.3}));
+        run(s, "prop.set", json!({"layer": l, "path": "effects/#1/numberOfEchoes", "value": 3.0}));
+    }
+    // Clip a on frames 0–20, clip b on 20–40 of a 45-frame comp.
+    type Step = fn(&mut Session, ItemId, &mut Vec<u64>);
+    let none: Step = |_, _, _| {};
+    /// An audio-only file (music) and a layer of it over the whole comp.
+    fn music(s: &mut Session, cid: ItemId) -> u64 {
+        use effectcraft_engine::project::{Footage, FootageKind};
+        let song = Footage { kind: FootageKind::Audio, has_video: false, has_audio: true, ..Default::default() };
+        let song = Arc::make_mut(&mut s.project).add_item("song.wav", Default::default(), None, ItemKind::Footage(song));
+        let l = run(s, "layer.addItem", json!({"item": song.0}))["layer"].as_u64().unwrap();
+        timing(s, cid, l, 0, 0, 45);
+        l
+    }
+    /// What an edit keeps: every frame, some, or none.
+    #[derive(Debug, PartialEq)]
+    enum Keep {
+        All,
+        Part,
+        Nothing,
+    }
+    let scenarios: Vec<(&str, Step, Step, Keep)> = vec![
+        ("nudge", none, |s, c, l| timing(s, c, l[1], 21, 21, 41), Keep::Part),
+        ("trim out", none, |s, c, l| timing(s, c, l[1], 20, 20, 32), Keep::Part),
+        ("trim in", none, |s, c, l| timing(s, c, l[1], 20, 28, 40), Keep::Part),
+        ("split", none, |s, c, l| split(s, c, l[1], 30), Keep::Part),
+        ("delete", none, |s, _, l| _ = run(s, "edit.clear", json!({"layers": [l[1]]})), Keep::Part),
+        ("duplicate", none, |s, _, l| _ = run(s, "edit.duplicate", json!({"layers": [l[0]]})), Keep::Part),
+        ("adjustment trim", |s, c, l| l.push(adjustment(s, c, "Gaussian Blur")), |s, c, l| timing(s, c, l[2], 0, 10, 25), Keep::Part),
+        ("adjustment split", |s, c, l| l.push(adjustment(s, c, "Invert")), |s, c, l| split(s, c, l[2], 22), Keep::Part),
+        (
+            "adjustment fx off",
+            |s, c, l| l.push(adjustment(s, c, "Invert")),
+            |s, _, l| _ = run(s, "layer.setSwitch", json!({"layers": [l[2]], "switch": "fx", "value": false})),
+            Keep::Part,
+        ),
+        // Music changes no picture; neither does it when imported with the same action.
+        ("add music", none, |s, c, _| _ = music(s, c), Keep::All),
+        ("trim music", |s, c, l| l.push(music(s, c)), |s, c, l| timing(s, c, l[2], 0, 0, 20), Keep::All),
+        ("move music", |s, c, l| l.push(music(s, c)), |s, c, l| timing(s, c, l[2], 5, 5, 45), Keep::All),
+        ("delete music", |s, c, l| l.push(music(s, c)), |s, _, l| _ = run(s, "edit.clear", json!({"layers": [l[2]]})), Keep::All),
+        ("hide a clip", none, |s, _, l| _ = run(s, "layer.setSwitch", json!({"layers": [l[1]], "switch": "video", "value": false})), Keep::Part),
+        // Music another layer reads isn't silent: like any layer another one reads, editing
+        // it re-renders everything.
+        (
+            "trim music an audio spectrum reads",
+            |s, c, l| {
+                let m = music(s, c);
+                run(s, "effect.apply", json!({"layers": [l[0]], "effect": "Audio Spectrum"}));
+                run(s, "prop.set", json!({"layer": l[0], "path": "effects/#1/audioLayer", "value": m}));
+                l.push(m);
+            },
+            |s, c, l| timing(s, c, l[2], 0, 0, 20),
+            Keep::Nothing,
+        ),
+        (
+            "noise split",
+            |s, _, l| _ = run(s, "effect.apply", json!({"layers": [l[1]], "effect": "Fractal Noise"})),
+            |s, c, l| split(s, c, l[1], 30),
+            Keep::Part,
+        ),
+        (
+            "motion blur trim",
+            |s, c, l| {
+                Arc::make_mut(&mut s.project).comp_mut(c).unwrap().enable_motion_blur = true;
+                run(s, "layer.setSwitch", json!({"layers": [l[1]], "switch": "motionBlur", "value": true}));
+            },
+            |s, c, l| timing(s, c, l[1], 20, 20, 32),
+            Keep::Part,
+        ),
+        (
+            "matted clip trim",
+            |s, c, l| {
+                let m = solid(s, "#808080");
+                timing(s, c, m, 0, 0, 45);
+                run(s, "layer.setTrackMatte", json!({"layer": l[1], "matte": m}));
+            },
+            |s, c, l| timing(s, c, l[1], 20, 20, 32),
+            Keep::Part,
+        ),
+        (
+            "parent move",
+            |s, _, l| _ = run(s, "layer.setParent", json!({"layers": [l[0]], "parent": l[1]})),
+            |s, c, l| timing(s, c, l[1], 21, 21, 41),
+            // (the child re-renders where it is active, the rest stays)
+            Keep::Part,
+        ),
+        ("echo trim in", |s, _, l| long_echo(s, l[1]), |s, c, l| timing(s, c, l[1], 20, 28, 40), Keep::Part),
+        ("echo trim out", |s, _, l| long_echo(s, l[1]), |s, c, l| timing(s, c, l[1], 20, 20, 32), Keep::Part),
+        (
+            "posterize time trim in",
+            |s, _, l| {
+                run(s, "effect.apply", json!({"layers": [l[1]], "effect": "Posterize Time"}));
+                run(s, "prop.set", json!({"layer": l[1], "path": "effects/#1/frameRate", "value": 3.0}));
+            },
+            |s, c, l| timing(s, c, l[1], 20, 28, 40),
+            Keep::Part,
+        ),
+        (
+            "time displacement trim in",
+            |s, _, l| _ = run(s, "effect.apply", json!({"layers": [l[1]], "effect": "Time Displacement"})),
+            |s, c, l| timing(s, c, l[1], 20, 28, 40),
+            Keep::Part,
+        ),
+        // (Echo on an adjustment layer doesn't read other times yet, `FxHost::self_at`;
+        // when it does, an edit under it reaches frames after the edit.)
+        (
+            "echo adjustment nudge",
+            |s, _, l| {
+                let a = run(s, "layer.newAdjustment", json!({}))["layer"].as_u64().unwrap();
+                long_echo(s, a);
+                l.push(a);
+            },
+            |s, c, l| timing(s, c, l[1], 21, 21, 41),
+            Keep::Part,
+        ),
+    ];
+    for (name, setup, edit, expect) in scenarios {
+        let mut s = Session::default();
+        let cid = ItemId(run(&mut s, "comp.new", json!({"name": "A", "width": 16, "height": 16, "duration": 1.5}))["comp"].as_u64().unwrap());
+        let mut l = vec![solid(&mut s, "#ff0000"), solid(&mut s, "#00ff00")];
+        timing(&mut s, cid, l[0], 0, 0, 20);
+        timing(&mut s, cid, l[1], 20, 20, 40);
+        setup(&mut s, cid, &mut l);
+        let p0 = s.project.clone();
+        edit(&mut s, cid, &mut l);
+        let p1 = s.project.clone();
+        let fr = p1.comp(cid).unwrap().frame_rate;
+        let frames = fr.frame_at(p1.comp(cid).unwrap().duration);
+        let dirty = dirty_frames(&p0, &p1, cid, &p1.heard_layers().union(&p0.heard_layers()), false);
+        let kept: Vec<i64> = match &dirty {
+            Some(d) => (0..frames).filter(|f| !d.iter().any(|(lo, hi)| (*lo..=*hi).contains(f))).collect(),
+            None => vec![],
+        };
+        let got = match kept.len() as i64 {
+            0 => Keep::Nothing,
+            n if n == frames => Keep::All,
+            _ => Keep::Part,
+        };
+        assert_eq!(got, expect, "{name}: dirty {dirty:?}");
+        for f in kept {
+            let (a, b) = (render_frame(&p0, cid, fr.tick_of(f), 1.0), render_frame(&p1, cid, fr.tick_of(f), 1.0));
+            assert!(a.data == b.data, "{name}: kept frame {f} renders differently after the edit");
+        }
+    }
+}
+
+/// An edit keeps the cached frames it can't reach: nudging a clip re-renders only where it
+/// was and is, a trim only the part it cut, a split only the copy's half (its new ids seed
+/// randomness). Undo finds them all again; a clip another layer reads (its parent here) also
+/// drops the frames of that layer.
+#[test]
+fn an_edit_keeps_the_frames_it_cant_reach() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Layer, LayerId};
+    use serde_json::json;
+    type Edit = fn(&mut Comp, LayerId, &dyn Fn(i64) -> Tick);
+    let nudge: Edit = |c, b, t| {
+        let l = c.layer_mut(b).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (l.start_time + t(1), l.in_point + t(1), l.out_point + t(1));
+    };
+    let trim: Edit = |c, b, t| c.layer_mut(b).unwrap().out_point = t(75);
+    let split: Edit = |c, b, t| {
+        let i = c.layers.iter().position(|l| l.id == b).unwrap();
+        let mut copy: Layer = c.layers[i].clone();
+        copy.id = LayerId(1000);
+        copy.props.reassign_uids(&mut 1000);
+        copy.in_point = t(75);
+        c.layers[i].out_point = t(75);
+        c.layers.insert(i, copy);
+    };
+    let cut: Vec<i64> = (0..=72).chain(92..=95).collect();
+    for (edit, kept) in [(nudge, (0..=57).chain(93..=95).collect::<Vec<_>>()), (trim, cut.clone()), (split, cut)] {
+        for parented in [false, true] {
+            let mut s = Session::default();
+            let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 4})).unwrap()["comp"].as_u64().unwrap());
+            s.execute("layer.newSolid", json!({})).unwrap();
+            s.execute("layer.newSolid", json!({})).unwrap();
+            let fr = s.project.comp(cid).unwrap().frame_rate;
+            let t = |f: i64| fr.tick_of(f);
+            let b = {
+                let c = Arc::make_mut(&mut s.project).comp_mut(cid).unwrap();
+                let (a, b): (LayerId, LayerId) = (c.layers[0].id, c.layers[1].id);
+                let l = c.layer_mut(a).unwrap();
+                (l.in_point, l.out_point) = (t(0), t(30));
+                l.parent = parented.then_some(b);
+                let l = c.layer_mut(b).unwrap();
+                (l.start_time, l.in_point, l.out_point) = (t(60), t(60), t(90));
+                b
+            };
+            let p0 = s.project.clone();
+            let f = Frames::default();
+            let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+            let id0 = f.content_of(&p0, 1, cid);
+            for fr in 0..=95 {
+                insert(&f, k(id0, fr));
+            }
+            let mut p1 = p0.clone();
+            edit(Arc::make_mut(&mut p1).comp_mut(cid).unwrap(), b, &t);
+            let id1 = f.content_of(&p1, 2, cid);
+            assert_ne!(id0, id1);
+            let got = f.cached_frames(&k(id1, 0));
+            // (the child, 0–30, renders again too)
+            assert_eq!(got, if parented { kept.iter().copied().filter(|f| *f > 31).collect() } else { kept.clone() });
+            assert_eq!(f.content_of(&p0, 3, cid), id0, "undo");
+            assert_eq!(f.cached_frames(&k(id0, 0)), (0..=95).collect::<Vec<_>>());
+        }
+    }
+}
+
+/// A saved and reopened project finds its frames on disk: the content key is the same.
+#[test]
+fn disk_keys_survive_save_and_reopen() {
+    use serde_json::json;
+    let dir = std::env::temp_dir().join(format!("ec-disk-keys-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let png = dir.join("still.png");
+    image::RgbaImage::from_pixel(4, 4, image::Rgba([200, 100, 50, 255])).save(&png).unwrap();
+    let mut s = effectcraft_host::session();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "Keys", "width": 16, "height": 16, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    let item = s.execute("file.import", json!({"paths": [png.to_string_lossy()]})).unwrap()["items"][0].clone();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#00ff00", "width": 8, "height": 8})).unwrap();
+    let adj = s.execute("layer.newAdjustment", json!({})).unwrap()["layer"].clone();
+    s.execute("effect.apply", json!({"layers": [adj], "effect": "Gaussian Blur"})).unwrap();
+    let before = disk_cache::comp_content_key(&s.project, cid);
+    let path = dir.join("keys.ecproj");
+    s.execute("file.saveAs", json!({"path": path.to_string_lossy()})).unwrap();
+    let mut again = effectcraft_host::session();
+    again.execute("file.open", json!({"path": path.to_string_lossy()})).unwrap();
+    assert_eq!(disk_cache::comp_content_key(&again.project, cid), before);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Frames in RAM that the disk lacks (an edit kept them; a write was dropped) are written
+/// when idle, so the reopened project shows them all as the blue bar. The RAM series carries a
+/// Roto Brush model stamp in its opts; the disk keys are the worker's, without it.
+#[test]
+fn ram_frames_missing_on_disk_are_written() {
+    ram_frames_missing_on_disk_are_written_as(false);
+}
+
+/// Same for a 32 bpc project, whose RAM frames are half-float.
+#[test]
+fn half_float_ram_frames_missing_on_disk_are_written() {
+    ram_frames_missing_on_disk_are_written_as(true);
+}
+
+/// A RAM frame whose render started before Reload Footage dropped one of its files (#3184)
+/// holds the pixels from before: writing it later to the disk cache (an idle pass after the
+/// drop) would bring them back, also after a restart, since the file kept its size and time. It
+/// is written only with the drop generation its render started at, for the cache it started
+/// with: so it is not written, nor is a frame rendered without that cache. Frames of other files,
+/// and frames rendered after the drop, are written.
+#[test]
+fn ram_frames_from_before_a_drop_are_not_written() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::render::reads::{FileStamp, ReadFile};
+    use serde_json::json;
+    let dir = tempfile::tempdir().unwrap();
+    let disk = DiskCache::open(dir.path().join("cache"), 1 << 30).unwrap();
+    let other = DiskCache::open(dir.path().join("other"), 1 << 30).unwrap();
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("layer.newSolid", json!({})).unwrap();
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: Some(disk.clone()),
+    };
+    let f = Frames::default();
+    let series = FrameKey { revision: 1, content: f.content_of(&src.project, 1, cid), comp: cid.0, opts: opts_hash(&RenderOpts::default()), ..key(0, 0, 0) };
+    let read = |p: &str| Some(Arc::new([ReadFile::new(p, FileStamp::Native { len: 3, modified: Some(1) })].into_iter().collect::<ReadFiles>()));
+    let before = DiskSince::of(&disk, disk.drop_generation());
+    {
+        let mut c = f.cache.lock().unwrap();
+        c.insert_with(FrameKey { frame: 0, ..series }, img(), read("/a.png"), Some(before.clone()));
+        c.insert_with(FrameKey { frame: 1, ..series }, img(), read("/b.png"), Some(before));
+        c.insert_with(FrameKey { frame: 2, ..series }, img(), read("/a.png"), None);
+        c.insert_with(FrameKey { frame: 3, ..series }, img(), read("/a.png"), Some(DiskSince::of(&other, other.drop_generation())));
+    }
+    // Reload Footage of a.png.
+    disk.drop_files(["/a.png"]);
+    disk.flush();
+    f.cache.lock().unwrap().insert_with(FrameKey { frame: 4, ..series }, img(), read("/a.png"), Some(DiskSince::of(&disk, disk.drop_generation())));
+    let on_disk = |fr: i64| {
+        disk.contains(
+            disk_cache::Kind::Frame,
+            frame_disk_key(&f.content_keys, &src.project, &FrameKey { frame: fr, ..series }, opts_hash(&RenderOpts::default())),
+        )
+    };
+    // Idle passes until there is nothing left to write.
+    let mut done = false;
+    for _ in 0..1000 {
+        let more = f.persist_missing(&src, &series, &RenderOpts::default());
+        disk.flush();
+        if !more && f.persisted.lock().unwrap().is_empty() {
+            done = true;
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(done, "the idle passes end");
+    assert!(on_disk(1) && on_disk(4), "another file's frame, and a frame rendered after the drop");
+    assert!(!on_disk(0), "made of a.png as it was before the drop");
+    assert!(!on_disk(2) && !on_disk(3), "rendered without this disk cache");
+    assert_eq!(disk.stats().entries, 2);
+}
+
+fn ram_frames_missing_on_disk_are_written_as(half: bool) {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    let dir = std::env::temp_dir().join(format!("ec-persist-{}-{half}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let disk = DiskCache::open(&dir, 1 << 30).unwrap();
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("layer.newSolid", json!({})).unwrap();
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: Some(disk.clone()),
+    };
+    let f = Frames::default();
+    let series =
+        FrameKey { revision: 1, content: f.content_of(&src.project, 1, cid), comp: cid.0, opts: opts_hash(&RenderOpts::default()) ^ 1, ..key(0, 0, 0) };
+    for fr in 0..10 {
+        let frame = if half { FrameImage::CpuF16(Arc::new(F16Frame::from_image(&effectcraft_engine::render::Image::new(8, 8), SRGB))) } else { img() };
+        f.cache.lock().unwrap().insert_with(FrameKey { frame: fr, ..series }, frame, Some(Arc::default()), Some(DiskSince::of(&disk, disk.drop_generation())));
+    }
+    let on_disk = |fr: i64| {
+        disk.contains(
+            disk_cache::Kind::Frame,
+            frame_disk_key(&f.content_keys, &src.project, &FrameKey { frame: fr, ..series }, opts_hash(&RenderOpts::default())),
+        )
+    };
+    let persist = || {
+        // The content key is computed on the frame pool first.
+        for _ in 0..1000 {
+            f.persist_missing(&src, &series, &RenderOpts::default());
+            disk.flush();
+            // (`flush` waits for the disk writes, not for the conversion to forget its keys)
+            if (0..10).all(on_disk) && f.persisted.lock().unwrap().is_empty() {
+                return true;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        false
+    };
+    let evict = || {
+        disk.set_max_bytes(1);
+        disk.set_max_bytes(1 << 30);
+        assert!(!(0..10).any(on_disk));
+    };
+    assert!(persist(), "every RAM frame written");
+    assert!(!f.persist_missing(&src, &series, &RenderOpts::default()), "nothing left to write: no more idle passes");
+    // Evicted from disk: the RAM frames are written again, once.
+    evict();
+    assert!(persist(), "evicted frames written again");
+    // Reopened: a new preview cache over the same disk shows every frame in blue.
+    let reopened = Frames::default();
+    let reopened_series = FrameKey { content: reopened.content_of(&src.project, 1, cid), ..series };
+    let mut blue = vec![];
+    for _ in 0..1000 {
+        blue = reopened.disk_frames(&src, &reopened_series, 0..10, &RenderOpts::default());
+        if blue.len() == 10 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(blue, (0..10).collect::<Vec<_>>());
+    // Evicted again (a disk cache too small for them): not rewritten on every idle pass.
+    evict();
+    assert!(!f.persist_missing(&src, &series, &RenderOpts::default()), "evicted twice: no more idle passes");
+    disk.flush();
+    assert!(!(0..10).any(on_disk));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// While free disk space holds the disk cache at 0, frames are not converted or compressed for
+/// it (the frame workers spent about 8 ms per frame on writes that were then refused), and idle
+/// passes don't keep converting the RAM frames; with room again they are written.
+#[test]
+fn no_frame_is_encoded_while_the_disk_has_no_room() {
+    use effectcraft_engine::Session;
+    use serde_json::json;
+    const GB: u64 = 1 << 30;
+    let dir = std::env::temp_dir().join(format!("ec-persist-full-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let disk = DiskCache::open(&dir, 20 * GB).unwrap();
+    // 4 TB disk, 1 GB free: under the 10 GB reserve.
+    disk.set_disk_space(Some((4096 * GB, GB)));
+    assert!(!disk.accepts_writes());
+    // The frame worker's write: refused up front.
+    assert!(!put_disk_frame(&disk, 1, &img(), &ReadFiles::default(), None, disk.drop_generation()));
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("layer.newSolid", json!({})).unwrap();
+    let src = RenderSource {
+        project: s.project.clone(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: Some(disk.clone()),
+    };
+    let f = Frames::default();
+    let series =
+        FrameKey { revision: 1, content: f.content_of(&src.project, 1, cid), comp: cid.0, opts: opts_hash(&RenderOpts::default()) ^ 1, ..key(0, 0, 0) };
+    for fr in 0..10 {
+        f.cache.lock().unwrap().insert_with(FrameKey { frame: fr, ..series }, img(), Some(Arc::default()), Some(DiskSince::of(&disk, disk.drop_generation())));
+    }
+    // Idle passes: nothing to do, nothing converted.
+    for _ in 0..20 {
+        assert!(!f.persist_missing(&src, &series, &RenderOpts::default()), "no idle passes while there is no room");
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    disk.flush();
+    assert!(f.persisted.lock().unwrap().is_empty());
+    assert_eq!((disk.encodes(), disk.stats().entries), (0, 0));
+    // Room again: the RAM frames are written.
+    disk.set_disk_space(Some((4096 * GB, 500 * GB)));
+    let on_disk = |fr: i64| {
+        disk.contains(
+            disk_cache::Kind::Frame,
+            frame_disk_key(&f.content_keys, &src.project, &FrameKey { frame: fr, ..series }, opts_hash(&RenderOpts::default())),
+        )
+    };
+    let mut written = false;
+    for _ in 0..1000 {
+        f.persist_missing(&src, &series, &RenderOpts::default());
+        disk.flush();
+        if (0..10).all(on_disk) && f.persisted.lock().unwrap().is_empty() {
+            written = true;
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(written, "every RAM frame written once there is room");
+    assert_eq!(disk.encodes(), 10);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Audio changes pixels only where something draws it: a clip's Audio Levels, audio effects and
+/// Audio switch keep every frame, in RAM and on disk, until a waveform picks the clip (on another
+/// layer, on itself, or through a precomp of it); then the frames of the reader render again.
+#[test]
+fn audio_edits_keep_the_frames_until_something_draws_the_audio() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Footage, GroupKind, LayerId, Value, build};
+    use effectcraft_engine::render::disk_cache::comp_content_key;
+    use serde_json::json;
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("layer.newSolid", json!({})).unwrap();
+    let mut p = (*s.project).clone();
+    let clip =
+        p.add_item("clip.mov", effectcraft_color::Label::None, None, ItemKind::Footage(Footage { has_video: true, has_audio: true, ..Default::default() }));
+    let comp = p.comp(cid).unwrap().clone();
+    let fr = comp.frame_rate;
+    let t = move |f: i64| fr.tick_of(f);
+    let v = build::layer(&mut p, &comp, "Clip", LayerSource::Footage { item: clip }, (8, 8), None);
+    let (clip_layer, solid) = (v.id, comp.layers[0].id);
+    p.comp_mut(cid).unwrap().layers.push(v);
+    for (id, a, b) in [(solid, 0, 30), (clip_layer, 90, 120)] {
+        let l = p.comp_mut(cid).unwrap().layer_mut(id).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (t(a), t(a), t(b));
+    }
+    // The outer comp shows the whole of A.
+    let outer = p.add_item("Outer", effectcraft_color::Label::None, None, ItemKind::Comp(Arc::new(Comp { layers: Default::default(), ..comp.clone() })));
+    let oc = p.comp(outer).unwrap().clone();
+    let mut pre = build::layer(&mut p, &oc, "Pre", LayerSource::Comp { item: cid }, (8, 8), None);
+    (pre.start_time, pre.in_point, pre.out_point) = (t(0), t(0), t(120));
+    let (pre_layer, reader) = (pre.id, oc.layers.first().map(|l| l.id));
+    assert!(reader.is_none());
+    p.comp_mut(outer).unwrap().layers.push(pre);
+    // An effect on `on` (of comp `c`) that picks layer `pick`.
+    let pick = |p: &mut Project, c: ItemId, on: LayerId, pick: LayerId| {
+        let mut n = 1_000_000;
+        let mut ids = build::Ids(&mut n);
+        let mut g = ids.group("waveform", "Audio Waveform");
+        g.kind = GroupKind::Effect { effect: "ec.generate.audiowaveform".into() };
+        g.children.push(ids.prop("audioLayer", "Audio Layer", Value::Layer(Some(pick.0))).into());
+        p.comp_mut(c).unwrap().layer_mut(on).unwrap().props.group_mut("effects").unwrap().children.push(g.into());
+    };
+    let levels = |p: &mut Project| {
+        p.comp_mut(cid).unwrap().layer_mut(clip_layer).unwrap().props.prop_mut("audio/levels").unwrap().set_value_at(t(0), Value::Vec2([-6.0, -6.0]))
+    };
+    let backwards = |p: &mut Project| {
+        let mut n = 2_000_000;
+        let mut g = build::Ids(&mut n).group("backwards", "Backwards");
+        g.kind = GroupKind::Effect { effect: "ec.audio.backwards".into() };
+        p.comp_mut(cid).unwrap().layer_mut(clip_layer).unwrap().props.group_mut("effects").unwrap().children.push(g.into());
+    };
+    let mute = |p: &mut Project| p.comp_mut(cid).unwrap().layer_mut(clip_layer).unwrap().switches.audio = false;
+    // The frames of `view` an edit keeps, and whether its disk key stays.
+    let kept = |p0: &Project, view: ItemId, edit: &dyn Fn(&mut Project)| {
+        let p0 = Arc::new(p0.clone());
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: view.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&p0, 1, view);
+        (0..120).for_each(|n| insert(&f, k(id0, n)));
+        let mut p1 = p0.clone();
+        edit(Arc::make_mut(&mut p1));
+        let id1 = f.content_of(&p1, 2, view);
+        (f.cached_frames(&k(id1, 0)), comp_content_key(&p0, view) == comp_content_key(&p1, view))
+    };
+    let all: Vec<i64> = (0..120).collect();
+    let edits: [(&str, &dyn Fn(&mut Project)); 3] = [("levels", &levels), ("audio effect", &backwards), ("audio switch", &mute)];
+    for (name, edit) in edits {
+        assert_eq!(kept(&p, cid, edit), (all.clone(), true), "{name}: nothing draws the clip's audio");
+        assert_eq!(kept(&p, outer, edit), (all.clone(), true), "{name}: nor through the precomp");
+
+        let mut q = p.clone();
+        pick(&mut q, cid, solid, clip_layer);
+        let (frames, disk) = kept(&q, cid, edit);
+        assert!(!disk, "{name}: the solid draws the clip's audio");
+        assert!(frames.contains(&60) && !frames.contains(&10) && !frames.contains(&100), "{name}: the reader's and the clip's frames go: {frames:?}");
+
+        let mut q = p.clone();
+        pick(&mut q, cid, clip_layer, clip_layer);
+        let (frames, disk) = kept(&q, cid, edit);
+        assert!(!disk, "{name}: the clip draws its own audio");
+        assert!(frames.contains(&10) && frames.contains(&60) && !frames.contains(&100), "{name}: the clip's frames go: {frames:?}");
+
+        let mut q = p.clone();
+        let r = q.comp(cid).unwrap().layers[0].clone();
+        let reader = LayerId(r.id.0 + 500_000);
+        q.comp_mut(outer).unwrap().layers.insert(0, effectcraft_engine::project::Layer { id: reader, ..r });
+        pick(&mut q, outer, reader, pre_layer);
+        let (frames, disk) = kept(&q, outer, edit);
+        assert!(
+            !disk && frames.contains(&60) && !frames.contains(&10) && !frames.contains(&100),
+            "{name}: a waveform in the outer comp draws the precomp's audio: {frames:?}"
+        );
+    }
+}
+
+/// An expression reaches only the frames of its own layer: with one in the comp, an edit (here
+/// or elsewhere in the project: a trim, a rename, a marker, another comp) re-renders that layer's
+/// frames besides the edit's own, and every frame kept renders as before, expressions evaluated,
+/// also when the expression reads the edited layer.
+#[test]
+fn an_expression_reaches_only_the_frames_of_its_layer() {
+    use effectcraft_engine::project::{LayerId, Marker};
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    let mut s = effectcraft_host::session();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 16, "height": 16, "duration": 1.5})).unwrap()["comp"].as_u64().unwrap());
+    let other = ItemId(s.execute("comp.new", json!({"name": "Other", "width": 8, "height": 8, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    s.execute("comp.open", json!({"comp": cid.0})).ok();
+    let mut solid = |name: &str| {
+        let l = s.execute("layer.newSolid", json!({"comp": cid.0, "color": "#ff0000", "width": 10, "height": 10})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("layer.rename", json!({"comp": cid.0, "layer": l, "name": name})).unwrap();
+        for (t, x) in [(0.0, 0.0), (1.5, 16.0)] {
+            s.execute("prop.addKey", json!({"comp": cid.0, "layer": l, "path": "transform/position", "time": t, "value": [x, 8.0, 0.0]})).unwrap();
+        }
+        LayerId(l)
+    };
+    let (a, b, c) = (solid("A"), solid("B"), solid("C"));
+    s.execute(
+        "prop.setExpression",
+        json!({"comp": cid.0, "layer": c.0, "path": "transform/position", "expression": "thisComp.layer(\"B\").transform.position + [0, time * 4]"}),
+    )
+    .unwrap();
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    let n = fr.frame_at(s.project.comp(cid).unwrap().duration);
+    let mut p0 = (*s.project).clone();
+    for (id, i, o) in [(a, 0, 20), (b, 20, 40), (c, 40, 45)] {
+        let l = p0.comp_mut(cid).unwrap().layer_mut(id).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (fr.tick_of(i), fr.tick_of(i), fr.tick_of(o));
+    }
+    let p0 = Arc::new(p0);
+    let host = s.expr.clone().unwrap();
+    let render = |p: &Project, i: i64| {
+        let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&*host);
+        r.comp_frame(cid, fr.tick_of(i))
+    };
+    type Edit = fn(&mut Project, ItemId, ItemId, [LayerId; 3]);
+    let edits: [(&str, Edit, i64); 4] = [
+        ("trim B", |p, c, _, l| p.comp_mut(c).unwrap().layer_mut(l[1]).unwrap().out_point = p.comp(c).unwrap().frame_rate.tick_of(32), 30),
+        ("rename A", |p, c, _, l| p.comp_mut(c).unwrap().layer_mut(l[0]).unwrap().name = "Renamed".into(), 38),
+        ("comp marker", |p, c, _, _| p.comp_mut(c).unwrap().markers.push(Marker { time: Tick::ZERO, ..Default::default() }), 38),
+        ("another comp", |p, _, o, _| p.comp_mut(o).unwrap().width = 9, 38),
+    ];
+    for (name, edit, kept_from) in edits {
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&p0, 1, cid);
+        (0..n).for_each(|i| insert(&f, k(id0, i)));
+        let mut p1 = p0.clone();
+        edit(Arc::make_mut(&mut p1), cid, other, [a, b, c]);
+        let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+        // C (frames 40–45) reads anything: it renders again, the frames before it (and before a
+        // trim of B) stay.
+        assert!((0..kept_from).all(|i| kept.contains(&i)) && !kept.contains(&42), "{name}: {kept:?}");
+        for i in kept {
+            assert_eq!(render(&p0, i), render(&p1, i), "{name}: kept frame {i} draws other pixels now");
+        }
+    }
+}
+
+/// An edit inside a precomp re-renders only the frames where the precomp shows what it changed:
+/// shifted by the precomp layer's start, scaled by its stretch, and its whole span under a time
+/// remap. Every frame kept renders as before.
+#[test]
+fn an_edit_in_a_precomp_reaches_only_where_it_shows() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{LayerId, Value, build};
+    use effectcraft_engine::render::render_frame;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let inner = ItemId(id(s.execute("comp.new", json!({"name": "Inner", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap(), "comp"));
+    let solid = |s: &mut Session| {
+        let l = id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": "#ff0000", "width": 6, "height": 6})).unwrap(), "layer");
+        for (t, x) in [(0.0, 0.0), (4.0, 16.0)] {
+            s.execute("prop.addKey", json!({"comp": inner.0, "layer": l, "path": "transform/position", "time": t, "value": [x, 8.0, 0.0]})).unwrap();
+        }
+        LayerId(l)
+    };
+    let (a, b) = (solid(&mut s), solid(&mut s));
+    let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 16, "height": 16, "duration": 6, "frameRate": 30})).unwrap(), "comp"));
+    let pre = LayerId(id(s.execute("layer.addItem", json!({"comp": outer.0, "item": inner.0})).unwrap(), "layer"));
+    let fr = s.project.comp(outer).unwrap().frame_rate;
+    let t = |f: i64| fr.tick_of(f);
+    let mut p0 = (*s.project).clone();
+    for (l, i, o) in [(a, 0, 30), (b, 30, 60)] {
+        let l = p0.comp_mut(inner).unwrap().layer_mut(l).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (t(i), t(i), t(o));
+    }
+    let n = fr.frame_at(p0.comp(outer).unwrap().duration);
+    // The precomp starts at frame 15; `layout` sets its stretch and time remap.
+    let place = |p: &mut Project, stretch: f64, remap: bool| {
+        let l = p.comp_mut(outer).unwrap().layer_mut(pre).unwrap();
+        (l.start_time, l.in_point, l.out_point, l.stretch) = (t(15), t(15), t(15) + Tick((t(120).0 as f64 * stretch / 100.0) as i64), stretch);
+        if remap {
+            let mut uid = 9_000_000;
+            l.props.children.push(build::Ids(&mut uid).prop("timeRemap", "Time Remap", Value::Scalar(1.5)).into());
+        }
+    };
+    // Trim B (inner frames 30–60) to end at 45.
+    let trim = |p: &mut Project| p.comp_mut(inner).unwrap().layer_mut(b).unwrap().out_point = t(45);
+    for (name, stretch, remap, kept_frames, dirty_frames) in [
+        ("offset", 100.0, false, vec![30, 55, 80, 130], vec![60, 75]),
+        ("stretched", 200.0, false, vec![30, 100, 140, 179], vec![105, 135]),
+        ("time remap", 100.0, true, vec![5], vec![30, 100]),
+    ] {
+        let mut q = p0.clone();
+        place(&mut q, stretch, remap);
+        let q = Arc::new(q);
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: outer.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&q, 1, outer);
+        (0..n).for_each(|i| insert(&f, k(id0, i)));
+        let mut q1 = q.clone();
+        trim(Arc::make_mut(&mut q1));
+        let kept = f.cached_frames(&k(f.content_of(&q1, 2, outer), 0));
+        assert!(kept_frames.iter().all(|i| kept.contains(i)) && !dirty_frames.iter().any(|i| kept.contains(i)), "{name}: {kept:?}");
+        for i in kept {
+            assert!(
+                render_frame(&q, outer, t(i), 1.0).data == render_frame(&q1, outer, t(i), 1.0).data,
+                "{name}: kept frame {i} renders differently after the edit"
+            );
+        }
+    }
+}
+
+/// Frames only on disk (the blue bar) outlive an edit that can't change them: a rename keeps them
+/// all, a trim all but the frames it cut, and undo finds the earlier ones again.
+#[test]
+fn disk_frames_outlive_an_edit_that_cant_change_them() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::LayerId;
+    use serde_json::json;
+    let dir = std::env::temp_dir().join(format!("ec-disk-carry-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let disk = DiskCache::open(&dir, 1 << 30).unwrap();
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 1, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let a = LayerId(s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap());
+    let b = LayerId(s.execute("layer.newSolid", json!({"color": "#00ff00"})).unwrap()["layer"].as_u64().unwrap());
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    let mut p0 = (*s.project).clone();
+    for (l, i, o) in [(a, 0, 15), (b, 15, 30)] {
+        let l = p0.comp_mut(cid).unwrap().layer_mut(l).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (fr.tick_of(i), fr.tick_of(i), fr.tick_of(o));
+    }
+    let p0 = Arc::new(p0);
+    let opts = RenderOpts::default();
+    let oh = opts_hash(&opts);
+    let src = |p: &Arc<Project>| RenderSource {
+        project: p.clone(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: Some(disk.clone()),
+    };
+    // Every frame of `p0` on disk, none in RAM.
+    let content0 = disk_cache::comp_content_key(&p0, cid);
+    for f in 0..30 {
+        disk.put_frame_now(disk_cache::frame_key(content0, f, 1000, oh), 1, 1, &[1, 2, 3, 255], &ReadFiles::default());
+    }
+    let rename: fn(&mut Project, ItemId, LayerId) = |p, c, l| p.comp_mut(c).unwrap().layer_mut(l).unwrap().name = "Renamed".into();
+    let trim: fn(&mut Project, ItemId, LayerId) = |p, c, l| {
+        let fr = p.comp(c).unwrap().frame_rate;
+        p.comp_mut(c).unwrap().layer_mut(l).unwrap().out_point = fr.tick_of(22);
+    };
+    for (name, edit, layer, kept) in [("rename", rename, a, (0..30).collect::<Vec<i64>>()), ("trim", trim, b, (0..20).collect())] {
+        let f = Frames::default();
+        let series = |p: &Arc<Project>, rev: u64| FrameKey { revision: rev, content: f.content_of(p, rev, cid), comp: cid.0, opts: oh, ..key(0, 0, 0) };
+        // Blue frames of `p` once the disk carries and the content key are done.
+        let blue = |p: &Arc<Project>, rev: u64, want: &[i64]| {
+            let base = series(p, rev);
+            let mut got = vec![];
+            for _ in 0..1000 {
+                got = f.disk_frames(&src(p), &base, 0..30, &opts);
+                if got == want {
+                    break;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(5));
+            }
+            got
+        };
+        assert_eq!(blue(&p0, 1, &(0..30).collect::<Vec<_>>()), (0..30).collect::<Vec<_>>(), "{name}: before");
+        let mut p1 = p0.clone();
+        edit(Arc::make_mut(&mut p1), cid, layer);
+        assert_eq!(blue(&p1, 2, &kept), kept, "{name}: after");
+        assert_eq!(blue(&p0, 3, &(0..30).collect::<Vec<_>>()), (0..30).collect::<Vec<_>>(), "{name}: undo");
+        // A drag: an edit per paint, each paint asking for the blue bar. One carry job drains
+        // them in order, and none is left scheduled.
+        let mut p = p0.clone();
+        for rev in 4..20 {
+            Arc::make_mut(&mut p).comp_mut(cid).unwrap().layer_mut(a).unwrap().name = format!("Drag {rev}");
+            let _ = f.disk_frames(&src(&p), &series(&p, rev), 0..30, &opts);
+        }
+        assert_eq!(blue(&p, 19, &(0..30).collect::<Vec<_>>()), (0..30).collect::<Vec<_>>(), "{name}: dragged");
+        for _ in 0..1000 {
+            if !f.carry_scheduled.load(Ordering::Acquire) {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert!(!f.carry_scheduled.load(Ordering::Acquire) && f.disk_carries.lock().unwrap().is_empty(), "{name}: carry job finished");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// With expressions the disk key covers what they can read (#3184, #1492): an edit to a comp no
+/// expression names keeps every frame on disk under the same key; an edit to the comp one names
+/// gives the comp a new key, and the frames outside the layer with that expression are carried to
+/// it (the dirty spans of #2795).
+#[test]
+fn disk_frames_outlive_edits_their_expressions_cant_read() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Expression, LayerId, Value};
+    use serde_json::json;
+    let dir = std::env::temp_dir().join(format!("ec-disk-carry-expr-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let disk = DiskCache::open(&dir, 1 << 30).unwrap();
+    let mut s = Session::default();
+    let comp = |s: &mut Session, name: &str| {
+        ItemId(s.execute("comp.new", json!({"name": name, "width": 8, "height": 8, "duration": 1, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap())
+    };
+    let solid = |s: &mut Session, c: ItemId| LayerId(s.execute("layer.newSolid", json!({"comp": c.0, "color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap());
+    let cid = comp(&mut s, "A");
+    let (a, b) = (solid(&mut s, cid), solid(&mut s, cid));
+    let other = comp(&mut s, "Other");
+    let o = solid(&mut s, other);
+    let third = comp(&mut s, "Third");
+    let t = solid(&mut s, third);
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    let mut p0 = (*s.project).clone();
+    for (l, i, out) in [(a, 0, 15), (b, 15, 30)] {
+        let l = p0.comp_mut(cid).unwrap().layer_mut(l).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (fr.tick_of(i), fr.tick_of(i), fr.tick_of(out));
+    }
+    p0.comp_mut(cid).unwrap().layer_mut(a).unwrap().props.prop_mut("transform/opacity").unwrap().expr =
+        Some(Expression { text: "comp(\"Other\").layer(1).transform.opacity".into(), enabled: true });
+    let p0 = Arc::new(p0);
+    let opts = RenderOpts::default();
+    let oh = opts_hash(&opts);
+    let src = |p: &Arc<Project>| RenderSource {
+        project: p.clone(),
+        footage: Arc::new(effectcraft_engine::render::NoFootage),
+        expr: None,
+        layer_cache: Arc::default(),
+        gpu: None,
+        gpu_display: false,
+        disk: Some(disk.clone()),
+    };
+    let content0 = disk_cache::comp_content_key(&p0, cid);
+    for f in 0..30 {
+        disk.put_frame_now(disk_cache::frame_key(content0, f, 1000, oh), 1, 1, &[1, 2, 3, 255], &ReadFiles::default());
+    }
+    let opacity = |p: &mut Project, c: ItemId, l: LayerId| {
+        p.comp_mut(c).unwrap().layer_mut(l).unwrap().props.prop_mut("transform/opacity").unwrap().value = Value::Scalar(40.0)
+    };
+    for (name, edited, layer, same_key, kept) in [("Third", third, t, true, (0..30).collect::<Vec<i64>>()), ("Other", other, o, false, (17..30).collect())] {
+        let f = Frames::default();
+        let series = |p: &Arc<Project>, rev: u64| FrameKey { revision: rev, content: f.content_of(p, rev, cid), comp: cid.0, opts: oh, ..key(0, 0, 0) };
+        let blue = |p: &Arc<Project>, rev: u64, want: &[i64]| {
+            let base = series(p, rev);
+            let mut got = vec![];
+            for _ in 0..1000 {
+                got = f.disk_frames(&src(p), &base, 0..30, &opts);
+                if got == want {
+                    break;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(5));
+            }
+            got
+        };
+        assert_eq!(blue(&p0, 1, &(0..30).collect::<Vec<_>>()), (0..30).collect::<Vec<_>>(), "{name}: before");
+        let mut p1 = p0.clone();
+        opacity(Arc::make_mut(&mut p1), edited, layer);
+        assert_eq!(disk_cache::comp_content_key(&p1, cid) == content0, same_key, "{name}: the key");
+        assert_eq!(blue(&p1, 2, &kept), kept, "{name}: after");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A keyframe edit re-renders only around the keys it changed: two keys either side (auto-Bezier
+/// and continuous tangents reach the neighbouring segments), and from the layer's in point when
+/// the first key changes. A static value or an expression still reaches the whole layer. Every
+/// frame kept renders as before.
+#[test]
+fn a_keyframe_edit_reaches_only_the_keys_around_it() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{LayerId, Value};
+    use effectcraft_engine::render::render_frame;
+    use effectcraft_keyframe::Interp;
+    use serde_json::json;
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let l = s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 4, "height": 4})).unwrap()["layer"].as_u64().unwrap();
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    // Keys at frames 0, 20, 40, 60, 80, 100, zig-zagging, all auto-Bezier and continuous.
+    for (i, f) in (0..6).map(|i| (i, i * 20)) {
+        let y = if i % 2 == 0 { 3.0 } else { 13.0 };
+        s.execute("prop.addKey", json!({"layer": l, "path": "transform/position", "time": fr.tick_of(f).seconds(), "value": [2.0 + i as f64 * 2.0, y, 0.0]}))
+            .unwrap();
+    }
+    let mut p0 = (*s.project).clone();
+    for k in &mut p0.comp_mut(cid).unwrap().layer_mut(LayerId(l)).unwrap().props.prop_mut("transform/position").unwrap().keys {
+        (k.in_interp, k.out_interp, k.auto_bezier, k.continuous, k.spatial_continuous) = (Interp::Bezier, Interp::Bezier, true, true, true);
+    }
+    let p0 = Arc::new(p0);
+    let n = 120;
+    type Edit = fn(&mut effectcraft_engine::project::Property);
+    let edits: [(&str, Edit, Vec<i64>, Vec<i64>); 5] = [
+        ("middle value", |p| p.keys[3].value = Value::Vec3([8.0, 8.0, 0.0]), vec![0, 17, 103, 119], vec![22, 60, 98]),
+        ("middle interpolation", |p| p.keys[3].out_interp = Interp::Hold, vec![0, 17, 103, 119], vec![22, 60, 98]),
+        ("first value", |p| p.keys[0].value = Value::Vec3([1.0, 1.0, 0.0]), vec![43, 119], vec![0, 20, 39]),
+        ("static", |p| p.keys.clear(), vec![], vec![0, 60, 119]),
+        ("expression", |p| p.expr = Some(effectcraft_engine::project::Expression { text: "value".into(), enabled: true }), vec![], vec![0, 60, 119]),
+    ];
+    for (name, edit, kept_frames, dirty_frames) in edits {
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&p0, 1, cid);
+        (0..n).for_each(|i| insert(&f, k(id0, i)));
+        let mut p1 = p0.clone();
+        edit(Arc::make_mut(&mut p1).comp_mut(cid).unwrap().layer_mut(LayerId(l)).unwrap().props.prop_mut("transform/position").unwrap());
+        let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+        assert!(kept_frames.iter().all(|i| kept.contains(i)) && !dirty_frames.iter().any(|i| kept.contains(i)), "{name}: {kept:?}");
+        let same = |i: i64| render_frame(&p0, cid, fr.tick_of(i), 1.0).data == render_frame(&p1, cid, fr.tick_of(i), 1.0).data;
+        // (the edit shows: the check below compares something)
+        assert!(name == "expression" || !(0..n).all(same), "{name}: the edit changes no pixels");
+        for i in kept {
+            assert!(same(i), "{name}: kept frame {i} renders differently after the edit");
+        }
+    }
+}
+
+/// Music's Audio Levels keep every frame, in RAM and on disk, while the project's expressions
+/// can't read audio (a wiggle); an expression naming the music's Audio Levels re-renders its layer.
+#[test]
+fn music_volume_keeps_the_frames_with_expressions_that_dont_read_audio() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Expression, Footage, FootageKind, LayerId, Value, build};
+    use effectcraft_engine::render::disk_cache::comp_content_key;
+    use serde_json::json;
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let solid = LayerId(s.execute("layer.newSolid", json!({})).unwrap()["layer"].as_u64().unwrap());
+    let mut p = (*s.project).clone();
+    let song = p.add_item(
+        "song.wav",
+        effectcraft_color::Label::None,
+        None,
+        ItemKind::Footage(Footage { kind: FootageKind::Audio, has_video: false, has_audio: true, ..Default::default() }),
+    );
+    let comp = p.comp(cid).unwrap().clone();
+    let music = build::layer(&mut p, &comp, "Music", LayerSource::Footage { item: song }, (8, 8), None);
+    let music_id = music.id;
+    p.comp_mut(cid).unwrap().layers.push(music);
+    let kept = |text: &str| {
+        let mut p0 = p.clone();
+        p0.comp_mut(cid).unwrap().layer_mut(solid).unwrap().props.prop_mut("transform/position").unwrap().expr =
+            Some(Expression { text: text.into(), enabled: true });
+        let p0 = Arc::new(p0);
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&p0, 1, cid);
+        (0..120).for_each(|n| insert(&f, k(id0, n)));
+        let mut p1 = p0.clone();
+        Arc::make_mut(&mut p1).comp_mut(cid).unwrap().layer_mut(music_id).unwrap().props.prop_mut("audio/levels").unwrap().value = Value::Vec2([-6.0, -6.0]);
+        let id1 = f.content_of(&p1, 2, cid);
+        (f.cached_frames(&k(id1, 0)).len(), comp_content_key(&p0, cid) == comp_content_key(&p1, cid))
+    };
+    assert_eq!(kept("wiggle(2, 20)"), (120, true), "a wiggle reads no audio");
+    let (frames, disk) = kept("value + thisComp.layer(\"Music\")(\"Audio\")(\"Audio Levels\")[0]");
+    assert!(frames < 120 && !disk, "the expression reads the music's levels: {frames} frames kept, disk kept {disk}");
+}
+
+/// A Scale edit with only two keys re-renders from the other key on (values hold past it), not
+/// the layer's whole length; a full-length layer whose expression reads only itself (a wiggle)
+/// keeps its frames. Every frame kept renders as before.
+#[test]
+fn a_two_key_edit_beside_a_wiggle_keeps_the_other_frames() {
+    use effectcraft_engine::project::{Expression, LayerId, Value};
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    let mut s = effectcraft_host::session();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let wig = LayerId(s.execute("layer.newSolid", json!({"color": "#0000ff", "width": 4, "height": 4})).unwrap()["layer"].as_u64().unwrap());
+    let l = LayerId(s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 4, "height": 4})).unwrap()["layer"].as_u64().unwrap());
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    for (f, v) in [(20, 50.0), (80, 150.0)] {
+        s.execute("prop.addKey", json!({"layer": l.0, "path": "transform/scale", "time": fr.tick_of(f).seconds(), "value": [v, v, 100.0]})).unwrap();
+    }
+    let mut p0 = (*s.project).clone();
+    p0.comp_mut(cid).unwrap().layer_mut(wig).unwrap().props.prop_mut("transform/position").unwrap().expr =
+        Some(Expression { text: "wiggle(2, 3)".into(), enabled: true });
+    let p0 = Arc::new(p0);
+    let host = s.expr.clone().unwrap();
+    let render = |p: &Project, i: i64| {
+        let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&*host);
+        r.comp_frame(cid, fr.tick_of(i))
+    };
+    // (key index, frames that must stay, frames that must go)
+    for (n, keep, go) in [(1, 0..18, [21, 60, 119]), (0, 82..120, [0, 20, 79])] {
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&p0, 1, cid);
+        (0..120).for_each(|i| insert(&f, k(id0, i)));
+        let mut p1 = p0.clone();
+        Arc::make_mut(&mut p1).comp_mut(cid).unwrap().layer_mut(l).unwrap().props.prop_mut("transform/scale").unwrap().keys[n].value =
+            Value::Vec3([90.0, 90.0, 100.0]);
+        let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+        assert!(keep.clone().all(|i| kept.contains(&i)) && !go.iter().any(|i| kept.contains(i)), "key {n}: {kept:?}");
+        for i in kept {
+            assert_eq!(render(&p0, i), render(&p1, i), "key {n}: kept frame {i} draws other pixels now");
+        }
+    }
+}
+
+/// An expression that reads its own layer's markers (no other layer or comp named) re-renders
+/// that layer when one of its markers changes. Every frame kept renders as before.
+#[test]
+fn a_marker_read_by_its_own_layer_re_renders_it() {
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    let mut s = effectcraft_host::session();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let l = s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 4, "height": 4})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.setExpression", json!({"layer": l, "path": "transform/opacity", "expression": "marker.numKeys > 0 ? 0 : 100"})).unwrap();
+    let p0 = s.project.clone();
+    s.execute("markers.set", json!({"comp": cid.0, "layer": l, "new": true, "time": 3.0})).unwrap();
+    let p1 = s.project.clone();
+    let host = s.expr.clone().unwrap();
+    let fr = p0.comp(cid).unwrap().frame_rate;
+    let render = |p: &Project, i: i64| {
+        let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&*host);
+        r.comp_frame(cid, fr.tick_of(i))
+    };
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, cid);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+    assert!(!kept.contains(&0), "the layer's frames must go: {kept:?}");
+    for i in kept {
+        assert_eq!(render(&p0, i), render(&p1, i), "kept frame {i} draws other pixels now");
+    }
+}
+
+/// An expression that reads its own layer's audio re-renders that layer when its volume
+/// changes.
+#[test]
+fn a_volume_read_by_its_own_layer_re_renders_it() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{Expression, Footage, FootageKind, Value, build};
+    use serde_json::json;
+    let mut s = Session::default();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 8, "height": 8, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let mut p = (*s.project).clone();
+    let clip = p.add_item(
+        "clip.mp4",
+        effectcraft_color::Label::None,
+        None,
+        ItemKind::Footage(Footage { kind: FootageKind::Video, has_video: true, has_audio: true, width: 8, height: 8, ..Default::default() }),
+    );
+    let comp = p.comp(cid).unwrap().clone();
+    let mut layer = build::layer(&mut p, &comp, "Clip", LayerSource::Footage { item: clip }, (8, 8), None);
+    layer.props.prop_mut("transform/opacity").unwrap().expr =
+        Some(Expression { text: "100 + thisLayer(\"Audio\")(\"Audio Levels\")[0]".into(), enabled: true });
+    let id = layer.id;
+    p.comp_mut(cid).unwrap().layers.push(layer);
+    let p0 = Arc::new(p);
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, cid);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let mut p1 = p0.clone();
+    Arc::make_mut(&mut p1).comp_mut(cid).unwrap().layer_mut(id).unwrap().props.prop_mut("audio/levels").unwrap().value = Value::Vec2([-6.0, -6.0]);
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+    assert!(!kept.contains(&0), "the clip's frames must go: {kept:?}");
+}
+
+/// An expression on the keyed layer can read the keyed property at other times (Rotation
+/// reading Position a second earlier): a key edit re-renders the layer's whole length. Every
+/// frame kept renders as before.
+#[test]
+fn a_keyframe_edit_read_at_other_times_by_its_layer_re_renders_it() {
+    use effectcraft_engine::project::{LayerId, Value};
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    let mut s = effectcraft_host::session();
+    let cid = ItemId(s.execute("comp.new", json!({"name": "A", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap()["comp"].as_u64().unwrap());
+    let l = LayerId(s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 4, "height": 4})).unwrap()["layer"].as_u64().unwrap());
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    for (f, x) in [(20, 2.0), (80, 14.0)] {
+        s.execute("prop.addKey", json!({"layer": l.0, "path": "transform/position", "time": fr.tick_of(f).seconds(), "value": [x, 8.0, 0.0]})).unwrap();
+    }
+    s.execute("prop.setExpression", json!({"layer": l.0, "path": "transform/rotation", "expression": "transform.position.valueAtTime(time - 1)[0] * 3"}))
+        .unwrap();
+    let p0 = s.project.clone();
+    let host = s.expr.clone().unwrap();
+    let render = |p: &Project, i: i64| {
+        let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&*host);
+        r.comp_frame(cid, fr.tick_of(i))
+    };
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, cid);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let mut p1 = p0.clone();
+    Arc::make_mut(&mut p1).comp_mut(cid).unwrap().layer_mut(l).unwrap().props.prop_mut("transform/position").unwrap().keys[0].value =
+        Value::Vec3([8.0, 2.0, 0.0]);
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+    assert!(!kept.contains(&100), "Rotation at frame 100 reads Position at frame 70: {kept:?}");
+    for i in kept {
+        assert_eq!(render(&p0, i), render(&p1, i), "kept frame {i} draws other pixels now");
+    }
+}
+
+/// An edit two precomps down (Outer → Mid → Inner) re-renders Outer where it shows, although
+/// Mid's own comp didn't change. Every frame kept renders as before.
+#[test]
+fn an_edit_two_precomps_down_reaches_the_outer_comp() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::LayerId;
+    use effectcraft_engine::render::render_frame;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let comp = |s: &mut Session, name: &str| {
+        ItemId(id(s.execute("comp.new", json!({"name": name, "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap(), "comp"))
+    };
+    let inner = comp(&mut s, "Inner");
+    let solid = |s: &mut Session, color: &str| {
+        LayerId(id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": color, "width": 6, "height": 6})).unwrap(), "layer"))
+    };
+    let (a, b) = (solid(&mut s, "#ff0000"), solid(&mut s, "#00ff00"));
+    let mid = comp(&mut s, "Mid");
+    s.execute("layer.addItem", json!({"comp": mid.0, "item": inner.0})).unwrap();
+    let outer = comp(&mut s, "Outer");
+    s.execute("layer.addItem", json!({"comp": outer.0, "item": mid.0})).unwrap();
+    let fr = s.project.comp(outer).unwrap().frame_rate;
+    let t = |f: i64| fr.tick_of(f);
+    let mut p0 = (*s.project).clone();
+    for (l, i, o) in [(a, 0, 30), (b, 30, 60)] {
+        let l = p0.comp_mut(inner).unwrap().layer_mut(l).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (t(i), t(i), t(o));
+    }
+    let p0 = Arc::new(p0);
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: outer.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, outer);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let mut p1 = p0.clone();
+    Arc::make_mut(&mut p1).comp_mut(inner).unwrap().layer_mut(b).unwrap().out_point = t(45);
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, outer), 0));
+    assert!(kept.contains(&10) && kept.contains(&100) && !kept.contains(&50), "{kept:?}");
+    for i in kept {
+        assert!(render_frame(&p0, outer, t(i), 1.0).data == render_frame(&p1, outer, t(i), 1.0).data, "kept frame {i} renders differently after the edit");
+    }
+}
+
+/// An expression reading its own layer's in point (a fade from `inPoint`) re-renders the layer
+/// when it is trimmed, and one reading its `index` re-renders it when a short layer is added
+/// above it. Every frame kept renders as before.
+#[test]
+fn expressions_reading_their_own_layer_re_render_on_a_trim_or_a_layer_above() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::LayerId;
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    /// Trim the layer to start at frame 10.
+    fn trim(s: &mut Session, cid: ItemId, l: LayerId) {
+        let fr = s.project.comp(cid).unwrap().frame_rate;
+        Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(l).unwrap().in_point = fr.tick_of(10);
+    }
+    /// Add a solid above the layer on frames 0–5.
+    fn layer_above(s: &mut Session, cid: ItemId, _: LayerId) {
+        let fr = s.project.comp(cid).unwrap().frame_rate;
+        let a = s.execute("layer.newSolid", json!({"comp": cid.0, "color": "#00ff00", "width": 2, "height": 2})).unwrap()["layer"].as_u64().unwrap();
+        let a = Arc::make_mut(&mut s.project).comp_mut(cid).unwrap().layer_mut(LayerId(a)).unwrap();
+        (a.start_time, a.in_point, a.out_point) = (fr.tick_of(0), fr.tick_of(0), fr.tick_of(5));
+    }
+    type Edit = fn(&mut Session, ItemId, LayerId);
+    let edits: [(&str, &str, &str, Edit); 2] =
+        [("trim", "transform/opacity", "linear(time, inPoint, inPoint + 2, 20, 100)", trim), ("layer above", "transform/rotation", "index * 20", layer_above)];
+    for (name, path, expression, edit) in edits {
+        let mut s = effectcraft_host::session();
+        let new = json!({"name": "A", "width": 16, "height": 16, "duration": 4, "frameRate": 30});
+        let cid = ItemId(s.execute("comp.new", new).unwrap()["comp"].as_u64().unwrap());
+        let l = LayerId(s.execute("layer.newSolid", json!({"comp": cid.0, "color": "#ff0000", "width": 6, "height": 6})).unwrap()["layer"].as_u64().unwrap());
+        s.execute("prop.setExpression", json!({"comp": cid.0, "layer": l.0, "path": path, "expression": expression})).unwrap();
+        let p0 = s.project.clone();
+        edit(&mut s, cid, l);
+        let p1 = s.project.clone();
+        let fr = p0.comp(cid).unwrap().frame_rate;
+        let host = s.expr.clone().unwrap();
+        let render = |p: &Project, i: i64| {
+            let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+            r.expr = Some(&*host);
+            r.comp_frame(cid, fr.tick_of(i))
+        };
+        assert_ne!(render(&p0, 60), render(&p1, 60), "{name}: the edit changes frame 60");
+        let f = Frames::default();
+        let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+        let id0 = f.content_of(&p0, 1, cid);
+        (0..120).for_each(|i| insert(&f, k(id0, i)));
+        let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+        assert!(!kept.contains(&60), "{name}: frame 60 must go: {kept:?}");
+        for i in kept {
+            assert_eq!(render(&p0, i), render(&p1, i), "{name}: kept frame {i} draws other pixels now");
+        }
+    }
+}
+
+/// An expression inside a precomp reading a layer of the comp nesting it (a hidden Controls
+/// layer, `comp("Main").layer("Controls")`) re-renders where the precomp shows it when that
+/// layer changes. Every frame kept renders as before.
+#[test]
+fn an_edit_read_by_a_precomp_expression_reaches_the_precomp() {
+    use effectcraft_engine::project::LayerId;
+    use effectcraft_engine::render::NoFootage;
+    use serde_json::json;
+    let mut s = effectcraft_host::session();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let new_comp = |s: &mut effectcraft_engine::Session, name: &str| {
+        ItemId(id(s.execute("comp.new", json!({"name": name, "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap(), "comp"))
+    };
+    let inner = new_comp(&mut s, "Inner");
+    let dot = id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": "#ff0000", "width": 6, "height": 6})).unwrap(), "layer");
+    s.execute(
+        "prop.setExpression",
+        json!({"comp": inner.0, "layer": dot, "path": "transform/opacity", "expression": "comp(\"Main\").layer(\"Controls\").transform.rotation"}),
+    )
+    .unwrap();
+    let main = new_comp(&mut s, "Main");
+    s.execute("layer.addItem", json!({"comp": main.0, "item": inner.0})).unwrap();
+    let controls = json!({"comp": main.0, "name": "Controls", "color": "#0000ff", "width": 2, "height": 2});
+    let controls = LayerId(id(s.execute("layer.newSolid", controls).unwrap(), "layer"));
+    // (hidden, and short: the precomp reads it at every frame all the same)
+    let fr = s.project.comp(main).unwrap().frame_rate;
+    let c = Arc::make_mut(&mut s.project).comp_mut(main).unwrap().layer_mut(controls).unwrap();
+    (c.switches.video, c.start_time, c.in_point, c.out_point) = (false, fr.tick_of(0), fr.tick_of(0), fr.tick_of(10));
+    let p0 = s.project.clone();
+    s.execute("prop.set", json!({"comp": main.0, "layer": controls.0, "path": "transform/rotation", "value": 60.0})).unwrap();
+    let p1 = s.project.clone();
+    let host = s.expr.clone().unwrap();
+    let render = |p: &Project, i: i64| {
+        let mut r = Renderer::new(p, &NoFootage, RenderOpts::default());
+        r.expr = Some(&*host);
+        r.comp_frame(main, fr.tick_of(i))
+    };
+    assert_ne!(render(&p0, 60), render(&p1, 60), "the dot's opacity follows Controls");
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: main.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, main);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, main), 0));
+    assert!(!kept.contains(&60), "the precomp's frames must go: {kept:?}");
+    for i in kept {
+        assert_eq!(render(&p0, i), render(&p1, i), "kept frame {i} draws other pixels now");
+    }
+}
+
+/// An edit inside a precomp whose layer runs Echo (it reads the precomp at earlier times)
+/// re-renders the precomp layer's whole span, not only where the precomp shows the edit. Every
+/// frame kept renders as before.
+#[test]
+fn an_edit_in_a_precomp_under_a_time_effect_reaches_its_whole_layer() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::LayerId;
+    use effectcraft_engine::render::render_frame;
+    use serde_json::json;
+    let mut s = Session::default();
+    let id = |v: serde_json::Value, k: &str| v[k].as_u64().unwrap();
+    let inner = ItemId(id(s.execute("comp.new", json!({"name": "Inner", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap(), "comp"));
+    let solid = |s: &mut Session, color: &str| {
+        LayerId(id(s.execute("layer.newSolid", json!({"comp": inner.0, "color": color, "width": 6, "height": 6})).unwrap(), "layer"))
+    };
+    let (a, b) = (solid(&mut s, "#ff0000"), solid(&mut s, "#00ff00"));
+    let outer = ItemId(id(s.execute("comp.new", json!({"name": "Outer", "width": 16, "height": 16, "duration": 4, "frameRate": 30})).unwrap(), "comp"));
+    let pre = id(s.execute("layer.addItem", json!({"comp": outer.0, "item": inner.0})).unwrap(), "layer");
+    // Echo reaching 9 frames back, once (more echoes of one solid add up past full and look alike).
+    s.execute("effect.apply", json!({"comp": outer.0, "layers": [pre], "effect": "Echo"})).unwrap();
+    s.execute("prop.set", json!({"comp": outer.0, "layer": pre, "path": "effects/#1/echoTime", "value": -0.3})).unwrap();
+    let fr = s.project.comp(outer).unwrap().frame_rate;
+    let t = |f: i64| fr.tick_of(f);
+    let mut p0 = (*s.project).clone();
+    for (l, i, o) in [(a, 0, 30), (b, 30, 60)] {
+        let l = p0.comp_mut(inner).unwrap().layer_mut(l).unwrap();
+        (l.start_time, l.in_point, l.out_point) = (t(i), t(i), t(o));
+    }
+    let p0 = Arc::new(p0);
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: outer.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, outer);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let mut p1 = p0.clone();
+    Arc::make_mut(&mut p1).comp_mut(inner).unwrap().layer_mut(b).unwrap().out_point = t(45);
+    let same = |i: i64| render_frame(&p0, outer, t(i), 1.0).data == render_frame(&p1, outer, t(i), 1.0).data;
+    assert!(!same(65), "Echo at frame 65 shows frame 56, which the trim removed");
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, outer), 0));
+    assert!(!kept.contains(&65), "{kept:?}");
+    for i in kept {
+        assert!(same(i), "kept frame {i} renders differently after the edit");
+    }
+}
+
+/// A keyframe edit beside muted keys reaches back to the nearest keys that play: muted keys are
+/// skipped, so the segment the edited key ends can start far before the two keys before it.
+/// Every frame kept renders as before.
+#[test]
+fn a_keyframe_edit_beside_muted_keys_reaches_the_keys_that_play() {
+    use effectcraft_engine::Session;
+    use effectcraft_engine::project::{LayerId, Value};
+    use effectcraft_engine::render::render_frame;
+    use serde_json::json;
+    let mut s = Session::default();
+    let new = json!({"name": "A", "width": 16, "height": 16, "duration": 4, "frameRate": 30});
+    let cid = ItemId(s.execute("comp.new", new).unwrap()["comp"].as_u64().unwrap());
+    let l = LayerId(s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 4, "height": 4})).unwrap()["layer"].as_u64().unwrap());
+    let fr = s.project.comp(cid).unwrap().frame_rate;
+    // Keys at frames 0, 20, 40, 60, 80, 100; the ones at 20 and 40 muted.
+    for i in 0..6 {
+        let add = json!({"layer": l.0, "path": "transform/position", "time": fr.tick_of(i * 20).seconds(), "value": [2.0 + i as f64 * 2.0, 8.0, 0.0]});
+        s.execute("prop.addKey", add).unwrap();
+    }
+    let mut p0 = (*s.project).clone();
+    for k in p0.comp_mut(cid).unwrap().layer_mut(l).unwrap().props.prop_mut("transform/position").unwrap().keys.iter_mut().skip(1).take(2) {
+        k.muted = true;
+    }
+    let p0 = Arc::new(p0);
+    let mut p1 = p0.clone();
+    Arc::make_mut(&mut p1).comp_mut(cid).unwrap().layer_mut(l).unwrap().props.prop_mut("transform/position").unwrap().keys[3].value =
+        Value::Vec3([8.0, 2.0, 0.0]);
+    let same = |i: i64| render_frame(&p0, cid, fr.tick_of(i), 1.0).data == render_frame(&p1, cid, fr.tick_of(i), 1.0).data;
+    assert!(!same(10), "the edited key's segment starts at frame 0");
+    let f = Frames::default();
+    let k = |content: u64, frame: i64| FrameKey { content, comp: cid.0, ..key(0, frame, 0) };
+    let id0 = f.content_of(&p0, 1, cid);
+    (0..120).for_each(|i| insert(&f, k(id0, i)));
+    let kept = f.cached_frames(&k(f.content_of(&p1, 2, cid), 0));
+    assert!(!kept.contains(&10), "{kept:?}");
+    for i in kept {
+        assert!(same(i), "kept frame {i} renders differently after the edit");
+    }
+}
+
+/// Disk-cache frame entries that keep the source files they were made of (#3184): a sequence
+/// comp in a folder of its own, with a large unused sequence in the project.
+mod frame_files {
+    use super::*;
+    use effectcraft_engine::project::{Footage, FootageKind, build};
+    use effectcraft_engine::time::FrameRate;
+    use std::path::{Path, PathBuf};
+    use std::sync::atomic::AtomicUsize;
+
+    const RATE: FrameRate = FrameRate::FPS_30;
+    const FRAMES: i64 = 5;
+
+    /// A fresh folder for test `name` (on the build drive, not the system temp folder), deleted
+    /// when the guard is dropped.
+    fn folder(name: &str) -> tempfile::TempDir {
+        let target = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target");
+        std::fs::create_dir_all(&target).unwrap();
+        tempfile::Builder::new().prefix(&format!("test-frame-files-{name}-")).tempdir_in(target).unwrap()
+    }
+
+    /// A flat grey PNG of `level` at `path`.
+    fn png(path: &Path, level: u8) -> String {
+        image::RgbaImage::from_pixel(16, 8, image::Rgba([level, level, level, 255])).save(path).unwrap();
+        path.to_string_lossy().to_string()
+    }
+
+    /// The grey level of sequence frame `i` as first written.
+    fn level(i: i64) -> u8 {
+        20 + i as u8 * 30
+    }
+
+    /// A project with a comp showing a sequence of [`FRAMES`] PNGs (in `dir/seq`) and, unused, a
+    /// sequence of 5000 frames that don't even exist. The files of the shown sequence.
+    fn project(dir: &Path) -> (Arc<Project>, ItemId, Vec<String>) {
+        let seq_dir = dir.join("seq");
+        std::fs::create_dir_all(&seq_dir).unwrap();
+        let files: Vec<String> = (0..FRAMES).map(|i| png(&seq_dir.join(format!("f_{i:04}.png")), level(i))).collect();
+        let mut seq = Footage { kind: FootageKind::Sequence, sequence: files.clone(), frame_rate: RATE, ..effectcraft_media::probe(&files[0]).unwrap() };
+        seq.sync_sequence_duration();
+        let unused = Footage {
+            kind: FootageKind::Sequence,
+            sequence: (0..5000).map(|i| dir.join("unused").join(format!("big_{i:05}.exr")).to_string_lossy().to_string()).collect(),
+            frame_rate: RATE,
+            width: 16,
+            height: 8,
+            has_video: true,
+            ..Default::default()
+        };
+        let mut p = Project::default();
+        p.add_item("Unused", effectcraft_engine::color::Label::Aqua, None, ItemKind::Footage(unused));
+        let item = p.add_item("Seq", effectcraft_engine::color::Label::Aqua, None, ItemKind::Footage(seq));
+        let mut comp = Comp::new(16, 8, RATE, RATE.tick_of(FRAMES));
+        comp.layers = vec![build::layer(&mut p, &comp, "Seq", LayerSource::Footage { item }, (16, 8), Some(comp.duration))].into();
+        let cid = p.add_item("C", effectcraft_engine::color::Label::None, None, ItemKind::Comp(comp.into()));
+        (Arc::new(p), cid, files)
+    }
+
+    /// A session over the disk cache in `dir`: a new preview cache, media pool, layer cache and
+    /// disk cache instance (as after reopening the project), counting the calls of the hook for
+    /// files served from memory.
+    struct Session {
+        frames: Frames,
+        src: RenderSource,
+        disk: Arc<DiskCache>,
+        hook_calls: Arc<AtomicUsize>,
+        /// The session's media pool (`src.footage`): what it decoded and opened.
+        pool: Arc<effectcraft_media::MediaPool>,
+    }
+
+    fn session(p: &Arc<Project>, dir: &Path) -> Session {
+        let disk = DiskCache::open(dir.join("cache"), 1 << 30).unwrap();
+        let hook_calls = Arc::new(AtomicUsize::new(0));
+        let mut frames = Frames::default();
+        let calls = hook_calls.clone();
+        frames.set_virtual_id(Arc::new(move |_| {
+            calls.fetch_add(1, Ordering::Relaxed);
+            None
+        }));
+        let pool = Arc::new(effectcraft_media::MediaPool::new());
+        let src = RenderSource {
+            project: p.clone(),
+            footage: pool.clone(),
+            expr: None,
+            layer_cache: Arc::default(),
+            gpu: None,
+            gpu_display: false,
+            disk: Some(disk.clone()),
+        };
+        Session { frames, src, disk, hook_calls, pool }
+    }
+
+    impl Session {
+        fn key(&self, cid: ItemId, frame: i64) -> FrameKey {
+            FrameKey {
+                revision: 1,
+                content: self.frames.content_of(&self.src.project, 1, cid),
+                comp: cid.0,
+                frame,
+                scale: 1000,
+                view: 0,
+                opts: opts_hash(&RenderOpts::default()),
+            }
+        }
+
+        /// Show `frames` of `cid` (rendered or read from disk); the grey level of each, once
+        /// their disk writes are done.
+        fn show(&self, cid: ItemId, frames: &[i64]) -> Vec<u8> {
+            for &f in frames {
+                self.frames.request(&self.src, self.key(cid, f), cid, RATE.tick_of(f), RenderOpts::default());
+            }
+            wait_for_renders(&self.frames);
+            // (the worker queues the write after it has released the frame)
+            for _ in 0..400 {
+                self.disk.flush();
+                if frames.iter().all(|f| self.disk.contains(disk_cache::Kind::Frame, self.disk_key(cid, *f))) {
+                    break;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(5));
+            }
+            frames
+                .iter()
+                .map(|f| match self.frames.get(&self.key(cid, *f)) {
+                    Some(FrameImage::Cpu(c)) => c.pixels[0].r(),
+                    _ => panic!("frame {f}: an 8-bit CPU frame"),
+                })
+                .collect()
+        }
+
+        fn disk_key(&self, cid: ItemId, frame: i64) -> u128 {
+            frame_disk_key(&self.frames.content_keys, &self.src.project, &self.key(cid, frame), opts_hash(&RenderOpts::default()))
+        }
+
+        /// (disk hits, disk misses) so far.
+        fn hits(&self) -> (u64, u64) {
+            let s = self.disk.stats();
+            (s.hits, s.misses)
+        }
+    }
+
+    fn close(a: u8, b: u8) -> bool {
+        a.abs_diff(b) <= 2
+    }
+
+    /// Give `path` a modification time `secs` later, contents and size unchanged.
+    fn touch(path: &str, secs: u64) {
+        let t = std::fs::metadata(path).unwrap().modified().unwrap() + std::time::Duration::from_secs(secs);
+        std::fs::File::options().append(true).open(path).unwrap().set_modified(t).unwrap();
+    }
+
+    /// Correct: a source file of the sequence changes (new contents and size; or only a new
+    /// time): exactly the frames that read it render again and their entries are replaced; the
+    /// others come from disk, also after reopening.
+    #[test]
+    fn a_changed_source_file_re_renders_exactly_its_frames() {
+        let tmp = folder("correct");
+        let dir = tmp.path();
+        let (p, cid, files) = project(dir);
+        let all: Vec<i64> = (0..FRAMES).collect();
+        let first = session(&p, dir);
+        let shown = first.show(cid, &all);
+        assert!(all.iter().all(|f| close(shown[*f as usize], level(*f))), "{shown:?}");
+        assert_eq!(first.hits(), (0, FRAMES as u64), "rendered, nothing on disk yet");
+        assert_eq!(first.disk.stats().entries, FRAMES as usize, "every frame stored");
+        drop(first);
+        // Frame 2's file gets new pixels (and size), frame 3's only a new time.
+        png(Path::new(&files[2]), 250);
+        touch(&files[3], 30);
+        let second = session(&p, dir);
+        let shown = second.show(cid, &all);
+        assert!(close(shown[2], 250), "frame 2 shows its new file: {shown:?}");
+        assert!([0, 1, 3, 4].iter().all(|f| close(shown[*f as usize], level(*f))), "{shown:?}");
+        assert_eq!(second.hits(), (3, 2), "frames 0, 1 and 4 from disk; 2 and 3 rendered again");
+        assert_eq!(second.disk.file_checks(), FRAMES as u64, "one file checked per frame read");
+        assert_eq!(second.disk.stats().entries, FRAMES as usize, "the entries of 2 and 3 were replaced");
+        drop(second);
+        // Reopened: every frame from disk, the replaced ones with their new pixels.
+        let third = session(&p, dir);
+        let shown = third.show(cid, &all);
+        assert_eq!(third.hits(), (FRAMES as u64, 0));
+        assert!(close(shown[2], 250) && close(shown[3], level(3)), "{shown:?}");
+    }
+
+    /// Reopened (a new preview cache, media pool, layer cache and disk cache on the same folder):
+    /// the frame comes from disk, its one source file is checked (a `metadata` call), and no
+    /// source file is opened or decoded for it.
+    #[test]
+    fn a_reopened_project_serves_its_frame_from_disk_without_opening_a_source_file() {
+        let tmp = folder("reopen");
+        let dir = tmp.path();
+        let (p, cid, _) = project(dir);
+        let first = session(&p, dir);
+        let shown = first.show(cid, &[1]);
+        assert!(close(shown[0], level(1)), "{shown:?}");
+        assert!(first.pool.stats().misses > 0, "the first session decodes the frame's file: {:?}", first.pool.stats());
+        assert!(first.disk.contains(disk_cache::Kind::Frame, first.disk_key(cid, 1)));
+        drop(first);
+        let again = session(&p, dir);
+        let shown = again.show(cid, &[1]);
+        assert!(close(shown[0], level(1)), "{shown:?}");
+        assert_eq!(again.hits(), (1, 0), "served from disk");
+        assert_eq!(again.disk.file_checks(), 1, "its one file checked");
+        assert_eq!(again.pool.stats(), effectcraft_media::PoolStats::default(), "no source file opened or decoded");
+    }
+
+    /// No scan: opening a comp of a project that also holds a large sequence, and showing a
+    /// frame, looks only at the files that frame reads; the comp's key looks at no file (it
+    /// stays the same when its files change, and never asks for the identity of a path).
+    #[test]
+    fn showing_a_frame_checks_only_the_files_it_reads() {
+        let tmp = folder("no-scan");
+        let dir = tmp.path();
+        let (p, cid, files) = project(dir);
+        let key = disk_cache::comp_content_key(&p, cid);
+        png(Path::new(&files[1]), 99);
+        touch(&files[2], 5);
+        assert_eq!(disk_cache::comp_content_key(&p, cid), key, "the key looks at no file");
+        let first = session(&p, dir);
+        first.show(cid, &[2]);
+        drop(first);
+        let again = session(&p, dir);
+        // (the indicator's key is computed off the UI thread first)
+        let mut blue = vec![];
+        for _ in 0..400 {
+            blue = again.frames.disk_frames(&again.src, &again.key(cid, 0), 0..FRAMES, &RenderOpts::default());
+            if !blue.is_empty() {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert_eq!(blue, vec![2], "the blue bar: present entries, no file looked at");
+        assert_eq!(again.disk.file_checks(), 0, "the indicator checks no file");
+        let shown = again.show(cid, &[2]);
+        assert!(close(shown[0], level(2)), "{shown:?}");
+        assert_eq!(again.hits(), (1, 0));
+        assert_eq!(again.disk.file_checks(), 1, "only the file frame 2 read");
+        assert_eq!(again.hook_calls.load(Ordering::Relaxed), 0, "no path of the unused sequence was asked about");
+    }
+
+    /// The frame entry files under the cache folder.
+    fn entries(dir: &Path) -> Vec<PathBuf> {
+        let mut out = vec![];
+        let mut stack = vec![dir.join("cache")];
+        while let Some(d) = stack.pop() {
+            for e in std::fs::read_dir(&d).into_iter().flatten().flatten() {
+                let p = e.path();
+                if p.is_dir() {
+                    stack.push(p);
+                } else if p.extension().is_some_and(|x| x == "ecc") && p.to_string_lossy().contains("frames") {
+                    out.push(p);
+                }
+            }
+        }
+        out
+    }
+
+    /// Safe: a missing source file, an unreadable one (a folder in its place) and a damaged
+    /// cache entry never serve the frame from before; each is rendered again and stored anew.
+    #[test]
+    fn missing_or_unreadable_files_and_damaged_entries_never_serve_a_stale_frame() {
+        let tmp = folder("safe");
+        let dir = tmp.path();
+        let (p, cid, files) = project(dir);
+        let first = session(&p, dir);
+        first.show(cid, &[0]);
+        assert_eq!(first.disk.stats().entries, 1);
+        drop(first);
+        // Missing: not served; the frame is rendered without it.
+        std::fs::remove_file(&files[0]).unwrap();
+        let missing = session(&p, dir);
+        let shown = missing.show(cid, &[0]);
+        assert!(!close(shown[0], level(0)), "the frame from before was served: {shown:?}");
+        assert_eq!(missing.hits(), (0, 1));
+        drop(missing);
+        // Back, with other pixels: the entry made while it was missing is not served either.
+        png(Path::new(&files[0]), 180);
+        let back = session(&p, dir);
+        let shown = back.show(cid, &[0]);
+        assert!(close(shown[0], 180), "{shown:?}");
+        assert_eq!(back.hits(), (0, 1));
+        drop(back);
+        // Unreadable (a folder in its place).
+        std::fs::remove_file(&files[0]).unwrap();
+        std::fs::create_dir(&files[0]).unwrap();
+        let unreadable = session(&p, dir);
+        let shown = unreadable.show(cid, &[0]);
+        assert!(!close(shown[0], 180), "the frame from before was served: {shown:?}");
+        assert_eq!(unreadable.hits(), (0, 1));
+        drop(unreadable);
+        std::fs::remove_dir(&files[0]).unwrap();
+        png(Path::new(&files[0]), 120);
+        let fresh = session(&p, dir);
+        assert!(close(fresh.show(cid, &[0])[0], 120));
+        drop(fresh);
+        // A damaged entry: a miss, rendered, stored again, then served.
+        let found = entries(dir);
+        assert_eq!(found.len(), 1, "{found:?}");
+        let mut bytes = std::fs::read(&found[0]).unwrap();
+        let n = bytes.len() / 2;
+        bytes[n] ^= 0x5a;
+        std::fs::write(&found[0], bytes).unwrap();
+        let damaged = session(&p, dir);
+        assert!(close(damaged.show(cid, &[0])[0], 120));
+        assert_eq!(damaged.hits(), (0, 1));
+        drop(damaged);
+        let healed = session(&p, dir);
+        assert!(close(healed.show(cid, &[0])[0], 120));
+        assert_eq!(healed.hits(), (1, 0), "the rewritten entry is used");
+    }
+}
diff --git a/crates/ui-egui/src/header.rs b/crates/ui-egui/src/header.rs
index fb381cfd3..140a0bbaf 100644
--- a/crates/ui-egui/src/header.rs
+++ b/crates/ui-egui/src/header.rs
@@ -12,21 +12,34 @@ use crate::widgets;
 use crate::{Dialog, EffectcraftApp};
 use effectcraft_color::BlendMode;
 use effectcraft_engine::commands::shape_tool::{PaintKind, ToolPaint};
+use effectcraft_engine::geom::vec2 as gv2;
 use effectcraft_engine::project::{LayerId, LayerSource, PropGroup};
 use effectcraft_engine::viewer as vw;
 
+/// Draws the Tools bar into `rect`: brand (About), Home, the tool slots with their fly-out
+/// menus and press-and-hold picks, options for the active tool (shape paint, puppet, roto),
+/// Snapping, then Discord, GitHub, website, appearance and workspace controls. Clicks apply
+/// tool, dialog, theme and workspace changes to `app` or run their commands.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let p = ui.painter().clone();
     p.rect_filled(rect, 0.0, t.header_bg);
     p.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.app_bg));
     let cy = rect.center().y;
-    let mut x = rect.min.x + if app.integrated_titlebar && !app.ui.show_menu_bar { 80.0 } else { 10.0 };
+    let x = rect.min.x + if app.integrated_titlebar && !app.ui.show_menu_bar { 80.0 } else { 10.0 };
+    let x = brand_and_home(app, ui, &p, x, cy);
+    let x = tool_slots(app, ui, &p, x, cy);
+    let x = tool_options_bar(app, ui, &p, x + 10.0, cy);
+    let x = snapping_toggle(app, ui, &p, x, cy);
+    right_side(app, ui, &p, rect, x, cy);
+}
 
-    // Brand mark.
+/// The brand mark (About) and the Home button; returns the x after them.
+fn brand_and_home(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, mut x: f32, cy: f32) -> f32 {
+    let t = app.tokens;
     let brand = Rect::from_min_size(pos2(x, cy - 12.0), vec2(24.0, 24.0));
-    paint_logo(&p, brand);
-    let bresp = ui.interact(brand, egui::Id::new("brand"), Sense::click());
+    paint_logo(p, brand);
+    let bresp = ui.interact(brand, egui::Id::unique("brand"), Sense::click());
     app.auto.add_response("header.about", &bresp, "About EffectCraft");
     widgets::focus_outline(ui, &bresp, &t);
     if bresp.on_hover_text(tr("About EffectCraft")).clicked() {
@@ -34,87 +47,27 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     x += 32.0;
 
-    // Home.
     let home = Rect::from_min_size(pos2(x, cy - 13.0), vec2(26.0, 26.0));
-    let home_response = widgets::icon_button(ui, home, Icon::Home, app.ui.start_screen, &t, egui::Id::new("tool-home")).on_hover_text(tr("Home"));
+    let home_response = widgets::icon_button(ui, home, Icon::Home, app.ui.start_screen, &t, egui::Id::unique("tool-home")).on_hover_text(tr("Home"));
     app.auto.add_response("header.home", &home_response, "Home");
     if home_response.clicked() {
         app.ui.start_screen = !app.ui.start_screen;
     }
     x += 30.0;
     p.line_segment([pos2(x, cy - 10.0), pos2(x, cy + 10.0)], Stroke::new(1.0, t.separator));
-    x += 6.0;
+    x + 6.0
+}
 
-    // Tool slots (with group separators after camera tools and pan-behind).
-    let held_id = egui::Id::new("tool-slot-held");
+/// The tool slots (with group separators after camera tools and pan-behind); returns the x after them.
+fn tool_slots(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, mut x: f32, cy: f32) -> f32 {
+    let t = app.tokens;
+    let held_id = egui::Id::unique("tool-slot-held");
     if ui.input(|i| i.pointer.any_pressed()) {
         ui.data_mut(|d| d.remove::<egui::Id>(held_id));
     }
     for (si, slot) in Tool::SLOTS.iter().enumerate() {
-        let cur = app.ui.slot_tools.get(si).copied().unwrap_or(slot[0]);
         let r = Rect::from_min_size(pos2(x, cy - 13.0), vec2(26.0, 26.0));
-        let active = slot.contains(&app.ui.tool);
-        let id = egui::Id::new(("tool-slot", si));
-        let resp = widgets::icon_button(ui, r, cur.icon(), active, &t, id);
-        if slot.len() > 1 {
-            // Flyout corner triangle.
-            p.add(egui::Shape::convex_polygon(
-                vec![pos2(r.max.x - 2.0, r.max.y - 6.0), pos2(r.max.x - 2.0, r.max.y - 2.0), pos2(r.max.x - 6.0, r.max.y - 2.0)],
-                if active { Color32::WHITE } else { t.text_dim },
-                Stroke::NONE,
-            ));
-        }
-        app.auto.add_response(&format!("tools.{cur:?}"), &resp, cur.label());
-        let tip = match cur.shortcut() {
-            Some(s) => format!("{} ({})", cur.label(), crate::menus::shortcut_text(s)),
-            None => cur.label().to_string(),
-        };
-        let resp = resp.on_hover_text(tip);
-        let held = ui.data(|d| d.get_temp::<egui::Id>(held_id)) == Some(id);
-        if resp.clicked() && !held {
-            app.ui.tool = cur;
-        }
-        // Ctrl+double-click Pan Behind: Center Anchor Point in Layer Content.
-        if cur == Tool::PanBehind
-            && resp.double_clicked()
-            && ui.input(|i| i.modifiers.command)
-            && let Err(e) = crate::menus::invoke(app, ui.ctx(), "layer.centerAnchor", json!({}))
-        {
-            app.ui.status = e;
-        }
-        if slot.len() > 1 {
-            let held_for = resp.is_pointer_button_down_on().then(|| ui.input(|i| i.pointer.press_start_time().map(|s| i.time - s))).flatten();
-            if let Some(seconds) = held_for
-                && seconds < 0.35
-            {
-                ui.ctx().request_repaint_after(std::time::Duration::from_secs_f64(0.35 - seconds));
-            }
-            let long_press = held_for.is_some_and(|seconds| seconds >= 0.35) && !held;
-            let command = if resp.secondary_clicked() || long_press {
-                if long_press {
-                    ui.data_mut(|d| d.insert_temp(held_id, id));
-                }
-                Some(egui::SetOpenCommand::Bool(true))
-            } else if resp.clicked() && !held {
-                Some(egui::SetOpenCommand::Bool(false))
-            } else {
-                None
-            };
-            let close_behavior = if held && resp.clicked() { egui::PopupCloseBehavior::IgnoreClicks } else { egui::PopupCloseBehavior::CloseOnClickOutside };
-            egui::Popup::menu(&resp).style(crate::widgets::menu_style).open_memory(command).close_behavior(close_behavior).show(|ui| {
-                for tool in slot.iter() {
-                    let row = ui.selectable_label(app.ui.tool == *tool, tool.label());
-                    app.auto.add(&format!("tools.select.{tool:?}"), row.rect, tool.label());
-                    if row.clicked() {
-                        app.ui.tool = *tool;
-                        if let Some(saved) = app.ui.slot_tools.get_mut(si) {
-                            *saved = *tool;
-                        }
-                        ui.close();
-                    }
-                }
-            });
-        }
+        tool_slot(app, ui, p, si, slot, r, held_id);
         x += 28.0;
         if matches!(si, 2 | 5 | 7 | 10 | 13) {
             x += 4.0;
@@ -122,17 +75,148 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             x += 6.0;
         }
     }
+    x
+}
 
-    // Tool options.
-    x += 10.0;
-    // Selected shape layers: the options show their paint and edit it (as in After Effects).
-    let shape_layers: Vec<u64> = app
-        .session
+/// One tool slot button in `r`: select on click, Ctrl+double-click Pan Behind, and the fly-out.
+fn tool_slot(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, si: usize, slot: &[Tool], r: Rect, held_id: egui::Id) {
+    let t = app.tokens;
+    let cur = app.ui.slot_tools.get(si).copied().unwrap_or(slot[0]);
+    let active = slot.contains(&app.ui.tool);
+    let id = egui::Id::unique(("tool-slot", si));
+    let resp = widgets::icon_button(ui, r, cur.icon(), active, &t, id);
+    if slot.len() > 1 {
+        // Flyout corner triangle.
+        p.add(egui::Shape::convex_polygon(
+            vec![pos2(r.max.x - 2.0, r.max.y - 6.0), pos2(r.max.x - 2.0, r.max.y - 2.0), pos2(r.max.x - 6.0, r.max.y - 2.0)],
+            if active { Color32::WHITE } else { t.text_dim },
+            Stroke::NONE,
+        ));
+    }
+    app.auto.add_response(&format!("tools.{cur:?}"), &resp, cur.label());
+    // The drawn tooltip asks the catalog; the automation label above keeps the English name.
+    let label = crate::i18n::tr(cur.label());
+    let tip = match cur.shortcut() {
+        Some(s) => format!("{} ({})", label, crate::menus::shortcut_text(s)),
+        None => label.to_string(),
+    };
+    let resp = resp.on_hover_text(tip);
+    let held = ui.data(|d| d.get_temp::<egui::Id>(held_id)) == Some(id);
+    // Plain click selects the shown tool; Alt/Option-click cycles the flyout slot
+    // (After Effects / Photoshop parity with the Shift+letter key cycle).
+    // Prefer the primary-release event's modifiers: Alt may already be up by the
+    // time this frame reads i.modifiers. When a double-click lands as two releases
+    // in one frame, the earlier release is the first click.
+    let releases: Vec<egui::Modifiers> = ui.input(|i| {
+        i.events
+            .iter()
+            .filter_map(|e| match e {
+                egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: false, modifiers, .. } if resp.rect.contains(*pos) => {
+                    Some(*modifiers)
+                }
+                _ => None,
+            })
+            .collect()
+    });
+    let click_mods = releases.last().copied().unwrap_or_else(|| ui.input(|i| i.modifiers));
+    let alt = click_mods.alt;
+    let modified = click_mods.alt || click_mods.shift || click_mods.ctrl || click_mods.command;
+    // egui's double-click ignores modifiers: remember whether the previous click
+    // was modified so create-on-double-click only runs for two plain clicks.
+    let prev_mod_id = id.with("click-mod");
+    let prev_modified = match releases.len() {
+        n if n >= 2 => {
+            let m = releases[n - 2];
+            m.alt || m.shift || m.ctrl || m.command
+        }
+        _ => ui.data(|d| d.get_temp::<bool>(prev_mod_id)).unwrap_or(false),
+    };
+    let slot_click = resp.clicked() && !held;
+    if slot_click {
+        let pick = if slot.len() > 1 && alt {
+            let from = if slot.contains(&app.ui.tool) { app.ui.tool } else { cur };
+            let i = slot.iter().position(|t| *t == from).unwrap_or(0);
+            slot[(i + 1) % slot.len()]
+        } else {
+            cur
+        };
+        app.ui.tool = pick;
+        if let Some(saved) = app.ui.slot_tools.get_mut(si) {
+            *saved = pick;
+        }
+    }
+    // Ctrl+double-click Pan Behind: Center Anchor Point in Layer Content.
+    if cur == Tool::PanBehind
+        && resp.double_clicked()
+        && click_mods.command
+        && let Err(e) = crate::menus::invoke(app, ui.ctx(), "layer.centerAnchor", json!({}))
+    {
+        app.ui.status = e;
+    } else if resp.double_clicked()
+        && !modified
+        && !prev_modified
+        && let Some((id, params)) = create_on_double_click(app, cur)
+        && let Err(e) = crate::menus::invoke(app, ui.ctx(), id, params)
+    {
+        app.ui.status = e;
+    }
+    if slot_click {
+        ui.data_mut(|d| d.insert_temp(prev_mod_id, modified));
+    }
+    if slot.len() > 1 {
+        slot_flyout(app, ui, si, slot, &resp, held_id);
+    }
+}
+
+/// The fly-out menu of a multi-tool slot: right-click or press-and-hold opens it.
+fn slot_flyout(app: &mut EffectcraftApp, ui: &mut egui::Ui, si: usize, slot: &[Tool], resp: &egui::Response, held_id: egui::Id) {
+    let id = resp.id;
+    let held = ui.data(|d| d.get_temp::<egui::Id>(held_id)) == Some(id);
+    let held_for = resp.is_pointer_button_down_on().then(|| ui.input(|i| i.pointer.press_start_time().map(|s| i.time - s))).flatten();
+    if let Some(seconds) = held_for
+        && seconds < 0.35
+    {
+        ui.ctx().request_repaint_after(std::time::Duration::from_secs_f64(0.35 - seconds));
+    }
+    let long_press = held_for.is_some_and(|seconds| seconds >= 0.35) && !held;
+    let command = if resp.secondary_clicked() || long_press {
+        if long_press {
+            ui.data_mut(|d| d.insert_temp(held_id, id));
+        }
+        Some(egui::SetOpenCommand::Bool(true))
+    } else if resp.clicked() && !held {
+        Some(egui::SetOpenCommand::Bool(false))
+    } else {
+        None
+    };
+    let close_behavior = if held && resp.clicked() { egui::PopupCloseBehavior::IgnoreClicks } else { egui::PopupCloseBehavior::CloseOnClickOutside };
+    egui::Popup::menu(resp).style(crate::widgets::menu_style).open_memory(command).close_behavior(close_behavior).show(|ui| {
+        for tool in slot.iter() {
+            let row = ui.selectable_label(app.ui.tool == *tool, crate::i18n::tr(tool.label()));
+            app.auto.add(&format!("tools.select.{tool:?}"), row.rect, tool.label());
+            if row.clicked() {
+                app.ui.tool = *tool;
+                if let Some(saved) = app.ui.slot_tools.get_mut(si) {
+                    *saved = *tool;
+                }
+                ui.close();
+            }
+        }
+    });
+}
+
+/// The ids of the selected shape layers: the options show their paint and edit it.
+fn selected_shape_layers(app: &EffectcraftApp) -> Vec<u64> {
+    app.session
         .active_comp()
         .map(|c| {
             app.session.state.selected_layers.iter().filter(|id| c.layer(**id).is_some_and(|l| matches!(l.source, LayerSource::Shape))).map(|id| id.0).collect()
         })
-        .unwrap_or_default();
+        .unwrap_or_default()
+}
+
+/// Mirrors the first selected shape layer's paint into the shape tool (as in After Effects).
+fn sync_layer_paint(app: &mut EffectcraftApp, shape_layers: &[u64]) {
     let layer_paint = shape_layers.first().and_then(|id| app.session.active_comp()?.layer(LayerId(*id))).map(|l| {
         let lt = l.layer_time(app.session.time());
         (effectcraft_engine::commands::shape_stroke::first_paint(l, lt), effectcraft_engine::commands::shape_stroke::first_paint_kinds(l, lt))
@@ -150,6 +234,13 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         tool.stroke_width = width.unwrap_or(0.0);
     }
+}
+
+/// Options for the active tool (shape creation, fill and stroke, puppet, roto); returns the x after them.
+fn tool_options_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, mut x: f32, cy: f32) -> f32 {
+    // Selected shape layers: the options show their paint and edit it (as in After Effects).
+    let shape_layers = selected_shape_layers(app);
+    sync_layer_paint(app, &shape_layers);
     // One undo step per picker session or width drag: end the merge once both are done.
     let picking = ["fill", "stroke"].iter().any(|k| widgets::popup_is_open(ui, picker_id(k)));
     if !picking && !ui.input(|i| i.pointer.any_down()) && app.session.history.merge_key.as_deref().is_some_and(|k| k.starts_with("tool-")) {
@@ -163,35 +254,58 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // Fill and Stroke, hidden while the tools draw masks.
     let masking = drawing && !shape_layers.is_empty() && app.session.state.shape_tool.creates_mask;
     if (drawing || !shape_layers.is_empty()) && !masking {
-        x = fill_stroke_options(app, ui, &p, &shape_layers, x, cy);
+        x = fill_stroke_options(app, ui, p, &shape_layers, x, cy);
     }
     if app.ui.tool.puppet_kind().is_some() {
-        x = puppet_options(app, ui, &p, x, cy);
+        x = puppet_options(app, ui, p, x, cy);
     }
     if app.ui.tool.roto_kind(false).is_some() {
-        x = roto_options(app, ui, &p, x, cy);
+        x = roto_options(app, ui, p, x, cy);
     }
+    x
+}
+
+/// The Snapping checkbox, its label and options menu; returns the x where it started.
+fn snapping_toggle(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, x: f32, cy: f32) -> f32 {
+    let t = app.tokens;
     let snap = Rect::from_min_size(pos2(x, cy - 10.0), vec2(20.0, 20.0));
     // The engine owns snapping (View ▸ Snapping); the checkbox mirrors it.
     app.ui.snapping = app.session.state.snapping;
-    if widgets::checkbox(ui, snap, app.ui.snapping, &t, egui::Id::new("snapping")).clicked() {
+    let snap_resp = widgets::checkbox(ui, snap, app.ui.snapping, &t, egui::Id::unique("snapping"));
+    crate::a11y::check_box(&snap_resp, tr("Snapping"), app.ui.snapping, true);
+    if snap_resp.changed() {
         let _ = app.session.execute("view.snapping", serde_json::json!({}));
         app.ui.snapping = app.session.state.snapping;
     }
     app.auto.add("header.snapping", snap, "Snapping");
     let label = p.text(pos2(snap.max.x + 4.0, cy), Align2::LEFT_CENTER, tr("Snapping"), Tokens::ui(12.0), t.text_dim);
     snapping_options(app, ui, Rect::from_min_size(pos2(label.max.x + 2.0, cy - 9.0), vec2(18.0, 18.0)));
+    x
+}
 
-    // Right side: community buttons, workspaces.
-    let mut rx = rect.max.x - 10.0;
+/// Right side: community buttons, appearance and workspaces; `left` is where the tools end.
+fn right_side(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, rect: Rect, left: f32, cy: f32) {
+    let t = app.tokens;
+    let rx = community_buttons(app, ui, p, rect.max.x - 10.0, cy);
+    let mut rx = appearance_button(app, ui, rx, cy);
+    rx -= 10.0;
+    p.line_segment([pos2(rx, cy - 10.0), pos2(rx, cy + 10.0)], Stroke::new(1.0, t.separator));
+    rx -= 10.0;
+    let rx = workspace_menu(app, ui, p, rx, cy);
+    workspace_tabs(app, ui, p, rx, left, cy);
+}
+
+/// The Discord pill and the GitHub and website buttons, right to left from `rx`; returns the new `rx`.
+fn community_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, mut rx: f32, cy: f32) -> f32 {
+    let t = app.tokens;
     // The pill fits its label (icon, gap, text) with even padding: it was a fixed 104 px with the
     // text at its left, which left a wide gap on the right (#581).
     let label = p.layout_no_wrap(tr("Discord").to_string(), Tokens::semibold(12.0), Color32::WHITE);
     let discord = Rect::from_min_max(pos2(rx - (10.0 + 14.0 + 6.0 + label.size().x + 12.0), cy - 13.0), pos2(rx, cy + 13.0));
-    let dresp = ui.interact(discord, egui::Id::new("hdr-discord"), Sense::click());
+    let dresp = ui.interact(discord, egui::Id::unique("hdr-discord"), Sense::click());
     let dc = Color32::from_rgb(0x58, 0x65, 0xf2);
     p.rect_filled(discord, 13.0, if dresp.hovered() { dc.gamma_multiply(1.2) } else { dc });
-    icons::paint(&p, Rect::from_center_size(pos2(discord.min.x + 17.0, cy), vec2(14.0, 14.0)), Icon::Chat, Color32::WHITE);
+    icons::paint(p, Rect::from_center_size(pos2(discord.min.x + 17.0, cy), vec2(14.0, 14.0)), Icon::Chat, Color32::WHITE);
     p.galley(pos2(discord.min.x + 30.0, cy - label.size().y / 2.0), label, Color32::WHITE);
     app.auto.add("header.discord", discord, "Join the ArtCraft Discord");
     if dresp.on_hover_text(tr("Join the ArtCraft community on Discord")).clicked() {
@@ -202,13 +316,19 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         [("hdr-github", Icon::Code, "EffectCraft on GitHub", "help.github"), ("hdr-web", Icon::Globe, "EffectCraft on getartcraft.com", "help.appPage")]
     {
         let r = Rect::from_min_max(pos2(rx - 26.0, cy - 13.0), pos2(rx, cy + 13.0));
-        if widgets::icon_button(ui, r, icon, false, &t, egui::Id::new(id)).on_hover_text(tip).clicked() {
+        if widgets::icon_button(ui, r, icon, false, &t, egui::Id::unique(id)).on_hover_text(tip).clicked() {
             let _ = app.session.execute(cmd, json!({}));
         }
         app.auto.add(&format!("header.{}", &id[4..]), r, tip);
         rx = r.min.x - 4.0;
     }
-    // Appearance: Sync with System, Light, Dark (a monitor, sun or moon), one click to the next.
+    rx
+}
+
+/// Appearance: Sync with System, Light, Dark (a monitor, sun or moon), one click to the next;
+/// returns the new `rx`.
+fn appearance_button(app: &mut EffectcraftApp, ui: &mut egui::Ui, rx: f32, cy: f32) -> f32 {
+    let t = app.tokens;
     let (icon, mode) = match app.session.prefs.appearance.appearance_mode.as_str() {
         "auto" => (Icon::Monitor, tr("Sync with System")),
         "light" => (Icon::Sun, tr("Light")),
@@ -216,72 +336,81 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     };
     let tip = tr_args("Appearance Mode: {}", &[&mode]);
     let r = Rect::from_min_max(pos2(rx - 26.0, cy - 13.0), pos2(rx, cy + 13.0));
-    let response = widgets::icon_button(ui, r, icon, false, &t, egui::Id::new("hdr-appearance")).on_hover_text(&tip);
+    let response = widgets::icon_button(ui, r, icon, false, &t, egui::Id::unique("hdr-appearance")).on_hover_text(&tip);
     if response.clicked() {
         app.cycle_appearance(ui.ctx());
     }
-    response.context_menu(|ui| {
-        let settings = ui.button(tr("Appearance Settings…"));
-        app.auto.add("header.appearanceSettings", settings.rect, "Appearance Settings…");
-        if settings.clicked() {
-            crate::panels::settings::open(app, "appearance");
-            ui.close();
-        }
-        let favorites = app.session.prefs.appearance.favorite_themes.clone();
-        for options in [effectcraft_engine::prefs::LIGHT_THEMES, effectcraft_engine::prefs::DARK_THEMES] {
-            let group: Vec<_> = options.iter().filter(|(_, id)| favorites.iter().any(|saved| saved == id)).collect();
-            if !group.is_empty() {
-                ui.separator();
-            }
-            for (label, id) in group {
-                let r = ui.selectable_label(app.ui.theme.name() == *id, tr(label));
-                app.auto.add(&format!("header.favoriteTheme.{id}"), r.rect, label);
-                if r.clicked() {
-                    if let Some(kind) = crate::theme::ThemeKind::from_name(id) {
-                        app.set_theme(ui.ctx(), kind);
-                    }
-                    ui.close();
-                }
-            }
-        }
-    });
+    response.context_menu(|ui| appearance_menu(app, ui));
     app.auto.add("header.appearance", r, &tip);
-    rx = r.min.x - 4.0;
-    rx -= 10.0;
-    p.line_segment([pos2(rx, cy - 10.0), pos2(rx, cy + 10.0)], Stroke::new(1.0, t.separator));
-    rx -= 10.0;
-    // Workspace tabs (right to left), with a » menu of all.
+    r.min.x - 4.0
+}
+
+/// The appearance button's context menu: settings and the favorite themes.
+fn appearance_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
+    let settings = ui.button(tr("Appearance Settings…"));
+    app.auto.add("header.appearanceSettings", settings.rect, "Appearance Settings…");
+    if settings.clicked() {
+        crate::panels::settings::open(app, "appearance");
+        ui.close();
+    }
+    let favorites = app.session.prefs.appearance.favorite_themes.clone();
+    for options in [effectcraft_engine::prefs::LIGHT_THEMES, effectcraft_engine::prefs::DARK_THEMES] {
+        let group: Vec<_> = options.iter().filter(|(_, id)| favorites.iter().any(|saved| saved == id)).collect();
+        if !group.is_empty() {
+            ui.separator();
+        }
+        for (label, id) in group {
+            let r = ui.selectable_label(app.ui.theme.name() == *id, tr(label));
+            app.auto.add(&format!("header.favoriteTheme.{id}"), r.rect, label);
+            if r.clicked() {
+                if let Some(kind) = crate::theme::ThemeKind::from_name(id) {
+                    app.set_theme(ui.ctx(), kind);
+                }
+                ui.close();
+            }
+        }
+    }
+}
+
+/// The » button with the menu of all workspaces; returns the new `rx`.
+fn workspace_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, rx: f32, cy: f32) -> f32 {
+    let t = app.tokens;
     let more = Rect::from_min_max(pos2(rx - 20.0, cy - 11.0), pos2(rx, cy + 11.0));
-    let mresp = ui.interact(more, egui::Id::new("ws-more"), Sense::click());
+    let mresp = ui.interact(more, egui::Id::unique("ws-more"), Sense::click());
     p.text(more.center(), Align2::CENTER_CENTER, "»", Tokens::ui(15.0), if mresp.hovered() { t.text } else { t.text_dim });
     app.auto.add("header.workspaces", more, "Workspaces");
-    crate::widgets::context_menu(&mresp, |ui| ws_menu(app, ui));
+    let current = app.ui.workspace.clone();
+    crate::widgets::context_menu(&mresp, |ui| ws_menu(app, ui, &current));
     if mresp.clicked() {
-        widgets::open_popup(ui, egui::Id::new("ws-pop"));
+        widgets::open_popup(ui, egui::Id::unique("ws-pop"));
     }
-    let names: Vec<String> = crate::dock::WORKSPACES.iter().map(|s| s.to_string()).collect();
+    let names: Vec<String> = crate::dock::WORKSPACES.iter().map(|s| crate::i18n::command_label("window.workspace", s).to_string()).collect();
     if let Some(i) = widgets::popup_menu(
         ui,
-        egui::Id::new("ws-pop"),
+        egui::Id::unique("ws-pop"),
         more.left_bottom() - vec2(140.0, 0.0),
         &names,
         crate::dock::WORKSPACES.iter().position(|w| *w == app.ui.workspace),
     ) {
         app.set_workspace(crate::dock::WORKSPACES[i]);
     }
-    rx = more.min.x - 6.0;
-    // After Effects 2026's workspace bar order (right to left here): Default, Review, Learn,
-    // Small Screen, Standard.
+    more.min.x - 6.0
+}
+
+/// Workspace tabs, right to left from `rx`, stopping 120 px right of `left`.
+/// After Effects 2026's order (right to left here): Default, Review, Learn, Small Screen, Standard.
+fn workspace_tabs(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, mut rx: f32, left: f32, cy: f32) {
+    let t = app.tokens;
     let shown = ["Standard", "Small Screen", "Learn", "Review", "Default"];
     for name in shown {
-        let g = p.layout_no_wrap(name.to_string(), Tokens::ui(12.0), t.text);
+        let g = p.layout_no_wrap(crate::i18n::command_label("window.workspace", name).to_string(), Tokens::ui(12.0), t.text);
         let w = g.size().x + 16.0;
         let r = Rect::from_min_max(pos2(rx - w, cy - 13.0), pos2(rx, cy + 13.0));
-        if r.min.x < x + 120.0 {
+        if r.min.x < left + 120.0 {
             break;
         }
         let active = app.ui.workspace == name;
-        let resp = ui.interact(r, egui::Id::new(("ws", name)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("ws", name)), Sense::click());
         let col = if active {
             t.hot_text
         } else if resp.hovered() {
@@ -298,6 +427,62 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             app.set_workspace(name);
         }
         rx = r.min.x - 2.0;
+        // Right-clicking a workspace opens the same options as the » button, which is where After
+        // Effects keeps them (reset, save, save a copy, edit).
+        let target = name.to_string();
+        crate::widgets::context_menu(&resp, |ui| ws_menu(app, ui, &target));
+    }
+}
+
+/// Double-clicking a creation tool in the Tools bar makes an instance of what it draws, as in
+/// After Effects (#1072): a text layer from the Type tools; from the shape tools, a shape that
+/// fills the comp — into the selected shape layer's Contents, as a mask on the selected layer
+/// (any non-shape layer, or Tool Creates Mask), or as a new shape layer when neither applies.
+fn create_on_double_click(app: &EffectcraftApp, tool: Tool) -> Option<(&'static str, serde_json::Value)> {
+    match tool {
+        // `invoke` turns empty params into an insertion point in the comp centre that starts
+        // editing (#866), which is what double-clicking the Type tool should do.
+        Tool::Type | Tool::TypeVertical => Some(("layer.newText", json!({}))),
+        Tool::Rectangle | Tool::RoundedRect | Tool::Ellipse | Tool::Polygon | Tool::Star => {
+            let kind = match tool {
+                Tool::Rectangle => "rect",
+                Tool::RoundedRect => "rounded",
+                Tool::Ellipse => "ellipse",
+                Tool::Polygon => "polygon",
+                _ => "star",
+            };
+            // Without a comp the command still runs and reports its error on the status line.
+            let Some(comp) = app.session.active_comp() else {
+                return Some(("shape.newShape", json!({"kind": kind})));
+            };
+            let (cw, ch) = (comp.width as f64, comp.height as f64);
+            // Rectangles and ellipses fill the comp; a Polystar's Outer Radius is half the comp
+            // height (Inner Radius: a quarter of it), so it gets a comp-height square.
+            let (w, h) = if matches!(tool, Tool::Polygon | Tool::Star) { (ch, ch) } else { (cw, ch) };
+            // A mask on the selected layer: any non-shape layer (the tool switches to Mask by
+            // itself), or a shape layer while Tool Creates Mask is on — as dragging does.
+            let sel = app.session.state.selected_layers.first().copied().and_then(|id| comp.layer(id));
+            if let Some(l) = sel.filter(|l| l.source.is_av() && (app.session.state.shape_tool.creates_mask || !matches!(l.source, LayerSource::Shape))) {
+                // The box in layer space, so a moved, scaled or rotated layer still gets a
+                // comp-filling mask: all four corners are mapped, and their bounds are the
+                // smallest axis-aligned box around the comp box.
+                let ctx = effectcraft_engine::render::EvalCtx::new(&app.session.project, app.session.active_comp_id()?, comp, app.session.time());
+                let inv = ctx.layer_to_comp(l).0.inverse().unwrap_or(effectcraft_engine::geom::Mat3::IDENTITY);
+                let (x0, y0, x1, y1) = (cw / 2.0 - w / 2.0, ch / 2.0 - h / 2.0, cw / 2.0 + w / 2.0, ch / 2.0 + h / 2.0);
+                let pts = [gv2(x0, y0), gv2(x1, y0), gv2(x1, y1), gv2(x0, y1)].map(|p| inv.apply(p));
+                let (mut lo, mut hi) = ([f64::INFINITY; 2], [f64::NEG_INFINITY; 2]);
+                for p in pts {
+                    lo = [lo[0].min(p.x), lo[1].min(p.y)];
+                    hi = [hi[0].max(p.x), hi[1].max(p.y)];
+                }
+                let rect = [lo[0], lo[1], hi[0] - lo[0], hi[1] - lo[1]];
+                return Some(("layer.addMask", json!({"layer": l.id.0, "shape": kind, "rect": rect})));
+            }
+            // Into the selected shape layer's Contents, else a new shape layer (the engine's own
+            // target), painted with the Tools bar's Fill and Stroke.
+            Some(("shape.newShape", json!({"kind": kind, "size": [w, h]})))
+        }
+        _ => None,
     }
 }
 
@@ -305,8 +490,8 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
 /// Features in Collapsed Compositions and Text Layers (`view.snappingOptions`).
 fn snapping_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect) {
     let t = app.tokens;
-    let pop = egui::Id::new("snap-options");
-    if widgets::icon_button(ui, r, Icon::ChevronDown, false, &t, egui::Id::new("snap-options-button")).on_hover_text(tr("Snapping options")).clicked() {
+    let pop = egui::Id::unique("snap-options");
+    if widgets::icon_button(ui, r, Icon::ChevronDown, false, &t, egui::Id::unique("snap-options-button")).on_hover_text(tr("Snapping options")).clicked() {
         widgets::open_popup(ui, pop);
     }
     app.auto.add("header.snappingOptions", r, "Snapping options");
@@ -349,7 +534,7 @@ fn gradient_colors(app: &EffectcraftApp, layers: &[u64], paint: &str) -> Option<
 
 /// The colour picker of the Fill or Stroke swatch.
 fn picker_id(key: &str) -> egui::Id {
-    egui::Id::new(("tool-pick", key))
+    egui::Id::unique(("tool-pick", key))
 }
 
 /// Tool Creates Shape / Tool Creates Mask: with a shape layer selected, whether the shape tools
@@ -359,7 +544,7 @@ fn creates_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, mut x: f32, cy:
     for (mask, icon, tip, key) in [(false, Icon::ShapeLayer, "Tool Creates Shape", "createsShape"), (true, Icon::MaskVis, "Tool Creates Mask", "createsMask")] {
         let r = Rect::from_min_size(pos2(x, cy - 13.0), vec2(26.0, 26.0));
         let on = app.session.state.shape_tool.creates_mask == mask;
-        if widgets::icon_button(ui, r, icon, on, &t, egui::Id::new(("tool-creates", key))).on_hover_text(tip).clicked() {
+        if widgets::icon_button(ui, r, icon, on, &t, egui::Id::unique(("tool-creates", key))).on_hover_text(tip).clicked() {
             tool_options(app, json!({"createsMask": mask}));
         }
         app.auto.add(&format!("header.{key}"), r, tip);
@@ -388,14 +573,14 @@ fn fill_stroke_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Pa
         let options = format!("{title} Options");
         let g = p.layout_no_wrap(format!("{title}:"), Tokens::ui(12.0), t.text_dim);
         let wr = Rect::from_min_size(pos2(x, cy - g.size().y / 2.0), g.size());
-        let wresp = ui.interact(wr, egui::Id::new(("tool-paint-word", key)), Sense::click()).on_hover_text(&options);
+        let wresp = ui.interact(wr, egui::Id::unique(("tool-paint-word", key)), Sense::click()).on_hover_text(&options);
         let col = if wresp.hovered() { t.text } else { t.text_dim };
         if wresp.hovered() {
             p.line_segment([pos2(wr.min.x, wr.max.y), pos2(wr.max.x - 3.0, wr.max.y)], Stroke::new(1.0, col));
         }
         p.galley_with_override_text_color(wr.min, g, col);
         app.auto.add(&format!("header.{key}Options"), wr, &options);
-        let opts = egui::Id::new(("tool-paint-options", key));
+        let opts = egui::Id::unique(("tool-paint-options", key));
         if wresp.clicked() {
             widgets::open_popup(ui, opts);
         }
@@ -403,7 +588,7 @@ fn fill_stroke_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Pa
         // the Gradient Editor (the selected shape layer's Gradient Fill / Gradient Stroke), and
         // opens the options otherwise; Alt-click steps through the kinds (as in After Effects).
         let sr = Rect::from_min_size(pos2(wr.max.x + 6.0, cy - 8.0), vec2(20.0, 16.0));
-        let sresp = ui.interact(sr, egui::Id::new(("tool-paint-swatch", key)), Sense::click()).on_hover_text(format!("{title}: {}", tp.kind.label()));
+        let sresp = ui.interact(sr, egui::Id::unique(("tool-paint-swatch", key)), Sense::click()).on_hover_text(format!("{title}: {}", tp.kind.label()));
         paint_swatch(p, sr, &tp, sresp.hovered(), &t);
         app.auto.add(&format!("header.{key}"), sr, &format!("{title} Color"));
         if sresp.clicked() {
@@ -435,7 +620,14 @@ fn fill_stroke_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Pa
         x = sr.max.x + 12.0;
     }
     let width = app.session.state.shape_tool.stroke_width;
-    let (r, v, _) = widgets::hot_number_at(ui, pos2(x - 6.0, cy - 9.0), egui::Id::new("tool-stroke-w"), width, 0.2, (0.0, 1000.0), 0, " px", &t);
+    let (r, v, _) = widgets::hot_number_at(
+        ui,
+        pos2(x - 6.0, cy - 9.0),
+        egui::Id::unique("tool-stroke-w"),
+        width,
+        &widgets::HotSpec { speed: 0.2, range: (0.0, 1000.0), decimals: 0, suffix: " px" },
+        &t,
+    );
     if let Some(v) = v {
         tool_options(app, json!({"strokeWidth": v}));
         paint(app, "strokeWidth", json!(v));
@@ -466,7 +658,7 @@ fn paint_kind(app: &mut EffectcraftApp, shape_layers: &[u64], key: &str, kind: P
 /// Fill Options / Stroke Options: None, Solid Color, Linear Gradient or Radial Gradient, and the
 /// blend mode and opacity new shapes get (After Effects' dialogs, applied as they change).
 fn paint_options_popup(app: &mut EffectcraftApp, ui: &mut egui::Ui, shape_layers: &[u64], key: &str, title: &str, pos: egui::Pos2) {
-    let id = egui::Id::new(("tool-paint-options", key));
+    let id = egui::Id::unique(("tool-paint-options", key));
     if !widgets::popup_is_open(ui, id) {
         return;
     }
@@ -502,7 +694,14 @@ fn paint_options_popup(app: &mut EffectcraftApp, ui: &mut egui::Ui, shape_layers
             }
             app.auto.add(&format!("header.{key}Options.blend"), blend_rect, "Blend Mode");
             p.text(row(98.0), Align2::LEFT_CENTER, tr("Opacity:"), Tokens::ui(12.0), t.text_dim);
-            let (or, v, _) = widgets::hot_number_at(ui, row(89.0) + vec2(84.0, 0.0), id.with("opacity"), tp.opacity, 0.5, (0.0, 100.0), 0, "%", &t);
+            let (or, v, _) = widgets::hot_number_at(
+                ui,
+                row(89.0) + vec2(84.0, 0.0),
+                id.with("opacity"),
+                tp.opacity,
+                &widgets::HotSpec { speed: 0.5, range: (0.0, 100.0), decimals: 0, suffix: "%" },
+                &t,
+            );
             app.auto.add(&format!("header.{key}Options.opacity"), or, "Opacity");
             if let Some(v) = v {
                 let k_opacity = format!("{key}Opacity");
@@ -573,7 +772,14 @@ fn roto_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
     let label = tr("Diameter:");
     let lr = p.text(pos2(x, cy), Align2::LEFT_CENTER, label, Tokens::ui(12.0), t.text_dim);
     x = lr.max.x + 6.0;
-    let (r, nv, _) = widgets::hot_number_at(ui, pos2(x, cy - 9.0), egui::Id::new(("roto-opt", key)), v, 0.5, (1.0, 5000.0), 0, " px", &t);
+    let (r, nv, _) = widgets::hot_number_at(
+        ui,
+        pos2(x, cy - 9.0),
+        egui::Id::unique(("roto-opt", key)),
+        v,
+        &widgets::HotSpec { speed: 0.5, range: (1.0, 5000.0), decimals: 0, suffix: " px" },
+        &t,
+    );
     app.auto.add("header.roto.diameter", r, label);
     if let Some(nv) = nv
         && let Err(e) = app.session.execute("roto.options", json!({key: nv}))
@@ -591,7 +797,7 @@ fn puppet_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
     p.text(pos2(x, cy), Align2::LEFT_CENTER, tr("Mesh:"), Tokens::ui(12.0), t.text_dim);
     x += 40.0;
     let show = Rect::from_min_size(pos2(x, cy - 10.0), vec2(20.0, 20.0));
-    if widgets::checkbox(ui, show, o.show_mesh, &t, egui::Id::new("puppet-show-mesh")).clicked() {
+    if widgets::checkbox(ui, show, o.show_mesh, &t, egui::Id::unique("puppet-show-mesh")).changed() {
         let _ = app.session.execute("puppet.mesh", json!({"showMesh": !o.show_mesh}));
     }
     app.auto.add("header.puppet.showMesh", show, "Show mesh");
@@ -600,7 +806,14 @@ fn puppet_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
     for (label, key, v, range) in [("Expansion:", "expansion", o.expansion, (-100.0, 200.0)), ("Density:", "density", o.density, (0.0, 100.0))] {
         p.text(pos2(x, cy), Align2::LEFT_CENTER, label, Tokens::ui(12.0), t.text_dim);
         x += if key == "expansion" { 64.0 } else { 52.0 };
-        let (r, nv, _) = widgets::hot_number_at(ui, pos2(x, cy - 9.0), egui::Id::new(("puppet-opt", key)), v, 0.2, range, 0, "", &t);
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(x, cy - 9.0),
+            egui::Id::unique(("puppet-opt", key)),
+            v,
+            &widgets::HotSpec { speed: 0.2, range, decimals: 0, suffix: "" },
+            &t,
+        );
         app.auto.add(&format!("header.puppet.{key}"), r, label);
         if let Some(nv) = nv {
             let _ = app.session.execute("puppet.mesh", json!({key: nv, "merge": format!("puppet-opt-{key}")}));
@@ -611,7 +824,7 @@ fn puppet_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
     let label = "Record Options...";
     let w = 104.0;
     let r = Rect::from_min_size(pos2(x, cy - 10.0), vec2(w, 20.0));
-    let resp = ui.interact(r, egui::Id::new("puppet-record-options"), egui::Sense::click()).on_hover_text(tr("⌘/Ctrl-drag a pin to record its motion"));
+    let resp = ui.interact(r, egui::Id::unique("puppet-record-options"), egui::Sense::click()).on_hover_text(tr("⌘/Ctrl-drag a pin to record its motion"));
     p.rect_stroke(r, 3.0, egui::Stroke::new(1.0, if resp.hovered() { t.accent } else { t.field_border }), egui::StrokeKind::Inside);
     p.text(r.center(), Align2::CENTER_CENTER, label, Tokens::ui(11.5), t.text);
     app.auto.add("header.puppet.recordOptions", r, label);
@@ -625,7 +838,7 @@ fn puppet_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
     let label = "Follow-Through...";
     let r = Rect::from_min_size(pos2(r.max.x + 8.0, cy - 10.0), vec2(w, 20.0));
     let resp = ui
-        .interact(r, egui::Id::new("puppet-follow"), egui::Sense::click())
+        .interact(r, egui::Id::unique("puppet-follow"), egui::Sense::click())
         .on_hover_text(tr("Select the leader pin, then Shift-click the pins that should trail it (hair, cloth, tails)"));
     p.rect_stroke(r, 3.0, egui::Stroke::new(1.0, if resp.hovered() { t.accent } else { t.field_border }), egui::StrokeKind::Inside);
     p.text(r.center(), Align2::CENTER_CENTER, label, Tokens::ui(11.5), t.text);
@@ -639,21 +852,55 @@ fn puppet_options(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
     r.max.x + 16.0
 }
 
-fn ws_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
+/// A workspace's drawn name: built-ins read the menu bar's Window ▸ Workspace row; names the user
+/// saved stay verbatim, even when one matches a catalog source such as "Composition".
+fn workspace_label(name: &str) -> &str {
+    if crate::dock::WORKSPACES.contains(&name) { crate::i18n::command_label("window.workspace", name) } else { name }
+}
+
+fn ws_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui, target: &str) {
     for w in app.workspace_names() {
-        if ui.selectable_label(app.ui.workspace == w, &w).clicked() {
+        if ui.selectable_label(app.ui.workspace == w, workspace_label(&w)).clicked() {
             app.set_workspace(&w);
             ui.close();
         }
     }
     ui.separator();
-    if ui.button(tr("Reset to Saved Layout")).clicked() {
-        let n = app.ui.workspace.clone();
-        app.set_workspace(&n);
+    // The workspace options After Effects puts at the foot of its workspace menu, in its order and
+    // grouping: reset the current layout, save over it, save a copy, then edit the list. All four
+    // are engine commands, so a script drives the same things from the command line.
+    for (id, source) in [
+        ("window.resetWorkspace", "Reset to Saved Layout"),
+        ("window.saveWorkspace", "Save Changes to this Workspace"),
+        ("window.saveWorkspaceAs", "Save as New Workspace..."),
+    ] {
+        if ui.button(crate::i18n::command_label(id, source)).clicked() {
+            // The menu belongs to the tab it was opened on, so resetting or saving from a right
+            // click acts on that workspace. Save As and Edit keep working on the workspace that is
+            // showing: Save As would otherwise switch the layout before the user has named the
+            // copy, and cancelling the dialog would leave the switch behind.
+            let acts_on_its_tab = matches!(id, "window.resetWorkspace" | "window.saveWorkspace");
+            if acts_on_its_tab && app.ui.workspace != target {
+                app.set_workspace(target);
+            }
+            run_workspace_command(app, ui, id);
+            ui.close();
+        }
+    }
+    ui.separator();
+    if ui.button(crate::i18n::command_label("window.editWorkspaces", "Edit Workspaces...")).clicked() {
+        run_workspace_command(app, ui, "window.editWorkspaces");
         ui.close();
     }
 }
 
+/// Runs a workspace command, showing a failure in the status line as the menu bar does.
+fn run_workspace_command(app: &mut EffectcraftApp, ui: &egui::Ui, id: &str) {
+    if let Err(e) = crate::menus::invoke(app, ui.ctx(), id, json!({})) {
+        app.ui.status = e;
+    }
+}
+
 /// The ArtCraft mark as supplied in `docs/brand` (the README's and getartcraft.com's logo; used
 /// unmodified, see `docs/brand/LICENSE-brand.txt`).
 static ARTCRAFT_MARK: &[u8] = include_bytes!("../../../docs/brand/artcraft-mark.png");
@@ -662,7 +909,7 @@ static ARTCRAFT_MARK: &[u8] = include_bytes!("../../../docs/brand/artcraft-mark.
 /// 24 px Tools bar to the About dialog). Nothing is drawn if it can't be decoded.
 pub fn paint_logo(p: &egui::Painter, r: Rect) {
     let ctx = p.ctx();
-    let id = egui::Id::new("artcraft-mark");
+    let id = egui::Id::unique("artcraft-mark");
     let tex = ctx.data(|d| d.get_temp::<Option<egui::TextureHandle>>(id)).unwrap_or_else(|| {
         let tex = image::load_from_memory_with_format(ARTCRAFT_MARK, image::ImageFormat::Png).ok().map(|img| {
             let img = img.to_rgba8();
@@ -692,6 +939,15 @@ mod tests {
         out.textures_delta.clear();
     }
 
+    #[test]
+    fn saved_workspace_names_stay_verbatim() {
+        crate::i18n::set_current("zh-hans");
+        assert_ne!(workspace_label("Default"), "Default");
+        assert_ne!(crate::i18n::tr("Composition"), "Composition");
+        assert_eq!(workspace_label("Composition"), "Composition");
+        crate::i18n::set_current("en");
+    }
+
     #[test]
     fn long_press_type_keeps_the_tool_until_vertical_is_selected() {
         let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
@@ -718,4 +974,311 @@ mod tests {
         frame(&mut app, &ctx, 2.1, vec![]);
         assert!(!app.auto.elements.iter().any(|w| w.id == "tools.select.TypeVertical"));
     }
+
+    /// Alt/Option-click cycles a Tools-bar flyout slot without opening the menu.
+    #[test]
+    fn alt_click_cycles_the_type_slot() {
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let center = |element: &crate::automation::Element| {
+            let [x, y, w, h] = element.rect;
+            egui::pos2(x + w / 2.0, y + h / 2.0)
+        };
+        let at = center(app.auto.elements.iter().find(|w| w.id == "tools.Type").unwrap());
+        let alt = egui::Modifiers { alt: true, ..Default::default() };
+        let pointer = |pos, pressed, modifiers| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers };
+        app.ui.tool = Tool::Type;
+        app.ui.slot_tools[10] = Tool::Type;
+        frame(&mut app, &ctx, 1.0, vec![egui::Event::ModifiersChanged(alt), egui::Event::PointerMoved(at), pointer(at, true, alt)]);
+        frame(&mut app, &ctx, 1.05, vec![egui::Event::ModifiersChanged(alt), pointer(at, false, alt)]);
+        frame(&mut app, &ctx, 1.1, vec![]);
+        assert_eq!(app.ui.tool, Tool::TypeVertical);
+        assert_eq!(app.ui.slot_tools[10], Tool::TypeVertical);
+        assert!(!app.auto.elements.iter().any(|w| w.id.starts_with("tools.select.")), "Alt-click must not open the flyout");
+        frame(&mut app, &ctx, 1.5, vec![egui::Event::ModifiersChanged(alt), egui::Event::PointerMoved(at), pointer(at, true, alt)]);
+        frame(&mut app, &ctx, 1.55, vec![egui::Event::ModifiersChanged(alt), pointer(at, false, alt)]);
+        frame(&mut app, &ctx, 1.6, vec![]);
+        assert_eq!(app.ui.tool, Tool::Type, "wraps back to Type");
+    }
+
+    /// An Alt-click and a plain click that land as two releases in one frame must not
+    /// create a text layer: the first click was modified.
+    #[test]
+    fn mixed_modifier_same_frame_double_click_does_not_create() {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let e = app.auto.elements.iter().find(|w| w.id == "tools.Type").expect("Type slot");
+        let at = egui::pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+        let alt = egui::Modifiers { alt: true, ..Default::default() };
+        let plain = egui::Modifiers::default();
+        let pointer = |pos, pressed, modifiers| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers };
+        app.ui.tool = Tool::Type;
+        app.ui.slot_tools[10] = Tool::Type;
+        frame(
+            &mut app,
+            &ctx,
+            1.0,
+            vec![egui::Event::PointerMoved(at), pointer(at, true, alt), pointer(at, false, alt), pointer(at, true, plain), pointer(at, false, plain)],
+        );
+        assert!(app.session.active_comp().unwrap().layers.is_empty(), "Alt then plain in one frame must not create");
+        assert!(app.session.state.text_edit.is_none());
+    }
+
+    /// Double-clicking a creation tool in the Tools bar makes an instance of what it draws
+    /// (#1072): with nothing selected a shape layer whose shape fills the comp, into the selected
+    /// shape layer's Contents, a mask on a non-shape layer, a text layer from the Type tools.
+    /// Tools that create nothing stay quiet.
+    #[test]
+    fn double_clicking_creation_tools_makes_instances() {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        // Both click pairs in one frame, as egui counts a double-click.
+        let double_click = |app: &mut EffectcraftApp, ctx: &egui::Context, t: f64, id: &str| {
+            let e = app.auto.elements.iter().find(|w| w.id == id).unwrap_or_else(|| panic!("no {id}"));
+            let at = egui::pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+            frame(app, ctx, t, vec![egui::Event::PointerMoved(at), pointer(at, true), pointer(at, false), pointer(at, true), pointer(at, false)]);
+        };
+        // Nothing selected: a shape layer with a Rectangle Path 1 the size of the comp.
+        double_click(&mut app, &ctx, 1.0, "tools.Rectangle");
+        {
+            let comp = app.session.active_comp().unwrap();
+            assert_eq!(comp.layers.len(), 1, "the double-click made a layer");
+            let l = &comp.layers[0];
+            assert!(matches!(l.source, LayerSource::Shape), "a shape layer");
+            let size = l.props.prop("contents/Rectangle 1/contents/Rectangle Path 1/size").expect("Rectangle Path 1");
+            assert_eq!(size.value.as_vec2(), [640.0, 360.0], "the rectangle fills the comp");
+        }
+        // The shape layer is selected: the Ellipse goes on top of its Contents, no new layer.
+        app.ui.slot_tools[8] = Tool::Ellipse;
+        frame(&mut app, &ctx, 1.05, vec![]);
+        double_click(&mut app, &ctx, 2.0, "tools.Ellipse");
+        {
+            let comp = app.session.active_comp().unwrap();
+            assert_eq!(comp.layers.len(), 1, "into the selected shape layer's Contents");
+            let l = &comp.layers[0];
+            assert!(l.props.prop("contents/Ellipse 1/contents/Ellipse Path 1/size").is_some(), "the new ellipse is on top");
+            assert!(l.props.prop("contents/Rectangle 1/contents/Rectangle Path 1/size").is_some(), "the rectangle still stands");
+        }
+        // The Type tool: a text layer above the selection, editing started (an insertion point, #866).
+        double_click(&mut app, &ctx, 3.0, "tools.Type");
+        {
+            let comp = app.session.active_comp().unwrap();
+            assert_eq!(comp.layers.len(), 2);
+            assert!(matches!(comp.layers[0].source, LayerSource::Text));
+            assert!(app.session.state.text_edit.is_some(), "the text layer is being edited");
+        }
+        // A non-shape layer is selected, so the Rectangle becomes a comp-filling mask on it.
+        app.ui.slot_tools[8] = Tool::Rectangle;
+        frame(&mut app, &ctx, 3.05, vec![]);
+        double_click(&mut app, &ctx, 4.0, "tools.Rectangle");
+        {
+            let comp = app.session.active_comp().unwrap();
+            assert_eq!(comp.layers.len(), 2, "a mask, not a layer");
+            let p = comp.layers[0].props.prop("masks/Mask 1/path").expect("Mask 1");
+            let sh = p.value.as_path().expect("a mask path");
+            let b = effectcraft_path::bounds(&[effectcraft_path::to_kurbo(sh)]).expect("bounds");
+            // The text layer is anchored top-left and centred in the comp: layer = comp - centre.
+            for (got, want) in [(b.x0, -320.0), (b.y0, -180.0), (b.x1, 320.0), (b.y1, 180.0)] {
+                assert!((got - want).abs() < 1.0, "the mask fills the comp: {got} vs {want}");
+            }
+        }
+        // A tool that creates nothing: no layer, no error.
+        double_click(&mut app, &ctx, 5.0, "tools.Hand");
+        assert_eq!(app.session.active_comp().unwrap().layers.len(), 2, "the Hand tool creates nothing");
+        assert!(app.ui.status.is_empty(), "{}", app.ui.status);
+        // Without a comp the command fails with the status line, never a panic.
+        let mut bare = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &bare.tokens, crate::i18n::language(&bare));
+        frame(&mut bare, &ctx, 0.0, vec![]);
+        frame(&mut bare, &ctx, 0.1, vec![]);
+        double_click(&mut bare, &ctx, 1.0, "tools.Rectangle");
+        assert!(!bare.ui.status.is_empty(), "no comp: a status message, not a crash");
+    }
+
+    /// #1765: a double-click on the Ellipse tool with nothing selected makes its own shape layer
+    /// the size of the comp, as the Rectangle does.
+    #[test]
+    fn double_click_ellipse_with_no_selection_makes_a_layer() {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        app.ui.slot_tools[8] = Tool::Ellipse;
+        frame(&mut app, &ctx, 1.0, vec![]);
+        let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        let e = app.auto.elements.iter().find(|w| w.id == "tools.Ellipse").unwrap_or_else(|| panic!("no tools.Ellipse"));
+        let at = egui::pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+        frame(&mut app, &ctx, 1.1, vec![egui::Event::PointerMoved(at), pointer(at, true), pointer(at, false), pointer(at, true), pointer(at, false)]);
+        let comp = app.session.active_comp().unwrap();
+        assert_eq!(comp.layers.len(), 1, "the double-click made a layer");
+        let l = &comp.layers[0];
+        assert!(matches!(l.source, LayerSource::Shape), "a shape layer");
+        let size = l.props.prop("contents/Ellipse 1/contents/Ellipse Path 1/size").expect("Ellipse Path 1");
+        assert_eq!(size.value.as_vec2(), [640.0, 360.0], "the ellipse fills the comp");
+        assert!(app.ui.status.is_empty(), "{}", app.ui.status);
+    }
+
+    /// Tool Creates Mask on (#1072): a double-click on a shape tool masks the selected shape
+    /// layer instead of adding to its Contents.
+    #[test]
+    fn double_click_masks_a_shape_layer_while_tool_creates_mask() {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        let double_click = |app: &mut EffectcraftApp, ctx: &egui::Context, t: f64, id: &str| {
+            let e = app.auto.elements.iter().find(|w| w.id == id).unwrap_or_else(|| panic!("no {id}"));
+            let at = egui::pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+            frame(app, ctx, t, vec![egui::Event::PointerMoved(at), pointer(at, true), pointer(at, false), pointer(at, true), pointer(at, false)]);
+        };
+        // A shape layer, selected by the double-click that made it.
+        double_click(&mut app, &ctx, 1.0, "tools.Rectangle");
+        assert_eq!(app.session.active_comp().unwrap().layers.len(), 1);
+        app.session.state.shape_tool.creates_mask = true;
+        app.ui.slot_tools[8] = Tool::Ellipse;
+        frame(&mut app, &ctx, 1.05, vec![]);
+        double_click(&mut app, &ctx, 2.0, "tools.Ellipse");
+        {
+            let comp = app.session.active_comp().unwrap();
+            assert_eq!(comp.layers.len(), 1, "a mask, not a second shape layer");
+            let l = &comp.layers[0];
+            assert!(l.props.prop("masks/Mask 1/path").is_some(), "an ellipse mask");
+            assert!(l.props.prop("contents/Ellipse 1").is_none(), "nothing added to the Contents");
+            let p = l.props.prop("contents/Rectangle 1/contents/Rectangle Path 1/size").expect("the rectangle stands");
+            assert_eq!(p.value.as_vec2(), [640.0, 360.0]);
+        }
+        assert!(app.ui.status.is_empty(), "{}", app.ui.status);
+    }
+
+    /// The shape tools' geometry defaults (#1072): the Rounded Rectangle tool's Roundness is a
+    /// fixed 20, the Polygon tool a 5-point polygon, the Star tool a 5-point star whose Inner
+    /// Radius is a quarter of its Outer Radius.
+    #[test]
+    fn double_click_shape_tool_geometry_defaults() {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        let double_click = |app: &mut EffectcraftApp, ctx: &egui::Context, t: f64, id: &str| {
+            let e = app.auto.elements.iter().find(|w| w.id == id).unwrap_or_else(|| panic!("no {id}"));
+            let at = egui::pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+            frame(app, ctx, t, vec![egui::Event::PointerMoved(at), pointer(at, true), pointer(at, false), pointer(at, true), pointer(at, false)]);
+        };
+        // Each shape on its own layer: deselect so the next double-click makes a new one.
+        let deselected = |app: &mut EffectcraftApp, ctx: &egui::Context, t: f64| {
+            app.session.execute("edit.deselectAll", json!({})).unwrap();
+            frame(app, ctx, t, vec![]);
+        };
+        // The Rounded Rectangle: Roundness 20, filling the comp.
+        app.ui.slot_tools[8] = Tool::RoundedRect;
+        frame(&mut app, &ctx, 1.0, vec![]);
+        double_click(&mut app, &ctx, 1.1, "tools.RoundedRect");
+        {
+            let comp = app.session.active_comp().unwrap();
+            let g = comp.layers[0].props.group("contents/Rectangle 1/contents/Rectangle Path 1").expect("Rectangle Path 1");
+            assert_eq!(g.prop("roundness").expect("roundness").value.as_f64(), 20.0, "a fixed roundness");
+            assert_eq!(g.prop("size").expect("size").value.as_vec2(), [640.0, 360.0]);
+        }
+        // The Star: 5 points, Outer Radius half the comp height, Inner Radius a quarter.
+        deselected(&mut app, &ctx, 2.0);
+        app.ui.slot_tools[8] = Tool::Star;
+        frame(&mut app, &ctx, 2.05, vec![]);
+        double_click(&mut app, &ctx, 2.1, "tools.Star");
+        {
+            let comp = app.session.active_comp().unwrap();
+            let g = comp.layers[0].props.group("contents/Polystar 1/contents/Polystar Path 1").expect("Polystar Path 1");
+            assert_eq!(g.prop("type").expect("type").value.as_enum(), 0, "Star");
+            assert_eq!(g.prop("points").expect("points").value.as_f64(), 5.0, "5 points");
+            assert_eq!(g.prop("outerRadius").expect("outer").value.as_f64(), 180.0, "half the comp height");
+            assert_eq!(g.prop("innerRadius").expect("inner").value.as_f64(), 90.0, "a quarter of the comp height");
+        }
+        // The Polygon: 5 points, Outer Radius half the comp height, no inner radius.
+        deselected(&mut app, &ctx, 3.0);
+        app.ui.slot_tools[8] = Tool::Polygon;
+        frame(&mut app, &ctx, 3.05, vec![]);
+        double_click(&mut app, &ctx, 3.1, "tools.Polygon");
+        {
+            let comp = app.session.active_comp().unwrap();
+            let g = comp.layers[0].props.group("contents/Polystar 1/contents/Polystar Path 1").expect("Polystar Path 1");
+            assert_eq!(g.prop("type").expect("type").value.as_enum(), 1, "Polygon");
+            assert_eq!(g.prop("points").expect("points").value.as_f64(), 5.0, "5 points");
+            assert_eq!(g.prop("outerRadius").expect("outer").value.as_f64(), 180.0, "half the comp height");
+            assert!(g.prop("innerRadius").is_none(), "a polygon has no inner radius");
+        }
+        assert!(app.ui.status.is_empty(), "{}", app.ui.status);
+    }
+
+    /// A double-clicked shape is painted with the Tools bar's Fill and Stroke (#1072): the
+    /// colours and stroke width the shape tool is set to — and no outline at all when the tool
+    /// has its Stroke off.
+    #[test]
+    fn double_click_paints_with_the_shape_tools_fill_and_stroke() {
+        let mut s = effectcraft_engine::Session::default();
+        s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        let double_click = |app: &mut EffectcraftApp, ctx: &egui::Context, t: f64, id: &str| {
+            let e = app.auto.elements.iter().find(|w| w.id == id).unwrap_or_else(|| panic!("no {id}"));
+            let at = egui::pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+            frame(app, ctx, t, vec![egui::Event::PointerMoved(at), pointer(at, true), pointer(at, false), pointer(at, true), pointer(at, false)]);
+        };
+        // The tool's own Fill and Stroke go onto the created shape.
+        app.session.state.shape_tool.fill.color = [1.0, 0.0, 0.0];
+        app.session.state.shape_tool.stroke.color = [0.0, 1.0, 0.0];
+        app.session.state.shape_tool.stroke_width = 5.0;
+        double_click(&mut app, &ctx, 1.0, "tools.Rectangle");
+        {
+            let comp = app.session.active_comp().unwrap();
+            let g = comp.layers[0].props.group("contents/Rectangle 1/contents").expect("the contents");
+            let fill = g.sub("fill").expect("the fill");
+            assert_eq!(fill.get("color").expect("color").value.as_color(), [1.0, 0.0, 0.0, 1.0], "the tool's Fill");
+            let stroke = g.sub("stroke").expect("the stroke");
+            assert_eq!(stroke.get("color").expect("color").value.as_color(), [0.0, 1.0, 0.0, 1.0], "the tool's Stroke");
+            assert_eq!(stroke.get("width").expect("width").value.as_f64(), 5.0, "the tool's Stroke Width");
+        }
+        // Stroke off ("Keine"): the next shape gets no outline at all, but keeps the Fill.
+        app.session.execute("shape.toolOptions", json!({"stroke": false})).unwrap();
+        app.session.execute("edit.deselectAll", json!({})).unwrap();
+        app.ui.slot_tools[8] = Tool::Ellipse;
+        frame(&mut app, &ctx, 1.05, vec![]);
+        double_click(&mut app, &ctx, 2.0, "tools.Ellipse");
+        {
+            let comp = app.session.active_comp().unwrap();
+            assert_eq!(comp.layers.len(), 2, "a new shape layer");
+            let g = comp.layers[0].props.group("contents/Ellipse 1/contents").expect("the ellipse");
+            assert!(g.sub("stroke").is_none(), "no outline when the tool's Stroke is off");
+            assert_eq!(g.sub("fill").expect("the fill").get("color").expect("color").value.as_color(), [1.0, 0.0, 0.0, 1.0]);
+        }
+        assert!(app.ui.status.is_empty(), "{}", app.ui.status);
+    }
 }
diff --git a/crates/ui-egui/src/hooks.rs b/crates/ui-egui/src/hooks.rs
new file mode 100644
index 000000000..457aeb99a
--- /dev/null
+++ b/crates/ui-egui/src/hooks.rs
@@ -0,0 +1,87 @@
+use super::*;
+
+/// The desktop's light or dark appearance where egui cannot see it (Wayland compositors that send
+/// winit no theme). `None` = the host does not know.
+pub type SystemThemeFn = Box<dyn Fn(&egui::Context) -> Option<egui::Theme>>;
+
+/// A file dialog a host shows without blocking the frame ([`Hooks::file_dialog_async`]).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum FileDialog {
+    /// Files to open or import with these extensions; several when `many`.
+    Open { exts: Vec<String>, many: bool },
+    /// An EffectCraft project to open.
+    OpenProject,
+    /// A folder.
+    Folder,
+    /// Where to save `default` (a file name or path) with extension `ext` (empty: no filter);
+    /// `project`: the project save dialog, given the file name.
+    Save { default: String, ext: String, project: bool },
+}
+
+impl FileDialog {
+    /// The save dialog for `default`, as [`Hooks::save_dialog`] picks it.
+    pub fn save(default: &str) -> Self {
+        let ext = std::path::Path::new(default).extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
+        Self::Save { default: default.to_string(), project: ext.eq_ignore_ascii_case("ecproj"), ext }
+    }
+}
+
+/// Called with the paths a [`FileDialog`] picked (empty: cancelled), from any thread.
+pub type DialogDone = Box<dyn FnOnce(Vec<String>) + Send>;
+
+/// Host hooks provided by the native app (file pickers etc.).
+#[derive(Default)]
+pub struct Hooks {
+    /// The system appearance for Settings ▸ Appearance ▸ Sync with System (the desktop app reads
+    /// the Linux desktop portal); without it, what egui reports.
+    pub system_theme: Option<SystemThemeFn>,
+    pub pick_files: Option<Box<dyn Fn(&[&str]) -> Vec<String>>>,
+    pub pick_save: Option<Box<dyn Fn(&str) -> Option<String>>>,
+    pub pick_open_project: Option<Box<dyn Fn() -> Option<String>>>,
+    /// Opens the audio output for preview playback (the desktop app uses cpal).
+    pub audio_device: Option<audio::AudioDeviceFactory>,
+    /// Lists audio output devices (Settings ▸ Audio).
+    pub audio_devices: Option<Box<dyn Fn() -> Vec<String>>>,
+    /// Picks a folder (Settings paths).
+    pub pick_folder: Option<Box<dyn Fn() -> Option<String>>>,
+    /// Save dialog for other file kinds: (default name or path, extension; empty: no filter). A
+    /// default path opens the dialog in its folder.
+    pub pick_save_file: Option<Box<dyn Fn(&str, &str) -> Option<String>>>,
+    /// The system clipboard's text (native menu Edit ▸ Paste into a text field).
+    pub clipboard_text: Option<Box<dyn Fn() -> Option<String>>>,
+    /// Application actions the OS performs (`app.hide`, `app.hideOthers`, `app.showAll` on
+    /// macOS). Returns false when the host doesn't handle the id.
+    pub app_action: Option<Box<dyn Fn(&str) -> bool>>,
+    /// Shows a command's file dialog without blocking the frame and calls `done` with the
+    /// answer (the host then asks for a repaint). Used in place of the blocking pickers above for
+    /// the commands' dialogs (File ▸ Import, Open, Save As…) where blocking the frame is unsafe or
+    /// leaves the window unresponsive: on macOS a nested modal event loop there aborted the app on
+    /// a drag over the window (#511), and on Linux a blocking desktop-portal dialog never pumps
+    /// events, so the compositor marks the window as not responding (#1275).
+    pub file_dialog_async: Option<Box<dyn Fn(FileDialog, DialogDone)>>,
+    /// Tells the user the graphics device was lost and the window is closing, once. `saved` is
+    /// the auto-save of unsaved changes (`None`: nothing was unsaved), its path or why it failed.
+    pub device_lost: Option<Box<dyn Fn(Option<Result<String, String>>)>>,
+    /// Runs on the worker thread right before the GPU compositor is built (desktop). Tests hold
+    /// it to look at the interface while the compositor is still being prepared, or make it
+    /// panic to check that a failing build never reaches the UI thread.
+    pub before_gpu_build: Option<Box<dyn FnOnce() + Send>>,
+}
+
+impl Hooks {
+    /// The host's save dialog for `default` (a file name or path), offering its extension: the
+    /// project dialog for project files, else [`Hooks::pick_save_file`]. The project dialog is
+    /// the fallback for hosts without that (the web, whose dialog only names the file): on macOS
+    /// a dialog filtered to projects appends `.ecproj` to any other name (#293). `None` when the
+    /// host has no save dialog; `Some(None)` when it was cancelled.
+    pub fn save_dialog(&self, default: &str) -> Option<Option<String>> {
+        let path = std::path::Path::new(default);
+        let ext = path.extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
+        match (&self.pick_save_file, &self.pick_save) {
+            (Some(pick), _) if !ext.eq_ignore_ascii_case("ecproj") => Some(pick(default, &ext)),
+            (_, Some(pick)) => Some(pick(&path.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default())),
+            (Some(pick), None) => Some(pick(default, &ext)),
+            (None, None) => None,
+        }
+    }
+}
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
index 8b8b01b51..c998538d4 100644
--- a/crates/ui-egui/src/i18n.rs
+++ b/crates/ui-egui/src/i18n.rs
@@ -8,12 +8,14 @@ use crate::EffectcraftApp;
 /// Effect names, keyed by effect id (#821).
 pub(crate) mod effects;
 /// Translations for the panels, tooltips and dialogs below the menu bar (see the module docs).
-mod ui;
+pub(crate) mod ui;
 use effectcraft_engine::menus::{MenuEntry, MenuNode};
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use ui::catalog_characters;
 pub(crate) use ui::{set_current, tr, tr_args};
 
 /// Every language with a catalog, in the order Settings ▸ General ▸ Language lists them.
-const CATALOG_CODES: [&str; 10] = ["ja", "zh-hans", "zh-hant", "uk", "es", "pt-br", "ru", "fr", "de", "cs"];
+const CATALOG_CODES: [&str; 13] = ["cs", "de", "es", "fr", "pl", "pt-br", "sv", "ru", "uk", "ka", "ja", "zh-hans", "zh-hant"];
 
 /// The active interface language: the stored preference when it names a catalog, otherwise `en`
 /// (English is the source of every label and needs no lookup).
@@ -64,22 +66,74 @@ pub(crate) fn czech(app: &EffectcraftApp) -> bool {
     language(app) == "cs"
 }
 
+/// The UI is in Polish.
+pub(crate) fn polish(app: &EffectcraftApp) -> bool {
+    language(app) == "pl"
+}
+
+/// The UI is in Georgian.
+pub(crate) fn georgian(app: &EffectcraftApp) -> bool {
+    language(app) == "ka"
+}
+
+/// The UI is in Swedish.
+pub(crate) fn swedish(app: &EffectcraftApp) -> bool {
+    language(app) == "sv"
+}
+
 /// Settings ▸ General ▸ Language ▸ Match System: the operating system's interface language
 /// where EffectCraft has it, else English (#229), as After Effects installs in the system's
-/// language. The browser build stays in English because it has no system-locale probe.
+/// language. The browser build follows the locales its page passes in ([`set_system_locales`]).
 fn system_language() -> &'static str {
     #[cfg(not(target_arch = "wasm32"))]
     {
         static LANGUAGE: std::sync::OnceLock<&'static str> = std::sync::OnceLock::new();
         LANGUAGE.get_or_init(|| supported(sys_locale::get_locale().as_deref()))
     }
-    // No system locale in the browser build: English.
     #[cfg(target_arch = "wasm32")]
-    supported(None)
+    {
+        let (requested, browser) = SYSTEM_LOCALES.get().map(|(r, b)| (r.as_deref(), b.as_slice())).unwrap_or_default();
+        first_supported(requested, browser, web_draws)
+    }
+}
+
+/// The page's `?lang=`, then the browser's preferred languages, most preferred first
+/// (`navigator.languages`), for Match System in the web build.
+static SYSTEM_LOCALES: std::sync::OnceLock<(Option<String>, Vec<String>)> = std::sync::OnceLock::new();
+
+/// Tell Match System the language the page asks for (`?lang=`) and the browser's preferred
+/// languages (the web build has no locale probe of its own). Set before the first frame; only
+/// the first call counts.
+pub fn set_system_locales(requested: Option<String>, browser: Vec<String>) {
+    let _ = SYSTEM_LOCALES.set((requested, browser));
+}
+
+/// `requested` when EffectCraft has a catalog for it, else the first of `browser` it has a
+/// catalog for and `drawable` accepts (English counts), else English: someone who prefers Dutch,
+/// then Czech, gets Czech.
+#[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
+fn first_supported(requested: Option<&str>, browser: &[String], drawable: impl Fn(&str) -> bool) -> &'static str {
+    let english = |t: &str| t.split(['-', '_']).next().is_some_and(|p| p.eq_ignore_ascii_case("en"));
+    requested
+        .map(|t| (t, true))
+        .into_iter()
+        .chain(browser.iter().map(|t| (t.as_str(), false)))
+        .map(|(t, asked)| (t, asked, supported(Some(t))))
+        .find(|(t, asked, code)| (*code != "en" && (*asked || drawable(code))) || english(t))
+        .map_or("en", |(_, _, code)| code)
+}
+
+/// Whether the web build can draw `language`'s interface. It installs no system fonts and its
+/// bundled faces have no CJK or Georgian glyphs, so Match System skips those browser languages
+/// rather than draw boxes; `?lang=` and a language chosen in Settings still select them.
+#[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
+fn web_draws(language: &str) -> bool {
+    !matches!(language, "ja" | "zh-hans" | "zh-hant" | "ka")
 }
 
 /// The language EffectCraft shows for a BCP 47 locale (`ja-JP` → `ja`, `zh-Hans-CN` → `zh-hans`,
-/// `zh-TW` → `zh-hant`, `uk-UA` → `uk`, `es-ES` → `es`, `pt-BR` → `pt-br`, `cs-CZ` → `cs`).
+/// `zh-TW` → `zh-hant`, `uk-UA` → `uk`, `es-ES` → `es`, `pt-BR` → `pt-br`, `cs-CZ` → `cs`,
+/// `ka-GE` → `ka`, `ru-RU` → `ru`, `de-AT` → `de`, `fr-CA` → `fr`, `sv-SE` → `sv`).
 fn supported(locale: Option<&str>) -> &'static str {
     let Some(locale) = locale else { return "en" };
     let mut parts = locale.split(['-', '_']);
@@ -90,6 +144,12 @@ fn supported(locale: Option<&str>) -> &'static str {
         "uk" => "uk",
         "es" => "es",
         "cs" => "cs",
+        "pl" => "pl",
+        "ka" => "ka",
+        "ru" => "ru",
+        "de" => "de",
+        "fr" => "fr",
+        "sv" => "sv",
         // The only Portuguese catalog: Brazil's, also for Portugal rather than English.
         "pt" => "pt-br",
         "zh" => {
@@ -100,28 +160,45 @@ fn supported(locale: Option<&str>) -> &'static str {
     }
 }
 
+/// The Windows and Linux sources of *Reveal in Finder* in each catalog that has them, keyed by
+/// language code: the platform names the file manager before the catalog sees the label, so the
+/// macOS row alone leaves the other two in English (#1450).
+const REVEAL_FINDER: &[(&str, &str, &str)] = &[
+    ("uk", "Показати у Провіднику", "Показати у файловому менеджері"),
+    ("de", "Im Explorer anzeigen", "Im Dateimanager anzeigen"),
+    ("cs", "Zobrazit v Průzkumníku", "Zobrazit ve správci souborů"),
+    ("ja", "エクスプローラーで表示", "ファイルマネージャーで表示"),
+    ("pl", "Pokaż w Eksploratorze", "Pokaż w menedżerze plików"),
+    ("ka", "Explorer-ში ჩვენება", "ფაილების მენეჯერში ჩვენება"),
+    ("zh-hans", "在资源管理器中显示", "在文件管理器中显示"),
+    ("zh-hant", "在檔案總管中顯示", "在檔案管理員中顯示"),
+    ("es", "Mostrar en el Explorador", "Mostrar en el gestor de archivos"),
+    ("pt-br", "Mostrar no Explorador", "Mostrar no gerenciador de arquivos"),
+    ("fr", "Afficher dans l’Explorateur", "Afficher dans le gestionnaire de fichiers"),
+    ("ru", "Показать в Проводнике", "Показать в файловом менеджере"),
+];
+
 pub(crate) fn label<'a>(app: &EffectcraftApp, command: &str, source: &'a str) -> &'a str {
     let language = language(app);
-    // The engine names the platform's file manager before the catalog sees the label. These
-    // two commands keep their ids, but on Windows/Linux their source is no longer "Finder".
-    if language == "uk" && matches!(command, "file.revealInFinder" | "layer.revealInFinder") {
+    // The engine names the platform's file manager before the catalog sees the label, so on
+    // Windows and Linux the source is no longer "Finder" and the catalog's row misses. Every
+    // language that names a file manager says so here (#1450); a language with no row keeps the
+    // English source rather than a guess.
+    if matches!(command, "file.revealInFinder" | "layer.revealInFinder")
+        && let Some((_, explorer, manager)) = REVEAL_FINDER.iter().find(|(code, ..)| *code == language)
+    {
+        // Only the Windows and Linux sources are overridden; "Reveal in Finder" keeps going to the
+        // catalog below, which holds the macOS wording.
         match source {
-            "Reveal in Explorer" => return "Показати у Провіднику",
-            "Reveal in File Manager" => return "Показати у файловому менеджері",
+            "Reveal in Explorer" => return explorer,
+            "Reveal in File Manager" => return manager,
             _ => {}
         }
     }
-    if language == "de" && matches!(command, "file.revealInFinder" | "layer.revealInFinder") {
+    if language == "sv" && matches!(command, "file.revealInFinder" | "layer.revealInFinder") {
         match source {
-            "Reveal in Explorer" => return "Im Explorer anzeigen",
-            "Reveal in File Manager" => return "Im Dateimanager anzeigen",
-            _ => {}
-        }
-    }
-    if language == "cs" && matches!(command, "file.revealInFinder" | "layer.revealInFinder") {
-        match source {
-            "Reveal in Explorer" => return "Zobrazit v Průzkumníku",
-            "Reveal in File Manager" => return "Zobrazit ve správci souborů",
+            "Reveal in Explorer" => return "Visa i Utforskaren",
+            "Reveal in File Manager" => return "Visa i filhanteraren",
             _ => {}
         }
     }
@@ -141,10 +218,30 @@ fn menu_catalog(language: &str) -> Option<&'static [(&'static str, &'static str,
         "fr" => FRENCH,
         "de" => GERMAN,
         "cs" => CZECH,
+        "pl" => POLISH,
+        "ka" => GEORGIAN,
+        "sv" => SWEDISH,
         _ => return None,
     })
 }
 
+/// A command's label drawn outside the menu bar (the dock's tab titles, the workspace bar), in the
+/// language the panels draw in: the menu bar's row for (`command`, `source`), else the panel
+/// catalog's row for `source`, else `source`. `…` also finds a menu bar row written `...`.
+pub(crate) fn command_label<'a>(command: &str, source: &'a str) -> &'a str {
+    let dotted = source.strip_suffix('…').map(|stem| format!("{stem}..."));
+    let row = |key: &str| menu_catalog(ui::current())?.iter().find(|(id, en, _)| *id == command && *en == key).map(|(_, _, translated)| *translated);
+    row(source).or_else(|| row(dotted.as_deref()?)).unwrap_or_else(|| tr(source))
+}
+
+/// A Settings page's title as the menu bar's Settings submenu draws it, without the ellipsis; the
+/// panel catalog's row for pages that have no menu row. The panel catalog's "Type" is the kind
+/// (Camera Settings, the Project panel's column), while the Type page is about text.
+pub(crate) fn settings_page_title(title: &str) -> &str {
+    let menu = menu_catalog(ui::current()).and_then(|c| c.iter().find(|(id, en, _)| *id == "app.settings" && en.strip_suffix("...") == Some(title)));
+    menu.and_then(|(_, _, translated)| translated.strip_suffix("...")).unwrap_or_else(|| tr(title))
+}
+
 /// `source` looked up in `catalog` by (command, English label); the source itself when the pair is
 /// absent, so computed labels and user names stay verbatim.
 fn lookup<'a>(catalog: &[(&str, &str, &'a str)], command: &str, source: &'a str) -> &'a str {
@@ -182,20 +279,36 @@ pub(crate) fn entry(app: &EffectcraftApp, e: &MenuEntry, shown: String) -> Strin
         return effects::name(id, &e.label);
     }
     // Undo/redo names come from the history, so they are formatted per language here rather than
-    // looked up in a catalog. An English (or untranslated) interface keeps the shown label.
-    let (undo, no_undo, redo, no_redo) = match language(app) {
-        "ja" => ("取り消し", "取り消しできません", "やり直し", "やり直しできません"),
-        "zh-hans" => ("撤销", "无可撤销的操作", "重做", "无可重做的操作"),
-        "zh-hant" => ("復原", "沒有可復原的操作", "重做", "沒有可重做的操作"),
-        "uk" => ("Скасувати", "Немає дій для скасування", "Повторити", "Немає дій для повторення"),
-        "es" => ("Deshacer", "No se puede deshacer", "Rehacer", "No se puede rehacer"),
-        "pt-br" => ("Desfazer", "Não há nada para desfazer", "Refazer", "Não há nada para refazer"),
-        "cs" => ("Zpět", "Není co vrátit", "Znovu", "Není co zopakovat"),
-        _ => return shown,
+    // looked up in a catalog. A language without this wording keeps the shown undo/redo label, and
+    // the rest of its menu still goes through the catalog below (#1449).
+    let history = match language(app) {
+        "en" => return shown,
+        "ja" => Some(("取り消し", "取り消しできません", "やり直し", "やり直しできません")),
+        "zh-hans" => Some(("撤销", "无可撤销的操作", "重做", "无可重做的操作")),
+        "zh-hant" => Some(("復原", "沒有可復原的操作", "重做", "沒有可重做的操作")),
+        "uk" => Some(("Скасувати", "Немає дій для скасування", "Повторити", "Немає дій для повторення")),
+        "es" => Some(("Deshacer", "No se puede deshacer", "Rehacer", "No se puede rehacer")),
+        "pt-br" => Some(("Desfazer", "Não há nada para desfazer", "Refazer", "Não há nada para refazer")),
+        "cs" => Some(("Zpět", "Není co vrátit", "Znovu", "Není co zopakovat")),
+        "fr" => Some(("Annuler", "Impossible d'annuler", "Rétablir", "Impossible de rétablir")),
+        "de" => Some(("Rückgängig", "Rückgängig nicht möglich", "Wiederholen", "Wiederholen nicht möglich")),
+        "pl" => Some(("Cofnij", "Nie można cofnąć", "Ponów", "Nie można ponowić")),
+        // A colon before the history's (untranslated) action name: "დაბრუნება: Comp1".
+        "ka" => Some(("დაბრუნება:", "დაბრუნება შეუძლებელია", "ხელახლა შესრულება:", "ხელახლა შესრულება შეუძლებელია")),
+        // A colon before the history's (untranslated) action name: "Отменить: Comp1".
+        "ru" => Some(("Отменить:", "Нечего отменять", "Повторить:", "Нечего повторять")),
+        "sv" => Some(("Ångra", "Det går inte att ångra", "Gör om", "Det går inte att göra om")),
+        _ => None,
     };
     match e.command.as_str() {
-        "edit.undo" => app.session.history.undo.last().map(|u| format!("{undo} {}", u.0)).unwrap_or_else(|| no_undo.into()),
-        "edit.redo" => app.session.history.redo.last().map(|u| format!("{redo} {}", u.0)).unwrap_or_else(|| no_redo.into()),
+        "edit.undo" | "edit.redo" => {
+            let Some((undo, no_undo, redo, no_redo)) = history else { return shown };
+            if e.command == "edit.undo" {
+                app.session.history.undo.last().map(|u| format!("{undo} {}", u.0)).unwrap_or_else(|| no_undo.into())
+            } else {
+                app.session.history.redo.last().map(|u| format!("{redo} {}", u.0)).unwrap_or_else(|| no_redo.into())
+            }
+        }
         "window.panel" => {
             let prefix = format!("{}: ", e.label);
             if let Some(name) = shown.strip_prefix(&prefix) {
@@ -221,8 +334,23 @@ pub(crate) fn effect_category(children: &[MenuNode], source: &str) -> Option<Str
     (!children.is_empty() && children.iter().all(|c| matches!(c, MenuNode::Item(e) if e.command == "effect.apply"))).then(|| effects::category(source))
 }
 
+/// Polish names for the Assign Shortcut submenus that carry a workspace's or 3D view's name.
+fn polish_assign_shortcut(source: &str, shown: &str) -> Option<String> {
+    let named = shown.strip_prefix("Assign Shortcut to “")?;
+    match source {
+        "Assign Shortcut to Workspace" => named.strip_suffix("” Workspace").map(|name| format!("Przypisz skrót do obszaru roboczego „{name}”")),
+        "Assign Shortcut to 3D View" => named.strip_suffix('”').map(|name| format!("Przypisz skrót do widoku 3D „{name}”")),
+        _ => None,
+    }
+}
+
 pub(crate) fn submenu(app: &EffectcraftApp, source: &str, shown: String) -> String {
     match language(app) {
+        "pl" => {
+            if let Some(label) = polish_assign_shortcut(source, &shown) {
+                return label;
+            }
+        }
         "cs" => {
             if source == "Assign Shortcut to Workspace" {
                 if let Some(name) = shown.strip_prefix("Assign Shortcut to “").and_then(|s| s.strip_suffix("” Workspace")) {
@@ -300,6 +428,28 @@ pub(crate) fn submenu(app: &EffectcraftApp, source: &str, shown: String) -> Stri
                 return format!("Atribuir atalho à visualização 3D “{name}”");
             }
         }
+        "ka" => {
+            if source == "Assign Shortcut to Workspace" {
+                if let Some(name) = shown.strip_prefix("Assign Shortcut to “").and_then(|s| s.strip_suffix("” Workspace")) {
+                    return format!("მალსახმობის მინიჭება სამუშაო სივრცისთვის „{name}“");
+                }
+            } else if source == "Assign Shortcut to 3D View"
+                && let Some(name) = shown.strip_prefix("Assign Shortcut to “").and_then(|s| s.strip_suffix('”'))
+            {
+                return format!("მალსახმობის მინიჭება 3D ხედისთვის „{name}“");
+            }
+        }
+        "sv" => {
+            if source == "Assign Shortcut to Workspace" {
+                if let Some(name) = shown.strip_prefix("Assign Shortcut to “").and_then(|s| s.strip_suffix("” Workspace")) {
+                    return format!("Tilldela kortkommando till arbetslayouten ”{name}”");
+                }
+            } else if source == "Assign Shortcut to 3D View"
+                && let Some(name) = shown.strip_prefix("Assign Shortcut to “").and_then(|s| s.strip_suffix('”'))
+            {
+                return format!("Tilldela kortkommando till 3D-vyn ”{name}”");
+            }
+        }
         _ => {}
     }
     label(app, "", &shown).into()
@@ -356,6 +506,8 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "文件..."),
     ("file.importMultiple", "Multiple Files...", "多个文件..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro 项目..."),
+    ("file.importAep", "After Effects Project...", "After Effects 项目..."),
+    ("file.exportAep", "After Effects Project...", "After Effects 项目..."),
     ("file.importProject", "EffectCraft Project...", "EffectCraft 项目..."),
     ("file.importPlaceholder", "Placeholder...", "占位符..."),
     ("file.importSolid", "Solid...", "纯色..."),
@@ -386,6 +538,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "安装脚本文件..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "安装 ScriptUI 面板..."),
     ("file.runScript", "Run Script File...", "运行脚本文件..."),
+    ("", "Recent Script Files", "最近的脚本文件"),
     ("", "Create Proxy", "创建代理"),
     ("file.createProxy", "Still...", "静止图像..."),
     ("file.createProxy", "Movie...", "影片..."),
@@ -505,6 +658,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "形状图层"),
     ("layer.newAdjustment", "Adjustment Layer", "调整图层"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "内容识别填充图层..."),
+    ("layer.newPrimitive", "3D Primitive...", "3D 基本体..."),
     ("layer.new3dPrimitive", "Cube", "立方体"),
     ("layer.new3dPrimitive", "Sphere", "球体"),
     ("layer.new3dPrimitive", "Plane", "平面"),
@@ -721,6 +875,8 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "全部移除"),
     ("effect.manage", "Manage Effects...", "管理效果..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "加载效果插件..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "通过辅助程序加载插件..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "扫描效果辅助程序"),
     ("", "Animation", "动画"),
     ("anim.savePreset", "Save Animation Preset...", "保存动画预设..."),
     ("anim.applyPreset", "Apply Animation Preset...", "将动画预设应用于..."),
@@ -738,6 +894,8 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "行落下"),
     ("anim.addKeyframe", "Add Keyframe", "添加关键帧"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "切换定格关键帧"),
+    ("keys.setMuted", "Mute Keyframes", "静音关键帧"),
+    ("keys.setMuted", "Unmute Keyframes", "取消静音关键帧"),
     ("keys.interpolation", "Keyframe Interpolation...", "关键帧插值..."),
     ("keys.velocity", "Keyframe Velocity...", "关键帧速度..."),
     ("", "Keyframe Assistant", "关键帧辅助"),
@@ -896,7 +1054,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "基本图形"),
     ("window.panel", "Info", "信息"),
     ("help.inAppTutorials", "Learn", "学习"),
-    ("window.panel", "Lumetri Scopes", "Lumetri 范围"),
+    ("window.panel", "Video Scopes", "视频示波器"),
     ("window.panel", "Mask Interpolation", "蒙版插值"),
     ("window.panel", "Media Browser", "媒体浏览器"),
     ("window.panel", "Metadata", "元数据"),
@@ -940,6 +1098,646 @@ const SIMPLIFIED_CHINESE: &[(&str, &str, &str)] = &[
     ("file.openDemoProject", "Open Demo Project", "打开示例项目"),
 ];
 
+/// Swedish (`sv`), written from the English source.
+const SWEDISH: &[(&str, &str, &str)] = &[
+    ("", "EffectCraft", "EffectCraft"),
+    ("app.about", "About EffectCraft...", "Om EffectCraft..."),
+    ("", "Settings...", "Inställningar..."),
+    ("app.settings", "General...", "Allmänt..."),
+    ("app.settings", "Startup & Repair...", "Start och reparation..."),
+    ("app.settings", "Project...", "Projekt..."),
+    ("app.settings", "Composition...", "Komposition..."),
+    ("app.settings", "Previews...", "Förhandsgranskningar..."),
+    ("app.settings", "Appearance...", "Utseende..."),
+    ("app.settings", "Grids & Guides...", "Rutnät och stödlinjer..."),
+    ("app.settings", "Labels...", "Etiketter..."),
+    ("app.settings", "Type...", "Text..."),
+    ("app.settings", "Import...", "Importera..."),
+    ("app.settings", "Export...", "Exportera..."),
+    ("app.settings", "Audio...", "Ljud..."),
+    ("app.settings", "Disk...", "Disk..."),
+    ("app.settings", "Memory & CPU...", "Minne och CPU..."),
+    ("app.settings", "Video...", "Video..."),
+    ("app.settings", "3D...", "3D..."),
+    ("app.settings", "Scripting & Expressions...", "Skript och uttryck..."),
+    ("app.hide", "Hide EffectCraft", "Dölj EffectCraft"),
+    ("app.hideOthers", "Hide Others", "Göm övriga"),
+    ("app.showAll", "Show All", "Visa alla"),
+    ("app.quit", "Quit EffectCraft", "Avsluta EffectCraft"),
+    ("", "File", "Arkiv"),
+    ("", "New", "Nytt"),
+    ("file.newProject", "New Project", "Nytt projekt"),
+    ("file.newFromTemplate", "New Project from Template...", "Nytt projekt från mall..."),
+    ("project.newFolder", "New Folder", "Ny mapp"),
+    ("file.open", "Open Project...", "Öppna projekt..."),
+    ("", "Open Recent", "Öppna senaste"),
+    ("file.clearRecent", "Clear Recent Projects", "Rensa senaste projekt"),
+    ("file.close", "Close", "Stäng"),
+    ("file.closeProject", "Close Project", "Stäng projekt"),
+    ("file.save", "Save", "Spara"),
+    ("", "Save As", "Spara som"),
+    ("file.saveAs", "Save As...", "Spara som..."),
+    ("file.saveCopy", "Save a Copy...", "Spara en kopia..."),
+    ("file.saveCopyAsXml", "Save a Copy As XML...", "Spara en kopia som XML..."),
+    ("templates.saveAs", "Save as Template...", "Spara som mall..."),
+    ("file.incrementAndSave", "Increment and Save", "Räkna upp och spara"),
+    ("file.revert", "Revert", "Återgå"),
+    ("", "Import", "Importera"),
+    ("file.import", "File...", "Fil..."),
+    ("file.importMultiple", "Multiple Files...", "Flera filer..."),
+    ("file.importTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro-projekt..."),
+    ("file.importAep", "After Effects Project...", "After Effects-projekt..."),
+    ("file.exportAep", "After Effects Project...", "After Effects-projekt..."),
+    ("file.importProject", "EffectCraft Project...", "EffectCraft-projekt..."),
+    ("file.importPlaceholder", "Placeholder...", "Platshållare..."),
+    ("file.importSolid", "Solid...", "Enfärgad..."),
+    ("file.importLottie", "Lottie...", "Lottie..."),
+    ("file.importVanishingPoint", "Vanishing Point (.vpe)...", "Fluktpunkt (.vpe)..."),
+    ("essential.importTemplate", "Essential Graphics Template...", "Mall för grundläggande grafik..."),
+    ("", "Import Recent Footage", "Importera senaste material"),
+    ("file.clearRecentFootage", "Clear Recent Footage", "Rensa senaste filmmaterial"),
+    ("", "Export", "Exportera"),
+    ("renderQueue.add", "Add to Render Queue", "Lägg till i renderingskön"),
+    ("file.exportTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro-projekt..."),
+    ("file.exportLottie", "Lottie JSON...", "Lottie JSON..."),
+    ("essential.exportTemplate", "Essential Graphics Template...", "Mall för grundläggande grafik..."),
+    ("app.find", "Find", "Sök"),
+    ("layer.addItem", "Add Footage to Comp", "Lägg till filmmaterial i komposition"),
+    ("file.newCompFromSelection", "New Comp from Selection...", "Ny komposition från markering..."),
+    ("", "Dependencies", "Beroenden"),
+    ("file.collectFiles", "Collect Files...", "Samla filer..."),
+    ("file.consolidateFootage", "Consolidate All Footage", "Konsolidera allt filmmaterial"),
+    ("file.removeUnusedFootage", "Remove Unused Footage", "Ta bort oanvänt filmmaterial"),
+    ("file.reduceProject", "Reduce Project", "Reducera projekt"),
+    ("file.findMissing", "Find Missing Effects", "Sök saknade effekter"),
+    ("file.findMissing", "Find Missing Fonts", "Sök saknade typsnitt"),
+    ("file.findMissing", "Find Missing Footage", "Sök saknat filmmaterial"),
+    ("file.relinkFootage", "Relink Missing Footage...", "Länka om saknat filmmaterial..."),
+    ("file.watchFolder", "Watch Folder...", "Bevakad mapp..."),
+    ("", "Scripts", "Skript"),
+    ("file.installScript", "Install Script File...", "Installera skriptfil..."),
+    ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Installera ScriptUI-panel..."),
+    ("file.runScript", "Run Script File...", "Kör skriptfil..."),
+    ("", "Create Proxy", "Skapa proxy"),
+    ("file.createProxy", "Still...", "Stillbild..."),
+    ("file.createProxy", "Movie...", "Film..."),
+    ("", "Set Proxy", "Ange proxy"),
+    ("file.setProxy", "File...", "Fil..."),
+    ("file.setProxyNone", "None", "Ingen"),
+    ("", "Interpret Footage", "Tolka material"),
+    ("file.interpretFootage", "Main...", "Huvud..."),
+    ("file.interpretProxy", "Proxy...", "Proxy..."),
+    ("file.rememberInterpretation", "Remember Interpretation", "Kom ihåg tolkning"),
+    ("file.applyInterpretation", "Apply Interpretation", "Använd tolkning"),
+    ("", "Replace Footage", "Ersätt material"),
+    ("file.replaceFootage", "File...", "Fil..."),
+    ("file.replaceWithPlaceholder", "Placeholder...", "Platshållare..."),
+    ("file.replaceWithSolid", "Solid...", "Enfärgad..."),
+    ("file.replaceWithLayeredComp", "With Layered Comp", "Med komposition i lager"),
+    ("file.reloadFootage", "Reload Footage", "Läs in filmmaterial igen"),
+    ("file.revealInFinder", "Reveal in Finder", "Visa i Finder"),
+    ("file.projectSettings", "Project Settings...", "Projektinställningar..."),
+    ("app.quit", "Exit", "Avsluta"),
+    ("", "Edit", "Redigera"),
+    ("edit.undo", "Undo", "Ångra"),
+    ("edit.redo", "Redo", "Gör om"),
+    ("", "History", "Historik"),
+    ("app.commandPalette", "Quick Apply...", "Använd snabbt..."),
+    ("edit.cut", "Cut", "Klipp ut"),
+    ("edit.copy", "Copy", "Kopiera"),
+    ("edit.copyWithPropertyLinks", "Copy with Property Links", "Kopiera med egenskapslänkar"),
+    ("edit.copyWithRelativePropertyLinks", "Copy with Relative Property Links", "Kopiera med relativa egenskapslänkar"),
+    ("edit.copyExpressionOnly", "Copy Expression Only", "Kopiera endast uttryck"),
+    ("edit.paste", "Paste", "Klistra in"),
+    ("edit.pasteReversedKeyframes", "Paste Reversed Keyframes", "Klistra in omvända nyckelbildrutor"),
+    ("edit.pasteTextMatchFormatting", "Paste Text and Match Formatting", "Klistra in text och matcha formatering"),
+    ("edit.pasteTextFormattingOnly", "Paste Text Formatting Only", "Klistra in endast textformatering"),
+    ("edit.clear", "Clear", "Rensa"),
+    ("edit.duplicate", "Duplicate", "Duplicera"),
+    ("edit.splitLayer", "Split Layer", "Dela lager"),
+    ("edit.liftWorkArea", "Lift Work Area", "Lyft arbetsområde"),
+    ("edit.extractWorkArea", "Extract Work Area", "Extrahera arbetsområde"),
+    ("edit.selectAll", "Select All", "Markera alla"),
+    ("edit.deselectAll", "Deselect All", "Avmarkera alla"),
+    ("", "Label", "Etikett"),
+    ("edit.selectLabelGroup", "Select Label Group", "Markera etikettgrupp"),
+    ("edit.label", "None", "Ingen"),
+    ("edit.label", "Red", "Röd"),
+    ("edit.label", "Yellow", "Gul"),
+    ("edit.label", "Aqua", "Akvamarin"),
+    ("edit.label", "Pink", "Rosa"),
+    ("edit.label", "Lavender", "Lavendel"),
+    ("edit.label", "Peach", "Persika"),
+    ("edit.label", "Sea Foam", "Havsskum"),
+    ("edit.label", "Blue", "Blå"),
+    ("edit.label", "Green", "Grön"),
+    ("edit.label", "Purple", "Lila"),
+    ("edit.label", "Orange", "Orange"),
+    ("edit.label", "Brown", "Brun"),
+    ("edit.label", "Fuchsia", "Fuchsia"),
+    ("edit.label", "Cyan", "Cyan"),
+    ("edit.label", "Sandstone", "Sandsten"),
+    ("edit.label", "Dark Green", "Mörkgrön"),
+    ("app.settings", "Edit Label Colors...", "Redigera etikettfärger..."),
+    ("", "Select Keyframe Label Group", "Markera etikettgrupp för nyckelbildrutor"),
+    ("keys.selectLabelGroup", "On Selected Layers", "På markerade lager"),
+    ("keys.selectLabelGroup", "On All Layers", "På alla lager"),
+    ("keys.selectLabelGroup", "Visible Keyframes on Selected Layers", "Synliga nyckelbildrutor på markerade lager"),
+    ("keys.selectLabelGroup", "Visible Keyframes on All Layers", "Synliga nyckelbildrutor på alla lager"),
+    ("", "Purge", "Rensa"),
+    ("edit.purge", "All Cache...", "All cache..."),
+    ("edit.purge", "All Memory & Disk Cache...", "Allt minne och all diskcache..."),
+    ("edit.purge", "All Memory", "Allt minne"),
+    ("edit.purge", "All Disk Cache...", "All diskcache..."),
+    ("edit.purge", "All 3D Cache...", "All 3D-cache..."),
+    ("edit.purgeUndo", "Undo", "Ångra"),
+    ("edit.purge", "Image Cache Memory", "Bildcacheminne"),
+    ("edit.purge", "Snapshot", "Ögonblicksbild"),
+    ("edit.editOriginal", "Edit Original...", "Redigera original..."),
+    ("", "Templates", "Mallar"),
+    ("app.templates", "Render Settings...", "Renderingsinställningar..."),
+    ("app.templates", "Output Module...", "Utgångsmodul..."),
+    ("app.keyboardShortcuts", "Keyboard Shortcuts", "Kortkommandon"),
+    ("", "Preferences", "Inställningar"),
+    ("", "Composition", "Komposition"),
+    ("comp.new", "New Composition...", "Ny komposition..."),
+    ("comp.settings", "Composition Settings...", "Kompositionsinställningar..."),
+    ("comp.setPosterTime", "Set Poster Time", "Ange affischtid"),
+    ("comp.trimToWorkArea", "Trim Comp to Work Area", "Trimma komp till arbetsområde"),
+    ("comp.cropToRegionOfInterest", "Crop Comp to Region of Interest", "Beskär komp till intresseregion"),
+    ("comp.cropToLayerBounds", "Crop Comp to Selected Layer(s) Bounds", "Beskär komp till markerade lager(s) gränser"),
+    ("render.addOutputModule", "Add Output Module", "Lägg till utgångsmodul"),
+    ("", "Preview", "Förhandsgranskning"),
+    ("playback.toggle", "Play Current Preview", "Spela upp aktuell förhandsgranskning"),
+    ("playback.cacheWhenIdle", "Cache Frames When Idle", "Cachelagra bildrutor vid inaktivitet"),
+    ("playback.audio", "Audio", "Ljud"),
+    ("", "Save Frame As", "Spara bildruta som"),
+    ("comp.saveFrameAs", "File...", "Fil..."),
+    ("comp.saveFrameAsPsd", "Photoshop Layers...", "Photoshop-lager..."),
+    ("comp.saveFrameAsExr", "ProEXR...", "ProEXR..."),
+    ("comp.copyFrame", "Copy Frame to Clipboard", "Kopiera bildruta till Urklipp"),
+    ("render.preRender", "Pre-render...", "Förrendera..."),
+    ("render.saveCurrentPreview", "Save Current Preview...", "Spara aktuell förhandsgranskning..."),
+    ("comp.openInEssentialGraphics", "Open in Essential Graphics", "Öppna i Grundläggande grafik"),
+    ("", "Responsive Design — Time", "Responsiv design — tid"),
+    ("comp.responsiveTime", "Create Intro", "Skapa intro"),
+    ("comp.responsiveTime", "Create Outro", "Skapa outro"),
+    ("comp.responsiveTime", "Create Protected Region from Work Area", "Skapa skyddad region från arbetsområde"),
+    ("comp.flowchart", "Composition Flowchart", "Kompositionsflödesschema"),
+    ("comp.miniFlowchart", "Composition Mini-Flowchart", "Kompositionens miniflödesschema"),
+    ("", "VR", "VR"),
+    ("comp.vr.createEnvironment", "Create VR Environment...", "Skapa VR-miljö..."),
+    ("comp.vr.extractCubemap", "Extract Cubemap...", "Extrahera kubkarta..."),
+    ("", "Layer", "Lager"),
+    ("layer.newText", "Text", "Text"),
+    ("layer.newSolid", "Solid...", "Enfärgad..."),
+    ("layer.newLight", "Light...", "Ljus..."),
+    ("layer.newCamera", "Camera...", "Kamera..."),
+    ("layer.newNull", "Null Object", "Nullobjekt"),
+    ("layer.newShape", "Shape Layer", "Formlager"),
+    ("layer.newAdjustment", "Adjustment Layer", "Justeringslager"),
+    ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Innehållsmedvetet fyllningslager..."),
+    ("layer.new3dPrimitive", "Cube", "Kub"),
+    ("layer.new3dPrimitive", "Sphere", "Sfär"),
+    ("layer.new3dPrimitive", "Plane", "Plan"),
+    ("layer.new3dPrimitive", "Torus", "Torus"),
+    ("layer.new3dPrimitive", "Cone", "Kon"),
+    ("layer.new3dPrimitive", "Cylinder", "Cylinder"),
+    ("layer.settings", "Layer Settings...", "Lagerinställningar..."),
+    ("layer.openLayer", "Open Layer", "Öppna lager"),
+    ("layer.openSource", "Open Layer Source", "Öppna lagerkälla"),
+    ("layer.revealInFinder", "Reveal in Finder", "Visa i Finder"),
+    ("", "Mask", "Mask"),
+    ("layer.addMask", "New Mask", "Ny mask"),
+    ("layer.mask.shape", "Mask Shape...", "Maskform..."),
+    ("layer.mask.set", "Mask Feather...", "Maskfjädring..."),
+    ("layer.mask.set", "Mask Opacity...", "Maskopacitet..."),
+    ("layer.mask.set", "Mask Expansion...", "Maskexpansion..."),
+    ("layer.mask.reset", "Reset Mask", "Återställ mask"),
+    ("layer.mask.remove", "Remove Mask", "Ta bort mask"),
+    ("layer.mask.removeAll", "Remove All Masks", "Ta bort alla masker"),
+    ("track.mask", "Track Mask", "Spåra mask"),
+    ("", "Mode", "Läge"),
+    ("layer.mask.mode", "None", "Ingen"),
+    ("layer.mask.mode", "Add", "Addera"),
+    ("layer.mask.mode", "Subtract", "Subtrahera"),
+    ("layer.mask.mode", "Intersect", "Skärning"),
+    ("layer.mask.mode", "Lighten", "Ljusare"),
+    ("layer.mask.mode", "Darken", "Mörkare"),
+    ("layer.mask.mode", "Difference", "Differens"),
+    ("layer.mask.invert", "Inverted", "Inverterad"),
+    ("layer.mask.lock", "Locked", "Låst"),
+    ("", "Motion Blur", "Rörelseoskärpa"),
+    ("layer.mask.motionBlur", "Same As Layer", "Samma som lagret"),
+    ("layer.mask.motionBlur", "On", "På"),
+    ("layer.mask.motionBlur", "Off", "Av"),
+    ("", "Feather Falloff", "Fjädringsavtagande"),
+    ("layer.mask.featherFalloff", "Smooth", "Mjuk"),
+    ("layer.mask.featherFalloff", "Linear", "Linjär"),
+    ("layer.mask.unlockAll", "Unlock All Masks", "Lås upp alla masker"),
+    ("layer.mask.lockOthers", "Lock Other Masks", "Lås andra masker"),
+    ("layer.mask.hideLocked", "Hide Locked Masks", "Dölj låsta masker"),
+    ("", "Mask and Shape Path", "Mask- och formbana"),
+    ("path.rotoBezier", "RotoBezier", "RotoBezier"),
+    ("mask.setClosed", "Closed", "Sluten"),
+    ("path.convertToBezier", "Convert To Bezier Path", "Konvertera till Bezierbana"),
+    ("path.setFirstVertex", "Set First Vertex", "Ange första hörnpunkt"),
+    ("path.freeTransform", "Free Transform Points", "Fri transformering av punkter"),
+    ("", "Quality", "Kvalitet"),
+    ("layer.quality", "Best", "Bästa"),
+    ("layer.quality", "Draft", "Utkast"),
+    ("layer.quality", "Wireframe", "Trådram"),
+    ("layer.sampling", "Bilinear", "Bilinjär"),
+    ("layer.sampling", "Bicubic", "Bikubisk"),
+    ("", "Switches", "Växlar"),
+    ("layer.hideOtherVideo", "Hide Other Video", "Dölj annan video"),
+    ("layer.showAllVideo", "Show All Video", "Visa all video"),
+    ("layer.unlockAll", "Unlock All Layers", "Lås upp alla lager"),
+    ("layer.expressions", "Enable Expressions", "Aktivera uttryck"),
+    ("layer.expressions", "Disable Expressions", "Inaktivera uttryck"),
+    ("layer.setSwitch", "Shy", "Blyg"),
+    ("layer.setSwitch", "Lock", "Lås"),
+    ("layer.setSwitch", "Audio", "Ljud"),
+    ("layer.setSwitch", "Video", "Video"),
+    ("layer.setSwitch", "Solo", "Solo"),
+    ("layer.setSwitch", "Effect", "Effekt"),
+    ("layer.setSwitch", "Collapse", "Komprimera"),
+    ("layer.setSwitch", "Motion Blur", "Rörelseoskärpa"),
+    ("layer.setSwitch", "Adjustment Layer", "Justeringslager"),
+    ("", "Transform", "Transformera"),
+    ("layer.transform", "Reset", "Återställ"),
+    ("layer.setTransform", "Anchor Point...", "Ankarpunkt..."),
+    ("layer.setTransform", "Position...", "Position..."),
+    ("layer.setTransform", "Scale...", "Skala..."),
+    ("layer.setTransform", "Orientation...", "Orientering..."),
+    ("layer.setTransform", "Rotation...", "Rotation..."),
+    ("layer.setTransform", "Opacity...", "Opacitet..."),
+    ("layer.transform", "Flip Horizontal", "Vänd vågrätt"),
+    ("layer.transform", "Flip Vertical", "Vänd lodrätt"),
+    ("layer.transform", "Center In View", "Centrera i vyn"),
+    ("layer.centerAnchor", "Center Anchor Point in Layer Content", "Centrera ankarpunkt i lagerinnehållet"),
+    ("layer.transform", "Fit to Comp", "Anpassa till kompositionen"),
+    ("layer.transform", "Fit to Comp Width", "Anpassa till kompositionens bredd"),
+    ("layer.transform", "Fit to Comp Height", "Anpassa till kompositionens höjd"),
+    ("layer.autoOrient", "Auto-Orient...", "Automatisk orientering..."),
+    ("", "Time", "Tid"),
+    ("layer.enableTimeRemap", "Enable Time Remapping", "Aktivera tidsomvandling"),
+    ("layer.timeReverse", "Time-Reverse Layer", "Tidsomvänd lager"),
+    ("layer.timeStretch", "Time Stretch...", "Tidssträckning..."),
+    ("layer.freezeFrame", "Freeze Frame", "Frys bildruta"),
+    ("layer.freezeOnLastFrame", "Freeze On Last Frame", "Frys på sista bildrutan"),
+    ("layer.alignVideoToData", "Align Video to Data", "Justera video efter data"),
+    ("", "Frame Blending", "Bildblandning"),
+    ("layer.frameBlending", "Off", "Av"),
+    ("layer.frameBlending", "Frame Mix", "Bildrutemix"),
+    ("layer.frameBlending", "Pixel Motion", "Pixelrörelse"),
+    ("layer.setSwitch", "3D Layer", "3D-lager"),
+    ("layer.setSwitch", "Guide Layer", "Hjälplager"),
+    ("layer.environment", "Environment Layer", "Miljölager"),
+    ("", "Markers", "Markörer"),
+    ("layer.addMarker", "Add Marker", "Lägg till markör"),
+    ("layer.updateMarkersFromSource", "Update Markers From Source", "Uppdatera markörer från källan"),
+    ("layer.markersLock", "Lock Markers", "Lås markörer"),
+    ("layer.deleteAllMarkers", "Delete All Markers", "Radera alla markörer"),
+    ("layer.setSwitch", "Preserve Transparency", "Bevara transparens"),
+    ("", "Blending Mode", "Blandningsläge"),
+    ("layer.setBlendMode", "Normal", "Normal"),
+    ("layer.setBlendMode", "Dissolve", "Övertoning"),
+    ("layer.setBlendMode", "Dancing Dissolve", "Dansande övertoning"),
+    ("layer.setBlendMode", "Darken", "Mörkare"),
+    ("layer.setBlendMode", "Multiply", "Multiplicera"),
+    ("layer.setBlendMode", "Color Burn", "Färgefterbelysning"),
+    ("layer.setBlendMode", "Classic Color Burn", "Klassisk färgefterbelysning"),
+    ("layer.setBlendMode", "Linear Burn", "Linjär efterbelysning"),
+    ("layer.setBlendMode", "Darker Color", "Mörkare färg"),
+    ("layer.setBlendMode", "Add", "Addera"),
+    ("layer.setBlendMode", "Lighten", "Ljusare"),
+    ("layer.setBlendMode", "Screen", "Skärm"),
+    ("layer.setBlendMode", "Color Dodge", "Färgskuggning"),
+    ("layer.setBlendMode", "Classic Color Dodge", "Klassisk färgskuggning"),
+    ("layer.setBlendMode", "Linear Dodge", "Linjär skuggning"),
+    ("layer.setBlendMode", "Lighter Color", "Ljusare färg"),
+    ("layer.setBlendMode", "Overlay", "Överlägg"),
+    ("layer.setBlendMode", "Soft Light", "Mjukt ljus"),
+    ("layer.setBlendMode", "Hard Light", "Hårt ljus"),
+    ("layer.setBlendMode", "Linear Light", "Linjärt ljus"),
+    ("layer.setBlendMode", "Vivid Light", "Intensivt ljus"),
+    ("layer.setBlendMode", "Pin Light", "Punktljus"),
+    ("layer.setBlendMode", "Hard Mix", "Hård blandning"),
+    ("layer.setBlendMode", "Difference", "Differens"),
+    ("layer.setBlendMode", "Classic Difference", "Klassisk differens"),
+    ("layer.setBlendMode", "Exclusion", "Uteslutning"),
+    ("layer.setBlendMode", "Subtract", "Subtrahera"),
+    ("layer.setBlendMode", "Divide", "Dividera"),
+    ("layer.setBlendMode", "Hue", "Nyans"),
+    ("layer.setBlendMode", "Saturation", "Mättnad"),
+    ("layer.setBlendMode", "Color", "Färg"),
+    ("layer.setBlendMode", "Luminosity", "Luminositet"),
+    ("layer.setBlendMode", "Stencil Alpha", "Schablon alfa"),
+    ("layer.setBlendMode", "Stencil Luma", "Schablon luma"),
+    ("layer.setBlendMode", "Silhouette Alpha", "Siluett alfa"),
+    ("layer.setBlendMode", "Silhouette Luma", "Siluett luma"),
+    ("layer.setBlendMode", "Alpha Add", "Alfa addera"),
+    ("layer.setBlendMode", "Luminescent Premul", "Luminiscent förmultiplicerad"),
+    ("layer.setBlendMode", "Next Blending Mode", "Nästa blandningsläge"),
+    ("layer.setBlendMode", "Previous Blending Mode", "Föregående blandningsläge"),
+    ("", "Track Matte", "Track matte"),
+    ("layer.trackMatte", "No Track Matte", "Ingen track matte"),
+    ("layer.trackMatte", "Alpha Matte", "Alfamatte"),
+    ("layer.trackMatte", "Alpha Inverted Matte", "Inverterad alfamatte"),
+    ("layer.trackMatte", "Luma Matte", "Lumamatte"),
+    ("layer.trackMatte", "Luma Inverted Matte", "Inverterad lumamatte"),
+    ("layer.trackMatte", "Matte with Layer Above", "Matte med lagret ovanför"),
+    ("layer.trackMatte", "Matte with Layer Below", "Matte med lagret nedanför"),
+    ("", "Layer Styles", "Lagerstilar"),
+    ("layer.style.options", "Layer Style Options...", "Lagerstilsalternativ..."),
+    ("layer.style.convertToEditable", "Convert to Editable Styles", "Konvertera till redigerbara stilar"),
+    ("layer.style.showAll", "Show All", "Visa alla"),
+    ("layer.style.removeAll", "Remove All", "Ta bort alla"),
+    ("layer.style.dropShadow", "Drop Shadow", "Slagskugga"),
+    ("layer.style.innerShadow", "Inner Shadow", "Inre skugga"),
+    ("layer.style.outerGlow", "Outer Glow", "Yttre glöd"),
+    ("layer.style.innerGlow", "Inner Glow", "Inre glöd"),
+    ("layer.style.bevelEmboss", "Bevel and Emboss", "Fasning och relief"),
+    ("layer.style.satin", "Satin", "Satin"),
+    ("layer.style.colorOverlay", "Color Overlay", "Färgöverlägg"),
+    ("layer.style.gradientOverlay", "Gradient Overlay", "Gradientöverlägg"),
+    ("layer.style.stroke", "Stroke", "Kontur"),
+    ("path.groupShapes", "Group Shapes", "Gruppera former"),
+    ("path.ungroupShapes", "Ungroup Shapes", "Avgruppera former"),
+    ("", "Arrange", "Ordna"),
+    ("layer.arrange", "Bring Layer to Front", "Lägg lager överst"),
+    ("layer.arrange", "Bring Layer Forward", "Flytta fram lager"),
+    ("layer.arrange", "Send Layer Backward", "Flytta bak lager"),
+    ("layer.arrange", "Send Layer to Back", "Lägg lager underst"),
+    ("", "Reveal", "Visa"),
+    ("layer.revealSource", "Reveal Layer Source in Project", "Visa lagerkälla i projektet"),
+    ("comp.flowchart", "Reveal Layer in Project Flowchart", "Visa lager i projektflödesschema"),
+    ("comp.revealInProject", "Reveal Composition in Project", "Visa komposition i projekt"),
+    ("layer.revealExpressionErrors", "Reveal Expression Errors", "Visa uttrycksfel"),
+    ("", "Create", "Skapa"),
+    ("layer.create", "Convert to Editable Text", "Konvertera till redigerbar text"),
+    ("layer.create", "Create Shapes from Text", "Skapa former från text"),
+    ("layer.create", "Create Masks from Text", "Skapa masker från text"),
+    ("layer.create", "Create Shapes from Vector Layer", "Skapa former från vektorlager"),
+    ("layer.create", "Create Keyframes from Data", "Skapa nyckelbildrutor från data"),
+    ("layer.create", "Null Controllers for Positional Points", "Null-kontroller för positionspunkter"),
+    ("layer.create", "Null Controllers for Path Points", "Null-kontroller för banpunkter"),
+    ("layer.create", "Nulls Following Path Points", "Nullobjekt som följer banpunkter"),
+    ("layer.create", "Null Tracing Along Path", "Null som spårar längs bana"),
+    ("layer.create", "Create 3D Layer Instance", "Skapa 3D-lagerinstans"),
+    ("", "Camera", "Kamera"),
+    ("camera.fromView", "Create Camera from 3D View", "Skapa kamera från 3D-vy"),
+    ("camera.stereoRig", "Create Stereo 3D Rig", "Skapa stereo-3D-rigg"),
+    ("camera.orbitNull", "Create Orbit Null", "Skapa null för kretsning"),
+    ("camera.fromModel", "Create Cameras from 3D Model", "Skapa kameror från 3D-modell"),
+    ("camera.linkFocusToPoi", "Link Focus Distance to Point of Interest", "Länka fokusavstånd till intressepunkt"),
+    ("camera.linkFocusToLayer", "Link Focus Distance to Layer", "Länka fokusavstånd till lager"),
+    ("camera.setFocusToLayer", "Set Focus Distance to Layer", "Ange fokusavstånd till lager"),
+    ("layer.cameraSettings", "Camera Settings...", "Kamerainställningar..."),
+    ("view.reset3DView", "Reset 3D View", "Återställ 3D-vy"),
+    ("", "Light", "Ljus"),
+    ("light.fromModel", "Create Lights from 3D Model", "Skapa ljus från 3D-modell"),
+    ("light.controlWithCamera", "Control Light with Camera", "Styr ljuset med kameran"),
+    ("light.environmentBackground", "Create Environment Light Background Layer", "Skapa bakgrundslager för miljöljus"),
+    ("", "Material", "Material"),
+    ("material.revealSource", "Reveal Material Source in Project", "Visa materialkällan i projektet"),
+    ("material.reset", "Reset Material", "Återställ material"),
+    ("material.duplicateAssign", "Duplicate and Assign Material", "Duplicera och tilldela material"),
+    ("layer.autoTrace", "Auto-trace...", "Automatisk konturspårning..."),
+    ("layer.precompose", "Pre-compose...", "Förkomponera..."),
+    ("layer.sceneEditDetection", "Scene Edit Detection...", "Identifiering av scensnitt..."),
+    ("", "Effect", "Effekt"),
+    ("window.panel", "Effect Controls", "Effektkontroller"),
+    ("effect.applyLast", "Last Effect", "Senaste effekten"),
+    ("effect.removeAll", "Remove All", "Ta bort alla"),
+    ("effect.manage", "Manage Effects...", "Hantera effekter..."),
+    ("effect.plugins.load", "Load Effect Plug-in...", "Läs in effektplugin..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Läs in plugin via hjälpprogram..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Sök efter effekthjälpprogram"),
+    ("", "Animation", "Animering"),
+    ("anim.savePreset", "Save Animation Preset...", "Spara animeringsförinställning..."),
+    ("anim.applyPreset", "Apply Animation Preset...", "Använd animeringsförinställning..."),
+    ("", "Recent Animation Presets", "Senaste animeringsförinställningar"),
+    ("anim.clearRecentPresets", "Clear Recent Presets", "Rensa senaste förinställningar"),
+    ("anim.browsePresets", "Browse Presets...", "Bläddra bland förinställningar..."),
+    ("", "Text Animation Presets", "Förinställningar för textanimering"),
+    ("layer.applyTextPreset", "Typewriter", "Skrivmaskin"),
+    ("layer.applyTextPreset", "Fade Up Characters", "Tona upp tecken"),
+    ("layer.applyTextPreset", "Bounce In Words", "Studsa in ord"),
+    ("layer.applyTextPreset", "Tracking In", "Spärrning in"),
+    ("layer.applyTextPreset", "Scramble", "Kasta om"),
+    ("layer.applyTextPreset", "Blur In", "Oskärpa in"),
+    ("layer.applyTextPreset", "Jitter", "Darr"),
+    ("layer.applyTextPreset", "Drop In Lines", "Släpp in rader"),
+    ("anim.addKeyframe", "Add Keyframe", "Lägg till nyckelbildruta"),
+    ("keys.toggleHold", "Toggle Hold Keyframe", "Växla hållen nyckelbildruta"),
+    ("keys.interpolation", "Keyframe Interpolation...", "Interpolering för nyckelbildrutor..."),
+    ("keys.velocity", "Keyframe Velocity...", "Ändringshastighet för nyckelbildrutor..."),
+    ("", "Keyframe Assistant", "Nyckelbildrutsassistent"),
+    ("keys.audioToKeyframes", "Convert Audio to Keyframes", "Konvertera ljud till nyckelbildrutor"),
+    ("prop.convertExpressionToKeyframes", "Convert Expression to Keyframes", "Konvertera uttryck till nyckelbildrutor"),
+    ("keys.easyEase", "Easy Ease", "Mjukt in och ut"),
+    ("keys.easyEaseIn", "Easy Ease In", "Mjukt in"),
+    ("keys.easyEaseOut", "Easy Ease Out", "Mjukt ut"),
+    ("keys.exponentialScale", "Exponential Scale", "Exponentiell skala"),
+    ("keys.rpfCameraImport", "RPF Camera Import", "RPF-kameraimport"),
+    ("layer.sequence", "Sequence Layers...", "Sekvensera lager..."),
+    ("keys.timeReverse", "Time-Reverse Keyframes", "Vänd nyckelbildrutor i tid"),
+    ("", "Animate Text", "Animera text"),
+    ("layer.enablePerChar3D", "Enable Per-character 3D", "Aktivera 3D per tecken"),
+    ("layer.addTextAnimator", "Anchor Point", "Ankarpunkt"),
+    ("layer.addTextAnimator", "Position", "Position"),
+    ("layer.addTextAnimator", "Scale", "Skala"),
+    ("layer.addTextAnimator", "Skew", "Skevning"),
+    ("layer.addTextAnimator", "Rotation", "Rotation"),
+    ("layer.addTextAnimator", "Opacity", "Opacitet"),
+    ("layer.addTextAnimator", "All Transform Properties", "Alla transformeringsegenskaper"),
+    ("", "Fill Color", "Fyllnadsfärg"),
+    ("layer.addTextAnimator", "RGB", "RGB"),
+    ("layer.addTextAnimator", "Hue", "Nyans"),
+    ("layer.addTextAnimator", "Saturation", "Mättnad"),
+    ("layer.addTextAnimator", "Brightness", "Ljusstyrka"),
+    ("", "Stroke Color", "Konturfärg"),
+    ("layer.addTextAnimator", "Stroke Width", "Konturbredd"),
+    ("", "Front", "Fram"),
+    ("", "Bevel", "Fasning"),
+    ("", "Side", "Sida"),
+    ("", "Back", "Tillbaka"),
+    ("layer.addTextAnimator", "Color", "Färg"),
+    ("layer.addTextAnimator", "Tracking", "Spärrning"),
+    ("layer.addTextAnimator", "Line Anchor", "Radankare"),
+    ("layer.addTextAnimator", "Line Spacing", "Radavstånd"),
+    ("layer.addTextAnimator", "Character Offset", "Teckenförskjutning"),
+    ("layer.addTextAnimator", "Character Value", "Teckenvärde"),
+    ("layer.addTextAnimator", "Blur", "Oskärpa"),
+    ("text.animatorFontAxes", "Variable Font Axes", "Axlar för variabla typsnitt"),
+    ("", "Add Text Selector", "Lägg till textväljare"),
+    ("text.addSelector", "Range", "Omfång"),
+    ("text.addSelector", "Wiggly", "Vickande"),
+    ("text.addSelector", "Expression", "Uttryck"),
+    ("text.removeAllAnimators", "Remove All Text Animators", "Ta bort alla textanimatörer"),
+    ("prop.setExpression", "Add Expression", "Lägg till uttryck"),
+    ("essential.addProperty", "Add Property to Essential Graphics", "Lägg till egenskap i Grundläggande grafik"),
+    ("prop.separateDimensions", "Separate Dimensions", "Separera dimensioner"),
+    ("track.camera", "Track Camera", "Spåra kamera"),
+    ("track.warpStabilizer", "Warp Stabilizer VFX", "Warp Stabilizer VFX"),
+    ("track.motion", "Track Motion", "Spåra rörelse"),
+    ("track.stabilize", "Stabilize Motion", "Stabilisera rörelse"),
+    ("track.property", "Track this Property", "Spåra den här egenskapen"),
+    ("anim.reveal", "Reveal Properties with Keyframes", "Visa egenskaper med nyckelbildrutor"),
+    ("anim.reveal", "Reveal Properties with Animation", "Visa egenskaper med animering"),
+    ("anim.reveal", "Reveal All Modified Properties", "Visa alla ändrade egenskaper"),
+    ("", "View", "Visa"),
+    ("view.newViewer", "New Viewer", "Ny visare"),
+    ("view.splitLockedViewer", "Split with New Locked Viewer", "Dela med ny låst visare"),
+    ("view.zoomIn", "Zoom In", "Zooma in"),
+    ("view.zoomOut", "Zoom Out", "Zooma ut"),
+    ("", "Resolution", "Upplösning"),
+    ("view.res.full", "Full", "Full"),
+    ("view.res.half", "Half", "Halv"),
+    ("view.res.third", "Third", "En tredjedel"),
+    ("view.res.quarter", "Quarter", "En fjärdedel"),
+    ("view.res.custom", "Custom...", "Anpassad..."),
+    ("view.displayColorManagement", "Use Display Color Management", "Använd färghantering för bildskärm"),
+    ("", "Simulate Output", "Simulera utgång"),
+    ("view.simulateOutput", "No Output Simulation", "Ingen utdatasimulering"),
+    ("view.simulateOutput", "HDTV (Rec. 709)", "HDTV (Rec. 709)"),
+    ("view.simulateOutput", "SDTV NTSC", "SDTV NTSC"),
+    ("view.simulateOutput", "SDTV PAL", "SDTV PAL"),
+    ("view.simulateOutput", "Legacy Macintosh RGB (Gamma 1.8)", "Äldre Macintosh RGB (gamma 1,8)"),
+    ("view.simulateOutput", "Internet Standard RGB (sRGB)", "Internetstandard-RGB (sRGB)"),
+    ("view.simulateOutput", "UHDTV (Rec. 2020)", "UHDTV (Rec. 2020)"),
+    ("view.simulateOutput", "Display P3", "Display P3"),
+    ("view.simulateOutput", "Linear (1.0 Gamma)", "Linjär (gamma 1,0)"),
+    ("view.customRgb", "My Custom RGB...", "Min anpassade RGB..."),
+    ("view.simulateOutput", "Custom...", "Anpassad..."),
+    ("view.rulers", "Show Rulers", "Visa linjaler"),
+    ("", "Panel Background Color", "Panelens bakgrundsfärg"),
+    ("view.panelBackground", "Black", "Svart"),
+    ("view.panelBackground", "Dark Gray", "Mörkgrå"),
+    ("view.panelBackground", "Medium Gray (Default)", "Mellangrå (standard)"),
+    ("view.panelBackground", "Light Gray", "Ljusgrå"),
+    ("view.panelBackground", "White", "Vit"),
+    ("view.panelBackground", "Custom", "Anpassad"),
+    ("view.panelBackground", "Select Custom Background Color...", "Välj anpassad bakgrundsfärg..."),
+    ("view.guides", "Show Guides", "Visa stödlinjer"),
+    ("view.snapToGuides", "Snap to Guides", "Fäst mot stödlinjer"),
+    ("view.lockGuides", "Lock Guides", "Lås stödlinjer"),
+    ("view.addGuide", "Add Guide...", "Lägg till stödlinje..."),
+    ("view.addPercentGuide", "Add Percentage Guide...", "Lägg till procentstödlinje..."),
+    ("view.convertGuides", "Convert Guides to Percentage", "Konvertera stödlinjer till procent"),
+    ("view.convertGuides", "Convert Guides to Pixels", "Konvertera stödlinjer till pixlar"),
+    ("view.clearGuides", "Clear Guides", "Rensa stödlinjer"),
+    ("view.importGuides", "Import Guides...", "Importera stödlinjer..."),
+    ("view.exportGuides", "Export Guides...", "Exportera stödlinjer..."),
+    ("view.grid", "Show Grid", "Visa rutnät"),
+    ("view.snapToGrid", "Snap to Grid", "Fäst mot rutnät"),
+    ("view.snapping", "Snapping", "Fäst"),
+    ("view.options", "View Options...", "Visningsalternativ..."),
+    ("view.layerControls", "Show Layer Controls", "Visa lagerkontroller"),
+    ("", "Switch View Layout", "Växla vylayout"),
+    ("view.layout", "1 View", "1 vy"),
+    ("view.layout", "2 Views", "2 vyer"),
+    ("view.layout", "4 Views", "4 vyer"),
+    ("view.shareViewOptions", "Share View Options", "Dela visningsalternativ"),
+    ("", "Switch 3D View", "Växla 3D-vy"),
+    ("view.3d.activeCamera", "Active Camera", "Aktiv kamera"),
+    ("view.3d.default", "Default", "Standard"),
+    ("view.3d.front", "Front", "Framifrån"),
+    ("view.3d.left", "Left", "Vänster"),
+    ("view.3d.top", "Top", "Ovanifrån"),
+    ("view.3d.back", "Back", "Bakifrån"),
+    ("view.3d.right", "Right", "Höger"),
+    ("view.3d.bottom", "Bottom", "Underifrån"),
+    ("view.3d.custom1", "Custom View 1", "Anpassad vy 1"),
+    ("view.3d.custom2", "Custom View 2", "Anpassad vy 2"),
+    ("view.3d.custom3", "Custom View 3", "Anpassad vy 3"),
+    ("", "Assign Shortcut to 3D View", "Tilldela kortkommando till 3D-vy"),
+    ("view.3d.last", "Switch to Last 3D View", "Växla till senaste 3D-vy"),
+    ("view.lookAtSelected", "Look at Selected Layers", "Titta på markerade lager"),
+    ("view.lookAtAll", "Look at All Layers", "Titta på alla lager"),
+    ("time.set", "Go to Time...", "Gå till tid..."),
+    ("view.fullScreen", "Enter Full Screen", "Visa i helskärm"),
+    ("", "Window", "Fönster"),
+    ("", "Workspace", "Arbetslayout"),
+    ("window.workspace", "Default", "Standard"),
+    ("window.workspace", "Review", "Granskning"),
+    ("window.workspace", "Learn", "Lär dig"),
+    ("window.workspace", "Small Screen", "Liten skärm"),
+    ("window.workspace", "Standard", "Standard"),
+    ("window.workspace", "All Panels", "Alla paneler"),
+    ("window.workspace", "Animation", "Animering"),
+    ("window.workspace", "Color", "Färg"),
+    ("window.workspace", "Effects", "Effekter"),
+    ("window.workspace", "Essential Graphics", "Grundläggande grafik"),
+    ("window.workspace", "Minimal", "Minimal"),
+    ("window.workspace", "Motion Tracking", "Rörelsespårning"),
+    ("window.workspace", "Paint", "Måla"),
+    ("window.workspace", "Text", "Text"),
+    ("window.workspace", "Undocked Panels", "Odockade paneler"),
+    ("window.resetWorkspace", "Reset to Saved Layout", "Återställ till sparad layout"),
+    ("window.saveWorkspace", "Save Changes to this Workspace", "Spara ändringar i den här arbetslayouten"),
+    ("window.saveWorkspaceAs", "Save as New Workspace...", "Spara som ny arbetslayout..."),
+    ("window.editWorkspaces", "Edit Workspaces...", "Redigera arbetslayouter..."),
+    ("", "Assign Shortcut to Workspace", "Tilldela kortkommando till arbetslayout"),
+    ("window.panel", "Align", "Justera"),
+    ("window.panel", "Audio", "Ljud"),
+    ("window.panel", "Brushes", "Penslar"),
+    ("window.panel", "Character", "Tecken"),
+    ("window.panel", "Content-Aware Fill", "Innehållsmedveten fyllning"),
+    ("window.panel", "Effects & Presets", "Effekter och förinställningar"),
+    ("window.panel", "Essential Graphics", "Grundläggande grafik"),
+    ("window.panel", "Info", "Info"),
+    ("help.inAppTutorials", "Learn", "Lär dig"),
+    ("window.panel", "Video Scopes", "Videoskop"),
+    ("window.panel", "Mask Interpolation", "Maskinterpolering"),
+    ("window.panel", "Media Browser", "Mediebläddrare"),
+    ("window.panel", "Metadata", "Metadata"),
+    ("window.panel", "Motion Sketch", "Rörelseskiss"),
+    ("window.panel", "Paint", "Måla"),
+    ("window.panel", "Paragraph", "Stycke"),
+    ("window.panel", "Preview", "Förhandsgranskning"),
+    ("window.panel", "Progress", "Förlopp"),
+    ("window.panel", "Properties", "Egenskaper"),
+    ("window.panel", "Script Console", "Skriptkonsol"),
+    ("window.panel", "Smoother", "Utjämnare"),
+    ("window.panel", "Tools", "Verktyg"),
+    ("window.panel", "Tracker", "Spårare"),
+    ("window.panel", "Wiggler", "Vickare"),
+    ("window.panel", "Composition", "Komposition"),
+    ("window.panel", "Flowchart", "Flödesschema"),
+    ("window.panel", "Footage", "Filmmaterial"),
+    ("window.panel", "Layer", "Lager"),
+    ("window.panel", "Project", "Projekt"),
+    ("window.panel", "Render Queue", "Renderingskö"),
+    ("window.panel", "Timeline", "Tidslinje"),
+    ("window.panel", "Create Nulls From Paths", "Skapa nullobjekt från banor"),
+    ("window.panel", "VR Comp Editor", "VR-kompositionsredigerare"),
+    ("", "Help", "Hjälp"),
+    ("help.docs", "EffectCraft Help...", "EffectCraft-hjälp..."),
+    ("help.docs", "Scripting Help...", "Hjälp för skript..."),
+    ("help.docs", "Expression Reference...", "Uttrycksreferens..."),
+    ("help.docs", "Effect Reference...", "Effektreferens..."),
+    ("anim.browsePresets", "Animation Presets...", "Animeringsförinställningar..."),
+    ("app.keyboardShortcuts", "Keyboard Shortcuts...", "Kortkommandon..."),
+    ("help.inAppTutorials", "In-App Tutorials...", "Självstudier i appen..."),
+    ("help.onlineTutorials", "Online Tutorials...", "Självstudier online..."),
+    ("help.systemReport", "System Compatibility Report...", "Systemkompatibilitetsrapport..."),
+    ("help.enableLogging", "Enable Logging", "Aktivera loggning"),
+    ("help.revealLogFile", "Reveal Logging File", "Visa loggfil"),
+    ("help.discord", "Join the ArtCraft Discord...", "Gå med i ArtCraft på Discord..."),
+    ("help.reportIssue", "Provide Feedback...", "Ge återkoppling..."),
+    ("help.website", "ArtCraft Website", "ArtCrafts webbplats"),
+    ("help.appPage", "EffectCraft Home Page", "EffectCrafts startsida"),
+    ("help.github", "EffectCraft on GitHub", "EffectCraft på GitHub"),
+    ("file.openDemoProject", "Open Demo Project", "Öppna demoprojekt"),
+    ("", "Recent Script Files", "Senaste skriptfiler"),
+    ("layer.newPrimitive", "3D Primitive...", "3D-primitiv..."),
+    ("keys.setMuted", "Mute Keyframes", "Stäng av nyckelbildrutor"),
+    ("keys.setMuted", "Unmute Keyframes", "Slå på nyckelbildrutor"),
+];
+
 /// Traditional Chinese (zh-hant): the same (command, English label) keys as `JAPANESE`, one
 /// entry per fixed menu row of the engine's menu tree, mirroring `SIMPLIFIED_CHINESE` in the
 /// vocabulary the sibling Craft apps' zh-hant catalogs use.
@@ -990,6 +1788,8 @@ const TRADITIONAL_CHINESE: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "檔案..."),
     ("file.importMultiple", "Multiple Files...", "多個檔案..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro 專案..."),
+    ("file.importAep", "After Effects Project...", "After Effects 專案..."),
+    ("file.exportAep", "After Effects Project...", "After Effects 專案..."),
     ("file.importProject", "EffectCraft Project...", "EffectCraft 專案..."),
     ("file.importPlaceholder", "Placeholder...", "預留位置..."),
     ("file.importSolid", "Solid...", "純色..."),
@@ -1020,6 +1820,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "安裝指令碼檔案..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "安裝 ScriptUI 面板..."),
     ("file.runScript", "Run Script File...", "執行指令碼檔案..."),
+    ("", "Recent Script Files", "最近使用的指令碼檔案"),
     ("", "Create Proxy", "建立代理"),
     ("file.createProxy", "Still...", "靜態影像..."),
     ("file.createProxy", "Movie...", "影片..."),
@@ -1139,6 +1940,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "形狀圖層"),
     ("layer.newAdjustment", "Adjustment Layer", "調整圖層"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "內容感知填滿圖層..."),
+    ("layer.newPrimitive", "3D Primitive...", "3D 基本體..."),
     ("layer.new3dPrimitive", "Cube", "立方體"),
     ("layer.new3dPrimitive", "Sphere", "球體"),
     ("layer.new3dPrimitive", "Plane", "平面"),
@@ -1355,6 +2157,8 @@ const TRADITIONAL_CHINESE: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "全部移除"),
     ("effect.manage", "Manage Effects...", "管理效果..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "載入效果外掛程式..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "透過輔助程式載入外掛程式..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "掃描效果輔助程式"),
     ("", "Animation", "動畫"),
     ("anim.savePreset", "Save Animation Preset...", "儲存動畫預設集..."),
     ("anim.applyPreset", "Apply Animation Preset...", "套用動畫預設集..."),
@@ -1372,6 +2176,8 @@ const TRADITIONAL_CHINESE: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "行落下"),
     ("anim.addKeyframe", "Add Keyframe", "新增關鍵影格"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "切換定格關鍵影格"),
+    ("keys.setMuted", "Mute Keyframes", "靜音關鍵影格"),
+    ("keys.setMuted", "Unmute Keyframes", "取消靜音關鍵影格"),
     ("keys.interpolation", "Keyframe Interpolation...", "關鍵影格插補..."),
     ("keys.velocity", "Keyframe Velocity...", "關鍵影格速度..."),
     ("", "Keyframe Assistant", "關鍵影格輔助"),
@@ -1530,7 +2336,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "基本圖形"),
     ("window.panel", "Info", "資訊"),
     ("help.inAppTutorials", "Learn", "學習"),
-    ("window.panel", "Lumetri Scopes", "Lumetri 示波器"),
+    ("window.panel", "Video Scopes", "視訊示波器"),
     ("window.panel", "Mask Interpolation", "遮色片插補"),
     ("window.panel", "Media Browser", "媒體瀏覽器"),
     ("window.panel", "Metadata", "中繼資料"),
@@ -1621,6 +2427,8 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "ファイル..."),
     ("file.importMultiple", "Multiple Files...", "複数のファイル..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Proプロジェクト..."),
+    ("file.importAep", "After Effects Project...", "After Effectsプロジェクト..."),
+    ("file.exportAep", "After Effects Project...", "After Effectsプロジェクト..."),
     ("file.importPlaceholder", "Placeholder...", "プレースホルダー..."),
     ("file.importSolid", "Solid...", "平面..."),
     ("file.importLottie", "Lottie...", "Lottie..."),
@@ -1651,6 +2459,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "スクリプトファイルをインストール..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "ScriptUIパネルをインストール..."),
     ("file.runScript", "Run Script File...", "スクリプトファイルを実行..."),
+    ("", "Recent Script Files", "最近使用したスクリプトファイル"),
     ("", "Create Proxy", "プロキシを作成"),
     ("file.createProxy", "Still...", "静止画..."),
     ("file.createProxy", "Movie...", "ムービー..."),
@@ -1675,23 +2484,23 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("edit.undo", "Undo", "取り消し"),
     ("edit.redo", "Redo", "やり直し"),
     ("", "History", "履歴"),
-    ("app.commandPalette", "Quick Apply...", "クイック適用..."),
+    ("app.commandPalette", "Quick Apply...", "今すぐ適用..."),
     ("edit.cut", "Cut", "カット"),
     ("edit.copy", "Copy", "コピー"),
-    ("edit.copyWithPropertyLinks", "Copy with Property Links", "プロパティリンク付きでコピー"),
-    ("edit.copyWithRelativePropertyLinks", "Copy with Relative Property Links", "相対プロパティリンク付きでコピー"),
+    ("edit.copyWithPropertyLinks", "Copy with Property Links", "プロパティリンクと一緒にコピー"),
+    ("edit.copyWithRelativePropertyLinks", "Copy with Relative Property Links", "相対的なプロパティリンクと一緒にコピー"),
     ("edit.copyExpressionOnly", "Copy Expression Only", "エクスプレッションのみをコピー"),
     ("edit.paste", "Paste", "ペースト"),
-    ("edit.pasteReversedKeyframes", "Paste Reversed Keyframes", "逆順にキーフレームをペースト"),
-    ("edit.pasteTextMatchFormatting", "Paste Text and Match Formatting", "書式を合わせてテキストをペースト"),
-    ("edit.pasteTextFormattingOnly", "Paste Text Formatting Only", "テキストの書式のみをペースト"),
+    ("edit.pasteReversedKeyframes", "Paste Reversed Keyframes", "反転したキーフレームをペースト"),
+    ("edit.pasteTextMatchFormatting", "Paste Text and Match Formatting", "テキストをペーストし書式設定を一致させる"),
+    ("edit.pasteTextFormattingOnly", "Paste Text Formatting Only", "テキスト書式設定のみをペースト"),
     ("edit.clear", "Clear", "消去"),
     ("edit.duplicate", "Duplicate", "複製"),
     ("edit.splitLayer", "Split Layer", "レイヤーを分割"),
-    ("edit.liftWorkArea", "Lift Work Area", "ワークエリアをリフト"),
-    ("edit.extractWorkArea", "Extract Work Area", "ワークエリアを抽出"),
-    ("edit.selectAll", "Select All", "すべてを選択"),
-    ("edit.deselectAll", "Deselect All", "すべての選択を解除"),
+    ("edit.liftWorkArea", "Lift Work Area", "ワークエリアのリフト"),
+    ("edit.extractWorkArea", "Extract Work Area", "ワークエリアの抽出"),
+    ("edit.selectAll", "Select All", "すべて選択"),
+    ("edit.deselectAll", "Deselect All", "すべてを選択解除"),
     ("", "Label", "ラベル"),
     ("edit.selectLabelGroup", "Select Label Group", "ラベルグループを選択"),
     ("edit.label", "None", "なし"),
@@ -1717,7 +2526,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("keys.selectLabelGroup", "On All Layers", "すべてのレイヤー上"),
     ("keys.selectLabelGroup", "Visible Keyframes on Selected Layers", "選択したレイヤー上の表示キーフレーム"),
     ("keys.selectLabelGroup", "Visible Keyframes on All Layers", "すべてのレイヤー上の表示キーフレーム"),
-    ("", "Purge", "キャッシュを消去"),
+    ("", "Purge", "キャッシュの消去"),
     ("edit.purge", "All Cache...", "すべてのキャッシュ..."),
     ("edit.purge", "All Memory & Disk Cache...", "すべてのメモリおよびディスクキャッシュ..."),
     ("edit.purge", "All Memory", "すべてのメモリ"),
@@ -1737,7 +2546,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("comp.settings", "Composition Settings...", "コンポジション設定..."),
     ("comp.setPosterTime", "Set Poster Time", "ポスター時間を設定"),
     ("comp.trimToWorkArea", "Trim Comp to Work Area", "コンポジションをワークエリアにトリミング"),
-    ("comp.cropToRegionOfInterest", "Crop Comp to Region of Interest", "コンポジションを目標範囲にクロップ"),
+    ("comp.cropToRegionOfInterest", "Crop Comp to Region of Interest", "コンポジションを関心領域にクロップ"),
     ("comp.cropToLayerBounds", "Crop Comp to Selected Layer(s) Bounds", "コンポジションを選択レイヤーの境界にクロップ"),
     ("render.addOutputModule", "Add Output Module", "出力モジュールを追加"),
     ("", "Preview", "プレビュー"),
@@ -1770,6 +2579,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "シェイプレイヤー"),
     ("layer.newAdjustment", "Adjustment Layer", "調整レイヤー"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "コンテンツに応じた塗りつぶしレイヤー..."),
+    ("layer.newPrimitive", "3D Primitive...", "3Dプリミティブ..."),
     ("layer.new3dPrimitive", "Cube", "立方体"),
     ("layer.new3dPrimitive", "Sphere", "球体"),
     ("layer.new3dPrimitive", "Plane", "平面"),
@@ -1789,7 +2599,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.mask.reset", "Reset Mask", "マスクをリセット"),
     ("layer.mask.remove", "Remove Mask", "マスクを削除"),
     ("layer.mask.removeAll", "Remove All Masks", "すべてのマスクを削除"),
-    ("track.mask", "Track Mask", "マスクをトラック"),
+    ("track.mask", "Track Mask", "マスクをトラッキング"),
     ("", "Mode", "モード"),
     ("layer.mask.mode", "None", "なし"),
     ("layer.mask.mode", "Add", "加算"),
@@ -1854,8 +2664,8 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.transform", "Fit to Comp Height", "コンポジションの高さに合わせる"),
     ("layer.autoOrient", "Auto-Orient...", "自動方向..."),
     ("", "Time", "時間"),
-    ("layer.enableTimeRemap", "Enable Time Remapping", "タイムリマップ使用可能"),
-    ("layer.timeReverse", "Time-Reverse Layer", "時間反転レイヤー"),
+    ("layer.enableTimeRemap", "Enable Time Remapping", "時間リマップを有効化"),
+    ("layer.timeReverse", "Time-Reverse Layer", "レイヤーを時間反転"),
     ("layer.timeStretch", "Time Stretch...", "時間伸縮..."),
     ("layer.freezeFrame", "Freeze Frame", "フレームを固定"),
     ("layer.freezeOnLastFrame", "Freeze On Last Frame", "最後のフレームで固定"),
@@ -1923,7 +2733,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.trackMatte", "Matte with Layer Above", "上のレイヤーをマットにする"),
     ("layer.trackMatte", "Matte with Layer Below", "下のレイヤーをマットにする"),
     ("", "Layer Styles", "レイヤースタイル"),
-    ("layer.style.options", "Layer Style Options...", "レイヤースタイルオプション..."),
+    ("layer.style.options", "Layer Style Options...", "レイヤースタイルのオプション..."),
     ("layer.style.convertToEditable", "Convert to Editable Styles", "編集可能なスタイルに変換"),
     ("layer.style.showAll", "Show All", "すべてを表示"),
     ("layer.style.removeAll", "Remove All", "すべてを削除"),
@@ -1952,7 +2762,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.create", "Convert to Editable Text", "編集可能なテキストに変換"),
     ("layer.create", "Create Shapes from Text", "テキストからシェイプを作成"),
     ("layer.create", "Create Masks from Text", "テキストからマスクを作成"),
-    ("layer.create", "Create Shapes from Vector Layer", "ベクトルレイヤーからシェイプを作成"),
+    ("layer.create", "Create Shapes from Vector Layer", "ベクターレイヤーからシェイプを作成"),
     ("layer.create", "Create Keyframes from Data", "データからキーフレームを作成"),
     ("layer.create", "Null Controllers for Positional Points", "位置のポイント用ヌルコントローラー"),
     ("layer.create", "Null Controllers for Path Points", "パスのポイント用ヌルコントローラー"),
@@ -1986,6 +2796,8 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "すべてを削除"),
     ("effect.manage", "Manage Effects...", "エフェクトを管理..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "エフェクトプラグインを読み込み..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "ヘルパー経由でプラグインを読み込み..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "エフェクトヘルパーをスキャン"),
     ("", "Animation", "アニメーション"),
     ("anim.savePreset", "Save Animation Preset...", "アニメーションプリセットを保存..."),
     ("anim.applyPreset", "Apply Animation Preset...", "アニメーションプリセットを適用..."),
@@ -2002,7 +2814,9 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Jitter", "ジッター"),
     ("layer.applyTextPreset", "Drop In Lines", "行をドロップイン"),
     ("anim.addKeyframe", "Add Keyframe", "キーフレームを追加"),
-    ("keys.toggleHold", "Toggle Hold Keyframe", "停止したキーフレームの切り替え"),
+    ("keys.toggleHold", "Toggle Hold Keyframe", "ホールドキーフレームの切り替え"),
+    ("keys.setMuted", "Mute Keyframes", "キーフレームをミュート"),
+    ("keys.setMuted", "Unmute Keyframes", "キーフレームのミュートを解除"),
     ("keys.interpolation", "Keyframe Interpolation...", "キーフレーム補間法..."),
     ("keys.velocity", "Keyframe Velocity...", "キーフレーム速度..."),
     ("", "Keyframe Assistant", "キーフレーム補助"),
@@ -2016,11 +2830,11 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.sequence", "Sequence Layers...", "シーケンスレイヤー..."),
     ("keys.timeReverse", "Time-Reverse Keyframes", "時間反転キーフレーム"),
     ("", "Animate Text", "テキストをアニメート"),
-    ("layer.enablePerChar3D", "Enable Per-character 3D", "文字ごとの3Dを使用可能にする"),
+    ("layer.enablePerChar3D", "Enable Per-character 3D", "文字単位の 3D 化を使用"),
     ("layer.addTextAnimator", "Anchor Point", "アンカーポイント"),
     ("layer.addTextAnimator", "Position", "位置"),
     ("layer.addTextAnimator", "Scale", "スケール"),
-    ("layer.addTextAnimator", "Skew", "傾斜"),
+    ("layer.addTextAnimator", "Skew", "歪曲"),
     ("layer.addTextAnimator", "Rotation", "回転"),
     ("layer.addTextAnimator", "Opacity", "不透明度"),
     ("layer.addTextAnimator", "All Transform Properties", "すべてのトランスフォームプロパティ"),
@@ -2028,7 +2842,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("layer.addTextAnimator", "RGB", "RGB"),
     ("layer.addTextAnimator", "Hue", "色相"),
     ("layer.addTextAnimator", "Saturation", "彩度"),
-    ("layer.addTextAnimator", "Brightness", "明度"),
+    ("layer.addTextAnimator", "Brightness", "明るさ"),
     ("", "Stroke Color", "線のカラー"),
     ("layer.addTextAnimator", "Stroke Width", "線幅"),
     ("", "Front", "前面"),
@@ -2036,13 +2850,13 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("", "Side", "側面"),
     ("", "Back", "背面"),
     ("layer.addTextAnimator", "Color", "カラー"),
-    ("layer.addTextAnimator", "Tracking", "トラッキング"),
-    ("layer.addTextAnimator", "Line Anchor", "行のアンカー"),
-    ("layer.addTextAnimator", "Line Spacing", "行間"),
+    ("layer.addTextAnimator", "Tracking", "字送り"),
+    ("layer.addTextAnimator", "Line Anchor", "ラインアンカー"),
+    ("layer.addTextAnimator", "Line Spacing", "ラインスペース"),
     ("layer.addTextAnimator", "Character Offset", "文字のオフセット"),
-    ("layer.addTextAnimator", "Character Value", "文字の値"),
+    ("layer.addTextAnimator", "Character Value", "文字コード"),
     ("layer.addTextAnimator", "Blur", "ブラー"),
-    ("text.animatorFontAxes", "Variable Font Axes", "可変フォントの軸"),
+    ("text.animatorFontAxes", "Variable Font Axes", "バリアブルフォント軸"),
     ("", "Add Text Selector", "テキストセレクターを追加"),
     ("text.addSelector", "Range", "範囲"),
     ("text.addSelector", "Wiggly", "ウィグリー"),
@@ -2050,12 +2864,12 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("text.removeAllAnimators", "Remove All Text Animators", "すべてのテキストアニメーターを削除"),
     ("prop.setExpression", "Add Expression", "エクスプレッションを追加"),
     ("essential.addProperty", "Add Property to Essential Graphics", "エッセンシャルグラフィックスにプロパティを追加"),
-    ("prop.separateDimensions", "Separate Dimensions", "次元に分割"),
-    ("track.camera", "Track Camera", "カメラをトラック"),
+    ("prop.separateDimensions", "Separate Dimensions", "次元を分離"),
+    ("track.camera", "Track Camera", "カメラをトラッキング"),
     ("track.warpStabilizer", "Warp Stabilizer VFX", "ワープスタビライザーVFX"),
-    ("track.motion", "Track Motion", "モーションをトラック"),
-    ("track.stabilize", "Stabilize Motion", "モーションをスタビライズ"),
-    ("track.property", "Track this Property", "このプロパティをトラック"),
+    ("track.motion", "Track Motion", "モーションをトラッキング"),
+    ("track.stabilize", "Stabilize Motion", "モーションを安定化"),
+    ("track.property", "Track this Property", "このプロパティをトラッキング"),
     ("anim.reveal", "Reveal Properties with Keyframes", "キーフレームのあるプロパティを表示"),
     ("anim.reveal", "Reveal Properties with Animation", "アニメーションのあるプロパティを表示"),
     ("anim.reveal", "Reveal All Modified Properties", "変更されたすべてのプロパティを表示"),
@@ -2066,9 +2880,9 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("view.zoomOut", "Zoom Out", "ズームアウト"),
     ("", "Resolution", "解像度"),
     ("view.res.full", "Full", "フル画質"),
-    ("view.res.half", "Half", "1/2 画質"),
-    ("view.res.third", "Third", "1/3 画質"),
-    ("view.res.quarter", "Quarter", "1/4 画質"),
+    ("view.res.half", "Half", "1/2画質"),
+    ("view.res.third", "Third", "1/3画質"),
+    ("view.res.quarter", "Quarter", "1/4画質"),
     ("view.res.custom", "Custom...", "カスタム..."),
     ("view.displayColorManagement", "Use Display Color Management", "ディスプレイカラーマネジメントを使用"),
     ("", "Simulate Output", "出力をシミュレート"),
@@ -2114,16 +2928,16 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("view.shareViewOptions", "Share View Options", "表示オプションを共有"),
     ("", "Switch 3D View", "3Dビューを切り替え"),
     ("view.3d.activeCamera", "Active Camera", "アクティブカメラ"),
-    ("view.3d.default", "Default", "初期設定"),
-    ("view.3d.front", "Front", "フロント"),
-    ("view.3d.left", "Left", "レフト"),
-    ("view.3d.top", "Top", "トップ"),
-    ("view.3d.back", "Back", "バック"),
-    ("view.3d.right", "Right", "ライト"),
-    ("view.3d.bottom", "Bottom", "ボトム"),
-    ("view.3d.custom1", "Custom View 1", "カスタムビュー1"),
-    ("view.3d.custom2", "Custom View 2", "カスタムビュー2"),
-    ("view.3d.custom3", "Custom View 3", "カスタムビュー3"),
+    ("view.3d.default", "Default", "デフォルト"),
+    ("view.3d.front", "Front", "フロントビュー"),
+    ("view.3d.left", "Left", "レフトビュー"),
+    ("view.3d.top", "Top", "トップビュー"),
+    ("view.3d.back", "Back", "バックビュー"),
+    ("view.3d.right", "Right", "ライトビュー"),
+    ("view.3d.bottom", "Bottom", "ボトムビュー"),
+    ("view.3d.custom1", "Custom View 1", "カスタムビュー 1"),
+    ("view.3d.custom2", "Custom View 2", "カスタムビュー 2"),
+    ("view.3d.custom3", "Custom View 3", "カスタムビュー 3"),
     ("", "Assign Shortcut to 3D View", "3Dビューにショートカットを割り当て"),
     ("view.3d.last", "Switch to Last 3D View", "最後の3Dビューに切り替え"),
     ("view.lookAtSelected", "Look at Selected Layers", "選択したレイヤーを見る"),
@@ -2135,7 +2949,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("window.workspace", "Default", "初期設定"),
     ("window.workspace", "Review", "レビュー"),
     ("window.workspace", "Learn", "学習"),
-    ("window.workspace", "Small Screen", "小画面"),
+    ("window.workspace", "Small Screen", "小さい画面"),
     ("window.workspace", "Standard", "標準"),
     ("window.workspace", "All Panels", "すべてのパネル"),
     ("window.workspace", "Animation", "アニメーション"),
@@ -2148,7 +2962,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("window.workspace", "Text", "テキスト"),
     ("window.workspace", "Undocked Panels", "ドッキング解除したパネル"),
     ("window.resetWorkspace", "Reset to Saved Layout", "保存したレイアウトにリセット"),
-    ("window.saveWorkspace", "Save Changes to this Workspace", "このワークスペースの変更を保存"),
+    ("window.saveWorkspace", "Save Changes to this Workspace", "このワークスペースへの変更を保存"),
     ("window.saveWorkspaceAs", "Save as New Workspace...", "新規ワークスペースとして保存..."),
     ("window.editWorkspaces", "Edit Workspaces...", "ワークスペースを編集..."),
     ("", "Assign Shortcut to Workspace", "ワークスペースにショートカットを割り当て"),
@@ -2161,7 +2975,7 @@ const JAPANESE: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "エッセンシャルグラフィックス"),
     ("window.panel", "Info", "情報"),
     ("help.inAppTutorials", "Learn", "学習"),
-    ("window.panel", "Lumetri Scopes", "Lumetriスコープ"),
+    ("window.panel", "Video Scopes", "ビデオスコープ"),
     ("window.panel", "Mask Interpolation", "マスク補間"),
     ("window.panel", "Media Browser", "メディアブラウザー"),
     ("window.panel", "Metadata", "メタデータ"),
@@ -2255,6 +3069,8 @@ const UKRAINIAN: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Файл..."),
     ("file.importMultiple", "Multiple Files...", "Кілька файлів..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Проєкт Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Проєкт After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Проєкт After Effects..."),
     ("file.importProject", "EffectCraft Project...", "Проєкт EffectCraft..."),
     ("file.importPlaceholder", "Placeholder...", "Заповнювач..."),
     ("file.importSolid", "Solid...", "Суцільний колір..."),
@@ -2285,6 +3101,7 @@ const UKRAINIAN: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Встановити файл скрипту..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Встановити панель ScriptUI..."),
     ("file.runScript", "Run Script File...", "Виконати файл скрипту..."),
+    ("", "Recent Script Files", "Нещодавні файли скриптів"),
     ("", "Create Proxy", "Створити проксі"),
     ("file.createProxy", "Still...", "Зображення..."),
     ("file.createProxy", "Movie...", "Відео..."),
@@ -2404,6 +3221,7 @@ const UKRAINIAN: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Шар фігури"),
     ("layer.newAdjustment", "Adjustment Layer", "Коригувальний шар"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Шар заливки з урахуванням вмісту..."),
+    ("layer.newPrimitive", "3D Primitive...", "3D-примітив..."),
     ("layer.new3dPrimitive", "Cube", "Куб"),
     ("layer.new3dPrimitive", "Sphere", "Сфера"),
     ("layer.new3dPrimitive", "Plane", "Площина"),
@@ -2620,6 +3438,8 @@ const UKRAINIAN: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Вилучити все"),
     ("effect.manage", "Manage Effects...", "Керування ефектами..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Завантажити плагін ефекту..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Завантажити плагіни через помічника..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Шукати помічників ефектів"),
     ("", "Animation", "Анімація"),
     ("anim.savePreset", "Save Animation Preset...", "Зберегти набір анімації..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Застосувати набір анімації..."),
@@ -2637,6 +3457,8 @@ const UKRAINIAN: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Поява рядків згори"),
     ("anim.addKeyframe", "Add Keyframe", "Додати ключовий кадр"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Перемкнути утримання ключового кадру"),
+    ("keys.setMuted", "Mute Keyframes", "Заглушити ключові кадри"),
+    ("keys.setMuted", "Unmute Keyframes", "Зняти заглушення ключових кадрів"),
     ("keys.interpolation", "Keyframe Interpolation...", "Інтерполяція ключових кадрів..."),
     ("keys.velocity", "Keyframe Velocity...", "Швидкість ключових кадрів..."),
     ("", "Keyframe Assistant", "Помічник ключових кадрів"),
@@ -2795,7 +3617,7 @@ const UKRAINIAN: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Основна графіка"),
     ("window.panel", "Info", "Інформація"),
     ("help.inAppTutorials", "Learn", "Навчання"),
-    ("window.panel", "Lumetri Scopes", "Вимірювачі Lumetri"),
+    ("window.panel", "Video Scopes", "Відеоскопи"),
     ("window.panel", "Mask Interpolation", "Інтерполяція маски"),
     ("window.panel", "Media Browser", "Браузер медіа"),
     ("window.panel", "Metadata", "Метадані"),
@@ -2890,6 +3712,8 @@ const SPANISH: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Archivo..."),
     ("file.importMultiple", "Multiple Files...", "Varios archivos..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Proyecto de Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Proyecto de After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Proyecto de After Effects..."),
     ("file.importProject", "EffectCraft Project...", "Proyecto de EffectCraft..."),
     ("file.importPlaceholder", "Placeholder...", "Marcador de posición..."),
     ("file.importSolid", "Solid...", "Sólido..."),
@@ -2920,6 +3744,7 @@ const SPANISH: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Instalar archivo de script..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Instalar panel de ScriptUI..."),
     ("file.runScript", "Run Script File...", "Ejecutar archivo de script..."),
+    ("", "Recent Script Files", "Archivos de script recientes"),
     ("", "Create Proxy", "Crear proxy"),
     ("file.createProxy", "Still...", "Imagen fija..."),
     ("file.createProxy", "Movie...", "Película..."),
@@ -3039,6 +3864,7 @@ const SPANISH: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Capa de forma"),
     ("layer.newAdjustment", "Adjustment Layer", "Capa de ajuste"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Capa de relleno según el contenido..."),
+    ("layer.newPrimitive", "3D Primitive...", "Primitiva 3D..."),
     ("layer.new3dPrimitive", "Cube", "Cubo"),
     ("layer.new3dPrimitive", "Sphere", "Esfera"),
     ("layer.new3dPrimitive", "Plane", "Plano"),
@@ -3255,6 +4081,8 @@ const SPANISH: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Quitar todo"),
     ("effect.manage", "Manage Effects...", "Administrar efectos..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Cargar complemento de efecto..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Cargar complementos mediante asistente..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Buscar asistentes de efectos"),
     ("", "Animation", "Animación"),
     ("anim.savePreset", "Save Animation Preset...", "Guardar ajuste preestablecido de animación..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Aplicar ajuste preestablecido de animación..."),
@@ -3272,6 +4100,8 @@ const SPANISH: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Entrada de líneas cayendo"),
     ("anim.addKeyframe", "Add Keyframe", "Añadir fotograma clave"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Conmutar mantener fotograma clave"),
+    ("keys.setMuted", "Mute Keyframes", "Silenciar fotogramas clave"),
+    ("keys.setMuted", "Unmute Keyframes", "Reactivar fotogramas clave"),
     ("keys.interpolation", "Keyframe Interpolation...", "Interpolación de fotogramas clave..."),
     ("keys.velocity", "Keyframe Velocity...", "Velocidad de fotogramas clave..."),
     ("", "Keyframe Assistant", "Asistente de fotogramas clave"),
@@ -3430,7 +4260,7 @@ const SPANISH: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Gráficos esenciales"),
     ("window.panel", "Info", "Información"),
     ("help.inAppTutorials", "Learn", "Aprender"),
-    ("window.panel", "Lumetri Scopes", "Ámbitos de Lumetri"),
+    ("window.panel", "Video Scopes", "Monitores de vídeo"),
     ("window.panel", "Mask Interpolation", "Interpolación de máscara"),
     ("window.panel", "Media Browser", "Navegador de medios"),
     ("window.panel", "Metadata", "Metadatos"),
@@ -3523,6 +4353,8 @@ const PORTUGUESE: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Arquivo..."),
     ("file.importMultiple", "Multiple Files...", "Vários arquivos..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Projeto do Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Projeto do After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Projeto do After Effects..."),
     ("file.importProject", "EffectCraft Project...", "Projeto do EffectCraft..."),
     ("file.importPlaceholder", "Placeholder...", "Espaço reservado..."),
     ("file.importSolid", "Solid...", "Sólido..."),
@@ -3553,6 +4385,7 @@ const PORTUGUESE: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Instalar arquivo de script..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Instalar painel ScriptUI..."),
     ("file.runScript", "Run Script File...", "Executar arquivo de script..."),
+    ("", "Recent Script Files", "Arquivos de script recentes"),
     ("", "Create Proxy", "Criar proxy"),
     ("file.createProxy", "Still...", "Imagem fixa..."),
     ("file.createProxy", "Movie...", "Filme..."),
@@ -3672,6 +4505,7 @@ const PORTUGUESE: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Camada de forma"),
     ("layer.newAdjustment", "Adjustment Layer", "Camada de ajuste"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Camada de preenchimento sensível ao conteúdo..."),
+    ("layer.newPrimitive", "3D Primitive...", "Primitiva 3D..."),
     ("layer.new3dPrimitive", "Cube", "Cubo"),
     ("layer.new3dPrimitive", "Sphere", "Esfera"),
     ("layer.new3dPrimitive", "Plane", "Plano"),
@@ -3888,6 +4722,8 @@ const PORTUGUESE: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Remover todos"),
     ("effect.manage", "Manage Effects...", "Gerenciar efeitos..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Carregar plug-in de efeito..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Carregar plug-ins por meio do auxiliar..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Procurar auxiliares de efeitos"),
     ("", "Animation", "Animação"),
     ("anim.savePreset", "Save Animation Preset...", "Salvar predefinição de animação..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Aplicar predefinição de animação..."),
@@ -3905,6 +4741,8 @@ const PORTUGUESE: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Entrar com queda de linhas"),
     ("anim.addKeyframe", "Add Keyframe", "Adicionar quadro-chave"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Alternar quadro-chave de retenção"),
+    ("keys.setMuted", "Mute Keyframes", "Silenciar quadros-chave"),
+    ("keys.setMuted", "Unmute Keyframes", "Reativar quadros-chave"),
     ("keys.interpolation", "Keyframe Interpolation...", "Interpolação de quadro-chave..."),
     ("keys.velocity", "Keyframe Velocity...", "Velocidade do quadro-chave..."),
     ("", "Keyframe Assistant", "Assistente de quadro-chave"),
@@ -4063,7 +4901,7 @@ const PORTUGUESE: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Gráficos essenciais"),
     ("window.panel", "Info", "Informações"),
     ("help.inAppTutorials", "Learn", "Aprender"),
-    ("window.panel", "Lumetri Scopes", "Escopos Lumetri"),
+    ("window.panel", "Video Scopes", "Escopos de vídeo"),
     ("window.panel", "Mask Interpolation", "Interpolação de máscara"),
     ("window.panel", "Media Browser", "Navegador de mídia"),
     ("window.panel", "Metadata", "Metadados"),
@@ -4164,6 +5002,8 @@ const RUSSIAN: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Файл..."),
     ("file.importMultiple", "Multiple Files...", "Несколько файлов..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Проект Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Проект After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Проект After Effects..."),
     ("file.importProject", "EffectCraft Project...", "Проект EffectCraft..."),
     ("file.importPlaceholder", "Placeholder...", "Заполнитель..."),
     ("file.importSolid", "Solid...", "Сплошной цвет..."),
@@ -4194,6 +5034,7 @@ const RUSSIAN: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Установить файл скрипта..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Установить панель ScriptUI..."),
     ("file.runScript", "Run Script File...", "Выполнить файл скрипта..."),
+    ("", "Recent Script Files", "Недавние файлы скриптов"),
     ("", "Create Proxy", "Создать суррогат"),
     ("file.createProxy", "Still...", "Стоп-кадр..."),
     ("file.createProxy", "Movie...", "Видео..."),
@@ -4312,6 +5153,7 @@ const RUSSIAN: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Слой-фигура"),
     ("layer.newAdjustment", "Adjustment Layer", "Корректирующий слой"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Слой заливки с учетом содержимого..."),
+    ("layer.newPrimitive", "3D Primitive...", "3D-примитив..."),
     ("layer.new3dPrimitive", "Cube", "Куб"),
     ("layer.new3dPrimitive", "Sphere", "Сфера"),
     ("layer.new3dPrimitive", "Plane", "Плоскость"),
@@ -4528,6 +5370,8 @@ const RUSSIAN: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Удалить все"),
     ("effect.manage", "Manage Effects...", "Управление эффектами..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Загрузить плагин эффектов..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Загрузить плагины через помощника..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Найти помощников эффектов"),
     ("", "Animation", "Анимация"),
     ("anim.savePreset", "Save Animation Preset...", "Сохранить заготовку анимации..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Применить заготовку анимации..."),
@@ -4545,6 +5389,8 @@ const RUSSIAN: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Появление строк сверху"),
     ("anim.addKeyframe", "Add Keyframe", "Добавить ключевой кадр"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Переключить фиксацию ключевого кадра"),
+    ("keys.setMuted", "Mute Keyframes", "Отключить ключевые кадры"),
+    ("keys.setMuted", "Unmute Keyframes", "Включить ключевые кадры"),
     ("keys.interpolation", "Keyframe Interpolation...", "Интерполяция ключевых кадров..."),
     ("keys.velocity", "Keyframe Velocity...", "Скорость ключевых кадров..."),
     ("", "Keyframe Assistant", "Помощник по ключевым кадрам"),
@@ -4698,7 +5544,7 @@ const RUSSIAN: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Основная графика"),
     ("window.panel", "Info", "Информация"),
     ("help.inAppTutorials", "Learn", "Обучение"),
-    ("window.panel", "Lumetri Scopes", "Измерители Lumetri"),
+    ("window.panel", "Video Scopes", "Видеоскопы"),
     ("window.panel", "Mask Interpolation", "Интерполяция маски"),
     ("window.panel", "Media Browser", "Обозреватель медиа"),
     ("window.panel", "Metadata", "Метаданные"),
@@ -4797,6 +5643,8 @@ const FRENCH: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Fichier..."),
     ("file.importMultiple", "Multiple Files...", "Plusieurs fichiers..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Projet Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Projet After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Projet After Effects..."),
     ("file.importProject", "EffectCraft Project...", "Projet EffectCraft..."),
     ("file.importPlaceholder", "Placeholder...", "Espace réservé..."),
     ("file.importSolid", "Solid...", "Solide..."),
@@ -4827,6 +5675,7 @@ const FRENCH: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Installer un fichier de script..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Installer un panneau ScriptUI..."),
     ("file.runScript", "Run Script File...", "Exécuter un fichier de script..."),
+    ("", "Recent Script Files", "Fichiers de script récents"),
     ("", "Create Proxy", "Créer un proxy"),
     ("file.createProxy", "Still...", "Image fixe..."),
     ("file.createProxy", "Movie...", "Vidéo..."),
@@ -4945,6 +5794,7 @@ const FRENCH: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Calque de forme"),
     ("layer.newAdjustment", "Adjustment Layer", "Calque de réglage"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Calque de remplissage d’après le contenu..."),
+    ("layer.newPrimitive", "3D Primitive...", "Primitive 3D..."),
     ("layer.new3dPrimitive", "Cube", "Cube"),
     ("layer.new3dPrimitive", "Sphere", "Sphère"),
     ("layer.new3dPrimitive", "Plane", "Plan"),
@@ -5161,6 +6011,8 @@ const FRENCH: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Tout supprimer"),
     ("effect.manage", "Manage Effects...", "Gérer les effets..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Charger un plug-in d'effet..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Charger des plug-ins via un assistant..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Rechercher les assistants d'effets"),
     ("", "Animation", "Animation"),
     ("anim.savePreset", "Save Animation Preset...", "Enregistrer une animation prédéfinie..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Appliquer une animation prédéfinie..."),
@@ -5178,6 +6030,8 @@ const FRENCH: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Chute des lignes depuis le haut"),
     ("anim.addKeyframe", "Add Keyframe", "Ajouter une image clé"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Activer/Désactiver l'image clé figée"),
+    ("keys.setMuted", "Mute Keyframes", "Désactiver les images clés"),
+    ("keys.setMuted", "Unmute Keyframes", "Réactiver les images clés"),
     ("keys.interpolation", "Keyframe Interpolation...", "Interpolation des images clés..."),
     ("keys.velocity", "Keyframe Velocity...", "Vitesse des images clés..."),
     ("", "Keyframe Assistant", "Assistant d'images clés"),
@@ -5331,7 +6185,7 @@ const FRENCH: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Graphiques essentiels"),
     ("window.panel", "Info", "Informations"),
     ("help.inAppTutorials", "Learn", "Apprentissage"),
-    ("window.panel", "Lumetri Scopes", "Oscilloscopes Lumetri"),
+    ("window.panel", "Video Scopes", "Oscilloscopes vidéo"),
     ("window.panel", "Mask Interpolation", "Interpolation de masque"),
     ("window.panel", "Media Browser", "Navigateur multimédia"),
     ("window.panel", "Metadata", "Métadonnées"),
@@ -5430,6 +6284,8 @@ const GERMAN: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Datei..."),
     ("file.importMultiple", "Multiple Files...", "Mehrere Dateien..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro-Projekt..."),
+    ("file.importAep", "After Effects Project...", "After Effects-Projekt..."),
+    ("file.exportAep", "After Effects Project...", "After Effects-Projekt..."),
     ("file.importProject", "EffectCraft Project...", "EffectCraft-Projekt..."),
     ("file.importPlaceholder", "Placeholder...", "Platzhalter..."),
     ("file.importSolid", "Solid...", "Farbfläche..."),
@@ -5460,6 +6316,7 @@ const GERMAN: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Skriptdatei installieren..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "ScriptUI-Bedienfeld installieren..."),
     ("file.runScript", "Run Script File...", "Skriptdatei ausführen..."),
+    ("", "Recent Script Files", "Zuletzt verwendete Skriptdateien"),
     ("", "Create Proxy", "Proxy erstellen"),
     ("file.createProxy", "Still...", "Standbild..."),
     ("file.createProxy", "Movie...", "Film..."),
@@ -5578,6 +6435,7 @@ const GERMAN: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Formebene"),
     ("layer.newAdjustment", "Adjustment Layer", "Einstellungsebene"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Ebene für inhaltsbasierte Füllung..."),
+    ("layer.newPrimitive", "3D Primitive...", "3D-Grundkörper..."),
     ("layer.new3dPrimitive", "Cube", "Würfel"),
     ("layer.new3dPrimitive", "Sphere", "Kugel"),
     ("layer.new3dPrimitive", "Plane", "Fläche"),
@@ -5794,6 +6652,8 @@ const GERMAN: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Alle entfernen"),
     ("effect.manage", "Manage Effects...", "Effekte verwalten..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Effekt-Plug-in laden..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Plug-ins über Hilfsprogramm laden..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Nach Effekt-Hilfsprogrammen suchen"),
     ("", "Animation", "Animation"),
     ("anim.savePreset", "Save Animation Preset...", "Animationsvorgabe speichern..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Animationsvorgabe anwenden..."),
@@ -5811,6 +6671,8 @@ const GERMAN: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Zeilen fallen ein"),
     ("anim.addKeyframe", "Add Keyframe", "Keyframe hinzufügen"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Halte-Keyframe umschalten"),
+    ("keys.setMuted", "Mute Keyframes", "Keyframes stummschalten"),
+    ("keys.setMuted", "Unmute Keyframes", "Keyframes wieder aktivieren"),
     ("keys.interpolation", "Keyframe Interpolation...", "Keyframe-Interpolation..."),
     ("keys.velocity", "Keyframe Velocity...", "Keyframe-Geschwindigkeit..."),
     ("", "Keyframe Assistant", "Keyframe-Assistent"),
@@ -5964,7 +6826,7 @@ const GERMAN: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Essential-Grafik"),
     ("window.panel", "Info", "Info"),
     ("help.inAppTutorials", "Learn", "Lernen"),
-    ("window.panel", "Lumetri Scopes", "Lumetri-Scopes"),
+    ("window.panel", "Video Scopes", "Videoskope"),
     ("window.panel", "Mask Interpolation", "Maskeninterpolation"),
     ("window.panel", "Media Browser", "Medienbrowser"),
     ("window.panel", "Metadata", "Metadaten"),
@@ -6010,6 +6872,644 @@ const GERMAN: &[(&str, &str, &str)] = &[
 
 // <<< generated i18n catalogs
 
+/// Polish (pl): original phrase translations of every fixed menu entry.
+const POLISH: &[(&str, &str, &str)] = &[
+    ("", "Front", "Przód"),
+    ("", "Bevel", "Fazowanie"),
+    ("", "Side", "Bok"),
+    ("", "Back", "Tył"),
+    ("layer.addTextAnimator", "Color", "Kolor"),
+    ("", "EffectCraft", "EffectCraft"),
+    ("app.about", "About EffectCraft...", "O programie EffectCraft..."),
+    ("", "Settings...", "Ustawienia..."),
+    ("app.settings", "General...", "Ogólne..."),
+    ("app.settings", "Startup & Repair...", "Uruchamianie i naprawa..."),
+    ("app.settings", "Project...", "Projekt..."),
+    ("app.settings", "Composition...", "Kompozycja..."),
+    ("app.settings", "Previews...", "Podglądy..."),
+    ("app.settings", "Appearance...", "Wygląd..."),
+    ("app.settings", "Grids & Guides...", "Siatki i linie pomocnicze..."),
+    ("app.settings", "Labels...", "Etykiety..."),
+    ("app.settings", "Type...", "Tekst..."),
+    ("app.settings", "Import...", "Import..."),
+    ("app.settings", "Export...", "Eksport..."),
+    ("app.settings", "Audio...", "Audio..."),
+    ("app.settings", "Disk...", "Dysk..."),
+    ("app.settings", "Memory & CPU...", "Pamięć i procesor..."),
+    ("app.settings", "Video...", "Wideo..."),
+    ("app.settings", "3D...", "3D..."),
+    ("app.settings", "Scripting & Expressions...", "Skrypty i wyrażenia..."),
+    ("app.hide", "Hide EffectCraft", "Ukryj EffectCraft"),
+    ("app.hideOthers", "Hide Others", "Ukryj pozostałe"),
+    ("app.showAll", "Show All", "Pokaż wszystko"),
+    ("app.quit", "Quit EffectCraft", "Zakończ EffectCraft"),
+    ("", "File", "Plik"),
+    ("", "New", "Nowy"),
+    ("file.newProject", "New Project", "Nowy projekt"),
+    ("file.newFromTemplate", "New Project from Template...", "Nowy projekt z szablonu..."),
+    ("project.newFolder", "New Folder", "Nowy folder"),
+    ("file.open", "Open Project...", "Otwórz projekt..."),
+    ("", "Open Recent", "Otwórz ostatnie"),
+    ("file.clearRecent", "Clear Recent Projects", "Wyczyść ostatnie projekty"),
+    ("file.close", "Close", "Zamknij"),
+    ("file.closeProject", "Close Project", "Zamknij projekt"),
+    ("file.save", "Save", "Zapisz"),
+    ("", "Save As", "Zapisz jako"),
+    ("file.saveAs", "Save As...", "Zapisz jako..."),
+    ("file.saveCopy", "Save a Copy...", "Zapisz kopię..."),
+    ("file.saveCopyAsXml", "Save a Copy As XML...", "Zapisz kopię jako XML..."),
+    ("templates.saveAs", "Save as Template...", "Zapisz jako szablon..."),
+    ("file.incrementAndSave", "Increment and Save", "Zapisz z kolejnym numerem"),
+    ("file.revert", "Revert", "Przywróć"),
+    ("", "Import", "Importuj"),
+    ("file.import", "File...", "Plik..."),
+    ("file.importMultiple", "Multiple Files...", "Wiele plików..."),
+    ("file.importTimeline", "Adobe Premiere Pro Project...", "Projekt Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Projekt After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Projekt After Effects..."),
+    ("file.importProject", "EffectCraft Project...", "Projekt EffectCraft..."),
+    ("file.importPlaceholder", "Placeholder...", "Element zastępczy..."),
+    ("file.importSolid", "Solid...", "Plansza..."),
+    ("file.importLottie", "Lottie...", "Lottie..."),
+    ("file.importVanishingPoint", "Vanishing Point (.vpe)...", "Punkt zbiegu (.vpe)..."),
+    ("essential.importTemplate", "Essential Graphics Template...", "Szablon Essential Graphics..."),
+    ("", "Import Recent Footage", "Importuj ostatnie materiały"),
+    ("file.clearRecentFootage", "Clear Recent Footage", "Wyczyść ostatnie materiały"),
+    ("", "Export", "Eksportuj"),
+    ("renderQueue.add", "Add to Render Queue", "Dodaj do kolejki renderowania"),
+    ("file.exportTimeline", "Adobe Premiere Pro Project...", "Projekt Adobe Premiere Pro..."),
+    ("file.exportLottie", "Lottie JSON...", "Lottie JSON..."),
+    ("essential.exportTemplate", "Essential Graphics Template...", "Szablon Essential Graphics..."),
+    ("app.find", "Find", "Znajdź"),
+    ("layer.addItem", "Add Footage to Comp", "Dodaj materiał do kompozycji"),
+    ("file.newCompFromSelection", "New Comp from Selection...", "Nowa kompozycja z zaznaczenia..."),
+    ("", "Dependencies", "Zależności"),
+    ("file.collectFiles", "Collect Files...", "Zbierz pliki..."),
+    ("file.consolidateFootage", "Consolidate All Footage", "Scal wszystkie materiały"),
+    ("file.removeUnusedFootage", "Remove Unused Footage", "Usuń nieużywane materiały"),
+    ("file.reduceProject", "Reduce Project", "Zredukuj projekt"),
+    ("file.findMissing", "Find Missing Effects", "Znajdź brakujące efekty"),
+    ("file.findMissing", "Find Missing Fonts", "Znajdź brakujące czcionki"),
+    ("file.findMissing", "Find Missing Footage", "Znajdź brakujące materiały"),
+    ("file.relinkFootage", "Relink Missing Footage...", "Połącz ponownie brakujące materiały..."),
+    ("file.watchFolder", "Watch Folder...", "Folder obserwowany..."),
+    ("", "Scripts", "Skrypty"),
+    ("file.installScript", "Install Script File...", "Zainstaluj plik skryptu..."),
+    ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Zainstaluj panel ScriptUI..."),
+    ("file.runScript", "Run Script File...", "Uruchom plik skryptu..."),
+    ("", "Create Proxy", "Utwórz proxy"),
+    ("file.createProxy", "Still...", "Klatka..."),
+    ("file.createProxy", "Movie...", "Film..."),
+    ("", "Set Proxy", "Ustaw proxy"),
+    ("file.setProxy", "File...", "Plik..."),
+    ("file.setProxyNone", "None", "Brak"),
+    ("", "Interpret Footage", "Interpretuj materiał"),
+    ("file.interpretFootage", "Main...", "Główny..."),
+    ("file.interpretProxy", "Proxy...", "Proxy..."),
+    ("file.rememberInterpretation", "Remember Interpretation", "Zapamiętaj interpretację"),
+    ("file.applyInterpretation", "Apply Interpretation", "Zastosuj interpretację"),
+    ("", "Replace Footage", "Zastąp materiał"),
+    ("file.replaceFootage", "File...", "Plik..."),
+    ("file.replaceWithPlaceholder", "Placeholder...", "Element zastępczy..."),
+    ("file.replaceWithSolid", "Solid...", "Plansza..."),
+    ("file.replaceWithLayeredComp", "With Layered Comp", "Z warstwową kompozycją"),
+    ("file.reloadFootage", "Reload Footage", "Wczytaj ponownie materiał"),
+    ("file.revealInFinder", "Reveal in Finder", "Pokaż w Finderze"),
+    ("file.projectSettings", "Project Settings...", "Ustawienia projektu..."),
+    ("app.quit", "Exit", "Zakończ"),
+    ("", "Edit", "Edycja"),
+    ("edit.undo", "Undo", "Cofnij"),
+    ("edit.redo", "Redo", "Ponów"),
+    ("", "History", "Historia"),
+    ("app.commandPalette", "Quick Apply...", "Szybkie stosowanie..."),
+    ("edit.cut", "Cut", "Wytnij"),
+    ("edit.copy", "Copy", "Kopiuj"),
+    ("edit.copyWithPropertyLinks", "Copy with Property Links", "Kopiuj z łączami właściwości"),
+    ("edit.copyWithRelativePropertyLinks", "Copy with Relative Property Links", "Kopiuj ze względnymi łączami właściwości"),
+    ("edit.copyExpressionOnly", "Copy Expression Only", "Kopiuj tylko wyrażenie"),
+    ("edit.paste", "Paste", "Wklej"),
+    ("edit.pasteReversedKeyframes", "Paste Reversed Keyframes", "Wklej odwrócone klatki kluczowe"),
+    ("edit.pasteTextMatchFormatting", "Paste Text and Match Formatting", "Wklej tekst i dopasuj formatowanie"),
+    ("edit.pasteTextFormattingOnly", "Paste Text Formatting Only", "Wklej tylko formatowanie tekstu"),
+    ("edit.clear", "Clear", "Wyczyść"),
+    ("edit.duplicate", "Duplicate", "Powiel"),
+    ("edit.splitLayer", "Split Layer", "Podziel warstwę"),
+    ("edit.liftWorkArea", "Lift Work Area", "Wytnij obszar roboczy"),
+    ("edit.extractWorkArea", "Extract Work Area", "Wyodrębnij obszar roboczy"),
+    ("edit.selectAll", "Select All", "Zaznacz wszystko"),
+    ("edit.deselectAll", "Deselect All", "Usuń zaznaczenie"),
+    ("", "Label", "Etykieta"),
+    ("edit.selectLabelGroup", "Select Label Group", "Zaznacz grupę etykiet"),
+    ("edit.label", "None", "Brak"),
+    ("edit.label", "Red", "Czerwony"),
+    ("edit.label", "Yellow", "Żółty"),
+    ("edit.label", "Aqua", "Akwamaryna"),
+    ("edit.label", "Pink", "Różowy"),
+    ("edit.label", "Lavender", "Lawendowy"),
+    ("edit.label", "Peach", "Brzoskwiniowy"),
+    ("edit.label", "Sea Foam", "Morska piana"),
+    ("edit.label", "Blue", "Niebieski"),
+    ("edit.label", "Green", "Zielony"),
+    ("edit.label", "Purple", "Fioletowy"),
+    ("edit.label", "Orange", "Pomarańczowy"),
+    ("edit.label", "Brown", "Brązowy"),
+    ("edit.label", "Fuchsia", "Fuksja"),
+    ("edit.label", "Cyan", "Cyjan"),
+    ("edit.label", "Sandstone", "Piaskowiec"),
+    ("edit.label", "Dark Green", "Ciemnozielony"),
+    ("app.settings", "Edit Label Colors...", "Edytuj kolory etykiet..."),
+    ("", "Select Keyframe Label Group", "Zaznacz grupę etykiet klatek kluczowych"),
+    ("keys.selectLabelGroup", "On Selected Layers", "Na zaznaczonych warstwach"),
+    ("keys.selectLabelGroup", "On All Layers", "Na wszystkich warstwach"),
+    ("keys.selectLabelGroup", "Visible Keyframes on Selected Layers", "Widoczne klatki kluczowe na zaznaczonych warstwach"),
+    ("keys.selectLabelGroup", "Visible Keyframes on All Layers", "Widoczne klatki kluczowe na wszystkich warstwach"),
+    ("", "Purge", "Wyczyść pamięć"),
+    ("edit.purge", "All Cache...", "Całą pamięć podręczną..."),
+    ("edit.purge", "All Memory & Disk Cache...", "Całą pamięć i pamięć dyskową..."),
+    ("edit.purge", "All Memory", "Całą pamięć"),
+    ("edit.purge", "All Disk Cache...", "Całą pamięć dyskową..."),
+    ("edit.purge", "All 3D Cache...", "Całą pamięć 3D..."),
+    ("edit.purgeUndo", "Undo", "Cofanie"),
+    ("edit.purge", "Image Cache Memory", "Pamięć podręczna obrazów"),
+    ("edit.purge", "Snapshot", "Migawka"),
+    ("edit.editOriginal", "Edit Original...", "Edytuj oryginał..."),
+    ("", "Templates", "Szablony"),
+    ("app.templates", "Render Settings...", "Ustawienia renderowania..."),
+    ("app.templates", "Output Module...", "Moduł wyjściowy..."),
+    ("app.keyboardShortcuts", "Keyboard Shortcuts", "Skróty klawiaturowe"),
+    ("", "Preferences", "Preferencje"),
+    ("", "Composition", "Kompozycja"),
+    ("comp.new", "New Composition...", "Nowa kompozycja..."),
+    ("comp.settings", "Composition Settings...", "Ustawienia kompozycji..."),
+    ("comp.setPosterTime", "Set Poster Time", "Ustaw czas plakatu"),
+    ("comp.trimToWorkArea", "Trim Comp to Work Area", "Przytnij kompozycję do obszaru roboczego"),
+    ("comp.cropToRegionOfInterest", "Crop Comp to Region of Interest", "Kadruj kompozycję do obszaru zainteresowania"),
+    ("comp.cropToLayerBounds", "Crop Comp to Selected Layer(s) Bounds", "Kadruj kompozycję do granic zaznaczonych warstw (warstwy)"),
+    ("render.addOutputModule", "Add Output Module", "Dodaj moduł wyjściowy"),
+    ("", "Preview", "Podgląd"),
+    ("playback.toggle", "Play Current Preview", "Odtwórz bieżący podgląd"),
+    ("playback.cacheWhenIdle", "Cache Frames When Idle", "Buforuj klatki w bezczynności"),
+    ("playback.audio", "Audio", "Audio"),
+    ("", "Save Frame As", "Zapisz klatkę jako"),
+    ("comp.saveFrameAs", "File...", "Plik..."),
+    ("comp.saveFrameAsPsd", "Photoshop Layers...", "Warstwy Photoshopa..."),
+    ("comp.saveFrameAsExr", "ProEXR...", "ProEXR..."),
+    ("comp.copyFrame", "Copy Frame to Clipboard", "Kopiuj klatkę do schowka"),
+    ("render.preRender", "Pre-render...", "Wstępne renderowanie..."),
+    ("render.saveCurrentPreview", "Save Current Preview...", "Zapisz bieżący podgląd..."),
+    ("comp.openInEssentialGraphics", "Open in Essential Graphics", "Otwórz w Essential Graphics"),
+    ("", "Responsive Design — Time", "Projekt responsywny — czas"),
+    ("comp.responsiveTime", "Create Intro", "Utwórz intro"),
+    ("comp.responsiveTime", "Create Outro", "Utwórz outro"),
+    ("comp.responsiveTime", "Create Protected Region from Work Area", "Utwórz chroniony obszar z obszaru roboczego"),
+    ("comp.flowchart", "Composition Flowchart", "Schemat kompozycji"),
+    ("comp.miniFlowchart", "Composition Mini-Flowchart", "Miniaturowy schemat kompozycji"),
+    ("", "VR", "VR"),
+    ("comp.vr.createEnvironment", "Create VR Environment...", "Utwórz środowisko VR..."),
+    ("comp.vr.extractCubemap", "Extract Cubemap...", "Wyodrębnij cubemapę..."),
+    ("", "Layer", "Warstwa"),
+    ("layer.newText", "Text", "Tekst"),
+    ("layer.newSolid", "Solid...", "Plansza..."),
+    ("layer.newLight", "Light...", "Światło..."),
+    ("layer.newCamera", "Camera...", "Kamera..."),
+    ("layer.newNull", "Null Object", "Obiekt zerowy"),
+    ("layer.newShape", "Shape Layer", "Warstwa kształtu"),
+    ("layer.newAdjustment", "Adjustment Layer", "Warstwa korekcyjna"),
+    ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Warstwa wypełnienia z uwzględnieniem zawartości..."),
+    ("layer.new3dPrimitive", "Cube", "Sześcian"),
+    ("layer.new3dPrimitive", "Sphere", "Kula"),
+    ("layer.new3dPrimitive", "Plane", "Płaszczyzna"),
+    ("layer.new3dPrimitive", "Torus", "Torus"),
+    ("layer.new3dPrimitive", "Cone", "Stożek"),
+    ("layer.new3dPrimitive", "Cylinder", "Walec"),
+    ("layer.settings", "Layer Settings...", "Ustawienia warstwy..."),
+    ("layer.openLayer", "Open Layer", "Otwórz warstwę"),
+    ("layer.openSource", "Open Layer Source", "Otwórz źródło warstwy"),
+    ("layer.revealInFinder", "Reveal in Finder", "Pokaż w Finderze"),
+    ("", "Mask", "Maska"),
+    ("layer.addMask", "New Mask", "Nowa maska"),
+    ("layer.mask.shape", "Mask Shape...", "Kształt maski..."),
+    ("layer.mask.set", "Mask Feather...", "Wtapianie maski..."),
+    ("layer.mask.set", "Mask Opacity...", "Krycie maski..."),
+    ("layer.mask.set", "Mask Expansion...", "Rozszerzenie maski..."),
+    ("layer.mask.reset", "Reset Mask", "Resetuj maskę"),
+    ("layer.mask.remove", "Remove Mask", "Usuń maskę"),
+    ("layer.mask.removeAll", "Remove All Masks", "Usuń wszystkie maski"),
+    ("track.mask", "Track Mask", "Śledź maskę"),
+    ("", "Mode", "Tryb"),
+    ("layer.mask.mode", "None", "Brak"),
+    ("layer.mask.mode", "Add", "Dodaj"),
+    ("layer.mask.mode", "Subtract", "Odejmij"),
+    ("layer.mask.mode", "Intersect", "Część wspólna"),
+    ("layer.mask.mode", "Lighten", "Rozjaśnij"),
+    ("layer.mask.mode", "Darken", "Przyciemnij"),
+    ("layer.mask.mode", "Difference", "Różnica"),
+    ("layer.mask.invert", "Inverted", "Odwrócona"),
+    ("layer.mask.lock", "Locked", "Zablokowana"),
+    ("", "Motion Blur", "Rozmycie ruchu"),
+    ("layer.mask.motionBlur", "Same As Layer", "Jak warstwa"),
+    ("layer.mask.motionBlur", "On", "Wł."),
+    ("layer.mask.motionBlur", "Off", "Wył."),
+    ("", "Feather Falloff", "Zanikanie wtapiania"),
+    ("layer.mask.featherFalloff", "Smooth", "Gładkie"),
+    ("layer.mask.featherFalloff", "Linear", "Liniowe"),
+    ("layer.mask.unlockAll", "Unlock All Masks", "Odblokuj wszystkie maski"),
+    ("layer.mask.lockOthers", "Lock Other Masks", "Zablokuj pozostałe maski"),
+    ("layer.mask.hideLocked", "Hide Locked Masks", "Ukryj zablokowane maski"),
+    ("", "Mask and Shape Path", "Ścieżka maski i kształtu"),
+    ("path.rotoBezier", "RotoBezier", "RotoBezier"),
+    ("mask.setClosed", "Closed", "Zamknięta"),
+    ("path.convertToBezier", "Convert To Bezier Path", "Konwertuj na ścieżkę Béziera"),
+    ("path.setFirstVertex", "Set First Vertex", "Ustaw pierwszy wierzchołek"),
+    ("path.freeTransform", "Free Transform Points", "Swobodne przekształcanie punktów"),
+    ("", "Quality", "Jakość"),
+    ("layer.quality", "Best", "Najlepsza"),
+    ("layer.quality", "Draft", "Robocza"),
+    ("layer.quality", "Wireframe", "Szkielet"),
+    ("layer.sampling", "Bilinear", "Dwuliniowa"),
+    ("layer.sampling", "Bicubic", "Dwusześcienna"),
+    ("", "Switches", "Przełączniki"),
+    ("layer.hideOtherVideo", "Hide Other Video", "Ukryj pozostałe wideo"),
+    ("layer.showAllVideo", "Show All Video", "Pokaż całe wideo"),
+    ("layer.unlockAll", "Unlock All Layers", "Odblokuj wszystkie warstwy"),
+    ("layer.expressions", "Enable Expressions", "Włącz wyrażenia"),
+    ("layer.expressions", "Disable Expressions", "Wyłącz wyrażenia"),
+    ("layer.setSwitch", "Shy", "Nieśmiała"),
+    ("layer.setSwitch", "Lock", "Zablokuj"),
+    ("layer.setSwitch", "Audio", "Audio"),
+    ("layer.setSwitch", "Video", "Wideo"),
+    ("layer.setSwitch", "Solo", "Solo"),
+    ("layer.setSwitch", "Effect", "Efekt"),
+    ("layer.setSwitch", "Collapse", "Zwiń"),
+    ("layer.setSwitch", "Motion Blur", "Rozmycie ruchu"),
+    ("layer.setSwitch", "Adjustment Layer", "Warstwa korekcyjna"),
+    ("", "Transform", "Przekształć"),
+    ("layer.transform", "Reset", "Resetuj"),
+    ("layer.setTransform", "Anchor Point...", "Punkt zakotwiczenia..."),
+    ("layer.setTransform", "Position...", "Położenie..."),
+    ("layer.setTransform", "Scale...", "Skala..."),
+    ("layer.setTransform", "Orientation...", "Orientacja..."),
+    ("layer.setTransform", "Rotation...", "Obrót..."),
+    ("layer.setTransform", "Opacity...", "Krycie..."),
+    ("layer.transform", "Flip Horizontal", "Odbij w poziomie"),
+    ("layer.transform", "Flip Vertical", "Odbij w pionie"),
+    ("layer.transform", "Center In View", "Wyśrodkuj w widoku"),
+    ("layer.centerAnchor", "Center Anchor Point in Layer Content", "Wyśrodkuj punkt zakotwiczenia w zawartości warstwy"),
+    ("layer.transform", "Fit to Comp", "Dopasuj do kompozycji"),
+    ("layer.transform", "Fit to Comp Width", "Dopasuj do szerokości kompozycji"),
+    ("layer.transform", "Fit to Comp Height", "Dopasuj do wysokości kompozycji"),
+    ("layer.autoOrient", "Auto-Orient...", "Automatyczna orientacja..."),
+    ("", "Time", "Czas"),
+    ("layer.enableTimeRemap", "Enable Time Remapping", "Włącz przemapowanie czasu"),
+    ("layer.timeReverse", "Time-Reverse Layer", "Odwróć czas warstwy"),
+    ("layer.timeStretch", "Time Stretch...", "Rozciągnięcie czasu..."),
+    ("layer.freezeFrame", "Freeze Frame", "Zamrożenie klatki"),
+    ("layer.freezeOnLastFrame", "Freeze On Last Frame", "Zamroź na ostatniej klatce"),
+    ("layer.alignVideoToData", "Align Video to Data", "Wyrównaj wideo do danych"),
+    ("", "Frame Blending", "Mieszanie klatek"),
+    ("layer.frameBlending", "Off", "Wył."),
+    ("layer.frameBlending", "Frame Mix", "Miks klatek"),
+    ("layer.frameBlending", "Pixel Motion", "Ruch pikseli"),
+    ("layer.setSwitch", "3D Layer", "Warstwa 3D"),
+    ("layer.setSwitch", "Guide Layer", "Warstwa pomocnicza"),
+    ("layer.environment", "Environment Layer", "Warstwa środowiska"),
+    ("", "Markers", "Znaczniki"),
+    ("layer.addMarker", "Add Marker", "Dodaj znacznik"),
+    ("layer.updateMarkersFromSource", "Update Markers From Source", "Aktualizuj znaczniki ze źródła"),
+    ("layer.markersLock", "Lock Markers", "Zablokuj znaczniki"),
+    ("layer.deleteAllMarkers", "Delete All Markers", "Usuń wszystkie znaczniki"),
+    ("layer.setSwitch", "Preserve Transparency", "Zachowaj przezroczystość"),
+    ("", "Blending Mode", "Tryb mieszania"),
+    ("layer.setBlendMode", "Normal", "Normalny"),
+    ("layer.setBlendMode", "Dissolve", "Rozpuszczenie"),
+    ("layer.setBlendMode", "Dancing Dissolve", "Tańczące rozpuszczenie"),
+    ("layer.setBlendMode", "Darken", "Ciemniej"),
+    ("layer.setBlendMode", "Multiply", "Mnożenie"),
+    ("layer.setBlendMode", "Color Burn", "Ściemnianie koloru"),
+    ("layer.setBlendMode", "Classic Color Burn", "Klasyczne ściemnianie koloru"),
+    ("layer.setBlendMode", "Linear Burn", "Ściemnianie liniowe"),
+    ("layer.setBlendMode", "Darker Color", "Ciemniejszy kolor"),
+    ("layer.setBlendMode", "Add", "Dodaj"),
+    ("layer.setBlendMode", "Lighten", "Jaśniej"),
+    ("layer.setBlendMode", "Screen", "Mnożenie odwrotne"),
+    ("layer.setBlendMode", "Color Dodge", "Rozjaśnianie koloru"),
+    ("layer.setBlendMode", "Classic Color Dodge", "Klasyczne rozjaśnianie koloru"),
+    ("layer.setBlendMode", "Linear Dodge", "Rozjaśnianie liniowe"),
+    ("layer.setBlendMode", "Lighter Color", "Jaśniejszy kolor"),
+    ("layer.setBlendMode", "Overlay", "Nakładka"),
+    ("layer.setBlendMode", "Soft Light", "Łagodne światło"),
+    ("layer.setBlendMode", "Hard Light", "Ostre światło"),
+    ("layer.setBlendMode", "Linear Light", "Światło liniowe"),
+    ("layer.setBlendMode", "Vivid Light", "Jaskrawe światło"),
+    ("layer.setBlendMode", "Pin Light", "Światło punktowe"),
+    ("layer.setBlendMode", "Hard Mix", "Twarde mieszanie"),
+    ("layer.setBlendMode", "Difference", "Różnica"),
+    ("layer.setBlendMode", "Classic Difference", "Klasyczna różnica"),
+    ("layer.setBlendMode", "Exclusion", "Wykluczenie"),
+    ("layer.setBlendMode", "Subtract", "Odejmowanie"),
+    ("layer.setBlendMode", "Divide", "Dzielenie"),
+    ("layer.setBlendMode", "Hue", "Barwa"),
+    ("layer.setBlendMode", "Saturation", "Nasycenie"),
+    ("layer.setBlendMode", "Color", "Kolor"),
+    ("layer.setBlendMode", "Luminosity", "Jasność"),
+    ("layer.setBlendMode", "Stencil Alpha", "Szablon alfa"),
+    ("layer.setBlendMode", "Stencil Luma", "Szablon luma"),
+    ("layer.setBlendMode", "Silhouette Alpha", "Sylweta alfa"),
+    ("layer.setBlendMode", "Silhouette Luma", "Sylweta luma"),
+    ("layer.setBlendMode", "Alpha Add", "Dodawanie alfa"),
+    ("layer.setBlendMode", "Luminescent Premul", "Luminescencja premul"),
+    ("layer.setBlendMode", "Next Blending Mode", "Następny tryb mieszania"),
+    ("layer.setBlendMode", "Previous Blending Mode", "Poprzedni tryb mieszania"),
+    ("", "Track Matte", "Matowa ścieżka"),
+    ("layer.trackMatte", "No Track Matte", "Bez matowej ścieżki"),
+    ("layer.trackMatte", "Alpha Matte", "Matowa alfa"),
+    ("layer.trackMatte", "Alpha Inverted Matte", "Odwrócona matowa alfa"),
+    ("layer.trackMatte", "Luma Matte", "Matowa luma"),
+    ("layer.trackMatte", "Luma Inverted Matte", "Odwrócona matowa luma"),
+    ("layer.trackMatte", "Matte with Layer Above", "Matowa z warstwą powyżej"),
+    ("layer.trackMatte", "Matte with Layer Below", "Matowa z warstwą poniżej"),
+    ("", "Layer Styles", "Style warstwy"),
+    ("layer.style.options", "Layer Style Options...", "Opcje stylu warstwy..."),
+    ("layer.style.convertToEditable", "Convert to Editable Styles", "Konwertuj na edytowalne style"),
+    ("layer.style.showAll", "Show All", "Pokaż wszystkie"),
+    ("layer.style.removeAll", "Remove All", "Usuń wszystkie"),
+    ("layer.style.dropShadow", "Drop Shadow", "Cień"),
+    ("layer.style.innerShadow", "Inner Shadow", "Cień wewnętrzny"),
+    ("layer.style.outerGlow", "Outer Glow", "Blask zewnętrzny"),
+    ("layer.style.innerGlow", "Inner Glow", "Blask wewnętrzny"),
+    ("layer.style.bevelEmboss", "Bevel and Emboss", "Faza i płaskorzeźba"),
+    ("layer.style.satin", "Satin", "Satyna"),
+    ("layer.style.colorOverlay", "Color Overlay", "Nakładka koloru"),
+    ("layer.style.gradientOverlay", "Gradient Overlay", "Nakładka gradientu"),
+    ("layer.style.stroke", "Stroke", "Obrys"),
+    ("path.groupShapes", "Group Shapes", "Grupuj kształty"),
+    ("path.ungroupShapes", "Ungroup Shapes", "Rozgrupuj kształty"),
+    ("", "Arrange", "Kolejność"),
+    ("layer.arrange", "Bring Layer to Front", "Przesuń warstwę na wierzch"),
+    ("layer.arrange", "Bring Layer Forward", "Przesuń warstwę do przodu"),
+    ("layer.arrange", "Send Layer Backward", "Przesuń warstwę do tyłu"),
+    ("layer.arrange", "Send Layer to Back", "Przesuń warstwę na spód"),
+    ("", "Reveal", "Pokaż"),
+    ("layer.revealSource", "Reveal Layer Source in Project", "Pokaż źródło warstwy w projekcie"),
+    ("comp.flowchart", "Reveal Layer in Project Flowchart", "Pokaż warstwę w schemacie projektu"),
+    ("comp.revealInProject", "Reveal Composition in Project", "Pokaż kompozycję w projekcie"),
+    ("layer.revealExpressionErrors", "Reveal Expression Errors", "Pokaż błędy wyrażeń"),
+    ("", "Create", "Utwórz"),
+    ("layer.create", "Convert to Editable Text", "Konwertuj na edytowalny tekst"),
+    ("layer.create", "Create Shapes from Text", "Utwórz kształty z tekstu"),
+    ("layer.create", "Create Masks from Text", "Utwórz maski z tekstu"),
+    ("layer.create", "Create Shapes from Vector Layer", "Utwórz kształty z warstwy wektorowej"),
+    ("layer.create", "Create Keyframes from Data", "Utwórz klatki kluczowe z danych"),
+    ("layer.create", "Null Controllers for Positional Points", "Kontrolery zerowe dla punktów położenia"),
+    ("layer.create", "Null Controllers for Path Points", "Kontrolery zerowe dla punktów ścieżki"),
+    ("layer.create", "Nulls Following Path Points", "Obiekty zerowe podążające za punktami ścieżki"),
+    ("layer.create", "Null Tracing Along Path", "Obiekt zerowy wzdłuż ścieżki"),
+    ("layer.create", "Create 3D Layer Instance", "Utwórz instancję warstwy 3D"),
+    ("", "Camera", "Kamera"),
+    ("camera.fromView", "Create Camera from 3D View", "Utwórz kamerę z widoku 3D"),
+    ("camera.stereoRig", "Create Stereo 3D Rig", "Utwórz zestaw stereo 3D"),
+    ("camera.orbitNull", "Create Orbit Null", "Utwórz obiekt zerowy orbity"),
+    ("camera.fromModel", "Create Cameras from 3D Model", "Utwórz kamery z modelu 3D"),
+    ("camera.linkFocusToPoi", "Link Focus Distance to Point of Interest", "Powiąż odległość ostrości z punktem zainteresowania"),
+    ("camera.linkFocusToLayer", "Link Focus Distance to Layer", "Powiąż odległość ostrości z warstwą"),
+    ("camera.setFocusToLayer", "Set Focus Distance to Layer", "Ustaw odległość ostrości na warstwę"),
+    ("layer.cameraSettings", "Camera Settings...", "Ustawienia kamery..."),
+    ("view.reset3DView", "Reset 3D View", "Resetuj widok 3D"),
+    ("", "Light", "Światło"),
+    ("light.fromModel", "Create Lights from 3D Model", "Utwórz światła z modelu 3D"),
+    ("light.controlWithCamera", "Control Light with Camera", "Steruj światłem za pomocą kamery"),
+    ("light.environmentBackground", "Create Environment Light Background Layer", "Utwórz warstwę tła światła otoczenia"),
+    ("", "Material", "Materiał"),
+    ("material.revealSource", "Reveal Material Source in Project", "Pokaż źródło materiału w projekcie"),
+    ("material.reset", "Reset Material", "Resetuj materiał"),
+    ("material.duplicateAssign", "Duplicate and Assign Material", "Powiel i przypisz materiał"),
+    ("layer.autoTrace", "Auto-trace...", "Automatyczne obrysowanie..."),
+    ("layer.precompose", "Pre-compose...", "Utwórz kompozycję wstępną..."),
+    ("layer.sceneEditDetection", "Scene Edit Detection...", "Wykrywanie zmian scen..."),
+    ("", "Effect", "Efekt"),
+    ("window.panel", "Effect Controls", "Ustawienia efektów"),
+    ("effect.applyLast", "Last Effect", "Ostatni efekt"),
+    ("effect.removeAll", "Remove All", "Usuń wszystkie"),
+    ("effect.manage", "Manage Effects...", "Zarządzaj efektami..."),
+    ("effect.plugins.load", "Load Effect Plug-in...", "Wczytaj wtyczkę efektu..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Wczytaj wtyczki przez program pomocniczy..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Wyszukaj programy pomocnicze efektów"),
+    ("", "Animation", "Animacja"),
+    ("anim.savePreset", "Save Animation Preset...", "Zapisz ustawienie animacji..."),
+    ("anim.applyPreset", "Apply Animation Preset...", "Zastosuj ustawienie animacji..."),
+    ("", "Recent Animation Presets", "Ostatnie ustawienia animacji"),
+    ("anim.clearRecentPresets", "Clear Recent Presets", "Wyczyść ostatnie ustawienia"),
+    ("anim.browsePresets", "Browse Presets...", "Przeglądaj ustawienia..."),
+    ("", "Text Animation Presets", "Ustawienia animacji tekstu"),
+    ("layer.applyTextPreset", "Typewriter", "Maszyna do pisania"),
+    ("layer.applyTextPreset", "Fade Up Characters", "Pojawianie się znaków"),
+    ("layer.applyTextPreset", "Bounce In Words", "Odbijające się słowa"),
+    ("layer.applyTextPreset", "Tracking In", "Zbliżanie liter"),
+    ("layer.applyTextPreset", "Scramble", "Mieszanie znaków"),
+    ("layer.applyTextPreset", "Blur In", "Wyostrzanie z rozmycia"),
+    ("layer.applyTextPreset", "Jitter", "Drganie"),
+    ("layer.applyTextPreset", "Drop In Lines", "Wpadające wiersze"),
+    ("anim.addKeyframe", "Add Keyframe", "Dodaj klatkę kluczową"),
+    ("keys.toggleHold", "Toggle Hold Keyframe", "Przełącz klatkę zatrzymania"),
+    ("keys.interpolation", "Keyframe Interpolation...", "Interpolacja klatek kluczowych..."),
+    ("keys.velocity", "Keyframe Velocity...", "Prędkość klatek kluczowych..."),
+    ("", "Keyframe Assistant", "Asystent klatek kluczowych"),
+    ("keys.audioToKeyframes", "Convert Audio to Keyframes", "Konwertuj audio na klatki kluczowe"),
+    ("prop.convertExpressionToKeyframes", "Convert Expression to Keyframes", "Konwertuj wyrażenie na klatki kluczowe"),
+    ("keys.easyEase", "Easy Ease", "Łagodne przejście"),
+    ("keys.easyEaseIn", "Easy Ease In", "Łagodne wejście"),
+    ("keys.easyEaseOut", "Easy Ease Out", "Łagodne wyjście"),
+    ("keys.exponentialScale", "Exponential Scale", "Skalowanie wykładnicze"),
+    ("keys.rpfCameraImport", "RPF Camera Import", "Import kamery RPF"),
+    ("layer.sequence", "Sequence Layers...", "Ułóż warstwy w sekwencję..."),
+    ("keys.timeReverse", "Time-Reverse Keyframes", "Odwróć czas klatek kluczowych"),
+    ("", "Animate Text", "Animuj tekst"),
+    ("layer.enablePerChar3D", "Enable Per-character 3D", "Włącz 3D dla każdego znaku"),
+    ("layer.addTextAnimator", "Anchor Point", "Punkt zakotwiczenia"),
+    ("layer.addTextAnimator", "Position", "Położenie"),
+    ("layer.addTextAnimator", "Scale", "Skala"),
+    ("layer.addTextAnimator", "Skew", "Pochylenie"),
+    ("layer.addTextAnimator", "Rotation", "Obrót"),
+    ("layer.addTextAnimator", "Opacity", "Krycie"),
+    ("layer.addTextAnimator", "All Transform Properties", "Wszystkie właściwości przekształcenia"),
+    ("", "Fill Color", "Kolor wypełnienia"),
+    ("layer.addTextAnimator", "RGB", "RGB"),
+    ("layer.addTextAnimator", "Hue", "Barwa"),
+    ("layer.addTextAnimator", "Saturation", "Nasycenie"),
+    ("layer.addTextAnimator", "Brightness", "Jasność"),
+    ("", "Stroke Color", "Kolor obrysu"),
+    ("layer.addTextAnimator", "Stroke Width", "Szerokość obrysu"),
+    ("layer.addTextAnimator", "Tracking", "Światło"),
+    ("layer.addTextAnimator", "Line Anchor", "Zakotwiczenie wiersza"),
+    ("layer.addTextAnimator", "Line Spacing", "Odstęp między wierszami"),
+    ("layer.addTextAnimator", "Character Offset", "Przesunięcie znaku"),
+    ("layer.addTextAnimator", "Character Value", "Wartość znaku"),
+    ("layer.addTextAnimator", "Blur", "Rozmycie"),
+    ("text.animatorFontAxes", "Variable Font Axes", "Osie czcionki zmiennej"),
+    ("", "Add Text Selector", "Dodaj selektor tekstu"),
+    ("text.addSelector", "Range", "Zakres"),
+    ("text.addSelector", "Wiggly", "Falowanie"),
+    ("text.addSelector", "Expression", "Wyrażenie"),
+    ("text.removeAllAnimators", "Remove All Text Animators", "Usuń wszystkie animatory tekstu"),
+    ("prop.setExpression", "Add Expression", "Dodaj wyrażenie"),
+    ("essential.addProperty", "Add Property to Essential Graphics", "Dodaj właściwość do Essential Graphics"),
+    ("prop.separateDimensions", "Separate Dimensions", "Rozdziel wymiary"),
+    ("track.camera", "Track Camera", "Śledź kamerę"),
+    ("track.warpStabilizer", "Warp Stabilizer VFX", "Warp Stabilizer VFX"),
+    ("track.motion", "Track Motion", "Śledź ruch"),
+    ("track.stabilize", "Stabilize Motion", "Stabilizuj ruch"),
+    ("track.property", "Track this Property", "Śledź tę właściwość"),
+    ("anim.reveal", "Reveal Properties with Keyframes", "Pokaż właściwości z klatkami kluczowymi"),
+    ("anim.reveal", "Reveal Properties with Animation", "Pokaż właściwości z animacją"),
+    ("anim.reveal", "Reveal All Modified Properties", "Pokaż wszystkie zmienione właściwości"),
+    ("", "View", "Widok"),
+    ("view.newViewer", "New Viewer", "Nowa przeglądarka"),
+    ("view.splitLockedViewer", "Split with New Locked Viewer", "Podziel z nową zablokowaną przeglądarką"),
+    ("view.zoomIn", "Zoom In", "Powiększ"),
+    ("view.zoomOut", "Zoom Out", "Pomniejsz"),
+    ("", "Resolution", "Rozdzielczość"),
+    ("view.res.full", "Full", "Pełna"),
+    ("view.res.half", "Half", "Połowa"),
+    ("view.res.third", "Third", "Jedna trzecia"),
+    ("view.res.quarter", "Quarter", "Jedna czwarta"),
+    ("view.res.custom", "Custom...", "Niestandardowa..."),
+    ("view.displayColorManagement", "Use Display Color Management", "Używaj zarządzania kolorem wyświetlacza"),
+    ("", "Simulate Output", "Symuluj wyjście"),
+    ("view.simulateOutput", "No Output Simulation", "Bez symulacji wyjścia"),
+    ("view.simulateOutput", "HDTV (Rec. 709)", "HDTV (Rec. 709)"),
+    ("view.simulateOutput", "SDTV NTSC", "SDTV NTSC"),
+    ("view.simulateOutput", "SDTV PAL", "SDTV PAL"),
+    ("view.simulateOutput", "Legacy Macintosh RGB (Gamma 1.8)", "Starsze RGB komputerów Macintosh (gamma 1,8)"),
+    ("view.simulateOutput", "Internet Standard RGB (sRGB)", "Standardowe internetowe RGB (sRGB)"),
+    ("view.simulateOutput", "UHDTV (Rec. 2020)", "UHDTV (Rec. 2020)"),
+    ("view.simulateOutput", "Display P3", "Display P3"),
+    ("view.simulateOutput", "Linear (1.0 Gamma)", "Liniowe (gamma 1,0)"),
+    ("view.customRgb", "My Custom RGB...", "Moje niestandardowe RGB..."),
+    ("view.simulateOutput", "Custom...", "Niestandardowe..."),
+    ("view.rulers", "Show Rulers", "Pokaż linijki"),
+    ("", "Panel Background Color", "Kolor tła panelu"),
+    ("view.panelBackground", "Black", "Czarny"),
+    ("view.panelBackground", "Dark Gray", "Ciemnoszary"),
+    ("view.panelBackground", "Medium Gray (Default)", "Średnioszary (domyślny)"),
+    ("view.panelBackground", "Light Gray", "Jasnoszary"),
+    ("view.panelBackground", "White", "Biały"),
+    ("view.panelBackground", "Custom", "Niestandardowy"),
+    ("view.panelBackground", "Select Custom Background Color...", "Wybierz niestandardowy kolor tła..."),
+    ("view.guides", "Show Guides", "Pokaż linie pomocnicze"),
+    ("view.snapToGuides", "Snap to Guides", "Przyciągaj do linii pomocniczych"),
+    ("view.lockGuides", "Lock Guides", "Zablokuj linie pomocnicze"),
+    ("view.addGuide", "Add Guide...", "Dodaj linię pomocniczą..."),
+    ("view.addPercentGuide", "Add Percentage Guide...", "Dodaj procentową linię pomocniczą..."),
+    ("view.convertGuides", "Convert Guides to Percentage", "Konwertuj linie pomocnicze na procenty"),
+    ("view.convertGuides", "Convert Guides to Pixels", "Konwertuj linie pomocnicze na piksele"),
+    ("view.clearGuides", "Clear Guides", "Wyczyść linie pomocnicze"),
+    ("view.importGuides", "Import Guides...", "Importuj linie pomocnicze..."),
+    ("view.exportGuides", "Export Guides...", "Eksportuj linie pomocnicze..."),
+    ("view.grid", "Show Grid", "Pokaż siatkę"),
+    ("view.snapToGrid", "Snap to Grid", "Przyciągaj do siatki"),
+    ("view.snapping", "Snapping", "Przyciąganie"),
+    ("view.options", "View Options...", "Opcje widoku..."),
+    ("view.layerControls", "Show Layer Controls", "Pokaż elementy sterujące warstwy"),
+    ("", "Switch View Layout", "Przełącz układ widoków"),
+    ("view.layout", "1 View", "1 widok"),
+    ("view.layout", "2 Views", "2 widoki"),
+    ("view.layout", "4 Views", "4 widoki"),
+    ("view.shareViewOptions", "Share View Options", "Wspólne opcje widoku"),
+    ("", "Switch 3D View", "Przełącz widok 3D"),
+    ("view.3d.activeCamera", "Active Camera", "Aktywna kamera"),
+    ("view.3d.default", "Default", "Domyślny"),
+    ("view.3d.front", "Front", "Przód"),
+    ("view.3d.left", "Left", "Lewo"),
+    ("view.3d.top", "Top", "Góra"),
+    ("view.3d.back", "Back", "Tył"),
+    ("view.3d.right", "Right", "Prawo"),
+    ("view.3d.bottom", "Bottom", "Dół"),
+    ("view.3d.custom1", "Custom View 1", "Widok niestandardowy 1"),
+    ("view.3d.custom2", "Custom View 2", "Widok niestandardowy 2"),
+    ("view.3d.custom3", "Custom View 3", "Widok niestandardowy 3"),
+    ("", "Assign Shortcut to 3D View", "Przypisz skrót do widoku 3D"),
+    ("view.3d.last", "Switch to Last 3D View", "Przełącz na ostatni widok 3D"),
+    ("view.lookAtSelected", "Look at Selected Layers", "Patrz na zaznaczone warstwy"),
+    ("view.lookAtAll", "Look at All Layers", "Patrz na wszystkie warstwy"),
+    ("time.set", "Go to Time...", "Przejdź do czasu..."),
+    ("view.fullScreen", "Enter Full Screen", "Pełny ekran"),
+    ("", "Window", "Okno"),
+    ("", "Workspace", "Obszar roboczy"),
+    ("window.workspace", "Default", "Domyślny"),
+    ("window.workspace", "Review", "Przegląd"),
+    ("window.workspace", "Learn", "Nauka"),
+    ("window.workspace", "Small Screen", "Mały ekran"),
+    ("window.workspace", "Standard", "Standardowy"),
+    ("window.workspace", "All Panels", "Wszystkie panele"),
+    ("window.workspace", "Animation", "Animacja"),
+    ("window.workspace", "Color", "Kolor"),
+    ("window.workspace", "Effects", "Efekty"),
+    ("window.workspace", "Essential Graphics", "Essential Graphics"),
+    ("window.workspace", "Minimal", "Minimalny"),
+    ("window.workspace", "Motion Tracking", "Śledzenie ruchu"),
+    ("window.workspace", "Paint", "Malowanie"),
+    ("window.workspace", "Text", "Tekst"),
+    ("window.workspace", "Undocked Panels", "Panele odpięte"),
+    ("window.resetWorkspace", "Reset to Saved Layout", "Przywróć zapisany układ"),
+    ("window.saveWorkspace", "Save Changes to this Workspace", "Zapisz zmiany w tym obszarze roboczym"),
+    ("window.saveWorkspaceAs", "Save as New Workspace...", "Zapisz jako nowy obszar roboczy..."),
+    ("window.editWorkspaces", "Edit Workspaces...", "Edytuj obszary robocze..."),
+    ("", "Assign Shortcut to Workspace", "Przypisz skrót do obszaru roboczego"),
+    ("window.panel", "Align", "Wyrównanie"),
+    ("window.panel", "Audio", "Audio"),
+    ("window.panel", "Brushes", "Pędzle"),
+    ("window.panel", "Character", "Znak"),
+    ("window.panel", "Content-Aware Fill", "Wypełnienie z uwzględnieniem zawartości"),
+    ("window.panel", "Effects & Presets", "Efekty i ustawienia"),
+    ("window.panel", "Essential Graphics", "Essential Graphics"),
+    ("window.panel", "Info", "Informacje"),
+    ("help.inAppTutorials", "Learn", "Nauka"),
+    ("window.panel", "Video Scopes", "Wskaźniki wideo"),
+    ("window.panel", "Mask Interpolation", "Interpolacja maski"),
+    ("window.panel", "Media Browser", "Przeglądarka multimediów"),
+    ("window.panel", "Metadata", "Metadane"),
+    ("window.panel", "Motion Sketch", "Szkic ruchu"),
+    ("window.panel", "Paint", "Malowanie"),
+    ("window.panel", "Paragraph", "Akapit"),
+    ("window.panel", "Preview", "Podgląd"),
+    ("window.panel", "Progress", "Postęp"),
+    ("window.panel", "Properties", "Właściwości"),
+    ("window.panel", "Script Console", "Konsola skryptów"),
+    ("window.panel", "Smoother", "Wygładzanie"),
+    ("window.panel", "Tools", "Narzędzia"),
+    ("window.panel", "Tracker", "Śledzenie"),
+    ("window.panel", "Wiggler", "Wahanie"),
+    ("window.panel", "Composition", "Kompozycja"),
+    ("window.panel", "Flowchart", "Schemat"),
+    ("window.panel", "Footage", "Materiał"),
+    ("window.panel", "Layer", "Warstwa"),
+    ("window.panel", "Project", "Projekt"),
+    ("window.panel", "Render Queue", "Kolejka renderowania"),
+    ("window.panel", "Timeline", "Oś czasu"),
+    ("window.panel", "Create Nulls From Paths", "Utwórz obiekty zerowe ze ścieżek"),
+    ("window.panel", "VR Comp Editor", "Edytor kompozycji VR"),
+    ("", "Help", "Pomoc"),
+    ("help.docs", "EffectCraft Help...", "Pomoc EffectCraft..."),
+    ("help.docs", "Scripting Help...", "Pomoc dotycząca skryptów..."),
+    ("help.docs", "Expression Reference...", "Dokumentacja wyrażeń..."),
+    ("help.docs", "Effect Reference...", "Dokumentacja efektów..."),
+    ("anim.browsePresets", "Animation Presets...", "Ustawienia animacji..."),
+    ("app.keyboardShortcuts", "Keyboard Shortcuts...", "Skróty klawiaturowe..."),
+    ("help.inAppTutorials", "In-App Tutorials...", "Samouczki w aplikacji..."),
+    ("help.onlineTutorials", "Online Tutorials...", "Samouczki online..."),
+    ("help.systemReport", "System Compatibility Report...", "Raport zgodności systemu..."),
+    ("help.enableLogging", "Enable Logging", "Włącz rejestrowanie"),
+    ("help.revealLogFile", "Reveal Logging File", "Pokaż plik dziennika"),
+    ("help.discord", "Join the ArtCraft Discord...", "Dołącz do Discorda ArtCraft..."),
+    ("help.reportIssue", "Provide Feedback...", "Prześlij opinię..."),
+    ("help.website", "ArtCraft Website", "Witryna ArtCraft"),
+    ("help.appPage", "EffectCraft Home Page", "Strona główna EffectCraft"),
+    ("help.github", "EffectCraft on GitHub", "EffectCraft w serwisie GitHub"),
+    ("file.openDemoProject", "Open Demo Project", "Otwórz projekt demonstracyjny"),
+    ("", "Recent Script Files", "Ostatnie pliki skryptów"),
+    ("layer.newPrimitive", "3D Primitive...", "Bryła podstawowa 3D..."),
+];
+
 /// Czech (cs): original phrase translations of every fixed menu entry.
 const CZECH: &[(&str, &str, &str)] = &[
     ("", "Front", "Přední strana"),
@@ -6063,6 +7563,8 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("file.import", "File...", "Soubor..."),
     ("file.importMultiple", "Multiple Files...", "Více souborů..."),
     ("file.importTimeline", "Adobe Premiere Pro Project...", "Projekt Adobe Premiere Pro..."),
+    ("file.importAep", "After Effects Project...", "Projekt After Effects..."),
+    ("file.exportAep", "After Effects Project...", "Projekt After Effects..."),
     ("file.importProject", "EffectCraft Project...", "Projekt EffectCraft..."),
     ("file.importPlaceholder", "Placeholder...", "Zástupný záznam..."),
     ("file.importSolid", "Solid...", "Plná vrstva..."),
@@ -6093,6 +7595,7 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("file.installScript", "Install Script File...", "Nainstalovat soubor skriptu..."),
     ("file.installScriptUIPanel", "Install ScriptUI Panel...", "Nainstalovat panel ScriptUI..."),
     ("file.runScript", "Run Script File...", "Spustit soubor skriptu..."),
+    ("", "Recent Script Files", "Nedávné soubory skriptů"),
     ("", "Create Proxy", "Vytvořit zástupný soubor"),
     ("file.createProxy", "Still...", "Statický snímek..."),
     ("file.createProxy", "Movie...", "Video..."),
@@ -6212,6 +7715,7 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("layer.newShape", "Shape Layer", "Vrstva tvaru"),
     ("layer.newAdjustment", "Adjustment Layer", "Vrstva úprav"),
     ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "Vrstva výplně podle obsahu..."),
+    ("layer.newPrimitive", "3D Primitive...", "3D primitivum..."),
     ("layer.new3dPrimitive", "Cube", "Krychle"),
     ("layer.new3dPrimitive", "Sphere", "Koule"),
     ("layer.new3dPrimitive", "Plane", "Rovina"),
@@ -6428,6 +7932,8 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("effect.removeAll", "Remove All", "Odstranit vše"),
     ("effect.manage", "Manage Effects...", "Spravovat efekty..."),
     ("effect.plugins.load", "Load Effect Plug-in...", "Načíst zásuvný modul efektu..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "Načíst zásuvné moduly přes pomocný program..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "Vyhledat pomocné programy efektů"),
     ("", "Animation", "Animace"),
     ("anim.savePreset", "Save Animation Preset...", "Uložit přednastavení animace..."),
     ("anim.applyPreset", "Apply Animation Preset...", "Použít přednastavení animace..."),
@@ -6445,6 +7951,8 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("layer.applyTextPreset", "Drop In Lines", "Spustit řádky shora"),
     ("anim.addKeyframe", "Add Keyframe", "Přidat klíčový snímek"),
     ("keys.toggleHold", "Toggle Hold Keyframe", "Přepnout podržení klíčového snímku"),
+    ("keys.setMuted", "Mute Keyframes", "Ztlumit klíčové snímky"),
+    ("keys.setMuted", "Unmute Keyframes", "Obnovit klíčové snímky"),
     ("keys.interpolation", "Keyframe Interpolation...", "Interpolace klíčových snímků..."),
     ("keys.velocity", "Keyframe Velocity...", "Rychlost klíčového snímku..."),
     ("", "Keyframe Assistant", "Pomocník klíčových snímků"),
@@ -6598,7 +8106,7 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("window.panel", "Essential Graphics", "Základní grafika"),
     ("window.panel", "Info", "Informace"),
     ("help.inAppTutorials", "Learn", "Výuka"),
-    ("window.panel", "Lumetri Scopes", "Měřicí přístroje Lumetri"),
+    ("window.panel", "Video Scopes", "Videoskopy"),
     ("window.panel", "Mask Interpolation", "Interpolace masek"),
     ("window.panel", "Media Browser", "Prohlížeč médií"),
     ("window.panel", "Metadata", "Metadata"),
@@ -6642,6 +8150,648 @@ const CZECH: &[(&str, &str, &str)] = &[
     ("file.openDemoProject", "Open Demo Project", "Otevřít ukázkový projekt"),
 ];
 
+/// Georgian (ka): the same (command, English label) keys as `JAPANESE`, one entry per fixed menu row.
+/// Original translations written from the meaning of the English labels, sharing the terminology of
+/// the other Craft apps' Georgian catalogs (შრე, საკვანძო კადრი, კომპოზიცია, ნიღაბი); commands are
+/// verbal nouns (შენახვა, გახსნა) and Georgian has no capital letters.
+const GEORGIAN: &[(&str, &str, &str)] = &[
+    ("", "EffectCraft", "EffectCraft"),
+    ("app.about", "About EffectCraft...", "EffectCraft-ის შესახებ..."),
+    ("", "Settings...", "პარამეტრები..."),
+    ("app.settings", "General...", "ზოგადი..."),
+    ("app.settings", "Startup & Repair...", "გაშვება და აღდგენა..."),
+    ("app.settings", "Project...", "პროექტი..."),
+    ("app.settings", "Composition...", "კომპოზიცია..."),
+    ("app.settings", "Previews...", "წინასწარი ნახვა..."),
+    ("app.settings", "Appearance...", "იერსახე..."),
+    ("app.settings", "Grids & Guides...", "ბადე და დამხმარე ხაზები..."),
+    ("app.settings", "Labels...", "იარლიყები..."),
+    ("app.settings", "Type...", "ტექსტი..."),
+    ("app.settings", "Import...", "იმპორტი..."),
+    ("app.settings", "Export...", "ექსპორტი..."),
+    ("app.settings", "Audio...", "აუდიო..."),
+    ("app.settings", "Disk...", "დისკი..."),
+    ("app.settings", "Memory & CPU...", "მეხსიერება და CPU..."),
+    ("app.settings", "Video...", "ვიდეო..."),
+    ("app.settings", "3D...", "3D..."),
+    ("app.settings", "Scripting & Expressions...", "სკრიპტები და ექსპრესიები..."),
+    ("app.hide", "Hide EffectCraft", "EffectCraft-ის დამალვა"),
+    ("app.hideOthers", "Hide Others", "სხვების დამალვა"),
+    ("app.showAll", "Show All", "ყველას ჩვენება"),
+    ("app.quit", "Quit EffectCraft", "EffectCraft-იდან გასვლა"),
+    ("", "File", "ფაილი"),
+    ("", "New", "ახალი"),
+    ("file.newProject", "New Project", "ახალი პროექტი"),
+    ("file.newFromTemplate", "New Project from Template...", "ახალი პროექტი შაბლონიდან..."),
+    ("project.newFolder", "New Folder", "ახალი საქაღალდე"),
+    ("file.open", "Open Project...", "პროექტის გახსნა..."),
+    ("", "Open Recent", "ბოლოს გახსნილი ფაილების გახსნა"),
+    ("file.clearRecent", "Clear Recent Projects", "ბოლო პროექტების სიის გასუფთავება"),
+    ("file.close", "Close", "დახურვა"),
+    ("file.closeProject", "Close Project", "პროექტის დახურვა"),
+    ("file.save", "Save", "შენახვა"),
+    ("", "Save As", "შენახვა როგორც"),
+    ("file.saveAs", "Save As...", "შენახვა როგორც..."),
+    ("file.saveCopy", "Save a Copy...", "ასლის შენახვა..."),
+    ("file.saveCopyAsXml", "Save a Copy As XML...", "ასლის შენახვა XML-ად..."),
+    ("templates.saveAs", "Save as Template...", "შაბლონად შენახვა..."),
+    ("file.incrementAndSave", "Increment and Save", "ვერსიის გაზრდით შენახვა"),
+    ("file.revert", "Revert", "წინა ვერსიაზე დაბრუნება"),
+    ("", "Import", "იმპორტი"),
+    ("file.import", "File...", "ფაილი..."),
+    ("file.importMultiple", "Multiple Files...", "რამდენიმე ფაილი..."),
+    ("file.importTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro-ს პროექტი..."),
+    ("file.importAep", "After Effects Project...", "After Effects-ის პროექტი..."),
+    ("file.exportAep", "After Effects Project...", "After Effects-ის პროექტი..."),
+    ("file.importProject", "EffectCraft Project...", "EffectCraft-ის პროექტი..."),
+    ("file.importPlaceholder", "Placeholder...", "ჩანაცვლების ობიექტი..."),
+    ("file.importSolid", "Solid...", "სოლიდი..."),
+    ("file.importLottie", "Lottie...", "Lottie..."),
+    ("file.importVanishingPoint", "Vanishing Point (.vpe)...", "Vanishing Point (.vpe)..."),
+    ("essential.importTemplate", "Essential Graphics Template...", "ძირითადი გრაფიკის შაბლონი..."),
+    ("", "Import Recent Footage", "ბოლო ვიდეომასალის იმპორტი"),
+    ("file.clearRecentFootage", "Clear Recent Footage", "ბოლო ვიდეომასალის სიის გასუფთავება"),
+    ("", "Export", "ექსპორტი"),
+    ("renderQueue.add", "Add to Render Queue", "რენდერის რიგში დამატება"),
+    ("file.exportTimeline", "Adobe Premiere Pro Project...", "Adobe Premiere Pro-ს პროექტი..."),
+    ("file.exportLottie", "Lottie JSON...", "Lottie JSON..."),
+    ("essential.exportTemplate", "Essential Graphics Template...", "ძირითადი გრაფიკის შაბლონი..."),
+    ("app.find", "Find", "ძებნა"),
+    ("layer.addItem", "Add Footage to Comp", "ვიდეომასალის კომპოზიციაში დამატება"),
+    ("file.newCompFromSelection", "New Comp from Selection...", "ახალი კომპოზიცია მონიშნულიდან..."),
+    ("", "Dependencies", "დამოკიდებულებები"),
+    ("file.collectFiles", "Collect Files...", "ფაილების შეგროვება..."),
+    ("file.consolidateFootage", "Consolidate All Footage", "მთელი ვიდეომასალის კონსოლიდაცია"),
+    ("file.removeUnusedFootage", "Remove Unused Footage", "გამოუყენებელი ვიდეომასალის წაშლა"),
+    ("file.reduceProject", "Reduce Project", "პროექტის შემცირება"),
+    ("file.findMissing", "Find Missing Effects", "დაკარგული ეფექტების ძებნა"),
+    ("file.findMissing", "Find Missing Fonts", "დაკარგული შრიფტების ძებნა"),
+    ("file.findMissing", "Find Missing Footage", "დაკარგული ვიდეომასალის ძებნა"),
+    ("file.relinkFootage", "Relink Missing Footage...", "დაკარგული ვიდეომასალის ხელახლა დაკავშირება..."),
+    ("file.watchFolder", "Watch Folder...", "საქაღალდეზე თვალყურის დევნება..."),
+    ("", "Scripts", "სკრიპტები"),
+    ("file.installScript", "Install Script File...", "სკრიპტის ფაილის დაყენება..."),
+    ("file.installScriptUIPanel", "Install ScriptUI Panel...", "ScriptUI პანელის დაყენება..."),
+    ("file.runScript", "Run Script File...", "სკრიპტის ფაილის გაშვება..."),
+    ("", "Recent Script Files", "ბოლო სკრიპტის ფაილები"),
+    ("", "Create Proxy", "პროქსის შექმნა"),
+    ("file.createProxy", "Still...", "სტატიკური კადრი..."),
+    ("file.createProxy", "Movie...", "ვიდეო..."),
+    ("", "Set Proxy", "პროქსის მინიჭება"),
+    ("file.setProxy", "File...", "ფაილი..."),
+    ("file.setProxyNone", "None", "არცერთი"),
+    ("", "Interpret Footage", "ვიდეომასალის ინტერპრეტაცია"),
+    ("file.interpretFootage", "Main...", "ძირითადი..."),
+    ("file.interpretProxy", "Proxy...", "პროქსი..."),
+    ("file.rememberInterpretation", "Remember Interpretation", "ინტერპრეტაციის დამახსოვრება"),
+    ("file.applyInterpretation", "Apply Interpretation", "ინტერპრეტაციის გამოყენება"),
+    ("", "Replace Footage", "ვიდეომასალის ჩანაცვლება"),
+    ("file.replaceFootage", "File...", "ფაილი..."),
+    ("file.replaceWithPlaceholder", "Placeholder...", "ჩანაცვლების ობიექტი..."),
+    ("file.replaceWithSolid", "Solid...", "სოლიდი..."),
+    ("file.replaceWithLayeredComp", "With Layered Comp", "შრეებიანი კომპოზიციით"),
+    ("file.reloadFootage", "Reload Footage", "ვიდეომასალის ხელახლა ჩატვირთვა"),
+    ("file.revealInFinder", "Reveal in Finder", "Finder-ში ჩვენება"),
+    ("file.projectSettings", "Project Settings...", "პროექტის პარამეტრები..."),
+    ("app.quit", "Exit", "გასვლა"),
+    ("", "Edit", "რედაქტირება"),
+    ("edit.undo", "Undo", "დაბრუნება"),
+    ("edit.redo", "Redo", "ხელახლა შესრულება"),
+    ("", "History", "ისტორია"),
+    ("app.commandPalette", "Quick Apply...", "სწრაფი გამოყენება..."),
+    ("edit.cut", "Cut", "ამოჭრა"),
+    ("edit.copy", "Copy", "კოპირება"),
+    ("edit.copyWithPropertyLinks", "Copy with Property Links", "კოპირება თვისებების ბმულებით"),
+    ("edit.copyWithRelativePropertyLinks", "Copy with Relative Property Links", "კოპირება თვისებების ფარდობითი ბმულებით"),
+    ("edit.copyExpressionOnly", "Copy Expression Only", "მხოლოდ ექსპრესიის კოპირება"),
+    ("edit.paste", "Paste", "ჩასმა"),
+    ("edit.pasteReversedKeyframes", "Paste Reversed Keyframes", "საკვანძო კადრების შებრუნებული ჩასმა"),
+    ("edit.pasteTextMatchFormatting", "Paste Text and Match Formatting", "ტექსტის ჩასმა ფორმატის შეთანხმებით"),
+    ("edit.pasteTextFormattingOnly", "Paste Text Formatting Only", "მხოლოდ ტექსტის ფორმატის ჩასმა"),
+    ("edit.clear", "Clear", "გასუფთავება"),
+    ("edit.duplicate", "Duplicate", "დუბლირება"),
+    ("edit.splitLayer", "Split Layer", "შრის დაყოფა"),
+    ("edit.liftWorkArea", "Lift Work Area", "სამუშაო არის აწევა"),
+    ("edit.extractWorkArea", "Extract Work Area", "სამუშაო არის ამოღება"),
+    ("edit.selectAll", "Select All", "ყველაფრის მონიშვნა"),
+    ("edit.deselectAll", "Deselect All", "ყველა მონიშვნის მოხსნა"),
+    ("", "Label", "იარლიყი"),
+    ("edit.selectLabelGroup", "Select Label Group", "იარლიყის ჯგუფის მონიშვნა"),
+    ("edit.label", "None", "არცერთი"),
+    ("edit.label", "Red", "წითელი"),
+    ("edit.label", "Yellow", "ყვითელი"),
+    ("edit.label", "Aqua", "ზღვისფერი"),
+    ("edit.label", "Pink", "ვარდისფერი"),
+    ("edit.label", "Lavender", "ლავანდისფერი"),
+    ("edit.label", "Peach", "ატმისფერი"),
+    ("edit.label", "Sea Foam", "ზღვის ქაფი"),
+    ("edit.label", "Blue", "ლურჯი"),
+    ("edit.label", "Green", "მწვანე"),
+    ("edit.label", "Purple", "იისფერი"),
+    ("edit.label", "Orange", "ნარინჯისფერი"),
+    ("edit.label", "Brown", "ყავისფერი"),
+    ("edit.label", "Fuchsia", "ფუქსია"),
+    ("edit.label", "Cyan", "ცისფერი"),
+    ("edit.label", "Sandstone", "ქვიშაქვა"),
+    ("edit.label", "Dark Green", "მუქი მწვანე"),
+    ("app.settings", "Edit Label Colors...", "იარლიყის ფერების რედაქტირება..."),
+    ("", "Select Keyframe Label Group", "საკვანძო კადრების იარლიყის ჯგუფის მონიშვნა"),
+    ("keys.selectLabelGroup", "On Selected Layers", "მონიშნულ შრეებზე"),
+    ("keys.selectLabelGroup", "On All Layers", "ყველა შრეზე"),
+    ("keys.selectLabelGroup", "Visible Keyframes on Selected Layers", "ხილული საკვანძო კადრები მონიშნულ შრეებზე"),
+    ("keys.selectLabelGroup", "Visible Keyframes on All Layers", "ხილული საკვანძო კადრები ყველა შრეზე"),
+    ("", "Purge", "გაწმენდა"),
+    ("edit.purge", "All Cache...", "მთელი ქეში..."),
+    ("edit.purge", "All Memory & Disk Cache...", "მთელი მეხსიერება და დისკის ქეში..."),
+    ("edit.purge", "All Memory", "მთელი მეხსიერება"),
+    ("edit.purge", "All Disk Cache...", "მთელი დისკის ქეში..."),
+    ("edit.purge", "All 3D Cache...", "მთელი 3D ქეში..."),
+    ("edit.purgeUndo", "Undo", "დაბრუნების ისტორია"),
+    ("edit.purge", "Image Cache Memory", "გამოსახულების ქეშის მეხსიერება"),
+    ("edit.purge", "Snapshot", "მომენტალური ასლი"),
+    ("edit.editOriginal", "Edit Original...", "ორიგინალის რედაქტირება..."),
+    ("", "Templates", "შაბლონები"),
+    ("app.templates", "Render Settings...", "რენდერის პარამეტრები..."),
+    ("app.templates", "Output Module...", "გამოტანის მოდული..."),
+    ("app.keyboardShortcuts", "Keyboard Shortcuts", "კლავიატურის მალსახმობები"),
+    ("", "Preferences", "პარამეტრები"),
+    ("", "Composition", "კომპოზიცია"),
+    ("comp.new", "New Composition...", "ახალი კომპოზიცია..."),
+    ("comp.settings", "Composition Settings...", "კომპოზიციის პარამეტრები..."),
+    ("comp.setPosterTime", "Set Poster Time", "პოსტერის დროის დაყენება"),
+    ("comp.trimToWorkArea", "Trim Comp to Work Area", "კომპოზიციის მოკვეთა სამუშაო არემდე"),
+    ("comp.cropToRegionOfInterest", "Crop Comp to Region of Interest", "კომპოზიციის ჩამოჭრა ინტერესის არემდე"),
+    ("comp.cropToLayerBounds", "Crop Comp to Selected Layer(s) Bounds", "კომპოზიციის ჩამოჭრა მონიშნული შრ(ეებ)ის საზღვრებამდე"),
+    ("render.addOutputModule", "Add Output Module", "გამოტანის მოდულის დამატება"),
+    ("", "Preview", "წინასწარი ნახვა"),
+    ("playback.toggle", "Play Current Preview", "მიმდინარე წინასწარი ნახვის დაკვრა"),
+    ("playback.cacheWhenIdle", "Cache Frames When Idle", "კადრების ქეშირება უქმობისას"),
+    ("playback.audio", "Audio", "აუდიო"),
+    ("", "Save Frame As", "კადრის შენახვა როგორც"),
+    ("comp.saveFrameAs", "File...", "ფაილი..."),
+    ("comp.saveFrameAsPsd", "Photoshop Layers...", "Photoshop-ის შრეები..."),
+    ("comp.saveFrameAsExr", "ProEXR...", "ProEXR..."),
+    ("comp.copyFrame", "Copy Frame to Clipboard", "კადრის კოპირება გაცვლის ბუფერში"),
+    ("render.preRender", "Pre-render...", "წინასწარი რენდერი..."),
+    ("render.saveCurrentPreview", "Save Current Preview...", "მიმდინარე წინასწარი ნახვის შენახვა..."),
+    ("comp.openInEssentialGraphics", "Open in Essential Graphics", "ძირითად გრაფიკაში გახსნა"),
+    ("", "Responsive Design — Time", "რესპონსიული დიზაინი — დრო"),
+    ("comp.responsiveTime", "Create Intro", "შესავლის შექმნა"),
+    ("comp.responsiveTime", "Create Outro", "დასასრულის შექმნა"),
+    ("comp.responsiveTime", "Create Protected Region from Work Area", "დაცული არის შექმნა სამუშაო არიდან"),
+    ("comp.flowchart", "Composition Flowchart", "კომპოზიციის ბლოკ-სქემა"),
+    ("comp.miniFlowchart", "Composition Mini-Flowchart", "კომპოზიციის მინი-ბლოკ-სქემა"),
+    ("", "VR", "VR"),
+    ("comp.vr.createEnvironment", "Create VR Environment...", "VR გარემოს შექმნა..."),
+    ("comp.vr.extractCubemap", "Extract Cubemap...", "კუბური რუკის ამოღება..."),
+    ("", "Layer", "შრე"),
+    ("layer.newText", "Text", "ტექსტი"),
+    ("layer.newSolid", "Solid...", "სოლიდი..."),
+    ("layer.newLight", "Light...", "სინათლე..."),
+    ("layer.newCamera", "Camera...", "კამერა..."),
+    ("layer.newNull", "Null Object", "ნულოვანი ობიექტი"),
+    ("layer.newShape", "Shape Layer", "ფიგურის შრე"),
+    ("layer.newAdjustment", "Adjustment Layer", "კორექციის შრე"),
+    ("layer.newContentAwareFill", "Content-Aware Fill Layer...", "შიგთავსის გათვალისწინებით შევსების შრე..."),
+    ("layer.new3dPrimitive", "Cube", "კუბი"),
+    ("layer.new3dPrimitive", "Sphere", "სფერო"),
+    ("layer.new3dPrimitive", "Plane", "სიბრტყე"),
+    ("layer.new3dPrimitive", "Torus", "ტორი"),
+    ("layer.new3dPrimitive", "Cone", "კონუსი"),
+    ("layer.new3dPrimitive", "Cylinder", "ცილინდრი"),
+    ("layer.settings", "Layer Settings...", "შრის პარამეტრები..."),
+    ("layer.openLayer", "Open Layer", "შრის გახსნა"),
+    ("layer.openSource", "Open Layer Source", "შრის წყაროს გახსნა"),
+    ("layer.revealInFinder", "Reveal in Finder", "Finder-ში ჩვენება"),
+    ("", "Mask", "ნიღაბი"),
+    ("layer.addMask", "New Mask", "ახალი ნიღაბი"),
+    ("layer.mask.shape", "Mask Shape...", "ნიღბის ფორმა..."),
+    ("layer.mask.set", "Mask Feather...", "ნიღბის კიდეების შერბილება..."),
+    ("layer.mask.set", "Mask Opacity...", "ნიღბის გაუმჭვირვალობა..."),
+    ("layer.mask.set", "Mask Expansion...", "ნიღბის გაფართოება..."),
+    ("layer.mask.reset", "Reset Mask", "ნიღბის ჩამოყრა"),
+    ("layer.mask.remove", "Remove Mask", "ნიღბის წაშლა"),
+    ("layer.mask.removeAll", "Remove All Masks", "ყველა ნიღბის წაშლა"),
+    ("track.mask", "Track Mask", "ნიღბის ტრეკინგი"),
+    ("", "Mode", "რეჟიმი"),
+    ("layer.mask.mode", "None", "არცერთი"),
+    ("layer.mask.mode", "Add", "დამატება"),
+    ("layer.mask.mode", "Subtract", "გამოკლება"),
+    ("layer.mask.mode", "Intersect", "გადაკვეთა"),
+    ("layer.mask.mode", "Lighten", "გაღიავება"),
+    ("layer.mask.mode", "Darken", "ჩამუქება"),
+    ("layer.mask.mode", "Difference", "სხვაობა"),
+    ("layer.mask.invert", "Inverted", "შებრუნებული"),
+    ("layer.mask.lock", "Locked", "ჩაკეტილი"),
+    ("", "Motion Blur", "მოძრაობის გაბუნდოვნება"),
+    ("layer.mask.motionBlur", "Same As Layer", "შრის მსგავსად"),
+    ("layer.mask.motionBlur", "On", "ჩართული"),
+    ("layer.mask.motionBlur", "Off", "გამორთული"),
+    ("", "Feather Falloff", "კიდეების შერბილების მილევა"),
+    ("layer.mask.featherFalloff", "Smooth", "გლუვი"),
+    ("layer.mask.featherFalloff", "Linear", "წრფივი"),
+    ("layer.mask.unlockAll", "Unlock All Masks", "ყველა ნიღბის განბლოკვა"),
+    ("layer.mask.lockOthers", "Lock Other Masks", "სხვა ნიღბების ჩაკეტვა"),
+    ("layer.mask.hideLocked", "Hide Locked Masks", "ჩაკეტილი ნიღბების დამალვა"),
+    ("", "Mask and Shape Path", "ნიღაბი და ფიგურის ტრაექტორია"),
+    ("path.rotoBezier", "RotoBezier", "RotoBezier"),
+    ("mask.setClosed", "Closed", "შეკრული"),
+    ("path.convertToBezier", "Convert To Bezier Path", "ბეზიეს ტრაექტორიად გარდაქმნა"),
+    ("path.setFirstVertex", "Set First Vertex", "პირველი წვეროს დაყენება"),
+    ("path.freeTransform", "Free Transform Points", "წერტილების თავისუფალი გარდაქმნა"),
+    ("", "Quality", "ხარისხი"),
+    ("layer.quality", "Best", "საუკეთესო"),
+    ("layer.quality", "Draft", "მონახაზი"),
+    ("layer.quality", "Wireframe", "კარკასი"),
+    ("layer.sampling", "Bilinear", "ბიწრფივი"),
+    ("layer.sampling", "Bicubic", "ბიკუბური"),
+    ("", "Switches", "გადამრთველები"),
+    ("layer.hideOtherVideo", "Hide Other Video", "სხვა ვიდეოს დამალვა"),
+    ("layer.showAllVideo", "Show All Video", "მთელი ვიდეოს ჩვენება"),
+    ("layer.unlockAll", "Unlock All Layers", "ყველა შრის განბლოკვა"),
+    ("layer.expressions", "Enable Expressions", "ექსპრესიების ჩართვა"),
+    ("layer.expressions", "Disable Expressions", "ექსპრესიების გამორთვა"),
+    ("layer.setSwitch", "Shy", "მორცხვი"),
+    ("layer.setSwitch", "Lock", "ჩაკეტვა"),
+    ("layer.setSwitch", "Audio", "აუდიო"),
+    ("layer.setSwitch", "Video", "ვიდეო"),
+    ("layer.setSwitch", "Solo", "სოლო"),
+    ("layer.setSwitch", "Effect", "ეფექტი"),
+    ("layer.setSwitch", "Collapse", "ჩაკეცვა"),
+    ("layer.setSwitch", "Motion Blur", "მოძრაობის გაბუნდოვნება"),
+    ("layer.setSwitch", "Adjustment Layer", "კორექციის შრე"),
+    ("", "Transform", "გარდაქმნა"),
+    ("layer.transform", "Reset", "ჩამოყრა"),
+    ("layer.setTransform", "Anchor Point...", "საყრდენი წერტილი..."),
+    ("layer.setTransform", "Position...", "პოზიცია..."),
+    ("layer.setTransform", "Scale...", "მასშტაბი..."),
+    ("layer.setTransform", "Orientation...", "ორიენტაცია..."),
+    ("layer.setTransform", "Rotation...", "შემობრუნება..."),
+    ("layer.setTransform", "Opacity...", "გაუმჭვირვალობა..."),
+    ("layer.transform", "Flip Horizontal", "ჰორიზონტალურად არეკვლა"),
+    ("layer.transform", "Flip Vertical", "ვერტიკალურად არეკვლა"),
+    ("layer.transform", "Center In View", "ხედის ცენტრში მოთავსება"),
+    ("layer.centerAnchor", "Center Anchor Point in Layer Content", "საყრდენი წერტილის შრის შიგთავსის ცენტრში მოთავსება"),
+    ("layer.transform", "Fit to Comp", "კომპოზიციაში ჩატევა"),
+    ("layer.transform", "Fit to Comp Width", "კომპოზიციის სიგანეში ჩატევა"),
+    ("layer.transform", "Fit to Comp Height", "კომპოზიციის სიმაღლეში ჩატევა"),
+    ("layer.autoOrient", "Auto-Orient...", "ავტოორიენტაცია..."),
+    ("", "Time", "დრო"),
+    ("layer.enableTimeRemap", "Enable Time Remapping", "დროის გადანაწილების ჩართვა"),
+    ("layer.timeReverse", "Time-Reverse Layer", "შრის დროში შებრუნება"),
+    ("layer.timeStretch", "Time Stretch...", "დროში გაწელვა..."),
+    ("layer.freezeFrame", "Freeze Frame", "კადრის გაყინვა"),
+    ("layer.freezeOnLastFrame", "Freeze On Last Frame", "ბოლო კადრზე გაყინვა"),
+    ("layer.alignVideoToData", "Align Video to Data", "ვიდეოს მონაცემებთან სწორება"),
+    ("", "Frame Blending", "კადრების შერევა"),
+    ("layer.frameBlending", "Off", "გამორთული"),
+    ("layer.frameBlending", "Frame Mix", "კადრების ნაზავი"),
+    ("layer.frameBlending", "Pixel Motion", "პიქსელების მოძრაობა"),
+    ("layer.setSwitch", "3D Layer", "3D შრე"),
+    ("layer.setSwitch", "Guide Layer", "დამხმარე შრე"),
+    ("layer.environment", "Environment Layer", "გარემოს შრე"),
+    ("", "Markers", "მარკერები"),
+    ("layer.addMarker", "Add Marker", "მარკერის დამატება"),
+    ("layer.updateMarkersFromSource", "Update Markers From Source", "მარკერების განახლება წყაროდან"),
+    ("layer.markersLock", "Lock Markers", "მარკერების ჩაკეტვა"),
+    ("layer.deleteAllMarkers", "Delete All Markers", "ყველა მარკერის წაშლა"),
+    ("layer.setSwitch", "Preserve Transparency", "გამჭვირვალობის შენარჩუნება"),
+    ("", "Blending Mode", "შერევის რეჟიმი"),
+    ("layer.setBlendMode", "Normal", "ჩვეულებრივი"),
+    ("layer.setBlendMode", "Dissolve", "გაფანტვა"),
+    ("layer.setBlendMode", "Dancing Dissolve", "მოცეკვავე გაფანტვა"),
+    ("layer.setBlendMode", "Darken", "ჩამუქება"),
+    ("layer.setBlendMode", "Multiply", "გამრავლება"),
+    ("layer.setBlendMode", "Color Burn", "ფერით ჩამუქება"),
+    ("layer.setBlendMode", "Classic Color Burn", "კლასიკური ფერით ჩამუქება"),
+    ("layer.setBlendMode", "Linear Burn", "წრფივი ჩამუქება"),
+    ("layer.setBlendMode", "Darker Color", "უფრო მუქი ფერი"),
+    ("layer.setBlendMode", "Add", "დამატება"),
+    ("layer.setBlendMode", "Lighten", "გაღიავება"),
+    ("layer.setBlendMode", "Screen", "ეკრანი"),
+    ("layer.setBlendMode", "Color Dodge", "ფერით გაღიავება"),
+    ("layer.setBlendMode", "Classic Color Dodge", "კლასიკური ფერით გაღიავება"),
+    ("layer.setBlendMode", "Linear Dodge", "წრფივი გაღიავება"),
+    ("layer.setBlendMode", "Lighter Color", "უფრო ღია ფერი"),
+    ("layer.setBlendMode", "Overlay", "გადაფარვა"),
+    ("layer.setBlendMode", "Soft Light", "რბილი სინათლე"),
+    ("layer.setBlendMode", "Hard Light", "მკვეთრი სინათლე"),
+    ("layer.setBlendMode", "Linear Light", "წრფივი სინათლე"),
+    ("layer.setBlendMode", "Vivid Light", "კაშკაშა სინათლე"),
+    ("layer.setBlendMode", "Pin Light", "წერტილოვანი სინათლე"),
+    ("layer.setBlendMode", "Hard Mix", "მკვეთრი შერევა"),
+    ("layer.setBlendMode", "Difference", "სხვაობა"),
+    ("layer.setBlendMode", "Classic Difference", "კლასიკური სხვაობა"),
+    ("layer.setBlendMode", "Exclusion", "გამორიცხვა"),
+    ("layer.setBlendMode", "Subtract", "გამოკლება"),
+    ("layer.setBlendMode", "Divide", "გაყოფა"),
+    ("layer.setBlendMode", "Hue", "ფერის ტონი"),
+    ("layer.setBlendMode", "Saturation", "გაჯერება"),
+    ("layer.setBlendMode", "Color", "ფერი"),
+    ("layer.setBlendMode", "Luminosity", "ნათება"),
+    ("layer.setBlendMode", "Stencil Alpha", "ალფა-ტრაფარეტი"),
+    ("layer.setBlendMode", "Stencil Luma", "ლუმა-ტრაფარეტი"),
+    ("layer.setBlendMode", "Silhouette Alpha", "ალფა-სილუეტი"),
+    ("layer.setBlendMode", "Silhouette Luma", "ლუმა-სილუეტი"),
+    ("layer.setBlendMode", "Alpha Add", "ალფას დამატება"),
+    ("layer.setBlendMode", "Luminescent Premul", "მანათობელი წინასწარ გამრავლებული"),
+    ("layer.setBlendMode", "Next Blending Mode", "შემდეგი შერევის რეჟიმი"),
+    ("layer.setBlendMode", "Previous Blending Mode", "წინა შერევის რეჟიმი"),
+    ("", "Track Matte", "ტრეკ-მატი"),
+    ("layer.trackMatte", "No Track Matte", "ტრეკ-მატის გარეშე"),
+    ("layer.trackMatte", "Alpha Matte", "ალფა-მატი"),
+    ("layer.trackMatte", "Alpha Inverted Matte", "შებრუნებული ალფა-მატი"),
+    ("layer.trackMatte", "Luma Matte", "ლუმა-მატი"),
+    ("layer.trackMatte", "Luma Inverted Matte", "შებრუნებული ლუმა-მატი"),
+    ("layer.trackMatte", "Matte with Layer Above", "მატი ზედა შრით"),
+    ("layer.trackMatte", "Matte with Layer Below", "მატი ქვედა შრით"),
+    ("", "Layer Styles", "შრის სტილები"),
+    ("layer.style.options", "Layer Style Options...", "შრის სტილის პარამეტრები..."),
+    ("layer.style.convertToEditable", "Convert to Editable Styles", "რედაქტირებად სტილებად გარდაქმნა"),
+    ("layer.style.showAll", "Show All", "ყველას ჩვენება"),
+    ("layer.style.removeAll", "Remove All", "ყველას წაშლა"),
+    ("layer.style.dropShadow", "Drop Shadow", "ჩრდილი"),
+    ("layer.style.innerShadow", "Inner Shadow", "შიდა ჩრდილი"),
+    ("layer.style.outerGlow", "Outer Glow", "გარე ნათება"),
+    ("layer.style.innerGlow", "Inner Glow", "შიდა ნათება"),
+    ("layer.style.bevelEmboss", "Bevel and Emboss", "ფასკა და რელიეფი"),
+    ("layer.style.satin", "Satin", "ატლასი"),
+    ("layer.style.colorOverlay", "Color Overlay", "ფერის გადაფარვა"),
+    ("layer.style.gradientOverlay", "Gradient Overlay", "გრადიენტის გადაფარვა"),
+    ("layer.style.stroke", "Stroke", "კონტური"),
+    ("path.groupShapes", "Group Shapes", "ფიგურების დაჯგუფება"),
+    ("path.ungroupShapes", "Ungroup Shapes", "ფიგურების დაჯგუფების მოხსნა"),
+    ("", "Arrange", "დალაგება"),
+    ("layer.arrange", "Bring Layer to Front", "შრის წინა პლანზე გადმოტანა"),
+    ("layer.arrange", "Bring Layer Forward", "შრის წინ გადმოტანა"),
+    ("layer.arrange", "Send Layer Backward", "შრის უკან გადატანა"),
+    ("layer.arrange", "Send Layer to Back", "შრის უკანა პლანზე გადატანა"),
+    ("", "Reveal", "ჩვენება"),
+    ("layer.revealSource", "Reveal Layer Source in Project", "შრის წყაროს ჩვენება პროექტში"),
+    ("comp.flowchart", "Reveal Layer in Project Flowchart", "შრის ჩვენება პროექტის ბლოკ-სქემაში"),
+    ("comp.revealInProject", "Reveal Composition in Project", "კომპოზიციის ჩვენება პროექტში"),
+    ("layer.revealExpressionErrors", "Reveal Expression Errors", "ექსპრესიის შეცდომების ჩვენება"),
+    ("", "Create", "შექმნა"),
+    ("layer.create", "Convert to Editable Text", "რედაქტირებად ტექსტად გარდაქმნა"),
+    ("layer.create", "Create Shapes from Text", "ფიგურების შექმნა ტექსტიდან"),
+    ("layer.create", "Create Masks from Text", "ნიღბების შექმნა ტექსტიდან"),
+    ("layer.create", "Create Shapes from Vector Layer", "ფიგურების შექმნა ვექტორული შრიდან"),
+    ("layer.create", "Create Keyframes from Data", "საკვანძო კადრების შექმნა მონაცემებიდან"),
+    ("layer.create", "Null Controllers for Positional Points", "ნულოვანი მართვის ობიექტები პოზიციის წერტილებისთვის"),
+    ("layer.create", "Null Controllers for Path Points", "ნულოვანი მართვის ობიექტები ტრაექტორიის წერტილებისთვის"),
+    ("layer.create", "Nulls Following Path Points", "ტრაექტორიის წერტილებს მიმყოლი ნულოვანი ობიექტები"),
+    ("layer.create", "Null Tracing Along Path", "ტრაექტორიის გასწვრივ მოძრავი ნულოვანი ობიექტი"),
+    ("layer.create", "Create 3D Layer Instance", "3D შრის ეგზემპლარის შექმნა"),
+    ("", "Camera", "კამერა"),
+    ("camera.fromView", "Create Camera from 3D View", "კამერის შექმნა 3D ხედიდან"),
+    ("camera.stereoRig", "Create Stereo 3D Rig", "სტერეო 3D სისტემის შექმნა"),
+    ("camera.orbitNull", "Create Orbit Null", "ორბიტის ნულოვანი ობიექტის შექმნა"),
+    ("camera.fromModel", "Create Cameras from 3D Model", "კამერების შექმნა 3D მოდელიდან"),
+    ("camera.linkFocusToPoi", "Link Focus Distance to Point of Interest", "ფოკუსური მანძილის მიბმა ინტერესის წერტილზე"),
+    ("camera.linkFocusToLayer", "Link Focus Distance to Layer", "ფოკუსური მანძილის მიბმა შრეზე"),
+    ("camera.setFocusToLayer", "Set Focus Distance to Layer", "ფოკუსური მანძილის დაყენება შრეზე"),
+    ("layer.cameraSettings", "Camera Settings...", "კამერის პარამეტრები..."),
+    ("view.reset3DView", "Reset 3D View", "3D ხედის ჩამოყრა"),
+    ("", "Light", "სინათლე"),
+    ("light.fromModel", "Create Lights from 3D Model", "სინათლის წყაროების შექმნა 3D მოდელიდან"),
+    ("light.controlWithCamera", "Control Light with Camera", "სინათლის მართვა კამერით"),
+    ("light.environmentBackground", "Create Environment Light Background Layer", "გარემოს სინათლის ფონური შრის შექმნა"),
+    ("", "Material", "მასალა"),
+    ("material.revealSource", "Reveal Material Source in Project", "მასალის წყაროს ჩვენება პროექტში"),
+    ("material.reset", "Reset Material", "მასალის ჩამოყრა"),
+    ("material.duplicateAssign", "Duplicate and Assign Material", "მასალის დუბლირება და მინიჭება"),
+    ("layer.autoTrace", "Auto-trace...", "ავტომატური ვექტორიზაცია..."),
+    ("layer.precompose", "Pre-compose...", "კომპოზიციაში მოთავსება..."),
+    ("layer.sceneEditDetection", "Scene Edit Detection...", "სცენების ჭრილების ამოცნობა..."),
+    ("", "Effect", "ეფექტი"),
+    ("window.panel", "Effect Controls", "ეფექტის მართვა"),
+    ("effect.applyLast", "Last Effect", "ბოლო ეფექტი"),
+    ("effect.removeAll", "Remove All", "ყველას წაშლა"),
+    ("effect.manage", "Manage Effects...", "ეფექტების მართვა..."),
+    ("effect.plugins.load", "Load Effect Plug-in...", "ეფექტის პლაგინის ჩატვირთვა..."),
+    ("effect.helpers.load", "Load Plug-ins Through Helper...", "პლაგინების ჩატვირთვა დამხმარე პროგრამით..."),
+    ("effect.helpers.scan", "Scan for Effect Helpers", "ეფექტის დამხმარე პროგრამების ძიება"),
+    ("", "Animation", "ანიმაცია"),
+    ("anim.savePreset", "Save Animation Preset...", "ანიმაციის პრესეტის შენახვა..."),
+    ("anim.applyPreset", "Apply Animation Preset...", "ანიმაციის პრესეტის გამოყენება..."),
+    ("", "Recent Animation Presets", "ბოლო ანიმაციის პრესეტები"),
+    ("anim.clearRecentPresets", "Clear Recent Presets", "ბოლო პრესეტების სიის გასუფთავება"),
+    ("anim.browsePresets", "Browse Presets...", "პრესეტების დათვალიერება..."),
+    ("", "Text Animation Presets", "ტექსტის ანიმაციის პრესეტები"),
+    ("layer.applyTextPreset", "Typewriter", "საბეჭდი მანქანა"),
+    ("layer.applyTextPreset", "Fade Up Characters", "ასოების ამოსვლა გამოჩენით"),
+    ("layer.applyTextPreset", "Bounce In Words", "სიტყვების ხტუნვით შემოსვლა"),
+    ("layer.applyTextPreset", "Tracking In", "ასოების შეკუმშვით შემოსვლა"),
+    ("layer.applyTextPreset", "Scramble", "არევა"),
+    ("layer.applyTextPreset", "Blur In", "გამოჩენა გაბუნდოვნებიდან"),
+    ("layer.applyTextPreset", "Jitter", "კანკალი"),
+    ("layer.applyTextPreset", "Drop In Lines", "სტრიქონების ჩამოვარდნა"),
+    ("anim.addKeyframe", "Add Keyframe", "საკვანძო კადრის დამატება"),
+    ("keys.toggleHold", "Toggle Hold Keyframe", "ფიქსირებული საკვანძო კადრის გადართვა"),
+    ("keys.setMuted", "Mute Keyframes", "საკვანძო კადრების დადუმება"),
+    ("keys.setMuted", "Unmute Keyframes", "საკვანძო კადრების დადუმების მოხსნა"),
+    ("keys.interpolation", "Keyframe Interpolation...", "საკვანძო კადრის ინტერპოლაცია..."),
+    ("keys.velocity", "Keyframe Velocity...", "საკვანძო კადრის სიჩქარე..."),
+    ("", "Keyframe Assistant", "საკვანძო კადრების ასისტენტი"),
+    ("keys.audioToKeyframes", "Convert Audio to Keyframes", "აუდიოს საკვანძო კადრებად გარდაქმნა"),
+    ("prop.convertExpressionToKeyframes", "Convert Expression to Keyframes", "ექსპრესიის საკვანძო კადრებად გარდაქმნა"),
+    ("keys.easyEase", "Easy Ease", "რბილი შენელება"),
+    ("keys.easyEaseIn", "Easy Ease In", "რბილი შენელება შესვლისას"),
+    ("keys.easyEaseOut", "Easy Ease Out", "რბილი შენელება გამოსვლისას"),
+    ("keys.exponentialScale", "Exponential Scale", "ექსპონენციალური მასშტაბი"),
+    ("keys.rpfCameraImport", "RPF Camera Import", "RPF კამერის იმპორტი"),
+    ("layer.sequence", "Sequence Layers...", "შრეების თანმიმდევრობით განლაგება..."),
+    ("keys.timeReverse", "Time-Reverse Keyframes", "საკვანძო კადრების დროში შებრუნება"),
+    ("", "Animate Text", "ტექსტის ანიმირება"),
+    ("layer.enablePerChar3D", "Enable Per-character 3D", "თითოეული ასოს 3D-ს ჩართვა"),
+    ("layer.addTextAnimator", "Anchor Point", "საყრდენი წერტილი"),
+    ("layer.addTextAnimator", "Position", "პოზიცია"),
+    ("layer.addTextAnimator", "Scale", "მასშტაბი"),
+    ("layer.addTextAnimator", "Skew", "დახრა"),
+    ("layer.addTextAnimator", "Rotation", "შემობრუნება"),
+    ("layer.addTextAnimator", "Opacity", "გაუმჭვირვალობა"),
+    ("layer.addTextAnimator", "All Transform Properties", "გარდაქმნის ყველა თვისება"),
+    ("", "Fill Color", "შევსების ფერი"),
+    ("layer.addTextAnimator", "RGB", "RGB"),
+    ("layer.addTextAnimator", "Hue", "ფერის ტონი"),
+    ("layer.addTextAnimator", "Saturation", "გაჯერება"),
+    ("layer.addTextAnimator", "Brightness", "სიკაშკაშე"),
+    ("", "Stroke Color", "კონტურის ფერი"),
+    ("layer.addTextAnimator", "Stroke Width", "კონტურის სისქე"),
+    ("", "Front", "წინა მხარე"),
+    ("", "Bevel", "წაკვეთა"),
+    ("", "Side", "გვერდითი მხარე"),
+    ("", "Back", "უკანა მხარე"),
+    ("layer.addTextAnimator", "Color", "ფერი"),
+    ("layer.addTextAnimator", "Tracking", "ასოთაშორისი ინტერვალი"),
+    ("layer.addTextAnimator", "Line Anchor", "სტრიქონის საყრდენი"),
+    ("layer.addTextAnimator", "Line Spacing", "სტრიქონთა დაშორება"),
+    ("layer.addTextAnimator", "Character Offset", "ასოს წანაცვლება"),
+    ("layer.addTextAnimator", "Character Value", "ასოს მნიშვნელობა"),
+    ("layer.addTextAnimator", "Blur", "გაბუნდოვნება"),
+    ("text.animatorFontAxes", "Variable Font Axes", "ცვლადი შრიფტის ღერძები"),
+    ("", "Add Text Selector", "ტექსტის სელექტორის დამატება"),
+    ("text.addSelector", "Range", "დიაპაზონი"),
+    ("text.addSelector", "Wiggly", "რხევითი"),
+    ("text.addSelector", "Expression", "ექსპრესია"),
+    ("text.removeAllAnimators", "Remove All Text Animators", "ტექსტის ყველა ანიმატორის წაშლა"),
+    ("prop.setExpression", "Add Expression", "ექსპრესიის დამატება"),
+    ("essential.addProperty", "Add Property to Essential Graphics", "თვისების დამატება ძირითად გრაფიკაში"),
+    ("prop.separateDimensions", "Separate Dimensions", "განზომილებების გაყოფა"),
+    ("track.camera", "Track Camera", "კამერის ტრეკინგი"),
+    ("track.warpStabilizer", "Warp Stabilizer VFX", "Warp Stabilizer VFX"),
+    ("track.motion", "Track Motion", "მოძრაობის ტრეკინგი"),
+    ("track.stabilize", "Stabilize Motion", "მოძრაობის სტაბილიზაცია"),
+    ("track.property", "Track this Property", "ამ თვისების ტრეკინგი"),
+    ("anim.reveal", "Reveal Properties with Keyframes", "საკვანძო კადრების მქონე თვისებების ჩვენება"),
+    ("anim.reveal", "Reveal Properties with Animation", "ანიმაციის მქონე თვისებების ჩვენება"),
+    ("anim.reveal", "Reveal All Modified Properties", "ყველა შეცვლილი თვისების ჩვენება"),
+    ("", "View", "ხედი"),
+    ("view.newViewer", "New Viewer", "ახალი დამთვალიერებელი"),
+    ("view.splitLockedViewer", "Split with New Locked Viewer", "დაყოფა ახალი ჩაკეტილი დამთვალიერებელით"),
+    ("view.zoomIn", "Zoom In", "გადიდება"),
+    ("view.zoomOut", "Zoom Out", "დაპატარავება"),
+    ("", "Resolution", "გარჩევადობა"),
+    ("view.res.full", "Full", "სრული"),
+    ("view.res.half", "Half", "ნახევარი"),
+    ("view.res.third", "Third", "მესამედი"),
+    ("view.res.quarter", "Quarter", "მეოთხედი"),
+    ("view.res.custom", "Custom...", "მორგებული..."),
+    ("view.displayColorManagement", "Use Display Color Management", "ეკრანის ფერთა მართვის გამოყენება"),
+    ("", "Simulate Output", "გამოტანის იმიტაცია"),
+    ("view.simulateOutput", "No Output Simulation", "გამოტანის იმიტაციის გარეშე"),
+    ("view.simulateOutput", "HDTV (Rec. 709)", "HDTV (Rec. 709)"),
+    ("view.simulateOutput", "SDTV NTSC", "SDTV NTSC"),
+    ("view.simulateOutput", "SDTV PAL", "SDTV PAL"),
+    ("view.simulateOutput", "Legacy Macintosh RGB (Gamma 1.8)", "ძველი Macintosh RGB (გამა 1.8)"),
+    ("view.simulateOutput", "Internet Standard RGB (sRGB)", "ინტერნეტის სტანდარტული RGB (sRGB)"),
+    ("view.simulateOutput", "UHDTV (Rec. 2020)", "UHDTV (Rec. 2020)"),
+    ("view.simulateOutput", "Display P3", "Display P3"),
+    ("view.simulateOutput", "Linear (1.0 Gamma)", "წრფივი (გამა 1.0)"),
+    ("view.customRgb", "My Custom RGB...", "ჩემი მორგებული RGB..."),
+    ("view.simulateOutput", "Custom...", "მორგებული..."),
+    ("view.rulers", "Show Rulers", "სახაზავების ჩვენება"),
+    ("", "Panel Background Color", "პანელის ფონის ფერი"),
+    ("view.panelBackground", "Black", "შავი"),
+    ("view.panelBackground", "Dark Gray", "მუქი ნაცრისფერი"),
+    ("view.panelBackground", "Medium Gray (Default)", "საშუალო ნაცრისფერი (ნაგულისხმევი)"),
+    ("view.panelBackground", "Light Gray", "ღია ნაცრისფერი"),
+    ("view.panelBackground", "White", "თეთრი"),
+    ("view.panelBackground", "Custom", "მორგებული"),
+    ("view.panelBackground", "Select Custom Background Color...", "მორგებული ფონის ფერის არჩევა..."),
+    ("view.guides", "Show Guides", "დამხმარე ხაზების ჩვენება"),
+    ("view.snapToGuides", "Snap to Guides", "დამხმარე ხაზებზე მიბმა"),
+    ("view.lockGuides", "Lock Guides", "დამხმარე ხაზების ჩაკეტვა"),
+    ("view.addGuide", "Add Guide...", "დამხმარე ხაზის დამატება..."),
+    ("view.addPercentGuide", "Add Percentage Guide...", "პროცენტული დამხმარე ხაზის დამატება..."),
+    ("view.convertGuides", "Convert Guides to Percentage", "დამხმარე ხაზების პროცენტულად გარდაქმნა"),
+    ("view.convertGuides", "Convert Guides to Pixels", "დამხმარე ხაზების პიქსელებად გარდაქმნა"),
+    ("view.clearGuides", "Clear Guides", "დამხმარე ხაზების გასუფთავება"),
+    ("view.importGuides", "Import Guides...", "დამხმარე ხაზების იმპორტი..."),
+    ("view.exportGuides", "Export Guides...", "დამხმარე ხაზების ექსპორტი..."),
+    ("view.grid", "Show Grid", "ბადის ჩვენება"),
+    ("view.snapToGrid", "Snap to Grid", "ბადეზე მიბმა"),
+    ("view.snapping", "Snapping", "მიბმა"),
+    ("view.options", "View Options...", "ხედის პარამეტრები..."),
+    ("view.layerControls", "Show Layer Controls", "შრის მართვის ელემენტების ჩვენება"),
+    ("", "Switch View Layout", "ხედების განლაგების გადართვა"),
+    ("view.layout", "1 View", "1 ხედი"),
+    ("view.layout", "2 Views", "2 ხედი"),
+    ("view.layout", "4 Views", "4 ხედი"),
+    ("view.shareViewOptions", "Share View Options", "ხედის პარამეტრების გაზიარება"),
+    ("", "Switch 3D View", "3D ხედის გადართვა"),
+    ("view.3d.activeCamera", "Active Camera", "აქტიური კამერა"),
+    ("view.3d.default", "Default", "ნაგულისხმევი"),
+    ("view.3d.front", "Front", "წინიდან"),
+    ("view.3d.left", "Left", "მარცხნიდან"),
+    ("view.3d.top", "Top", "ზემოდან"),
+    ("view.3d.back", "Back", "უკნიდან"),
+    ("view.3d.right", "Right", "მარჯვნიდან"),
+    ("view.3d.bottom", "Bottom", "ქვემოდან"),
+    ("view.3d.custom1", "Custom View 1", "მორგებული ხედი 1"),
+    ("view.3d.custom2", "Custom View 2", "მორგებული ხედი 2"),
+    ("view.3d.custom3", "Custom View 3", "მორგებული ხედი 3"),
+    ("", "Assign Shortcut to 3D View", "მალსახმობის მინიჭება 3D ხედისთვის"),
+    ("view.3d.last", "Switch to Last 3D View", "ბოლო 3D ხედზე გადართვა"),
+    ("view.lookAtSelected", "Look at Selected Layers", "მონიშნული შრეების დათვალიერება"),
+    ("view.lookAtAll", "Look at All Layers", "ყველა შრის დათვალიერება"),
+    ("time.set", "Go to Time...", "დროზე გადასვლა..."),
+    ("view.fullScreen", "Enter Full Screen", "სრულეკრანიან რეჟიმში გადასვლა"),
+    ("", "Window", "ფანჯარა"),
+    ("", "Workspace", "სამუშაო სივრცე"),
+    ("window.workspace", "Default", "ნაგულისხმევი"),
+    ("window.workspace", "Review", "განხილვა"),
+    ("window.workspace", "Learn", "სწავლა"),
+    ("window.workspace", "Small Screen", "პატარა ეკრანი"),
+    ("window.workspace", "Standard", "სტანდარტული"),
+    ("window.workspace", "All Panels", "ყველა პანელი"),
+    ("window.workspace", "Animation", "ანიმაცია"),
+    ("window.workspace", "Color", "ფერი"),
+    ("window.workspace", "Effects", "ეფექტები"),
+    ("window.workspace", "Essential Graphics", "ძირითადი გრაფიკა"),
+    ("window.workspace", "Minimal", "მინიმალური"),
+    ("window.workspace", "Motion Tracking", "მოძრაობის ტრეკინგი"),
+    ("window.workspace", "Paint", "ხატვა"),
+    ("window.workspace", "Text", "ტექსტი"),
+    ("window.workspace", "Undocked Panels", "მოხსნილი პანელები"),
+    ("window.resetWorkspace", "Reset to Saved Layout", "შენახულ განლაგებაზე დაბრუნება"),
+    ("window.saveWorkspace", "Save Changes to this Workspace", "ამ სამუშაო სივრცეში ცვლილებების შენახვა"),
+    ("window.saveWorkspaceAs", "Save as New Workspace...", "ახალ სამუშაო სივრცედ შენახვა..."),
+    ("window.editWorkspaces", "Edit Workspaces...", "სამუშაო სივრცეების რედაქტირება..."),
+    ("", "Assign Shortcut to Workspace", "მალსახმობის მინიჭება სამუშაო სივრცისთვის"),
+    ("window.panel", "Align", "სწორება"),
+    ("window.panel", "Audio", "აუდიო"),
+    ("window.panel", "Brushes", "ფუნჯები"),
+    ("window.panel", "Character", "სიმბოლო"),
+    ("window.panel", "Content-Aware Fill", "შიგთავსის გათვალისწინებით შევსება"),
+    ("window.panel", "Effects & Presets", "ეფექტები და პრესეტები"),
+    ("window.panel", "Essential Graphics", "ძირითადი გრაფიკა"),
+    ("window.panel", "Info", "ინფორმაცია"),
+    ("help.inAppTutorials", "Learn", "სწავლა"),
+    ("window.panel", "Video Scopes", "ვიდეოსკოპები"),
+    ("window.panel", "Mask Interpolation", "ნიღბის ინტერპოლაცია"),
+    ("window.panel", "Media Browser", "მედიის ბრაუზერი"),
+    ("window.panel", "Metadata", "მეტამონაცემები"),
+    ("window.panel", "Motion Sketch", "მოძრაობის ესკიზი"),
+    ("window.panel", "Paint", "ხატვა"),
+    ("window.panel", "Paragraph", "აბზაცი"),
+    ("window.panel", "Preview", "წინასწარი ნახვა"),
+    ("window.panel", "Progress", "პროგრესი"),
+    ("window.panel", "Properties", "თვისებები"),
+    ("window.panel", "Script Console", "სკრიპტის კონსოლი"),
+    ("window.panel", "Smoother", "დამგლუვებელი"),
+    ("window.panel", "Tools", "ხელსაწყოები"),
+    ("window.panel", "Tracker", "ტრეკერი"),
+    ("window.panel", "Wiggler", "რხევის გენერატორი"),
+    ("window.panel", "Composition", "კომპოზიცია"),
+    ("window.panel", "Flowchart", "ბლოკ-სქემა"),
+    ("window.panel", "Footage", "ვიდეომასალა"),
+    ("window.panel", "Layer", "შრე"),
+    ("window.panel", "Project", "პროექტი"),
+    ("window.panel", "Render Queue", "რენდერის რიგი"),
+    ("window.panel", "Timeline", "დროის ხაზი"),
+    ("window.panel", "Create Nulls From Paths", "ნულოვანი ობიექტების შექმნა ტრაექტორიებიდან"),
+    ("window.panel", "VR Comp Editor", "VR კომპოზიციის რედაქტორი"),
+    ("", "Help", "დახმარება"),
+    ("help.docs", "EffectCraft Help...", "EffectCraft-ის დახმარება..."),
+    ("help.docs", "Scripting Help...", "სკრიპტების დახმარება..."),
+    ("help.docs", "Expression Reference...", "ექსპრესიების ცნობარი..."),
+    ("help.docs", "Effect Reference...", "ეფექტების ცნობარი..."),
+    ("anim.browsePresets", "Animation Presets...", "ანიმაციის პრესეტები..."),
+    ("app.keyboardShortcuts", "Keyboard Shortcuts...", "კლავიატურის მალსახმობები..."),
+    ("help.inAppTutorials", "In-App Tutorials...", "აპის შიგნით გაკვეთილები..."),
+    ("help.onlineTutorials", "Online Tutorials...", "ონლაინ გაკვეთილები..."),
+    ("help.systemReport", "System Compatibility Report...", "სისტემის თავსებადობის ანგარიში..."),
+    ("help.enableLogging", "Enable Logging", "ჟურნალის ჩართვა"),
+    ("help.revealLogFile", "Reveal Logging File", "ჟურნალის ფაილის ჩვენება"),
+    ("help.discord", "Join the ArtCraft Discord...", "შემოუერთდით ArtCraft-ის Discord-ს..."),
+    ("help.reportIssue", "Provide Feedback...", "გამოხმაურების გაგზავნა..."),
+    ("help.website", "ArtCraft Website", "ArtCraft-ის ვებსაიტი"),
+    ("help.appPage", "EffectCraft Home Page", "EffectCraft-ის საწყისი გვერდი"),
+    ("help.github", "EffectCraft on GitHub", "EffectCraft GitHub-ზე"),
+    ("file.openDemoProject", "Open Demo Project", "სადემონსტრაციო პროექტის გახსნა"),
+];
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -6650,139 +8800,138 @@ mod tests {
     use std::collections::BTreeSet;
 
     #[test]
-    fn czech_translates_menus_without_changing_bindings_or_user_names() {
+    fn renamed_menu_translations_do_not_reintroduce_vendor_names() {
+        for code in CATALOG_CODES {
+            set_current(code);
+            for (id, source) in [("window.panel", "Video Scopes")] {
+                let rendered = command_label(id, source);
+                let label = rendered.to_lowercase();
+                for mark in ["lumetri", "mercury"] {
+                    assert!(!label.contains(mark), "{code}: {id} -> {rendered}");
+                }
+            }
+        }
+        set_current("en");
+    }
+
+    /// The four options at the foot of the header's workspace menu say what After Effects says,
+    /// read from its workspace button on 2026-10-31: reset, save over this one, save a copy, then
+    /// edit the list.
+    #[test]
+    fn the_workspace_menu_options_use_after_effects_words() {
+        set_current("ja");
+        for (id, en, ja) in [
+            ("window.resetWorkspace", "Reset to Saved Layout", "保存したレイアウトにリセット"),
+            ("window.saveWorkspace", "Save Changes to this Workspace", "このワークスペースへの変更を保存"),
+            ("window.saveWorkspaceAs", "Save as New Workspace...", "新規ワークスペースとして保存..."),
+            ("window.editWorkspaces", "Edit Workspaces...", "ワークスペースを編集..."),
+        ] {
+            assert_eq!(command_label(id, en), ja, "{id}");
+        }
+    }
+
+    /// Labels drawn outside the menu bar take the menu bar's row for their command (with `…` for
+    /// `...`), else the panel catalog's row, else stay as they are.
+    #[test]
+    fn command_label_reads_the_menu_row_then_the_panel_row() {
+        set_current("zh-hans");
+        assert_eq!(command_label("window.panel", "Project"), lookup(SIMPLIFIED_CHINESE, "window.panel", "Project"));
+        let (command, en, translated) = SIMPLIFIED_CHINESE.iter().find(|(c, en, _)| !c.is_empty() && en.ends_with("...")).expect("a menu row ending in ...");
+        assert_eq!(command_label(command, &format!("{}…", en.trim_end_matches("..."))), *translated);
+        assert_eq!(command_label("no.such.command", "Cancel"), tr("Cancel"));
+        assert_eq!(command_label("window.panel", "Comp 1"), "Comp 1");
+        set_current("en");
+        assert_eq!(command_label("window.panel", "Project"), "Project");
+    }
+
+    #[test]
+    fn settings_page_titles_read_the_menu_row() {
+        set_current("zh-hans");
+        let menu_row = lookup(SIMPLIFIED_CHINESE, "app.settings", "Type...");
+        assert_eq!(settings_page_title("Type"), menu_row.trim_end_matches("..."));
+        assert_ne!(settings_page_title("Type"), tr("Type"), "the page is about text, the panel row is the kind");
+        assert_eq!(settings_page_title("Roto Brush"), tr("Roto Brush"));
+        set_current("en");
+        assert_eq!(settings_page_title("Type"), "Type");
+    }
+
+    #[test]
+    fn match_system_takes_the_first_browser_language_with_a_catalog() {
+        let tags = |t: &[&str]| t.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let any = |_: &str| true;
+        assert_eq!(super::first_supported(None, &tags(&["cs-CZ", "cs", "en"]), any), "cs");
+        assert_eq!(super::first_supported(None, &tags(&["nl-NL", "cs"]), any), "cs");
+        assert_eq!(super::first_supported(None, &tags(&["en-US", "cs"]), any), "en");
+        assert_eq!(super::first_supported(None, &tags(&["nl-NL"]), any), "en");
+        assert_eq!(super::first_supported(None, &tags(&[]), any), "en");
+        assert_eq!(super::first_supported(Some("uk"), &tags(&["cs"]), any), "uk");
+        assert_eq!(super::first_supported(Some("nl"), &tags(&["cs"]), any), "cs");
+    }
+
+    /// The web build installs no CJK or Georgian font: Match System passes over those browser
+    /// languages, while `?lang=` still selects them.
+    #[test]
+    fn web_match_system_skips_languages_without_a_font() {
+        let tags = |t: &[&str]| t.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        assert_eq!(super::first_supported(None, &tags(&["ja-JP", "zh-CN", "zh-TW", "ka-GE", "cs"]), super::web_draws), "cs");
+        assert_eq!(super::first_supported(None, &tags(&["ka"]), super::web_draws), "en");
+        assert_eq!(super::first_supported(Some("ka"), &tags(&["cs"]), super::web_draws), "ka");
+        assert_eq!(super::first_supported(Some("ja"), &tags(&[]), super::web_draws), "ja");
+    }
+
+    #[test]
+    fn swedish_translates_menus_without_changing_bindings_or_user_names() {
         let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
         app.session.execute("prefs.set", json!({"key": "general.language", "value": "en"})).unwrap();
         app.session.prefs.push_recent("File.ecproj");
         let en = crate::native_menu::build(&app);
         let state = crate::native_menu::state_key(&app);
-        app.session.execute("prefs.set", json!({"key": "general.language", "value": "cs"})).unwrap();
-        let cs = crate::native_menu::build(&app);
-        assert_eq!(language(&app), "cs");
-        assert!(czech(&app));
-        assert_eq!(code("cs"), "cs");
+        app.session.execute("prefs.set", json!({"key": "general.language", "value": "sv"})).unwrap();
+        let sv = crate::native_menu::build(&app);
+        assert_eq!(language(&app), "sv");
+        assert!(swedish(&app));
+        assert!(!czech(&app));
+        assert_eq!(code("sv"), "sv");
         assert_ne!(state, crate::native_menu::state_key(&app));
         let bindings = |menu: &crate::native_menu::NativeMenu| {
             menu.items().into_iter().map(|i| (i.id.clone(), i.command.clone(), i.params.clone(), i.shortcut.clone(), i.enabled, i.checked)).collect::<Vec<_>>()
         };
-        assert_eq!(bindings(&en), bindings(&cs));
-        assert!(cs.items().iter().any(|i| i.command == "comp.new" && i.label == "Nová kompozice..."));
-        assert!(cs.items().iter().any(|i| i.command == "layer.newText" && i.label == "Text"));
-        assert!(cs.items().iter().any(|i| i.command == "keys.easyEase" && i.label == "Snadné zpomalení"));
-        assert!(cs.items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
-        for (source, translated) in [
-            ("File", "Soubor"),
-            ("Edit", "Úpravy"),
-            ("Composition", "Kompozice"),
-            ("Layer", "Vrstva"),
-            ("Effect", "Efekt"),
-            ("Animation", "Animace"),
-            ("View", "Zobrazení"),
-            ("Window", "Okno"),
-            ("Help", "Nápověda"),
-        ] {
+        assert_eq!(bindings(&en), bindings(&sv));
+        assert!(sv.items().iter().any(|i| i.command == "comp.new" && i.label == "Ny komposition..."));
+        assert!(sv.items().iter().any(|i| i.command == "keys.easyEase" && i.label == "Mjukt in och ut"));
+        assert!(sv.items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
+        for (source, translated) in
+            [("File", "Arkiv"), ("Edit", "Redigera"), ("Composition", "Komposition"), ("Layer", "Lager"), ("Window", "Fönster"), ("Help", "Hjälp")]
+        {
             assert_eq!(label(&app, "", source), translated);
         }
         assert_eq!(label(&app, "unknown.command", "Text"), "Text");
         let panel =
             MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel": "layer"}), shortcut: None, alt_shortcuts: vec![] };
-        assert_eq!(entry(&app, &panel, "Layer: File Čeština".into()), "Vrstva: File Čeština");
+        assert_eq!(entry(&app, &panel, "Layer: File Åsa".into()), "Lager: File Åsa");
         assert_eq!(
-            submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “File Čeština” Workspace".into()),
-            "Přiřadit zkratku pracovnímu prostoru „File Čeština“"
+            submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “File Åsa” Workspace".into()),
+            "Tilldela kortkommando till arbetslayouten ”File Åsa”"
         );
-        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "Přiřadit zkratku 3D zobrazení „Top“");
-        assert_eq!(submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to Workspace".into()), "Přiřadit zkratku pracovnímu prostoru");
+        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "Tilldela kortkommando till 3D-vyn ”Top”");
+        assert_eq!(submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to Workspace".into()), "Tilldela kortkommando till arbetslayout");
+        let undo = MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] };
+        assert_eq!(entry(&app, &undo, "Can't Undo".into()), "Det går inte att ångra");
+        app.session.history.undo.push(("File Åsa".into(), app.session.project.clone()));
+        assert_eq!(entry(&app, &undo, "Undo File Åsa".into()), "Ångra File Åsa");
+        for command in ["file.revealInFinder", "layer.revealInFinder"] {
+            for (source, translated) in
+                [("Reveal in Finder", "Visa i Finder"), ("Reveal in Explorer", "Visa i Utforskaren"), ("Reveal in File Manager", "Visa i filhanteraren")]
+            {
+                assert_eq!(label(&app, command, source), translated);
+                assert_eq!(label(&app, "file.openRecent", source), source);
+            }
+        }
+        app.session.history.undo.clear();
         app.session.execute("prefs.set", json!({"key": "general.language", "value": "en"})).unwrap();
         assert_eq!(crate::native_menu::build(&app), en);
     }
 
-    #[test]
-    fn czech_undo_redo_keeps_history_labels_verbatim() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key": "general.language", "value": "cs"})).unwrap();
-        let undo = MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] };
-        let redo = MenuEntry { label: "Redo".into(), command: "edit.redo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] };
-        assert_eq!(entry(&app, &undo, "Can't Undo".into()), "Není co vrátit");
-        assert_eq!(entry(&app, &redo, "Can't Redo".into()), "Není co zopakovat");
-        app.session.history.undo.push(("File Čeština".into(), app.session.project.clone()));
-        app.session.history.redo.push(("Text Čeština".into(), app.session.project.clone()));
-        assert_eq!(entry(&app, &undo, "Undo File Čeština".into()), "Zpět File Čeština");
-        assert_eq!(entry(&app, &redo, "Redo Text Čeština".into()), "Znovu Text Čeština");
-    }
-
-    #[test]
-    fn german_reveal_labels_follow_the_platform_file_manager() {
-        // As `czech_…` and `ukrainian_…` do. Asserted through `label`, not `entry`: `entry`
-        // returns the English for German, Russian and French, which have catalogues but are
-        // not wired into the menus (see the undo/redo match in `entry` and `supported`).
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key": "general.language", "value": "de"})).unwrap();
-        for command in ["file.revealInFinder", "layer.revealInFinder"] {
-            for (source, translated) in [
-                ("Reveal in Finder", "Im Finder anzeigen"),
-                ("Reveal in Explorer", "Im Explorer anzeigen"),
-                ("Reveal in File Manager", "Im Dateimanager anzeigen"),
-            ] {
-                assert_eq!(label(&app, command, source), translated, "{command} / {source}");
-                // Another command keeps a label that merely looks like one of these.
-                assert_eq!(label(&app, "file.openRecent", source), source);
-            }
-            assert_eq!(label(&app, command, "My file.mp4"), "My file.mp4", "a user's filename is never looked up");
-        }
-    }
-
-    #[test]
-    fn german_menu_labels_name_what_their_command_does() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key": "general.language", "value": "de"})).unwrap();
-        // "Ebenenreihenfolge umkehren" reads as reversing the stacking order, not time, and
-        // "Formate" are formats, not layer styles (#1443).
-        assert_eq!(label(&app, "layer.timeReverse", "Time-Reverse Layer"), "Ebene zeitlich umkehren");
-        assert_eq!(label(&app, "keys.timeReverse", "Time-Reverse Keyframes"), "Keyframes zeitlich umkehren");
-        assert_eq!(label(&app, "layer.style.convertToEditable", "Convert to Editable Styles"), "In bearbeitbare Stile umwandeln");
-    }
-
-    #[test]
-    fn german_uses_one_word_per_term() {
-        let german: Vec<&str> = GERMAN.iter().map(|(_, _, de)| *de).collect();
-        let with = |needle: &str| german.iter().filter(|de| de.contains(needle)).copied().collect::<Vec<_>>();
-        // "Expression" is "Ausdruck", not the English word.
-        assert!(with("Expression").is_empty(), "{:?}", with("Expression"));
-        // "Track" as a verb is "verfolgen", not "tracken".
-        assert!(with("tracken").is_empty(), "{:?}", with("tracken"));
-        // "Reveal <somewhere>" is "anzeigen". ("einblenden" stays right for "Show All",
-        // "Fade from Blur" and the like, so only the Reveal entries are checked.)
-        let reveal: Vec<&str> =
-            GERMAN.iter().filter(|(_, en, _)| en.starts_with("Reveal")).map(|(_, _, de)| *de).filter(|de| !de.to_lowercase().contains("anzeigen")).collect();
-        assert!(reveal.is_empty(), "{reveal:?}");
-        // One spelling of "to the front".
-        let vorn: Vec<&str> = german.iter().filter(|de| de.ends_with("nach vorn")).copied().collect();
-        assert!(vorn.is_empty(), "{vorn:?}");
-        // The terms those entries joined are still the majority ones.
-        assert!(with("verfolgen").len() >= 4, "{:?}", with("verfolgen"));
-        assert!(with("anzeigen").len() >= 12, "{}", with("anzeigen").len());
-    }
-
-    #[test]
-    fn czech_reveal_labels_follow_the_platform_file_manager() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key": "general.language", "value": "cs"})).unwrap();
-        for command in ["file.revealInFinder", "layer.revealInFinder"] {
-            for (source, translated) in [
-                ("Reveal in Finder", "Zobrazit ve Finderu"),
-                ("Reveal in Explorer", "Zobrazit v Průzkumníku"),
-                ("Reveal in File Manager", "Zobrazit ve správci souborů"),
-            ] {
-                let e = MenuEntry { label: source.into(), command: command.into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] };
-                assert_eq!(label(&app, command, source), translated);
-                assert_eq!(entry(&app, &e, source.into()), translated);
-                assert_eq!(label(&app, "file.openRecent", source), source);
-            }
-            assert_eq!(label(&app, command, "My file.mp4"), "My file.mp4");
-        }
-    }
-
     fn keys(nodes: &[MenuNode], out: &mut BTreeSet<(String, String)>) {
         for node in nodes {
             match node {
@@ -6798,63 +8947,82 @@ mod tests {
         }
     }
 
+    /// The fixed menu entries `code` has no row for. `@effects` is the generated plug-in catalog,
+    /// whose effect names come from the effect catalog instead.
+    fn missing_menu_entries(code: &str) -> Vec<String> {
+        let catalog = menu_catalog(code).unwrap_or_default();
+        // A label the tree repeats (one command in two menus) counts once.
+        let mut missing = Vec::new();
+        let mut seen = BTreeSet::new();
+        for line in TREE.lines() {
+            let line = line.trim().trim_start_matches("[mac] ").trim_start_matches("[!mac] ");
+            if line.is_empty() || line == "---" || line.starts_with('@') {
+                continue;
+            }
+            let mut parts = line.split(" | ");
+            let Some(en) = parts.next() else { continue };
+            let command = parts.next().and_then(|p| p.split_whitespace().next()).unwrap_or("");
+            if !catalog.iter().any(|(id, source, _)| *id == command && *source == en) && seen.insert((command, en)) {
+                missing.push(en.to_string());
+            }
+        }
+        missing
+    }
+
+    /// Lists, per language, the interface strings with no translation, which show in English. It
+    /// always passes: a missing translation never blocks a change. `cargo xtask ci` runs it.
     #[test]
-    fn every_translation_key_exists_in_the_actual_menu_tree() {
+    fn missing_translations_report() {
+        const SHOWN: usize = 12;
+        println!("Missing translations (shown in English):");
+        let mut total = 0;
+        for code in CATALOG_CODES {
+            let catalogs = [("menus", missing_menu_entries(code)), ("panels", ui::missing(code)), ("effects", effects::missing(code))];
+            let count: usize = catalogs.iter().map(|(_, missing)| missing.len()).sum();
+            total += count;
+            println!("{code}: {count}");
+            for (catalog, missing) in &catalogs {
+                if missing.is_empty() {
+                    continue;
+                }
+                let shown: Vec<&String> = missing.iter().take(SHOWN).collect();
+                let more = missing.len().saturating_sub(SHOWN);
+                let more = if more > 0 { format!(" … and {more} more") } else { String::new() };
+                println!("  {catalog} ({}): {shown:?}{more}", missing.len());
+            }
+        }
+        println!("total: {total}");
+    }
+
+    /// Prints the translated-row counts per language, the numbers `docs/localization-parity.md`
+    /// quotes. `cargo xtask i18n-report` runs it with `--nocapture`.
+    #[test]
+    fn catalog_row_counts_report() {
+        println!("Localization catalog rows:");
+        for code in CATALOG_CODES {
+            let menus = menu_catalog(code).map_or(0, |catalog| catalog.len());
+            let panels = ui::translated_rows(code);
+            let effect_names = effects::translated_rows(code);
+            println!("{code}: menus {menus}, panels {panels}, effect names {effect_names}, total {}", menus + panels + effect_names);
+        }
+    }
+
+    #[test]
+    fn menu_catalogs_have_no_stale_or_duplicate_rows() {
         let mut actual = BTreeSet::new();
         for mac in [false, true] {
             keys(&parse(TREE, mac).unwrap(), &mut actual);
         }
-        let mut japanese_keys = BTreeSet::new();
-        let mut chinese_keys = BTreeSet::new();
-        let mut traditional_keys = BTreeSet::new();
-        let mut ukrainian_keys = BTreeSet::new();
-        let mut spanish_keys = BTreeSet::new();
-        let mut portuguese_keys = BTreeSet::new();
-        let mut russian_keys = BTreeSet::new();
-        let mut french_keys = BTreeSet::new();
-        let mut german_keys = BTreeSet::new();
-        let mut czech_keys = BTreeSet::new();
-        for (catalog, unique) in [
-            (JAPANESE, &mut japanese_keys),
-            (SIMPLIFIED_CHINESE, &mut chinese_keys),
-            (TRADITIONAL_CHINESE, &mut traditional_keys),
-            (UKRAINIAN, &mut ukrainian_keys),
-            (SPANISH, &mut spanish_keys),
-            (PORTUGUESE, &mut portuguese_keys),
-            (RUSSIAN, &mut russian_keys),
-            (FRENCH, &mut french_keys),
-            (GERMAN, &mut german_keys),
-            (CZECH, &mut czech_keys),
-        ] {
+        for code in CATALOG_CODES {
+            let catalog = menu_catalog(code).unwrap();
+            let mut unique = BTreeSet::new();
             for (command, en, translated) in catalog {
                 let key = (command.to_string(), en.to_string());
-                assert!(actual.contains(&key), "stale translation: {key:?}");
-                assert!(unique.insert(key), "duplicate translation: {command} / {en}");
-                assert!(!translated.is_empty());
-            }
-            // All fixed TREE entries are covered; @effects is a generated plug-in catalog,
-            // whose product/effect names are intentionally left as registered.
-            for line in TREE.lines() {
-                let line = line.trim().trim_start_matches("[mac] ").trim_start_matches("[!mac] ");
-                if line.is_empty() || line == "---" || line.starts_with('@') {
-                    continue;
-                }
-                let mut parts = line.split(" | ");
-                let en = parts.next().unwrap();
-                let command = parts.next().and_then(|p| p.split_whitespace().next()).unwrap_or("");
-                assert!(unique.contains(&(command.into(), en.into())), "untranslated fixed entry: {line}");
+                assert!(actual.contains(&key), "{code}: stale translation: {key:?}");
+                assert!(unique.insert(key), "{code}: duplicate translation: {command} / {en}");
+                assert!(!translated.is_empty(), "{code}: empty translation: {command} / {en}");
             }
         }
-        // Every translated language covers exactly the same entries.
-        assert_eq!(japanese_keys, chinese_keys, "the languages must translate the same entries");
-        assert_eq!(chinese_keys, traditional_keys, "the languages must translate the same entries");
-        assert_eq!(traditional_keys, spanish_keys, "the languages must translate the same entries");
-        assert_eq!(spanish_keys, portuguese_keys, "the languages must translate the same entries");
-        assert_eq!(japanese_keys, ukrainian_keys, "the languages must translate the same entries");
-        assert_eq!(ukrainian_keys, russian_keys, "the languages must translate the same entries");
-        assert_eq!(russian_keys, french_keys, "the languages must translate the same entries");
-        assert_eq!(french_keys, german_keys, "the languages must translate the same entries");
-        assert_eq!(japanese_keys, czech_keys, "the languages must translate the same entries");
     }
 
     /// Exercise each engine spelling on every host: a macOS-only run must still catch a
@@ -6895,23 +9063,68 @@ mod tests {
             menu.items().into_iter().map(|i| (i.id.clone(), i.command.clone(), i.params.clone(), i.shortcut.clone(), i.enabled, i.checked)).collect::<Vec<_>>()
         };
         assert_eq!(bindings(&en), bindings(&ja));
+        assert!(ja.items().iter().any(|i| i.command == "comp.new" && i.label == label(&app, "comp.new", "New Composition...")));
         assert_eq!(label(&app, "unknown.command", "Text"), "Text");
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel":"layer"}), shortcut: None, alt_shortcuts: vec![] },
-                "Layer: File".into()
-            ),
-            "レイヤー: File"
-        );
-        assert!(ja.items().iter().any(|i| i.command == "comp.new" && i.label == "新規コンポジション..."));
-        assert!(ja.items().iter().any(|i| i.command == "layer.newText" && i.label == "テキスト"));
-        assert!(ja.items().iter().any(|i| i.command == "keys.easyEase" && i.label == "イージーイーズ"));
         app.session.prefs.push_recent("/tmp/File.ecproj");
         assert!(crate::native_menu::build(&app).items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
         app.session.execute("prefs.set", json!({"key":"general.language", "value":"en"})).unwrap();
         assert_eq!(label(&app, "", "Composition"), "Composition");
     }
+    /// Every catalog names the platform's file manager: the engine substitutes it for "Finder"
+    /// before the label reaches the catalog, so the macOS row alone leaves Windows and Linux in
+    /// English (#1450).
+    #[test]
+    fn the_reveal_command_names_the_file_manager_in_every_catalog() {
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        for (code, explorer, manager) in REVEAL_FINDER {
+            app.session.execute("prefs.set", json!({"key":"general.language", "value": code})).unwrap();
+            assert_eq!(label(&app, "file.revealInFinder", "Reveal in Explorer"), *explorer, "{code}");
+            assert_eq!(label(&app, "layer.revealInFinder", "Reveal in File Manager"), *manager, "{code}");
+        }
+        // English keeps the source, and the macOS wording still comes from the catalog.
+        app.session.execute("prefs.set", json!({"key":"general.language", "value": "en"})).unwrap();
+        assert_eq!(label(&app, "file.revealInFinder", "Reveal in Explorer"), "Reveal in Explorer");
+        app.session.execute("prefs.set", json!({"key":"general.language", "value": "ja"})).unwrap();
+        assert_eq!(label(&app, "file.revealInFinder", "Reveal in Finder"), "Finderで表示");
+    }
+
+    /// Match System in the browser also picks the Russian, French and German catalogs, in the
+    /// order of the browser's preferences (#1700).
+    #[test]
+    fn browser_preferences_choose_russian_french_and_german() {
+        let tags = |t: &[&str]| t.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        for (locales, expected) in
+            [(vec!["de-DE", "es-ES"], "de"), (vec!["xx-XX", "fr-CA"], "fr"), (vec!["ru-RU", "cs"], "ru"), (vec!["en-US", "de-DE"], "en"), (vec!["xx-XX"], "en")]
+        {
+            assert_eq!(super::first_supported(None, &tags(&locales), super::web_draws), expected, "{locales:?}");
+        }
+    }
+
+    /// The Edit menu's Undo and Redo name the history's action in the interface language, also in
+    /// the languages added with #1700.
+    #[test]
+    fn undo_and_redo_are_localized_for_russian_french_and_german() {
+        for (language, undo, no_undo, redo, no_redo) in [
+            ("ru", "Отменить:", "Нечего отменять", "Повторить:", "Нечего повторять"),
+            ("fr", "Annuler", "Impossible d'annuler", "Rétablir", "Impossible de rétablir"),
+            ("de", "Rückgängig", "Rückgängig nicht möglich", "Wiederholen", "Wiederholen nicht möglich"),
+        ] {
+            let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+            app.session.execute("prefs.set", json!({"key": "general.language", "value": language})).unwrap();
+            let entry_of = |app: &EffectcraftApp, command: &str| {
+                let (_, e) = effectcraft_engine::menus::entries().into_iter().find(|(_, e)| e.command == command).unwrap();
+                entry(app, e, e.label.clone())
+            };
+            assert_eq!(entry_of(&app, "edit.undo"), no_undo, "{language}");
+            assert_eq!(entry_of(&app, "edit.redo"), no_redo, "{language}");
+            app.session.execute("comp.new", json!({"name": "A", "duration": 1})).unwrap();
+            let action = app.session.history.undo.last().map(|u| u.0.clone()).unwrap();
+            assert_eq!(entry_of(&app, "edit.undo"), format!("{undo} {action}"), "{language}");
+            app.session.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(entry_of(&app, "edit.redo"), format!("{redo} {action}"), "{language}");
+        }
+    }
+
     #[test]
     fn match_system_uses_the_system_language_where_there_is_a_catalog() {
         for (locale, language) in [
@@ -6941,9 +9154,30 @@ mod tests {
             (Some("cs-CZ"), "cs"),
             (Some("cs_CZ.UTF-8"), "cs"),
             (Some("CS_cz.UTF-8"), "cs"),
+            (Some("pl"), "pl"),
+            (Some("pl-PL"), "pl"),
+            (Some("pl_PL.UTF-8"), "pl"),
+            (Some("PL_pl.UTF-8"), "pl"),
+            (Some("ka"), "ka"),
+            (Some("ka-GE"), "ka"),
+            (Some("ka_GE.UTF-8"), "ka"),
+            (Some("ru"), "ru"),
+            (Some("ru-RU"), "ru"),
+            (Some("ru-SK"), "ru"),
+            (Some("ru_RU.UTF-8"), "ru"),
+            (Some("de"), "de"),
+            (Some("de-DE"), "de"),
+            (Some("de_AT.UTF-8"), "de"),
+            (Some("fr"), "fr"),
+            (Some("fr-FR"), "fr"),
+            (Some("fr_CA.UTF-8"), "fr"),
+            (Some("sv"), "sv"),
+            (Some("sv-SE"), "sv"),
+            (Some("sv-FI"), "sv"),
+            (Some("sv_SE.UTF-8"), "sv"),
             (Some("en-US"), "en"),
             (Some("jv-ID"), "en"),
-            (Some("de-DE"), "en"),
+            (Some("nl-NL"), "en"),
             (None, "en"),
         ] {
             assert_eq!(supported(locale), language, "{locale:?}");
@@ -6955,6 +9189,8 @@ mod tests {
         assert_eq!(traditional(&app), system_language() == "zh-hant");
         assert_eq!(spanish(&app), system_language() == "es");
         assert_eq!(czech(&app), system_language() == "cs");
+        assert_eq!(polish(&app), system_language() == "pl");
+        assert_eq!(swedish(&app), system_language() == "sv");
         app.session.execute("prefs.set", json!({"key":"general.language", "value":"ja"})).unwrap();
         assert!(japanese(&app));
         app.session.execute("prefs.set", json!({"key":"general.language", "value":"zh-hans"})).unwrap();
@@ -6972,11 +9208,43 @@ mod tests {
         assert!(!japanese(&app));
     }
 
+    /// File ▸ Import ▸ After Effects Project… has its row in every menu catalog.
+    #[test]
+    fn the_aep_import_and_export_entries_are_in_every_menu_catalog() {
+        for (code, catalog) in [
+            ("zh-hans", SIMPLIFIED_CHINESE),
+            ("zh-hant", TRADITIONAL_CHINESE),
+            ("ja", JAPANESE),
+            ("uk", UKRAINIAN),
+            ("es", SPANISH),
+            ("pt-br", PORTUGUESE),
+            ("ru", RUSSIAN),
+            ("fr", FRENCH),
+            ("de", GERMAN),
+            ("cs", CZECH),
+            ("pl", POLISH),
+            ("ka", GEORGIAN),
+            ("sv", SWEDISH),
+        ] {
+            for id in ["file.importAep", "file.exportAep"] {
+                assert!(catalog.iter().any(|(command, _, _)| *command == id), "{code} has no {id} row");
+            }
+        }
+    }
+
     #[test]
     fn every_translated_entry_keeps_the_english_shape() {
-        for (code, catalog) in
-            [("zh-hans", SIMPLIFIED_CHINESE), ("zh-hant", TRADITIONAL_CHINESE), ("uk", UKRAINIAN), ("es", SPANISH), ("pt-br", PORTUGUESE), ("cs", CZECH)]
-        {
+        for (code, catalog) in [
+            ("zh-hans", SIMPLIFIED_CHINESE),
+            ("zh-hant", TRADITIONAL_CHINESE),
+            ("uk", UKRAINIAN),
+            ("es", SPANISH),
+            ("pt-br", PORTUGUESE),
+            ("cs", CZECH),
+            ("pl", POLISH),
+            ("ka", GEORGIAN),
+            ("sv", SWEDISH),
+        ] {
             for (command, en, translated) in catalog {
                 assert_eq!(en.contains("..."), translated.contains("..."), "{code} {command} / {en}: {translated}");
                 let brackets = |s: &str| s.chars().filter(|c| *c == '(' || *c == ')').count();
@@ -6986,143 +9254,33 @@ mod tests {
         }
     }
 
+    /// The dock's tab titles are `PanelKind::title()`; the panels the Window menu lists are drawn in
+    /// the interface language through their `(window.panel, title)` rows. `History` and `ScriptUI
+    /// Panel` are in no menu and keep their English names, which is what this pins.
     #[test]
-    fn zh_hans_translates_labels_computed_titles_and_keeps_names_verbatim() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"zh-hans"})).unwrap();
-        assert_eq!(language(&app), "zh-hans");
-        assert!(simplified(&app));
-        assert!(!traditional(&app));
-        assert!(!japanese(&app));
-        // Fixed menu rows come from the catalog.
-        assert_eq!(label(&app, "", "Composition"), "合成");
-        assert_eq!(label(&app, "", "Effect"), "效果");
-        assert_eq!(label(&app, "comp.new", "New Composition..."), "新建合成...");
-        assert_eq!(label(&app, "layer.newText", "Text"), "文本");
-        // Untranslated keys and dynamic labels stay verbatim.
-        assert_eq!(label(&app, "unknown.command", "Text"), "Text");
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] },
-                "Undo Comp1".into()
-            ),
-            "无可撤销的操作"
-        );
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel":"layer"}), shortcut: None, alt_shortcuts: vec![] },
-                "Layer: File".into()
-            ),
-            "图层: File"
-        );
-        // The submenu titles that name the current workspace / view.
-        assert_eq!(submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “Default” Workspace".into()), "为工作区“Default”指定快捷键");
-        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "为 3D 视图“Top”指定快捷键");
-        // The menu tree carries the same commands and shortcuts with the Chinese labels.
-        let zh = crate::native_menu::build(&app);
-        assert!(zh.items().iter().any(|i| i.command == "comp.new" && i.label == "新建合成..."));
-        assert!(zh.items().iter().any(|i| i.command == "layer.newText" && i.label == "文本"));
-        assert!(zh.items().iter().any(|i| i.command == "keys.easyEase" && i.label == "缓动"));
-        // A dynamic filename is never translated.
-        app.session.prefs.push_recent("/tmp/File.ecproj");
-        assert!(crate::native_menu::build(&app).items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
-    }
-
-    #[test]
-    fn zh_hant_translates_labels_computed_titles_and_keeps_names_verbatim() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"zh-hant"})).unwrap();
-        assert_eq!(language(&app), "zh-hant");
-        assert!(traditional(&app));
-        assert!(!simplified(&app));
-        assert!(!japanese(&app));
-        // Fixed menu rows come from the catalog.
-        assert_eq!(label(&app, "", "Composition"), "合成");
-        assert_eq!(label(&app, "", "Effect"), "效果");
-        assert_eq!(label(&app, "comp.new", "New Composition..."), "新增合成...");
-        assert_eq!(label(&app, "layer.newText", "Text"), "文字");
-        // Untranslated keys and dynamic labels stay verbatim.
-        assert_eq!(label(&app, "unknown.command", "Text"), "Text");
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] },
-                "Undo Comp1".into()
-            ),
-            "沒有可復原的操作"
-        );
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel":"layer"}), shortcut: None, alt_shortcuts: vec![] },
-                "Layer: File".into()
-            ),
-            "圖層: File"
-        );
-        // The submenu titles that name the current workspace / view.
-        assert_eq!(submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “Default” Workspace".into()), "為工作區“Default”指定快速鍵");
-        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "為 3D 檢視“Top”指定快速鍵");
-        // The menu tree carries the same commands and shortcuts with the Traditional labels.
-        let zh = crate::native_menu::build(&app);
-        assert!(zh.items().iter().any(|i| i.command == "comp.new" && i.label == "新增合成..."));
-        assert!(zh.items().iter().any(|i| i.command == "layer.newText" && i.label == "文字"));
-        assert!(zh.items().iter().any(|i| i.command == "keys.easyEase" && i.label == "緩動"));
-        // A dynamic filename is never translated.
-        app.session.prefs.push_recent("/tmp/File.ecproj");
-        assert!(crate::native_menu::build(&app).items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
-    }
-
-    #[test]
-    fn ukrainian_translates_menus_without_changing_bindings_or_user_names() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"en"})).unwrap();
-        app.session.prefs.push_recent("/tmp/File.ecproj");
-        let en = crate::native_menu::build(&app);
-        let state = crate::native_menu::state_key(&app);
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"uk"})).unwrap();
-        let uk = crate::native_menu::build(&app);
-        assert_eq!(language(&app), "uk");
-        assert!(ukrainian(&app));
-        assert_ne!(state, crate::native_menu::state_key(&app));
-        let bindings = |menu: &crate::native_menu::NativeMenu| {
-            menu.items().into_iter().map(|i| (i.id.clone(), i.command.clone(), i.params.clone(), i.shortcut.clone(), i.enabled, i.checked)).collect::<Vec<_>>()
-        };
-        assert_eq!(bindings(&en), bindings(&uk));
-        assert!(uk.items().iter().any(|i| i.command == "comp.new" && i.label == "Нова композиція..."));
-        assert!(uk.items().iter().any(|i| i.command == "layer.newText" && i.label == "Текст"));
-        assert!(uk.items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
-        assert_eq!(label(&app, "", "File"), "Файл");
-        assert_eq!(label(&app, "", "Light"), "Світло");
-        assert_eq!(label(&app, "view.panelBackground", "Black"), "Чорний");
-        assert_eq!(label(&app, "layer.addTextAnimator", "Tracking"), "Міжлітерний інтервал");
-        assert_eq!(label(&app, "edit.purgeUndo", "Undo"), "Історія скасувань");
-        assert_eq!(label(&app, "unknown.command", "Text"), "Text");
-        let panel =
-            MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel":"layer"}), shortcut: None, alt_shortcuts: vec![] };
-        assert_eq!(entry(&app, &panel, "Layer: File".into()), "Шар: File");
-        assert_eq!(
-            submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “File Україна” Workspace".into()),
-            "Призначити скорочення для робочого простору «File Україна»"
-        );
-        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "Призначити скорочення для вигляду 3D «Top»");
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"en"})).unwrap();
-        assert_eq!(crate::native_menu::build(&app), en);
-    }
-
-    #[test]
-    fn ukrainian_undo_redo_keeps_history_labels_verbatim() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"uk"})).unwrap();
-        let undo = MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] };
-        let redo = MenuEntry { label: "Redo".into(), command: "edit.redo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] };
-        assert_eq!(entry(&app, &undo, "Can't Undo".into()), "Немає дій для скасування");
-        assert_eq!(entry(&app, &redo, "Can't Redo".into()), "Немає дій для повторення");
-        app.session.history.undo.push(("File Україна".into(), app.session.project.clone()));
-        app.session.history.redo.push(("Text Україна".into(), app.session.project.clone()));
-        assert_eq!(entry(&app, &undo, "Undo File Україна".into()), "Скасувати File Україна");
-        assert_eq!(entry(&app, &redo, "Redo Text Україна".into()), "Повторити Text Україна");
+    fn the_dock_draws_every_panel_it_can_in_the_interface_language() {
+        use crate::dock::PanelKind;
+        const WITHOUT_A_ROW: &[&str] = &["History", "ScriptUI Panel"];
+        for (name, catalog, code) in [("ja", JAPANESE, "ja"), ("zh-hans", SIMPLIFIED_CHINESE, "zh-hans"), ("zh-hant", TRADITIONAL_CHINESE, "zh-hant")] {
+            // The dock asks both catalogs, so a title may be named by either.
+            ui::set_current(code);
+            for p in PanelKind::ALL {
+                let title = p.title();
+                let in_menu = catalog.iter().any(|(c, en, _)| *c == "window.panel" && *en == title);
+                let in_panel = ui::tr(title) != title;
+                assert_eq!(
+                    in_menu || in_panel,
+                    !WITHOUT_A_ROW.contains(&title),
+                    "{name}: {title} is {}named by a catalog and {}in the exception list",
+                    if in_menu || in_panel { "" } else { "not " },
+                    if WITHOUT_A_ROW.contains(&title) { "" } else { "not " }
+                );
+            }
+        }
+        ui::set_current("en");
+        // The dock asks the catalog rather than drawing the English name.
+        let dock_ui = include_str!("dock_ui.rs");
+        assert!(dock_ui.contains(r#"crate::i18n::command_label("window.panel", title)"#), "dock_ui.rs no longer asks the catalog for the panel titles");
     }
 
     #[test]
@@ -7134,90 +9292,33 @@ mod tests {
         assert_eq!(code("unknown"), "en");
     }
 
+    /// Every catalog language draws its menu entries from the catalog, including those with no
+    /// undo/redo wording of their own: choosing Deutsch, Русский or Français left the menus in
+    /// English (#1449).
     #[test]
-    fn es_translates_labels_computed_titles_and_keeps_names_verbatim() {
+    fn every_catalog_language_translates_menu_entries() {
         let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"es"})).unwrap();
-        assert_eq!(language(&app), "es");
-        assert!(spanish(&app));
-        assert!(!traditional(&app));
-        assert!(!simplified(&app));
-        assert!(!japanese(&app));
-        // Fixed menu rows come from the catalog.
-        assert_eq!(label(&app, "", "Composition"), "Composición");
-        assert_eq!(label(&app, "", "Effect"), "Efecto");
-        assert_eq!(label(&app, "comp.new", "New Composition..."), "Nueva composición...");
-        assert_eq!(label(&app, "layer.newText", "Text"), "Texto");
-        assert_eq!(label(&app, "layer.setBlendMode", "Color Burn"), "Subexposición de color");
-        // Untranslated keys and dynamic labels stay verbatim.
-        assert_eq!(label(&app, "unknown.command", "Text"), "Text");
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] },
-                "Undo Comp1".into()
-            ),
-            "No se puede deshacer"
-        );
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel":"layer"}), shortcut: None, alt_shortcuts: vec![] },
-                "Layer: File".into()
-            ),
-            "Capa: File"
-        );
-        // The submenu titles that name the current workspace / view.
-        assert_eq!(
-            submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “Default” Workspace".into()),
-            "Asignar método abreviado al espacio de trabajo “Default”"
-        );
-        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "Asignar método abreviado a la vista 3D “Top”");
-        // The menu tree carries the same commands and shortcuts with the Spanish labels.
-        let es = crate::native_menu::build(&app);
-        assert!(es.items().iter().any(|i| i.command == "comp.new" && i.label == "Nueva composición..."));
-        assert!(es.items().iter().any(|i| i.command == "layer.newText" && i.label == "Texto"));
-        assert!(es.items().iter().any(|i| i.command == "keys.easyEase" && i.label == "Suavizado"));
-        // A dynamic filename is never translated.
-        app.session.prefs.push_recent("/tmp/File.ecproj");
-        assert!(crate::native_menu::build(&app).items().iter().any(|i| i.command == "file.openRecent" && i.label == "File.ecproj"));
-    }
-
-    #[test]
-    fn pt_br_translates_labels_computed_titles_and_keeps_names_verbatim() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("prefs.set", json!({"key":"general.language", "value":"pt-br"})).unwrap();
-        assert_eq!(language(&app), "pt-br");
-        assert!(!japanese(&app));
-        // Fixed menu rows come from the catalog.
-        assert_eq!(label(&app, "", "Composition"), "Composição");
-        assert_eq!(label(&app, "", "Effect"), "Efeito");
-        assert_eq!(label(&app, "comp.new", "New Composition..."), "Nova composição...");
-        assert_eq!(label(&app, "layer.newText", "Text"), "Texto");
-        // Untranslated keys and dynamic labels stay verbatim.
-        assert_eq!(label(&app, "unknown.command", "Text"), "Text");
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Undo".into(), command: "edit.undo".into(), params: json!({}), shortcut: None, alt_shortcuts: vec![] },
-                "Undo Comp1".into()
-            ),
-            "Não há nada para desfazer"
-        );
-        assert_eq!(
-            entry(
-                &app,
-                &MenuEntry { label: "Layer".into(), command: "window.panel".into(), params: json!({"panel":"layer"}), shortcut: None, alt_shortcuts: vec![] },
-                "Layer: File".into()
-            ),
-            "Camada: File"
-        );
-        // The submenu titles that name the current workspace / view.
-        assert_eq!(
-            submenu(&app, "Assign Shortcut to Workspace", "Assign Shortcut to “Default” Workspace".into()),
-            "Atribuir atalho à área de trabalho “Default”"
-        );
-        assert_eq!(submenu(&app, "Assign Shortcut to 3D View", "Assign Shortcut to “Top”".into()), "Atribuir atalho à visualização 3D “Top”");
+        let menu_entry = |command: &str, label: &str| MenuEntry {
+            label: label.into(),
+            command: command.into(),
+            params: serde_json::Value::Null,
+            shortcut: None,
+            alt_shortcuts: Vec::new(),
+        };
+        let new_comp = menu_entry("comp.new", "New Composition...");
+        let undo = menu_entry("edit.undo", "Undo");
+        for code in CATALOG_CODES {
+            app.session.execute("prefs.set", json!({"key":"general.language", "value":code})).unwrap();
+            let drawn = entry(&app, &new_comp, new_comp.label.clone());
+            assert_eq!(drawn, label(&app, "comp.new", "New Composition..."), "{code}");
+            assert_ne!(drawn, new_comp.label, "{code}: the menu entry is drawn in English");
+        }
+        app.session.execute("prefs.set", json!({"key":"general.language", "value":"ru"})).unwrap();
+        assert_eq!(entry(&app, &undo, "Can't Undo".into()), "Нечего отменять");
+        app.session.execute("prefs.set", json!({"key":"general.language", "value":"de"})).unwrap();
+        assert_eq!(entry(&app, &undo, "Can't Undo".into()), "Rückgängig nicht möglich");
+        app.session.execute("prefs.set", json!({"key":"general.language", "value":"en"})).unwrap();
+        assert_eq!(entry(&app, &new_comp, new_comp.label.clone()), "New Composition...");
     }
 
     #[test]
diff --git a/crates/ui-egui/src/i18n/effects.rs b/crates/ui-egui/src/i18n/effects.rs
index 5c6d09ba5..55893115a 100644
--- a/crates/ui-egui/src/i18n/effects.rs
+++ b/crates/ui-egui/src/i18n/effects.rs
@@ -14,21 +14,39 @@
 //!   the id is stable, so a translation never becomes an orphan.
 //!
 //! Each row repeats the registry's English name so that a rename upstream fails
-//! [`tests::every_effect_has_a_row`] instead of silently pointing a translation at another
-//! effect.
+//! `tests::every_row_names_a_registry_effect` instead of silently pointing a translation at
+//! another effect. An effect with no row draws the registry's English name; the
+//! `missing_translations_report` test (run by `cargo xtask ci`) lists those per language.
 //!
-//! A language decides for itself which names stay English: After Effects' Japanese interface
-//! leaves the `CC` series, the `VR` set and the `OCIO` set in English, while its Simplified
-//! Chinese one translates them (the `CC` names come from Adobe's Chinese *documentation*, which
-//! names 68 of the 69). Repeating the English name is therefore a language-level choice, not a
-//! missing row: [`tests::only_the_brand_names_stay_in_english`] pins *Simplified Chinese's* five
-//! brand names and is deliberately not shared by the other languages.
+//! Own feature names are descriptive. The renamed effects use original translations in every
+//! existing effect catalog; legacy vendor names remain search aliases in the effects crate.
+//! External format tokens and stored instance names are not localized or rewritten.
 //!
-//! The Simplified Chinese names come from the installed After Effects 2026 (26.5.0.89)
-//! Simplified Chinese interface, its 21 category folder names included; `Cryptomatte`,
+//! The rows of the effects this cleanup did not rename keep the provenance they had. A language
+//! decides for itself which names stay English: After Effects' Japanese interface leaves the `CC`
+//! series in English and gives the `VR` and `OCIO` sets a Japanese tail (`VR ブラー`,
+//! `OCIO CDL 変換`), while its Simplified Chinese one translates them. Repeating the English name
+//! is therefore a language-level choice, not a missing row.
+//!
+//! The Simplified Chinese names of unchanged effects come from the installed After Effects 2026
+//! (26.5.0.89) Simplified Chinese interface, its 21 category folder names included (the `CC` names
+//! came from Adobe's Chinese *documentation*, which names 68 of the 69); `Cryptomatte`,
 //! `EXtractoR`, `IDentifier`, `Key Light` and `Unmult` stay in English as brand names, and
 //! `Face Measurements` / `Face Track Points` are EffectCraft's own effects, so their wording is
 //! ours.
+//!
+//! The Traditional Chinese names for Taiwan are written from the meaning of the English ones, with
+//! the terms Taiwan's creative software uses (`圖層`, `遮罩`, `筆刷`, `雜訊`, `發光`, `漸層`); they
+//! are not converted from the Simplified table. Brand and coined names (`Cryptomatte`,
+//! `EXtractoR`, `IDentifier`, `Key Light`, `Unmult`, `Colorama`, `Minimax`, `Vegas`) stay in
+//! English, and the `VR` and `OCIO` sets keep their prefix in Chinese word order.
+//!
+//! The French names are written from the meaning of the English ones, with the vocabulary of the
+//! French menus; they come from no other application's interface. Brand and coined names
+//! (`Cryptomatte`, `EXtractoR`, `IDentifier`, `Key Light`, `Unmult`, `Colorama`, `Minimax`,
+//! `Tritone`, `Vibrance`, `Vegas`) stay in English; a series tag that prefixes a descriptive name
+//! (`VR`, `OCIO`, `PS`, `HDR`) stays and follows the French word order (`Flou VR`,
+//! `Transformation CDL OCIO`).
 
 use std::collections::HashMap;
 use std::sync::OnceLock;
@@ -63,19 +81,25 @@ impl Catalog {
 ///
 /// **Adding a language** is two tables and one arm: write its rows (one per effect, ids from
 /// [`SIMPLIFIED_CHINESE`]) and its category labels, name them in the `static` below and in this
-/// `match`. Nothing else changes — not the lookups, not one panel. `zh-hant` and `ja` are listed
-/// with empty tables, so a translator fills rows in without touching this function, and until
-/// then those languages draw the registry's English name.
+/// `match`. Nothing else changes — not the lookups, not one panel. `zh-hant` now covers every
+/// effect and category; `ja` ships a table that a translator fills in without touching this
+/// function. An effect with no row draws the registry's English name until its row arrives.
 fn catalog(language: &str) -> Option<&'static Catalog> {
     static SIMPLIFIED: Catalog = Catalog { rows: SIMPLIFIED_CHINESE, categories: SIMPLIFIED_CHINESE_CATEGORIES, index: OnceLock::new() };
     static TRADITIONAL: Catalog = Catalog { rows: TRADITIONAL_CHINESE, categories: TRADITIONAL_CHINESE_CATEGORIES, index: OnceLock::new() };
     static JAPANESE: Catalog = Catalog { rows: JAPANESE_EFFECTS, categories: JAPANESE_CATEGORIES, index: OnceLock::new() };
+    static GEORGIAN_CATALOG: Catalog = Catalog { rows: GEORGIAN, categories: GEORGIAN_CATEGORIES, index: OnceLock::new() };
+    static SWEDISH_CATALOG: Catalog = Catalog { rows: SWEDISH, categories: SWEDISH_CATEGORIES, index: OnceLock::new() };
+    static FRENCH_CATALOG: Catalog = Catalog { rows: FRENCH, categories: FRENCH_CATEGORIES, index: OnceLock::new() };
     match language {
         "zh-hans" => Some(&SIMPLIFIED),
         "zh-hant" => Some(&TRADITIONAL),
         // Japanese: the slot the Japanese data point on #821 asked for, so both languages share
         // this one catalog instead of inventing a second mechanism.
         "ja" => Some(&JAPANESE),
+        "ka" => Some(&GEORGIAN_CATALOG),
+        "sv" => Some(&SWEDISH_CATALOG),
+        "fr" => Some(&FRENCH_CATALOG),
         _ => None,
     }
 }
@@ -85,22 +109,38 @@ pub(crate) fn name(id: &str, english: &str) -> String {
     catalog(current()).and_then(|c| c.row(id)).map_or_else(|| english.to_string(), |(_, translated)| translated.to_string())
 }
 
+/// The characters of `language`'s effect names and category labels, so the interface's font probe
+/// registers a face for each of them as it does for the panel catalog's.
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn characters(language: &str) -> impl Iterator<Item = char> {
+    catalog(language).into_iter().flat_map(|c| c.rows.iter().map(|(_, _, t)| *t).chain(c.categories.iter().map(|(_, t)| *t))).flat_map(str::chars)
+}
+
+/// The number of effect-name rows `language` translates, for the row-count report; 0 when it has
+/// no catalog or when it is English.
+#[cfg(test)]
+pub(super) fn translated_rows(language: &str) -> usize {
+    catalog(language).map_or(0, |c| c.rows.len())
+}
+
 /// The name to draw for an effect group the property tree stores as `stored`: the catalog name,
 /// plus the instance index the engine appends to a repeat (`Gaussian Blur 2` → `高斯模糊 2`).
 ///
-/// A name that is neither the registry's nor the registry's plus an index was typed by the user
-/// (Effect Controls ▸ Rename), so it stays verbatim — as does the whole string in a language
-/// with no row.
+/// Current and legacy default names (including numeric instance suffixes) draw the current
+/// name. Other names were supplied by the user and stay verbatim. Stored data is never changed.
 pub(crate) fn group(id: &str, stored: &str) -> String {
-    let Some((english, translated)) = catalog(current()).and_then(|c| c.row(id)) else { return stored.to_string() };
-    if stored == english {
-        return translated.to_string();
-    }
-    if let Some(index) = stored.strip_prefix(english).and_then(|rest| rest.strip_prefix(' '))
-        && !index.is_empty()
-        && index.bytes().all(|b| b.is_ascii_digit())
-    {
-        return format!("{translated} {index}");
+    let Some(spec) = effectcraft_engine::effects::find(id) else { return stored.to_string() };
+    let translated = name(id, spec.name);
+    for source in std::iter::once(spec.name).chain(effectcraft_engine::effects::aliases(id).iter().copied()) {
+        if stored == source {
+            return translated;
+        }
+        if let Some(index) = stored.strip_prefix(source).and_then(|rest| rest.strip_prefix(' '))
+            && !index.is_empty()
+            && index.bytes().all(|b| b.is_ascii_digit())
+        {
+            return format!("{translated} {index}");
+        }
     }
     stored.to_string()
 }
@@ -115,9 +155,23 @@ pub(crate) fn category(source: &str) -> String {
 /// `query` (lowercase)? Both names match, so a translated interface can be searched either way.
 pub(crate) fn matches(id: &str, english: &str, query: &str) -> bool {
     english.to_lowercase().contains(query)
+        || effectcraft_engine::effects::find(id).is_some_and(|spec| effectcraft_engine::effects::name_matches(spec, query))
         || catalog(current()).and_then(|c| c.row(id)).is_some_and(|(_, translated)| translated.to_lowercase().contains(query))
 }
 
+/// The registry's effect names and categories `language` has no row for, for the missing-strings
+/// report.
+#[cfg(test)]
+pub(super) fn missing(language: &str) -> Vec<String> {
+    let table = catalog(language);
+    let effects = effectcraft_engine::effects::registry().iter().filter(|spec| table.and_then(|c| c.row(spec.id)).is_none()).map(|spec| spec.name.to_string());
+    let categories = effectcraft_engine::effects::categories()
+        .into_iter()
+        .filter(|source| table.and_then(|c| c.category(source)).is_none())
+        .map(|source| format!("{source} (category)"));
+    effects.chain(categories).collect()
+}
+
 /// Simplified Chinese (`zh-hans`): one row per effect in the registry.
 const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.3d.channelextract", "3D Channel Extract", "3D 通道提取"),
@@ -128,6 +182,7 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.3d.fog3d", "Fog 3D", "雾 3D"),
     ("ec.3d.identifier", "IDentifier", "IDentifier"),
     ("ec.3d.idmatte", "ID Matte", "ID 遮罩"),
+    ("ec.3d.instance3d", "3D Layer Instance", "3D 图层实例"),
     ("ec.audio.backwards", "Backwards", "倒放"),
     ("ec.audio.basstreble", "Bass & Treble", "低音和高音"),
     ("ec.audio.compressor", "Compressor", "压缩程序"),
@@ -144,10 +199,10 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.blur.bilateral", "Bilateral Blur", "双向模糊"),
     ("ec.blur.cameralens", "Camera Lens Blur", "摄像机镜头模糊"),
     ("ec.blur.camerashakedeblur", "Camera-Shake Deblur", "摄像机抖动去模糊"),
-    ("ec.blur.cccross", "CC Cross Blur", "CC 交叉模糊"),
-    ("ec.blur.ccradial", "CC Radial Blur", "CC 径向模糊"),
-    ("ec.blur.ccradialfast", "CC Radial Fast Blur", "CC 径向快速模糊"),
-    ("ec.blur.ccvector", "CC Vector Blur", "CC 矢量模糊"),
+    ("ec.blur.cccross", "Cross Blur", "十字模糊"),
+    ("ec.blur.ccradial", "Variable Radial Blur", "可变径向模糊"),
+    ("ec.blur.ccradialfast", "Fast Radial Blur", "快速径向模糊"),
+    ("ec.blur.ccvector", "Vector Blur", "矢量模糊"),
     ("ec.blur.channel", "Channel Blur", "通道模糊"),
     ("ec.blur.compound", "Compound Blur", "复合模糊"),
     ("ec.blur.directional", "Directional Blur", "定向模糊"),
@@ -161,7 +216,7 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.channel.arithmetic", "Arithmetic", "算术"),
     ("ec.channel.blend", "Blend", "混合"),
     ("ec.channel.calculations", "Calculations", "计算"),
-    ("ec.channel.cccomposite", "CC Composite", "CC 合成"),
+    ("ec.channel.cccomposite", "Source Composite", "源图合成"),
     ("ec.channel.combiner", "Channel Combiner", "通道合成器"),
     ("ec.channel.compoundarithmetic", "Compound Arithmetic", "复合运算"),
     ("ec.channel.invert", "Invert", "反转"),
@@ -177,10 +232,10 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.color.blackwhite", "Black & White", "黑色和白色"),
     ("ec.color.brightnesscontrast", "Brightness & Contrast", "亮度和对比度"),
     ("ec.color.broadcast", "Broadcast Colors", "广播颜色"),
-    ("ec.color.cccolorneutralizer", "CC Color Neutralizer", "CC 颜色中和器"),
-    ("ec.color.cccoloroffset", "CC Color Offset", "CC 颜色偏移"),
-    ("ec.color.cckernel", "CC Kernel", "CC 内核"),
-    ("ec.color.cctoner", "CC Toner", "CC 调色器"),
+    ("ec.color.cccolorneutralizer", "Color Neutralizer", "色偏校正"),
+    ("ec.color.cccoloroffset", "Channel Offset", "通道偏移"),
+    ("ec.color.cckernel", "Convolution Kernel", "卷积核"),
+    ("ec.color.cctoner", "Multi-Tone Tint", "多色调着色"),
     ("ec.color.changecolor", "Change Color", "更改颜色"),
     ("ec.color.changetocolor", "Change to Color", "更改为颜色"),
     ("ec.color.channelmixer", "Channel Mixer", "通道混合器"),
@@ -197,7 +252,7 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.color.leavecolor", "Leave Color", "保留颜色"),
     ("ec.color.levels", "Levels", "色阶"),
     ("ec.color.levelsic", "Levels (Individual Controls)", "色阶 (单独控件)"),
-    ("ec.color.lumetri", "Lumetri Color", "Lumetri 颜色"),
+    ("ec.color.lumetri", "Color Grading", "色彩分级"),
     ("ec.color.ociocdl", "OCIO CDL Transform", "OCIO CDL 变换"),
     ("ec.color.ociocolorspace", "OCIO Color Space Transform", "OCIO 颜色空间变换"),
     ("ec.color.ociodisplay", "OCIO Display Transform", "OCIO 显示变换"),
@@ -222,20 +277,20 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.control.stereo3d", "Stereo 3D Controls", "立体 3D 控制"),
     ("ec.distort.bezierwarp", "Bezier Warp", "贝塞尔曲线变形"),
     ("ec.distort.bulge", "Bulge", "凸出"),
-    ("ec.distort.ccbender", "CC Bender", "CC 弯曲器"),
-    ("ec.distort.ccbendit", "CC Bend It", "CC 弯曲"),
-    ("ec.distort.ccblobbylize", "CC Blobbylize", "CC 融化"),
-    ("ec.distort.ccflomotion", "CC Flo Motion", "CC 流动运动"),
-    ("ec.distort.ccgriddler", "CC Griddler", "CC 网格生成器"),
-    ("ec.distort.cclens", "CC Lens", "CC 镜头"),
-    ("ec.distort.ccpageturn", "CC Page Turn", "CC 翻页"),
-    ("ec.distort.ccpowerpin", "CC Power Pin", "CC 强力边角定位"),
-    ("ec.distort.ccripplepulse", "CC Ripple Pulse", "CC 波纹脉冲"),
-    ("ec.distort.ccslant", "CC Slant", "CC 倾斜"),
-    ("ec.distort.ccsmear", "CC Smear", "CC 漩涡条纹"),
-    ("ec.distort.ccsplit", "CC Split", "CC 拆分"),
-    ("ec.distort.ccsplit2", "CC Split 2", "CC 拆分 2"),
-    ("ec.distort.cctiler", "CC Tiler", "CC 拼贴器"),
+    ("ec.distort.ccbender", "Flexible Bend", "柔性弯曲"),
+    ("ec.distort.ccbendit", "Two-Point Bend", "两点弯曲"),
+    ("ec.distort.ccblobbylize", "Organic Displacement", "有机置换"),
+    ("ec.distort.ccflomotion", "Dual Lens Warp", "双镜头变形"),
+    ("ec.distort.ccgriddler", "Tile Grid", "平铺网格"),
+    ("ec.distort.cclens", "Lens Distortion", "镜头畸变"),
+    ("ec.distort.ccpageturn", "Page Curl", "页面卷曲"),
+    ("ec.distort.ccpowerpin", "Perspective Pin", "透视定位"),
+    ("ec.distort.ccripplepulse", "Pulsed Ripple", "脉冲涟漪"),
+    ("ec.distort.ccslant", "Slant", "倾斜"),
+    ("ec.distort.ccsmear", "Directional Smear", "定向涂抹"),
+    ("ec.distort.ccsplit", "Split Warp", "分割变形"),
+    ("ec.distort.ccsplit2", "Dual Split Warp", "双重分割变形"),
+    ("ec.distort.cctiler", "Scaled Tiles", "缩放平铺"),
     ("ec.distort.cornerpin", "Corner Pin", "边角定位"),
     ("ec.distort.displacementmap", "Displacement Map", "置换图"),
     ("ec.distort.liquify", "Liquify", "液化"),
@@ -263,11 +318,11 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.generate.audiospectrum", "Audio Spectrum", "音频频谱"),
     ("ec.generate.audiowaveform", "Audio Waveform", "音频波形"),
     ("ec.generate.beam", "Beam", "光束"),
-    ("ec.generate.ccgluegun", "CC Glue Gun", "CC 胶水枪"),
-    ("ec.generate.cclightburst", "CC Light Burst 2.5", "CC 光束放射 2.5"),
-    ("ec.generate.cclightrays", "CC Light Rays", "CC 光线"),
-    ("ec.generate.cclightsweep", "CC Light Sweep", "CC 光线扫描"),
-    ("ec.generate.ccthreads", "CC Threads", "CC 编织条"),
+    ("ec.generate.ccgluegun", "Paint Beads", "颜料珠"),
+    ("ec.generate.cclightburst", "Radial Light Burst", "径向光芒"),
+    ("ec.generate.cclightrays", "Light Rays", "光线"),
+    ("ec.generate.cclightsweep", "Light Sweep", "扫光"),
+    ("ec.generate.ccthreads", "Woven Threads", "编织线"),
     ("ec.generate.cellpattern", "Cell Pattern", "单元格图案"),
     ("ec.generate.checkerboard", "Checkerboard", "棋盘"),
     ("ec.generate.circle", "Circle", "圆形"),
@@ -286,7 +341,7 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.generate.vegas", "Vegas", "勾画"),
     ("ec.generate.writeon", "Write-on", "写入"),
     ("ec.key.advancedspill", "Advanced Spill Suppressor", "高级溢出抑制器"),
-    ("ec.key.ccsimplewireremoval", "CC Simple Wire Removal", "CC 简单丝线移除"),
+    ("ec.key.ccsimplewireremoval", "Line Removal", "线条移除"),
     ("ec.key.colordifference", "Color Difference Key", "颜色差值键"),
     ("ec.key.colorkey", "Color Key", "颜色键"),
     ("ec.key.colorrange", "Color Range", "颜色范围"),
@@ -299,7 +354,7 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.key.screen", "Screen Key", "屏幕键"),
     ("ec.key.spill", "Spill Suppressor", "溢出抑制"),
     ("ec.key.unmult", "Unmult", "Unmult"),
-    ("ec.keying.keylight", "Key Light", "Key Light"),
+    ("ec.keying.keylight", "Screen Color Key", "屏幕色键"),
     ("ec.matte.mattechoker", "Matte Choker", "遮罩阻塞工具"),
     ("ec.matte.objectmatte", "Object Matte", "对象遮罩"),
     ("ec.matte.refinehard", "Refine Hard Matte", "调整实边遮罩"),
@@ -323,50 +378,50 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.obsolete.basictext", "Basic Text", "基本文字"),
     ("ec.obsolete.gaussianlegacy", "Gaussian Blur (Legacy)", "高斯模糊 (旧版)"),
     ("ec.obsolete.lightning", "Lightning", "闪电"),
-    ("ec.obsolete.mochashape", "Mocha shape", "Mocha 形状"),
+    ("ec.obsolete.mochashape", "Tracked Shape Matte", "跟踪形状遮罩"),
     ("ec.obsolete.pathtext", "Path Text", "路径文本"),
     ("ec.paint.paint", "Paint", "绘画"),
     ("ec.perspective.3dglasses", "3D Glasses", "3D 眼镜"),
     ("ec.perspective.bevelalpha", "Bevel Alpha", "斜面 Alpha"),
     ("ec.perspective.beveledges", "Bevel Edges", "边缘斜面"),
     ("ec.perspective.cameratracker", "3D Camera Tracker", "3D 摄像机跟踪器"),
-    ("ec.perspective.cccylinder", "CC Cylinder", "CC 圆柱体"),
-    ("ec.perspective.ccenvironment", "CC Environment", "CC 环境"),
-    ("ec.perspective.ccsphere", "CC Sphere", "CC 球体"),
-    ("ec.perspective.ccspotlight", "CC Spotlight", "CC 聚光"),
+    ("ec.perspective.cccylinder", "Cylinder Wrap", "圆柱包裹"),
+    ("ec.perspective.ccenvironment", "Environment Map", "环境映射"),
+    ("ec.perspective.ccsphere", "Sphere Wrap", "球面包裹"),
+    ("ec.perspective.ccspotlight", "Surface Spotlight", "表面聚光灯"),
     ("ec.perspective.dropshadow", "Drop Shadow", "投影"),
     ("ec.perspective.radialshadow", "Radial Shadow", "径向阴影"),
     ("ec.sim.carddance", "Card Dance", "卡片动画"),
     ("ec.sim.caustics", "Caustics", "焦散"),
-    ("ec.sim.ccballaction", "CC Ball Action", "CC 球动作"),
-    ("ec.sim.ccbubbles", "CC Bubbles", "CC 气泡"),
-    ("ec.sim.ccdrizzle", "CC Drizzle", "CC 细雨波纹"),
-    ("ec.sim.cchair", "CC Hair", "CC 毛发"),
-    ("ec.sim.ccmrmercury", "CC Mr. Mercury", "CC 水银流体"),
-    ("ec.sim.ccparticlesystems2", "CC Particle Systems II", "CC 粒子系统 II"),
-    ("ec.sim.ccparticleworld", "CC Particle World", "CC 粒子世界"),
-    ("ec.sim.ccpixelpolly", "CC Pixel Polly", "CC 像素多边形"),
-    ("ec.sim.ccrainfall", "CC Rainfall", "CC 降雨"),
-    ("ec.sim.ccscatterize", "CC Scatterize", "CC 散射"),
-    ("ec.sim.ccsnowfall", "CC Snowfall", "CC 降雪"),
-    ("ec.sim.ccstarburst", "CC Star Burst", "CC 星爆"),
+    ("ec.sim.ccballaction", "Ball Grid", "球体网格"),
+    ("ec.sim.ccbubbles", "Bubbles", "气泡"),
+    ("ec.sim.ccdrizzle", "Water Ripples", "水面涟漪"),
+    ("ec.sim.cchair", "Surface Fibers", "表面纤维"),
+    ("ec.sim.ccmrmercury", "Liquid Particles", "液体粒子"),
+    ("ec.sim.ccparticlesystems2", "Particle Emitter 2D", "二维粒子发射器"),
+    ("ec.sim.ccparticleworld", "Particle Emitter 3D", "三维粒子发射器"),
+    ("ec.sim.ccpixelpolly", "Pixel Shatter", "像素破碎"),
+    ("ec.sim.ccrainfall", "Rainfall", "降雨"),
+    ("ec.sim.ccscatterize", "Pixel Scatter", "像素散射"),
+    ("ec.sim.ccsnowfall", "Snowfall", "降雪"),
+    ("ec.sim.ccstarburst", "Starfield", "星空"),
     ("ec.sim.foam", "Foam", "泡沫"),
     ("ec.sim.particleplayground", "Particle Playground", "粒子运动场"),
     ("ec.sim.shatter", "Shatter", "碎片"),
     ("ec.sim.waveworld", "Wave World", "波形环境"),
     ("ec.stylize.brushstrokes", "Brush Strokes", "画笔描边"),
     ("ec.stylize.cartoon", "Cartoon", "卡通"),
-    ("ec.stylize.ccblockload", "CC Block Load", "CC 块加载"),
-    ("ec.stylize.ccburnfilm", "CC Burn Film", "CC 烧毁胶片"),
-    ("ec.stylize.ccglass", "CC Glass", "CC 玻璃"),
-    ("ec.stylize.cchextile", "CC HexTile", "CC 六边形拼贴"),
-    ("ec.stylize.cckaleida", "CC Kaleida", "CC 万花筒"),
-    ("ec.stylize.ccmrsmoothie", "CC Mr. Smoothie", "CC 像素溶解"),
-    ("ec.stylize.ccplastic", "CC Plastic", "CC 塑料"),
-    ("ec.stylize.ccrepetile", "CC RepeTile", "CC 重复拼贴"),
-    ("ec.stylize.ccthreshold", "CC Threshold", "CC 阈值"),
-    ("ec.stylize.ccthresholdrgb", "CC Threshold RGB", "CC 阈值 RGB"),
-    ("ec.stylize.ccvignette", "CC Vignette", "CC 暗角"),
+    ("ec.stylize.ccblockload", "Block Reveal", "块状显现"),
+    ("ec.stylize.ccburnfilm", "Film Burn", "胶片灼烧"),
+    ("ec.stylize.ccglass", "Glass Relief", "玻璃浮雕"),
+    ("ec.stylize.cchextile", "Hexagonal Tiles", "六边形平铺"),
+    ("ec.stylize.cckaleida", "Kaleidoscope", "万花筒"),
+    ("ec.stylize.ccmrsmoothie", "Palette Map", "调色板映射"),
+    ("ec.stylize.ccplastic", "Plastic Shading", "塑料着色"),
+    ("ec.stylize.ccrepetile", "Edge Tile Repeat", "边缘平铺重复"),
+    ("ec.stylize.ccthreshold", "Channel Threshold", "通道阈值"),
+    ("ec.stylize.ccthresholdrgb", "RGB Threshold", "RGB 阈值"),
+    ("ec.stylize.ccvignette", "Vignette", "晕影"),
     ("ec.stylize.coloremboss", "Color Emboss", "彩色浮雕"),
     ("ec.stylize.emboss", "Emboss", "浮雕"),
     ("ec.stylize.findedges", "Find Edges", "查找边缘"),
@@ -381,8 +436,8 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.stylize.threshold", "Threshold", "阈值"),
     ("ec.text.numbers", "Numbers", "编号"),
     ("ec.text.timecode", "Timecode", "时间码"),
-    ("ec.time.ccforcemotionblur", "CC Force Motion Blur", "CC 强制运动模糊"),
-    ("ec.time.ccwidetime", "CC Wide Time", "CC 宽泛时间"),
+    ("ec.time.ccforcemotionblur", "Temporal Motion Blur", "时间运动模糊"),
+    ("ec.time.ccwidetime", "Temporal Blend", "时间混合"),
     ("ec.time.echo", "Echo", "残影"),
     ("ec.time.pixelmotionblur", "Pixel Motion Blur", "像素运动模糊"),
     ("ec.time.posterizetime", "Posterize Time", "抽帧"),
@@ -391,23 +446,23 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.time.timewarp", "Timewarp", "时间扭曲"),
     ("ec.transition.blockdissolve", "Block Dissolve", "块溶解"),
     ("ec.transition.cardwipe", "Card Wipe", "卡片擦除"),
-    ("ec.transition.ccglasswipe", "CC Glass Wipe", "CC 玻璃擦除"),
-    ("ec.transition.ccgridwipe", "CC Grid Wipe", "CC 网格擦除"),
-    ("ec.transition.ccimagewipe", "CC Image Wipe", "CC 图像擦除"),
-    ("ec.transition.ccjaws", "CC Jaws", "CC 锯齿"),
-    ("ec.transition.cclightwipe", "CC Light Wipe", "CC 光线擦除"),
-    ("ec.transition.cclinesweep", "CC Line Sweep", "CC 线条扫掠"),
-    ("ec.transition.ccradialscalewipe", "CC Radial ScaleWipe", "CC 径向缩放擦除"),
-    ("ec.transition.ccscalewipe", "CC Scale Wipe", "CC 缩放擦除"),
-    ("ec.transition.cctwister", "CC Twister", "CC 扭曲器"),
-    ("ec.transition.ccwarpomatic", "CC WarpoMatic", "CC 自动扭曲"),
+    ("ec.transition.ccglasswipe", "Glass Wipe", "玻璃擦除"),
+    ("ec.transition.ccgridwipe", "Grid Wipe", "网格擦除"),
+    ("ec.transition.ccimagewipe", "Luminance Image Wipe", "亮度图像擦除"),
+    ("ec.transition.ccjaws", "Serrated Wipe", "锯齿擦除"),
+    ("ec.transition.cclightwipe", "Light Wipe", "光线擦除"),
+    ("ec.transition.cclinesweep", "Line Sweep", "线条扫过"),
+    ("ec.transition.ccradialscalewipe", "Radial Scale Wipe", "径向缩放擦除"),
+    ("ec.transition.ccscalewipe", "Scale Wipe", "缩放擦除"),
+    ("ec.transition.cctwister", "Twist Wipe", "扭转擦除"),
+    ("ec.transition.ccwarpomatic", "Warp Dissolve", "变形溶解"),
     ("ec.transition.gradientwipe", "Gradient Wipe", "渐变擦除"),
     ("ec.transition.iriswipe", "Iris Wipe", "光圈擦除"),
     ("ec.transition.linearwipe", "Linear Wipe", "线性擦除"),
     ("ec.transition.radialwipe", "Radial Wipe", "径向擦除"),
     ("ec.transition.venetian", "Venetian Blinds", "百叶窗"),
     ("ec.utility.applylut", "Apply Color LUT", "应用颜色 LUT"),
-    ("ec.utility.ccoverbrights", "CC Overbrights", "CC 高光溢出"),
+    ("ec.utility.ccoverbrights", "Out-of-Range Display", "超出范围显示"),
     ("ec.utility.cineon", "Cineon Converter", "Cineon 转换器"),
     ("ec.utility.colorprofileconverter", "Color Profile Converter", "颜色配置文件转换器"),
     ("ec.utility.facemeasurements", "Face Measurements", "面部测量"),
@@ -428,43 +483,678 @@ const SIMPLIFIED_CHINESE: &[Row] = &[
     ("ec.vr.sharpen", "VR Sharpen", "VR 锐化"),
     ("ec.vr.spheretoplane", "VR Sphere to Plane", "VR 球面到平面"),
 ];
-/// Traditional Chinese (`zh-hant`): no rows yet. A translator fills one row per effect, ids from
-/// [`SIMPLIFIED_CHINESE`]; a row may repeat the English name, which is what the language draws
-/// for that effect.
-const TRADITIONAL_CHINESE: &[Row] = &[];
+/// Traditional Chinese (`zh-hant`): one row per effect in the registry, ids from
+/// [`SIMPLIFIED_CHINESE`]. Written from the meaning of the English names with the vocabulary
+/// Taiwan's creative software uses (圖層, 遮罩, 筆刷, 雜訊, 發光, 漸層), not converted from the
+/// Simplified table. Brand and coined names (`Cryptomatte`, `EXtractoR`, `IDentifier`, `Key Light`,
+/// `Unmult`, `Colorama`, `Minimax`, `Vegas`) stay in English; the `VR` and `OCIO` sets keep their
+/// prefix in Chinese word order. The effects this cleanup renamed are translated from their new
+/// descriptive names.
+const TRADITIONAL_CHINESE: &[Row] = &[
+    ("ec.3d.channelextract", "3D Channel Extract", "3D 通道擷取"),
+    ("ec.3d.cryptomatte", "Cryptomatte", "Cryptomatte"),
+    ("ec.3d.depthmatte", "Depth Matte", "深度遮罩"),
+    ("ec.3d.depthoffield", "Depth of Field", "景深"),
+    ("ec.3d.extractor", "EXtractoR", "EXtractoR"),
+    ("ec.3d.fog3d", "Fog 3D", "3D 霧"),
+    ("ec.3d.identifier", "IDentifier", "IDentifier"),
+    ("ec.3d.idmatte", "ID Matte", "ID 遮罩"),
+    ("ec.3d.instance3d", "3D Layer Instance", "3D 圖層實體"),
+    ("ec.audio.backwards", "Backwards", "倒轉"),
+    ("ec.audio.basstreble", "Bass & Treble", "低音與高音"),
+    ("ec.audio.compressor", "Compressor", "壓縮器"),
+    ("ec.audio.delay", "Delay", "延遲"),
+    ("ec.audio.distortion", "Distortion", "失真"),
+    ("ec.audio.flangechorus", "Flange & Chorus", "鑲邊與合聲"),
+    ("ec.audio.gate", "Gate", "雜訊閘"),
+    ("ec.audio.highlowpass", "High-Low Pass", "高通/低通"),
+    ("ec.audio.modulator", "Modulator", "調變器"),
+    ("ec.audio.parametriceq", "Parametric EQ", "參數等化器"),
+    ("ec.audio.reverb", "Reverb", "殘響"),
+    ("ec.audio.stereomixer", "Stereo Mixer", "立體聲混音器"),
+    ("ec.audio.tone", "Tone", "音調"),
+    ("ec.blur.bilateral", "Bilateral Blur", "雙邊模糊"),
+    ("ec.blur.cameralens", "Camera Lens Blur", "相機鏡頭模糊"),
+    ("ec.blur.camerashakedeblur", "Camera-Shake Deblur", "相機晃動去模糊"),
+    ("ec.blur.cccross", "Cross Blur", "十字模糊"),
+    ("ec.blur.ccradial", "Variable Radial Blur", "可變放射狀模糊"),
+    ("ec.blur.ccradialfast", "Fast Radial Blur", "快速放射狀模糊"),
+    ("ec.blur.ccvector", "Vector Blur", "向量模糊"),
+    ("ec.blur.channel", "Channel Blur", "通道模糊"),
+    ("ec.blur.compound", "Compound Blur", "複合模糊"),
+    ("ec.blur.directional", "Directional Blur", "方向模糊"),
+    ("ec.blur.fastbox", "Fast Box Blur", "快速方框模糊"),
+    ("ec.blur.gaussian", "Gaussian Blur", "高斯模糊"),
+    ("ec.blur.radial", "Radial Blur", "徑向模糊"),
+    ("ec.blur.reduceflicker", "Reduce Interlace Flicker", "減少交錯閃爍"),
+    ("ec.blur.sharpen", "Sharpen", "銳利化"),
+    ("ec.blur.smart", "Smart Blur", "智慧型模糊"),
+    ("ec.blur.unsharp", "Unsharp Mask", "遮色片銳利化"),
+    ("ec.channel.arithmetic", "Arithmetic", "算術"),
+    ("ec.channel.blend", "Blend", "混合"),
+    ("ec.channel.calculations", "Calculations", "運算"),
+    ("ec.channel.cccomposite", "Source Composite", "來源影像合成"),
+    ("ec.channel.combiner", "Channel Combiner", "通道合成器"),
+    ("ec.channel.compoundarithmetic", "Compound Arithmetic", "複合算術"),
+    ("ec.channel.invert", "Invert", "反轉"),
+    ("ec.channel.minimax", "Minimax", "Minimax"),
+    ("ec.channel.removecolormatting", "Remove Color Matting", "移除色彩殘邊"),
+    ("ec.channel.setchannels", "Set Channels", "設定通道"),
+    ("ec.channel.setmatte", "Set Matte", "設定遮罩"),
+    ("ec.channel.shiftchannels", "Shift Channels", "轉移通道"),
+    ("ec.channel.solidcomposite", "Solid Composite", "實色合成"),
+    ("ec.color.autocolor", "Auto Color", "自動色彩"),
+    ("ec.color.autocontrast", "Auto Contrast", "自動對比"),
+    ("ec.color.autolevels", "Auto Levels", "自動色階"),
+    ("ec.color.blackwhite", "Black & White", "黑白"),
+    ("ec.color.brightnesscontrast", "Brightness & Contrast", "亮度與對比"),
+    ("ec.color.broadcast", "Broadcast Colors", "廣播色彩"),
+    ("ec.color.cccolorneutralizer", "Color Neutralizer", "色偏校正"),
+    ("ec.color.cccoloroffset", "Channel Offset", "色版偏移"),
+    ("ec.color.cckernel", "Convolution Kernel", "卷積核心"),
+    ("ec.color.cctoner", "Multi-Tone Tint", "多色調著色"),
+    ("ec.color.changecolor", "Change Color", "變更色彩"),
+    ("ec.color.changetocolor", "Change to Color", "變更為色彩"),
+    ("ec.color.channelmixer", "Channel Mixer", "通道混合器"),
+    ("ec.color.colorama", "Colorama", "Colorama"),
+    ("ec.color.colorbalance", "Color Balance", "色彩平衡"),
+    ("ec.color.colorbalancehls", "Color Balance (HLS)", "色彩平衡（HLS）"),
+    ("ec.color.colorlink", "Color Link", "色彩連結"),
+    ("ec.color.colorstabilizer", "Color Stabilizer", "色彩穩定器"),
+    ("ec.color.curves", "Curves", "曲線"),
+    ("ec.color.equalize", "Equalize", "等化"),
+    ("ec.color.exposure", "Exposure", "曝光"),
+    ("ec.color.gammapedestalgain", "Gamma/Pedestal/Gain", "伽瑪/基準/增益"),
+    ("ec.color.huesaturation", "Hue/Saturation", "色相/飽和度"),
+    ("ec.color.leavecolor", "Leave Color", "保留色彩"),
+    ("ec.color.levels", "Levels", "色階"),
+    ("ec.color.levelsic", "Levels (Individual Controls)", "色階（個別控制項）"),
+    ("ec.color.lumetri", "Color Grading", "色彩分級"),
+    ("ec.color.ociocdl", "OCIO CDL Transform", "OCIO CDL 轉換"),
+    ("ec.color.ociocolorspace", "OCIO Color Space Transform", "OCIO 色彩空間轉換"),
+    ("ec.color.ociodisplay", "OCIO Display Transform", "OCIO 顯示轉換"),
+    ("ec.color.ociofile", "OCIO File Transform", "OCIO 檔案轉換"),
+    ("ec.color.ociolook", "OCIO Look Transform", "OCIO 外觀轉換"),
+    ("ec.color.photofilter", "Photo Filter", "相片濾鏡"),
+    ("ec.color.psarbitrarymap", "PS Arbitrary Map", "PS 任意映射"),
+    ("ec.color.selectivecolor", "Selective Color", "選擇性色彩"),
+    ("ec.color.shadowhighlight", "Shadow/Highlight", "陰影/亮部"),
+    ("ec.color.tint", "Tint", "染色"),
+    ("ec.color.tritone", "Tritone", "三色調"),
+    ("ec.color.vibrance", "Vibrance", "自然飽和度"),
+    ("ec.color.videolimiter", "Video Limiter", "視訊限制器"),
+    ("ec.control.angle", "Angle Control", "角度控制"),
+    ("ec.control.checkbox", "Checkbox Control", "核取方塊控制"),
+    ("ec.control.color", "Color Control", "色彩控制"),
+    ("ec.control.dropdown", "Dropdown Menu Control", "下拉式選單控制"),
+    ("ec.control.layer", "Layer Control", "圖層控制"),
+    ("ec.control.point", "Point Control", "點控制"),
+    ("ec.control.point3d", "3D Point Control", "3D 點控制"),
+    ("ec.control.slider", "Slider Control", "滑桿控制"),
+    ("ec.control.stereo3d", "Stereo 3D Controls", "立體 3D 控制"),
+    ("ec.distort.bezierwarp", "Bezier Warp", "貝茲彎曲"),
+    ("ec.distort.bulge", "Bulge", "凸出"),
+    ("ec.distort.ccbender", "Flexible Bend", "柔性彎曲"),
+    ("ec.distort.ccbendit", "Two-Point Bend", "兩點彎曲"),
+    ("ec.distort.ccblobbylize", "Organic Displacement", "有機置換"),
+    ("ec.distort.ccflomotion", "Dual Lens Warp", "雙鏡頭變形"),
+    ("ec.distort.ccgriddler", "Tile Grid", "拼貼網格"),
+    ("ec.distort.cclens", "Lens Distortion", "鏡頭畸變"),
+    ("ec.distort.ccpageturn", "Page Curl", "頁面捲曲"),
+    ("ec.distort.ccpowerpin", "Perspective Pin", "透視定位"),
+    ("ec.distort.ccripplepulse", "Pulsed Ripple", "脈衝漣漪"),
+    ("ec.distort.ccslant", "Slant", "傾斜"),
+    ("ec.distort.ccsmear", "Directional Smear", "定向塗抹"),
+    ("ec.distort.ccsplit", "Split Warp", "分割變形"),
+    ("ec.distort.ccsplit2", "Dual Split Warp", "雙重分割變形"),
+    ("ec.distort.cctiler", "Scaled Tiles", "縮放平鋪"),
+    ("ec.distort.cornerpin", "Corner Pin", "邊角釘選"),
+    ("ec.distort.displacementmap", "Displacement Map", "位移映射"),
+    ("ec.distort.liquify", "Liquify", "液化"),
+    ("ec.distort.magnify", "Magnify", "放大"),
+    ("ec.distort.meshwarp", "Mesh Warp", "網格彎曲"),
+    ("ec.distort.mirror", "Mirror", "鏡像"),
+    ("ec.distort.offset", "Offset", "位移"),
+    ("ec.distort.opticscompensation", "Optics Compensation", "光學補償"),
+    ("ec.distort.polar", "Polar Coordinates", "極座標"),
+    ("ec.distort.puppet", "Puppet", "木偶"),
+    ("ec.distort.reshape", "Reshape", "重塑"),
+    ("ec.distort.ripple", "Ripple", "漣漪"),
+    ("ec.distort.rollingshutterrepair", "Rolling Shutter Repair", "滾動快門修正"),
+    ("ec.distort.smear", "Smear", "塗抹"),
+    ("ec.distort.spherize", "Spherize", "球面化"),
+    ("ec.distort.transform", "Transform", "變形"),
+    ("ec.distort.turbulentdisplace", "Turbulent Displace", "擾流位移"),
+    ("ec.distort.twirl", "Twirl", "扭轉"),
+    ("ec.distort.twirllegacy", "Twirl (Legacy)", "扭轉（舊版）"),
+    ("ec.distort.upscale", "Detail-preserving Upscale", "保留細節放大"),
+    ("ec.distort.warp", "Warp", "彎曲"),
+    ("ec.distort.warpstabilizer", "Warp Stabilizer", "彎曲穩定器"),
+    ("ec.distort.wavewarp", "Wave Warp", "波浪彎曲"),
+    ("ec.generate.advancedlightning", "Advanced Lightning", "進階閃電"),
+    ("ec.generate.audiospectrum", "Audio Spectrum", "音訊頻譜"),
+    ("ec.generate.audiowaveform", "Audio Waveform", "音訊波形"),
+    ("ec.generate.beam", "Beam", "光束"),
+    ("ec.generate.ccgluegun", "Paint Beads", "顏料珠"),
+    ("ec.generate.cclightburst", "Radial Light Burst", "放射狀光芒"),
+    ("ec.generate.cclightrays", "Light Rays", "光線"),
+    ("ec.generate.cclightsweep", "Light Sweep", "掃光"),
+    ("ec.generate.ccthreads", "Woven Threads", "編織線"),
+    ("ec.generate.cellpattern", "Cell Pattern", "細胞圖樣"),
+    ("ec.generate.checkerboard", "Checkerboard", "棋盤格"),
+    ("ec.generate.circle", "Circle", "圓形"),
+    ("ec.generate.ellipse", "Ellipse", "橢圓"),
+    ("ec.generate.eyedropperfill", "Eyedropper Fill", "滴管填色"),
+    ("ec.generate.fill", "Fill", "填色"),
+    ("ec.generate.fourcolor", "4-Color Gradient", "四色漸層"),
+    ("ec.generate.fractal", "Fractal", "碎形"),
+    ("ec.generate.gradientramp", "Gradient Ramp", "漸層色帶"),
+    ("ec.generate.grid", "Grid", "格線"),
+    ("ec.generate.lensflare", "Lens Flare", "鏡頭光暈"),
+    ("ec.generate.paintbucket", "Paint Bucket", "油漆桶"),
+    ("ec.generate.radiowaves", "Radio Waves", "無線電波"),
+    ("ec.generate.scribble", "Scribble", "塗鴉"),
+    ("ec.generate.stroke", "Stroke", "筆畫"),
+    ("ec.generate.vegas", "Vegas", "Vegas"),
+    ("ec.generate.writeon", "Write-on", "書寫"),
+    ("ec.key.advancedspill", "Advanced Spill Suppressor", "進階溢色抑制"),
+    ("ec.key.ccsimplewireremoval", "Line Removal", "線條移除"),
+    ("ec.key.colordifference", "Color Difference Key", "色彩差異去背"),
+    ("ec.key.colorkey", "Color Key", "色彩去背"),
+    ("ec.key.colorrange", "Color Range", "色彩範圍"),
+    ("ec.key.differencematte", "Difference Matte", "差異遮罩"),
+    ("ec.key.extract", "Extract", "擷取"),
+    ("ec.key.innerouter", "Inner/Outer Key", "內/外去背"),
+    ("ec.key.keycleaner", "Key Cleaner", "去背淨化"),
+    ("ec.key.linearcolor", "Linear Color Key", "線性色彩去背"),
+    ("ec.key.luma", "Luma Key", "亮度去背"),
+    ("ec.key.screen", "Screen Key", "螢幕去背"),
+    ("ec.key.spill", "Spill Suppressor", "溢色抑制"),
+    ("ec.key.unmult", "Unmult", "Unmult"),
+    ("ec.keying.keylight", "Screen Color Key", "螢幕色鍵"),
+    ("ec.matte.mattechoker", "Matte Choker", "遮罩收縮器"),
+    ("ec.matte.objectmatte", "Object Matte", "物件遮罩"),
+    ("ec.matte.refinehard", "Refine Hard Matte", "調整硬邊遮罩"),
+    ("ec.matte.refinesoft", "Refine Soft Matte", "調整柔邊遮罩"),
+    ("ec.matte.rotobrush", "Roto Brush & Refine Edge", "Roto 筆刷與邊緣調整"),
+    ("ec.matte.simplechoker", "Simple Choker", "簡單收縮器"),
+    ("ec.noise.addgrain", "Add Grain", "新增顆粒"),
+    ("ec.noise.curlnoise", "Curl Noise", "捲曲雜訊"),
+    ("ec.noise.dustscratches", "Dust & Scratches", "汙點與刮痕"),
+    ("ec.noise.fractal", "Fractal Noise", "碎形雜訊"),
+    ("ec.noise.matchgrain", "Match Grain", "符合顆粒"),
+    ("ec.noise.median", "Median", "中值"),
+    ("ec.noise.medianlegacy", "Median (Legacy)", "中值（舊版）"),
+    ("ec.noise.noise", "Noise", "雜訊"),
+    ("ec.noise.noisealpha", "Noise Alpha", "雜訊 Alpha"),
+    ("ec.noise.noisehls", "Noise HLS", "雜訊 HLS"),
+    ("ec.noise.noisehlsauto", "Noise HLS Auto", "雜訊 HLS 自動"),
+    ("ec.noise.removegrain", "Remove Grain", "移除顆粒"),
+    ("ec.noise.turbulent", "Turbulent Noise", "擾流雜訊"),
+    ("ec.obsolete.basic3d", "Basic 3D", "基礎 3D"),
+    ("ec.obsolete.basictext", "Basic Text", "基礎文字"),
+    ("ec.obsolete.gaussianlegacy", "Gaussian Blur (Legacy)", "高斯模糊（舊版）"),
+    ("ec.obsolete.lightning", "Lightning", "閃電"),
+    ("ec.obsolete.mochashape", "Tracked Shape Matte", "追蹤形狀遮罩"),
+    ("ec.obsolete.pathtext", "Path Text", "路徑文字"),
+    ("ec.paint.paint", "Paint", "繪畫"),
+    ("ec.perspective.3dglasses", "3D Glasses", "3D 眼鏡"),
+    ("ec.perspective.bevelalpha", "Bevel Alpha", "Alpha 斜角"),
+    ("ec.perspective.beveledges", "Bevel Edges", "邊緣斜角"),
+    ("ec.perspective.cameratracker", "3D Camera Tracker", "3D 攝影機追蹤"),
+    ("ec.perspective.cccylinder", "Cylinder Wrap", "圓柱包覆"),
+    ("ec.perspective.ccenvironment", "Environment Map", "環境貼圖"),
+    ("ec.perspective.ccsphere", "Sphere Wrap", "球面包覆"),
+    ("ec.perspective.ccspotlight", "Surface Spotlight", "表面聚光燈"),
+    ("ec.perspective.dropshadow", "Drop Shadow", "陰影"),
+    ("ec.perspective.radialshadow", "Radial Shadow", "徑向陰影"),
+    ("ec.sim.carddance", "Card Dance", "卡片舞蹈"),
+    ("ec.sim.caustics", "Caustics", "焦散"),
+    ("ec.sim.ccballaction", "Ball Grid", "球體網格"),
+    ("ec.sim.ccbubbles", "Bubbles", "氣泡"),
+    ("ec.sim.ccdrizzle", "Water Ripples", "水面漣漪"),
+    ("ec.sim.cchair", "Surface Fibers", "表面纖維"),
+    ("ec.sim.ccmrmercury", "Liquid Particles", "液體粒子"),
+    ("ec.sim.ccparticlesystems2", "Particle Emitter 2D", "二維粒子發射器"),
+    ("ec.sim.ccparticleworld", "Particle Emitter 3D", "三維粒子發射器"),
+    ("ec.sim.ccpixelpolly", "Pixel Shatter", "像素破碎"),
+    ("ec.sim.ccrainfall", "Rainfall", "降雨"),
+    ("ec.sim.ccscatterize", "Pixel Scatter", "像素散射"),
+    ("ec.sim.ccsnowfall", "Snowfall", "降雪"),
+    ("ec.sim.ccstarburst", "Starfield", "星空"),
+    ("ec.sim.foam", "Foam", "泡沫"),
+    ("ec.sim.particleplayground", "Particle Playground", "粒子遊樂場"),
+    ("ec.sim.shatter", "Shatter", "粉碎"),
+    ("ec.sim.waveworld", "Wave World", "波浪世界"),
+    ("ec.stylize.brushstrokes", "Brush Strokes", "筆觸"),
+    ("ec.stylize.cartoon", "Cartoon", "卡通"),
+    ("ec.stylize.ccblockload", "Block Reveal", "區塊顯現"),
+    ("ec.stylize.ccburnfilm", "Film Burn", "膠片灼燒"),
+    ("ec.stylize.ccglass", "Glass Relief", "玻璃浮雕"),
+    ("ec.stylize.cchextile", "Hexagonal Tiles", "六角形拼貼"),
+    ("ec.stylize.cckaleida", "Kaleidoscope", "萬花筒"),
+    ("ec.stylize.ccmrsmoothie", "Palette Map", "調色盤對應"),
+    ("ec.stylize.ccplastic", "Plastic Shading", "塑膠著色"),
+    ("ec.stylize.ccrepetile", "Edge Tile Repeat", "邊緣拼貼重複"),
+    ("ec.stylize.ccthreshold", "Channel Threshold", "色版臨界值"),
+    ("ec.stylize.ccthresholdrgb", "RGB Threshold", "RGB 臨界值"),
+    ("ec.stylize.ccvignette", "Vignette", "暗角"),
+    ("ec.stylize.coloremboss", "Color Emboss", "彩色浮雕"),
+    ("ec.stylize.emboss", "Emboss", "浮雕"),
+    ("ec.stylize.findedges", "Find Edges", "尋找邊緣"),
+    ("ec.stylize.glow", "Glow", "發光"),
+    ("ec.stylize.mosaic", "Mosaic", "馬賽克"),
+    ("ec.stylize.motiontile", "Motion Tile", "動態並排"),
+    ("ec.stylize.posterize", "Posterize", "色調分離"),
+    ("ec.stylize.roughenedges", "Roughen Edges", "粗糙邊緣"),
+    ("ec.stylize.scatter", "Scatter", "散佈"),
+    ("ec.stylize.strobe", "Strobe Light", "頻閃光"),
+    ("ec.stylize.texturize", "Texturize", "材質化"),
+    ("ec.stylize.threshold", "Threshold", "臨界值"),
+    ("ec.text.numbers", "Numbers", "數字"),
+    ("ec.text.timecode", "Timecode", "時間碼"),
+    ("ec.time.ccforcemotionblur", "Temporal Motion Blur", "時間動態模糊"),
+    ("ec.time.ccwidetime", "Temporal Blend", "時間混合"),
+    ("ec.time.echo", "Echo", "回音"),
+    ("ec.time.pixelmotionblur", "Pixel Motion Blur", "像素動態模糊"),
+    ("ec.time.posterizetime", "Posterize Time", "色調分離時間"),
+    ("ec.time.timedifference", "Time Difference", "時間差異"),
+    ("ec.time.timedisplacement", "Time Displacement", "時間位移"),
+    ("ec.time.timewarp", "Timewarp", "時間扭曲"),
+    ("ec.transition.blockdissolve", "Block Dissolve", "區塊溶解"),
+    ("ec.transition.cardwipe", "Card Wipe", "卡片擦拭"),
+    ("ec.transition.ccglasswipe", "Glass Wipe", "玻璃擦拭"),
+    ("ec.transition.ccgridwipe", "Grid Wipe", "網格擦拭"),
+    ("ec.transition.ccimagewipe", "Luminance Image Wipe", "亮度影像擦拭"),
+    ("ec.transition.ccjaws", "Serrated Wipe", "鋸齒擦拭"),
+    ("ec.transition.cclightwipe", "Light Wipe", "光線擦拭"),
+    ("ec.transition.cclinesweep", "Line Sweep", "線條掃過"),
+    ("ec.transition.ccradialscalewipe", "Radial Scale Wipe", "放射狀縮放擦拭"),
+    ("ec.transition.ccscalewipe", "Scale Wipe", "縮放擦拭"),
+    ("ec.transition.cctwister", "Twist Wipe", "扭轉擦拭"),
+    ("ec.transition.ccwarpomatic", "Warp Dissolve", "變形溶解"),
+    ("ec.transition.gradientwipe", "Gradient Wipe", "漸層擦拭"),
+    ("ec.transition.iriswipe", "Iris Wipe", "光圈擦拭"),
+    ("ec.transition.linearwipe", "Linear Wipe", "線性擦拭"),
+    ("ec.transition.radialwipe", "Radial Wipe", "徑向擦拭"),
+    ("ec.transition.venetian", "Venetian Blinds", "百葉窗"),
+    ("ec.utility.applylut", "Apply Color LUT", "套用色彩 LUT"),
+    ("ec.utility.ccoverbrights", "Out-of-Range Display", "超出範圍顯示"),
+    ("ec.utility.cineon", "Cineon Converter", "Cineon 轉換器"),
+    ("ec.utility.colorprofileconverter", "Color Profile Converter", "色彩設定檔轉換器"),
+    ("ec.utility.facemeasurements", "Face Measurements", "臉部測量"),
+    ("ec.utility.facetrackpoints", "Face Track Points", "臉部追蹤點"),
+    ("ec.utility.growbounds", "Grow Bounds", "擴展範圍"),
+    ("ec.utility.hdrcompander", "HDR Compander", "HDR 壓縮擴展器"),
+    ("ec.utility.hdrcompression", "HDR Highlight Compression", "HDR 亮部壓縮"),
+    ("ec.vr.blur", "VR Blur", "VR 模糊"),
+    ("ec.vr.chromaticaberrations", "VR Chromatic Aberrations", "VR 色差"),
+    ("ec.vr.colorgradients", "VR Color Gradients", "VR 色彩漸層"),
+    ("ec.vr.converter", "VR Converter", "VR 轉換器"),
+    ("ec.vr.denoise", "VR De-Noise", "VR 降噪"),
+    ("ec.vr.digitalglitch", "VR Digital Glitch", "VR 數位故障"),
+    ("ec.vr.fractalnoise", "VR Fractal Noise", "VR 碎形雜訊"),
+    ("ec.vr.glow", "VR Glow", "VR 發光"),
+    ("ec.vr.planetosphere", "VR Plane to Sphere", "VR 平面轉球體"),
+    ("ec.vr.rotatesphere", "VR Rotate Sphere", "VR 旋轉球體"),
+    ("ec.vr.sharpen", "VR Sharpen", "VR 銳利化"),
+    ("ec.vr.spheretoplane", "VR Sphere to Plane", "VR 球體轉平面"),
+];
 
 /// Japanese (`ja`): reserved for the Japanese data point on #821, so both languages share this
 /// one catalog instead of inventing a second mechanism. A translator fills one row per effect,
-/// ids from [`SIMPLIFIED_CHINESE`]; the names Adobe's Japanese interface leaves in English (the
-/// `CC` series, the `VR` set, the `OCIO` set, `Cryptomatte`, `EXtractoR`, `IDentifier`,
-/// `Key Light`, `Unmult`, `Twirl (Legacy)` and the two EffectCraft-only effects) repeat that
-/// English name here rather than being left out.
+/// ids from [`SIMPLIFIED_CHINESE`]; the names Adobe's Japanese interface leaves in English
+/// (`Cryptomatte`, `EXtractoR`, `IDentifier` and `Key Light`) repeat that English name here rather
+/// than being left out; the `VR` and `OCIO` sets take a Japanese tail instead, and `Unmult` keeps
+/// its English name in both catalogs. An effect with no row draws its English name anyway, which
+/// is what `Twirl (Legacy)` and the two EffectCraft-only effects would do without their rows.
 ///
-/// The rows below were read from the installed After Effects 2026 (26.5) Japanese interface
-/// (its generated Effect menu and its Effects & Presets panel).
+/// The rows of the effects this cleanup did not rename come from AE 2026's Japanese interface
+/// where it was read directly (its Effect menu and its Effects & Presets panel) and from Adobe's
+/// own Japanese help where the panel was not to hand. A published glossary is used to cross-check,
+/// never as the only source: it normalises the typography (half-width parentheses where AE draws
+/// full-width) and still carries CS6-era names for the `CC` series. The renamed effects are
+/// translated from their new descriptive names.
 const JAPANESE_EFFECTS: &[Row] = &[
+    // Effects this application adds itself have no interface to read a name from, so they follow
+    // the Chinese catalog's choice to translate them (顔の測定, 顔のトラッキングポイント) rather than
+    // staying English. Unmult stays English: that is what the interface it comes from shows.
+    ("ec.3d.instance3d", "3D Layer Instance", "3Dレイヤーインスタンス"),
+    ("ec.color.broadcast", "Broadcast Colors", "ブロードキャストカラー"),
+    ("ec.control.stereo3d", "Stereo 3D Controls", "ステレオ3Dコントロール"),
+    ("ec.distort.puppet", "Puppet", "パペット"),
+    ("ec.key.screen", "Screen Key", "スクリーンキー"),
+    ("ec.key.unmult", "Unmult", "Unmult"),
+    ("ec.matte.objectmatte", "Object Matte", "オブジェクトマット"),
+    ("ec.matte.rotobrush", "Roto Brush & Refine Edge", "ロトブラシとエッジの調整"),
+    ("ec.paint.paint", "Paint", "ペイント"),
+    ("ec.utility.facemeasurements", "Face Measurements", "顔の測定"),
+    ("ec.utility.facetrackpoints", "Face Track Points", "顔のトラッキングポイント"),
+    ("ec.3d.channelextract", "3D Channel Extract", "3Dチャンネル抽出"),
+    ("ec.3d.cryptomatte", "Cryptomatte", "Cryptomatte"),
+    ("ec.3d.depthmatte", "Depth Matte", "デプスマット"),
+    ("ec.3d.depthoffield", "Depth of Field", "被写界深度"),
+    ("ec.3d.extractor", "EXtractoR", "EXtractoR"),
+    ("ec.3d.fog3d", "Fog 3D", "フォグ3D"),
+    ("ec.3d.identifier", "IDentifier", "IDentifier"),
+    ("ec.3d.idmatte", "ID Matte", "IDマット"),
+    ("ec.audio.backwards", "Backwards", "リバース"),
+    ("ec.audio.basstreble", "Bass & Treble", "バス&トレブル"),
+    ("ec.audio.compressor", "Compressor", "コンプレッサー"),
+    ("ec.audio.delay", "Delay", "ディレイ"),
+    ("ec.audio.distortion", "Distortion", "歪み"),
+    ("ec.audio.flangechorus", "Flange & Chorus", "フランジ&コーラス"),
+    ("ec.audio.gate", "Gate", "ゲート"),
+    ("ec.audio.highlowpass", "High-Low Pass", "ハイパス／ローパス"),
+    ("ec.audio.modulator", "Modulator", "モジュレーター"),
+    ("ec.audio.parametriceq", "Parametric EQ", "パラメトリックEQ"),
+    ("ec.audio.reverb", "Reverb", "リバーブ"),
+    ("ec.audio.stereomixer", "Stereo Mixer", "ステレオミキサー"),
+    ("ec.audio.tone", "Tone", "トーン"),
     ("ec.blur.bilateral", "Bilateral Blur", "ブラー（バイラテラル）"),
     ("ec.blur.cameralens", "Camera Lens Blur", "ブラー（カメラレンズ）"),
+    ("ec.blur.camerashakedeblur", "Camera-Shake Deblur", "カメラぶれ除去"),
+    ("ec.blur.cccross", "Cross Blur", "十字ぼかし"),
+    ("ec.blur.ccradial", "Variable Radial Blur", "可変放射状ぼかし"),
+    ("ec.blur.ccradialfast", "Fast Radial Blur", "高速放射状ぼかし"),
+    ("ec.blur.ccvector", "Vector Blur", "ベクトルぼかし"),
     ("ec.blur.channel", "Channel Blur", "ブラー（チャンネル）"),
     ("ec.blur.compound", "Compound Blur", "ブラー（合成）"),
     ("ec.blur.directional", "Directional Blur", "ブラー（方向）"),
     ("ec.blur.fastbox", "Fast Box Blur", "高速ボックスブラー"),
     ("ec.blur.gaussian", "Gaussian Blur", "ブラー（ガウス）"),
     ("ec.blur.radial", "Radial Blur", "ブラー（放射状）"),
-    ("ec.color.lumetri", "Lumetri Color", "Lumetri カラー"),
+    ("ec.blur.reduceflicker", "Reduce Interlace Flicker", "インターレースのちらつき削減"),
+    ("ec.blur.sharpen", "Sharpen", "シャープ"),
+    ("ec.blur.smart", "Smart Blur", "ブラー（詳細）"),
+    ("ec.blur.unsharp", "Unsharp Mask", "アンシャープマスク"),
+    ("ec.channel.arithmetic", "Arithmetic", "アリスマチック"),
+    ("ec.channel.blend", "Blend", "ブレンド"),
+    ("ec.channel.calculations", "Calculations", "計算"),
+    ("ec.channel.cccomposite", "Source Composite", "元画像合成"),
+    ("ec.channel.combiner", "Channel Combiner", "チャンネルコンバイナー"),
+    ("ec.channel.compoundarithmetic", "Compound Arithmetic", "合成アリスマチック"),
+    ("ec.channel.invert", "Invert", "反転"),
+    ("ec.channel.minimax", "Minimax", "最大／最小"),
+    ("ec.channel.removecolormatting", "Remove Color Matting", "カラーマット削除"),
+    ("ec.channel.setchannels", "Set Channels", "チャンネル設定"),
+    ("ec.channel.setmatte", "Set Matte", "マット設定"),
+    ("ec.channel.shiftchannels", "Shift Channels", "チャンネルシフト"),
+    ("ec.channel.solidcomposite", "Solid Composite", "単色合成"),
+    ("ec.color.autocolor", "Auto Color", "自動カラー補正"),
+    ("ec.color.autocontrast", "Auto Contrast", "自動コントラスト"),
+    ("ec.color.autolevels", "Auto Levels", "自動レベル補正"),
+    ("ec.color.blackwhite", "Black & White", "白黒"),
+    ("ec.color.brightnesscontrast", "Brightness & Contrast", "輝度&コントラスト"),
+    ("ec.color.cccolorneutralizer", "Color Neutralizer", "色かぶり補正"),
+    ("ec.color.cccoloroffset", "Channel Offset", "チャンネルオフセット"),
+    ("ec.color.cckernel", "Convolution Kernel", "畳み込みカーネル"),
+    ("ec.color.cctoner", "Multi-Tone Tint", "多色調ティント"),
+    ("ec.color.changecolor", "Change Color", "色を変更"),
+    ("ec.color.changetocolor", "Change to Color", "他のカラーへ変更"),
+    ("ec.color.channelmixer", "Channel Mixer", "チャンネルミキサー"),
+    ("ec.color.colorama", "Colorama", "コロラマ"),
+    ("ec.color.colorbalance", "Color Balance", "カラーバランス"),
+    ("ec.color.colorbalancehls", "Color Balance (HLS)", "カラーバランス（HLS）"),
+    ("ec.color.colorlink", "Color Link", "カラーリンク"),
+    ("ec.color.colorstabilizer", "Color Stabilizer", "カラースタビライザー"),
+    ("ec.color.curves", "Curves", "トーンカーブ"),
+    ("ec.color.equalize", "Equalize", "平均化（イコライズ）"),
+    ("ec.color.exposure", "Exposure", "露光量"),
+    ("ec.color.gammapedestalgain", "Gamma/Pedestal/Gain", "ガンマ／ペデスタル／ゲイン"),
+    ("ec.color.huesaturation", "Hue/Saturation", "色相／彩度"),
+    ("ec.color.leavecolor", "Leave Color", "色抜き"),
+    ("ec.color.levels", "Levels", "レベル補正"),
+    ("ec.color.levelsic", "Levels (Individual Controls)", "レベル（個々の制御）"),
+    ("ec.color.lumetri", "Color Grading", "カラーグレーディング"),
+    ("ec.color.ociocdl", "OCIO CDL Transform", "OCIO CDL 変換"),
+    ("ec.color.ociocolorspace", "OCIO Color Space Transform", "OCIO 色空間変換"),
+    ("ec.color.ociodisplay", "OCIO Display Transform", "OCIO 表示変換"),
+    ("ec.color.ociofile", "OCIO File Transform", "OCIO ファイル変換"),
+    ("ec.color.ociolook", "OCIO Look Transform", "OCIO Look トランスフォーム"),
+    ("ec.color.photofilter", "Photo Filter", "レンズフィルター"),
+    ("ec.color.psarbitrarymap", "PS Arbitrary Map", "PS不定マップ"),
+    ("ec.color.selectivecolor", "Selective Color", "特定色域の選択"),
+    ("ec.color.shadowhighlight", "Shadow/Highlight", "シャドウ・ハイライト"),
+    ("ec.color.tint", "Tint", "着色"),
+    ("ec.color.tritone", "Tritone", "トライトーン"),
+    ("ec.color.vibrance", "Vibrance", "自然な彩度"),
+    ("ec.color.videolimiter", "Video Limiter", "ビデオリミッター"),
+    ("ec.control.angle", "Angle Control", "角度制御"),
+    ("ec.control.checkbox", "Checkbox Control", "チェックボックス制御"),
+    ("ec.control.color", "Color Control", "カラー制御"),
+    ("ec.control.dropdown", "Dropdown Menu Control", "ドロップダウンメニュー制御"),
+    ("ec.control.layer", "Layer Control", "レイヤー制御"),
+    ("ec.control.point", "Point Control", "ポイント制御"),
+    ("ec.control.point3d", "3D Point Control", "3D ポイント制御"),
+    ("ec.control.slider", "Slider Control", "スライダー制御"),
+    ("ec.distort.bezierwarp", "Bezier Warp", "ベジェワープ"),
+    ("ec.distort.bulge", "Bulge", "バルジ"),
+    ("ec.distort.ccbender", "Flexible Bend", "柔軟ベンド"),
+    ("ec.distort.ccbendit", "Two-Point Bend", "2点ベンド"),
+    ("ec.distort.ccblobbylize", "Organic Displacement", "有機変位"),
+    ("ec.distort.ccflomotion", "Dual Lens Warp", "ダブルレンズ変形"),
+    ("ec.distort.ccgriddler", "Tile Grid", "タイルグリッド"),
+    ("ec.distort.cclens", "Lens Distortion", "レンズ歪み"),
+    ("ec.distort.ccpageturn", "Page Curl", "ページカール"),
+    ("ec.distort.ccpowerpin", "Perspective Pin", "遠近ピン"),
+    ("ec.distort.ccripplepulse", "Pulsed Ripple", "パルス波紋"),
+    ("ec.distort.ccslant", "Slant", "傾斜"),
+    ("ec.distort.ccsmear", "Directional Smear", "方向性にじみ"),
+    ("ec.distort.ccsplit", "Split Warp", "分割変形"),
+    ("ec.distort.ccsplit2", "Dual Split Warp", "二重分割変形"),
+    ("ec.distort.cctiler", "Scaled Tiles", "スケールタイル"),
+    ("ec.distort.cornerpin", "Corner Pin", "コーナーピン"),
+    ("ec.distort.displacementmap", "Displacement Map", "ディスプレイスメントマップ"),
+    ("ec.distort.liquify", "Liquify", "ゆがみ"),
+    ("ec.distort.magnify", "Magnify", "ズーム"),
+    ("ec.distort.meshwarp", "Mesh Warp", "メッシュワープ"),
+    ("ec.distort.mirror", "Mirror", "ミラー"),
+    ("ec.distort.offset", "Offset", "オフセット"),
+    ("ec.distort.opticscompensation", "Optics Compensation", "レンズ補正"),
+    ("ec.distort.polar", "Polar Coordinates", "極座標"),
+    ("ec.distort.reshape", "Reshape", "リシェープ"),
+    ("ec.distort.ripple", "Ripple", "波紋"),
+    ("ec.distort.rollingshutterrepair", "Rolling Shutter Repair", "ローリングシャッターの修復"),
+    ("ec.distort.smear", "Smear", "にじみ"),
+    ("ec.distort.spherize", "Spherize", "球面"),
+    ("ec.distort.transform", "Transform", "トランスフォーム"),
+    ("ec.distort.turbulentdisplace", "Turbulent Displace", "タービュレントディスプレイス"),
+    ("ec.distort.twirl", "Twirl", "回転"),
+    ("ec.distort.twirllegacy", "Twirl (Legacy)", "Twirl (Legacy)"),
+    ("ec.distort.upscale", "Detail-preserving Upscale", "アップスケール（詳細を保持）"),
+    ("ec.distort.warp", "Warp", "ワープ"),
+    ("ec.distort.warpstabilizer", "Warp Stabilizer", "ワープスタビライザー"),
+    ("ec.distort.wavewarp", "Wave Warp", "波形ワープ"),
+    ("ec.generate.advancedlightning", "Advanced Lightning", "稲妻(高度)"),
+    ("ec.generate.audiospectrum", "Audio Spectrum", "オーディオスペクトラム"),
+    ("ec.generate.audiowaveform", "Audio Waveform", "オーディオウェーブフォーム"),
+    ("ec.generate.beam", "Beam", "レーザー"),
+    ("ec.generate.ccgluegun", "Paint Beads", "絵の具の粒"),
+    ("ec.generate.cclightburst", "Radial Light Burst", "放射状の光"),
+    ("ec.generate.cclightrays", "Light Rays", "光線"),
+    ("ec.generate.cclightsweep", "Light Sweep", "光のスイープ"),
+    ("ec.generate.ccthreads", "Woven Threads", "織り糸"),
+    ("ec.generate.cellpattern", "Cell Pattern", "セルパターン"),
+    ("ec.generate.checkerboard", "Checkerboard", "チェッカーボード"),
+    ("ec.generate.circle", "Circle", "円"),
+    ("ec.generate.ellipse", "Ellipse", "楕円"),
+    ("ec.generate.eyedropperfill", "Eyedropper Fill", "スポイト塗り"),
+    ("ec.generate.fill", "Fill", "塗り"),
+    ("ec.generate.fourcolor", "4-Color Gradient", "4色グラデーション"),
+    ("ec.generate.fractal", "Fractal", "フラクタル"),
+    ("ec.generate.gradientramp", "Gradient Ramp", "グラデーション"),
+    ("ec.generate.grid", "Grid", "グリッド"),
+    ("ec.generate.lensflare", "Lens Flare", "レンズフレア"),
+    ("ec.generate.paintbucket", "Paint Bucket", "塗りつぶし"),
+    ("ec.generate.radiowaves", "Radio Waves", "電波"),
+    ("ec.generate.scribble", "Scribble", "落書き"),
+    ("ec.generate.stroke", "Stroke", "線"),
+    ("ec.generate.vegas", "Vegas", "ベガス"),
+    ("ec.generate.writeon", "Write-on", "ブラシアニメーション"),
+    ("ec.key.advancedspill", "Advanced Spill Suppressor", "Advanced Spill Suppressor"),
+    ("ec.key.ccsimplewireremoval", "Line Removal", "ライン除去"),
+    ("ec.key.colordifference", "Color Difference Key", "カラー差キー"),
     ("ec.key.colorkey", "Color Key", "カラーキー"),
+    ("ec.key.colorrange", "Color Range", "色範囲"),
+    ("ec.key.differencematte", "Difference Matte", "異なるマット"),
+    ("ec.key.extract", "Extract", "抽出"),
+    ("ec.key.innerouter", "Inner/Outer Key", "インナー／アウターキー"),
+    ("ec.key.keycleaner", "Key Cleaner", "Key Cleaner"),
+    ("ec.key.linearcolor", "Linear Color Key", "リニアカラーキー"),
     ("ec.key.luma", "Luma Key", "ルミナンスキー"),
     ("ec.key.spill", "Spill Suppressor", "スピルサプレッション"),
-    ("ec.obsolete.basic3d", "Basic 3D", "基本 3D"),
+    ("ec.keying.keylight", "Screen Color Key", "スクリーンカラーキー"),
+    ("ec.matte.mattechoker", "Matte Choker", "マットチョーク"),
+    ("ec.matte.refinehard", "Refine Hard Matte", "ハードマットを調整"),
+    ("ec.matte.refinesoft", "Refine Soft Matte", "ソフトマットを調整"),
+    ("ec.matte.simplechoker", "Simple Choker", "チョーク"),
+    ("ec.noise.addgrain", "Add Grain", "グレイン（追加）"),
+    ("ec.noise.curlnoise", "Curl Noise", "カールノイズ"),
+    ("ec.noise.dustscratches", "Dust & Scratches", "ダスト&スクラッチ"),
+    ("ec.noise.fractal", "Fractal Noise", "フラクタルノイズ"),
+    ("ec.noise.matchgrain", "Match Grain", "グレイン（マッチ）"),
+    ("ec.noise.median", "Median", "ミディアン"),
+    ("ec.noise.medianlegacy", "Median (Legacy)", "ミディアン（レガシー）"),
+    ("ec.noise.noise", "Noise", "ノイズ"),
+    ("ec.noise.noisealpha", "Noise Alpha", "ノイズアルファ"),
+    ("ec.noise.noisehls", "Noise HLS", "ノイズHLS"),
+    ("ec.noise.noisehlsauto", "Noise HLS Auto", "ノイズHLSオート"),
+    ("ec.noise.removegrain", "Remove Grain", "グレイン（除去）"),
+    ("ec.noise.turbulent", "Turbulent Noise", "タービュレントノイズ"),
+    ("ec.obsolete.basic3d", "Basic 3D", "基本3D"),
     ("ec.obsolete.basictext", "Basic Text", "基本テキスト"),
     ("ec.obsolete.gaussianlegacy", "Gaussian Blur (Legacy)", "ブラー（ガウス）（レガシー）"),
     ("ec.obsolete.lightning", "Lightning", "稲妻"),
+    ("ec.obsolete.mochashape", "Tracked Shape Matte", "トラッキングシェイプマット"),
     ("ec.obsolete.pathtext", "Path Text", "パステキスト"),
+    ("ec.perspective.3dglasses", "3D Glasses", "3Dメガネ"),
+    ("ec.perspective.bevelalpha", "Bevel Alpha", "ベベルアルファ"),
+    ("ec.perspective.beveledges", "Bevel Edges", "ベベルエッジ"),
+    ("ec.perspective.cameratracker", "3D Camera Tracker", "3D カメラトラッカー"),
+    ("ec.perspective.cccylinder", "Cylinder Wrap", "円筒ラップ"),
+    ("ec.perspective.ccenvironment", "Environment Map", "環境マップ"),
+    ("ec.perspective.ccsphere", "Sphere Wrap", "球面ラップ"),
+    ("ec.perspective.ccspotlight", "Surface Spotlight", "表面スポットライト"),
+    ("ec.perspective.dropshadow", "Drop Shadow", "ドロップシャドウ"),
+    ("ec.perspective.radialshadow", "Radial Shadow", "放射状シャドウ"),
+    ("ec.sim.carddance", "Card Dance", "カードダンス"),
+    ("ec.sim.caustics", "Caustics", "コースティック"),
+    ("ec.sim.ccballaction", "Ball Grid", "球体グリッド"),
+    ("ec.sim.ccbubbles", "Bubbles", "気泡"),
+    ("ec.sim.ccdrizzle", "Water Ripples", "水面の波紋"),
+    ("ec.sim.cchair", "Surface Fibers", "表面の繊維"),
+    ("ec.sim.ccmrmercury", "Liquid Particles", "液体パーティクル"),
+    ("ec.sim.ccparticlesystems2", "Particle Emitter 2D", "2Dパーティクルエミッター"),
+    ("ec.sim.ccparticleworld", "Particle Emitter 3D", "3Dパーティクルエミッター"),
+    ("ec.sim.ccpixelpolly", "Pixel Shatter", "ピクセル破砕"),
+    ("ec.sim.ccrainfall", "Rainfall", "雨"),
+    ("ec.sim.ccscatterize", "Pixel Scatter", "ピクセル散乱"),
+    ("ec.sim.ccsnowfall", "Snowfall", "雪"),
+    ("ec.sim.ccstarburst", "Starfield", "星空"),
+    ("ec.sim.foam", "Foam", "泡"),
+    ("ec.sim.particleplayground", "Particle Playground", "パーティクルプレイグラウンド"),
+    ("ec.sim.shatter", "Shatter", "シャター"),
+    ("ec.sim.waveworld", "Wave World", "ウェーブワールド"),
+    ("ec.stylize.brushstrokes", "Brush Strokes", "ブラシストローク"),
+    ("ec.stylize.cartoon", "Cartoon", "カートゥーン"),
+    ("ec.stylize.ccblockload", "Block Reveal", "ブロック表示"),
+    ("ec.stylize.ccburnfilm", "Film Burn", "フィルム焼け"),
+    ("ec.stylize.ccglass", "Glass Relief", "ガラスレリーフ"),
+    ("ec.stylize.cchextile", "Hexagonal Tiles", "六角形タイル"),
+    ("ec.stylize.cckaleida", "Kaleidoscope", "万華鏡"),
+    ("ec.stylize.ccmrsmoothie", "Palette Map", "パレットマップ"),
+    ("ec.stylize.ccplastic", "Plastic Shading", "プラスチックシェーディング"),
+    ("ec.stylize.ccrepetile", "Edge Tile Repeat", "エッジタイル反復"),
+    ("ec.stylize.ccthreshold", "Channel Threshold", "チャンネルしきい値"),
+    ("ec.stylize.ccthresholdrgb", "RGB Threshold", "RGBしきい値"),
+    ("ec.stylize.ccvignette", "Vignette", "ビネット"),
+    ("ec.stylize.coloremboss", "Color Emboss", "カラーエンボス"),
+    ("ec.stylize.emboss", "Emboss", "エンボス"),
+    ("ec.stylize.findedges", "Find Edges", "輪郭検出"),
+    ("ec.stylize.glow", "Glow", "グロー"),
+    ("ec.stylize.mosaic", "Mosaic", "モザイク"),
+    ("ec.stylize.motiontile", "Motion Tile", "モーションタイル"),
+    ("ec.stylize.posterize", "Posterize", "ポスタリゼーション"),
+    ("ec.stylize.roughenedges", "Roughen Edges", "ラフエッジ"),
+    ("ec.stylize.scatter", "Scatter", "拡散"),
+    ("ec.stylize.strobe", "Strobe Light", "ストロボ"),
+    ("ec.stylize.texturize", "Texturize", "テクスチャ"),
+    ("ec.stylize.threshold", "Threshold", "しきい値"),
+    ("ec.text.numbers", "Numbers", "番号"),
+    ("ec.text.timecode", "Timecode", "タイムコード"),
+    ("ec.time.ccforcemotionblur", "Temporal Motion Blur", "時間方向モーションブラー"),
+    ("ec.time.ccwidetime", "Temporal Blend", "時間ブレンド"),
+    ("ec.time.echo", "Echo", "エコー"),
     ("ec.time.pixelmotionblur", "Pixel Motion Blur", "ピクセルモーションブラー"),
+    ("ec.time.posterizetime", "Posterize Time", "ポスタリゼーション時間"),
+    ("ec.time.timedifference", "Time Difference", "時間差"),
+    ("ec.time.timedisplacement", "Time Displacement", "時間置き換え"),
+    ("ec.time.timewarp", "Timewarp", "タイムワープ"),
+    ("ec.transition.blockdissolve", "Block Dissolve", "ブロックディゾルブ"),
+    ("ec.transition.cardwipe", "Card Wipe", "カードワイプ"),
+    ("ec.transition.ccglasswipe", "Glass Wipe", "ガラスワイプ"),
+    ("ec.transition.ccgridwipe", "Grid Wipe", "グリッドワイプ"),
+    ("ec.transition.ccimagewipe", "Luminance Image Wipe", "輝度画像ワイプ"),
+    ("ec.transition.ccjaws", "Serrated Wipe", "鋸歯状ワイプ"),
+    ("ec.transition.cclightwipe", "Light Wipe", "ライトワイプ"),
+    ("ec.transition.cclinesweep", "Line Sweep", "ラインスイープ"),
+    ("ec.transition.ccradialscalewipe", "Radial Scale Wipe", "放射状スケールワイプ"),
+    ("ec.transition.ccscalewipe", "Scale Wipe", "スケールワイプ"),
+    ("ec.transition.cctwister", "Twist Wipe", "ツイストワイプ"),
+    ("ec.transition.ccwarpomatic", "Warp Dissolve", "変形ディゾルブ"),
+    ("ec.transition.gradientwipe", "Gradient Wipe", "グラデーションワイプ"),
+    ("ec.transition.iriswipe", "Iris Wipe", "アイリスワイプ"),
+    ("ec.transition.linearwipe", "Linear Wipe", "リニアワイプ"),
+    ("ec.transition.radialwipe", "Radial Wipe", "放射状ワイプ"),
+    ("ec.transition.venetian", "Venetian Blinds", "ブラインド"),
+    ("ec.utility.applylut", "Apply Color LUT", "カラー LUT を適用"),
+    ("ec.utility.ccoverbrights", "Out-of-Range Display", "範囲外表示"),
+    ("ec.utility.cineon", "Cineon Converter", "Cineon コンバーター"),
+    ("ec.utility.colorprofileconverter", "Color Profile Converter", "カラープロファイルコンバーター"),
+    ("ec.utility.growbounds", "Grow Bounds", "範囲拡張"),
+    ("ec.utility.hdrcompander", "HDR Compander", "HDR コンパンダー"),
+    ("ec.utility.hdrcompression", "HDR Highlight Compression", "HDR ハイライト圧縮"),
+    ("ec.vr.blur", "VR Blur", "VR ブラー"),
+    ("ec.vr.chromaticaberrations", "VR Chromatic Aberrations", "VR 色収差"),
+    ("ec.vr.colorgradients", "VR Color Gradients", "VR カラーグラデーション"),
+    ("ec.vr.converter", "VR Converter", "VR コンバーター"),
+    ("ec.vr.denoise", "VR De-Noise", "VR ノイズ除去"),
+    ("ec.vr.digitalglitch", "VR Digital Glitch", "VR デジタルグリッチ"),
+    ("ec.vr.fractalnoise", "VR Fractal Noise", "VR フラクタルノイズ"),
+    ("ec.vr.glow", "VR Glow", "VR グロー"),
+    ("ec.vr.planetosphere", "VR Plane to Sphere", "VR 平面として投影"),
+    ("ec.vr.rotatesphere", "VR Rotate Sphere", "VR 回転（球）"),
+    ("ec.vr.sharpen", "VR Sharpen", "VR シャープ"),
+    ("ec.vr.spheretoplane", "VR Sphere to Plane", "VR 球体から平面"),
 ];
 
-/// Traditional Chinese (`zh-hant`) category labels, keyed by the registry's English category.
-const TRADITIONAL_CHINESE_CATEGORIES: &[(&str, &str)] = &[];
+/// The 21 category folder names in Traditional Chinese, written from the English source with the
+/// vocabulary Taiwan's creative software uses; the labels stay distinct so the Effect menu shows
+/// one folder per category.
+const TRADITIONAL_CHINESE_CATEGORIES: &[(&str, &str)] = &[
+    ("3D Channel", "3D 通道"),
+    ("Audio", "音訊"),
+    ("Blur & Sharpen", "模糊與銳利化"),
+    ("Channel", "通道"),
+    ("Color Correction", "色彩校正"),
+    ("Distort", "扭曲"),
+    ("Expression Controls", "表示式控制"),
+    ("Generate", "產生"),
+    ("Immersive Video", "沉浸式影片"),
+    ("Keying", "去背"),
+    ("Matte", "遮罩"),
+    ("Noise & Grain", "雜訊與顆粒"),
+    ("Obsolete", "過時"),
+    ("Paint", "繪畫"),
+    ("Perspective", "透視"),
+    ("Simulation", "模擬"),
+    ("Stylize", "風格化"),
+    ("Text", "文字"),
+    ("Time", "時間"),
+    ("Transition", "轉場"),
+    ("Utility", "公用程式"),
+];
 
 /// Japanese (`ja`) category labels, keyed by the registry's English category.
 const JAPANESE_CATEGORIES: &[(&str, &str)] = &[
@@ -475,12 +1165,13 @@ const JAPANESE_CATEGORIES: &[(&str, &str)] = &[
     ("Color Correction", "カラー補正"),
     ("Distort", "ディストーション"),
     ("Expression Controls", "式制御"),
+    ("Generate", "描画"),
     ("Immersive Video", "イマーシブビデオ"),
     ("Keying", "キーイング"),
     ("Matte", "マット"),
     ("Noise & Grain", "ノイズ＆グレイン"),
     ("Obsolete", "旧バージョン"),
-    ("Paint", "描画"),
+    ("Paint", "ペイント"),
     ("Perspective", "遠近"),
     ("Simulation", "シミュレーション"),
     ("Stylize", "スタイライズ"),
@@ -490,6 +1181,687 @@ const JAPANESE_CATEGORIES: &[(&str, &str)] = &[
     ("Utility", "ユーティリティ"),
 ];
 
+/// Georgian (`ka`): one row per effect, ids from [`SIMPLIFIED_CHINESE`]. Written from the meaning
+/// of the English names, with the terms the Georgian menus and panels use (FilmCraft's Georgian
+/// for the effects the two apps share). The brand names (`Cryptomatte`, `EXtractoR`, `IDentifier`,
+/// `Key Light`, `Unmult`) stay in English; `VR` and `OCIO` keep their prefix. The renamed effects
+/// are translated from their new descriptive names.
+const GEORGIAN: &[Row] = &[
+    ("ec.3d.channelextract", "3D Channel Extract", "3D არხის ამოღება"),
+    ("ec.3d.cryptomatte", "Cryptomatte", "Cryptomatte"),
+    ("ec.3d.depthmatte", "Depth Matte", "სიღრმის მატი"),
+    ("ec.3d.depthoffield", "Depth of Field", "ველის სიღრმე"),
+    ("ec.3d.extractor", "EXtractoR", "EXtractoR"),
+    ("ec.3d.fog3d", "Fog 3D", "3D ნისლი"),
+    ("ec.3d.identifier", "IDentifier", "IDentifier"),
+    ("ec.3d.idmatte", "ID Matte", "ID მატი"),
+    ("ec.3d.instance3d", "3D Layer Instance", "3D Layer Instance"),
+    ("ec.audio.backwards", "Backwards", "უკუღმა"),
+    ("ec.audio.basstreble", "Bass & Treble", "ბასი და ტრებლი"),
+    ("ec.audio.compressor", "Compressor", "კომპრესორი"),
+    ("ec.audio.delay", "Delay", "დაყოვნება"),
+    ("ec.audio.distortion", "Distortion", "დამახინჯება"),
+    ("ec.audio.flangechorus", "Flange & Chorus", "ფლენჯერი და ქორუსი"),
+    ("ec.audio.gate", "Gate", "გეიტი"),
+    ("ec.audio.highlowpass", "High-Low Pass", "მაღალი/დაბალი სიხშირეების ფილტრი"),
+    ("ec.audio.modulator", "Modulator", "მოდულატორი"),
+    ("ec.audio.parametriceq", "Parametric EQ", "პარამეტრული ეკვალაიზერი"),
+    ("ec.audio.reverb", "Reverb", "რევერბი"),
+    ("ec.audio.stereomixer", "Stereo Mixer", "სტერეომიქშერი"),
+    ("ec.audio.tone", "Tone", "ტონი"),
+    ("ec.blur.bilateral", "Bilateral Blur", "ბილატერალური გაბუნდოვნება"),
+    ("ec.blur.cameralens", "Camera Lens Blur", "კამერის ობიექტივის გაბუნდოვნება"),
+    ("ec.blur.camerashakedeblur", "Camera-Shake Deblur", "კამერის რყევით გაბუნდოვნების მოცილება"),
+    ("ec.blur.cccross", "Cross Blur", "ჯვარედინი დაბინდვა"),
+    ("ec.blur.ccradial", "Variable Radial Blur", "ცვლადი რადიალური დაბინდვა"),
+    ("ec.blur.ccradialfast", "Fast Radial Blur", "სწრაფი რადიალური დაბინდვა"),
+    ("ec.blur.ccvector", "Vector Blur", "ვექტორული დაბინდვა"),
+    ("ec.blur.channel", "Channel Blur", "არხის გაბუნდოვნება"),
+    ("ec.blur.compound", "Compound Blur", "შედგენილი გაბუნდოვნება"),
+    ("ec.blur.directional", "Directional Blur", "მიმართული გაბუნდოვნება"),
+    ("ec.blur.fastbox", "Fast Box Blur", "სწრაფი ბლოკური გაბუნდოვნება"),
+    ("ec.blur.gaussian", "Gaussian Blur", "გაუსის გაბუნდოვნება"),
+    ("ec.blur.radial", "Radial Blur", "რადიალური გაბუნდოვნება"),
+    ("ec.blur.reduceflicker", "Reduce Interlace Flicker", "ნახევარკადრული ციმციმის შემცირება"),
+    ("ec.blur.sharpen", "Sharpen", "სიმკვეთრე"),
+    ("ec.blur.smart", "Smart Blur", "ჭკვიანი გაბუნდოვნება"),
+    ("ec.blur.unsharp", "Unsharp Mask", "არამკვეთრი ნიღაბი"),
+    ("ec.channel.arithmetic", "Arithmetic", "არითმეტიკა"),
+    ("ec.channel.blend", "Blend", "შერევა"),
+    ("ec.channel.calculations", "Calculations", "გამოთვლები"),
+    ("ec.channel.cccomposite", "Source Composite", "წყაროს კომპოზიცია"),
+    ("ec.channel.combiner", "Channel Combiner", "არხების გამაერთიანებელი"),
+    ("ec.channel.compoundarithmetic", "Compound Arithmetic", "შედგენილი არითმეტიკა"),
+    ("ec.channel.invert", "Invert", "ინვერსია"),
+    ("ec.channel.minimax", "Minimax", "მინიმაქსი"),
+    ("ec.channel.removecolormatting", "Remove Color Matting", "ფერადი მატინგის მოცილება"),
+    ("ec.channel.setchannels", "Set Channels", "არხების დაყენება"),
+    ("ec.channel.setmatte", "Set Matte", "მატის დაყენება"),
+    ("ec.channel.shiftchannels", "Shift Channels", "არხების გადანაცვლება"),
+    ("ec.channel.solidcomposite", "Solid Composite", "სოლიდთან კომპოზიტი"),
+    ("ec.color.autocolor", "Auto Color", "ავტოფერი"),
+    ("ec.color.autocontrast", "Auto Contrast", "ავტოკონტრასტი"),
+    ("ec.color.autolevels", "Auto Levels", "ავტოდონეები"),
+    ("ec.color.blackwhite", "Black & White", "შავ-თეთრი"),
+    ("ec.color.brightnesscontrast", "Brightness & Contrast", "სიკაშკაშე და კონტრასტი"),
+    ("ec.color.broadcast", "Broadcast Colors", "სამაუწყებლო ფერები"),
+    ("ec.color.cccolorneutralizer", "Color Neutralizer", "ფერის ნეიტრალიზაცია"),
+    ("ec.color.cccoloroffset", "Channel Offset", "არხების წანაცვლება"),
+    ("ec.color.cckernel", "Convolution Kernel", "კონვოლუციის ბირთვი"),
+    ("ec.color.cctoner", "Multi-Tone Tint", "მრავალტონიანი შეფერილობა"),
+    ("ec.color.changecolor", "Change Color", "ფერის შეცვლა"),
+    ("ec.color.changetocolor", "Change to Color", "ფერად შეცვლა"),
+    ("ec.color.channelmixer", "Channel Mixer", "არხების მიქშერი"),
+    ("ec.color.colorama", "Colorama", "კოლორამა"),
+    ("ec.color.colorbalance", "Color Balance", "ფერთა ბალანსი"),
+    ("ec.color.colorbalancehls", "Color Balance (HLS)", "ფერთა ბალანსი (HLS)"),
+    ("ec.color.colorlink", "Color Link", "ფერის ბმა"),
+    ("ec.color.colorstabilizer", "Color Stabilizer", "ფერის სტაბილიზატორი"),
+    ("ec.color.curves", "Curves", "მრუდები"),
+    ("ec.color.equalize", "Equalize", "გათანაბრება"),
+    ("ec.color.exposure", "Exposure", "ექსპოზიცია"),
+    ("ec.color.gammapedestalgain", "Gamma/Pedestal/Gain", "გამა/საფეხური/გაძლიერება"),
+    ("ec.color.huesaturation", "Hue/Saturation", "ფერის ტონი/გაჯერება"),
+    ("ec.color.leavecolor", "Leave Color", "ფერის დატოვება"),
+    ("ec.color.levels", "Levels", "დონეები"),
+    ("ec.color.levelsic", "Levels (Individual Controls)", "დონეები (ცალკეული მართვა)"),
+    ("ec.color.lumetri", "Color Grading", "ფერთა კორექცია"),
+    ("ec.color.ociocdl", "OCIO CDL Transform", "OCIO CDL გარდაქმნა"),
+    ("ec.color.ociocolorspace", "OCIO Color Space Transform", "OCIO ფერთა სივრცის გარდაქმნა"),
+    ("ec.color.ociodisplay", "OCIO Display Transform", "OCIO ეკრანის გარდაქმნა"),
+    ("ec.color.ociofile", "OCIO File Transform", "OCIO ფაილის გარდაქმნა"),
+    ("ec.color.ociolook", "OCIO Look Transform", "OCIO ვიზუალური სტილის გარდაქმნა"),
+    ("ec.color.photofilter", "Photo Filter", "ფოტოფილტრი"),
+    ("ec.color.psarbitrarymap", "PS Arbitrary Map", "PS ნებისმიერი რუკა"),
+    ("ec.color.selectivecolor", "Selective Color", "შერჩევითი ფერი"),
+    ("ec.color.shadowhighlight", "Shadow/Highlight", "ჩრდილები/ღია ტონები"),
+    ("ec.color.tint", "Tint", "ტონირება"),
+    ("ec.color.tritone", "Tritone", "სამტონიანი"),
+    ("ec.color.vibrance", "Vibrance", "სიხალასე"),
+    ("ec.color.videolimiter", "Video Limiter", "ვიდეოლიმიტერი"),
+    ("ec.control.angle", "Angle Control", "კუთხის მართვა"),
+    ("ec.control.checkbox", "Checkbox Control", "მოსანიშნი ველის მართვა"),
+    ("ec.control.color", "Color Control", "ფერის მართვა"),
+    ("ec.control.dropdown", "Dropdown Menu Control", "ჩამოსაშლელი მენიუს მართვა"),
+    ("ec.control.layer", "Layer Control", "შრის მართვა"),
+    ("ec.control.point", "Point Control", "წერტილის მართვა"),
+    ("ec.control.point3d", "3D Point Control", "3D წერტილის მართვა"),
+    ("ec.control.slider", "Slider Control", "სლაიდერის მართვა"),
+    ("ec.control.stereo3d", "Stereo 3D Controls", "სტერეო 3D მართვა"),
+    ("ec.distort.bezierwarp", "Bezier Warp", "ბეზიეს დეფორმაცია"),
+    ("ec.distort.bulge", "Bulge", "გამობერილობა"),
+    ("ec.distort.ccbender", "Flexible Bend", "მოქნილი მოღუნვა"),
+    ("ec.distort.ccbendit", "Two-Point Bend", "ორწერტილიანი მოღუნვა"),
+    ("ec.distort.ccblobbylize", "Organic Displacement", "ორგანული გადაადგილება"),
+    ("ec.distort.ccflomotion", "Dual Lens Warp", "ორმაგი ლინზით დეფორმაცია"),
+    ("ec.distort.ccgriddler", "Tile Grid", "ფილების ბადე"),
+    ("ec.distort.cclens", "Lens Distortion", "ლინზის დამახინჯება"),
+    ("ec.distort.ccpageturn", "Page Curl", "გვერდის დახვევა"),
+    ("ec.distort.ccpowerpin", "Perspective Pin", "პერსპექტიული დამაგრება"),
+    ("ec.distort.ccripplepulse", "Pulsed Ripple", "პულსური ტალღა"),
+    ("ec.distort.ccslant", "Slant", "დახრა"),
+    ("ec.distort.ccsmear", "Directional Smear", "მიმართულებითი გაწელვა"),
+    ("ec.distort.ccsplit", "Split Warp", "გაყოფილი დეფორმაცია"),
+    ("ec.distort.ccsplit2", "Dual Split Warp", "ორმაგად გაყოფილი დეფორმაცია"),
+    ("ec.distort.cctiler", "Scaled Tiles", "მასშტაბირებული ფილები"),
+    ("ec.distort.cornerpin", "Corner Pin", "კუთხეების მიმაგრება"),
+    ("ec.distort.displacementmap", "Displacement Map", "წანაცვლების რუკა"),
+    ("ec.distort.liquify", "Liquify", "გათხევადება"),
+    ("ec.distort.magnify", "Magnify", "გადიდება"),
+    ("ec.distort.meshwarp", "Mesh Warp", "ბადისებრი დეფორმაცია"),
+    ("ec.distort.mirror", "Mirror", "სარკე"),
+    ("ec.distort.offset", "Offset", "წანაცვლება"),
+    ("ec.distort.opticscompensation", "Optics Compensation", "ოპტიკის კომპენსაცია"),
+    ("ec.distort.polar", "Polar Coordinates", "პოლარული კოორდინატები"),
+    ("ec.distort.puppet", "Puppet", "მარიონეტი"),
+    ("ec.distort.reshape", "Reshape", "ფორმის შეცვლა"),
+    ("ec.distort.ripple", "Ripple", "ტალღა"),
+    ("ec.distort.rollingshutterrepair", "Rolling Shutter Repair", "მცოცავი ჩამკეტის გასწორება"),
+    ("ec.distort.smear", "Smear", "გადღაბნა"),
+    ("ec.distort.spherize", "Spherize", "სფერიზება"),
+    ("ec.distort.transform", "Transform", "გარდაქმნა"),
+    ("ec.distort.turbulentdisplace", "Turbulent Displace", "ტურბულენტური წანაცვლება"),
+    ("ec.distort.twirl", "Twirl", "გრიგალი"),
+    ("ec.distort.twirllegacy", "Twirl (Legacy)", "გრიგალი (მოძველებული)"),
+    ("ec.distort.upscale", "Detail-preserving Upscale", "გადიდება დეტალების შენარჩუნებით"),
+    ("ec.distort.warp", "Warp", "დეფორმაცია"),
+    ("ec.distort.warpstabilizer", "Warp Stabilizer", "დეფორმაციის სტაბილიზატორი"),
+    ("ec.distort.wavewarp", "Wave Warp", "ტალღური დეფორმაცია"),
+    ("ec.generate.advancedlightning", "Advanced Lightning", "გაფართოებული ელვა"),
+    ("ec.generate.audiospectrum", "Audio Spectrum", "აუდიოს სპექტრი"),
+    ("ec.generate.audiowaveform", "Audio Waveform", "აუდიოს ტალღის ფორმა"),
+    ("ec.generate.beam", "Beam", "სხივი"),
+    ("ec.generate.ccgluegun", "Paint Beads", "საღებავის მარცვლები"),
+    ("ec.generate.cclightburst", "Radial Light Burst", "რადიალური ნათება"),
+    ("ec.generate.cclightrays", "Light Rays", "სინათლის სხივები"),
+    ("ec.generate.cclightsweep", "Light Sweep", "სინათლის გავლა"),
+    ("ec.generate.ccthreads", "Woven Threads", "ნაქსოვი ძაფები"),
+    ("ec.generate.cellpattern", "Cell Pattern", "უჯრედების პატერნი"),
+    ("ec.generate.checkerboard", "Checkerboard", "ჭადრაკის დაფა"),
+    ("ec.generate.circle", "Circle", "წრე"),
+    ("ec.generate.ellipse", "Ellipse", "ელიფსი"),
+    ("ec.generate.eyedropperfill", "Eyedropper Fill", "პიპეტით შევსება"),
+    ("ec.generate.fill", "Fill", "შევსება"),
+    ("ec.generate.fourcolor", "4-Color Gradient", "4-ფერიანი გრადიენტი"),
+    ("ec.generate.fractal", "Fractal", "ფრაქტალი"),
+    ("ec.generate.gradientramp", "Gradient Ramp", "გრადიენტული გადასვლა"),
+    ("ec.generate.grid", "Grid", "ბადე"),
+    ("ec.generate.lensflare", "Lens Flare", "ობიექტივის ანარეკლი"),
+    ("ec.generate.paintbucket", "Paint Bucket", "საღებავის ვედრო"),
+    ("ec.generate.radiowaves", "Radio Waves", "რადიოტალღები"),
+    ("ec.generate.scribble", "Scribble", "ჯღაბნა"),
+    ("ec.generate.stroke", "Stroke", "კონტური"),
+    ("ec.generate.vegas", "Vegas", "ვეგასი"),
+    ("ec.generate.writeon", "Write-on", "თანდათანობითი წერა"),
+    ("ec.key.advancedspill", "Advanced Spill Suppressor", "ფერის გადაღვრის გაფართოებული ჩამხშობი"),
+    ("ec.key.ccsimplewireremoval", "Line Removal", "ხაზის მოცილება"),
+    ("ec.key.colordifference", "Color Difference Key", "ფერთა სხვაობის გასაღები"),
+    ("ec.key.colorkey", "Color Key", "ფერის გასაღები"),
+    ("ec.key.colorrange", "Color Range", "ფერების დიაპაზონი"),
+    ("ec.key.differencematte", "Difference Matte", "სხვაობის მატი"),
+    ("ec.key.extract", "Extract", "ამოღება"),
+    ("ec.key.innerouter", "Inner/Outer Key", "შიდა/გარე გასაღები"),
+    ("ec.key.keycleaner", "Key Cleaner", "გასაღების გამწმენდი"),
+    ("ec.key.linearcolor", "Linear Color Key", "წრფივი ფერის გასაღები"),
+    ("ec.key.luma", "Luma Key", "სიკაშკაშის გასაღები"),
+    ("ec.key.screen", "Screen Key", "ეკრანის გასაღები"),
+    ("ec.key.spill", "Spill Suppressor", "ფერის გადაღვრის ჩამხშობი"),
+    ("ec.key.unmult", "Unmult", "Unmult"),
+    ("ec.keying.keylight", "Screen Color Key", "ეკრანის ფერის გამოყოფა"),
+    ("ec.matte.mattechoker", "Matte Choker", "მატის შემკუმშველი"),
+    ("ec.matte.objectmatte", "Object Matte", "ობიექტის მატი"),
+    ("ec.matte.refinehard", "Refine Hard Matte", "მკვეთრი მატის დახვეწა"),
+    ("ec.matte.refinesoft", "Refine Soft Matte", "რბილი მატის დახვეწა"),
+    ("ec.matte.rotobrush", "Roto Brush & Refine Edge", "როტო-ფუნჯი და კიდის დახვეწა"),
+    ("ec.matte.simplechoker", "Simple Choker", "მარტივი შემკუმშველი"),
+    ("ec.noise.addgrain", "Add Grain", "მარცვლოვნების დამატება"),
+    ("ec.noise.curlnoise", "Curl Noise", "გრიგალური ხმაური"),
+    ("ec.noise.dustscratches", "Dust & Scratches", "მტვერი და ნაკაწრები"),
+    ("ec.noise.fractal", "Fractal Noise", "ფრაქტალური ხმაური"),
+    ("ec.noise.matchgrain", "Match Grain", "მარცვლოვნების მისადაგება"),
+    ("ec.noise.median", "Median", "მედიანა"),
+    ("ec.noise.medianlegacy", "Median (Legacy)", "მედიანა (მოძველებული)"),
+    ("ec.noise.noise", "Noise", "ხმაური"),
+    ("ec.noise.noisealpha", "Noise Alpha", "ალფა-ხმაური"),
+    ("ec.noise.noisehls", "Noise HLS", "HLS ხმაური"),
+    ("ec.noise.noisehlsauto", "Noise HLS Auto", "HLS ხმაური (ავტომატური)"),
+    ("ec.noise.removegrain", "Remove Grain", "მარცვლოვნების მოცილება"),
+    ("ec.noise.turbulent", "Turbulent Noise", "ტურბულენტური ხმაური"),
+    ("ec.obsolete.basic3d", "Basic 3D", "საბაზო 3D"),
+    ("ec.obsolete.basictext", "Basic Text", "საბაზო ტექსტი"),
+    ("ec.obsolete.gaussianlegacy", "Gaussian Blur (Legacy)", "გაუსის გაბუნდოვნება (მოძველებული)"),
+    ("ec.obsolete.lightning", "Lightning", "ელვა"),
+    ("ec.obsolete.mochashape", "Tracked Shape Matte", "თვალთვალის ფორმის ნიღაბი"),
+    ("ec.obsolete.pathtext", "Path Text", "ტექსტი ტრაექტორიაზე"),
+    ("ec.paint.paint", "Paint", "ხატვა"),
+    ("ec.perspective.3dglasses", "3D Glasses", "3D სათვალე"),
+    ("ec.perspective.bevelalpha", "Bevel Alpha", "ალფას ფასკა"),
+    ("ec.perspective.beveledges", "Bevel Edges", "კიდეების ფასკა"),
+    ("ec.perspective.cameratracker", "3D Camera Tracker", "3D კამერის ტრეკერი"),
+    ("ec.perspective.cccylinder", "Cylinder Wrap", "ცილინდრზე შემოხვევა"),
+    ("ec.perspective.ccenvironment", "Environment Map", "გარემოს რუკა"),
+    ("ec.perspective.ccsphere", "Sphere Wrap", "სფეროზე შემოხვევა"),
+    ("ec.perspective.ccspotlight", "Surface Spotlight", "ზედაპირის პროჟექტორი"),
+    ("ec.perspective.dropshadow", "Drop Shadow", "ჩრდილი"),
+    ("ec.perspective.radialshadow", "Radial Shadow", "რადიალური ჩრდილი"),
+    ("ec.sim.carddance", "Card Dance", "მოცეკვავე ბარათები"),
+    ("ec.sim.caustics", "Caustics", "კაუსტიკა"),
+    ("ec.sim.ccballaction", "Ball Grid", "ბურთულების ბადე"),
+    ("ec.sim.ccbubbles", "Bubbles", "ბუშტები"),
+    ("ec.sim.ccdrizzle", "Water Ripples", "წყლის ტალღები"),
+    ("ec.sim.cchair", "Surface Fibers", "ზედაპირის ბოჭკოები"),
+    ("ec.sim.ccmrmercury", "Liquid Particles", "თხევადი ნაწილაკები"),
+    ("ec.sim.ccparticlesystems2", "Particle Emitter 2D", "ნაწილაკების 2D წყარო"),
+    ("ec.sim.ccparticleworld", "Particle Emitter 3D", "ნაწილაკების 3D წყარო"),
+    ("ec.sim.ccpixelpolly", "Pixel Shatter", "პიქსელების დაშლა"),
+    ("ec.sim.ccrainfall", "Rainfall", "წვიმა"),
+    ("ec.sim.ccscatterize", "Pixel Scatter", "პიქსელების გაფანტვა"),
+    ("ec.sim.ccsnowfall", "Snowfall", "თოვა"),
+    ("ec.sim.ccstarburst", "Starfield", "ვარსკვლავების ველი"),
+    ("ec.sim.foam", "Foam", "ქაფი"),
+    ("ec.sim.particleplayground", "Particle Playground", "ნაწილაკების სიმულაცია"),
+    ("ec.sim.shatter", "Shatter", "დამსხვრევა"),
+    ("ec.sim.waveworld", "Wave World", "ტალღების სამყარო"),
+    ("ec.stylize.brushstrokes", "Brush Strokes", "ფუნჯის შტრიხები"),
+    ("ec.stylize.cartoon", "Cartoon", "მულტფილმის სტილი"),
+    ("ec.stylize.ccblockload", "Block Reveal", "ბლოკებით გამოჩენა"),
+    ("ec.stylize.ccburnfilm", "Film Burn", "ფირის დაწვა"),
+    ("ec.stylize.ccglass", "Glass Relief", "მინის რელიეფი"),
+    ("ec.stylize.cchextile", "Hexagonal Tiles", "ექვსკუთხა ფილები"),
+    ("ec.stylize.cckaleida", "Kaleidoscope", "კალეიდოსკოპი"),
+    ("ec.stylize.ccmrsmoothie", "Palette Map", "პალიტრის რუკა"),
+    ("ec.stylize.ccplastic", "Plastic Shading", "პლასტმასის დაჩრდილვა"),
+    ("ec.stylize.ccrepetile", "Edge Tile Repeat", "კიდეების განმეორება"),
+    ("ec.stylize.ccthreshold", "Channel Threshold", "არხის ზღვარი"),
+    ("ec.stylize.ccthresholdrgb", "RGB Threshold", "RGB ზღვარი"),
+    ("ec.stylize.ccvignette", "Vignette", "ვინიეტირება"),
+    ("ec.stylize.coloremboss", "Color Emboss", "ფერადი რელიეფი"),
+    ("ec.stylize.emboss", "Emboss", "რელიეფი"),
+    ("ec.stylize.findedges", "Find Edges", "კიდეების პოვნა"),
+    ("ec.stylize.glow", "Glow", "ნათება"),
+    ("ec.stylize.mosaic", "Mosaic", "მოზაიკა"),
+    ("ec.stylize.motiontile", "Motion Tile", "მოძრავი ფილები"),
+    ("ec.stylize.posterize", "Posterize", "პოსტერიზაცია"),
+    ("ec.stylize.roughenedges", "Roughen Edges", "კიდეების დაუხეშება"),
+    ("ec.stylize.scatter", "Scatter", "გაბნევა"),
+    ("ec.stylize.strobe", "Strobe Light", "სტრობოსკოპი"),
+    ("ec.stylize.texturize", "Texturize", "ტექსტურირება"),
+    ("ec.stylize.threshold", "Threshold", "ზღვარი"),
+    ("ec.text.numbers", "Numbers", "რიცხვები"),
+    ("ec.text.timecode", "Timecode", "თაიმკოდი"),
+    ("ec.time.ccforcemotionblur", "Temporal Motion Blur", "დროითი მოძრაობის დაბინდვა"),
+    ("ec.time.ccwidetime", "Temporal Blend", "დროითი შერევა"),
+    ("ec.time.echo", "Echo", "ექო"),
+    ("ec.time.pixelmotionblur", "Pixel Motion Blur", "პიქსელების მოძრაობის გაბუნდოვნება"),
+    ("ec.time.posterizetime", "Posterize Time", "დროის პოსტერიზაცია"),
+    ("ec.time.timedifference", "Time Difference", "დროითი სხვაობა"),
+    ("ec.time.timedisplacement", "Time Displacement", "დროითი წანაცვლება"),
+    ("ec.time.timewarp", "Timewarp", "Timewarp"),
+    ("ec.transition.blockdissolve", "Block Dissolve", "ბლოკური გადადნობა"),
+    ("ec.transition.cardwipe", "Card Wipe", "ბარათებით წმენდა"),
+    ("ec.transition.ccglasswipe", "Glass Wipe", "მინის გადასვლა"),
+    ("ec.transition.ccgridwipe", "Grid Wipe", "ბადის გადასვლა"),
+    ("ec.transition.ccimagewipe", "Luminance Image Wipe", "სიკაშკაშის გამოსახულებით გადასვლა"),
+    ("ec.transition.ccjaws", "Serrated Wipe", "დაკბილული გადასვლა"),
+    ("ec.transition.cclightwipe", "Light Wipe", "სინათლის გადასვლა"),
+    ("ec.transition.cclinesweep", "Line Sweep", "ხაზების გავლა"),
+    ("ec.transition.ccradialscalewipe", "Radial Scale Wipe", "რადიალური მასშტაბის გადასვლა"),
+    ("ec.transition.ccscalewipe", "Scale Wipe", "მასშტაბის გადასვლა"),
+    ("ec.transition.cctwister", "Twist Wipe", "მოგრეხილი გადასვლა"),
+    ("ec.transition.ccwarpomatic", "Warp Dissolve", "დეფორმაციით გადასვლა"),
+    ("ec.transition.gradientwipe", "Gradient Wipe", "გრადიენტული წმენდა"),
+    ("ec.transition.iriswipe", "Iris Wipe", "დიაფრაგმული წმენდა"),
+    ("ec.transition.linearwipe", "Linear Wipe", "წრფივი წმენდა"),
+    ("ec.transition.radialwipe", "Radial Wipe", "რადიალური წმენდა"),
+    ("ec.transition.venetian", "Venetian Blinds", "ჟალუზი"),
+    ("ec.utility.applylut", "Apply Color LUT", "ფერის LUT-ის გამოყენება"),
+    ("ec.utility.ccoverbrights", "Out-of-Range Display", "დიაპაზონის გარეთ ჩვენება"),
+    ("ec.utility.cineon", "Cineon Converter", "Cineon-ის გარდამქმნელი"),
+    ("ec.utility.colorprofileconverter", "Color Profile Converter", "ფერის პროფილის გარდამქმნელი"),
+    ("ec.utility.facemeasurements", "Face Measurements", "სახის გაზომვები"),
+    ("ec.utility.facetrackpoints", "Face Track Points", "სახის ტრეკინგის წერტილები"),
+    ("ec.utility.growbounds", "Grow Bounds", "საზღვრების გაზრდა"),
+    ("ec.utility.hdrcompander", "HDR Compander", "HDR კომპანდერი"),
+    ("ec.utility.hdrcompression", "HDR Highlight Compression", "HDR ღია ტონების შეკუმშვა"),
+    ("ec.vr.blur", "VR Blur", "VR გაბუნდოვნება"),
+    ("ec.vr.chromaticaberrations", "VR Chromatic Aberrations", "VR ქრომატული აბერაციები"),
+    ("ec.vr.colorgradients", "VR Color Gradients", "VR ფერადი გრადიენტები"),
+    ("ec.vr.converter", "VR Converter", "VR გარდამქმნელი"),
+    ("ec.vr.denoise", "VR De-Noise", "VR ხმაურის მოცილება"),
+    ("ec.vr.digitalglitch", "VR Digital Glitch", "VR ციფრული ხარვეზი"),
+    ("ec.vr.fractalnoise", "VR Fractal Noise", "VR ფრაქტალური ხმაური"),
+    ("ec.vr.glow", "VR Glow", "VR ნათება"),
+    ("ec.vr.planetosphere", "VR Plane to Sphere", "VR სიბრტყიდან სფეროზე"),
+    ("ec.vr.rotatesphere", "VR Rotate Sphere", "VR სფეროს შემობრუნება"),
+    ("ec.vr.sharpen", "VR Sharpen", "VR სიმკვეთრე"),
+    ("ec.vr.spheretoplane", "VR Sphere to Plane", "VR სფეროდან სიბრტყეზე"),
+];
+
+/// Georgian (`ka`) category labels, keyed by the registry's English category.
+const GEORGIAN_CATEGORIES: &[(&str, &str)] = &[
+    ("3D Channel", "3D არხი"),
+    ("Audio", "აუდიო"),
+    ("Blur & Sharpen", "გაბუნდოვნება და სიმკვეთრე"),
+    ("Channel", "არხი"),
+    ("Color Correction", "ფერის კორექცია"),
+    ("Distort", "დამახინჯება"),
+    ("Expression Controls", "ექსპრესიის მართვა"),
+    ("Generate", "გენერაცია"),
+    ("Immersive Video", "იმერსიული ვიდეო"),
+    ("Keying", "კეიინგი"),
+    ("Matte", "მატი"),
+    ("Noise & Grain", "ხმაური და მარცვლოვნება"),
+    ("Obsolete", "მოძველებული"),
+    ("Paint", "ხატვა"),
+    ("Perspective", "პერსპექტივა"),
+    ("Simulation", "სიმულაცია"),
+    ("Stylize", "სტილიზაცია"),
+    ("Text", "ტექსტი"),
+    ("Time", "დრო"),
+    ("Transition", "გადასვლა"),
+    ("Utility", "დამხმარე"),
+];
+
+/// French (`fr`): one row per effect, ids from [`SIMPLIFIED_CHINESE`]. Written from the meaning of the
+/// English names, with the terms the French menus use (calque, estampe for a matte, incrustation for
+/// keying). The brand names stay in English, `VR`, `OCIO`, `PS` and `HDR` keep their tag after the
+/// translated name.
+const FRENCH: &[Row] = &[
+    ("ec.3d.channelextract", "3D Channel Extract", "Extraction de canal 3D"),
+    ("ec.3d.cryptomatte", "Cryptomatte", "Cryptomatte"),
+    ("ec.3d.depthmatte", "Depth Matte", "Estampe de profondeur"),
+    ("ec.3d.depthoffield", "Depth of Field", "Profondeur de champ"),
+    ("ec.3d.extractor", "EXtractoR", "EXtractoR"),
+    ("ec.3d.fog3d", "Fog 3D", "Brouillard 3D"),
+    ("ec.3d.identifier", "IDentifier", "IDentifier"),
+    ("ec.3d.idmatte", "ID Matte", "Estampe par ID"),
+    ("ec.audio.backwards", "Backwards", "À l’envers"),
+    ("ec.audio.basstreble", "Bass & Treble", "Graves et aigus"),
+    ("ec.audio.compressor", "Compressor", "Compresseur"),
+    ("ec.audio.delay", "Delay", "Retard"),
+    ("ec.audio.distortion", "Distortion", "Distorsion"),
+    ("ec.audio.flangechorus", "Flange & Chorus", "Flanger et chorus"),
+    ("ec.audio.gate", "Gate", "Porte de bruit"),
+    ("ec.audio.highlowpass", "High-Low Pass", "Passe-haut/passe-bas"),
+    ("ec.audio.modulator", "Modulator", "Modulateur"),
+    ("ec.audio.parametriceq", "Parametric EQ", "Égaliseur paramétrique"),
+    ("ec.audio.reverb", "Reverb", "Réverbération"),
+    ("ec.audio.stereomixer", "Stereo Mixer", "Mixeur stéréo"),
+    ("ec.audio.tone", "Tone", "Tonalité"),
+    ("ec.blur.bilateral", "Bilateral Blur", "Flou bilatéral"),
+    ("ec.blur.cameralens", "Camera Lens Blur", "Flou de l’objectif de la caméra"),
+    ("ec.blur.camerashakedeblur", "Camera-Shake Deblur", "Correction du flou de bougé de caméra"),
+    ("ec.blur.cccross", "Cross Blur", "Flou croisé"),
+    ("ec.blur.ccradial", "Variable Radial Blur", "Flou radial variable"),
+    ("ec.blur.ccradialfast", "Fast Radial Blur", "Flou radial rapide"),
+    ("ec.blur.ccvector", "Vector Blur", "Flou vectoriel"),
+    ("ec.blur.channel", "Channel Blur", "Flou de canal"),
+    ("ec.blur.compound", "Compound Blur", "Flou composé"),
+    ("ec.blur.directional", "Directional Blur", "Flou directionnel"),
+    ("ec.blur.fastbox", "Fast Box Blur", "Flou rectangulaire rapide"),
+    ("ec.blur.gaussian", "Gaussian Blur", "Flou gaussien"),
+    ("ec.blur.radial", "Radial Blur", "Flou radial"),
+    ("ec.blur.reduceflicker", "Reduce Interlace Flicker", "Réduction du scintillement d’entrelacement"),
+    ("ec.blur.sharpen", "Sharpen", "Accentuation"),
+    ("ec.blur.smart", "Smart Blur", "Flou intelligent"),
+    ("ec.blur.unsharp", "Unsharp Mask", "Masque flou"),
+    ("ec.channel.arithmetic", "Arithmetic", "Arithmétique"),
+    ("ec.channel.blend", "Blend", "Fusion"),
+    ("ec.channel.calculations", "Calculations", "Calculs"),
+    ("ec.channel.cccomposite", "Source Composite", "Composition de la source"),
+    ("ec.channel.combiner", "Channel Combiner", "Combinateur de canaux"),
+    ("ec.channel.compoundarithmetic", "Compound Arithmetic", "Arithmétique composée"),
+    ("ec.channel.invert", "Invert", "Inversion"),
+    ("ec.channel.minimax", "Minimax", "Minimax"),
+    ("ec.channel.removecolormatting", "Remove Color Matting", "Suppression du fond de couleur"),
+    ("ec.channel.setchannels", "Set Channels", "Définir les canaux"),
+    ("ec.channel.setmatte", "Set Matte", "Définir l’estampe"),
+    ("ec.channel.shiftchannels", "Shift Channels", "Décaler les canaux"),
+    ("ec.channel.solidcomposite", "Solid Composite", "Composite avec solide"),
+    ("ec.color.autocolor", "Auto Color", "Couleur automatique"),
+    ("ec.color.autocontrast", "Auto Contrast", "Contraste automatique"),
+    ("ec.color.autolevels", "Auto Levels", "Niveaux automatiques"),
+    ("ec.color.blackwhite", "Black & White", "Noir et blanc"),
+    ("ec.color.brightnesscontrast", "Brightness & Contrast", "Luminosité et contraste"),
+    ("ec.color.broadcast", "Broadcast Colors", "Couleurs de diffusion"),
+    ("ec.color.cccolorneutralizer", "Color Neutralizer", "Neutralisation des couleurs"),
+    ("ec.color.cccoloroffset", "Channel Offset", "Décalage des canaux"),
+    ("ec.color.cckernel", "Convolution Kernel", "Noyau de convolution"),
+    ("ec.color.cctoner", "Multi-Tone Tint", "Teinte multiton"),
+    ("ec.color.changecolor", "Change Color", "Changer la couleur"),
+    ("ec.color.changetocolor", "Change to Color", "Changer en couleur"),
+    ("ec.color.channelmixer", "Channel Mixer", "Mélangeur de canaux"),
+    ("ec.color.colorama", "Colorama", "Colorama"),
+    ("ec.color.colorbalance", "Color Balance", "Balance des couleurs"),
+    ("ec.color.colorbalancehls", "Color Balance (HLS)", "Balance des couleurs (TLS)"),
+    ("ec.color.colorlink", "Color Link", "Lien de couleur"),
+    ("ec.color.colorstabilizer", "Color Stabilizer", "Stabilisateur de couleur"),
+    ("ec.color.curves", "Curves", "Courbes"),
+    ("ec.color.equalize", "Equalize", "Égalisation"),
+    ("ec.color.exposure", "Exposure", "Exposition"),
+    ("ec.color.gammapedestalgain", "Gamma/Pedestal/Gain", "Gamma/Piédestal/Gain"),
+    ("ec.color.huesaturation", "Hue/Saturation", "Teinte/Saturation"),
+    ("ec.color.leavecolor", "Leave Color", "Conserver la couleur"),
+    ("ec.color.levels", "Levels", "Niveaux"),
+    ("ec.color.levelsic", "Levels (Individual Controls)", "Niveaux (contrôles individuels)"),
+    ("ec.color.lumetri", "Color Grading", "Étalonnage des couleurs"),
+    ("ec.color.ociocdl", "OCIO CDL Transform", "Transformation CDL OCIO"),
+    ("ec.color.ociocolorspace", "OCIO Color Space Transform", "Transformation d’espace colorimétrique OCIO"),
+    ("ec.color.ociodisplay", "OCIO Display Transform", "Transformation d’affichage OCIO"),
+    ("ec.color.ociofile", "OCIO File Transform", "Transformation de fichier OCIO"),
+    ("ec.color.ociolook", "OCIO Look Transform", "Transformation de look OCIO"),
+    ("ec.color.photofilter", "Photo Filter", "Filtre photo"),
+    ("ec.color.psarbitrarymap", "PS Arbitrary Map", "Carte arbitraire PS"),
+    ("ec.color.selectivecolor", "Selective Color", "Couleur sélective"),
+    ("ec.color.shadowhighlight", "Shadow/Highlight", "Ombres/Hautes lumières"),
+    ("ec.color.tint", "Tint", "Coloration"),
+    ("ec.color.tritone", "Tritone", "Tritone"),
+    ("ec.color.vibrance", "Vibrance", "Vibrance"),
+    ("ec.color.videolimiter", "Video Limiter", "Limiteur vidéo"),
+    ("ec.control.angle", "Angle Control", "Contrôle d’angle"),
+    ("ec.control.checkbox", "Checkbox Control", "Contrôle de case à cocher"),
+    ("ec.control.color", "Color Control", "Contrôle de couleur"),
+    ("ec.control.dropdown", "Dropdown Menu Control", "Contrôle de menu déroulant"),
+    ("ec.control.layer", "Layer Control", "Contrôle de calque"),
+    ("ec.control.point", "Point Control", "Contrôle de point"),
+    ("ec.control.point3d", "3D Point Control", "Contrôle de point 3D"),
+    ("ec.control.slider", "Slider Control", "Contrôle de curseur"),
+    ("ec.control.stereo3d", "Stereo 3D Controls", "Contrôles stéréo 3D"),
+    ("ec.distort.bezierwarp", "Bezier Warp", "Déformation Bézier"),
+    ("ec.distort.bulge", "Bulge", "Renflement"),
+    ("ec.distort.ccbender", "Flexible Bend", "Courbure souple"),
+    ("ec.distort.ccbendit", "Two-Point Bend", "Courbure à deux points"),
+    ("ec.distort.ccblobbylize", "Organic Displacement", "Déplacement organique"),
+    ("ec.distort.ccflomotion", "Dual Lens Warp", "Déformation à deux lentilles"),
+    ("ec.distort.ccgriddler", "Tile Grid", "Grille de tuiles"),
+    ("ec.distort.cclens", "Lens Distortion", "Distorsion de lentille"),
+    ("ec.distort.ccpageturn", "Page Curl", "Page enroulée"),
+    ("ec.distort.ccpowerpin", "Perspective Pin", "Épinglage en perspective"),
+    ("ec.distort.ccripplepulse", "Pulsed Ripple", "Ondulation pulsée"),
+    ("ec.distort.ccslant", "Slant", "Inclinaison"),
+    ("ec.distort.ccsmear", "Directional Smear", "Étalement directionnel"),
+    ("ec.distort.ccsplit", "Split Warp", "Déformation divisée"),
+    ("ec.distort.ccsplit2", "Dual Split Warp", "Déformation à double division"),
+    ("ec.distort.cctiler", "Scaled Tiles", "Tuiles mises à l’échelle"),
+    ("ec.distort.cornerpin", "Corner Pin", "Épinglage d’angles"),
+    ("ec.distort.displacementmap", "Displacement Map", "Carte de déplacement"),
+    ("ec.distort.liquify", "Liquify", "Liquéfier"),
+    ("ec.distort.magnify", "Magnify", "Loupe"),
+    ("ec.distort.meshwarp", "Mesh Warp", "Déformation par maillage"),
+    ("ec.distort.mirror", "Mirror", "Miroir"),
+    ("ec.distort.offset", "Offset", "Décalage"),
+    ("ec.distort.opticscompensation", "Optics Compensation", "Compensation optique"),
+    ("ec.distort.polar", "Polar Coordinates", "Coordonnées polaires"),
+    ("ec.distort.puppet", "Puppet", "Marionnette"),
+    ("ec.distort.reshape", "Reshape", "Remodeler"),
+    ("ec.distort.ripple", "Ripple", "Ondulation"),
+    ("ec.distort.rollingshutterrepair", "Rolling Shutter Repair", "Correction de l’obturateur roulant"),
+    ("ec.distort.smear", "Smear", "Étalement"),
+    ("ec.distort.spherize", "Spherize", "Sphérisation"),
+    ("ec.distort.transform", "Transform", "Transformation"),
+    ("ec.distort.turbulentdisplace", "Turbulent Displace", "Déplacement turbulent"),
+    ("ec.distort.twirl", "Twirl", "Tourbillon"),
+    ("ec.distort.twirllegacy", "Twirl (Legacy)", "Tourbillon (hérité)"),
+    ("ec.distort.upscale", "Detail-preserving Upscale", "Agrandissement avec préservation des détails"),
+    ("ec.distort.warp", "Warp", "Déformation"),
+    ("ec.distort.warpstabilizer", "Warp Stabilizer", "Stabilisateur de déformation"),
+    ("ec.distort.wavewarp", "Wave Warp", "Déformation en vague"),
+    ("ec.generate.advancedlightning", "Advanced Lightning", "Foudre avancée"),
+    ("ec.generate.audiospectrum", "Audio Spectrum", "Spectre audio"),
+    ("ec.generate.audiowaveform", "Audio Waveform", "Forme d’onde audio"),
+    ("ec.generate.beam", "Beam", "Faisceau"),
+    ("ec.generate.ccgluegun", "Paint Beads", "Perles de peinture"),
+    ("ec.generate.cclightburst", "Radial Light Burst", "Éclat lumineux radial"),
+    ("ec.generate.cclightrays", "Light Rays", "Rayons lumineux"),
+    ("ec.generate.cclightsweep", "Light Sweep", "Balayage lumineux"),
+    ("ec.generate.ccthreads", "Woven Threads", "Fils tissés"),
+    ("ec.generate.cellpattern", "Cell Pattern", "Motif cellulaire"),
+    ("ec.generate.checkerboard", "Checkerboard", "Damier"),
+    ("ec.generate.circle", "Circle", "Cercle"),
+    ("ec.generate.ellipse", "Ellipse", "Ellipse"),
+    ("ec.generate.eyedropperfill", "Eyedropper Fill", "Remplissage par pipette"),
+    ("ec.generate.fill", "Fill", "Remplissage"),
+    ("ec.generate.fourcolor", "4-Color Gradient", "Dégradé à 4 couleurs"),
+    ("ec.generate.fractal", "Fractal", "Fractale"),
+    ("ec.generate.gradientramp", "Gradient Ramp", "Rampe de dégradé"),
+    ("ec.generate.grid", "Grid", "Grille"),
+    ("ec.generate.lensflare", "Lens Flare", "Reflet d’objectif"),
+    ("ec.generate.paintbucket", "Paint Bucket", "Pot de peinture"),
+    ("ec.generate.radiowaves", "Radio Waves", "Ondes radio"),
+    ("ec.generate.scribble", "Scribble", "Gribouillis"),
+    ("ec.generate.stroke", "Stroke", "Contour"),
+    ("ec.generate.vegas", "Vegas", "Vegas"),
+    ("ec.generate.writeon", "Write-on", "Écriture progressive"),
+    ("ec.key.advancedspill", "Advanced Spill Suppressor", "Suppresseur de débordement avancé"),
+    ("ec.key.ccsimplewireremoval", "Line Removal", "Suppression de ligne"),
+    ("ec.key.colordifference", "Color Difference Key", "Incrustation par différence de couleur"),
+    ("ec.key.colorkey", "Color Key", "Incrustation couleur"),
+    ("ec.key.colorrange", "Color Range", "Plage de couleurs"),
+    ("ec.key.differencematte", "Difference Matte", "Estampe de différence"),
+    ("ec.key.extract", "Extract", "Extraction"),
+    ("ec.key.innerouter", "Inner/Outer Key", "Incrustation intérieure/extérieure"),
+    ("ec.key.keycleaner", "Key Cleaner", "Nettoyeur d’incrustation"),
+    ("ec.key.linearcolor", "Linear Color Key", "Incrustation couleur linéaire"),
+    ("ec.key.luma", "Luma Key", "Incrustation de luminance"),
+    ("ec.key.screen", "Screen Key", "Incrustation d’écran"),
+    ("ec.key.spill", "Spill Suppressor", "Suppresseur de débordement"),
+    ("ec.key.unmult", "Unmult", "Unmult"),
+    ("ec.keying.keylight", "Screen Color Key", "Incrustation par couleur d’écran"),
+    ("ec.matte.mattechoker", "Matte Choker", "Réducteur d’estampe"),
+    ("ec.matte.objectmatte", "Object Matte", "Estampe d’objet"),
+    ("ec.matte.refinehard", "Refine Hard Matte", "Affiner l’estampe nette"),
+    ("ec.matte.refinesoft", "Refine Soft Matte", "Affiner l’estampe douce"),
+    ("ec.matte.rotobrush", "Roto Brush & Refine Edge", "Roto Brush et affinage des bords"),
+    ("ec.matte.simplechoker", "Simple Choker", "Réducteur simple"),
+    ("ec.noise.addgrain", "Add Grain", "Ajouter du grain"),
+    ("ec.noise.curlnoise", "Curl Noise", "Bruit curl"),
+    ("ec.noise.dustscratches", "Dust & Scratches", "Poussières et rayures"),
+    ("ec.noise.fractal", "Fractal Noise", "Bruit fractal"),
+    ("ec.noise.matchgrain", "Match Grain", "Assortir le grain"),
+    ("ec.noise.median", "Median", "Médian"),
+    ("ec.noise.medianlegacy", "Median (Legacy)", "Médian (hérité)"),
+    ("ec.noise.noise", "Noise", "Bruit"),
+    ("ec.noise.noisealpha", "Noise Alpha", "Bruit alpha"),
+    ("ec.noise.noisehls", "Noise HLS", "Bruit TLS"),
+    ("ec.noise.noisehlsauto", "Noise HLS Auto", "Bruit TLS automatique"),
+    ("ec.noise.removegrain", "Remove Grain", "Supprimer le grain"),
+    ("ec.noise.turbulent", "Turbulent Noise", "Bruit turbulent"),
+    ("ec.obsolete.basic3d", "Basic 3D", "3D de base"),
+    ("ec.obsolete.basictext", "Basic Text", "Texte de base"),
+    ("ec.obsolete.gaussianlegacy", "Gaussian Blur (Legacy)", "Flou gaussien (hérité)"),
+    ("ec.obsolete.lightning", "Lightning", "Foudre"),
+    ("ec.obsolete.mochashape", "Tracked Shape Matte", "Cache de forme suivie"),
+    ("ec.obsolete.pathtext", "Path Text", "Texte sur tracé"),
+    ("ec.paint.paint", "Paint", "Peinture"),
+    ("ec.perspective.3dglasses", "3D Glasses", "Lunettes 3D"),
+    ("ec.perspective.bevelalpha", "Bevel Alpha", "Biseau alpha"),
+    ("ec.perspective.beveledges", "Bevel Edges", "Biseau des bords"),
+    ("ec.perspective.cameratracker", "3D Camera Tracker", "Suivi de caméra 3D"),
+    ("ec.perspective.cccylinder", "Cylinder Wrap", "Enroulement cylindrique"),
+    ("ec.perspective.ccenvironment", "Environment Map", "Carte d’environnement"),
+    ("ec.perspective.ccsphere", "Sphere Wrap", "Enroulement sphérique"),
+    ("ec.perspective.ccspotlight", "Surface Spotlight", "Projecteur de surface"),
+    ("ec.perspective.dropshadow", "Drop Shadow", "Ombre portée"),
+    ("ec.perspective.radialshadow", "Radial Shadow", "Ombre radiale"),
+    ("ec.sim.carddance", "Card Dance", "Danse de cartes"),
+    ("ec.sim.caustics", "Caustics", "Caustiques"),
+    ("ec.sim.ccballaction", "Ball Grid", "Grille de sphères"),
+    ("ec.sim.ccbubbles", "Bubbles", "Bulles"),
+    ("ec.sim.ccdrizzle", "Water Ripples", "Ondulations de l’eau"),
+    ("ec.sim.cchair", "Surface Fibers", "Fibres de surface"),
+    ("ec.sim.ccmrmercury", "Liquid Particles", "Particules liquides"),
+    ("ec.sim.ccparticlesystems2", "Particle Emitter 2D", "Émetteur de particules 2D"),
+    ("ec.sim.ccparticleworld", "Particle Emitter 3D", "Émetteur de particules 3D"),
+    ("ec.sim.ccpixelpolly", "Pixel Shatter", "Éclatement des pixels"),
+    ("ec.sim.ccrainfall", "Rainfall", "Pluie"),
+    ("ec.sim.ccscatterize", "Pixel Scatter", "Dispersion des pixels"),
+    ("ec.sim.ccsnowfall", "Snowfall", "Neige"),
+    ("ec.sim.ccstarburst", "Starfield", "Champ d’étoiles"),
+    ("ec.sim.foam", "Foam", "Mousse"),
+    ("ec.sim.particleplayground", "Particle Playground", "Terrain de jeu de particules"),
+    ("ec.sim.shatter", "Shatter", "Éclatement"),
+    ("ec.sim.waveworld", "Wave World", "Monde des vagues"),
+    ("ec.stylize.brushstrokes", "Brush Strokes", "Coups de pinceau"),
+    ("ec.stylize.cartoon", "Cartoon", "Dessin animé"),
+    ("ec.stylize.ccblockload", "Block Reveal", "Révélation par blocs"),
+    ("ec.stylize.ccburnfilm", "Film Burn", "Brûlure de pellicule"),
+    ("ec.stylize.ccglass", "Glass Relief", "Relief de verre"),
+    ("ec.stylize.cchextile", "Hexagonal Tiles", "Tuiles hexagonales"),
+    ("ec.stylize.cckaleida", "Kaleidoscope", "Kaléidoscope"),
+    ("ec.stylize.ccmrsmoothie", "Palette Map", "Palettmappning"),
+    ("ec.stylize.ccplastic", "Plastic Shading", "Ombrage plastique"),
+    ("ec.stylize.ccrepetile", "Edge Tile Repeat", "Répétition des tuiles aux bords"),
+    ("ec.stylize.ccthreshold", "Channel Threshold", "Seuil de canal"),
+    ("ec.stylize.ccthresholdrgb", "RGB Threshold", "Seuil RVB"),
+    ("ec.stylize.ccvignette", "Vignette", "Vignettage"),
+    ("ec.stylize.coloremboss", "Color Emboss", "Estampage couleur"),
+    ("ec.stylize.emboss", "Emboss", "Estampage"),
+    ("ec.stylize.findedges", "Find Edges", "Détection des contours"),
+    ("ec.stylize.glow", "Glow", "Lueur"),
+    ("ec.stylize.mosaic", "Mosaic", "Mosaïque"),
+    ("ec.stylize.motiontile", "Motion Tile", "Mosaïque de mouvement"),
+    ("ec.stylize.posterize", "Posterize", "Postérisation"),
+    ("ec.stylize.roughenedges", "Roughen Edges", "Bords irréguliers"),
+    ("ec.stylize.scatter", "Scatter", "Dispersion"),
+    ("ec.stylize.strobe", "Strobe Light", "Lumière stroboscopique"),
+    ("ec.stylize.texturize", "Texturize", "Texturisation"),
+    ("ec.stylize.threshold", "Threshold", "Seuil"),
+    ("ec.text.numbers", "Numbers", "Nombres"),
+    ("ec.text.timecode", "Timecode", "Timecode"),
+    ("ec.time.ccforcemotionblur", "Temporal Motion Blur", "Flou de mouvement temporel"),
+    ("ec.time.ccwidetime", "Temporal Blend", "Fusion temporelle"),
+    ("ec.time.echo", "Echo", "Écho"),
+    ("ec.time.pixelmotionblur", "Pixel Motion Blur", "Flou de mouvement des pixels"),
+    ("ec.time.posterizetime", "Posterize Time", "Postérisation temporelle"),
+    ("ec.time.timedifference", "Time Difference", "Différence temporelle"),
+    ("ec.time.timedisplacement", "Time Displacement", "Déplacement temporel"),
+    ("ec.time.timewarp", "Timewarp", "Déformation temporelle"),
+    ("ec.transition.blockdissolve", "Block Dissolve", "Fondu par blocs"),
+    ("ec.transition.cardwipe", "Card Wipe", "Volet de cartes"),
+    ("ec.transition.ccglasswipe", "Glass Wipe", "Volet de verre"),
+    ("ec.transition.ccgridwipe", "Grid Wipe", "Volet en grille"),
+    ("ec.transition.ccimagewipe", "Luminance Image Wipe", "Volet par luminance d’image"),
+    ("ec.transition.ccjaws", "Serrated Wipe", "Volet dentelé"),
+    ("ec.transition.cclightwipe", "Light Wipe", "Volet lumineux"),
+    ("ec.transition.cclinesweep", "Line Sweep", "Balayage de lignes"),
+    ("ec.transition.ccradialscalewipe", "Radial Scale Wipe", "Volet d’échelle radial"),
+    ("ec.transition.ccscalewipe", "Scale Wipe", "Volet d’échelle"),
+    ("ec.transition.cctwister", "Twist Wipe", "Volet torsadé"),
+    ("ec.transition.ccwarpomatic", "Warp Dissolve", "Fondu déformant"),
+    ("ec.transition.gradientwipe", "Gradient Wipe", "Volet en dégradé"),
+    ("ec.transition.iriswipe", "Iris Wipe", "Volet en iris"),
+    ("ec.transition.linearwipe", "Linear Wipe", "Volet linéaire"),
+    ("ec.transition.radialwipe", "Radial Wipe", "Volet radial"),
+    ("ec.transition.venetian", "Venetian Blinds", "Stores vénitiens"),
+    ("ec.utility.applylut", "Apply Color LUT", "Appliquer une LUT de couleur"),
+    ("ec.utility.ccoverbrights", "Out-of-Range Display", "Affichage hors plage"),
+    ("ec.utility.cineon", "Cineon Converter", "Convertisseur Cineon"),
+    ("ec.utility.colorprofileconverter", "Color Profile Converter", "Convertisseur de profil colorimétrique"),
+    ("ec.utility.facemeasurements", "Face Measurements", "Mesures du visage"),
+    ("ec.utility.facetrackpoints", "Face Track Points", "Points de suivi du visage"),
+    ("ec.utility.growbounds", "Grow Bounds", "Extension des limites"),
+    ("ec.utility.hdrcompander", "HDR Compander", "Compandeur HDR"),
+    ("ec.utility.hdrcompression", "HDR Highlight Compression", "Compression des hautes lumières HDR"),
+    ("ec.vr.blur", "VR Blur", "Flou VR"),
+    ("ec.vr.chromaticaberrations", "VR Chromatic Aberrations", "Aberrations chromatiques VR"),
+    ("ec.vr.colorgradients", "VR Color Gradients", "Dégradés de couleur VR"),
+    ("ec.vr.converter", "VR Converter", "Convertisseur VR"),
+    ("ec.vr.denoise", "VR De-Noise", "Réduction du bruit VR"),
+    ("ec.vr.digitalglitch", "VR Digital Glitch", "Glitch numérique VR"),
+    ("ec.vr.fractalnoise", "VR Fractal Noise", "Bruit fractal VR"),
+    ("ec.vr.glow", "VR Glow", "Lueur VR"),
+    ("ec.vr.planetosphere", "VR Plane to Sphere", "Plan vers sphère VR"),
+    ("ec.vr.rotatesphere", "VR Rotate Sphere", "Rotation de sphère VR"),
+    ("ec.vr.sharpen", "VR Sharpen", "Accentuation VR"),
+    ("ec.vr.spheretoplane", "VR Sphere to Plane", "Sphère vers plan VR"),
+    ("ec.3d.instance3d", "3D Layer Instance", "Instance de calque 3D"),
+];
+
+/// French (`fr`) category labels, keyed by the registry's English category.
+const FRENCH_CATEGORIES: &[(&str, &str)] = &[
+    ("3D Channel", "Canal 3D"),
+    ("Audio", "Audio"),
+    ("Blur & Sharpen", "Flou et netteté"),
+    ("Channel", "Canal"),
+    ("Color Correction", "Correction colorimétrique"),
+    ("Distort", "Déformation"),
+    ("Expression Controls", "Contrôles d’expression"),
+    ("Generate", "Génération"),
+    ("Immersive Video", "Vidéo immersive"),
+    ("Keying", "Incrustation"),
+    ("Matte", "Estampe"),
+    ("Noise & Grain", "Bruit et grain"),
+    ("Obsolete", "Obsolète"),
+    ("Paint", "Peinture"),
+    ("Perspective", "Perspective"),
+    ("Simulation", "Simulation"),
+    ("Stylize", "Stylisation"),
+    ("Text", "Texte"),
+    ("Time", "Temps"),
+    ("Transition", "Transition"),
+    ("Utility", "Utilitaire"),
+];
+
 /// The 21 category folder names the generated Effect menu and Effects & Presets draw, in
 /// Simplified Chinese. Read from the installed After Effects 2026 (26.5.0.89) Simplified Chinese
 /// interface (the checklist's `07-类别` sheet); two of them are the interface's own wording where
@@ -518,63 +1890,436 @@ const SIMPLIFIED_CHINESE_CATEGORIES: &[(&str, &str)] = &[
     ("Utility", "实用工具"),
 ];
 
+/// Swedish (`sv`), written from the English source.
+const SWEDISH: &[Row] = &[
+    ("ec.3d.channelextract", "3D Channel Extract", "Extrahera 3D-kanal"),
+    ("ec.3d.cryptomatte", "Cryptomatte", "Cryptomatte"),
+    ("ec.3d.depthmatte", "Depth Matte", "Djupmatte"),
+    ("ec.3d.depthoffield", "Depth of Field", "Skärpedjup"),
+    ("ec.3d.extractor", "EXtractoR", "EXtractoR"),
+    ("ec.3d.fog3d", "Fog 3D", "3D-dimma"),
+    ("ec.3d.identifier", "IDentifier", "IDentifier"),
+    ("ec.3d.idmatte", "ID Matte", "ID-matte"),
+    ("ec.audio.backwards", "Backwards", "Baklänges"),
+    ("ec.audio.basstreble", "Bass & Treble", "Bas och diskant"),
+    ("ec.audio.compressor", "Compressor", "Kompressor"),
+    ("ec.audio.delay", "Delay", "Delay"),
+    ("ec.audio.distortion", "Distortion", "Distorsion"),
+    ("ec.audio.flangechorus", "Flange & Chorus", "Flanger och chorus"),
+    ("ec.audio.gate", "Gate", "Gate"),
+    ("ec.audio.highlowpass", "High-Low Pass", "Hög-/lågpass"),
+    ("ec.audio.modulator", "Modulator", "Modulator"),
+    ("ec.audio.parametriceq", "Parametric EQ", "Parametrisk EQ"),
+    ("ec.audio.reverb", "Reverb", "Reverb"),
+    ("ec.audio.stereomixer", "Stereo Mixer", "Stereomixer"),
+    ("ec.audio.tone", "Tone", "Ton"),
+    ("ec.blur.bilateral", "Bilateral Blur", "Bilateral oskärpa"),
+    ("ec.blur.cameralens", "Camera Lens Blur", "Kameralinsoskärpa"),
+    ("ec.blur.camerashakedeblur", "Camera-Shake Deblur", "Ta bort oskärpa från kameraskakning"),
+    ("ec.blur.cccross", "Cross Blur", "Korsoskärpa"),
+    ("ec.blur.ccradial", "Variable Radial Blur", "Variabel radiell oskärpa"),
+    ("ec.blur.ccradialfast", "Fast Radial Blur", "Snabb radiell oskärpa"),
+    ("ec.blur.ccvector", "Vector Blur", "Vektoroskärpa"),
+    ("ec.blur.channel", "Channel Blur", "Kanaloskärpa"),
+    ("ec.blur.compound", "Compound Blur", "Sammansatt oskärpa"),
+    ("ec.blur.directional", "Directional Blur", "Riktad oskärpa"),
+    ("ec.blur.fastbox", "Fast Box Blur", "Snabb rutoskärpa"),
+    ("ec.blur.gaussian", "Gaussian Blur", "Gaussisk oskärpa"),
+    ("ec.blur.radial", "Radial Blur", "Radiell oskärpa"),
+    ("ec.blur.reduceflicker", "Reduce Interlace Flicker", "Minska flimmer från sammanflätning"),
+    ("ec.blur.sharpen", "Sharpen", "Skärpa"),
+    ("ec.blur.smart", "Smart Blur", "Smart oskärpa"),
+    ("ec.blur.unsharp", "Unsharp Mask", "Oskarp mask"),
+    ("ec.channel.arithmetic", "Arithmetic", "Aritmetik"),
+    ("ec.channel.blend", "Blend", "Blanda"),
+    ("ec.channel.calculations", "Calculations", "Beräkningar"),
+    ("ec.channel.cccomposite", "Source Composite", "Källkomposition"),
+    ("ec.channel.combiner", "Channel Combiner", "Kanalkombinerare"),
+    ("ec.channel.compoundarithmetic", "Compound Arithmetic", "Sammansatt aritmetik"),
+    ("ec.channel.invert", "Invert", "Invertera"),
+    ("ec.channel.minimax", "Minimax", "Minimax"),
+    ("ec.channel.removecolormatting", "Remove Color Matting", "Ta bort färgkantbehandling"),
+    ("ec.channel.setchannels", "Set Channels", "Ange kanaler"),
+    ("ec.channel.setmatte", "Set Matte", "Ange matte"),
+    ("ec.channel.shiftchannels", "Shift Channels", "Flytta kanaler"),
+    ("ec.channel.solidcomposite", "Solid Composite", "Enfärgad komposit"),
+    ("ec.color.autocolor", "Auto Color", "Autofärg"),
+    ("ec.color.autocontrast", "Auto Contrast", "Autokontrast"),
+    ("ec.color.autolevels", "Auto Levels", "Autonivåer"),
+    ("ec.color.blackwhite", "Black & White", "Svartvitt"),
+    ("ec.color.brightnesscontrast", "Brightness & Contrast", "Ljusstyrka och kontrast"),
+    ("ec.color.broadcast", "Broadcast Colors", "Broadcast-färger"),
+    ("ec.color.cccolorneutralizer", "Color Neutralizer", "Färgneutralisering"),
+    ("ec.color.cccoloroffset", "Channel Offset", "Kanalförskjutning"),
+    ("ec.color.cckernel", "Convolution Kernel", "Faltningskärna"),
+    ("ec.color.cctoner", "Multi-Tone Tint", "Flertonsfärgning"),
+    ("ec.color.changecolor", "Change Color", "Ändra färg"),
+    ("ec.color.changetocolor", "Change to Color", "Ändra till färg"),
+    ("ec.color.channelmixer", "Channel Mixer", "Kanalmixer"),
+    ("ec.color.colorama", "Colorama", "Colorama"),
+    ("ec.color.colorbalance", "Color Balance", "Färgbalans"),
+    ("ec.color.colorbalancehls", "Color Balance (HLS)", "Färgbalans (HLS)"),
+    ("ec.color.colorlink", "Color Link", "Färglänk"),
+    ("ec.color.colorstabilizer", "Color Stabilizer", "Färgstabiliserare"),
+    ("ec.color.curves", "Curves", "Kurvor"),
+    ("ec.color.equalize", "Equalize", "Utjämna"),
+    ("ec.color.exposure", "Exposure", "Exponering"),
+    ("ec.color.gammapedestalgain", "Gamma/Pedestal/Gain", "Gamma/svartnivå/förstärkning"),
+    ("ec.color.huesaturation", "Hue/Saturation", "Nyans/mättnad"),
+    ("ec.color.leavecolor", "Leave Color", "Behåll färg"),
+    ("ec.color.levels", "Levels", "Nivåer"),
+    ("ec.color.levelsic", "Levels (Individual Controls)", "Nivåer (individuella kontroller)"),
+    ("ec.color.lumetri", "Color Grading", "Färggradering"),
+    ("ec.color.ociocdl", "OCIO CDL Transform", "OCIO CDL-transformering"),
+    ("ec.color.ociocolorspace", "OCIO Color Space Transform", "OCIO färgrymdstransformering"),
+    ("ec.color.ociodisplay", "OCIO Display Transform", "OCIO visningstransformering"),
+    ("ec.color.ociofile", "OCIO File Transform", "OCIO filtransformering"),
+    ("ec.color.ociolook", "OCIO Look Transform", "OCIO look-transformering"),
+    ("ec.color.photofilter", "Photo Filter", "Fotofilter"),
+    ("ec.color.psarbitrarymap", "PS Arbitrary Map", "PS godtycklig mappning"),
+    ("ec.color.selectivecolor", "Selective Color", "Selektiv färg"),
+    ("ec.color.shadowhighlight", "Shadow/Highlight", "Skugga/högdager"),
+    ("ec.color.tint", "Tint", "Färgton"),
+    ("ec.color.tritone", "Tritone", "Tretoning"),
+    ("ec.color.vibrance", "Vibrance", "Lyster"),
+    ("ec.color.videolimiter", "Video Limiter", "Videobegränsare"),
+    ("ec.control.angle", "Angle Control", "Vinkelkontroll"),
+    ("ec.control.checkbox", "Checkbox Control", "Kryssrutekontroll"),
+    ("ec.control.color", "Color Control", "Färgkontroll"),
+    ("ec.control.dropdown", "Dropdown Menu Control", "Kontroll för listmeny"),
+    ("ec.control.layer", "Layer Control", "Lagerkontroll"),
+    ("ec.control.point", "Point Control", "Punktkontroll"),
+    ("ec.control.point3d", "3D Point Control", "3D-punktkontroll"),
+    ("ec.control.slider", "Slider Control", "Skjutreglagekontroll"),
+    ("ec.control.stereo3d", "Stereo 3D Controls", "Stereo 3D-kontroller"),
+    ("ec.distort.bezierwarp", "Bezier Warp", "Bezierförvrängning"),
+    ("ec.distort.bulge", "Bulge", "Utbuktning"),
+    ("ec.distort.ccbender", "Flexible Bend", "Flexibel böjning"),
+    ("ec.distort.ccbendit", "Two-Point Bend", "Tvåpunktsböjning"),
+    ("ec.distort.ccblobbylize", "Organic Displacement", "Organisk förskjutning"),
+    ("ec.distort.ccflomotion", "Dual Lens Warp", "Dubbel linsförvrängning"),
+    ("ec.distort.ccgriddler", "Tile Grid", "Plattnät"),
+    ("ec.distort.cclens", "Lens Distortion", "Linsförvrängning"),
+    ("ec.distort.ccpageturn", "Page Curl", "Sidkrullning"),
+    ("ec.distort.ccpowerpin", "Perspective Pin", "Perspektivnålar"),
+    ("ec.distort.ccripplepulse", "Pulsed Ripple", "Pulserande krusning"),
+    ("ec.distort.ccslant", "Slant", "Lutning"),
+    ("ec.distort.ccsmear", "Directional Smear", "Riktningssmetning"),
+    ("ec.distort.ccsplit", "Split Warp", "Delad förvrängning"),
+    ("ec.distort.ccsplit2", "Dual Split Warp", "Dubbeldelad förvrängning"),
+    ("ec.distort.cctiler", "Scaled Tiles", "Skalade plattor"),
+    ("ec.distort.cornerpin", "Corner Pin", "Hörnförankring"),
+    ("ec.distort.displacementmap", "Displacement Map", "Förskjutningskarta"),
+    ("ec.distort.liquify", "Liquify", "Gör flytande"),
+    ("ec.distort.magnify", "Magnify", "Förstora"),
+    ("ec.distort.meshwarp", "Mesh Warp", "Nätförvrängning"),
+    ("ec.distort.mirror", "Mirror", "Spegel"),
+    ("ec.distort.offset", "Offset", "Förskjutning"),
+    ("ec.distort.opticscompensation", "Optics Compensation", "Optikkompensation"),
+    ("ec.distort.polar", "Polar Coordinates", "Polära koordinater"),
+    ("ec.distort.puppet", "Puppet", "Docka"),
+    ("ec.distort.reshape", "Reshape", "Omforma"),
+    ("ec.distort.ripple", "Ripple", "Krusning"),
+    ("ec.distort.rollingshutterrepair", "Rolling Shutter Repair", "Reparera rullande slutare"),
+    ("ec.distort.smear", "Smear", "Utsmetning"),
+    ("ec.distort.spherize", "Spherize", "Sfärisera"),
+    ("ec.distort.transform", "Transform", "Transformera"),
+    ("ec.distort.turbulentdisplace", "Turbulent Displace", "Turbulent förskjutning"),
+    ("ec.distort.twirl", "Twirl", "Virvel"),
+    ("ec.distort.twirllegacy", "Twirl (Legacy)", "Virvel (äldre)"),
+    ("ec.distort.upscale", "Detail-preserving Upscale", "Detaljbevarande uppskalning"),
+    ("ec.distort.warp", "Warp", "Förvräng"),
+    ("ec.distort.warpstabilizer", "Warp Stabilizer", "Warp Stabilizer"),
+    ("ec.distort.wavewarp", "Wave Warp", "Vågförvrängning"),
+    ("ec.generate.advancedlightning", "Advanced Lightning", "Avancerad blixt"),
+    ("ec.generate.audiospectrum", "Audio Spectrum", "Ljudspektrum"),
+    ("ec.generate.audiowaveform", "Audio Waveform", "Ljudvågform"),
+    ("ec.generate.beam", "Beam", "Stråle"),
+    ("ec.generate.ccgluegun", "Paint Beads", "Färgpärlor"),
+    ("ec.generate.cclightburst", "Radial Light Burst", "Radiellt ljusutbrott"),
+    ("ec.generate.cclightrays", "Light Rays", "Ljusstrålar"),
+    ("ec.generate.cclightsweep", "Light Sweep", "Ljussvep"),
+    ("ec.generate.ccthreads", "Woven Threads", "Vävda trådar"),
+    ("ec.generate.cellpattern", "Cell Pattern", "Cellmönster"),
+    ("ec.generate.checkerboard", "Checkerboard", "Schackbräde"),
+    ("ec.generate.circle", "Circle", "Cirkel"),
+    ("ec.generate.ellipse", "Ellipse", "Ellips"),
+    ("ec.generate.eyedropperfill", "Eyedropper Fill", "Pipettfyllning"),
+    ("ec.generate.fill", "Fill", "Fyllning"),
+    ("ec.generate.fourcolor", "4-Color Gradient", "Fyrfärgsgradient"),
+    ("ec.generate.fractal", "Fractal", "Fraktal"),
+    ("ec.generate.gradientramp", "Gradient Ramp", "Gradientramp"),
+    ("ec.generate.grid", "Grid", "Rutnät"),
+    ("ec.generate.lensflare", "Lens Flare", "Linsreflex"),
+    ("ec.generate.paintbucket", "Paint Bucket", "Färghink"),
+    ("ec.generate.radiowaves", "Radio Waves", "Radiovågor"),
+    ("ec.generate.scribble", "Scribble", "Klotter"),
+    ("ec.generate.stroke", "Stroke", "Kontur"),
+    ("ec.generate.vegas", "Vegas", "Vegas"),
+    ("ec.generate.writeon", "Write-on", "Framskrivning"),
+    ("ec.key.advancedspill", "Advanced Spill Suppressor", "Avancerad spilldämpning"),
+    ("ec.key.ccsimplewireremoval", "Line Removal", "Linjeborttagning"),
+    ("ec.key.colordifference", "Color Difference Key", "Färgdifferensnyckel"),
+    ("ec.key.colorkey", "Color Key", "Färgnyckel"),
+    ("ec.key.colorrange", "Color Range", "Färgomfång"),
+    ("ec.key.differencematte", "Difference Matte", "Differensmatte"),
+    ("ec.key.extract", "Extract", "Extrahera"),
+    ("ec.key.innerouter", "Inner/Outer Key", "Inre/yttre nyckel"),
+    ("ec.key.keycleaner", "Key Cleaner", "Nyckelrensare"),
+    ("ec.key.linearcolor", "Linear Color Key", "Linjär färgnyckel"),
+    ("ec.key.luma", "Luma Key", "Lumanyckel"),
+    ("ec.key.screen", "Screen Key", "Skärmnyckel"),
+    ("ec.key.spill", "Spill Suppressor", "Spilldämpning"),
+    ("ec.key.unmult", "Unmult", "Unmult"),
+    ("ec.keying.keylight", "Screen Color Key", "Skärmfärgsnyckling"),
+    ("ec.matte.mattechoker", "Matte Choker", "Mattekrympning"),
+    ("ec.matte.objectmatte", "Object Matte", "Objektmatte"),
+    ("ec.matte.refinehard", "Refine Hard Matte", "Förfina hård matte"),
+    ("ec.matte.refinesoft", "Refine Soft Matte", "Förfina mjuk matte"),
+    ("ec.matte.rotobrush", "Roto Brush & Refine Edge", "Rotopensel och förfina kant"),
+    ("ec.matte.simplechoker", "Simple Choker", "Enkel krympning"),
+    ("ec.noise.addgrain", "Add Grain", "Lägg till korn"),
+    ("ec.noise.curlnoise", "Curl Noise", "Curl-brus"),
+    ("ec.noise.dustscratches", "Dust & Scratches", "Damm och repor"),
+    ("ec.noise.fractal", "Fractal Noise", "Fraktalbrus"),
+    ("ec.noise.matchgrain", "Match Grain", "Matcha korn"),
+    ("ec.noise.median", "Median", "Median"),
+    ("ec.noise.medianlegacy", "Median (Legacy)", "Median (äldre)"),
+    ("ec.noise.noise", "Noise", "Brus"),
+    ("ec.noise.noisealpha", "Noise Alpha", "Alfabrus"),
+    ("ec.noise.noisehls", "Noise HLS", "HLS-brus"),
+    ("ec.noise.noisehlsauto", "Noise HLS Auto", "HLS-brus auto"),
+    ("ec.noise.removegrain", "Remove Grain", "Ta bort korn"),
+    ("ec.noise.turbulent", "Turbulent Noise", "Turbulent brus"),
+    ("ec.obsolete.basic3d", "Basic 3D", "Grundläggande 3D"),
+    ("ec.obsolete.basictext", "Basic Text", "Grundläggande text"),
+    ("ec.obsolete.gaussianlegacy", "Gaussian Blur (Legacy)", "Gaussisk oskärpa (äldre)"),
+    ("ec.obsolete.lightning", "Lightning", "Blixt"),
+    ("ec.obsolete.mochashape", "Tracked Shape Matte", "Spårad formmask"),
+    ("ec.obsolete.pathtext", "Path Text", "Text längs bana"),
+    ("ec.paint.paint", "Paint", "Måla"),
+    ("ec.perspective.3dglasses", "3D Glasses", "3D-glasögon"),
+    ("ec.perspective.bevelalpha", "Bevel Alpha", "Alfafasning"),
+    ("ec.perspective.beveledges", "Bevel Edges", "Fasade kanter"),
+    ("ec.perspective.cameratracker", "3D Camera Tracker", "3D-kameraspårning"),
+    ("ec.perspective.cccylinder", "Cylinder Wrap", "Cylinderomslag"),
+    ("ec.perspective.ccenvironment", "Environment Map", "Miljökarta"),
+    ("ec.perspective.ccsphere", "Sphere Wrap", "Sfäromslag"),
+    ("ec.perspective.ccspotlight", "Surface Spotlight", "Ytstrålkastare"),
+    ("ec.perspective.dropshadow", "Drop Shadow", "Slagskugga"),
+    ("ec.perspective.radialshadow", "Radial Shadow", "Radiell skugga"),
+    ("ec.sim.carddance", "Card Dance", "Kortdans"),
+    ("ec.sim.caustics", "Caustics", "Kaustik"),
+    ("ec.sim.ccballaction", "Ball Grid", "Kulnät"),
+    ("ec.sim.ccbubbles", "Bubbles", "Bubblor"),
+    ("ec.sim.ccdrizzle", "Water Ripples", "Vattenkrusningar"),
+    ("ec.sim.cchair", "Surface Fibers", "Ytfibrer"),
+    ("ec.sim.ccmrmercury", "Liquid Particles", "Vätskepartiklar"),
+    ("ec.sim.ccparticlesystems2", "Particle Emitter 2D", "Partikelsändare 2D"),
+    ("ec.sim.ccparticleworld", "Particle Emitter 3D", "Partikelsändare 3D"),
+    ("ec.sim.ccpixelpolly", "Pixel Shatter", "Pixelsplittring"),
+    ("ec.sim.ccrainfall", "Rainfall", "Regn"),
+    ("ec.sim.ccscatterize", "Pixel Scatter", "Pixelspridning"),
+    ("ec.sim.ccsnowfall", "Snowfall", "Snöfall"),
+    ("ec.sim.ccstarburst", "Starfield", "Stjärnfält"),
+    ("ec.sim.foam", "Foam", "Skum"),
+    ("ec.sim.particleplayground", "Particle Playground", "Partikellekplats"),
+    ("ec.sim.shatter", "Shatter", "Krossa"),
+    ("ec.sim.waveworld", "Wave World", "Vågvärld"),
+    ("ec.stylize.brushstrokes", "Brush Strokes", "Penseldrag"),
+    ("ec.stylize.cartoon", "Cartoon", "Tecknat"),
+    ("ec.stylize.ccblockload", "Block Reveal", "Blockframträdande"),
+    ("ec.stylize.ccburnfilm", "Film Burn", "Filmbränning"),
+    ("ec.stylize.ccglass", "Glass Relief", "Glasrelief"),
+    ("ec.stylize.cchextile", "Hexagonal Tiles", "Sexkantiga plattor"),
+    ("ec.stylize.cckaleida", "Kaleidoscope", "Kalejdoskop"),
+    ("ec.stylize.ccmrsmoothie", "Palette Map", "Mappage de palette"),
+    ("ec.stylize.ccplastic", "Plastic Shading", "Plastskuggning"),
+    ("ec.stylize.ccrepetile", "Edge Tile Repeat", "Kantupprepning"),
+    ("ec.stylize.ccthreshold", "Channel Threshold", "Kanaltröskel"),
+    ("ec.stylize.ccthresholdrgb", "RGB Threshold", "RGB-tröskel"),
+    ("ec.stylize.ccvignette", "Vignette", "Vinjettering"),
+    ("ec.stylize.coloremboss", "Color Emboss", "Färgrelief"),
+    ("ec.stylize.emboss", "Emboss", "Relief"),
+    ("ec.stylize.findedges", "Find Edges", "Hitta kanter"),
+    ("ec.stylize.glow", "Glow", "Glöd"),
+    ("ec.stylize.mosaic", "Mosaic", "Mosaik"),
+    ("ec.stylize.motiontile", "Motion Tile", "Rörlig sida vid sida"),
+    ("ec.stylize.posterize", "Posterize", "Posterisera"),
+    ("ec.stylize.roughenedges", "Roughen Edges", "Ojämna kanter"),
+    ("ec.stylize.scatter", "Scatter", "Spridning"),
+    ("ec.stylize.strobe", "Strobe Light", "Stroboskopljus"),
+    ("ec.stylize.texturize", "Texturize", "Texturera"),
+    ("ec.stylize.threshold", "Threshold", "Tröskel"),
+    ("ec.text.numbers", "Numbers", "Siffror"),
+    ("ec.text.timecode", "Timecode", "Tidskod"),
+    ("ec.time.ccforcemotionblur", "Temporal Motion Blur", "Tidsbaserad rörelseoskärpa"),
+    ("ec.time.ccwidetime", "Temporal Blend", "Tidsblandning"),
+    ("ec.time.echo", "Echo", "Eko"),
+    ("ec.time.pixelmotionblur", "Pixel Motion Blur", "Pixelrörelseoskärpa"),
+    ("ec.time.posterizetime", "Posterize Time", "Posterisera tid"),
+    ("ec.time.timedifference", "Time Difference", "Tidsdifferens"),
+    ("ec.time.timedisplacement", "Time Displacement", "Tidsförskjutning"),
+    ("ec.time.timewarp", "Timewarp", "Tidsförvrängning"),
+    ("ec.transition.blockdissolve", "Block Dissolve", "Blockövertoning"),
+    ("ec.transition.cardwipe", "Card Wipe", "Kortridå"),
+    ("ec.transition.ccglasswipe", "Glass Wipe", "Glasövergång"),
+    ("ec.transition.ccgridwipe", "Grid Wipe", "Rutnätsövergång"),
+    ("ec.transition.ccimagewipe", "Luminance Image Wipe", "Luminansbildsövergång"),
+    ("ec.transition.ccjaws", "Serrated Wipe", "Tandad övergång"),
+    ("ec.transition.cclightwipe", "Light Wipe", "Ljusövergång"),
+    ("ec.transition.cclinesweep", "Line Sweep", "Linjesvep"),
+    ("ec.transition.ccradialscalewipe", "Radial Scale Wipe", "Radiell skalövergång"),
+    ("ec.transition.ccscalewipe", "Scale Wipe", "Skalövergång"),
+    ("ec.transition.cctwister", "Twist Wipe", "Vridövergång"),
+    ("ec.transition.ccwarpomatic", "Warp Dissolve", "Förvrängningsupplösning"),
+    ("ec.transition.gradientwipe", "Gradient Wipe", "Gradientridå"),
+    ("ec.transition.iriswipe", "Iris Wipe", "Irisridå"),
+    ("ec.transition.linearwipe", "Linear Wipe", "Linjär ridå"),
+    ("ec.transition.radialwipe", "Radial Wipe", "Radiell ridå"),
+    ("ec.transition.venetian", "Venetian Blinds", "Persienner"),
+    ("ec.utility.applylut", "Apply Color LUT", "Använd färg-LUT"),
+    ("ec.utility.ccoverbrights", "Out-of-Range Display", "Visa utanför intervallet"),
+    ("ec.utility.cineon", "Cineon Converter", "Cineon-konverterare"),
+    ("ec.utility.colorprofileconverter", "Color Profile Converter", "Färgprofilkonverterare"),
+    ("ec.utility.facemeasurements", "Face Measurements", "Ansiktsmått"),
+    ("ec.utility.facetrackpoints", "Face Track Points", "Ansiktsspårningspunkter"),
+    ("ec.utility.growbounds", "Grow Bounds", "Väx gränser"),
+    ("ec.utility.hdrcompander", "HDR Compander", "HDR-kompander"),
+    ("ec.utility.hdrcompression", "HDR Highlight Compression", "HDR-högdagerkomprimering"),
+    ("ec.vr.blur", "VR Blur", "VR-oskärpa"),
+    ("ec.vr.chromaticaberrations", "VR Chromatic Aberrations", "VR-kromatiska aberrationer"),
+    ("ec.vr.colorgradients", "VR Color Gradients", "VR-färggradienter"),
+    ("ec.vr.converter", "VR Converter", "VR-konverterare"),
+    ("ec.vr.denoise", "VR De-Noise", "VR-brusreducering"),
+    ("ec.vr.digitalglitch", "VR Digital Glitch", "VR-digitala störningar"),
+    ("ec.vr.fractalnoise", "VR Fractal Noise", "VR-fraktalbrus"),
+    ("ec.vr.glow", "VR Glow", "VR-glöd"),
+    ("ec.vr.planetosphere", "VR Plane to Sphere", "VR-plan till sfär"),
+    ("ec.vr.rotatesphere", "VR Rotate Sphere", "VR-rotera sfär"),
+    ("ec.vr.sharpen", "VR Sharpen", "VR-skärpa"),
+    ("ec.vr.spheretoplane", "VR Sphere to Plane", "VR-sfär till plan"),
+    ("ec.3d.instance3d", "3D Layer Instance", "3D-lagerinstans"),
+];
+
+/// Swedish (`sv`), written from the English source.
+const SWEDISH_CATEGORIES: &[(&str, &str)] = &[
+    ("3D Channel", "3D-kanal"),
+    ("Audio", "Ljud"),
+    ("Blur & Sharpen", "Oskärpa och skärpa"),
+    ("Channel", "Kanal"),
+    ("Color Correction", "Färgkorrigering"),
+    ("Distort", "Förvräng"),
+    ("Expression Controls", "Uttryckskontroller"),
+    ("Generate", "Generera"),
+    ("Immersive Video", "Immersiv video"),
+    ("Keying", "Keying"),
+    ("Matte", "Matte"),
+    ("Noise & Grain", "Brus och korn"),
+    ("Obsolete", "Föråldrade"),
+    ("Paint", "Måla"),
+    ("Perspective", "Perspektiv"),
+    ("Simulation", "Simulering"),
+    ("Stylize", "Stilisera"),
+    ("Text", "Text"),
+    ("Time", "Tid"),
+    ("Transition", "Övergång"),
+    ("Utility", "Verktyg"),
+];
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::i18n::set_current;
     use effectcraft_engine::effects;
 
-    /// Every effect in the registry has a row, and that row still carries the registry's English
-    /// name. A new effect, a rename or a removal fails here rather than drawing an English name
-    /// in a Chinese interface, or attaching a translation to a different effect.
     #[test]
-    fn every_effect_has_a_row() {
+    fn legacy_effect_names_draw_current_labels_without_changing_custom_names() {
+        for language in ["en", "ja", "zh-hans", "zh-hant", "fr", "sv", "ka", "cs", "de", "es", "pl", "pt-br", "ru", "uk"] {
+            set_current(language);
+            for spec in effects::registry() {
+                let translated = name(spec.id, spec.name);
+                for alias in effects::aliases(spec.id) {
+                    assert_eq!(group(spec.id, alias), translated, "{language}: {alias}");
+                    assert!(matches(spec.id, alias, &spec.name.to_lowercase()), "{language}: search current name of {alias}");
+                    assert!(matches(spec.id, spec.name, &alias.to_lowercase()), "{language}: search legacy name {alias}");
+                    assert_eq!(group(spec.id, &format!("{alias} 2")), format!("{translated} 2"));
+                    let custom = format!("{alias} custom");
+                    assert_eq!(group(spec.id, &custom), custom);
+                }
+            }
+        }
+        set_current("en");
+    }
+
+    #[test]
+    fn localized_effect_names_do_not_reintroduce_legacy_branding() {
+        for (language, rows) in COMPLETE.iter().chain(PARTIAL) {
+            for (_, _, translated) in *rows {
+                let label = translated.to_lowercase();
+                assert!(!label.starts_with("cc "), "{language}: {translated}");
+                for mark in ["lumetri", "mercury", "mocha", "keylight"] {
+                    assert!(!label.contains(mark), "{language}: {translated}");
+                }
+            }
+        }
+    }
+
+    /// Every row names an effect in the registry and still carries its English name, so a rename
+    /// or a removal fails here rather than attaching a translation to a different effect.
+    #[test]
+    fn every_row_names_a_registry_effect() {
         let registry = effects::registry();
-        assert_eq!(SIMPLIFIED_CHINESE.len(), registry.len(), "the catalog has {} rows for {} effects", SIMPLIFIED_CHINESE.len(), registry.len());
-        for spec in registry {
-            let Some((_, english, translated)) = SIMPLIFIED_CHINESE.iter().find(|(id, _, _)| *id == spec.id) else {
-                panic!("no catalog row for {} ({})", spec.id, spec.name);
-            };
-            assert_eq!(*english, spec.name, "{}: the catalog says {english:?}, the registry {:?}", spec.id, spec.name);
-            assert!(!translated.is_empty(), "{}: empty translation", spec.id);
+        for (language, rows) in COMPLETE {
+            for (id, english, translated) in *rows {
+                let Some(spec) = registry.iter().find(|spec| spec.id == *id) else {
+                    panic!("{language} row {id} ({english}) is not an effect in the registry");
+                };
+                assert_eq!(*english, spec.name, "{language} row {id}: the catalog says {english:?}, the registry {:?}", spec.name);
+                assert!(!translated.is_empty(), "{language} row {id}: empty translation");
+            }
+        }
+    }
+
+    /// Two effects that draw one name cannot be told apart in the Effect menu, Effect Controls or
+    /// Effects & Presets, so every catalog names each effect it covers distinctly.
+    #[test]
+    fn display_names_are_unique_in_every_catalog() {
+        for (language, rows) in COMPLETE.iter().chain(PARTIAL) {
+            let mut seen: std::collections::HashMap<&str, &str> = std::collections::HashMap::new();
+            for (id, _, translated) in *rows {
+                if let Some(other) = seen.insert(translated, id) {
+                    assert_ne!(other, *id, "{language}: {id} and {other} are both {translated:?}");
+                }
+            }
         }
     }
 
     /// Rows are keyed by id, so a repeated id would shadow a translation.
     #[test]
     fn ids_are_unique() {
-        let mut ids: Vec<&str> = SIMPLIFIED_CHINESE.iter().map(|(id, _, _)| *id).collect();
-        let listed = ids.len();
-        ids.sort_unstable();
-        ids.dedup();
-        assert_eq!(listed, ids.len(), "an effect id is listed twice");
-    }
-
-    /// The five names Adobe's Simplified Chinese interface leaves in English as brand names, and
-    /// the only zh-hans rows that may repeat their English name. Deliberately not shared: another
-    /// language keeps different names in English (Japanese leaves the whole `CC`, `VR` and `OCIO`
-    /// sets in English), so this is zh-hans's own choice, not an invariant of the tables.
-    #[test]
-    fn only_the_brand_names_stay_in_english() {
-        const BRANDS: [&str; 5] = ["ec.3d.cryptomatte", "ec.3d.extractor", "ec.3d.identifier", "ec.keying.keylight", "ec.key.unmult"];
-        for (id, english, translated) in SIMPLIFIED_CHINESE {
-            assert_eq!(english == translated, BRANDS.contains(id), "{id}: {english:?} is drawn as {translated:?}");
+        for (language, rows) in COMPLETE.iter().chain(PARTIAL) {
+            let mut ids: Vec<&str> = rows.iter().map(|(id, _, _)| *id).collect();
+            let listed = ids.len();
+            ids.sort_unstable();
+            ids.dedup();
+            assert_eq!(listed, ids.len(), "{language} lists an effect id twice");
         }
     }
 
-    /// The languages that have no rows yet, with the table a translator fills in for each. A new
-    /// language is added here and to [`catalog`]; the test then guards its rows as they arrive.
-    const PENDING: &[(&str, &[Row])] = &[("zh-hant", TRADITIONAL_CHINESE)];
+    /// The languages whose tables are complete: one row per effect in the registry and one row
+    /// per category when they were written. A new effect without a row draws its English name (as
+    /// in every language), so it does not block other work; the rows are guarded like [`PARTIAL`]'s.
+    const COMPLETE: &[(&str, &[Row])] = &[("zh-hans", SIMPLIFIED_CHINESE), ("zh-hant", TRADITIONAL_CHINESE)];
 
-    /// The languages whose tables are being filled in: guarded like [`PENDING`] row by row.
-    const PARTIAL: &[(&str, &[Row])] = &[("ja", JAPANESE_EFFECTS)];
+    /// The languages whose tables are being filled in: guarded row by row.
+    const PARTIAL: &[(&str, &[Row])] = &[("ja", JAPANESE_EFFECTS), ("ka", GEORGIAN), ("sv", SWEDISH), ("fr", FRENCH)];
 
-    /// A pending language may lag Simplified Chinese but may not invent ids or disagree about
-    /// which effect an id names: a translator fills these tables row by row. While they are
-    /// empty the test is a no-op, which is why the slot ships before the data does.
+    /// A partial language may lag Simplified Chinese but may not invent ids or disagree about
+    /// which effect an id names: a translator fills these tables row by row.
     #[test]
-    fn a_pending_language_only_uses_known_ids() {
-        for (language, rows) in PENDING.iter().chain(PARTIAL) {
+    fn a_partial_language_only_uses_known_ids() {
+        for (language, rows) in PARTIAL {
             let mut ids: Vec<&str> = vec![];
             for (id, english, translated) in *rows {
                 let Some((_, hans_english, _)) = SIMPLIFIED_CHINESE.iter().find(|(hans_id, _, _)| hans_id == id) else {
@@ -591,16 +2336,19 @@ mod tests {
         }
     }
 
-    /// Every category the registry and its plug-ins report has a Simplified Chinese row, and
-    /// every row of every language names a category that exists — else the generated Effect menu
-    /// and Effects & Presets would draw a label no folder has.
+    /// Every category row of every language names a category that exists, else the generated
+    /// Effect menu and Effects & Presets would carry a label no folder has.
     #[test]
-    fn every_category_has_a_row() {
+    fn every_category_row_names_a_category() {
         let categories = effects::categories();
-        for category in &categories {
-            assert!(SIMPLIFIED_CHINESE_CATEGORIES.iter().any(|(english, _)| english == category), "no catalog row for category {category}");
-        }
-        for (language, rows) in [("zh-hans", SIMPLIFIED_CHINESE_CATEGORIES), ("zh-hant", TRADITIONAL_CHINESE_CATEGORIES), ("ja", JAPANESE_CATEGORIES)] {
+        for (language, rows) in [
+            ("zh-hans", SIMPLIFIED_CHINESE_CATEGORIES),
+            ("zh-hant", TRADITIONAL_CHINESE_CATEGORIES),
+            ("ja", JAPANESE_CATEGORIES),
+            ("ka", GEORGIAN_CATEGORIES),
+            ("sv", SWEDISH_CATEGORIES),
+            ("fr", FRENCH_CATEGORIES),
+        ] {
             for (english, translated) in rows {
                 assert!(categories.contains(english), "{language} lists {english}, which is not a category");
                 assert!(!translated.is_empty(), "empty {language} translation for {english}");
@@ -613,48 +2361,61 @@ mod tests {
     #[test]
     fn group_names_keep_the_instance_index_and_user_renames() {
         set_current("zh-hans");
-        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur"), "高斯模糊");
-        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), "高斯模糊 2");
-        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 12"), "高斯模糊 12");
+        let translated = name("ec.blur.gaussian", "Gaussian Blur");
+        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur"), translated);
+        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), format!("{translated} 2"));
+        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 12"), format!("{translated} 12"));
         assert_eq!(group("ec.blur.gaussian", "My Blur"), "My Blur", "a rename is not a row");
         assert_eq!(group("ec.blur.gaussian", "Gaussian Blur X"), "Gaussian Blur X");
         assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2x"), "Gaussian Blur 2x");
-        assert_eq!(group("ec.blur.gaussian", "高斯模糊"), "高斯模糊", "an already translated name stays");
+        assert_eq!(group("ec.blur.gaussian", &translated), translated, "an already translated name stays");
         set_current("en");
     }
 
-    /// English, and a language with no catalog or no row for this effect, draws the registry's
-    /// name rather than an empty label.
-    ///
-    /// The pending languages are also checked to still be row-less and to have an arm in
-    /// [`catalog`]: an arm with no table would leave a translator's rows dead, and the day a
-    /// pending language gets rows this fails so its slot moves out of [`PENDING`], where the
-    /// coverage for it lives.
+    /// English, and a language with no catalog or no row for an effect, draws the registry's
+    /// name rather than an empty label; a language with a row draws the row. Every table in
+    /// [`COMPLETE`] and [`PARTIAL`] has an arm in [`catalog`]: an arm-less table's rows would be dead.
     #[test]
     fn languages_without_rows_draw_the_registry_name() {
+        for (language, _) in COMPLETE.iter().chain(PARTIAL) {
+            assert!(catalog(language).is_some(), "{language} has a table but no arm in `catalog`: its rows would be dead");
+        }
+        let tables = COMPLETE.iter().chain(PARTIAL).map(|(language, rows)| (*language, *rows));
+        for (language, rows) in [("en", &[][..]), ("uk", &[][..]), ("cs", &[][..])].into_iter().chain(tables) {
+            set_current(language);
+            let expected = rows.iter().find(|(id, _, _)| *id == "ec.blur.gaussian").map_or("Gaussian Blur", |(_, _, translated)| *translated);
+            assert_eq!(name("ec.blur.gaussian", "Gaussian Blur"), expected, "{language}");
+            assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), format!("{expected} 2"), "{language}");
+            assert_eq!(name("ec.unknown.effect", "Mystery"), "Mystery", "{language}");
+            assert_eq!(category("Not A Category"), "Not A Category", "{language}");
+        }
         for language in ["en", "uk", "cs"] {
             set_current(language);
-            assert_eq!(name("ec.blur.gaussian", "Gaussian Blur"), "Gaussian Blur", "{language}");
-            assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), "Gaussian Blur 2", "{language}");
             assert_eq!(category("Blur & Sharpen"), "Blur & Sharpen", "{language}");
         }
-        for (language, rows) in PENDING {
-            assert!(catalog(language).is_some(), "{language} has a table but no arm in `catalog`: its rows would be dead");
-            assert!(rows.is_empty(), "{language} has rows now: move it out of PENDING and cover it here");
-            set_current(language);
-            assert_eq!(name("ec.blur.gaussian", "Gaussian Blur"), "Gaussian Blur", "{language}");
-            assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), "Gaussian Blur 2", "{language}");
-            assert_eq!(category("Blur & Sharpen"), "Blur & Sharpen", "{language}");
+        set_current("en");
+    }
+
+    /// Every Swedish row names an effect the registry has, by the registry's English name; an
+    /// effect without a row draws its English name, so a new effect does not block other work.
+    /// Names and categories draw in Swedish and search finds either name.
+    #[test]
+    fn swedish_rows_match_the_registry() {
+        let registry = effects::registry();
+        for (id, english, translated) in SWEDISH {
+            let Some(spec) = registry.iter().find(|spec| spec.id == *id) else {
+                panic!("Swedish row {id} is not an effect in the registry");
+            };
+            assert_eq!(*english, spec.name, "{id}: the Swedish catalog says {english:?}, the registry {:?}", spec.name);
+            assert!(!translated.is_empty(), "{id}: empty Swedish translation");
         }
-        set_current("zh-hans");
-        assert_eq!(name("ec.blur.gaussian", "Gaussian Blur"), "高斯模糊");
-        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), "高斯模糊 2");
-        assert_eq!(category("Blur & Sharpen"), "模糊和锐化");
-        assert_eq!(name("ec.unknown.effect", "Mystery"), "Mystery");
-        assert_eq!(category("Not A Category"), "Not A Category");
-        set_current("ja");
-        assert_eq!(name("ec.blur.gaussian", "Gaussian Blur"), "ブラー（ガウス）");
-        assert_eq!(name("ec.unknown.effect", "Mystery"), "Mystery", "a row a partial table lacks draws the registry name");
+        set_current("sv");
+        assert_eq!(name("ec.blur.gaussian", "Gaussian Blur"), "Gaussisk oskärpa");
+        assert_eq!(group("ec.blur.gaussian", "Gaussian Blur 2"), "Gaussisk oskärpa 2");
+        assert_eq!(group("ec.blur.gaussian", "My Blur"), "My Blur");
+        assert_eq!(category("Blur & Sharpen"), "Oskärpa och skärpa");
+        assert!(matches("ec.blur.gaussian", "Gaussian Blur", "gaussisk"));
+        assert!(matches("ec.blur.gaussian", "Gaussian Blur", "blur"));
         set_current("en");
     }
 
@@ -665,38 +2426,51 @@ mod tests {
         set_current("zh-hans");
         assert!(matches("ec.blur.gaussian", "Gaussian Blur", "blur"));
         assert!(matches("ec.blur.gaussian", "Gaussian Blur", "gaussian"));
-        assert!(matches("ec.blur.gaussian", "Gaussian Blur", "高斯"));
+        assert!(matches("ec.blur.gaussian", "Gaussian Blur", &name("ec.blur.gaussian", "Gaussian Blur").to_lowercase()));
         assert!(!matches("ec.blur.gaussian", "Gaussian Blur", "sharpen"));
         set_current("en");
         assert!(matches("ec.blur.gaussian", "Gaussian Blur", "blur"));
         assert!(!matches("ec.blur.gaussian", "Gaussian Blur", "高斯"));
     }
+}
 
-    /// The drawing sites ask this catalog instead of the registry's English name (#821). Like the
-    /// panel catalog's literal scan this is a heuristic: it pins the expressions that used to draw
-    /// the English name, so a revert fails here.
+#[cfg(test)]
+mod category_name_tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    /// Two categories drawing the same Japanese name would make the Effect menu show one name twice and
+    /// leave the user unable to tell them apart. `描画` was both `Generate` and `Paint` before #2583.
     #[test]
-    fn the_drawing_sites_ask_the_catalog() {
-        /// A file that must ask the catalog.
-        const ASKS: &[(&str, &str, &str)] = &[
-            ("i18n.rs", include_str!("../i18n.rs"), "effects::name("),
-            ("i18n.rs", include_str!("../i18n.rs"), "effects::category("),
-            ("panels/effects_presets.rs", include_str!("../panels/effects_presets.rs"), "effects::name("),
-            ("panels/effects_presets.rs", include_str!("../panels/effects_presets.rs"), "effects::category("),
-            ("panels/effect_controls.rs", include_str!("../panels/effect_controls.rs"), "effects::group("),
-            ("panels/timeline.rs", include_str!("../panels/timeline.rs"), "effects::group("),
-        ];
-        /// An expression that drew the registry's English name and must be gone.
-        const RAW: &[(&str, &str, &str)] = &[
-            ("panels/effects_presets.rs", include_str!("../panels/effects_presets.rs"), "pos2(r.min.x + 56.0 + indent, r.center().y), e.name, query, &t)"),
-            ("panels/effect_controls.rs", include_str!("../panels/effect_controls.rs"), "Align2::LEFT_CENTER, &g.name,"),
-            ("panels/timeline.rs", include_str!("../panels/timeline.rs"), "Align2::LEFT_CENTER, name,"),
-        ];
-        for (path, source, call) in ASKS {
-            assert!(source.contains(call), "{path} does not ask the effect-name catalog (`{call}`)");
+    fn no_two_categories_share_a_japanese_name() {
+        let mut seen: HashMap<&str, &str> = HashMap::new();
+        for (english, japanese) in JAPANESE_CATEGORIES {
+            if let Some(other) = seen.insert(japanese, english) {
+                panic!("`{english}` and `{other}` both draw as `{japanese}`");
+            }
         }
-        for (path, source, raw) in RAW {
-            assert!(!source.contains(raw), "{path} draws the registry's English name again: `{raw}`");
+    }
+
+    /// The interface's font probe sees the effect names and category labels, not only the panel
+    /// catalog: `鑲` appears only in Flange & Chorus (`鑲邊與合聲`), and a sparse Han face missing
+    /// it would otherwise draw a box.
+    #[test]
+    fn the_font_probe_sees_effect_and_category_characters() {
+        let chars = crate::i18n::catalog_characters("zh-hant");
+        assert!(chars.contains(&'鑲'), "an effect name's character is probed");
+        let (_, label) = TRADITIONAL_CHINESE_CATEGORIES.first().copied().unwrap_or_default();
+        assert!(label.chars().all(|ch| chars.contains(&ch)), "{label}: a category label's characters are probed");
+    }
+
+    /// The same for Traditional Chinese: one repeated label would hide a category behind another
+    /// in the Effect menu.
+    #[test]
+    fn no_two_categories_share_a_traditional_chinese_name() {
+        let mut seen: HashMap<&str, &str> = HashMap::new();
+        for (english, traditional) in TRADITIONAL_CHINESE_CATEGORIES {
+            if let Some(other) = seen.insert(traditional, english) {
+                panic!("`{english}` and `{other}` both draw as `{traditional}`");
+            }
         }
     }
 }
diff --git a/crates/ui-egui/src/i18n/ui.rs b/crates/ui-egui/src/i18n/ui.rs
index 434f2b79c..ac6504493 100644
--- a/crates/ui-egui/src/i18n/ui.rs
+++ b/crates/ui-egui/src/i18n/ui.rs
@@ -6,12 +6,15 @@
 //! inventing an id, and a missing row falls back to English instead of to an empty label.
 //!
 //! The language in force is set once per frame, from the same resolved language the fonts are
-//! installed for ([`super::language`], [`set_current`]), so a panel does not have to thread it
+//! installed for (`crate::i18n::language`, [`set_current`]), so a panel does not have to thread it
 //! through every function. It is thread-local: the render threads never draw interface text.
 //!
 //! A row that carries values keeps one `{}` per value and is read with [`tr_args`]; the tests below
 //! refuse a row whose placeholder count differs from its English source, so a translation can never
 //! drop a value, and `tr_args` itself cannot panic.
+//!
+//! A language may lack rows: the English source shows instead, and the `missing_translations_report`
+//! test (run by `cargo xtask ci`) lists what each language lacks.
 
 use std::cell::Cell;
 use std::collections::HashMap;
@@ -19,7 +22,7 @@ use std::fmt::Display;
 use std::sync::OnceLock;
 
 thread_local! {
-    /// The resolved interface language ("en", "ja", "zh-hans", "zh-hant", "uk", "pt-br", "cs", "es"); "en" until the first
+    /// The resolved interface language ("en", "ja", "zh-hans", "zh-hant", "uk", "pt-br", "cs", "es", "pl", "ka", "sv", "fr"); "en" until the first
     /// frame sets it.
     static CURRENT: Cell<&'static str> = const { Cell::new("en") };
 }
@@ -37,6 +40,23 @@ pub(crate) fn current() -> &'static str {
 
 type Index = HashMap<&'static str, &'static str>;
 
+/// Every language with panel rows, for the tests and the missing-strings report.
+#[cfg(test)]
+const ROWS: &[(&str, &[(&str, &str)])] = &[
+    ("ja", JAPANESE),
+    ("zh-hans", SIMPLIFIED_CHINESE),
+    ("zh-hant", TRADITIONAL_CHINESE),
+    ("uk", UKRAINIAN),
+    ("pt-br", PORTUGUESE),
+    ("cs", CZECH),
+    ("es", SPANISH),
+    ("pl", POLISH),
+    ("ka", GEORGIAN),
+    ("ka", GEORGIAN_PANELS),
+    ("sv", SWEDISH),
+    ("fr", FRENCH),
+];
+
 /// The catalog for `language`, indexed by English source (built on first use: panels translate
 /// hundreds of strings a frame); `None` for English and any language that has no rows yet.
 fn catalog(language: &str) -> Option<&'static Index> {
@@ -47,6 +67,10 @@ fn catalog(language: &str) -> Option<&'static Index> {
     static PT_BR: OnceLock<Index> = OnceLock::new();
     static CS: OnceLock<Index> = OnceLock::new();
     static ES: OnceLock<Index> = OnceLock::new();
+    static PL: OnceLock<Index> = OnceLock::new();
+    static KA: OnceLock<Index> = OnceLock::new();
+    static SV: OnceLock<Index> = OnceLock::new();
+    static FR: OnceLock<Index> = OnceLock::new();
     let (index, rows) = match language {
         "ja" => (&JA, JAPANESE),
         "zh-hans" => (&HANS, SIMPLIFIED_CHINESE),
@@ -55,11 +79,81 @@ fn catalog(language: &str) -> Option<&'static Index> {
         "pt-br" => (&PT_BR, PORTUGUESE),
         "cs" => (&CS, CZECH),
         "es" => (&ES, SPANISH),
+        "pl" => (&PL, POLISH),
+        "fr" => (&FR, FRENCH),
+        // Georgian also reads its own rows for text the other catalogs don't have yet.
+        "ka" => return Some(KA.get_or_init(|| GEORGIAN.iter().chain(GEORGIAN_PANELS).copied().collect())),
+        "sv" => (&SV, SWEDISH),
         _ => return None,
     };
     Some(index.get_or_init(|| rows.iter().copied().collect()))
 }
 
+/// The panel strings `language` has no row for, for the missing-strings report: every English
+/// source any catalog lists, in catalog order, then the literals the converted panels pass to `tr`
+/// or `tr_args` that no catalog lists yet.
+#[cfg(test)]
+pub(super) fn missing(language: &str) -> Vec<String> {
+    let table = catalog(language);
+    let rows = ROWS.iter().flat_map(|(_, rows)| rows.iter().map(|(en, _)| en.to_string()));
+    let literals = tests::CONVERTED.iter().flat_map(|(_, src)| tr_literals(src));
+    let mut seen = std::collections::HashSet::new();
+    rows.chain(literals).filter(|en| !table.is_some_and(|c| c.contains_key(en.as_str())) && seen.insert(en.clone())).collect()
+}
+
+/// The number of panel/dialog rows `language` translates, for the row-count report; 0 when it has
+/// no catalog or when it is English.
+#[cfg(test)]
+pub(super) fn translated_rows(language: &str) -> usize {
+    catalog(language).map_or(0, Index::len)
+}
+
+/// The string literals `src` passes to `tr(` and `tr_args(`.
+#[cfg(test)]
+fn tr_literals(src: &str) -> Vec<String> {
+    let mut out = Vec::new();
+    for call in ["tr(\"", "tr_args(\""] {
+        for (at, _) in src.match_indices(call) {
+            // `str("` or `attr("` is another call.
+            if src[..at].chars().next_back().is_some_and(|c| c.is_alphanumeric() || c == '_') {
+                continue;
+            }
+            out.extend(string_literal(&src[at + call.len()..]));
+        }
+    }
+    out
+}
+
+/// The text of the string literal `rest` starts inside (just after its opening quote), with the
+/// common escapes resolved; `None` for an escape this doesn't resolve.
+#[cfg(test)]
+fn string_literal(rest: &str) -> Option<String> {
+    let mut out = String::new();
+    let mut chars = rest.chars();
+    while let Some(c) = chars.next() {
+        match c {
+            '"' => return Some(out),
+            '\\' => match chars.next()? {
+                'n' => out.push('\n'),
+                't' => out.push('\t'),
+                c @ ('\\' | '"' | '\'') => out.push(c),
+                _ => return None,
+            },
+            c => out.push(c),
+        }
+    }
+    None
+}
+
+/// Characters required by the fixed panel catalog and the effect names and categories, for
+/// system-font coverage selection. Sorted and deduplicated so fallback registration is
+/// deterministic.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn catalog_characters(language: &str) -> Vec<char> {
+    let panels = catalog(language).into_iter().flat_map(|c| c.values()).flat_map(|s| s.chars());
+    panels.chain(super::effects::characters(language)).collect::<std::collections::BTreeSet<_>>().into_iter().collect()
+}
+
 /// Translate one interface string: the current language's row for `text`, or `text` itself.
 pub(crate) fn tr(text: &str) -> &str {
     catalog(current()).and_then(|c| c.get(text)).copied().unwrap_or(text)
@@ -85,8 +179,9 @@ pub(crate) fn tr_args(text: &str, args: &[&dyn Display]) -> String {
     out
 }
 
-/// Japanese: the same rows, in the same order, as the Chinese catalogs below (the tests keep the two in step).
+/// Japanese: the same rows, in the same order, as the Chinese catalogs below.
 const JAPANESE: &[(&str, &str)] = &[
+    ("Click to sample color", "クリックして色をサンプル"),
     ("Appearance Settings…", "外観設定…"),
     ("Add to favorites", "お気に入りに追加"),
     ("Remove from favorites", "お気に入りから削除"),
@@ -104,6 +199,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("About...", "情報..."),
     ("Active", "使用中"),
     ("Active Camera", "アクティブカメラ"),
+    ("Active Camera ({})", "アクティブカメラ（{}）"),
     ("Alpha", "アルファ"),
     ("Adapt Feature On Every Frame", "フレームごとに特徴を更新"),
     ("Adaptive Sample Limit:", "適応サンプル数の上限:"),
@@ -117,9 +213,10 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Add a shape, fill, stroke or path operation", "シェイプ、塗り、線、またはパス操作を追加"),
     ("Add to Composition", "コンポジションに追加"),
     ("Add to Favorites", "お気に入りに追加"),
-    ("Add:", "追加:"),
+    ("Add:", "追加："),
     ("Adjust Exposure (stops)", "露出を調整（段単位）"),
     ("Adjust composition duration to the time span of the selected layers", "コンポジションのデュレーションを、選択したレイヤーの時間範囲に合わせる"),
+    ("Advanced", "詳細"),
     ("Advanced 3D", "アドバンスド3D"),
     ("Align Layers to:", "レイヤーの整列基準:"),
     ("All six face cameras turn together; the scene is not changed.", "6つの面のカメラがすべて一緒に回転します。シーンは変更されません。"),
@@ -143,8 +240,11 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Browser Storage", "ブラウザーストレージ"),
     ("Browse…", "参照…"),
     ("Brush Dynamics", "ブラシのダイナミクス"),
-    ("Caching frames…", "フレームをキャッシュ中…"),
+    ("Caching frames", "フレームをキャッシュ中"),
     ("Cancel", "キャンセル"),
+    ("Import After Effects Project", "After Effectsプロジェクトを読み込み"),
+    ("Some parts of this project cannot be imported exactly (left out or changed):", "このプロジェクトの一部は正確に読み込めません（省略または変更されます）:"),
+    ("Import Anyway", "このまま読み込み"),
     ("Casts Shadows", "シャドウを落とす"),
     ("Change Renderer…", "レンダラーを変更…"),
     (
@@ -228,13 +328,16 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Duration:", "デュレーション:"),
     ("Edit Gradient…", "グラデーションを編集…"),
     ("Edit Target: {}", "編集対象：{}"),
-    ("Edit in the Timeline", "タイムラインで編集"),
     ("EffectCraft didn't quit normally last time.", "EffectCraftは前回正常に終了しませんでした。"),
     ("Effects", "エフェクト"),
     ("Effects & Presets options", "エフェクト＆プリセットのオプション"),
     ("Copy Presets Folder Path", "プリセットフォルダーのパスをコピー"),
     ("Copy Source Path", "ソースパスをコピー"),
     ("Effects: {}", "エフェクト：{}"),
+    ("EXR Bit Depth: {}", "EXR ビット深度：{}"),
+    ("EXR Compression: {}", "EXR 圧縮：{}"),
+    ("EXR Compression: {} (lossy)", "EXR 圧縮：{}（非可逆）"),
+    ("EXR Compression: {} (uncompressed at float)", "EXR 圧縮：{}（float では非圧縮）"),
     ("Empty folder", "空のフォルダー"),
     ("Enable Depth of Field", "被写界深度を有効化"),
     ("Enable Expression", "エクスプレッションを有効化"),
@@ -259,9 +362,10 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Follow Feature Rotation and Scale", "特徴の回転とスケールに追従"),
     ("Footage: {}", "フッテージ：{}"),
     ("Format: {}", "形式：{}"),
-    ("Frame Aspect Ratio: {}", "フレームアスペクト比：{}"),
+    ("Frame Aspect Ratio: {}", "フレーム縦横比：{}"),
     ("Frame Blending: {}", "フレームブレンド：{}"),
     ("Frame Rate:", "フレームレート:"),
+    ("Resolution:", "解像度:"),
     ("Frame Render Time  {}ms", "フレームのレンダリング時間  {}ms"),
     ("Frame Target:", "フレームターゲット:"),
     ("Freeze", "フリーズ"),
@@ -294,7 +398,6 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "最新の自動保存：{}"),
     ("Layer", "レイヤー"),
     ("Layer controls", "レイヤーコントロール"),
-    ("Layer {}", "レイヤー{}"),
     ("Layer:", "レイヤー:"),
     ("Layer: {}", "レイヤー：{}"),
     ("Layer Styles", "レイヤースタイル"),
@@ -308,7 +411,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Lighter", "明るく"),
     ("Link Selected Property", "選択したプロパティをリンク"),
     ("Location:", "位置:"),
-    ("Lock Aspect Ratio to {}", "アスペクト比を{}に固定"),
+    ("Lock Aspect Ratio to {}", "縦横比を{}に固定"),
     ("Lock to Zoom", "ズームにロック"),
     ("Locked: {} — {}", "ロック済み：{} — {}"),
     ("Log:", "ログ:"),
@@ -358,6 +461,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("No layer selected", "レイヤーが選択されていません"),
     ("No matching effects or presets", "一致するエフェクトまたはプリセットはありません"),
     ("No matching fonts", "一致するフォントはありません"),
+    ("Rescan Fonts", "フォントを再スキャン"),
     ("Variable fonts only", "可変フォントのみ"),
     ("No model credits were built into this copy.", "このビルドにはモデルのクレジットが含まれていません。"),
     ("No nested compositions", "ネストされたコンポジションはありません"),
@@ -367,7 +471,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("None", "なし"),
     ("Not applied: tick it in the list to add it.", "未適用：リストでチェックを入れると追加されます。"),
     ("Not assigned", "未割り当て"),
-    ("Note: Shadows are only cast from layers with Cast Shadows enabled.", "注意：シャドウは「シャドウを投影」が有効なレイヤーからのみ投影されます。"),
+    ("Note: Shadows are only cast from layers with Cast Shadows enabled.", "注意：「シャドウを落とす」が有効なレイヤーだけがシャドウを落とします。"),
     ("Notify", "通知"),
     ("OK", "OK"),
     ("Offset:", "オフセット:"),
@@ -375,8 +479,8 @@ const JAPANESE: &[(&str, &str)] = &[
     ("One-Node Camera", "1ノードカメラ"),
     ("Opacity:", "不透明度:"),
     ("Open Composition", "コンポジションを開く"),
-    ("used once", "1 回使用"),
-    ("used {} times", "{} 回使用"),
+    ("used once", "1回使用"),
+    ("used {} times", "{}回使用"),
     ("Compositions that use this item", "このアイテムを使用しているコンポジション"),
     ("Open Last Saved Project", "最後に保存したプロジェクトを開く"),
     ("Open New Composition", "新規コンポジションを開く"),
@@ -391,7 +495,9 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Overlay", "オーバーレイ"),
     ("Parameter Name:", "パラメーター名:"),
     ("Parent pick whip: drag onto a layer", "親ピックウィップ：レイヤー上にドラッグ"),
-    ("Pixel Aspect Ratio:", "ピクセルアスペクト比:"),
+    ("Track Matte pick whip: drag onto a layer", "トラックマットピックウィップ：レイヤー上にドラッグ"),
+    ("Pixel Aspect Ratio:", "ピクセル縦横比:"),
+    ("Play/Stop", "再生/停止"),
     ("Playing on Video Preview", "ビデオプレビューで再生中"),
     ("Post-Render Action: {}", "レンダリング後の処理：{}"),
     ("Preserve frame rate when nested or in render queue", "ネスト時またはレンダーキュー内でフレームレートを保持"),
@@ -447,7 +553,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Select a command to change its shortcut.", "ショートカットを変更するコマンドを選択してください。"),
     ("Select a layer to see its effects", "レイヤーを選択するとエフェクトが表示されます"),
     ("Select a layer to see its properties", "レイヤーを選択するとプロパティが表示されます"),
-    ("({}) Selected Objects", "({}) 個の選択されたオブジェクト"),
+    ("({}) Selected Objects", "選択したオブジェクト（{}）"),
     (
         "Select a layer with a mask or shape path (or the path property), or Puppet pins.",
         "マスクまたはシェイプパスのあるレイヤー（またはパスプロパティ）か、パペットピンを選択してください。",
@@ -539,7 +645,12 @@ const JAPANESE: &[(&str, &str)] = &[
     ),
     ("VR Environments", "VR環境"),
     ("Value:", "値:"),
-    ("Variable Font Axes", "可変フォントの軸"),
+    ("Variable Font Axes", "バリアブルフォント軸"),
+    ("Selector: Range", "セレクター: 範囲"),
+    ("Selector: Wiggly", "セレクター: ウィグリー"),
+    ("Selector: Expression", "セレクター: エクスプレッション"),
+    ("Property: {}", "プロパティ: {}"),
+    ("Variable Font Axes: {}", "バリアブルフォント軸: {}"),
     ("Video Codec: {}", "ビデオコーデック：{}"),
     ("View:", "表示:"),
     ("Welcome to EffectCraft", "EffectCraftへようこそ"),
@@ -567,16 +678,16 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Fit", "フィット"),
     ("Fit up to 100%", "100%までフィット"),
     ("Full", "フル画質"),
-    ("Half", "1/2 画質"),
+    ("Half", "1/2画質"),
     ("Only this layer uses this solid.", "この平面を使用するのはこのレイヤーだけです。"),
     ("Proportional Grid", "プロポーショナルグリッド"),
-    ("Quarter", "1/4 画質"),
+    ("Quarter", "1/4画質"),
     ("Region of Interest", "関心領域"),
     ("Reset Exposure", "露出をリセット"),
     ("Show Channel and Color Management Settings", "チャンネルとカラーマネジメント設定を表示"),
     ("Show Snapshot (hold)", "スナップショットを表示（長押し）"),
     ("Take Snapshot", "スナップショットを取得"),
-    ("Third", "1/3 画質"),
+    ("Third", "1/3画質"),
     ("Toggle Mask and Shape Path Visibility", "マスクとシェイプのパスを表示"),
     ("Toggle Transparency Grid", "透明グリッドを切り替え"),
     ("16 bits per channel", "チャンネルあたり16ビット"),
@@ -586,24 +697,24 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Adobe-style built-in", "Adobe標準の組み込み"),
     ("Blue", "青"),
     ("Current Settings", "現在の設定"),
-    ("Disable Per-character 3D", "文字ごとの3Dを無効化"),
+    ("Disable Per-character 3D", "文字単位の 3D 化を使用しない"),
     ("Draft", "ドラフト"),
-    ("Enable Per-character 3D", "文字ごとの3Dを有効化"),
+    ("Enable Per-character 3D", "文字単位の 3D 化を使用"),
     ("Fast Draft", "高速ドラフト"),
-    ("Fast Previews (Draft 3D, Faster Effects)", "高速プレビュー（ドラフト 3D、より高速なエフェクト）"),
+    ("Fast Previews (Draft 3D, Faster Effects)", "高速プレビュー（ドラフト3D、より高速なエフェクト）"),
     ("Green", "緑"),
     ("Import Image Sequence", "画像シーケンスを読み込み"),
     ("Import PDF / Illustrator File", "PDF / Illustratorファイルを読み込み"),
     ("Import Photoshop File", "Photoshopファイルを読み込み"),
-    ("Interpret Unlabeled Alpha As", "ラベルのないアルファを変換"),
+    ("Interpret Unlabeled Alpha As", "ラベルのないアルファの解釈"),
     ("Join the ArtCraft Discord", "ArtCraftのDiscordに参加"),
-    ("Mercury GPU Acceleration ({})", "Mercury GPUアクセラレーション（{}）"),
-    ("Mercury Software Only", "Mercuryソフトウェアのみ"),
+    ("GPU Acceleration ({})", "GPUアクセラレーション（{}）"),
+    ("Software Rendering", "ソフトウェアレンダリング"),
     ("OCIO (built-in ACES config)", "OCIO（組み込みACES設定）"),
     ("Off (Final Quality)", "オフ（最終品質）"),
     ("OpenGL (compatibility)", "OpenGL（互換）"),
     ("Opus Bitrate: {} kbps", "Opusビットレート：{} kbps"),
-    ("RGB Straight", "RGB ストレート"),
+    ("RGB Straight", "RGBストレート"),
     ("Red", "赤"),
     ("Tone map", "トーンマップ"),
     ("Use In-Window Menu Bar on macOS", "macOSでウィンドウ内メニューバーを使用"),
@@ -703,17 +814,17 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Faster", "高速"),
     ("More Accurate", "精度を優先"),
     ("Display Color Space", "表示色空間"),
-    ("GPU Information...", "GPU 情報..."),
+    ("GPU Information...", "GPU情報..."),
     ("Appearance", "外観"),
     ("Brightness", "明るさ"),
-    ("UI Scale", "UI スケール"),
+    ("UI Scale", "UIスケール"),
     ("Labels and Colors", "ラベルとカラー"),
     ("Use Label Color for Layer Handles and Paths", "レイヤーハンドルとパスにラベルカラーを使用"),
     ("Use Label Color for Related Tabs", "ラベルカラーを関連するタブに使用"),
     ("Cycle Mask Colors", "新規マスクに別のカラーを使用"),
     ("Use Gradients", "グラデーションを使用"),
     ("Menu Bar", "メニューバー"),
-    ("Grids & Guides", "グリッド＆ガイド"),
+    ("Grids & Guides", "グリッドとガイド"),
     ("Gridline Every", "グリッドの間隔"),
     ("Subdivisions", "分割数"),
     ("Style", "スタイル"),
@@ -745,7 +856,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Ask User", "ユーザーに確認"),
     ("Guess", "推測"),
     ("Ignore", "無視"),
-    ("Straight", "そのまま"),
+    ("Straight", "ストレート"),
     ("Premultiplied", "プリマルチプライ"),
     ("Default Drag Import As", "複数アイテムのドラッグ読み込みの初期設定"),
     ("Footage", "フッテージ"),
@@ -773,8 +884,8 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Media Cache", "メディアキャッシュ"),
     ("Database and Cache Folder", "データベースとキャッシュのフォルダー"),
     ("Conformed Audio Folder", "適合オーディオフォルダー"),
-    ("Memory & CPU", "メモリと CPU"),
-    ("RAM Reserved for Other Applications", "他のアプリケーション用に確保する RAM"),
+    ("Memory & CPU", "メモリとCPU"),
+    ("RAM Reserved for Other Applications", "他のアプリケーション用に確保するRAM"),
     ("Cache Budgets", "キャッシュの割り当て"),
     ("Layer Cache", "レイヤーキャッシュ"),
     ("Footage Frame Cache", "フッテージフレームキャッシュ"),
@@ -788,14 +899,14 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Video Output During Playback", "再生中のビデオ出力"),
     ("Mirror on Computer Monitor", "コンピューターモニターにミラーリング"),
     ("Disable Video Output When in Background", "バックグラウンド動作時のビデオ出力を無効にする"),
-    ("Default 3D Renderer", "既定の 3D レンダラー"),
+    ("Default 3D Renderer", "既定の3Dレンダラー"),
     ("Show 3D Reference Axes", "3D参照軸を表示"),
     ("Extended Viewer", "拡張ビューアー"),
     ("Realtime Shadows in Draft", "ドラフトのリアルタイムシャドウ"),
     ("Scripting & Expressions", "スクリプトとエクスプレッション"),
     ("Application Scripting", "アプリケーションのスクリプト"),
     ("Allow Scripts to Write Files and Access Network", "スクリプトによるファイルへの書き込みとネットワークへのアクセスを許可"),
-    ("Warn User When Executing Files", "ファイルの実行時にカーソルに警告"),
+    ("Warn User When Executing Files", "ファイルの実行時にユーザーに警告"),
     ("Enable JavaScript Debugger", "JavaScript デバッガーを使用"),
     ("Expressions Editor", "エクスプレッションエディター"),
     ("Font Size", "フォントサイズ"),
@@ -804,7 +915,7 @@ const JAPANESE: &[(&str, &str)] = &[
     ("Auto-complete", "オートコンプリート"),
     ("Bracket Matching", "対応する括弧をハイライト"),
     ("Word Wrap", "折り返し"),
-    ("Show Expression Error Banner", "式のエラーがある場合に警告バナーを表示"),
+    ("Show Expression Error Banner", "エクスプレッションのエラーがある場合に警告バナーを表示"),
     (
         "Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger.",
         "エクスプレッションはJavaScriptエンジンを使用します。スクリプトのエラーはファイルと行をスクリプトコンソールに報告します。ステップ実行デバッガーはありません。",
@@ -822,12 +933,396 @@ const JAPANESE: &[(&str, &str)] = &[
         "トラッカーパネルのフェイストラッキング（輪郭のみと詳細機能）はここで選んだモデルを使用します。モデルはオープンソースで、要求したときだけダウンロードされ、公開されているSHA-256と照合されます。",
     ),
     ("Match System", "システムに合わせる"),
+    ("Default", "デフォルト"),
+    ("Stored, but not used by EffectCraft yet", "保存されますが、EffectCraftではまだ使用されません"),
     ("Total Offset", "合計オフセット"),
     ("Per Layer", "レイヤーごと"),
     ("Track", "トラック"),
+    ("Selection Tool", "選択ツール"),
+    ("Hand Tool", "手のひらツール"),
+    ("Zoom Tool", "ズームツール"),
+    ("Orbit Around Cursor Tool", "カーソルのまわりを周回ツール"),
+    ("Pan Under Cursor Tool", "カーソルの下でパンツール"),
+    ("Dolly Towards Cursor Tool", "カーソルに向かってドリーツール"),
+    ("Rotation Tool", "回転ツール"),
+    ("Pan Behind (Anchor Point) Tool", "アンカーポイントツール"),
+    ("Rectangle Tool", "長方形ツール"),
+    ("Rounded Rectangle Tool", "角丸長方形ツール"),
+    ("Ellipse Tool", "楕円形ツール"),
+    ("Polygon Tool", "多角形ツール"),
+    ("Star Tool", "スターツール"),
+    ("Pen Tool", "ペンツール"),
+    ("Add Vertex Tool", "頂点を追加ツール"),
+    ("Delete Vertex Tool", "頂点を削除ツール"),
+    ("Convert Vertex Tool", "頂点を切り替えツール"),
+    ("Mask Feather Tool", "マスクの境界のぼかしツール"),
+    ("Horizontal Type Tool", "横書き文字ツール"),
+    ("Vertical Type Tool", "縦書き文字ツール"),
+    ("Brush Tool", "ブラシツール"),
+    ("Clone Stamp Tool", "コピースタンプツール"),
+    ("Eraser Tool", "消しゴムツール"),
+    ("Roto Brush Tool", "ロトブラシツール"),
+    ("Refine Edge Tool", "エッジを調整ツール"),
+    ("Object Matte Tool", "オブジェクトマットツール"),
+    ("Puppet Position Pin Tool", "パペット位置ピンツール"),
+    ("Puppet Starch Pin Tool", "パペットスターチピンツール"),
+    ("Puppet Bend Pin Tool", "パペットベンドピンツール"),
+    ("Puppet Advanced Pin Tool", "パペット詳細ピンツール"),
+    ("Puppet Overlap Pin Tool", "パペット重なりピンツール"),
+    ("Shortcut", "ショートカット"),
+    ("Range", "範囲"),
+    ("Play From", "再生開始位置"),
+    ("Force alphabetical order", "アルファベット順を強制"),
+    ("Frame rate (fps)", "フレームレート (fps)"),
+    ("Import Kind", "読み込みの種類"),
+    ("Delay (s)", "遅延 (秒)"),
+    ("Amount (%)", "量 (%)"),
+    ("Cascade (farther pins trail longer)", "カスケード (離れたピンほど長く遅れる)"),
+    ("Speed (%)", "速度 (%)"),
+    ("Use Draft Deformation", "下書き変形を使用"),
+    ("Show Mesh", "メッシュを表示"),
+    ("Scale X (%)", "X方向の拡大率 (%)"),
+    ("Scale Y (%)", "Y方向の拡大率 (%)"),
+    ("Rotation (degrees)", "回転 (度)"),
+    ("Move X", "X移動"),
+    ("Move Y", "Y移動"),
+    ("Position (pixels)", "位置 (ピクセル)"),
+    ("Position (percent of the composition)", "位置 (コンポジションに対する割合)"),
+    ("Use Dimensions From", "使用するサイズの基準"),
+    ("Still Duration (seconds)", "静止画のデュレーション (秒)"),
+    ("Add to Render Queue", "レンダーキューに追加"),
+    ("Sequence Layers", "レイヤーをシーケンス化"),
+    ("Duration (seconds)", "デュレーション (秒)"),
+    ("Matte color (premultiplied)", "マットの色 (プリマルチプライ)"),
+    ("Invert Alpha", "アルファを反転"),
+    ("Assume this frame rate", "このフレームレートとみなす"),
+    ("Separate Fields", "フィールドを分離"),
+    ("Pixel Aspect Ratio", "ピクセル縦横比"),
+    ("Loop (times)", "ループ (回)"),
+    ("Assign Profile", "プロファイルを割り当て"),
+    ("Preserve RGB", "RGBを保持"),
+    ("Interpret As Linear Light", "リニア光として解釈"),
+    ("Start Timecode", "開始タイムコード"),
+    ("Override Start", "開始値を上書き"),
+    ("Time display style", "タイムコード表示"),
+    ("Color engine", "カラーエンジン"),
+    ("Working space", "作業用スペース"),
+    ("Working gamma", "作業用ガンマ"),
+    ("Linearize working space", "作業用スペースをリニア化"),
+    ("Blend colors using 1.0 gamma", "1.0ガンマで色を混合"),
+    ("Output color space", "出力カラースペース"),
+    ("Video rendering and effects", "ビデオのレンダリングとエフェクト"),
+    ("Time Span", "時間範囲"),
+    ("Blur (pixels before auto-trace)", "ブラー (自動トレース前のピクセル)"),
+    ("Tolerance (pixels)", "許容値 (ピクセル)"),
+    ("Threshold (%)", "しきい値 (%)"),
+    ("Minimum Area (pixels)", "最小領域 (ピクセル)"),
+    ("Corner Roundness (%)", "角の丸み (%)"),
+    ("Apply To New Layer", "新しいレイヤーに適用"),
+    ("Sensitivity threshold (0–1, lower finds more)", "感度のしきい値 (0～1、低いほど多く検出)"),
+    ("Time field (empty: automatic)", "時間フィールド (空欄: 自動)"),
+    ("Video start (ISO date-time, hh:mm:ss, timecode; empty: file date)", "ビデオ開始 (ISO日時、hh:mm:ss、タイムコード、空欄: ファイルの日付)"),
+    ("First sample at (comp seconds)", "最初のサンプル位置 (コンポジション秒)"),
+    ("Frame rate", "フレームレート"),
+    ("Color (#rrggbb)", "カラー (#rrggbb)"),
+    ("Embed footage files", "フッテージを埋め込む"),
+    ("Embed up to (MB)", "埋め込み上限 (MB)"),
+    ("Orient Along Path", "パスに沿って向きを設定"),
+    ("Orient Towards Camera", "カメラの方向に向ける"),
+    ("Orient Towards Point of Interest", "対象点の方向に向ける"),
+    ("Single Composition", "単一コンポジション"),
+    ("Multiple Compositions", "複数のコンポジション"),
+    ("Dissolve Front Layer", "前面のレイヤーをディゾルブ"),
+    ("Cross Dissolve Front and Back Layers", "前後のレイヤーをクロスディゾルブ"),
+    ("Interpret Straight - Unmatted", "ストレート (マットなし) として解釈"),
+    ("Interpret Premultiplied - Matted With Color", "プリマルチプライ (色でマット) として解釈"),
+    ("Upper Field First", "偶数フィールド優先"),
+    ("Lower Field First", "奇数フィールド優先"),
+    ("Rec. 2020", "Rec. 2020"),
+    ("Use Source File Timecode", "ソースファイルのタイムコードを使用"),
+    ("Feet + Frames (35mm)", "フィート + フレーム (35mm)"),
+    ("Feet + Frames (16mm)", "フィート + フレーム (16mm)"),
+    ("Current Frame", "現在のフレーム"),
+    ("Work Area", "ワークエリア"),
+    ("Create Markers", "マーカーを作成"),
+    ("Split Layers", "レイヤーを分割"),
+    ("Split and Precompose", "分割してプリコンポーズ"),
+    ("All layers", "すべてのレイヤー"),
+    ("None (leave them out)", "なし (除外)"),
+    ("Nested sequences", "ネストしたシーケンス"),
+    ("Solid…", "平面…"),
+    ("Light…", "ライト…"),
+    ("Camera…", "カメラ…"),
+    ("Null Object", "ヌルオブジェクト"),
+    ("Shape Layer", "シェイプレイヤー"),
+    ("Adjustment Layer", "調整レイヤー"),
+    ("Layer Settings…", "レイヤー設定…"),
+    ("Create Shapes from Vector Layer", "ベクターレイヤーからシェイプを作成"),
+    ("Create Shapes from Text", "テキストからシェイプを作成"),
+    ("Create Masks from Text", "テキストからマスクを作成"),
+    ("New Mask", "新規マスク"),
+    ("Center In View", "ビューの中央に配置"),
+    ("Fit to Comp", "コンポジションに合わせる"),
+    ("Flip Horizontal", "水平方向に反転"),
+    ("Flip Vertical", "垂直方向に反転"),
+    ("Enable Time Remapping", "時間リマップを有効化"),
+    ("Time-Reverse Layer", "レイヤーを時間反転"),
+    ("Freeze Frame", "フレームを固定"),
+    ("Freeze On Last Frame", "最後のフレームで固定"),
+    ("Add Marker", "マーカーを追加"),
+    ("Bring Layer to Front", "レイヤーを最前面へ"),
+    ("Bring Layer Forward", "レイヤーを前面へ"),
+    ("Send Layer Backward", "レイヤーを背面へ"),
+    ("Send Layer to Back", "レイヤーを最背面へ"),
+    ("Pre-compose…", "プリコンポーズ…"),
+    ("Split Layer", "レイヤーを分割"),
+    ("Layer Style Options...", "レイヤースタイルのオプション..."),
+    ("Convert to Editable Styles", "編集可能なスタイルに変換"),
+    ("Show All", "すべて表示"),
+    ("Remove All", "すべて削除"),
+    ("Separate Dimensions", "次元を分離"),
+    ("Add Property to Essential Graphics", "エッセンシャルグラフィックスにプロパティを追加"),
+    ("Continuous Bezier", "連続ベジェ"),
+    ("Auto Bezier", "自動ベジェ"),
+    ("Lock To Time", "時間に固定"),
+    ("Rove Across Time", "時間をまたいで移動"),
+    ("Anchor Point", "アンカーポイント"),
+    ("All Transform Properties", "すべてのトランスフォームプロパティ"),
+    ("Animate:", "アニメーター："),
+    ("Add property or selector", "プロパティまたはセレクターを追加"),
+    ("Animate text", "テキストをアニメート"),
+    ("Line Anchor", "ラインアンカー"),
+    ("Line Spacing", "ラインスペース"),
+    ("Character Offset", "文字のオフセット"),
+    ("Character Value", "文字コード"),
+    ("Fill Color: RGB", "塗りのカラー: RGB"),
+    ("Fill Color: Hue", "塗りのカラー: 色相"),
+    ("Fill Color: Saturation", "塗りのカラー: 彩度"),
+    ("Fill Color: Brightness", "塗りのカラー: 明るさ"),
+    ("Fill Color: Opacity", "塗りのカラー: 不透明度"),
+    ("Stroke Color: RGB", "線のカラー: RGB"),
+    ("Stroke Color: Hue", "線のカラー: 色相"),
+    ("Stroke Color: Saturation", "線のカラー: 彩度"),
+    ("Stroke Color: Brightness", "線のカラー: 明るさ"),
+    ("Stroke Color: Opacity", "線のカラー: 不透明度"),
+    ("Stroke Width", "線幅"),
+    ("Front: Color", "前面: 色"),
+    ("Bevel: Color", "ベベル: 色"),
+    ("Side: Color", "側面: 色"),
+    ("Back: Color", "背面: 色"),
+    ("Effect Controls", "エフェクトコントロール"),
+    ("Effects & Presets", "エフェクト＆プリセット"),
+    ("Motion Sketch", "モーションスケッチ"),
+    ("Render Queue", "レンダーキュー"),
+    ("Mask Interpolation", "マスク補間"),
+    ("Script Console", "スクリプトコンソール"),
+    ("Essential Graphics", "エッセンシャルグラフィックス"),
+    ("ScriptUI Panel", "ScriptUIパネル"),
+    ("Video Scopes", "ビデオスコープ"),
+    ("Media Browser", "メディアブラウザー"),
+    ("Content-Aware Fill", "コンテンツに応じた塗りつぶし"),
+    ("Create Nulls From Paths", "パスからヌルを作成"),
+    ("VR Comp Editor", "VRコンポジションエディター"),
+    ("Media Duration", "メディアの長さ"),
+    ("Frame Rate", "フレームレート"),
+    ("Resolution", "解像度"),
+    ("Overlays", "オーバーレイ"),
+    ("Layer Controls", "レイヤーコントロール"),
+    ("Loop", "ループ"),
+    ("Cache Before Playback", "再生前にキャッシュ"),
+    ("Pre-roll", "プリロール"),
+    ("Post-roll", "ポストロール"),
+    ("If caching, play cached frames", "キャッシュ中はキャッシュ済みフレームを再生"),
+    ("File Path", "ファイルパス"),
+    ("Interpret Footage", "フッテージの解釈"),
+    ("Create a new Folder", "新しいフォルダーを作成"),
+    ("Create a new Composition", "新しいコンポジションを作成"),
+    ("First Frame", "最初のフレーム"),
+    ("Previous Frame", "前のフレーム"),
+    ("Next Frame", "次のフレーム"),
+    ("Last Frame", "最後のフレーム"),
+    ("Name (A–Z)", "名前 (A–Z)"),
+    ("Merged PRs", "マージ済みPR"),
+    ("Lines added", "追加行数"),
+    ("Lines deleted", "削除行数"),
+    ("Line delta", "行数の差分"),
+    ("Binary assets added", "追加バイナリ"),
+    ("Binary assets removed", "削除バイナリ"),
+    ("First commit", "最初のコミット"),
+    ("Last commit", "最後のコミット"),
+    ("Display name", "表示名"),
+    ("Real name", "本名"),
+    ("ArtCraft website", "ArtCraftのウェブサイト"),
+    ("Source code on GitHub", "GitHubのソースコード"),
+    ("3D Renderer", "3Dレンダラー"),
+    ("Black", "黒"),
+    ("White", "白"),
+    ("Composition Settings", "コンポジション設定"),
+    ("Preset Name", "プリセット名"),
+    ("Save Preset…", "プリセットを保存…"),
+    ("Delete Preset", "プリセットを削除"),
+    ("Lock Aspect Ratio", "縦横比を固定"),
+    ("Frame Rate presets", "フレームレートのプリセット"),
+    ("Background Color", "背景色"),
+    ("Basic", "基本"),
+    ("Shutter Angle", "シャッター角度"),
+    ("Shutter Phase", "シャッターフェーズ"),
+    ("Samples Per Frame", "フレームあたりのサンプル数"),
+    ("Adaptive Sample Limit", "適応サンプル数の上限"),
+    ("X and Y", "XとY"),
+    ("X only", "Xのみ"),
+    ("Y only", "Yのみ"),
+    ("Track Camera", "カメラをトラッキング"),
+    ("Warp Stabilizer", "ワープスタビライザー"),
+    ("Track Motion", "モーションをトラッキング"),
+    ("Stabilize Motion", "モーションを安定化"),
+    ("Motion Source:", "モーションソース:"),
+    ("Current Track:", "現在のトラック:"),
+    ("Track Type:", "トラックの種類:"),
+    ("Motion Target:", "モーションの適用先:"),
+    ("Track Mask:", "トラックマスク:"),
+    ("Analyze forward", "前方を解析"),
+    ("Analyze backward", "後方を解析"),
+    ("Continue Tracking", "トラッキングを続行"),
+    ("Stop Tracking", "トラッキングを停止"),
+    ("Adapt Feature", "特徴を適応"),
+    ("Extrapolate Motion", "モーションを外挿"),
+    ("Attach Point", "アタッチポイント"),
+    ("Track Name", "トラック名"),
+    ("Motion Tracker Options", "モーショントラッカーのオプション"),
+    ("Motion Tracker Apply Options", "モーショントラッカーの適用オプション"),
+    ("Edit Value Graph", "値グラフを編集"),
+    ("Edit Speed Graph", "速度グラフを編集"),
+    ("Show Reference Graph", "参照グラフを表示"),
+    (
+        "Auto-Select Graph Type (speed graph for spatial properties, else value graph)",
+        "グラフの種類を自動選択 (空間プロパティは速度グラフ、それ以外は値グラフ)",
+    ),
+    ("Auto-zoom graph height", "グラフの高さを自動ズーム"),
+    ("Fit all graphs to view", "すべてのグラフをビューに合わせる"),
+    ("Fit selection to view", "選択項目をビューに合わせる"),
+    ("Snap (key drags snap to the current time and other keys)", "スナップ (キーのドラッグを現在の時間や他のキーに合わせる)"),
+    ("Show Transform Box when multiple keys are selected", "複数のキーを選択したときにトランスフォームボックスを表示"),
+    ("Separate Dimensions (Position)", "次元を分離 (位置)"),
+    ("Convert selected keyframes to Hold", "選択したキーフレームをホールドに変換"),
+    ("Convert selected keyframes to Linear", "選択したキーフレームをリニアに変換"),
+    ("Convert selected keyframes to Auto Bezier", "選択したキーフレームを自動ベジェに変換"),
+    ("Easy Ease (F9)", "イージーイーズ (F9)"),
+    ("Easy Ease In (Shift+F9)", "イージーイーズイン (Shift+F9)"),
+    ("Easy Ease Out (Ctrl+Shift+F9)", "イージーイーズアウト (Ctrl+Shift+F9)"),
+    ("Spatial Path", "空間パス"),
+    ("Temporal Path", "時間パス"),
+    ("All the Same", "すべて同じ"),
+    ("All Independently", "すべて個別"),
+    ("Noise Type:", "ノイズの種類:"),
+    ("Apply To:", "適用先:"),
+    ("Temporal Graph", "時間グラフ"),
+    ("Keyframe Rate:", "キーフレームレート:"),
+    ("Capture speed at:", "速度の記録位置:"),
+    ("Start Capture", "記録を開始"),
+    ("Cancel Capture", "記録をキャンセル"),
+    ("Small Caps", "スモールキャップ"),
+    ("All Small Caps", "すべてスモールキャップ"),
+    ("Superscript / Superior", "上付き文字"),
+    ("Subscript / Inferior", "下付き文字"),
+    ("Standard Ligatures", "標準合字"),
+    ("Discretionary Ligatures", "任意合字"),
+    ("Contextual Alternates", "状況依存の代替字形"),
+    ("Stylistic Alternates", "スタイル代替字形"),
+    ("Titling Alternates", "タイトル用代替字形"),
+    ("Default Figure Style", "既定の数字スタイル"),
+    ("Tabular Lining", "等幅ライニング"),
+    ("Proportional Oldstyle", "プロポーショナルオールドスタイル"),
+    ("Proportional Lining", "プロポーショナルライニング"),
+    ("Tabular Oldstyle", "等幅オールドスタイル"),
+    ("Fill Over Stroke", "線の上に塗り"),
+    ("Stroke Over Fill", "塗りの上に線"),
+    ("Stroke order", "線の順序"),
+    ("Single-line Composer", "単一行コンポーザー"),
+    ("Every-line Composer", "全行コンポーザー"),
+    ("Text direction", "テキストの方向"),
+    ("Recently Used", "最近使用した項目"),
+    ("User Presets", "ユーザープリセット"),
+    ("Remove from Favorites", "お気に入りから削除"),
+    ("Show Animation Presets", "アニメーションプリセットを表示"),
+    ("    Refresh List", "    リストを更新"),
+    ("    Clear Recently Used", "    最近使用した項目を消去"),
+    ("Show 32 bpc Effects Only", "32 bpcのエフェクトのみ表示"),
+    ("Show GPU Accelerated Effects Only", "GPUアクセラレーションのエフェクトのみ表示"),
+    ("Show Effects for All Color Depths", "すべての色深度のエフェクトを表示"),
+    ("* Animation Presets", "* アニメーションプリセット"),
+    ("Select a layer to apply to", "適用するレイヤーを選択してください"),
+    ("Search effects and presets", "エフェクトとプリセットを検索"),
+    ("Building waveform…", "波形を生成中…"),
+    ("No effects. Drag one from Effects & Presets.", "エフェクトがありません。エフェクト&プリセットからドラッグしてください。"),
+    (
+        "Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it",
+        "リングをクリックするとカラーを追加します。Altを押しながらストップをクリック（または外へドラッグ）すると削除します",
+    ),
+    (
+        "Start from a ready-made project. Opening a template makes an untitled copy.",
+        "既成のプロジェクトから開始します。テンプレートを開くと無題のコピーが作成されます。",
+    ),
+    ("Square Pixels", "スクエアピクセル"),
+    ("Alpha Expansion:", "アルファの拡張:"),
+    ("Fill Method:", "塗りの方法:"),
+    ("Edge Blend", "エッジのブレンド"),
+    ("Entire Duration", "全体のデュレーション"),
+    ("Reference Frame:", "参照フレーム:"),
+    ("Use Current Time", "現在の時間を使用"),
+    ("Generate Fill Layer", "塗りレイヤーを生成"),
+    ("Lighting Correction:", "ライティングの補正:"),
+    ("Create Text and Camera", "テキストとカメラを作成"),
+    ("Create Solid and Camera", "平面とカメラを作成"),
+    ("Create Null and Camera", "ヌルとカメラを作成"),
+    ("Create Shadow Catcher, Camera and Light", "シャドウキャッチャー、カメラ、ライトを作成"),
+    ("Unable to solve camera", "カメラを解析できません"),
+    ("Waiting to solve", "解析待ち"),
+    ("Create Camera", "カメラを作成"),
+    ("track point", "トラックポイント"),
+    ("Ruler zero point", "ルーラーの原点"),
+    ("Vertical ruler", "垂直ルーラー"),
+    ("Horizontal ruler", "水平ルーラー"),
+    ("Viewer controls", "ビューアーのコントロール"),
+    ("Resolution/Down Sample Factor", "解像度/ダウンサンプル係数"),
+    ("Adjust Exposure", "露出を調整"),
+    ("Snapshot taken", "スナップショットを撮影しました"),
+    ("Fast Previews", "高速プレビュー"),
+    ("3D View", "3Dビュー"),
+    ("Current time", "現在の時間"),
+    ("Layer Transform", "レイヤーのトランスフォーム"),
+    ("Reset Transform", "トランスフォームをリセット"),
+    ("Text Animation", "テキストアニメーション"),
+    ("Text Animation Presets", "テキストアニメーションのプリセット"),
+    ("EffectCraft on getartcraft.com", "getartcraft.com の EffectCraft"),
+    ("Small Screen", "小さい画面"),
+    ("Tool Creates Shape", "ツールでシェイプを作成"),
+    ("Tool Creates Mask", "ツールでマスクを作成"),
+    ("Blend Mode", "描画モード"),
+    ("Show mesh", "メッシュを表示"),
+    ("Record Options...", "記録オプション..."),
+    ("Apply", "適用"),
+    ("Analyze", "分析"),
+    ("Add Point", "ポイントを追加"),
+    ("Remove Point", "ポイントを削除"),
+    ("Render", "レンダリング"),
+    ("Save Current as Template…", "テンプレートとして保存…"),
+    ("New Composition From Footage", "フッテージから新規コンポジション"),
+    ("All", "すべて"),
+    ("Available", "利用可能"),
+    ("Missing", "見つかりません"),
+    ("Filter by footage status", "フッテージの状態で絞り込む"),
+    ("Search project", "プロジェクトを検索"),
+    ("Search", "検索"),
+    ("(no composition)", "（コンポジションなし）"),
+    ("per second", "毎秒"),
+    ("Waveform", "波形"),
+    ("steps", "ステップ"),
+    ("GPU Acceleration (no GPU: software)", "GPUアクセラレーション（GPUなし：ソフトウェア）"),
 ];
 
 const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
+    ("Click to sample color", "单击以取样颜色"),
     ("Appearance Settings…", "外观设置…"),
     ("Add to favorites", "添加到收藏"),
     ("Remove from favorites", "从收藏中移除"),
@@ -861,6 +1356,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Add:", "添加："),
     ("Adjust Exposure (stops)", "调整曝光（光圈级数）"),
     ("Adjust composition duration to the time span of the selected layers", "将合成时长调整为所选图层的时间范围"),
+    ("Advanced", "高级"),
     ("Advanced 3D", "高级 3D"),
     ("Align Layers to:", "将图层对齐到："),
     ("All six face cameras turn together; the scene is not changed.", "六个面摄像机一起旋转；场景不会改变。"),
@@ -884,8 +1380,11 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Browser Storage", "浏览器存储"),
     ("Browse…", "浏览…"),
     ("Brush Dynamics", "画笔动态"),
-    ("Caching frames…", "正在缓存帧…"),
+    ("Caching frames", "正在缓存帧"),
     ("Cancel", "取消"),
+    ("Import After Effects Project", "导入 After Effects 项目"),
+    ("Some parts of this project cannot be imported exactly (left out or changed):", "此项目的某些部分无法准确导入（将被省略或更改）："),
+    ("Import Anyway", "仍然导入"),
     ("Casts Shadows", "投射阴影"),
     ("Change Renderer…", "更改渲染器…"),
     ("Changing a shortcut creates a custom preset; the default stays as it is.", "修改快捷键会创建自定义预设；默认预设保持不变。"),
@@ -963,13 +1462,16 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Duration:", "持续时间："),
     ("Edit Gradient…", "编辑渐变…"),
     ("Edit Target: {}", "编辑目标：{}"),
-    ("Edit in the Timeline", "在时间轴中编辑"),
     ("EffectCraft didn't quit normally last time.", "EffectCraft 上次未正常退出。"),
     ("Effects", "效果"),
     ("Effects & Presets options", "效果和预设选项"),
     ("Copy Presets Folder Path", "复制预设文件夹路径"),
     ("Copy Source Path", "复制源路径"),
     ("Effects: {}", "效果：{}"),
+    ("EXR Bit Depth: {}", "EXR 位深度：{}"),
+    ("EXR Compression: {}", "EXR 压缩：{}"),
+    ("EXR Compression: {} (lossy)", "EXR 压缩：{}（有损）"),
+    ("EXR Compression: {} (uncompressed at float)", "EXR 压缩：{}（浮点下不压缩）"),
     ("Empty folder", "空文件夹"),
     ("Enable Depth of Field", "启用景深"),
     ("Enable Expression", "启用表达式"),
@@ -997,6 +1499,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Frame Aspect Ratio: {}", "帧长宽比：{}"),
     ("Frame Blending: {}", "帧混合：{}"),
     ("Frame Rate:", "帧速率："),
+    ("Resolution:", "分辨率："),
     ("Frame Render Time  {}ms", "帧渲染时间  {} 毫秒"),
     ("Frame Target:", "帧目标："),
     ("Freeze", "冻结"),
@@ -1029,7 +1532,6 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "最新的自动保存：{}"),
     ("Layer", "图层"),
     ("Layer controls", "图层控制"),
-    ("Layer {}", "图层 {}"),
     ("Layer:", "图层："),
     ("Layer: {}", "图层：{}"),
     ("Layer Styles", "图层样式"),
@@ -1090,6 +1592,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("No layer selected", "未选择图层"),
     ("No matching effects or presets", "没有匹配的效果或预设"),
     ("No matching fonts", "没有匹配的字体"),
+    ("Rescan Fonts", "重新扫描字体"),
     ("Variable fonts only", "仅可变字体"),
     ("No model credits were built into this copy.", "此副本未内置模型致谢。"),
     ("No nested compositions", "没有嵌套合成"),
@@ -1123,7 +1626,9 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Overlay", "叠加"),
     ("Parameter Name:", "参数名称："),
     ("Parent pick whip: drag onto a layer", "父级拾取器：拖到图层上"),
+    ("Track Matte pick whip: drag onto a layer", "轨道遮罩拾取器：拖到图层上"),
     ("Pixel Aspect Ratio:", "像素长宽比："),
+    ("Play/Stop", "播放/停止"),
     ("Playing on Video Preview", "在视频预览中播放"),
     ("Post-Render Action: {}", "渲染后动作：{}"),
     ("Preserve frame rate when nested or in render queue", "嵌套或在渲染队列中时保留帧速率"),
@@ -1254,7 +1759,7 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Transparency grid", "透明网格"),
     ("Tutorial complete", "教程完成"),
     ("Two-Node Camera", "双节点摄像机"),
-    ("Type", "文字"),
+    ("Type", "类型"),
     ("Type a command or effect…", "输入命令或效果…"),
     ("URL:", "URL："),
     ("Undock Panel", "取消停靠面板"),
@@ -1333,8 +1838,8 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Import Photoshop File", "导入 Photoshop 文件"),
     ("Interpret Unlabeled Alpha As", "将未标记的 Alpha 解释为"),
     ("Join the ArtCraft Discord", "加入 ArtCraft Discord"),
-    ("Mercury GPU Acceleration ({})", "Mercury GPU 加速（{}）"),
-    ("Mercury Software Only", "仅 Mercury 软件"),
+    ("GPU Acceleration ({})", "GPU 加速（{}）"),
+    ("Software Rendering", "软件渲染"),
     ("OCIO (built-in ACES config)", "OCIO（内置 ACES 配置）"),
     ("Off (Final Quality)", "关闭（最终质量）"),
     ("OpenGL (compatibility)", "OpenGL（兼容）"),
@@ -1565,9 +2070,1642 @@ const SIMPLIFIED_CHINESE: &[(&str, &str)] = &[
     ("Total Offset", "总偏移"),
     ("Per Layer", "每个图层"),
     ("Track", "跟踪"),
+    ("Selection Tool", "选择工具"),
+    ("Hand Tool", "抓手工具"),
+    ("Zoom Tool", "缩放工具"),
+    ("Orbit Around Cursor Tool", "绕行摄像机工具"),
+    ("Pan Under Cursor Tool", "平移摄像机工具"),
+    ("Dolly Towards Cursor Tool", "推拉摄像机工具"),
+    ("Rotation Tool", "旋转工具"),
+    ("Pan Behind (Anchor Point) Tool", "向后平移工具"),
+    ("Rectangle Tool", "矩形工具"),
+    ("Rounded Rectangle Tool", "圆角矩形工具"),
+    ("Ellipse Tool", "椭圆工具"),
+    ("Polygon Tool", "多边形工具"),
+    ("Star Tool", "星形工具"),
+    ("Pen Tool", "钢笔工具"),
+    ("Add Vertex Tool", "添加顶点工具"),
+    ("Delete Vertex Tool", "删除顶点工具"),
+    ("Convert Vertex Tool", "转换顶点工具"),
+    ("Mask Feather Tool", "蒙版羽化工具"),
+    ("Horizontal Type Tool", "横排文字工具"),
+    ("Vertical Type Tool", "直排文字工具"),
+    ("Brush Tool", "画笔工具"),
+    ("Clone Stamp Tool", "仿制图章工具"),
+    ("Eraser Tool", "橡皮擦工具"),
+    ("Roto Brush Tool", "Roto 笔刷工具"),
+    ("Refine Edge Tool", "调整边缘工具"),
+    ("Object Matte Tool", "对象遮罩工具"),
+    ("Puppet Position Pin Tool", "人偶位置控点工具"),
+    ("Puppet Starch Pin Tool", "人偶扑粉控点工具"),
+    ("Puppet Bend Pin Tool", "人偶弯曲控点工具"),
+    ("Puppet Advanced Pin Tool", "人偶高级控点工具"),
+    ("Puppet Overlap Pin Tool", "人偶重叠控点工具"),
+    ("Shortcut", "快捷键"),
+    ("Range", "范围"),
+    ("Play From", "从以下位置播放"),
+    ("Frame Rate", "帧速率"),
+    ("Resolution", "分辨率"),
+    ("Overlays", "叠加"),
+    ("Layer Controls", "图层控制"),
+    ("Loop", "循环"),
+    ("Cache Before Playback", "播放前缓存"),
+    ("Pre-roll", "预卷"),
+    ("Post-roll", "后卷"),
+    ("If caching, play cached frames", "缓存时播放已缓存帧"),
+    ("Apply", "应用"),
+    ("Analyze", "分析"),
+    ("Create Camera", "创建摄像机"),
+    ("Add Point", "添加点"),
+    ("Remove Point", "移除点"),
+    ("Render", "渲染"),
+    ("Save Current as Template…", "将当前项存为模板…"),
+    ("New Composition From Footage", "从素材新建合成"),
+    ("Search effects and presets", "搜索效果和预设"),
+    ("Search project", "搜索项目"),
+    ("Search", "搜索"),
+    ("(no composition)", "没有合成"),
+    ("per second", "每秒"),
+    ("Waveform", "波形"),
+    ("steps", "步"),
+    ("Building waveform…", "正在生成波形…"),
+    ("No effects. Drag one from Effects & Presets.", "没有效果。从效果和预设中拖入一个。"),
+    ("Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it", "点击色环添加颜色；按住 Alt 点击色标（或将其拖出）可移除"),
+    ("Start from a ready-made project. Opening a template makes an untitled copy.", "从现成项目开始。打开模板会创建一份未命名副本。"),
+    ("Square Pixels", "方形像素"),
+    ("Basic", "基本"),
+    ("3D Renderer", "3D 渲染器"),
+    ("Black", "黑色"),
+    ("White", "白色"),
+    ("Composition Settings", "合成设置"),
+    ("Force alphabetical order", "强制按字母顺序"),
+    ("Frame rate (fps)", "帧速率 (fps)"),
+    ("Import Kind", "导入类型"),
+    ("Delay (s)", "延迟 (秒)"),
+    ("Amount (%)", "数量 (%)"),
+    ("Cascade (farther pins trail longer)", "级联 (越远的图钉滞后越长)"),
+    ("Speed (%)", "速度 (%)"),
+    ("Use Draft Deformation", "使用草稿变形"),
+    ("Show Mesh", "显示网格"),
+    ("Scale X (%)", "X 缩放 (%)"),
+    ("Scale Y (%)", "Y 缩放 (%)"),
+    ("Rotation (degrees)", "旋转 (度)"),
+    ("Move X", "移动 X"),
+    ("Move Y", "移动 Y"),
+    ("Position (pixels)", "位置 (像素)"),
+    ("Position (percent of the composition)", "位置 (合成百分比)"),
+    ("Use Dimensions From", "尺寸来源"),
+    ("Still Duration (seconds)", "静止图像持续时间 (秒)"),
+    ("Add to Render Queue", "添加到渲染队列"),
+    ("Sequence Layers", "序列图层"),
+    ("Duration (seconds)", "持续时间 (秒)"),
+    ("Matte color (premultiplied)", "遮罩颜色 (预乘)"),
+    ("Invert Alpha", "反转 Alpha"),
+    ("Assume this frame rate", "按此帧速率处理"),
+    ("Separate Fields", "分离场"),
+    ("Pixel Aspect Ratio", "像素长宽比"),
+    ("Loop (times)", "循环 (次)"),
+    ("Assign Profile", "指定配置文件"),
+    ("Preserve RGB", "保留 RGB"),
+    ("Interpret As Linear Light", "解释为线性光"),
+    ("Start Timecode", "开始时间码"),
+    ("Override Start", "覆盖开始"),
+    ("Time display style", "时间显示样式"),
+    ("Color engine", "颜色引擎"),
+    ("Working space", "工作空间"),
+    ("Working gamma", "工作伽马"),
+    ("Linearize working space", "线性化工作空间"),
+    ("Blend colors using 1.0 gamma", "使用 1.0 伽马混合颜色"),
+    ("Output color space", "输出颜色空间"),
+    ("Video rendering and effects", "视频渲染与效果"),
+    ("Time Span", "时间范围"),
+    ("Blur (pixels before auto-trace)", "模糊 (自动描摹前的像素)"),
+    ("Tolerance (pixels)", "容差 (像素)"),
+    ("Threshold (%)", "阈值 (%)"),
+    ("Minimum Area (pixels)", "最小区域 (像素)"),
+    ("Corner Roundness (%)", "角圆度 (%)"),
+    ("Apply To New Layer", "应用到新图层"),
+    ("Sensitivity threshold (0–1, lower finds more)", "灵敏度阈值 (0–1，越低找到的越多)"),
+    ("Time field (empty: automatic)", "时间字段 (为空: 自动)"),
+    ("Video start (ISO date-time, hh:mm:ss, timecode; empty: file date)", "视频开始 (ISO 日期时间、hh:mm:ss、时间码；为空: 文件日期)"),
+    ("First sample at (comp seconds)", "首个采样位置 (合成秒)"),
+    ("Frame rate", "帧速率"),
+    ("Color (#rrggbb)", "颜色 (#rrggbb)"),
+    ("Embed footage files", "嵌入素材文件"),
+    ("Embed up to (MB)", "嵌入上限 (MB)"),
+    ("Orient Along Path", "沿路径定向"),
+    ("Orient Towards Camera", "朝向摄像机"),
+    ("Orient Towards Point of Interest", "朝向目标点"),
+    ("Single Composition", "单个合成"),
+    ("Multiple Compositions", "多个合成"),
+    ("Dissolve Front Layer", "溶解前层"),
+    ("Cross Dissolve Front and Back Layers", "交叉溶解前后层"),
+    ("Interpret Straight - Unmatted", "解释为直接 (未遮罩)"),
+    ("Interpret Premultiplied - Matted With Color", "解释为预乘 (以颜色遮罩)"),
+    ("Upper Field First", "上场优先"),
+    ("Lower Field First", "下场优先"),
+    ("Rec. 2020", "Rec. 2020"),
+    ("Use Source File Timecode", "使用源文件时间码"),
+    ("Feet + Frames (35mm)", "英尺 + 帧 (35mm)"),
+    ("Feet + Frames (16mm)", "英尺 + 帧 (16mm)"),
+    ("Current Frame", "当前帧"),
+    ("Work Area", "工作区域"),
+    ("Create Markers", "创建标记"),
+    ("Split Layers", "拆分图层"),
+    ("Split and Precompose", "拆分并预合成"),
+    ("All layers", "所有图层"),
+    ("None (leave them out)", "无 (不含)"),
+    ("Nested sequences", "嵌套序列"),
+    ("Solid…", "纯色…"),
+    ("Light…", "灯光…"),
+    ("Camera…", "摄像机…"),
+    ("Null Object", "空对象"),
+    ("Shape Layer", "形状图层"),
+    ("Adjustment Layer", "调整图层"),
+    ("Layer Settings…", "图层设置…"),
+    ("Create Shapes from Vector Layer", "从矢量图层创建形状"),
+    ("Create Shapes from Text", "从文本创建形状"),
+    ("Create Masks from Text", "从文本创建遮罩"),
+    ("New Mask", "新建遮罩"),
+    ("Center In View", "在视图中居中"),
+    ("Fit to Comp", "适应合成"),
+    ("Flip Horizontal", "水平翻转"),
+    ("Flip Vertical", "垂直翻转"),
+    ("Enable Time Remapping", "启用时间重映射"),
+    ("Time-Reverse Layer", "时间反向图层"),
+    ("Freeze Frame", "冻结帧"),
+    ("Freeze On Last Frame", "在最后一帧冻结"),
+    ("Add Marker", "添加标记"),
+    ("Bring Layer to Front", "图层置顶"),
+    ("Bring Layer Forward", "图层上移一层"),
+    ("Send Layer Backward", "图层下移一层"),
+    ("Send Layer to Back", "图层置底"),
+    ("Pre-compose…", "预合成…"),
+    ("Split Layer", "拆分图层"),
+    ("Layer Style Options...", "图层样式选项..."),
+    ("Convert to Editable Styles", "转换为可编辑样式"),
+    ("Show All", "全部显示"),
+    ("Remove All", "全部移除"),
+    ("Separate Dimensions", "分离维度"),
+    ("Add Property to Essential Graphics", "将属性添加到基本图形"),
+    ("Continuous Bezier", "连续贝塞尔"),
+    ("Auto Bezier", "自动贝塞尔"),
+    ("Lock To Time", "锁定到时间"),
+    ("Rove Across Time", "跨时间漫游"),
+    ("Anchor Point", "锚点"),
+    ("All Transform Properties", "所有变换属性"),
+    ("Line Anchor", "行锚点"),
+    ("Line Spacing", "行距"),
+    ("Character Offset", "字符偏移"),
+    ("Character Value", "字符值"),
+    ("Fill Color: RGB", "填充颜色: RGB"),
+    ("Fill Color: Hue", "填充颜色: 色相"),
+    ("Fill Color: Saturation", "填充颜色: 饱和度"),
+    ("Fill Color: Brightness", "填充颜色: 亮度"),
+    ("Fill Color: Opacity", "填充颜色: 不透明度"),
+    ("Stroke Color: RGB", "描边颜色: RGB"),
+    ("Stroke Color: Hue", "描边颜色: 色相"),
+    ("Stroke Color: Saturation", "描边颜色: 饱和度"),
+    ("Stroke Color: Brightness", "描边颜色: 亮度"),
+    ("Stroke Color: Opacity", "描边颜色: 不透明度"),
+    ("Stroke Width", "描边宽度"),
+    ("Front: Color", "前面: 颜色"),
+    ("Bevel: Color", "斜面: 颜色"),
+    ("Side: Color", "侧面: 颜色"),
+    ("Back: Color", "背面: 颜色"),
+    ("Effect Controls", "效果控件"),
+    ("Effects & Presets", "效果和预设"),
+    ("Motion Sketch", "运动草图"),
+    ("Render Queue", "渲染队列"),
+    ("Mask Interpolation", "遮罩插值"),
+    ("Script Console", "脚本控制台"),
+    ("Essential Graphics", "基本图形"),
+    ("ScriptUI Panel", "ScriptUI 面板"),
+    ("Video Scopes", "视频示波器"),
+    ("Media Browser", "媒体浏览器"),
+    ("Content-Aware Fill", "内容识别填充"),
+    ("Create Nulls From Paths", "从路径创建空对象"),
+    ("VR Comp Editor", "VR 合成编辑器"),
+    ("Media Duration", "媒体持续时间"),
+    ("File Path", "文件路径"),
+    ("Interpret Footage", "解释素材"),
+    ("Create a new Folder", "新建文件夹"),
+    ("Create a new Composition", "新建合成"),
+    ("First Frame", "第一帧"),
+    ("Previous Frame", "上一帧"),
+    ("Next Frame", "下一帧"),
+    ("Last Frame", "最后一帧"),
+    ("Name (A–Z)", "名称 (A–Z)"),
+    ("Merged PRs", "已合并 PR"),
+    ("Lines added", "添加的行数"),
+    ("Lines deleted", "删除的行数"),
+    ("Line delta", "行数差异"),
+    ("Binary assets added", "添加的二进制资源"),
+    ("Binary assets removed", "删除的二进制资源"),
+    ("First commit", "首次提交"),
+    ("Last commit", "最近提交"),
+    ("Display name", "显示名称"),
+    ("Real name", "真实姓名"),
+    ("ArtCraft website", "ArtCraft 网站"),
+    ("Source code on GitHub", "GitHub 上的源代码"),
+    ("Preset Name", "预设名称"),
+    ("Save Preset…", "保存预设…"),
+    ("Delete Preset", "删除预设"),
+    ("Lock Aspect Ratio", "锁定长宽比"),
+    ("Frame Rate presets", "帧速率预设"),
+    ("Background Color", "背景颜色"),
+    ("Shutter Angle", "快门角度"),
+    ("Shutter Phase", "快门相位"),
+    ("Samples Per Frame", "每帧采样数"),
+    ("Adaptive Sample Limit", "自适应采样上限"),
+    ("X and Y", "X 和 Y"),
+    ("X only", "仅 X"),
+    ("Y only", "仅 Y"),
+    ("Track Camera", "跟踪摄像机"),
+    ("Warp Stabilizer", "变形稳定器"),
+    ("Track Motion", "跟踪运动"),
+    ("Stabilize Motion", "稳定运动"),
+    ("Motion Source:", "运动源:"),
+    ("Current Track:", "当前跟踪:"),
+    ("Track Type:", "跟踪类型:"),
+    ("Motion Target:", "运动目标:"),
+    ("Track Mask:", "跟踪遮罩:"),
+    ("Analyze forward", "向前分析"),
+    ("Analyze backward", "向后分析"),
+    ("Continue Tracking", "继续跟踪"),
+    ("Stop Tracking", "停止跟踪"),
+    ("Adapt Feature", "自适应特征"),
+    ("Extrapolate Motion", "外推运动"),
+    ("Attach Point", "附加点"),
+    ("Track Name", "跟踪名称"),
+    ("Motion Tracker Options", "运动跟踪器选项"),
+    ("Motion Tracker Apply Options", "运动跟踪器应用选项"),
+    ("Edit Value Graph", "编辑值图表"),
+    ("Edit Speed Graph", "编辑速度图表"),
+    ("Show Reference Graph", "显示参考图表"),
+    ("Auto-Select Graph Type (speed graph for spatial properties, else value graph)", "自动选择图表类型 (空间属性用速度图表，否则用值图表)"),
+    ("Auto-zoom graph height", "自动缩放图表高度"),
+    ("Fit all graphs to view", "使所有图表适合视图"),
+    ("Fit selection to view", "使所选内容适合视图"),
+    ("Snap (key drags snap to the current time and other keys)", "吸附 (关键帧拖动时吸附到当前时间和其他关键帧)"),
+    ("Show Transform Box when multiple keys are selected", "选择多个关键帧时显示变换框"),
+    ("Separate Dimensions (Position)", "分离维度 (位置)"),
+    ("Convert selected keyframes to Hold", "将所选关键帧转换为定格"),
+    ("Convert selected keyframes to Linear", "将所选关键帧转换为线性"),
+    ("Convert selected keyframes to Auto Bezier", "将所选关键帧转换为自动贝塞尔"),
+    ("Easy Ease (F9)", "缓动 (F9)"),
+    ("Easy Ease In (Shift+F9)", "缓入 (Shift+F9)"),
+    ("Easy Ease Out (Ctrl+Shift+F9)", "缓出 (Ctrl+Shift+F9)"),
+    ("Spatial Path", "空间路径"),
+    ("Temporal Path", "时间路径"),
+    ("All the Same", "全部相同"),
+    ("All Independently", "全部独立"),
+    ("Noise Type:", "噪波类型:"),
+    ("Apply To:", "应用到:"),
+    ("Temporal Graph", "时间图表"),
+    ("Keyframe Rate:", "关键帧速率:"),
+    ("Capture speed at:", "速度捕获位置:"),
+    ("Start Capture", "开始捕获"),
+    ("Cancel Capture", "取消捕获"),
+    ("Small Caps", "小型大写字母"),
+    ("All Small Caps", "全部小型大写字母"),
+    ("Superscript / Superior", "上标"),
+    ("Subscript / Inferior", "下标"),
+    ("Standard Ligatures", "标准连字"),
+    ("Discretionary Ligatures", "可选连字"),
+    ("Contextual Alternates", "上下文替换"),
+    ("Stylistic Alternates", "样式替换"),
+    ("Titling Alternates", "标题替换"),
+    ("Default Figure Style", "默认数字样式"),
+    ("Tabular Lining", "等宽线条"),
+    ("Proportional Oldstyle", "比例旧式"),
+    ("Proportional Lining", "比例线条"),
+    ("Tabular Oldstyle", "等宽旧式"),
+    ("Fill Over Stroke", "填充在描边之上"),
+    ("Stroke Over Fill", "描边在填充之上"),
+    ("Stroke order", "描边顺序"),
+    ("Single-line Composer", "单行书写器"),
+    ("Every-line Composer", "逐行书写器"),
+    ("Text direction", "文本方向"),
+    ("Recently Used", "最近使用"),
+    ("User Presets", "用户预设"),
+    ("Remove from Favorites", "从收藏夹移除"),
+    ("Show Animation Presets", "显示动画预设"),
+    ("    Refresh List", "    刷新列表"),
+    ("    Clear Recently Used", "    清除最近使用"),
+    ("Show 32 bpc Effects Only", "仅显示 32 bpc 效果"),
+    ("Show GPU Accelerated Effects Only", "仅显示 GPU 加速效果"),
+    ("Show Effects for All Color Depths", "显示所有颜色深度的效果"),
+    ("* Animation Presets", "* 动画预设"),
+    ("Select a layer to apply to", "请选择要应用到的图层"),
+    ("Alpha Expansion:", "Alpha 扩展:"),
+    ("Fill Method:", "填充方式:"),
+    ("Edge Blend", "边缘混合"),
+    ("Entire Duration", "整个持续时间"),
+    ("Reference Frame:", "参考帧:"),
+    ("Use Current Time", "使用当前时间"),
+    ("Generate Fill Layer", "生成填充图层"),
+    ("Lighting Correction:", "光照校正:"),
+    ("Create Text and Camera", "创建文本和摄像机"),
+    ("Create Solid and Camera", "创建纯色和摄像机"),
+    ("Create Null and Camera", "创建空对象和摄像机"),
+    ("Create Shadow Catcher, Camera and Light", "创建阴影捕捉器、摄像机和灯光"),
+    ("Unable to solve camera", "无法求解摄像机"),
+    ("Waiting to solve", "等待求解"),
+    ("track point", "跟踪点"),
+    ("Ruler zero point", "标尺零点"),
+    ("Vertical ruler", "垂直标尺"),
+    ("Horizontal ruler", "水平标尺"),
+    ("Viewer controls", "查看器控件"),
+    ("Resolution/Down Sample Factor", "分辨率/降采样系数"),
+    ("Adjust Exposure", "调整曝光"),
+    ("Snapshot taken", "已拍摄快照"),
+    ("Fast Previews", "快速预览"),
+    ("3D View", "3D 视图"),
+    ("Current time", "当前时间"),
+    ("Layer Transform", "图层变换"),
+    ("Reset Transform", "重置变换"),
+    ("Text Animation", "文本动画"),
+    ("Text Animation Presets", "文本动画预设"),
+    ("EffectCraft on getartcraft.com", "getartcraft.com 上的 EffectCraft"),
+    ("Small Screen", "小屏幕"),
+    ("Tool Creates Shape", "工具创建形状"),
+    ("Tool Creates Mask", "工具创建遮罩"),
+    ("Blend Mode", "混合模式"),
+    ("Show mesh", "显示网格"),
+    ("Record Options...", "记录选项..."),
+    ("GPU Acceleration (no GPU: software)", "GPU 加速（无 GPU：软件）"),
+];
+
+/// Swedish (`sv`), written from the English source.
+const SWEDISH: &[(&str, &str)] = &[
+    ("Appearance Settings…", "Utseendeinställningar…"),
+    ("Add to favorites", "Lägg till i favoriter"),
+    ("Remove from favorites", "Ta bort från favoriter"),
+    ("   OK   ", "   OK   "),
+    ("  Delete  ", "  Radera  "),
+    (" Open Auto-Save ", " Öppna autosparad fil "),
+    ("(missing)", "(saknas)"),
+    ("360 View Orientation", "Orientering för 360-vy"),
+    ("3:2 Pulldown: {}", "3:2-pulldown: {}"),
+    (
+        "A clean-room, open-source compositor for motion graphics and visual effects: native on macOS, Windows and Linux, and in the browser. Part of the ArtCraft family of creative apps.",
+        "En clean room-utvecklad kompositör med öppen källkod för rörlig grafik och visuella effekter: inbyggd på macOS, Windows och Linux samt i webbläsaren. Del av ArtCraft-familjen av kreativa program.",
+    ),
+    ("About EffectCraft", "Om EffectCraft"),
+    ("About...", "Om..."),
+    ("Active", "Aktiv"),
+    ("Active Camera", "Aktiv kamera"),
+    ("Alpha", "Alfa"),
+    ("Adapt Feature On Every Frame", "Anpassa spårdetalj i varje bildruta"),
+    ("Adaptive Sample Limit:", "Gräns för adaptiva sampel:"),
+    ("Add Animator", "Lägg till animerare"),
+    ("Add Comment", "Lägg till kommentar"),
+    ("Add Formatting", "Lägg till formatering"),
+    ("Add Group", "Lägg till grupp"),
+    ("Add Mirror", "Lägg till spegel"),
+    ("Add Selected As", "Lägg till markerade som"),
+    ("Add a comment", "Lägg till en kommentar"),
+    ("Add a shape, fill, stroke or path operation", "Lägg till en form, fyllning, kontur eller banoperation"),
+    ("Add to Composition", "Lägg till i komposition"),
+    ("Add to Favorites", "Lägg till i favoriter"),
+    ("Add:", "Lägg till:"),
+    ("Adjust Exposure (stops)", "Justera exponering (stopp)"),
+    ("Adjust composition duration to the time span of the selected layers", "Anpassa kompositionens längd till de markerade lagrens tidsspann"),
+    ("Advanced 3D", "Avancerad 3D"),
+    ("Align Layers to:", "Justera lager mot:"),
+    ("All six face cameras turn together; the scene is not changed.", "Alla sex sidokameror vrids tillsammans; scenen ändras inte."),
+    ("Anchor:", "Ankare:"),
+    ("Aperture", "Bländare"),
+    ("Appearance Mode", "Utseendeläge"),
+    ("Appearance Mode: {}", "Utseendeläge: {}"),
+    ("Apply Dimensions:", "Använd dimensioner:"),
+    ("Apply Motion To:", "Använd rörelse på:"),
+    ("Arrange", "Ordna"),
+    ("Assign", "Tilldela"),
+    ("Auto", "Auto"),
+    ("Auto-saves", "Automatiska sparningar"),
+    ("Back", "Tillbaka"),
+    ("Background Color:", "Bakgrundsfärg:"),
+    ("Blend Mode:", "Blandningsläge:"),
+    ("Blending Mode", "Blandningsläge"),
+    ("Blur", "Oskärpa"),
+    ("Blur Level", "Oskärpenivå"),
+    ("Boundary", "Gräns"),
+    ("Browser Storage", "Webbläsarlagring"),
+    ("Browse…", "Bläddra…"),
+    ("Brush Dynamics", "Penseldynamik"),
+    ("Caching frames", "Cachelagrar bildrutor"),
+    ("Cancel", "Avbryt"),
+    ("Import After Effects Project", "Importera After Effects-projekt"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Vissa delar av projektet kan inte importeras exakt (utelämnas eller ändras):",
+    ),
+    ("Import Anyway", "Importera ändå"),
+    ("Casts Shadows", "Kastar skuggor"),
+    ("Change Renderer…", "Byt renderare…"),
+    (
+        "Changing a shortcut creates a custom preset; the default stays as it is.",
+        "Om du ändrar ett kortkommando skapas en anpassad förinställning; standardinställningen förblir som den är.",
+    ),
+    ("Channel", "Kanal"),
+    ("Channel:", "Kanal:"),
+    ("Chapter:", "Kapitel:"),
+    ("Choose...", "Välj..."),
+    ("Classic 3D", "Klassisk 3D"),
+    ("Clear", "Rensa"),
+    ("Clear list", "Rensa listan"),
+    ("Click a key to see its commands.", "Klicka på en tangent för att se dess kommandon."),
+    (
+        "Click above the bar to add an opacity stop, below it to add a color stop.",
+        "Klicka ovanför fältet för att lägga till ett opacitetsstopp och under det för att lägga till ett färgstopp.",
+    ),
+    ("Click adds a point (½ height = no change)", "Klicka för att lägga till en punkt (½ höjd = ingen ändring)"),
+    ("Click adds a point; drag one off to remove", "Klicka för att lägga till en punkt; dra ut en punkt för att ta bort den"),
+    ("Click to make this viewer active", "Klicka för att göra den här visningen aktiv"),
+    ("Click to reveal the expression in the timeline", "Klicka för att visa uttrycket i tidslinjen"),
+    ("Click to show the active composition here", "Klicka för att visa den aktiva kompositionen här"),
+    ("Click, then click in the Composition panel", "Klicka och klicka sedan i panelen Komposition"),
+    ("Clone Options", "Klonalternativ"),
+    ("Clone Source Overlay:", "Överlägg för klonkälla:"),
+    ("Close", "Stäng"),
+    ("Close Panel", "Stäng panel"),
+    ("Close tutorial", "Stäng självstudien"),
+    ("Color", "Färg"),
+    ("Color Depth: {}", "Färgdjup: {}"),
+    ("Color:", "Färg:"),
+    ("Colour map", "Färgkarta"),
+    ("Columns", "Kolumner"),
+    ("Comment:", "Kommentar:"),
+    ("Community", "Gemenskap"),
+    ("Composition", "Komposition"),
+    ("Composition Mini-Flowchart", "Kompositionens miniflödesschema"),
+    ("Composition Name:", "Kompositionsnamn:"),
+    ("Composition Settings ▸ 3D Renderer", "Kompositionsinställningar ▸ 3D-renderare"),
+    ("Composition Settings…", "Kompositionsinställningar…"),
+    ("Composition marker bin: drag a marker to the time ruler", "Kompositionens markörbin: dra en markör till tidslinjalen"),
+    ("Cone Angle", "Konvinkel"),
+    ("Cone Feather", "Konfjädring"),
+    ("Constrain Proportions", "Behåll proportioner"),
+    ("Continuous (Lock Outgoing to Incoming)", "Kontinuerlig (lås utgående till inkommande)"),
+    ("Cue Point", "Referenspunkt"),
+    ("Current Render", "Aktuell rendering"),
+    ("Dark", "Mörk"),
+    ("Dark Theme", "Mörkt tema"),
+    ("Darker", "Mörkare"),
+    ("Default Output:", "Standardutgång:"),
+    ("Default: {}", "Standard: {}"),
+    ("Defaults", "Standardvärden"),
+    ("Delete", "Radera"),
+    ("Delete Selected Points", "Radera markerade punkter"),
+    ("Delete selected project items", "Radera markerade projektobjekt"),
+    ("Delete this template", "Radera den här mallen"),
+    ("Depth of Field", "Skärpedjup"),
+    ("Discord", "Discord"),
+    ("Distribute Layers:", "Fördela lager:"),
+    ("Don't Recover", "Återställ inte"),
+    ("Don't Save", "Spara inte"),
+    ("Double-click a layer to open it in the Layer panel", "Dubbelklicka på ett lager för att öppna det i panelen Lager"),
+    ("Double-click footage in the Project panel to open it here", "Dubbelklicka på material i panelen Projekt för att öppna det här"),
+    ("Double-click to edit the comment", "Dubbelklicka för att redigera kommentaren"),
+    ("Download", "Hämta"),
+    (
+        "Drag properties here from the timeline,\nor use Animation > Add Property to Essential Graphics.",
+        "Dra hit egenskaper från tidslinjen,\neller använd Animering > Lägg till egenskap i Grundläggande grafik.",
+    ),
+    ("Drag to change", "Dra för att ändra"),
+    ("Drag to create a guide", "Dra för att skapa en stödlinje"),
+    ("Drag to slip the source", "Dra för att slip-flytta källan"),
+    ("Drop Frame", "Drop frame"),
+    ("Duplicate", "Duplicera"),
+    ("Duration:", "Längd:"),
+    ("Edit Gradient…", "Redigera gradient…"),
+    ("Edit Target: {}", "Redigeringsmål: {}"),
+    ("EffectCraft didn't quit normally last time.", "EffectCraft avslutades inte normalt förra gången."),
+    ("Effects & Presets options", "Alternativ för Effekter och förinställningar"),
+    ("Copy Presets Folder Path", "Kopiera sökväg till förinställningsmappen"),
+    ("Effects: {}", "Effekter: {}"),
+    ("EXR Bit Depth: {}", "EXR-bitdjup: {}"),
+    ("EXR Compression: {}", "EXR-komprimering: {}"),
+    ("EXR Compression: {} (lossy)", "EXR-komprimering: {} (förstörande)"),
+    ("EXR Compression: {} (uncompressed at float)", "EXR-komprimering: {} (okomprimerad vid float)"),
+    ("Empty folder", "Tom mapp"),
+    ("Enable Depth of Field", "Aktivera skärpedjup"),
+    ("Enable Expression", "Aktivera uttryck"),
+    ("Enhance", "Förbättra"),
+    ("Essential Properties — {}", "Grundläggande egenskaper — {}"),
+    ("Event", "Händelse"),
+    ("Export Template…", "Exportera mall…"),
+    ("Export...", "Exportera..."),
+    ("Expression Language Menu", "Meny för uttrycksspråk"),
+    ("Expression pick whip: drag onto a property", "Uttryckets plockpiska: dra till en egenskap"),
+    ("Expression:", "Uttryck:"),
+    ("Eyedropper: click, then click in the Composition panel", "Pipett: klicka och klicka sedan i panelen Komposition"),
+    ("Falloff", "Avtagande"),
+    ("Falloff Distance", "Avstånd för avtagande"),
+    ("Favorites", "Favoriter"),
+    ("Field Render: {}", "Fältrendering: {}"),
+    ("Figures", "Figurer"),
+    ("Fill Target", "Fyllningsmål"),
+    ("Finished", "Klar"),
+    ("Flowchart: {}", "Flödesschema: {}"),
+    ("Focus Distance", "Fokusavstånd"),
+    ("Follow Feature Rotation and Scale", "Följ detaljens rotation och skala"),
+    ("Footage: {}", "Material: {}"),
+    ("Format: {}", "Format: {}"),
+    ("Frame Aspect Ratio: {}", "Bildförhållande för bildruta: {}"),
+    ("Frame Blending: {}", "Bildblandning: {}"),
+    ("Frame Rate:", "Bildfrekvens:"),
+    ("Frame Render Time  {}ms", "Renderingstid per bildruta  {} ms"),
+    ("Frame Target:", "Bildrutemål:"),
+    ("Freeze", "Frys"),
+    ("Grab bag", "Blandat"),
+    ("Gradient Editor", "Gradientredigerare"),
+    ("Grid", "Rutnät"),
+    ("Guide Layers: {}", "Stödlager: {}"),
+    ("Guides", "Stödlinjer"),
+    ("Height:", "Höjd:"),
+    ("Hide This", "Dölj den här"),
+    ("Histogram", "Histogram"),
+    ("Hold In Place", "Håll kvar på plats"),
+    ("Home", "Start"),
+    ("If Confidence is Below", "Om konfidensen är under"),
+    ("Import", "Importera"),
+    ("Import and Add to Composition", "Importera och lägg till i komposition"),
+    ("Import...", "Importera..."),
+    ("Imported media", "Importerade media"),
+    ("Influence:", "Inverkan:"),
+    ("Install from File…", "Installera från fil…"),
+    ("Intensity", "Intensitet"),
+    ("Inverted", "Inverterad"),
+    ("Join the ArtCraft community on Discord", "Gå med i ArtCrafts community på Discord"),
+    ("Key: {}", "Tangent: {}"),
+    ("LEARN", "LÄR DIG"),
+    ("Label", "Etikett"),
+    ("Label Colors and Names:", "Etikettfärger och namn:"),
+    ("Label:", "Etikett:"),
+    ("Latest auto-save: {}", "Senaste autosparning: {}"),
+    ("Layer", "Lager"),
+    ("Layer controls", "Lagerkontroller"),
+    ("Layer:", "Lager:"),
+    ("Layer: {}", "Lager: {}"),
+    ("Learn", "Lär dig"),
+    ("Leave all attributes in \"{}\"", "Lämna alla attribut i \"{}\""),
+    ("Licence: {}", "Licens: {}"),
+    ("Ligatures", "Ligaturer"),
+    ("Light", "Ljus"),
+    ("Light Theme", "Ljust tema"),
+    ("Light Type", "Ljustyp"),
+    ("Lighter", "Ljusare"),
+    ("Link Selected Property", "Länka markerad egenskap"),
+    ("Location:", "Plats:"),
+    ("Lock Aspect Ratio to {}", "Lås bildförhållandet till {}"),
+    ("Lock to Zoom", "Lås till zoom"),
+    ("Locked: {} — {}", "Låst: {} — {}"),
+    ("Log:", "Log:"),
+    ("Loop (Trace Path)", "Loopa (följ bana)"),
+    ("MIT OR Apache-2.0 • Fonts: Inter, JetBrains Mono (OFL)", "MIT OR Apache-2.0 • Typsnitt: Inter, JetBrains Mono (OFL)"),
+    ("Magnification ratio popup", "Meny för förstoringsgrad"),
+    ("Make Comp Size", "Anpassa till kompositionsstorlek"),
+    ("Markers", "Markörer"),
+    ("Masks", "Masker"),
+    ("Maximize Panel", "Maximera panel"),
+    ("Media Replacement", "Ersätt media"),
+    ("Mesh:", "Nät:"),
+    ("Diameter:", "Diameter:"),
+    ("Method Used: {}    Average Error: {} pixels", "Använd metod: {}    Medelfel: {} pixlar"),
+    ("Models folder: {}", "Modellmapp: {}"),
+    ("Modifiers:", "Modifieringstangenter:"),
+    ("More", "Mer"),
+    ("More ArtCraft apps", "Fler ArtCraft-appar"),
+    ("More tutorials", "Fler självstudier"),
+    ("Motion Blur", "Rörelseoskärpa"),
+    ("Motion Blur: {}", "Rörelseoskärpa: {}"),
+    ("Motion Sketch: drag to record", "Rörelseskiss: dra för att spela in"),
+    ("Move Down", "Flytta ned"),
+    ("Move Up", "Flytta upp"),
+    ("Move to Project Root", "Flytta till projektets rot"),
+    ("Name", "Namn"),
+    ("Name:", "Namn:"),
+    ("Navigation", "Navigering"),
+    ("New", "Nytt"),
+    ("New Comp from Selection", "Ny komposition från markering"),
+    ("Replace with Precomposition", "Ersätt med förkomposition"),
+    ("New Duration:", "Ny längd:"),
+    ("New composition name:", "Namn på ny komposition:"),
+    ("New from Render Queue item:", "Ny från objekt i renderingskön:"),
+    ("New from Template", "Ny från mall"),
+    ("Next", "Nästa"),
+    ("Nice work. Pick another tutorial on the Home screen's Learn tab.", "Bra jobbat! Välj en annan självstudie på fliken Lär dig på startskärmen."),
+    (
+        "No VR environments yet. Create one with Composition ▸ VR ▸ Create VR Environment…",
+        "Inga VR-miljöer ännu. Skapa en med Komposition ▸ VR ▸ Skapa VR-miljö…",
+    ),
+    ("No audio layer selected", "Inget ljudlager markerat"),
+    ("No background jobs running", "Inga bakgrundsjobb körs"),
+    ("No composition markers", "Inga kompositionsmarkörer"),
+    ("No contributor data was built into this copy.", "Inga uppgifter om bidragsgivare finns inbyggda i den här kopian."),
+    ("No device list from this host; the system default output is used.", "Värden tillhandahåller ingen enhetslista. Systemets standardutgång används."),
+    ("No layer selected", "Inget lager markerat"),
+    ("No matching effects or presets", "Inga matchande effekter eller förinställningar"),
+    ("No matching fonts", "Inga matchande typsnitt"),
+    ("Variable fonts only", "Endast variabla typsnitt"),
+    ("No model credits were built into this copy.", "Inga modellkrediteringar finns inbyggda i den här kopian."),
+    ("No nested compositions", "Inga kapslade kompositioner"),
+    ("No shortcut", "Inget kortkommando"),
+    ("No unlocked layer selected", "Inget upplåst lager markerat"),
+    ("No video", "Ingen video"),
+    ("None", "Ingen"),
+    ("Not applied: tick it in the list to add it.", "Inte använd: markera den i listan för att lägga till den."),
+    ("Not assigned", "Inte tilldelad"),
+    ("Note: Shadows are only cast from layers with Cast Shadows enabled.", "Obs! Skuggor kastas bara från lager där Kasta skuggor är aktiverat."),
+    ("Notify", "Meddela"),
+    ("OK", "OK"),
+    ("Offset:", "Förskjutning:"),
+    ("On ({}) stop:", "Vid stopp ({}):"),
+    ("One-Node Camera", "Kamera med en nod"),
+    ("Opacity:", "Opacitet:"),
+    ("Open Composition", "Öppna komposition"),
+    ("used once", "används en gång"),
+    ("used {} times", "används {} gånger"),
+    ("Compositions that use this item", "Kompositioner som använder det här objektet"),
+    ("Open Last Saved Project", "Öppna senast sparade projekt"),
+    ("Open New Composition", "Öppna ny komposition"),
+    ("Open Output", "Öppna utdata"),
+    ("Open a composition to build Essential Graphics", "Öppna en komposition för att bygga grundläggande grafik"),
+    ("Open a composition to see its scopes", "Öppna en komposition för att se dess mätinstrument"),
+    ("Open a composition to track motion.", "Öppna en komposition för att spåra rörelse."),
+    ("Opus Tuning: {}", "Opus-optimering: {}"),
+    ("Original Duration:", "Ursprunglig längd:"),
+    ("Output Cycle: {}", "Utdatacykel: {}"),
+    ("Output To:", "Utdata till:"),
+    ("Overlay", "Överlägg"),
+    ("Parameter Name:", "Parameternamn:"),
+    ("Parent pick whip: drag onto a layer", "Överordnad väljare: dra till ett lager"),
+    ("Pixel Aspect Ratio:", "Pixelproportioner:"),
+    ("Playing on Video Preview", "Spelas upp i videoförhandsgranskningen"),
+    ("Post-Render Action: {}", "Åtgärd efter rendering: {}"),
+    ("Preserve frame rate when nested or in render queue", "Bevara bildfrekvensen när den är kapslad eller i renderingskön"),
+    ("Preserve resolution when nested", "Bevara upplösningen när den är kapslad"),
+    ("Preset", "Förinställning"),
+    ("Preset:", "Förinställning:"),
+    ("Presets", "Förinställningar"),
+    ("Previous", "Föregående"),
+    ("Primary:", "Primär:"),
+    ("Process Before Match", "Bearbeta före matchning"),
+    ("Profile: {}", "Profil: {}"),
+    (
+        "Project color depth: click to cycle 8/16/32 bpc, Alt-click for Project Settings",
+        "Projektets färgdjup: klicka för att växla mellan 8/16/32 bpc, Alt-klicka för projektinställningar",
+    ),
+    ("Project: {}", "Projekt: {}"),
+    ("Projects", "Projekt"),
+    ("Property pick whip: drag onto a property", "Egenskapsväljare: dra till en egenskap"),
+    ("Protected Region", "Skyddad region"),
+    ("Proxy Use: {}", "Proxyanvändning: {}"),
+    ("Push All to Comp", "Skjut alla till kompositionen"),
+    ("RGB", "RGB"),
+    ("Radius", "Radie"),
+    ("Rate Control: {}", "Bithastighetsstyrning: {}"),
+    ("Recent", "Senaste"),
+    ("Recording", "Spelar in"),
+    ("Remove", "Ta bort"),
+    ("Rename", "Byt namn"),
+    ("Render: {} ms  •  UI {} fps{}", "Rendering: {} ms  •  UI {} bild/s{}"),
+    ("Renderer:", "Renderare:"),
+    ("Request Persistent Storage", "Begär beständig lagring"),
+    ("Reset", "Återställ"),
+    ("Reset Labels", "Återställ etiketter"),
+    ("Reset Preset", "Återställ förinställning"),
+    ("Reset to Default", "Återställ till standard"),
+    ("Reset to Saved Layout", "Återställ till sparad layout"),
+    ("Resolution/Down Sample Factor Popup", "Meny för upplösning/nedsamplingsfaktor"),
+    ("Restore Panel Size", "Återställ panelstorlek"),
+    ("Reverse the order", "Vänd på ordningen"),
+    ("Revert All", "Återgå för alla"),
+    ("Roman Hanging Punctuation", "Hängande interpunktion (roman)"),
+    ("Roving:", "Rörlig:"),
+    ("Ruler zero point (drag to move, double-click to reset)", "Linjalens nollpunkt (dra för att flytta, dubbelklicka för att återställa)"),
+    ("Rulers", "Linjaler"),
+    ("Run", "Kör"),
+    ("Sample Format: {}", "Samplingsformat: {}"),
+    ("Samples Per Frame:", "Samplingar per bildruta:"),
+    ("Save from #{}", "Spara från #{}"),
+    ("Saved {}", "Sparat {}"),
+    ("Script… (⌘/Ctrl+Enter runs)", "Skript… (⌘/Ctrl+Enter kör)"),
+    ("Search commands or shortcuts", "Sök kommandon eller kortkommandon"),
+    ("Select", "Markera"),
+    ("Select a command to change its shortcut.", "Markera ett kommando för att ändra dess kortkommando."),
+    ("Select a layer to see its effects", "Markera ett lager för att se dess effekter"),
+    ("Select a layer to see its properties", "Markera ett lager för att se dess egenskaper"),
+    ("({}) Selected Objects", "({}) markerade objekt"),
+    (
+        "Select a layer with a mask or shape path (or the path property), or Puppet pins.",
+        "Markera ett lager med en mask- eller formbana (eller banegenskapen) eller marionettnålar.",
+    ),
+    ("Select a text layer", "Markera ett textlager"),
+    ("Select an item in the Project panel", "Markera ett objekt i panelen Projekt"),
+    ("Select animated properties to show them in the Graph Editor", "Markera animerade egenskaper för att visa dem i grafredigeraren"),
+    (
+        "Select the leader pin, then Shift-click the pins that should trail it (hair, cloth, tails)",
+        "Markera ledarnålen och Shift-klicka sedan på nålarna som ska följa efter den (hår, tyg, svansar)",
+    ),
+    ("Set Ground Plane and Origin", "Ange markplan och origo"),
+    ("Set Paint Colors to Black and White (D)", "Ställ in målarfärger på svart och vitt (D)"),
+    ("Settings", "Inställningar"),
+    ("Settings Name:", "Inställningsnamn:"),
+    ("Shadow Darkness", "Skuggmörkhet"),
+    ("Shadow Diffusion", "Skuggdiffusion"),
+    ("Shadows", "Skuggor"),
+    ("Shape…", "Form…"),
+    ("Show", "Visa"),
+    ("Show Layer Name", "Visa lagernamn"),
+    ("Show Source Name", "Visa källnamn"),
+    ("Show me", "Visa mig"),
+    ("Show:", "Visa:"),
+    ("Shutter Angle:", "Slutarvinkel:"),
+    ("Shutter Phase:", "Slutarfas:"),
+    ("Size", "Storlek"),
+    ("Skip", "Hoppa över"),
+    ("Snapping", "Fäst"),
+    ("Snapping options", "Fästalternativ"),
+    ("Snapshot", "Ögonblicksbild"),
+    ("Solo Supported Properties", "Solo för egenskaper som stöds"),
+    ("Solo Switches: {}", "Soloväxlar: {}"),
+    ("Sort", "Sortera"),
+    ("Spacing:", "Avstånd:"),
+    ("Spatial Interpolation:", "Rumslig interpolering:"),
+    ("Speed:", "Hastighet:"),
+    ("Start Timecode:", "Starttidskod:"),
+    ("Start: {}   Duration: {}", "Start: {}   Längd: {}"),
+    ("Step {} of {}: {}", "Steg {} av {}: {}"),
+    ("Stop", "Stoppa"),
+    ("Stop {} at {}°", "Stopp {} vid {}°"),
+    ("Stored in: {}", "Lagras i: {}"),
+    ("Stretch", "Sträck"),
+    ("Stretch Factor:", "Sträckfaktor:"),
+    ("Stylistic Sets", "Stilistiska uppsättningar"),
+    ("Subpixel Positioning", "Subpixelpositionering"),
+    ("Swap Colors", "Byt plats på färger"),
+    ("Swap Paint Colors (X)", "Byt plats på målarfärger (X)"),
+    ("Sync with System", "Synka med systemet"),
+    ("System Default", "Systemstandard"),
+    ("Table", "Tabell"),
+    ("Template name", "Mallnamn"),
+    ("Template: {}\n{}", "Mall: {}\n{}"),
+    ("Temporal Interpolation:", "Tidsinterpolering:"),
+    ("The Media Browser is not available here (use File ▸ Import)", "Mediebläddraren är inte tillgänglig här (använd Arkiv ▸ Importera)"),
+    ("The OpenEXR layer shown in red, green, blue and alpha", "OpenEXR-lagret visas i rött, grönt, blått och alfa"),
+    ("The render queue is empty.", "Renderingskön är tom."),
+    (
+        "These adjacent keyframes cannot interpolate because their stop counts differ.",
+        "De här intilliggande nyckelbildrutorna kan inte interpoleras eftersom de har olika antal stopp.",
+    ),
+    ("This ScriptUI panel has closed", "Den här ScriptUI-panelen har stängts"),
+    ("This change will create a new solid for this layer.", "Den här ändringen skapar ett nytt enfärgat lager för det här lagret."),
+    ("Time", "Tid"),
+    ("Time Stretch…", "Tidssträckning…"),
+    ("Time:", "Tid:"),
+    ("Time: {}", "Tid: {}"),
+    ("Title/Action Safe", "Text-/bildsäkert område"),
+    ("Title/action safe", "Textsäkert/bildsäkert område"),
+    ("Toggle Switches / Modes", "Växla reglage/lägen"),
+    ("Track Name:", "Spårnamn:"),
+    (
+        "Trained models are available in the desktop app; the browser uses the classic engine.",
+        "Tränade modeller finns i skrivbordsappen; webbläsaren använder den klassiska motorn.",
+    ),
+    ("Transform", "Transformera"),
+    ("Transparency grid", "Transparensrutnät"),
+    ("Tutorial complete", "Självstudien är klar"),
+    ("Two-Node Camera", "Kamera med två noder"),
+    ("Type", "Typ"),
+    ("Type a command or effect…", "Skriv ett kommando eller en effekt…"),
+    ("URL:", "URL:"),
+    ("Undock Panel", "Lossa panel"),
+    ("Move Panel to New Window", "Flytta panelen till ett nytt fönster"),
+    ("Move Panel to Main Window", "Flytta panelen till huvudfönstret"),
+    ("Unfreeze", "Tina upp"),
+    ("Unlink {}", "Ta bort länk till {}"),
+    (
+        "Use this option to place the currently selected layers together into a new intermediate composition.",
+        "Använd det här alternativet för att placera de markerade lagren tillsammans i en ny mellanliggande komposition.",
+    ),
+    ("VR Environments", "VR-miljöer"),
+    ("Value:", "Värde:"),
+    ("Variable Font Axes", "Axlar för variabla typsnitt"),
+    ("Video Codec: {}", "Videokodek: {}"),
+    ("View:", "Vy:"),
+    ("Welcome to EffectCraft", "Välkommen till EffectCraft"),
+    ("Width:", "Bredd:"),
+    ("You can undo this.", "Du kan ångra detta."),
+    ("You can't undo this.", "Du kan inte ångra detta."),
+    ("Your changes will be lost if you don't save them.", "Dina ändringar går förlorade om du inte sparar dem."),
+    ("Zoom", "Zoom"),
+    ("built-in", "inbyggd"),
+    ("frames per second", "bilder per sekund"),
+    ("template name", "mallnamn"),
+    ("{} contributors · {} commits", "{} bidragsgivare · {} commits"),
+    ("{} x {}, {}MB per 8bpc frame", "{} x {}, {} MB per bildruta i 8 bpc"),
+    ("{} — coming soon", "{} – kommer snart"),
+    ("{} — double-click to open, {}-click to reveal", "{} – dubbelklicka för att öppna, {}-klicka för att visa i mappen"),
+    ("⌘/Ctrl-drag a pin to record its motion", "⌘/Ctrl-dra en nål för att spela in dess rörelse"),
+    ("▣ {}", "▣ {}"),
+    ("⚠ {} is used by:", "⚠ {} används av:"),
+    ("3D Reference Axes", "3D-referensaxlar"),
+    ("Affect all layers that use this solid", "Påverka alla lager som använder den här enfärgade ytan"),
+    ("Choose grid and guide options", "Välj alternativ för rutnät och stödlinjer"),
+    ("Colorize", "Färglägg"),
+    ("Custom", "Anpassad"),
+    ("Custom...", "Anpassad..."),
+    ("Fit", "Anpassa"),
+    ("Fit up to 100%", "Anpassa upp till 100 %"),
+    ("Full", "Full"),
+    ("Half", "Halv"),
+    ("Only this layer uses this solid.", "Bara det här lagret använder den här enfärgade ytan."),
+    ("Proportional Grid", "Proportionellt rutnät"),
+    ("Quarter", "Fjärdedel"),
+    ("Region of Interest", "Intresseområde"),
+    ("Reset Exposure", "Återställ exponering"),
+    ("Show Channel and Color Management Settings", "Visa inställningar för kanal och färghantering"),
+    ("Show Snapshot (hold)", "Visa ögonblicksbild (håll ned)"),
+    ("Take Snapshot", "Ta ögonblicksbild"),
+    ("Third", "En tredjedel"),
+    ("Toggle Mask and Shape Path Visibility", "Växla synlighet för mask- och formbanor"),
+    ("Toggle Transparency Grid", "Växla transparensrutnät"),
+    ("16 bits per channel", "16 bitar per kanal"),
+    ("32 bits per channel (float)", "32 bitar per kanal (flyttal)"),
+    ("8 bits per channel", "8 bitar per kanal"),
+    ("Adaptive Resolution", "Adaptiv upplösning"),
+    ("Adobe-style built-in", "Inbyggd i Adobe-stil"),
+    ("Blue", "Blå"),
+    ("Current Settings", "Aktuella inställningar"),
+    ("Disable Per-character 3D", "Inaktivera 3D per tecken"),
+    ("Draft", "Utkast"),
+    ("Enable Per-character 3D", "Aktivera 3D per tecken"),
+    ("Fast Draft", "Snabbt utkast"),
+    ("Fast Previews (Draft 3D, Faster Effects)", "Snabba förhandsgranskningar (3D-utkast, snabbare effekter)"),
+    ("Green", "Grön"),
+    ("Import Image Sequence", "Importera bildsekvens"),
+    ("Import PDF / Illustrator File", "Importera PDF-/Illustrator-fil"),
+    ("Import Photoshop File", "Importera Photoshop-fil"),
+    ("Interpret Unlabeled Alpha As", "Tolka omärkt alfa som"),
+    ("Join the ArtCraft Discord", "Gå med i ArtCraft på Discord"),
+    ("GPU Acceleration ({})", "GPU-acceleration ({})"),
+    ("Software Rendering", "Programvarurendering"),
+    ("OCIO (built-in ACES config)", "OCIO (inbyggd ACES-konfiguration)"),
+    ("Off (Final Quality)", "Av (slutlig kvalitet)"),
+    ("OpenGL (compatibility)", "OpenGL (kompatibilitet)"),
+    ("Opus Bitrate: {} kbps", "Opus-bithastighet: {} kbit/s"),
+    ("RGB Straight", "RGB (rak)"),
+    ("Red", "Röd"),
+    ("Tone map", "Tonmappning"),
+    ("Use In-Window Menu Bar on macOS", "Använd menyrad i fönstret på macOS"),
+    ("Wireframe", "Trådram"),
+    ("sRGB IEC61966-2.1 (default)", "sRGB IEC61966-2.1 (standard)"),
+    ("New Project", "Nytt projekt"),
+    ("Open Project…", "Öppna projekt…"),
+    ("Templates", "Mallar"),
+    ("EffectCraft home page", "EffectCrafts webbplats"),
+    ("EffectCraft on GitHub", "EffectCraft på GitHub"),
+    ("Motion graphics and visual effects · version {}", "Rörlig grafik och visuella effekter · version {}"),
+    ("New Composition", "Ny komposition"),
+    ("Open Demo Project", "Öppna demoprojekt"),
+    ("Import Footage…", "Importera material…"),
+    ("Filter recent files", "Filtrera senaste filer"),
+    ("NAME", "NAMN"),
+    ("OPENED", "ÖPPNAD"),
+    ("SIZE", "STORLEK"),
+    ("KIND", "TYP"),
+    ("Your recent files will show here", "Dina senaste filer visas här"),
+    ("Create a new project, or open the demo project to look around.", "Skapa ett nytt projekt, eller öppna demoprojektet för att titta runt."),
+    ("No recent files match the filter", "Inga senaste filer matchar filtret"),
+    ("Try another name or folder.", "Prova ett annat namn eller en annan mapp."),
+    ("Just now", "Nyss"),
+    ("Yesterday", "I går"),
+    ("{} minute ago", "för {} minut sedan"),
+    ("{} minutes ago", "för {} minuter sedan"),
+    ("{} hour ago", "för {} timme sedan"),
+    ("{} hours ago", "för {} timmar sedan"),
+    ("{} day ago", "för {} dag sedan"),
+    ("{} days ago", "för {} dagar sedan"),
+    ("EffectCraft project", "EffectCraft-projekt"),
+    ("After Effects project", "After Effects-projekt"),
+    ("Lottie animation", "Lottie-animering"),
+    ("Project", "Projekt"),
+    ("General", "Allmänt"),
+    ("Language", "Språk"),
+    ("Levels of Undo", "Antal ångranivåer"),
+    ("Path Point and Handle Size", "Storlek på banpunkter och handtag"),
+    ("Recent Projects Shown", "Antal senaste projekt som visas"),
+    ("Options", "Alternativ"),
+    ("Show Tool Tips", "Visa verktygstips"),
+    ("Create Layers at Composition Start Time", "Skapa lager vid kompositionens starttid"),
+    ("Switches Affect Nested Comps", "Växlar påverkar kapslade kompositioner"),
+    ("Default Spatial Interpolation to Linear", "Linjär spatial interpolering som standard"),
+    ("Preserve Constant Vertex and Feather Point Count when Editing Masks", "Bevara konstant antal hörn och fjäderpunkter vid redigering av masker"),
+    ("Synchronize Time of All Related Items", "Synkronisera tid för alla relaterade objekt"),
+    ("Expression Pick Whip Writes Compact English", "Uttryckets plockpiska skriver kompakt engelska"),
+    ("Create Split Layers Above Original Layer", "Skapa delade lager ovanför originallagret"),
+    ("Use System Color Picker", "Använd systemets färgväljare"),
+    (
+        "EffectCraft always uses its own colour picker (the same on every platform and the web).",
+        "EffectCraft använder alltid sin egen färgväljare (densamma på alla plattformar och på webben).",
+    ),
+    ("Startup & Repair", "Start och reparation"),
+    ("Show Home Screen When Launching", "Visa startskärmen vid start"),
+    ("Show Home Screen When Opening a Project", "Visa startskärmen när ett projekt öppnas"),
+    ("Offer to Open the Latest Auto-Save After a Crash", "Erbjud att öppna den senaste autosparningen efter en krasch"),
+    ("Window Graphics", "Fönstergrafik"),
+    ("Automatic", "Automatisk"),
+    (
+        "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
+        "Fönstergrafik tillämpas från nästa start. Om grafikdrivrutinen stoppar EffectCraft när fönstret öppnas byter nästa start till OpenGL.",
+    ),
+    ("Repair", "Reparera"),
+    ("Reset Settings", "Återställ inställningar"),
+    ("Reset Keyboard Shortcuts", "Återställ kortkommandon"),
+    ("Empty Disk Cache", "Töm diskcache"),
+    ("New Project Loads Template", "Nytt projekt läser in mall"),
+    ("Template Project", "Mallprojekt"),
+    ("Auto-Save", "Spara automatiskt"),
+    ("Automatically Save Projects", "Spara projekt automatiskt"),
+    ("Save Every", "Spara var"),
+    ("Minutes", "Minuter"),
+    ("Maximum Project Versions", "Maximalt antal projektversioner"),
+    ("Auto-Save Location", "Plats för automatisk sparning"),
+    ("Next to Project", "Bredvid projektet"),
+    ("Custom Location", "Anpassad plats"),
+    ("Save When Starting Render Queue", "Spara när renderingskön startas"),
+    ("Save Now", "Spara nu"),
+    ("Motion Path", "Rörelsebana"),
+    ("All Keyframes", "Alla nyckelbildrutor"),
+    ("No Motion Path", "Ingen rörelsebana"),
+    ("No More Than (Seconds)", "Högst (sekunder)"),
+    ("No More Than (Keyframes)", "Högst (nyckelbildrutor)"),
+    ("Seconds", "Sekunder"),
+    ("Keyframes", "Nyckelbildrutor"),
+    ("Display", "Visning"),
+    ("Show Rendering Progress in Info Panel and Flowchart", "Visa renderingsförlopp i panelen Info och flödesschemat"),
+    ("Hardware Accelerate Composition, Layer and Footage Panels", "Maskinvaruaccelerera panelerna Komposition, Lager och Material"),
+    ("Panels are always drawn by the GPU (wgpu).", "Paneler ritas alltid av GPU:n (wgpu)."),
+    ("Previews", "Förhandsgranskningar"),
+    ("Adaptive Resolution Limit", "Gräns för adaptiv upplösning"),
+    ("Show Internal Wireframes", "Visa interna trådmodeller"),
+    ("Cache Frames When Idle", "Cachelagra bildrutor vid inaktivitet"),
+    ("Viewer Zoom Quality", "Zoomkvalitet i visningsfönstret"),
+    ("Faster", "Snabbare"),
+    ("More Accurate", "Mer exakt"),
+    ("Display Color Space", "Visningsfärgrymd"),
+    ("GPU Information...", "GPU-information..."),
+    ("Appearance", "Utseende"),
+    ("Brightness", "Ljusstyrka"),
+    ("UI Scale", "Gränssnittsskala"),
+    ("Labels and Colors", "Etiketter och färger"),
+    ("Use Label Color for Layer Handles and Paths", "Använd etikettfärg för lagerhandtag och banor"),
+    ("Use Label Color for Related Tabs", "Använd etikettfärg för relaterade flikar"),
+    ("Cycle Mask Colors", "Växla maskfärger"),
+    ("Use Gradients", "Använd gradienter"),
+    ("Menu Bar", "Menyrad"),
+    ("Grids & Guides", "Rutnät och stödlinjer"),
+    ("Gridline Every", "Stödlinje var"),
+    ("Subdivisions", "Underindelningar"),
+    ("Style", "Stil"),
+    ("Lines", "Rader"),
+    ("Dashed Lines", "Streckade linjer"),
+    ("Dots", "Punkter"),
+    ("Horizontal", "Horisontell"),
+    ("Vertical", "Vertikal"),
+    ("Safe Margins", "Säkra marginaler"),
+    ("Action-safe", "Bildsäkert område"),
+    ("Title-safe", "Titelsäker"),
+    ("Labels", "Etiketter"),
+    ("Text Engine", "Textmotor"),
+    ("Latin", "Latin"),
+    ("South Asian and Middle Eastern", "Sydasiatiska och mellanösterländska"),
+    ("Show Font Preview", "Visa förhandsgranskning av typsnitt"),
+    ("Number of Recent Fonts to Display", "Antal senaste typsnitt som visas"),
+    ("Show Font Names in English", "Visa typsnittsnamn på engelska"),
+    ("Still Footage", "Stillbildsmaterial"),
+    ("Length of Composition", "Kompositionens längd"),
+    ("Duration (Seconds)", "Längd (sekunder)"),
+    ("Still Duration", "Stillbildslängd"),
+    ("Sequence Footage", "Sekvensmaterial"),
+    ("Report Missing Frames", "Rapportera saknade bildrutor"),
+    ("Automatically Reload Footage", "Läs in material igen automatiskt"),
+    ("Off", "Av"),
+    ("Non-Sequence Footage", "Material som inte är sekvenser"),
+    ("All Footage", "Allt material"),
+    ("Ask User", "Fråga användaren"),
+    ("Guess", "Gissa"),
+    ("Ignore", "Ignorera"),
+    ("Straight", "Rak"),
+    ("Premultiplied", "Förmultiplicerad"),
+    ("Default Drag Import As", "Standardimport vid dragning"),
+    ("Footage", "Material"),
+    ("Composition - Retain Layer Sizes", "Komposition – behåll lagerstorlekar"),
+    ("Export", "Exportera"),
+    ("Default Output Folder", "Standardmapp för utgång"),
+    ("Segment Sequences", "Segmentera sekvenser"),
+    ("Files per Segment", "Filer per segment"),
+    ("files", "filer"),
+    ("Segment Movie Files", "Segmentera filmfiler"),
+    ("Segment Size", "Segmentstorlek"),
+    ("Append Bit Depth to File Name", "Lägg till bitdjup i filnamnet"),
+    ("Audio", "Ljud"),
+    ("Audio Hardware", "Ljudhårdvara"),
+    ("Preview Sample Rate", "Samplingsfrekvens för förhandsgranskning"),
+    ("Audio Output Mapping", "Mappning av ljudutgång"),
+    ("Left", "Vänster"),
+    ("Right", "Höger"),
+    ("channel", "kanal"),
+    ("Disk", "Disk"),
+    ("Disk Cache", "Diskcache"),
+    ("Enable Disk Cache", "Aktivera diskcache"),
+    ("Maximum Disk Cache Size", "Maximal storlek på diskcache"),
+    ("Disk Cache Folder", "Mapp för diskcache"),
+    ("Media Cache", "Mediecache"),
+    ("Database and Cache Folder", "Databas- och cachemapp"),
+    ("Conformed Audio Folder", "Mapp för konformerat ljud"),
+    ("Memory & CPU", "Minne och processor"),
+    ("RAM Reserved for Other Applications", "RAM reserverat för andra program"),
+    ("Cache Budgets", "Cachebudgetar"),
+    ("Layer Cache", "Lagercache"),
+    ("Footage Frame Cache", "Bildrutecache för material"),
+    ("Preview (RAM) Cache", "Förhandsgranskningscache (RAM)"),
+    ("Reduce Cache Size When System Is Low on Memory", "Minska cachestorleken när systemet har ont om minne"),
+    ("Video", "Video"),
+    ("Enable Video Preview Output", "Aktivera videoutgång för förhandsgranskning"),
+    ("Video Device", "Videoenhet"),
+    ("Floating Window", "Flytande fönster"),
+    ("Full Screen", "Helskärm"),
+    ("Video Output During Playback", "Videoutgång under uppspelning"),
+    ("Mirror on Computer Monitor", "Spegla på datorskärmen"),
+    ("Disable Video Output When in Background", "Inaktivera videoutgång i bakgrunden"),
+    ("Default 3D Renderer", "Standard-3D-renderare"),
+    ("Show 3D Reference Axes", "Visa 3D-referensaxlar"),
+    ("Extended Viewer", "Utökad visare"),
+    ("Realtime Shadows in Draft", "Skuggor i realtid i utkastläge"),
+    ("Scripting & Expressions", "Skript och uttryck"),
+    ("Application Scripting", "Programskriptning"),
+    ("Allow Scripts to Write Files and Access Network", "Tillåt skript att skriva filer och komma åt nätverket"),
+    ("Warn User When Executing Files", "Varna användaren när filer körs"),
+    ("Enable JavaScript Debugger", "Aktivera JavaScript-felsökare"),
+    ("Expressions Editor", "Uttrycksredigerare"),
+    ("Font Size", "Teckenstorlek"),
+    ("Syntax Highlighting", "Syntaxmarkering"),
+    ("Line Numbers", "Radnummer"),
+    ("Auto-complete", "Autokomplettering"),
+    ("Bracket Matching", "Parentesmatchning"),
+    ("Word Wrap", "Radbrytning"),
+    ("Show Expression Error Banner", "Visa fältet för uttrycksfel"),
+    (
+        "Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger.",
+        "Uttryck använder JavaScript-motorn. Skriptfel rapporterar fil och rad i skriptkonsolen; det finns ingen stegvis felsökare.",
+    ),
+    ("Roto Brush", "Rotopensel"),
+    ("Segmentation Model", "Segmenteringsmodell"),
+    (
+        "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Rotopensel 2.0 och 3.0 använder modellen som väljs här (version 1.0 använder alltid den klassiska motorn). Modellerna är öppen källkod, laddas bara ned när du ber om det och kontrolleras mot sin publicerade SHA-256.",
+    ),
+    ("Face Tracking", "Ansiktsspårning"),
+    ("Face Model", "Ansiktsmodell"),
+    (
+        "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Ansiktsspårning i panelen Spårning (Endast kontur och Detaljerade drag) använder modellen som väljs här. Modellerna är öppen källkod, hämtas bara när du ber om det och kontrolleras mot sin publicerade SHA-256.",
+    ),
+    ("Match System", "Enligt systemet"),
+    ("Default", "Standard"),
+    ("Stored, but not used by EffectCraft yet", "Lagras, men används inte av EffectCraft än"),
+    ("Total Offset", "Total förskjutning"),
+    ("Per Layer", "Per lager"),
+    ("Track", "Spåra"),
+    ("A built-in preset has this name", "En inbyggd förinställning har det här namnet"),
+    ("Cannot import dropped files: {}", "Kan inte importera släppta filer: {}"),
+    ("Cannot open dropped project {}: {}", "Kan inte öppna det släppta projektet {}: {}"),
+    ("Click in the Composition panel to sample text {}", "Klicka i panelen Komposition för att hämta text {}"),
+    ("Click to sample text {}", "Klicka för att hämta text {}"),
+    ("Comment of {}: {}", "Kommentar till {}: {}"),
+    ("Delete Preset", "Radera förinställning"),
+    ("Drop file to import", "Släpp filen för att importera"),
+    ("Drop {} files to import", "Släpp {} filer för att importera"),
+    ("Effects", "Effekter"),
+    ("Label of {}: {}", "Etikett för {}: {}"),
+    ("GPU Acceleration (no GPU: software)", "GPU-acceleration (ingen GPU: programvara)"),
+    ("Only one project can be opened per drop; skipped {} more", "Bara ett projekt kan öppnas per släpp; hoppade över {} till"),
+    ("Open in Essential Graphics", "Öppna i Grundläggande grafik"),
+    ("Original color: click to go back to it", "Originalfärg: klicka för att återgå till den"),
+    ("Project color depth: {}", "Projektets färgdjup: {}"),
+    ("Replaces your preset with this name", "Ersätter din förinställning med det här namnet"),
+    ("Resize floating panel", "Ändra storlek på flytande panel"),
+    ("Save Preset…", "Spara förinställning…"),
+    (
+        "Skipped {} dropped file(s) without a local path. Use File ▸ Import ▸ File…",
+        "Hoppade över {} släppta fil(er) utan lokal sökväg. Använd Arkiv ▸ Importera ▸ Fil…",
+    ),
+    ("Sort by {}", "Sortera efter {}"),
+    ("Sort by {}, {}", "Sortera efter {}, {}"),
+    ("Video preview is off (Preview panel): audio only", "Videoförhandsgranskningen är av (panelen Förhandsgranskning): endast ljud"),
+    ("Video preview off: audio only", "Videoförhandsgranskning av: endast ljud"),
+    ("Copy", "Kopiera"),
+    ("Paste", "Klistra in"),
+    ("Edit Value…", "Redigera värde…"),
+    ("Remove Expression", "Ta bort uttryck"),
+    ("Copy Source Path", "Kopiera källsökväg"),
+    ("Resolution:", "Upplösning:"),
+    ("Guide Layer", "Hjälplager"),
+    ("Layer Styles", "Lagerstilar"),
+    ("Check for Updates", "Sök efter uppdateringar"),
+    ("Close font search", "Stäng typsnittssökningen"),
+    ("Search project", "Sök i projektet"),
+    ("Update check is not supported in the web browser.", "Sökning efter uppdateringar stöds inte i webbläsaren."),
+    ("Click to sample color", "Klicka för att ta färgprov"),
+    ("Advanced", "Avancerat"),
+    ("Rescan Fonts", "Skanna om typsnitt"),
+    ("Track Matte pick whip: drag onto a layer", "Track matte-väljare: dra till ett lager"),
+    ("Play/Stop", "Spela/stoppa"),
+    ("Selection Tool", "Markeringsverktyg"),
+    ("Hand Tool", "Handverktyg"),
+    ("Zoom Tool", "Zoomverktyg"),
+    ("Orbit Around Cursor Tool", "Verktyg för att kretsa kring pekaren"),
+    ("Pan Under Cursor Tool", "Verktyg för att panorera under pekaren"),
+    ("Dolly Towards Cursor Tool", "Verktyget Dolly mot pekaren"),
+    ("Rotation Tool", "Rotationsverktyg"),
+    ("Pan Behind (Anchor Point) Tool", "Verktyg för att panorera bakom (ankarpunkt)"),
+    ("Rectangle Tool", "Rektangelverktyg"),
+    ("Rounded Rectangle Tool", "Verktyg för rundad rektangel"),
+    ("Ellipse Tool", "Ellipsverktyg"),
+    ("Polygon Tool", "Polygonverktyg"),
+    ("Star Tool", "Stjärnverktyg"),
+    ("Pen Tool", "Pennverktyg"),
+    ("Add Vertex Tool", "Verktyget Lägg till hörnpunkt"),
+    ("Delete Vertex Tool", "Verktyget Radera hörnpunkt"),
+    ("Convert Vertex Tool", "Verktyget Konvertera hörnpunkt"),
+    ("Mask Feather Tool", "Maskfjädringsverktyg"),
+    ("Horizontal Type Tool", "Horisontellt textverktyg"),
+    ("Vertical Type Tool", "Vertikalt textverktyg"),
+    ("Brush Tool", "Penselverktyg"),
+    ("Clone Stamp Tool", "Klonstämpelverktyg"),
+    ("Eraser Tool", "Suddgummiverktyg"),
+    ("Roto Brush Tool", "Rotopenselverktyg"),
+    ("Refine Edge Tool", "Verktyg för kantförfining"),
+    ("Object Matte Tool", "Objektmatteverktyg"),
+    ("Puppet Position Pin Tool", "Verktyg för positionsnål (docka)"),
+    ("Puppet Starch Pin Tool", "Verktyg för styvhetsnål (docka)"),
+    ("Puppet Bend Pin Tool", "Docknålsverktyg för böjning"),
+    ("Puppet Advanced Pin Tool", "Avancerat docknålsverktyg"),
+    ("Puppet Overlap Pin Tool", "Docknålsverktyg för överlappning"),
+    ("Shortcut", "Kortkommando"),
+    ("Range", "Omfång"),
+    ("Play From", "Spela upp från"),
+    ("Frame Rate", "Bildfrekvens"),
+    ("Resolution", "Upplösning"),
+    ("Overlays", "Överlägg"),
+    ("Layer Controls", "Lagerkontroller"),
+    ("Loop", "Loopa"),
+    ("Cache Before Playback", "Cachelagra före uppspelning"),
+    ("Pre-roll", "Förrullning"),
+    ("Post-roll", "Efterrullning"),
+    ("If caching, play cached frames", "Spela upp cachade bildrutor vid cachning"),
+    ("Apply", "Använd"),
+    ("Analyze", "Analysera"),
+    ("Create Camera", "Skapa kamera"),
+    ("Add Point", "Lägg till punkt"),
+    ("Remove Point", "Ta bort punkt"),
+    ("Render", "Rendera"),
+    ("Save Current as Template…", "Spara aktuellt som mall…"),
+    ("New Composition From Footage", "Ny komposition från material"),
+    ("Search effects and presets", "Sök effekter och förinställningar"),
+    ("Search", "Sök"),
+    ("(no composition)", "(ingen komposition)"),
+    ("per second", "per sekund"),
+    ("Waveform", "Vågform"),
+    ("steps", "steg"),
+    ("Building waveform…", "Skapar vågform…"),
+    ("No effects. Drag one from Effects & Presets.", "Inga effekter. Dra hit en från Effekter och förinställningar."),
+    (
+        "Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it",
+        "Klicka på ringen för att lägga till en färg; Alt-klicka på ett färgstopp (eller dra bort det) för att ta bort det",
+    ),
+    (
+        "Start from a ready-made project. Opening a template makes an untitled copy.",
+        "Börja från ett färdigt projekt. När du öppnar en mall skapas en namnlös kopia.",
+    ),
+    ("Square Pixels", "Kvadratiska pixlar"),
+    ("Basic", "Grundläggande"),
+    ("3D Renderer", "3D-renderare"),
+    ("Black", "Svart"),
+    ("White", "Vit"),
+    ("Composition Settings", "Kompositionsinställningar"),
+    ("Force alphabetical order", "Tvinga bokstavsordning"),
+    ("Frame rate (fps)", "Bildfrekvens (bild/s)"),
+    ("Import Kind", "Importtyp"),
+    ("Delay (s)", "Delay (s)"),
+    ("Amount (%)", "Mängd (%)"),
+    ("Cascade (farther pins trail longer)", "Överlappande (nålar längre bort släpar efter mer)"),
+    ("Speed (%)", "Hastighet (%)"),
+    ("Use Draft Deformation", "Använd utkastdeformation"),
+    ("Show Mesh", "Visa nät"),
+    ("Scale X (%)", "Skala X (%)"),
+    ("Scale Y (%)", "Skala Y (%)"),
+    ("Rotation (degrees)", "Rotation (grader)"),
+    ("Move X", "Flytta X"),
+    ("Move Y", "Flytta Y"),
+    ("Position (pixels)", "Position (pixlar)"),
+    ("Position (percent of the composition)", "Position (procent av kompositionen)"),
+    ("Use Dimensions From", "Använd dimensioner från"),
+    ("Still Duration (seconds)", "Stillbildslängd (sekunder)"),
+    ("Add to Render Queue", "Lägg till i renderingskön"),
+    ("Sequence Layers", "Lägg lager i sekvens"),
+    ("Duration (seconds)", "Längd (sekunder)"),
+    ("Matte color (premultiplied)", "Mattefärg (förmultiplicerad)"),
+    ("Invert Alpha", "Invertera alfa"),
+    ("Assume this frame rate", "Anta denna bildfrekvens"),
+    ("Separate Fields", "Separera fält"),
+    ("Pixel Aspect Ratio", "Pixelbildförhållande"),
+    ("Loop (times)", "Loopa (antal gånger)"),
+    ("Assign Profile", "Tilldela profil"),
+    ("Preserve RGB", "Bevara RGB"),
+    ("Interpret As Linear Light", "Tolka som linjärt ljus"),
+    ("Start Timecode", "Starttidskod"),
+    ("Override Start", "Åsidosätt start"),
+    ("Time display style", "Tidsvisningsformat"),
+    ("Color engine", "Färgmotor"),
+    ("Working space", "Arbetsfärgrymd"),
+    ("Working gamma", "Arbetsgamma"),
+    ("Linearize working space", "Linjärisera arbetsfärgrymden"),
+    ("Blend colors using 1.0 gamma", "Blanda färger med gamma 1,0"),
+    ("Output color space", "Färgrymd för utdata"),
+    ("Video rendering and effects", "Videorendering och effekter"),
+    ("Time Span", "Tidsintervall"),
+    ("Blur (pixels before auto-trace)", "Oskärpa (pixlar före automatisk vektorisering)"),
+    ("Tolerance (pixels)", "Tolerans (pixlar)"),
+    ("Threshold (%)", "Tröskel (%)"),
+    ("Minimum Area (pixels)", "Minsta area (pixlar)"),
+    ("Corner Roundness (%)", "Hörnrundhet (%)"),
+    ("Apply To New Layer", "Använd på nytt lager"),
+    ("Sensitivity threshold (0–1, lower finds more)", "Känslighetströskel (0–1, lägre hittar fler)"),
+    ("Time field (empty: automatic)", "Tidsfält (tomt: automatiskt)"),
+    ("Video start (ISO date-time, hh:mm:ss, timecode; empty: file date)", "Videostart (ISO-datum och tid, hh:mm:ss, tidskod; tom: filens datum)"),
+    ("First sample at (comp seconds)", "Första sampel vid (sekunder i kompositionen)"),
+    ("Frame rate", "Bildfrekvens"),
+    ("Color (#rrggbb)", "Färg (#rrggbb)"),
+    ("Embed footage files", "Bädda in materialfiler"),
+    ("Embed up to (MB)", "Bädda in upp till (MB)"),
+    ("Orient Along Path", "Orientera längs banan"),
+    ("Orient Towards Camera", "Orientera mot kameran"),
+    ("Orient Towards Point of Interest", "Orientera mot intressepunkten"),
+    ("Single Composition", "Enskild komposition"),
+    ("Multiple Compositions", "Flera kompositioner"),
+    ("Dissolve Front Layer", "Övertona främre lager"),
+    ("Cross Dissolve Front and Back Layers", "Korsövertona främre och bakre lager"),
+    ("Interpret Straight - Unmatted", "Tolka som rak – utan matte"),
+    ("Interpret Premultiplied - Matted With Color", "Tolka som förmultiplicerad – mattad med färg"),
+    ("Upper Field First", "Övre fältet först"),
+    ("Lower Field First", "Undre fält först"),
+    ("Rec. 2020", "Rec. 2020"),
+    ("Use Source File Timecode", "Använd källfilens tidskod"),
+    ("Feet + Frames (35mm)", "Fot + bildrutor (35 mm)"),
+    ("Feet + Frames (16mm)", "Fot + bildrutor (16 mm)"),
+    ("Current Frame", "Aktuell bildruta"),
+    ("Work Area", "Arbetsområde"),
+    ("Create Markers", "Skapa markörer"),
+    ("Split Layers", "Dela lager"),
+    ("Split and Precompose", "Dela och förkomponera"),
+    ("All layers", "Alla lager"),
+    ("None (leave them out)", "Ingen (utelämna dem)"),
+    ("Nested sequences", "Kapslade sekvenser"),
+    ("Solid…", "Enfärgat lager…"),
+    ("Light…", "Ljus…"),
+    ("Camera…", "Kamera…"),
+    ("Null Object", "Nullobjekt"),
+    ("Shape Layer", "Formlager"),
+    ("Adjustment Layer", "Justeringslager"),
+    ("Layer Settings…", "Lagerinställningar…"),
+    ("Create Shapes from Vector Layer", "Skapa former från vektorlager"),
+    ("Create Shapes from Text", "Skapa former från text"),
+    ("Create Masks from Text", "Skapa masker från text"),
+    ("New Mask", "Ny mask"),
+    ("Center In View", "Centrera i vyn"),
+    ("Fit to Comp", "Anpassa till kompositionen"),
+    ("Flip Horizontal", "Vänd vågrätt"),
+    ("Flip Vertical", "Vänd lodrätt"),
+    ("Enable Time Remapping", "Aktivera tidsomvandling"),
+    ("Time-Reverse Layer", "Tidsomvänd lager"),
+    ("Freeze Frame", "Frys bildruta"),
+    ("Freeze On Last Frame", "Frys på sista bildrutan"),
+    ("Add Marker", "Lägg till markör"),
+    ("Bring Layer to Front", "Lägg lager överst"),
+    ("Bring Layer Forward", "Flytta fram lager"),
+    ("Send Layer Backward", "Flytta bak lager"),
+    ("Send Layer to Back", "Lägg lager underst"),
+    ("Pre-compose…", "Förkomponera…"),
+    ("Split Layer", "Dela lager"),
+    ("Layer Style Options...", "Lagerstilsalternativ..."),
+    ("Convert to Editable Styles", "Konvertera till redigerbara stilar"),
+    ("Show All", "Visa alla"),
+    ("Remove All", "Ta bort alla"),
+    ("Separate Dimensions", "Separera dimensioner"),
+    ("Add Property to Essential Graphics", "Lägg till egenskap i Grundläggande grafik"),
+    ("Continuous Bezier", "Kontinuerlig bezier"),
+    ("Auto Bezier", "Automatisk bezier"),
+    ("Lock To Time", "Lås till tid"),
+    ("Rove Across Time", "Flytande över tid"),
+    ("Anchor Point", "Ankarpunkt"),
+    ("All Transform Properties", "Alla transformeringsegenskaper"),
+    ("Line Anchor", "Radankare"),
+    ("Line Spacing", "Radavstånd"),
+    ("Character Offset", "Teckenförskjutning"),
+    ("Character Value", "Teckenvärde"),
+    ("Fill Color: RGB", "Fyllningsfärg: RGB"),
+    ("Fill Color: Hue", "Fyllningsfärg: nyans"),
+    ("Fill Color: Saturation", "Fyllningsfärg: mättnad"),
+    ("Fill Color: Brightness", "Fyllningsfärg: ljusstyrka"),
+    ("Fill Color: Opacity", "Fyllningsfärg: opacitet"),
+    ("Stroke Color: RGB", "Konturfärg: RGB"),
+    ("Stroke Color: Hue", "Konturfärg: nyans"),
+    ("Stroke Color: Saturation", "Konturfärg: mättnad"),
+    ("Stroke Color: Brightness", "Konturfärg: ljusstyrka"),
+    ("Stroke Color: Opacity", "Konturfärg: opacitet"),
+    ("Stroke Width", "Konturbredd"),
+    ("Front: Color", "Framsida: färg"),
+    ("Bevel: Color", "Fasning: Färg"),
+    ("Side: Color", "Sida: färg"),
+    ("Back: Color", "Baksida: Färg"),
+    ("Effect Controls", "Effektkontroller"),
+    ("Effects & Presets", "Effekter och förinställningar"),
+    ("Motion Sketch", "Rörelseskiss"),
+    ("Render Queue", "Renderingskö"),
+    ("Mask Interpolation", "Maskinterpolering"),
+    ("Script Console", "Skriptkonsol"),
+    ("Essential Graphics", "Grundläggande grafik"),
+    ("ScriptUI Panel", "ScriptUI-panel"),
+    ("Video Scopes", "Videoskop"),
+    ("Media Browser", "Mediebläddrare"),
+    ("Content-Aware Fill", "Innehållsmedveten fyllning"),
+    ("Create Nulls From Paths", "Skapa nullobjekt från banor"),
+    ("VR Comp Editor", "VR-kompositionsredigerare"),
+    ("Media Duration", "Medielängd"),
+    ("File Path", "Sökväg"),
+    ("Interpret Footage", "Tolka material"),
+    ("Create a new Folder", "Skapa en ny mapp"),
+    ("Create a new Composition", "Skapa en ny komposition"),
+    ("First Frame", "Första bildrutan"),
+    ("Previous Frame", "Föregående bildruta"),
+    ("Next Frame", "Nästa bildruta"),
+    ("Last Frame", "Sista bildrutan"),
+    ("Name (A–Z)", "Namn (A–Ö)"),
+    ("Merged PRs", "Sammanslagna PR:er"),
+    ("Lines added", "Tillagda rader"),
+    ("Lines deleted", "Borttagna rader"),
+    ("Line delta", "Raddifferens"),
+    ("Binary assets added", "Binära resurser tillagda"),
+    ("Binary assets removed", "Binära resurser borttagna"),
+    ("First commit", "Första commit"),
+    ("Last commit", "Senaste commit"),
+    ("Display name", "Visningsnamn"),
+    ("Real name", "Riktigt namn"),
+    ("ArtCraft website", "ArtCrafts webbplats"),
+    ("Source code on GitHub", "Källkod på GitHub"),
+    ("Preset Name", "Namn på förinställning"),
+    ("Lock Aspect Ratio", "Lås proportioner"),
+    ("Frame Rate presets", "Förinställningar för bildfrekvens"),
+    ("Background Color", "Bakgrundsfärg"),
+    ("Shutter Angle", "Slutarvinkel"),
+    ("Shutter Phase", "Slutarfas"),
+    ("Samples Per Frame", "Samplingar per bildruta"),
+    ("Adaptive Sample Limit", "Adaptiv samplingsgräns"),
+    ("X and Y", "X och Y"),
+    ("X only", "Endast X"),
+    ("Y only", "Endast Y"),
+    ("Track Camera", "Spåra kamera"),
+    ("Warp Stabilizer", "Warp Stabilizer"),
+    ("Track Motion", "Spåra rörelse"),
+    ("Stabilize Motion", "Stabilisera rörelse"),
+    ("Motion Source:", "Rörelsekälla:"),
+    ("Current Track:", "Aktuell spårning:"),
+    ("Track Type:", "Spårtyp:"),
+    ("Motion Target:", "Rörelsemål:"),
+    ("Track Mask:", "Spåra mask:"),
+    ("Analyze forward", "Analysera framåt"),
+    ("Analyze backward", "Analysera bakåt"),
+    ("Continue Tracking", "Fortsätt spårning"),
+    ("Stop Tracking", "Stoppa spårning"),
+    ("Adapt Feature", "Anpassa detalj"),
+    ("Extrapolate Motion", "Extrapolera rörelse"),
+    ("Attach Point", "Fästpunkt"),
+    ("Track Name", "Spårnamn"),
+    ("Motion Tracker Options", "Alternativ för rörelsespårare"),
+    ("Motion Tracker Apply Options", "Tillämpningsalternativ för rörelsespårare"),
+    ("Edit Value Graph", "Redigera värdediagram"),
+    ("Edit Speed Graph", "Redigera hastighetsdiagram"),
+    ("Show Reference Graph", "Visa referensdiagram"),
+    (
+        "Auto-Select Graph Type (speed graph for spatial properties, else value graph)",
+        "Välj diagramtyp automatiskt (hastighetsdiagram för rumsliga egenskaper, annars värdediagram)",
+    ),
+    ("Auto-zoom graph height", "Zooma diagramhöjden automatiskt"),
+    ("Fit all graphs to view", "Anpassa alla kurvor till vyn"),
+    ("Fit selection to view", "Anpassa markeringen till vyn"),
+    ("Snap (key drags snap to the current time and other keys)", "Fäst (nyckelbildrutor som dras fästs mot aktuell tid och andra nyckelbildrutor)"),
+    ("Show Transform Box when multiple keys are selected", "Visa transformeringsruta när flera nyckelbildrutor är markerade"),
+    ("Separate Dimensions (Position)", "Separera dimensioner (position)"),
+    ("Convert selected keyframes to Hold", "Konvertera markerade nyckelbildrutor till Håll"),
+    ("Convert selected keyframes to Linear", "Konvertera markerade nyckelbildrutor till Linjär"),
+    ("Convert selected keyframes to Auto Bezier", "Konvertera markerade nyckelbildrutor till Automatisk bezier"),
+    ("Easy Ease (F9)", "Mjukt in och ut (F9)"),
+    ("Easy Ease In (Shift+F9)", "Mjukt in (Shift+F9)"),
+    ("Easy Ease Out (Ctrl+Shift+F9)", "Mjukt ut (Ctrl+Shift+F9)"),
+    ("Spatial Path", "Rumslig bana"),
+    ("Temporal Path", "Temporal bana"),
+    ("All the Same", "Alla likadana"),
+    ("All Independently", "Alla oberoende av varandra"),
+    ("Noise Type:", "Brustyp:"),
+    ("Apply To:", "Använd på:"),
+    ("Temporal Graph", "Temporalt diagram"),
+    ("Keyframe Rate:", "Nyckelbildrutefrekvens:"),
+    ("Capture speed at:", "Spela in hastighet vid:"),
+    ("Start Capture", "Starta inspelning"),
+    ("Cancel Capture", "Avbryt inspelning"),
+    ("Small Caps", "Kapitäler"),
+    ("All Small Caps", "Alla som kapitäler"),
+    ("Superscript / Superior", "Upphöjd / superior"),
+    ("Subscript / Inferior", "Nedsänkt / inferior"),
+    ("Standard Ligatures", "Standardligaturer"),
+    ("Discretionary Ligatures", "Valfria ligaturer"),
+    ("Contextual Alternates", "Kontextuella alternativ"),
+    ("Stylistic Alternates", "Stilistiska alternativ"),
+    ("Titling Alternates", "Rubrikalternativ"),
+    ("Default Figure Style", "Standardfigurstil"),
+    ("Tabular Lining", "Tabellsiffror, versala"),
+    ("Proportional Oldstyle", "Proportionella medievalsiffror"),
+    ("Proportional Lining", "Proportionella versalsiffror"),
+    ("Tabular Oldstyle", "Medievalsiffror i tabellbredd"),
+    ("Fill Over Stroke", "Fyllning över kontur"),
+    ("Stroke Over Fill", "Kontur över fyllning"),
+    ("Stroke order", "Konturordning"),
+    ("Single-line Composer", "Enradssättare"),
+    ("Every-line Composer", "Flerradssättning"),
+    ("Text direction", "Textriktning"),
+    ("Recently Used", "Senast använda"),
+    ("User Presets", "Användarförinställningar"),
+    ("Remove from Favorites", "Ta bort från favoriter"),
+    ("Show Animation Presets", "Visa animeringsförinställningar"),
+    ("    Refresh List", "    Uppdatera listan"),
+    ("    Clear Recently Used", "    Rensa senast använda"),
+    ("Show 32 bpc Effects Only", "Visa endast 32 bpc-effekter"),
+    ("Show GPU Accelerated Effects Only", "Visa endast GPU-accelererade effekter"),
+    ("Show Effects for All Color Depths", "Visa effekter för alla färgdjup"),
+    ("* Animation Presets", "* Animeringsförinställningar"),
+    ("Select a layer to apply to", "Markera ett lager att tillämpa på"),
+    ("Alpha Expansion:", "Alfaexpansion:"),
+    ("Fill Method:", "Fyllningsmetod:"),
+    ("Edge Blend", "Kantblandning"),
+    ("Entire Duration", "Hela längden"),
+    ("Reference Frame:", "Referensbildruta:"),
+    ("Use Current Time", "Använd aktuell tid"),
+    ("Generate Fill Layer", "Generera fyllningslager"),
+    ("Lighting Correction:", "Belysningskorrigering:"),
+    ("Create Text and Camera", "Skapa text och kamera"),
+    ("Create Solid and Camera", "Skapa enfärgat lager och kamera"),
+    ("Create Null and Camera", "Skapa nullobjekt och kamera"),
+    ("Create Shadow Catcher, Camera and Light", "Skapa skuggfångare, kamera och ljus"),
+    ("Unable to solve camera", "Det gick inte att beräkna kameran"),
+    ("Waiting to solve", "Väntar på beräkning"),
+    ("track point", "spårpunkt"),
+    ("Ruler zero point", "Linjalens nollpunkt"),
+    ("Vertical ruler", "Vertikal linjal"),
+    ("Horizontal ruler", "Vågrät linjal"),
+    ("Viewer controls", "Visningskontroller"),
+    ("Resolution/Down Sample Factor", "Upplösning/nedsamplingsfaktor"),
+    ("Adjust Exposure", "Justera exponering"),
+    ("Snapshot taken", "Ögonblicksbild tagen"),
+    ("Fast Previews", "Snabba förhandsgranskningar"),
+    ("3D View", "3D-vy"),
+    ("Current time", "Aktuell tid"),
+    ("Layer Transform", "Lagertransformering"),
+    ("Reset Transform", "Återställ transformering"),
+    ("Text Animation", "Textanimering"),
+    ("Text Animation Presets", "Förinställningar för textanimering"),
+    ("EffectCraft on getartcraft.com", "EffectCraft på getartcraft.com"),
+    ("Small Screen", "Liten skärm"),
+    ("Tool Creates Shape", "Verktyget skapar form"),
+    ("Tool Creates Mask", "Verktyget skapar mask"),
+    ("Blend Mode", "Blandningsläge"),
+    ("Show mesh", "Visa nät"),
+    ("Record Options...", "Inspelningsalternativ..."),
+    ("Export Scene to Blender...", "Exportera scen till Blender..."),
+    (
+        "Hands-on tutorials that run inside EffectCraft. Do each step yourself, or press Show me.",
+        "Praktiska självstudier som körs i EffectCraft. Gör varje steg själv eller tryck på Visa mig.",
+    ),
+    (
+        "JavaScript with the After Effects scripting object model — try app.project.numItems",
+        "JavaScript med objektmodellen för skript i After Effects – prova app.project.numItems",
+    ),
+    ("Label {} color", "Färg för etikett {}"),
+    ("Label {} name", "Namn på etikett {}"),
+    ("Output file name template", "Mall för utdatafilens namn"),
+    ("Output file: {}", "Utdatafil: {}"),
+    ("Preview", "Förhandsgranska"),
+    ("Stroke width presets", "Förinställda konturbredder"),
+    ("Select an item to see its details", "Markera ett objekt för att se dess detaljer"),
+    ("A/V Features", "A/V-funktioner"),
+    ("Keys", "Nycklar"),
+    ("Layer Name", "Lagernamn"),
+    ("Source Name", "Källnamn"),
+    ("Switches", "Växlar"),
+    ("Modes", "Lägen"),
+    ("Track Matte", "Track matte"),
+    ("Parent & Link", "Överordnad och länk"),
+    ("In", "In"),
+    ("Out", "Ut"),
+    ("Render every n-th pixel", "Rendera var n:te pixel"),
+    ("Workspace", "Arbetslayout"),
+    ("Rename to", "Nytt namn"),
+    ("Open", "Öppna"),
+    ("Custom Resolution", "Anpassad upplösning"),
+    ("Panel Background Color", "Panelens bakgrundsfärg"),
+    ("New Workspace", "Ny arbetslayout"),
+    ("Edit Workspaces", "Redigera arbetslayouter"),
+    ("A script wants to open a file", "Ett skript vill öppna en fil"),
+    ("Null Settings", "Null-inställningar"),
+    (
+        "Change the frame rate, alpha and start frame later with File ▸ Interpret Footage.",
+        "Ändra bildfrekvens, alfa och startbildruta senare med Arkiv ▸ Tolka material.",
+    ),
+    ("Page", "Sida"),
+    ("Smoothing", "Utjämning"),
+    ("Top", "Överkant"),
+    ("Mode", "Läge"),
+    ("Frame", "Bildruta"),
+    ("Orientation", "Orientering"),
+    ("Create", "Skapa"),
+    ("Overlap", "Överlappning"),
+    ("Transition", "Övergång"),
+    ("Depth", "Djup"),
+    ("HDR on SDR displays and outputs", "HDR på SDR-skärmar och -utgångar"),
+    ("Invert", "Invertera"),
+    ("Action", "Åtgärd"),
+    ("Data", "Data"),
+    (
+        "Writes Final Cut Pro XML (.xml), which Premiere Pro opens with File ▸ Import. Native .prproj files are not written.",
+        "Skriver Final Cut Pro XML (.xml), som Premiere Pro öppnar med Arkiv ▸ Importera. Ursprungliga .prproj-filer skrivs inte.",
+    ),
+    ("File", "Fil"),
+    ("Format", "Format"),
+    ("Pre-render (ProRes 4444)", "Förrendera (ProRes 4444)"),
+    ("Precomps", "Förkompositioner"),
+    ("Description", "Beskrivning"),
+    ("Category", "Kategori"),
+    ("Use the sRGB curve (ignore Gamma)", "Använd sRGB-kurvan (ignorera gamma)"),
+    ("ICC profile (replaces the numbers)", "ICC-profil (ersätter siffrorna)"),
+    ("Rectangle", "Rektangel"),
+    ("Ellipse", "Ellips"),
+    ("Embedded / sRGB", "Inbäddad / sRGB"),
+    ("Timecode", "Tidskod"),
+    ("Frames", "Bildrutor"),
+    ("Clip", "Klipp"),
+    ("Compand", "Kompander"),
+    ("Luminance", "Luminans"),
+    ("CMX 3600 EDL (.edl, V1 only)", "CMX 3600 EDL (.edl, endast V1)"),
+    ("OMF (.omf, audio)", "OMF (.omf, ljud)"),
+    ("Layers Premiere can't show (text, shapes, effects…)", "Lager som Premiere inte kan visa (text, former, effekter…)"),
+    ("Pre-render", "Förrendera"),
+    ("Puppet Follow-Through", "Dockans eftersläpning"),
+    ("Puppet Record Options", "Inspelningsalternativ för docka"),
+    ("Free Transform Points", "Fri transformering av punkter"),
+    ("Mask Shape", "Maskform"),
+    ("Auto-Orientation", "Automatisk orientering"),
+    ("Go to Time", "Gå till tid"),
+    ("Add Guide", "Lägg till stödlinje"),
+    ("Add Percentage Guide", "Lägg till stödlinje i procent"),
+    ("New Composition from Selection", "Ny komposition från markering"),
+    ("Project Settings", "Projektinställningar"),
+    ("Auto-trace", "Autokonturera"),
+    ("Scene Edit Detection", "Identifiering av scensnitt"),
+    ("Align Video to Data", "Justera video efter data"),
+    ("Export Adobe Premiere Pro Project", "Exportera Adobe Premiere Pro-projekt"),
+    ("New Placeholder", "Ny platshållare"),
+    ("Solid Settings", "Inställningar för enfärgad yta"),
+    ("Save as Template", "Spara som mall"),
+    ("My Custom RGB", "Min anpassade RGB"),
+    ("Start (s)", "Start (s)"),
+    ("Duration (s)", "Längd (s)"),
+    ("Bottom", "Nederkant"),
+    ("Bitrate (kbps)", "Bithastighet (kbit/s)"),
+    ("Frames between key frames (0 = every 2 s)", "Bildrutor mellan nyckelbildrutor (0 = varannan sekund)"),
+    ("Remove this object's strokes", "Ta bort objektets penseldrag"),
+    ("Object {}", "Objekt {}"),
+    ("Object {} ({})", "Objekt {} ({})"),
+    ("Source", "Källa"),
+    ("Active Camera ({})", "Aktiv kamera ({})"),
 ];
 
 const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
+    ("Click to sample color", "按一下以取樣顏色"),
     ("Appearance Settings…", "外觀設定…"),
     ("Add to favorites", "加入最愛"),
     ("Remove from favorites", "從最愛移除"),
@@ -1601,6 +3739,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Add:", "添加："),
     ("Adjust Exposure (stops)", "調整曝光（光圈級數）"),
     ("Adjust composition duration to the time span of the selected layers", "將合成時長調整為所選圖層的時間範圍"),
+    ("Advanced", "進階"),
     ("Advanced 3D", "高級 3D"),
     ("Align Layers to:", "將圖層對齊到："),
     ("All six face cameras turn together; the scene is not changed.", "六個面攝影機一起旋轉；場景不會改變。"),
@@ -1624,8 +3763,11 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Browser Storage", "瀏覽器儲存"),
     ("Browse…", "瀏覽…"),
     ("Brush Dynamics", "筆刷動態"),
-    ("Caching frames…", "正在快取幀…"),
+    ("Caching frames", "正在快取幀"),
     ("Cancel", "取消"),
+    ("Import After Effects Project", "匯入 After Effects 專案"),
+    ("Some parts of this project cannot be imported exactly (left out or changed):", "此專案的部分內容無法準確匯入（將被省略或變更）："),
+    ("Import Anyway", "仍要匯入"),
     ("Casts Shadows", "投射陰影"),
     ("Change Renderer…", "更改算圖引擎…"),
     ("Changing a shortcut creates a custom preset; the default stays as it is.", "修改快速鍵會創建自定義預設集；預設預設集保持不變。"),
@@ -1703,13 +3845,16 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Duration:", "持續時間："),
     ("Edit Gradient…", "編輯漸變…"),
     ("Edit Target: {}", "編輯目標：{}"),
-    ("Edit in the Timeline", "在時間軸中編輯"),
     ("EffectCraft didn't quit normally last time.", "EffectCraft 上次未正常結束。"),
     ("Effects", "效果"),
     ("Effects & Presets options", "效果和預設集選項"),
     ("Copy Presets Folder Path", "複製預設集資料夾路徑"),
     ("Copy Source Path", "複製來源路徑"),
     ("Effects: {}", "效果：{}"),
+    ("EXR Bit Depth: {}", "EXR 位元深度：{}"),
+    ("EXR Compression: {}", "EXR 壓縮：{}"),
+    ("EXR Compression: {} (lossy)", "EXR 壓縮：{}（失真）"),
+    ("EXR Compression: {} (uncompressed at float)", "EXR 壓縮：{}（浮點時不壓縮）"),
     ("Empty folder", "空資料夾"),
     ("Enable Depth of Field", "啟用景深"),
     ("Enable Expression", "啟用表達式"),
@@ -1737,6 +3882,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Frame Aspect Ratio: {}", "影格長寬比：{}"),
     ("Frame Blending: {}", "影格混合：{}"),
     ("Frame Rate:", "影格速率："),
+    ("Resolution:", "解析度："),
     ("Frame Render Time  {}ms", "影格算圖時間  {} 毫秒"),
     ("Frame Target:", "幀目標："),
     ("Freeze", "凍結"),
@@ -1769,7 +3915,6 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "最新的自動儲存：{}"),
     ("Layer", "圖層"),
     ("Layer controls", "圖層控制"),
-    ("Layer {}", "圖層 {}"),
     ("Layer:", "圖層："),
     ("Layer: {}", "圖層：{}"),
     ("Layer Styles", "圖層樣式"),
@@ -1830,6 +3975,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("No layer selected", "未選取圖層"),
     ("No matching effects or presets", "沒有匹配的效果或預設集"),
     ("No matching fonts", "沒有符合的字體"),
+    ("Rescan Fonts", "重新掃描字型"),
     ("Variable fonts only", "僅可變字型"),
     ("No model credits were built into this copy.", "此副本未內置模型致謝。"),
     ("No nested compositions", "沒有嵌套合成"),
@@ -1863,7 +4009,9 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Overlay", "疊加"),
     ("Parameter Name:", "參數名稱："),
     ("Parent pick whip: drag onto a layer", "上層拾取線：拖到圖層上"),
+    ("Track Matte pick whip: drag onto a layer", "軌道遮罩拾取線：拖到圖層上"),
     ("Pixel Aspect Ratio:", "像素長寬比例："),
+    ("Play/Stop", "播放/停止"),
     ("Playing on Video Preview", "在視訊預覽中播放"),
     ("Post-Render Action: {}", "算圖後動作：{}"),
     ("Preserve frame rate when nested or in render queue", "嵌套或在算圖佇列中時保留影格速率"),
@@ -1994,7 +4142,7 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Transparency grid", "透明格點"),
     ("Tutorial complete", "教學完成"),
     ("Two-Node Camera", "雙節點攝影機"),
-    ("Type", "文字"),
+    ("Type", "類型"),
     ("Type a command or effect…", "輸入命令或效果…"),
     ("URL:", "URL："),
     ("Undock Panel", "取消停靠面板"),
@@ -2027,59 +4175,10 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("⌘/Ctrl-drag a pin to record its motion", "⌘/Ctrl 拖曳釘選點可記錄其運動"),
     ("▣ {}", "▣ {}"),
     ("⚠ {} is used by:", "⚠ {} 已被以下專案使用："),
-    // The same rows as the Simplified catalog (the tests require both lists to match). The
-    // Traditional wording is the translator's call and is left as the English source for now.
-    ("3D Reference Axes", "3D Reference Axes"),
-    ("Affect all layers that use this solid", "Affect all layers that use this solid"),
-    ("Choose grid and guide options", "Choose grid and guide options"),
-    ("Colorize", "Colorize"),
-    ("Custom", "Custom"),
-    ("Custom...", "Custom..."),
-    ("Fit", "Fit"),
-    ("Fit up to 100%", "Fit up to 100%"),
-    ("Full", "Full"),
-    ("Half", "Half"),
-    ("Only this layer uses this solid.", "Only this layer uses this solid."),
-    ("Proportional Grid", "Proportional Grid"),
-    ("Quarter", "Quarter"),
-    ("Region of Interest", "Region of Interest"),
-    ("Reset Exposure", "Reset Exposure"),
-    ("Show Channel and Color Management Settings", "Show Channel and Color Management Settings"),
-    ("Show Snapshot (hold)", "Show Snapshot (hold)"),
-    ("Take Snapshot", "Take Snapshot"),
-    ("Third", "Third"),
-    ("Toggle Mask and Shape Path Visibility", "Toggle Mask and Shape Path Visibility"),
-    ("Toggle Transparency Grid", "Toggle Transparency Grid"),
-    ("16 bits per channel", "16 bits per channel"),
-    ("32 bits per channel (float)", "32 bits per channel (float)"),
-    ("8 bits per channel", "8 bits per channel"),
-    ("Adaptive Resolution", "Adaptive Resolution"),
-    ("Adobe-style built-in", "Adobe-style built-in"),
     ("Blue", "藍色"),
-    ("Current Settings", "Current Settings"),
-    ("Disable Per-character 3D", "Disable Per-character 3D"),
-    ("Draft", "Draft"),
-    ("Enable Per-character 3D", "Enable Per-character 3D"),
-    ("Fast Draft", "Fast Draft"),
-    ("Fast Previews (Draft 3D, Faster Effects)", "Fast Previews (Draft 3D, Faster Effects)"),
     ("Green", "綠色"),
-    ("Import Image Sequence", "Import Image Sequence"),
-    ("Import PDF / Illustrator File", "Import PDF / Illustrator File"),
-    ("Import Photoshop File", "Import Photoshop File"),
-    ("Interpret Unlabeled Alpha As", "Interpret Unlabeled Alpha As"),
     ("Join the ArtCraft Discord", "加入 ArtCraft Discord"),
-    ("Mercury GPU Acceleration ({})", "Mercury GPU Acceleration ({})"),
-    ("Mercury Software Only", "Mercury Software Only"),
-    ("OCIO (built-in ACES config)", "OCIO (built-in ACES config)"),
-    ("Off (Final Quality)", "Off (Final Quality)"),
-    ("OpenGL (compatibility)", "OpenGL (compatibility)"),
-    ("Opus Bitrate: {} kbps", "Opus Bitrate: {} kbps"),
-    ("RGB Straight", "RGB Straight"),
     ("Red", "紅色"),
-    ("Tone map", "Tone map"),
-    ("Use In-Window Menu Bar on macOS", "Use In-Window Menu Bar on macOS"),
-    ("Wireframe", "Wireframe"),
-    ("sRGB IEC61966-2.1 (default)", "sRGB IEC61966-2.1 (default)"),
     // The Home screen (#574).
     ("New Project", "新增專案"),
     ("Open Project…", "開啟專案…"),
@@ -2300,11 +4399,379 @@ const TRADITIONAL_CHINESE: &[(&str, &str)] = &[
     ("Total Offset", "總偏移"),
     ("Per Layer", "每個圖層"),
     ("Track", "追蹤"),
+    ("Selection Tool", "選取工具"),
+    ("Hand Tool", "手形工具"),
+    ("Zoom Tool", "縮放工具"),
+    ("Orbit Around Cursor Tool", "繞行攝影機工具"),
+    ("Pan Under Cursor Tool", "平移攝影機工具"),
+    ("Dolly Towards Cursor Tool", "推拉攝影機工具"),
+    ("Rotation Tool", "旋轉工具"),
+    ("Pan Behind (Anchor Point) Tool", "向後平移工具"),
+    ("Rectangle Tool", "矩形工具"),
+    ("Rounded Rectangle Tool", "圓角矩形工具"),
+    ("Ellipse Tool", "橢圓工具"),
+    ("Polygon Tool", "多邊形工具"),
+    ("Star Tool", "星形工具"),
+    ("Pen Tool", "筆型工具"),
+    ("Add Vertex Tool", "添加頂點工具"),
+    ("Delete Vertex Tool", "刪除頂點工具"),
+    ("Convert Vertex Tool", "轉換頂點工具"),
+    ("Mask Feather Tool", "遮色片羽化工具"),
+    ("Horizontal Type Tool", "橫排文字工具"),
+    ("Vertical Type Tool", "垂直文字工具"),
+    ("Brush Tool", "筆刷工具"),
+    ("Clone Stamp Tool", "仿製圖章工具"),
+    ("Eraser Tool", "橡皮擦工具"),
+    ("Roto Brush Tool", "Roto 筆刷工具"),
+    ("Refine Edge Tool", "調整邊緣工具"),
+    ("Object Matte Tool", "物件遮色片工具"),
+    ("Puppet Position Pin Tool", "人偶位置控點工具"),
+    ("Puppet Starch Pin Tool", "人偶撲粉控點工具"),
+    ("Puppet Bend Pin Tool", "人偶彎曲控點工具"),
+    ("Puppet Advanced Pin Tool", "人偶高級控點工具"),
+    ("Puppet Overlap Pin Tool", "人偶重疊控點工具"),
+    ("Shortcut", "快速鍵"),
+    ("Range", "範圍"),
+    ("Play From", "從下列位置播放"),
+    ("Frame Rate", "影格速率"),
+    ("Resolution", "解析度"),
+    ("Overlays", "覆疊"),
+    ("Layer Controls", "圖層控制"),
+    ("Loop", "循環"),
+    ("Cache Before Playback", "播放前快取"),
+    ("Pre-roll", "預卷"),
+    ("Post-roll", "後卷"),
+    ("If caching, play cached frames", "快取時播放已快取影格"),
+    ("Apply", "套用"),
+    ("Analyze", "分析"),
+    ("Create Camera", "建立攝影機"),
+    ("Add Point", "添加點"),
+    ("Remove Point", "移除點"),
+    ("Render", "算圖"),
+    ("Save Current as Template…", "將目前項目存為範本…"),
+    ("New Composition From Footage", "從素材新增合成"),
+    ("Search effects and presets", "搜尋效果與預設"),
+    ("Search project", "搜尋專案"),
+    ("Search", "搜尋"),
+    ("(no composition)", "沒有合成"),
+    ("per second", "每秒"),
+    ("Waveform", "波形"),
+    ("steps", "步驟"),
+    ("Building waveform…", "正在產生波形…"),
+    ("No effects. Drag one from Effects & Presets.", "沒有效果。從效果與預設集中拖入一個。"),
+    ("Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it", "點擊色環新增顏色；按住 Alt 點擊色標（或將其拖出）即可移除"),
+    ("Start from a ready-made project. Opening a template makes an untitled copy.", "從現成專案開始。開啟範本會建立一份未命名副本。"),
+    ("Square Pixels", "方形像素"),
+    ("Basic", "基本"),
+    ("3D Renderer", "3D 算圖引擎"),
+    ("Black", "黑色"),
+    ("White", "白色"),
+    ("Composition Settings", "合成設置"),
+    ("Force alphabetical order", "強制依字母順序"),
+    ("Frame rate (fps)", "幀率 (fps)"),
+    ("Import Kind", "匯入類型"),
+    ("Delay (s)", "延遲 (秒)"),
+    ("Amount (%)", "數量 (%)"),
+    ("Cascade (farther pins trail longer)", "階層 (越遠的圖釘延遲越長)"),
+    ("Speed (%)", "速度 (%)"),
+    ("Use Draft Deformation", "使用草稿變形"),
+    ("Show Mesh", "顯示網格"),
+    ("Scale X (%)", "X 縮放 (%)"),
+    ("Scale Y (%)", "Y 縮放 (%)"),
+    ("Rotation (degrees)", "旋轉 (度)"),
+    ("Move X", "移動 X"),
+    ("Move Y", "移動 Y"),
+    ("Position (pixels)", "位置 (像素)"),
+    ("Position (percent of the composition)", "位置 (合成百分比)"),
+    ("Use Dimensions From", "尺寸來源"),
+    ("Still Duration (seconds)", "靜態影像持續時間 (秒)"),
+    ("Add to Render Queue", "新增至轉譯佇列"),
+    ("Sequence Layers", "序列圖層"),
+    ("Duration (seconds)", "持續時間 (秒)"),
+    ("Matte color (premultiplied)", "遮罩顏色 (預乘)"),
+    ("Invert Alpha", "反轉 Alpha"),
+    ("Assume this frame rate", "以此幀率為準"),
+    ("Separate Fields", "分離場"),
+    ("Pixel Aspect Ratio", "像素長寬比"),
+    ("Loop (times)", "循環 (次)"),
+    ("Assign Profile", "指定設定檔"),
+    ("Preserve RGB", "保留 RGB"),
+    ("Interpret As Linear Light", "解譯為線性光"),
+    ("Start Timecode", "開始時間碼"),
+    ("Override Start", "覆寫開始"),
+    ("Time display style", "時間顯示樣式"),
+    ("Color engine", "色彩引擎"),
+    ("Working space", "工作空間"),
+    ("Working gamma", "工作 Gamma"),
+    ("Linearize working space", "線性化工作空間"),
+    ("Blend colors using 1.0 gamma", "使用 1.0 Gamma 混合顏色"),
+    ("Output color space", "輸出色彩空間"),
+    ("Video rendering and effects", "視訊轉譯與效果"),
+    ("Time Span", "時間範圍"),
+    ("Blur (pixels before auto-trace)", "模糊 (自動描摹前的像素)"),
+    ("Tolerance (pixels)", "容差 (像素)"),
+    ("Threshold (%)", "閾值 (%)"),
+    ("Minimum Area (pixels)", "最小區域 (像素)"),
+    ("Corner Roundness (%)", "角圓度 (%)"),
+    ("Apply To New Layer", "套用至新圖層"),
+    ("Sensitivity threshold (0–1, lower finds more)", "靈敏度閾值 (0–1，越低找到的越多)"),
+    ("Time field (empty: automatic)", "時間欄位 (空白: 自動)"),
+    ("Video start (ISO date-time, hh:mm:ss, timecode; empty: file date)", "視訊開始 (ISO 日期時間、hh:mm:ss、時間碼；空白: 檔案日期)"),
+    ("First sample at (comp seconds)", "首個取樣位置 (合成秒)"),
+    ("Frame rate", "幀率"),
+    ("Color (#rrggbb)", "顏色 (#rrggbb)"),
+    ("Embed footage files", "內嵌素材檔案"),
+    ("Embed up to (MB)", "內嵌上限 (MB)"),
+    ("Orient Along Path", "沿路徑定向"),
+    ("Orient Towards Camera", "朝向攝影機"),
+    ("Orient Towards Point of Interest", "朝向目標點"),
+    ("Single Composition", "單一合成"),
+    ("Multiple Compositions", "多個合成"),
+    ("Dissolve Front Layer", "溶解前層"),
+    ("Cross Dissolve Front and Back Layers", "交叉溶解前後層"),
+    ("Interpret Straight - Unmatted", "解譯為直接 (未遮罩)"),
+    ("Interpret Premultiplied - Matted With Color", "解譯為預乘 (以顏色遮罩)"),
+    ("Upper Field First", "上場優先"),
+    ("Lower Field First", "下場優先"),
+    ("Rec. 2020", "Rec. 2020"),
+    ("Use Source File Timecode", "使用來源檔案時間碼"),
+    ("Feet + Frames (35mm)", "英尺 + 幀 (35mm)"),
+    ("Feet + Frames (16mm)", "英尺 + 幀 (16mm)"),
+    ("Current Frame", "目前幀"),
+    ("Work Area", "工作區域"),
+    ("Create Markers", "建立標記"),
+    ("Split Layers", "分割圖層"),
+    ("Split and Precompose", "分割並預合成"),
+    ("All layers", "所有圖層"),
+    ("None (leave them out)", "無 (不含)"),
+    ("Nested sequences", "巢狀序列"),
+    ("Solid…", "純色…"),
+    ("Light…", "燈光…"),
+    ("Camera…", "攝影機…"),
+    ("Null Object", "空物件"),
+    ("Shape Layer", "形狀圖層"),
+    ("Adjustment Layer", "調整圖層"),
+    ("Layer Settings…", "圖層設定…"),
+    ("Create Shapes from Vector Layer", "從向量圖層建立形狀"),
+    ("Create Shapes from Text", "從文字建立形狀"),
+    ("Create Masks from Text", "從文字建立遮罩"),
+    ("New Mask", "新增遮罩"),
+    ("Center In View", "在視圖中置中"),
+    ("Fit to Comp", "符合合成"),
+    ("Flip Horizontal", "水平翻轉"),
+    ("Flip Vertical", "垂直翻轉"),
+    ("Enable Time Remapping", "啟用時間重對應"),
+    ("Time-Reverse Layer", "時間反轉圖層"),
+    ("Freeze Frame", "凍結幀"),
+    ("Freeze On Last Frame", "在最後一幀凍結"),
+    ("Add Marker", "新增標記"),
+    ("Bring Layer to Front", "圖層移至最上層"),
+    ("Bring Layer Forward", "圖層上移一層"),
+    ("Send Layer Backward", "圖層下移一層"),
+    ("Send Layer to Back", "圖層移至最下層"),
+    ("Pre-compose…", "預合成…"),
+    ("Split Layer", "分割圖層"),
+    ("Layer Style Options...", "圖層樣式選項..."),
+    ("Convert to Editable Styles", "轉換為可編輯樣式"),
+    ("Show All", "全部顯示"),
+    ("Remove All", "全部移除"),
+    ("Separate Dimensions", "分離維度"),
+    ("Add Property to Essential Graphics", "將屬性新增至基本圖形"),
+    ("Continuous Bezier", "連續貝茲"),
+    ("Auto Bezier", "自動貝茲"),
+    ("Lock To Time", "鎖定至時間"),
+    ("Rove Across Time", "跨時間漫遊"),
+    ("Anchor Point", "錨點"),
+    ("All Transform Properties", "所有變換屬性"),
+    ("Line Anchor", "行錨點"),
+    ("Line Spacing", "行距"),
+    ("Character Offset", "字元偏移"),
+    ("Character Value", "字元值"),
+    ("Fill Color: RGB", "填色: RGB"),
+    ("Fill Color: Hue", "填色: 色相"),
+    ("Fill Color: Saturation", "填色: 飽和度"),
+    ("Fill Color: Brightness", "填色: 亮度"),
+    ("Fill Color: Opacity", "填色: 不透明度"),
+    ("Stroke Color: RGB", "筆畫顏色: RGB"),
+    ("Stroke Color: Hue", "筆畫顏色: 色相"),
+    ("Stroke Color: Saturation", "筆畫顏色: 飽和度"),
+    ("Stroke Color: Brightness", "筆畫顏色: 亮度"),
+    ("Stroke Color: Opacity", "筆畫顏色: 不透明度"),
+    ("Stroke Width", "筆畫寬度"),
+    ("Front: Color", "前面: 顏色"),
+    ("Bevel: Color", "斜角: 顏色"),
+    ("Side: Color", "側面: 顏色"),
+    ("Back: Color", "背面: 顏色"),
+    ("Effect Controls", "效果控制項"),
+    ("Effects & Presets", "效果與預設集"),
+    ("Motion Sketch", "運動草圖"),
+    ("Render Queue", "轉譯佇列"),
+    ("Mask Interpolation", "遮罩插補"),
+    ("Script Console", "指令碼主控台"),
+    ("Essential Graphics", "基本圖形"),
+    ("ScriptUI Panel", "ScriptUI 面板"),
+    ("Video Scopes", "視訊示波器"),
+    ("Media Browser", "媒體瀏覽器"),
+    ("Content-Aware Fill", "內容感知填色"),
+    ("Create Nulls From Paths", "從路徑建立空物件"),
+    ("VR Comp Editor", "VR 合成編輯器"),
+    ("Media Duration", "媒體持續時間"),
+    ("File Path", "檔案路徑"),
+    ("Interpret Footage", "解譯素材"),
+    ("Create a new Folder", "新增資料夾"),
+    ("Create a new Composition", "新增合成"),
+    ("First Frame", "第一幀"),
+    ("Previous Frame", "上一幀"),
+    ("Next Frame", "下一幀"),
+    ("Last Frame", "最後一幀"),
+    ("Name (A–Z)", "名稱 (A–Z)"),
+    ("Merged PRs", "已合併 PR"),
+    ("Lines added", "新增的行數"),
+    ("Lines deleted", "刪除的行數"),
+    ("Line delta", "行數差異"),
+    ("Binary assets added", "新增的二進位資源"),
+    ("Binary assets removed", "刪除的二進位資源"),
+    ("First commit", "首次提交"),
+    ("Last commit", "最近提交"),
+    ("Display name", "顯示名稱"),
+    ("Real name", "真實姓名"),
+    ("ArtCraft website", "ArtCraft 網站"),
+    ("Source code on GitHub", "GitHub 上的原始碼"),
+    ("Preset Name", "預設集名稱"),
+    ("Save Preset…", "儲存預設集…"),
+    ("Delete Preset", "刪除預設集"),
+    ("Lock Aspect Ratio", "鎖定長寬比"),
+    ("Frame Rate presets", "幀率預設集"),
+    ("Background Color", "背景顏色"),
+    ("Shutter Angle", "快門角度"),
+    ("Shutter Phase", "快門相位"),
+    ("Samples Per Frame", "每幀取樣數"),
+    ("Adaptive Sample Limit", "自適應取樣上限"),
+    ("X and Y", "X 和 Y"),
+    ("X only", "僅 X"),
+    ("Y only", "僅 Y"),
+    ("Track Camera", "追蹤攝影機"),
+    ("Warp Stabilizer", "彎曲穩定器"),
+    ("Track Motion", "追蹤運動"),
+    ("Stabilize Motion", "穩定運動"),
+    ("Motion Source:", "運動來源:"),
+    ("Current Track:", "目前追蹤:"),
+    ("Track Type:", "追蹤類型:"),
+    ("Motion Target:", "運動目標:"),
+    ("Track Mask:", "追蹤遮罩:"),
+    ("Analyze forward", "向前分析"),
+    ("Analyze backward", "向後分析"),
+    ("Continue Tracking", "繼續追蹤"),
+    ("Stop Tracking", "停止追蹤"),
+    ("Adapt Feature", "自適應特徵"),
+    ("Extrapolate Motion", "外推運動"),
+    ("Attach Point", "附加點"),
+    ("Track Name", "追蹤名稱"),
+    ("Motion Tracker Options", "運動追蹤器選項"),
+    ("Motion Tracker Apply Options", "運動追蹤器套用選項"),
+    ("Edit Value Graph", "編輯數值圖表"),
+    ("Edit Speed Graph", "編輯速度圖表"),
+    ("Show Reference Graph", "顯示參考圖表"),
+    ("Auto-Select Graph Type (speed graph for spatial properties, else value graph)", "自動選擇圖表類型 (空間屬性用速度圖表，否則用數值圖表)"),
+    ("Auto-zoom graph height", "自動縮放圖表高度"),
+    ("Fit all graphs to view", "使所有圖表符合視圖"),
+    ("Fit selection to view", "使所選內容符合視圖"),
+    ("Snap (key drags snap to the current time and other keys)", "貼齊 (關鍵影格拖曳時貼齊目前時間和其他關鍵影格)"),
+    ("Show Transform Box when multiple keys are selected", "選擇多個關鍵影格時顯示變換框"),
+    ("Separate Dimensions (Position)", "分離維度 (位置)"),
+    ("Convert selected keyframes to Hold", "將所選關鍵影格轉換為定格"),
+    ("Convert selected keyframes to Linear", "將所選關鍵影格轉換為線性"),
+    ("Convert selected keyframes to Auto Bezier", "將所選關鍵影格轉換為自動貝茲"),
+    ("Easy Ease (F9)", "緩和 (F9)"),
+    ("Easy Ease In (Shift+F9)", "緩入 (Shift+F9)"),
+    ("Easy Ease Out (Ctrl+Shift+F9)", "緩出 (Ctrl+Shift+F9)"),
+    ("Spatial Path", "空間路徑"),
+    ("Temporal Path", "時間路徑"),
+    ("All the Same", "全部相同"),
+    ("All Independently", "全部獨立"),
+    ("Noise Type:", "雜訊類型:"),
+    ("Apply To:", "套用至:"),
+    ("Temporal Graph", "時間圖表"),
+    ("Keyframe Rate:", "關鍵影格率:"),
+    ("Capture speed at:", "速度擷取位置:"),
+    ("Start Capture", "開始擷取"),
+    ("Cancel Capture", "取消擷取"),
+    ("Small Caps", "小型大寫字母"),
+    ("All Small Caps", "全部小型大寫字母"),
+    ("Superscript / Superior", "上標"),
+    ("Subscript / Inferior", "下標"),
+    ("Standard Ligatures", "標準連字"),
+    ("Discretionary Ligatures", "選用連字"),
+    ("Contextual Alternates", "上下文替代"),
+    ("Stylistic Alternates", "樣式替代"),
+    ("Titling Alternates", "標題替代"),
+    ("Default Figure Style", "預設數字樣式"),
+    ("Tabular Lining", "等寬襯線數字"),
+    ("Proportional Oldstyle", "比例舊式"),
+    ("Proportional Lining", "比例襯線數字"),
+    ("Tabular Oldstyle", "等寬舊式"),
+    ("Fill Over Stroke", "填色在筆畫之上"),
+    ("Stroke Over Fill", "筆畫在填色之上"),
+    ("Stroke order", "筆畫順序"),
+    ("Single-line Composer", "單行排版器"),
+    ("Every-line Composer", "逐行排版器"),
+    ("Text direction", "文字方向"),
+    ("Recently Used", "最近使用"),
+    ("User Presets", "使用者預設集"),
+    ("Remove from Favorites", "從我的最愛移除"),
+    ("Show Animation Presets", "顯示動畫預設集"),
+    ("    Refresh List", "    重新整理清單"),
+    ("    Clear Recently Used", "    清除最近使用"),
+    ("Show 32 bpc Effects Only", "僅顯示 32 bpc 效果"),
+    ("Show GPU Accelerated Effects Only", "僅顯示 GPU 加速效果"),
+    ("Show Effects for All Color Depths", "顯示所有色彩深度的效果"),
+    ("* Animation Presets", "* 動畫預設集"),
+    ("Select a layer to apply to", "請選擇要套用的圖層"),
+    ("Alpha Expansion:", "Alpha 擴張:"),
+    ("Fill Method:", "填色方式:"),
+    ("Edge Blend", "邊緣混合"),
+    ("Entire Duration", "整個持續時間"),
+    ("Reference Frame:", "參考幀:"),
+    ("Use Current Time", "使用目前時間"),
+    ("Generate Fill Layer", "產生填色圖層"),
+    ("Lighting Correction:", "光照校正:"),
+    ("Create Text and Camera", "建立文字和攝影機"),
+    ("Create Solid and Camera", "建立純色和攝影機"),
+    ("Create Null and Camera", "建立空物件和攝影機"),
+    ("Create Shadow Catcher, Camera and Light", "建立陰影擷取器、攝影機和燈光"),
+    ("Unable to solve camera", "無法求解攝影機"),
+    ("Waiting to solve", "等待求解"),
+    ("track point", "追蹤點"),
+    ("Ruler zero point", "尺規零點"),
+    ("Vertical ruler", "垂直尺規"),
+    ("Horizontal ruler", "水平尺規"),
+    ("Viewer controls", "檢視器控制項"),
+    ("Resolution/Down Sample Factor", "解析度/降取樣係數"),
+    ("Adjust Exposure", "調整曝光"),
+    ("Snapshot taken", "已拍攝快照"),
+    ("Fast Previews", "快速預覽"),
+    ("3D View", "3D 視圖"),
+    ("Current time", "目前時間"),
+    ("Layer Transform", "圖層變換"),
+    ("Reset Transform", "重設變換"),
+    ("Text Animation", "文字動畫"),
+    ("Text Animation Presets", "文字動畫預設集"),
+    ("EffectCraft on getartcraft.com", "getartcraft.com 上的 EffectCraft"),
+    ("Small Screen", "小螢幕"),
+    ("Tool Creates Shape", "工具建立形狀"),
+    ("Tool Creates Mask", "工具建立遮罩"),
+    ("Blend Mode", "混合模式"),
+    ("Show mesh", "顯示網格"),
+    ("Record Options...", "記錄選項..."),
+    ("Software Rendering", "軟體算繪"),
+    ("GPU Acceleration ({})", "GPU 加速（{}）"),
+    ("GPU Acceleration (no GPU: software)", "GPU 加速（無 GPU：軟體）"),
 ];
 
 /// Ukrainian (uk): original translations of the same interface rows as the Chinese catalogs.
 /// Technical names, key names and substituted project content keep their original spelling.
 const UKRAINIAN: &[(&str, &str)] = &[
+    ("Click to sample color", "Клацніть, щоб узяти зразок кольору"),
     ("Appearance Settings…", "Налаштування вигляду…"),
     ("Add to favorites", "Додати до вибраного"),
     ("Remove from favorites", "Видалити з вибраного"),
@@ -2361,8 +4828,14 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Browser Storage", "Сховище браузера"),
     ("Browse…", "Огляд…"),
     ("Brush Dynamics", "Динаміка пензля"),
-    ("Caching frames…", "Кешування кадрів…"),
+    ("Caching frames", "Кешування кадрів"),
     ("Cancel", "Скасувати"),
+    ("Import After Effects Project", "Імпортувати проєкт After Effects"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Деякі частини цього проєкту неможливо імпортувати точно (їх пропущено або змінено):",
+    ),
+    ("Import Anyway", "Усе одно імпортувати"),
     ("Casts Shadows", "Відкидає тіні"),
     ("Change Renderer…", "Змінити рушій рендерингу…"),
     (
@@ -2446,13 +4919,16 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Duration:", "Тривалість:"),
     ("Edit Gradient…", "Редагувати градієнт…"),
     ("Edit Target: {}", "Ціль редагування: {}"),
-    ("Edit in the Timeline", "Редагувати на шкалі часу"),
     ("EffectCraft didn't quit normally last time.", "Минулого разу EffectCraft завершив роботу некоректно."),
     ("Effects", "Ефекти"),
     ("Effects & Presets options", "Параметри ефектів і наборів"),
     ("Copy Presets Folder Path", "Копіювати шлях до папки наборів"),
     ("Copy Source Path", "Копіювати шлях до джерела"),
     ("Effects: {}", "Ефекти: {}"),
+    ("EXR Bit Depth: {}", "Бітова глибина EXR: {}"),
+    ("EXR Compression: {}", "Стиснення EXR: {}"),
+    ("EXR Compression: {} (lossy)", "Стиснення EXR: {} (із втратами)"),
+    ("EXR Compression: {} (uncompressed at float)", "Стиснення EXR: {} (без стиснення для float)"),
     ("Empty folder", "Порожня тека"),
     ("Enable Depth of Field", "Увімкнути глибину різкості"),
     ("Enable Expression", "Увімкнути вираз"),
@@ -2480,6 +4956,7 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Frame Aspect Ratio: {}", "Пропорції кадру: {}"),
     ("Frame Blending: {}", "Змішування кадрів: {}"),
     ("Frame Rate:", "Частота кадрів:"),
+    ("Resolution:", "Роздільність:"),
     ("Frame Render Time  {}ms", "Час рендерингу кадру  {} мс"),
     ("Frame Target:", "Цільовий фрейм:"),
     ("Freeze", "Заморозити"),
@@ -2512,7 +4989,6 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "Останнє автозбереження: {}"),
     ("Layer", "Шар"),
     ("Layer controls", "Керування шарами"),
-    ("Layer {}", "Шар {}"),
     ("Layer:", "Шар:"),
     ("Layer: {}", "Шар: {}"),
     ("Layer Styles", "Стилі шару"),
@@ -2579,6 +5055,7 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("No layer selected", "Шар не виділено"),
     ("No matching effects or presets", "Не знайдено відповідних ефектів або наборів"),
     ("No matching fonts", "Не знайдено відповідних шрифтів"),
+    ("Rescan Fonts", "Повторно сканувати шрифти"),
     ("Variable fonts only", "Лише змінні шрифти"),
     ("No model credits were built into this copy.", "Ця копія не містить відомостей про моделі."),
     ("No nested compositions", "Немає вкладених композицій"),
@@ -2612,6 +5089,7 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Overlay", "Накладання"),
     ("Parameter Name:", "Назва параметра:"),
     ("Parent pick whip: drag onto a layer", "Зв’язування батьківського шару: перетягніть на шар"),
+    ("Track Matte pick whip: drag onto a layer", "Зв’язування трекової маски: перетягніть на шар"),
     ("Pixel Aspect Ratio:", "Пропорції пікселя:"),
     ("Playing on Video Preview", "Відтворення на відеоперегляді"),
     ("Post-Render Action: {}", "Дія після рендерингу: {}"),
@@ -2828,8 +5306,8 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Import Photoshop File", "Імпорт файлу Photoshop"),
     ("Interpret Unlabeled Alpha As", "Інтерпретувати непозначену альфу як"),
     ("Join the ArtCraft Discord", "Приєднатися до Discord ArtCraft"),
-    ("Mercury GPU Acceleration ({})", "Прискорення Mercury GPU ({})"),
-    ("Mercury Software Only", "Лише програмний Mercury"),
+    ("GPU Acceleration ({})", "Прискорення GPU ({})"),
+    ("Software Rendering", "Програмне відтворення"),
     ("OCIO (built-in ACES config)", "OCIO (вбудована конфігурація ACES)"),
     ("Off (Final Quality)", "Вимкнено (остаточна якість)"),
     ("OpenGL (compatibility)", "OpenGL (сумісність)"),
@@ -2875,10 +5353,14 @@ const UKRAINIAN: &[(&str, &str)] = &[
     ("Project", "Проєкт"),
     ("Total Offset", "Загальний зсув"),
     ("Per Layer", "На шар"),
+    ("Video Scopes", "Відеоскопи"),
+    ("GPU Acceleration (no GPU: software)", "Прискорення GPU (без GPU: програмне)"),
 ];
 
 // Brazilian Portuguese.
 const PORTUGUESE: &[(&str, &str)] = &[
+    ("Click to sample color", "Clique para obter uma amostra de cor"),
+    ("Export Scene to Blender...", "Exportar cena para o Blender..."),
     ("   OK   ", "   OK   "),
     ("  Delete  ", "  Excluir  "),
     (" Open Auto-Save ", " Abrir salvamento automático "),
@@ -2927,8 +5409,14 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("Browser Storage", "Armazenamento do navegador"),
     ("Browse…", "Procurar…"),
     ("Brush Dynamics", "Dinâmica do pincel"),
-    ("Caching frames…", "Armazenando quadros em cache…"),
+    ("Caching frames", "Armazenando quadros em cache"),
     ("Cancel", "Cancelar"),
+    ("Import After Effects Project", "Importar projeto do After Effects"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Algumas partes deste projeto não podem ser importadas exatamente (omitidas ou alteradas):",
+    ),
+    ("Import Anyway", "Importar mesmo assim"),
     ("Casts Shadows", "Projeta sombras"),
     ("Change Renderer…", "Alterar renderizador…"),
     (
@@ -3006,13 +5494,16 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("Duration:", "Duração:"),
     ("Edit Gradient…", "Editar gradiente…"),
     ("Edit Target: {}", "Editar destino: {}"),
-    ("Edit in the Timeline", "Editar na linha do tempo"),
     ("EffectCraft didn't quit normally last time.", "O EffectCraft não foi encerrado normalmente da última vez."),
     ("Effects", "Efeitos"),
     ("Effects & Presets options", "Opções de Efeitos e predefinições"),
     ("Copy Presets Folder Path", "Copiar caminho da pasta de predefinições"),
     ("Copy Source Path", "Copiar caminho da origem"),
     ("Effects: {}", "Efeitos: {}"),
+    ("EXR Bit Depth: {}", "Profundidade de bits EXR: {}"),
+    ("EXR Compression: {}", "Compactação EXR: {}"),
+    ("EXR Compression: {} (lossy)", "Compactação EXR: {} (com perdas)"),
+    ("EXR Compression: {} (uncompressed at float)", "Compactação EXR: {} (sem compactação em float)"),
     ("Empty folder", "Pasta vazia"),
     ("Enable Depth of Field", "Ativar profundidade de campo"),
     ("Enable Expression", "Ativar expressão"),
@@ -3040,6 +5531,7 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("Frame Aspect Ratio: {}", "Proporção do quadro: {}"),
     ("Frame Blending: {}", "Mesclagem de quadros: {}"),
     ("Frame Rate:", "Taxa de quadros:"),
+    ("Resolution:", "Resolução:"),
     ("Frame Render Time  {}ms", "Tempo de renderização do quadro  {}ms"),
     ("Frame Target:", "Destino do quadro:"),
     ("Grab bag", "Lista"),
@@ -3070,7 +5562,6 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "Último salvamento automático: {}"),
     ("Layer", "Camada"),
     ("Layer controls", "Controles da camada"),
-    ("Layer {}", "Camada {}"),
     ("Layer:", "Camada:"),
     ("Layer: {}", "Camada: {}"),
     ("Layer Styles", "Estilos de camada"),
@@ -3113,6 +5604,7 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("New", "Novo"),
     ("New Comp from Selection", "Nova composição a partir da seleção"),
     ("Replace with Precomposition", "Substituir por pré-composição"),
+    ("Rescan Fonts", "Reanalisar fontes"),
     ("used once", "usado uma vez"),
     ("used {} times", "usado {} vezes"),
     ("Compositions that use this item", "Composições que usam este item"),
@@ -3165,6 +5657,7 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("Output To:", "Saída para:"),
     ("Parameter Name:", "Nome do parâmetro:"),
     ("Parent pick whip: drag onto a layer", "Pick whip de pai: arraste até uma camada"),
+    ("Track Matte pick whip: drag onto a layer", "Pick whip de track matte: arraste até uma camada"),
     ("Pixel Aspect Ratio:", "Proporção de pixel:"),
     ("Playing on Video Preview", "Reproduzindo na visualização de vídeo"),
     ("Post-Render Action: {}", "Ação pós-renderização: {}"),
@@ -3326,10 +5819,1071 @@ const PORTUGUESE: &[(&str, &str)] = &[
     ("⚠ {} is used by:", "⚠ {} é usado por:"),
     ("Total Offset", "Deslocamento total"),
     ("Per Layer", "Por camada"),
+    ("Action-safe", "Área segura de ação"),
+    ("Add to favorites", "Adicionar aos favoritos"),
+    ("All Footage", "Todas as mídias"),
+    ("All Keyframes", "Todos os keyframes"),
+    ("Allow Scripts to Write Files and Access Network", "Permitir que scripts gravem arquivos e acessem a rede"),
+    ("Append Bit Depth to File Name", "Anexar profundidade de bits ao nome do arquivo"),
+    ("Application Scripting", "Scripting do aplicativo"),
+    ("Ask User", "Perguntar ao usuário"),
+    ("Audio Hardware", "Hardware de áudio"),
+    ("Audio Output Mapping", "Mapeamento de saída de áudio"),
+    ("Auto-Save Location", "Local do salvamento automático"),
+    ("Automatic", "Automático"),
+    ("Automatically Reload Footage", "Recarregar mídias automaticamente"),
+    ("Automatically Save Projects", "Salvar projetos automaticamente"),
+    ("Brightness", "Brilho"),
+    ("Cache Budgets", "Orçamentos de cache"),
+    ("Conformed Audio Folder", "Pasta de áudio conformado"),
+    ("Create Layers at Composition Start Time", "Criar camadas no tempo inicial da composição"),
+    ("Create Split Layers Above Original Layer", "Criar camadas divididas acima da camada original"),
+    ("Custom", "Personalizado"),
+    ("Custom Location", "Local personalizado"),
+    ("Cycle Mask Colors", "Alternar cores das máscaras"),
+    ("Dark Theme", "Tema escuro"),
+    ("Dashed Lines", "Linhas tracejadas"),
+    ("Default 3D Renderer", "Renderizador 3D padrão"),
+    ("Default Drag Import As", "Importação padrão ao arrastar como"),
+    ("Default Output Folder", "Pasta de saída padrão"),
+    ("Default Spatial Interpolation to Linear", "Definir interpolação espacial padrão como linear"),
+    ("Disable Video Output When in Background", "Desativar saída de vídeo em segundo plano"),
+    ("Disk Cache Folder", "Pasta de cache do disco"),
+    ("Display Color Space", "Espaço de cores da exibição"),
+    ("Dots", "Pontos"),
+    ("Duration (Seconds)", "Duração (segundos)"),
+    (
+        "EffectCraft always uses its own colour picker (the same on every platform and the web).",
+        "O EffectCraft sempre usa o próprio seletor de cores (o mesmo em todas as plataformas e na web).",
+    ),
+    ("Empty Disk Cache", "Esvaziar cache do disco"),
+    ("Enable Disk Cache", "Ativar cache do disco"),
+    ("Enable JavaScript Debugger", "Ativar depurador JavaScript"),
+    ("Enable Video Preview Output", "Ativar saída de pré-visualização de vídeo"),
+    ("Expression Pick Whip Writes Compact English", "Pick whip de expressão grava inglês compacto"),
+    (
+        "Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger.",
+        "As expressões usam o mecanismo JavaScript. Erros de script informam o arquivo e a linha no Console de scripts; não há depurador passo a passo.",
+    ),
+    ("Face Model", "Modelo de rosto"),
+    ("Face Tracking", "Rastreamento facial"),
+    (
+        "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "O rastreamento facial no painel Rastreador (Somente contorno e recursos detalhados) usa o modelo escolhido aqui. Os modelos são de código aberto, baixados somente quando você solicita, e verificados com o SHA-256 publicado.",
+    ),
+    ("Fast Previews (Draft 3D, Faster Effects)", "Pré-visualizações rápidas (3D em rascunho, efeitos mais rápidos)"),
+    ("Files per Segment", "Arquivos por segmento"),
+    ("Fit", "Ajustar"),
+    ("Fit up to 100%", "Ajustar até 100%"),
+    ("Floating Window", "Janela flutuante"),
+    ("Footage Frame Cache", "Cache de quadros de mídia"),
+    ("GPU Information...", "Informações da GPU..."),
+    ("Gridline Every", "Grade a cada"),
+    ("Hardware Accelerate Composition, Layer and Footage Panels", "Aceleração por hardware dos painéis de composição, camada e mídia"),
+    ("Import Photoshop File", "Importar arquivo do Photoshop"),
+    ("Interpret Unlabeled Alpha As", "Interpretar alfa não rotulado como"),
+    ("Keyframes", "Keyframes"),
+    ("Labels and Colors", "Rótulos e cores"),
+    ("Layer Cache", "Cache de camada"),
+    ("Length of Composition", "Duração da composição"),
+    ("Levels of Undo", "Níveis de desfazer"),
+    ("Light Theme", "Tema claro"),
+    ("Match System", "Seguir o sistema"),
+    ("Maximum Disk Cache Size", "Tamanho máximo do cache do disco"),
+    ("Maximum Project Versions", "Máximo de versões do projeto"),
+    ("Media Cache", "Cache de mídia"),
+    ("Menu Bar", "Barra de menus"),
+    ("Minutes", "Minutos"),
+    ("Mirror on Computer Monitor", "Espelhar no monitor do computador"),
+    ("Move Panel to New Window", "Mover painel para nova janela"),
+    ("New Composition", "Nova composição"),
+    ("New Project", "Novo projeto"),
+    ("New Project Loads Template", "Novo projeto carrega modelo"),
+    ("Next to Project", "Ao lado do projeto"),
+    ("No More Than (Keyframes)", "No máximo (keyframes)"),
+    ("No More Than (Seconds)", "No máximo (segundos)"),
+    ("No Motion Path", "Sem caminho de movimento"),
+    ("Non-Sequence Footage", "Mídia que não é sequência"),
+    ("Number of Recent Fonts to Display", "Número de fontes recentes a exibir"),
+    ("Off (Final Quality)", "Desativado (qualidade final)"),
+    ("Offer to Open the Latest Auto-Save After a Crash", "Oferecer para abrir o salvamento automático mais recente após uma falha"),
+    ("OpenGL (compatibility)", "OpenGL (compatibilidade)"),
+    ("Panels are always drawn by the GPU (wgpu).", "Os painéis são sempre desenhados pela GPU (wgpu)."),
+    ("Preserve Constant Vertex and Feather Point Count when Editing Masks", "Preservar o número constante de vértices e pontos de feather ao editar máscaras"),
+    ("Preview (RAM) Cache", "Cache de pré-visualização (RAM)"),
+    ("RAM Reserved for Other Applications", "RAM reservada para outros aplicativos"),
+    ("RGB Straight", "RGB direto"),
+    ("Realtime Shadows in Draft", "Sombras em tempo real no rascunho"),
+    ("Recent Projects Shown", "Projetos recentes exibidos"),
+    ("Red", "Vermelho"),
+    ("Reduce Cache Size When System Is Low on Memory", "Reduzir o tamanho do cache quando o sistema estiver com pouca memória"),
+    ("Remove from favorites", "Remover dos favoritos"),
+    ("Repair", "Reparo"),
+    ("Report Missing Frames", "Relatar quadros ausentes"),
+    ("Reset Keyboard Shortcuts", "Redefinir atalhos de teclado"),
+    ("Reset Settings", "Redefinir configurações"),
+    (
+        "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Roto Brush 2.0 e 3.0 usam o modelo escolhido aqui (a versão 1.0 sempre usa o mecanismo clássico). Os modelos são de código aberto, baixados somente quando você solicita, e verificados com o SHA-256 publicado.",
+    ),
+    ("Safe Margins", "Margens de segurança"),
+    ("Save Every", "Salvar a cada"),
+    ("Save Now", "Salvar agora"),
+    ("Save When Starting Render Queue", "Salvar ao iniciar a fila de renderização"),
+    ("Segment Movie Files", "Segmentar arquivos de filme"),
+    ("Segment Sequences", "Segmentar sequências"),
+    ("Segment Size", "Tamanho do segmento"),
+    ("Segmentation Model", "Modelo de segmentação"),
+    ("Sequence Footage", "Mídia em sequência"),
+    ("Show 3D Reference Axes", "Mostrar eixos de referência 3D"),
+    ("Show Expression Error Banner", "Mostrar faixa de erro de expressão"),
+    ("Show Font Names in English", "Mostrar nomes de fontes em inglês"),
+    ("Show Font Preview", "Mostrar pré-visualização de fonte"),
+    ("Show Home Screen When Launching", "Mostrar tela inicial ao iniciar"),
+    ("Show Home Screen When Opening a Project", "Mostrar tela inicial ao abrir um projeto"),
+    ("Show Tool Tips", "Mostrar dicas de ferramenta"),
+    ("Startup & Repair", "Inicialização e reparo"),
+    ("Still Footage", "Mídia estática"),
+    ("Stored, but not used by EffectCraft yet", "Armazenado, mas ainda não usado pelo EffectCraft"),
+    ("Subdivisions", "Subdivisões"),
+    ("Switches Affect Nested Comps", "Interruptores afetam composições aninhadas"),
+    ("Synchronize Time of All Related Items", "Sincronizar o tempo de todos os itens relacionados"),
+    ("Template Project", "Projeto de modelo"),
+    ("Title-safe", "Área segura de título"),
+    ("Use In-Window Menu Bar on macOS", "Usar barra de menus na janela no macOS"),
+    ("Use System Color Picker", "Usar seletor de cores do sistema"),
+    ("Video Device", "Dispositivo de vídeo"),
+    ("Video Output During Playback", "Saída de vídeo durante a reprodução"),
+    ("Warn User When Executing Files", "Avisar o usuário ao executar arquivos"),
+    ("Window Graphics", "Gráficos da janela"),
+    (
+        "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
+        "Gráficos da janela vale a partir do próximo início. Quando o driver gráfico interrompe o EffectCraft na abertura da janela, o próximo início muda para OpenGL.",
+    ),
+    ("Wireframe", "Wireframe"),
+    ("Active", "Em uso"),
+    ("NAME", "NOME"),
+    ("Affect all layers that use this solid", "Afetar todas as camadas que usam este sólido"),
+    ("EffectCraft home page", "Página inicial do EffectCraft"),
+    ("Only this layer uses this solid.", "Somente esta camada usa este sólido."),
+    ("KIND", "TIPO"),
+    ("Blue", "Azul"),
+    ("Green", "Verde"),
+    ("Unfreeze", "Descongelar"),
+    ("Export", "Exportar"),
+    ("Auto-complete", "Preenchimento automático"),
+    ("Bracket Matching", "Correspondência de colchetes"),
+    ("Font Size", "Tamanho da fonte"),
+    ("Line Numbers", "Números de linha"),
+    ("Scripting & Expressions", "Scripts e expressões"),
+    ("Syntax Highlighting", "Realce de sintaxe"),
+    ("Word Wrap", "Quebra automática de linha"),
+    ("16 bits per channel", "16 bits por canal"),
+    ("32 bits per channel (float)", "32 bits por canal (ponto flutuante)"),
+    ("8 bits per channel", "8 bits por canal"),
+    ("Adobe-style built-in", "Integrado (estilo Adobe)"),
+    ("Composition - Retain Layer Sizes", "Composição - Manter tamanhos de camada"),
+    ("Guess", "Adivinhar"),
+    ("Import Image Sequence", "Importar sequência de imagens"),
+    ("Import PDF / Illustrator File", "Importar arquivo PDF / Illustrator"),
+    ("Software Rendering", "Renderização por software"),
+    ("OCIO (built-in ACES config)", "OCIO (config do ACES integrado)"),
+    ("Still Duration", "Duração da imagem fixa"),
+    ("Straight", "Direto"),
+    ("Tone map", "Mapeamento tonal"),
+    ("sRGB IEC61966-2.1 (default)", "sRGB IEC61966-2.1 (padrão)"),
+    (
+        "Click above the bar to add an opacity stop, below it to add a color stop.",
+        "Clique acima da barra para adicionar uma parada de opacidade, abaixo dela para adicionar uma parada de cor.",
+    ),
+    ("Location:", "Local:"),
+    (
+        "These adjacent keyframes cannot interpolate because their stop counts differ.",
+        "Estes keyframes adjacentes não podem ser interpolados porque os seus números de paradas diferem.",
+    ),
+    ("After Effects project", "Projeto do After Effects"),
+    ("Create a new project, or open the demo project to look around.", "Crie um novo projeto ou abra o projeto de demonstração para explorar."),
+    ("Filter recent files", "Filtrar arquivos recentes"),
+    ("Import Footage…", "Importar mídia…"),
+    ("Just now", "Agora mesmo"),
+    ("Lottie animation", "Animação Lottie"),
+    ("Motion graphics and visual effects · version {}", "Motion graphics e efeitos visuais · versão {}"),
+    ("No recent files match the filter", "Nenhum arquivo recente corresponde ao filtro"),
+    ("OPENED", "ABERTO"),
+    ("Open Demo Project", "Abrir projeto de demonstração"),
+    ("Open Project…", "Abrir projeto…"),
+    ("SIZE", "TAMANHO"),
+    ("Try another name or folder.", "Tente outro nome ou pasta."),
+    ("Yesterday", "Ontem"),
+    ("Your recent files will show here", "Seus arquivos recentes aparecerão aqui"),
+    ("{} day ago", "há {} dia"),
+    ("{} days ago", "há {} dias"),
+    ("{} hour ago", "há {} hora"),
+    ("{} hours ago", "há {} horas"),
+    ("{} minute ago", "há {} minuto"),
+    ("{} minutes ago", "há {} minutos"),
+    ("Show Rendering Progress in Info Panel and Flowchart", "Mostrar progresso de renderização no painel Informações e no fluxograma"),
+    ("Current Settings", "Configurações atuais"),
+    ("Move Panel to Main Window", "Mover painel para a janela principal"),
+    ("Disable Per-character 3D", "Desativar 3D por caractere"),
+    ("Enable Per-character 3D", "Ativar 3D por caractere"),
+    ("Opus Bitrate: {} kbps", "Taxa de bits do Opus: {} kbps"),
+    ("Quarter", "Um quarto"),
+    ("Region of Interest", "Região de interesse"),
+    ("Third", "Um terço"),
+    ("Boundary", "Contorno"),
+    ("Labels", "Rótulos"),
+    ("You can't undo this.", "Você não pode desfazer isto."),
+    ("Latin", "Latino"),
+    ("South Asian and Middle Eastern", "Sul-asiático e do Oriente Médio"),
+    ("Text Engine", "Motor de texto"),
+    ("Variable fonts only", "Apenas fontes variáveis"),
+    ("Expressions Editor", "Editor de expressões"),
+    ("Faster", "Mais rápido"),
+    ("Grids & Guides", "Grades e guias"),
+    ("More Accurate", "Mais preciso"),
+    ("Path Point and Handle Size", "Tamanho dos pontos de caminho e das alças"),
+    ("Show Internal Wireframes", "Mostrar wireframes internos"),
+    ("Viewer Zoom Quality", "Qualidade de zoom do visualizador"),
+    ("Motion Path", "Caminho de movimento"),
+    ("3D Reference Axes", "Eixos de referência 3D"),
+    ("Choose grid and guide options", "Escolher opções de grade e guias"),
+    ("Colorize", "Colorir"),
+    ("Custom...", "Personalizado..."),
+    ("Proportional Grid", "Grade proporcional"),
+    ("Reset Exposure", "Redefinir exposição"),
+    ("Show Channel and Color Management Settings", "Mostrar configurações de canal e de gerenciamento de cores"),
+    ("Show Snapshot (hold)", "Mostrar instantâneo (manter pressionado)"),
+    ("Take Snapshot", "Capturar instantâneo"),
+    ("Toggle Mask and Shape Path Visibility", "Alternar visibilidade das máscaras e dos caminhos de forma"),
+    ("Toggle Transparency Grid", "Alternar grade de transparência"),
+    ("Database and Cache Folder", "Pasta de banco de dados e de cache"),
+    ("Adaptive Resolution", "Resolução adaptável"),
+    ("Adaptive Resolution Limit", "Limite de resolução adaptável"),
+    ("Alpha", "Alfa"),
+    ("Appearance", "Aparência"),
+    ("Appearance Mode", "Modo de aparência"),
+    ("Appearance Mode: {}", "Modo de aparência: {}"),
+    ("Appearance Settings…", "Configurações de aparência…"),
+    ("Audio", "Áudio"),
+    ("Auto-Save", "Auto-salvar"),
+    ("Cache Frames When Idle", "Armazenar quadros em cache quando ocioso"),
+    ("Dark", "Escuro"),
+    ("Default", "Padrão"),
+    ("Disk", "Disco"),
+    ("Disk Cache", "Cache do disco"),
+    ("Display", "Exibição"),
+    ("Draft", "Rascunho"),
+    ("EffectCraft on GitHub", "EffectCraft no GitHub"),
+    ("EffectCraft project", "Projeto do EffectCraft"),
+    ("Extended Viewer", "Visualizador estendido"),
+    ("Fast Draft", "Rascunho rápido"),
+    ("Footage", "Mídia"),
+    ("Freeze", "Congelar"),
+    ("Full", "Integral"),
+    ("Full Screen", "Tela inteira"),
+    ("General", "Geral"),
+    ("Gradient Editor", "Editor de gradiente"),
+    ("Half", "Metade"),
+    ("Horizontal", "Horizontal"),
+    ("Ignore", "Ignorar"),
+    ("Join the ArtCraft Discord", "Entre no Discord da ArtCraft"),
+    ("Language", "Idioma"),
+    ("Left", "Esquerda"),
+    ("Light", "Claro"),
+    ("Lines", "Linhas"),
+    ("Memory & CPU", "Memória e CPU"),
+    ("GPU Acceleration ({})", "Aceleração de GPU ({})"),
+    ("Off", "Desativado"),
+    ("Options", "Opções"),
+    ("Overlay", "Sobrepor"),
+    ("Premultiplied", "Pré-multiplicado"),
+    ("Preview Sample Rate", "Taxa de amostragem de pré-visualização"),
+    ("Previews", "Pré-visualizações"),
+    ("Project", "Projeto"),
+    ("RGB", "RGB"),
+    ("Right", "Direita"),
+    ("Roto Brush", "Roto Brush"),
+    ("Seconds", "Segundos"),
+    ("Stop", "Parar"),
+    ("Style", "Estilo"),
+    ("Sync with System", "Sincronizar com o sistema"),
+    ("Templates", "Modelos"),
+    ("Track", "Rastrear"),
+    ("UI Scale", "Escala da interface"),
+    ("Use Gradients", "Usar gradientes"),
+    ("Use Label Color for Layer Handles and Paths", "Usar a cor do rótulo nas alças de camada e nos caminhos"),
+    ("Use Label Color for Related Tabs", "Usar a cor do rótulo nas abas relacionadas"),
+    ("Vertical", "Vertical"),
+    ("Video", "Vídeo"),
+    ("channel", "canal"),
+    ("files", "arquivos"),
+    ("Video Scopes", "Escopos de vídeo"),
+    ("GPU Acceleration (no GPU: software)", "Aceleração de GPU (sem GPU: software)"),
+];
+
+/// Polish (pl): original translations covering every row in the Chinese panel catalogs.
+const POLISH: &[(&str, &str)] = &[
+    ("Click to sample color", "Kliknij, aby pobrać próbkę koloru"),
+    ("Appearance Settings…", "Ustawienia wyglądu…"),
+    ("Add to favorites", "Dodaj do ulubionych"),
+    ("Remove from favorites", "Usuń z ulubionych"),
+    ("   OK   ", "   OK   "),
+    ("  Delete  ", "  Usuń  "),
+    (" Open Auto-Save ", " Otwórz autozapis "),
+    ("(missing)", "(brak)"),
+    ("360 View Orientation", "Orientacja widoku 360"),
+    ("3:2 Pulldown: {}", "Pulldown 3:2: {}"),
+    (
+        "A clean-room, open-source compositor for motion graphics and visual effects: native on macOS, Windows and Linux, and in the browser. Part of the ArtCraft family of creative apps.",
+        "Kompozytor grafiki ruchomej i efektów wizualnych, open source i tworzony metodą clean-room: natywny w macOS, Windows i Linuksie oraz w przeglądarce. Część rodziny aplikacji twórczych ArtCraft.",
+    ),
+    ("About EffectCraft", "O programie EffectCraft"),
+    ("About...", "O programie..."),
+    ("Active", "Aktywny"),
+    ("Active Camera", "Aktywna kamera"),
+    ("Alpha", "Alfa"),
+    ("Adapt Feature On Every Frame", "Dostosuj cechę w każdej klatce"),
+    ("Adaptive Sample Limit:", "Adaptacyjny limit próbek:"),
+    ("Add Animator", "Dodaj animator"),
+    ("Add Comment", "Dodaj komentarz"),
+    ("Add Formatting", "Dodaj formatowanie"),
+    ("Add Group", "Dodaj grupę"),
+    ("Add Mirror", "Dodaj lustro"),
+    ("Add Selected As", "Dodaj zaznaczone jako"),
+    ("Add a comment", "Dodaj komentarz"),
+    ("Add a shape, fill, stroke or path operation", "Dodaj kształt, wypełnienie, obrys lub operację na ścieżce"),
+    ("Add to Composition", "Dodaj do kompozycji"),
+    ("Add to Favorites", "Dodaj do ulubionych"),
+    ("Add:", "Dodaj:"),
+    ("Adjust Exposure (stops)", "Dostosuj ekspozycję (EV)"),
+    ("Adjust composition duration to the time span of the selected layers", "Dopasuj czas trwania kompozycji do zakresu czasu zaznaczonych warstw"),
+    ("Advanced 3D", "Zaawansowane 3D"),
+    ("Align Layers to:", "Wyrównaj warstwy do:"),
+    ("All six face cameras turn together; the scene is not changed.", "Wszystkie sześć kamer ścian obraca się razem; scena się nie zmienia."),
+    ("Anchor:", "Zakotwiczenie:"),
+    ("Aperture", "Przysłona"),
+    ("Appearance Mode", "Tryb wyglądu"),
+    ("Appearance Mode: {}", "Tryb wyglądu: {}"),
+    ("Apply Dimensions:", "Zastosuj wymiary:"),
+    ("Apply Motion To:", "Zastosuj ruch do:"),
+    ("Arrange", "Kolejność"),
+    ("Assign", "Przypisz"),
+    ("Auto", "Auto"),
+    ("Auto-saves", "Autozapisy"),
+    ("Back", "Tył"),
+    ("Background Color:", "Kolor tła:"),
+    ("Blend Mode:", "Tryb mieszania:"),
+    ("Blending Mode", "Tryb mieszania"),
+    ("Blur", "Rozmycie"),
+    ("Blur Level", "Poziom rozmycia"),
+    ("Boundary", "Granica"),
+    ("Browser Storage", "Pamięć przeglądarki"),
+    ("Browse…", "Przeglądaj…"),
+    ("Brush Dynamics", "Dynamika pędzla"),
+    ("Caching frames", "Buforowanie klatek"),
+    ("Cancel", "Anuluj"),
+    ("Import After Effects Project", "Importuj projekt After Effects"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Niektórych części tego projektu nie można zaimportować dokładnie (zostaną pominięte lub zmienione):",
+    ),
+    ("Import Anyway", "Importuj mimo to"),
+    ("Casts Shadows", "Rzuca cienie"),
+    ("Change Renderer…", "Zmień renderer…"),
+    (
+        "Changing a shortcut creates a custom preset; the default stays as it is.",
+        "Zmiana skrótu tworzy niestandardowe ustawienie; domyślne pozostaje bez zmian.",
+    ),
+    ("Channel", "Kanał"),
+    ("Channel:", "Kanał:"),
+    ("Chapter:", "Rozdział:"),
+    ("Choose...", "Wybierz..."),
+    ("Classic 3D", "Klasyczne 3D"),
+    ("Clear", "Wyczyść"),
+    ("Clear list", "Wyczyść listę"),
+    ("Click a key to see its commands.", "Kliknij klawisz, aby zobaczyć jego polecenia."),
+    (
+        "Click above the bar to add an opacity stop, below it to add a color stop.",
+        "Kliknij nad paskiem, aby dodać punkt krycia, pod nim, aby dodać punkt koloru.",
+    ),
+    ("Click adds a point (½ height = no change)", "Kliknięcie dodaje punkt (½ wysokości = bez zmian)"),
+    ("Click adds a point; drag one off to remove", "Kliknięcie dodaje punkt; przeciągnij go poza obszar, aby usunąć"),
+    ("Click to make this viewer active", "Kliknij, aby uaktywnić tę przeglądarkę"),
+    ("Click to reveal the expression in the timeline", "Kliknij, aby pokazać wyrażenie na osi czasu"),
+    ("Click to show the active composition here", "Kliknij, aby pokazać tu aktywną kompozycję"),
+    ("Click, then click in the Composition panel", "Kliknij, a potem kliknij w panelu Kompozycja"),
+    ("Clone Options", "Opcje klonowania"),
+    ("Clone Source Overlay:", "Nakładka źródła klonowania:"),
+    ("Close", "Zamknij"),
+    ("Close Panel", "Zamknij panel"),
+    ("Close tutorial", "Zamknij samouczek"),
+    ("Color", "Kolor"),
+    ("Color Depth: {}", "Głębia kolorów: {}"),
+    ("Color:", "Kolor:"),
+    ("Colour map", "Mapa kolorów"),
+    ("Columns", "Kolumny"),
+    ("Comment:", "Komentarz:"),
+    ("Community", "Społeczność"),
+    ("Composition", "Kompozycja"),
+    ("Composition Mini-Flowchart", "Miniaturowy schemat kompozycji"),
+    ("Composition Name:", "Nazwa kompozycji:"),
+    ("Composition Settings ▸ 3D Renderer", "Ustawienia kompozycji ▸ Renderer 3D"),
+    ("Composition Settings…", "Ustawienia kompozycji…"),
+    ("Composition marker bin: drag a marker to the time ruler", "Pojemnik znaczników kompozycji: przeciągnij znacznik na linijkę czasu"),
+    ("Cone Angle", "Kąt stożka"),
+    ("Cone Feather", "Wtapianie stożka"),
+    ("Constrain Proportions", "Zachowaj proporcje"),
+    ("Continuous (Lock Outgoing to Incoming)", "Ciągły (zablokuj wyjście do wejścia)"),
+    ("Cue Point", "Punkt sygnału"),
+    ("Current Render", "Bieżące renderowanie"),
+    ("Dark", "Ciemny"),
+    ("Dark Theme", "Ciemny motyw"),
+    ("Darker", "Ciemniej"),
+    ("Default Output:", "Domyślne wyjście:"),
+    ("Default: {}", "Domyślnie: {}"),
+    ("Defaults", "Domyślne"),
+    ("Delete", "Usuń"),
+    ("Delete Selected Points", "Usuń zaznaczone punkty"),
+    ("Delete selected project items", "Usuń zaznaczone elementy projektu"),
+    ("Delete this template", "Usuń ten szablon"),
+    ("Depth of Field", "Głębia ostrości"),
+    ("Discord", "Discord"),
+    ("Distribute Layers:", "Rozmieść warstwy:"),
+    ("Don't Recover", "Nie odzyskuj"),
+    ("Don't Save", "Nie zapisuj"),
+    ("Double-click a layer to open it in the Layer panel", "Kliknij dwukrotnie warstwę, aby otworzyć ją w panelu Warstwa"),
+    ("Double-click footage in the Project panel to open it here", "Kliknij dwukrotnie materiał w panelu Projekt, aby otworzyć go tutaj"),
+    ("Double-click to edit the comment", "Kliknij dwukrotnie, aby edytować komentarz"),
+    ("Download", "Pobierz"),
+    (
+        "Drag properties here from the timeline,\nor use Animation > Add Property to Essential Graphics.",
+        "Przeciągnij tu właściwości z osi czasu\nalbo użyj Animacja > Dodaj właściwość do Essential Graphics.",
+    ),
+    ("Drag to change", "Przeciągnij, aby zmienić"),
+    ("Drag to create a guide", "Przeciągnij, aby utworzyć linię pomocniczą"),
+    ("Drag to slip the source", "Przeciągnij, aby przesunąć źródło"),
+    ("Drop Frame", "Z pomijaniem klatek"),
+    ("Duplicate", "Powiel"),
+    ("Duration:", "Czas trwania:"),
+    ("Edit Gradient…", "Edytuj gradient…"),
+    ("Edit Target: {}", "Cel edycji: {}"),
+    ("EffectCraft didn't quit normally last time.", "EffectCraft nie zakończył się poprawnie ostatnim razem."),
+    ("Effects & Presets options", "Opcje efektów i ustawień"),
+    ("Copy Presets Folder Path", "Kopiuj ścieżkę folderu ustawień"),
+    ("Effects: {}", "Efekty: {}"),
+    ("EXR Bit Depth: {}", "Głębia bitowa EXR: {}"),
+    ("EXR Compression: {}", "Kompresja EXR: {}"),
+    ("EXR Compression: {} (lossy)", "Kompresja EXR: {} (stratna)"),
+    ("EXR Compression: {} (uncompressed at float)", "Kompresja EXR: {} (bez kompresji dla float)"),
+    ("Empty folder", "Pusty folder"),
+    ("Enable Depth of Field", "Włącz głębię ostrości"),
+    ("Enable Expression", "Włącz wyrażenie"),
+    ("Enhance", "Ulepsz"),
+    ("Essential Properties — {}", "Najważniejsze właściwości — {}"),
+    ("Event", "Zdarzenie"),
+    ("Export Template…", "Eksportuj szablon…"),
+    ("Export...", "Eksportuj..."),
+    ("Expression Language Menu", "Menu języka wyrażeń"),
+    ("Expression pick whip: drag onto a property", "Łącznik wyrażenia: przeciągnij na właściwość"),
+    ("Expression:", "Wyrażenie:"),
+    ("Eyedropper: click, then click in the Composition panel", "Kroplomierz: kliknij, a potem kliknij w panelu Kompozycja"),
+    ("Falloff", "Zanikanie"),
+    ("Falloff Distance", "Odległość zanikania"),
+    ("Favorites", "Ulubione"),
+    ("Field Render: {}", "Renderowanie pól: {}"),
+    ("Figures", "Cyfry"),
+    ("Fill Target", "Cel wypełnienia"),
+    ("Finished", "Zakończono"),
+    ("Flowchart: {}", "Schemat: {}"),
+    ("Focus Distance", "Odległość ostrości"),
+    ("Follow Feature Rotation and Scale", "Podążaj za obrotem i skalą cechy"),
+    ("Footage: {}", "Materiał: {}"),
+    ("Format: {}", "Format: {}"),
+    ("Frame Aspect Ratio: {}", "Proporcje klatki: {}"),
+    ("Frame Blending: {}", "Mieszanie klatek: {}"),
+    ("Frame Rate:", "Liczba klatek na sekundę:"),
+    ("Frame Render Time  {}ms", "Czas renderowania klatki  {}ms"),
+    ("Frame Target:", "Cel klatki:"),
+    ("Freeze", "Zamroź"),
+    ("Grab bag", "Różności"),
+    ("Gradient Editor", "Edytor gradientu"),
+    ("Grid", "Siatka"),
+    ("Guide Layers: {}", "Warstwy pomocnicze: {}"),
+    ("Guides", "Linie pomocnicze"),
+    ("Height:", "Wysokość:"),
+    ("Hide This", "Ukryj to"),
+    ("Histogram", "Histogram"),
+    ("Hold In Place", "Zatrzymaj w miejscu"),
+    ("Home", "Start"),
+    ("If Confidence is Below", "Jeśli pewność jest poniżej"),
+    ("Import", "Importuj"),
+    ("Import and Add to Composition", "Importuj i dodaj do kompozycji"),
+    ("Import...", "Importuj..."),
+    ("Imported media", "Zaimportowane multimedia"),
+    ("Influence:", "Wpływ:"),
+    ("Install from File…", "Zainstaluj z pliku…"),
+    ("Intensity", "Natężenie"),
+    ("Inverted", "Odwrócone"),
+    ("Join the ArtCraft community on Discord", "Dołącz do społeczności ArtCraft na Discordzie"),
+    ("Key: {}", "Klawisz: {}"),
+    ("LEARN", "NAUKA"),
+    ("Label", "Etykieta"),
+    ("Label Colors and Names:", "Kolory i nazwy etykiet:"),
+    ("Label:", "Etykieta:"),
+    ("Latest auto-save: {}", "Ostatni autozapis: {}"),
+    ("Layer", "Warstwa"),
+    ("Layer controls", "Elementy sterujące warstwy"),
+    ("Layer:", "Warstwa:"),
+    ("Layer: {}", "Warstwa: {}"),
+    ("Learn", "Nauka"),
+    ("Leave all attributes in \"{}\"", "Zachowaj wszystkie atrybuty w „{}”"),
+    ("Licence: {}", "Licencja: {}"),
+    ("Ligatures", "Ligatury"),
+    ("Light", "Jasny"),
+    ("Light Theme", "Jasny motyw"),
+    ("Light Type", "Typ światła"),
+    ("Lighter", "Jaśniej"),
+    ("Link Selected Property", "Połącz zaznaczoną właściwość"),
+    ("Location:", "Lokalizacja:"),
+    ("Lock Aspect Ratio to {}", "Zablokuj proporcje na {}"),
+    ("Lock to Zoom", "Zablokuj do powiększenia"),
+    ("Locked: {} — {}", "Zablokowano: {} — {}"),
+    ("Log:", "Dziennik:"),
+    ("Loop (Trace Path)", "Pętla (śledź ścieżkę)"),
+    ("MIT OR Apache-2.0 • Fonts: Inter, JetBrains Mono (OFL)", "MIT OR Apache-2.0 • Czcionki: Inter, JetBrains Mono (OFL)"),
+    ("Magnification ratio popup", "Menu współczynnika powiększenia"),
+    ("Make Comp Size", "Ustaw rozmiar kompozycji"),
+    ("Markers", "Znaczniki"),
+    ("Masks", "Maski"),
+    ("Maximize Panel", "Maksymalizuj panel"),
+    ("Media Replacement", "Zamiana multimediów"),
+    ("Mesh:", "Siatka:"),
+    ("Diameter:", "Średnica:"),
+    ("Method Used: {}    Average Error: {} pixels", "Użyta metoda: {}    Średni błąd: {} px"),
+    ("Models folder: {}", "Folder modeli: {}"),
+    ("Modifiers:", "Modyfikatory:"),
+    ("More", "Więcej"),
+    ("More ArtCraft apps", "Więcej aplikacji ArtCraft"),
+    ("More tutorials", "Więcej samouczków"),
+    ("Motion Blur", "Rozmycie ruchu"),
+    ("Motion Blur: {}", "Rozmycie ruchu: {}"),
+    ("Motion Sketch: drag to record", "Szkic ruchu: przeciągnij, aby nagrać"),
+    ("Move Down", "Przesuń w dół"),
+    ("Move Up", "Przesuń w górę"),
+    ("Move to Project Root", "Przenieś do katalogu głównego projektu"),
+    ("Name", "Nazwa"),
+    ("Name:", "Nazwa:"),
+    ("Navigation", "Nawigacja"),
+    ("New", "Nowy"),
+    ("New Comp from Selection", "Nowa kompozycja z zaznaczenia"),
+    ("Replace with Precomposition", "Zastąp kompozycją wstępną"),
+    ("New Duration:", "Nowy czas trwania:"),
+    ("New composition name:", "Nazwa nowej kompozycji:"),
+    ("New from Render Queue item:", "Nowy z elementu kolejki renderowania:"),
+    ("New from Template", "Nowy z szablonu"),
+    ("Next", "Dalej"),
+    ("Nice work. Pick another tutorial on the Home screen's Learn tab.", "Dobra robota. Wybierz kolejny samouczek na karcie Nauka ekranu startowego."),
+    (
+        "No VR environments yet. Create one with Composition ▸ VR ▸ Create VR Environment…",
+        "Brak środowisk VR. Utwórz je poleceniem Kompozycja ▸ VR ▸ Utwórz środowisko VR…",
+    ),
+    ("No audio layer selected", "Nie zaznaczono warstwy audio"),
+    ("No background jobs running", "Brak zadań w tle"),
+    ("No composition markers", "Brak znaczników kompozycji"),
+    ("No contributor data was built into this copy.", "Ta kopia nie zawiera danych o współtwórcach."),
+    ("No device list from this host; the system default output is used.", "Ten system nie podaje listy urządzeń; używane jest domyślne wyjście systemowe."),
+    ("No layer selected", "Nie zaznaczono warstwy"),
+    ("No matching effects or presets", "Brak pasujących efektów lub ustawień"),
+    ("No matching fonts", "Brak pasujących czcionek"),
+    ("Variable fonts only", "Tylko czcionki zmienne"),
+    ("No model credits were built into this copy.", "Ta kopia nie zawiera informacji o modelach."),
+    ("No nested compositions", "Brak zagnieżdżonych kompozycji"),
+    ("No shortcut", "Brak skrótu"),
+    ("No unlocked layer selected", "Nie zaznaczono odblokowanej warstwy"),
+    ("No video", "Brak wideo"),
+    ("None", "Brak"),
+    ("Not applied: tick it in the list to add it.", "Niezastosowany: zaznacz go na liście, aby go dodać."),
+    ("Not assigned", "Nieprzypisany"),
+    ("Note: Shadows are only cast from layers with Cast Shadows enabled.", "Uwaga: cienie rzucają tylko warstwy z włączoną opcją Rzuca cienie."),
+    ("Notify", "Powiadom"),
+    ("OK", "OK"),
+    ("Offset:", "Przesunięcie:"),
+    ("On ({}) stop:", "Punkt na ({}):"),
+    ("One-Node Camera", "Kamera jednowęzłowa"),
+    ("Opacity:", "Krycie:"),
+    ("Open Composition", "Otwórz kompozycję"),
+    ("used once", "użyty raz"),
+    ("used {} times", "użycia: {}"),
+    ("Compositions that use this item", "Kompozycje, które używają tego elementu"),
+    ("Open Last Saved Project", "Otwórz ostatnio zapisany projekt"),
+    ("Open New Composition", "Otwórz nową kompozycję"),
+    ("Open Output", "Otwórz wynik"),
+    ("Open a composition to build Essential Graphics", "Otwórz kompozycję, aby zbudować Essential Graphics"),
+    ("Open a composition to see its scopes", "Otwórz kompozycję, aby zobaczyć jej zakresy"),
+    ("Open a composition to track motion.", "Otwórz kompozycję, aby śledzić ruch."),
+    ("Opus Tuning: {}", "Strojenie Opus: {}"),
+    ("Original Duration:", "Oryginalny czas trwania:"),
+    ("Output Cycle: {}", "Cykl wyjścia: {}"),
+    ("Output To:", "Wyjście do:"),
+    ("Overlay", "Nakładka"),
+    ("Parameter Name:", "Nazwa parametru:"),
+    ("Parent pick whip: drag onto a layer", "Łącznik rodzica: przeciągnij na warstwę"),
+    ("Pixel Aspect Ratio:", "Proporcje piksela:"),
+    ("Playing on Video Preview", "Odtwarzanie w podglądzie wideo"),
+    ("Post-Render Action: {}", "Akcja po renderowaniu: {}"),
+    ("Preserve frame rate when nested or in render queue", "Zachowaj liczbę klatek po zagnieżdżeniu lub w kolejce renderowania"),
+    ("Preserve resolution when nested", "Zachowaj rozdzielczość po zagnieżdżeniu"),
+    ("Preset", "Ustawienie"),
+    ("Preset:", "Ustawienie:"),
+    ("Presets", "Ustawienia"),
+    ("Previous", "Wstecz"),
+    ("Primary:", "Główny:"),
+    ("Process Before Match", "Przetwarzaj przed dopasowaniem"),
+    ("Profile: {}", "Profil: {}"),
+    (
+        "Project color depth: click to cycle 8/16/32 bpc, Alt-click for Project Settings",
+        "Głębia kolorów projektu: kliknij, aby przełączać 8/16/32 bpc, Alt-klik otwiera Ustawienia projektu",
+    ),
+    ("Project: {}", "Projekt: {}"),
+    ("Projects", "Projekty"),
+    ("Property pick whip: drag onto a property", "Łącznik właściwości: przeciągnij na właściwość"),
+    ("Protected Region", "Obszar chroniony"),
+    ("Proxy Use: {}", "Użycie proxy: {}"),
+    ("Push All to Comp", "Wypchnij wszystko do kompozycji"),
+    ("RGB", "RGB"),
+    ("Radius", "Promień"),
+    ("Rate Control: {}", "Kontrola przepływności: {}"),
+    ("Recent", "Ostatnie"),
+    ("Recording", "Nagrywanie"),
+    ("Remove", "Usuń"),
+    ("Rename", "Zmień nazwę"),
+    ("Render: {} ms  •  UI {} fps{}", "Renderowanie: {} ms  •  UI {} fps{}"),
+    ("Renderer:", "Renderer:"),
+    ("Request Persistent Storage", "Poproś o trwałą pamięć"),
+    ("Reset", "Resetuj"),
+    ("Reset Labels", "Resetuj etykiety"),
+    ("Reset Preset", "Resetuj ustawienie"),
+    ("Reset to Default", "Przywróć domyślne"),
+    ("Reset to Saved Layout", "Przywróć zapisany układ"),
+    ("Resolution/Down Sample Factor Popup", "Menu rozdzielczości/współczynnika próbkowania"),
+    ("Restore Panel Size", "Przywróć rozmiar panelu"),
+    ("Reverse the order", "Odwróć kolejność"),
+    ("Revert All", "Przywróć wszystko"),
+    ("Roman Hanging Punctuation", "Interpunkcja wisząca (łacińska)"),
+    ("Roving:", "Wędrujące:"),
+    ("Ruler zero point (drag to move, double-click to reset)", "Punkt zerowy linijki (przeciągnij, aby przesunąć, kliknij dwukrotnie, aby zresetować)"),
+    ("Rulers", "Linijki"),
+    ("Run", "Uruchom"),
+    ("Sample Format: {}", "Format próbek: {}"),
+    ("Samples Per Frame:", "Próbek na klatkę:"),
+    ("Save from #{}", "Zapisz od #{}"),
+    ("Saved {}", "Zapisano {}"),
+    ("Script… (⌘/Ctrl+Enter runs)", "Skrypt… (⌘/Ctrl+Enter uruchamia)"),
+    ("Search commands or shortcuts", "Szukaj poleceń lub skrótów"),
+    ("Select", "Zaznacz"),
+    ("Select a command to change its shortcut.", "Zaznacz polecenie, aby zmienić jego skrót."),
+    ("Select a layer to see its effects", "Zaznacz warstwę, aby zobaczyć jej efekty"),
+    ("Select a layer to see its properties", "Zaznacz warstwę, aby zobaczyć jej właściwości"),
+    ("({}) Selected Objects", "Zaznaczone obiekty ({})"),
+    (
+        "Select a layer with a mask or shape path (or the path property), or Puppet pins.",
+        "Zaznacz warstwę z maską lub ścieżką kształtu (albo właściwość ścieżki) lub pinezki Puppet.",
+    ),
+    ("Select a text layer", "Zaznacz warstwę tekstową"),
+    ("Select an item in the Project panel", "Zaznacz element w panelu Projekt"),
+    ("Select animated properties to show them in the Graph Editor", "Zaznacz animowane właściwości, aby pokazać je w edytorze wykresów"),
+    (
+        "Select the leader pin, then Shift-click the pins that should trail it (hair, cloth, tails)",
+        "Zaznacz pinezkę prowadzącą, a potem Shift-kliknij pinezki, które mają za nią podążać (włosy, tkanina, ogony)",
+    ),
+    ("Set Ground Plane and Origin", "Ustaw płaszczyznę podłoża i początek układu"),
+    ("Set Paint Colors to Black and White (D)", "Ustaw kolory malowania na czarny i biały (D)"),
+    ("Settings", "Ustawienia"),
+    ("Settings Name:", "Nazwa ustawień:"),
+    ("Shadow Darkness", "Ciemność cienia"),
+    ("Shadow Diffusion", "Rozproszenie cienia"),
+    ("Shadows", "Cienie"),
+    ("Shape…", "Kształt…"),
+    ("Show", "Pokaż"),
+    ("Show Layer Name", "Pokaż nazwę warstwy"),
+    ("Show Source Name", "Pokaż nazwę źródła"),
+    ("Show me", "Pokaż mi"),
+    ("Show:", "Pokaż:"),
+    ("Shutter Angle:", "Kąt migawki:"),
+    ("Shutter Phase:", "Faza migawki:"),
+    ("Size", "Rozmiar"),
+    ("Skip", "Pomiń"),
+    ("Snapping", "Przyciąganie"),
+    ("Snapping options", "Opcje przyciągania"),
+    ("Snapshot", "Migawka"),
+    ("Solo Supported Properties", "Solo dla obsługiwanych właściwości"),
+    ("Solo Switches: {}", "Przełączniki solo: {}"),
+    ("Sort", "Sortuj"),
+    ("Spacing:", "Odstęp:"),
+    ("Spatial Interpolation:", "Interpolacja przestrzenna:"),
+    ("Speed:", "Szybkość:"),
+    ("Start Timecode:", "Początkowy kod czasowy:"),
+    ("Start: {}   Duration: {}", "Początek: {}   Czas trwania: {}"),
+    ("Step {} of {}: {}", "Krok {} z {}: {}"),
+    ("Stop", "Zatrzymaj"),
+    ("Stop {} at {}°", "Punkt {} na {}°"),
+    ("Stored in: {}", "Przechowywane w: {}"),
+    ("Stretch", "Rozciągnij"),
+    ("Stretch Factor:", "Współczynnik rozciągnięcia:"),
+    ("Stylistic Sets", "Zestawy stylistyczne"),
+    ("Subpixel Positioning", "Pozycjonowanie podpikselowe"),
+    ("Swap Colors", "Zamień kolory"),
+    ("Swap Paint Colors (X)", "Zamień kolory malowania (X)"),
+    ("Sync with System", "Synchronizuj z systemem"),
+    ("System Default", "Domyślne systemowe"),
+    ("Table", "Tabela"),
+    ("Template name", "Nazwa szablonu"),
+    ("Template: {}\n{}", "Szablon: {}\n{}"),
+    ("Temporal Interpolation:", "Interpolacja czasowa:"),
+    ("The Media Browser is not available here (use File ▸ Import)", "Przeglądarka multimediów nie jest tu dostępna (użyj Plik ▸ Importuj)"),
+    ("The OpenEXR layer shown in red, green, blue and alpha", "Warstwa OpenEXR pokazana w kanałach czerwonym, zielonym, niebieskim i alfa"),
+    ("The render queue is empty.", "Kolejka renderowania jest pusta."),
+    (
+        "These adjacent keyframes cannot interpolate because their stop counts differ.",
+        "Te sąsiednie klatki kluczowe nie mogą być interpolowane, bo mają różną liczbę punktów.",
+    ),
+    ("This ScriptUI panel has closed", "Ten panel ScriptUI został zamknięty"),
+    ("This change will create a new solid for this layer.", "Ta zmiana utworzy nową planszę dla tej warstwy."),
+    ("Time", "Czas"),
+    ("Time Stretch…", "Rozciągnięcie czasu…"),
+    ("Time:", "Czas:"),
+    ("Time: {}", "Czas: {}"),
+    ("Title/Action Safe", "Obszar bezpieczny tytułów/akcji"),
+    ("Title/action safe", "Obszar bezpieczny tytułów/akcji"),
+    ("Toggle Switches / Modes", "Przełącz przełączniki / tryby"),
+    ("Track Name:", "Nazwa ścieżki:"),
+    (
+        "Trained models are available in the desktop app; the browser uses the classic engine.",
+        "Wytrenowane modele są dostępne w aplikacji desktopowej; przeglądarka używa klasycznego silnika.",
+    ),
+    ("Transform", "Przekształć"),
+    ("Transparency grid", "Siatka przezroczystości"),
+    ("Tutorial complete", "Samouczek ukończony"),
+    ("Two-Node Camera", "Kamera dwuwęzłowa"),
+    ("Type", "Typ"),
+    ("Type a command or effect…", "Wpisz polecenie lub efekt…"),
+    ("URL:", "URL:"),
+    ("Undock Panel", "Odepnij panel"),
+    ("Move Panel to New Window", "Przenieś panel do nowego okna"),
+    ("Move Panel to Main Window", "Przenieś panel do głównego okna"),
+    ("Unfreeze", "Odmroź"),
+    ("Unlink {}", "Odłącz {}"),
+    (
+        "Use this option to place the currently selected layers together into a new intermediate composition.",
+        "Użyj tej opcji, aby umieścić zaznaczone warstwy razem w nowej kompozycji pośredniej.",
+    ),
+    ("VR Environments", "Środowiska VR"),
+    ("Value:", "Wartość:"),
+    ("Variable Font Axes", "Osie czcionki zmiennej"),
+    ("Video Codec: {}", "Kodek wideo: {}"),
+    ("View:", "Widok:"),
+    ("Welcome to EffectCraft", "Witaj w EffectCraft"),
+    ("Width:", "Szerokość:"),
+    ("You can undo this.", "Można to cofnąć."),
+    ("You can't undo this.", "Tego nie można cofnąć."),
+    ("Your changes will be lost if you don't save them.", "Jeśli nie zapiszesz zmian, zostaną utracone."),
+    ("Zoom", "Powiększenie"),
+    ("built-in", "wbudowany"),
+    ("frames per second", "klatek na sekundę"),
+    ("template name", "nazwa szablonu"),
+    ("{} contributors · {} commits", "Współtwórcy: {} · commity: {}"),
+    ("{} x {}, {}MB per 8bpc frame", "{} x {}, {} MB na klatkę 8 bpc"),
+    ("{} — coming soon", "{} — wkrótce"),
+    ("{} — double-click to open, {}-click to reveal", "{} — kliknij dwukrotnie, aby otworzyć, {}-klik, aby pokazać w folderze"),
+    ("⌘/Ctrl-drag a pin to record its motion", "⌘/Ctrl-przeciągnij pinezkę, aby nagrać jej ruch"),
+    ("▣ {}", "▣ {}"),
+    ("⚠ {} is used by:", "⚠ {} jest używany przez:"),
+    ("3D Reference Axes", "Osie odniesienia 3D"),
+    ("Affect all layers that use this solid", "Dotyczy wszystkich warstw używających tej planszy"),
+    ("Choose grid and guide options", "Wybierz opcje siatki i linii pomocniczych"),
+    ("Colorize", "Koloryzuj"),
+    ("Custom", "Niestandardowe"),
+    ("Custom...", "Niestandardowe..."),
+    ("Fit", "Dopasuj"),
+    ("Fit up to 100%", "Dopasuj do 100%"),
+    ("Full", "Pełna"),
+    ("Half", "Połowa"),
+    ("Only this layer uses this solid.", "Tylko ta warstwa używa tej planszy."),
+    ("Proportional Grid", "Siatka proporcjonalna"),
+    ("Quarter", "Jedna czwarta"),
+    ("Region of Interest", "Obszar zainteresowania"),
+    ("Reset Exposure", "Resetuj ekspozycję"),
+    ("Show Channel and Color Management Settings", "Pokaż ustawienia kanałów i zarządzania kolorem"),
+    ("Show Snapshot (hold)", "Pokaż migawkę (przytrzymaj)"),
+    ("Take Snapshot", "Zrób migawkę"),
+    ("Third", "Jedna trzecia"),
+    ("Toggle Mask and Shape Path Visibility", "Przełącz widoczność ścieżek masek i kształtów"),
+    ("Toggle Transparency Grid", "Przełącz siatkę przezroczystości"),
+    ("16 bits per channel", "16 bitów na kanał"),
+    ("32 bits per channel (float)", "32 bity na kanał (zmiennoprzecinkowe)"),
+    ("8 bits per channel", "8 bitów na kanał"),
+    ("Adaptive Resolution", "Rozdzielczość adaptacyjna"),
+    ("Adobe-style built-in", "Wbudowany w stylu Adobe"),
+    ("Blue", "Niebieski"),
+    ("Current Settings", "Bieżące ustawienia"),
+    ("Disable Per-character 3D", "Wyłącz 3D dla każdego znaku"),
+    ("Draft", "Robocza"),
+    ("Enable Per-character 3D", "Włącz 3D dla każdego znaku"),
+    ("Fast Draft", "Szybka robocza"),
+    ("Fast Previews (Draft 3D, Faster Effects)", "Szybkie podglądy (robocze 3D, szybsze efekty)"),
+    ("Green", "Zielony"),
+    ("Import Image Sequence", "Importuj sekwencję obrazów"),
+    ("Import PDF / Illustrator File", "Importuj plik PDF / Illustrator"),
+    ("Import Photoshop File", "Importuj plik Photoshopa"),
+    ("Interpret Unlabeled Alpha As", "Interpretuj nieoznaczoną alfę jako"),
+    ("Join the ArtCraft Discord", "Dołącz do Discorda ArtCraft"),
+    ("GPU Acceleration ({})", "Akceleracja GPU ({})"),
+    ("Software Rendering", "Renderowanie programowe"),
+    ("OCIO (built-in ACES config)", "OCIO (wbudowana konfiguracja ACES)"),
+    ("Off (Final Quality)", "Wył. (jakość końcowa)"),
+    ("OpenGL (compatibility)", "OpenGL (zgodność)"),
+    ("Opus Bitrate: {} kbps", "Przepływność Opus: {} kb/s"),
+    ("RGB Straight", "RGB proste"),
+    ("Red", "Czerwony"),
+    ("Tone map", "Mapowanie tonów"),
+    ("Use In-Window Menu Bar on macOS", "Używaj paska menu w oknie w macOS"),
+    ("Wireframe", "Szkielet"),
+    ("sRGB IEC61966-2.1 (default)", "sRGB IEC61966-2.1 (domyślny)"),
+    ("New Project", "Nowy projekt"),
+    ("Open Project…", "Otwórz projekt…"),
+    ("Templates", "Szablony"),
+    ("EffectCraft home page", "Strona główna EffectCraft"),
+    ("EffectCraft on GitHub", "EffectCraft w serwisie GitHub"),
+    ("Motion graphics and visual effects · version {}", "Grafika ruchoma i efekty wizualne · wersja {}"),
+    ("New Composition", "Nowa kompozycja"),
+    ("Open Demo Project", "Otwórz projekt demonstracyjny"),
+    ("Import Footage…", "Importuj materiał…"),
+    ("Filter recent files", "Filtruj ostatnie pliki"),
+    ("NAME", "NAZWA"),
+    ("OPENED", "OTWARTY"),
+    ("SIZE", "ROZMIAR"),
+    ("KIND", "RODZAJ"),
+    ("Your recent files will show here", "Tu pojawią się ostatnie pliki"),
+    ("Create a new project, or open the demo project to look around.", "Utwórz nowy projekt albo otwórz projekt demonstracyjny, aby się rozejrzeć."),
+    ("No recent files match the filter", "Żaden ostatni plik nie pasuje do filtra"),
+    ("Try another name or folder.", "Spróbuj innej nazwy lub folderu."),
+    ("Just now", "Przed chwilą"),
+    ("Yesterday", "Wczoraj"),
+    ("{} minute ago", "{} minutę temu"),
+    ("{} minutes ago", "{} min temu"),
+    ("{} hour ago", "{} godzinę temu"),
+    ("{} hours ago", "{} godz. temu"),
+    ("{} day ago", "{} dzień temu"),
+    ("{} days ago", "{} dni temu"),
+    ("EffectCraft project", "Projekt EffectCraft"),
+    ("After Effects project", "Projekt After Effects"),
+    ("Lottie animation", "Animacja Lottie"),
+    ("Project", "Projekt"),
+    ("General", "Ogólne"),
+    ("Language", "Język"),
+    ("Levels of Undo", "Poziomy cofania"),
+    ("Path Point and Handle Size", "Rozmiar punktów i uchwytów ścieżki"),
+    ("Recent Projects Shown", "Liczba wyświetlanych ostatnich projektów"),
+    ("Options", "Opcje"),
+    ("Show Tool Tips", "Pokazuj podpowiedzi"),
+    ("Create Layers at Composition Start Time", "Twórz warstwy w czasie początku kompozycji"),
+    ("Switches Affect Nested Comps", "Przełączniki wpływają na zagnieżdżone kompozycje"),
+    ("Default Spatial Interpolation to Linear", "Domyślna interpolacja przestrzenna liniowa"),
+    ("Preserve Constant Vertex and Feather Point Count when Editing Masks", "Zachowaj stałą liczbę wierzchołków i punktów wtapiania podczas edycji masek"),
+    ("Synchronize Time of All Related Items", "Synchronizuj czas wszystkich powiązanych elementów"),
+    ("Expression Pick Whip Writes Compact English", "Łącznik wyrażeń zapisuje zwięzły angielski"),
+    ("Create Split Layers Above Original Layer", "Twórz podzielone warstwy nad oryginalną warstwą"),
+    ("Use System Color Picker", "Używaj systemowego próbnika kolorów"),
+    (
+        "EffectCraft always uses its own colour picker (the same on every platform and the web).",
+        "EffectCraft zawsze używa własnego próbnika kolorów (takiego samego na każdej platformie i w przeglądarce).",
+    ),
+    ("Startup & Repair", "Uruchamianie i naprawa"),
+    ("Show Home Screen When Launching", "Pokazuj ekran startowy przy uruchamianiu"),
+    ("Show Home Screen When Opening a Project", "Pokazuj ekran startowy przy otwieraniu projektu"),
+    ("Offer to Open the Latest Auto-Save After a Crash", "Proponuj otwarcie ostatniego autozapisu po awarii"),
+    ("Window Graphics", "Grafika okna"),
+    ("Automatic", "Automatycznie"),
+    (
+        "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
+        "Grafika okna obowiązuje od następnego uruchomienia. Gdy sterownik graficzny zatrzyma EffectCraft przy otwieraniu okna, następne uruchomienie przełączy się na OpenGL.",
+    ),
+    ("Repair", "Naprawa"),
+    ("Reset Settings", "Resetuj ustawienia"),
+    ("Reset Keyboard Shortcuts", "Resetuj skróty klawiaturowe"),
+    ("Empty Disk Cache", "Opróżnij pamięć dyskową"),
+    ("New Project Loads Template", "Nowy projekt wczytuje szablon"),
+    ("Template Project", "Projekt szablonu"),
+    ("Auto-Save", "Autozapis"),
+    ("Automatically Save Projects", "Automatycznie zapisuj projekty"),
+    ("Save Every", "Zapisuj co"),
+    ("Minutes", "min"),
+    ("Maximum Project Versions", "Maksymalna liczba wersji projektu"),
+    ("Auto-Save Location", "Lokalizacja autozapisu"),
+    ("Next to Project", "Obok projektu"),
+    ("Custom Location", "Lokalizacja niestandardowa"),
+    ("Save When Starting Render Queue", "Zapisuj przy uruchamianiu kolejki renderowania"),
+    ("Save Now", "Zapisz teraz"),
+    ("Motion Path", "Ścieżka ruchu"),
+    ("All Keyframes", "Wszystkie klatki kluczowe"),
+    ("No Motion Path", "Bez ścieżki ruchu"),
+    ("No More Than (Seconds)", "Nie więcej niż (sekundy)"),
+    ("No More Than (Keyframes)", "Nie więcej niż (klatki kluczowe)"),
+    ("Seconds", "s"),
+    ("Keyframes", "Klatki kluczowe"),
+    ("Display", "Wyświetlanie"),
+    ("Show Rendering Progress in Info Panel and Flowchart", "Pokazuj postęp renderowania w panelu Informacje i schemacie"),
+    ("Hardware Accelerate Composition, Layer and Footage Panels", "Akceleracja sprzętowa paneli Kompozycja, Warstwa i Materiał"),
+    ("Panels are always drawn by the GPU (wgpu).", "Panele są zawsze rysowane przez GPU (wgpu)."),
+    ("Previews", "Podglądy"),
+    ("Adaptive Resolution Limit", "Limit rozdzielczości adaptacyjnej"),
+    ("Show Internal Wireframes", "Pokazuj wewnętrzne szkielety"),
+    ("Cache Frames When Idle", "Buforuj klatki w bezczynności"),
+    ("Viewer Zoom Quality", "Jakość powiększenia przeglądarki"),
+    ("Faster", "Szybciej"),
+    ("More Accurate", "Dokładniej"),
+    ("Display Color Space", "Przestrzeń kolorów wyświetlacza"),
+    ("GPU Information...", "Informacje o GPU..."),
+    ("Appearance", "Wygląd"),
+    ("Brightness", "Jasność"),
+    ("UI Scale", "Skala interfejsu"),
+    ("Labels and Colors", "Etykiety i kolory"),
+    ("Use Label Color for Layer Handles and Paths", "Używaj koloru etykiety dla uchwytów i ścieżek warstw"),
+    ("Use Label Color for Related Tabs", "Używaj koloru etykiety dla powiązanych kart"),
+    ("Cycle Mask Colors", "Zmieniaj kolejno kolory masek"),
+    ("Use Gradients", "Używaj gradientów"),
+    ("Menu Bar", "Pasek menu"),
+    ("Grids & Guides", "Siatki i linie pomocnicze"),
+    ("Gridline Every", "Linia siatki co"),
+    ("Subdivisions", "Podpodziały"),
+    ("Style", "Styl"),
+    ("Lines", "Linie"),
+    ("Dashed Lines", "Linie przerywane"),
+    ("Dots", "Kropki"),
+    ("Horizontal", "Poziomo"),
+    ("Vertical", "Pionowo"),
+    ("Safe Margins", "Marginesy bezpieczne"),
+    ("Action-safe", "Bezpieczny dla akcji"),
+    ("Title-safe", "Bezpieczny dla tytułów"),
+    ("Labels", "Etykiety"),
+    ("Text Engine", "Silnik tekstu"),
+    ("Latin", "Łaciński"),
+    ("South Asian and Middle Eastern", "Południowoazjatycki i bliskowschodni"),
+    ("Show Font Preview", "Pokazuj podgląd czcionki"),
+    ("Number of Recent Fonts to Display", "Liczba wyświetlanych ostatnich czcionek"),
+    ("Show Font Names in English", "Pokazuj nazwy czcionek po angielsku"),
+    ("Still Footage", "Materiał nieruchomy"),
+    ("Length of Composition", "Długość kompozycji"),
+    ("Duration (Seconds)", "Czas trwania (sekundy)"),
+    ("Still Duration", "Czas trwania obrazu"),
+    ("Sequence Footage", "Materiał sekwencyjny"),
+    ("Report Missing Frames", "Zgłaszaj brakujące klatki"),
+    ("Automatically Reload Footage", "Automatycznie wczytuj ponownie materiał"),
+    ("Off", "Wył."),
+    ("Non-Sequence Footage", "Materiał niesekwencyjny"),
+    ("All Footage", "Wszystkie materiały"),
+    ("Ask User", "Pytaj użytkownika"),
+    ("Guess", "Zgadnij"),
+    ("Ignore", "Ignoruj"),
+    ("Straight", "Prosta"),
+    ("Premultiplied", "Wstępnie mnożona"),
+    ("Default Drag Import As", "Domyślny import przeciągnięciem jako"),
+    ("Footage", "Materiał"),
+    ("Composition - Retain Layer Sizes", "Kompozycja – zachowaj rozmiary warstw"),
+    ("Export", "Eksport"),
+    ("Default Output Folder", "Domyślny folder wyjściowy"),
+    ("Segment Sequences", "Dziel sekwencje na segmenty"),
+    ("Files per Segment", "Pliki na segment"),
+    ("files", "pliki"),
+    ("Segment Movie Files", "Dziel pliki filmowe na segmenty"),
+    ("Segment Size", "Rozmiar segmentu"),
+    ("Append Bit Depth to File Name", "Dodawaj głębię bitową do nazwy pliku"),
+    ("Audio", "Audio"),
+    ("Audio Hardware", "Sprzęt audio"),
+    ("Preview Sample Rate", "Częstotliwość próbkowania podglądu"),
+    ("Audio Output Mapping", "Mapowanie wyjść audio"),
+    ("Left", "Lewy"),
+    ("Right", "Prawy"),
+    ("channel", "kanał"),
+    ("Disk", "Dysk"),
+    ("Disk Cache", "Pamięć dyskowa"),
+    ("Enable Disk Cache", "Włącz pamięć dyskową"),
+    ("Maximum Disk Cache Size", "Maksymalny rozmiar pamięci dyskowej"),
+    ("Disk Cache Folder", "Folder pamięci dyskowej"),
+    ("Media Cache", "Pamięć multimediów"),
+    ("Database and Cache Folder", "Folder bazy danych i pamięci"),
+    ("Conformed Audio Folder", "Folder dopasowanego audio"),
+    ("Memory & CPU", "Pamięć i procesor"),
+    ("RAM Reserved for Other Applications", "Pamięć RAM zarezerwowana dla innych aplikacji"),
+    ("Cache Budgets", "Budżety pamięci podręcznej"),
+    ("Layer Cache", "Pamięć warstw"),
+    ("Footage Frame Cache", "Pamięć klatek materiałów"),
+    ("Preview (RAM) Cache", "Pamięć podglądu (RAM)"),
+    ("Reduce Cache Size When System Is Low on Memory", "Zmniejsz pamięć podręczną, gdy w systemie brakuje pamięci"),
+    ("Video", "Wideo"),
+    ("Enable Video Preview Output", "Włącz wyjście podglądu wideo"),
+    ("Video Device", "Urządzenie wideo"),
+    ("Floating Window", "Okno pływające"),
+    ("Full Screen", "Pełny ekran"),
+    ("Video Output During Playback", "Wyjście wideo podczas odtwarzania"),
+    ("Mirror on Computer Monitor", "Powielaj na monitorze komputera"),
+    ("Disable Video Output When in Background", "Wyłącz wyjście wideo w tle"),
+    ("Default 3D Renderer", "Domyślny renderer 3D"),
+    ("Show 3D Reference Axes", "Pokazuj osie odniesienia 3D"),
+    ("Extended Viewer", "Rozszerzona przeglądarka"),
+    ("Realtime Shadows in Draft", "Cienie w czasie rzeczywistym w trybie roboczym"),
+    ("Scripting & Expressions", "Skrypty i wyrażenia"),
+    ("Application Scripting", "Skrypty aplikacji"),
+    ("Allow Scripts to Write Files and Access Network", "Zezwalaj skryptom na zapis plików i dostęp do sieci"),
+    ("Warn User When Executing Files", "Ostrzegaj przy uruchamianiu plików"),
+    ("Enable JavaScript Debugger", "Włącz debuger JavaScript"),
+    ("Expressions Editor", "Edytor wyrażeń"),
+    ("Font Size", "Rozmiar czcionki"),
+    ("Syntax Highlighting", "Podświetlanie składni"),
+    ("Line Numbers", "Numery wierszy"),
+    ("Auto-complete", "Autouzupełnianie"),
+    ("Bracket Matching", "Dopasowywanie nawiasów"),
+    ("Word Wrap", "Zawijanie wierszy"),
+    ("Show Expression Error Banner", "Pokazuj pasek błędów wyrażeń"),
+    (
+        "Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger.",
+        "Wyrażenia używają silnika JavaScript. Błędy skryptów podają plik i wiersz w konsoli skryptów; nie ma debugera krokowego.",
+    ),
+    ("Roto Brush", "Pędzel Roto"),
+    ("Segmentation Model", "Model segmentacji"),
+    (
+        "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Pędzel Roto 2.0 i 3.0 używa wybranego tu modelu (wersja 1.0 zawsze używa klasycznego silnika). Modele są open source, pobierane tylko na Twoje żądanie i sprawdzane z opublikowanym SHA-256.",
+    ),
+    ("Face Tracking", "Śledzenie twarzy"),
+    ("Face Model", "Model twarzy"),
+    (
+        "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Śledzenie twarzy w panelu Śledzenie (tylko kontur i szczegółowe cechy) używa wybranego tu modelu. Modele są open source, pobierane tylko na Twoje żądanie i sprawdzane z opublikowanym SHA-256.",
+    ),
+    ("Match System", "Zgodnie z systemem"),
+    ("Default", "Domyślny"),
+    ("Stored, but not used by EffectCraft yet", "Zapisane, ale jeszcze nieużywane przez EffectCraft"),
+    ("Total Offset", "Całkowite przesunięcie"),
+    ("Per Layer", "Na warstwę"),
+    ("Track", "Ścieżka"),
+    ("Copy", "Kopiuj"),
+    ("Paste", "Wklej"),
+    ("Edit Value…", "Edytuj wartość…"),
+    ("Remove Expression", "Usuń wyrażenie"),
+    ("Effects", "Efekty"),
+    ("Copy Source Path", "Kopiuj ścieżkę źródła"),
+    ("Resolution:", "Rozdzielczość:"),
+    ("Guide Layer", "Warstwa pomocnicza"),
+    ("Layer Styles", "Style warstwy"),
+    ("Video Scopes", "Wskaźniki wideo"),
+    ("GPU Acceleration (no GPU: software)", "Akceleracja GPU (bez GPU: programowa)"),
 ];
 
 /// Czech (cs): original translations covering every row in the Chinese panel catalogs.
 const CZECH: &[(&str, &str)] = &[
+    ("Click to sample color", "Kliknutím naberete barvu"),
     ("   OK   ", "   OK   "),
     ("  Delete  ", "  Odstranit  "),
     (" Open Auto-Save ", " Otevřít automatickou zálohu "),
@@ -3383,8 +6937,14 @@ const CZECH: &[(&str, &str)] = &[
     ("Browser Storage", "Úložiště prohlížeče"),
     ("Browse…", "Procházet…"),
     ("Brush Dynamics", "Dynamika štětce"),
-    ("Caching frames…", "Ukládání snímků do mezipaměti…"),
+    ("Caching frames", "Ukládání snímků do mezipaměti"),
     ("Cancel", "Zrušit"),
+    ("Import After Effects Project", "Importovat projekt After Effects"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Některé části tohoto projektu nelze importovat přesně (budou vynechány nebo změněny):",
+    ),
+    ("Import Anyway", "Přesto importovat"),
     ("Casts Shadows", "Vrhat stíny"),
     ("Change Renderer…", "Změnit vykreslovací modul…"),
     (
@@ -3464,13 +7024,16 @@ const CZECH: &[(&str, &str)] = &[
     ("Duration:", "Délka trvání:"),
     ("Edit Gradient…", "Upravit přechod…"),
     ("Edit Target: {}", "Upravit cíl: {}"),
-    ("Edit in the Timeline", "Upravit na časové ose"),
     ("EffectCraft didn't quit normally last time.", "EffectCraft nebyl při posledním použití ukončen běžným způsobem."),
     ("Effects", "Efekty"),
     ("Effects & Presets options", "Možnosti efektů a přednastavení"),
     ("Copy Presets Folder Path", "Kopírovat cestu ke složce přednastavení"),
     ("Copy Source Path", "Kopírovat cestu ke zdroji"),
     ("Effects: {}", "Efekty: {}"),
+    ("EXR Bit Depth: {}", "Bitová hloubka EXR: {}"),
+    ("EXR Compression: {}", "Komprese EXR: {}"),
+    ("EXR Compression: {} (lossy)", "Komprese EXR: {} (ztrátová)"),
+    ("EXR Compression: {} (uncompressed at float)", "Komprese EXR: {} (u float bez komprese)"),
     ("Empty folder", "Prázdná složka"),
     ("Enable Depth of Field", "Povolit hloubku ostrosti"),
     ("Enable Expression", "Povolit výraz"),
@@ -3498,6 +7061,7 @@ const CZECH: &[(&str, &str)] = &[
     ("Frame Aspect Ratio: {}", "Poměr stran snímku: {}"),
     ("Frame Blending: {}", "Prolnutí snímků: {}"),
     ("Frame Rate:", "Snímková frekvence:"),
+    ("Resolution:", "Rozlišení:"),
     ("Frame Render Time  {}ms", "Čas vykreslení snímku  {}ms"),
     ("Frame Target:", "Cílový rámec:"),
     ("Freeze", "Zmrazit"),
@@ -3529,7 +7093,6 @@ const CZECH: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "Nejnovější automatická záloha: {}"),
     ("Layer", "Vrstva"),
     ("Layer controls", "Ovládací prvky vrstvy"),
-    ("Layer {}", "Vrstva {}"),
     ("Layer:", "Vrstva:"),
     ("Layer: {}", "Vrstva: {}"),
     ("Layer Styles", "Styly vrstvy"),
@@ -3574,6 +7137,7 @@ const CZECH: &[(&str, &str)] = &[
     ("New", "Nový"),
     ("New Comp from Selection", "Nová kompozice z výběru"),
     ("Replace with Precomposition", "Nahradit předkompozicí"),
+    ("Rescan Fonts", "Znovu nalézt písma"),
     ("used once", "použito jednou"),
     ("used {} times", "použito {}×"),
     ("Compositions that use this item", "Kompozice, které tuto položku používají"),
@@ -3624,6 +7188,7 @@ const CZECH: &[(&str, &str)] = &[
     ("Overlay", "Překrytí"),
     ("Parameter Name:", "Název parametru:"),
     ("Parent pick whip: drag onto a layer", "Propojovací nástroj nadřazené vrstvy: přetáhněte na vrstvu"),
+    ("Track Matte pick whip: drag onto a layer", "Propojovací nástroj masky stopy: přetáhněte na vrstvu"),
     ("Pixel Aspect Ratio:", "Poměr stran pixelů:"),
     ("Playing on Video Preview", "Přehrávání ve videonáhledu"),
     ("Post-Render Action: {}", "Akce po vykreslení: {}"),
@@ -3826,8 +7391,8 @@ const CZECH: &[(&str, &str)] = &[
     ("Import Photoshop File", "Importovat soubor Photoshop"),
     ("Interpret Unlabeled Alpha As", "Interpretovat neoznačenou alfu jako"),
     ("Join the ArtCraft Discord", "Připojit se na Discord ArtCraft"),
-    ("Mercury GPU Acceleration ({})", "GPU akcelerace Mercury ({})"),
-    ("Mercury Software Only", "Pouze softwarové zpracování Mercury"),
+    ("GPU Acceleration ({})", "Akcelerace GPU ({})"),
+    ("Software Rendering", "Softwarové vykreslování"),
     ("OCIO (built-in ACES config)", "OCIO (vestavěná konfigurace ACES)"),
     ("Off (Final Quality)", "Vypnuto (finální kvalita)"),
     ("OpenGL (compatibility)", "OpenGL (kompatibilita)"),
@@ -3878,12 +7443,15 @@ const CZECH: &[(&str, &str)] = &[
     ("Variable fonts only", "Jen proměnná písma"),
     ("Total Offset", "Celkový posun"),
     ("Per Layer", "Na vrstvu"),
+    ("Video Scopes", "Videoskopy"),
+    ("GPU Acceleration (no GPU: software)", "Akcelerace GPU (bez GPU: software)"),
 ];
 
 /// Spanish: neutral, tú, sentence case; the same source strings as the Chinese catalogs, in the same
 /// order. Terms follow the Spanish menu catalog (composición, material de archivo, cola de procesamiento,
 /// ajuste preestablecido, método abreviado). Written from the English source.
 const SPANISH: &[(&str, &str)] = &[
+    ("Click to sample color", "Haz clic para tomar una muestra de color"),
     ("Copy Source Path", "Copiar ruta de origen"),
     ("Appearance Settings…", "Ajustes de apariencia…"),
     ("Add to favorites", "Añadir a favoritos"),
@@ -3944,8 +7512,14 @@ const SPANISH: &[(&str, &str)] = &[
     ("Browser Storage", "Almacenamiento del navegador"),
     ("Browse…", "Examinar…"),
     ("Brush Dynamics", "Dinámica del pincel"),
-    ("Caching frames…", "Almacenando fotogramas en caché…"),
+    ("Caching frames", "Almacenando fotogramas en caché"),
     ("Cancel", "Cancelar"),
+    ("Import After Effects Project", "Importar proyecto de After Effects"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Algunas partes de este proyecto no se pueden importar con exactitud (se omiten o cambian):",
+    ),
+    ("Import Anyway", "Importar de todos modos"),
     ("Casts Shadows", "Proyecta sombras"),
     ("Change Renderer…", "Cambiar motor de procesamiento…"),
     (
@@ -4029,11 +7603,14 @@ const SPANISH: &[(&str, &str)] = &[
     ("Duration:", "Duración:"),
     ("Edit Gradient…", "Editar degradado…"),
     ("Edit Target: {}", "Destino de la edición: {}"),
-    ("Edit in the Timeline", "Editar en la cronología"),
     ("EffectCraft didn't quit normally last time.", "EffectCraft no se cerró normalmente la última vez."),
     ("Effects", "Efectos"),
     ("Effects & Presets options", "Opciones de Efectos y ajustes preestablecidos"),
     ("Effects: {}", "Efectos: {}"),
+    ("EXR Bit Depth: {}", "Profundidad de bits EXR: {}"),
+    ("EXR Compression: {}", "Compresión EXR: {}"),
+    ("EXR Compression: {} (lossy)", "Compresión EXR: {} (con pérdida)"),
+    ("EXR Compression: {} (uncompressed at float)", "Compresión EXR: {} (sin compresión en float)"),
     ("Empty folder", "Carpeta vacía"),
     ("Enable Depth of Field", "Habilitar profundidad de campo"),
     ("Enable Expression", "Habilitar expresión"),
@@ -4061,6 +7638,7 @@ const SPANISH: &[(&str, &str)] = &[
     ("Frame Aspect Ratio: {}", "Relación de aspecto del fotograma: {}"),
     ("Frame Blending: {}", "Fusión de fotogramas: {}"),
     ("Frame Rate:", "Velocidad de fotogramas:"),
+    ("Resolution:", "Resolución:"),
     ("Frame Render Time  {}ms", "Tiempo de procesamiento del fotograma  {}ms"),
     ("Frame Target:", "Marco de destino:"),
     ("Freeze", "Congelar"),
@@ -4092,7 +7670,6 @@ const SPANISH: &[(&str, &str)] = &[
     ("Latest auto-save: {}", "Último guardado automático: {}"),
     ("Layer", "Capa"),
     ("Layer controls", "Controles de capa"),
-    ("Layer {}", "Capa {}"),
     ("Layer:", "Capa:"),
     ("Layer: {}", "Capa: {}"),
     ("Layer Styles", "Estilos de capa"),
@@ -4157,6 +7734,7 @@ const SPANISH: &[(&str, &str)] = &[
     ("No layer selected", "No hay ninguna capa seleccionada"),
     ("No matching effects or presets", "No hay efectos ni ajustes preestablecidos que coincidan"),
     ("No matching fonts", "No hay fuentes coincidentes"),
+    ("Rescan Fonts", "Volver a analizar fuentes"),
     ("Variable fonts only", "Solo fuentes variables"),
     ("No model credits were built into this copy.", "No se incluyeron créditos de modelos en esta copia."),
     ("No nested compositions", "No hay composiciones anidadas"),
@@ -4187,6 +7765,7 @@ const SPANISH: &[(&str, &str)] = &[
     ("Overlay", "Superposición"),
     ("Parameter Name:", "Nombre del parámetro:"),
     ("Parent pick whip: drag onto a layer", "Selector de capa padre: arrastra hasta una capa"),
+    ("Track Matte pick whip: drag onto a layer", "Selector de mate de seguimiento: arrastra hasta una capa"),
     ("Pixel Aspect Ratio:", "Relación de aspecto de píxel:"),
     ("Playing on Video Preview", "Reproduciendo en la previsualización de vídeo"),
     ("Post-Render Action: {}", "Acción posterior al procesamiento: {}"),
@@ -4394,8 +7973,8 @@ const SPANISH: &[(&str, &str)] = &[
     ("Import Photoshop File", "Importar archivo de Photoshop"),
     ("Interpret Unlabeled Alpha As", "Interpretar alfa sin etiquetar como"),
     ("Join the ArtCraft Discord", "Únete al Discord de ArtCraft"),
-    ("Mercury GPU Acceleration ({})", "Aceleración por GPU Mercury ({})"),
-    ("Mercury Software Only", "Solo software Mercury"),
+    ("GPU Acceleration ({})", "Aceleración por GPU ({})"),
+    ("Software Rendering", "Renderizado por software"),
     ("OCIO (built-in ACES config)", "OCIO (configuración ACES integrada)"),
     ("Off (Final Quality)", "Desactivado (calidad final)"),
     ("OpenGL (compatibility)", "OpenGL (compatibilidad)"),
@@ -4436,29 +8015,2326 @@ const SPANISH: &[(&str, &str)] = &[
     ("After Effects project", "Proyecto de After Effects"),
     ("Lottie animation", "Animación de Lottie"),
     ("Project", "Proyecto"),
+    ("Video Scopes", "Monitores de vídeo"),
+    ("GPU Acceleration (no GPU: software)", "Aceleración por GPU (sin GPU: software)"),
+];
+
+/// Georgian (ka): every row of the Chinese catalogs, in the same order (the tests keep them in step).
+const GEORGIAN: &[(&str, &str)] = &[
+    ("Click to sample color", "დააწკაპუნეთ ფერის ნიმუშის ასაღებად"),
+    ("Appearance Settings…", "იერსახის პარამეტრები…"),
+    ("Add to favorites", "რჩეულებში დამატება"),
+    ("Remove from favorites", "რჩეულებიდან ამოშლა"),
+    ("   OK   ", "   OK   "),
+    ("  Delete  ", "  წაშლა  "),
+    (" Open Auto-Save ", " ავტოშენახვის გახსნა "),
+    ("(missing)", "(აკლია)"),
+    ("360 View Orientation", "360° ხედის ორიენტაცია"),
+    ("3:2 Pulldown: {}", "3:2 Pulldown: {}"),
+    (
+        "A clean-room, open-source compositor for motion graphics and visual effects: native on macOS, Windows and Linux, and in the browser. Part of the ArtCraft family of creative apps.",
+        "სუფთა ოთახის მეთოდით შექმნილი, ღია კოდის კომპოზიტორი მოძრავი გრაფიკისა და ვიზუალური ეფექტებისთვის: ნატიურად მუშაობს macOS-ზე, Windows-სა და Linux-ზე, ასევე ბრაუზერში. ArtCraft-ის შემოქმედებითი აპების ოჯახის ნაწილი.",
+    ),
+    ("About EffectCraft", "EffectCraft-ის შესახებ"),
+    ("About...", "პროგრამის შესახებ..."),
+    ("Active", "აქტიური"),
+    ("Active Camera", "აქტიური კამერა"),
+    ("Alpha", "ალფა"),
+    ("Adapt Feature On Every Frame", "მახასიათებლის განახლება ყოველ კადრზე"),
+    ("Adaptive Sample Limit:", "ადაპტური ნიმუშების ზღვარი:"),
+    ("Add Animator", "ანიმატორის დამატება"),
+    ("Add Comment", "კომენტარის დამატება"),
+    ("Add Formatting", "ფორმატირების დამატება"),
+    ("Add Group", "ჯგუფის დამატება"),
+    ("Add Mirror", "სარკის დამატება"),
+    ("Add Selected As", "მონიშნულის დამატება როგორც"),
+    ("Add a comment", "კომენტარის დამატება"),
+    ("Add a shape, fill, stroke or path operation", "ფიგურის, შევსების, კონტურის ან ტრაექტორიის ოპერაციის დამატება"),
+    ("Add to Composition", "კომპოზიციაში დამატება"),
+    ("Add to Favorites", "რჩეულებში დამატება"),
+    ("Add:", "დამატება:"),
+    ("Adjust Exposure (stops)", "ექსპოზიციის კორექცია (საფეხურები)"),
+    ("Adjust composition duration to the time span of the selected layers", "კომპოზიციის ხანგრძლივობის მორგება მონიშნული შრეების დროის შუალედზე"),
+    ("Advanced 3D", "გაფართოებული 3D"),
+    ("Align Layers to:", "შრეების სწორება:"),
+    ("All six face cameras turn together; the scene is not changed.", "სახეების ექვსივე კამერა ერთად ბრუნავს; სცენა არ იცვლება."),
+    ("Anchor:", "მიმაგრება:"),
+    ("Aperture", "დიაფრაგმა"),
+    ("Appearance Mode", "იერსახის რეჟიმი"),
+    ("Appearance Mode: {}", "იერსახის რეჟიმი: {}"),
+    ("Apply Dimensions:", "განზომილებების გამოყენება:"),
+    ("Apply Motion To:", "მოძრაობის გამოყენება:"),
+    ("Arrange", "დალაგება"),
+    ("Assign", "მინიჭება"),
+    ("Auto", "ავტომატური"),
+    ("Auto-saves", "ავტოშენახვები"),
+    ("Back", "უკან"),
+    ("Background Color:", "ფონის ფერი:"),
+    ("Blend Mode:", "შერევის რეჟიმი:"),
+    ("Blending Mode", "შერევის რეჟიმი"),
+    ("Blur", "გაბუნდოვნება"),
+    ("Blur Level", "გაბუნდოვნების დონე"),
+    ("Boundary", "საზღვარი"),
+    ("Browser Storage", "ბრაუზერის მეხსიერება"),
+    ("Browse…", "არჩევა…"),
+    ("Brush Dynamics", "ფუნჯის დინამიკა"),
+    ("Caching frames", "კადრების ქეშირება"),
+    ("Cancel", "გაუქმება"),
+    ("Import After Effects Project", "After Effects-ის პროექტის იმპორტი"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "ამ პროექტის ზოგიერთი ნაწილის ზუსტად იმპორტი შეუძლებელია (გამოტოვებული ან შეცვლილი):",
+    ),
+    ("Import Anyway", "მაინც იმპორტი"),
+    ("Casts Shadows", "ჩრდილს აგდებს"),
+    ("Change Renderer…", "რენდერერის შეცვლა…"),
+    ("Changing a shortcut creates a custom preset; the default stays as it is.", "მალსახმობის შეცვლა ქმნის მორგებულ პრესეტს; ნაგულისხმევი უცვლელი რჩება."),
+    ("Channel", "არხი"),
+    ("Channel:", "არხი:"),
+    ("Chapter:", "თავი:"),
+    ("Choose...", "არჩევა..."),
+    ("Classic 3D", "კლასიკური 3D"),
+    ("Clear", "გასუფთავება"),
+    ("Clear list", "სიის გასუფთავება"),
+    ("Click a key to see its commands.", "დაწკაპეთ კლავიშზე მისი ბრძანებების სანახავად."),
+    (
+        "Click above the bar to add an opacity stop, below it to add a color stop.",
+        "დაწკაპეთ ზოლის ზემოთ გაუმჭვირვალობის გადასვლის წერტილის დასამატებლად, ქვემოთ — ფერის გადასვლის წერტილის დასამატებლად.",
+    ),
+    ("Click adds a point (½ height = no change)", "დაწკაპუნება ამატებს წერტილს (½ სიმაღლე = ცვლილების გარეშე)"),
+    ("Click adds a point; drag one off to remove", "დაწკაპუნება ამატებს წერტილს; მის მოსაშორებლად გადაათრიეთ გარეთ"),
+    ("Click to make this viewer active", "დაწკაპეთ ამ დამთვალიერებელის გასააქტიურებლად"),
+    ("Click to reveal the expression in the timeline", "დაწკაპეთ ექსპრესიის დროის ხაზზე საჩვენებლად"),
+    ("Click to show the active composition here", "დაწკაპეთ აქტიური კომპოზიციის აქ საჩვენებლად"),
+    ("Click, then click in the Composition panel", "დაწკაპეთ, შემდეგ კი დაწკაპეთ კომპოზიციის პანელში"),
+    ("Clone Options", "კლონირების პარამეტრები"),
+    ("Clone Source Overlay:", "კლონირების წყაროს გადაფარვა:"),
+    ("Close", "დახურვა"),
+    ("Close Panel", "პანელის დახურვა"),
+    ("Close tutorial", "გაკვეთილის დახურვა"),
+    ("Color", "ფერი"),
+    ("Color Depth: {}", "ფერის სიღრმე: {}"),
+    ("Color:", "ფერი:"),
+    ("Colour map", "ფერების რუკა"),
+    ("Columns", "სვეტები"),
+    ("Comment:", "კომენტარი:"),
+    ("Community", "საზოგადოება"),
+    ("Composition", "კომპოზიცია"),
+    ("Composition Mini-Flowchart", "კომპოზიციის მინი-ბლოკ-სქემა"),
+    ("Composition Name:", "კომპოზიციის სახელი:"),
+    ("Composition Settings ▸ 3D Renderer", "კომპოზიციის პარამეტრები ▸ 3D რენდერერი"),
+    ("Composition Settings…", "კომპოზიციის პარამეტრები…"),
+    ("Composition marker bin: drag a marker to the time ruler", "კომპოზიციის მარკერების ბინი: გადაათრიეთ მარკერი დროის სახაზავზე"),
+    ("Cone Angle", "კონუსის კუთხე"),
+    ("Cone Feather", "კონუსის კიდეების შერბილება"),
+    ("Constrain Proportions", "პროპორციების შენარჩუნება"),
+    ("Continuous (Lock Outgoing to Incoming)", "უწყვეტი (გამავალის მიბმა შემავალზე)"),
+    ("Cue Point", "მინიშნების წერტილი"),
+    ("Current Render", "მიმდინარე რენდერი"),
+    ("Dark", "ბნელი"),
+    ("Dark Theme", "ბნელი თემა"),
+    ("Darker", "უფრო მუქი"),
+    ("Default Output:", "ნაგულისხმევი გამოტანა:"),
+    ("Default: {}", "ნაგულისხმევი: {}"),
+    ("Defaults", "ნაგულისხმევი"),
+    ("Delete", "წაშლა"),
+    ("Delete Selected Points", "მონიშნული წერტილების წაშლა"),
+    ("Delete selected project items", "პროექტის მონიშნული ელემენტების წაშლა"),
+    ("Delete this template", "ამ შაბლონის წაშლა"),
+    ("Depth of Field", "ველის სიღრმე"),
+    ("Discord", "Discord"),
+    ("Distribute Layers:", "შრეების განაწილება:"),
+    ("Don't Recover", "არ აღადგინო"),
+    ("Don't Save", "არ შეინახო"),
+    ("Double-click a layer to open it in the Layer panel", "ორჯერ დაწკაპეთ შრეზე მის შრის პანელში გასახსნელად"),
+    ("Double-click footage in the Project panel to open it here", "ორჯერ დაწკაპეთ ვიდეომასალაზე პროექტის პანელში მის აქ გასახსნელად"),
+    ("Double-click to edit the comment", "ორჯერ დაწკაპეთ კომენტარის რედაქტირებისთვის"),
+    ("Download", "ჩამოტვირთვა"),
+    (
+        "Drag properties here from the timeline,\nor use Animation > Add Property to Essential Graphics.",
+        "გადმოათრიეთ თვისებები დროის ხაზიდან,\nან გამოიყენეთ ანიმაცია > თვისების დამატება ძირითად გრაფიკაში.",
+    ),
+    ("Drag to change", "გადაათრიეთ შესაცვლელად"),
+    ("Drag to create a guide", "გადაათრიეთ დამხმარე ხაზის შესაქმნელად"),
+    ("Drag to slip the source", "გადაათრიეთ წყაროს გადასაწევად"),
+    ("Drop Frame", "კადრების გამოტოვებით"),
+    ("Duplicate", "დუბლირება"),
+    ("Copy", "კოპირება"),
+    ("Paste", "ჩასმა"),
+    ("Edit Value…", "მნიშვნელობის რედაქტირება…"),
+    ("Remove Expression", "ექსპრესიის მოცილება"),
+    ("Duration:", "ხანგრძლივობა:"),
+    ("Edit Gradient…", "გრადიენტის რედაქტირება…"),
+    ("Edit Target: {}", "რედაქტირების სამიზნე: {}"),
+    ("EffectCraft didn't quit normally last time.", "EffectCraft ბოლოს ნორმალურად არ დახურულა."),
+    ("Effects", "ეფექტები"),
+    ("Effects & Presets options", "ეფექტებისა და პრესეტების პარამეტრები"),
+    ("Copy Presets Folder Path", "პრესეტების საქაღალდის მისამართის კოპირება"),
+    ("Copy Source Path", "წყაროს მისამართის კოპირება"),
+    ("Effects: {}", "ეფექტები: {}"),
+    ("EXR Bit Depth: {}", "EXR ბიტის სიღრმე: {}"),
+    ("EXR Compression: {}", "EXR შეკუმშვა: {}"),
+    ("EXR Compression: {} (lossy)", "EXR შეკუმშვა: {} (დანაკარგით)"),
+    ("EXR Compression: {} (uncompressed at float)", "EXR შეკუმშვა: {} (float-ზე შეკუმშვის გარეშე)"),
+    ("Empty folder", "ცარიელი საქაღალდე"),
+    ("Enable Depth of Field", "ველის სიღრმის ჩართვა"),
+    ("Enable Expression", "ექსპრესიის ჩართვა"),
+    ("Enhance", "გაუმჯობესება"),
+    ("Essential Properties — {}", "ძირითადი თვისებები — {}"),
+    ("Event", "მოვლენა"),
+    ("Export Template…", "შაბლონის ექსპორტი…"),
+    ("Export...", "ექსპორტი..."),
+    ("Expression Language Menu", "ექსპრესიების ენის მენიუ"),
+    ("Expression pick whip: drag onto a property", "ექსპრესიის ბმის სპირალი: გადაათრიეთ თვისებაზე"),
+    ("Expression:", "ექსპრესია:"),
+    ("Eyedropper: click, then click in the Composition panel", "პიპეტი: დაწკაპეთ, შემდეგ კი დაწკაპეთ კომპოზიციის პანელში"),
+    ("Falloff", "მილევა"),
+    ("Falloff Distance", "მილევის მანძილი"),
+    ("Favorites", "რჩეულები"),
+    ("Field Render: {}", "ნახევარკადრების რენდერი: {}"),
+    ("Figures", "ციფრები"),
+    ("Fill Target", "შევსების სამიზნე"),
+    ("Finished", "დასრულდა"),
+    ("Flowchart: {}", "ბლოკ-სქემა: {}"),
+    ("Focus Distance", "ფოკუსური მანძილი"),
+    ("Follow Feature Rotation and Scale", "მახასიათებლის შემობრუნებისა და მასშტაბის მიდევნება"),
+    ("Footage: {}", "ვიდეომასალა: {}"),
+    ("Format: {}", "ფორმატი: {}"),
+    ("Frame Aspect Ratio: {}", "კადრის თანაფარდობა: {}"),
+    ("Frame Blending: {}", "კადრების შერევა: {}"),
+    ("Frame Rate:", "კადრების სიხშირე:"),
+    ("Frame Render Time  {}ms", "კადრის რენდერის დრო  {}ms"),
+    ("Frame Target:", "კადრის სამიზნე:"),
+    ("Freeze", "გაყინვა"),
+    ("Grab bag", "სხვადასხვა"),
+    ("Gradient Editor", "გრადიენტის რედაქტორი"),
+    ("Grid", "ბადე"),
+    ("Guide Layer", "დამხმარე შრე"),
+    ("Guide Layers: {}", "დამხმარე შრეები: {}"),
+    ("Guides", "დამხმარე ხაზები"),
+    ("Height:", "სიმაღლე:"),
+    ("Hide This", "ამის დამალვა"),
+    ("Histogram", "ჰისტოგრამა"),
+    ("Hold In Place", "ადგილზე დაფიქსირება"),
+    ("Home", "საწყისი ეკრანი"),
+    ("If Confidence is Below", "თუ სანდოობა ნაკლებია"),
+    ("Import", "იმპორტი"),
+    ("Import and Add to Composition", "იმპორტი და კომპოზიციაში დამატება"),
+    ("Import...", "იმპორტი..."),
+    ("Imported media", "იმპორტირებული მედია"),
+    ("Influence:", "გავლენა:"),
+    ("Install from File…", "ფაილიდან დაყენება…"),
+    ("Intensity", "ინტენსივობა"),
+    ("Inverted", "შებრუნებული"),
+    ("Join the ArtCraft community on Discord", "შემოუერთდით ArtCraft-ის საზოგადოებას Discord-ზე"),
+    ("Key: {}", "გასაღები: {}"),
+    ("LEARN", "სწავლა"),
+    ("Label", "იარლიყი"),
+    ("Label Colors and Names:", "იარლიყების ფერები და სახელები:"),
+    ("Label:", "იარლიყი:"),
+    ("Latest auto-save: {}", "ბოლო ავტოშენახვა: {}"),
+    ("Layer", "შრე"),
+    ("Layer controls", "შრის მართვის ელემენტები"),
+    ("Layer:", "შრე:"),
+    ("Layer: {}", "შრე: {}"),
+    ("Layer Styles", "შრის სტილები"),
+    ("Learn", "სწავლა"),
+    ("Leave all attributes in \"{}\"", "ყველა ატრიბუტის დატოვება „{}“-ში"),
+    ("Licence: {}", "ლიცენზია: {}"),
+    ("Ligatures", "ლიგატურები"),
+    ("Light", "ღია"),
+    ("Light Theme", "ღია თემა"),
+    ("Light Type", "სინათლის ტიპი"),
+    ("Lighter", "უფრო ღია"),
+    ("Link Selected Property", "მონიშნული თვისების დაკავშირება"),
+    ("Location:", "პოზიცია:"),
+    ("Lock Aspect Ratio to {}", "თანაფარდობის ჩაკეტვა: {}"),
+    ("Lock to Zoom", "მასშტაბზე მიბმა"),
+    ("Locked: {} — {}", "ჩაკეტილი: {} — {}"),
+    ("Log:", "ჟურნალი:"),
+    ("Loop (Trace Path)", "მარყუჟი (ტრაექტორიის გავლა)"),
+    ("MIT OR Apache-2.0 • Fonts: Inter, JetBrains Mono (OFL)", "MIT OR Apache-2.0 • შრიფტები: Inter, JetBrains Mono (OFL)"),
+    ("Magnification ratio popup", "გადიდების კოეფიციენტის მენიუ"),
+    ("Make Comp Size", "კომპოზიციის ზომაზე მორგება"),
+    ("Markers", "მარკერები"),
+    ("Masks", "ნიღბები"),
+    ("Maximize Panel", "პანელის გაშლა"),
+    ("Media Replacement", "მედიის ჩანაცვლება"),
+    ("Mesh:", "ბადე:"),
+    ("Diameter:", "დიამეტრი:"),
+    ("Method Used: {}    Average Error: {} pixels", "გამოყენებული მეთოდი: {}    საშუალო ცდომილება: {} პიქსელი"),
+    ("Models folder: {}", "მოდელების საქაღალდე: {}"),
+    ("Modifiers:", "მოდიფიკატორები:"),
+    ("More", "მეტი"),
+    ("More ArtCraft apps", "ArtCraft-ის სხვა აპლიკაციები"),
+    ("More tutorials", "მეტი გაკვეთილი"),
+    ("Motion Blur", "მოძრაობის გაბუნდოვნება"),
+    ("Motion Blur: {}", "მოძრაობის გაბუნდოვნება: {}"),
+    ("Motion Sketch: drag to record", "მოძრაობის ესკიზი: გადაათრიეთ ჩასაწერად"),
+    ("Move Down", "ჩამოწევა"),
+    ("Move Up", "აწევა"),
+    ("Move to Project Root", "პროექტის ძირში გადატანა"),
+    ("Name", "სახელი"),
+    ("Name:", "სახელი:"),
+    ("Navigation", "ნავიგაცია"),
+    ("New", "ახალი"),
+    ("New Comp from Selection", "ახალი კომპოზიცია მონიშნულიდან"),
+    ("Replace with Precomposition", "ჩადგმული კომპოზიციით ჩანაცვლება"),
+    ("New Duration:", "ახალი ხანგრძლივობა:"),
+    ("New composition name:", "ახალი კომპოზიციის სახელი:"),
+    ("New from Render Queue item:", "ახალი რენდერის რიგის ელემენტიდან:"),
+    ("New from Template", "შაბლონიდან შექმნა"),
+    ("Next", "შემდეგი"),
+    ("Nice work. Pick another tutorial on the Home screen's Learn tab.", "ყოჩაღ. აირჩიეთ სხვა გაკვეთილი საწყისი ეკრანის „სწავლის“ ჩანართზე."),
+    (
+        "No VR environments yet. Create one with Composition ▸ VR ▸ Create VR Environment…",
+        "VR გარემო ჯერ არ არის. შექმენით: კომპოზიცია ▸ VR ▸ VR გარემოს შექმნა…",
+    ),
+    ("No audio layer selected", "აუდიოშრე არ არის მონიშნული"),
+    ("No background jobs running", "ფონური ამოცანები არ მიმდინარეობს"),
+    ("No composition markers", "კომპოზიციის მარკერები არ არის"),
+    ("No contributor data was built into this copy.", "ამ ასლში მონაწილეების მონაცემები არ არის ჩაშენებული."),
+    (
+        "No device list from this host; the system default output is used.",
+        "ამ ჰოსტიდან მოწყობილობების სია მიუწვდომელია; გამოიყენება სისტემის ნაგულისხმევი გამოტანა.",
+    ),
+    ("No layer selected", "შრე არ არის მონიშნული"),
+    ("No matching effects or presets", "შესაბამისი ეფექტები ან პრესეტები არ მოიძებნა"),
+    ("No matching fonts", "შესაბამისი შრიფტები არ მოიძებნა"),
+    ("Variable fonts only", "მხოლოდ ცვლადი შრიფტები"),
+    ("No model credits were built into this copy.", "ამ ასლში მოდელების მონაცემები არ არის ჩაშენებული."),
+    ("No nested compositions", "ჩადგმული კომპოზიციები არ არის"),
+    ("No shortcut", "მალსახმობის გარეშე"),
+    ("No unlocked layer selected", "განბლოკილი შრე არ არის მონიშნული"),
+    ("No video", "ვიდეოს გარეშე"),
+    ("None", "არცერთი"),
+    ("Not applied: tick it in the list to add it.", "არ არის გამოყენებული: დასამატებლად მონიშნეთ სიაში."),
+    ("Not assigned", "არ არის მინიჭებული"),
+    ("Note: Shadows are only cast from layers with Cast Shadows enabled.", "შენიშვნა: ჩრდილს აგდებს მხოლოდ ის შრე, რომელსაც ჩართული აქვს „ჩრდილს აგდებს“."),
+    ("Notify", "შეტყობინება"),
+    ("OK", "OK"),
+    ("Offset:", "წანაცვლება:"),
+    ("On ({}) stop:", "ჩართვისას ({}) გაჩერება:"),
+    ("One-Node Camera", "ერთკვანძიანი კამერა"),
+    ("Opacity:", "გაუმჭვირვალობა:"),
+    ("Open Composition", "კომპოზიციის გახსნა"),
+    ("used once", "გამოყენებულია ერთხელ"),
+    ("used {} times", "გამოყენებულია {}-ჯერ"),
+    ("Compositions that use this item", "კომპოზიციები, რომლებიც ამ ელემენტს იყენებს"),
+    ("Open Last Saved Project", "ბოლოს შენახული პროექტის გახსნა"),
+    ("Open New Composition", "ახალი კომპოზიციის გახსნა"),
+    ("Open Output", "გამოტანის გახსნა"),
+    ("Open a composition to build Essential Graphics", "გახსენით კომპოზიცია ძირითადი გრაფიკის ასაგებად"),
+    ("Open a composition to see its scopes", "გახსენით კომპოზიცია მისი სკოპების სანახავად"),
+    ("Open a composition to track motion.", "გახსენით კომპოზიცია მოძრაობის ტრეკინგისთვის."),
+    ("Opus Tuning: {}", "Opus-ის მორგება: {}"),
+    ("Original Duration:", "საწყისი ხანგრძლივობა:"),
+    ("Output Cycle: {}", "გამოტანის ციკლი: {}"),
+    ("Output To:", "გამოტანის ადგილი:"),
+    ("Overlay", "გადაფარვა"),
+    ("Parameter Name:", "პარამეტრის სახელი:"),
+    ("Parent pick whip: drag onto a layer", "მშობლის ბმის სპირალი: გადაათრიეთ შრეზე"),
+    ("Pixel Aspect Ratio:", "პიქსელის გვერდების თანაფარდობა:"),
+    ("Playing on Video Preview", "იკვრება ვიდეოს წინასწარ ნახვაზე"),
+    ("Post-Render Action: {}", "რენდერის შემდგომი მოქმედება: {}"),
+    ("Preserve frame rate when nested or in render queue", "კადრების სიხშირის შენარჩუნება ჩადგმისას ან რენდერის რიგში"),
+    ("Preserve resolution when nested", "გარჩევადობის შენარჩუნება ჩადგმისას"),
+    ("Preset", "პრესეტი"),
+    ("Preset:", "პრესეტი:"),
+    ("Presets", "პრესეტები"),
+    ("Previous", "წინა"),
+    ("Primary:", "ძირითადი:"),
+    ("Process Before Match", "დამუშავება შეთანხმებამდე"),
+    ("Profile: {}", "პროფილი: {}"),
+    (
+        "Project color depth: click to cycle 8/16/32 bpc, Alt-click for Project Settings",
+        "პროექტის ფერის სიღრმე: დაწკაპეთ 8/16/32 bpc-ის გადასართავად, Alt-დაწკაპუნება — პროექტის პარამეტრები",
+    ),
+    ("Project: {}", "პროექტი: {}"),
+    ("Projects", "პროექტები"),
+    ("Property pick whip: drag onto a property", "თვისების ბმის სპირალი: გადაათრიეთ თვისებაზე"),
+    ("Protected Region", "დაცული არე"),
+    ("Proxy Use: {}", "პროქსის გამოყენება: {}"),
+    ("Push All to Comp", "ყველაფრის კომპოზიციაში გადატანა"),
+    ("RGB", "RGB"),
+    ("Radius", "რადიუსი"),
+    ("Rate Control: {}", "სიჩქარის კონტროლი: {}"),
+    ("Recent", "ბოლოდროინდელი"),
+    ("Recording", "ჩაწერა"),
+    ("Remove", "წაშლა"),
+    ("Rename", "სახელის შეცვლა"),
+    ("Render: {} ms  •  UI {} fps{}", "რენდერი: {} ms  •  UI {} fps{}"),
+    ("Renderer:", "რენდერერი:"),
+    ("Request Persistent Storage", "მუდმივი მეხსიერების მოთხოვნა"),
+    ("Reset", "ჩამოყრა"),
+    ("Reset Labels", "იარლიყების ჩამოყრა"),
+    ("Reset Preset", "პრესეტის ჩამოყრა"),
+    ("Reset to Default", "ნაგულისხმევზე დაბრუნება"),
+    ("Reset to Saved Layout", "შენახულ განლაგებაზე დაბრუნება"),
+    ("Resolution/Down Sample Factor Popup", "გარჩევადობის/დისკრეტიზაციის კოეფიციენტის მენიუ"),
+    ("Restore Panel Size", "პანელის ზომის აღდგენა"),
+    ("Reverse the order", "რიგის შებრუნება"),
+    ("Revert All", "ყველაფრის დაბრუნება"),
+    ("Roman Hanging Punctuation", "ლათინური გამოწეული პუნქტუაცია"),
+    ("Roving:", "მცურავი:"),
+    ("Ruler zero point (drag to move, double-click to reset)", "სახაზავის ნულოვანი წერტილი (გადაათრიეთ გადასაადგილებლად, ორჯერ დაწკაპეთ ჩამოსაყრელად)"),
+    ("Rulers", "სახაზავები"),
+    ("Run", "გაშვება"),
+    ("Sample Format: {}", "ნიმუშის ფორმატი: {}"),
+    ("Samples Per Frame:", "ნიმუშები კადრზე:"),
+    ("Save from #{}", "შენახვა #{}-დან"),
+    ("Saved {}", "შენახულია {}"),
+    ("Script… (⌘/Ctrl+Enter runs)", "სკრიპტი… (⌘/Ctrl+Enter უშვებს)"),
+    ("Search commands or shortcuts", "ბრძანებების ან მალსახმობების ძიება"),
+    ("Select", "მონიშვნა"),
+    ("Select a command to change its shortcut.", "მონიშნეთ ბრძანება მისი მალსახმობის შესაცვლელად."),
+    ("Select a layer to see its effects", "მონიშნეთ შრე მისი ეფექტების სანახავად"),
+    ("Select a layer to see its properties", "მონიშნეთ შრე მისი თვისებების სანახავად"),
+    ("({}) Selected Objects", "({}) მონიშნული ობიექტი"),
+    (
+        "Select a layer with a mask or shape path (or the path property), or Puppet pins.",
+        "მონიშნეთ ნიღბიანი ან ფიგურის ტრაექტორიის მქონე შრე (ან ტრაექტორიის თვისება), ან მარიონეტის სამაგრები.",
+    ),
+    ("Select a text layer", "მონიშნეთ ტექსტური შრე"),
+    ("Select an item in the Project panel", "მონიშნეთ ელემენტი პროექტის პანელში"),
+    ("Select animated properties to show them in the Graph Editor", "მონიშნეთ ანიმირებული თვისებები გრაფიკების რედაქტორში საჩვენებლად"),
+    (
+        "Select the leader pin, then Shift-click the pins that should trail it (hair, cloth, tails)",
+        "მონიშნეთ წამყვანი სამაგრი, შემდეგ Shift-დაწკაპუნებით მონიშნეთ მიმყოლი სამაგრები (თმა, ქსოვილი, კუდები)",
+    ),
+    ("Set Ground Plane and Origin", "მიწის სიბრტყისა და სათავის დაყენება"),
+    ("Set Paint Colors to Black and White (D)", "ხატვის ფერების შავ-თეთრზე დაყენება (D)"),
+    ("Settings", "პარამეტრები"),
+    ("Settings Name:", "პარამეტრების სახელი:"),
+    ("Shadow Darkness", "ჩრდილის სიმუქე"),
+    ("Shadow Diffusion", "ჩრდილის გაბნევა"),
+    ("Shadows", "ჩრდილები"),
+    ("Shape…", "ფორმა…"),
+    ("Show", "ჩვენება"),
+    ("Show Layer Name", "შრის სახელის ჩვენება"),
+    ("Show Source Name", "წყაროს სახელის ჩვენება"),
+    ("Show me", "მაჩვენე"),
+    ("Show:", "ჩვენება:"),
+    ("Shutter Angle:", "ობტურატორის კუთხე:"),
+    ("Shutter Phase:", "ობტურატორის ფაზა:"),
+    ("Size", "ზომა"),
+    ("Skip", "გამოტოვება"),
+    ("Snapping", "მიბმა"),
+    ("Snapping options", "მიბმის პარამეტრები"),
+    ("Snapshot", "მომენტალური ასლი"),
+    ("Solo Supported Properties", "მხარდაჭერილი თვისებების სოლო"),
+    ("Solo Switches: {}", "სოლოს გადამრთველები: {}"),
+    ("Sort", "სორტირება"),
+    ("Spacing:", "ინტერვალი:"),
+    ("Spatial Interpolation:", "სივრცითი ინტერპოლაცია:"),
+    ("Speed:", "სიჩქარე:"),
+    ("Start Timecode:", "საწყისი თაიმკოდი:"),
+    ("Start: {}   Duration: {}", "დასაწყისი: {}   ხანგრძლივობა: {}"),
+    ("Step {} of {}: {}", "ნაბიჯი {} / {}: {}"),
+    ("Stop", "შეწყვეტა"),
+    ("Stop {} at {}°", "გადასვლის წერტილი {} — {}°"),
+    ("Stored in: {}", "შენახულია: {}"),
+    ("Stretch", "გაწელვა"),
+    ("Stretch Factor:", "გაწელვის კოეფიციენტი:"),
+    ("Stylistic Sets", "სტილისტური ნაკრებები"),
+    ("Subpixel Positioning", "სუბპიქსელური პოზიციონირება"),
+    ("Swap Colors", "ფერების გაცვლა"),
+    ("Swap Paint Colors (X)", "ხატვის ფერების გაცვლა (X)"),
+    ("Sync with System", "სისტემასთან სინქრონიზაცია"),
+    ("System Default", "სისტემის ნაგულისხმევი"),
+    ("Table", "ცხრილი"),
+    ("Template name", "შაბლონის სახელი"),
+    ("Template: {}\n{}", "შაბლონი: {}\n{}"),
+    ("Temporal Interpolation:", "დროითი ინტერპოლაცია:"),
+    ("The Media Browser is not available here (use File ▸ Import)", "მედიის ბრაუზერი აქ მიუწვდომელია (გამოიყენეთ ფაილი ▸ იმპორტი)"),
+    ("The OpenEXR layer shown in red, green, blue and alpha", "OpenEXR შრე წითლად, მწვანედ, ლურჯად და ალფად"),
+    ("The render queue is empty.", "რენდერის რიგი ცარიელია."),
+    (
+        "These adjacent keyframes cannot interpolate because their stop counts differ.",
+        "ამ მეზობელ საკვანძო კადრებს შორის ინტერპოლაცია შეუძლებელია, რადგან მათ გრადიენტის გადასვლის წერტილების განსხვავებული რაოდენობა აქვთ.",
+    ),
+    ("This ScriptUI panel has closed", "ეს ScriptUI პანელი დაიხურა"),
+    ("This change will create a new solid for this layer.", "ეს ცვლილება ამ შრისთვის ახალ სოლიდს შექმნის."),
+    ("Time", "დრო"),
+    ("Time Stretch…", "დროში გაწელვა…"),
+    ("Time:", "დრო:"),
+    ("Time: {}", "დრო: {}"),
+    ("Title/Action Safe", "სათაურისა და მოქმედების უსაფრთხო არე"),
+    ("Title/action safe", "სათაურისა და მოქმედების უსაფრთხო არე"),
+    ("Toggle Switches / Modes", "გადამრთველების / რეჟიმების გადართვა"),
+    ("Track Name:", "ტრეკის სახელი:"),
+    (
+        "Trained models are available in the desktop app; the browser uses the classic engine.",
+        "გაწვრთნილი მოდელები ხელმისაწვდომია დესკტოპის აპში; ბრაუზერი კლასიკურ ძრავს იყენებს.",
+    ),
+    ("Transform", "გარდაქმნა"),
+    ("Transparency grid", "გამჭვირვალობის ბადე"),
+    ("Tutorial complete", "გაკვეთილი დასრულდა"),
+    ("Two-Node Camera", "ორკვანძიანი კამერა"),
+    ("Type", "ტიპი"),
+    ("Type a command or effect…", "აკრიფეთ ბრძანება ან ეფექტი…"),
+    ("URL:", "URL:"),
+    ("Undock Panel", "პანელის მოხსნა"),
+    ("Move Panel to New Window", "პანელის ახალ ფანჯარაში გადატანა"),
+    ("Move Panel to Main Window", "პანელის მთავარ ფანჯარაში გადატანა"),
+    ("Unfreeze", "გაყინვის მოხსნა"),
+    ("Unlink {}", "{}-ის კავშირის გაწყვეტა"),
+    (
+        "Use this option to place the currently selected layers together into a new intermediate composition.",
+        "გამოიყენეთ ეს ვარიანტი მონიშნული შრეების ერთად ახალ შუალედურ კომპოზიციაში მოსათავსებლად.",
+    ),
+    ("VR Environments", "VR გარემოები"),
+    ("Value:", "მნიშვნელობა:"),
+    ("Variable Font Axes", "ცვლადი შრიფტის ღერძები"),
+    ("Video Codec: {}", "ვიდეო კოდეკი: {}"),
+    ("View:", "ხედი:"),
+    ("Welcome to EffectCraft", "მოგესალმებათ EffectCraft"),
+    ("Width:", "სიგანე:"),
+    ("You can undo this.", "ამის დაბრუნება შეგიძლიათ."),
+    ("You can't undo this.", "ამის დაბრუნება შეუძლებელია."),
+    ("Your changes will be lost if you don't save them.", "თუ ცვლილებებს არ შეინახავთ, ისინი დაიკარგება."),
+    ("Zoom", "მასშტაბი"),
+    ("built-in", "ჩაშენებული"),
+    ("frames per second", "კადრი წამში"),
+    ("template name", "შაბლონის სახელი"),
+    ("{} contributors · {} commits", "მონაწილე: {} · კომიტი: {}"),
+    ("{} x {}, {}MB per 8bpc frame", "{} x {}, {}MB 8bpc კადრზე"),
+    ("{} — coming soon", "{} — მალე"),
+    ("{} — double-click to open, {}-click to reveal", "{} — ორჯერ დაწკაპეთ გასახსნელად, {}-დაწკაპუნება საჩვენებლად"),
+    ("⌘/Ctrl-drag a pin to record its motion", "⌘/Ctrl-ით გადაათრიეთ სამაგრი მისი მოძრაობის ჩასაწერად"),
+    ("▣ {}", "▣ {}"),
+    ("⚠ {} is used by:", "⚠ {} გამოიყენება:"),
+    ("3D Reference Axes", "3D საორიენტაციო ღერძები"),
+    ("Affect all layers that use this solid", "ზემოქმედება ყველა შრეზე, რომელიც ამ სოლიდს იყენებს"),
+    ("Choose grid and guide options", "ბადისა და დამხმარე ხაზების პარამეტრების არჩევა"),
+    ("Colorize", "გაფერადება"),
+    ("Custom", "მორგებული"),
+    ("Custom...", "მორგებული..."),
+    ("Fit", "ჩატევა"),
+    ("Fit up to 100%", "ჩატევა 100%-მდე"),
+    ("Full", "სრული"),
+    ("Half", "ნახევარი"),
+    ("Only this layer uses this solid.", "ამ სოლიდს მხოლოდ ეს შრე იყენებს."),
+    ("Proportional Grid", "პროპორციული ბადე"),
+    ("Quarter", "მეოთხედი"),
+    ("Region of Interest", "ინტერესის არე"),
+    ("Reset Exposure", "ექსპოზიციის ჩამოყრა"),
+    ("Show Channel and Color Management Settings", "არხისა და ფერთა მართვის პარამეტრების ჩვენება"),
+    ("Show Snapshot (hold)", "მომენტალური ასლის ჩვენება (დაჭერით)"),
+    ("Take Snapshot", "მომენტალური ასლის გადაღება"),
+    ("Third", "მესამედი"),
+    ("Toggle Mask and Shape Path Visibility", "ნიღბისა და ფიგურის ტრაექტორიის ხილვადობის გადართვა"),
+    ("Toggle Transparency Grid", "გამჭვირვალობის ბადის გადართვა"),
+    ("16 bits per channel", "16 ბიტი არხზე"),
+    ("32 bits per channel (float)", "32 ბიტი არხზე (მცურავი)"),
+    ("8 bits per channel", "8 ბიტი არხზე"),
+    ("Adaptive Resolution", "ადაპტური გარჩევადობა"),
+    ("Adobe-style built-in", "ჩაშენებული, Adobe-ს სტილის"),
+    ("Blue", "ლურჯი"),
+    ("Current Settings", "მიმდინარე პარამეტრები"),
+    ("Disable Per-character 3D", "თითოეული ასოს 3D-ს გამორთვა"),
+    ("Draft", "მონახაზი"),
+    ("Enable Per-character 3D", "თითოეული ასოს 3D-ს ჩართვა"),
+    ("Fast Draft", "სწრაფი მონახაზი"),
+    ("Fast Previews (Draft 3D, Faster Effects)", "სწრაფი წინასწარი ნახვა (3D მონახაზი, უფრო სწრაფი ეფექტები)"),
+    ("Green", "მწვანე"),
+    ("Import Image Sequence", "გამოსახულებების თანმიმდევრობის იმპორტი"),
+    ("Import PDF / Illustrator File", "PDF / Illustrator ფაილის იმპორტი"),
+    ("Import Photoshop File", "Photoshop ფაილის იმპორტი"),
+    ("Interpret Unlabeled Alpha As", "უცნობი ალფას ინტერპრეტაცია"),
+    ("Join the ArtCraft Discord", "შემოგვიერთდით Discord-ზე"),
+    ("GPU Acceleration ({})", "GPU აჩქარება ({})"),
+    ("Software Rendering", "პროგრამული რენდერი"),
+    ("OCIO (built-in ACES config)", "OCIO (ჩაშენებული ACES კონფიგურაცია)"),
+    ("Off (Final Quality)", "გამორთული (საბოლოო ხარისხი)"),
+    ("OpenGL (compatibility)", "OpenGL (თავსებადობა)"),
+    ("Opus Bitrate: {} kbps", "Opus-ის ბიტრეიტი: {} kbps"),
+    ("RGB Straight", "RGB Straight"),
+    ("Red", "წითელი"),
+    ("Tone map", "ტონური რუკა"),
+    ("Use In-Window Menu Bar on macOS", "ფანჯრის შიდა მენიუს ზოლის გამოყენება macOS-ზე"),
+    ("Wireframe", "კარკასი"),
+    ("sRGB IEC61966-2.1 (default)", "sRGB IEC61966-2.1 (ნაგულისხმევი)"),
+    ("New Project", "ახალი პროექტი"),
+    ("Open Project…", "პროექტის გახსნა…"),
+    ("Templates", "შაბლონები"),
+    ("EffectCraft home page", "EffectCraft-ის საწყისი გვერდი"),
+    ("EffectCraft on GitHub", "EffectCraft GitHub-ზე"),
+    ("Motion graphics and visual effects · version {}", "მოძრავი გრაფიკა და ვიზუალური ეფექტები · ვერსია {}"),
+    ("New Composition", "ახალი კომპოზიცია"),
+    ("Open Demo Project", "დემო-პროექტის გახსნა"),
+    ("Import Footage…", "ვიდეომასალის იმპორტი…"),
+    ("Filter recent files", "ბოლო ფაილების გაფილტვრა"),
+    ("NAME", "სახელი"),
+    ("OPENED", "გახსნილია"),
+    ("SIZE", "ზომა"),
+    ("KIND", "სახეობა"),
+    ("Your recent files will show here", "ბოლოდროინდელი ფაილები აქ გამოჩნდება"),
+    ("Create a new project, or open the demo project to look around.", "შექმენით ახალი პროექტი, ან გახსენით სადემონსტრაციო პროექტი გასაცნობად."),
+    ("No recent files match the filter", "ფილტრს ბოლოდროინდელი ფაილები არ შეესაბამება"),
+    ("Try another name or folder.", "სცადეთ სხვა სახელი ან საქაღალდე."),
+    ("Just now", "ახლახან"),
+    ("Yesterday", "გუშინ"),
+    ("{} minute ago", "{} წუთის წინ"),
+    ("{} minutes ago", "{} წუთის წინ"),
+    ("{} hour ago", "{} საათის წინ"),
+    ("{} hours ago", "{} საათის წინ"),
+    ("{} day ago", "{} დღის წინ"),
+    ("{} days ago", "{} დღის წინ"),
+    ("EffectCraft project", "EffectCraft-ის პროექტი"),
+    ("After Effects project", "After Effects-ის პროექტი"),
+    ("Lottie animation", "Lottie ანიმაცია"),
+    ("Project", "პროექტი"),
+    ("General", "ზოგადი"),
+    ("Language", "ენა"),
+    ("Levels of Undo", "დაბრუნების დონეები"),
+    ("Path Point and Handle Size", "წერტილისა და სახელურის ზომა"),
+    ("Recent Projects Shown", "ნაჩვენები ბოლო პროექტები"),
+    ("Options", "პარამეტრები"),
+    ("Show Tool Tips", "მინიშნებების ჩვენება"),
+    ("Create Layers at Composition Start Time", "შრეების შექმნა კომპოზიციის დაწყების დროზე"),
+    ("Switches Affect Nested Comps", "გადამრთველები მოქმედებს ჩადგმულ კომპოზიციებზე"),
+    ("Default Spatial Interpolation to Linear", "ნაგულისხმევი სივრცითი ინტერპოლაცია: წრფივი"),
+    (
+        "Preserve Constant Vertex and Feather Point Count when Editing Masks",
+        "ნიღბების რედაქტირებისას წვეროებისა და შერბილების წერტილების რაოდენობის შენარჩუნება",
+    ),
+    ("Synchronize Time of All Related Items", "ყველა დაკავშირებული ელემენტის დროის სინქრონიზაცია"),
+    ("Expression Pick Whip Writes Compact English", "ექსპრესიის ბმის სპირალი წერს კომპაქტურ ინგლისურს"),
+    ("Create Split Layers Above Original Layer", "დაყოფილი შრეების შექმნა საწყისი შრის ზემოთ"),
+    ("Use System Color Picker", "სისტემის ფერის ამომრჩევის გამოყენება"),
+    (
+        "EffectCraft always uses its own colour picker (the same on every platform and the web).",
+        "EffectCraft ყოველთვის საკუთარ ფერის ამომრჩევს იყენებს (ერთნაირს ყველა პლატფორმაზე და ვებში).",
+    ),
+    ("Startup & Repair", "გაშვება და აღდგენა"),
+    ("Show Home Screen When Launching", "საწყისი ეკრანის ჩვენება გაშვებისას"),
+    ("Show Home Screen When Opening a Project", "საწყისი ეკრანის ჩვენება პროექტის გახსნისას"),
+    ("Offer to Open the Latest Auto-Save After a Crash", "ავარიის შემდეგ ბოლო ავტოშენახვის გახსნის შეთავაზება"),
+    ("Window Graphics", "ფანჯრის გრაფიკა"),
+    ("Automatic", "ავტომატური"),
+    (
+        "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
+        "ფანჯრის გრაფიკა მოქმედებს შემდეგი გაშვებიდან. თუ გრაფიკის დრაივერი EffectCraft-ს ფანჯრის გახსნისას აჩერებს, შემდეგი გაშვება OpenGL-ზე გადაერთვება.",
+    ),
+    ("Repair", "აღდგენა"),
+    ("Reset Settings", "პარამეტრების ჩამოყრა"),
+    ("Reset Keyboard Shortcuts", "კლავიატურის მალსახმობების ჩამოყრა"),
+    ("Empty Disk Cache", "დისკის ქეშის გასუფთავება"),
+    ("New Project Loads Template", "ახალი პროექტი შაბლონს ტვირთავს"),
+    ("Template Project", "შაბლონი პროექტი"),
+    ("Auto-Save", "ავტოშენახვა"),
+    ("Automatically Save Projects", "პროექტების ავტომატური შენახვა"),
+    ("Save Every", "შენახვა ყოველ"),
+    ("Minutes", "წუთში"),
+    ("Maximum Project Versions", "ვერსიების მაქსიმალური რაოდენობა"),
+    ("Auto-Save Location", "ავტოშენახვის მდებარეობა"),
+    ("Next to Project", "პროექტის გვერდით"),
+    ("Custom Location", "სხვა მდებარეობა"),
+    ("Save When Starting Render Queue", "შენახვა რენდერის რიგის დაწყებისას"),
+    ("Save Now", "ახლავე შენახვა"),
+    ("Motion Path", "მოძრაობის ტრაექტორია"),
+    ("All Keyframes", "ყველა საკვანძო კადრი"),
+    ("No Motion Path", "მოძრაობის ტრაექტორიის გარეშე"),
+    ("No More Than (Seconds)", "არაუმეტეს (წამი)"),
+    ("No More Than (Keyframes)", "არაუმეტეს (საკვანძო კადრი)"),
+    ("Seconds", "წამი"),
+    ("Keyframes", "საკვანძო კადრები"),
+    ("Display", "ეკრანი"),
+    ("Show Rendering Progress in Info Panel and Flowchart", "რენდერის პროგრესის ჩვენება ინფორმაციის პანელსა და ბლოკ-სქემაში"),
+    ("Hardware Accelerate Composition, Layer and Footage Panels", "კომპოზიციის, შრისა და ვიდეომასალის პანელების აპარატული აჩქარება"),
+    ("Panels are always drawn by the GPU (wgpu).", "პანელებს ყოველთვის GPU ხატავს (wgpu)."),
+    ("Previews", "წინასწარი ნახვა"),
+    ("Adaptive Resolution Limit", "ადაპტური გარჩევადობის ზღვარი"),
+    ("Show Internal Wireframes", "შიდა კარკასების ჩვენება"),
+    ("Cache Frames When Idle", "კადრების ქეშირება უქმობისას"),
+    ("Viewer Zoom Quality", "დამთვალიერებლის მასშტაბის ხარისხი"),
+    ("Faster", "უფრო სწრაფი"),
+    ("More Accurate", "უფრო ზუსტი"),
+    ("Display Color Space", "ეკრანის ფერთა სივრცე"),
+    ("GPU Information...", "ინფორმაცია GPU-ს შესახებ..."),
+    ("Appearance", "იერსახე"),
+    ("Brightness", "სიკაშკაშე"),
+    ("UI Scale", "ინტერფეისის მასშტაბი"),
+    ("Labels and Colors", "იარლიყები და ფერები"),
+    ("Use Label Color for Layer Handles and Paths", "იარლიყის ფერის გამოყენება შრის სახელურებისა და ტრაექტორიებისთვის"),
+    ("Use Label Color for Related Tabs", "იარლიყის ფერის გამოყენება დაკავშირებული ჩანართებისთვის"),
+    ("Cycle Mask Colors", "ნიღბის ფერების მონაცვლეობა"),
+    ("Use Gradients", "გრადიენტების გამოყენება"),
+    ("Menu Bar", "მენიუს ზოლი"),
+    ("Grids & Guides", "ბადე და დამხმარე ხაზები"),
+    ("Gridline Every", "ბადის ხაზი ყოველ"),
+    ("Subdivisions", "ქვედანაყოფები"),
+    ("Style", "სტილი"),
+    ("Lines", "ხაზები"),
+    ("Dashed Lines", "წყვეტილი ხაზები"),
+    ("Dots", "წერტილები"),
+    ("Horizontal", "ჰორიზონტალური"),
+    ("Vertical", "ვერტიკალური"),
+    ("Safe Margins", "უსაფრთხო ზღვრები"),
+    ("Action-safe", "მოქმედების უსაფრთხო არე"),
+    ("Title-safe", "ტიტრების უსაფრთხო არე"),
+    ("Labels", "იარლიყები"),
+    ("Text Engine", "ტექსტის ძრავა"),
+    ("Latin", "ლათინური"),
+    ("South Asian and Middle Eastern", "სამხრეთაზიური და ახლო აღმოსავლური"),
+    ("Show Font Preview", "შრიფტის წინასწარი ნახვის ჩვენება"),
+    ("Number of Recent Fonts to Display", "ბოლო შრიფტების რაოდენობა"),
+    ("Show Font Names in English", "შრიფტების სახელების ინგლისურად ჩვენება"),
+    ("Still Footage", "უძრავი ვიდეომასალა"),
+    ("Length of Composition", "კომპოზიციის სიგრძე"),
+    ("Duration (Seconds)", "ხანგრძლივობა (წამი)"),
+    ("Still Duration", "უძრავი კადრის ხანგრძლივობა"),
+    ("Sequence Footage", "სეკვენციური ვიდეომასალა"),
+    ("Report Missing Frames", "გამოტოვებული კადრების შეტყობინება"),
+    ("Automatically Reload Footage", "ავტომატური ხელახლა ჩატვირთვა"),
+    ("Off", "გამორთული"),
+    ("Non-Sequence Footage", "არასეკვენციური ვიდეომასალა"),
+    ("All Footage", "მთელი ვიდეომასალა"),
+    ("Ask User", "მომხმარებლისთვის კითხვა"),
+    ("Guess", "ვარაუდი"),
+    ("Ignore", "უგულებელყოფა"),
+    ("Straight", "პირდაპირი"),
+    ("Premultiplied", "წინასწარ გამრავლებული"),
+    ("Default Drag Import As", "გადათრევით იმპორტი როგორც"),
+    ("Footage", "ვიდეომასალა"),
+    ("Composition - Retain Layer Sizes", "კომპოზიცია - შრეების ზომების შენარჩუნებით"),
+    ("Export", "ექსპორტი"),
+    ("Default Output Folder", "ნაგულისხმევი გამოტანის საქაღალდე"),
+    ("Segment Sequences", "სეკვენციების სეგმენტებად დაყოფა"),
+    ("Files per Segment", "ფაილი სეგმენტში"),
+    ("files", "ფაილი"),
+    ("Segment Movie Files", "ვიდეოფაილების სეგმენტებად დაყოფა"),
+    ("Segment Size", "სეგმენტის ზომა"),
+    ("Append Bit Depth to File Name", "ბიტური სიღრმის ფაილის სახელზე დამატება"),
+    ("Audio", "აუდიო"),
+    ("Audio Hardware", "აუდიოაპარატურა"),
+    ("Preview Sample Rate", "ნახვის დისკრეტიზაციის სიხშირე"),
+    ("Audio Output Mapping", "აუდიოს გამოტანის ასახვა"),
+    ("Left", "მარცხენა"),
+    ("Right", "მარჯვენა"),
+    ("channel", "არხი"),
+    ("Disk", "დისკი"),
+    ("Disk Cache", "დისკის ქეში"),
+    ("Enable Disk Cache", "დისკის ქეშის ჩართვა"),
+    ("Maximum Disk Cache Size", "დისკის ქეშის მაქსიმალური ზომა"),
+    ("Disk Cache Folder", "დისკის ქეშის საქაღალდე"),
+    ("Media Cache", "მედიაქეში"),
+    ("Database and Cache Folder", "მონაცემთა ბაზისა და ქეშის საქაღალდე"),
+    ("Conformed Audio Folder", "მისადაგებული აუდიოს საქაღალდე"),
+    ("Memory & CPU", "მეხსიერება და CPU"),
+    ("RAM Reserved for Other Applications", "სხვა აპლიკაციებისთვის დაჯავშნული RAM"),
+    ("Cache Budgets", "ქეშის ლიმიტები"),
+    ("Layer Cache", "შრეების ქეში"),
+    ("Footage Frame Cache", "ვიდეომასალის კადრების ქეში"),
+    ("Preview (RAM) Cache", "წინასწარი ნახვის (RAM) ქეში"),
+    ("Reduce Cache Size When System Is Low on Memory", "ქეშის ზომის შემცირება, როცა სისტემას მეხსიერება აკლია"),
+    ("Video", "ვიდეო"),
+    ("Enable Video Preview Output", "ვიდეოს წინასწარი ნახვის გამოტანის ჩართვა"),
+    ("Video Device", "ვიდეომოწყობილობა"),
+    ("Floating Window", "მცურავი ფანჯარა"),
+    ("Full Screen", "მთელ ეკრანზე"),
+    ("Video Output During Playback", "ვიდეოს გამოტანა დაკვრისას"),
+    ("Mirror on Computer Monitor", "დუბლირება კომპიუტერის მონიტორზე"),
+    ("Disable Video Output When in Background", "ვიდეოს გამოტანის გამორთვა ფონურ რეჟიმში"),
+    ("Default 3D Renderer", "ნაგულისხმევი 3D რენდერერი"),
+    ("Show 3D Reference Axes", "3D საორიენტაციო ღერძების ჩვენება"),
+    ("Extended Viewer", "გაფართოებული დამთვალიერებელი"),
+    ("Realtime Shadows in Draft", "რეალურ დროში ჩრდილები მონახაზში"),
+    ("Scripting & Expressions", "სკრიპტები და ექსპრესიები"),
+    ("Application Scripting", "აპლიკაციის სკრიპტები"),
+    ("Allow Scripts to Write Files and Access Network", "სკრიპტებისთვის ფაილების ჩაწერისა და ქსელთან წვდომის დაშვება"),
+    ("Warn User When Executing Files", "მომხმარებლის გაფრთხილება ფაილების გაშვებისას"),
+    ("Enable JavaScript Debugger", "JavaScript-ის გამმართველის ჩართვა"),
+    ("Expressions Editor", "ექსპრესიების რედაქტორი"),
+    ("Font Size", "შრიფტის ზომა"),
+    ("Syntax Highlighting", "სინტაქსის გამოკვეთა"),
+    ("Line Numbers", "სტრიქონების ნომრები"),
+    ("Auto-complete", "ავტოდასრულება"),
+    ("Bracket Matching", "ფრჩხილების დაწყვილება"),
+    ("Word Wrap", "სიტყვების გადატანა"),
+    ("Show Expression Error Banner", "ექსპრესიის შეცდომის ზოლის ჩვენება"),
+    (
+        "Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger.",
+        "ექსპრესიები JavaScript-ის ძრავას იყენებს. სკრიპტის შეცდომები ფაილსა და სტრიქონს სკრიპტის კონსოლში აჩვენებს; ნაბიჯ-ნაბიჯ გამმართველი არ არის.",
+    ),
+    ("Roto Brush", "როტო-ფუნჯი"),
+    ("Segmentation Model", "სეგმენტაციის მოდელი"),
+    (
+        "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "როტო-ფუნჯი 2.0 და 3.0 აქ არჩეულ მოდელს იყენებს (ვერსია 1.0 ყოველთვის კლასიკურ ძრავას იყენებს). მოდელები ღია კოდისაა, ჩამოიტვირთება მხოლოდ თქვენი მოთხოვნით და მოწმდება გამოქვეყნებული SHA-256-ით.",
+    ),
+    ("Face Tracking", "სახის ტრეკინგი"),
+    ("Face Model", "სახის მოდელი"),
+    (
+        "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "ტრეკერის პანელში სახის ტრეკინგი (მხოლოდ კონტური და დეტალური ნიშნები) აქ არჩეულ მოდელს იყენებს. მოდელები ღია კოდისაა, ჩამოიტვირთება მხოლოდ თქვენი მოთხოვნით და მოწმდება გამოქვეყნებული SHA-256-ით.",
+    ),
+    ("Match System", "სისტემის მიხედვით"),
+    ("Default", "ნაგულისხმევი"),
+    ("Stored, but not used by EffectCraft yet", "შენახულია, მაგრამ EffectCraft ჯერ არ იყენებს"),
+    ("Total Offset", "ჯამური წანაცვლება"),
+    ("Per Layer", "შრიდან შრემდე"),
+    ("Track", "ტრეკინგი"),
+    ("Video Scopes", "ვიდეოსკოპები"),
+];
+
+/// Georgian rows for interface text no other catalog has yet: strings the panels already send
+/// through [`tr`] (form fields and titles, drop messages, screen-reader names) and the labels of
+/// the Timeline's context menus. Kept apart from [`GEORGIAN`] so that table can keep listing
+/// exactly the Chinese catalogs' sources; the tests hold these to the same rules.
+const GEORGIAN_PANELS: &[(&str, &str)] = &[
+    ("Search project", "პროექტში ძიება"),
+    ("Select an item to see its details", "მონიშნეთ ელემენტი დეტალებისთვის"),
+    ("Media Duration", "მედიის ხანგრძლივობა"),
+    ("Frame Rate", "კადრების სიხშირე"),
+    ("File Path", "ფაილის მისამართი"),
+    ("Comment", "კომენტარი"),
+    ("A/V Features", "A/V ფუნქციები"),
+    ("Keys", "საკვანძო კადრები"),
+    ("Layer Name", "შრის სახელი"),
+    ("Source Name", "წყაროს სახელი"),
+    ("Switches", "გადამრთველები"),
+    ("Modes", "რეჟიმები"),
+    ("Track Matte", "ტრეკ-მატი"),
+    ("Parent & Link", "მშობელი და ბმა"),
+    ("In", "შესვლა"),
+    ("Out", "გამოსვლა"),
+    ("Duration", "ხანგრძლივობა"),
+    ("Original color: click to go back to it", "საწყისი ფერი: დაწკაპეთ მასზე დასაბრუნებლად"),
+    ("Resize floating panel", "მცურავი პანელის ზომის შეცვლა"),
+    ("Render every n-th pixel", "ყოველი n-ური პიქსელის რენდერი"),
+    ("Color (#rrggbb)", "ფერი (#rrggbb)"),
+    ("Workspace", "სამუშაო სივრცე"),
+    ("Rename to", "ახალი სახელი"),
+    ("Open", "გახსნა"),
+    ("Custom Resolution", "მორგებული გარჩევადობა"),
+    ("Panel Background Color", "პანელის ფონის ფერი"),
+    ("New Workspace", "ახალი სამუშაო სივრცე"),
+    ("Edit Workspaces", "სამუშაო სივრცეების რედაქტირება"),
+    ("A script wants to open a file", "სკრიპტს ფაილის გახსნა სურს"),
+    ("Drop file to import", "ჩააგდეთ ფაილი იმპორტისთვის"),
+    ("Drop {} files to import", "ჩააგდეთ ფაილები იმპორტისთვის: {}"),
+    (
+        "Skipped {} dropped file(s) without a local path. Use File ▸ Import ▸ File…",
+        "გამოტოვებულია ჩაგდებული ფაილი ლოკალური მისამართის გარეშე: {}. გამოიყენეთ ფაილი ▸ იმპორტი ▸ ფაილი…",
+    ),
+    ("Only one project can be opened per drop; skipped {} more", "ერთ ჩაგდებაზე მხოლოდ ერთი პროექტი იხსნება; გამოტოვებულია კიდევ: {}"),
+    ("Cannot open dropped project {}: {}", "ჩაგდებული პროექტის გახსნა შეუძლებელია, {}: {}"),
+    ("Cannot import dropped files: {}", "ჩაგდებული ფაილების იმპორტი შეუძლებელია: {}"),
+    ("A built-in preset has this name", "ამ სახელით ჩაშენებული პრესეტი არსებობს"),
+    ("Replaces your preset with this name", "ჩაანაცვლებს თქვენს პრესეტს ამ სახელით"),
+    ("Save Preset…", "პრესეტის შენახვა…"),
+    ("Delete Preset", "პრესეტის წაშლა"),
+    ("Null Settings", "ნულოვანი ობიექტის პარამეტრები"),
+    ("Click to sample text {}", "დაწკაპეთ ტექსტის ნიმუშის ასაღებად {}"),
+    ("Force alphabetical order", "ანბანური რიგის იძულება"),
+    ("Frame rate (fps)", "კადრების სიხშირე (fps)"),
+    (
+        "Change the frame rate, alpha and start frame later with File ▸ Interpret Footage.",
+        "კადრების სიხშირე, ალფა და საწყისი კადრი მოგვიანებით შეცვალეთ: ფაილი ▸ ვიდეომასალის ინტერპრეტაცია.",
+    ),
+    ("Import Kind", "იმპორტის სახე"),
+    ("Page", "გვერდი"),
+    ("Delay (s)", "დაყოვნება (წმ)"),
+    ("Amount (%)", "რაოდენობა (%)"),
+    ("Cascade (farther pins trail longer)", "კასკადი (შორეული სამაგრები უფრო დიდხანს ჩამორჩება)"),
+    ("Speed (%)", "სიჩქარე (%)"),
+    ("Smoothing", "დაგლუვება"),
+    ("Use Draft Deformation", "მონახაზის დეფორმაციის გამოყენება"),
+    ("Show Mesh", "ბადის ჩვენება"),
+    ("Scale X (%)", "მასშტაბი X (%)"),
+    ("Scale Y (%)", "მასშტაბი Y (%)"),
+    ("Rotation (degrees)", "შემობრუნება (გრადუსი)"),
+    ("Move X", "გადაადგილება X"),
+    ("Move Y", "გადაადგილება Y"),
+    ("Top", "ზემოდან"),
+    ("Width", "სიგანე"),
+    ("Height", "სიმაღლე"),
+    ("Shape", "ფიგურა"),
+    ("Mode", "რეჟიმი"),
+    ("Frame", "კადრი"),
+    ("Orientation", "ორიენტაცია"),
+    ("Position (pixels)", "პოზიცია (პიქსელი)"),
+    ("Position (percent of the composition)", "პოზიცია (კომპოზიციის პროცენტი)"),
+    ("Create", "შექმნა"),
+    ("Use Dimensions From", "ზომების აღება"),
+    ("Still Duration (seconds)", "უძრავი კადრის ხანგრძლივობა (წამი)"),
+    ("Add to Render Queue", "რენდერის რიგში დამატება"),
+    ("Sequence Layers", "შრეების თანმიმდევრობით განლაგება"),
+    ("Overlap", "გადაფარვა"),
+    ("Duration (seconds)", "ხანგრძლივობა (წამი)"),
+    ("Transition", "გადასვლა"),
+    ("Matte color (premultiplied)", "მატის ფერი (წინასწარ გამრავლებული)"),
+    ("Invert Alpha", "ალფას ინვერსია"),
+    ("Assume this frame rate", "ამ კადრების სიხშირის გამოყენება"),
+    ("Separate Fields", "ნახევარკადრების გაყოფა"),
+    ("Pixel Aspect Ratio", "პიქსელის გვერდების თანაფარდობა"),
+    ("Loop (times)", "ციკლი (ჯერ)"),
+    ("Assign Profile", "პროფილის მინიჭება"),
+    ("Preserve RGB", "RGB-ის შენარჩუნება"),
+    ("Interpret As Linear Light", "წრფივ სინათლედ ინტერპრეტაცია"),
+    ("Start Timecode", "საწყისი თაიმკოდი"),
+    ("Override Start", "დასაწყისის ხელით მითითება"),
+    ("Depth", "სიღრმე"),
+    ("Time display style", "დროის ჩვენების სტილი"),
+    ("Color engine", "ფერთა ძრავა"),
+    ("Working space", "სამუშაო სივრცე"),
+    ("Working gamma", "სამუშაო გამა"),
+    ("Linearize working space", "სამუშაო სივრცის წრფივად გარდაქმნა"),
+    ("Blend colors using 1.0 gamma", "ფერების შერევა 1.0 გამით"),
+    ("HDR on SDR displays and outputs", "HDR SDR ეკრანებსა და გამოტანებზე"),
+    ("Output color space", "გამოტანის ფერთა სივრცე"),
+    ("Video rendering and effects", "ვიდეოს რენდერი და ეფექტები"),
+    ("Time Span", "დროის მონაკვეთი"),
+    ("Invert", "ინვერსია"),
+    ("Blur (pixels before auto-trace)", "გაბუნდოვნება (პიქსელი, ვექტორიზაციამდე)"),
+    ("Tolerance (pixels)", "დაშვება (პიქსელი)"),
+    ("Threshold (%)", "ზღვარი (%)"),
+    ("Minimum Area (pixels)", "მინიმალური ფართობი (პიქსელი)"),
+    ("Corner Roundness (%)", "კუთხეების მომრგვალება (%)"),
+    ("Apply To New Layer", "ახალ შრეზე გამოყენება"),
+    ("Action", "მოქმედება"),
+    ("Sensitivity threshold (0–1, lower finds more)", "მგრძნობელობის ზღვარი (0–1, ნაკლები მეტს პოულობს)"),
+    ("Data", "მონაცემები"),
+    ("Time field (empty: automatic)", "დროის ველი (ცარიელი: ავტომატური)"),
+    ("Video start (ISO date-time, hh:mm:ss, timecode; empty: file date)", "ვიდეოს დასაწყისი (ISO თარიღი-დრო, hh:mm:ss, თაიმკოდი; ცარიელი: ფაილის თარიღი)"),
+    ("First sample at (comp seconds)", "პირველი ნიმუში (კომპოზიციის წამი)"),
+    (
+        "Writes Final Cut Pro XML (.xml), which Premiere Pro opens with File ▸ Import. Native .prproj files are not written.",
+        "იწერს Final Cut Pro XML-ს (.xml), რომელსაც Premiere Pro ხსნის ბრძანებით File ▸ Import. მშობლიური .prproj ფაილები არ იწერება.",
+    ),
+    ("File", "ფაილი"),
+    ("Format", "ფორმატი"),
+    ("Pre-render (ProRes 4444)", "წინასწარი რენდერი (ProRes 4444)"),
+    ("Precomps", "ჩადგმული კომპოზიციები"),
+    ("Frame rate", "კადრების სიხშირე"),
+    ("Description", "აღწერა"),
+    ("Category", "კატეგორია"),
+    ("Embed footage files", "ვიდეომასალის ფაილების ჩაშენება"),
+    ("Embed up to (MB)", "ჩაშენება მაქსიმუმ (MB)"),
+    ("Use the sRGB curve (ignore Gamma)", "sRGB მრუდის გამოყენება (გამის უგულებელყოფა)"),
+    ("ICC profile (replaces the numbers)", "ICC პროფილი (ცვლის რიცხვებს)"),
+    ("Rectangle", "მართკუთხედი"),
+    ("Ellipse", "ელიფსი"),
+    ("Orient Along Path", "ორიენტაცია ტრაექტორიის გასწვრივ"),
+    ("Orient Towards Camera", "ორიენტაცია კამერისკენ"),
+    ("Orient Towards Point of Interest", "ორიენტაცია ინტერესის წერტილისკენ"),
+    ("Single Composition", "ერთი კომპოზიცია"),
+    ("Multiple Compositions", "რამდენიმე კომპოზიცია"),
+    ("Dissolve Front Layer", "წინა შრის გადადნობა"),
+    ("Cross Dissolve Front and Back Layers", "წინა და უკანა შრეების ჯვარედინი გადადნობა"),
+    ("Interpret Straight - Unmatted", "პირდაპირად ინტერპრეტაცია - მატის გარეშე"),
+    ("Interpret Premultiplied - Matted With Color", "წინასწარ გამრავლებულად ინტერპრეტაცია - ფერით მატირებული"),
+    ("Upper Field First", "ჯერ ზედა ნახევარკადრი"),
+    ("Lower Field First", "ჯერ ქვედა ნახევარკადრი"),
+    ("Embedded / sRGB", "ჩაშენებული / sRGB"),
+    ("Use Source File Timecode", "წყარო ფაილის თაიმკოდის გამოყენება"),
+    ("Timecode", "თაიმკოდი"),
+    ("Frames", "კადრები"),
+    ("Feet + Frames (35mm)", "ფუტი + კადრი (35 მმ)"),
+    ("Feet + Frames (16mm)", "ფუტი + კადრი (16 მმ)"),
+    ("Clip", "მოჭრა"),
+    ("Compand", "კომპანდირება"),
+    ("Current Frame", "მიმდინარე კადრი"),
+    ("Work Area", "სამუშაო არე"),
+    ("Luminance", "სიკაშკაშე"),
+    ("Create Markers", "მარკერები"),
+    ("Split Layers", "შრეების დაყოფა"),
+    ("Split and Precompose", "დაყოფა და კომპოზიციაში მოთავსება"),
+    ("CMX 3600 EDL (.edl, V1 only)", "CMX 3600 EDL (.edl, მხოლოდ V1)"),
+    ("OMF (.omf, audio)", "OMF (.omf, აუდიო)"),
+    ("Layers Premiere can't show (text, shapes, effects…)", "Premiere-ში უხილავი შრეები"),
+    ("All layers", "ყველა შრე"),
+    ("None (leave them out)", "არცერთი (გამოტოვება)"),
+    ("Nested sequences", "ჩადგმული სეკვენციები"),
+    ("Pre-render", "წინასწარი რენდერი"),
+    ("Puppet Follow-Through", "მარიონეტის ინერციული მოძრაობა"),
+    ("Puppet Record Options", "მარიონეტის ჩაწერის პარამეტრები"),
+    ("Free Transform Points", "წერტილების თავისუფალი გარდაქმნა"),
+    ("Mask Shape", "ნიღბის ფორმა"),
+    ("Auto-Orientation", "ავტოორიენტაცია"),
+    ("Go to Time", "დროზე გადასვლა"),
+    ("Add Guide", "დამხმარე ხაზის დამატება"),
+    ("Add Percentage Guide", "პროცენტული დამხმარე ხაზის დამატება"),
+    ("New Composition from Selection", "ახალი კომპოზიცია მონიშნულიდან"),
+    ("Project Settings", "პროექტის პარამეტრები"),
+    ("Auto-trace", "ავტომატური ვექტორიზაცია"),
+    ("Scene Edit Detection", "სცენების ჭრილების ამოცნობა"),
+    ("Align Video to Data", "ვიდეოს მონაცემებთან სწორება"),
+    ("Export Adobe Premiere Pro Project", "Adobe Premiere Pro-ს პროექტის ექსპორტი"),
+    ("New Placeholder", "ახალი ჩანაცვლების ობიექტი"),
+    ("Solid Settings", "სოლიდის პარამეტრები"),
+    ("Save as Template", "შაბლონად შენახვა"),
+    ("My Custom RGB", "ჩემი მორგებული RGB"),
+    ("GPU Acceleration (no GPU: software)", "GPU აჩქარება (GPU არ არის: პროგრამული)"),
+    ("Sort by {}, {}", "დალაგება: {}, {}"),
+    ("Sort by {}", "დალაგება: {}"),
+    ("Label of {}: {}", "{}-ის იარლიყი: {}"),
+    ("Comment of {}: {}", "{}-ის კომენტარი: {}"),
+    ("Project color depth: {}", "პროექტის ფერის სიღრმე: {}"),
+    ("Start (s)", "დასაწყისი (წმ)"),
+    ("Duration (s)", "ხანგრძლივობა (წმ)"),
+    ("Frames per second", "კადრი წამში"),
+    ("Bottom", "ქვემოდან"),
+    ("Bitrate (kbps)", "ბიტრეიტი (kbps)"),
+    ("Frames between key frames (0 = every 2 s)", "კადრები საკვანძო კადრებს შორის (0 = ყოველ 2 წმ-ში)"),
+    ("Click in the Composition panel to sample text {}", "დაწკაპეთ კომპოზიციის პანელში ტექსტის ნიმუშის ასაღებად {}"),
+    ("Video preview off: audio only", "ვიდეოს წინასწარი ნახვა გამორთულია: მხოლოდ აუდიო"),
+    ("Open in Essential Graphics", "ძირითად გრაფიკაში გახსნა"),
+    ("Video preview is off (Preview panel): audio only", "ვიდეოს წინასწარი ნახვა გამორთულია (წინასწარი ნახვის პანელი): მხოლოდ აუდიო"),
+    ("Solid…", "სოლიდი…"),
+];
+
+/// French: vouvoiement, infinitive for commands, sentence case; the same source strings as the other
+/// panel catalogs together (the Chinese ones, Georgian's extra panel rows and the literals the converted
+/// panels pass to `tr`). Terms follow the French menu catalog in [`super`] (composition, calque, image
+/// clé, métrage, file d'attente de rendu, chronologie, repère, estampe). A no-break space precedes
+/// `:`, `;`, `?` and `!`, and the apostrophe is the typographic one. Written from the English source.
+const FRENCH: &[(&str, &str)] = &[
+    ("Appearance Settings…", "Paramètres d’apparence…"),
+    ("Add to favorites", "Ajouter aux favoris"),
+    ("Remove from favorites", "Retirer des favoris"),
+    ("   OK   ", "   OK   "),
+    ("  Delete  ", "  Supprimer  "),
+    (" Open Auto-Save ", " Ouvrir l’enregistrement automatique "),
+    ("(missing)", "(manquant)"),
+    ("360 View Orientation", "Orientation de la vue 360°"),
+    ("3:2 Pulldown: {}", "Pulldown 3:2 : {}"),
+    (
+        "A clean-room, open-source compositor for motion graphics and visual effects: native on macOS, Windows and Linux, and in the browser. Part of the ArtCraft family of creative apps.",
+        "Un compositeur open source, développé en salle blanche, pour le motion design et les effets visuels : natif sur macOS, Windows et Linux, ainsi que dans le navigateur. Fait partie de la famille d’applications créatives ArtCraft.",
+    ),
+    ("About EffectCraft", "À propos d’EffectCraft"),
+    ("About...", "À propos..."),
+    ("Active", "Actif"),
+    ("Active Camera", "Caméra active"),
+    ("Alpha", "Alpha"),
+    ("Adapt Feature On Every Frame", "Adapter la caractéristique à chaque image"),
+    ("Adaptive Sample Limit:", "Limite d’échantillons adaptatifs :"),
+    ("Add Animator", "Ajouter un animateur"),
+    ("Add Comment", "Ajouter un commentaire"),
+    ("Add Formatting", "Ajouter une mise en forme"),
+    ("Add Group", "Ajouter un groupe"),
+    ("Add Mirror", "Ajouter un miroir"),
+    ("Add Selected As", "Ajouter la sélection comme"),
+    ("Add a comment", "Ajouter un commentaire"),
+    ("Add a shape, fill, stroke or path operation", "Ajouter une forme, un remplissage, un contour ou une opération sur le tracé"),
+    ("Add to Composition", "Ajouter à la composition"),
+    ("Add to Favorites", "Ajouter aux favoris"),
+    ("Add:", "Ajouter :"),
+    ("Adjust Exposure (stops)", "Ajuster l’exposition (diaphs)"),
+    (
+        "Adjust composition duration to the time span of the selected layers",
+        "Ajuster la durée de la composition à l’intervalle de temps des calques sélectionnés",
+    ),
+    ("Advanced 3D", "3D avancée"),
+    ("Align Layers to:", "Aligner les calques sur :"),
+    ("All six face cameras turn together; the scene is not changed.", "Les six caméras des faces tournent ensemble ; la scène n’est pas modifiée."),
+    ("Anchor:", "Ancrage :"),
+    ("Aperture", "Ouverture"),
+    ("Appearance Mode", "Mode d’apparence"),
+    ("Appearance Mode: {}", "Mode d’apparence : {}"),
+    ("Apply Dimensions:", "Appliquer les dimensions :"),
+    ("Apply Motion To:", "Appliquer le mouvement à :"),
+    ("Arrange", "Disposition"),
+    ("Assign", "Attribuer"),
+    ("Auto", "Auto"),
+    ("Auto-saves", "Enregistrements automatiques"),
+    ("Back", "Retour"),
+    ("Background Color:", "Couleur d’arrière-plan :"),
+    ("Blend Mode:", "Mode de fusion :"),
+    ("Blending Mode", "Mode de fusion"),
+    ("Blur", "Flou"),
+    ("Blur Level", "Niveau de flou"),
+    ("Boundary", "Limite"),
+    ("Browser Storage", "Stockage du navigateur"),
+    ("Browse…", "Parcourir…"),
+    ("Brush Dynamics", "Dynamique du pinceau"),
+    ("Caching frames", "Mise en cache des images"),
+    ("Cancel", "Annuler"),
+    ("Import After Effects Project", "Importer un projet After Effects"),
+    (
+        "Some parts of this project cannot be imported exactly (left out or changed):",
+        "Certaines parties de ce projet ne peuvent pas être importées à l’identique (omises ou modifiées) :",
+    ),
+    ("Import Anyway", "Importer quand même"),
+    ("Casts Shadows", "Projette des ombres"),
+    ("Change Renderer…", "Changer de moteur de rendu…"),
+    (
+        "Changing a shortcut creates a custom preset; the default stays as it is.",
+        "Modifier un raccourci crée un préréglage personnalisé ; le préréglage par défaut reste inchangé.",
+    ),
+    ("Channel", "Canal"),
+    ("Channel:", "Canal :"),
+    ("Chapter:", "Chapitre :"),
+    ("Choose...", "Choisir..."),
+    ("Classic 3D", "3D classique"),
+    ("Clear", "Effacer"),
+    ("Clear list", "Effacer la liste"),
+    ("Click a key to see its commands.", "Cliquez sur une touche pour voir ses commandes."),
+    (
+        "Click above the bar to add an opacity stop, below it to add a color stop.",
+        "Cliquez au-dessus de la barre pour ajouter un point d’arrêt d’opacité, en dessous pour ajouter un point d’arrêt de couleur.",
+    ),
+    ("Click adds a point (½ height = no change)", "Un clic ajoute un point (½ hauteur = aucun changement)"),
+    ("Click adds a point; drag one off to remove", "Un clic ajoute un point ; faites-en glisser un hors de la zone pour le supprimer"),
+    ("Click to make this viewer active", "Cliquez pour activer ce visualiseur"),
+    ("Click to reveal the expression in the timeline", "Cliquez pour révéler l’expression dans la chronologie"),
+    ("Click to show the active composition here", "Cliquez pour afficher ici la composition active"),
+    ("Click, then click in the Composition panel", "Cliquez, puis cliquez dans le panneau Composition"),
+    ("Clone Options", "Options de clonage"),
+    ("Clone Source Overlay:", "Superposition de la source de clonage :"),
+    ("Close", "Fermer"),
+    ("Close Panel", "Fermer le panneau"),
+    ("Close tutorial", "Fermer le tutoriel"),
+    ("Color", "Couleur"),
+    ("Color Depth: {}", "Profondeur de couleur : {}"),
+    ("Color:", "Couleur :"),
+    ("Colour map", "Carte de couleurs"),
+    ("Columns", "Colonnes"),
+    ("Comment:", "Commentaire :"),
+    ("Community", "Communauté"),
+    ("Composition", "Composition"),
+    ("Composition Mini-Flowchart", "Mini-organigramme de composition"),
+    ("Composition Name:", "Nom de la composition :"),
+    ("Composition Settings ▸ 3D Renderer", "Paramètres de composition ▸ Moteur de rendu 3D"),
+    ("Composition Settings…", "Paramètres de composition…"),
+    ("Composition marker bin: drag a marker to the time ruler", "Bac des repères de composition : faites glisser un repère vers la règle temporelle"),
+    ("Cone Angle", "Angle du cône"),
+    ("Cone Feather", "Contour progressif du cône"),
+    ("Constrain Proportions", "Conserver les proportions"),
+    ("Continuous (Lock Outgoing to Incoming)", "Continu (verrouiller la sortie sur l’entrée)"),
+    ("Cue Point", "Point de repère"),
+    ("Current Render", "Rendu en cours"),
+    ("Dark", "Sombre"),
+    ("Dark Theme", "Thème sombre"),
+    ("Darker", "Plus sombre"),
+    ("Default Output:", "Sortie par défaut :"),
+    ("Default: {}", "Par défaut : {}"),
+    ("Defaults", "Valeurs par défaut"),
+    ("Delete", "Supprimer"),
+    ("Delete Selected Points", "Supprimer les points sélectionnés"),
+    ("Delete selected project items", "Supprimer les éléments de projet sélectionnés"),
+    ("Delete this template", "Supprimer ce modèle"),
+    ("Depth of Field", "Profondeur de champ"),
+    ("Discord", "Discord"),
+    ("Distribute Layers:", "Répartir les calques :"),
+    ("Don't Recover", "Ne pas récupérer"),
+    ("Don't Save", "Ne pas enregistrer"),
+    ("Double-click a layer to open it in the Layer panel", "Double-cliquez sur un calque pour l’ouvrir dans le panneau Calque"),
+    ("Double-click footage in the Project panel to open it here", "Double-cliquez sur un métrage dans le panneau Projet pour l’ouvrir ici"),
+    ("Double-click to edit the comment", "Double-cliquez pour modifier le commentaire"),
+    ("Download", "Télécharger"),
+    (
+        "Drag properties here from the timeline,\nor use Animation > Add Property to Essential Graphics.",
+        "Faites glisser des propriétés ici depuis la chronologie,\nou utilisez Animation > Ajouter la propriété aux graphiques essentiels.",
+    ),
+    ("Drag to change", "Faites glisser pour modifier"),
+    ("Drag to create a guide", "Faites glisser pour créer un repère"),
+    ("Drag to slip the source", "Faites glisser pour décaler la source"),
+    ("Drop Frame", "Drop frame"),
+    ("Duplicate", "Dupliquer"),
+    ("Copy", "Copier"),
+    ("Paste", "Coller"),
+    ("Edit Value…", "Modifier la valeur…"),
+    ("Remove Expression", "Supprimer l’expression"),
+    ("Duration:", "Durée :"),
+    ("Edit Gradient…", "Modifier le dégradé…"),
+    ("Edit Target: {}", "Cible de modification : {}"),
+    ("EffectCraft didn't quit normally last time.", "EffectCraft ne s’est pas fermé normalement la dernière fois."),
+    ("Effects", "Effets"),
+    ("Effects & Presets options", "Options d’Effets et programmes"),
+    ("Copy Presets Folder Path", "Copier le chemin du dossier des préréglages"),
+    ("Copy Source Path", "Copier le chemin source"),
+    ("Effects: {}", "Effets : {}"),
+    ("EXR Bit Depth: {}", "Profondeur de bits EXR : {}"),
+    ("EXR Compression: {}", "Compression EXR : {}"),
+    ("EXR Compression: {} (lossy)", "Compression EXR : {} (avec perte)"),
+    ("EXR Compression: {} (uncompressed at float)", "Compression EXR : {} (non compressé en float)"),
+    ("Empty folder", "Dossier vide"),
+    ("Enable Depth of Field", "Activer la profondeur de champ"),
+    ("Enable Expression", "Activer l’expression"),
+    ("Enhance", "Améliorer"),
+    ("Essential Properties — {}", "Propriétés essentielles — {}"),
+    ("Event", "Événement"),
+    ("Export Template…", "Exporter le modèle…"),
+    ("Export...", "Exporter..."),
+    ("Expression Language Menu", "Menu du langage d’expression"),
+    ("Expression pick whip: drag onto a property", "Sélecteur d’expression : faites-le glisser sur une propriété"),
+    ("Expression:", "Expression :"),
+    ("Eyedropper: click, then click in the Composition panel", "Pipette : cliquez, puis cliquez dans le panneau Composition"),
+    ("Falloff", "Atténuation"),
+    ("Falloff Distance", "Distance d’atténuation"),
+    ("Favorites", "Favoris"),
+    ("Field Render: {}", "Rendu des trames : {}"),
+    ("Figures", "Chiffres"),
+    ("Fill Target", "Cible du remplissage"),
+    ("Finished", "Terminé"),
+    ("Flowchart: {}", "Organigramme : {}"),
+    ("Focus Distance", "Distance de mise au point"),
+    ("Follow Feature Rotation and Scale", "Suivre la rotation et l’échelle de la caractéristique"),
+    ("Footage: {}", "Métrage : {}"),
+    ("Format: {}", "Format : {}"),
+    ("Frame Aspect Ratio: {}", "Rapport d’aspect de l’image : {}"),
+    ("Frame Blending: {}", "Fusion d’images : {}"),
+    ("Frame Rate:", "Fréquence d’images :"),
+    ("Resolution:", "Résolution :"),
+    ("Frame Render Time  {}ms", "Temps de rendu de l’image  {} ms"),
+    ("Frame Target:", "Image cible :"),
+    ("Freeze", "Figer"),
+    ("Grab bag", "Divers"),
+    ("Gradient Editor", "Éditeur de dégradé"),
+    ("Grid", "Grille"),
+    ("Guide Layer", "Calque de repère"),
+    ("Guide Layers: {}", "Calques de repère : {}"),
+    ("Guides", "Repères"),
+    ("Height:", "Hauteur :"),
+    ("Hide This", "Masquer ceci"),
+    ("Histogram", "Histogramme"),
+    ("Hold In Place", "Maintenir en place"),
+    ("Home", "Accueil"),
+    ("If Confidence is Below", "Si la confiance est inférieure à"),
+    ("Import", "Importer"),
+    ("Import and Add to Composition", "Importer et ajouter à la composition"),
+    ("Import...", "Importer..."),
+    ("Imported media", "Médias importés"),
+    ("Influence:", "Influence :"),
+    ("Install from File…", "Installer à partir d’un fichier…"),
+    ("Intensity", "Intensité"),
+    ("Inverted", "Inversé"),
+    ("Join the ArtCraft community on Discord", "Rejoindre la communauté ArtCraft sur Discord"),
+    ("Key: {}", "Touche : {}"),
+    ("LEARN", "APPRENTISSAGE"),
+    ("Label", "Étiquette"),
+    ("Label Colors and Names:", "Couleurs et noms des étiquettes :"),
+    ("Label:", "Étiquette :"),
+    ("Latest auto-save: {}", "Dernier enregistrement automatique : {}"),
+    ("Layer", "Calque"),
+    ("Layer controls", "Contrôles de calque"),
+    ("Layer:", "Calque :"),
+    ("Layer: {}", "Calque : {}"),
+    ("Layer Styles", "Styles de calque"),
+    ("Learn", "Apprentissage"),
+    ("Leave all attributes in \"{}\"", "Conserver tous les attributs dans « {} »"),
+    ("Licence: {}", "Licence : {}"),
+    ("Ligatures", "Ligatures"),
+    ("Light", "Clair"),
+    ("Light Theme", "Thème clair"),
+    ("Light Type", "Type de lumière"),
+    ("Lighter", "Plus clair"),
+    ("Link Selected Property", "Lier la propriété sélectionnée"),
+    ("Location:", "Emplacement :"),
+    ("Lock Aspect Ratio to {}", "Verrouiller le rapport d’aspect sur {}"),
+    ("Lock to Zoom", "Verrouiller sur le zoom"),
+    ("Locked: {} — {}", "Verrouillé : {} — {}"),
+    ("Log:", "Journal :"),
+    ("Loop (Trace Path)", "Boucle (suivre le tracé)"),
+    ("MIT OR Apache-2.0 • Fonts: Inter, JetBrains Mono (OFL)", "MIT OR Apache-2.0 • Polices : Inter, JetBrains Mono (OFL)"),
+    ("Magnification ratio popup", "Menu du rapport d’agrandissement"),
+    ("Make Comp Size", "Adopter la taille de la composition"),
+    ("Markers", "Repères"),
+    ("Masks", "Masques"),
+    ("Maximize Panel", "Agrandir le panneau"),
+    ("Media Replacement", "Remplacement de média"),
+    ("Mesh:", "Maillage :"),
+    ("Diameter:", "Diamètre :"),
+    ("Method Used: {}    Average Error: {} pixels", "Méthode utilisée : {}    Erreur moyenne : {} pixels"),
+    ("Models folder: {}", "Dossier des modèles : {}"),
+    ("Modifiers:", "Modificateurs :"),
+    ("More", "Plus"),
+    ("More ArtCraft apps", "Autres applications ArtCraft"),
+    ("More tutorials", "Autres tutoriels"),
+    ("Motion Blur", "Flou de mouvement"),
+    ("Motion Blur: {}", "Flou de mouvement : {}"),
+    ("Motion Sketch: drag to record", "Croquis de mouvement : faites glisser pour enregistrer"),
+    ("Move Down", "Descendre"),
+    ("Move Up", "Monter"),
+    ("Move to Project Root", "Déplacer à la racine du projet"),
+    ("Name", "Nom"),
+    ("Name:", "Nom :"),
+    ("Navigation", "Navigation"),
+    ("New", "Nouveau"),
+    ("New Comp from Selection", "Nouvelle composition à partir de la sélection"),
+    ("Replace with Precomposition", "Remplacer par une précomposition"),
+    ("New Duration:", "Nouvelle durée :"),
+    ("New composition name:", "Nom de la nouvelle composition :"),
+    ("New from Render Queue item:", "Nouveau à partir de l’élément de la file d’attente de rendu :"),
+    ("New from Template", "Nouveau à partir d’un modèle"),
+    ("Next", "Suivant"),
+    (
+        "Nice work. Pick another tutorial on the Home screen's Learn tab.",
+        "Bon travail. Choisissez un autre tutoriel dans l’onglet Apprentissage de l’écran d’accueil.",
+    ),
+    (
+        "No VR environments yet. Create one with Composition ▸ VR ▸ Create VR Environment…",
+        "Aucun environnement VR pour le moment. Créez-en un avec Composition ▸ VR ▸ Créer un environnement VR…",
+    ),
+    ("No audio layer selected", "Aucun calque audio sélectionné"),
+    ("No background jobs running", "Aucune tâche en arrière-plan en cours"),
+    ("No composition markers", "Aucun repère de composition"),
+    ("No contributor data was built into this copy.", "Aucune donnée sur les contributeurs n’est intégrée à cette copie."),
+    (
+        "No device list from this host; the system default output is used.",
+        "Aucune liste de périphériques fournie par cet hôte ; la sortie par défaut du système est utilisée.",
+    ),
+    ("No layer selected", "Aucun calque sélectionné"),
+    ("No matching effects or presets", "Aucun effet ni préréglage correspondant"),
+    ("No matching fonts", "Aucune police correspondante"),
+    ("Variable fonts only", "Polices variables uniquement"),
+    ("No model credits were built into this copy.", "Aucun crédit de modèle n’est intégré à cette copie."),
+    ("No nested compositions", "Aucune composition imbriquée"),
+    ("No shortcut", "Aucun raccourci"),
+    ("No unlocked layer selected", "Aucun calque déverrouillé sélectionné"),
+    ("No video", "Aucune vidéo"),
+    ("None", "Aucun"),
+    ("Not applied: tick it in the list to add it.", "Non appliqué : cochez-le dans la liste pour l’ajouter."),
+    ("Not assigned", "Non attribué"),
+    (
+        "Note: Shadows are only cast from layers with Cast Shadows enabled.",
+        "Remarque : seuls les calques dont l’option Projette des ombres est activée projettent des ombres.",
+    ),
+    ("Notify", "Notifier"),
+    ("OK", "OK"),
+    ("Offset:", "Décalage :"),
+    ("On ({}) stop:", "À l’arrêt ({}) :"),
+    ("One-Node Camera", "Caméra à un nœud"),
+    ("Opacity:", "Opacité :"),
+    ("Open Composition", "Ouvrir la composition"),
+    ("used once", "utilisé une fois"),
+    ("used {} times", "utilisé {} fois"),
+    ("Compositions that use this item", "Compositions qui utilisent cet élément"),
+    ("Open Last Saved Project", "Ouvrir le dernier projet enregistré"),
+    ("Open New Composition", "Ouvrir la nouvelle composition"),
+    ("Open Output", "Ouvrir la sortie"),
+    ("Open a composition to build Essential Graphics", "Ouvrez une composition pour créer des graphiques essentiels"),
+    ("Open a composition to see its scopes", "Ouvrez une composition pour voir ses oscilloscopes"),
+    ("Open a composition to track motion.", "Ouvrez une composition pour suivre un mouvement."),
+    ("Opus Tuning: {}", "Réglage Opus : {}"),
+    ("Original Duration:", "Durée d’origine :"),
+    ("Output Cycle: {}", "Cycle de sortie : {}"),
+    ("Output To:", "Sortie vers :"),
+    ("Overlay", "Superposition"),
+    ("Parameter Name:", "Nom du paramètre :"),
+    ("Parent pick whip: drag onto a layer", "Sélecteur de parent : faites-le glisser sur un calque"),
+    ("Pixel Aspect Ratio:", "Rapport d’aspect des pixels :"),
+    ("Playing on Video Preview", "Lecture sur la prévisualisation vidéo"),
+    ("Post-Render Action: {}", "Action après le rendu : {}"),
+    ("Preserve frame rate when nested or in render queue", "Conserver la fréquence d’images en cas d’imbrication ou dans la file d’attente de rendu"),
+    ("Preserve resolution when nested", "Conserver la résolution en cas d’imbrication"),
+    ("Preset", "Préréglage"),
+    ("Preset:", "Préréglage :"),
+    ("Presets", "Préréglages"),
+    ("Previous", "Précédent"),
+    ("Primary:", "Principal :"),
+    ("Process Before Match", "Traiter avant la mise en correspondance"),
+    ("Profile: {}", "Profil : {}"),
+    (
+        "Project color depth: click to cycle 8/16/32 bpc, Alt-click for Project Settings",
+        "Profondeur de couleur du projet : cliquez pour alterner entre 8/16/32 bpc, Alt-clic pour les paramètres du projet",
+    ),
+    ("Project: {}", "Projet : {}"),
+    ("Projects", "Projets"),
+    ("Property pick whip: drag onto a property", "Sélecteur de propriété : faites-le glisser sur une propriété"),
+    ("Protected Region", "Région protégée"),
+    ("Proxy Use: {}", "Utilisation du proxy : {}"),
+    ("Push All to Comp", "Tout envoyer vers la composition"),
+    ("RGB", "RVB"),
+    ("Radius", "Rayon"),
+    ("Rate Control: {}", "Contrôle du débit : {}"),
+    ("Recent", "Récents"),
+    ("Recording", "Enregistrement"),
+    ("Remove", "Supprimer"),
+    ("Rename", "Renommer"),
+    ("Render: {} ms  •  UI {} fps{}", "Rendu : {} ms  •  Interface {} i/s{}"),
+    ("Renderer:", "Moteur de rendu :"),
+    ("Request Persistent Storage", "Demander un stockage persistant"),
+    ("Reset", "Réinitialiser"),
+    ("Reset Labels", "Réinitialiser les étiquettes"),
+    ("Reset Preset", "Réinitialiser le préréglage"),
+    ("Reset to Default", "Rétablir les valeurs par défaut"),
+    ("Reset to Saved Layout", "Rétablir la disposition enregistrée"),
+    ("Resolution/Down Sample Factor Popup", "Menu de résolution et de facteur de sous-échantillonnage"),
+    ("Restore Panel Size", "Restaurer la taille du panneau"),
+    ("Reverse the order", "Inverser l’ordre"),
+    ("Revert All", "Tout rétablir"),
+    ("Roman Hanging Punctuation", "Ponctuation suspendue romaine"),
+    ("Roving:", "Itinérant :"),
+    ("Ruler zero point (drag to move, double-click to reset)", "Point zéro de la règle (faites glisser pour le déplacer, double-cliquez pour réinitialiser)"),
+    ("Rulers", "Règles"),
+    ("Run", "Exécuter"),
+    ("Sample Format: {}", "Format d’échantillon : {}"),
+    ("Samples Per Frame:", "Échantillons par image :"),
+    ("Save from #{}", "Enregistrer à partir de #{}"),
+    ("Saved {}", "Enregistré {}"),
+    ("Script… (⌘/Ctrl+Enter runs)", "Script… (⌘/Ctrl+Entrée pour exécuter)"),
+    ("Search commands or shortcuts", "Rechercher des commandes ou des raccourcis"),
+    ("Select", "Sélectionner"),
+    ("Select a command to change its shortcut.", "Sélectionnez une commande pour modifier son raccourci."),
+    ("Select a layer to see its effects", "Sélectionnez un calque pour voir ses effets"),
+    ("Select a layer to see its properties", "Sélectionnez un calque pour voir ses propriétés"),
+    ("({}) Selected Objects", "({}) objets sélectionnés"),
+    (
+        "Select a layer with a mask or shape path (or the path property), or Puppet pins.",
+        "Sélectionnez un calque doté d’un masque ou d’un tracé de forme (ou la propriété de tracé), ou des épingles de marionnette.",
+    ),
+    ("Select a text layer", "Sélectionnez un calque de texte"),
+    ("Select an item in the Project panel", "Sélectionnez un élément dans le panneau Projet"),
+    ("Select animated properties to show them in the Graph Editor", "Sélectionnez des propriétés animées pour les afficher dans l’éditeur de courbes"),
+    (
+        "Select the leader pin, then Shift-click the pins that should trail it (hair, cloth, tails)",
+        "Sélectionnez l’épingle principale, puis Maj-clic sur les épingles qui doivent la suivre (cheveux, tissu, queues)",
+    ),
+    ("Set Ground Plane and Origin", "Définir le plan de sol et l’origine"),
+    ("Set Paint Colors to Black and White (D)", "Définir les couleurs de peinture sur noir et blanc (D)"),
+    ("Settings", "Paramètres"),
+    ("Settings Name:", "Nom des paramètres :"),
+    ("Shadow Darkness", "Obscurité de l’ombre"),
+    ("Shadow Diffusion", "Diffusion de l’ombre"),
+    ("Shadows", "Ombres"),
+    ("Shape…", "Forme…"),
+    ("Show", "Afficher"),
+    ("Show Layer Name", "Afficher le nom du calque"),
+    ("Show Source Name", "Afficher le nom de la source"),
+    ("Show me", "Montrez-moi"),
+    ("Show:", "Afficher :"),
+    ("Shutter Angle:", "Angle d’obturation :"),
+    ("Shutter Phase:", "Phase d’obturation :"),
+    ("Size", "Taille"),
+    ("Skip", "Passer"),
+    ("Snapping", "Aimantation"),
+    ("Snapping options", "Options d’aimantation"),
+    ("Snapshot", "Instantané"),
+    ("Solo Supported Properties", "Solo sur les propriétés prises en charge"),
+    ("Solo Switches: {}", "Commutateurs Solo : {}"),
+    ("Sort", "Trier"),
+    ("Spacing:", "Espacement :"),
+    ("Spatial Interpolation:", "Interpolation spatiale :"),
+    ("Speed:", "Vitesse :"),
+    ("Start Timecode:", "Timecode de début :"),
+    ("Start: {}   Duration: {}", "Début : {}   Durée : {}"),
+    ("Step {} of {}: {}", "Étape {} sur {} : {}"),
+    ("Stop", "Arrêter"),
+    ("Stop {} at {}°", "Point d’arrêt {} à {}°"),
+    ("Stored in: {}", "Stocké dans : {}"),
+    ("Stretch", "Étirement"),
+    ("Stretch Factor:", "Facteur d’étirement :"),
+    ("Stylistic Sets", "Jeux stylistiques"),
+    ("Subpixel Positioning", "Positionnement au sous-pixel"),
+    ("Swap Colors", "Permuter les couleurs"),
+    ("Swap Paint Colors (X)", "Permuter les couleurs de peinture (X)"),
+    ("Sync with System", "Synchroniser avec le système"),
+    ("System Default", "Par défaut du système"),
+    ("Table", "Tableau"),
+    ("Template name", "Nom du modèle"),
+    ("Template: {}\n{}", "Modèle : {}\n{}"),
+    ("Temporal Interpolation:", "Interpolation temporelle :"),
+    ("The Media Browser is not available here (use File ▸ Import)", "Le navigateur multimédia n’est pas disponible ici (utilisez Fichier ▸ Importer)"),
+    ("The OpenEXR layer shown in red, green, blue and alpha", "La couche OpenEXR affichée en rouge, vert, bleu et alpha"),
+    ("The render queue is empty.", "La file d’attente de rendu est vide."),
+    (
+        "These adjacent keyframes cannot interpolate because their stop counts differ.",
+        "Ces images clés adjacentes ne peuvent pas être interpolées, car leur nombre de points d’arrêt diffère.",
+    ),
+    ("This ScriptUI panel has closed", "Ce panneau ScriptUI a été fermé"),
+    ("This change will create a new solid for this layer.", "Cette modification créera un nouveau solide pour ce calque."),
+    ("Time", "Temps"),
+    ("Time Stretch…", "Extension temporelle…"),
+    ("Time:", "Temps :"),
+    ("Time: {}", "Temps : {}"),
+    ("Title/Action Safe", "Zones de sécurité titres/action"),
+    ("Title/action safe", "Zones de sécurité titres/action"),
+    ("Toggle Switches / Modes", "Basculer entre commutateurs et modes"),
+    ("Track Name:", "Nom de la piste :"),
+    (
+        "Trained models are available in the desktop app; the browser uses the classic engine.",
+        "Les modèles entraînés sont disponibles dans l’application de bureau ; le navigateur utilise le moteur classique.",
+    ),
+    ("Transform", "Transformation"),
+    ("Transparency grid", "Grille de transparence"),
+    ("Tutorial complete", "Tutoriel terminé"),
+    ("Two-Node Camera", "Caméra à deux nœuds"),
+    ("Type", "Type"),
+    ("Type a command or effect…", "Saisissez une commande ou un effet…"),
+    ("URL:", "URL :"),
+    ("Undock Panel", "Détacher le panneau"),
+    ("Move Panel to New Window", "Déplacer le panneau vers une nouvelle fenêtre"),
+    ("Move Panel to Main Window", "Déplacer le panneau vers la fenêtre principale"),
+    ("Unfreeze", "Dégeler"),
+    ("Unlink {}", "Dissocier {}"),
+    (
+        "Use this option to place the currently selected layers together into a new intermediate composition.",
+        "Utilisez cette option pour regrouper les calques actuellement sélectionnés dans une nouvelle composition intermédiaire.",
+    ),
+    ("VR Environments", "Environnements VR"),
+    ("Value:", "Valeur :"),
+    ("Variable Font Axes", "Axes de police variable"),
+    ("Video Codec: {}", "Codec vidéo : {}"),
+    ("View:", "Affichage :"),
+    ("Welcome to EffectCraft", "Bienvenue dans EffectCraft"),
+    ("Width:", "Largeur :"),
+    ("You can undo this.", "Vous pouvez annuler cette action."),
+    ("You can't undo this.", "Vous ne pouvez pas annuler cette action."),
+    ("Your changes will be lost if you don't save them.", "Vos modifications seront perdues si vous ne les enregistrez pas."),
+    ("Zoom", "Zoom"),
+    ("built-in", "intégré"),
+    ("frames per second", "images par seconde"),
+    ("template name", "nom du modèle"),
+    ("{} contributors · {} commits", "{} contributeurs · {} commits"),
+    ("{} x {}, {}MB per 8bpc frame", "{} x {}, {} Mo par image 8 bpc"),
+    ("{} — coming soon", "{} — bientôt disponible"),
+    ("{} — double-click to open, {}-click to reveal", "{} — double-cliquez pour ouvrir, {}-clic pour révéler"),
+    ("⌘/Ctrl-drag a pin to record its motion", "Glissez une épingle en maintenant ⌘/Ctrl pour enregistrer son mouvement"),
+    ("▣ {}", "▣ {}"),
+    ("⚠ {} is used by:", "⚠ {} est utilisé par :"),
+    ("3D Reference Axes", "Axes de référence 3D"),
+    ("Affect all layers that use this solid", "Affecter tous les calques qui utilisent ce solide"),
+    ("Choose grid and guide options", "Choisir les options de grille et de repères"),
+    ("Colorize", "Coloriser"),
+    ("Custom", "Personnalisée"),
+    ("Custom...", "Personnalisée..."),
+    ("Fit", "Ajuster"),
+    ("Fit up to 100%", "Ajuster jusqu’à 100 %"),
+    ("Full", "Complète"),
+    ("Half", "Moitié"),
+    ("Only this layer uses this solid.", "Seul ce calque utilise ce solide."),
+    ("Proportional Grid", "Grille proportionnelle"),
+    ("Quarter", "Quart"),
+    ("Region of Interest", "Zone d’intérêt"),
+    ("Reset Exposure", "Réinitialiser l’exposition"),
+    ("Show Channel and Color Management Settings", "Afficher les paramètres de canaux et de gestion des couleurs"),
+    ("Show Snapshot (hold)", "Afficher l’instantané (maintenir)"),
+    ("Take Snapshot", "Prendre un instantané"),
+    ("Third", "Tiers"),
+    ("Toggle Mask and Shape Path Visibility", "Afficher/masquer les tracés de masque et de forme"),
+    ("Toggle Transparency Grid", "Afficher/masquer la grille de transparence"),
+    ("16 bits per channel", "16 bits par canal"),
+    ("32 bits per channel (float)", "32 bits par canal (virgule flottante)"),
+    ("8 bits per channel", "8 bits par canal"),
+    ("Adaptive Resolution", "Résolution adaptative"),
+    ("Adobe-style built-in", "Intégré (style Adobe)"),
+    ("Blue", "Bleu"),
+    ("Current Settings", "Paramètres actuels"),
+    ("Disable Per-character 3D", "Désactiver la 3D par caractère"),
+    ("Draft", "Brouillon"),
+    ("Enable Per-character 3D", "Activer la 3D par caractère"),
+    ("Fast Draft", "Brouillon rapide"),
+    ("Fast Previews (Draft 3D, Faster Effects)", "Aperçus rapides (3D brouillon, effets plus rapides)"),
+    ("Green", "Vert"),
+    ("Import Image Sequence", "Importer une séquence d’images"),
+    ("Import PDF / Illustrator File", "Importer un fichier PDF / Illustrator"),
+    ("Import Photoshop File", "Importer un fichier Photoshop"),
+    ("Interpret Unlabeled Alpha As", "Interpréter l’alpha non étiqueté comme"),
+    ("Join the ArtCraft Discord", "Rejoindre le Discord ArtCraft"),
+    ("GPU Acceleration ({})", "Accélération GPU ({})"),
+    ("Software Rendering", "Rendu logiciel"),
+    ("OCIO (built-in ACES config)", "OCIO (configuration ACES intégrée)"),
+    ("Off (Final Quality)", "Désactivé (qualité finale)"),
+    ("OpenGL (compatibility)", "OpenGL (compatibilité)"),
+    ("Opus Bitrate: {} kbps", "Débit Opus : {} kb/s"),
+    ("RGB Straight", "RVB direct"),
+    ("Red", "Rouge"),
+    ("Tone map", "Mappage tonal"),
+    ("Use In-Window Menu Bar on macOS", "Utiliser la barre de menus dans la fenêtre sous macOS"),
+    ("Wireframe", "Fil de fer"),
+    ("sRGB IEC61966-2.1 (default)", "sRGB IEC61966-2.1 (par défaut)"),
+    ("New Project", "Nouveau projet"),
+    ("Open Project…", "Ouvrir un projet…"),
+    ("Templates", "Modèles"),
+    ("EffectCraft home page", "Page d’accueil EffectCraft"),
+    ("EffectCraft on GitHub", "EffectCraft sur GitHub"),
+    ("Motion graphics and visual effects · version {}", "Motion design et effets visuels · version {}"),
+    ("New Composition", "Nouvelle composition"),
+    ("Open Demo Project", "Ouvrir le projet de démonstration"),
+    ("Import Footage…", "Importer un métrage…"),
+    ("Filter recent files", "Filtrer les fichiers récents"),
+    ("NAME", "NOM"),
+    ("OPENED", "OUVERT LE"),
+    ("SIZE", "TAILLE"),
+    ("KIND", "TYPE"),
+    ("Your recent files will show here", "Vos fichiers récents s’afficheront ici"),
+    ("Create a new project, or open the demo project to look around.", "Créez un projet ou ouvrez le projet de démonstration pour explorer."),
+    ("No recent files match the filter", "Aucun fichier récent ne correspond au filtre"),
+    ("Try another name or folder.", "Essayez un autre nom ou dossier."),
+    ("Just now", "À l’instant"),
+    ("Yesterday", "Hier"),
+    ("{} minute ago", "Il y a {} minute"),
+    ("{} minutes ago", "Il y a {} minutes"),
+    ("{} hour ago", "Il y a {} heure"),
+    ("{} hours ago", "Il y a {} heures"),
+    ("{} day ago", "Il y a {} jour"),
+    ("{} days ago", "Il y a {} jours"),
+    ("EffectCraft project", "Projet EffectCraft"),
+    ("After Effects project", "Projet After Effects"),
+    ("Lottie animation", "Animation Lottie"),
+    ("Project", "Projet"),
+    ("General", "Général"),
+    ("Language", "Langue"),
+    ("Levels of Undo", "Niveaux d’annulation"),
+    ("Path Point and Handle Size", "Taille des points de tracé et des poignées"),
+    ("Recent Projects Shown", "Nombre de projets récents affichés"),
+    ("Options", "Options"),
+    ("Show Tool Tips", "Afficher les info-bulles"),
+    ("Create Layers at Composition Start Time", "Créer les calques au début de la composition"),
+    ("Switches Affect Nested Comps", "Les commutateurs affectent les compositions imbriquées"),
+    ("Default Spatial Interpolation to Linear", "Interpolation spatiale linéaire par défaut"),
+    (
+        "Preserve Constant Vertex and Feather Point Count when Editing Masks",
+        "Conserver un nombre constant de sommets et de points de contour progressif lors de la modification des masques",
+    ),
+    ("Synchronize Time of All Related Items", "Synchroniser le temps de tous les éléments liés"),
+    ("Expression Pick Whip Writes Compact English", "Le sélecteur d’expression écrit un anglais compact"),
+    ("Create Split Layers Above Original Layer", "Créer les calques fractionnés au-dessus du calque d’origine"),
+    ("Use System Color Picker", "Utiliser le sélecteur de couleurs du système"),
+    (
+        "EffectCraft always uses its own colour picker (the same on every platform and the web).",
+        "EffectCraft utilise toujours son propre sélecteur de couleurs (le même sur toutes les plateformes et sur le web).",
+    ),
+    ("Startup & Repair", "Démarrage et réparation"),
+    ("Show Home Screen When Launching", "Afficher l’écran d’accueil au lancement"),
+    ("Show Home Screen When Opening a Project", "Afficher l’écran d’accueil à l’ouverture d’un projet"),
+    ("Offer to Open the Latest Auto-Save After a Crash", "Proposer d’ouvrir le dernier enregistrement automatique après un plantage"),
+    ("Window Graphics", "Graphismes de la fenêtre"),
+    ("Automatic", "Automatique"),
+    (
+        "Window Graphics applies from the next launch. When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL.",
+        "Le réglage Graphismes de la fenêtre s’applique à partir du prochain lancement. Si le pilote graphique arrête EffectCraft à l’ouverture de sa fenêtre, le lancement suivant bascule sur OpenGL.",
+    ),
+    ("Repair", "Réparation"),
+    ("Reset Settings", "Réinitialiser les préférences"),
+    ("Reset Keyboard Shortcuts", "Réinitialiser les raccourcis clavier"),
+    ("Empty Disk Cache", "Vider le cache disque"),
+    ("New Project Loads Template", "Un nouveau projet charge un modèle"),
+    ("Template Project", "Projet modèle"),
+    ("Auto-Save", "Enregistrement automatique"),
+    ("Automatically Save Projects", "Enregistrer automatiquement les projets"),
+    ("Save Every", "Enregistrer toutes les"),
+    ("Minutes", "Minutes"),
+    ("Maximum Project Versions", "Nombre maximal de versions du projet"),
+    ("Auto-Save Location", "Emplacement de l’enregistrement automatique"),
+    ("Next to Project", "À côté du projet"),
+    ("Custom Location", "Emplacement personnalisé"),
+    ("Save When Starting Render Queue", "Enregistrer au démarrage de la file d’attente de rendu"),
+    ("Save Now", "Enregistrer maintenant"),
+    ("Motion Path", "Trajectoire de mouvement"),
+    ("All Keyframes", "Toutes les images clés"),
+    ("No Motion Path", "Aucune trajectoire de mouvement"),
+    ("No More Than (Seconds)", "Pas plus de (secondes)"),
+    ("No More Than (Keyframes)", "Pas plus de (images clés)"),
+    ("Seconds", "Secondes"),
+    ("Keyframes", "Images clés"),
+    ("Display", "Affichage"),
+    ("Show Rendering Progress in Info Panel and Flowchart", "Afficher la progression du rendu dans le panneau Informations et l’organigramme"),
+    ("Hardware Accelerate Composition, Layer and Footage Panels", "Accélération matérielle des panneaux Composition, Calque et Métrage"),
+    ("Panels are always drawn by the GPU (wgpu).", "Les panneaux sont toujours dessinés par le GPU (wgpu)."),
+    ("Previews", "Prévisualisations"),
+    ("Adaptive Resolution Limit", "Limite de résolution adaptative"),
+    ("Show Internal Wireframes", "Afficher les fils de fer internes"),
+    ("Cache Frames When Idle", "Mettre en cache les images en cas d’inactivité"),
+    ("Viewer Zoom Quality", "Qualité du zoom du visualiseur"),
+    ("Faster", "Plus rapide"),
+    ("More Accurate", "Plus précis"),
+    ("Display Color Space", "Espace colorimétrique d’affichage"),
+    ("GPU Information...", "Informations sur le GPU..."),
+    ("Appearance", "Apparence"),
+    ("Brightness", "Luminosité"),
+    ("UI Scale", "Échelle de l’interface"),
+    ("Labels and Colors", "Étiquettes et couleurs"),
+    ("Use Label Color for Layer Handles and Paths", "Utiliser la couleur d’étiquette pour les poignées et les tracés des calques"),
+    ("Use Label Color for Related Tabs", "Utiliser la couleur d’étiquette pour les onglets associés"),
+    ("Cycle Mask Colors", "Alterner les couleurs des masques"),
+    ("Use Gradients", "Utiliser les dégradés"),
+    ("Menu Bar", "Barre de menus"),
+    ("Grids & Guides", "Grilles et repères"),
+    ("Gridline Every", "Ligne de grille toutes les"),
+    ("Subdivisions", "Subdivisions"),
+    ("Style", "Style"),
+    ("Lines", "Lignes"),
+    ("Dashed Lines", "Lignes en tirets"),
+    ("Dots", "Points"),
+    ("Horizontal", "Horizontal"),
+    ("Vertical", "Vertical"),
+    ("Safe Margins", "Marges de sécurité"),
+    ("Action-safe", "Sécurité action"),
+    ("Title-safe", "Sécurité titres"),
+    ("Labels", "Étiquettes"),
+    ("Text Engine", "Moteur de texte"),
+    ("Latin", "Latin"),
+    ("South Asian and Middle Eastern", "Asie du Sud et Moyen-Orient"),
+    ("Show Font Preview", "Afficher l’aperçu des polices"),
+    ("Number of Recent Fonts to Display", "Nombre de polices récentes à afficher"),
+    ("Show Font Names in English", "Afficher les noms des polices en anglais"),
+    ("Still Footage", "Métrage fixe"),
+    ("Length of Composition", "Durée de la composition"),
+    ("Duration (Seconds)", "Durée (secondes)"),
+    ("Still Duration", "Durée de l’image fixe"),
+    ("Sequence Footage", "Métrage en séquence"),
+    ("Report Missing Frames", "Signaler les images manquantes"),
+    ("Automatically Reload Footage", "Recharger automatiquement le métrage"),
+    ("Off", "Désactivé"),
+    ("Non-Sequence Footage", "Métrage hors séquence"),
+    ("All Footage", "Tout le métrage"),
+    ("Ask User", "Demander à l’utilisateur"),
+    ("Guess", "Deviner"),
+    ("Ignore", "Ignorer"),
+    ("Straight", "Direct"),
+    ("Premultiplied", "Prémultiplié"),
+    ("Default Drag Import As", "Importation par glisser par défaut en tant que"),
+    ("Footage", "Métrage"),
+    ("Composition - Retain Layer Sizes", "Composition – conserver les tailles des calques"),
+    ("Export", "Exportation"),
+    ("Default Output Folder", "Dossier de sortie par défaut"),
+    ("Segment Sequences", "Segmenter les séquences"),
+    ("Files per Segment", "Fichiers par segment"),
+    ("files", "fichiers"),
+    ("Segment Movie Files", "Segmenter les fichiers vidéo"),
+    ("Segment Size", "Taille du segment"),
+    ("Append Bit Depth to File Name", "Ajouter la profondeur de bits au nom du fichier"),
+    ("Audio", "Audio"),
+    ("Audio Hardware", "Matériel audio"),
+    ("Preview Sample Rate", "Fréquence d’échantillonnage de l’aperçu"),
+    ("Audio Output Mapping", "Affectation des sorties audio"),
+    ("Left", "Gauche"),
+    ("Right", "Droite"),
+    ("channel", "canal"),
+    ("Disk", "Disque"),
+    ("Disk Cache", "Cache disque"),
+    ("Enable Disk Cache", "Activer le cache disque"),
+    ("Maximum Disk Cache Size", "Taille maximale du cache disque"),
+    ("Disk Cache Folder", "Dossier du cache disque"),
+    ("Media Cache", "Cache des médias"),
+    ("Database and Cache Folder", "Dossier de la base de données et du cache"),
+    ("Conformed Audio Folder", "Dossier de l’audio conformé"),
+    ("Memory & CPU", "Mémoire et CPU"),
+    ("RAM Reserved for Other Applications", "Mémoire vive réservée aux autres applications"),
+    ("Cache Budgets", "Budgets de cache"),
+    ("Layer Cache", "Cache des calques"),
+    ("Footage Frame Cache", "Cache des images du métrage"),
+    ("Preview (RAM) Cache", "Cache de prévisualisation (RAM)"),
+    ("Reduce Cache Size When System Is Low on Memory", "Réduire la taille du cache quand le système manque de mémoire"),
+    ("Video", "Vidéo"),
+    ("Enable Video Preview Output", "Activer la sortie de prévisualisation vidéo"),
+    ("Video Device", "Périphérique vidéo"),
+    ("Floating Window", "Fenêtre flottante"),
+    ("Full Screen", "Plein écran"),
+    ("Video Output During Playback", "Sortie vidéo pendant la lecture"),
+    ("Mirror on Computer Monitor", "Dupliquer sur l’écran de l’ordinateur"),
+    ("Disable Video Output When in Background", "Désactiver la sortie vidéo en arrière-plan"),
+    ("Default 3D Renderer", "Moteur de rendu 3D par défaut"),
+    ("Show 3D Reference Axes", "Afficher les axes de référence 3D"),
+    ("Extended Viewer", "Visualiseur étendu"),
+    ("Realtime Shadows in Draft", "Ombres en temps réel en mode brouillon"),
+    ("Scripting & Expressions", "Scripts et expressions"),
+    ("Application Scripting", "Scripts de l’application"),
+    ("Allow Scripts to Write Files and Access Network", "Autoriser les scripts à écrire des fichiers et à accéder au réseau"),
+    ("Warn User When Executing Files", "Avertir l’utilisateur à l’exécution de fichiers"),
+    ("Enable JavaScript Debugger", "Activer le débogueur JavaScript"),
+    ("Expressions Editor", "Éditeur d’expressions"),
+    ("Font Size", "Taille de police"),
+    ("Syntax Highlighting", "Coloration syntaxique"),
+    ("Line Numbers", "Numéros de ligne"),
+    ("Auto-complete", "Complétion automatique"),
+    ("Bracket Matching", "Appariement des parenthèses"),
+    ("Word Wrap", "Retour automatique à la ligne"),
+    ("Show Expression Error Banner", "Afficher le bandeau d’erreur d’expression"),
+    (
+        "Expressions use the JavaScript engine. Script errors report their file and line in the Script Console; there is no step debugger.",
+        "Les expressions utilisent le moteur JavaScript. Les erreurs de script indiquent leur fichier et leur ligne dans la console de scripts ; il n’existe pas de débogueur pas à pas.",
+    ),
+    ("Roto Brush", "Roto Brush"),
+    ("Segmentation Model", "Modèle de segmentation"),
+    (
+        "Roto Brush 2.0 and 3.0 use the model chosen here (Version 1.0 always uses the classic engine). Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Roto Brush 2.0 et 3.0 utilisent le modèle choisi ici (la version 1.0 utilise toujours le moteur classique). Les modèles sont open source, ne sont téléchargés que sur votre demande et sont vérifiés d’après leur empreinte SHA-256 publiée.",
+    ),
+    ("Face Tracking", "Suivi du visage"),
+    ("Face Model", "Modèle de visage"),
+    (
+        "Face tracking in the Tracker panel (Outline Only and Detailed Features) uses the model chosen here. Models are open source, downloaded only when you ask, and checked against their published SHA-256.",
+        "Le suivi du visage du panneau Suivi (Outline Only et Detailed Features) utilise le modèle choisi ici. Les modèles sont open source, ne sont téléchargés que sur votre demande et sont vérifiés d’après leur empreinte SHA-256 publiée.",
+    ),
+    ("Match System", "Langue du système"),
+    ("Total Offset", "Décalage total"),
+    ("Per Layer", "Par calque"),
+    ("Track", "Suivre"),
+    ("Default", "Par défaut"),
+    ("Stored, but not used by EffectCraft yet", "Enregistré, mais pas encore utilisé par EffectCraft"),
+    ("Search project", "Rechercher dans le projet"),
+    ("Select an item to see its details", "Sélectionnez un élément pour voir ses détails"),
+    ("Media Duration", "Durée du média"),
+    ("Frame Rate", "Fréquence d’images"),
+    ("File Path", "Chemin du fichier"),
+    ("Comment", "Commentaire"),
+    ("A/V Features", "Fonctions A/V"),
+    ("Keys", "Clés"),
+    ("Layer Name", "Nom du calque"),
+    ("Source Name", "Nom de la source"),
+    ("Switches", "Commutateurs"),
+    ("Modes", "Modes"),
+    ("Track Matte", "Estampe"),
+    ("Parent & Link", "Parent et lien"),
+    ("In", "Entrée"),
+    ("Out", "Sortie"),
+    ("Duration", "Durée"),
+    ("Original color: click to go back to it", "Couleur d’origine : cliquez pour y revenir"),
+    ("Resize floating panel", "Redimensionner le panneau flottant"),
+    ("Render every n-th pixel", "Rendre un pixel sur n"),
+    ("Color (#rrggbb)", "Couleur (#rrggbb)"),
+    ("Workspace", "Espace de travail"),
+    ("Rename to", "Renommer en"),
+    ("Open", "Ouvrir"),
+    ("Custom Resolution", "Résolution personnalisée"),
+    ("Panel Background Color", "Couleur d’arrière-plan du panneau"),
+    ("New Workspace", "Nouvel espace de travail"),
+    ("Edit Workspaces", "Modifier les espaces de travail"),
+    ("A script wants to open a file", "Un script veut ouvrir un fichier"),
+    ("Drop file to import", "Déposez le fichier pour l’importer"),
+    ("Drop {} files to import", "Déposez {} fichiers pour les importer"),
+    (
+        "Skipped {} dropped file(s) without a local path. Use File ▸ Import ▸ File…",
+        "{} fichier(s) déposé(s) sans chemin local ignoré(s). Utilisez Fichier ▸ Importer ▸ Fichier…",
+    ),
+    ("Only one project can be opened per drop; skipped {} more", "Un seul projet peut être ouvert par dépôt ; {} de plus ignoré(s)"),
+    ("Cannot open dropped project {}: {}", "Impossible d’ouvrir le projet déposé {} : {}"),
+    ("Cannot import dropped files: {}", "Impossible d’importer les fichiers déposés : {}"),
+    ("A built-in preset has this name", "Un préréglage intégré porte ce nom"),
+    ("Replaces your preset with this name", "Remplace votre préréglage portant ce nom"),
+    ("Save Preset…", "Enregistrer le préréglage…"),
+    ("Delete Preset", "Supprimer le préréglage"),
+    ("Null Settings", "Paramètres de l’objet nul"),
+    ("Click to sample text {}", "Cliquez pour échantillonner le texte {}"),
+    ("Force alphabetical order", "Forcer l’ordre alphabétique"),
+    ("Frame rate (fps)", "Fréquence d’images (i/s)"),
+    (
+        "Change the frame rate, alpha and start frame later with File ▸ Interpret Footage.",
+        "Modifiez plus tard la fréquence d’images, l’alpha et l’image de début avec Fichier ▸ Interpréter le métrage.",
+    ),
+    ("Import Kind", "Type d’importation"),
+    ("Page", "Page"),
+    ("Delay (s)", "Délai (s)"),
+    ("Amount (%)", "Quantité (%)"),
+    ("Cascade (farther pins trail longer)", "En cascade (les épingles éloignées traînent plus longtemps)"),
+    ("Speed (%)", "Vitesse (%)"),
+    ("Smoothing", "Lissage"),
+    ("Use Draft Deformation", "Utiliser la déformation brouillon"),
+    ("Show Mesh", "Afficher le maillage"),
+    ("Scale X (%)", "Échelle X (%)"),
+    ("Scale Y (%)", "Échelle Y (%)"),
+    ("Rotation (degrees)", "Rotation (degrés)"),
+    ("Move X", "Déplacement X"),
+    ("Move Y", "Déplacement Y"),
+    ("Top", "Haut"),
+    ("Width", "Largeur"),
+    ("Height", "Hauteur"),
+    ("Shape", "Forme"),
+    ("Mode", "Mode"),
+    ("Frame", "Image"),
+    ("Orientation", "Orientation"),
+    ("Position (pixels)", "Position (pixels)"),
+    ("Position (percent of the composition)", "Position (pourcentage de la composition)"),
+    ("Create", "Créer"),
+    ("Use Dimensions From", "Utiliser les dimensions de"),
+    ("Still Duration (seconds)", "Durée de l’image fixe (secondes)"),
+    ("Add to Render Queue", "Ajouter à la file d’attente de rendu"),
+    ("Sequence Layers", "Enchaîner les calques"),
+    ("Overlap", "Chevauchement"),
+    ("Duration (seconds)", "Durée (secondes)"),
+    ("Transition", "Transition"),
+    ("Matte color (premultiplied)", "Couleur de fond (prémultipliée)"),
+    ("Invert Alpha", "Inverser l’alpha"),
+    ("Assume this frame rate", "Supposer cette fréquence d’images"),
+    ("Separate Fields", "Séparer les trames"),
+    ("Pixel Aspect Ratio", "Rapport d’aspect des pixels"),
+    ("Loop (times)", "Boucle (fois)"),
+    ("Assign Profile", "Attribuer un profil"),
+    ("Preserve RGB", "Conserver le RVB"),
+    ("Interpret As Linear Light", "Interpréter comme lumière linéaire"),
+    ("Start Timecode", "Timecode de début"),
+    ("Override Start", "Remplacer le début"),
+    ("Depth", "Profondeur"),
+    ("Time display style", "Style d’affichage du temps"),
+    ("Color engine", "Moteur colorimétrique"),
+    ("Working space", "Espace colorimétrique de travail"),
+    ("Working gamma", "Gamma de travail"),
+    ("Linearize working space", "Linéariser l’espace colorimétrique de travail"),
+    ("Blend colors using 1.0 gamma", "Fusionner les couleurs avec un gamma de 1,0"),
+    ("HDR on SDR displays and outputs", "HDR sur les écrans et sorties SDR"),
+    ("Output color space", "Espace colorimétrique de sortie"),
+    ("Video rendering and effects", "Rendu vidéo et effets"),
+    ("Time Span", "Intervalle de temps"),
+    ("Invert", "Inverser"),
+    ("Blur (pixels before auto-trace)", "Flou (pixels avant le tracé automatique)"),
+    ("Tolerance (pixels)", "Tolérance (pixels)"),
+    ("Threshold (%)", "Seuil (%)"),
+    ("Minimum Area (pixels)", "Surface minimale (pixels)"),
+    ("Corner Roundness (%)", "Arrondi des angles (%)"),
+    ("Apply To New Layer", "Appliquer à un nouveau calque"),
+    ("Action", "Action"),
+    ("Sensitivity threshold (0–1, lower finds more)", "Seuil de sensibilité (0–1, plus bas = plus de résultats)"),
+    ("Data", "Données"),
+    ("Time field (empty: automatic)", "Champ de temps (vide : automatique)"),
+    ("Video start (ISO date-time, hh:mm:ss, timecode; empty: file date)", "Début de la vidéo (date-heure ISO, hh:mm:ss, timecode ; vide : date du fichier)"),
+    ("First sample at (comp seconds)", "Premier échantillon à (secondes de composition)"),
+    (
+        "Writes Final Cut Pro XML (.xml), which Premiere Pro opens with File ▸ Import. Native .prproj files are not written.",
+        "Écrit un XML Final Cut Pro (.xml), que Premiere Pro ouvre avec Fichier ▸ Importer. Les fichiers .prproj natifs ne sont pas écrits.",
+    ),
+    ("File", "Fichier"),
+    ("Format", "Format"),
+    ("Pre-render (ProRes 4444)", "Prérendu (ProRes 4444)"),
+    ("Precomps", "Précompositions"),
+    ("Frame rate", "Fréquence d’images"),
+    ("Description", "Description"),
+    ("Category", "Catégorie"),
+    ("Embed footage files", "Intégrer les fichiers de métrage"),
+    ("Embed up to (MB)", "Intégrer jusqu’à (Mo)"),
+    ("Use the sRGB curve (ignore Gamma)", "Utiliser la courbe sRVB (ignorer le gamma)"),
+    ("ICC profile (replaces the numbers)", "Profil ICC (remplace les valeurs)"),
+    ("Rectangle", "Rectangle"),
+    ("Ellipse", "Ellipse"),
+    ("Orient Along Path", "Orienter le long du tracé"),
+    ("Orient Towards Camera", "Orienter vers la caméra"),
+    ("Orient Towards Point of Interest", "Orienter vers le point d’intérêt"),
+    ("Single Composition", "Composition unique"),
+    ("Multiple Compositions", "Plusieurs compositions"),
+    ("Dissolve Front Layer", "Fondu du calque avant"),
+    ("Cross Dissolve Front and Back Layers", "Fondu enchaîné des calques avant et arrière"),
+    ("Interpret Straight - Unmatted", "Interpréter comme direct – sans fond"),
+    ("Interpret Premultiplied - Matted With Color", "Interpréter comme prémultiplié – sur fond coloré"),
+    ("Upper Field First", "Trame supérieure en premier"),
+    ("Lower Field First", "Trame inférieure en premier"),
+    ("Embedded / sRGB", "Intégré / sRVB"),
+    ("Use Source File Timecode", "Utiliser le timecode du fichier source"),
+    ("Timecode", "Timecode"),
+    ("Frames", "Images"),
+    ("Feet + Frames (35mm)", "Pieds + images (35 mm)"),
+    ("Feet + Frames (16mm)", "Pieds + images (16 mm)"),
+    ("Clip", "Écrêtage"),
+    ("Compand", "Compandage"),
+    ("Current Frame", "Image actuelle"),
+    ("Work Area", "Zone de travail"),
+    ("Luminance", "Luminance"),
+    ("Create Markers", "Créer des repères"),
+    ("Split Layers", "Fractionner les calques"),
+    ("Split and Precompose", "Fractionner et précomposer"),
+    ("CMX 3600 EDL (.edl, V1 only)", "CMX 3600 EDL (.edl, V1 uniquement)"),
+    ("OMF (.omf, audio)", "OMF (.omf, audio)"),
+    ("Layers Premiere can't show (text, shapes, effects…)", "Calques que Premiere ne peut pas afficher (texte, formes, effets…)"),
+    ("All layers", "Tous les calques"),
+    ("None (leave them out)", "Aucun (les exclure)"),
+    ("Nested sequences", "Séquences imbriquées"),
+    ("Pre-render", "Prérendu"),
+    ("Puppet Follow-Through", "Prolongement de la marionnette"),
+    ("Puppet Record Options", "Options d’enregistrement de la marionnette"),
+    ("Free Transform Points", "Transformation libre des points"),
+    ("Mask Shape", "Forme du masque"),
+    ("Auto-Orientation", "Orientation automatique"),
+    ("Go to Time", "Accéder au temps"),
+    ("Add Guide", "Ajouter un repère"),
+    ("Add Percentage Guide", "Ajouter un repère en pourcentage"),
+    ("New Composition from Selection", "Nouvelle composition à partir de la sélection"),
+    ("Project Settings", "Paramètres du projet"),
+    ("Auto-trace", "Tracé automatique"),
+    ("Scene Edit Detection", "Détection des coupes de scène"),
+    ("Align Video to Data", "Aligner la vidéo sur les données"),
+    ("Export Adobe Premiere Pro Project", "Exporter un projet Adobe Premiere Pro"),
+    ("New Placeholder", "Nouvel espace réservé"),
+    ("Solid Settings", "Paramètres du solide"),
+    ("Save as Template", "Enregistrer en tant que modèle"),
+    ("My Custom RGB", "Mon RVB personnalisé"),
+    ("GPU Acceleration (no GPU: software)", "Accélération GPU (aucun GPU : logiciel)"),
+    ("Sort by {}, {}", "Trier par {}, {}"),
+    ("Sort by {}", "Trier par {}"),
+    ("Label of {}: {}", "Étiquette de {} : {}"),
+    ("Comment of {}: {}", "Commentaire de {} : {}"),
+    ("Project color depth: {}", "Profondeur de couleur du projet : {}"),
+    ("Start (s)", "Début (s)"),
+    ("Duration (s)", "Durée (s)"),
+    ("Frames per second", "Images par seconde"),
+    ("Bottom", "Bas"),
+    ("Bitrate (kbps)", "Débit (kb/s)"),
+    ("Frames between key frames (0 = every 2 s)", "Images entre les images clés (0 = toutes les 2 s)"),
+    ("Click in the Composition panel to sample text {}", "Cliquez dans le panneau Composition pour échantillonner le texte {}"),
+    ("Video preview off: audio only", "Prévisualisation vidéo désactivée : audio uniquement"),
+    ("Open in Essential Graphics", "Ouvrir dans Graphiques essentiels"),
+    ("Video preview is off (Preview panel): audio only", "La prévisualisation vidéo est désactivée (panneau Prévisualisation) : audio uniquement"),
+    ("Solid…", "Solide…"),
+    ("Click to sample color", "Cliquez pour échantillonner la couleur"),
+    ("Advanced", "Avancé"),
+    ("Rescan Fonts", "Réanalyser les polices"),
+    ("Track Matte pick whip: drag onto a layer", "Sélecteur d’estampe : faites glisser vers un calque"),
+    ("Play/Stop", "Lecture/Arrêt"),
+    ("Selection Tool", "Outil Sélection"),
+    ("Hand Tool", "Outil Main"),
+    ("Zoom Tool", "Outil Zoom"),
+    ("Orbit Around Cursor Tool", "Outil Orbite autour du curseur"),
+    ("Pan Under Cursor Tool", "Outil Panoramique sous le curseur"),
+    ("Dolly Towards Cursor Tool", "Outil Travelling vers le curseur"),
+    ("Rotation Tool", "Outil Rotation"),
+    ("Pan Behind (Anchor Point) Tool", "Outil Déplacement derrière (point d’ancrage)"),
+    ("Rectangle Tool", "Outil Rectangle"),
+    ("Rounded Rectangle Tool", "Outil Rectangle arrondi"),
+    ("Ellipse Tool", "Outil Ellipse"),
+    ("Polygon Tool", "Outil Polygone"),
+    ("Star Tool", "Outil Étoile"),
+    ("Pen Tool", "Outil Plume"),
+    ("Add Vertex Tool", "Outil Ajout de sommet"),
+    ("Delete Vertex Tool", "Outil Suppression de sommet"),
+    ("Convert Vertex Tool", "Outil Conversion de sommet"),
+    ("Mask Feather Tool", "Outil Contour progressif du masque"),
+    ("Horizontal Type Tool", "Outil Texte horizontal"),
+    ("Vertical Type Tool", "Outil Texte vertical"),
+    ("Brush Tool", "Outil Pinceau"),
+    ("Clone Stamp Tool", "Outil Tampon de duplication"),
+    ("Eraser Tool", "Outil Gomme"),
+    ("Roto Brush Tool", "Outil Pinceau de rotoscopie"),
+    ("Refine Edge Tool", "Outil Affinage des contours"),
+    ("Object Matte Tool", "Outil Estampe d’objet"),
+    ("Puppet Position Pin Tool", "Outil Épingle de position de marionnette"),
+    ("Puppet Starch Pin Tool", "Outil Épingle de rigidité de marionnette"),
+    ("Puppet Bend Pin Tool", "Outil Épingle de courbure de marionnette"),
+    ("Puppet Advanced Pin Tool", "Outil Épingle avancée de marionnette"),
+    ("Puppet Overlap Pin Tool", "Outil Épingle de chevauchement de marionnette"),
+    ("Shortcut", "Raccourci"),
+    ("Range", "Plage"),
+    ("Play From", "Lire à partir de"),
+    ("Rec. 2020", "Rec. 2020"),
+    ("Light…", "Lumière…"),
+    ("Camera…", "Caméra…"),
+    ("Null Object", "Objet nul"),
+    ("Shape Layer", "Calque de forme"),
+    ("Adjustment Layer", "Calque de réglage"),
+    ("Layer Settings…", "Paramètres du calque…"),
+    ("Create Shapes from Vector Layer", "Créer des formes à partir du calque vectoriel"),
+    ("Create Shapes from Text", "Créer des formes à partir du texte"),
+    ("Create Masks from Text", "Créer des masques à partir du texte"),
+    ("New Mask", "Nouveau masque"),
+    ("Center In View", "Centrer dans la vue"),
+    ("Fit to Comp", "Ajuster à la composition"),
+    ("Flip Horizontal", "Miroir horizontal"),
+    ("Flip Vertical", "Miroir vertical"),
+    ("Enable Time Remapping", "Activer le remappage temporel"),
+    ("Time-Reverse Layer", "Inverser le temps du calque"),
+    ("Freeze Frame", "Image figée"),
+    ("Freeze On Last Frame", "Figer à la dernière image"),
+    ("Add Marker", "Ajouter un repère"),
+    ("Bring Layer to Front", "Placer le calque au premier plan"),
+    ("Bring Layer Forward", "Avancer le calque d’un cran"),
+    ("Send Layer Backward", "Reculer le calque d’un cran"),
+    ("Send Layer to Back", "Placer le calque à l’arrière-plan"),
+    ("Pre-compose…", "Précomposer…"),
+    ("Split Layer", "Fractionner le calque"),
+    ("Layer Style Options...", "Options de style de calque..."),
+    ("Convert to Editable Styles", "Convertir en styles modifiables"),
+    ("Show All", "Tout afficher"),
+    ("Remove All", "Tout supprimer"),
+    ("Separate Dimensions", "Dissocier les dimensions"),
+    ("Add Property to Essential Graphics", "Ajouter la propriété aux graphiques essentiels"),
+    ("Continuous Bezier", "Bézier continu"),
+    ("Auto Bezier", "Bézier automatique"),
+    ("Lock To Time", "Verrouiller sur le temps"),
+    ("Rove Across Time", "Répartir dans le temps"),
+    ("Anchor Point", "Point d’ancrage"),
+    ("All Transform Properties", "Toutes les propriétés de transformation"),
+    ("Line Anchor", "Ancrage de ligne"),
+    ("Line Spacing", "Interligne"),
+    ("Character Offset", "Décalage de caractère"),
+    ("Character Value", "Valeur de caractère"),
+    ("Fill Color: RGB", "Couleur de remplissage : RVB"),
+    ("Fill Color: Hue", "Couleur de remplissage : teinte"),
+    ("Fill Color: Saturation", "Couleur de remplissage : saturation"),
+    ("Fill Color: Brightness", "Couleur de remplissage : luminosité"),
+    ("Fill Color: Opacity", "Couleur de remplissage : opacité"),
+    ("Stroke Color: RGB", "Couleur du contour : RVB"),
+    ("Stroke Color: Hue", "Couleur du contour : teinte"),
+    ("Stroke Color: Saturation", "Couleur du contour : saturation"),
+    ("Stroke Color: Brightness", "Couleur du contour : luminosité"),
+    ("Stroke Color: Opacity", "Couleur du contour : opacité"),
+    ("Stroke Width", "Épaisseur du contour"),
+    ("Front: Color", "Face avant : couleur"),
+    ("Bevel: Color", "Biseau : couleur"),
+    ("Side: Color", "Côté : couleur"),
+    ("Back: Color", "Face arrière : couleur"),
+    ("Effect Controls", "Contrôles d’effets"),
+    ("Effects & Presets", "Effets et préréglages"),
+    ("Motion Sketch", "Croquis de mouvement"),
+    ("Render Queue", "File d’attente de rendu"),
+    ("Mask Interpolation", "Interpolation de masque"),
+    ("Script Console", "Console de scripts"),
+    ("Essential Graphics", "Graphiques essentiels"),
+    ("ScriptUI Panel", "Panneau ScriptUI"),
+    ("Video Scopes", "Oscilloscopes vidéo"),
+    ("Media Browser", "Explorateur de médias"),
+    ("Content-Aware Fill", "Remplissage adapté au contenu"),
+    ("Create Nulls From Paths", "Créer des objets nuls à partir de tracés"),
+    ("VR Comp Editor", "Éditeur de composition VR"),
+    ("Resolution", "Résolution"),
+    ("Overlays", "Incrustations"),
+    ("Layer Controls", "Contrôles de calque"),
+    ("Loop", "Boucle"),
+    ("Cache Before Playback", "Mettre en cache avant la lecture"),
+    ("Pre-roll", "Pré-roulement"),
+    ("Post-roll", "Post-roulement"),
+    ("If caching, play cached frames", "En cas de mise en cache, lire les images en cache"),
+    ("Interpret Footage", "Interpréter le métrage"),
+    ("Create a new Folder", "Créer un nouveau dossier"),
+    ("Create a new Composition", "Créer une nouvelle composition"),
+    ("First Frame", "Première image"),
+    ("Previous Frame", "Image précédente"),
+    ("Next Frame", "Image suivante"),
+    ("Last Frame", "Dernière image"),
+    ("Name (A–Z)", "Nom (A–Z)"),
+    ("Merged PRs", "PR fusionnées"),
+    ("Lines added", "Lignes ajoutées"),
+    ("Lines deleted", "Lignes supprimées"),
+    ("Line delta", "Écart de lignes"),
+    ("Binary assets added", "Ressources binaires ajoutées"),
+    ("Binary assets removed", "Ressources binaires supprimées"),
+    ("First commit", "Premier commit"),
+    ("Last commit", "Dernier commit"),
+    ("Display name", "Nom affiché"),
+    ("Real name", "Vrai nom"),
+    ("ArtCraft website", "Site web d’ArtCraft"),
+    ("Source code on GitHub", "Code source sur GitHub"),
+    ("3D Renderer", "Moteur de rendu 3D"),
+    ("Black", "Noir"),
+    ("White", "Blanc"),
+    ("Composition Settings", "Paramètres de composition"),
+    ("Preset Name", "Nom du préréglage"),
+    ("Lock Aspect Ratio", "Verrouiller le rapport d’aspect"),
+    ("Frame Rate presets", "Préréglages de fréquence d’images"),
+    ("Background Color", "Couleur d’arrière-plan"),
+    ("Basic", "Général"),
+    ("Shutter Angle", "Angle d’obturation"),
+    ("Shutter Phase", "Phase d’obturation"),
+    ("Samples Per Frame", "Échantillons par image"),
+    ("Adaptive Sample Limit", "Limite d’échantillons adaptatifs"),
+    ("X and Y", "X et Y"),
+    ("X only", "X uniquement"),
+    ("Y only", "Y uniquement"),
+    ("Track Camera", "Suivi de caméra"),
+    ("Warp Stabilizer", "Stabilisateur de déformation"),
+    ("Track Motion", "Suivi du mouvement"),
+    ("Stabilize Motion", "Stabiliser le mouvement"),
+    ("Motion Source:", "Source du mouvement :"),
+    ("Current Track:", "Piste actuelle :"),
+    ("Track Type:", "Type de suivi :"),
+    ("Motion Target:", "Cible du mouvement :"),
+    ("Track Mask:", "Suivi du masque :"),
+    ("Analyze forward", "Analyser vers l’avant"),
+    ("Analyze backward", "Analyser vers l’arrière"),
+    ("Continue Tracking", "Poursuivre le suivi"),
+    ("Stop Tracking", "Arrêter le suivi"),
+    ("Adapt Feature", "Adapter la caractéristique"),
+    ("Extrapolate Motion", "Extrapoler le mouvement"),
+    ("Attach Point", "Point de rattachement"),
+    ("Track Name", "Nom de la piste"),
+    ("Motion Tracker Options", "Options du suivi de mouvement"),
+    ("Motion Tracker Apply Options", "Options d’application du suivi de mouvement"),
+    ("Edit Value Graph", "Modifier la courbe de valeur"),
+    ("Edit Speed Graph", "Modifier la courbe de vitesse"),
+    ("Show Reference Graph", "Afficher la courbe de référence"),
+    (
+        "Auto-Select Graph Type (speed graph for spatial properties, else value graph)",
+        "Sélection automatique du type de courbe (vitesse pour les propriétés spatiales, valeur sinon)",
+    ),
+    ("Auto-zoom graph height", "Zoom automatique sur la hauteur du graphique"),
+    ("Fit all graphs to view", "Ajuster tous les graphiques à la vue"),
+    ("Fit selection to view", "Ajuster la sélection à la vue"),
+    (
+        "Snap (key drags snap to the current time and other keys)",
+        "Aimantation (les images clés déplacées s’alignent sur le temps courant et les autres images clés)",
+    ),
+    ("Show Transform Box when multiple keys are selected", "Afficher le cadre de transformation lorsque plusieurs images clés sont sélectionnées"),
+    ("Separate Dimensions (Position)", "Dissocier les dimensions (position)"),
+    ("Convert selected keyframes to Hold", "Convertir les images clés sélectionnées en images figées"),
+    ("Convert selected keyframes to Linear", "Convertir les images clés sélectionnées en linéaire"),
+    ("Convert selected keyframes to Auto Bezier", "Convertir les images clés sélectionnées en Bézier automatique"),
+    ("Easy Ease (F9)", "Lissage (F9)"),
+    ("Easy Ease In (Shift+F9)", "Lissage entrant (Maj+F9)"),
+    ("Easy Ease Out (Ctrl+Shift+F9)", "Lissage sortant (Ctrl+Maj+F9)"),
+    ("Spatial Path", "Trajectoire spatiale"),
+    ("Temporal Path", "Trajectoire temporelle"),
+    ("All the Same", "Tous identiques"),
+    ("All Independently", "Tous indépendants"),
+    ("Noise Type:", "Type de bruit :"),
+    ("Apply To:", "Appliquer à :"),
+    ("Temporal Graph", "Courbe temporelle"),
+    ("Keyframe Rate:", "Fréquence des images clés :"),
+    ("Capture speed at:", "Vitesse de capture à :"),
+    ("Start Capture", "Démarrer la capture"),
+    ("Cancel Capture", "Annuler la capture"),
+    ("Small Caps", "Petites capitales"),
+    ("All Small Caps", "Tout en petites capitales"),
+    ("Superscript / Superior", "Exposant / supérieur"),
+    ("Subscript / Inferior", "Indice / inférieur"),
+    ("Standard Ligatures", "Ligatures standard"),
+    ("Discretionary Ligatures", "Ligatures facultatives"),
+    ("Contextual Alternates", "Alternatives contextuelles"),
+    ("Stylistic Alternates", "Alternatives stylistiques"),
+    ("Titling Alternates", "Alternatives de titrage"),
+    ("Default Figure Style", "Style de chiffres par défaut"),
+    ("Tabular Lining", "Chiffres alignés tabulaires"),
+    ("Proportional Oldstyle", "Chiffres elzéviriens proportionnels"),
+    ("Proportional Lining", "Chiffres alignés proportionnels"),
+    ("Tabular Oldstyle", "Chiffres elzéviriens tabulaires"),
+    ("Fill Over Stroke", "Remplissage sur le contour"),
+    ("Stroke Over Fill", "Contour sur le remplissage"),
+    ("Stroke order", "Ordre du contour"),
+    ("Single-line Composer", "Composeur de ligne unique"),
+    ("Every-line Composer", "Composeur de toutes les lignes"),
+    ("Text direction", "Direction du texte"),
+    ("Recently Used", "Récemment utilisés"),
+    ("User Presets", "Préréglages utilisateur"),
+    ("Remove from Favorites", "Retirer des favoris"),
+    ("Show Animation Presets", "Afficher les animations prédéfinies"),
+    ("    Refresh List", "    Actualiser la liste"),
+    ("    Clear Recently Used", "    Effacer les éléments récemment utilisés"),
+    ("Show 32 bpc Effects Only", "Afficher uniquement les effets 32 bpc"),
+    ("Show GPU Accelerated Effects Only", "Afficher uniquement les effets accélérés par GPU"),
+    ("Show Effects for All Color Depths", "Afficher les effets pour toutes les profondeurs de couleur"),
+    ("* Animation Presets", "* Animations prédéfinies"),
+    ("Select a layer to apply to", "Sélectionnez un calque auquel appliquer"),
+    ("Search effects and presets", "Rechercher des effets et des préréglages"),
+    ("Building waveform…", "Création de la forme d’onde…"),
+    ("No effects. Drag one from Effects & Presets.", "Aucun effet. Faites-en glisser un depuis Effets et préréglages."),
+    (
+        "Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it",
+        "Cliquez sur l’anneau pour ajouter une couleur ; Alt-clic sur un point d’arrêt (ou faites-le glisser hors du dégradé) pour le supprimer",
+    ),
+    (
+        "Start from a ready-made project. Opening a template makes an untitled copy.",
+        "Partez d’un projet prêt à l’emploi. L’ouverture d’un modèle crée une copie sans titre.",
+    ),
+    ("Square Pixels", "Pixels carrés"),
+    ("Alpha Expansion:", "Expansion de l’alpha :"),
+    ("Fill Method:", "Méthode de remplissage :"),
+    ("Edge Blend", "Fusion des bords"),
+    ("Entire Duration", "Durée entière"),
+    ("Reference Frame:", "Image de référence :"),
+    ("Use Current Time", "Utiliser le temps courant"),
+    ("Generate Fill Layer", "Générer un calque de remplissage"),
+    ("Lighting Correction:", "Correction de l’éclairage :"),
+    ("Create Text and Camera", "Créer un texte et une caméra"),
+    ("Create Solid and Camera", "Créer un solide et une caméra"),
+    ("Create Null and Camera", "Créer un objet nul et une caméra"),
+    ("Create Shadow Catcher, Camera and Light", "Créer un récepteur d’ombres, une caméra et une lumière"),
+    ("Unable to solve camera", "Impossible de résoudre la caméra"),
+    ("Waiting to solve", "En attente de résolution"),
+    ("Create Camera", "Créer une caméra"),
+    ("track point", "point de suivi"),
+    ("Ruler zero point", "Point zéro de la règle"),
+    ("Vertical ruler", "Règle verticale"),
+    ("Horizontal ruler", "Règle horizontale"),
+    ("Viewer controls", "Contrôles du visualiseur"),
+    ("Resolution/Down Sample Factor", "Résolution et facteur de sous-échantillonnage"),
+    ("Adjust Exposure", "Ajuster l’exposition"),
+    ("Snapshot taken", "Instantané pris"),
+    ("Fast Previews", "Aperçus rapides"),
+    ("3D View", "Vue 3D"),
+    ("Current time", "Temps courant"),
+    ("Layer Transform", "Transformation du calque"),
+    ("Reset Transform", "Réinitialiser la transformation"),
+    ("Text Animation", "Animation de texte"),
+    ("Text Animation Presets", "Animations de texte prédéfinies"),
+    ("EffectCraft on getartcraft.com", "EffectCraft sur getartcraft.com"),
+    ("Small Screen", "Petit écran"),
+    ("Tool Creates Shape", "L’outil crée une forme"),
+    ("Tool Creates Mask", "L’outil crée un masque"),
+    ("Blend Mode", "Mode de fusion"),
+    ("Show mesh", "Afficher le maillage"),
+    ("Record Options...", "Options d’enregistrement..."),
+    ("Apply", "Appliquer"),
+    ("Analyze", "Analyser"),
+    ("Add Point", "Ajouter un point"),
+    ("Remove Point", "Supprimer le point"),
+    ("Render", "Rendu"),
+    ("Save Current as Template…", "Enregistrer l’actuel comme modèle…"),
+    ("New Composition From Footage", "Nouvelle composition à partir d’un métrage"),
+    ("Search", "Rechercher"),
+    ("(no composition)", "(aucune composition)"),
+    ("per second", "par seconde"),
+    ("Waveform", "Forme d’onde"),
+    ("steps", "étapes"),
+    ("Export Scene to Blender...", "Exporter la scène vers Blender..."),
+    ("Preview", "Prévisualisation"),
+    (
+        "Hands-on tutorials that run inside EffectCraft. Do each step yourself, or press Show me.",
+        "Des tutoriels pratiques qui se déroulent dans EffectCraft. Réalisez chaque étape vous-même, ou appuyez sur Montrez-moi.",
+    ),
+    ("Remove this object's strokes", "Supprimer les traits de cet objet"),
+    ("Object {}", "Objet {}"),
+    ("Object {} ({})", "Objet {} ({})"),
+    ("Output file name template", "Modèle de nom du fichier de sortie"),
+    ("Output file: {}", "Fichier de sortie : {}"),
+    (
+        "JavaScript with the After Effects scripting object model — try app.project.numItems",
+        "JavaScript avec le modèle d’objets de script After Effects — essayez app.project.numItems",
+    ),
+    ("Source", "Source"),
+    ("Label {} color", "Couleur de l’étiquette {}"),
+    ("Label {} name", "Nom de l’étiquette {}"),
+    ("Stroke width presets", "Préréglages d’épaisseur du contour"),
+    ("Close font search", "Fermer la recherche de polices"),
 ];
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// Check rendered feature labels only. Format names, compatibility tokens and user text
+    /// are not subject to this guard, and a missing translation keeps its English fallback.
+    #[test]
+    fn renamed_panel_labels_do_not_reintroduce_vendor_names() {
+        for language in ["en", "ja", "zh-hans", "zh-hant", "fr", "sv", "ka", "cs", "de", "es", "pl", "pt-br", "ru", "uk"] {
+            set_current(language);
+            for source in ["GPU Acceleration ({})", "GPU Acceleration (no GPU: software)", "Software Rendering", "Video Scopes"] {
+                let rendered = tr(source);
+                assert!(!rendered.is_empty(), "{language}: {source}");
+                let label = rendered.to_lowercase();
+                for mark in ["lumetri", "mercury", "mocha", "keylight"] {
+                    assert!(!label.contains(mark), "{language}: {source} -> {rendered}");
+                }
+            }
+            // A real interchange label remains factual, not rewritten or rejected.
+            assert!(!tr("Export Adobe Premiere Pro Project").is_empty());
+        }
+        set_current("en");
+    }
+
     /// The interface text that has moved into this catalog. Add a panel here when you convert it;
-    /// the tests below then keep it translated.
-    const CONVERTED: &[(&str, &str)] = &[
+    /// `every_row_is_used_by_a_converted_panel` then looks for its rows' English sources in it.
+    pub(super) const CONVERTED: &[(&str, &str)] = &[
         ("color_picker.rs", include_str!("../color_picker.rs")),
         ("credits.rs", include_str!("../credits.rs")),
+        ("dock.rs", include_str!("../dock.rs")),
+        ("dock_ui.rs", include_str!("../dock_ui.rs")),
         ("header.rs", include_str!("../header.rs")),
-        ("menus.rs", include_str!("../menus.rs")),
+        ("menus/bar.rs", include_str!("../menus/bar.rs")),
+        ("menus/commands.rs", include_str!("../menus/commands.rs")),
+        ("menus/entries.rs", include_str!("../menus/entries.rs")),
+        ("menus/frontend.rs", include_str!("../menus/frontend.rs")),
+        ("menus/invoke.rs", include_str!("../menus/invoke.rs")),
+        ("menus/shortcuts.rs", include_str!("../menus/shortcuts.rs")),
+        ("state.rs", include_str!("../state.rs")),
+        ("prefs_live.rs", include_str!("../prefs_live.rs")),
+        ("updates_ui.rs", include_str!("../updates_ui.rs")),
         ("widgets.rs", include_str!("../widgets.rs")),
+        ("panels/aep_losses.rs", include_str!("../panels/aep_losses.rs")),
         ("panels/anim_tools.rs", include_str!("../panels/anim_tools.rs")),
         ("panels/camera_tracker_ui.rs", include_str!("../panels/camera_tracker_ui.rs")),
         ("panels/comp_settings.rs", include_str!("../panels/comp_settings.rs")),
         ("panels/content_fill_panel.rs", include_str!("../panels/content_fill_panel.rs")),
         ("panels/delete_items.rs", include_str!("../panels/delete_items.rs")),
+        ("panels/unprecompose.rs", include_str!("../panels/unprecompose.rs")),
         ("panels/gradient_editor.rs", include_str!("../panels/gradient_editor.rs")),
         ("panels/dialogs.rs", include_str!("../panels/dialogs.rs")),
         ("panels/dialogs_3d.rs", include_str!("../panels/dialogs_3d.rs")),
-        ("panels/effect_controls.rs", include_str!("../panels/effect_controls.rs")),
+        ("panels/effect_controls/common.rs", include_str!("../panels/effect_controls/common.rs")),
+        ("panels/effect_controls/editors.rs", include_str!("../panels/effect_controls/editors.rs")),
+        ("panels/effect_controls/panel.rs", include_str!("../panels/effect_controls/panel.rs")),
+        ("panels/effect_controls/rows.rs", include_str!("../panels/effect_controls/rows.rs")),
+        ("panels/effect_controls/viewer.rs", include_str!("../panels/effect_controls/viewer.rs")),
         ("panels/effects_presets.rs", include_str!("../panels/effects_presets.rs")),
         ("panels/essential.rs", include_str!("../panels/essential.rs")),
         ("panels/expr_bar.rs", include_str!("../panels/expr_bar.rs")),
@@ -4476,7 +10352,7 @@ mod tests {
         ("panels/markers_ui.rs", include_str!("../panels/markers_ui.rs")),
         ("panels/media_panels.rs", include_str!("../panels/media_panels.rs")),
         ("panels/misc.rs", include_str!("../panels/misc.rs")),
-        ("panels/mod.rs", include_str!("../panels/mod.rs")),
+        ("panels.rs", include_str!("../panels.rs")),
         ("panels/paint_panels.rs", include_str!("../panels/paint_panels.rs")),
         ("panels/path_vr_panels.rs", include_str!("../panels/path_vr_panels.rs")),
         ("panels/precomp.rs", include_str!("../panels/precomp.rs")),
@@ -4496,90 +10372,97 @@ mod tests {
         ("panels/tracker.rs", include_str!("../panels/tracker.rs")),
         ("panels/unsaved.rs", include_str!("../panels/unsaved.rs")),
         ("panels/viewer.rs", include_str!("../panels/viewer.rs")),
+        ("panels/viewer/frame.rs", include_str!("../panels/viewer/frame.rs")),
+        ("panels/viewer/geometry.rs", include_str!("../panels/viewer/geometry.rs")),
+        ("panels/viewer/gesture.rs", include_str!("../panels/viewer/gesture.rs")),
+        ("panels/viewer/shapes.rs", include_str!("../panels/viewer/shapes.rs")),
+        ("panels/viewer/tools.rs", include_str!("../panels/viewer/tools.rs")),
+        ("panels/viewer/view.rs", include_str!("../panels/viewer/view.rs")),
         ("panels/viewer_tools.rs", include_str!("../panels/viewer_tools.rs")),
         ("panels/viewers.rs", include_str!("../panels/viewers.rs")),
         // Text the interface draws but does not own: the settings pages and the viewer's channel
         // and Fast Previews lists come from the engine as data, so their source strings live here.
-        // Both files pass the literal scan below unchanged (they hold no drawn literals).
-        ("engine settings pages", include_str!("../../../engine/src/prefs.rs")),
+        ("engine settings pages", include_str!("../../../engine/src/settings/prefs/dialog.rs")),
+        ("engine settings choices", include_str!("../../../engine/src/settings/prefs/choices.rs")),
         ("engine viewer channels", include_str!("../../../engine/src/viewer.rs")),
-        ("engine viewer commands", include_str!("../../../engine/src/commands/viewer_cmds.rs")),
+        ("engine viewer commands", include_str!("../../../engine/src/cmd/viewer_cmds.rs")),
+        // The text animator menu's labels come from the engine as data, like the settings pages.
+        ("engine text animator kinds", include_str!("../../../project/src/build.rs")),
     ];
 
-    /// Call shapes that hand a string literal straight to the user.
-    const CALLS: &[&str] = &[
-        ".label(\"",
-        ".button(\"",
-        ".small(\"",
-        ".strong(\"",
-        ".heading(\"",
-        ".monospace(\"",
-        ".on_hover_text(\"",
-        ".on_disabled_hover_text(\"",
-        ".hint_text(\"",
-        ".text(\"",
-        ".prefix(\"",
-        ".suffix(\"",
-        "RichText::new(\"",
-        "Label::new(\"",
-        "Button::new(\"",
-        "Window::new(\"",
-        "CollapsingHeader::new(\"",
-    ];
-
-    /// Literals that stay as they are: a unit or a separator reads the same in every language.
-    const UNITS: &[&str] = &[" px", "%", "·", "s", "ms", "°", "fps", " bpc", " mm", " s", " %", " pixels"];
-
     fn catalogs() -> Vec<(&'static str, &'static str)> {
-        JAPANESE
-            .iter()
-            .copied()
-            .chain(SIMPLIFIED_CHINESE.iter().copied())
-            .chain(TRADITIONAL_CHINESE.iter().copied())
-            .chain(UKRAINIAN.iter().copied())
-            .chain(PORTUGUESE.iter().copied())
-            .chain(CZECH.iter().copied())
-            .chain(SPANISH.iter().copied())
-            .collect()
+        ROWS.iter().flat_map(|(_, rows)| rows.iter().copied()).collect()
+    }
+
+    /// `en`'s row in `rows`, else `en`: what `tr` should return without pinning one wording.
+    fn row(rows: &[(&'static str, &'static str)], en: &'static str) -> &'static str {
+        rows.iter().find(|(source, _)| *source == en).map_or(en, |(_, translated)| *translated)
     }
 
     #[test]
-    fn czech_panels_translate_and_keep_project_content_and_argument_order() {
-        set_current("cs");
-        assert_eq!(tr("Composition Name:"), "Název kompozice:");
-        assert_eq!(tr("Cancel"), "Zrušit");
-        assert_eq!(tr("Guide Layer"), "Pomocná vrstva", "the layer context menus' item, as Layer ▸ Guide Layer");
-        assert_eq!(tr("my layer.mp4"), "my layer.mp4");
-        assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), "Použití zástupných souborů: Best");
-        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Krok 1 z 3: Colour");
-        assert_eq!(tr_args("Template: {}\n{}", &[&"Title", &"My description"]), "Šablona: Title\nMy description");
-        assert_eq!(tr_args("Leave all attributes in \"{}\"", &[&"File Čeština"]), "Ponechat všechny atributy v „File Čeština“");
-        assert_eq!(
-            tr_args("{} — double-click to open, {}-click to reveal", &[&"File.ecproj", &"Alt"]),
-            "File.ecproj — dvojklikem otevřete, kliknutím s Alt zobrazíte umístění"
+    fn the_toolbar_asks_the_catalog_for_the_tool_names() {
+        let header = include_str!("../header.rs");
+        for call in ["crate::i18n::tr(tool.label())", "crate::i18n::tr(cur.label())"] {
+            assert!(header.contains(call), "header.rs no longer draws {call}");
+        }
+        assert!(
+            header.contains("app.auto.add(&format!(\"tools.select.{tool:?}\"), row.rect, tool.label())"),
+            "the automation label must stay the English tool name"
         );
-        assert_eq!(tr_args("Proxy Use: {}", &[]), "Použití zástupných souborů: ");
-        set_current("en");
-        assert_eq!(tr("Composition Name:"), "Composition Name:");
+    }
+
+    #[test]
+    fn the_preview_panel_labels_are_translated() {
+        // The Preview panel draws these from a local closure, a check table and a roll tuple, none of
+        // which the call-shape scan sees; they had no rows at all.
+        for key in [
+            "Shortcut",
+            "Range",
+            "Play From",
+            "Frame Rate",
+            "Resolution",
+            "Overlays",
+            "Layer Controls",
+            "Loop",
+            "Cache Before Playback",
+            "Pre-roll",
+            "Post-roll",
+            "If caching, play cached frames",
+        ] {
+            for (name, table) in [("Simplified", SIMPLIFIED_CHINESE), ("Traditional", TRADITIONAL_CHINESE)] {
+                let value = table.iter().find(|(k, _)| *k == key).map(|(_, v)| *v);
+                assert!(value.is_some_and(|v| !v.is_empty()), "{key} has no {name} row");
+            }
+        }
+        // A row is not a translation until the panel asks for it: the labels drawn one by one carry
+        // `tr(..)`, and the table and the roll tuple wrap the text they read at the call.
+        let source = include_str!("../panels/misc.rs");
+        for literal in ["Shortcut", "Range", "Play From", "Frame Rate", "Resolution", "Full Screen", "If caching, play cached frames"] {
+            assert!(source.contains(&format!("tr(\"{literal}\")")), "{literal} is drawn without asking the catalog");
+        }
+        for call in ["check_row(app, ui, &p, pos2(cx, cy), key, tr(text), on)", "Align2::LEFT_CENTER, tr(text),"] {
+            assert!(source.contains(call), "{call} no longer asks the catalog");
+        }
+        for table in ["\"Overlays\"", "\"Layer Controls\"", "\"Loop\"", "\"Cache Before Playback\"", "\"Pre-roll\"", "\"Post-roll\""] {
+            assert!(source.contains(table), "{table} is not in the panel");
+        }
     }
 
     /// A row that translates nothing, repeats a source string, or changes the number of values the
     /// English source carries is a bug in the catalog itself.
     #[test]
     fn catalogs_are_unique_and_keep_the_english_shape() {
-        let hans: Vec<&str> = SIMPLIFIED_CHINESE.iter().map(|(en, _)| *en).collect();
-        let hant: Vec<&str> = TRADITIONAL_CHINESE.iter().map(|(en, _)| *en).collect();
-        assert_eq!(hans, hant, "the two Chinese catalogs list different source strings");
-        // Japanese, Ukrainian and Czech may lag the Chinese catalogs: a missing row falls back to English.
-        for (name, cat) in [("Japanese", JAPANESE), ("Ukrainian", UKRAINIAN), ("Brazilian Portuguese", PORTUGUESE), ("Czech", CZECH), ("Spanish", SPANISH)] {
-            let extra: Vec<&str> = cat.iter().map(|(en, _)| *en).filter(|en| !hans.contains(en)).collect();
-            assert!(extra.is_empty(), "the {name} catalog lists source strings the Chinese ones don't: {extra:?}");
+        // Grouped by language: a source listed in two tables of one language is still a repeat.
+        let mut by_code: std::collections::BTreeMap<&str, Vec<&str>> = std::collections::BTreeMap::new();
+        for (code, rows) in ROWS {
+            by_code.entry(code).or_default().extend(rows.iter().map(|(en, _)| *en));
+        }
+        for (code, mut sources) in by_code {
+            sources.sort_unstable();
+            let listed = sources.len();
+            sources.dedup();
+            assert_eq!(listed, sources.len(), "{code}: a source string is listed twice");
         }
-        let mut sorted = hans.clone();
-        sorted.sort_unstable();
-        let listed = sorted.len();
-        sorted.dedup();
-        assert_eq!(listed, sorted.len(), "a source string is listed twice");
         for (en, translated) in catalogs() {
             assert!(!en.is_empty() && !translated.is_empty(), "empty row for {en:?}");
             assert!(en.contains("{}") || !en.contains('{'), "{en:?} has a placeholder but no `{{}}`");
@@ -4596,47 +10479,46 @@ mod tests {
         set_current("xx"); // a language without rows
         assert_eq!(tr("Composition Name:"), "Composition Name:");
         set_current("zh-hans");
-        assert_eq!(tr("Composition Name:"), "合成名称：");
+        assert_eq!(tr("Composition Name:"), row(SIMPLIFIED_CHINESE, "Composition Name:"));
         assert_eq!(tr("my layer.mp4"), "my layer.mp4");
         set_current("en");
     }
 
-    /// The same language preference used for the menus reaches panels immediately, and formatted
-    /// text keeps the caller's values intact even when they contain non-Ukrainian words.
+    /// Georgian also reads its own table, for text the other catalogs don't have yet.
     #[test]
-    fn ukrainian_panels_translate_and_keep_project_content() {
-        set_current("uk");
-        assert_eq!(tr("Composition Name:"), "Назва композиції:");
-        assert_eq!(tr("Cancel"), "Скасувати");
-        assert_eq!(tr("my layer.mp4"), "my layer.mp4");
-        assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), "Використання проксі: Best");
-        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Крок 1 з 3: Colour");
-        assert_eq!(tr_args("Template: {}\n{}", &[&"Title", &"My description"]), "Шаблон: Title\nMy description");
+    fn georgian_reads_its_own_panel_rows() {
+        set_current("ka");
+        for (source, _) in GEORGIAN_PANELS.iter().take(3) {
+            assert_eq!(tr(source), row(GEORGIAN_PANELS, source));
+        }
         set_current("en");
-        assert_eq!(tr("Composition Name:"), "Composition Name:");
     }
 
-    /// Brazilian Portuguese panels translate, fill values in order and keep project content.
+    /// Swedish panels translate, fill values in order and keep project content.
     #[test]
-    fn brazilian_portuguese_panels_translate_and_keep_project_content() {
-        set_current("pt-br");
-        assert_eq!(tr("Composition Name:"), "Nome da composição:");
-        assert_eq!(tr("Cancel"), "Cancelar");
+    fn swedish_panels_translate_and_keep_project_content() {
+        set_current("sv");
+        assert_eq!(tr("Composition Name:"), "Kompositionsnamn:");
+        assert_eq!(tr("Cancel"), "Avbryt");
         assert_eq!(tr("my layer.mp4"), "my layer.mp4");
-        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Etapa 1 de 3: Colour");
-        assert_eq!(tr("   OK   "), "   OK   ");
+        assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), "Proxyanvändning: Best");
+        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Steg 1 av 3: Colour");
         set_current("en");
         assert_eq!(tr("Cancel"), "Cancel");
     }
 
-    /// Spanish panels translate, fill values in order and keep project content.
+    /// French sets a no-break space before `:`, `;`, `?` and `!`, never a plain one, and keeps the
+    /// project's own text untouched.
     #[test]
-    fn spanish_panels_translate_and_keep_project_content() {
-        set_current("es");
-        assert_eq!(tr("Composition Name:"), "Nombre de la composición:");
-        assert_eq!(tr("Cancel"), "Cancelar");
+    fn french_panels_translate_and_keep_the_punctuation_rule() {
+        for (en, fr) in FRENCH {
+            assert!(!fr.contains(" :") && !fr.contains(" ;") && !fr.contains(" ?") && !fr.contains(" !"), "{en:?}: plain space before a high punctuation mark");
+        }
+        set_current("fr");
+        assert_eq!(tr("Composition Name:"), "Nom de la composition\u{a0}:");
+        assert_eq!(tr("Cancel"), "Annuler");
         assert_eq!(tr("my layer.mp4"), "my layer.mp4");
-        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Paso 1 de 3: Colour");
+        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Étape 1 sur 3\u{a0}: Colour");
         set_current("en");
         assert_eq!(tr("Cancel"), "Cancel");
     }
@@ -4645,11 +10527,13 @@ mod tests {
     #[test]
     fn tr_args_fills_values_in_order() {
         set_current("zh-hans");
-        assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), "代理使用：Best");
-        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "第 1 步，共 3 步：Colour");
-        assert_eq!(tr_args("Proxy Use: {}", &[]), "代理使用：");
+        let template = row(SIMPLIFIED_CHINESE, "Proxy Use: {}");
+        assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), template.replacen("{}", "Best", 1));
+        assert_eq!(tr_args("Proxy Use: {}", &[]), template.replacen("{}", "", 1));
         set_current("en");
+        assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "Step 1 of 3: Colour");
         assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), "Proxy Use: Best");
+        assert_eq!(tr_args("Proxy Use: {}", &[]), "Proxy Use: ");
     }
 
     /// Japanese reads its own rows: values fill the placeholders in order, and a name that is not a
@@ -4658,16 +10542,315 @@ mod tests {
     fn japanese_rows_translate_the_panels() {
         set_current("ja");
         assert_eq!(tr("Composition Name:"), "コンポジション名:");
+        // The panel/dialog second step: panel tabs, form labels, context menus and messages.
+        assert_eq!(tr("Effect Controls"), "エフェクトコントロール");
+        assert_eq!(tr("Media Duration"), "メディアの長さ");
+        assert_eq!(tr("Bring Layer to Front"), "レイヤーを最前面へ");
+        assert_eq!(tr("All Transform Properties"), "すべてのトランスフォームプロパティ");
+        assert_eq!(tr("Fill Color: RGB"), "塗りのカラー: RGB");
+        assert_eq!(tr("Lines added"), "追加行数");
+        // The composition-settings tabs and the Preview transport pass these through `tr` as
+        // variables, so a missing row would fall back to English unnoticed.
+        assert_eq!(tr("Basic"), "基本");
+        assert_eq!(tr("Advanced"), "詳細");
+        assert_eq!(tr("Play/Stop"), "再生/停止");
         assert_eq!(tr("my layer.mp4"), "my layer.mp4");
         assert_eq!(tr_args("Proxy Use: {}", &[&"Best"]), "プロキシの使用：Best");
         assert_eq!(tr_args("Step {} of {}: {}", &[&1, &3, &"Colour"]), "ステップ1/3：Colour");
         set_current("en");
     }
 
-    /// Every row is asked for by a converted panel: a leftover row means the panel went back to its
-    /// English literal. A string a helper draws for the panel (a toolbar tooltip, a popup item, a
-    /// checkbox label) is looked up inside that helper, so its English source only appears as a
-    /// literal there - `helper_labels_are_translated` keeps those helpers honest.
+    /// Every row is asked for by a converted panel: a leftover row is stale, because the panel's
+    /// English source changed or went away. A string a helper draws for the panel (a toolbar
+    /// tooltip, a popup item, a checkbox label) is looked up inside that helper, so its English
+    /// source only appears as a literal there.
+    #[test]
+    fn helper_and_painter_labels_are_translated() {
+        /// The `widgets.rs` helpers that draw a label, and which argument holds it.
+        const HELPER_LABELS: &[(&str, usize)] =
+            &[("text_button", 2), ("search_field", 3), ("text_field", 3), ("dropdown", 2), ("dropdown_tip", 2), ("text_fit", 3), ("check_label", 1)];
+        /// Literals that draw as they are: a brand, a value, a separator, a unit, and the kerning
+        /// sample pair the Character panel shows.
+        const VERBATIM: &[&str] = &["EffectCraft", "32", "dB", "···", "×", "V/A"];
+
+        /// The top-level arguments of a call, given the text after its `(`. A call split over
+        /// several lines is still one argument list, so this walks past newlines until the
+        /// parenthesis closes. It understands the two string forms a label can be written in - a
+        /// plain one with escapes and a raw one (`r"…"`, `r#"…"#`) - so a comma or parenthesis
+        /// inside either is not mistaken for code.
+        fn args_of(s: &str) -> Vec<&str> {
+            #[derive(Clone, Copy)]
+            enum Mode {
+                Code,
+                Str(bool),
+                Raw(usize),
+            }
+            let cs: Vec<(usize, char)> = s.char_indices().collect();
+            let (mut out, mut depth, mut start, mut end) = (Vec::new(), 0i32, None, s.len());
+            let mut mode = Mode::Code;
+            let mut k = 0;
+            while k < cs.len() {
+                let (i, c) = cs[k];
+                match mode {
+                    Mode::Raw(hashes) => {
+                        if c == '"' {
+                            let mut n = 0;
+                            while cs.get(k + 1 + n).is_some_and(|(_, h)| *h == '#') {
+                                n += 1;
+                            }
+                            if n >= hashes {
+                                mode = Mode::Code;
+                                k += n;
+                            }
+                        }
+                    }
+                    Mode::Str(escaped) => {
+                        mode = if c == '"' && !escaped { Mode::Code } else { Mode::Str(c == '\\' && !escaped) };
+                    }
+                    Mode::Code => match c {
+                        '"' => {
+                            mode = Mode::Str(false);
+                            if start.is_none() {
+                                start = Some(i);
+                            }
+                        }
+                        'r' if start.is_none() && cs.get(k + 1).is_some_and(|(_, n)| *n == '#' || *n == '"') => {
+                            let mut n = 0;
+                            while cs.get(k + 1 + n).is_some_and(|(_, h)| *h == '#') {
+                                n += 1;
+                            }
+                            if cs.get(k + 1 + n).is_some_and(|(_, q)| *q == '"') {
+                                mode = Mode::Raw(n);
+                                start = Some(i);
+                                k += n + 1;
+                            }
+                        }
+                        '(' | '[' | '{' => depth += 1,
+                        ')' | ']' | '}' => {
+                            if depth == 0 {
+                                end = i;
+                                break;
+                            }
+                            depth -= 1;
+                        }
+                        ',' if depth == 0 => {
+                            if let Some(st) = start {
+                                out.push(s[st..i].trim());
+                            }
+                            start = None;
+                        }
+                        c if !c.is_whitespace() && start.is_none() => start = Some(i),
+                        _ => {}
+                    },
+                }
+                k += 1;
+            }
+            if let Some(st) = start {
+                out.push(s[st..end].trim());
+            }
+            out
+        }
+
+        /// The text a literal argument draws: a plain string with its escapes undone, or a raw
+        /// string with none. `None` when the argument is not one literal (a concatenation, a call).
+        fn literal_text(arg: &str) -> Option<String> {
+            if let Some(rest) = arg.strip_prefix('r') {
+                let hashes = rest.chars().take_while(|c| *c == '#').count();
+                // An identifier that starts with `r` (`result`) is not a raw string: the quote has
+                // to follow the `#`s.
+                if rest.chars().nth(hashes) != Some('"') {
+                    return None;
+                }
+                let close = format!("\"{}", "#".repeat(hashes));
+                return arg.get(1 + hashes + 1..)?.strip_suffix(&close).map(str::to_string);
+            }
+            let body = arg.strip_prefix('"')?.strip_suffix('"')?;
+            // Decode the escapes that matter for the exemption: a literal written as `"\u{bb}"` is
+            // one character (`»`), not six.
+            let mut out = String::new();
+            let mut it = body.chars().peekable();
+            while let Some(c) = it.next() {
+                if c != '\\' {
+                    if c == '"' {
+                        return None; // two literals side by side
+                    }
+                    out.push(c);
+                    continue;
+                }
+                match it.next()? {
+                    '"' => out.push('"'),
+                    '\\' => out.push('\\'),
+                    'n' => out.push('\n'),
+                    't' => out.push('\t'),
+                    'x' => {
+                        let hex: String = it.by_ref().take(2).collect();
+                        let byte = u8::from_str_radix(&hex, 16).ok()?;
+                        out.push(char::from(byte));
+                    }
+                    'u' => {
+                        if it.next() != Some('{') {
+                            return None;
+                        }
+                        let hex: String = it.by_ref().take_while(|c| *c != '}').collect();
+                        out.push(char::from_u32(u32::from_str_radix(&hex, 16).ok()?)?);
+                    }
+                    other => {
+                        out.push('\\');
+                        out.push(other);
+                    }
+                }
+            }
+            Some(out)
+        }
+
+        /// `source` with comments blanked and the *contents* of every string literal blanked too,
+        /// with offsets, newlines and the quotes kept. Call tokens are looked for in this text, so a
+        /// `widgets::…(` or `.text(` that only appears inside a doc string or a sample is not
+        /// mistaken for a call; the argument list is then read from the original at that offset.
+        fn code_only(source: &str) -> String {
+            #[derive(Clone, Copy)]
+            enum Mode {
+                Code,
+                Str(bool),
+                Raw(usize),
+                Comment,
+            }
+            let cs: Vec<(usize, char)> = source.char_indices().collect();
+            // Byte-for-byte: a blanked character becomes as many spaces as its UTF-8 length, so
+            // every offset found here indexes the original source as well.
+            let mut out: Vec<u8> = Vec::with_capacity(source.len());
+            let keep = |out: &mut Vec<u8>, c: char| out.extend_from_slice(c.encode_utf8(&mut [0; 4]).as_bytes());
+            let blank = |out: &mut Vec<u8>, c: char| out.extend(std::iter::repeat_n(b' ', c.len_utf8()));
+            let mut mode = Mode::Code;
+            let mut k = 0;
+            while k < cs.len() {
+                let (_, c) = cs[k];
+                match mode {
+                    Mode::Comment => {
+                        if c == '\n' {
+                            mode = Mode::Code;
+                            keep(&mut out, c);
+                        } else {
+                            blank(&mut out, c);
+                        }
+                    }
+                    Mode::Raw(hashes) => {
+                        if c == '"' {
+                            let mut n = 0;
+                            while cs.get(k + 1 + n).is_some_and(|(_, h)| *h == '#') {
+                                n += 1;
+                            }
+                            if n >= hashes {
+                                keep(&mut out, c);
+                                for j in 1..=n {
+                                    keep(&mut out, cs[k + j].1);
+                                }
+                                mode = Mode::Code;
+                                k += n;
+                            } else {
+                                blank(&mut out, c);
+                            }
+                        } else {
+                            blank(&mut out, c);
+                        }
+                    }
+                    Mode::Str(escaped) => {
+                        if c == '"' && !escaped {
+                            mode = Mode::Code;
+                            keep(&mut out, c);
+                        } else {
+                            mode = Mode::Str(c == '\\' && !escaped);
+                            blank(&mut out, c);
+                        }
+                    }
+                    Mode::Code => match c {
+                        '"' => {
+                            mode = Mode::Str(false);
+                            keep(&mut out, c);
+                        }
+                        '/' if out.last() == Some(&b'/') => {
+                            // The first `/` stays; this one becomes a space. Both are one byte, so
+                            // the mask keeps its length and every offset still indexes the source.
+                            blank(&mut out, c);
+                            mode = Mode::Comment;
+                        }
+                        'r' if matches!(cs.get(k + 1), Some((_, n)) if *n == '#' || *n == '"') => {
+                            let mut n = 0;
+                            while cs.get(k + 1 + n).is_some_and(|(_, h)| *h == '#') {
+                                n += 1;
+                            }
+                            if cs.get(k + 1 + n).is_some_and(|(_, q)| *q == '"') {
+                                keep(&mut out, c);
+                                for j in 1..=n {
+                                    keep(&mut out, cs[k + j].1);
+                                }
+                                keep(&mut out, '"');
+                                mode = Mode::Raw(n);
+                                k += n + 1;
+                            } else {
+                                keep(&mut out, c);
+                            }
+                        }
+                        _ => keep(&mut out, c),
+                    },
+                }
+                k += 1;
+            }
+            debug_assert_eq!(out.len(), source.len(), "the mask must keep every byte offset");
+            String::from_utf8(out).expect("mask keeps UTF-8 boundaries")
+        }
+
+        for (path, source) in CONVERTED {
+            // The test module draws nothing; it holds sample strings. A test-only helper above it
+            // (`#[cfg(test)] pub(crate) fn press_key` in `dialogs.rs`) is kept in the scanned range,
+            // because production code follows it.
+            let cut = source
+                .match_indices("#[cfg(test)]")
+                .find(|(at, _)| source[at + "#[cfg(test)]".len()..].lines().take(3).any(|l| l.trim_start().starts_with("mod ")))
+                .map_or(source.len(), |(at, _)| at);
+            let source = &source[..cut];
+            let code = code_only(source);
+            let line_of = |at: usize| code[..at].matches('\n').count() + 1;
+            let check = |at: usize, arg: &str, what: &str| {
+                // A single character is a symbol or a glyph, not interface text - the same exemption
+                // the call-shape scan above makes. A call that already asks the catalog is not a
+                // literal here at all.
+                if let Some(text) = literal_text(arg)
+                    && text.chars().count() >= 2
+                    && !VERBATIM.contains(&text.as_str())
+                {
+                    panic!("{path}:{}: the interface text {arg} that {what} draws is not in the catalog", line_of(at));
+                }
+            };
+            for (call, index) in HELPER_LABELS {
+                let marker = format!("widgets::{call}(");
+                for (at, _) in code.match_indices(&marker) {
+                    if let Some(arg) = args_of(&source[at + marker.len()..]).get(*index) {
+                        check(at, arg, &format!("widgets::{call}"));
+                    }
+                }
+            }
+            for (at, _) in code.match_indices(".text(") {
+                if let Some(arg) = args_of(&source[at + ".text(".len()..]).get(2) {
+                    check(at, arg, "Painter::text");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn the_composition_settings_labels_are_translated() {
+        // The Composition Settings dialog (and New Composition) draws these from a `(label, value)`
+        // table, a tab array and a `match` arm, which the call-shape scan cannot see (#1451). They
+        // used to have no row in any catalog, so every interface drew them in English.
+        for key in ["Square Pixels", "Basic", "Advanced", "3D Renderer", "Black", "White", "Composition Settings"] {
+            for (name, table) in [("Simplified", SIMPLIFIED_CHINESE), ("Traditional", TRADITIONAL_CHINESE)] {
+                let value = table.iter().find(|(k, _)| *k == key).map(|(_, v)| *v);
+                assert!(value.is_some_and(|v| !v.is_empty()), "{key} has an empty {name} row");
+            }
+        }
+    }
+
     #[test]
     fn every_row_is_used_by_a_converted_panel() {
         for (en, _) in catalogs() {
@@ -4680,84 +10863,4 @@ mod tests {
             );
         }
     }
-
-    /// A label that a helper takes as an argument is drawn by the helper, so the helper has to ask
-    /// the catalog: `Checkbox::new` and `RadioButton::new` are not among the scanned call shapes
-    /// (the label is their second argument), which let the solid dialog's checkbox ship in English.
-    #[test]
-    fn helper_labels_are_translated() {
-        for (path, source) in CONVERTED {
-            for marker in ["Checkbox::new(", "RadioButton::new("] {
-                let mut from = 0;
-                while let Some(at) = source[from..].find(marker) {
-                    let at = from + at;
-                    let rest = &source[at + marker.len()..];
-                    let line = &rest[..rest.find('\n').unwrap_or(rest.len())];
-                    if let Some(q) = line.find('"') {
-                        let before = line[..q].trim_end();
-                        assert!(before.ends_with("tr("), "{path}: the `{marker}` label `{}` is not in the catalog", &line[q..]);
-                    }
-                    from = at + marker.len();
-                }
-            }
-        }
-    }
-
-    /// The Settings pages come from the engine as data, so the literal scan above cannot see them:
-    /// every title, section, label, choice, button, note and unit they draw needs a Chinese row
-    /// (#1178). Language names are written in their own language, and a few labels read the same
-    /// everywhere.
-    #[test]
-    fn settings_pages_are_translated() {
-        use effectcraft_engine::prefs::{Item, Kind, LANGUAGES, pages};
-        const VERBATIM: &[&str] = &["", "3D", "1/2", "1/4", "1/8", "sRGB", "Display P3", "px", "s", "%", "MB", "GB", "Hz", "pt"];
-        let mut drawn = Vec::new();
-        for page in pages() {
-            drawn.push(page.title);
-            for item in page.items {
-                match item {
-                    Item::Section(text) | Item::Note(text) | Item::Button { label: text, .. } => drawn.push(text),
-                    Item::Setting { label, kind, .. } => {
-                        drawn.push(label);
-                        match kind {
-                            Kind::Int(_, _, unit) | Kind::Float(_, _, unit) => drawn.push(unit),
-                            Kind::Choice(options) => drawn.extend(options.iter().map(|(l, _)| *l)),
-                            _ => {}
-                        }
-                    }
-                    _ => {}
-                }
-            }
-        }
-        drawn.push("Stored, but not used by EffectCraft yet");
-        let languages: Vec<&str> = LANGUAGES.iter().map(|(l, _)| *l).filter(|l| *l != "Match System").collect();
-        let hans: HashMap<&str, &str> = SIMPLIFIED_CHINESE.iter().copied().collect();
-        let mut missing: Vec<&str> = drawn.into_iter().filter(|en| !VERBATIM.contains(en) && !languages.contains(en) && !hans.contains_key(en)).collect();
-        missing.sort_unstable();
-        missing.dedup();
-        assert!(missing.is_empty(), "Settings text with no Simplified Chinese row: {missing:?}");
-    }
-
-    /// A newly hard-coded interface string fails here instead of shipping in English to every
-    /// language. It is a heuristic - it looks at the call shapes the panels use - and it ignores
-    /// one-character literals, which are punctuation or a key name rather than a sentence.
-    #[test]
-    fn converted_panels_have_no_unwrapped_literals() {
-        for (path, source) in CONVERTED {
-            for (n, line) in source.lines().enumerate() {
-                let code = line.split("//").next().unwrap_or(line);
-                for call in CALLS {
-                    let Some(at) = code.find(call) else { continue };
-                    let rest = &code[at + call.len()..];
-                    let Some(end) = rest.find('"') else { continue };
-                    let literal = &rest[..end];
-                    assert!(
-                        literal.chars().count() < 2 || UNITS.contains(&literal),
-                        "{path}:{}: interface text `{literal}` in `{call}` is not in the catalog",
-                        n + 1
-                    );
-                }
-            }
-        }
-    }
 }
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index 949ea3771..3f6a22445 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -48,6 +48,8 @@ pub enum Icon {
     Speaker,
     Solo,
     Lock,
+    /// An open padlock: the shackle lifted clear of the body on the right.
+    LockOpen,
     Shy,
     Collapse,
     Quality,
@@ -110,6 +112,8 @@ pub enum Icon {
     Fullscreen,
     Channel,
     Exposure,
+    /// Stroke width: three bars, thin to thick.
+    StrokeWidth,
     // links
     Chat,
     Globe,
@@ -160,6 +164,14 @@ impl Pen16<'_> {
     fn dot(&self, x: f32, y: f32, r: f32) {
         self.painter.circle_filled(self.p(x, y), r * self.s(), self.color);
     }
+    /// A filled dot in its own colour, for the icons that are coloured in After Effects too (the
+    /// channel picker's red, green and blue). The tint's alpha is kept, so a dimmed button stays
+    /// dimmed.
+    fn dot_colored(&self, x: f32, y: f32, r: f32, color: Color32) {
+        // `gamma_multiply` keeps the premultiplied channels consistent, so a dimmed tint dims the
+        // circle instead of darkening it twice.
+        self.painter.circle_filled(self.p(x, y), r * self.s(), color.gamma_multiply(self.color.a() as f32 / 255.0));
+    }
     fn rect(&self, x0: f32, y0: f32, x1: f32, y1: f32) {
         let r = Rect::from_min_max(self.p(x0, y0), self.p(x1, y1));
         self.painter.rect_stroke(r, 1.0 * self.s(), Stroke::new(self.width * self.s(), self.color), egui::StrokeKind::Middle);
@@ -402,6 +414,12 @@ pub fn paint(painter: &Painter, rect: Rect, icon: Icon, color: Color32) {
             pen.arc(8.0, 7.0, 3.0, 180.0, 360.0);
             pen.dot(8.0, 10.5, 1.0);
         }
+        LockOpen => {
+            pen.rect(3.5, 7.0, 12.5, 14.0);
+            pen.arc(8.0, 4.0, 3.0, 180.0, 360.0);
+            pen.line(&[(5.0, 4.0), (5.0, 7.0)]);
+            pen.dot(8.0, 10.5, 1.0);
+        }
         Shy => {
             pen.circle(8.0, 8.0, 5.8);
             pen.dot(6.0, 7.0, 0.8);
@@ -540,6 +558,11 @@ pub fn paint(painter: &Painter, rect: Rect, icon: Icon, color: Color32) {
             }
             pen.circle(8.0, 8.0, 4.2);
         }
+        StrokeWidth => {
+            pen.rect_fill(2.5, 3.0, 13.5, 3.75);
+            pen.rect_fill(2.5, 6.5, 13.5, 8.0);
+            pen.rect_fill(2.5, 10.5, 13.5, 13.0);
+        }
         Hamburger => {
             for y in [4.5, 8.0, 11.5] {
                 pen.line(&[(3.0, y), (13.0, y)]);
@@ -638,9 +661,11 @@ pub fn paint(painter: &Painter, rect: Rect, icon: Icon, color: Color32) {
             pen.line(&[(6.0, 14.0), (2.0, 14.0), (2.0, 10.0)]);
         }
         Channel => {
-            pen.circle(6.0, 6.5, 3.6);
-            pen.circle(10.0, 6.5, 3.6);
-            pen.circle(8.0, 10.0, 3.6);
+            // After Effects draws this one in colour: red, green and blue, as the channels it picks
+            // between. The circles keep the geometry this icon already had; only their fill changes.
+            pen.dot_colored(6.0, 6.5, 3.6, Color32::from_rgb(226, 58, 58));
+            pen.dot_colored(10.0, 6.5, 3.6, Color32::from_rgb(58, 200, 88));
+            pen.dot_colored(8.0, 10.0, 3.6, Color32::from_rgb(64, 120, 235));
         }
         Exposure => {
             pen.circle(8.0, 8.0, 5.5);
@@ -720,6 +745,12 @@ pub fn keyframe(
     painter.extend(keyframe_shapes(center, size, left, right, fill));
 }
 
+/// The screen rect a [`keyframe`] glyph covers, read off the shapes it draws.
+pub fn keyframe_bounds(center: Pos2, size: f32, left: effectcraft_engine::keyframe::KeyHalf, right: effectcraft_engine::keyframe::KeyHalf) -> Rect {
+    // Any opaque fill: a transparent shape would report no bounds.
+    egui::Shape::Vec(keyframe_shapes(center, size, left, right, Color32::WHITE)).visual_bounding_rect()
+}
+
 /// The halves of a [`keyframe`] glyph. Flat, without a dark outline (as in After Effects), so
 /// keys that overlap read as one shape instead of a tangle of borders (#284); the hairline in
 /// the fill colour closes the seam between the halves.
@@ -787,6 +818,23 @@ mod tests {
         }
     }
 
+    /// Each half reaches as far as it is drawn, plus the hairline around it, and the halves are
+    /// independent (a key can come in linear and go out on hold).
+    #[test]
+    fn keyframe_bounds_follow_each_half() {
+        let c = egui::pos2(100.0, 50.0);
+        let r = 5.5;
+        // (half, how far it reaches sideways, how far up and down)
+        let extents = [(H::Linear, r, r), (H::Hold, r * 0.8, r * 0.8), (H::Bezier, r * 0.75, r), (H::Auto, r * 0.8, r * 0.8)];
+        for (l, lx, ly) in extents {
+            for (rt, rx, ry) in extents {
+                let b = super::keyframe_bounds(c, 11.0, l, rt);
+                let want = egui::Rect::from_min_max(c - egui::vec2(lx, ly.max(ry)), c + egui::vec2(rx, ly.max(ry))).expand(0.25);
+                assert!(b.min.distance(want.min) < 1e-3 && b.max.distance(want.max) < 1e-3, "{l:?}/{rt:?}: {b:?}, want {want:?}");
+            }
+        }
+    }
+
     /// #284: keyframes have no dark border (overlapping keys looked messy): each half is filled
     /// and edged in the key's own colour.
     #[test]
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 72016cc53..be14cd8df 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -7,14 +7,25 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+pub(crate) mod a11y;
+
+/// EffectCraft as craft-update knows it, with its 128 px icon and accent colour: the update
+/// prompt shows both, and an AppImage's menu entry gets the icon.
+#[cfg(not(target_arch = "wasm32"))]
+pub const UPDATE_APP: craft_update::app::App = craft_update::app::App {
+    icon_png: Some(include_bytes!("../../../assets/app-icon/hicolor/128x128/apps/ai.storyteller.effectcraft.png")),
+    accent: Some([0xe0, 0x36, 0x8f]),
+    ..craft_update::suite::EFFECTCRAFT
+};
+
 pub mod audio;
 pub mod automation;
 pub mod bench;
 pub mod color_picker;
 pub mod control;
 pub mod credits;
+pub mod display_gpu;
 pub mod dock;
-mod dock_shared;
 pub mod dock_ui;
 mod expression_diagnostics;
 pub mod frames;
@@ -30,6 +41,7 @@ mod pointer_wrap;
 pub mod prefs_live;
 pub mod state;
 pub mod theme;
+pub mod updates_ui;
 pub mod widgets;
 mod workspace_state;
 
@@ -37,7 +49,7 @@ use std::sync::Arc;
 use std::sync::mpsc::{Receiver, Sender};
 
 pub use control::ControlRequest;
-use dock::PanelKind;
+use dock::{PanelKind, WorkspaceExt as _};
 use effectcraft_engine::Session;
 use effectcraft_engine::project::ItemId;
 use effectcraft_engine::render::RenderOpts;
@@ -47,10 +59,55 @@ use serde_json::json;
 use state::UiState;
 use theme::Tokens;
 
-const SCREENSHOT_TIMEOUT_S: f64 = 4.0;
-/// Seconds without a project change before paused prefetch resumes (see
-/// [`EffectcraftApp::editing`]).
-const EDIT_QUIET: f64 = 0.3;
+mod app;
+mod clock;
+mod hooks;
+
+pub use app::{GPU_PREPARING, GpuBuild};
+#[cfg(test)]
+use app::{MAX_PENDING_SHOTS, SCREENSHOT_SETTLE_PASSES, SCREENSHOT_SETTLE_S, SCREENSHOT_TIMEOUT_S};
+pub use clock::AppClock;
+pub use hooks::{DialogDone, FileDialog, Hooks, SystemThemeFn};
+pub use state::ShotTarget;
+
+/// The root surface geometry of the last completed (non-discarded) UI pass.
+///
+/// The window position is deliberately excluded: moving the window does not change the pixels
+/// a screenshot captures. Size and scale-factor changes advance [`Self::epoch`].
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct DrawGeometry {
+    pub rect: egui::Rect,
+    pub ppp: f32,
+    /// Bumped whenever `rect.size()` or `ppp` differs from the previous recorded pass.
+    pub epoch: u64,
+}
+
+/// One `ui.screenshot` request: its reply, its admission reservation and its completion slot.
+struct PendingShot {
+    path: Option<String>,
+    /// What to capture; resolved afresh at every issuance.
+    target: ShotTarget,
+    /// The crop resolved at issuance, **relative to the issued rect's origin** (the image's
+    /// origin); `None` captures the whole surface.
+    crop: Option<[f32; 4]>,
+    reply: Sender<serde_json::Value>,
+    /// App-clock instant after which the request fails instead of waiting.
+    deadline: f64,
+    /// App-clock instant before which the UI must have settled.
+    settle_at: f64,
+    /// Root geometry and geometry epoch the reservation was admitted against.
+    admitted: DrawGeometry,
+    /// Final UI passes completed when the request was admitted.
+    admitted_pass: u64,
+    /// The geometry epoch bound to the issued capture command, if it was issued.
+    issued: Option<DrawGeometry>,
+    /// The shared completion slot; dropping it cancels a late callback.
+    slot: Option<craft_ui::capture::CaptureSlot>,
+    /// Bytes reserved against [`EffectcraftApp::shot_bytes`].
+    reserved_bytes: usize,
+    /// Geometry retries used.
+    attempts: u32,
+}
 
 /// Modal dialogs.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -72,6 +129,7 @@ pub enum Dialog {
     ViewOptions,
     CameraSettings,
     LightSettings,
+    NewPrimitive,
     KeyVelocity,
     KeyInterpolation,
     TimeStretch,
@@ -95,41 +153,17 @@ pub enum Dialog {
     UnsavedChanges,
     /// Delete Project items that compositions use? (`panels::delete_items`).
     DeleteItems,
+    /// Import an After Effects project although some of it cannot be imported exactly?
+    /// (`panels::aep_losses`).
+    AepLosses,
+    /// Un-precompose although it changes the picture or drops something? (`panels::unprecompose`).
+    Unprecompose,
     /// A gradient property's Gradient Editor (`panels::gradient_editor`, `prop.editGradient`).
     GradientEditor,
     /// Delete a user template from Home? (`panels::templates`).
     DeleteTemplate,
 }
 
-/// The desktop's light or dark appearance where egui cannot see it (Wayland compositors that send
-/// winit no theme). `None` = the host does not know.
-pub type SystemThemeFn = Box<dyn Fn(&egui::Context) -> Option<egui::Theme>>;
-
-/// A file dialog a host shows without blocking the frame ([`Hooks::file_dialog_async`]).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum FileDialog {
-    /// Files to open or import with these extensions; several when `many`.
-    Open { exts: Vec<String>, many: bool },
-    /// An EffectCraft project to open.
-    OpenProject,
-    /// A folder.
-    Folder,
-    /// Where to save `default` (a file name or path) with extension `ext` (empty: no filter);
-    /// `project`: the project save dialog, given the file name.
-    Save { default: String, ext: String, project: bool },
-}
-
-impl FileDialog {
-    /// The save dialog for `default`, as [`Hooks::save_dialog`] picks it.
-    pub fn save(default: &str) -> Self {
-        let ext = std::path::Path::new(default).extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
-        Self::Save { default: default.to_string(), project: ext.eq_ignore_ascii_case("ecproj"), ext }
-    }
-}
-
-/// Called with the paths a [`FileDialog`] picked (empty: cancelled), from any thread.
-pub type DialogDone = Box<dyn FnOnce(Vec<String>) + Send>;
-
 /// A non-blocking file dialog's answer for the command that asked (`menus::dialog_answered`).
 pub(crate) struct DialogAnswer {
     pub command: String,
@@ -138,59 +172,6 @@ pub(crate) struct DialogAnswer {
     pub paths: Vec<String>,
 }
 
-/// Host hooks provided by the native app (file pickers etc.).
-#[derive(Default)]
-pub struct Hooks {
-    /// The system appearance for Settings ▸ Appearance ▸ Sync with System (the desktop app reads
-    /// the Linux desktop portal); without it, what egui reports.
-    pub system_theme: Option<SystemThemeFn>,
-    pub pick_files: Option<Box<dyn Fn(&[&str]) -> Vec<String>>>,
-    pub pick_save: Option<Box<dyn Fn(&str) -> Option<String>>>,
-    pub pick_open_project: Option<Box<dyn Fn() -> Option<String>>>,
-    /// Opens the audio output for preview playback (the desktop app uses cpal).
-    pub audio_device: Option<audio::AudioDeviceFactory>,
-    /// Lists audio output devices (Settings ▸ Audio).
-    pub audio_devices: Option<Box<dyn Fn() -> Vec<String>>>,
-    /// Picks a folder (Settings paths).
-    pub pick_folder: Option<Box<dyn Fn() -> Option<String>>>,
-    /// Save dialog for other file kinds: (default name or path, extension; empty: no filter). A
-    /// default path opens the dialog in its folder.
-    pub pick_save_file: Option<Box<dyn Fn(&str, &str) -> Option<String>>>,
-    /// The system clipboard's text (native menu Edit ▸ Paste into a text field).
-    pub clipboard_text: Option<Box<dyn Fn() -> Option<String>>>,
-    /// Application actions the OS performs (`app.hide`, `app.hideOthers`, `app.showAll` on
-    /// macOS). Returns false when the host doesn't handle the id.
-    pub app_action: Option<Box<dyn Fn(&str) -> bool>>,
-    /// Shows a command's file dialog without blocking the frame and calls `done` with the
-    /// answer (the host then asks for a repaint). Used in place of the blocking pickers above for
-    /// the commands' dialogs (File ▸ Import, Open, Save As…) where blocking the frame is unsafe or
-    /// leaves the window unresponsive: on macOS a nested modal event loop there aborted the app on
-    /// a drag over the window (#511), and on Linux a blocking desktop-portal dialog never pumps
-    /// events, so the compositor marks the window as not responding (#1275).
-    pub file_dialog_async: Option<Box<dyn Fn(FileDialog, DialogDone)>>,
-    /// Tells the user the graphics device was lost and the window is closing, once. `saved` is
-    /// the auto-save of unsaved changes (`None`: nothing was unsaved), its path or why it failed.
-    pub device_lost: Option<Box<dyn Fn(Option<Result<String, String>>)>>,
-}
-
-impl Hooks {
-    /// The host's save dialog for `default` (a file name or path), offering its extension: the
-    /// project dialog for project files, else [`Hooks::pick_save_file`]. The project dialog is
-    /// the fallback for hosts without that (the web, whose dialog only names the file): on macOS
-    /// a dialog filtered to projects appends `.ecproj` to any other name (#293). `None` when the
-    /// host has no save dialog; `Some(None)` when it was cancelled.
-    pub fn save_dialog(&self, default: &str) -> Option<Option<String>> {
-        let path = std::path::Path::new(default);
-        let ext = path.extension().map(|e| e.to_string_lossy().to_string()).unwrap_or_default();
-        match (&self.pick_save_file, &self.pick_save) {
-            (Some(pick), _) if !ext.eq_ignore_ascii_case("ecproj") => Some(pick(default, &ext)),
-            (_, Some(pick)) => Some(pick(&path.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default())),
-            (Some(pick), None) => Some(pick(default, &ext)),
-            (None, None) => None,
-        }
-    }
-}
-
 #[derive(Default)]
 pub struct Playback {
     pub playing: bool,
@@ -216,11 +197,24 @@ pub struct Playback {
     pub restore_max: Option<Option<PanelKind>>,
     /// Audio-only previews: the frame under the audible sample (the current time stays put).
     pub audio_frame: Option<i64>,
-    /// The preview's sound waits for frames: while the frames ahead aren't cached, every frame
-    /// shows as it renders, silently; the sound starts once the rest of the preview (or what
-    /// fits in the RAM preview) is cached, so it never plays over skipped frames (#103), or
-    /// sooner once the silent preview keeps real time with the frames ahead cached (#208).
+    /// The preview's sound waits for frames: a preview whose start gave up on frames that weren't
+    /// cached shows every frame as it renders, silently, and starts the sound once the frames
+    /// ahead are cached while it keeps real time (#208), or the rest of the preview is. Once the
+    /// sound plays it goes on through frames that aren't cached, and the picture drops frames to
+    /// follow it (#2473).
     pub audio_held: bool,
+    /// Starting a preview with sound (#947): the playhead stays on the first frame while the
+    /// frames ahead render (the prefetch window, at most what fits in the RAM preview), then
+    /// sound and picture start together from it. Without this the picture played on silently
+    /// while they rendered and the sound started at the later frame, so the opening was lost.
+    /// Once the sound plays, a stall no longer stops it: the picture drops frames to follow it
+    /// (#2473).
+    pub starting: bool,
+    /// When the preview started (seconds): [`Playback::starting`] gives up after `STARTUP_LIMIT`.
+    pub starting_since: f64,
+    /// When the first frame was cached while [`Playback::starting`] (seconds): the wait for the
+    /// frames ahead gives up `STARTUP_WAIT` after it.
+    pub first_cached: Option<f64>,
     /// When the last frames were shown (seconds, the last second's worth): the achieved rate.
     pub shown_at: std::collections::VecDeque<f64>,
 }
@@ -270,21 +264,48 @@ pub struct EffectcraftApp {
     pub dialog: Option<Dialog>,
     pub hooks: Hooks,
     pub fps: f32,
+    /// The app clock and the value it had at the last [`EffectcraftApp::tick`].
+    clock: AppClock,
+    now: f64,
     last_time: f64,
     styled: bool,
     fonts_ready: bool,
     /// The interface language the fonts were installed for; `""` until the first frame.
     styled_language: &'static str,
+    /// The root viewport's focus, from the viewport information a logic tick refreshes.
+    focused: bool,
+    /// Whether the last UI pass saw events or a moving/held pointer.
+    input_active: bool,
+    /// The pointer was down in the last UI pass (workspace auto-save waits for it to lift).
+    last_pointer_down: bool,
+    /// Geometry of the last completed, non-discarded UI pass.
+    draw_geom: Option<DrawGeometry>,
+    /// Bumped when the root surface size or pixels-per-point changes.
+    geometry_epoch: u64,
+    /// Per-viewport IME owner, generation and change-cause state for the on-canvas text editor.
+    pub(crate) ime_tracker: egui::ImeContextTracker,
+    /// Completed, non-discarded UI passes since launch.
+    ui_pass_seq: u64,
+    /// A hidden window must run a UI pass (queued input, screenshots, playback children, …).
+    want_paint: bool,
+    /// The synthetic batch moved into raw input has not been applied by a UI pass yet.
+    synthetic_in_flight: bool,
+    /// The events of that batch while egui applies them (never fed to a second pass).
+    synthetic_in_flight_events: Vec<egui::Event>,
+    /// The viewer scale the last UI pass drew at: playback prefetches without a viewer pass.
+    last_viewer_scale: Option<f64>,
     pub(crate) control_rx: Option<Receiver<ControlRequest>>,
     pub(crate) deferred: Vec<(ControlRequest, f64)>,
     pub(crate) synthetic: Vec<egui::Event>,
+    /// Input from floating panels' own OS windows for the main window's next frame.
+    pub(crate) forwarded: ForwardedInput,
     pub(crate) input_waiters: Vec<Sender<serde_json::Value>>,
     /// Control requests waiting for an offloaded job (`wait: true` in the browser).
     pub(crate) job_waiters: Vec<(control::JobWaiter, Sender<serde_json::Value>)>,
-    queued_screenshots: Vec<(u64, f64, u32)>,
-    pending_screenshots: Vec<(u64, Option<String>, Option<[f32; 4]>, Sender<serde_json::Value>, f64)>,
-    next_token: u64,
-    pub(crate) last_ui_time: f64,
+    pub(crate) script_waiters: Vec<(u32, Sender<serde_json::Value>)>,
+    pending_screenshots: Vec<PendingShot>,
+    /// Pixels reserved by queued and in-flight screenshot requests.
+    shot_bytes: usize,
     /// When the user last did something (input or an edit): Cache Frames When Idle waits for
     /// a second of quiet. (time, project revision then)
     last_activity: (f64, u64),
@@ -299,10 +320,28 @@ pub struct EffectcraftApp {
     /// The last GPU frame shown: its egui texture id (registered with egui-wgpu), key and texture.
     pub(crate) viewer_native: Option<(egui::TextureId, FrameKey, Arc<effectcraft_gpu::DisplayFrame>)>,
     /// The texture the viewer draws and its frame key (CPU or GPU frame).
-    pub(crate) viewer_shown: Option<(egui::TextureId, FrameKey)>,
-    /// Last displayed image (Info panel colour, eyedroppers, histograms). GPU frames fill it on
-    /// demand ([`EffectcraftApp::viewer_pixels`]).
+    /// (`None` texture: a half-float frame, drawn by the display pass.)
+    pub(crate) viewer_shown: Option<(Option<egui::TextureId>, FrameKey)>,
+    /// A Cryptomatte eyedropper probe is being built (one at a time, re-arming included).
+    pub(crate) crypto_probe_busy: Arc<std::sync::atomic::AtomicBool>,
+    /// Last displayed image (Info panel colour, eyedroppers, histograms). GPU frames and
+    /// half-float frames fill it on demand ([`EffectcraftApp::viewer_pixels`]).
     pub(crate) viewer_image: Option<Arc<egui::ColorImage>>,
+    /// The half-float frame on screen (32 bpc projects; its key is `viewer_shown`'s).
+    pub(crate) viewer_f16: Option<Arc<frames::F16Frame>>,
+    /// The window's egui-wgpu device (with or without a GPU compositor on it): the display pass
+    /// runs there.
+    pub(crate) window_wgpu: Option<eframe::egui_wgpu::RenderState>,
+    /// The display pass on that device (made with the first frame that needs it), and whether
+    /// making it failed (the pass then runs on the CPU).
+    pub(crate) display_gpu: Option<Arc<display_gpu::DisplayGpu>>,
+    pub(crate) display_gpu_failed: bool,
+    /// The Composition viewer's and the snapshot's displayed textures (display pass).
+    pub(crate) viewer_bake: display_gpu::Bake,
+    pub(crate) snapshot_bake: display_gpu::Bake,
+    /// The snapshot in half floats for the display pass (the image it was made from, not kept
+    /// alive by this).
+    pub(crate) snapshot_f16: Option<(std::sync::Weak<effectcraft_engine::render::Image>, Arc<frames::F16Frame>)>,
     /// wasm32: an asynchronous readback of a GPU viewer frame (key asked for, result).
     viewer_readback: (Option<FrameKey>, Arc<std::sync::Mutex<Option<(FrameKey, Arc<egui::ColorImage>)>>>),
     /// egui-wgpu's device, once the first frame arrives (desktop and WebGPU).
@@ -310,13 +349,24 @@ pub struct EffectcraftApp {
     /// The GPU compositor on that device (None: no usable adapter → CPU only).
     pub(crate) gpu: Option<effectcraft_gpu::Gpu>,
     gpu_checked: bool,
+    /// The GPU compositor being built on a worker thread (desktop): the window opens at once and
+    /// composites on the CPU until the worker's result lands ([`Self::init_gpu`]).
+    #[cfg(not(target_arch = "wasm32"))]
+    gpu_build: Option<Receiver<GpuBuild>>,
     gpu_failures: Option<gpu_failure::GpuFailureBridge>,
     gpu_failure_applied: Option<bool>,
+    /// Settings ▸ Import ▸ Reload Footage Changed on Disk: the worker that stamps the footage
+    /// files, started with the first project that has items ([`Self::tick_footage_reload`]).
+    footage_watcher: Option<effectcraft_engine::footage_reload::Watcher>,
+    /// The project revision and preference the watched set was last computed for.
+    footage_watch_key: Option<(u64, String, bool)>,
     /// The graphics device was lost and the window is closing (see `close_after_device_loss`);
     /// `true` keeps crash recovery for the next launch.
     device_lost_close: Option<bool>,
     /// Answers of file dialogs shown without blocking ([`Hooks::file_dialog_async`]).
     pub(crate) dialog_answers: (Sender<DialogAnswer>, Receiver<DialogAnswer>),
+    /// Those dialogs that are up, for blocking floating panels' OS windows meanwhile.
+    pub(crate) file_dialogs: FileDialogsUp,
     /// Commands from the native menu bar.
     pub command_inbox: Option<Receiver<String>>,
     /// Pointer position in comp pixels (Info panel).
@@ -327,6 +377,7 @@ pub struct EffectcraftApp {
     pub audio: Option<audio::AudioPlayback>,
     /// Audio scrubbing's open output (Ctrl/Cmd-drag the current time, `playback.scrubAudio`).
     pub scrub: Option<audio::AudioScrub>,
+    pub(crate) updates_rt: updates_ui::Runtime,
     /// Audio panel VU meters.
     pub meter: audio::Meter,
     /// Waveform peak summaries per footage item (see `panels::waveform`).
@@ -342,6 +393,13 @@ pub struct EffectcraftApp {
     /// Docked groups laid out last frame: (active panel, group rect) — `~` maximizes the one
     /// under the pointer.
     pub(crate) dock_rects: Vec<(PanelKind, egui::Rect)>,
+    /// The floating panels' OS windows that drew a panel last frame; one that is gone releases
+    /// its IME state.
+    pub(crate) native_viewports: Vec<egui::ViewportId>,
+    /// The native windows that drew a panel last frame without publishing their IME descriptor.
+    pub(crate) unpublished_viewports: Vec<egui::ViewportId>,
+    /// A floating panel shown by a command: its window comes to the front next frame.
+    pub(crate) pending_panel_raise: Option<PanelKind>,
     /// Home screen: recent-project thumbnail textures by path (None = no thumbnail).
     pub(crate) home_thumbs: std::collections::HashMap<String, Option<egui::TextureHandle>>,
     /// The (project path, saved revision) whose thumbnail was stored last.
@@ -357,1818 +415,73 @@ pub struct EffectcraftApp {
 /// The saved workspaces in the settings store ([`effectcraft_engine::config::ConfigStore`]).
 pub const WORKSPACES_FILE: &str = "workspaces.json";
 
-#[derive(serde::Serialize, serde::Deserialize)]
-struct SavedWorkspaces {
-    #[serde(default)]
-    workspaces: std::collections::BTreeMap<String, dock::DockNode>,
-    #[serde(default)]
-    floating: std::collections::BTreeMap<String, Vec<dock::Floating>>,
+/// Non-blocking file dialogs ([`Hooks::file_dialog_async`]) that are up. While one is, the dock
+/// area blocks floating panels' OS windows, as it does for a modal dialog; otherwise craft-ui
+/// takes the app for inactive while the dialog has the keyboard, and hides floating palettes.
+///
+/// A dialog can end without answering: on macOS a sheet whose window goes away ends without its
+/// completion handler. A dialog is taken for gone, so floating windows never stay blocked, once
+/// one of the app's windows has the keyboard again after none had it, or when one has kept it
+/// for [`FileDialogsUp::UNSEEN`] since the dialog was asked for, so the dialog never showed.
+#[derive(Default)]
+pub(crate) struct FileDialogsUp {
+    count: usize,
+    /// When the oldest dialog up was first checked ([`FileDialogsUp::up`]).
+    since: Option<f64>,
+    /// None of the app's windows had the keyboard since then.
+    left: bool,
 }
 
-impl EffectcraftApp {
-    pub fn new(session: Session) -> Self {
-        let mut ui = UiState::default();
-        let workspace_store = workspace_state::WorkspaceStore::load(session.config.as_deref(), &mut ui);
-        EffectcraftApp {
-            session,
-            ui,
-            workspace_store,
-            tokens: Tokens::for_kind(Default::default()),
-            auto: Default::default(),
-            frames: Frames::default(),
-            playback: Playback::default(),
-            dialog: None,
-            hooks: Hooks::default(),
-            fps: 60.0,
-            last_time: 0.0,
-            styled: false,
-            fonts_ready: false,
-            styled_language: "",
-            control_rx: None,
-            deferred: vec![],
-            synthetic: vec![],
-            input_waiters: vec![],
-            job_waiters: vec![],
-            queued_screenshots: vec![],
-            pending_screenshots: vec![],
-            next_token: 1,
-            last_ui_time: 0.0,
-            last_activity: (0.0, 0),
-            last_edit: (0.0, 0),
-            toast: None,
-            viewer_tex: None,
-            passive_tex: std::collections::HashMap::new(),
-            viewer_native: None,
-            viewer_shown: None,
-            viewer_image: None,
-            viewer_readback: Default::default(),
-            wgpu: None,
-            gpu: None,
-            gpu_checked: false,
-            gpu_failures: None,
-            gpu_failure_applied: None,
-            device_lost_close: None,
-            dialog_answers: std::sync::mpsc::channel(),
-            command_inbox: None,
-            pointer_comp: None,
-            dialog_state: Default::default(),
-            integrated_titlebar: false,
-            audio: None,
-            scrub: None,
-            meter: Default::default(),
-            expression_diagnostics: Default::default(),
-            waveforms: Default::default(),
-            last_reveal: None,
-            applied_prefs: None,
-            recovery: None,
-            dock_rects: vec![],
-            home_thumbs: Default::default(),
-            home_thumb_saved: None,
-            window_title: String::new(),
-            template_thumbs: Default::default(),
-            template_list: None,
-        }
-        .with_ui_commands()
-    }
-
-    /// Keep the saved workspaces for the next session (see [`EffectcraftApp::new`]): After
-    /// Effects' saved workspaces last until they are deleted (#320). `Err` when they weren't
-    /// written (#696): the change applies for this session and a later save retries it, but until
-    /// then a restart brings back what is on disk.
-    pub(crate) fn store_saved_workspaces(&mut self) -> Result<(), String> {
-        let Err(error) = self.workspace_store.save_now(self.session.config.as_deref(), &self.ui) else { return Ok(()) };
-        let message = format!("Workspace changes couldn't be saved and may be lost after a restart: {error}");
-        log::warn!("{message}");
-        self.ui.status = message.clone();
-        // The raw error, so the background retry doesn't report the same failure again.
-        self.workspace_store.error = Some(error);
-        Err(message)
-    }
-
-    /// Offer the frontend's commands (tools, timeline navigation…) for keyboard shortcuts.
-    fn with_ui_commands(mut self) -> Self {
-        let cmds = menus::UI_COMMANDS
-            .iter()
-            .map(|c| effectcraft_engine::shortcuts::UiCommand { id: c.id.into(), label: c.label.into(), shortcut: c.shortcut.map(str::to_string) })
-            .collect();
-        self.session.set_ui_commands(cmds);
-        self
-    }
-
-    /// Show the crash-recovery dialog for a previous run that didn't exit cleanly.
-    pub fn offer_recovery(&mut self, r: effectcraft_engine::autosave::Recovery) {
-        if r.autosave.is_some() {
-            self.recovery = Some(r);
-            self.dialog = Some(Dialog::Recovery);
-        }
-    }
-
-    /// Apply changed settings: theme and brightness, label colours, tool tips, preview caches.
-    pub fn apply_prefs(&mut self, ctx: &egui::Context) {
-        // Sync with System re-applies when the system appearance changes (the host wakes the UI;
-        // nothing polls).
-        let system = if self.session.prefs.appearance.appearance_mode == "auto" { self.system_light(ctx) } else { None };
-        if self.applied_prefs == Some((self.session.prefs_revision, system)) {
-            return;
-        }
-        self.applied_prefs = Some((self.session.prefs_revision, system));
-        let p = &self.session.prefs;
-        self.ui.theme = theme::ThemeKind::from_name(p.appearance.resolved_theme(system)).unwrap_or_default();
-        self.tokens = Tokens::from_prefs(p, self.ui.theme);
-        theme::apply_visuals(ctx, &self.tokens);
-        ctx.set_theme(theme::theme_preference(&p.appearance.appearance_mode, self.ui.theme.is_light()));
-        let tips = p.general.show_tool_tips;
-        ctx.all_styles_mut(|s| s.interaction.tooltip_delay = if tips { 0.5 } else { f32::INFINITY });
-        // Settings ▸ Appearance ▸ UI Scale (#284). egui's own Ctrl+= / Ctrl+- / Ctrl+0 zoom stays
-        // off: Ctrl+0 is Window ▸ Project, and the scale is a setting.
-        ctx.options_mut(|o| o.zoom_with_keyboard = false);
-        ctx.set_zoom_factor(p.appearance.ui_scale as f32 / 100.0);
-        self.ui.cache_when_idle = p.previews.cache_frames_when_idle;
-        self.ui.viewer.fast_preview = p.previews.fast_previews;
-        self.frames.set_budget(p.cache_budgets(self.session.sys_memory).preview);
-    }
-
-    /// Change settings from the UI (applied next frame and saved).
-    pub fn set_pref(&mut self, key: &str, value: serde_json::Value) -> Result<(), String> {
-        self.session.prefs.set(key, value)?;
-        self.session.prefs_changed();
-        self.session.save_prefs();
-        Ok(())
-    }
-
-    pub fn with_control(mut self, rx: Receiver<ControlRequest>) -> Self {
-        self.control_rx = Some(rx);
-        self
-    }
-
-    /// Show theme `k`: the appearance mode becomes its family's (Dark or Light), and `k` that
-    /// family's theme.
-    pub fn set_theme(&mut self, ctx: &egui::Context, k: theme::ThemeKind) {
-        if let Err(e) = self.set_pref("appearance.theme", json!(k.name())) {
-            self.ui.status = e;
-        }
-        self.apply_prefs(ctx);
-    }
-
-    /// The system appearance: light (`Some(true)`), dark, or unknown. The host's answer (the Linux
-    /// desktop portal) wins over egui's, which Wayland compositors often leave empty.
-    pub fn system_light(&self, ctx: &egui::Context) -> Option<bool> {
-        self.hooks.system_theme.as_ref().and_then(|read| read(ctx)).or_else(|| ctx.system_theme()).map(|t| t == egui::Theme::Light)
-    }
-
-    /// The Tools bar's appearance button (`view.theme.toggle`): Sync with System, then Light, then
-    /// Dark, then Sync with System again. The light and dark theme choices are kept.
-    pub fn cycle_appearance(&mut self, ctx: &egui::Context) {
-        let next = match self.session.prefs.appearance.appearance_mode.as_str() {
-            "auto" => "light",
-            "light" => "dark",
-            _ => "auto",
-        };
-        if let Err(e) = self.set_pref("appearance.appearanceMode", json!(next)) {
-            self.ui.status = e;
-        }
-        self.apply_prefs(ctx);
-    }
-
-    pub fn set_workspace(&mut self, name: &str) {
-        // Learn: the Home screen's Learn tab (tutorials) in the Composition panel. Leaving it for
-        // another workspace closes the Home screen again: it stayed over every workspace until a
-        // project was created (#272).
-        if name == "Learn" {
-            self.ui.start_screen = true;
-            self.ui.home_learn = true;
-            self.ui.home_templates = false;
-        } else if self.ui.workspace == "Learn" {
-            self.ui.start_screen = false;
-            self.ui.home_learn = false;
-        }
-        self.ui.workspace = name.to_string();
-        self.ui.dock = self.ui.saved_workspaces.get(name).cloned().unwrap_or_else(|| dock::workspace(name));
-        self.ui.floating = self.ui.saved_floating.get(name).cloned().unwrap_or_else(|| dock::workspace_floating(name));
-        self.ui.maximized = None;
-    }
-
-    /// Built-in workspaces followed by the saved ones (Window ▸ Workspace ▸ Save as New Workspace).
-    pub fn workspace_names(&self) -> Vec<String> {
-        let mut v: Vec<String> = dock::WORKSPACES.iter().map(|s| s.to_string()).collect();
-        v.extend(self.saved_workspace_names());
-        v
-    }
-
-    /// The workspaces the user saved under a new name (built-ins whose changes were saved are
-    /// not repeated), in name order.
-    pub fn saved_workspace_names(&self) -> Vec<String> {
-        self.ui.saved_workspaces.keys().filter(|k| !dock::WORKSPACES.contains(&k.as_str())).cloned().collect()
-    }
-
-    /// The open Gradient Editor's draft (`panels::gradient_editor`): what OK would set.
-    pub fn gradient_draft(&self) -> &panels::gradient_editor::Draft {
-        &self.dialog_state.gradient
-    }
-
-    /// The open Gradient Editor's draft, to edit (tests and automation; the editor's own fields
-    /// do the same).
-    pub fn gradient_draft_mut(&mut self) -> &mut panels::gradient_editor::Draft {
-        &mut self.dialog_state.gradient
-    }
-
-    /// Feed this frame's share of the queued synthetic input (control channel `ui.click`,
-    /// `ui.drag`…) into `raw_input`. Pointer events go one per frame so egui sees press → moves
-    /// → release as a real gesture.
-    pub fn feed_synthetic(&mut self, raw_input: &mut egui::RawInput) {
-        if !self.synthetic.is_empty() {
-            // Pointer events go one per frame so egui sees press → moves → release as a real drag.
-            let pointer = |e: &egui::Event| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerButton { .. } | egui::Event::MouseWheel { .. });
-            let n = if pointer(&self.synthetic[0]) {
-                1
-            } else {
-                self.synthetic
-                    .iter()
-                    .position(|e| pointer(e) || matches!(e, egui::Event::Key { pressed: false, .. }))
-                    .map_or(self.synthetic.len(), |i| if pointer(&self.synthetic[i]) { i.max(1) } else { i + 1 })
-            };
-            raw_input.events.extend(self.synthetic.drain(..n));
-        }
-    }
-
-    /// Show panel `p` (opening it in its usual place if it is closed), bring it to the front and
-    /// give it the focus: Window ▸ <panel>.
-    pub fn show_panel(&mut self, p: PanelKind) {
-        if !self.ui.floating.iter().any(|f| f.panels.contains(&p)) && self.ui.maximized.is_some_and(|m| m != p) {
-            self.ui.maximized = None;
-        }
-        self.raise_panel(p);
-        self.ui.focused = p;
-    }
-
-    /// Bring panel `p` to the front of its group, opening it in its usual place if it is closed,
-    /// without moving the focus (a comp opening brings up its viewer, an effect applied brings up
-    /// Effect Controls).
-    pub fn raise_panel(&mut self, p: PanelKind) {
-        if self.ui.floating.iter().any(|group| group.panels.contains(&p)) {
-            self.edit_layout(|layout| layout.apply(craft_ui::docking::Action::Activate { panel: p }).is_ok());
-            return;
-        }
-        if !self.ui.dock.contains(p) {
-            // The Composition panel lives in the centre, with the Layer panel and other viewers;
-            // with none of those left, above the Timeline.
-            let centre = |d: &dock::DockNode| {
-                let mut v = Vec::new();
-                d.panels(&mut v);
-                v.into_iter().find(|q| matches!(q, PanelKind::Layer | PanelKind::Viewer(_) | PanelKind::Flowchart | PanelKind::Footage))
-            };
-            let near = match p {
-                PanelKind::Composition => match centre(&self.ui.dock) {
-                    Some(q) => q,
-                    None if self.ui.dock.dock_panel(p, PanelKind::Timeline, dock::Zone::Top) => {
-                        self.ui.dock.activate(p);
-                        return;
-                    }
-                    None => PanelKind::EffectsPresets,
-                },
-                PanelKind::Layer | PanelKind::Flowchart | PanelKind::Viewer(_) => PanelKind::Composition,
-                PanelKind::RenderQueue => PanelKind::Timeline,
-                PanelKind::EffectControls | PanelKind::History => PanelKind::Project,
-                _ => PanelKind::EffectsPresets,
-            };
-            self.ui.dock.open_near(p, near);
-        }
-        self.ui.dock.activate(p);
-    }
-
-    pub fn render_source(&self) -> RenderSource {
-        RenderSource {
-            project: self.session.project.clone(),
-            footage: self.session.footage.clone(),
-            expr: self.session.expr.clone(),
-            layer_cache: self.session.layer_cache.clone(),
-            gpu: self.gpu.clone(),
-            gpu_display: self.gpu_display(),
-            disk: self.session.disk_cache.clone(),
-        }
-    }
-
-    /// Keep GPU-composited viewer frames on the GPU (drawn from their texture). The browser can't
-    /// read frames back (its thread can't wait for the GPU), so there the viewer shows GPU frames
-    /// directly whenever it draws them plainly (RGB, no exposure, no region of interest); the
-    /// desktop reads them back (see [`frames::RenderSource::gpu_display`]).
-    fn gpu_display(&self) -> bool {
-        let v = &self.session.state.viewer;
-        cfg!(target_arch = "wasm32")
-            && v.channel == effectcraft_engine::viewer::Channel::Rgb
-            && v.exposure == 0.0
-            && self.session.state.region_of_interest.is_none()
-            && self.ui.viewer.extended.is_none()
-    }
-
-    /// The UI draws its panels and handles input such as dropped files. Until the fonts are
-    /// installed (the first frames) it draws nothing, and that input goes unhandled.
-    pub fn is_ready(&self) -> bool {
-        self.fonts_ready
-    }
-
-    /// Provide the executable/embedding host's device notifications. The host installs the
-    /// handlers once; this frontend never replaces handlers on a borrowed device.
-    pub fn set_gpu_failure_bridge(&mut self, bridge: gpu_failure::GpuFailureBridge) {
-        if let Some(gpu) = &self.gpu {
-            bridge.forward_to(gpu.context().device_failure_notifier());
-        }
-        self.gpu_failures = Some(bridge);
-    }
-
-    fn apply_gpu_failure(&mut self, ctx: &egui::Context) {
-        let Some(bridge) = &self.gpu_failures else { return };
-        // Readback deadlines can retire the compositor without a host device notification.
-        if let Some(gpu) = &self.gpu
-            && let Err(reason) = gpu.context().check_health()
-        {
-            bridge.report(&reason, false);
-        }
-        let Some(failure) = bridge.failure() else { return };
-        if self.gpu_failure_applied == Some(failure.presentation_lost) {
-            return;
-        }
-        self.gpu_failure_applied = Some(failure.presentation_lost);
-        self.gpu_checked = true;
-        self.frames.retire_gpu();
-        self.session.accel = None;
-        self.session.accel_note = Some(format!("GPU preview retired: {}", failure.reason));
-        self.session.layer_cache.clear();
-        self.gpu = None;
-        if let Some(rs) = &self.wgpu {
-            let mut renderer = rs.renderer.write();
-            if let Some((id, _, _)) = &self.viewer_native {
-                renderer.free_texture(id);
-            }
-            for (_, texture) in self.passive_tex.values() {
-                if let panels::viewers::PassiveTexture::Gpu(id, _) = texture {
-                    renderer.free_texture(id);
-                }
-            }
-        }
-        self.viewer_native = None;
-        self.passive_tex.retain(|_, (_, texture)| matches!(texture, panels::viewers::PassiveTexture::Cpu(_)));
-        self.viewer_shown = self.viewer_tex.as_ref().map(|(texture, key, _)| (texture.id(), *key));
-        self.viewer_image = None;
-        // Old completion closures retain only their detached slot, not the replacement.
-        self.viewer_readback = Default::default();
-        self.wgpu = None;
-        self.ui.status = if failure.presentation_lost {
-            "Graphics device lost. The project is still open; presentation requires restarting the application.".into()
-        } else {
-            "Shared GPU preview disabled; CPU compositing remains available.".into()
-        };
-        log::warn!("GPU preview retired: {}", failure.reason);
-        ctx.request_repaint();
-    }
-
-    /// After the graphics device is lost, eframe's renderer cannot draw again: any mesh makes
-    /// egui-wgpu panic on the main thread when it cannot stage its index buffer (#591). Draw
-    /// nothing from then on, auto-save a project with unsaved changes (keeping the crash
-    /// recovery marker, so the next launch offers it) and close the window.
-    fn close_after_device_loss(&mut self, ctx: &egui::Context) {
-        if self.device_lost_close.is_some() {
-            return;
-        }
-        let keep_recovery = self.session.is_dirty();
-        let saved = keep_recovery.then(|| match self.session.autosave_now().and_then(|path| self.session.autosave_wait().map(|()| path)) {
-            Ok(path) => {
-                log::warn!("graphics device lost: auto-saved {path}; the next launch offers to recover it");
-                Ok(path)
-            }
-            Err(e) => {
-                log::error!("graphics device lost: {e}");
-                Err(e.to_string())
-            }
-        });
-        self.device_lost_close = Some(keep_recovery);
-        log::warn!("graphics device lost: closing the window");
-        if let Some(tell) = &self.hooks.device_lost {
-            tell(saved);
-        }
-        ctx.send_viewport_cmd(egui::ViewportCommand::Close);
-    }
-
-    /// Run the commands whose non-blocking file dialogs have been answered.
-    pub(crate) fn run_dialog_answers(&mut self) {
-        while let Ok(answer) = self.dialog_answers.1.try_recv() {
-            menus::dialog_answered(self, answer);
-        }
-    }
-
-    /// Set up the GPU compositor on egui-wgpu's device (once). Without an adapter that runs
-    /// compute shaders (WebGL2, software GL) everything stays on the CPU.
-    pub(crate) fn init_gpu(&mut self, frame: &eframe::Frame) {
-        if self.gpu_checked {
-            return;
-        }
-        self.gpu_checked = true;
-        if self.gpu_failures.as_ref().is_some_and(|bridge| bridge.failure().is_some()) {
-            return;
-        }
-        let Some(rs) = frame.wgpu_render_state() else { return };
-        // Help ▸ System Compatibility Report names the adapter and backend the window got.
-        let info = rs.adapter.get_info();
-        self.session.window_adapter = Some(format!(
-            "{} ({:?}, {:?}{})",
-            info.name,
-            info.backend,
-            info.device_type,
-            if info.driver.is_empty() { String::new() } else { format!(", {} {}", info.driver, info.driver_info) }
-        ));
-        // Backend validation can panic on shader compilation even when device creation
-        // succeeded. Keep the document and the egui renderer, and use CPU compositing.
-        let gpu = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| effectcraft_gpu::Gpu::new(&rs.adapter, rs.device.clone(), rs.queue.clone())));
-        match gpu {
-            Ok(Ok(g)) => {
-                if let Some(bridge) = &self.gpu_failures {
-                    bridge.forward_to(g.context().device_failure_notifier());
-                    if bridge.failure().is_some() {
-                        return;
-                    }
-                }
-                log::info!("GPU compositor: {}", effectcraft_engine::render::Accelerator::name(&g));
-                self.session.accel = Some(Arc::new(g.clone()));
-                self.gpu = Some(g);
-                self.wgpu = Some(rs.clone());
-            }
-            Ok(Err(e)) => {
-                log::info!("GPU compositor unavailable: {e}");
-                self.session.accel_note = Some(format!("GPU compositor unavailable: {e}"));
-            }
-            Err(e) => {
-                let reason = e.downcast_ref::<String>().map(String::as_str).or_else(|| e.downcast_ref::<&str>().copied()).unwrap_or("backend panicked");
-                log::warn!("GPU compositor setup failed; using CPU compositing: {reason}");
-                self.session.accel_note = Some(format!("GPU compositor setup failed: {reason}"));
-            }
-        }
-    }
-
-    /// The viewer shows a frame composited on the GPU (drawn from its wgpu texture).
-    pub fn viewer_on_gpu(&self) -> bool {
-        matches!((&self.viewer_shown, &self.viewer_native), (Some(s), Some(n)) if s.1 == n.1)
-    }
-
-    /// The GPU compositor's adapter, when the viewer has one.
-    pub fn gpu_adapter(&self) -> Option<String> {
-        self.gpu.as_ref().map(effectcraft_engine::render::Accelerator::name)
-    }
-
-    /// The size of the viewer frame's texture (CPU frames; fitted to the GPU's texture limit).
-    pub fn viewer_texture_size(&self) -> Option<[usize; 2]> {
-        self.viewer_tex.as_ref().map(|(t, _, _)| t.size())
-    }
-
-    /// The viewer's current pixels as 8-bit premultiplied RGBA, reading a GPU frame back the
-    /// first time something asks for it.
-    ///
-    /// The browser can't wait for the GPU: there the first call starts an asynchronous readback
-    /// and returns `None`; a later call (the next frame) has the pixels.
-    pub fn viewer_pixels(&mut self) -> Option<Arc<egui::ColorImage>> {
-        let to_image = |bytes: Vec<u8>, w: u32, h: u32| {
-            let px = bytes.as_chunks::<4>().0.iter().map(|c| egui::Color32::from_rgba_premultiplied(c[0], c[1], c[2], c[3])).collect();
-            Arc::new(egui::ColorImage::new([w as usize, h as usize], px))
-        };
-        if self.viewer_image.is_none()
-            && let (Some((_, key, f)), Some(g)) = (&self.viewer_native, &self.gpu)
-            && self.viewer_shown.as_ref().map(|s| s.1) == Some(*key)
-        {
-            if cfg!(target_arch = "wasm32") {
-                let ready = self.viewer_readback.1.lock().ok().and_then(|mut r| r.take_if(|r| r.0 == *key));
-                if let Some((_, img)) = ready {
-                    self.viewer_image = Some(img);
-                } else if self.viewer_readback.0 != Some(*key) {
-                    self.viewer_readback.0 = Some(*key);
-                    let (slot, k, (w, h)) = (self.viewer_readback.1.clone(), *key, (f.width, f.height));
-                    let ctx = self.frames.context();
-                    g.read_display_async(f, move |bytes| {
-                        if let (Some(b), Ok(mut s)) = (bytes, slot.lock()) {
-                            *s = Some((k, to_image(b, w, h)));
-                        }
-                        if let Some(c) = ctx {
-                            c.request_repaint();
-                        }
-                    });
-                }
-            } else if let Some(bytes) = g.read_display(f) {
-                self.viewer_image = Some(to_image(bytes, f.width, f.height));
-            }
-        }
-        self.viewer_image.clone()
-    }
-
-    /// The viewer's Resolution: the active composition's (saved with the project).
-    pub fn viewer_res(&self) -> state::Resolution {
-        self.session.active_comp().map(|c| c.resolution).unwrap_or_default()
-    }
-
-    /// The render scale used by the viewer right now.
-    pub fn viewer_scale(&self, zoom: f32, ppp: f32) -> f64 {
-        // The preview's Resolution (when not Auto) while it plays.
-        if self.playback.playing
-            && let Some(f) = self.playback.res
-        {
-            return state::Resolution::from_factor(f.into()).scale(zoom, ppp);
-        }
-        // Auto follows the zoom alike while playing and paused, so frames cached while scrubbing
-        // play back, and frames cached by a preview stay on screen when it stops.
-        let res = self.viewer_res();
-        let full = res.scale(zoom, ppp);
-        // Fast Previews ▸ Adaptive Resolution / Fast Draft: lower resolution while dragging.
-        let (_, k) = self.session.state.viewer.fast_previews.render(self.ui.viewer.interacting || self.ui.viewer.property_interacting);
-        if k < 1.0 && res.is_auto() {
-            return full.min((full * 0.5).max(self.session.prefs.adaptive_limit()));
-        }
-        full
-    }
-
-    /// The cache key of viewer frame `frame` of `comp` at `scale` (see [`Self::frame_series`]).
-    pub fn frame_key(&self, comp: ItemId, frame: i64, scale: f64) -> FrameKey {
-        FrameKey { frame, ..self.frame_series(comp, scale) }
-    }
-
-    /// The key of frame 0 of `comp`'s viewer frames at `scale` (the content, view and render
-    /// options are the same for every frame: loops compute this once).
-    pub fn frame_series(&self, comp: ItemId, scale: f64) -> FrameKey {
-        FrameKey {
-            revision: self.session.revision,
-            content: self.frames.content_of(&self.session.project, self.session.revision, comp),
-            comp: comp.0,
-            frame: 0,
-            scale: (scale * 1000.0).round() as u32,
-            view: self.view_hash(comp),
-            opts: frames::opts_hash(&self.frame_opts(comp, scale)),
-        }
-    }
-
-    /// The frame series the viewer of `comp` shows now (its scale, view and options, for the
-    /// comp's current content): what the cache bars count.
-    pub fn shown_series(&self, comp: ItemId) -> FrameKey {
-        let scale = self.viewer_shown.as_ref().filter(|(_, k)| k.comp == comp.0).map_or(1000, |(_, k)| k.scale);
-        self.frame_series(comp, scale as f64 / 1000.0)
-    }
-
-    /// Hash of the comp viewer's 3D view camera (0 for the active camera view).
-    pub fn view_hash(&self, comp: ItemId) -> u64 {
-        use std::hash::{Hash, Hasher};
-        let mut h = std::collections::hash_map::DefaultHasher::new();
-        // The region of interest changes what is rendered too.
-        let roi = self.viewer_region(comp);
-        if let Some(r) = roi {
-            r.map(f64::to_bits).hash(&mut h);
-        }
-        let Some(cam) = self.session.view_camera(comp) else { return if roi.is_some() { h.finish() | 1 } else { 0 } };
-        for row in cam.view.0 {
-            for v in row {
-                v.to_bits().hash(&mut h);
-            }
-        }
-        cam.zoom.to_bits().hash(&mut h);
-        cam.ortho.hash(&mut h);
-        h.finish() | 1
-    }
-
-    /// The comp-space region viewer frames of `comp` cover: the region of interest, else the
-    /// Extended Viewer's area (frame plus pasteboard), else `None` (the whole frame).
-    pub fn viewer_region(&self, comp: ItemId) -> Option<[f64; 4]> {
-        if self.session.active_comp_id() != Some(comp) {
-            return None;
-        }
-        self.session.state.region_of_interest.or(self.ui.viewer.extended)
-    }
-
-    /// Request a prefetch frame render (no-op if cached/in flight).
-    pub fn request_frame(&self, comp: ItemId, frame: i64, scale: f64) {
-        self.request_frame_with(comp, frame, scale, false);
-    }
-
-    /// Request the frame on screen: rendered before any queued prefetch.
-    pub fn request_frame_urgent(&self, comp: ItemId, frame: i64, scale: f64) {
-        self.request_frame_with(comp, frame, scale, true);
-    }
-
-    /// Render options of viewer frames of `comp` at `scale`.
-    pub fn frame_opts(&self, comp: ItemId, scale: f64) -> RenderOpts {
-        let (draft, _) = self.session.state.viewer.fast_previews.render(self.ui.viewer.interacting || self.ui.viewer.property_interacting);
-        let roi = self.viewer_region(comp);
-        RenderOpts {
-            scale,
-            motion_blur: true,
-            guides: true,
-            draft: self.ui.viewer.fast_preview || draft,
-            view: self.session.view_camera(comp),
-            roi,
-            backend: effectcraft_engine::render::Backend::Auto,
-            nested_switches: self.session.prefs.general.switches_affect_nested_comps,
-            draft_shadows: self.session.prefs.three_d.realtime_shadows,
-            proxy: Default::default(),
-        }
-    }
-
-    fn request_frame_with(&self, comp: ItemId, frame: i64, scale: f64, urgent: bool) {
-        let Some(c) = self.session.project.comp(comp) else { return };
-        let key = self.frame_key(comp, frame, scale);
-        let t = c.frame_rate.tick_of(frame);
-        let opts = self.frame_opts(comp, scale);
-        if urgent {
-            self.frames.request_urgent(&self.render_source(), key, comp, t, opts);
-        } else {
-            self.frames.request(&self.render_source(), key, comp, t, opts);
-        }
-    }
-
-    // ---------------------------------------------------------------- playback
-
-    pub fn play(&mut self, now: f64) {
-        let sc = self.session.prefs.preview.current;
-        self.play_with(now, sc);
-    }
-
-    /// Start the preview of a Preview panel shortcut (its range, play-from, rate, skip,
-    /// resolution, loop, caching, full screen and include options).
-    pub fn play_with(&mut self, now: f64, sc: effectcraft_engine::preview::PreviewShortcut) {
-        let Some(c) = self.session.active_comp_arc() else { return };
-        let preset = self.session.prefs.preview.get(sc).clone();
-        let plan = effectcraft_engine::preview::plan(&preset, &c, self.session.time());
-        let fr = c.frame_rate;
-        if plan.video {
-            self.session.set_time(fr.tick_of(plan.first));
-        }
-        let restore_max = preset.full_screen.then_some(self.ui.maximized);
-        let viewer = panels::viewers::active_panel(self);
-        if preset.full_screen && self.ui.dock.contains(viewer) {
-            self.ui.maximized = Some(viewer);
-        }
-        self.playback = Playback {
-            playing: true,
-            start_wall: now,
-            start_time: fr.tick_of(plan.first),
-            start_frame: plan.first,
-            shown: 0,
-            waiting: false,
-            fps: plan.fps,
-            shortcut: sc,
-            plan: Some(plan),
-            caching: plan.cache_first && plan.video,
-            res: preset.resolution.factor(preset.custom_resolution),
-            overlays: preset.include_overlays,
-            layer_controls: preset.include_layer_controls,
-            restore_max,
-            audio_frame: (!plan.video).then_some(plan.first),
-            audio_held: false,
-            shown_at: Default::default(),
-        };
-        if !self.playback.caching {
-            if plan.video {
-                self.playback.audio_held = self.audio_plays();
-            } else {
-                self.start_audio(fr.tick_of(plan.first));
-            }
-        }
-    }
-
-    /// The preview includes audio at the comp's frame rate and the comp has something audible.
-    fn audio_plays(&self) -> bool {
-        let (Some(pl), Some(cid)) = (self.playback.plan, self.session.active_comp_id()) else { return false };
-        let Some(c) = self.session.project.comp(cid) else { return false };
-        // A preview at another frame rate plays slower or faster than real time: silent.
-        pl.audio && (pl.fps - c.frame_rate.as_f64()).abs() <= 0.01 && effectcraft_engine::render::audio::comp_has_audio(&self.session.project, cid)
-    }
-
-    /// Start audio preview from comp time `t` when [`Self::audio_plays`] and an output device
-    /// opens.
-    fn start_audio(&mut self, t: Tick) {
-        self.audio = None;
-        self.meter.clipped = [false; 2];
-        let (Some(pl), Some(cid)) = (self.playback.plan, self.session.active_comp_id()) else { return };
-        let Some(c) = self.session.project.comp_arc(cid).filter(|_| self.audio_plays()) else { return };
-        let out = audio::AudioOutput::from_prefs(&self.session.prefs);
-        let Some(dev) = self.hooks.audio_device.as_ref().and_then(|f| f(&out)) else { return };
-        let mix = self.session.prefs.audio.preview_sample_rate;
-        let fr = c.frame_rate;
-        match audio::AudioPlayback::start(dev, self.render_source(), cid, t, fr.tick_of(pl.start), fr.tick_of(pl.end + 1), pl.looping, mix) {
-            Ok(a) => self.audio = Some(a),
-            Err(e) => log::warn!("audio preview: {e}"),
-        }
-    }
-
-    /// Audio scrubbing: play the frame of `comp` at `t` (see [`audio::AudioScrub`]), opening the
-    /// output on first use. Silent comps and missing devices do nothing.
-    pub fn scrub_audio(&mut self, comp: ItemId, t: Tick, now: f64) {
-        if self.playback.playing || !effectcraft_engine::render::audio::comp_has_audio(&self.session.project, comp) {
-            return;
-        }
-        if self.scrub.is_none() {
-            let out = audio::AudioOutput::from_prefs(&self.session.prefs);
-            let Some(dev) = self.hooks.audio_device.as_ref().and_then(|f| f(&out)) else { return };
-            match audio::AudioScrub::open(dev, now) {
-                Ok(s) => self.scrub = Some(s),
-                Err(e) => {
-                    log::warn!("audio scrubbing: {e}");
-                    return;
-                }
-            }
-        }
-        let src = self.render_source();
-        let mix = self.session.prefs.audio.preview_sample_rate;
-        if let Some(s) = &mut self.scrub {
-            s.play(&src, comp, t, mix, now);
-        }
-    }
-
-    pub fn stop(&mut self) {
-        let was = std::mem::replace(&mut self.playback.playing, false);
-        self.audio = None;
-        self.playback.caching = false;
-        if !was {
-            return;
-        }
-        if let Some(m) = self.playback.restore_max.take() {
-            self.ui.maximized = m;
-        }
-        let Some(pl) = self.playback.plan else { return };
-        let move_time = self.session.prefs.preview.get(self.playback.shortcut).move_time_to_preview_time;
-        if !move_time {
-            self.session.set_time(pl.origin);
-        } else if let Some(f) = self.playback.audio_frame
-            && let Some(c) = self.session.active_comp()
-        {
-            let t = c.frame_rate.tick_of(f);
-            self.session.set_time(t);
-        }
-    }
+impl FileDialogsUp {
+    /// Seconds a dialog has to take the keyboard from the app's windows. The desktop portal can
+    /// take a moment to show the first dialog on Linux.
+    const UNSEEN: f64 = 2.0;
 
-    pub fn toggle_play(&mut self, now: f64) {
-        let sc = self.session.prefs.preview.current;
-        self.toggle_play_with(now, sc);
-    }
-
-    /// A preview shortcut pressed: start its preview, or stop the running one. While Cache
-    /// Before Playback is still rendering, "If caching, play cached frames" plays what is
-    /// cached so far instead of stopping.
-    pub fn toggle_play_with(&mut self, now: f64, sc: effectcraft_engine::preview::PreviewShortcut) {
-        if !self.playback.playing {
-            self.play_with(now, sc);
-            return;
+    pub(crate) fn opened(&mut self) {
+        if self.count == 0 {
+            *self = Self::default();
         }
-        if self.playback.caching && self.session.prefs.preview.get(self.playback.shortcut).play_cached_frames && self.play_cached(now) {
-            return;
-        }
-        self.stop();
-    }
-
-    /// Cut the caching preview down to the frames cached from its first frame on and play them.
-    fn play_cached(&mut self, now: f64) -> bool {
-        let (Some(mut pl), Some(cid)) = (self.playback.plan, self.session.active_comp_id()) else { return false };
-        let scale = self.viewer_shown.as_ref().map(|(_, k)| k.scale as f64 / 1000.0).unwrap_or(1.0);
-        let series = self.frame_series(cid, scale);
-        let mut last = None;
-        let mut f = pl.first;
-        while f <= pl.end && self.frames.is_cached(&FrameKey { frame: f, ..series }) {
-            last = Some(f);
-            f += pl.step;
-        }
-        let Some(last) = last else { return false };
-        pl.end = last;
-        pl.start = pl.first;
-        self.playback.plan = Some(pl);
-        self.playback.caching = false;
-        self.playback.start_wall = now;
-        self.playback.start_frame = pl.first;
-        let t = self.session.active_comp().map(|c| c.frame_rate.tick_of(pl.first)).unwrap_or_default();
-        self.start_audio(t);
-        true
-    }
-
-    /// A preview plays with Video off in the Preview panel (audio only): the current time stays
-    /// put, so the viewer and Timeline say so instead of looking stuck (#1118). The frame under
-    /// the audible sample, when one is known.
-    pub fn video_preview_off(&self) -> Option<Option<i64>> {
-        let p = self.playback.plan.filter(|_| self.playback.playing)?;
-        (!p.video).then_some(self.playback.audio_frame)
-    }
-
-    /// The viewer shows grids, guides and safe margins (hidden while a preview without
-    /// Include Overlays plays).
-    pub fn overlays_visible(&self) -> bool {
-        !self.playback.playing || self.playback.overlays
+        self.count = self.count.saturating_add(1);
     }
 
-    /// The viewer shows layer handles and paths (View ▸ Show Layer Controls, and Include Layer
-    /// Controls while a preview plays).
-    pub fn layer_controls_visible(&self) -> bool {
-        self.ui.viewer.show_layer_controls && (!self.playback.playing || self.playback.layer_controls)
+    pub(crate) fn answered(&mut self) {
+        self.count = self.count.saturating_sub(1);
     }
 
-    /// RAM preview: advance at the preview's frame rate when frames are cached; otherwise hold
-    /// and keep rendering ahead (the green cache bar fills, then playback runs in real time).
-    fn advance_playback(&mut self, ctx: &egui::Context, scale: f64) {
-        let Some(cid) = self.session.active_comp_id() else { return };
-        let Some(c) = self.session.project.comp_arc(cid) else { return };
-        let now = ctx.input(|i| i.time);
-        let fr = c.frame_rate;
-        let plan = self.playback.plan.filter(|_| self.playback.playing);
-        let (wa, wb) = match plan {
-            Some(p) => (p.start, p.end),
-            None => (fr.frame_at(c.work_area.0), fr.frame_at(c.work_area.1 - c.frame_duration())),
-        };
-        let looping = plan.is_none_or(|p| p.looping);
-        let video = plan.is_none_or(|p| p.video);
-        // Prefetch ahead.
-        let cur = fr.frame_at(self.session.time());
-        // While paused (scrubbing, editing) the viewer's frame comes first: prefetch only a few
-        // frames, only once it is done, and not while edits keep coming (a layer dragged in the
-        // viewer): those frames would be stale at the next step and would hold the CPU and GPU
-        // the next viewer frame needs.
-        let ahead = if self.playback.playing {
-            (self.frames_parallelism() * 2).max(4) as i64
-        } else if self.frames.urgent_pending() {
-            0
-        } else if let Some(wait) = self.editing(now) {
-            ctx.request_repaint_after(std::time::Duration::from_secs_f64(wait));
-            0
-        } else {
-            // Keep workers available for a newly edited viewer frame. Running obsolete
-            // background renders cannot be preempted by the priority queue.
-            self.frames_parallelism().saturating_sub(1).min(2) as i64
-        };
-        let mut queued = self.frames.inflight();
-        let series = self.frame_series(cid, scale);
-        // The preview's position orders prefetch and eviction (#595).
-        let playhead = plan.filter(|p| p.video).map(|p| frames::Playhead { series, cur, start: p.start, end: p.end, step: p.step, looping: p.looping });
-        self.frames.set_playhead(playhead);
-        if self.playback.caching
-            && let Some(p) = plan
-        {
-            // Cache Before Playback: the range in play order, then start the clock. A range
-            // larger than the RAM preview budget is cut to the frames that fit (caching more
-            // would evict the first ones and never finish).
-            let mut all = true;
-            let n = (p.end - p.start) / p.step + 1;
-            let fit = self.frames_that_fit(&c, scale);
-            if n > fit {
-                let mut cut = p;
-                (cut.start, cut.end) = (p.first, (p.first + (fit - 1) * p.step).min(p.end));
-                self.playback.plan = Some(cut);
-                self.toast = Some((format!("Preview cut to {fit} of {n} frames: no more fit in the RAM preview (Settings ▸ Memory & CPU)"), now));
-                ctx.request_repaint();
-                return;
-            }
-            let order: Vec<i64> = (0..n).filter_map(|k| p.frame_after(p.first, k)).collect();
-            for f in order {
-                if self.frames.is_cached(&FrameKey { frame: f, ..series }) {
-                    continue;
-                }
-                all = false;
-                if queued < ahead as usize {
-                    self.request_frame(cid, f, scale);
-                    queued += 1;
-                }
-            }
-            self.playback.waiting = !all;
-            if all {
-                self.playback.caching = false;
-                self.playback.start_wall = now;
-                self.playback.start_frame = p.first;
-                self.session.set_time(fr.tick_of(p.first));
-                self.start_audio(fr.tick_of(p.first));
-            }
-            ctx.request_repaint();
-            return;
-        }
-        let step = plan.map_or(1, |p| p.step);
-        // Never further ahead than the RAM preview holds: those frames would evict the ones the
-        // preview shows first, or be evicted before it gets there (#595).
-        let window = (ahead * 3).min(self.frames_that_fit(&c, scale) - 1);
-        for k in 0..window {
-            if queued >= ahead as usize || !video {
-                break;
-            }
-            let f = match plan {
-                Some(p) => match p.frame_after(cur, k) {
-                    Some(f) => f,
-                    None => break,
-                },
-                None => {
-                    let mut f = cur + k;
-                    if f > wb {
-                        f = wa + (f - wb - 1).rem_euclid((wb - wa + 1).max(1));
-                    }
-                    f
-                }
-            };
-            if !self.frames.is_cached(&FrameKey { frame: f, ..series }) {
-                self.request_frame(cid, f, scale);
-                queued += 1;
-            }
-        }
-        if let Some(a) = &mut self.audio {
-            a.pump();
-            self.meter.update(a.feed.take_peaks(), now);
-        } else if let Some(s) = &mut self.scrub {
-            // Scrubbing: the meters follow the snippets; an idle second closes the output.
-            s.pump();
-            self.meter.update(s.feed.take_peaks(), now);
-            if now - s.last_used > 1.0 {
-                self.scrub = None;
-            }
-            ctx.request_repaint_after(std::time::Duration::from_millis(50));
-        } else if self.meter.active() {
-            self.meter.update([0.0; 2], now);
-            ctx.request_repaint();
-        }
-        if !self.playback.playing {
-            self.cache_when_idle(ctx, &c, &series, now, (wa, wb));
-            return;
-        }
-        let snap = |f: i64| wa + (f - wa).div_euclid(step) * step;
-        // Held sound starts once the frames ahead are cached (see `Playback::audio_held`): the
-        // prefetch window when the silent preview keeps real time, else the rest of the preview.
-        let fit = self.frames_that_fit(&c, scale);
-        if self.playback.audio_held
-            && let Some(p) = plan
-            && ((self.playback.keeps_up(now) && self.cached_ahead(&p, &series, cur, ahead.min(fit))) || self.cached_ahead(&p, &series, cur, fit))
-        {
-            self.playback.audio_held = false;
-            self.playback.start_wall = now;
-            self.playback.start_frame = cur;
-            self.start_audio(fr.tick_of(cur));
-        }
-        // Audio clock drives playback: show the frame under the audible sample.
-        if let Some(a) = &self.audio {
-            if a.finished() {
-                if video {
-                    self.session.set_time(fr.tick_of(wb));
-                } else {
-                    self.playback.audio_frame = Some(wb);
-                }
-                self.stop();
-                return;
-            }
-            let target = snap(audio::frame_of_sample(a.clock(), a.rate, fr).clamp(wa, wb));
-            if !video {
-                self.playback.audio_frame = Some(target);
-            } else if self.frames.is_cached(&FrameKey { frame: target, ..series }) {
-                self.playback.waiting = false;
-                if target != cur {
-                    self.session.set_time(fr.tick_of(target));
-                    self.playback.frame_shown(now);
-                }
-            } else {
-                // Rendering can't keep up: rather than skip frames, the sound stops and every
-                // frame shows as it renders until the frames ahead are cached again.
-                self.audio = None;
-                self.playback.audio_held = true;
-                self.playback.waiting = true;
-                // The rate measured before the stall no longer says it keeps up.
-                self.playback.shown_at.clear();
-                self.playback.start_wall = now;
-                self.playback.start_frame = cur;
-            }
-            ctx.request_repaint();
-            return;
-        }
-        let elapsed = now - self.playback.start_wall;
-        let n = ((elapsed * self.playback.fps) / step as f64).floor() as i64;
-        let target = match plan {
-            Some(p) => p.frame_after(self.playback.start_frame, n),
-            None => {
-                let t = self.playback.start_frame + n;
-                if t <= wb {
-                    Some(t)
-                } else if looping {
-                    Some(wa + (t - wa).rem_euclid((wb - wa + 1).max(1)))
-                } else {
-                    None
-                }
-            }
-        };
-        let Some(target) = target else {
-            if video {
-                self.session.set_time(fr.tick_of(wb));
-            } else {
-                self.playback.audio_frame = Some(wb);
-            }
-            self.stop();
-            return;
-        };
-        if !video {
-            // Audio-only preview without an audio device: the clock runs, the time stays.
-            self.playback.audio_frame = Some(target);
-            ctx.request_repaint();
-            return;
-        }
-        if self.frames.is_cached(&FrameKey { frame: target, ..series }) {
-            self.playback.waiting = false;
-            if target != cur {
-                self.session.set_time(fr.tick_of(target));
-                self.playback.frame_shown(now);
-            }
-        } else {
-            // Not cached yet: hold the clock at the current frame (cache first, then play).
-            self.playback.waiting = true;
-            let next = plan.and_then(|p| p.frame_after(cur, 1)).unwrap_or(if cur + 1 > wb { wa } else { cur + 1 });
-            if self.frames.is_cached(&FrameKey { frame: next, ..series }) {
-                self.session.set_time(fr.tick_of(next));
-            }
-            self.playback.start_wall = now;
-            self.playback.start_frame = fr.frame_at(self.session.time());
-        }
-        ctx.request_repaint();
-    }
-
-    /// While the project keeps changing (an edit within [`EDIT_QUIET`] seconds), how long until
-    /// it counts as settled.
-    fn editing(&mut self, now: f64) -> Option<f64> {
-        if self.last_edit.1 != self.session.revision {
-            self.last_edit = (now, self.session.revision);
-        }
-        let left = EDIT_QUIET - (now - self.last_edit.0);
-        (left > 0.0).then_some(left)
-    }
-
-    /// Composition ▸ Preview ▸ Cache Frames When Idle: after a second without input or edits,
-    /// render the work area's frames (from the current time on, then from its start) in the
-    /// background, a few at a time, until it is cached or the RAM preview budget is full.
-    fn cache_when_idle(&mut self, ctx: &egui::Context, comp: &effectcraft_engine::project::Comp, series: &FrameKey, now: f64, (wa, wb): (i64, i64)) {
-        let active = ctx.input(|i| !i.events.is_empty() || i.pointer.any_down() || i.pointer.is_moving());
-        if active || self.last_activity.1 != self.session.revision {
-            self.last_activity = (now, self.session.revision);
-        }
-        if !self.ui.cache_when_idle || self.frames.urgent_pending() {
-            return;
-        }
-        let quiet = now - self.last_activity.0;
-        if quiet < 1.0 {
-            ctx.request_repaint_after(std::time::Duration::from_secs_f64(1.0 - quiet));
-            return;
-        }
-        // An empty work area has nothing to cache.
-        let n = wb - wa + 1;
-        if n < 1 {
-            return;
-        }
-        let cur = comp.frame_rate.frame_at(self.session.time()).clamp(wa, wb);
-        let fit = self.frames_that_fit(comp, series.scale as f64 / 1000.0).min(n);
-        let slots = (self.frames_parallelism() / 2).max(1);
-        let mut queued = self.frames.inflight();
-        let scale = series.scale as f64 / 1000.0;
-        let mut pending = false;
-        for k in 0..fit {
-            let f = wa + (cur - wa + k).rem_euclid(n);
-            if self.frames.is_cached(&FrameKey { frame: f, ..*series }) {
-                continue;
-            }
-            pending = true;
-            if queued >= slots {
-                break;
-            }
-            self.request_frame(ItemId(series.comp), f, scale);
-            queued += 1;
+    /// Whether a dialog is up at `now`, `focused`: whether one of the app's windows has the
+    /// keyboard.
+    pub(crate) fn up(&mut self, focused: bool, now: f64) -> bool {
+        if self.count == 0 {
+            return false;
         }
-        if pending {
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-    }
-
-    /// How many viewer frames of `comp` at `scale` the RAM preview budget holds (90 % of it,
-    /// at least one).
-    /// The frames of `plan` from `cur` to its end, or as many as fit in the RAM preview, are
-    /// cached: sound can play from `cur` in real time.
-    fn cached_ahead(&self, plan: &effectcraft_engine::preview::PreviewPlan, series: &FrameKey, cur: i64, fit: i64) -> bool {
-        let cached = self.frames.cached_frames(series);
-        (0..fit).map_while(|k| plan.frame_after(cur, k)).take_while(|f| *f >= cur).all(|f| cached.binary_search(&f).is_ok())
-    }
-
-    fn frames_that_fit(&self, comp: &effectcraft_engine::project::Comp, scale: f64) -> i64 {
-        let side = |n: u32| (n as f64 * scale).ceil().max(1.0);
-        let frame = side(comp.width) * side(comp.height) * 4.0;
-        ((self.frames.budget() as f64 * 0.9 / frame) as i64).max(1)
-    }
-
-    fn frames_parallelism(&self) -> usize {
-        if cfg!(target_arch = "wasm32") {
-            // frame workers render one frame each; without them frames render one at a time
-            // on the UI thread (`Frames::pump`)
-            return self.frames.remote_slots().max(1);
-        }
-        self.frames.parallelism()
-    }
-
-    // ---------------------------------------------------------------- control channel
-
-    pub(crate) fn raise_for_control(&mut self, ctx: &egui::Context) {
-        ctx.request_repaint();
-    }
-
-    fn drain_control(&mut self, ctx: &egui::Context) {
-        let Some(rx) = self.control_rx.take() else { return };
-        let now = ctx.input(|i| i.time);
-        let mut reqs: Vec<(ControlRequest, f64)> = std::mem::take(&mut self.deferred);
-        while let Ok(req) = rx.try_recv() {
-            reqs.push((req, now + 3.0));
-        }
-        for (req, deadline) in reqs {
-            let reply = req.reply.clone();
-            match control::handle(self, ctx, &req) {
-                control::Outcome::Done(v) => {
-                    let _ = reply.send(v);
-                }
-                control::Outcome::Retry(msg) => {
-                    if now < deadline {
-                        self.deferred.push((req, deadline));
-                        ctx.request_repaint();
-                    } else {
-                        let _ = reply.send(json!({"ok": false, "error": msg}));
-                    }
-                }
-                control::Outcome::AfterInput => self.input_waiters.push(reply),
-                control::Outcome::AwaitJobs(w) => {
-                    self.job_waiters.push((w, reply));
-                    ctx.request_repaint();
-                }
-                control::Outcome::Screenshot { path, crop } => {
-                    // A covered or minimized window presents no frames (macOS skips its redraws), so
-                    // a screenshot would never arrive and nothing would tick its timeout.
-                    if ctx.input(|i| i.viewport().occluded == Some(true) || i.viewport().minimized == Some(true)) {
-                        let _ = reply.send(json!({"ok": false, "error": "window is covered or minimized: call ui.focus first (render.frame renders comp pixels without the window)"}));
-                        continue;
-                    }
-                    let token = self.next_token;
-                    self.next_token += 1;
-                    let settle = now + 0.35;
-                    self.queued_screenshots.push((token, settle, 0));
-                    self.pending_screenshots.push((token, path, crop, reply, settle + SCREENSHOT_TIMEOUT_S));
-                }
-            }
-        }
-        self.control_rx = Some(rx);
-        self.finish_job_waiters(ctx);
-    }
-
-    /// Reply to the control requests whose offloaded jobs ended.
-    fn finish_job_waiters(&mut self, ctx: &egui::Context) {
-        if self.job_waiters.is_empty() {
-            return;
-        }
-        self.session.poll_render();
-        self.session.poll_offload();
-        let waiters = std::mem::take(&mut self.job_waiters);
-        for (w, reply) in waiters {
-            if w.pending(self) {
-                self.job_waiters.push((w, reply));
-            } else {
-                let v = w.finish(self);
-                let _ = reply.send(v);
-            }
-        }
-        if !self.job_waiters.is_empty() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(50));
-        }
-    }
-
-    fn issue_screenshots(&mut self, ctx: &egui::Context) {
-        let now = ctx.input(|i| i.time);
-        let mut any = false;
-        let busy = self.frames.inflight() > 0;
-        self.queued_screenshots.retain_mut(|(token, at, frames)| {
-            *frames += 1;
-            any = true;
-            // Wait for the viewer's frame to finish rendering (bounded by the timeout below).
-            if now >= *at && *frames >= 3 && (!busy || now > *at + 2.5) {
-                ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(egui::UserData::new(*token)));
-                false
-            } else {
-                true
-            }
-        });
-        self.pending_screenshots.retain(|(.., reply, deadline)| {
-            if now > *deadline {
-                let _ = reply.send(json!({"ok": false, "error": "no frame was presented (window hidden or display asleep)"}));
-                false
-            } else {
-                true
-            }
-        });
-        if any {
-            ctx.request_repaint();
-        } else if !self.pending_screenshots.is_empty() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(16));
-        }
-    }
-
-    fn collect_screenshots(&mut self, ctx: &egui::Context) {
-        if self.pending_screenshots.is_empty() {
-            return;
-        }
-        let events: Vec<_> = ctx.input(|i| {
-            i.raw
-                .events
-                .iter()
-                .filter_map(|e| match e {
-                    egui::Event::Screenshot { user_data, image, .. } => {
-                        let token = user_data.data.as_ref().and_then(|d| d.downcast_ref::<u64>()).copied()?;
-                        Some((token, image.clone()))
-                    }
-                    _ => None,
-                })
-                .collect()
-        });
-        for (token, image) in events {
-            if let Some(i) = self.pending_screenshots.iter().position(|(t, ..)| *t == token) {
-                let (_, path, crop, reply, _) = self.pending_screenshots.remove(i);
-                let r = control::save_screenshot(ctx, &image, path.as_deref(), crop);
-                let _ = reply.send(r);
-            }
-        }
-    }
-
-    // ---------------------------------------------------------------- frame
-
-    fn handle_events(&mut self, ctx: &egui::Context) {
-        for ev in self.session.drain_events() {
-            match ev {
-                effectcraft_engine::Event::OpenComp(c) => {
-                    panels::viewers::on_open_comp(self, c);
-                    self.ui.timeline.pps = None;
-                }
-                effectcraft_engine::Event::Toast { message, .. } => self.toast = Some((message, ctx.input(|i| i.time))),
-                effectcraft_engine::Event::OpenUrl(url) => ctx.open_url(egui::OpenUrl::new_tab(url)),
-                // Frames are keyed by content: an edit keeps those of comps it doesn't touch.
-                effectcraft_engine::Event::ProjectChanged { .. } => {}
-                effectcraft_engine::Event::Frontend { command, params } => {
-                    if let Err(e) = crate::menus::frontend(self, ctx, &command, params) {
-                        self.ui.status = e;
-                    }
-                }
-                effectcraft_engine::Event::PurgeCaches => self.frames.clear(),
-                effectcraft_engine::Event::CopyImage { width, height, rgba } => {
-                    if let Err(e) = copy_image(ctx, width, height, &rgba) {
-                        self.ui.status = e;
-                    }
-                }
-            }
-        }
-    }
-
-    fn frame(&mut self, ui: &mut egui::Ui) {
-        let ctx = ui.ctx().clone();
-        self.apply_gpu_failure(&ctx);
-        self.run_dialog_answers();
-        self.auto.begin_frame();
-        self.frames.set_context(&ctx);
-        if self.session.render_job.is_some() {
-            self.session.poll_render();
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-        if self.session.track_job.is_some() {
-            self.session.poll_track();
-            ctx.request_repaint_after(std::time::Duration::from_millis(50));
-        }
-        if self.session.mask_job.is_some() {
-            self.session.poll_mask_track();
-            ctx.request_repaint_after(std::time::Duration::from_millis(50));
-        }
-        // Background tasks (Content-Aware Fill, Scene Edit Detection, imports).
-        if !self.session.tasks.is_empty() {
-            self.session.poll_jobs();
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-        // Analyses running in a worker (the web app).
-        if !self.session.offloaded.is_empty() {
-            self.session.poll_offload();
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-        // Warp Stabilizer: finish analyses and start queued (re-)analyses in the background.
-        if self.session.warp_job.is_some() || !self.session.warp_pending.is_empty() {
-            self.session.poll_warp(true);
-            self.session.poll_roto(true);
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-        // Roto Brush propagation and Object Matte tracking / Freeze: finish jobs (a Freeze writes
-        // its mattes) and start queued ones in the background.
-        if self.session.roto_job.is_some() || !self.session.roto_pending.is_empty() {
-            self.session.poll_roto(true);
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-        // 3D Camera Tracker: likewise (tracking, then solving).
-        if self.session.camera_job.is_some() || !self.session.camera_pending.is_empty() {
-            self.session.poll_camera(true);
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-        self.run_script_tasks(&ctx);
-        self.apply_prefs(&ctx);
-        self.handle_events(&ctx);
-        panels::unsaved::on_close_requested(self, &ctx);
-        let title = panels::unsaved::window_title(self);
-        if title != self.window_title {
-            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
-            self.window_title = title;
-        }
-        self.tick_autosave(&ctx);
-        prefs_live::frame(self, &ctx);
-        if let Some(rx) = self.command_inbox.take() {
-            while let Ok(id) = rx.try_recv() {
-                if let Err(e) = menus::invoke(self, &ctx, &id, json!({})) {
-                    self.ui.status = e;
-                }
-            }
-            self.command_inbox = Some(rx);
-        }
-        let tab_had_widget_focus = ctx.egui_wants_keyboard_input();
-        menus::handle_shortcuts(self, &ctx);
-        if !ctx.input(|i| i.pointer.primary_down()) {
-            self.ui.viewer.property_interacting = false;
-        }
-        let t = self.tokens;
-        let full = ui.max_rect();
-        if self.dialog.is_some() {
-            ui.disable();
-        }
-        ui.painter().rect_filled(full, 0.0, t.app_bg);
-        let mut top = full.min.y;
-        if self.ui.show_menu_bar {
-            let mb = egui::Rect::from_min_size(full.min, egui::vec2(full.width(), 24.0));
-            let mut child = ui.new_child(egui::UiBuilder::new().max_rect(mb));
-            child.painter().rect_filled(mb, 0.0, t.header_bg);
-            menus::menu_bar(self, &mut child);
-            top = mb.max.y;
-        }
-        let header_h = 40.0;
-        let header = egui::Rect::from_min_size(egui::pos2(full.min.x, top), egui::vec2(full.width(), header_h));
-        header::show(self, ui, header);
-        let body = egui::Rect::from_min_max(egui::pos2(full.min.x + 4.0, header.max.y + 2.0), egui::pos2(full.max.x - 4.0, full.max.y - 4.0));
-        self.dock_area(ui, body);
-        #[cfg(not(target_arch = "wasm32"))]
-        prefs_live::dropped_files(self, ui, full);
-        if !tab_had_widget_focus {
-            menus::handle_tab_shortcut(self, &ctx);
-        }
-        panels::precomp::mini_flowchart(self, &ctx);
-        panels::home::capture_thumbnail(self);
-        panels::dialogs::show(self, &ctx);
-        panels::scriptui_view::sync_panels(self);
-        panels::scriptui_view::show_windows(self, &ctx);
-        panels::learn::coach(self, &ctx);
-        let lift = panels::media_panels::import_card(self, ui, full);
-        self.draw_toast(ui, full, lift);
-        if self.session.config.is_some() && self.workspace_store.has_changes(&self.ui) && !ctx.input(|i| i.pointer.any_down()) {
-            if self.workspace_store.due(ctx.input(|i| i.time)) {
-                self.save_workspace_state();
-            }
-            if self.workspace_store.has_changes(&self.ui) {
-                ctx.request_repaint_after(std::time::Duration::from_secs(1));
-            }
-        }
-    }
-
-    fn save_workspace_state(&mut self) {
-        if let Err(error) = self.workspace_store.save(self.session.config.as_deref(), &self.ui) {
-            if self.workspace_store.error.as_ref() != Some(&error) {
-                log::warn!("{error}");
-                self.ui.status = error.clone();
-            }
-            self.workspace_store.error = Some(error);
-        }
-    }
-
-    /// The status message or the latest toast, bottom left (`lift` points higher while the
-    /// Importing card is there).
-    fn draw_toast(&mut self, ui: &mut egui::Ui, full: egui::Rect, lift: f32) {
-        let now = ui.input(|i| i.time);
-        let msg = if !self.ui.status.is_empty() {
-            Some(self.ui.status.clone())
-        } else {
-            self.toast.as_ref().filter(|(_, at)| now - at < 4.0).map(|(m, _)| m.clone())
-        };
-        if let Some(m) = msg {
-            let t = &self.tokens;
-            let galley = ui.painter().layout_no_wrap(m.clone(), Tokens::ui(12.0), t.text);
-            let r = egui::Rect::from_min_size(egui::pos2(full.min.x + 16.0, full.max.y - 44.0 - lift), galley.size() + egui::vec2(24.0, 14.0));
-            ui.painter().rect_filled(r, 6.0, t.panel_bg);
-            ui.painter().rect_stroke(r, 6.0, egui::Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
-            ui.painter().galley(r.min + egui::vec2(12.0, 7.0), galley, t.text);
-            self.auto.add("toast", r, &m);
-            let resp = ui.interact(r, egui::Id::new("toast"), egui::Sense::click());
-            if resp.clicked() {
-                self.ui.status.clear();
-                self.toast = None;
-            }
-            ui.ctx().request_repaint_after(std::time::Duration::from_millis(500));
-            if !self.ui.status.is_empty() {
-                let since: f64 = ui.data(|d| d.get_temp(egui::Id::new("status-since")).unwrap_or(now));
-                ui.data_mut(|d| d.insert_temp(egui::Id::new("status-since"), since));
-                if now - since > 5.0 {
-                    self.ui.status.clear();
-                    ui.data_mut(|d| d.remove::<f64>(egui::Id::new("status-since")));
-                }
-            }
+        let since = *self.since.get_or_insert(now);
+        if !focused {
+            self.left = true;
+        } else if self.left || now - since >= Self::UNSEEN {
+            *self = Self::default();
         }
+        self.count > 0
     }
 }
 
-impl EffectcraftApp {
-    /// Scripts' `app.scheduleTask` tasks that are due (repeating ones keep a ScriptUI panel
-    /// fresh): errors as a toast, the last line printed in the status bar, and a repaint when
-    /// the next one is due.
-    fn run_script_tasks(&mut self, ctx: &egui::Context) {
-        if self.session.script_ui.task_hosts.is_empty() {
-            return;
-        }
-        let Some(r) = effectcraft_engine::scriptui::ScriptUi::run_tasks(&mut self.session) else { return };
-        if let Some(msg) = r["errors"].as_array().and_then(|e| e.first()).and_then(|e| e["message"].as_str()) {
-            self.toast = Some((format!("Scheduled script task: {msg}"), ctx.input(|i| i.time)));
-        } else if let Some(line) = r["output"].as_array().and_then(|o| o.last()).and_then(|l| l.as_str()) {
-            self.ui.status = line.to_string();
-        }
-        if let Some(next) = r["next"].as_u64() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(next));
-        }
-    }
-
-    /// Auto-save a dirty project when the interval has passed (Settings ▸ Project ▸ Auto-Save).
-    fn tick_autosave(&mut self, ctx: &egui::Context) {
-        let now = web_time::SystemTime::now().duration_since(web_time::UNIX_EPOCH).map(|d| d.as_secs_f64()).unwrap_or(0.0);
-        if let Some(Err(e)) = self.session.autosave_tick(now) {
-            self.ui.status = e.to_string();
-        }
-        if self.session.prefs.auto_save.enabled {
-            ctx.request_repaint_after(std::time::Duration::from_secs(30));
-        }
-        // File ▸ Watch Folder: look for new projects every 10 seconds.
-        if self.session.state.watch_folder.is_some() {
-            let key = egui::Id::new("watchFolder.lastPoll");
-            let last: f64 = ctx.data(|d| d.get_temp(key)).unwrap_or(0.0);
-            if now - last >= 10.0 {
-                ctx.data_mut(|d| d.insert_temp(key, now));
-                match self.session.execute("file.watchFolder.poll", serde_json::json!({})) {
-                    Ok(r) => {
-                        if let Some(n) = r["rendered"].as_array().map(Vec::len).filter(|n| *n > 0) {
-                            self.ui.status = format!("Watch Folder: rendered {n} project(s)");
-                        }
-                    }
-                    Err(e) => self.ui.status = e.to_string(),
-                }
-            }
-            ctx.request_repaint_after(std::time::Duration::from_secs(10));
-        }
-        self.tick_footage_reload(ctx, now);
-    }
-
-    /// Settings ▸ Import ▸ Reload Footage Changed on Disk: every two seconds, and as soon as the
-    /// window comes back to the front (after saving in another app), stamp the footage files on a
-    /// worker thread and reload the ones that changed.
-    fn tick_footage_reload(&mut self, ctx: &egui::Context, now: f64) {
-        use effectcraft_engine::footage_reload;
-        if let Some(Err(e)) = footage_reload::poll_scan(&mut self.session) {
-            self.ui.status = e.to_string();
-        }
-        let (last_key, focus_key) = (egui::Id::new("footageReload.lastScan"), egui::Id::new("footageReload.focused"));
-        let focused = ctx.input(|i| i.focused);
-        let was_focused: bool = ctx.data(|d| d.get_temp(focus_key)).unwrap_or(focused);
-        ctx.data_mut(|d| d.insert_temp(focus_key, focused));
-        if self.session.prefs.import.auto_reload_footage == "off" || self.session.project.items.is_empty() {
-            return;
-        }
-        let last: f64 = ctx.data(|d| d.get_temp(last_key)).unwrap_or(0.0);
-        if now - last >= 2.0 || (focused && !was_focused) {
-            ctx.data_mut(|d| d.insert_temp(last_key, now));
-            footage_reload::start_scan(&mut self.session);
-        }
-        if self.session.footage_scan.is_some() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        } else {
-            ctx.request_repaint_after(std::time::Duration::from_secs(2));
-        }
-    }
-
-    /// Take the pending synthetic input (from `ui.click`, `ui.key`, …). Hosts that don't call
-    /// [`eframe::App::raw_input_hook`] (the headless test harness) feed these in themselves.
-    pub fn take_synthetic_input(&mut self) -> Vec<egui::Event> {
-        std::mem::take(&mut self.synthetic)
-    }
+/// Keys and dropped files from floating panels' OS windows (craft-ui `DockOutput`).
+#[derive(Default)]
+pub(crate) struct ForwardedInput {
+    pub(crate) events: Vec<egui::Event>,
+    pub(crate) files: Vec<egui::DroppedFileHandle>,
+    /// Files handed over by a floating window whose panel under the pointer was the Timeline. The
+    /// paths lose the window they came from, so this keeps the one thing the import still needs
+    /// (#2661); each drop clears it.
+    pub(crate) dropped_on_timeline: bool,
 }
 
-impl eframe::App for EffectcraftApp {
-    fn on_exit(&mut self) {
-        self.save_workspace_state();
-        // Clean exit: no crash recovery next launch (unless the graphics device was lost with
-        // unsaved changes, which are in the auto-save it offers).
-        if self.device_lost_close != Some(true) {
-            self.session.end_recovery();
-        }
-    }
-
-    fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
-        let injected = !self.synthetic.is_empty();
-        self.feed_synthetic(raw_input);
-        if pointer_wrap::prepare_input(ctx, raw_input, injected) {
-            self.session.history.merge_key = None;
-        }
-    }
-
-    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        self.apply_gpu_failure(ctx);
-        // The CJK fallback fonts depend on the interface language, so they follow a change of
-        // Settings ▸ General ▸ Language instead of only the first frame.
-        let language = crate::i18n::language(self);
-        crate::i18n::set_current(language);
-        if !self.styled || self.styled_language != language {
-            theme::install(ctx, &self.tokens, language);
-            self.styled_language = language;
-            if !self.styled {
-                fit_window(ctx);
-                self.styled = true;
-            }
-            ctx.request_repaint();
-        } else {
-            self.fonts_ready = true;
-        }
-        let now = ctx.input(|i| i.time);
-        let dt = (now - self.last_time) as f32;
-        if dt > 0.0 {
-            self.fps = self.fps * 0.9 + (1.0 / dt).min(480.0) * 0.1;
-        }
-        self.last_time = now;
-        self.drain_control(ctx);
-        if !self.synthetic.is_empty() {
-            ctx.request_repaint();
-        } else if !self.input_waiters.is_empty() {
-            for w in self.input_waiters.drain(..) {
-                let _ = w.send(json!({"ok": true, "result": null}));
-            }
-        }
-        self.issue_screenshots(ctx);
-        self.collect_screenshots(ctx);
-    }
-
-    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
-        if self.gpu_failure_applied == Some(true) {
-            self.close_after_device_loss(ui.ctx());
-            return;
-        }
-        self.init_gpu(frame);
-        if !self.fonts_ready {
-            ui.ctx().request_repaint();
-            return;
-        }
-        self.frame(ui);
-        let ctx = ui.ctx().clone();
-        #[cfg(not(target_arch = "wasm32"))]
-        pointer_wrap::finish_native(&ctx, frame);
-        // wasm32: no frame threads; render queued frames now, between UI frames.
-        if cfg!(target_arch = "wasm32") && self.frames.pump(std::time::Duration::from_millis(if self.playback.playing { 24 } else { 40 })) {
-            ctx.request_repaint();
-        }
-        self.last_ui_time = ctx.input(|i| i.time);
-        if !self.synthetic.is_empty() {
-            ctx.request_repaint();
-        } else if !self.input_waiters.is_empty() {
-            ctx.request_repaint();
-            for w in self.input_waiters.drain(..) {
-                let _ = w.send(json!({"ok": true, "result": null}));
-            }
-        }
-        if self.frames.inflight() > 0 {
-            ctx.request_repaint_after(std::time::Duration::from_millis(30));
-        }
-    }
-}
-
-/// Advance playback with the viewer's scale (called by the viewer panel each frame).
-pub(crate) fn tick_playback(app: &mut EffectcraftApp, ctx: &egui::Context, scale: f64) {
-    app.advance_playback(ctx, scale);
-}
-
-/// Put `width` × `height` straight-alpha RGBA8 pixels on the system clipboard (Composition ▸ Copy
-/// Frame to Clipboard). The pixel count is checked first: egui's image constructor panics on a
-/// size that doesn't match its buffer.
-fn copy_image(ctx: &egui::Context, width: u32, height: u32, rgba: &[u8]) -> Result<(), String> {
-    let (w, h) = (width as usize, height as usize);
-    if w == 0 || h == 0 || w.checked_mul(h).and_then(|n| n.checked_mul(4)) != Some(rgba.len()) {
-        return Err(format!("cannot copy a malformed {width}×{height} image to the clipboard"));
-    }
-    ctx.copy_image(egui::ColorImage::from_rgba_unmultiplied([w, h], rgba));
-    Ok(())
-}
-
-/// Maximize a first window that doesn't fit the screen, which fits it to the space beside the
-/// taskbar or dock. The 1680 × 1020 window on a smaller screen is only shrunk to the monitor's
-/// size, so with its title bar it ran under the taskbar and cut menus off at the bottom of the
-/// screen (#269).
-fn fit_window(ctx: &egui::Context) {
-    let (monitor, window) = ctx.input(|i| (i.viewport().monitor_size, i.viewport().outer_rect.or(i.viewport().inner_rect)));
-    if let (Some(monitor), Some(window)) = (monitor, window)
-        && overflows_screen(window.size(), monitor)
-    {
-        ctx.send_viewport_cmd(egui::ViewportCommand::Maximized(true));
-    }
-}
-
-/// Whether a window `size` leaves no room on a `monitor` for a taskbar or dock (points).
-fn overflows_screen(size: egui::Vec2, monitor: egui::Vec2) -> bool {
-    const TASKBAR: f32 = 64.0;
-    size.x > monitor.x || size.y > monitor.y - TASKBAR
+/// Record the scale the viewer drew at (called by the viewer panel each pass).
+///
+/// Playback itself advances in [`EffectcraftApp::tick`], so it keeps running while the window is
+/// hidden; using the last drawn scale keeps prefetch keys consistent with the visible viewer.
+pub(crate) fn note_viewer_scale(app: &mut EffectcraftApp, scale: f64) {
+    app.last_viewer_scale = Some(scale);
 }
 
 #[cfg(test)]
-mod fit_window_tests {
-    use super::overflows_screen;
-    use egui::vec2;
-
-    #[test]
-    fn a_window_taller_than_the_screen_beside_its_taskbar_overflows() {
-        // The default window on a 1366 × 768 laptop (shrunk to the monitor) and on 1080p.
-        assert!(overflows_screen(vec2(1366.0, 799.0), vec2(1366.0, 768.0)));
-        assert!(overflows_screen(vec2(1680.0, 1051.0), vec2(1920.0, 1080.0)));
-        assert!(!overflows_screen(vec2(1680.0, 1051.0), vec2(2560.0, 1440.0)));
-    }
-}
-
-#[cfg(test)]
-mod copy_frame_tests {
-    use super::*;
-
-    fn copied(output: &egui::FullOutput) -> Vec<&egui::ColorImage> {
-        output
-            .platform_output
-            .commands
-            .iter()
-            .filter_map(|c| match c {
-                egui::OutputCommand::CopyImage(image) => Some(image),
-                _ => None,
-            })
-            .collect()
-    }
-
-    /// Composition ▸ Copy Frame to Clipboard puts the rendered frame on the system clipboard.
-    #[test]
-    fn copy_frame_puts_the_frame_on_the_clipboard() {
-        let mut session = Session::default();
-        session.execute("comp.new", json!({"name": "Copy", "width": 8, "height": 6, "duration": 1})).unwrap();
-        session.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
-        let mut app = EffectcraftApp::new(session);
-        let ctx = egui::Context::default();
-        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
-            crate::menus::invoke(&mut app, ui.ctx(), "comp.copyFrame", json!({})).unwrap();
-            app.handle_events(ui.ctx());
-        });
-        output.textures_delta.clear();
-        let images = copied(&output);
-        assert_eq!(images.len(), 1);
-        assert_eq!(images[0].size, [8, 6]);
-        assert!(images[0].pixels.iter().all(|p| *p == egui::Color32::from_rgb(255, 0, 0)));
-    }
-
-    /// A malformed image never reaches egui's panicking constructor.
-    #[test]
-    fn a_malformed_image_is_an_error_not_a_crash() {
-        let ctx = egui::Context::default();
-        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
-            assert!(copy_image(ui.ctx(), 4, 4, &[0; 10]).is_err());
-            assert!(copy_image(ui.ctx(), 0, 4, &[]).is_err());
-            assert!(copy_image(ui.ctx(), u32::MAX, u32::MAX, &[0; 4]).is_err());
-        });
-        output.textures_delta.clear();
-        assert!(copied(&output).is_empty());
-    }
-}
-
-#[cfg(test)]
-mod gpu_failure_tests {
-    use super::*;
-
-    #[test]
-    fn host_failure_preserves_document_undo_and_cpu_pixels_and_detaches_late_readbacks() {
-        let mut session = Session::default();
-        let comp = ItemId(session.execute("comp.new", json!({"name": "Recovery", "width": 4, "height": 4, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
-        session.execute("layer.newSolid", json!({"comp": comp.0, "color": "#ff0000"})).unwrap();
-        let before = session.render(comp, Tick::ZERO, RenderOpts::default());
-        let project = session.project.clone();
-        let revision = session.revision;
-        let prefs = serde_json::to_value(&session.prefs).unwrap();
-        let mut app = EffectcraftApp::new(session);
-        let ctx = egui::Context::default();
-        let bridge = gpu_failure::GpuFailureBridge::new(&ctx);
-        app.set_gpu_failure_bridge(bridge.clone());
-        let late_slot = app.viewer_readback.1.clone();
-        let key = FrameKey { revision, content: 1, comp: comp.0, frame: 0, scale: 1000, view: 0, opts: 0 };
-        app.viewer_readback.0 = Some(key);
-        bridge.report("synthetic host device failure", true);
-        app.apply_gpu_failure(&ctx);
-        assert!(Arc::ptr_eq(&project, &app.session.project));
-        assert_eq!(app.session.revision, revision);
-        assert_eq!(serde_json::to_value(&app.session.prefs).unwrap(), prefs);
-        assert!(app.gpu_checked, "failed device cannot be initialized again next frame");
-        assert!(app.session.accel.is_none());
-        assert!(app.ui.status.contains("presentation requires restarting"));
-        assert_eq!(app.session.render(comp, Tick::ZERO, RenderOpts::default()).data, before.data);
-        *late_slot.lock().unwrap() = Some((key, Arc::new(egui::ColorImage::new([1, 1], vec![egui::Color32::RED]))));
-        assert!(app.viewer_readback.0.is_none());
-        assert!(app.viewer_readback.1.lock().unwrap().is_none(), "a late completion cannot refill the replacement slot");
-        app.session.execute("edit.undo", json!({})).unwrap();
-        assert!(app.session.project.comp(comp).unwrap().layers.is_empty());
-        app.session.execute("edit.redo", json!({})).unwrap();
-        assert_eq!(app.session.render(comp, Tick::ZERO, RenderOpts::default()).data, before.data);
-    }
-}
-
-#[cfg(test)]
-mod appearance_tests {
-    use super::*;
-    use crate::theme::ThemeKind;
-
-    fn app() -> EffectcraftApp {
-        EffectcraftApp::new(effectcraft_engine::Session::default())
-    }
-
-    /// The Tools bar's appearance button: Sync with System, Light, Dark, then Sync with System
-    /// again, showing the saved theme of each family without losing either choice.
-    #[test]
-    fn appearance_button_cycles_modes_without_losing_theme_choices() {
-        let ctx = egui::Context::default();
-        let mut app = app();
-        app.hooks.system_theme = Some(Box::new(|_| Some(egui::Theme::Dark)));
-        app.set_pref("appearance.darkTheme", json!("darker")).unwrap();
-        app.apply_prefs(&ctx);
-        assert_eq!(app.ui.theme, ThemeKind::Darker);
-        for (mode, shown) in [("auto", ThemeKind::Darker), ("light", ThemeKind::Light), ("dark", ThemeKind::Darker), ("auto", ThemeKind::Darker)] {
-            menus::invoke(&mut app, &ctx, "view.theme.toggle", json!({})).unwrap();
-            assert_eq!(app.session.prefs.appearance.appearance_mode, mode);
-            assert_eq!(app.ui.theme, shown, "{mode}");
-            assert_eq!(app.tokens.kind, shown);
-            assert_eq!(app.session.prefs.appearance.dark_theme, "darker");
-            assert_eq!(app.session.prefs.appearance.light_theme, "light");
-        }
-    }
-
-    /// Sync with System follows the host's answer (the Linux portal) when it changes, and falls
-    /// back to Dark when nothing reports a system appearance.
-    #[test]
-    fn auto_follows_a_stubbed_system_theme() {
-        use std::sync::{Arc, Mutex};
-        let ctx = egui::Context::default();
-        let mut app = app();
-        let system = Arc::new(Mutex::new(Some(egui::Theme::Light)));
-        let read = Arc::clone(&system);
-        app.hooks.system_theme = Some(Box::new(move |_| *read.lock().unwrap_or_else(std::sync::PoisonError::into_inner)));
-        app.set_pref("appearance.appearanceMode", json!("auto")).unwrap();
-        app.apply_prefs(&ctx);
-        assert_eq!(app.ui.theme, ThemeKind::Light);
-        *system.lock().unwrap() = Some(egui::Theme::Dark);
-        app.apply_prefs(&ctx);
-        assert_eq!(app.ui.theme, ThemeKind::Dark, "a system change applies without a settings change");
-        *system.lock().unwrap() = None;
-        app.apply_prefs(&ctx);
-        assert_eq!(app.ui.theme, ThemeKind::Dark);
-        // A fixed mode ignores the system.
-        *system.lock().unwrap() = Some(egui::Theme::Light);
-        app.set_pref("appearance.appearanceMode", json!("dark")).unwrap();
-        app.apply_prefs(&ctx);
-        assert_eq!(app.ui.theme, ThemeKind::Dark);
-    }
-
-    /// Sync with System leaves egui's theme preference at System, so egui never gives the native
-    /// window an appearance of its own (on macOS that stops system appearance changes reaching
-    /// the app, #642); egui's light and dark styles both carry the resolved theme. Fixed modes
-    /// pin the window to their family.
-    #[test]
-    fn auto_mode_leaves_the_native_window_following_the_system() {
-        let ctx = egui::Context::default();
-        let mut app = app();
-        app.hooks.system_theme = Some(Box::new(|_| Some(egui::Theme::Light)));
-        app.set_pref("appearance.appearanceMode", json!("auto")).unwrap();
-        app.apply_prefs(&ctx);
-        assert_eq!(app.ui.theme, ThemeKind::Light);
-        assert_eq!(ctx.options(|o| o.theme_preference), egui::ThemePreference::System);
-        for theme in [egui::Theme::Light, egui::Theme::Dark] {
-            assert_eq!(ctx.style_of(theme).visuals.panel_fill, app.tokens.panel_bg, "{theme:?}");
-        }
-        // egui asks the window to follow the system, never to take Light or Dark.
-        let mut out = ctx.run_ui(egui::RawInput::default(), |_| {});
-        out.textures_delta.clear();
-        let cmds = out.viewport_output.values().flat_map(|v| v.commands.iter()).collect::<Vec<_>>();
-        assert!(!cmds.iter().any(|c| matches!(c, egui::ViewportCommand::SetTheme(t) if t != &egui::SystemTheme::SystemDefault)), "{cmds:?}");
-        for (mode, pref) in [("light", egui::ThemePreference::Light), ("dark", egui::ThemePreference::Dark)] {
-            app.set_pref("appearance.appearanceMode", json!(mode)).unwrap();
-            app.apply_prefs(&ctx);
-            assert_eq!(ctx.options(|o| o.theme_preference), pref, "{mode}");
-            assert_eq!(ctx.global_style().visuals.panel_fill, app.tokens.panel_bg, "{mode}");
-        }
-    }
-
-    /// Picking a theme (`view.theme.*`, `ui.set {theme}`) fixes the mode to its family.
-    #[test]
-    fn picking_a_theme_fixes_its_mode() {
-        let ctx = egui::Context::default();
-        let mut app = app();
-        app.set_pref("appearance.appearanceMode", json!("auto")).unwrap();
-        menus::invoke(&mut app, &ctx, "view.theme.light", json!({})).unwrap();
-        assert_eq!(app.session.prefs.appearance.appearance_mode, "light");
-        assert_eq!(app.ui.theme, ThemeKind::Light);
-        menus::invoke(&mut app, &ctx, "view.theme.darker", json!({})).unwrap();
-        assert_eq!(app.session.prefs.appearance.appearance_mode, "dark");
-        assert_eq!(app.session.prefs.appearance.dark_theme, "darker");
-        assert_eq!(app.ui.theme, ThemeKind::Darker);
-    }
-}
+mod lifecycle_tests;
diff --git a/crates/ui-egui/src/lifecycle_tests.rs b/crates/ui-egui/src/lifecycle_tests.rs
new file mode 100644
index 000000000..6c9eb85d2
--- /dev/null
+++ b/crates/ui-egui/src/lifecycle_tests.rs
@@ -0,0 +1,509 @@
+//! The logic-only / UI-pass split: queue work in `tick`, input, layout and setup in `draw`.
+//!
+//! The driver mirrors eframe's order for a hidden window: `raw_input_hook` prepares the raw
+//! input, a logic-only iteration runs `tick`, and a forced pass runs `draw` with the same
+//! prepared input. Nothing may depend on `current_pass_index`, which is zero in both.
+
+use super::*;
+use effectcraft_engine::config::{ConfigStore, MemoryConfig};
+
+fn app_with_comp() -> EffectcraftApp {
+    let mut session = Session::default();
+    session.execute("comp.new", json!({"name": "Lifecycle", "width": 64, "height": 36, "duration": 1})).unwrap();
+    session.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    let mut app = EffectcraftApp::new(session);
+    app.ui.start_screen = false;
+    app.ui.show_menu_bar = false;
+    app.use_manual_clock();
+    app
+}
+
+fn raw(size: egui::Vec2) -> egui::RawInput {
+    egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, size)), ..Default::default() }
+}
+
+fn tick_with(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame, raw: &egui::RawInput) -> egui::LogicOutput {
+    ctx.run_logic(raw, |ctx| app.tick(ctx, frame))
+}
+
+fn hidden_tick(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame) {
+    let _ = tick_with(app, ctx, frame, &raw(egui::vec2(800.0, 480.0)));
+}
+
+/// One host iteration that ends in a UI pass (the forced hidden pass, or a visible frame).
+fn pass(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame, raw: &mut egui::RawInput) -> egui::FullOutput {
+    eframe::App::raw_input_hook(app, ctx, raw);
+    let mut out = ctx.run_ui(raw.take(), |ui| app.draw(ui, frame));
+    out.textures_delta.clear();
+    out
+}
+
+fn ready(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame) -> DrawGeometry {
+    // The first pass installs the fonts, the second draws with them.
+    for _ in 0..3 {
+        let mut raw = raw(egui::vec2(800.0, 480.0));
+        pass(app, ctx, frame, &mut raw);
+    }
+    assert!(app.is_ready(), "fonts are ready after the warm-up passes");
+    app.draw_geometry().expect("a completed pass records its geometry")
+}
+
+fn send(app: &mut EffectcraftApp, method: &str, params: serde_json::Value) -> std::sync::mpsc::Receiver<serde_json::Value> {
+    let (request, reply) = ControlRequest::new(method, params);
+    let (tx, rx) = std::sync::mpsc::channel();
+    tx.send(request).unwrap();
+    app.control_rx = Some(rx);
+    reply
+}
+
+#[test]
+fn a_logic_only_tick_installs_no_fonts_and_records_no_geometry() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    hidden_tick(&mut app, &ctx, &frame);
+    assert!(!app.is_ready(), "fonts need a real pass, not a logic-only tick");
+    assert!(app.draw_geometry().is_none(), "a logic-only tick is not a frame");
+    assert_eq!(app.ui_passes(), 0);
+}
+
+#[test]
+fn a_control_command_that_needs_no_ui_completes_without_a_pass() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    let reply = send(&mut app, "engine.execute", json!({"command": "comp.new", "params": {"name": "Queued", "width": 32, "height": 18, "duration": 1}}));
+    hidden_tick(&mut app, &ctx, &frame);
+    let value = reply.try_recv().expect("a command that needs no UI is answered by the tick");
+    assert_eq!(value["ok"], true, "{value}");
+    assert_eq!(app.ui_passes(), 0);
+}
+
+#[test]
+fn a_pass_that_cannot_draw_receives_no_synthetic_input() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    assert!(!app.is_ready(), "a fresh app installs its fonts in its first pass");
+    let reply = send(&mut app, "ui.click", json!({"x": 40, "y": 40}));
+    hidden_tick(&mut app, &ctx, &frame);
+    assert!(reply.try_recv().is_err(), "a click is not answered before its UI pass");
+    // The font-install pass cannot draw. It must not receive the click: `run_ui` applies what
+    // the hook feeds, and a batch cannot be put back without applying its pointer state twice.
+    let mut setup = raw(egui::vec2(800.0, 480.0));
+    eframe::App::raw_input_hook(&mut app, &ctx, &mut setup);
+    assert!(setup.events.is_empty(), "a pass that cannot draw gets no synthetic input");
+    assert_eq!(app.synthetic.len(), 5, "the whole gesture still waits for a drawing pass");
+    assert!(app.pending_synthetic_events().is_empty());
+    let mut setup_pass = ctx.run_ui(setup.take(), |ui| app.draw(ui, &frame));
+    setup_pass.textures_delta.clear();
+    assert!(!app.is_ready(), "the pass that installs the fonts draws nothing");
+    // Once fonts are ready the click reaches the UI exactly once, one event per pass.
+    let mut passes = 0;
+    while reply.try_recv().is_err() {
+        passes += 1;
+        assert!(passes < 40, "the click must be applied within a few passes");
+        let mut raw = raw(egui::vec2(800.0, 480.0));
+        pass(&mut app, &ctx, &frame, &mut raw);
+    }
+    assert!(reply.try_recv().is_err(), "the reply is sent once");
+    assert!(app.pending_synthetic_events().is_empty());
+    assert!(app.synthetic.is_empty(), "every event was applied once");
+}
+
+#[test]
+fn one_pending_synthetic_batch_is_never_duplicated_while_hidden() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    let reply = send(&mut app, "ui.click", json!({"x": 40, "y": 40}));
+    hidden_tick(&mut app, &ctx, &frame);
+    assert!(reply.try_recv().is_err(), "a click is not answered before its UI pass");
+    // Several hidden host iterations: eframe keeps the first prepared input; only its one
+    // event may reach the raw input, and a later hook must not add another.
+    let mut first = raw(egui::vec2(800.0, 480.0));
+    eframe::App::raw_input_hook(&mut app, &ctx, &mut first);
+    assert_eq!(first.events.len(), 1, "the first event of the gesture is fed");
+    let mut second = raw(egui::vec2(800.0, 480.0));
+    eframe::App::raw_input_hook(&mut app, &ctx, &mut second);
+    assert!(second.events.is_empty(), "an unapplied batch blocks the next event");
+    assert_eq!(app.pending_synthetic_events().len(), 1);
+    // The pass that applies the batch acknowledges it once; it is never fed again.
+    pass(&mut app, &ctx, &frame, &mut first);
+    assert!(app.pending_synthetic_events().is_empty());
+    // Drive real passes until the gesture is applied: exactly one reply, no lost events.
+    let mut passes = 0;
+    while reply.try_recv().is_err() {
+        passes += 1;
+        assert!(passes < 40, "the click must be applied within a few passes");
+        let mut raw = raw(egui::vec2(800.0, 480.0));
+        pass(&mut app, &ctx, &frame, &mut raw);
+    }
+    assert!(app.pending_synthetic_events().is_empty());
+    assert!(app.synthetic.is_empty());
+    assert!(reply.try_recv().is_err(), "the reply is sent once");
+}
+
+#[test]
+fn geometry_epoch_tracks_size_and_scale_but_not_window_position() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    let first = ready(&mut app, &ctx, &frame);
+    let mut moved = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::pos2(120.0, 80.0), first.rect.size())), ..Default::default() };
+    pass(&mut app, &ctx, &frame, &mut moved);
+    assert_eq!(app.draw_geometry().unwrap().epoch, first.epoch, "moving the window does not change a capture");
+    let mut resized = raw(egui::vec2(1024.0, 640.0));
+    pass(&mut app, &ctx, &frame, &mut resized);
+    let after_resize = app.draw_geometry().unwrap();
+    assert!(after_resize.epoch > first.epoch, "a resize advances the epoch");
+    let mut back = raw(egui::vec2(800.0, 480.0));
+    pass(&mut app, &ctx, &frame, &mut back);
+    assert!(app.draw_geometry().unwrap().epoch > after_resize.epoch, "changing back is another change, not the old epoch");
+}
+
+#[test]
+fn only_a_viewer_that_draws_records_a_prefetch_scale() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    assert!(app.last_viewer_scale.is_some(), "the visible viewer recorded the scale it drew at");
+    // The Home screen draws no viewer: the old comp's scale must not keep idle prefetch alive.
+    app.ui.start_screen = true;
+    let mut input = raw(egui::vec2(800.0, 480.0));
+    pass(&mut app, &ctx, &frame, &mut input);
+    assert!(app.last_viewer_scale.is_none(), "no viewer drew, so there is no scale to prefetch at");
+    // Back to the comp: the next pass records it again.
+    app.ui.start_screen = false;
+    let mut input = raw(egui::vec2(800.0, 480.0));
+    pass(&mut app, &ctx, &frame, &mut input);
+    assert!(app.last_viewer_scale.is_some());
+}
+
+#[test]
+fn playback_advances_on_a_logic_only_tick() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    app.playback.playing = true;
+    app.playback.plan = Some(effectcraft_engine::preview::PreviewPlan {
+        start: 1,
+        end: 1,
+        first: 1,
+        step: 1,
+        fps: 24.0,
+        looping: false,
+        cache_first: false,
+        video: false,
+        audio: false,
+        origin: Tick::ZERO,
+    });
+    app.playback.start_wall = 0.0;
+    app.playback.start_frame = 1;
+    app.clock_mut().advance(1.0);
+    hidden_tick(&mut app, &ctx, &frame);
+    assert!(!app.playback.playing, "a one-frame preview ends without any UI pass");
+    assert_eq!(app.playback.audio_frame, Some(1), "the audio-only playhead reached the plan's end");
+    assert_eq!(app.ui_passes(), 0);
+}
+
+#[test]
+fn workspace_layout_autosave_writes_on_a_hidden_tick() {
+    let store = Arc::new(MemoryConfig::default());
+    let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
+    app.ui.start_screen = false;
+    app.use_manual_clock();
+    app.ui.focused = PanelKind::Timeline;
+    app.clock_mut().advance(2.0);
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    hidden_tick(&mut app, &ctx, &frame);
+    assert!(store.read(WORKSPACES_FILE).is_some(), "the layout is saved while the window is hidden");
+    assert_eq!(app.ui_passes(), 0);
+}
+
+#[test]
+fn the_close_guard_answers_a_close_request_without_a_pass() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    assert!(app.session.is_dirty(), "creating a comp and a layer leaves unsaved changes");
+    let mut raw = raw(egui::vec2(800.0, 480.0));
+    raw.viewports.insert(egui::ViewportId::ROOT, egui::ViewportInfo { events: vec![egui::ViewportEvent::Close], ..Default::default() });
+    let out = tick_with(&mut app, &ctx, &frame, &raw);
+    assert!(app.dialog.is_some(), "a hidden close request opens the unsaved-changes prompt");
+    let cancel = out.viewport_commands.values().flatten().any(|c| matches!(c, egui::ViewportCommand::CancelClose));
+    assert!(cancel, "the window stays open while the prompt is asking");
+    assert_eq!(app.ui_passes(), 0);
+}
+
+// ---------------------------------------------------------------- screenshots
+
+fn screenshot_request(app: &mut EffectcraftApp, ctx: &egui::Context, path: Option<&str>, target: ShotTarget) -> std::sync::mpsc::Receiver<serde_json::Value> {
+    let (tx, rx) = std::sync::mpsc::channel();
+    app.admit_screenshot(ctx, path.map(str::to_string), target, tx);
+    rx
+}
+
+fn shot_callbacks(out: &egui::LogicOutput) -> Vec<egui::ScreenshotCallback> {
+    out.viewport_commands
+        .values()
+        .flatten()
+        .filter_map(|c| match c {
+            egui::ViewportCommand::Screenshot(cb) => Some(cb.clone()),
+            _ => None,
+        })
+        .collect()
+}
+
+/// Three settled passes and the settle delay, then the tick that issues the capture.
+fn issue_shot(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame) -> egui::ScreenshotCallback {
+    issue_shot_at(app, ctx, frame, egui::vec2(800.0, 480.0))
+}
+
+fn issue_shot_at(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame, size: egui::Vec2) -> egui::ScreenshotCallback {
+    for _ in 0..SCREENSHOT_SETTLE_PASSES {
+        let mut raw = raw(size);
+        pass(app, ctx, frame, &mut raw);
+    }
+    app.clock_mut().advance(SCREENSHOT_SETTLE_S + 0.01);
+    let out = tick_with(app, ctx, frame, &raw(size));
+    let cbs = shot_callbacks(&out);
+    assert_eq!(cbs.len(), 1, "one settled screenshot is issued once");
+    cbs.into_iter().next().unwrap()
+}
+
+fn image(width: usize, height: usize) -> Arc<egui::ColorImage> {
+    Arc::new(egui::ColorImage::new([width, height], vec![egui::Color32::from_rgb(10, 20, 30); width.checked_mul(height).unwrap()]))
+}
+
+#[test]
+fn a_screenshot_is_issued_only_after_settled_passes_and_writes_from_the_tick() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    let path = std::env::temp_dir().join(format!("effectcraft-shot-{}-ok.png", std::process::id()));
+    let _ = std::fs::remove_file(&path);
+    let reply = screenshot_request(&mut app, &ctx, path.to_str(), ShotTarget::Window);
+    // Not settled: a tick issues nothing and asks for passes instead.
+    let out = tick_with(&mut app, &ctx, &frame, &raw(egui::vec2(800.0, 480.0)));
+    assert!(shot_callbacks(&out).is_empty(), "no capture before the UI settles");
+    assert_eq!(out.viewport_commands.values().flatten().filter(|c| matches!(c, egui::ViewportCommand::RequestPaintWhileHidden)).count(), 1);
+    let cb = issue_shot(&mut app, &ctx, &frame);
+    assert!(reply.try_recv().is_err(), "the callback must not write or reply itself");
+    cb.complete(image(800, 480));
+    hidden_tick(&mut app, &ctx, &frame);
+    let value = reply.try_recv().expect("the tick drains the completed slot and replies");
+    assert_eq!(value["ok"], true, "{value}");
+    assert!(path.exists(), "{value}");
+    assert_eq!(value["result"]["width"], 800);
+    assert_eq!(value["result"]["height"], 480);
+    assert_eq!(app.shot_bytes, 0, "the reservation is released");
+    let _ = std::fs::remove_file(&path);
+}
+
+#[test]
+fn a_resize_between_issue_and_completion_rejects_the_pixels_and_retries() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    let path = std::env::temp_dir().join(format!("effectcraft-shot-{}-retry.png", std::process::id()));
+    let _ = std::fs::remove_file(&path);
+    let reply = screenshot_request(&mut app, &ctx, path.to_str(), ShotTarget::Window);
+    let first = issue_shot(&mut app, &ctx, &frame);
+    let size = egui::vec2(1024.0, 640.0);
+    let mut resized = raw(size);
+    pass(&mut app, &ctx, &frame, &mut resized);
+    first.complete(image(800, 480));
+    let _ = tick_with(&mut app, &ctx, &frame, &raw(size));
+    assert!(reply.try_recv().is_err(), "pixels from the old surface epoch are discarded");
+    assert!(!path.exists(), "a stale image is never written");
+    // The retry is issued against the new geometry and the new image is accepted.
+    let second = issue_shot_at(&mut app, &ctx, &frame, size);
+    second.complete(image(1024, 640));
+    let _ = tick_with(&mut app, &ctx, &frame, &raw(size));
+    let value = reply.try_recv().expect("the retried capture replies");
+    assert_eq!(value["ok"], true, "{value}");
+    assert_eq!(value["result"]["width"], 1024);
+    let _ = std::fs::remove_file(&path);
+}
+
+#[test]
+fn screenshot_admission_bounds_requests_and_a_timeout_releases_its_reservation() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    let mut replies = Vec::new();
+    for _ in 0..MAX_PENDING_SHOTS {
+        replies.push(screenshot_request(&mut app, &ctx, None, ShotTarget::Rect([0.0, 0.0, 4.0, 4.0])));
+    }
+    let refused = screenshot_request(&mut app, &ctx, None, ShotTarget::Rect([0.0, 0.0, 4.0, 4.0]));
+    let value = refused.try_recv().expect("the fifth request is refused immediately");
+    assert_eq!(value["ok"], false, "{value}");
+    // Every queued request times out on a hidden window that presents no frame; each one
+    // releases its reservation exactly once.
+    app.clock_mut().advance(SCREENSHOT_TIMEOUT_S + 1.0);
+    hidden_tick(&mut app, &ctx, &frame);
+    for reply in replies {
+        let value = reply.try_recv().expect("a timed-out request gets an actionable reply");
+        assert_eq!(value["ok"], false, "{value}");
+        assert!(value["error"].as_str().is_some_and(|e| e.contains("no frame")), "{value}");
+    }
+    assert_eq!(app.shot_bytes, 0);
+    assert!(app.pending_screenshots.is_empty());
+}
+
+#[test]
+fn a_late_callback_after_cancellation_writes_nothing_and_replies_once() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    let path = std::env::temp_dir().join(format!("effectcraft-shot-{}-late.png", std::process::id()));
+    let _ = std::fs::remove_file(&path);
+    let reply = screenshot_request(&mut app, &ctx, path.to_str(), ShotTarget::Window);
+    let late = issue_shot(&mut app, &ctx, &frame);
+    app.clock_mut().advance(SCREENSHOT_TIMEOUT_S + 1.0);
+    hidden_tick(&mut app, &ctx, &frame);
+    let timeout = reply.try_recv().expect("the request times out");
+    assert_eq!(timeout["ok"], false, "{timeout}");
+    late.complete(image(800, 480));
+    hidden_tick(&mut app, &ctx, &frame);
+    assert!(reply.try_recv().is_err(), "a late completion sends no second reply");
+    assert!(!path.exists(), "a late completion writes no file");
+    assert_eq!(app.shot_bytes, 0);
+}
+
+/// Every repaint delay requested on `ctx` (what a host uses to wake the app).
+fn wake_requests(ctx: &egui::Context) -> Arc<std::sync::Mutex<Vec<std::time::Duration>>> {
+    let wakes: Arc<std::sync::Mutex<Vec<std::time::Duration>>> = Arc::default();
+    let record = Arc::clone(&wakes);
+    ctx.set_repaint_observer(move |i| record.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(i.delay));
+    wakes
+}
+
+#[test]
+fn an_issued_capture_schedules_a_wake_up_for_its_deadline() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    ready(&mut app, &ctx, &frame);
+    let reply = screenshot_request(&mut app, &ctx, None, ShotTarget::Window);
+    for _ in 0..SCREENSHOT_SETTLE_PASSES {
+        let mut raw = raw(egui::vec2(800.0, 480.0));
+        pass(&mut app, &ctx, &frame, &mut raw);
+    }
+    app.clock_mut().advance(SCREENSHOT_SETTLE_S + 0.01);
+    // Record the repaint requests of the tick that issues the capture only.
+    let wakes = wake_requests(&ctx);
+    let out = tick_with(&mut app, &ctx, &frame, &raw(egui::vec2(800.0, 480.0)));
+    assert_eq!(shot_callbacks(&out).len(), 1, "the settled capture is issued once");
+    let delays = wakes.lock().unwrap_or_else(std::sync::PoisonError::into_inner).clone();
+    // The deadline is 8 s after admission; the capture was issued ~0.31 s in, so the app must
+    // ask for a wake-up close to that timeout, not only for the next paint.
+    let deadline_wake = delays.iter().any(|d| d.as_secs_f64() > 7.0 && d.as_secs_f64() <= SCREENSHOT_TIMEOUT_S);
+    assert!(deadline_wake, "an issued capture asks the host to wake for its timeout: {delays:?}");
+    // The callback never arrives (a hidden window or a display asleep). The host wakes at the
+    // requested delay; without this wake-up the timeout below could never be evaluated.
+    app.clock_mut().advance(SCREENSHOT_TIMEOUT_S + 1.0);
+    hidden_tick(&mut app, &ctx, &frame);
+    let value = reply.try_recv().expect("the deadline wake-up produces the timeout reply");
+    assert_eq!(value["ok"], false, "{value}");
+    assert!(value["error"].as_str().is_some_and(|e| e.contains("no frame")), "{value}");
+    assert_eq!(app.shot_bytes, 0);
+    assert!(app.pending_screenshots.is_empty());
+}
+
+#[test]
+fn a_downscaled_capture_is_cropped_with_the_images_own_scale() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    let geom = ready(&mut app, &ctx, &frame);
+    assert_eq!((geom.rect.width(), geom.rect.height(), geom.ppp), (800.0, 480.0, 1.0));
+    // The adapter-limit fit (E2) returned half the requested pixels. Left red, right blue.
+    let fitted =
+        Arc::new(egui::ColorImage::new([400, 240], (0..400 * 240).map(|i| if i % 400 < 200 { egui::Color32::RED } else { egui::Color32::BLUE }).collect()));
+    let dir = std::env::temp_dir();
+    for (name, crop, want) in [("left", [0.0, 0.0, 400.0, 240.0], egui::Color32::RED), ("right", [400.0, 0.0, 400.0, 240.0], egui::Color32::BLUE)] {
+        let path = dir.join(format!("effectcraft-shot-{}-scale-{name}.png", std::process::id()));
+        let _ = std::fs::remove_file(&path);
+        let reply = screenshot_request(&mut app, &ctx, path.to_str(), ShotTarget::Rect(crop));
+        let cb = issue_shot(&mut app, &ctx, &frame);
+        cb.complete(Arc::clone(&fitted));
+        hidden_tick(&mut app, &ctx, &frame);
+        let value = reply.try_recv().expect("the downscaled capture replies");
+        assert_eq!(value["ok"], true, "{value}");
+        assert_eq!(value["result"]["width"], 200, "{value}");
+        assert_eq!(value["result"]["height"], 120, "{value}");
+        let png = std::fs::read(&path).expect("the PNG is written");
+        let decoded = image::load_from_memory(&png).expect("our PNG decodes").to_rgba8();
+        assert_eq!((decoded.width(), decoded.height()), (200, 120), "{value}");
+        let px = decoded.get_pixel(100, 60).0;
+        assert!(px[0] == want.r() && px[1] == want.g() && px[2] == want.b(), "{name}: {px:?} is not from its half of the fitted image");
+        let _ = std::fs::remove_file(&path);
+    }
+}
+
+#[test]
+fn a_capture_before_any_pass_never_uses_the_window_frame_rect() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    // Only the outer (title bar included) rectangle is known: it is not the captured surface.
+    let outer = egui::Rect::from_min_size(egui::pos2(0.0, -30.0), egui::vec2(800.0, 510.0));
+    let mut raw = egui::RawInput::default();
+    raw.viewports.insert(egui::ViewportId::ROOT, egui::ViewportInfo { outer_rect: Some(outer), ..Default::default() });
+    let _ = tick_with(&mut app, &ctx, &frame, &raw);
+    let (tx, reply) = std::sync::mpsc::channel();
+    app.admit_screenshot(&ctx, None, ShotTarget::Window, tx);
+    let value = reply.try_recv().expect("the request is answered now");
+    assert_eq!(value["ok"], false, "{value}");
+    assert!(value["error"].as_str().is_some_and(|e| e.contains("geometry is not known")), "{value}");
+    assert!(app.pending_screenshots.is_empty(), "nothing was reserved against the wrong rectangle");
+    assert_eq!(app.shot_bytes, 0);
+    assert!(app.want_paint, "the pass that records the geometry is requested");
+}
+
+#[test]
+fn an_element_that_moves_while_the_ui_settles_is_captured_where_it_is() {
+    let ctx = egui::Context::default();
+    let frame = eframe::Frame::_new_kittest();
+    let mut app = app_with_comp();
+    let geom = ready(&mut app, &ctx, &frame);
+    // Any registered panel: the crop follows this element's rectangle.
+    let panel = app.auto.previous.iter().chain(app.auto.elements.iter()).find(|e| e.id.starts_with("panel.")).map(|e| e.id.clone());
+    let panel = panel.expect("a dock panel is on screen after a completed pass");
+    let reply = screenshot_request(&mut app, &ctx, None, ShotTarget::Id(panel.clone()));
+    for _ in 0..SCREENSHOT_SETTLE_PASSES {
+        let mut raw = raw(egui::vec2(800.0, 480.0));
+        pass(&mut app, &ctx, &frame, &mut raw);
+    }
+    // The panel moves after its last draw: the crop must follow it, not the admission rect.
+    let moved = [40.0, 30.0, 300.0, 200.0];
+    for list in [&mut app.auto.previous, &mut app.auto.elements] {
+        if let Some(e) = list.iter_mut().find(|e| e.id == panel) {
+            e.rect = moved;
+        }
+    }
+    app.clock_mut().advance(SCREENSHOT_SETTLE_S + 0.01);
+    let out = tick_with(&mut app, &ctx, &frame, &raw(egui::vec2(800.0, 480.0)));
+    assert_eq!(shot_callbacks(&out).len(), 1, "the settled capture is issued once");
+    let crop = app.pending_screenshots.first().and_then(|s| s.crop).expect("the element crop is resolved at issuance");
+    assert!((crop[0] - (moved[0] - geom.rect.min.x)).abs() < 0.01, "{crop:?}");
+    assert!((crop[1] - (moved[1] - geom.rect.min.y)).abs() < 0.01, "{crop:?}");
+    assert!((crop[2] - moved[2]).abs() < 0.01 && (crop[3] - moved[3]).abs() < 0.01, "{crop:?}");
+    // Let it complete and reply, so the request does not outlive the test.
+    if let Some(cb) = shot_callbacks(&out).into_iter().next() {
+        cb.complete(image(800, 480));
+    }
+    hidden_tick(&mut app, &ctx, &frame);
+    let value = reply.try_recv().expect("the capture replies");
+    assert_eq!(value["ok"], true, "{value}");
+    assert_eq!((value["result"]["width"].as_u64(), value["result"]["height"].as_u64()), (Some(300), Some(200)), "{value}");
+}
diff --git a/crates/ui-egui/src/menu_keys.rs b/crates/ui-egui/src/menu_keys.rs
index 397385309..49d07301c 100644
--- a/crates/ui-egui/src/menu_keys.rs
+++ b/crates/ui-egui/src/menu_keys.rs
@@ -10,7 +10,7 @@
 //! shortcuts and the panels don't see them (Space must not start a preview).
 
 use egui::containers::menu::{MenuState, SubMenu, find_menu_root};
-use egui::{Context, Event, Id, Key, Modifiers, Popup, Pos2, Response, Ui};
+use egui::{Context, Event, Id, Key, Modifiers, Popup, Pos2, Rect, Response, Ui};
 
 /// An entry of an open menu as drawn this frame.
 #[derive(Clone, Copy)]
@@ -39,6 +39,12 @@ pub struct Nav {
     tops: Vec<(Id, Id)>,
     /// Open menus by depth: the top-level menu, then each open submenu.
     levels: Vec<Level>,
+    /// The titles and open menus drawn this frame: a press outside them is an outside press,
+    /// which closes the menu (native behaviour; the press itself still reaches what's under it).
+    rects: Vec<Rect>,
+    /// A title press opened (or kept) the menu this frame: releasing the button over an entry
+    /// chooses it (After Effects' press-and-browse).
+    browsing: bool,
 }
 
 /// What to highlight once a menu opened from the keyboard has been drawn: the first entry of the
@@ -54,17 +60,26 @@ struct KeyOpened {
     pointer: Option<Pos2>,
 }
 
+/// The temp-data id of the [`FirstEntry`] depth to highlight after a keyboard-opened menu is
+/// first drawn.
 fn pending_id() -> Id {
-    Id::new("menu-keys-first")
+    Id::unique("menu-keys-first")
 }
+
+/// The temp-data id of the [`KeyOpened`] record: submenus opened from the keyboard and the
+/// pointer position they were opened at.
 fn opened_id() -> Id {
-    Id::new("menu-keys-opened")
+    Id::unique("menu-keys-opened")
 }
+
+/// The temp-data id of the flag saying the menu bar currently holds the keyboard.
 fn active_id() -> Id {
-    Id::new("menu-keys-active")
+    Id::unique("menu-keys-active")
 }
+
+/// The temp-data id of the `(armed, held)` Alt-key state used to detect an Alt tap.
 fn alt_id() -> Id {
-    Id::new("menu-keys-alt")
+    Id::unique("menu-keys-alt")
 }
 
 impl Nav {
@@ -73,6 +88,37 @@ impl Nav {
         self.tops.push((button.id, Popup::default_response_id(button)));
     }
 
+    /// The rect `rect` (a menu title or an open menu) holds, so a press there doesn't close.
+    pub fn cover(&mut self, rect: Rect) {
+        self.rects.push(rect);
+    }
+
+    /// Whether `pos` is inside a title or menu drawn this frame.
+    pub fn covers(&self, pos: Pos2) -> bool {
+        self.rects.iter().any(|r| r.contains(pos))
+    }
+
+    /// A title press is in progress (its button still held): see [`Nav::browsing`].
+    pub fn set_browsing(&mut self) {
+        self.browsing = true;
+    }
+
+    /// Whether the menu bar is mid press-and-browse (a title was pressed this pointer-down and
+    /// hasn't been released yet): releasing over an entry then chooses it.
+    pub fn browsing(&self) -> bool {
+        self.browsing
+    }
+
+    /// The popup of the open top-level menu (only one can be open), if any.
+    pub fn open_popup(&self, ctx: &Context) -> Option<Id> {
+        self.tops.iter().find(|(_, p)| Popup::is_id_open(ctx, *p)).map(|(_, p)| *p)
+    }
+
+    /// The position in the bar of the open top-level menu, if any.
+    pub fn open_index(&self, ctx: &Context) -> Option<usize> {
+        self.tops.iter().position(|(_, p)| Popup::is_id_open(ctx, *p))
+    }
+
     /// An entry drawn at `depth` (0: a top-level menu) in the menu `ui`. Hovering an entry moves
     /// the keyboard highlight to it, and a highlighted entry scrolls into view.
     pub fn entry(&mut self, ui: &Ui, depth: usize, r: &Response, submenu: bool) {
@@ -81,7 +127,7 @@ impl Nav {
         }
         let Some(level) = self.levels.get_mut(depth) else { return };
         if level.menu.is_none() {
-            level.menu = Some(find_menu_root(ui).id);
+            level.menu = Some(find_menu_root(ui).scope_id);
             level.sizing = ui.is_sizing_pass();
         }
         level.rows.push(Row { id: r.id, enabled: r.enabled(), submenu });
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index 92893dcb6..cb28b0bcd 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -8,10 +8,31 @@
 use serde_json::{Value, json};
 
 use crate::EffectcraftApp;
-use crate::dock::PanelKind;
+use crate::dock::{PanelKind, WorkspaceExt as _};
 use crate::state::{Resolution, Tool};
 use effectcraft_engine::menus::{MenuEntry, MenuNode};
 
+mod bar;
+mod commands;
+mod entries;
+mod frontend;
+mod invoke;
+mod shortcuts;
+
+pub use bar::menu_bar;
+pub(crate) use bar::{dyn_ctx, entry_for, menu_contents, submenu_at};
+pub use commands::UI_COMMANDS;
+pub use entries::{MenuItem, menu_items, menus};
+pub(crate) use entries::{entry_checked, entry_enabled, entry_label, entry_shortcut, menu_choice, panel_shown};
+pub use frontend::frontend;
+#[cfg(test)]
+use frontend::zoom_step;
+pub(crate) use frontend::{dialog_answered, run_engine};
+pub use invoke::{invoke, panel_command_id, reveal};
+#[cfg(test)]
+use shortcuts::modifiers_at_start;
+pub use shortcuts::{Binding, bindings, chord_matches, forwardable_during_text_edit, handle_shortcuts, handle_tab_shortcut, parse_shortcut, shortcut_text};
+
 pub struct UiCommand {
     pub id: &'static str,
     pub label: &'static str,
@@ -19,2551 +40,5 @@ pub struct UiCommand {
     pub shortcut: Option<&'static str>,
 }
 
-macro_rules! uic {
-    ($id:literal, $label:literal, [$($m:literal),*], $sc:expr) => {
-        UiCommand { id: $id, label: $label, menu: &[$($m),*], shortcut: $sc }
-    };
-}
-
-/// UI-only commands (not in the AE menus; shortcuts and the command palette).
-pub const UI_COMMANDS: &[UiCommand] = &[
-    uic!("window.dockAction", "Docking Action", [], None),
-    uic!("playback.ramPreview", "Preview (Numpad 0)", [], Some("Num0")),
-    uic!("playback.preview.shiftSpacebar", "Preview (Shift+Spacebar)", [], Some("Shift+Space")),
-    uic!("playback.preview.shiftNumpad0", "Preview (Shift+Numpad 0)", [], Some("Shift+Num0")),
-    uic!("playback.preview.altNumpad0", "Preview (Alt+Numpad 0)", [], Some("Alt+Num0")),
-    uic!("playback.stop", "Stop", [], None),
-    uic!("view.fit", "Fit", [], Some("Shift+/")),
-    uic!("view.actualSize", "100%", [], Some("/")),
-    uic!("view.fitUpTo100", "Fit up to 100%", [], Some("Alt+/")),
-    uic!("view.nextItem", "Next Composition in Viewer", [], Some("Shift+.")),
-    uic!("view.previousItem", "Previous Composition in Viewer", [], Some("Shift+,")),
-    uic!("viewer.nudge.up", "Move Selected Layers Up 1 Pixel at Current Magnification", [], Some("ArrowUp")),
-    uic!("viewer.nudge.down", "Move Selected Layers Down 1 Pixel at Current Magnification", [], Some("ArrowDown")),
-    uic!("viewer.nudge.left", "Move Selected Layers Left 1 Pixel at Current Magnification", [], Some("ArrowLeft")),
-    uic!("viewer.nudge.right", "Move Selected Layers Right 1 Pixel at Current Magnification", [], Some("ArrowRight")),
-    uic!("viewer.nudge.up10", "Move Selected Layers Up 10 Pixels at Current Magnification", [], Some("Shift+ArrowUp")),
-    uic!("viewer.nudge.down10", "Move Selected Layers Down 10 Pixels at Current Magnification", [], Some("Shift+ArrowDown")),
-    uic!("viewer.nudge.left10", "Move Selected Layers Left 10 Pixels at Current Magnification", [], Some("Shift+ArrowLeft")),
-    uic!("viewer.nudge.right10", "Move Selected Layers Right 10 Pixels at Current Magnification", [], Some("Shift+ArrowRight")),
-    uic!("view.safeMargins", "Title/Action Safe", [], Some("'")),
-    uic!("view.transparencyGrid", "Transparency Grid", [], None),
-    uic!("view.fastPreviews", "Fast Previews", [], None),
-    uic!("view.theme.toggle", "Next Appearance Mode", [], None),
-    uic!("view.theme.dark", "Theme: Dark", [], None),
-    uic!("view.theme.darker", "Theme: Darker", [], None),
-    uic!("view.theme.light", "Theme: Light", [], None),
-    uic!("timeline.zoomIn", "Zoom In Time", [], Some("=")),
-    uic!("timeline.zoomOut", "Zoom Out Time", [], Some("-")),
-    uic!("timeline.zoomFit", "Zoom to Fit Comp", [], Some("Shift+;")),
-    uic!("timeline.scrollToTime", "Scroll to Current Time", [], Some("D")),
-    uic!("timeline.scrollToLayer", "Scroll Topmost Selected Layer to Top", [], Some("X")),
-    uic!("timeline.parentColumn", "Show/Hide Parent Column", [], Some("Shift+F4")),
-    uic!("timeline.zoomFrameToggle", "Zoom In to Frame Level / Out to the Whole Comp", [], Some(";")),
-    uic!("timeline.graphEditor", "Graph Editor", [], Some("Shift+F3")),
-    uic!("timeline.switchesModes", "Toggle Switches / Modes", [], Some("F4")),
-    uic!("timeline.workAreaBegin", "Set Work Area Begin", [], Some("B")),
-    uic!("timeline.workAreaEnd", "Set Work Area End", [], Some("N")),
-    uic!("timeline.moveInToTime", "Move Layer In Point to Current Time", [], Some("[")),
-    uic!("timeline.moveOutToTime", "Move Layer Out Point to Current Time", [], Some("]")),
-    uic!("timeline.trimInToTime", "Trim Layer In Point to Current Time", [], Some("Alt+[")),
-    uic!("timeline.trimOutToTime", "Trim Layer Out Point to Current Time", [], Some("Alt+]")),
-    uic!("timeline.reveal.position", "Reveal Position", [], Some("P")),
-    uic!("timeline.reveal.scale", "Reveal Scale", [], Some("S")),
-    uic!("timeline.reveal.rotation", "Reveal Rotation", [], Some("R")),
-    uic!("timeline.reveal.opacity", "Reveal Opacity", [], Some("T")),
-    uic!("timeline.reveal.anchor", "Reveal Anchor Point", [], Some("A")),
-    uic!("timeline.reveal.effects", "Reveal Effects", [], Some("E")),
-    uic!("timeline.reveal.masks", "Reveal Masks", [], Some("M")),
-    uic!("timeline.reveal.feather", "Reveal Mask Feather", [], Some("F")),
-    uic!("timeline.reveal.levels", "Reveal Audio Levels (press twice: Waveform)", [], Some("L")),
-    uic!("timeline.reveal.timeRemap", "Reveal Time Remap", [], None),
-    uic!("timeline.reveal.expressions", "Reveal Expressions", [], None),
-    uic!("timeline.reveal.maskOpacity", "Reveal Mask Opacity", [], None),
-    uic!("timeline.reveal.maskPath", "Reveal Mask Path", [], None),
-    uic!("timeline.reveal.material", "Reveal Material Options", [], None),
-    uic!("timeline.reveal.paint", "Reveal Paint, Roto Brush and Puppet", [], None),
-    uic!("timeline.reveal.selected", "Reveal Selected Properties", [], None),
-    uic!("timeline.reveal.missingEffects", "Reveal Missing Effects", [], None),
-    uic!("timeline.reveal.waveform", "Reveal Audio Waveform", [], None),
-    uic!("timeline.revealAdd.position", "Add Position to Revealed Properties", [], Some("Shift+P")),
-    uic!("timeline.revealAdd.scale", "Add Scale to Revealed Properties", [], Some("Shift+S")),
-    uic!("timeline.revealAdd.rotation", "Add Rotation to Revealed Properties", [], Some("Shift+R")),
-    uic!("timeline.revealAdd.opacity", "Add Opacity to Revealed Properties", [], Some("Shift+T")),
-    uic!("timeline.revealAdd.anchor", "Add Anchor Point to Revealed Properties", [], Some("Shift+A")),
-    uic!("timeline.revealAdd.effects", "Add Effects to Revealed Properties", [], Some("Shift+E")),
-    uic!("timeline.revealAdd.masks", "Add Masks to Revealed Properties", [], Some("Shift+M")),
-    uic!("timeline.revealAdd.feather", "Add Mask Feather to Revealed Properties", [], Some("Shift+F")),
-    uic!("timeline.revealAdd.levels", "Add Audio Levels to Revealed Properties", [], Some("Shift+L")),
-    uic!("timeline.revealAdd.animated", "Add Animated Properties to Revealed Properties", [], Some("Shift+U")),
-    uic!("timeline.column", "Show/Hide Timeline Column", [], None),
-    uic!("timeline.sourceName", "Source Name / Layer Name", [], None),
-    uic!("timeline.search", "Search Timeline", [], None),
-    uic!("flowchart.options", "Flowchart Options", [], None),
-    uic!("flowchart.graph", "Flowchart Graph", [], None),
-    uic!("timeline.collapseAll", "Collapse All", [], None),
-    uic!("timeline.twirlSelected", "Twirl Selected Layers Open / Closed", [], Some("Cmd+`")),
-    uic!("timeline.keyAt.anchor", "Add or Remove Anchor Point Keyframe", [], Some("Alt+Shift+A")),
-    uic!("timeline.keyAt.position", "Add or Remove Position Keyframe", [], Some("Alt+Shift+P")),
-    uic!("timeline.keyAt.scale", "Add or Remove Scale Keyframe", [], Some("Alt+Shift+S")),
-    uic!("timeline.keyAt.rotation", "Add or Remove Rotation Keyframe", [], Some("Alt+Shift+R")),
-    uic!("timeline.keyAt.opacity", "Add or Remove Opacity Keyframe", [], Some("Alt+Shift+T")),
-    uic!("tool.selection", "Selection Tool", [], Some("V")),
-    uic!("tool.hand", "Hand Tool", [], Some("H")),
-    uic!("tool.zoom", "Zoom Tool", [], Some("Z")),
-    uic!("tool.orbit", "Orbit Tool", [], Some("1")),
-    uic!("tool.panCamera", "Pan Camera Tool", [], Some("2")),
-    uic!("tool.dolly", "Dolly Tool", [], Some("3")),
-    uic!("tool.camera", "Camera Tools", [], Some("C")),
-    uic!("tool.rotate", "Rotation Tool", [], Some("W")),
-    uic!("tool.panBehind", "Pan Behind Tool", [], Some("Y")),
-    uic!("tool.shape", "Shape Tools", [], Some("Q")),
-    uic!("tool.pen", "Pen Tool", [], Some("G")),
-    uic!("tool.type", "Type Tools", [], Some("Cmd+T")),
-    uic!("tool.brush", "Brush Tools", [], Some("Cmd+B")),
-    uic!("tool.rotoBrush", "Roto Brush & Refine Edge Tools", [], Some("Alt+W")),
-    uic!("tool.puppet", "Puppet Tools", [], Some("Cmd+P")),
-    uic!("app.newComp", "New Composition...", [], None),
-    uic!("app.compSettings", "Composition Settings...", [], None),
-    uic!("app.solidSettings", "New Solid...", [], None),
-    uic!("app.home", "Home", [], None),
-    uic!("markers.dialog", "Marker Settings...", [], None),
-    uic!("window.maximizePanel", "Maximize Panel Under Pointer", [], Some("`")),
-    uic!("window.maximizeApp", "Maximize or Restore Application Window", [], Some("Cmd+\\")),
-    uic!("window.toggleCompTimeline", "Switch Between Composition and Timeline Panel", [], Some("\\")),
-    uic!("window.nextPanel", "Next Panel in Frame", [], Some("Alt+Shift+.")),
-    uic!("window.previousPanel", "Previous Panel in Frame", [], Some("Alt+Shift+,")),
-    uic!("window.closeAll", "Close Panel or All Viewers", [], Some("Cmd+Shift+W")),
-    uic!("window.dockPanel", "Dock Panel", [], None),
-    uic!("window.floatPanel", "Undock Panel", [], None),
-    uic!("window.closePanel", "Close Panel", [], None),
-    uic!("window.panelWindow", "Move Panel to New Window", [], None),
-];
-
-pub fn panel_command_id(p: PanelKind) -> String {
-    format!("window.panel.{}", p.id())
-}
-
-/// The reveal shortcuts (P, S, R, T, A, E, M, F, L…). `add` (Shift+key) adds the property to
-/// (or removes it from) those already revealed instead of replacing them.
-pub fn reveal(app: &mut EffectcraftApp, kind: &str, now: f64, add: bool) {
-    // The double-press shortcuts: the same key again within 0.6 s reveals its second set (LL
-    // Waveform, TT Mask Opacity, MM all mask properties, EE Expressions, RR Time Remap, AA
-    // Material Options, PP paint / Roto Brush / Puppet, SS selected properties, FF missing
-    // effects). A single M shows Mask Path.
-    let double = |k: &str| -> Option<&'static str> {
-        Some(match k {
-            "levels" => "waveform",
-            "opacity" => "maskOpacity",
-            "masks" => "masks",
-            "effects" => "expressions",
-            "rotation" => "timeRemap",
-            "anchor" => "material",
-            "position" => "paint",
-            "scale" => "selected",
-            "feather" => "missingEffects",
-            _ => return None,
-        })
-    };
-    let pressed = kind;
-    // (With Shift a second press removes the property again instead.)
-    let again = !add && matches!(app.last_reveal.take(), Some((k, t)) if k == pressed && now - t < 0.6);
-    app.last_reveal = Some((if again { String::new() } else { pressed.to_string() }, now));
-    let kind = match (again, double(pressed)) {
-        (true, Some(d)) => {
-            // The second press replaces what the first one revealed.
-            let first = if pressed == "masks" { "maskPath" } else { pressed };
-            app.ui.timeline.reveal.retain(|k| k != first);
-            d
-        }
-        _ if pressed == "masks" => "maskPath",
-        _ => pressed,
-    };
-    let targets = reveal_targets(app);
-    let tl = &mut app.ui.timeline;
-    let present = tl.reveal.iter().any(|k| k == kind);
-    let mut kinds = tl.reveal.clone();
-    if add {
-        if present {
-            kinds.retain(|k| k != kind);
-        } else {
-            kinds.retain(|k| k != "props" || !tl.reveal_props.is_empty());
-            kinds.push(kind.to_string());
-        }
-    } else if present && kinds.len() == 1 {
-        kinds.clear();
-    } else {
-        kinds = vec![kind.to_string()];
-    }
-    tl.apply_reveal(&targets, kinds.clone());
-    crate::panels::timeline::open_revealed(app, &targets, &kinds);
-}
-
-/// Show Time Remap on the layers of a `layer.enableTimeRemap` (`layers` by id, else the
-/// selected ones) that have it now.
-fn reveal_time_remap(app: &mut EffectcraftApp, params: &Value) {
-    let asked: Vec<u64> = match params.get("layers").and_then(Value::as_array) {
-        Some(a) => a.iter().filter_map(Value::as_u64).collect(),
-        None => app.session.state.selected_layers.iter().map(|l| l.0).collect(),
-    };
-    let Some(comp) = app.session.active_comp() else { return };
-    let layers: Vec<u64> = comp.layers.iter().filter(|l| asked.contains(&l.id.0) && l.props.get("timeRemap").is_some()).map(|l| l.id.0).collect();
-    if !layers.is_empty() {
-        app.ui.timeline.apply_reveal(&layers, vec!["timeRemap".into()]);
-    }
-}
-
-/// After Alt+Shift+P (A, S, R, T) the Timeline shows the property on each layer it keyed, as in
-/// After Effects: added to what a reveal shortcut shows, else with the layer's Transform twirled
-/// open, else alone like P.
-fn reveal_keyed(app: &mut EffectcraftApp, keyed: &Value, kind: &str) {
-    let layers: std::collections::BTreeSet<u64> = keyed.as_array().into_iter().flatten().filter_map(|k| k.get("layer").and_then(Value::as_u64)).collect();
-    let Some(comp) = app.session.active_comp() else { return };
-    let tl = &mut app.ui.timeline;
-    for id in layers {
-        let shown = tl.layer_reveal.get(&id).filter(|k| !k.is_empty()).cloned();
-        match shown {
-            Some(mut kinds) => {
-                if !kinds.iter().any(|k| k == kind) {
-                    kinds.push(kind.to_string());
-                    tl.layer_reveal.insert(id, kinds);
-                }
-            }
-            None if tl.open_layers.contains(&id) => {
-                if let Some(tr) = comp.layer(effectcraft_engine::project::LayerId(id)).and_then(|l| l.transform()) {
-                    tl.open_groups.insert(tr.uid);
-                }
-            }
-            None => {
-                tl.open_layers.insert(id);
-                tl.layer_reveal.insert(id, vec![kind.to_string()]);
-            }
-        }
-    }
-}
-
-/// The layers a reveal shortcut acts on: the selected ones, else every layer of the active comp.
-fn reveal_targets(app: &EffectcraftApp) -> Vec<u64> {
-    if app.session.state.selected_layers.is_empty() {
-        app.session.active_comp().map(|c| c.layers.iter().map(|l| l.id.0).collect()).unwrap_or_default()
-    } else {
-        app.session.state.selected_layers.iter().map(|l| l.0).collect()
-    }
-}
-
-/// The arrow keys nudge the selected layers 1 pixel at the viewer's magnification (`up`,
-/// `down`, `left`, `right`), 10 with Shift (`up10`…), as After Effects does, so zoomed in
-/// they move by fractions of a comp pixel. From any panel except Project (which owns the
-/// arrow keys for its own keyboard navigation, #961); not while typing, with a dialog or
-/// menu open. With mask points selected the arrows move the points instead (#1288).
-fn nudge(app: &mut EffectcraftApp, ctx: &egui::Context, dir: &str) -> Result<Value, String> {
-    let (side, n) = match dir.strip_suffix("10") {
-        Some(side) => (side, 10.0),
-        None => (dir, 1.0),
-    };
-    let (x, y) = match side {
-        "up" => (0.0, -n),
-        "down" => (0.0, n),
-        "left" => (-n, 0.0),
-        "right" => (n, 0.0),
-        _ => return Err(format!("unknown nudge `{dir}`")),
-    };
-    let st = &app.session.state;
-    if app.ui.focused == PanelKind::Project || (st.selected_layers.is_empty() && st.selected_vertices.is_empty()) || st.text_edit.is_some() {
-        return Ok(Value::Null);
-    }
-    // Screen pixels per comp pixel.
-    let zoom = (app.ui.viewer.zoom.unwrap_or_else(|| crate::panels::viewer::last_fit(ctx)) * ctx.pixels_per_point()) as f64;
-    let k = if zoom.is_finite() && zoom > 1e-6 { 1.0 / zoom } else { 1.0 };
-    if let Some(layer) = st.selected_vertices.first().map(|v| v.layer) {
-        let d = vertex_delta(app, layer, [x * k, y * k]);
-        return run_engine(app, ctx, "mask.moveVertices", json!({"delta": d}));
-    }
-    run_engine(app, ctx, "layer.nudge", json!({"x": x * k, "y": y * k}))
-}
-
-/// A comp-space step `d` in the layer space of `layer`, where mask points live. Like a drag of
-/// the points in the viewer, every selected point takes the first one's layer space.
-fn vertex_delta(app: &EffectcraftApp, layer: effectcraft_engine::project::LayerId, d: [f64; 2]) -> [f64; 2] {
-    use effectcraft_engine::geom::vec2;
-    let s = &app.session;
-    let (Some(cid), Some(comp)) = (s.active_comp_id(), s.active_comp()) else { return d };
-    let Some(l) = comp.layer(layer) else { return d };
-    let ectx = effectcraft_engine::render::EvalCtx { project: &s.project, comp_id: cid, comp, time: s.time(), expr: s.expr.as_deref(), footage: None };
-    let (l2c, _) = crate::panels::viewer::l2c(&ectx, l);
-    l2c.inverse().map_or(d, |inv| {
-        let v = inv.apply_vec(vec2(d[0], d[1]));
-        [v.x, v.y]
-    })
-}
-
-fn no_params(p: &Value) -> bool {
-    p.as_object().is_none_or(|m| m.is_empty())
-}
-
-/// `{"comp": id}` and nothing else: Composition Settings opens on that comp instead of
-/// applying no settings to it.
-fn only_comp(p: &Value) -> Option<effectcraft_engine::project::ItemId> {
-    let m = p.as_object().filter(|m| m.len() == 1)?;
-    m.get("comp")?.as_u64().map(effectcraft_engine::project::ItemId)
-}
-
-/// Execute a UI or engine command by id.
-pub fn invoke(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, params: Value) -> Result<Value, String> {
-    if matches!(id, "effects.copyPresetsFolderPath" | "mediaBrowser.copySourcePath") {
-        return frontend(app, ctx, id, params);
-    }
-    // Layer ▸ New ▸ Text (menu, shortcut, context menus) puts an insertion point in the centre of
-    // the comp, as After Effects does, so typing goes into Source Text rather than running
-    // shortcuts (#866). `engine.execute` keeps the headless default.
-    if id == "layer.newText" && no_params(&params) {
-        return run_engine(app, ctx, id, json!({"text": "", "edit": true}));
-    }
-    // A new folder (File ▸ New, its shortcut, the Project panel's button and context menu) opens
-    // with its name ready to type, as in After Effects (#1658). The command selects it.
-    // `engine.execute` keeps the headless default.
-    if id == "project.newFolder" && no_params(&params) {
-        let r = run_engine(app, ctx, id, params);
-        if r.is_ok() {
-            app.show_panel(PanelKind::Project);
-            crate::panels::project::begin_rename(app, ctx);
-        }
-        return r;
-    }
-    if no_params(&params) && app.ui.focused == PanelKind::Project {
-        match id {
-            "edit.duplicate" => return run_engine(app, ctx, "project.duplicate", json!({})),
-            "edit.selectAll" => {
-                let items: Vec<u64> = crate::panels::project::visible_rows(app)
-                    .into_iter()
-                    .filter(|(id, _)| app.ui.project_search.is_empty() || app.session.project.item(*id).is_some_and(|it| !it.is_folder()))
-                    .map(|(id, _)| id.0)
-                    .collect();
-                return run_engine(app, ctx, "project.select", json!({"items":items}));
-            }
-            "edit.deselectAll" => return run_engine(app, ctx, "project.select", json!({"items":[]})),
-            "edit.cut" | "edit.copy" | "edit.paste" | "edit.copyWithPropertyLinks" | "edit.copyWithRelativePropertyLinks" | "edit.copyExpressionOnly" => {
-                return Err("Project clipboard actions are not supported yet".into());
-            }
-            _ => {}
-        }
-    }
-    // Edit ▸ Paste with SVG markup on the system clipboard pastes it as a shape layer (After
-    // Effects 26.3). Copying in the app replaces the system clipboard with a note naming what
-    // was copied, so SVG there was copied after anything copied in the app.
-    if id == "edit.paste" && no_params(&params) && app.session.state.text_edit.is_none() {
-        let text = ctx.data_mut(|d| d.remove_temp::<String>(system_paste_id())).or_else(|| app.hooks.clipboard_text.as_ref().and_then(|f| f()));
-        if let Some(svg) = text.filter(|t| effectcraft_engine::vector::is_svg_text(t)) {
-            return run_engine(app, ctx, "edit.pasteSvg", json!({"svg": svg}));
-        }
-    }
-    // Clear follows panel focus, including the Edit menu and keyboard shortcut.
-    if id == "edit.clear" && params.as_object().is_some_and(|p| p.is_empty()) && app.ui.focused == PanelKind::Project {
-        // Through `invoke`, so deleting items that compositions use still asks first (M3.16).
-        return invoke(app, ctx, "project.delete", json!({}));
-    }
-    if id == "edit.clear" && params.as_object().is_some_and(|p| p.is_empty()) && app.ui.focused == PanelKind::RenderQueue {
-        let selected = ctx.data(|d| d.get_temp::<(Vec<u64>, Option<u64>)>(egui::Id::new("rq-ui"))).and_then(|(_, id)| id);
-        return match selected {
-            Some(item) => run_engine(app, ctx, "renderQueue.remove", json!({"item": item})),
-            None => Err("select a Render Queue item first".into()),
-        };
-    }
-    // Shift+Delete deletes the Project panel's selection without asking; it does nothing in the
-    // other panels.
-    if id == "project.deleteWithoutConfirmation" {
-        if app.ui.focused != PanelKind::Project {
-            return Ok(Value::Null);
-        }
-        return crate::panels::delete_items::delete_confirmed(app, ctx, json!({}));
-    }
-    let now = ctx.input(|i| i.time);
-    // Closing a modified project asks to save it first; the command runs once answered.
-    if crate::panels::unsaved::guard(app, id, &params) {
-        return Ok(json!({"dialog": "unsavedChanges"}));
-    }
-    // Deleting Project items that compositions use asks first, as in After Effects.
-    if crate::panels::delete_items::guard(app, id, &params) {
-        return Ok(json!({"dialog": "deleteItems"}));
-    }
-    // J / K and Select All Keyframes act on what the Timeline shows (its revealed properties).
-    if matches!(id, "time.nextKey" | "time.previousKey" | "keys.selectAll")
-        && ["visible", "layers", "layer", "prop"].iter().all(|k| params.get(*k).is_none())
-        && let Some(c) = app.session.active_comp_arc()
-    {
-        let mut p = if params.is_object() { params.clone() } else { json!({}) };
-        p["visible"] = json!(crate::panels::timeline::visible_props(app, &c));
-        return run_engine(app, ctx, id, p);
-    }
-    // New Camera/Light and Camera/Light Settings without parameters open their dialogs.
-    if crate::panels::dialogs_3d::route(app, id, &params)? {
-        return Ok(Value::Null);
-    }
-    // Layer Settings on a solid, adjustment layer or null opens its settings dialog.
-    if crate::panels::dialogs::route_layer_settings(app, id, &params)? {
-        return Ok(Value::Null);
-    }
-    // Layer ▸ Layer Styles ▸ <style> from the menu adds the style and opens the dialog on it.
-    if crate::panels::layer_styles_dialog::route(app, id, &params)? {
-        return Ok(Value::Null);
-    }
-    // Legacy per-panel / per-workspace ids (`window.panel.Project`, `window.workspace.default`).
-    if let Some(rest) = id.strip_prefix("window.panel.") {
-        return frontend(app, ctx, "window.panel", json!({"panel": rest}));
-    }
-    if let Some(ws) = id.strip_prefix("window.workspace.") {
-        if ws == "reset" {
-            return frontend(app, ctx, "window.resetWorkspace", json!({}));
-        }
-        return frontend(app, ctx, "window.workspace", json!({"name": ws}));
-    }
-    if let Some(t) = id.strip_prefix("tool.") {
-        // C cycles through the camera tools.
-        if t == "camera" {
-            let tools = [Tool::Orbit, Tool::PanCamera, Tool::Dolly];
-            let next = match tools.iter().position(|x| *x == app.ui.tool) {
-                Some(i) => tools[(i + 1) % tools.len()],
-                None => Tool::Orbit,
-            };
-            app.ui.tool = next;
-            return Ok(json!({"tool": next}));
-        }
-        // Slot shortcuts cycle through the slot's tools.
-        let slot = match t {
-            "shape" => Some(8),
-            "pen" => Some(9),
-            "type" => Some(10),
-            "brush" => Some(11),
-            "rotoBrush" => Some(14),
-            "puppet" => Some(15),
-            _ => None,
-        };
-        if let Some(si) = slot {
-            let tools: Vec<Tool> = match si {
-                11 => vec![Tool::Brush, Tool::Clone, Tool::Eraser],
-                _ => crate::state::Tool::SLOTS[si].to_vec(),
-            };
-            let cur = tools.iter().position(|x| *x == app.ui.tool);
-            let next = match cur {
-                Some(i) => tools[(i + 1) % tools.len()],
-                None => app.ui.slot_tools.get(si).copied().filter(|x| tools.contains(x)).unwrap_or(tools[0]),
-            };
-            app.ui.tool = next;
-            if si < app.ui.slot_tools.len() && si != 11 {
-                app.ui.slot_tools[si] = next;
-            }
-            return Ok(json!({"tool": next}));
-        }
-        let tool = Tool::from_name(t).ok_or_else(|| format!("unknown tool `{t}`"))?;
-        app.ui.tool = tool;
-        return Ok(json!({"tool": tool}));
-    }
-    if let Some(dir) = id.strip_prefix("viewer.nudge.") {
-        return nudge(app, ctx, dir);
-    }
-    if let Some(k) = id.strip_prefix("timeline.reveal.") {
-        if k == "animated" {
-            return run_engine(app, ctx, "anim.reveal", json!({"kind": "keyframes"}));
-        }
-        reveal(app, k, now, false);
-        return Ok(Value::Null);
-    }
-    if let Some(k) = id.strip_prefix("timeline.keyAt.") {
-        let r = run_engine(app, ctx, "keys.toggleTransform", json!({"prop": k}))?;
-        reveal_keyed(app, &r, k);
-        return Ok(r);
-    }
-    if let Some(k) = id.strip_prefix("timeline.revealAdd.") {
-        reveal(app, k, now, true);
-        return Ok(json!({"revealed": app.ui.timeline.reveal}));
-    }
-    // U reveals keyframed properties; UU (pressed twice quickly) all modified properties; U
-    // again later hides them.
-    if id == "anim.reveal" && params.get("kind").and_then(Value::as_str) == Some("keyframes") {
-        let last = app.last_reveal.take();
-        app.last_reveal = Some(("keyframes".into(), now));
-        match last {
-            Some((k, t)) if k == "keyframes" && now - t < 0.6 => {
-                return run_engine(app, ctx, "anim.reveal", json!({"kind": "modified"}));
-            }
-            Some((k, _)) if k == "keyframes" && app.ui.timeline.reveal == ["props"] => {
-                let targets = reveal_targets(app);
-                app.ui.timeline.apply_reveal(&targets, vec![]);
-                return Ok(json!({"revealed": 0}));
-            }
-            _ => {}
-        }
-    }
-    if id == "window.dockAction" {
-        let value = params.get("action").cloned().ok_or("missing docking action")?;
-        let action: craft_ui::docking::Action<PanelKind> = serde_json::from_value(value).map_err(|error| format!("invalid docking action: {error}"))?;
-        if matches!(&action, craft_ui::docking::Action::Open { .. } | craft_ui::docking::Action::OpenAt { .. }) {
-            return Err("use the panel open commands to preserve viewer and ScriptUI lifecycle callbacks".into());
-        }
-        if let craft_ui::docking::Action::Close { panel } = &action {
-            let mut layout = crate::dock_shared::encode(&app.ui.dock, &app.ui.floating)?;
-            layout.apply(action.clone()).map_err(|error| error.to_string())?;
-            app.close_panel(*panel);
-            return Ok(Value::Null);
-        }
-        let mut error = None;
-        if !app.edit_layout(|layout| match layout.apply(action) {
-            Ok(()) => true,
-            Err(reason) => {
-                error = Some(reason);
-                false
-            }
-        }) {
-            return Err(error.unwrap_or_else(|| "invalid docking layout".into()));
-        }
-        return Ok(Value::Null);
-    }
-    // Multiple monitors: {panel, window?: bool} moves a panel into its own native window (or
-    // back into the main window; no `window` toggles).
-    if id == "window.panelWindow" {
-        // A panel name ("Info", "Effect Controls") or its serialized form ({"Viewer": 2}).
-        let value = params.get("panel").ok_or("panelWindow: need `panel`")?;
-        let panel = match value.as_str() {
-            Some(name) => PanelKind::from_name(name).ok_or(format!("unknown panel `{name}`"))?,
-            None => serde_json::from_value::<PanelKind>(value.clone()).map_err(|_| "panelWindow: unknown `panel`".to_string())?,
-        };
-        let window = match params.get("window") {
-            None | Some(Value::Null) => None,
-            Some(value) => Some(value.as_bool().ok_or("panelWindow: `window` must be true or false")?),
-        };
-        let window = app.set_panel_window(ctx, panel, window)?;
-        return Ok(json!({"window": window}));
-    }
-    // A UI-only command (not in the engine's menus), so `frontend` gets it from here.
-    if id == "window.maximizeApp" {
-        return frontend(app, ctx, id, params);
-    }
-    // Docking: {panel, anchor, zone: center|left|right|top|bottom}, {panel, rect?}, {panel?}.
-    if let Some(op) = id.strip_prefix("window.").filter(|o| matches!(*o, "maximizePanel" | "dockPanel" | "floatPanel" | "closePanel")) {
-        let panel_of = |k: &str| params.get(k).and_then(Value::as_str).map(|s| PanelKind::from_name(s).ok_or(format!("unknown panel `{s}`")));
-        match op {
-            "maximizePanel" => {
-                let p = match panel_of("panel") {
-                    Some(p) => p?,
-                    None => app.panel_at(ctx.pointer_hover_pos()),
-                };
-                app.toggle_maximize(p);
-                return Ok(json!({"maximized": app.ui.maximized}));
-            }
-            "closePanel" => {
-                let p = panel_of("panel").ok_or("closePanel: need `panel`")??;
-                app.close_panel(p);
-                return Ok(Value::Null);
-            }
-            "floatPanel" => {
-                let p = panel_of("panel").ok_or("floatPanel: need `panel`")??;
-                let r = match params.get("rect") {
-                    Some(value) => serde_json::from_value::<[f32; 4]>(value.clone()).map_err(|_| "rect must contain four finite numbers")?,
-                    None => crate::dock_ui::default_float_rect(ctx.content_rect()),
-                };
-                if !app.edit_layout(|l| l.float(p, r)) {
-                    return Err(format!("can't undock {}", p.title()));
-                }
-                return Ok(Value::Null);
-            }
-            _ => {
-                let p = panel_of("panel").ok_or("dockPanel: need `panel`")??;
-                let anchor = panel_of("anchor").ok_or("dockPanel: need `anchor` (a docked panel)")??;
-                let zone = params
-                    .get("zone")
-                    .and_then(Value::as_str)
-                    .map_or(Some(crate::dock::Zone::Center), crate::dock::Zone::from_name)
-                    .ok_or("zone: center|left|right|top|bottom")?;
-                if !app.edit_layout(|l| l.dock(p, anchor, zone)) {
-                    return Err(format!("can't dock {} at {} ({zone:?})", p.title(), anchor.title()));
-                }
-                app.show_panel(p);
-                return Ok(Value::Null);
-            }
-        }
-    }
-    if id == "markers.dialog" {
-        // The Composition/Layer Marker dialog (double-click a marker): {layer?, index}.
-        let index = params.get("index").and_then(Value::as_u64).ok_or("markers.dialog: need `index`")? as usize;
-        let layer = params.get("layer").and_then(Value::as_u64);
-        crate::panels::markers_ui::open_dialog(app, crate::panels::markers_ui::MarkerRef { layer, index })?;
-        return Ok(json!({"dialog": id}));
-    }
-
-    if id == "view.theme.toggle" {
-        app.cycle_appearance(ctx);
-        return Ok(json!({"appearanceMode": app.session.prefs.appearance.appearance_mode}));
-    }
-    if let Some(th) = id.strip_prefix("view.theme.") {
-        let k = crate::theme::ThemeKind::from_name(th).ok_or("unknown theme")?;
-        app.set_theme(ctx, k);
-        return Ok(Value::Null);
-    }
-    let timing = |app: &mut EffectcraftApp, op: &str| app.session.execute("layer.timing", json!({"op": op})).map_err(|e| e.to_string());
-    match id {
-        "playback.ramPreview" => {
-            app.toggle_play_with(now, effectcraft_engine::preview::PreviewShortcut::Numpad0);
-            return Ok(json!({"playing": app.playback.playing}));
-        }
-        "playback.preview.shiftSpacebar" | "playback.preview.shiftNumpad0" | "playback.preview.altNumpad0" => {
-            let sc = effectcraft_engine::preview::PreviewShortcut::parse(id.trim_start_matches("playback.preview.")).ok_or("unknown preview shortcut")?;
-            app.toggle_play_with(now, sc);
-            return Ok(json!({"playing": app.playback.playing}));
-        }
-        "playback.stop" => {
-            app.stop();
-            return Ok(Value::Null);
-        }
-        // The focused Layer panel has its own magnification; otherwise the Composition viewer.
-        "view.fit" if app.ui.focused == PanelKind::Layer => {
-            app.ui.layer_zoom = None;
-            app.ui.layer_pan = [0.0, 0.0];
-            return Ok(Value::Null);
-        }
-        "view.fit" => {
-            app.ui.viewer.zoom = None;
-            app.ui.viewer.fit_up_to_100 = false;
-            app.ui.viewer.pan = [0.0, 0.0];
-            return Ok(Value::Null);
-        }
-        "timeline.scrollToTime" => app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Time),
-        "timeline.scrollToLayer" => app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Layer),
-        "timeline.parentColumn" => {
-            let on = !crate::panels::timeline::column_visible(&app.ui.timeline, "parent");
-            crate::panels::timeline::set_column(&mut app.ui.timeline, "parent", on)?;
-            return Ok(json!({"parent": on}));
-        }
-        "view.fitUpTo100" => {
-            app.ui.viewer.zoom = None;
-            app.ui.viewer.fit_up_to_100 = true;
-            app.ui.viewer.pan = [0.0, 0.0];
-            return Ok(Value::Null);
-        }
-        // Shift+, / Shift+.: the previous / next open composition (the viewer's tabs).
-        "view.nextItem" | "view.previousItem" => {
-            let open = app.session.state.open_comps.clone();
-            let Some(i) = app.session.state.active_comp.and_then(|c| open.iter().position(|o| *o == c)) else { return Ok(Value::Null) };
-            let step = if id == "view.nextItem" { 1 } else { open.len().saturating_sub(1) };
-            let Some(next) = open.get((i + step) % open.len().max(1)).copied().filter(|n| Some(*n) != app.session.state.active_comp) else {
-                return Ok(Value::Null);
-            };
-            return run_engine(app, ctx, "comp.open", json!({"comp": next.0}));
-        }
-        // \\: between the Composition viewer and the Timeline.
-        "window.toggleCompTimeline" => {
-            let to = if app.ui.focused == PanelKind::Timeline { crate::panels::viewers::active_panel(app) } else { PanelKind::Timeline };
-            app.show_panel(to);
-            return Ok(json!({"focused": to.id()}));
-        }
-        // Alt+Shift+, / Alt+Shift+.: the previous / next tab of the focused panel's group.
-        "window.nextPanel" | "window.previousPanel" => {
-            let focused = app.ui.focused;
-            let group: Vec<PanelKind> = match app.ui.floating.iter().find(|f| f.panels.contains(&focused)) {
-                Some(f) => f.panels.clone(),
-                None => app.ui.dock.group_of(focused).map(<[PanelKind]>::to_vec).unwrap_or_default(),
-            };
-            let Some(i) = group.iter().position(|p| *p == focused) else { return Ok(Value::Null) };
-            let step = if id == "window.nextPanel" { 1 } else { group.len().saturating_sub(1) };
-            if let Some(next) = group.get((i + step) % group.len().max(1)).copied() {
-                app.show_panel(next);
-            }
-            return Ok(json!({"focused": app.ui.focused.id()}));
-        }
-        // Ctrl+Shift+W: with a viewer or the Timeline active, every open composition closes;
-        // any other panel closes itself.
-        "window.closeAll" => {
-            let focused = app.ui.focused;
-            if matches!(focused, PanelKind::Composition | PanelKind::Timeline | PanelKind::Viewer(_)) {
-                for c in app.session.state.open_comps.clone() {
-                    run_engine(app, ctx, "comp.close", json!({"comp": c.0}))?;
-                }
-            } else {
-                app.close_panel(focused);
-            }
-            return Ok(Value::Null);
-        }
-        "view.actualSize" if app.ui.focused == PanelKind::Layer => {
-            app.ui.layer_zoom = Some(1.0 / ctx.pixels_per_point());
-            app.ui.layer_pan = [0.0, 0.0];
-            return Ok(Value::Null);
-        }
-        "view.actualSize" => {
-            app.ui.viewer.zoom = Some(1.0 / ctx.pixels_per_point());
-            app.ui.viewer.pan = [0.0, 0.0];
-            return Ok(Value::Null);
-        }
-        "view.safeMargins" => app.ui.viewer.safe_margins = !app.ui.viewer.safe_margins,
-        "view.transparencyGrid" => app.ui.viewer.transparency_grid = !app.ui.viewer.transparency_grid,
-        "view.fastPreviews" => {
-            // With a mode: Fast Previews ▸ Off / Adaptive Resolution / Draft / Fast Draft /
-            // Wireframe; without: toggle Draft quality (Settings ▸ Previews).
-            if params.get("mode").is_some() {
-                return run_engine(app, ctx, "view.fastPreviewMode", params);
-            }
-            let on = !app.ui.viewer.fast_preview;
-            app.set_pref("previews.fastPreviews", json!(on))?;
-            app.ui.viewer.fast_preview = on;
-        }
-        "timeline.zoomIn" | "timeline.zoomOut" => {
-            let k = if id == "timeline.zoomIn" { crate::panels::timeline::ZOOM_STEP } else { 1.0 / crate::panels::timeline::ZOOM_STEP };
-            crate::panels::timeline::zoom(app, ctx, k);
-            return Ok(Value::Null);
-        }
-        "timeline.zoomFit" => crate::panels::timeline::toggle_fit_zoom(app, ctx),
-        "timeline.zoomFrameToggle" => crate::panels::timeline::toggle_frame_zoom(app, ctx),
-        "timeline.column" => {
-            let col = params.get("column").and_then(Value::as_str).ok_or("timeline.column: need `column`")?;
-            let on = params.get("visible").and_then(Value::as_bool).unwrap_or(!crate::panels::timeline::column_visible(&app.ui.timeline, col));
-            crate::panels::timeline::set_column(&mut app.ui.timeline, col, on)?;
-            let shown: Vec<&str> =
-                crate::panels::timeline::COLUMNS.iter().map(|c| c.0).filter(|c| crate::panels::timeline::column_visible(&app.ui.timeline, c)).collect();
-            return Ok(json!({"columns": shown}));
-        }
-        "timeline.sourceName" => {
-            let tl = &mut app.ui.timeline;
-            tl.source_name = params.get("value").and_then(Value::as_bool).unwrap_or(!tl.source_name);
-            return Ok(json!({"sourceName": tl.source_name}));
-        }
-        "flowchart.options" | "flowchart.graph" => return crate::panels::flowchart::command(app, id, &params),
-        "timeline.search" => {
-            app.ui.timeline.search = params.get("query").and_then(Value::as_str).unwrap_or_default().to_string();
-            app.show_panel(PanelKind::Timeline);
-        }
-        "timeline.graphEditor" => app.ui.timeline.graph_editor = !app.ui.timeline.graph_editor,
-        "timeline.switchesModes" => app.ui.timeline.show_modes = !app.ui.timeline.show_modes,
-        "timeline.collapseAll" => {
-            app.ui.timeline.open_layers.clear();
-            app.ui.timeline.open_groups.clear();
-            app.ui.timeline.reveal.clear();
-            app.ui.timeline.layer_reveal.clear();
-        }
-        // Ctrl+`: twirl the selected layers open (all closed ones) or closed (all open). From a
-        // reveal shortcut's view it opens their full property trees.
-        "timeline.twirlSelected" => {
-            let sel: Vec<u64> = app.session.state.selected_layers.iter().map(|l| l.0).collect();
-            let tl = &mut app.ui.timeline;
-            let revealing = sel.iter().any(|l| tl.layer_reveal.contains_key(l));
-            tl.reveal.clear();
-            for l in &sel {
-                tl.layer_reveal.remove(l);
-            }
-            if !revealing && sel.iter().all(|l| tl.open_layers.contains(l)) {
-                for l in &sel {
-                    tl.open_layers.remove(l);
-                }
-            } else {
-                tl.open_layers.extend(sel);
-            }
-        }
-        "timeline.workAreaBegin" => return app.session.execute("comp.workArea", json!({"set": "begin"})).map_err(|e| e.to_string()),
-        "timeline.workAreaEnd" => return app.session.execute("comp.workArea", json!({"set": "end"})).map_err(|e| e.to_string()),
-        "timeline.moveInToTime" => return timing(app, "moveInToTime"),
-        "timeline.moveOutToTime" => return timing(app, "moveOutToTime"),
-        "timeline.trimInToTime" => return timing(app, "trimInToTime"),
-        "timeline.trimOutToTime" => return timing(app, "trimOutToTime"),
-        "app.home" => app.ui.start_screen = !app.ui.start_screen,
-        "app.newComp" | "comp.new" if no_params(&params) => crate::panels::dialogs::open_new_comp(app),
-        "app.compSettings" | "comp.settings" if no_params(&params) => crate::panels::dialogs::open_comp_settings(app)?,
-        "app.compSettings" | "comp.settings" if only_comp(&params).is_some() => {
-            crate::panels::dialogs::open_comp_settings_for(app, only_comp(&params).ok_or("missing `comp`")?)?
-        }
-        "app.solidSettings" | "layer.newSolid" if no_params(&params) => crate::panels::dialogs::open_new_solid(app)?,
-        "keys.velocity" if no_params(&params) => crate::panels::key_dialogs::open_velocity(app)?,
-        "keys.interpolation" if no_params(&params) => crate::panels::key_dialogs::open_interpolation(app)?,
-        "layer.timeStretch" if no_params(&params) => crate::panels::key_dialogs::open_time_stretch(app)?,
-        _ => {
-            if id == "renderQueue.render" && params.get("wait").is_none() {
-                // The UI renders in the background; the panel shows progress.
-                let mut p = params.clone();
-                if let Some(m) = p.as_object_mut() {
-                    m.insert("wait".into(), json!(false));
-                } else {
-                    p = json!({"wait": false});
-                }
-                app.show_panel(PanelKind::RenderQueue);
-                return app.session.execute(id, p).map_err(|e| e.to_string());
-            }
-            if id == "renderQueue.add" {
-                let r = app.session.execute(id, params).map_err(|e| e.to_string());
-                match &r {
-                    Ok(_) => app.show_panel(PanelKind::RenderQueue),
-                    Err(e) => app.ui.status = e.clone(),
-                }
-                return r;
-            }
-            if let Some(r) = file_dialog(app, id, &params) {
-                return r;
-            }
-            if id == "layer.precompose" && params.get("name").is_none() {
-                crate::panels::precomp::open(app, &params)?;
-                return Ok(json!({"dialog": id}));
-            }
-            if crate::panels::dialogs::open_form(app, id, &params) {
-                return Ok(json!({"dialog": id}));
-            }
-            if id == "renderQueue.render" && params.get("wait").is_none() {
-                // The UI renders in the background; the panel shows progress.
-                let mut p = params.clone();
-                if let Some(m) = p.as_object_mut() {
-                    m.insert("wait".into(), json!(false));
-                } else {
-                    p = json!({"wait": false});
-                }
-                app.show_panel(PanelKind::RenderQueue);
-                return app.session.execute(id, p).map_err(|e| e.to_string());
-            }
-            if id == "renderQueue.add" {
-                let r = app.session.execute(id, params).map_err(|e| e.to_string());
-                match &r {
-                    Ok(_) => app.show_panel(PanelKind::RenderQueue),
-                    Err(e) => app.ui.status = e.clone(),
-                }
-                return r;
-            }
-            // An effect added to a layer (Effect menu, Last Effect, dropped on a layer) brings
-            // up Effect Controls on that layer, as in After Effects.
-            if matches!(id, "effect.apply" | "effect.applyLast") {
-                let r = run_engine(app, ctx, id, params.clone());
-                if let Ok(applied) = &r {
-                    crate::panels::effect_controls::reveal_applied(app, &params);
-                    crate::panels::effect_controls::choose_files_after_apply(app, applied);
-                }
-                return r;
-            }
-            // Enabling time remapping twirls its layers open on Time Remap and its two keys.
-            if id == "layer.enableTimeRemap" {
-                let r = run_engine(app, ctx, id, params.clone());
-                if r.as_ref().is_ok_and(|on| on.as_bool() == Some(true)) {
-                    reveal_time_remap(app, &params);
-                }
-                return r;
-            }
-            if id == "layer.rename" && params.get("name").is_none() {
-                crate::panels::timeline::begin_rename(app, ctx);
-                return Ok(Value::Null);
-            }
-            return run_engine(app, ctx, id, params);
-        }
-    }
-    Ok(Value::Null)
-}
-
-/// Run an engine command and perform the frontend events it emitted right away.
-/// Commands that fill the internal clipboard.
-const COPY_COMMANDS: &[&str] =
-    &["edit.copy", "edit.cut", "edit.copyWithPropertyLinks", "edit.copyWithRelativePropertyLinks", "edit.copyExpressionOnly", "keys.copy", "effect.copy"];
-
-/// A line for the system clipboard naming what EffectCraft copied. The system clipboard must
-/// hold something: with nothing on it, the windowing layer sends no paste event for Ctrl+V.
-fn clipboard_note(s: &effectcraft_engine::Session) -> String {
-    let st = &s.state;
-    let n = |n: usize, one: &str, many: &str| format!("EffectCraft: {n} {}", if n == 1 { one } else { many });
-    if st.clip_is_keys && !st.key_clipboard.is_empty() {
-        n(st.key_clipboard.iter().map(|c| c.keys.len()).sum(), "keyframe", "keyframes")
-    } else if !st.effect_clipboard.is_empty() {
-        n(st.effect_clipboard.len(), "effect", "effects")
-    } else if !st.contents_clipboard.is_empty() {
-        n(st.contents_clipboard.len(), "shape item", "shape items")
-    } else if st.link_clipboard.is_some() {
-        "EffectCraft: property links".into()
-    } else {
-        n(st.clipboard.len(), "layer", "layers")
-    }
-}
-
-pub(crate) fn run_engine(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, params: Value) -> Result<Value, String> {
-    // Events already queued belong to earlier invocations (`engine.execute` defers them).
-    let queued = app.session.events.len();
-    let mut r = app.session.execute(id, params).map_err(|e| e.to_string());
-    if let Err(e) = &r {
-        app.ui.status = e.clone();
-    } else if COPY_COMMANDS.contains(&id) && app.session.state.text_edit.is_none() {
-        ctx.copy_text(clipboard_note(&app.session));
-    }
-    let events = app.session.drain_events();
-    for (index, ev) in events.into_iter().enumerate() {
-        match ev {
-            effectcraft_engine::Event::Frontend { command, params } => {
-                if let Err(e) = frontend(app, ctx, &command, params) {
-                    app.ui.status = e.clone();
-                    // A frontend-only command's own failure is the command's result (#696: a
-                    // workspace save that didn't reach disk reported success). An earlier
-                    // invocation's failure only sets the status.
-                    if index >= queued && command == id && r.is_ok() {
-                        r = Err(e);
-                    }
-                }
-            }
-            other => app.session.events.push(other),
-        }
-    }
-    r
-}
-
-fn toggle(slot: &mut bool, p: &Value) -> Value {
-    *slot = p.get("value").and_then(Value::as_bool).unwrap_or(!*slot);
-    json!(*slot)
-}
-
-/// Perform a frontend command (from `Event::Frontend`).
-pub fn frontend(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, p: Value) -> Result<Value, String> {
-    let now = ctx.input(|i| i.time);
-    let v = &mut app.ui.viewer;
-    Ok(match id {
-        "mediaBrowser.copySourcePath" => {
-            let path = p.get("path").and_then(Value::as_str).filter(|path| !path.is_empty()).ok_or("A source path is required")?;
-            ctx.copy_text(path.to_string());
-            json!({"path": path})
-        }
-        "effects.copyPresetsFolderPath" => {
-            if cfg!(target_arch = "wasm32") {
-                return Err("The web app has no local presets folder".into());
-            }
-            let path = crate::panels::effects_presets::presets_dir().filter(|path| !path.as_os_str().is_empty()).ok_or("No presets folder is configured")?;
-            let path = std::path::absolute(path).map_err(|e| format!("Cannot resolve the presets folder path: {e}"))?;
-            let path = path.to_str().ok_or("The presets folder path is not valid UTF-8")?;
-            ctx.copy_text(path.to_string());
-            json!({"path": path})
-        }
-        "app.about" => {
-            app.dialog = Some(crate::Dialog::About);
-            Value::Null
-        }
-        // Window ▸ <ScriptUI panel>: dock (or bring forward) the panel the script built.
-        // Audio scrubbing: one frame of audio at `time` (default the current time).
-        "playback.scrubAudio" => {
-            let cid = app.session.active_comp_id().ok_or("no composition")?;
-            let t = p.get("time").and_then(Value::as_f64).map_or(app.session.time(), effectcraft_engine::time::Tick::from_seconds_f64);
-            app.scrub_audio(cid, t, now);
-            json!({"playing": app.scrub.is_some()})
-        }
-        // View ▸ New Viewer.
-        "view.newViewer" => json!({"viewer": crate::panels::viewers::new_viewer(app)}),
-        // Run by id (control channel, MCP): the Project panel's selection, whatever has focus.
-        "project.deleteWithoutConfirmation" => crate::panels::delete_items::delete_confirmed(app, ctx, json!({}))?,
-        // A gradient property's "Edit Gradient…" (the Timeline's value): the Gradient Editor.
-        "prop.editGradient" => crate::panels::gradient_editor::open(app, &p)?,
-        "window.scriptPanel" => {
-            let id = p.get("window").and_then(Value::as_u64).ok_or("no ScriptUI panel window")? as u32;
-            app.show_panel(PanelKind::ScriptPanel(id));
-            json!({"window": id})
-        }
-        "layer.style.options" => {
-            crate::panels::layer_styles_dialog::open(app, &p)?;
-            Value::Null
-        }
-        "app.settings" => {
-            let page = p.get("page").and_then(Value::as_str).unwrap_or("general");
-            crate::panels::settings::open(app, effectcraft_engine::prefs::page_id(page).unwrap_or("general"));
-            Value::Null
-        }
-        "app.gpuInfo" => {
-            crate::panels::dialogs::info(
-                app,
-                "GPU Information",
-                &format!(
-                    "{}Layer cache: {} MB  •  Preview cache: {} MB.",
-                    effectcraft_engine::sysinfo::gpu_summary(&app.session),
-                    app.session.layer_cache.budget() >> 20,
-                    app.frames.budget() >> 20
-                ),
-            );
-            Value::Null
-        }
-        "app.hide" | "app.hideOthers" | "app.showAll" => {
-            // The desktop app asks macOS (NSApplication hide / hideOtherApplications /
-            // unhideAllApplications); elsewhere Hide minimizes and the others don't apply.
-            if app.hooks.app_action.as_ref().is_some_and(|f| f(id)) {
-                return Ok(Value::Null);
-            }
-            match id {
-                "app.hide" => ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(true)),
-                _ => return Err(format!("`{id}` is only available on macOS")),
-            }
-            Value::Null
-        }
-        "app.quit" => {
-            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
-            Value::Null
-        }
-        "app.commandPalette" => {
-            app.dialog_state.palette_query = p.get("query").and_then(Value::as_str).unwrap_or_default().to_string();
-            app.dialog_state.palette_sel = 0;
-            app.dialog = Some(crate::Dialog::CommandPalette);
-            Value::Null
-        }
-        "app.keyboardShortcuts" => {
-            crate::panels::shortcut_editor::open(app);
-            Value::Null
-        }
-        "app.templates" => {
-            let kind = p.get("kind").and_then(Value::as_str).unwrap_or("renderSettings");
-            crate::panels::rq_templates::open(app, ctx, kind);
-            Value::Null
-        }
-        "renderQueue.notify" => {
-            // Render finished with Notify on: a toast, the dock/taskbar attention request, and the
-            // host's system sound (the desktop app handles `renderQueue.notify`).
-            let msg = p.get("message").and_then(Value::as_str).unwrap_or("Render finished").to_string();
-            app.toast = Some((msg, now));
-            ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Informational));
-            if let Some(f) = app.hooks.app_action.as_ref() {
-                f("renderQueue.notify");
-            }
-            Value::Null
-        }
-        "app.find" => {
-            if let Some(q) = p.get("query").and_then(Value::as_str) {
-                app.ui.project_search = q.to_string();
-            }
-            app.show_panel(PanelKind::Project);
-            Value::Null
-        }
-        "playback.toggle" => {
-            // The play button and Spacebar: `{shortcut?}` picks which Preview panel shortcut's
-            // options to play with (default Spacebar).
-            let sc = match p.get("shortcut").and_then(Value::as_str) {
-                Some(k) => effectcraft_engine::preview::PreviewShortcut::parse(k).ok_or_else(|| format!("unknown preview shortcut `{k}`"))?,
-                None => effectcraft_engine::preview::PreviewShortcut::Spacebar,
-            };
-            app.toggle_play_with(now, sc);
-            json!({"playing": app.playback.playing, "shortcut": sc.id()})
-        }
-        "playback.cacheWhenIdle" => {
-            let r = toggle(&mut app.ui.cache_when_idle, &p);
-            app.set_pref("previews.cacheFramesWhenIdle", r.clone())?;
-            r
-        }
-        "playback.audio" => {
-            // Include Audio of the shortcut shown in the Preview panel.
-            let mut on = app.session.prefs.preview.active().include_audio;
-            let r = toggle(&mut on, &p);
-            app.session.execute("playback.settings.set", json!({"includeAudio": on})).map_err(|e| e.to_string())?;
-            if !on {
-                app.audio = None;
-            }
-            r
-        }
-        // Zoom In / Zoom Out act on the focused viewer: the Layer panel when it has focus, else
-        // the Composition viewer.
-        "view.zoomIn" | "view.zoomOut" if app.ui.focused == PanelKind::Layer => {
-            let cur = app.ui.layer_zoom.unwrap_or_else(|| crate::panels::layer_panel::last_fit(ctx));
-            // The Layer panel zooms in points (pixels-per-point 1).
-            let next = zoom_step(cur, 1.0, id == "view.zoomIn");
-            app.ui.layer_zoom = Some(next);
-            json!({"zoom": next, "panel": "layer"})
-        }
-        "view.zoomIn" | "view.zoomOut" => {
-            let ppp = ctx.pixels_per_point();
-            let cur = v.zoom.unwrap_or_else(|| crate::panels::viewer::last_fit(ctx));
-            let next = zoom_step(cur, ppp, id == "view.zoomIn");
-            v.zoom = Some(next);
-            json!({"zoom": next})
-        }
-        // View ▸ Resolution ▸ Custom without a factor (the engine sets the comp's resolution).
-        "view.res.custom" => {
-            let cur = match app.viewer_res() {
-                Resolution::Custom(n) => f64::from(n),
-                _ => 2.0,
-            };
-            crate::panels::dialogs::form(
-                app,
-                "Custom Resolution",
-                "view.res.custom",
-                json!({}),
-                vec![crate::panels::dialogs::Field::num("factor", "Render every n-th pixel", cur)],
-            );
-            Value::Null
-        }
-        "view.rulers" => toggle(&mut v.rulers, &p),
-        "view.guides" => toggle(&mut v.guides, &p),
-        "view.snapToGuides" => toggle(&mut v.snap_guides, &p),
-        "view.lockGuides" => toggle(&mut v.lock_guides, &p),
-        "view.grid" => toggle(&mut v.grid, &p),
-        "view.snapToGrid" => toggle(&mut v.snap_grid, &p),
-        "view.layerControls" => toggle(&mut v.show_layer_controls, &p),
-        "view.options" => {
-            app.dialog = Some(crate::Dialog::ViewOptions);
-            Value::Null
-        }
-        "view.panelBackground" => {
-            if p.get("pick").and_then(Value::as_bool) == Some(true) {
-                let [r, g, b] = v.custom_pasteboard;
-                crate::panels::dialogs::form(
-                    app,
-                    "Panel Background Color",
-                    "view.panelBackground",
-                    json!({}),
-                    vec![crate::panels::dialogs::Field::text("color", "Color (#rrggbb)", &format!("#{r:02x}{g:02x}{b:02x}"))],
-                );
-                return Ok(Value::Null);
-            }
-            let c = p.get("color").and_then(Value::as_str).unwrap_or("mediumGray");
-            v.pasteboard = match c {
-                "black" => Some([0, 0, 0]),
-                "darkGray" => Some([0x2a, 0x2a, 0x2a]),
-                "mediumGray" => None,
-                "lightGray" => Some([0xb4, 0xb4, 0xb4]),
-                "white" => Some([0xff, 0xff, 0xff]),
-                "custom" => Some(v.custom_pasteboard),
-                hex => {
-                    let c = effectcraft_engine::color::Rgba::from_hex(hex).ok_or_else(|| format!("unknown colour `{hex}`"))?;
-                    let rgb = [(c.r * 255.0).round() as u8, (c.g * 255.0).round() as u8, (c.b * 255.0).round() as u8];
-                    v.custom_pasteboard = rgb;
-                    Some(rgb)
-                }
-            };
-            Value::Null
-        }
-        // Ctrl+\ / Cmd+\, as in After Effects (#336): `{maximized}`, the window's new state.
-        "window.maximizeApp" => {
-            let maximized = !ctx.input(|i| i.viewport().maximized.unwrap_or(false));
-            ctx.send_viewport_cmd(egui::ViewportCommand::Maximized(maximized));
-            json!({"maximized": maximized})
-        }
-        "view.fullScreen" => {
-            let full = ctx.input(|i| i.viewport().fullscreen.unwrap_or(false));
-            ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(!full));
-            json!(!full)
-        }
-        "window.panel" => {
-            let name = p.get("panel").and_then(Value::as_str).unwrap_or_default();
-            if name.eq_ignore_ascii_case("tools") {
-                app.ui.status = "The Tools panel is the toolbar in the header".into();
-                return Ok(Value::Null);
-            }
-            let panel = PanelKind::from_name(name).ok_or_else(|| format!("unknown panel `{name}`"))?;
-            app.show_panel(panel);
-            Value::Null
-        }
-        "window.workspace" => {
-            let want = p.get("name").and_then(Value::as_str).unwrap_or("Default").to_ascii_lowercase().replace(' ', "");
-            let name = app
-                .workspace_names()
-                .into_iter()
-                .find(|w| w.to_ascii_lowercase().replace(' ', "") == want)
-                .ok_or_else(|| format!("unknown workspace `{want}`"))?;
-            app.set_workspace(&name);
-            json!({"workspace": name})
-        }
-        "window.resetWorkspace" => {
-            let name = app.ui.workspace.clone();
-            app.set_workspace(&name);
-            Value::Null
-        }
-        "window.saveWorkspace" => {
-            let name = app.ui.workspace.clone();
-            app.ui.saved_workspaces.insert(name.clone(), app.ui.dock.clone());
-            app.ui.saved_floating.insert(name.clone(), app.ui.floating.clone());
-            app.store_saved_workspaces()?;
-            json!({"workspace": name})
-        }
-        "window.saveWorkspaceAs" => {
-            let Some(name) = p.get("name").and_then(Value::as_str).map(str::trim).filter(|n| !n.is_empty()).map(str::to_string) else {
-                crate::panels::dialogs::form(
-                    app,
-                    "New Workspace",
-                    "window.saveWorkspaceAs",
-                    json!({}),
-                    vec![crate::panels::dialogs::Field::text("name", "Name", "Untitled Workspace")],
-                );
-                return Ok(Value::Null);
-            };
-            app.ui.saved_workspaces.insert(name.clone(), app.ui.dock.clone());
-            app.ui.saved_floating.insert(name.clone(), app.ui.floating.clone());
-            app.ui.workspace = name.clone();
-            app.store_saved_workspaces()?;
-            json!({"workspace": name})
-        }
-        "window.editWorkspaces" => {
-            let Some(name) = p.get("name").and_then(Value::as_str).map(str::to_string) else {
-                let cur = app.ui.workspace.clone();
-                crate::panels::dialogs::form(
-                    app,
-                    "Edit Workspaces",
-                    "window.editWorkspaces",
-                    json!({}),
-                    vec![
-                        crate::panels::dialogs::Field::text("name", "Workspace", &cur),
-                        crate::panels::dialogs::Field::text("rename", "Rename to", &cur),
-                        crate::panels::dialogs::Field::bool("delete", "Delete", false),
-                    ],
-                );
-                return Ok(Value::Null);
-            };
-            let builtin = crate::dock::WORKSPACES.contains(&name.as_str());
-            if p.get("delete").and_then(Value::as_bool) == Some(true) {
-                app.ui.saved_floating.remove(&name);
-                if app.ui.saved_workspaces.remove(&name).is_none() && !builtin {
-                    return Err(format!("no workspace `{name}`"));
-                }
-                // Leave the deleted workspace first: a current workspace needs a definition.
-                if app.ui.workspace == name {
-                    app.set_workspace("Default");
-                }
-                app.store_saved_workspaces()?;
-                return Ok(json!({"deleted": name}));
-            }
-            if let Some(new) = p.get("rename").and_then(Value::as_str).map(str::trim).filter(|n| !n.is_empty() && *n != name) {
-                if builtin {
-                    return Err(format!("`{name}` is a built-in workspace: save it as a new workspace instead"));
-                }
-                let dock = app.ui.saved_workspaces.remove(&name).ok_or_else(|| format!("no workspace `{name}`"))?;
-                app.ui.saved_workspaces.insert(new.to_string(), dock);
-                if let Some(f) = app.ui.saved_floating.remove(&name) {
-                    app.ui.saved_floating.insert(new.to_string(), f);
-                }
-                if app.ui.workspace == name {
-                    app.ui.workspace = new.to_string();
-                }
-                app.store_saved_workspaces()?;
-                return Ok(json!({"renamed": new}));
-            }
-            json!({"workspaces": app.workspace_names()})
-        }
-        "view.lookAt" => {
-            let r: Vec<f64> = p.get("rect").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
-            if r.len() == 4 {
-                let map: Option<crate::panels::viewer::ViewerMap> = ctx.data(|d| d.get_temp(egui::Id::new("viewer-map")));
-                if let Some(m) = map {
-                    let (rw, rh) = (((r[2] - r[0]) as f32).max(1.0), ((r[3] - r[1]) as f32).max(1.0));
-                    let zoom = ((m.area.width() - 40.0) / rw).min((m.area.height() - 40.0) / rh).clamp(0.015, 32.0);
-                    let rc = [(r[0] + r[2]) as f32 / 2.0, (r[1] + r[3]) as f32 / 2.0];
-                    let v = &mut app.ui.viewer;
-                    v.zoom = Some(zoom);
-                    v.pan = [m.comp[0] * zoom / 2.0 - rc[0] * zoom, m.comp[1] * zoom / 2.0 - rc[1] * zoom];
-                }
-            }
-            Value::Null
-        }
-        "comp.flowchart" => {
-            // Chart the active comp; Layer ▸ Reveal ▸ Reveal Layer in Project Flowchart shows
-            // layers and selects the layer's node.
-            app.ui.flowchart.root = app.session.active_comp_id().map(|c| c.0);
-            if let (Some(c), Some(l)) = (app.session.active_comp_id(), app.session.state.selected_layers.first()) {
-                app.ui.flowchart.layers = true;
-                app.ui.flowchart.selected = Some(format!("layer:{}:{}", c.0, l.0));
-            }
-            app.show_panel(PanelKind::Flowchart);
-            Value::Null
-        }
-        "comp.miniFlowchart" => {
-            let at = ctx.input(|i| i.pointer.hover_pos()).unwrap_or_else(|| ctx.content_rect().center());
-            app.ui.mini_flowchart = Some([at.x, at.y]);
-            Value::Null
-        }
-        "track.editTargetDialog" => {
-            crate::panels::tracker::open_target(app)?;
-            Value::Null
-        }
-        "track.optionsDialog" => {
-            crate::panels::tracker::open_options(app)?;
-            Value::Null
-        }
-        "layer.openLayer" => {
-            let id = p.get("layer").and_then(Value::as_u64).or_else(|| app.session.state.selected_layers.first().map(|l| l.0));
-            // Another layer opens at Fit.
-            if id != app.ui.layer_panel {
-                app.ui.layer_zoom = None;
-                app.ui.layer_pan = [0.0, 0.0];
-            }
-            app.ui.layer_panel = id;
-            app.ui.layer_view = None;
-            app.show_panel(PanelKind::Layer);
-            Value::Null
-        }
-        "app.confirmExecute" => {
-            // Settings ▸ Scripting ▸ Warn User When Executing Files.
-            let path = p.get("path").and_then(Value::as_str).unwrap_or_default().to_string();
-            crate::panels::forms::form(
-                app,
-                "A script wants to open a file",
-                "file.executeFile",
-                json!({"path": path, "confirmed": true}),
-                vec![crate::panels::forms::Field::text("path", "Open", &path)],
-            );
-            Value::Null
-        }
-        "app.showReport" => {
-            let title = p.get("title").and_then(Value::as_str).unwrap_or("Report").to_string();
-            let text = p.get("text").and_then(Value::as_str).unwrap_or_default().to_string();
-            crate::panels::dialogs::info(app, &title, &text);
-            Value::Null
-        }
-        "window.assignWorkspaceShortcut" => {
-            let mut q = p.clone();
-            q["workspace"] = json!(app.ui.workspace);
-            return run_engine(app, ctx, "window.assignWorkspaceShortcut", q);
-        }
-        "file.interpretFootage" => {
-            // Import ▸ Interpret Unlabeled Alpha As: Ask User.
-            if let Some(i) = p.get("item").and_then(Value::as_u64) {
-                app.session.state.project_selection = vec![effectcraft_engine::project::ItemId(i)];
-            }
-            crate::panels::dialogs::open_form(app, "file.interpretFootage", &json!({}));
-            Value::Null
-        }
-        // Help ▸ In-App Tutorials: the Home screen's Learn tab.
-        "help.inAppTutorials" => {
-            app.ui.start_screen = true;
-            app.ui.home_learn = true;
-            app.ui.home_templates = false;
-            Value::Null
-        }
-        // File ▸ New ▸ New Project from Template…: the Home screen's Templates tab.
-        "file.newFromTemplate" => {
-            app.ui.start_screen = true;
-            app.ui.home_learn = false;
-            app.ui.home_templates = true;
-            Value::Null
-        }
-        "effect.manage" | "anim.browsePresets" => {
-            app.show_panel(PanelKind::EffectsPresets);
-            Value::Null
-        }
-        "timeline.revealProps" => {
-            let props = p.get("props").and_then(Value::as_array).cloned().unwrap_or_default();
-            let uids = |k: &str| -> Vec<u64> { props.iter().filter_map(|x| x.get(k).and_then(Value::as_u64)).collect() };
-            let (found, with_props) = (uids("prop"), uids("layer"));
-            // The layers it looked at (`layers`), else those it found something on. Layers that
-            // have nothing to show close; the others' reveals stay.
-            let targets: Vec<u64> = match p.get("layers").and_then(Value::as_array) {
-                Some(l) => l.iter().filter_map(Value::as_u64).collect(),
-                None => with_props.clone(),
-            };
-            // The targets' earlier picks go (U after UU shows the keyframed ones only).
-            let comp = app.session.active_comp_arc();
-            let theirs = |u: u64| {
-                comp.as_ref().is_some_and(|c| {
-                    targets
-                        .iter()
-                        .filter_map(|l| c.layer(effectcraft_engine::project::LayerId(*l)))
-                        .any(|l| l.props.find(u).is_some() || l.props.find_group(u).is_some())
-                })
-            };
-            let tl = &mut app.ui.timeline;
-            tl.reveal_props.retain(|u| !theirs(*u));
-            tl.reveal_props.extend(found.iter().copied());
-            let (shown, hidden): (Vec<u64>, Vec<u64>) = targets.into_iter().partition(|l| with_props.contains(l));
-            tl.apply_reveal(&hidden, vec![]);
-            if !shown.is_empty() {
-                tl.apply_reveal(&shown, vec!["props".into()]);
-            }
-            // Properties inside effects (puppet pins…) show under their effect, twirled open.
-            for (layer, prop) in props.iter().filter_map(|x| Some((x.get("layer")?.as_u64()?, x.get("prop")?.as_u64()?))) {
-                crate::panels::timeline::open_effect_paths(app, layer, &[prop]);
-            }
-            json!({"revealed": found.len()})
-        }
-        _ => return Err(format!("`{id}` is not a frontend command")),
-    })
-}
-
-/// Commands that need a file or folder path: ask the host's file dialog when `params` lacks one.
-fn file_dialog(app: &mut EffectcraftApp, id: &str, params: &Value) -> Option<Result<Value, String>> {
-    enum Ask {
-        Folder,
-        Import,
-        OpenProject,
-        Save(&'static str),
-        Open(&'static [&'static str]),
-    }
-    let (key, ask) = match id {
-        "file.import" | "file.importMultiple" => ("paths", Ask::Import),
-        "file.open" => ("path", Ask::OpenProject),
-        "file.save" if app.session.path.is_none() => ("path", Ask::Save("Untitled Project.ecproj")),
-        "file.saveAs" | "file.saveCopy" => ("path", Ask::Save("Untitled Project.ecproj")),
-        "comp.saveFrameAs" => ("path", Ask::Save("Frame.png")),
-        "comp.saveFrameAsPsd" => ("path", Ask::Save("Frame.psd")),
-        "comp.saveFrameAsExr" => ("path", Ask::Save("Frame.exr")),
-        "file.watchFolder" if params.get("stop").is_none() => ("folder", Ask::Save("Watch Folder")),
-        "anim.savePreset" => ("path", Ask::Save("Preset.ecpreset")),
-        "anim.applyPreset" => ("path", Ask::Open(&["ecpreset", "json"])),
-        "view.exportGuides" => ("path", Ask::Save("Guides.json")),
-        "view.importGuides" => ("path", Ask::Open(&["json"])),
-        "file.exportLottie" => ("path", Ask::Save("Animation.json")),
-        "file.importLottie" => ("path", Ask::Open(&["json", "lottie"])),
-        "file.importProject" => ("path", Ask::Open(&["ecproj", "ecprojx"])),
-        "file.importTimeline" => ("path", Ask::Open(&["xml", "fcpxml", "otio", "edl", "aaf", "omf"])),
-        "render.saveCurrentPreview" => ("path", Ask::Save("Preview.mp4")),
-        "file.runScript" if params.get("name").is_none() => ("path", Ask::Open(&["jsx", "js", "jsonl", "json", "txt"])),
-        "file.installScript" | "file.installScriptUIPanel" => ("path", Ask::Open(&["jsx", "js"])),
-        "effect.plugins.load" if params.get("folder").is_none() => ("path", Ask::Open(&["wasm", "wat"])),
-        "file.replaceFootage" => ("path", Ask::Import),
-        "file.relinkFootage" => ("folder", Ask::Folder),
-        "file.collectFiles" => ("folder", Ask::Save("Collected Files")),
-        "file.saveCopyAsXml" => ("path", Ask::Save("Untitled Project.ecprojx")),
-        "keys.rpfCameraImport" => ("path", Ask::Open(&["json", "csv", "txt"])),
-        "essential.exportTemplate" => ("path", Ask::Save("Template.ectemplate")),
-        "essential.importTemplate" => ("path", Ask::Open(&["ectemplate"])),
-        "file.setProxy" => {
-            ("path", Ask::Open(&["mp4", "mov", "m4v", "mkv", "webm", "mxf", "png", "jpg", "jpeg", "gif", "webp", "tif", "tiff", "bmp", "tga", "exr"]))
-        }
-        _ => return None,
-    };
-    if params.get(key).is_some()
-        || params.get("path").is_some()
-        || params.get("paths").is_some()
-        || params.get("steps").is_some()
-        || params.get("preset").is_some()
-    {
-        return None;
-    }
-    const MEDIA: &[&str] = &[
-        "mp4", "mov", "m4v", "mkv", "webm", "mxf", "png", "jpg", "jpeg", "gif", "webp", "tif", "tiff", "bmp", "exr", "dpx", "cin", "wav", "aif", "aiff", "mp3",
-        "flac", "ogg", "opus", "svg", "pdf", "ai", "eps", "psd", "psb", "tga", "hdr", "gltf", "glb", "obj", "stl", "fbx", "json", "csv", "tsv",
-    ];
-    // A host whose blocking dialogs are unsafe inside this frame shows the dialog without
-    // blocking — macOS: the nested event loop re-entered winit's handler on a drag over the
-    // window and aborted the app (#511); Linux: the desktop portal's answer never gets pumped,
-    // so the compositor marks the window as not responding (#1275) — and the command continues
-    // when the answer arrives.
-    if let Some(spawn) = app.hooks.file_dialog_async.as_ref() {
-        let request = match ask {
-            Ask::Folder => crate::FileDialog::Folder,
-            Ask::Import => crate::FileDialog::Open { exts: MEDIA.iter().map(|e| e.to_string()).collect(), many: key == "paths" },
-            Ask::OpenProject => crate::FileDialog::OpenProject,
-            Ask::Open(exts) => crate::FileDialog::Open { exts: exts.iter().map(|e| e.to_string()).collect(), many: false },
-            Ask::Save(default) => crate::FileDialog::save(default),
-        };
-        let tx = app.dialog_answers.0.clone();
-        let answer = crate::DialogAnswer { command: id.to_string(), key, params: params.clone(), paths: Vec::new() };
-        spawn(
-            request,
-            Box::new(move |paths| {
-                let _ = tx.send(crate::DialogAnswer { paths, ..answer });
-            }),
-        );
-        return Some(Ok(json!({"dialog": id})));
-    }
-    let picked: Option<Value> = match ask {
-        Ask::Folder => {
-            let Some(f) = app.hooks.pick_folder.as_ref() else { return Some(Err("no folder dialog available (pass `folder`)".into())) };
-            f().map(Value::from)
-        }
-        Ask::Import => {
-            let Some(f) = app.hooks.pick_files.as_ref() else { return Some(Err("no file dialog available (pass `paths`)".into())) };
-            picked_value(key, f(MEDIA))
-        }
-        Ask::OpenProject => {
-            let Some(f) = app.hooks.pick_open_project.as_ref() else { return Some(Err("no file dialog available (pass `path`)".into())) };
-            f().map(|s| json!(s))
-        }
-        Ask::Open(exts) => {
-            let Some(f) = app.hooks.pick_files.as_ref() else { return Some(Err("no file dialog available (pass `path`)".into())) };
-            f(exts).first().map(|s| json!(s))
-        }
-        Ask::Save(default) => {
-            let Some(picked) = app.hooks.save_dialog(default) else { return Some(Err("no file dialog available (pass `path`)".into())) };
-            picked.map(|s| json!(s))
-        }
-    };
-    let Some(v) = picked else { return Some(Ok(Value::Null)) };
-    Some(run_with_picked(app, id, key, params, v))
-}
-
-/// The dialog's answer as the command's `key` parameter (`None`: cancelled).
-fn picked_value(key: &str, paths: Vec<String>) -> Option<Value> {
-    match (paths.is_empty(), key) {
-        (true, _) => None,
-        (false, "paths") => Some(json!(paths)),
-        (false, _) => paths.into_iter().next().map(Value::from),
-    }
-}
-
-/// A file dialog shown without blocking ([`crate::Hooks::file_dialog_async`]) answered: run its
-/// command with the picked path (nothing when it was cancelled).
-pub(crate) fn dialog_answered(app: &mut EffectcraftApp, answer: crate::DialogAnswer) {
-    let Some(v) = picked_value(answer.key, answer.paths) else { return };
-    if let Err(e) = run_with_picked(app, &answer.command, answer.key, &answer.params, v) {
-        app.ui.status = e;
-    }
-}
-
-/// Run command `id` with the path picked for it in parameter `key`.
-fn run_with_picked(app: &mut EffectcraftApp, id: &str, key: &str, params: &Value, v: Value) -> Result<Value, String> {
-    let mut p = params.as_object().cloned().unwrap_or_default();
-    p.insert(key.to_string(), v);
-    // Picked files import in the background, with the Importing card showing progress (#270).
-    if matches!(id, "file.import" | "file.importMultiple") {
-        p.insert("background".into(), Value::Bool(true));
-    }
-    // Photoshop files ask how to import them first; numbered stills whether to import them as an
-    // image sequence.
-    let picked = Value::Object(p.clone());
-    if id == "file.import" && crate::panels::dialogs::open_form(app, id, &picked)
-        || matches!(id, "file.import" | "file.importMultiple") && crate::panels::forms::open_import_sequence(app, &picked)
-    {
-        return Ok(json!({"dialog": id}));
-    }
-    // Save (untitled) becomes Save As.
-    let id = if id == "file.save" { "file.saveAs" } else { id };
-    let r = app.session.execute(id, Value::Object(p)).map_err(|e| e.to_string());
-    if let Err(e) = &r {
-        app.ui.status = e.clone();
-    }
-    r
-}
-
-/// A menu entry for display / `ui.menu.list`.
-#[derive(Clone, Debug, serde::Serialize)]
-pub struct MenuItem {
-    pub id: String,
-    pub label: String,
-    pub path: Vec<String>,
-    pub shortcut: Option<String>,
-    pub enabled: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub checked: Option<bool>,
-    /// Parameters bound to the entry (e.g. the effect for Effect menu items).
-    #[serde(skip_serializing_if = "Value::is_null")]
-    pub params: Value,
-}
-
-/// Top-level menus in order.
-pub fn menus() -> Vec<&'static str> {
-    effectcraft_engine::menus::top_level()
-}
-
-pub(crate) fn entry_label(app: &EffectcraftApp, e: &MenuEntry) -> String {
-    let shown = match e.command.as_str() {
-        "edit.undo" => app.session.history.undo.last().map(|u| format!("Undo {}", u.0)).unwrap_or_else(|| "Can't Undo".into()),
-        "edit.redo" => app.session.history.redo.last().map(|u| format!("Redo {}", u.0)).unwrap_or_else(|| "Can't Redo".into()),
-        // Window ▸ Layer: the layer open in the Layer panel.
-        "window.panel" if e.params.get("panel").and_then(Value::as_str) == Some("layer") => {
-            let name = app
-                .ui
-                .layer_panel
-                .and_then(|id| app.session.active_comp().and_then(|c| c.layer(effectcraft_engine::project::LayerId(id))))
-                .map(|l| l.name.clone());
-            format!("Layer: {}", name.unwrap_or_else(|| "(none)".into()))
-        }
-        _ => effectcraft_engine::menus::entry_label(&app.session, e),
-    };
-    crate::i18n::entry(app, e, shown)
-}
-
-/// The entry's shortcut in the active keyboard shortcut preset.
-pub(crate) fn entry_shortcut(app: &EffectcraftApp, e: &MenuEntry) -> Option<String> {
-    app.session.shortcuts().shortcut_of(&e.command, &e.params).map(str::to_string)
-}
-
-/// Whether panel `p` is on screen: the front tab of a floating window, or of a docked group
-/// (an open frame in a stack) that a maximized panel does not cover.
-pub(crate) fn panel_shown(app: &EffectcraftApp, p: PanelKind) -> bool {
-    if app.ui.floating.iter().any(|f| f.panels.get(f.active) == Some(&p)) {
-        return true;
-    }
-    match app.ui.maximized.filter(|m| app.ui.dock.contains(*m)) {
-        Some(m) => m == p,
-        None => app.ui.dock.is_visible(p),
-    }
-}
-
-/// The command a menu entry runs when chosen from a menu: Window ▸ <panel> closes a panel whose
-/// entry is checked, as in After Effects (#1630). Shortcuts and agents calling `window.panel`
-/// still only show the panel.
-pub(crate) fn menu_choice(app: &EffectcraftApp, id: String, params: Value) -> (String, Value) {
-    if id == "window.panel"
-        && let Some(p) = params.get("panel").and_then(Value::as_str).and_then(PanelKind::from_name)
-        && panel_shown(app, p)
-    {
-        return ("window.closePanel".into(), params);
-    }
-    (id, params)
-}
-
-/// Check-mark state of frontend toggles (engine state is answered by the engine).
-pub(crate) fn entry_checked(app: &EffectcraftApp, e: &MenuEntry) -> Option<bool> {
-    let v = &app.ui.viewer;
-    let pstr = |k: &str| e.params.get(k).and_then(Value::as_str);
-    match e.command.as_str() {
-        "view.rulers" => Some(v.rulers),
-        "view.guides" => Some(v.guides),
-        "view.snapToGuides" => Some(v.snap_guides),
-        "view.lockGuides" => Some(v.lock_guides),
-        "view.grid" => Some(v.grid),
-        "view.snapToGrid" => Some(v.snap_grid),
-        "view.layerControls" => Some(v.show_layer_controls),
-        "playback.cacheWhenIdle" => Some(app.ui.cache_when_idle),
-        "playback.audio" => Some(app.session.prefs.preview.active().include_audio),
-        "window.workspace" => Some(pstr("name").is_some_and(|n| n == app.ui.workspace)),
-        // The Tools panel is the header toolbar: always on screen.
-        "window.panel" => Some(pstr("panel").is_some_and(|n| n.eq_ignore_ascii_case("tools") || PanelKind::from_name(n).is_some_and(|p| panel_shown(app, p)))),
-        "view.panelBackground" if e.params.get("pick").is_none() => {
-            let cur = match v.pasteboard {
-                None => "mediumGray",
-                Some([0, 0, 0]) => "black",
-                Some([0x2a, 0x2a, 0x2a]) => "darkGray",
-                Some([0xb4, 0xb4, 0xb4]) => "lightGray",
-                Some([0xff, 0xff, 0xff]) => "white",
-                Some(_) => "custom",
-            };
-            Some(pstr("color") == Some(cur))
-        }
-        _ => effectcraft_engine::menus::checked(&app.session, &e.command, &e.params),
-    }
-}
-
-pub(crate) fn entry_enabled(app: &EffectcraftApp, e: &MenuEntry) -> bool {
-    if app.ui.focused == PanelKind::Project {
-        match e.command.as_str() {
-            "edit.duplicate" => {
-                return !app.session.state.project_selection.is_empty()
-                    && app.session.state.project_selection.iter().all(|id| app.session.project.item(*id).is_some_and(|i| !i.is_folder()));
-            }
-            "edit.selectAll" => return !app.session.project.items.is_empty(),
-            "edit.deselectAll" => return !app.session.state.project_selection.is_empty(),
-            "edit.cut" | "edit.copy" | "edit.paste" | "edit.copyWithPropertyLinks" | "edit.copyWithRelativePropertyLinks" | "edit.copyExpressionOnly" => {
-                return false;
-            }
-            _ => {}
-        }
-    }
-    if e.command == "edit.clear" && app.ui.focused == PanelKind::Project {
-        return app.session.is_enabled("project.delete");
-    }
-    if e.command == "edit.clear" && app.ui.focused == PanelKind::RenderQueue {
-        return !app.session.is_rendering() && !app.session.project.render_queue.is_empty();
-    }
-    if e.command == "window.panel" {
-        return true;
-    }
-    app.session.is_enabled(&e.command)
-}
-
-/// Every menu entry, flattened with its submenu path.
-pub fn menu_items(app: &EffectcraftApp) -> Vec<MenuItem> {
-    effectcraft_engine::menus::entries()
-        .into_iter()
-        .map(|(path, e)| MenuItem {
-            id: e.command.clone(),
-            label: entry_label(app, e),
-            path,
-            shortcut: entry_shortcut(app, e),
-            enabled: entry_enabled(app, e),
-            checked: entry_checked(app, e),
-            params: e.params.clone(),
-        })
-        .collect()
-}
-
-/// Shortcut text in this OS's notation (`⇧⌘K` on macOS, `Ctrl+Shift+K` elsewhere).
-pub fn shortcut_text(s: &str) -> String {
-    if cfg!(target_os = "macos") {
-        let mut out = String::new();
-        let parts: Vec<&str> = match s.strip_suffix("++") {
-            Some(head) => vec![head, "+"],
-            None => s.split('+').collect(),
-        };
-        let (mods, key) = parts.split_at(parts.len().saturating_sub(1));
-        for m in mods {
-            out.push_str(match *m {
-                "Ctrl" => "⌃",
-                "Alt" => "⌥",
-                "Shift" => "⇧",
-                "Cmd" => "⌘",
-                x => x,
-            });
-        }
-        out.push_str(match key.first().copied().unwrap_or("") {
-            "Space" => "Space",
-            "Escape" => "Esc",
-            "Home" => "↖",
-            k => k,
-        });
-        out
-    } else {
-        s.replace("Cmd", "Ctrl")
-    }
-}
-
-/// Parse "Cmd+Shift+K" into modifiers + key.
-pub fn parse_shortcut(s: &str) -> Option<(egui::Modifiers, egui::Key)> {
-    let mut m = egui::Modifiers::NONE;
-    let mut key = None;
-    // The plus key itself is written `+` or `Cmd++`.
-    let (head, plus) = match s.strip_suffix("++") {
-        Some(h) => (h, true),
-        None if s == "+" => ("", true),
-        None => (s, false),
-    };
-    let mut parts: Vec<&str> = if head.is_empty() { vec![] } else { head.split('+').collect() };
-    if plus {
-        parts.push("+");
-    }
-    for p in parts {
-        match p {
-            "Cmd" => {
-                m.command = true;
-                m.mac_cmd = cfg!(target_os = "macos");
-                if !cfg!(target_os = "macos") {
-                    m.ctrl = true;
-                }
-            }
-            "Physical" => {}
-            "Shift" => m.shift = true,
-            "Alt" => m.alt = true,
-            "Ctrl" => m.ctrl = true,
-            k => {
-                key = match k {
-                    ";" => Some(egui::Key::Semicolon),
-                    "'" => Some(egui::Key::Quote),
-                    "," => Some(egui::Key::Comma),
-                    "." => Some(egui::Key::Period),
-                    "/" => Some(egui::Key::Slash),
-                    "\\" => Some(egui::Key::Backslash),
-                    "=" => Some(egui::Key::Equals),
-                    "-" => Some(egui::Key::Minus),
-                    "`" => Some(egui::Key::Backtick),
-                    "[" => Some(egui::Key::OpenBracket),
-                    "]" => Some(egui::Key::CloseBracket),
-                    "Num0" => Some(egui::Key::Num0),
-                    "Num*" => None,
-                    _ => egui::Key::from_name(k),
-                }
-            }
-        }
-    }
-    key.map(|k| (m, k))
-}
-
-/// The key some keyboards report for a shifted punctuation key (`Shift+=` arrives as `+`).
-fn shifted_alias(k: egui::Key) -> Option<egui::Key> {
-    use egui::Key::*;
-    Some(match k {
-        Equals => Plus,
-        Semicolon => Colon,
-        OpenBracket => OpenCurlyBracket,
-        CloseBracket => CloseCurlyBracket,
-        Slash => Questionmark,
-        Backslash => Pipe,
-        _ => return None,
-    })
-}
-
-/// A key binding: modifiers, key, command id and bound params.
-pub type Binding = (egui::Modifiers, egui::Key, String, Value);
-
-/// All bindings of the active keyboard shortcut preset, most modifiers first.
-pub fn bindings(session: &effectcraft_engine::Session) -> Vec<Binding> {
-    let mut v: Vec<Binding> = Vec::new();
-    for (sc, b) in session.shortcuts().bindings() {
-        if sc.starts_with("Physical+") {
-            continue;
-        }
-        // Off macOS `Cmd` is Ctrl, so a custom Ctrl+Cmd shortcut would
-        // steal the plain Cmd one: such macOS-only shortcuts aren't bound there.
-        if !cfg!(target_os = "macos") && sc.split('+').any(|p| p == "Ctrl") && sc.split('+').any(|p| p == "Cmd") {
-            continue;
-        }
-        if let Some((m, k)) = parse_shortcut(sc) {
-            if m.shift
-                && let Some(alias) = shifted_alias(k)
-            {
-                v.push((m, alias, b.command.clone(), b.params.clone()));
-            }
-            v.push((m, k, b.command.clone(), b.params.clone()));
-        }
-    }
-    v.sort_by_key(|(m, ..)| std::cmp::Reverse(m.command as u8 + m.shift as u8 + m.alt as u8 + m.ctrl as u8));
-    v
-}
-
-fn mods_match(want: egui::Modifiers, got: egui::Modifiers) -> bool {
-    want.command == got.command && want.shift == got.shift && want.alt == got.alt && (want.ctrl == got.ctrl || got.command && cfg!(not(target_os = "macos")))
-}
-
-/// Set (egui temp data) from a plain Spacebar press until its release while a tap would still
-/// run the Spacebar shortcut.
-/// The system clipboard's text of this frame's paste event, for the Edit ▸ Paste it runs.
-fn system_paste_id() -> egui::Id {
-    egui::Id::new("menus-system-paste")
-}
-
-fn space_tap_id() -> egui::Id {
-    egui::Id::new("spacebar-tap")
-}
-
-/// The modifiers held when this frame's input began: the state the last pass ended with, if it
-/// ran this (egui keeps only the state after the frame's events). Records this pass's state.
-fn modifiers_at_start(ctx: &egui::Context) -> Option<egui::Modifiers> {
-    let id = egui::Id::new("shortcut-modifiers");
-    let pass = ctx.cumulative_pass_nr();
-    let now = ctx.input(|i| i.modifiers);
-    ctx.data_mut(|d| {
-        let last = d.get_temp::<(u64, egui::Modifiers, Option<egui::Modifiers>)>(id);
-        if let Some((p, _, start)) = last
-            && p == pass
-        {
-            return start;
-        }
-        let start = last.and_then(|(p, m, _)| (p.checked_add(1) == Some(pass)).then_some(m));
-        d.insert_temp(id, (pass, now, start));
-        start
-    })
-}
-
-/// Only Shift held (Shift+Delete, not Ctrl/Alt+Shift+Delete).
-fn only_shift(m: egui::Modifiers) -> bool {
-    m.shift && !m.alt && !m.ctrl && !m.command && !m.mac_cmd
-}
-
-/// Dispatch keyboard shortcuts (skipped while typing in a text field).
-pub fn handle_shortcuts(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    handle_shortcuts_impl(app, ctx, false);
-}
-
-/// Tab can acquire widget focus while the current frame is drawn. Dispatch its application
-/// binding only afterward, and only when no widget owned focus before or after layout.
-pub fn handle_tab_shortcut(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    if ctx.input(|i| i.key_pressed(egui::Key::Tab)) {
-        handle_shortcuts_impl(app, ctx, true);
-    }
-}
-
-fn handle_shortcuts_impl(app: &mut EffectcraftApp, ctx: &egui::Context, tab_only: bool) {
-    let start = modifiers_at_start(ctx);
-    // Dialog cancellation owns Escape even when a text field has keyboard focus.
-    if !tab_only && app.dialog.is_some() && ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
-        // A popup or colour picker takes Escape first (the picker goes back to its original colour).
-        if crate::panels::shortcut_editor::recording(app)
-            || crate::panels::shortcut_editor::confirming(app)
-            || egui::Popup::is_any_open(ctx)
-            || crate::color_picker::open_recently(ctx)
-        {
-            return;
-        }
-        ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape));
-        if app.dialog == Some(crate::Dialog::LayerStyles) {
-            crate::panels::layer_styles_dialog::finish(app, false);
-        } else if app.dialog == Some(crate::Dialog::Info) {
-            crate::panels::forms::close_info(app);
-        } else {
-            if app.dialog == Some(crate::Dialog::Settings)
-                && let Some(p) = app.dialog_state.prefs_snapshot.take()
-            {
-                app.session.prefs = p;
-                app.session.prefs_changed();
-            }
-            if app.dialog == Some(crate::Dialog::UnsavedChanges) {
-                app.dialog_state.unsaved.command = None;
-            }
-            app.dialog = None;
-        }
-        return;
-    }
-    // A mouse button down while Spacebar is held belongs to the Hand tool: its release won't
-    // preview.
-    if ctx.input(|i| i.pointer.any_down()) || ctx.egui_wants_keyboard_input() {
-        ctx.data_mut(|d| d.remove::<bool>(space_tap_id()));
-    }
-    // While a menu or popup list is open, keys go to it, not to the app (Space must not start a
-    // preview behind the menu, #279).
-    if ctx.egui_wants_keyboard_input() || crate::widgets::any_menu_open(ctx) {
-        return;
-    }
-    // Text editing in the viewer takes the clipboard events itself.
-    let clipboard = app.session.state.text_edit.is_none();
-    let project = app.ui.focused == PanelKind::Project;
-    // The paste event's text: Edit ▸ Paste pastes SVG markup as a shape layer.
-    let pasted =
-        if clipboard { ctx.input(|i| i.events.iter().rev().find_map(|e| if let egui::Event::Paste(t) = e { Some(t.clone()) } else { None })) } else { None };
-    let mut events: Vec<(egui::Key, egui::Modifiers, bool, Option<egui::Key>)> = ctx.input(|i| {
-        // The windowing layer turns Ctrl+C / Ctrl+X / Ctrl+V into clipboard events instead of
-        // key presses: map them back to the keys (with the modifiers held) so Edit ▸ Copy, Cut,
-        // Paste and their variants (Ctrl+Alt+C…) run. Clipboard events carry no modifiers and
-        // `i.modifiers` is the state after all of the frame's events, so each is read with the
-        // modifiers where it is in the stream: walk the events from the frame's starting state.
-        // `None` when that isn't known.
-        let changed = i.events.iter().any(|e| matches!(e, egui::Event::ModifiersChanged(_) | egui::Event::WindowFocused(false)));
-        let mut at = if changed { start } else { Some(i.modifiers) };
-        let held = |at: Option<egui::Modifiers>| at.filter(|m| m.command).unwrap_or(egui::Modifiers::COMMAND);
-        let mut out = Vec::new();
-        for e in &i.events {
-            match e {
-                egui::Event::ModifiersChanged(m) => at = Some(*m),
-                // egui forgets the modifiers held when the window loses focus.
-                egui::Event::WindowFocused(false) => at = Some(egui::Modifiers::NONE),
-                egui::Event::Key { key, physical_key, pressed: true, modifiers, repeat, .. }
-                    if !*repeat
-                        || matches!(
-                            key,
-                            egui::Key::PageUp | egui::Key::PageDown | egui::Key::ArrowLeft | egui::Key::ArrowRight | egui::Key::ArrowUp | egui::Key::ArrowDown
-                        ) =>
-                {
-                    out.push((*key, *modifiers, true, *physical_key));
-                }
-                egui::Event::Key { key: egui::Key::Space, pressed: false, .. } => out.push((egui::Key::Space, egui::Modifiers::NONE, false, None)),
-                egui::Event::Copy if clipboard => out.push((egui::Key::C, held(at), true, None)),
-                // On Windows, Shift+Delete is the old Cut key and arrives as Cut too. The Project
-                // panel has no clipboard: there a Cut with only Shift held is Shift+Delete (Delete
-                // Project Items Without Confirmation). Never when the modifiers aren't known.
-                egui::Event::Cut if clipboard && project && at.is_some_and(only_shift) => {
-                    out.push((egui::Key::Delete, egui::Modifiers::SHIFT, true, None));
-                }
-                egui::Event::Cut if clipboard => out.push((egui::Key::X, held(at), true, None)),
-                egui::Event::Paste(_) if clipboard => out.push((egui::Key::V, held(at), true, None)),
-                _ => {}
-            }
-        }
-        out
-    });
-    events.retain(|(key, _, _, _)| (*key == egui::Key::Tab) == tab_only);
-    // Numpad * (or `*` typed with Shift+8): Add Marker (#275). egui has no key for it, so it
-    // comes as text.
-    if !tab_only && clipboard && app.dialog.is_none() && ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::Text(t) if t == "*"))) {
-        let bound = app.session.shortcuts().bindings().into_iter().find(|(k, _)| *k == "Num*").map(|(_, b)| (b.command.clone(), b.params.clone()));
-        // As in After Effects, it marks the selected layers; only with none selected does it add
-        // a composition marker (#976).
-        let bound = bound.map(|(id, params)| {
-            if id == "comp.addMarker" && !app.session.state.selected_layers.is_empty() { ("layer.addMarker".to_owned(), params) } else { (id, params) }
-        });
-        if let Some((id, params)) = bound
-            && let Err(e) = invoke(app, ctx, &id, if params.is_null() { json!({}) } else { params })
-        {
-            app.ui.status = e;
-        }
-    }
-    if events.is_empty() {
-        return;
-    }
-    let binds = bindings(&app.session);
-    for (key, mods, pressed, physical_key) in events {
-        // Plain Spacebar runs its shortcut (Play Current Preview) on the release: held, it is
-        // the Hand tool (After Effects), and a drag with it must not start or stop playback.
-        if key == egui::Key::Space && (!pressed || !mods.any()) {
-            if pressed {
-                if app.dialog.is_none() {
-                    ctx.data_mut(|d| d.insert_temp(space_tap_id(), true));
-                }
-                continue;
-            }
-            if !ctx.data_mut(|d| d.remove_temp::<bool>(space_tap_id())).unwrap_or(false) {
-                continue;
-            }
-        }
-        // Escape closes dialogs.
-        if key == egui::Key::Escape && app.dialog.is_some() {
-            // Escape while recording a shortcut cancels the recording, not the editor; so does
-            // Escape in its Delete Preset prompt.
-            if crate::panels::shortcut_editor::recording(app) || crate::panels::shortcut_editor::confirming(app) {
-                continue;
-            }
-            if app.dialog == Some(crate::Dialog::Info) {
-                crate::panels::forms::close_info(app);
-                continue;
-            }
-            // Escape in Settings is Cancel: restore the settings from when it opened.
-            if app.dialog == Some(crate::Dialog::Settings)
-                && let Some(p) = app.dialog_state.prefs_snapshot.take()
-            {
-                app.session.prefs = p;
-                app.session.prefs_changed();
-            }
-            app.dialog = None;
-            continue;
-        }
-        if app.dialog.is_some() {
-            continue;
-        }
-        // Enter in the Project panel renames the selected item (handled by the panel).
-        if key == egui::Key::Enter && !mods.any() && app.ui.focused == PanelKind::Project {
-            continue;
-        }
-        // The Project panel has its own selection; a previously selected Timeline layer
-        // must not be deleted while the Project panel has focus.
-        if matches!(key, egui::Key::Delete | egui::Key::Backspace) && !mods.any() {
-            if matches!(app.ui.focused, PanelKind::Composition | PanelKind::Viewer(_)) && !app.session.state.camera_points.is_empty() {
-                if let Err(e) = run_engine(app, ctx, "camera.deletePoints", json!({})) {
-                    app.ui.status = e;
-                }
-                ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, key));
-                continue;
-            }
-            // The queue panel consumes the event after its selection state is drawn.
-            if app.ui.focused == PanelKind::RenderQueue {
-                continue;
-            }
-            let _ = invoke(app, ctx, "edit.clear", json!({}));
-            continue;
-        }
-        // Explicit physical bindings distinguish keys that a layout reports with the same
-        // logical name (for example AZERTY's minus and right parenthesis).
-        let physical = physical_key.and_then(|key| {
-            app.session.shortcuts().bindings().into_iter().find_map(|(sc, b)| {
-                let (m, k) = parse_shortcut(sc.strip_prefix("Physical+")?)?;
-                (k == key && mods_match(m, mods)).then(|| (b.command.clone(), b.params.clone()))
-            })
-        });
-        if let Some((id, params)) = physical {
-            if let Err(e) = invoke(app, ctx, &id, if params.is_null() { json!({}) } else { params }) {
-                app.ui.status = e;
-            }
-            continue;
-        }
-        if let Some((_, _, id, params)) = binds.iter().filter(|(m, k, ..)| *k == key && mods_match(*m, mods)).min_by_key(|(_, _, id, params)| {
-            // The focused panel wins over an application command sharing its chord.
-            let key = effectcraft_engine::shortcuts::binding_key(id, params);
-            app.session.shortcuts().find(&key).is_none_or(|b| b.scope != app.ui.focused.id())
-        }) {
-            let (id, params) = (id.clone(), if params.is_null() { json!({}) } else { params.clone() });
-            if id == "edit.paste"
-                && let Some(t) = &pasted
-            {
-                ctx.data_mut(|d| d.insert_temp(system_paste_id(), t.clone()));
-            }
-            if let Err(e) = invoke(app, ctx, &id, params) {
-                app.ui.status = e;
-            }
-            ctx.data_mut(|d| d.remove_temp::<String>(system_paste_id()));
-        }
-    }
-}
-
-/// Draw the in-window menu bar (the engine's AE menu tree).
-pub fn menu_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
-    let ctx = ui.ctx().clone();
-    let mut clicked: Option<(String, Value)> = None;
-    let mut nav = crate::menu_keys::Nav::default();
-    ui.horizontal_centered(|ui| {
-        ui.add_space(6.0);
-        egui::MenuBar::new().config(egui::containers::menu::MenuConfig::new().style(crate::widgets::menu_style)).ui(ui, |ui| {
-            for node in effectcraft_engine::menus::menu_bar() {
-                if let MenuNode::Submenu { label, children } = node {
-                    let r = ui.menu_button(crate::i18n::label(app, "", label), |ui| {
-                        ui.set_min_width(if label == "Effect" { 200.0 } else { 280.0 });
-                        crate::widgets::menu_scroll(ui, |ui| menu_nodes(app, ui, children, &mut clicked, &mut nav, 0));
-                    });
-                    nav.top(&r.response);
-                    app.auto.add(&format!("menu.{label}"), r.response.rect, label);
-                }
-            }
-        });
-    });
-    crate::menu_keys::handle(&ctx, &nav);
-    if let Some((id, params)) = clicked.map(|(id, params)| menu_choice(app, id, params))
-        && let Err(e) = invoke(app, &ctx, &id, if params.is_null() { json!({}) } else { params })
-    {
-        app.ui.status = e;
-    }
-}
-
-/// The entries of top-level menu `name` (the Effect menu is the Effect Controls panel's context
-/// menu); returns the chosen command and its params.
-pub(crate) fn menu_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, name: &str) -> Option<(String, Value)> {
-    let mut clicked = None;
-    if let Some(MenuNode::Submenu { children, .. }) =
-        effectcraft_engine::menus::menu_bar().iter().find(|n| matches!(n, MenuNode::Submenu { label, .. } if label == name))
-    {
-        menu_nodes(app, ui, children, &mut clicked, &mut crate::menu_keys::Nav::default(), 0);
-    }
-    clicked.map(|(id, params)| (id, if params.is_null() { json!({}) } else { params }))
-}
-
-/// The entries `nodes` of a menu `depth` submenus deep, registered with `nav` for the keyboard.
-fn menu_nodes(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    nodes: &[MenuNode],
-    clicked: &mut Option<(String, Value)>,
-    nav: &mut crate::menu_keys::Nav,
-    depth: usize,
-) {
-    for n in nodes {
-        match n {
-            MenuNode::Separator => {
-                ui.separator();
-            }
-            MenuNode::Dynamic { name } => {
-                // Recent projects / footage / presets, undo history, shortcut slots, viewers,
-                // saved workspaces.
-                let ws = app.ui.workspace.clone();
-                let saved = app.saved_workspace_names();
-                let (entries, empty) = effectcraft_engine::menus::dynamic(&app.session, name, &dyn_ctx(&ws, &saved));
-                if entries.is_empty()
-                    && let Some(e) = empty
-                {
-                    ui.add_enabled(false, egui::Button::new((gutter(false), e)));
-                }
-                for (i, e) in entries.iter().enumerate() {
-                    let tip = match name.as_str() {
-                        "recentProjects" => app.session.prefs.recent_projects.get(i).cloned(),
-                        "recentFootage" => app.session.prefs.recent_footage.get(i).cloned(),
-                        "recentPresets" => app.session.prefs.recent_presets.get(i).cloned(),
-                        _ => None,
-                    };
-                    let r = ui.add_enabled(entry_enabled(app, e), egui::Button::new((gutter(entry_checked(app, e) == Some(true)), e.label.as_str())));
-                    let r = match &tip {
-                        Some(t) => r.on_hover_text(t),
-                        None => r,
-                    };
-                    app.auto.add(&format!("menu.{name}.{i}"), r.rect, &e.label);
-                    nav.entry(ui, depth, &r, false);
-                    if r.clicked() {
-                        *clicked = Some((e.command.clone(), e.params.clone()));
-                        ui.close();
-                    }
-                }
-            }
-            MenuNode::Submenu { label, children } => {
-                let ws = app.ui.workspace.clone();
-                // The generated Effect menu's category submenus draw the catalog's name (#821);
-                // every other submenu goes through the menu catalog.
-                let shown = crate::i18n::effect_category(children, label)
-                    .unwrap_or_else(|| crate::i18n::submenu(app, label, effectcraft_engine::menus::submenu_label(&app.session, label, &dyn_ctx(&ws, &[]))));
-                let r = ui.menu_button((gutter(false), shown.as_str()), |ui| {
-                    ui.set_min_width(if children.len() > 30 { 200.0 } else { 240.0 });
-                    crate::widgets::menu_scroll(ui, |ui| menu_nodes(app, ui, children, clicked, nav, depth + 1));
-                });
-                nav.entry(ui, depth, &r.response, true);
-                if r.inner.is_some() {
-                    nav.opened(depth, &r.response);
-                }
-            }
-            MenuNode::Item(e) => {
-                let r = menu_entry(app, ui, e);
-                nav.entry(ui, depth, &r, false);
-                if r.clicked() {
-                    *clicked = Some((e.command.clone(), e.params.clone()));
-                    ui.close();
-                }
-            }
-        }
-    }
-}
-
-/// The menu bar's submenu at `path` (`["File", "Interpret Footage"]`) in a panel's context menu,
-/// with the menu bar's labels, shortcuts and enabled state; a chosen entry goes to `clicked`.
-pub(crate) fn submenu_at(app: &mut EffectcraftApp, ui: &mut egui::Ui, path: &[&str], clicked: &mut Option<(String, Value)>) {
-    let mut nodes = effectcraft_engine::menus::menu_bar();
-    let mut found = None;
-    for label in path {
-        let Some(n) = nodes.iter().find(|n| matches!(n, MenuNode::Submenu { label: l, .. } if l == label)) else { return };
-        if let MenuNode::Submenu { children, .. } = n {
-            nodes = children;
-        }
-        found = Some(n);
-    }
-    if let Some(n) = found {
-        menu_nodes(app, ui, std::slice::from_ref(n), clicked, &mut crate::menu_keys::Nav::default(), 0);
-    }
-    if let Some((_, p)) = clicked.as_mut()
-        && p.is_null()
-    {
-        *p = json!({});
-    }
-}
-
-/// The menu bar's entry for `command` in a panel's context menu (see [`submenu_at`]).
-pub(crate) fn entry_for(app: &EffectcraftApp, ui: &mut egui::Ui, command: &str, clicked: &mut Option<(String, Value)>) {
-    if let Some((_, e)) = effectcraft_engine::menus::entries().into_iter().find(|(_, e)| e.command == command)
-        && menu_entry(app, ui, e).clicked()
-    {
-        *clicked = Some((e.command.clone(), e.params_or_empty()));
-        ui.close();
-    }
-}
-
-/// Frontend state for dynamic menus (the current workspace and the saved ones).
-pub(crate) fn dyn_ctx<'a>(workspace: &'a str, saved_workspaces: &'a [String]) -> effectcraft_engine::menus::DynCtx<'a> {
-    effectcraft_engine::menus::DynCtx { workspace: Some(workspace), saved_workspaces }
-}
-
-/// The check-mark column every menu row reserves (like macOS / After Effects menus).
-fn gutter(checked: bool) -> egui::Atom<'static> {
-    use egui::AtomExt;
-    (if checked { "✔" } else { "" }).atom_size(egui::vec2(14.0, 14.0))
-}
-
-fn menu_entry(app: &EffectcraftApp, ui: &mut egui::Ui, e: &MenuEntry) -> egui::Response {
-    let (label, check, enabled) = (entry_label(app, e), gutter(entry_checked(app, e) == Some(true)), entry_enabled(app, e));
-    // Edit ▸ Label's entries show the label's colour before its name.
-    if e.command == "edit.label"
-        && let Some(l) = e.params.get("label").and_then(Value::as_str).and_then(effectcraft_engine::color::Label::from_name)
-    {
-        let out = ui.add_enabled_ui(enabled, |ui| egui::Button::new((check, crate::widgets::label_swatch(), label)).atom_ui(ui)).inner;
-        crate::widgets::paint_label_swatch(ui, &out, l, &app.tokens);
-        return out.response;
-    }
-    let mut b = egui::Button::new((check, label));
-    if let Some(s) = entry_shortcut(app, e) {
-        b = b.shortcut_text(shortcut_text(&s));
-    }
-    ui.add_enabled(enabled, b)
-}
-
-/// View ▸ Zoom In / Zoom Out: the next standard magnification (as a share of screen pixels, so
-/// 100 % is one comp pixel per screen pixel at any display scaling) above or below `cur`, which is
-/// in points per comp pixel like the result (#882).
-fn zoom_step(cur: f32, ppp: f32, zoom_in: bool) -> f32 {
-    const STEPS: [f32; 16] = [0.015, 0.03, 0.0625, 0.125, 0.25, 0.333, 0.5, 0.66, 1.0, 1.5, 2.0, 3.0, 4.0, 8.0, 16.0, 32.0];
-    let ppp = if ppp.is_finite() && ppp > 0.0 { ppp } else { 1.0 };
-    let shown = cur * ppp;
-    let next = if zoom_in {
-        STEPS.iter().copied().find(|s| *s > shown + 1e-3).unwrap_or(32.0)
-    } else {
-        STEPS.iter().rev().copied().find(|s| *s < shown - 1e-3).unwrap_or(0.015)
-    };
-    next / ppp
-}
-
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// #882: at 125 % / 150 % display scaling Zoom In reaches 100 % (one comp pixel per screen
-    /// pixel), not 100 % in points (125 % / 150 % on screen).
-    #[test]
-    fn zoom_steps_land_on_whole_screen_magnifications() {
-        for ppp in [1.0f32, 1.25, 1.5, 2.0] {
-            let at_100 = zoom_step(0.7 / ppp, ppp, true);
-            assert!((at_100 * ppp - 1.0).abs() < 1e-6, "ppp {ppp}: {}", at_100 * ppp);
-            assert!((zoom_step(at_100, ppp, true) * ppp - 1.5).abs() < 1e-6);
-            assert!((zoom_step(at_100, ppp, false) * ppp - 0.66).abs() < 1e-6);
-        }
-        assert!(zoom_step(1.0, 0.0, true).is_finite());
-    }
-
-    #[test]
-    fn shortcut_passes_share_frame_start_modifiers() {
-        let ctx = egui::Context::default();
-        let mut starts = Vec::new();
-        let mut output = ctx.run_ui(egui::RawInput { events: vec![egui::Event::ModifiersChanged(egui::Modifiers::SHIFT)], ..Default::default() }, |ui| {
-            let ctx = ui.ctx();
-            starts.push(modifiers_at_start(ctx));
-            starts.push(modifiers_at_start(ctx));
-        });
-        output.textures_delta.clear();
-        assert_eq!(starts, vec![None, None]);
-        starts.clear();
-        let mut output = ctx.run_ui(egui::RawInput { events: vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE)], ..Default::default() }, |ui| {
-            let ctx = ui.ctx();
-            starts.push(modifiers_at_start(ctx));
-            starts.push(modifiers_at_start(ctx));
-        });
-        output.textures_delta.clear();
-        assert_eq!(starts, vec![Some(egui::Modifiers::SHIFT), Some(egui::Modifiers::SHIFT)]);
-    }
-
-    #[test]
-    fn every_ui_shortcut_parses() {
-        for c in UI_COMMANDS {
-            if let Some(sc) = c.shortcut {
-                assert!(parse_shortcut(sc).is_some() || sc == "Num*", "{sc}");
-            }
-        }
-        for (_, e) in effectcraft_engine::menus::entries() {
-            if let Some(sc) = &e.shortcut {
-                assert!(parse_shortcut(sc).is_some() || sc == "Num*", "{} ({sc})", e.label);
-            }
-        }
-    }
-
-    #[test]
-    fn full_screen_default_is_platform_specific() {
-        let app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let full_screen = app.session.shortcuts().shortcut_of("view.fullScreen", &Value::Null);
-        if cfg!(target_os = "macos") {
-            assert_eq!(full_screen, Some("Ctrl+Cmd+F"));
-        } else {
-            assert_eq!(full_screen, None);
-            assert_eq!(app.session.shortcuts().shortcut_of("window.maximizeApp", &Value::Null), Some("Cmd+\\"));
-        }
-    }
-
-    #[test]
-    fn ui_and_menu_shortcuts_do_not_collide() {
-        let app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let mut seen: std::collections::BTreeMap<(String, String), (String, String)> = Default::default();
-        for (m, k, id, params) in bindings(&app.session) {
-            let key = (format!("{m:?}"), format!("{k:?}"));
-            let target = (id.clone(), params.to_string());
-            if let Some(prev) = seen.get(&key) {
-                assert_eq!(prev, &target, "{key:?} bound to {prev:?} and {target:?}");
-            } else {
-                seen.insert(key, target);
-            }
-        }
-    }
-
-    /// #336: Ctrl+\ (Cmd+\ on macOS) maximizes the application window, and again restores
-    /// it, as in After Effects.
-    #[test]
-    fn ctrl_backslash_maximizes_or_restores_the_window() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let (m, k) = parse_shortcut("Cmd+\\").unwrap();
-        assert!(m.command && k == egui::Key::Backslash, "{m:?} {k:?}");
-        assert!(bindings(&app.session).iter().any(|b| (b.0, b.1) == (m, k) && b.2 == "window.maximizeApp"));
-        let ctx = egui::Context::default();
-        let run = |app: &mut EffectcraftApp, maximized: bool| {
-            let input = egui::RawInput {
-                viewports: std::iter::once((egui::ViewportId::ROOT, egui::ViewportInfo { maximized: Some(maximized), ..Default::default() })).collect(),
-                ..Default::default()
-            };
-            let mut r = Value::Null;
-            let mut out = ctx.run_ui(input, |ui| r = invoke(app, ui.ctx(), "window.maximizeApp", json!({})).unwrap());
-            out.textures_delta.clear();
-            let cmds = out.viewport_output.get(&egui::ViewportId::ROOT).map(|v| v.commands.clone()).unwrap_or_default();
-            (r, cmds)
-        };
-        let (r, cmds) = run(&mut app, false);
-        assert_eq!(r, json!({"maximized": true}));
-        assert!(cmds.contains(&egui::ViewportCommand::Maximized(true)), "{cmds:?}");
-        let (r, cmds) = run(&mut app, true);
-        assert_eq!(r, json!({"maximized": false}));
-        assert!(cmds.contains(&egui::ViewportCommand::Maximized(false)), "{cmds:?}");
-    }
-
-    /// The default keys of the keyboard-only commands parse and reach them.
-    #[test]
-    fn keyboard_only_commands_are_bound() {
-        let app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        for (id, keys) in [
-            ("time.workAreaStart", "Shift+Home"),
-            ("time.workAreaEnd", "Shift+End"),
-            ("time.previousInOut", "Cmd+Alt+Shift+ArrowLeft"),
-            ("time.nextInOut", "Cmd+Alt+Shift+ArrowRight"),
-            ("comp.workAreaToSelection", "Cmd+Alt+B"),
-            ("comp.activateRecent", "Shift+Escape"),
-            ("keys.deselectAll", "Shift+F2"),
-            ("keys.deselectAll", "Cmd+Alt+Shift+A"),
-            ("layer.extendSelectionNext", "Cmd+Shift+ArrowDown"),
-            ("layer.moveInToStart", "Alt+Home"),
-            ("layer.moveEarlier", "Alt+PageUp"),
-            ("layer.moveLater10", "Alt+Shift+PageDown"),
-            ("layer.stretchInToTime", "Cmd+Shift+,"),
-            ("layer.stretchOutToTime", "Cmd+Alt+,"),
-            ("layer.mask.selectNext", "Alt+`"),
-            ("layer.mask.selectPrevious", "Alt+Shift+`"),
-            ("layer.castsShadows", "Alt+Shift+C"),
-            ("timeline.scrollToTime", "D"),
-            ("timeline.scrollToLayer", "X"),
-            ("timeline.parentColumn", "Shift+F4"),
-            ("view.fitUpTo100", "Alt+/"),
-            ("view.nextItem", "Shift+."),
-            ("view.previousItem", "Shift+,"),
-            ("window.toggleCompTimeline", "\\"),
-            ("window.nextPanel", "Alt+Shift+."),
-            ("window.previousPanel", "Alt+Shift+,"),
-            ("window.closeAll", "Cmd+Shift+W"),
-            ("tool.camera", "C"),
-        ] {
-            assert!(bindings(&app.session).into_iter().any(|x| x.2 == id && Some((x.0, x.1)) == parse_shortcut(keys)), "{id} on {keys}");
-        }
-    }
-
-    #[test]
-    fn timeline_keys_scroll_and_toggle_the_parent_column() {
-        let ctx = egui::Context::default();
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let run = |app: &mut EffectcraftApp, id: &str| invoke(app, &ctx, id, json!({})).unwrap();
-        // D and X leave a scroll for the Timeline to do when it is drawn.
-        run(&mut app, "timeline.scrollToTime");
-        assert_eq!(app.ui.timeline.scroll_to, Some(crate::state::ScrollTo::Time));
-        run(&mut app, "timeline.scrollToLayer");
-        assert_eq!(app.ui.timeline.scroll_to, Some(crate::state::ScrollTo::Layer));
-        // Shift+F4 shows and hides the Parent column.
-        let parent = crate::panels::timeline::column_visible(&app.ui.timeline, "parent");
-        run(&mut app, "timeline.parentColumn");
-        assert_eq!(crate::panels::timeline::column_visible(&app.ui.timeline, "parent"), !parent);
-        run(&mut app, "timeline.parentColumn");
-        assert_eq!(crate::panels::timeline::column_visible(&app.ui.timeline, "parent"), parent);
-    }
-
-    #[test]
-    fn viewer_keys_fit_and_step_through_open_comps() {
-        let ctx = egui::Context::default();
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let run = |app: &mut EffectcraftApp, id: &str| invoke(app, &ctx, id, json!({})).unwrap();
-        let new = |app: &mut EffectcraftApp, name: &str| app.session.execute("comp.new", json!({"name": name, "duration": 4})).unwrap()["comp"].as_u64();
-        let active = |app: &EffectcraftApp| app.session.state.active_comp.map(|c| c.0);
-        // With one composition open there is nothing to step to.
-        let a = new(&mut app, "A");
-        run(&mut app, "view.nextItem");
-        assert_eq!(active(&app), a);
-        // Shift+, / Shift+.: through the open compositions, wrapping.
-        let b = new(&mut app, "B");
-        assert_eq!(active(&app), b);
-        run(&mut app, "view.nextItem");
-        assert_eq!(active(&app), a);
-        run(&mut app, "view.previousItem");
-        assert_eq!(active(&app), b);
-        // Alt+/ fits the viewer without magnifying past 100 %; Shift+/ fits fully again.
-        app.ui.viewer.zoom = Some(3.0);
-        run(&mut app, "view.fitUpTo100");
-        assert!(app.ui.viewer.zoom.is_none() && app.ui.viewer.fit_up_to_100);
-        run(&mut app, "view.fit");
-        assert!(!app.ui.viewer.fit_up_to_100);
-    }
-
-    #[test]
-    fn panel_keys_switch_cycle_and_close() {
-        let ctx = egui::Context::default();
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let run = |app: &mut EffectcraftApp, id: &str| invoke(app, &ctx, id, json!({})).unwrap();
-        for name in ["A", "B"] {
-            app.session.execute("comp.new", json!({"name": name, "duration": 4})).unwrap();
-        }
-        // \\ switches between the Timeline and the Composition viewer.
-        app.ui.focused = PanelKind::Timeline;
-        run(&mut app, "window.toggleCompTimeline");
-        assert_eq!(app.ui.focused, PanelKind::Composition);
-        run(&mut app, "window.toggleCompTimeline");
-        assert_eq!(app.ui.focused, PanelKind::Timeline);
-        // Alt+Shift+. / Alt+Shift+,: the tabs of the focused panel's group, wrapping.
-        let group = app.ui.dock.group_of(PanelKind::Timeline).unwrap().to_vec();
-        assert!(group.len() > 1, "{group:?}");
-        run(&mut app, "window.nextPanel");
-        assert_eq!(app.ui.focused, group[(group.iter().position(|p| *p == PanelKind::Timeline).unwrap() + 1) % group.len()]);
-        run(&mut app, "window.previousPanel");
-        assert_eq!(app.ui.focused, PanelKind::Timeline);
-        // Ctrl+Shift+W with the Timeline active closes every composition.
-        run(&mut app, "window.closeAll");
-        assert!(app.session.state.open_comps.is_empty());
-        // With another panel active it closes that panel.
-        app.show_panel(PanelKind::Project);
-        run(&mut app, "window.closeAll");
-        assert!(!app.ui.dock.contains(PanelKind::Project));
-    }
-
-    #[test]
-    fn c_cycles_the_camera_tools() {
-        let ctx = egui::Context::default();
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.ui.tool = Tool::Selection;
-        let mut seen = vec![];
-        for _ in 0..4 {
-            invoke(&mut app, &ctx, "tool.camera", json!({})).unwrap();
-            seen.push(app.ui.tool);
-        }
-        assert_eq!(seen, [Tool::Orbit, Tool::PanCamera, Tool::Dolly, Tool::Orbit]);
-    }
-
-    #[test]
-    fn dispatch_uses_the_active_custom_preset() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let find = |app: &EffectcraftApp, id: &str| bindings(&app.session).into_iter().filter(|b| b.2 == id).map(|b| (b.0, b.1)).collect::<Vec<_>>();
-        let (m, k) = parse_shortcut("Cmd+Alt+Shift+Y").unwrap();
-        assert!(find(&app, "layer.newNull").contains(&(m, k)));
-        // A UI command rebound in a custom preset.
-        app.session.execute("shortcuts.set", json!({"command": "tool.hand", "keys": "Ctrl+Alt+H"})).unwrap();
-        assert_eq!(app.session.keymaps.active, "Custom");
-        let (m2, k2) = parse_shortcut("Ctrl+Alt+H").unwrap();
-        assert_eq!(find(&app, "tool.hand"), vec![(m2, k2)]);
-        app.session.execute("shortcuts.set", json!({"command": "layer.newNull", "keys": "F6"})).unwrap();
-        assert_eq!(find(&app, "layer.newNull"), vec![(egui::Modifiers::NONE, egui::Key::F6)]);
-        // The menus show the preset's shortcut.
-        let item = menu_items(&app).into_iter().find(|i| i.id == "layer.newNull").unwrap();
-        assert_eq!(item.shortcut.as_deref(), Some("F6"));
-        // Back to the default preset.
-        app.session.execute("shortcuts.preset", json!({"op": "select", "name": effectcraft_engine::shortcuts::DEFAULT_PRESET})).unwrap();
-        assert!(find(&app, "layer.newNull").contains(&(m, k)));
-    }
-
-    #[test]
-    fn renamed_label_shows_in_the_label_menu() {
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.set_pref("labels.1.name", json!("Sunflower")).unwrap();
-        let labels: Vec<String> = menu_items(&app).into_iter().filter(|i| i.id == "edit.label").map(|i| i.label).collect();
-        assert!(labels.contains(&"Sunflower".to_string()), "{labels:?}");
-        assert!(!labels.contains(&"Yellow".to_string()));
-    }
-
-    /// Saving anything but a project asks the save dialog for that file's extension (#293): the
-    /// project dialog, filtered to `.ecproj`, made macOS append `.ecproj` (`Frame.png.ecproj`).
-    /// Hosts with only the project dialog (the web) still get it, given the file name.
-    #[test]
-    fn save_dialogs_offer_the_file_extension() {
-        use std::cell::RefCell;
-        use std::rc::Rc;
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": 1})).unwrap();
-        let ctx = egui::Context::default();
-        let asked: Rc<RefCell<Vec<String>>> = Rc::default();
-        let (a, b) = (asked.clone(), asked.clone());
-        app.hooks.pick_save = Some(Box::new(move |name: &str| {
-            a.borrow_mut().push(format!("project {name}"));
-            None
-        }));
-        app.hooks.pick_save_file = Some(Box::new(move |name: &str, ext: &str| {
-            b.borrow_mut().push(format!("file {name} [{ext}]"));
-            None
-        }));
-        for id in ["comp.saveFrameAs", "render.saveCurrentPreview", "file.exportLottie", "file.saveCopyAsXml", "file.collectFiles", "file.saveAs"] {
-            invoke(&mut app, &ctx, id, json!({})).unwrap();
-        }
-        assert_eq!(
-            *asked.borrow(),
-            [
-                "file Frame.png [png]",
-                "file Preview.mp4 [mp4]",
-                "file Animation.json [json]",
-                "file Untitled Project.ecprojx [ecprojx]",
-                "file Collected Files []",
-                "project Untitled Project.ecproj",
-            ]
-        );
-        // Without the other dialog, the project one names any file.
-        app.hooks.pick_save_file = None;
-        asked.borrow_mut().clear();
-        invoke(&mut app, &ctx, "comp.saveFrameAs", json!({})).unwrap();
-        assert_eq!(*asked.borrow(), ["project Frame.png"]);
-    }
-
-    /// #511: with a host's non-blocking dialogs, a command's file dialog opens without running
-    /// a nested event loop inside the frame (a drag over the window then aborted the app on
-    /// macOS); the command runs on a later frame with the answer, and a cancelled one not at all.
-    #[test]
-    fn file_dialogs_can_answer_on_a_later_frame() {
-        use std::sync::{Arc, Mutex};
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        app.session.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": 1})).unwrap();
-        let ctx = egui::Context::default();
-        app.hooks.pick_save = Some(Box::new(|_: &str| panic!("the blocking dialog is not used")));
-        let pending: Arc<Mutex<Vec<(crate::FileDialog, crate::DialogDone)>>> = Arc::default();
-        let queue = pending.clone();
-        app.hooks.file_dialog_async = Some(Box::new(move |dialog, done| queue.lock().unwrap().push((dialog, done))));
-        assert_eq!(invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap(), json!({"dialog": "file.saveAs"}));
-        let (dialog, done) = pending.lock().unwrap().pop().expect("a dialog was shown");
-        assert_eq!(dialog, crate::FileDialog::Save { default: "Untitled Project.ecproj".into(), ext: "ecproj".into(), project: true });
-        assert!(app.session.path.is_none(), "nothing saved until the dialog answers");
-        let dir = std::env::temp_dir().join(format!("ec-dialog-answer-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let path = dir.join("Answered.ecproj");
-        // Answered from another thread, as the host's dialog does.
-        std::thread::spawn(move || done(vec![path.to_string_lossy().to_string()])).join().unwrap();
-        app.run_dialog_answers();
-        assert_eq!(app.session.path.as_deref(), Some(dir.join("Answered.ecproj").to_string_lossy().as_ref()));
-        assert!(dir.join("Answered.ecproj").is_file());
-        // Cancelled: nothing runs.
-        invoke(&mut app, &ctx, "comp.saveFrameAs", json!({})).unwrap();
-        let (dialog, done) = pending.lock().unwrap().pop().expect("a dialog was shown");
-        assert_eq!(dialog, crate::FileDialog::Save { default: "Frame.png".into(), ext: "png".into(), project: false });
-        done(Vec::new());
-        app.run_dialog_answers();
-        assert!(!dir.join("Frame.png").exists());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn tga_is_available_in_import_replace_and_proxy_dialogs() {
-        use std::sync::{Arc, Mutex};
-        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
-        let ctx = egui::Context::default();
-        let pending = Arc::new(Mutex::new(Vec::new()));
-        let queue = pending.clone();
-        app.hooks.file_dialog_async = Some(Box::new(move |dialog, _done| queue.lock().unwrap().push(dialog)));
-        for command in ["file.import", "file.importMultiple", "file.replaceFootage", "file.setProxy"] {
-            assert_eq!(invoke(&mut app, &ctx, command, json!({})).unwrap(), json!({"dialog": command}));
-            let crate::FileDialog::Open { exts, .. } = pending.lock().unwrap().pop().unwrap() else { panic!("not an open dialog") };
-            assert!(exts.iter().any(|ext| ext == "tga"), "{command}: {exts:?}");
-        }
-    }
-
-    #[test]
-    fn menu_items_cover_the_tree() {
-        assert_eq!(menus().last(), Some(&"Help"));
-        assert!(effectcraft_engine::menus::entries().len() > 500);
-    }
-}
+mod tests;
diff --git a/crates/ui-egui/src/menus/bar.rs b/crates/ui-egui/src/menus/bar.rs
new file mode 100644
index 000000000..dc4478a47
--- /dev/null
+++ b/crates/ui-egui/src/menus/bar.rs
@@ -0,0 +1,312 @@
+use super::entries::{entry_checked, entry_enabled, entry_label, entry_shortcut, menu_choice};
+use super::invoke::invoke;
+use super::shortcuts::shortcut_text;
+use super::{EffectcraftApp, MenuEntry, MenuNode, Value, json};
+
+/// The id under which [`menu_bar`] remembers which of its menus was open at the end of the last
+/// frame (its title's open look, and the hover that switches between the titles).
+fn open_menu_id() -> egui::Id {
+    egui::Id::unique("menu-bar-open")
+}
+
+/// The id under which [`menu_bar`] remembers a title press still in progress (press-and-browse).
+fn browse_menu_id() -> egui::Id {
+    egui::Id::unique("menu-bar-browse")
+}
+
+/// The id under which [`menu_bar`] remembers where it last saw the pointer (`None`: outside the
+/// window).
+fn last_pointer_id() -> egui::Id {
+    egui::Id::unique("menu-bar-last-pointer")
+}
+
+/// Draw the in-window menu bar (the engine's AE menu tree).
+///
+/// The titles open on the press, not the release (native menu bars): while one is held the menus
+/// can be browsed by moving onto them, and releasing over an entry chooses it. Hovering another
+/// title switches the open menu to it, and the open one closes on a press outside it or when the
+/// window loses focus. The pointer leaving the window — onto the OS title bar, directly above the
+/// bar — closes nothing, however long: the platform forwards none of the title bar's clicks to
+/// egui (only the cursor leaving), so there is no click to close on and a graze must not drop the
+/// menu. The closing press itself still reaches the widget under it, as a click does in After
+/// Effects.
+pub fn menu_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
+    let ctx = ui.ctx().clone();
+    let mut clicked: Option<(String, Value)> = None;
+    let mut nav = crate::menu_keys::Nav::default();
+    // The open menu as of the last frame: the titles are drawn before this frame can open or
+    // close anything, and what happened last frame is what they must react to.
+    let open_prev: Option<usize> = ctx.data(|d| d.get_temp(open_menu_id())).flatten();
+    if ctx.data(|d| d.get_temp(browse_menu_id())).unwrap_or(false) {
+        nav.set_browsing();
+    }
+    // Whether the pointer has moved since the last frame. Kept by position rather than egui's
+    // `delta`, which is zero for the first position after the pointer comes back into the window:
+    // coming back in over another title must switch to it too (#1290).
+    let pointer = ctx.pointer_hover_pos();
+    let last = ctx.data_mut(|d| std::mem::replace(d.get_temp_mut_or(last_pointer_id(), None), pointer));
+    let moved = pointer.is_some() && pointer != last;
+    let mut drawn = 0;
+    ui.horizontal_centered(|ui| {
+        ui.add_space(6.0);
+        egui::MenuBar::new().config(egui::containers::menu::MenuConfig::new().style(crate::widgets::menu_style)).ui(ui, |ui| {
+            for node in effectcraft_engine::menus::menu_bar() {
+                let MenuNode::Submenu { label, children } = node else { continue };
+                // The open title takes the open button's look while its menu is up (as in AE).
+                let inactive = ui.style().visuals.widgets.inactive;
+                if open_prev == Some(drawn) {
+                    ui.style_mut().visuals.widgets.inactive = ui.style().visuals.widgets.open;
+                }
+                let mut response = ui.add(egui::Button::new(crate::i18n::label(app, "", label)));
+                ui.style_mut().visuals.widgets.inactive = inactive;
+                // A press on a title opens its menu at once (a second press on the open one closes
+                // it), and while it is held the menus below are browsable. The keyboard and the
+                // accessibility activation report `clicked` without the primary button (the press
+                // then happened somewhere else), and toggle the menu. Hovering another title
+                // switches to it once the pointer has moved: merely resting there must not take a
+                // keyboard-driven menu over.
+                // With the button down elsewhere nothing is hovered, so the title under the
+                // pointer takes the highlight by hand: the hover-switch to it shows, one frame
+                // later like egui's own hover (the open title keeps its open look).
+                if moved && response.contains_pointer() && open_prev.is_some_and(|p| p != drawn) {
+                    response = response.highlight();
+                }
+                let pressed = ctx.input(|i| i.pointer.button_pressed(egui::PointerButton::Primary)) && response.hovered();
+                let cmd = if pressed {
+                    nav.set_browsing();
+                    Some(egui::SetOpenCommand::Bool(open_prev != Some(drawn)))
+                } else if response.clicked() && !response.clicked_by(egui::PointerButton::Primary) {
+                    Some(egui::SetOpenCommand::Toggle)
+                } else if moved && response.enabled() && response.contains_pointer() && open_prev.is_some_and(|p| p != drawn) {
+                    Some(egui::SetOpenCommand::Bool(true))
+                } else {
+                    None
+                };
+                let inner = egui::Popup::menu(&response)
+                    .close_behavior(egui::PopupCloseBehavior::IgnoreClicks)
+                    .style(crate::widgets::menu_style)
+                    .open_memory(cmd)
+                    .show(|ui| {
+                        ui.set_min_width(if label == "Effect" { 200.0 } else { 280.0 });
+                        let browsing = nav.browsing();
+                        crate::widgets::menu_scroll(ui, browsing, |ui| menu_nodes(app, ui, children, &mut clicked, &mut nav, 0));
+                    });
+                nav.top(&response);
+                // The titles and the open menus: a press inside them is not an outside press.
+                nav.cover(response.rect);
+                if let Some(inner) = &inner {
+                    nav.cover(inner.response.rect);
+                }
+                app.auto.add(&format!("menu.{label}"), response.rect, label);
+                drawn += 1;
+            }
+        });
+    });
+    crate::menu_keys::handle(&ctx, &nav);
+    // egui leaves the closing to us (`IgnoreClicks`), so the menus close here: at once on a press
+    // outside them (the press itself still reaches the widget below) and when the window loses
+    // focus. The pointer leaving the window closes nothing: moving onto the OS title bar fires
+    // the cursor-left event and the platform forwards none of its clicks to egui, so there is no
+    // click to close on — and a graze or a stay must not drop the menu, as in native apps.
+    if let Some(top) = nav.open_popup(&ctx) {
+        let focus_lost = ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::WindowFocused(false))));
+        let outside_press = ctx.input(|i| i.pointer.any_pressed() && i.pointer.interact_pos().is_some_and(|p| !nav.covers(p)));
+        if focus_lost || outside_press {
+            egui::Popup::close_id(&ctx, top);
+        }
+    }
+    if let Some((id, params)) = clicked.map(|(id, params)| menu_choice(app, id, params)) {
+        match invoke(app, &ctx, &id, if params.is_null() { json!({}) } else { params }) {
+            Ok(result) => super::frontend::show_result_errors(app, &result),
+            Err(e) => app.ui.status = e,
+        }
+    }
+    // What the next frame starts from: the open title, and a title press still in progress.
+    let open = nav.open_index(&ctx);
+    let browsing = open.is_some() && nav.browsing() && ctx.input(|i| i.pointer.primary_down());
+    ctx.data_mut(|d| {
+        d.insert_temp(open_menu_id(), open);
+        d.insert_temp(browse_menu_id(), browsing);
+    });
+}
+
+/// The entries of top-level menu `name` (the Effect menu is the Effect Controls panel's context
+/// menu); returns the chosen command and its params.
+pub(crate) fn menu_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, name: &str) -> Option<(String, Value)> {
+    let mut clicked = None;
+    if let Some(MenuNode::Submenu { children, .. }) =
+        effectcraft_engine::menus::menu_bar().iter().find(|n| matches!(n, MenuNode::Submenu { label, .. } if label == name))
+    {
+        menu_nodes(app, ui, children, &mut clicked, &mut crate::menu_keys::Nav::default(), 0);
+    }
+    clicked.map(|(id, params)| (id, if params.is_null() { json!({}) } else { params }))
+}
+
+/// The entries `nodes` of a menu `depth` submenus deep, registered with `nav` for the keyboard.
+fn menu_nodes(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    nodes: &[MenuNode],
+    clicked: &mut Option<(String, Value)>,
+    nav: &mut crate::menu_keys::Nav,
+    depth: usize,
+) {
+    for n in nodes {
+        match n {
+            MenuNode::Separator => {
+                ui.separator();
+            }
+            MenuNode::Dynamic { name } => {
+                // Recent projects / footage / presets, undo history, shortcut slots, viewers,
+                // saved workspaces.
+                let ws = app.ui.workspace.clone();
+                let saved = app.saved_workspace_names();
+                let (nodes, empty) = effectcraft_engine::menus::dynamic_nodes(&app.session, name, &dyn_ctx(&ws, &saved));
+                if nodes.is_empty()
+                    && let Some(e) = empty
+                {
+                    ui.add_enabled(false, egui::Button::new((gutter(false), e)));
+                }
+                for (i, n) in nodes.iter().enumerate() {
+                    // A folder of scripts or panels: a submenu.
+                    let MenuNode::Item(e) = n else {
+                        menu_nodes(app, ui, std::slice::from_ref(n), clicked, nav, depth);
+                        continue;
+                    };
+                    let tip = match name.as_str() {
+                        "recentProjects" => app.session.prefs.recent_projects.get(i).cloned(),
+                        "recentFootage" => app.session.prefs.recent_footage.get(i).cloned(),
+                        "recentPresets" => app.session.prefs.recent_presets.get(i).cloned(),
+                        "recentScripts" => app.session.prefs.recent_scripts.get(i).map(|r| r.text().to_string()),
+                        _ => None,
+                    };
+                    let mut b = egui::Button::new((gutter(entry_checked(app, e) == Some(true)), e.label.as_str()));
+                    // File ▸ Scripts entries show the key a script was given.
+                    if let Some(s) = entry_shortcut(app, e) {
+                        b = b.shortcut_text(shortcut_text(&s));
+                    }
+                    let r = ui.add_enabled(entry_enabled(app, e), b);
+                    let r = match &tip {
+                        Some(t) => r.on_hover_text(t),
+                        None => r,
+                    };
+                    let r = browse_hover(nav, r);
+                    app.auto.add(&format!("menu.{name}.{i}"), r.rect, &e.label);
+                    nav.entry(ui, depth, &r, false);
+                    if r.clicked() || browse_pick(nav, ui, &r) {
+                        *clicked = Some((e.command.clone(), e.params.clone()));
+                        ui.close();
+                    }
+                }
+            }
+            MenuNode::Submenu { label, children } => {
+                let ws = app.ui.workspace.clone();
+                // The generated Effect menu's category submenus draw the catalog's name (#821);
+                // every other submenu goes through the menu catalog.
+                let shown = crate::i18n::effect_category(children, label)
+                    .unwrap_or_else(|| crate::i18n::submenu(app, label, effectcraft_engine::menus::submenu_label(&app.session, label, &dyn_ctx(&ws, &[]))));
+                let browsing = nav.browsing();
+                let egui::InnerResponse { inner, response } = ui.menu_button((gutter(false), shown.as_str()), |ui| {
+                    ui.set_min_width(if children.len() > 30 { 200.0 } else { 240.0 });
+                    crate::widgets::menu_scroll(ui, browsing, |ui| menu_nodes(app, ui, children, clicked, nav, depth + 1));
+                });
+                let response = browse_hover(nav, response);
+                nav.entry(ui, depth, &response, true);
+                if inner.is_some() {
+                    // `ui.menu_button` drops the popup's own response on the floor: read it back,
+                    // so that a press inside this submenu doesn't count as an outside press.
+                    let sub = egui::containers::menu::SubMenu::id_from_widget_id(response.id);
+                    if let Some(resp) = ui.ctx().read_response(sub) {
+                        nav.cover(resp.rect);
+                    }
+                    nav.opened(depth, &response);
+                }
+            }
+            MenuNode::Item(e) => {
+                let r = browse_hover(nav, menu_entry(app, ui, e));
+                nav.entry(ui, depth, &r, false);
+                if r.clicked() || browse_pick(nav, ui, &r) {
+                    *clicked = Some((e.command.clone(), e.params.clone()));
+                    ui.close();
+                }
+            }
+        }
+    }
+}
+
+/// The row `r` highlighted while the bar is mid press-and-browse: with a button down egui reports
+/// nothing as hovered — which would leave browsing with no hover feedback at all — so the row
+/// under the pointer takes the highlight by hand. It reads as the hover look one frame later,
+/// exactly egui's own hover latency; disabled rows ignore it (`Noninteractive`), as in native
+/// menus. Context menus use their own [`crate::menu_keys::Nav`], where the bar never browses.
+fn browse_hover(nav: &crate::menu_keys::Nav, r: egui::Response) -> egui::Response {
+    if nav.browsing() && r.contains_pointer() { r.highlight() } else { r }
+}
+
+/// Whether a press-and-browse (a menu-bar title still held down) releases over entry `r`, which
+/// then chooses it like a click does. egui reports neither for it: the release is far from the
+/// press, so there is no click, and nothing but the pressed widget is hovered while a button is
+/// down, so the row has to be tested by the pointer being over it.
+fn browse_pick(nav: &crate::menu_keys::Nav, ui: &egui::Ui, r: &egui::Response) -> bool {
+    nav.browsing() && r.enabled() && r.contains_pointer() && ui.input(|i| i.pointer.button_released(egui::PointerButton::Primary))
+}
+
+/// The menu bar's submenu at `path` (`["File", "Interpret Footage"]`) in a panel's context menu,
+/// with the menu bar's labels, shortcuts and enabled state; a chosen entry goes to `clicked`.
+pub(crate) fn submenu_at(app: &mut EffectcraftApp, ui: &mut egui::Ui, path: &[&str], clicked: &mut Option<(String, Value)>) {
+    let mut nodes = effectcraft_engine::menus::menu_bar();
+    let mut found = None;
+    for label in path {
+        let Some(n) = nodes.iter().find(|n| matches!(n, MenuNode::Submenu { label: l, .. } if l == label)) else { return };
+        if let MenuNode::Submenu { children, .. } = n {
+            nodes = children;
+        }
+        found = Some(n);
+    }
+    if let Some(n) = found {
+        menu_nodes(app, ui, std::slice::from_ref(n), clicked, &mut crate::menu_keys::Nav::default(), 0);
+    }
+    if let Some((_, p)) = clicked.as_mut()
+        && p.is_null()
+    {
+        *p = json!({});
+    }
+}
+
+/// The menu bar's entry for `command` in a panel's context menu (see [`submenu_at`]).
+pub(crate) fn entry_for(app: &EffectcraftApp, ui: &mut egui::Ui, command: &str, clicked: &mut Option<(String, Value)>) {
+    if let Some((_, e)) = effectcraft_engine::menus::entries().into_iter().find(|(_, e)| e.command == command)
+        && menu_entry(app, ui, e).clicked()
+    {
+        *clicked = Some((e.command.clone(), e.params_or_empty()));
+        ui.close();
+    }
+}
+
+/// Frontend state for dynamic menus (the current workspace and the saved ones).
+pub(crate) fn dyn_ctx<'a>(workspace: &'a str, saved_workspaces: &'a [String]) -> effectcraft_engine::menus::DynCtx<'a> {
+    effectcraft_engine::menus::DynCtx { workspace: Some(workspace), saved_workspaces }
+}
+
+/// The check-mark column every menu row reserves (like macOS / After Effects menus).
+fn gutter(checked: bool) -> egui::Atom<'static> {
+    use egui::AtomExt;
+    (if checked { "✔" } else { "" }).atom_size(egui::vec2(14.0, 14.0))
+}
+
+fn menu_entry(app: &EffectcraftApp, ui: &mut egui::Ui, e: &MenuEntry) -> egui::Response {
+    let (label, check, enabled) = (entry_label(app, e), gutter(entry_checked(app, e) == Some(true)), entry_enabled(app, e));
+    // Edit ▸ Label's entries show the label's colour before its name.
+    if e.command == "edit.label"
+        && let Some(l) = e.params.get("label").and_then(Value::as_str).and_then(effectcraft_engine::color::Label::from_name)
+    {
+        let out = ui.add_enabled_ui(enabled, |ui| egui::Button::new((check, crate::widgets::label_swatch(), label)).atom_ui(ui)).inner;
+        crate::widgets::paint_label_swatch(ui, &out, l, &app.tokens);
+        return out.response;
+    }
+    let mut b = egui::Button::new((check, label));
+    if let Some(s) = entry_shortcut(app, e) {
+        b = b.shortcut_text(shortcut_text(&s));
+    }
+    ui.add_enabled(enabled, b)
+}
diff --git a/crates/ui-egui/src/menus/commands.rs b/crates/ui-egui/src/menus/commands.rs
new file mode 100644
index 000000000..c162bbd3a
--- /dev/null
+++ b/crates/ui-egui/src/menus/commands.rs
@@ -0,0 +1,122 @@
+use super::UiCommand;
+
+macro_rules! uic {
+    ($id:literal, $label:literal, [$($m:literal),*], $sc:expr) => {
+        UiCommand { id: $id, label: $label, menu: &[$($m),*], shortcut: $sc }
+    };
+}
+
+/// UI-only commands (not in the AE menus; shortcuts and the command palette).
+pub const UI_COMMANDS: &[UiCommand] = &[
+    uic!("window.dockAction", "Docking Action", [], None),
+    uic!("playback.ramPreview", "Preview (Numpad 0)", [], Some("Num0")),
+    uic!("playback.preview.shiftSpacebar", "Preview (Shift+Spacebar)", [], Some("Shift+Space")),
+    uic!("playback.preview.shiftNumpad0", "Preview (Shift+Numpad 0)", [], Some("Shift+Num0")),
+    uic!("playback.preview.altNumpad0", "Preview (Alt+Numpad 0)", [], Some("Alt+Num0")),
+    uic!("playback.stop", "Stop", [], None),
+    uic!("view.fit", "Fit", [], Some("Shift+/")),
+    uic!("view.actualSize", "100%", [], Some("/")),
+    uic!("view.fitUpTo100", "Fit up to 100%", [], Some("Alt+/")),
+    uic!("view.nextItem", "Next Composition in Viewer", [], Some("Shift+.")),
+    uic!("view.previousItem", "Previous Composition in Viewer", [], Some("Shift+,")),
+    uic!("viewer.nudge.up", "Move Selected Layers Up 1 Pixel at Current Magnification", [], Some("ArrowUp")),
+    uic!("viewer.nudge.down", "Move Selected Layers Down 1 Pixel at Current Magnification", [], Some("ArrowDown")),
+    uic!("viewer.nudge.left", "Move Selected Layers Left 1 Pixel at Current Magnification", [], Some("ArrowLeft")),
+    uic!("viewer.nudge.right", "Move Selected Layers Right 1 Pixel at Current Magnification", [], Some("ArrowRight")),
+    uic!("viewer.nudge.up10", "Move Selected Layers Up 10 Pixels at Current Magnification", [], Some("Shift+ArrowUp")),
+    uic!("viewer.nudge.down10", "Move Selected Layers Down 10 Pixels at Current Magnification", [], Some("Shift+ArrowDown")),
+    uic!("viewer.nudge.left10", "Move Selected Layers Left 10 Pixels at Current Magnification", [], Some("Shift+ArrowLeft")),
+    uic!("viewer.nudge.right10", "Move Selected Layers Right 10 Pixels at Current Magnification", [], Some("Shift+ArrowRight")),
+    uic!("view.safeMargins", "Title/Action Safe", [], Some("'")),
+    uic!("view.transparencyGrid", "Transparency Grid", [], None),
+    uic!("view.fastPreviews", "Fast Previews", [], None),
+    uic!("view.theme.toggle", "Next Appearance Mode", [], None),
+    uic!("view.theme.dark", "Theme: Dark", [], None),
+    uic!("view.theme.darker", "Theme: Darker", [], None),
+    uic!("view.theme.light", "Theme: Light", [], None),
+    uic!("timeline.zoomIn", "Zoom In Time", [], Some("=")),
+    uic!("timeline.zoomOut", "Zoom Out Time", [], Some("-")),
+    uic!("timeline.zoomFit", "Zoom to Fit Comp", [], Some("Shift+;")),
+    uic!("timeline.scrollToTime", "Scroll to Current Time", [], Some("D")),
+    uic!("timeline.scrollToLayer", "Scroll Topmost Selected Layer to Top", [], Some("X")),
+    uic!("timeline.parentColumn", "Show/Hide Parent Column", [], Some("Shift+F4")),
+    uic!("timeline.zoomFrameToggle", "Zoom In to Frame Level / Out to the Whole Comp", [], Some(";")),
+    uic!("timeline.graphEditor", "Graph Editor", [], Some("Shift+F3")),
+    uic!("timeline.switchesModes", "Toggle Switches / Modes", [], Some("F4")),
+    uic!("timeline.workAreaBegin", "Set Work Area Begin", [], Some("B")),
+    uic!("timeline.workAreaEnd", "Set Work Area End", [], Some("N")),
+    uic!("timeline.moveInToTime", "Move Layer In Point to Current Time", [], Some("[")),
+    uic!("timeline.moveOutToTime", "Move Layer Out Point to Current Time", [], Some("]")),
+    uic!("timeline.trimInToTime", "Trim Layer In Point to Current Time", [], Some("Alt+[")),
+    uic!("timeline.trimOutToTime", "Trim Layer Out Point to Current Time", [], Some("Alt+]")),
+    uic!("timeline.reveal.position", "Reveal Position", [], Some("P")),
+    uic!("timeline.reveal.scale", "Reveal Scale", [], Some("S")),
+    uic!("timeline.reveal.rotation", "Reveal Rotation", [], Some("R")),
+    uic!("timeline.reveal.opacity", "Reveal Opacity", [], Some("T")),
+    uic!("timeline.reveal.anchor", "Reveal Anchor Point", [], Some("A")),
+    uic!("timeline.reveal.effects", "Reveal Effects", [], Some("E")),
+    uic!("timeline.reveal.masks", "Reveal Masks", [], Some("M")),
+    uic!("timeline.reveal.feather", "Reveal Mask Feather", [], Some("F")),
+    uic!("timeline.reveal.levels", "Reveal Audio Levels (press twice: Waveform)", [], Some("L")),
+    uic!("timeline.reveal.timeRemap", "Reveal Time Remap", [], None),
+    uic!("timeline.reveal.expressions", "Reveal Expressions", [], None),
+    uic!("timeline.reveal.maskOpacity", "Reveal Mask Opacity", [], None),
+    uic!("timeline.reveal.maskPath", "Reveal Mask Path", [], None),
+    uic!("timeline.reveal.material", "Reveal Material Options", [], None),
+    uic!("timeline.reveal.paint", "Reveal Paint, Roto Brush and Puppet", [], None),
+    uic!("timeline.reveal.selected", "Reveal Selected Properties", [], None),
+    uic!("timeline.reveal.missingEffects", "Reveal Missing Effects", [], None),
+    uic!("timeline.reveal.waveform", "Reveal Audio Waveform", [], None),
+    uic!("timeline.revealAdd.position", "Add Position to Revealed Properties", [], Some("Shift+P")),
+    uic!("timeline.revealAdd.scale", "Add Scale to Revealed Properties", [], Some("Shift+S")),
+    uic!("timeline.revealAdd.rotation", "Add Rotation to Revealed Properties", [], Some("Shift+R")),
+    uic!("timeline.revealAdd.opacity", "Add Opacity to Revealed Properties", [], Some("Shift+T")),
+    uic!("timeline.revealAdd.anchor", "Add Anchor Point to Revealed Properties", [], Some("Shift+A")),
+    uic!("timeline.revealAdd.effects", "Add Effects to Revealed Properties", [], Some("Shift+E")),
+    uic!("timeline.revealAdd.masks", "Add Masks to Revealed Properties", [], Some("Shift+M")),
+    uic!("timeline.revealAdd.feather", "Add Mask Feather to Revealed Properties", [], Some("Shift+F")),
+    uic!("timeline.revealAdd.levels", "Add Audio Levels to Revealed Properties", [], Some("Shift+L")),
+    uic!("timeline.revealAdd.animated", "Add Animated Properties to Revealed Properties", [], Some("Shift+U")),
+    uic!("timeline.column", "Show/Hide Timeline Column", [], None),
+    uic!("timeline.sourceName", "Source Name / Layer Name", [], None),
+    uic!("timeline.search", "Search Timeline", [], None),
+    uic!("flowchart.options", "Flowchart Options", [], None),
+    uic!("flowchart.graph", "Flowchart Graph", [], None),
+    uic!("timeline.collapseAll", "Collapse All", [], None),
+    uic!("timeline.twirlSelected", "Twirl Selected Layers Open / Closed", [], Some("Cmd+`")),
+    uic!("timeline.keyAt.anchor", "Add or Remove Anchor Point Keyframe", [], Some("Alt+Shift+A")),
+    uic!("timeline.keyAt.position", "Add or Remove Position Keyframe", [], Some("Alt+Shift+P")),
+    uic!("timeline.keyAt.scale", "Add or Remove Scale Keyframe", [], Some("Alt+Shift+S")),
+    uic!("timeline.keyAt.rotation", "Add or Remove Rotation Keyframe", [], Some("Alt+Shift+R")),
+    uic!("timeline.keyAt.opacity", "Add or Remove Opacity Keyframe", [], Some("Alt+Shift+T")),
+    uic!("tool.selection", "Selection Tool", [], Some("V")),
+    uic!("tool.hand", "Hand Tool", [], Some("H")),
+    uic!("tool.zoom", "Zoom Tool", [], Some("Z")),
+    uic!("tool.orbit", "Orbit Tool", [], Some("1")),
+    uic!("tool.panCamera", "Pan Camera Tool", [], Some("2")),
+    uic!("tool.dolly", "Dolly Tool", [], Some("3")),
+    uic!("tool.camera", "Camera Tools", [], Some("C")),
+    uic!("tool.rotate", "Rotation Tool", [], Some("W")),
+    uic!("tool.panBehind", "Pan Behind Tool", [], Some("Y")),
+    uic!("tool.shape", "Shape Tools", [], Some("Q")),
+    uic!("tool.pen", "Pen Tool", [], Some("G")),
+    uic!("tool.type", "Type Tools", [], Some("Cmd+T")),
+    uic!("tool.brush", "Brush Tools", [], Some("Cmd+B")),
+    uic!("tool.rotoBrush", "Roto Brush & Refine Edge Tools", [], Some("Alt+W")),
+    uic!("tool.puppet", "Puppet Tools", [], Some("Cmd+P")),
+    uic!("app.newComp", "New Composition...", [], None),
+    uic!("app.compSettings", "Composition Settings...", [], None),
+    uic!("app.solidSettings", "New Solid...", [], None),
+    uic!("app.home", "Home", [], None),
+    uic!("markers.dialog", "Marker Settings...", [], None),
+    uic!("window.maximizePanel", "Maximize Panel Under Pointer", [], Some("`")),
+    uic!("window.maximizeApp", "Maximize or Restore Application Window", [], Some("Cmd+\\")),
+    uic!("window.toggleCompTimeline", "Switch Between Composition and Timeline Panel", [], Some("\\")),
+    uic!("window.nextPanel", "Next Panel in Frame", [], Some("Alt+Shift+.")),
+    uic!("window.previousPanel", "Previous Panel in Frame", [], Some("Alt+Shift+,")),
+    uic!("window.closeAll", "Close Panel or All Viewers", [], Some("Cmd+Shift+W")),
+    uic!("window.dockPanel", "Dock Panel", [], None),
+    uic!("window.floatPanel", "Undock Panel", [], None),
+    uic!("window.closePanel", "Close Panel", [], None),
+    uic!("window.panelWindow", "Move Panel to New Window", [], None),
+];
diff --git a/crates/ui-egui/src/menus/entries.rs b/crates/ui-egui/src/menus/entries.rs
new file mode 100644
index 000000000..3391e47bd
--- /dev/null
+++ b/crates/ui-egui/src/menus/entries.rs
@@ -0,0 +1,151 @@
+use super::*;
+
+/// A menu entry for display / `ui.menu.list`.
+#[derive(Clone, Debug, serde::Serialize)]
+pub struct MenuItem {
+    pub id: String,
+    pub label: String,
+    pub path: Vec<String>,
+    pub shortcut: Option<String>,
+    pub enabled: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub checked: Option<bool>,
+    /// Parameters bound to the entry (e.g. the effect for Effect menu items).
+    #[serde(skip_serializing_if = "Value::is_null")]
+    pub params: Value,
+}
+
+/// Top-level menus in order.
+pub fn menus() -> Vec<&'static str> {
+    effectcraft_engine::menus::top_level()
+}
+
+pub(crate) fn entry_label(app: &EffectcraftApp, e: &MenuEntry) -> String {
+    let shown = match e.command.as_str() {
+        "edit.undo" => app.session.history.undo.last().map(|u| format!("Undo {}", u.0)).unwrap_or_else(|| "Can't Undo".into()),
+        "edit.redo" => app.session.history.redo.last().map(|u| format!("Redo {}", u.0)).unwrap_or_else(|| "Can't Redo".into()),
+        // Window ▸ Layer: the layer open in the Layer panel.
+        "window.panel" if e.params.get("panel").and_then(Value::as_str) == Some("layer") => {
+            let name = app
+                .ui
+                .layer_panel
+                .and_then(|id| app.session.active_comp().and_then(|c| c.layer(effectcraft_engine::project::LayerId(id))))
+                .map(|l| l.name.clone());
+            format!("Layer: {}", name.unwrap_or_else(|| "(none)".into()))
+        }
+        _ => effectcraft_engine::menus::entry_label(&app.session, e),
+    };
+    crate::i18n::entry(app, e, shown)
+}
+
+/// The entry's shortcut in the active keyboard shortcut preset.
+pub(crate) fn entry_shortcut(app: &EffectcraftApp, e: &MenuEntry) -> Option<String> {
+    app.session.shortcuts().shortcut_of(&e.command, &e.params).map(str::to_string)
+}
+
+/// Whether panel `p` is on screen: the front tab of a floating window, or of a docked group
+/// (an open frame in a stack) that a maximized panel does not cover.
+pub(crate) fn panel_shown(app: &EffectcraftApp, p: PanelKind) -> bool {
+    if app.ui.dock.is_floating(p) {
+        return app.ui.dock.is_visible(p);
+    }
+    match app.ui.maximized.filter(|m| app.ui.dock.is_docked(*m)) {
+        Some(m) => m == p,
+        None => app.ui.dock.is_visible(p),
+    }
+}
+
+/// The command a menu entry runs when chosen from a menu: Window ▸ `<panel>` closes a panel whose
+/// entry is checked, as in After Effects (#1630). Shortcuts and agents calling `window.panel`
+/// still only show the panel.
+pub(crate) fn menu_choice(app: &EffectcraftApp, id: String, params: Value) -> (String, Value) {
+    if id == "window.panel"
+        && let Some(p) = params.get("panel").and_then(Value::as_str).and_then(PanelKind::from_name)
+        && panel_shown(app, p)
+    {
+        return ("window.closePanel".into(), params);
+    }
+    (id, params)
+}
+
+/// Check-mark state of frontend toggles (engine state is answered by the engine).
+pub(crate) fn entry_checked(app: &EffectcraftApp, e: &MenuEntry) -> Option<bool> {
+    let v = &app.ui.viewer;
+    let pstr = |k: &str| e.params.get(k).and_then(Value::as_str);
+    match e.command.as_str() {
+        "view.rulers" => Some(v.rulers),
+        "view.guides" => Some(v.guides),
+        "view.snapToGuides" => Some(v.snap_guides),
+        "view.lockGuides" => Some(v.lock_guides),
+        "view.grid" => Some(v.grid),
+        "view.snapToGrid" => Some(v.snap_grid),
+        "view.layerControls" => Some(v.show_layer_controls),
+        "playback.cacheWhenIdle" => Some(app.ui.cache_when_idle),
+        "playback.audio" => Some(app.session.prefs.preview.active().include_audio),
+        "window.workspace" => Some(pstr("name").is_some_and(|n| n == app.ui.workspace)),
+        // The Tools panel is the header toolbar: always on screen.
+        "window.panel" => Some(pstr("panel").is_some_and(|n| n.eq_ignore_ascii_case("tools") || PanelKind::from_name(n).is_some_and(|p| panel_shown(app, p)))),
+        "view.panelBackground" if e.params.get("pick").is_none() => {
+            let cur = match v.pasteboard {
+                None => "mediumGray",
+                Some([0, 0, 0]) => "black",
+                Some([0x2a, 0x2a, 0x2a]) => "darkGray",
+                Some([0xb4, 0xb4, 0xb4]) => "lightGray",
+                Some([0xff, 0xff, 0xff]) => "white",
+                Some(_) => "custom",
+            };
+            Some(pstr("color") == Some(cur))
+        }
+        _ => effectcraft_engine::menus::checked(&app.session, &e.command, &e.params),
+    }
+}
+
+pub(crate) fn entry_enabled(app: &EffectcraftApp, e: &MenuEntry) -> bool {
+    // The Project-panel enabled rules mirror the invoke redirects, so they stand down for the
+    // same reason (see the redirect block): while a text edit is open the menu items must be
+    // enabled by what their routed command can do, or the menu grays out commands that work.
+    if app.ui.focused == PanelKind::Project && app.session.state.text_edit.is_none() {
+        match e.command.as_str() {
+            "edit.duplicate" => {
+                return !app.session.state.project_selection.is_empty()
+                    && app.session.state.project_selection.iter().all(|id| app.session.project.item(*id).is_some_and(|i| !i.is_folder()));
+            }
+            "edit.selectAll" => return !app.session.project.items.is_empty(),
+            "edit.deselectAll" => return !app.session.state.project_selection.is_empty(),
+            "edit.cut" | "edit.copy" | "edit.paste" | "edit.copyWithPropertyLinks" | "edit.copyWithRelativePropertyLinks" | "edit.copyExpressionOnly" => {
+                return false;
+            }
+            _ => {}
+        }
+    }
+    if e.command == "edit.clear" && app.ui.focused == PanelKind::Project {
+        // An open text edit stands down: Clear must not delete the comp being typed into (#2227).
+        return app.session.state.text_edit.is_none() && app.session.is_enabled("project.delete");
+    }
+    if e.command == "edit.clear" && app.ui.focused == PanelKind::RenderQueue {
+        return !app.session.is_rendering() && !app.session.project.render_queue.is_empty();
+    }
+    if e.command == "file.close" && super::invoke::no_params(&e.params) && app.ui.focused == PanelKind::RenderQueue {
+        return !app.ui.dock.locked;
+    }
+    if e.command == "window.panel" {
+        return true;
+    }
+    app.session.is_enabled(&e.command)
+}
+
+/// Every menu entry, flattened with its submenu path.
+pub fn menu_items(app: &EffectcraftApp) -> Vec<MenuItem> {
+    effectcraft_engine::menus::entries()
+        .into_iter()
+        .map(|(path, e)| MenuItem {
+            id: e.command.clone(),
+            label: entry_label(app, e),
+            path,
+            shortcut: entry_shortcut(app, e),
+            enabled: entry_enabled(app, e),
+            checked: entry_checked(app, e),
+            params: e.params.clone(),
+        })
+        .collect()
+}
diff --git a/crates/ui-egui/src/menus/frontend.rs b/crates/ui-egui/src/menus/frontend.rs
new file mode 100644
index 000000000..bd1294330
--- /dev/null
+++ b/crates/ui-egui/src/menus/frontend.rs
@@ -0,0 +1,820 @@
+use super::{EffectcraftApp, PanelKind, Resolution, Value, json};
+
+/// Run an engine command and perform the frontend events it emitted right away.
+/// Commands that fill the internal clipboard.
+const COPY_COMMANDS: &[&str] =
+    &["edit.copy", "edit.cut", "edit.copyWithPropertyLinks", "edit.copyWithRelativePropertyLinks", "edit.copyExpressionOnly", "keys.copy", "effect.copy"];
+
+/// Text for the system clipboard: copied keyframes and values as After Effects keyframe text,
+/// for other applications (#1908), else a line naming what EffectCraft copied. The system
+/// clipboard must hold something: with nothing on it, the windowing layer sends no paste event
+/// for Ctrl+V. Paste in EffectCraft uses its own clipboard either way.
+fn clipboard_text(s: &effectcraft_engine::Session) -> String {
+    let st = &s.state;
+    if let Some(text) = &st.keyframe_text {
+        return text.clone();
+    }
+    let n = |n: usize, one: &str, many: &str| format!("EffectCraft: {n} {}", if n == 1 { one } else { many });
+    if st.clip_is_keys && !st.key_clipboard.is_empty() {
+        n(st.key_clipboard.iter().map(|c| c.keys.len()).sum(), "keyframe", "keyframes")
+    } else if !st.effect_clipboard.is_empty() {
+        n(st.effect_clipboard.len(), "effect", "effects")
+    } else if !st.contents_clipboard.is_empty() {
+        n(st.contents_clipboard.len(), "shape item", "shape items")
+    } else if !st.mask_clipboard.is_empty() {
+        n(st.mask_clipboard.len(), "mask", "masks")
+    } else if st.link_clipboard.is_some() {
+        "EffectCraft: property links".into()
+    } else {
+        n(st.clipboard.len(), "layer", "layers")
+    }
+}
+
+/// What a command is checked against for leaving the Home screen: the active composition and
+/// the project (its epoch, which a replaced project steps even when its composition has the same
+/// id).
+type HomeMark = (Option<effectcraft_project::ItemId>, u64);
+
+/// The [`HomeMark`] of the session now.
+fn home_mark(app: &EffectcraftApp) -> HomeMark {
+    (app.session.active_comp_id(), app.session.script_ui.project_epoch)
+}
+
+/// A command that opened a composition (an imported After Effects project, a new or opened
+/// project) leaves the Home screen, as the Home screen's own buttons do: it otherwise stayed
+/// over the opened project.
+fn leave_home_if_opened(app: &mut EffectcraftApp, before: HomeMark, ok: bool) {
+    if ok && app.session.active_comp_id().is_some() && home_mark(app) != before {
+        app.ui.start_screen = false;
+    }
+}
+
+/// Runs engine command `id` from a menu, key or the control channel: the status line shows a
+/// failure, Copy commands fill the clipboard, the frontend events it queued run, and a command
+/// that opened a composition leaves the Home screen.
+pub(crate) fn run_engine(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, params: Value) -> Result<Value, String> {
+    // Events already queued belong to earlier invocations (`engine.execute` defers them).
+    let queued = app.session.events.len();
+    let before = home_mark(app);
+    let mut r = app.session.execute(id, params).map_err(|e| e.to_string());
+    if let Err(e) = &r {
+        app.ui.status = e.clone();
+    } else if COPY_COMMANDS.contains(&id) && app.session.state.text_edit.is_none() {
+        ctx.copy_text(clipboard_text(&app.session));
+    }
+    // Frontend events below may show the Home screen again (Help ▸ In-App Tutorials).
+    leave_home_if_opened(app, before, r.is_ok());
+    let events = app.session.drain_events();
+    for (index, ev) in events.into_iter().enumerate() {
+        match ev {
+            effectcraft_engine::Event::Frontend { command, params } => {
+                if let Err(e) = frontend(app, ctx, &command, params) {
+                    app.ui.status = e.clone();
+                    // A frontend-only command's own failure is the command's result (#696: a
+                    // workspace save that didn't reach disk reported success). An earlier
+                    // invocation's failure only sets the status.
+                    if index >= queued && command == id && r.is_ok() {
+                        r = Err(e);
+                    }
+                }
+            }
+            other => app.session.events.push(other),
+        }
+    }
+    r
+}
+
+fn toggle(slot: &mut bool, p: &Value) -> Value {
+    *slot = p.get("value").and_then(Value::as_bool).unwrap_or(!*slot);
+    json!(*slot)
+}
+
+/// Perform a frontend command (from `Event::Frontend`).
+pub fn frontend(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, p: Value) -> Result<Value, String> {
+    let now = app.now();
+    let v = &mut app.ui.viewer;
+    Ok(match id {
+        "mediaBrowser.copySourcePath" => {
+            let path = p.get("path").and_then(Value::as_str).filter(|path| !path.is_empty()).ok_or("A source path is required")?;
+            ctx.copy_text(path.to_string());
+            json!({"path": path})
+        }
+        "effects.copyPresetsFolderPath" => {
+            if cfg!(target_arch = "wasm32") {
+                return Err("The web app has no local presets folder".into());
+            }
+            let path = crate::panels::effects_presets::presets_dir().filter(|path| !path.as_os_str().is_empty()).ok_or("No presets folder is configured")?;
+            let path = std::path::absolute(path).map_err(|e| format!("Cannot resolve the presets folder path: {e}"))?;
+            let path = path.to_str().ok_or("The presets folder path is not valid UTF-8")?;
+            ctx.copy_text(path.to_string());
+            json!({"path": path})
+        }
+        "app.checkForUpdates" | "help.checkForUpdates" => {
+            crate::updates_ui::check(app);
+            Value::Null
+        }
+        "app.about" => {
+            app.dialog = Some(crate::Dialog::About);
+            Value::Null
+        }
+        // Window ▸ <ScriptUI panel>: dock (or bring forward) the panel the script built.
+        // Audio scrubbing: one frame of audio at `time` (default the current time).
+        "playback.scrubAudio" => {
+            let cid = app.session.active_comp_id().ok_or("no composition")?;
+            let t = p.get("time").and_then(Value::as_f64).map_or(app.session.time(), effectcraft_engine::time::Tick::from_seconds_f64);
+            app.scrub_audio(cid, t, now);
+            json!({"playing": app.scrub.is_some()})
+        }
+        // View ▸ New Viewer.
+        "view.newViewer" => json!({"viewer": crate::panels::viewers::new_viewer(app)}),
+        // Reveal Layer Source / Reveal Composition: show the Project panel on the item, opening
+        // its folders and clearing the search so the row is visible.
+        "project.reveal" => {
+            let ids: Vec<effectcraft_engine::project::ItemId> = p
+                .get("items")
+                .and_then(Value::as_array)
+                .map(|items| items.iter().filter_map(Value::as_u64).map(effectcraft_engine::project::ItemId).collect())
+                .or_else(|| p.get("item").and_then(Value::as_u64).map(|item| vec![effectcraft_engine::project::ItemId(item)]))
+                .unwrap_or_default();
+            crate::panels::project::reveal(app, ctx, &ids);
+            json!({"items": ids.iter().map(|item| item.0).collect::<Vec<_>>()})
+        }
+        // Run by id (control channel, MCP): the Project panel's selection, whatever has focus.
+        "project.deleteWithoutConfirmation" => crate::panels::delete_items::delete_confirmed(app, ctx, json!({}))?,
+        // A gradient property's "Edit Gradient…" (the Timeline's value): the Gradient Editor.
+        "prop.editGradient" => crate::panels::gradient_editor::open(app, &p)?,
+        "window.scriptPanel" => {
+            let id = p.get("window").and_then(Value::as_u64).ok_or("no ScriptUI panel window")? as u32;
+            app.show_panel(PanelKind::ScriptPanel(id));
+            json!({"window": id})
+        }
+        "layer.style.options" => {
+            crate::panels::layer_styles_dialog::open(app, &p)?;
+            Value::Null
+        }
+        "app.settings" => {
+            let page = p.get("page").and_then(Value::as_str).unwrap_or("general");
+            crate::panels::settings::open(app, effectcraft_engine::prefs::page_id(page).unwrap_or("general"));
+            Value::Null
+        }
+        "app.gpuInfo" => {
+            crate::panels::dialogs::info(
+                app,
+                "GPU Information",
+                &format!(
+                    "{}Layer cache: {} MB  •  Preview cache: {} MB.",
+                    effectcraft_engine::sysinfo::gpu_summary(&app.session),
+                    app.session.layer_cache.budget() >> 20,
+                    app.frames.budget() >> 20
+                ),
+            );
+            Value::Null
+        }
+        "app.hide" | "app.hideOthers" | "app.showAll" => {
+            // The desktop app asks macOS (NSApplication hide / hideOtherApplications /
+            // unhideAllApplications); elsewhere Hide minimizes and the others don't apply.
+            if app.hooks.app_action.as_ref().is_some_and(|f| f(id)) {
+                return Ok(Value::Null);
+            }
+            match id {
+                "app.hide" => ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(true)),
+                _ => return Err(format!("`{id}` is only available on macOS")),
+            }
+            Value::Null
+        }
+        "app.quit" => {
+            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+            Value::Null
+        }
+        "app.commandPalette" => {
+            app.dialog_state.palette_query = p.get("query").and_then(Value::as_str).unwrap_or_default().to_string();
+            app.dialog_state.palette_sel = 0;
+            app.dialog = Some(crate::Dialog::CommandPalette);
+            Value::Null
+        }
+        "app.keyboardShortcuts" => {
+            crate::panels::shortcut_editor::open(app);
+            Value::Null
+        }
+        "app.templates" => {
+            let kind = p.get("kind").and_then(Value::as_str).unwrap_or("renderSettings");
+            crate::panels::rq_templates::open(app, ctx, kind);
+            Value::Null
+        }
+        "renderQueue.notify" => {
+            // Render finished with Notify on: a toast, the dock/taskbar attention request, and the
+            // host's system sound (the desktop app handles `renderQueue.notify`).
+            let msg = p.get("message").and_then(Value::as_str).unwrap_or("Render finished").to_string();
+            app.toast = Some((msg, now));
+            ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Informational));
+            if let Some(f) = app.hooks.app_action.as_ref() {
+                f("renderQueue.notify");
+            }
+            Value::Null
+        }
+        "app.find" => {
+            if let Some(status) = p.get("status").and_then(Value::as_str) {
+                app.ui.project_status = match status {
+                    "all" => crate::state::ProjectStatus::All,
+                    "available" => crate::state::ProjectStatus::Available,
+                    "missing" => crate::state::ProjectStatus::Missing,
+                    _ => return Err("status must be all, available or missing".into()),
+                };
+            }
+            if let Some(q) = p.get("query").and_then(Value::as_str) {
+                app.ui.project_search = q.to_string();
+            }
+            app.show_panel(PanelKind::Project);
+            Value::Null
+        }
+        "playback.toggle" => {
+            // The play button and Spacebar: `{shortcut?}` picks which Preview panel shortcut's
+            // options to play with (default Spacebar).
+            let sc = match p.get("shortcut").and_then(Value::as_str) {
+                Some(k) => effectcraft_engine::preview::PreviewShortcut::parse(k).ok_or_else(|| format!("unknown preview shortcut `{k}`"))?,
+                None => effectcraft_engine::preview::PreviewShortcut::Spacebar,
+            };
+            app.toggle_play_with(now, sc);
+            json!({"playing": app.playback.playing, "shortcut": sc.id()})
+        }
+        "playback.cacheWhenIdle" => {
+            let r = toggle(&mut app.ui.cache_when_idle, &p);
+            app.set_pref("previews.cacheFramesWhenIdle", r.clone())?;
+            r
+        }
+        "playback.audio" => {
+            // Include Audio of the shortcut shown in the Preview panel.
+            let mut on = app.session.prefs.preview.active().include_audio;
+            let r = toggle(&mut on, &p);
+            app.session.execute("playback.settings.set", json!({"includeAudio": on})).map_err(|e| e.to_string())?;
+            if !on {
+                app.audio = None;
+            }
+            r
+        }
+        // Zoom In / Zoom Out act on the focused viewer: the Layer panel when it has focus, else
+        // the Composition viewer.
+        "view.zoomIn" | "view.zoomOut" if app.ui.focused == PanelKind::Layer => {
+            let cur = app.ui.layer_zoom.unwrap_or_else(|| crate::panels::layer_panel::last_fit(ctx));
+            // The Layer panel zooms in points (pixels-per-point 1).
+            let next = zoom_step(cur, 1.0, id == "view.zoomIn");
+            app.ui.layer_zoom = Some(next);
+            json!({"zoom": next, "panel": "layer"})
+        }
+        "view.zoomIn" | "view.zoomOut" => {
+            let ppp = ctx.pixels_per_point();
+            let cur = v.zoom.unwrap_or_else(|| crate::panels::viewer::last_fit(ctx));
+            let next = zoom_step(cur, ppp, id == "view.zoomIn");
+            v.zoom = Some(next);
+            json!({"zoom": next})
+        }
+        // View ▸ Resolution ▸ Custom without a factor (the engine sets the comp's resolution).
+        "view.res.custom" => {
+            let cur = match app.viewer_res() {
+                Resolution::Custom(n) => f64::from(n),
+                _ => 2.0,
+            };
+            crate::panels::dialogs::form(
+                app,
+                "Custom Resolution",
+                "view.res.custom",
+                json!({}),
+                vec![crate::panels::dialogs::Field::num("factor", "Render every n-th pixel", cur)],
+            );
+            Value::Null
+        }
+        "view.rulers" => toggle(&mut v.rulers, &p),
+        "view.guides" => toggle(&mut v.guides, &p),
+        "view.snapToGuides" => toggle(&mut v.snap_guides, &p),
+        "view.lockGuides" => toggle(&mut v.lock_guides, &p),
+        "view.grid" => toggle(&mut v.grid, &p),
+        "view.snapToGrid" => toggle(&mut v.snap_grid, &p),
+        "view.layerControls" => toggle(&mut v.show_layer_controls, &p),
+        "view.options" => {
+            app.dialog = Some(crate::Dialog::ViewOptions);
+            Value::Null
+        }
+        "view.panelBackground" => {
+            if p.get("pick").and_then(Value::as_bool) == Some(true) {
+                let [r, g, b] = v.custom_pasteboard;
+                crate::panels::dialogs::form(
+                    app,
+                    "Panel Background Color",
+                    "view.panelBackground",
+                    json!({}),
+                    vec![crate::panels::dialogs::Field::text("color", "Color (#rrggbb)", &format!("#{r:02x}{g:02x}{b:02x}"))],
+                );
+                return Ok(Value::Null);
+            }
+            let c = p.get("color").and_then(Value::as_str).unwrap_or("mediumGray");
+            v.pasteboard = match c {
+                "black" => Some([0, 0, 0]),
+                "darkGray" => Some([0x2a, 0x2a, 0x2a]),
+                "mediumGray" => None,
+                "lightGray" => Some([0xb4, 0xb4, 0xb4]),
+                "white" => Some([0xff, 0xff, 0xff]),
+                "custom" => Some(v.custom_pasteboard),
+                hex => {
+                    let c = effectcraft_engine::color::Rgba::from_hex(hex).ok_or_else(|| format!("unknown colour `{hex}`"))?;
+                    let rgb = [(c.r * 255.0).round() as u8, (c.g * 255.0).round() as u8, (c.b * 255.0).round() as u8];
+                    v.custom_pasteboard = rgb;
+                    Some(rgb)
+                }
+            };
+            Value::Null
+        }
+        // Ctrl+\ / Cmd+\, as in After Effects (#336): `{maximized}`, the window's new state.
+        "window.maximizeApp" => {
+            let maximized = !ctx.input(|i| i.viewport().maximized.unwrap_or(false));
+            ctx.send_viewport_cmd(egui::ViewportCommand::Maximized(maximized));
+            json!({"maximized": maximized})
+        }
+        "view.fullScreen" => {
+            let full = ctx.input(|i| i.viewport().fullscreen.unwrap_or(false));
+            ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(!full));
+            json!(!full)
+        }
+        "window.panel" => {
+            let name = p.get("panel").and_then(Value::as_str).unwrap_or_default();
+            if name.eq_ignore_ascii_case("tools") {
+                app.ui.status = "The Tools panel is the toolbar in the header".into();
+                return Ok(Value::Null);
+            }
+            let panel = PanelKind::from_name(name).ok_or_else(|| format!("unknown panel `{name}`"))?;
+            app.show_panel(panel);
+            Value::Null
+        }
+        "window.workspace" => {
+            let want = p.get("name").and_then(Value::as_str).unwrap_or("Default").to_ascii_lowercase().replace(' ', "");
+            let name = app
+                .workspace_names()
+                .into_iter()
+                .find(|w| w.to_ascii_lowercase().replace(' ', "") == want)
+                .ok_or_else(|| format!("unknown workspace `{want}`"))?;
+            app.set_workspace(&name);
+            json!({"workspace": name})
+        }
+        "window.resetWorkspace" => {
+            let name = app.ui.workspace.clone();
+            app.set_workspace(&name);
+            Value::Null
+        }
+        "window.saveWorkspace" => {
+            crate::workspace_state::ensure_positions_ready(&app.ui)?;
+            let name = app.ui.workspace.clone();
+            app.ui.saved_workspaces.insert(name.clone(), app.ui.dock.clone());
+            app.store_saved_workspaces()?;
+            json!({"workspace": name})
+        }
+        "window.saveWorkspaceAs" => {
+            let Some(name) = p.get("name").and_then(Value::as_str).map(str::trim).filter(|n| !n.is_empty()).map(str::to_string) else {
+                crate::panels::dialogs::form(
+                    app,
+                    "New Workspace",
+                    "window.saveWorkspaceAs",
+                    json!({}),
+                    vec![crate::panels::dialogs::Field::text("name", "Name", "Untitled Workspace")],
+                );
+                return Ok(Value::Null);
+            };
+            crate::workspace_state::ensure_positions_ready(&app.ui)?;
+            app.ui.saved_workspaces.insert(name.clone(), app.ui.dock.clone());
+            app.ui.workspace = name.clone();
+            app.store_saved_workspaces()?;
+            json!({"workspace": name})
+        }
+        "window.editWorkspaces" => {
+            let Some(name) = p.get("name").and_then(Value::as_str).map(str::to_string) else {
+                let cur = app.ui.workspace.clone();
+                crate::panels::dialogs::form(
+                    app,
+                    "Edit Workspaces",
+                    "window.editWorkspaces",
+                    json!({}),
+                    vec![
+                        crate::panels::dialogs::Field::text("name", "Workspace", &cur),
+                        crate::panels::dialogs::Field::text("rename", "Rename to", &cur),
+                        crate::panels::dialogs::Field::bool("delete", "Delete", false),
+                    ],
+                );
+                return Ok(Value::Null);
+            };
+            let builtin = crate::dock::WORKSPACES.contains(&name.as_str());
+            if p.get("delete").and_then(Value::as_bool) == Some(true) {
+                crate::workspace_state::ensure_positions_ready(&app.ui)?;
+                if app.ui.saved_workspaces.remove(&name).is_none() && !builtin {
+                    return Err(format!("no workspace `{name}`"));
+                }
+                // Leave the deleted workspace first: a current workspace needs a definition.
+                if app.ui.workspace == name {
+                    app.set_workspace("Default");
+                }
+                app.store_saved_workspaces()?;
+                return Ok(json!({"deleted": name}));
+            }
+            if let Some(new) = p.get("rename").and_then(Value::as_str).map(str::trim).filter(|n| !n.is_empty() && *n != name) {
+                if builtin {
+                    return Err(format!("`{name}` is a built-in workspace: save it as a new workspace instead"));
+                }
+                crate::workspace_state::ensure_positions_ready(&app.ui)?;
+                let dock = app.ui.saved_workspaces.remove(&name).ok_or_else(|| format!("no workspace `{name}`"))?;
+                app.ui.saved_workspaces.insert(new.to_string(), dock);
+                if app.ui.workspace == name {
+                    app.ui.workspace = new.to_string();
+                }
+                app.store_saved_workspaces()?;
+                return Ok(json!({"renamed": new}));
+            }
+            json!({"workspaces": app.workspace_names()})
+        }
+        "view.lookAt" => {
+            let r: Vec<f64> = p.get("rect").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
+            if r.len() == 4 {
+                let map: Option<crate::panels::viewer::ViewerMap> = ctx.data(|d| d.get_temp(egui::Id::unique("viewer-map")));
+                if let Some(m) = map {
+                    let (rw, rh) = (((r[2] - r[0]) as f32).max(1.0), ((r[3] - r[1]) as f32).max(1.0));
+                    let zoom = ((m.area.width() - 40.0) / rw).min((m.area.height() - 40.0) / rh).clamp(0.015, 32.0);
+                    let rc = [(r[0] + r[2]) as f32 / 2.0, (r[1] + r[3]) as f32 / 2.0];
+                    let v = &mut app.ui.viewer;
+                    v.zoom = Some(zoom);
+                    v.pan = [m.comp[0] * zoom / 2.0 - rc[0] * zoom, m.comp[1] * zoom / 2.0 - rc[1] * zoom];
+                }
+            }
+            Value::Null
+        }
+        "comp.flowchart" => {
+            // Chart the active comp; Layer ▸ Reveal ▸ Reveal Layer in Project Flowchart shows
+            // layers and selects the layer's node.
+            app.ui.flowchart.root = app.session.active_comp_id().map(|c| c.0);
+            if let (Some(c), Some(l)) = (app.session.active_comp_id(), app.session.state.selected_layers.first()) {
+                app.ui.flowchart.layers = true;
+                app.ui.flowchart.selected = Some(format!("layer:{}:{}", c.0, l.0));
+            }
+            app.show_panel(PanelKind::Flowchart);
+            Value::Null
+        }
+        "comp.miniFlowchart" => {
+            let at = ctx.input(|i| i.pointer.hover_pos()).unwrap_or_else(|| ctx.content_rect().center());
+            app.ui.mini_flowchart = Some([at.x, at.y]);
+            Value::Null
+        }
+        "track.editTargetDialog" => {
+            crate::panels::tracker::open_target(app)?;
+            Value::Null
+        }
+        "track.optionsDialog" => {
+            crate::panels::tracker::open_options(app)?;
+            Value::Null
+        }
+        "layer.openLayer" => {
+            let id = p.get("layer").and_then(Value::as_u64).or_else(|| app.session.state.selected_layers.first().map(|l| l.0));
+            // Another layer opens at Fit.
+            if id != app.ui.layer_panel {
+                app.ui.layer_zoom = None;
+                app.ui.layer_pan = [0.0, 0.0];
+            }
+            app.ui.layer_panel = id;
+            app.ui.layer_view = None;
+            app.show_panel(PanelKind::Layer);
+            Value::Null
+        }
+        "app.confirmExecute" => {
+            // Settings ▸ Scripting ▸ Warn User When Executing Files.
+            let path = p.get("path").and_then(Value::as_str).unwrap_or_default().to_string();
+            crate::panels::forms::form(
+                app,
+                "A script wants to open a file",
+                "file.executeFile",
+                json!({"path": path, "confirmed": true}),
+                vec![crate::panels::forms::Field::text("path", "Open", &path)],
+            );
+            Value::Null
+        }
+        "app.showReport" => {
+            let title = p.get("title").and_then(Value::as_str).unwrap_or("Report").to_string();
+            let text = p.get("text").and_then(Value::as_str).unwrap_or_default().to_string();
+            crate::panels::dialogs::info(app, &title, &text);
+            Value::Null
+        }
+        "window.assignWorkspaceShortcut" => {
+            let mut q = p.clone();
+            q["workspace"] = json!(app.ui.workspace);
+            return run_engine(app, ctx, "window.assignWorkspaceShortcut", q);
+        }
+        "file.interpretFootage" => {
+            // Import ▸ Interpret Unlabeled Alpha As: Ask User.
+            if let Some(i) = p.get("item").and_then(Value::as_u64) {
+                app.session.state.project_selection = vec![effectcraft_engine::project::ItemId(i)];
+            }
+            crate::panels::dialogs::open_form(app, "file.interpretFootage", &json!({}));
+            Value::Null
+        }
+        // Help ▸ In-App Tutorials: the Home screen's Learn tab.
+        "help.inAppTutorials" => {
+            app.ui.start_screen = true;
+            app.ui.home_learn = true;
+            app.ui.home_templates = false;
+            Value::Null
+        }
+        // File ▸ New ▸ New Project from Template…: the Home screen's Templates tab.
+        "file.newFromTemplate" => {
+            app.ui.start_screen = true;
+            app.ui.home_learn = false;
+            app.ui.home_templates = true;
+            Value::Null
+        }
+        "effect.manage" => {
+            app.show_panel(PanelKind::EffectsPresets);
+            Value::Null
+        }
+        "anim.browsePresets" => {
+            app.ui.effects_search.clear();
+            app.ui.effects_view.presets = true;
+            app.ui.effects_open.insert("presets".into());
+            ctx.data_mut(|data| data.insert_temp(egui::Id::unique(crate::panels::effects_presets::REVEAL_PRESETS_ID), true));
+            app.show_panel(PanelKind::EffectsPresets);
+            Value::Null
+        }
+        "timeline.revealMask" => {
+            let id = |key: &str| p.get(key).and_then(Value::as_u64).ok_or_else(|| format!("timeline.revealMask: need `{key}` as an unsigned integer"));
+            let (comp, layer, mask, epoch) = (id("comp")?, id("layer")?, id("mask")?, id("projectEpoch")?);
+            if epoch != app.session.script_ui.project_epoch || app.session.active_comp_id().map(|c| c.0) != Some(comp) {
+                return Ok(json!({"revealed": false}));
+            }
+            let masks = app.session.active_comp().and_then(|c| c.layer(effectcraft_engine::project::LayerId(layer))).and_then(|l| l.masks());
+            let Some(masks) = masks.filter(|m| m.groups().any(|g| g.uid == mask && matches!(g.kind, effectcraft_engine::project::GroupKind::Mask { .. })))
+            else {
+                return Ok(json!({"revealed": false}));
+            };
+            let masks_uid = masks.uid;
+            let tl = &mut app.ui.timeline;
+            tl.open_layers.insert(layer);
+            tl.open_groups.extend([masks_uid, mask]);
+            // Add to a shortcut's existing reveal without changing the last pressed shortcut.
+            if let Some(kinds) = tl.layer_reveal.get_mut(&layer).filter(|k| !k.is_empty()) {
+                tl.reveal_props.insert(mask);
+                if !kinds.iter().any(|k| k == "props") {
+                    kinds.push("props".into());
+                }
+            }
+            json!({"revealed": true})
+        }
+        "timeline.revealProps" => {
+            let props = p.get("props").and_then(Value::as_array).cloned().unwrap_or_default();
+            let uids = |k: &str| -> Vec<u64> { props.iter().filter_map(|x| x.get(k).and_then(Value::as_u64)).collect() };
+            let (found, with_props) = (uids("prop"), uids("layer"));
+            // The layers it looked at (`layers`), else those it found something on. Layers that
+            // have nothing to show close; the others' reveals stay.
+            let targets: Vec<u64> = match p.get("layers").and_then(Value::as_array) {
+                Some(l) => l.iter().filter_map(Value::as_u64).collect(),
+                None => with_props.clone(),
+            };
+            // The targets' earlier picks go (U after UU shows the keyframed ones only).
+            let comp = app.session.active_comp_arc();
+            let theirs = |u: u64| {
+                comp.as_ref().is_some_and(|c| {
+                    targets
+                        .iter()
+                        .filter_map(|l| c.layer(effectcraft_engine::project::LayerId(*l)))
+                        .any(|l| l.props.find(u).is_some() || l.props.find_group(u).is_some())
+                })
+            };
+            let tl = &mut app.ui.timeline;
+            tl.reveal_props.retain(|u| !theirs(*u));
+            tl.reveal_props.extend(found.iter().copied());
+            let (shown, hidden): (Vec<u64>, Vec<u64>) = targets.into_iter().partition(|l| with_props.contains(l));
+            tl.apply_reveal(&hidden, vec![]);
+            if !shown.is_empty() {
+                tl.apply_reveal(&shown, vec!["props".into()]);
+            }
+            // Properties inside effects (puppet pins…) show under their effect, twirled open.
+            for (layer, prop) in props.iter().filter_map(|x| Some((x.get("layer")?.as_u64()?, x.get("prop")?.as_u64()?))) {
+                crate::panels::timeline::open_effect_paths(app, layer, &[prop]);
+            }
+            json!({"revealed": found.len()})
+        }
+        _ => return Err(format!("`{id}` is not a frontend command")),
+    })
+}
+
+/// Commands that need a file or folder path: ask the host's file dialog when `params` lacks one.
+pub(super) fn file_dialog(app: &mut EffectcraftApp, id: &str, params: &Value) -> Option<Result<Value, String>> {
+    enum Ask {
+        Folder,
+        Import,
+        OpenProject,
+        Save(std::borrow::Cow<'static, str>),
+        Open(&'static [&'static str]),
+        /// A movie, or a file with one of these extensions.
+        OpenFootage(&'static [&'static str]),
+    }
+    // Save As, Save a Copy and Save a Copy As XML start from the open project's file, in its
+    // folder, as After Effects does (#2788); an untitled project starts from Untitled Project.
+    // Save a Copy adds ` copy` (`suffix`): it never writes over the open project's file.
+    let project_as = |suffix: &str, ext: &str| -> std::borrow::Cow<'static, str> {
+        let Some(path) = app.session.path.as_deref().map(std::path::Path::new) else { return format!("Untitled Project{suffix}.{ext}").into() };
+        let stem = path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "Untitled Project".into());
+        path.with_file_name(format!("{stem}{suffix}.{ext}")).to_string_lossy().into_owned().into()
+    };
+    let (key, ask) = match id {
+        "file.import" | "file.importMultiple" => ("paths", Ask::Import),
+        "file.open" => ("path", Ask::OpenProject),
+        "file.save" if app.session.path.is_none() => ("path", Ask::Save(project_as("", "ecproj"))),
+        "file.saveAs" => ("path", Ask::Save(project_as("", "ecproj"))),
+        "file.saveCopy" => ("path", Ask::Save(project_as(" copy", "ecproj"))),
+        "comp.saveFrameAs" => ("path", Ask::Save("Frame.png".into())),
+        "comp.saveFrameAsPsd" => ("path", Ask::Save("Frame.psd".into())),
+        "comp.saveFrameAsExr" => ("path", Ask::Save("Frame.exr".into())),
+        "file.watchFolder" if params.get("stop").is_none() => ("folder", Ask::Save("Watch Folder".into())),
+        "anim.savePreset" => ("path", Ask::Save("Preset.ecpreset".into())),
+        "anim.applyPreset" => ("path", Ask::Open(&["ecpreset", "json"])),
+        "view.exportGuides" => ("path", Ask::Save("Guides.json".into())),
+        "view.importGuides" => ("path", Ask::Open(&["json"])),
+        "camera.exportBlender" => ("path", Ask::Save("Tracked Scene.py".into())),
+        "file.exportLottie" => ("path", Ask::Save("Animation.json".into())),
+        "file.exportAep" => ("path", Ask::Save("Project.aep".into())),
+        "file.importLottie" => ("path", Ask::Open(&["json", "lottie"])),
+        "file.importAep" => ("path", Ask::Open(&["aep", "aepx"])),
+        "file.importProject" => ("path", Ask::Open(&["ecproj", "ecprojx"])),
+        "file.importTimeline" => ("path", Ask::Open(&["xml", "fcpxml", "otio", "edl", "aaf", "omf"])),
+        "render.saveCurrentPreview" => ("path", Ask::Save("Preview.mp4".into())),
+        "file.runScript" if params.get("name").is_none() && params.get("recent").is_none() => ("path", Ask::Open(&["jsx", "js", "jsonl", "json", "txt"])),
+        "file.installScript" | "file.installScriptUIPanel" => ("path", Ask::Open(&["jsx", "js"])),
+        "effect.plugins.load" if params.get("folder").is_none() => ("path", Ask::Open(&["wasm", "wat"])),
+        "effect.plugins.install" if params.get("bundle").is_some() => ("folder", Ask::Folder),
+        "effect.plugins.install" if params.get("folder").is_none() && params.get("path").is_none() => ("path", Ask::Open(&["wasm"])),
+        "effect.helpers.load" => ("path", Ask::Folder),
+        "file.replaceFootage" => ("path", Ask::Import),
+        "file.relinkFootage" => ("folder", Ask::Folder),
+        "file.collectFiles" => ("folder", Ask::Save("Collected Files".into())),
+        // An open XML project gets ` copy` too: the copy never writes over the open file.
+        "file.saveCopyAsXml" => {
+            let xml = app.session.path.as_deref().and_then(|p| std::path::Path::new(p).extension()).is_some_and(|e| e.eq_ignore_ascii_case("ecprojx"));
+            ("path", Ask::Save(project_as(if xml { " copy" } else { "" }, "ecprojx")))
+        }
+        "keys.rpfCameraImport" => ("path", Ask::Open(&["json", "csv", "txt"])),
+        "essential.exportTemplate" => ("path", Ask::Save("Template.ectemplate".into())),
+        "essential.importTemplate" => ("path", Ask::Open(&["ectemplate"])),
+        "file.setProxy" => ("path", Ask::OpenFootage(&["png", "jpg", "jpeg", "gif", "webp", "tif", "tiff", "bmp", "tga", "exr"])),
+        _ => return None,
+    };
+    if params.get(key).is_some()
+        || params.get("path").is_some()
+        || params.get("paths").is_some()
+        || params.get("steps").is_some()
+        || params.get("preset").is_some()
+    {
+        return None;
+    }
+    // Importable files besides movies.
+    const MEDIA: &[&str] = &[
+        "png", "jpg", "jpeg", "gif", "webp", "tif", "tiff", "bmp", "exr", "dpx", "cin", "wav", "aif", "aiff", "mp3", "flac", "ogg", "opus", "svg", "pdf", "ai",
+        "eps", "psd", "psb", "tga", "hdr", "gltf", "glb", "obj", "stl", "fbx", "json", "csv", "tsv",
+    ];
+    let footage = |more: &[&'static str]| effectcraft_project::VIDEO_EXTENSIONS.iter().chain(more).copied().collect::<Vec<_>>();
+    // A host whose blocking dialogs are unsafe inside this frame shows the dialog without
+    // blocking — macOS: the nested event loop re-entered winit's handler on a drag over the
+    // window and aborted the app (#511); Linux: the desktop portal's answer never gets pumped,
+    // so the compositor marks the window as not responding (#1275) — and the command continues
+    // when the answer arrives.
+    if let Some(spawn) = app.hooks.file_dialog_async.as_ref() {
+        let request = match ask {
+            Ask::Folder => crate::FileDialog::Folder,
+            Ask::Import => crate::FileDialog::Open { exts: footage(MEDIA).iter().map(|e| e.to_string()).collect(), many: key == "paths" },
+            Ask::OpenProject => crate::FileDialog::OpenProject,
+            Ask::Open(exts) => crate::FileDialog::Open { exts: exts.iter().map(|e| e.to_string()).collect(), many: false },
+            Ask::OpenFootage(more) => crate::FileDialog::Open { exts: footage(more).iter().map(|e| e.to_string()).collect(), many: false },
+            Ask::Save(default) => crate::FileDialog::save(&default),
+        };
+        let tx = app.dialog_answers.0.clone();
+        let answer = crate::DialogAnswer { command: id.to_string(), key, params: params.clone(), paths: Vec::new() };
+        app.file_dialogs.opened();
+        spawn(
+            request,
+            Box::new(move |paths| {
+                let _ = tx.send(crate::DialogAnswer { paths, ..answer });
+            }),
+        );
+        return Some(Ok(json!({"dialog": id})));
+    }
+    let picked: Option<Value> = match ask {
+        Ask::Folder => {
+            let Some(f) = app.hooks.pick_folder.as_ref() else { return Some(Err("no folder dialog available (pass `folder`)".into())) };
+            f().map(Value::from)
+        }
+        Ask::Import => {
+            let Some(f) = app.hooks.pick_files.as_ref() else { return Some(Err("no file dialog available (pass `paths`)".into())) };
+            picked_value(key, f(&footage(MEDIA)))
+        }
+        Ask::OpenProject => {
+            let Some(f) = app.hooks.pick_open_project.as_ref() else { return Some(Err("no file dialog available (pass `path`)".into())) };
+            f().map(|s| json!(s))
+        }
+        Ask::Open(exts) => {
+            let Some(f) = app.hooks.pick_files.as_ref() else { return Some(Err("no file dialog available (pass `path`)".into())) };
+            f(exts).first().map(|s| json!(s))
+        }
+        Ask::OpenFootage(more) => {
+            let Some(f) = app.hooks.pick_files.as_ref() else { return Some(Err("no file dialog available (pass `path`)".into())) };
+            f(&footage(more)).first().map(|s| json!(s))
+        }
+        Ask::Save(default) => {
+            let Some(picked) = app.hooks.save_dialog(&default) else { return Some(Err("no file dialog available (pass `path`)".into())) };
+            picked.map(|s| json!(s))
+        }
+    };
+    let Some(v) = picked else { return Some(Ok(Value::Null)) };
+    Some(run_with_picked(app, id, key, params, v))
+}
+
+/// The dialog's answer as the command's `key` parameter (`None`: cancelled).
+fn picked_value(key: &str, paths: Vec<String>) -> Option<Value> {
+    match (paths.is_empty(), key) {
+        (true, _) => None,
+        (false, "paths") => Some(json!(paths)),
+        (false, _) => paths.into_iter().next().map(Value::from),
+    }
+}
+
+/// A file dialog shown without blocking ([`crate::Hooks::file_dialog_async`]) answered: run its
+/// command with the picked path (nothing when it was cancelled).
+pub(crate) fn dialog_answered(app: &mut EffectcraftApp, answer: crate::DialogAnswer) {
+    let Some(v) = picked_value(answer.key, answer.paths) else { return };
+    match run_with_picked(app, &answer.command, answer.key, &answer.params, v) {
+        Ok(result) => show_result_errors(app, &result),
+        Err(e) => app.ui.status = e,
+    }
+}
+
+/// A successful command can still report per-item problems in an `errors` array (Effect ▸
+/// Install Effect Plug-in Bundle does): show a short, readable report in the status line,
+/// without turning the success into an error. The full structured array stays in the result
+/// for scripts; the status line is single-line and short-lived, so it lists the first few
+/// problems and counts the rest instead of printing raw JSON.
+pub(crate) fn show_result_errors(app: &mut EffectcraftApp, result: &Value) {
+    let Some(errors) = result.get("errors").and_then(Value::as_array).filter(|e| !e.is_empty()) else { return };
+    let parts: Vec<String> = errors
+        .iter()
+        .map(|e| match (e.get("file").and_then(Value::as_str), e.get("error").and_then(Value::as_str)) {
+            (Some(file), Some(error)) => format!("{file}: {error}"),
+            (_, Some(error)) => error.to_string(),
+            _ => e.to_string(),
+        })
+        .collect();
+    let mut msg = parts.iter().take(3).cloned().collect::<Vec<_>>().join("; ");
+    if parts.len() > 3 {
+        msg.push_str(&format!("; +{} more", parts.len() - 3));
+    }
+    app.ui.status = msg;
+}
+
+/// Run command `id` with the path picked for it in parameter `key`.
+fn run_with_picked(app: &mut EffectcraftApp, id: &str, key: &str, params: &Value, v: Value) -> Result<Value, String> {
+    let mut p = params.as_object().cloned().unwrap_or_default();
+    p.insert(key.to_string(), v);
+    // Picked files import in the background, with the Importing card showing progress (#270).
+    if matches!(id, "file.import" | "file.importMultiple") {
+        p.insert("background".into(), Value::Bool(true));
+    }
+    // Photoshop files ask how to import them first; numbered stills whether to import them as an
+    // image sequence.
+    let picked = Value::Object(p.clone());
+    if id == "file.import" && crate::panels::dialogs::open_form(app, id, &picked)
+        || matches!(id, "file.import" | "file.importMultiple") && crate::panels::forms::open_import_sequence(app, &picked)
+    {
+        return Ok(json!({"dialog": id}));
+    }
+    // An After Effects import that loses something asks first (`panels::aep_losses`).
+    match crate::panels::aep_losses::guard(app, id, &picked) {
+        Ok(true) => return Ok(json!({"dialog": id})),
+        Ok(false) => {}
+        Err(e) => {
+            app.ui.status = e.clone();
+            return Err(e);
+        }
+    }
+    // Save (untitled) becomes Save As.
+    let id = if id == "file.save" { "file.saveAs" } else { id };
+    let before = home_mark(app);
+    let r = app.session.execute(id, Value::Object(p)).map_err(|e| e.to_string());
+    if let Err(e) = &r {
+        app.ui.status = e.clone();
+    }
+    leave_home_if_opened(app, before, r.is_ok());
+    r
+}
+
+/// View ▸ Zoom In / Zoom Out: the next standard magnification (as a share of screen pixels, so
+/// 100 % is one comp pixel per screen pixel at any display scaling) above or below `cur`, which is
+/// in points per comp pixel like the result (#882).
+pub(super) fn zoom_step(cur: f32, ppp: f32, zoom_in: bool) -> f32 {
+    const STEPS: [f32; 16] = [0.015, 0.03, 0.0625, 0.125, 0.25, 0.333, 0.5, 0.66, 1.0, 1.5, 2.0, 3.0, 4.0, 8.0, 16.0, 32.0];
+    let ppp = if ppp.is_finite() && ppp > 0.0 { ppp } else { 1.0 };
+    let shown = cur * ppp;
+    let next = if zoom_in {
+        STEPS.iter().copied().find(|s| *s > shown + 1e-3).unwrap_or(32.0)
+    } else {
+        STEPS.iter().rev().copied().find(|s| *s < shown - 1e-3).unwrap_or(0.015)
+    };
+    next / ppp
+}
diff --git a/crates/ui-egui/src/menus/invoke.rs b/crates/ui-egui/src/menus/invoke.rs
new file mode 100644
index 000000000..bebb7f767
--- /dev/null
+++ b/crates/ui-egui/src/menus/invoke.rs
@@ -0,0 +1,735 @@
+use super::frontend::{file_dialog, frontend, run_engine};
+use super::shortcuts::system_paste_id;
+use super::*;
+
+pub fn panel_command_id(p: PanelKind) -> String {
+    format!("window.panel.{}", p.id())
+}
+
+/// The reveal shortcuts (P, S, R, T, A, E, M, F, L…). `add` (Shift+key) adds the property to
+/// (or removes it from) those already revealed instead of replacing them.
+pub fn reveal(app: &mut EffectcraftApp, kind: &str, now: f64, add: bool) {
+    // The double-press shortcuts: the same key again within 0.6 s reveals its second set (LL
+    // Waveform, TT Mask Opacity, MM all mask properties, EE Expressions, RR Time Remap, AA
+    // Material Options, PP paint / Roto Brush / Puppet, SS selected properties, FF missing
+    // effects). A single M shows Mask Path.
+    let double = |k: &str| -> Option<&'static str> {
+        Some(match k {
+            "levels" => "waveform",
+            "opacity" => "maskOpacity",
+            "masks" => "masks",
+            "effects" => "expressions",
+            "rotation" => "timeRemap",
+            "anchor" => "material",
+            "position" => "paint",
+            "scale" => "selected",
+            "feather" => "missingEffects",
+            _ => return None,
+        })
+    };
+    let pressed = kind;
+    // (With Shift a second press removes the property again instead.)
+    let again = !add && matches!(app.last_reveal.take(), Some((k, t)) if k == pressed && now - t < 0.6);
+    app.last_reveal = Some((if again { String::new() } else { pressed.to_string() }, now));
+    let kind = match (again, double(pressed)) {
+        (true, Some(d)) => {
+            // The second press replaces what the first one revealed.
+            let first = if pressed == "masks" { "maskPath" } else { pressed };
+            app.ui.timeline.reveal.retain(|k| k != first);
+            d
+        }
+        _ if pressed == "masks" => "maskPath",
+        _ => pressed,
+    };
+    let targets = reveal_targets(app);
+    let tl = &mut app.ui.timeline;
+    let present = tl.reveal.iter().any(|k| k == kind);
+    let mut kinds = tl.reveal.clone();
+    if add {
+        if present {
+            kinds.retain(|k| k != kind);
+        } else {
+            kinds.retain(|k| k != "props" || !tl.reveal_props.is_empty());
+            kinds.push(kind.to_string());
+        }
+    } else if present && kinds.len() == 1 {
+        kinds.clear();
+    } else {
+        kinds = vec![kind.to_string()];
+    }
+    tl.apply_reveal(&targets, kinds.clone());
+    crate::panels::timeline::open_revealed(app, &targets, &kinds);
+}
+
+/// Show Time Remap on the layers of a `layer.enableTimeRemap` (`layers` by id, else the
+/// selected ones) that have it now.
+fn reveal_time_remap(app: &mut EffectcraftApp, params: &Value) {
+    let asked: Vec<u64> = match params.get("layers").and_then(Value::as_array) {
+        Some(a) => a.iter().filter_map(Value::as_u64).collect(),
+        None => app.session.state.selected_layers.iter().map(|l| l.0).collect(),
+    };
+    let Some(comp) = app.session.active_comp() else { return };
+    let layers: Vec<u64> = comp.layers.iter().filter(|l| asked.contains(&l.id.0) && l.props.get("timeRemap").is_some()).map(|l| l.id.0).collect();
+    if !layers.is_empty() {
+        app.ui.timeline.apply_reveal(&layers, vec!["timeRemap".into()]);
+    }
+}
+
+/// After Alt+Shift+P (A, S, R, T) the Timeline shows the property on each layer it keyed, as in
+/// After Effects: added to what a reveal shortcut shows, else with the layer's Transform twirled
+/// open, else alone like P.
+fn reveal_keyed(app: &mut EffectcraftApp, keyed: &Value, kind: &str) {
+    let layers: std::collections::BTreeSet<u64> = keyed.as_array().into_iter().flatten().filter_map(|k| k.get("layer").and_then(Value::as_u64)).collect();
+    let Some(comp) = app.session.active_comp() else { return };
+    let tl = &mut app.ui.timeline;
+    for id in layers {
+        let shown = tl.layer_reveal.get(&id).filter(|k| !k.is_empty()).cloned();
+        match shown {
+            Some(mut kinds) => {
+                if !kinds.iter().any(|k| k == kind) {
+                    kinds.push(kind.to_string());
+                    tl.layer_reveal.insert(id, kinds);
+                }
+            }
+            None if tl.open_layers.contains(&id) => {
+                if let Some(tr) = comp.layer(effectcraft_engine::project::LayerId(id)).and_then(|l| l.transform()) {
+                    tl.open_groups.insert(tr.uid);
+                }
+            }
+            None => {
+                tl.open_layers.insert(id);
+                tl.layer_reveal.insert(id, vec![kind.to_string()]);
+            }
+        }
+    }
+}
+
+/// The layers a reveal shortcut acts on: the selected ones, else every layer of the active comp.
+fn reveal_targets(app: &EffectcraftApp) -> Vec<u64> {
+    if app.session.state.selected_layers.is_empty() {
+        app.session.active_comp().map(|c| c.layers.iter().map(|l| l.id.0).collect()).unwrap_or_default()
+    } else {
+        app.session.state.selected_layers.iter().map(|l| l.0).collect()
+    }
+}
+
+/// The arrow keys nudge the selected layers 1 pixel at the viewer's magnification (`up`,
+/// `down`, `left`, `right`), 10 with Shift (`up10`…), as After Effects does, so zoomed in
+/// they move by fractions of a comp pixel. From any panel except Project, Effects & Presets, Render Queue and the Flowchart (which own the
+/// arrow keys for its own keyboard navigation, #961); not while typing, with a dialog or
+/// menu open. With mask points selected the arrows move the points instead (#1288).
+fn nudge(app: &mut EffectcraftApp, ctx: &egui::Context, dir: &str) -> Result<Value, String> {
+    let (side, n) = match dir.strip_suffix("10") {
+        Some(side) => (side, 10.0),
+        None => (dir, 1.0),
+    };
+    let (x, y) = match side {
+        "up" => (0.0, -n),
+        "down" => (0.0, n),
+        "left" => (-n, 0.0),
+        "right" => (n, 0.0),
+        _ => return Err(format!("unknown nudge `{dir}`")),
+    };
+    let st = &app.session.state;
+    if matches!(app.ui.focused, PanelKind::Project | PanelKind::EffectsPresets | PanelKind::RenderQueue | PanelKind::Flowchart)
+        || (st.selected_layers.is_empty() && st.selected_vertices.is_empty())
+        || st.text_edit.is_some()
+    {
+        return Ok(Value::Null);
+    }
+    // Screen pixels per comp pixel.
+    let zoom = (app.ui.viewer.zoom.unwrap_or_else(|| crate::panels::viewer::last_fit(ctx)) * ctx.pixels_per_point()) as f64;
+    let k = if zoom.is_finite() && zoom > 1e-6 { 1.0 / zoom } else { 1.0 };
+    if let Some(layer) = st.selected_vertices.first().map(|v| v.layer) {
+        let d = vertex_delta(app, layer, [x * k, y * k]);
+        return run_engine(app, ctx, "mask.moveVertices", json!({"delta": d}));
+    }
+    run_engine(app, ctx, "layer.nudge", json!({"x": x * k, "y": y * k}))
+}
+
+/// A comp-space step `d` in the layer space of `layer`, where mask points live. Like a drag of
+/// the points in the viewer, every selected point takes the first one's layer space.
+fn vertex_delta(app: &EffectcraftApp, layer: effectcraft_engine::project::LayerId, d: [f64; 2]) -> [f64; 2] {
+    use effectcraft_engine::geom::vec2;
+    let s = &app.session;
+    let (Some(cid), Some(comp)) = (s.active_comp_id(), s.active_comp()) else { return d };
+    let Some(l) = comp.layer(layer) else { return d };
+    let ectx = effectcraft_engine::render::EvalCtx {
+        project: &s.project,
+        comp_id: cid,
+        comp,
+        time: s.time(),
+        expr: s.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let (l2c, _) = crate::panels::viewer::l2c(&ectx, l);
+    l2c.inverse().map_or(d, |inv| {
+        let v = inv.apply_vec(vec2(d[0], d[1]));
+        [v.x, v.y]
+    })
+}
+
+pub(super) fn no_params(p: &Value) -> bool {
+    p.as_object().is_none_or(|m| m.is_empty())
+}
+
+/// `{"comp": id}` and nothing else: Composition Settings opens on that comp instead of
+/// applying no settings to it.
+fn only_comp(p: &Value) -> Option<effectcraft_engine::project::ItemId> {
+    let m = p.as_object().filter(|m| m.len() == 1)?;
+    m.get("comp")?.as_u64().map(effectcraft_engine::project::ItemId)
+}
+
+/// Execute a UI or engine command by id.
+pub fn invoke(app: &mut EffectcraftApp, ctx: &egui::Context, id: &str, params: Value) -> Result<Value, String> {
+    crate::control::check_script_render(app, id)?;
+    if matches!(id, "effects.copyPresetsFolderPath" | "mediaBrowser.copySourcePath") {
+        return frontend(app, ctx, id, params);
+    }
+    // Layer ▸ New ▸ Text (menu, shortcut, context menus) puts an insertion point in the centre of
+    // the comp, as After Effects does, so typing goes into Source Text rather than running
+    // shortcuts (#866). `engine.execute` keeps the headless default.
+    if id == "layer.newText" && no_params(&params) {
+        return run_engine(app, ctx, id, json!({"text": "", "edit": true}));
+    }
+    // A new folder (File ▸ New, its shortcut, the Project panel's button and context menu) opens
+    // with its name ready to type, as in After Effects (#1658). The command selects it.
+    // `engine.execute` keeps the headless default.
+    if id == "project.newFolder" && no_params(&params) {
+        let r = run_engine(app, ctx, id, params);
+        if r.is_ok() {
+            app.show_panel(PanelKind::Project);
+            crate::panels::project::begin_rename(app, ctx);
+        }
+        return r;
+    }
+    // The Project-panel focus redirects apply only while no text edit is open: creating a text
+    // layer leaves focus on Project while the insertion point lives in the comp, so during an
+    // edit these commands address the text context — redirected, Deselect All would clear a
+    // project selection the user is not looking at and silently swallow the edit's own end.
+    if no_params(&params) && app.ui.focused == PanelKind::Project && app.session.state.text_edit.is_none() {
+        match id {
+            "edit.duplicate" => return run_engine(app, ctx, "project.duplicate", json!({})),
+            "edit.selectAll" => {
+                let items: Vec<u64> = crate::panels::project::visible_rows(app)
+                    .into_iter()
+                    .filter(|(id, _)| app.ui.project_search.is_empty() || app.session.project.item(*id).is_some_and(|it| !it.is_folder()))
+                    .map(|(id, _)| id.0)
+                    .collect();
+                return run_engine(app, ctx, "project.select", json!({"items":items}));
+            }
+            "edit.deselectAll" => return run_engine(app, ctx, "project.select", json!({"items":[]})),
+            "edit.cut" | "edit.copy" | "edit.paste" | "edit.copyWithPropertyLinks" | "edit.copyWithRelativePropertyLinks" | "edit.copyExpressionOnly" => {
+                return Err("Project clipboard actions are not supported yet".into());
+            }
+            _ => {}
+        }
+    }
+    // Close follows panel focus too: with the Render Queue active, Cmd+W closes that panel and
+    // leaves the active composition open (it used to close the composition next to it).
+    if id == "file.close" && no_params(&params) && app.ui.focused == PanelKind::RenderQueue {
+        app.apply_dock(craft_ui::docking::Action::Close { panel: PanelKind::RenderQueue })?;
+        // The focus goes to a panel that is still there, so the next Close acts on the composition
+        // instead of on the queue that is gone.
+        let next = [PanelKind::Timeline, PanelKind::Composition, PanelKind::Project].into_iter().find(|p| panel_shown(app, *p)).unwrap_or(PanelKind::Project);
+        app.show_panel(next);
+        app.focus_panel(ctx, next);
+        // Activating a passive viewer emits OpenComp, which raises Timeline. Finish that routing
+        // before restoring the destination panel, including when they share the same tab group.
+        app.handle_events(ctx);
+        app.show_panel(next);
+        return Ok(Value::Null);
+    }
+    // Edit ▸ Paste with SVG markup on the system clipboard pastes it as a shape layer (After
+    // Effects 26.3). Copying in the app replaces the system clipboard with a note naming what
+    // was copied, so SVG there was copied after anything copied in the app.
+    if id == "edit.paste" && no_params(&params) && app.session.state.text_edit.is_none() {
+        let text = ctx.data_mut(|d| d.remove_temp::<String>(system_paste_id())).or_else(|| app.hooks.clipboard_text.as_ref().and_then(|f| f()));
+        if let Some(svg) = text.filter(|t| effectcraft_engine::vector::is_svg_text(t)) {
+            return run_engine(app, ctx, "edit.pasteSvg", json!({"svg": svg}));
+        }
+    }
+    // Clear follows panel focus, including the Edit menu and keyboard shortcut. An open text
+    // edit stands down: the user is working in a composition, and the Project-panel redirect
+    // would delete it without asking when nothing uses it (#2227).
+    if id == "edit.clear" && params.as_object().is_some_and(|p| p.is_empty()) && app.ui.focused == PanelKind::Project {
+        if app.session.state.text_edit.is_some() {
+            return Ok(Value::Null);
+        }
+        // Through `invoke`, so deleting items that compositions use still asks first (M3.16).
+        return invoke(app, ctx, "project.delete", json!({}));
+    }
+    if id == "edit.clear" && params.as_object().is_some_and(|p| p.is_empty()) && app.ui.focused == PanelKind::RenderQueue {
+        let selected = ctx.data(|d| d.get_temp::<(Vec<u64>, Option<u64>)>(egui::Id::unique("rq-ui"))).and_then(|(_, id)| id);
+        return match selected {
+            Some(item) => run_engine(app, ctx, "renderQueue.remove", json!({"item": item})),
+            None => Err("select a Render Queue item first".into()),
+        };
+    }
+    // Shift+Delete deletes the Project panel's selection without asking; it does nothing in the
+    // other panels.
+    if id == "project.deleteWithoutConfirmation" {
+        if app.ui.focused != PanelKind::Project {
+            return Ok(Value::Null);
+        }
+        return crate::panels::delete_items::delete_confirmed(app, ctx, json!({}));
+    }
+    let now = app.now();
+    // Closing a modified project asks to save it first; the command runs once answered.
+    if crate::panels::unsaved::guard(app, id, &params) {
+        return Ok(json!({"dialog": "unsavedChanges"}));
+    }
+    // Deleting Project items that compositions use asks first, as in After Effects.
+    if crate::panels::delete_items::guard(app, id, &params) {
+        return Ok(json!({"dialog": "deleteItems"}));
+    }
+    // Un-precompose that would change the picture lists why and asks before unpacking anyway.
+    if crate::panels::unprecompose::guard(app, id, &params)? {
+        return Ok(json!({"dialog": "unprecompose"}));
+    }
+    // An After Effects import with a path that loses something asks first (the menu's file
+    // dialog asks in `run_with_picked`).
+    if params.get("path").is_some() && crate::panels::aep_losses::guard(app, id, &params)? {
+        return Ok(json!({"dialog": "aepLosses"}));
+    }
+    // J / K and Select All Keyframes act on what the Timeline shows (its revealed properties).
+    if matches!(id, "time.nextKey" | "time.previousKey" | "keys.selectAll")
+        && ["visible", "layers", "layer", "prop"].iter().all(|k| params.get(*k).is_none())
+        && let Some(c) = app.session.active_comp_arc()
+    {
+        let mut p = if params.is_object() { params.clone() } else { json!({}) };
+        p["visible"] = json!(crate::panels::timeline::visible_props(app, &c));
+        return run_engine(app, ctx, id, p);
+    }
+    // New Camera/Light and Camera/Light Settings without parameters open their dialogs.
+    if crate::panels::dialogs_3d::route(app, id, &params)? {
+        return Ok(Value::Null);
+    }
+    // New 3D Primitive without parameters opens its dialog.
+    if crate::panels::primitive_dialog::route(app, id, &params)? {
+        return Ok(Value::Null);
+    }
+    // Layer Settings on a solid, adjustment layer or null opens its settings dialog.
+    if crate::panels::dialogs::route_layer_settings(app, id, &params)? {
+        return Ok(Value::Null);
+    }
+    // Layer ▸ Layer Styles ▸ <style> from the menu adds the style and opens the dialog on it.
+    if crate::panels::layer_styles_dialog::route(app, id, &params)? {
+        return Ok(Value::Null);
+    }
+    // Shared docking: `window.dockAction`, craft-ui's `window.panel.*` commands, `ui.dock`,
+    // `ui.dock.reset` and `window.panelWindow`.
+    if let Some(result) = crate::dock_ui::route(app, ctx, id, &params) {
+        return result;
+    }
+    // Legacy per-panel / per-workspace ids (`window.panel.Project`, `window.workspace.default`).
+    if let Some(rest) = id.strip_prefix("window.panel.") {
+        return frontend(app, ctx, "window.panel", json!({"panel": rest}));
+    }
+    if let Some(ws) = id.strip_prefix("window.workspace.") {
+        if ws == "reset" {
+            return frontend(app, ctx, "window.resetWorkspace", json!({}));
+        }
+        return frontend(app, ctx, "window.workspace", json!({"name": ws}));
+    }
+    if let Some(t) = id.strip_prefix("tool.") {
+        // C cycles through the camera tools.
+        if t == "camera" {
+            let tools = [Tool::Orbit, Tool::PanCamera, Tool::Dolly];
+            let next = match tools.iter().position(|x| *x == app.ui.tool) {
+                Some(i) => tools[(i + 1) % tools.len()],
+                None => Tool::Orbit,
+            };
+            app.ui.tool = next;
+            return Ok(json!({"tool": next}));
+        }
+        // Slot shortcuts cycle through the slot's tools.
+        let slot = match t {
+            "shape" => Some(8),
+            "pen" => Some(9),
+            "type" => Some(10),
+            "brush" => Some(11),
+            "rotoBrush" => Some(14),
+            "puppet" => Some(15),
+            _ => None,
+        };
+        if let Some(si) = slot {
+            let tools: Vec<Tool> = match si {
+                11 => vec![Tool::Brush, Tool::Clone, Tool::Eraser],
+                _ => crate::state::Tool::SLOTS[si].to_vec(),
+            };
+            let cur = tools.iter().position(|x| *x == app.ui.tool);
+            let next = match cur {
+                Some(i) => tools[(i + 1) % tools.len()],
+                None => app.ui.slot_tools.get(si).copied().filter(|x| tools.contains(x)).unwrap_or(tools[0]),
+            };
+            app.ui.tool = next;
+            if si < app.ui.slot_tools.len() && si != 11 {
+                app.ui.slot_tools[si] = next;
+            }
+            return Ok(json!({"tool": next}));
+        }
+        let tool = Tool::from_name(t).ok_or_else(|| format!("unknown tool `{t}`"))?;
+        app.ui.tool = tool;
+        return Ok(json!({"tool": tool}));
+    }
+    if let Some(dir) = id.strip_prefix("viewer.nudge.") {
+        return nudge(app, ctx, dir);
+    }
+    if let Some(k) = id.strip_prefix("timeline.reveal.") {
+        if k == "animated" {
+            return run_engine(app, ctx, "anim.reveal", json!({"kind": "keyframes"}));
+        }
+        reveal(app, k, now, false);
+        return Ok(Value::Null);
+    }
+    if let Some(k) = id.strip_prefix("timeline.keyAt.") {
+        let r = run_engine(app, ctx, "keys.toggleTransform", json!({"prop": k}))?;
+        reveal_keyed(app, &r, k);
+        return Ok(r);
+    }
+    if let Some(k) = id.strip_prefix("timeline.revealAdd.") {
+        reveal(app, k, now, true);
+        return Ok(json!({"revealed": app.ui.timeline.reveal}));
+    }
+    // U reveals keyframed properties; UU (pressed twice quickly) all modified properties; U
+    // again later hides them.
+    if id == "anim.reveal" && params.get("kind").and_then(Value::as_str) == Some("keyframes") {
+        let last = app.last_reveal.take();
+        app.last_reveal = Some(("keyframes".into(), now));
+        match last {
+            Some((k, t)) if k == "keyframes" && now - t < 0.6 => {
+                return run_engine(app, ctx, "anim.reveal", json!({"kind": "modified"}));
+            }
+            Some((k, _)) if k == "keyframes" && app.ui.timeline.reveal == ["props"] => {
+                let targets = reveal_targets(app);
+                app.ui.timeline.apply_reveal(&targets, vec![]);
+                return Ok(json!({"revealed": 0}));
+            }
+            _ => {}
+        }
+    }
+    // A UI-only command (not in the engine's menus), so `frontend` gets it from here.
+    if id == "window.maximizeApp" {
+        return frontend(app, ctx, id, params);
+    }
+    // Docking: {panel, anchor, zone: center|left|right|top|bottom}, {panel, rect?}, {panel?}.
+    if let Some(op) = id.strip_prefix("window.").filter(|o| matches!(*o, "maximizePanel" | "dockPanel" | "floatPanel" | "closePanel")) {
+        let panel_of = |k: &str| params.get(k).and_then(Value::as_str).map(|s| PanelKind::from_name(s).ok_or(format!("unknown panel `{s}`")));
+        match op {
+            "maximizePanel" => {
+                let p = match panel_of("panel") {
+                    Some(p) => p?,
+                    None => app.panel_at(ctx.pointer_hover_pos()),
+                };
+                app.toggle_maximize(p);
+                return Ok(json!({"maximized": app.ui.maximized}));
+            }
+            "closePanel" => {
+                let p = panel_of("panel").ok_or("closePanel: need `panel`")??;
+                if app.ui.dock.is_open(p) {
+                    app.apply_dock(craft_ui::docking::Action::Close { panel: p })?;
+                }
+                return Ok(Value::Null);
+            }
+            "floatPanel" => {
+                let p = panel_of("panel").ok_or("floatPanel: need `panel`")??;
+                let r = match params.get("rect") {
+                    Some(value) => serde_json::from_value::<[f32; 4]>(value.clone()).map_err(|_| "rect must contain four finite numbers")?,
+                    None => crate::dock_ui::default_float_rect(ctx.content_rect()),
+                };
+                app.apply_dock(craft_ui::docking::Action::Float { panel: p, rect: r }).map_err(|e| format!("can't undock {}: {e}", p.title()))?;
+                return Ok(Value::Null);
+            }
+            _ => {
+                // craft-ui's `window.panel.dock`: zones center/tab, left/right/top/bottom (a split
+                // beside the anchor), above/below; without an anchor a side zone docks along that
+                // edge of the whole workspace.
+                let p = panel_of("panel").ok_or("dockPanel: need `panel`")??;
+                let mut command = json!({"command": "window.panel.dock", "panel": p});
+                if let Some(anchor) = panel_of("anchor") {
+                    command["anchor"] = json!(anchor?);
+                    command["zone"] = json!("center");
+                }
+                if let Some(zone) = params.get("zone") {
+                    let zone = zone.as_str().ok_or("zone: center|tab|left|right|top|bottom|above|below")?.to_ascii_lowercase();
+                    if command.get("anchor").is_some() || zone != "center" {
+                        command["zone"] = json!(zone);
+                    }
+                }
+                if let Some(before) = panel_of("before") {
+                    command["before"] = json!(before?);
+                }
+                let command: craft_ui::docking::DockCommand<PanelKind> =
+                    serde_json::from_value(command).map_err(|e| format!("dockPanel: zone: center|tab|left|right|top|bottom|above|below ({e})"))?;
+                app.run_dock_command(ctx, command).map_err(|e| format!("can't dock {}: {e}", p.title()))?;
+                app.show_panel(p);
+                return Ok(Value::Null);
+            }
+        }
+    }
+    if id == "markers.dialog" {
+        // The Composition/Layer Marker dialog (double-click a marker): {layer?, index}.
+        let index = params.get("index").and_then(Value::as_u64).ok_or("markers.dialog: need `index`")? as usize;
+        let layer = params.get("layer").and_then(Value::as_u64);
+        crate::panels::markers_ui::open_dialog(app, crate::panels::markers_ui::MarkerRef { layer, index })?;
+        return Ok(json!({"dialog": id}));
+    }
+
+    if id == "view.theme.toggle" {
+        app.cycle_appearance(ctx);
+        return Ok(json!({"appearanceMode": app.session.prefs.appearance.appearance_mode}));
+    }
+    if let Some(th) = id.strip_prefix("view.theme.") {
+        let k = crate::theme::ThemeKind::from_name(th).ok_or("unknown theme")?;
+        app.set_theme(ctx, k);
+        return Ok(Value::Null);
+    }
+    let timing = |app: &mut EffectcraftApp, op: &str| app.session.execute("layer.timing", json!({"op": op})).map_err(|e| e.to_string());
+    match id {
+        "playback.ramPreview" => {
+            app.toggle_play_with(now, effectcraft_engine::preview::PreviewShortcut::Numpad0);
+            return Ok(json!({"playing": app.playback.playing}));
+        }
+        "playback.preview.shiftSpacebar" | "playback.preview.shiftNumpad0" | "playback.preview.altNumpad0" => {
+            let sc = effectcraft_engine::preview::PreviewShortcut::parse(id.trim_start_matches("playback.preview.")).ok_or("unknown preview shortcut")?;
+            app.toggle_play_with(now, sc);
+            return Ok(json!({"playing": app.playback.playing}));
+        }
+        "playback.stop" => {
+            app.stop();
+            return Ok(Value::Null);
+        }
+        // The focused Layer panel has its own magnification; otherwise the Composition viewer.
+        "view.fit" if app.ui.focused == PanelKind::Layer => {
+            app.ui.layer_zoom = None;
+            app.ui.layer_pan = [0.0, 0.0];
+            return Ok(Value::Null);
+        }
+        "view.fit" => {
+            app.ui.viewer.zoom = None;
+            app.ui.viewer.fit_up_to_100 = false;
+            app.ui.viewer.pan = [0.0, 0.0];
+            return Ok(Value::Null);
+        }
+        "timeline.scrollToTime" => app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Time),
+        "timeline.scrollToLayer" => app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Layer),
+        "timeline.parentColumn" => {
+            let on = !crate::panels::timeline::column_visible(&app.ui.timeline, "parent");
+            crate::panels::timeline::set_column(&mut app.ui.timeline, "parent", on)?;
+            return Ok(json!({"parent": on}));
+        }
+        "view.fitUpTo100" => {
+            app.ui.viewer.zoom = None;
+            app.ui.viewer.fit_up_to_100 = true;
+            app.ui.viewer.pan = [0.0, 0.0];
+            return Ok(Value::Null);
+        }
+        // Shift+, / Shift+.: the previous / next open composition (the viewer's tabs).
+        "view.nextItem" | "view.previousItem" => {
+            let open = app.session.state.open_comps.clone();
+            let Some(i) = app.session.state.active_comp.and_then(|c| open.iter().position(|o| *o == c)) else { return Ok(Value::Null) };
+            let step = if id == "view.nextItem" { 1 } else { open.len().saturating_sub(1) };
+            let Some(next) = open.get((i + step) % open.len().max(1)).copied().filter(|n| Some(*n) != app.session.state.active_comp) else {
+                return Ok(Value::Null);
+            };
+            return run_engine(app, ctx, "comp.open", json!({"comp": next.0}));
+        }
+        // \\: between the Composition viewer and the Timeline.
+        "window.toggleCompTimeline" => {
+            let to = if app.ui.focused == PanelKind::Timeline { crate::panels::viewers::active_panel(app) } else { PanelKind::Timeline };
+            app.show_panel(to);
+            return Ok(json!({"focused": to.id()}));
+        }
+        // Alt+Shift+, / Alt+Shift+.: the previous / next tab of the focused panel's group.
+        "window.nextPanel" | "window.previousPanel" => {
+            let focused = app.ui.focused;
+            let group = app.ui.dock.group_of(focused);
+            let Some(i) = group.iter().position(|p| *p == focused) else { return Ok(Value::Null) };
+            let step = if id == "window.nextPanel" { 1 } else { group.len().saturating_sub(1) };
+            if let Some(next) = group.get((i + step) % group.len().max(1)).copied() {
+                app.show_panel(next);
+            }
+            return Ok(json!({"focused": app.ui.focused.id()}));
+        }
+        // Ctrl+Shift+W: with a viewer or the Timeline active, every open composition closes;
+        // any other panel closes itself.
+        "window.closeAll" => {
+            let focused = app.ui.focused;
+            if matches!(focused, PanelKind::Composition | PanelKind::Timeline | PanelKind::Viewer(_)) {
+                for c in app.session.state.open_comps.clone() {
+                    run_engine(app, ctx, "comp.close", json!({"comp": c.0}))?;
+                }
+            } else {
+                app.close_panel(focused);
+            }
+            return Ok(Value::Null);
+        }
+        "view.actualSize" if app.ui.focused == PanelKind::Layer => {
+            app.ui.layer_zoom = Some(1.0 / ctx.pixels_per_point());
+            app.ui.layer_pan = [0.0, 0.0];
+            return Ok(Value::Null);
+        }
+        "view.actualSize" => {
+            app.ui.viewer.zoom = Some(1.0 / ctx.pixels_per_point());
+            app.ui.viewer.pan = [0.0, 0.0];
+            return Ok(Value::Null);
+        }
+        "view.safeMargins" => app.ui.viewer.safe_margins = !app.ui.viewer.safe_margins,
+        "view.transparencyGrid" => app.ui.viewer.transparency_grid = !app.ui.viewer.transparency_grid,
+        "view.fastPreviews" => {
+            // With a mode: Fast Previews ▸ Off / Adaptive Resolution / Draft / Fast Draft /
+            // Wireframe; without: toggle Draft quality (Settings ▸ Previews).
+            if params.get("mode").is_some() {
+                return run_engine(app, ctx, "view.fastPreviewMode", params);
+            }
+            let on = !app.ui.viewer.fast_preview;
+            app.set_pref("previews.fastPreviews", json!(on))?;
+            app.ui.viewer.fast_preview = on;
+        }
+        "timeline.zoomIn" | "timeline.zoomOut" => {
+            let k = if id == "timeline.zoomIn" { crate::panels::timeline::ZOOM_STEP } else { 1.0 / crate::panels::timeline::ZOOM_STEP };
+            crate::panels::timeline::zoom(app, ctx, k);
+            return Ok(Value::Null);
+        }
+        "timeline.zoomFit" => crate::panels::timeline::toggle_fit_zoom(app, ctx),
+        "timeline.zoomFrameToggle" => crate::panels::timeline::toggle_frame_zoom(app, ctx),
+        "timeline.column" => {
+            let col = params.get("column").and_then(Value::as_str).ok_or("timeline.column: need `column`")?;
+            let on = params.get("visible").and_then(Value::as_bool).unwrap_or(!crate::panels::timeline::column_visible(&app.ui.timeline, col));
+            crate::panels::timeline::set_column(&mut app.ui.timeline, col, on)?;
+            let shown: Vec<&str> =
+                crate::panels::timeline::COLUMNS.iter().map(|c| c.0).filter(|c| crate::panels::timeline::column_visible(&app.ui.timeline, c)).collect();
+            return Ok(json!({"columns": shown}));
+        }
+        "timeline.sourceName" => {
+            let tl = &mut app.ui.timeline;
+            tl.source_name = params.get("value").and_then(Value::as_bool).unwrap_or(!tl.source_name);
+            return Ok(json!({"sourceName": tl.source_name}));
+        }
+        "flowchart.options" | "flowchart.graph" => return crate::panels::flowchart::command(app, id, &params),
+        "timeline.search" => {
+            app.ui.timeline.search = params.get("query").and_then(Value::as_str).unwrap_or_default().to_string();
+            app.show_panel(PanelKind::Timeline);
+        }
+        "timeline.graphEditor" => app.ui.timeline.graph_editor = !app.ui.timeline.graph_editor,
+        "timeline.switchesModes" => app.ui.timeline.show_modes = !app.ui.timeline.show_modes,
+        "timeline.collapseAll" => {
+            app.ui.timeline.open_layers.clear();
+            app.ui.timeline.open_groups.clear();
+            app.ui.timeline.reveal.clear();
+            app.ui.timeline.layer_reveal.clear();
+        }
+        // Ctrl+`: twirl the selected layers open (all closed ones) or closed (all open). From a
+        // reveal shortcut's view it opens their full property trees.
+        "timeline.twirlSelected" => {
+            let sel: Vec<u64> = app.session.state.selected_layers.iter().map(|l| l.0).collect();
+            let tl = &mut app.ui.timeline;
+            let revealing = sel.iter().any(|l| tl.layer_reveal.contains_key(l));
+            tl.reveal.clear();
+            for l in &sel {
+                tl.layer_reveal.remove(l);
+            }
+            if !revealing && sel.iter().all(|l| tl.open_layers.contains(l)) {
+                for l in &sel {
+                    tl.open_layers.remove(l);
+                }
+            } else {
+                tl.open_layers.extend(sel);
+            }
+        }
+        "timeline.workAreaBegin" => return app.session.execute("comp.workArea", json!({"set": "begin"})).map_err(|e| e.to_string()),
+        "timeline.workAreaEnd" => return app.session.execute("comp.workArea", json!({"set": "end"})).map_err(|e| e.to_string()),
+        "timeline.moveInToTime" => return timing(app, "moveInToTime"),
+        "timeline.moveOutToTime" => return timing(app, "moveOutToTime"),
+        "timeline.trimInToTime" => return timing(app, "trimInToTime"),
+        "timeline.trimOutToTime" => return timing(app, "trimOutToTime"),
+        "app.home" => app.ui.start_screen = !app.ui.start_screen,
+        "app.newComp" | "comp.new" if no_params(&params) => crate::panels::dialogs::open_new_comp(app),
+        "app.compSettings" | "comp.settings" if no_params(&params) => crate::panels::dialogs::open_comp_settings(app)?,
+        "app.compSettings" | "comp.settings" if only_comp(&params).is_some() => {
+            crate::panels::dialogs::open_comp_settings_for(app, only_comp(&params).ok_or("missing `comp`")?)?
+        }
+        "app.solidSettings" | "layer.newSolid" if no_params(&params) => crate::panels::dialogs::open_new_solid(app)?,
+        "keys.velocity" if no_params(&params) => crate::panels::key_dialogs::open_velocity(app)?,
+        "keys.interpolation" if no_params(&params) => crate::panels::key_dialogs::open_interpolation(app)?,
+        "layer.timeStretch" if no_params(&params) => crate::panels::key_dialogs::open_time_stretch(app)?,
+        _ => {
+            if id == "renderQueue.render" && params.get("wait").is_none() {
+                // The UI renders in the background; the panel shows progress.
+                let mut p = params.clone();
+                if let Some(m) = p.as_object_mut() {
+                    m.insert("wait".into(), json!(false));
+                } else {
+                    p = json!({"wait": false});
+                }
+                app.show_panel(PanelKind::RenderQueue);
+                return app.session.execute(id, p).map_err(|e| e.to_string());
+            }
+            if id == "renderQueue.add" {
+                let r = app.session.execute(id, params).map_err(|e| e.to_string());
+                match &r {
+                    Ok(_) => app.show_panel(PanelKind::RenderQueue),
+                    Err(e) => app.ui.status = e.clone(),
+                }
+                return r;
+            }
+            if let Some(r) = file_dialog(app, id, &params) {
+                return r;
+            }
+            if id == "layer.precompose" && params.get("name").is_none() {
+                crate::panels::precomp::open(app, &params)?;
+                return Ok(json!({"dialog": id}));
+            }
+            if crate::panels::dialogs::open_form(app, id, &params) {
+                return Ok(json!({"dialog": id}));
+            }
+            if id == "renderQueue.render" && params.get("wait").is_none() {
+                // The UI renders in the background; the panel shows progress.
+                let mut p = params.clone();
+                if let Some(m) = p.as_object_mut() {
+                    m.insert("wait".into(), json!(false));
+                } else {
+                    p = json!({"wait": false});
+                }
+                app.show_panel(PanelKind::RenderQueue);
+                return app.session.execute(id, p).map_err(|e| e.to_string());
+            }
+            if id == "renderQueue.add" {
+                let r = app.session.execute(id, params).map_err(|e| e.to_string());
+                match &r {
+                    Ok(_) => app.show_panel(PanelKind::RenderQueue),
+                    Err(e) => app.ui.status = e.clone(),
+                }
+                return r;
+            }
+            // An effect added to a layer (Effect menu, Last Effect, dropped on a layer) brings
+            // up Effect Controls on that layer, as in After Effects.
+            if matches!(id, "effect.apply" | "effect.applyLast") {
+                let r = run_engine(app, ctx, id, params.clone());
+                if let Ok(applied) = &r {
+                    crate::panels::effect_controls::reveal_applied(app, &params);
+                    crate::panels::effect_controls::choose_files_after_apply(app, applied);
+                }
+                return r;
+            }
+            // Enabling time remapping twirls its layers open on Time Remap and its two keys.
+            if id == "layer.enableTimeRemap" {
+                let r = run_engine(app, ctx, id, params.clone());
+                if r.as_ref().is_ok_and(|on| on.as_bool() == Some(true)) {
+                    reveal_time_remap(app, &params);
+                }
+                return r;
+            }
+            if id == "layer.rename" && params.get("name").is_none() {
+                crate::panels::timeline::begin_rename(app, ctx);
+                return Ok(Value::Null);
+            }
+            return run_engine(app, ctx, id, params);
+        }
+    }
+    Ok(Value::Null)
+}
diff --git a/crates/ui-egui/src/menus/shortcuts.rs b/crates/ui-egui/src/menus/shortcuts.rs
new file mode 100644
index 000000000..dc4efd384
--- /dev/null
+++ b/crates/ui-egui/src/menus/shortcuts.rs
@@ -0,0 +1,463 @@
+use super::frontend::run_engine;
+use super::invoke::invoke;
+use super::{EffectcraftApp, PanelKind, Value, json};
+use crate::state::Tool;
+
+/// Shortcut text in this OS's notation (`⇧⌘K` on macOS, `Ctrl+Shift+K` elsewhere).
+pub fn shortcut_text(s: &str) -> String {
+    if cfg!(target_os = "macos") {
+        let mut out = String::new();
+        let parts: Vec<&str> = match s.strip_suffix("++") {
+            Some(head) => vec![head, "+"],
+            None => s.split('+').collect(),
+        };
+        let (mods, key) = parts.split_at(parts.len().saturating_sub(1));
+        for m in mods {
+            out.push_str(match *m {
+                "Ctrl" => "⌃",
+                "Alt" => "⌥",
+                "Shift" => "⇧",
+                "Cmd" => "⌘",
+                x => x,
+            });
+        }
+        out.push_str(match key.first().copied().unwrap_or("") {
+            "Space" => "Space",
+            "Escape" => "Esc",
+            "Home" => "↖",
+            k => k,
+        });
+        out
+    } else {
+        s.replace("Cmd", "Ctrl")
+    }
+}
+
+/// Parse "Cmd+Shift+K" into modifiers + key.
+pub fn parse_shortcut(s: &str) -> Option<(egui::Modifiers, egui::Key)> {
+    let mut m = egui::Modifiers::NONE;
+    let mut key = None;
+    // The plus key itself is written `+` or `Cmd++`.
+    let (head, plus) = match s.strip_suffix("++") {
+        Some(h) => (h, true),
+        None if s == "+" => ("", true),
+        None => (s, false),
+    };
+    let mut parts: Vec<&str> = if head.is_empty() { vec![] } else { head.split('+').collect() };
+    if plus {
+        parts.push("+");
+    }
+    for p in parts {
+        match p {
+            "Cmd" => {
+                m.command = true;
+                m.mac_cmd = cfg!(target_os = "macos");
+                if !cfg!(target_os = "macos") {
+                    m.ctrl = true;
+                }
+            }
+            "Physical" => {}
+            "Shift" => m.shift = true,
+            "Alt" => m.alt = true,
+            "Ctrl" => m.ctrl = true,
+            k => {
+                key = match k {
+                    ";" => Some(egui::Key::Semicolon),
+                    "'" => Some(egui::Key::Quote),
+                    "," => Some(egui::Key::Comma),
+                    "." => Some(egui::Key::Period),
+                    "/" => Some(egui::Key::Slash),
+                    "\\" => Some(egui::Key::Backslash),
+                    "=" => Some(egui::Key::Equals),
+                    "-" => Some(egui::Key::Minus),
+                    "`" => Some(egui::Key::Backtick),
+                    "[" => Some(egui::Key::OpenBracket),
+                    "]" => Some(egui::Key::CloseBracket),
+                    "Num0" => Some(egui::Key::Num0),
+                    "Num*" => None,
+                    _ => egui::Key::from_name(k),
+                }
+            }
+        }
+    }
+    key.map(|k| (m, k))
+}
+
+/// The key some keyboards report for a shifted punctuation key (`Shift+=` arrives as `+`).
+fn shifted_alias(k: egui::Key) -> Option<egui::Key> {
+    use egui::Key::*;
+    Some(match k {
+        Equals => Plus,
+        Semicolon => Colon,
+        OpenBracket => OpenCurlyBracket,
+        CloseBracket => CloseCurlyBracket,
+        Slash => Questionmark,
+        Backslash => Pipe,
+        _ => return None,
+    })
+}
+
+/// A key binding: modifiers, key, command id and bound params.
+pub type Binding = (egui::Modifiers, egui::Key, String, Value);
+
+/// All bindings of the active keyboard shortcut preset, most modifiers first.
+pub fn bindings(session: &effectcraft_engine::Session) -> Vec<Binding> {
+    let mut v: Vec<Binding> = Vec::new();
+    for (sc, b) in session.shortcuts().bindings() {
+        if sc.starts_with("Physical+") {
+            continue;
+        }
+        // Off macOS `Cmd` is Ctrl, so a custom Ctrl+Cmd shortcut would
+        // steal the plain Cmd one: such macOS-only shortcuts aren't bound there.
+        if !cfg!(target_os = "macos") && sc.split('+').any(|p| p == "Ctrl") && sc.split('+').any(|p| p == "Cmd") {
+            continue;
+        }
+        if let Some((m, k)) = parse_shortcut(sc) {
+            if m.shift
+                && let Some(alias) = shifted_alias(k)
+            {
+                v.push((m, alias, b.command.clone(), b.params.clone()));
+            }
+            v.push((m, k, b.command.clone(), b.params.clone()));
+        }
+    }
+    v.sort_by_key(|(m, ..)| std::cmp::Reverse(m.command as u8 + m.shift as u8 + m.alt as u8 + m.ctrl as u8));
+    v
+}
+
+fn mods_match(want: egui::Modifiers, got: egui::Modifiers) -> bool {
+    want.command == got.command && want.shift == got.shift && want.alt == got.alt && (want.ctrl == got.ctrl || got.command && cfg!(not(target_os = "macos")))
+}
+
+/// Whether the `key`+`mods` chord is the current binding of `command` in the active preset
+/// (so callers that must match a shortcut themselves — like the viewer's text editor, which
+/// holds the keyboard while the shortcut dispatcher is skipped — follow rebinds).
+/// `Physical+`-only bindings never match here, exactly as for the app-wide dispatcher.
+pub fn chord_matches(session: &effectcraft_engine::Session, command: &str, key: egui::Key, mods: egui::Modifiers) -> bool {
+    bindings(session).into_iter().any(|(m, k, id, _)| id == command && k == key && mods_match(m, mods))
+}
+
+/// Whether a Deselect All or Duplicate chord matched by [`chord_matches`] may run while a text
+/// editor holds the keyboard. Chords carrying Cmd/Ctrl/Alt are command chords (the editor treats them as
+/// such for undo and the rest), and function keys never type, so those forward from the editor;
+/// a chord that could instead produce a character — a bare or Shift-only letter, digit or
+/// punctuation key, as from a pathological bare-letter rebinding — stays with the editor so
+/// typing keeps working, the same invariant the app-wide dispatcher honors by skipping
+/// focused text fields.
+pub fn forwardable_during_text_edit(mods: egui::Modifiers, key: egui::Key) -> bool {
+    mods.command || mods.ctrl || mods.alt || (egui::Key::F1..=egui::Key::F35).contains(&key)
+}
+
+/// Set (egui temp data) from a plain Spacebar press until its release while a tap would still
+/// run the Spacebar shortcut.
+/// The system clipboard's text of this frame's paste event, for the Edit ▸ Paste it runs.
+pub(super) fn system_paste_id() -> egui::Id {
+    egui::Id::unique("menus-system-paste")
+}
+
+/// The temp-data id of the flag set by a plain Space press and taken on its release, so a tap
+/// runs the Space shortcut while holding Space stays the Hand tool.
+fn space_tap_id() -> egui::Id {
+    egui::Id::unique("spacebar-tap")
+}
+
+/// The modifiers held when this frame's input began: the state the last pass ended with, if it
+/// ran this (egui keeps only the state after the frame's events). Records this pass's state.
+pub(super) fn modifiers_at_start(ctx: &egui::Context) -> Option<egui::Modifiers> {
+    let id = egui::Id::unique("shortcut-modifiers");
+    let pass = ctx.cumulative_pass_nr();
+    let now = ctx.input(|i| i.modifiers);
+    ctx.data_mut(|d| {
+        let last = d.get_temp::<(u64, egui::Modifiers, Option<egui::Modifiers>)>(id);
+        if let Some((p, _, start)) = last
+            && p == pass
+        {
+            return start;
+        }
+        let start = last.and_then(|(p, m, _)| (p.checked_add(1) == Some(pass)).then_some(m));
+        d.insert_temp(id, (pass, now, start));
+        start
+    })
+}
+
+/// The shortcut contexts active now (`effectcraft_engine::shortcuts::CONTEXT_SCOPES`): text
+/// being edited in the viewer, a paint tool or a camera tool active, a mask selected.
+pub fn active_contexts(app: &EffectcraftApp) -> Vec<&'static str> {
+    let mut out = vec![];
+    if app.session.state.text_edit.is_some() {
+        out.push("TextEditing");
+    }
+    match app.ui.tool {
+        Tool::Brush | Tool::Clone | Tool::Eraser => out.push("Paint"),
+        Tool::Orbit | Tool::PanCamera | Tool::Dolly => out.push("Camera"),
+        _ => {}
+    }
+    if app.session.selected_mask().is_some() {
+        out.push("Mask");
+    }
+    out
+}
+
+/// Only Shift held (Shift+Delete, not Ctrl/Alt+Shift+Delete).
+fn only_shift(m: egui::Modifiers) -> bool {
+    m.shift && !m.alt && !m.ctrl && !m.command && !m.mac_cmd
+}
+
+/// Dispatch keyboard shortcuts (skipped while typing in a text field).
+pub fn handle_shortcuts(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    handle_shortcuts_impl(app, ctx, false);
+}
+
+/// Tab can acquire widget focus while the current frame is drawn. Dispatch its application
+/// binding only afterward, and only when no widget owned focus before or after layout.
+pub fn handle_tab_shortcut(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    if ctx.input(|i| i.key_pressed(egui::Key::Tab)) {
+        handle_shortcuts_impl(app, ctx, true);
+    }
+}
+
+/// Escape with a dialog open: close the popup/picker first, else cancel the dialog.
+fn escape_dialog(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    // A popup or colour picker takes Escape first (the picker goes back to its original colour).
+    if crate::panels::shortcut_editor::recording(app)
+        || crate::panels::shortcut_editor::confirming(app)
+        || egui::Popup::is_any_open(ctx)
+        || crate::color_picker::open_recently(ctx)
+    {
+        return;
+    }
+    ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape));
+    if app.dialog == Some(crate::Dialog::LayerStyles) {
+        crate::panels::layer_styles_dialog::finish(app, false);
+    } else if app.dialog == Some(crate::Dialog::GradientEditor) {
+        // Escape is Cancel: the preview rolls back.
+        crate::panels::gradient_editor::finish(app, false, ctx);
+    } else if app.dialog == Some(crate::Dialog::Info) {
+        crate::panels::forms::close_info(app);
+    } else {
+        if app.dialog == Some(crate::Dialog::Settings)
+            && let Some(p) = app.dialog_state.prefs_snapshot.take()
+        {
+            app.session.prefs = p;
+            app.session.prefs_changed();
+        }
+        if app.dialog == Some(crate::Dialog::UnsavedChanges) {
+            app.dialog_state.unsaved.command = None;
+        }
+        // Escape is Cancel: a Preview that edited the project rolls back.
+        crate::panels::live_preview::cancel(app);
+        app.dialog = None;
+    }
+}
+
+/// Escape with a dialog open: it is Cancel. Escape while recording a shortcut cancels the
+/// recording, not the editor; so does Escape in its Delete Preset prompt.
+fn cancel_dialog(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    if crate::panels::shortcut_editor::recording(app) || crate::panels::shortcut_editor::confirming(app) {
+        return;
+    }
+    if app.dialog == Some(crate::Dialog::Info) {
+        crate::panels::forms::close_info(app);
+        return;
+    }
+    if app.dialog == Some(crate::Dialog::GradientEditor) {
+        crate::panels::gradient_editor::finish(app, false, ctx);
+        return;
+    }
+    // Escape in Settings is Cancel: restore the settings from when it opened.
+    if app.dialog == Some(crate::Dialog::Settings)
+        && let Some(p) = app.dialog_state.prefs_snapshot.take()
+    {
+        app.session.prefs = p;
+        app.session.prefs_changed();
+    }
+    crate::panels::live_preview::cancel(app);
+    app.dialog = None;
+}
+
+type KeyEvent = (egui::Key, egui::Modifiers, bool, Option<egui::Key>);
+
+/// The frame's key presses, with clipboard events mapped back to Ctrl+C / X / V.
+fn collect_key_events(ctx: &egui::Context, start: Option<egui::Modifiers>, clipboard: bool, project: bool) -> Vec<KeyEvent> {
+    ctx.input(|i| {
+        // The windowing layer turns Ctrl+C / Ctrl+X / Ctrl+V into clipboard events instead of
+        // key presses: map them back to the keys (with the modifiers held) so Edit ▸ Copy, Cut,
+        // Paste and their variants (Ctrl+Alt+C…) run. Clipboard events carry no modifiers and
+        // `i.modifiers` is the state after all of the frame's events, so each is read with the
+        // modifiers where it is in the stream: walk the events from the frame's starting state.
+        // `None` when that isn't known.
+        let changed = i.events.iter().any(|e| matches!(e, egui::Event::ModifiersChanged(_) | egui::Event::WindowFocused(false)));
+        let mut at = if changed { start } else { Some(i.modifiers) };
+        let held = |at: Option<egui::Modifiers>| at.filter(|m| m.command).unwrap_or(egui::Modifiers::COMMAND);
+        let mut out = Vec::new();
+        for e in &i.events {
+            match e {
+                egui::Event::ModifiersChanged(m) => at = Some(*m),
+                // egui forgets the modifiers held when the window loses focus.
+                egui::Event::WindowFocused(false) => at = Some(egui::Modifiers::NONE),
+                egui::Event::Key { key, physical_key, pressed: true, modifiers, repeat, .. }
+                    if !*repeat
+                        || matches!(
+                            key,
+                            egui::Key::PageUp | egui::Key::PageDown | egui::Key::ArrowLeft | egui::Key::ArrowRight | egui::Key::ArrowUp | egui::Key::ArrowDown
+                        ) =>
+                {
+                    out.push((*key, *modifiers, true, *physical_key));
+                }
+                egui::Event::Key { key: egui::Key::Space, pressed: false, .. } => out.push((egui::Key::Space, egui::Modifiers::NONE, false, None)),
+                egui::Event::Copy if clipboard => out.push((egui::Key::C, held(at), true, None)),
+                // On Windows, Shift+Delete is the old Cut key and arrives as Cut too. The Project
+                // panel has no clipboard: there a Cut with only Shift held is Shift+Delete (Delete
+                // Project Items Without Confirmation). Never when the modifiers aren't known.
+                egui::Event::Cut if clipboard && project && at.is_some_and(only_shift) => {
+                    out.push((egui::Key::Delete, egui::Modifiers::SHIFT, true, None));
+                }
+                egui::Event::Cut if clipboard => out.push((egui::Key::X, held(at), true, None)),
+                egui::Event::Paste(_) if clipboard => out.push((egui::Key::V, held(at), true, None)),
+                _ => {}
+            }
+        }
+        out
+    })
+}
+
+/// Numpad * (or `*` typed with Shift+8): Add Marker (#275). egui has no key for it, so it
+/// comes as text.
+fn numpad_star_marker(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    if !ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::Text(t) if t == "*"))) {
+        return;
+    }
+    let bound = app.session.shortcuts().bindings().into_iter().find(|(k, _)| *k == "Num*").map(|(_, b)| (b.command.clone(), b.params.clone()));
+    // As in After Effects, it marks the selected layers; only with none selected does it add
+    // a composition marker (#976).
+    let bound =
+        bound.map(
+            |(id, params)| {
+                if id == "comp.addMarker" && !app.session.state.selected_layers.is_empty() { ("layer.addMarker".to_owned(), params) } else { (id, params) }
+            },
+        );
+    if let Some((id, params)) = bound
+        && let Err(e) = invoke(app, ctx, &id, if params.is_null() { json!({}) } else { params })
+    {
+        app.ui.status = e;
+    }
+}
+
+/// Panels that handle Enter themselves (rename, apply, open the row).
+fn panel_owns_enter(kind: PanelKind) -> bool {
+    matches!(kind, PanelKind::Project | PanelKind::EffectsPresets | PanelKind::RenderQueue | PanelKind::Flowchart)
+}
+
+fn handle_shortcuts_impl(app: &mut EffectcraftApp, ctx: &egui::Context, tab_only: bool) {
+    let start = modifiers_at_start(ctx);
+    if !tab_only && app.dialog.is_some() && ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+        escape_dialog(app, ctx);
+        return;
+    }
+    // A mouse button down while Spacebar is held belongs to the Hand tool: its release won't
+    // preview.
+    if ctx.input(|i| i.pointer.any_down()) || ctx.egui_wants_keyboard_input() {
+        ctx.data_mut(|d| d.remove::<bool>(space_tap_id()));
+    }
+    // While a menu or popup list is open, keys go to it, not to the app (Space must not start a
+    // preview behind the menu, #279).
+    if ctx.egui_wants_keyboard_input() || crate::widgets::any_menu_open(ctx) {
+        return;
+    }
+    // Text editing in the viewer takes the clipboard events itself.
+    let clipboard = app.session.state.text_edit.is_none();
+    let project = app.ui.focused == PanelKind::Project;
+    // The paste event's text: Edit ▸ Paste pastes SVG markup as a shape layer.
+    let pasted =
+        if clipboard { ctx.input(|i| i.events.iter().rev().find_map(|e| if let egui::Event::Paste(t) = e { Some(t.clone()) } else { None })) } else { None };
+    let mut events = collect_key_events(ctx, start, clipboard, project);
+    events.retain(|(key, _, _, _)| (*key == egui::Key::Tab) == tab_only);
+    if !tab_only && clipboard && app.dialog.is_none() {
+        numpad_star_marker(app, ctx);
+    }
+    if events.is_empty() {
+        return;
+    }
+    let binds = bindings(&app.session);
+    for (key, mods, pressed, physical_key) in events {
+        // (Per event: a shortcut can change the tool, the selection or the focused panel.)
+        let (focused, contexts) = (app.ui.focused.shortcut_scope(), active_contexts(app));
+        // Plain Spacebar runs its shortcut (Play Current Preview) on the release: held, it is
+        // the Hand tool (After Effects), and a drag with it must not start or stop playback.
+        if key == egui::Key::Space && (!pressed || !mods.any()) {
+            if pressed {
+                if app.dialog.is_none() {
+                    ctx.data_mut(|d| d.insert_temp(space_tap_id(), true));
+                }
+                continue;
+            }
+            if !ctx.data_mut(|d| d.remove_temp::<bool>(space_tap_id())).unwrap_or(false) {
+                continue;
+            }
+        }
+        // Escape closes dialogs.
+        if key == egui::Key::Escape && app.dialog.is_some() {
+            cancel_dialog(app, ctx);
+            continue;
+        }
+        if app.dialog.is_some() {
+            continue;
+        }
+        // Enter in the Project panel renames the selected item (handled by the panel).
+        // In Effects & Presets and the Render Queue Enter applies or opens the row (handled by the
+        // panel), not the layer rename.
+        if key == egui::Key::Enter && !mods.any() && panel_owns_enter(app.ui.focused) {
+            continue;
+        }
+        // The Project panel has its own selection; a previously selected Timeline layer
+        // must not be deleted while the Project panel has focus.
+        if matches!(key, egui::Key::Delete | egui::Key::Backspace) && !mods.any() {
+            if matches!(app.ui.focused, PanelKind::Composition | PanelKind::Viewer(_)) && !app.session.state.camera_points.is_empty() {
+                if let Err(e) = run_engine(app, ctx, "camera.deletePoints", json!({})) {
+                    app.ui.status = e;
+                }
+                ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, key));
+                continue;
+            }
+            // The queue panel consumes the event after its selection state is drawn.
+            if app.ui.focused == PanelKind::RenderQueue {
+                continue;
+            }
+            let _ = invoke(app, ctx, "edit.clear", json!({}));
+            continue;
+        }
+        // The narrowest active scope wins a chord: an active context, the focused panel, the
+        // application. A context's shortcut doesn't run outside it. Explicit physical bindings
+        // distinguish keys that a layout reports with the same logical name (for example AZERTY's
+        // minus and right parenthesis); they win over logical ones of the same scope rank.
+        let table = app.session.shortcuts();
+        let scope_of = |id: &str, params: &Value| {
+            let key = effectcraft_engine::shortcuts::binding_key(id, params);
+            table.find(&key).map_or(effectcraft_engine::shortcuts::APP_SCOPE, |b| b.scope.as_str())
+        };
+        let physical = table.bindings().into_iter().filter_map(|(sc, b)| {
+            let (m, k) = parse_shortcut(sc.strip_prefix("Physical+")?)?;
+            (Some(k) == physical_key && mods_match(m, mods)).then_some((b.scope.as_str(), true, (&b.command, &b.params)))
+        });
+        let logical = binds.iter().filter(|(m, k, ..)| *k == key && mods_match(*m, mods)).map(|(_, _, id, params)| (scope_of(id, params), false, (id, params)));
+        let chosen = match effectcraft_engine::shortcuts::pick(physical.chain(logical), &focused, &contexts) {
+            Ok(c) => c.map(|(id, params)| (id.clone(), if params.is_null() { json!({}) } else { params.clone() })),
+            Err(scopes) => {
+                let panels: Vec<String> = scopes.iter().map(|s| effectcraft_engine::shortcuts::scope_label(s)).collect();
+                app.ui.status = format!("This shortcut belongs to {}: focus one of them", panels.join(" and "));
+                None
+            }
+        };
+        if let Some((id, params)) = chosen {
+            if id == "edit.paste"
+                && let Some(t) = &pasted
+            {
+                ctx.data_mut(|d| d.insert_temp(system_paste_id(), t.clone()));
+            }
+            if let Err(e) = invoke(app, ctx, &id, params) {
+                app.ui.status = e;
+            }
+            ctx.data_mut(|d| d.remove_temp::<String>(system_paste_id()));
+        }
+    }
+}
diff --git a/crates/ui-egui/src/menus/tests.rs b/crates/ui-egui/src/menus/tests.rs
new file mode 100644
index 000000000..b12483b0a
--- /dev/null
+++ b/crates/ui-egui/src/menus/tests.rs
@@ -0,0 +1,732 @@
+use super::*;
+
+/// #882: at 125 % / 150 % display scaling Zoom In reaches 100 % (one comp pixel per screen
+/// pixel), not 100 % in points (125 % / 150 % on screen).
+#[test]
+fn zoom_steps_land_on_whole_screen_magnifications() {
+    for ppp in [1.0f32, 1.25, 1.5, 2.0] {
+        let at_100 = zoom_step(0.7 / ppp, ppp, true);
+        assert!((at_100 * ppp - 1.0).abs() < 1e-6, "ppp {ppp}: {}", at_100 * ppp);
+        assert!((zoom_step(at_100, ppp, true) * ppp - 1.5).abs() < 1e-6);
+        assert!((zoom_step(at_100, ppp, false) * ppp - 0.66).abs() < 1e-6);
+    }
+    assert!(zoom_step(1.0, 0.0, true).is_finite());
+}
+
+#[test]
+fn shortcut_passes_share_frame_start_modifiers() {
+    let ctx = egui::Context::default();
+    let mut starts = Vec::new();
+    let mut output = ctx.run_ui(egui::RawInput { events: vec![egui::Event::ModifiersChanged(egui::Modifiers::SHIFT)], ..Default::default() }, |ui| {
+        let ctx = ui.ctx();
+        starts.push(modifiers_at_start(ctx));
+        starts.push(modifiers_at_start(ctx));
+    });
+    output.textures_delta.clear();
+    assert_eq!(starts, vec![None, None]);
+    starts.clear();
+    let mut output = ctx.run_ui(egui::RawInput { events: vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE)], ..Default::default() }, |ui| {
+        let ctx = ui.ctx();
+        starts.push(modifiers_at_start(ctx));
+        starts.push(modifiers_at_start(ctx));
+    });
+    output.textures_delta.clear();
+    assert_eq!(starts, vec![Some(egui::Modifiers::SHIFT), Some(egui::Modifiers::SHIFT)]);
+}
+
+#[test]
+fn every_ui_shortcut_parses() {
+    for c in UI_COMMANDS {
+        if let Some(sc) = c.shortcut {
+            assert!(parse_shortcut(sc).is_some() || sc == "Num*", "{sc}");
+        }
+    }
+    for (_, e) in effectcraft_engine::menus::entries() {
+        if let Some(sc) = &e.shortcut {
+            assert!(parse_shortcut(sc).is_some() || sc == "Num*", "{} ({sc})", e.label);
+        }
+    }
+}
+
+#[test]
+fn full_screen_default_is_platform_specific() {
+    let app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let full_screen = app.session.shortcuts().shortcut_of("view.fullScreen", &Value::Null);
+    if cfg!(target_os = "macos") {
+        assert_eq!(full_screen, Some("Ctrl+Cmd+F"));
+    } else {
+        assert_eq!(full_screen, None);
+        assert_eq!(app.session.shortcuts().shortcut_of("window.maximizeApp", &Value::Null), Some("Cmd+\\"));
+    }
+}
+
+#[test]
+fn ui_and_menu_shortcuts_do_not_collide() {
+    let app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let mut seen: std::collections::BTreeMap<(String, String), (String, String)> = Default::default();
+    for (m, k, id, params) in bindings(&app.session) {
+        let key = (format!("{m:?}"), format!("{k:?}"));
+        let target = (id.clone(), params.to_string());
+        if let Some(prev) = seen.get(&key) {
+            assert_eq!(prev, &target, "{key:?} bound to {prev:?} and {target:?}");
+        } else {
+            seen.insert(key, target);
+        }
+    }
+}
+
+/// #336: Ctrl+\ (Cmd+\ on macOS) maximizes the application window, and again restores
+/// it, as in After Effects.
+#[test]
+fn ctrl_backslash_maximizes_or_restores_the_window() {
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let (m, k) = parse_shortcut("Cmd+\\").unwrap();
+    assert!(m.command && k == egui::Key::Backslash, "{m:?} {k:?}");
+    assert!(bindings(&app.session).iter().any(|b| (b.0, b.1) == (m, k) && b.2 == "window.maximizeApp"));
+    let ctx = egui::Context::default();
+    let run = |app: &mut EffectcraftApp, maximized: bool| {
+        let input = egui::RawInput {
+            viewports: std::iter::once((egui::ViewportId::ROOT, egui::ViewportInfo { maximized: Some(maximized), ..Default::default() })).collect(),
+            ..Default::default()
+        };
+        let mut r = Value::Null;
+        let mut out = ctx.run_ui(input, |ui| r = invoke(app, ui.ctx(), "window.maximizeApp", json!({})).unwrap());
+        out.textures_delta.clear();
+        let cmds = out.viewport_output.get(&egui::ViewportId::ROOT).map(|v| v.commands.clone()).unwrap_or_default();
+        (r, cmds)
+    };
+    let (r, cmds) = run(&mut app, false);
+    assert_eq!(r, json!({"maximized": true}));
+    assert!(cmds.contains(&egui::ViewportCommand::Maximized(true)), "{cmds:?}");
+    let (r, cmds) = run(&mut app, true);
+    assert_eq!(r, json!({"maximized": false}));
+    assert!(cmds.contains(&egui::ViewportCommand::Maximized(false)), "{cmds:?}");
+}
+
+/// The default keys of the keyboard-only commands parse and reach them.
+#[test]
+fn keyboard_only_commands_are_bound() {
+    let app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    for (id, keys) in [
+        ("time.workAreaStart", "Shift+Home"),
+        ("time.workAreaEnd", "Shift+End"),
+        ("time.previousInOut", "Cmd+Alt+Shift+ArrowLeft"),
+        ("time.nextInOut", "Cmd+Alt+Shift+ArrowRight"),
+        ("comp.workAreaToSelection", "Cmd+Alt+B"),
+        ("comp.activateRecent", "Shift+Escape"),
+        ("keys.deselectAll", "Shift+F2"),
+        ("keys.deselectAll", "Cmd+Alt+Shift+A"),
+        ("layer.extendSelectionNext", "Cmd+Shift+ArrowDown"),
+        ("layer.moveInToStart", "Alt+Home"),
+        ("layer.moveEarlier", "Alt+PageUp"),
+        ("layer.moveLater10", "Alt+Shift+PageDown"),
+        ("layer.stretchInToTime", "Cmd+Shift+,"),
+        ("layer.stretchOutToTime", "Cmd+Alt+,"),
+        ("layer.mask.selectNext", "Alt+`"),
+        ("layer.mask.selectPrevious", "Alt+Shift+`"),
+        ("layer.castsShadows", "Alt+Shift+C"),
+        ("timeline.scrollToTime", "D"),
+        ("timeline.scrollToLayer", "X"),
+        ("timeline.parentColumn", "Shift+F4"),
+        ("view.fitUpTo100", "Alt+/"),
+        ("view.nextItem", "Shift+."),
+        ("view.previousItem", "Shift+,"),
+        ("window.toggleCompTimeline", "\\"),
+        ("window.nextPanel", "Alt+Shift+."),
+        ("window.previousPanel", "Alt+Shift+,"),
+        ("window.closeAll", "Cmd+Shift+W"),
+        ("tool.camera", "C"),
+    ] {
+        assert!(bindings(&app.session).into_iter().any(|x| x.2 == id && Some((x.0, x.1)) == parse_shortcut(keys)), "{id} on {keys}");
+    }
+}
+
+#[test]
+fn timeline_keys_scroll_and_toggle_the_parent_column() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let run = |app: &mut EffectcraftApp, id: &str| invoke(app, &ctx, id, json!({})).unwrap();
+    // D and X leave a scroll for the Timeline to do when it is drawn.
+    run(&mut app, "timeline.scrollToTime");
+    assert_eq!(app.ui.timeline.scroll_to, Some(crate::state::ScrollTo::Time));
+    run(&mut app, "timeline.scrollToLayer");
+    assert_eq!(app.ui.timeline.scroll_to, Some(crate::state::ScrollTo::Layer));
+    // Shift+F4 shows and hides the Parent column.
+    let parent = crate::panels::timeline::column_visible(&app.ui.timeline, "parent");
+    run(&mut app, "timeline.parentColumn");
+    assert_eq!(crate::panels::timeline::column_visible(&app.ui.timeline, "parent"), !parent);
+    run(&mut app, "timeline.parentColumn");
+    assert_eq!(crate::panels::timeline::column_visible(&app.ui.timeline, "parent"), parent);
+}
+
+#[test]
+fn viewer_keys_fit_and_step_through_open_comps() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let run = |app: &mut EffectcraftApp, id: &str| invoke(app, &ctx, id, json!({})).unwrap();
+    let new = |app: &mut EffectcraftApp, name: &str| app.session.execute("comp.new", json!({"name": name, "duration": 4})).unwrap()["comp"].as_u64();
+    let active = |app: &EffectcraftApp| app.session.state.active_comp.map(|c| c.0);
+    // With one composition open there is nothing to step to.
+    let a = new(&mut app, "A");
+    run(&mut app, "view.nextItem");
+    assert_eq!(active(&app), a);
+    // Shift+, / Shift+.: through the open compositions, wrapping.
+    let b = new(&mut app, "B");
+    assert_eq!(active(&app), b);
+    run(&mut app, "view.nextItem");
+    assert_eq!(active(&app), a);
+    run(&mut app, "view.previousItem");
+    assert_eq!(active(&app), b);
+    // Alt+/ fits the viewer without magnifying past 100 %; Shift+/ fits fully again.
+    app.ui.viewer.zoom = Some(3.0);
+    run(&mut app, "view.fitUpTo100");
+    assert!(app.ui.viewer.zoom.is_none() && app.ui.viewer.fit_up_to_100);
+    run(&mut app, "view.fit");
+    assert!(!app.ui.viewer.fit_up_to_100);
+}
+
+#[test]
+fn panel_keys_switch_cycle_and_close() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let run = |app: &mut EffectcraftApp, id: &str| invoke(app, &ctx, id, json!({})).unwrap();
+    for name in ["A", "B"] {
+        app.session.execute("comp.new", json!({"name": name, "duration": 4})).unwrap();
+    }
+    // \\ switches between the Timeline and the Composition viewer.
+    app.ui.focused = PanelKind::Timeline;
+    run(&mut app, "window.toggleCompTimeline");
+    assert_eq!(app.ui.focused, PanelKind::Composition);
+    run(&mut app, "window.toggleCompTimeline");
+    assert_eq!(app.ui.focused, PanelKind::Timeline);
+    // Alt+Shift+. / Alt+Shift+,: the tabs of the focused panel's group, wrapping.
+    let group = app.ui.dock.group_of(PanelKind::Timeline);
+    assert!(group.len() > 1, "{group:?}");
+    run(&mut app, "window.nextPanel");
+    assert_eq!(app.ui.focused, group[(group.iter().position(|p| *p == PanelKind::Timeline).unwrap() + 1) % group.len()]);
+    run(&mut app, "window.previousPanel");
+    assert_eq!(app.ui.focused, PanelKind::Timeline);
+    // Ctrl+Shift+W with the Timeline active closes every composition.
+    run(&mut app, "window.closeAll");
+    assert!(app.session.state.open_comps.is_empty());
+    // With another panel active it closes that panel.
+    app.show_panel(PanelKind::Project);
+    run(&mut app, "window.closeAll");
+    assert!(!app.ui.dock.is_open(PanelKind::Project));
+}
+
+#[test]
+fn c_cycles_the_camera_tools() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.ui.tool = Tool::Selection;
+    let mut seen = vec![];
+    for _ in 0..4 {
+        invoke(&mut app, &ctx, "tool.camera", json!({})).unwrap();
+        seen.push(app.ui.tool);
+    }
+    assert_eq!(seen, [Tool::Orbit, Tool::PanCamera, Tool::Dolly, Tool::Orbit]);
+}
+
+#[test]
+fn dispatch_uses_the_active_custom_preset() {
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let find = |app: &EffectcraftApp, id: &str| bindings(&app.session).into_iter().filter(|b| b.2 == id).map(|b| (b.0, b.1)).collect::<Vec<_>>();
+    let (m, k) = parse_shortcut("Cmd+Alt+Shift+Y").unwrap();
+    assert!(find(&app, "layer.newNull").contains(&(m, k)));
+    // A UI command rebound in a custom preset.
+    app.session.execute("shortcuts.set", json!({"command": "tool.hand", "keys": "Ctrl+Alt+H"})).unwrap();
+    assert_eq!(app.session.keymaps.active, "Custom");
+    let (m2, k2) = parse_shortcut("Ctrl+Alt+H").unwrap();
+    assert_eq!(find(&app, "tool.hand"), vec![(m2, k2)]);
+    app.session.execute("shortcuts.set", json!({"command": "layer.newNull", "keys": "F6"})).unwrap();
+    assert_eq!(find(&app, "layer.newNull"), vec![(egui::Modifiers::NONE, egui::Key::F6)]);
+    // The menus show the preset's shortcut.
+    let item = menu_items(&app).into_iter().find(|i| i.id == "layer.newNull").unwrap();
+    assert_eq!(item.shortcut.as_deref(), Some("F6"));
+    // Back to the default preset.
+    app.session.execute("shortcuts.preset", json!({"op": "select", "name": effectcraft_engine::shortcuts::DEFAULT_PRESET})).unwrap();
+    assert!(find(&app, "layer.newNull").contains(&(m, k)));
+}
+
+#[test]
+fn renamed_label_shows_in_the_label_menu() {
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.set_pref("labels.1.name", json!("Sunflower")).unwrap();
+    let labels: Vec<String> = menu_items(&app).into_iter().filter(|i| i.id == "edit.label").map(|i| i.label).collect();
+    assert!(labels.contains(&"Sunflower".to_string()), "{labels:?}");
+    assert!(!labels.contains(&"Yellow".to_string()));
+}
+
+/// Saving anything but a project asks the save dialog for that file's extension (#293): the
+/// project dialog, filtered to `.ecproj`, made macOS append `.ecproj` (`Frame.png.ecproj`).
+/// Hosts with only the project dialog (the web) still get it, given the file name.
+#[test]
+fn save_dialogs_offer_the_file_extension() {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.session.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": 1})).unwrap();
+    let ctx = egui::Context::default();
+    let asked: Rc<RefCell<Vec<String>>> = Rc::default();
+    let (a, b) = (asked.clone(), asked.clone());
+    app.hooks.pick_save = Some(Box::new(move |name: &str| {
+        a.borrow_mut().push(format!("project {name}"));
+        None
+    }));
+    app.hooks.pick_save_file = Some(Box::new(move |name: &str, ext: &str| {
+        b.borrow_mut().push(format!("file {name} [{ext}]"));
+        None
+    }));
+    for id in ["comp.saveFrameAs", "render.saveCurrentPreview", "file.exportLottie", "file.saveCopyAsXml", "file.collectFiles", "file.saveAs"] {
+        invoke(&mut app, &ctx, id, json!({})).unwrap();
+    }
+    assert_eq!(
+        *asked.borrow(),
+        [
+            "file Frame.png [png]",
+            "file Preview.mp4 [mp4]",
+            "file Animation.json [json]",
+            "file Untitled Project.ecprojx [ecprojx]",
+            "file Collected Files []",
+            "project Untitled Project.ecproj",
+        ]
+    );
+    // Without the other dialog, the project one names any file.
+    app.hooks.pick_save_file = None;
+    asked.borrow_mut().clear();
+    invoke(&mut app, &ctx, "comp.saveFrameAs", json!({})).unwrap();
+    assert_eq!(*asked.borrow(), ["project Frame.png"]);
+}
+
+/// #2788: Save As, Save a Copy (`<name> copy`) and Save a Copy As XML start from the open
+/// project's name (in its folder), not Untitled Project.
+#[test]
+fn save_as_dialogs_start_from_the_open_project() {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+    use std::sync::{Arc, Mutex};
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.session.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": 1})).unwrap();
+    let ctx = egui::Context::default();
+    let dir = std::env::temp_dir().join(format!("ec-save-as-name-{}", std::process::id()));
+    let project = dir.join("Intro.ecproj");
+    app.session.path = Some(project.to_string_lossy().to_string());
+    let asked: Rc<RefCell<Vec<String>>> = Rc::default();
+    let (a, b) = (asked.clone(), asked.clone());
+    app.hooks.pick_save = Some(Box::new(move |name: &str| {
+        a.borrow_mut().push(format!("project {name}"));
+        None
+    }));
+    app.hooks.pick_save_file = Some(Box::new(move |name: &str, ext: &str| {
+        b.borrow_mut().push(format!("file {name} [{ext}]"));
+        None
+    }));
+    for id in ["file.saveAs", "file.saveCopy", "file.saveCopyAsXml"] {
+        invoke(&mut app, &ctx, id, json!({})).unwrap();
+    }
+    let xml = dir.join("Intro.ecprojx").to_string_lossy().to_string();
+    // Save a Copy names another file: it would refuse to write over the open project.
+    assert_eq!(*asked.borrow(), ["project Intro.ecproj".to_string(), "project Intro copy.ecproj".into(), format!("file {xml} [ecprojx]")]);
+    // An open XML project's XML copy is another file too.
+    app.session.path = Some(dir.join("Intro.ecprojx").to_string_lossy().to_string());
+    asked.borrow_mut().clear();
+    invoke(&mut app, &ctx, "file.saveCopyAsXml", json!({})).unwrap();
+    let copy = dir.join("Intro copy.ecprojx").to_string_lossy().to_string();
+    assert_eq!(*asked.borrow(), [format!("file {copy} [ecprojx]")]);
+    app.session.path = Some(project.to_string_lossy().to_string());
+    // The non-blocking dialog gets the whole path, so it opens in the project's folder.
+    let pending: Arc<Mutex<Vec<crate::FileDialog>>> = Arc::default();
+    let queue = pending.clone();
+    app.hooks.file_dialog_async = Some(Box::new(move |dialog, _done| queue.lock().unwrap().push(dialog)));
+    invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap();
+    let dialog = pending.lock().unwrap().pop().expect("a dialog was shown");
+    assert_eq!(dialog, crate::FileDialog::Save { default: project.to_string_lossy().to_string(), ext: "ecproj".into(), project: true });
+}
+
+/// File ▸ Scripts ▸ Recent Script Files and its key run a script again without a file dialog.
+#[test]
+fn recent_script_files_run_without_a_dialog() {
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let ctx = egui::Context::default();
+    let dir = std::env::temp_dir().join(format!("ec-recent-script-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let script = dir.join("New Comp.jsonl");
+    std::fs::write(&script, r#"{"command": "comp.new", "params": {"name": "From Script", "width": 64, "height": 36, "frameRate": 30, "duration": 1}}"#)
+        .unwrap();
+    app.session.execute("file.runScript", json!({"path": script.to_string_lossy()})).unwrap();
+    let (m, k, id, params) =
+        bindings(&app.session).into_iter().find(|b| b.2 == "file.runScript" && b.3 == json!({"recent": 0})).expect("the most recent script has a key");
+    assert_eq!((m, k), parse_shortcut("Cmd+Alt+Shift+D").unwrap());
+    assert_eq!(invoke(&mut app, &ctx, &id, params).unwrap()["steps"], 1);
+    assert_eq!(app.session.project.items.values().filter(|i| i.name.starts_with("From Script")).count(), 2);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #511: with a host's non-blocking dialogs, a command's file dialog opens without running
+/// a nested event loop inside the frame (a drag over the window then aborted the app on
+/// macOS); the command runs on a later frame with the answer, and a cancelled one not at all.
+#[test]
+fn file_dialogs_can_answer_on_a_later_frame() {
+    use std::sync::{Arc, Mutex};
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.session.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": 1})).unwrap();
+    let ctx = egui::Context::default();
+    app.hooks.pick_save = Some(Box::new(|_: &str| panic!("the blocking dialog is not used")));
+    let pending: Arc<Mutex<Vec<(crate::FileDialog, crate::DialogDone)>>> = Arc::default();
+    let queue = pending.clone();
+    app.hooks.file_dialog_async = Some(Box::new(move |dialog, done| queue.lock().unwrap().push((dialog, done))));
+    assert_eq!(invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap(), json!({"dialog": "file.saveAs"}));
+    let (dialog, done) = pending.lock().unwrap().pop().expect("a dialog was shown");
+    assert_eq!(dialog, crate::FileDialog::Save { default: "Untitled Project.ecproj".into(), ext: "ecproj".into(), project: true });
+    assert!(app.session.path.is_none(), "nothing saved until the dialog answers");
+    let dir = std::env::temp_dir().join(format!("ec-dialog-answer-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("Answered.ecproj");
+    // Answered from another thread, as the host's dialog does.
+    std::thread::spawn(move || done(vec![path.to_string_lossy().to_string()])).join().unwrap();
+    app.run_dialog_answers();
+    assert_eq!(app.session.path.as_deref(), Some(dir.join("Answered.ecproj").to_string_lossy().as_ref()));
+    assert!(dir.join("Answered.ecproj").is_file());
+    // Cancelled: nothing runs.
+    invoke(&mut app, &ctx, "comp.saveFrameAs", json!({})).unwrap();
+    let (dialog, done) = pending.lock().unwrap().pop().expect("a dialog was shown");
+    assert_eq!(dialog, crate::FileDialog::Save { default: "Frame.png".into(), ext: "png".into(), project: false });
+    done(Vec::new());
+    app.run_dialog_answers();
+    assert!(!dir.join("Frame.png").exists());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// While a command's OS file dialog is up, floating panels' OS windows are blocked, as for
+/// a modal dialog; a dialog that ends, answered or not, unblocks them, and Save As opens a
+/// dialog again. A macOS sheet can end without answering (its window went away): once one of
+/// the app's windows has the keyboard again, or keeps it as if no dialog showed, floating
+/// windows are not left blocked.
+#[test]
+fn file_dialogs_block_floating_windows_only_while_up() {
+    use std::sync::{Arc, Mutex};
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let ctx = egui::Context::default();
+    let pending: Arc<Mutex<Vec<crate::DialogDone>>> = Arc::default();
+    let queue = pending.clone();
+    app.hooks.file_dialog_async = Some(Box::new(move |_dialog, done| queue.lock().unwrap().push(done)));
+    let blocked = |app: &mut EffectcraftApp, focused: bool, time: f64| {
+        let input = egui::RawInput { focused, time: Some(time), ..Default::default() };
+        let mut out = false;
+        ctx.run_ui(input, |ui| out = app.floats_blocked(ui.ctx())).textures_delta.clear();
+        out
+    };
+    assert!(!blocked(&mut app, true, 0.0));
+    // Cancelled.
+    invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap();
+    assert!(blocked(&mut app, true, 0.1), "blocked while the dialog takes the keyboard");
+    assert!(blocked(&mut app, false, 0.2));
+    let done = pending.lock().unwrap().pop().expect("a dialog was shown");
+    done(Vec::new());
+    app.run_dialog_answers();
+    assert!(!blocked(&mut app, false, 0.3));
+    // Save As asks again; the sheet ends without answering.
+    invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap();
+    assert_eq!(pending.lock().unwrap().len(), 1, "Save As opens a dialog again");
+    assert!(blocked(&mut app, true, 1.0));
+    assert!(blocked(&mut app, false, 1.1));
+    assert!(blocked(&mut app, false, 9.0), "a dialog may stay up for long");
+    assert!(!blocked(&mut app, true, 9.1), "an app window has the keyboard again");
+    // A dialog that never takes the keyboard.
+    invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap();
+    assert!(blocked(&mut app, true, 10.0));
+    assert!(blocked(&mut app, true, 11.0));
+    assert!(!blocked(&mut app, true, 12.5));
+    // Answers of dialogs taken for gone arrive late: nothing stays blocked.
+    for done in pending.lock().unwrap().drain(..) {
+        done(Vec::new());
+    }
+    app.run_dialog_answers();
+    assert!(!blocked(&mut app, false, 13.0));
+    invoke(&mut app, &ctx, "file.saveAs", json!({})).unwrap();
+    assert!(blocked(&mut app, false, 13.1), "a later dialog blocks again");
+}
+
+#[test]
+fn tga_is_available_in_import_replace_and_proxy_dialogs() {
+    use std::sync::{Arc, Mutex};
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let ctx = egui::Context::default();
+    let pending = Arc::new(Mutex::new(Vec::new()));
+    let queue = pending.clone();
+    app.hooks.file_dialog_async = Some(Box::new(move |dialog, _done| queue.lock().unwrap().push(dialog)));
+    for command in ["file.import", "file.importMultiple", "file.replaceFootage", "file.setProxy"] {
+        assert_eq!(invoke(&mut app, &ctx, command, json!({})).unwrap(), json!({"dialog": command}));
+        let crate::FileDialog::Open { exts, .. } = pending.lock().unwrap().pop().unwrap() else { panic!("not an open dialog") };
+        assert!(exts.iter().any(|ext| ext == "tga"), "{command}: {exts:?}");
+    }
+}
+
+/// Cmd+W with the Render Queue focused closes the queue; the composition next to it stays
+/// open (it used to be closed, and the queue stayed).
+#[test]
+fn cmd_w_in_the_render_queue_closes_the_queue_not_the_comp() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let a = app.session.execute("comp.new", json!({"name": "A", "duration": 4})).unwrap()["comp"].as_u64();
+    app.show_panel(PanelKind::RenderQueue);
+    assert_eq!(app.ui.focused, PanelKind::RenderQueue);
+    invoke(&mut app, &ctx, "file.close", json!({})).unwrap();
+    assert!(!app.ui.dock.is_visible(PanelKind::RenderQueue));
+    assert_eq!(app.session.state.active_comp.map(|c| c.0), a);
+    assert_eq!(app.session.state.open_comps.len(), 1);
+    // The focus left the closed queue: the next Close closes the composition.
+    assert_ne!(app.ui.focused, PanelKind::RenderQueue);
+    invoke(&mut app, &ctx, "file.close", json!({})).unwrap();
+    assert_eq!(app.session.state.open_comps.len(), 0, "a second Close acts on the composition");
+}
+
+#[test]
+fn file_close_is_available_for_an_empty_render_queue_without_a_comp() {
+    for params in [Value::Null, json!({})] {
+        let ctx = egui::Context::default();
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        assert!(app.session.active_comp().is_none());
+        app.show_panel(PanelKind::RenderQueue);
+        assert!(menu_items(&app).iter().find(|item| item.id == "file.close").unwrap().enabled);
+        invoke(&mut app, &ctx, "file.close", params).unwrap();
+        assert!(!app.ui.dock.is_open(PanelKind::RenderQueue));
+    }
+}
+
+#[test]
+fn closing_the_render_queue_reveals_the_panel_receiving_focus() {
+    for maximized in [false, true] {
+        let ctx = egui::Context::default();
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        app.close_panel(PanelKind::Timeline);
+        app.close_panel(PanelKind::Composition);
+        app.show_panel(PanelKind::EffectControls);
+        assert!(!app.ui.dock.is_visible(PanelKind::Project));
+        app.show_panel(PanelKind::RenderQueue);
+        if maximized {
+            app.apply_dock(craft_ui::docking::Action::Float { panel: PanelKind::RenderQueue, rect: [50.0, 60.0, 400.0, 200.0] }).unwrap();
+            app.toggle_maximize(PanelKind::EffectControls);
+            app.ui.focused = PanelKind::RenderQueue;
+            assert!(app.ui.dock.is_floating(PanelKind::RenderQueue));
+        }
+        invoke(&mut app, &ctx, "file.close", json!({})).unwrap();
+        assert_eq!(app.ui.focused, PanelKind::Project);
+        assert!(app.ui.dock.is_visible(app.ui.focused), "focus must belong to a front tab");
+        assert_eq!(app.ui.maximized, None, "the focused docked panel must be on screen");
+    }
+}
+
+/// Closing a floating queue must focus the viewer that is actually shown, retaining maximization.
+#[test]
+fn closing_a_floating_queue_preserves_the_maximized_composition() {
+    let mut session = effectcraft_engine::Session::default();
+    session.execute("comp.new", json!({"name": "A", "width": 32, "height": 32, "duration": 2})).unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_| EffectcraftApp::new(session));
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    let app = h.state_mut();
+    app.show_panel(PanelKind::Composition);
+    app.show_panel(PanelKind::RenderQueue);
+    app.apply_dock(craft_ui::docking::Action::Float { panel: PanelKind::RenderQueue, rect: [50.0, 60.0, 400.0, 200.0] }).unwrap();
+    app.toggle_maximize(PanelKind::Composition);
+    app.ui.focused = PanelKind::RenderQueue;
+    assert!(app.ui.dock.is_visible(PanelKind::Timeline), "the hidden underlying tab triggers the regression");
+    assert!(!panel_shown(app, PanelKind::Timeline));
+    invoke(app, &ctx, "file.close", json!({})).unwrap();
+    h.run_steps(3);
+    assert_eq!(h.state().ui.focused, PanelKind::Composition);
+    assert_eq!(h.state().ui.maximized, Some(PanelKind::Composition));
+    assert!(!h.state().ui.dock.is_open(PanelKind::RenderQueue));
+    assert_eq!(h.state().session.state.open_comps.len(), 1);
+}
+
+#[test]
+fn queue_close_preserves_state_when_workspace_is_locked() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.session.execute("comp.new", json!({"name": "A", "duration": 2})).unwrap();
+    app.show_panel(PanelKind::RenderQueue);
+    app.ui.dock.locked = true;
+    let workspace = app.ui.dock.clone();
+    let comp = app.session.active_comp_id();
+    for _ in 0..2 {
+        assert!(invoke(&mut app, &ctx, "file.close", Value::Null).is_err());
+        assert_eq!(app.ui.dock, workspace);
+        assert_eq!(app.ui.focused, PanelKind::RenderQueue);
+        assert_eq!(app.session.active_comp_id(), comp);
+    }
+    assert!(!menu_items(&app).iter().find(|item| item.id == "file.close").unwrap().enabled);
+    app.ui.dock.locked = false;
+    invoke(&mut app, &ctx, "file.close", Value::Null).unwrap();
+    assert!(!app.ui.dock.is_open(PanelKind::RenderQueue));
+}
+
+#[test]
+fn queue_close_preserves_viewer_command_target() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let a = app.session.execute("comp.new", json!({"name": "A", "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    let b = app.session.execute("comp.new", json!({"name": "B", "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    app.show_panel(PanelKind::Viewer(1));
+    app.ui.viewers.insert(0, Some(a));
+    app.ui.viewers.insert(1, Some(b));
+    app.ui.active_viewer = 1;
+    app.apply_dock(craft_ui::docking::Action::Move {
+        panel: PanelKind::Timeline,
+        anchor: PanelKind::Composition,
+        placement: craft_ui::docking::Placement::Tab { before: None },
+    })
+    .unwrap();
+    app.close_panel(PanelKind::Timeline);
+    app.show_panel(PanelKind::Composition);
+    app.show_panel(PanelKind::RenderQueue);
+    assert_eq!(app.session.active_comp_id().map(|id| id.0), Some(b));
+    invoke(&mut app, &ctx, "file.close", json!({})).unwrap();
+    assert_eq!(app.ui.focused, PanelKind::Composition);
+    assert_eq!(app.ui.active_viewer, 0);
+    assert_eq!(app.session.active_comp_id().map(|id| id.0), Some(a));
+    invoke(&mut app, &ctx, "file.close", json!({})).unwrap();
+    assert!(!app.session.state.open_comps.iter().any(|id| id.0 == a));
+    assert!(app.session.state.open_comps.iter().any(|id| id.0 == b));
+}
+
+#[test]
+fn queue_close_keeps_passive_viewer_focus_across_frames() {
+    let mut session = effectcraft_engine::Session::default();
+    let a = session.execute("comp.new", json!({"name": "A", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    let b = session.execute("comp.new", json!({"name": "B", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_| EffectcraftApp::new(session));
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    let app = h.state_mut();
+    app.show_panel(PanelKind::Viewer(1));
+    app.ui.viewers.insert(0, Some(a));
+    app.ui.viewers.insert(1, Some(b));
+    app.ui.active_viewer = 1;
+    app.apply_dock(craft_ui::docking::Action::Move {
+        panel: PanelKind::Timeline,
+        anchor: PanelKind::Composition,
+        placement: craft_ui::docking::Placement::Tab { before: None },
+    })
+    .unwrap();
+    app.close_panel(PanelKind::Timeline);
+    app.show_panel(PanelKind::Composition);
+    app.show_panel(PanelKind::RenderQueue);
+    invoke(app, &ctx, "file.close", Value::Null).unwrap();
+    h.run_steps(4);
+    let app = h.state_mut();
+    assert_eq!(app.ui.focused, PanelKind::Composition);
+    assert_eq!(app.ui.active_viewer, 0);
+    assert_eq!(app.session.active_comp_id().map(|id| id.0), Some(a));
+    assert!(app.ui.dock.is_visible(PanelKind::Composition));
+    assert!(!app.ui.dock.is_open(PanelKind::RenderQueue));
+    invoke(app, &ctx, "file.close", json!({})).unwrap();
+    assert!(!app.session.state.open_comps.iter().any(|id| id.0 == a));
+    assert!(app.session.state.open_comps.iter().any(|id| id.0 == b));
+    // A later explicit Open still routes normally, rather than inheriting a deferred focus override.
+    invoke(app, &ctx, "comp.open", json!({"comp": b})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().ui.dock.is_visible(PanelKind::Timeline));
+    assert_eq!(h.state().session.active_comp_id().map(|id| id.0), Some(b));
+}
+
+#[test]
+fn menu_items_cover_the_tree() {
+    assert_eq!(menus().last(), Some(&"Help"));
+    assert!(effectcraft_engine::menus::entries().len() > 500);
+}
+
+/// A command run from the menu that opens a composition (File ▸ Import ▸ After Effects
+/// Project… after Import Anyway, a new composition) leaves the Home screen: it stayed over the
+/// imported project, which looked as if nothing was imported. A command that opens none keeps it.
+#[test]
+fn a_menu_command_that_opens_a_composition_leaves_the_home_screen() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.ui.start_screen = true;
+    run_engine(&mut app, &ctx, "project.summary", json!({})).unwrap();
+    assert!(app.ui.start_screen);
+    assert!(run_engine(&mut app, &ctx, "file.importAep", json!({"path": "/no/such/file.aep", "allowLosses": true})).is_err());
+    assert!(app.ui.start_screen);
+    run_engine(&mut app, &ctx, "comp.new", json!({"name": "Opened", "width": 64, "height": 36, "duration": 1})).unwrap();
+    assert!(!app.ui.start_screen);
+    // Asked for again (Home button, Help ▸ In-App Tutorials) it stays while the comp is open.
+    app.ui.start_screen = true;
+    run_engine(&mut app, &ctx, "layer.newSolid", json!({"color": "#ff0000"})).unwrap();
+    assert!(app.ui.start_screen);
+}
+
+/// Opening a project leaves the Home screen also when its composition has the id of the one open
+/// before (the project changed, the id did not), from the menu and from a file dialog's answer.
+#[test]
+fn opening_a_project_leaves_the_home_screen_whatever_its_composition_id() {
+    let ctx = egui::Context::default();
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    app.session.execute("comp.new", json!({"name": "Saved", "width": 64, "height": 36, "duration": 1})).unwrap();
+    let dir = std::env::temp_dir().join(format!("ec-home-open-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("Home.ecproj").to_string_lossy().to_string();
+    app.session.execute("file.saveAs", json!({"path": path})).unwrap();
+    let comp = app.session.active_comp_id();
+    // File ▸ Open with the path given (the menu path, `run_engine`).
+    app.ui.start_screen = true;
+    run_engine(&mut app, &ctx, "file.open", json!({"path": path})).unwrap();
+    assert_eq!(app.session.active_comp_id(), comp, "the same composition id");
+    assert!(!app.ui.start_screen, "File ▸ Open leaves the Home screen");
+    // The path picked in a file dialog (`run_with_picked`).
+    app.ui.start_screen = true;
+    super::frontend::dialog_answered(&mut app, crate::DialogAnswer { command: "file.open".into(), key: "path", params: json!({}), paths: vec![path.clone()] });
+    assert_eq!(app.session.active_comp_id(), comp);
+    assert!(!app.ui.start_screen, "a picked project leaves the Home screen");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A successful command that reports per-item problems (`errors`) shows a compact, readable
+/// report in the status line: `file: error; …`, first three and a count, never raw JSON.
+#[test]
+fn bundle_result_errors_show_compactly_in_the_status_line() {
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let result = json!({"installed": [], "errors": [
+        {"file": "a.wasm", "error": "already installed"},
+        {"file": "b.wasm", "error": "does not load"},
+        {"file": "c.wasm", "error": "cannot read it"},
+        {"error": "cannot read the bundle folder"},
+    ]});
+    super::frontend::show_result_errors(&mut app, &result);
+    assert_eq!(app.ui.status, "a.wasm: already installed; b.wasm: does not load; c.wasm: cannot read it; +1 more");
+    // A clean success leaves the status line alone.
+    super::frontend::show_result_errors(&mut app, &json!({"installed": ["x.wasm"], "errors": []}));
+    assert_eq!(app.ui.status, "a.wasm: already installed; b.wasm: does not load; c.wasm: cannot read it; +1 more");
+}
+
+/// Effect ▸ Install Effect Plug-in… picks its dialog by params: a bundle asks for a folder,
+/// a plain install asks for a `.wasm`, and with both given inline nothing asks at all.
+#[test]
+fn effect_plugin_install_dialog_router() {
+    use std::sync::{Arc, Mutex};
+    let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+    let ctx = egui::Context::default();
+    let pending = Arc::new(Mutex::new(Vec::new()));
+    let queue = pending.clone();
+    app.hooks.file_dialog_async = Some(Box::new(move |dialog, _done| queue.lock().unwrap().push(dialog)));
+    // The bundle menu entry: a folder picker.
+    assert_eq!(invoke(&mut app, &ctx, "effect.plugins.install", json!({"bundle": true})).unwrap(), json!({"dialog": "effect.plugins.install"}));
+    assert_eq!(pending.lock().unwrap().pop().unwrap(), crate::FileDialog::Folder, "the bundle asks for a folder");
+    // The plain command: a `.wasm` file picker.
+    assert_eq!(invoke(&mut app, &ctx, "effect.plugins.install", json!({})).unwrap(), json!({"dialog": "effect.plugins.install"}));
+    let crate::FileDialog::Open { exts, many } = pending.lock().unwrap().pop().unwrap() else { panic!("not an open dialog") };
+    assert_eq!(exts, vec!["wasm".to_string()], "{exts:?}");
+    assert!(!many);
+    // `path` given inline overrides the bundle ask: the command runs directly, opening no dialog
+    // (this session has no plug-in loader, so it errors — but nothing was asked).
+    let r = invoke(&mut app, &ctx, "effect.plugins.install", json!({"bundle": true, "path": "x.wasm"}));
+    assert!(r.is_err(), "{r:?}");
+    assert!(pending.lock().unwrap().is_empty(), "no dialog for an inline path");
+    // A supplied `folder` is a bundle source too: asking for a file would let the install take
+    // the picked file and ignore the folder, so nothing is asked.
+    let r = invoke(&mut app, &ctx, "effect.plugins.install", json!({"folder": "some/where"}));
+    assert!(r.is_err(), "{r:?}");
+    assert!(pending.lock().unwrap().is_empty(), "no dialog for an inline folder");
+}
diff --git a/crates/ui-egui/src/native_menu.rs b/crates/ui-egui/src/native_menu.rs
index ad30ded58..1d892b38a 100644
--- a/crates/ui-egui/src/native_menu.rs
+++ b/crates/ui-egui/src/native_menu.rs
@@ -126,8 +126,40 @@ impl NativeMenu {
     }
 }
 
+/// The native menu spec as the menu bar shows it now: [`build`], with the Edit items a text field
+/// takes ([`edits_text`]) enabled while one has the keyboard ([`text_field_window`]). Paste
+/// otherwise follows the project clipboard and would be greyed out with nothing copied there,
+/// while the field can paste.
+pub fn build_now(app: &EffectcraftApp, ctx: &egui::Context) -> NativeMenu {
+    fn enable(app: &EffectcraftApp, nodes: &mut [NativeNode]) {
+        for node in nodes {
+            match node {
+                NativeNode::Item(item) if edits_text(&item.command) => {
+                    item.enabled = true;
+                    let source = match item.command.as_str() {
+                        "edit.undo" => Some("Undo"),
+                        "edit.redo" => Some("Redo"),
+                        _ => None,
+                    };
+                    if let Some(source) = source {
+                        item.label = crate::i18n::label(app, &item.command, source).into();
+                    }
+                }
+                NativeNode::Submenu { children, .. } => enable(app, children),
+                _ => {}
+            }
+        }
+    }
+    let mut menu = build(app);
+    if text_field_window(ctx).is_some() {
+        enable(app, &mut menu.menus);
+    }
+    menu
+}
+
 /// Build the native menu spec for the app's current state.
 pub fn build(app: &EffectcraftApp) -> NativeMenu {
+    /// Append the native nodes of `nodes` to `out`; item ids start with `path`.
     fn rec(app: &EffectcraftApp, nodes: &[MenuNode], path: &str, out: &mut Vec<NativeNode>) {
         let mut services_added = false;
         for (i, n) in nodes.iter().enumerate() {
@@ -138,8 +170,8 @@ pub fn build(app: &EffectcraftApp) -> NativeMenu {
                     // Recent projects / footage / presets, undo history, shortcut slots, viewers,
                     // saved workspaces.
                     let saved = app.saved_workspace_names();
-                    let (entries, empty) = effectcraft_engine::menus::dynamic(&app.session, name, &crate::menus::dyn_ctx(&app.ui.workspace, &saved));
-                    if entries.is_empty()
+                    let (nodes, empty) = effectcraft_engine::menus::dynamic_nodes(&app.session, name, &crate::menus::dyn_ctx(&app.ui.workspace, &saved));
+                    if nodes.is_empty()
                         && let Some(e) = empty
                     {
                         out.push(NativeNode::Item(NativeItem {
@@ -153,14 +185,20 @@ pub fn build(app: &EffectcraftApp) -> NativeMenu {
                             checked: None,
                         }));
                     }
-                    for (k, e) in entries.iter().enumerate() {
+                    for (k, n) in nodes.iter().enumerate() {
+                        // A folder of scripts or panels: a submenu.
+                        let MenuNode::Item(e) = n else {
+                            rec(app, std::slice::from_ref(n), &format!("{id}.d{k}"), out);
+                            continue;
+                        };
                         out.push(NativeNode::Item(NativeItem {
                             id: format!("{id}.d{k}"),
                             label: e.label.clone(),
                             command: e.command.clone(),
                             params: e.params.clone(),
-                            shortcut: None,
-                            accelerator: None,
+                            // File ▸ Scripts entries show the key a script was given.
+                            shortcut: crate::menus::entry_shortcut(app, e),
+                            accelerator: crate::menus::entry_shortcut(app, e).as_deref().and_then(accelerator),
                             enabled: crate::menus::entry_enabled(app, e),
                             checked: crate::menus::entry_checked(app, e),
                         }));
@@ -206,6 +244,12 @@ pub fn build(app: &EffectcraftApp) -> NativeMenu {
                                     "Serviços"
                                 } else if crate::i18n::czech(app) {
                                     "Služby"
+                                } else if crate::i18n::polish(app) {
+                                    "Usługi"
+                                } else if crate::i18n::georgian(app) {
+                                    "სერვისები"
+                                } else if crate::i18n::swedish(app) {
+                                    "Tjänster"
                                 } else {
                                     "Services"
                                 }
@@ -317,10 +361,16 @@ pub fn state_key(app: &EffectcraftApp) -> u64 {
     s.journal.last().map(|j| &j.0).hash(&mut h);
     s.prefs.recent_projects.hash(&mut h);
     (&s.prefs.recent_footage, &s.prefs.recent_presets).hash(&mut h);
+    s.prefs.recent_scripts.hash(&mut h);
     s.history.undo.iter().for_each(|(l, _)| l.hash(&mut h));
     s.state.open_comps.hash(&mut h);
     s.active_comp_id().and_then(|c| s.state.views3d.get(&c)).map(|v| format!("{:?}", v.current)).hash(&mut h);
-    s.shortcuts().keys.len().hash(&mut h);
+    // Each binding's keys: a key changed to another one gives the item a new accelerator.
+    let shortcuts = s.shortcuts();
+    for b in &shortcuts.bindables {
+        b.key.hash(&mut h);
+        shortcuts.keys.get(&b.key).hash(&mut h);
+    }
     s.keymaps.active.hash(&mut h);
     let v = &app.ui.viewer;
     (v.rulers, v.guides, v.snap_guides, v.lock_guides, v.grid, v.snap_grid, v.show_layer_controls, v.pasteboard).hash(&mut h);
@@ -330,9 +380,23 @@ pub fn state_key(app: &EffectcraftApp) -> u64 {
     h.finish()
 }
 
-/// Commands that act on a focused text field instead (Edit menu while typing): the egui event to
-/// send in their place.
-fn text_field_event(command: &str, clipboard: Option<String>) -> Option<Vec<egui::Event>> {
+/// The window whose text field has the keyboard: a floating panel's own OS window, or the main
+/// window, where any widget that holds the keyboard counts (the Viewer's text editor is not an
+/// egui text field).
+pub fn text_field_window(ctx: &egui::Context) -> Option<egui::ViewportId> {
+    craft_ui::docking::typing_window(ctx).or_else(|| ctx.egui_wants_keyboard_input().then_some(egui::ViewportId::ROOT))
+}
+
+/// Whether a focused text field takes the menu command `command` ([`activate`]): the native menu
+/// keeps such items enabled while one has the keyboard, whatever the project allows.
+pub fn edits_text(command: &str) -> bool {
+    text_field_event(command).is_some()
+}
+
+/// Commands that act on a focused text field instead (Edit menu while typing): the egui events
+/// to send in their place. Paste is a Cmd+V press, which the field's window turns into a request
+/// for the clipboard text.
+fn text_field_event(command: &str) -> Option<Vec<egui::Event>> {
     let key = |k: egui::Key, shift: bool| egui::Event::Key {
         key: k,
         physical_key: None,
@@ -343,7 +407,7 @@ fn text_field_event(command: &str, clipboard: Option<String>) -> Option<Vec<egui
     Some(match command {
         "edit.copy" => vec![egui::Event::Copy],
         "edit.cut" => vec![egui::Event::Cut],
-        "edit.paste" => vec![egui::Event::Paste(clipboard?)],
+        "edit.paste" => vec![key(egui::Key::V, false)],
         "edit.selectAll" => vec![key(egui::Key::A, false)],
         "edit.undo" => vec![key(egui::Key::Z, false)],
         "edit.redo" => vec![key(egui::Key::Z, true)],
@@ -351,8 +415,43 @@ fn text_field_event(command: &str, clipboard: Option<String>) -> Option<Vec<egui
     })
 }
 
+/// Hand a text field's Edit command to the window `window` whose field has the keyboard. The
+/// main window gets the clipboard text itself and the events through the synthetic queue; a
+/// floating panel's OS window gets each key pressed and released, and asks for the clipboard
+/// text on Cmd+V (`craft_ui::docking::send_keys`).
+fn send_to_text_field(app: &mut EffectcraftApp, ctx: &egui::Context, window: egui::ViewportId, events: Vec<egui::Event>) {
+    if window == egui::ViewportId::ROOT {
+        for event in events {
+            match event {
+                egui::Event::Key { key: egui::Key::V, .. } => {
+                    if let Some(text) = app.hooks.clipboard_text.as_ref().and_then(|f| f()) {
+                        app.synthetic.push(egui::Event::Paste(text));
+                    }
+                }
+                event => app.synthetic.push(event),
+            }
+        }
+        ctx.request_repaint();
+        return;
+    }
+    let events = events
+        .into_iter()
+        .flat_map(|event| {
+            let release = match &event {
+                egui::Event::Key { key, physical_key, modifiers, .. } => {
+                    Some(egui::Event::Key { key: *key, physical_key: *physical_key, pressed: false, repeat: false, modifiers: *modifiers })
+                }
+                _ => None,
+            };
+            std::iter::once(event).chain(release)
+        })
+        .collect();
+    craft_ui::docking::send_keys(ctx, window, events);
+}
+
 /// Run a native menu item (by id) the way the in-window menu bar does. While a text field has
-/// the keyboard, Edit ▸ Cut/Copy/Paste/Select All/Undo/Redo edit the text instead.
+/// the keyboard ([`text_field_window`]), Edit ▸ Cut/Copy/Paste/Select All/Undo/Redo edit the
+/// text instead.
 pub fn activate(app: &mut EffectcraftApp, ctx: &egui::Context, menu: &NativeMenu, id: &str) -> Result<Value, String> {
     let item = menu.find(id).ok_or_else(|| format!("no native menu item `{id}`"))?;
     let (command, params) = (item.command.clone(), item.params.clone());
@@ -367,13 +466,12 @@ pub fn activate(app: &mut EffectcraftApp, ctx: &egui::Context, menu: &NativeMenu
         ctx.request_repaint();
         return Ok(Value::Null);
     }
-    if ctx.egui_wants_keyboard_input() {
-        let clip = if command == "edit.paste" { app.hooks.clipboard_text.as_ref().and_then(|f| f()) } else { None };
-        if let Some(events) = text_field_event(&command, clip) {
-            app.synthetic.extend(events);
-            ctx.request_repaint();
-            return Ok(Value::Null);
-        }
+    // The menu bar takes the Edit menu's key equivalents before any window sees them: while a
+    // text field has the keyboard, in the main window or a floating panel's own window, the
+    // field gets the key and the project command does not run.
+    if let (Some(window), Some(events)) = (text_field_window(ctx), text_field_event(&command)) {
+        send_to_text_field(app, ctx, window, events);
+        return Ok(Value::Null);
     }
     let params = if params.is_null() { json!({}) } else { params };
     let (command, params) = crate::menus::menu_choice(app, command, params);
@@ -469,6 +567,27 @@ mod tests {
         assert_eq!(translated, ["Служби", "Приховати EffectCraft", "Приховати решту", "Показати все"]);
     }
 
+    #[test]
+    fn swedish_translates_macos_predefined_items() {
+        if !cfg!(target_os = "macos") {
+            return;
+        }
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        app.session.execute("prefs.set", json!({"key": "general.language", "value": "sv"})).unwrap();
+        fn labels(nodes: &[NativeNode], out: &mut Vec<String>) {
+            for node in nodes {
+                match node {
+                    NativeNode::Predefined { label, .. } => out.push(label.clone()),
+                    NativeNode::Submenu { children, .. } => labels(children, out),
+                    _ => {}
+                }
+            }
+        }
+        let mut translated = vec![];
+        labels(&build(&app).menus, &mut translated);
+        assert_eq!(translated, ["Tjänster", "Dölj EffectCraft", "Göm övriga", "Visa alla"]);
+    }
+
     #[test]
     fn czech_translates_macos_predefined_items() {
         if !cfg!(target_os = "macos") {
@@ -490,6 +609,48 @@ mod tests {
         assert_eq!(translated, ["Služby", "Skrýt EffectCraft", "Skrýt ostatní", "Zobrazit vše"]);
     }
 
+    #[test]
+    fn polish_translates_macos_predefined_items() {
+        if !cfg!(target_os = "macos") {
+            return;
+        }
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        app.session.execute("prefs.set", json!({"key": "general.language", "value": "pl"})).unwrap();
+        fn labels(nodes: &[NativeNode], out: &mut Vec<String>) {
+            for node in nodes {
+                match node {
+                    NativeNode::Predefined { label, .. } => out.push(label.clone()),
+                    NativeNode::Submenu { children, .. } => labels(children, out),
+                    _ => {}
+                }
+            }
+        }
+        let mut translated = vec![];
+        labels(&build(&app).menus, &mut translated);
+        assert_eq!(translated, ["Usługi", "Ukryj EffectCraft", "Ukryj pozostałe", "Pokaż wszystko"]);
+    }
+
+    #[test]
+    fn georgian_translates_macos_predefined_items() {
+        if !cfg!(target_os = "macos") {
+            return;
+        }
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        app.session.execute("prefs.set", json!({"key": "general.language", "value": "ka"})).unwrap();
+        fn labels(nodes: &[NativeNode], out: &mut Vec<String>) {
+            for node in nodes {
+                match node {
+                    NativeNode::Predefined { label, .. } => out.push(label.clone()),
+                    NativeNode::Submenu { children, .. } => labels(children, out),
+                    _ => {}
+                }
+            }
+        }
+        let mut translated = vec![];
+        labels(&build(&app).menus, &mut translated);
+        assert_eq!(translated, ["სერვისები", "EffectCraft-ის დამალვა", "სხვების დამალვა", "ყველას ჩვენება"]);
+    }
+
     #[test]
     fn hide_items_are_predefined_on_macos() {
         let spec = build(&app());
@@ -582,7 +743,7 @@ mod tests {
         assert_ne!(state_key(&app), k0);
         // A tab behind another one, a closed panel and panels under a maximized one are not shown.
         assert_eq!((checked(&app, "renderQueue"), checked(&app, "timeline")), (Some(true), Some(false)));
-        app.ui.dock.close(PanelKind::RenderQueue);
+        app.close_panel(PanelKind::RenderQueue);
         assert_eq!((checked(&app, "renderQueue"), checked(&app, "timeline")), (Some(false), Some(true)));
         app.ui.maximized = Some(PanelKind::Timeline);
         assert_eq!((checked(&app, "timeline"), checked(&app, "project")), (Some(true), Some(false)));
@@ -613,6 +774,24 @@ mod tests {
         assert!(spec2.items().iter().any(|i| i.command == "file.openRecent" && i.label == "Recent Test.ecproj"));
     }
 
+    /// A script's key changed to another key changes the key, so the File ▸ Scripts entry gets
+    /// the new accelerator even though the number of bindings stays the same.
+    #[test]
+    fn a_changed_shortcut_changes_the_state_key() {
+        let mut app = app();
+        let script = json!({"name": "Rename Layers.jsx"});
+        let b = app.session.shortcuts().find(&effectcraft_engine::shortcuts::binding_key("file.runScript", &script)).cloned().unwrap();
+        app.session.keymaps.set(&b, &["Cmd+Alt+Shift+F7".to_string()]).unwrap();
+        app.session.shortcuts_changed();
+        let k0 = state_key(&app);
+        app.session.keymaps.set(&b, &["Cmd+Alt+Shift+F8".to_string()]).unwrap();
+        app.session.shortcuts_changed();
+        assert_ne!(state_key(&app), k0);
+        let spec = build(&app);
+        let entry = spec.items().into_iter().find(|i| i.command == "file.runScript" && i.params == script).unwrap();
+        assert_eq!(entry.shortcut.as_deref(), Some("Cmd+Alt+Shift+F8"));
+    }
+
     /// #1630: a checked Window menu entry closes its panel; an unchecked one opens it.
     #[test]
     fn window_menu_entry_toggles_its_panel() {
@@ -625,9 +804,9 @@ mod tests {
             activate(app, &ctx, &spec, &id).unwrap();
         };
         choose(&mut app);
-        assert!(app.ui.dock.contains(PanelKind::Align));
+        assert!(crate::dock::WorkspaceExt::is_open(&app.ui.dock, PanelKind::Align));
         choose(&mut app);
-        assert!(!app.ui.dock.contains(PanelKind::Align));
+        assert!(!crate::dock::WorkspaceExt::is_open(&app.ui.dock, PanelKind::Align));
     }
 
     #[test]
@@ -640,8 +819,48 @@ mod tests {
         activate(&mut app, &ctx, &spec, &id).unwrap();
         assert_eq!(app.session.active_comp().unwrap().layers.len(), n + 1);
         assert!(activate(&mut app, &ctx, &spec, "m.999").is_err());
-        assert!(text_field_event("edit.copy", None).is_some());
-        assert!(text_field_event("edit.paste", None).is_none());
-        assert!(text_field_event("layer.newNull", None).is_none());
+        assert!(edits_text("edit.copy") && edits_text("edit.paste"));
+        assert!(!edits_text("layer.newNull"));
+    }
+    /// #2459: while a text field has the keyboard the Edit menu's Undo and Redo act on the field and
+    /// read plain "Undo" / "Redo"; the project history labels come back once focus leaves.
+    #[test]
+    fn a_focused_text_field_gets_plain_undo_and_redo_labels() {
+        fn label(menu: &NativeMenu, id: &str) -> String {
+            menu.items().into_iter().find(|i| i.command == id).map(|i| i.label.to_string()).unwrap_or_default()
+        }
+        for (language, undo, redo) in [("en", "Undo", "Redo"), ("ja", "取り消し", "やり直し")] {
+            let mut app = app();
+            app.session.execute("prefs.set", json!({"key": "general.language", "value": language})).unwrap();
+            app.session.execute("layer.newNull", json!({})).unwrap();
+            app.session.execute("layer.newNull", json!({})).unwrap();
+            app.session.execute("edit.undo", json!({})).unwrap();
+            let ctx = egui::Context::default();
+            let history = label(&build_now(&app, &ctx), "edit.undo");
+            let redo_history = label(&build_now(&app, &ctx), "edit.redo");
+            assert!(history.starts_with(undo) && history != undo, "{history}");
+            assert!(redo_history.starts_with(redo) && redo_history != redo, "{redo_history}");
+            let mut text = String::new();
+            let mut id = None;
+            for _ in 0..2 {
+                let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
+                    let r = ui.text_edit_singleline(&mut text);
+                    r.request_focus();
+                    id = Some(r.id);
+                });
+                out.textures_delta.clear();
+            }
+            assert!(text_field_window(&ctx).is_some());
+            let typing = build_now(&app, &ctx);
+            assert_eq!(label(&typing, "edit.undo"), undo);
+            assert_eq!(label(&typing, "edit.redo"), redo);
+            assert!(typing.items().into_iter().any(|i| i.command == "edit.undo" && i.enabled));
+            assert!(typing.items().into_iter().any(|i| i.command == "edit.redo" && i.enabled));
+            ctx.memory_mut(|m| m.surrender_focus(id.unwrap_or(egui::Id::NULL)));
+            assert!(text_field_window(&ctx).is_none());
+            let after = build_now(&app, &ctx);
+            assert_eq!(label(&after, "edit.undo"), history);
+            assert_eq!(label(&after, "edit.redo"), redo_history);
+        }
     }
 }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
new file mode 100644
index 000000000..ccff0fdcd
--- /dev/null
+++ b/crates/ui-egui/src/panels.rs
@@ -0,0 +1,598 @@
+//! Panel bodies.
+
+pub mod aep_losses;
+pub mod anim_tools;
+pub mod camera_tracker_ui;
+pub mod comp_settings;
+pub mod content_fill_panel;
+pub mod crypto_pick;
+pub mod delete_items;
+pub mod dialogs;
+pub mod dialogs_3d;
+pub mod effect_controls;
+pub mod effects_presets;
+pub mod essential;
+pub mod expr_bar;
+pub mod expr_editor;
+pub mod flowchart;
+pub mod footage_panel;
+pub mod forms;
+pub mod fx_editors;
+pub mod fx_widgets;
+pub mod gradient_editor;
+pub mod gradient_handles;
+pub mod graph;
+pub mod graph_tools;
+pub mod home;
+pub mod info;
+pub mod key_dialogs;
+pub mod layer_panel;
+pub mod layer_styles_dialog;
+pub mod learn;
+pub mod live_preview;
+pub mod markers_ui;
+pub mod media_panels;
+pub mod misc;
+pub mod object_matte_tool;
+pub mod paint_panels;
+pub mod panel_kit;
+pub mod path_vr_panels;
+pub mod precomp;
+pub(crate) mod preview_merge;
+pub mod primitive_dialog;
+pub mod project;
+pub mod properties;
+pub mod puppet_tool;
+pub mod render_queue;
+pub mod roto_tool;
+pub mod rq_templates;
+pub mod scopes_panel;
+pub mod script_console;
+pub mod scriptui_view;
+pub mod settings;
+pub mod shortcut_editor;
+pub mod templates;
+pub mod text_panels;
+pub mod text_range_handles;
+pub mod timeline;
+pub mod tracker;
+pub mod unprecompose;
+pub mod unsaved;
+pub mod viewer;
+pub mod viewer_drop;
+pub mod viewer_overlays;
+pub mod viewer_text;
+pub mod viewer_tools;
+pub mod viewers;
+pub mod waveform;
+
+use crate::i18n::tr;
+use effectcraft_engine::Session;
+use effectcraft_engine::project::Comp;
+use effectcraft_engine::time::Tick;
+use egui::Rect;
+
+use crate::EffectcraftApp;
+use crate::dock::PanelKind;
+
+/// Drag-and-drop payloads between panels.
+#[derive(Clone, Debug)]
+pub enum DragPayload {
+    /// A project item (footage, comp, solid).
+    Item(u64),
+    /// An effect id from Effects & Presets.
+    Effect(String),
+    /// An animation preset from Effects & Presets, with its display name for the drag ghost.
+    Preset { preset: PresetRef, name: String },
+    /// A property dragged from the timeline (to the Essential Graphics panel).
+    Property { layer: u64, prop: u64 },
+    /// Files from the Media Browser (import; into the timeline: import and add).
+    Files(Vec<String>),
+}
+
+/// An animation preset in Effects & Presets.
+#[derive(Clone, Debug, PartialEq)]
+pub enum PresetRef {
+    /// A text animation preset id (`layer.applyTextPreset`).
+    Text(String),
+    /// A built-in animation preset id, e.g. a transition (`anim.applyBuiltinPreset`).
+    Builtin(String),
+    /// A user `.ecpreset` file path (`anim.applyPreset`).
+    File(String),
+}
+
+impl PresetRef {
+    /// The command and params that apply the preset to the selected layers.
+    pub fn command(&self) -> (&'static str, serde_json::Value) {
+        match self {
+            PresetRef::Text(id) => ("layer.applyTextPreset", serde_json::json!({"preset": id})),
+            PresetRef::Builtin(id) => ("anim.applyBuiltinPreset", serde_json::json!({"preset": id})),
+            PresetRef::File(path) => ("anim.applyPreset", serde_json::json!({"path": path})),
+        }
+    }
+
+    /// The command and params that apply the preset to `layer` (a drop target).
+    pub fn apply_to(&self, layer: u64) -> (&'static str, serde_json::Value) {
+        let (id, mut params) = self.command();
+        if let Some(obj) = params.as_object_mut() {
+            // `layer.applyTextPreset` takes one `layer`; the animation preset commands take `layers`.
+            match self {
+                PresetRef::Text(_) => obj.insert("layer".into(), serde_json::json!(layer)),
+                PresetRef::Builtin(_) | PresetRef::File(_) => obj.insert("layers".into(), serde_json::json!([layer])),
+            };
+        }
+        (id, params)
+    }
+}
+
+/// Layers carried by a Project item drag. Dragging a selected item uses the
+/// complete selection, while dragging an unselected item uses only that item.
+/// Folders and data files are not composition layers, and the composition the
+/// drop lands in is left out of a selection: it cannot contain itself, and one
+/// such item would make the engine refuse the whole drop (#2589).
+pub(crate) fn project_drop_items(app: &EffectcraftApp, dragged: u64, target: Option<effectcraft_engine::project::ItemId>) -> Vec<u64> {
+    use effectcraft_engine::project::{FootageKind, ItemId, ItemKind};
+
+    let selected = &app.session.state.project_selection;
+    let candidates: Vec<u64> = if selected.iter().any(|id| id.0 == dragged) {
+        selected.iter().map(|id| id.0).collect()
+    } else {
+        // One unselected item goes through as is, so a folder or data file still gets the
+        // engine's error instead of a silent no-op. The composition the drop lands in is the
+        // one case that never reaches it, selected or not (#2589).
+        return if Some(ItemId(dragged)) == target { Vec::new() } else { vec![dragged] };
+    };
+    candidates
+        .into_iter()
+        .filter(|id| {
+            if Some(ItemId(*id)) == target {
+                return false;
+            }
+            app.session.project.item(ItemId(*id)).is_some_and(|item| match &item.kind {
+                ItemKind::Comp(_) | ItemKind::Solid(_) => true,
+                ItemKind::Footage(f) => f.kind != FootageKind::Data,
+                ItemKind::Folder => false,
+            })
+        })
+        .collect()
+}
+
+/// The current time formatted per project settings (timecode with `;` for drop-frame, frames
+/// or Feet + Frames).
+pub fn timecode(session: &Session, comp: &Comp, t: Tick) -> String {
+    effectcraft_engine::commands::time::display_time(session, comp, t)
+}
+
+/// A length (a Duration) formatted per project settings, with no start offset.
+pub fn duration(session: &Session, comp: &Comp, len: Tick) -> String {
+    effectcraft_engine::commands::time::display_duration(session, comp, len)
+}
+
+/// Ctrl/Cmd-click on a current-time display toggles the project's Time Display Style between
+/// Timecode and Frames, as in After Effects (through Project Settings: one undo step).
+pub(crate) fn toggle_time_display(app: &mut EffectcraftApp, resp: &egui::Response) {
+    if !(resp.clicked() && resp.ctx.input(|i| i.modifiers.command)) {
+        return;
+    }
+    let timecode = app.session.project.settings.time_display == effectcraft_engine::project::TimeDisplayStyle::Timecode;
+    if let Err(e) = app.session.execute("file.projectSettings", serde_json::json!({"timeDisplay": if timecode { "frames" } else { "timecode" }})) {
+        app.ui.status = e.to_string();
+    }
+}
+
+/// Spacebar held outside a text field: the Hand tool (drags pan the viewer and scroll the
+/// Timeline).
+pub(crate) fn space_hand(ctx: &egui::Context) -> bool {
+    ctx.input(|i| i.key_down(egui::Key::Space)) && !ctx.egui_wants_keyboard_input()
+}
+
+/// What a scroll gesture over a viewer (Composition, Layer) does this frame.
+pub(crate) struct ViewerScroll {
+    /// Points to pan by: a two-finger trackpad scroll.
+    pub pan: egui::Vec2,
+    /// Factor to zoom by around the pointer: a pinch, Ctrl/Cmd+scroll, a mouse wheel, or
+    /// Alt + a trackpad scroll.
+    pub zoom: f32,
+    /// The gesture came from a trackpad (or is still the smoothed tail of one).
+    pub trackpad: bool,
+    /// Unmodified mouse-wheel lines this frame. Zero for a trackpad, a point-unit wheel, or
+    /// Ctrl/Cmd/Alt+wheel.
+    pub wheel_lines: f32,
+    /// This frame has a Ctrl/Cmd/Alt mouse-wheel event, which keeps zooming.
+    pub wheel_modified: bool,
+}
+
+/// Splits the frame's scroll input into a viewer pan and a zoom: a mouse wheel zooms and a
+/// trackpad's two-finger scroll pans.
+///
+/// Where the platform names the device (`MouseWheelSource`, macOS), that decides. Elsewhere a
+/// wheel scrolls in lines, but in a browser and with some high-resolution wheels it scrolls in
+/// points like a trackpad does, so the unit alone doesn't tell them apart. A scroll in points is
+/// a trackpad's once it has shown what a wheel can't do: a touch phase, movement on both axes at
+/// once, or a pinch. That holds until a wheel scrolls in lines. Until then the vertical part
+/// zooms; the horizontal part always pans.
+pub(crate) fn viewer_scroll(ctx: &egui::Context) -> ViewerScroll {
+    let id = egui::Id::unique("viewer-scroll-trackpad");
+    // The scroll is smoothed over the frames after its event, so the device is remembered.
+    let was: bool = ctx.data(|d| d.get_temp(id)).unwrap_or(false);
+    let trackpad = ctx.input(|i| {
+        i.events.iter().fold(was, |t, e| match e {
+            egui::Event::MouseWheel { source: egui::MouseWheelSource::Trackpad | egui::MouseWheelSource::Momentum, .. } => true,
+            egui::Event::MouseWheel { source: egui::MouseWheelSource::Wheel, .. } => false,
+            egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta, phase, modifiers, .. } => {
+                // Shift turns a wheel's scroll sideways, which is still one axis.
+                t || *phase == egui::TouchPhase::Start || (delta.x != 0.0 && delta.y != 0.0 && !modifiers.shift)
+            }
+            egui::Event::MouseWheel { .. } => false,
+            egui::Event::Zoom(_) => true,
+            _ => t,
+        })
+    });
+    if trackpad != was {
+        ctx.data_mut(|d| d.insert_temp(id, trackpad));
+    }
+    let (scroll, pinch, alt) = ctx.input(|i| (i.smooth_scroll_delta, i.zoom_delta(), i.modifiers.alt));
+    let pinch = if pinch.is_finite() && pinch > 0.0 { pinch } else { 1.0 };
+    let scroll = if scroll.x.is_finite() && scroll.y.is_finite() { scroll } else { egui::Vec2::ZERO };
+    let (wheel_lines, wheel_modified) = ctx.input(|i| {
+        let mut lines = 0.0;
+        let mut modified = false;
+        if !trackpad {
+            for event in &i.events {
+                if let egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta, modifiers, source, .. } = event
+                    && !matches!(source, egui::MouseWheelSource::Trackpad | egui::MouseWheelSource::Momentum)
+                {
+                    if modifiers.command || modifiers.ctrl || modifiers.alt {
+                        modified = true;
+                    } else {
+                        lines += delta.y;
+                    }
+                }
+            }
+        }
+        (lines, modified)
+    });
+    let (pan, zoom) = if trackpad && !alt {
+        (scroll, pinch)
+    } else if alt {
+        (egui::Vec2::ZERO, pinch * (scroll.y / 300.0).exp())
+    } else {
+        (egui::vec2(scroll.x, 0.0), pinch * (scroll.y / 300.0).exp())
+    };
+    ViewerScroll { pan, zoom, trackpad, wheel_lines, wheel_modified }
+}
+
+pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: PanelKind, rect: Rect) {
+    match p {
+        PanelKind::Composition => viewers::show(app, ui, 0, rect),
+        PanelKind::Viewer(n) => viewers::show(app, ui, n, rect),
+        PanelKind::Timeline => timeline::show(app, ui, rect),
+        PanelKind::Project => project::show(app, ui, rect),
+        PanelKind::EffectControls => effect_controls::show(app, ui, rect),
+        PanelKind::EffectsPresets => effects_presets::show(app, ui, rect),
+        PanelKind::Info => info::show(app, ui, rect),
+        PanelKind::Preview => misc::preview(app, ui, rect),
+        PanelKind::Character => text_panels::character(app, ui, rect),
+        PanelKind::Paragraph => text_panels::paragraph(app, ui, rect),
+        PanelKind::Align => text_panels::align(app, ui, rect),
+        PanelKind::Properties => properties::show(app, ui, rect),
+        PanelKind::Audio => misc::audio(app, ui, rect),
+        PanelKind::History => misc::history(app, ui, rect),
+        PanelKind::Markers => misc::markers(app, ui, rect),
+        PanelKind::MaskInterpolation => anim_tools::mask_interpolation(app, ui, rect),
+        PanelKind::ScriptConsole => script_console::show(app, ui, rect),
+        PanelKind::Wiggler => anim_tools::wiggler(app, ui, rect),
+        PanelKind::Smoother => anim_tools::smoother(app, ui, rect),
+        PanelKind::MotionSketch => anim_tools::motion_sketch(app, ui, rect),
+        PanelKind::RenderQueue => render_queue::show(app, ui, rect),
+        PanelKind::Tracker => tracker::show(app, ui, rect),
+        PanelKind::Layer => layer_panel::show(app, ui, rect),
+        PanelKind::Paint => paint_panels::paint(app, ui, rect),
+        PanelKind::Brushes => paint_panels::brushes(app, ui, rect),
+        PanelKind::EssentialGraphics => essential::show(app, ui, rect),
+        PanelKind::ScriptPanel(id) => scriptui_view::panel(app, ui, rect, id),
+        PanelKind::Flowchart => flowchart::show(app, ui, rect),
+        PanelKind::LumetriScopes => scopes_panel::show(app, ui, rect),
+        PanelKind::Footage => footage_panel::show(app, ui, rect),
+        PanelKind::MediaBrowser => media_panels::media_browser(app, ui, rect),
+        PanelKind::Metadata => media_panels::metadata(app, ui, rect),
+        PanelKind::Progress => media_panels::progress(app, ui, rect),
+        PanelKind::ContentAwareFill => content_fill_panel::show(app, ui, rect),
+        PanelKind::CreateNullsFromPaths => path_vr_panels::create_nulls(app, ui, rect),
+        PanelKind::VrCompEditor => path_vr_panels::vr_editor(app, ui, rect),
+    }
+}
+
+/// The open ≡ panel menu: the panel, where it opens and the viewport that owns the click.
+pub(crate) type OpenPanelMenu = (PanelKind, egui::Pos2, egui::ViewportId);
+
+/// The main window's pass of the ≡ panel menu (opened from a tab).
+pub fn panel_menu_popup(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
+    panel_menu_area(app, ui);
+}
+
+/// The ≡ panel menu, drawn in the viewport that owns the click that opened it: a panel in its own
+/// OS window opens its menu in that window, at that window's coordinates, instead of in the main
+/// window.
+pub(crate) fn panel_menu_area(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
+    let id = egui::Id::unique("panel-menu");
+    let viewport = ui.ctx().viewport_id();
+    let Some((panel, pos, owner)) = ui.ctx().data(|d| d.get_temp::<OpenPanelMenu>(id)) else { return };
+    if owner != viewport {
+        // a press in another window dismisses the menu, as a press elsewhere in its own does
+        if ui.ctx().input(|i| i.pointer.any_pressed()) {
+            ui.ctx().data_mut(|d| d.remove::<OpenPanelMenu>(id));
+        }
+        return;
+    }
+    let mut close = false;
+    let area_id = id.with("area");
+    // a small window (a floated panel can be narrower than the menu) gets the menu at its width
+    let width = (ui.ctx().content_rect().width() - 16.0).max(0.0);
+    let grew = ui.ctx().data_mut(|d| {
+        let last = d.get_temp::<f32>(area_id);
+        d.insert_temp(area_id, width);
+        last.is_some_and(|last| width > last)
+    });
+    // measured afresh on each opening, as egui's popups are: its items and its window change between
+    // openings. A window that grows under it gives back the width a narrower one took.
+    let opening = ui.ctx().read_response(area_id).is_none() || grew;
+    let area = egui::Area::new(area_id).order(egui::Order::Foreground).fixed_pos(pos).sizing_pass(opening).show(ui.ctx(), |ui| {
+        egui::Frame::popup(ui.style()).show(ui, |ui| {
+            ui.set_min_width(200.0_f32.min(width));
+            // only ever narrows what the area measured: the separator fills whatever width it is given
+            ui.set_max_width(ui.max_rect().width().min(width));
+            if ui.button(tr("Close Panel")).clicked() {
+                let _ = app.dock_command(ui.ctx(), craft_ui::docking::Action::Close { panel });
+                close = true;
+            }
+            let floating = crate::dock::WorkspaceExt::is_floating(&app.ui.dock, panel);
+            if !floating && ui.button(tr("Undock Panel")).clicked() {
+                let r = crate::dock_ui::default_float_rect(ui.ctx().content_rect());
+                let _ = app.dock_command(ui.ctx(), craft_ui::docking::Action::Float { panel, rect: r });
+                close = true;
+            }
+            // Multiple monitors: an OS window of its own, which can go on another screen. Where
+            // egui embeds viewports (the web), floating windows stay in the page.
+            if !ui.ctx().embed_viewports() {
+                let windowed = app.in_panel_window(panel);
+                if ui.button(if windowed { tr("Move Panel to Main Window") } else { tr("Move Panel to New Window") }).clicked() {
+                    let _ = crate::menus::invoke(app, &ui.ctx().clone(), "window.panelWindow", serde_json::json!({"panel": panel, "window": !windowed}));
+                    close = true;
+                }
+            }
+            if !floating && ui.button(if app.ui.maximized == Some(panel) { tr("Restore Panel Size") } else { tr("Maximize Panel") }).clicked() {
+                app.toggle_maximize(panel);
+                close = true;
+            }
+            ui.separator();
+            match panel {
+                PanelKind::Timeline => {
+                    for (label, id) in [
+                        ("Hide Shy Layers", "hideShy"),
+                        ("Enable Frame Blending", "frameBlending"),
+                        ("Enable Motion Blur", "motionBlur"),
+                        ("Draft 3D", "draft3d"),
+                    ] {
+                        if ui.button(label).clicked() {
+                            let _ = app.session.execute("comp.setSwitch", serde_json::json!({"switch": id}));
+                            close = true;
+                        }
+                    }
+                    if ui.button(tr("Composition Settings…")).clicked() {
+                        let _ = dialogs::open_comp_settings(app);
+                        close = true;
+                    }
+                }
+                PanelKind::Composition | PanelKind::Viewer(_) => {
+                    for (label, cmd) in [
+                        ("New Viewer", "view.newViewer"),
+                        ("Composition Settings…", "app.compSettings"),
+                        ("View Options…", "view.layerControls"),
+                        ("Show Grid", "view.grid"),
+                        ("Title/Action Safe", "view.safeMargins"),
+                    ] {
+                        if ui.button(label).clicked() {
+                            let _ = crate::menus::invoke(app, &ui.ctx().clone(), cmd, serde_json::json!({}));
+                            close = true;
+                        }
+                    }
+                }
+                _ => {
+                    ui.label(egui::RichText::new(crate::i18n::label(app, "window.panel", panel.title())).weak());
+                }
+            }
+        });
+    });
+    if close || crate::widgets::pressed_outside(ui.ctx(), &area.response) {
+        ui.ctx().data_mut(|d| d.remove::<OpenPanelMenu>(id));
+    }
+}
+
+#[cfg(test)]
+mod preset_drop_tests {
+    use super::PresetRef;
+    use serde_json::json;
+
+    #[test]
+    fn preset_drops_target_the_layer_with_each_commands_param() {
+        assert_eq!(PresetRef::Text("typewriter".into()).apply_to(7), ("layer.applyTextPreset", json!({"preset": "typewriter", "layer": 7})));
+        assert_eq!(PresetRef::Builtin("fadeIn".into()).apply_to(7), ("anim.applyBuiltinPreset", json!({"preset": "fadeIn", "layers": [7]})));
+        assert_eq!(PresetRef::File("/p/a.ecpreset".into()).apply_to(7), ("anim.applyPreset", json!({"path": "/p/a.ecpreset", "layers": [7]})));
+        // Double-click applies to the selection: no layer given.
+        assert_eq!(PresetRef::Text("typewriter".into()).command(), ("layer.applyTextPreset", json!({"preset": "typewriter"})));
+    }
+}
+
+#[cfg(test)]
+mod panel_menu_viewport_tests {
+    use super::*;
+    use effectcraft_engine::Session;
+
+    fn menu_id() -> egui::Id {
+        egui::Id::unique("panel-menu")
+    }
+
+    fn open(ctx: &egui::Context, owner: egui::ViewportId) {
+        ctx.data_mut(|d| d.insert_temp::<OpenPanelMenu>(menu_id(), (PanelKind::Timeline, egui::pos2(20.0, 20.0), owner)));
+    }
+
+    fn is_open(ctx: &egui::Context) -> bool {
+        ctx.data(|d| d.get_temp::<OpenPanelMenu>(menu_id())).is_some()
+    }
+
+    /// One pass of `viewport` (a window `width` wide) that draws the menu as the app does: the
+    /// main window through `panel_menu_popup`, a panel's own window through `panel_menu_area`.
+    /// Returns where the menu was drawn in that pass.
+    fn pass(app: &mut EffectcraftApp, ctx: &egui::Context, viewport: egui::ViewportId, width: f32, events: Vec<egui::Event>) -> Option<egui::Rect> {
+        let mut viewports = egui::ViewportIdMap::default();
+        viewports.insert(viewport, egui::ViewportInfo::default());
+        let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(width, 400.0));
+        let raw = egui::RawInput { viewport_id: viewport, viewports, screen_rect: Some(screen), events, ..Default::default() };
+        let mut drawn = None;
+        let mut out = ctx.run_ui(raw, |ui| {
+            if viewport == egui::ViewportId::ROOT {
+                panel_menu_popup(app, ui);
+            } else {
+                panel_menu_area(app, ui);
+            }
+            drawn = ui.ctx().memory(|m| m.area_rect(menu_id().with("area")));
+        });
+        out.textures_delta.clear();
+        drawn
+    }
+
+    fn window() -> egui::ViewportId {
+        egui::ViewportId::from_hash_of("panel-window")
+    }
+
+    fn press(pos: egui::Pos2) -> Vec<egui::Event> {
+        vec![
+            egui::Event::PointerMoved(pos),
+            egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE },
+        ]
+    }
+
+    #[test]
+    fn a_floating_panels_menu_is_drawn_in_its_own_window_not_the_main_one() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, window());
+        assert_eq!(pass(&mut app, &ctx, egui::ViewportId::ROOT, 1000.0, vec![]), None, "the main window does not draw it");
+        assert!(is_open(&ctx), "and does not drop it");
+        let rect = pass(&mut app, &ctx, window(), 1000.0, vec![]).expect("the panel's window draws it");
+        assert!((rect.min.x - 20.0).abs() < 1.0, "it opens at the window-local position: {rect:?}");
+    }
+
+    #[test]
+    fn a_main_window_panels_menu_stays_in_the_main_window() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, egui::ViewportId::ROOT);
+        assert!(pass(&mut app, &ctx, window(), 1000.0, vec![]).is_none());
+        assert!(pass(&mut app, &ctx, egui::ViewportId::ROOT, 1000.0, vec![]).is_some());
+    }
+
+    #[test]
+    fn a_floating_panels_menu_fits_a_window_narrower_than_the_menu() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, window());
+        let rect = pass(&mut app, &ctx, window(), 160.0, vec![]).unwrap();
+        assert!(rect.max.x <= 160.5, "the menu fits the 160 pt window: {rect:?}");
+        for _ in 0..4 {
+            let rect = pass(&mut app, &ctx, window(), 160.0, vec![]).unwrap();
+            assert!(rect.min.x >= -0.5 && rect.max.x <= 160.5, "and keeps fitting it: {rect:?}");
+        }
+    }
+
+    #[test]
+    fn the_menu_is_as_wide_as_its_contents_not_the_window() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, egui::ViewportId::ROOT);
+        let first = pass(&mut app, &ctx, egui::ViewportId::ROOT, 1200.0, vec![]).unwrap();
+        assert!(first.width() < 400.0, "measured to its contents: {first:?}");
+        for _ in 0..4 {
+            let rect = pass(&mut app, &ctx, egui::ViewportId::ROOT, 1200.0, vec![]).unwrap();
+            assert!((rect.width() - first.width()).abs() < 1.0, "and stays there, pass after pass: {rect:?}, first {first:?}");
+        }
+    }
+
+    #[test]
+    fn a_window_narrowed_under_the_open_menu_narrows_the_menu() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, window());
+        for _ in 0..3 {
+            pass(&mut app, &ctx, window(), 1000.0, vec![]);
+        }
+        for _ in 0..3 {
+            pass(&mut app, &ctx, window(), 160.0, vec![]);
+        }
+        let rect = pass(&mut app, &ctx, window(), 160.0, vec![]).unwrap();
+        assert!(rect.min.x >= -0.5 && rect.max.x <= 160.5, "the menu follows the window: {rect:?}");
+    }
+
+    /// A long translation (here French) makes the menu wider than its minimum.
+    #[test]
+    fn a_window_widened_under_the_open_menu_gives_the_labels_their_room_back() {
+        crate::i18n::set_current("fr");
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        ctx.set_embed_viewports(false);
+        open(&ctx, window());
+        let wide = (0..3).filter_map(|_| pass(&mut app, &ctx, window(), 1000.0, vec![])).last().unwrap();
+        let narrow = (0..3).filter_map(|_| pass(&mut app, &ctx, window(), 160.0, vec![])).last().unwrap();
+        let again = (0..3).filter_map(|_| pass(&mut app, &ctx, window(), 1000.0, vec![])).last().unwrap();
+        crate::i18n::set_current("en");
+        assert!(narrow.width() < wide.width(), "it fits the narrow window: {narrow:?}, wide {wide:?}");
+        assert!((again.width() - wide.width()).abs() < 1.0, "back to its own width: {again:?}, first {wide:?}");
+    }
+
+    #[test]
+    fn each_opening_measures_the_menu_afresh() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, window());
+        let wide = (0..3).filter_map(|_| pass(&mut app, &ctx, window(), 1000.0, vec![])).last().unwrap();
+        // the same menu, opened while the window is narrow, wraps to fit...
+        ctx.data_mut(|d| d.remove::<OpenPanelMenu>(menu_id()));
+        pass(&mut app, &ctx, window(), 160.0, vec![]);
+        open(&ctx, window());
+        let narrow = (0..3).filter_map(|_| pass(&mut app, &ctx, window(), 160.0, vec![])).last().unwrap();
+        assert!(narrow.width() < wide.width(), "it fits the narrow window: {narrow:?}, wide {wide:?}");
+        // ...and doesn't keep that size when it next opens with room
+        ctx.data_mut(|d| d.remove::<OpenPanelMenu>(menu_id()));
+        pass(&mut app, &ctx, window(), 1000.0, vec![]);
+        open(&ctx, window());
+        let again = (0..3).filter_map(|_| pass(&mut app, &ctx, window(), 1000.0, vec![])).last().unwrap();
+        assert!((again.width() - wide.width()).abs() < 1.0, "back to its own width: {again:?}, first {wide:?}");
+    }
+
+    #[test]
+    fn a_press_in_another_window_closes_a_floating_panels_menu() {
+        let mut app = EffectcraftApp::new(Session::default());
+        let ctx = egui::Context::default();
+        open(&ctx, window());
+        pass(&mut app, &ctx, window(), 1000.0, vec![]);
+        assert!(is_open(&ctx));
+        pass(&mut app, &ctx, egui::ViewportId::ROOT, 1000.0, press(egui::pos2(600.0, 300.0)));
+        assert!(!is_open(&ctx), "a click in the main window dismisses it");
+    }
+
+    #[test]
+    fn a_menu_left_in_a_closed_window_is_dropped() {
+        let ctx = egui::Context::default();
+        let other = egui::ViewportId::from_hash_of("other-window");
+        open(&ctx, window());
+        crate::dock_ui::drop_menu_of_closed_window(&ctx, &[other]);
+        assert!(!is_open(&ctx), "its window is gone");
+        open(&ctx, window());
+        crate::dock_ui::drop_menu_of_closed_window(&ctx, &[window()]);
+        assert!(is_open(&ctx), "its window is still there");
+        open(&ctx, egui::ViewportId::ROOT);
+        crate::dock_ui::drop_menu_of_closed_window(&ctx, &[]);
+        assert!(is_open(&ctx), "the main window is always there");
+    }
+}
diff --git a/crates/ui-egui/src/panels/aep_losses.rs b/crates/ui-egui/src/panels/aep_losses.rs
new file mode 100644
index 000000000..746e83b86
--- /dev/null
+++ b/crates/ui-egui/src/panels/aep_losses.rs
@@ -0,0 +1,229 @@
+//! File ▸ Import / Export ▸ After Effects Project… from the menu: what the conversion cannot
+//! carry over is shown first (the command's dry run), and the user chooses to cancel or to go on
+//! with those losses (`allowLosses`). Cancel changes nothing; a conversion without losses runs at
+//! once. Agents running `file.importAep` / `file.exportAep` with `engine.execute` are never asked:
+//! they pass `allowLosses` or get the refusal.
+//!
+//! Automation ids: `dialog.aepLosses.continue`, `dialog.aepLosses.cancel`.
+
+use crate::i18n::tr;
+use egui::vec2;
+use serde_json::{Value, json};
+
+use crate::theme::Tokens;
+use crate::{Dialog, EffectcraftApp};
+
+/// The conversion waiting on the prompt: its command, params and the dry run's report.
+#[derive(Clone, Debug, Default)]
+pub struct Pending {
+    pub command: Option<(String, Value, Value)>,
+}
+
+/// How many detail lines of a loss category the prompt shows.
+const DETAILS: usize = 3;
+
+/// Whether command `id` with `params` needs the prompt first. When it does, the prompt opens
+/// holding the command and the caller must not run it. `Err` when the dry run fails (the file
+/// cannot be read or is not a project), with the message.
+pub fn guard(app: &mut EffectcraftApp, id: &str, params: &Value) -> Result<bool, String> {
+    if !matches!(id, "file.importAep" | "file.exportAep")
+        || params.get("allowLosses") == Some(&Value::Bool(true))
+        || params.get("dryRun") == Some(&Value::Bool(true))
+    {
+        return Ok(false);
+    }
+    let mut dry = params.as_object().cloned().unwrap_or_default();
+    dry.insert("dryRun".into(), Value::Bool(true));
+    let r = app.session.execute(id, Value::Object(dry)).map_err(|e| e.to_string())?;
+    let report = r.get("report").cloned().unwrap_or(Value::Null);
+    if report["losses"].as_array().is_none_or(|l| l.is_empty()) {
+        return Ok(false);
+    }
+    app.dialog_state.aep_losses.command = Some((id.to_string(), params.clone(), report));
+    app.dialog = Some(Dialog::AepLosses);
+    Ok(true)
+}
+
+/// A loss category (`snake_case` in the report) as words: `layer_styles` → `Layer styles`.
+fn category(c: &str) -> String {
+    let words = c.replace('_', " ");
+    let mut chars = words.chars();
+    chars.next().map(|f| f.to_uppercase().chain(chars).collect()).unwrap_or_default()
+}
+
+/// The report's losses as lines: one per category with its count, and a few of its details.
+pub fn lines(report: &Value) -> Vec<(String, Vec<String>)> {
+    let Some(losses) = report["losses"].as_array() else { return vec![] };
+    losses
+        .iter()
+        .map(|l| {
+            let head = format!("{} ({})", category(l["category"].as_str().unwrap_or("other")), l["count"].as_u64().unwrap_or(0));
+            let details = l["details"].as_array().map(|d| d.iter().filter_map(Value::as_str).take(DETAILS).map(str::to_string).collect()).unwrap_or_default();
+            (head, details)
+        })
+        .collect()
+}
+
+pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
+    let Some((id, _, report)) = app.dialog_state.aep_losses.command.clone() else {
+        app.dialog = None;
+        return;
+    };
+    let import = id == "file.importAep";
+    let title = if import { "Import After Effects Project" } else { "Export After Effects Project" };
+    let mut answer: Option<bool> = None;
+    super::dialogs::modal(ctx, title, vec2(520.0, 340.0), t, |ui| {
+        let text = if import {
+            tr("Some parts of this project cannot be imported exactly (left out or changed):")
+        } else {
+            tr("Some parts of this project cannot be exported exactly (left out or changed):")
+        };
+        ui.label(egui::RichText::new(text).color(t.tab_text_active));
+        ui.add_space(6.0);
+        egui::ScrollArea::vertical().max_height(200.0).show(ui, |ui| {
+            for (head, details) in lines(&report) {
+                ui.label(egui::RichText::new(head).color(t.tab_text_active));
+                for d in details {
+                    ui.label(egui::RichText::new(format!("    {d}")).color(t.text_dim).size(11.0));
+                }
+            }
+        });
+        ui.add_space(14.0);
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            let label = if import { tr("Import Anyway") } else { tr("Export Anyway") };
+            let r = ui.button(label);
+            app.auto.add("dialog.aepLosses.continue", r.rect, label);
+            if r.clicked() {
+                answer = Some(true);
+            }
+            let r = ui.button(tr("Cancel"));
+            app.auto.add("dialog.aepLosses.cancel", r.rect, "Cancel");
+            if r.clicked() {
+                answer = Some(false);
+            }
+        });
+    });
+    if answer.is_none() && ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+        answer = Some(false);
+    }
+    if let Some(go) = answer {
+        finish(app, ctx, go);
+    }
+}
+
+/// The prompt's answer: Cancel (`false`) drops the conversion, Import / Export Anyway runs it
+/// with `allowLosses`.
+fn finish(app: &mut EffectcraftApp, ctx: &egui::Context, go: bool) {
+    app.dialog = None;
+    let Some((id, params, _)) = app.dialog_state.aep_losses.command.take() else { return };
+    if go {
+        // An error is already in the status bar.
+        let _ = crate::menus::run_engine(app, ctx, &id, with_losses(&params));
+    }
+}
+
+/// `params` with the user's consent to the losses the prompt listed.
+fn with_losses(params: &Value) -> Value {
+    let mut p = params.as_object().cloned().unwrap_or_default();
+    p.insert("allowLosses".into(), json!(true));
+    Value::Object(p)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_report_reads_as_categories_with_counts_and_details() {
+        let report = json!({"losses": [{"category": "layer_styles", "count": 4, "details": ["a", "b", "c", "d"]}, {"category": "effects", "count": 1}]});
+        let l = lines(&report);
+        assert_eq!(l[0], ("Layer styles (4)".to_string(), vec!["a".to_string(), "b".into(), "c".into()]));
+        assert_eq!(l[1], ("Effects (1)".to_string(), vec![]));
+        assert!(lines(&json!({})).is_empty());
+    }
+
+    #[test]
+    fn agents_and_consented_calls_are_not_asked() {
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        assert_eq!(guard(&mut app, "file.importAep", &json!({"path": "x.aep", "allowLosses": true})), Ok(false));
+        assert_eq!(guard(&mut app, "file.importAep", &json!({"path": "x.aep", "dryRun": true})), Ok(false));
+        assert_eq!(guard(&mut app, "file.open", &json!({"path": "x.aep"})), Ok(false));
+        // `false` is no consent: the dry run still runs (and fails first here).
+        assert!(guard(&mut app, "file.importAep", &json!({"path": "/no/such/file.aep", "allowLosses": false, "dryRun": false})).is_err());
+        // A file that cannot be read is an error, not a prompt.
+        assert!(guard(&mut app, "file.importAep", &json!({"path": "/no/such/file.aep"})).is_err());
+        assert!(app.dialog.is_none());
+    }
+
+    #[test]
+    fn cancel_changes_nothing_and_continue_exports_with_the_losses() {
+        let ctx = egui::Context::default();
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        // Rec. 2020 has no After Effects counterpart: the export reports it.
+        std::sync::Arc::make_mut(&mut app.session.project).settings.working_space = Some(effectcraft_engine::color::ColorSpace::Rec2020);
+        let dir = TempDir::new();
+        let path = dir.0.join("out.aep");
+        let params = json!({"path": path.to_string_lossy()});
+        assert_eq!(guard(&mut app, "file.exportAep", &params), Ok(true));
+        assert_eq!(app.dialog, Some(Dialog::AepLosses));
+        crate::panels::dialogs::press_key(&mut app, &ctx, egui::Key::Escape, egui::Modifiers::NONE);
+        assert!(app.dialog.is_none() && app.dialog_state.aep_losses.command.is_none());
+        assert!(!path.exists(), "Cancel wrote nothing");
+        assert_eq!(guard(&mut app, "file.exportAep", &params), Ok(true));
+        finish(&mut app, &ctx, true);
+        assert!(app.dialog.is_none() && path.is_file(), "Export Anyway wrote the file");
+    }
+
+    #[test]
+    fn a_false_consent_still_asks() {
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        std::sync::Arc::make_mut(&mut app.session.project).settings.working_space = Some(effectcraft_engine::color::ColorSpace::Rec2020);
+        let dir = TempDir::new();
+        let params = json!({"path": dir.0.join("out.aep").to_string_lossy(), "allowLosses": false, "dryRun": false});
+        assert_eq!(guard(&mut app, "file.exportAep", &params), Ok(true));
+        assert_eq!(app.dialog, Some(Dialog::AepLosses));
+    }
+
+    /// A folder of its own for one test, removed afterwards.
+    struct TempDir(std::path::PathBuf);
+
+    impl TempDir {
+        fn new() -> Self {
+            static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+            let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
+            let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            let dir = std::env::temp_dir().join(format!("ec-aep-losses-{}-{nanos}-{n}", std::process::id()));
+            std::fs::create_dir_all(&dir).unwrap();
+            assert!(std::fs::read_dir(&dir).unwrap().next().is_none(), "a fresh folder");
+            Self(dir)
+        }
+    }
+
+    impl Drop for TempDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn a_lossy_import_asks_and_import_anyway_imports() {
+        // The combined effects project of the test corpus (opt-in, the folder named by
+        // `EFFECTCRAFT_AEP_FIXTURES`) has effects outside the importer's table.
+        let path = std::env::var_os("EFFECTCRAFT_AEP_FIXTURES").filter(|d| !d.is_empty()).map(|d| std::path::PathBuf::from(d).join("effects.aep"));
+        let Some(path) = path.filter(|p| p.is_file()) else {
+            assert!(std::env::var_os("EFFECTCRAFT_AEP_FIXTURES_REQUIRED").is_none_or(|v| v.is_empty()), "fixture effects.aep missing");
+            println!("SKIPPED: fixture effects.aep missing");
+            return;
+        };
+        let ctx = egui::Context::default();
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        let params = json!({"path": path.to_string_lossy()});
+        assert_eq!(guard(&mut app, "file.importAep", &params), Ok(true));
+        assert_eq!(app.dialog, Some(Dialog::AepLosses));
+        assert!(app.session.project.items.is_empty(), "the dry run imported nothing");
+        finish(&mut app, &ctx, true);
+        assert!(app.dialog.is_none() && !app.session.project.items.is_empty(), "Import Anyway imported the project");
+    }
+}
diff --git a/crates/ui-egui/src/panels/anim_tools.rs b/crates/ui-egui/src/panels/anim_tools.rs
index 15a4f4f89..67ae71c0b 100644
--- a/crates/ui-egui/src/panels/anim_tools.rs
+++ b/crates/ui-egui/src/panels/anim_tools.rs
@@ -22,7 +22,7 @@ fn label(p: &egui::Painter, x: f32, y: f32, s: &str, t: &Tokens) {
 /// A dropdown with options; returns the new index when changed.
 fn choice(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, auto: &str, options: &[&str], cur: usize) -> Option<usize> {
     let t = app.tokens;
-    let id = egui::Id::new(("animtool-dd", auto));
+    let id = egui::Id::unique(("animtool-dd", auto));
     if widgets::dropdown(ui, r, options.get(cur).copied().unwrap_or(""), &t, id).clicked() {
         widgets::open_popup(ui, id);
     }
@@ -31,17 +31,21 @@ fn choice(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, auto: &str, opti
     widgets::popup_menu(ui, id, r.left_bottom(), &opts, Some(cur)).filter(|i| *i != cur)
 }
 
-fn number(app: &mut EffectcraftApp, ui: &mut egui::Ui, at: egui::Pos2, auto: &str, v: f64, speed: f64, range: (f64, f64), dec: usize, suffix: &str) -> f64 {
+/// A drag-to-change number field for an anim-tool setting: `v` clamped to `range`, `speed` points
+/// per pixel, `dec` decimals and a `suffix`; returns the new value, or `v` when it did not change.
+fn number(app: &mut EffectcraftApp, ui: &mut egui::Ui, at: egui::Pos2, auto: &str, v: f64, spec: widgets::HotSpec) -> f64 {
     let t = app.tokens;
-    let (r, nv, _) = widgets::hot_number_at(ui, at, egui::Id::new(("animtool-n", auto)), v, speed, range, dec, suffix, &t);
+    let (r, nv, _) = widgets::hot_number_at(ui, at, egui::Id::unique(("animtool-n", auto)), v, &spec, &t);
     app.auto.add(auto, r, &format!("{v}"));
     nv.unwrap_or(v)
 }
 
+/// A checkbox at `at` with its `text` label drawn to its right; returns the state to store, i.e.
+/// `!on` when it was clicked and `on` otherwise.
 fn checkbox(app: &mut EffectcraftApp, ui: &mut egui::Ui, at: egui::Pos2, auto: &str, text: &str, on: bool) -> bool {
     let t = app.tokens;
     let r = Rect::from_min_size(at, vec2(16.0, 16.0));
-    let clicked = widgets::checkbox(ui, r, on, &t, egui::Id::new(("animtool-cb", auto))).clicked();
+    let clicked = widgets::checkbox(ui, r, on, &t, egui::Id::unique(("animtool-cb", auto))).changed();
     ui.painter().text(pos2(r.max.x + 6.0, r.center().y), Align2::LEFT_CENTER, text, Tokens::ui(12.0), t.text);
     app.auto.add(auto, r, text);
     if clicked { !on } else { on }
@@ -101,15 +105,29 @@ pub fn wiggler(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     y += ROW + 4.0;
     label(&p, x0, y, "Frequency:", &t);
-    st.wiggle_frequency = number(app, ui, pos2(xv, y), "wiggler.frequency", st.wiggle_frequency, 0.1, (0.1, 100.0), 1, " per second");
+    st.wiggle_frequency = number(
+        app,
+        ui,
+        pos2(xv, y),
+        "wiggler.frequency",
+        st.wiggle_frequency,
+        widgets::HotSpec { speed: 0.1, range: (0.1, 100.0), decimals: 1, suffix: " per second" },
+    );
     y += ROW;
     label(&p, x0, y, "Magnitude:", &t);
-    st.wiggle_magnitude = number(app, ui, pos2(xv, y), "wiggler.magnitude", st.wiggle_magnitude, 0.5, (0.0, 100_000.0), 1, "");
+    st.wiggle_magnitude = number(
+        app,
+        ui,
+        pos2(xv, y),
+        "wiggler.magnitude",
+        st.wiggle_magnitude,
+        widgets::HotSpec { speed: 0.5, range: (0.0, 100_000.0), decimals: 1, suffix: "" },
+    );
     y += ROW + 8.0;
     app.ui.anim_tools = st.clone();
     let b = Rect::from_min_size(pos2(rect.max.x - 92.0, y), vec2(80.0, 24.0));
     let enabled = app.session.state.selected_keys.len() >= 2;
-    if widgets::text_button(ui, b, "Apply", enabled, &t, egui::Id::new("wg-apply")).clicked() {
+    if widgets::text_button(ui, b, crate::i18n::tr("Apply"), enabled, &t, egui::Id::unique("wg-apply")).clicked() {
         let params = json!({
             "apply": if st.wiggle_spatial { "spatial" } else { "temporal" },
             "noise": if st.wiggle_smooth { "smooth" } else { "jagged" },
@@ -145,12 +163,19 @@ pub fn smoother(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     p.text(pos2(xv, y + 9.0), Align2::LEFT_CENTER, txt, Tokens::ui(12.0), t.text);
     y += ROW;
     label(&p, x0, y, "Tolerance:", &t);
-    let tol = number(app, ui, pos2(xv, y), "smoother.tolerance", app.ui.anim_tools.smooth_tolerance, 0.05, (0.0, 10_000.0), 2, "");
+    let tol = number(
+        app,
+        ui,
+        pos2(xv, y),
+        "smoother.tolerance",
+        app.ui.anim_tools.smooth_tolerance,
+        widgets::HotSpec { speed: 0.05, range: (0.0, 10_000.0), decimals: 2, suffix: "" },
+    );
     app.ui.anim_tools.smooth_tolerance = tol;
     y += ROW + 8.0;
     let b = Rect::from_min_size(pos2(rect.max.x - 92.0, y), vec2(80.0, 24.0));
     let enabled = app.session.state.selected_keys.len() >= 3;
-    if widgets::text_button(ui, b, "Apply", enabled, &t, egui::Id::new("sm-apply")).clicked() {
+    if widgets::text_button(ui, b, crate::i18n::tr("Apply"), enabled, &t, egui::Id::unique("sm-apply")).clicked() {
         apply(app, "keys.smooth", json!({"tolerance": tol}));
     }
     app.auto.add("smoother.apply", b, "Apply");
@@ -166,10 +191,24 @@ pub fn motion_sketch(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let mut y = rect.min.y + 10.0;
     let mut st = app.ui.anim_tools.clone();
     label(&p, x0, y, "Capture speed at:", &t);
-    st.sketch_speed = number(app, ui, pos2(xv, y), "motionSketch.captureSpeed", st.sketch_speed, 1.0, (1.0, 10_000.0), 0, " %");
+    st.sketch_speed = number(
+        app,
+        ui,
+        pos2(xv, y),
+        "motionSketch.captureSpeed",
+        st.sketch_speed,
+        widgets::HotSpec { speed: 1.0, range: (1.0, 10_000.0), decimals: 0, suffix: " %" },
+    );
     y += ROW;
     label(&p, x0, y, "Smoothing:", &t);
-    st.sketch_smoothing = number(app, ui, pos2(xv, y), "motionSketch.smoothing", st.sketch_smoothing, 0.1, (0.0, 100.0), 1, "");
+    st.sketch_smoothing = number(
+        app,
+        ui,
+        pos2(xv, y),
+        "motionSketch.smoothing",
+        st.sketch_smoothing,
+        widgets::HotSpec { speed: 0.1, range: (0.0, 100.0), decimals: 1, suffix: "" },
+    );
     y += ROW + 2.0;
     p.text(pos2(x0, y + 8.0), Align2::LEFT_CENTER, tr("Show:"), Tokens::ui(12.0), t.text_dim);
     y += ROW - 6.0;
@@ -184,13 +223,19 @@ pub fn motion_sketch(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let fr = c.frame_rate;
     let (s, e) = (app.session.time(), c.work_area.1);
     let tc = |x| crate::panels::timecode(&app.session, c, x);
-    p.text(pos2(x0, y + 8.0), Align2::LEFT_CENTER, tr_args("Start: {}   Duration: {}", &[&(tc(s)), &(tc(e - s))]), Tokens::ui(11.0), t.text_faint);
+    p.text(
+        pos2(x0, y + 8.0),
+        Align2::LEFT_CENTER,
+        tr_args("Start: {}   Duration: {}", &[&(tc(s)), &crate::panels::duration(&app.session, c, e - s)]),
+        Tokens::ui(11.0),
+        t.text_faint,
+    );
     let _ = fr;
     y += ROW;
     let b = Rect::from_min_size(pos2(x0, y), vec2(120.0, 24.0));
     let armed = st.sketch_armed;
     let has_layer = !app.session.state.selected_layers.is_empty();
-    if widgets::text_button(ui, b, if armed { "Cancel Capture" } else { "Start Capture" }, has_layer && !armed, &t, egui::Id::new("ms-start")).clicked() {
+    if widgets::text_button(ui, b, if armed { "Cancel Capture" } else { "Start Capture" }, has_layer && !armed, &t, egui::Id::unique("ms-start")).clicked() {
         if !has_layer {
             app.ui.status = "Select a layer to sketch its motion".into();
         } else {
@@ -212,8 +257,10 @@ struct Capture {
     points: Vec<[f64; 3]>,
 }
 
+/// The `egui::Id` of the Motion Sketch capture in progress ([`Capture`]): its start time and the
+/// recorded points.
 fn capture_id() -> egui::Id {
-    egui::Id::new("motion-sketch-capture")
+    egui::Id::unique("motion-sketch-capture")
 }
 
 /// The Motion Sketch overlay on the Composition viewer (`area`): while armed, a press starts
@@ -224,9 +271,9 @@ pub fn sketch_overlay(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
         return;
     }
     let ctx = ui.ctx().clone();
-    let Some(map) = ctx.data(|d| d.get_temp::<crate::panels::viewer::ViewerMap>(egui::Id::new("viewer-map"))) else { return };
+    let Some(map) = ctx.data(|d| d.get_temp::<crate::panels::viewer::ViewerMap>(egui::Id::unique("viewer-map"))) else { return };
     let area = map.area;
-    let resp = ui.interact(area, egui::Id::new("motion-sketch-overlay"), Sense::drag());
+    let resp = ui.interact(area, egui::Id::unique("motion-sketch-overlay"), Sense::drag());
     app.auto.add("motionSketch.overlay", area, "Motion Sketch capture area");
     let now = ctx.input(|i| i.time);
     let painter = ui.painter().with_clip_rect(area);
@@ -316,12 +363,19 @@ pub fn mask_interpolation(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rec
         changes.insert("keyframeRate".into(), if i == 0 { json!("auto") } else { json!(fps) });
     }
     if let Some(r) = o.keyframe_rate {
-        let nr = number(app, ui, pos2(xv + 78.0, y), "maskInterp.rate", r, 0.5, (0.1, 1000.0), 1, " per second");
+        let nr = number(
+            app,
+            ui,
+            pos2(xv + 78.0, y),
+            "maskInterp.rate",
+            r,
+            widgets::HotSpec { speed: 0.5, range: (0.1, 1000.0), decimals: 1, suffix: " per second" },
+        );
         if (nr - r).abs() > 1e-9 {
             changes.insert("keyframeRate".into(), json!(nr));
         }
     } else {
-        p.text(pos2(xv + 78.0, y + 9.0), Align2::LEFT_CENTER, "per second", Tokens::ui(12.0), t.text_dim);
+        p.text(pos2(xv + 78.0, y + 9.0), Align2::LEFT_CENTER, crate::i18n::tr("per second"), Tokens::ui(12.0), t.text_dim);
     }
     y += ROW;
     let mut check = |app: &mut EffectcraftApp, y: f32, key: &str, text: &str, on: bool| {
@@ -334,13 +388,20 @@ pub fn mask_interpolation(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rec
     check(app, y, "linearVertexPaths", "Use \"Linear\" Vertex Paths", o.linear_vertex_paths);
     y += ROW;
     label(&p, x0, y, "Bending Resistance:", &t);
-    let br = number(app, ui, pos2(xv, y), "maskInterp.bendingResistance", o.bending_resistance, 0.5, (0.0, 100.0), 0, "");
+    let br = number(
+        app,
+        ui,
+        pos2(xv, y),
+        "maskInterp.bendingResistance",
+        o.bending_resistance,
+        widgets::HotSpec { speed: 0.5, range: (0.0, 100.0), decimals: 0, suffix: "" },
+    );
     if (br - o.bending_resistance).abs() > 1e-9 {
         changes.insert("bendingResistance".into(), json!(br));
     }
     y += ROW;
     label(&p, x0, y, "Quality:", &t);
-    let q = number(app, ui, pos2(xv, y), "maskInterp.quality", o.quality, 0.5, (0.0, 100.0), 0, "");
+    let q = number(app, ui, pos2(xv, y), "maskInterp.quality", o.quality, widgets::HotSpec { speed: 0.5, range: (0.0, 100.0), decimals: 0, suffix: "" });
     if (q - o.quality).abs() > 1e-9 {
         changes.insert("quality".into(), json!(q));
     }
@@ -351,7 +412,8 @@ pub fn mask_interpolation(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rec
     }
     y += ROW;
     if let Some(v) = o.add_vertices {
-        let nv = number(app, ui, pos2(x0 + 22.0, y), "maskInterp.addVertices", v, 0.2, (0.1, 2000.0), 1, "");
+        let nv =
+            number(app, ui, pos2(x0 + 22.0, y), "maskInterp.addVertices", v, widgets::HotSpec { speed: 0.2, range: (0.1, 2000.0), decimals: 1, suffix: "" });
         if (nv - v).abs() > 1e-9 {
             changes.insert("addVertices".into(), json!(nv));
         }
@@ -392,7 +454,7 @@ pub fn mask_interpolation(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rec
     }
     let b = Rect::from_min_size(pos2(rect.max.x - 92.0, y), vec2(80.0, 24.0));
     let enabled = app.session.state.selected_keys.len() >= 2;
-    if widgets::text_button(ui, b, "Apply", enabled, &t, egui::Id::new("mi-apply")).clicked() {
+    if widgets::text_button(ui, b, crate::i18n::tr("Apply"), enabled, &t, egui::Id::unique("mi-apply")).clicked() {
         match app.session.execute("mask.interpolate", json!({})) {
             Ok(r) => app.ui.status = format!("Mask Interpolation: {} keyframes added ({} vertices)", r["keys"], r["vertices"]),
             Err(e) => app.ui.status = e.to_string(),
diff --git a/crates/ui-egui/src/panels/camera_tracker_ui.rs b/crates/ui-egui/src/panels/camera_tracker_ui.rs
index 2bccfae07..fdda5f5d2 100644
--- a/crates/ui-egui/src/panels/camera_tracker_ui.rs
+++ b/crates/ui-egui/src/panels/camera_tracker_ui.rs
@@ -9,7 +9,7 @@
 //!   and Camera, Create Multiple …, Delete Selected Points; Delete removes the selection;
 //! - the "Analyzing in background (step 1 of 2)" / "Solving camera" banner;
 //! - the Effect Controls block with Analyze / Cancel / Create Camera, Method Used and Average
-//!   Error.
+//!   Error, and how many frames a partial solve solved.
 //!
 //! Everything is dispatched to the `camera.*` commands.
 
@@ -28,7 +28,7 @@ use serde_json::json;
 
 use super::viewer::ViewerMap;
 use crate::theme::Tokens;
-use crate::{EffectcraftApp, widgets};
+use crate::{EffectcraftApp, a11y, widgets};
 
 /// The tracker whose points the viewer shows.
 struct Active {
@@ -217,11 +217,11 @@ pub fn viewer_hook(
     // Interaction over the image.
     // While Space (Hand tool) is held the overlay only hovers, so the viewer underneath gets the pan drag.
     let sense = if super::space_hand(&ctx) { Sense::hover() } else { Sense::click_and_drag() };
-    let resp = ui.interact(map.area, egui::Id::new("viewer-camera-tracker"), sense);
+    let resp = ui.interact(map.area, egui::Id::unique("viewer-camera-tracker"), sense);
     app.auto.add("viewer.cameraTracker", map.area, "3D Camera Tracker points");
     // The overlay is on top of the viewer, so a middle-button drag lands here: pan the viewer like the Hand tool.
     if resp.dragged_by(egui::PointerButton::Middle) {
-        let pid = egui::Id::new("viewer-camera-tracker-pan");
+        let pid = egui::Id::unique("viewer-camera-tracker-pan");
         if resp.drag_started() {
             let start_pan = app.ui.viewer.pan;
             ui.data_mut(|d| d.insert_temp(pid, start_pan));
@@ -237,7 +237,7 @@ pub fn viewer_hook(
     let hover = resp.hover_pos();
     let point_at = |p: Pos2| hits.iter().filter(|h| h.1.distance(p) <= h.2 + 3.0).min_by(|x, y| x.1.distance(p).total_cmp(&y.1.distance(p))).map(|h| h.0);
     let tri = hover.filter(|p| point_at(*p).is_none()).and_then(|p| triangle_at(&hits, p));
-    let mid = egui::Id::new("viewer-camera-tracker-marquee");
+    let mid = egui::Id::unique("viewer-camera-tracker-marquee");
     let marquee: Option<Pos2> = ui.data(|d| d.get_temp(mid));
     // Hover target / the selection's target.
     if marquee.is_none() {
@@ -284,7 +284,7 @@ pub fn viewer_hook(
         }
     }
     // Right-click: the points under the cursor (selection, else the hovered triangle).
-    let cid = egui::Id::new("viewer-camera-tracker-menu-points");
+    let cid = egui::Id::unique("viewer-camera-tracker-menu-points");
     if resp.secondary_clicked() {
         let pts: Vec<u32> = if !selected.is_empty() {
             selected.clone()
@@ -413,23 +413,32 @@ pub fn editor(
     let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
     let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
     let b3 = Rect::from_min_size(pos2(b2.max.x + 8.0, b1.min.y), vec2(110.0, 22.0));
-    if widgets::text_button(ui, b1, "Analyze", false, &t, egui::Id::new(("ct-analyze", g.uid))).clicked() && !busy {
+    let analyze = widgets::text_button(ui, b1, tr("Analyze"), false, &t, egui::Id::unique(("ct-analyze", g.uid)));
+    a11y::button(&analyze, tr("Analyze"), !busy);
+    if analyze.clicked() && !busy {
         actions.push(("camera.analyze".into(), me.clone()));
     }
     app.auto.add(&format!("effectControls.cameraTracker.{}.analyze", g.uid), b1, "Analyze");
     if running {
-        if widgets::text_button(ui, b2, "Cancel", false, &t, egui::Id::new(("ct-cancel", g.uid))).clicked() {
+        if widgets::text_button(ui, b2, tr("Cancel"), false, &t, egui::Id::unique(("ct-cancel", g.uid))).clicked() {
             actions.push(("camera.cancel".into(), json!({})));
         }
         app.auto.add(&format!("effectControls.cameraTracker.{}.cancel", g.uid), b2, "Cancel");
     }
     let params = effectcraft_engine::camera_track::static_params(g);
     let solve = ct::solve(&params);
+    let partial = solve.as_deref().and_then(partial_frames);
+    let dy = if partial.is_some() { PARTIAL_LINE } else { 0.0 };
     if solve.is_some() {
-        if widgets::text_button(ui, b3, "Create Camera", false, &t, egui::Id::new(("ct-camera", g.uid))).clicked() {
+        if widgets::text_button(ui, b3, tr("Create Camera"), false, &t, egui::Id::unique(("ct-camera", g.uid))).clicked() {
             actions.push(("camera.create".into(), me.clone()));
         }
         app.auto.add(&format!("effectControls.cameraTracker.{}.createCamera", g.uid), b3, "Create Camera");
+        let export = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 70.0 + dy), vec2(218.0, 22.0));
+        if widgets::text_button(ui, export, tr("Export Scene to Blender..."), false, &t, egui::Id::unique(("ct-blender", g.uid))).clicked() && !busy {
+            actions.push(("camera.exportBlender".into(), me.clone()));
+        }
+        app.auto.add(&format!("effectControls.cameraTracker.{}.exportBlender", g.uid), export, "Export Scene to Blender...");
     }
     let status = match app.session.camera_progress() {
         Some(pr) if running => pr.banner(),
@@ -443,18 +452,41 @@ pub fn editor(
             None => "Not analyzed: click Analyze".into(),
         },
     };
-    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, status, Tokens::ui(11.5), t.text_dim);
+    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, &status, Tokens::ui(11.5), t.text_dim);
+    // The status is painted text; a read-out gives assistive technology the same words.
+    let line = |y: f32| Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + y), vec2((r.width() - 32.0).max(24.0), 16.0));
+    a11y::readout(ui, egui::Id::unique(("ct-status", g.uid)), line(30.0), &status);
+    if let Some((solved, frames)) = partial {
+        let text = tr_args("Partial solve: {} of {} frames solved", &[&solved, &frames]);
+        p.text(pos2(r.min.x + 24.0, r.min.y + 56.0), Align2::LEFT_CENTER, &text, Tokens::ui(11.5), t.warning);
+        app.auto.add(
+            &format!("effectControls.cameraTracker.{}.partialSolve", g.uid),
+            Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 48.0), vec2(r.width() - 24.0, 16.0)),
+            &text,
+        );
+        a11y::readout(ui, egui::Id::unique(("ct-partial", g.uid)), line(48.0), &text);
+    }
     if let Some(sv) = &solve {
         let f = sv.focal();
-        p.text(
-            pos2(r.min.x + 24.0, r.min.y + 56.0),
-            Align2::LEFT_CENTER,
-            format!("{} solved points · Horizontal Angle of View {:.1}°", sv.points.len(), sv.hfov(f)),
-            Tokens::ui(11.5),
-            t.text_faint,
-        );
+        let solved = format!("{} solved points · Horizontal Angle of View {:.1}°", sv.points.len(), sv.hfov(f));
+        p.text(pos2(r.min.x + 24.0, r.min.y + 56.0 + dy), Align2::LEFT_CENTER, &solved, Tokens::ui(11.5), t.text_faint);
+        a11y::readout(ui, egui::Id::unique(("ct-solved", g.uid)), line(48.0 + dy), &solved);
     }
 }
 
-/// Height of [`editor`].
-pub const EDITOR_HEIGHT: f32 = 68.0;
+/// Height of [`editor`] without the partial-solve line.
+const EDITOR_HEIGHT: f32 = 100.0;
+const PARTIAL_LINE: f32 = 18.0;
+
+/// Height of [`editor`] for tracker `g`.
+pub fn editor_height(g: &PropGroup) -> f32 {
+    let partial = ct::solve(&effectcraft_engine::camera_track::static_params(g)).is_some_and(|sv| partial_frames(&sv).is_some());
+    if partial { EDITOR_HEIGHT + PARTIAL_LINE } else { EDITOR_HEIGHT }
+}
+
+/// `(solved, all)` frames of a solve with unsolved frames, where the solver interpolates the
+/// camera; `None` when every frame is solved.
+fn partial_frames(sv: &CameraSolve) -> Option<(usize, usize)> {
+    let solved = sv.frames.iter().filter(|c| c.solved).count();
+    (solved < sv.frames.len()).then_some((solved, sv.frames.len()))
+}
diff --git a/crates/ui-egui/src/panels/comp_settings.rs b/crates/ui-egui/src/panels/comp_settings.rs
index 2cd19df5d..b778a3999 100644
--- a/crates/ui-egui/src/panels/comp_settings.rs
+++ b/crates/ui-egui/src/panels/comp_settings.rs
@@ -5,6 +5,7 @@
 use crate::i18n::{tr, tr_args};
 use crate::icons::Icon;
 use effectcraft_engine::prefs::CompPreset;
+use effectcraft_engine::project::Resolution;
 use effectcraft_engine::time::{FrameRate, format_timecode_frames, parse_timecode};
 use egui::{Color32, vec2};
 use serde_json::json;
@@ -94,6 +95,9 @@ pub struct CompDraft {
     pub preserve_frame_rate: bool,
     pub preserve_resolution: bool,
     pub advanced_3d: bool,
+    /// The comp's Resolution (the Composition panel's popup): saved with the project but no undo
+    /// step, so OK sets it apart from `comp.new` / `comp.settings`.
+    pub resolution: Resolution,
     pub tab: Tab,
     /// Timecode text being edited (start, duration).
     pub start_tc: Option<String>,
@@ -122,6 +126,7 @@ impl Default for CompDraft {
             preserve_frame_rate: false,
             preserve_resolution: false,
             advanced_3d: false,
+            resolution: Resolution::Auto,
             tab: Tab::Basic,
             start_tc: None,
             dur_tc: None,
@@ -176,8 +181,10 @@ fn timecode_field(ui: &mut egui::Ui, buf: &mut Option<String>, secs: &mut f64, r
     r
 }
 
+/// The temp-data id of the one-shot flag that makes the Save Preset name field take focus when
+/// it is next drawn.
 fn name_focus_id() -> egui::Id {
-    egui::Id::new("comp-preset-name-focus")
+    egui::Id::unique("comp-preset-name-focus")
 }
 
 /// Save Preset's Choose Name prompt (drawn in its own modal over the dialog while
@@ -239,36 +246,18 @@ fn matches(d: &CompDraft, w: u32, h: u32, par: f64, fps: f64) -> bool {
     w == d.width && h == d.height && (par - d.pixel_aspect).abs() < 1e-3 && (fps - d.fps).abs() < 1e-3
 }
 
-/// Draw the dialog. Returns `Some(params)` when OK is pressed, `Some(Null)` on Cancel. `custom`
-/// are the presets the user saved; saving or deleting one pushes its engine command to `cmds`.
-pub fn show(
+/// The controls of one tab.
+fn tab_body(
     ui: &mut egui::Ui,
+    tab: Tab,
     d: &mut CompDraft,
     t: &Tokens,
     auto: &mut Registry,
     custom: &[CompPreset],
     cmds: &mut Vec<(&'static str, serde_json::Value)>,
-) -> Option<serde_json::Value> {
-    let mut out = None;
-    ui.horizontal(|ui| {
-        ui.label(tr("Composition Name:"));
-        let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(300.0));
-        crate::widgets::focus_on_open(ui.ctx(), &r, &d.name);
-        auto.add("dialog.comp.name", r.rect, "Composition Name");
-    });
-    ui.add_space(8.0);
-    ui.horizontal(|ui| {
-        for (tab, label, key) in [(Tab::Basic, "Basic", "basic"), (Tab::Advanced, "Advanced", "advanced"), (Tab::Renderer, "3D Renderer", "renderer")] {
-            let r = ui.selectable_label(d.tab == tab, label);
-            auto.add(&format!("dialog.comp.tab.{key}"), r.rect, label);
-            if r.clicked() {
-                d.tab = tab;
-            }
-        }
-    });
-    ui.separator();
+) {
     let rate = FrameRate::from_f64(d.fps);
-    match d.tab {
+    match tab {
         Tab::Basic => {
             egui::Grid::new("comp-basic").num_columns(2).spacing([12.0, 9.0]).show(ui, |ui| {
                 ui.label(tr("Preset:"));
@@ -279,7 +268,7 @@ pub fn show(
                     .or_else(|| PRESETS.iter().find(|(_, w, h, par, f)| matches(d, *w, *h, *par, *f)).map(|p| p.0))
                     .unwrap_or("Custom");
                 ui.horizontal(|ui| {
-                    let r = egui::ComboBox::from_id_salt("comp-preset").width(300.0).selected_text(current).show_ui(ui, |ui| {
+                    let r = craft_ui::ComboBox::from_id_salt("comp-preset").width(300.0).selected_text(current).show_ui(ui, |ui| {
                         // Your own presets first, then the built-in ones.
                         for q in custom {
                             if ui.selectable_label(q.name == current, &q.name).clicked() {
@@ -297,7 +286,7 @@ pub fn show(
                     });
                     auto.add("dialog.comp.preset", r.response.rect, "Preset");
                     let (save_r, _) = ui.allocate_exact_size(vec2(20.0, 20.0), egui::Sense::hover());
-                    let save = crate::widgets::icon_button(ui, save_r, Icon::Plus, d.preset_name.is_some(), t, egui::Id::new("comp-preset-save"))
+                    let save = crate::widgets::icon_button(ui, save_r, Icon::Plus, d.preset_name.is_some(), t, egui::Id::unique("comp-preset-save"))
                         .on_hover_text(tr("Save Preset…"));
                     auto.add("dialog.comp.presetSave", save_r, "Save Preset");
                     if save.clicked() {
@@ -306,7 +295,7 @@ pub fn show(
                     }
                     if let Some(q) = own {
                         let (del_r, _) = ui.allocate_exact_size(vec2(20.0, 20.0), egui::Sense::hover());
-                        let del = crate::widgets::icon_button(ui, del_r, Icon::Trash, false, t, egui::Id::new("comp-preset-delete"))
+                        let del = crate::widgets::icon_button(ui, del_r, Icon::Trash, false, t, egui::Id::unique("comp-preset-delete"))
                             .on_hover_text(tr("Delete Preset"));
                         auto.add("dialog.comp.presetDelete", del_r, "Delete Preset");
                         if del.clicked() {
@@ -320,8 +309,8 @@ pub fn show(
                     let (ow, oh) = (d.width, d.height);
                     let r = ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut d.width).range(4..=30000).suffix(" px")));
                     auto.add("dialog.comp.width", r.rect, "Width");
-                    let lbl = format!("Lock Aspect Ratio to {}", aspect_label(ow as f64, oh as f64));
-                    let r = ui.checkbox(&mut d.lock_aspect, lbl);
+                    let lbl = tr_args("Lock Aspect Ratio to {}", &[&(aspect_label(ow as f64, oh as f64))]);
+                    let r = crate::widgets::labelled_checkbox(ui, &mut d.lock_aspect, lbl);
                     auto.add("dialog.comp.lockAspect", r.rect, "Lock Aspect Ratio");
                     if d.lock_aspect && ow != d.width && ow > 0 {
                         d.height = ((d.width as f64) * oh as f64 / ow as f64).round().max(4.0) as u32;
@@ -341,11 +330,11 @@ pub fn show(
                     let cur = PIXEL_ASPECTS
                         .iter()
                         .find(|(_, v)| (v - d.pixel_aspect).abs() < 1e-3)
-                        .map(|p| p.0.to_string())
+                        .map(|p| tr(p.0).to_string())
                         .unwrap_or_else(|| format!("{:.2}", d.pixel_aspect));
-                    let r = egui::ComboBox::from_id_salt("comp-par").width(220.0).selected_text(cur).show_ui(ui, |ui| {
+                    let r = craft_ui::ComboBox::from_id_salt("comp-par").width(220.0).selected_text(cur).show_ui(ui, |ui| {
                         for (name, v) in PIXEL_ASPECTS {
-                            if ui.selectable_label((v - d.pixel_aspect).abs() < 1e-3, *name).clicked() {
+                            if ui.selectable_label((v - d.pixel_aspect).abs() < 1e-3, tr(name)).clicked() {
                                 d.pixel_aspect = *v;
                             }
                         }
@@ -362,7 +351,7 @@ pub fn show(
                     // Any rate can be typed; the list holds the common ones.
                     let r = ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut d.fps).range(1.0..=999.0).speed(0.01).max_decimals(3)));
                     auto.add("dialog.comp.frameRate", r.rect, "Frame Rate");
-                    let r = egui::ComboBox::from_id_salt("comp-fps").width(18.0).selected_text("").show_ui(ui, |ui| {
+                    let r = craft_ui::ComboBox::from_id_salt("comp-fps").width(18.0).selected_text("").show_ui(ui, |ui| {
                         for f in FRAME_RATES {
                             if ui.selectable_label((d.fps - f).abs() < 1e-3, format!("{f}")).clicked() {
                                 d.fps = *f;
@@ -376,9 +365,30 @@ pub fn show(
                     }
                 });
                 ui.end_row();
-                ui.label("");
-                let mb = d.width as f64 * d.height as f64 * 4.0 / (1024.0 * 1024.0);
-                ui.label(egui::RichText::new(tr_args("{} x {}, {}MB per 8bpc frame", &[&d.width, &d.height, &format!("{mb:.1}")])).color(Color32::GRAY));
+                // As in After Effects, the Resolution menu (the Composition panel's popup) with
+                // the frame it renders beside it.
+                ui.label(tr("Resolution:"));
+                ui.horizontal(|ui| {
+                    let r = craft_ui::ComboBox::from_id_salt("comp-resolution").width(90.0).selected_text(tr(d.resolution.label())).show_ui(ui, |ui| {
+                        for res in Resolution::ALL {
+                            ui.selectable_value(&mut d.resolution, res, tr(res.label()));
+                        }
+                        let custom = matches!(d.resolution, Resolution::Custom(_));
+                        if ui.selectable_label(custom, tr("Custom")).clicked() && !custom {
+                            d.resolution = Resolution::Custom(5);
+                        }
+                    });
+                    auto.add("dialog.comp.resolution", r.response.rect, "Resolution");
+                    if let Resolution::Custom(n) = d.resolution {
+                        let mut n = n;
+                        let r = ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut n).range(2..=40)));
+                        auto.add("dialog.comp.resolutionFactor", r.rect, "Custom Resolution");
+                        d.resolution = Resolution::Custom(n);
+                    }
+                    let (w, h) = frame_at(d.width, d.height, d.resolution);
+                    let mb = w as f64 * h as f64 * 4.0 / (1024.0 * 1024.0);
+                    ui.label(egui::RichText::new(tr_args("{} x {}, {}MB per 8bpc frame", &[&w, &h, &format!("{mb:.1}")])).color(Color32::GRAY));
+                });
                 ui.end_row();
                 ui.label(tr("Start Timecode:"));
                 let r = ui.horizontal(|ui| timecode_field(ui, &mut d.start_tc, &mut d.start, rate, i64::MIN / 4)).inner;
@@ -392,7 +402,7 @@ pub fn show(
                 ui.horizontal(|ui| {
                     let r = crate::widgets::srgb_color_button(ui, &mut d.bg);
                     auto.add("dialog.comp.background", r.rect, "Background Color");
-                    ui.label(color_name(d.bg));
+                    ui.label(tr(color_name(d.bg)));
                 });
                 ui.end_row();
             });
@@ -416,11 +426,11 @@ pub fn show(
                 });
                 ui.end_row();
                 ui.label("");
-                let r = ui.checkbox(&mut d.preserve_frame_rate, tr("Preserve frame rate when nested or in render queue"));
+                let r = crate::widgets::labelled_checkbox(ui, &mut d.preserve_frame_rate, tr("Preserve frame rate when nested or in render queue"));
                 auto.add("dialog.comp.preserveFrameRate", r.rect, "Preserve frame rate when nested or in render queue");
                 ui.end_row();
                 ui.label("");
-                let r = ui.checkbox(&mut d.preserve_resolution, tr("Preserve resolution when nested"));
+                let r = crate::widgets::labelled_checkbox(ui, &mut d.preserve_resolution, tr("Preserve resolution when nested"));
                 auto.add("dialog.comp.preserveResolution", r.rect, "Preserve resolution when nested");
                 ui.end_row();
                 ui.label(egui::RichText::new(tr("Motion Blur")).strong());
@@ -446,7 +456,7 @@ pub fn show(
         Tab::Renderer => {
             ui.horizontal(|ui| {
                 ui.label(tr("Renderer:"));
-                let r = egui::ComboBox::from_id_salt("comp-renderer").selected_text(tr(if d.advanced_3d { "Advanced 3D" } else { "Classic 3D" })).show_ui(
+                let r = craft_ui::ComboBox::from_id_salt("comp-renderer").selected_text(tr(if d.advanced_3d { "Advanced 3D" } else { "Classic 3D" })).show_ui(
                     ui,
                     |ui| {
                         ui.selectable_value(&mut d.advanced_3d, false, tr("Classic 3D"));
@@ -457,6 +467,84 @@ pub fn show(
             });
         }
     }
+}
+
+/// The width and height `tab` would take at `top`, from laying it out unseen: they follow the
+/// font, the language and the scale. Nothing it registers or changes is kept.
+fn tab_size(ui: &mut egui::Ui, tab: Tab, d: &CompDraft, t: &Tokens, custom: &[CompPreset], top: f32) -> egui::Vec2 {
+    let rect = egui::Rect::from_min_size(egui::pos2(ui.max_rect().left(), top), vec2(ui.max_rect().width(), 0.0));
+    let mut child = ui.new_child(egui::UiBuilder::new().max_rect(rect).id_salt("comp-tab-measure").invisible());
+    tab_body(&mut child, tab, &mut d.clone(), t, &mut Registry::default(), custom, &mut Vec::new());
+    vec2(child.min_rect().width(), child.cursor().top() - top)
+}
+
+/// Where the width of the dialog's content, measured when it was last shown, is kept.
+fn content_width_id() -> egui::Id {
+    egui::Id::unique("comp-settings-content-width")
+}
+
+/// The dialog's width: 600 points, or more when the widest row on any of its tabs (as last shown),
+/// a scroll bar and the modal's two 18-point margins need it. A translation longer than the English (French,
+/// #2841) widens the dialog rather than hiding OK past its right edge.
+pub fn dialog_width(ctx: &egui::Context) -> f32 {
+    let content = ctx.data(|d| d.get_temp::<f32>(content_width_id())).unwrap_or(0.0);
+    (content + 36.0).max(600.0)
+}
+
+/// Draw the dialog. Returns `Some(params)` when OK is pressed, `Some(Null)` on Cancel. `custom`
+/// are the presets the user saved; saving or deleting one pushes its engine command to `cmds`.
+pub fn show(
+    ui: &mut egui::Ui,
+    d: &mut CompDraft,
+    t: &Tokens,
+    auto: &mut Registry,
+    custom: &[CompPreset],
+    cmds: &mut Vec<(&'static str, serde_json::Value)>,
+    preview: Option<&mut bool>,
+) -> Option<serde_json::Value> {
+    let mut out = None;
+    // The dialog's visible area, which Cancel and OK stay inside: the scroll area's viewport,
+    // which stays put when the content scrolls.
+    auto.add("dialog.comp.view", ui.clip_rect(), "Composition Settings");
+    let name_row = ui.horizontal(|ui| {
+        ui.label(tr("Composition Name:"));
+        let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(300.0));
+        crate::widgets::focus_on_open(ui.ctx(), &r, &d.name);
+        auto.add("dialog.comp.name", r.rect, "Composition Name");
+    });
+    ui.add_space(8.0);
+    let tab_row = ui.horizontal(|ui| {
+        for (tab, label, key) in [(Tab::Basic, "Basic", "basic"), (Tab::Advanced, "Advanced", "advanced"), (Tab::Renderer, "3D Renderer", "renderer")] {
+            let r = ui.selectable_label(d.tab == tab, tr(label));
+            auto.add(&format!("dialog.comp.tab.{key}"), r.rect, label);
+            if r.clicked() {
+                d.tab = tab;
+            }
+        }
+    });
+    ui.separator();
+    // Every tab takes the height of the tallest one, so Cancel and OK stay put between tabs.
+    let body_top = ui.cursor().top();
+    tab_body(ui, d.tab, d, t, auto, custom, cmds);
+    let shown = ui.cursor().top() - body_top;
+    let sizes: Vec<egui::Vec2> = [Tab::Basic, Tab::Advanced, Tab::Renderer].into_iter().map(|tab| tab_size(ui, tab, d, t, custom, body_top)).collect();
+    let tallest = sizes.iter().fold(shown, |h, s| h.max(s.y));
+    ui.add_space((tallest - shown).max(0.0));
+    // Every tab takes the width of the widest one too, so the dialog doesn't change size with them.
+    let widest = sizes.iter().fold(name_row.response.rect.width().max(tab_row.response.rect.width()), |w, s| w.max(s.x));
+    // Room for a vertical scroll bar too: without it, a bar shown while the dialog settles narrows
+    // the content into a horizontal bar, which takes the height back from it, and the two bars
+    // trade places every frame.
+    let needed = widest + ui.spacing().scroll.allocated_width();
+    let ctx = ui.ctx().clone();
+    let before = dialog_width(&ctx);
+    ctx.data_mut(|m| m.insert_temp(content_width_id(), needed.ceil()));
+    if dialog_width(&ctx) != before {
+        // This pass was laid out at the old width: lay it out again at the new one instead of
+        // showing it, and paint again in case egui declines the extra pass.
+        ctx.request_discard("Composition Settings width");
+        ctx.request_repaint();
+    }
     ui.add_space(14.0);
     ui.horizontal(|ui| {
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
@@ -470,6 +558,9 @@ pub fn show(
             if r.clicked() {
                 out = Some(serde_json::Value::Null);
             }
+            if let Some(on) = preview {
+                super::live_preview::checkbox(ui, auto, on, "dialog.comp.preview");
+            }
         });
     });
     out
@@ -486,10 +577,26 @@ pub fn params(d: &CompDraft) -> serde_json::Value {
     })
 }
 
+/// The frame size the comp renders at `res` (Auto follows the magnification, so the dialog shows
+/// the full frame for it).
+pub fn frame_at(w: u32, h: u32, res: Resolution) -> (u32, u32) {
+    effectcraft_render::frame_size(w, h, 1.0 / f64::from(res.factor().unwrap_or(1).max(1)))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn frame_size_follows_the_resolution() {
+        // The renderer's size, which rounds: 1081 / 3 = 360.33 and 1920 / 7 = 274.3.
+        assert_eq!(frame_at(1920, 1081, Resolution::Third), (640, 360));
+        assert_eq!(frame_at(1920, 1080, Resolution::Custom(7)), (274, 154));
+        assert_eq!(frame_at(1920, 1081, Resolution::Half), (960, 541));
+        assert_eq!(frame_at(1920, 1080, Resolution::Full), (1920, 1080));
+        assert_eq!(frame_at(1920, 1080, Resolution::Auto), (1920, 1080));
+    }
+
     #[test]
     fn aspect_labels_match_ae() {
         assert_eq!(aspect_label(1920.0, 1080.0), "16:9 (1.78)");
diff --git a/crates/ui-egui/src/panels/crypto_pick.rs b/crates/ui-egui/src/panels/crypto_pick.rs
new file mode 100644
index 000000000..2310ba93b
--- /dev/null
+++ b/crates/ui-egui/src/panels/crypto_pick.rs
@@ -0,0 +1,602 @@
+//! The Cryptomatte eyedropper in the Composition viewer (#473). The button next to the effect's
+//! Selection arms it ([`super::effect_controls::toggle_pick`] with [`KIND`]); while it is armed
+//! the viewer names the ID under the cursor, and a click picks it into the Selection: a plain
+//! click replaces it, Shift adds, Alt or Ctrl (Option or Cmd on a Mac) removes. It stays armed
+//! for the next click until Esc or the button again, and highlights the hovered ID's coverage.
+//! Arming it whenever the effect is selected (After Effects' behaviour, #1811) would only need
+//! to set the same pick.
+//!
+//! The hover needs the frame's Cryptomatte probe ([`effectcraft_engine::Session::crypto_probe_job`]):
+//! it is built off the UI thread, one at a time, not while playing or scrubbing; the chip says so
+//! meanwhile, and clicks wait for it (the hover then builds nothing), except while playing, where
+//! a click without its probe is not made. Once built, a hover is a few array reads.
+//!
+//! A click is the frame and the project shown at its press (and the resolution it read). It is
+//! made at the end of a pass ([`upkeep`]), checked against the frame and the project right
+//! before: if either changed since its press, it and every click waiting with it are dropped,
+//! and the status says so. A press dragged further than [`SLOP`] picks nothing, and says so.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use effectcraft_engine::commands::CryptoProbeJob;
+use effectcraft_engine::geom::Mat3;
+use effectcraft_engine::project::Layer;
+use effectcraft_engine::render::EvalCtx;
+use egui::{Color32, Rect, Sense, vec2};
+use serde_json::{Value, json};
+
+use super::fx_widgets as fw;
+use crate::EffectcraftApp;
+use crate::i18n::{tr, tr_args};
+use crate::state::{FxPick, Tool};
+use crate::theme::Tokens;
+
+/// [`FxPick::kind`] of the Cryptomatte eyedropper.
+pub const KIND: &str = "crypto";
+
+/// How long the time must stay put before a probe is built for it (scrubbing).
+const SETTLE: f64 = 0.1;
+
+/// A press that moves further than this (points) before its release picks nothing.
+const SLOP: f32 = 24.0;
+
+/// The status when waiting clicks are dropped.
+const NOT_MADE: &str = "Pick not made: the frame or the project changed before its Cryptomatte IDs were read";
+
+/// The status when a click is not made because the preview plays.
+const PLAYING: &str = "Pick not made: stop playback to pick";
+
+/// egui temp-data id for the eyedropper's [`State`] between frames.
+const VIEWER_CRYPTO_PICK: &str = "viewer-crypto-pick";
+
+/// egui temp-data id for the project revision and frame at the start of a pass.
+const VIEWER_CRYPTO_PICK_START: &str = "viewer-crypto-pick-start";
+
+fn pick_id() -> egui::Id {
+    egui::Id::unique(VIEWER_CRYPTO_PICK)
+}
+
+fn pick_start_id() -> egui::Id {
+    egui::Id::unique(VIEWER_CRYPTO_PICK_START)
+}
+
+/// The press of a click in progress.
+#[derive(Clone)]
+struct Press {
+    pos: egui::Pos2,
+    /// Its modifiers: letting go of Shift a moment early still adds.
+    keys: egui::Modifiers,
+    /// A menu or popup list was open: the click only closes it.
+    menu: bool,
+    /// A text field had the focus: the click commits it (the project may change by that).
+    typing: bool,
+    /// The pick query at the press (frame, resolution, layer point) and the project revision.
+    q: Option<Value>,
+    rev: u64,
+}
+
+/// The hovered ID's coverage highlight drawn over the viewer.
+#[derive(Clone)]
+struct HighlightMask {
+    key: (u32, Value),
+    texture: egui::TextureHandle,
+    size: [f64; 2],
+    uv: [f32; 2],
+}
+
+/// Hover and click state between frames.
+#[derive(Clone, Default)]
+struct State {
+    /// The last hover query (with the project revision) and its answer (or why there is none).
+    asked: Option<(Value, u64)>,
+    reply: Option<Result<Value, String>>,
+    /// Clicks waiting for their probe, in order, and the project revision they were made at.
+    pending: Vec<Value>,
+    pending_rev: u64,
+    /// The waiting clicks took the focus from a text field (the Selection being typed): they
+    /// are made once it has committed, on top of what it committed.
+    after_typing: bool,
+    /// A text field, a popup or a dialog had the keyboard the pass before: its Esc isn't the
+    /// pick's (egui lets go of the focus and closes popups, and Esc closes the dialog, before
+    /// the viewer runs).
+    esc_taken: bool,
+    /// The press of the click in progress.
+    press: Option<Press>,
+    /// Probes may be built for the waiting clicks (not while playing or scrubbing).
+    start: bool,
+    /// The comp time shown and since when (to wait for a scrub to settle).
+    shown: Option<(f64, f64)>,
+    /// The pick (layer, Selection) and the egui pass this state was last used for.
+    seen: Option<((u64, u64), u64)>,
+    /// The hovered ID's highlight: its hash and probe query, coverage texture, size and uv.
+    mask: Option<HighlightMask>,
+}
+
+/// Clears the busy flag and repaints when a build ends, a panic included.
+struct Done(Arc<AtomicBool>, egui::Context);
+impl Drop for Done {
+    fn drop(&mut self) {
+        self.0.store(false, Ordering::Release);
+        self.1.request_repaint();
+    }
+}
+
+fn run(job: CryptoProbeJob, done: Done) {
+    let _done = done;
+    job();
+}
+
+/// Whether the probe `q` needs is built; if not and `start`, start building it unless one is
+/// being built (one at a time for the app). Asking changes nothing: only a build started here
+/// supersedes another.
+fn ready(app: &EffectcraftApp, ctx: &egui::Context, q: &Value, start: bool) -> Result<bool, String> {
+    let busy = &app.crypto_probe_busy;
+    if app.session.crypto_probe_ready(q).map_err(|e| shown_error(&e.to_string()))? {
+        return Ok(true);
+    }
+    // (Only this thread sets the flag, so it stays clear until the store.)
+    if !start || busy.load(Ordering::Acquire) {
+        return Ok(false);
+    }
+    let Some(job) = app.session.crypto_probe_job(q).map_err(|e| shown_error(&e.to_string()))? else { return Ok(true) };
+    busy.store(true, Ordering::Release);
+    let done = Done(busy.clone(), ctx.clone());
+    if cfg!(target_arch = "wasm32") {
+        run(job, done);
+    } else if std::thread::Builder::new().name("crypto-probe".into()).spawn(move || run(job, done)).is_err() {
+        return Err("could not start reading the Cryptomatte IDs".into());
+    }
+    Ok(false)
+}
+
+/// An engine error as the chip and the status line show it: without the command's "invalid
+/// parameters for `…`:" prefix, capitalised.
+fn shown_error(e: &str) -> String {
+    let e = e.strip_prefix("invalid parameters for `").and_then(|r| r.split_once("`: ")).map_or(e, |(_, m)| m);
+    let mut c = e.chars();
+    c.next().map_or_else(String::new, |f| f.to_uppercase().chain(c).collect())
+}
+
+/// The keys that remove an ID (Ctrl removes on a Mac too, but means right-click there).
+pub fn remove_keys(os: egui::os::OperatingSystem) -> &'static str {
+    if os == egui::os::OperatingSystem::Mac { tr("Option or Cmd") } else { tr("Alt or Ctrl") }
+}
+
+/// At the start of every pass, before its keys: the project revision and frame on screen when
+/// the pass's input happened. A press in the pass is taken against them, not against what the
+/// pass's own keys made of them (a slow pass can hold a press, a PageDown and the release).
+pub fn pass_start(app: &EffectcraftApp, ctx: &egui::Context) {
+    ctx.data_mut(|d| d.insert_temp(pick_start_id(), (app.session.revision, app.session.time().seconds())));
+}
+
+/// Every frame: a disarmed eyedropper lets go of its state and the session's probe.
+pub fn upkeep(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    let sid = pick_id();
+    // Another project (New, Open, Revert) ends a pick: it is kept by layer id and property uid,
+    // which the next project reuses.
+    let eid = egui::Id::unique("viewer-fx-pick-project");
+    let epoch = app.session.script_ui.project_epoch;
+    let seen = ctx.data(|d| d.get_temp::<u64>(eid));
+    if seen != Some(epoch) {
+        if seen.is_some() && app.ui.fx_pick.is_some() {
+            app.ui.fx_pick = None;
+            app.ui.status.clear();
+        }
+        ctx.data_mut(|d| d.insert_temp(eid, epoch));
+    }
+    if app.ui.fx_pick.as_ref().is_none_or(|p| p.kind != KIND) && ctx.data(|d| d.get_temp::<State>(sid)).is_some() {
+        ctx.data_mut(|d| d.remove::<State>(sid));
+        app.session.drop_crypto_probe();
+    }
+    // The clicks waiting in the viewer, after everything else this pass did (its keys, edits and
+    // frame steps included).
+    if let Some(mut st) = ctx.data(|d| d.get_temp::<State>(sid)).filter(|s| s.seen.is_some_and(|(_, n)| n == ctx.cumulative_pass_nr())) {
+        make_waiting(app, ctx, &mut st);
+        ctx.data_mut(|d| d.insert_temp(sid, st));
+    }
+}
+
+/// Drop every waiting click, and say so.
+fn drop_waiting(app: &mut EffectcraftApp, ctx: &egui::Context, st: &mut State) {
+    (st.pending, st.after_typing) = (vec![], false);
+    app.say(ctx, tr(if app.playback.playing { PLAYING } else { NOT_MADE }).to_string());
+}
+
+/// Make one click. Our own pick is not "the project changed" for a click still held.
+fn make(app: &mut EffectcraftApp, ctx: &egui::Context, st: &mut State, q: Value) -> Result<Value, String> {
+    let before = app.session.revision;
+    let r = crate::menus::invoke(app, ctx, "effect.pickCryptomatte", q);
+    if let Some(p) = st.press.as_mut()
+        && p.rev == before
+    {
+        p.rev = app.session.revision;
+    }
+    r
+}
+
+/// Make the waiting clicks whose probe is built, in order. Each is checked against the frame and
+/// the project right before it is made, with nothing in between: if either changed since its
+/// press, it and the clicks waiting with it are not made.
+fn make_waiting(app: &mut EffectcraftApp, ctx: &egui::Context, st: &mut State) {
+    // A click that took the focus from a text field waits for the field to commit (it may do so
+    // later in this pass or in the next), then is made on what it committed.
+    let typing = st.after_typing && ctx.text_edit_focused();
+    if st.after_typing && !typing {
+        (st.after_typing, st.pending_rev) = (false, app.session.revision);
+    }
+    while let Some(q) = st.pending.first().cloned().filter(|_| !typing) {
+        let comp = app.session.active_comp_id().map(|c| c.0);
+        if st.pending_rev != app.session.revision || q["comp"].as_u64() != comp || q["time"].as_f64() != Some(app.session.time().seconds()) {
+            return drop_waiting(app, ctx, st);
+        }
+        match ready(app, ctx, &q, st.start) {
+            Ok(true) => match make(app, ctx, st, q) {
+                Ok(r) if r["pending"] == true => break,
+                r => {
+                    st.pending.remove(0);
+                    (st.asked, st.pending_rev) = (None, app.session.revision);
+                    let msg = match r {
+                        Ok(r) => tr_args("Cryptomatte Selection: {}", &[&r["selection"].as_str().unwrap_or_default()]),
+                        Err(e) => shown_error(&e),
+                    };
+                    app.say(ctx, msg);
+                }
+            },
+            Ok(false) => break,
+            Err(e) => {
+                (st.pending, st.after_typing) = (vec![], false);
+                app.say(ctx, e);
+            }
+        }
+    }
+}
+
+/// Middle-button pan and forwarded right-click for the armed eyedropper overlay.
+fn viewer_pan_and_secondary(app: &mut EffectcraftApp, ctx: &egui::Context, resp: &egui::Response) {
+    // The middle button pans the viewer, as the Hand tool (and as without the eyedropper).
+    if resp.dragged_by(egui::PointerButton::Middle) {
+        let pid = egui::Id::unique("viewer-fx-pick-pan");
+        if resp.drag_started() {
+            let start = app.ui.viewer.pan;
+            ctx.data_mut(|d| d.insert_temp(pid, start));
+        }
+        if let (Some(start), Some(d)) = (ctx.data(|m| m.get_temp::<[f32; 2]>(pid)), resp.total_drag_delta()) {
+            app.ui.viewer.pan = [start[0] + d.x, start[1] + d.y];
+        }
+    }
+    // The right button opens the viewer's context menu (next pass).
+    if resp.secondary_clicked()
+        && let Some(p) = resp.interact_pointer_pos()
+    {
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique(super::viewer::FORWARDED_SECONDARY), p));
+    }
+}
+
+/// Whether Space / Hand / Zoom (`tools`) or middle/right buttons (`nav`) own the pointer.
+struct PointerNav {
+    tools: bool,
+    nav: bool,
+}
+
+/// Queues Cryptomatte picks from primary presses and releases on the armed eyedropper overlay.
+///
+/// A press is taken against the pass-start revision and frame, then queued for [`make_waiting`]
+/// (or dropped if the drag, playback, frame or project make it invalid). `nav` suppresses a new
+/// press when another pointer button or tool owns the click.
+fn viewer_click_to_pick(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    map: &super::viewer::ViewerMap,
+    ectx: &EvalCtx,
+    st: &mut State,
+    pointer: PointerNav,
+    at: &dyn Fn(egui::Pos2) -> Option<Value>,
+) {
+    let ctx = ui.ctx().clone();
+    // The click is what the press saw: its frame, resolution, point and project. The pass's
+    // primary presses and releases are taken in order: a slow pass can hold a whole click, or one
+    // click's release and the next one's press (egui then reports no press on the overlay).
+    // `None`: the window lost the focus, so a held press may never see its release.
+    let events: Vec<Option<(egui::Pos2, bool, egui::Modifiers)>> = ui.input(|i| {
+        i.events
+            .iter()
+            .filter_map(|e| match e {
+                egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers } => Some(Some((*pos, *pressed, *modifiers))),
+                egui::Event::WindowFocused(false) => Some(None),
+                _ => None,
+            })
+            .collect()
+    });
+    // Space (or the Hand or Zoom tool) while the button is held cancels the press (a pan needs a
+    // new press).
+    if pointer.tools {
+        st.press = None;
+    }
+    let (rev0, t0) = ctx.data(|d| d.get_temp::<(u64, f64)>(pick_start_id())).unwrap_or((app.session.revision, ectx.time.seconds()));
+    for e in events {
+        let Some((pos, pressed, keys)) = e else {
+            st.press = None;
+            continue;
+        };
+        if pressed {
+            let ours = map.area.contains(pos) && ctx.layer_id_at(pos) == Some(ui.layer_id());
+            st.press = (!pointer.nav && ours).then(|| Press {
+                pos,
+                keys,
+                menu: crate::widgets::any_menu_open(&ctx),
+                typing: ctx.text_edit_focused(),
+                // The frame on screen at the press: a frame step earlier in this pass drops it.
+                q: at(pos).map(|mut q| {
+                    if t0 != ectx.time.seconds() {
+                        q["time"] = json!(t0);
+                    }
+                    q
+                }),
+                rev: rev0,
+            });
+            continue;
+        }
+        // The release ends the press, whatever egui made of it.
+        let Some(Press { pos: from, keys: k, menu: false, typing, q: Some(mut q), rev }) = st.press.take() else { continue };
+        // Ctrl too on a Mac, where `command` is Cmd.
+        q["mode"] = json!(if k.alt || k.command || k.ctrl {
+            "remove"
+        } else if k.shift {
+            "add"
+        } else {
+            "replace"
+        });
+        let same_frame = q["time"].as_f64() == Some(ectx.time.seconds());
+        if pos.distance(from) > SLOP {
+            app.say(&ctx, tr("Drag cancelled the pick").to_string());
+        } else if app.playback.playing && !(same_frame && app.session.crypto_probe_ready(&q).unwrap_or(false)) {
+            // Playing, a frame without its IDs read is gone before they could be: not queued.
+            app.say(&ctx, tr(PLAYING).to_string());
+        } else if !same_frame || !typing && rev != app.session.revision {
+            // A frame step or an edit came between the press and the release.
+            drop_waiting(app, &ctx, st);
+        } else {
+            if st.pending.is_empty() {
+                st.pending_rev = rev;
+            }
+            st.after_typing |= typing || ctx.text_edit_focused();
+            st.pending.push(q);
+        }
+    }
+}
+
+/// Drop stale hover/click state when the pick or pass gap means it no longer applies.
+fn reset_stale_state(app: &mut EffectcraftApp, ctx: &egui::Context, st: &mut State, pick: &FxPick) {
+    let pass = ctx.cumulative_pass_nr();
+    // Disarmed (or the viewer hidden) since, or another pick: start afresh, so an old click
+    // waiting for its probe is never made. (A probe still being built keeps the app's flag.)
+    if st.seen.is_none_or(|(k, n)| k != (pick.layer, pick.prop) || n + 1 < pass) {
+        if !st.pending.is_empty() {
+            app.say(ctx, tr(NOT_MADE).to_string());
+        }
+        *st = State::default();
+    }
+    st.seen = Some(((pick.layer, pick.prop), pass));
+}
+
+/// Track the shown time for scrub settle; returns whether probe builds may start.
+fn track_scrub_settle(app: &EffectcraftApp, ctx: &egui::Context, st: &mut State, time_secs: f64) -> bool {
+    // No builds while playing, nor until a scrub has settled.
+    let now = ctx.input(|i| i.time);
+    if st.shown.is_none_or(|s| s.0 != time_secs) {
+        st.shown = Some((time_secs, if st.shown.is_some() { now } else { f64::MIN }));
+    }
+    let settled = st.shown.is_some_and(|s| now - s.1 >= SETTLE);
+    if !settled {
+        ctx.request_repaint_after(std::time::Duration::from_secs_f64(SETTLE));
+    }
+    let start = settled && !app.playback.playing;
+    st.start = start;
+    start
+}
+
+/// Read the Cryptomatte ID under the cursor; returns whether a probe is still being read.
+fn hover_read(
+    app: &mut EffectcraftApp,
+    ctx: &egui::Context,
+    map: &super::viewer::ViewerMap,
+    st: &mut State,
+    resp: &egui::Response,
+    start: bool,
+    at: &dyn Fn(egui::Pos2) -> Option<Value>,
+) -> bool {
+    let mut reading = false;
+    match resp.hover_pos() {
+        Some(hp) => {
+            ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
+            let c = map.to_comp(hp);
+            app.pointer_comp = Some([c[0] as f32, c[1] as f32]);
+            let q = at(hp);
+            let asked = q.clone().map(|q| (q, app.session.revision));
+            if asked != st.asked {
+                st.reply = None;
+                // While clicks wait, they own the build: the hover only reads.
+                match q.as_ref().map(|q| ready(app, ctx, q, start && st.pending.is_empty())) {
+                    Some(Ok(true)) => {
+                        let r = q.map(|q| app.session.execute("effect.cryptomatteAt", q).map_err(|e| shown_error(&e.to_string())));
+                        if r.as_ref().is_some_and(|r| r.as_ref().is_ok_and(|v| v["pending"] == true)) {
+                            reading = true;
+                        } else {
+                            st.reply = r.filter(|r| !matches!(r, Ok(Value::Null)));
+                            st.asked = asked;
+                        }
+                    }
+                    Some(Ok(false)) => reading = true,
+                    Some(Err(e)) => (st.reply, st.asked) = (Some(Err(e)), asked),
+                    None => st.asked = None,
+                }
+            }
+        }
+        None => (st.asked, st.reply) = (None, None),
+    }
+    reading
+}
+
+/// Rebuilds the texture when the hovered ID, or the layer, effect, scale, frame or project
+/// revision it was read at, changes; then draws it.
+fn draw_coverage_highlight(app: &mut EffectcraftApp, ctx: &egui::Context, painter: &egui::Painter, map: &super::viewer::ViewerMap, m: &Mat3, st: &mut State) {
+    let hovered = st.reply.as_ref().and_then(|r| u32::from_str_radix(r.as_ref().ok()?["hash"].as_str()?, 16).ok());
+    let hovered = hovered.zip(st.asked.as_ref()).map(|(h, (q, rev))| (h, json!([q["layer"], q["effect"], q["scale"], q["time"], rev])));
+    if let (Some(h), Some(q)) = (&hovered, st.asked.as_ref().map(|a| &a.0))
+        && st.mask.as_ref().is_none_or(|mask| mask.key != *h)
+    {
+        st.mask = app.session.crypto_coverage(q, h.0, 1024).map(|c| {
+            let a = app.tokens.accent;
+            let px = c.coverage.iter().map(|v| Color32::from_rgba_unmultiplied(a.r(), a.g(), a.b(), (v * 140.0) as u8)).collect();
+            let img = egui::ColorImage::new([c.width, c.height], px);
+            let size = [c.size[0], c.size[1]];
+            HighlightMask {
+                key: h.clone(),
+                texture: ctx.load_texture("crypto-pick-highlight", img, egui::TextureOptions::NEAREST),
+                size,
+                uv: [c.uv[0] as f32, c.uv[1] as f32],
+            }
+        });
+    }
+    if let (Some(h), Some(mask)) = (&hovered, &st.mask)
+        && h == &mask.key
+    {
+        let (tex, size, uv) = (&mask.texture, mask.size, mask.uv);
+        let corners = [[0.0, 0.0], [size[0], 0.0], size, [0.0, size[1]]].map(|p| map.to_screen(fw::layer_to_comp(m, p)));
+        let mut mesh = egui::Mesh::with_texture(tex.id());
+        for (pos, t) in corners.iter().zip([[0.0, 0.0], [uv[0], 0.0], uv, [0.0, uv[1]]]) {
+            mesh.vertices.push(egui::epaint::Vertex { pos: *pos, uv: egui::pos2(t[0], t[1]), color: Color32::WHITE });
+        }
+        mesh.indices = vec![0, 1, 2, 0, 2, 3];
+        painter.add(mesh);
+        // Its corners (screen points), for tests and agents.
+        let label = corners.iter().map(|p| format!("{:.2},{:.2}", p.x, p.y)).collect::<Vec<_>>().join(" ");
+        app.auto.add("viewer.cryptoPick.highlight", Rect::from_points(&corners), &label);
+    }
+}
+
+/// Draw the status chip (hovered name, reading, or usage hint).
+fn draw_status_chip(app: &mut EffectcraftApp, ctx: &egui::Context, painter: &egui::Painter, map: &super::viewer::ViewerMap, st: &State, reading: bool) {
+    let err = !reading && matches!(st.reply, Some(Err(_)));
+    let text = match &st.reply {
+        _ if reading && app.playback.playing => tr("Stop playback to pick").to_string(),
+        _ if reading => tr("Reading Cryptomatte IDs…").to_string(),
+        Some(Ok(r)) => {
+            let name = r["name"].as_str().map_or_else(|| format!("<{}>", r["hash"].as_str().unwrap_or_default()), str::to_string);
+            if r["selected"] == true { tr_args("{} (selected)", &[&name]) } else { name }
+        }
+        Some(Err(e)) => e.clone(),
+        None => tr_args("Click: replace · Shift: add · {}: remove", &[&remove_keys(ctx.os())]),
+    };
+    // One line, at most the viewer's width (long names end in an ellipsis); an error in red, on
+    // as many lines as it needs (at least three, more in a narrow viewer), so its hint shows.
+    let max = (map.area.width() - 44.0).clamp(40.0, 480.0);
+    let rows = ((map.area.height() - 28.0) / 14.0).max(3.0) as usize;
+    let colour = if err { app.tokens.danger } else { app.tokens.text };
+    let mut job = egui::text::LayoutJob::simple_singleline(text.clone(), Tokens::ui(11.5), colour);
+    job.wrap = egui::text::TextWrapping { max_width: max, max_rows: if err { rows } else { 1 }, break_anywhere: !err, overflow_character: Some('…') };
+    let galley = painter.layout_job(job);
+    let chip = Rect::from_min_size(map.area.min + vec2(10.0, 10.0), vec2(galley.size().x + 24.0, (galley.size().y + 8.0).max(22.0)));
+    app.auto.add("viewer.cryptoPick", chip, &text);
+    if err {
+        app.auto.add("viewer.cryptoPick.error", chip, if galley.elided { "cut" } else { "whole" });
+        painter.rect(chip, 6.0, Color32::from_rgba_unmultiplied(48, 10, 8, 220), egui::Stroke::new(1.0, colour), egui::StrokeKind::Inside);
+    } else {
+        painter.rect_filled(chip, 11.0, Color32::from_black_alpha(180));
+    }
+    painter.galley(chip.left_center() + vec2(12.0, -galley.size().y / 2.0), galley, colour);
+}
+
+/// Esc disarms the eyedropper only when no text field, popup, or dialog had the keyboard this
+/// pass or the pass before (egui lets go of the focus and closes popups, and Esc closes the
+/// dialog, before the viewer runs).
+fn handle_escape(app: &mut EffectcraftApp, ui: &mut egui::Ui, st: &mut State) {
+    let ctx = ui.ctx();
+    // (Esc in a text field, the Selection being typed, only ends the typing; in a menu or dialog, it.)
+    let esc_taken = std::mem::replace(&mut st.esc_taken, ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || app.dialog.is_some());
+    if ui.input(|i| i.key_pressed(egui::Key::Escape)) && !esc_taken && !st.esc_taken {
+        app.ui.fx_pick = None;
+        app.ui.status.clear();
+        st.pending.clear();
+    }
+}
+
+/// The armed eyedropper's part of the viewer. `m` maps the layer's effect space to the comp.
+#[allow(clippy::too_many_arguments)]
+pub fn viewer_hook(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    painter: &egui::Painter,
+    map: &super::viewer::ViewerMap,
+    ectx: &EvalCtx,
+    layer: &Layer,
+    m: &Mat3,
+    pick: &FxPick,
+) {
+    let ctx = ui.ctx().clone();
+    let sid = pick_id();
+    let mut st: State = ctx.data(|d| d.get_temp(sid)).unwrap_or_default();
+    reset_stale_state(app, &ctx, &mut st, pick);
+    // The Cryptomatte effect that owns the Selection (gone: the pick ends).
+    let Some(fx) = layer.effects().and_then(|f| f.groups().find(|g| g.find(pick.prop).is_some())).map(|g| g.uid) else {
+        app.ui.fx_pick = None;
+        return;
+    };
+    let start = track_scrub_settle(app, &ctx, &mut st, ectx.time.seconds());
+    // The resolution of the frame on screen: the pick reads the pixel it shows.
+    let scale = app
+        .viewer_shown
+        .as_ref()
+        .filter(|(_, k)| k.comp == ectx.comp_id.0)
+        .map_or(1.0, |(_, k)| crate::frames::render_scale(k.scale, ectx.comp.resolution.factor()));
+    // The centre of the shown frame's pixel under the cursor: the layer may be resampled into
+    // the frame (a proxy, a scaled layer), and that pixel is what the user sees.
+    let region = super::viewer_tools::shown_region(&ctx, map.comp);
+    let at = |pos: egui::Pos2| {
+        let c = map.to_comp(pos);
+        let snap = |v: f64, o: f64| o + (((v - o) * scale).floor() + 0.5) / scale;
+        let p = fw::comp_to_layer(m, [snap(c[0], region[0]), snap(c[1], region[1])])?;
+        let (x, y, time) = (p[0], p[1], ectx.time.seconds());
+        Some(
+            json!({"comp": ectx.comp_id.0, "layer": layer.id.0, "effect": fx, "x": x, "y": y, "scale": scale.clamp(1e-3, 1.0), "time": time, "probeOnly": true}),
+        )
+    };
+    // The Hand and Zoom tools (Space held too) and other buttons keep their own clicks and drags.
+    let tools = super::space_hand(&ctx) || matches!(app.ui.tool, Tool::Hand | Tool::Zoom);
+    let nav = tools || ctx.input(|i| i.pointer.middle_down() || i.pointer.secondary_down());
+    // Drags too: a click that drifts must not move the layer under it. (egui hands a press to
+    // what sensed it the pass before, so middle and right presses land here: passed on below.)
+    let resp = ui.interact(map.area, egui::Id::unique("viewer-fx-pick"), if tools { Sense::hover() } else { Sense::click_and_drag() });
+    viewer_pan_and_secondary(app, &ctx, &resp);
+    app.auto.add("viewer.fxPick", map.area, &pick.name);
+    let mut reading = hover_read(app, &ctx, map, &mut st, &resp, start, &at);
+    viewer_click_to_pick(app, ui, map, ectx, &mut st, PointerNav { tools, nav }, &at);
+    // Clicks waiting for their probe ([`make_waiting`], at the end of the pass).
+    reading |= !st.pending.is_empty();
+    draw_coverage_highlight(app, &ctx, painter, map, m, &mut st);
+    draw_status_chip(app, &ctx, painter, map, &st, reading);
+    handle_escape(app, ui, &mut st);
+    ctx.data_mut(|d| d.insert_temp(sid, st));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn errors_show_without_the_command_prefix() {
+        let e = "invalid parameters for `effect.cryptomatteAt`: this layer has no pixels";
+        assert_eq!(shown_error(e), "This layer has no pixels");
+        assert_eq!(shown_error("Reading the Cryptomatte IDs failed: x"), "Reading the Cryptomatte IDs failed: x");
+    }
+
+    /// A build that panics still clears the busy flag, so the next hover can build again.
+    #[test]
+    fn a_panicking_build_clears_busy() {
+        let busy = Arc::new(AtomicBool::new(true));
+        let done = Done(busy.clone(), egui::Context::default());
+        let r = std::thread::spawn(move || run(Box::new(|| panic!("a broken build")), done)).join();
+        assert!(r.is_err() && !busy.load(Ordering::Acquire));
+    }
+}
diff --git a/crates/ui-egui/src/panels/dialogs.rs b/crates/ui-egui/src/panels/dialogs.rs
index d773fc433..458ce60a9 100644
--- a/crates/ui-egui/src/panels/dialogs.rs
+++ b/crates/ui-egui/src/panels/dialogs.rs
@@ -37,6 +37,12 @@ pub struct DialogState {
     pub palette_sel: usize,
     /// Settings dialog page id (`general`, `appearance`…).
     pub settings_page: String,
+    /// Settings ▸ Plug-in Library: the search field.
+    pub library_query: String,
+    /// Settings ▸ Plug-in Library: the package whose preview is open.
+    pub library_preview: Option<String>,
+    /// The preview's Before/After split (0 = all After, 1 = all Before).
+    pub library_split: f32,
     /// Settings when the dialog opened (Cancel restores them).
     pub prefs_snapshot: Option<effectcraft_engine::prefs::Prefs>,
     /// Keyboard Shortcuts editor.
@@ -47,6 +53,7 @@ pub struct DialogState {
     pub info: (String, String),
     pub camera: super::dialogs_3d::CameraDraft,
     pub light: super::dialogs_3d::LightDraft,
+    pub primitive: super::primitive_dialog::PrimitiveDraft,
     pub velocity: super::key_dialogs::VelocityDraft,
     pub interp: super::key_dialogs::InterpDraft,
     pub stretch: super::key_dialogs::StretchDraft,
@@ -63,8 +70,13 @@ pub struct DialogState {
     pub unsaved: super::unsaved::Pending,
     /// Deleting Project items in use: the deletion waiting on the prompt.
     pub delete_items: super::delete_items::Pending,
+    pub aep_losses: super::aep_losses::Pending,
+    /// Un-precompose with reasons: the unpack waiting on the prompt.
+    pub unprecompose: super::unprecompose::Pending,
     /// The Gradient Editor's draft and the property it edits.
     pub gradient: super::gradient_editor::Draft,
+    /// Preview of the settings dialog being edited (Solid, Camera, Light, Composition Settings).
+    pub live: super::live_preview::LivePreview,
     /// The user template the Delete Template prompt asks about: its id and name.
     pub delete_template: Option<(String, String)>,
 }
@@ -75,6 +87,7 @@ pub fn open_new_comp(app: &mut EffectcraftApp) {
     app.dialog_state.comp =
         CompDraft { name: format!("Comp {n}"), tab: super::comp_settings::Tab::Basic, start_tc: None, dur_tc: None, preset_name: None, ..last };
     app.dialog_state.editing_existing = false;
+    app.dialog_state.live = Default::default();
     app.dialog = Some(Dialog::NewComp);
 }
 
@@ -102,11 +115,13 @@ pub fn open_comp_settings_for(app: &mut EffectcraftApp, cid: ItemId) -> Result<(
         preserve_frame_rate: c.preserve_frame_rate,
         preserve_resolution: c.preserve_resolution,
         advanced_3d: c.renderer == effectcraft_engine::project::Renderer::Advanced3D,
+        resolution: c.resolution,
         ..Default::default()
     };
     app.dialog_state.editing_existing = true;
     app.dialog_state.editing_comp = Some(cid);
     app.dialog = Some(Dialog::CompSettings);
+    super::live_preview::begin(app, Dialog::CompSettings);
     Ok(())
 }
 
@@ -121,6 +136,7 @@ pub fn open_new_solid(app: &mut EffectcraftApp) -> Result<(), String> {
     if d.solid_color == [0.0; 3] {
         d.solid_color = [0.2, 0.45, 0.85];
     }
+    d.live = Default::default();
     app.dialog = Some(Dialog::SolidSettings);
     Ok(())
 }
@@ -136,6 +152,7 @@ fn open_solid_settings(app: &mut EffectcraftApp, layer: u64, item: ItemId) -> Re
     (d.solid_name, d.solid_color, d.solid_size, d.solid_pixel_aspect) = (name, so.color, [so.width, so.height], so.pixel_aspect);
     (d.solid_layer, d.solid_shared, d.solid_affect_all) = (Some(layer), users > 1, false);
     app.dialog = Some(Dialog::SolidSettings);
+    super::live_preview::begin(app, Dialog::SolidSettings);
     Ok(())
 }
 
@@ -168,6 +185,18 @@ pub(crate) fn modal_space(ctx: &egui::Context) -> egui::Vec2 {
     (ctx.content_rect().size() - vec2(48.0, 48.0)).max(vec2(120.0, 80.0))
 }
 
+fn modal_pass_id() -> egui::Id {
+    egui::Id::unique("effectcraft-modal-pass")
+}
+
+/// Whether a modal dialog showed in this pass or the one before: egui's `Modal` blocks input
+/// only in its own window, so floating panels in OS windows of their own are blocked by the
+/// dock area while this holds. Dialogs draw after the dock, so the previous pass counts.
+pub(crate) fn modal_open(ctx: &egui::Context) -> bool {
+    let shown = ctx.data(|d| d.get_temp::<u64>(modal_pass_id()));
+    shown.is_some_and(|pass| pass.saturating_add(1) >= ctx.cumulative_pass_nr_for(egui::ViewportId::ROOT))
+}
+
 pub(crate) fn modal(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &Tokens, body: impl FnOnce(&mut egui::Ui)) {
     modal_with_scroll(ctx, title, size, t, false, body);
 }
@@ -176,6 +205,31 @@ pub(crate) fn modal_vertical(ctx: &egui::Context, title: &str, size: egui::Vec2,
     modal_with_scroll(ctx, title, size, t, true, body);
 }
 
+/// Where a modal dialog opens and whether it dims the window behind it. The default is the middle
+/// of the window over a dimmed backdrop.
+#[derive(Clone, Copy, Debug)]
+pub struct Placement {
+    /// The opening position as a fraction of the room the dialog can move in, from the middle
+    /// `(0, 0)` to the bottom right `(1, 1)`.
+    pub start: egui::Vec2,
+    /// Dim the window behind the dialog.
+    pub dim: bool,
+}
+
+impl Default for Placement {
+    fn default() -> Self {
+        Placement { start: vec2(0.0, 0.0), dim: true }
+    }
+}
+
+/// [`modal`] at `place`: a dialog that edits what is behind it keeps the canvas in view.
+pub(crate) fn modal_placed(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &Tokens, place: Placement, body: impl FnOnce(&mut egui::Ui)) {
+    let max_height = (modal_space(ctx).y - 84.0).max(40.0);
+    modal_fit_placed(ctx, title, size, t, place, |ui, _| {
+        egui::ScrollArea::both().max_height(max_height).auto_shrink([false, true]).show(ui, body);
+    });
+}
+
 fn modal_with_scroll(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &Tokens, vertical_only: bool, body: impl FnOnce(&mut egui::Ui)) {
     let max_height = (modal_space(ctx).y - 84.0).max(40.0);
     modal_fit(ctx, title, size, t, |ui, _| {
@@ -188,16 +242,23 @@ fn modal_with_scroll(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &Tok
 /// only its content: `body` gets the height left under the title, with `size` kept within the
 /// window.
 pub(crate) fn modal_fit(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &Tokens, body: impl FnOnce(&mut egui::Ui, f32)) {
+    modal_fit_placed(ctx, title, size, t, Placement::default(), body);
+}
+
+/// [`modal_fit`] at `place`.
+pub(crate) fn modal_fit_placed(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &Tokens, place: Placement, body: impl FnOnce(&mut egui::Ui, f32)) {
+    let pass = ctx.cumulative_pass_nr_for(egui::ViewportId::ROOT);
+    ctx.data_mut(|d| d.insert_temp(modal_pass_id(), pass));
     let size = size.min(modal_space(ctx));
-    let id = egui::Id::new(("modal", title));
+    let id = egui::Id::unique(("modal", title));
     // Dragging the title row moves the dialog off what it edits. The offset is kept within the
     // window, so dragging back never has to undo a part the dialog could not follow.
     let offset_id = id.with("offset");
     let room = ((ctx.content_rect().size() - size) * 0.5).max(vec2(0.0, 0.0));
-    let offset = ctx.data(|d| d.get_temp::<egui::Vec2>(offset_id)).unwrap_or_default().clamp(-room, room);
+    let offset = ctx.data(|d| d.get_temp::<egui::Vec2>(offset_id)).unwrap_or(room * place.start).clamp(-room, room);
     egui::Modal::new(id)
         .area(egui::Modal::default_area(id).anchor(Align2::CENTER_CENTER, offset))
-        .backdrop_color(Color32::from_black_alpha(120))
+        .backdrop_color(Color32::from_black_alpha(if place.dim { 120 } else { 0 }))
         .frame(egui::Frame::window(&ctx.style_of(ctx.theme())).fill(t.panel_bg).inner_margin(egui::Margin::same(18)))
         .show(ctx, |ui| {
             ui.set_width(size.x - 36.0);
@@ -205,7 +266,7 @@ pub(crate) fn modal_fit(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &
             // The id stays keyed on the untranslated source, so switching language cannot move it.
             let head = ui.label(egui::RichText::new(tr(title)).font(Tokens::semibold(15.0)).color(t.tab_text_active));
             let row = Rect::from_x_y_ranges(ui.max_rect().x_range(), head.rect.y_range());
-            let grip = ui.interact(row, id.with("grip"), Sense::drag()).on_hover_cursor(egui::CursorIcon::Grab);
+            let grip = ui.interact(row, id.with("grip"), Sense::DRAG).on_hover_cursor(egui::CursorIcon::Grab);
             if grip.dragged() {
                 let moved = (offset + grip.drag_delta()).clamp(-room, room);
                 ui.ctx().data_mut(|d| d.insert_temp(offset_id, moved));
@@ -213,6 +274,8 @@ pub(crate) fn modal_fit(ctx: &egui::Context, title: &str, size: egui::Vec2, t: &
             ui.add_space(10.0);
             let title_h = ui.cursor().top() - ui.min_rect().top();
             body(ui, (size.y - 36.0 - title_h).max(40.0));
+            // A colour picker's eyedropper samples the viewer under the dialog, but not the dialog itself.
+            crate::color_picker::note_overlay(ui.ctx(), ui.min_rect().expand(18.0));
         });
 }
 
@@ -248,6 +311,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context) {
         Dialog::ViewOptions => super::forms::show_view_options(app, ctx, &t),
         Dialog::CameraSettings => super::dialogs_3d::camera(app, ctx, &t),
         Dialog::LightSettings => super::dialogs_3d::light(app, ctx, &t),
+        Dialog::NewPrimitive => super::primitive_dialog::dialog(app, ctx, &t),
         Dialog::KeyVelocity => super::key_dialogs::velocity(app, ctx, &t),
         Dialog::KeyInterpolation => super::key_dialogs::interpolation(app, ctx, &t),
         Dialog::TimeStretch => super::key_dialogs::time_stretch(app, ctx, &t),
@@ -260,6 +324,8 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context) {
         Dialog::RenderTemplates => super::rq_templates::show(app, ctx, &t),
         Dialog::UnsavedChanges => super::unsaved::show(app, ctx, &t),
         Dialog::DeleteItems => super::delete_items::show(app, ctx, &t),
+        Dialog::AepLosses => super::aep_losses::show(app, ctx, &t),
+        Dialog::Unprecompose => super::unprecompose::show(app, ctx, &t),
         Dialog::GradientEditor => super::gradient_editor::show(app, ctx, &t),
         Dialog::DeleteTemplate => super::templates::show_delete(app, ctx, &t),
     }
@@ -270,11 +336,16 @@ const ABOUT_TABS: [(&str, &str); 3] = [("About", "about"), ("Contributors", "con
 /// Height of the Contributors / Models tab bodies (they scroll inside it).
 const CREDITS_HEIGHT: f32 = 380.0;
 
+/// The About dialog: tabs for the name/version/blurb, the contributors and the models (the last
+/// two scroll in a fixed-height body), the licence and bundled-font line, and Close. The tab is
+/// kept in egui temp data. A command the About body asked for is run once the modal has been
+/// built; Close clears `app.dialog`.
 fn about(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     let mut close = false;
     let mut cmd: Option<&str> = None;
-    let tab_id = egui::Id::new("about_tab");
-    modal(ctx, "About EffectCraft", vec2(680.0, 520.0), t, |ui| {
+    let tab_id = egui::Id::unique("about_tab");
+    // Wide enough for every Contributors column at its natural width (modals shrink to the window).
+    modal(ctx, "About EffectCraft", vec2(820.0, 520.0), t, |ui| {
         let mut tab = ui.data_mut(|d| d.get_temp::<usize>(tab_id)).unwrap_or(0);
         ui.horizontal(|ui| {
             for (i, (label, id)) in ABOUT_TABS.iter().enumerate() {
@@ -382,9 +453,15 @@ fn comp_settings(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens, exis
     let mut result = None;
     let custom = app.session.prefs.comp_presets.clone();
     let mut cmds = Vec::new();
-    modal(ctx, "Composition Settings", vec2(600.0, 470.0), t, |ui| {
-        result = super::comp_settings::show(ui, &mut d, t, &mut app.auto, &custom, &mut cmds);
+    // The title keys the modal id and its drag offset; `modal_fit` translates the heading itself,
+    // so passing the source keeps the dialog in place when the interface language changes.
+    let live = existing && super::live_preview::active(app);
+    let place = super::live_preview::place(app);
+    let mut preview = app.dialog_state.live.on;
+    modal_placed(ctx, "Composition Settings", vec2(super::comp_settings::dialog_width(ctx), 470.0), t, place, |ui| {
+        result = super::comp_settings::show(ui, &mut d, t, &mut app.auto, &custom, &mut cmds, live.then_some(&mut preview));
     });
+    app.dialog_state.live.on = preview;
     if d.preset_name.is_some() {
         // Save Preset asks for the name in its own window over the dialog, as After Effects does.
         result = None;
@@ -402,21 +479,59 @@ fn comp_settings(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens, exis
     }
     app.dialog_state.comp = d;
     match result {
-        Some(serde_json::Value::Null) => app.dialog = None,
+        Some(serde_json::Value::Null) => {
+            super::live_preview::cancel(app);
+            app.dialog = None;
+        }
         Some(mut params) => {
             if existing && let (Some(cid), Some(m)) = (app.dialog_state.editing_comp, params.as_object_mut()) {
                 m.insert("comp".into(), json!(cid.0));
             }
+            // A preview already made the edit (one undo step): OK keeps it.
+            if existing && super::live_preview::keep(app, "comp.settings", params.clone()) {
+                // The Resolution is not part of the command, so the preview never applied it.
+                if let Some(cid) = app.dialog_state.editing_comp
+                    && let Err(e) = set_resolution(app, cid.0, app.dialog_state.comp.resolution)
+                {
+                    app.ui.status = e.to_string();
+                }
+                app.dialog = None;
+                return;
+            }
             let r = if existing { app.session.execute("comp.settings", params) } else { app.session.execute("comp.new", params) };
+            let cid = if existing { app.dialog_state.editing_comp.map(|c| c.0) } else { r.as_ref().ok().and_then(|v| v["comp"].as_u64()) };
+            let r = match cid {
+                Some(cid) if r.is_ok() => set_resolution(app, cid, app.dialog_state.comp.resolution).and(r),
+                _ => r,
+            };
             if !existing && r.is_ok() {
                 app.dialog_state.last_new_comp = Some(app.dialog_state.comp.clone());
+                // The new composition opens: it leaves the Home screen, as `run_engine` does.
+                app.ui.start_screen = false;
             }
             if let Err(e) = r {
                 app.ui.status = e.to_string();
             }
             app.dialog = None;
         }
-        None => {}
+        None => {
+            if existing && let Some(cid) = app.dialog_state.editing_comp {
+                let mut params = super::comp_settings::params(&app.dialog_state.comp);
+                if let Some(m) = params.as_object_mut() {
+                    m.insert("comp".into(), json!(cid.0));
+                }
+                super::live_preview::sync(app, "comp.settings", params);
+            }
+        }
+    }
+}
+
+/// The Resolution chosen in Composition Settings, set as the Composition panel's popup sets it:
+/// saved with the project but no undo step, so it stays out of `comp.new` / `comp.settings`.
+fn set_resolution(app: &mut EffectcraftApp, cid: u64, r: effectcraft_engine::project::Resolution) -> effectcraft_engine::Result<Value> {
+    match r.factor() {
+        None => app.session.execute("view.res.auto", json!({"comp": cid})),
+        Some(n) => app.session.execute("view.res.custom", json!({"comp": cid, "factor": n})),
     }
 }
 
@@ -462,10 +577,13 @@ fn solid(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         (ds.solid_name.clone(), ds.solid_color, ds.solid_size, ds.solid_pixel_aspect, ds.solid_affect_all);
     let (editing, shared) = (ds.solid_layer, ds.solid_shared);
     let comp_size = app.session.active_comp().map(|c| (c.width, c.height)).unwrap_or((1920, 1080));
-    let lock_id = egui::Id::new("solid-lock-aspect");
+    let lock_id = egui::Id::unique("solid-lock-aspect");
     let mut lock = ctx.data(|m| m.get_temp::<bool>(lock_id)).unwrap_or(true);
+    let live = super::live_preview::active(app);
+    let place = super::live_preview::place(app);
+    let mut preview = app.dialog_state.live.on;
     let auto = &mut app.auto;
-    modal(ctx, "Solid Settings", vec2(480.0, if editing.is_some() { 430.0 } else { 390.0 }), t, |ui| {
+    modal_placed(ctx, "Solid Settings", vec2(480.0, if editing.is_some() { 430.0 } else { 390.0 }), t, place, |ui| {
         ui.horizontal(|ui| {
             ui.label(tr("Name:"));
             let r = ui.add(egui::TextEdit::singleline(&mut name).desired_width(320.0));
@@ -480,7 +598,11 @@ fn solid(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             ui.horizontal(|ui| {
                 let r = ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut size[0]).range(1..=30000).suffix(" px")));
                 auto.add("dialog.solid.width", r.rect, "Width");
-                let r = ui.checkbox(&mut lock, tr_args("Lock Aspect Ratio to {}", &[&(super::comp_settings::aspect_label(ow as f64, oh as f64))]));
+                let r = crate::widgets::labelled_checkbox(
+                    ui,
+                    &mut lock,
+                    tr_args("Lock Aspect Ratio to {}", &[&(super::comp_settings::aspect_label(ow as f64, oh as f64))]),
+                );
                 auto.add("dialog.solid.lockAspect", r.rect, "Lock Aspect Ratio");
             });
             ui.end_row();
@@ -501,7 +623,7 @@ fn solid(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                 .find(|(_, v)| (v - par).abs() < 1e-3)
                 .map(|p| p.0.to_string())
                 .unwrap_or_else(|| format!("{par:.2}"));
-            let r = egui::ComboBox::from_id_salt("solid-par").width(240.0).selected_text(cur).show_ui(ui, |ui| {
+            let r = craft_ui::ComboBox::from_id_salt("solid-par").width(240.0).selected_text(cur).show_ui(ui, |ui| {
                 for (label, v) in super::comp_settings::PIXEL_ASPECTS {
                     if ui.selectable_label((v - par).abs() < 1e-3, *label).clicked() {
                         par = *v;
@@ -536,7 +658,7 @@ fn solid(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         if editing.is_some() {
             ui.add_space(8.0);
             let r = ui
-                .add_enabled(shared, egui::Checkbox::new(&mut affect_all, tr("Affect all layers that use this solid")))
+                .add_enabled(shared, crate::widgets::DragCheckbox::new(&mut affect_all, tr("Affect all layers that use this solid")))
                 .on_disabled_hover_text(tr("Only this layer uses this solid."));
             auto.add("dialog.solid.affectAll", r.rect, "Affect all layers that use this solid");
             if shared && !affect_all {
@@ -551,16 +673,28 @@ fn solid(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             let r = ui.button(tr("Cancel"));
             auto.add("dialog.solid.cancel", r.rect, "Cancel");
             close = r.clicked();
+            if live {
+                super::live_preview::checkbox(ui, auto, &mut preview, "dialog.solid.preview");
+            }
         });
     });
     ctx.data_mut(|m| m.insert_temp(lock_id, lock));
     let ds = &mut app.dialog_state;
+    ds.live.on = preview;
     (ds.solid_name, ds.solid_color, ds.solid_size, ds.solid_pixel_aspect, ds.solid_affect_all) = (name, color, size, par, affect_all);
+    let (command, params) = (solid_command(ds), solid_params(ds));
     if ok || ui_enter(ctx) {
-        if let Err(e) = app.session.execute(solid_command(ds), solid_params(ds)) {
+        // A preview already made the edit (one undo step): OK keeps it.
+        if !super::live_preview::keep(app, command, params.clone())
+            && let Err(e) = app.session.execute(command, params)
+        {
             app.ui.status = e.to_string();
         }
         close = true;
+    } else if close {
+        super::live_preview::cancel(app);
+    } else {
+        super::live_preview::sync(app, command, params);
     }
     if close {
         app.dialog = None;
@@ -613,6 +747,8 @@ fn palette(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         .collect();
     modal(ctx, "Command Palette", vec2(560.0, 470.0), t, |ui| {
         let r = ui.add(egui::TextEdit::singleline(&mut q).hint_text(tr("Type a command or effect…")).desired_width(f32::INFINITY).font(Tokens::ui(14.0)));
+        // A placeholder disappears once typing starts; keep the field named for assistive input.
+        ctx.accesskit_node_builder(r.id, |node| node.set_label(tr("Type a command or effect…")));
         // Take the keyboard when the palette opens (and if anything else takes it away), but not
         // while the field already has it: egui's `request_focus` interrupts the IME composition,
         // and asking on every frame cancelled the pinyin being typed, so no Chinese could be
@@ -670,6 +806,29 @@ fn palette(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn modal_open_holds_from_a_shown_dialog_until_the_pass_after_it_closes() {
+        let (app, ctx) = app();
+        let t = app.tokens;
+        // Asked as the dock asks it: during the pass, before the dialogs draw.
+        let pass = |show: bool| {
+            let mut open = false;
+            let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+                open = modal_open(ui.ctx());
+                if show {
+                    modal(ui.ctx(), "Test", vec2(200.0, 100.0), &t, |_| {});
+                }
+            });
+            output.textures_delta.clear();
+            open
+        };
+        assert!(!pass(false));
+        assert!(!pass(true), "the first pass of a dialog finds none shown yet");
+        assert!(pass(true));
+        assert!(pass(false), "the pass after the last one shown still counts");
+        assert!(!pass(false));
+    }
+
     fn app() -> (EffectcraftApp, egui::Context) {
         let ctx = egui::Context::default();
         let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
@@ -731,7 +890,7 @@ mod tests {
         assert_eq!(app.dialog_state.palette_query, "nihao");
         // Something else taking the keyboard takes it away for a frame; the field claims it back
         // (a request is what gets the keys back, and there is no composition to interrupt then).
-        ctx.memory_mut(|m| m.request_focus(egui::Id::new("elsewhere")));
+        ctx.memory_mut(|m| m.request_focus(egui::Id::unique("elsewhere")));
         assert!(frame_with(&mut app, &ctx, vec![]).platform_output.ime.is_none(), "the field lost the keyboard");
         assert!(frame_with(&mut app, &ctx, vec![]).platform_output.ime.is_some(), "and takes it back");
     }
@@ -827,6 +986,59 @@ mod tests {
         assert_eq!(selected(&ctx), Some(0..app.dialog_state.solid_name.chars().count()));
     }
 
+    /// One frame of Composition Settings (or New Composition) with Enter pressed: OK.
+    fn press_ok(app: &mut EffectcraftApp, ctx: &egui::Context, existing: bool) {
+        let t = app.tokens;
+        let mut out = ctx.run_ui(Default::default(), |ui| {
+            app.auto.begin_frame();
+            ui.input_mut(|i| {
+                i.events.push(egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Default::default() })
+            });
+            comp_settings(app, ui.ctx(), &t, existing);
+        });
+        out.textures_delta.clear();
+        assert!(app.dialog.is_none(), "OK closed the dialog");
+    }
+
+    /// The Resolution menu sets the comp's Resolution on OK. As from the Composition panel's popup
+    /// it is no undo step: the settings are one step, and undoing them keeps the Resolution.
+    #[test]
+    fn composition_settings_resolution_applies_on_ok_outside_the_undo_history() {
+        use effectcraft_engine::project::Resolution;
+        let (mut app, ctx) = app();
+        let cid = app.session.active_comp_id().unwrap();
+        app.session.execute("view.res.third", json!({})).unwrap();
+        open_comp_settings(&mut app).unwrap();
+        assert_eq!(app.dialog_state.comp.resolution, Resolution::Third, "the dialog opens on the comp's Resolution");
+        frame(&mut app, &ctx);
+        assert!(app.auto.find("dialog.comp.resolution").is_some());
+        let steps = app.session.history.undo.len();
+        (app.dialog_state.comp.resolution, app.dialog_state.comp.width) = (Resolution::Half, 700);
+        app.dialog_state.comp.lock_aspect = false;
+        press_ok(&mut app, &ctx, true);
+        let c = app.session.project.comp(cid).unwrap();
+        assert_eq!((c.width, c.resolution), (700, Resolution::Half));
+        assert_eq!(app.session.history.undo.len(), steps + 1, "Composition Settings is one undo step");
+        app.session.execute("edit.undo", json!({})).unwrap();
+        let c = app.session.project.comp(cid).unwrap();
+        assert_eq!((c.width, c.resolution), (640, Resolution::Half), "undo keeps the Resolution");
+        // Only the Resolution changed: still set, and no extra step.
+        open_comp_settings(&mut app).unwrap();
+        app.dialog_state.comp.resolution = Resolution::Custom(6);
+        let steps = app.session.history.undo.len();
+        press_ok(&mut app, &ctx, true);
+        assert_eq!(app.session.project.comp(cid).unwrap().resolution, Resolution::Custom(6));
+        assert_eq!(app.session.history.undo.len(), steps, "no undo step");
+        // New Composition makes its comp at the menu's Resolution; the comp the viewer showed keeps its own.
+        open_new_comp(&mut app);
+        app.dialog_state.comp.resolution = Resolution::Quarter;
+        press_ok(&mut app, &ctx, false);
+        let new = app.session.active_comp_id().unwrap();
+        assert_ne!(new, cid);
+        assert_eq!(app.session.project.comp(new).unwrap().resolution, Resolution::Quarter);
+        assert_eq!(app.session.project.comp(cid).unwrap().resolution, Resolution::Custom(6));
+    }
+
     #[test]
     fn composition_settings_register_every_control_and_new_comp_remembers() {
         let (mut app, ctx) = app();
diff --git a/crates/ui-egui/src/panels/dialogs_3d.rs b/crates/ui-egui/src/panels/dialogs_3d.rs
index a1a67bc60..16137b599 100644
--- a/crates/ui-egui/src/panels/dialogs_3d.rs
+++ b/crates/ui-egui/src/panels/dialogs_3d.rs
@@ -29,7 +29,7 @@ pub struct CameraDraft {
 pub struct LightDraft {
     pub layer: Option<u64>,
     pub name: String,
-    pub kind: usize,
+    pub kind: LightKind,
     pub color: [f32; 3],
     pub intensity: f64,
     pub cone_angle: f64,
@@ -42,9 +42,21 @@ pub struct LightDraft {
     pub shadow_diffusion: f64,
 }
 
-const KINDS: [LightKind; 4] = [LightKind::Parallel, LightKind::Spot, LightKind::Point, LightKind::Ambient];
 const FALLOFFS: [&str; 3] = ["None", "Smooth", "Inverse Square Clamped"];
 
+/// Whether a light type has Falloff options (distance attenuation): image-based Environment
+/// lights and Ambient come from no one place, so they have none.
+fn falls_off(kind: LightKind) -> bool {
+    !matches!(kind, LightKind::Ambient | LightKind::Environment)
+}
+
+/// Whether a light type has Shadows options in the dialog. After Effects' Light Settings shows
+/// Cast Shadows (with Shadow Darkness and Diffusion) for every light but Ambient — an
+/// Environment light's shadow comes from its image, not a falloff.
+fn casts_shadows(kind: LightKind) -> bool {
+    kind != LightKind::Ambient
+}
+
 fn comp_w(app: &EffectcraftApp) -> f64 {
     app.session.active_comp().map(|c| c.width as f64).unwrap_or(1920.0)
 }
@@ -87,8 +99,14 @@ pub fn open_camera(app: &mut EffectcraftApp, layer: Option<u64>) -> Result<(), S
             }
         }
     };
+    let editing = d.layer.is_some();
     app.dialog_state.camera = d;
     app.dialog = Some(Dialog::CameraSettings);
+    if editing {
+        super::live_preview::begin(app, Dialog::CameraSettings);
+    } else {
+        app.dialog_state.live = Default::default();
+    }
     Ok(())
 }
 
@@ -105,7 +123,7 @@ pub fn open_light(app: &mut EffectcraftApp, layer: Option<u64>) -> Result<(), St
             LightDraft {
                 layer: Some(l.id.0),
                 name: l.name.clone(),
-                kind: KINDS.iter().position(|k| *k == kind).unwrap_or(1),
+                kind,
                 color: [c[0], c[1], c[2]],
                 intensity: f("intensity", 100.0),
                 cone_angle: f("coneAngle", 90.0),
@@ -123,7 +141,7 @@ pub fn open_light(app: &mut EffectcraftApp, layer: Option<u64>) -> Result<(), St
             LightDraft {
                 layer: None,
                 name: format!("Light {n}"),
-                kind: 1,
+                kind: LightKind::Spot,
                 color: [1.0, 1.0, 1.0],
                 intensity: 100.0,
                 cone_angle: 90.0,
@@ -137,13 +155,19 @@ pub fn open_light(app: &mut EffectcraftApp, layer: Option<u64>) -> Result<(), St
             }
         }
     };
+    let editing = d.layer.is_some();
     app.dialog_state.light = d;
     app.dialog = Some(Dialog::LightSettings);
+    if editing {
+        super::live_preview::begin(app, Dialog::LightSettings);
+    } else {
+        app.dialog_state.live = Default::default();
+    }
     Ok(())
 }
 
-fn buttons(ui: &mut egui::Ui, t: &Tokens, ok: &mut bool, close: &mut bool) -> (egui::Rect, egui::Rect) {
-    let mut r = (egui::Rect::NOTHING, egui::Rect::NOTHING);
+fn buttons(ui: &mut egui::Ui, t: &Tokens, ok: &mut bool, close: &mut bool, preview: Option<&mut bool>) -> (egui::Rect, egui::Rect, egui::Rect) {
+    let mut r = (egui::Rect::NOTHING, egui::Rect::NOTHING, egui::Rect::NOTHING);
     ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
         let b = ui.add(egui::Button::new(egui::RichText::new(tr("   OK   ")).color(Color32::WHITE)).fill(t.accent));
         r.0 = b.rect;
@@ -155,6 +179,9 @@ fn buttons(ui: &mut egui::Ui, t: &Tokens, ok: &mut bool, close: &mut bool) -> (e
         if c.clicked() {
             *close = true;
         }
+        if let Some(on) = preview {
+            r.2 = ui.checkbox(on, tr("Preview")).rect;
+        }
     });
     r
 }
@@ -163,11 +190,14 @@ pub fn camera(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     let w = comp_w(app);
     let mut d = app.dialog_state.camera.clone();
     let (mut ok, mut close) = (false, false);
-    let mut rects = (egui::Rect::NOTHING, egui::Rect::NOTHING);
-    super::dialogs::modal(ctx, "Camera Settings", vec2(520.0, 420.0), t, |ui| {
+    let mut rects = (egui::Rect::NOTHING, egui::Rect::NOTHING, egui::Rect::NOTHING);
+    let live = super::live_preview::active(app);
+    let place = super::live_preview::place(app);
+    let mut preview = app.dialog_state.live.on;
+    super::dialogs::modal_placed(ctx, "Camera Settings", vec2(520.0, 420.0), t, place, |ui| {
         egui::Grid::new("cam-grid").num_columns(2).spacing([14.0, 9.0]).show(ui, |ui| {
             ui.label(tr("Type"));
-            egui::ComboBox::from_id_salt("cam-type").selected_text(if d.two_node { "Two-Node Camera" } else { "One-Node Camera" }).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("cam-type").selected_text(if d.two_node { "Two-Node Camera" } else { "One-Node Camera" }).show_ui(ui, |ui| {
                 ui.selectable_value(&mut d.two_node, true, tr("Two-Node Camera"));
                 ui.selectable_value(&mut d.two_node, false, tr("One-Node Camera"));
             });
@@ -179,7 +209,7 @@ pub fn camera(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             ui.label(tr("Preset"));
             let focal = focal_for_zoom(w, d.zoom);
             let cur = PRESETS.iter().find(|(_, f)| (f - focal).abs() < 1e-6).map(|(n, _)| *n).unwrap_or("Custom");
-            egui::ComboBox::from_id_salt("cam-preset").selected_text(cur).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("cam-preset").selected_text(cur).show_ui(ui, |ui| {
                 for (n, f) in PRESETS {
                     if ui.selectable_label(cur == n, n).clicked() {
                         d.zoom = zoom_for_focal(w, f);
@@ -201,12 +231,12 @@ pub fn camera(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             });
             ui.end_row();
             ui.label(tr("Depth of Field"));
-            ui.checkbox(&mut d.dof, tr("Enable Depth of Field"));
+            crate::widgets::labelled_checkbox(ui, &mut d.dof, tr("Enable Depth of Field"));
             ui.end_row();
             ui.label(tr("Focus Distance"));
             ui.horizontal(|ui| {
                 ui.add_enabled(!d.lock_to_zoom, crate::widgets::drag_value(egui::DragValue::new(&mut d.focus).range(0.0..=100000.0).suffix(" px")));
-                ui.checkbox(&mut d.lock_to_zoom, tr("Lock to Zoom"));
+                crate::widgets::labelled_checkbox(ui, &mut d.lock_to_zoom, tr("Lock to Zoom"));
             });
             ui.end_row();
             ui.label(tr("Aperture"));
@@ -217,57 +247,79 @@ pub fn camera(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             ui.end_row();
         });
         ui.add_space(14.0);
-        rects = buttons(ui, t, &mut ok, &mut close);
+        rects = buttons(ui, t, &mut ok, &mut close, live.then_some(&mut preview));
     });
+    app.dialog_state.live.on = preview;
     if d.lock_to_zoom {
         d.focus = d.zoom;
     }
     app.auto.add("dialog.camera.ok", rects.0, "OK");
     app.auto.add("dialog.camera.cancel", rects.1, "Cancel");
+    if live {
+        app.auto.add("dialog.camera.preview", rects.2, "Preview");
+    }
     app.dialog_state.camera = d.clone();
+    let (id, p) = camera_command(&d);
     if ok || super::dialogs::ui_enter(ctx) {
-        let mut p = json!({
-            "name": d.name,
-            "type": if d.two_node { "twoNode" } else { "oneNode" },
-            "zoom": d.zoom,
-            "dof": d.dof,
-            "focusDistance": d.focus,
-            "aperture": d.aperture,
-            "blurLevel": d.blur,
-        });
-        let id = match d.layer {
-            Some(l) => {
-                p["layer"] = json!(l);
-                "layer.cameraSettings"
-            }
-            None => "layer.newCamera",
-        };
-        if let Err(e) = app.session.execute(id, p) {
+        // A preview already made the edit (one undo step): OK keeps it.
+        if !super::live_preview::keep(app, id, p.clone())
+            && let Err(e) = app.session.execute(id, p)
+        {
             app.ui.status = e.to_string();
         }
         close = true;
+    } else if close {
+        super::live_preview::cancel(app);
+    } else {
+        super::live_preview::sync(app, id, p);
     }
     if close {
         app.dialog = None;
     }
 }
 
+/// The command Camera Settings' OK runs, and its parameters.
+fn camera_command(d: &CameraDraft) -> (&'static str, Value) {
+    let mut p = json!({
+        "name": d.name,
+        "type": if d.two_node { "twoNode" } else { "oneNode" },
+        "zoom": d.zoom,
+        "dof": d.dof,
+        "focusDistance": d.focus,
+        "aperture": d.aperture,
+        "blurLevel": d.blur,
+    });
+    let id = match d.layer {
+        Some(l) => {
+            p["layer"] = json!(l);
+            "layer.cameraSettings"
+        }
+        None => "layer.newCamera",
+    };
+    (id, p)
+}
+
 pub fn light(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     let mut d = app.dialog_state.light.clone();
     let (mut ok, mut close) = (false, false);
-    let mut rects = (egui::Rect::NOTHING, egui::Rect::NOTHING);
-    super::dialogs::modal(ctx, "Light Settings", vec2(480.0, 470.0), t, |ui| {
+    let mut rects = (egui::Rect::NOTHING, egui::Rect::NOTHING, egui::Rect::NOTHING);
+    let live = super::live_preview::active(app);
+    let place = super::live_preview::place(app);
+    let mut preview = app.dialog_state.live.on;
+    super::dialogs::modal_placed(ctx, "Light Settings", vec2(480.0, 470.0), t, place, |ui| {
         egui::Grid::new("light-grid").num_columns(2).spacing([14.0, 9.0]).show(ui, |ui| {
             ui.label(tr("Name"));
             let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(220.0));
             crate::widgets::focus_on_open(ui.ctx(), &r, &d.name);
             ui.end_row();
             ui.label(tr("Light Type"));
-            egui::ComboBox::from_id_salt("light-type").selected_text(KINDS[d.kind.min(3)].label()).show_ui(ui, |ui| {
-                for (i, k) in KINDS.iter().enumerate() {
-                    ui.selectable_value(&mut d.kind, i, k.label());
+            let combo = craft_ui::ComboBox::from_id_salt("light-type").selected_text(tr(d.kind.label())).show_ui(ui, |ui| {
+                for (i, k) in LightKind::ALL.into_iter().enumerate() {
+                    let item = ui.selectable_value(&mut d.kind, k, tr(k.label()));
+                    app.auto.add(&format!("dialog.light.typeItem.{i}"), item.rect, k.label());
                 }
             });
+            app.auto.add_response("dialog.light.type", &combo.response, "Light Type");
             ui.end_row();
             ui.label(tr("Color"));
             crate::widgets::srgb_color_button(ui, &mut d.color);
@@ -275,8 +327,7 @@ pub fn light(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             ui.label(tr("Intensity"));
             ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut d.intensity).range(-10000.0..=10000.0).suffix(" %")));
             ui.end_row();
-            let kind = KINDS[d.kind.min(3)];
-            if kind == LightKind::Spot {
+            if d.kind == LightKind::Spot {
                 ui.label(tr("Cone Angle"));
                 ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut d.cone_angle).range(0.0..=180.0).suffix("°")));
                 ui.end_row();
@@ -284,9 +335,9 @@ pub fn light(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                 ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut d.cone_feather).range(0.0..=100.0).suffix(" %")));
                 ui.end_row();
             }
-            if kind != LightKind::Ambient {
+            if falls_off(d.kind) {
                 ui.label(tr("Falloff"));
-                egui::ComboBox::from_id_salt("light-falloff").selected_text(FALLOFFS[d.falloff.min(2)]).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("light-falloff").selected_text(FALLOFFS[d.falloff.min(2)]).show_ui(ui, |ui| {
                     for (i, f) in FALLOFFS.iter().enumerate() {
                         ui.selectable_value(&mut d.falloff, i, *f);
                     }
@@ -300,8 +351,11 @@ pub fn light(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                     ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut d.falloff_distance).range(0.0..=100000.0).suffix(" px")));
                     ui.end_row();
                 }
+            }
+            if casts_shadows(d.kind) {
                 ui.label(tr("Shadows"));
-                ui.checkbox(&mut d.casts_shadows, tr("Casts Shadows"));
+                let cb = crate::widgets::labelled_checkbox(ui, &mut d.casts_shadows, tr("Casts Shadows"));
+                app.auto.add_response("dialog.light.casts", &cb, "Casts Shadows");
                 ui.end_row();
                 ui.label(tr("Shadow Darkness"));
                 ui.add_enabled(d.casts_shadows, crate::widgets::drag_value(egui::DragValue::new(&mut d.shadow_darkness).range(0.0..=100.0).suffix(" %")));
@@ -312,50 +366,71 @@ pub fn light(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             }
         });
         ui.add_space(14.0);
-        ui.label(egui::RichText::new(tr("Note: Shadows are only cast from layers with Cast Shadows enabled.")).font(Tokens::ui(11.0)).color(t.text_dim));
-        ui.add_space(8.0);
-        rects = buttons(ui, t, &mut ok, &mut close);
+        if casts_shadows(d.kind) {
+            ui.label(egui::RichText::new(tr("Note: Shadows are only cast from layers with Cast Shadows enabled.")).font(Tokens::ui(11.0)).color(t.text_dim));
+            ui.add_space(8.0);
+        }
+        rects = buttons(ui, t, &mut ok, &mut close, live.then_some(&mut preview));
     });
+    app.dialog_state.live.on = preview;
     app.auto.add("dialog.light.ok", rects.0, "OK");
     app.auto.add("dialog.light.cancel", rects.1, "Cancel");
+    if live {
+        app.auto.add("dialog.light.preview", rects.2, "Preview");
+    }
     app.dialog_state.light = d.clone();
+    let (id, p) = light_command(&d);
     if ok || super::dialogs::ui_enter(ctx) {
-        let kind = KINDS[d.kind.min(3)];
-        let mut p = json!({
-            "name": d.name,
-            "kind": kind.label(),
-            "color": [d.color[0], d.color[1], d.color[2]],
-            "intensity": d.intensity,
-        });
-        if kind == LightKind::Spot {
-            p["coneAngle"] = json!(d.cone_angle);
-            p["coneFeather"] = json!(d.cone_feather);
-        }
-        if kind != LightKind::Ambient {
-            p["falloff"] = json!(d.falloff);
-            p["radius"] = json!(d.radius);
-            p["falloffDistance"] = json!(d.falloff_distance);
-            p["castsShadows"] = json!(d.casts_shadows);
-            p["shadowDarkness"] = json!(d.shadow_darkness);
-            p["shadowDiffusion"] = json!(d.shadow_diffusion);
-        }
-        let id = match d.layer {
-            Some(l) => {
-                p["layer"] = json!(l);
-                "layer.lightSettings"
-            }
-            None => "layer.newLight",
-        };
-        if let Err(e) = app.session.execute(id, p) {
+        // A preview already made the edit (one undo step): OK keeps it.
+        if !super::live_preview::keep(app, id, p.clone())
+            && let Err(e) = app.session.execute(id, p)
+        {
             app.ui.status = e.to_string();
         }
         close = true;
+    } else if close {
+        super::live_preview::cancel(app);
+    } else {
+        super::live_preview::sync(app, id, p);
     }
     if close {
         app.dialog = None;
     }
 }
 
+/// The command Light Settings' OK runs, and its parameters.
+fn light_command(d: &LightDraft) -> (&'static str, Value) {
+    let kind = d.kind;
+    let mut p = json!({
+        "name": d.name,
+        "kind": kind.label(),
+        "color": [d.color[0], d.color[1], d.color[2]],
+        "intensity": d.intensity,
+    });
+    if kind == LightKind::Spot {
+        p["coneAngle"] = json!(d.cone_angle);
+        p["coneFeather"] = json!(d.cone_feather);
+    }
+    if falls_off(kind) {
+        p["falloff"] = json!(d.falloff);
+        p["radius"] = json!(d.radius);
+        p["falloffDistance"] = json!(d.falloff_distance);
+    }
+    if casts_shadows(kind) {
+        p["castsShadows"] = json!(d.casts_shadows);
+        p["shadowDarkness"] = json!(d.shadow_darkness);
+        p["shadowDiffusion"] = json!(d.shadow_diffusion);
+    }
+    let id = match d.layer {
+        Some(l) => {
+            p["layer"] = json!(l);
+            "layer.lightSettings"
+        }
+        None => "layer.newLight",
+    };
+    (id, p)
+}
+
 /// Menu/shortcut routing: commands that open a 3D settings dialog when invoked without params.
 /// Returns true when a dialog was opened.
 pub fn route(app: &mut EffectcraftApp, id: &str, params: &Value) -> Result<bool, String> {
diff --git a/crates/ui-egui/src/panels/effect_controls.rs b/crates/ui-egui/src/panels/effect_controls.rs
index 03b3a1ac4..d9706f147 100644
--- a/crates/ui-egui/src/panels/effect_controls.rs
+++ b/crates/ui-egui/src/panels/effect_controls.rs
@@ -28,1652 +28,14 @@ use crate::state::FxPick;
 use crate::theme::Tokens;
 use crate::{EffectcraftApp, widgets};
 
-type Actions = Vec<(String, serde_json::Value)>;
+mod common;
+mod editors;
+mod panel;
+mod rows;
+mod viewer;
 
-const ROW: f32 = 20.0;
-const DIAL_ROW: f32 = 64.0;
-// The effect title starts at 44 pt. Each level's names sit one tree step farther in;
-// reserve the same icon gutter for properties and groups so sibling names align.
-const PARAM_NAME_X: f32 = 58.0;
-const TREE_INDENT: f32 = 14.0;
-
-/// Selecting any descendant activates its owning effect without replacing the property
-/// selection used by keyframe editing, copy and delete.
-fn effect_active(g: &PropGroup, layer: effectcraft_engine::project::LayerId, selected: &[(effectcraft_engine::project::LayerId, u64)]) -> bool {
-    fn contains(g: &PropGroup, uid: u64, depth: usize) -> bool {
-        if g.uid == uid {
-            return true;
-        }
-        if depth >= 16 {
-            return false;
-        }
-        g.children.iter().any(|n| n.uid() == uid || matches!(n, Node::Group(child) if contains(child, uid, depth + 1)))
-    }
-    selected.iter().any(|(l, uid)| *l == layer && contains(g, *uid, 0))
-}
-
-fn selected_layer(app: &EffectcraftApp) -> Option<Layer> {
-    let comp = app.session.active_comp()?;
-    let id = app.session.state.selected_layers.first()?;
-    comp.layer(*id).cloned()
-}
-
-/// An effect was just applied (`effect.apply` / `effect.applyLast` with `params`): Effect
-/// Controls comes up (opened if closed, brought to the front, the focus left where it is) on the
-/// layer the effect went to, with the new effect selected, as in After Effects.
-pub fn reveal_applied(app: &mut EffectcraftApp, params: &serde_json::Value) {
-    // `effect.apply` selects the new effect on (the last of) the layers it went to.
-    let target = app.session.state.selected_props.last().map(|(l, _)| *l);
-    if let Some(l) = target
-        && !app.session.state.selected_layers.contains(&l)
-        && params.get("comp").is_none()
-        && app.session.active_comp().is_some_and(|c| c.layer(l).is_some())
-    {
-        // Show that layer (dropped on an unselected one), keeping the new effect selected.
-        let props = app.session.state.selected_props.clone();
-        match app.session.execute("layer.select", json!({"layers": [l.0]})) {
-            Ok(_) => app.session.state.selected_props = props,
-            Err(e) => app.ui.status = e.to_string(),
-        }
-    }
-    app.raise_panel(crate::dock::PanelKind::EffectControls);
-}
-
-/// After Effects asks for an effect's file as it applies it (Apply Color LUT opens the file
-/// dialog for its LUT). For the instances `effect.apply` made (`applied`, its result), open the
-/// file dialog for their first empty file parameter and set the file on each; cancelling
-/// leaves the effect without one. Does nothing without a file dialog (tests, agents).
-pub fn choose_files_after_apply(app: &mut EffectcraftApp, applied: &serde_json::Value) {
-    let Some(pick) = app.hooks.pick_files.as_ref() else { return };
-    let Some(comp) = app.session.active_comp() else { return };
-    let uids: Vec<u64> = applied.get("effects").and_then(|v| v.as_array()).map(|a| a.iter().filter_map(|v| v.as_u64()).collect()).unwrap_or_default();
-    let mut targets = vec![];
-    let mut filters: Vec<String> = vec![];
-    for uid in uids {
-        for l in &comp.layers {
-            let Some(g) = l.props.find_group(uid) else { continue };
-            let mut found = None;
-            g.walk("", &mut |_, pr| {
-                if found.is_none()
-                    && let ParamUi::File { filters } = &pr.ui
-                    && matches!(&pr.value, Value::Str(s) if s.trim().is_empty())
-                {
-                    found = Some((pr.uid, filters.clone()));
-                }
-            });
-            if let Some((prop, f)) = found {
-                targets.push((l.id.0, prop));
-                filters = f;
-            }
-        }
-    }
-    if targets.is_empty() {
-        return;
-    }
-    let exts: Vec<&str> = filters.iter().map(String::as_str).collect();
-    let Some(path) = pick(&exts).into_iter().next() else { return };
-    for (layer, prop) in targets {
-        if let Err(e) = app.session.execute("prop.set", json!({"layer": layer, "prop": prop, "value": path})) {
-            app.ui.status = e.to_string();
-        }
-    }
-}
-
-/// An undo-merge key for one gesture on `id`: a new key each time a drag starts, so separate
-/// drags are separate undo steps while one drag is one step.
-pub(crate) fn gesture_key(ui: &egui::Ui, id: egui::Id, started: bool) -> String {
-    let kid = id.with("gesture");
-    let n: u64 = if started {
-        let n = ui.data(|d| d.get_temp::<u64>(kid)).unwrap_or(0) + 1;
-        ui.data_mut(|d| d.insert_temp(kid, n));
-        n
-    } else {
-        ui.data(|d| d.get_temp::<u64>(kid)).unwrap_or(0)
-    };
-    format!("{id:?}-{n}")
-}
-
-fn triangle(p: &egui::Painter, c: egui::Pos2, left: bool, col: Color32) {
-    let (dx, h) = (if left { -3.5 } else { 3.5 }, 4.0);
-    p.add(egui::Shape::convex_polygon(vec![pos2(c.x + dx, c.y), pos2(c.x - dx, c.y - h), pos2(c.x - dx, c.y + h)], col, Stroke::NONE));
-}
-
-/// ◀ ◆ ▶ at the right end of an animated parameter's row.
-fn key_navigator(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    layer: &Layer,
-    prop: &Property,
-    ectx: &EvalCtx,
-    r: Rect,
-    actions: &mut Actions,
-) {
-    let t = app.tokens;
-    let cy = r.center().y;
-    let uid = prop.uid;
-    let half = ectx.comp.frame_duration().0 / 2;
-    let on_key = prop.keys.iter().any(|k| (layer.comp_time(k.time).0 - ectx.time.0).abs() <= half);
-    for (what, dx) in [("prev", -44.0), ("key", -32.0), ("next", -20.0)] {
-        let cr = Rect::from_center_size(pos2(r.max.x + dx, cy), vec2(12.0, 16.0));
-        let resp = ui.interact(cr, egui::Id::new(("ec-nav", uid, what)), Sense::click());
-        let col = if resp.hovered() { t.text } else { t.text_dim };
-        match what {
-            "prev" => triangle(p, cr.center(), true, col),
-            "next" => triangle(p, cr.center(), false, col),
-            _ => {
-                let kr = Rect::from_center_size(cr.center(), vec2(10.0, 10.0));
-                if on_key {
-                    icons::paint(p, kr, Icon::Keyframe, t.keyframe);
-                } else {
-                    let c = kr.center();
-                    let d = 4.5;
-                    p.add(egui::Shape::closed_line(
-                        vec![pos2(c.x, c.y - d), pos2(c.x + d, c.y), pos2(c.x, c.y + d), pos2(c.x - d, c.y)],
-                        Stroke::new(1.0, col),
-                    ));
-                }
-            }
-        }
-        app.auto.add(&format!("effectControls.prop.{uid}.{what}Key"), cr, &prop.name);
-        if resp.clicked() {
-            match what {
-                "prev" => actions.push(("time.go".into(), json!({"to": "prevKey", "prop": uid}))),
-                "next" => actions.push(("time.go".into(), json!({"to": "nextKey", "prop": uid}))),
-                _ => actions.push(("prop.toggleKey".into(), json!({"layer": layer.id.0, "prop": uid, "selected": true}))),
-            }
-        }
-    }
-}
-
-/// Toggle a viewer pick (crosshair / eyedropper) for a parameter (also the Timeline's colour
-/// eyedroppers).
-pub(crate) fn toggle_pick(app: &mut EffectcraftApp, kind: &str, layer: &Layer, prop: &Property) {
-    let pick = FxPick { kind: kind.into(), layer: layer.id.0, prop: prop.uid, name: prop.name.clone() };
-    if app.ui.fx_pick.as_ref() == Some(&pick) {
-        app.ui.fx_pick = None;
-    } else {
-        app.ui.fx_pick = Some(pick);
-        app.ui.text_color_pick = None;
-        app.ui.status = if kind == "point" {
-            format!("Click in the Composition panel to set {}", prop.name)
-        } else {
-            format!("Click in the Composition panel to sample {}", prop.name)
-        };
-    }
-}
-
-/// One property row: stopwatch, name, value control (and the keyframe navigator). Returns the
-/// value fields of a vector, one per dimension, for the pick whip.
-#[allow(clippy::too_many_arguments)]
-fn prop_row(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    layer: &Layer,
-    group: &PropGroup,
-    prop: &Property,
-    ectx: &EvalCtx,
-    r: Rect,
-    indent: f32,
-    actions: &mut Actions,
-) -> Vec<Rect> {
-    let t = app.tokens;
-    let mut dims = vec![];
-    let cy = r.center().y;
-    let uid = prop.uid;
-    if ui.input(|i| i.pointer.primary_pressed()) && ui.rect_contains_pointer(r) {
-        let add = ui.input(|i| i.modifiers.shift || i.modifiers.command);
-        actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "add": add})));
-    }
-    let swr = Rect::from_center_size(pos2(r.min.x + indent, cy), vec2(14.0, 14.0));
-    if !prop.static_only && !matches!(prop.ui, ParamUi::Hidden) {
-        let resp = ui.interact(swr, egui::Id::new(("ec-sw", uid)), Sense::click());
-        icons::paint(
-            p,
-            swr,
-            Icon::Stopwatch,
-            if prop.is_animated() {
-                t.hot_text
-            } else if resp.hovered() {
-                t.text
-            } else {
-                t.text_dim
-            },
-        );
-        app.auto.add(&format!("effectControls.prop.{uid}.stopwatch"), swr, &prop.name);
-        if resp.clicked() {
-            actions.push(("prop.toggleAnimation".into(), json!({"layer": layer.id.0, "prop": uid, "selected": true})));
-        }
-    }
-    if prop.is_animated() {
-        key_navigator(app, ui, p, layer, prop, ectx, r, actions);
-    }
-    let value = ectx.value(layer, prop);
-    // Keep a shared value column while names and their icons follow the group hierarchy.
-    // Extremely deep groups still leave a little name space before their value.
-    let vx = (r.min.x + r.width() * 0.48).max(r.min.x + PARAM_NAME_X + 124.0).max(swr.max.x + 40.0);
-    // A vector's values end before the keyframe navigator: in a narrow panel they move left over
-    // the name (cut short) instead of running under the navigator (#271).
-    let vx = match &value {
-        Value::Vec2(_) | Value::Vec3(_) => {
-            let point = if matches!(prop.ui, ParamUi::Point | ParamUi::Point3) { 22.0 } else { 0.0 };
-            let fields: f32 = value
-                .components()
-                .iter()
-                .take(shown_dims(layer, prop, &value))
-                .map(|v| p.layout_no_wrap(format!("{v:.1}"), Tokens::ui(12.0), t.hot_text).size().x + 12.0)
-                .sum();
-            let right = r.max.x - if prop.is_animated() { 52.0 } else { 8.0 };
-            vx.min(right - point - fields + 8.0).max(swr.max.x + 60.0)
-        }
-        _ => vx,
-    };
-    let name_clip = Rect::from_min_max(pos2(swr.max.x + 6.0, r.min.y), pos2(vx - 6.0, r.max.y));
-    app.auto.add(&format!("effectControls.prop.{uid}.name"), name_clip, &prop.name);
-    p.with_clip_rect(name_clip.intersect(p.clip_rect())).text(pos2(swr.max.x + 6.0, cy), Align2::LEFT_CENTER, &prop.name, Tokens::ui(12.0), t.text);
-    let name_response = ui.interact(name_clip, egui::Id::new(("ec-prop-name", uid)), Sense::click());
-    if name_response.double_clicked() {
-        app.ui.timeline.search.clear();
-        app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Property(uid));
-        if let Err(e) = crate::menus::frontend(app, ui.ctx(), "timeline.revealProps", json!({"props": [{"layer": layer.id.0, "prop": uid}]})) {
-            app.ui.status = e;
-        }
-        app.show_panel(crate::dock::PanelKind::Timeline);
-    }
-    app.auto.add(&format!("effectControls.prop.{uid}.name"), name_clip, &prop.name);
-    let merge = format!("ec-{uid}");
-    // With several layers selected the edit applies to the same effect property of each (#491).
-    let scrub = ui.ctx().dragged_id().is_some() && ui.input(|i| i.pointer.is_decidedly_dragging());
-    let set = |actions: &mut Actions, v: serde_json::Value| {
-        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": v, "merge": merge, "selected": true, "offset": scrub})))
-    };
-    let twirl_open = |app: &mut EffectcraftApp, ui: &mut egui::Ui| {
-        let open = app.ui.fx_slider_open.contains(&uid);
-        let tw = Rect::from_center_size(pos2(swr.min.x - 9.0, cy), vec2(10.0, 10.0));
-        if widgets::twirl(ui, tw, open, egui::Id::new(("ec-stw", uid)), &t).clicked() {
-            if open {
-                app.ui.fx_slider_open.remove(&uid);
-            } else {
-                app.ui.fx_slider_open.insert(uid);
-            }
-        }
-        app.auto.add(&format!("effectControls.prop.{uid}.twirl"), tw, &prop.name);
-    };
-    match &value {
-        Value::Scalar(v) if matches!(prop.ui, ParamUi::Mask) => {
-            // A mask of this layer ("Path" popup).
-            let mut opts = vec!["None".to_string()];
-            if let Some(m) = layer.masks() {
-                opts.extend(m.groups().map(|g| g.name.clone()));
-            }
-            let i = v.round().max(0.0) as usize;
-            let label = opts.get(i).cloned().unwrap_or_else(|| format!("Mask {i}"));
-            let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((r.max.x - vx - 56.0).clamp(80.0, 200.0), 18.0));
-            let pop = egui::Id::new(("ec-mpop", uid));
-            if widgets::dropdown(ui, dr, &label, &t, egui::Id::new(("ec-m", uid))).clicked() {
-                widgets::open_popup(ui, pop);
-            }
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
-            if let Some(ni) = widgets::popup_menu(ui, pop, dr.left_bottom(), &opts, Some(i)) {
-                set(actions, json!(ni as f64));
-            }
-        }
-        Value::Scalar(v) if matches!(prop.ui, ParamUi::Angle) => {
-            let (rr, dr, nv) = fw::angle_field(ui, pos2(vx, cy - 9.0), egui::Id::new(("ec-v", uid)), *v, 1, &t);
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), rr.union(dr), &fw::format_angle(*v, 1));
-            app.auto.add(&format!("effectControls.prop.{uid}.revolutions"), rr, &prop.name);
-            if let Some(nv) = nv {
-                set(actions, json!(nv));
-            }
-            twirl_open(app, ui);
-        }
-        Value::Scalar(v) => {
-            let (min, max, dec) = match &prop.ui {
-                ParamUi::Slider { min, max, decimals, .. } => (*min, *max, *decimals as usize),
-                _ => (-1e9, 1e9, 1),
-            };
-            let suffix = match prop.ui {
-                ParamUi::Percent => "%",
-                _ => "",
-            };
-            let speed = match &prop.ui {
-                ParamUi::Slider { slider_min, slider_max, .. } => ((slider_max - slider_min) / 300.0).clamp(0.001, 50.0),
-                _ => 0.5,
-            };
-            let (vr, nv, _) = widgets::hot_number_at(
-                ui,
-                pos2(vx, cy - 9.0),
-                egui::Id::new(("ec-v", uid)),
-                *v,
-                speed,
-                (min, max),
-                dec.max(if dec == 0 { 0 } else { 1 }),
-                suffix,
-                &t,
-            );
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), vr, &prop.name);
-            if let Some(nv) = nv {
-                set(actions, json!(nv));
-            }
-            // AE hides a slider param's slider until its twirl is opened (see `slider_row`).
-            if matches!(prop.ui, ParamUi::Slider { .. }) {
-                twirl_open(app, ui);
-            }
-        }
-        Value::Vec2(_) | Value::Vec3(_) => {
-            let c = value.components();
-            let n = shown_dims(layer, prop, &value);
-            let mut x = vx;
-            if matches!(prop.ui, ParamUi::Point | ParamUi::Point3) {
-                let cr = Rect::from_center_size(pos2(x + 8.0, cy), vec2(18.0, 18.0));
-                let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == "point");
-                if fw::crosshair_button(ui, cr, active, egui::Id::new(("ec-xh", uid)), &t)
-                    .on_hover_text(crate::i18n::tr("Click, then click in the Composition panel"))
-                    .clicked()
-                {
-                    toggle_pick(app, "point", layer, prop);
-                }
-                app.auto.add(&format!("effectControls.prop.{uid}.crosshair"), cr, &prop.name);
-                x += 22.0;
-            }
-            for d in 0..n.min(c.len()) {
-                let (vr, nv, _) = widgets::hot_number_at(ui, pos2(x, cy - 9.0), egui::Id::new(("ec-v", uid, d)), c[d], 1.0, (-1e9, 1e9), 1, "", &t);
-                app.auto.add(&format!("effectControls.prop.{uid}.value.{d}"), vr, &prop.name);
-                dims.push(vr);
-                if let Some(nv) = nv {
-                    let mut nc = c.clone();
-                    nc[d] = nv;
-                    set(actions, json!(nc));
-                    // Typed into this component only: other selected layers keep the rest of
-                    // their own value (#1434).
-                    if let Some((_, a)) = actions.last_mut() {
-                        a["dims"] = json!([d]);
-                    }
-                }
-                x = vr.max.x + 8.0;
-            }
-        }
-        Value::Color(c) => {
-            let sr = Rect::from_min_size(pos2(vx, cy - 8.0), vec2(30.0, 16.0));
-            let pop = egui::Id::new(("ec-cpop", uid));
-            if widgets::swatch(ui, sr, [c[0] as f32, c[1] as f32, c[2] as f32, 1.0], egui::Id::new(("ec-c", uid)), &t).clicked() {
-                widgets::open_popup(ui, pop);
-            }
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), sr, &prop.name);
-            let er = Rect::from_center_size(pos2(sr.max.x + 14.0, cy), vec2(18.0, 18.0));
-            let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == "color");
-            if fw::eyedropper_button(ui, er, active, egui::Id::new(("ec-eye", uid)), &t)
-                .on_hover_text(crate::i18n::tr("Eyedropper: click, then click in the Composition panel"))
-                .clicked()
-            {
-                toggle_pick(app, "color", layer, prop);
-            }
-            app.auto.add(&format!("effectControls.prop.{uid}.eyedropper"), er, &prop.name);
-            let mut rgb = [c[0] as f32, c[1] as f32, c[2] as f32];
-            if crate::widgets::color_popup(ui, pop, sr.left_bottom(), &mut rgb) {
-                set(actions, json!([rgb[0], rgb[1], rgb[2], 1.0]));
-            }
-        }
-        Value::Bool(b) => {
-            let cr = Rect::from_min_size(pos2(vx, cy - 8.0), vec2(16.0, 16.0));
-            if widgets::checkbox(ui, cr, *b, &t, egui::Id::new(("ec-b", uid))).clicked() {
-                set(actions, json!(!b));
-            }
-            p.text(pos2(cr.max.x + 6.0, cy), Align2::LEFT_CENTER, &prop.name, Tokens::ui(12.0), t.text_dim);
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), cr, &prop.name);
-        }
-        Value::Enum(i) => {
-            if let ParamUi::Popup { options } = &prop.ui {
-                let widest = options.iter().map(|o| p.layout_no_wrap(o.clone(), Tokens::ui(11.5), t.text).size().x).fold(0.0, f32::max);
-                let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((widest + 30.0).clamp(80.0, (r.max.x - vx - 56.0).max(80.0)), 18.0));
-                let pop = egui::Id::new(("ec-epop", uid));
-                if widgets::dropdown(ui, dr, options.get(*i as usize).map(String::as_str).unwrap_or(""), &t, egui::Id::new(("ec-e", uid))).clicked() {
-                    widgets::open_popup(ui, pop);
-                }
-                app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
-                if let Some(ni) = widgets::popup_menu(ui, pop, dr.left_bottom(), options, Some(*i as usize)) {
-                    set(actions, json!(ni));
-                }
-            }
-        }
-        Value::Layer(l) => {
-            let comp = app.session.active_comp_arc();
-            if let Some(comp) = comp {
-                let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2(((r.max.x - vx) * 0.55).clamp(90.0, 170.0), 18.0));
-                let idx_of = |id: u64| comp.layers.iter().position(|x| x.id.0 == id);
-                let name = l.and_then(|id| idx_of(id).map(|i| format!("{}. {}", i + 1, comp.layers[i].name))).unwrap_or_else(|| "None".into());
-                let pop = egui::Id::new(("ec-lpop", uid));
-                if widgets::dropdown(ui, dr, &name, &t, egui::Id::new(("ec-l", uid))).clicked() {
-                    widgets::open_popup(ui, pop);
-                }
-                app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
-                let mut opts = vec!["None".to_string()];
-                opts.extend(comp.layers.iter().enumerate().map(|(i, l)| format!("{}. {}", i + 1, l.name)));
-                let cur = l.and_then(idx_of).map(|i| i + 1).unwrap_or(0);
-                if let Some(i) = widgets::popup_menu(ui, pop, dr.left_bottom(), &opts, Some(cur)) {
-                    set(actions, if i == 0 { serde_json::Value::Null } else { json!(comp.layers[i - 1].id.0) });
-                }
-                // Source / Masks / Effects & Masks (the hidden companion parameter).
-                if let Some(src) = group.get(&effectcraft_engine::effects::layer_source_id(&prop.match_id)) {
-                    let si = src.value.as_enum() as usize;
-                    let opts: Vec<String> = effectcraft_engine::effects::LAYER_SOURCE_OPTIONS.iter().map(|s| s.to_string()).collect();
-                    let sr = Rect::from_min_size(pos2(dr.max.x + 6.0, cy - 9.0), vec2(((r.max.x - dr.max.x) - 64.0).clamp(70.0, 120.0), 18.0));
-                    let spop = egui::Id::new(("ec-lspop", uid));
-                    if widgets::dropdown(ui, sr, opts.get(si).map(String::as_str).unwrap_or(""), &t, egui::Id::new(("ec-ls", uid))).clicked() {
-                        widgets::open_popup(ui, spop);
-                    }
-                    app.auto.add(&format!("effectControls.prop.{uid}.source"), sr, &src.name);
-                    if let Some(ni) = widgets::popup_menu(ui, spop, sr.left_bottom(), &opts, Some(si)) {
-                        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": src.uid, "value": ni})));
-                    }
-                }
-            }
-        }
-        // EXtractoR's red / green / blue / alpha: a popup of the footage's OpenEXR channels (#295).
-        Value::Str(s) if super::fx_editors::is_extractor_channel(group, prop) => {
-            let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((r.max.x - vx - 56.0).clamp(80.0, 200.0), 18.0));
-            super::fx_editors::channel_popup(app, ui, layer, prop, s, dr, actions);
-        }
-        // A file parameter (Apply Color LUT's LUT, an OCIO config): its file name and Choose…,
-        // as in After Effects.
-        Value::Str(s) if matches!(prop.ui, ParamUi::File { .. }) => {
-            let bw = 70.0;
-            let br = Rect::from_min_size(pos2(vx, cy - 9.0), vec2(bw, 18.0));
-            if widgets::text_button(ui, br, crate::i18n::tr("Choose..."), false, &t, egui::Id::new(("ec-file", uid))).clicked() {
-                let filters: Vec<&str> = match &prop.ui {
-                    ParamUi::File { filters } => filters.iter().map(String::as_str).collect(),
-                    _ => vec![],
-                };
-                match app.hooks.pick_files.as_ref() {
-                    Some(pick) => {
-                        if let Some(path) = pick(&filters).into_iter().next() {
-                            actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": path})));
-                        }
-                    }
-                    None => app.ui.status = "no file dialog available: set the path with prop.set".into(),
-                }
-            }
-            app.auto.add(&format!("effectControls.prop.{uid}.choose"), br, &prop.name);
-            let shown = if s.trim().is_empty() {
-                crate::i18n::tr("None").to_string()
-            } else if s.contains('\n') {
-                prop.name.clone()
-            } else {
-                effectcraft_engine::sequence::file_name(s)
-            };
-            let nr = Rect::from_min_max(pos2(br.max.x + 8.0, r.min.y), pos2(r.max.x - 8.0, r.max.y));
-            let np = p.with_clip_rect(nr.intersect(p.clip_rect()));
-            np.text(pos2(nr.min.x, cy), Align2::LEFT_CENTER, &shown, Tokens::ui(12.0), if s.trim().is_empty() { t.text_dim } else { t.text });
-            let hover = ui.interact(nr, egui::Id::new(("ec-file-name", uid)), Sense::hover());
-            if !s.trim().is_empty() && !s.contains('\n') {
-                hover.on_hover_text(s.as_str());
-            }
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), nr, &shown);
-        }
-        // A text parameter (Cryptomatte's Selection, Colorama's Output Cycle, config names):
-        // typed in a field, set when it loses the focus (Esc keeps the old text).
-        Value::Str(s) if matches!(prop.ui, ParamUi::Text) => {
-            let fr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((r.max.x - vx - 12.0).clamp(80.0, 320.0), 18.0));
-            let bid = egui::Id::new(("ec-text", uid));
-            let mut buf: String = ui.data(|d| d.get_temp(bid)).unwrap_or_else(|| s.clone());
-            let resp = widgets::text_field(ui, fr, &mut buf, "", &t);
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), fr, &prop.name);
-            if resp.lost_focus() {
-                if buf != *s && !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                    actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": buf})));
-                }
-                ui.data_mut(|d| d.remove::<String>(bid));
-            } else if resp.has_focus() {
-                ui.data_mut(|d| d.insert_temp(bid, buf));
-            }
-        }
-        Value::Gradient(g) => {
-            let gr = Rect::from_min_size(pos2(vx, cy - 7.0), vec2((r.max.x - vx - 56.0).clamp(60.0, 180.0), 14.0));
-            let n = 48;
-            for k in 0..n {
-                let f = k as f64 / (n - 1) as f64;
-                let c = gradient_at(g, f);
-                let x0 = gr.min.x + gr.width() * k as f32 / n as f32;
-                let x1 = gr.min.x + gr.width() * (k + 1) as f32 / n as f32;
-                p.rect_filled(Rect::from_min_max(pos2(x0, gr.min.y), pos2(x1, gr.max.y)), 0.0, c);
-            }
-            p.rect_stroke(gr, 2.0, Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
-            app.auto.add(&format!("effectControls.prop.{uid}.value"), gr, &prop.name);
-        }
-        _ => {}
-    }
-    dims
-}
-
-/// How many of a vector parameter's values show (a 3D point's Z only on a 3D layer).
-fn shown_dims(layer: &Layer, prop: &Property, value: &Value) -> usize {
-    let n = value.components().len();
-    if prop.shown_dims > 0 && !(layer.is_3d() && n == 3) { prop.shown_dims as usize } else { n }
-}
-
-/// Colour of a gradient at `f` (colour stops only).
-fn gradient_at(g: &effectcraft_engine::keyframe::Gradient, f: f64) -> Color32 {
-    let stops = &g.colors;
-    let c = if stops.is_empty() {
-        [0.0, 0.0, 0.0, 1.0]
-    } else if f <= stops[0].0 {
-        stops[0].1
-    } else if f >= stops[stops.len() - 1].0 {
-        stops[stops.len() - 1].1
-    } else {
-        let i = stops.iter().position(|s| s.0 > f).unwrap_or(stops.len() - 1).max(1);
-        let (a, b) = (stops[i - 1], stops[i]);
-        let k = ((f - a.0) / (b.0 - a.0).max(1e-9)) as f32;
-        [0, 1, 2, 3].map(|j| a.1[j] + (b.1[j] - a.1[j]) * k)
-    };
-    Color32::from_rgb((c[0].clamp(0.0, 1.0) * 255.0) as u8, (c[1].clamp(0.0, 1.0) * 255.0) as u8, (c[2].clamp(0.0, 1.0) * 255.0) as u8)
-}
-
-/// The twirled-open slider under a slider param: track, knob and the slider range's ends.
-#[allow(clippy::too_many_arguments)]
-fn slider_row(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    layer: &Layer,
-    prop: &Property,
-    ectx: &EvalCtx,
-    r: Rect,
-    x0: f32,
-    actions: &mut Actions,
-) {
-    let t = app.tokens;
-    let ParamUi::Slider { slider_min, slider_max, decimals, .. } = prop.ui else { return };
-    let Value::Scalar(v) = ectx.value(layer, prop) else { return };
-    let uid = prop.uid;
-    let tr = Rect::from_min_max(pos2(r.min.x + x0, r.min.y + 8.0), pos2(r.max.x - 16.0, r.min.y + 12.0));
-    if tr.width() < 40.0 {
-        return;
-    }
-    p.rect_filled(tr, 2.0, t.field_bg);
-    let f = ((v - slider_min) / (slider_max - slider_min)).clamp(0.0, 1.0) as f32;
-    p.rect_filled(Rect::from_min_max(tr.min, pos2(tr.min.x + tr.width() * f, tr.max.y)), 2.0, t.accent.gamma_multiply(0.7));
-    p.circle_filled(pos2(tr.min.x + tr.width() * f, tr.center().y), 5.0, t.text);
-    let dec = decimals as usize;
-    p.text(pos2(tr.min.x, tr.max.y + 4.0), Align2::LEFT_TOP, format!("{slider_min:.dec$}"), Tokens::ui(10.5), t.text_dim);
-    p.text(pos2(tr.max.x, tr.max.y + 4.0), Align2::RIGHT_TOP, format!("{slider_max:.dec$}"), Tokens::ui(10.5), t.text_dim);
-    let sresp = ui.interact(tr.expand2(vec2(4.0, 6.0)), egui::Id::new(("ec-slider", uid)), Sense::click_and_drag());
-    app.auto.add(&format!("effectControls.prop.{uid}.slider"), tr, &prop.name);
-    if (sresp.dragged() || sresp.clicked())
-        && let Some(pt) = sresp.interact_pointer_pos()
-    {
-        let f = ((pt.x - tr.min.x) / tr.width()).clamp(0.0, 1.0) as f64;
-        actions.push((
-            "prop.set".into(),
-            json!({"layer": layer.id.0, "prop": uid, "value": slider_min + (slider_max - slider_min) * f, "merge": format!("ec-{uid}")}),
-        ));
-    }
-}
-
-/// The twirled-open angle dial under an angle param.
-#[allow(clippy::too_many_arguments)]
-fn dial_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, layer: &Layer, prop: &Property, ectx: &EvalCtx, r: Rect, x0: f32, actions: &mut Actions) {
-    let t = app.tokens;
-    let Value::Scalar(v) = ectx.value(layer, prop) else { return };
-    let uid = prop.uid;
-    let d = (r.height() - 12.0).min(52.0);
-    let dr = Rect::from_min_size(pos2(r.min.x + x0 + 40.0, r.min.y + 6.0), vec2(d, d));
-    let id = egui::Id::new(("ec-dial", uid));
-    let (resp, nv) = fw::angle_dial(ui, dr, v, id, &t);
-    app.auto.add(&format!("effectControls.prop.{uid}.dial"), dr, &prop.name);
-    if let Some(nv) = nv {
-        let key = gesture_key(ui, id, resp.drag_started() || resp.clicked());
-        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": nv, "merge": key})));
-    }
-}
-
-/// The effect instance a row belongs to, for conditional visibility
-/// ([`effectcraft_engine::effects::catalog::param_shown`]): effect id, the instance's root
-/// group and the spec-id path of the group being drawn (`""` or `cameraPosition/`).
-struct FxScope<'a> {
-    effect: &'a str,
-    root: &'a PropGroup,
-    path: String,
-}
-
-impl<'a> FxScope<'a> {
-    fn sub(&self, m: &str) -> FxScope<'a> {
-        FxScope { effect: self.effect, root: self.root, path: format!("{}{m}/", self.path) }
-    }
-    /// Whether child `m` of the current group is shown.
-    fn shown(&self, layer: &Layer, ectx: &EvalCtx, m: &str) -> bool {
-        let root = self.root;
-        let value = |id: &str| -> Option<Value> {
-            let mut g = root;
-            let mut parts = id.split('/').peekable();
-            while let Some(part) = parts.next() {
-                if parts.peek().is_none() {
-                    return g.get(part).map(|p| ectx.value(layer, p));
-                }
-                g = g.sub(part)?;
-            }
-            None
-        };
-        effectcraft_engine::effects::catalog::param_shown(self.effect, &format!("{}{m}", self.path), &value)
-    }
-}
-
-/// Twirl `g` closed (it was `open`) or open; with `all` (Alt/Cmd-click) every group under it follows.
-fn toggle_closed(app: &mut EffectcraftApp, g: &PropGroup, open: bool, all: bool) {
-    fn walk(g: &PropGroup, out: &mut Vec<u64>) {
-        for sg in g.groups() {
-            out.push(sg.uid);
-            walk(sg, out);
-        }
-    }
-    let mut uids = vec![g.uid];
-    if all {
-        walk(g, &mut uids);
-    }
-    for u in uids {
-        if open {
-            app.ui.fx_closed.insert(u);
-        } else {
-            app.ui.fx_closed.remove(&u);
-        }
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-fn group_rows(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    layer: &Layer,
-    g: &PropGroup,
-    ectx: &EvalCtx,
-    rect: Rect,
-    y: &mut f32,
-    depth: usize,
-    fx: &FxScope,
-    actions: &mut Actions,
-) {
-    let t = app.tokens;
-    for c in &g.children {
-        let r = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), ROW));
-        match c {
-            Node::Prop(pr) => {
-                if matches!(pr.ui, ParamUi::Hidden) || pr.three_d_only && !layer.is_3d() || !fx.shown(layer, ectx, &pr.match_id) {
-                    continue;
-                }
-                *y += ROW;
-                let indent = PARAM_NAME_X - 13.0 + TREE_INDENT * depth as f32;
-                let visible = !(r.max.y < rect.min.y || r.min.y > rect.max.y);
-                if visible {
-                    app.auto.add(&format!("effectControls.row.{}", pr.uid), r, &pr.name);
-                    let dims = prop_row(app, ui, p, layer, g, pr, ectx, r, indent, actions);
-                    // A Timeline pick whip can be dropped here (After Effects).
-                    super::timeline::whip_target(ui.ctx(), r.intersect(rect), layer.id.0, pr.uid, dims);
-                }
-                if app.ui.fx_slider_open.contains(&pr.uid) {
-                    if matches!(pr.ui, ParamUi::Angle) {
-                        let sr = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), DIAL_ROW));
-                        *y += DIAL_ROW;
-                        if sr.max.y >= rect.min.y && sr.min.y <= rect.max.y {
-                            dial_row(app, ui, layer, pr, ectx, sr, indent + 22.0, actions);
-                        }
-                    } else if matches!(pr.ui, ParamUi::Slider { .. }) {
-                        let sr = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), 34.0));
-                        *y += 34.0;
-                        if sr.max.y >= rect.min.y && sr.min.y <= rect.max.y {
-                            slider_row(app, ui, p, layer, pr, ectx, sr, indent + 22.0, actions);
-                        }
-                    }
-                }
-            }
-            Node::Group(sg) => {
-                // Paint strokes live in the Timeline only (AE's Paint shows Paint on Transparent).
-                if effectcraft_engine::effects::paint::is_paint(g) || !fx.shown(layer, ectx, &sg.match_id) {
-                    continue;
-                }
-                *y += ROW;
-                let open = !app.ui.fx_closed.contains(&sg.uid);
-                let tw = Rect::from_center_size(pos2(r.min.x + PARAM_NAME_X - 12.0 + TREE_INDENT * depth as f32, r.center().y), vec2(12.0, 12.0));
-                if r.max.y >= rect.min.y && r.min.y <= rect.max.y {
-                    app.auto.add(&format!("effectControls.row.{}", sg.uid), r, &sg.name);
-                    app.auto.add(&format!("effectControls.group.{}.twirl", sg.uid), tw, &sg.name);
-                    if widgets::twirl(ui, tw, open, egui::Id::new(("ec-g", sg.uid)), &t).clicked() {
-                        toggle_closed(app, sg, open, ui.input(|i| i.modifiers.alt || i.modifiers.command));
-                    }
-                    let name = p.text(pos2(tw.max.x + 6.0, r.center().y), Align2::LEFT_CENTER, &sg.name, Tokens::ui(12.0), t.text);
-                    app.auto.add(&format!("effectControls.group.{}.name", sg.uid), name, &sg.name);
-                }
-                if open {
-                    let sub = fx.sub(&sg.match_id);
-                    // A visual editor for the group's hidden parameters (Lumetri curves, …).
-                    let eh = super::fx_editors::inline_height(fx.effect, &sub.path, rect.width());
-                    if eh > 0.0 {
-                        let er = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), eh));
-                        *y += eh;
-                        if er.max.y >= rect.min.y && er.min.y <= rect.max.y {
-                            super::fx_editors::inline_editor(app, ui, p, layer, fx.root, sg, fx.effect, &sub.path, ectx, er, actions);
-                        }
-                    }
-                    group_rows(app, ui, p, layer, sg, ectx, rect, y, depth + 1, &sub, actions);
-                }
-            }
-        }
-    }
-}
-
-/// Warp Stabilizer's Analyze / Cancel buttons and analysis status.
-fn warp_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, r: Rect, actions: &mut Actions) {
-    let t = app.tokens;
-    let running = app.session.warp_target().is_some_and(|(_, l, u)| l == layer.id && u == g.uid) && app.session.is_warp_analyzing();
-    let busy = app.session.is_warp_analyzing();
-    let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
-    let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
-    if widgets::text_button(ui, b1, "Analyze", false, &t, egui::Id::new(("warp-analyze", g.uid))).clicked() && !busy {
-        actions.push(("warp.analyze".into(), json!({"layer": layer.id.0, "effect": g.uid})));
-    }
-    app.auto.add(&format!("effectControls.warp.{}.analyze", g.uid), b1, "Analyze");
-    if running {
-        if widgets::text_button(ui, b2, "Cancel", false, &t, egui::Id::new(("warp-cancel", g.uid))).clicked() {
-            actions.push(("warp.cancel".into(), json!({})));
-        }
-        app.auto.add(&format!("effectControls.warp.{}.cancel", g.uid), b2, "Cancel");
-    }
-    let analysed = matches!(g.get(effectcraft_engine::effects::warp_stab::ANALYSIS).map(|p| &p.value), Some(Value::Str(s)) if !s.is_empty());
-    let status = match app.session.warp_progress() {
-        Some(pr) if running => pr.banner(),
-        _ if analysed => "Analysis complete".to_string(),
-        _ if app.session.warp_pending.iter().any(|(_, l, u)| *l == layer.id && *u == g.uid) => "Waiting to analyze".to_string(),
-        _ => "Not analyzed: click Analyze".to_string(),
-    };
-    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, status, Tokens::ui(11.5), t.text_dim);
-}
-
-/// Roto Brush & Refine Edge: Freeze / Unfreeze and Propagate buttons and the segmentation status.
-fn roto_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, r: Rect, actions: &mut Actions) {
-    use effectcraft_engine::effects::roto as fx;
-    let t = app.tokens;
-    let params = effectcraft_engine::effects::flatten_params(g, &mut |pr| pr.value.clone());
-    let frozen = fx::is_frozen(&params);
-    let d = fx::data(&params);
-    let running = app.session.roto_target().is_some_and(|(_, l, u, _)| l == layer.id && u == g.uid) && app.session.is_roto_running();
-    let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
-    let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
-    let label = if frozen { "Unfreeze" } else { "Freeze" };
-    if widgets::text_button(ui, b1, label, frozen, &t, egui::Id::new(("roto-freeze-ec", g.uid))).clicked() && !running {
-        let id = if frozen { "roto.unfreeze" } else { "roto.freeze" };
-        actions.push((id.into(), json!({"layer": layer.id.0, "effect": g.uid})));
-    }
-    app.auto.add(&format!("effectControls.roto.{}.freeze", g.uid), b1, label);
-    let (l2, id2) = if running { ("Stop", "roto.cancel") } else { ("Propagate", "roto.propagate") };
-    if widgets::text_button(ui, b2, l2, false, &t, egui::Id::new(("roto-prop-ec", g.uid))).clicked() && !frozen {
-        actions.push((id2.into(), json!({"layer": layer.id.0, "effect": g.uid})));
-    }
-    app.auto.add(&format!("effectControls.roto.{}.propagate", g.uid), b2, l2);
-    let status = match (app.session.roto_progress(), d.base) {
-        (Some(pr), _) if running => pr.banner(),
-        (_, None) => "No strokes: paint with the Roto Brush tool (Alt+W) in the Layer panel".to_string(),
-        (_, Some(b)) => format!("Base frame {b}, span {}–{}{}", d.span[0], d.span[1], if frozen { " (frozen)" } else { "" }),
-    };
-    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, status, Tokens::ui(11.5), t.text_dim);
-}
-
-/// Object Matte: Freeze / Unfreeze and Track / Stop buttons (the background job that computes
-/// the matte over the tracked frames) and its status.
-fn object_matte_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, r: Rect, actions: &mut Actions) {
-    use effectcraft_engine::effects::object_matte as om;
-    let t = app.tokens;
-    let params = effectcraft_engine::effects::flatten_params(g, &mut |pr| pr.value.clone());
-    let frozen = om::is_frozen(&params);
-    let mine = app.session.roto_target().is_some_and(|(_, l, u, _)| l == layer.id && u == g.uid);
-    let running = mine && app.session.is_roto_running();
-    let busy = app.session.is_roto_running();
-    let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
-    let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
-    let label = if frozen { "Unfreeze" } else { "Freeze" };
-    if widgets::text_button(ui, b1, crate::i18n::tr(label), frozen, &t, egui::Id::new(("om-freeze-ec", g.uid))).clicked() && !busy {
-        let id = if frozen { "objectMatte.unfreeze" } else { "objectMatte.freeze" };
-        actions.push((id.into(), json!({"layer": layer.id.0, "effect": g.uid})));
-    }
-    app.auto.add(&format!("effectControls.objectMatte.{}.freeze", g.uid), b1, label);
-    let (l2, id2) = if running { ("Stop", "roto.cancel") } else { ("Track", "objectMatte.propagate") };
-    if widgets::text_button(ui, b2, crate::i18n::tr(l2), false, &t, egui::Id::new(("om-track-ec", g.uid))).clicked() && !frozen && (running || !busy) {
-        actions.push((id2.into(), json!({"layer": layer.id.0, "effect": g.uid})));
-    }
-    app.auto.add(&format!("effectControls.objectMatte.{}.track", g.uid), b2, l2);
-    let base = om::reference_frame(&params);
-    let status = match app.session.roto_progress() {
-        Some(pr) if running => pr.banner(),
-        _ if frozen => format!("Frozen from reference frame {base}"),
-        _ if app.session.roto_pending.iter().any(|(_, l, u)| *l == layer.id && *u == g.uid) => "Waiting to track".to_string(),
-        _ => format!("Reference frame {base}: Track computes the matte ahead of playback"),
-    };
-    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, &status, Tokens::ui(11.5), t.text_dim);
-    app.auto.add(
-        &format!("effectControls.objectMatte.{}.status", g.uid),
-        Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 30.0), vec2(r.width() - 24.0, 16.0)),
-        &status,
-    );
-}
-
-// ---------------------------------------------------------------------------------------------
-// Curves / Levels editors
-
-/// Height of the custom editor shown under an effect's header (0 when none).
-fn editor_height(effect: &str, g: &PropGroup, width: f32) -> f32 {
-    match effect {
-        super::fx_editors::GLOW | super::fx_editors::RESHAPE | super::fx_editors::EXTRACTOR => super::fx_editors::header_height(effect, g, width),
-        "ec.color.curves" => 34.0 + curves_size(width) + 26.0,
-        effectcraft_engine::effects::warp_stab::ID => 50.0,
-        effectcraft_engine::effects::camera_tracker::ID => super::camera_tracker_ui::EDITOR_HEIGHT,
-        effectcraft_engine::effects::roto::ID | effectcraft_engine::effects::object_matte::ID => 50.0,
-        "ec.color.levels" | "ec.color.levelsic" => 34.0 + 80.0 + 58.0,
-        "ec.color.autolevels" | "ec.color.autocontrast" | "ec.color.autocolor" => 24.0 + 80.0 + 12.0,
-        _ => 0.0,
-    }
-}
-
-fn curves_size(width: f32) -> f32 {
-    (width - 72.0).clamp(120.0, 256.0)
-}
-
-/// Cached histogram of the displayed frame (recomputed when the frame changes).
-fn frame_histogram(app: &mut EffectcraftApp, ctx: &egui::Context) -> Option<std::sync::Arc<[[u32; 256]; 5]>> {
-    let img = app.viewer_pixels()?;
-    let key = std::sync::Arc::as_ptr(&img) as usize;
-    let id = egui::Id::new("ec-histogram");
-    if let Some((k, h)) = ctx.data(|d| d.get_temp::<(usize, std::sync::Arc<[[u32; 256]; 5]>)>(id))
-        && k == key
-    {
-        return Some(h);
-    }
-    let h = std::sync::Arc::new(fw::histogram(&img));
-    ctx.data_mut(|d| d.insert_temp(id, (key, h.clone())));
-    Some(h)
-}
-
-fn channel_color(ch: usize) -> Color32 {
-    match ch {
-        1 => Color32::from_rgb(0xe0, 0x50, 0x50),
-        2 => Color32::from_rgb(0x50, 0xc8, 0x60),
-        3 => Color32::from_rgb(0x50, 0x80, 0xf0),
-        4 => Color32::from_gray(0x90),
-        _ => Color32::from_gray(0xb8),
-    }
-}
-
-/// A "Channel: [RGB ▾]" popup; returns the chosen channel.
-#[allow(clippy::too_many_arguments)]
-fn channel_popup(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    x: f32,
-    cy: f32,
-    cur: usize,
-    names: &[&str],
-    id: egui::Id,
-    auto: &str,
-) -> Option<usize> {
-    let t = app.tokens;
-    p.text(pos2(x, cy), Align2::LEFT_CENTER, crate::i18n::tr("Channel:"), Tokens::ui(12.0), t.text_dim);
-    let dr = Rect::from_min_size(pos2(x + 58.0, cy - 9.0), vec2(80.0, 18.0));
-    let pop = id.with("pop");
-    if widgets::dropdown(ui, dr, names.get(cur).copied().unwrap_or(""), &t, id).clicked() {
-        widgets::open_popup(ui, pop);
-    }
-    app.auto.add(auto, dr, "Channel");
-    let opts: Vec<String> = names.iter().map(|s| s.to_string()).collect();
-    widgets::popup_menu(ui, pop, dr.left_bottom(), &opts, Some(cur))
-}
-
-/// Curves: channel popup, Bezier/pencil mode, Reset, and the graph bound to the channel's
-/// hidden point-list parameter.
-#[allow(clippy::too_many_arguments)]
-fn curves_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, ectx: &EvalCtx, r: Rect, actions: &mut Actions) {
-    let t = app.tokens;
-    let euid = g.uid;
-    // The channel lives in the effect's hidden Channel parameter (UI state for instances
-    // saved before it existed).
-    let chan_prop = g.get("channel");
-    let ch = match chan_prop {
-        Some(pr) => ectx.value(layer, pr).as_enum() as usize,
-        None => app.ui.fx_curve_channel.get(&euid).copied().unwrap_or(0),
-    }
-    .min(4);
-    let x0 = r.min.x + 30.0;
-    let cy = r.min.y + 17.0;
-    let names: [&str; 5] = [crate::i18n::tr("RGB"), crate::i18n::tr("Red"), crate::i18n::tr("Green"), crate::i18n::tr("Blue"), crate::i18n::tr("Alpha")];
-    if let Some(n) = channel_popup(app, ui, p, x0, cy, ch, &names, egui::Id::new(("ec-cch", euid)), &format!("effectControls.effect.{euid}.curves.channel")) {
-        match chan_prop {
-            Some(pr) => actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": pr.uid, "value": n}))),
-            None => {
-                app.ui.fx_curve_channel.insert(euid, n);
-            }
-        }
-    }
-    let pencil = app.ui.fx_curve_pencil.contains(&euid);
-    let mr = Rect::from_min_size(pos2(x0 + 146.0, cy - 9.0), vec2(56.0, 18.0));
-    if widgets::dropdown(ui, mr, if pencil { "Pencil" } else { "Bezier" }, &t, egui::Id::new(("ec-cmode", euid))).clicked() {
-        if pencil {
-            app.ui.fx_curve_pencil.remove(&euid);
-        } else {
-            app.ui.fx_curve_pencil.insert(euid);
-        }
-    }
-    app.auto.add(&format!("effectControls.effect.{euid}.curves.mode"), mr, "Curve mode");
-    let Some(prop) = g.get(fw::CURVE_CHANNELS[ch].0) else { return };
-    let cur = match ectx.value(layer, prop) {
-        Value::Str(s) => fw::CurvePoints::parse(&s),
-        _ => fw::CurvePoints::identity(),
-    };
-    let rr = Rect::from_min_size(pos2(mr.max.x + 8.0, cy - 9.0), vec2(44.0, 18.0));
-    let rresp = ui.interact(rr, egui::Id::new(("ec-creset", euid)), Sense::click());
-    p.text(rr.center(), Align2::CENTER_CENTER, crate::i18n::tr("Reset"), Tokens::ui(11.5), if rresp.hovered() { t.hot_text } else { t.text_dim });
-    app.auto.add(&format!("effectControls.effect.{euid}.curves.reset"), rr, "Reset curve");
-    if rresp.clicked() {
-        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": prop.uid, "value": fw::CurvePoints::identity().format()})));
-    }
-    let size = curves_size(r.width());
-    let gr = Rect::from_min_size(pos2(x0 + 8.0, r.min.y + 38.0), vec2(size, size));
-    // Input/output gradients along the axes.
-    let col = channel_color(ch);
-    p.rect_filled(Rect::from_min_max(pos2(gr.min.x, gr.max.y + 3.0), pos2(gr.max.x, gr.max.y + 8.0)), 0.0, col.gamma_multiply(0.5));
-    let id = egui::Id::new(("ec-curves", euid, ch));
-    let (resp, edit) = fw::curves_graph(ui, gr, &cur, ch, pencil, id, &t);
-    app.auto.add(&format!("effectControls.effect.{euid}.curves.graph"), gr, "Curves");
-    let started = resp.drag_started() || resp.clicked();
-    if let Some(np) = edit.changed {
-        let key = gesture_key(ui, id, started);
-        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": prop.uid, "value": np.format(), "merge": key})));
-    }
-    p.text(
-        pos2(gr.min.x, gr.max.y + 18.0),
-        Align2::LEFT_CENTER,
-        if pencil { "Drag to draw the curve" } else { "Click adds a point; drag one off to remove" },
-        Tokens::ui(10.5),
-        t.text_faint,
-    );
-}
-
-/// Levels parameter ids for a channel: input black, input white, gamma, output black, output white.
-fn levels_ids(effect: &str, ch: usize) -> [String; 5] {
-    if effect == "ec.color.levels" {
-        return effectcraft_engine::effects::levels_channel_ids(ch);
-    }
-    // Levels (Individual Controls) nests each channel's controls in its twirl-down group.
-    let pre = fw::LEVELS_CHANNELS[ch.min(4)].0;
-    ["InBlack", "InWhite", "Gamma", "OutBlack", "OutWhite"].map(|s| format!("{pre}/{pre}{s}"))
-}
-
-/// Levels: (channel popup,) histogram, input black/gamma/white triangles, output bar with
-/// black/white triangles.
-#[allow(clippy::too_many_arguments)]
-fn levels_editor(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    layer: &Layer,
-    g: &PropGroup,
-    effect: &str,
-    ectx: &EvalCtx,
-    r: Rect,
-    actions: &mut Actions,
-) {
-    let t = app.tokens;
-    let euid = g.uid;
-    let x0 = r.min.x + 30.0;
-    let cy = r.min.y + 17.0;
-    // Levels keeps its channel in the Channel parameter; Levels (Individual Controls) shows
-    // every channel and the popup only picks the histogram.
-    let ch = if effect == "ec.color.levelsic" {
-        app.ui.fx_levels_channel.get(&euid).copied().unwrap_or(0).min(4)
-    } else {
-        g.get("channel").map(|pr| ectx.value(layer, pr).as_enum() as usize).unwrap_or(0).min(4)
-    };
-    if effect == "ec.color.levelsic" {
-        let names: [&str; 5] = [crate::i18n::tr("RGB"), crate::i18n::tr("Red"), crate::i18n::tr("Green"), crate::i18n::tr("Blue"), crate::i18n::tr("Alpha")];
-        if let Some(n) = channel_popup(app, ui, p, x0, cy, ch, &names, egui::Id::new(("ec-lch", euid)), &format!("effectControls.effect.{euid}.levels.channel"))
-        {
-            app.ui.fx_levels_channel.insert(euid, n);
-        }
-    } else {
-        p.text(pos2(x0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Histogram"), Tokens::ui(12.0), t.text_dim);
-    }
-    let w = (r.width() - 72.0).clamp(120.0, 256.0);
-    let hr = Rect::from_min_size(pos2(x0 + 8.0, r.min.y + 34.0), vec2(w, 80.0));
-    match frame_histogram(app, ui.ctx()) {
-        // Channel 0 (RGB) shows luminance; the others their own channel.
-        Some(h) => fw::draw_histogram(p, hr, &h[ch], channel_color(ch)),
-        None => {
-            p.rect_filled(hr, 0.0, Color32::from_rgb(0x1c, 0x1c, 0x1c));
-        }
-    }
-    app.auto.add(&format!("effectControls.effect.{euid}.levels.histogram"), hr, "Histogram");
-    let ids = levels_ids(effect, ch);
-    let val = |id: &str| g.prop(id).map(|pr| ectx.value(layer, pr).as_f64()).unwrap_or(0.0);
-    let (ib, iw, gm, ob, ow) = (val(&ids[0]), val(&ids[1]), val(&ids[2]), val(&ids[3]), val(&ids[4]));
-    let mut set = |ui: &egui::Ui, id: &str, v: f64, started: bool| {
-        if let Some(pr) = g.prop(id) {
-            let key = gesture_key(ui, egui::Id::new(("ec-lv", euid, id)), started);
-            actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": pr.uid, "value": v, "merge": key})));
-        }
-    };
-    let track = Rect::from_min_size(pos2(hr.min.x, hr.max.y + 1.0), vec2(w, 10.0));
-    let started = |ui: &egui::Ui| ui.input(|i| i.pointer.any_pressed());
-    let (r0, nv) = fw::level_handle(ui, track, ib, Color32::BLACK, egui::Id::new(("ec-lib", euid, ch)), &t);
-    app.auto.add(&format!("effectControls.effect.{euid}.levels.inBlack"), r0, "Input Black");
-    if let Some(v) = nv {
-        set(ui, &ids[0], v.min(iw - 0.005), started(ui));
-    }
-    let gx = fw::gamma_handle(ib, iw, gm);
-    let (r1, nv) = fw::level_handle(ui, track, gx, Color32::from_gray(128), egui::Id::new(("ec-lg", euid, ch)), &t);
-    app.auto.add(&format!("effectControls.effect.{euid}.levels.gamma"), r1, "Gamma");
-    if let Some(v) = nv {
-        set(ui, &ids[2], (fw::gamma_from_handle(ib, iw, v) * 100.0).round() / 100.0, started(ui));
-    }
-    let (r2, nv) = fw::level_handle(ui, track, iw, Color32::WHITE, egui::Id::new(("ec-liw", euid, ch)), &t);
-    app.auto.add(&format!("effectControls.effect.{euid}.levels.inWhite"), r2, "Input White");
-    if let Some(v) = nv {
-        set(ui, &ids[1], v.max(ib + 0.005), started(ui));
-    }
-    // Output: a black→white bar with its two triangles.
-    let bar = Rect::from_min_size(pos2(hr.min.x, track.max.y + 10.0), vec2(w, 9.0));
-    let n = 32;
-    for k in 0..n {
-        let v = (k as f32 / (n - 1) as f32 * 255.0) as u8;
-        let x0 = bar.min.x + bar.width() * k as f32 / n as f32;
-        let x1 = bar.min.x + bar.width() * (k + 1) as f32 / n as f32;
-        p.rect_filled(Rect::from_min_max(pos2(x0, bar.min.y), pos2(x1, bar.max.y)), 0.0, Color32::from_gray(v));
-    }
-    let otrack = Rect::from_min_size(pos2(bar.min.x, bar.max.y + 1.0), vec2(w, 10.0));
-    let (r3, nv) = fw::level_handle(ui, otrack, ob, Color32::BLACK, egui::Id::new(("ec-lob", euid, ch)), &t);
-    app.auto.add(&format!("effectControls.effect.{euid}.levels.outBlack"), r3, "Output Black");
-    if let Some(v) = nv {
-        set(ui, &ids[3], v, started(ui));
-    }
-    let (r4, nv) = fw::level_handle(ui, otrack, ow, Color32::WHITE, egui::Id::new(("ec-low", euid, ch)), &t);
-    app.auto.add(&format!("effectControls.effect.{euid}.levels.outWhite"), r4, "Output White");
-    if let Some(v) = nv {
-        set(ui, &ids[4], v, started(ui));
-    }
-}
-
-/// Auto Levels / Auto Contrast / Auto Color: the histogram they work from.
-fn histogram_only(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, g: &PropGroup, r: Rect) {
-    let t = app.tokens;
-    let x0 = r.min.x + 30.0;
-    p.text(pos2(x0, r.min.y + 12.0), Align2::LEFT_CENTER, crate::i18n::tr("Histogram"), Tokens::ui(12.0), t.text_dim);
-    let w = (r.width() - 72.0).clamp(120.0, 256.0);
-    let hr = Rect::from_min_size(pos2(x0 + 8.0, r.min.y + 24.0), vec2(w, 80.0));
-    match frame_histogram(app, ui.ctx()) {
-        Some(h) => {
-            fw::draw_histogram(p, hr, &h[1], channel_color(1).gamma_multiply(0.6));
-            fw::draw_histogram_overlay(p, hr, &h[2], channel_color(2).gamma_multiply(0.6));
-            fw::draw_histogram_overlay(p, hr, &h[3], channel_color(3).gamma_multiply(0.6));
-        }
-        None => {
-            p.rect_filled(hr, 0.0, Color32::from_rgb(0x1c, 0x1c, 0x1c));
-        }
-    }
-    app.auto.add(&format!("effectControls.effect.{}.histogram", g.uid), hr, "Histogram");
-}
-
-// ---------------------------------------------------------------------------------------------
-
-/// Open the rename field on effect `uid` (Enter with the effect selected), name selected.
-pub fn start_rename(ctx: &egui::Context, uid: u64, name: &str) {
-    let id = egui::Id::new(("ec-rename", uid));
-    ctx.data_mut(|d| d.insert_temp(id, name.to_string()));
-    ctx.data_mut(|d| d.insert_temp(id.with("select"), true));
-    ctx.memory_mut(|m| m.request_focus(id.with("field")));
-}
-
-pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
-    let t = app.tokens;
-    let p = ui.painter().with_clip_rect(rect);
-    let ctx = ui.ctx().clone();
-    let Some(layer) = selected_layer(app) else {
-        p.text(rect.center(), Align2::CENTER_CENTER, crate::i18n::tr("Select a layer to see its effects"), Tokens::ui(12.0), t.text_faint);
-        return;
-    };
-    let Some(cid) = app.session.active_comp_id() else { return };
-    let comp = app.session.project.comp_arc(cid).unwrap_or_else(|| effectcraft_engine::project::Comp::new(1, 1, Default::default(), Default::default()).into());
-    let comp_name = app.session.project.item(cid).map(|i| i.name.clone()).unwrap_or_default();
-    let snap_project = app.session.project.clone();
-    let snap_expr = app.session.expr.clone();
-    let ectx = EvalCtx { project: &snap_project, comp_id: cid, comp: &comp, time: app.session.time(), expr: snap_expr.as_deref(), footage: None };
-    let hdr = Rect::from_min_size(rect.min, vec2(rect.width(), 24.0));
-    p.text(pos2(hdr.min.x + 10.0, hdr.center().y), Align2::LEFT_CENTER, format!("{} • {}", comp_name, layer.name), Tokens::ui(11.5), t.text_dim);
-    p.line_segment([hdr.left_bottom(), hdr.right_bottom()], Stroke::new(1.0, t.separator));
-    let body = Rect::from_min_max(pos2(rect.min.x, hdr.max.y), rect.max);
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("ec-scroll"), body);
-    let mut y = body.min.y + 4.0 - scroll.offset;
-    let mut actions: Actions = vec![];
-    let bp = p.with_clip_rect(body);
-    // Rows scroll under the header: clip their widgets (and hit tests) to the body.
-    let panel_clip = ui.clip_rect();
-    ui.set_clip_rect(body.intersect(panel_clip));
-    let fx: Vec<PropGroup> = layer.effects().map(|f| f.groups().cloned().collect()).unwrap_or_default();
-    if fx.is_empty() {
-        bp.text(
-            pos2(body.center().x, body.min.y + 40.0),
-            Align2::CENTER_CENTER,
-            "No effects. Drag one from Effects & Presets.",
-            Tokens::ui(12.0),
-            t.text_faint,
-        );
-    }
-    // Clicking empty space deselects the effects.
-    let bg = ui.interact(body, egui::Id::new("ec-bg"), Sense::click());
-    if bg.clicked() {
-        app.session.state.selected_props.retain(|(l, u)| !(*l == layer.id && fx.iter().any(|g| effect_active(g, layer.id, &[(*l, *u)]))));
-    }
-    let has_clip = !app.session.state.effect_clipboard.is_empty();
-    let drag_id = egui::Id::new("ec-drag-effect");
-    let dragging: Option<u64> = ctx.data(|d| d.get_temp(drag_id));
-    // Header tops, for drag-to-reorder.
-    let mut tops: Vec<(u64, f32)> = vec![];
-    for (fi, g) in fx.iter().enumerate() {
-        let GroupKind::Effect { effect } = &g.kind else { continue };
-        // The header draws the effect's name in the interface language; the automation labels
-        // below keep the property tree's name, which is the registry's English name (#821).
-        let shown = crate::i18n::effects::group(effect, &g.name);
-        let r = Rect::from_min_size(pos2(body.min.x, y), vec2(body.width(), ROW + 2.0));
-        tops.push((g.uid, r.min.y));
-        y += ROW + 2.0;
-        let open = !app.ui.fx_closed.contains(&g.uid);
-        let selected = app.session.state.selected_props.iter().any(|(l, u)| *l == layer.id && *u == g.uid);
-        let active = effect_active(g, layer.id, &app.session.state.selected_props);
-        bp.rect_filled(r, 0.0, if active { t.fx_header_active } else { t.fx_header });
-        // The effect's colour label (26.5): a bar on the header's left edge.
-        if let Some(lab) = g.label.filter(|l| *l != effectcraft_engine::color::Label::None) {
-            let [lr, lg, lb] = app.session.prefs.label_rgb(lab);
-            bp.rect_filled(Rect::from_min_size(r.min, vec2(4.0, r.height())), 0.0, Color32::from_rgb(lr, lg, lb));
-            app.auto.add(
-                &format!("effectControls.effect.{}.label", g.uid),
-                Rect::from_min_size(r.min, vec2(4.0, r.height())),
-                &app.session.prefs.label_name(lab),
-            );
-        }
-        let fxr = Rect::from_center_size(pos2(r.min.x + 14.0, r.center().y), vec2(16.0, 16.0));
-        if widgets::icon_toggle(ui, fxr, Icon::Fx, g.enabled, &t, egui::Id::new(("ec-fx", g.uid)), Sense::click()).clicked() {
-            actions.push(("effect.toggle".into(), json!({"layer": layer.id.0, "effect": g.uid})));
-        }
-        app.auto.add(&format!("effectControls.effect.{}.fx", g.uid), fxr, &g.name);
-        let tw = Rect::from_center_size(pos2(r.min.x + 32.0, r.center().y), vec2(12.0, 12.0));
-        if widgets::twirl(ui, tw, open, egui::Id::new(("ec-tw", g.uid)), &t).clicked() {
-            toggle_closed(app, g, open, ui.input(|i| i.modifiers.alt || i.modifiers.command));
-        }
-        app.auto.add(&format!("effectControls.effect.{}.twirl", g.uid), tw, &g.name);
-        let rename_id = egui::Id::new(("ec-rename", g.uid));
-        let editing: Option<String> = ctx.data(|d| d.get_temp(rename_id));
-        let reset = Rect::from_min_size(pos2(r.max.x - 96.0, r.center().y - 9.0), vec2(40.0, 18.0));
-        if let Some(mut value) = editing.as_ref().cloned() {
-            let name_rect = Rect::from_min_max(pos2(tw.max.x + 6.0, r.min.y + 2.0), pos2(reset.min.x - 6.0, r.max.y - 2.0));
-            let response = ui.put(name_rect, egui::TextEdit::singleline(&mut value).id(rename_id.with("field")).font(Tokens::semibold(12.0)));
-            // Focus the field the frame it first exists: focusing an id not yet on screen leaves
-            // the accessibility tree with a focus it doesn't contain.
-            if ctx.data_mut(|d| d.remove_temp::<bool>(rename_id.with("start"))).is_some() {
-                crate::widgets::select_all(&ctx, response.id, &value);
-                response.request_focus();
-            }
-            app.auto.add(&format!("effectControls.effect.{}.nameEdit", g.uid), name_rect, "Effect name");
-            if ctx.data_mut(|d| d.remove_temp::<bool>(rename_id.with("select"))).unwrap_or(false) {
-                widgets::select_all(&ctx, response.id, &value);
-            }
-            // Escape cancels. egui drops the field's focus on Escape in the same frame, so the
-            // key is checked on the focus being lost as well as held.
-            let escape = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
-            let commit = response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)));
-            if escape || commit {
-                ctx.data_mut(|d| d.remove::<String>(rename_id));
-                // The field opens with the drawn name, so committing it unchanged is not a rename.
-                if !escape && !value.trim().is_empty() && value != shown {
-                    actions.push(("prop.renameGroup".into(), json!({"layer": layer.id.0, "prop": g.uid, "name": value})));
-                }
-            } else {
-                ctx.data_mut(|d| d.insert_temp(rename_id, value));
-            }
-        } else {
-            let name = bp.text(pos2(tw.max.x + 6.0, r.center().y), Align2::LEFT_CENTER, &shown, Tokens::semibold(12.0), t.text);
-            app.auto.add(&format!("effectControls.effect.{}.name", g.uid), name, &g.name);
-        }
-        let rresp = ui.interact(reset, egui::Id::new(("ec-reset", g.uid)), Sense::click());
-        bp.text(reset.center(), Align2::CENTER_CENTER, crate::i18n::tr("Reset"), Tokens::ui(11.5), if rresp.hovered() { t.hot_text } else { t.text_dim });
-        app.auto.add(&format!("effectControls.effect.{}.reset", g.uid), reset, "Reset");
-        if rresp.clicked() {
-            actions.push(("effect.reset".into(), json!({"layer": layer.id.0, "effect": g.uid})));
-        }
-        // About…: the effect's name and category (AE's About dialog).
-        let about = Rect::from_min_size(pos2(r.max.x - 50.0, r.center().y - 9.0), vec2(44.0, 18.0));
-        let aresp = ui.interact(about, egui::Id::new(("ec-about", g.uid)), Sense::click());
-        bp.text(about.center(), Align2::CENTER_CENTER, crate::i18n::tr("About..."), Tokens::ui(11.5), if aresp.hovered() { t.hot_text } else { t.text_dim });
-        app.auto.add(&format!("effectControls.effect.{}.about", g.uid), about, "About");
-        let apop = egui::Id::new(("ec-about-pop", g.uid));
-        if aresp.clicked() {
-            widgets::open_popup(ui, apop);
-        }
-        if let Some(spec) = effectcraft_engine::effects::find(effect) {
-            let lines = vec![
-                crate::i18n::effects::name(spec.id, spec.name),
-                format!("Category: {}", crate::i18n::effects::category(spec.category)),
-                "EffectCraft built-in effect (MIT OR Apache-2.0)".to_string(),
-            ];
-            let _ = widgets::popup_menu(ui, apop, about.left_bottom(), &lines, None);
-        }
-        let hresp = ui.interact(
-            Rect::from_min_max(pos2(tw.max.x, r.min.y), pos2(reset.min.x - 4.0, r.max.y)),
-            egui::Id::new(("ec-hdr", g.uid)),
-            if editing.is_some() { Sense::hover() } else { Sense::click_and_drag() },
-        );
-        if hresp.double_clicked() {
-            ctx.data_mut(|d| d.insert_temp(rename_id, shown.clone()));
-            ctx.data_mut(|d| d.insert_temp(rename_id.with("start"), true));
-        }
-        hresp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, active, &shown));
-        app.auto.add(&format!("effectControls.effect.{}", g.uid), r, &g.name);
-        if hresp.clicked() || hresp.drag_started() || hresp.secondary_clicked() {
-            let add = ui.input(|i| i.modifiers.shift || i.modifiers.command);
-            if add && hresp.clicked() {
-                if selected {
-                    app.session.state.selected_props.retain(|(l, u)| !(*l == layer.id && *u == g.uid));
-                } else {
-                    app.session.state.selected_props.push((layer.id, g.uid));
-                }
-            } else if !selected || hresp.clicked() {
-                app.session.state.selected_props = vec![(layer.id, g.uid)];
-            }
-        }
-        if hresp.drag_started() {
-            ctx.data_mut(|d| d.insert_temp(drag_id, g.uid));
-        }
-        crate::widgets::context_menu(&hresp, |ui| {
-            let lid = layer.id.0;
-            let mut picked_label: Option<usize> = None;
-            let mut item = |ui: &mut egui::Ui, label: &str, enabled: bool, cmd: &str, params: serde_json::Value| {
-                if ui.add_enabled(enabled, egui::Button::new(crate::i18n::context_item(cmd, &params, label))).clicked() {
-                    actions.push((cmd.into(), params));
-                    ui.close();
-                }
-            };
-            item(ui, "Copy", true, "effect.copy", json!({"layer": lid, "effect": g.uid}));
-            item(ui, "Paste", has_clip, "effect.paste", json!({"layers": [lid]}));
-            item(ui, "Duplicate", true, "effect.duplicate", json!({"layer": lid, "effect": g.uid}));
-            if ui.button(crate::i18n::tr("Rename")).clicked() {
-                ctx.data_mut(|d| d.insert_temp(rename_id, shown.clone()));
-                ctx.data_mut(|d| d.insert_temp(rename_id.with("start"), true));
-                ui.close();
-            }
-            ui.separator();
-            ui.menu_button(crate::i18n::tr("Label"), |ui| {
-                let cur = g.label.unwrap_or(effectcraft_engine::color::Label::None);
-                for (i, l) in effectcraft_engine::color::Label::ALL.into_iter().enumerate() {
-                    if widgets::label_entry(ui, l, &app.session.prefs.label_name(l), l == cur, &t).clicked() {
-                        picked_label = Some(i);
-                        ui.close();
-                    }
-                }
-            });
-            item(ui, "Reset", true, "effect.reset", json!({"layer": lid, "effect": g.uid}));
-            item(ui, "Remove", true, "effect.remove", json!({"layer": lid, "effect": g.uid}));
-            ui.separator();
-            item(ui, "Move Up", fi > 0, "effect.reorder", json!({"layer": lid, "effect": g.uid, "index": fi.max(1)}));
-            item(ui, "Move Down", fi + 1 < fx.len(), "effect.reorder", json!({"layer": lid, "effect": g.uid, "index": fi + 2}));
-            if let Some(i) = picked_label {
-                actions.push(("effect.setLabel".into(), json!({"layer": lid, "effect": g.uid, "label": i})));
-            }
-        });
-        // What the effect can't render as asked (an OCIO config it can't read, transforms it
-        // passes through), under its name.
-        if let Some(w) = effectcraft_engine::effects::warning(g, &mut |pr| ectx.value(&layer, pr)) {
-            let galley = bp.layout(format!("⚠ {w}"), Tokens::ui(11.0), t.warning, (body.width() - 20.0).max(60.0));
-            let wr = Rect::from_min_size(pos2(body.min.x + 10.0, y + 3.0), galley.size());
-            bp.galley(wr.min, galley, t.warning);
-            app.auto.add(&format!("effectControls.effect.{}.warning", g.uid), wr, &w);
-            y += wr.height() + 6.0;
-        }
-        if open {
-            let eh = editor_height(effect, g, body.width());
-            if eh > 0.0 {
-                let er = Rect::from_min_size(pos2(body.min.x, y), vec2(body.width(), eh));
-                y += eh;
-                if er.max.y >= body.min.y && er.min.y <= body.max.y {
-                    // Curves, Levels and other custom editors do not use prop_row.
-                    // Clicking their controls must activate the owner as well.
-                    if ui.input(|i| i.pointer.primary_pressed()) && ui.rect_contains_pointer(er) {
-                        actions.push(("prop.select".into(), json!({"layer":layer.id.0,"prop":g.uid})));
-                    }
-                    match effect.as_str() {
-                        "ec.color.curves" => curves_editor(app, ui, &bp, &layer, g, &ectx, er, &mut actions),
-                        effectcraft_engine::effects::warp_stab::ID => warp_editor(app, ui, &bp, &layer, g, er, &mut actions),
-                        effectcraft_engine::effects::camera_tracker::ID => super::camera_tracker_ui::editor(app, ui, &bp, &layer, g, er, &mut actions),
-                        effectcraft_engine::effects::roto::ID => roto_editor(app, ui, &bp, &layer, g, er, &mut actions),
-                        effectcraft_engine::effects::object_matte::ID => object_matte_editor(app, ui, &bp, &layer, g, er, &mut actions),
-                        "ec.color.levels" | "ec.color.levelsic" => levels_editor(app, ui, &bp, &layer, g, effect, &ectx, er, &mut actions),
-                        super::fx_editors::GLOW | super::fx_editors::RESHAPE | super::fx_editors::EXTRACTOR => {
-                            super::fx_editors::header_editor(app, ui, &bp, &layer, g, effect, &ectx, er, &mut actions)
-                        }
-                        _ => histogram_only(app, ui, &bp, g, er),
-                    }
-                }
-            }
-            let scope = FxScope { effect: effect.as_str(), root: g, path: String::new() };
-            group_rows(app, ui, &bp, &layer, g, &ectx, body, &mut y, 0, &scope, &mut actions);
-            if effect == "ec.color.tint" {
-                let r = Rect::from_min_size(pos2(body.min.x + PARAM_NAME_X, y + 2.0), vec2(120.0, ROW));
-                let label = crate::i18n::tr("Swap Colors");
-                let resp = widgets::text_button(ui, r, label, false, &t, egui::Id::new(("ec-tint-swap", g.uid)));
-                app.auto.add_response(&format!("effectControls.effect.{}.swapColors", g.uid), &resp, label);
-                if resp.clicked() {
-                    actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": g.uid})));
-                    actions.push(("effect.swapTintColors".into(), json!({"layer": layer.id.0, "effect": g.uid})));
-                }
-                y += ROW + 4.0;
-            }
-        }
-        y += 4.0;
-    }
-    // Drag an effect header to reorder: insertion line between headers.
-    if let Some(du) = dragging {
-        if let Some(pos) = ctx.pointer_interact_pos() {
-            let slot = tops.iter().position(|(_, ty)| pos.y < *ty + (ROW + 2.0) / 2.0).unwrap_or(tops.len());
-            let ly = tops.get(slot).map(|(_, ty)| *ty).unwrap_or(y - 4.0);
-            bp.line_segment([pos2(body.min.x + 4.0, ly), pos2(body.max.x - 4.0, ly)], Stroke::new(2.0, t.accent));
-            if ctx.input(|i| i.pointer.any_released()) {
-                if let Some(from) = tops.iter().position(|(u, _)| *u == du) {
-                    let to = if slot > from { slot - 1 } else { slot };
-                    if to != from {
-                        actions.push(("effect.reorder".into(), json!({"layer": layer.id.0, "effect": du, "index": to + 1})));
-                    }
-                }
-                ctx.data_mut(|d| d.remove::<u64>(drag_id));
-            }
-        }
-        if !ctx.input(|i| i.pointer.any_down()) {
-            ctx.data_mut(|d| d.remove::<u64>(drag_id));
-        }
-    }
-    // Right-click anywhere a control has no menu of its own: the Effect menu, which applies to
-    // the selected layers (After Effects). Drawn after the rows, whose menus open first.
-    let menu_id = bg.id.with("effect-menu");
-    let open = ui.input(|i| i.pointer.secondary_clicked())
-        && ui.rect_contains_pointer(body)
-        && (!egui::Popup::is_any_open(&ctx) || egui::Popup::is_id_open(&ctx, menu_id));
-    egui::Popup::context_menu(&bg).style(crate::widgets::menu_style).id(menu_id).open_memory(open.then_some(egui::SetOpenCommand::Bool(true))).show(|ui| {
-        ui.set_min_width(200.0);
-        actions.extend(crate::menus::menu_contents(app, ui, "Effect"));
-    });
-    ui.set_clip_rect(panel_clip);
-    let content_h = y + scroll.offset - body.min.y;
-    scroll.end(ui, &mut app.auto, "effectControls.scroll", content_h, &t);
-    // Drop effects and animation presets here.
-    if let Some(payload) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx)
-        && ui.rect_contains_pointer(rect)
-        && let Some((id, params)) = match payload.as_ref() {
-            crate::panels::DragPayload::Effect(e) => Some(("effect.apply", json!({"effect": e, "layers": [layer.id.0]}))),
-            crate::panels::DragPayload::Preset { preset, .. } => Some(preset.apply_to(layer.id.0)),
-            _ => None,
-        }
-    {
-        p.rect_stroke(rect, 0.0, Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
-        if ctx.input(|i| i.pointer.any_released()) {
-            actions.push((id.into(), params));
-            egui::DragAndDrop::clear_payload(&ctx);
-        }
-    }
-    if ui.input(|i| i.pointer.primary_down()) && actions.iter().any(|(id, _)| id == "prop.set") {
-        app.ui.viewer.property_interacting = true;
-        ctx.request_repaint();
-    }
-    for (id, params) in actions {
-        if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
-            app.ui.status = e;
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------------------------
-// Viewer hook
-
-/// Collect point controls through visible parameter groups. Hidden optional slots do not
-/// leave stray viewport handles. The depth cap also bounds malformed project trees.
-fn visible_points<'a>(g: &'a PropGroup, scope: &FxScope<'_>, layer: &Layer, ectx: &EvalCtx, depth: usize, out: &mut Vec<&'a Property>) {
-    if depth > 16 {
-        return;
-    }
-    for node in &g.children {
-        match node {
-            Node::Prop(p) if matches!(p.ui, ParamUi::Point) && scope.shown(layer, ectx, &p.match_id) => out.push(p),
-            Node::Group(child) if child.enabled && scope.shown(layer, ectx, &child.match_id) => {
-                visible_points(child, &scope.sub(&child.match_id), layer, ectx, depth + 1, out)
-            }
-            _ => {}
-        }
-    }
-}
-
-/// Effect Controls' part of the Composition viewer, called by the viewer after its own
-/// interaction (so these controls sit on top):
-///
-/// - while a crosshair pick is armed, its handle previews the cursor position without editing
-///   the property; the next click sets the point in layer space, and Esc cancels;
-/// - an eyedropper pick samples the frame's colour on click;
-/// - otherwise, the point parameters of the selected effects are drawn as draggable ⊕ controls.
-///
-/// `l2c` is the viewer's layer→comp matrix (it knows the 3D view).
-pub fn viewer_hook(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    painter: &egui::Painter,
-    map: &super::viewer::ViewerMap,
-    ectx: &EvalCtx,
-    l2c: &dyn Fn(&EvalCtx, &Layer) -> Mat3,
-) {
-    let t = app.tokens;
-    let ctx = ui.ctx().clone();
-    let mut actions: Actions = vec![];
-    let mut point_preview = None;
-    if let Some(pick) = app.ui.fx_pick.clone() {
-        let Some(layer) = ectx.comp.layer(effectcraft_engine::project::LayerId(pick.layer)).cloned() else {
-            app.ui.fx_pick = None;
-            return;
-        };
-        // Keyers pick from their input (the shown frame is already keyed): `effect.pickColor`.
-        let keyer = (pick.kind == "color")
-            .then(|| layer.effects()?.groups().find(|g| g.find(pick.prop).is_some()))
-            .flatten()
-            .filter(|g| effectcraft_engine::effects::find(&g.match_id).is_some_and(|s| s.category == "Keying"))
-            .map(|g| g.uid);
-        if pick.kind == "color" && keyer.is_none() {
-            // GPU frames: read the shown frame back for sampling.
-            app.viewer_pixels();
-        }
-        let resp = ui.interact(map.area, egui::Id::new("viewer-fx-pick"), Sense::click());
-        app.auto.add("viewer.fxPick", map.area, &pick.name);
-        let hint = if pick.kind == "point" { format!("Click to set {}", pick.name) } else { format!("Click to sample {}", pick.name) };
-        let chip = Rect::from_min_size(map.area.min + vec2(10.0, 10.0), vec2(220.0, 22.0));
-        painter.rect_filled(chip, 11.0, Color32::from_black_alpha(180));
-        painter.text(chip.center(), Align2::CENTER_CENTER, hint, Tokens::ui(11.5), t.text);
-        if let Some(hp) = resp.hover_pos() {
-            ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
-            let c = map.to_comp(hp);
-            app.pointer_comp = Some([c[0] as f32, c[1] as f32]);
-            if pick.kind == "point" && fw::comp_to_layer(&l2c(ectx, &layer), c).is_some() {
-                point_preview = Some(hp);
-            }
-            if pick.kind == "color"
-                && keyer.is_none()
-                && let Some(img) = &app.viewer_image
-                && let Some(s) = fw::sample_frame(img, super::viewer_tools::shown_region(&ctx, map.comp), c)
-            {
-                let sw = Rect::from_min_size(hp + vec2(14.0, 14.0), vec2(26.0, 18.0));
-                painter.rect_filled(sw, 2.0, Color32::from_rgb((s[0] * 255.0) as u8, (s[1] * 255.0) as u8, (s[2] * 255.0) as u8));
-                painter.rect_stroke(sw, 2.0, Stroke::new(1.0, Color32::WHITE), egui::StrokeKind::Outside);
-            }
-        }
-        // No frame to sample yet (it is still rendering, or its readback is pending): the click
-        // leaves the eyedropper armed instead of using it up without a colour.
-        let unsampled = pick.kind == "color" && keyer.is_none() && app.viewer_image.is_none();
-        if resp.clicked()
-            && !unsampled
-            && let Some(pos) = resp.interact_pointer_pos()
-        {
-            let c = map.to_comp(pos);
-            // Effect points and the keyer's input are in effect space.
-            let m = super::viewer::from_effect_space(ectx, &layer, l2c(ectx, &layer));
-            if pick.kind == "point" {
-                if let Some(lp) = fw::comp_to_layer(&m, c) {
-                    actions.push(("prop.set".into(), json!({"layer": pick.layer, "prop": pick.prop, "value": [lp[0], lp[1]]})));
-                }
-            } else if let Some(fx) = keyer {
-                // Ctrl/Cmd+click averages the 5 × 5 pixels around the point.
-                if let Some(lp) = fw::comp_to_layer(&m, c) {
-                    let average = ui.input(|i| i.modifiers.command);
-                    actions.push((
-                        "effect.pickColor".into(),
-                        json!({"layer": pick.layer, "effect": fx, "prop": pick.prop, "x": lp[0], "y": lp[1], "average": average}),
-                    ));
-                }
-            } else if let Some(img) = &app.viewer_image
-                && let Some(s) = fw::sample_frame(img, super::viewer_tools::shown_region(&ctx, map.comp), c)
-            {
-                actions.push(("prop.set".into(), json!({"layer": pick.layer, "prop": pick.prop, "value": [s[0], s[1], s[2], 1.0]})));
-            }
-            app.ui.fx_pick = None;
-            app.ui.status.clear();
-        }
-        if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-            app.ui.fx_pick = None;
-            app.ui.status.clear();
-        }
-    }
-    if let Some(pick) = app.ui.text_color_pick.clone() {
-        if ectx.comp.layer(effectcraft_engine::project::LayerId(pick.layer)).is_none() {
-            app.ui.text_color_pick = None;
-            app.ui.status.clear();
-        } else {
-            app.viewer_pixels();
-            let resp = ui.interact(map.area, egui::Id::new("viewer-text-color-pick"), Sense::click());
-            app.auto.add("viewer.textColorPick", map.area, &pick.field);
-            let chip = Rect::from_min_size(map.area.min + vec2(10.0, 10.0), vec2(220.0, 22.0));
-            painter.rect_filled(chip, 11.0, Color32::from_black_alpha(180));
-            painter.text(chip.center(), Align2::CENTER_CENTER, crate::i18n::tr_args("Click to sample text {}", &[&pick.field]), Tokens::ui(11.5), t.text);
-            if let Some(pos) = resp.hover_pos() {
-                ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
-                let c = map.to_comp(pos);
-                app.pointer_comp = Some([c[0] as f32, c[1] as f32]);
-                if let Some(img) = &app.viewer_image
-                    && let Some(s) = fw::sample_frame(img, super::viewer_tools::shown_region(&ctx, map.comp), c)
-                {
-                    let sw = Rect::from_min_size(pos + vec2(14.0, 14.0), vec2(26.0, 18.0));
-                    painter.rect_filled(sw, 2.0, Color32::from_rgb((s[0] * 255.0) as u8, (s[1] * 255.0) as u8, (s[2] * 255.0) as u8));
-                    painter.rect_stroke(sw, 2.0, Stroke::new(1.0, Color32::WHITE), egui::StrokeKind::Outside);
-                }
-            }
-            if resp.clicked()
-                && let Some(pos) = resp.interact_pointer_pos()
-                && let Some(img) = &app.viewer_image
-                && let Some(s) = fw::sample_frame(img, super::viewer_tools::shown_region(&ctx, map.comp), map.to_comp(pos))
-            {
-                let mut params = json!({"layer": pick.layer});
-                params[&pick.field] = json!([s[0], s[1], s[2]]);
-                if let Some(range) = pick.range {
-                    params["range"] = json!(range);
-                }
-                actions.push(("layer.setText".into(), params));
-                app.ui.text_color_pick = None;
-                app.ui.status.clear();
-            }
-            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                app.ui.text_color_pick = None;
-                app.ui.status.clear();
-            }
-        }
-    }
-    let picking = app.ui.fx_pick.is_some() || app.ui.text_color_pick.is_some();
-    let point_pick = app.ui.fx_pick.clone().filter(|p| p.kind == "point");
-    if app.ui.viewer.show_layer_controls || point_pick.is_some() {
-        // ⊕ controls for the point parameters of the selected effects.
-        let mut sel = app.session.state.selected_props.clone();
-        if let Some(pick) = &point_pick {
-            sel.push((effectcraft_engine::project::LayerId(pick.layer), pick.prop));
-        }
-        let selected = app.session.state.selected_layers.clone();
-        for layer in ectx
-            .comp
-            .layers
-            .iter()
-            .filter(|l| (selected.contains(&l.id) || point_pick.as_ref().is_some_and(|p| p.layer == l.id.0)) && l.is_active_at(ectx.time))
-        {
-            let Some(fx) = layer.effects() else { continue };
-            let m = l2c(ectx, layer);
-            // Masks are in layer space, effect points in effect space.
-            let fm = super::viewer::from_effect_space(ectx, layer, m);
-            let picked_prop = point_pick.as_ref().filter(|p| p.layer == layer.id.0).map(|p| p.prop);
-            for g in fx.groups().filter(|g| g.enabled && effect_active(g, layer.id, &sel)) {
-                // Puppet owns its pin handles and hit testing. Generic crosshairs would
-                // overlap the pins and steal their selection/rotation/scale gestures.
-                if matches!(&g.kind, GroupKind::Effect { effect } if effect == effectcraft_engine::effects::puppet::ID) {
-                    continue;
-                }
-                if !picking && app.ui.viewer.show_layer_controls && matches!(&g.kind, GroupKind::Effect { effect } if effect == super::fx_editors::RESHAPE) {
-                    super::fx_editors::reshape_overlay(app, ui, painter, map, ectx, layer, g, &m, &mut actions);
-                }
-                if !picking && app.ui.viewer.show_layer_controls && matches!(&g.kind, GroupKind::Effect { effect } if effect == super::fx_editors::MESH_WARP) {
-                    super::fx_editors::mesh_warp_overlay(app, ui, painter, map, ectx, layer, g, &fm, &mut actions);
-                }
-                let scope = FxScope { effect: &g.match_id, root: g, path: String::new() };
-                let mut pts = Vec::new();
-                visible_points(g, &scope, layer, ectx, 0, &mut pts);
-                // An explicit pick stays visible even when View > Show Layer Controls is off.
-                if !app.ui.viewer.show_layer_controls {
-                    pts.retain(|pr| picked_prop == Some(pr.uid));
-                }
-                let screen: Vec<egui::Pos2> = pts
-                    .iter()
-                    .map(|pr| {
-                        if picked_prop == Some(pr.uid)
-                            && let Some(pos) = point_preview
-                        {
-                            return pos;
-                        }
-                        let v = ectx.value(layer, pr).as_vec2();
-                        map.to_screen(fw::layer_to_comp(&fm, v))
-                    })
-                    .collect();
-                // Gradient Ramp and friends: a guide between start and end points.
-                if screen.len() == 2 && matches!(&g.kind, GroupKind::Effect { effect } if effect.contains("gradient") || effect.contains("ramp")) {
-                    painter.line_segment([screen[0], screen[1]], Stroke::new(1.0, Color32::from_white_alpha(110)));
-                }
-                for (pr, s) in pts.iter().zip(screen) {
-                    let hr = Rect::from_center_size(s, vec2(16.0, 16.0));
-                    let id = egui::Id::new(("viewer-fx-pt", pr.uid));
-                    // The picker owns the click. Preview handles must not steal it or start a drag.
-                    let resp = (!picking).then(|| ui.interact(hr, id, Sense::drag()));
-                    let col = if picked_prop == Some(pr.uid) || resp.as_ref().is_some_and(|r| r.hovered() || r.dragged()) { t.accent } else { Color32::WHITE };
-                    fw::draw_crosshair(painter, s + vec2(1.0, 1.0), 5.0, Color32::from_black_alpha(160));
-                    fw::draw_crosshair(painter, s, 5.0, col);
-                    app.auto.add(&format!("viewer.effectPoint.{}", pr.uid), hr, &pr.name);
-                    let Some(resp) = resp else { continue };
-                    if resp.hovered() {
-                        ctx.set_cursor_icon(egui::CursorIcon::Move);
-                        resp.clone().on_hover_text(format!("{}: {}", crate::i18n::effects::group(&g.match_id, &g.name), pr.name));
-                    }
-                    if resp.dragged()
-                        && let Some(pos) = resp.interact_pointer_pos()
-                        && let Some(lp) = fw::comp_to_layer(&fm, map.to_comp(pos))
-                    {
-                        let key = gesture_key(ui, id, resp.drag_started());
-                        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": pr.uid, "value": [lp[0], lp[1]], "merge": key})));
-                    }
-                }
-            }
-        }
-    }
-    for (id, params) in actions {
-        if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
-            app.ui.status = e;
-        }
-    }
-}
+pub(crate) use common::gesture_key;
+pub use common::{choose_files_after_apply, reveal_applied};
+pub use panel::{show, start_rename};
+pub(crate) use rows::toggle_pick;
+pub use viewer::viewer_hook;
diff --git a/crates/ui-egui/src/panels/effect_controls/common.rs b/crates/ui-egui/src/panels/effect_controls/common.rs
new file mode 100644
index 000000000..ab46a07ac
--- /dev/null
+++ b/crates/ui-egui/src/panels/effect_controls/common.rs
@@ -0,0 +1,109 @@
+use super::{EffectcraftApp, Layer, Node, ParamUi, PropGroup, Value, json};
+
+pub(super) type Actions = Vec<(String, serde_json::Value)>;
+
+pub(super) const ROW: f32 = 20.0;
+
+pub(super) const DIAL_ROW: f32 = 64.0;
+
+// The effect title starts at 44 pt. Each level's names sit one tree step farther in;
+// reserve the same icon gutter for properties and groups so sibling names align.
+pub(super) const PARAM_NAME_X: f32 = 58.0;
+
+pub(super) const TREE_INDENT: f32 = 14.0;
+
+/// Selecting any descendant activates its owning effect without replacing the property
+/// selection used by keyframe editing, copy and delete.
+pub(super) fn effect_active(g: &PropGroup, layer: effectcraft_engine::project::LayerId, selected: &[(effectcraft_engine::project::LayerId, u64)]) -> bool {
+    fn contains(g: &PropGroup, uid: u64, depth: usize) -> bool {
+        if g.uid == uid {
+            return true;
+        }
+        if depth >= 16 {
+            return false;
+        }
+        g.children.iter().any(|n| n.uid() == uid || matches!(n, Node::Group(child) if contains(child, uid, depth + 1)))
+    }
+    selected.iter().any(|(l, uid)| *l == layer && contains(g, *uid, 0))
+}
+
+pub(super) fn selected_layer(app: &EffectcraftApp) -> Option<Layer> {
+    let comp = app.session.active_comp()?;
+    let id = app.session.state.selected_layers.first()?;
+    comp.layer(*id).cloned()
+}
+
+/// An effect was just applied (`effect.apply` / `effect.applyLast` with `params`): Effect
+/// Controls comes up (opened if closed, brought to the front, the focus left where it is) on the
+/// layer the effect went to, with the new effect selected, as in After Effects.
+pub fn reveal_applied(app: &mut EffectcraftApp, params: &serde_json::Value) {
+    // `effect.apply` selects the new effect on (the last of) the layers it went to.
+    let target = app.session.state.selected_props.last().map(|(l, _)| *l);
+    if let Some(l) = target
+        && !app.session.state.selected_layers.contains(&l)
+        && params.get("comp").is_none()
+        && app.session.active_comp().is_some_and(|c| c.layer(l).is_some())
+    {
+        // Show that layer (dropped on an unselected one), keeping the new effect selected.
+        let props = app.session.state.selected_props.clone();
+        match app.session.execute("layer.select", json!({"layers": [l.0]})) {
+            Ok(_) => app.session.state.selected_props = props,
+            Err(e) => app.ui.status = e.to_string(),
+        }
+    }
+    app.raise_panel(crate::dock::PanelKind::EffectControls);
+}
+
+/// After Effects asks for an effect's file as it applies it (Apply Color LUT opens the file
+/// dialog for its LUT). For the instances `effect.apply` made (`applied`, its result), open the
+/// file dialog for their first empty file parameter and set the file on each; cancelling
+/// leaves the effect without one. Does nothing without a file dialog (tests, agents).
+pub fn choose_files_after_apply(app: &mut EffectcraftApp, applied: &serde_json::Value) {
+    let Some(pick) = app.hooks.pick_files.as_ref() else { return };
+    let Some(comp) = app.session.active_comp() else { return };
+    let uids: Vec<u64> = applied.get("effects").and_then(|v| v.as_array()).map(|a| a.iter().filter_map(|v| v.as_u64()).collect()).unwrap_or_default();
+    let mut targets = vec![];
+    let mut filters: Vec<String> = vec![];
+    for uid in uids {
+        for l in &comp.layers {
+            let Some(g) = l.props.find_group(uid) else { continue };
+            let mut found = None;
+            g.walk("", &mut |_, pr| {
+                if found.is_none()
+                    && let ParamUi::File { filters } = &pr.ui
+                    && matches!(&pr.value, Value::Str(s) if s.trim().is_empty())
+                {
+                    found = Some((pr.uid, filters.clone()));
+                }
+            });
+            if let Some((prop, f)) = found {
+                targets.push((l.id.0, prop));
+                filters = f;
+            }
+        }
+    }
+    if targets.is_empty() {
+        return;
+    }
+    let exts: Vec<&str> = filters.iter().map(String::as_str).collect();
+    let Some(path) = pick(&exts).into_iter().next() else { return };
+    for (layer, prop) in targets {
+        if let Err(e) = app.session.execute("prop.set", json!({"layer": layer, "prop": prop, "value": path})) {
+            app.ui.status = e.to_string();
+        }
+    }
+}
+
+/// An undo-merge key for one gesture on `id`: a new key each time a drag starts, so separate
+/// drags are separate undo steps while one drag is one step.
+pub(crate) fn gesture_key(ui: &egui::Ui, id: egui::Id, started: bool) -> String {
+    let kid = id.with("gesture");
+    let n: u64 = if started {
+        let n = ui.data(|d| d.get_temp::<u64>(kid)).unwrap_or(0) + 1;
+        ui.data_mut(|d| d.insert_temp(kid, n));
+        n
+    } else {
+        ui.data(|d| d.get_temp::<u64>(kid)).unwrap_or(0)
+    };
+    format!("{id:?}-{n}")
+}
diff --git a/crates/ui-egui/src/panels/effect_controls/editors.rs b/crates/ui-egui/src/panels/effect_controls/editors.rs
new file mode 100644
index 000000000..bcc0dfd88
--- /dev/null
+++ b/crates/ui-egui/src/panels/effect_controls/editors.rs
@@ -0,0 +1,380 @@
+use super::common::{Actions, gesture_key};
+use super::{Align2, Color32, EffectcraftApp, EvalCtx, Layer, PropGroup, Rect, Sense, Tokens, Value, fw, json, pos2, vec2, widgets};
+
+/// Warp Stabilizer's Analyze / Cancel buttons and analysis status.
+pub(super) fn warp_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, r: Rect, actions: &mut Actions) {
+    let t = app.tokens;
+    let running = app.session.warp_target().is_some_and(|(_, l, u)| l == layer.id && u == g.uid) && app.session.is_warp_analyzing();
+    let busy = app.session.is_warp_analyzing();
+    let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
+    let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
+    if widgets::text_button(ui, b1, crate::i18n::tr("Analyze"), false, &t, egui::Id::unique(("warp-analyze", g.uid))).clicked() && !busy {
+        actions.push(("warp.analyze".into(), json!({"layer": layer.id.0, "effect": g.uid})));
+    }
+    app.auto.add(&format!("effectControls.warp.{}.analyze", g.uid), b1, "Analyze");
+    if running {
+        if widgets::text_button(ui, b2, crate::i18n::tr("Cancel"), false, &t, egui::Id::unique(("warp-cancel", g.uid))).clicked() {
+            actions.push(("warp.cancel".into(), json!({})));
+        }
+        app.auto.add(&format!("effectControls.warp.{}.cancel", g.uid), b2, "Cancel");
+    }
+    let analysed = matches!(g.get(effectcraft_engine::effects::warp_stab::ANALYSIS).map(|p| &p.value), Some(Value::Str(s)) if !s.is_empty());
+    let status = match app.session.warp_progress() {
+        Some(pr) if running => pr.banner(),
+        _ if analysed => "Analysis complete".to_string(),
+        _ if app.session.warp_pending.iter().any(|(_, l, u)| *l == layer.id && *u == g.uid) => "Waiting to analyze".to_string(),
+        _ => "Not analyzed: click Analyze".to_string(),
+    };
+    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, status, Tokens::ui(11.5), t.text_dim);
+}
+
+/// Roto Brush & Refine Edge: Freeze / Unfreeze and Propagate buttons and the segmentation status.
+pub(super) fn roto_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, r: Rect, actions: &mut Actions) {
+    use effectcraft_engine::effects::roto as fx;
+    let t = app.tokens;
+    let params = effectcraft_engine::effects::flatten_params(g, &mut |pr| pr.value.clone());
+    let frozen = fx::is_frozen(&params);
+    let d = fx::data(&params);
+    let running = app.session.roto_target().is_some_and(|(_, l, u, _)| l == layer.id && u == g.uid) && app.session.is_roto_running();
+    let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
+    let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
+    let label = if frozen { "Unfreeze" } else { "Freeze" };
+    if widgets::text_button(ui, b1, label, frozen, &t, egui::Id::unique(("roto-freeze-ec", g.uid))).clicked() && !running {
+        let id = if frozen { "roto.unfreeze" } else { "roto.freeze" };
+        actions.push((id.into(), json!({"layer": layer.id.0, "effect": g.uid})));
+    }
+    app.auto.add(&format!("effectControls.roto.{}.freeze", g.uid), b1, label);
+    let (l2, id2) = if running { ("Stop", "roto.cancel") } else { ("Propagate", "roto.propagate") };
+    if widgets::text_button(ui, b2, l2, false, &t, egui::Id::unique(("roto-prop-ec", g.uid))).clicked() && !frozen {
+        actions.push((id2.into(), json!({"layer": layer.id.0, "effect": g.uid})));
+    }
+    app.auto.add(&format!("effectControls.roto.{}.propagate", g.uid), b2, l2);
+    let status = match (app.session.roto_progress(), d.base) {
+        (Some(pr), _) if running => pr.banner(),
+        (_, None) => "No strokes: paint with the Roto Brush tool (Alt+W) in the Layer panel".to_string(),
+        (_, Some(b)) => format!("Base frame {b}, span {}–{}{}", d.span[0], d.span[1], if frozen { " (frozen)" } else { "" }),
+    };
+    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, status, Tokens::ui(11.5), t.text_dim);
+}
+
+/// Object Matte: Freeze / Unfreeze and Track / Stop buttons (the background job that computes
+/// the matte over the tracked frames) and its status.
+pub(super) fn object_matte_editor(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    layer: &Layer,
+    g: &PropGroup,
+    r: Rect,
+    actions: &mut Actions,
+) {
+    use effectcraft_engine::effects::object_matte as om;
+    let t = app.tokens;
+    let params = effectcraft_engine::effects::flatten_params(g, &mut |pr| pr.value.clone());
+    let frozen = om::is_frozen(&params);
+    let mine = app.session.roto_target().is_some_and(|(_, l, u, _)| l == layer.id && u == g.uid);
+    let running = mine && app.session.is_roto_running();
+    let busy = app.session.is_roto_running();
+    let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
+    let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(84.0, 22.0));
+    let label = if frozen { "Unfreeze" } else { "Freeze" };
+    if widgets::text_button(ui, b1, crate::i18n::tr(label), frozen, &t, egui::Id::unique(("om-freeze-ec", g.uid))).clicked() && !busy {
+        let id = if frozen { "objectMatte.unfreeze" } else { "objectMatte.freeze" };
+        actions.push((id.into(), json!({"layer": layer.id.0, "effect": g.uid})));
+    }
+    app.auto.add(&format!("effectControls.objectMatte.{}.freeze", g.uid), b1, label);
+    let (l2, id2) = if running { ("Stop", "roto.cancel") } else { ("Track", "objectMatte.propagate") };
+    if widgets::text_button(ui, b2, crate::i18n::tr(l2), false, &t, egui::Id::unique(("om-track-ec", g.uid))).clicked() && !frozen && (running || !busy) {
+        actions.push((id2.into(), json!({"layer": layer.id.0, "effect": g.uid})));
+    }
+    app.auto.add(&format!("effectControls.objectMatte.{}.track", g.uid), b2, l2);
+    let base = om::reference_frame(&params);
+    let status = match app.session.roto_progress() {
+        Some(pr) if running => pr.banner(),
+        _ if frozen => format!("Frozen from reference frame {base}"),
+        _ if app.session.roto_pending.iter().any(|(_, l, u)| *l == layer.id && *u == g.uid) => "Waiting to track".to_string(),
+        _ => format!("Reference frame {base}: Track computes the matte ahead of playback"),
+    };
+    p.text(pos2(r.min.x + 24.0, r.min.y + 38.0), Align2::LEFT_CENTER, &status, Tokens::ui(11.5), t.text_dim);
+    app.auto.add(
+        &format!("effectControls.objectMatte.{}.status", g.uid),
+        Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 30.0), vec2(r.width() - 24.0, 16.0)),
+        &status,
+    );
+}
+
+// ---------------------------------------------------------------------------------------------
+// Curves / Levels editors
+
+/// Height of the custom editor shown under an effect's header (0 when none).
+pub(super) fn editor_height(effect: &str, g: &PropGroup, width: f32) -> f32 {
+    match effect {
+        crate::panels::fx_editors::GLOW | crate::panels::fx_editors::RESHAPE | crate::panels::fx_editors::EXTRACTOR => {
+            crate::panels::fx_editors::header_height(effect, g, width)
+        }
+        "ec.color.curves" => 34.0 + curves_size(width) + 26.0,
+        effectcraft_engine::effects::warp_stab::ID => 50.0,
+        effectcraft_engine::effects::camera_tracker::ID => crate::panels::camera_tracker_ui::editor_height(g),
+        effectcraft_engine::effects::roto::ID | effectcraft_engine::effects::object_matte::ID => 50.0,
+        "ec.color.levels" | "ec.color.levelsic" => 34.0 + 80.0 + 58.0,
+        "ec.color.autolevels" | "ec.color.autocontrast" | "ec.color.autocolor" => 24.0 + 80.0 + 12.0,
+        _ => 0.0,
+    }
+}
+
+fn curves_size(width: f32) -> f32 {
+    (width - 72.0).clamp(120.0, 256.0)
+}
+
+/// Cached histogram of the displayed frame (recomputed when the frame changes).
+fn frame_histogram(app: &mut EffectcraftApp, ctx: &egui::Context) -> Option<std::sync::Arc<[[u32; 256]; 5]>> {
+    let img = app.viewer_pixels()?;
+    let key = std::sync::Arc::as_ptr(&img) as usize;
+    let id = egui::Id::unique("ec-histogram");
+    if let Some((k, h)) = ctx.data(|d| d.get_temp::<(usize, std::sync::Arc<[[u32; 256]; 5]>)>(id))
+        && k == key
+    {
+        return Some(h);
+    }
+    let h = std::sync::Arc::new(fw::histogram(&img));
+    ctx.data_mut(|d| d.insert_temp(id, (key, h.clone())));
+    Some(h)
+}
+
+fn channel_color(ch: usize) -> Color32 {
+    match ch {
+        1 => Color32::from_rgb(0xe0, 0x50, 0x50),
+        2 => Color32::from_rgb(0x50, 0xc8, 0x60),
+        3 => Color32::from_rgb(0x50, 0x80, 0xf0),
+        4 => Color32::from_gray(0x90),
+        _ => Color32::from_gray(0xb8),
+    }
+}
+
+/// A "Channel: [RGB ▾]" popup; returns the chosen channel.
+#[allow(clippy::too_many_arguments)]
+fn channel_popup(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    x: f32,
+    cy: f32,
+    cur: usize,
+    names: &[&str],
+    id: egui::Id,
+    auto: &str,
+) -> Option<usize> {
+    let t = app.tokens;
+    p.text(pos2(x, cy), Align2::LEFT_CENTER, crate::i18n::tr("Channel:"), Tokens::ui(12.0), t.text_dim);
+    let dr = Rect::from_min_size(pos2(x + 58.0, cy - 9.0), vec2(80.0, 18.0));
+    let pop = id.with("pop");
+    if widgets::dropdown(ui, dr, names.get(cur).copied().unwrap_or(""), &t, id).clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add(auto, dr, "Channel");
+    let opts: Vec<String> = names.iter().map(|s| s.to_string()).collect();
+    widgets::popup_menu(ui, pop, dr.left_bottom(), &opts, Some(cur))
+}
+
+/// Curves: channel popup, Bezier/pencil mode, Reset, and the graph bound to the channel's
+/// hidden point-list parameter.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn curves_editor(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    layer: &Layer,
+    g: &PropGroup,
+    ectx: &EvalCtx,
+    r: Rect,
+    actions: &mut Actions,
+) {
+    let t = app.tokens;
+    let euid = g.uid;
+    // The channel lives in the effect's hidden Channel parameter (UI state for instances
+    // saved before it existed).
+    let chan_prop = g.get("channel");
+    let ch = match chan_prop {
+        Some(pr) => ectx.value(layer, pr).as_enum() as usize,
+        None => app.ui.fx_curve_channel.get(&euid).copied().unwrap_or(0),
+    }
+    .min(4);
+    let x0 = r.min.x + 30.0;
+    let cy = r.min.y + 17.0;
+    let names: [&str; 5] = [crate::i18n::tr("RGB"), crate::i18n::tr("Red"), crate::i18n::tr("Green"), crate::i18n::tr("Blue"), crate::i18n::tr("Alpha")];
+    if let Some(n) = channel_popup(app, ui, p, x0, cy, ch, &names, egui::Id::unique(("ec-cch", euid)), &format!("effectControls.effect.{euid}.curves.channel"))
+    {
+        match chan_prop {
+            Some(pr) => actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": pr.uid, "value": n}))),
+            None => {
+                app.ui.fx_curve_channel.insert(euid, n);
+            }
+        }
+    }
+    let pencil = app.ui.fx_curve_pencil.contains(&euid);
+    let mr = Rect::from_min_size(pos2(x0 + 146.0, cy - 9.0), vec2(56.0, 18.0));
+    if widgets::dropdown(ui, mr, if pencil { "Pencil" } else { "Bezier" }, &t, egui::Id::unique(("ec-cmode", euid))).clicked() {
+        if pencil {
+            app.ui.fx_curve_pencil.remove(&euid);
+        } else {
+            app.ui.fx_curve_pencil.insert(euid);
+        }
+    }
+    app.auto.add(&format!("effectControls.effect.{euid}.curves.mode"), mr, "Curve mode");
+    let Some(prop) = g.get(fw::CURVE_CHANNELS[ch].0) else { return };
+    let cur = match ectx.value(layer, prop) {
+        Value::Str(s) => fw::CurvePoints::parse(&s),
+        _ => fw::CurvePoints::identity(),
+    };
+    let rr = Rect::from_min_size(pos2(mr.max.x + 8.0, cy - 9.0), vec2(44.0, 18.0));
+    let rresp = ui.interact(rr, egui::Id::unique(("ec-creset", euid)), Sense::click());
+    p.text(rr.center(), Align2::CENTER_CENTER, crate::i18n::tr("Reset"), Tokens::ui(11.5), if rresp.hovered() { t.hot_text } else { t.text_dim });
+    app.auto.add(&format!("effectControls.effect.{euid}.curves.reset"), rr, "Reset curve");
+    if rresp.clicked() {
+        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": prop.uid, "value": fw::CurvePoints::identity().format()})));
+    }
+    let size = curves_size(r.width());
+    let gr = Rect::from_min_size(pos2(x0 + 8.0, r.min.y + 38.0), vec2(size, size));
+    // Input/output gradients along the axes.
+    let col = channel_color(ch);
+    p.rect_filled(Rect::from_min_max(pos2(gr.min.x, gr.max.y + 3.0), pos2(gr.max.x, gr.max.y + 8.0)), 0.0, col.gamma_multiply(0.5));
+    let id = egui::Id::unique(("ec-curves", euid, ch));
+    let (resp, edit) = fw::curves_graph(ui, gr, &cur, ch, fw::CurveMode { pencil, natural: true }, id, &t);
+    app.auto.add(&format!("effectControls.effect.{euid}.curves.graph"), gr, "Curves");
+    let started = resp.drag_started() || resp.clicked();
+    if let Some(np) = edit.changed {
+        let key = gesture_key(ui, id, started);
+        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": prop.uid, "value": np.format(), "merge": key})));
+    }
+    p.text(
+        pos2(gr.min.x, gr.max.y + 18.0),
+        Align2::LEFT_CENTER,
+        if pencil { "Drag to draw the curve" } else { "Click adds a point; drag one off to remove" },
+        Tokens::ui(10.5),
+        t.text_faint,
+    );
+}
+
+/// Levels parameter ids for a channel: input black, input white, gamma, output black, output white.
+fn levels_ids(effect: &str, ch: usize) -> [String; 5] {
+    if effect == "ec.color.levels" {
+        return effectcraft_engine::effects::levels_channel_ids(ch);
+    }
+    // Levels (Individual Controls) nests each channel's controls in its twirl-down group.
+    let pre = fw::LEVELS_CHANNELS[ch.min(4)].0;
+    ["InBlack", "InWhite", "Gamma", "OutBlack", "OutWhite"].map(|s| format!("{pre}/{pre}{s}"))
+}
+
+/// Levels: (channel popup,) histogram, input black/gamma/white triangles, output bar with
+/// black/white triangles.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn levels_editor(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    layer: &Layer,
+    g: &PropGroup,
+    effect: &str,
+    ectx: &EvalCtx,
+    r: Rect,
+    actions: &mut Actions,
+) {
+    let t = app.tokens;
+    let euid = g.uid;
+    let x0 = r.min.x + 30.0;
+    let cy = r.min.y + 17.0;
+    // Levels keeps its channel in the Channel parameter; Levels (Individual Controls) shows
+    // every channel and the popup only picks the histogram.
+    let ch = if effect == "ec.color.levelsic" {
+        app.ui.fx_levels_channel.get(&euid).copied().unwrap_or(0).min(4)
+    } else {
+        g.get("channel").map(|pr| ectx.value(layer, pr).as_enum() as usize).unwrap_or(0).min(4)
+    };
+    if effect == "ec.color.levelsic" {
+        let names: [&str; 5] = [crate::i18n::tr("RGB"), crate::i18n::tr("Red"), crate::i18n::tr("Green"), crate::i18n::tr("Blue"), crate::i18n::tr("Alpha")];
+        if let Some(n) =
+            channel_popup(app, ui, p, x0, cy, ch, &names, egui::Id::unique(("ec-lch", euid)), &format!("effectControls.effect.{euid}.levels.channel"))
+        {
+            app.ui.fx_levels_channel.insert(euid, n);
+        }
+    } else {
+        p.text(pos2(x0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Histogram"), Tokens::ui(12.0), t.text_dim);
+    }
+    let w = (r.width() - 72.0).clamp(120.0, 256.0);
+    let hr = Rect::from_min_size(pos2(x0 + 8.0, r.min.y + 34.0), vec2(w, 80.0));
+    match frame_histogram(app, ui.ctx()) {
+        // Channel 0 (RGB) shows luminance; the others their own channel.
+        Some(h) => fw::draw_histogram(p, hr, &h[ch], channel_color(ch)),
+        None => {
+            p.rect_filled(hr, 0.0, Color32::from_rgb(0x1c, 0x1c, 0x1c));
+        }
+    }
+    app.auto.add(&format!("effectControls.effect.{euid}.levels.histogram"), hr, "Histogram");
+    let ids = levels_ids(effect, ch);
+    let val = |id: &str| g.prop(id).map(|pr| ectx.value(layer, pr).as_f64()).unwrap_or(0.0);
+    let (ib, iw, gm, ob, ow) = (val(&ids[0]), val(&ids[1]), val(&ids[2]), val(&ids[3]), val(&ids[4]));
+    let mut set = |ui: &egui::Ui, id: &str, v: f64, started: bool| {
+        if let Some(pr) = g.prop(id) {
+            let key = gesture_key(ui, egui::Id::unique(("ec-lv", euid, id)), started);
+            actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": pr.uid, "value": v, "merge": key})));
+        }
+    };
+    let track = Rect::from_min_size(pos2(hr.min.x, hr.max.y + 1.0), vec2(w, 10.0));
+    let started = |ui: &egui::Ui| ui.input(|i| i.pointer.any_pressed());
+    let (r0, nv) = fw::level_handle(ui, track, ib, Color32::BLACK, egui::Id::unique(("ec-lib", euid, ch)), &t);
+    app.auto.add(&format!("effectControls.effect.{euid}.levels.inBlack"), r0, "Input Black");
+    if let Some(v) = nv {
+        set(ui, &ids[0], v.min(iw - 0.005), started(ui));
+    }
+    let gx = fw::gamma_handle(ib, iw, gm);
+    let (r1, nv) = fw::level_handle(ui, track, gx, Color32::from_gray(128), egui::Id::unique(("ec-lg", euid, ch)), &t);
+    app.auto.add(&format!("effectControls.effect.{euid}.levels.gamma"), r1, "Gamma");
+    if let Some(v) = nv {
+        set(ui, &ids[2], (fw::gamma_from_handle(ib, iw, v) * 100.0).round() / 100.0, started(ui));
+    }
+    let (r2, nv) = fw::level_handle(ui, track, iw, Color32::WHITE, egui::Id::unique(("ec-liw", euid, ch)), &t);
+    app.auto.add(&format!("effectControls.effect.{euid}.levels.inWhite"), r2, "Input White");
+    if let Some(v) = nv {
+        set(ui, &ids[1], v.max(ib + 0.005), started(ui));
+    }
+    // Output: a black→white bar with its two triangles.
+    let bar = Rect::from_min_size(pos2(hr.min.x, track.max.y + 10.0), vec2(w, 9.0));
+    let n = 32;
+    for k in 0..n {
+        let v = (k as f32 / (n - 1) as f32 * 255.0) as u8;
+        let x0 = bar.min.x + bar.width() * k as f32 / n as f32;
+        let x1 = bar.min.x + bar.width() * (k + 1) as f32 / n as f32;
+        p.rect_filled(Rect::from_min_max(pos2(x0, bar.min.y), pos2(x1, bar.max.y)), 0.0, Color32::from_gray(v));
+    }
+    let otrack = Rect::from_min_size(pos2(bar.min.x, bar.max.y + 1.0), vec2(w, 10.0));
+    let (r3, nv) = fw::level_handle(ui, otrack, ob, Color32::BLACK, egui::Id::unique(("ec-lob", euid, ch)), &t);
+    app.auto.add(&format!("effectControls.effect.{euid}.levels.outBlack"), r3, "Output Black");
+    if let Some(v) = nv {
+        set(ui, &ids[3], v, started(ui));
+    }
+    let (r4, nv) = fw::level_handle(ui, otrack, ow, Color32::WHITE, egui::Id::unique(("ec-low", euid, ch)), &t);
+    app.auto.add(&format!("effectControls.effect.{euid}.levels.outWhite"), r4, "Output White");
+    if let Some(v) = nv {
+        set(ui, &ids[4], v, started(ui));
+    }
+}
+
+/// Auto Levels / Auto Contrast / Auto Color: the histogram they work from.
+pub(super) fn histogram_only(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, g: &PropGroup, r: Rect) {
+    let t = app.tokens;
+    let x0 = r.min.x + 30.0;
+    p.text(pos2(x0, r.min.y + 12.0), Align2::LEFT_CENTER, crate::i18n::tr("Histogram"), Tokens::ui(12.0), t.text_dim);
+    let w = (r.width() - 72.0).clamp(120.0, 256.0);
+    let hr = Rect::from_min_size(pos2(x0 + 8.0, r.min.y + 24.0), vec2(w, 80.0));
+    match frame_histogram(app, ui.ctx()) {
+        Some(h) => {
+            fw::draw_histogram(p, hr, &h[1], channel_color(1).gamma_multiply(0.6));
+            fw::draw_histogram_overlay(p, hr, &h[2], channel_color(2).gamma_multiply(0.6));
+            fw::draw_histogram_overlay(p, hr, &h[3], channel_color(3).gamma_multiply(0.6));
+        }
+        None => {
+            p.rect_filled(hr, 0.0, Color32::from_rgb(0x1c, 0x1c, 0x1c));
+        }
+    }
+    app.auto.add(&format!("effectControls.effect.{}.histogram", g.uid), hr, "Histogram");
+}
diff --git a/crates/ui-egui/src/panels/effect_controls/panel.rs b/crates/ui-egui/src/panels/effect_controls/panel.rs
new file mode 100644
index 000000000..39fd4847a
--- /dev/null
+++ b/crates/ui-egui/src/panels/effect_controls/panel.rs
@@ -0,0 +1,404 @@
+use super::common::{Actions, PARAM_NAME_X, ROW, effect_active, selected_layer};
+use super::editors::{curves_editor, editor_height, histogram_only, levels_editor, object_matte_editor, roto_editor, warp_editor};
+use super::rows::{FxScope, group_rows, toggle_closed};
+use super::{Align2, Color32, EffectcraftApp, EvalCtx, GroupKind, Icon, Layer, PropGroup, Rect, Sense, Stroke, Tokens, json, pos2, vec2, widgets};
+
+// ---------------------------------------------------------------------------------------------
+
+/// Open the rename field on effect `uid` (Enter with the effect selected), name selected.
+pub fn start_rename(ctx: &egui::Context, uid: u64, name: &str) {
+    let id = egui::Id::unique(("ec-rename", uid));
+    ctx.data_mut(|d| d.insert_temp(id, name.to_string()));
+    ctx.data_mut(|d| d.insert_temp(id.with("select"), true));
+    ctx.memory_mut(|m| m.request_focus(id.with("field")));
+}
+
+/// Where an effect header's parts sit, for its rename field.
+struct EffectHdr<'a> {
+    g: &'a PropGroup,
+    shown: &'a str,
+    r: Rect,
+    tw: Rect,
+    reset: Rect,
+    rename_id: egui::Id,
+    layer_id: u64,
+}
+
+/// The effect header's name field while renaming: Enter or blur commits, Escape cancels.
+fn rename_field(app: &mut EffectcraftApp, ui: &mut egui::Ui, h: &EffectHdr, mut value: String, actions: &mut Actions) {
+    let EffectHdr { g, shown, r, tw, reset, rename_id, layer_id } = *h;
+    let ctx = ui.ctx().clone();
+    let name_rect = Rect::from_min_max(pos2(tw.max.x + 6.0, r.min.y + 2.0), pos2(reset.min.x - 6.0, r.max.y - 2.0));
+    let response = ui.put(name_rect, egui::TextEdit::singleline(&mut value).id(rename_id.with("field")).font(Tokens::semibold(12.0)));
+    // Focus the field the frame it first exists: focusing an id not yet on screen leaves
+    // the accessibility tree with a focus it doesn't contain.
+    if ctx.data_mut(|d| d.remove_temp::<bool>(rename_id.with("start"))).is_some() {
+        crate::widgets::select_all(&ctx, response.id, &value);
+        response.request_focus();
+    }
+    app.auto.add(&format!("effectControls.effect.{}.nameEdit", g.uid), name_rect, "Effect name");
+    if ctx.data_mut(|d| d.remove_temp::<bool>(rename_id.with("select"))).unwrap_or(false) {
+        widgets::select_all(&ctx, response.id, &value);
+    }
+    // Escape cancels. egui drops the field's focus on Escape in the same frame, so the
+    // key is checked on the focus being lost as well as held.
+    let escape = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
+    let commit = response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)));
+    if escape || commit {
+        ctx.data_mut(|d| d.remove::<String>(rename_id));
+        // The field opens with the drawn name, so committing it unchanged is not a rename.
+        if !escape && !value.trim().is_empty() && value != shown {
+            actions.push(("prop.renameGroup".into(), json!({"layer": layer_id, "prop": g.uid, "name": value})));
+        }
+    } else {
+        ctx.data_mut(|d| d.insert_temp(rename_id, value));
+    }
+}
+
+struct EditorCx<'a> {
+    bp: &'a egui::Painter,
+    layer: &'a Layer,
+    ectx: &'a EvalCtx<'a>,
+}
+
+/// An effect's custom editor (curves, levels, roto...), or the histogram-only fallback.
+fn effect_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &EditorCx, g: &PropGroup, er: Rect, actions: &mut Actions) {
+    let GroupKind::Effect { effect } = &g.kind else { return };
+    match effect.as_str() {
+        "ec.color.curves" => curves_editor(app, ui, cx.bp, cx.layer, g, cx.ectx, er, actions),
+        effectcraft_engine::effects::warp_stab::ID => warp_editor(app, ui, cx.bp, cx.layer, g, er, actions),
+        effectcraft_engine::effects::camera_tracker::ID => crate::panels::camera_tracker_ui::editor(app, ui, cx.bp, cx.layer, g, er, actions),
+        effectcraft_engine::effects::roto::ID => roto_editor(app, ui, cx.bp, cx.layer, g, er, actions),
+        effectcraft_engine::effects::object_matte::ID => object_matte_editor(app, ui, cx.bp, cx.layer, g, er, actions),
+        "ec.color.levels" | "ec.color.levelsic" => levels_editor(app, ui, cx.bp, cx.layer, g, effect, cx.ectx, er, actions),
+        crate::panels::fx_editors::GLOW | crate::panels::fx_editors::RESHAPE | crate::panels::fx_editors::EXTRACTOR => {
+            crate::panels::fx_editors::header_editor(app, ui, cx.bp, cx.layer, g, effect, cx.ectx, er, actions)
+        }
+        _ => histogram_only(app, ui, cx.bp, g, er),
+    }
+}
+
+struct ReorderDrag<'a> {
+    tops: &'a [(u64, f32)],
+    y: f32,
+    du: u64,
+    drag_id: egui::Id,
+    layer_id: u64,
+}
+
+/// Drag an effect header to reorder: the insertion line between headers, and the drop.
+fn reorder_drag(ctx: &egui::Context, bp: &egui::Painter, body: Rect, t: &Tokens, st: &ReorderDrag, actions: &mut Actions) {
+    let ReorderDrag { tops, y, du, drag_id, layer_id } = *st;
+    if let Some(pos) = ctx.pointer_interact_pos() {
+        let slot = tops.iter().position(|(_, ty)| pos.y < *ty + (ROW + 2.0) / 2.0).unwrap_or(tops.len());
+        let ly = tops.get(slot).map(|(_, ty)| *ty).unwrap_or(y - 4.0);
+        bp.line_segment([pos2(body.min.x + 4.0, ly), pos2(body.max.x - 4.0, ly)], Stroke::new(2.0, t.accent));
+        if ctx.input(|i| i.pointer.any_released()) {
+            if let Some(from) = tops.iter().position(|(u, _)| *u == du) {
+                let to = if slot > from { slot - 1 } else { slot };
+                if to != from {
+                    actions.push(("effect.reorder".into(), json!({"layer": layer_id, "effect": du, "index": to + 1})));
+                }
+            }
+            ctx.data_mut(|d| d.remove::<u64>(drag_id));
+        }
+    }
+    if !ctx.input(|i| i.pointer.any_down()) {
+        ctx.data_mut(|d| d.remove::<u64>(drag_id));
+    }
+}
+
+/// Drop effects and animation presets here.
+fn drop_payload(ui: &egui::Ui, rect: Rect, p: &egui::Painter, t: &Tokens, layer_id: u64, actions: &mut Actions) {
+    let ctx = ui.ctx().clone();
+    if let Some(payload) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx)
+        && ui.rect_contains_pointer(rect)
+        && let Some((id, params)) = match payload.as_ref() {
+            crate::panels::DragPayload::Effect(e) => Some(("effect.apply", json!({"effect": e, "layers": [layer_id]}))),
+            crate::panels::DragPayload::Preset { preset, .. } => Some(preset.apply_to(layer_id)),
+            _ => None,
+        }
+    {
+        p.rect_stroke(rect, 0.0, Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
+        if ctx.input(|i| i.pointer.any_released()) {
+            actions.push((id.into(), params));
+            egui::DragAndDrop::clear_payload(&ctx);
+        }
+    }
+}
+
+/// A plug-in effect whose last render failed (an effect helper that stopped, ...): a warning sign
+/// at `at`, after the effect's name, with the message on hover. The frame shows the input as is.
+fn render_error_mark(app: &mut EffectcraftApp, ui: &mut egui::Ui, bp: &egui::Painter, effect: &str, g: &PropGroup, at: egui::Pos2) {
+    let Some(err) = effectcraft_engine::effects::plugin::plugin_error(effect) else { return };
+    let wr = bp.text(at, Align2::LEFT_CENTER, "⚠", Tokens::semibold(12.0), app.tokens.warning);
+    let resp = ui.interact(wr.expand(2.0), egui::Id::unique(("ec-fx-error", g.uid)), Sense::hover());
+    app.auto.add(&format!("effectControls.effect.{}.error", g.uid), wr, &err);
+    resp.on_hover_text(err);
+    ui.ctx().request_repaint_after(std::time::Duration::from_millis(500));
+}
+
+fn about_button(app: &mut EffectcraftApp, ui: &mut egui::Ui, bp: &egui::Painter, t: &Tokens, effect: &str, g: &PropGroup, r: Rect) {
+    // About…: the effect's name and category (AE's About dialog).
+    let about = Rect::from_min_size(pos2(r.max.x - 50.0, r.center().y - 9.0), vec2(44.0, 18.0));
+    let aresp = ui.interact(about, egui::Id::unique(("ec-about", g.uid)), Sense::click());
+    bp.text(about.center(), Align2::CENTER_CENTER, crate::i18n::tr("About..."), Tokens::ui(11.5), if aresp.hovered() { t.hot_text } else { t.text_dim });
+    app.auto.add(&format!("effectControls.effect.{}.about", g.uid), about, "About");
+    let apop = egui::Id::unique(("ec-about-pop", g.uid));
+    if aresp.clicked() {
+        widgets::open_popup(ui, apop);
+    }
+    if let Some(spec) = effectcraft_engine::effects::find(effect) {
+        let lines = vec![
+            crate::i18n::effects::name(spec.id, spec.name),
+            format!("Category: {}", crate::i18n::effects::category(spec.category)),
+            "EffectCraft built-in effect (MIT OR Apache-2.0)".to_string(),
+        ];
+        let _ = widgets::popup_menu(ui, apop, about.left_bottom(), &lines, None);
+    }
+}
+
+/// The Effect Controls panel for the selected layer: a header with the comp and layer names, then
+/// one header per effect (Fx toggle, twirl, rename, Reset, About, label bar, reorder drag and its
+/// right-click menu) followed by that effect's custom editor and its property rows. Dragging
+/// effects or presets onto the panel applies them; a right-click on empty space opens the Effect
+/// menu. The rows read from a snapshot of the project, and every edit is queued and run through
+/// [`crate::menus::invoke`], with failures reported in `app.ui.status`.
+pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let p = ui.painter().with_clip_rect(rect);
+    let ctx = ui.ctx().clone();
+    let Some(layer) = selected_layer(app) else {
+        p.text(rect.center(), Align2::CENTER_CENTER, crate::i18n::tr("Select a layer to see its effects"), Tokens::ui(12.0), t.text_faint);
+        return;
+    };
+    let Some(cid) = app.session.active_comp_id() else { return };
+    let comp = app.session.project.comp_arc(cid).unwrap_or_else(|| effectcraft_engine::project::Comp::new(1, 1, Default::default(), Default::default()).into());
+    let comp_name = app.session.project.item(cid).map(|i| i.name.clone()).unwrap_or_default();
+    let snap_project = app.session.project.clone();
+    let snap_expr = app.session.expr.clone();
+    let ectx = EvalCtx {
+        project: &snap_project,
+        comp_id: cid,
+        comp: &comp,
+        time: app.session.time(),
+        expr: snap_expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let hdr = Rect::from_min_size(rect.min, vec2(rect.width(), 24.0));
+    p.text(pos2(hdr.min.x + 10.0, hdr.center().y), Align2::LEFT_CENTER, format!("{} • {}", comp_name, layer.name), Tokens::ui(11.5), t.text_dim);
+    p.line_segment([hdr.left_bottom(), hdr.right_bottom()], Stroke::new(1.0, t.separator));
+    let body = Rect::from_min_max(pos2(rect.min.x, hdr.max.y), rect.max);
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("ec-scroll"), body);
+    let body = scroll.content;
+    let mut y = body.min.y + 4.0 - scroll.offset;
+    let mut actions: Actions = vec![];
+    let bp = p.with_clip_rect(body);
+    let fx: Vec<PropGroup> = layer.effects().map(|f| f.groups().cloned().collect()).unwrap_or_default();
+    if fx.is_empty() {
+        bp.text(
+            pos2(body.center().x, body.min.y + 40.0),
+            Align2::CENTER_CENTER,
+            crate::i18n::tr("No effects. Drag one from Effects & Presets."),
+            Tokens::ui(12.0),
+            t.text_faint,
+        );
+    }
+    // Clicking empty space deselects the effects.
+    let bg = ui.interact(body, egui::Id::unique("ec-bg"), Sense::click());
+    if bg.clicked() {
+        app.session.state.selected_props.retain(|(l, u)| !(*l == layer.id && fx.iter().any(|g| effect_active(g, layer.id, &[(*l, *u)]))));
+    }
+    let has_clip = !app.session.state.effect_clipboard.is_empty();
+    let drag_id = egui::Id::unique("ec-drag-effect");
+    let dragging: Option<u64> = ctx.data(|d| d.get_temp(drag_id));
+    // Header tops, for drag-to-reorder.
+    let mut tops: Vec<(u64, f32)> = vec![];
+    for (fi, g) in fx.iter().enumerate() {
+        let GroupKind::Effect { effect } = &g.kind else { continue };
+        // The header draws the effect's name in the interface language; the automation labels
+        // below keep the property tree's name, which is the registry's English name (#821).
+        let shown = crate::i18n::effects::group(effect, &g.name);
+        let r = Rect::from_min_size(pos2(body.min.x, y), vec2(body.width(), ROW + 2.0));
+        tops.push((g.uid, r.min.y));
+        y += ROW + 2.0;
+        let open = !app.ui.fx_closed.contains(&g.uid);
+        let selected = app.session.state.selected_props.iter().any(|(l, u)| *l == layer.id && *u == g.uid);
+        let active = effect_active(g, layer.id, &app.session.state.selected_props);
+        bp.rect_filled(r, 0.0, if active { t.fx_header_active } else { t.fx_header });
+        // The effect's colour label (26.5): a bar on the header's left edge.
+        if let Some(lab) = g.label.filter(|l| *l != effectcraft_engine::color::Label::None) {
+            let [lr, lg, lb] = app.session.prefs.label_rgb(lab);
+            bp.rect_filled(Rect::from_min_size(r.min, vec2(4.0, r.height())), 0.0, Color32::from_rgb(lr, lg, lb));
+            app.auto.add(
+                &format!("effectControls.effect.{}.label", g.uid),
+                Rect::from_min_size(r.min, vec2(4.0, r.height())),
+                &app.session.prefs.label_name(lab),
+            );
+        }
+        let fxr = Rect::from_center_size(pos2(r.min.x + 14.0, r.center().y), vec2(16.0, 16.0));
+        if widgets::icon_toggle(ui, fxr, Icon::Fx, g.enabled, &t, egui::Id::unique(("ec-fx", g.uid)), Sense::click()).clicked() {
+            actions.push(("effect.toggle".into(), json!({"layer": layer.id.0, "effect": g.uid})));
+        }
+        app.auto.add(&format!("effectControls.effect.{}.fx", g.uid), fxr, &g.name);
+        let tw = Rect::from_center_size(pos2(r.min.x + 32.0, r.center().y), vec2(12.0, 12.0));
+        if widgets::twirl(ui, tw, open, egui::Id::unique(("ec-tw", g.uid)), &t).clicked() {
+            toggle_closed(app, g, open, ui.input(|i| i.modifiers.alt || i.modifiers.command));
+        }
+        app.auto.add(&format!("effectControls.effect.{}.twirl", g.uid), tw, &g.name);
+        let rename_id = egui::Id::unique(("ec-rename", g.uid));
+        let editing: Option<String> = ctx.data(|d| d.get_temp(rename_id));
+        let reset = Rect::from_min_size(pos2(r.max.x - 96.0, r.center().y - 9.0), vec2(40.0, 18.0));
+        let hdr_cx = EffectHdr { g, shown: &shown, r, tw, reset, rename_id, layer_id: layer.id.0 };
+        if let Some(value) = editing.as_ref().cloned() {
+            rename_field(app, ui, &hdr_cx, value, &mut actions);
+        } else {
+            let name = bp.text(pos2(tw.max.x + 6.0, r.center().y), Align2::LEFT_CENTER, &shown, Tokens::semibold(12.0), t.text);
+            app.auto.add(&format!("effectControls.effect.{}.name", g.uid), name, &g.name);
+            render_error_mark(app, ui, &bp, effect, g, pos2(name.max.x + 8.0, r.center().y));
+        }
+        let rresp = ui.interact(reset, egui::Id::unique(("ec-reset", g.uid)), Sense::click());
+        bp.text(reset.center(), Align2::CENTER_CENTER, crate::i18n::tr("Reset"), Tokens::ui(11.5), if rresp.hovered() { t.hot_text } else { t.text_dim });
+        app.auto.add(&format!("effectControls.effect.{}.reset", g.uid), reset, "Reset");
+        if rresp.clicked() {
+            actions.push(("effect.reset".into(), json!({"layer": layer.id.0, "effect": g.uid})));
+        }
+        about_button(app, ui, &bp, &t, effect, g, r);
+        let hresp = ui.interact(
+            Rect::from_min_max(pos2(tw.max.x, r.min.y), pos2(reset.min.x - 4.0, r.max.y)),
+            egui::Id::unique(("ec-hdr", g.uid)),
+            if editing.is_some() { Sense::hover() } else { Sense::click_and_drag() },
+        );
+        if hresp.double_clicked() {
+            ctx.data_mut(|d| d.insert_temp(rename_id, shown.clone()));
+            ctx.data_mut(|d| d.insert_temp(rename_id.with("start"), true));
+        }
+        hresp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, active, &shown));
+        app.auto.add(&format!("effectControls.effect.{}", g.uid), r, &g.name);
+        if hresp.clicked() || hresp.drag_started() || hresp.secondary_clicked() {
+            let (shift, command) = ui.input(|i| (i.modifiers.shift, i.modifiers.command));
+            if shift && hresp.clicked() {
+                // A range from the last effect picked, which stays the end the next range starts from.
+                let from = app.session.state.selected_props.iter().rev().find_map(|(l, u)| fx.iter().position(|f| *l == layer.id && f.uid == *u));
+                let from = from.unwrap_or(fi);
+                let range = fx.iter().enumerate().filter(|(i, _)| (from.min(fi)..=from.max(fi)).contains(i));
+                let mut picked: Vec<_> = range.filter(|(i, _)| *i != from).map(|(_, f)| (layer.id, f.uid)).collect();
+                picked.extend(fx.get(from).map(|f| (layer.id, f.uid)));
+                app.session.state.selected_props = picked;
+            } else if command && hresp.clicked() {
+                if selected {
+                    app.session.state.selected_props.retain(|(l, u)| !(*l == layer.id && *u == g.uid));
+                } else {
+                    app.session.state.selected_props.push((layer.id, g.uid));
+                }
+            } else if !selected || hresp.clicked() {
+                app.session.state.selected_props = vec![(layer.id, g.uid)];
+            }
+        }
+        if hresp.drag_started() {
+            ctx.data_mut(|d| d.insert_temp(drag_id, g.uid));
+        }
+        crate::widgets::context_menu(&hresp, |ui| {
+            let lid = layer.id.0;
+            let mut picked_label: Option<usize> = None;
+            let mut item = |ui: &mut egui::Ui, label: &str, enabled: bool, cmd: &str, params: serde_json::Value| {
+                if ui.add_enabled(enabled, egui::Button::new(crate::i18n::context_item(cmd, &params, label))).clicked() {
+                    actions.push((cmd.into(), params));
+                    ui.close();
+                }
+            };
+            item(ui, "Copy", true, "effect.copy", json!({"layer": lid, "effect": g.uid}));
+            item(ui, "Paste", has_clip, "effect.paste", json!({"layers": [lid]}));
+            item(ui, "Duplicate", true, "effect.duplicate", json!({"layer": lid, "effect": g.uid}));
+            if ui.button(crate::i18n::tr("Rename")).clicked() {
+                ctx.data_mut(|d| d.insert_temp(rename_id, shown.clone()));
+                ctx.data_mut(|d| d.insert_temp(rename_id.with("start"), true));
+                ui.close();
+            }
+            ui.separator();
+            ui.menu_button(crate::i18n::tr("Label"), |ui| {
+                let cur = g.label.unwrap_or(effectcraft_engine::color::Label::None);
+                for (i, l) in effectcraft_engine::color::Label::ALL.into_iter().enumerate() {
+                    if widgets::label_entry(ui, l, &app.session.prefs.label_name(l), l == cur, &t).clicked() {
+                        picked_label = Some(i);
+                        ui.close();
+                    }
+                }
+            });
+            item(ui, "Reset", true, "effect.reset", json!({"layer": lid, "effect": g.uid}));
+            item(ui, "Remove", true, "effect.remove", json!({"layer": lid, "effect": g.uid}));
+            ui.separator();
+            item(ui, "Move Up", fi > 0, "effect.reorder", json!({"layer": lid, "effect": g.uid, "index": fi.max(1)}));
+            item(ui, "Move Down", fi + 1 < fx.len(), "effect.reorder", json!({"layer": lid, "effect": g.uid, "index": fi + 2}));
+            if let Some(i) = picked_label {
+                actions.push(("effect.setLabel".into(), json!({"layer": lid, "effect": g.uid, "label": i})));
+            }
+        });
+        // What the effect can't render as asked (an OCIO config it can't read, transforms it
+        // passes through), under its name.
+        if let Some(w) = effectcraft_engine::effects::warning(g, &mut |pr| ectx.value(&layer, pr)) {
+            let galley = bp.layout(format!("⚠ {w}"), Tokens::ui(11.0), t.warning, (body.width() - 20.0).max(60.0));
+            let wr = Rect::from_min_size(pos2(body.min.x + 10.0, y + 3.0), galley.size());
+            bp.galley(wr.min, galley, t.warning);
+            app.auto.add(&format!("effectControls.effect.{}.warning", g.uid), wr, &w);
+            y += wr.height() + 6.0;
+        }
+        if open {
+            let eh = editor_height(effect, g, body.width());
+            if eh > 0.0 {
+                let er = Rect::from_min_size(pos2(body.min.x, y), vec2(body.width(), eh));
+                y += eh;
+                if er.max.y >= body.min.y && er.min.y <= body.max.y {
+                    // Curves, Levels and other custom editors do not use prop_row.
+                    // Clicking their controls must activate the owner as well.
+                    if ui.input(|i| i.pointer.primary_pressed()) && ui.rect_contains_pointer(er) {
+                        actions.push(("prop.select".into(), json!({"layer":layer.id.0,"prop":g.uid})));
+                    }
+                    effect_editor(app, ui, &EditorCx { bp: &bp, layer: &layer, ectx: &ectx }, g, er, &mut actions);
+                }
+            }
+            let scope = FxScope { effect: effect.as_str(), root: g, path: String::new() };
+            group_rows(app, ui, &bp, &layer, g, &ectx, body, &mut y, 0, &scope, &mut actions);
+            if effect == "ec.color.tint" {
+                let r = Rect::from_min_size(pos2(body.min.x + PARAM_NAME_X, y + 2.0), vec2(120.0, ROW));
+                let label = crate::i18n::tr("Swap Colors");
+                let resp = widgets::text_button(ui, r, label, false, &t, egui::Id::unique(("ec-tint-swap", g.uid)));
+                app.auto.add_response(&format!("effectControls.effect.{}.swapColors", g.uid), &resp, label);
+                if resp.clicked() {
+                    actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": g.uid})));
+                    actions.push(("effect.swapTintColors".into(), json!({"layer": layer.id.0, "effect": g.uid})));
+                }
+                y += ROW + 4.0;
+            }
+        }
+        y += 4.0;
+    }
+    if let Some(du) = dragging {
+        reorder_drag(&ctx, &bp, body, &t, &ReorderDrag { tops: &tops, y, du, drag_id, layer_id: layer.id.0 }, &mut actions);
+    }
+    // Right-click anywhere a control has no menu of its own: the Effect menu, which applies to
+    // the selected layers (After Effects). Drawn after the rows, whose menus open first.
+    let menu_id = bg.id.with("effect-menu");
+    let open = ui.input(|i| i.pointer.secondary_clicked())
+        && ui.rect_contains_pointer(body)
+        && (!egui::Popup::is_any_open(&ctx) || egui::Popup::is_id_open(&ctx, menu_id));
+    egui::Popup::context_menu(&bg).style(crate::widgets::menu_style).id(menu_id).open_memory(open.then_some(egui::SetOpenCommand::Bool(true))).show(|ui| {
+        ui.set_min_width(200.0);
+        actions.extend(crate::menus::menu_contents(app, ui, "Effect"));
+    });
+    let content_h = y + scroll.offset - body.min.y;
+    scroll.end(ui, &mut app.auto, "effectControls.scroll", content_h, &t);
+    drop_payload(ui, rect, &p, &t, layer.id.0, &mut actions);
+    if ui.input(|i| i.pointer.primary_down()) && actions.iter().any(|(id, _)| id == "prop.set") {
+        app.ui.viewer.property_interacting = true;
+        ctx.request_repaint();
+    }
+    for (id, params) in actions {
+        if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
+            app.ui.status = e;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/panels/effect_controls/rows.rs b/crates/ui-egui/src/panels/effect_controls/rows.rs
new file mode 100644
index 000000000..c14630af4
--- /dev/null
+++ b/crates/ui-egui/src/panels/effect_controls/rows.rs
@@ -0,0 +1,791 @@
+use super::common::{Actions, DIAL_ROW, PARAM_NAME_X, ROW, TREE_INDENT, gesture_key};
+use super::{
+    Align2, Color32, EffectcraftApp, EvalCtx, FxPick, GroupKind, Icon, Layer, Node, ParamUi, PropGroup, Property, Rect, Sense, Stroke, Tokens, Value, fw,
+    icons, json, pos2, vec2, widgets,
+};
+
+fn triangle(p: &egui::Painter, c: egui::Pos2, left: bool, col: Color32) {
+    let (dx, h) = (if left { -3.5 } else { 3.5 }, 4.0);
+    p.add(egui::Shape::convex_polygon(vec![pos2(c.x + dx, c.y), pos2(c.x - dx, c.y - h), pos2(c.x - dx, c.y + h)], col, Stroke::NONE));
+}
+
+/// The layer and whether the time is on a key, for the key navigator.
+#[derive(Clone, Copy)]
+struct KeyNav {
+    layer_id: u64,
+    on_key: bool,
+}
+
+/// ◀ ◆ ▶ at the right end of an animated parameter's row.
+fn key_navigator(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, nav: KeyNav, prop: &Property, r: Rect, actions: &mut Actions) {
+    let KeyNav { layer_id, on_key } = nav;
+    let t = app.tokens;
+    let cy = r.center().y;
+    let uid = prop.uid;
+    for (what, dx) in [("prev", -44.0), ("key", -32.0), ("next", -20.0)] {
+        let cr = Rect::from_center_size(pos2(r.max.x + dx, cy), vec2(12.0, 16.0));
+        let resp = ui.interact(cr, egui::Id::unique(("ec-nav", uid, what)), Sense::click());
+        let col = if resp.hovered() { t.text } else { t.text_dim };
+        match what {
+            "prev" => triangle(p, cr.center(), true, col),
+            "next" => triangle(p, cr.center(), false, col),
+            _ => {
+                let kr = Rect::from_center_size(cr.center(), vec2(10.0, 10.0));
+                if on_key {
+                    icons::paint(p, kr, Icon::Keyframe, t.keyframe);
+                } else {
+                    let c = kr.center();
+                    let d = 4.5;
+                    p.add(egui::Shape::closed_line(
+                        vec![pos2(c.x, c.y - d), pos2(c.x + d, c.y), pos2(c.x, c.y + d), pos2(c.x - d, c.y)],
+                        Stroke::new(1.0, col),
+                    ));
+                }
+            }
+        }
+        app.auto.add(&format!("effectControls.prop.{uid}.{what}Key"), cr, &prop.name);
+        if resp.clicked() {
+            match what {
+                "prev" => actions.push(("time.go".into(), json!({"to": "prevKey", "prop": uid}))),
+                "next" => actions.push(("time.go".into(), json!({"to": "nextKey", "prop": uid}))),
+                _ => actions.push(("prop.toggleKey".into(), json!({"layer": layer_id, "prop": uid, "selected": true}))),
+            }
+        }
+    }
+}
+
+/// Toggle a viewer pick (crosshair / eyedropper) for a parameter (also the Timeline's colour
+/// eyedroppers).
+pub(crate) fn toggle_pick(app: &mut EffectcraftApp, kind: &str, layer: &Layer, prop: &Property) {
+    let pick = FxPick { kind: kind.into(), layer: layer.id.0, prop: prop.uid, name: prop.name.clone() };
+    if app.ui.fx_pick.as_ref() == Some(&pick) {
+        app.ui.fx_pick = None;
+    } else {
+        app.ui.fx_pick = Some(pick);
+        app.ui.text_color_pick = None;
+        app.ui.status = if kind == "point" {
+            format!("Click in the Composition panel to set {}", prop.name)
+        } else if kind == crate::panels::crypto_pick::KIND {
+            let keys = crate::panels::crypto_pick::remove_keys(egui::os::OperatingSystem::from_target_os());
+            crate::i18n::tr_args("Click IDs in the Composition panel: Shift adds, {} removes, Esc ends", &[&keys])
+        } else {
+            format!("Click in the Composition panel to sample {}", prop.name)
+        };
+    }
+}
+
+/// What the value controls of one property row share.
+#[derive(Clone, Copy)]
+struct PropCx<'a> {
+    p: &'a egui::Painter,
+    layer: &'a Layer,
+    group: &'a PropGroup,
+    prop: &'a Property,
+    r: Rect,
+    vx: f32,
+    cy: f32,
+    swr: Rect,
+    t: Tokens,
+    uid: u64,
+    scrub: bool,
+}
+
+impl PropCx<'_> {
+    /// The tokens of the value fields: red while an expression drives the parameter (#1306).
+    fn value_tokens(&self) -> Tokens {
+        self.t.for_value(self.prop.has_expression())
+    }
+
+    /// Queues the `prop.set` of one edit; consecutive edits of the parameter (a scrub) are one undo step.
+    fn set(&self, actions: &mut Actions, v: serde_json::Value) {
+        self.push(actions, v, Some(format!("ec-{}", self.uid)));
+    }
+
+    /// Queues the `prop.set` of a discrete choice (a pop-up pick, a check box): its own undo step,
+    /// never merged with the parameter's previous edit (#2152).
+    fn set_step(&self, actions: &mut Actions, v: serde_json::Value) {
+        self.push(actions, v, None);
+    }
+
+    fn push(&self, actions: &mut Actions, v: serde_json::Value, merge: Option<String>) {
+        let (layer, uid, scrub) = (self.layer, self.uid, self.scrub);
+        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": v, "merge": merge, "selected": true, "offset": scrub})))
+    }
+
+    fn twirl_open(&self, app: &mut EffectcraftApp, ui: &mut egui::Ui) {
+        let PropCx { swr, cy, uid, prop, t, .. } = self;
+        let (cy, uid) = (*cy, *uid);
+        let open = app.ui.fx_slider_open.contains(&uid);
+        let tw = Rect::from_center_size(pos2(swr.min.x - 9.0, cy), vec2(10.0, 10.0));
+        if widgets::twirl(ui, tw, open, egui::Id::unique(("ec-stw", uid)), t).clicked() {
+            if open {
+                app.ui.fx_slider_open.remove(&uid);
+            } else {
+                app.ui.fx_slider_open.insert(uid);
+            }
+        }
+        app.auto.add(&format!("effectControls.prop.{uid}.twirl"), tw, &prop.name);
+    }
+}
+
+/// One property row: stopwatch, name, value control (and the keyframe navigator). Returns the
+/// value fields of a vector, one per dimension, for the pick whip.
+#[allow(clippy::too_many_arguments)]
+fn prop_row(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    layer: &Layer,
+    group: &PropGroup,
+    prop: &Property,
+    ectx: &EvalCtx,
+    r: Rect,
+    indent: f32,
+    actions: &mut Actions,
+) -> Vec<Rect> {
+    let t = app.tokens;
+    let mut dims = vec![];
+    let cy = r.center().y;
+    let uid = prop.uid;
+    if ui.input(|i| i.pointer.primary_pressed()) && ui.rect_contains_pointer(r) {
+        let add = ui.input(|i| i.modifiers.shift || i.modifiers.command);
+        actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "add": add})));
+    }
+    let swr = Rect::from_center_size(pos2(r.min.x + indent, cy), vec2(14.0, 14.0));
+    if !prop.static_only && !matches!(prop.ui, ParamUi::Hidden) {
+        let resp = ui.interact(swr, egui::Id::unique(("ec-sw", uid)), Sense::click());
+        icons::paint(
+            p,
+            swr,
+            Icon::Stopwatch,
+            if prop.is_animated() {
+                t.hot_text
+            } else if resp.hovered() {
+                t.text
+            } else {
+                t.text_dim
+            },
+        );
+        app.auto.add(&format!("effectControls.prop.{uid}.stopwatch"), swr, &prop.name);
+        if resp.clicked() {
+            actions.push(("prop.toggleAnimation".into(), json!({"layer": layer.id.0, "prop": uid, "selected": true})));
+        }
+    }
+    if prop.is_animated() {
+        let half = ectx.comp.frame_duration().0 / 2;
+        let on_key = prop.keys.iter().any(|k| (layer.comp_time(k.time).0 - ectx.time.0).abs() <= half);
+        key_navigator(app, ui, p, KeyNav { layer_id: layer.id.0, on_key }, prop, r, actions);
+    }
+    let value = ectx.value(layer, prop);
+    // Keep a shared value column while names and their icons follow the group hierarchy.
+    // Extremely deep groups still leave a little name space before their value.
+    let vx = (r.min.x + r.width() * 0.48).max(r.min.x + PARAM_NAME_X + 124.0).max(swr.max.x + 40.0);
+    // A vector's values end before the keyframe navigator: in a narrow panel they move left over
+    // the name (cut short) instead of running under the navigator (#271).
+    let vx = match &value {
+        Value::Vec2(_) | Value::Vec3(_) => {
+            let point = if matches!(prop.ui, ParamUi::Point | ParamUi::Point3) { 22.0 } else { 0.0 };
+            let fields: f32 = value
+                .components()
+                .iter()
+                .take(shown_dims(layer, prop, &value))
+                .map(|v| p.layout_no_wrap(format!("{v:.1}"), Tokens::ui(12.0), t.hot_text).size().x + 12.0)
+                .sum();
+            let right = r.max.x - if prop.is_animated() { 52.0 } else { 8.0 };
+            vx.min(right - point - fields + 8.0).max(swr.max.x + 60.0)
+        }
+        _ => vx,
+    };
+    let name_clip = Rect::from_min_max(pos2(swr.max.x + 6.0, r.min.y), pos2(vx - 6.0, r.max.y));
+    app.auto.add(&format!("effectControls.prop.{uid}.name"), name_clip, &prop.name);
+    p.with_clip_rect(name_clip.intersect(p.clip_rect())).text(pos2(swr.max.x + 6.0, cy), Align2::LEFT_CENTER, &prop.name, Tokens::ui(12.0), t.text);
+    let name_response = ui.interact(name_clip, egui::Id::unique(("ec-prop-name", uid)), Sense::click());
+    if name_response.double_clicked() {
+        app.ui.timeline.search.clear();
+        app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Property(uid));
+        if let Err(e) = crate::menus::frontend(app, ui.ctx(), "timeline.revealProps", json!({"props": [{"layer": layer.id.0, "prop": uid}]})) {
+            app.ui.status = e;
+        }
+        app.show_panel(crate::dock::PanelKind::Timeline);
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.name"), name_clip, &prop.name);
+    // With several layers selected the edit applies to the same effect property of each (#491).
+    let scrub = ui.ctx().dragged_id().is_some() && ui.input(|i| i.pointer.is_decidedly_dragging());
+    let cx = PropCx { p, layer, group, prop, r, vx, cy, swr, t, uid, scrub };
+    match &value {
+        Value::Scalar(_) if matches!(prop.ui, ParamUi::Mask) => value_mask(app, ui, &cx, &value, actions),
+        Value::Scalar(_) if matches!(prop.ui, ParamUi::Angle) => value_angle(app, ui, &cx, &value, actions),
+        Value::Scalar(_) => value_scalar(app, ui, &cx, &value, actions),
+        Value::Vec2(_) | Value::Vec3(_) => dims = value_vector(app, ui, &cx, &value, actions),
+        Value::Color(_) => value_color(app, ui, &cx, &value, actions),
+        Value::Bool(_) => value_toggle(app, ui, &cx, &value, actions),
+        // Cryptomatte's Layer: the Cryptomatte layers the footage's metadata names.
+        Value::Enum(_) if crate::panels::fx_editors::is_crypto_layer(group, prop) => value_crypto_layer(app, ui, &cx, &value, actions),
+        Value::Enum(_) => value_popup(app, ui, &cx, &value, actions),
+        Value::Layer(_) => value_layer_ref(app, ui, &cx, &value, actions),
+        // EXtractoR's red / green / blue / alpha: a popup of the footage's OpenEXR channels (#295).
+        Value::Str(_) if crate::panels::fx_editors::is_extractor_channel(group, prop) => value_extractor(app, ui, &cx, &value, actions),
+        // A file parameter (Apply Color LUT's LUT, an OCIO config): its file name and Choose…,
+        // as in After Effects.
+        Value::Str(_) if matches!(prop.ui, ParamUi::File { .. }) => value_file(app, ui, &cx, &value, actions),
+        // A text parameter (Cryptomatte's Selection, Colorama's Output Cycle, config names):
+        // typed in a field, set when it loses the focus (Esc keeps the old text).
+        Value::Str(_) if matches!(prop.ui, ParamUi::Text) => value_text(app, ui, &cx, &value, actions),
+        Value::Gradient(_) => value_gradient(app, &cx, &value),
+        _ => {}
+    }
+    dims
+}
+
+fn value_mask(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Scalar(v) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, layer, prop, .. } = *cx;
+    // A mask of this layer ("Path" popup).
+    let mut opts = vec!["None".to_string()];
+    if let Some(m) = layer.masks() {
+        opts.extend(m.groups().map(|g| g.name.clone()));
+    }
+    let i = v.round().max(0.0) as usize;
+    let label = opts.get(i).cloned().unwrap_or_else(|| format!("Mask {i}"));
+    let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((r.max.x - vx - 56.0).clamp(80.0, 200.0), 18.0));
+    let pop = egui::Id::unique(("ec-mpop", uid));
+    if widgets::dropdown(ui, dr, &label, &t, egui::Id::unique(("ec-m", uid))).clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
+    if let Some(ni) = widgets::popup_menu(ui, pop, dr.left_bottom(), &opts, Some(i)) {
+        cx.set_step(actions, json!(ni as f64));
+    }
+}
+
+fn value_angle(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Scalar(v) = value else {
+        return;
+    };
+    let PropCx { uid, cy, vx, prop, .. } = *cx;
+    let (rr, dr, nv) = fw::angle_field(ui, pos2(vx, cy - 9.0), egui::Id::unique(("ec-v", uid)), *v, 1, &cx.value_tokens());
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), rr.union(dr), &fw::format_angle(*v, 1));
+    app.auto.add(&format!("effectControls.prop.{uid}.revolutions"), rr, &prop.name);
+    if let Some(nv) = nv {
+        cx.set(actions, json!(nv));
+    }
+    cx.twirl_open(app, ui);
+}
+
+fn value_scalar(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Scalar(v) = value else {
+        return;
+    };
+    let PropCx { uid, cy, vx, prop, .. } = *cx;
+    let (min, max, dec) = match &prop.ui {
+        ParamUi::Slider { min, max, decimals, .. } => (*min, *max, *decimals as usize),
+        _ => (-1e9, 1e9, 1),
+    };
+    let suffix = match prop.ui {
+        ParamUi::Percent => "%",
+        _ => "",
+    };
+    let speed = widgets::slider_scrub_speed(&prop.ui);
+    let (vr, nv, _) = widgets::hot_number_at(
+        ui,
+        pos2(vx, cy - 9.0),
+        egui::Id::unique(("ec-v", uid)),
+        *v,
+        &widgets::HotSpec { speed, range: (min, max), decimals: dec.max(if dec == 0 { 0 } else { 1 }), suffix },
+        &cx.value_tokens(),
+    );
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), vr, &prop.name);
+    if let Some(nv) = nv {
+        cx.set(actions, json!(nv));
+    }
+    // AE hides a slider param's slider until its twirl is opened (see `slider_row`).
+    if matches!(prop.ui, ParamUi::Slider { .. }) {
+        cx.twirl_open(app, ui);
+    }
+}
+
+fn value_vector(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) -> Vec<Rect> {
+    let mut dims = vec![];
+    let PropCx { t, uid, cy, vx, layer, prop, .. } = *cx;
+    let c = value.components();
+    let n = shown_dims(layer, prop, value);
+    let vt = cx.value_tokens();
+    let mut x = vx;
+    if matches!(prop.ui, ParamUi::Point | ParamUi::Point3) {
+        let cr = Rect::from_center_size(pos2(x + 8.0, cy), vec2(18.0, 18.0));
+        let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == "point");
+        if fw::crosshair_button(ui, cr, active, egui::Id::unique(("ec-xh", uid)), &t)
+            .on_hover_text(crate::i18n::tr("Click, then click in the Composition panel"))
+            .clicked()
+        {
+            toggle_pick(app, "point", layer, prop);
+        }
+        app.auto.add(&format!("effectControls.prop.{uid}.crosshair"), cr, &prop.name);
+        x += 22.0;
+    }
+    for d in 0..n.min(c.len()) {
+        let (vr, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(x, cy - 9.0),
+            egui::Id::unique(("ec-v", uid, d)),
+            c[d],
+            &widgets::HotSpec { speed: 1.0, range: (-1e9, 1e9), decimals: 1, suffix: "" },
+            &vt,
+        );
+        app.auto.add(&format!("effectControls.prop.{uid}.value.{d}"), vr, &prop.name);
+        dims.push(vr);
+        if let Some(nv) = nv {
+            let mut nc = c.clone();
+            nc[d] = nv;
+            cx.set(actions, json!(nc));
+            // Typed into this component only: other selected layers keep the rest of
+            // their own value (#1434).
+            if let Some((_, a)) = actions.last_mut() {
+                a["dims"] = json!([d]);
+            }
+        }
+        x = vr.max.x + 8.0;
+    }
+    dims
+}
+
+fn value_color(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Color(c) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, layer, prop, .. } = *cx;
+    let sr = Rect::from_min_size(pos2(vx, cy - 8.0), vec2(30.0, 16.0));
+    let pop = egui::Id::unique(("ec-cpop", uid));
+    if widgets::swatch(ui, sr, [c[0] as f32, c[1] as f32, c[2] as f32, 1.0], egui::Id::unique(("ec-c", uid)), &t).clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), sr, &prop.name);
+    let er = Rect::from_center_size(pos2(sr.max.x + 14.0, cy), vec2(18.0, 18.0));
+    let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == "color");
+    if fw::eyedropper_button(ui, er, active, egui::Id::unique(("ec-eye", uid)), &t)
+        .on_hover_text(crate::i18n::tr("Eyedropper: click, then click in the Composition panel"))
+        .clicked()
+    {
+        toggle_pick(app, "color", layer, prop);
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.eyedropper"), er, &prop.name);
+    let mut rgb = [c[0] as f32, c[1] as f32, c[2] as f32];
+    if crate::widgets::color_popup(ui, pop, sr.left_bottom(), &mut rgb) {
+        cx.set(actions, json!([rgb[0], rgb[1], rgb[2], 1.0]));
+    }
+}
+
+fn value_toggle(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Bool(b) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, p, prop, .. } = *cx;
+    let cr = Rect::from_min_size(pos2(vx, cy - 8.0), vec2(16.0, 16.0));
+    if widgets::checkbox(ui, cr, *b, &t, egui::Id::unique(("ec-b", uid))).changed() {
+        cx.set_step(actions, json!(!b));
+    }
+    p.text(pos2(cr.max.x + 6.0, cy), Align2::LEFT_CENTER, &prop.name, Tokens::ui(12.0), t.text_dim);
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), cr, &prop.name);
+}
+
+fn value_popup(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Enum(i) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, p, prop, .. } = *cx;
+    if let ParamUi::Popup { options } = &prop.ui {
+        let widest = options.iter().map(|o| p.layout_no_wrap(o.clone(), Tokens::ui(11.5), t.text).size().x).fold(0.0, f32::max);
+        let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((widest + 30.0).clamp(80.0, (r.max.x - vx - 56.0).max(80.0)), 18.0));
+        let pop = egui::Id::unique(("ec-epop", uid));
+        if widgets::dropdown(ui, dr, options.get(*i as usize).map(String::as_str).unwrap_or(""), &t, egui::Id::unique(("ec-e", uid))).clicked() {
+            widgets::open_popup(ui, pop);
+        }
+        app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
+        if let Some(ni) = widgets::popup_menu(ui, pop, dr.left_bottom(), options, Some(*i as usize)) {
+            cx.set_step(actions, json!(ni));
+        }
+    }
+}
+
+/// Cryptomatte's Layer popup: the Cryptomatte layers of the layer's OpenEXR footage (the three
+/// standard ones when there are none). The stored value stays the index
+/// [`effectcraft_engine::effects::crypto_layer_name`] reads, so older projects load unchanged.
+fn value_crypto_layer(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Enum(i) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, p, layer, prop, .. } = *cx;
+    // The channels of the frame the render just read: decoded files are cached.
+    let aux = app.session.layer_channels(layer.id);
+    let (choices, shown) = effectcraft_engine::effects::crypto_layer_menu(aux.as_deref(), *i as usize);
+    let names: Vec<String> = choices.iter().map(|c| c.1.clone()).collect();
+    let widest = names.iter().map(|o| p.layout_no_wrap(o.clone(), Tokens::ui(11.5), t.text).size().x).fold(0.0, f32::max);
+    let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((widest + 30.0).clamp(80.0, (r.max.x - vx - 56.0).max(80.0)), 18.0));
+    let pop = egui::Id::unique(("ec-epop", uid));
+    if widgets::dropdown(ui, dr, shown.as_deref().unwrap_or(""), &t, egui::Id::unique(("ec-e", uid))).clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
+    let cur = names.iter().position(|n| Some(n) == shown.as_ref());
+    if let Some(ni) = widgets::popup_menu(ui, pop, dr.left_bottom(), &names, cur)
+        && let Some(c) = choices.get(ni)
+    {
+        cx.set_step(actions, json!(c.0));
+    }
+}
+
+fn value_layer_ref(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Layer(l) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, layer, prop, group, .. } = *cx;
+    let comp = app.session.active_comp_arc();
+    if let Some(comp) = comp {
+        let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2(((r.max.x - vx) * 0.55).clamp(90.0, 170.0), 18.0));
+        if let Some(chosen) = widgets::layer_picker(ui, dr, &comp.layers, *l, &t, egui::Id::unique(("ec-l", uid))) {
+            cx.set_step(actions, chosen.map(|id| json!(id)).unwrap_or(serde_json::Value::Null));
+        }
+        app.auto.add(&format!("effectControls.prop.{uid}.value"), dr, &prop.name);
+        // Source / Masks / Effects & Masks (the hidden companion parameter).
+        if let Some(src) = group.get(&effectcraft_engine::effects::layer_source_id(&prop.match_id)) {
+            let si = src.value.as_enum() as usize;
+            let opts: Vec<String> = effectcraft_engine::effects::LAYER_SOURCE_OPTIONS.iter().map(|s| s.to_string()).collect();
+            let sr = Rect::from_min_size(pos2(dr.max.x + 6.0, cy - 9.0), vec2(((r.max.x - dr.max.x) - 64.0).clamp(70.0, 120.0), 18.0));
+            let spop = egui::Id::unique(("ec-lspop", uid));
+            if widgets::dropdown(ui, sr, opts.get(si).map(String::as_str).unwrap_or(""), &t, egui::Id::unique(("ec-ls", uid))).clicked() {
+                widgets::open_popup(ui, spop);
+            }
+            app.auto.add(&format!("effectControls.prop.{uid}.source"), sr, &src.name);
+            if let Some(ni) = widgets::popup_menu(ui, spop, sr.left_bottom(), &opts, Some(si)) {
+                actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": src.uid, "value": ni})));
+            }
+        }
+    }
+}
+
+fn value_extractor(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Str(s) = value else {
+        return;
+    };
+    let PropCx { cy, vx, r, layer, prop, .. } = *cx;
+    let dr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((r.max.x - vx - 56.0).clamp(80.0, 200.0), 18.0));
+    crate::panels::fx_editors::channel_popup(app, ui, layer, prop, s, dr, actions);
+}
+
+fn value_file(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Str(s) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, p, layer, prop, .. } = *cx;
+    let bw = 70.0;
+    let br = Rect::from_min_size(pos2(vx, cy - 9.0), vec2(bw, 18.0));
+    if widgets::text_button(ui, br, crate::i18n::tr("Choose..."), false, &t, egui::Id::unique(("ec-file", uid))).clicked() {
+        let filters: Vec<&str> = match &prop.ui {
+            ParamUi::File { filters } => filters.iter().map(String::as_str).collect(),
+            _ => vec![],
+        };
+        match app.hooks.pick_files.as_ref() {
+            Some(pick) => {
+                if let Some(path) = pick(&filters).into_iter().next() {
+                    actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": path})));
+                }
+            }
+            None => app.ui.status = "no file dialog available: set the path with prop.set".into(),
+        }
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.choose"), br, &prop.name);
+    let shown = if s.trim().is_empty() {
+        crate::i18n::tr("None").to_string()
+    } else if s.contains('\n') {
+        prop.name.clone()
+    } else {
+        effectcraft_engine::sequence::file_name(s)
+    };
+    let nr = Rect::from_min_max(pos2(br.max.x + 8.0, r.min.y), pos2(r.max.x - 8.0, r.max.y));
+    let np = p.with_clip_rect(nr.intersect(p.clip_rect()));
+    np.text(pos2(nr.min.x, cy), Align2::LEFT_CENTER, &shown, Tokens::ui(12.0), if s.trim().is_empty() { t.text_dim } else { t.text });
+    let hover = ui.interact(nr, egui::Id::unique(("ec-file-name", uid)), Sense::hover());
+    if !s.trim().is_empty() && !s.contains('\n') {
+        hover.on_hover_text(s);
+    }
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), nr, &shown);
+}
+
+fn value_text(app: &mut EffectcraftApp, ui: &mut egui::Ui, cx: &PropCx, value: &Value, actions: &mut Actions) {
+    let Value::Str(s) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, layer, group, prop, .. } = *cx;
+    // Cryptomatte's Selection also has an eyedropper that picks IDs in the viewer (#473).
+    let crypto = matches!(&group.kind, GroupKind::Effect { effect } if effect == "ec.3d.cryptomatte") && prop.match_id == "selection";
+    let fr = Rect::from_min_size(pos2(vx, cy - 9.0), vec2((r.max.x - vx - if crypto { 36.0 } else { 12.0 }).clamp(80.0, 320.0), 18.0));
+    if crypto {
+        let er = Rect::from_center_size(pos2(fr.max.x + 14.0, cy), vec2(18.0, 18.0));
+        let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == crate::panels::crypto_pick::KIND);
+        if fw::eyedropper_button(ui, er, active, egui::Id::unique(("ec-eye", uid)), &t)
+            .on_hover_text(crate::i18n::tr("Eyedropper: click, then click in the Composition panel"))
+            .clicked()
+        {
+            toggle_pick(app, crate::panels::crypto_pick::KIND, layer, prop);
+        }
+        app.auto.add(&format!("effectControls.prop.{uid}.eyedropper"), er, &prop.name);
+    }
+    let bid = egui::Id::unique(("ec-text", uid));
+    let mut buf: String = ui.data(|d| d.get_temp(bid)).unwrap_or_else(|| s.to_owned());
+    let resp = widgets::text_field(ui, fr, &mut buf, "", &t);
+    // Cut off by a narrow panel (a long Selection): the whole text on hover.
+    let cut = !resp.has_focus() && ui.painter().layout_no_wrap(buf.clone(), egui::TextStyle::Body.resolve(ui.style()), t.text).size().x > fr.width() - 17.0;
+    let resp = if cut { resp.on_hover_text(buf.clone()) } else { resp };
+    // The field has no visible hint: give the screen reader the parameter's name.
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, ui.is_enabled(), &prop.name));
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), fr, &prop.name);
+    if resp.lost_focus() {
+        if buf != *s && !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+            actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": buf})));
+        }
+        ui.data_mut(|d| d.remove::<String>(bid));
+    } else if resp.has_focus() {
+        ui.data_mut(|d| d.insert_temp(bid, buf));
+    }
+}
+
+fn value_gradient(app: &mut EffectcraftApp, cx: &PropCx, value: &Value) {
+    let Value::Gradient(g) = value else {
+        return;
+    };
+    let PropCx { t, uid, cy, vx, r, p, prop, .. } = *cx;
+    let gr = Rect::from_min_size(pos2(vx, cy - 7.0), vec2((r.max.x - vx - 56.0).clamp(60.0, 180.0), 14.0));
+    let n = 48;
+    for k in 0..n {
+        let f = k as f64 / (n - 1) as f64;
+        let c = gradient_at(g, f);
+        let x0 = gr.min.x + gr.width() * k as f32 / n as f32;
+        let x1 = gr.min.x + gr.width() * (k + 1) as f32 / n as f32;
+        p.rect_filled(Rect::from_min_max(pos2(x0, gr.min.y), pos2(x1, gr.max.y)), 0.0, c);
+    }
+    p.rect_stroke(gr, 2.0, Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
+    app.auto.add(&format!("effectControls.prop.{uid}.value"), gr, &prop.name);
+}
+
+/// How many of a vector parameter's values show (a 3D point's Z only on a 3D layer).
+fn shown_dims(layer: &Layer, prop: &Property, value: &Value) -> usize {
+    let n = value.components().len();
+    if prop.shown_dims > 0 && !(layer.is_3d() && n == 3) { prop.shown_dims as usize } else { n }
+}
+
+/// Colour of a gradient at `f` (colour stops only).
+fn gradient_at(g: &effectcraft_engine::keyframe::Gradient, f: f64) -> Color32 {
+    let stops = &g.colors;
+    let c = if stops.is_empty() {
+        [0.0, 0.0, 0.0, 1.0]
+    } else if f <= stops[0].0 {
+        stops[0].1
+    } else if f >= stops[stops.len() - 1].0 {
+        stops[stops.len() - 1].1
+    } else {
+        let i = stops.iter().position(|s| s.0 > f).unwrap_or(stops.len() - 1).max(1);
+        let (a, b) = (stops[i - 1], stops[i]);
+        let k = ((f - a.0) / (b.0 - a.0).max(1e-9)) as f32;
+        [0, 1, 2, 3].map(|j| a.1[j] + (b.1[j] - a.1[j]) * k)
+    };
+    Color32::from_rgb((c[0].clamp(0.0, 1.0) * 255.0) as u8, (c[1].clamp(0.0, 1.0) * 255.0) as u8, (c[2].clamp(0.0, 1.0) * 255.0) as u8)
+}
+
+/// The twirled-open slider under a slider param: track, knob and the slider range's ends.
+#[allow(clippy::too_many_arguments)]
+fn slider_row(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    layer: &Layer,
+    prop: &Property,
+    ectx: &EvalCtx,
+    r: Rect,
+    x0: f32,
+    actions: &mut Actions,
+) {
+    let t = app.tokens;
+    let ParamUi::Slider { slider_min, slider_max, decimals, .. } = prop.ui else { return };
+    let Value::Scalar(v) = ectx.value(layer, prop) else { return };
+    let uid = prop.uid;
+    let tr = Rect::from_min_max(pos2(r.min.x + x0, r.min.y + 8.0), pos2(r.max.x - 16.0, r.min.y + 12.0));
+    if tr.width() < 40.0 {
+        return;
+    }
+    p.rect_filled(tr, 2.0, t.field_bg);
+    let f = ((v - slider_min) / (slider_max - slider_min)).clamp(0.0, 1.0) as f32;
+    p.rect_filled(Rect::from_min_max(tr.min, pos2(tr.min.x + tr.width() * f, tr.max.y)), 2.0, t.accent.gamma_multiply(0.7));
+    p.circle_filled(pos2(tr.min.x + tr.width() * f, tr.center().y), 5.0, t.text);
+    let dec = decimals as usize;
+    p.text(pos2(tr.min.x, tr.max.y + 4.0), Align2::LEFT_TOP, format!("{slider_min:.dec$}"), Tokens::ui(10.5), t.text_dim);
+    p.text(pos2(tr.max.x, tr.max.y + 4.0), Align2::RIGHT_TOP, format!("{slider_max:.dec$}"), Tokens::ui(10.5), t.text_dim);
+    let sresp = ui.interact(tr.expand2(vec2(4.0, 6.0)), egui::Id::unique(("ec-slider", uid)), Sense::click_and_drag());
+    app.auto.add(&format!("effectControls.prop.{uid}.slider"), tr, &prop.name);
+    if (sresp.dragged() || sresp.clicked())
+        && let Some(pt) = sresp.interact_pointer_pos()
+    {
+        let f = ((pt.x - tr.min.x) / tr.width()).clamp(0.0, 1.0) as f64;
+        actions.push((
+            "prop.set".into(),
+            json!({"layer": layer.id.0, "prop": uid, "value": slider_min + (slider_max - slider_min) * f, "merge": format!("ec-{uid}")}),
+        ));
+    }
+}
+
+/// The twirled-open angle dial under an angle param.
+#[allow(clippy::too_many_arguments)]
+fn dial_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, layer: &Layer, prop: &Property, ectx: &EvalCtx, r: Rect, x0: f32, actions: &mut Actions) {
+    let t = app.tokens;
+    let Value::Scalar(v) = ectx.value(layer, prop) else { return };
+    let uid = prop.uid;
+    let d = (r.height() - 12.0).min(52.0);
+    let dr = Rect::from_min_size(pos2(r.min.x + x0 + 40.0, r.min.y + 6.0), vec2(d, d));
+    let id = egui::Id::unique(("ec-dial", uid));
+    let (resp, nv) = fw::angle_dial(ui, dr, v, id, &t);
+    app.auto.add(&format!("effectControls.prop.{uid}.dial"), dr, &prop.name);
+    if let Some(nv) = nv {
+        let key = gesture_key(ui, id, resp.drag_started() || resp.clicked());
+        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": uid, "value": nv, "merge": key})));
+    }
+}
+
+/// The effect instance a row belongs to, for conditional visibility
+/// ([`effectcraft_engine::effects::catalog::param_shown`]): effect id, the instance's root
+/// group and the spec-id path of the group being drawn (`""` or `cameraPosition/`).
+pub(super) struct FxScope<'a> {
+    pub(super) effect: &'a str,
+    pub(super) root: &'a PropGroup,
+    pub(super) path: String,
+}
+
+impl<'a> FxScope<'a> {
+    pub(super) fn sub(&self, m: &str) -> FxScope<'a> {
+        FxScope { effect: self.effect, root: self.root, path: format!("{}{m}/", self.path) }
+    }
+    /// Whether child `m` of the current group is shown.
+    pub(super) fn shown(&self, layer: &Layer, ectx: &EvalCtx, m: &str) -> bool {
+        let root = self.root;
+        let value = |id: &str| -> Option<Value> {
+            let mut g = root;
+            let mut parts = id.split('/').peekable();
+            while let Some(part) = parts.next() {
+                if parts.peek().is_none() {
+                    return g.get(part).map(|p| ectx.value(layer, p));
+                }
+                g = g.sub(part)?;
+            }
+            None
+        };
+        effectcraft_engine::effects::catalog::param_shown(self.effect, &format!("{}{m}", self.path), &value)
+    }
+}
+
+/// Twirl `g` closed (it was `open`) or open; with `all` (Alt/Cmd-click) every group under it follows.
+pub(super) fn toggle_closed(app: &mut EffectcraftApp, g: &PropGroup, open: bool, all: bool) {
+    fn walk(g: &PropGroup, out: &mut Vec<u64>) {
+        for sg in g.groups() {
+            out.push(sg.uid);
+            walk(sg, out);
+        }
+    }
+    let mut uids = vec![g.uid];
+    if all {
+        walk(g, &mut uids);
+    }
+    for u in uids {
+        if open {
+            app.ui.fx_closed.insert(u);
+        } else {
+            app.ui.fx_closed.remove(&u);
+        }
+    }
+}
+
+/// Lays out one property group's rows below `*y` (which it advances), recursing into open
+/// subgroups: one row per visible property with its controls, plus the dial or slider row when its
+/// slider is open, and an inline editor for groups that have one. Rows scrolled out of `rect` are
+/// skipped without being drawn or registered, though their height is still counted. Pick-whip
+/// drops are registered for each visible property; edits go on `actions`.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn group_rows(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    p: &egui::Painter,
+    layer: &Layer,
+    g: &PropGroup,
+    ectx: &EvalCtx,
+    rect: Rect,
+    y: &mut f32,
+    depth: usize,
+    fx: &FxScope,
+    actions: &mut Actions,
+) {
+    let t = app.tokens;
+    for c in &g.children {
+        let r = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), ROW));
+        match c {
+            Node::Prop(pr) => {
+                if matches!(pr.ui, ParamUi::Hidden) || pr.three_d_only && !layer.is_3d() || !fx.shown(layer, ectx, &pr.match_id) {
+                    continue;
+                }
+                *y += ROW;
+                let indent = PARAM_NAME_X - 13.0 + TREE_INDENT * depth as f32;
+                let visible = !(r.max.y < rect.min.y || r.min.y > rect.max.y);
+                if visible {
+                    app.auto.add(&format!("effectControls.row.{}", pr.uid), r, &pr.name);
+                    let dims = prop_row(app, ui, p, layer, g, pr, ectx, r, indent, actions);
+                    // A Timeline pick whip can be dropped here (After Effects).
+                    crate::panels::timeline::whip_target(ui.ctx(), r.intersect(rect), layer.id.0, pr.uid, dims);
+                }
+                if app.ui.fx_slider_open.contains(&pr.uid) {
+                    if matches!(pr.ui, ParamUi::Angle) {
+                        let sr = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), DIAL_ROW));
+                        *y += DIAL_ROW;
+                        if sr.max.y >= rect.min.y && sr.min.y <= rect.max.y {
+                            dial_row(app, ui, layer, pr, ectx, sr, indent + 22.0, actions);
+                        }
+                    } else if matches!(pr.ui, ParamUi::Slider { .. }) {
+                        let sr = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), 34.0));
+                        *y += 34.0;
+                        if sr.max.y >= rect.min.y && sr.min.y <= rect.max.y {
+                            slider_row(app, ui, p, layer, pr, ectx, sr, indent + 22.0, actions);
+                        }
+                    }
+                }
+            }
+            Node::Group(sg) => {
+                // Paint strokes live in the Timeline only (AE's Paint shows Paint on Transparent).
+                if effectcraft_engine::effects::paint::is_paint(g) || !fx.shown(layer, ectx, &sg.match_id) {
+                    continue;
+                }
+                *y += ROW;
+                let open = !app.ui.fx_closed.contains(&sg.uid);
+                let tw = Rect::from_center_size(pos2(r.min.x + PARAM_NAME_X - 12.0 + TREE_INDENT * depth as f32, r.center().y), vec2(12.0, 12.0));
+                if r.max.y >= rect.min.y && r.min.y <= rect.max.y {
+                    app.auto.add(&format!("effectControls.row.{}", sg.uid), r, &sg.name);
+                    app.auto.add(&format!("effectControls.group.{}.twirl", sg.uid), tw, &sg.name);
+                    if widgets::twirl(ui, tw, open, egui::Id::unique(("ec-g", sg.uid)), &t).clicked() {
+                        toggle_closed(app, sg, open, ui.input(|i| i.modifiers.alt || i.modifiers.command));
+                    }
+                    let name = p.text(pos2(tw.max.x + 6.0, r.center().y), Align2::LEFT_CENTER, &sg.name, Tokens::ui(12.0), t.text);
+                    app.auto.add(&format!("effectControls.group.{}.name", sg.uid), name, &sg.name);
+                }
+                if open {
+                    let sub = fx.sub(&sg.match_id);
+                    // A visual editor for the group's hidden parameters (Lumetri curves, …).
+                    let eh = crate::panels::fx_editors::inline_height(fx.effect, &sub.path, rect.width());
+                    if eh > 0.0 {
+                        let er = Rect::from_min_size(pos2(rect.min.x, *y), vec2(rect.width(), eh));
+                        *y += eh;
+                        if er.max.y >= rect.min.y && er.min.y <= rect.max.y {
+                            crate::panels::fx_editors::inline_editor(app, ui, p, layer, fx.root, sg, fx.effect, &sub.path, ectx, er, actions);
+                        }
+                    }
+                    group_rows(app, ui, p, layer, sg, ectx, rect, y, depth + 1, &sub, actions);
+                }
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/panels/effect_controls/viewer.rs b/crates/ui-egui/src/panels/effect_controls/viewer.rs
new file mode 100644
index 000000000..6d4eb7ffd
--- /dev/null
+++ b/crates/ui-egui/src/panels/effect_controls/viewer.rs
@@ -0,0 +1,331 @@
+use std::ops::ControlFlow;
+
+use super::common::{Actions, effect_active, gesture_key};
+use super::rows::FxScope;
+use super::{
+    Align2, Color32, EffectcraftApp, EvalCtx, GroupKind, Layer, Mat3, Node, ParamUi, PropGroup, Property, Rect, Sense, Stroke, Tokens, fw, json, vec2,
+};
+
+// ---------------------------------------------------------------------------------------------
+// Viewer hook
+
+/// Collect point controls through visible parameter groups. Hidden optional slots do not
+/// leave stray viewport handles. The depth cap also bounds malformed project trees.
+fn visible_points<'a>(g: &'a PropGroup, scope: &FxScope<'_>, layer: &Layer, ectx: &EvalCtx, depth: usize, out: &mut Vec<&'a Property>) {
+    if depth > 16 {
+        return;
+    }
+    for node in &g.children {
+        match node {
+            Node::Prop(p) if matches!(p.ui, ParamUi::Point) && scope.shown(layer, ectx, &p.match_id) => out.push(p),
+            Node::Group(child) if child.enabled && scope.shown(layer, ectx, &child.match_id) => {
+                visible_points(child, &scope.sub(&child.match_id), layer, ectx, depth + 1, out)
+            }
+            _ => {}
+        }
+    }
+}
+
+/// An armed crosshair / eyedropper pick: the hint chip, the cursor preview, and the click that
+/// sets or samples. `Break` when the picked layer is gone; `Continue` carries the point preview.
+fn fx_pick_session(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    painter: &egui::Painter,
+    map: &crate::panels::viewer::ViewerMap,
+    ectx: &EvalCtx,
+    l2c: &dyn Fn(&EvalCtx, &Layer) -> Mat3,
+    actions: &mut Actions,
+) -> ControlFlow<(), Option<egui::Pos2>> {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    let mut point_preview = None;
+    let Some(pick) = app.ui.fx_pick.clone() else {
+        return ControlFlow::Continue(None);
+    };
+    let Some(layer) = ectx.comp.layer(effectcraft_engine::project::LayerId(pick.layer)).cloned() else {
+        app.ui.fx_pick = None;
+        return ControlFlow::Break(());
+    };
+    // Keyers pick from their input (the shown frame is already keyed): `effect.pickColor`.
+    let keyer = (pick.kind == "color")
+        .then(|| layer.effects()?.groups().find(|g| g.find(pick.prop).is_some()))
+        .flatten()
+        .filter(|g| effectcraft_engine::effects::find(&g.match_id).is_some_and(|s| s.category == "Keying"))
+        .map(|g| g.uid);
+    if pick.kind == "color" && keyer.is_none() {
+        // GPU frames: read the shown frame back for sampling.
+        app.viewer_pixels();
+    }
+    let resp = ui.interact(map.area, egui::Id::unique("viewer-fx-pick"), Sense::click());
+    app.auto.add("viewer.fxPick", map.area, &pick.name);
+    let hint = if pick.kind == "point" { format!("Click to set {}", pick.name) } else { format!("Click to sample {}", pick.name) };
+    let chip = Rect::from_min_size(map.area.min + vec2(10.0, 10.0), vec2(220.0, 22.0));
+    painter.rect_filled(chip, 11.0, Color32::from_black_alpha(180));
+    painter.text(chip.center(), Align2::CENTER_CENTER, hint, Tokens::ui(11.5), t.text);
+    if let Some(hp) = resp.hover_pos() {
+        ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
+        let c = map.to_comp(hp);
+        app.pointer_comp = Some([c[0] as f32, c[1] as f32]);
+        if pick.kind == "point" && fw::comp_to_layer(&l2c(ectx, &layer), c).is_some() {
+            point_preview = Some(hp);
+        }
+        if pick.kind == "color"
+            && keyer.is_none()
+            && let Some(img) = &app.viewer_image
+            && let Some(s) = fw::sample_frame(img, crate::panels::viewer_tools::shown_region(&ctx, map.comp), c)
+        {
+            let sw = Rect::from_min_size(hp + vec2(14.0, 14.0), vec2(26.0, 18.0));
+            painter.rect_filled(sw, 2.0, Color32::from_rgb((s[0] * 255.0) as u8, (s[1] * 255.0) as u8, (s[2] * 255.0) as u8));
+            painter.rect_stroke(sw, 2.0, Stroke::new(1.0, Color32::WHITE), egui::StrokeKind::Outside);
+        }
+    }
+    // No frame to sample yet (it is still rendering, or its readback is pending): the click
+    // leaves the eyedropper armed instead of using it up without a colour.
+    let unsampled = pick.kind == "color" && keyer.is_none() && app.viewer_image.is_none();
+    if resp.clicked()
+        && !unsampled
+        && let Some(pos) = resp.interact_pointer_pos()
+    {
+        let c = map.to_comp(pos);
+        // Effect points and the keyer's input are in effect space.
+        let m = crate::panels::viewer::from_effect_space(ectx, &layer, l2c(ectx, &layer));
+        if pick.kind == "point" {
+            if let Some(lp) = fw::comp_to_layer(&m, c) {
+                actions.push(("prop.set".into(), json!({"layer": pick.layer, "prop": pick.prop, "value": [lp[0], lp[1]]})));
+            }
+        } else if let Some(fx) = keyer {
+            // Ctrl/Cmd+click averages the 5 × 5 pixels around the point.
+            if let Some(lp) = fw::comp_to_layer(&m, c) {
+                let average = ui.input(|i| i.modifiers.command);
+                actions.push((
+                    "effect.pickColor".into(),
+                    json!({"layer": pick.layer, "effect": fx, "prop": pick.prop, "x": lp[0], "y": lp[1], "average": average}),
+                ));
+            }
+        } else if let Some(img) = &app.viewer_image
+            && let Some(s) = fw::sample_frame(img, crate::panels::viewer_tools::shown_region(&ctx, map.comp), c)
+        {
+            actions.push(("prop.set".into(), json!({"layer": pick.layer, "prop": pick.prop, "value": [s[0], s[1], s[2], 1.0]})));
+        }
+        app.ui.fx_pick = None;
+        app.ui.status.clear();
+    }
+    if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+        app.ui.fx_pick = None;
+        app.ui.status.clear();
+    }
+
+    ControlFlow::Continue(point_preview)
+}
+
+/// Shared hint chip and sampled-color swatch for text and popup eyedroppers.
+fn color_pick_preview(app: &EffectcraftApp, painter: &egui::Painter, map: &crate::panels::viewer::ViewerMap, hint: &str, pointer: Option<egui::Pos2>) {
+    let chip = Rect::from_min_size(map.area.min + vec2(10.0, 10.0), vec2(220.0, 22.0));
+    painter.rect_filled(chip, 11.0, Color32::from_black_alpha(180));
+    painter.text(chip.center(), Align2::CENTER_CENTER, hint, Tokens::ui(11.5), app.tokens.text);
+    if let Some(pos) = pointer
+        && let Some(sample) = crate::panels::viewer_tools::sample_displayed(app, painter.ctx(), map.to_comp(pos))
+    {
+        let swatch = Rect::from_min_size(pos + vec2(14.0, 14.0), vec2(26.0, 18.0));
+        painter.rect_filled(swatch, 2.0, Color32::from_rgb((sample[0] * 255.0) as u8, (sample[1] * 255.0) as u8, (sample[2] * 255.0) as u8));
+        painter.rect_stroke(swatch, 2.0, Stroke::new(1.0, Color32::WHITE), egui::StrokeKind::Outside);
+    }
+}
+
+/// An armed text-colour pick: sample the shown frame on click, Esc cancels.
+fn text_color_pick(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    painter: &egui::Painter,
+    map: &crate::panels::viewer::ViewerMap,
+    ectx: &EvalCtx,
+    actions: &mut Actions,
+) {
+    let ctx = ui.ctx().clone();
+    let Some(pick) = app.ui.text_color_pick.clone() else {
+        return;
+    };
+    if ectx.comp.layer(effectcraft_engine::project::LayerId(pick.layer)).is_none() {
+        app.ui.text_color_pick = None;
+        app.ui.status.clear();
+    } else {
+        app.viewer_pixels();
+        let resp = ui.interact(map.area, egui::Id::unique("viewer-text-color-pick"), Sense::click());
+        app.auto.add("viewer.textColorPick", map.area, &pick.field);
+        color_pick_preview(app, painter, map, &crate::i18n::tr_args("Click to sample text {}", &[&pick.field]), resp.hover_pos());
+        if let Some(pos) = resp.hover_pos() {
+            ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
+            let c = map.to_comp(pos);
+            app.pointer_comp = Some([c[0] as f32, c[1] as f32]);
+        }
+        if resp.clicked()
+            && let Some(pos) = resp.interact_pointer_pos()
+            && let Some(s) = crate::panels::viewer_tools::sample_displayed(app, &ctx, map.to_comp(pos))
+        {
+            let mut params = json!({"layer": pick.layer});
+            params[&pick.field] = json!([s[0], s[1], s[2]]);
+            if let Some(range) = pick.range {
+                params["range"] = json!(range);
+            }
+            actions.push(("layer.setText".into(), params));
+            app.ui.text_color_pick = None;
+            app.ui.status.clear();
+        }
+        if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+            app.ui.text_color_pick = None;
+            app.ui.status.clear();
+        }
+    }
+}
+
+/// A colour picker's eyedropper is armed (its popup stays open): the viewer shows the colour under
+/// the pointer, and the next press on it samples the frame into the picker. The press is read from
+/// the pointer, since a modal dialog over the viewer takes its clicks.
+fn popup_eyedropper(app: &mut EffectcraftApp, ui: &mut egui::Ui, painter: &egui::Painter, map: &crate::panels::viewer::ViewerMap) {
+    let ctx = ui.ctx().clone();
+    if !crate::color_picker::eyedropper_armed(&ctx) {
+        return;
+    }
+    let _ = ui.interact(map.area, egui::Id::unique("viewer-popup-eyedropper"), Sense::click());
+    // The sampling surface, apart from the picker's button that arms it (`colorPicker.eyedropper`).
+    app.auto.add("viewer.colorPickerEyedropper", map.area, "Sample color");
+    ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
+    app.viewer_pixels();
+    color_pick_preview(app, painter, map, crate::i18n::tr("Click to sample color"), crate::color_picker::eyedropper_point(&ctx));
+    if let Some(pos) = crate::color_picker::sample_press(&ctx)
+        && let Some(s) = crate::panels::viewer_tools::sample_displayed(app, &ctx, map.to_comp(pos))
+    {
+        crate::color_picker::deliver_sample(&ctx, [s[0], s[1], s[2]]);
+    }
+}
+
+/// Effect Controls' part of the Composition viewer, called by the viewer after its own
+/// interaction (so these controls sit on top):
+///
+/// - while a crosshair pick is armed, its handle previews the cursor position without editing
+///   the property; the next click sets the point in layer space, and Esc cancels;
+/// - an eyedropper pick samples the frame's colour on click;
+/// - otherwise, the point parameters of the selected effects are drawn as draggable ⊕ controls.
+///
+/// `l2c` is the viewer's layer→comp matrix (it knows the 3D view).
+pub fn viewer_hook(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    painter: &egui::Painter,
+    map: &crate::panels::viewer::ViewerMap,
+    ectx: &EvalCtx,
+    l2c: &dyn Fn(&EvalCtx, &Layer) -> Mat3,
+) {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    crate::color_picker::note_viewer(&ctx, map.area);
+    let mut actions: Actions = vec![];
+    let point_preview = if let Some(pick) = app.ui.fx_pick.clone().filter(|p| p.kind == crate::panels::crypto_pick::KIND) {
+        match ectx.comp.layer(effectcraft_engine::project::LayerId(pick.layer)) {
+            Some(l) => {
+                crate::panels::crypto_pick::viewer_hook(app, ui, painter, map, ectx, l, &crate::panels::viewer::from_effect_space(ectx, l, l2c(ectx, l)), &pick)
+            }
+            None => app.ui.fx_pick = None,
+        }
+        None
+    } else {
+        match fx_pick_session(app, ui, painter, map, ectx, l2c, &mut actions) {
+            ControlFlow::Break(()) => return,
+            ControlFlow::Continue(p) => p,
+        }
+    };
+    text_color_pick(app, ui, painter, map, ectx, &mut actions);
+    popup_eyedropper(app, ui, painter, map);
+    let picking = app.ui.fx_pick.is_some() || app.ui.text_color_pick.is_some();
+    let point_pick = app.ui.fx_pick.clone().filter(|p| p.kind == "point");
+    if app.ui.viewer.show_layer_controls || point_pick.is_some() {
+        // ⊕ controls for the point parameters of the selected effects.
+        let mut sel = app.session.state.selected_props.clone();
+        if let Some(pick) = &point_pick {
+            sel.push((effectcraft_engine::project::LayerId(pick.layer), pick.prop));
+        }
+        let selected = app.session.state.selected_layers.clone();
+        for layer in ectx
+            .comp
+            .layers
+            .iter()
+            .filter(|l| (selected.contains(&l.id) || point_pick.as_ref().is_some_and(|p| p.layer == l.id.0)) && l.is_active_at(ectx.time))
+        {
+            let Some(fx) = layer.effects() else { continue };
+            let m = l2c(ectx, layer);
+            // Masks are in layer space, effect points in effect space.
+            let fm = crate::panels::viewer::from_effect_space(ectx, layer, m);
+            let picked_prop = point_pick.as_ref().filter(|p| p.layer == layer.id.0).map(|p| p.prop);
+            for g in fx.groups().filter(|g| g.enabled && effect_active(g, layer.id, &sel)) {
+                // Puppet owns its pin handles and hit testing. Generic crosshairs would
+                // overlap the pins and steal their selection/rotation/scale gestures.
+                if matches!(&g.kind, GroupKind::Effect { effect } if effect == effectcraft_engine::effects::puppet::ID) {
+                    continue;
+                }
+                if !picking
+                    && app.ui.viewer.show_layer_controls
+                    && matches!(&g.kind, GroupKind::Effect { effect } if effect == crate::panels::fx_editors::RESHAPE)
+                {
+                    crate::panels::fx_editors::reshape_overlay(app, ui, painter, map, ectx, layer, g, &m, &mut actions);
+                }
+                if !picking
+                    && app.ui.viewer.show_layer_controls
+                    && matches!(&g.kind, GroupKind::Effect { effect } if effect == crate::panels::fx_editors::MESH_WARP)
+                {
+                    crate::panels::fx_editors::mesh_warp_overlay(app, ui, painter, map, ectx, layer, g, &fm, &mut actions);
+                }
+                let scope = FxScope { effect: &g.match_id, root: g, path: String::new() };
+                let mut pts = Vec::new();
+                visible_points(g, &scope, layer, ectx, 0, &mut pts);
+                // An explicit pick stays visible even when View > Show Layer Controls is off.
+                if !app.ui.viewer.show_layer_controls {
+                    pts.retain(|pr| picked_prop == Some(pr.uid));
+                }
+                let screen: Vec<egui::Pos2> = pts
+                    .iter()
+                    .map(|pr| {
+                        if picked_prop == Some(pr.uid)
+                            && let Some(pos) = point_preview
+                        {
+                            return pos;
+                        }
+                        let v = ectx.value(layer, pr).as_vec2();
+                        map.to_screen(fw::layer_to_comp(&fm, v))
+                    })
+                    .collect();
+                // Gradient Ramp and friends: a guide between start and end points.
+                if screen.len() == 2 && matches!(&g.kind, GroupKind::Effect { effect } if effect.contains("gradient") || effect.contains("ramp")) {
+                    painter.line_segment([screen[0], screen[1]], Stroke::new(1.0, Color32::from_white_alpha(110)));
+                }
+                for (pr, s) in pts.iter().zip(screen) {
+                    let hr = Rect::from_center_size(s, vec2(16.0, 16.0));
+                    let id = egui::Id::unique(("viewer-fx-pt", pr.uid));
+                    // The picker owns the click. Preview handles must not steal it or start a drag.
+                    let resp = (!picking).then(|| ui.interact(hr, id, Sense::drag()));
+                    let col = if picked_prop == Some(pr.uid) || resp.as_ref().is_some_and(|r| r.hovered() || r.dragged()) { t.accent } else { Color32::WHITE };
+                    fw::draw_crosshair(painter, s + vec2(1.0, 1.0), 5.0, Color32::from_black_alpha(160));
+                    fw::draw_crosshair(painter, s, 5.0, col);
+                    app.auto.add(&format!("viewer.effectPoint.{}", pr.uid), hr, &pr.name);
+                    let Some(resp) = resp else { continue };
+                    if resp.hovered() {
+                        ctx.set_cursor_icon(egui::CursorIcon::Move);
+                        resp.clone().on_hover_text(format!("{}: {}", crate::i18n::effects::group(&g.match_id, &g.name), pr.name));
+                    }
+                    if resp.dragged()
+                        && let Some(pos) = resp.interact_pointer_pos()
+                        && let Some(lp) = fw::comp_to_layer(&fm, map.to_comp(pos))
+                    {
+                        let key = gesture_key(ui, id, resp.drag_started());
+                        actions.push(("prop.set".into(), json!({"layer": layer.id.0, "prop": pr.uid, "value": [lp[0], lp[1]], "merge": key})));
+                    }
+                }
+            }
+        }
+    }
+    for (id, params) in actions {
+        if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
+            app.ui.status = e;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/panels/effects_presets.rs b/crates/ui-egui/src/panels/effects_presets.rs
index d2058fbea..db42e8992 100644
--- a/crates/ui-egui/src/panels/effects_presets.rs
+++ b/crates/ui-egui/src/panels/effects_presets.rs
@@ -10,6 +10,7 @@ use egui::{Align2, Color32, Rect, Sense, Stroke, pos2, vec2};
 use serde_json::json;
 use std::sync::Arc;
 
+use crate::a11y;
 use crate::icons::{self, Icon};
 use crate::panels::{DragPayload, PresetRef};
 use crate::theme::Tokens;
@@ -17,6 +18,7 @@ use crate::{EffectcraftApp, widgets};
 
 const ROW_H: f32 = 21.0;
 const RECENT_MAX: usize = 8;
+pub(crate) const REVEAL_PRESETS_ID: &str = "fx-reveal-presets";
 
 /// A user animation preset file.
 #[derive(Clone, Debug, PartialEq)]
@@ -106,12 +108,70 @@ fn highlighted(p: &egui::Painter, pos: egui::Pos2, name: &str, query: &str, t: &
     p.text(pos, Align2::LEFT_CENTER, name, Tokens::ui(12.0), t.text);
 }
 
+#[derive(Clone)]
 enum Apply {
     Effect(String),
     /// A text, built-in (Transitions…) or user file animation preset.
     Preset(PresetRef),
 }
 
+/// One row of the list as drawn this pass, including the rows scrolled out of view: what the
+/// arrow keys, Home / End and Enter work on (the rows are painted by hand, so this is the list).
+struct NavRow {
+    id: egui::Id,
+    /// The favourite star's widget, for an effect row.
+    star: Option<egui::Id>,
+    parent: Option<egui::Id>,
+    /// Where the row starts in the scrolled content.
+    top: f32,
+    /// A folder: (its key, open, forced open by a search).
+    folder: Option<(String, bool, bool)>,
+    /// What Enter applies, for an effect or preset row.
+    apply: Option<Apply>,
+}
+
+/// The list's keyboard state: the rows drawn, and the row the keys work from (the "cursor":
+/// selected, and the one Tab stop of the list).
+struct Nav {
+    rows: Vec<NavRow>,
+    /// The open folders on the way down to the row being drawn, by level.
+    stack: Vec<egui::Id>,
+    cursor: Option<egui::Id>,
+    /// The scroll offset and the list's top, to place rows in the content.
+    offset: f32,
+    list_top: f32,
+}
+
+impl Nav {
+    /// The row `id` is the list's Tab stop: the cursor row, or the first row while there is none.
+    fn tab_stop(&self, id: egui::Id) -> bool {
+        match self.cursor {
+            Some(c) => c == id,
+            None => self.rows.is_empty(),
+        }
+    }
+
+    /// Record the row drawn at `y`; returns whether it is the cursor row.
+    fn push(&mut self, id: egui::Id, y: f32, level: usize, folder: Option<(String, bool, bool)>, apply: Option<Apply>) -> bool {
+        let parent = level.checked_sub(2).and_then(|i| self.stack.get(i)).copied();
+        if folder.is_some() {
+            self.stack.truncate(level.saturating_sub(1));
+            self.stack.push(id);
+        }
+        self.rows.push(NavRow { id, star: None, parent, top: y - self.list_top + self.offset, folder, apply });
+        self.cursor == Some(id)
+    }
+}
+
+fn cursor_id() -> egui::Id {
+    egui::Id::unique("fx-cursor")
+}
+
+/// The accessible name of a folder: what the row shows, in the interface language.
+fn folder_name(label: &str) -> &str {
+    tr(label)
+}
+
 /// A folder row; returns whether it is open.
 #[allow(clippy::too_many_arguments)]
 fn folder_row(
@@ -120,8 +180,10 @@ fn folder_row(
     lp: &egui::Painter,
     list: Rect,
     y: &mut f32,
+    nav: &mut Nav,
     key: &str,
     label: &str,
+    level: usize,
     indent: f32,
     forced_open: bool,
     icon: Option<Icon>,
@@ -129,12 +191,18 @@ fn folder_row(
     let t = app.tokens;
     let open = forced_open || app.ui.effects_open.contains(key);
     let r = Rect::from_min_size(pos2(list.min.x, *y), vec2(list.width(), ROW_H));
+    let id = egui::Id::unique(("fxcat", key));
+    let tab = nav.tab_stop(id);
+    let selected = nav.push(id, *y, level, Some((key.to_string(), open, forced_open)), None);
     *y += ROW_H;
     if r.max.y < list.min.y || r.min.y > list.max.y {
         return open;
     }
-    let resp = ui.interact(r.intersect(list), egui::Id::new(("fxcat", key)), Sense::click());
-    if resp.hovered() {
+    let shown = folder_name(label);
+    let resp = ui.interact(r.intersect(list), id, if tab { Sense::click() } else { Sense::CLICK });
+    if selected {
+        lp.rect_filled(r, 0.0, t.row_selected);
+    } else if resp.hovered() {
         lp.rect_filled(r, 0.0, t.hover);
     }
     let tw = Rect::from_center_size(pos2(r.min.x + 12.0 + indent, r.center().y), vec2(12.0, 12.0));
@@ -145,18 +213,62 @@ fn folder_row(
         Some(i) => icons::paint(lp, ic, i, t.text_dim),
         None => icons::paint(lp, ic, Icon::Folder, Color32::from_rgb(0xc8, 0xb0, 0x58)),
     }
-    lp.text(pos2(r.min.x + 40.0 + indent, r.center().y), Align2::LEFT_CENTER, label, Tokens::ui(12.0), t.text);
+    lp.text(pos2(r.min.x + 40.0 + indent, r.center().y), Align2::LEFT_CENTER, shown, Tokens::ui(12.0), t.text);
     app.auto.add(&format!("effects.category.{key}"), r, label);
-    if resp.clicked() && !forced_open {
-        if open {
-            app.ui.effects_open.remove(key);
-        } else {
-            app.ui.effects_open.insert(key.to_string());
+    a11y::tree_item(&resp, shown, selected, level, Some(open));
+    row_focus(app, ui, lp, &resp, r, id);
+    if resp.clicked() {
+        nav_click(ui.ctx(), app, id);
+        if !forced_open {
+            if open {
+                app.ui.effects_open.remove(key);
+            } else {
+                app.ui.effects_open.insert(key.to_string());
+            }
         }
     }
     open
 }
 
+/// What every row does with the keyboard focus: the focus ring, the panel taking the focus, the
+/// list owning its keys, and moving the focus here when the arrow keys asked for it.
+fn row_focus(app: &mut EffectcraftApp, ui: &egui::Ui, lp: &egui::Painter, resp: &egui::Response, r: Rect, id: egui::Id) {
+    let ctx = ui.ctx();
+    if a11y::take_pending_focus(ctx, "fx", id) {
+        resp.request_focus();
+    }
+    if resp.gained_focus() {
+        app.ui.focused = crate::dock::PanelKind::EffectsPresets;
+    }
+    if resp.has_focus() {
+        lp.rect_stroke(r.shrink(0.5), 0.0, Stroke::new(1.0, app.tokens.accent), egui::StrokeKind::Inside);
+    }
+}
+
+/// A click on a row moves the cursor there and gives the panel the keyboard.
+fn nav_click(ctx: &egui::Context, app: &mut EffectcraftApp, id: egui::Id) {
+    ctx.data_mut(|d| d.insert_temp(cursor_id(), id));
+    app.ui.focused = crate::dock::PanelKind::EffectsPresets;
+}
+
+/// Number of visible rows before Animation Presets in the current panel state.
+fn rows_before_presets(favorites: usize, recent: usize, searching: bool, favorites_open: bool, recent_open: bool) -> usize {
+    let mut rows = 0usize;
+    if favorites > 0 {
+        rows = rows.saturating_add(1);
+        if searching || favorites_open {
+            rows = rows.saturating_add(favorites);
+        }
+    }
+    if !searching && recent > 0 {
+        rows = rows.saturating_add(1);
+        if recent_open {
+            rows = rows.saturating_add(recent);
+        }
+    }
+    rows
+}
+
 /// An effect row (fx icon, highlighted name, favourite star, 32 bpc badge).
 #[allow(clippy::too_many_arguments)]
 fn effect_row(
@@ -165,7 +277,9 @@ fn effect_row(
     lp: &egui::Painter,
     list: Rect,
     y: &mut f32,
+    nav: &mut Nav,
     e: &'static effectcraft_engine::effects::EffectSpec,
+    level: usize,
     indent: f32,
     query: &str,
     auto_prefix: &str,
@@ -174,13 +288,22 @@ fn effect_row(
     let t = app.tokens;
     let ctx = ui.ctx().clone();
     let r = Rect::from_min_size(pos2(list.min.x, *y), vec2(list.width(), ROW_H));
+    let id = egui::Id::unique((auto_prefix, e.id));
+    let star_id = egui::Id::unique((auto_prefix, e.id, "star"));
+    let tab = nav.tab_stop(id);
+    let selected = nav.push(id, *y, level, None, Some(Apply::Effect(e.id.to_string())));
+    if let Some(row) = nav.rows.last_mut() {
+        row.star = Some(star_id);
+    }
     *y += ROW_H;
     if r.max.y < list.min.y || r.min.y > list.max.y {
         return;
     }
     let star = Rect::from_center_size(pos2(r.max.x - 38.0, r.center().y), vec2(16.0, 16.0));
-    let resp = ui.interact(r.intersect(list), egui::Id::new((auto_prefix, e.id)), Sense::click_and_drag());
-    if resp.hovered() {
+    let resp = ui.interact(r.intersect(list), id, if tab { Sense::click_and_drag() } else { Sense::CLICK | Sense::DRAG });
+    if selected {
+        lp.rect_filled(r, 0.0, t.row_selected);
+    } else if resp.hovered() {
         lp.rect_filled(r, 0.0, t.hover);
     }
     icons::paint(lp, Rect::from_center_size(pos2(r.min.x + 44.0 + indent, r.center().y), vec2(12.0, 12.0)), Icon::Fx, t.text_dim);
@@ -192,20 +315,32 @@ fn effect_row(
         lp.text(pos2(r.max.x - 10.0, r.center().y), Align2::RIGHT_CENTER, "32", Tokens::ui(9.5), t.text_faint);
     }
     app.auto.add(&format!("{auto_prefix}.{}", e.id), r, e.name);
-    // Favourite star (always shown when starred, else on hover).
+    a11y::tree_item(&resp, &shown, selected, level, None);
+    row_focus(app, ui, lp, &resp, r, id);
+    // Favourite star (always shown when starred, else on hover or with the keyboard focus).
     let fav = app.session.prefs.is_effect_favorite(e.id);
-    let sresp = ui.interact(star.intersect(list), egui::Id::new((auto_prefix, e.id, "star")), Sense::click());
-    if fav || resp.hovered() || sresp.hovered() {
+    let sresp = ui.interact(star.intersect(list), star_id, if tab { Sense::click() } else { Sense::CLICK });
+    if fav || resp.hovered() || sresp.hovered() || sresp.has_focus() {
         let gold = Color32::from_rgb(0xe8, 0xc0, 0x40);
         filled_star(lp, star.center(), 6.0, fav.then_some(gold), if fav || sresp.hovered() { gold } else { t.text_faint });
     }
     app.auto.add(&format!("{auto_prefix}.{}.star", e.id), star, if fav { "Remove from Favorites" } else { "Add to Favorites" });
+    a11y::button(&sresp, &format!("{}: {shown}", tr(if fav { "Remove from favorites" } else { "Add to favorites" })), true);
+    if sresp.gained_focus() {
+        app.ui.focused = crate::dock::PanelKind::EffectsPresets;
+    }
+    if sresp.has_focus() {
+        widgets::focus_outline(ui, &sresp, &t);
+    }
     if sresp.clicked() {
         // Kept in the settings, so the stars are there next time (#1692).
         app.session.prefs.toggle_effect_favorite(e.id);
         app.session.save_prefs();
         return;
     }
+    if resp.clicked() {
+        nav_click(&ctx, app, id);
+    }
     if resp.double_clicked() {
         *apply = Some(Apply::Effect(e.id.to_string()));
     }
@@ -222,6 +357,7 @@ fn preset_row(
     lp: &egui::Painter,
     list: Rect,
     y: &mut f32,
+    nav: &mut Nav,
     name: &str,
     auto_id: &str,
     query: &str,
@@ -230,17 +366,27 @@ fn preset_row(
 ) {
     let t = app.tokens;
     let r = Rect::from_min_size(pos2(list.min.x, *y), vec2(list.width(), ROW_H));
+    let id = egui::Id::unique(("fxpreset", auto_id));
+    let tab = nav.tab_stop(id);
+    let selected = nav.push(id, *y, 3, None, Some(Apply::Preset(preset.clone())));
     *y += ROW_H;
     if r.max.y < list.min.y || r.min.y > list.max.y {
         return;
     }
-    let resp = ui.interact(r.intersect(list), egui::Id::new(("fxpreset", auto_id)), Sense::click_and_drag());
-    if resp.hovered() {
+    let resp = ui.interact(r.intersect(list), id, if tab { Sense::click_and_drag() } else { Sense::CLICK | Sense::DRAG });
+    if selected {
+        lp.rect_filled(r, 0.0, t.row_selected);
+    } else if resp.hovered() {
         lp.rect_filled(r, 0.0, t.hover);
     }
     icons::paint(lp, Rect::from_center_size(pos2(r.min.x + 58.0, r.center().y), vec2(12.0, 12.0)), Icon::Keyframe, t.text_dim);
     highlighted(lp, pos2(r.min.x + 70.0, r.center().y), name, query, &t);
     app.auto.add(auto_id, r, name);
+    a11y::tree_item(&resp, name, selected, 3, None);
+    row_focus(app, ui, lp, &resp, r, id);
+    if resp.clicked() {
+        nav_click(ui.ctx(), app, id);
+    }
     if resp.drag_started() {
         egui::DragAndDrop::set_payload(ui.ctx(), DragPayload::Preset { preset: preset.clone(), name: name.to_string() });
     }
@@ -249,9 +395,125 @@ fn preset_row(
     }
 }
 
+/// The list's keys. With a row focused (Tab, a screen reader): Up / Down move between rows,
+/// Home / End go to the first / last, Page Up / Page Down a page, Right opens a folder (then steps
+/// into it) and Left closes it (then steps out to it), Enter and Space apply the row or open /
+/// close the folder. With the mouse's last click in the panel and no widget focused, the arrows
+/// and Enter work the same, so the list is operable without a mouse either way. The focus follows
+/// the cursor, so a screen reader reads each row as it is reached. Returns what to apply.
+fn list_keys(app: &mut EffectcraftApp, ctx: &egui::Context, nav: &Nav, list: Rect) -> Option<Apply> {
+    use egui::Key;
+    // A cursor whose row is gone (a search hid it): the first row is the Tab stop again.
+    if let Some(c) = nav.cursor
+        && !nav.rows.iter().any(|r| r.id == c)
+    {
+        ctx.data_mut(|d| d.remove::<egui::Id>(cursor_id()));
+        ctx.request_repaint();
+    }
+    let focused = ctx.memory(|m| m.focused());
+    let on_row = focused.is_some_and(|f| nav.rows.iter().any(|r| r.id == f || r.star == Some(f)));
+    // Enter / Space on the star are the star button's (it toggles the favourite), not the row's.
+    let on_star = focused.is_some_and(|f| nav.rows.iter().any(|r| r.star == Some(f)));
+    let by_mouse = focused.is_none() && app.ui.focused == crate::dock::PanelKind::EffectsPresets;
+    if (!on_row && !by_mouse) || app.dialog.is_some() || widgets::any_menu_open(ctx) {
+        return None;
+    }
+    let keys: Vec<Key> = ctx.input(|i| {
+        i.events
+            .iter()
+            .filter_map(|e| match e {
+                egui::Event::Key { key, pressed: true, modifiers, .. } if !modifiers.any() => Some(*key),
+                _ => None,
+            })
+            .collect()
+    });
+    let page = ((list.height() / ROW_H).floor() as usize).saturating_sub(1).max(1);
+    // The row with the keyboard focus is where the keys start (the first Tab lands on a row
+    // before anything is selected); otherwise the cursor.
+    let focus_row = focused.and_then(|f| nav.rows.iter().find(|r| r.id == f || r.star == Some(f))).map(|r| r.id);
+    let mut cursor = focus_row.or_else(|| nav.cursor.filter(|c| nav.rows.iter().any(|r| r.id == *c)));
+    let mut apply = None;
+    let mut moved = false;
+    for key in keys {
+        let at = cursor.and_then(|c| nav.rows.iter().position(|r| r.id == c));
+        let last = nav.rows.len().checked_sub(1)?;
+        let to = match key {
+            Key::ArrowDown => Some(at.map_or(0, |a| a.saturating_add(1).min(last))),
+            Key::ArrowUp => Some(at.map_or(last, |a| a.saturating_sub(1))),
+            Key::Home if on_row => Some(0),
+            Key::End if on_row => Some(last),
+            Key::PageDown if on_row => Some(at.map_or(0, |a| a.saturating_add(page).min(last))),
+            Key::PageUp if on_row => Some(at.map_or(last, |a| a.saturating_sub(page))),
+            Key::ArrowRight | Key::ArrowLeft | Key::Enter | Key::Space if at.is_some() => {
+                let row = at.and_then(|a| nav.rows.get(a))?;
+                let toggle = |app: &mut EffectcraftApp, open: bool| {
+                    if let Some((k, _, forced)) = &row.folder
+                        && !forced
+                    {
+                        if open {
+                            app.ui.effects_open.insert(k.clone());
+                        } else {
+                            app.ui.effects_open.remove(k);
+                        }
+                    }
+                };
+                match (key, &row.folder) {
+                    (Key::ArrowRight, Some((_, false, _))) => {
+                        toggle(app, true);
+                        None
+                    }
+                    (Key::ArrowRight, Some((_, true, _))) => at.map(|a| a.saturating_add(1).min(last)),
+                    (Key::ArrowLeft, Some((_, true, false))) => {
+                        toggle(app, false);
+                        None
+                    }
+                    (Key::ArrowLeft, _) => row.parent.and_then(|p| nav.rows.iter().position(|r| r.id == p)),
+                    (Key::Enter, Some((_, open, _))) | (Key::Space, Some((_, open, _))) if on_row || key == Key::Enter => {
+                        toggle(app, !*open);
+                        None
+                    }
+                    (Key::Enter, None) if !on_star => {
+                        apply = row.apply.clone();
+                        None
+                    }
+                    (Key::Space, None) if on_row && !on_star => {
+                        apply = row.apply.clone();
+                        None
+                    }
+                    _ => None,
+                }
+            }
+            _ => None,
+        };
+        if let Some(to) = to
+            && let Some(row) = nav.rows.get(to)
+        {
+            cursor = Some(row.id);
+            moved = true;
+        }
+    }
+    if moved && let Some(c) = cursor {
+        ctx.data_mut(|d| d.insert_temp(cursor_id(), c));
+        // Scroll the row into view.
+        if let Some(row) = nav.rows.iter().find(|r| r.id == c) {
+            widgets::PanelScroll::reveal(ctx, egui::Id::unique("fx-scroll"), row.top, row.top + ROW_H, list.height());
+        }
+        app.ui.focused = crate::dock::PanelKind::EffectsPresets;
+        if on_row {
+            a11y::focus_next_pass(ctx, "fx", c);
+        }
+        ctx.request_repaint();
+    }
+    // The arrows are the list's, not egui's spatial focus moves.
+    if on_row {
+        ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
+    }
+    apply
+}
+
 /// User preset files, rescanned every few seconds (and on Refresh List).
 fn user_presets(ctx: &egui::Context, force: bool, scan: impl FnOnce() -> Vec<PresetFile>) -> Arc<Vec<PresetFile>> {
-    let id = egui::Id::new("fx-user-presets");
+    let id = egui::Id::unique("fx-user-presets");
     let now = ctx.input(|i| i.time);
     if !force
         && let Some((at, v)) = ctx.data(|d| d.get_temp::<(f64, Arc<Vec<PresetFile>>)>(id))
@@ -264,25 +526,15 @@ fn user_presets(ctx: &egui::Context, force: bool, scan: impl FnOnce() -> Vec<Pre
     v
 }
 
-pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
-    let t = app.tokens;
-    let ctx = ui.ctx().clone();
-    let p = ui.painter().clone();
-    // Track the last applied effect (menus, drag and drop, the control channel) as recently used.
-    if let Some(last) = app.session.state.last_effect.clone()
-        && app.ui.effects_recent.first() != Some(&last)
-    {
-        push_recent(&mut app.ui.effects_recent, &last);
-    }
-    let sr = Rect::from_min_size(rect.min + vec2(8.0, 8.0), vec2(rect.width() - 44.0, 24.0));
-    let mut q = app.ui.effects_search.clone();
-    widgets::search_field(ui, sr, &mut q, "Search effects and presets", &t);
-    app.ui.effects_search = q.clone();
-    app.auto.add("effects.search", sr, "Search");
+/// The "Effects & Presets options" hamburger menu beside the search field; returns whether
+/// "Refresh List" was picked.
+fn contents_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui, ctx: &egui::Context, rect: Rect, sr: Rect, t: &Tokens) -> bool {
     // Contents menu.
     let mr = Rect::from_center_size(pos2(rect.max.x - 18.0, sr.center().y), vec2(22.0, 22.0));
-    let mpop = egui::Id::new("fx-contents-menu");
-    if widgets::icon_button(ui, mr, Icon::Hamburger, false, &t, egui::Id::new("fx-menu")).on_hover_text(tr("Effects & Presets options")).clicked() {
+    let mpop = egui::Id::unique("fx-contents-menu");
+    let menu_resp = widgets::icon_button(ui, mr, Icon::Hamburger, false, t, egui::Id::unique("fx-menu")).on_hover_text(tr("Effects & Presets options"));
+    a11y::menu_button(&menu_resp, tr("Effects & Presets options"), widgets::popup_is_open(ui, mpop));
+    if menu_resp.clicked() {
         widgets::open_popup(ui, mpop);
     }
     app.auto.add("effects.menu", mr, "Effects & Presets options");
@@ -315,6 +567,12 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     ui.separator();
                 } else {
                     let resp = ui.selectable_label(false, label);
+                    // The ✓ and the padding are the menu's drawing: say it as a state.
+                    let checkable = matches!(i, 0 | 1 | 2 | 4 | 6 | 7);
+                    a11y::menu_item(&resp, label.trim_start_matches('✓').trim(), checkable.then(|| label.starts_with('✓')));
+                    if i == 0 {
+                        widgets::focus_when_opened(ui, mpop, &resp);
+                    }
                     if label == &copy_label {
                         app.auto.add("effects.copyPresetsFolderPath", resp.rect, "Copy Presets Folder Path");
                     }
@@ -329,10 +587,13 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         None
     };
     if let Some(i) = choice {
+        if widgets::by_keyboard(ui) {
+            menu_resp.request_focus();
+        }
         let v = &mut app.ui.effects_view;
         match i {
             i if menu.get(i) == Some(&copy_label) => {
-                if let Err(e) = crate::menus::invoke(app, &ctx, "effects.copyPresetsFolderPath", json!({})) {
+                if let Err(e) = crate::menus::invoke(app, ctx, "effects.copyPresetsFolderPath", json!({})) {
                     app.ui.status = e;
                 }
             }
@@ -347,14 +608,44 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             _ => {}
         }
     }
+    force_scan
+}
+
+/// The Effects & Presets panel: search, a contents menu (colour-depth and GPU filters, whether
+/// presets show, categories or one alphabetical list, refresh and clear of the recently used
+/// list), then Favourites, Recently Used, Animation Presets and the effects by category or
+/// alphabetically, filtered by the query. Picking an effect or preset applies it to the selection
+/// (`effect.apply` or the preset's own command); applying an effect also records it as recently
+/// used and opens Effect Controls. Without a selected layer it only reports that in
+/// `app.ui.status`.
+pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    let p = ui.painter().clone();
+    // Track the last applied effect (menus, drag and drop, the control channel) as recently used.
+    if let Some(last) = app.session.state.last_effect.clone()
+        && app.ui.effects_recent.first() != Some(&last)
+    {
+        push_recent(&mut app.ui.effects_recent, &last);
+    }
+    let sr = Rect::from_min_size(rect.min + vec2(8.0, 8.0), vec2(rect.width() - 44.0, 24.0));
+    let mut q = app.ui.effects_search.clone();
+    let search_hint = tr("Search effects and presets");
+    let search = widgets::search_field(ui, sr, &mut q, search_hint, &t);
+    a11y::text_input(&search, search_hint, &q);
+    app.ui.effects_search = q.clone();
+    app.auto.add("effects.search", sr, "Search");
+    let force_scan = contents_menu(app, ui, &ctx, rect, sr, &t);
     let view = app.ui.effects_view.clone();
     let list = Rect::from_min_max(pos2(rect.min.x, sr.max.y + 6.0), rect.max);
+    let mut scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("fx-scroll"), list);
+    let list = scroll.content;
     let lp = p.with_clip_rect(list);
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("fx-scroll"), list);
     let query = q.trim().to_lowercase();
     let searching = !query.is_empty();
     let mut y = list.min.y - scroll.offset;
     let mut apply: Option<Apply> = None;
+    let mut nav = Nav { rows: vec![], stack: vec![], cursor: ctx.data(|d| d.get_temp::<egui::Id>(cursor_id())), offset: scroll.offset, list_top: list.min.y };
     let reg = effectcraft_engine::effects::all();
     let keep = |e: &effectcraft_engine::effects::EffectSpec| {
         depth_keeps(&view.depth, e)
@@ -364,17 +655,27 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
 
     // Favorites and Recently Used.
     let favs: Vec<_> = app.session.prefs.effects_favorites.iter().filter_map(|id| lookup(id)).filter(|e| keep(e)).collect();
-    if !favs.is_empty() && folder_row(app, ui, &lp, list, &mut y, "favorites", "Favorites", 0.0, searching, Some(Icon::Star)) {
+    let recent: Vec<_> = app.ui.effects_recent.iter().filter_map(|id| lookup(id)).filter(|e| keep(e)).collect();
+    let reveal_presets = ctx.data_mut(|data| data.remove_temp::<bool>(egui::Id::unique(REVEAL_PRESETS_ID))).unwrap_or(false);
+    if reveal_presets {
+        // These rows come before Animation Presets. Scroll past expanded lists so the section is
+        // visible even when Favorites or Recently Used is long.
+        let preceding_rows =
+            rows_before_presets(favs.len(), recent.len(), searching, app.ui.effects_open.contains("favorites"), app.ui.effects_open.contains("recent"));
+        scroll.offset = ROW_H * preceding_rows as f32;
+        y = list.min.y - scroll.offset;
+        nav.offset = scroll.offset;
+    }
+    if !favs.is_empty() && folder_row(app, ui, &lp, list, &mut y, &mut nav, "favorites", "Favorites", 1, 0.0, searching, Some(Icon::Star)) {
         let mut favs = favs;
         favs.sort_by_key(|e| e.name);
         for e in favs {
-            effect_row(app, ui, &lp, list, &mut y, e, 0.0, &query, "effects.favorites", &mut apply);
+            effect_row(app, ui, &lp, list, &mut y, &mut nav, e, 2, 0.0, &query, "effects.favorites", &mut apply);
         }
     }
-    let recent: Vec<_> = app.ui.effects_recent.iter().filter_map(|id| lookup(id)).filter(|e| keep(e)).collect();
-    if !recent.is_empty() && !searching && folder_row(app, ui, &lp, list, &mut y, "recent", "Recently Used", 0.0, false, None) {
+    if !recent.is_empty() && !searching && folder_row(app, ui, &lp, list, &mut y, &mut nav, "recent", "Recently Used", 1, 0.0, false, None) {
         for e in recent {
-            effect_row(app, ui, &lp, list, &mut y, e, 0.0, &query, "effects.recent", &mut apply);
+            effect_row(app, ui, &lp, list, &mut y, &mut nav, e, 2, 0.0, &query, "effects.recent", &mut apply);
         }
     }
 
@@ -393,21 +694,45 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let user = user_presets(&ctx, force_scan, || presets_dir().map(|d| scan_presets(&d)).unwrap_or_default());
         let files: Vec<&PresetFile> = user.iter().filter(|f| query.is_empty() || f.name.to_lowercase().contains(&query)).collect();
         let any = !text.is_empty() || !builtin.is_empty() || !files.is_empty();
-        if any && folder_row(app, ui, &lp, list, &mut y, "presets", "* Animation Presets", 0.0, searching, None) {
-            if !text.is_empty() && folder_row(app, ui, &lp, list, &mut y, "presets/Text", "Text", 14.0, searching, None) {
+        if any && folder_row(app, ui, &lp, list, &mut y, &mut nav, "presets", "* Animation Presets", 1, 0.0, searching, None) {
+            if !text.is_empty() && folder_row(app, ui, &lp, list, &mut y, &mut nav, "presets/Text", "Text", 2, 14.0, searching, None) {
                 for (id, name) in text {
-                    preset_row(app, ui, &lp, list, &mut y, &name, &format!("effects.preset.text.{id}"), &query, PresetRef::Text(id.clone()), &mut apply);
+                    preset_row(
+                        app,
+                        ui,
+                        &lp,
+                        list,
+                        &mut y,
+                        &mut nav,
+                        &name,
+                        &format!("effects.preset.text.{id}"),
+                        &query,
+                        PresetRef::Text(id.clone()),
+                        &mut apply,
+                    );
                 }
             }
             for cat in &categories {
-                if !folder_row(app, ui, &lp, list, &mut y, &format!("presets/{cat}"), cat, 14.0, searching, None) {
+                if !folder_row(app, ui, &lp, list, &mut y, &mut nav, &format!("presets/{cat}"), cat, 2, 14.0, searching, None) {
                     continue;
                 }
                 for (id, name, _) in builtin.iter().filter(|(_, _, c)| c == cat) {
-                    preset_row(app, ui, &lp, list, &mut y, name, &format!("effects.preset.builtin.{id}"), &query, PresetRef::Builtin(id.clone()), &mut apply);
+                    preset_row(
+                        app,
+                        ui,
+                        &lp,
+                        list,
+                        &mut y,
+                        &mut nav,
+                        name,
+                        &format!("effects.preset.builtin.{id}"),
+                        &query,
+                        PresetRef::Builtin(id.clone()),
+                        &mut apply,
+                    );
                 }
             }
-            if !files.is_empty() && folder_row(app, ui, &lp, list, &mut y, "presets/User", "User Presets", 14.0, searching, None) {
+            if !files.is_empty() && folder_row(app, ui, &lp, list, &mut y, &mut nav, "presets/User", "User Presets", 2, 14.0, searching, None) {
                 for f in files {
                     preset_row(
                         app,
@@ -415,6 +740,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                         &lp,
                         list,
                         &mut y,
+                        &mut nav,
                         &f.name,
                         &format!("effects.preset.file.{}", f.name),
                         &query,
@@ -431,23 +757,26 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let mut all: Vec<_> = reg.iter().filter(|e| keep(e)).collect();
         all.sort_by_key(|e| e.name.to_lowercase());
         for e in all {
-            effect_row(app, ui, &lp, list, &mut y, e, -16.0, &query, "effects.item", &mut apply);
+            effect_row(app, ui, &lp, list, &mut y, &mut nav, e, 1, -16.0, &query, "effects.item", &mut apply);
         }
     } else {
         let mut cats: Vec<&str> = effectcraft_engine::effects::categories();
         cats.retain(|c| reg.iter().any(|e| e.category == *c));
         for cat in cats {
-            let items: Vec<_> = reg.iter().filter(|e| e.category == cat && keep(e)).collect();
+            let mut items: Vec<_> = reg.iter().filter(|e| e.category == cat && keep(e)).collect();
             if items.is_empty() {
                 continue;
             }
+            // After Effects lists a category by the effect's English name, whatever the interface
+            // language draws; the registry's own order is packing order, which reads as random.
+            items.sort_by_key(|e| e.name.to_lowercase());
             // The folder draws the category in the interface language; `cat` stays the key (the
             // open/closed state and the automation id are the registry's English name).
-            if !folder_row(app, ui, &lp, list, &mut y, cat, &crate::i18n::effects::category(cat), 0.0, searching, None) {
+            if !folder_row(app, ui, &lp, list, &mut y, &mut nav, cat, &crate::i18n::effects::category(cat), 1, 0.0, searching, None) {
                 continue;
             }
             for e in items {
-                effect_row(app, ui, &lp, list, &mut y, e, 0.0, &query, "effects.item", &mut apply);
+                effect_row(app, ui, &lp, list, &mut y, &mut nav, e, 2, 0.0, &query, "effects.item", &mut apply);
             }
         }
     }
@@ -456,13 +785,16 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     let content = y + scroll.offset - list.min.y;
     scroll.end(ui, &mut app.auto, "effects.scroll", content, &t);
+    if let Some(a) = list_keys(app, &ctx, &nav, list) {
+        apply = Some(a);
+    }
     if let Some(name) = egui::DragAndDrop::payload::<DragPayload>(&ctx).and_then(|p| match p.as_ref() {
         DragPayload::Effect(id) => Some(effectcraft_engine::effects::find(id).map(|e| crate::i18n::effects::name(e.id, e.name)).unwrap_or_default()),
         DragPayload::Preset { name, .. } => Some(name.clone()),
         _ => None,
     }) && let Some(pos) = ctx.pointer_hover_pos()
     {
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("dnd-fx")));
+        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("dnd-fx")));
         let g = painter.layout_no_wrap(name, Tokens::ui(12.0), t.text);
         let r = Rect::from_min_size(pos + vec2(12.0, 8.0), g.size() + vec2(16.0, 8.0));
         painter.rect_filled(r, 4.0, Color32::from_rgba_premultiplied(40, 40, 40, 230));
@@ -582,7 +914,7 @@ mod tests {
         for _ in 0..5 {
             let start = std::time::Instant::now();
             for _ in 0..1000 {
-                let (_, shared) = ctx.data(|d| d.get_temp::<(f64, Arc<Vec<PresetFile>>)>(egui::Id::new("fx-user-presets"))).unwrap();
+                let (_, shared) = ctx.data(|d| d.get_temp::<(f64, Arc<Vec<PresetFile>>)>(egui::Id::unique("fx-user-presets"))).unwrap();
                 std::hint::black_box((*shared).clone());
             }
             before.push(start.elapsed());
diff --git a/crates/ui-egui/src/panels/essential.rs b/crates/ui-egui/src/panels/essential.rs
index 2e99c7d39..02e077508 100644
--- a/crates/ui-egui/src/panels/essential.rs
+++ b/crates/ui-egui/src/panels/essential.rs
@@ -56,6 +56,11 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 }
 
+/// The Essential Graphics panel's contents for the Primary (else active) comp: its name and Solo
+/// toggle, the template name, the controls list with its drop target for Timeline properties, the
+/// Add Formatting / Add Selected As / Media Replacement / Export Template buttons and the selected
+/// instance's properties. Returns the `essential.*` commands to run directly and the ones that go
+/// through the menu/frontend layer; with no comp it shows a hint and returns empty lists.
 fn body(app: &mut EffectcraftApp, ui: &mut egui::Ui) -> (Actions, Actions) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -71,7 +76,7 @@ fn body(app: &mut EffectcraftApp, ui: &mut egui::Ui) -> (Actions, Actions) {
     // ---- Primary + Solo.
     ui.horizontal(|ui| {
         ui.label(RichText::new(tr("Primary:")).color(t.text_dim));
-        let r = egui::ComboBox::from_id_salt("eg-primary").selected_text(&comp_name).width(150.0).show_ui(ui, |ui| {
+        let r = craft_ui::ComboBox::from_id_salt("eg-primary").selected_text(&comp_name).width(150.0).show_ui(ui, |ui| {
             for (id, _) in project.comps() {
                 let name = project.item(*id).map(|i| i.name.clone()).unwrap_or_default();
                 if ui.selectable_label(*id == cid, name).clicked() {
@@ -79,6 +84,10 @@ fn body(app: &mut EffectcraftApp, ui: &mut egui::Ui) -> (Actions, Actions) {
                 }
             }
         });
+        // The label beside the combo names it for a screen reader; the selected comp alone
+        // doesn't say what the dropdown chooses. Keep the visible label and value together.
+        let primary_name = format!("{} {}", tr("Primary:"), comp_name);
+        r.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), &primary_name));
         app.auto.add("essential.primary", r.response.rect, &comp_name);
     });
     let solo = app.session.state.essential_solo;
@@ -90,7 +99,7 @@ fn body(app: &mut EffectcraftApp, ui: &mut egui::Ui) -> (Actions, Actions) {
     // ---- Name.
     let eg = project.comp(cid).and_then(|c| c.essential.clone()).unwrap_or_default();
     let shown_name = if eg.name.is_empty() { comp_name.clone() } else { eg.name.clone() };
-    let name_id = egui::Id::new("eg-name-buf");
+    let name_id = egui::Id::unique("eg-name-buf");
     let mut name: String = ctx.data(|d| d.get_temp(name_id)).unwrap_or_else(|| shown_name.clone());
     let r = ui.add(egui::TextEdit::singleline(&mut name).hint_text(tr("Template name")).desired_width(f32::INFINITY));
     app.auto.add("essential.name", r.rect, &shown_name);
@@ -291,7 +300,7 @@ fn link_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui, cid: ItemId, c: &EgCon
 
 /// A control's name; double-click to rename (comments: edit the text).
 fn name_label(app: &mut EffectcraftApp, ui: &mut egui::Ui, cid: ItemId, c: &EgControl, text: RichText, actions: &mut Actions) {
-    let edit_id = egui::Id::new(("eg-rename", c.id));
+    let edit_id = egui::Id::unique(("eg-rename", c.id));
     let editing: Option<String> = ui.ctx().data(|d| d.get_temp(edit_id));
     match editing {
         Some(mut buf) => {
@@ -329,7 +338,7 @@ fn value_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, auto: &str, ty: Opt
                 KV::Str(s) => s.clone(),
                 _ => String::new(),
             };
-            let id = egui::Id::new(("eg-text", auto));
+            let id = egui::Id::unique(("eg-text", auto));
             let mut buf: String = ui.ctx().data(|d| d.get_temp(id)).unwrap_or_else(|| cur.clone());
             let r = ui.add(egui::TextEdit::singleline(&mut buf).desired_width(140.0));
             if r.has_focus() {
@@ -353,7 +362,7 @@ fn value_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, auto: &str, ty: Opt
         }
         ControlType::Checkbox => {
             let mut on = v.as_bool();
-            let r = ui.checkbox(&mut on, "");
+            let r = crate::widgets::labelled_checkbox(ui, &mut on, "");
             if r.changed() {
                 out = Some(json!(on));
             }
@@ -365,7 +374,7 @@ fn value_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, auto: &str, ty: Opt
                 _ => vec![],
             };
             let cur = v.as_enum() as usize;
-            let r = egui::ComboBox::from_id_salt(("eg-dd", auto)).selected_text(opts.get(cur).cloned().unwrap_or_default()).show_ui(ui, |ui| {
+            let r = craft_ui::ComboBox::from_id_salt(("eg-dd", auto)).selected_text(opts.get(cur).cloned().unwrap_or_default()).show_ui(ui, |ui| {
                 for (i, o) in opts.iter().enumerate() {
                     if ui.selectable_label(i == cur, o).clicked() {
                         out = Some(json!(i));
@@ -428,7 +437,7 @@ fn value_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, auto: &str, ty: Opt
             let fams = effectcraft_engine::text::fonts::families();
             let mut d = (**doc).clone();
             let mut changed = false;
-            let r1 = egui::ComboBox::from_id_salt(("eg-font", auto)).selected_text(&d.font).width(110.0).show_ui(ui, |ui| {
+            let r1 = craft_ui::ComboBox::from_id_salt(("eg-font", auto)).selected_text(&d.font).width(110.0).show_ui(ui, |ui| {
                 for (f, _) in &fams {
                     if ui.selectable_label(*f == d.font, f).clicked() {
                         d.font = f.clone();
@@ -437,7 +446,7 @@ fn value_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, auto: &str, ty: Opt
                 }
             });
             let styles: Vec<String> = fams.iter().find(|(f, _)| *f == d.font).map(|(_, st)| st.clone()).unwrap_or_default();
-            let r2 = egui::ComboBox::from_id_salt(("eg-style", auto)).selected_text(&d.style).width(70.0).show_ui(ui, |ui| {
+            let r2 = craft_ui::ComboBox::from_id_salt(("eg-style", auto)).selected_text(&d.style).width(70.0).show_ui(ui, |ui| {
                 for st in &styles {
                     if ui.selectable_label(*st == d.style, st).clicked() {
                         d.style = st.clone();
@@ -523,7 +532,7 @@ fn instance(app: &mut EffectcraftApp, ui: &mut egui::Ui, actions: &mut Actions)
                         .filter(|i| matches!(&i.kind, ItemKind::Footage(f) if f.has_video))
                         .map(|i| (i.id, i.name.clone()))
                         .collect();
-                    let r = egui::ComboBox::from_id_salt(("eg-media", layer.id.0, c.id)).selected_text(cur_name).show_ui(ui, |ui| {
+                    let r = craft_ui::ComboBox::from_id_salt(("eg-media", layer.id.0, c.id)).selected_text(cur_name).show_ui(ui, |ui| {
                         for (id, name) in &items {
                             if ui.selectable_label(*id == cur, name).clicked() {
                                 actions.push(("essential.set".into(), json!({"layer": layer.id.0, "control": c.id, "item": id.0})));
diff --git a/crates/ui-egui/src/panels/expr_bar.rs b/crates/ui-egui/src/panels/expr_bar.rs
index 4f6d1c747..ce098efa0 100644
--- a/crates/ui-egui/src/panels/expr_bar.rs
+++ b/crates/ui-egui/src/panels/expr_bar.rs
@@ -23,8 +23,10 @@ struct Cache {
     current: usize,
 }
 
+/// The `egui::Id` under which the error bar's cache for composition `cid` is kept: this pass's
+/// failing expressions and which one is shown.
 fn cache_id(cid: ItemId) -> egui::Id {
-    egui::Id::new(("expr-error-bar", cid.0))
+    egui::Id::unique(("expr-error-bar", cid.0))
 }
 
 /// Both layout and painting read the same completed diagnostics; neither evaluates expressions.
@@ -46,6 +48,11 @@ pub fn height(app: &mut EffectcraftApp, ctx: &egui::Context, cid: ItemId) -> f32
     if errors(app, ctx, cid).errors.is_empty() { 0.0 } else { HEIGHT }
 }
 
+/// Draws the expression error strip for composition `cid` in `rect`: a warning, the shown error's
+/// description and ◀ n/m ▶ buttons to step through the failing expressions. Clicking the message
+/// selects that layer and property, reveals it in the Timeline and opens its expression. Does
+/// nothing when every expression evaluates. Stepping and clicking only change UI state (the
+/// cached index, selection and Timeline state), never the document.
 pub fn draw(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, cid: ItemId) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -64,7 +71,7 @@ pub fn draw(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, cid: ItemId
     let count = Rect::from_center_size(pos2(rect.max.x - 44.0, rect.center().y), vec2(40.0, 16.0));
     let prev = Rect::from_center_size(pos2(rect.max.x - 74.0, rect.center().y), vec2(16.0, 16.0));
     for (r, label, auto, d) in [(prev, "◀", "viewer.exprErrors.prev", n - 1), (next, "▶", "viewer.exprErrors.next", 1)] {
-        let resp = ui.interact(r, egui::Id::new(("expr-bar", auto)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("expr-bar", auto)), Sense::click());
         p.text(r.center(), Align2::CENTER_CENTER, label, Tokens::ui(11.0), if resp.hovered() { Color32::WHITE } else { t.text });
         app.auto.add(auto, r, label);
         if resp.clicked() {
@@ -76,7 +83,7 @@ pub fn draw(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, cid: ItemId
     let comp_name = app.session.project.item(cid).map(|it| it.name.clone()).unwrap_or_default();
     let Some(e) = c.errors.get(i).cloned() else { return };
     let msg_rect = Rect::from_min_max(pos2(rect.min.x + 26.0, rect.min.y), pos2(prev.min.x - 6.0, rect.max.y));
-    let resp = ui.interact(msg_rect, egui::Id::new("expr-bar-msg"), Sense::click()).on_hover_text(tr("Click to reveal the expression in the timeline"));
+    let resp = ui.interact(msg_rect, egui::Id::unique("expr-bar-msg"), Sense::click()).on_hover_text(tr("Click to reveal the expression in the timeline"));
     p.with_clip_rect(msg_rect).text(
         pos2(msg_rect.min.x, rect.center().y),
         Align2::LEFT_CENTER,
diff --git a/crates/ui-egui/src/panels/expr_editor.rs b/crates/ui-egui/src/panels/expr_editor.rs
index f342d5636..6d742dc4e 100644
--- a/crates/ui-egui/src/panels/expr_editor.rs
+++ b/crates/ui-egui/src/panels/expr_editor.rs
@@ -111,6 +111,7 @@ pub const COMPLETIONS: &[&str] = &[
     "ease",
     "easeIn",
     "easeOut",
+    "bezier",
     "clamp",
     "random",
     "gaussRandom",
@@ -331,8 +332,16 @@ fn layout(text: &str, font: FontId, base: Color32, sx: &Syntax, p: &Scripting, b
     job
 }
 
+/// The scripting preferences, text colour and row count an [`editor`] is drawn with.
+pub struct EditorOpts<'a> {
+    pub prefs: &'a Scripting,
+    pub color: Color32,
+    pub rows: usize,
+}
+
 /// The editor: returns the response; `buf` is edited in place.
-pub fn editor(ui: &mut egui::Ui, id: egui::Id, buf: &mut String, rect: Rect, p: &Scripting, color: Color32, rows: usize, t: &Tokens) -> egui::Response {
+pub fn editor(ui: &mut egui::Ui, id: egui::Id, buf: &mut String, rect: Rect, opts: EditorOpts, t: &Tokens) -> egui::Response {
+    let EditorOpts { prefs: p, color, rows } = opts;
     let size = (p.editor_font_size.clamp(8, 40) as f32) * 0.9;
     let font = Tokens::mono(size);
     // Line numbers in a gutter on the left.
diff --git a/crates/ui-egui/src/panels/flowchart.rs b/crates/ui-egui/src/panels/flowchart.rs
index f59d35982..d6d6fca01 100644
--- a/crates/ui-egui/src/panels/flowchart.rs
+++ b/crates/ui-egui/src/panels/flowchart.rs
@@ -6,7 +6,7 @@
 //! [`build`] is pure and cycle-safe (a comp nested in itself is drawn once, with an edge back),
 //! so agents get the same graph through `flowchart.graph`.
 
-use crate::i18n::tr_args;
+use crate::i18n::{tr, tr_args};
 use std::collections::{BTreeMap, BTreeSet};
 
 use effectcraft_engine::project::{ItemId, ItemKind, LayerSource, Project};
@@ -16,7 +16,7 @@ use serde_json::{Value, json};
 
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
-use crate::{EffectcraftApp, widgets};
+use crate::{EffectcraftApp, a11y, widgets};
 
 /// Flowchart panel options (the panel's switches).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -233,6 +233,19 @@ pub fn command(app: &mut EffectcraftApp, id: &str, p: &Value) -> Result<Value, S
     Ok(json!({"layers": o.layers, "effects": o.effects, "solids": o.solids, "direction": if o.vertical { "tb" } else { "lr" }, "root": o.root}))
 }
 
+/// What a node is, in words.
+fn kind_name(kind: &str) -> String {
+    match kind {
+        "comp" => tr("Composition"),
+        "footage" => tr("Footage"),
+        "solid" => tr("Solid"),
+        "layer" => tr("Layer"),
+        "effect" => tr("Effect"),
+        other => other,
+    }
+    .to_string()
+}
+
 fn kind_style(kind: &str) -> (Icon, Color32) {
     match kind {
         "comp" => (Icon::Comp, Color32::from_rgb(0x3d, 0x5a, 0x8c)),
@@ -243,6 +256,140 @@ fn kind_style(kind: &str) -> (Icon, Color32) {
     }
 }
 
+/// The frame's key presses without modifiers.
+fn plain_key_presses(ctx: &egui::Context) -> Vec<egui::Key> {
+    ctx.input(|i| {
+        i.events
+            .iter()
+            .filter_map(|e| match e {
+                egui::Event::Key { key, pressed: true, modifiers, .. } if !modifiers.any() => Some(*key),
+                _ => None,
+            })
+            .collect()
+    })
+}
+
+/// The node a navigation key moves to from node `at` (Up / Down / Home / End by order, Right to
+/// a node this one uses, Left back to one that uses it); `home_end` only with a node focused.
+fn key_target(g: &FlowGraph, idx: &BTreeMap<&str, usize>, key: egui::Key, at: Option<usize>, home_end: bool) -> Option<usize> {
+    use egui::Key;
+    let last = g.nodes.len().checked_sub(1);
+    match (key, last) {
+        (Key::ArrowDown, Some(last)) => Some(at.map_or(0, |a| a.saturating_add(1).min(last))),
+        (Key::ArrowUp, Some(last)) => Some(at.map_or(last, |a| a.saturating_sub(1))),
+        (Key::Home, Some(_)) if home_end => Some(0),
+        (Key::End, Some(last)) if home_end => Some(last),
+        (Key::ArrowRight, _) => {
+            at.and_then(|a| g.nodes.get(a)).and_then(|n| g.edges.iter().find(|(from, _)| *from == n.id)).and_then(|(_, to)| idx.get(to.as_str()).copied())
+        }
+        (Key::ArrowLeft, _) => {
+            at.and_then(|a| g.nodes.get(a)).and_then(|n| g.edges.iter().find(|(_, to)| *to == n.id)).and_then(|(from, _)| idx.get(from.as_str()).copied())
+        }
+        _ => None,
+    }
+}
+
+/// How far to pan so `r` is inside `body`, with a margin.
+fn pan_into_view(r: Rect, body: Rect) -> (f32, f32) {
+    let axis = |lo: f32, hi: f32, body_lo: f32, body_hi: f32| {
+        if lo < body_lo + 16.0 {
+            body_lo + 16.0 - lo
+        } else if hi > body_hi - 16.0 {
+            body_hi - 16.0 - hi
+        } else {
+            0.0
+        }
+    };
+    (axis(r.min.x, r.max.x, body.min.x, body.max.x), axis(r.min.y, r.max.y, body.min.y, body.max.y))
+}
+
+/// "Mid, Composition, uses 2": the node's name, what it is and how many nodes it leads to.
+fn node_a11y_name(g: &FlowGraph, n: &FlowNode) -> String {
+    let uses = g.edges.iter().filter(|(a, _)| *a == n.id).count();
+    if uses > 0 { tr_args("{}, {}, uses {}", &[&n.label, &kind_name(n.kind), &uses]) } else { tr_args("{}, {}", &[&n.label, &kind_name(n.kind)]) }
+}
+
+/// The `flowchart.options` params for the toolbar switch `key` (currently `on`).
+fn option_params(key: &str, on: bool, vertical: bool) -> Value {
+    if key == "direction" { json!({"direction": if vertical { "lr" } else { "tb" }}) } else { json!({key: !on}) }
+}
+
+fn node_id(id: &str) -> egui::Id {
+    egui::Id::unique(("flow-node", id))
+}
+
+/// What a node does: opened (as a double click).
+fn open_cmd(n: &FlowNode) -> Option<(String, Value)> {
+    match (n.kind, n.item, n.comp) {
+        ("comp", Some(c), _) | (_, _, Some(c)) => Some(("comp.open".into(), json!({"comp": c}))),
+        _ => None,
+    }
+}
+
+/// What a node does: revealed (as a Cmd/Ctrl click).
+fn reveal_cmds(n: &FlowNode) -> Vec<(String, Value)> {
+    match (n.item, n.comp, n.layer) {
+        // Items in the Project panel, layers selected in their comp.
+        (Some(item), ..) => vec![("project.select".into(), json!({"items": [item]})), ("window.panel".into(), json!({"panel": "project"}))],
+        (None, Some(c), Some(l)) => vec![("comp.open".into(), json!({"comp": c})), ("layer.select".into(), json!({"layers": [l]}))],
+        _ => vec![],
+    }
+}
+
+// Keyboard, with a node focused (or after a click, when nothing has the focus): Up / Down and
+// Home / End move through the nodes, Right goes to a node this one uses and Left back to one
+// that uses it, Enter opens (as a double click), Space reveals (as a Cmd/Ctrl click). The
+// focus follows, and the view pans to keep the node in sight.
+fn flow_keys(
+    app: &mut EffectcraftApp,
+    ctx: &egui::Context,
+    (g, idx): (&FlowGraph, &BTreeMap<&str, usize>),
+    (cursor, selected): (Option<usize>, Option<&str>),
+    body: Rect,
+    rects: &[Rect],
+    cmds: &mut Vec<(String, Value)>,
+) {
+    let focused = ctx.memory(|m| m.focused());
+    let on_node = focused.is_some_and(|f| g.nodes.iter().any(|n| node_id(&n.id) == f));
+    let by_mouse = focused.is_none() && app.ui.focused == crate::dock::PanelKind::Flowchart;
+    if (on_node || by_mouse) && app.dialog.is_none() && !widgets::any_menu_open(ctx) {
+        let keys = plain_key_presses(ctx);
+        let mut at = selected.and_then(|s| idx.get(s).copied()).or(cursor);
+        let mut moved = None;
+        for key in keys {
+            use egui::Key;
+            let to = key_target(g, idx, key, at, on_node);
+            if let Some(n) = to.and_then(|to| g.nodes.get(to)) {
+                at = to;
+                app.ui.flowchart.selected = Some(n.id.clone());
+                moved = Some(n.id.clone());
+                continue;
+            }
+            let Some(n) = at.and_then(|a| g.nodes.get(a)) else { continue };
+            match key {
+                Key::Enter => cmds.extend(open_cmd(n)),
+                Key::Space if on_node => cmds.extend(reveal_cmds(n)),
+                _ => {}
+            }
+        }
+        if let Some(i) = moved.as_deref().and_then(|m| idx.get(m).copied()) {
+            // Pan so the node is inside the view, with a margin.
+            let (dx, dy) = pan_into_view(rects.get(i).copied().unwrap_or(body), body);
+            app.ui.flowchart.pan[0] += dx;
+            app.ui.flowchart.pan[1] += dy;
+            app.ui.focused = crate::dock::PanelKind::Flowchart;
+            if on_node && let Some(id) = moved.as_deref() {
+                a11y::focus_next_pass(ctx, "flow", node_id(id));
+            }
+            ctx.request_repaint();
+        }
+        // The arrows are the chart's, not egui's spatial focus moves.
+        if on_node {
+            ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
+        }
+    }
+}
+
 /// Draw the Flowchart panel.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
@@ -250,7 +397,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let p = ui.painter().with_clip_rect(rect);
     p.rect_filled(rect, 0.0, t.tl_bg);
     let Some(rid) = root(app) else {
-        p.text(rect.center(), Align2::CENTER_CENTER, "(no composition)", Tokens::ui(12.0), t.text_faint);
+        p.text(rect.center(), Align2::CENTER_CENTER, crate::i18n::tr("(no composition)"), Tokens::ui(12.0), t.text_faint);
         return;
     };
     // ---- toolbar: switches and direction.
@@ -267,11 +414,17 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         ("layers", "Layers", o.layers),
         ("solids", "Solids", o.solids),
     ] {
-        let w = 18.0 + label.len() as f32 * 6.6;
+        let shown = tr(label);
+        let w = 18.0 + shown.chars().count() as f32 * 6.6;
         let r = Rect::from_min_size(pos2(x - w, bar.min.y + 5.0), vec2(w, 20.0));
         x -= w + 6.0;
-        if widgets::text_button(ui, r, label, on, &t, egui::Id::new(("flow-opt", key))).clicked() {
-            let v = if key == "direction" { json!({"direction": if o.vertical { "lr" } else { "tb" }}) } else { json!({key: !on}) };
+        let resp = widgets::text_button(ui, r, shown, on, &t, egui::Id::unique(("flow-opt", key)));
+        if key != "direction" {
+            // Effects, Layers and Solids stay pressed while they are on.
+            a11y::toggle_button(&resp, shown, on);
+        }
+        if resp.clicked() {
+            let v = option_params(key, on, o.vertical);
             cmds.push(("flowchart.options".into(), v));
         }
         app.auto.add(&format!("flowchart.option.{key}"), r, label);
@@ -282,7 +435,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let g = build(&app.session.project, rid, &o);
     let pos = layout(&g, o.vertical);
     let origin = body.min + vec2(24.0 + o.pan[0], 24.0 + o.pan[1]);
-    let bg = ui.interact(body, egui::Id::new("flow-bg"), Sense::click_and_drag());
+    // Panned with the mouse (or the wheel); the keyboard moves between the nodes and the view
+    // follows, so the background is not a Tab stop.
+    let bg = ui.interact(body, egui::Id::unique("flow-bg"), Sense::CLICK | Sense::DRAG);
+    a11y::role_name(&bg, egui::accesskit::Role::Group, &tr_args("Flowchart: {}", &[&root_name]));
     if bg.dragged() {
         let d = bg.drag_delta();
         app.ui.flowchart.pan[0] += d.x;
@@ -315,14 +471,28 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         gp.add(egui::Shape::convex_polygon(vec![e, e + l, e + r], col, Stroke::NONE));
     }
     let cmd_down = ui.input(|i| i.modifiers.command || i.modifiers.ctrl);
+    // One Tab stop for the chart: the selected node (the first one drawn without a selection);
+    // the arrow keys move between the others.
+    let drawn: Vec<bool> = (0..g.nodes.len()).map(|i| rect_of(i).intersects(body)).collect();
+    let is_drawn = |i: usize| drawn.get(i).copied().unwrap_or(false);
+    let cursor = o.selected.as_deref().and_then(|s| idx.get(s).copied()).filter(|i| is_drawn(*i)).or_else(|| drawn.iter().position(|d| *d));
+    let size = g.nodes.len();
     for (i, n) in g.nodes.iter().enumerate() {
         let r = rect_of(i);
-        if !r.intersects(body) {
+        if !is_drawn(i) {
             continue;
         }
         let (icon, fill) = kind_style(n.kind);
         let selected = o.selected.as_deref() == Some(n.id.as_str());
-        let resp = ui.interact(r.intersect(body), egui::Id::new(("flow-node", &n.id)), Sense::click());
+        let sense = if cursor == Some(i) { Sense::click() } else { Sense::CLICK };
+        let resp = ui.interact(r.intersect(body), node_id(&n.id), sense);
+        if a11y::take_pending_focus(&ctx, "flow", resp.id) {
+            resp.request_focus();
+        }
+        if resp.gained_focus() {
+            app.ui.flowchart.selected = Some(n.id.clone());
+            app.ui.focused = crate::dock::PanelKind::Flowchart;
+        }
         let fill = if resp.hovered() { fill.gamma_multiply(1.25) } else { fill };
         gp.rect_filled(r, 5.0, fill);
         gp.rect_stroke(
@@ -331,6 +501,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             Stroke::new(if selected { 2.0 } else { 1.0 }, if selected { t.accent } else { Color32::from_black_alpha(120) }),
             StrokeKind::Inside,
         );
+        if resp.has_focus() {
+            gp.rect_stroke(r.expand(2.0), 6.0, Stroke::new(2.0, t.text), StrokeKind::Outside);
+        }
         icons::paint(&gp, Rect::from_center_size(pos2(r.min.x + 16.0, r.center().y), vec2(14.0, 14.0)), icon, Color32::WHITE);
         gp.with_clip_rect(r.shrink(2.0).intersect(body)).text(
             pos2(r.min.x + 30.0, r.center().y),
@@ -340,32 +513,23 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             Color32::WHITE,
         );
         app.auto.add(&format!("flowchart.node.{}", n.id), r, &n.label);
+        let name = node_a11y_name(&g, n);
+        a11y::list_item(&resp, &name, selected, i.saturating_add(1), size);
         if resp.clicked() {
             app.ui.flowchart.selected = Some(n.id.clone());
+            app.ui.focused = crate::dock::PanelKind::Flowchart;
             if cmd_down {
-                // Reveal: items in the Project panel, layers selected in their comp.
-                match (n.item, n.comp, n.layer) {
-                    (Some(item), ..) => {
-                        cmds.push(("project.select".into(), json!({"items": [item]})));
-                        cmds.push(("window.panel".into(), json!({"panel": "project"})));
-                    }
-                    (None, Some(c), Some(l)) => {
-                        cmds.push(("comp.open".into(), json!({"comp": c})));
-                        cmds.push(("layer.select".into(), json!({"layers": [l]})));
-                    }
-                    _ => {}
-                }
+                cmds.extend(reveal_cmds(n));
             }
         }
         if resp.double_clicked() {
-            match (n.kind, n.item, n.comp) {
-                ("comp", Some(c), _) => cmds.push(("comp.open".into(), json!({"comp": c}))),
-                (_, _, Some(c)) => cmds.push(("comp.open".into(), json!({"comp": c}))),
-                _ => {}
-            }
+            cmds.extend(open_cmd(n));
         }
         resp.on_hover_text(tr_args("{} — double-click to open, {}-click to reveal", &[&n.label, &(if cfg!(target_os = "macos") { "Cmd" } else { "Ctrl" })]));
     }
+
+    let rects: Vec<Rect> = (0..g.nodes.len()).map(rect_of).collect();
+    flow_keys(app, &ctx, (&g, &idx), (cursor, o.selected.as_deref()), body, &rects, &mut cmds);
     for (id, params) in cmds {
         if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
             app.ui.status = e;
diff --git a/crates/ui-egui/src/panels/footage_panel.rs b/crates/ui-egui/src/panels/footage_panel.rs
index a9e7cefb2..ef6458475 100644
--- a/crates/ui-egui/src/panels/footage_panel.rs
+++ b/crates/ui-egui/src/panels/footage_panel.rs
@@ -1,7 +1,8 @@
 //! The Footage panel (double-click footage in the Project panel): the source on its own time
 //! ruler, play / pause, In and Out marks, and the Edit Target buttons — Overlay Edit and Ripple
 //! Insert Edit — that cut the marked range into the active composition at its current time.
-//! Everything runs `footage.*` commands (state in `EditorState::footage_panel`).
+//! Time, marks and edits run `footage.*` commands (state in `EditorState::footage_panel`);
+//! the Play/Pause flag is local egui state.
 
 use crate::i18n::{tr, tr_args};
 use effectcraft_engine::project::{FootageKind, ItemKind};
@@ -13,6 +14,11 @@ use super::panel_kit as kit;
 use crate::EffectcraftApp;
 use crate::theme::Tokens;
 
+/// The Footage panel for the item opened into it: the frame at the panel's current time (cached
+/// per item, time and session revision), a ruler with the in/out span and CTI that scrubs on click
+/// or drag, Play/Pause, set In/Out, and Ripple Insert / Overlay Edit into the active comp. A solid
+/// shows its colour, footage without video says so, and an empty panel explains how to open one.
+/// Time changes run `footage.*` commands; the panel's Play/Pause flag is local egui state.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -58,11 +64,11 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         && f.has_video
     {
         let key = (view.item.0, view.time.0, app.session.revision);
-        let tid = egui::Id::new("footage-panel-tex");
+        let tid = egui::Id::unique("footage-panel-tex");
         let cached: Option<((u64, i64, u64), egui::TextureHandle, [u32; 2])> = ctx.data(|d| d.get_temp(tid));
         let tex = match cached {
             Some((k, tex, size)) if k == key => Some((tex, size)),
-            _ => app.session.footage.frame(view.item, f, view.time).map(|img| {
+            _ => effectcraft_engine::commands::footage_panel::frame(&app.session, view.item, f, view.time).map(|img| {
                 let ci = egui::ColorImage::from_rgba_unmultiplied([img.width as usize, img.height as usize], &img.to_rgba8());
                 let tex = crate::frames::load_fitted(&ctx, "footage-panel", ci, egui::TextureOptions::LINEAR);
                 ctx.data_mut(|d| d.insert_temp(tid, (key, tex.clone(), [img.width, img.height])));
@@ -97,7 +103,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     p.rect_filled(Rect::from_min_max(pos2(x_of(a), ruler.max.y - 4.0), pos2(x_of(b), ruler.max.y)), 0.0, t.work_area);
     let cx = x_of(view.time);
     p.line_segment([pos2(cx, ruler.min.y), pos2(cx, ruler.max.y)], Stroke::new(1.5, t.cti));
-    let resp = ui.interact(ruler, egui::Id::new("footage-ruler"), Sense::click_and_drag());
+    let resp = ui.interact(ruler, egui::Id::unique("footage-ruler"), Sense::click_and_drag());
     app.auto.add("footage.ruler", ruler, "Time ruler");
     if (resp.clicked() || resp.dragged())
         && let Some(pt) = resp.interact_pointer_pos()
@@ -106,7 +112,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         kit::exec(app, "footage.setTime", json!({"time": s}));
     }
     // Playback.
-    let play_id = egui::Id::new("footage-playing");
+    let play_id = egui::Id::unique("footage-playing");
     let playing: bool = ctx.data(|d| d.get_temp(play_id).unwrap_or(false));
     if playing {
         let dt = ctx.input(|i| i.stable_dt).min(0.1) as f64;
diff --git a/crates/ui-egui/src/panels/forms.rs b/crates/ui-egui/src/panels/forms.rs
index 185c10336..e83530fa4 100644
--- a/crates/ui-egui/src/panels/forms.rs
+++ b/crates/ui-egui/src/panels/forms.rs
@@ -152,7 +152,7 @@ fn is_pdf(p: &Value) -> bool {
 }
 
 /// File ▸ Import ▸ File… picked numbered stills that import as image sequences: ask, as After
-/// Effects' "<format> Sequence" checkbox in its Import dialog does (rfd's native dialog can't
+/// Effects' `<format> Sequence` checkbox in its Import dialog does (rfd's native dialog can't
 /// carry a checkbox), with Force Alphabetical Order and the frame rate. `p`: the import's
 /// parameters. Returns whether the dialog opened. The checkbox starts off, as in After Effects:
 /// unticked, the picked files import as stills. Dropped files and agents' `file.import` don't
@@ -206,6 +206,304 @@ fn value_fields(name: &str, v: &effectcraft_engine::keyframe::Value) -> Option<V
     })
 }
 
+/// The New Composition from Selection dialog's title and fields.
+fn new_comp_from_selection_form(s: &effectcraft_engine::Session) -> (String, Vec<Field>) {
+    let names: Vec<(String, Value)> =
+        s.state.project_selection.iter().enumerate().filter_map(|(i, id)| s.project.item(*id).map(|it| (it.name.clone(), json!(i)))).collect();
+    let names: Vec<(&str, Value)> = names.iter().map(|(n, v)| (n.as_str(), v.clone())).collect();
+    let still = if s.prefs.import.still_footage == "seconds" { s.prefs.import.still_seconds } else { 10.0 };
+    (
+        "New Composition from Selection".into(),
+        vec![
+            Field::choice("single", "Create", &[("Single Composition", json!(true)), ("Multiple Compositions", json!(false))], 0),
+            Field::choice("dimensionsFrom", "Use Dimensions From", &names, 0),
+            Field::num("duration", "Still Duration (seconds)", still),
+            Field::bool("addToRenderQueue", "Add to Render Queue", false),
+            Field::bool("sequence", "Sequence Layers", false),
+            Field::bool("overlap", "Overlap", false),
+            Field::num("overlapDuration", "Duration (seconds)", 1.0),
+            Field::choice(
+                "transition",
+                "Transition",
+                &[("Off", json!("off")), ("Dissolve Front Layer", json!("dissolveFront")), ("Cross Dissolve Front and Back Layers", json!("crossDissolve"))],
+                0,
+            ),
+        ],
+    )
+}
+
+/// The Interpret Footage dialog for the selected footage (or its proxy), if there is one.
+fn interpret_footage_form(s: &effectcraft_engine::Session, proxy: bool, base: &mut Value) -> Option<(String, Vec<Field>)> {
+    let f = s.state.project_selection.first().and_then(|i| s.project.item(*i)).and_then(|it| match (&it.kind, &it.proxy) {
+        (_, Some(px)) if proxy => Some(px.footage.clone()),
+        (effectcraft_engine::project::ItemKind::Footage(f), _) if !proxy => Some(f.clone()),
+        _ => None,
+    });
+    let f = f?;
+    let hex = |c: [f32; 3]| format!("#{:02x}{:02x}{:02x}", (c[0] * 255.0).round() as u8, (c[1] * 255.0).round() as u8, (c[2] * 255.0).round() as u8);
+    let mut fields = vec![
+        // Main Options ▸ Alpha.
+        Field::choice(
+            "alpha",
+            "Alpha",
+            &[
+                ("Interpret Straight - Unmatted", json!("straight")),
+                ("Interpret Premultiplied - Matted With Color", json!("premultiplied")),
+                ("Ignore", json!("ignore")),
+                ("Guess", json!("guess")),
+            ],
+            f.alpha as usize,
+        ),
+        Field::text("matteColor", "Matte color (premultiplied)", &hex(f.premul_color)),
+        Field::bool("invertAlpha", "Invert Alpha", f.invert_alpha),
+        // Main Options ▸ Frame Rate, Fields and Pulldown, Other Options.
+        Field::num("frameRate", "Assume this frame rate", f.frame_rate.as_f64()),
+        Field::choice(
+            "fields",
+            "Separate Fields",
+            &[("Off", json!("off")), ("Upper Field First", json!("upper")), ("Lower Field First", json!("lower"))],
+            f.fields as usize,
+        ),
+        Field::num("pixelAspect", "Pixel Aspect Ratio", f.pixel_aspect),
+        Field::num("loop", "Loop (times)", f.loop_count as f64),
+        // Color.
+        Field::choice(
+            "colorProfile",
+            "Assign Profile",
+            &[
+                ("Embedded / sRGB", json!("auto")),
+                ("sRGB IEC61966-2.1", json!("srgb")),
+                ("HDTV (Rec. 709)", json!("rec709")),
+                ("Rec. 2020", json!("rec2020")),
+                ("Display P3", json!("p3")),
+                ("ACEScg", json!("acescg")),
+                ("ACES2065-1", json!("aces2065")),
+                ("Rec. 2100 PQ", json!("rec2100pq")),
+                ("Rec. 2100 HLG", json!("rec2100hlg")),
+            ],
+            f.color_profile.map_or(0, |c| 1 + effectcraft_engine::project::ColorSpace::ALL.iter().position(|x| *x == c).unwrap_or(0)),
+        ),
+        Field::bool("preserveRgb", "Preserve RGB", f.preserve_rgb),
+        Field::bool("linearLight", "Interpret As Linear Light", f.linear_light),
+    ];
+    // Color ▸ Cineon Settings (DPX and Cineon files). The converted points show in the
+    // footage's Units, and `pointUnits` reads them back in those units when Units changes.
+    if f.is_cineon_file() {
+        use effectcraft_engine::project::CineonUnits;
+        let c = f.cineon;
+        let units: Vec<(&str, Value)> = CineonUnits::ALL.iter().map(|u| (u.label(), json!(u.id()))).collect();
+        fields.extend([
+            Field::note("cineonSettings", "Cineon Settings"),
+            Field::bool("logConversion", "Logarithmic Conversion", c.log_conversion),
+            Field::num("convertedBlack", "Converted Black Point", c.units.from_ten_bit(f64::from(c.converted_black))),
+            Field::num("convertedWhite", "Converted White Point", c.units.from_ten_bit(f64::from(c.converted_white))),
+            Field::num("tenBitBlack", "10 Bit Black Point", f64::from(c.black)),
+            Field::num("tenBitWhite", "10 Bit White Point", f64::from(c.white)),
+            Field::num("currentGamma", "Current Gamma", f64::from(c.gamma)),
+            Field::num("highlightRolloff", "Highlight Rolloff", f64::from(c.rolloff)),
+            Field::choice("cineonUnits", "Units", &units, CineonUnits::ALL.iter().position(|u| *u == c.units).unwrap_or(0)),
+        ]);
+        if !base.is_object() {
+            *base = json!({});
+        }
+        if let Some(m) = base.as_object_mut() {
+            m.insert("pointUnits".into(), json!(c.units.id()));
+        }
+    }
+    // After Frame Rate: an image sequence's frames (a missing one holds the previous frame),
+    // then Start Timecode.
+    let mut timing = Vec::new();
+    if f.kind == effectcraft_engine::project::FootageKind::Sequence {
+        let gaps = match effectcraft_engine::sequence::missing_report(&f.sequence) {
+            _ if f.alphabetical => "files in alphabetical order".into(),
+            Some(gaps) => format!("{gaps} (the previous frame is held)"),
+            None => "no missing frames".into(),
+        };
+        timing.push(Field::note("sequenceInfo", &format!("Image sequence: {} files, {} frames; {gaps}.", f.sequence.len(), f.sequence_frames())));
+    }
+    if f.kind != effectcraft_engine::project::FootageKind::Still {
+        timing.push(Field::choice(
+            "overrideStart",
+            "Start Timecode",
+            &[("Use Source File Timecode", json!(false)), ("Override Start", json!(true))],
+            usize::from(f.start_timecode.is_some()),
+        ));
+        timing.push(Field::text("startTimecode", "Override Start", &f.timecode(0)));
+    }
+    let at = fields.iter().position(|x| x.key == "frameRate").map_or(fields.len(), |i| i + 1);
+    fields.splice(at..at, timing);
+    Some((if proxy { "Interpret Footage: Proxy".into() } else { "Interpret Footage".into() }, fields))
+}
+
+/// The Project Settings dialog's title and fields.
+fn project_settings_form(s: &effectcraft_engine::Session) -> (String, Vec<Field>) {
+    let st = &s.project.settings;
+    // The catalogue row is `GPU Acceleration ({})`, so the value goes through
+    // tr_args: wrapping the assembled string in tr() would look up the backend's name.
+    let gpu_label = match &s.accel {
+        Some(a) => tr_args("GPU Acceleration ({})", &[&a.name()]),
+        None => tr("GPU Acceleration (no GPU: software)").to_string(),
+    };
+    let depth = match st.bit_depth.label() {
+        l if l.starts_with("16") => 1,
+        l if l.starts_with("32") => 2,
+        _ => 0,
+    };
+    (
+        "Project Settings".into(),
+        vec![
+            Field::choice(
+                "bitDepth",
+                "Depth",
+                &[("8 bits per channel", json!(8)), ("16 bits per channel", json!(16)), ("32 bits per channel (float)", json!(32))],
+                depth,
+            ),
+            Field::choice(
+                "timeDisplay",
+                "Time display style",
+                &[
+                    ("Timecode", json!("timecode")),
+                    ("Frames", json!("frames")),
+                    ("Feet + Frames (35mm)", json!("feet35")),
+                    ("Feet + Frames (16mm)", json!("feet16")),
+                ],
+                {
+                    use effectcraft_engine::project::TimeDisplayStyle as T;
+                    match st.time_display {
+                        T::Timecode => 0,
+                        T::Frames => 1,
+                        T::Feet35 => 2,
+                        T::Feet16 => 3,
+                    }
+                },
+            ),
+            // Time Display Style ▸ Frames ▸ Frame Count (also numbers Feet + Frames).
+            Field::choice("frameStart", "Frame count", &[("Start at 0", json!(0)), ("Start at 1", json!(1))], usize::from(st.frame_start == 1)),
+            Field::choice(
+                "colorEngine",
+                "Color engine",
+                &[("Adobe-style built-in", json!("adobe")), ("OCIO (built-in ACES config)", json!("ocio"))],
+                usize::from(st.color_engine == effectcraft_engine::project::ColorEngine::Ocio),
+            ),
+            Field::choice(
+                "workingSpace",
+                "Working space",
+                &[
+                    ("None", json!("none")),
+                    ("sRGB IEC61966-2.1", json!("srgb")),
+                    ("HDTV (Rec. 709)", json!("rec709")),
+                    ("Rec. 2020", json!("rec2020")),
+                    ("Display P3", json!("p3")),
+                    ("ACEScg", json!("acescg")),
+                    ("ACES2065-1", json!("aces2065")),
+                ],
+                st.working_space.map_or(0, |c| 1 + effectcraft_engine::project::ColorSpace::WORKING.iter().position(|x| *x == c).unwrap_or(0)),
+            ),
+            // With Working Space None (After Effects' Working Gamma, 2.2 or 2.4).
+            Field::choice("workingGamma", "Working gamma", &[("2.2", json!(2.2)), ("2.4", json!(2.4))], usize::from(st.working_gamma_24())),
+            Field::bool("linearize", "Linearize working space", st.linearize),
+            Field::bool("blendLinear", "Blend colors using 1.0 gamma", st.blend_linear),
+            Field::choice(
+                "hdr",
+                "HDR on SDR displays and outputs",
+                &[("Clip", json!("clip")), ("Compand", json!("compand")), ("Tone map", json!("toneMap"))],
+                st.hdr as usize,
+            ),
+            Field::choice(
+                "outputSpace",
+                "Output color space",
+                &[
+                    ("sRGB IEC61966-2.1 (default)", json!("default")),
+                    ("HDTV (Rec. 709)", json!("rec709")),
+                    ("Rec. 2020", json!("rec2020")),
+                    ("Display P3", json!("p3")),
+                    ("Rec. 2100 PQ (HDR)", json!("rec2100pq")),
+                    ("Rec. 2100 HLG (HDR)", json!("rec2100hlg")),
+                ],
+                {
+                    use effectcraft_engine::project::ColorSpace as C;
+                    match st.output_space {
+                        Some(C::Rec709) => 1,
+                        Some(C::Rec2020) => 2,
+                        Some(C::DisplayP3) => 3,
+                        Some(C::Rec2100Pq) => 4,
+                        Some(C::Rec2100Hlg) => 5,
+                        _ => 0,
+                    }
+                },
+            ),
+            // Video Rendering and Effects ▸ Use.
+            Field::choice(
+                "renderer",
+                "Video rendering and effects",
+                &[(gpu_label.as_str(), json!("gpu")), ("Software Rendering", json!("software"))],
+                usize::from(!st.gpu_acceleration),
+            ),
+        ],
+    )
+}
+
+/// The Export Adobe Premiere Pro Project dialog's title and fields.
+fn export_timeline_form(s: &effectcraft_engine::Session) -> (String, Vec<Field>) {
+    let name = s.active_comp_id().and_then(|c| s.project.item(c)).map(|i| i.name.clone()).unwrap_or_else(|| "Composition".into());
+    let dir = s.path.as_deref().and_then(|p| std::path::Path::new(p).parent()).map(|d| d.to_path_buf()).unwrap_or_default();
+    let path = dir.join(format!("{name}.xml")).to_string_lossy().to_string();
+    (
+        "Export Adobe Premiere Pro Project".into(),
+        vec![
+            Field::note("note", "Writes Final Cut Pro XML (.xml), which Premiere Pro opens with File ▸ Import. Native .prproj files are not written."),
+            Field::save_path("path", "File", &path),
+            Field::choice(
+                "format",
+                "Format",
+                &[
+                    ("Final Cut Pro XML (.xml) – Premiere Pro", json!("xml")),
+                    ("FCPXML (.fcpxml)", json!("fcpxml")),
+                    ("OpenTimelineIO (.otio)", json!("otio")),
+                    ("CMX 3600 EDL (.edl, V1 only)", json!("edl")),
+                    ("AAF (.aaf)", json!("aaf")),
+                    ("OMF (.omf, audio)", json!("omf")),
+                ],
+                0,
+            ),
+            Field::choice(
+                "prerender",
+                "Pre-render (ProRes 4444)",
+                &[
+                    ("Layers Premiere can't show (text, shapes, effects…)", json!("unsupported")),
+                    ("All layers", json!("all")),
+                    ("None (leave them out)", json!("none")),
+                ],
+                0,
+            ),
+            Field::choice("precomps", "Precomps", &[("Nested sequences", json!("nest")), ("Pre-render", json!("prerender"))], 0),
+        ],
+    )
+}
+
+/// The Layer ▸ Transform value dialog for the property named by `p` (default Position).
+fn transform_form(p: &Value, layer: Option<&effectcraft_engine::project::Layer>, lt: effectcraft_engine::time::Tick) -> (String, Vec<Field>) {
+    let prop = p.get("prop").and_then(Value::as_str).unwrap_or("position");
+    let cur = layer.and_then(|l| l.transform()).and_then(|tr| tr.get(if prop == "anchorPoint" { "anchor" } else { prop })).map(|pr| pr.value_at(lt));
+    let v = cur.map(|c| c.as_vec3()).unwrap_or([0.0; 3]);
+    let three = layer.is_some_and(|l| l.is_3d());
+    let title = match prop {
+        "anchor" => "Anchor Point",
+        "position" => "Position",
+        "scale" => "Scale",
+        "orientation" => "Orientation",
+        "rotation" => "Rotation",
+        _ => "Opacity",
+    };
+    let fields = match prop {
+        "rotation" | "opacity" => vec![Field::num("value", if prop == "rotation" { "Degrees" } else { "Opacity (%)" }, v[0])],
+        "orientation" => vec![Field::num("value[0]", "X", v[0]), Field::num("value[1]", "Y", v[1]), Field::num("value[2]", "Z", v[2])],
+        _ if three => vec![Field::num("value[0]", "X", v[0]), Field::num("value[1]", "Y", v[1]), Field::num("value[2]", "Z", v[2])],
+        _ => vec![Field::num("value[0]", "X", v[0]), Field::num("value[1]", "Y", v[1])],
+    };
+    (title.into(), fields)
+}
+
 /// If `id` is a dialog command invoked without its parameters, open its form and return true.
 pub fn open_form(app: &mut EffectcraftApp, id: &str, p: &Value) -> bool {
     let s = &app.session;
@@ -213,7 +511,7 @@ pub fn open_form(app: &mut EffectcraftApp, id: &str, p: &Value) -> bool {
     let layer = comp.and_then(|c| s.state.selected_layers.first().and_then(|l| c.layer(*l)));
     let t = s.time();
     let lt = layer.map(|l| l.layer_time(t)).unwrap_or(t);
-    let base = p.clone();
+    let mut base = p.clone();
     let (title, fields): (String, Vec<Field>) = match id {
         // Photoshop files: Import Kind (Footage / Composition / – Retain Layer Sizes). Dropped
         // files start at Settings ▸ Import ▸ Default Drag Import As.
@@ -281,27 +579,7 @@ pub fn open_form(app: &mut EffectcraftApp, id: &str, p: &Value) -> bool {
             let Some(fields) = value_fields(&pr.name, &pr.value_at(l.layer_time(t))) else { return false };
             (pr.name.clone(), fields)
         }
-        "layer.setTransform" if !has(p, &["value"]) => {
-            let prop = p.get("prop").and_then(Value::as_str).unwrap_or("position");
-            let cur = layer.and_then(|l| l.transform()).and_then(|tr| tr.get(if prop == "anchorPoint" { "anchor" } else { prop })).map(|pr| pr.value_at(lt));
-            let v = cur.map(|c| c.as_vec3()).unwrap_or([0.0; 3]);
-            let three = layer.is_some_and(|l| l.is_3d());
-            let title = match prop {
-                "anchor" => "Anchor Point",
-                "position" => "Position",
-                "scale" => "Scale",
-                "orientation" => "Orientation",
-                "rotation" => "Rotation",
-                _ => "Opacity",
-            };
-            let fields = match prop {
-                "rotation" | "opacity" => vec![Field::num("value", if prop == "rotation" { "Degrees" } else { "Opacity (%)" }, v[0])],
-                "orientation" => vec![Field::num("value[0]", "X", v[0]), Field::num("value[1]", "Y", v[1]), Field::num("value[2]", "Z", v[2])],
-                _ if three => vec![Field::num("value[0]", "X", v[0]), Field::num("value[1]", "Y", v[1]), Field::num("value[2]", "Z", v[2])],
-                _ => vec![Field::num("value[0]", "X", v[0]), Field::num("value[1]", "Y", v[1])],
-            };
-            (title.into(), fields)
-        }
+        "layer.setTransform" if !has(p, &["value"]) => transform_form(p, layer, lt),
         "path.freeTransform" if !has(p, &["scale", "rotation", "offset"]) => (
             "Free Transform Points".into(),
             vec![
@@ -377,32 +655,7 @@ pub fn open_form(app: &mut EffectcraftApp, id: &str, p: &Value) -> bool {
         "file.newCompFromSelection"
             if s.state.project_selection.len() > 1 && !has(p, &["single", "dimensionsFrom", "duration", "sequence", "addToRenderQueue"]) =>
         {
-            let names: Vec<(String, Value)> =
-                s.state.project_selection.iter().enumerate().filter_map(|(i, id)| s.project.item(*id).map(|it| (it.name.clone(), json!(i)))).collect();
-            let names: Vec<(&str, Value)> = names.iter().map(|(n, v)| (n.as_str(), v.clone())).collect();
-            let still = if s.prefs.import.still_footage == "seconds" { s.prefs.import.still_seconds } else { 10.0 };
-            (
-                "New Composition from Selection".into(),
-                vec![
-                    Field::choice("single", "Create", &[("Single Composition", json!(true)), ("Multiple Compositions", json!(false))], 0),
-                    Field::choice("dimensionsFrom", "Use Dimensions From", &names, 0),
-                    Field::num("duration", "Still Duration (seconds)", still),
-                    Field::bool("addToRenderQueue", "Add to Render Queue", false),
-                    Field::bool("sequence", "Sequence Layers", false),
-                    Field::bool("overlap", "Overlap", false),
-                    Field::num("overlapDuration", "Duration (seconds)", 1.0),
-                    Field::choice(
-                        "transition",
-                        "Transition",
-                        &[
-                            ("Off", json!("off")),
-                            ("Dissolve Front Layer", json!("dissolveFront")),
-                            ("Cross Dissolve Front and Back Layers", json!("crossDissolve")),
-                        ],
-                        0,
-                    ),
-                ],
-            )
+            new_comp_from_selection_form(s)
         }
         "layer.sequence" if !has(p, &["overlap"]) => (
             "Sequence Layers".into(),
@@ -422,189 +675,36 @@ pub fn open_form(app: &mut EffectcraftApp, id: &str, p: &Value) -> bool {
             ],
         ),
         "file.interpretFootage" | "file.interpretProxy"
-            if !has(p, &["frameRate", "alpha", "loop", "pixelAspect", "colorProfile", "fields", "invertAlpha", "matteColor", "linearLight", "startFrame"]) =>
+            if !has(
+                p,
+                &[
+                    "frameRate",
+                    "alpha",
+                    "loop",
+                    "pixelAspect",
+                    "colorProfile",
+                    "fields",
+                    "invertAlpha",
+                    "matteColor",
+                    "linearLight",
+                    "startFrame",
+                    "logConversion",
+                    "cineonUnits",
+                    "pointUnits",
+                    "convertedBlack",
+                    "convertedWhite",
+                    "tenBitBlack",
+                    "tenBitWhite",
+                    "currentGamma",
+                    "highlightRolloff",
+                ],
+            ) =>
         {
             let proxy = id == "file.interpretProxy";
-            let f = s.state.project_selection.first().and_then(|i| s.project.item(*i)).and_then(|it| match (&it.kind, &it.proxy) {
-                (_, Some(px)) if proxy => Some(px.footage.clone()),
-                (effectcraft_engine::project::ItemKind::Footage(f), _) if !proxy => Some(f.clone()),
-                _ => None,
-            });
-            let Some(f) = f else { return false };
-            let hex = |c: [f32; 3]| format!("#{:02x}{:02x}{:02x}", (c[0] * 255.0).round() as u8, (c[1] * 255.0).round() as u8, (c[2] * 255.0).round() as u8);
-            let mut fields = vec![
-                // Main Options ▸ Alpha.
-                Field::choice(
-                    "alpha",
-                    "Alpha",
-                    &[
-                        ("Interpret Straight - Unmatted", json!("straight")),
-                        ("Interpret Premultiplied - Matted With Color", json!("premultiplied")),
-                        ("Ignore", json!("ignore")),
-                        ("Guess", json!("guess")),
-                    ],
-                    f.alpha as usize,
-                ),
-                Field::text("matteColor", "Matte color (premultiplied)", &hex(f.premul_color)),
-                Field::bool("invertAlpha", "Invert Alpha", f.invert_alpha),
-                // Main Options ▸ Frame Rate, Fields and Pulldown, Other Options.
-                Field::num("frameRate", "Assume this frame rate", f.frame_rate.as_f64()),
-                Field::choice(
-                    "fields",
-                    "Separate Fields",
-                    &[("Off", json!("off")), ("Upper Field First", json!("upper")), ("Lower Field First", json!("lower"))],
-                    f.fields as usize,
-                ),
-                Field::num("pixelAspect", "Pixel Aspect Ratio", f.pixel_aspect),
-                Field::num("loop", "Loop (times)", f.loop_count as f64),
-                // Color.
-                Field::choice(
-                    "colorProfile",
-                    "Assign Profile",
-                    &[
-                        ("Embedded / sRGB", json!("auto")),
-                        ("sRGB IEC61966-2.1", json!("srgb")),
-                        ("HDTV (Rec. 709)", json!("rec709")),
-                        ("Rec. 2020", json!("rec2020")),
-                        ("Display P3", json!("p3")),
-                        ("ACEScg", json!("acescg")),
-                        ("ACES2065-1", json!("aces2065")),
-                        ("Rec. 2100 PQ", json!("rec2100pq")),
-                        ("Rec. 2100 HLG", json!("rec2100hlg")),
-                    ],
-                    f.color_profile.map_or(0, |c| 1 + effectcraft_engine::project::ColorSpace::ALL.iter().position(|x| *x == c).unwrap_or(0)),
-                ),
-                Field::bool("preserveRgb", "Preserve RGB", f.preserve_rgb),
-                Field::bool("linearLight", "Interpret As Linear Light", f.linear_light),
-            ];
-            // After Frame Rate: an image sequence's frames (missing ones show colour bars, as in
-            // After Effects), then Start Timecode.
-            let mut timing = Vec::new();
-            if f.kind == effectcraft_engine::project::FootageKind::Sequence {
-                let gaps = match effectcraft_engine::sequence::missing_report(&f.sequence) {
-                    _ if f.alphabetical => "files in alphabetical order".into(),
-                    Some(gaps) => format!("{gaps} shown as color bars"),
-                    None => "no missing frames".into(),
-                };
-                timing.push(Field::note("sequenceInfo", &format!("Image sequence: {} files, {} frames; {gaps}.", f.sequence.len(), f.sequence_frames())));
-            }
-            if f.kind != effectcraft_engine::project::FootageKind::Still {
-                timing.push(Field::choice(
-                    "overrideStart",
-                    "Start Timecode",
-                    &[("Use Source File Timecode", json!(false)), ("Override Start", json!(true))],
-                    usize::from(f.start_timecode.is_some()),
-                ));
-                timing.push(Field::text("startTimecode", "Override Start", &f.timecode(0)));
-            }
-            let at = fields.iter().position(|x| x.key == "frameRate").map_or(fields.len(), |i| i + 1);
-            fields.splice(at..at, timing);
-            (if proxy { "Interpret Footage: Proxy".into() } else { "Interpret Footage".into() }, fields)
-        }
-        "file.projectSettings" if p.as_object().is_none_or(|m| m.is_empty()) => {
-            let st = &s.project.settings;
-            // The catalogue row is `Mercury GPU Acceleration ({})`, so the value goes through
-            // tr_args: wrapping the assembled string in tr() would look up the backend's name.
-            let gpu_label = match &s.accel {
-                Some(a) => tr_args("Mercury GPU Acceleration ({})", &[&a.name()]),
-                None => tr("Mercury GPU Acceleration (no GPU: software)").to_string(),
-            };
-            let depth = match st.bit_depth.label() {
-                l if l.starts_with("16") => 1,
-                l if l.starts_with("32") => 2,
-                _ => 0,
-            };
-            (
-                "Project Settings".into(),
-                vec![
-                    Field::choice(
-                        "bitDepth",
-                        "Depth",
-                        &[("8 bits per channel", json!(8)), ("16 bits per channel", json!(16)), ("32 bits per channel (float)", json!(32))],
-                        depth,
-                    ),
-                    Field::choice(
-                        "timeDisplay",
-                        "Time display style",
-                        &[
-                            ("Timecode", json!("timecode")),
-                            ("Frames", json!("frames")),
-                            ("Feet + Frames (35mm)", json!("feet35")),
-                            ("Feet + Frames (16mm)", json!("feet16")),
-                        ],
-                        {
-                            use effectcraft_engine::project::TimeDisplayStyle as T;
-                            match st.time_display {
-                                T::Timecode => 0,
-                                T::Frames => 1,
-                                T::Feet35 => 2,
-                                T::Feet16 => 3,
-                            }
-                        },
-                    ),
-                    Field::choice(
-                        "colorEngine",
-                        "Color engine",
-                        &[("Adobe-style built-in", json!("adobe")), ("OCIO (built-in ACES config)", json!("ocio"))],
-                        usize::from(st.color_engine == effectcraft_engine::project::ColorEngine::Ocio),
-                    ),
-                    Field::choice(
-                        "workingSpace",
-                        "Working space",
-                        &[
-                            ("None", json!("none")),
-                            ("sRGB IEC61966-2.1", json!("srgb")),
-                            ("HDTV (Rec. 709)", json!("rec709")),
-                            ("Rec. 2020", json!("rec2020")),
-                            ("Display P3", json!("p3")),
-                            ("ACEScg", json!("acescg")),
-                            ("ACES2065-1", json!("aces2065")),
-                        ],
-                        st.working_space.map_or(0, |c| 1 + effectcraft_engine::project::ColorSpace::WORKING.iter().position(|x| *x == c).unwrap_or(0)),
-                    ),
-                    // With Working Space None (After Effects' Working Gamma, 2.2 or 2.4).
-                    Field::choice("workingGamma", "Working gamma", &[("2.2", json!(2.2)), ("2.4", json!(2.4))], usize::from(st.working_gamma_24())),
-                    Field::bool("linearize", "Linearize working space", st.linearize),
-                    Field::bool("blendLinear", "Blend colors using 1.0 gamma", st.blend_linear),
-                    Field::choice(
-                        "hdr",
-                        "HDR on SDR displays and outputs",
-                        &[("Clip", json!("clip")), ("Compand", json!("compand")), ("Tone map", json!("toneMap"))],
-                        st.hdr as usize,
-                    ),
-                    Field::choice(
-                        "outputSpace",
-                        "Output color space",
-                        &[
-                            ("sRGB IEC61966-2.1 (default)", json!("default")),
-                            ("HDTV (Rec. 709)", json!("rec709")),
-                            ("Rec. 2020", json!("rec2020")),
-                            ("Display P3", json!("p3")),
-                            ("Rec. 2100 PQ (HDR)", json!("rec2100pq")),
-                            ("Rec. 2100 HLG (HDR)", json!("rec2100hlg")),
-                        ],
-                        {
-                            use effectcraft_engine::project::ColorSpace as C;
-                            match st.output_space {
-                                Some(C::Rec709) => 1,
-                                Some(C::Rec2020) => 2,
-                                Some(C::DisplayP3) => 3,
-                                Some(C::Rec2100Pq) => 4,
-                                Some(C::Rec2100Hlg) => 5,
-                                _ => 0,
-                            }
-                        },
-                    ),
-                    // Video Rendering and Effects ▸ Use.
-                    Field::choice(
-                        "renderer",
-                        "Video rendering and effects",
-                        &[(gpu_label.as_str(), json!("gpu")), ("Mercury Software Only", json!("software"))],
-                        usize::from(!st.gpu_acceleration),
-                    ),
-                ],
-            )
+            let Some(form) = interpret_footage_form(s, proxy, &mut base) else { return false };
+            form
         }
+        "file.projectSettings" if p.as_object().is_none_or(|m| m.is_empty()) => project_settings_form(s),
         "layer.autoTrace" if !has(p, &["channel", "timeSpan", "threshold"]) => (
             "Auto-trace".into(),
             vec![
@@ -661,40 +761,14 @@ pub fn open_form(app: &mut EffectcraftApp, id: &str, p: &Value) -> bool {
         }
         // File ▸ Export ▸ Adobe Premiere Pro Project…: Final Cut Pro XML (or FCPXML / OTIO / EDL).
         "file.exportTimeline" if !has(p, &["path"]) => {
-            let name = s.active_comp_id().and_then(|c| s.project.item(c)).map(|i| i.name.clone()).unwrap_or_else(|| "Composition".into());
-            let dir = s.path.as_deref().and_then(|p| std::path::Path::new(p).parent()).map(|d| d.to_path_buf()).unwrap_or_default();
-            let path = dir.join(format!("{name}.xml")).to_string_lossy().to_string();
-            (
-                "Export Adobe Premiere Pro Project".into(),
-                vec![
-                    Field::note("note", "Writes Final Cut Pro XML (.xml), which Premiere Pro opens with File ▸ Import. Native .prproj files are not written."),
-                    Field::save_path("path", "File", &path),
-                    Field::choice(
-                        "format",
-                        "Format",
-                        &[
-                            ("Final Cut Pro XML (.xml) – Premiere Pro", json!("xml")),
-                            ("FCPXML (.fcpxml)", json!("fcpxml")),
-                            ("OpenTimelineIO (.otio)", json!("otio")),
-                            ("CMX 3600 EDL (.edl, V1 only)", json!("edl")),
-                            ("AAF (.aaf)", json!("aaf")),
-                            ("OMF (.omf, audio)", json!("omf")),
-                        ],
-                        0,
-                    ),
-                    Field::choice(
-                        "prerender",
-                        "Pre-render (ProRes 4444)",
-                        &[
-                            ("Layers Premiere can't show (text, shapes, effects…)", json!("unsupported")),
-                            ("All layers", json!("all")),
-                            ("None (leave them out)", json!("none")),
-                        ],
-                        0,
-                    ),
-                    Field::choice("precomps", "Precomps", &[("Nested sequences", json!("nest")), ("Pre-render", json!("prerender"))], 0),
-                ],
-            )
+            // Its pre-renders run as a job in Window ▸ Progress, not with the window waiting (#2269).
+            match base.as_object_mut() {
+                Some(m) => {
+                    m.insert("background".into(), json!(true));
+                }
+                None => base = json!({"background": true}),
+            }
+            export_timeline_form(s)
         }
         "file.importPlaceholder" | "file.replaceWithPlaceholder" if p.as_object().is_none_or(|m| m.is_empty()) => (
             "New Placeholder".into(),
@@ -823,12 +897,12 @@ fn form_grid(ui: &mut egui::Ui, f: &mut Form, regs: &mut Vec<(String, egui::Rect
                     .inner
                     .rect
                 }
-                FieldKind::Bool(b) => ui.checkbox(b, "").rect,
+                FieldKind::Bool(b) => crate::widgets::labelled_checkbox(ui, b, "").rect,
                 FieldKind::Choice { options, sel } => {
                     let cur = options.get(*sel).map(|o| o.0.clone()).unwrap_or_default();
                     // The column keeps its width: a long choice (a GPU adapter's name) ends in an
                     // ellipsis instead of widening the form past the dialog (#978).
-                    egui::ComboBox::from_id_salt(("form", fl.key.as_str()))
+                    craft_ui::ComboBox::from_id_salt(("form", fl.key.as_str()))
                         .selected_text(tr(&cur))
                         .width(240.0)
                         .truncate()
@@ -953,13 +1027,13 @@ pub fn show_view_options(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Toke
     let mut close = false;
     super::dialogs::modal(ctx, "View Options", vec2(360.0, 330.0), t, |ui| {
         let v = &mut app.ui.viewer;
-        ui.checkbox(&mut v.show_layer_controls, tr("Layer controls"));
-        ui.checkbox(&mut v.show_masks, tr("Masks"));
-        ui.checkbox(&mut v.rulers, tr("Rulers"));
-        ui.checkbox(&mut v.guides, tr("Guides"));
-        ui.checkbox(&mut v.grid, tr("Grid"));
-        ui.checkbox(&mut v.safe_margins, tr("Title/action safe"));
-        ui.checkbox(&mut v.transparency_grid, tr("Transparency grid"));
+        crate::widgets::labelled_checkbox(ui, &mut v.show_layer_controls, tr("Layer controls"));
+        crate::widgets::labelled_checkbox(ui, &mut v.show_masks, tr("Masks"));
+        crate::widgets::labelled_checkbox(ui, &mut v.rulers, tr("Rulers"));
+        crate::widgets::labelled_checkbox(ui, &mut v.guides, tr("Guides"));
+        crate::widgets::labelled_checkbox(ui, &mut v.grid, tr("Grid"));
+        crate::widgets::labelled_checkbox(ui, &mut v.safe_margins, tr("Title/action safe"));
+        crate::widgets::labelled_checkbox(ui, &mut v.transparency_grid, tr("Transparency grid"));
         ui.add_space(12.0);
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             if ui.add(egui::Button::new(egui::RichText::new(tr("   OK   ")).color(Color32::WHITE)).fill(t.accent)).clicked() {
@@ -976,6 +1050,18 @@ pub fn show_view_options(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Toke
 mod tests {
     use super::*;
 
+    #[test]
+    fn renderer_form_keeps_descriptive_labels_and_stable_option_values() {
+        crate::i18n::set_current("en");
+        let (_, fields) = project_settings_form(&effectcraft_engine::Session::default());
+        let renderer = fields.iter().find(|field| field.key == "renderer").unwrap();
+        let FieldKind::Choice { options, .. } = &renderer.kind else { panic!("renderer must be a choice") };
+        assert_eq!(
+            options.as_slice(),
+            &[("GPU Acceleration (no GPU: software)".to_string(), json!("gpu")), ("Software Rendering".to_string(), json!("software"))]
+        );
+    }
+
     #[test]
     fn form_params_build_arrays_and_choices() {
         let f = Form {
@@ -1052,8 +1138,108 @@ mod tests {
         let params = app.dialog_state.form.params();
         assert!(params.get("note").is_none());
         assert_eq!(params["format"], "xml");
-        let r = app.session.execute("file.exportTimeline", params).unwrap();
-        assert_eq!(r["path"], path.as_str());
+        assert_eq!(params["background"], true, "the dialog exports in the background");
+        assert!(app.session.execute("file.exportTimeline", params).unwrap()["job"].is_string());
+        app.session.wait_jobs();
+        let done = app.session.job_log.last().unwrap();
+        assert_eq!((done.status.as_str(), &done.result["path"]), ("done", &json!(path)));
         assert!(std::fs::read_to_string(&path).unwrap().contains("<xmeml"));
     }
+
+    #[test]
+    fn interpretation_menu_applies_explicit_cineon_parameters_without_a_dialog() {
+        use effectcraft_engine::project::{Footage, FootageKind, ItemKind, Proxy};
+        for command in ["file.interpretFootage", "file.interpretProxy"] {
+            let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+            let footage = Footage { path: "/m/scan.dpx".into(), kind: FootageKind::Still, width: 4, height: 4, has_video: true, ..Default::default() };
+            let project = std::sync::Arc::make_mut(&mut app.session.project);
+            let item = project.add_item("scan.dpx", Default::default(), None, ItemKind::Footage(footage.clone()));
+            project.item_mut(item).unwrap().proxy = Some(Box::new(Proxy { footage, enabled: true }));
+            app.session.state.project_selection = vec![item];
+            let ctx = egui::Context::default();
+            for params in [
+                json!({"logConversion": true}),
+                json!({"cineonUnits": "10bit"}),
+                json!({"pointUnits": "10bit"}),
+                json!({"convertedBlack": 10.0}),
+                json!({"convertedWhite": 900.0}),
+                json!({"tenBitBlack": 90.0}),
+                json!({"tenBitWhite": 690.0}),
+                json!({"currentGamma": 2.2}),
+                json!({"highlightRolloff": 30.0}),
+            ] {
+                crate::menus::invoke(&mut app, &ctx, command, params.clone()).unwrap();
+                assert!(app.dialog.is_none(), "{command}: {params}");
+            }
+            let item = app.session.project.item(item).unwrap();
+            let footage = if command == "file.interpretProxy" {
+                &item.proxy.as_ref().unwrap().footage
+            } else {
+                let ItemKind::Footage(footage) = &item.kind else { panic!("not footage") };
+                footage
+            };
+            assert!(footage.cineon.log_conversion);
+            assert_eq!(footage.cineon.gamma, 2.2);
+            assert_eq!(footage.cineon.converted_white, 900.0);
+        }
+    }
+
+    /// Interpret Footage on an image sequence with a gap says the previous frame is held there
+    /// (what the media pool shows), not colour bars.
+    #[test]
+    fn interpret_footage_says_a_sequence_gap_holds_the_previous_frame() {
+        use effectcraft_engine::project::{Footage, FootageKind, ItemKind};
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let sequence: Vec<String> = ["/m/a_001.png", "/m/a_002.png", "/m/a_005.png"].map(String::from).to_vec();
+        let footage = Footage { path: sequence[0].clone(), kind: FootageKind::Sequence, sequence, width: 4, height: 4, has_video: true, ..Default::default() };
+        let project = std::sync::Arc::make_mut(&mut app.session.project);
+        let item = project.add_item("a_[001-005].png", Default::default(), None, ItemKind::Footage(footage));
+        app.session.state.project_selection = vec![item];
+        assert!(open_form(&mut app, "file.interpretFootage", &json!({})));
+        let note = app.dialog_state.form.fields.iter().find(|f| f.key == "sequenceInfo").map(|f| f.kind.clone());
+        let Some(FieldKind::Note(text)) = note else { panic!("no sequence note: {note:?}") };
+        assert!(text.contains("2 missing frames (3–4)") && text.contains("the previous frame is held"), "{text}");
+        assert!(!text.contains("color bars"), "{text}");
+    }
+
+    /// Interpret Footage shows Cineon Settings for DPX footage only. The converted points show in
+    /// the footage's Units, and choosing other Units reads the shown values in the old ones.
+    #[test]
+    fn interpret_footage_shows_cineon_settings_for_dpx() {
+        use effectcraft_engine::project::{CineonUnits, Footage, FootageKind, ItemKind};
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let still =
+            |path: &str| ItemKind::Footage(Footage { path: path.into(), kind: FootageKind::Still, width: 4, height: 4, has_video: true, ..Default::default() });
+        let project = std::sync::Arc::make_mut(&mut app.session.project);
+        let dpx = project.add_item("scan.dpx", Default::default(), None, still("/m/scan.dpx"));
+        let png = project.add_item("still.png", Default::default(), None, still("/m/still.png"));
+        let keys = |app: &EffectcraftApp| app.dialog_state.form.fields.iter().map(|f| f.key.clone()).collect::<Vec<_>>();
+        app.session.state.project_selection = vec![png];
+        assert!(open_form(&mut app, "file.interpretFootage", &json!({})));
+        assert!(!keys(&app).iter().any(|k| k == "logConversion"), "{:?}", keys(&app));
+        app.session.state.project_selection = vec![dpx];
+        assert!(open_form(&mut app, "file.interpretFootage", &json!({})));
+        for k in ["logConversion", "convertedBlack", "convertedWhite", "tenBitBlack", "tenBitWhite", "currentGamma", "highlightRolloff", "cineonUnits"] {
+            assert!(keys(&app).iter().any(|x| x == k), "{k}: {:?}", keys(&app));
+        }
+        // Units ▸ 8-bit with Converted White Point still showing 1023 (10-bit).
+        let form = &mut app.dialog_state.form;
+        for f in form.fields.iter_mut() {
+            match (f.key.as_str(), &mut f.kind) {
+                ("cineonUnits", FieldKind::Choice { sel, .. }) => *sel = 1,
+                ("logConversion", FieldKind::Bool(b)) => *b = true,
+                _ => {}
+            }
+        }
+        let params = form.params();
+        assert_eq!((params["pointUnits"].as_str(), params["cineonUnits"].as_str()), (Some("10bit"), Some("8bit")), "{params}");
+        app.session.execute("file.interpretFootage", params).unwrap();
+        let Some(ItemKind::Footage(f)) = app.session.project.item(dpx).map(|i| &i.kind) else { panic!("not footage") };
+        assert!(f.cineon.log_conversion && f.cineon.units == CineonUnits::EightBit, "{:?}", f.cineon);
+        assert!((f.cineon.converted_white - 1023.0).abs() < 1e-3, "{:?}", f.cineon);
+        // Opened again, the point shows in 8-bit units.
+        assert!(open_form(&mut app, "file.interpretFootage", &json!({})));
+        let white = app.dialog_state.form.fields.iter().find(|f| f.key == "convertedWhite").map(|f| f.kind.clone());
+        assert!(matches!(white, Some(FieldKind::Number { value, .. }) if (value - 255.0).abs() < 1e-6), "{white:?}");
+    }
 }
diff --git a/crates/ui-egui/src/panels/fx_editors.rs b/crates/ui-egui/src/panels/fx_editors.rs
index 1ae74caa2..45dbcb1d7 100644
--- a/crates/ui-egui/src/panels/fx_editors.rs
+++ b/crates/ui-egui/src/panels/fx_editors.rs
@@ -39,6 +39,7 @@ pub const COLORAMA: &str = "ec.color.colorama";
 pub const GLOW: &str = "ec.stylize.glow";
 pub const RESHAPE: &str = "ec.distort.reshape";
 pub const EXTRACTOR: &str = "ec.3d.extractor";
+pub const CRYPTOMATTE: &str = "ec.3d.cryptomatte";
 pub const MESH_WARP: &str = "ec.distort.meshwarp";
 
 fn str_value(layer: &Layer, ectx: &EvalCtx, g: &PropGroup, id: &str) -> String {
@@ -66,24 +67,14 @@ fn register_points(app: &mut EffectcraftApp, prefix: &str, gr: Rect, pts: &[[f32
 }
 
 /// Small coloured tabs (`names[i]`, swatch `cols[i]`); returns the clicked one.
-fn tabs(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    x0: f32,
-    cy: f32,
-    cur: usize,
-    names: &[&str],
-    cols: &[Color32],
-    id: &str,
-) -> Option<usize> {
+fn tabs(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, at: Pos2, cur: usize, (names, cols): (&[&str], &[Color32]), id: &str) -> Option<usize> {
     let t = app.tokens;
-    let mut x = x0;
+    let (mut x, cy) = (at.x, at.y);
     let mut out = None;
     for (i, name) in names.iter().enumerate() {
         let w = if cols.is_empty() { 16.0 + name.chars().count() as f32 * 6.2 } else { 20.0 };
         let r = Rect::from_min_size(pos2(x, cy - 9.0), vec2(w, 18.0));
-        let resp = ui.interact(r, egui::Id::new((id, i)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique((id, i)), Sense::click());
         let sel = i == cur;
         if sel {
             p.rect_filled(r, 3.0, t.row_selected);
@@ -111,9 +102,11 @@ fn tabs(
     out
 }
 
+/// A small "Reset" link centred in `r`, registered under the automation id `id`; returns whether
+/// it was clicked.
 fn reset_link(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, r: Rect, id: &str) -> bool {
     let t = app.tokens;
-    let resp = ui.interact(r, egui::Id::new(id), Sense::click());
+    let resp = ui.interact(r, egui::Id::unique(id), Sense::click());
     p.text(r.center(), Align2::CENTER_CENTER, tr("Reset"), Tokens::ui(11.5), if resp.hovered() { t.hot_text } else { t.text_dim });
     app.auto.add(id, r, "Reset");
     resp.clicked()
@@ -162,6 +155,10 @@ pub fn inline_editor(
 
 const RGB_CURVES: [(&str, &str); 4] = [("master", "Master"), ("red", "Red"), ("green", "Green"), ("blue", "Blue")];
 
+/// The Lumetri RGB Curves editor for effect group `g`: channel tabs (Master, Red, Green, Blue),
+/// the selected channel's curve graph with its Reset, and the point positions registered for
+/// automation. A curve edit or Reset is queued on `actions` as a `prop.set` of that channel's
+/// curve string; the visible channel is remembered in `app.ui.fx_curve_channel` per group.
 #[allow(clippy::too_many_arguments)]
 fn rgb_curves(
     app: &mut EffectcraftApp,
@@ -182,7 +179,7 @@ fn rgb_curves(
     let cy = r.min.y + 15.0;
     let cols = [Color32::from_gray(0xe8), Color32::from_rgb(0xf0, 0x50, 0x50), Color32::from_rgb(0x50, 0xd0, 0x60), Color32::from_rgb(0x50, 0x80, 0xff)];
     let names: Vec<&str> = RGB_CURVES.iter().map(|c| c.1).collect();
-    if let Some(n) = tabs(app, ui, p, x0, cy, ch, &names, &cols, &format!("{prefix}.channel")) {
+    if let Some(n) = tabs(app, ui, p, pos2(x0, cy), ch, (&names, &cols), &format!("{prefix}.channel")) {
         app.ui.fx_curve_channel.insert(g.uid, n);
     }
     let id = RGB_CURVES[ch].0;
@@ -192,8 +189,8 @@ fn rgb_curves(
         set_str(actions, layer, g, id, fw::CurvePoints::identity().format(), None);
     }
     let gr = Rect::from_min_size(pos2(x0, r.min.y + 30.0), vec2(size, size));
-    let gid = egui::Id::new(("lumetri-rgb", euid, ch));
-    let (resp, edit) = fw::curves_graph(ui, gr, &cur, ch, false, gid, &t);
+    let gid = egui::Id::unique(("lumetri-rgb", euid, ch));
+    let (resp, edit) = fw::curves_graph(ui, gr, &cur, ch, fw::CurveMode { pencil: false, natural: false }, gid, &t);
     app.auto.add(&format!("{prefix}.graph"), gr, "RGB Curves");
     register_points(app, &prefix, gr, &cur.0);
     let key = gesture_key(ui, gid, resp.drag_started() || resp.clicked());
@@ -269,6 +266,11 @@ fn hue_color(h: f32) -> Color32 {
     Color32::from(c)
 }
 
+/// The Lumetri Hue/Saturation Curves editor for effect group `g`: tabs for the Hue vs Sat,
+/// Hue vs Hue, Hue vs Luma, Luma vs Sat and Sat vs Sat curves, drawn as a neutral-relative offset
+/// curve over the axis' colour band, with point drag/add/remove gestures and a Reset. Changes are
+/// queued on `actions` as a `prop.set` of the selected curve's point list; the visible tab is kept
+/// in `app.ui.fx_curve_channel` per group.
 #[allow(clippy::too_many_arguments)]
 fn huesat_curves(
     app: &mut EffectcraftApp,
@@ -288,7 +290,7 @@ fn huesat_curves(
     let x0 = r.min.x + 38.0;
     let cy = r.min.y + 15.0;
     let names: Vec<&str> = HUESAT.iter().map(|c| c.1).collect();
-    if let Some(n) = tabs(app, ui, p, x0, cy, k, &names, &[], &format!("{prefix}.curve")) {
+    if let Some(n) = tabs(app, ui, p, pos2(x0, cy), k, (&names, &[]), &format!("{prefix}.curve")) {
         app.ui.fx_curve_channel.insert(g.uid, n);
     }
     let (id, name, axis, periodic) = HUESAT[k];
@@ -321,7 +323,7 @@ fn huesat_curves(
         })
         .collect();
     p.add(egui::Shape::line(line, Stroke::new(1.5, Color32::from_gray(0xe8))));
-    let gid = egui::Id::new(("lumetri-hs", euid, k));
+    let gid = egui::Id::unique(("lumetri-hs", euid, k));
     let resp = ui.interact(gr.expand(6.0), gid, Sense::click_and_drag());
     app.auto.add(&format!("{prefix}.graph"), gr, name);
     let drag_id = gid.with("drag");
@@ -441,6 +443,12 @@ fn wheel_point(c: Pos2, radius: f32, phase: f32) -> Pos2 {
     pos2(c.x + radius * a.sin(), c.y - radius * a.cos())
 }
 
+/// Colorama's Output Cycle wheel for effect group `g`: the palette drawn as a ring with its stops.
+/// Clicking the ring adds a stop with the colour there, dragging moves one, and Alt-clicking or
+/// dragging one off removes it while another stop remains; the selected stop's colour can be
+/// edited below. A change queues
+/// the rewritten palette on `actions`, and for a preset palette also switches the effect to the
+/// custom palette in the same undo step.
 #[allow(clippy::too_many_arguments)]
 fn colorama_wheel(
     app: &mut EffectcraftApp,
@@ -476,7 +484,7 @@ fn colorama_wheel(
     }
     p.circle_stroke(c, outer, Stroke::new(1.0, Color32::from_black_alpha(160)));
     p.circle_stroke(c, inner, Stroke::new(1.0, Color32::from_black_alpha(160)));
-    let wid = egui::Id::new(("colorama-wheel", euid));
+    let wid = egui::Id::unique(("colorama-wheel", euid));
     let ring = Rect::from_center_size(c, vec2(outer * 2.0 + 40.0, outer * 2.0 + 40.0));
     let resp = ui.interact(ring, wid, Sense::click_and_drag());
     app.auto.add(&format!("{prefix}.wheel"), ring, "Output Cycle");
@@ -593,7 +601,7 @@ fn colorama_wheel(
     p.text(
         pos2(sr.min.x, sr.max.y + 9.0),
         Align2::LEFT_CENTER,
-        "Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it",
+        crate::i18n::tr("Click the ring to add a colour; Alt-click a stop (or drag it off) to remove it"),
         Tokens::ui(10.5),
         t.text_faint,
     );
@@ -657,6 +665,10 @@ pub fn join_map(m: &[fw::CurvePoints; 3]) -> String {
     m.iter().map(|c| c.format()).collect::<Vec<_>>().join(" | ")
 }
 
+/// Glow's Colour Map for effect group `g`: a strip showing the gradient the glow uses (A/B colours,
+/// or the arbitrary map sampled through the loop settings). In arbitrary-map mode it also draws the
+/// RGB curve tabs and the selected channel's graph with a Reset; edits queue a `prop.set` of
+/// `arbitraryMap` on `actions`.
 #[allow(clippy::too_many_arguments)]
 fn glow_map(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, g: &PropGroup, ectx: &EvalCtx, r: Rect, actions: &mut Actions) {
     let t = app.tokens;
@@ -703,7 +715,7 @@ fn glow_map(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, laye
     }
     let ch = app.ui.fx_curve_channel.get(&euid).copied().unwrap_or(0).min(2);
     let cols = [Color32::from_rgb(0xf0, 0x50, 0x50), Color32::from_rgb(0x50, 0xd0, 0x60), Color32::from_rgb(0x50, 0x80, 0xff)];
-    if let Some(n) = tabs(app, ui, p, x0, r.min.y + 15.0, ch, &["Red", "Green", "Blue"], &cols, &format!("{prefix}.channel")) {
+    if let Some(n) = tabs(app, ui, p, pos2(x0, r.min.y + 15.0), ch, (&["Red", "Green", "Blue"], &cols), &format!("{prefix}.channel")) {
         app.ui.fx_curve_channel.insert(euid, n);
     }
     if reset_link(app, ui, p, Rect::from_min_size(pos2(x0 + size - 44.0, r.min.y + 6.0), vec2(44.0, 18.0)), &format!("{prefix}.reset")) {
@@ -712,8 +724,8 @@ fn glow_map(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, laye
         set_str(actions, layer, g, "arbitraryMap", join_map(&m), None);
     }
     let gr = Rect::from_min_size(pos2(x0, r.min.y + 30.0), vec2(size, size));
-    let gid = egui::Id::new(("glow-map", euid, ch));
-    let (resp, edit) = fw::curves_graph(ui, gr, &map[ch], ch + 1, false, gid, &t);
+    let gid = egui::Id::unique(("glow-map", euid, ch));
+    let (resp, edit) = fw::curves_graph(ui, gr, &map[ch], ch + 1, fw::CurveMode { pencil: false, natural: false }, gid, &t);
     app.auto.add(&format!("{prefix}.graph"), gr, "Arbitrary Map");
     register_points(app, &prefix, gr, &map[ch].0);
     let key = gesture_key(ui, gid, resp.drag_started() || resp.clicked());
@@ -769,6 +781,10 @@ pub fn add_pair(v: &[(f64, f64)]) -> (f64, f64) {
     ((a.0 + ds * 0.5).rem_euclid(1.0), (a.1 + gap * 0.5).rem_euclid(1.0))
 }
 
+/// Reshape's correspondence buttons: Add Point appends a pair at the widest destination-fraction
+/// gap (or `(0, 0)` for an empty list), Remove Point drops the last stored pair, and Clear removes
+/// all pairs. A status line says whether points are automatic. Each change
+/// queues a `prop.set` of the `correspondencePoints` string on `actions`.
 #[allow(clippy::too_many_arguments)]
 fn reshape_buttons(
     app: &mut EffectcraftApp,
@@ -786,19 +802,19 @@ fn reshape_buttons(
     let b1 = Rect::from_min_size(pos2(r.min.x + 24.0, r.min.y + 4.0), vec2(84.0, 22.0));
     let b2 = Rect::from_min_size(pos2(b1.max.x + 8.0, b1.min.y), vec2(96.0, 22.0));
     let b3 = Rect::from_min_size(pos2(b2.max.x + 8.0, b1.min.y), vec2(56.0, 22.0));
-    if widgets::text_button(ui, b1, "Add Point", false, &t, egui::Id::new(("reshape-add", euid))).clicked() {
+    if widgets::text_button(ui, b1, crate::i18n::tr("Add Point"), false, &t, egui::Id::unique(("reshape-add", euid))).clicked() {
         let mut v = pairs.clone();
         v.push(add_pair(&pairs));
         set_str(actions, layer, g, "correspondencePoints", format_pairs(&v), None);
     }
     app.auto.add(&format!("effectControls.effect.{euid}.reshape.add"), b1, "Add Point");
-    if widgets::text_button(ui, b2, "Remove Point", false, &t, egui::Id::new(("reshape-remove", euid))).clicked() && !pairs.is_empty() {
+    if widgets::text_button(ui, b2, crate::i18n::tr("Remove Point"), false, &t, egui::Id::unique(("reshape-remove", euid))).clicked() && !pairs.is_empty() {
         let mut v = pairs.clone();
         v.pop();
         set_str(actions, layer, g, "correspondencePoints", format_pairs(&v), None);
     }
     app.auto.add(&format!("effectControls.effect.{euid}.reshape.remove"), b2, "Remove Point");
-    if widgets::text_button(ui, b3, "Clear", false, &t, egui::Id::new(("reshape-clear", euid))).clicked() && !pairs.is_empty() {
+    if widgets::text_button(ui, b3, crate::i18n::tr("Clear"), false, &t, egui::Id::unique(("reshape-clear", euid))).clicked() && !pairs.is_empty() {
         set_str(actions, layer, g, "correspondencePoints", String::new(), None);
     }
     app.auto.add(&format!("effectControls.effect.{euid}.reshape.clear"), b3, "Clear");
@@ -823,6 +839,17 @@ pub fn is_extractor_channel(g: &PropGroup, prop: &effectcraft_engine::project::P
     matches!(&g.kind, GroupKind::Effect { effect } if effect == EXTRACTOR) && EXTRACTOR_CHANNELS.contains(&prop.match_id.as_str())
 }
 
+/// Whether `prop` (in group `g`) is the Cryptomatte effect's Layer.
+pub fn is_crypto_layer(g: &PropGroup, prop: &effectcraft_engine::project::Property) -> bool {
+    matches!(&g.kind, GroupKind::Effect { effect } if effect == CRYPTOMATTE) && prop.match_id == "layer"
+}
+
+/// Whether `prop` is the Layer of a Cryptomatte effect on `layer` (the timeline finds it without
+/// its group).
+pub fn is_crypto_layer_of(layer: &Layer, prop: &effectcraft_engine::project::Property) -> bool {
+    layer.effects().is_some_and(|fx| fx.groups().any(|g| g.match_id == CRYPTOMATTE && g.get("layer").is_some_and(|q| q.uid == prop.uid)))
+}
+
 /// The OpenEXR layer EXtractoR's red, green and blue come from (`""`: the unnamed layer), or
 /// `None` when they mix layers.
 fn extractor_layer(vals: &[String; 4]) -> Option<&str> {
@@ -857,8 +884,8 @@ fn extractor_layers(
     p.text(pos2(r.min.x + 37.0, r.center().y), Align2::LEFT_CENTER, tr("Layer"), Tokens::ui(12.0), t.text);
     let vx = (r.min.x + r.width() * 0.48).max(r.min.x + 161.0);
     let dr = Rect::from_min_size(pos2(vx, r.center().y - 9.0), vec2((r.max.x - vx - 56.0).clamp(80.0, 200.0), 18.0));
-    let pop = egui::Id::new(("extractor-layers", euid));
-    if widgets::dropdown(ui, dr, &label, &t, egui::Id::new(("extractor-layer", euid)))
+    let pop = egui::Id::unique(("extractor-layers", euid));
+    if widgets::dropdown(ui, dr, &label, &t, egui::Id::unique(("extractor-layer", euid)))
         .on_hover_text(tr("The OpenEXR layer shown in red, green, blue and alpha"))
         .clicked()
     {
@@ -899,8 +926,8 @@ pub fn channel_popup(
     let t = app.tokens;
     let uid = prop.uid;
     let label = if cur.trim().is_empty() { NO_CHANNEL } else { cur };
-    let pop = egui::Id::new(("ec-chpop", uid));
-    if widgets::dropdown(ui, r, label, &t, egui::Id::new(("ec-ch", uid))).clicked() {
+    let pop = egui::Id::unique(("ec-chpop", uid));
+    if widgets::dropdown(ui, r, label, &t, egui::Id::unique(("ec-ch", uid))).clicked() {
         widgets::open_popup(ui, pop);
     }
     app.auto.add(&format!("effectControls.prop.{uid}.value"), r, &prop.name);
@@ -992,7 +1019,7 @@ pub fn reshape_overlay(
         painter.line_segment([ps, pd], Stroke::new(1.0, Color32::from_white_alpha(150)));
         for (end, s, col) in [(0usize, ps, ys), (1, pd, cs)] {
             let hr = Rect::from_center_size(s, vec2(12.0, 12.0));
-            let id = egui::Id::new(("reshape-pt", g.uid, i, end));
+            let id = egui::Id::unique(("reshape-pt", g.uid, i, end));
             let resp = ui.interact(hr, id, Sense::drag());
             let hot = resp.hovered() || resp.dragged();
             painter.rect_filled(Rect::from_center_size(s, vec2(7.0, 7.0)), 0.0, if hot { Color32::WHITE } else { col });
@@ -1086,7 +1113,7 @@ pub fn mesh_warp_overlay(
     let accent = app.tokens.accent;
     for (k, s) in screen.iter().enumerate() {
         let hr = Rect::from_center_size(*s, vec2(10.0, 10.0));
-        let id = egui::Id::new(("mesh-warp-vertex", g.uid, k));
+        let id = egui::Id::unique(("mesh-warp-vertex", g.uid, k));
         let resp = ui.interact(hr, id, Sense::drag());
         let hot = resp.hovered() || resp.dragged();
         let dot = Rect::from_center_size(*s, vec2(5.0, 5.0));
diff --git a/crates/ui-egui/src/panels/fx_widgets.rs b/crates/ui-egui/src/panels/fx_widgets.rs
index ca49c3fd0..b3140d394 100644
--- a/crates/ui-egui/src/panels/fx_widgets.rs
+++ b/crates/ui-egui/src/panels/fx_widgets.rs
@@ -59,7 +59,8 @@ pub fn angle_field(ui: &mut egui::Ui, at: Pos2, id: egui::Id, v: f64, decimals:
     let (rev, deg) = split_angle(v);
     let (rr, new_rev, _) = widgets::hot_int_at(ui, at, id.with("rev"), rev, 0.1, "x", t);
     let sign = ui.painter().text(pos2(rr.max.x - 2.0, rr.center().y), Align2::LEFT_CENTER, if deg < 0.0 { "-" } else { "+" }, Tokens::ui(12.0), t.hot_text);
-    let (dr, new_deg, _) = widgets::hot_number_at(ui, pos2(sign.max.x - 2.0, at.y), id, deg.abs(), 0.5, (-1e9, 1e9), decimals, "°", t);
+    let (dr, new_deg, _) =
+        widgets::hot_number_at(ui, pos2(sign.max.x - 2.0, at.y), id, deg.abs(), &widgets::HotSpec { speed: 0.5, range: (-1e9, 1e9), decimals, suffix: "°" }, t);
     let dragging = new_deg.is_some() && ui.ctx().is_being_dragged(id);
     let out = match (new_rev, new_deg) {
         (Some(r), _) => Some(r as f64 * 360.0 + deg),
@@ -171,12 +172,7 @@ pub fn eyedropper_button(ui: &mut egui::Ui, rect: Rect, active: bool, id: egui::
     } else {
         t.text_dim
     };
-    // A pipette: a diagonal glass tube with a bulb at the top right and a tip at the bottom left.
-    let r = rect.shrink(rect.width() * 0.2);
-    let at = |x: f32, y: f32| pos2(r.min.x + x * r.width(), r.min.y + y * r.height());
-    p.line_segment([at(0.08, 0.92), at(0.62, 0.38)], Stroke::new(2.2, col));
-    p.circle_filled(at(0.76, 0.24), r.width() * 0.2, col);
-    p.line_segment([at(0.5, 0.3), at(0.7, 0.5)], Stroke::new(1.4, col));
+    crate::color_picker::draw_pipette(p, rect, col);
     resp
 }
 
@@ -200,14 +196,21 @@ pub fn layer_to_comp(l2c: &Mat3, p: [f64; 2]) -> [f64; 2] {
 /// `region` ([x, y, w, h] in comp pixels: the whole comp, or the region of interest or Extended
 /// Viewer area it was rendered for), maybe at a reduced resolution. `None` outside it.
 pub fn frame_pixel(img: &egui::ColorImage, region: [f64; 4], pt: [f64; 2]) -> Option<Color32> {
+    img.pixels.get(frame_pixel_index(img.size, region, pt)?).copied()
+}
+
+pub(crate) fn frame_pixel_index(size: [usize; 2], region: [f64; 4], pt: [f64; 2]) -> Option<usize> {
+    if size.contains(&0) {
+        return None;
+    }
     let [x, y, w, h] = region;
     let (fx, fy) = ((pt[0] - x) / w, (pt[1] - y) / h);
     if !(0.0..1.0).contains(&fx) || !(0.0..1.0).contains(&fy) {
         return None;
     }
-    let sx = ((fx * img.size[0] as f64).floor() as usize).min(img.size[0].saturating_sub(1));
-    let sy = ((fy * img.size[1] as f64).floor() as usize).min(img.size[1].saturating_sub(1));
-    img.pixels.get(sy.checked_mul(img.size[0])?.checked_add(sx)?).copied()
+    let sx = ((fx * size[0] as f64).floor() as usize).min(size[0].saturating_sub(1));
+    let sy = ((fy * size[1] as f64).floor() as usize).min(size[1].saturating_sub(1));
+    sy.checked_mul(size[0])?.checked_add(sx)
 }
 
 /// Straight RGBA (0..1) of the displayed frame at comp point `pt` ([`frame_pixel`]).
@@ -291,7 +294,8 @@ impl CurvePoints {
     pub fn hit(&self, x: f32, y: f32, r: f32) -> Option<usize> {
         self.0.iter().enumerate().map(|(i, p)| (i, (p[0] - x).hypot(p[1] - y))).filter(|(_, d)| *d <= r).min_by(|a, b| a.1.total_cmp(&b.1)).map(|(i, _)| i)
     }
-    /// The curve the effect renders (the same monotone spline), evaluated at `x`.
+    /// The monotone spline (`Curve::parse`) through the points, evaluated at `x`: the curve
+    /// Lumetri's RGB curves and Glow's arbitrary map render.
     pub fn eval(&self, x: f32) -> f32 {
         effectcraft_engine::effects::Curve::parse(&self.format()).map(|c| c.eval(x)).unwrap_or(x)
     }
@@ -324,13 +328,56 @@ pub struct CurveEdit {
     pub done: bool,
 }
 
+/// How the Curves graph takes input: `pencil` draws freehand, `natural` picks the natural spline.
+#[derive(Clone, Copy)]
+pub struct CurveMode {
+    pub pencil: bool,
+    pub natural: bool,
+}
+
 /// The Curves graph: grid, identity diagonal, the curve, its points. Click adds a point, drag
 /// moves one, dragging a point off the graph (or Alt-clicking it) removes it. In pencil mode a
-/// drag draws the curve freehand.
-pub fn curves_graph(ui: &mut egui::Ui, rect: Rect, pts: &CurvePoints, channel: usize, pencil: bool, id: egui::Id, t: &Tokens) -> (egui::Response, CurveEdit) {
+/// drag draws the curve freehand. `mode.natural` draws the natural spline the Curves effect
+/// renders (`Curve::parse_natural`) instead of the monotone one.
+pub fn curves_graph(
+    ui: &mut egui::Ui,
+    rect: Rect,
+    pts: &CurvePoints,
+    channel: usize,
+    mode: CurveMode,
+    id: egui::Id,
+    t: &Tokens,
+) -> (egui::Response, CurveEdit) {
     let resp = ui.interact(rect.expand(6.0), id, Sense::click_and_drag());
     let p = ui.painter().with_clip_rect(rect.expand(8.0));
     p.rect_filled(rect, 0.0, Color32::from_rgb(0x1c, 0x1c, 0x1c));
+    draw_curve_grid(&p, rect, t);
+    let col = curve_channel_color(channel);
+    let spline =
+        if mode.natural { effectcraft_engine::effects::Curve::parse_natural(&pts.format()) } else { effectcraft_engine::effects::Curve::parse(&pts.format()) };
+    let eval = |x: f32| spline.as_ref().map(|c| c.eval(x)).unwrap_or(x);
+    let line: Vec<Pos2> = (0..=96)
+        .map(|i| {
+            let x = i as f32 / 96.0;
+            curve_to_screen(rect, x, eval(x).clamp(0.0, 1.0))
+        })
+        .collect();
+    p.add(egui::Shape::line(line, Stroke::new(1.5, col)));
+    let drag_id = id.with("drag");
+    let dragging: Option<usize> = ui.data(|d| d.get_temp(drag_id));
+    draw_curve_points(&p, rect, pts, col, dragging);
+    if mode.pencil {
+        let edit = curve_pencil(ui, &resp, rect, id, &eval);
+        return (resp, edit);
+    }
+    let mut edit = CurveEdit::default();
+    curve_drag(ui, &resp, rect, pts, drag_id, dragging, &mut edit);
+    let alt = ui.input(|i| i.modifiers.alt);
+    curve_click(&resp, rect, pts, alt, &mut edit);
+    (resp, edit)
+}
+
+fn draw_curve_grid(p: &egui::Painter, rect: Rect, t: &Tokens) {
     for k in 1..4 {
         let f = k as f32 / 4.0;
         let x = rect.min.x + rect.width() * f;
@@ -340,28 +387,29 @@ pub fn curves_graph(ui: &mut egui::Ui, rect: Rect, pts: &CurvePoints, channel: u
     }
     p.line_segment([rect.left_bottom(), rect.right_top()], Stroke::new(1.0, Color32::from_white_alpha(40)));
     p.rect_stroke(rect, 0.0, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
-    let col = match channel {
+}
+
+fn curve_channel_color(channel: usize) -> Color32 {
+    match channel {
         1 => Color32::from_rgb(0xf0, 0x60, 0x60),
         2 => Color32::from_rgb(0x60, 0xe0, 0x70),
         3 => Color32::from_rgb(0x60, 0x90, 0xff),
         4 => Color32::from_gray(0xb0),
         _ => Color32::from_gray(0xe8),
-    };
-    let to_s = |x: f32, y: f32| pos2(rect.min.x + x * rect.width(), rect.max.y - y * rect.height());
-    let to_g = |s: Pos2| [((s.x - rect.min.x) / rect.width()), ((rect.max.y - s.y) / rect.height())];
-    let spline = effectcraft_engine::effects::Curve::parse(&pts.format());
-    let line: Vec<Pos2> = (0..=96)
-        .map(|i| {
-            let x = i as f32 / 96.0;
-            to_s(x, spline.as_ref().map(|c| c.eval(x)).unwrap_or(x).clamp(0.0, 1.0))
-        })
-        .collect();
-    p.add(egui::Shape::line(line, Stroke::new(1.5, col)));
-    let drag_id = id.with("drag");
-    let pencil_id = id.with("pencil");
-    let dragging: Option<usize> = ui.data(|d| d.get_temp(drag_id));
+    }
+}
+
+fn curve_to_screen(rect: Rect, x: f32, y: f32) -> Pos2 {
+    pos2(rect.min.x + x * rect.width(), rect.max.y - y * rect.height())
+}
+
+fn screen_to_curve(rect: Rect, s: Pos2) -> [f32; 2] {
+    [((s.x - rect.min.x) / rect.width()), ((rect.max.y - s.y) / rect.height())]
+}
+
+fn draw_curve_points(p: &egui::Painter, rect: Rect, pts: &CurvePoints, col: Color32, dragging: Option<usize>) {
     for (i, q) in pts.0.iter().enumerate() {
-        let s = to_s(q[0], q[1]);
+        let s = curve_to_screen(rect, q[0], q[1]);
         let r = Rect::from_center_size(s, vec2(7.0, 7.0));
         if dragging == Some(i) {
             p.rect_filled(r, 0.0, col);
@@ -370,33 +418,41 @@ pub fn curves_graph(ui: &mut egui::Ui, rect: Rect, pts: &CurvePoints, channel: u
             p.rect_stroke(r, 0.0, Stroke::new(1.2, col), StrokeKind::Inside);
         }
     }
+}
+
+/// Pencil mode: a drag overwrites the sampled curve under the pointer.
+fn curve_pencil(ui: &mut egui::Ui, resp: &egui::Response, rect: Rect, id: egui::Id, eval: &dyn Fn(f32) -> f32) -> CurveEdit {
+    let pencil_id = id.with("pencil");
+    let seed = || (0..=64).map(|i| eval(i as f32 / 64.0)).collect::<Vec<f32>>();
     let mut edit = CurveEdit::default();
-    let hit_r = 7.0 / rect.width();
-    let alt = ui.input(|i| i.modifiers.alt);
-    if pencil {
-        if resp.drag_started() {
-            ui.data_mut(|d| d.insert_temp(pencil_id, (0..=64).map(|i| pts.eval(i as f32 / 64.0)).collect::<Vec<f32>>()));
-        }
-        if (resp.dragged() || resp.clicked())
-            && let Some(pt) = resp.interact_pointer_pos()
-        {
-            let mut samples: Vec<f32> = ui.data(|d| d.get_temp(pencil_id)).unwrap_or_else(|| (0..=64).map(|i| pts.eval(i as f32 / 64.0)).collect());
-            let g = to_g(pt);
-            let i = (g[0].clamp(0.0, 1.0) * 64.0).round() as usize;
-            samples[i.min(64)] = g[1].clamp(0.0, 1.0);
-            ui.data_mut(|d| d.insert_temp(pencil_id, samples.clone()));
-            edit.changed = Some(CurvePoints::from_samples(&samples));
-        }
-        if resp.drag_stopped() {
-            ui.data_mut(|d| d.remove::<Vec<f32>>(pencil_id));
-            edit.done = true;
-        }
-        return (resp, edit);
+    if resp.drag_started() {
+        ui.data_mut(|d| d.insert_temp(pencil_id, seed()));
     }
+    if (resp.dragged() || resp.clicked())
+        && let Some(pt) = resp.interact_pointer_pos()
+    {
+        let mut samples: Vec<f32> = ui.data(|d| d.get_temp(pencil_id)).unwrap_or_else(seed);
+        let g = screen_to_curve(rect, pt);
+        let i = (g[0].clamp(0.0, 1.0) * 64.0).round() as usize;
+        samples[i.min(64)] = g[1].clamp(0.0, 1.0);
+        ui.data_mut(|d| d.insert_temp(pencil_id, samples.clone()));
+        edit.changed = Some(CurvePoints::from_samples(&samples));
+    }
+    if resp.drag_stopped() {
+        ui.data_mut(|d| d.remove::<Vec<f32>>(pencil_id));
+        edit.done = true;
+    }
+    edit
+}
+
+/// Drag a point to move it, or drag from empty space to insert one; dropping a point well off
+/// the graph removes it.
+fn curve_drag(ui: &mut egui::Ui, resp: &egui::Response, rect: Rect, pts: &CurvePoints, drag_id: egui::Id, dragging: Option<usize>, edit: &mut CurveEdit) {
+    let hit_r = 7.0 / rect.width();
     if resp.drag_started()
         && let Some(pt) = ui.input(|i| i.pointer.press_origin())
     {
-        let g = to_g(pt);
+        let g = screen_to_curve(rect, pt);
         let i = match pts.hit(g[0], g[1], hit_r) {
             Some(i) => i,
             None => {
@@ -410,7 +466,7 @@ pub fn curves_graph(ui: &mut egui::Ui, rect: Rect, pts: &CurvePoints, channel: u
     } else if resp.dragged()
         && let (Some(i), Some(pt)) = (dragging, resp.interact_pointer_pos())
     {
-        let g = to_g(pt);
+        let g = screen_to_curve(rect, pt);
         let mut np = pts.clone();
         np.move_point(i, g[0], g[1]);
         if np != *pts {
@@ -429,10 +485,15 @@ pub fn curves_graph(ui: &mut egui::Ui, rect: Rect, pts: &CurvePoints, channel: u
         ui.data_mut(|d| d.remove::<usize>(drag_id));
         edit.done = true;
     }
+}
+
+/// A click adds a point on empty space; Alt-clicking a point removes it.
+fn curve_click(resp: &egui::Response, rect: Rect, pts: &CurvePoints, alt: bool, edit: &mut CurveEdit) {
     if resp.clicked()
         && let Some(pt) = resp.interact_pointer_pos()
     {
-        let g = to_g(pt);
+        let g = screen_to_curve(rect, pt);
+        let hit_r = 7.0 / rect.width();
         let mut np = pts.clone();
         match pts.hit(g[0], g[1], hit_r) {
             Some(i) if alt => {
@@ -448,7 +509,6 @@ pub fn curves_graph(ui: &mut egui::Ui, rect: Rect, pts: &CurvePoints, channel: u
         }
         edit.done = true;
     }
-    (resp, edit)
 }
 
 // ---------------------------------------------------------------------------------------------
diff --git a/crates/ui-egui/src/panels/gradient_editor.rs b/crates/ui-egui/src/panels/gradient_editor.rs
index bb6923025..0f0bbe412 100644
--- a/crates/ui-egui/src/panels/gradient_editor.rs
+++ b/crates/ui-egui/src/panels/gradient_editor.rs
@@ -3,14 +3,18 @@
 //! Opacity stops sit above the preview bar and colour stops below it. Click above or below the
 //! bar to add a stop (it takes that track's value there), drag a stop to move it, edit the
 //! selected stop's location, opacity or colour, and Delete removes it (never the last stop of a
-//! track). The editor works on a draft: OK sets the property once with `prop.set` at the time it
-//! opened (one undo step, nothing at all when nothing changed); Cancel and Escape leave it as it
-//! was.
+//! track). The editor works on a draft. With **Preview** on (the default, as in After Effects) each
+//! edit is applied to the property at once, with `prop.set` at the time the editor opened and one
+//! merged undo step, so the canvas shows the gradient as it is edited; OK keeps it, Cancel and
+//! Escape roll it back to the checkpoint taken when the editor opened. With Preview off, OK sets
+//! the property once (one undo step, nothing at all when nothing changed). The dialog opens at
+//! the lower right of the window and does not dim it, so the canvas stays in view.
 //!
 //! Automation ids: `dialog.gradient.bar`, `dialog.gradient.addOpacity`, `dialog.gradient.addColor`,
 //! `dialog.gradient.opacityStop.<i>`, `dialog.gradient.colorStop.<i>` (in order along the bar),
 //! `dialog.gradient.location`, `dialog.gradient.opacity`, `dialog.gradient.color`,
-//! `dialog.gradient.delete`, `dialog.gradient.ok`, `dialog.gradient.cancel`.
+//! `dialog.gradient.delete`, `dialog.gradient.preview`, `dialog.gradient.ok`,
+//! `dialog.gradient.cancel`.
 
 use effectcraft_engine::keyframe::{Gradient, Value};
 use effectcraft_engine::project::{ItemId, LayerId};
@@ -18,6 +22,8 @@ use egui::{Color32, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
 use serde_json::{Value as Json, json};
 
 use crate::i18n::tr;
+use crate::panels::layer_styles_dialog::{Checkpoint, checkpoint};
+use crate::panels::preview_merge::{self, Applied};
 use crate::theme::Tokens;
 use crate::{Dialog, EffectcraftApp};
 
@@ -58,6 +64,14 @@ pub struct Draft {
     pub baseline: Gradient,
     /// Stop counts (colour, opacity) of the keyframes just before and after the edit time.
     pub neighbors: Vec<(usize, usize)>,
+    /// Preview: edits are applied to the property as they are made.
+    pub preview: bool,
+    /// The gradient the property was last given by the preview, if it has been.
+    pub applied: Option<Gradient>,
+    /// The project as the preview left it, to tell edits made since from the preview's.
+    applied_at: Option<Applied>,
+    /// The project and undo history as the editor opened, for Cancel.
+    checkpoint: Option<Checkpoint>,
     next_id: u64,
 }
 
@@ -220,7 +234,10 @@ pub fn open(app: &mut EffectcraftApp, p: &Json) -> Result<Json, String> {
     let before = prop.keys.iter().rev().find(|k| k.time < lt).and_then(|k| counts(&k.value));
     let after = prop.keys.iter().find(|k| k.time > lt).and_then(|k| counts(&k.value));
     let target = Target { comp: cid.0, layer: lid, prop: uid, time: ct.seconds() };
-    app.dialog_state.gradient = Draft::new(&g, Some(target), before.into_iter().chain(after).collect());
+    let mut draft = Draft::new(&g, Some(target), before.into_iter().chain(after).collect());
+    draft.preview = true;
+    draft.checkpoint = Some(checkpoint(app));
+    app.dialog_state.gradient = draft;
     app.dialog = Some(Dialog::GradientEditor);
     Ok(json!({"dialog": "gradientEditor"}))
 }
@@ -228,9 +245,14 @@ pub fn open(app: &mut EffectcraftApp, p: &Json) -> Result<Json, String> {
 /// Set the property to the draft: one `prop.set` at the time the editor opened, in composition
 /// time, or nothing when the draft is unchanged (so OK adds no keyframe).
 fn commit(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    app.dialog = None;
+    close(app);
     let d = std::mem::take(&mut app.dialog_state.gradient);
     let g = d.gradient();
+    // The preview already set the property to this draft, in one merged undo step: OK keeps it.
+    if d.applied.as_ref() == Some(&g) {
+        app.session.history.merge_key = None;
+        return;
+    }
     let Some(tg) = d.target else { return };
     if g == d.baseline {
         return;
@@ -241,18 +263,79 @@ fn commit(app: &mut EffectcraftApp, ctx: &egui::Context) {
     }
 }
 
-fn to_color32(c: [f32; 4]) -> Color32 {
+/// Close the editor without keeping the preview: the project and undo history go back to how they
+/// were when it opened (nothing happens when the preview never changed the property).
+pub fn finish(app: &mut EffectcraftApp, ok: bool, ctx: &egui::Context) {
+    if ok {
+        // An edit made in the same frame as OK is not in the last preview yet.
+        sync_preview(app, ctx);
+        commit(app, ctx);
+        return;
+    }
+    let d = std::mem::take(&mut app.dialog_state.gradient);
+    if d.applied.is_some()
+        && let Some(cp) = d.checkpoint
+    {
+        preview_merge::rollback(app, cp, d.applied_at.as_ref());
+    }
+    app.session.history.merge_key = None;
+    close(app);
+}
+
+/// Close the editor: back to the Layer Style dialog when it opened from there (#2057).
+fn close(app: &mut EffectcraftApp) {
+    app.dialog = std::mem::take(&mut app.dialog_state.layer_style.gradient_open).then_some(Dialog::LayerStyles);
+}
+
+/// Keep the property in step with the draft while Preview is on: apply a changed draft with one
+/// merged undo step, and roll back to the checkpoint when Preview goes off or the draft is back to
+/// how it opened.
+fn sync_preview(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    let d = &app.dialog_state.gradient;
+    let Some(tg) = d.target.clone() else { return };
+    let g = d.gradient();
+    let want = d.preview && g != d.baseline;
+    if want && d.applied.as_ref() != Some(&g) {
+        let params = json!({
+            "comp": tg.comp, "layer": tg.layer, "prop": tg.prop, "time": tg.time, "timeBase": "comp",
+            "value": Value::Gradient(g.clone()).to_json(), "merge": format!("gradient-editor-{}", tg.prop),
+        });
+        match crate::menus::invoke(app, ctx, "prop.set", params) {
+            Ok(_) => {
+                app.dialog_state.gradient.applied = Some(g);
+                app.dialog_state.gradient.applied_at = Some(preview_merge::applied(app));
+            }
+            Err(e) => app.ui.status = e,
+        }
+    } else if !want
+        && d.applied.is_some()
+        && let Some(cp) = d.checkpoint.clone()
+    {
+        let at = app.dialog_state.gradient.applied_at.take();
+        preview_merge::rollback(app, cp, at.as_ref());
+        app.dialog_state.gradient.applied = None;
+    }
+}
+
+pub(super) fn to_color32(c: [f32; 4]) -> Color32 {
     let b = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
     Color32::from_rgba_unmultiplied(b(c[0]), b(c[1]), b(c[2]), b(c[3]))
 }
 
+/// The Gradient Editor dialog for the gradient in `app.dialog_state.gradient`: a stop track for
+/// the opacity and colour tracks over a checkerboard preview, the selected stop's location,
+/// opacity or colour and a Delete button (when its track has more than one stop), the
+/// mismatched-stop-count warning, and OK/Cancel. Dragging moves stops, Delete/Backspace removes the
+/// selected one unless a widget wants keyboard input. OK runs the commit path; Cancel closes the dialog and drops the
+/// draft. With no gradient target it closes the dialog.
 pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     if app.dialog_state.gradient.target.is_none() {
         app.dialog = None;
         return;
     }
     let mut answer: Option<bool> = None;
-    super::dialogs::modal(ctx, tr("Gradient Editor"), vec2(520.0, 270.0), t, |ui| {
+    // At the lower right, undimmed: the canvas it edits stays in view (After Effects).
+    super::dialogs::modal_placed(ctx, tr("Gradient Editor"), vec2(520.0, 270.0), t, super::live_preview::PLACE, |ui| {
         let w = ui.available_width().max(200.0);
         let (area, _) = ui.allocate_exact_size(vec2(w, 72.0), Sense::hover());
         let bar = Rect::from_min_max(pos2(area.min.x + 8.0, area.min.y + 22.0), pos2(area.max.x - 8.0, area.min.y + 48.0));
@@ -291,7 +374,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
 
         // Clicking a row's empty space adds a stop there.
         for (track, rowr, id) in [(Track::Opacity, opacity_row, "dialog.gradient.addOpacity"), (Track::Color, color_row, "dialog.gradient.addColor")] {
-            let r = ui.interact(rowr, egui::Id::new(("gradient-add", id)), Sense::click());
+            let r = ui.interact(rowr, egui::Id::unique(("gradient-add", id)), Sense::click());
             app.auto.add(id, rowr, id);
             if r.clicked()
                 && let Some(p) = r.interact_pointer_pos()
@@ -323,7 +406,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                     Stroke::new(if selected { 2.0 } else { 1.0 }, if selected { t.accent } else { t.field_border }),
                     StrokeKind::Outside,
                 );
-                let resp = ui.interact(r.expand(2.0), egui::Id::new(("gradient-stop", track == Track::Color, id)), Sense::click_and_drag());
+                let resp = ui.interact(r.expand(2.0), egui::Id::unique(("gradient-stop", track == Track::Color, id)), Sense::click_and_drag());
                 let name = match track {
                     Track::Opacity => format!("dialog.gradient.opacityStop.{i}"),
                     Track::Color => format!("dialog.gradient.colorStop.{i}"),
@@ -410,6 +493,10 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             if r.clicked() {
                 answer = Some(true);
             }
+            let mut preview = app.dialog_state.gradient.preview;
+            let r = ui.checkbox(&mut preview, tr("Preview"));
+            app.auto.add("dialog.gradient.preview", r.rect, "Preview");
+            app.dialog_state.gradient.preview = preview;
         });
     });
     // Delete / Backspace remove the selected stop, but not while typing in a field.
@@ -421,12 +508,8 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         app.dialog_state.gradient.remove(track, id);
     }
     match answer {
-        Some(true) => commit(app, ctx),
-        Some(false) => {
-            app.dialog = None;
-            app.dialog_state.gradient = Draft::default();
-        }
-        None => {}
+        Some(ok) => finish(app, ok, ctx),
+        None => sync_preview(app, ctx),
     }
 }
 
diff --git a/crates/ui-egui/src/panels/gradient_handles.rs b/crates/ui-egui/src/panels/gradient_handles.rs
index e855a49e1..bc0ec4d82 100644
--- a/crates/ui-egui/src/panels/gradient_handles.rs
+++ b/crates/ui-egui/src/panels/gradient_handles.rs
@@ -76,7 +76,7 @@ pub fn viewer_hook(
             }
             for (pr, s) in pts.iter().zip(screen) {
                 let hr = Rect::from_center_size(s, vec2(16.0, 16.0));
-                let id = egui::Id::new(("viewer-gradient-pt", pr.uid));
+                let id = egui::Id::unique(("viewer-gradient-pt", pr.uid));
                 let resp = ui.interact(hr, id, Sense::drag());
                 let col = if resp.hovered() || resp.dragged() { t.accent } else { Color32::WHITE };
                 fw::draw_crosshair(painter, s + vec2(1.0, 1.0), 5.0, Color32::from_black_alpha(160));
diff --git a/crates/ui-egui/src/panels/graph.rs b/crates/ui-egui/src/panels/graph.rs
index 0b372c0a0..be18999d4 100644
--- a/crates/ui-egui/src/panels/graph.rs
+++ b/crates/ui-egui/src/panels/graph.rs
@@ -48,9 +48,21 @@ struct KeyPt {
     t: f64,
     v: f64,
     sel: bool,
+    muted: bool,
     handles: Vec<Handle>,
 }
 
+/// A graph key's fill and edge colours: muted keys stay visible and selectable, dimmed.
+fn key_colors(t: &Tokens, edge: Color32, k: &KeyPt) -> (Color32, Color32) {
+    let fill = match (k.muted, k.sel) {
+        (true, true) => t.keyframe_selected.gamma_multiply(0.5),
+        (true, false) => Color32::from_gray(0x70),
+        (false, true) => t.keyframe_selected,
+        (false, false) => Color32::from_gray(0xe0),
+    };
+    (fill, if k.muted { edge.gamma_multiply(0.4) } else { edge })
+}
+
 struct Curve<'a> {
     layer: &'a Layer,
     prop: &'a Property,
@@ -153,7 +165,7 @@ fn curves<'a>(app: &EffectcraftApp, comp: &'a Comp, ectx: &EvalCtx, tm: TMap, pl
                     let dt = e.influence * dur * if out_side { 1.0 } else { -1.0 };
                     let (hv, show) = if speed { (e.speed.abs(), true) } else { (k.value.components().get(d).copied().unwrap_or(0.0) + e.speed * dt, !spatial) };
                     let bezier = if out_side { k.out_interp == Interp::Bezier } else { k.in_interp == Interp::Bezier };
-                    if ks && show && (bezier || speed) {
+                    if ks && !k.muted && show && (bezier || speed) {
                         handles.push(Handle { out: out_side, t: kt + dt, v: hv, speed: e.speed, dur });
                     }
                 }
@@ -162,7 +174,7 @@ fn curves<'a>(app: &EffectcraftApp, comp: &'a Comp, ectx: &EvalCtx, tm: TMap, pl
                 } else {
                     k.value.components().get(d).copied().unwrap_or(0.0)
                 };
-                keys.push(KeyPt { idx: i, time: k.time, t: kt, v, sel: ks, handles });
+                keys.push(KeyPt { idx: i, time: k.time, t: kt, v, sel: ks, muted: k.muted, handles });
             }
             out.push(Curve { layer: l, prop: pr, dim: d, color, pts, keys, editable: !spatial });
         }
@@ -189,8 +201,11 @@ const MORE_POPUP: &str = "graph-more";
 impl ButtonBar {
     const MORE_W: f32 = 24.0;
 
+    /// A bar starting 8 points into `bar`, stopping short of its right end by the "»" button's
+    /// width. It takes the id picked from the "»" menu in the previous frame, so the button whose
+    /// id that was reports a click on the frame after the pick.
     fn new(ctx: &egui::Context, bar: Rect) -> Self {
-        let chosen = ctx.data_mut(|d| d.remove_temp::<String>(egui::Id::new(MORE_POPUP).with("chosen")));
+        let chosen = ctx.data_mut(|d| d.remove_temp::<String>(egui::Id::unique(MORE_POPUP).with("chosen")));
         ButtonBar { x: bar.min.x + 8.0, limit: bar.max.x - 8.0 - Self::MORE_W - 4.0, hidden: Vec::new(), chosen }
     }
 
@@ -201,7 +216,7 @@ impl ButtonBar {
         }
         let t = app.tokens;
         let r = Rect::from_min_size(pos2(bar.max.x - 8.0 - Self::MORE_W, bar.center().y - 9.0), vec2(Self::MORE_W, 18.0));
-        let pid = egui::Id::new(MORE_POPUP);
+        let pid = egui::Id::unique(MORE_POPUP);
         let resp = ui.interact(r, pid.with("button"), Sense::click()).on_hover_text(crate::i18n::tr("More"));
         p.rect_filled(r, 3.0, if resp.hovered() { t.hover } else { Color32::from_rgb(0x2c, 0x2c, 0x2c) });
         p.text(r.center(), Align2::CENTER_CENTER, "»", Tokens::ui(12.0), t.text);
@@ -218,7 +233,7 @@ impl ButtonBar {
         let chosen = widgets::popup_list(ui, pid, pos, r, rows, 0, |ui| {
             let mut chosen = None;
             for (id, label, on, tip) in &self.hidden {
-                let item = ui.selectable_label(*on, label.as_str()).on_hover_text(tip.as_str());
+                let item = ui.selectable_label(*on, crate::i18n::tr(label)).on_hover_text(crate::i18n::tr(tip));
                 app.auto.add(&format!("timeline.graph.more.{id}"), item.rect, tip);
                 if item.clicked() {
                     chosen = Some(id.clone());
@@ -233,26 +248,31 @@ impl ButtonBar {
     }
 }
 
-fn text_button(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    bar: &mut ButtonBar,
-    y: f32,
-    label: &str,
+/// One text button of the Graph Editor's button bar at the bar's current `x`, in the toolbar row
+/// at `y`: draws it, registers it for automation and advances the bar. Once a button does not fit
+/// (or a previous one overflowed), the button goes to the "»" menu instead and only the id the
+/// menu picked reports a click. Returns whether this button was chosen.
+/// One bar button for [`text_button`]: label, lit state, automation id and tooltip.
+struct BarBtn<'a> {
+    label: &'a str,
     on: bool,
-    id: &str,
-    tip: &str,
-) -> bool {
+    id: &'a str,
+    tip: &'a str,
+}
+
+fn text_button(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, bar: &mut ButtonBar, y: f32, btn: BarBtn) -> bool {
+    let BarBtn { label, on, id, tip } = btn;
     let t = app.tokens;
-    let w = p.layout_no_wrap(label.to_string(), Tokens::ui(11.0), t.text).size().x + 14.0;
+    let (shown, shown_tip) = (crate::i18n::tr(label), crate::i18n::tr(tip));
+    let w = p.layout_no_wrap(shown.to_string(), Tokens::ui(11.0), t.text).size().x + 14.0;
     // Once one button overflows, the rest follow it into the menu (they keep their order).
     if !bar.hidden.is_empty() || bar.x + w > bar.limit {
+        // The menu translates these English labels when it draws them; automation keeps them.
         bar.hidden.push((id.to_string(), label.to_string(), on, tip.to_string()));
         return bar.chosen.as_deref() == Some(id);
     }
     let r = Rect::from_min_size(pos2(bar.x, y - 9.0), vec2(w, 18.0));
-    let resp = ui.interact(r, egui::Id::new(("graph-btn", id)), Sense::click()).on_hover_text(tip);
+    let resp = ui.interact(r, egui::Id::unique(("graph-btn", id)), Sense::click()).on_hover_text(shown_tip);
     p.rect_filled(
         r,
         3.0,
@@ -264,41 +284,50 @@ fn text_button(
             Color32::from_rgb(0x2c, 0x2c, 0x2c)
         },
     );
-    p.text(r.center(), Align2::CENTER_CENTER, label, Tokens::ui(11.0), if on { Color32::WHITE } else { t.text });
+    p.text(r.center(), Align2::CENTER_CENTER, shown, Tokens::ui(11.0), if on { Color32::WHITE } else { t.text });
     app.auto.add(&format!("timeline.graph.{id}"), r, tip);
     bar.x += w + 4.0;
     resp.clicked()
 }
 
-/// Draw the Graph Editor into `area` (the right side of the Timeline) and queue edits.
-pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, comp: &Comp, ectx: &EvalCtx, tm: TMap, area: Rect, actions: &mut Actions) {
-    let t = app.tokens;
-    let ctx = ui.ctx().clone();
-    let footer_h = 28.0;
-    let plot = Rect::from_min_max(area.min + vec2(0.0, 6.0), pos2(area.max.x, area.max.y - footer_h));
-    let bar = Rect::from_min_max(pos2(area.min.x, area.max.y - footer_h), area.max);
-    // Background first so keys and handles (added later) sit on top for hit-testing.
-    let bg = ui.interact(plot, egui::Id::new("graph-bg"), Sense::click_and_drag());
-    p.rect_filled(area, 0.0, Color32::from_rgb(0x1d, 0x1d, 0x1d));
-    app.auto.add("timeline.graph", plot, &app.ui.timeline.graph_mode.clone());
-    let speed = speed_graph(app, comp);
-    let cs = curves(app, comp, ectx, tm, plot, speed);
-    // Just opened, or the graph type changed (value and speed have different units): frame the
-    // graphs (Fit Selection to View, else Fit All Graphs to View).
-    let was_speed_id = egui::Id::new("graph-was-speed");
-    let type_changed = ctx.data(|d| d.get_temp::<bool>(was_speed_id)).is_some_and(|was| was != speed);
-    ctx.data_mut(|d| d.insert_temp(was_speed_id, speed));
-    if ctx.data_mut(|d| d.remove_temp::<bool>(fit_pending_id())).unwrap_or(false) || type_changed {
-        if cs.iter().any(|c| c.keys.iter().any(|k| k.sel)) {
-            fit_selection(app, &cs, tm, plot, speed);
-        } else {
-            fit_all(app);
+/// What the Graph Editor draws: the composition, its evaluation context and the time mapping.
+#[derive(Clone, Copy)]
+pub(crate) struct GraphView<'a> {
+    pub comp: &'a Comp,
+    pub ectx: &'a EvalCtx<'a>,
+    pub tm: TMap,
+}
+
+/// Show Reference Graph: the other graph type, faint, scaled to the plot.
+fn reference_graph(app: &EffectcraftApp, view: GraphView, plot: Rect, speed: bool, pc: &egui::Painter) {
+    let GraphView { comp, ectx, tm } = view;
+    let other = curves(app, comp, ectx, tm, plot, !speed);
+    let (mut rlo, mut rhi) = (f64::INFINITY, f64::NEG_INFINITY);
+    for c in &other {
+        for (_, v) in &c.pts {
+            rlo = rlo.min(*v);
+            rhi = rhi.max(*v);
         }
     }
+    if rlo.is_finite() {
+        let span = (rhi - rlo).max(1e-9);
+        let lines: Vec<(Color32, Vec<Pos2>)> = other
+            .iter()
+            .map(|c| {
+                (
+                    c.color,
+                    c.pts.iter().map(|(ct, v)| pos2(tm.x(*ct), plot.max.y - ((v - rlo) / span) as f32 * plot.height() * 0.9 - plot.height() * 0.05)).collect(),
+                )
+            })
+            .collect();
+        super::graph_tools::reference_graph(pc, plot, &lines);
+    }
+}
 
-    // Vertical range: auto-zoom to the curves + handles, or the stored manual range.
+/// The value range that fits every curve point and key handle (with a margin).
+fn auto_range(cs: &[Curve], speed: bool) -> (f64, f64) {
     let (mut lo, mut hi) = (f64::INFINITY, f64::NEG_INFINITY);
-    for c in &cs {
+    for c in cs {
         for (_, v) in &c.pts {
             lo = lo.min(*v);
             hi = hi.max(*v);
@@ -320,9 +349,80 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
         hi = lo + 1.0;
     }
     let pad = (hi - lo) * 0.08;
-    let auto = (lo - pad, hi + pad);
+    (lo - pad, hi + pad)
+}
+
+/// Background: a click deselects keys, a drag box-selects the keys inside it.
+fn box_select(ui: &egui::Ui, pc: &egui::Painter, bg: &egui::Response, key_screens: &[(serde_json::Value, Pos2)], accent: Color32, actions: &mut Actions) {
+    let ctx = ui.ctx().clone();
+    if bg.clicked() {
+        actions.push(("keys.select".into(), json!({"keys": []})));
+    }
+    if bg.dragged()
+        && let (Some(o), Some(cur)) = (ctx.input(|i| i.pointer.press_origin()), bg.interact_pointer_pos())
+    {
+        let br = Rect::from_two_pos(o, cur);
+        pc.rect_filled(br, 0.0, accent.gamma_multiply(0.12));
+        pc.rect_stroke(br, 0.0, Stroke::new(1.0, accent), StrokeKind::Middle);
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique("graph-box"), br));
+    }
+    if bg.drag_stopped()
+        && let Some(br) = ctx.data(|d| d.get_temp::<Rect>(egui::Id::unique("graph-box")))
+    {
+        ctx.data_mut(|d| d.remove::<Rect>(egui::Id::unique("graph-box")));
+        let keys: Vec<serde_json::Value> = key_screens.iter().filter(|(_, sp)| br.contains(*sp)).map(|(k, _)| k.clone()).collect();
+        actions.push(("keys.select".into(), json!({"keys": keys, "add": ui.input(|i| i.modifiers.shift)})));
+    }
+}
+
+/// Wheel over the graph with Ctrl zooms the value axis `(lo, hi)` (turns auto-zoom off).
+fn wheel_zoom(app: &mut EffectcraftApp, ui: &egui::Ui, plot: Rect, (lo, hi): (f64, f64)) {
+    if ui.rect_contains_pointer(plot) {
+        let (dy, zoom) = ui.input(|i| (i.smooth_scroll_delta.y, i.modifiers.ctrl || i.modifiers.command));
+        if zoom && dy.abs() > 0.0 {
+            let k = (-dy as f64 / 200.0).exp();
+            let mid = (lo + hi) / 2.0;
+            app.ui.timeline.graph_auto_zoom = false;
+            app.ui.timeline.graph_range = Some((mid - (mid - lo) * k, mid + (hi - mid) * k));
+        }
+    }
+}
+
+/// Just opened, or the graph type changed (value and speed have different units): frame the
+/// graphs (Fit Selection to View, else Fit All Graphs to View).
+fn fit_on_open(app: &mut EffectcraftApp, ctx: &egui::Context, cs: &[Curve], tm: TMap, plot: Rect, speed: bool) {
+    let was_speed_id = egui::Id::unique("graph-was-speed");
+    let type_changed = ctx.data(|d| d.get_temp::<bool>(was_speed_id)).is_some_and(|was| was != speed);
+    ctx.data_mut(|d| d.insert_temp(was_speed_id, speed));
+    if ctx.data_mut(|d| d.remove_temp::<bool>(fit_pending_id())).unwrap_or(false) || type_changed {
+        if cs.iter().any(|c| c.keys.iter().any(|k| k.sel)) {
+            fit_selection(app, cs, tm, plot, speed);
+        } else {
+            fit_all(app);
+        }
+    }
+}
+
+/// Draw the Graph Editor into `area` (the right side of the Timeline) and queue edits.
+pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, view: GraphView, area: Rect, actions: &mut Actions) {
+    let GraphView { comp, ectx, tm } = view;
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    let footer_h = 28.0;
+    let plot = Rect::from_min_max(area.min + vec2(0.0, 6.0), pos2(area.max.x, area.max.y - footer_h));
+    let bar = Rect::from_min_max(pos2(area.min.x, area.max.y - footer_h), area.max);
+    // Background first so keys and handles (added later) sit on top for hit-testing.
+    let bg = ui.interact(plot, egui::Id::unique("graph-bg"), Sense::click_and_drag());
+    p.rect_filled(area, 0.0, Color32::from_rgb(0x1d, 0x1d, 0x1d));
+    app.auto.add("timeline.graph", plot, &app.ui.timeline.graph_mode.clone());
+    let speed = speed_graph(app, comp);
+    let cs = curves(app, comp, ectx, tm, plot, speed);
+    fit_on_open(app, &ctx, &cs, tm, plot, speed);
+
+    // Vertical range: auto-zoom to the curves + handles, or the stored manual range.
+    let auto = auto_range(&cs, speed);
     // While a key or handle is being dragged the scale stays put (no feedback loop).
-    let drag_id = egui::Id::new("graph-dragging");
+    let drag_id = egui::Id::unique("graph-dragging");
     let dragging = ctx.data(|d| d.get_temp::<bool>(drag_id)).unwrap_or(false) && ctx.input(|i| i.pointer.any_down());
     let (lo, hi) = if app.ui.timeline.graph_auto_zoom && !dragging { auto } else { app.ui.timeline.graph_range.unwrap_or(auto) };
     if app.ui.timeline.graph_auto_zoom && !dragging {
@@ -351,32 +451,8 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
         );
     }
 
-    // Show Reference Graph: the other graph type, faint, scaled to the plot.
     if app.ui.timeline.graph_reference && !cs.is_empty() {
-        let other = curves(app, comp, ectx, tm, plot, !speed);
-        let (mut rlo, mut rhi) = (f64::INFINITY, f64::NEG_INFINITY);
-        for c in &other {
-            for (_, v) in &c.pts {
-                rlo = rlo.min(*v);
-                rhi = rhi.max(*v);
-            }
-        }
-        if rlo.is_finite() {
-            let span = (rhi - rlo).max(1e-9);
-            let lines: Vec<(Color32, Vec<Pos2>)> = other
-                .iter()
-                .map(|c| {
-                    (
-                        c.color,
-                        c.pts
-                            .iter()
-                            .map(|(ct, v)| pos2(tm.x(*ct), plot.max.y - ((v - rlo) / span) as f32 * plot.height() * 0.9 - plot.height() * 0.05))
-                            .collect(),
-                    )
-                })
-                .collect();
-            super::graph_tools::reference_graph(&pc, plot, &lines);
-        }
+        reference_graph(app, view, plot, speed, &pc);
     }
     // Curves.
     for c in &cs {
@@ -394,11 +470,12 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
     let mut key_screens: Vec<(serde_json::Value, Pos2)> = vec![];
     for c in &cs {
         let (lid, uid, d) = (c.layer.id, c.prop.uid, c.dim);
+        let unlocked = !c.layer.switches.locked;
         for k in &c.keys {
             let kp = pos2(tm.x(k.t), ymap(k.v));
             // In the speed graph an end key rises with the handle being dragged; skipping it once it
             // leaves the plot would drop the handle's widget and end the drag at the top edge.
-            let handle_dragged = || ["in", "out"].iter().any(|side| ctx.is_being_dragged(egui::Id::new(("ghandle", uid, d, k.idx, *side))));
+            let handle_dragged = || ["in", "out"].iter().any(|side| ctx.is_being_dragged(egui::Id::unique(("ghandle", uid, d, k.idx, *side))));
             if !plot.expand(6.0).contains(kp) && !handle_dragged() {
                 continue;
             }
@@ -411,13 +488,14 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
                 pc.circle_filled(hp, 3.5, Color32::from_rgb(0xd8, 0xd8, 0x60));
                 let side = if h.out { "out" } else { "in" };
                 let hr = Rect::from_center_size(hp, vec2(10.0, 10.0));
-                let hresp = ui.interact(hr, egui::Id::new(("ghandle", uid, d, k.idx, side)), Sense::drag());
+                let hresp = ui.interact(hr, egui::Id::unique(("ghandle", uid, d, k.idx, side)), Sense::drag());
                 app.auto.add(&format!("timeline.graph.handle.{uid}.{d}.{}.{side}", k.idx), hr, "Bezier handle");
                 // The same side's handles of every selected key move with it, by as much as the
                 // pointer moved (After Effects), in one undo step.
-                if hresp.drag_started() {
+                if unlocked && hresp.drag_started() {
                     let grabs: Vec<HandleGrab> = cs
                         .iter()
+                        .filter(|c2| !c2.layer.switches.locked)
                         .flat_map(|c2| {
                             c2.keys.iter().flat_map(move |k2| {
                                 k2.handles.iter().filter(|h2| h2.out == h.out).map(move |h2| HandleGrab {
@@ -437,7 +515,8 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
                     let press = ui.input(|i| i.pointer.press_origin()).unwrap_or(hp);
                     ctx.data_mut(|dd| dd.insert_temp::<HandleDrag>(handle_drag_id(), (press, grabs)));
                 }
-                if hresp.dragged()
+                if unlocked
+                    && hresp.dragged()
                     && let Some(pt) = hresp.interact_pointer_pos()
                     && let Some((press, grabs)) = ctx.data(|dd| dd.get_temp::<HandleDrag>(handle_drag_id()))
                 {
@@ -460,15 +539,15 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
                 }
             }
             // The key itself.
-            let col = if k.sel { t.keyframe_selected } else { Color32::from_gray(0xe0) };
+            let (col, edge) = key_colors(&t, c.color, k);
             pc.rect_filled(Rect::from_center_size(kp, vec2(7.0, 7.0)), 0.0, col);
-            pc.rect_stroke(Rect::from_center_size(kp, vec2(7.0, 7.0)), 0.0, Stroke::new(1.0, c.color), StrokeKind::Outside);
+            pc.rect_stroke(Rect::from_center_size(kp, vec2(7.0, 7.0)), 0.0, Stroke::new(1.0, edge), StrokeKind::Outside);
             let kr = Rect::from_center_size(kp, vec2(11.0, 11.0));
-            let kresp = ui.interact(kr, egui::Id::new(("gkey", uid, d, k.idx)), Sense::click_and_drag());
+            let kresp = ui.interact(kr, egui::Id::unique(("gkey", uid, d, k.idx)), Sense::click_and_drag());
             app.auto.add(&format!("timeline.graph.key.{uid}.{d}.{}", k.idx), kr, &c.prop.name);
             let mods = ui.input(|i| i.modifiers);
             let key = &c.prop.keys[k.idx];
-            if kresp.clicked() && mods.command {
+            if unlocked && kresp.clicked() && mods.command {
                 // Ctrl+click: Linear ↔ Auto Bezier; Ctrl+Alt+click: Hold on / off (as in the Timeline).
                 actions.push(("keys.select".into(), json!({"keys": [kjson.clone()]})));
                 if mods.alt {
@@ -477,20 +556,22 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
                     let linear = key.in_interp == Interp::Linear && key.out_interp == Interp::Linear;
                     actions.push(("keys.interpolation".into(), json!({"interpolation": if linear { "autoBezier" } else { "linear" }})));
                 }
-            } else if kresp.clicked() && mods.shift {
+            } else if unlocked && kresp.clicked() && mods.shift {
                 actions.push(("keys.select".into(), json!({"keys": [kjson.clone()], "toggle": true})));
-            } else if (kresp.clicked() || kresp.drag_started()) && !k.sel {
+            } else if unlocked && (kresp.clicked() || kresp.drag_started() || kresp.secondary_clicked()) && !k.sel {
                 actions.push(("keys.select".into(), json!({"keys": [kjson.clone()], "add": mods.shift})));
             }
             // A drag moves every selected key, by how far the pointer went from where the button
             // went down (the key doesn't jump under the pointer); Shift keeps it to the time or
             // the value axis, whichever moved more.
-            if kresp.drag_started()
+            if unlocked
+                && kresp.drag_started()
                 && let Some(o) = ui.input(|i| i.pointer.press_origin())
             {
                 ctx.data_mut(|dd| dd.insert_temp(key_grab_id(), KeyGrab { press: o, t: k.t }));
             }
-            if kresp.dragged()
+            if unlocked
+                && kresp.dragged()
                 && let Some(pt) = kresp.interact_pointer_pos()
                 && let Some(g) = ctx.data(|dd| dd.get_temp::<KeyGrab>(key_grab_id()))
             {
@@ -511,42 +592,26 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
                 ctx.data_mut(|dd| dd.insert_temp(drag_id, false));
                 actions.push(("__endMerge".into(), json!({})));
             }
+            // Right-click: the Timeline's key menu, with the same commands.
+            crate::widgets::context_menu(&kresp, |ui| super::timeline::key_menu(ui, app, c.layer, c.prop, key, k.sel, actions));
         }
     }
 
     super::graph_tools::transform_box(app, ui, &pc, &sel_keys, tm, &ymap, &vmap, speed, true, actions);
 
-    // Background: click deselects keys, drag box-selects.
-    if bg.clicked() {
-        actions.push(("keys.select".into(), json!({"keys": []})));
-    }
-    if bg.dragged()
-        && let (Some(o), Some(cur)) = (ctx.input(|i| i.pointer.press_origin()), bg.interact_pointer_pos())
-    {
-        let br = Rect::from_two_pos(o, cur);
-        pc.rect_filled(br, 0.0, t.accent.gamma_multiply(0.12));
-        pc.rect_stroke(br, 0.0, Stroke::new(1.0, t.accent), StrokeKind::Middle);
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("graph-box"), br));
-    }
-    if bg.drag_stopped()
-        && let Some(br) = ctx.data(|d| d.get_temp::<Rect>(egui::Id::new("graph-box")))
-    {
-        ctx.data_mut(|d| d.remove::<Rect>(egui::Id::new("graph-box")));
-        let keys: Vec<serde_json::Value> = key_screens.iter().filter(|(_, sp)| br.contains(*sp)).map(|(k, _)| k.clone()).collect();
-        actions.push(("keys.select".into(), json!({"keys": keys, "add": ui.input(|i| i.modifiers.shift)})));
-    }
-    // Wheel over the graph with Alt/Ctrl zooms the value axis (turns auto-zoom off).
-    if ui.rect_contains_pointer(plot) {
-        let (dy, zoom) = ui.input(|i| (i.smooth_scroll_delta.y, i.modifiers.ctrl || i.modifiers.command));
-        if zoom && dy.abs() > 0.0 {
-            let k = (-dy as f64 / 200.0).exp();
-            let mid = (lo + hi) / 2.0;
-            app.ui.timeline.graph_auto_zoom = false;
-            app.ui.timeline.graph_range = Some((mid - (mid - lo) * k, mid + (hi - mid) * k));
-        }
+    box_select(ui, &pc, &bg, &key_screens, t.accent, actions);
+    wheel_zoom(app, ui, plot, (lo, hi));
+    if button_bar(app, ui, p, comp, bar, speed, actions) {
+        fit_selection(app, &cs, tm, plot, speed);
     }
+}
 
-    // Button bar.
+/// The footer button bar: graph type, display toggles, fit, snap and keyframe interpolation.
+/// Returns whether Fit Selection was pressed.
+fn button_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, comp: &Comp, bar: Rect, speed: bool, actions: &mut Actions) -> bool {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    let mut fit_sel = false;
     p.rect_filled(bar, 0.0, t.panel_bg);
     p.line_segment([bar.left_top(), bar.right_top()], Stroke::new(1.0, t.separator));
     let y = bar.center().y;
@@ -559,48 +624,71 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
         p,
         &mut buttons,
         y,
-        "Auto",
-        auto_type,
-        "autoSelectGraphType",
-        "Auto-Select Graph Type (speed graph for spatial properties, else value graph)",
+        BarBtn {
+            label: "Auto",
+            on: auto_type,
+            id: "autoSelectGraphType",
+            tip: "Auto-Select Graph Type (speed graph for spatial properties, else value graph)",
+        },
     ) {
         app.ui.timeline.graph_mode = if auto_type { if speed { "speed" } else { "value" } } else { "auto" }.into();
     }
     // Choosing a graph type turns Auto-Select off, as in After Effects.
-    if text_button(app, ui, p, &mut buttons, y, "Value", !speed, "valueGraph", "Edit Value Graph") {
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Value", on: !speed, id: "valueGraph", tip: "Edit Value Graph" }) {
         app.ui.timeline.graph_mode = "value".into();
     }
-    if text_button(app, ui, p, &mut buttons, y, "Speed", speed, "speedGraph", "Edit Speed Graph") {
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Speed", on: speed, id: "speedGraph", tip: "Edit Speed Graph" }) {
         app.ui.timeline.graph_mode = "speed".into();
     }
     buttons.x += 6.0;
-    if text_button(app, ui, p, &mut buttons, y, "Selected", show_sel, "showSelected", "Show Selected Properties (else all animated properties)") {
+    if text_button(
+        app,
+        ui,
+        p,
+        &mut buttons,
+        y,
+        BarBtn { label: "Selected", on: show_sel, id: "showSelected", tip: "Show Selected Properties (else all animated properties)" },
+    ) {
         app.ui.timeline.graph_show_selected = !show_sel;
     }
-    if text_button(app, ui, p, &mut buttons, y, "Auto-zoom", auto_on, "autoZoom", "Auto-zoom graph height") {
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Auto-zoom", on: auto_on, id: "autoZoom", tip: "Auto-zoom graph height" }) {
         app.ui.timeline.graph_auto_zoom = !auto_on;
     }
-    if text_button(app, ui, p, &mut buttons, y, "Fit", false, "fit", "Fit all graphs to view") {
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Fit", on: false, id: "fit", tip: "Fit all graphs to view" }) {
         fit_all(app);
     }
-    if text_button(app, ui, p, &mut buttons, y, "Fit Selection", false, "fitSelection", "Fit selection to view") {
-        fit_selection(app, &cs, tm, plot, speed);
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Fit Selection", on: false, id: "fitSelection", tip: "Fit selection to view" }) {
+        fit_sel = true;
     }
     buttons.x += 6.0;
     let (snap, reference, tbox) = (app.ui.timeline.graph_snap, app.ui.timeline.graph_reference, app.ui.timeline.graph_transform_box);
-    if text_button(app, ui, p, &mut buttons, y, "Snap", snap, "snap", "Snap (key drags snap to the current time and other keys)") {
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Snap", on: snap, id: "snap", tip: "Snap (key drags snap to the current time and other keys)" })
+    {
         app.ui.timeline.graph_snap = !snap;
     }
-    if text_button(app, ui, p, &mut buttons, y, "Reference", reference, "reference", "Show Reference Graph") {
+    if text_button(app, ui, p, &mut buttons, y, BarBtn { label: "Reference", on: reference, id: "reference", tip: "Show Reference Graph" }) {
         app.ui.timeline.graph_reference = !reference;
     }
-    if text_button(app, ui, p, &mut buttons, y, "Transform Box", tbox, "transformBox", "Show Transform Box when multiple keys are selected") {
+    if text_button(
+        app,
+        ui,
+        p,
+        &mut buttons,
+        y,
+        BarBtn { label: "Transform Box", on: tbox, id: "transformBox", tip: "Show Transform Box when multiple keys are selected" },
+    ) {
         app.ui.timeline.graph_transform_box = !tbox;
     }
     buttons.x += 6.0;
     let pos_sel = app.session.state.selected_props.iter().find_map(|(l, u)| super::timeline::is_position(comp.layer(*l)?, *u).then_some(l.0));
-    if text_button(app, ui, p, &mut buttons, y, "Separate Dimensions", false, "separateDimensions", "Separate Dimensions (Position)")
-        && let Some(l) = pos_sel.or(app.session.state.selected_layers.first().map(|l| l.0))
+    if text_button(
+        app,
+        ui,
+        p,
+        &mut buttons,
+        y,
+        BarBtn { label: "Separate Dimensions", on: false, id: "separateDimensions", tip: "Separate Dimensions (Position)" },
+    ) && let Some(l) = pos_sel.or(app.session.state.selected_layers.first().map(|l| l.0))
     {
         actions.push(("prop.separateDimensions".into(), json!({"layer": l})));
     }
@@ -614,11 +702,12 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
         ("Ease Out", "keys.easyEaseOut", json!({}), "Easy Ease Out (Ctrl+Shift+F9)"),
     ] {
         let id = cmd.trim_start_matches("keys.").to_string() + label.split_whitespace().next().unwrap_or("");
-        if text_button(app, ui, p, &mut buttons, y, label, false, &id, tip) {
+        if text_button(app, ui, p, &mut buttons, y, BarBtn { label, on: false, id: &id, tip }) {
             actions.push((cmd.into(), params));
         }
     }
     buttons.more(app, ui, p, bar);
+    fit_sel
 }
 
 /// Fit All Graphs to View: the whole comp in time, auto-zoomed values.
@@ -627,15 +716,17 @@ fn fit_all(app: &mut EffectcraftApp) {
     app.ui.timeline.pps = None;
 }
 
+/// The `egui::Id` of the one-shot flag [`track_open`] sets when the Graph Editor is switched on,
+/// so [`show`] frames all graphs on its next pass, once the plot rectangle is known.
 fn fit_pending_id() -> egui::Id {
-    egui::Id::new("graph-fit-pending")
+    egui::Id::unique("graph-fit-pending")
 }
 
 /// Called every Timeline frame with whether the Graph Editor is on: switching it on (header
 /// button, menu, Shift+F3 or the control channel) frames the graphs on its first frame, when the
 /// plot rect is known, as After Effects does.
 pub(crate) fn track_open(ctx: &egui::Context, on: bool) {
-    let was_id = egui::Id::new("graph-editor-was-on");
+    let was_id = egui::Id::unique("graph-editor-was-on");
     let was = ctx.data(|d| d.get_temp::<bool>(was_id)).unwrap_or(false);
     ctx.data_mut(|d| {
         d.insert_temp(was_id, on);
@@ -739,8 +830,10 @@ struct KeyGrab {
     t: f64,
 }
 
+/// The `egui::Id` of the key drag in progress ([`KeyGrab`]): where the button went down and the
+/// grabbed key's comp time when it did.
 fn key_grab_id() -> egui::Id {
-    egui::Id::new("graph-key-grab")
+    egui::Id::unique("graph-key-grab")
 }
 
 /// A Bezier handle moving with a handle drag: its key, side and dimension, the key's place
@@ -786,8 +879,10 @@ impl HandleGrab {
 /// A handle drag: where the button went down, and the handles that move.
 type HandleDrag = (Pos2, Vec<HandleGrab>);
 
+/// The `egui::Id` of the Bezier handle drag in progress ([`HandleDrag`]): the press position and
+/// the handles the drag moves.
 fn handle_drag_id() -> egui::Id {
-    egui::Id::new("graph-handle-drag")
+    egui::Id::unique("graph-handle-drag")
 }
 
 /// Which axes a drag may move on (time, value): both, or with Shift only the one the pointer moved more along.
diff --git a/crates/ui-egui/src/panels/graph_tools.rs b/crates/ui-egui/src/panels/graph_tools.rs
index a13a5396f..7950d4a66 100644
--- a/crates/ui-egui/src/panels/graph_tools.rs
+++ b/crates/ui-egui/src/panels/graph_tools.rs
@@ -34,8 +34,9 @@ struct BoxDrag {
     last: [f64; 2],
 }
 
+/// The `egui::Id` of the transform-box drag in progress ([`BoxDrag`]).
 fn box_id() -> egui::Id {
-    egui::Id::new("graph-transform-box")
+    egui::Id::unique("graph-transform-box")
 }
 
 /// Bounds of the selected keys: (t0, v0, t1, v1).
@@ -80,7 +81,7 @@ pub(crate) fn transform_box(
     let value_ok = !speed && keys.iter().all(|k| k.editable);
     let col = Color32::from_rgb(0xd8, 0xd8, 0xd8);
     let ctx = ui.ctx().clone();
-    let drag_id = egui::Id::new("graph-dragging");
+    let drag_id = egui::Id::unique("graph-dragging");
     let hp = handle_points(r);
     let data = |q: Pos2| [tm.t(q.x), vmap(q.y)];
     // Which data point each handle sits on, and its opposite.
@@ -100,7 +101,7 @@ pub(crate) fn transform_box(
     let mut resp_any: Option<egui::Response> = None;
     if !handles {
         p.rect_stroke(r, 0.0, Stroke::new(1.0, col.gamma_multiply(0.7)), StrokeKind::Middle);
-        let resp = ui.interact(r, egui::Id::new("graph-box-inside"), Sense::drag());
+        let resp = ui.interact(r, egui::Id::unique("graph-box-inside"), Sense::drag());
         app.auto.add("timeline.graph.transformBox", r, "Transform box");
         if resp.drag_started()
             && let Some(o) = ui.input(|i| i.pointer.press_origin())
@@ -117,7 +118,7 @@ pub(crate) fn transform_box(
             let hr = Rect::from_center_size(*h, vec2(7.0, 7.0));
             p.rect_filled(hr, 0.0, Color32::from_gray(0x20));
             p.rect_stroke(hr, 0.0, Stroke::new(1.0, col), StrokeKind::Middle);
-            let resp = ui.interact(hr.expand(2.0), egui::Id::new(("graph-box-handle", i)), Sense::drag());
+            let resp = ui.interact(hr.expand(2.0), egui::Id::unique(("graph-box-handle", i)), Sense::drag());
             app.auto.add(&format!("timeline.graph.transformBox.{i}"), hr, "Transform box handle");
             if resp.drag_started() {
                 let opp = [2, 3, 0, 1, 6, 7, 4, 5][i];
@@ -254,8 +255,9 @@ struct AltScale {
     span: Option<f64>,
 }
 
+/// The `egui::Id` of the Timeline Alt-drag group scale in progress ([`AltScale`]).
 fn alt_id() -> egui::Id {
-    egui::Id::new("timeline-alt-scale")
+    egui::Id::unique("timeline-alt-scale")
 }
 
 /// Selected keys' comp-time range.
diff --git a/crates/ui-egui/src/panels/home.rs b/crates/ui-egui/src/panels/home.rs
index 46bbb44fc..3b735e47e 100644
--- a/crates/ui-egui/src/panels/home.rs
+++ b/crates/ui-egui/src/panels/home.rs
@@ -67,21 +67,32 @@ pub fn recent_entries(prefs: &effectcraft_engine::prefs::Prefs) -> Vec<RecentEnt
         .collect()
 }
 
-/// `YYYY-MM-DD HH:MM` (UTC) from Unix seconds.
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month, day and time of day come from chrono and only the year is carried, which keeps every
+/// `i64` exact instead of collapsing out-of-range years to the epoch.
+fn utc_parts(secs: i64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = (secs.div_euclid(86_400), secs.rem_euclid(86_400));
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
+/// Unix seconds → `YYYY-MM-DD HH:MM` (UTC). Years far outside chrono's own range are preserved
+/// (the old hand-rolled conversion kept them) rather than collapsing to the epoch.
 pub fn format_utc(secs: i64) -> String {
-    let days = secs.div_euclid(86_400);
-    let rem = secs.rem_euclid(86_400);
-    // Civil date from days since 1970-01-01 (Howard Hinnant's algorithm).
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z - era * 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + i64::from(m <= 2);
-    format!("{y:04}-{m:02}-{d:02} {:02}:{:02}", rem / 3600, (rem % 3600) / 60)
+    let (y, t) = utc_parts(secs);
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", t.format("%m-%d %H:%M"))
 }
 
 /// How long ago `then` was, as the Home screen's Opened column shows it ("3 hours ago", then the
@@ -95,7 +106,8 @@ pub fn format_ago(now: i64, then: i64) -> String {
         3_600..86_400 => plural(d / 3_600, "{} hour ago", "{} hours ago"),
         86_400..172_800 => tr("Yesterday").to_string(),
         172_800..604_800 => plural(d / 86_400, "{} day ago", "{} days ago"),
-        _ => format_utc(then).get(..10).unwrap_or_default().to_string(),
+        // The date part: up to the space, not a fixed 10 bytes, so a year past 9999 stays whole.
+        _ => format_utc(then).split(' ').next().unwrap_or_default().to_string(),
     }
 }
 
@@ -115,7 +127,7 @@ pub fn format_size(bytes: u64) -> String {
 
 /// The Kind column: what a recent file is, by its extension, in the interface language.
 fn kind_of(path: &str) -> &'static str {
-    tr(match std::path::Path::new(path).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).as_deref() {
+    tr(match std::path::Path::new(path).extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).as_deref() {
         Some("ecproj") => "EffectCraft project",
         Some("aep" | "aepx") => "After Effects project",
         Some("json" | "lottie") => "Lottie animation",
@@ -154,12 +166,13 @@ pub fn encode_thumb(img: &egui::ColorImage) -> String {
     out
 }
 
+/// Decode a stored hex thumbnail, rejecting malformed or non-ASCII text.
 pub fn decode_thumb(text: &str) -> Option<egui::ColorImage> {
     let t = text.trim();
-    if t.len() != THUMB_W * THUMB_H * 6 {
+    if t.len() != THUMB_W * THUMB_H * 6 || !t.is_ascii() {
         return None;
     }
-    let b: Vec<u8> = (0..t.len()).step_by(2).map(|i| u8::from_str_radix(&t[i..i + 2], 16)).collect::<Result<_, _>>().ok()?;
+    let b: Vec<u8> = (0..t.len()).step_by(2).map(|i| u8::from_str_radix(t.get(i..i + 2)?, 16).ok()).collect::<Option<_>>()?;
     let px = b.as_chunks::<3>().0.iter().map(|c| Color32::from_rgb(c[0], c[1], c[2])).collect();
     Some(egui::ColorImage::new([THUMB_W, THUMB_H], px))
 }
@@ -238,7 +251,7 @@ fn rail_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, rail:
     let mut y = rail.min.y + 20.0;
     for (label, id, primary) in [("New Project", "file.newProject", true), ("Open Project…", "file.open", false)] {
         let r = Rect::from_min_size(pos2(x0, y), vec2(w, 34.0));
-        if widgets::text_button(ui, r, tr(label), primary, &t, egui::Id::new(("home", id))).clicked() {
+        if widgets::text_button(ui, r, tr(label), primary, &t, egui::Id::unique(("home", id))).clicked() {
             actions.push((id, json!({})));
         }
         app.auto.add(&format!("home.{id}"), r, label);
@@ -255,7 +268,7 @@ fn rail_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, rail:
     };
     for (k, (label, icon)) in [("Home", Icon::Home), ("Templates", Icon::Grid), ("Learn", Icon::Sparkle)].into_iter().enumerate() {
         let r = Rect::from_min_size(pos2(rail.min.x + 8.0, y), vec2(rail.width() - 16.0, 34.0));
-        let resp = ui.interact(r, egui::Id::new(("home-tab", label)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("home-tab", label)), Sense::click());
         let on = page == k;
         if on || resp.hovered() {
             p.rect_filled(r, 6.0, if on { t.row_selected } else { t.hover });
@@ -286,7 +299,7 @@ fn rail_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, rail:
     cy += 22.0;
     for (icon, label, cmd) in links {
         let r = Rect::from_min_size(pos2(x0, cy), vec2(w, 26.0));
-        let resp = ui.interact(r, egui::Id::new(("home-link", cmd)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("home-link", cmd)), Sense::click());
         let discord = cmd == "help.discord";
         if discord {
             p.rect_filled(r, 13.0, Color32::from_rgb(0x58, 0x65, 0xf2));
@@ -307,7 +320,7 @@ fn rail_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, rail:
     let sw = (w - 6.0) / 2.0;
     for (i, (name, slug)) in sib.iter().enumerate() {
         let r = Rect::from_min_size(pos2(x0 + (i % 2) as f32 * (sw + 6.0), cy + (i / 2) as f32 * 26.0), vec2(sw, 22.0));
-        let resp = ui.interact(r, egui::Id::new(("sib", *slug)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("sib", *slug)), Sense::click());
         p.rect_filled(r, 11.0, if resp.hovered() { t.hover } else { t.field_bg });
         p.text(r.center(), Align2::CENTER_CENTER, *name, Tokens::ui(11.0), t.text);
         app.auto.add(&format!("home.sibling.{slug}"), r, name);
@@ -350,7 +363,7 @@ fn home_page(
     let tw = ((w - gap * 3.0) / 4.0).clamp(120.0, 220.0);
     for (k, (label, id, icon)) in tiles.into_iter().enumerate() {
         let r = Rect::from_min_size(pos2(x0 + k as f32 * (tw + gap), y), vec2(tw, 64.0));
-        let resp = ui.interact(r, egui::Id::new(("home-tile", id)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("home-tile", id)), Sense::click());
         p.rect_filled(r, 8.0, if resp.hovered() { t.hover } else { t.panel_bg });
         p.rect_stroke(r, 8.0, Stroke::new(1.0, if resp.hovered() { t.accent } else { t.separator }), StrokeKind::Inside);
         let ir = Rect::from_center_size(pos2(r.min.x + 30.0, r.center().y), vec2(32.0, 32.0));
@@ -372,7 +385,7 @@ fn home_page(
     // Recent: heading, filter, clear.
     p.text(pos2(x0, y + 12.0), Align2::LEFT_CENTER, tr("Recent"), Tokens::semibold(17.0), t.tab_text_active);
     let entries = recent_entries(&app.session.prefs);
-    let fid = egui::Id::new("home-filter");
+    let fid = egui::Id::unique("home-filter");
     let mut filter: String = ctx.data(|d| d.get_temp(fid)).unwrap_or_default();
     let fr = Rect::from_min_size(pos2(x0 + w - 240.0, y), vec2(240.0, 26.0));
     widgets::search_field(ui, fr, &mut filter, tr("Filter recent files"), &t);
@@ -380,7 +393,7 @@ fn home_page(
     ctx.data_mut(|d| d.insert_temp(fid, filter.clone()));
     if !entries.is_empty() {
         let cr = Rect::from_min_size(pos2(fr.min.x - 96.0, y + 3.0), vec2(84.0, 20.0));
-        let resp = ui.interact(cr, egui::Id::new("home-clear-recent"), Sense::click());
+        let resp = ui.interact(cr, egui::Id::unique("home-clear-recent"), Sense::click());
         p.text(cr.right_center(), Align2::RIGHT_CENTER, tr("Clear list"), Tokens::ui(11.5), if resp.hovered() { t.text } else { t.text_faint });
         app.auto.add("home.clearRecent", cr, "Clear Recent Projects");
         if resp.clicked() {
@@ -417,7 +430,7 @@ fn home_page(
         if r.min.y > area.max.y {
             break;
         }
-        let resp = ui.interact(r, egui::Id::new(("home-recent", e.index)), Sense::click()).on_hover_text(&e.path);
+        let resp = ui.interact(r, egui::Id::unique(("home-recent", e.index)), Sense::click()).on_hover_text(&e.path);
         if resp.hovered() {
             p.rect_filled(r, 6.0, t.hover);
         }
@@ -484,6 +497,12 @@ fn run_actions(app: &mut EffectcraftApp, ctx: &egui::Context, actions: Vec<(&str
 mod tests {
     use super::*;
 
+    #[test]
+    fn non_ascii_thumbnail_is_rejected_without_panicking() {
+        let malformed = format!("aé{}", "0".repeat(THUMB_W * THUMB_H * 6 - 3));
+        assert!(decode_thumb(&malformed).is_none());
+    }
+
     #[test]
     fn recent_list_comes_from_settings() {
         let mut prefs = effectcraft_engine::prefs::Prefs::default();
@@ -510,6 +529,12 @@ mod tests {
         assert_eq!(format_utc(0), "1970-01-01 00:00");
         assert_eq!(format_utc(1_790_000_000), "2026-09-21 14:13");
         assert_eq!(format_utc(951_782_400), "2000-02-29 00:00");
+        // Years far outside chrono's own range are preserved (the old hand-rolled conversion kept
+        // them), including negatives and the i64 extremes, rather than collapsing to the epoch.
+        assert_eq!(format_utc(10_000_000_000_000), "318857-05-20 17:46");
+        assert_eq!(format_utc(-10_000_000_000_000), "-314918-08-13 06:13");
+        assert_eq!(format_utc(i64::MAX), "292277026596-12-04 15:30");
+        assert_eq!(format_utc(i64::MIN), "-292277022657-01-27 08:29");
         let img = egui::ColorImage::new([200, 100], vec![Color32::from_rgb(10, 200, 30); 200 * 100]);
         let text = encode_thumb(&img);
         let back = decode_thumb(&text).unwrap();
@@ -533,20 +558,20 @@ mod tests {
         assert_eq!(format_ago(now, now + 100), "Just now");
         assert_eq!((format_size(900), format_size(13_000), format_size(3_500_000)), ("900 B".into(), "13 KB".into(), "3.3 MB".into()));
         assert_eq!((kind_of("/a/B.ecproj"), kind_of("c.AEP"), kind_of("x")), ("EffectCraft project", "After Effects project", "Project"));
+        // After a week it is the date, whole even for a five-digit year.
+        assert_eq!(format_ago(i64::MAX, 253_402_300_800), "10000-01-01");
     }
 
     /// The Home screen's own text goes through the interface catalog (#574): the Opened and Kind
-    /// columns read in Chinese, and English stays English.
+    /// columns read in the interface language, and English stays English.
     #[test]
     fn home_text_follows_the_interface_language() {
         let now = 1_790_000_000;
         crate::i18n::set_current("zh-hans");
-        let zh = (format_ago(now, now - 5), format_ago(now, now - 3 * 3_600), format_ago(now, now - 90_000), kind_of("/a/B.ecproj"));
-        crate::i18n::set_current("zh-hant");
-        let tw = (format_ago(now, now - 60), kind_of("x"));
+        let shown = (format_ago(now, now - 5), format_ago(now, now - 3 * 3_600), format_ago(now, now - 90_000), kind_of("/a/B.ecproj"));
+        let catalog = (tr("Just now").to_string(), tr_args("{} hours ago", &[&3]), tr("Yesterday").to_string(), tr("EffectCraft project"));
         crate::i18n::set_current("en");
-        assert_eq!(zh, ("刚刚".into(), "3 小时前".into(), "昨天".into(), "EffectCraft 项目"));
-        assert_eq!(tw, ("1 分鐘前".into(), "專案"));
+        assert_eq!(shown, catalog);
         assert_eq!(tr("Filter recent files"), "Filter recent files");
     }
 
diff --git a/crates/ui-egui/src/panels/info.rs b/crates/ui-egui/src/panels/info.rs
index 581e43344..af8e66b25 100644
--- a/crates/ui-egui/src/panels/info.rs
+++ b/crates/ui-egui/src/panels/info.rs
@@ -4,24 +4,42 @@ use crate::i18n::{tr, tr_args};
 use egui::{Align2, Color32, Rect, pos2, vec2};
 
 use crate::theme::Tokens;
-use crate::{EffectcraftApp, widgets};
+use crate::{EffectcraftApp, a11y, widgets};
 
+/// The Info panel: the colour and alpha under the pointer (sampled from the shown viewer frame,
+/// read back for GPU frames) with its position and a swatch, then the selected layers, the current
+/// time, the duration/In/Out of a single selected layer, the achieved preview frame rate, the
+/// render time and queue state (when the preference asks for it) and the selected keyframe's
+/// property, time and value. Read-only: it draws and scrolls but changes no document state.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("info-scroll"), rect);
+    let rect = scroll.content;
     let p = ui.painter().with_clip_rect(rect);
     let x0 = rect.min.x + 12.0;
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("info-scroll"), rect);
     let mut y = rect.min.y + 14.0 - scroll.offset;
-    if app.pointer_comp.is_some() {
+    let comp_size = app.session.active_comp().map_or([1.0, 1.0], |c| [c.width as f32, c.height as f32]);
+    let region = || super::viewer_tools::shown_region(ui.ctx(), comp_size);
+    // 32 bpc (half-float frames): the frame's float values, straight colour as rendered (before
+    // Project Settings ▸ HDR and the viewer's exposure), as After Effects shows them in 32 bpc.
+    let floats = match (app.pointer_comp, app.viewer_f16()) {
+        (Some([cx, cy]), Some(f)) => {
+            let p = super::fx_widgets::frame_pixel_index(f.size(), region(), [cx as f64, cy as f64]).and_then(|i| f.pixel(i));
+            let un = |p: [f32; 4]| {
+                let a = p[3].clamp(0.0, 1.0);
+                if a > 0.0 { [p[0] / a, p[1] / a, p[2] / a, a] } else { [0.0; 4] }
+            };
+            Some((p.map(un), (cx, cy)))
+        }
+        _ => None,
+    };
+    if app.pointer_comp.is_some() && floats.is_none() {
         // GPU frames: read the shown frame back for sampling.
         app.viewer_pixels();
     }
     let (rgba, xy) = match (app.pointer_comp, &app.viewer_image) {
-        (Some([cx, cy]), Some(img)) => {
-            let comp = app.session.active_comp().map_or([1.0, 1.0], |c| [c.width as f32, c.height as f32]);
-            let region = super::viewer_tools::shown_region(ui.ctx(), comp);
-            (super::fx_widgets::frame_pixel(img, region, [cx as f64, cy as f64]), Some((cx, cy)))
-        }
+        _ if floats.is_some() => (None, floats.map(|(_, xy)| xy)),
+        (Some([cx, cy]), Some(img)) => (super::fx_widgets::frame_pixel(img, region(), [cx as f64, cy as f64]), Some((cx, cy))),
         _ => (None, None),
     };
     let row = |p: &egui::Painter, y: f32, k: &str, v: String, col: Color32| {
@@ -37,20 +55,40 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             [f(c.r()), f(c.g()), f(c.b()), a]
         }
     };
-    let px = rgba.map(unpre).unwrap_or([0, 0, 0, 0]);
-    row(&p, y, "R :", format!("{}", px[0]), Color32::from_rgb(0xe0, 0x60, 0x60));
-    row(&p, y + 18.0, "G :", format!("{}", px[1]), Color32::from_rgb(0x60, 0xd0, 0x60));
-    row(&p, y + 36.0, "B :", format!("{}", px[2]), Color32::from_rgb(0x60, 0x90, 0xf0));
-    row(&p, y + 54.0, "A :", format!("{}", px[3]), t.text_dim);
+    let (texts, swatch): ([String; 4], Option<[u8; 4]>) = match floats {
+        Some((p, _)) => (p.unwrap_or([0.0; 4]).map(|v| format!("{v:.4}")), p.map(|p| p.map(|v| (v.clamp(0.0, 1.0) * 255.0 + 0.5) as u8))),
+        None => {
+            let px = rgba.map(unpre).unwrap_or([0, 0, 0, 0]);
+            (px.map(|v| format!("{v}")), rgba.map(|_| px))
+        }
+    };
+    let [tr_, tg, tb, ta] = texts;
+    // The panel paints its text, which assistive technology cannot see: each line is also a
+    // read-out with the same words (a sentence a reader can speak: "Red: 128").
+    let full = rect.width() - 24.0;
+    let say = |key: &str, x: f32, y: f32, w: f32, text: &str| {
+        a11y::readout(ui, egui::Id::unique(("info", key)), Rect::from_min_size(pos2(x, y - 8.0), vec2(w.max(24.0), 16.0)), text);
+    };
+    let half = rect.width() * 0.5 - 16.0;
+    say("r", x0, y, half, &tr_args("Red: {}", &[&tr_]));
+    say("g", x0, y + 18.0, half, &tr_args("Green: {}", &[&tg]));
+    say("b", x0, y + 36.0, half, &tr_args("Blue: {}", &[&tb]));
+    say("a", x0, y + 54.0, half, &tr_args("Alpha: {}", &[&ta]));
+    row(&p, y, "R :", tr_, Color32::from_rgb(0xe0, 0x60, 0x60));
+    row(&p, y + 18.0, "G :", tg, Color32::from_rgb(0x60, 0xd0, 0x60));
+    row(&p, y + 36.0, "B :", tb, Color32::from_rgb(0x60, 0x90, 0xf0));
+    row(&p, y + 54.0, "A :", ta, t.text_dim);
     let cx = rect.min.x + rect.width() * 0.5;
     if let Some((x, yy)) = xy {
+        say("x", cx, y, half, &tr_args("X: {}", &[&format!("{x:.0}")]));
+        say("y", cx, y + 18.0, half, &tr_args("Y: {}", &[&format!("{yy:.0}")]));
         p.text(pos2(cx, y), Align2::LEFT_CENTER, format!("X : {x:.0}"), Tokens::mono(12.0), t.text);
         p.text(pos2(cx, y + 18.0), Align2::LEFT_CENTER, format!("Y : {yy:.0}"), Tokens::mono(12.0), t.text);
     }
-    if let Some(c) = rgba {
+    if let Some(px) = swatch {
         let sw = egui::Rect::from_min_size(pos2(cx, y + 34.0), vec2(36.0, 30.0));
         p.rect_filled(sw, 3.0, Color32::from_rgb(px[0], px[1], px[2]));
-        let _ = c;
+        a11y::graphic(ui, egui::Id::unique(("info", "swatch")), sw, &tr_args("Color under the pointer: {}", &[&format!("{}, {}, {}", px[0], px[1], px[2])]));
     }
     y += 82.0;
     p.line_segment([pos2(rect.min.x + 8.0, y), pos2(rect.max.x - 8.0, y)], egui::Stroke::new(1.0, t.separator));
@@ -60,14 +98,12 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     if let Some(c) = comp {
         let sel: Vec<String> = app.session.state.selected_layers.iter().filter_map(|id| c.layer(*id)).map(|l| l.name.clone()).collect();
         let tc = crate::panels::timecode(&app.session, &c, app.session.time());
-        p.text(
-            pos2(x0, y),
-            Align2::LEFT_CENTER,
-            if sel.is_empty() { tr("No layer selected").to_string() } else { sel.join(", ") },
-            Tokens::semibold(12.0),
-            t.text,
-        );
-        p.text(pos2(x0, y + 18.0), Align2::LEFT_CENTER, tr_args("Time: {}", &[&tc]), Tokens::ui(12.0), t.text_dim);
+        let selection = if sel.is_empty() { tr("No layer selected").to_string() } else { sel.join(", ") };
+        p.text(pos2(x0, y), Align2::LEFT_CENTER, &selection, Tokens::semibold(12.0), t.text);
+        say("selection", x0, y, full, &tr_args("Selected layers: {}", &[&selection]));
+        let time_line = tr_args("Time: {}", &[&tc]);
+        p.text(pos2(x0, y + 18.0), Align2::LEFT_CENTER, &time_line, Tokens::ui(12.0), t.text_dim);
+        say("time", x0, y + 18.0, full, &time_line);
         // One layer selected: Duration, In and Out like AE's Info panel.
         let mut ly = y + 36.0;
         if let [id] = app.session.state.selected_layers.as_slice()
@@ -84,8 +120,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 }),
                 format!("In: {}, Out: {}", tc(l.in_point), tc(effectcraft_engine::time::Tick(l.out_point.0 - c.frame_duration().0))),
             ];
-            for line in lines {
-                p.text(pos2(x0, ly), Align2::LEFT_CENTER, line, Tokens::ui(12.0), t.text_dim);
+            for (k, line) in lines.into_iter().enumerate() {
+                p.text(pos2(x0, ly), Align2::LEFT_CENTER, &line, Tokens::ui(12.0), t.text_dim);
+                say(if k == 0 { "duration" } else { "inout" }, x0, ly, full, &line);
                 ly += 18.0;
             }
         }
@@ -93,6 +130,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         if let (Some(fps), Some(rt)) = (app.playback.achieved_fps(), app.playback.real_time()) {
             let note = if rt { "real-time" } else { "not real-time" };
             p.text(pos2(x0, ly), Align2::LEFT_CENTER, format!("{fps:.2} fps ({note})"), Tokens::ui(11.5), if rt { t.text_dim } else { t.warning });
+            say("fps", x0, ly, full, &format!("{fps:.2} fps ({note})"));
             app.auto.add("info.previewFps", Rect::from_min_size(pos2(x0, ly - 8.0), vec2(200.0, 16.0)), &format!("{fps:.2} fps ({note})"));
             ly += 18.0;
         }
@@ -100,13 +138,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         if app.session.prefs.composition.show_rendering_progress {
             let ms = app.frames.last_ms.lock().map(|v| *v).unwrap_or(0.0);
             let rq = app.session.render_job.as_ref().map(|_| "  •  Rendering queue…").unwrap_or("");
-            p.text(
-                pos2(x0, ly),
-                Align2::LEFT_CENTER,
-                tr_args("Render: {} ms  •  UI {} fps{}", &[&format!("{ms:.0}"), &format!("{:.0}", app.fps), &rq]),
-                Tokens::ui(11.5),
-                t.text_faint,
-            );
+            let render_line = tr_args("Render: {} ms  •  UI {} fps{}", &[&format!("{ms:.0}"), &format!("{:.0}", app.fps), &rq]);
+            p.text(pos2(x0, ly), Align2::LEFT_CENTER, &render_line, Tokens::ui(11.5), t.text_faint);
+            say("render", x0, ly, full, &render_line);
         }
         if !app.session.state.selected_keys.is_empty() {
             // One key: its property, time and value (as After Effects' Info panel shows them).
@@ -127,7 +161,8 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 _ => None,
             };
             let line = one.unwrap_or_else(|| format!("{} keyframes selected", sel.len()));
-            p.text(pos2(x0, ly + 18.0), Align2::LEFT_CENTER, line, Tokens::ui(11.5), t.text_dim);
+            p.text(pos2(x0, ly + 18.0), Align2::LEFT_CENTER, &line, Tokens::ui(11.5), t.text_dim);
+            say("keys", x0, ly + 18.0, full, &line);
         }
         bottom = ly + 30.0;
     }
diff --git a/crates/ui-egui/src/panels/key_dialogs.rs b/crates/ui-egui/src/panels/key_dialogs.rs
index 73f76aaaa..db3144ffd 100644
--- a/crates/ui-egui/src/panels/key_dialogs.rs
+++ b/crates/ui-egui/src/panels/key_dialogs.rs
@@ -125,8 +125,16 @@ fn buttons(ui: &mut egui::Ui, app: &mut EffectcraftApp, t: &Tokens, prefix: &str
     (ok, cancel)
 }
 
-fn drag(ui: &mut egui::Ui, app: &mut EffectcraftApp, id: &str, v: &mut f64, speed: f64, range: std::ops::RangeInclusive<f64>, suffix: &str, enabled: bool) {
-    let r = ui.add_enabled(enabled, crate::widgets::drag_value(egui::DragValue::new(v).speed(speed).range(range).max_decimals(2).suffix(suffix)));
+/// Drag speed, clamp range and suffix of a [`drag`] field.
+struct DragSpec<'a> {
+    speed: f64,
+    range: std::ops::RangeInclusive<f64>,
+    suffix: &'a str,
+}
+
+fn drag(ui: &mut egui::Ui, app: &mut EffectcraftApp, id: &str, v: &mut f64, spec: DragSpec, enabled: bool) {
+    let r =
+        ui.add_enabled(enabled, crate::widgets::drag_value(egui::DragValue::new(v).speed(spec.speed).range(spec.range).max_decimals(2).suffix(spec.suffix)));
     app.auto.add(id, r.rect, id);
 }
 
@@ -147,20 +155,20 @@ pub fn velocity(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                     ui.horizontal(|ui| {
                         ui.label(tr("Speed:"));
                         let v = if out { &mut d.out_speed[dim] } else { &mut d.in_speed[dim] };
-                        drag(ui, app, &format!("dialog.velocity.{side}Speed.{dim}"), v, 1.0, -1e7..=1e7, "", enabled);
+                        drag(ui, app, &format!("dialog.velocity.{side}Speed.{dim}"), v, DragSpec { speed: 1.0, range: -1e7..=1e7, suffix: "" }, enabled);
                         ui.label(egui::RichText::new(&d.units).color(t.text_dim));
                     });
                     ui.horizontal(|ui| {
                         ui.label(tr("Influence:"));
                         let v = if out { &mut d.out_inf[dim] } else { &mut d.in_inf[dim] };
-                        drag(ui, app, &format!("dialog.velocity.{side}Influence.{dim}"), v, 0.2, 0.1..=100.0, " %", enabled);
+                        drag(ui, app, &format!("dialog.velocity.{side}Influence.{dim}"), v, DragSpec { speed: 0.2, range: 0.1..=100.0, suffix: " %" }, enabled);
                     });
                     ui.end_row();
                 }
             });
             ui.add_space(8.0);
         }
-        let r = ui.checkbox(&mut d.continuous, tr("Continuous (Lock Outgoing to Incoming)"));
+        let r = crate::widgets::labelled_checkbox(ui, &mut d.continuous, tr("Continuous (Lock Outgoing to Incoming)"));
         app.auto.add("dialog.velocity.continuous", r.rect, "Continuous");
         if d.continuous {
             d.out_speed = d.in_speed.clone();
@@ -191,7 +199,7 @@ pub fn velocity(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
 fn combo(ui: &mut egui::Ui, app: &mut EffectcraftApp, id: &str, sel: &mut usize, opts: &[&str], enabled: bool) {
     ui.add_enabled_ui(enabled, |ui| {
         // The options are the English source strings; the automation id and label stay English.
-        let r = egui::ComboBox::from_id_salt(id).width(200.0).selected_text(tr(opts[*sel])).show_ui(ui, |ui| {
+        let r = craft_ui::ComboBox::from_id_salt(id).width(200.0).selected_text(tr(opts[*sel])).show_ui(ui, |ui| {
             for (i, o) in opts.iter().enumerate() {
                 ui.selectable_value(sel, i, tr(o));
             }
@@ -254,16 +262,28 @@ pub fn time_stretch(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             ui.end_row();
             ui.label(tr("Stretch Factor:"));
             let before = d.percent;
-            drag(ui, app, "dialog.timeStretch.percent", &mut d.percent, 0.5, -10000.0..=10000.0, " %", true);
+            drag(
+                ui,
+                app,
+                "dialog.timeStretch.percent",
+                &mut d.percent,
+                DragSpec { speed: 0.5, range: -effectcraft_project::limits::MAX_STRETCH..=effectcraft_project::limits::MAX_STRETCH, suffix: " %" },
+                true,
+            );
             if (before - d.percent).abs() > 1e-9 && d.orig_percent.abs() > 1e-9 {
                 d.duration = d.orig_duration * d.percent.abs() / d.orig_percent.abs();
             }
             ui.end_row();
             ui.label(tr("New Duration:"));
             let before = d.duration;
-            drag(ui, app, "dialog.timeStretch.duration", &mut d.duration, 0.05, 0.01..=100000.0, " s", true);
+            drag(ui, app, "dialog.timeStretch.duration", &mut d.duration, DragSpec { speed: 0.05, range: 0.01..=100000.0, suffix: " s" }, true);
             if (before - d.duration).abs() > 1e-9 && d.orig_duration > 1e-9 {
-                d.percent = d.orig_percent.signum() * d.orig_percent.abs() * d.duration / d.orig_duration;
+                let wanted = d.orig_percent.signum() * d.orig_percent.abs() * d.duration / d.orig_duration;
+                // Within what Time Stretch accepts (±1 % to ±9900 %, #3247); the duration follows.
+                d.percent = effectcraft_project::limits::stretch(wanted);
+                if d.percent.to_bits() != wanted.to_bits() && d.orig_percent.abs() > 1e-9 {
+                    d.duration = d.orig_duration * d.percent.abs() / d.orig_percent.abs();
+                }
             }
             ui.end_row();
         });
diff --git a/crates/ui-egui/src/panels/layer_panel.rs b/crates/ui-egui/src/panels/layer_panel.rs
index e5d8e4e0d..e23e11cfb 100644
--- a/crates/ui-egui/src/panels/layer_panel.rs
+++ b/crates/ui-egui/src/panels/layer_panel.rs
@@ -40,12 +40,16 @@ struct Tex {
     rect: [f64; 4],
 }
 
+/// The `egui::Id` of the cached render of the layer shown in this panel ([`Tex`]), with the key
+/// the image was made from.
 fn tex_id() -> egui::Id {
-    egui::Id::new("layer-panel-tex")
+    egui::Id::unique("layer-panel-tex")
 }
 
+/// The `egui::Id` under which the panel's last Fit magnification is kept, so View ▸ Zoom In/Out
+/// can start from it (see [`last_fit`]).
 fn fit_id() -> egui::Id {
-    egui::Id::new("layer-panel-fit")
+    egui::Id::unique("layer-panel-fit")
 }
 
 /// The Layer panel's last Fit magnification (points per layer pixel), for View ▸ Zoom In / Zoom
@@ -83,6 +87,158 @@ fn default_view(layer: &Layer, tool: Tool) -> usize {
     }
 }
 
+/// The layer's rendered view `view` at `scale`, cached in egui's temp data per revision, layer,
+/// time, view and scale (the layer cache makes repeats cheap).
+fn render_tex(
+    app: &EffectcraftApp,
+    ctx: &egui::Context,
+    cid: effectcraft_engine::project::ItemId,
+    comp: &effectcraft_engine::project::Comp,
+    layer: &Layer,
+    view: usize,
+    scale: f64,
+) -> Option<Tex> {
+    let time = app.session.time();
+    let key = (app.session.revision, layer.id.0, time.0, view, (scale * 1000.0) as u32);
+    let cached: Option<Tex> = ctx.data(|d| d.get_temp(tex_id()));
+    match cached {
+        Some(c) if c.key == key => Some(c),
+        _ => {
+            let ectx = EvalCtx {
+                project: &app.session.project,
+                comp_id: cid,
+                comp,
+                time,
+                expr: app.session.expr.as_deref(),
+                footage: None,
+                property_overrides: &[],
+                media_overrides: &[],
+                reads: None,
+            };
+            let mut r = Renderer::new(&app.session.project, &*app.session.footage, RenderOpts { scale, ..Default::default() });
+            r.expr = app.session.expr.as_deref();
+            r.cache = Some(&app.session.layer_cache);
+            r.layer_input(&ectx, layer, view).map(|buf| {
+                let img = crate::frames::to_color_image(&buf.img);
+                let x0 = -buf.offset[0] / buf.scale;
+                let y0 = -buf.offset[1] / buf.scale;
+                let rect = [x0, y0, x0 + buf.img.width as f64 / buf.scale, y0 + buf.img.height as f64 / buf.scale];
+                let tex = crate::frames::load_fitted(ctx, "layer-panel", img, egui::TextureOptions::LINEAR);
+                let c = Tex { key, tex, rect };
+                ctx.data_mut(|d| d.insert_temp(tex_id(), c.clone()));
+                c
+            })
+        }
+    }
+}
+
+/// What [`paint_stroke`] needs about the brush and the layer <-> screen mapping.
+#[derive(Clone, Copy)]
+struct StrokeCtx<'a> {
+    layer: u64,
+    kind: &'a str,
+    zoom: f64,
+    did: egui::Id,
+    diameter: f64,
+    color: [f64; 4],
+    to_layer: &'a dyn Fn(Pos2) -> [f64; 2],
+    to_screen: &'a dyn Fn([f64; 2]) -> Pos2,
+}
+
+/// Records a paint stroke's layer-space points while dragging, previews it, and runs
+/// `paint.stroke` on release (or on a click).
+fn paint_stroke(app: &mut EffectcraftApp, ui: &egui::Ui, painter: &egui::Painter, resp: &egui::Response, sc: &StrokeCtx) {
+    let StrokeCtx { layer, kind, zoom, did, diameter, color, to_layer, to_screen } = *sc;
+    let ctx = ui.ctx().clone();
+    let now = ui.input(|i| i.time);
+    if resp.drag_started()
+        && let Some(pos) = ui.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
+    {
+        ctx.data_mut(|d| d.insert_temp(did, Drag { layer, points: vec![to_layer(pos)], started: now }));
+    }
+    if let Some(mut d) = ctx.data(|d| d.get_temp::<Drag>(did)) {
+        if let Some(pos) = resp.interact_pointer_pos() {
+            let lp = to_layer(pos);
+            let last = d.points.last().copied().unwrap_or(lp);
+            if (lp[0] - last[0]).hypot(lp[1] - last[1]) * zoom >= 1.0 {
+                d.points.push(lp);
+                ctx.data_mut(|dd| dd.insert_temp(did, d.clone()));
+            }
+        }
+        // Live preview of the stroke.
+        let col = if kind == "eraser" {
+            Color32::from_white_alpha(140)
+        } else {
+            Color32::from_rgba_unmultiplied((color[0] * 255.0) as u8, (color[1] * 255.0) as u8, (color[2] * 255.0) as u8, 200)
+        };
+        let width = ((diameter * zoom) as f32).max(1.0);
+        let pts: Vec<Pos2> = d.points.iter().map(|q| to_screen(*q)).collect();
+        if pts.len() == 1 {
+            painter.circle_filled(pts[0], width / 2.0, col);
+        } else {
+            painter.add(egui::Shape::line(pts, Stroke::new(width, col)));
+        }
+        if resp.drag_stopped() {
+            ctx.data_mut(|dd| dd.remove::<Drag>(did));
+            let pts: Vec<[f64; 2]> = d.points.clone();
+            let r = app.session.execute("paint.stroke", json!({"layer": d.layer, "kind": kind, "points": pts, "duration": (now - d.started).max(0.0)}));
+            if let Err(e) = r {
+                app.ui.status = e.to_string();
+            }
+        }
+    }
+    if resp.clicked()
+        && let Some(pos) = resp.interact_pointer_pos()
+    {
+        let r = app.session.execute("paint.stroke", json!({"layer": layer, "kind": kind, "points": [to_layer(pos)], "duration": 0.0}));
+        if let Err(e) = r {
+            app.ui.status = e.to_string();
+        }
+    }
+}
+
+/// The bottom bar: the magnification menu and the View menu over `names` (Masks, then the
+/// effects). Returns where the View dropdown ends.
+fn bottom_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, bar: Rect, names: &[String], view: usize, (zoom, fit): (f64, f32)) -> f32 {
+    let t = app.tokens;
+    p.rect_filled(bar, 0.0, t.panel_bg);
+    let mr = Rect::from_min_size(pos2(bar.min.x + 8.0, bar.center().y - 10.0), vec2(80.0, 20.0));
+    if let Some((z, up)) = super::viewer_tools::magnification_menu(
+        app,
+        ui,
+        mr,
+        "layer-mag",
+        "layerPanel.magnification",
+        "layerMagnification",
+        zoom as f32,
+        app.ui.layer_zoom,
+        false,
+    ) {
+        // The Layer panel keeps no fit mode: Fit up to 100% is the fit, at most 100 %.
+        app.ui.layer_zoom = if up { Some(fit.min(1.0 / ui.ctx().pixels_per_point())) } else { z };
+        app.ui.layer_pan = [0.0, 0.0];
+    }
+    let vx = mr.max.x + 10.0;
+    p.text(pos2(vx, bar.center().y), Align2::LEFT_CENTER, tr("View:"), Tokens::ui(12.0), t.text_dim);
+    let vr = Rect::from_min_size(pos2(vx + 36.0, bar.center().y - 10.0), vec2(150.0, 20.0));
+    let pop = egui::Id::unique("layer-view-pop");
+    if widgets::dropdown(ui, vr, &names[view.min(names.len() - 1)], &t, egui::Id::unique("layer-view")).clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add("layerPanel.view", vr, "View");
+    if let Some(i) = widgets::popup_menu(ui, pop, vr.left_bottom(), names, Some(view)) {
+        app.ui.layer_view = Some(i);
+    }
+    vr.max.x
+}
+
+/// The Layer panel: one layer in its own space with its masks and effects up to the View menu's
+/// choice, rendered synchronously at a zoom/pan the panel keeps (the last Fit magnification is
+/// published for the View menu). Wheel or pinch zooms about the pointer, the Hand tool or
+/// Space-drag pans, and the Zoom tool clicks zoom. The paint tools record a stroke's layer-space
+/// points while dragging and run `paint.stroke` on release (or on a click); Alt-click with the
+/// Clone Stamp sets its source. With a Roto Brush effect it hands the canvas to
+/// [`super::roto_tool`]. Without a current layer it shows how to open one.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -119,44 +275,17 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     };
     let origin = area.center() + pan - vec2((lw * zoom / 2.0) as f32, (lh * zoom / 2.0) as f32);
 
-    // Bottom bar: magnification and View menus.
-    p.rect_filled(bar, 0.0, t.panel_bg);
-    let mr = Rect::from_min_size(pos2(bar.min.x + 8.0, bar.center().y - 10.0), vec2(80.0, 20.0));
-    if let Some((z, up)) = super::viewer_tools::magnification_menu(
-        app,
-        ui,
-        mr,
-        "layer-mag",
-        "layerPanel.magnification",
-        "layerMagnification",
-        zoom as f32,
-        app.ui.layer_zoom,
-        false,
-    ) {
-        // The Layer panel keeps no fit mode: Fit up to 100% is the fit, at most 100 %.
-        app.ui.layer_zoom = if up { Some(fit.min(1.0 / ui.ctx().pixels_per_point())) } else { z };
-        app.ui.layer_pan = [0.0, 0.0];
-    }
-    let vx = mr.max.x + 10.0;
-    p.text(pos2(vx, bar.center().y), Align2::LEFT_CENTER, tr("View:"), Tokens::ui(12.0), t.text_dim);
     let mut names = vec!["Masks".to_string()];
     if let Some(fx) = layer.effects() {
         names.extend(fx.groups().map(|g| g.name.clone()));
     }
-    let vr = Rect::from_min_size(pos2(vx + 36.0, bar.center().y - 10.0), vec2(150.0, 20.0));
-    let pop = egui::Id::new("layer-view-pop");
-    if widgets::dropdown(ui, vr, &names[view.min(names.len() - 1)], &t, egui::Id::new("layer-view")).clicked() {
-        widgets::open_popup(ui, pop);
-    }
-    app.auto.add("layerPanel.view", vr, "View");
-    if let Some(i) = widgets::popup_menu(ui, pop, vr.left_bottom(), &names, Some(view)) {
-        app.ui.layer_view = Some(i);
-    }
+    let vr_right = bottom_bar(app, ui, &p, bar, &names, view, (zoom, fit));
+
     let tc = super::timecode(&app.session, &comp, time);
     p.text(pos2(bar.max.x - 10.0, bar.center().y), Align2::RIGHT_CENTER, tc, Tokens::mono(12.0), t.timecode);
     // Roto Brush: view / Freeze buttons and the segmentation span bar.
     if roto.is_some() {
-        super::roto_tool::bar_buttons(app, ui, &p, bar, vr.max.x + 12.0, &layer);
+        super::roto_tool::bar_buttons(app, ui, &p, bar, vr_right + 12.0, &layer);
         let sb = Rect::from_min_max(pos2(rect.min.x, canvas_bottom), pos2(rect.max.x, bar.min.y));
         super::roto_tool::span_bar(app, ui, &p, sb, &comp, &layer);
     }
@@ -179,27 +308,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     } else {
         0.25
     };
-    let key = (app.session.revision, layer.id.0, time.0, view, (scale * 1000.0) as u32);
-    let cached: Option<Tex> = ctx.data(|d| d.get_temp(tex_id()));
-    let tex = match cached {
-        Some(c) if c.key == key => Some(c),
-        _ => {
-            let ectx = EvalCtx { project: &app.session.project, comp_id: cid, comp: &comp, time, expr: app.session.expr.as_deref(), footage: None };
-            let mut r = Renderer::new(&app.session.project, &*app.session.footage, RenderOpts { scale, ..Default::default() });
-            r.expr = app.session.expr.as_deref();
-            r.cache = Some(&app.session.layer_cache);
-            r.layer_input(&ectx, &layer, view).map(|buf| {
-                let img = crate::frames::to_color_image(&buf.img);
-                let x0 = -buf.offset[0] / buf.scale;
-                let y0 = -buf.offset[1] / buf.scale;
-                let rect = [x0, y0, x0 + buf.img.width as f64 / buf.scale, y0 + buf.img.height as f64 / buf.scale];
-                let tex = crate::frames::load_fitted(&ctx, "layer-panel", img, egui::TextureOptions::LINEAR);
-                let c = Tex { key, tex, rect };
-                ctx.data_mut(|d| d.insert_temp(tex_id(), c.clone()));
-                c
-            })
-        }
-    };
+    let tex = render_tex(app, &ctx, cid, &comp, &layer, view, scale);
     if let Some(tx) = &tex {
         let r = Rect::from_min_max(to_screen([tx.rect[0], tx.rect[1]]), to_screen([tx.rect[2], tx.rect[3]]));
         painter.image(tx.tex.id(), r, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
@@ -211,13 +320,17 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     app.auto.add("layerPanel.canvas", frame, &layer.name);
     app.auto.add("layerPanel.area", area, "Layer panel");
 
-    // Navigation (as the Composition panel): the wheel / pinch zooms around the pointer with any
-    // tool; the Hand tool or Space-drag pans and the Zoom tool clicks zoom in (Alt: out).
+    // Navigation (as the Composition panel): the wheel / pinch zooms around the pointer and a
+    // two-finger trackpad scroll pans with any tool; the Hand tool or Space-drag pans and the
+    // Zoom tool clicks zoom in (Alt: out).
     let hovered = ui.rect_contains_pointer(area);
     if let Some(hp) = ui.input(|i| i.pointer.hover_pos()).filter(|_| hovered) {
-        let scroll = ui.input(|i| i.smooth_scroll_delta.y + i.zoom_delta().ln() * 300.0);
-        if scroll.is_finite() && scroll.abs() > 0.1 {
-            zoom_at(app, area, [lw, lh], hp, to_layer(hp), zoom as f32 * (scroll / 300.0).exp());
+        let scroll = super::viewer_scroll(&ctx);
+        if (scroll.zoom - 1.0).abs() > 3e-4 {
+            zoom_at(app, area, [lw, lh], hp, to_layer(hp), zoom as f32 * scroll.zoom);
+        } else if scroll.pan != egui::Vec2::ZERO {
+            app.ui.layer_zoom.get_or_insert(zoom as f32);
+            app.ui.layer_pan = [pan.x + scroll.pan.x, pan.y + scroll.pan.y];
         }
     }
     // A middle-drag pans with any tool; painting and Roto Brush strokes don't run meanwhile.
@@ -233,7 +346,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     let space = super::space_hand(&ctx);
     if space || matches!(app.ui.tool, Tool::Hand | Tool::Zoom) {
-        let resp = ui.interact(area, egui::Id::new("layer-panel-nav"), Sense::click_and_drag());
+        let resp = ui.interact(area, egui::Id::unique("layer-panel-nav"), Sense::click_and_drag());
         let alt = ui.input(|i| i.modifiers.alt);
         if resp.hovered() {
             ctx.set_cursor_icon(match app.ui.tool {
@@ -260,14 +373,14 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     // Interaction: Roto Brush / Refine Edge.
     if app.ui.tool.roto_kind(false).is_some() {
-        super::roto_tool::interact(app, ui, &painter, area, &layer, zoom, &to_screen, &to_layer);
+        super::roto_tool::interact(app, ui, &painter, area, &layer, zoom, super::roto_tool::LayerXform { to_screen: &to_screen, to_layer: &to_layer });
         return;
     }
     // Interaction: paint tools.
-    let resp = ui.interact(area, egui::Id::new("layer-panel-interact"), Sense::click_and_drag());
+    let resp = ui.interact(area, egui::Id::unique("layer-panel-interact"), Sense::click_and_drag());
     let kind = app.ui.tool.paint_kind();
     let o = app.session.state.paint.clone();
-    let did = egui::Id::new("layer-panel-drag");
+    let did = egui::Id::unique("layer-panel-drag");
     if let Some(hp) = resp.hover_pos() {
         let lp = to_layer(hp);
         app.pointer_comp = Some([lp[0] as f32, lp[1] as f32]);
@@ -303,7 +416,6 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         painter.line_segment([s - vec2(0.0, 6.0), s + vec2(0.0, 6.0)], Stroke::new(1.0, Color32::WHITE));
     }
     let mods = ui.input(|i| i.modifiers);
-    let now = ui.input(|i| i.time);
     // Alt/Option-click with the Clone Stamp sets the source.
     if app.ui.tool == Tool::Clone
         && mods.alt
@@ -317,49 +429,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     if let Some(kind) = kind
         && !mods.alt
     {
-        if resp.drag_started()
-            && let Some(pos) = ui.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
-        {
-            ctx.data_mut(|d| d.insert_temp(did, Drag { layer: layer.id.0, points: vec![to_layer(pos)], started: now }));
-        }
-        if let Some(mut d) = ctx.data(|d| d.get_temp::<Drag>(did)) {
-            if let Some(pos) = resp.interact_pointer_pos() {
-                let lp = to_layer(pos);
-                let last = d.points.last().copied().unwrap_or(lp);
-                if (lp[0] - last[0]).hypot(lp[1] - last[1]) * zoom >= 1.0 {
-                    d.points.push(lp);
-                    ctx.data_mut(|dd| dd.insert_temp(did, d.clone()));
-                }
-            }
-            // Live preview of the stroke.
-            let col = if kind == "eraser" {
-                Color32::from_white_alpha(140)
-            } else {
-                Color32::from_rgba_unmultiplied((o.color[0] * 255.0) as u8, (o.color[1] * 255.0) as u8, (o.color[2] * 255.0) as u8, 200)
-            };
-            let width = ((o.diameter * zoom) as f32).max(1.0);
-            let pts: Vec<Pos2> = d.points.iter().map(|q| to_screen(*q)).collect();
-            if pts.len() == 1 {
-                painter.circle_filled(pts[0], width / 2.0, col);
-            } else {
-                painter.add(egui::Shape::line(pts, Stroke::new(width, col)));
-            }
-            if resp.drag_stopped() {
-                ctx.data_mut(|dd| dd.remove::<Drag>(did));
-                let pts: Vec<[f64; 2]> = d.points.clone();
-                let r = app.session.execute("paint.stroke", json!({"layer": d.layer, "kind": kind, "points": pts, "duration": (now - d.started).max(0.0)}));
-                if let Err(e) = r {
-                    app.ui.status = e.to_string();
-                }
-            }
-        }
-        if resp.clicked()
-            && let Some(pos) = resp.interact_pointer_pos()
-        {
-            let r = app.session.execute("paint.stroke", json!({"layer": layer.id.0, "kind": kind, "points": [to_layer(pos)], "duration": 0.0}));
-            if let Err(e) = r {
-                app.ui.status = e.to_string();
-            }
-        }
+        let stroke = StrokeCtx { layer: layer.id.0, kind, zoom, did, diameter: o.diameter, color: o.color, to_layer: &to_layer, to_screen: &to_screen };
+        paint_stroke(app, ui, &painter, &resp, &stroke);
     }
 }
diff --git a/crates/ui-egui/src/panels/layer_styles_dialog.rs b/crates/ui-egui/src/panels/layer_styles_dialog.rs
index c0b03f77e..09b775e30 100644
--- a/crates/ui-egui/src/panels/layer_styles_dialog.rs
+++ b/crates/ui-egui/src/panels/layer_styles_dialog.rs
@@ -5,8 +5,10 @@
 //! edits made in the dialog back, OK keeps them (one undo step per control drag).
 
 use crate::i18n::tr;
+use effectcraft_engine::commands::text_edit::active_editor_snapshot;
 use effectcraft_engine::keyframe::Value as KV;
-use effectcraft_engine::project::styles::{BLENDING, STYLES};
+use effectcraft_engine::project::build::Ids;
+use effectcraft_engine::project::styles::{BLENDING, GROUP, STYLES, blending_options};
 use effectcraft_engine::project::{Layer, LayerId, ParamUi, Property};
 use egui::vec2;
 use serde_json::{Value, json};
@@ -21,12 +23,15 @@ pub struct LayerStyleState {
     pub selected: String,
     pub undo_mark: usize,
     checkpoint: Option<Checkpoint>,
+    /// The Gradient Editor opened from this dialog: closing it comes back here (#2057).
+    pub gradient_open: bool,
 }
 
+/// The project and undo history as a dialog found them, for a Cancel that rolls its live edits back.
 #[derive(Clone)]
-struct Checkpoint {
-    project: std::sync::Arc<effectcraft_engine::project::Project>,
-    history: effectcraft_engine::history::History,
+pub(crate) struct Checkpoint {
+    pub(crate) project: std::sync::Arc<effectcraft_engine::project::Project>,
+    pub(crate) history: effectcraft_engine::history::History,
 }
 
 impl std::fmt::Debug for Checkpoint {
@@ -35,7 +40,7 @@ impl std::fmt::Debug for Checkpoint {
     }
 }
 
-fn checkpoint(app: &mut EffectcraftApp) -> Checkpoint {
+pub(crate) fn checkpoint(app: &mut EffectcraftApp) -> Checkpoint {
     app.session.history.merge_key = None;
     Checkpoint { project: app.session.project.clone(), history: app.session.history.clone() }
 }
@@ -55,12 +60,13 @@ pub fn open(app: &mut EffectcraftApp, params: &Value) -> Result<(), String> {
         return Err(format!("unknown layer style `{style}`"));
     }
     let checkpoint = checkpoint(app);
-    app.dialog_state.layer_style = LayerStyleState { layer, selected: style, undo_mark: app.session.history.undo.len(), checkpoint: Some(checkpoint) };
+    app.dialog_state.layer_style =
+        LayerStyleState { layer, selected: style, undo_mark: app.session.history.undo.len(), checkpoint: Some(checkpoint), gradient_open: false };
     app.dialog = Some(Dialog::LayerStyles);
     Ok(())
 }
 
-/// Menu routing: choosing one of the Layer ▸ Layer Styles ▸ <style> items (no parameters) adds
+/// Menu routing: choosing one of the Layer ▸ Layer Styles ▸ `<style>` items (no parameters) adds
 /// the style as usual and opens the dialog on it.
 pub fn route(app: &mut EffectcraftApp, id: &str, params: &Value) -> Result<bool, String> {
     let Some(style) = id.strip_prefix("layer.style.").filter(|s| STYLES.iter().any(|x| x.0 == *s)) else { return Ok(false) };
@@ -86,11 +92,11 @@ fn control(ui: &mut egui::Ui, p: &Property, v: &KV) -> Option<Value> {
     match (v, &p.ui) {
         (KV::Bool(b), _) => {
             let mut on = *b;
-            ui.checkbox(&mut on, "").changed().then(|| json!(on))
+            crate::widgets::labelled_checkbox(ui, &mut on, "").changed().then(|| json!(on))
         }
         (KV::Enum(i), ParamUi::Popup { options }) => {
             let mut sel = *i as usize;
-            egui::ComboBox::from_id_salt(("ls-popup", p.uid)).selected_text(options.get(sel).cloned().unwrap_or_default()).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt(("ls-popup", p.uid)).selected_text(options.get(sel).cloned().unwrap_or_default()).show_ui(ui, |ui| {
                 for (k, o) in options.iter().enumerate() {
                     ui.selectable_value(&mut sel, k, o);
                 }
@@ -115,10 +121,6 @@ fn control(ui: &mut egui::Ui, p: &Property, v: &KV) -> Option<Value> {
             let changed = crate::widgets::srgb_color_button(ui, &mut rgb).changed();
             changed.then(|| json!(rgb))
         }
-        (KV::Gradient(_), _) => {
-            ui.label(egui::RichText::new(tr("Edit in the Timeline")).weak());
-            None
-        }
         _ => {
             ui.label(egui::RichText::new(format!("{v:?}").chars().take(24).collect::<String>()).weak());
             None
@@ -133,6 +135,10 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     };
     let lid = l.id.0;
     let styles = l.layer_styles().cloned();
+    // Shown only: its uids are never stored in the project.
+    let mut next = app.session.project.next_id;
+    let blending_template =
+        if styles.is_none() && l.can_have_styles() { app.session.active_comp().map(|c| blending_options(&mut Ids(&mut next), &c.global_light)) } else { None };
     let sel = app.dialog_state.layer_style.selected.clone();
     let time = app.session.time();
     let lt = l.layer_time(time);
@@ -170,7 +176,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                             if id != BLENDING {
                                 let g = styles.as_ref().and_then(|s| s.sub(id));
                                 let mut on = g.is_some_and(|g| g.enabled);
-                                if ui.checkbox(&mut on, "").changed() {
+                                if crate::widgets::labelled_checkbox(ui, &mut on, "").changed() {
                                     if g.is_none() {
                                         actions.push(("layer.style.add".into(), json!({"layers": [lid], "style": id})));
                                     } else {
@@ -197,7 +203,10 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                 let head = ui.label(egui::RichText::new(name).font(Tokens::semibold(13.0)));
                 app.auto.add("dialog.layerStyle.page", head.rect, &sel);
                 ui.add_space(6.0);
-                let Some(g) = styles.as_ref().and_then(|s| s.sub(&sel)) else {
+                // A layer with no styles still shows Blending Options, with the values the Layer
+                // Styles group would start from; the first change creates the group (#1389).
+                let missing = blending_template.as_ref().filter(|_| sel == BLENDING && styles.is_none());
+                let Some(g) = styles.as_ref().and_then(|s| s.sub(&sel)).or(missing) else {
                     ui.label(egui::RichText::new(tr("Not applied: tick it in the list to add it.")).weak());
                     return;
                 };
@@ -218,14 +227,35 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                                 }
                                 let lbl = ui.label(&p.name);
                                 let v = p.value_at(lt);
-                                let edit = ui.scope(|ui| control(ui, p, &v));
-                                if let Some(nv) = edit.inner {
-                                    actions.push((
-                                        "prop.set".into(),
-                                        json!({"layer": lid, "prop": p.uid, "value": nv, "merge": format!("layer-style-dialog-{}", p.uid)}),
-                                    ));
+                                if matches!(v, KV::Gradient(_)) {
+                                    // The Gradient Editor, over this dialog (a style the dialog
+                                    // only shows has no property to edit yet).
+                                    let path = g.match_path_of(p.uid).unwrap_or_default();
+                                    let r = ui.add_enabled(missing.is_none(), egui::Button::new(tr("Edit Gradient…")));
+                                    if r.clicked() {
+                                        actions.push(("prop.editGradient".into(), json!({"layer": lid, "prop": p.uid})));
+                                        app.dialog_state.layer_style.gradient_open = true;
+                                    }
+                                    app.auto.add(&format!("dialog.layerStyle.value.{sel}/{path}"), r.rect, &p.name);
+                                    ui.end_row();
+                                    return;
                                 }
+                                let edit = ui.scope(|ui| control(ui, p, &v));
                                 let path = g.match_path_of(p.uid).unwrap_or_default();
+                                if let Some(nv) = edit.inner {
+                                    // Keyed by path, not uid: the group created by the first
+                                    // change and the rest of the drag stay one undo step.
+                                    let merge = format!("layer-style-dialog-{lid}-{sel}/{path}");
+                                    if missing.is_some() {
+                                        actions.push(("layer.style.add".into(), json!({"layers": [lid], "style": BLENDING, "merge": merge})));
+                                        actions.push((
+                                            "prop.set".into(),
+                                            json!({"layer": lid, "path": format!("{GROUP}/{BLENDING}/{path}"), "value": nv, "merge": merge}),
+                                        ));
+                                    } else {
+                                        actions.push(("prop.set".into(), json!({"layer": lid, "prop": p.uid, "value": nv, "merge": merge})));
+                                    }
+                                }
                                 app.auto.add(&format!("dialog.layerStyle.prop.{sel}/{path}"), lbl.rect, &p.name);
                                 app.auto.add(&format!("dialog.layerStyle.value.{sel}/{path}"), edit.response.rect, &p.name);
                                 ui.end_row();
@@ -257,14 +287,93 @@ pub fn finish(app: &mut EffectcraftApp, ok: bool) {
     if let Some(checkpoint) = app.dialog_state.layer_style.checkpoint.take()
         && !ok
     {
-        let changed = !std::sync::Arc::ptr_eq(&app.session.project, &checkpoint.project);
-        app.session.project = checkpoint.project;
-        app.session.history = checkpoint.history;
-        app.session.sanitize_state();
-        if changed {
-            app.session.bump();
-        }
+        restore(app, checkpoint);
     }
     app.session.history.merge_key = None;
     app.dialog = None;
 }
+
+/// Put the project and undo history back as `checkpoint` has them (nothing happens when nothing
+/// changed since).
+pub(crate) fn restore(app: &mut EffectcraftApp, checkpoint: Checkpoint) {
+    let changed = !std::sync::Arc::ptr_eq(&app.session.project, &checkpoint.project);
+    if changed {
+        // Snapshot only when Cancel has something to restore: opening and cancelling without
+        // edits must not copy the whole TextDoc.
+        let edited = active_editor_snapshot(&app.session);
+        app.session.project = checkpoint.project;
+        app.session.history = checkpoint.history;
+        app.session.sanitize_after_replacement(edited.as_ref());
+        app.session.bump();
+    } else {
+        // No edit was committed, so nothing can have become invalid. In particular, do not
+        // call sanitize_state here: its text-edit cleanup clones the whole TextDoc.
+        app.session.history = checkpoint.history;
+    }
+    app.session.history.merge_key = None;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use effectcraft_engine::Session;
+    use effectcraft_engine::commands::text_edit::layer_doc;
+    use effectcraft_engine::project::LayerId;
+    use effectcraft_engine::project::styles::BLENDING;
+    use serde_json::json;
+
+    fn editing_app() -> (EffectcraftApp, u64) {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Styles", "width": 320, "height": 180, "duration": 1})).unwrap();
+        let lid = s.execute("layer.newText", json!({"text": "abcdef"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("text.edit", json!({"layer": lid, "caret": 3})).unwrap();
+        (EffectcraftApp::new(s), lid)
+    }
+
+    fn editor_state(app: &EffectcraftApp) -> Option<(LayerId, u64, usize, usize)> {
+        app.session.state.text_edit.as_ref().map(|e| (e.layer, e.session, e.anchor, e.caret))
+    }
+
+    #[test]
+    fn cancel_keeps_an_open_text_editor_when_the_dialog_did_not_change_its_text() {
+        let (mut app, lid) = editing_app();
+        open(&mut app, &json!({"layer": lid, "style": BLENDING})).unwrap();
+        // A live preview edit changes the project but not the edited Source Text.
+        app.session.execute("prop.set", json!({"layer": lid, "path": "transform/opacity", "value": 40})).unwrap();
+        let before = editor_state(&app);
+        assert!(before.is_some());
+
+        finish(&mut app, false);
+        assert_eq!(editor_state(&app), before, "Cancel keeps an editor whose document it did not replace");
+    }
+
+    #[test]
+    fn cancel_without_a_dialog_edit_keeps_the_open_editor_and_its_document_untouched() {
+        let (mut app, lid) = editing_app();
+        open(&mut app, &json!({"layer": lid, "style": BLENDING})).unwrap();
+        let before = editor_state(&app);
+        let project = app.session.project.clone();
+        let undo = app.session.history.undo.len();
+        assert!(before.is_some());
+
+        finish(&mut app, false);
+        assert!(std::sync::Arc::ptr_eq(&app.session.project, &project), "a no-op Cancel restores the same project");
+        assert_eq!(app.session.history.undo.len(), undo, "and the same undo history");
+        assert_eq!(editor_state(&app), before, "and leaves the open editor untouched");
+    }
+
+    #[test]
+    fn cancel_replaces_an_open_text_editor_when_the_preview_changed_its_text() {
+        let (mut app, lid) = editing_app();
+        open(&mut app, &json!({"layer": lid, "style": BLENDING})).unwrap();
+        app.session.execute("layer.setText", json!({"layer": lid, "text": "ab"})).unwrap();
+        let preview = editor_state(&app).expect("still editing");
+        assert_eq!(layer_doc(&app.session, LayerId(lid)).unwrap().text, "ab");
+
+        finish(&mut app, false);
+        let restored = editor_state(&app).expect("the editor survives the rollback");
+        assert_eq!(layer_doc(&app.session, LayerId(lid)).unwrap().text, "abcdef", "Cancel restores the pre-dialog text");
+        assert_ne!(restored.1, preview.1, "the restored editor starts a new epoch");
+        assert_eq!((restored.2, restored.3), (2, 2), "the caret stays in the restored document");
+    }
+}
diff --git a/crates/ui-egui/src/panels/learn.rs b/crates/ui-egui/src/panels/learn.rs
index b613791fd..fcb98cce1 100644
--- a/crates/ui-egui/src/panels/learn.rs
+++ b/crates/ui-egui/src/panels/learn.rs
@@ -18,7 +18,7 @@ pub fn home_tab(app: &mut EffectcraftApp, ui: &mut egui::Ui, area: Rect) {
     p.text(
         pos2(x, y + 26.0),
         Align2::LEFT_CENTER,
-        "Hands-on tutorials that run inside EffectCraft. Do each step yourself, or press Show me.",
+        crate::i18n::tr("Hands-on tutorials that run inside EffectCraft. Do each step yourself, or press Show me."),
         Tokens::ui(11.5),
         t.text_faint,
     );
@@ -31,14 +31,14 @@ pub fn home_tab(app: &mut EffectcraftApp, ui: &mut egui::Ui, area: Rect) {
         if r.min.y > area.max.y {
             break;
         }
-        let resp = ui.interact(r, egui::Id::new(("learn-card", &tut.id)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("learn-card", &tut.id)), Sense::click());
         p.rect_filled(r, 8.0, if resp.hovered() { Color32::from_rgb(0x2c, 0x2e, 0x37) } else { Color32::from_rgb(0x24, 0x26, 0x2e) });
         // A small original badge: the step count in a circle.
         let badge = Rect::from_min_size(pos2(r.min.x + 16.0, r.min.y + 16.0), vec2(44.0, 44.0));
         p.circle_filled(badge.center(), 22.0, t.accent.gamma_multiply(0.25));
         p.circle_stroke(badge.center(), 22.0, Stroke::new(1.5, t.accent));
         p.text(badge.center() - vec2(0.0, 5.0), Align2::CENTER_CENTER, tut.steps.len().to_string(), Tokens::semibold(15.0), Color32::WHITE);
-        p.text(badge.center() + vec2(0.0, 10.0), Align2::CENTER_CENTER, "steps", Tokens::ui(9.0), t.text_dim);
+        p.text(badge.center() + vec2(0.0, 10.0), Align2::CENTER_CENTER, crate::i18n::tr("steps"), Tokens::ui(9.0), t.text_dim);
         let tx = badge.max.x + 16.0;
         p.text(pos2(tx, r.min.y + 22.0), Align2::LEFT_CENTER, &tut.title, Tokens::semibold(14.0), Color32::WHITE);
         p.text(pos2(tx, r.min.y + 40.0), Align2::LEFT_CENTER, format!("{} min", tut.minutes), Tokens::ui(11.0), t.text_faint);
@@ -50,7 +50,7 @@ pub fn home_tab(app: &mut EffectcraftApp, ui: &mut egui::Ui, area: Rect) {
         p.galley(pos2(tx, r.min.y + 84.0), g, t.text_faint);
         let br = Rect::from_min_size(pos2(r.max.x - 104.0, r.min.y + 16.0), vec2(88.0, 28.0));
         let label = if running.as_deref() == Some(tut.id.as_str()) { "Resume" } else { "Start" };
-        let clicked = widgets::text_button(ui, br, label, true, &t, egui::Id::new(("learn-start", &tut.id))).clicked();
+        let clicked = widgets::text_button(ui, br, label, true, &t, egui::Id::unique(("learn-start", &tut.id))).clicked();
         app.auto.add(&format!("home.learn.{}", tut.id), r, &tut.title);
         app.auto.add(&format!("home.learn.{}.start", tut.id), br, label);
         if clicked || resp.clicked() {
@@ -92,7 +92,7 @@ pub fn coach(app: &mut EffectcraftApp, ctx: &egui::Context) {
     {
         let time = ctx.input(|i| i.time);
         let pulse = (0.5 + 0.5 * (time * 4.0).sin()) as f32;
-        let p = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("learn-highlight")));
+        let p = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("learn-highlight")));
         let hr = r.expand(3.0 + 2.0 * pulse);
         p.rect_stroke(hr, 5.0, Stroke::new(2.0, t.accent.gamma_multiply(0.6 + 0.4 * pulse)), StrokeKind::Outside);
         app.auto.add("learn.highlight", hr, tp);
@@ -100,7 +100,7 @@ pub fn coach(app: &mut EffectcraftApp, ctx: &egui::Context) {
     }
     let w = 340.0;
     let mut action: Option<&str> = None;
-    let area = egui::Area::new(egui::Id::new("learn-coach"))
+    let area = egui::Area::new(egui::Id::unique("learn-coach"))
         .order(egui::Order::Foreground)
         .fixed_pos(pos2(screen.max.x - w - 20.0, screen.max.y - 250.0))
         .show(ctx, |ui| {
diff --git a/crates/ui-egui/src/panels/live_preview.rs b/crates/ui-egui/src/panels/live_preview.rs
new file mode 100644
index 000000000..83d0d2836
--- /dev/null
+++ b/crates/ui-egui/src/panels/live_preview.rs
@@ -0,0 +1,129 @@
+//! Preview for the settings dialogs that edit something that already exists (Solid Settings on a
+//! solid layer, Camera Settings, Light Settings, Composition Settings): After Effects' Preview
+//! checkbox. Each change of the draft is applied to the project at once, so the canvas shows it
+//! while it is made; OK keeps it and Cancel and Escape take it back.
+//!
+//! Every step goes back to the checkpoint taken when the dialog opened (the project and its undo
+//! history) and then runs the dialog's command once with the draft's parameters. So the project is
+//! always "as it opened, plus one command": OK leaves exactly one undo step, whatever was tried
+//! meanwhile, and Cancel only has to put the checkpoint back. With Preview off nothing is applied
+//! until OK, and switching it off takes back what was applied.
+//!
+//! While a preview is active the dialog opens at the lower right of the window, without the dark
+//! backdrop, and the window behind it is not greyed out, so the canvas stays in view.
+
+use egui::vec2;
+use serde_json::Value;
+
+use crate::panels::dialogs::Placement;
+use crate::panels::layer_styles_dialog::{Checkpoint, checkpoint};
+use crate::panels::preview_merge::{self, Applied};
+use crate::{Dialog, EffectcraftApp};
+
+/// Where a previewing dialog opens: the lower right, undimmed.
+pub const PLACE: Placement = Placement { start: vec2(0.75, 0.8), dim: false };
+
+/// The state of the one dialog being previewed (only one dialog is open at a time).
+#[derive(Clone, Debug, Default)]
+pub struct LivePreview {
+    /// The dialog this belongs to; a preview left over from another one is ignored.
+    dialog: Option<Dialog>,
+    /// The Preview checkbox.
+    pub on: bool,
+    checkpoint: Option<Checkpoint>,
+    /// The draft's parameters when the dialog opened: nothing is applied while it equals them.
+    baseline: Option<Value>,
+    /// The command and parameters the preview last applied.
+    applied: Option<(&'static str, Value)>,
+    /// The project as that command left it, to tell edits made since from the preview's.
+    applied_at: Option<Applied>,
+}
+
+impl LivePreview {
+    fn active_for(&self, dialog: Option<Dialog>) -> bool {
+        self.checkpoint.is_some() && self.dialog.is_some() && self.dialog == dialog
+    }
+}
+
+/// Start previewing for `dialog`, which has just opened on an existing item (Preview on).
+pub fn begin(app: &mut EffectcraftApp, dialog: Dialog) {
+    app.dialog_state.live = LivePreview { dialog: Some(dialog), on: true, checkpoint: Some(checkpoint(app)), ..Default::default() };
+}
+
+/// The dialog that is open is previewing.
+pub fn active(app: &EffectcraftApp) -> bool {
+    app.dialog_state.live.active_for(app.dialog)
+}
+
+/// Where the open dialog goes: the lower right, undimmed, while it previews; else the middle.
+pub fn place(app: &EffectcraftApp) -> Placement {
+    if active(app) { PLACE } else { Placement::default() }
+}
+
+/// Keep the project in step with the draft: `command` with `params` is what OK would run. The
+/// first call (the draft as it opened) only notes it.
+pub fn sync(app: &mut EffectcraftApp, command: &'static str, params: Value) {
+    if !active(app) {
+        return;
+    }
+    let live = &app.dialog_state.live;
+    if live.baseline.is_none() {
+        app.dialog_state.live.baseline = Some(params);
+        return;
+    }
+    let want = live.on && live.baseline.as_ref() != Some(&params);
+    let is_applied = live.applied.is_some();
+    if want {
+        if live.applied.as_ref().is_some_and(|(c, p)| *c == command && *p == params) {
+            return;
+        }
+        if is_applied {
+            put_back(app);
+        }
+        match app.session.execute(command, params.clone()) {
+            Ok(_) => {
+                app.dialog_state.live.applied = Some((command, params));
+                app.dialog_state.live.applied_at = Some(preview_merge::applied(app));
+            }
+            Err(e) => app.ui.status = e.to_string(),
+        }
+    } else if is_applied {
+        put_back(app);
+    }
+}
+
+/// The project as the dialog found it.
+fn put_back(app: &mut EffectcraftApp) {
+    if let Some(cp) = app.dialog_state.live.checkpoint.clone() {
+        let at = app.dialog_state.live.applied_at.take();
+        // Only what the preview did is taken back: an edit made while the dialog was open stays.
+        preview_merge::rollback(app, cp, at.as_ref());
+    }
+    app.dialog_state.live.applied = None;
+    app.dialog_state.live.applied_at = None;
+}
+
+/// OK: the preview's result is the edit. The preview is first brought up to `command` with
+/// `params`, the draft as OK found it (an edit made in the same frame as OK is not in the last
+/// preview). Returns whether the project then already has the edit (the caller must not run the
+/// command again); otherwise the caller runs it, as without a preview.
+pub fn keep(app: &mut EffectcraftApp, command: &'static str, params: Value) -> bool {
+    sync(app, command, params);
+    let kept = active(app) && app.dialog_state.live.applied.is_some();
+    app.dialog_state.live = LivePreview::default();
+    kept
+}
+
+/// Cancel and Escape: take back whatever the preview applied.
+pub fn cancel(app: &mut EffectcraftApp) {
+    if active(app) {
+        put_back(app);
+    }
+    app.dialog_state.live = LivePreview::default();
+}
+
+/// The Preview checkbox, when the open dialog previews; `id` is its automation id.
+pub fn checkbox(ui: &mut egui::Ui, auto: &mut crate::automation::Registry, on: &mut bool, id: &str) {
+    let r = ui.checkbox(on, crate::i18n::tr("Preview"));
+    auto.add(id, r.rect, "Preview");
+}
diff --git a/crates/ui-egui/src/panels/markers_ui.rs b/crates/ui-egui/src/panels/markers_ui.rs
index 2fff7e1c8..ee33fc9de 100644
--- a/crates/ui-egui/src/panels/markers_ui.rs
+++ b/crates/ui-egui/src/panels/markers_ui.rs
@@ -155,7 +155,7 @@ pub fn dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             ui.end_row();
         });
         ui.add_space(8.0);
-        let r = ui.checkbox(&mut d.cue, tr("Cue Point"));
+        let r = crate::widgets::labelled_checkbox(ui, &mut d.cue, tr("Cue Point"));
         app.auto.add("dialog.marker.cue", r.rect, "Cue Point");
         ui.add_enabled_ui(d.cue, |ui| {
             ui.horizontal(|ui| {
@@ -191,13 +191,13 @@ pub fn dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         });
         ui.add_space(8.0);
         ui.horizontal(|ui| {
-            let r = ui.checkbox(&mut d.protected, tr("Protected Region"));
+            let r = crate::widgets::labelled_checkbox(ui, &mut d.protected, tr("Protected Region"));
             app.auto.add("dialog.marker.protected", r.rect, "Protected Region");
             ui.add_space(20.0);
             ui.label(tr("Label:"));
             let labels = effectcraft_engine::color::Label::ALL;
             let cur = labels.get(d.label).copied().unwrap_or_default();
-            let r = egui::ComboBox::from_id_salt("dialog.marker.label").selected_text(app.session.prefs.label_name(cur)).show_ui(ui, |ui| {
+            let r = craft_ui::ComboBox::from_id_salt("dialog.marker.label").selected_text(app.session.prefs.label_name(cur)).show_ui(ui, |ui| {
                 for (i, l) in labels.into_iter().enumerate() {
                     if crate::widgets::label_entry(ui, l, &app.session.prefs.label_name(l), d.label == i, &app.tokens).clicked() {
                         d.label = i;
@@ -243,8 +243,10 @@ pub fn dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
 
 // ---------------------------------------------------------------- timeline drawing + gestures
 
+/// The `egui::Id` of a marker drag in progress: the dragged marker's layer and index (updated as
+/// the marker moves) and whether Alt was held when the drag started.
 fn drag_state_id() -> egui::Id {
-    egui::Id::new("marker-drag")
+    egui::Id::unique("marker-drag")
 }
 
 /// Snap `t` (comp seconds) to the CTI, the work area and other marker times within 8 px.
@@ -283,8 +285,8 @@ fn marker(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, comp:
     let x = tm.x(comp_t);
     let col = marker_color(&t, m.label);
     let h = (y1 - y0).min(10.0);
-    if m.duration > Tick(0) {
-        let xe = tm.x(comp_t + m.duration.seconds());
+    let end = (m.duration > Tick(0)).then(|| tm.x(comp_t + m.duration.seconds()));
+    if let Some(xe) = end {
         let bar = Rect::from_min_max(pos2(x, y0 + 1.0), pos2(xe, y0 + h - 1.0));
         p.rect_filled(bar, 1.0, col.gamma_multiply(if m.protected { 0.35 } else { 0.5 }));
         if m.protected {
@@ -294,14 +296,19 @@ fn marker(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, comp:
                 hx += 5.0;
             }
         }
-        p.line_segment([pos2(xe, y0), pos2(xe, y0 + h)], Stroke::new(1.0, col));
     }
-    p.add(egui::Shape::convex_polygon(marker_shape(x, y0, h), col, Stroke::NONE));
     if !m.comment.is_empty() {
-        p.text(pos2(x + 7.0, y0 + h / 2.0), Align2::LEFT_CENTER, m.comment.lines().next().unwrap_or_default(), Tokens::ui(10.0), t.text);
+        // The name sits in a small outlined box beside the flag, as in After Effects. It is drawn in the theme's field
+        // colours, so it follows Dark, Darker and Light.
+        let galley = p.layout_no_wrap(m.comment.lines().next().unwrap_or_default().to_string(), Tokens::ui(10.0), t.text);
+        let box_w = galley.size().x + 8.0;
+        let box_x = name_box_x(x, box_w, end, p.clip_rect());
+        let box_rect = Rect::from_min_size(pos2(box_x, y0), vec2(box_w, h.max(galley.size().y + 2.0)));
+        p.rect(box_rect, t.radius_sm, t.field_bg, Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
+        p.galley(pos2(box_rect.min.x + 4.0, box_rect.center().y - galley.size().y / 2.0), galley, t.text);
     }
     let hit = Rect::from_min_max(pos2(x - 5.0, y0 - 1.0), pos2(x + 5.0, y1));
-    let id = egui::Id::new(("marker", r.layer, r.index));
+    let id = egui::Id::unique(("marker", r.layer, r.index));
     let resp = ui.interact(hit, id, Sense::click_and_drag());
     app.auto.add(&r.auto_id(), hit, if m.comment.is_empty() { "marker" } else { &m.comment });
     let tip = if m.comment.is_empty() { "Marker".to_string() } else { m.comment.clone() };
@@ -366,10 +373,39 @@ fn marker(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, comp:
         run(ui, "Delete This Marker", "markers.delete", r.params(), app);
         if let Some(l) = r.layer {
             run(ui, "Delete All Markers", "layer.deleteAllMarkers", json!({"layers": [l]}), app);
+        } else {
+            run(ui, "Delete All Markers", "comp.deleteAllMarkers", json!({}), app);
         }
     });
 }
 
+fn name_box_x(x: f32, width: f32, end: Option<f32>, clip: Rect) -> f32 {
+    let start = x + 6.0;
+    let right = match end {
+        Some(end) if end > start && end < start + width => end + 3.0,
+        _ => start,
+    };
+    if right + width <= clip.right() {
+        return right;
+    }
+    let left = x - 6.0 - width;
+    if left >= clip.left() {
+        return left;
+    }
+    start
+}
+
+/// Flags and duration handles sit above every name box in their marker strip.
+fn marker_glyphs(p: &egui::Painter, tokens: &Tokens, tm: TMap, marker: &Marker, time: f64, y0: f32, y1: f32) {
+    let color = marker_color(tokens, marker.label);
+    let h = (y1 - y0).min(10.0);
+    p.add(egui::Shape::convex_polygon(marker_shape(tm.x(time), y0, h), color, Stroke::NONE));
+    if marker.duration > Tick(0) {
+        let end = tm.x(time + marker.duration.seconds());
+        p.line_segment([pos2(end, y0), pos2(end, y0 + h)], Stroke::new(1.0, color));
+    }
+}
+
 /// Composition markers in the ruler strip `[y0, y1]`, protected regions over `rows`.
 pub(crate) fn comp_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, comp: &Comp, tm: TMap, strip: Rect, rows: Rect) {
     let p = ui.painter().with_clip_rect(strip);
@@ -383,15 +419,27 @@ pub(crate) fn comp_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, comp: &C
     for (i, m) in comp.markers.iter().enumerate() {
         marker(app, ui, &p, comp, tm, m, m.time.seconds(), MarkerRef { layer: None, index: i }, strip.min.y, strip.max.y);
     }
+    for m in &comp.markers {
+        marker_glyphs(&p, &app.tokens, tm, m, m.time.seconds(), strip.min.y, strip.max.y);
+    }
 }
 
 /// The composition marker bin at the right end of the time ruler (`bin`), as in After Effects
 /// (#275): drag a marker out of it and it follows the pointer along the marker strip `strip`
 /// (snapping like a dragged marker); dropping it there adds a composition marker at that time,
 /// one undo step. Dropped back on the bin or outside the time graph's width, nothing is added.
+/// A double-click on the bin adds one at the current time (#1826).
 pub(crate) fn marker_bin(app: &mut EffectcraftApp, ui: &mut egui::Ui, comp: &Comp, tm: TMap, bin: Rect, strip: Rect) {
     let t = app.tokens;
-    let resp = ui.interact(bin, egui::Id::new("marker-bin"), Sense::drag()).on_hover_text(tr("Composition marker bin: drag a marker to the time ruler"));
+    let resp = ui.interact(bin, egui::Id::unique("marker-bin"), Sense::drag()).on_hover_text(tr("Composition marker bin: drag a marker to the time ruler"));
+    // The bin senses drags only, so a drag starts as soon as it is pressed: sensing clicks too
+    // would hold that back until the pointer moved, and a drag out released within that frame
+    // would add nothing. The double-click is read from the pointer instead.
+    if bin_double_clicked(ui, resp.id, bin, resp.enabled() && (resp.contains_pointer() || resp.dragged() || resp.drag_stopped()))
+        && let Err(e) = app.session.execute("comp.addMarker", json!({}))
+    {
+        app.ui.status = e.to_string();
+    }
     app.auto.add("timeline.markerBin", bin, "Composition marker bin");
     let hot = resp.hovered() || resp.dragged();
     if hot {
@@ -416,6 +464,64 @@ pub(crate) fn marker_bin(app: &mut EffectcraftApp, ui: &mut egui::Ui, comp: &Com
     }
 }
 
+/// What the marker bin keeps of the primary button between frames: the press being held (when,
+/// where, and whether it has moved too far since to be a click), and the last click (when,
+/// where, and whether it was on the bin: both pressed and released there).
+#[derive(Clone, Copy, Default)]
+struct BinClicks {
+    press: Option<(f64, Pos2, bool)>,
+    last: Option<(f64, Pos2, bool)>,
+}
+
+/// Whether the marker bin `bin` (widget `id`; `over` when it is enabled and has the pointer, not
+/// something above it) was double-clicked this frame: two clicks in a row, both on the bin, each
+/// in a frame when it was `over`. egui's own
+/// double-click takes any click within a few points of the last for the first one, so a click on
+/// the ruler right beside the bin and then one on the bin would count. The bin pairs the clicks
+/// itself, in the order they came, by egui's rules: a click is released within `max_click_dist`
+/// of where it was pressed and within `max_click_duration`, and the second of a double-click comes
+/// within `max_double_click_delay` and `max_click_dist` of the first. A third click starts over.
+fn bin_double_clicked(ui: &egui::Ui, id: egui::Id, bin: Rect, over: bool) -> bool {
+    use egui::{Event, PointerButton};
+    let (dist, duration, delay) = ui.ctx().options(|o| {
+        let i = &o.input_options;
+        (i.max_click_dist, i.max_click_duration, i.max_double_click_delay)
+    });
+    let id = id.with("clicks");
+    let mut s = ui.data(|d| d.get_temp::<BinClicks>(id)).unwrap_or_default();
+    let double = ui.input(|i| {
+        let mut double = false;
+        for e in &i.events {
+            match *e {
+                Event::PointerMoved(p) => {
+                    if let Some((_, at, moved)) = &mut s.press {
+                        *moved |= at.distance(p) > dist;
+                    }
+                }
+                Event::PointerButton { button: PointerButton::Primary, pressed: true, pos, .. } => s.press = Some((i.time, pos, false)),
+                Event::PointerButton { button: PointerButton::Primary, pressed: false, pos, .. } => {
+                    let Some((pressed_at, at, moved)) = s.press.take() else { continue };
+                    if moved || at.distance(pos) > dist || i.time - pressed_at >= duration {
+                        continue;
+                    }
+                    let on = over && bin.contains(at) && bin.contains(pos);
+                    let pair = s.last.is_some_and(|(t, p, was_on)| was_on && on && i.time - t < delay && p.distance(pos) < dist);
+                    if pair {
+                        double = true;
+                        s.last = None;
+                    } else {
+                        s.last = Some((i.time, pos, on));
+                    }
+                }
+                _ => {}
+            }
+        }
+        double
+    });
+    ui.data_mut(|d| d.insert_temp(id, s));
+    double
+}
+
 /// Layer markers on a layer's row `r`; on a precomp layer, its comp's markers too (read-only,
 /// outlined: hover names them, a double-click opens the nested comp at the marker).
 pub(crate) fn layer_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, clip: Rect, comp: &Comp, layer: &Layer, tm: TMap, r: Rect) {
@@ -424,6 +530,9 @@ pub(crate) fn layer_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, clip: R
     for (i, m) in layer.markers.iter().enumerate() {
         marker(app, ui, &p, comp, tm, m, layer.comp_time(m.time).seconds(), MarkerRef { layer: Some(layer.id.0), index: i }, r.min.y + 3.0, r.max.y - 3.0);
     }
+    for m in &layer.markers {
+        marker_glyphs(&p, &app.tokens, tm, m, layer.comp_time(m.time).seconds(), r.min.y + 3.0, r.max.y - 3.0);
+    }
 }
 
 /// The nested comp's markers on a precomp layer's bar (`markers.nested`).
@@ -436,7 +545,7 @@ fn nested_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
         return;
     }
     // Where they land, once per revision (with time remapping that samples the layer's frames).
-    let (key, rev) = (egui::Id::new(("nested-markers", cid.0, layer.id.0)), app.session.revision);
+    let (key, rev) = (egui::Id::unique(("nested-markers", cid.0, layer.id.0)), app.session.revision);
     let cached = ui.ctx().data(|d| d.get_temp::<(u64, Vec<(Tick, usize)>)>(key)).filter(|(r, _)| *r == rev);
     let at = cached.map(|(_, v)| v).unwrap_or_else(|| {
         let v: Vec<(Tick, usize)> =
@@ -457,7 +566,7 @@ fn nested_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
         }
         let hit = Rect::from_min_max(pos2(x - 5.0, y0 - 1.0), pos2(x + 5.0, r.max.y - 3.0));
         let tip = if m.comment.is_empty() { format!("Marker in {name}") } else { format!("{} (marker in {name})", m.comment) };
-        let resp = ui.interact(hit, egui::Id::new(("nested-marker", layer.id.0, i)), Sense::click()).on_hover_text(&tip);
+        let resp = ui.interact(hit, egui::Id::unique(("nested-marker", layer.id.0, i)), Sense::click()).on_hover_text(&tip);
         app.auto.add(&format!("timeline.layer.{}.nestedMarker.{i}", layer.id.0), hit, &tip);
         if resp.double_clicked() {
             let opened =
@@ -473,6 +582,21 @@ fn nested_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter
 mod tests {
     use super::*;
 
+    #[test]
+    fn duration_name_box_stays_visible_near_the_right_clip_edge() {
+        let clip = Rect::from_min_max(pos2(0.0, 0.0), pos2(100.0, 20.0));
+        let x = name_box_x(70.0, 20.0, Some(85.0), clip);
+        assert!(x >= clip.left() && x + 20.0 <= clip.right());
+        assert!(x + 20.0 < 70.0 - 4.0, "the left-hand box must not cover its own marker flag");
+        assert!(85.0 < x || 85.0 > x + 20.0, "the end cap must remain outside the box");
+        assert_eq!(name_box_x(20.0, 20.0, Some(35.0), clip), 38.0);
+        for end in [None, Some(72.0), Some(110.0)] {
+            let x = name_box_x(90.0, 20.0, end, clip);
+            assert!(x >= clip.left() && x + 20.0 <= clip.right(), "all right-edge names must remain visible: {end:?}");
+            assert!(x + 20.0 < 90.0 - 4.0);
+        }
+    }
+
     #[test]
     fn marker_dialog_reads_and_writes_every_field() {
         let mut s = effectcraft_engine::Session::default();
diff --git a/crates/ui-egui/src/panels/media_panels.rs b/crates/ui-egui/src/panels/media_panels.rs
index cd32cb7f2..756959871 100644
--- a/crates/ui-egui/src/panels/media_panels.rs
+++ b/crates/ui-egui/src/panels/media_panels.rs
@@ -29,7 +29,7 @@ type Listing = (f64, Arc<Result<Vec<mb::Entry>, String>>);
 
 /// Thumbnail of a file (cached per path; `None` while not decoded or not decodable).
 fn thumbnail(app: &EffectcraftApp, ctx: &egui::Context, path: &str, budget: &mut u32) -> Thumb {
-    let id = egui::Id::new(("mb-thumb", path));
+    let id = egui::Id::unique(("mb-thumb", path));
     if let Some(t) = ctx.data(|d| d.get_temp::<Thumb>(id)) {
         return t;
     }
@@ -63,6 +63,33 @@ fn thumbnail(app: &EffectcraftApp, ctx: &egui::Context, path: &str, budget: &mut
     thumb
 }
 
+/// The Favorites column: one clickable row per place, the current folder `dir` highlighted.
+fn places_column(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, side: Rect, places: &[(String, String)], dir: &str) {
+    let t = app.tokens;
+    let mut fy = side.min.y + 22.0;
+    for (i, (name, path)) in places.iter().enumerate() {
+        let r = Rect::from_min_size(pos2(side.min.x, fy), vec2(side.width(), 20.0));
+        let resp = ui.interact(r, egui::Id::unique(("mb-fav", i)), Sense::click());
+        if path == dir {
+            p.rect_filled(r, 0.0, t.row_selected);
+        } else if resp.hovered() {
+            p.rect_filled(r, 0.0, t.hover);
+        }
+        p.text(pos2(r.min.x + 14.0, r.center().y), Align2::LEFT_CENTER, name, Tokens::ui(12.0), t.text);
+        app.auto.add(&format!("mediaBrowser.place.{i}"), r, name);
+        if resp.clicked() {
+            kit::exec(app, "mediaBrowser.go", json!({"path": path}));
+        }
+        fy += 20.0;
+    }
+}
+
+/// The Media Browser panel: a toolbar (up, home, favourite, "Media only" filter and the browser's
+/// own actions), the current path, the favourite places and a tile grid of the folder's entries
+/// with thumbnails for images and videos. Double-click opens a folder or imports a file; files
+/// drag out as [`DragPayload::Files`] and a context menu copies paths, imports (optionally into the
+/// comp) or adds a favourite. The listing is cached per folder and filter for a second, and every
+/// change runs a `mediaBrowser.*` command.
 pub fn media_browser(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -76,7 +103,7 @@ pub fn media_browser(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let st = app.session.state.media_browser.clone();
     let dir = st.folder.clone().unwrap_or_else(|| b.home());
     // Listing cached per folder for a second.
-    let lid = egui::Id::new(("mb-list", dir.clone(), st.importable_only));
+    let lid = egui::Id::unique(("mb-list", dir.clone(), st.importable_only));
     let now = ctx.input(|i| i.time);
     let listing: Option<Listing> = ctx.data(|d| d.get_temp(lid));
     let entries = match listing {
@@ -130,26 +157,11 @@ pub fn media_browser(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let side = Rect::from_min_max(pos2(rect.min.x, rect.min.y + 54.0), pos2(rect.min.x + 160.0_f32.min(rect.width() * 0.3), rect.max.y));
     p.line_segment([side.right_top(), side.right_bottom()], Stroke::new(1.0, t.separator));
     p.text(pos2(side.min.x + 10.0, side.min.y + 10.0), Align2::LEFT_CENTER, tr("Favorites"), Tokens::semibold(11.5), t.text_dim);
-    let mut fy = side.min.y + 22.0;
     let mut places: Vec<(String, String)> = b.places();
     places.extend(
         st.favorites.iter().map(|f| (std::path::Path::new(f).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| f.clone()), f.clone())),
     );
-    for (i, (name, path)) in places.iter().enumerate() {
-        let r = Rect::from_min_size(pos2(side.min.x, fy), vec2(side.width(), 20.0));
-        let resp = ui.interact(r, egui::Id::new(("mb-fav", i)), Sense::click());
-        if *path == dir {
-            p.rect_filled(r, 0.0, t.row_selected);
-        } else if resp.hovered() {
-            p.rect_filled(r, 0.0, t.hover);
-        }
-        p.text(pos2(r.min.x + 14.0, r.center().y), Align2::LEFT_CENTER, name, Tokens::ui(12.0), t.text);
-        app.auto.add(&format!("mediaBrowser.place.{i}"), r, name);
-        if resp.clicked() {
-            kit::exec(app, "mediaBrowser.go", json!({"path": path}));
-        }
-        fy += 20.0;
-    }
+    places_column(app, ui, &p, side, &places, &dir);
     // Files.
     let list = Rect::from_min_max(pos2(side.max.x + 1.0, side.min.y), rect.max);
     let entries = match entries.as_ref() {
@@ -159,10 +171,11 @@ pub fn media_browser(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             return;
         }
     };
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("mb-scroll"), list);
+    let list = scroll.content;
     let tile = vec2(140.0, 112.0);
     let cols = ((list.width() - 8.0) / tile.x).floor().max(1.0) as usize;
     let mut budget = 2u32;
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("mb-scroll"), list);
     let lp = p.with_clip_rect(list);
     let mut actions: Vec<(&str, Value)> = vec![];
     for (i, e) in entries.iter().enumerate() {
@@ -173,7 +186,7 @@ pub fn media_browser(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         if !r.intersects(list) {
             continue;
         }
-        let resp = ui.interact(r.intersect(list), egui::Id::new(("mb-entry", &e.path)), Sense::click_and_drag());
+        let resp = ui.interact(r.intersect(list), egui::Id::unique(("mb-entry", &e.path)), Sense::click_and_drag());
         app.auto.add(&format!("mediaBrowser.entry.{}", e.name), r, &e.name);
         lp.rect_filled(r, 4.0, if resp.hovered() { t.hover } else { t.row });
         let thumb = Rect::from_min_max(r.min + vec2(6.0, 6.0), pos2(r.max.x - 6.0, r.max.y - 26.0));
@@ -264,7 +277,7 @@ fn rows_of(v: &Value) -> Vec<(String, String)> {
 
 /// An editable comment field; returns the edited text when it changes.
 fn comment_field(ui: &mut egui::Ui, r: Rect, id: &str, text: &str) -> Option<String> {
-    let key = egui::Id::new(("meta-comment", id));
+    let key = egui::Id::unique(("meta-comment", id));
     let mut buf: String = ui.data(|d| d.get_temp(key)).unwrap_or_else(|| text.to_string());
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(r));
     let resp = child.add(egui::TextEdit::multiline(&mut buf).desired_width(r.width()).desired_rows(2).hint_text(tr("Add a comment")));
@@ -438,8 +451,8 @@ mod tests {
                 kind: Some("video"),
             })
             .collect();
-        let old_id = egui::Id::new("old-list");
-        let new_id = egui::Id::new("new-list");
+        let old_id = egui::Id::unique("old-list");
+        let new_id = egui::Id::unique("new-list");
         ctx.data_mut(|d| {
             d.insert_temp(old_id, (0.0, Ok::<_, String>(entries.clone())));
             d.insert_temp(new_id, (0.0, Arc::new(Ok::<_, String>(entries))));
diff --git a/crates/ui-egui/src/panels/misc.rs b/crates/ui-egui/src/panels/misc.rs
index cd0ab6897..0c87721db 100644
--- a/crates/ui-egui/src/panels/misc.rs
+++ b/crates/ui-egui/src/panels/misc.rs
@@ -11,7 +11,8 @@ use crate::{EffectcraftApp, widgets};
 
 pub fn placeholder(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, p: PanelKind) {
     let t = app.tokens;
-    ui.painter().text(rect.center(), Align2::CENTER_CENTER, tr_args("{} — coming soon", &[&(p.title())]), Tokens::ui(12.0), t.text_faint);
+    let name = crate::i18n::label(app, "window.panel", p.title());
+    ui.painter().text(rect.center(), Align2::CENTER_CENTER, tr_args("{} — coming soon", &[&name]), Tokens::ui(12.0), t.text_faint);
 }
 
 /// Preview panel: transport controls, the shortcut whose options are shown, and that
@@ -21,12 +22,11 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     use effectcraft_engine::preview::{PlayFrom, PreviewRange, PreviewResolution, PreviewShortcut};
     let t = app.tokens;
     let ctx = ui.ctx().clone();
-    let p = ui.painter().with_clip_rect(rect);
     // The panel scrolls when it is shorter than its controls (the default workspace shows just
     // the transport row, as in After Effects).
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("preview-scroll"), rect);
-    let panel_clip = ui.clip_rect();
-    ui.set_clip_rect(rect.intersect(panel_clip));
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("preview-scroll"), rect);
+    let rect = scroll.content;
+    let p = ui.painter().with_clip_rect(rect);
     let y = rect.min.y + 12.0 - scroll.offset;
     let bw = 30.0;
     let total = bw * 5.0 + 16.0;
@@ -42,7 +42,10 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     for (icon, cmd, tip) in buttons {
         let r = Rect::from_min_size(pos2(x, y), vec2(bw, 28.0));
         let icon = if cmd == "playback.toggle" && app.playback.playing { Icon::Pause } else { icon };
-        if widgets::icon_button(ui, r, icon, cmd == "playback.toggle" && app.playback.playing, &t, egui::Id::new(("pv", cmd))).on_hover_text(tip).clicked() {
+        if widgets::icon_button(ui, r, icon, cmd == "playback.toggle" && app.playback.playing, &t, egui::Id::unique(("pv", cmd)))
+            .on_hover_text(tr(tip))
+            .clicked()
+        {
             // The play button plays with the options of the shortcut shown below.
             let params = if cmd == "playback.toggle" { json!({"shortcut": current.id()}) } else { json!({}) };
             let _ = crate::menus::invoke(app, &ctx, cmd, params);
@@ -61,7 +64,7 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let mut yy = y + 46.0;
 
     // Shortcut.
-    label(yy, "Shortcut");
+    label(yy, tr("Shortcut"));
     let names: Vec<String> = PreviewShortcut::ALL.iter().map(|s| s.label().to_string()).collect();
     if let Some(i) = dropdown_row(
         app,
@@ -91,14 +94,14 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let row = if i < 4 { i / 2 } else { i - 2 };
         let cx = x0 + col as f32 * 110.0 - 2.0;
         let cy = yy + row as f32 * 22.0;
-        if check_row(app, ui, &p, pos2(cx, cy), key, text, on) {
+        if check_row(app, ui, &p, pos2(cx, cy), key, tr(text), on) {
             changes.push(json!({"shortcut": current.id(), key: !on}));
         }
     }
     yy += 4.0 * 22.0 + 6.0;
 
     // Range (and the pre/post-roll of Play Around Current Time).
-    label(yy, "Range");
+    label(yy, tr("Range"));
     let ranges: Vec<String> = PreviewRange::ALL.iter().map(|r| r.label().to_string()).collect();
     let range_ids = ["workArea", "workAreaExtended", "entireDuration", "aroundCurrentTime"];
     if let Some(i) = dropdown_row(
@@ -116,8 +119,15 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     if o.range == PreviewRange::AroundCurrentTime {
         for (k, (key, text, v)) in [("preRoll", "Pre-roll", o.pre_roll), ("postRoll", "Post-roll", o.post_roll)].into_iter().enumerate() {
             let lx = xv + k as f32 * 100.0;
-            p.text(pos2(lx, yy), Align2::LEFT_CENTER, text, Tokens::ui(11.5), t.text_dim);
-            let (r, nv, _) = widgets::hot_number_at(ui, pos2(lx + 52.0, yy - 9.0), egui::Id::new(("pv-roll", key)), v, 0.05, (0.0, 600.0), 1, "s", &t);
+            p.text(pos2(lx, yy), Align2::LEFT_CENTER, tr(text), Tokens::ui(11.5), t.text_dim);
+            let (r, nv, _) = widgets::hot_number_at(
+                ui,
+                pos2(lx + 52.0, yy - 9.0),
+                egui::Id::unique(("pv-roll", key)),
+                v,
+                &widgets::HotSpec { speed: 0.05, range: (0.0, 600.0), decimals: 1, suffix: "s" },
+                &t,
+            );
             app.auto.add(&format!("preview.{key}"), r, text);
             if let Some(nv) = nv {
                 changes.push(json!({"shortcut": current.id(), key: nv}));
@@ -127,7 +137,7 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 
     // Play From.
-    label(yy, "Play From");
+    label(yy, tr("Play From"));
     let froms: Vec<String> = PlayFrom::ALL.iter().map(|f| f.label().to_string()).collect();
     if let Some(i) = dropdown_row(
         app,
@@ -144,7 +154,7 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
 
     // Frame Rate, Skip, Resolution.
     let comp_fps = app.session.active_comp().map(|c| c.frame_rate.as_f64());
-    label(yy, "Frame Rate");
+    label(yy, tr("Frame Rate"));
     const RATES: [f64; 12] = [8.0, 10.0, 12.0, 12.5, 15.0, 23.976, 24.0, 25.0, 29.97, 30.0, 50.0, 60.0];
     let auto = format!("({:.2}) Auto", comp_fps.unwrap_or(0.0));
     let mut rates = vec![auto.clone()];
@@ -160,13 +170,20 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     let sx = xv + 106.0;
     p.text(pos2(sx, yy), Align2::LEFT_CENTER, tr("Skip"), Tokens::ui(12.0), t.text_dim);
-    let (r, nv, _) = widgets::hot_number_at(ui, pos2(sx + 30.0, yy - 9.0), egui::Id::new("pv-skip"), o.skip as f64, 0.1, (0.0, 99.0), 0, "", &t);
+    let (r, nv, _) = widgets::hot_number_at(
+        ui,
+        pos2(sx + 30.0, yy - 9.0),
+        egui::Id::unique("pv-skip"),
+        o.skip as f64,
+        &widgets::HotSpec { speed: 0.1, range: (0.0, 99.0), decimals: 0, suffix: "" },
+        &t,
+    );
     app.auto.add("preview.skip", r, "Skip");
     if let Some(nv) = nv {
         changes.push(json!({"shortcut": current.id(), "skip": nv.round() as u32}));
     }
     yy += 24.0;
-    label(yy, "Resolution");
+    label(yy, tr("Resolution"));
     let ress: Vec<String> = PreviewResolution::ALL.iter().map(|r| r.label().to_string()).collect();
     let res_ids = ["auto", "full", "half", "third", "quarter", "custom"];
     if let Some(i) = dropdown_row(
@@ -181,15 +198,21 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         changes.push(json!({"shortcut": current.id(), "resolution": res_ids[i]}));
     }
     if o.resolution == PreviewResolution::Custom {
-        let (r, nv, _) =
-            widgets::hot_number_at(ui, pos2(xv + 106.0, yy - 9.0), egui::Id::new("pv-custom-res"), o.custom_resolution as f64, 0.1, (1.0, 40.0), 0, "", &t);
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(xv + 106.0, yy - 9.0),
+            egui::Id::unique("pv-custom-res"),
+            o.custom_resolution as f64,
+            &widgets::HotSpec { speed: 0.1, range: (1.0, 40.0), decimals: 0, suffix: "" },
+            &t,
+        );
         app.auto.add("preview.customResolution", r, "Custom Resolution");
         if let Some(nv) = nv {
             changes.push(json!({"shortcut": current.id(), "customResolution": nv.round() as u32}));
         }
     }
     yy += 24.0;
-    if check_row(app, ui, &p, pos2(x0 - 2.0, yy), "fullScreen", "Full Screen", o.full_screen) {
+    if check_row(app, ui, &p, pos2(x0 - 2.0, yy), "fullScreen", tr("Full Screen"), o.full_screen) {
         changes.push(json!({"shortcut": current.id(), "fullScreen": !o.full_screen}));
     }
     yy += 24.0;
@@ -197,7 +220,7 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // What stopping does.
     p.text(pos2(x0, yy), Align2::LEFT_CENTER, tr_args("On ({}) stop:", &[&(current.label())]), Tokens::ui(11.5), t.text_dim);
     yy += 20.0;
-    if check_row(app, ui, &p, pos2(x0 - 2.0, yy), "playCachedFrames", "If caching, play cached frames", o.play_cached_frames) {
+    if check_row(app, ui, &p, pos2(x0 - 2.0, yy), "playCachedFrames", tr("If caching, play cached frames"), o.play_cached_frames) {
         changes.push(json!({"shortcut": current.id(), "playCachedFrames": !o.play_cached_frames}));
     }
     yy += 22.0;
@@ -217,7 +240,7 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             Some(pl) => pl,
             None => effectcraft_engine::preview::plan(&o, &c, app.session.time()),
         };
-        let cached_set = app.frames.cached_frames(&app.shown_series(cid));
+        let cached_set = app.frames.cached_frames(&app.preview_series(cid, &o));
         let total = pl.frames().count();
         let cached = pl.frames().filter(|f| cached_set.binary_search(f).is_ok()).count();
         let bar = Rect::from_min_size(pos2(rect.min.x + 12.0, yy), vec2(rect.width() - 24.0, 6.0));
@@ -227,7 +250,6 @@ pub fn preview(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let status = if app.playback.playing && app.playback.caching { " — caching before playback" } else { "" };
         p.text(pos2(bar.min.x, bar.max.y + 12.0), Align2::LEFT_CENTER, format!("{cached} / {total} frames cached{status}"), Tokens::ui(11.0), t.text_faint);
     }
-    ui.set_clip_rect(panel_clip);
     let content = yy + 30.0 - (rect.min.y - scroll.offset);
     scroll.end(ui, &mut app.auto, "preview.scroll", content, &t);
 }
@@ -240,7 +262,7 @@ fn fmt_rate(r: f64) -> String {
 fn check_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, at: egui::Pos2, key: &str, text: &str, on: bool) -> bool {
     let t = app.tokens;
     let r = Rect::from_min_size(pos2(at.x, at.y - 8.0), vec2(16.0, 16.0));
-    let clicked = widgets::checkbox(ui, r, on, &t, egui::Id::new(("pv-check", key))).clicked();
+    let clicked = widgets::checkbox(ui, r, on, &t, egui::Id::unique(("pv-check", key))).changed();
     p.text(pos2(r.max.x + 5.0, at.y), Align2::LEFT_CENTER, text, Tokens::ui(12.0), t.text);
     app.auto.add(&format!("preview.{key}"), r, text);
     clicked
@@ -250,7 +272,7 @@ fn check_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, at:
 /// returns the chosen index.
 fn dropdown_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, key: &str, text: &str, items: &[String], current: Option<usize>) -> Option<usize> {
     let t = app.tokens;
-    let pid = egui::Id::new(("pv-pop", key));
+    let pid = egui::Id::unique(("pv-pop", key));
     if widgets::dropdown(ui, r, text, &t, pid.with("btn")).clicked() {
         let open: bool = ui.data(|d| d.get_temp(pid.with("open")).unwrap_or(false));
         ui.data_mut(|d| d.insert_temp(pid.with("open"), !open));
@@ -318,7 +340,7 @@ pub fn audio(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let clip = Rect::from_min_max(pos2(bar.min.x, top - 14.0), pos2(bar.max.x, top - 4.0));
         p.rect_filled(clip, 1.0, if m.clipped[c] { red } else { t.field_bg });
         let id = if c == 0 { "audio.clipLeft" } else { "audio.clipRight" };
-        if ui.interact(clip, egui::Id::new(id), Sense::click()).clicked() {
+        if ui.interact(clip, egui::Id::unique(id), Sense::click()).clicked() {
             app.meter.clipped[c] = false;
         }
         app.auto.add(id, clip, if c == 0 { "Left clip indicator" } else { "Right clip indicator" });
@@ -362,16 +384,21 @@ pub fn audio(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 }
 
+/// The History panel: every state of the session's branching history, indented under the state it
+/// grew from, with the current state highlighted and future/abandoned branches dimmed. Only the
+/// rows in view are drawn; the current state is scrolled into view when it changes. Clicking a
+/// state runs `edit.history.goto`, reporting a failure in `app.ui.status`.
 pub fn history(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
-    let p = ui.painter().with_clip_rect(rect);
     // The branching history (EffectCraft's History panel): every state, branches indented under
     // the state they grew from; click any state to go there (`edit.history.goto`).
     let nodes = app.session.history_tree();
     let row_h = 22.0;
     let cur = nodes.iter().position(|n| n.current).unwrap_or(0);
-    let scroll_id = egui::Id::new("history-scroll");
+    let scroll_id = egui::Id::unique("history-scroll");
     let mut scroll = widgets::PanelScroll::begin(ui, scroll_id, rect);
+    let rect = scroll.content;
+    let p = ui.painter().with_clip_rect(rect);
     // The current state scrolls into view when it changes (undo, redo, a new step).
     if ui.data(|d| d.get_temp::<usize>(scroll_id.with("current"))) != Some(cur) {
         ui.data_mut(|d| d.insert_temp(scroll_id.with("current"), cur));
@@ -390,7 +417,7 @@ pub fn history(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     for n in nodes.iter().skip(first).take(visible) {
         let r = Rect::from_min_size(pos2(rect.min.x, y), vec2(rect.width(), row_h));
         y += row_h;
-        let resp = ui.interact(r, egui::Id::new(("hist", n.id.as_str())), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("hist", n.id.as_str())), Sense::click());
         if n.current {
             p.rect_filled(r, 0.0, t.row_selected);
         } else if resp.hovered() {
@@ -419,11 +446,15 @@ pub fn history(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 }
 
+/// The Markers panel: the active comp's markers in time order, each with its timecode and comment;
+/// clicking a row moves the current time to that marker. Shows a hint when the comp has none and
+/// draws nothing without an active comp.
 pub fn markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
-    let p = ui.painter().with_clip_rect(rect);
     let Some(c) = app.session.active_comp_arc() else { return };
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("markers-scroll"), rect);
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("markers-scroll"), rect);
+    let rect = scroll.content;
+    let p = ui.painter().with_clip_rect(rect);
     let mut y = rect.min.y + 8.0 - scroll.offset;
     if c.markers.is_empty() {
         p.text(rect.center(), Align2::CENTER_CENTER, tr("No composition markers"), Tokens::ui(12.0), t.text_faint);
@@ -437,7 +468,7 @@ pub fn markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let tc = crate::panels::timecode(&app.session, &c, m.time);
         p.text(pos2(r.min.x + 12.0, r.center().y), Align2::LEFT_CENTER, tc, Tokens::mono(11.5), t.timecode);
         p.text(pos2(r.min.x + 120.0, r.center().y), Align2::LEFT_CENTER, &m.comment, Tokens::ui(12.0), t.text);
-        if ui.interact(r, egui::Id::new(("mk", m.time.0)), Sense::click()).clicked() {
+        if ui.interact(r, egui::Id::unique(("mk", m.time.0)), Sense::click()).clicked() {
             app.session.set_time(m.time);
         }
     }
diff --git a/crates/ui-egui/src/panels/mod.rs b/crates/ui-egui/src/panels/mod.rs
deleted file mode 100644
index 3aa9a19c5..000000000
--- a/crates/ui-egui/src/panels/mod.rs
+++ /dev/null
@@ -1,304 +0,0 @@
-//! Panel bodies.
-
-pub mod anim_tools;
-pub mod camera_tracker_ui;
-pub mod comp_settings;
-pub mod content_fill_panel;
-pub mod delete_items;
-pub mod dialogs;
-pub mod dialogs_3d;
-pub mod effect_controls;
-pub mod effects_presets;
-pub mod essential;
-pub mod expr_bar;
-pub mod expr_editor;
-pub mod flowchart;
-pub mod footage_panel;
-pub mod forms;
-pub mod fx_editors;
-pub mod fx_widgets;
-pub mod gradient_editor;
-pub mod gradient_handles;
-pub mod graph;
-pub mod graph_tools;
-pub mod home;
-pub mod info;
-pub mod key_dialogs;
-pub mod layer_panel;
-pub mod layer_styles_dialog;
-pub mod learn;
-pub mod markers_ui;
-pub mod media_panels;
-pub mod misc;
-pub mod object_matte_tool;
-pub mod paint_panels;
-pub mod panel_kit;
-pub mod path_vr_panels;
-pub mod precomp;
-pub mod project;
-pub mod properties;
-pub mod puppet_tool;
-pub mod render_queue;
-pub mod roto_tool;
-pub mod rq_templates;
-pub mod scopes_panel;
-pub mod script_console;
-pub mod scriptui_view;
-pub mod settings;
-pub mod shortcut_editor;
-pub mod templates;
-pub mod text_panels;
-pub mod text_range_handles;
-pub mod timeline;
-pub mod tracker;
-pub mod unsaved;
-pub mod viewer;
-pub mod viewer_drop;
-pub mod viewer_overlays;
-pub mod viewer_text;
-pub mod viewer_tools;
-pub mod viewers;
-pub mod waveform;
-
-use crate::i18n::tr;
-use effectcraft_engine::Session;
-use effectcraft_engine::project::Comp;
-use effectcraft_engine::time::Tick;
-use egui::Rect;
-
-use crate::EffectcraftApp;
-use crate::dock::PanelKind;
-
-/// Drag-and-drop payloads between panels.
-#[derive(Clone, Debug)]
-pub enum DragPayload {
-    /// A project item (footage, comp, solid).
-    Item(u64),
-    /// An effect id from Effects & Presets.
-    Effect(String),
-    /// An animation preset from Effects & Presets, with its display name for the drag ghost.
-    Preset { preset: PresetRef, name: String },
-    /// A property dragged from the timeline (to the Essential Graphics panel).
-    Property { layer: u64, prop: u64 },
-    /// Files from the Media Browser (import; into the timeline: import and add).
-    Files(Vec<String>),
-}
-
-/// An animation preset in Effects & Presets.
-#[derive(Clone, Debug, PartialEq)]
-pub enum PresetRef {
-    /// A text animation preset id (`layer.applyTextPreset`).
-    Text(String),
-    /// A built-in animation preset id, e.g. a transition (`anim.applyBuiltinPreset`).
-    Builtin(String),
-    /// A user `.ecpreset` file path (`anim.applyPreset`).
-    File(String),
-}
-
-impl PresetRef {
-    /// The command and params that apply the preset to the selected layers.
-    pub fn command(&self) -> (&'static str, serde_json::Value) {
-        match self {
-            PresetRef::Text(id) => ("layer.applyTextPreset", serde_json::json!({"preset": id})),
-            PresetRef::Builtin(id) => ("anim.applyBuiltinPreset", serde_json::json!({"preset": id})),
-            PresetRef::File(path) => ("anim.applyPreset", serde_json::json!({"path": path})),
-        }
-    }
-
-    /// The command and params that apply the preset to `layer` (a drop target).
-    pub fn apply_to(&self, layer: u64) -> (&'static str, serde_json::Value) {
-        let (id, mut params) = self.command();
-        if let Some(obj) = params.as_object_mut() {
-            // `layer.applyTextPreset` takes one `layer`; the animation preset commands take `layers`.
-            match self {
-                PresetRef::Text(_) => obj.insert("layer".into(), serde_json::json!(layer)),
-                PresetRef::Builtin(_) | PresetRef::File(_) => obj.insert("layers".into(), serde_json::json!([layer])),
-            };
-        }
-        (id, params)
-    }
-}
-
-/// Layers carried by a Project item drag. Dragging a selected item uses the
-/// complete selection, while dragging an unselected item uses only that item.
-/// Folders and data files are not composition layers.
-pub(crate) fn project_drop_items(app: &EffectcraftApp, dragged: u64) -> Vec<u64> {
-    use effectcraft_engine::project::{FootageKind, ItemId, ItemKind};
-
-    let selected = &app.session.state.project_selection;
-    let candidates: Vec<u64> = if selected.iter().any(|id| id.0 == dragged) {
-        selected.iter().map(|id| id.0).collect()
-    } else {
-        // One unselected item goes through as is, so a folder or data file still gets the
-        // engine's error instead of a silent no-op.
-        return vec![dragged];
-    };
-    candidates
-        .into_iter()
-        .filter(|id| {
-            app.session.project.item(ItemId(*id)).is_some_and(|item| match &item.kind {
-                ItemKind::Comp(_) | ItemKind::Solid(_) => true,
-                ItemKind::Footage(f) => f.kind != FootageKind::Data,
-                ItemKind::Folder => false,
-            })
-        })
-        .collect()
-}
-
-/// The current time formatted per project settings (timecode with `;` for drop-frame, frames
-/// or Feet + Frames).
-pub fn timecode(session: &Session, comp: &Comp, t: Tick) -> String {
-    effectcraft_engine::commands::time::display_time(session, comp, t)
-}
-
-/// Ctrl/Cmd-click on a current-time display toggles the project's Time Display Style between
-/// Timecode and Frames, as in After Effects (through Project Settings: one undo step).
-pub(crate) fn toggle_time_display(app: &mut EffectcraftApp, resp: &egui::Response) {
-    if !(resp.clicked() && resp.ctx.input(|i| i.modifiers.command)) {
-        return;
-    }
-    let timecode = app.session.project.settings.time_display == effectcraft_engine::project::TimeDisplayStyle::Timecode;
-    if let Err(e) = app.session.execute("file.projectSettings", serde_json::json!({"timeDisplay": if timecode { "frames" } else { "timecode" }})) {
-        app.ui.status = e.to_string();
-    }
-}
-
-/// Spacebar held outside a text field: the Hand tool (drags pan the viewer and scroll the
-/// Timeline).
-pub(crate) fn space_hand(ctx: &egui::Context) -> bool {
-    ctx.input(|i| i.key_down(egui::Key::Space)) && !ctx.egui_wants_keyboard_input()
-}
-
-pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: PanelKind, rect: Rect) {
-    match p {
-        PanelKind::Composition => viewers::show(app, ui, 0, rect),
-        PanelKind::Viewer(n) => viewers::show(app, ui, n, rect),
-        PanelKind::Timeline => timeline::show(app, ui, rect),
-        PanelKind::Project => project::show(app, ui, rect),
-        PanelKind::EffectControls => effect_controls::show(app, ui, rect),
-        PanelKind::EffectsPresets => effects_presets::show(app, ui, rect),
-        PanelKind::Info => info::show(app, ui, rect),
-        PanelKind::Preview => misc::preview(app, ui, rect),
-        PanelKind::Character => text_panels::character(app, ui, rect),
-        PanelKind::Paragraph => text_panels::paragraph(app, ui, rect),
-        PanelKind::Align => text_panels::align(app, ui, rect),
-        PanelKind::Properties => properties::show(app, ui, rect),
-        PanelKind::Audio => misc::audio(app, ui, rect),
-        PanelKind::History => misc::history(app, ui, rect),
-        PanelKind::Markers => misc::markers(app, ui, rect),
-        PanelKind::MaskInterpolation => anim_tools::mask_interpolation(app, ui, rect),
-        PanelKind::ScriptConsole => script_console::show(app, ui, rect),
-        PanelKind::Wiggler => anim_tools::wiggler(app, ui, rect),
-        PanelKind::Smoother => anim_tools::smoother(app, ui, rect),
-        PanelKind::MotionSketch => anim_tools::motion_sketch(app, ui, rect),
-        PanelKind::RenderQueue => render_queue::show(app, ui, rect),
-        PanelKind::Tracker => tracker::show(app, ui, rect),
-        PanelKind::Layer => layer_panel::show(app, ui, rect),
-        PanelKind::Paint => paint_panels::paint(app, ui, rect),
-        PanelKind::Brushes => paint_panels::brushes(app, ui, rect),
-        PanelKind::EssentialGraphics => essential::show(app, ui, rect),
-        PanelKind::ScriptPanel(id) => scriptui_view::panel(app, ui, rect, id),
-        PanelKind::Flowchart => flowchart::show(app, ui, rect),
-        PanelKind::LumetriScopes => scopes_panel::show(app, ui, rect),
-        PanelKind::Footage => footage_panel::show(app, ui, rect),
-        PanelKind::MediaBrowser => media_panels::media_browser(app, ui, rect),
-        PanelKind::Metadata => media_panels::metadata(app, ui, rect),
-        PanelKind::Progress => media_panels::progress(app, ui, rect),
-        PanelKind::ContentAwareFill => content_fill_panel::show(app, ui, rect),
-        PanelKind::CreateNullsFromPaths => path_vr_panels::create_nulls(app, ui, rect),
-        PanelKind::VrCompEditor => path_vr_panels::vr_editor(app, ui, rect),
-    }
-}
-
-/// The ≡ panel menu (opened from a tab).
-pub fn panel_menu_popup(app: &mut EffectcraftApp, ui: &mut egui::Ui) {
-    let id = egui::Id::new("panel-menu");
-    let Some((panel, pos)) = ui.ctx().data(|d| d.get_temp::<(PanelKind, egui::Pos2)>(id)) else { return };
-    // The menu opens in the window that shows the panel (a panel can have its own window).
-    if app.panel_viewport(ui.ctx(), panel) != ui.ctx().viewport_id() {
-        return;
-    }
-    let mut close = false;
-    let area = egui::Area::new(id.with("area")).order(egui::Order::Foreground).fixed_pos(pos).show(ui.ctx(), |ui| {
-        egui::Frame::popup(ui.style()).show(ui, |ui| {
-            ui.set_min_width(200.0);
-            if ui.button(tr("Close Panel")).clicked() {
-                let _ = app.dock_command(ui.ctx(), craft_ui::docking::Action::Close { panel });
-                close = true;
-            }
-            let floating = app.ui.floating.iter().any(|f| f.panels.contains(&panel));
-            if !floating && ui.button(tr("Undock Panel")).clicked() {
-                let r = crate::dock_ui::default_float_rect(ui.ctx().content_rect());
-                let _ = app.dock_command(ui.ctx(), craft_ui::docking::Action::Float { panel, rect: r });
-                close = true;
-            }
-            // Multiple monitors: a native window of its own, which can go on another screen.
-            if !ui.ctx().embed_viewports() {
-                let windowed = app.in_panel_window(panel);
-                if ui.button(if windowed { tr("Move Panel to Main Window") } else { tr("Move Panel to New Window") }).clicked() {
-                    let _ = crate::menus::invoke(app, &ui.ctx().clone(), "window.panelWindow", serde_json::json!({"panel": panel, "window": !windowed}));
-                    close = true;
-                }
-            }
-            if !floating && ui.button(if app.ui.maximized == Some(panel) { tr("Restore Panel Size") } else { tr("Maximize Panel") }).clicked() {
-                app.toggle_maximize(panel);
-                close = true;
-            }
-            ui.separator();
-            match panel {
-                PanelKind::Timeline => {
-                    for (label, id) in [
-                        ("Hide Shy Layers", "hideShy"),
-                        ("Enable Frame Blending", "frameBlending"),
-                        ("Enable Motion Blur", "motionBlur"),
-                        ("Draft 3D", "draft3d"),
-                    ] {
-                        if ui.button(label).clicked() {
-                            let _ = app.session.execute("comp.setSwitch", serde_json::json!({"switch": id}));
-                            close = true;
-                        }
-                    }
-                    if ui.button(tr("Composition Settings…")).clicked() {
-                        let _ = dialogs::open_comp_settings(app);
-                        close = true;
-                    }
-                }
-                PanelKind::Composition | PanelKind::Viewer(_) => {
-                    for (label, cmd) in [
-                        ("New Viewer", "view.newViewer"),
-                        ("Composition Settings…", "app.compSettings"),
-                        ("View Options…", "view.layerControls"),
-                        ("Show Grid", "view.grid"),
-                        ("Title/Action Safe", "view.safeMargins"),
-                    ] {
-                        if ui.button(label).clicked() {
-                            let _ = crate::menus::invoke(app, &ui.ctx().clone(), cmd, serde_json::json!({}));
-                            close = true;
-                        }
-                    }
-                }
-                _ => {
-                    ui.label(egui::RichText::new(panel.title()).weak());
-                }
-            }
-        });
-    });
-    if close || crate::widgets::pressed_outside(ui.ctx(), &area.response) {
-        ui.ctx().data_mut(|d| d.remove::<(PanelKind, egui::Pos2)>(id));
-    }
-}
-
-#[cfg(test)]
-mod preset_drop_tests {
-    use super::PresetRef;
-    use serde_json::json;
-
-    #[test]
-    fn preset_drops_target_the_layer_with_each_commands_param() {
-        assert_eq!(PresetRef::Text("typewriter".into()).apply_to(7), ("layer.applyTextPreset", json!({"preset": "typewriter", "layer": 7})));
-        assert_eq!(PresetRef::Builtin("fadeIn".into()).apply_to(7), ("anim.applyBuiltinPreset", json!({"preset": "fadeIn", "layers": [7]})));
-        assert_eq!(PresetRef::File("/p/a.ecpreset".into()).apply_to(7), ("anim.applyPreset", json!({"path": "/p/a.ecpreset", "layers": [7]})));
-        // Double-click applies to the selection: no layer given.
-        assert_eq!(PresetRef::Text("typewriter".into()).command(), ("layer.applyTextPreset", json!({"preset": "typewriter"})));
-    }
-}
diff --git a/crates/ui-egui/src/panels/paint_panels.rs b/crates/ui-egui/src/panels/paint_panels.rs
index 675bc1e16..edf12ed7a 100644
--- a/crates/ui-egui/src/panels/paint_panels.rs
+++ b/crates/ui-egui/src/panels/paint_panels.rs
@@ -36,11 +36,21 @@ fn number(
     let t = app.tokens;
     p.text(pos2(x, y + 9.0), Align2::LEFT_CENTER, label, Tokens::ui(11.5), if enabled { t.text_dim } else { t.text_faint });
     let lw = p.layout_no_wrap(label.to_string(), Tokens::ui(11.5), t.text).size().x;
-    let (r, nv, _) = widgets::hot_number_at(ui, pos2(x + lw + 6.0, y), egui::Id::new(("paint-num", key)), v, 0.5, range, 0, suffix, &t);
+    let (r, nv, _) = widgets::hot_number_at(
+        ui,
+        pos2(x + lw + 6.0, y),
+        egui::Id::unique(("paint-num", key)),
+        v,
+        &widgets::HotSpec { speed: 0.5, range, decimals: 0, suffix },
+        &t,
+    );
     app.auto.add(key, r, label);
     nv.filter(|_| enabled)
 }
 
+/// A label at `x`, `y` and, to its right, a dropdown over `options` with `cur` selected. The
+/// dropdown only opens while `enabled`; otherwise only its label is dimmed. Returns the index
+/// picked from the open menu, if any.
 #[allow(clippy::too_many_arguments)]
 fn popup_row(
     app: &mut EffectcraftApp,
@@ -58,18 +68,74 @@ fn popup_row(
     let t = app.tokens;
     p.text(pos2(x, y + 10.0), Align2::LEFT_CENTER, label, Tokens::ui(11.5), if enabled { t.text_dim } else { t.text_faint });
     let r = Rect::from_min_size(pos2(x + 70.0, y), vec2((w - 70.0).max(60.0), 20.0));
-    let pop = egui::Id::new(("paint-pop", key));
-    if widgets::dropdown(ui, r, options.get(cur).map(String::as_str).unwrap_or(""), &t, egui::Id::new(("paint-dd", key))).clicked() && enabled {
+    let pop = egui::Id::unique(("paint-pop", key));
+    if widgets::dropdown(ui, r, options.get(cur).map(String::as_str).unwrap_or(""), &t, egui::Id::unique(("paint-dd", key))).clicked() && enabled {
         widgets::open_popup(ui, pop);
     }
     app.auto.add(key, r, label);
     widgets::popup_menu(ui, pop, r.left_bottom(), options, Some(cur))
 }
 
+/// The RGB components of an RGBA paint colour as `f32`, for the swatches and the colour picker.
 fn rgb(c: [f64; 4]) -> [f32; 3] {
     [c[0] as f32, c[1] as f32, c[2] as f32]
 }
 
+/// The swap-colours icon: one arrow right above one arrow left.
+fn paint_swap_icon(p: &egui::Painter, rect: Rect, color: Color32) {
+    let stroke = Stroke::new(1.0, color);
+    let (left, right) = (rect.left() + 2.0, rect.right() - 2.0);
+    let (top, bottom) = (rect.top() + 3.0, rect.bottom() - 3.0);
+    p.arrow(pos2(left, top), vec2(right - left, 0.0), stroke);
+    p.arrow(pos2(right, bottom), vec2(left - right, 0.0), stroke);
+}
+
+/// The foreground-over-background swatches (each opens a colour popup) with Swap and Reset.
+fn colour_swatches(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, x0: f32, y: f32, color: [f64; 4], background: [f64; 4]) {
+    let t = app.tokens;
+    let fg = Rect::from_min_size(pos2(x0, y), vec2(26.0, 20.0));
+    let bg = Rect::from_min_size(pos2(x0 + 14.0, y + 10.0), vec2(26.0, 20.0));
+    widgets::swatch(ui, bg, [background[0] as f32, background[1] as f32, background[2] as f32, 1.0], egui::Id::unique("paint-bg"), &t);
+    let bresp = ui.interact(Rect::from_min_max(pos2(fg.max.x, bg.min.y), bg.max), egui::Id::unique("paint-bg-hit"), Sense::click());
+    if bresp.clicked() {
+        widgets::open_popup(ui, egui::Id::unique("paint-bg-pop"));
+    }
+    if widgets::swatch(ui, fg, [color[0] as f32, color[1] as f32, color[2] as f32, 1.0], egui::Id::unique("paint-fg"), &t).clicked() {
+        widgets::open_popup(ui, egui::Id::unique("paint-fg-pop"));
+    }
+    app.auto.add("paint.color", fg, "Foreground color");
+    app.auto.add("paint.background", bg, "Background color");
+    let mut fc = rgb(color);
+    if crate::widgets::color_popup(ui, egui::Id::unique("paint-fg-pop"), fg.left_bottom(), &mut fc) {
+        set(app, json!({"color": [fc[0], fc[1], fc[2], 1.0]}));
+    }
+    let mut bc = rgb(background);
+    if crate::widgets::color_popup(ui, egui::Id::unique("paint-bg-pop"), bg.left_bottom(), &mut bc) {
+        set(app, json!({"background": [bc[0], bc[1], bc[2], 1.0]}));
+    }
+    let swap = Rect::from_min_size(pos2(x0 + 46.0, y), vec2(18.0, 14.0));
+    let sresp = ui.interact(swap, egui::Id::unique("paint-swap"), Sense::click());
+    // Two arrows (foreground over background): drawn, so the icon does not depend on a font
+    // carrying U+21C4 (the bundled fonts do not).
+    paint_swap_icon(p, swap, if sresp.hovered() { t.text } else { t.text_dim });
+    app.auto.add("paint.swapColors", swap, "Swap colors");
+    if sresp.on_hover_text(tr("Swap Paint Colors (X)")).clicked() {
+        set(app, json!({"color": background, "background": color}));
+    }
+    let reset = Rect::from_min_size(pos2(x0 + 46.0, y + 18.0), vec2(18.0, 14.0));
+    let rresp = ui.interact(reset, egui::Id::unique("paint-reset-colors"), Sense::click());
+    p.rect_filled(Rect::from_min_size(reset.min + vec2(4.0, 3.0), vec2(7.0, 6.0)), 0.0, Color32::WHITE);
+    p.rect_stroke(Rect::from_min_size(reset.min + vec2(8.0, 6.0), vec2(7.0, 6.0)), 0.0, Stroke::new(1.0, t.text_dim), StrokeKind::Inside);
+    app.auto.add("paint.resetColors", reset, "Default colors");
+    if rresp.on_hover_text(tr("Set Paint Colors to Black and White (D)")).clicked() {
+        set(app, json!({"color": [1.0, 1.0, 1.0, 1.0], "background": [0.0, 0.0, 0.0, 1.0]}));
+    }
+}
+
+/// The Paint panel: opacity and flow, foreground/background colours with swap and reset, mode,
+/// channels, duration, erase mode and the Clone Stamp options. Every change is sent as a
+/// `paint.options` command. Mode and Channels are disabled for the Eraser; Erase is enabled
+/// only for it. The Clone Options heading is dimmed for other tools, but its controls stay enabled.
 pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let p = ui.painter().with_clip_rect(rect);
@@ -89,41 +155,7 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     y += 28.0;
     // Colour swatches (foreground over background) with swap / reset.
-    let fg = Rect::from_min_size(pos2(x0, y), vec2(26.0, 20.0));
-    let bg = Rect::from_min_size(pos2(x0 + 14.0, y + 10.0), vec2(26.0, 20.0));
-    widgets::swatch(ui, bg, [o.background[0] as f32, o.background[1] as f32, o.background[2] as f32, 1.0], egui::Id::new("paint-bg"), &t);
-    let bresp = ui.interact(Rect::from_min_max(pos2(fg.max.x, bg.min.y), bg.max), egui::Id::new("paint-bg-hit"), Sense::click());
-    if bresp.clicked() {
-        widgets::open_popup(ui, egui::Id::new("paint-bg-pop"));
-    }
-    if widgets::swatch(ui, fg, [o.color[0] as f32, o.color[1] as f32, o.color[2] as f32, 1.0], egui::Id::new("paint-fg"), &t).clicked() {
-        widgets::open_popup(ui, egui::Id::new("paint-fg-pop"));
-    }
-    app.auto.add("paint.color", fg, "Foreground color");
-    app.auto.add("paint.background", bg, "Background color");
-    let mut fc = rgb(o.color);
-    if crate::widgets::color_popup(ui, egui::Id::new("paint-fg-pop"), fg.left_bottom(), &mut fc) {
-        set(app, json!({"color": [fc[0], fc[1], fc[2], 1.0]}));
-    }
-    let mut bc = rgb(o.background);
-    if crate::widgets::color_popup(ui, egui::Id::new("paint-bg-pop"), bg.left_bottom(), &mut bc) {
-        set(app, json!({"background": [bc[0], bc[1], bc[2], 1.0]}));
-    }
-    let swap = Rect::from_min_size(pos2(x0 + 46.0, y), vec2(18.0, 14.0));
-    let sresp = ui.interact(swap, egui::Id::new("paint-swap"), Sense::click());
-    p.text(swap.center(), Align2::CENTER_CENTER, "⇄", Tokens::ui(12.0), if sresp.hovered() { t.text } else { t.text_dim });
-    app.auto.add("paint.swapColors", swap, "Swap colors");
-    if sresp.on_hover_text(tr("Swap Paint Colors (X)")).clicked() {
-        set(app, json!({"color": o.background, "background": o.color}));
-    }
-    let reset = Rect::from_min_size(pos2(x0 + 46.0, y + 18.0), vec2(18.0, 14.0));
-    let rresp = ui.interact(reset, egui::Id::new("paint-reset-colors"), Sense::click());
-    p.rect_filled(Rect::from_min_size(reset.min + vec2(4.0, 3.0), vec2(7.0, 6.0)), 0.0, Color32::WHITE);
-    p.rect_stroke(Rect::from_min_size(reset.min + vec2(8.0, 6.0), vec2(7.0, 6.0)), 0.0, Stroke::new(1.0, t.text_dim), StrokeKind::Inside);
-    app.auto.add("paint.resetColors", reset, "Default colors");
-    if rresp.on_hover_text(tr("Set Paint Colors to Black and White (D)")).clicked() {
-        set(app, json!({"color": [1.0, 1.0, 1.0, 1.0], "background": [0.0, 0.0, 0.0, 1.0]}));
-    }
+    colour_swatches(app, ui, &p, x0, y, o.color, o.background);
     y += 40.0;
 
     // Mode / Channels / Duration.
@@ -146,12 +178,9 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let (r, nv, _) = widgets::hot_number_at(
             ui,
             pos2(x0 + w - 52.0, y + 1.0),
-            egui::Id::new("paint-custom-frames"),
+            egui::Id::unique("paint-custom-frames"),
             o.custom_frames as f64,
-            0.2,
-            (1.0, 10000.0),
-            0,
-            " f",
+            &widgets::HotSpec { speed: 0.2, range: (1.0, 10000.0), decimals: 0, suffix: " f" },
             &t,
         );
         app.auto.add("paint.customFrames", r, "Custom duration (frames)");
@@ -174,7 +203,7 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     p.text(pos2(x0, y + 10.0), Align2::LEFT_CENTER, tr("Preset:"), Tokens::ui(11.5), t.text_dim);
     for i in 1..=5u32 {
         let r = Rect::from_min_size(pos2(x0 + 56.0 + (i - 1) as f32 * 26.0, y), vec2(22.0, 20.0));
-        let resp = ui.interact(r, egui::Id::new(("clone-preset", i)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("clone-preset", i)), Sense::click());
         let on = o.clone_preset == i;
         p.rect_filled(
             r,
@@ -210,7 +239,7 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             .enumerate()
     {
         let r = Rect::from_min_size(pos2(x0 + i as f32 * (w / 2.0), y), vec2(18.0, 20.0));
-        if widgets::checkbox(ui, r, on, &t, egui::Id::new(key)).clicked() {
+        if widgets::checkbox(ui, r, on, &t, egui::Id::unique(key)).changed() {
             set(app, json!({k: !on}));
         }
         p.text(pos2(r.max.x + 4.0, r.center().y), Align2::LEFT_CENTER, label, Tokens::ui(11.5), t.text_dim);
@@ -220,7 +249,14 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let off = o.clone_offset.unwrap_or([0.0, 0.0]);
     p.text(pos2(x0, y + 9.0), Align2::LEFT_CENTER, tr("Offset:"), Tokens::ui(11.5), t.text_dim);
     for (d, v) in off.iter().enumerate() {
-        let (r, nv, _) = widgets::hot_number_at(ui, pos2(x0 + 56.0 + d as f32 * 64.0, y), egui::Id::new(("clone-off", d)), *v, 1.0, (-1e5, 1e5), 0, "", &t);
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(x0 + 56.0 + d as f32 * 64.0, y),
+            egui::Id::unique(("clone-off", d)),
+            *v,
+            &widgets::HotSpec { speed: 1.0, range: (-1e5, 1e5), decimals: 0, suffix: "" },
+            &t,
+        );
         app.auto.add(&format!("paint.cloneOffset.{d}"), r, "Clone offset");
         if let Some(nv) = nv {
             let mut no = off;
@@ -237,7 +273,7 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     y += 26.0;
     let r = Rect::from_min_size(pos2(x0, y), vec2(18.0, 20.0));
-    if widgets::checkbox(ui, r, o.show_overlay, &t, egui::Id::new("paint.showOverlay")).clicked() {
+    if widgets::checkbox(ui, r, o.show_overlay, &t, egui::Id::unique("paint.showOverlay")).changed() {
         set(app, json!({"showOverlay": !o.show_overlay}));
     }
     app.auto.add("paint.showOverlay", r, "Clone Source Overlay");
@@ -246,7 +282,7 @@ pub fn paint(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         set(app, json!({"overlayOpacity": nv}));
     }
     let dr = Rect::from_min_size(pos2(x0 + w - 18.0, y), vec2(18.0, 20.0));
-    if widgets::checkbox(ui, dr, o.overlay_difference, &t, egui::Id::new("paint.overlayDifference")).clicked() {
+    if widgets::checkbox(ui, dr, o.overlay_difference, &t, egui::Id::unique("paint.overlayDifference")).changed() {
         set(app, json!({"overlayDifference": !o.overlay_difference}));
     }
     app.auto.add("paint.overlayDifference", dr, "Difference mode overlay");
@@ -275,6 +311,9 @@ fn tip_preview(p: &egui::Painter, r: Rect, diameter: f64, angle: f64, roundness:
     }
 }
 
+/// The Brushes panel: a grid of built-in brush presets (each runs `paint.brushPreset`), a tip
+/// preview, diameter/angle/roundness/hardness/spacing fields and the size/opacity/flow pressure
+/// options. Values are sent as `paint.options` commands and failures land in `app.ui.status`.
 pub fn brushes(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let p = ui.painter().with_clip_rect(rect);
@@ -287,7 +326,7 @@ pub fn brushes(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let cols = ((w / cell).floor() as usize).max(1);
     for (i, tip) in BRUSH_PRESETS.iter().enumerate() {
         let r = Rect::from_min_size(pos2(x0 + (i % cols) as f32 * cell, y + (i / cols) as f32 * cell), vec2(cell - 2.0, cell - 2.0));
-        let resp = ui.interact(r, egui::Id::new(("brush-preset", i)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("brush-preset", i)), Sense::click());
         let on = o.preset == Some(i);
         p.rect_filled(
             r,
@@ -332,7 +371,14 @@ pub fn brushes(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // Spacing (checkbox in AE turns spacing on; we always space dabs, so it shows the value).
     p.text(pos2(x0, y + 9.0), Align2::LEFT_CENTER, tr("Spacing:"), Tokens::ui(11.5), t.text_dim);
     let _ = r;
-    let (sr, nv, _) = widgets::hot_number_at(ui, pos2(x0 + 58.0, y), egui::Id::new("brushes-spacing"), o.spacing, 0.5, (1.0, 1000.0), 0, " %", &t);
+    let (sr, nv, _) = widgets::hot_number_at(
+        ui,
+        pos2(x0 + 58.0, y),
+        egui::Id::unique("brushes-spacing"),
+        o.spacing,
+        &widgets::HotSpec { speed: 0.5, range: (1.0, 1000.0), decimals: 0, suffix: " %" },
+        &t,
+    );
     app.auto.add("brushes.spacing", sr, "Spacing");
     if let Some(nv) = nv {
         set(app, json!({"spacing": nv}));
diff --git a/crates/ui-egui/src/panels/panel_kit.rs b/crates/ui-egui/src/panels/panel_kit.rs
index cbf28c8ac..c1d88a417 100644
--- a/crates/ui-egui/src/panels/panel_kit.rs
+++ b/crates/ui-egui/src/panels/panel_kit.rs
@@ -9,7 +9,7 @@ use crate::{EffectcraftApp, widgets};
 /// A dropdown; returns the newly chosen index.
 pub fn dropdown(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, auto: &str, options: &[&str], cur: usize) -> Option<usize> {
     let t = app.tokens;
-    let id = egui::Id::new(("kit-dd", auto));
+    let id = egui::Id::unique(("kit-dd", auto));
     let text = options.get(cur).copied().unwrap_or("");
     if widgets::dropdown(ui, r, text, &t, id).clicked() {
         widgets::open_popup(ui, id);
@@ -23,7 +23,7 @@ pub fn dropdown(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, auto: &str
 pub fn checkbox(app: &mut EffectcraftApp, ui: &mut egui::Ui, at: egui::Pos2, auto: &str, text: &str, on: bool) -> bool {
     let t = app.tokens;
     let r = Rect::from_min_size(at, vec2(16.0, 16.0));
-    let clicked = widgets::checkbox(ui, r, on, &t, egui::Id::new(("kit-cb", auto))).clicked();
+    let clicked = widgets::checkbox(ui, r, on, &t, egui::Id::unique(("kit-cb", auto))).changed();
     ui.painter().text(pos2(r.max.x + 6.0, r.center().y), Align2::LEFT_CENTER, text, Tokens::ui(12.0), t.text);
     let full = Rect::from_min_size(at, vec2(22.0 + text.len() as f32 * 6.5, 16.0));
     app.auto.add(auto, full, text);
@@ -33,7 +33,7 @@ pub fn checkbox(app: &mut EffectcraftApp, ui: &mut egui::Ui, at: egui::Pos2, aut
 /// A text button; true when clicked.
 pub fn button(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, auto: &str, text: &str, primary: bool) -> bool {
     let t = app.tokens;
-    let clicked = widgets::text_button(ui, r, text, primary, &t, egui::Id::new(("kit-btn", auto))).clicked();
+    let clicked = widgets::text_button(ui, r, text, primary, &t, egui::Id::unique(("kit-btn", auto))).clicked();
     app.auto.add(auto, r, text);
     clicked
 }
@@ -47,7 +47,7 @@ pub fn label(ui: &egui::Ui, at: egui::Pos2, text: &str, t: &Tokens) {
 #[allow(clippy::too_many_arguments)]
 pub fn number(app: &mut EffectcraftApp, ui: &mut egui::Ui, at: egui::Pos2, auto: &str, v: f64, speed: f64, range: (f64, f64), dec: usize, suffix: &str) -> f64 {
     let t = app.tokens;
-    let (r, nv, _) = widgets::hot_number_at(ui, at, egui::Id::new(("kit-n", auto)), v, speed, range, dec, suffix, &t);
+    let (r, nv, _) = widgets::hot_number_at(ui, at, egui::Id::unique(("kit-n", auto)), v, &widgets::HotSpec { speed, range, decimals: dec, suffix }, &t);
     app.auto.add(auto, r, &format!("{v}"));
     nv.unwrap_or(v)
 }
diff --git a/crates/ui-egui/src/panels/path_vr_panels.rs b/crates/ui-egui/src/panels/path_vr_panels.rs
index 9dba0dd59..fcba902e4 100644
--- a/crates/ui-egui/src/panels/path_vr_panels.rs
+++ b/crates/ui-egui/src/panels/path_vr_panels.rs
@@ -36,7 +36,7 @@ pub fn create_nulls(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
     let mut ui = area(ui, rect);
-    let loop_id = egui::Id::new("createNulls.loop");
+    let loop_id = egui::Id::unique("createNulls.loop");
     let mut looping: bool = ui.data(|d| d.get_temp(loop_id)).unwrap_or(false);
     let ready = app.session.is_enabled("paths.nullsFollowPoints") && !app.session.state.selected_layers.is_empty();
     ui.label(RichText::new(tr("Select a layer with a mask or shape path (or the path property), or Puppet pins.")).color(t.text_dim).small());
@@ -54,7 +54,7 @@ pub fn create_nulls(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             acts.push((id, if id == "paths.tracePath" { json!({"loop": looping}) } else { json!({}) }));
         }
     }
-    let r = ui.checkbox(&mut looping, tr("Loop (Trace Path)"));
+    let r = crate::widgets::labelled_checkbox(&mut ui, &mut looping, tr("Loop (Trace Path)"));
     app.auto.add("createNulls.loop", r.rect, "Loop");
     ui.data_mut(|d| d.insert_temp(loop_id, looping));
     run(app, &ctx, acts);
@@ -70,7 +70,7 @@ pub fn vr_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         ui.label(RichText::new(tr("No VR environments yet. Create one with Composition ▸ VR ▸ Create VR Environment…")).color(t.text_faint));
         return;
     }
-    let sel_id = egui::Id::new("vrEditor.selected");
+    let sel_id = egui::Id::unique("vrEditor.selected");
     let active = app.session.state.active_comp.map(|c| c.0);
     let mut sel: u64 = ui.data(|d| d.get_temp(sel_id)).unwrap_or(0);
     // Default: the active comp's environment, else the first.
diff --git a/crates/ui-egui/src/panels/precomp.rs b/crates/ui-egui/src/panels/precomp.rs
index 8a40c56e9..6ec9072f3 100644
--- a/crates/ui-egui/src/panels/precomp.rs
+++ b/crates/ui-egui/src/panels/precomp.rs
@@ -141,11 +141,11 @@ pub fn dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         );
         ui.add_space(4.0);
         ui.add_enabled_ui(!d.leave, |ui| {
-            let r = ui.checkbox(&mut d.adjust, tr("Adjust composition duration to the time span of the selected layers"));
+            let r = crate::widgets::labelled_checkbox(ui, &mut d.adjust, tr("Adjust composition duration to the time span of the selected layers"));
             app.auto.add("dialog.precompose.adjust", r.rect, "Adjust composition duration");
         });
         ui.add_space(8.0);
-        let r = ui.checkbox(&mut d.open, tr("Open New Composition"));
+        let r = crate::widgets::labelled_checkbox(ui, &mut d.open, tr("Open New Composition"));
         app.auto.add("dialog.precompose.open", r.rect, "Open New Composition");
         ui.add_space(14.0);
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
@@ -209,7 +209,7 @@ pub fn navigator(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         };
         let g = p.layout_no_wrap(label.clone(), Tokens::ui(11.5), col);
         let r = Rect::from_min_size(pos2(x, rect.min.y + 2.0), vec2(g.size().x + 12.0, rect.height() - 4.0));
-        let resp = ui.interact(r, egui::Id::new(("comp-nav", id.0)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("comp-nav", id.0)), Sense::click());
         if active {
             p.rect_filled(r, 3.0, t.row_selected);
         } else if resp.hovered() {
@@ -223,7 +223,7 @@ pub fn navigator(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         x = r.max.x + 2.0;
     }
     let fr = Rect::from_min_size(pos2(rect.max.x - 26.0, rect.min.y + 2.0), vec2(22.0, rect.height() - 4.0));
-    if crate::widgets::icon_button(ui, fr, crate::icons::Icon::Flowchart, false, &t, egui::Id::new("comp-nav-flow"))
+    if crate::widgets::icon_button(ui, fr, crate::icons::Icon::Flowchart, false, &t, egui::Id::unique("comp-nav-flow"))
         .on_hover_text(tr("Composition Mini-Flowchart"))
         .clicked()
     {
@@ -248,64 +248,65 @@ pub fn mini_flowchart(app: &mut EffectcraftApp, ctx: &egui::Context) {
     let downs = downstream(&proj, cid);
     let mut open = None;
     let mut close = false;
-    let area = egui::Area::new(egui::Id::new("mini-flowchart")).order(egui::Order::Foreground).constrain(true).fixed_pos(pos2(at[0], at[1])).show(ctx, |ui| {
-        egui::Frame::popup(ui.style()).fill(t.panel_bg).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
-            let col_w = 160.0;
-            let rows = ups.len().max(downs.len()).max(1) as f32;
-            let h = rows * 26.0 + 8.0;
-            let (rect, _) = ui.allocate_exact_size(vec2(col_w * 3.0 + 60.0, h), Sense::hover());
-            let p = ui.painter().clone();
-            let node = |ui: &mut egui::Ui, app: &mut EffectcraftApp, r: Rect, id: ItemId, active: bool| {
-                let resp = ui.interact(r, egui::Id::new(("mfc", id.0)), Sense::click());
-                p.rect_filled(
-                    r,
-                    4.0,
-                    if active {
-                        t.accent
-                    } else if resp.hovered() {
-                        t.hover
-                    } else {
-                        t.field_bg
-                    },
-                );
-                p.text(r.center(), Align2::CENTER_CENTER, name(&proj, id), Tokens::ui(11.5), if active { Color32::WHITE } else { t.text });
-                app.auto.add(&format!("flowchart.mini.{}", id.0), r, &name(&proj, id));
-                resp.clicked()
-            };
-            let mid = Rect::from_center_size(rect.center(), vec2(col_w, 22.0));
-            if node(ui, app, mid, cid, true) {
-                close = true;
-            }
-            let col = |i: usize, n: usize, x: f32| {
-                let y0 = rect.center().y - (n as f32 * 26.0) / 2.0 + 13.0;
-                Rect::from_center_size(pos2(x, y0 + i as f32 * 26.0), vec2(col_w, 22.0))
-            };
-            let arrow = |a: egui::Pos2, b: egui::Pos2| {
-                p.line_segment([a, b], Stroke::new(1.2, t.text_dim));
-                let d = (b - a).normalized();
-                let n = vec2(-d.y, d.x);
-                p.add(egui::Shape::convex_polygon(vec![b, b - d * 7.0 + n * 3.5, b - d * 7.0 - n * 3.5], t.text_dim, Stroke::NONE));
-            };
-            for (i, u) in ups.iter().enumerate() {
-                let r = col(i, ups.len(), rect.min.x + col_w / 2.0);
-                // Upstream comps contain the active one: arrow from the nested comp up into them.
-                arrow(mid.left_center(), r.right_center());
-                if node(ui, app, r, *u, false) {
-                    open = Some(*u);
+    let area =
+        egui::Area::new(egui::Id::unique("mini-flowchart")).order(egui::Order::Foreground).constrain(true).fixed_pos(pos2(at[0], at[1])).show(ctx, |ui| {
+            egui::Frame::popup(ui.style()).fill(t.panel_bg).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
+                let col_w = 160.0;
+                let rows = ups.len().max(downs.len()).max(1) as f32;
+                let h = rows * 26.0 + 8.0;
+                let (rect, _) = ui.allocate_exact_size(vec2(col_w * 3.0 + 60.0, h), Sense::hover());
+                let p = ui.painter().clone();
+                let node = |ui: &mut egui::Ui, app: &mut EffectcraftApp, r: Rect, id: ItemId, active: bool| {
+                    let resp = ui.interact(r, egui::Id::unique(("mfc", id.0)), Sense::click());
+                    p.rect_filled(
+                        r,
+                        4.0,
+                        if active {
+                            t.accent
+                        } else if resp.hovered() {
+                            t.hover
+                        } else {
+                            t.field_bg
+                        },
+                    );
+                    p.text(r.center(), Align2::CENTER_CENTER, name(&proj, id), Tokens::ui(11.5), if active { Color32::WHITE } else { t.text });
+                    app.auto.add(&format!("flowchart.mini.{}", id.0), r, &name(&proj, id));
+                    resp.clicked()
+                };
+                let mid = Rect::from_center_size(rect.center(), vec2(col_w, 22.0));
+                if node(ui, app, mid, cid, true) {
+                    close = true;
                 }
-            }
-            for (i, d) in downs.iter().enumerate() {
-                let r = col(i, downs.len(), rect.max.x - col_w / 2.0);
-                arrow(r.left_center(), mid.right_center());
-                if node(ui, app, r, *d, false) {
-                    open = Some(*d);
+                let col = |i: usize, n: usize, x: f32| {
+                    let y0 = rect.center().y - (n as f32 * 26.0) / 2.0 + 13.0;
+                    Rect::from_center_size(pos2(x, y0 + i as f32 * 26.0), vec2(col_w, 22.0))
+                };
+                let arrow = |a: egui::Pos2, b: egui::Pos2| {
+                    p.line_segment([a, b], Stroke::new(1.2, t.text_dim));
+                    let d = (b - a).normalized();
+                    let n = vec2(-d.y, d.x);
+                    p.add(egui::Shape::convex_polygon(vec![b, b - d * 7.0 + n * 3.5, b - d * 7.0 - n * 3.5], t.text_dim, Stroke::NONE));
+                };
+                for (i, u) in ups.iter().enumerate() {
+                    let r = col(i, ups.len(), rect.min.x + col_w / 2.0);
+                    // Upstream comps contain the active one: arrow from the nested comp up into them.
+                    arrow(mid.left_center(), r.right_center());
+                    if node(ui, app, r, *u, false) {
+                        open = Some(*u);
+                    }
                 }
-            }
-            if ups.is_empty() && downs.is_empty() {
-                p.text(pos2(rect.center().x, rect.max.y - 4.0), Align2::CENTER_BOTTOM, tr("No nested compositions"), Tokens::ui(10.5), t.text_faint);
-            }
+                for (i, d) in downs.iter().enumerate() {
+                    let r = col(i, downs.len(), rect.max.x - col_w / 2.0);
+                    arrow(r.left_center(), mid.right_center());
+                    if node(ui, app, r, *d, false) {
+                        open = Some(*d);
+                    }
+                }
+                if ups.is_empty() && downs.is_empty() {
+                    p.text(pos2(rect.center().x, rect.max.y - 4.0), Align2::CENTER_BOTTOM, tr("No nested compositions"), Tokens::ui(10.5), t.text_faint);
+                }
+            });
         });
-    });
     let outside = crate::widgets::pressed_outside(ctx, &area.response);
     if let Some(id) = open {
         app.session.open_comp(id);
diff --git a/crates/ui-egui/src/panels/preview_merge.rs b/crates/ui-egui/src/panels/preview_merge.rs
new file mode 100644
index 000000000..ab41e3167
--- /dev/null
+++ b/crates/ui-egui/src/panels/preview_merge.rs
@@ -0,0 +1,204 @@
+//! Taking a dialog's Preview back without taking other edits with it.
+//!
+//! A previewing dialog (Camera, Light, Solid, Composition Settings, the Gradient Editor) puts the
+//! project and undo history back to a checkpoint when it is cancelled or Preview goes off. If the
+//! project changed in the meantime for another reason (a camera analysis finishing, a script, the
+//! control channel), swapping the checkpoint in would throw that edit away. This module undoes
+//! only what the preview did: a three-way merge of the checkpoint (before the preview), the project
+//! right after the preview (`Applied`) and the project now. Whatever the preview did not touch
+//! stays as it is now; what only the preview touched goes back to the checkpoint; what both touched
+//! keeps the other edit.
+
+use std::collections::BTreeSet;
+use std::sync::Arc;
+
+use effectcraft_engine::commands::text_edit::active_editor_snapshot;
+use effectcraft_engine::project::{Comp, Item, ItemId, ItemKind, Layer, LayerId, Project};
+
+use crate::EffectcraftApp;
+use crate::panels::layer_styles_dialog::{Checkpoint, restore};
+
+/// The project right after a preview was applied, and the undo depth then.
+#[derive(Clone)]
+pub(crate) struct Applied {
+    project: Arc<Project>,
+    undo_len: usize,
+}
+
+impl std::fmt::Debug for Applied {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Applied").field("undo_len", &self.undo_len).finish_non_exhaustive()
+    }
+}
+
+/// Note the project as the preview that has just been applied left it.
+pub(crate) fn applied(app: &EffectcraftApp) -> Applied {
+    Applied { project: app.session.project.clone(), undo_len: app.session.history.undo.len() }
+}
+
+/// Put the project back as `checkpoint` has it, minus nothing but the preview: when the project is
+/// still what the preview made (or nothing says what that was) the checkpoint is simply restored.
+pub(crate) fn rollback(app: &mut EffectcraftApp, checkpoint: Checkpoint, applied: Option<&Applied>) {
+    let Some(applied) = applied.filter(|a| !Arc::ptr_eq(&a.project, &app.session.project)) else {
+        restore(app, checkpoint);
+        return;
+    };
+    let merged = merge(&checkpoint.project, &applied.project, &app.session.project);
+    // One step for what was done meanwhile, from the project before the dialog: Undo takes it back.
+    let label = app.session.history.undo.get(applied.undo_len).map(|(label, _)| label.clone()).unwrap_or_else(|| "Edit".to_string());
+    let mut history = checkpoint.history;
+    history.undo.push((label, checkpoint.project));
+    history.redo.clear();
+    history.merge_key = None;
+    let edited = active_editor_snapshot(&app.session);
+    app.session.project = Arc::new(merged);
+    app.session.history = history;
+    app.session.sanitize_after_replacement(edited.as_ref());
+    app.session.bump();
+}
+
+/// `now` without the changes between `before` and `after`, keeping any other change.
+fn merge(before: &Project, after: &Project, now: &Project) -> Project {
+    let mut merged = now.clone();
+    let ids: BTreeSet<ItemId> = before.items.keys().chain(after.items.keys()).chain(now.items.keys()).copied().collect();
+    for id in ids {
+        match item(before.items.get(&id), after.items.get(&id), now.items.get(&id)) {
+            Some(it) => {
+                merged.items.insert(id, it);
+            }
+            None => {
+                merged.items.remove(&id);
+            }
+        }
+    }
+    merged
+}
+
+/// The three-way choice for one value: untouched by the preview keeps `now`, touched only by the
+/// preview goes back to `before`, touched by both is `both`.
+fn pick<T: PartialEq + Clone>(before: Option<&T>, after: Option<&T>, now: Option<&T>, both: impl FnOnce() -> Option<T>) -> Option<T> {
+    if after == before {
+        now.cloned()
+    } else if now == after {
+        before.cloned()
+    } else {
+        both()
+    }
+}
+
+fn item(before: Option<&Item>, after: Option<&Item>, now: Option<&Item>) -> Option<Item> {
+    pick(before, after, now, || {
+        if let (Some(b), Some(a), Some(n)) = (before, after, now)
+            && let (ItemKind::Comp(bc), ItemKind::Comp(ac), ItemKind::Comp(nc)) = (&b.kind, &a.kind, &n.kind)
+        {
+            let mut merged = n.clone();
+            // Name, folder and the like: only a preview that changed the item itself and nothing else
+            // is taken back; the comp's own contents are merged below.
+            merged.kind = ItemKind::Comp(Arc::new(comp(bc, ac, nc)));
+            return Some(merged);
+        }
+        now.cloned()
+    })
+}
+
+fn bare(c: &Comp) -> Comp {
+    let mut b = c.clone();
+    b.layers.clear();
+    b
+}
+
+fn layer_of(c: &Comp, id: LayerId) -> Option<&Layer> {
+    c.layers.iter().find(|l| l.id == id)
+}
+
+fn comp(before: &Comp, after: &Comp, now: &Comp) -> Comp {
+    // The comp's own settings, apart from its layers.
+    let mut merged = pick(Some(&bare(before)), Some(&bare(after)), Some(&bare(now)), || Some(bare(now))).unwrap_or_else(|| bare(now));
+    let merge_layer = |id: LayerId| pick(layer_of(before, id), layer_of(after, id), layer_of(now, id), || layer_of(now, id).cloned());
+    // Layers as they stand now, in their order, then the ones the preview removed put back.
+    let mut layers: Vec<Layer> = now.layers.iter().filter_map(|l| merge_layer(l.id)).collect();
+    for (at, l) in before.layers.iter().enumerate() {
+        if layer_of(now, l.id).is_none()
+            && let Some(back) = merge_layer(l.id)
+        {
+            layers.insert(at.min(layers.len()), back);
+        }
+    }
+    merged.layers = layers.into();
+    merged
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::Dialog;
+    use crate::panels::live_preview;
+    use effectcraft_engine::Session;
+    use serde_json::json;
+
+    fn app_with_light() -> (EffectcraftApp, u64) {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Scene", "width": 320, "height": 180, "duration": 1})).unwrap();
+        let light = s.execute("layer.newLight", json!({"kind": "Point"})).unwrap()["layer"].as_u64().unwrap();
+        (EffectcraftApp::new(s), light)
+    }
+
+    fn name_of(app: &EffectcraftApp, layer: u64) -> String {
+        app.session.active_comp().unwrap().layer(LayerId(layer)).unwrap().name.clone()
+    }
+
+    fn layer_count(app: &EffectcraftApp) -> usize {
+        app.session.active_comp().unwrap().layers.len()
+    }
+
+    /// The preview renames the light; a null is added meanwhile (what a finished background job
+    /// would do). Cancel takes the rename back and keeps the null, with one undo step for it.
+    #[test]
+    fn cancelling_a_preview_keeps_an_edit_made_while_it_was_open() {
+        let (mut app, light) = app_with_light();
+        let original = name_of(&app, light);
+        app.dialog = Some(Dialog::LightSettings);
+        live_preview::begin(&mut app, Dialog::LightSettings);
+        let rename = |name: &str| json!({"layer": light, "name": name});
+        live_preview::sync(&mut app, "layer.rename", rename(&original));
+        live_preview::sync(&mut app, "layer.rename", rename("Previewed"));
+        assert_eq!(name_of(&app, light), "Previewed");
+        let layers = layer_count(&app);
+        app.session.execute("layer.newNull", json!({})).unwrap();
+        live_preview::cancel(&mut app);
+        assert_eq!(name_of(&app, light), original, "the preview is taken back");
+        assert_eq!(layer_count(&app), layers + 1, "the other edit stays");
+        assert!(app.session.undo());
+        assert_eq!(layer_count(&app), layers, "and has its own undo step");
+        assert_eq!(name_of(&app, light), original);
+    }
+
+    /// With nothing else done meanwhile the checkpoint is restored as before.
+    #[test]
+    fn cancelling_an_undisturbed_preview_restores_the_checkpoint() {
+        let (mut app, light) = app_with_light();
+        let original = name_of(&app, light);
+        let steps = app.session.history.undo.len();
+        app.dialog = Some(Dialog::LightSettings);
+        live_preview::begin(&mut app, Dialog::LightSettings);
+        live_preview::sync(&mut app, "layer.rename", json!({"layer": light, "name": original}));
+        live_preview::sync(&mut app, "layer.rename", json!({"layer": light, "name": "Previewed"}));
+        live_preview::cancel(&mut app);
+        assert_eq!(name_of(&app, light), original);
+        assert_eq!(app.session.history.undo.len(), steps);
+    }
+
+    /// An item both the preview and another edit changed keeps the other edit.
+    #[test]
+    fn a_layer_both_edits_changed_keeps_the_other_edit() {
+        let (mut app, light) = app_with_light();
+        let original = name_of(&app, light);
+        app.dialog = Some(Dialog::LightSettings);
+        live_preview::begin(&mut app, Dialog::LightSettings);
+        live_preview::sync(&mut app, "layer.rename", json!({"layer": light, "name": original}));
+        live_preview::sync(&mut app, "layer.rename", json!({"layer": light, "name": "Previewed"}));
+        app.session.execute("layer.rename", json!({"layer": light, "name": "Renamed elsewhere"})).unwrap();
+        live_preview::cancel(&mut app);
+        assert_eq!(name_of(&app, light), "Renamed elsewhere");
+    }
+}
diff --git a/crates/ui-egui/src/panels/primitive_dialog.rs b/crates/ui-egui/src/panels/primitive_dialog.rs
new file mode 100644
index 000000000..3711c6a80
--- /dev/null
+++ b/crates/ui-egui/src/panels/primitive_dialog.rs
@@ -0,0 +1,125 @@
+//! New 3D Primitive dialog (Layer ▸ New ▸ 3D Primitive…): the primitive's type, name and
+//! dimensions. OK runs `layer.newPrimitive`, which switches a Classic 3D comp to Advanced 3D;
+//! the layer's Geometry Options edit it afterwards.
+
+use std::collections::BTreeMap;
+
+use crate::i18n::tr;
+use effectcraft_engine::project::build::{Ids, primitive_geometry_options};
+use effectcraft_engine::project::{ItemId, ParamUi, PrimitiveKind, Property};
+use egui::{Color32, vec2};
+use serde_json::{Value, json};
+
+use crate::theme::Tokens;
+use crate::{Dialog, EffectcraftApp};
+
+#[derive(Clone, Debug, Default)]
+pub struct PrimitiveDraft {
+    pub kind: PrimitiveKind,
+    pub name: String,
+    /// Whether the name was typed; until then it follows the type.
+    pub named: bool,
+    /// Dimensions typed, by Geometry Options match id, kept when the type changes (a sphere's
+    /// radius carries over to a cone); the rest are the type's defaults.
+    pub dims: BTreeMap<String, f64>,
+    /// The project (its epoch) and comp the dialog was opened for.
+    pub target: Option<(u64, ItemId)>,
+}
+
+fn target(app: &EffectcraftApp) -> Option<(u64, ItemId)> {
+    Some((app.session.script_ui.project_epoch, app.session.active_comp_id()?))
+}
+
+/// The dimensions a primitive type has: its Geometry Options as the engine builds them.
+fn dimensions(kind: PrimitiveKind) -> Vec<Property> {
+    let mut next = 0;
+    primitive_geometry_options(&mut Ids(&mut next), kind).props().cloned().collect()
+}
+
+/// Open the dialog for a new primitive in the active comp.
+pub fn open(app: &mut EffectcraftApp) -> Result<(), String> {
+    let target = Some(target(app).ok_or("no composition is open")?);
+    let kind = PrimitiveKind::Cube;
+    app.dialog_state.primitive = PrimitiveDraft { kind, name: kind.label().to_string(), named: false, dims: BTreeMap::new(), target };
+    app.dialog = Some(Dialog::NewPrimitive);
+    Ok(())
+}
+
+pub fn dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
+    let mut d = app.dialog_state.primitive.clone();
+    // A project opened or another comp made active since (by a script or the control channel):
+    // the primitive would land somewhere the dialog was not opened for.
+    if target(app) != d.target {
+        app.ui.status = "New 3D Primitive closed: the composition changed".into();
+        app.dialog = None;
+        return;
+    }
+    let (mut ok, mut close) = (false, false);
+    super::dialogs::modal(ctx, "New 3D Primitive", vec2(420.0, 300.0), t, |ui| {
+        egui::Grid::new("primitive-grid").num_columns(2).spacing([14.0, 9.0]).show(ui, |ui| {
+            ui.label(tr("Type"));
+            let combo = craft_ui::ComboBox::from_id_salt("primitive-type").selected_text(tr(d.kind.label())).show_ui(ui, |ui| {
+                for (i, k) in PrimitiveKind::ALL.into_iter().enumerate() {
+                    let item = ui.selectable_value(&mut d.kind, k, tr(k.label()));
+                    app.auto.add(&format!("dialog.primitive.typeItem.{i}"), item.rect, k.label());
+                }
+            });
+            app.auto.add_response("dialog.primitive.type", &combo.response, "Type");
+            if !d.named {
+                d.name = d.kind.label().to_string();
+            }
+            ui.end_row();
+            ui.label(tr("Name"));
+            let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(220.0));
+            d.named |= r.changed();
+            app.auto.add_response("dialog.primitive.name", &r, "Name");
+            ui.end_row();
+            for p in dimensions(d.kind) {
+                let ParamUi::Slider { min, max, decimals, .. } = p.ui else { continue };
+                let mut v = d.dims.get(&p.match_id).copied().unwrap_or(p.value.as_f64());
+                ui.label(tr(&p.name));
+                // Counts (segments, rings) are whole numbers; sizes are pixels.
+                let suffix = if decimals == 0 { "" } else { " px" };
+                let r = ui.add(crate::widgets::drag_value(egui::DragValue::new(&mut v).range(min..=max).max_decimals(decimals as usize).suffix(suffix)));
+                app.auto.add_response(&format!("dialog.primitive.{}", p.match_id), &r, &p.name);
+                if r.changed() {
+                    d.dims.insert(p.match_id, v);
+                }
+                ui.end_row();
+            }
+        });
+        ui.add_space(14.0);
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            let b = ui.add(egui::Button::new(egui::RichText::new(tr("   OK   ")).color(Color32::WHITE)).fill(t.accent));
+            app.auto.add("dialog.primitive.ok", b.rect, "OK");
+            ok |= b.clicked();
+            let c = ui.button(tr("Cancel"));
+            app.auto.add("dialog.primitive.cancel", c.rect, "Cancel");
+            close |= c.clicked();
+        });
+    });
+    app.dialog_state.primitive = d.clone();
+    if ok || super::dialogs::ui_enter(ctx) {
+        let mut p = json!({"kind": d.kind.label().to_ascii_lowercase(), "name": d.name});
+        for dim in dimensions(d.kind) {
+            if let Some(v) = d.dims.get(&dim.match_id) {
+                p[dim.match_id.as_str()] = json!(v);
+            }
+        }
+        if let Err(e) = app.session.execute("layer.newPrimitive", p) {
+            app.ui.status = e.to_string();
+        }
+        close = true;
+    }
+    if close {
+        app.dialog = None;
+    }
+}
+
+/// Menu routing: New 3D Primitive without parameters opens the dialog. Returns true when it did.
+pub fn route(app: &mut EffectcraftApp, id: &str, params: &Value) -> Result<bool, String> {
+    if id != "layer.newPrimitive" || !params.as_object().is_none_or(|m| m.is_empty()) {
+        return Ok(false);
+    }
+    open(app).map(|_| true)
+}
diff --git a/crates/ui-egui/src/panels/project.rs b/crates/ui-egui/src/panels/project.rs
index c4e9894c4..8d67fd9ee 100644
--- a/crates/ui-egui/src/panels/project.rs
+++ b/crates/ui-egui/src/panels/project.rs
@@ -126,8 +126,8 @@ type PendingThumb = (u64, Arc<Mutex<Option<Option<(u32, u32, Vec<u8>)>>>>);
 /// Rendered on a background thread (inline on wasm32): until the new one lands the previous
 /// thumbnail stays up, so selecting a big comp or editing it never stalls the panel.
 fn thumbnail(app: &EffectcraftApp, ctx: &egui::Context, it: &Item) -> Option<egui::TextureHandle> {
-    let key = egui::Id::new(("proj-thumb", it.id.0));
-    let pkey = egui::Id::new(("proj-thumb-pending", it.id.0));
+    let key = egui::Id::unique(("proj-thumb", it.id.0));
+    let pkey = egui::Id::unique(("proj-thumb-pending", it.id.0));
     let rev = app.session.revision;
     let cached: Option<(u64, egui::TextureHandle)> = ctx.data(|d| d.get_temp(key));
     let mut tex = cached.as_ref().map(|(_, t)| t.clone());
@@ -191,8 +191,10 @@ fn fit(r: Rect, w: f32, h: f32) -> Rect {
 
 /// An inline text edit in progress: (item, field `name`|`comment`, text).
 type Editing = (u64, String, String);
+/// The `egui::Id` of the Project panel's inline edit in progress ([`Editing`]): the item, which
+/// field (`name` or `comment`) and the text being typed.
 fn edit_id() -> egui::Id {
-    egui::Id::new("proj-inline-edit")
+    egui::Id::unique("proj-inline-edit")
 }
 
 /// Start renaming the selected item (Enter in the Project panel).
@@ -206,22 +208,27 @@ pub fn begin_rename(app: &EffectcraftApp, ctx: &egui::Context) {
 
 /// Where a Shift-extended selection starts (the last item clicked or moved to without Shift).
 fn anchor_id() -> egui::Id {
-    egui::Id::new("project-selection-anchor")
+    egui::Id::unique("project-selection-anchor")
 }
 
 /// The item the arrow keys move from: the last item clicked or moved to.
 fn cursor_id() -> egui::Id {
-    egui::Id::new("project-selection-cursor")
+    egui::Id::unique("project-selection-cursor")
 }
 
 /// An item row's widget: its click / drag area, keyboard focus and accessibility node.
 fn row_id(item: ItemId) -> egui::Id {
-    egui::Id::new(("pitem", item.0))
+    egui::Id::unique(("pitem", item.0))
 }
 
 /// The last row drawn with keyboard focus (egui drops the focus of a row scrolled out of view).
 fn focused_row_id() -> egui::Id {
-    egui::Id::new("project-focused-row")
+    egui::Id::unique("project-focused-row")
+}
+
+/// The item whose selection the panel last scrolled into view.
+fn selection_seen_id() -> egui::Id {
+    egui::Id::unique("proj-sel-seen")
 }
 
 /// The focused widget is one of the panel's rows, or nothing has keyboard focus: the panel's keys
@@ -328,31 +335,77 @@ fn keyboard_nav(app: &mut EffectcraftApp, ctx: &egui::Context) -> Option<ItemId>
     moved
 }
 
+/// Match names and dependency status, retain folder ancestors, and expand them while filtering.
+/// Iterative traversal bounds cyclic document trees and builds each folder's child list once.
 pub(crate) fn visible_rows(app: &EffectcraftApp) -> Vec<(ItemId, usize)> {
-    fn walk(app: &EffectcraftApp, folder: Option<ItemId>, depth: usize, q: &str, out: &mut Vec<(ItemId, usize)>) {
-        let mut kids = app.session.project.children(folder);
-        sort_items(&mut kids, &app.ui.project_sort, app.ui.project_sort_desc);
-        for it in kids {
-            if !q.is_empty() && !it.is_folder() && !it.name.to_lowercase().contains(q) {
-                continue;
-            }
-            out.push((it.id, depth));
-            if it.is_folder() && (app.ui.project_open_folders.contains(&it.id.0) || !q.is_empty()) {
-                walk(app, Some(it.id), depth + 1, q, out);
+    let project = &app.session.project;
+    let q = app.ui.project_search.to_lowercase();
+    let filtered = !q.is_empty() || app.ui.project_status != crate::state::ProjectStatus::All;
+    let mut included = std::collections::BTreeSet::new();
+    if filtered {
+        for item in project.items.values().filter(|i| !i.is_folder() && app.ui.project_status.matches(i) && i.name.to_lowercase().contains(&q)) {
+            let mut id = Some(item.id);
+            while let Some(current) = id {
+                if !included.insert(current) {
+                    break;
+                }
+                id = project.item(current).and_then(|i| i.parent);
             }
         }
     }
-    let mut rows = vec![];
-    walk(app, None, 0, &app.ui.project_search.to_lowercase(), &mut rows);
+    let mut children: std::collections::BTreeMap<Option<ItemId>, Vec<&Item>> = std::collections::BTreeMap::new();
+    for item in project.items.values() {
+        children.entry(item.parent).or_default().push(item);
+    }
+    for kids in children.values_mut() {
+        sort_items(kids, &app.ui.project_sort, app.ui.project_sort_desc);
+    }
+    let mut pending: Vec<_> = children.get(&None).into_iter().flatten().rev().map(|i| (*i, 0usize)).collect();
+    let mut seen = std::collections::BTreeSet::new();
+    let mut rows = Vec::new();
+    while let Some((item, depth)) = pending.pop() {
+        if !seen.insert(item.id) || (filtered && !included.contains(&item.id)) {
+            continue;
+        }
+        rows.push((item.id, depth));
+        if item.is_folder() && (filtered || app.ui.project_open_folders.contains(&item.id.0)) {
+            pending.extend(children.get(&Some(item.id)).into_iter().flatten().rev().map(|i| (*i, depth.saturating_add(1))));
+        }
+    }
     rows
 }
 
-pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+/// Bring `items` into view: clear the panel's search, open every folder holding them, select
+/// them, and show and focus the Project panel. Used by Reveal Layer Source in Project and
+/// Reveal Composition in Project, so the item is visible even in a large, filtered project.
+pub(crate) fn reveal(app: &mut EffectcraftApp, ctx: &egui::Context, items: &[ItemId]) {
+    let items: Vec<ItemId> = items.iter().copied().filter(|item| app.session.project.item(*item).is_some()).collect();
+    if items.is_empty() {
+        return;
+    }
+    for item in &items {
+        let mut parent = app.session.project.item(*item).and_then(|item| item.parent);
+        let mut depth = 0;
+        while let Some(folder) = parent {
+            app.ui.project_open_folders.insert(folder.0);
+            parent = app.session.project.item(folder).and_then(|item| item.parent);
+            depth += 1;
+            if depth > 256 {
+                break;
+            }
+        }
+    }
+    app.ui.project_search.clear();
+    app.ui.project_status = crate::state::ProjectStatus::All;
+    app.session.state.project_selection = items;
+    // Force the panel's selection scroll on its next draw, even when the item was already selected.
+    ctx.data_mut(|d| d.remove_temp::<Option<u64>>(selection_seen_id()));
+    app.show_panel(crate::dock::PanelKind::Project);
+}
+
+/// The selected item's thumbnail and details (with the comps that use it), or a hint.
+fn details_header(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, ctx: &egui::Context, head: Rect) {
     let t = app.tokens;
-    let p = ui.painter().clone();
-    let ctx = ui.ctx().clone();
-    // Preview header.
-    let head = Rect::from_min_size(rect.min, vec2(rect.width(), 74.0));
     let sel = app.session.state.project_selection.first().copied();
     if let Some(it) = sel.and_then(|i| app.session.project.item(i)).cloned() {
         let thumb = Rect::from_min_size(head.min + vec2(10.0, 10.0), vec2(96.0, 54.0));
@@ -361,12 +414,12 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             ItemKind::Solid(s) => {
                 p.rect_filled(thumb.shrink(4.0), 2.0, Color32::from_rgb((s.color[0] * 255.0) as u8, (s.color[1] * 255.0) as u8, (s.color[2] * 255.0) as u8));
             }
-            _ => match thumbnail(app, &ctx, &it) {
+            _ => match thumbnail(app, ctx, &it) {
                 Some(tex) => {
                     let [w, h] = tex.size();
                     p.image(tex.id(), fit(thumb, w as f32, h as f32), Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
                 }
-                None => icons::paint(&p, Rect::from_center_size(thumb.center(), vec2(24.0, 24.0)), item_icon(&it), t.text_dim),
+                None => icons::paint(p, Rect::from_center_size(thumb.center(), vec2(24.0, 24.0)), item_icon(&it), t.text_dim),
             },
         }
         app.auto.add("project.thumbnail", thumb, &it.name);
@@ -379,7 +432,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let count = users.iter().fold(0usize, |n, (_, k)| n.saturating_add(*k));
         let name_y = thumb.min.y + 6.0;
         if count == 0 {
-            let r = widgets::text_fit(&p, pos2(tx, name_y), Align2::LEFT_CENTER, &it.name, Tokens::semibold(12.0), max_w, t.text);
+            let r = widgets::text_fit(p, pos2(tx, name_y), Align2::LEFT_CENTER, &it.name, Tokens::semibold(12.0), max_w, t.text);
             app.auto.add("project.details.name", r, &it.name);
         } else {
             let used = if count == 1 { crate::i18n::tr("used once").to_owned() } else { crate::i18n::tr_args("used {} times", &[&count]) };
@@ -388,17 +441,17 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             let arrow_w = 14.0;
             // The name gives way first, but keeps at least half the room; the count is cut after it.
             let name_max = (max_w - arrow_w - used_w).max(max_w * 0.5);
-            let r = widgets::text_fit(&p, pos2(tx, name_y), Align2::LEFT_CENTER, &it.name, Tokens::semibold(12.0), name_max, t.text);
+            let r = widgets::text_fit(p, pos2(tx, name_y), Align2::LEFT_CENTER, &it.name, Tokens::semibold(12.0), name_max, t.text);
             app.auto.add("project.details.name", r, &it.name);
             let ar = Rect::from_min_size(pos2(r.max.x + 1.0, name_y - 7.0), vec2(arrow_w, 14.0));
             let tip = crate::i18n::tr("Compositions that use this item");
-            let aresp = ui.interact(ar, egui::Id::new("proj-used-in"), Sense::click()).on_hover_text(tip);
-            icons::paint(&p, Rect::from_center_size(ar.center(), vec2(9.0, 9.0)), Icon::ChevronDown, if aresp.hovered() { t.text } else { t.text_dim });
+            let aresp = ui.interact(ar, egui::Id::unique("proj-used-in"), Sense::click()).on_hover_text(tip);
+            icons::paint(p, Rect::from_center_size(ar.center(), vec2(9.0, 9.0)), Icon::ChevronDown, if aresp.hovered() { t.text } else { t.text_dim });
             app.auto.add("project.details.usedIn", ar, tip);
             // The comma sits right after the arrow (its glyph ends short of the hit area).
             let ux = ar.max.x - 3.0;
             let room = (head.max.x - 10.0 - ux).max(0.0);
-            let ur = widgets::text_fit(&p, pos2(ux, name_y), Align2::LEFT_CENTER, &used, Tokens::ui(11.0), room, t.text_dim);
+            let ur = widgets::text_fit(p, pos2(ux, name_y), Align2::LEFT_CENTER, &used, Tokens::ui(11.0), room, t.text_dim);
             app.auto.add("project.details.used", ur, &used);
             let names: Vec<(u64, String, usize)> =
                 users.iter().map(|(cid, n)| (cid.0, app.session.project.item(*cid).map(|c| c.name.clone()).unwrap_or_default(), *n)).collect();
@@ -415,7 +468,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 }
             });
             if let Some(cid) = open
-                && let Err(e) = crate::menus::invoke(app, &ctx, "comp.open", json!({"comp": cid}))
+                && let Err(e) = crate::menus::invoke(app, ctx, "comp.open", json!({"comp": cid}))
             {
                 app.ui.status = e;
             }
@@ -432,24 +485,75 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             lines.push(f.codec.clone());
         }
         for (i, l) in lines.iter().enumerate() {
-            let r = widgets::text_fit(&p, pos2(tx, thumb.min.y + 22.0 + 13.0 * i as f32), Align2::LEFT_CENTER, l, Tokens::ui(11.0), max_w, t.text_dim);
+            let r = widgets::text_fit(p, pos2(tx, thumb.min.y + 22.0 + 13.0 * i as f32), Align2::LEFT_CENTER, l, Tokens::ui(11.0), max_w, t.text_dim);
             app.auto.add(&format!("project.details.{i}"), r, l);
         }
     } else {
         let hint = "Select an item to see its details";
-        let r = widgets::text_fit(&p, head.center(), Align2::CENTER_CENTER, hint, Tokens::ui(11.0), head.width() - 20.0, t.text_faint);
+        let r = widgets::text_fit(p, head.center(), Align2::CENTER_CENTER, crate::i18n::tr(hint), Tokens::ui(11.0), head.width() - 20.0, t.text_faint);
         app.auto.add("project.details.hint", r, hint);
     }
-    // Search.
-    let sr = Rect::from_min_size(pos2(rect.min.x + 8.0, head.max.y + 2.0), vec2(rect.width() - 16.0, 22.0));
-    let mut q = app.ui.project_search.clone();
-    widgets::search_field(ui, sr, &mut q, "Search project", &t);
-    app.ui.project_search = q;
-    app.auto.add("project.search", sr, "Search");
-    // Column header: Name, Label, then the visible optional columns.
-    let hdr = Rect::from_min_size(pos2(rect.min.x, sr.max.y + 6.0), vec2(rect.width(), 20.0));
-    p.line_segment([hdr.left_bottom(), hdr.right_bottom()], Stroke::new(1.0, t.separator));
-    let name_w = (rect.width() * 0.40).clamp(120.0, 260.0);
+}
+
+/// Column positions: Name and Label, then the visible optional columns (scrolled by `hscroll`).
+struct Columns {
+    cols: Vec<(&'static str, &'static str, f32, f32)>,
+    name_w: f32,
+    label_x: f32,
+    opt_x0: f32,
+    /// How far the optional columns overflow the panel.
+    overflow: f32,
+    hscroll: f32,
+    /// Where the last column ends.
+    end_x: f32,
+}
+
+impl Columns {
+    /// `r` cut off under the frozen Name and Label columns.
+    fn opt_clip(&self, r: Rect) -> Rect {
+        Rect::from_min_max(pos2(r.min.x.max(self.opt_x0 - 4.0), r.min.y), r.max)
+    }
+}
+
+/// Narrowest Name column (points).
+const MIN_NAME_W: f32 = 120.0;
+
+/// The Name column width that shows every listed name in full: indent, twirl and icon, the
+/// name, and room for a problem marker.
+fn name_fit(app: &EffectcraftApp, p: &egui::Painter, rows: &[(ItemId, usize)]) -> f32 {
+    rows.iter()
+        .filter_map(|(id, depth)| {
+            let it = app.session.project.item(*id)?;
+            let text = p.layout_no_wrap(it.name.clone(), Tokens::ui(12.0), Color32::WHITE).size().x;
+            Some(8.0 + 14.0 * *depth as f32 + 30.0 + text + 24.0)
+        })
+        .fold(0.0, f32::max)
+}
+
+/// [`name_fit`] of the listed rows: only an automatic width (or an invalid saved one) measures the
+/// names.
+fn auto_name_fit(app: &EffectcraftApp, p: &egui::Painter) -> f32 {
+    if app.ui.project_name_w.is_some_and(f32::is_finite) { 0.0 } else { name_fit(app, p, &visible_rows(app)) }
+}
+
+/// The part of the panel the optional columns keep next to a widest Name column (points): room
+/// for some of their content and a horizontal scroll bar track that can be dragged.
+const MIN_OPTIONAL_VIEW: f32 = 40.0;
+
+/// The widest the Name column gets in a panel `width` points wide: the width less the Label
+/// column (40 points), and less [`MIN_OPTIONAL_VIEW`] while optional columns are shown.
+fn name_max_w(app: &EffectcraftApp, width: f32) -> f32 {
+    let optional = if app.ui.project_columns.iter().any(|k| COLUMNS.iter().any(|c| c.0 == k)) { MIN_OPTIONAL_VIEW } else { 0.0 };
+    (width - 40.0 - optional).max(MIN_NAME_W)
+}
+
+/// Column positions. The Name column is as wide as the user dragged it, else wide enough for
+/// the names listed (`fit`), as After Effects shows full names; at most [`name_max_w`] (the
+/// optional columns scroll under it).
+fn layout_columns(app: &mut EffectcraftApp, rect: Rect, fit: f32) -> Columns {
+    let max_w = name_max_w(app, rect.width());
+    let auto = (rect.width() * 0.40).clamp(MIN_NAME_W, 260.0).max(fit);
+    let name_w = app.ui.project_name_w.filter(|w| w.is_finite()).unwrap_or(auto).clamp(MIN_NAME_W, max_w);
     let label_x = rect.min.x + name_w + 14.0;
     let mut cols: Vec<(&'static str, &'static str, f32, f32)> = vec![("name", "Name", rect.min.x + 26.0, name_w - 26.0), ("label", "", label_x - 8.0, 18.0)];
     // Optional columns wider than the panel scroll horizontally under the frozen Name and Label
@@ -466,16 +570,29 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             x += w + 4.0;
         }
     }
-    let opt_clip = |r: Rect| Rect::from_min_max(pos2(r.min.x.max(opt_x0 - 4.0), r.min.y), r.max);
+    Columns { cols, name_w, label_x, opt_x0, overflow, hscroll, end_x: x }
+}
+
+/// The column header row: sort labels with the sort arrow, and the Columns menu.
+fn draw_header(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, hdr: Rect, cl: &Columns) {
+    let t = app.tokens;
+    let Columns { cols, label_x, end_x, .. } = cl;
+    let (label_x, end_x) = (*label_x, *end_x);
     let hp = p.with_clip_rect(hdr);
-    for (key, label, x, w) in &cols {
+    for (key, label, x, w) in cols {
         let hr = Rect::from_min_size(pos2(x - 4.0, hdr.min.y), vec2(*w, hdr.height()));
-        let hr = if matches!(*key, "name" | "label") { hr } else { opt_clip(hr) };
+        let hr = if matches!(*key, "name" | "label") { hr } else { cl.opt_clip(hr) };
         if hr.width() <= 0.0 {
             continue;
         }
-        let resp = ui.interact(hr.intersect(hdr), egui::Id::new(("proj-sort", *key)), Sense::click());
-        hp.with_clip_rect(hr).text(pos2(*x, hdr.center().y), Align2::LEFT_CENTER, *label, Tokens::ui(11.0), if resp.hovered() { t.text } else { t.text_dim });
+        let resp = ui.interact(hr.intersect(hdr), egui::Id::unique(("proj-sort", *key)), Sense::click());
+        hp.with_clip_rect(hr).text(
+            pos2(*x, hdr.center().y),
+            Align2::LEFT_CENTER,
+            crate::i18n::tr(label),
+            Tokens::ui(11.0),
+            if resp.hovered() { t.text } else { t.text_dim },
+        );
         if *key == "label" {
             icons::paint(&hp, Rect::from_center_size(pos2(label_x, hdr.center().y), vec2(10.0, 10.0)), Icon::Keyframe, t.text_dim);
         }
@@ -496,7 +613,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 Some(o) => crate::i18n::tr_args("Sort by {}, {}", &[&column, &o]),
                 None => crate::i18n::tr_args("Sort by {}", &[&column]),
             };
-            egui::WidgetInfo::labeled(egui::WidgetType::Button, true, name)
+            egui::WidgetInfo::labeled(egui::Role::Button, true, name)
         });
         if resp.clicked() {
             if app.ui.project_sort == *key {
@@ -508,433 +625,222 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         column_menu(app, &resp);
     }
-    let hresp = ui.interact(Rect::from_min_max(pos2(x, hdr.min.y), hdr.max), egui::Id::new("proj-hdr-rest"), Sense::CLICK);
+    let hresp = ui.interact(Rect::from_min_max(pos2(end_x, hdr.min.y), hdr.max), egui::Id::unique("proj-hdr-rest"), Sense::CLICK);
     column_menu(app, &hresp);
+    // The Name column's right edge: drag to resize it, double-click to fit the names again.
+    let edge = Rect::from_center_size(pos2(hdr.min.x + cl.name_w + 5.0, hdr.center().y), vec2(8.0, hdr.height()));
+    let eresp = ui.interact(edge, egui::Id::unique("proj-name-edge"), Sense::click_and_drag());
+    app.auto.add("project.nameColumn.edge", edge, "Drag to resize the Name column; double-click to fit the names");
+    if eresp.hovered() || eresp.dragged() {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::ResizeColumn);
+        hp.line_segment([pos2(edge.center().x, hdr.min.y + 3.0), pos2(edge.center().x, hdr.max.y - 3.0)], Stroke::new(1.0, t.text_dim));
+    }
+    if eresp.double_clicked() {
+        app.ui.project_name_w = None;
+    } else if eresp.dragged() {
+        let max_w = name_max_w(app, hdr.width());
+        app.ui.project_name_w = Some((app.ui.project_name_w.unwrap_or(cl.name_w).min(max_w) + eresp.drag_delta().x).clamp(MIN_NAME_W, max_w));
+    }
+    eresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, crate::i18n::tr("Resize the Name column")));
     app.auto.add("project.columns", hdr, "Columns (right-click to show or hide)");
-    // Rows.
-    let footer_h = 28.0;
-    let list = Rect::from_min_max(pos2(rect.min.x, hdr.max.y), pos2(rect.max.x, rect.max.y - footer_h));
-    let lp = p.with_clip_rect(list);
-    // The list's empty area (under the rows and the scroll bar, which take their own clicks):
-    // a click deselects, a drag draws a selection box, a double-click imports, as in After
-    // Effects (File ▸ Import ▸ File...).
-    // Not a Tab stop: the keyboard reaches the rows, and nothing else here takes a key.
-    let empty = ui.interact(list, egui::Id::new("proj-empty"), Sense::CLICK | Sense::DRAG);
-    app.auto.add("project.empty", list, "Double-click to import files; drag to select items; right-click for project actions");
-    if overflow > 0.0 && ui.rect_contains_pointer(list) {
-        let (dx, dy, shift) = ui.input(|i| (i.smooth_scroll_delta.x, i.smooth_scroll_delta.y, i.modifiers.shift));
-        let d = if dx.abs() > 0.0 {
-            dx
-        } else if shift {
-            dy
-        } else {
-            0.0
-        };
-        app.ui.project_hscroll = (app.ui.project_hscroll - d).clamp(0.0, overflow);
+}
+
+/// An item row's context menu: Composition Settings, Delete, Rename, Duplicate, labels and the
+/// footage commands.
+fn item_menu(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    ctx: &egui::Context,
+    it: &effectcraft_engine::project::Item,
+    id: ItemId,
+    selected: bool,
+    actions: &mut Vec<(String, serde_json::Value)>,
+) {
+    let t = app.tokens;
+    let footage = matches!(it.kind, ItemKind::Footage(_));
+    // First on a comp, as in After Effects; for this comp, not the viewer's (#1058).
+    if matches!(it.kind, ItemKind::Comp(_)) && ui.button(crate::i18n::tr("Composition Settings…")).clicked() {
+        actions.push(("comp.settings".into(), json!({"comp": id.0})));
+        ui.close();
     }
-    let moved = keyboard_nav(app, &ctx);
-    let rows = visible_rows(app);
-    // Enter renames the selected item (Project panel focused, not typing).
-    if app.ui.focused == crate::dock::PanelKind::Project
-        && app.dialog.is_none()
-        && keys_reach_rows(app, &ctx)
-        && ctx.data(|d| d.get_temp::<Editing>(edit_id())).is_none()
-        && ctx.input(|i| i.key_pressed(egui::Key::Enter))
-    {
-        begin_rename(app, &ctx);
+    if ui.button(crate::i18n::tr("Delete")).clicked() {
+        actions.push(("project.delete".into(), json!({"items": targets(app, id, selected)})));
+        ui.close();
     }
-    let editing: Option<Editing> = ctx.data(|d| d.get_temp(edit_id()));
-    let dragging = egui::DragAndDrop::payload::<DragPayload>(&ctx).and_then(|p| match *p {
-        DragPayload::Item(i) => Some(i),
-        _ => None,
+    if matches!(it.kind, ItemKind::Comp(_)) && ui.button(crate::i18n::tr("Open Composition")).clicked() {
+        actions.push(("comp.open".into(), json!({"comp": id.0})));
+        ui.close();
+    }
+    if ui.button(crate::i18n::tr("Rename")).clicked() {
+        ctx.data_mut(|d| d.insert_temp::<Editing>(edit_id(), (id.0, "name".into(), it.name.clone())));
+        ui.close();
+    }
+    let duplicate_items = targets(app, id, selected);
+    // Like Edit > Duplicate: folders disable the whole operation, including mixed selections.
+    let can_duplicate = !duplicate_items.is_empty() && duplicate_items.iter().all(|id| app.session.project.item(ItemId(*id)).is_some_and(|i| !i.is_folder()));
+    let mut duplicate = egui::Button::new(crate::i18n::tr("Duplicate"));
+    if let Some(shortcut) = app.session.shortcuts().shortcut_of("edit.duplicate", &serde_json::Value::Null) {
+        duplicate = duplicate.shortcut_text(crate::menus::shortcut_text(shortcut));
+    }
+    let response = ui.add_enabled(can_duplicate, duplicate);
+    app.auto.add("project.context.duplicate", response.rect, "Duplicate");
+    if response.clicked() {
+        actions.push(("project.duplicate".into(), json!({"items": duplicate_items})));
+        ui.close();
+    }
+    if it.parent.is_some() && ui.button(crate::i18n::tr("Move to Project Root")).clicked() {
+        actions.push(("project.move".into(), json!({"items": targets(app, id, selected), "folder": null})));
+        ui.close();
+    }
+    // A composition cannot contain itself, so its own row offers nothing to add to (#2589).
+    if !it.is_folder() {
+        let add = ui.add_enabled(app.session.state.active_comp != Some(id), egui::Button::new(crate::i18n::tr("Add to Composition")));
+        app.auto.add("project.context.addToComposition", add.rect, "Add to Composition");
+        if add.clicked() {
+            actions.push(("layer.addItem".into(), json!({"item": id.0})));
+            ui.close();
+        }
+    }
+    // File ▸ New Comp from Selection on the selection (the right-clicked row joins it
+    // above): several items ask how in its dialog, as in After Effects (#360).
+    if ui.button(crate::i18n::tr("New Comp from Selection")).clicked() {
+        actions.push(("file.newCompFromSelection".into(), json!({})));
+        ui.close();
+    }
+    // File ▸ Replace Footage ▸ With Precomposition: every layer using the item uses a
+    // new composition holding it instead. The label says how many layers that changes.
+    let uses: usize = app.session.project.item_users(id).iter().map(|(_, n)| n).sum();
+    let label = match uses {
+        0 => crate::i18n::tr("Replace with Precomposition").to_owned(),
+        1 => format!("{} ({})", crate::i18n::tr("Replace with Precomposition"), crate::i18n::tr("used once")),
+        n => format!("{} ({})", crate::i18n::tr("Replace with Precomposition"), crate::i18n::tr_args("used {} times", &[&n])),
+    };
+    if (footage || matches!(it.kind, ItemKind::Solid(_))) && ui.button(label).clicked() {
+        actions.push(("file.replaceWithPrecomp".into(), json!({"item": id.0})));
+        ui.close();
+    }
+    ui.separator();
+    ui.menu_button(crate::i18n::tr("Label"), |ui| {
+        for l in Label::ALL {
+            if widgets::label_entry(ui, l, &app.session.prefs.label_name(l), l == it.label, &t).clicked() {
+                actions.push(("project.setLabel".into(), json!({"items": targets(app, id, selected), "label": label_index(l)})));
+                ui.close();
+            }
+        }
     });
-    let hover_y = ctx.pointer_hover_pos().filter(|p| list.contains(*p)).map(|p| p.y);
-    let mut drop_row: Option<ItemId> = None;
-    let mut actions: Vec<(String, serde_json::Value)> = vec![];
-    // Vertical scrolling: only the rows in view are drawn (and registered), so a project with
-    // thousands of items costs what one screenful does.
-    let content_h = rows.len() as f32 * ROW_H;
-    let max_scroll = (content_h - list.height() + ROW_H).max(0.0);
-    if ui.rect_contains_pointer(list) {
-        let (dy, shift) = ui.input(|i| (i.smooth_scroll_delta.y, i.modifiers.shift));
-        if !shift && dy != 0.0 {
-            app.ui.project_scroll -= dy;
-        }
+    // Footage: the File menu's footage commands (Interpret Footage, Replace Footage…).
+    if footage {
+        let mut chosen = None;
+        crate::menus::submenu_at(app, ui, &["File", "Interpret Footage"], &mut chosen);
+        crate::menus::submenu_at(app, ui, &["File", "Replace Footage"], &mut chosen);
+        crate::menus::entry_for(app, ui, "file.reloadFootage", &mut chosen);
+        crate::menus::entry_for(app, ui, "file.revealInFinder", &mut chosen);
+        actions.extend(chosen);
     }
-    // A selection made elsewhere (a command, an agent, the viewer) scrolls into view.
-    let sel_key = egui::Id::new("proj-sel-seen");
-    let sel_now = app.session.state.project_selection.last().map(|i| i.0);
-    if ctx.data(|d| d.get_temp::<Option<u64>>(sel_key)) != Some(sel_now) {
-        ctx.data_mut(|d| d.insert_temp(sel_key, sel_now));
-        if let Some(row) = sel_now.and_then(|s| rows.iter().position(|(id, _)| id.0 == s)) {
-            let top = row as f32 * ROW_H;
-            if top < app.ui.project_scroll {
-                app.ui.project_scroll = top;
-            } else if top + ROW_H > app.ui.project_scroll + list.height() {
-                app.ui.project_scroll = top + ROW_H - list.height();
-            }
-        }
+}
+
+/// The inline rename / comment field over `cell` when it is item `id`'s `field` being edited;
+/// returns whether it took the cell.
+fn cell_edit(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    actions: &mut Vec<(String, serde_json::Value)>,
+    editing: &Option<Editing>,
+    id: u64,
+    field: &str,
+    cell: Rect,
+) -> bool {
+    let ctx = ui.ctx().clone();
+    let Some((eid, ef, mut buf)) = editing.clone().filter(|(e, f, _)| *e == id && f == field) else { return false };
+    let mut child = ui.new_child(egui::UiBuilder::new().max_rect(cell));
+    // The field keeps Tab (egui would move the keyboard to the next widget, where Enter no
+    // longer renames, #881): Tab commits like Enter and gives the keyboard back to the panel.
+    let filter = egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, ..Default::default() };
+    let resp = child.add(egui::TextEdit::singleline(&mut buf).desired_width(cell.width()).font(Tokens::ui(12.0)).event_filter(filter));
+    app.auto.add(&format!("project.item.{}.{field}Edit", id), cell, field);
+    let tab = resp.has_focus() && ctx.input(|i| i.key_pressed(egui::Key::Tab));
+    if tab {
+        resp.surrender_focus();
     }
-    // The arrow keys' item scrolls into view (Shift+Up extends upward, past the selection's end).
-    if let Some(row) = moved.and_then(|m| rows.iter().position(|(id, _)| *id == m)) {
-        let top = row as f32 * ROW_H;
-        // Not `clamp`: a panel shorter than a row would make its bounds cross. The row's top wins.
-        app.ui.project_scroll = app.ui.project_scroll.max(top + ROW_H - list.height()).min(top);
-    }
-    app.ui.project_scroll = app.ui.project_scroll.clamp(0.0, max_scroll);
-    let scroll = app.ui.project_scroll;
-    let first = ((scroll / ROW_H).floor() as usize).min(rows.len());
-    let mut y = list.min.y - (scroll - first as f32 * ROW_H);
-    let project = app.session.project.clone();
-    for (i, (id, depth)) in rows.iter().enumerate().skip(first) {
-        let Some(it) = project.item(*id) else { continue };
-        let r = Rect::from_min_size(pos2(list.min.x, y), vec2(list.width(), ROW_H));
-        y += ROW_H;
-        if r.min.y > list.max.y {
-            break;
-        }
-        if hover_y.is_some_and(|hy| hy >= r.min.y && hy < r.max.y) {
-            drop_row = Some(*id);
-        }
-        let selected = app.session.state.project_selection.contains(id);
-        lp.rect_filled(
-            r,
-            0.0,
-            // Flat rows like After Effects' Project panel (no stripes).
-            if selected { t.row_selected } else { t.row },
-        );
-        // The row's click / drag area goes first, so the twirl, proxy, label and comment widgets
-        // on top of it take their own clicks.
-        let mut resp = ui.interact(r.intersect(list), row_id(*id), Sense::click_and_drag());
-        app.auto.add(&format!("project.item.{}", id.0), r, &it.name);
-        // For screen readers: a tree item named by the item and its type, with its selection,
-        // depth and (a folder) open state. One Tab stop per row; the panel's keys then apply.
-        let open = it.is_folder().then(|| app.ui.project_open_folders.contains(&id.0) || !app.ui.project_search.is_empty());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, true, format!("{}, {}", it.name, crate::i18n::tr(it.type_name()))));
-        ctx.accesskit_node_builder(resp.id, |n| {
-            n.set_role(egui::accesskit::Role::TreeItem);
-            n.set_selected(selected);
-            n.set_level(depth.saturating_add(1));
-            if let Some(open) = open {
-                n.set_expanded(open);
-            }
-        });
-        if resp.has_focus() {
-            ctx.data_mut(|d| d.insert_temp(focused_row_id(), *id));
-        }
-        if resp.gained_focus() {
-            app.ui.focused = crate::dock::PanelKind::Project;
-        }
-        let _ = i;
-        let x0 = r.min.x + 8.0 + 14.0 * *depth as f32;
-        if it.is_folder() {
-            let open = app.ui.project_open_folders.contains(&id.0);
-            let tw = Rect::from_center_size(pos2(x0 + 4.0, r.center().y), vec2(12.0, 12.0));
-            let tresp = widgets::twirl(ui, tw, open, egui::Id::new(("pf", id.0)), &t);
-            tresp.widget_info(|| {
-                let name = crate::i18n::tr_args(if open { "Close folder {}" } else { "Open folder {}" }, &[&it.name]);
-                egui::WidgetInfo::labeled(egui::WidgetType::Button, true, name)
-            });
-            if tresp.clicked() {
-                // Alt/Cmd-click twirls every folder inside it too.
-                let mut ids = vec![*id];
-                if ui.input(|i| i.modifiers.alt || i.modifiers.command) {
-                    let mut at = 0;
-                    while let Some(f) = ids.get(at).copied() {
-                        ids.extend(app.session.project.children(Some(f)).into_iter().filter(|c| c.is_folder()).map(|c| c.id));
-                        at += 1;
-                    }
-                }
-                for f in ids {
-                    if open {
-                        app.ui.project_open_folders.remove(&f.0);
-                    } else {
-                        app.ui.project_open_folders.insert(f.0);
-                    }
-                }
-            }
-            app.auto.add(&format!("project.item.{}.twirl", id.0), tw, &it.name);
-        }
-        icons::paint(&lp, Rect::from_center_size(pos2(x0 + 18.0, r.center().y), vec2(14.0, 14.0)), item_icon(it), t.text_dim);
-        // Proxy indicator: filled = the proxy is used, hollow = set but off. Click to switch.
-        if let Some(px) = it.proxy.as_ref() {
-            let pr = Rect::from_center_size(pos2(x0 + 4.0, r.center().y), vec2(9.0, 9.0));
-            if px.enabled {
-                lp.rect_filled(pr, 1.0, t.text);
+    if resp.lost_focus() || tab {
+        ctx.data_mut(|d| d.remove::<Editing>(edit_id()));
+        if !ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+            let (cmd, params) = if ef == "name" {
+                ("project.rename", json!({"item": eid, "name": buf}))
             } else {
-                lp.rect_stroke(pr, 1.0, Stroke::new(1.0, t.text), egui::StrokeKind::Inside);
-            }
-            let presp = ui.interact(pr.expand(2.0).intersect(list), egui::Id::new(("pproxy", id.0)), Sense::click()).on_hover_text(format!(
-                "Proxy: {} ({})",
-                px.footage.path,
-                if px.enabled { "in use" } else { "off" }
-            ));
-            app.auto.add(&format!("project.item.{}.proxy", id.0), pr, if px.enabled { "Proxy in use" } else { "Proxy off" });
-            presp.widget_info(|| {
-                let name = crate::i18n::tr_args(if px.enabled { "Proxy of {}: in use" } else { "Proxy of {}: off" }, &[&it.name]);
-                egui::WidgetInfo::labeled(egui::WidgetType::Button, true, name)
-            });
-            if presp.clicked() {
-                actions.push(("file.useProxy".into(), json!({"item": id.0})));
-            }
-        }
-        // Footage that can't be decoded (no decoder for its codec / profile): a warning marker
-        // at the end of the name cell, the reason on hover.
-        let problem = match &it.kind {
-            ItemKind::Footage(f) => app.session.footage.problem(f),
-            _ => None,
-        };
-        let name_clip =
-            Rect::from_min_max(pos2(x0 + 30.0, r.min.y), pos2(r.min.x + name_w + 4.0 - if problem.is_some() { 16.0 } else { 0.0 }, r.max.y)).intersect(list);
-        if let Some(why) = &problem {
-            let m = Rect::from_center_size(pos2(r.min.x + name_w - 8.0, r.center().y), vec2(13.0, 12.0));
-            lp.add(egui::Shape::convex_polygon(vec![m.center_top(), m.right_bottom(), m.left_bottom()], t.warning, Stroke::NONE));
-            lp.text(m.center() + vec2(0.0, 1.5), Align2::CENTER_CENTER, "!", Tokens::semibold(9.0), Color32::BLACK);
-            ui.interact(m.expand(2.0).intersect(list), egui::Id::new(("pproblem", id.0)), Sense::hover()).on_hover_text(why.as_str());
-            app.auto.add(&format!("project.item.{}.problem", id.0), m, why);
-        }
-        let name_rect = Rect::from_min_max(pos2(x0 + 28.0, r.min.y + 2.0), pos2(r.min.x + name_w + 2.0, r.max.y - 2.0));
-        // Inline edits (rename / comment).
-        let cell_edit = |app: &mut EffectcraftApp, ui: &mut egui::Ui, actions: &mut Vec<(String, serde_json::Value)>, field: &str, cell: Rect| -> bool {
-            let Some((eid, ef, mut buf)) = editing.clone().filter(|(e, f, _)| *e == id.0 && f == field) else { return false };
-            let mut child = ui.new_child(egui::UiBuilder::new().max_rect(cell));
-            // The field keeps Tab (egui would move the keyboard to the next widget, where Enter no
-            // longer renames, #881): Tab commits like Enter and gives the keyboard back to the panel.
-            let filter = egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, ..Default::default() };
-            let resp = child.add(egui::TextEdit::singleline(&mut buf).desired_width(cell.width()).font(Tokens::ui(12.0)).event_filter(filter));
-            app.auto.add(&format!("project.item.{}.{field}Edit", id.0), cell, field);
-            let tab = resp.has_focus() && ctx.input(|i| i.key_pressed(egui::Key::Tab));
-            if tab {
-                resp.surrender_focus();
-            }
-            if resp.lost_focus() || tab {
-                ctx.data_mut(|d| d.remove::<Editing>(edit_id()));
-                if !ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
-                    let (cmd, params) = if ef == "name" {
-                        ("project.rename", json!({"item": eid, "name": buf}))
-                    } else {
-                        ("project.setComment", json!({"items": [eid], "comment": buf}))
-                    };
-                    actions.push((cmd.into(), params));
-                }
-            } else {
-                widgets::keep_focus(&ctx, &resp, &buf);
-                ctx.data_mut(|d| d.insert_temp::<Editing>(edit_id(), (eid, ef, buf)));
-            }
-            true
-        };
-        if !cell_edit(app, ui, &mut actions, "name", name_rect) {
-            // The selected item's name sits in a light cell with dark text.
-            if selected {
-                let g = lp.layout_no_wrap(it.name.clone(), Tokens::ui(12.0), Color32::BLACK);
-                let cell = Rect::from_min_max(pos2(x0 + 27.0, r.min.y + 1.0), pos2((x0 + 33.0 + g.size().x).min(name_clip.max.x), r.max.y - 1.0));
-                lp.with_clip_rect(name_clip.expand2(vec2(3.0, 0.0))).rect_filled(cell, 0.0, Color32::from_rgb(0xa6, 0xa6, 0xa6));
-            }
-            // Long names end in "…" before the label column instead of being cut mid-glyph.
-            widgets::text_fit(
-                &lp.with_clip_rect(name_clip),
-                pos2(x0 + 30.0, r.center().y),
-                Align2::LEFT_CENTER,
-                &it.name,
-                Tokens::ui(12.0),
-                name_clip.max.x - (x0 + 30.0) - 2.0,
-                if selected { Color32::from_gray(0x16) } else { t.text },
-            );
-        }
-        // Label swatch: click for the label colour menu.
-        let sw = Rect::from_center_size(pos2(label_x, r.center().y), vec2(10.0, 10.0));
-        lp.rect_filled(sw, 2.0, t.label(it.label));
-        let sresp = ui.interact(sw.expand(3.0).intersect(list), egui::Id::new(("plabel", id.0)), Sense::click());
-        app.auto.add(&format!("project.item.{}.label", id.0), sw, it.label.name());
-        sresp.widget_info(|| {
-            let name = crate::i18n::tr_args("Label of {}: {}", &[&it.name, &app.session.prefs.label_name(it.label)]);
-            egui::WidgetInfo::labeled(egui::WidgetType::Button, true, name)
-        });
-        let pop = egui::Id::new(("plabel-pop", id.0));
-        if sresp.clicked() || sresp.secondary_clicked() {
-            widgets::open_popup(ui, pop);
-        }
-        if let Some(l) = widgets::label_popup(ui, pop, sw.left_bottom(), it.label, |l| app.session.prefs.label_name(l), &t) {
-            actions.push(("project.setLabel".into(), json!({"items": targets(app, *id, selected), "label": label_index(l)})));
-        }
-        // Optional columns.
-        for (key, _, cx, w) in cols.iter().skip(2) {
-            let cell = opt_clip(Rect::from_min_size(pos2(*cx, r.min.y), vec2(*w, r.height())).intersect(list));
-            if cell.width() <= 0.0 {
-                continue;
-            }
-            let cp = lp.with_clip_rect(cell);
-            let txt = match *key {
-                "type" => it.type_name().to_string(),
-                "size" => file_size(it).map(fmt_size).unwrap_or_default(),
-                "duration" => it.duration().map(|d| fmt_dur(d.seconds(), it.frame_rate().map(|r| r.as_f64()).unwrap_or(30.0))).unwrap_or_default(),
-                "fps" => it.frame_rate().map(|f| format!("{:.2}", f.as_f64())).unwrap_or_default(),
-                "path" => file_path(it).to_string(),
-                "comment" => {
-                    let cr = Rect::from_min_size(pos2(*cx - 2.0, r.min.y + 2.0), vec2(*w, r.height() - 4.0));
-                    if cell_edit(app, ui, &mut actions, "comment", cr) {
-                        continue;
-                    }
-                    let cresp = ui.interact(cell, egui::Id::new(("pcomment", id.0)), Sense::CLICK);
-                    app.auto.add(&format!("project.item.{}.comment", id.0), cell, &it.comment);
-                    cresp.widget_info(|| {
-                        egui::WidgetInfo::labeled(egui::WidgetType::Other, true, crate::i18n::tr_args("Comment of {}: {}", &[&it.name, &it.comment]))
-                    });
-                    if cresp.double_clicked() {
-                        ctx.data_mut(|d| d.insert_temp::<Editing>(edit_id(), (id.0, "comment".into(), it.comment.clone())));
-                    } else {
-                        // Other clicks select the row and open its context menu.
-                        resp = resp.union(cresp);
-                    }
-                    it.comment.clone()
-                }
-                _ => String::new(),
+                ("project.setComment", json!({"items": [eid], "comment": buf}))
             };
-            let align = if *key == "fps" { Align2::RIGHT_CENTER } else { Align2::LEFT_CENTER };
-            let tx = if *key == "fps" { cx + w - 6.0 } else { *cx };
-            cp.text(pos2(tx, r.center().y), align, txt, Tokens::ui(11.5), t.text_dim);
+            actions.push((cmd.into(), params));
         }
-        if dragging.is_some_and(|d| d != id.0) && drop_row == Some(*id) && it.is_folder() {
-            lp.rect_stroke(r.shrink(1.0), 2.0, Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
-        }
-        // The row with keyboard focus (Tab, or the arrow keys after it) shows a focus ring.
-        if ctx.memory(|m| m.has_focus(row_id(*id))) {
-            lp.rect_stroke(r.shrink(0.5), 0.0, Stroke::new(1.0, t.accent), egui::StrokeKind::Inside);
-        }
-        // Part of the row: not a second Tab stop.
-        let nresp = ui.interact(name_clip, egui::Id::new(("pname", id.0)), Sense::CLICK | Sense::DRAG);
-        app.auto.add(&format!("project.item.{}.name", id.0), name_clip, &it.name);
-        let resp = resp.union(nresp);
-        if resp.clicked() {
-            let m = ui.input(|i| i.modifiers);
-            let anchor_key = anchor_id();
-            ctx.data_mut(|d| d.insert_temp(cursor_id(), *id));
-            let anchor = ctx.data(|d| d.get_temp::<ItemId>(anchor_key)).or_else(|| app.session.state.project_selection.first().copied());
-            if m.shift
-                && let Some(a) = anchor.and_then(|a| rows.iter().position(|(i, _)| *i == a))
-            {
-                let b = rows.iter().position(|(i, _)| i == id).unwrap_or(a);
-                app.session.state.project_selection = rows.get(a.min(b)..=a.max(b)).unwrap_or_default().iter().map(|(i, _)| *i).collect();
-            } else if m.command {
-                if app.session.state.project_selection.contains(id) {
-                    app.session.state.project_selection.retain(|i| i != id);
-                } else {
-                    app.session.state.project_selection.push(*id);
-                }
-                ctx.data_mut(|d| d.insert_temp(anchor_key, *id));
-            } else {
-                app.session.state.project_selection = vec![*id];
-                ctx.data_mut(|d| d.insert_temp(anchor_key, *id));
-            }
-        }
-        // Double-click opens the item, as in After Effects (a comp gets its own Timeline tab and
-        // the viewer); Enter or the context menu renames.
-        if resp.double_clicked() {
-            match &it.kind {
-                ItemKind::Comp(_) => actions.push(("comp.open".into(), json!({"comp": id.0}))),
-                ItemKind::Folder if !app.ui.project_open_folders.remove(&id.0) => {
-                    app.ui.project_open_folders.insert(id.0);
-                }
-                // Footage (not data) and solids open in the Footage panel.
-                ItemKind::Footage(f) if f.kind != effectcraft_engine::project::FootageKind::Data => {
-                    actions.push(("footage.open".into(), json!({"item": id.0})))
-                }
-                ItemKind::Solid(_) => actions.push(("footage.open".into(), json!({"item": id.0}))),
-                _ => {}
-            }
-        }
-        if resp.drag_started() {
-            egui::DragAndDrop::set_payload(&ctx, DragPayload::Item(id.0));
-        }
-        // Right-clicking an item selects it (After Effects): the menu's File commands act on the
-        // selection.
-        if resp.secondary_clicked() && !selected {
-            app.session.state.project_selection = vec![*id];
-        }
-        let footage = matches!(it.kind, ItemKind::Footage(_));
-        crate::widgets::context_menu(&resp, |ui| {
-            // First on a comp, as in After Effects; for this comp, not the viewer's (#1058).
-            if matches!(it.kind, ItemKind::Comp(_)) && ui.button(crate::i18n::tr("Composition Settings…")).clicked() {
-                actions.push(("comp.settings".into(), json!({"comp": id.0})));
-                ui.close();
-            }
-            if ui.button(crate::i18n::tr("Delete")).clicked() {
-                actions.push(("project.delete".into(), json!({"items": targets(app, *id, selected)})));
-                ui.close();
-            }
-            if matches!(it.kind, ItemKind::Comp(_)) && ui.button(crate::i18n::tr("Open Composition")).clicked() {
-                actions.push(("comp.open".into(), json!({"comp": id.0})));
-                ui.close();
-            }
-            if ui.button(crate::i18n::tr("Rename")).clicked() {
-                ctx.data_mut(|d| d.insert_temp::<Editing>(edit_id(), (id.0, "name".into(), it.name.clone())));
-                ui.close();
-            }
-            if it.parent.is_some() && ui.button(crate::i18n::tr("Move to Project Root")).clicked() {
-                actions.push(("project.move".into(), json!({"items": targets(app, *id, selected), "folder": null})));
-                ui.close();
-            }
-            if !it.is_folder() && ui.button(crate::i18n::tr("Add to Composition")).clicked() {
-                actions.push(("layer.addItem".into(), json!({"item": id.0})));
-                ui.close();
-            }
-            // File ▸ New Comp from Selection on the selection (the right-clicked row joins it
-            // above): several items ask how in its dialog, as in After Effects (#360).
-            if ui.button(crate::i18n::tr("New Comp from Selection")).clicked() {
-                actions.push(("file.newCompFromSelection".into(), json!({})));
-                ui.close();
-            }
-            // File ▸ Replace Footage ▸ With Precomposition: every layer using the item uses a
-            // new composition holding it instead. The label says how many layers that changes.
-            let uses: usize = app.session.project.item_users(*id).iter().map(|(_, n)| n).sum();
-            let label = match uses {
-                0 => crate::i18n::tr("Replace with Precomposition").to_owned(),
-                1 => format!("{} ({})", crate::i18n::tr("Replace with Precomposition"), crate::i18n::tr("used once")),
-                n => format!("{} ({})", crate::i18n::tr("Replace with Precomposition"), crate::i18n::tr_args("used {} times", &[&n])),
-            };
-            if (footage || matches!(it.kind, ItemKind::Solid(_))) && ui.button(label).clicked() {
-                actions.push(("file.replaceWithPrecomp".into(), json!({"item": id.0})));
-                ui.close();
-            }
-            ui.separator();
-            ui.menu_button(crate::i18n::tr("Label"), |ui| {
-                for l in Label::ALL {
-                    if widgets::label_entry(ui, l, &app.session.prefs.label_name(l), l == it.label, &t).clicked() {
-                        actions.push(("project.setLabel".into(), json!({"items": targets(app, *id, selected), "label": label_index(l)})));
-                        ui.close();
-                    }
-                }
-            });
-            // Footage: the File menu's footage commands (Interpret Footage, Replace Footage…).
-            if footage {
-                let mut chosen = None;
-                crate::menus::submenu_at(app, ui, &["File", "Interpret Footage"], &mut chosen);
-                crate::menus::submenu_at(app, ui, &["File", "Replace Footage"], &mut chosen);
-                crate::menus::entry_for(app, ui, "file.reloadFootage", &mut chosen);
-                crate::menus::entry_for(app, ui, "file.revealInFinder", &mut chosen);
-                actions.extend(chosen);
-            }
-        });
+    } else {
+        widgets::keep_focus(&ctx, &resp, &buf);
+        ctx.data_mut(|d| d.insert_temp::<Editing>(edit_id(), (eid, ef, buf)));
     }
-    // The scroll bars, over the rows (which would take their presses otherwise).
-    if overflow > 0.0 {
-        let track = Rect::from_min_max(pos2(opt_x0, list.max.y - 5.0), pos2(rect.max.x - 4.0, list.max.y - 1.0));
-        app.ui.project_hscroll = widgets::scroll_bar(ui, &mut app.auto, "project.hscroll", track, hscroll, overflow, &t);
+    true
+}
+
+/// A click on item `id`'s row: plain selects it, Shift extends from the anchor and Cmd toggles.
+fn select_click(app: &mut EffectcraftApp, ui: &egui::Ui, ctx: &egui::Context, id: ItemId, rows: &[(ItemId, usize)]) {
+    let m = ui.input(|i| i.modifiers);
+    let anchor_key = anchor_id();
+    ctx.data_mut(|d| d.insert_temp(cursor_id(), id));
+    let anchor = ctx.data(|d| d.get_temp::<ItemId>(anchor_key)).or_else(|| app.session.state.project_selection.first().copied());
+    if m.shift
+        && let Some(a) = anchor.and_then(|a| rows.iter().position(|(i, _)| *i == a))
+    {
+        let b = rows.iter().position(|(i, _)| *i == id).unwrap_or(a);
+        app.session.state.project_selection = rows.get(a.min(b)..=a.max(b)).unwrap_or_default().iter().map(|(i, _)| *i).collect();
+    } else if m.command {
+        if app.session.state.project_selection.contains(&id) {
+            app.session.state.project_selection.retain(|i| *i != id);
+        } else {
+            app.session.state.project_selection.push(id);
+        }
+        ctx.data_mut(|d| d.insert_temp(anchor_key, id));
+    } else {
+        app.session.state.project_selection = vec![id];
+        ctx.data_mut(|d| d.insert_temp(anchor_key, id));
     }
-    if max_scroll > 0.0 {
-        let track = Rect::from_min_max(pos2(rect.max.x - 6.0, list.min.y + 1.0), pos2(rect.max.x - 2.0, list.max.y - 7.0));
-        app.ui.project_scroll = widgets::scroll_bar(ui, &mut app.auto, "project.vscroll", track, scroll, max_scroll, &t);
+}
+
+/// Double-click opens the item, as in After Effects: a comp in its Timeline and the viewer, a
+/// folder toggles, footage (not data) and solids open in the Footage panel.
+fn open_item(app: &mut EffectcraftApp, it: &effectcraft_engine::project::Item, id: ItemId, actions: &mut Vec<(String, serde_json::Value)>) {
+    match &it.kind {
+        ItemKind::Comp(_) => actions.push(("comp.open".into(), json!({"comp": id.0}))),
+        ItemKind::Folder if !app.ui.project_open_folders.remove(&id.0) => {
+            app.ui.project_open_folders.insert(id.0);
+        }
+        // Footage (not data) and solids open in the Footage panel.
+        ItemKind::Footage(f) if f.kind != effectcraft_engine::project::FootageKind::Data => actions.push(("footage.open".into(), json!({"item": id.0}))),
+        ItemKind::Solid(_) => actions.push(("footage.open".into(), json!({"item": id.0}))),
+        _ => {}
     }
+}
+
+/// What the pointer is doing over the list: the item being dragged, the row under it, whether it
+/// is over the list at all.
+struct DropState {
+    dragging: Option<u64>,
+    row: Option<ItemId>,
+    hovering: bool,
+}
+
+/// Dragging an item or files over the list: drop outlines, moving items into folders, importing
+/// files and the drag ghost.
+fn drop_targets(app: &mut EffectcraftApp, ctx: &egui::Context, lp: &egui::Painter, list: Rect, ds: DropState, actions: &mut Vec<(String, serde_json::Value)>) {
+    let t = app.tokens;
+    let DropState { dragging, row, hovering } = ds;
     // Dropping a dragged item on the list: into the folder under the pointer (or the folder of
     // the item under it), or the project root below the rows.
     if let Some(iid) = dragging
-        && hover_y.is_some()
+        && hovering
     {
-        if drop_row.is_none() {
+        if row.is_none() {
             lp.rect_stroke(list.shrink(1.0), 0.0, Stroke::new(1.0, t.accent.gamma_multiply(0.6)), egui::StrokeKind::Inside);
         }
-        if ctx.input(|i| i.pointer.any_released()) && drop_row != Some(ItemId(iid)) {
-            let folder = drop_folder(&app.session.project, drop_row);
+        if ctx.input(|i| i.pointer.any_released()) && row != Some(ItemId(iid)) {
+            let folder = drop_folder(&app.session.project, row);
             let cur = app.session.project.item(ItemId(iid)).and_then(|i| i.parent);
             if folder != cur {
                 let moving: Vec<u64> = if app.session.state.project_selection.contains(&ItemId(iid)) {
@@ -947,32 +853,36 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     app.ui.project_open_folders.insert(f.0);
                 }
             }
-            egui::DragAndDrop::clear_payload(&ctx);
+            egui::DragAndDrop::clear_payload(ctx);
         }
     }
     // Files dragged from the Media Browser: import.
-    if let Some(DragPayload::Files(paths)) = egui::DragAndDrop::payload::<DragPayload>(&ctx).as_deref()
-        && hover_y.is_some()
+    if let Some(DragPayload::Files(paths)) = egui::DragAndDrop::payload::<DragPayload>(ctx).as_deref()
+        && hovering
     {
         lp.rect_stroke(list.shrink(1.0), 0.0, Stroke::new(1.0, t.accent.gamma_multiply(0.6)), egui::StrokeKind::Inside);
         if ctx.input(|i| i.pointer.any_released()) {
             actions.push(("mediaBrowser.import".into(), json!({"paths": paths})));
-            egui::DragAndDrop::clear_payload(&ctx);
+            egui::DragAndDrop::clear_payload(ctx);
         }
     }
     // Drag ghost.
-    if let Some(DragPayload::Item(iid)) = egui::DragAndDrop::payload::<DragPayload>(&ctx).as_deref()
+    if let Some(DragPayload::Item(iid)) = egui::DragAndDrop::payload::<DragPayload>(ctx).as_deref()
         && let Some(pos) = ctx.pointer_hover_pos()
         && let Some(it) = app.session.project.item(ItemId(*iid))
     {
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("dnd-ghost")));
+        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("dnd-ghost")));
         let g = painter.layout_no_wrap(it.name.clone(), Tokens::ui(12.0), t.text);
         let r = Rect::from_min_size(pos + vec2(12.0, 8.0), g.size() + vec2(16.0, 8.0));
         painter.rect_filled(r, 4.0, Color32::from_rgba_premultiplied(40, 40, 40, 230));
         painter.galley(r.min + vec2(8.0, 4.0), g, t.text);
     }
-    // Footer.
-    let foot = Rect::from_min_max(pos2(rect.min.x, rect.max.y - footer_h), rect.max);
+}
+
+/// The footer: Interpret Footage, New Folder, New Composition, the colour depth and the trash.
+fn footer(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, foot: Rect, actions: &mut Vec<(String, serde_json::Value)>) {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
     p.line_segment([foot.left_top(), foot.right_top()], Stroke::new(1.0, t.separator));
     let mut x = foot.min.x + 8.0;
     for (icon, id, tip) in [
@@ -981,9 +891,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         (Icon::NewComp, "newComp", "Create a new Composition"),
     ] {
         let r = Rect::from_min_size(pos2(x, foot.min.y + 3.0), vec2(22.0, 22.0));
-        let resp = widgets::icon_button(ui, r, icon, false, &t, egui::Id::new(("pfoot", id))).on_hover_text(tip);
+        let resp = widgets::icon_button(ui, r, icon, false, &t, egui::Id::unique(("pfoot", id))).on_hover_text(crate::i18n::tr(tip));
         app.auto.add(&format!("project.{id}"), r, tip);
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, crate::i18n::tr(tip)));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, crate::i18n::tr(tip)));
         if resp.clicked() {
             let footage =
                 app.session.state.project_selection.first().and_then(|i| app.session.project.item(*i)).is_some_and(|i| matches!(i.kind, ItemKind::Footage(_)));
@@ -1013,10 +923,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     let depth = app.session.project.settings.bit_depth.label();
     let dr = Rect::from_min_size(pos2(x + 4.0, foot.min.y + 5.0), vec2(48.0, 18.0));
-    let dresp = ui.interact(dr, egui::Id::new("bpc"), Sense::click());
+    let dresp = ui.interact(dr, egui::Id::unique("bpc"), Sense::click());
     p.text(dr.center(), Align2::CENTER_CENTER, depth, Tokens::ui(11.5), if dresp.hovered() { t.text } else { t.text_dim });
     app.auto.add("project.bitDepth", dr, depth);
-    dresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, crate::i18n::tr_args("Project color depth: {}", &[&depth])));
+    dresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, crate::i18n::tr_args("Project color depth: {}", &[&depth])));
     // Click cycles 8/16/32 bpc; Alt-click opens Project Settings (as in After Effects).
     if dresp.clicked() {
         if ui.input(|i| i.modifiers.alt) {
@@ -1027,33 +937,113 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     dresp.on_hover_text(crate::i18n::tr("Project color depth: click to cycle 8/16/32 bpc, Alt-click for Project Settings"));
     let tr = Rect::from_min_size(pos2(foot.max.x - 30.0, foot.min.y + 3.0), vec2(22.0, 22.0));
-    let trash = widgets::icon_button(ui, tr, Icon::Trash, false, &t, egui::Id::new("ptrash")).on_hover_text(crate::i18n::tr("Delete selected project items"));
-    trash.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, crate::i18n::tr("Delete selected project items")));
+    let trash =
+        widgets::icon_button(ui, tr, Icon::Trash, false, &t, egui::Id::unique("ptrash")).on_hover_text(crate::i18n::tr("Delete selected project items"));
+    trash.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, crate::i18n::tr("Delete selected project items")));
     if trash.clicked() && !app.session.state.project_selection.is_empty() {
         actions.push(("project.delete".into(), json!({})));
     }
     app.auto.add("project.delete", tr, "Delete");
-    if empty.double_clicked() {
-        actions.push(("file.import".into(), json!({})));
-    }
-    crate::widgets::context_menu(&empty, |ui| {
-        for (key, label, command) in
-            [("newComp", "New Composition…", "comp.new"), ("newFolder", "New Folder", "project.newFolder"), ("import", "Import File…", "file.import")]
-        {
-            let response = ui.button(label);
-            app.auto.add(&format!("project.context.{key}"), response.rect, label);
-            if response.clicked() {
-                actions.push((command.into(), json!({})));
-                ui.close();
-            }
+}
+
+/// The optional columns of a row (type, size, duration, fps, path, comment). Returns the comment
+/// cell's response so its clicks select the row and open its context menu.
+fn optional_cells(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    g: &RowGeom,
+    it: &effectcraft_engine::project::Item,
+    cl: &Columns,
+    editing: &Option<Editing>,
+    actions: &mut Vec<(String, serde_json::Value)>,
+) -> Option<egui::Response> {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    let RowGeom { lp, list, r, .. } = *g;
+    let mut extra = None;
+    for (key, _, cx, w) in cl.cols.iter().skip(2) {
+        let cell = cl.opt_clip(Rect::from_min_size(pos2(*cx, r.min.y), vec2(*w, r.height())).intersect(list));
+        if cell.width() <= 0.0 {
+            continue;
         }
-    });
-    // Selection box over the rows it touches (#203); Shift or Cmd/Ctrl adds to the selection.
-    let adding = ui.input(|i| i.modifiers.shift || i.modifiers.command);
+        let cp = lp.with_clip_rect(cell);
+        let txt = match *key {
+            "type" => it.type_name().to_string(),
+            "size" => file_size(it).map(fmt_size).unwrap_or_default(),
+            "duration" => it.duration().map(|d| fmt_dur(d.seconds(), it.frame_rate().map(|r| r.as_f64()).unwrap_or(30.0))).unwrap_or_default(),
+            "fps" => it.frame_rate().map(|f| format!("{:.2}", f.as_f64())).unwrap_or_default(),
+            "path" => file_path(it).to_string(),
+            "comment" => {
+                let cr = Rect::from_min_size(pos2(*cx - 2.0, r.min.y + 2.0), vec2(*w, r.height() - 4.0));
+                if cell_edit(app, ui, actions, editing, it.id.0, "comment", cr) {
+                    continue;
+                }
+                let cresp = ui.interact(cell, egui::Id::unique(("pcomment", it.id.0)), Sense::CLICK);
+                app.auto.add(&format!("project.item.{}.comment", it.id.0), cell, &it.comment);
+                cresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Unknown, true, crate::i18n::tr_args("Comment of {}: {}", &[&it.name, &it.comment])));
+                if cresp.double_clicked() {
+                    ctx.data_mut(|d| d.insert_temp::<Editing>(edit_id(), (it.id.0, "comment".into(), it.comment.clone())));
+                } else {
+                    // Other clicks select the row and open its context menu.
+                    extra = Some(cresp);
+                }
+                it.comment.clone()
+            }
+            _ => String::new(),
+        };
+        let align = if *key == "fps" { Align2::RIGHT_CENTER } else { Align2::LEFT_CENTER };
+        let tx = if *key == "fps" { cx + w - 6.0 } else { *cx };
+        cp.text(pos2(tx, r.center().y), align, txt, Tokens::ui(11.5), t.text_dim);
+    }
+    extra
+}
+
+/// Shift+wheel / trackpad over the list scrolls the optional columns sideways.
+fn hscroll_wheel(app: &mut EffectcraftApp, ui: &egui::Ui, list: Rect, overflow: f32) {
+    if overflow > 0.0 && ui.rect_contains_pointer(list) {
+        let (dx, dy, shift) = ui.input(|i| (i.smooth_scroll_delta.x, i.smooth_scroll_delta.y, i.modifiers.shift));
+        let d = if dx.abs() > 0.0 {
+            dx
+        } else if shift {
+            dy
+        } else {
+            0.0
+        };
+        app.ui.project_hscroll = (app.ui.project_hscroll - d).clamp(0.0, overflow);
+    }
+}
+
+/// Enter renames the selected item (Project panel focused, not typing).
+fn enter_renames(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    if app.ui.focused == crate::dock::PanelKind::Project
+        && app.dialog.is_none()
+        && keys_reach_rows(app, ctx)
+        && ctx.data(|d| d.get_temp::<Editing>(edit_id())).is_none()
+        && ctx.input(|i| i.key_pressed(egui::Key::Enter))
+    {
+        begin_rename(app, ctx);
+    }
+}
+
+/// The warning marker at the end of the name cell for footage that can't be decoded.
+fn problem_marker(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &RowGeom, name_w: f32, id: ItemId, why: &str) {
+    let t = app.tokens;
+    let RowGeom { lp, list, r, .. } = *g;
+    let m = Rect::from_center_size(pos2(r.min.x + name_w - 8.0, r.center().y), vec2(13.0, 12.0));
+    lp.add(egui::Shape::convex_polygon(vec![m.center_top(), m.right_bottom(), m.left_bottom()], t.warning, Stroke::NONE));
+    lp.text(m.center() + vec2(0.0, 1.5), Align2::CENTER_CENTER, "!", Tokens::semibold(9.0), Color32::BLACK);
+    ui.interact(m.expand(2.0).intersect(list), egui::Id::unique(("pproblem", id.0)), Sense::hover()).on_hover_text(why);
+    app.auto.add(&format!("project.item.{}.problem", id.0), m, why);
+}
+
+/// Selection box over the rows it touches (#203); Shift or Cmd/Ctrl adds to the selection.
+fn marquee_select(app: &mut EffectcraftApp, ctx: &egui::Context, lp: &egui::Painter, list: Rect, empty: &egui::Response, rows: &[(ItemId, usize)]) {
+    let t = app.tokens;
+    let adding = ctx.input(|i| i.modifiers.shift || i.modifiers.command);
     if empty.clicked() && !adding {
         app.session.state.project_selection.clear();
     }
-    let box_id = egui::Id::new("proj-marquee");
+    let box_id = egui::Id::unique("proj-marquee");
     if let (Some(start), Some(end)) = (ctx.input(|i| i.pointer.press_origin()), empty.interact_pointer_pos())
         && empty.dragged()
     {
@@ -1083,6 +1073,367 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
+}
+
+/// Where a row is drawn: its clipped painter, the list, the row rectangle and the indented x.
+#[derive(Clone, Copy)]
+struct RowGeom<'a> {
+    lp: &'a egui::Painter,
+    list: Rect,
+    r: Rect,
+    x0: f32,
+}
+
+/// Vertical scrolling: only the rows in view are drawn (and registered), so a project with
+/// thousands of items costs what one screenful does. Returns the scroll offset and its maximum.
+fn update_scroll(app: &mut EffectcraftApp, ui: &egui::Ui, ctx: &egui::Context, list: Rect, rows: &[(ItemId, usize)], moved: Option<ItemId>) -> (f32, f32) {
+    let content_h = rows.len() as f32 * ROW_H;
+    let max_scroll = (content_h - list.height() + ROW_H).max(0.0);
+    if ui.rect_contains_pointer(list) {
+        let (dy, shift) = ui.input(|i| (i.smooth_scroll_delta.y, i.modifiers.shift));
+        if !shift && dy != 0.0 {
+            app.ui.project_scroll -= dy;
+        }
+    }
+    // A selection made elsewhere (a command, an agent, the viewer) scrolls into view.
+    let sel_key = selection_seen_id();
+    let sel_now = app.session.state.project_selection.last().map(|i| i.0);
+    if ctx.data(|d| d.get_temp::<Option<u64>>(sel_key)) != Some(sel_now) {
+        ctx.data_mut(|d| d.insert_temp(sel_key, sel_now));
+        if let Some(row) = sel_now.and_then(|s| rows.iter().position(|(id, _)| id.0 == s)) {
+            let top = row as f32 * ROW_H;
+            if top < app.ui.project_scroll {
+                app.ui.project_scroll = top;
+            } else if top + ROW_H > app.ui.project_scroll + list.height() {
+                app.ui.project_scroll = top + ROW_H - list.height();
+            }
+        }
+    }
+    // The arrow keys' item scrolls into view (Shift+Up extends upward, past the selection's end).
+    if let Some(row) = moved.and_then(|m| rows.iter().position(|(id, _)| *id == m)) {
+        let top = row as f32 * ROW_H;
+        // Not `clamp`: a panel shorter than a row would make its bounds cross. The row's top wins.
+        app.ui.project_scroll = app.ui.project_scroll.max(top + ROW_H - list.height()).min(top);
+    }
+    app.ui.project_scroll = app.ui.project_scroll.clamp(0.0, max_scroll);
+    (app.ui.project_scroll, max_scroll)
+}
+
+/// The folder's open / close twirl (Alt / Cmd-click twirls every folder inside it too).
+fn folder_twirl(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &RowGeom, it: &effectcraft_engine::project::Item) {
+    let t = app.tokens;
+    let RowGeom { r, x0, .. } = *g;
+    let open = app.ui.project_open_folders.contains(&it.id.0);
+    let tw = Rect::from_center_size(pos2(x0 + 4.0, r.center().y), vec2(12.0, 12.0));
+    let tresp = widgets::twirl(ui, tw, open, egui::Id::unique(("pf", it.id.0)), &t);
+    tresp.widget_info(|| {
+        let name = crate::i18n::tr_args(if open { "Close folder {}" } else { "Open folder {}" }, &[&it.name]);
+        egui::WidgetInfo::labeled(egui::Role::Button, true, name)
+    });
+    if tresp.clicked() {
+        // Alt/Cmd-click twirls every folder inside it too.
+        let mut ids = vec![it.id];
+        if ui.input(|i| i.modifiers.alt || i.modifiers.command) {
+            let mut at = 0;
+            while let Some(f) = ids.get(at).copied() {
+                ids.extend(app.session.project.children(Some(f)).into_iter().filter(|c| c.is_folder()).map(|c| c.id));
+                at += 1;
+            }
+        }
+        for f in ids {
+            if open {
+                app.ui.project_open_folders.remove(&f.0);
+            } else {
+                app.ui.project_open_folders.insert(f.0);
+            }
+        }
+    }
+    app.auto.add(&format!("project.item.{}.twirl", it.id.0), tw, &it.name);
+}
+
+/// Proxy indicator: filled = the proxy is used, hollow = set but off. Click to switch.
+fn proxy_indicator(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    g: &RowGeom,
+    it: &effectcraft_engine::project::Item,
+    actions: &mut Vec<(String, serde_json::Value)>,
+) {
+    let t = app.tokens;
+    let RowGeom { lp, list, r, x0 } = *g;
+    if let Some(px) = it.proxy.as_ref() {
+        let pr = Rect::from_center_size(pos2(x0 + 4.0, r.center().y), vec2(9.0, 9.0));
+        if px.enabled {
+            lp.rect_filled(pr, 1.0, t.text);
+        } else {
+            lp.rect_stroke(pr, 1.0, Stroke::new(1.0, t.text), egui::StrokeKind::Inside);
+        }
+        let presp = ui.interact(pr.expand(2.0).intersect(list), egui::Id::unique(("pproxy", it.id.0)), Sense::click()).on_hover_text(format!(
+            "Proxy: {} ({})",
+            px.footage.path,
+            if px.enabled { "in use" } else { "off" }
+        ));
+        app.auto.add(&format!("project.item.{}.proxy", it.id.0), pr, if px.enabled { "Proxy in use" } else { "Proxy off" });
+        presp.widget_info(|| {
+            let name = crate::i18n::tr_args(if px.enabled { "Proxy of {}: in use" } else { "Proxy of {}: off" }, &[&it.name]);
+            egui::WidgetInfo::labeled(egui::Role::Button, true, name)
+        });
+        if presp.clicked() {
+            actions.push(("file.useProxy".into(), json!({"item": it.id.0})));
+        }
+    }
+}
+
+/// The label swatch: click for the label colour menu.
+fn label_swatch(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    g: &RowGeom,
+    it: &effectcraft_engine::project::Item,
+    label_x: f32,
+    selected: bool,
+    actions: &mut Vec<(String, serde_json::Value)>,
+) {
+    let t = app.tokens;
+    let RowGeom { lp, list, r, .. } = *g;
+    let sw = Rect::from_center_size(pos2(label_x, r.center().y), vec2(10.0, 10.0));
+    lp.rect_filled(sw, 2.0, t.label(it.label));
+    let sresp = ui.interact(sw.expand(3.0).intersect(list), egui::Id::unique(("plabel", it.id.0)), Sense::click());
+    app.auto.add(&format!("project.item.{}.label", it.id.0), sw, it.label.name());
+    sresp.widget_info(|| {
+        let name = crate::i18n::tr_args("Label of {}: {}", &[&it.name, &app.session.prefs.label_name(it.label)]);
+        egui::WidgetInfo::labeled(egui::Role::Button, true, name)
+    });
+    let pop = egui::Id::unique(("plabel-pop", it.id.0));
+    if sresp.clicked() || sresp.secondary_clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    if let Some(l) = widgets::label_popup(ui, pop, sw.left_bottom(), it.label, |l| app.session.prefs.label_name(l), &t) {
+        actions.push(("project.setLabel".into(), json!({"items": targets(app, it.id, selected), "label": label_index(l)})));
+    }
+}
+
+/// The Project panel: the selected item's thumbnail and details (with the comps that use it), the
+/// search field, sortable column headers, and the item rows (folders, comps, footage and solids)
+/// with selection, Shift/Cmd ranges, keyboard navigation, inline rename, drag-and-drop move,
+/// marquee selection and context menus. Only the rows in view are drawn. File commands are queued
+/// and run through [`crate::menus::invoke`] at the end, with failures shown in `app.ui.status`.
+pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let p = ui.painter().clone();
+    let ctx = ui.ctx().clone();
+    // Preview header.
+    let head = Rect::from_min_size(rect.min, vec2(rect.width(), 74.0));
+    details_header(app, ui, &p, &ctx, head);
+    // Search.
+    let sr = Rect::from_min_size(pos2(rect.min.x + 8.0, head.max.y + 2.0), vec2(rect.width() - 16.0, 22.0));
+    let filter_w = 88.0_f32.min(sr.width() * 0.45);
+    let filter = Rect::from_min_max(pos2(sr.max.x - filter_w, sr.min.y), sr.max);
+    let sr = Rect::from_min_max(sr.min, pos2((filter.min.x - 4.0).max(sr.min.x), sr.max.y));
+    let id = egui::Id::unique("project-status");
+    let pop = id.with("popup");
+    let status = app.ui.project_status;
+    let response = widgets::dropdown_tip(ui, filter, crate::i18n::tr(status.label()), Some(crate::i18n::tr("Filter by footage status")), &t, id);
+    app.auto.add("project.status", filter, status.label());
+    if response.clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    if widgets::popup_is_open(ui, pop) {
+        let options: Vec<_> = crate::state::ProjectStatus::ALL.iter().map(|s| crate::i18n::tr(s.label()).to_string()).collect();
+        if let Some(index) = widgets::popup_menu(ui, pop, filter.left_bottom(), &options, crate::state::ProjectStatus::ALL.iter().position(|s| *s == status))
+            && let Some(chosen) = crate::state::ProjectStatus::ALL.get(index)
+        {
+            app.ui.project_status = *chosen;
+        }
+    }
+    let mut q = app.ui.project_search.clone();
+    widgets::search_field(ui, sr, &mut q, crate::i18n::tr("Search project"), &t);
+    app.ui.project_search = q;
+    app.auto.add("project.search", sr, "Search");
+    // Column header: Name, Label, then the visible optional columns.
+    let hdr = Rect::from_min_size(pos2(rect.min.x, sr.max.y + 6.0), vec2(rect.width(), 20.0));
+    p.line_segment([hdr.left_bottom(), hdr.right_bottom()], Stroke::new(1.0, t.separator));
+    // Rows and columns stay clear of the scroll bar. (By last frame's overflow: the rows are
+    // listed below, and how many there are does not depend on the width.)
+    let gutter_id = egui::Id::unique("project-gutter");
+    let gutter = ctx.data(|d| d.get_temp::<bool>(gutter_id)).unwrap_or(false);
+    let content = if gutter { Rect::from_min_max(rect.min, pos2((rect.max.x - widgets::SCROLL_GUTTER).max(rect.min.x), rect.max.y)) } else { rect };
+    let fit = auto_name_fit(app, &p);
+    let cl = layout_columns(app, content, fit);
+    let (name_w, label_x, opt_x0, overflow, hscroll) = (cl.name_w, cl.label_x, cl.opt_x0, cl.overflow, cl.hscroll);
+    draw_header(app, ui, &p, hdr, &cl);
+    // Rows.
+    let footer_h = 28.0;
+    let list = Rect::from_min_max(pos2(rect.min.x, hdr.max.y), pos2(content.max.x, rect.max.y - footer_h));
+    let lp = p.with_clip_rect(list);
+    // The list's empty area (under the rows and the scroll bar, which take their own clicks):
+    // a click deselects, a drag draws a selection box, a double-click imports, as in After
+    // Effects (File ▸ Import ▸ File...).
+    // Not a Tab stop: the keyboard reaches the rows, and nothing else here takes a key.
+    let empty = ui.interact(list, egui::Id::unique("proj-empty"), Sense::CLICK | Sense::DRAG);
+    app.auto.add("project.empty", list, "Double-click to import files; drag to select items; right-click for project actions");
+    // (The wheel works over the scroll bar too.)
+    let wheel_area = Rect::from_min_max(list.min, pos2(rect.max.x, list.max.y));
+    hscroll_wheel(app, ui, wheel_area, overflow);
+    let moved = keyboard_nav(app, &ctx);
+    let rows = visible_rows(app);
+    enter_renames(app, &ctx);
+    let editing: Option<Editing> = ctx.data(|d| d.get_temp(edit_id()));
+    let dragging = egui::DragAndDrop::payload::<DragPayload>(&ctx).and_then(|p| match *p {
+        DragPayload::Item(i) => Some(i),
+        _ => None,
+    });
+    let hover_y = ctx.pointer_hover_pos().filter(|p| list.contains(*p)).map(|p| p.y);
+    let mut drop_row: Option<ItemId> = None;
+    let mut actions: Vec<(String, serde_json::Value)> = vec![];
+    let (scroll, max_scroll) = update_scroll(app, ui, &ctx, wheel_area, &rows, moved);
+    if gutter != (max_scroll > 0.0) {
+        ctx.data_mut(|d| d.insert_temp(gutter_id, max_scroll > 0.0));
+        ctx.request_repaint();
+    }
+    let first = ((scroll / ROW_H).floor() as usize).min(rows.len());
+    let mut y = list.min.y - (scroll - first as f32 * ROW_H);
+    let project = app.session.project.clone();
+    // Clip the rows' widgets (and hit tests) to the list too.
+    let panel_clip = ui.clip_rect();
+    ui.set_clip_rect(list.intersect(panel_clip));
+    for (i, (id, depth)) in rows.iter().enumerate().skip(first) {
+        let Some(it) = project.item(*id) else { continue };
+        let r = Rect::from_min_size(pos2(list.min.x, y), vec2(list.width(), ROW_H));
+        y += ROW_H;
+        if r.min.y > list.max.y {
+            break;
+        }
+        if hover_y.is_some_and(|hy| hy >= r.min.y && hy < r.max.y) {
+            drop_row = Some(*id);
+        }
+        let selected = app.session.state.project_selection.contains(id);
+        lp.rect_filled(
+            r,
+            0.0,
+            // Flat rows like After Effects' Project panel (no stripes).
+            if selected { t.row_selected } else { t.row },
+        );
+        // The row's click / drag area goes first, so the twirl, proxy, label and comment widgets
+        // on top of it take their own clicks.
+        let mut resp = ui.interact(r.intersect(list), row_id(*id), Sense::click_and_drag());
+        app.auto.add(&format!("project.item.{}", id.0), r, &it.name);
+        // For screen readers: a tree item named by the item and its type, with its selection,
+        // depth and (a folder) open state. One Tab stop per row; the panel's keys then apply.
+        let open = it.is_folder().then(|| {
+            app.ui.project_open_folders.contains(&id.0) || !app.ui.project_search.is_empty() || app.ui.project_status != crate::state::ProjectStatus::All
+        });
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TreeItem, true, format!("{}, {}", it.name, crate::i18n::tr(it.type_name()))));
+        ctx.accesskit_node_builder(resp.id, |n| {
+            n.set_selected(selected);
+            n.set_level(depth.saturating_add(1));
+            if let Some(open) = open {
+                n.set_expanded(open);
+            }
+        });
+        if resp.has_focus() {
+            ctx.data_mut(|d| d.insert_temp(focused_row_id(), *id));
+        }
+        if resp.gained_focus() {
+            app.ui.focused = crate::dock::PanelKind::Project;
+        }
+        let _ = i;
+        let x0 = r.min.x + 8.0 + 14.0 * *depth as f32;
+        let g = RowGeom { lp: &lp, list, r, x0 };
+        if it.is_folder() {
+            folder_twirl(app, ui, &g, it);
+        }
+        icons::paint(&lp, Rect::from_center_size(pos2(x0 + 18.0, r.center().y), vec2(14.0, 14.0)), item_icon(it), t.text_dim);
+        proxy_indicator(app, ui, &g, it, &mut actions);
+        // Footage (or the proxy in use) that can't be decoded (no decoder for its codec /
+        // profile): a warning marker at the end of the name cell, the reason on hover.
+        let problem = app.session.footage.item_problem(it).or_else(|| effectcraft_engine::render::missing_item_problem(it));
+        let name_clip =
+            Rect::from_min_max(pos2(x0 + 30.0, r.min.y), pos2(r.min.x + name_w + 4.0 - if problem.is_some() { 16.0 } else { 0.0 }, r.max.y)).intersect(list);
+        if let Some(why) = &problem {
+            problem_marker(app, ui, &g, name_w, it.id, why);
+        }
+        let name_rect = Rect::from_min_max(pos2(x0 + 28.0, r.min.y + 2.0), pos2(r.min.x + name_w + 2.0, r.max.y - 2.0));
+        if !cell_edit(app, ui, &mut actions, &editing, id.0, "name", name_rect) {
+            // The selected item's name sits in a light cell with dark text.
+            if selected {
+                let g = lp.layout_no_wrap(it.name.clone(), Tokens::ui(12.0), Color32::BLACK);
+                let cell = Rect::from_min_max(pos2(x0 + 27.0, r.min.y + 1.0), pos2((x0 + 33.0 + g.size().x).min(name_clip.max.x), r.max.y - 1.0));
+                lp.with_clip_rect(name_clip.expand2(vec2(3.0, 0.0))).rect_filled(cell, 0.0, Color32::from_rgb(0xa6, 0xa6, 0xa6));
+            }
+            // Long names end in "…" before the label column instead of being cut mid-glyph.
+            widgets::text_fit(
+                &lp.with_clip_rect(name_clip),
+                pos2(x0 + 30.0, r.center().y),
+                Align2::LEFT_CENTER,
+                &it.name,
+                Tokens::ui(12.0),
+                name_clip.max.x - (x0 + 30.0) - 2.0,
+                if selected { Color32::from_gray(0x16) } else { t.text },
+            );
+        }
+        label_swatch(app, ui, &g, it, label_x, selected, &mut actions);
+        if let Some(extra) = optional_cells(app, ui, &g, it, &cl, &editing, &mut actions) {
+            resp = resp.union(extra);
+        }
+        if dragging.is_some_and(|d| d != id.0) && drop_row == Some(*id) && it.is_folder() {
+            lp.rect_stroke(r.shrink(1.0), 2.0, Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
+        }
+        // The row with keyboard focus (Tab, or the arrow keys after it) shows a focus ring.
+        if ctx.memory(|m| m.has_focus(row_id(*id))) {
+            lp.rect_stroke(r.shrink(0.5), 0.0, Stroke::new(1.0, t.accent), egui::StrokeKind::Inside);
+        }
+        // Part of the row: not a second Tab stop.
+        let nresp = ui.interact(name_clip, egui::Id::unique(("pname", id.0)), Sense::CLICK | Sense::DRAG);
+        app.auto.add(&format!("project.item.{}.name", id.0), name_clip, &it.name);
+        let resp = resp.union(nresp);
+        if resp.clicked() {
+            select_click(app, ui, &ctx, *id, &rows);
+        }
+        // Double-click opens the item, as in After Effects (a comp gets its own Timeline tab and
+        // the viewer); Enter or the context menu renames.
+        if resp.double_clicked() {
+            open_item(app, it, *id, &mut actions);
+        }
+        if resp.drag_started() {
+            egui::DragAndDrop::set_payload(&ctx, DragPayload::Item(id.0));
+        }
+        // Right-clicking an item selects it (After Effects): the menu's File commands act on the
+        // selection.
+        if resp.secondary_clicked() && !selected {
+            app.session.state.project_selection = vec![*id];
+        }
+        crate::widgets::context_menu(&resp, |ui| item_menu(app, ui, &ctx, it, *id, selected, &mut actions));
+    }
+    ui.set_clip_rect(panel_clip);
+    // The scroll bars, over the rows (which would take their presses otherwise).
+    if overflow > 0.0 {
+        let track = Rect::from_min_max(pos2(opt_x0, list.max.y - 5.0), pos2(rect.max.x - 4.0, list.max.y - 1.0));
+        app.ui.project_hscroll = widgets::scroll_bar(ui, &mut app.auto, "project.hscroll", track, hscroll, overflow, &t);
+    }
+    if max_scroll > 0.0 {
+        let track = Rect::from_min_max(pos2(rect.max.x - 6.0, list.min.y + 1.0), pos2(rect.max.x - 2.0, list.max.y - 7.0));
+        app.ui.project_scroll = widgets::scroll_bar(ui, &mut app.auto, "project.vscroll", track, scroll, max_scroll, &t);
+    }
+    drop_targets(app, &ctx, &lp, list, DropState { dragging, row: drop_row, hovering: hover_y.is_some() }, &mut actions);
+    let foot = Rect::from_min_max(pos2(rect.min.x, rect.max.y - footer_h), rect.max);
+    footer(app, ui, &p, foot, &mut actions);
+    if empty.double_clicked() {
+        actions.push(("file.import".into(), json!({})));
+    }
+    crate::widgets::context_menu(&empty, |ui| {
+        for (key, label, command) in
+            [("newComp", "New Composition…", "comp.new"), ("newFolder", "New Folder", "project.newFolder"), ("import", "Import File…", "file.import")]
+        {
+            let response = ui.button(label);
+            app.auto.add(&format!("project.context.{key}"), response.rect, label);
+            if response.clicked() {
+                actions.push((command.into(), json!({})));
+                ui.close();
+            }
+        }
+    });
+    marquee_select(app, &ctx, &lp, list, &empty, &rows);
     for (id, params) in actions {
         if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
             app.ui.status = e;
@@ -1106,7 +1457,7 @@ fn column_menu(app: &mut EffectcraftApp, resp: &egui::Response) {
         ui.label(egui::RichText::new(crate::i18n::tr("Columns")).weak());
         for (key, label, _) in COLUMNS {
             let mut on = app.ui.project_columns.iter().any(|c| c == key);
-            if ui.checkbox(&mut on, label).changed() {
+            if crate::widgets::labelled_checkbox(ui, &mut on, crate::i18n::tr(label)).changed() {
                 set_column(&mut app.ui.project_columns, key, on);
             }
         }
@@ -1153,6 +1504,53 @@ mod tests {
         }
     }
 
+    /// Long names show in full: the Name column fits them (it stopped at 260 points with "…")
+    /// up to the panel's width less the Label column and, while optional columns show, room for
+    /// them; a width the user dragged wins.
+    #[test]
+    fn the_name_column_fits_the_names_up_to_the_panel_width() {
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let rect = Rect::from_min_size(pos2(0.0, 0.0), vec2(700.0, 400.0));
+        assert_eq!(layout_columns(&mut app, rect, 0.0).name_w, 260.0);
+        assert_eq!(layout_columns(&mut app, rect, 400.0).name_w, 400.0);
+        // The optional columns keep 40 points more: some content and a usable scroll bar track.
+        assert!(!app.ui.project_columns.is_empty());
+        let cl = layout_columns(&mut app, rect, 2000.0);
+        assert_eq!(cl.name_w, 620.0);
+        assert!(rect.max.x - cl.opt_x0 >= 50.0, "the optional columns keep {} points", rect.max.x - cl.opt_x0);
+        let narrow = Rect::from_min_size(pos2(0.0, 0.0), vec2(100.0, 400.0));
+        assert_eq!(layout_columns(&mut app, narrow, 400.0).name_w, MIN_NAME_W);
+        app.ui.project_name_w = Some(150.0);
+        assert_eq!(layout_columns(&mut app, rect, 400.0).name_w, 150.0);
+        app.ui.project_name_w = Some(f32::NAN);
+        assert_eq!(layout_columns(&mut app, rect, 400.0).name_w, 400.0);
+        app.ui.project_name_w = Some(5000.0);
+        assert_eq!(layout_columns(&mut app, rect, 0.0).name_w, 620.0);
+        // Without optional columns the Name column may take all but the Label column.
+        app.ui.project_columns.clear();
+        assert_eq!(layout_columns(&mut app, rect, 0.0).name_w, 660.0);
+    }
+
+    #[test]
+    fn name_fit_measures_the_longest_listed_name_with_its_indent() {
+        let mut s = effectcraft_engine::Session::default();
+        let p = std::sync::Arc::make_mut(&mut s.project);
+        let folder = p.add_item("F", Label::Aqua, None, ItemKind::Folder);
+        let long = p.add_item("A rather long composition name for the list", Label::Aqua, Some(folder), ItemKind::Folder);
+        let app = EffectcraftApp::new(s);
+        let ctx = egui::Context::default();
+        let mut fit = (0.0, 0.0);
+        ctx.run_ui(Default::default(), |ui| {
+            let painter = ui.painter();
+            let text = painter.layout_no_wrap("A rather long composition name for the list".into(), Tokens::ui(12.0), Color32::WHITE).size().x;
+            fit = (name_fit(&app, painter, &[(folder, 0), (long, 1)]), 8.0 + 14.0 + 30.0 + text + 24.0);
+        })
+        .textures_delta
+        .clear();
+        assert_eq!(fit.0, fit.1);
+        assert!(fit.0 > 260.0);
+    }
+
     #[test]
     fn size_keys_are_sampled_once_with_stable_ties() {
         let mut project = Project::default();
@@ -1295,3 +1693,40 @@ mod tests {
         assert_eq!(cols, ["type", "duration", "fps", "path", "comment"]);
     }
 }
+
+#[cfg(test)]
+mod availability_filter_tests {
+    use super::*;
+    use crate::state::ProjectStatus;
+    use effectcraft_engine::project::{Footage, Proxy};
+
+    #[test]
+    fn status_and_search_keep_only_matching_items_and_their_folder_ancestors() {
+        let mut s = effectcraft_engine::Session::default();
+        let p = Arc::make_mut(&mut s.project);
+        let folder = p.add_item("Shots", Label::None, None, ItemKind::Folder);
+        let missing =
+            p.add_item("Lost plate", Label::None, Some(folder), ItemKind::Footage(Footage { path: "/gone.png".into(), missing: true, ..Default::default() }));
+        let present = p.add_item("Other plate", Label::None, None, ItemKind::Footage(Footage { path: "/here.png".into(), ..Default::default() }));
+        let mut app = EffectcraftApp::new(s);
+        app.ui.project_status = ProjectStatus::Missing;
+        app.ui.project_search = "plate".into();
+        assert_eq!(visible_rows(&app), vec![(folder, 0), (missing, 1)]);
+        app.ui.project_status = ProjectStatus::Available;
+        assert_eq!(visible_rows(&app), vec![(present, 0)]);
+        app.ui.project_search = "absent name".into();
+        assert!(visible_rows(&app).is_empty());
+    }
+
+    #[test]
+    fn unused_missing_proxy_is_in_the_missing_filter() {
+        let mut s = effectcraft_engine::Session::default();
+        let p = Arc::make_mut(&mut s.project);
+        let id = p.add_item("Plate", Label::None, None, ItemKind::Footage(Footage { path: "/original.png".into(), ..Default::default() }));
+        p.item_mut(id).unwrap().proxy =
+            Some(Box::new(Proxy { footage: Footage { path: "/proxy.png".into(), missing: true, ..Default::default() }, enabled: false }));
+        let mut app = EffectcraftApp::new(s);
+        app.ui.project_status = ProjectStatus::Missing;
+        assert_eq!(visible_rows(&app), vec![(id, 0)]);
+    }
+}
diff --git a/crates/ui-egui/src/panels/properties.rs b/crates/ui-egui/src/panels/properties.rs
index 0fc747bf5..4edcbb31a 100644
--- a/crates/ui-egui/src/panels/properties.rs
+++ b/crates/ui-egui/src/panels/properties.rs
@@ -51,6 +51,12 @@ fn decimals(v: f64) -> usize {
     if (v - v.round()).abs() < 1e-6 { 0 } else { 1 }
 }
 
+/// The Properties panel for the first selected layer: "N Selected Objects" when several are
+/// selected, the Layer Transform section (with Reset) and, for a text layer, the text, paragraph
+/// and Text Animation sections that edit the range being edited in the viewer. Rows are evaluated
+/// against a snapshot of the project; every row edit is queued and run through
+/// [`crate::menus::invoke`] at the end (range-scoped for `layer.setText`), with failures reported
+/// in `app.ui.status`. Without a selected layer it shows a hint.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let p = ui.painter().with_clip_rect(rect);
@@ -64,10 +70,22 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let project = app.session.project.clone();
     let expr = app.session.expr.clone();
     let now = app.session.time();
-    let ectx = EvalCtx { project: &project, comp_id: cid, comp: &comp, time: now, expr: expr.as_deref(), footage: None };
+    let ectx = EvalCtx {
+        project: &project,
+        comp_id: cid,
+        comp: &comp,
+        time: now,
+        expr: expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("props-scroll"), rect);
+    let rect = scroll.content;
+    let p = p.with_clip_rect(rect);
     let x0 = rect.min.x + PAD;
     let w = rect.width() - 2.0 * PAD;
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("props-scroll"), rect);
     let top = rect.min.y + 8.0 - scroll.offset;
     let mut y = top;
     let mut actions: Actions = vec![];
@@ -85,9 +103,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
 
     // ---------------------------------------------------------------- Layer Transform
     if let Some(tr) = layer.transform().cloned() {
-        section_header(app, ui, &p, x0, w, y, "Layer Transform", "properties.transform");
+        section_header(app, &p, x0, w, y, "Layer Transform", "properties.transform");
         let rr = Rect::from_min_size(pos2(x0 + w - 40.0, y), vec2(40.0, ROW_H));
-        let resp = ui.interact(rr, egui::Id::new("props-reset"), Sense::click());
+        let resp = ui.interact(rr, egui::Id::unique("props-reset"), Sense::click());
         p.text(rr.right_center(), Align2::RIGHT_CENTER, crate::i18n::tr("Reset"), Tokens::ui(12.0), if resp.hovered() { t.accent_hover } else { t.accent });
         app.auto.add("properties.transform.reset", rr, "Reset Transform");
         if resp.clicked() {
@@ -118,15 +136,17 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         divider(&p, x0, w, y - 4.0, &t);
         y = paragraph_section(app, ui, &p, &layer, &doc, x0, w, y + 4.0, &mut actions);
         divider(&p, x0, w, y - 4.0, &t);
-        section_header(app, ui, &p, x0, w, y + 4.0, "Text Animation", "properties.textAnimation");
+        section_header(app, &p, x0, w, y + 4.0, "Text Animation", "properties.textAnimation");
         y += ROW_H + 10.0;
-        let br = Rect::from_min_size(pos2(x0, y), vec2(116.0, 24.0));
-        let resp = ui.interact(br, egui::Id::new("props-add-animator"), Sense::click());
+        // Both buttons grow with their (translated) labels; English keeps its 116 / 84 px.
+        let text_w = |s: &str| p.layout_no_wrap(s.to_string(), Tokens::ui(12.0), t.text).size().x;
+        let br = Rect::from_min_size(pos2(x0, y), vec2(116f32.max(text_w(crate::i18n::tr("Add Animator")) + 36.0), 24.0));
+        let resp = ui.interact(br, egui::Id::unique("props-add-animator"), Sense::click());
         p.rect_stroke(br, 4.0, Stroke::new(1.0, if resp.hovered() { t.text_dim } else { t.field_border }), egui::StrokeKind::Inside);
         icons::paint(&p, Rect::from_center_size(pos2(br.min.x + 14.0, br.center().y), vec2(10.0, 10.0)), Icon::Plus, t.text);
         p.text(pos2(br.min.x + 26.0, br.center().y), Align2::LEFT_CENTER, crate::i18n::tr("Add Animator"), Tokens::ui(12.0), t.text);
         app.auto.add("properties.addAnimator", br, "Add Animator");
-        let pop = egui::Id::new("props-add-animator-pop");
+        let pop = egui::Id::unique("props-add-animator-pop");
         if resp.clicked() {
             widgets::open_popup(ui, pop);
         }
@@ -142,12 +162,12 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
         // Our own presets (original work, see presets/text_animators.json).
-        let pr = Rect::from_min_size(pos2(br.max.x + 8.0, y), vec2(84.0, 24.0));
-        let presp = ui.interact(pr, egui::Id::new("props-text-presets"), Sense::click());
+        let pr = Rect::from_min_size(pos2(br.max.x + 8.0, y), vec2(84f32.max(text_w(crate::i18n::tr("Presets")) + 16.0), 24.0));
+        let presp = ui.interact(pr, egui::Id::unique("props-text-presets"), Sense::click());
         p.rect_stroke(pr, 4.0, Stroke::new(1.0, if presp.hovered() { t.text_dim } else { t.field_border }), egui::StrokeKind::Inside);
         p.text(pr.center(), Align2::CENTER_CENTER, crate::i18n::tr("Presets"), Tokens::ui(12.0), t.text);
         app.auto.add("properties.textPresets", pr, "Text Animation Presets");
-        let ppop = egui::Id::new("props-text-presets-pop");
+        let ppop = egui::Id::unique("props-text-presets-pop");
         if presp.clicked() {
             widgets::open_popup(ui, ppop);
         }
@@ -172,11 +192,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 }
 
-fn section_header(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, x0: f32, w: f32, y: f32, title: &str, auto: &str) {
+fn section_header(app: &mut EffectcraftApp, p: &egui::Painter, x0: f32, w: f32, y: f32, title: &str, auto: &str) {
     let t = app.tokens;
     p.text(pos2(x0, y + ROW_H / 2.0), Align2::LEFT_CENTER, title, Tokens::semibold(12.0), t.text);
     let r = Rect::from_min_size(pos2(x0, y), vec2(w, ROW_H));
-    let _ = ui;
     app.auto.add(auto, r, title);
 }
 
@@ -193,6 +212,8 @@ fn triangle(p: &egui::Painter, c: egui::Pos2, left: bool, col: Color32) {
 #[allow(clippy::too_many_arguments)]
 fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, layer: &Layer, pr: &Property, ectx: &EvalCtx, r: Rect, actions: &mut Actions) {
     let t = app.tokens;
+    // The values themselves: red while an expression drives the property (#1306).
+    let vt = t.for_value(pr.has_expression());
     let cy = r.center().y;
     let uid = pr.uid;
     let lid = layer.id.0;
@@ -205,7 +226,7 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
         let cells = [("prev", r.min.x + 4.0), ("key", r.min.x + 16.0), ("next", r.min.x + 28.0)];
         for (what, cx) in cells {
             let cr = Rect::from_center_size(pos2(cx, cy), vec2(12.0, 16.0));
-            let resp = ui.interact(cr, egui::Id::new(("props-nav", uid, what)), Sense::click());
+            let resp = ui.interact(cr, egui::Id::unique(("props-nav", uid, what)), Sense::click());
             let col = if resp.hovered() { t.text } else { t.text_dim };
             match what {
                 "prev" => triangle(p, cr.center(), true, col),
@@ -235,7 +256,7 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
         }
     } else {
         let swr = Rect::from_center_size(pos2(r.min.x + 16.0, cy), vec2(14.0, 14.0));
-        let resp = ui.interact(swr, egui::Id::new(("props-sw", uid)), Sense::click());
+        let resp = ui.interact(swr, egui::Id::unique(("props-sw", uid)), Sense::click());
         icons::paint(p, swr, Icon::Stopwatch, if resp.hovered() { t.text } else { t.text_dim });
         app.auto.add(&format!("{base}.stopwatch"), swr, &pr.name);
         if resp.clicked() {
@@ -245,9 +266,11 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
     p.text(pos2(r.min.x + 42.0, cy), Align2::LEFT_CENTER, &pr.name, Tokens::ui(12.0), t.text);
     let vx = r.min.x + (r.width() * 0.5).max(130.0);
     let label = Rect::from_min_max(pos2(r.min.x + 42.0, r.min.y), pos2(vx - 20.0, r.max.y));
-    let resp = ui.interact(label, egui::Id::new(("props-label", uid)), Sense::click());
+    let resp = ui.interact(label, egui::Id::unique(("props-label", uid)), Sense::click());
+    crate::a11y::role_name(&resp, egui::accesskit::Role::Button, &pr.name);
     app.auto.add(&format!("{base}.label"), label, &pr.name);
-    if resp.double_clicked() {
+    // A double click, or the keyboard's activation (a primary single click is not one).
+    if resp.double_clicked() || (resp.clicked() && !resp.clicked_by(egui::PointerButton::Primary)) {
         app.ui.timeline.search.clear();
         app.ui.timeline.scroll_to = Some(crate::state::ScrollTo::Property(uid));
         if let Err(e) = crate::menus::frontend(app, ui.ctx(), "timeline.revealProps", json!({"props": [{"layer": lid, "prop": uid}]})) {
@@ -269,7 +292,7 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
     match &value {
         Value::Scalar(v) if pr.name == "Rotation" || pr.name.ends_with(" Rotation") => {
             let (_, deg) = super::fx_widgets::split_angle(*v);
-            let (rr, dr, nv) = super::fx_widgets::angle_field(ui, pos2(vx, cy - 9.0), egui::Id::new(("props-v", uid)), *v, decimals(deg), &t);
+            let (rr, dr, nv) = super::fx_widgets::angle_field(ui, pos2(vx, cy - 9.0), egui::Id::unique(("props-v", uid)), *v, decimals(deg), &vt);
             app.auto.add(&format!("{base}.value"), dr, &pr.name);
             app.auto.add(&format!("{base}.revolutions"), rr, &pr.name);
             if let Some(nv) = nv {
@@ -278,7 +301,14 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
         }
         Value::Scalar(v) => {
             let range = if pr.name == "Opacity" { (0.0, 100.0) } else { (-1e9, 1e9) };
-            let (vr, nv, _) = widgets::hot_number_at(ui, pos2(vx, cy - 9.0), egui::Id::new(("props-v", uid)), *v, 0.5, range, decimals(*v), suffix, &t);
+            let (vr, nv, _) = widgets::hot_number_at(
+                ui,
+                pos2(vx, cy - 9.0),
+                egui::Id::unique(("props-v", uid)),
+                *v,
+                &widgets::HotSpec { speed: 0.5, range, decimals: decimals(*v), suffix },
+                &vt,
+            );
             app.auto.add(&format!("{base}.value"), vr, &pr.name);
             if let Some(nv) = nv {
                 set(actions, json!(nv));
@@ -295,7 +325,7 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
             if linkable {
                 // Constrain Proportions toggle, left of the values.
                 let lr = Rect::from_center_size(pos2(x - 12.0, cy), vec2(12.0, 12.0));
-                let resp = ui.interact(lr, egui::Id::new(("props-link", uid)), Sense::click()).on_hover_text(tr("Constrain Proportions"));
+                let resp = ui.interact(lr, egui::Id::unique(("props-link", uid)), Sense::click()).on_hover_text(tr("Constrain Proportions"));
                 icons::paint(p, lr, Icon::Link, if linked { t.accent } else { t.text_faint });
                 app.auto.add(&format!("{base}.constrain"), lr, "Constrain Proportions");
                 if resp.clicked() && !app.ui.timeline.unlinked.remove(&uid) {
@@ -303,8 +333,14 @@ fn transform_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
                 }
             }
             for d in 0..n.min(c.len()) {
-                let (vr, nv, _) =
-                    widgets::hot_number_at(ui, pos2(x, cy - 9.0), egui::Id::new(("props-v", uid, d)), c[d], 1.0, (-1e9, 1e9), decimals(c[d]), suffix, &t);
+                let (vr, nv, _) = widgets::hot_number_at(
+                    ui,
+                    pos2(x, cy - 9.0),
+                    egui::Id::unique(("props-v", uid, d)),
+                    c[d],
+                    &widgets::HotSpec { speed: 1.0, range: (-1e9, 1e9), decimals: decimals(c[d]), suffix },
+                    &vt,
+                );
                 app.auto.add(&format!("{base}.value.{d}"), vr, &pr.name);
                 if let Some(nv) = nv {
                     let mut nc = c.clone();
@@ -350,18 +386,18 @@ fn text_section(
         v["layer"] = json!(lid);
         actions.push(("layer.setText".into(), v));
     };
-    section_header(app, ui, p, x0, w, y, "Text", "properties.text");
+    section_header(app, p, x0, w, y, "Text", "properties.text");
     y += ROW_H + 4.0;
     // Font family and style.
     let fr = Rect::from_min_size(pos2(x0, y), vec2(w, 22.0));
-    let pop = egui::Id::new("props-font-pop");
+    let pop = egui::Id::unique("props-font-pop");
     if let Some(f) = super::text_panels::font_picker(app, ui, pop, fr, &doc.font, "properties.text.font", true) {
         set(actions, json!({"font": f}));
     }
     y += 28.0;
     let sr = Rect::from_min_size(pos2(x0, y), vec2(w, 22.0));
-    let spop = egui::Id::new("props-style-pop");
-    if widgets::dropdown(ui, sr, &doc.style, &t, egui::Id::new("props-style")).clicked() {
+    let spop = egui::Id::unique("props-style-pop");
+    if widgets::dropdown(ui, sr, &doc.style, &t, egui::Id::unique("props-style")).clicked() {
         widgets::open_popup(ui, spop);
     }
     app.auto.add("properties.text.style", sr, "Font style");
@@ -375,7 +411,14 @@ fn text_section(
     let col2 = x0 + w / 2.0;
     let field = |app: &mut EffectcraftApp, ui: &mut egui::Ui, x: f32, y: f32, glyph: &str, key: &str, v: f64, range: (f64, f64), suffix: &str| {
         p.text(pos2(x, y + 9.0), Align2::LEFT_CENTER, glyph, Tokens::semibold(11.0), t.text_dim);
-        let (r, nv, _) = widgets::hot_number_at(ui, pos2(x + 26.0, y), egui::Id::new(("props-text", key)), v, 0.5, range, decimals(v), suffix, &t);
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(x + 26.0, y),
+            egui::Id::unique(("props-text", key)),
+            v,
+            &widgets::HotSpec { speed: 0.5, range, decimals: decimals(v), suffix },
+            &t,
+        );
         app.auto.add(&format!("properties.text.{key}"), r, key);
         nv
     };
@@ -392,7 +435,7 @@ fn text_section(
             // Auto Leading: click to switch to an explicit value (120% of the size).
             p.text(pos2(col2, y + 9.0), Align2::LEFT_CENTER, "A", Tokens::semibold(11.0), t.text_dim);
             let r = Rect::from_min_size(pos2(col2 + 26.0, y), vec2(40.0, 18.0));
-            let resp = ui.interact(r, egui::Id::new("props-leading-auto"), Sense::click());
+            let resp = ui.interact(r, egui::Id::unique("props-leading-auto"), Sense::click());
             p.text(
                 pos2(r.min.x + 2.0, r.center().y),
                 Align2::LEFT_CENTER,
@@ -418,14 +461,14 @@ fn text_section(
     for (i, (key, label, on, c)) in [("fill", "Fill", doc.apply_fill, doc.fill), ("stroke", "Stroke", doc.apply_stroke, doc.stroke)].into_iter().enumerate() {
         let ry = y + i as f32 * 24.0;
         let cr = Rect::from_min_size(pos2(x0, ry + 2.0), vec2(14.0, 14.0));
-        if widgets::checkbox(ui, cr, on, &t, egui::Id::new(("props-apply", key))).clicked() {
+        if widgets::checkbox(ui, cr, on, &t, egui::Id::unique(("props-apply", key))).changed() {
             let k = if key == "fill" { "applyFill" } else { "applyStroke" };
             set(actions, json!({k: !on}));
         }
         app.auto.add(&format!("properties.text.{key}.enabled"), cr, label);
         let sw = Rect::from_min_size(pos2(x0 + 24.0, ry + 1.0), vec2(16.0, 16.0));
-        let pop = egui::Id::new(("props-color-pop", key));
-        if widgets::swatch(ui, sw, c, egui::Id::new(("props-color", key)), &t).clicked() {
+        let pop = egui::Id::unique(("props-color-pop", key));
+        if widgets::swatch(ui, sw, c, egui::Id::unique(("props-color", key)), &t).clicked() {
             widgets::open_popup(ui, pop);
         }
         app.auto.add(&format!("properties.text.{key}"), sw, label);
@@ -454,12 +497,12 @@ fn paragraph_section(
     actions: &mut Actions,
 ) -> f32 {
     let t = app.tokens;
-    section_header(app, ui, p, x0, w, y, "Paragraph", "properties.paragraph");
+    section_header(app, p, x0, w, y, "Paragraph", "properties.paragraph");
     y += ROW_H + 4.0;
     for (i, (j, key)) in ALIGNS.into_iter().enumerate() {
         let r = Rect::from_min_size(pos2(x0 + i as f32 * 26.0, y), vec2(22.0, 22.0));
         let on = doc.justify == j;
-        let resp = ui.interact(r, egui::Id::new(("props-para", key)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("props-para", key)), Sense::click());
         p.rect_filled(
             r,
             3.0,
@@ -514,7 +557,7 @@ fn paint_align_glyph(p: &egui::Painter, r: Rect, j: Justify, c: Color32) {
 fn more_button(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, x0: f32, y: f32, id: &str, auto: &str, panel: PanelKind) -> f32 {
     let t = app.tokens;
     let r = Rect::from_min_size(pos2(x0, y), vec2(64.0, 22.0));
-    let resp = ui.interact(r, egui::Id::new(id), Sense::click());
+    let resp = ui.interact(r, egui::Id::unique(id), Sense::click());
     p.rect_filled(r, 4.0, if resp.hovered() { t.hover } else { t.field_bg });
     p.text(pos2(r.min.x + 8.0, r.center().y), Align2::LEFT_CENTER, "···", Tokens::semibold(12.0), t.text);
     p.text(pos2(r.min.x + 26.0, r.center().y), Align2::LEFT_CENTER, crate::i18n::tr("More"), Tokens::ui(12.0), t.text);
diff --git a/crates/ui-egui/src/panels/puppet_tool.rs b/crates/ui-egui/src/panels/puppet_tool.rs
index 8299f3a34..ac2186bf8 100644
--- a/crates/ui-egui/src/panels/puppet_tool.rs
+++ b/crates/ui-egui/src/panels/puppet_tool.rs
@@ -70,7 +70,7 @@ struct Cached {
 pub fn overlay(app: &EffectcraftApp, ctx: &egui::Context, cid: ItemId, layer: &Layer, t: Tick) -> Option<Overlay> {
     let fx = layer.effects()?.groups().find(|g| puppet::is_puppet(g))?;
     let key = (app.session.revision, cid.0, layer.id.0, t.0);
-    let id = egui::Id::new(("puppet-overlay", layer.id.0));
+    let id = egui::Id::unique(("puppet-overlay", layer.id.0));
     if let Some(c) = ctx.data(|d| d.get_temp::<Cached>(id))
         && c.key == key
     {
@@ -84,8 +84,8 @@ pub fn overlay(app: &EffectcraftApp, ctx: &egui::Context, cid: ItemId, layer: &L
 
 /// The layer a Puppet tool press at comp point `cpt` works on, of the selected `layers` with a
 /// Puppet effect (stack order): the one whose mesh, as deformed now, is under it (pins go on the
-/// deformed shape, also where it reaches past the layer's own bounds), else the one whose art is
-/// (a new mesh there). Never a layer without a Puppet effect: the tools stay on the layers being
+/// deformed shape, also where it reaches past the layer's own bounds), else the one `on_art` takes
+/// it (see `takes_pin`). Never a layer without a Puppet effect: the tools stay on the layers being
 /// rigged, as in After Effects (#284).
 pub fn target(ectx: &EvalCtx, layers: &[(&Layer, Overlay)], cpt: [f64; 2], on_art: impl Fn(&Layer) -> bool) -> Option<LayerId> {
     let on_mesh = |l: &Layer, ov: &Overlay| {
@@ -96,6 +96,14 @@ pub fn target(ectx: &EvalCtx, layers: &[(&Layer, Overlay)], cpt: [f64; 2], on_ar
     layers.iter().find(|(l, ov)| on_mesh(l, ov)).or_else(|| layers.iter().find(|(l, _)| on_art(l))).map(|(l, _)| l.id)
 }
 
+/// Whether a press at comp point `cpt` places a pin on `layer`. Where it would not (the deformed
+/// layer is empty there) the press is on nothing: a click does nothing, a drag is a marquee (#2865).
+pub fn takes_pin(app: &EffectcraftApp, ectx: &EvalCtx, layer: &Layer, cpt: [f64; 2]) -> bool {
+    let Some(inv) = fx2c(ectx, layer).inverse() else { return false };
+    let p = inv.apply(gv2(cpt[0], cpt[1]));
+    effectcraft_engine::commands::puppet::places_pin(&app.session, ectx.comp_id, layer.id, [p.x, p.y], ectx.time)
+}
+
 /// Keep a pin's keyframed Position in view in the Timeline after placing, moving or recording the
 /// pin in the viewer (#273).
 pub fn reveal_pin(app: &mut EffectcraftApp, layer: LayerId, pin: u64) {
diff --git a/crates/ui-egui/src/panels/render_queue.rs b/crates/ui-egui/src/panels/render_queue.rs
index e07efe69e..6c5963908 100644
--- a/crates/ui-egui/src/panels/render_queue.rs
+++ b/crates/ui-egui/src/panels/render_queue.rs
@@ -13,13 +13,15 @@
 
 use crate::i18n::{tr, tr_args};
 use effectcraft_engine::project::render_queue::{
-    AlphaMode, AudioFormat, AudioOutput, Channels, ColorDepth, CurrentOrOff, EffectsMode, FieldRender, OpusApplication, OutputFormat, PostRenderAction,
-    ProResProfile, Pulldown, RESIZE_PRESETS, RenderLog, RenderQuality, RenderQueueItem, RenderStatus, ResizeQuality, SwitchOverride, TimeSpan, WebmVideoCodec,
+    AlphaMode, AudioFormat, AudioOutput, Channels, ColorDepth, CurrentOrOff, EffectsMode, ExrBitDepth, ExrCompression, FieldRender, OpusApplication,
+    OutputFormat, PostRenderAction, ProResProfile, Pulldown, RESIZE_PRESETS, RenderLog, RenderQuality, RenderQueueItem, RenderStatus, ResizeQuality,
+    SwitchOverride, TimeSpan, WebmVideoCodec,
 };
 use effectcraft_engine::project::render_templates::RenderTemplates;
 use egui::{Align2, Color32, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
 use serde_json::{Value, json};
 
+use crate::a11y;
 use crate::theme::Tokens;
 use crate::widgets::check_label as mark;
 use crate::{EffectcraftApp, widgets};
@@ -35,21 +37,38 @@ pub fn hms(secs: f64) -> String {
     format!("{}:{:02}:{:02}", s / 3600, s / 60 % 60, s % 60)
 }
 
-/// Unix seconds → `YYYY-MM-DD hh:mm:ss` (UTC).
+/// Unix seconds → (proleptic Gregorian year, the same wall-clock instant moved into chrono's range
+/// by whole 400-year cycles). The Gregorian calendar repeats every 400 years (146_097 days), so
+/// month, day and time of day come from chrono and only the year is carried, which keeps every
+/// input exact instead of collapsing out-of-range years to the epoch. `unix` is `u64`, so `days`
+/// always fits an `i64`.
+fn utc_parts(unix: u64) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (days, sod) = ((unix / 86_400) as i64, (unix % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
+/// Unix seconds → `YYYY-MM-DD hh:mm:ss` (UTC). Years far outside chrono's own range are preserved
+/// (the old hand-rolled conversion kept them) rather than collapsing to the epoch.
 pub fn utc_stamp(unix: u64) -> String {
-    let days = (unix / 86_400) as i64;
-    let rem = unix % 86_400;
-    // Civil-from-days (proleptic Gregorian).
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z - era * 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + i64::from(m <= 2);
-    format!("{y:04}-{m:02}-{d:02} {:02}:{:02}:{:02}", rem / 3600, rem / 60 % 60, rem % 60)
+    let (y, t) = utc_parts(unix);
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", t.format("%m-%d %H:%M:%S"))
+}
+
+/// A queue item's row: its click area, keyboard focus and accessibility node.
+fn row_id(item: u64) -> egui::Id {
+    egui::Id::unique(("rq-row", item))
 }
 
 fn status_color(t: &Tokens, s: &RenderStatus) -> Color32 {
@@ -159,6 +178,7 @@ fn output_menu(it: &RenderQueueItem, available: &[OutputFormat], templates: &Ren
                 v.push((mark(o.prores_profile == p, p.label()), json!({"proresProfile": format!("{p:?}")})));
             }
         }
+        OutputFormat::ExrSequence => exr_menu(o, &mut v),
         OutputFormat::H264 => {
             v.push(("-".into(), Value::Null));
             for kbps in [2_000, 5_000, 10_000, 15_000, 20_000, 40_000] {
@@ -254,6 +274,26 @@ fn output_menu(it: &RenderQueueItem, available: &[OutputFormat], templates: &Ren
     v
 }
 
+/// OpenEXR options: compression (marked where lossy at the module's bit depth) and bit depth.
+fn exr_menu(o: &effectcraft_engine::project::render_queue::OutputModule, v: &mut Vec<(String, Value)>) {
+    v.push(("-".into(), Value::Null));
+    for c in ExrCompression::ALL {
+        let d = o.exr_bit_depth;
+        let label = if c.is_lossy(d) {
+            "EXR Compression: {} (lossy)"
+        } else if c != ExrCompression::None && c.stores_uncompressed(d) {
+            "EXR Compression: {} (uncompressed at float)"
+        } else {
+            "EXR Compression: {}"
+        };
+        v.push((mark(o.exr_compression == c, &tr_args(label, &[&(c.label())])), json!({"exrCompression": c.name()})));
+    }
+    v.push(("-".into(), Value::Null));
+    for d in ExrBitDepth::ALL {
+        v.push((mark(o.exr_bit_depth == d, &tr_args("EXR Bit Depth: {}", &[&(d.label())])), json!({"exrBitDepth": d.name()})));
+    }
+}
+
 /// HEVC / AV1 options: profile, level, rate control (bitrate or constant quality), key frames.
 fn codec_menu(o: &effectcraft_engine::project::render_queue::OutputModule, v: &mut Vec<(String, Value)>) {
     use effectcraft_engine::project::render_queue::{CodecProfile, RateControlMode, VideoCodecOptions};
@@ -403,15 +443,21 @@ fn pick_output(app: &EffectcraftApp, it: &RenderQueueItem) -> Option<Option<Stri
     app.hooks.save_dialog(&app.session.resolve_output(it).unwrap_or_default())
 }
 
-pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+/// A `renderQueue.*` command queued while drawing, run after the frame.
+type Action = (&'static str, Value);
+
+/// What the panel's sections read: the queue, the running render (if any) and the formats.
+#[derive(Clone, Copy)]
+struct RqView<'a> {
+    queue: &'a [RenderQueueItem],
+    progress: Option<&'a effectcraft_engine::render_queue::JobState>,
+    rendering: bool,
+    available: &'a [OutputFormat],
+}
+
+/// Comps dragged from the Project over the panel: an outline while hovering, queued on release.
+fn queue_drop(app: &EffectcraftApp, ui: &egui::Ui, rect: Rect, p: &egui::Painter, rendering: bool, actions: &mut Vec<Action>) {
     let t = app.tokens;
-    let p = ui.painter().with_clip_rect(rect);
-    let queue: Vec<RenderQueueItem> = app.session.project.render_queue.clone();
-    let progress = app.session.render_progress();
-    let rendering = app.session.is_rendering();
-    let available = app.session.exporter.as_ref().map(|e| e.formats()).unwrap_or_default();
-    let mut actions: Vec<(&'static str, Value)> = Vec::new();
-    app.auto.add("renderQueue.drop", rect, "Drop compositions to queue");
     if !rendering
         && let Some(crate::panels::DragPayload::Item(id)) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(ui.ctx()).as_deref()
         && app.session.project.comp(effectcraft_engine::project::ItemId(*id)).is_some()
@@ -431,23 +477,43 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             p.rect_stroke(rect.shrink(2.0), 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
         }
     }
-    let mut forms: Vec<(RenderQueueItem, String)> = Vec::new();
-    let state_id = egui::Id::new("rq-ui");
-    let (mut open, mut selected): (Vec<u64>, Option<u64>) = ui.data(|d| d.get_temp(state_id).unwrap_or_default());
+}
 
-    // ---------------------------------------------------------- Current Render strip
-    let top = Rect::from_min_size(rect.min, vec2(rect.width(), TOP_H));
-    p.rect_filled(top, 0.0, t.tl_ruler_bg);
-    let x0 = rect.min.x + 12.0;
+/// Elapsed and estimated remaining seconds at UI time `now`. The job reports them as frames
+/// finish; between reports they count on from the last one, as a clock does, so a slow frame
+/// doesn't read as a stalled render (#2593).
+fn live_times(ctx: &egui::Context, pr: &effectcraft_engine::render_queue::JobState, now: f64) -> (f64, Option<f64>) {
+    let report = (pr.current, pr.done, pr.item_elapsed.to_bits());
+    let since = ctx.data_mut(|d| {
+        let seen = d.get_temp_mut_or_insert_with(egui::Id::unique("rq-progress-seen"), || (report, now));
+        if seen.0 != report {
+            *seen = (report, now);
+        }
+        seen.1
+    });
+    let dt = if pr.finished { 0.0 } else { (now - since).max(0.0) };
+    (pr.item_elapsed + dt, pr.remaining.map(|r| (r - dt).max(0.0)))
+}
+
+/// The Current Render strip inside `top`: title, elapsed / remaining time, Render, Stop, Notify
+/// and the progress bar.
+fn current_render_strip(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, top: Rect, rq: &RqView, actions: &mut Vec<Action>) {
+    let t = app.tokens;
+    let RqView { queue, progress, rendering, available } = *rq;
+    let x0 = top.min.x + 12.0;
     p.text(pos2(x0, top.min.y + 16.0), Align2::LEFT_CENTER, tr("Current Render"), Tokens::semibold(12.5), t.text);
     let cur_item = progress.as_ref().and_then(|p| p.current).and_then(|id| queue.iter().find(|i| i.id == id));
     let cur_name = cur_item.and_then(|i| app.session.project.item(i.comp)).map(|i| i.name.clone());
     if let Some(pr) = &progress {
-        let rem = pr.remaining.map(hms).unwrap_or_else(|| "–".into());
+        let (elapsed, remaining) = live_times(ui.ctx(), pr, ui.input(|i| i.time));
+        if rendering {
+            ui.ctx().request_repaint_after(std::time::Duration::from_millis(500));
+        }
+        let rem = remaining.map(hms).unwrap_or_else(|| "–".into());
         p.text(
             pos2(top.max.x - 12.0, top.min.y + 16.0),
             Align2::RIGHT_CENTER,
-            format!("Elapsed: {}     Est. Remain: {rem}", hms(pr.item_elapsed)),
+            format!("Elapsed: {}     Est. Remain: {rem}", hms(elapsed)),
             Tokens::ui(11.5),
             t.text_dim,
         );
@@ -456,20 +522,25 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let render_b = Rect::from_min_size(pos2(top.max.x - 12.0 - bw, top.min.y + 34.0), vec2(bw, 26.0));
     let stop_b = Rect::from_min_size(pos2(render_b.min.x - 8.0 - bw, render_b.min.y), vec2(bw, 26.0));
     let can_render = !rendering && queue.iter().any(RenderQueueItem::is_queued) && !available.is_empty();
-    if widgets::text_button(ui, render_b, "Render", can_render, &t, egui::Id::new("rq-render")).clicked() && can_render {
+    let render_label = tr("Render");
+    let render_resp = widgets::text_button(ui, render_b, render_label, can_render, &t, egui::Id::unique("rq-render"));
+    a11y::button(&render_resp, render_label, can_render);
+    if render_resp.clicked() && can_render {
         actions.push(("renderQueue.render", json!({"wait": false})));
     }
     app.auto.add("renderQueue.render", render_b, "Render");
     // Notify (sound + notification when the queue finishes).
     let notify = app.session.project.render_prefs.notify;
     let nb = Rect::from_min_size(pos2(render_b.min.x - 8.0 - 2.0 * bw - 8.0, render_b.min.y + 4.0), vec2(18.0, 18.0));
-    if widgets::checkbox(ui, nb, notify, &t, egui::Id::new("rq-notify")).clicked() {
+    let notify_resp = widgets::checkbox(ui, nb, notify, &t, egui::Id::unique("rq-notify"));
+    a11y::check_box(&notify_resp, tr("Notify"), notify, true);
+    if notify_resp.changed() {
         actions.push(("renderQueue.setNotify", json!({"notify": !notify})));
     }
     p.text(pos2(nb.max.x + 5.0, nb.center().y), Align2::LEFT_CENTER, tr("Notify"), Tokens::ui(11.5), t.text_dim);
     app.auto.add("renderQueue.notify", nb, if notify { "Notify: on" } else { "Notify: off" });
     if rendering {
-        if widgets::text_button(ui, stop_b, "Stop", false, &t, egui::Id::new("rq-stop")).clicked() {
+        if widgets::text_button(ui, stop_b, crate::i18n::tr("Stop"), false, &t, egui::Id::unique("rq-stop")).clicked() {
             actions.push(("renderQueue.stop", json!({})));
         }
         app.auto.add("renderQueue.stop", stop_b, "Stop");
@@ -496,11 +567,315 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     };
-    p.text(pos2(bar.min.x + 8.0, bar.center().y), Align2::LEFT_CENTER, bar_text, Tokens::ui(11.5), t.text);
+    p.text(pos2(bar.min.x + 8.0, bar.center().y), Align2::LEFT_CENTER, &bar_text, Tokens::ui(11.5), t.text);
     app.auto.add("renderQueue.progress", bar, &format!("{:.0}%", frac * 100.0));
+    a11y::progress(&ui.interact(bar, egui::Id::unique("rq-progress"), Sense::hover()), &bar_text, frac);
+}
+
+/// The footer: the message line and the totals.
+fn footer(p: &egui::Painter, rect: Rect, rq: &RqView, t: &Tokens) {
+    let RqView { queue, progress, rendering, .. } = *rq;
+    let foot = Rect::from_min_max(pos2(rect.min.x, rect.max.y - FOOT_H), rect.max);
+    p.rect_filled(foot, 0.0, t.tl_ruler_bg);
+    p.line_segment([foot.left_top(), foot.right_top()], Stroke::new(1.0, t.separator));
+    let msg = match &progress {
+        Some(pr) if rendering => format!("Message: Rendering {} of {}", (pr.items_done + 1).min(pr.items_total), pr.items_total),
+        _ => {
+            let done = queue.iter().filter(|i| i.status == RenderStatus::Done).count();
+            format!("Message: {done} of {} done", queue.len())
+        }
+    };
+    p.text(pos2(foot.min.x + 12.0, foot.center().y), Align2::LEFT_CENTER, msg, Tokens::ui(11.0), t.text_dim);
+    let started = queue.iter().filter(|i| i.started.is_some()).count();
+    let total: f64 = queue.iter().filter_map(|i| i.render_time).sum();
+    p.text(
+        pos2(foot.max.x - 12.0, foot.center().y),
+        Align2::RIGHT_CENTER,
+        format!("Renders Started: {started}     Total Time Elapsed: {}", hms(progress.as_ref().filter(|_| rendering).map(|p| p.elapsed).unwrap_or(total))),
+        Tokens::ui(11.0),
+        t.text_dim,
+    );
+}
+
+/// An item row's context menu: Duplicate, Remove and Move Up / Down (row `k` of `len`).
+fn row_menu(ui: &mut egui::Ui, actions: &mut Vec<Action>, item_id: u64, k: usize, len: usize) {
+    if ui.button(tr("Duplicate")).clicked() {
+        actions.push(("renderQueue.duplicate", json!({"item": item_id})));
+        ui.close();
+    }
+    if ui.button(tr("Remove")).clicked() {
+        actions.push(("renderQueue.remove", json!({"item": item_id})));
+        ui.close();
+    }
+    if k > 0 && ui.button(tr("Move Up")).clicked() {
+        actions.push(("renderQueue.move", json!({"item": item_id, "to": k})));
+        ui.close();
+    }
+    if k + 1 < len && ui.button(tr("Move Down")).clicked() {
+        actions.push(("renderQueue.move", json!({"item": item_id, "to": k + 2})));
+        ui.close();
+    }
+}
+
+/// Log: Errors Only / Plus Settings / Plus Per Frame Info.
+fn log_dropdown(app: &mut EffectcraftApp, ui: &mut egui::Ui, row: &ItemRow, it: &RenderQueueItem, actions: &mut Vec<Action>) {
+    let ItemRow { lp, r, n, rendering, .. } = *row;
+    let t = app.tokens;
+    let aid = |s: &str| format!("renderQueue.item.{n}.{s}");
+    let ld = Rect::from_min_size(pos2(r.max.x - 190.0, r.min.y + 3.0), vec2(150.0, ROW_H - 6.0));
+    lp.text(pos2(ld.min.x - 6.0, r.center().y), Align2::RIGHT_CENTER, tr("Log:"), Tokens::ui(11.5), t.text_dim);
+    let lid = egui::Id::unique(("rq-log", it.id));
+    let log_resp = widgets::dropdown(ui, ld, it.log.label(), &t, lid);
+    a11y::combo_box(&log_resp, tr("Log:").trim_end_matches(':'), it.log.label(), !rendering);
+    if log_resp.clicked() && !rendering {
+        widgets::open_popup(ui, lid);
+    }
+    let llabels: Vec<String> = RenderLog::ALL.iter().map(|l| mark(it.log == *l, l.label())).collect();
+    if let Some(i) = widgets::popup_menu(ui, lid, ld.left_bottom(), &llabels, None) {
+        if widgets::by_keyboard(ui) {
+            log_resp.request_focus();
+        }
+        actions.push(("renderQueue.setLog", json!({"item": it.id, "log": RenderLog::ALL[i].label()})));
+    }
+    app.auto.add(&aid("log"), ld, it.log.label());
+}
+
+/// Where an item row's expanded line is drawn.
+#[derive(Clone, Copy)]
+struct ItemRow<'a> {
+    lp: &'a egui::Painter,
+    list: Rect,
+    r: Rect,
+    /// The item's 1-based position in the queue.
+    n: usize,
+    rendering: bool,
+}
+
+/// The expanded "Output To" line: the template menu, and the file name (click to choose it or
+/// edit the template in place).
+fn output_to(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    row: &ItemRow,
+    it: &RenderQueueItem,
+    dd_right: f32,
+    editing: &mut Option<(u64, String)>,
+    actions: &mut Vec<Action>,
+) {
+    let ItemRow { lp, list, r, n, rendering } = *row;
+    let t = app.tokens;
+    let aid = |s: &str| format!("renderQueue.item.{n}.{s}");
+    let ox = dd_right + 14.0;
+    lp.text(pos2(ox, r.center().y), Align2::LEFT_CENTER, tr("Output To:"), Tokens::ui(11.5), t.text_dim);
+    let odd = Rect::from_min_size(pos2(ox + 62.0, r.min.y + 3.0), vec2(22.0, ROW_H - 6.0));
+    let oid = egui::Id::unique(("rq-out", it.id));
+    let out_resp = widgets::dropdown(ui, odd, "", &t, oid);
+    a11y::combo_box(
+        &out_resp,
+        tr("Output To:").trim_end_matches(':'),
+        &app.session.resolve_output(it).unwrap_or_else(|| "Not yet specified".into()),
+        !rendering,
+    );
+    if out_resp.clicked() && !rendering {
+        widgets::open_popup(ui, oid);
+    }
+    app.auto.add(&aid("outputTo"), odd, "Output To");
+    let omenu = output_to_menu(it);
+    let olabels: Vec<String> = omenu.iter().map(|(l, _)| l.clone()).collect();
+    if let Some(i) = widgets::popup_menu(ui, oid, odd.left_bottom(), &olabels, None) {
+        if widgets::by_keyboard(ui) {
+            out_resp.request_focus();
+        }
+        if omenu[i].1.get("choose").is_some() {
+            match pick_output(app, it) {
+                Some(Some(path)) => actions.push(("renderQueue.setOutput", json!({"item": it.id, "path": path}))),
+                Some(None) => {}
+                None => *editing = Some((it.id, it.output.output.clone())),
+            }
+        } else {
+            let mut params = omenu[i].1.clone();
+            params["item"] = json!(it.id);
+            actions.push(("renderQueue.setOutput", params));
+        }
+    }
+    let path_rect = Rect::from_min_max(pos2(odd.max.x + 6.0, r.min.y + 2.0), pos2(r.max.x - 8.0, r.max.y - 2.0));
+    if editing.as_ref().is_some_and(|(id, _)| *id == it.id) {
+        let mut buf = editing.as_ref().map(|(_, b)| b.clone()).unwrap_or_default();
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(path_rect));
+        let resp = child.add(egui::TextEdit::singleline(&mut buf).desired_width(path_rect.width()).font(Tokens::ui(11.5)));
+        a11y::text_input(&resp, tr("Output file name template"), &buf);
+        if resp.lost_focus() {
+            if ui.input(|i| i.key_pressed(egui::Key::Enter)) && !buf.trim().is_empty() {
+                actions.push(("renderQueue.setOutput", json!({"item": it.id, "path": buf.trim()})));
+            }
+            *editing = None;
+        } else {
+            widgets::keep_focus(ui.ctx(), &resp, &buf);
+            *editing = Some((it.id, buf));
+        }
+    } else {
+        let shown = app.session.resolve_output(it).unwrap_or_else(|| "Not yet specified".into());
+        let resp = ui.interact(path_rect, egui::Id::unique(("rq-path", it.id)), Sense::click());
+        a11y::button(&resp, &tr_args("Output file: {}", &[&shown]), !rendering);
+        let col = if resp.hovered() { t.accent_hover } else { t.hot_text };
+        lp.with_clip_rect(path_rect.intersect(list)).text(pos2(path_rect.min.x, r.center().y), Align2::LEFT_CENTER, &shown, Tokens::ui(11.5), col);
+        // Clicking the file name opens the save dialog (Output Movie To); Alt-click, or a
+        // host without one, edits the name template in place.
+        let dialog = app.hooks.pick_save_file.is_some();
+        if resp.clicked() && !rendering {
+            let picked = if ui.input(|i| i.modifiers.alt) { None } else { pick_output(app, it) };
+            match picked {
+                Some(Some(path)) => actions.push(("renderQueue.setOutput", json!({"item": it.id, "path": path}))),
+                Some(None) => {}
+                None => *editing = Some((it.id, it.output.output.clone())),
+            }
+        }
+        let how = if dialog { "Click to choose where to save; Alt-click to edit the template" } else { "Click to edit" };
+        resp.on_hover_text(tr_args("Template: {}\n{}", &[&it.output.output, &how]));
+        app.auto.add(&aid("outputPath"), path_rect, &shown);
+    }
+}
+
+/// Delete removes the selected item when the panel has focus (`allowed`: not editing a path and
+/// not rendering).
+fn delete_selected(app: &EffectcraftApp, ui: &egui::Ui, allowed: bool, on_row: bool, selected: &mut Option<u64>, actions: &mut Vec<Action>) {
+    if app.ui.focused == crate::dock::PanelKind::RenderQueue
+        && allowed
+        && let Some(id) = *selected
+        && app.dialog.is_none()
+        && !crate::widgets::any_menu_open(ui.ctx())
+        && ui.input(|i| i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace))
+        // (A focused queue row is not typing; any other focused widget may be.)
+        && (on_row || !ui.ctx().egui_wants_keyboard_input())
+    {
+        actions.push(("renderQueue.remove", json!({"item": id})));
+        *selected = None;
+    }
+}
+
+// Keyboard: Up / Down move between the queued items, Home / End go to the first / last, Right
+// and Left open and close the item's settings, Enter and Space do the same (Space only with a
+// row focused: otherwise it plays the preview). The focus follows the selection.
+///
+/// Returns whether a queue row has keyboard focus.
+fn list_keys(
+    app: &mut EffectcraftApp,
+    ctx: &egui::Context,
+    queue: &[RenderQueueItem],
+    (open, selected): (&mut Vec<u64>, &mut Option<u64>),
+    can_navigate: bool,
+    tops: &[(u64, f32)],
+    list_h: f32,
+) -> bool {
+    let focused = ctx.memory(|m| m.focused());
+    let on_row = focused.is_some_and(|f| queue.iter().any(|i| row_id(i.id) == f));
+    let by_mouse = focused.is_none() && app.ui.focused == crate::dock::PanelKind::RenderQueue;
+    if (on_row || by_mouse) && can_navigate && app.dialog.is_none() && !widgets::any_menu_open(ctx) {
+        let keys: Vec<egui::Key> = ctx.input(|i| {
+            i.events
+                .iter()
+                .filter_map(|e| match e {
+                    egui::Event::Key { key, pressed: true, modifiers, .. } if !modifiers.any() => Some(*key),
+                    _ => None,
+                })
+                .collect()
+        });
+        let mut moved = None;
+        for key in keys {
+            use egui::Key;
+            let at = (*selected).and_then(|s| queue.iter().position(|i| i.id == s));
+            let Some(last) = queue.len().checked_sub(1) else { break };
+            let to = match key {
+                Key::ArrowDown => Some(at.map_or(0, |a| a.saturating_add(1).min(last))),
+                Key::ArrowUp => Some(at.map_or(last, |a| a.saturating_sub(1))),
+                Key::Home if on_row => Some(0),
+                Key::End if on_row => Some(last),
+                _ => None,
+            };
+            if let Some(item) = to.and_then(|to| queue.get(to)) {
+                *selected = Some(item.id);
+                moved = Some(item.id);
+                continue;
+            }
+            let Some(item) = (*selected).filter(|s| queue.iter().any(|i| i.id == *s)) else { continue };
+            match key {
+                Key::ArrowRight if !open.contains(&item) => open.push(item),
+                Key::ArrowLeft => open.retain(|i| *i != item),
+                Key::Enter | Key::Space if on_row || key == Key::Enter => {
+                    if open.contains(&item) {
+                        open.retain(|i| *i != item);
+                    } else {
+                        open.push(item);
+                    }
+                }
+                _ => {}
+            }
+        }
+        if let Some(item) = moved {
+            if let Some((_, top)) = tops.iter().find(|(id, _)| *id == item) {
+                widgets::PanelScroll::reveal(ctx, egui::Id::unique("rq-scroll"), *top, *top + ROW_H, list_h);
+            }
+            app.ui.focused = crate::dock::PanelKind::RenderQueue;
+            if on_row {
+                a11y::focus_next_pass(ctx, "rq", row_id(item));
+            }
+            ctx.request_repaint();
+        }
+        // The arrows are the queue's, not egui's spatial focus moves.
+        if on_row {
+            ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
+        }
+    }
+    on_row
+}
+
+/// An item's Status cell: its state, or the percentage while it is the one rendering.
+fn status_text(it: &RenderQueueItem, progress: Option<&effectcraft_engine::render_queue::JobState>, rendering: bool) -> String {
+    match progress.filter(|p| rendering && p.current == Some(it.id)) {
+        Some(pr) => format!("Rendering {:.0}%", if pr.total > 0 { pr.done as f64 * 100.0 / pr.total as f64 } else { 0.0 }),
+        None => it.status.label().to_string(),
+    }
+}
+
+/// An item's Render Time cell: the running time while it renders, else its last render time.
+fn render_time_text(it: &RenderQueueItem, progress: Option<&effectcraft_engine::render_queue::JobState>, rendering: bool) -> String {
+    match progress.filter(|p| rendering && p.current == Some(it.id)) {
+        Some(p) => hms(p.item_elapsed),
+        None => it.render_time.map(|s| if s < 60.0 { format!("{s:.1} s") } else { hms(s) }).unwrap_or_else(|| "-".into()),
+    }
+}
+
+/// The Render Queue panel: the Current Render strip (elapsed and remaining time, Render/Stop and
+/// Notify, plus the progress bar), the column header, the queued items with their output template,
+/// status and timings, and the footer totals. Comps dragged from the Project are queued on
+/// release. The open items and the selected item are kept in egui temp data; output-template forms
+/// open through a small form, and every change runs a `renderQueue.*` command.
+pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let p = ui.painter().with_clip_rect(rect);
+    let queue: Vec<RenderQueueItem> = app.session.project.render_queue.clone();
+    let progress = app.session.render_progress();
+    let rendering = app.session.is_rendering();
+    let available = app.session.exporter.as_ref().map(|e| e.formats()).unwrap_or_default();
+    let mut actions: Vec<Action> = Vec::new();
+    let rq = RqView { queue: &queue, progress: progress.as_ref(), rendering, available: &available };
+    app.auto.add("renderQueue.drop", rect, "Drop compositions to queue");
+    queue_drop(app, ui, rect, &p, rendering, &mut actions);
+    let mut forms: Vec<(RenderQueueItem, String)> = Vec::new();
+    let state_id = egui::Id::unique("rq-ui");
+    let (mut open, mut selected): (Vec<u64>, Option<u64>) = ui.data(|d| d.get_temp(state_id).unwrap_or_default());
+
+    // ---------------------------------------------------------- Current Render strip
+    let top = Rect::from_min_size(rect.min, vec2(rect.width(), TOP_H));
+    p.rect_filled(top, 0.0, t.tl_ruler_bg);
+    current_render_strip(app, ui, &p, top, &rq, &mut actions);
 
     // ---------------------------------------------------------- column header
     let head = Rect::from_min_size(pos2(rect.min.x, top.max.y), vec2(rect.width(), HEAD_H));
+    // (The scroll begins here for the columns: they line up with the items, clear of its bar.)
+    let list = Rect::from_min_max(pos2(rect.min.x, head.max.y), pos2(rect.max.x, rect.max.y - FOOT_H));
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("rq-scroll"), list);
+    let list = scroll.content;
     p.rect_filled(head, 0.0, t.panel_bg);
     p.line_segment([head.left_bottom(), head.right_bottom()], Stroke::new(1.0, t.separator));
     // Columns: twirl | Render | label | # | Comp Name | Status | Started | Render Time
@@ -512,7 +887,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let w_time = 92.0;
     let w_started = 156.0;
     let w_status = 112.0;
-    let cx_time = (rect.max.x - w_time).max(cx_name + 120.0);
+    let cx_time = (list.max.x - w_time).max(cx_name + 120.0);
     let cx_started = cx_time - w_started;
     let cx_status = cx_started - w_status;
     let hy = head.center().y;
@@ -524,17 +899,15 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 
     // ---------------------------------------------------------- items
-    let list = Rect::from_min_max(pos2(rect.min.x, head.max.y), pos2(rect.max.x, rect.max.y - FOOT_H));
     let lp = p.with_clip_rect(list);
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("rq-scroll"), list);
-    // Items scroll under the header and footer: clip their widgets (and hit tests) to the list.
-    let panel_clip = ui.clip_rect();
-    ui.set_clip_rect(list.intersect(panel_clip));
     let mut y = list.min.y - scroll.offset;
     if queue.is_empty() {
         lp.text(pos2(list.center().x, list.min.y + 30.0), Align2::CENTER_CENTER, tr("The render queue is empty."), Tokens::ui(12.0), t.text_faint);
     }
-    let editing_id = egui::Id::new("rq-edit-output");
+    let ctx = ui.ctx().clone();
+    // Where each item's row starts in the scrolled content, for the keys.
+    let mut tops: Vec<(u64, f32)> = Vec::new();
+    let editing_id = egui::Id::unique("rq-edit-output");
     let mut editing: Option<(u64, String)> = ui.data(|d| d.get_temp(editing_id));
     for (k, it) in queue.iter().enumerate() {
         let n = k + 1;
@@ -553,34 +926,27 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 t.row_alt
             },
         );
-        let row_resp = ui.interact(row, egui::Id::new(("rq-row", it.id)), Sense::click());
-        if row_resp.clicked() {
+        let row_resp = ui.interact(row, row_id(it.id), Sense::click());
+        tops.push((it.id, row.min.y - list.min.y + scroll.offset));
+        if a11y::take_pending_focus(&ctx, "rq", row_resp.id) {
+            row_resp.request_focus();
+        }
+        if row_resp.clicked() || row_resp.gained_focus() {
             selected = Some(it.id);
             app.ui.focused = crate::dock::PanelKind::RenderQueue;
         }
-        let item_id = it.id;
-        crate::widgets::context_menu(&row_resp, |ui| {
-            if ui.button(tr("Duplicate")).clicked() {
-                actions.push(("renderQueue.duplicate", json!({"item": item_id})));
-                ui.close();
-            }
-            if ui.button(tr("Remove")).clicked() {
-                actions.push(("renderQueue.remove", json!({"item": item_id})));
-                ui.close();
-            }
-            if k > 0 && ui.button(tr("Move Up")).clicked() {
-                actions.push(("renderQueue.move", json!({"item": item_id, "to": n - 1})));
-                ui.close();
-            }
-            if n < queue.len() && ui.button(tr("Move Down")).clicked() {
-                actions.push(("renderQueue.move", json!({"item": item_id, "to": n + 1})));
-                ui.close();
-            }
-        });
+        if row_resp.has_focus() {
+            lp.rect_stroke(row.shrink(0.5), 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
+        }
+        let comp_item = app.session.project.item(it.comp);
+        let name = comp_item.map(|i| i.name.clone()).unwrap_or_else(|| "(missing composition)".into());
+        crate::widgets::context_menu(&row_resp, |ui| row_menu(ui, &mut actions, it.id, k, queue.len()));
         app.auto.add(&aid("row"), row, &format!("#{n}"));
         let is_open = open.contains(&it.id);
         let tw = Rect::from_center_size(pos2(cx_twirl + 8.0, row.center().y), vec2(14.0, 14.0));
-        if widgets::twirl(ui, tw, is_open, egui::Id::new(("rq-twirl", it.id)), &t).clicked() {
+        let tw_resp = widgets::twirl(ui, tw, is_open, egui::Id::unique(("rq-twirl", it.id)), &t);
+        a11y::disclosure(&tw_resp, &tr_args(if is_open { "Hide details of {}" } else { "Show details of {}" }, &[&name]), is_open);
+        if tw_resp.clicked() {
             if is_open {
                 open.retain(|i| *i != it.id);
             } else {
@@ -589,37 +955,27 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         app.auto.add(&aid("twirl"), tw, "Twirl");
         let cb = Rect::from_center_size(pos2(cx_render + 20.0, row.center().y), vec2(18.0, 18.0));
-        if widgets::checkbox(ui, cb, it.render, &t, egui::Id::new(("rq-cb", it.id))).clicked() && !rendering {
+        let cb_resp = ui.add_enabled_ui(!rendering, |ui| widgets::checkbox(ui, cb, it.render, &t, egui::Id::unique(("rq-cb", it.id)))).inner;
+        a11y::check_box(&cb_resp, &format!("{}: {name}", tr("Render")), it.render, !rendering);
+        if cb_resp.changed() && !rendering {
             actions.push(("renderQueue.setRender", json!({"item": it.id, "render": !it.render})));
         }
         app.auto.add(&aid("render"), cb, if it.render { "Render: on" } else { "Render: off" });
-        let comp_item = app.session.project.item(it.comp);
         let label_col = comp_item.map(|i| t.label(i.label)).unwrap_or(t.text_faint);
         lp.rect_filled(Rect::from_center_size(pos2(cx_label + 6.0, row.center().y), vec2(10.0, 10.0)), 2.0, label_col);
         lp.text(pos2(cx_num + 2.0, row.center().y), Align2::LEFT_CENTER, n.to_string(), Tokens::ui(12.0), t.text_dim);
-        let name = comp_item.map(|i| i.name.clone()).unwrap_or_else(|| "(missing composition)".into());
         lp.text(pos2(cx_name + 2.0, row.center().y), Align2::LEFT_CENTER, &name, Tokens::ui(12.0), t.text);
-        let status = if rendering && let Some(pr) = progress.as_ref().filter(|p| p.current == Some(it.id)) {
-            format!("Rendering {:.0}%", if pr.total > 0 { pr.done as f64 * 100.0 / pr.total as f64 } else { 0.0 })
-        } else {
-            it.status.label().to_string()
-        };
+        let status = status_text(it, progress.as_ref(), rendering);
         let st_rect = Rect::from_min_size(pos2(cx_status, row.min.y), vec2(w_status, ROW_H));
         lp.text(pos2(cx_status + 2.0, row.center().y), Align2::LEFT_CENTER, &status, Tokens::ui(12.0), status_color(&t, &it.status));
         if let RenderStatus::Failed(e) = &it.status {
-            ui.interact(st_rect, egui::Id::new(("rq-st", it.id)), Sense::hover()).on_hover_text(e);
+            ui.interact(st_rect, egui::Id::unique(("rq-st", it.id)), Sense::hover()).on_hover_text(e);
         }
         app.auto.add(&aid("status"), st_rect, &status);
-        if let Some(s) = it.started {
-            lp.text(pos2(cx_started + 2.0, row.center().y), Align2::LEFT_CENTER, utc_stamp(s), Tokens::ui(11.5), t.text_dim);
-        } else {
-            lp.text(pos2(cx_started + 2.0, row.center().y), Align2::LEFT_CENTER, "-", Tokens::ui(11.5), t.text_faint);
-        }
-        let rt = if progress.as_ref().and_then(|p| p.current) == Some(it.id) && rendering {
-            progress.as_ref().map(|p| hms(p.item_elapsed)).unwrap_or_default()
-        } else {
-            it.render_time.map(|s| if s < 60.0 { format!("{s:.1} s") } else { hms(s) }).unwrap_or_else(|| "-".into())
-        };
+        a11y::tree_item(&row_resp, &format!("{n}. {name}, {status}"), is_sel, 1, Some(is_open));
+        let (started, started_col) = it.started.map_or(("-".to_string(), t.text_faint), |s| (utc_stamp(s), t.text_dim));
+        lp.text(pos2(cx_started + 2.0, row.center().y), Align2::LEFT_CENTER, started, Tokens::ui(11.5), started_col);
+        let rt = render_time_text(it, progress.as_ref(), rendering);
         lp.text(pos2(cx_time + 2.0, row.center().y), Align2::LEFT_CENTER, rt, Tokens::ui(11.5), t.text_dim);
 
         if !is_open {
@@ -639,13 +995,18 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             };
             lp.text(pos2(cx_num - 6.0, r.center().y), Align2::LEFT_CENTER, label, Tokens::ui(11.5), t.text_dim);
             let dd = Rect::from_min_size(pos2(ix + 70.0, r.min.y + 3.0), vec2(220.0, ROW_H - 6.0));
-            let did = egui::Id::new(("rq-dd", it.id, sub));
+            let did = egui::Id::unique(("rq-dd", it.id, sub));
             let shown: String = if summary.chars().count() > 31 { summary.chars().take(30).chain(std::iter::once('…')).collect() } else { summary.clone() };
-            if widgets::dropdown(ui, dd, &shown, &t, did).clicked() && !rendering {
+            let dd_resp = widgets::dropdown(ui, dd, &shown, &t, did);
+            a11y::combo_box(&dd_resp, label.trim_end_matches(':'), &summary, !rendering);
+            if dd_resp.clicked() && !rendering {
                 widgets::open_popup(ui, did);
             }
             let labels: Vec<String> = menu.iter().map(|(l, _)| l.clone()).collect();
             if let Some(i) = widgets::popup_menu(ui, did, dd.left_bottom(), &labels, None) {
+                if widgets::by_keyboard(ui) {
+                    dd_resp.request_focus();
+                }
                 let mut params = menu[i].1.clone();
                 if let Some(f) = params.get("form").and_then(Value::as_str) {
                     forms.push((it.clone(), f.to_string()));
@@ -669,81 +1030,12 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     );
                     lp.text(pos2(dd.max.x + 14.0, r.center().y), Align2::LEFT_CENTER, info, Tokens::ui(11.0), t.text_faint);
                 }
-                // Log: Errors Only / Plus Settings / Plus Per Frame Info.
-                let ld = Rect::from_min_size(pos2(r.max.x - 190.0, r.min.y + 3.0), vec2(150.0, ROW_H - 6.0));
-                lp.text(pos2(ld.min.x - 6.0, r.center().y), Align2::RIGHT_CENTER, tr("Log:"), Tokens::ui(11.5), t.text_dim);
-                let lid = egui::Id::new(("rq-log", it.id));
-                if widgets::dropdown(ui, ld, it.log.label(), &t, lid).clicked() && !rendering {
-                    widgets::open_popup(ui, lid);
-                }
-                let llabels: Vec<String> = RenderLog::ALL.iter().map(|l| mark(it.log == *l, l.label())).collect();
-                if let Some(i) = widgets::popup_menu(ui, lid, ld.left_bottom(), &llabels, None) {
-                    actions.push(("renderQueue.setLog", json!({"item": it.id, "log": RenderLog::ALL[i].label()})));
-                }
-                app.auto.add(&aid("log"), ld, it.log.label());
+                log_dropdown(app, ui, &ItemRow { lp: &lp, list, r, n, rendering }, it, &mut actions);
                 continue;
             }
-            // Output To.
-            let ox = dd.max.x + 14.0;
-            lp.text(pos2(ox, r.center().y), Align2::LEFT_CENTER, tr("Output To:"), Tokens::ui(11.5), t.text_dim);
-            let odd = Rect::from_min_size(pos2(ox + 62.0, r.min.y + 3.0), vec2(22.0, ROW_H - 6.0));
-            let oid = egui::Id::new(("rq-out", it.id));
-            if widgets::dropdown(ui, odd, "", &t, oid).clicked() && !rendering {
-                widgets::open_popup(ui, oid);
-            }
-            app.auto.add(&aid("outputTo"), odd, "Output To");
-            let omenu = output_to_menu(it);
-            let olabels: Vec<String> = omenu.iter().map(|(l, _)| l.clone()).collect();
-            if let Some(i) = widgets::popup_menu(ui, oid, odd.left_bottom(), &olabels, None) {
-                if omenu[i].1.get("choose").is_some() {
-                    match pick_output(app, it) {
-                        Some(Some(path)) => actions.push(("renderQueue.setOutput", json!({"item": it.id, "path": path}))),
-                        Some(None) => {}
-                        None => editing = Some((it.id, it.output.output.clone())),
-                    }
-                } else {
-                    let mut params = omenu[i].1.clone();
-                    params["item"] = json!(it.id);
-                    actions.push(("renderQueue.setOutput", params));
-                }
-            }
-            let path_rect = Rect::from_min_max(pos2(odd.max.x + 6.0, r.min.y + 2.0), pos2(r.max.x - 8.0, r.max.y - 2.0));
-            if editing.as_ref().is_some_and(|(id, _)| *id == it.id) {
-                let mut buf = editing.as_ref().map(|(_, b)| b.clone()).unwrap_or_default();
-                let mut child = ui.new_child(egui::UiBuilder::new().max_rect(path_rect));
-                let resp = child.add(egui::TextEdit::singleline(&mut buf).desired_width(path_rect.width()).font(Tokens::ui(11.5)));
-                if resp.lost_focus() {
-                    if ui.input(|i| i.key_pressed(egui::Key::Enter)) && !buf.trim().is_empty() {
-                        actions.push(("renderQueue.setOutput", json!({"item": it.id, "path": buf.trim()})));
-                    }
-                    editing = None;
-                } else {
-                    widgets::keep_focus(ui.ctx(), &resp, &buf);
-                    editing = Some((it.id, buf));
-                }
-            } else {
-                let shown = app.session.resolve_output(it).unwrap_or_else(|| "Not yet specified".into());
-                let resp = ui.interact(path_rect, egui::Id::new(("rq-path", it.id)), Sense::click());
-                let col = if resp.hovered() { t.accent_hover } else { t.hot_text };
-                lp.with_clip_rect(path_rect.intersect(list)).text(pos2(path_rect.min.x, r.center().y), Align2::LEFT_CENTER, &shown, Tokens::ui(11.5), col);
-                // Clicking the file name opens the save dialog (Output Movie To); Alt-click, or a
-                // host without one, edits the name template in place.
-                let dialog = app.hooks.pick_save_file.is_some();
-                if resp.clicked() && !rendering {
-                    let picked = if ui.input(|i| i.modifiers.alt) { None } else { pick_output(app, it) };
-                    match picked {
-                        Some(Some(path)) => actions.push(("renderQueue.setOutput", json!({"item": it.id, "path": path}))),
-                        Some(None) => {}
-                        None => editing = Some((it.id, it.output.output.clone())),
-                    }
-                }
-                let how = if dialog { "Click to choose where to save; Alt-click to edit the template" } else { "Click to edit" };
-                resp.on_hover_text(tr_args("Template: {}\n{}", &[&it.output.output, &how]));
-                app.auto.add(&aid("outputPath"), path_rect, &shown);
-            }
+            output_to(app, ui, &ItemRow { lp: &lp, list, r, n, rendering }, it, dd.max.x, &mut editing, &mut actions);
         }
     }
-    ui.set_clip_rect(panel_clip);
     let content = y + scroll.offset - list.min.y;
     scroll.end(ui, &mut app.auto, "renderQueue.scroll", content, &t);
     ui.data_mut(|d| match &editing {
@@ -753,44 +1045,15 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         None => d.remove::<(u64, String)>(editing_id),
     });
 
-    // Delete removes the selected item when the panel has focus.
-    if app.ui.focused == crate::dock::PanelKind::RenderQueue
-        && editing.is_none()
-        && !rendering
-        && let Some(id) = selected
-        && app.dialog.is_none()
-        && ui.input(|i| i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace))
-        && !ui.ctx().egui_wants_keyboard_input()
-    {
-        actions.push(("renderQueue.remove", json!({"item": id})));
-        selected = None;
-    }
+    let on_row = list_keys(app, &ctx, &queue, (&mut open, &mut selected), editing.is_none(), &tops, list.height());
+
+    delete_selected(app, ui, editing.is_none() && !rendering, on_row, &mut selected, &mut actions);
 
     // ---------------------------------------------------------- footer
-    let foot = Rect::from_min_max(pos2(rect.min.x, rect.max.y - FOOT_H), rect.max);
-    p.rect_filled(foot, 0.0, t.tl_ruler_bg);
-    p.line_segment([foot.left_top(), foot.right_top()], Stroke::new(1.0, t.separator));
-    let msg = match &progress {
-        Some(pr) if rendering => format!("Message: Rendering {} of {}", (pr.items_done + 1).min(pr.items_total), pr.items_total),
-        _ => {
-            let done = queue.iter().filter(|i| i.status == RenderStatus::Done).count();
-            format!("Message: {done} of {} done", queue.len())
-        }
-    };
-    p.text(pos2(foot.min.x + 12.0, foot.center().y), Align2::LEFT_CENTER, msg, Tokens::ui(11.0), t.text_dim);
-    let started = queue.iter().filter(|i| i.started.is_some()).count();
-    let total: f64 = queue.iter().filter_map(|i| i.render_time).sum();
-    p.text(
-        pos2(foot.max.x - 12.0, foot.center().y),
-        Align2::RIGHT_CENTER,
-        format!("Renders Started: {started}     Total Time Elapsed: {}", hms(progress.as_ref().filter(|_| rendering).map(|p| p.elapsed).unwrap_or(total))),
-        Tokens::ui(11.0),
-        t.text_dim,
-    );
+    footer(&p, rect, &rq, &t);
 
     open.retain(|id| queue.iter().any(|i| i.id == *id));
     ui.data_mut(|d| d.insert_temp(state_id, (open, selected)));
-    let ctx = ui.ctx().clone();
     for (it, f) in forms {
         open_menu_form(app, &it, &f);
     }
@@ -807,6 +1070,63 @@ mod tests {
     fn stamps() {
         assert_eq!(super::utc_stamp(0), "1970-01-01 00:00:00");
         assert_eq!(super::utc_stamp(1_700_000_000), "2023-11-14 22:13:20");
+        // Years far outside chrono's own range are preserved (the old hand-rolled conversion kept
+        // them) rather than collapsing to the epoch.
+        assert_eq!(super::utc_stamp(10_000_000_000_000), "318857-05-20 17:46:40");
+        assert_eq!(super::utc_stamp(u64::MAX), "584554051223-11-09 07:00:15");
         assert_eq!(super::hms(3725.4), "1:02:05");
     }
+
+    /// #2593: between progress reports the times count on from the last report, and a new
+    /// report starts the count again.
+    #[test]
+    fn render_times_tick_between_reports() {
+        let ctx = egui::Context::default();
+        let mut pr = effectcraft_engine::render_queue::JobState {
+            current: Some(1),
+            done: 2,
+            total: 10,
+            item_elapsed: 20.0,
+            remaining: Some(80.0),
+            ..Default::default()
+        };
+        assert_eq!(super::live_times(&ctx, &pr, 100.0), (20.0, Some(80.0)));
+        assert_eq!(super::live_times(&ctx, &pr, 103.0), (23.0, Some(77.0)));
+        assert_eq!(super::live_times(&ctx, &pr, 300.0).1, Some(0.0), "never below zero");
+        (pr.done, pr.item_elapsed, pr.remaining) = (3, 31.0, Some(72.0));
+        assert_eq!(super::live_times(&ctx, &pr, 301.0), (31.0, Some(72.0)));
+        pr.finished = true;
+        assert_eq!(super::live_times(&ctx, &pr, 400.0), (31.0, Some(72.0)), "a finished job stands still");
+    }
+
+    /// #2911: an OpenEXR module's menu offers every compression and both bit depths, ticks the
+    /// current ones and marks the methods that are lossy at the current depth; other formats
+    /// don't show them.
+    #[test]
+    fn exr_menu_offers_compression_and_bit_depth() {
+        use effectcraft_engine::project::render_queue::{ExrBitDepth, OutputFormat, OutputModule, RenderQueueItem};
+        use effectcraft_engine::project::{ItemId, render_templates::RenderTemplates};
+        crate::i18n::ui::set_current("en");
+        let mut it = RenderQueueItem::new(1, ItemId(1));
+        it.output = OutputModule::for_format(OutputFormat::ExrSequence);
+        let menu = |it: &RenderQueueItem| super::output_menu(it, &OutputFormat::ALL, &RenderTemplates::default());
+        let find = |m: &[(String, serde_json::Value)], label: &str| m.iter().find(|(l, _)| l.trim_start_matches('✓').trim() == label).cloned();
+        let m = menu(&it);
+        assert_eq!(find(&m, "EXR Compression: ZIP (16 scan lines)").unwrap().0, "✓ EXR Compression: ZIP (16 scan lines)");
+        assert_eq!(find(&m, "EXR Compression: PIZ").unwrap().1, serde_json::json!({"exrCompression": "piz"}));
+        assert!(find(&m, "EXR Compression: PXR24 (lossy)").is_some() && find(&m, "EXR Compression: B44 (uncompressed at float)").is_some());
+        assert_eq!(find(&m, "EXR Compression: ZIPS (1 scan line)").unwrap().1, serde_json::json!({"exrCompression": "zips"}));
+        assert_eq!(find(&m, "EXR Bit Depth: 32-bit Float").unwrap().0, "✓ EXR Bit Depth: 32-bit Float");
+        assert_eq!(find(&m, "EXR Bit Depth: 16-bit Half Float").unwrap().1, serde_json::json!({"exrBitDepth": "half"}));
+        assert_eq!(m.iter().filter(|(l, _)| l.contains("EXR Compression: ")).count(), 10);
+        it.output.exr_bit_depth = ExrBitDepth::Half;
+        let m = menu(&it);
+        assert!(
+            find(&m, "EXR Compression: PXR24").is_some()
+                && find(&m, "EXR Compression: B44 (lossy)").is_some()
+                && find(&m, "EXR Compression: DWAA (lossy)").is_some()
+        );
+        it.output = OutputModule::for_format(OutputFormat::PngSequence);
+        assert!(!menu(&it).iter().any(|(l, _)| l.contains("EXR Compression") || l.contains("EXR Bit Depth")));
+    }
 }
diff --git a/crates/ui-egui/src/panels/roto_tool.rs b/crates/ui-egui/src/panels/roto_tool.rs
index fbd7119c8..c01a8f07e 100644
--- a/crates/ui-egui/src/panels/roto_tool.rs
+++ b/crates/ui-egui/src/panels/roto_tool.rs
@@ -8,7 +8,7 @@ use effectcraft_engine::render::{EvalCtx, RenderOpts, Renderer};
 use egui::{Align2, Color32, Pos2, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
 use serde_json::json;
 
-use crate::i18n::tr;
+use crate::i18n::{tr, tr_args};
 use crate::theme::Tokens;
 use crate::{EffectcraftApp, widgets};
 
@@ -21,6 +21,42 @@ fn roto_group(layer: &Layer) -> Option<&effectcraft_engine::project::PropGroup>
     layer.effects()?.groups().nth(roto_index(layer)?)
 }
 
+/// The colour of object `o`'s outline: object 0 keeps the chosen boundary colour, the others cycle through a palette.
+pub fn object_color(o: u32, base: [f64; 3]) -> Color32 {
+    const PALETTE: [[u8; 3]; 8] =
+        [[60, 200, 255], [255, 170, 40], [150, 230, 60], [180, 110, 255], [255, 225, 60], [40, 210, 170], [255, 90, 80], [90, 130, 255]];
+    if o == 0 {
+        return c32(base, 255);
+    }
+    let [r, g, b] = PALETTE[(o as usize - 1) % PALETTE.len()];
+    Color32::from_rgb(r, g, b)
+}
+
+/// Sample the layer-grid matte at each input pixel centre, including cropping and preview scale.
+fn object_mask_in_input(seg: &fx::FrameSeg, inp: &effectcraft_engine::effects::Buf) -> Vec<bool> {
+    let width = inp.img.width as usize;
+    if width == 0 || !inp.scale.is_finite() || inp.scale <= 0.0 || inp.offset.iter().any(|v| !v.is_finite()) {
+        return vec![false; inp.img.data.len()];
+    }
+    inp.img
+        .data
+        .iter()
+        .enumerate()
+        .map(|(i, _)| {
+            let x = ((i % width) as f64 + 0.5 - inp.offset[0]) / inp.scale;
+            let y = ((i / width) as f64 + 0.5 - inp.offset[1]) / inp.scale;
+            if x < 0.0 || y < 0.0 || x >= seg.w as f64 || y >= seg.h as f64 {
+                return false;
+            }
+            (y.floor() as usize)
+                .checked_mul(seg.w)
+                .and_then(|row| row.checked_add(x.floor() as usize))
+                .and_then(|index| seg.matte.get(index))
+                .is_some_and(|m| *m != 0)
+        })
+        .collect()
+}
+
 /// A stroke being drawn.
 #[derive(Clone, Debug)]
 struct Drag {
@@ -64,12 +100,22 @@ pub fn draw_overlay(
         (scale * 1000.0) as u32,
         format!("{}{:?}{:?}{}", o.view, o.overlay_color, o.boundary_color, o.overlay_opacity),
     );
-    let id = egui::Id::new("roto-overlay");
+    let id = egui::Id::unique("roto-overlay");
     let cached: Option<Overlay> = ctx.data(|d| d.get_temp(id));
     let ov = match cached {
         Some(c) if c.key == key => Some(c),
         _ => {
-            let ectx = EvalCtx { project: &app.session.project, comp_id: cid, comp, time, expr: app.session.expr.as_deref(), footage: None };
+            let ectx = EvalCtx {
+                project: &app.session.project,
+                comp_id: cid,
+                comp,
+                time,
+                expr: app.session.expr.as_deref(),
+                footage: None,
+                property_overrides: &[],
+                media_overrides: &[],
+                reads: None,
+            };
             let mut r = Renderer::new(&app.session.project, &*app.session.footage, RenderOpts { scale, ..Default::default() });
             r.expr = app.session.expr.as_deref();
             r.cache = Some(&app.session.layer_cache);
@@ -85,6 +131,19 @@ pub fn draw_overlay(
             let alpha: Vec<f32> = (0..w * h).map(|i| a_at((i % w) as i64, (i / w) as i64)).collect();
             let inside = |x: i64, y: i64| x >= 0 && y >= 0 && x < w as i64 && y < h as i64 && alpha[y as usize * w + x as usize] >= 0.5;
             let mut px = vec![Color32::TRANSPARENT; w * h];
+            // With several objects the boundary view outlines each in its own colour.
+            let per_object: Vec<(Color32, Vec<bool>)> = match (o.view.as_str(), roto_group(layer)) {
+                ("alphaBoundary", Some(g)) => {
+                    let params = effectcraft_engine::effects::flatten_params(g, &mut |p| p.value.clone());
+                    let size = effectcraft_engine::roto::layer_size(&app.session.project, comp, layer);
+                    let f = fx::frame_of(layer.layer_time(time).seconds(), comp.frame_rate.as_f64());
+                    fx::object_mattes(&params, size, comp.frame_rate.as_f64(), f)
+                        .into_iter()
+                        .map(|(obj, seg)| (object_color(obj, o.boundary_color), object_mask_in_input(&seg, &inp)))
+                        .collect()
+                }
+                _ => vec![],
+            };
             let bc = c32(o.boundary_color, 255);
             let oc = c32(o.overlay_color, (o.overlay_opacity / 100.0 * 255.0).clamp(0.0, 255.0) as u8);
             // View Search Region: the band around the boundary (yellow).
@@ -108,7 +167,30 @@ pub fn draw_overlay(
                         _ => {
                             let me = a >= 0.5;
                             let edge = me && [(-1, 0), (1, 0), (0, -1), (0, 1)].iter().any(|(dx, dy)| !inside(x + dx, y + dy));
-                            if edge { bc } else { Color32::TRANSPARENT }
+                            if per_object.is_empty() {
+                                if edge { bc } else { Color32::TRANSPARENT }
+                            } else {
+                                // the outline of every object whose own matte has an edge here
+                                let inside_of = |m: &Vec<bool>, x: i64, y: i64| {
+                                    x >= 0
+                                        && y >= 0
+                                        && x < w as i64
+                                        && y < h as i64
+                                        && (y as usize)
+                                            .checked_mul(w)
+                                            .and_then(|row| row.checked_add(x as usize))
+                                            .and_then(|index| m.get(index))
+                                            .copied()
+                                            .unwrap_or(false)
+                                };
+                                per_object
+                                    .iter()
+                                    .rev()
+                                    .find(|(_, m)| {
+                                        inside_of(m, x, y) && [(-1, 0), (1, 0), (0, -1), (0, 1)].iter().any(|(dx, dy)| !inside_of(m, x + dx, y + dy))
+                                    })
+                                    .map_or(Color32::TRANSPARENT, |(c, _)| *c)
+                            }
                         }
                     };
                     if let Some((sd, r)) = &search {
@@ -135,21 +217,19 @@ pub fn draw_overlay(
     }
 }
 
+/// The layer <-> screen mappings [`interact`] works with.
+pub struct LayerXform<'a> {
+    pub to_screen: &'a dyn Fn([f64; 2]) -> Pos2,
+    pub to_layer: &'a dyn Fn(Pos2) -> [f64; 2],
+}
+
 /// Pointer handling for the Roto Brush / Refine Edge tools. Returns true when it handled input.
-pub fn interact(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    painter: &egui::Painter,
-    area: Rect,
-    layer: &Layer,
-    zoom: f64,
-    to_screen: &dyn Fn([f64; 2]) -> Pos2,
-    to_layer: &dyn Fn(Pos2) -> [f64; 2],
-) -> bool {
+pub fn interact(app: &mut EffectcraftApp, ui: &mut egui::Ui, painter: &egui::Painter, area: Rect, layer: &Layer, zoom: f64, xf: LayerXform) -> bool {
+    let LayerXform { to_screen, to_layer } = xf;
     let ctx = ui.ctx().clone();
     let mods = ui.input(|i| i.modifiers);
     let Some(kind) = app.ui.tool.roto_kind(mods.alt) else { return false };
-    let resp = ui.interact(area, egui::Id::new("layer-panel-roto"), Sense::click_and_drag());
+    let resp = ui.interact(area, egui::Id::unique("layer-panel-roto"), Sense::click_and_drag());
     let o = app.session.state.roto.clone();
     let refine = kind.starts_with("refine");
     let dia = if refine { o.refine_diameter } else { o.diameter };
@@ -170,7 +250,7 @@ pub fn interact(
     }
     // ⌘/Ctrl-drag resizes the brush (After Effects): the circle stays at the press point and its
     // edge follows the pointer. No stroke is painted.
-    let rid = egui::Id::new("layer-panel-roto-resize");
+    let rid = egui::Id::unique("layer-panel-roto-resize");
     if resp.drag_started()
         && mods.command
         && let Some(pos) = ui.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
@@ -194,7 +274,7 @@ pub fn interact(
         }
         return true;
     }
-    let did = egui::Id::new("layer-panel-roto-drag");
+    let did = egui::Id::unique("layer-panel-roto-drag");
     if resp.drag_started()
         && let Some(pos) = ui.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
     {
@@ -236,6 +316,20 @@ fn run_stroke(app: &mut EffectcraftApp, layer: u64, kind: &str, points: &[[f64;
     }
 }
 
+/// The span bar's colour for a frame a tracker followed: green when it is sure, amber when it is
+/// doubtful, red when it is not, slate when the object was absent.
+pub(crate) fn trust_color(confidence: f32, occluded: bool) -> Color32 {
+    if occluded {
+        Color32::from_rgb(110, 118, 150)
+    } else if confidence >= 0.85 {
+        Color32::from_rgb(70, 200, 90)
+    } else if confidence >= 0.5 {
+        Color32::from_rgb(230, 180, 50)
+    } else {
+        Color32::from_rgb(220, 70, 60)
+    }
+}
+
 /// The segmentation span bar (above the panel's bottom bar): the layer's frames, the span, the
 /// base frame (yellow), computed frames (green) and stroke frames. Click to go to a frame; drag
 /// the span's ends to change it.
@@ -257,10 +351,17 @@ pub fn span_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
         let sp = Rect::from_min_max(pos2(x_of(d.span[0] as f64), track.min.y), pos2(x_of(d.span[1] as f64 + 1.0), track.max.y));
         let frozen = fx::is_frozen(&params);
         p.rect_filled(sp, 2.0, if frozen { Color32::from_rgb(60, 110, 190) } else { Color32::from_rgb(90, 90, 96) });
+        // Computed frames: green, or (frames a tracker followed) coloured by its confidence, with
+        // frames where the object was absent in slate.
+        let trust = app.session.roto_trust(cid, layer.id, uid);
         for (f, done) in app.session.roto_computed(cid, layer.id, uid) {
             if done {
-                let cr = Rect::from_min_max(pos2(x_of(f as f64), track.max.y - 4.0), pos2(x_of(f as f64 + 1.0), track.max.y));
-                p.rect_filled(cr, 0.0, Color32::from_rgb(70, 200, 90));
+                let (color, h) = match trust.get(&f) {
+                    Some(t) => (trust_color(t.confidence, t.occluded), 6.0),
+                    None => (Color32::from_rgb(70, 200, 90), 4.0),
+                };
+                let cr = Rect::from_min_max(pos2(x_of(f as f64), track.max.y - h), pos2(x_of(f as f64 + 1.0), track.max.y));
+                p.rect_filled(cr, 0.0, color);
             }
         }
         for f in d.stroke_frames() {
@@ -277,8 +378,8 @@ pub fn span_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter,
     p.line_segment([pos2(cx, r.min.y), pos2(cx, r.max.y)], Stroke::new(1.0, t.timecode));
     p.rect_stroke(track, 2.0, Stroke::new(1.0, Color32::from_black_alpha(140)), StrokeKind::Outside);
     app.auto.add("layerPanel.rotoSpan", track, "Segmentation span");
-    let resp = ui.interact(track, egui::Id::new("roto-span-bar"), Sense::click_and_drag());
-    let hid = egui::Id::new("roto-span-handle");
+    let resp = ui.interact(track, egui::Id::unique("roto-span-bar"), Sense::click_and_drag());
+    let hid = egui::Id::unique("roto-span-handle");
     if resp.drag_started()
         && let (Some(pos), Some(_)) = (resp.interact_pointer_pos(), d.base)
     {
@@ -322,7 +423,7 @@ pub fn bar_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
     for (id, label) in [("alpha", tr("Alpha")), ("alphaBoundary", tr("Boundary")), ("alphaOverlay", tr("Overlay"))] {
         let r = Rect::from_min_size(pos2(x, bar.center().y - 10.0), vec2(66.0, 20.0));
         let on = view == id;
-        if widgets::text_button(ui, r, label, on, &t, egui::Id::new(("roto-view", id))).clicked() {
+        if widgets::text_button(ui, r, label, on, &t, egui::Id::unique(("roto-view", id))).clicked() {
             let v = if on { "none" } else { id };
             let _ = app.session.execute("roto.options", json!({"view": v}));
         }
@@ -337,7 +438,7 @@ pub fn bar_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
     x += 8.0;
     let r = Rect::from_min_size(pos2(x, bar.center().y - 10.0), vec2(74.0, 20.0));
     let label = if frozen { tr("Unfreeze") } else { tr("Freeze") };
-    if widgets::text_button(ui, r, label, frozen, &t, egui::Id::new(("roto-freeze", uid))).clicked() {
+    if widgets::text_button(ui, r, label, frozen, &t, egui::Id::unique(("roto-freeze", uid))).clicked() {
         let id = if frozen { "roto.unfreeze" } else { "roto.freeze" };
         if let Err(e) = app.session.execute(id, json!({"layer": layer.id.0, "effect": uid})) {
             app.ui.status = e.to_string();
@@ -345,9 +446,48 @@ pub fn bar_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
     }
     app.auto.add("layerPanel.roto.freeze", r, label);
     x += 80.0;
+    // Objects: strokes belong to the current object; with a tracker each is followed on its own and the mattes are united.
+    let objects = fx::data(&params).objects();
+    let current = app.session.state.roto.object;
+    let known = objects.contains(&current);
+    let r = Rect::from_min_size(pos2(x, bar.center().y - 10.0), vec2(104.0, 20.0));
+    let strokes = fx::data(&params).strokes.iter().filter(|st| st.object == current && st.kind.is_segmentation()).count();
+    let label = if strokes == 0 { tr_args("Object {}", &[&(current + 1)]) } else { tr_args("Object {} ({})", &[&(current + 1), &strokes]) };
+    if widgets::text_button(ui, r, &label, false, &t, egui::Id::unique(("roto-object", uid))).clicked() {
+        // cycle through the objects that have strokes (and the empty one being drawn)
+        let mut all = objects.clone();
+        if !known {
+            all.push(current);
+            all.sort_unstable();
+        }
+        let next = all.iter().copied().find(|o| *o > current).or_else(|| all.first().copied()).unwrap_or(0);
+        let _ = app.session.execute("roto.options", json!({"object": next}));
+    }
+    p.circle_filled(pos2(r.min.x + 9.0, r.center().y), 4.0, object_color(current, app.session.state.roto.boundary_color));
+    app.auto.add("layerPanel.roto.object", r, &label);
+    x += 108.0;
+    let r = Rect::from_min_size(pos2(x, bar.center().y - 10.0), vec2(26.0, 20.0));
+    if widgets::text_button(ui, r, "+", false, &t, egui::Id::unique(("roto-object-new", uid))).clicked() {
+        let next = objects.iter().copied().chain([current]).max().map_or(0, |m| m + 1);
+        let _ = app.session.execute("roto.options", json!({"object": next}));
+    }
+    app.auto.add("layerPanel.roto.newObject", r, "New object");
+    x += 30.0;
+    // remove the current object's strokes (the object stays selected; with none left it is simply empty)
+    if strokes > 0 {
+        let r = Rect::from_min_size(pos2(x, bar.center().y - 10.0), vec2(26.0, 20.0));
+        let c = widgets::text_button(ui, r, "×", false, &t, egui::Id::unique(("roto-object-clear", uid))).on_hover_text(tr("Remove this object's strokes"));
+        if c.clicked()
+            && let Err(e) = app.session.execute("roto.clearStrokes", json!({"layer": layer.id.0, "effect": uid, "object": current}))
+        {
+            app.ui.status = e.to_string();
+        }
+        app.auto.add("layerPanel.roto.clearObject", r, "Remove object strokes");
+        x += 30.0;
+    }
     if running {
         let r = Rect::from_min_size(pos2(x, bar.center().y - 10.0), vec2(60.0, 20.0));
-        if widgets::text_button(ui, r, tr("Stop"), false, &t, egui::Id::new("roto-stop")).clicked() {
+        if widgets::text_button(ui, r, tr("Stop"), false, &t, egui::Id::unique("roto-stop")).clicked() {
             let _ = app.session.execute("roto.cancel", json!({}));
         }
         app.auto.add("layerPanel.roto.stop", r, "Stop");
@@ -356,3 +496,39 @@ pub fn bar_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painte
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn per_object_outlines_follow_cropped_padded_and_scaled_input_coordinates() {
+        use effectcraft_engine::{effects::Buf, raster::Image};
+        let seg = fx::FrameSeg { w: 4, h: 2, matte: vec![0, 0, 255, 255, 0, 0, 255, 255], refine: vec![0; 8], ..Default::default() };
+        for (offset, scale, expected) in [
+            ([-2.0, 0.0], 1.0, vec![true, true]),
+            ([0.0, 0.0], 0.5, vec![false, true]),
+            ([-1.0, 0.0], 0.5, vec![true, false]),
+            ([2.0, 0.0], 1.0, vec![false, false]),
+        ] {
+            let inp = Buf { img: Image::new(2, 1), offset, scale };
+            assert_eq!(object_mask_in_input(&seg, &inp), expected, "offset={offset:?}, scale={scale}");
+        }
+        let inp = Buf { img: Image::new(6, 4), offset: [1.0, 1.0], scale: 1.0 };
+        let expected: Vec<bool> = (0..24).map(|i| matches!((i % 6, i / 6), (3 | 4, 1 | 2))).collect();
+        assert_eq!(object_mask_in_input(&seg, &inp), expected);
+    }
+
+    #[test]
+    fn confidence_colours_run_from_green_to_red_and_absent_is_slate() {
+        let (g, a, r, s) = (trust_color(0.99, false), trust_color(0.6, false), trust_color(0.1, false), trust_color(0.99, true));
+        assert_eq!(g, Color32::from_rgb(70, 200, 90));
+        assert_eq!(a, Color32::from_rgb(230, 180, 50));
+        assert_eq!(r, Color32::from_rgb(220, 70, 60));
+        assert_eq!(s, Color32::from_rgb(110, 118, 150));
+        // the boundaries
+        assert_eq!(trust_color(0.85, false), g);
+        assert_eq!(trust_color(0.5, false), a);
+        assert_eq!(trust_color(f32::NAN, false), r);
+    }
+}
diff --git a/crates/ui-egui/src/panels/rq_templates.rs b/crates/ui-egui/src/panels/rq_templates.rs
index f03771133..93a458aae 100644
--- a/crates/ui-egui/src/panels/rq_templates.rs
+++ b/crates/ui-egui/src/panels/rq_templates.rs
@@ -11,6 +11,7 @@ use effectcraft_engine::project::render_templates::{RenderTemplates, TemplateKin
 use egui::{Color32, vec2};
 use serde_json::{Value, json};
 
+use crate::a11y;
 use crate::theme::Tokens;
 use crate::{Dialog, EffectcraftApp};
 
@@ -21,8 +22,10 @@ struct State {
     new_name: String,
 }
 
+/// The `egui::Id` of the render-settings / output-module template dialog's state ([`State`]):
+/// which kind it edits, the selected template and the name being typed.
 fn state_id() -> egui::Id {
-    egui::Id::new("rq-templates-dialog")
+    egui::Id::unique("rq-templates-dialog")
 }
 
 /// Open the dialog for `kind` (`renderSettings` | `outputModule`).
@@ -58,11 +61,12 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                 ui.label(slot.label());
                 let cur = templates.default_name(k, slot);
                 let mut pick = cur.clone();
-                let r = egui::ComboBox::from_id_salt(("tpl-def", slot.label())).selected_text(&cur).width(300.0).show_ui(ui, |ui| {
+                let r = craft_ui::ComboBox::from_id_salt(("tpl-def", slot.label())).selected_text(&cur).width(300.0).show_ui(ui, |ui| {
                     for n in &list {
                         ui.selectable_value(&mut pick, n.clone(), n);
                     }
                 });
+                a11y::combo_box(&r.response, slot.label(), &cur, true);
                 app.auto.add(&format!("templates.default.{slot:?}"), r.response.rect, &cur);
                 if pick != cur {
                     actions.push(("renderQueue.setTemplateDefault", json!({"kind": kind, "slot": format!("{slot:?}"), "name": pick})));
@@ -75,11 +79,12 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         ui.label(egui::RichText::new(tr("Settings")).font(Tokens::semibold(12.5)).color(t.text));
         ui.horizontal(|ui| {
             ui.label(tr("Settings Name:"));
-            let r = egui::ComboBox::from_id_salt("tpl-select").selected_text(&st.selected).width(300.0).show_ui(ui, |ui| {
+            let r = craft_ui::ComboBox::from_id_salt("tpl-select").selected_text(&st.selected).width(300.0).show_ui(ui, |ui| {
                 for n in &list {
                     ui.selectable_value(&mut st.selected, n.clone(), n);
                 }
             });
+            a11y::combo_box(&r.response, tr("Settings Name:").trim_end_matches(':'), &st.selected, true);
             app.auto.add("templates.select", r.response.rect, &st.selected);
         });
         let builtin = RenderTemplates::is_builtin(k, &st.selected)
@@ -135,6 +140,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         ui.horizontal(|ui| {
             ui.label(tr("New from Render Queue item:"));
             let r = ui.add(egui::TextEdit::singleline(&mut st.new_name).hint_text(tr("template name")).desired_width(180.0));
+            a11y::text_input(&r, tr("template name"), &st.new_name);
             app.auto.add("templates.newName", r.rect, &st.new_name);
             let item = queue.last().map(|i| i.id);
             let ok = item.is_some() && !st.new_name.trim().is_empty();
diff --git a/crates/ui-egui/src/panels/scopes_panel.rs b/crates/ui-egui/src/panels/scopes_panel.rs
index 6665164e2..726639598 100644
--- a/crates/ui-egui/src/panels/scopes_panel.rs
+++ b/crates/ui-egui/src/panels/scopes_panel.rs
@@ -38,6 +38,10 @@ struct Cached {
     tex: Option<egui::TextureHandle>,
 }
 
+/// The Scopes panel: the scope kind, colour standard, 8-bit/Float scale and Clamp Signal controls,
+/// then the chosen scope for the active comp's frame at the current time, cached per revision,
+/// comp, time, settings and plot size (drawn as a texture, or bars for the histogram) over its
+/// graticule. The controls update `app.ui.scopes`; the scope itself is only computed and drawn.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let p = ui.painter().with_clip_rect(rect);
@@ -97,7 +101,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let time = app.session.time();
     let key = (app.session.revision, cid.0, time.0, format!("{}{}{}{}{}x{}", st.scope, st.standard, st.float, st.clamp, o.width, o.height), 0);
     let ctx = ui.ctx().clone();
-    let id = egui::Id::new("scopes-cache");
+    let id = egui::Id::unique("scopes-cache");
     let cached: Option<Cached> = ctx.data(|d| d.get_temp(id));
     let cached = match cached {
         Some(c) if c.key == key => c,
diff --git a/crates/ui-egui/src/panels/script_console.rs b/crates/ui-egui/src/panels/script_console.rs
index 97c30c4c4..7403ca481 100644
--- a/crates/ui-egui/src/panels/script_console.rs
+++ b/crates/ui-egui/src/panels/script_console.rs
@@ -7,8 +7,8 @@ use egui::{Align2, Rect, Sense, pos2, vec2};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 
-use crate::EffectcraftApp;
 use crate::theme::Tokens;
+use crate::{EffectcraftApp, a11y, widgets};
 
 /// One line of console output.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
@@ -74,6 +74,9 @@ pub fn run(app: &mut EffectcraftApp, ctx: &egui::Context) {
     con.input.clear();
 }
 
+/// The Script Console panel: the output log (newest lines at the bottom, coloured by kind), the
+/// multi-line script input and Run/Clear. Run — the button or ⌘/Ctrl+Enter while typing — hands the
+/// input to the script runner; Clear only empties the log. The input text and log are UI state.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let input_h = 86.0;
@@ -99,23 +102,30 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         p.text(
             out_rect.center(),
             Align2::CENTER_CENTER,
-            "JavaScript with the After Effects scripting object model — try app.project.numItems",
+            crate::i18n::tr("JavaScript with the After Effects scripting object model — try app.project.numItems"),
             Tokens::ui(12.0),
             t.text_faint,
         );
     }
     app.auto.add("scriptConsole.output", out_rect, "Script Console output");
+    // The output is painted text; a screen reader gets the same lines (the newest 200) as a log.
+    let tail = app.ui.script_console.log.len().saturating_sub(200);
+    let text: Vec<&str> = app.ui.script_console.log.iter().skip(tail).map(|l| l.text.as_str()).collect();
+    a11y::log(ui, egui::Id::unique("script-console-output"), out_rect, tr("Script Console output"), &text.join("\n"));
     // Input.
     let in_rect = Rect::from_min_size(pos2(rect.min.x + 4.0, out_rect.max.y + 4.0), vec2(rect.width() - 8.0, input_h - 8.0));
     let mut run_now = false;
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(in_rect));
     let te = egui::TextEdit::multiline(&mut app.ui.script_console.input)
-        .id(egui::Id::new("script-console-input"))
+        .id(egui::Id::unique("script-console-input"))
         .font(Tokens::mono(12.0))
         .desired_width(in_rect.width())
         .desired_rows(4)
+        // Tab leaves the field (it would otherwise type a tab character and trap the keyboard).
+        .lock_focus(false)
         .hint_text(tr("Script… (⌘/Ctrl+Enter runs)"));
     let resp = child.add_sized(in_rect.size(), te);
+    a11y::name(&resp, tr("Script… (⌘/Ctrl+Enter runs)"));
     if resp.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter) && i.modifiers.command) {
         run_now = true;
     }
@@ -124,12 +134,16 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let bar = Rect::from_min_size(pos2(rect.min.x, rect.max.y - bar_h), vec2(rect.width(), bar_h));
     let run_r = Rect::from_min_size(pos2(bar.max.x - 64.0, bar.min.y + 2.0), vec2(56.0, 20.0));
     let clear_r = Rect::from_min_size(pos2(bar.max.x - 128.0, bar.min.y + 2.0), vec2(56.0, 20.0));
-    let run_resp = ui.interact(run_r, egui::Id::new("script-console-run"), Sense::click());
+    let run_resp = ui.interact(run_r, egui::Id::unique("script-console-run"), Sense::click());
     p.rect_filled(run_r, 3.0, if run_resp.hovered() { t.accent_hover } else { t.accent });
     p.text(run_r.center(), Align2::CENTER_CENTER, tr("Run"), Tokens::ui(12.0), egui::Color32::WHITE);
-    let clear_resp = ui.interact(clear_r, egui::Id::new("script-console-clear"), Sense::click());
+    let clear_resp = ui.interact(clear_r, egui::Id::unique("script-console-clear"), Sense::click());
     p.rect_stroke(clear_r, 3.0, egui::Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
     p.text(clear_r.center(), Align2::CENTER_CENTER, tr("Clear"), Tokens::ui(12.0), t.text);
+    a11y::button(&run_resp, tr("Run"), !app.ui.script_console.input.trim().is_empty());
+    a11y::button(&clear_resp, tr("Clear"), !app.ui.script_console.log.is_empty());
+    widgets::focus_outline(ui, &run_resp, &t);
+    widgets::focus_outline(ui, &clear_resp, &t);
     app.auto.add("scriptConsole.run", run_r, "Run");
     app.auto.add("scriptConsole.clear", clear_r, "Clear");
     if run_resp.clicked() {
diff --git a/crates/ui-egui/src/panels/scriptui_view.rs b/crates/ui-egui/src/panels/scriptui_view.rs
index f0a3975fc..753b2884e 100644
--- a/crates/ui-egui/src/panels/scriptui_view.rs
+++ b/crates/ui-egui/src/panels/scriptui_view.rs
@@ -15,7 +15,7 @@ use egui::{Align2, Color32, Rect, Sense, Stroke, StrokeKind, UiBuilder, pos2, ve
 use serde_json::{Value, json};
 
 use crate::EffectcraftApp;
-use crate::dock::PanelKind;
+use crate::dock::{PanelKind, WorkspaceExt as _};
 use crate::theme::Tokens;
 
 enum Act {
@@ -26,6 +26,8 @@ enum Act {
     Close(u32),
     /// A mouse event (`scriptui.mouse` parameters without window and widget).
     Mouse(u32, u32, Value),
+    /// A docked panel's new size (`scriptui.resize`).
+    Resize(u32, [f32; 2]),
 }
 
 fn rect_of(origin: egui::Pos2, b: [f64; 4]) -> Rect {
@@ -51,7 +53,7 @@ fn draw_children(app: &mut EffectcraftApp, ui: &mut egui::Ui, origin: egui::Pos2
             let tw = (tab.text.chars().count() as f32 * 7.0 + 20.0).max(48.0);
             let hr = Rect::from_min_size(pos2(x, r.min.y), vec2(tw, 22.0));
             let active = i == w.active_tab;
-            let resp = ui.interact(hr, egui::Id::new(("sui-tab", win, tab.id)), Sense::click());
+            let resp = ui.interact(hr, egui::Id::unique(("sui-tab", win, tab.id)), Sense::click());
             ui.painter().rect_filled(
                 hr,
                 3.0,
@@ -81,12 +83,17 @@ fn draw_children(app: &mut EffectcraftApp, ui: &mut egui::Ui, origin: egui::Pos2
     }
 }
 
+/// Draws ScriptUI widget `w` of window `win` at its bounds offset by `origin`, registering it for
+/// automation, and recurses into containers. Widgets with an `onDraw` handler are painted by the
+/// script (replacing the default look, or on top of it when it called `drawOSControl()`) while
+/// buttons, checkboxes and radios still take clicks. Edits and clicks are appended to `acts` for
+/// [`perform`]; while a field or slider is in use its live value lives in egui temp data.
 fn draw_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, origin: egui::Pos2, win: u32, w: &Widget, acts: &mut Vec<Act>) {
     let t = app.tokens;
     let services = app.session.services.clone();
     let rect = rect_of(origin, w.bounds);
     register(app, win, w, rect);
-    let id = egui::Id::new(("sui", win, w.id));
+    let id = egui::Id::unique(("sui", win, w.id));
     let tip = |r: egui::Response| if w.help_tip.is_empty() { r } else { r.on_hover_text(&w.help_tip) };
     // onDraw: the script paints the control. Without drawOSControl() its paint replaces the
     // default look (buttons and toggles still respond to clicks); with it, it goes on top.
@@ -209,7 +216,7 @@ fn draw_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, origin: egui::Pos2,
             let mut pick: Option<usize> = None;
             ui.add_enabled_ui(w.enabled, |ui| {
                 ui.scope_builder(UiBuilder::new().max_rect(rect), |ui| {
-                    egui::ComboBox::from_id_salt(id).selected_text(cur).width(rect.width() - 8.0).show_ui(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt(id).selected_text(cur).width(rect.width() - 8.0).show_ui(ui, |ui| {
                         for (i, it) in w.items.iter().enumerate() {
                             if it == "-" {
                                 ui.separator();
@@ -256,20 +263,22 @@ fn draw_widget(app: &mut EffectcraftApp, ui: &mut egui::Ui, origin: egui::Pos2,
     }
 }
 
+/// A draw-list colour (`None` is the theme colour). Script colours are display (sRGB) values
+/// in 0..1, as in After Effects, not linear light: `[43/255, 43/255, 43/255, 1]` is RGB 43.
+fn draw_color(c: &Option<[f32; 4]>, theme: Color32) -> Color32 {
+    c.map_or(theme, super::gradient_editor::to_color32)
+}
+
 /// Paint an onDraw draw list in `rect` (control coordinates → screen).
 fn paint_draw(ui: &egui::Ui, rect: Rect, ops: &[DrawOp], t: &Tokens, services: &dyn Services) {
     let p = ui.painter().with_clip_rect(rect.intersect(ui.clip_rect()));
-    let col = |c: &Option<[f32; 4]>, theme: Color32| match c {
-        Some(c) => egui::Rgba::from_rgba_unmultiplied(c[0], c[1], c[2], c[3]).into(),
-        None => theme,
-    };
     let at = |x: f64, y: f64| rect.min + vec2(x as f32, y as f32);
     for op in ops {
         match op {
             DrawOp::Fill { color, path } => {
                 // Any path shape (concave, self-intersecting, with holes): non-zero winding
                 // triangles, not egui's convex-only polygon fill.
-                let c = col(color, t.field_bg);
+                let c = draw_color(color, t.field_bg);
                 let mut mesh = egui::Mesh::default();
                 for tri in PathSeg::fill_triangles(path, 48, false) {
                     let base = mesh.vertices.len() as u32;
@@ -283,14 +292,14 @@ fn paint_draw(ui: &egui::Ui, rect: Rect, ops: &[DrawOp], t: &Tokens, services: &
                 }
             }
             DrawOp::Stroke { color, width, path } => {
-                let s = Stroke::new(*width as f32, col(color, t.text));
+                let s = Stroke::new(*width as f32, draw_color(color, t.text));
                 for (pts, closed) in PathSeg::polylines(path, 48) {
                     let pts: Vec<egui::Pos2> = pts.iter().map(|q| at(q[0], q[1])).collect();
                     p.add(if closed { egui::Shape::closed_line(pts, s) } else { egui::Shape::line(pts, s) });
                 }
             }
             DrawOp::Text { text, color, x, y, size, .. } => {
-                p.text(at(*x, *y), Align2::LEFT_TOP, text, Tokens::ui(*size as f32), col(color, t.text));
+                p.text(at(*x, *y), Align2::LEFT_TOP, text, Tokens::ui(*size as f32), draw_color(color, t.text));
             }
             DrawOp::Image { image, x, y, w, h } => {
                 let tex = image.as_ref().and_then(|i| image_texture(ui.ctx(), i, services));
@@ -316,7 +325,7 @@ fn paint_draw(ui: &egui::Ui, rect: Rect, ops: &[DrawOp], t: &Tokens, services: &
 /// A ScriptUIImage as a texture (decoded once and kept; `None` when it can't be read or
 /// decoded).
 fn image_texture(ctx: &egui::Context, img: &ImageRef, services: &dyn Services) -> Option<egui::TextureHandle> {
-    let id = egui::Id::new(("scriptui-image", img));
+    let id = egui::Id::unique(("scriptui-image", img));
     if let Some(cached) = ctx.data(|d| d.get_temp::<Option<egui::TextureHandle>>(id)) {
         return cached;
     }
@@ -382,13 +391,17 @@ fn wants_mouse(w: &Widget, depth: usize) -> bool {
 /// same control; it replaces the plain click the control reported, so a checkbox toggles once).
 /// Only events a listener wants are sent; none while `active` is false (a modal dialog is up).
 fn mouse_events(ui: &egui::Ui, origin: egui::Pos2, area: Rect, win: u32, root: &Widget, active: bool, acts: &mut Vec<Act>) {
-    let id = egui::Id::new(("sui-mouse", win));
+    let id = egui::Id::unique(("sui-mouse", win));
     if !wants_mouse(root, 0) {
         ui.data_mut(|d| d.remove::<MouseTrack>(id));
         return;
     }
     let mut st: MouseTrack = ui.data(|d| d.get_temp(id)).unwrap_or_default();
-    let (latest, events, mods, time) = ui.input(|i| (i.pointer.latest_pos(), i.events.clone(), i.modifiers, i.time));
+    let (latest, events, mods, time, held) = ui.input(|i| {
+        let held = |b: egui::PointerButton, bit: u8| if i.pointer.button_down(b) { bit } else { 0 };
+        let held = held(egui::PointerButton::Primary, 1) | held(egui::PointerButton::Secondary, 2) | held(egui::PointerButton::Middle, 4);
+        (i.pointer.latest_pos(), i.events.clone(), i.modifiers, i.time, held)
+    });
     let ctx = ui.ctx();
     let layer = ui.layer_id();
     let target = |p: egui::Pos2| -> Option<&Widget> {
@@ -407,7 +420,7 @@ fn mouse_events(ui: &egui::Ui, origin: egui::Pos2, area: Rect, win: u32, root: &
             w.id,
             json!({
                 "type": ty, "x": p.x - at.x, "y": p.y - at.y, "screenX": p.x, "screenY": p.y,
-                "button": button, "detail": detail,
+                "button": button, "buttons": held, "detail": detail,
                 "altKey": mods.alt, "ctrlKey": mods.ctrl, "shiftKey": mods.shift, "metaKey": mods.mac_cmd,
             }),
         ));
@@ -424,10 +437,15 @@ fn mouse_events(ui: &egui::Ui, origin: egui::Pos2, area: Rect, win: u32, root: &
         }
         st.hover = now_id;
     }
-    if let Some((w, p)) = now
-        && st.at != Some(p)
-    {
-        send(w, "mousemove", p, 0, 0, acts);
+    // While a button is held, the control it was pressed on keeps getting the moves, inside or
+    // outside the window, as in After Effects (#2584).
+    let captured = st.down.and_then(|(c, _)| root.find(c));
+    if let Some(p) = latest.filter(|p| st.at != Some(*p)) {
+        match (captured, now) {
+            (Some(c), _) => send(c, "mousemove", p, 0, 0, acts),
+            (None, Some((w, _))) => send(w, "mousemove", p, 0, 0, acts),
+            (None, None) => {}
+        }
     }
     st.at = latest;
     // Presses and releases.
@@ -439,7 +457,9 @@ fn mouse_events(ui: &egui::Ui, origin: egui::Pos2, area: Rect, win: u32, root: &
             egui::PointerButton::Secondary => 2,
             _ => continue,
         };
-        let Some(w) = target(*pos) else {
+        // A release goes to the control the button was pressed on, wherever the pointer is.
+        let pressed_on = st.down.filter(|(_, db)| !*pressed && *db == b).and_then(|(c, _)| root.find(c));
+        let Some(w) = pressed_on.or_else(|| target(*pos)) else {
             if !pressed {
                 st.down = None;
             }
@@ -453,7 +473,8 @@ fn mouse_events(ui: &egui::Ui, origin: egui::Pos2, area: Rect, win: u32, root: &
             send(w, "mousedown", *pos, b, st.clicks, acts);
         } else {
             send(w, "mouseup", *pos, b, st.clicks, acts);
-            if st.down == Some((w.id, b)) && b == 0 && w.enabled && w.mouse.iter().any(|m| m == "click") {
+            let over = target(*pos).is_some_and(|t| t.id == w.id);
+            if over && st.down == Some((w.id, b)) && b == 0 && w.enabled && w.mouse.iter().any(|m| m == "click") {
                 // The click with the pointer's details, after mousedown / mouseup, in place of
                 // the plain click the control reported.
                 acts.retain(|a| !matches!(a, Act::Click(aw, ac) if *aw == win && *ac == w.id));
@@ -471,6 +492,9 @@ fn snug(r: Rect, text: &str) -> Rect {
     Rect::from_min_size(r.min, vec2(w, r.height()))
 }
 
+/// Runs the actions collected while drawing a ScriptUI window as `scriptui.*` commands, in order.
+/// A reply carrying an `error` becomes a toast with the script's message; otherwise a non-empty
+/// `output` becomes the status line (its last line). Command failures also go to `app.ui.status`.
 fn perform(app: &mut EffectcraftApp, ctx: &egui::Context, acts: Vec<Act>) {
     for a in acts {
         let (cmd, p) = match a {
@@ -478,6 +502,7 @@ fn perform(app: &mut EffectcraftApp, ctx: &egui::Context, acts: Vec<Act>) {
             Act::Set(w, id, v) => ("scriptui.set", json!({"window": w, "widget": id, "value": v})),
             Act::Changing(w, id, v) => ("scriptui.set", json!({"window": w, "widget": id, "value": v, "changing": true})),
             Act::Close(w) => ("scriptui.close", json!({"window": w})),
+            Act::Resize(w, [x, y]) => ("scriptui.resize", json!({"window": w, "size": [x, y]})),
             Act::Mouse(w, id, mut v) => {
                 if let Some(o) = v.as_object_mut() {
                     o.insert("window".into(), json!(w));
@@ -490,7 +515,7 @@ fn perform(app: &mut EffectcraftApp, ctx: &egui::Context, acts: Vec<Act>) {
             Ok(r) => {
                 if let Some(e) = r.get("error").filter(|e| !e.is_null()) {
                     let msg = e["message"].as_str().unwrap_or("script error").to_string();
-                    app.toast = Some((msg, ctx.input(|i| i.time)));
+                    app.toast = Some((msg, app.now()));
                 } else if let Some(o) = r["output"].as_str().filter(|o| !o.is_empty()) {
                     app.ui.status = o.lines().last().unwrap_or_default().to_string();
                 }
@@ -512,7 +537,7 @@ pub fn show_windows(app: &mut EffectcraftApp, ctx: &egui::Context) {
     let blocked = windows.iter().any(|w| w.modal);
     if blocked {
         // A modal dialog blocks the app behind it, as in After Effects.
-        let r = egui::Area::new(egui::Id::new("scriptui-modal-block")).order(egui::Order::Middle).fixed_pos(screen.min).show(ctx, |ui| {
+        let r = egui::Area::new(egui::Id::unique("scriptui-modal-block")).order(egui::Order::Middle).fixed_pos(screen.min).show(ctx, |ui| {
             ui.allocate_exact_size(screen.size(), Sense::click_and_drag());
             ui.painter().rect_filled(screen, 0.0, Color32::from_black_alpha(90));
         });
@@ -523,7 +548,7 @@ pub fn show_windows(app: &mut EffectcraftApp, ctx: &egui::Context) {
         let mut open = true;
         let order = if w.modal { egui::Order::Foreground } else { egui::Order::Middle };
         let resp = egui::Window::new(if w.title.is_empty() { &w.script } else { &w.title })
-            .id(egui::Id::new(("scriptui-window", w.id)))
+            .id(egui::Id::unique(("scriptui-window", w.id)))
             .order(order)
             .collapsible(false)
             .resizable(false)
@@ -546,7 +571,7 @@ pub fn show_windows(app: &mut EffectcraftApp, ctx: &egui::Context) {
     perform(app, ctx, acts);
 }
 
-/// A dockable ScriptUI panel's content (Window ▸ <panel>.jsx).
+/// A dockable ScriptUI panel's content (Window ▸ `<panel>.jsx`).
 pub fn panel(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, id: u32) {
     let t = app.tokens;
     let Some(mut w) = app.session.script_ui.window(id).cloned() else {
@@ -560,6 +585,14 @@ pub fn panel(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, id: u32) {
     // A modal script dialog blocks the panels too.
     let modal = app.session.script_ui.windows.iter().any(|w| w.modal);
     let mut acts = vec![];
+    // The script learns its dock's size when it changes (#2585), as After Effects tells a
+    // docked panel: its window takes the size and onResize runs.
+    let dock = [rect.width().round(), rect.height().round()];
+    let told = egui::Id::unique(("scriptui-dock-size", id));
+    if ui.data(|d| d.get_temp::<[f32; 2]>(told)) != Some(dock) && dock[0] >= 1.0 && dock[1] >= 1.0 {
+        ui.data_mut(|d| d.insert_temp(told, dock));
+        acts.push(Act::Resize(id, dock));
+    }
     let content = rect;
     egui::ScrollArea::both().id_salt(("scriptui-panel", id)).max_width(content.width()).max_height(content.height()).show(ui, |ui| {
         let (r, _) = ui.allocate_exact_size(vec2(w.root.bounds[2] as f32, w.root.bounds[3] as f32), Sense::hover());
@@ -579,12 +612,7 @@ pub fn panel_title(app: &EffectcraftApp, id: u32) -> Option<String> {
 /// Close the dock panels whose script window has gone (the script closed it, or a saved
 /// workspace from an earlier run).
 pub fn sync_panels(app: &mut EffectcraftApp) {
-    let mut all = vec![];
-    app.ui.dock.panels(&mut all);
-    for f in &app.ui.floating {
-        all.extend(f.panels.iter().copied());
-    }
-    for p in all {
+    for p in app.ui.dock.panels() {
         if let PanelKind::ScriptPanel(id) = p
             && app.session.script_ui.window(id).is_none()
         {
@@ -592,3 +620,47 @@ pub fn sync_panels(app: &mut EffectcraftApp) {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Script colours are sRGB, not linear: `#2B2B2B` drew as RGB 114 when read as linear light.
+    #[test]
+    fn draw_colours_are_srgb() {
+        let v = 43.0 / 255.0;
+        assert_eq!(draw_color(&Some([v, v, v, 1.0]), Color32::RED), Color32::from_rgb(43, 43, 43));
+        let orange = [242.0 / 255.0, 140.0 / 255.0, 40.0 / 255.0, 1.0];
+        assert_eq!(draw_color(&Some(orange), Color32::RED), Color32::from_rgb(242, 140, 40));
+        assert_eq!(draw_color(&None, Color32::RED), Color32::RED, "no colour is the theme colour");
+    }
+
+    /// fillPath, strokePath and drawString all paint the script's colour as sRGB.
+    #[test]
+    fn paint_draw_paints_srgb_colours() {
+        let v = 43.0 / 255.0;
+        let color = Some([v, v, v, 1.0]);
+        let path = vec![PathSeg::R { x: 0.0, y: 0.0, w: 10.0, h: 10.0 }];
+        let ops = [
+            DrawOp::Fill { color, path: path.clone() },
+            DrawOp::Stroke { color, width: 1.0, path },
+            DrawOp::Text { text: "Hi".into(), color, x: 0.0, y: 0.0, size: 12.0, style: String::new() },
+        ];
+        let t = Tokens::for_kind(crate::theme::ThemeKind::Dark);
+        let mut out = egui::Context::default().run_ui(egui::RawInput::default(), |ui| {
+            paint_draw(ui, Rect::from_min_size(pos2(0.0, 0.0), vec2(50.0, 50.0)), &ops, &t, &effectcraft_engine::FsServices);
+        });
+        out.textures_delta.clear();
+        let want = Color32::from_rgb(43, 43, 43);
+        let (mut fill, mut stroke, mut text) = (false, false, false);
+        for s in out.shapes {
+            match s.shape {
+                egui::Shape::Mesh(m) => fill |= m.vertices.iter().all(|v| v.color == want),
+                egui::Shape::Path(p) => stroke |= matches!(p.stroke.color, egui::epaint::ColorMode::Solid(c) if c == want),
+                egui::Shape::Text(t) => text |= t.fallback_color == want,
+                _ => {}
+            }
+        }
+        assert!(fill && stroke && text, "fill {fill}, stroke {stroke}, text {text}");
+    }
+}
diff --git a/crates/ui-egui/src/panels/settings.rs b/crates/ui-egui/src/panels/settings.rs
index 28a7c0142..cdeb85116 100644
--- a/crates/ui-egui/src/panels/settings.rs
+++ b/crates/ui-egui/src/panels/settings.rs
@@ -5,7 +5,8 @@
 //!
 //! Automation ids: `settings.page.<id>`, `settings.<key>` (e.g. `settings.general.undoLevels`),
 //! `settings.labels.<n>.name` / `.color`, `settings.button.<label>`, `settings.ok`,
-//! `settings.cancel`, `settings.previous`, `settings.next`.
+//! `settings.cancel`, `settings.previous`, `settings.next`, `settings.disk.cacheLimit` (the disk
+//! cache's limit in effect, a label).
 
 use crate::i18n::{tr, tr_args};
 use effectcraft_engine::prefs::{APPEARANCE_MODES, DARK_THEMES, Item, Kind, LIGHT_THEMES, Page, pages};
@@ -13,6 +14,7 @@ use effectcraft_engine::segment::Task;
 use egui::{Color32, RichText, vec2};
 use serde_json::{Value, json};
 
+use crate::a11y;
 use crate::theme::{ThemeKind, Tokens};
 use crate::{Dialog, EffectcraftApp};
 
@@ -72,13 +74,15 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
             Item::Labels => labels_ui(app, ui, cur, acts),
             Item::BrowserStorage => browser_storage_ui(app, ui, t, acts),
             Item::Models(task) => models_ui(app, ui, t, acts, task),
+            Item::PluginLibrary => library_ui(app, ui, t, acts),
             Item::AudioDevices { key } => {
                 let devices: Vec<String> = app.hooks.audio_devices.as_ref().map(|f| f()).unwrap_or_default();
                 let sel = get(key).as_str().unwrap_or("").to_string();
                 ui.horizontal(|ui| {
                     ui.add_sized(vec2(label_w, 18.0), egui::Label::new(tr("Default Output:")));
                     let shown = if sel.is_empty() { tr("System Default").to_string() } else { sel.clone() };
-                    let r = egui::ComboBox::from_id_salt(("settings", key)).selected_text(shown).width(260.0).show_ui(ui, |ui| {
+                    let shown_name = shown.clone();
+                    let r = craft_ui::ComboBox::from_id_salt(("settings", key)).selected_text(shown).width(260.0).show_ui(ui, |ui| {
                         if ui.selectable_label(sel.is_empty(), tr("System Default")).clicked() {
                             acts.push(Act::Set(key.into(), json!("")));
                         }
@@ -88,6 +92,7 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                             }
                         }
                     });
+                    a11y::combo_box(&r.response, tr("Default Output:").trim_end_matches(':'), &shown_name, true);
                     reg(app, &format!("settings.{key}"), &r.response, "Default Output");
                 });
                 if devices.is_empty() {
@@ -103,10 +108,12 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                 let id = format!("settings.{key}");
                 let tip = (!live).then(|| tr("Stored, but not used by EffectCraft yet"));
                 let mut resp: Option<egui::Response> = None;
+                // What the control is set to, for assistive technology.
+                let mut value_text = String::new();
                 match kind {
                     Kind::Bool => {
                         let mut b = v.as_bool().unwrap_or(false);
-                        let r = ui.checkbox(&mut b, tr(label));
+                        let r = crate::widgets::labelled_checkbox(ui, &mut b, tr(label));
                         if r.changed() {
                             acts.push(Act::Set(key.into(), json!(b)));
                         }
@@ -117,15 +124,20 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                             ui.add_sized(vec2(label_w, 18.0), egui::Label::new(format!("{}:", tr(label))).truncate());
                             let r = match kind {
                                 Kind::Int(lo, hi, unit) => {
-                                    let mut x = v.as_i64().unwrap_or(0);
-                                    // A typed number applies once entered: typing 85 into UI Scale
-                                    // doesn't resize the interface to 75 % at its first digit.
+                                    // A dragged value applies on release, and a typed one once
+                                    // entered: UI Scale doesn't resize the interface under the
+                                    // pointer mid-drag (#2582) or at a typed number's first digit.
+                                    let held = egui::Id::unique(("settings-drag", key));
+                                    let mut x = ui.data(|d| d.get_temp::<i64>(held)).unwrap_or_else(|| v.as_i64().unwrap_or(0));
                                     let drag = egui::DragValue::new(&mut x).range(lo..=hi).speed(0.25).update_while_editing(false);
                                     let r = ui.add(crate::widgets::drag_value(drag));
                                     if !unit.is_empty() {
                                         ui.label(RichText::new(tr(unit)).color(t.text_dim));
                                     }
-                                    if r.changed() {
+                                    if r.dragged() {
+                                        ui.data_mut(|d| d.insert_temp(held, x));
+                                    } else if r.changed() || r.drag_stopped() {
+                                        ui.data_mut(|d| d.remove::<i64>(held));
                                         acts.push(Act::Set(key.into(), json!(x)));
                                     }
                                     r
@@ -157,7 +169,8 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                                 Kind::Choice(opts) => {
                                     let curv = v.as_str().map_or_else(|| v.to_string(), str::to_string);
                                     let shown = opts.iter().find(|o| o.1 == curv).map(|o| o.0).unwrap_or(curv.as_str()).to_string();
-                                    egui::ComboBox::from_id_salt(("settings", key))
+                                    value_text = tr(&shown).to_string();
+                                    craft_ui::ComboBox::from_id_salt(("settings", key))
                                         .selected_text(tr(&shown))
                                         .width(220.0)
                                         .show_ui(ui, |ui| {
@@ -172,6 +185,7 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                                 Kind::Text | Kind::Path => {
                                     let mut s = v.as_str().unwrap_or("").to_string();
                                     let r = ui.add(egui::TextEdit::singleline(&mut s).desired_width(if kind == Kind::Path { 230.0 } else { 260.0 }));
+                                    value_text = s.clone();
                                     if r.changed() {
                                         acts.push(Act::Set(key.into(), json!(s)));
                                     }
@@ -189,6 +203,7 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                                     let mut f = c.map(|v| v as f32 / 255.0);
                                     let r = crate::widgets::srgb_color_button(ui, &mut f);
                                     let rgb = if r.changed() { srgb_bytes(f) } else { c };
+                                    value_text = hex(rgb);
                                     ui.label(RichText::new(hex(rgb)).monospace().color(t.text_dim));
                                     if rgb != c {
                                         acts.push(Act::Set(key.into(), json!(hex(rgb))));
@@ -202,6 +217,17 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                         });
                     }
                 }
+                if let Some(r) = &resp {
+                    // The field's label is drawn beside it, not on it: give the control its name.
+                    let name = tr(label);
+                    match kind {
+                        Kind::Bool => {}
+                        Kind::Choice(_) => a11y::combo_box(r, name, &value_text, true),
+                        Kind::Text | Kind::Path => a11y::text_input(r, name, &value_text),
+                        Kind::Color => a11y::name_value(r, name, &value_text),
+                        _ => a11y::name(r, name),
+                    }
+                }
                 if let Some(r) = resp {
                     let r = match tip {
                         Some(tip) => r.on_hover_text(tip),
@@ -209,11 +235,61 @@ fn page_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, page: &Page, cur: &Value
                     };
                     reg(app, &id, &r, label);
                 }
+                if key == "disk.diskCacheMaxGb" {
+                    disk_cache_limit_ui(app, ui, t);
+                }
             }
         }
     }
 }
 
+/// Settings ▸ Disk, under Maximum Disk Cache Size: the limit in effect, and why it is lower when
+/// free disk space holds the cache below the setting (it never fills the disk). Automation id
+/// `settings.disk.cacheLimit`, labelled `limitMb=… maxMb=… reserveMb=… spaceLimited=… writes=…`
+/// (machine-readable, the same in every interface language). Nothing without an open disk cache.
+/// The maximum is the one applied: an edit applies at once (a dragged value on release).
+fn disk_cache_limit_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    let Some(dc) = app.session.disk_cache.clone() else { return };
+    // (atomic reads: drawn every frame)
+    let (max, limit, reserve, writes) = (dc.max_bytes(), dc.limit_bytes(), dc.reserve_bytes(), dc.accepts_writes());
+    let lines = disk_cache_limit_lines(max, limit, reserve, writes);
+    let color = if limit < max { t.warning } else { t.text_dim };
+    let r = ui
+        .vertical(|ui| {
+            for line in &lines {
+                ui.label(RichText::new(line).color(color));
+            }
+        })
+        .response;
+    let label =
+        format!("limitMb={} maxMb={} reserveMb={} spaceLimited={} writes={writes}", limit.min(max) >> 20, max >> 20, reserve.unwrap_or(0) >> 20, limit < max);
+    app.auto.add("settings.disk.cacheLimit", r.rect, &label);
+}
+
+/// The lines [`disk_cache_limit_ui`] shows for a disk cache of `max` bytes (Maximum Disk Cache
+/// Size) whose limit in effect is `limit` bytes, leaving `reserve` bytes of its disk free (when
+/// known), and taking frame and layer writes (`writes`, [`DiskCache::accepts_writes`]).
+///
+/// [`DiskCache::accepts_writes`]: effectcraft_engine::render::disk_cache::DiskCache::accepts_writes
+pub(crate) fn disk_cache_limit_lines(max: u64, limit: u64, reserve: Option<u64>, writes: bool) -> Vec<String> {
+    use effectcraft_engine::render::disk_cache::{MAX_DISK_RESERVE, MIN_DISK_RESERVE};
+    const GB: f64 = (1u64 << 30) as f64;
+    let mut lines = vec![tr_args("Disk cache limit in effect: {} MB", &[&(limit.min(max) >> 20)])];
+    if limit < max {
+        lines.push(match reserve {
+            Some(r) => tr_args("Limited by free disk space: EffectCraft keeps {} GB of this disk free.", &[&format!("{:.1}", r as f64 / GB)]),
+            None => tr_args(
+                "Limited by free disk space: EffectCraft keeps 5% of the disk free (at least {} GB, at most {} GB).",
+                &[&(MIN_DISK_RESERVE >> 30), &(MAX_DISK_RESERVE >> 30)],
+            ),
+        });
+    }
+    if !writes {
+        lines.push(tr("No room left: nothing is written to the disk cache until disk space is freed.").to_string());
+    }
+    lines
+}
+
 /// A small EffectCraft window painted with theme `kind`'s tokens: the Tools bar, the Project
 /// panel, the Composition panel, the Preview and Properties column and the Timeline with its
 /// layer bars.
@@ -302,19 +378,20 @@ fn theme_preview(ui: &mut egui::Ui, kind: ThemeKind, width: f32) {
     painter.line_segment([pos2(cti, graph.top()), pos2(cti, graph.bottom())], egui::Stroke::new(1.0, p.cti));
 }
 
+/// What [`theme_card`] shows: the setting `key`, the translated `title`, whether the family is
+/// `active`, the `cur`rent theme and the `options` (value, label) to pick from.
+struct ThemeFamily<'a> {
+    key: &'a str,
+    title: &'a str,
+    active: bool,
+    cur: &'a str,
+    options: &'a [(&'a str, &'a str)],
+}
+
 /// One theme family's card: its (translated) name, Active when the appearance shows it now, a preview of the
 /// chosen theme and a radio button per theme.
-fn theme_card(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    key: &str,
-    title: &str,
-    active: bool,
-    cur: &str,
-    options: &[(&str, &str)],
-    acts: &mut Vec<Act>,
-) {
+fn theme_card(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, fam: ThemeFamily, acts: &mut Vec<Act>) {
+    let ThemeFamily { key, title, active, cur, options } = fam;
     egui::Frame::new()
         .fill(t.field_bg)
         .stroke(egui::Stroke::new(1.0, if active { t.accent } else { t.field_border }))
@@ -346,7 +423,7 @@ fn theme_card(
                         let favorite = favorites.iter().any(|id| id == value);
                         let tip = tr(if favorite { "Remove from favorites" } else { "Add to favorites" });
                         let r = ui.add_visible(favorite || hovered, egui::Button::new("").min_size(vec2(24.0, 24.0)).frame(false)).on_hover_text(tip);
-                        r.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("{}: {}", tip, tr(label))));
+                        r.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("{}: {}", tip, tr(label))));
                         reg(app, &format!("settings.appearance.favoriteThemes.{value}"), &r, tip);
                         if favorite || hovered {
                             crate::icons::paint(
@@ -378,7 +455,7 @@ fn appearance_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, cur: &Value, t: &T
     ui.horizontal(|ui| {
         ui.add_sized(vec2(250.0, 18.0), egui::Label::new(format!("{}:", tr("Appearance Mode"))).truncate());
         let shown = APPEARANCE_MODES.iter().find(|(_, v)| *v == mode).map_or(mode.as_str(), |(l, _)| *l);
-        let r = egui::ComboBox::from_id_salt(("settings", "appearance.appearanceMode"))
+        let r = craft_ui::ComboBox::from_id_salt(("settings", "appearance.appearanceMode"))
             .selected_text(tr(shown))
             .width(220.0)
             .show_ui(ui, |ui| {
@@ -389,6 +466,7 @@ fn appearance_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, cur: &Value, t: &T
                 }
             })
             .response;
+        a11y::combo_box(&r, tr("Appearance Mode"), tr(shown), true);
         reg(app, "settings.appearance.appearanceMode", &r, "Appearance Mode");
     });
     ui.add_space(6.0);
@@ -396,8 +474,20 @@ fn appearance_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, cur: &Value, t: &T
     let light_active = mode == "light" || (mode == "auto" && system_light == Some(true));
     ui.columns(2, |cols| {
         let [l, d] = cols else { return };
-        theme_card(app, l, t, "appearance.lightTheme", tr("Light Theme"), light_active, &light, LIGHT_THEMES, acts);
-        theme_card(app, d, t, "appearance.darkTheme", tr("Dark Theme"), !light_active, &dark, DARK_THEMES, acts);
+        theme_card(
+            app,
+            l,
+            t,
+            ThemeFamily { key: "appearance.lightTheme", title: tr("Light Theme"), active: light_active, cur: &light, options: LIGHT_THEMES },
+            acts,
+        );
+        theme_card(
+            app,
+            d,
+            t,
+            ThemeFamily { key: "appearance.darkTheme", title: tr("Dark Theme"), active: !light_active, cur: &dark, options: DARK_THEMES },
+            acts,
+        );
     });
     ui.add_space(6.0);
 }
@@ -451,6 +541,9 @@ fn models_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, acts: &mut
                 ui.label(RichText::new(state).color(if active { t.accent } else { t.text_dim }));
             });
             ui.label(RichText::new(m["description"].as_str().unwrap_or_default()).color(t.text_dim));
+            if let Some(hint) = m["hint"].as_str() {
+                ui.label(RichText::new(hint).color(if m["recommended"].as_bool().unwrap_or(false) { t.accent } else { t.text_dim }));
+            }
             if let Some(by) = m["authors"].as_str() {
                 ui.label(RichText::new(format!("By {by}")).color(t.text_dim));
             }
@@ -467,12 +560,19 @@ fn models_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, acts: &mut
                         }
                     }
                 }
+                if let (Some(source), Some(file)) = (m["source"].as_str(), m["sourceFile"].as_str()) {
+                    let response = ui.link(file).on_hover_text(crate::i18n::tr("Source"));
+                    reg(app, &format!("settings.{prefix}.source.{id}"), &response, file);
+                    if response.clicked() {
+                        ui.ctx().open_url(egui::OpenUrl::new_tab(source));
+                    }
+                }
             });
             if classic {
                 return;
             }
             ui.horizontal(|ui| {
-                if !installed && !web {
+                if !installed && !web && m["url"].as_str().is_some_and(|url| !url.is_empty()) {
                     let r = ui.add_enabled(busy.is_none(), egui::Button::new(tr("Download")));
                     reg(app, &format!("settings.{prefix}.download.{id}"), &r, "Download");
                     if r.clicked() {
@@ -513,6 +613,269 @@ fn models_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, acts: &mut
     }
 }
 
+/// Settings ▸ Plug-in Library (`library.*`): search the community catalog, install, update and
+/// remove packages. Automation ids: `settings.library.query`, `settings.library.refresh`,
+/// `settings.library.updateAll`, `settings.library.<install|update|remove>.<package id>`.
+fn library_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, acts: &mut Vec<Act>) {
+    let query = app.dialog_state.library_query.clone();
+    let Ok(info) = app.session.execute("library.list", json!({"query": query})) else { return };
+    if !info["available"].as_bool().unwrap_or(false) {
+        ui.label(RichText::new(tr("The Plug-in Library is available in the desktop app.")).color(t.text_dim));
+        return;
+    }
+    let busy = info["busy"].as_str().map(str::to_string);
+    let packages = info["packages"].as_array().cloned().unwrap_or_default();
+    let has_catalog = info["catalog"].is_string();
+    ui.add_space(6.0);
+    library_toolbar_ui(app, ui, &query, &packages, has_catalog, busy.is_none(), acts);
+    if let Some(when) = info["fetched"].as_str() {
+        let when = when.get(..16).unwrap_or(when).replace('T', " ");
+        ui.label(RichText::new(tr_args("Catalog fetched {} (UTC)", &[&when])).color(t.text_faint));
+    }
+    // A plug-in author's test catalog stays in use until Refresh fetches the community one.
+    if let Some(url) = info["catalog"].as_str().filter(|u| *u != effectcraft_engine::library::CATALOG_URL) {
+        ui.label(RichText::new(tr_args("Test catalog: {} (Refresh returns to the community catalog)", &[&url])).color(t.warning));
+    }
+    if !has_catalog {
+        ui.label(RichText::new(tr("Nothing is downloaded until you fetch the catalog.")).color(t.text_dim));
+    }
+    for p in &packages {
+        ui.add_space(6.0);
+        library_card_ui(app, ui, t, p, busy.is_none(), acts);
+    }
+    if has_catalog && packages.is_empty() {
+        let note = if query.is_empty() { tr("The catalog lists no plug-ins yet.") } else { tr("No plug-ins match the search.") };
+        ui.label(RichText::new(note).color(t.text_dim));
+    }
+    if let Some(b) = &busy {
+        ui.horizontal(|ui| {
+            ui.spinner();
+            ui.label(b);
+        });
+        ui.ctx().request_repaint_after(std::time::Duration::from_millis(250));
+    }
+    if let Some(e) = info["error"].as_str() {
+        ui.label(RichText::new(e).color(t.danger));
+    }
+    if let Some(f) = info["folder"].as_str() {
+        ui.label(RichText::new(tr_args("Plug-ins folder: {}", &[&f])).color(t.text_faint));
+    }
+}
+
+/// The Plug-in Library's search field, Refresh (or Fetch Catalog) and Update All.
+fn library_toolbar_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, query: &str, packages: &[Value], has_catalog: bool, idle: bool, acts: &mut Vec<Act>) {
+    ui.horizontal(|ui| {
+        let mut q = query.to_string();
+        let r = ui.add(egui::TextEdit::singleline(&mut q).hint_text(tr("Search plug-ins and effects")).desired_width(260.0));
+        reg(app, "settings.library.query", &r, "Search");
+        if q != query {
+            app.dialog_state.library_query = q;
+        }
+        let label = if has_catalog { tr("Refresh") } else { tr("Fetch Catalog") };
+        let r = ui.add_enabled(idle, egui::Button::new(label));
+        reg(app, "settings.library.refresh", &r, "Refresh");
+        if r.clicked() {
+            acts.push(Act::Run("library.refresh".into(), json!({})));
+        }
+        let updates = packages.iter().filter(|p| p["updateAvailable"].as_bool().unwrap_or(false)).count();
+        if updates > 0 {
+            let r = ui.add_enabled(idle, egui::Button::new(tr_args("Update All ({})", &[&updates])));
+            reg(app, "settings.library.updateAll", &r, "Update All");
+            if r.clicked() {
+                acts.push(Act::Run("library.update".into(), json!({})));
+            }
+        }
+    });
+}
+
+/// One package of the Plug-in Library (`library.list`'s entry `p`): name, state, details, links,
+/// actions and, when shown, its preview.
+fn library_card_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, p: &Value, idle: bool, acts: &mut Vec<Act>) {
+    let id = p["id"].as_str().unwrap_or_default().to_string();
+    let s = |k: &str| p[k].as_str().unwrap_or_default().to_string();
+    let installed = p["installed"].as_str().map(str::to_string);
+    let (update, restart, newer_app) =
+        (p["updateAvailable"].as_bool().unwrap_or(false), p["restartNeeded"].as_bool().unwrap_or(false), p["needsNewerApp"].as_bool().unwrap_or(false));
+    egui::Frame::new().fill(t.field_bg).corner_radius(6.0).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        ui.horizontal(|ui| {
+            ui.label(RichText::new(s("name")).font(Tokens::semibold(12.5)));
+            if let Some(v) = p["latest"].as_str() {
+                ui.label(RichText::new(v).color(t.text_dim));
+            }
+            let state = match (&installed, restart, update) {
+                (_, true, _) => tr("Restart EffectCraft to finish").to_string(),
+                (Some(v), _, true) => tr_args("Installed {}: update available", &[v]),
+                (Some(v), _, _) => tr_args("Installed {}", &[v]),
+                (None, _, _) if newer_app && p["latest"].is_null() => tr("Needs a newer EffectCraft").to_string(),
+                _ => String::new(),
+            };
+            ui.label(RichText::new(state).color(if installed.is_some() { t.accent } else { t.text_dim }));
+        });
+        if !s("description").is_empty() {
+            ui.label(RichText::new(s("description")).color(t.text_dim));
+        }
+        library_links_ui(app, ui, t, p, &id);
+        let effects: Vec<&str> = p["effects"].as_array().into_iter().flatten().filter_map(Value::as_str).collect();
+        if !effects.is_empty() {
+            ui.label(RichText::new(tr_args("Effects: {}", &[&effects.join(", ")])).color(t.text_faint));
+        }
+        library_actions_ui(app, ui, p, &id, idle, acts);
+        if app.dialog_state.library_preview.as_deref() == Some(id.as_str()) {
+            library_preview_ui(app, ui, t, &id);
+        }
+    });
+}
+
+/// A package's author, licence, size, and links to its source and video.
+fn library_links_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, p: &Value, id: &str) {
+    let s = |k: &str| p[k].as_str().unwrap_or_default().to_string();
+    ui.horizontal_wrapped(|ui| {
+        if !s("author").is_empty() {
+            ui.label(RichText::new(tr_args("By {}", &[&s("author")])).color(t.text_dim));
+        }
+        if !s("license").is_empty() {
+            ui.label(RichText::new(tr_args("Licence: {}", &[&s("license")])).color(t.text_dim));
+        }
+        if let Some(size) = p["size"].as_u64() {
+            ui.label(RichText::new(format!("·  {}", human_bytes(size))).color(t.text_dim));
+        }
+        let repo = s("repo");
+        if repo.starts_with("https://") {
+            let label = if repo.starts_with("https://github.com/") { tr("Open on GitHub") } else { tr("Source") };
+            let r = ui.link(label);
+            reg(app, &format!("settings.library.repo.{id}"), &r, "Source");
+            if r.clicked() {
+                ui.ctx().open_url(egui::OpenUrl::new_tab(repo));
+            }
+        }
+        let video = s("video");
+        if video.starts_with("https://") {
+            let r = ui.link(tr("Watch video"));
+            reg(app, &format!("settings.library.video.{id}"), &r, "Watch video");
+            if r.clicked() {
+                ui.ctx().open_url(egui::OpenUrl::new_tab(video));
+            }
+        }
+    });
+}
+
+/// A package's Preview / Install / Update / Remove buttons.
+fn library_actions_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &Value, id: &str, idle: bool, acts: &mut Vec<Act>) {
+    let installed = p["installed"].is_string();
+    let available = !p["latest"].is_null();
+    let showing = app.dialog_state.library_preview.as_deref() == Some(id);
+    ui.horizontal(|ui| {
+        if available {
+            let r = ui.add_enabled(idle || showing, egui::Button::new(if showing { tr("Hide Preview") } else { tr("Preview") }).selected(showing));
+            reg(app, &format!("settings.library.preview.{id}"), &r, "Preview");
+            if r.clicked() {
+                if showing {
+                    app.dialog_state.library_preview = None;
+                } else {
+                    app.dialog_state.library_preview = Some(id.to_string());
+                    app.dialog_state.library_split = 0.5;
+                    acts.push(Act::Run("library.preview".into(), json!({"id": id})));
+                }
+            }
+        }
+        let buttons = [
+            (!installed && available, tr("Install"), "Install", "install", "library.install"),
+            (p["updateAvailable"].as_bool().unwrap_or(false), tr("Update"), "Update", "update", "library.update"),
+            (installed, tr("Remove"), "Remove", "remove", "library.uninstall"),
+        ];
+        for (shown, label, name, key, command) in buttons {
+            if !shown {
+                continue;
+            }
+            let r = ui.add_enabled(idle, egui::Button::new(label));
+            reg(app, &format!("settings.library.{key}.{id}"), &r, name);
+            if r.clicked() {
+                acts.push(Act::Run(command.into(), json!({"id": id})));
+            }
+        }
+    });
+}
+
+/// A package's live preview (`library.preview`): its effect at default settings on the sample
+/// frame, playing, with a Before/After split the user drags (automation id
+/// `settings.library.previewImage`), and the effect's parameters.
+fn library_preview_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, id: &str) {
+    let status = app.session.library.status();
+    let Some(pv) = status.preview.filter(|v| v.id == id) else {
+        // A failure shows under the list (the library's error).
+        if status.busy.is_none() {
+            return;
+        }
+        ui.horizontal(|ui| {
+            ui.spinner();
+            ui.label(RichText::new(tr("Rendering a preview in the sandbox…")).color(t.text_dim));
+        });
+        return;
+    };
+    let ctx = ui.ctx().clone();
+    // Textures: the sample frame, then the effect's frames. One set, tagged with its package
+    // version and replaced when another is previewed (the engine keeps only the last preview).
+    let key = egui::Id::unique("library-preview");
+    let tag = (pv.id.clone(), pv.version.clone());
+    let size = [pv.width as usize, pv.height as usize];
+    // Cached per preview: its textures, whether it moves, whether it changes the frame at all.
+    let cached = ctx.data(|d| d.get_temp::<((String, String), Vec<egui::TextureHandle>, bool, bool)>(key));
+    let (tex, animated, unchanged) = match cached {
+        Some((t, v, animated, unchanged)) if t == tag => (v, animated, unchanged),
+        _ => {
+            let v: Vec<egui::TextureHandle> = std::iter::once(&pv.before)
+                .chain(&pv.frames)
+                .enumerate()
+                .filter(|(_, px)| px.len() == size[0] * size[1] * 4)
+                .map(|(i, px)| {
+                    ctx.load_texture(format!("library-preview-{i}"), egui::ColorImage::from_rgba_unmultiplied(size, px), egui::TextureOptions::LINEAR)
+                })
+                .collect();
+            let animated = pv.frames.windows(2).any(|w| w.first() != w.last());
+            let unchanged = pv.frames.iter().all(|f| *f == pv.before);
+            ctx.data_mut(|d| d.insert_temp(key, (tag, v.clone(), animated, unchanged)));
+            (v, animated, unchanged)
+        }
+    };
+    let (Some(before), true) = (tex.first(), tex.len() > 1) else { return };
+    let frames = tex.get(1..).unwrap_or_default();
+    let index = if animated { (ctx.input(|i| i.time) * pv.fps) as usize % frames.len() } else { 0 };
+    let Some(after) = frames.get(index) else { return };
+    if animated {
+        ctx.request_repaint_after(std::time::Duration::from_secs_f64(1.0 / pv.fps.max(1.0)));
+    }
+    ui.add_space(6.0);
+    let w = ui.available_width().min(480.0);
+    let (rect, r) = ui.allocate_exact_size(vec2(w, w * pv.height as f32 / pv.width.max(1) as f32), egui::Sense::click_and_drag());
+    reg(app, "settings.library.previewImage", &r, "Preview: drag to compare");
+    let split = &mut app.dialog_state.library_split;
+    if let Some(pos) = r.interact_pointer_pos() {
+        *split = ((pos.x - rect.left()) / rect.width()).clamp(0.0, 1.0);
+    }
+    let x = rect.left() + rect.width() * *split;
+    let uv = egui::Rect::from_min_max(egui::pos2(0.0, 0.0), egui::pos2(1.0, 1.0));
+    let painter = ui.painter_at(rect);
+    painter.image(after.id(), rect, uv, Color32::WHITE);
+    let left = egui::Rect::from_min_max(rect.min, egui::pos2(x, rect.bottom()));
+    painter.with_clip_rect(left).image(before.id(), rect, uv, Color32::WHITE);
+    painter.line_segment([egui::pos2(x, rect.top()), egui::pos2(x, rect.bottom())], egui::Stroke::new(2.0, Color32::WHITE));
+    let font = egui::FontId::proportional(11.0);
+    painter.text(rect.left_top() + vec2(6.0, 4.0), egui::Align2::LEFT_TOP, tr("Before"), font.clone(), Color32::WHITE);
+    painter.text(rect.right_top() + vec2(-6.0, 4.0), egui::Align2::RIGHT_TOP, tr("After"), font, Color32::WHITE);
+    let effect = &pv.manifest;
+    let params: Vec<&str> = effect["params"].as_array().into_iter().flatten().filter_map(|p| p["name"].as_str()).collect();
+    let mut line =
+        tr_args("{} ({}) at default settings, on a sample frame", &[&effect["name"].as_str().unwrap_or(id), &effect["category"].as_str().unwrap_or("")]);
+    if !params.is_empty() {
+        line = format!("{line} · {}", tr_args("Parameters: {}", &[&params.join(", ")]));
+    }
+    ui.label(RichText::new(line).color(t.text_faint));
+    if unchanged {
+        ui.label(RichText::new(tr("At its default settings this effect leaves the sample frame unchanged.")).color(t.text_dim));
+    }
+}
+
 /// Settings ▸ Disk ▸ Browser Storage (the web app's storage manager, `storage.*`): where the
 /// data lives, the origin's usage and quota, persistent storage, and Clear buttons.
 fn browser_storage_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, acts: &mut Vec<Act>) {
@@ -589,6 +952,7 @@ fn browser_storage_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, t: &Tokens, a
     ui.ctx().request_repaint_after(std::time::Duration::from_secs(1));
 }
 
+/// Draw the editable label colors and names in Settings.
 fn labels_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, cur: &Value, acts: &mut Vec<Act>) {
     ui.label(tr("Label Colors and Names:"));
     ui.add_space(4.0);
@@ -599,12 +963,14 @@ fn labels_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, cur: &Value, acts: &mu
             let mut f = c.map(|v| v as f32 / 255.0);
             let r = crate::widgets::srgb_color_button(ui, &mut f);
             let rgb = if r.changed() { srgb_bytes(f) } else { c };
+            a11y::name_value(&r, &tr_args("Label {} color", &[&(i + 1)]), &hex(rgb));
             app.auto.add(&format!("settings.labels.{i}.color"), r.rect, "label colour");
             if rgb != c {
                 acts.push(Act::Set(format!("labels.{i}.color"), json!(hex(rgb))));
             }
             let mut name = l["name"].as_str().unwrap_or("").to_string();
             let r = ui.add_sized(vec2(160.0, 20.0), egui::TextEdit::singleline(&mut name));
+            a11y::text_input(&r, &tr_args("Label {} name", &[&(i + 1)]), &name);
             app.auto.add(&format!("settings.labels.{i}.name"), r.rect, "label name");
             if r.changed() {
                 acts.push(Act::Set(format!("labels.{i}.name"), json!(name)));
@@ -622,6 +988,7 @@ fn labels_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, cur: &Value, acts: &mu
     }
 }
 
+/// Draw the Settings dialog, including its translated page list and the selected page's controls.
 pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     let all = pages();
     let mut page = app.dialog_state.settings_page.clone();
@@ -661,31 +1028,82 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         {
             let ui = &mut body;
             // Page list (left, like After Effects).
+            let widest_page = all
+                .iter()
+                .map(|p| ui.painter().layout_no_wrap(crate::i18n::settings_page_title(p.title).to_owned(), Tokens::ui(12.5), t.text).size().x)
+                .fold(0.0_f32, f32::max);
+            let page_width = (widest_page + 20.0).max(176.0).min((ui.available_width() * 0.42).min(300.0));
             ui.vertical(|ui| {
-                ui.set_width(180.0);
+                ui.set_width(page_width + 4.0);
                 egui::ScrollArea::vertical().id_salt("settings-pages").max_height(body_h).auto_shrink([false, false]).show(ui, |ui| {
+                    // One Tab stop for the list (the open page); Up / Down / Home / End move
+                    // between the pages and the focus goes with them.
                     // The rows touch, so the pointer never falls between two of them.
                     ui.spacing_mut().item_spacing.y = 0.0;
-                    for p in &all {
-                        let (r, resp) = ui.allocate_exact_size(vec2(176.0, 24.0), egui::Sense::click());
+                    let ctx = ui.ctx().clone();
+                    let page_item = |id: &str| egui::Id::unique(("settings-page", id.to_string()));
+                    let on_list = all.iter().any(|q| ctx.memory(|m| m.has_focus(page_item(q.id))));
+                    for (n, p) in all.iter().enumerate() {
                         let sel = page == p.id;
+                        let r = ui.allocate_space(vec2(page_width, 24.0)).1;
+                        let resp = ui.interact(r, page_item(p.id), if sel { egui::Sense::click() } else { egui::Sense::CLICK });
+                        a11y::list_item(&resp, crate::i18n::settings_page_title(p.title), sel, n + 1, all.len());
+                        if a11y::take_pending_focus(&ctx, "settings", resp.id) {
+                            resp.request_focus();
+                            resp.scroll_to_me(None);
+                        }
                         if sel {
                             ui.painter().rect_filled(r, 3.0, t.accent);
                         } else if resp.hovered() {
                             ui.painter().rect_filled(r, 3.0, t.hover);
                         }
-                        ui.painter().text(
+                        crate::widgets::text_fit(
+                            ui.painter(),
                             r.left_center() + vec2(10.0, 0.0),
                             egui::Align2::LEFT_CENTER,
-                            tr(p.title),
+                            crate::i18n::settings_page_title(p.title),
                             Tokens::ui(12.5),
+                            (page_width - 20.0).max(0.0),
                             if sel { Color32::WHITE } else { t.text },
                         );
+                        if resp.has_focus() {
+                            ui.painter().rect_stroke(r.shrink(1.0), 3.0, egui::Stroke::new(2.0, t.text), egui::StrokeKind::Inside);
+                        }
                         app.auto.add(&format!("settings.page.{}", p.id), r, p.title);
-                        if resp.clicked() {
+                        if resp.on_hover_text(crate::i18n::settings_page_title(p.title)).clicked() {
                             page = p.id.to_string();
                         }
                     }
+                    if on_list {
+                        let at = all.iter().position(|q| q.id == page).unwrap_or(0);
+                        let last = all.len().saturating_sub(1);
+                        let mut to = at;
+                        for key in ctx.input(|i| {
+                            i.events
+                                .iter()
+                                .filter_map(|e| match e {
+                                    egui::Event::Key { key, pressed: true, modifiers, .. } if !modifiers.any() => Some(*key),
+                                    _ => None,
+                                })
+                                .collect::<Vec<_>>()
+                        }) {
+                            to = match key {
+                                egui::Key::ArrowDown => to.saturating_add(1).min(last),
+                                egui::Key::ArrowUp => to.saturating_sub(1),
+                                egui::Key::Home => 0,
+                                egui::Key::End => last,
+                                _ => to,
+                            };
+                        }
+                        if to != at
+                            && let Some(q) = all.get(to)
+                        {
+                            page = q.id.to_string();
+                            a11y::focus_next_pass(&ctx, "settings", page_item(q.id));
+                        }
+                        // The arrows are the list's, not egui's spatial focus moves.
+                        ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
+                    }
                 });
             });
             ui.separator();
@@ -694,7 +1112,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                 // dialog scrolled sideways a little (#284).
                 ui.set_width(ui.available_width());
                 let p = &all[idx];
-                ui.label(RichText::new(tr(p.title)).font(Tokens::semibold(14.0)).color(t.tab_text_active));
+                ui.label(RichText::new(crate::i18n::settings_page_title(p.title)).font(Tokens::semibold(14.0)).color(t.tab_text_active));
                 ui.add_space(6.0);
                 egui::ScrollArea::vertical().max_height((body_h - 30.0).max(0.0)).auto_shrink([false, false]).show(ui, |ui| {
                     page_ui(app, ui, p, &cur, t, &mut acts);
@@ -781,9 +1199,9 @@ pub fn recovery(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                 if m < 1 {
                     "less than a minute ago".to_string()
                 } else if m < 120 {
-                    format!("{m} minutes ago")
+                    tr_args("{} minutes ago", &[&m])
                 } else {
-                    format!("{} hours ago", m / 60)
+                    tr_args("{} hours ago", &[&(m / 60)])
                 }
             });
             ui.label(tr_args("Latest auto-save: {}", &[&a]));
@@ -829,3 +1247,85 @@ pub fn recovery(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         app.ui.status = e;
     }
 }
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod tests {
+    use super::*;
+
+    /// Install-only models must not offer a download that the command will reject.
+    #[test]
+    fn sam2_settings_offer_file_installation_without_downloads() {
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let ctx = egui::Context::default();
+        let tokens = app.tokens;
+        let mut actions = vec![];
+        let mut output = ctx
+            .run_ui(egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, vec2(900.0, 2200.0))), ..Default::default() }, |ui| {
+                models_ui(&mut app, ui, &tokens, &mut actions, Task::Mask)
+            });
+        output.textures_delta.clear();
+        for id in ["sam2.1-hiera-tiny", "sam2.1-hiera-small", "sam2.1-hiera-base-plus", "sam2.1-hiera-large"] {
+            assert!(app.auto.find(&format!("settings.roto.download.{id}")).is_none());
+            assert!(app.auto.find(&format!("settings.roto.install.{id}")).is_some());
+            assert_eq!(app.auto.find(&format!("settings.roto.source.{id}")).unwrap().label, "model.safetensors");
+        }
+        assert!(actions.is_empty());
+    }
+
+    /// Settings ▸ Disk shows the disk cache's limit in effect under Maximum Disk Cache Size, and
+    /// says when free disk space holds it lower (a 20 GB cache held at 0 showed nothing).
+    #[test]
+    fn the_disk_page_shows_the_limit_free_space_allows() {
+        use effectcraft_engine::render::disk_cache::DiskCache;
+        const GB: u64 = 1 << 30;
+        let dir = std::env::temp_dir().join(format!("ec-settings-disk-limit-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let mut app = EffectcraftApp::new(effectcraft_engine::Session::default());
+        let dc = DiskCache::open(&dir, 20 * GB).unwrap();
+        app.session.disk_cache = Some(dc.clone());
+        let page = pages().into_iter().find(|p| p.id == "disk").unwrap();
+        let shown = |app: &mut EffectcraftApp| {
+            // (one frame's elements: `find` returns the first match)
+            app.auto = Default::default();
+            let ctx = egui::Context::default();
+            let (tokens, cur) = (app.tokens, serde_json::to_value(&app.session.prefs).unwrap());
+            let mut actions = vec![];
+            let mut output = ctx
+                .run_ui(egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, vec2(900.0, 1200.0))), ..Default::default() }, |ui| {
+                    page_ui(app, ui, &page, &cur, &tokens, &mut actions)
+                });
+            output.textures_delta.clear();
+            app.auto.find("settings.disk.cacheLimit").map(|e| e.label.clone())
+        };
+        let text = || disk_cache_limit_lines(dc.max_bytes(), dc.limit_bytes(), dc.reserve_bytes(), dc.accepts_writes()).join(" ");
+        // A 4 TB disk with 190 GB free: the 20 GB setting holds.
+        dc.set_disk_space(Some((4096 * GB, 190 * GB)));
+        let label = shown(&mut app).expect("the limit is shown");
+        assert_eq!(label, "limitMb=20480 maxMb=20480 reserveMb=10240 spaceLimited=false writes=true");
+        assert_eq!(text(), "Disk cache limit in effect: 20480 MB");
+        // 3 GB free on a 4 TB disk: 10 GB stay free, nothing is left for the cache.
+        dc.set_disk_space(Some((4096 * GB, 3 * GB)));
+        assert_eq!(shown(&mut app).unwrap(), "limitMb=0 maxMb=20480 reserveMb=10240 spaceLimited=true writes=false");
+        assert_eq!(
+            text(),
+            "Disk cache limit in effect: 0 MB Limited by free disk space: EffectCraft keeps 10.0 GB of this disk free. No room left: nothing is written to the disk cache until disk space is freed."
+        );
+        // 12 GB free: 2 GB for the cache.
+        dc.set_disk_space(Some((4096 * GB, 12 * GB)));
+        assert_eq!(shown(&mut app).unwrap(), "limitMb=2048 maxMb=20480 reserveMb=10240 spaceLimited=true writes=true");
+        assert_eq!(text(), "Disk cache limit in effect: 2048 MB Limited by free disk space: EffectCraft keeps 10.0 GB of this disk free.");
+        // A 100 GB disk keeps 5 GB.
+        dc.set_disk_space(Some((100 * GB, 6 * GB)));
+        assert_eq!(shown(&mut app).unwrap(), "limitMb=1024 maxMb=20480 reserveMb=5120 spaceLimited=true writes=true");
+        // Without the disk's size, the rule from the constants.
+        assert_eq!(
+            disk_cache_limit_lines(20 * GB, GB, None, true)[1],
+            "Limited by free disk space: EffectCraft keeps 5% of the disk free (at least 2 GB, at most 10 GB)."
+        );
+        // No disk cache: no line.
+        app.session.disk_cache = None;
+        assert!(shown(&mut app).is_none());
+        drop(dc);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/ui-egui/src/panels/shortcut_editor.rs b/crates/ui-egui/src/panels/shortcut_editor.rs
index 440ca6394..e4bf313ac 100644
--- a/crates/ui-egui/src/panels/shortcut_editor.rs
+++ b/crates/ui-egui/src/panels/shortcut_editor.rs
@@ -17,7 +17,7 @@
 //! `shortcuts.resetPreset`, `shortcuts.close`.
 
 use crate::i18n::{tr, tr_args};
-use effectcraft_engine::shortcuts::{APP_SCOPE, Bindable, DEFAULT_PRESET, normalize};
+use effectcraft_engine::shortcuts::{APP_SCOPE, Bindable, DEFAULT_PRESET, normalize, scope_label};
 use egui::{Align2, Color32, Rect, RichText, Sense, Stroke, StrokeKind, pos2, vec2};
 use serde_json::{Value, json};
 
@@ -49,6 +49,8 @@ const PANEL_COLOR: Color32 = Color32::from_rgb(0x3f, 0xa8, 0x6c);
 
 pub fn open(app: &mut EffectcraftApp) {
     app.dialog_state.shortcuts = EditorState::default();
+    // Scripts copied into the Scripts folder since the table was built are listed too.
+    app.session.scripts_changed();
     app.dialog = Some(Dialog::Shortcuts);
 }
 
@@ -200,6 +202,12 @@ const SIDE_KEYS: &[(&str, &str, f32, f32)] = &[
     ("→", "ArrowRight", 2.0, 5.0),
 ];
 
+/// The Keyboard Shortcuts dialog: while a shortcut field listens it records the next key
+/// combination (dropping those key events so the field does not type them), the preset bar switches
+/// keymaps, the drawn keyboard lists what the selected key runs, and the command list and editor
+/// remove, assign and reset bindings, warning about conflicts. Enter is OK unless a rename field, a
+/// preset menu or the delete confirmation is open. The collected `shortcuts.*` commands are run
+/// with the session when the frame ends; OK closes the dialog.
 pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     let mut st = std::mem::take(&mut app.dialog_state.shortcuts);
     let mut run: Vec<(String, Value)> = vec![];
@@ -258,7 +266,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
         // ---- preset bar
         ui.horizontal(|ui| {
             ui.label(tr("Preset:"));
-            let r = egui::ComboBox::from_id_salt("sc-preset").selected_text(&active).width(220.0).show_ui(ui, |ui| {
+            let r = craft_ui::ComboBox::from_id_salt("sc-preset").selected_text(&active).width(220.0).show_ui(ui, |ui| {
                 for n in &presets {
                     if ui.selectable_label(*n == active, n).clicked() {
                         run.push(("shortcuts.preset".into(), json!({"op": "select", "name": n})));
@@ -377,7 +385,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
             }
             let id = format!("shortcuts.key.{}", name.trim_start_matches('#'));
             app.auto.add(&id, r, label);
-            let resp = ui.interact(r, egui::Id::new(("sc-key", name, r.min.x as i32)), Sense::click());
+            let resp = ui.interact(r, egui::Id::unique(("sc-key", name, r.min.x as i32)), Sense::click());
             if resp.clicked() {
                 if let Some(i) = mod_idx {
                     st.mods[i] = !st.mods[i];
@@ -509,7 +517,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                     return;
                 };
                 ui.label(RichText::new(&b.label).font(Tokens::semibold(13.0)).color(t.tab_text_active));
-                ui.label(RichText::new(format!("{} • {}", b.command, b.scope)).color(t.text_faint));
+                ui.label(RichText::new(format!("{} • {}", b.command, scope_label(&b.scope))).color(t.text_faint));
                 ui.add_space(6.0);
                 let keys = table.keys.get(&b.key).cloned().unwrap_or_default();
                 if keys.is_empty() {
@@ -557,7 +565,7 @@ pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
                         ui.add_space(4.0);
                         ui.label(RichText::new(tr_args("⚠ {} is used by:", &[&(crate::menus::shortcut_text(&k))])).color(t.warning));
                         for c in conflicts.iter().take(4) {
-                            ui.label(RichText::new(format!("   {} ({})", c.label, c.scope)).color(t.warning));
+                            ui.label(RichText::new(format!("   {} ({})", c.label, scope_label(&c.scope))).color(t.warning));
                         }
                     }
                 }
diff --git a/crates/ui-egui/src/panels/templates.rs b/crates/ui-egui/src/panels/templates.rs
index ec65ee6d7..5a1ac35a0 100644
--- a/crates/ui-egui/src/panels/templates.rs
+++ b/crates/ui-egui/src/panels/templates.rs
@@ -62,14 +62,14 @@ pub fn home_tab(app: &mut EffectcraftApp, ui: &mut egui::Ui, area: Rect) {
     p.text(
         pos2(x, y + 26.0),
         Align2::LEFT_CENTER,
-        "Start from a ready-made project. Opening a template makes an untitled copy.",
+        crate::i18n::tr("Start from a ready-made project. Opening a template makes an untitled copy."),
         Tokens::ui(11.5),
         t.text_faint,
     );
     // Save the open project as a user template.
     let can_save = app.session.project.comps().next().is_some();
     let sr = Rect::from_min_size(pos2(area.max.x - 210.0, y - 4.0), vec2(210.0, 28.0));
-    let save = widgets::text_button(ui, sr, "Save Current as Template…", false, &t, egui::Id::new("home-templates-save")).clicked();
+    let save = widgets::text_button(ui, sr, crate::i18n::tr("Save Current as Template…"), false, &t, egui::Id::unique("home-templates-save")).clicked();
     app.auto.add("home.templates.saveCurrent", sr, "Save Current as Template…");
     if save {
         if can_save {
@@ -101,7 +101,7 @@ pub fn home_tab(app: &mut EffectcraftApp, ui: &mut egui::Ui, area: Rect) {
             let (cx, cy) = (full.min.x + (i % cols) as f32 * (card_w + gap), full.min.y + (i / cols) as f32 * (card_h + gap));
             let r = Rect::from_min_size(pos2(cx, cy), vec2(card_w, card_h));
             let visible = r.intersects(ui.clip_rect());
-            let resp = ui.interact(r, egui::Id::new(("template-card", &tpl.id)), Sense::click()).on_hover_text(&tpl.description);
+            let resp = ui.interact(r, egui::Id::unique(("template-card", &tpl.id)), Sense::click()).on_hover_text(&tpl.description);
             p.rect_filled(r, 8.0, if resp.hovered() { Color32::from_rgb(0x2c, 0x2e, 0x37) } else { Color32::from_rgb(0x24, 0x26, 0x2e) });
             let tr = Rect::from_min_size(r.min, vec2(card_w, thumb_h));
             let tex = if visible { thumb(app, &ctx, &tpl.id, &mut budget) } else { None };
@@ -137,7 +137,7 @@ pub fn home_tab(app: &mut EffectcraftApp, ui: &mut egui::Ui, area: Rect) {
             let mut del_hit = false;
             if !tpl.builtin {
                 let dr = Rect::from_min_size(pos2(tr.max.x - 30.0, tr.min.y + 6.0), vec2(24.0, 24.0));
-                let dresp = ui.interact(dr, egui::Id::new(("template-del", &tpl.id)), Sense::click()).on_hover_text(crate::i18n::tr("Delete this template"));
+                let dresp = ui.interact(dr, egui::Id::unique(("template-del", &tpl.id)), Sense::click()).on_hover_text(crate::i18n::tr("Delete this template"));
                 if resp.hovered() || dresp.hovered() {
                     p.circle_filled(dr.center(), 12.0, if dresp.hovered() { Color32::from_rgb(0xc0, 0x3a, 0x3a) } else { Color32::from_black_alpha(170) });
                     icons::paint(&p, dr.shrink(6.0), Icon::Close, Color32::WHITE);
diff --git a/crates/ui-egui/src/panels/text_panels.rs b/crates/ui-egui/src/panels/text_panels.rs
index b3791efb7..f22d775a3 100644
--- a/crates/ui-egui/src/panels/text_panels.rs
+++ b/crates/ui-egui/src/panels/text_panels.rs
@@ -3,7 +3,7 @@
 //! otherwise they apply to the whole selected text layer.
 
 use crate::i18n::tr;
-use effectcraft_engine::keyframe::{BaselineOption, Composer, Direction, FigureStyle, FigureWidth, Justify, Kerning, TextDoc};
+use effectcraft_engine::keyframe::{BaselineOption, Composer, Direction, FigureStyle, FigureWidth, Justify, Kerning, LineJoin, TextDoc};
 use effectcraft_engine::render::EvalCtx;
 use egui::{Align2, Rect, Sense, pos2, vec2};
 use serde_json::json;
@@ -57,13 +57,27 @@ pub fn text_target(app: &EffectcraftApp) -> Option<TextTarget> {
         .iter()
         .filter_map(|id| comp.layer(*id))
         .find(|l| matches!(l.source, effectcraft_engine::project::LayerSource::Text))?;
-    let ectx = EvalCtx { project: &app.session.project, comp_id: cid, comp, time: app.session.time(), expr: app.session.expr.as_deref(), footage: None };
+    let ectx = EvalCtx {
+        project: &app.session.project,
+        comp_id: cid,
+        comp,
+        time: app.session.time(),
+        expr: app.session.expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
     effectcraft_engine::render::text::source_text(&ectx, layer).map(|d| TextTarget { layer: layer.id.0, doc: d, range: None })
 }
 
-fn toggle(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, r: Rect, id: &str, label: &str, on: bool, bold: bool) -> bool {
+/// A small toggle button at `r` showing `label` (semibold 13 when `bold`, else 12), filled with
+/// the accent while `on`; returns whether it was clicked. It only reports the click: the caller
+/// decides the new state.
+fn toggle(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, r: Rect, id: &str, look: (&str, bool, bool)) -> bool {
+    let (label, on, bold) = look;
     let t = app.tokens;
-    let resp = ui.interact(r, egui::Id::new(("text-toggle", id)), Sense::click());
+    let resp = ui.interact(r, egui::Id::unique(("text-toggle", id)), Sense::click());
     p.rect_filled(
         r,
         3.0,
@@ -81,39 +95,19 @@ fn toggle(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, r: Rec
     resp.clicked()
 }
 
-pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+/// Position of the numeric grid (`x0`, top `y`, width `w`) and whether edits are collected.
+#[derive(Clone, Copy)]
+struct Grid {
+    x0: f32,
+    y: f32,
+    w: f32,
+    enabled: bool,
+}
+
+/// Numeric fields in AE's two-column grid (Kerning is a popup, at row 1 left).
+fn numeric_fields(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, g: Grid, doc: &TextDoc, actions: &mut Vec<serde_json::Value>) {
     let t = app.tokens;
-    let p = ui.painter().with_clip_rect(rect);
-    let ctx = ui.ctx().clone();
-    let target = text_target(app);
-    let enabled = target.is_some();
-    let doc = target.as_ref().map(|t| t.doc.clone()).unwrap_or_default();
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("character-scroll"), rect);
-    let top = rect.min.y + 10.0 - scroll.offset;
-    let mut y = top;
-    let x0 = rect.min.x + 10.0;
-    let w = rect.width() - 20.0;
-    let mut actions: Vec<serde_json::Value> = vec![];
-    // Font family + style.
-    let fr = Rect::from_min_size(pos2(x0, y), vec2(w, 22.0));
-    let pop = egui::Id::new("char-font-pop");
-    if let Some(f) = font_picker(app, ui, pop, fr, &doc.font, "character.font", enabled) {
-        actions.push(json!({"font": f}));
-    }
-    y += 28.0;
-    let sr = Rect::from_min_size(pos2(x0, y), vec2(w - 84.0, 22.0));
-    let spop = egui::Id::new("char-style-pop");
-    if widgets::dropdown(ui, sr, &doc.style, &t, egui::Id::new("char-style")).clicked() && enabled {
-        widgets::open_popup(ui, spop);
-    }
-    app.auto.add("character.style", sr, "Font style");
-    // The family's own styles.
-    let styles: Vec<String> = if widgets::popup_is_open(ui, spop) { effectcraft_engine::font_styles(&doc.font) } else { vec![] };
-    if let Some(st) = widgets::popup_menu(ui, spop, sr.left_bottom(), &styles, styles.iter().position(|s| *s == doc.style)).and_then(|i| styles.get(i)) {
-        actions.push(json!({"style": st}));
-    }
-    y += 34.0;
-    // Numeric fields in AE's two-column grid (Kerning is a popup, at row 1 right).
+    let Grid { x0, y, w, enabled } = g;
     let fields: [(&str, &str, f64, (f64, f64), &str); 10] = [
         ("size", "T", doc.size, (1.0, 2000.0), " px"),
         ("leading", "A", doc.leading.unwrap_or(doc.size * 1.2), (0.0, 5000.0), " px"),
@@ -134,67 +128,209 @@ pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let row = i / 2;
         let fx = x0 + col as f32 * (w / 2.0);
         let fy = y + row as f32 * 28.0;
-        p.text(pos2(fx, fy + 9.0), Align2::LEFT_CENTER, glyph, Tokens::semibold(11.0), t.text_dim);
-        let (r, nv, _) = widgets::hot_number_at(ui, pos2(fx + 26.0, fy), egui::Id::new(("char", key)), v, 0.5, range, 0, suffix, &t);
+        let stroke = key == "strokeWidth";
+        if stroke {
+            // The stroke-width icon, as in After Effects, not a letter that reads as "width".
+            crate::icons::paint(p, Rect::from_min_size(pos2(fx, fy + 1.0), vec2(18.0, 18.0)), crate::icons::Icon::StrokeWidth, t.text_dim);
+        } else {
+            p.text(pos2(fx, fy + 9.0), Align2::LEFT_CENTER, glyph, Tokens::semibold(11.0), t.text_dim);
+        }
+        // Fractional stroke widths (the 0.25 / 0.5 / 0.75 presets) show their decimals.
+        let decimals = if stroke && v.fract().abs() > 1e-9 { 2 } else { 0 };
+        let (r, nv, _) =
+            widgets::hot_number_at(ui, pos2(fx + 26.0, fy), egui::Id::unique(("char", key)), v, &widgets::HotSpec { speed: 0.5, range, decimals, suffix }, &t);
         app.auto.add(&format!("character.{key}"), r, key);
+        if stroke {
+            stroke_width_presets(app, ui, r, enabled, actions);
+        }
         if let Some(nv) = nv
             && enabled
         {
             actions.push(json!({key: nv, "merge": format!("char-{key}")}));
         }
     }
-    // Kerning: Metrics / Optical / a manual value (row 1, left).
+}
+
+/// The stroke width's presets menu beside its value (`r`), as in After Effects.
+fn stroke_width_presets(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, enabled: bool, actions: &mut Vec<serde_json::Value>) {
+    const PRESETS: [f64; 22] = [0.25, 0.5, 0.75, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 20.0, 30.0, 40.0, 50.0, 60.0, 70.0, 80.0, 90.0, 100.0];
+    let t = app.tokens;
+    let br = Rect::from_min_size(pos2(r.max.x + 4.0, r.min.y + 2.0), vec2(16.0, 16.0));
+    let pop = egui::Id::unique("char-stroke-width-pop");
+    if widgets::icon_button(ui, br, crate::icons::Icon::ChevronDown, false, &t, egui::Id::unique("char-stroke-width-presets"))
+        .on_hover_text(tr("Stroke width presets"))
+        .clicked()
+        && enabled
     {
-        let fy = y + 28.0;
-        p.text(pos2(x0, fy + 9.0), Align2::LEFT_CENTER, "V/A", Tokens::semibold(11.0), t.text_dim);
-        let label = match doc.kerning {
-            Kerning::Metrics => "Metrics".to_string(),
-            Kerning::Optical => "Optical".to_string(),
-            Kerning::Manual(v) => format!("{v:.0}"),
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add("character.strokeWidth.presets", br, "Stroke width presets");
+    let labels: Vec<String> = PRESETS.iter().map(|v| format!("{v} px")).collect();
+    if let Some(v) = widgets::popup_menu(ui, pop, br.left_bottom(), &labels, None).and_then(|i| PRESETS.get(i)) {
+        actions.push(json!({"strokeWidth": v}));
+    }
+}
+
+/// Kerning: Metrics / Optical / a manual value (grid row 1, left).
+fn kerning_field(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, g: Grid, doc: &TextDoc, actions: &mut Vec<serde_json::Value>) {
+    let t = app.tokens;
+    let Grid { x0, y, w, enabled } = g;
+    let fy = y + 28.0;
+    p.text(pos2(x0, fy + 9.0), Align2::LEFT_CENTER, "V/A", Tokens::semibold(11.0), t.text_dim);
+    let label = match doc.kerning {
+        Kerning::Metrics => "Metrics".to_string(),
+        Kerning::Optical => "Optical".to_string(),
+        Kerning::Manual(v) => format!("{v:.0}"),
+    };
+    let kr = Rect::from_min_size(pos2(x0 + 26.0, fy), vec2((w / 2.0 - 32.0).max(50.0), 20.0));
+    let kpop = egui::Id::unique("char-kerning-pop");
+    if widgets::dropdown(ui, kr, &label, &t, egui::Id::unique("char-kerning")).clicked() && enabled {
+        widgets::open_popup(ui, kpop);
+    }
+    app.auto.add("character.kerning", kr, "Kerning");
+    let opts: Vec<String> = ["Metrics", "Optical", "0", "-50", "-25", "-10", "10", "25", "50", "100"].iter().map(|s| s.to_string()).collect();
+    if let Some(i) = widgets::popup_menu(ui, kpop, kr.left_bottom(), &opts, None) {
+        let v = match i {
+            0 => json!("metrics"),
+            1 => json!("optical"),
+            _ => json!(opts[i].parse::<f64>().unwrap_or(0.0)),
         };
-        let kr = Rect::from_min_size(pos2(x0 + 26.0, fy), vec2((w / 2.0 - 32.0).max(50.0), 20.0));
-        let kpop = egui::Id::new("char-kerning-pop");
-        if widgets::dropdown(ui, kr, &label, &t, egui::Id::new("char-kerning")).clicked() && enabled {
-            widgets::open_popup(ui, kpop);
-        }
-        app.auto.add("character.kerning", kr, "Kerning");
-        let opts: Vec<String> = ["Metrics", "Optical", "0", "-50", "-25", "-10", "10", "25", "50", "100"].iter().map(|s| s.to_string()).collect();
-        if let Some(i) = widgets::popup_menu(ui, kpop, kr.left_bottom(), &opts, None) {
-            let v = match i {
-                0 => json!("metrics"),
-                1 => json!("optical"),
-                _ => json!(opts[i].parse::<f64>().unwrap_or(0.0)),
-            };
-            actions.push(json!({"kerning": v}));
-        }
+        actions.push(json!({"kerning": v}));
     }
-    // Stroke Over Fill / Fill Over Stroke (row 2, right).
-    {
-        let fx = x0 + w / 2.0;
-        let fy = y + 2.0 * 28.0;
-        let dr = Rect::from_min_size(pos2(fx, fy), vec2(w / 2.0, 20.0));
-        let labels = vec!["Fill Over Stroke".to_string(), "Stroke Over Fill".to_string()];
-        let pop = egui::Id::new("char-stroke-order-pop");
-        if widgets::dropdown(ui, dr, &labels[doc.stroke_over_fill as usize], &t, egui::Id::new("char-stroke-order")).clicked() && enabled {
-            widgets::open_popup(ui, pop);
-        }
-        app.auto.add("character.strokeOverFill", dr, "Stroke order");
-        if let Some(i) = widgets::popup_menu(ui, pop, dr.left_bottom(), &labels, Some(doc.stroke_over_fill as usize)) {
+}
+
+/// Stroke order (grid row 2, right): per character (Fill Over Stroke / Stroke Over Fill), or for
+/// the whole layer, which is the layer's More Options > Fill & Stroke (`fill_stroke`, see
+/// [`layer_fill_stroke`]). Returns the layer order picked, if any.
+fn stroke_order_field(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    g: Grid,
+    doc: &TextDoc,
+    fill_stroke: u32,
+    actions: &mut Vec<serde_json::Value>,
+) -> Option<u32> {
+    let t = app.tokens;
+    let Grid { x0, y, w, enabled } = g;
+    let fx = x0 + w / 2.0;
+    let fy = y + 2.0 * 28.0;
+    let dr = Rect::from_min_size(pos2(fx, fy), vec2(w / 2.0, 20.0));
+    let labels: Vec<String> =
+        ["Fill Over Stroke", "Stroke Over Fill", "-", "All Fills Over All Strokes", "All Strokes Over All Fills"].iter().map(|s| s.to_string()).collect();
+    let current = match fill_stroke {
+        1 => 3,
+        2 => 4,
+        _ => doc.stroke_over_fill as usize,
+    };
+    let pop = egui::Id::unique("char-stroke-order-pop");
+    if widgets::dropdown(ui, dr, &labels[current], &t, egui::Id::unique("char-stroke-order")).clicked() && enabled {
+        widgets::open_popup(ui, pop);
+    }
+    app.auto.add("character.strokeOverFill", dr, "Stroke order");
+    match widgets::popup_menu(ui, pop, dr.left_bottom(), &labels, Some(current)) {
+        Some(i @ (3 | 4)) => Some(i as u32 - 2),
+        Some(i) => {
             actions.push(json!({"strokeOverFill": i == 1}));
+            // A per-character order puts the layer back on the Per Character Palette, or it
+            // would have no visible effect.
+            (fill_stroke != 0).then_some(0)
+        }
+        None => None,
+    }
+}
+
+/// Line Join of the stroke: Miter / Round / Bevel (grid row 5, under the stroke width).
+fn line_join_field(app: &mut EffectcraftApp, ui: &mut egui::Ui, p: &egui::Painter, g: Grid, doc: &TextDoc, actions: &mut Vec<serde_json::Value>) {
+    let Grid { x0, y, w, enabled } = g;
+    let bw = (w - 2.0 * 4.0) / 3.0;
+    for (i, (key, label, join)) in
+        [("miter", "Miter", LineJoin::Miter), ("round", "Round", LineJoin::Round), ("bevel", "Bevel", LineJoin::Bevel)].into_iter().enumerate()
+    {
+        let r = Rect::from_min_size(pos2(x0 + i as f32 * (bw + 4.0), y + 5.0 * 28.0), vec2(bw, 22.0));
+        if toggle(app, ui, p, r, &format!("character.lineJoin.{key}"), (label, doc.line_join == join, false)) && enabled {
+            actions.push(json!({"lineJoin": key}));
         }
     }
-    y += 5.0 * 28.0 + 8.0;
+}
+
+/// Sets the layer's More Options > Fill & Stroke to `v` together with the per-character order
+/// it changes, as one undo step.
+fn apply_layer_fill_stroke(app: &mut EffectcraftApp, ctx: &egui::Context, tt: &TextTarget, v: u32, actions: Vec<serde_json::Value>) {
+    let set = json!({"command": "prop.set", "params": {"layer": tt.layer, "path": "text/moreOptions/fillStroke", "value": v}});
+    let steps: Vec<serde_json::Value> =
+        std::iter::once(set).chain(actions.into_iter().map(|a| json!({"command": "layer.setText", "params": tt.params(a)}))).collect();
+    if let Err(e) = crate::menus::invoke(app, ctx, "engine.batch", json!({"steps": steps, "label": "Stroke Order"})) {
+        app.ui.status = e;
+    }
+}
+
+/// A text layer's More Options > Fill & Stroke in the active comp: 0 per character palette,
+/// 1 all fills over all strokes, 2 all strokes over all fills.
+fn layer_fill_stroke(app: &EffectcraftApp, layer: u64) -> u32 {
+    let (Some(comp), Some(cid)) = (app.session.active_comp(), app.session.active_comp_id()) else { return 0 };
+    let Some(l) = comp.layer(effectcraft_engine::project::LayerId(layer)) else { return 0 };
+    let Some(more) = l.props.sub("text").and_then(|t| t.sub("moreOptions")) else { return 0 };
+    let ectx = EvalCtx { expr: app.session.expr.as_deref(), ..EvalCtx::new(&app.session.project, cid, comp, app.session.time()) };
+    ectx.e(l, more, "fillStroke")
+}
+
+/// The Character panel for the text being edited (or the selected text layer): font family and
+/// style, size, leading, tracking, stroke, scale, baseline shift and other numeric fields, kerning,
+/// fill/stroke colours with eyedroppers, style toggles, OpenType features and variable-font axes.
+/// Without a text target the panel is inert — no edit is collected and it asks for a text layer.
+/// Edits are collected and, when a target exists, sent as `layer.setText` commands scoped to the
+/// edited range; failures show in `app.ui.status`.
+pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    let target = text_target(app);
+    let enabled = target.is_some();
+    let doc = target.as_ref().map(|t| t.doc.clone()).unwrap_or_default();
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("character-scroll"), rect);
+    let rect = scroll.content;
+    let p = ui.painter().with_clip_rect(rect);
+    let top = rect.min.y + 10.0 - scroll.offset;
+    let mut y = top;
+    let x0 = rect.min.x + 10.0;
+    let w = rect.width() - 20.0;
+    let mut actions: Vec<serde_json::Value> = vec![];
+    // Font family + style.
+    let fr = Rect::from_min_size(pos2(x0, y), vec2(w, 22.0));
+    let pop = egui::Id::unique("char-font-pop");
+    if let Some(f) = font_picker(app, ui, pop, fr, &doc.font, "character.font", enabled) {
+        actions.push(json!({"font": f}));
+    }
+    y += 28.0;
+    let sr = Rect::from_min_size(pos2(x0, y), vec2(w - 84.0, 22.0));
+    let spop = egui::Id::unique("char-style-pop");
+    if widgets::dropdown(ui, sr, &doc.style, &t, egui::Id::unique("char-style")).clicked() && enabled {
+        widgets::open_popup(ui, spop);
+    }
+    app.auto.add("character.style", sr, "Font style");
+    // The family's own styles.
+    let styles: Vec<String> = if widgets::popup_is_open(ui, spop) { effectcraft_engine::font_styles(&doc.font) } else { vec![] };
+    if let Some(st) = widgets::popup_menu(ui, spop, sr.left_bottom(), &styles, styles.iter().position(|s| *s == doc.style)).and_then(|i| styles.get(i)) {
+        actions.push(json!({"style": st}));
+    }
+    y += 34.0;
+    let grid = Grid { x0, y, w, enabled };
+    numeric_fields(app, ui, &p, grid, &doc, &mut actions);
+    kerning_field(app, ui, &p, grid, &doc, &mut actions);
+    let fill_stroke = target.as_ref().map_or(0, |tt| layer_fill_stroke(app, tt.layer));
+    let layer_fill_stroke_pick = stroke_order_field(app, ui, grid, &doc, fill_stroke, &mut actions);
+    line_join_field(app, ui, &p, grid, &doc, &mut actions);
+    y += 6.0 * 28.0 + 8.0;
     // Fill / stroke swatches with their enable boxes.
     for (i, (key, label, on, c)) in [("fill", "Fill", doc.apply_fill, doc.fill), ("stroke", "Stroke", doc.apply_stroke, doc.stroke)].into_iter().enumerate() {
         let fx = x0 + i as f32 * (w / 2.0);
         let cr = Rect::from_min_size(pos2(fx, y + 3.0), vec2(14.0, 14.0));
-        if widgets::checkbox(ui, cr, on, &t, egui::Id::new(("char-apply", key))).clicked() && enabled {
+        if ui.add_enabled_ui(enabled, |ui| widgets::checkbox(ui, cr, on, &t, egui::Id::unique(("char-apply", key)))).inner.changed() && enabled {
             actions.push(json!({if key == "fill" { "applyFill" } else { "applyStroke" }: !on}));
         }
         app.auto.add(&format!("character.{key}.enabled"), cr, label);
         let fs = Rect::from_min_size(pos2(fx + 20.0, y), vec2(26.0, 20.0));
-        let pop = egui::Id::new(("char-color-pop", key));
-        if widgets::swatch(ui, fs, c, egui::Id::new(("char-color", key)), &t).clicked() && enabled {
+        let pop = egui::Id::unique(("char-color-pop", key));
+        if widgets::swatch(ui, fs, c, egui::Id::unique(("char-color", key)), &t).clicked() && enabled {
             widgets::open_popup(ui, pop);
         }
         app.auto.add(&format!("character.{key}"), fs, label);
@@ -204,7 +340,8 @@ pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         let er = Rect::from_min_size(pos2(fs.max.x + 4.0, y + 1.0), vec2(18.0, 18.0));
         let active = app.ui.text_color_pick.as_ref().is_some_and(|pick| pick.layer == target.as_ref().map_or(0, |tt| tt.layer) && pick.field == key);
-        let eye = super::fx_widgets::eyedropper_button(ui, er, active, egui::Id::new(("char-eye", key)), &t);
+        let eye = super::fx_widgets::eyedropper_button(ui, er, active, egui::Id::unique(("char-eye", key)), &t)
+            .on_hover_text(tr("Eyedropper: click, then click in the Composition panel"));
         app.auto.add(&format!("character.{key}.eyedropper"), er, &format!("{label} eyedropper"));
         if eye.clicked() {
             if active {
@@ -233,24 +370,24 @@ pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let bw = ((w - 5.0 * 4.0) / 6.0).clamp(22.0, 30.0);
     for (i, (key, label, on, bold)) in toggles.into_iter().enumerate() {
         let r = Rect::from_min_size(pos2(x0 + i as f32 * (bw + 4.0), y), vec2(bw, 24.0));
-        if toggle(app, ui, &p, r, &format!("character.{key}"), label, on, bold) && enabled {
+        if toggle(app, ui, &p, r, &format!("character.{key}"), (label, on, bold)) && enabled {
             actions.push(json!({key: !on}));
         }
     }
     y += 32.0;
     // Ligatures.
     let lr = Rect::from_min_size(pos2(x0, y), vec2(14.0, 14.0));
-    if widgets::checkbox(ui, lr, doc.ligatures, &t, egui::Id::new("char-ligatures")).clicked() && enabled {
+    if ui.add_enabled_ui(enabled, |ui| widgets::checkbox(ui, lr, doc.ligatures, &t, egui::Id::unique("char-ligatures"))).inner.changed() && enabled {
         actions.push(json!({"ligatures": !doc.ligatures}));
     }
     app.auto.add("character.ligatures", lr, "Ligatures");
     p.text(pos2(x0 + 20.0, y + 7.0), Align2::LEFT_CENTER, tr("Ligatures"), Tokens::ui(11.5), t.text_dim);
     // OpenType: a popup with the font's layout features (like the Character panel's OpenType menu).
     let or = Rect::from_min_size(pos2(sr.max.x + 6.0, sr.min.y), vec2(78.0, 22.0));
-    let opop = egui::Id::new("char-opentype-pop");
+    let opop = egui::Id::unique("char-opentype-pop");
     let n_on = doc.opentype.feature_settings().len();
     let olabel = if n_on > 0 { format!("OT ({n_on})") } else { "OpenType".to_string() };
-    if widgets::dropdown(ui, or, &olabel, &t, egui::Id::new("char-opentype")).clicked() && enabled {
+    if widgets::dropdown(ui, or, &olabel, &t, egui::Id::unique("char-opentype")).clicked() && enabled {
         widgets::open_popup(ui, opop);
     }
     app.auto.add("character.opentype", or, "OpenType");
@@ -264,7 +401,7 @@ pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 .enumerate()
         {
             let cr = Rect::from_min_size(pos2(x0 + i as f32 * 120.0, y), vec2(14.0, 14.0));
-            if widgets::checkbox(ui, cr, on, &t, egui::Id::new(("char-vert", key))).clicked() && enabled {
+            if ui.add_enabled_ui(enabled, |ui| widgets::checkbox(ui, cr, on, &t, egui::Id::unique(("char-vert", key)))).inner.changed() && enabled {
                 actions.push(json!({key: !on}));
             }
             app.auto.add(&format!("character.{key}"), cr, label);
@@ -287,8 +424,14 @@ pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             let tag = a.tag.trim_end().to_string();
             let v = doc.variations.iter().chain(&instance).find(|(t2, _)| t2.trim_end() == tag).map(|(_, v)| *v).unwrap_or(a.default);
             p.text(pos2(fx, fy + 9.0), Align2::LEFT_CENTER, &tag, Tokens::semibold(10.5), t.text_dim);
-            let (r, nv, _) =
-                widgets::hot_number_at(ui, pos2(fx + 34.0, fy), egui::Id::new(("char-axis", &tag)), v as f64, 1.0, (a.min as f64, a.max as f64), 0, "", &t);
+            let (r, nv, _) = widgets::hot_number_at(
+                ui,
+                pos2(fx + 34.0, fy),
+                egui::Id::unique(("char-axis", &tag)),
+                v as f64,
+                &widgets::HotSpec { speed: 1.0, range: (a.min as f64, a.max as f64), decimals: 0, suffix: "" },
+                &t,
+            );
             app.auto.add(&format!("character.axis.{tag}"), r, &a.name);
             if let Some(nv) = nv
                 && enabled
@@ -312,6 +455,9 @@ pub fn character(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         _ => {}
     }
     let Some(tt) = target else { return };
+    if let Some(v) = layer_fill_stroke_pick {
+        apply_layer_fill_stroke(app, &ctx, &tt, v, std::mem::take(&mut actions));
+    }
     for a in actions {
         if let Err(e) = crate::menus::invoke(app, &ctx, "layer.setText", tt.params(a)) {
             app.ui.status = e;
@@ -452,16 +598,21 @@ pub fn paint_justify_glyph(p: &egui::Painter, r: Rect, j: Justify, c: egui::Colo
     }
 }
 
+/// The Paragraph panel: alignment, left/right/first-line indents, space before and after,
+/// paragraph direction (when the text engine allows it), the composer, and Roman hanging
+/// punctuation. Edits are queued and sent as `layer.setText` for the edited range when a text
+/// target exists; failures show in `app.ui.status`.
 pub fn paragraph(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
-    let p = ui.painter().with_clip_rect(rect);
     let ctx = ui.ctx().clone();
     let target = text_target(app);
     let enabled = target.is_some();
     let doc = target.as_ref().map(|t| t.doc.clone()).unwrap_or_default();
+    let scroll = widgets::PanelScroll::begin(ui, egui::Id::unique("paragraph-scroll"), rect);
+    let rect = scroll.content;
+    let p = ui.painter().with_clip_rect(rect);
     let x0 = rect.min.x + 10.0;
     let w = rect.width() - 20.0;
-    let scroll = widgets::PanelScroll::begin(ui, egui::Id::new("paragraph-scroll"), rect);
     let top = rect.min.y + 10.0 - scroll.offset;
     let mut y = top;
     let mut actions: Vec<serde_json::Value> = vec![];
@@ -469,7 +620,7 @@ pub fn paragraph(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     for (i, (j, key)) in ALIGNS.into_iter().enumerate() {
         let r = Rect::from_min_size(pos2(x0 + i as f32 * (bw + 3.0), y), vec2(bw, 24.0));
         let on = doc.justify == j;
-        let resp = ui.interact(r, egui::Id::new(("para", key)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("para", key)), Sense::click());
         p.rect_filled(
             r,
             3.0,
@@ -504,7 +655,14 @@ pub fn paragraph(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let fx = x0 + (i % 2) as f32 * (w / 2.0);
         let fy = y + (i / 2) as f32 * 28.0;
         p.text(pos2(fx, fy + 9.0), Align2::LEFT_CENTER, glyph, Tokens::semibold(11.0), t.text_dim);
-        let (r, nv, _) = widgets::hot_number_at(ui, pos2(fx + 26.0, fy), egui::Id::new(("para-f", key)), v, 0.5, (-5000.0, 5000.0), 0, " px", &t);
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(fx + 26.0, fy),
+            egui::Id::unique(("para-f", key)),
+            v,
+            &widgets::HotSpec { speed: 0.5, range: (-5000.0, 5000.0), decimals: 0, suffix: " px" },
+            &t,
+        );
         app.auto.add(&format!("paragraph.{key}"), r, key);
         if let Some(nv) = nv
             && enabled
@@ -521,8 +679,8 @@ pub fn paragraph(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     if world_ready || rtl {
         let dr = Rect::from_min_size(pos2(x0, y), vec2(w / 2.0 - 4.0, 22.0));
         let dirs = vec!["Left-to-Right Text".to_string(), "Right-to-Left Text".to_string()];
-        let dpop = egui::Id::new("para-direction-pop");
-        if widgets::dropdown(ui, dr, &dirs[rtl as usize], &t, egui::Id::new("para-direction")).clicked() && enabled {
+        let dpop = egui::Id::unique("para-direction-pop");
+        if widgets::dropdown(ui, dr, &dirs[rtl as usize], &t, egui::Id::unique("para-direction")).clicked() && enabled {
             widgets::open_popup(ui, dpop);
         }
         app.auto.add("paragraph.direction", dr, "Text direction");
@@ -536,9 +694,9 @@ pub fn paragraph(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     } else {
         vec!["Every-line Composer".to_string(), "Single-line Composer".to_string()]
     };
-    let cpop = egui::Id::new("para-composer-pop");
+    let cpop = egui::Id::unique("para-composer-pop");
     let single = doc.composer == Composer::SingleLine;
-    if widgets::dropdown(ui, cr, &comps[single as usize], &t, egui::Id::new("para-composer")).clicked() && enabled {
+    if widgets::dropdown(ui, cr, &comps[single as usize], &t, egui::Id::unique("para-composer")).clicked() && enabled {
         widgets::open_popup(ui, cpop);
     }
     app.auto.add("paragraph.composer", cr, "Composer");
@@ -547,7 +705,7 @@ pub fn paragraph(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
     y += 30.0;
     let hr = Rect::from_min_size(pos2(x0, y), vec2(14.0, 14.0));
-    if widgets::checkbox(ui, hr, doc.hanging_punctuation, &t, egui::Id::new("para-hanging")).clicked() && enabled {
+    if ui.add_enabled_ui(enabled, |ui| widgets::checkbox(ui, hr, doc.hanging_punctuation, &t, egui::Id::unique("para-hanging"))).inner.changed() && enabled {
         actions.push(json!({"hangingPunctuation": !doc.hanging_punctuation}));
     }
     app.auto.add("paragraph.hangingPunctuation", hr, "Roman Hanging Punctuation");
@@ -572,6 +730,17 @@ struct FontSearch {
 }
 
 /// Shared font menu for Character and Properties: search, recent fonts and previews.
+/// Finish a font rescan started from the font menu and report how many faces it added.
+/// While the scan is still walking font folders, ask for another frame so the menu updates.
+pub(crate) fn poll_font_rescan(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    if effectcraft_engine::text::fonts::rescan_busy() {
+        ctx.request_repaint_after(std::time::Duration::from_millis(100));
+    }
+    if let Some(n) = effectcraft_engine::text::fonts::poll_rescan() {
+        app.ui.status = format!("{} +{n}", tr("Rescan Fonts"));
+    }
+}
+
 pub(super) fn font_picker(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: egui::Id, rect: Rect, current: &str, auto: &str, enabled: bool) -> Option<String> {
     let state_id = id.with("search-state");
     app.auto.add(auto, rect, "Font family");
@@ -610,7 +779,10 @@ pub(super) fn font_picker(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: egui:
         search.request_focus();
     }
     ui.memory_mut(|m| m.set_focus_lock_filter(search_id, egui::EventFilter { vertical_arrows: true, escape: true, ..Default::default() }));
-    if widgets::icon_button(ui, arrow, crate::icons::Icon::ChevronDown, false, &t, id.with("arrow")).clicked() {
+    if widgets::icon_button(ui, arrow, crate::icons::Icon::ChevronDown, false, &t, id.with("arrow"))
+        .on_hover_text(crate::i18n::tr("Close font search"))
+        .clicked()
+    {
         ui.data_mut(|d| {
             d.insert_temp(id.with("open"), false);
             d.remove::<FontSearch>(state_id);
@@ -619,130 +791,139 @@ pub(super) fn font_picker(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: egui:
         return None;
     }
     app.auto.add(&format!("{auto}.toggle"), arrow, "Close font list");
-    let mut chosen = None;
-    let screen = ui.ctx().content_rect();
-    let below = screen.bottom() - rect.bottom() - 16.0;
-    let above = below < 100.0 && rect.top() - screen.top() > below;
-    let max_height = (if above { rect.top() - screen.top() - 16.0 } else { below }).clamp(28.0, 380.0);
-    let anchor = if above { rect.left_top() } else { rect.left_bottom() };
-    let pivot = if above { Align2::LEFT_BOTTOM } else { Align2::LEFT_TOP };
     widgets::note_open_popup_list(ui.ctx());
-    let area = egui::Area::new(id.with("area")).order(egui::Order::Foreground).pivot(pivot).fixed_pos(anchor).show(ui.ctx(), |ui| {
-        egui::Frame::popup(ui.style()).show(ui, |ui| {
-            ui.set_width(rect.width().max(180.0));
-            // Filter row: a checkbox that keeps only the variable fonts.
-            let filter_h = 22.0;
-            let row = ui.add_sized([ui.available_width(), filter_h], egui::Button::selectable(false, ""));
-            let box_rect = Rect::from_min_size(row.rect.min, vec2(18.0, filter_h));
-            let label_rect = Rect::from_min_max(pos2(box_rect.max.x + 2.0, row.rect.min.y), row.rect.max);
-            let boxed = widgets::checkbox(ui, box_rect, only_variable, &t, id.with("variable-check"));
-            ui.painter().text(label_rect.left_center(), Align2::LEFT_CENTER, tr("Variable fonts only"), Tokens::ui(11.5), t.text);
-            app.auto.add(&format!("{auto}.variable"), row.rect, "Variable fonts only");
-            let toggled = row.clicked() || boxed.clicked();
-            if toggled {
-                only_variable = !only_variable;
-                ui.data_mut(|d| d.insert_temp(variable_id, only_variable));
-                // Typing goes on into the search field.
-                ui.memory_mut(|m| m.request_focus(search_id));
+    let changed = search.changed();
+    let mut open = true;
+    // The search lives in the field; the menu's header is the filter row, its list the fonts.
+    let menu = craft_ui::combo::Menu::new(ui, &search)
+        .open(&mut open)
+        .height(380.0)
+        .close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside)
+        .style(egui::style::StyleModifier::default());
+    let app_ref = &mut *app;
+    let header = |ui: &mut egui::Ui| {
+        ui.set_width(rect.width().max(180.0));
+        // Filter row: a checkbox that keeps only the variable fonts.
+        let filter_h = 22.0;
+        let row = ui.add_sized([ui.available_width(), filter_h], widgets::DragCheckbox::new(&mut only_variable, tr("Variable fonts only")));
+        app_ref.auto.add(&format!("{auto}.variable"), row.rect, "Variable fonts only");
+        // #1089: fonts installed after launch appear without restarting. The button is its own
+        // row: the popup is only 180 px wide, so a control pinned to the filter row covers
+        // "Variable fonts only". The scan itself runs off the UI thread (`poll_font_rescan`).
+        let rescan_h = 22.0;
+        let (resc, _) = ui.allocate_exact_size(vec2(ui.available_width(), rescan_h), egui::Sense::hover());
+        if widgets::text_button(ui, resc, tr("Rescan Fonts"), false, &t, id.with("rescan")).clicked() && effectcraft_engine::text::fonts::start_rescan() {
+            app_ref.ui.status = format!("{}…", tr("Rescan Fonts"));
+        }
+        app_ref.auto.add(&format!("{auto}.rescan"), resc, "Rescan Fonts");
+        let toggled = row.changed();
+        if toggled {
+            ui.data_mut(|d| d.insert_temp(variable_id, only_variable));
+        }
+        // The native checkbox can take focus on release after changing on press.
+        // Typing goes on into the search field after either event.
+        if toggled || row.clicked() {
+            ui.memory_mut(|m| m.request_focus(search_id));
+        }
+        let query = state.query.trim().to_lowercase();
+        let mut seen = std::collections::HashSet::new();
+        let filtered: Vec<_> = rows
+            .iter()
+            .filter(|r| {
+                !r.family.is_empty()
+                    && (!only_variable || r.variable)
+                    && (query.is_empty() || ((r.family.to_lowercase().contains(&query) || r.display.to_lowercase().contains(&query)) && seen.insert(&r.family)))
+            })
+            .collect();
+        if fresh {
+            state.selected = filtered.iter().position(|r| r.family == current).unwrap_or(0);
+        }
+        if changed || toggled {
+            state.selected = 0;
+        }
+        let last = filtered.len().saturating_sub(1);
+        state.selected = state.selected.min(last);
+        if down {
+            state.selected = state.selected.saturating_add(1).min(last);
+        }
+        if up {
+            state.selected = state.selected.saturating_sub(1);
+        }
+        let entered = if enter { filtered.get(state.selected).map(|r| r.family.clone()) } else { None };
+        (app_ref, filtered, query.is_empty(), state.selected, changed || toggled, entered)
+    };
+    let list = |ui: &mut egui::Ui,
+                (app, filtered, all, selected, restart, entered): (
+        &mut EffectcraftApp,
+        Vec<&effectcraft_engine::FontRow>,
+        bool,
+        usize,
+        bool,
+        Option<String>,
+    )| {
+        if restart {
+            ui.scroll_to_cursor(Some(egui::Align::TOP));
+        }
+        let mut chosen = entered;
+        if filtered.is_empty() {
+            let r = ui.label(tr("No matching fonts"));
+            app.auto.add(&format!("{auto}.empty"), r.rect, "No matching fonts");
+        }
+        let mut was_recent = false;
+        for (index, r) in filtered.iter().enumerate() {
+            if all && was_recent && !r.recent {
+                ui.separator();
             }
-            let query = state.query.trim().to_lowercase();
-            let mut seen = std::collections::HashSet::new();
-            let filtered: Vec<_> = rows
-                .iter()
-                .filter(|r| {
-                    !r.family.is_empty()
-                        && (!only_variable || r.variable)
-                        && (query.is_empty()
-                            || ((r.family.to_lowercase().contains(&query) || r.display.to_lowercase().contains(&query)) && seen.insert(&r.family)))
-                })
-                .collect();
-            if fresh {
-                state.selected = filtered.iter().position(|r| r.family == current).unwrap_or(0);
+            was_recent = r.recent;
+            let row_width = ui.available_width();
+            let label_width = if preview { (row_width - 100.0).max(40.0) } else { row_width };
+            let resp = ui.add_sized([row_width, 24.0], egui::Button::selectable(index == selected, ""));
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), index == selected, &r.display));
+            let label_rect = Rect::from_min_size(resp.rect.min + vec2(5.0, 0.0), vec2(label_width - 5.0, resp.rect.height()));
+            let name = drawn_font_name(ui.ctx(), r);
+            ui.painter().with_clip_rect(label_rect.intersect(ui.clip_rect())).text(
+                label_rect.left_center(),
+                Align2::LEFT_CENTER,
+                name,
+                Tokens::ui(12.0),
+                t.text,
+            );
+            if ui.is_rect_visible(resp.rect) {
+                app.auto.add(&format!("{auto}.option.{}", r.family), resp.rect, &r.display);
             }
-            if search.changed() || toggled {
-                state.selected = 0;
+            if index == selected && (fresh || up || down) {
+                resp.scroll_to_me(None);
             }
-            let last = filtered.len().saturating_sub(1);
-            state.selected = state.selected.min(last);
-            if down {
-                state.selected = state.selected.saturating_add(1).min(last);
-            }
-            if up {
-                state.selected = state.selected.saturating_sub(1);
-            }
-            if enter {
-                chosen = filtered.get(state.selected).map(|r| r.family.clone());
-            }
-            // Give the result list its actual height even when the previous query had
-            // only one row. A cached tiny Area must not collapse a reopened long list.
-            let filter_room = filter_h + ui.spacing().item_spacing.y;
-            let height = (filtered.len() as f32 * (24.0 + ui.spacing().item_spacing.y) + 16.0).clamp(28.0, (max_height - filter_room).max(28.0));
-            // A minimum, from below the filter row (a maximum would move the cursor back up).
-            ui.set_min_height(height);
-            let mut scroll = egui::ScrollArea::vertical().id_salt(id.with("results")).max_height(height).min_scrolled_height(height);
-            if search.changed() || toggled {
-                scroll = scroll.vertical_scroll_offset(0.0);
-            }
-            scroll.show(ui, |ui| {
-                if filtered.is_empty() {
-                    let r = ui.label(tr("No matching fonts"));
-                    app.auto.add(&format!("{auto}.empty"), r.rect, "No matching fonts");
+            if preview && ui.is_rect_visible(resp.rect) {
+                let key = egui::Id::unique(("font-preview", &r.family));
+                let lines: std::sync::Arc<Vec<Vec<[f32; 2]>>> = match ui.data(|d| d.get_temp(key)) {
+                    Some(l) => l,
+                    None => {
+                        let l = std::sync::Arc::new(effectcraft_engine::font_preview(&r.family, 14.0));
+                        ui.data_mut(|d| d.insert_temp(key, l.clone()));
+                        l
+                    }
+                };
+                // Scaled and placed to fit the row's preview column, and clipped to the row (#577).
+                let room = Rect::from_min_max(pos2(resp.rect.max.x - 95.0, resp.rect.min.y + 1.0), pos2(resp.rect.max.x - 6.0, resp.rect.max.y - 1.0));
+                if let Some((k, o)) = fit_preview(&lines, room, resp.rect.center().y + 5.0) {
+                    let painter = ui.painter().with_clip_rect(resp.rect.intersect(ui.clip_rect()));
+                    for poly in lines.iter() {
+                        let pts: Vec<egui::Pos2> =
+                            poly.iter().filter(|p| p[0].is_finite() && p[1].is_finite()).map(|p| (o + vec2(p[0], p[1]) * k).to_pos2()).collect();
+                        painter.add(egui::Shape::line(pts, egui::Stroke::new(1.0, t.text_dim)));
+                    }
                 }
-                let mut was_recent = false;
-                for (index, r) in filtered.iter().enumerate() {
-                    if query.is_empty() && was_recent && !r.recent {
-                        ui.separator();
-                    }
-                    was_recent = r.recent;
-                    let row_width = ui.available_width();
-                    let label_width = if preview { (row_width - 100.0).max(40.0) } else { row_width };
-                    let resp = ui.add_sized([row_width, 24.0], egui::Button::selectable(index == state.selected, ""));
-                    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, ui.is_enabled(), index == state.selected, &r.display));
-                    let label_rect = Rect::from_min_size(resp.rect.min + vec2(5.0, 0.0), vec2(label_width - 5.0, resp.rect.height()));
-                    ui.painter().with_clip_rect(label_rect.intersect(ui.clip_rect())).text(
-                        label_rect.left_center(),
-                        Align2::LEFT_CENTER,
-                        &r.display,
-                        Tokens::ui(12.0),
-                        t.text,
-                    );
-                    if ui.is_rect_visible(resp.rect) {
-                        app.auto.add(&format!("{auto}.option.{}", r.family), resp.rect, &r.display);
-                    }
-                    if index == state.selected && (fresh || up || down) {
-                        resp.scroll_to_me(None);
-                    }
-                    if preview && ui.is_rect_visible(resp.rect) {
-                        let key = egui::Id::new(("font-preview", &r.family));
-                        let lines: std::sync::Arc<Vec<Vec<[f32; 2]>>> = match ui.data(|d| d.get_temp(key)) {
-                            Some(l) => l,
-                            None => {
-                                let l = std::sync::Arc::new(effectcraft_engine::font_preview(&r.family, 14.0));
-                                ui.data_mut(|d| d.insert_temp(key, l.clone()));
-                                l
-                            }
-                        };
-                        // Scaled and placed to fit the row's preview column, and clipped to the row (#577).
-                        let room = Rect::from_min_max(pos2(resp.rect.max.x - 95.0, resp.rect.min.y + 1.0), pos2(resp.rect.max.x - 6.0, resp.rect.max.y - 1.0));
-                        if let Some((k, o)) = fit_preview(&lines, room, resp.rect.center().y + 5.0) {
-                            let painter = ui.painter().with_clip_rect(resp.rect.intersect(ui.clip_rect()));
-                            for poly in lines.iter() {
-                                let pts: Vec<egui::Pos2> =
-                                    poly.iter().filter(|p| p[0].is_finite() && p[1].is_finite()).map(|p| (o + vec2(p[0], p[1]) * k).to_pos2()).collect();
-                                painter.add(egui::Shape::line(pts, egui::Stroke::new(1.0, t.text_dim)));
-                            }
-                        }
-                    }
-                    if resp.clicked() {
-                        chosen = Some(r.family.clone());
-                    }
-                    resp.on_hover_text(&r.display);
-                }
-            });
-        });
-    });
-    let outside = widgets::pressed_outside(ui.ctx(), &area.response) && !ui.input(|i| i.pointer.interact_pos().is_some_and(|p| rect.contains(p)));
-    if chosen.is_some() || outside || escape {
+            }
+            if resp.clicked() {
+                chosen = Some(r.family.clone());
+            }
+            resp.on_hover_text(name);
+        }
+        chosen
+    };
+    let chosen = menu.show_ui_with_header(header, list).flatten();
+    if chosen.is_some() || !open || escape {
         ui.data_mut(|d| {
             d.insert_temp(id.with("open"), false);
             d.remove::<FontSearch>(state_id);
@@ -765,7 +946,7 @@ pub fn align(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     p.text(pos2(x0, y + 10.0), Align2::LEFT_CENTER, tr("Align Layers to:"), Tokens::ui(11.5), t.text_dim);
     let dr = Rect::from_min_size(pos2(x0 + 100.0, y), vec2(110.0, 20.0));
     let to_sel = app.ui.align_to_selection;
-    let pid = egui::Id::new("align-to-pop");
+    let pid = egui::Id::unique("align-to-pop");
     if widgets::dropdown(ui, dr, if to_sel { "Selection" } else { "Composition" }, &t, pid.with("btn")).clicked() {
         widgets::open_popup(ui, pid);
     }
@@ -785,7 +966,7 @@ pub fn align(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         for (i, op) in ops.iter().enumerate() {
             let r = Rect::from_min_size(pos2(x0 + i as f32 * 34.0 + if i >= 3 { 12.0 } else { 0.0 }, y), vec2(30.0, 28.0));
-            let resp = ui.interact(r, egui::Id::new((kind, *op)), Sense::click());
+            let resp = ui.interact(r, egui::Id::unique((kind, *op)), Sense::click());
             p.rect_filled(r, 3.0, if resp.hovered() { t.hover } else { t.field_bg });
             align_glyph(&p, r, op, row == 1, &t);
             let tip = align_tip(kind, op);
@@ -883,6 +1064,13 @@ fn align_glyph(p: &egui::Painter, r: Rect, op: &str, distribute: bool, t: &Token
     }
 }
 
+/// The name a font menu row draws: the font's own-language name when the interface fonts have a
+/// glyph for each of its characters, else its English family name. A Simplified Chinese name
+/// such as 微软雅黑 can have characters that the Han face of an English interface lacks.
+fn drawn_font_name<'a>(ctx: &egui::Context, row: &'a effectcraft_engine::FontRow) -> &'a str {
+    if ctx.fonts_mut(|f| f.has_glyphs(&Tokens::ui(12.0), &row.display)) { &row.display } else { &row.family }
+}
+
 /// Where a font's "Sample" outlines (`lines`, baseline at y = 0) go in `room`: `(scale, origin)`,
 /// a point `p` landing at `origin + p * scale`. At their natural size on `baseline` when they fit;
 /// fonts with large or odd metrics are scaled down (never up) and moved inside, so no preview
@@ -941,4 +1129,17 @@ mod tests {
         assert!(fit_preview(&[], room, baseline).is_none());
         assert!(fit_preview(&[vec![[f32::NAN, 1.0]]], room, baseline).is_none());
     }
+
+    /// A font menu row draws the font's own-language name when the interface fonts have its
+    /// glyphs, and the English family name when they do not.
+    #[test]
+    fn font_menu_rows_draw_a_name_the_interface_fonts_have() {
+        let ctx = egui::Context::default();
+        crate::theme::install(&ctx, &Tokens::for_kind(Default::default()), "en");
+        ctx.run_ui(Default::default(), |_| {}).textures_delta.clear();
+        let row = |display: &str| effectcraft_engine::FontRow { family: "Menu Name Test".into(), display: display.into(), recent: false, variable: false };
+        // U+F1234 is in a private use plane that no interface font maps.
+        assert_eq!(drawn_font_name(&ctx, &row("Menu \u{F1234}")), "Menu Name Test");
+        assert_eq!(drawn_font_name(&ctx, &row("Nom du menu")), "Nom du menu");
+    }
 }
diff --git a/crates/ui-egui/src/panels/text_range_handles.rs b/crates/ui-egui/src/panels/text_range_handles.rs
index bb5f01e36..6ab7ee2b8 100644
--- a/crates/ui-egui/src/panels/text_range_handles.rs
+++ b/crates/ui-egui/src/panels/text_range_handles.rs
@@ -106,7 +106,7 @@ pub fn viewer_hook(
                 // A short grab zone around the triangle, so the line above doesn't steal the
                 // layer's scale handles.
                 let hr = Rect::from_two_pos(sp, sp + up * 8.0 + inward * 6.0).expand(3.0);
-                let id = egui::Id::new(("viewer-text-range", pr.uid));
+                let id = egui::Id::unique(("viewer-text-range", pr.uid));
                 let on_box_handle = ctx.pointer_latest_pos().is_some_and(|p| box_handles.iter().any(|c| c.distance(p) < 9.0));
                 let free = ctx.is_being_dragged(id) || !on_box_handle;
                 let resp = (interactive && free).then(|| ui.interact(hr, id, Sense::drag()));
diff --git a/crates/ui-egui/src/panels/timeline.rs b/crates/ui-egui/src/panels/timeline.rs
index b34fbd9d3..d7017e7fd 100644
--- a/crates/ui-egui/src/panels/timeline.rs
+++ b/crates/ui-egui/src/panels/timeline.rs
@@ -8,13 +8,16 @@
 
 use effectcraft_engine::color::BlendMode;
 use effectcraft_engine::keyframe::{Interp, Value};
-use effectcraft_engine::project::{Comp, GroupKind, ItemId, Layer, LayerId, LayerSource, MatteKind, Node, ParamUi, PropGroup, Property};
+use effectcraft_engine::project::{
+    Comp, FootageKind, GroupKind, ItemId, ItemKind, Layer, LayerId, LayerSource, MatteKind, Node, ParamUi, Project, PropGroup, Property,
+};
 use effectcraft_engine::render::EvalCtx;
 use effectcraft_engine::time::Tick;
-use egui::{Align2, Color32, Pos2, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use egui::{Align2, Color32, Pos2, Rect, Sense, Stroke, StrokeKind, Vec2, pos2, vec2};
 use serde_json::json;
+use std::sync::Arc;
 
-use crate::i18n::tr;
+use crate::i18n::{tr, tr_args};
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
 use crate::{EffectcraftApp, widgets};
@@ -74,6 +77,17 @@ pub(crate) fn bar_color(label: Color32, selected: bool) -> Color32 {
 const TRIM_OUTSIDE: f32 = 4.0;
 const TRIM_INSIDE: f32 = 5.0;
 
+/// A middle-drag in the timeline pans it (`hand_tool_pan`, #2854): a middle press here starts no
+/// drag, so it can't move a bar or a key. A widget that takes a drag on press was given it this frame,
+/// before anything here ran. Handing that drag to an id nothing uses and ending it means no
+/// widget sees it start or stop.
+fn ignore_middle_press(ui: &egui::Ui, rect: Rect) {
+    if ui.rect_contains_pointer(rect) && ui.input(|i| i.pointer.button_pressed(egui::PointerButton::Middle) && !i.pointer.primary_down()) {
+        ui.ctx().set_dragged_id(egui::Id::unique("tl-middle-press"));
+        ui.ctx().stop_dragging();
+    }
+}
+
 /// A layer bar's body (drag to move) and its In/Out trim zones. Short bars keep their middle
 /// third as body; a bar too short for that is all trim zones (the Out one on top).
 fn trim_zones(bar: Rect) -> (Rect, Rect, Rect) {
@@ -121,7 +135,7 @@ const EXPR_MAX_LINES: usize = 100;
 
 /// The text of the expression being edited (while its editor has the keyboard).
 fn expr_buf_id(prop: u64) -> egui::Id {
-    egui::Id::new(("expr-buf", prop))
+    egui::Id::unique(("expr-buf", prop))
 }
 
 /// Insert an expression editor row after every property that has an expression: as many lines
@@ -155,35 +169,57 @@ fn with_expr_rows(rows: Vec<Row>, comp: &Comp, tl: &crate::state::TimelineState,
 }
 
 /// A pick-whip drag in progress: (kind, layer, prop uid, start point). The kinds are the
-/// layer's parent pick whip, an expression's and a property's (Parent & Link column).
+/// layer's parent pick whip, an expression's, a property's (Parent & Link column) and the layer's
+/// track matte pick whip.
 type PickWhip = (u8, u64, u64, Pos2);
 const WHIP_PARENT: u8 = 0;
 const WHIP_EXPR: u8 = 1;
 const WHIP_PROP: u8 = 2;
+const WHIP_MATTE: u8 = 3;
 
+/// The `egui::Id` under which a pick-whip drag in progress ([`PickWhip`]) is kept during the
+/// drag.
 fn pick_whip_id() -> egui::Id {
-    egui::Id::new("tl-pickwhip")
+    egui::Id::unique("tl-pickwhip")
+}
+
+/// The layers a layer pick whip (parent, track matte) links, taken as its drag starts.
+fn whip_layers_id() -> egui::Id {
+    egui::Id::unique("tl-pickwhip-layers")
+}
+
+/// The automation id, label and hover hint of a pick whip.
+struct WhipText<'a> {
+    auto: &'a str,
+    label: &'a str,
+    hint: &'a str,
 }
 
 /// A pick whip at `rect`: dragging it starts a pick whip of `kind` from `layer`'s `prop` (0 for
 /// the layer's own), drawn and dropped at the end of [`show`].
-#[allow(clippy::too_many_arguments)]
 fn pick_whip(
     app: &mut EffectcraftApp,
     ui: &egui::Ui,
     p: &egui::Painter,
     rect: Rect,
     (kind, layer, prop): (u8, u64, u64),
-    auto: &str,
-    label: &str,
-    hint: &str,
+    text: WhipText<'_>,
 ) -> egui::Response {
-    let resp = ui.interact(rect, egui::Id::new(("pick-whip", kind, layer, prop)), Sense::drag()).on_hover_text(hint);
+    let WhipText { auto, label, hint } = text;
+    let resp = ui.interact(rect, egui::Id::unique(("pick-whip", kind, layer, prop)), Sense::drag()).on_hover_text(hint);
     icons::paint(p, rect.shrink(1.0), Icon::PickWhip, if resp.hovered() || resp.dragged() { app.tokens.text } else { app.tokens.text_dim });
     app.auto.add(auto, rect, label);
     if resp.drag_started() {
         let state: PickWhip = (kind, layer, prop, rect.center());
-        ui.ctx().data_mut(|d| d.insert_temp(pick_whip_id(), state));
+        let selected = &app.session.state.selected_layers;
+        let layers = match (kind, app.session.active_comp()) {
+            (WHIP_MATTE, Some(comp)) => video_targets(comp, LayerId(layer), selected),
+            _ => edited_layers(LayerId(layer), selected),
+        };
+        ui.ctx().data_mut(|d| {
+            d.insert_temp(pick_whip_id(), state);
+            d.insert_temp(whip_layers_id(), layers);
+        });
     }
     resp
 }
@@ -192,8 +228,10 @@ fn pick_whip(
 /// (row, layer, prop uid, its value fields per dimension), and the pass they were shown in.
 type WhipTargets = (u64, Vec<(Rect, u64, u64, Vec<Rect>)>);
 
+/// The `egui::Id` of the drop targets other panels register for a pick-whip drag
+/// ([`whip_target`]); [`show`] clears it when the whip is released or dropped.
 fn whip_targets_id() -> egui::Id {
-    egui::Id::new("tl-pickwhip-targets")
+    egui::Id::unique("tl-pickwhip-targets")
 }
 
 /// While a pick whip is being dragged, `layer`'s property `prop` shown at `row` in another panel
@@ -261,14 +299,33 @@ fn centered_on(span: f64, duration: f64, cti: f64) -> f64 {
 /// it (characters): the pick whip's reference goes in there.
 type WhipInto = (String, [usize; 2]);
 
+/// The `egui::Id` under which the expression text captured by an expression pick whip
+/// ([`WhipInto`]) is held for property `prop` until that editor is drawn again.
 fn whip_into_id(prop: u64) -> egui::Id {
-    egui::Id::new(("tl-pickwhip-into", prop))
+    egui::Id::unique(("tl-pickwhip-into", prop))
 }
 
-/// After a pick whip into the expression being edited: its editor takes the focus back, the
-/// cursor this many characters before the end (just after the reference).
-fn expr_refocus_id(prop: u64) -> egui::Id {
-    egui::Id::new(("tl-expr-refocus", prop))
+/// An expression editor to take the keyboard when it is next drawn: its property, the text to
+/// select as counts of characters before the end (so it fits the expression as it will be then)
+/// and the pass it was asked for in. After a pick whip into the expression being edited, the
+/// cursor goes just after the reference; after an Alt-click on a stopwatch adds an expression,
+/// its whole text is selected, so typing replaces it.
+#[derive(Clone, Copy, Debug)]
+struct ExprFocus {
+    prop: u64,
+    select: [usize; 2],
+    pass: u64,
+}
+
+/// The `egui::Id` of the pending [`ExprFocus`]: which expression editor takes the keyboard on
+/// its next draw, and what to select in it.
+fn expr_focus_id() -> egui::Id {
+    egui::Id::unique("tl-expr-focus")
+}
+
+fn focus_expression(ctx: &egui::Context, prop: u64, select: [usize; 2]) {
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data_mut(|d| d.insert_temp(expr_focus_id(), ExprFocus { prop, select, pass }));
 }
 
 #[derive(Clone, Debug)]
@@ -460,6 +517,67 @@ fn column_at(cw: &Cols, x: f32) -> Option<&'static str> {
     spans.into_iter().find(|(_, on, a, b)| *on && x >= *a && x < *b).map(|s| s.0)
 }
 
+/// The column headers that show an icon or a symbol instead of a name, and what hovering one
+/// says: (column, key, short name, explanation), in the order the header draws them. Over a layer
+/// switch the key is that switch's name, and the row's switch shows the same text
+/// ([`switch_tip`]).
+pub const HEADER_TIPS: [(&str, &str, &str, &str); 15] = [
+    ("av", "video", "Video", "Video: shows or hides the layer's picture in the composition"),
+    ("av", "audio", "Audio", "Audio: turns the layer's sound on or off"),
+    ("av", "solo", "Solo", "Solo: while any layer is soloed, only the soloed layers render"),
+    ("av", "lock", "Lock", "Lock: keeps the layer from being selected or changed"),
+    ("label", "label", "Label", "Label: the layer's color label; click a layer's swatch to pick another"),
+    ("num", "num", "#", "Layer number: the layer's place in the stack, counted from the top"),
+    ("switches", "shy", "Shy", "Shy: the layer leaves the Timeline while Hide Shy Layers is on"),
+    (
+        "switches",
+        "collapse",
+        "Collapse Transformations / Continuously Rasterize",
+        "Collapse Transformations / Continuously Rasterize: a precomposition's layers render straight into this composition; a vector layer is redrawn sharp at every scale",
+    ),
+    ("switches", "quality", "Quality and Sampling", "Quality and Sampling: Draft renders faster; Best renders with subpixel accuracy and smooth sampling"),
+    ("switches", "fx", "Effect", "Effect: turns the layer's effects on or off"),
+    ("switches", "frameBlend", "Frame Blending", "Frame Blending: smooths footage whose speed or frame rate differs from the composition's"),
+    ("switches", "motionBlur", "Motion Blur", "Motion Blur: blurs the layer along its movement while the composition's Motion Blur is on"),
+    ("switches", "adjustment", "Adjustment Layer", "Adjustment Layer: the layer's effects apply to every layer below it"),
+    ("switches", "threeD", "3D Layer", "3D Layer: the layer moves and turns in depth and reacts to cameras and lights"),
+    (
+        "modes",
+        "preserveTransparency",
+        "Preserve Transparency",
+        "Preserve Transparency: the layer shows only over the layers below it, and only as opaque as they are",
+    ),
+];
+
+/// The hover text of the layer switch (or the header over it) named `key`.
+fn switch_tip(key: &str) -> Option<&'static str> {
+    HEADER_TIPS.iter().find(|t| t.1 == key).map(|t| t.3)
+}
+
+/// Where each shown entry of [`HEADER_TIPS`] sits in the column header row `ch`: (column, key,
+/// rect), over the icon the header draws there. Hidden columns give none.
+fn header_tip_rects(cw: &Cols, ch: Rect) -> Vec<(&'static str, &'static str, Rect)> {
+    let v = cw.vis;
+    let mut out = Vec::new();
+    for (col, key, _, _) in HEADER_TIPS {
+        // The icon's place among its column's icons.
+        let i = HEADER_TIPS.iter().filter(|t| t.0 == col).position(|t| t.1 == key).unwrap_or(0) as f32;
+        let span = match col {
+            "av" => v.av.then_some((cw.av + 1.0 + 18.0 * i, 18.0)),
+            "label" => v.label.then_some((cw.label, LABEL_W)),
+            "num" => v.num.then_some((cw.num, NUM_W)),
+            "switches" => v.switches.then_some((cw.switches + SW * i, SW)),
+            // The `T` over the rows' Preserve Transparency boxes.
+            "modes" => v.modes.then_some((cw.mode + 72.0, 18.0)),
+            _ => None,
+        };
+        if let Some((x, w)) = span {
+            out.push((col, key, Rect::from_min_max(pos2(x, ch.min.y), pos2(x + w, ch.max.y))));
+        }
+    }
+    out
+}
+
 /// Snap a time to the nearest candidate within `tolerance` (all seconds); Shift-dragging the
 /// current-time indicator snaps to keyframes, layer in/out points, markers and the work area.
 pub fn snap_time(candidates: &[f64], t: f64, tolerance: f64) -> f64 {
@@ -515,6 +633,19 @@ impl TMap {
     }
 }
 
+fn disk_bar_range(tm: &TMap, clip: Rect, fd: f64, frames: i64) -> std::ops::Range<i64> {
+    if clip.width() <= 0.0 || clip.height() <= 0.0 || !fd.is_finite() || fd <= 0.0 || !tm.pps.is_finite() || tm.pps <= 0.0 {
+        return 0..0;
+    }
+    let start = tm.t(clip.min.x) / fd;
+    let end = tm.t(clip.max.x) / fd;
+    if !start.is_finite() || !end.is_finite() {
+        return 0..0;
+    }
+    let limit = frames.clamp(0, 100_000) as f64;
+    (start.clamp(0.0, limit).floor() as i64)..(end.clamp(0.0, limit).ceil() as i64)
+}
+
 /// A Timeline ruler tick label for comp frame `fno`: seconds:frames (`00:15f`, AE) or, when
 /// the project's Time Display Style is Frames, the frame number the current-time display shows
 /// (`00015`, counted from Start Numbering Frames At) (#710).
@@ -530,8 +661,10 @@ fn ruler_label(fno: i64, fps_i: i64, settings: &effectcraft_engine::project::Pro
     }
 }
 
+/// The `egui::Id` under which [`show`] records this frame's time mapping as `(x0, start, pps)`,
+/// i.e. the [`TMap`] fields it lays the ruler and graph out with.
 fn tl_map_id() -> egui::Id {
-    egui::Id::new("timeline-map")
+    egui::Id::unique("timeline-map")
 }
 
 /// The column right of the time graph: the composition marker bin over the layers' scroll bar.
@@ -564,7 +697,7 @@ pub(crate) fn set_zoom(tl: &mut crate::state::TimelineState, comp: &Comp, pps: f
 
 /// `;`: from the whole comp, zoom in to frame level around the CTI; otherwise show the whole comp.
 pub fn toggle_frame_zoom(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    let Some((_, w)) = ctx.data(|d| d.get_temp::<(f32, f32)>(egui::Id::new("timeline-graph-area"))) else { return };
+    let Some((_, w)) = ctx.data(|d| d.get_temp::<(f32, f32)>(egui::Id::unique("timeline-graph-area"))) else { return };
     let Some(comp) = app.session.active_comp_arc() else { return };
     let fit = fit_pps(w, &comp);
     if app.ui.timeline.pps.is_some_and(|p| p > fit) {
@@ -585,14 +718,14 @@ pub fn toggle_fit_zoom(app: &mut EffectcraftApp, ctx: &egui::Context) {
         return;
     }
     let Some((start, pps)) = tl.before_fit.take() else { return };
-    let Some((_, w)) = ctx.data(|d| d.get_temp::<(f32, f32)>(egui::Id::new("timeline-graph-area"))) else { return };
+    let Some((_, w)) = ctx.data(|d| d.get_temp::<(f32, f32)>(egui::Id::unique("timeline-graph-area"))) else { return };
     let Some(comp) = app.session.active_comp_arc() else { return };
     set_zoom(&mut app.ui.timeline, &comp, pps, fit_pps(w, &comp), start, 0.0);
 }
 
 /// Zoom the time ruler around the CTI.
 pub fn zoom(app: &mut EffectcraftApp, ctx: &egui::Context, k: f64) {
-    let Some((_, w)) = ctx.data(|d| d.get_temp::<(f32, f32)>(egui::Id::new("timeline-graph-area"))) else { return };
+    let Some((_, w)) = ctx.data(|d| d.get_temp::<(f32, f32)>(egui::Id::unique("timeline-graph-area"))) else { return };
     let Some(comp) = app.session.active_comp_arc() else { return };
     let fit = fit_pps(w, &comp);
     let pps = app.ui.timeline.pps.unwrap_or(fit);
@@ -673,18 +806,20 @@ fn double_click_action(layer: &Layer) -> Option<(String, serde_json::Value)> {
 /// Open the rename field on layer `id`; it takes the keyboard focus on its first frame only.
 fn start_rename(ctx: &egui::Context, id: u64, name: &str) {
     ctx.data_mut(|d| {
-        d.insert_temp(egui::Id::new("tl-rename"), (id, name.to_string()));
+        d.insert_temp(egui::Id::unique("tl-rename"), (id, name.to_string()));
         d.insert_temp(rename_focus_id(), true);
     });
 }
 
 /// The Timeline's open group rename field: (layer, group uid, text).
 fn group_rename_id() -> egui::Id {
-    egui::Id::new("tl-group-rename")
+    egui::Id::unique("tl-group-rename")
 }
 
+/// The `egui::Id` of the one-shot flag that makes the open layer rename field take the keyboard
+/// on its first frame (see [`start_rename`]).
 fn rename_focus_id() -> egui::Id {
-    egui::Id::new("tl-rename-focus")
+    egui::Id::unique("tl-rename-focus")
 }
 
 fn group_visible(g: &PropGroup, layer: &Layer) -> bool {
@@ -747,15 +882,21 @@ fn display_name(app: &EffectcraftApp, l: &Layer) -> String {
 /// layer whose names contain `q` (lowercase), each with its enclosing groups. A matching group
 /// brings its whole contents.
 fn search_rows(l: &Layer, q: &str) -> Vec<Row> {
+    /// The row for a group in search results: depth, its effect's enabled flag, and its eye
+    /// switch ([`eye_of`]).
     fn group_row(l: &Layer, g: &PropGroup, depth: usize, parent: &PropGroup) -> Row {
         let fx = matches!(g.kind, GroupKind::Effect { .. }).then_some(g.enabled);
-        let eye =
-            (parent.match_id == effectcraft_engine::project::styles::GROUP && g.match_id != effectcraft_engine::project::styles::BLENDING).then_some(g.enabled);
+        let eye = eye_of(parent, g);
         Row { layer: l.id, depth, kind: RowKind::Group { uid: g.uid, name: g.name.clone(), open: true, has_children: !g.children.is_empty(), fx, eye } }
     }
+    /// Every visible child of `g` at `depth`, groups recursed into whole — a matching group
+    /// brings its contents. A shape group's inner Contents is elided (as in AE): no row, and
+    /// its items list at the same depth as the group itself.
     fn all(l: &Layer, g: &PropGroup, depth: usize, out: &mut Vec<Row>) {
         for c in &g.children {
             match c {
+                // A shape group's inner Contents is elided (as in AE): no row, items at the same depth.
+                Node::Group(sg) if g.match_id == "group" && sg.match_id == "contents" => all(l, sg, depth, out),
                 Node::Group(sg) => {
                     out.push(group_row(l, sg, depth, g));
                     all(l, sg, depth + 1, out);
@@ -765,9 +906,14 @@ fn search_rows(l: &Layer, q: &str) -> Vec<Row> {
             }
         }
     }
+    /// The children of `g` that match `q`: a name-matching group brings its whole contents
+    /// (`all`); otherwise the search recurses and keeps only subtrees with hits. A shape
+    /// group's inner Contents is searched through without a row of its own (as in AE).
     fn rec(l: &Layer, g: &PropGroup, depth: usize, q: &str, out: &mut Vec<Row>) {
         for c in &g.children {
             match c {
+                // A shape group's inner Contents is elided (as in AE): search through it, no row.
+                Node::Group(sg) if g.match_id == "group" && sg.match_id == "contents" => rec(l, sg, depth, q, out),
                 Node::Group(sg) if depth > 1 || group_visible(sg, l) => {
                     // An effect group also matches the name the row draws, so a search finds
                     // `高斯模糊` in a Chinese interface and `Gaussian Blur` in an English one.
@@ -828,6 +974,7 @@ pub(crate) fn visible_props(app: &EffectcraftApp, comp: &Comp) -> Vec<serde_json
         .collect()
 }
 
+/// Project the property tree into Timeline rows; explicit search takes precedence over collapse and shortcut reveals.
 fn build_rows(app: &EffectcraftApp, comp: &Comp) -> Vec<Row> {
     let tl = &app.ui.timeline;
     let search = tl.search.trim().to_lowercase();
@@ -1021,6 +1168,9 @@ fn reveal_rows(app: &EffectcraftApp, l: &Layer, kinds: &[String], rows: &mut Vec
         let mut groups = vec![];
         groups_in(&l.props, reveal_props, &mut groups);
         for g in groups {
+            if shown_groups.contains(&g.uid) {
+                continue;
+            }
             let open = tl.open_groups.contains(&g.uid);
             rows.push(Row {
                 layer: l.id,
@@ -1091,6 +1241,19 @@ fn revealed_rows(
             }
         }
     }
+    // Whole groups already emitted above own their properties, including under mixed reveals.
+    fn props(rows: &mut Vec<Row>, t: &Tree<'_>, g: &PropGroup) {
+        if t.skip.contains(&g.uid) {
+            return;
+        }
+        for child in &g.children {
+            match child {
+                Node::Prop(p) if (t.wanted)(p) => rows.push(Row { layer: t.l.id, depth: 1, kind: RowKind::Prop { uid: p.uid } }),
+                Node::Group(g) => props(rows, t, g),
+                _ => {}
+            }
+        }
+    }
     let wanted = |p: &Property| shown.contains(&p.uid) && prop_visible(p, l);
     let tree = Tree { l, wanted: &wanted, skip, open, full };
     for c in &l.props.children {
@@ -1100,11 +1263,7 @@ fn revealed_rows(
                     group(rows, &tree, e, 1);
                 }
             }
-            Node::Group(g) => {
-                let mut found = vec![];
-                collect_props(g, &mut found, &wanted);
-                rows.extend(found.into_iter().map(|uid| Row { layer: l.id, depth: 1, kind: RowKind::Prop { uid } }));
-            }
+            Node::Group(g) => props(rows, &tree, g),
             Node::Prop(p) if wanted(p) => rows.push(Row { layer: l.id, depth: 1, kind: RowKind::Prop { uid: p.uid } }),
             Node::Prop(_) => {}
         }
@@ -1171,6 +1330,18 @@ fn collect_props(g: &PropGroup, out: &mut Vec<u64>, f: &dyn Fn(&Property) -> boo
     }
 }
 
+/// The rows for the children of `g` at `depth`: groups recurse into when their twirl-down is
+/// in `open`, text animators list their selectors and properties directly (as in AE), and a
+/// shape group's inner Contents (AE's elided `ADBE Vectors Group`) is skipped so its items
+/// list directly under the group.
+/// The eye switch of group `g` inside `parent`, as in After Effects: layer styles (not Blending
+/// Options) and every item in a shape layer's Contents (#959), which the renderer skips when off.
+fn eye_of(parent: &PropGroup, g: &PropGroup) -> Option<bool> {
+    let style = parent.match_id == effectcraft_engine::project::styles::GROUP && g.match_id != effectcraft_engine::project::styles::BLENDING;
+    let shape_item = parent.match_id == "contents" && g.match_id != "transform";
+    (style || shape_item).then_some(g.enabled)
+}
+
 fn push_group(rows: &mut Vec<Row>, l: &Layer, g: &PropGroup, depth: usize, open: &std::collections::BTreeSet<u64>) {
     for c in &g.children {
         match c {
@@ -1178,12 +1349,15 @@ fn push_group(rows: &mut Vec<Row>, l: &Layer, g: &PropGroup, depth: usize, open:
             Node::Group(sg) if g.match_id == "animator" && matches!(sg.match_id.as_str(), "selectors" | "properties") => {
                 push_group(rows, l, sg, depth, open);
             }
+            // A shape group's inner Contents (AE's elided `ADBE Vectors Group`): the group's items
+            // (path, fill/stroke, Transform) list directly under it, with no "Contents" row.
+            Node::Group(sg) if g.match_id == "group" && sg.match_id == "contents" => {
+                push_group(rows, l, sg, depth, open);
+            }
             Node::Group(sg) => {
                 let o = open.contains(&sg.uid);
                 let fx = matches!(sg.kind, GroupKind::Effect { .. }).then_some(sg.enabled);
-                // Layer style groups have eye switches (not Blending Options).
-                let eye = (g.match_id == effectcraft_engine::project::styles::GROUP && sg.match_id != effectcraft_engine::project::styles::BLENDING)
-                    .then_some(sg.enabled);
+                let eye = eye_of(g, sg);
                 rows.push(Row {
                     layer: l.id,
                     depth,
@@ -1224,8 +1398,29 @@ fn layer_icon(l: &Layer, project: &effectcraft_engine::project::Project) -> Icon
 }
 
 /// Layers being dragged to a new place in the stack (timeline rows).
+#[derive(Clone)]
+struct LayerDrag {
+    comp: ItemId,
+    owner: egui::Id,
+    layers: Vec<u64>,
+}
+
 fn layer_drag_id() -> egui::Id {
-    egui::Id::new("tl-layer-drag")
+    egui::Id::unique("tl-layer-drag")
+}
+
+/// An effect, mask, shape item or text animator being dragged to a new place among its
+/// siblings (#2210).
+#[derive(Clone)]
+struct GroupDrag {
+    comp: ItemId,
+    owner: egui::Id,
+    layer: LayerId,
+    uid: u64,
+}
+
+fn group_drag_id() -> egui::Id {
+    egui::Id::unique("tl-group-drag")
 }
 
 /// A keyframe drag in progress: where the pointer started, the grabbed key's comp time
@@ -1239,8 +1434,10 @@ struct KeyDrag {
     quick: Option<usize>,
 }
 
+/// The `egui::Id` of the keyframe drag in progress ([`KeyDrag`]): its start, the grabbed key's
+/// time and how far the selection has moved so far.
 fn key_drag_id() -> egui::Id {
-    egui::Id::new("tl-key-drag")
+    egui::Id::unique("tl-key-drag")
 }
 
 /// A Quick Offset drag of selected layer bars (Ctrl/Cmd+Alt, #1012): the bar it started on, where
@@ -1253,8 +1450,9 @@ struct QuickBar {
     applied: i64,
 }
 
+/// The `egui::Id` of a Quick Offset drag of layer bars in progress ([`QuickBar`]).
 fn quick_bar_id() -> egui::Id {
-    egui::Id::new("tl-quick-bar")
+    egui::Id::unique("tl-quick-bar")
 }
 
 /// How many layers a Quick Offset of `layers` staggers (#1012): the unlocked ones, each once, if
@@ -1277,7 +1475,7 @@ fn quick_offset_note(frames: i64, layers: usize) -> String {
 
 /// A Timeline drag's readout by the pointer (After Effects shows it in the Info panel).
 fn drag_tip(ctx: &egui::Context, t: &Tokens, ptr: Pos2, note: String) {
-    let fg = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("tl-key-drag-tip")));
+    let fg = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("tl-key-drag-tip")));
     let g = fg.layout_no_wrap(note, Tokens::ui(11.5), t.text);
     let r = Rect::from_min_size(ptr + vec2(14.0, 14.0), g.size() + vec2(10.0, 6.0));
     fg.rect_filled(r, 3.0, t.panel_bg);
@@ -1294,8 +1492,10 @@ struct SwitchDrag {
     merge: String,
 }
 
+/// The `egui::Id` of the switch press-and-drag in progress ([`SwitchDrag`]): the switch, the
+/// state the press gave it and the undo step the drag folds into.
 fn switch_drag_id() -> egui::Id {
-    egui::Id::new("tl-switch-drag")
+    egui::Id::unique("tl-switch-drag")
 }
 
 /// The press-and-drag gesture of the Timeline's switches and stopwatches (`switch`, on `row`,
@@ -1314,12 +1514,44 @@ fn switch_gesture(ui: &egui::Ui, resp: &egui::Response, row: Rect, switch: &'sta
     (a.min(b) < row.max.y && a.max(b) >= row.min.y).then_some((d.value, d.merge))
 }
 
-/// A layer's switch (A/V Features and Switches columns) in `row`, with the
-/// [`switch_gesture`].
-#[allow(clippy::too_many_arguments)]
-fn layer_switch(
-    ui: &mut egui::Ui,
-    t: &Tokens,
+/// The layers an edit made on `layer`'s row applies to (a switch, its label, its blending mode,
+/// its parent or track matte, moving its bar): the selection when the row is selected, else that
+/// layer alone, as in After Effects (#1260).
+fn edited_layers(layer: LayerId, selected: &[LayerId]) -> Vec<u64> {
+    if selected.contains(&layer) { selected.iter().map(|l| l.0).collect() } else { vec![layer.0] }
+}
+
+/// Whether the Timeline shows switch `name`'s cell on `layer`'s row (A/V Features and Switches
+/// columns): a layer that has no such cell isn't one a click gives the switch to either.
+fn switch_applies(layer: &Layer, name: &str, project: &Project) -> bool {
+    match name {
+        "video" | "lock" | "shy" => true,
+        "audio" => layer.props.sub("audio").is_some(),
+        "solo" | "quality" | "motionBlur" | "adjustment" => layer.source.is_av(),
+        "collapse" => collapse_applies(layer, project),
+        "fx" => layer.effects().is_some_and(|f| !f.children.is_empty()),
+        "frameBlend" => matches!(layer.source, LayerSource::Footage { .. } | LayerSource::Comp { .. }),
+        "threeD" => layer.source.is_av() || matches!(layer.source, LayerSource::Null),
+        _ => true,
+    }
+}
+
+/// The layers a click on the `name` switch of `layer`'s row acts on: [`edited_layers`] without
+/// the layers the switch doesn't apply to.
+fn switch_targets(comp: &Comp, project: &Project, selected: &[LayerId], layer: u64, name: &str) -> Vec<u64> {
+    edited_layers(LayerId(layer), selected).into_iter().filter(|l| comp.layer(LayerId(*l)).is_some_and(|l| switch_applies(l, name, project))).collect()
+}
+
+/// The layers a Modes column edit (blending mode, Preserve Transparency) or a Track Matte edit
+/// on `layer`'s row acts on: [`edited_layers`] that have video. Selected nulls, cameras and
+/// lights (no Modes or Track Matte on their rows) are left out.
+fn video_targets(comp: &Comp, layer: LayerId, selected: &[LayerId]) -> Vec<u64> {
+    edited_layers(layer, selected).into_iter().filter(|l| comp.layer(LayerId(*l)).is_some_and(|l| l.source.is_av())).collect()
+}
+
+/// Where and what a layer switch is: its cell, icon, state and the switch it sets.
+#[derive(Clone, Copy)]
+struct SwitchSpec {
     row: Rect,
     br: Rect,
     icon: Icon,
@@ -1328,25 +1560,50 @@ fn layer_switch(
     layer: u64,
     name: &'static str,
     others: bool,
+}
+
+/// A layer's switch (A/V Features and Switches columns) in `row`, with the
+/// [`switch_gesture`].
+fn layer_switch(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    spec: &SwitchSpec,
+    comp: &Comp,
+    project: &Project,
+    selected: &[LayerId],
     actions: &mut Vec<(String, serde_json::Value)>,
 ) {
+    let SwitchSpec { row, br, icon, on, id, layer, name, others } = *spec;
     let resp = widgets::icon_toggle(ui, br, icon, on, t, id, Sense::click_and_drag());
+    // What the switch does, as its column header says.
+    let resp = match switch_tip(name) {
+        Some(tip) => resp.on_hover_text(tr(tip)),
+        None => resp,
+    };
     // Alt-click on an A/V feature sets the layer apart: the other layers go off (or locked),
-    // and come back on the next Alt-click.
+    // and come back on the next Alt-click. With several layers selected, the whole selection is
+    // set apart.
     if others && resp.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_pressed() && i.modifiers.alt) {
-        actions.push(("layer.setSwitch".into(), json!({"layers": [layer], "switch": name, "others": true})));
+        let layers = edited_layers(LayerId(layer), selected);
+        actions.push(("layer.setSwitch".into(), json!({"layers": layers, "switch": name, "others": true})));
         return;
     }
+    // A press on a selected layer's switch gives the switch to every selected layer, as in After
+    // Effects; the targets are picked when the press happens, never while the row is drawn.
     if let Some((value, merge)) = switch_gesture(ui, &resp, row, name, on) {
-        actions.push(("layer.setSwitch".into(), json!({"layers": [layer], "switch": name, "value": value, "merge": merge})));
+        let layers = switch_targets(comp, project, selected, layer, name);
+        actions.push(("layer.setSwitch".into(), json!({"layers": layers, "switch": name, "value": value, "merge": merge})));
     } else if resp.clicked() && !resp.clicked_by(egui::PointerButton::Primary) {
         // Keyboard or accessibility activation (a pointer press was handled above).
-        actions.push(("layer.setSwitch".into(), json!({"layers": [layer], "switch": name})));
+        let layers = switch_targets(comp, project, selected, layer, name);
+        actions.push(("layer.setSwitch".into(), json!({"layers": layers, "switch": name, "value": !on})));
     }
 }
 
+/// The `egui::Id` under which composition `comp` remembers the layer the last click selected, so
+/// a following Shift-click can select the range from there ([`shift_range`]).
 fn anchor_id(comp: ItemId) -> egui::Id {
-    egui::Id::new(("timeline-selection-anchor", comp.0))
+    egui::Id::unique(("timeline-selection-anchor", comp.0))
 }
 
 /// Remember `layer` as where the next Shift-click selection starts.
@@ -1361,15 +1618,15 @@ fn shift_range(ctx: &egui::Context, cid: ItemId, comp: &Comp, rows: &[Row], sele
     let anchor = ctx.data(|d| d.get_temp::<LayerId>(anchor_id(cid))).or_else(|| selected.first().copied())?;
     let a = comp.layers.iter().position(|l| l.id == anchor)?;
     let b = comp.layers.iter().position(|l| l.id == layer)?;
-    let span = comp.layers.get(a.min(b)..=a.max(b))?;
-    Some(span.iter().filter(|l| !l.switches.locked && rows.iter().any(|r| r.layer == l.id)).map(|l| l.id.0).collect())
+    let span = comp.layers.iter().skip(a.min(b)).take(a.max(b) - a.min(b) + 1);
+    Some(span.filter(|l| !l.switches.locked && rows.iter().any(|r| r.layer == l.id)).map(|l| l.id.0).collect())
 }
 
 /// Set on the frame the reorder drag is released.
 /// Where layers dropped at height `py` land among the visible layer rows: above the first row
 /// whose middle is below it (its index in `layer_rows`), else below the last row. Returns that
 /// and the y of the line that shows it (`top` without rows).
-fn insertion(layer_rows: &[(Rect, LayerId)], py: f32, top: f32) -> (Option<usize>, f32) {
+fn insertion<T>(layer_rows: &[(Rect, T)], py: f32, top: f32) -> (Option<usize>, f32) {
     let at = layer_rows.iter().position(|(r, _)| py < r.center().y);
     let y = match at {
         Some(i) => layer_rows.get(i).map_or(top, |(r, _)| r.min.y),
@@ -1378,50 +1635,141 @@ fn insertion(layer_rows: &[(Rect, LayerId)], py: f32, top: f32) -> (Option<usize
     (at, y)
 }
 
-fn layer_drop_id() -> egui::Id {
-    egui::Id::new("tl-layer-drop")
+/// Resolve a visible insertion boundary through the full outline, including offscreen layers.
+fn layer_drop_target(rows: &[Row], visible: &[(Rect, LayerId)], at: Option<usize>, moving: &[u64]) -> Option<LayerId> {
+    let (anchor, after) = match at {
+        Some(i) => (visible.get(i)?.1, false),
+        None => (visible.last()?.1, true),
+    };
+    rows.iter()
+        .filter(|row| matches!(row.kind, RowKind::Layer))
+        .skip_while(|row| row.layer != anchor)
+        .skip(usize::from(after))
+        .find(|row| !moving.contains(&row.layer.0))
+        .map(|row| row.layer)
 }
 
-pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+/// Whether a Project item can replace a layer's source (the same set `layer.replaceSource`
+/// accepts): compositions, footage and solids; not folders, data files or 3D models.
+fn replaceable_item(it: &effectcraft_engine::project::Item) -> bool {
+    match &it.kind {
+        ItemKind::Comp(_) | ItemKind::Solid(_) => true,
+        ItemKind::Footage(f) => !matches!(f.kind, FootageKind::Data | FootageKind::Model),
+        ItemKind::Folder => false,
+    }
+}
+
+/// The Alt/Option-drag target: the layer under the pointer can take this item as its source, and
+/// the item wouldn't put the composition inside itself.
+pub(crate) fn replace_source_target(app: &EffectcraftApp, cid: ItemId, item: ItemId, lid: LayerId, comp: &Comp) -> bool {
+    app.session.project.item(item).is_some_and(replaceable_item)
+        && !app.session.project.comp_contains(item, cid)
+        && comp
+            .layer(lid)
+            .is_some_and(|l| !l.switches.locked && matches!(l.source, LayerSource::Footage { .. } | LayerSource::Comp { .. } | LayerSource::Solid { .. }))
+}
+
+/// The frame's layout and state shared by the Timeline's drawing steps.
+struct Tl {
+    t: Tokens,
+    cid: ItemId,
+    time: Tick,
+    fr: effectcraft_engine::time::FrameRate,
+    rect: Rect,
+    header_h: f32,
+    colhdr_h: f32,
+    footer_h: f32,
+    vis: Vis,
+    left_w: f32,
+    overflow: f32,
+    oscroll: f32,
+    cw: Cols,
+    graph_x0: f32,
+    graph_x1: f32,
+    fit_pps: f64,
+    pps: f64,
+    scroll_to: Option<crate::state::ScrollTo>,
+    tm: TMap,
+    top: f32,
+    rows_rect: Rect,
+    ruler: Rect,
+    bin: Rect,
+    tc_rect: Rect,
+    wa_row: Rect,
+    fd: f64,
+    rh: f32,
+    max_scroll: f32,
+    ctx: egui::Context,
+    comp: Arc<Comp>,
+    p: egui::Painter,
+    rows: Arc<Vec<Row>>,
+    actions: Vec<(String, serde_json::Value)>,
+}
+
+/// [`Tl`] plus what the layer rows and the interactions after them share.
+struct Rw {
+    tl: Tl,
+    lp: egui::Painter,
+    gp: egui::Painter,
+    graph_on: bool,
+    full_clip: Rect,
+    left_clip: Rect,
+    right_clip: Rect,
+    empty_rect: Rect,
+    empty: egui::Response,
+    outline_empty: egui::Response,
+    selected: Vec<LayerId>,
+    sel_keys: Vec<effectcraft_engine::KeyRef>,
+    ui_actions: Vec<UiAct>,
+    hit_rows: Vec<(Rect, Row)>,
+    dim_hits: Vec<(u64, Vec<Rect>)>,
+}
+
+/// One visible row: what the per-kind drawing steps need to know about it.
+struct RowCtx<'a> {
+    row: &'a Row,
+    layer: &'a Layer,
+    r: Rect,
+    left: Rect,
+    cy: f32,
+    is_sel: bool,
+    ri: usize,
+    indent: f32,
+}
+
+/// The responses of a layer bar's body and its two trim edges.
+struct BarResps {
+    body: egui::Response,
+    lin: egui::Response,
+    lout: egui::Response,
+}
+
+/// An expression row's property, expression and editor ids.
+#[derive(Clone, Copy)]
+struct ExprRow<'a> {
+    prop: &'a Property,
+    ex: &'a effectcraft_engine::project::Expression,
+    buf_id: egui::Id,
+    edit_id: egui::Id,
+}
+
+/// A keyframe marker's hit result.
+struct KeyHit<'a> {
+    k: &'a effectcraft_engine::keyframe::Keyframe,
+    ct: Tick,
+    ks: bool,
+    kresp: egui::Response,
+    mods: egui::Modifiers,
+    this_key: serde_json::Value,
+}
+
+/// Computes this frame's layout: zoom, scroll and the panel's regions.
+fn layout(app: &mut EffectcraftApp, ui: &egui::Ui, rect: Rect, cid: ItemId, comp: &Arc<Comp>) -> Tl {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
-    let Some(cid) = app.session.active_comp_id() else {
-        ui.painter().text(rect.center(), Align2::CENTER_CENTER, "(no composition)", Tokens::ui(12.0), t.text_faint);
-        // Dropping footage into an empty Timeline should create its first composition,
-        // just like dropping onto the Project panel's New Composition button (#649).
-        if let Some(crate::panels::DragPayload::Item(dragged)) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx).as_deref()
-            && ui.rect_contains_pointer(rect)
-        {
-            let items: Vec<ItemId> = crate::panels::project_drop_items(app, *dragged)
-                .into_iter()
-                .map(ItemId)
-                .filter(|id| {
-                    app.session.project.item(*id).is_some_and(|item| match &item.kind {
-                        effectcraft_engine::project::ItemKind::Footage(footage) => footage.kind != effectcraft_engine::project::FootageKind::Data,
-                        effectcraft_engine::project::ItemKind::Solid(_) | effectcraft_engine::project::ItemKind::Comp(_) => true,
-                        _ => false,
-                    })
-                })
-                .collect();
-            if !items.is_empty() {
-                ui.painter().rect_stroke(rect.shrink(2.0), 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
-                app.auto.add("timeline.newCompDrop", rect, "Drop footage to create a composition");
-                if ctx.input(|i| i.pointer.any_released()) {
-                    app.session.state.project_selection = items;
-                    if let Err(e) = crate::menus::invoke(app, &ctx, "file.newCompFromSelection", json!({})) {
-                        app.ui.status = e;
-                    }
-                    egui::DragAndDrop::clear_payload(&ctx);
-                }
-            }
-        }
-        return;
-    };
-    let Some(comp) = app.session.project.comp_arc(cid) else { return };
     let p = ui.painter().clone();
     let time = app.session.time();
     let fr = comp.frame_rate;
-
     // Geometry.
     let header_h = 48.0;
     let ruler_h = 34.0;
@@ -1438,8 +1786,8 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let cw = cols(rect.min.x - oscroll, left_w + overflow, vis);
     let graph_x0 = rect.min.x + left_w + 1.0;
     let graph_x1 = rect.max.x - GUTTER_W;
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("timeline-graph-area"), (graph_x0, graph_x1 - graph_x0)));
-    let fit_pps = fit_pps(graph_x1 - graph_x0, &comp);
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("timeline-graph-area"), (graph_x0, graph_x1 - graph_x0)));
+    let fit_pps = fit_pps(graph_x1 - graph_x0, comp);
     let pps = app.ui.timeline.pps.unwrap_or(fit_pps);
     if app.ui.timeline.pps.is_none() {
         app.ui.timeline.start = 0.0;
@@ -1463,1966 +1811,206 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let top = rect.min.y;
     let rows_top = top + header_h + colhdr_h;
     let rows_rect = Rect::from_min_max(pos2(rect.min.x, rows_top), pos2(rect.max.x, rect.max.y - footer_h));
-    let graph_rect = Rect::from_min_max(pos2(graph_x0, top + header_h - ruler_h + colhdr_h), pos2(rect.max.x, rect.max.y - footer_h));
     p.rect_filled(Rect::from_min_max(pos2(graph_x0, top), rect.max), 0.0, t.tl_bg);
     p.line_segment([pos2(graph_x0 - 1.0, top), pos2(graph_x0 - 1.0, rect.max.y)], Stroke::new(1.0, t.app_bg));
 
-    let mut actions: Vec<(String, serde_json::Value)> = Vec::new();
-    if !ui.input(|i| i.pointer.primary_down()) {
-        ctx.data_mut(|d| d.remove::<SwitchDrag>(switch_drag_id()));
-    }
-    // ---- header (left): time display, search, switches.
-    let tc = crate::panels::timecode(&app.session, &comp, time);
-    let tc_rect = Rect::from_min_size(pos2(rect.min.x + 12.0, top + 6.0), vec2(150.0, 24.0));
-    let tc_resp = ui.interact(tc_rect, egui::Id::new("tl-timecode"), Sense::click_and_drag());
-    p.text(tc_rect.left_center(), Align2::LEFT_CENTER, &tc, Tokens::semibold(16.0), t.timecode);
-    // Under it the other style (frames under timecode, timecode under frames) and the rate.
-    let settings = &app.session.project.settings;
-    let other = if settings.time_display == effectcraft_engine::project::TimeDisplayStyle::Timecode {
-        format!("{:05}", fr.frame_at(time) + settings.frame_start)
-    } else {
-        effectcraft_engine::time::format_timecode_ae(fr.frame_at(time + comp.display_start), fr, false)
-    };
-    // Audio-only preview (Video off in the Preview panel): the current time stays put, so that
-    // line says why and where the sound is instead (#1118).
-    if let Some(af) = app.video_preview_off() {
-        let at = af.map(|f| format!(" · {}", effectcraft_engine::time::format_timecode_ae(f + fr.frame_at(comp.display_start), fr, false))).unwrap_or_default();
-        let msg = format!("{}{at}", crate::i18n::tr("Video preview off: audio only"));
-        p.text(pos2(tc_rect.min.x, tc_rect.max.y + 8.0), Align2::LEFT_CENTER, msg, Tokens::ui(10.5), t.cache_green);
-    } else {
-        p.text(pos2(tc_rect.min.x, tc_rect.max.y + 8.0), Align2::LEFT_CENTER, format!("{other} ({:.2} fps)", fr.as_f64()), Tokens::ui(10.5), t.text_faint);
-    }
-    app.auto.add("timeline.timecode", tc_rect, &tc);
-    super::toggle_time_display(app, &tc_resp);
-    if tc_resp.dragged() {
-        let d = tc_resp.drag_delta().x as f64;
-        let f = fr.frame_at(time) + (d * 0.5).round() as i64;
-        let _ = app.session.execute("time.set", json!({"frame": f.max(0)}));
-    }
-    if tc_resp.double_clicked() {
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("tl-tc-edit"), tc.clone()));
-    }
-    if let Some(mut buf) = ctx.data(|d| d.get_temp::<String>(egui::Id::new("tl-tc-edit"))) {
-        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(tc_rect));
-        let r = child.add(egui::TextEdit::singleline(&mut buf).font(Tokens::semibold(16.0)).desired_width(150.0));
-        if r.lost_focus() {
-            if !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                let _ = app.session.execute("time.set", json!({"timecode": buf}));
-            }
-            ctx.data_mut(|d| d.remove::<String>(egui::Id::new("tl-tc-edit")));
-        } else {
-            widgets::keep_focus(&ctx, &r, &buf);
-            ctx.data_mut(|d| d.insert_temp(egui::Id::new("tl-tc-edit"), buf));
-        }
-    }
-    let sr = Rect::from_min_size(pos2(tc_rect.max.x + 14.0, top + 12.0), vec2((left_w - 420.0).clamp(120.0, 220.0), 22.0));
-    let mut search = app.ui.timeline.search.clone();
-    widgets::search_field(ui, sr, &mut search, "Search", &t);
-    app.ui.timeline.search = search;
-    app.auto.add("timeline.search", sr, "Search");
-    let mut bx = rect.min.x + left_w - 10.0;
-    for (icon, on, id, tip) in [
-        (Icon::Graph, app.ui.timeline.graph_editor, "graph", "Graph Editor"),
-        (Icon::MotionBlur, comp.enable_motion_blur, "motionBlur", "Enables Motion Blur for all layers with the Motion Blur switch set"),
-        (Icon::FrameBlend, comp.enable_frame_blending, "frameBlending", "Enables Frame Blending for all layers with the Frame Blend switch set"),
-        (Icon::Shy, comp.hide_shy, "hideShy", "Hides all layers for which the Shy switch is set"),
-        (Icon::Draft3D, comp.draft_3d, "draft3d", "Draft 3D"),
-        (Icon::Flowchart, false, "flowchart", "Composition Mini-Flowchart"),
-    ] {
-        let r = Rect::from_min_size(pos2(bx - 24.0, top + 11.0), vec2(24.0, 24.0));
-        let resp = widgets::icon_button(ui, r, icon, on, &t, egui::Id::new(("tl-sw", id))).on_hover_text(tip);
-        app.auto.add(&format!("timeline.switch.{id}"), r, tip);
-        if resp.clicked() {
-            match id {
-                "graph" => app.ui.timeline.graph_editor = !app.ui.timeline.graph_editor,
-                "flowchart" => app.show_panel(crate::dock::PanelKind::Flowchart),
-                _ => {
-                    let _ = app.session.execute("comp.setSwitch", json!({"switch": id}));
-                }
-            }
-        }
-        bx -= 28.0;
-    }
-
-    // ---- ruler (right).
     let ruler = Rect::from_min_max(pos2(graph_x0, top + header_h - ruler_h), pos2(rect.max.x, top + header_h));
     // The composition marker bin, at the right end of the ruler above the layers' scroll bar.
     let bin = Rect::from_min_max(pos2(graph_x1 + 2.0, ruler.max.y - 16.0), pos2(rect.max.x - 2.0, ruler.max.y - 2.0));
-    let nav = Rect::from_min_max(pos2(graph_x0 + 6.0, top + 6.0), pos2(graph_x1, top + 14.0));
-    // Time navigator: the visible span as a grey bar with blue end handles (as in After
-    // Effects), over a dark track.
-    p.rect_filled(nav, 1.0, t.field_bg);
-    let vis0 = (tm.start / comp.duration.seconds()) as f32;
-    let vis1 = (tm.t(graph_x1) / comp.duration.seconds()) as f32;
-    let nav_vis =
-        Rect::from_min_max(pos2(nav.min.x + nav.width() * vis0.clamp(0.0, 1.0), nav.min.y), pos2(nav.min.x + nav.width() * vis1.clamp(0.0, 1.0), nav.max.y));
-    p.rect_filled(nav_vis, 0.0, t.tl_nav_bar);
-    for x in [nav_vis.min.x, nav_vis.max.x] {
-        p.rect_filled(Rect::from_min_max(pos2(x - 3.0, nav.min.y - 1.0), pos2(x + 3.0, nav.max.y + 1.0)), 3.0, t.accent);
-    }
-    // The middle scrolls at the current zoom; each end is a handle that moves that side of the
-    // visible span (pulled in: zoomed in; stretched to the whole track: the whole comp).
-    let nresp = ui.interact(nav, egui::Id::new("tl-nav"), Sense::drag());
-    app.auto.add("timeline.navigator", nav, "Time navigator");
-    if nresp.dragged() {
-        let d = nresp.drag_delta().x as f64 / nav.width() as f64 * comp.duration.seconds();
-        app.ui.timeline.start = (app.ui.timeline.start + d).clamp(0.0, comp.duration.seconds());
-        if app.ui.timeline.pps.is_none() {
-            app.ui.timeline.pps = Some(pps);
-        }
-    }
-    let span_px = (graph_x1 - tm.x0) as f64;
-    let (t0, t1) = (tm.start, tm.t(graph_x1));
-    for (end, x) in [("start", nav_vis.min.x), ("end", nav_vis.max.x)] {
-        let hr = Rect::from_center_size(pos2(x, nav.center().y), vec2(10.0, nav.height() + 6.0));
-        let hresp = ui.interact(hr, egui::Id::new(("tl-nav", end)), Sense::drag());
-        app.auto.add(&format!("timeline.navigator.{end}"), hr, if end == "start" { "Time navigator start" } else { "Time navigator end" });
-        if hresp.hovered() || hresp.dragged() {
-            ctx.set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
-        }
-        if let Some(px) = hresp.interact_pointer_pos().filter(|_| hresp.dragged()) {
-            let t = ((px.x - nav.min.x) / nav.width()) as f64 * comp.duration.seconds();
-            // The other end stays; the span is at least what the most zoomed-in ruler shows.
-            let min_span = span_px / MAX_PPS;
-            let (keep_t, keep_px, span) = if end == "start" { (t1, span_px, t1 - t.min(t1 - min_span)) } else { (t0, 0.0, t.max(t0 + min_span) - t0) };
-            set_zoom(&mut app.ui.timeline, &comp, span_px / span.max(min_span), fit_pps, keep_t, keep_px);
-        }
-    }
-    p.rect_filled(ruler, 0.0, t.tl_ruler_bg);
-    app.auto.add("timeline.ruler", ruler, &format!("{},{}", tm.start, tm.pps));
-    // Work area bar: below the ruler, beside the column headers (After Effects' layout), with
-    // blue begin / end handles; the cache bar runs under it. Dragging the bar moves the work
-    // area, the handles move its ends; Shift snaps (#252).
+    let tc_rect = Rect::from_min_size(pos2(rect.min.x + 12.0, top + 6.0), vec2(150.0, 24.0));
     let wa_row = Rect::from_min_max(pos2(graph_x0, top + header_h), pos2(rect.max.x, top + header_h + colhdr_h));
-    let (wa0, wa1) = (comp.work_area.0.seconds(), comp.work_area.1.seconds());
-    let wa = Rect::from_min_max(pos2(tm.x(wa0), wa_row.min.y + 3.0), pos2(tm.x(wa1), wa_row.max.y - 6.0));
-    p.with_clip_rect(wa_row).rect_filled(wa, 0.0, t.tl_work_area_bar);
-    let shift = ui.input(|i| i.modifiers.shift);
-    let bar = wa.intersect(wa_row);
-    let bresp = ui.interact(bar, egui::Id::new("wa-bar"), Sense::click_and_drag());
-    app.auto.add("timeline.workArea.bar", bar, "Work area");
-    // Right-click: the work area's commands (After Effects).
-    crate::widgets::context_menu(&bresp, |ui| {
-        let mut chosen = None;
-        for id in ["comp.trimToWorkArea", "edit.liftWorkArea", "edit.extractWorkArea"] {
-            crate::menus::entry_for(app, ui, id, &mut chosen);
-        }
-        actions.extend(chosen);
-    });
-    let bar_start = egui::Id::new("wa-bar-start");
-    if bresp.drag_started() {
-        ctx.data_mut(|d| d.insert_temp(bar_start, wa0));
-    }
-    if bresp.dragged()
-        && let (Some(a0), Some(d)) = (ctx.data(|d| d.get_temp::<f64>(bar_start)), bresp.total_drag_delta())
-    {
-        let len = wa1 - wa0;
-        let mut a = a0 + d.x as f64 / pps.max(1e-6);
-        if shift {
-            a += work_area_snap(app, &comp, &[a, a + len], pps);
-        }
-        let a = fr.snap_nearest(Tick::from_seconds_f64(a.clamp(0.0, (comp.duration.seconds() - len).max(0.0)))).seconds();
-        let _ = app.session.execute("comp.workArea", json!({"start": a, "end": a + len, "merge": "wa-drag"}));
-    }
-    for (hx, set) in [(wa.min.x, "begin"), (wa.max.x, "end")] {
-        let hr = Rect::from_center_size(pos2(hx, wa.center().y), vec2(8.0, 14.0));
-        let handle = if set == "begin" {
-            Rect::from_min_max(pos2(hx - 1.0, wa.min.y), pos2(hx + 4.0, wa.max.y))
-        } else {
-            Rect::from_min_max(pos2(hx - 4.0, wa.min.y), pos2(hx + 1.0, wa.max.y))
-        };
-        p.rect_filled(handle, 2.0, t.accent);
-        let resp = ui.interact(hr, egui::Id::new(("wa", set)), Sense::drag());
-        app.auto.add(&format!("timeline.workArea.{set}"), hr, set);
-        if resp.dragged()
-            && let Some(pt) = resp.interact_pointer_pos()
-        {
-            let mut secs = tm.t(pt.x).max(0.0);
-            if shift {
-                secs += work_area_snap(app, &comp, &[secs], pps);
-            }
-            let secs = fr.snap_nearest(Tick::from_seconds_f64(secs)).seconds();
-            let key = if set == "begin" { "start" } else { "end" };
-            let _ = app.session.execute("comp.workArea", json!({key: secs, "merge": "wa-drag"}));
-        }
-    }
-    // Cache bar (green: cached frames of what the viewer shows: its resolution, view and options).
-    let series = app.shown_series(cid);
-    let cached = app.frames.cached_frames(&series);
     let fd = comp.frame_duration().seconds();
-    let cy0 = wa_row.max.y - 4.0;
-    let mut run: Option<(i64, i64)> = None;
-    let draw_run = |a: i64, b: i64| {
-        let x0 = tm.x(a as f64 * fd);
-        let x1 = tm.x((b + 1) as f64 * fd);
-        p.rect_filled(Rect::from_min_max(pos2(x0, cy0), pos2(x1, cy0 + 2.5)), 0.0, t.cache_green);
-    };
-    for f in cached {
-        run = match run {
-            Some((a, b)) if f == b + 1 => Some((a, f)),
-            Some((a, b)) => {
-                draw_run(a, b);
-                Some((f, f))
-            }
-            None => Some((f, f)),
-        };
-    }
-    if let Some((a, b)) = run {
-        draw_run(a, b);
-    }
-    // Disk-cached frames not in RAM (blue), like After Effects.
-    if app.session.disk_cache.is_some() || app.frames.remote_disk() {
-        let frames = comp.frame_rate.frame_at(comp.duration);
-        let opts = app.frame_opts(cid, series.scale as f64 / 1000.0);
-        let disk = app.frames.disk_frames(&app.render_source(), &series, frames, &opts);
-        let draw_blue = |a: i64, b: i64| {
-            let x0 = tm.x(a as f64 * fd);
-            let x1 = tm.x((b + 1) as f64 * fd);
-            p.rect_filled(Rect::from_min_max(pos2(x0, cy0), pos2(x1, cy0 + 2.5)), 0.0, t.cache_blue);
-        };
-        let mut run: Option<(i64, i64)> = None;
-        for f in disk {
-            run = match run {
-                Some((a, b)) if f == b + 1 => Some((a, f)),
-                Some((a, b)) => {
-                    draw_blue(a, b);
-                    Some((f, f))
-                }
-                None => Some((f, f)),
-            };
-        }
-        if let Some((a, b)) = run {
-            draw_blue(a, b);
-        }
-    }
-    // Ticks + labels.
-    // Label spacing in whole frames (AE: `00:15f`-style seconds:frames labels).
-    let fps_i = fr.as_f64().round().max(1.0) as i64;
-    let half = (fps_i / 2).max(1);
-    let label_frames = [1, 2, 5, 10, half, fps_i, 2 * fps_i, 5 * fps_i, 10 * fps_i, 30 * fps_i, 60 * fps_i]
-        .into_iter()
-        .find(|f| *f as f64 * fd * pps >= 52.0)
-        .unwrap_or(60 * fps_i);
-    let secs_per_label = label_frames as f64 * fd;
-    let first = (tm.start / secs_per_label).floor() * secs_per_label;
-    let mut s = first;
-    let pr = p.with_clip_rect(Rect::from_min_max(pos2(graph_x0, ruler.min.y), pos2(bin.min.x, ruler.max.y)));
-    while s <= tm.t(graph_x1) + secs_per_label {
-        let x = tm.x(s);
-        pr.line_segment([pos2(x, ruler.max.y - 10.0), pos2(x, ruler.max.y)], Stroke::new(1.0, t.tl_ruler_tick));
-        let fno = (s / fd).round() as i64;
-        let label = ruler_label(fno, fps_i, &app.session.project.settings);
-        // A label that would run under the marker bin is left out rather than cut to a stray digit.
-        let g = pr.layout_no_wrap(label, Tokens::ui(10.0), t.tl_ruler_text);
-        if x + 3.0 + g.size().x <= bin.min.x {
-            pr.galley(pos2(x + 3.0, ruler.max.y - 16.0 - g.size().y / 2.0), g, t.tl_ruler_text);
-        }
-        for k in 1..5 {
-            let xx = tm.x(s + secs_per_label * k as f64 / 5.0);
-            pr.line_segment([pos2(xx, ruler.max.y - 4.0), pos2(xx, ruler.max.y)], Stroke::new(1.0, t.tl_ruler_tick.gamma_multiply(0.6)));
-        }
-        s += secs_per_label;
-    }
-    // Scrub in the ruler: the current time jumps to the pointer as soon as the button goes down
-    // (After Effects), then follows it.
-    let rresp =
-        ui.interact(Rect::from_min_max(pos2(graph_x0, ruler.min.y + 12.0), pos2(bin.min.x, ruler.max.y)), egui::Id::new("tl-ruler"), Sense::click_and_drag());
-    if ((rresp.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_down())) || rresp.clicked())
-        && let Some(pt) = rresp.interact_pointer_pos()
-    {
-        let mut x = pt.x;
-        // Zoomed in, a scrub held past either end of the ruler scrolls the timeline that way
-        // (faster the further), with the CTI at the edge (After Effects).
-        let mut tm = tm;
-        if rresp.dragged() && app.ui.timeline.pps.is_some() {
-            let speed = edge_scroll_speed_x(tm.x0, graph_x1, x);
-            if speed != 0.0 {
-                let dt = f64::from(ui.input(|i| i.stable_dt).clamp(0.0, 0.1));
-                let span = f64::from(graph_x1 - tm.x0) / pps;
-                let cur = app.ui.timeline.start;
-                let hi = (comp.duration.seconds() - span).max(0.0).max(cur);
-                app.ui.timeline.start = (cur + f64::from(speed) * dt / pps).clamp(0.0, hi);
-                tm.start = app.ui.timeline.start;
-                ui.ctx().request_repaint();
-            }
-            x = x.clamp(tm.x0, graph_x1);
-        }
-        let mut secs = tm.t(x).max(0.0);
-        // Shift-drag: snap to keyframes, in/out points, markers and the work area (8 px).
-        if ui.input(|i| i.modifiers.shift) {
-            let cands = snap_candidates(&comp, &build_rows(app, &comp));
-            secs = snap_time(&cands, secs, 8.0 / pps.max(1e-6));
-        }
-        let tt = Tick::from_seconds_f64(secs);
-        app.session.set_time(tt);
-        app.stop();
-        // Dragged past either edge of the ruler (over the layer outline, say), the view scrolls so
-        // the current time indicator stays in sight (After Effects).
-        if app.ui.timeline.pps.is_some() {
-            let now = app.session.time().seconds();
-            let span = tm.t(bin.min.x) - tm.start;
-            if now < tm.start {
-                app.ui.timeline.start = now.max(0.0);
-            } else if now > tm.start + span {
-                app.ui.timeline.start = (now - span).max(0.0);
-            }
-        }
-        // Ctrl/Cmd-drag scrubs the audio too (After Effects).
-        if rresp.dragged()
-            && ui.input(|i| i.modifiers.command)
-            && let Some(cid) = app.session.active_comp_id()
-        {
-            let now = ui.input(|i| i.time);
-            let t = app.session.time();
-            app.scrub_audio(cid, t, now);
-        }
+    Tl {
+        t,
+        cid,
+        time,
+        fr,
+        rect,
+        header_h,
+        colhdr_h,
+        footer_h,
+        vis,
+        left_w,
+        overflow,
+        oscroll,
+        cw,
+        graph_x0,
+        graph_x1,
+        fit_pps,
+        pps,
+        scroll_to,
+        tm,
+        top,
+        rows_rect,
+        ruler,
+        bin,
+        tc_rect,
+        wa_row,
+        fd,
+        rh: t.row_h,
+        max_scroll: 0.0,
+        ctx,
+        comp: comp.clone(),
+        p,
+        rows: Arc::new(Vec::new()),
+        actions: Vec::new(),
     }
+}
 
-    // ---- column headers (right-click: show/hide columns; click the name header: Source/Layer Name).
-    let ch = Rect::from_min_max(pos2(rect.min.x, top + header_h), pos2(rect.max.x, top + header_h + colhdr_h));
-    p.rect_filled(Rect::from_min_max(ch.min, pos2(graph_x0 - 1.0, ch.max.y)), 0.0, t.panel_bg);
-    p.line_segment([pos2(rect.min.x, ch.max.y), pos2(rect.max.x, ch.max.y)], Stroke::new(1.0, t.separator));
-    let hy = ch.center().y;
-    // Column headers scroll with the outline and never spill into the time ruler.
-    let hp = p.with_clip_rect(Rect::from_min_max(ch.min, pos2(graph_x0 - 1.0, ch.max.y)));
-    let hic = |icon: Icon, x: f32| icons::paint(&hp, Rect::from_center_size(pos2(x, hy), vec2(12.0, 12.0)), icon, t.text_dim);
-    let htext = |x: f32, s: &str| hp.text(pos2(x, hy), Align2::LEFT_CENTER, s, Tokens::ui(11.0), t.text_dim);
-    if vis.av {
-        hic(Icon::Eye, cw.av + 10.0);
-        hic(Icon::Speaker, cw.av + 28.0);
-        hic(Icon::Solo, cw.av + 46.0);
-        hic(Icon::Lock, cw.av + 64.0);
-    }
-    if vis.keys {
-        htext(cw.keys + 6.0, "Keys");
-    }
-    if vis.label {
-        icons::paint(&hp, Rect::from_center_size(pos2(cw.label + 10.0, hy), vec2(10.0, 10.0)), Icon::Keyframe, t.text_dim);
-    }
-    if vis.num {
-        htext(cw.num + 6.0, "#");
-    }
-    let name_hdr = if app.ui.timeline.source_name { "Source Name" } else { "Layer Name" };
-    htext(cw.name + 22.0, name_hdr);
-    if vis.comment {
-        htext(cw.comment + 6.0, "Comment");
-    }
-    if vis.switches {
-        for (i, icon) in
-            [Icon::Shy, Icon::Collapse, Icon::Quality, Icon::Fx, Icon::FrameBlend, Icon::MotionBlur, Icon::Adjustment, Icon::Cube].into_iter().enumerate()
-        {
-            hic(icon, cw.switches + SW * i as f32 + SW / 2.0);
-        }
-    }
-    if vis.modes {
-        htext(cw.mode + 4.0, "Mode");
-        htext(cw.mode + 74.0, "T");
-        htext(cw.trkmat + 4.0, "Track Matte");
-    }
-    if vis.parent {
-        icons::paint(&hp, Rect::from_center_size(pos2(cw.parent + 10.0, hy), vec2(12.0, 12.0)), Icon::PickWhip, t.text_dim);
-        htext(cw.parent + 20.0, "Parent & Link");
-    }
-    for (on, x, s) in [(vis.in_, cw.in_, "In"), (vis.out, cw.out, "Out"), (vis.duration, cw.duration, "Duration"), (vis.stretch, cw.stretch, "Stretch")] {
-        if on {
-            htext(x + 6.0, s);
-        }
-    }
-    let hdr_rect = Rect::from_min_max(ch.min, pos2(graph_x0 - 1.0, ch.max.y));
-    let hresp = ui.interact(hdr_rect, egui::Id::new("tl-colhdr"), Sense::click());
-    app.auto.add("timeline.header", hdr_rect, "Columns (right-click)");
-    for (id, label) in COLUMNS {
-        if let Some(x0) = match id {
-            "av" => vis.av.then_some((cw.av, AV_W)),
-            "keys" => vis.keys.then_some((cw.keys, KEYS_W)),
-            "label" => vis.label.then_some((cw.label, LABEL_W)),
-            "num" => vis.num.then_some((cw.num, NUM_W)),
-            "name" => Some((cw.name, cw.name_end - cw.name)),
-            "comment" => vis.comment.then_some((cw.comment, COMMENT_W)),
-            "switches" => vis.switches.then_some((cw.switches, SW * 8.0 + 6.0)),
-            "modes" => vis.modes.then_some((cw.mode, MODES_W)),
-            "parent" => vis.parent.then_some((cw.parent, PARENT_W)),
-            "in" => vis.in_.then_some((cw.in_, TIME_W)),
-            "out" => vis.out.then_some((cw.out, TIME_W)),
-            "duration" => vis.duration.then_some((cw.duration, TIME_W)),
-            _ => vis.stretch.then_some((cw.stretch, STRETCH_W)),
-        } {
-            app.auto.add(&format!("timeline.header.{id}"), Rect::from_min_size(pos2(x0.0, ch.min.y), vec2(x0.1, colhdr_h)), label);
-        }
-    }
-    if hresp.clicked()
-        && let Some(pt) = hresp.interact_pointer_pos()
-        && column_at(&cw, pt.x) == Some("name")
+/// Without an active composition: a hint, and dropping footage creates the first composition.
+fn empty_timeline(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let ctx = ui.ctx().clone();
+    ui.painter().text(rect.center(), Align2::CENTER_CENTER, crate::i18n::tr("(no composition)"), Tokens::ui(12.0), t.text_faint);
+    // Dropping footage into an empty Timeline should create its first composition,
+    // just like dropping onto the Project panel's New Composition button (#649).
+    if let Some(crate::panels::DragPayload::Item(dragged)) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx).as_deref()
+        && ui.rect_contains_pointer(rect)
     {
-        app.ui.timeline.source_name = !app.ui.timeline.source_name;
-    }
-    if hresp.secondary_clicked() {
-        let under = hresp.interact_pointer_pos().and_then(|pt| column_at(&cw, pt.x));
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("tl-colhdr-under"), under.unwrap_or("")));
-    }
-    crate::widgets::context_menu(&hresp, |ui| {
-        let under: &str = ctx.data(|d| d.get_temp(egui::Id::new("tl-colhdr-under"))).unwrap_or("");
-        if !under.is_empty() && under != "name" && ui.button(crate::i18n::tr("Hide This")).clicked() {
-            actions.push(("timeline.column".into(), json!({"column": under, "visible": false})));
-            ui.close();
-        }
-        ui.menu_button(crate::i18n::tr("Columns"), |ui| {
-            for (id, label) in COLUMNS {
-                let label = if id == "name" { if app.ui.timeline.source_name { "Source Name" } else { "Layer Name" } } else { label };
-                let on = column_visible(&app.ui.timeline, id);
-                if ui.add_enabled(id != "name", egui::Button::new(label).selected(on)).clicked() {
-                    actions.push(("timeline.column".into(), json!({"column": id, "visible": !on})));
-                    ui.close();
+        let items: Vec<ItemId> = crate::panels::project_drop_items(app, *dragged, None)
+            .into_iter()
+            .map(ItemId)
+            .filter(|id| {
+                app.session.project.item(*id).is_some_and(|item| match &item.kind {
+                    effectcraft_engine::project::ItemKind::Footage(footage) => footage.kind != effectcraft_engine::project::FootageKind::Data,
+                    effectcraft_engine::project::ItemKind::Solid(_) | effectcraft_engine::project::ItemKind::Comp(_) => true,
+                    _ => false,
+                })
+            })
+            .collect();
+        if !items.is_empty() {
+            ui.painter().rect_stroke(rect.shrink(2.0), 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
+            app.auto.add("timeline.newCompDrop", rect, "Drop footage to create a composition");
+            if ctx.input(|i| i.pointer.any_released()) {
+                app.session.state.project_selection = items;
+                if let Err(e) = crate::menus::invoke(app, &ctx, "file.newCompFromSelection", json!({})) {
+                    app.ui.status = e;
                 }
+                egui::DragAndDrop::clear_payload(&ctx);
             }
-        });
-        if ui.button(if app.ui.timeline.source_name { crate::i18n::tr("Show Layer Name") } else { crate::i18n::tr("Show Source Name") }).clicked() {
-            actions.push(("timeline.sourceName".into(), json!({})));
-            ui.close();
         }
-    });
-    let _ = cw.end;
+    }
+}
 
-    // ---- rows.
-    let rows = with_expr_rows(build_rows(app, &comp), &comp, &app.ui.timeline, &ctx);
-    let rh = t.row_h;
-    let total_h: f32 = rows.iter().map(|r| row_height(r, rh)).sum();
-    let max_scroll = (total_h - rows_rect.height() + rh).max(0.0);
-    if scroll_to == Some(crate::state::ScrollTo::Layer) {
-        // The topmost selected layer, in stack order.
-        let sel = &app.session.state.selected_layers;
-        let top = comp.layers.iter().find(|l| sel.contains(&l.id)).map(|l| l.id);
-        if let Some(i) = rows.iter().position(|r| matches!(r.kind, RowKind::Layer) && Some(r.layer) == top) {
-            app.ui.timeline.scroll_y = rows.iter().take(i).map(|r| row_height(r, rh)).sum();
-        }
-    } else if let Some(crate::state::ScrollTo::Property(uid)) = scroll_to
-        && let Some(i) = rows.iter().position(|r| matches!(r.kind, RowKind::Prop { uid: p } if p == uid))
-    {
-        app.ui.timeline.scroll_y = rows.iter().take(i).map(|r| row_height(r, rh)).sum();
-    }
-    if ui.rect_contains_pointer(rows_rect) {
-        let (dy, dx, zoom) = ui.input(|i| (i.smooth_scroll_delta.y, i.smooth_scroll_delta.x, i.modifiers.alt));
-        // Ctrl/Cmd+wheel and a trackpad pinch reach egui as a zoom factor rather than a scroll
-        // (#428); like Alt+wheel they zoom time.
-        let pinch = ui.input(|i| i.zoom_delta()) as f64;
-        let at_x = ui.input(|i| i.pointer.hover_pos()).map(|p| p.x).unwrap_or(graph_x0);
-        if (pinch - 1.0).abs() > 1e-4 {
-            set_zoom(&mut app.ui.timeline, &comp, tm.pps * pinch, fit_pps, tm.t(at_x), (at_x - tm.x0) as f64);
-        } else if zoom && dy.abs() > 0.0 {
-            // Alt+wheel zooms around the pointer, out until the whole comp shows.
-            set_zoom(&mut app.ui.timeline, &comp, tm.pps * (dy as f64 / 200.0).exp(), fit_pps, tm.t(at_x), (at_x - tm.x0) as f64);
-        } else {
-            let over_outline = ui.input(|i| i.pointer.hover_pos()).is_some_and(|p| p.x < graph_x0);
-            let shift = ui.input(|i| i.modifiers.shift);
-            if over_outline && overflow > 0.0 && (dx.abs() > 0.0 || (shift && dy.abs() > 0.0)) {
-                let d = if dx.abs() > 0.0 { dx } else { dy };
-                app.ui.timeline.outline_scroll = (app.ui.timeline.outline_scroll - d).clamp(0.0, overflow);
-            } else {
-                app.ui.timeline.scroll_y = (app.ui.timeline.scroll_y - dy).clamp(0.0, max_scroll);
-            }
-            if dx.abs() > 0.0 && app.ui.timeline.pps.is_some() && !over_outline {
-                app.ui.timeline.start = (app.ui.timeline.start - dx as f64 / pps).max(0.0);
-            }
-        }
-    }
-    // A pick whip held near the top or bottom of the layers (or past it) scrolls them, as in
-    // After Effects.
-    if ctx.data(|d| d.get_temp::<PickWhip>(pick_whip_id())).is_some()
-        && let Some(ptr) = ctx.input(|i| i.pointer.latest_pos()).filter(|p| rect.x_range().contains(p.x))
-    {
-        let speed = edge_scroll_speed(rows_rect, ptr.y, rh);
-        if speed != 0.0 {
-            app.ui.timeline.scroll_y += speed * ctx.input(|i| i.stable_dt).min(0.1);
-            ctx.request_repaint();
-        }
-    }
-    app.ui.timeline.scroll_y = app.ui.timeline.scroll_y.clamp(0.0, max_scroll);
-    let snap_project = app.session.project.clone();
-    let snap_expr = app.session.expr.clone();
-    let ectx = EvalCtx { project: &snap_project, comp_id: cid, comp: &comp, time, expr: snap_expr.as_deref(), footage: None };
-    let lp = p.with_clip_rect(rows_rect.intersect(Rect::from_min_max(rows_rect.min, pos2(graph_x0 - 1.0, rows_rect.max.y))));
-    let gp = p.with_clip_rect(rows_rect.intersect(Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max)));
-    let mut y = rows_rect.min.y - app.ui.timeline.scroll_y;
-    let selected = app.session.state.selected_layers.clone();
-    let sel_keys = app.session.state.selected_keys.clone();
-    let mut ui_actions: Vec<UiAct> = Vec::new();
-    let idx_of = |id: LayerId| comp.index_of(id).unwrap_or(0);
+/// Starts the rows pass: the clipped painters and the background responses.
+fn begin_rows(app: &mut EffectcraftApp, ui: &mut egui::Ui, tl: Tl) -> Rw {
+    let rows_rect = tl.rows_rect;
+    let graph_x0 = tl.graph_x0;
+    let rect = tl.rect;
+    let lp = tl.p.with_clip_rect(rows_rect.intersect(Rect::from_min_max(rows_rect.min, pos2(graph_x0 - 1.0, rows_rect.max.y))));
+    // The rows reach through the gutter right of the time graph, but stop before the scroll bar.
+    let graph_rows = Rect::from_min_max(
+        pos2(graph_x0, rows_rect.min.y),
+        pos2(if tl.max_scroll > 0.0 { rect.max.x - widgets::SCROLL_GUTTER } else { rect.max.x }, rows_rect.max.y),
+    );
+    let gp = tl.p.with_clip_rect(rows_rect.intersect(graph_rows));
     let graph_on = app.ui.timeline.graph_editor;
     super::graph::track_open(ui.ctx(), graph_on);
     let full_clip = ui.clip_rect();
     let left_clip = full_clip.intersect(Rect::from_min_max(pos2(rect.min.x, rows_rect.min.y), pos2(graph_x0 - 1.0, rows_rect.max.y)));
-    let right_clip = full_clip.intersect(Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max));
+    let right_clip = full_clip.intersect(graph_rows);
     // Registered before the rows so keys, bars and editors on top of it get the pointer first.
     let empty_rect = if graph_on { Rect::NOTHING } else { Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max) };
-    let empty = ui.interact(empty_rect, egui::Id::new("tl-graph-bg"), Sense::click_and_drag());
+    let empty = ui.interact(empty_rect, egui::Id::unique("tl-graph-bg"), Sense::click_and_drag());
     let outline_rect = Rect::from_min_max(rows_rect.min, pos2(graph_x0 - 1.0, rows_rect.max.y));
-    let outline_empty = ui.interact(outline_rect, egui::Id::new("tl-layer-bg"), Sense::click_and_drag());
+    let outline_empty = ui.interact(outline_rect, egui::Id::unique("tl-layer-bg"), Sense::click_and_drag());
     app.auto.add("timeline.layerMarquee", outline_rect, "Drag empty outline to select layers");
-    let mut hit_rows: Vec<(Rect, Row)> = vec![];
-    // The value fields of multi-dimension properties (per dimension), for the pick whip.
-    let mut dim_hits: Vec<(u64, Vec<Rect>)> = vec![];
-    // Rows stripe by their index among the rows that are not expression editors, so adding or
-    // removing an expression leaves every other row's stripe alone; an editor takes the index
-    // (and so the stripe) of its property's row, the one just above.
-    let mut striped = 0usize;
-    for row in rows.iter() {
-        let ri = if matches!(row.kind, RowKind::Expr { .. }) {
-            striped.saturating_sub(1)
-        } else {
-            striped += 1;
-            striped - 1
-        };
-        // Outline widgets never spill into the time graph (narrow timelines).
-        ui.set_clip_rect(left_clip);
-        let hh = row_height(row, rh);
-        let r = Rect::from_min_size(pos2(rect.min.x, y), vec2(rect.width(), hh));
-        y += hh;
-        if r.max.y < rows_rect.min.y || r.min.y > rows_rect.max.y {
-            continue;
-        }
-        hit_rows.push((r, row.clone()));
-        let Some(layer) = comp.layer(row.layer) else { continue };
-        let is_sel = selected.contains(&layer.id);
-        let left = Rect::from_min_max(r.min, pos2(graph_x0 - 1.0, r.max.y));
-        let cy = r.min.y + rh / 2.0;
-        match &row.kind {
-            RowKind::Layer => {
-                // After Effects draws layer rows as one flat tone separated by dark hairlines
-                // (outline and time graph alike), not as alternating stripes.
-                let _ = ri;
-                lp.rect_filled(left, 0.0, if is_sel { t.row_selected } else { t.row_alt });
-                gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, if is_sel { t.tl_graph_selected } else { t.tl_bg });
-                lp.line_segment([pos2(rect.min.x, r.max.y - 0.5), pos2(graph_x0, r.max.y - 0.5)], Stroke::new(1.0, t.app_bg));
-                gp.line_segment([pos2(graph_x0, r.max.y - 0.5), pos2(r.max.x, r.max.y - 0.5)], Stroke::new(1.0, t.app_bg));
-                // A/V features.
-                let sw = &layer.switches;
-                // Every layer has the Video switch (the eye), nulls, cameras and lights included,
-                // as in After Effects: it hides a null's outline in the viewer and turns a camera or
-                // light off.
-                let av_items: [(Icon, bool, &str, bool); 4] = [
-                    (Icon::Eye, sw.video, "video", true),
-                    (Icon::Speaker, sw.audio, "audio", layer.props.sub("audio").is_some()),
-                    (Icon::Solo, sw.solo, "solo", layer.source.is_av()),
-                    (Icon::Lock, sw.locked, "lock", true),
-                ];
-                for (i, (icon, on, name, applicable)) in av_items.into_iter().enumerate() {
-                    let br = Rect::from_center_size(pos2(cw.av + 10.0 + 18.0 * i as f32, cy), vec2(15.0, 15.0));
-                    if !applicable || !vis.av {
-                        continue;
-                    }
-                    lp.rect_filled(br.shrink(0.5), 1.0, t.switch_well);
-                    layer_switch(ui, &t, r, br, icon, on, egui::Id::new(("av", layer.id.0, i)), layer.id.0, name, true, &mut actions);
-                    app.auto.add(&format!("timeline.layer.{}.{name}", layer.id.0), br, name);
-                }
-                // Label swatch.
-                if vis.label {
-                    let lr = Rect::from_center_size(pos2(cw.label + 10.0, cy), vec2(12.0, 12.0));
-                    lp.rect_filled(lr, 2.0, t.label(layer.label));
-                    let lresp = ui.interact(lr, egui::Id::new(("label", layer.id.0)), Sense::click());
-                    app.auto.add(&format!("timeline.layer.{}.label", layer.id.0), lr, layer.label.name());
-                    // Click (or right-click) the swatch for the label menu (After Effects).
-                    let pop = egui::Id::new(("label-pop", layer.id.0));
-                    if lresp.clicked() || lresp.secondary_clicked() {
-                        widgets::open_popup(ui, pop);
-                    }
-                    if let Some(lab) = widgets::label_popup(ui, pop, lr.left_bottom(), layer.label, |l| app.session.prefs.label_name(l), &t) {
-                        actions.push(("edit.label".into(), json!({"layers": [layer.id.0], "label": lab.name()})));
-                    }
-                }
-                if vis.num {
-                    lp.text(pos2(cw.num + 13.0, cy), Align2::CENTER_CENTER, format!("{}", idx_of(layer.id)), Tokens::ui(11.5), t.text_dim);
-                }
-                layer_cells(app, ui, &lp, &cw, &comp, layer, r, cy, &mut actions);
-                // Row click → select; double-click → rename; drag → reorder. Registered before the
-                // twirl and the name field so those sit on top and get their clicks.
-                let row_x0 = if vis.num { cw.num } else { cw.name + 16.0 };
-                let row_resp = ui.interact(
-                    Rect::from_min_max(pos2(row_x0, r.min.y), pos2(cw.name_end, r.max.y)),
-                    egui::Id::new(("row", layer.id.0)),
-                    Sense::click_and_drag(),
-                );
-                // Twirl + icon + name.
-                let tw = Rect::from_center_size(pos2(cw.name + 8.0, cy), vec2(14.0, 14.0));
-                let open = app.ui.timeline.open_layers.contains(&layer.id.0);
-                if widgets::twirl(ui, tw, open, egui::Id::new(("twirl", layer.id.0)), &t).clicked() {
-                    ui_actions.push(UiAct::ToggleLayer(layer.id.0, ui.input(|i| i.modifiers.alt || i.modifiers.command)));
-                }
-                app.auto.add(&format!("timeline.layer.{}.twirl", layer.id.0), tw, "twirl");
-                icons::paint(&lp, Rect::from_center_size(pos2(cw.name + 24.0, cy), vec2(13.0, 13.0)), layer_icon(layer, &app.session.project), t.text_dim);
-                // A guide layer carries a guide mark before its name (After Effects).
-                let name_x = if layer.switches.guide {
-                    let mark = Rect::from_center_size(pos2(cw.name + 40.0, cy), vec2(11.0, 11.0));
-                    icons::paint(&lp, mark, Icon::Grid, t.text_dim);
-                    app.auto.add(&format!("timeline.layer.{}.guide", layer.id.0), mark, "Guide Layer");
-                    cw.name + 50.0
-                } else {
-                    cw.name + 34.0
-                };
-                let name_rect = Rect::from_min_max(pos2(name_x, r.min.y), pos2(cw.name_end - 4.0, r.max.y));
-                let rename_id = egui::Id::new("tl-rename");
-                let renaming: Option<(u64, String)> = ctx.data(|d| d.get_temp(rename_id));
-                if let Some((rl, mut buf)) = renaming.filter(|(rl, _)| *rl == layer.id.0) {
-                    let mut child = ui.new_child(egui::UiBuilder::new().max_rect(name_rect.shrink2(vec2(0.0, 2.0))));
-                    let er = child.add(egui::TextEdit::singleline(&mut buf).font(Tokens::ui(12.0)).desired_width(name_rect.width()));
-                    app.auto.add(&format!("timeline.layer.{rl}.nameEdit"), er.rect, &buf);
-                    if ctx.data_mut(|d| d.remove_temp::<bool>(rename_focus_id())).unwrap_or(false) {
-                        // Just started: focus the field with the whole name selected.
-                        er.request_focus();
-                        widgets::select_all(&ctx, er.id, &buf);
-                    }
-                    if er.lost_focus() {
-                        if !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                            actions.push(("layer.rename".into(), json!({"layer": rl, "name": buf})));
-                        }
-                        ctx.data_mut(|d| d.remove::<(u64, String)>(rename_id));
-                    } else {
-                        ctx.data_mut(|d| d.insert_temp(rename_id, (rl, buf)));
-                    }
-                } else {
-                    // The selected layer's name sits in a light cell with dark text.
-                    let name_col = if is_sel { Color32::from_gray(0x16) } else { t.text };
-                    if is_sel {
-                        let g = lp.layout_no_wrap(display_name(app, layer), Tokens::ui(12.0), name_col);
-                        let cell = Rect::from_min_max(
-                            pos2(name_rect.min.x - 3.0, r.min.y + 1.0),
-                            pos2((name_rect.min.x + g.size().x + 4.0).max(cw.name_end - 4.0).min(cw.name_end - 2.0), r.max.y - 1.0),
-                        );
-                        lp.rect_filled(cell, 0.0, SELECTED_NAME_BG);
-                    }
-                    let lpn = lp.with_clip_rect(name_rect.intersect(lp.clip_rect()));
-                    lpn.text(pos2(name_rect.min.x, cy), Align2::LEFT_CENTER, display_name(app, layer), Tokens::ui(12.0), name_col);
-                }
-                // Locked layers can't be selected or moved (unlock them with the lock switch).
-                let locked = layer.switches.locked;
-                if row_resp.drag_started() && !locked {
-                    // The selected layers move together; an unselected row moves alone.
-                    let moving: Vec<u64> =
-                        if is_sel { comp.layers.iter().filter(|l| selected.contains(&l.id)).map(|l| l.id.0).collect() } else { vec![layer.id.0] };
-                    ctx.data_mut(|d| d.insert_temp(layer_drag_id(), moving));
-                }
-                if row_resp.drag_stopped() {
-                    ctx.data_mut(|d| d.insert_temp(layer_drop_id(), true));
-                }
-                app.auto.add(&format!("timeline.layer.{}.row", layer.id.0), left, &layer.name);
-                if row_resp.clicked() && !locked {
-                    let m = ui.input(|i| i.modifiers);
-                    if let Some(layers) = m.shift.then(|| shift_range(&ctx, cid, &comp, &rows, &selected, layer.id)).flatten() {
-                        actions.push(("layer.select".into(), json!({"layers": layers})));
-                    } else {
-                        actions.push(("layer.select".into(), json!({"layers": [layer.id.0], "toggle": m.command})));
-                        set_anchor(&ctx, cid, layer.id);
-                    }
-                }
-                if row_resp.double_clicked() {
-                    match double_click_action(layer) {
-                        Some(a) => actions.push(a),
-                        None => start_rename(&ctx, layer.id.0, &layer.name),
-                    }
-                }
-                layer_context_menu(&row_resp, &comp, layer, &selected, LayerMenuCaps::of(&app.session.project, layer), &mut app.auto, &mut actions);
-                // Switches.
-                let sws: [(Icon, bool, &str, bool); 8] = [
-                    (Icon::Shy, sw.shy, "shy", true),
-                    (Icon::Collapse, sw.collapse, "collapse", collapse_applies(layer, &app.session.project)),
-                    (Icon::Quality, sw.quality == effectcraft_engine::project::Quality::Best, "quality", layer.source.is_av()),
-                    (Icon::Fx, sw.effects, "fx", layer.effects().is_some_and(|f| !f.children.is_empty())),
-                    (
-                        Icon::FrameBlend,
-                        sw.frame_blend != effectcraft_engine::project::FrameBlend::Off,
-                        "frameBlend",
-                        matches!(layer.source, LayerSource::Footage { .. } | LayerSource::Comp { .. }),
-                    ),
-                    (Icon::MotionBlur, sw.motion_blur, "motionBlur", layer.source.is_av()),
-                    (Icon::Adjustment, sw.adjustment, "adjustment", layer.source.is_av()),
-                    (Icon::Cube, layer.is_3d(), "threeD", layer.source.is_av() || matches!(layer.source, LayerSource::Null)),
-                ];
-                for (i, (icon, on, name, applicable)) in sws.into_iter().enumerate() {
-                    if !applicable || !vis.switches {
-                        continue;
-                    }
-                    let br = Rect::from_center_size(pos2(cw.switches + SW * i as f32 + SW / 2.0, cy), vec2(16.0, 16.0));
-                    lp.rect_filled(br.shrink(1.0), 1.0, t.switch_well);
-                    layer_switch(ui, &t, r, br, icon, on, egui::Id::new(("sw", layer.id.0, i)), layer.id.0, name, false, &mut actions);
-                    app.auto.add(&format!("timeline.layer.{}.switch.{name}", layer.id.0), br, name);
-                }
-                // Modes.
-                if app.ui.timeline.show_modes && layer.source.is_av() {
-                    let mr = Rect::from_min_size(pos2(cw.mode + 2.0, cy - 9.0), vec2(80.0, 18.0));
-                    let mresp = widgets::dropdown(ui, mr, layer.blend_mode.label(), &t, egui::Id::new(("mode", layer.id.0)));
-                    app.auto.add(&format!("timeline.layer.{}.mode", layer.id.0), mr, "Mode");
-                    let pop = egui::Id::new(("mode-pop", layer.id.0));
-                    if mresp.clicked() {
-                        widgets::open_popup(ui, pop);
-                    }
-                    let opts: Vec<String> = BlendMode::ALL
-                        .iter()
-                        .flat_map(|m| if m.ends_group() { vec![m.label().to_string(), "-".to_string()] } else { vec![m.label().to_string()] })
-                        .collect();
-                    if let Some(i) = widgets::popup_menu(ui, pop, mr.left_bottom(), &opts, opts.iter().position(|o| o == layer.blend_mode.label())) {
-                        actions.push(("layer.setBlendMode".into(), json!({"layers": [layer.id.0], "mode": opts[i]})));
-                    }
-                    let tr = Rect::from_center_size(pos2(cw.mode + 76.0 + 6.0, cy), vec2(14.0, 14.0));
-                    if widgets::checkbox(ui, tr, layer.preserve_transparency, &t, egui::Id::new(("pt", layer.id.0))).clicked() {
-                        actions.push(("layer.setSwitch".into(), json!({"layers": [layer.id.0], "switch": "preserveTransparency"})));
-                    }
-                    // Track matte: layer picker + kind.
-                    let mr = Rect::from_min_size(pos2(cw.trkmat + 2.0, cy - 9.0), vec2(104.0, 18.0));
-                    let label = match layer.track_matte {
-                        Some(m) => comp.layer(m.layer).map(|l| format!("{} {}", idx_of(l.id), l.name)).unwrap_or("None".into()),
-                        None => "No Track Matte".into(),
-                    };
-                    // The cell is too narrow for the mode as well: it is in the tooltip and ticked in the menu.
-                    let tip = layer.track_matte.map(|m| format!("{label} · {}", crate::i18n::tr(m.kind.label())));
-                    let tresp = widgets::dropdown_tip(ui, mr, &label, tip.as_deref(), &t, egui::Id::new(("trkmat", layer.id.0)));
-                    app.auto.add(&format!("timeline.layer.{}.trackMatte", layer.id.0), mr, "Track Matte");
-                    let pop = egui::Id::new(("trk-pop", layer.id.0));
-                    if tresp.clicked() {
-                        widgets::open_popup(ui, pop);
-                    }
-                    // The menu lists every layer: built only while it is open (per visible row
-                    // it made a big comp's timeline quadratic).
-                    let mut opts = vec!["No Track Matte".to_string(), "-".to_string()];
-                    let mut candidates: Vec<&Layer> = vec![];
-                    if widgets::popup_is_open(ui, pop) {
-                        for (i, l) in comp.layers.iter().enumerate().filter(|(_, l)| l.id != layer.id && l.source.is_av()) {
-                            opts.push(format!("{}. {}", i + 1, l.name));
-                            candidates.push(l);
-                        }
-                        opts.push("-".into());
-                        for k in MatteKind::ALL {
-                            opts.push(k.label().into());
-                        }
-                    }
-                    let current = layer.track_matte.and_then(|m| opts.iter().position(|o| o == m.kind.label()));
-                    if let Some(i) = widgets::popup_menu(ui, pop, mr.left_bottom(), &opts, current) {
-                        let ids: Vec<LayerId> = candidates.iter().map(|l| l.id).collect();
-                        if let Some(a) = opts.get(i).and_then(|o| track_matte_pick(layer, &ids, i, o)) {
-                            actions.push(a);
-                        }
-                    }
-                    if layer.track_matte.is_some() {
-                        let kr = Rect::from_center_size(pos2(mr.max.x - 26.0, cy), vec2(10.0, 10.0));
-                        let _ = kr;
-                    }
-                }
-                // Parent.
-                if vis.parent {
-                    pick_whip(
-                        app,
-                        ui,
-                        &lp,
-                        Rect::from_center_size(pos2(cw.parent + 9.0, cy), vec2(15.0, 15.0)),
-                        (WHIP_PARENT, layer.id.0, 0),
-                        &format!("timeline.layer.{}.pickWhip", layer.id.0),
-                        "Parent pick whip",
-                        crate::i18n::tr("Parent pick whip: drag onto a layer"),
-                    );
-                    let pr_rect = Rect::from_min_size(pos2(cw.parent + 20.0, cy - 9.0), vec2(94.0, 18.0));
-                    let plabel = layer.parent.and_then(|p| comp.layer(p)).map(|l| format!("{}. {}", idx_of(l.id), l.name)).unwrap_or_else(|| "None".into());
-                    let presp = widgets::dropdown(ui, pr_rect, &plabel, &t, egui::Id::new(("parent", layer.id.0)));
-                    app.auto.add(&format!("timeline.layer.{}.parent", layer.id.0), pr_rect, "Parent");
-                    let pop = egui::Id::new(("par-pop", layer.id.0));
-                    if presp.clicked() {
-                        widgets::open_popup(ui, pop);
-                    }
-                    let mut cands: Vec<&Layer> = vec![];
-                    let mut popts = vec!["None".to_string(), "-".to_string()];
-                    if widgets::popup_is_open(ui, pop) {
-                        for (i, l) in comp.layers.iter().enumerate().filter(|(_, l)| l.id != layer.id) {
-                            popts.push(format!("{}. {}", i + 1, l.name));
-                            cands.push(l);
-                        }
-                    }
-                    if let Some(i) = widgets::popup_menu(ui, pop, pr_rect.left_bottom(), &popts, None) {
-                        let par = if i == 0 { serde_json::Value::Null } else { json!(cands[i - 2].id.0) };
-                        actions.push(("layer.setParent".into(), json!({"layers": [layer.id.0], "parent": par})));
-                    }
-                }
-                // Layer bar.
-                ui.set_clip_rect(right_clip);
-                if !graph_on {
-                    let x_in = tm.x(layer.in_point.seconds());
-                    let x_out = tm.x(layer.out_point.seconds());
-                    let bar = Rect::from_min_max(pos2(x_in, r.min.y + 1.0), pos2(x_out, r.max.y - 1.0));
-                    let lc = t.label(layer.label);
-                    let fill = bar_color(lc, is_sel);
-                    gp.rect_filled(bar, 0.0, fill);
-                    if is_sel {
-                        gp.rect_stroke(bar, 0.0, Stroke::new(1.0, Color32::from_white_alpha(90)), StrokeKind::Inside);
-                    }
-                    // Source extent (e.g. trimmed footage) shown faint.
-                    if let LayerSource::Footage { .. } | LayerSource::Comp { .. } = layer.source
-                        && let Some(d) = layer.source.item().and_then(|i| app.session.project.item(i)).and_then(|i| i.duration())
-                    {
-                        let xs = tm.x(layer.start_time.seconds());
-                        let xe = tm.x(layer.comp_time(d).seconds());
-                        let ghost = Rect::from_min_max(pos2(xs.min(xe), r.min.y + 9.0), pos2(xs.max(xe), r.max.y - 9.0));
-                        gp.rect_filled(ghost, 1.0, lc.gamma_multiply(0.18));
-                        // The bar past the source's end (its last frame held) or before its start
-                        // is striped, so the source's own span shows (#290). Time remapping
-                        // decides what shows there itself.
-                        if layer.props.get("timeRemap").is_none() {
-                            for (side, part) in [
-                                ("beforeSource", Rect::from_min_max(bar.min, pos2(ghost.min.x, bar.max.y))),
-                                ("afterSource", Rect::from_min_max(pos2(ghost.max.x, bar.min.y), bar.max)),
-                            ] {
-                                if part.width() >= 1.0 {
-                                    stripes(&gp, part, lc);
-                                    app.auto.add(&format!("timeline.layer.{}.bar.{side}", layer.id.0), part, "Past the source");
-                                }
-                            }
-                        }
-                        // Dragging the source bar outside the in/out span slips the source.
-                        for (side, gr) in [
-                            ("l", Rect::from_min_max(ghost.min, pos2(bar.min.x, ghost.max.y))),
-                            ("r", Rect::from_min_max(pos2(bar.max.x, ghost.min.y), ghost.max)),
-                        ] {
-                            if gr.width() < 2.0 {
-                                continue;
-                            }
-                            let gresp = ui
-                                .interact(gr, egui::Id::new(("ghost", side, layer.id.0)), Sense::click_and_drag())
-                                .on_hover_text(crate::i18n::tr("Drag to slip the source"));
-                            // Outside the bar it is empty track area: a plain click deselects.
-                            if gresp.clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
-                                actions.push(("layer.select".into(), json!({"layers": []})));
-                            }
-                            app.auto.add(&format!("timeline.layer.{}.source{}", layer.id.0, side), gr, "Slip");
-                            if gresp.hovered() || gresp.dragged() {
-                                ctx.set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
-                            }
-                            let acc_id = egui::Id::new(("slip-acc", layer.id.0));
-                            if gresp.dragged() {
-                                let mut acc: f32 = ctx.data(|d| d.get_temp(acc_id).unwrap_or(0.0));
-                                acc += gresp.drag_delta().x;
-                                let frames = ((acc as f64 / pps) / fd).trunc() as i64;
-                                if frames != 0 {
-                                    acc -= (frames as f64 * fd * pps) as f32;
-                                    actions.push((
-                                        "layer.slip".into(),
-                                        json!({"layers": [layer.id.0], "frames": frames, "merge": format!("slip-{}", layer.id.0)}),
-                                    ));
-                                }
-                                ctx.data_mut(|d| d.insert_temp(acc_id, acc));
-                            }
-                            if gresp.drag_stopped() {
-                                ctx.data_mut(|d| d.remove::<f32>(acc_id));
-                                ui_actions.push(UiAct::EndMerge);
-                            }
-                        }
-                    }
-                    app.auto.add(&format!("timeline.layer.{}.bar", layer.id.0), bar, &layer.name);
-                    // Interactions: move body, trim edges.
-                    let (body_r, in_r, out_r) = trim_zones(bar);
-                    let body = ui.interact(body_r, egui::Id::new(("bar", layer.id.0)), Sense::click_and_drag());
-                    let lin = ui.interact(in_r, egui::Id::new(("bar-in", layer.id.0)), Sense::drag());
-                    let lout = ui.interact(out_r, egui::Id::new(("bar-out", layer.id.0)), Sense::drag());
-                    app.auto.add(&format!("timeline.layer.{}.bar.in", layer.id.0), in_r, "Trim In");
-                    app.auto.add(&format!("timeline.layer.{}.bar.out", layer.id.0), out_r, "Trim Out");
-                    if lin.hovered() || lout.hovered() || lin.dragged() || lout.dragged() {
-                        trim_cursor(&ctx);
-                    }
-                    if body.double_clicked()
-                        && let Some(a) = double_click_action(layer)
-                    {
-                        actions.push(a);
-                    }
-                    let shift = ui.input(|i| i.modifiers.shift);
-                    if let Some(layers) = (body.clicked() && shift).then(|| shift_range(&ctx, cid, &comp, &rows, &selected, layer.id)).flatten() {
-                        // Shift-click: the layers from the last one clicked to this one, as in
-                        // the layer outline.
-                        actions.push(("layer.select".into(), json!({"layers": layers})));
-                    } else {
-                        if (body.clicked() || body.drag_started()) && !is_sel {
-                            actions.push(("layer.select".into(), json!({"layers": [layer.id.0], "add": shift})));
-                        }
-                        if (body.clicked() || body.drag_started()) && !shift {
-                            set_anchor(&ctx, cid, layer.id);
-                        }
-                    }
-                    layer_context_menu(&body, &comp, layer, &selected, LayerMenuCaps::of(&app.session.project, layer), &mut app.auto, &mut actions);
-                    let drag_key = format!("bar-{}", layer.id.0);
-                    // Ctrl/Cmd+Alt dragging a selected bar: Quick Offset (#1012), chosen as the
-                    // drag starts and followed below the rows until the button is released.
-                    let mods = ui.input(|i| i.modifiers);
-                    if body.drag_started()
-                        && is_sel
-                        && mods.command
-                        && mods.alt
-                        && let Some(n) = quick_offset_layers(&comp, selected.iter().copied())
-                        && let Some(p) = ctx.input(|i| i.pointer.press_origin())
-                    {
-                        ctx.data_mut(|d| d.insert_temp(quick_bar_id(), QuickBar { layer: layer.id, origin_x: p.x, layers: n, applied: 0 }));
-                    }
-                    let quick = ctx.data(|d| d.get_temp::<QuickBar>(quick_bar_id())).is_some_and(|q| q.layer == layer.id);
-                    for (resp, kind) in [(&body, "move"), (&lin, "in"), (&lout, "out")] {
-                        if kind == "move" && quick {
-                            continue;
-                        }
-                        if resp.dragged() {
-                            let acc_id = egui::Id::new(("bar-acc", layer.id.0, kind));
-                            let mut acc: f32 = ctx.data(|d| d.get_temp(acc_id).unwrap_or(0.0));
-                            acc += resp.drag_delta().x;
-                            let frames = ((acc as f64 / pps) / fd).trunc() as i64;
-                            if frames != 0 {
-                                acc -= (frames as f64 * fd * pps) as f32;
-                                let d = frames as f64 * fd;
-                                // Moving or trimming a selected layer acts on the whole
-                                // selection; each layer trims from its own in/out point.
-                                let targets = if is_sel { json!(selected.iter().map(|l| l.0).collect::<Vec<_>>()) } else { json!([layer.id.0]) };
-                                let params = match kind {
-                                    "move" => json!({"layers": targets, "delta": d, "merge": drag_key}),
-                                    "in" => json!({"layers": targets, "inDelta": d, "merge": drag_key}),
-                                    _ => json!({"layers": targets, "outDelta": d, "merge": drag_key}),
-                                };
-                                actions.push(("layer.timing".into(), params));
-                            }
-                            ctx.data_mut(|d| d.insert_temp(acc_id, acc));
-                        }
-                        if resp.drag_stopped() {
-                            ctx.data_mut(|d| d.remove::<f32>(egui::Id::new(("bar-acc", layer.id.0, kind))));
-                            ui_actions.push(UiAct::EndMerge);
-                        }
-                    }
-                    // Markers on the layer (drag, Alt-drag duration, Cmd-click delete, dialog).
-                    let gclip = rows_rect.intersect(Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max));
-                    super::markers_ui::layer_markers(app, ui, gclip, &comp, layer, tm, r);
-                }
-            }
-            RowKind::Group { uid, name, open, has_children, fx, eye } => {
-                // The row draws an effect's name in the interface language (#821); `name` stays
-                // the property tree's, which the automation labels below keep. Any other group
-                // (a mask, a shape group, a layer style) draws its own name.
-                let group = layer.props.find_group(*uid);
-                let shown = match group.and_then(|g| match &g.kind {
-                    GroupKind::Effect { effect } => Some(effect.as_str()),
-                    _ => None,
-                }) {
-                    Some(effect) => crate::i18n::effects::group(effect, name),
-                    None => name.clone(),
-                };
-                // Selected groups (an effect, a mask, a shape group…) highlight like selected
-                // property rows.
-                let sel_group = app.session.state.selected_props.contains(&(layer.id, *uid));
-                lp.rect_filled(
-                    left,
-                    0.0,
-                    if sel_group {
-                        t.row_selected
-                    } else if ri % 2 == 0 {
-                        t.row
-                    } else {
-                        t.row_alt
-                    },
-                );
-                gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, t.tl_bg);
-                // An effect's colour label (26.5): the same bar the Effect Controls header wears,
-                // on the row's left edge.
-                if let Some(lab) =
-                    group.filter(|g| matches!(g.kind, GroupKind::Effect { .. })).and_then(|g| g.label).filter(|l| *l != effectcraft_engine::color::Label::None)
-                {
-                    let [lr, lg, lb] = app.session.prefs.label_rgb(lab);
-                    let bar = Rect::from_min_size(left.min, vec2(4.0, left.height()));
-                    lp.rect_filled(bar, 0.0, Color32::from_rgb(lr, lg, lb));
-                    app.auto.add(&format!("timeline.group.{uid}.label"), bar, &app.session.prefs.label_name(lab));
-                }
-                let indent = cw.name + 6.0 + 14.0 * row.depth as f32;
-                if *has_children {
-                    let tw = Rect::from_center_size(pos2(indent, cy), vec2(13.0, 13.0));
-                    if widgets::twirl(ui, tw, *open, egui::Id::new(("gtw", uid)), &t).clicked() {
-                        // Alt/Cmd-click twirls the whole tree under the group (as on a layer).
-                        ui_actions.push(UiAct::ToggleGroup(layer.id.0, *uid, ui.input(|i| i.modifiers.alt || i.modifiers.command)));
-                    }
-                    app.auto.add(&format!("timeline.group.{uid}.twirl"), tw, name);
-                }
-                if let Some(en) = fx {
-                    let fr_ = Rect::from_center_size(pos2(cw.switches + SW * 3.0 + SW / 2.0, cy), vec2(16.0, 16.0));
-                    if widgets::icon_toggle(ui, fr_, Icon::Fx, *en, &t, egui::Id::new(("gfx", uid)), Sense::click()).clicked() {
-                        actions.push(("effect.toggle".into(), json!({"layer": layer.id.0, "effect": uid})));
-                    }
-                    app.auto.add(&format!("timeline.group.{uid}.fx"), fr_, name);
-                }
-                if let Some(en) = eye {
-                    // Layer style eye switch in the A/V column, like AE.
-                    let er = Rect::from_center_size(pos2(cw.av + 10.0, cy), vec2(15.0, 15.0));
-                    lp.rect_stroke(er.shrink(1.5), 2.0, Stroke::new(1.0, t.separator), StrokeKind::Inside);
-                    if widgets::icon_toggle(ui, er, Icon::Eye, *en, &t, egui::Id::new(("geye", uid)), Sense::click()).clicked() {
-                        actions.push(("layer.style.toggle".into(), json!({"layer": layer.id.0, "style": uid})));
-                    }
-                    app.auto.add(&format!("timeline.group.{uid}.eye"), er, name);
-                }
-                let group_edit: Option<(u64, u64, String)> = ctx.data(|d| d.get_temp(group_rename_id()));
-                if let Some((_, _, mut buf)) = group_edit.filter(|(rl, ru, _)| *rl == layer.id.0 && ru == uid) {
-                    let field = Rect::from_min_max(pos2(indent + 8.0, r.min.y + 2.0), pos2((cw.switches - 4.0).max(indent + 60.0), r.max.y - 2.0));
-                    let mut child = ui.new_child(egui::UiBuilder::new().max_rect(field));
-                    let er = child.add(egui::TextEdit::singleline(&mut buf).font(Tokens::ui(12.0)).desired_width(field.width()));
-                    app.auto.add(&format!("timeline.group.{uid}.nameEdit"), er.rect, &buf);
-                    if ctx.data_mut(|d| d.remove_temp::<bool>(rename_focus_id())).unwrap_or(false) {
-                        er.request_focus();
-                        widgets::select_all(&ctx, er.id, &buf);
-                    }
-                    if er.lost_focus() {
-                        if !ui.input(|i| i.key_pressed(egui::Key::Escape)) && !buf.trim().is_empty() && buf != *name {
-                            actions.push(("prop.renameGroup".into(), json!({"layer": layer.id.0, "prop": uid, "name": buf})));
-                        }
-                        ctx.data_mut(|d| d.remove::<(u64, u64, String)>(group_rename_id()));
-                    } else {
-                        ctx.data_mut(|d| d.insert_temp(group_rename_id(), (layer.id.0, *uid, buf)));
-                    }
-                } else {
-                    lp.text(pos2(indent + 10.0, cy), Align2::LEFT_CENTER, &shown, Tokens::ui(12.0), t.text);
-                }
-                text_anim_popups(app, ui, &lp, layer, *uid, cw.switches, cy, &mut actions);
-                shape_add_popup(app, ui, &lp, layer, *uid, cw.switches, cy, &mut actions);
-                if *uid == GEOM_BIT | layer.id.0 {
-                    let lr = lp.text(pos2(cw.switches + 6.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Change Renderer…"), Tokens::ui(11.5), t.accent);
-                    let resp = ui
-                        .interact(lr, egui::Id::new(("tl-change-renderer", layer.id.0)), Sense::click())
-                        .on_hover_text(crate::i18n::tr("Composition Settings ▸ 3D Renderer"));
-                    if resp.hovered() {
-                        ctx.set_cursor_icon(egui::CursorIcon::PointingHand);
-                    }
-                    app.auto.add(&format!("timeline.layer.{}.changeRenderer", layer.id.0), lr, "Change Renderer…");
-                    if resp.clicked() {
-                        ui_actions.push(UiAct::ChangeRenderer);
-                    }
-                }
-                dash_buttons(app, ui, &lp, layer, *uid, cw.switches, cy, &mut actions);
-                // Mask mode + inverted inline.
-                if let Some(g) = layer.props.find_group(*uid)
-                    && let GroupKind::Mask { mode, inverted, .. } = g.kind
-                {
-                    let mr = Rect::from_min_size(pos2(cw.switches + 4.0, cy - 9.0), vec2(80.0, 18.0));
-                    let pop = egui::Id::new(("maskmode", uid));
-                    if widgets::dropdown(ui, mr, mode.label(), &t, egui::Id::new(("mm", uid))).clicked() {
-                        widgets::open_popup(ui, pop);
-                    }
-                    let opts: Vec<String> = effectcraft_engine::project::MaskMode::ALL.iter().map(|m| m.label().to_string()).collect();
-                    if let Some(i) = widgets::popup_menu(ui, pop, mr.left_bottom(), &opts, None) {
-                        actions.push(("layer.setMask".into(), json!({"layer": layer.id.0, "mask": uid, "mode": opts[i]})));
-                    }
-                    let ir = Rect::from_min_size(pos2(mr.max.x + 8.0, cy - 8.0), vec2(16.0, 16.0));
-                    if widgets::checkbox(ui, ir, inverted, &t, egui::Id::new(("minv", uid))).clicked() {
-                        actions.push(("layer.setMask".into(), json!({"layer": layer.id.0, "mask": uid, "inverted": !inverted})));
-                    }
-                    lp.text(pos2(ir.max.x + 4.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Inverted"), Tokens::ui(11.0), t.text_dim);
-                }
-                let gr_rect = Rect::from_min_max(pos2(indent + 8.0, r.min.y), pos2(cw.switches, r.max.y));
-                let gr = ui.interact(gr_rect, egui::Id::new(("grow", uid)), Sense::click());
-                app.auto.add(&format!("timeline.group.{uid}.name"), gr_rect, name);
-                if gr.clicked() && uid & (WAVE_BIT | GEOM_BIT) == 0 {
-                    actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "selectKeys": false})));
-                }
-                if gr.double_clicked() {
-                    if fx.is_some() {
-                        // An effect's name: open it in Effect Controls (as in After Effects).
-                        actions.push(("layer.select".into(), json!({"layers": [layer.id.0]})));
-                        actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "selectKeys": false})));
-                        actions.push(("window.panel".into(), json!({"panel": "EffectControls"})));
-                    } else {
-                        ui_actions.push(UiAct::ToggleGroup(layer.id.0, *uid, false));
-                    }
-                }
-            }
-            RowKind::Waveform { item } => {
-                lp.rect_filled(left, 0.0, if ri % 2 == 0 { t.row } else { t.row_alt });
-                let indent = cw.name + 6.0 + 14.0 * row.depth as f32;
-                lp.text(pos2(indent + 10.0, cy), Align2::LEFT_CENTER, "Waveform", Tokens::ui(12.0), t.text);
-                let wr = Rect::from_min_max(pos2(graph_x0, r.min.y), r.max);
-                gp.rect_filled(wr, 0.0, t.tl_bg);
-                app.auto.add(&format!("timeline.layer.{}.waveform", layer.id.0), wr, "Waveform");
-                match super::waveform::summary(app, &ctx, ItemId(*item)) {
-                    Some(s) => super::waveform::draw(&gp, wr.shrink2(vec2(0.0, 2.0)), &tm, layer, &s, Color32::from_rgb(0x5f, 0xc8, 0x8a)),
-                    None => {
-                        gp.text(
-                            pos2(tm.x(layer.in_point.seconds()).max(wr.min.x) + 6.0, wr.center().y),
-                            Align2::LEFT_CENTER,
-                            "Building waveform…",
-                            Tokens::ui(11.0),
-                            t.text_faint,
-                        );
-                    }
-                }
-            }
-            RowKind::Expr { uid, lines } => {
-                let Some(prop) = layer.props.find(*uid) else { continue };
-                let Some(ex) = prop.expr.clone() else { continue };
-                let (buf_id, edit_id) = (expr_buf_id(*uid), egui::Id::new(("expr-edit", uid)));
-                // The same background as its property's row, selection included.
-                let sel_prop = app.session.state.selected_props.contains(&(layer.id, *uid));
-                lp.rect_filled(
-                    left,
-                    0.0,
-                    if sel_prop {
-                        t.row_selected
-                    } else if ri % 2 == 0 {
-                        t.row
-                    } else {
-                        t.row_alt
-                    },
-                );
-                let indent = cw.name + 6.0 + 14.0 * row.depth as f32;
-                lp.text(pos2(indent + 12.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Expression:"), Tokens::ui(11.5), t.text_dim);
-                lp.text(pos2(indent + 82.0, cy), Align2::LEFT_CENTER, &prop.name, Tokens::ui(11.5), t.text);
-                // "=" enable switch and the property pick whip (AE's expression controls).
-                let en_r = Rect::from_center_size(pos2(cw.switches + 10.0, cy), vec2(16.0, 16.0));
-                let en = ui.interact(en_r, egui::Id::new(("expr-en", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Enable Expression"));
-                lp.rect_stroke(en_r.shrink(1.0), 2.0, Stroke::new(1.0, t.separator), StrokeKind::Inside);
-                let expr_col = t.expr_text;
-                lp.text(
-                    en_r.center(),
-                    Align2::CENTER_CENTER,
-                    if ex.enabled { "=" } else { "≠" },
-                    Tokens::semibold(13.0),
-                    if ex.enabled { expr_col } else { t.text_dim },
-                );
-                app.auto.add(&format!("timeline.prop.{uid}.exprEnable"), en_r, "Enable Expression");
-                if en.clicked() {
-                    actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid, "enabled": !ex.enabled})));
-                }
-                let pw = pick_whip(
-                    app,
-                    ui,
-                    &lp,
-                    Rect::from_center_size(pos2(cw.switches + 30.0, cy), vec2(15.0, 15.0)),
-                    (WHIP_EXPR, layer.id.0, *uid),
-                    &format!("timeline.prop.{uid}.pickWhip"),
-                    "Expression pick whip",
-                    crate::i18n::tr("Expression pick whip: drag onto a property"),
-                );
-                if pw.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_pressed()) {
-                    // Pressed while the expression is being edited (its text is buffered while
-                    // the editor has the focus): the reference will go in at the cursor,
-                    // replacing the selection (#284).
-                    let into = ctx.data(|d| d.get_temp::<String>(buf_id)).map(|buf| {
-                        let n = buf.chars().count();
-                        let sel = egui::text_edit::TextEditState::load(&ctx, edit_id)
-                            .and_then(|st| st.cursor.char_range())
-                            .map_or([n, n], |r| [r.primary.index.0.min(r.secondary.index.0).min(n), r.primary.index.0.max(r.secondary.index.0).min(n)]);
-                        (buf, sel)
-                    });
-                    ctx.data_mut(|d| {
-                        if let Some(into) = into {
-                            d.insert_temp(whip_into_id(*uid), into);
-                        } else {
-                            d.remove::<WhipInto>(whip_into_id(*uid));
-                        }
-                    });
-                }
-                // Syntax errors: warning in the outline (the expression is disabled).
-                if let Some(check) = app.session.expr_check
-                    && let Err(e) = check(&ex.text)
-                {
-                    let wr = Rect::from_center_size(pos2(cw.switches + 50.0, cy), vec2(14.0, 14.0));
-                    lp.text(wr.center(), Align2::CENTER_CENTER, "⚠", Tokens::ui(12.0), Color32::from_rgb(0xf0, 0xa0, 0x30));
-                    let _ = ui.interact(wr, egui::Id::new(("expr-err", uid)), Sense::hover()).on_hover_text(e);
-                }
-                // ⓕ: the Expression Language menu inserts at the cursor.
-                let lang_r = Rect::from_center_size(pos2(cw.switches + 70.0, cy), vec2(16.0, 16.0));
-                let lang = ui.interact(lang_r, egui::Id::new(("expr-lang", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Expression Language Menu"));
-                lp.circle_stroke(lang_r.center(), 6.5, Stroke::new(1.0, if lang.hovered() { t.text } else { t.text_dim }));
-                lp.text(lang_r.center(), Align2::CENTER_CENTER, "f", Tokens::semibold(10.0), if lang.hovered() { t.text } else { t.text_dim });
-                app.auto.add(&format!("timeline.prop.{uid}.exprLanguage"), lang_r, "Expression Language Menu");
-                let mut picked: Option<&'static str> = None;
-                egui::Popup::menu(&lang).style(crate::widgets::menu_style).show(|ui| {
-                    for (cat, items) in effectcraft_engine::commands::expr_tools::language_menu() {
-                        ui.menu_button(cat, |ui| {
-                            widgets::menu_scroll(ui, |ui| {
-                                for (label, text) in items {
-                                    if ui.button(label).clicked() {
-                                        picked = Some(text);
-                                        ui.close();
-                                    }
-                                }
-                            })
-                        });
-                    }
-                });
-                if let Some(text) = picked {
-                    let cur: String = ctx.data(|d| d.get_temp(buf_id)).unwrap_or_else(|| ex.text.clone());
-                    let at = egui::text_edit::TextEditState::load(&ctx, edit_id)
-                        .and_then(|st| st.cursor.char_range())
-                        .map(|r| r.primary.index.0)
-                        .unwrap_or(cur.chars().count())
-                        .min(cur.chars().count());
-                    let byte = cur.char_indices().nth(at).map(|(b, _)| b).unwrap_or(cur.len());
-                    let mut next = cur.clone();
-                    next.insert_str(byte, text);
-                    actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid, "expression": next})));
-                    ctx.data_mut(|d| d.remove::<String>(buf_id));
-                }
-                // The editor in the time-graph area.
-                ui.set_clip_rect(right_clip);
-                gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, t.expr_bg);
-                let er = Rect::from_min_max(pos2(graph_x0 + 8.0, r.min.y + 3.0), pos2(rect.max.x - 14.0, r.max.y - 3.0));
-                let mut buf: String = ctx.data(|d| d.get_temp(buf_id)).unwrap_or_else(|| ex.text.clone());
-                if let Some(after) = ctx.data_mut(|d| d.remove_temp::<usize>(expr_refocus_id(*uid))) {
-                    // A pick whip just put a reference in: editing goes on in the new text,
-                    // the cursor after the reference.
-                    buf = ex.text.clone();
-                    let mut st = egui::text_edit::TextEditState::load(&ctx, edit_id).unwrap_or_default();
-                    st.cursor.set_char_range(Some(egui::text::CCursorRange::one(egui::text::CCursor::new(buf.chars().count().saturating_sub(after)))));
-                    st.store(&ctx, edit_id);
-                    ctx.memory_mut(|m| m.request_focus(edit_id));
-                }
-                // Settings ▸ Scripting & Expressions ▸ Expressions Editor.
-                let sp = app.session.prefs.scripting.clone();
-                let resp = super::expr_editor::editor(ui, edit_id, &mut buf, er, &sp, if ex.enabled { expr_col } else { t.text_dim }, *lines, &t);
-                app.auto.add(&format!("timeline.prop.{uid}.expression"), er, &prop.name);
-                // Its bottom edge drags to set its height in whole lines, as in After Effects.
-                let edge = Rect::from_min_max(pos2(er.min.x, r.max.y - 4.0), pos2(er.max.x, r.max.y));
-                let eresp = ui.interact(edge, egui::Id::new(("expr-edge", uid)), Sense::drag());
-                app.auto.add(&format!("timeline.prop.{uid}.expressionHeight"), edge, "Expression field height");
-                if eresp.hovered() || eresp.dragged() {
-                    ctx.set_cursor_icon(egui::CursorIcon::ResizeVertical);
-                }
-                if let Some(py) = eresp.interact_pointer_pos().filter(|_| eresp.dragged()).map(|p| p.y) {
-                    let n = ((py - r.min.y) / rh).round().clamp(1.0, EXPR_MAX_LINES as f32);
-                    app.ui.timeline.expr_lines.insert(*uid, n as usize);
-                }
-                let commit = resp.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter) && (i.modifiers.command || i.modifiers.ctrl));
-                if commit {
-                    resp.surrender_focus();
-                }
-                if resp.has_focus() && !commit {
-                    ctx.data_mut(|d| d.insert_temp(buf_id, buf));
-                } else {
-                    if (resp.lost_focus() || commit) && buf.trim_end() != ex.text {
-                        actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid, "expression": buf.trim_end()})));
-                    }
-                    ctx.data_mut(|d| d.remove::<String>(buf_id));
-                }
-            }
-            RowKind::Prop { uid } => {
-                let Some(prop) = layer.props.find(*uid) else { continue };
-                app.auto.add(&format!("timeline.prop.{uid}.row"), r, &prop.name);
-                let sel_prop = app.session.state.selected_props.contains(&(layer.id, *uid));
-                lp.rect_filled(
-                    left,
-                    0.0,
-                    if sel_prop {
-                        t.row_selected
-                    } else if ri % 2 == 0 {
-                        t.row
-                    } else {
-                        t.row_alt
-                    },
-                );
-                gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, t.tl_bg);
-                let indent = cw.name + 6.0 + 14.0 * row.depth as f32;
-                // Keyframe navigator (in the A/V column, like AE).
-                // (in the Keys column when it is shown).
-                if prop.is_animated() && (vis.keys || vis.av) {
-                    let lt = layer.layer_time(time);
-                    let at_key = effectcraft_engine::keyframe::key_at(&prop.keys, lt).is_some();
-                    let nav_x = if vis.keys { cw.keys + 12.0 } else { cw.av + 18.0 };
-                    let prev = Rect::from_center_size(pos2(nav_x, cy), vec2(12.0, 14.0));
-                    let mid = Rect::from_center_size(pos2(nav_x + 16.0, cy), vec2(14.0, 14.0));
-                    let next = Rect::from_center_size(pos2(nav_x + 32.0, cy), vec2(12.0, 14.0));
-                    icons::paint(&lp, prev.shrink(2.0), Icon::ChevronLeft, t.text_dim);
-                    icons::paint(&lp, next.shrink(2.0), Icon::ChevronRight, t.text_dim);
-                    let kc = if at_key { t.keyframe_selected } else { Color32::TRANSPARENT };
-                    lp.add(egui::Shape::convex_polygon(
-                        vec![mid.center() + vec2(0.0, -5.0), mid.center() + vec2(5.0, 0.0), mid.center() + vec2(0.0, 5.0), mid.center() + vec2(-5.0, 0.0)],
-                        kc,
-                        Stroke::new(1.0, t.text_dim),
-                    ));
-                    if ui.interact(prev, egui::Id::new(("kprev", uid)), Sense::click()).clicked()
-                        && let Some(k) = prop.keys.iter().rev().find(|k| layer.comp_time(k.time).0 < time.0 - fr.frame_duration().0 / 2)
-                    {
-                        ui_actions.push(UiAct::SetTime(layer.comp_time(k.time)));
-                    }
-                    if ui.interact(next, egui::Id::new(("knext", uid)), Sense::click()).clicked()
-                        && let Some(k) = prop.keys.iter().find(|k| layer.comp_time(k.time).0 > time.0 + fr.frame_duration().0 / 2)
-                    {
-                        ui_actions.push(UiAct::SetTime(layer.comp_time(k.time)));
-                    }
-                    if ui.interact(mid, egui::Id::new(("kmid", uid)), Sense::click()).clicked() {
-                        actions.push(("prop.toggleKey".into(), json!({"layer": layer.id.0, "prop": uid})));
-                    }
-                    app.auto.add(&format!("timeline.prop.{uid}.addKey"), mid, "Add or remove keyframe");
-                }
-                // Stopwatch: Alt+click adds an expression; a press toggles the animation, and
-                // dragging on over other stopwatches gives them the same state (#284).
-                if !prop.static_only {
-                    let swr = Rect::from_center_size(pos2(indent, cy), vec2(15.0, 15.0));
-                    let resp = ui.interact(swr, egui::Id::new(("stopwatch", uid)), Sense::click_and_drag());
-                    let col = if prop.is_animated() {
-                        t.hot_text
-                    } else if resp.hovered() {
-                        t.text
-                    } else {
-                        t.text_dim
-                    };
-                    icons::paint(&lp, swr, Icon::Stopwatch, col);
-                    app.auto.add(&format!("timeline.prop.{uid}.stopwatch"), swr, &prop.name);
-                    if ui.input(|i| i.modifiers.alt) {
-                        if resp.clicked() {
-                            actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid})));
-                        }
-                    } else if let Some((value, merge)) = switch_gesture(ui, &resp, r, "stopwatch", prop.is_animated()) {
-                        actions.push(("prop.toggleAnimation".into(), json!({"layer": layer.id.0, "prop": uid, "value": value, "merge": merge})));
-                    } else if resp.clicked() && !resp.clicked_by(egui::PointerButton::Primary) {
-                        // Keyboard or accessibility activation.
-                        actions.push(("prop.toggleAnimation".into(), json!({"layer": layer.id.0, "prop": uid})));
-                    }
-                }
-                let name_x = indent + 12.0;
-                // 3D layers show Rotation as "Z Rotation" next to X/Y Rotation.
-                let is_tr_rot = layer.transform().and_then(|t| t.get("rotation")).is_some_and(|r| r.uid == prop.uid);
-                let base = if is_tr_rot && prop.name == "Rotation" && layer.is_3d() { "Z Rotation".to_string() } else { prop.name.clone() };
-                let pname = if prop.has_expression() { format!("{base}  =") } else { base };
-                lp.text(pos2(name_x, cy), Align2::LEFT_CENTER, &pname, Tokens::ui(12.0), if prop.has_expression() { t.expr_text } else { t.text });
-                let name_rect = Rect::from_min_max(pos2(name_x, r.min.y), pos2(cw.switches - 2.0, r.max.y));
-                let name_resp = ui.interact(name_rect, egui::Id::new(("pname", uid)), Sense::click_and_drag());
-                app.auto.add(&format!("timeline.prop.{uid}.name"), name_rect, &prop.name);
-                if name_resp.drag_started() {
-                    // Drop on the Essential Graphics panel to expose the property.
-                    egui::DragAndDrop::set_payload(&ctx, crate::panels::DragPayload::Property { layer: layer.id.0, prop: *uid });
-                }
-                if name_resp.dragged() {
-                    egui::Tooltip::always_open(ctx.clone(), ui.layer_id(), egui::Id::new("prop-drag-tip"), egui::PopupAnchor::Pointer)
-                        .show(|ui| ui.label(&prop.name));
-                }
-                if name_resp.clicked() {
-                    actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "add": ui.input(|i| i.modifiers.shift)})));
-                }
-                crate::widgets::context_menu(&name_resp, |ui| prop_menu(ui, &mut app.auto, cid, layer, prop, &mut actions));
-                // Value editors.
-                let value = ectx.value(layer, prop);
-                let vx = (cw.switches + 4.0).max(name_x + 120.0);
-                let dims = value_editor(app, ui, &lp, layer, prop, &value, pos2(vx, cy), &mut actions);
-                if !dims.is_empty() {
-                    dim_hits.push((*uid, dims));
-                }
-                // The property pick whip (Parent & Link column, AE CC 2018 and later): dropped on
-                // a property it links this one to it, adding the expression if there is none.
-                if vis.parent && !prop.static_only {
-                    pick_whip(
-                        app,
-                        ui,
-                        &lp,
-                        Rect::from_center_size(pos2(cw.parent + 9.0, cy), vec2(15.0, 15.0)),
-                        (WHIP_PROP, layer.id.0, *uid),
-                        &format!("timeline.prop.{uid}.propertyPickWhip"),
-                        "Property pick whip",
-                        crate::i18n::tr("Property pick whip: drag onto a property"),
-                    );
-                }
-                ui.set_clip_rect(right_clip);
-                // Expression text row hint.
-                if let Some(e) = prop.expr.as_ref().filter(|e| e.enabled && app.ui.timeline.expr_closed.contains(uid)) {
-                    gp.text(
-                        pos2(graph_x0 + 8.0, cy),
-                        Align2::LEFT_CENTER,
-                        format!("= {}", e.text.lines().next().unwrap_or("")),
-                        Tokens::mono(11.0),
-                        t.expr_text,
-                    );
-                }
-                // Keyframes.
-                if !graph_on {
-                    for k in &prop.keys {
-                        let ct = layer.comp_time(k.time);
-                        let x = tm.x(ct.seconds());
-                        if x < graph_x0 - 8.0 || x > rect.max.x + 8.0 {
-                            continue;
-                        }
-                        let kref = effectcraft_engine::KeyRef { layer: layer.id, prop: *uid, time: k.time };
-                        let ks = sel_keys.contains(&kref);
-                        let icon = k.icon();
-                        let c = pos2(x, cy);
-                        // Labelled keys take their label colour (brighter when selected).
-                        let kcol = match effectcraft_engine::color::Label::ALL.get(k.label as usize).filter(|_| k.label > 0) {
-                            Some(l) => {
-                                let c = t.label(*l);
-                                if ks { c } else { c.gamma_multiply(0.75) }
-                            }
-                            None if ks => t.keyframe_selected,
-                            None => t.keyframe,
-                        };
-                        if k.roving {
-                            // Roving keys: a small dot (their time follows their neighbours).
-                            gp.circle_filled(c, 2.5, kcol);
-                        } else {
-                            icons::keyframe(&gp, c, 11.0, icon.left, icon.right, kcol);
-                        }
-                        let kr = Rect::from_center_size(c, vec2(12.0, 14.0));
-                        let kresp = ui.interact(kr, egui::Id::new(("key", uid, k.time.0)), Sense::click_and_drag());
-                        app.auto.add(&format!("timeline.key.{uid}.{}", fr.frame_at(ct)), kr, &format!("{} key", prop.name));
-                        // Exact (layer-time ticks): keys a Quick Offset puts on subframes can share a frame.
-                        app.auto.add(&format!("timeline.keyAt.{uid}.{}", k.time.0), kr, &format!("{} key", prop.name));
-                        let mods = ui.input(|i| i.modifiers);
-                        let this_key = json!({"keys": [{"layer": layer.id.0, "prop": uid, "time": k.time.seconds()}], "selectProperties": true});
-                        if kresp.clicked() && mods.command {
-                            // Ctrl+click: Linear ↔ Auto Bezier; Ctrl+Alt+click: Hold on / off.
-                            actions.push(("keys.select".into(), this_key.clone()));
-                            if mods.alt {
-                                actions.push(("keys.toggleHold".into(), json!({})));
-                            } else {
-                                let linear = k.in_interp == Interp::Linear && k.out_interp == Interp::Linear;
-                                actions.push(("keys.interpolation".into(), json!({"interpolation": if linear { "autoBezier" } else { "linear" }})));
-                            }
-                        } else if kresp.clicked() && mods.shift {
-                            // Shift+click: in or out of the selection.
-                            let mut p = this_key.clone();
-                            p["toggle"] = json!(true);
-                            actions.push(("keys.select".into(), p));
-                        } else if (kresp.clicked() || kresp.drag_started()) && !ks {
-                            let mut p = this_key.clone();
-                            p["add"] = json!(mods.shift);
-                            actions.push(("keys.select".into(), p));
-                        }
-                        if kresp.double_clicked() {
-                            // Edit the key's value (numeric properties), as After Effects does.
-                            if matches!(k.value, Value::Scalar(_) | Value::Vec2(_) | Value::Vec3(_)) {
-                                actions.push(("keys.set".into(), json!({"layer": layer.id.0, "prop": uid, "time": k.time.seconds()})));
-                            } else {
-                                ui_actions.push(UiAct::SetTime(ct));
-                            }
-                        }
-                        crate::widgets::context_menu(&kresp, |ui| {
-                            for (lbl, cmd, params) in [
-                                ("Edit Value…", "keys.set", json!({"layer": layer.id.0, "prop": uid, "time": k.time.seconds()})),
-                                ("-", "", json!({})),
-                                ("Copy", "keys.copy", json!({})),
-                                ("Paste", "keys.paste", json!({})),
-                                ("-", "", json!({})),
-                                ("Select Equal Keyframes", "keys.selectEqual", json!({})),
-                                ("Select Previous Keyframes", "keys.selectPrevious", json!({})),
-                                ("Select Following Keyframes", "keys.selectFollowing", json!({})),
-                                ("-", "", json!({})),
-                                ("Keyframe Interpolation…", "keys.interpolation", json!({})),
-                                ("Keyframe Velocity…", "keys.velocity", json!({})),
-                                ("Toggle Hold Keyframe", "keys.toggleHold", json!({})),
-                                ("Rove Across Time", "keys.interpolation", json!({"roving": !k.roving})),
-                                ("-", "", json!({})),
-                                ("Easy Ease", "keys.easyEase", json!({})),
-                                ("Easy Ease In", "keys.easyEaseIn", json!({})),
-                                ("Easy Ease Out", "keys.easyEaseOut", json!({})),
-                                ("Time-Reverse Keyframes", "keys.timeReverse", json!({})),
-                                ("-", "", json!({})),
-                                ("Linear", "keys.interpolation", json!({"interpolation": "linear"})),
-                                ("Bezier", "keys.interpolation", json!({"interpolation": "bezier"})),
-                                ("Auto Bezier", "keys.interpolation", json!({"interpolation": "autoBezier"})),
-                                ("Select All Keyframes", "keys.selectAll", json!({})),
-                                ("Delete", "keys.delete", json!({})),
-                            ] {
-                                if lbl == "Select All Keyframes" {
-                                    // Keyframe colour labels.
-                                    ui.menu_button(crate::i18n::tr("Label"), |ui| {
-                                        for (i, l) in effectcraft_engine::color::Label::ALL.into_iter().enumerate() {
-                                            if widgets::label_entry(ui, l, &app.session.prefs.label_name(l), k.label as usize == i, &t).clicked() {
-                                                if !ks {
-                                                    actions.push((
-                                                        "keys.select".into(),
-                                                        json!({"keys": [{"layer": layer.id.0, "prop": uid, "time": k.time.seconds()}]}),
-                                                    ));
-                                                }
-                                                actions.push(("keys.setLabel".into(), json!({"label": i})));
-                                                ui.close();
-                                            }
-                                        }
-                                    });
-                                }
-                                if lbl == "-" {
-                                    ui.separator();
-                                    continue;
-                                }
-                                if lbl == "Rove Across Time" && !prop.spatial {
-                                    continue;
-                                }
-                                if lbl == "Edit Value…" && !matches!(k.value, Value::Scalar(_) | Value::Vec2(_) | Value::Vec3(_)) {
-                                    continue;
-                                }
-                                if ui.button(lbl).clicked() {
-                                    if !ks {
-                                        actions.push(("keys.select".into(), json!({"keys": [{"layer": layer.id.0, "prop": uid, "time": k.time.seconds()}]})));
-                                    }
-                                    actions.push((cmd.into(), params));
-                                    ui.close();
-                                }
-                            }
-                        });
-                        // Alt-drag the first or last key of a selected group: scale the group in time.
-                        if kresp.drag_started()
-                            && mods.alt
-                            && !mods.command
-                            && let Some(c) = app.session.active_comp_arc()
-                        {
-                            super::graph_tools::alt_scale_begin(app, &ctx, &c, ct.seconds());
-                        }
-                        // A plain drag moves the selected keys. The timeline follows it (below): this
-                        // widget's id changes with the key's time, so its own drag would end after
-                        // the first frame of movement.
-                        // (From where the button went down: a drag starts a few pixels later.)
-                        if kresp.drag_started()
-                            && !super::graph_tools::alt_scale_active(&ctx)
-                            && let Some(p) = ctx.input(|i| i.pointer.press_origin())
-                        {
-                            // Ctrl/Cmd+Alt: Quick Offset of the selected keys' layers (#1012).
-                            let quick = (mods.command && mods.alt && ks).then(|| quick_offset_layers(&comp, sel_keys.iter().map(|k| k.layer))).flatten();
-                            ctx.data_mut(|d| d.insert_temp(key_drag_id(), KeyDrag { origin_x: p.x, anchor: ct.seconds(), applied: 0, quick }));
-                        }
-                    }
-                }
-            }
-        }
-    }
-    ui.set_clip_rect(full_clip);
-    // The background responses sit below rows, bars and editors, preserving their menus.
-    if !graph_on {
-        app.auto.add("timeline.empty", empty_rect, "Right-click to create a layer");
-    }
-    for (response, area) in [(&outline_empty, "outline"), (&empty, "graph")] {
-        crate::widgets::context_menu(response, |ui| {
-            let menu = ui.menu_button(crate::i18n::tr("New"), |ui| {
-                for (key, label, command, params) in [
-                    ("text", "Text", "layer.newText", json!({})),
-                    ("solid", "Solid…", "layer.newSolid", json!({})),
-                    ("light", "Light…", "layer.newLight", json!({})),
-                    ("camera", "Camera…", "layer.newCamera", json!({})),
-                    ("null", "Null Object", "layer.newNull", json!({})),
-                    ("shape", "Shape Layer", "layer.newShape", json!({"kind": "none"})),
-                    ("adjustment", "Adjustment Layer", "layer.newAdjustment", json!({})),
-                ] {
-                    let response = ui.button(crate::i18n::context_item(command, &params, label));
-                    app.auto.add(&format!("timeline.context.{area}.{key}"), response.rect, label);
-                    if response.clicked() {
-                        actions.push((command.into(), params));
-                        ui.close();
-                    }
-                }
-            });
-            app.auto.add(&format!("timeline.context.{area}.new"), menu.response.rect, "New");
-            let response = ui.button(crate::i18n::tr("Composition Settings…"));
-            app.auto.add(&format!("timeline.context.{area}.settings"), response.rect, "Composition Settings…");
-            if response.clicked() {
-                actions.push(("comp.settings".into(), json!({})));
-                ui.close();
-            }
-            let response = ui.button(crate::i18n::tr("Open in Essential Graphics"));
-            app.auto.add(&format!("timeline.context.{area}.essentialGraphics"), response.rect, "Open in Essential Graphics");
-            if response.clicked() {
-                actions.push(("comp.openInEssentialGraphics".into(), json!({})));
-                ui.close();
-            }
-        });
-    }
-    if outline_empty.clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
-        actions.push(("layer.select".into(), json!({"layers": []})));
-    }
-    if let (Some(start), Some(end)) = (ctx.input(|i| i.pointer.press_origin()), outline_empty.interact_pointer_pos())
-        && outline_empty.dragged()
-    {
-        let box_rect = Rect::from_two_pos(start, end).intersect(outline_rect);
-        lp.rect_filled(box_rect, 0.0, t.accent.gamma_multiply(0.12));
-        lp.rect_stroke(box_rect, 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("tl-layer-box"), box_rect));
-    }
-    if outline_empty.drag_stopped()
-        && let Some(box_rect) = ctx.data(|d| d.get_temp::<Rect>(egui::Id::new("tl-layer-box")))
-    {
-        ctx.data_mut(|d| d.remove::<Rect>(egui::Id::new("tl-layer-box")));
-        let layers: Vec<u64> = hit_rows
-            .iter()
-            .filter(|(r, row)| matches!(row.kind, RowKind::Layer) && r.intersects(box_rect))
-            .filter(|(_, row)| comp.layer(row.layer).is_some_and(|l| !l.switches.locked))
-            .map(|(_, row)| row.layer.0)
-            .collect();
-        actions.push(("layer.select".into(), json!({"layers": layers, "add": ui.input(|i| i.modifiers.shift || i.modifiers.command)})));
-    }
-    // Pick whips: a line follows the pointer; releasing over a row links to it (an expression's
-    // or a property's, also over a property in Effect Controls).
-    if let Some((kind, src_layer, src_prop, start)) = ctx.data(|d| d.get_temp::<PickWhip>(pick_whip_id())) {
-        let ptr = ctx.input(|i| i.pointer.latest_pos()).unwrap_or(start);
-        let fg = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("tl-pickwhip-line")));
-        fg.line_segment([start, ptr], Stroke::new(1.5, t.accent));
-        fg.circle_stroke(ptr, 4.0, Stroke::new(1.5, t.accent));
-        let target = hit_rows.iter().find(|(r, _)| r.contains(ptr)).map(|(r, row)| (*r, row.clone()));
-        // Shown this pass or the last one (Effect Controls may draw after the Timeline).
-        let pass = ctx.cumulative_pass_nr();
-        let elsewhere = (target.is_none() && kind != WHIP_PARENT)
-            .then(|| ctx.data(|d| d.get_temp::<WhipTargets>(whip_targets_id())))
-            .flatten()
-            .filter(|(p, _)| p.saturating_add(1) >= pass)
-            .and_then(|(_, targets)| targets.into_iter().find(|(r, ..)| r.contains(ptr)));
-        if let Some((tr, _)) = &target {
-            fg.rect_stroke(Rect::from_min_max(tr.min, pos2(graph_x0 - 1.0, tr.max.y)), 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
-        } else if let Some((tr, ..)) = &elsewhere {
-            fg.rect_stroke(*tr, 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
-        }
-        if ctx.input(|i| !i.pointer.any_down()) {
-            ctx.data_mut(|d| {
-                d.remove::<PickWhip>(pick_whip_id());
-                d.remove::<WhipTargets>(whip_targets_id());
-            });
-            let into = (kind == WHIP_EXPR).then(|| ctx.data_mut(|d| d.remove_temp::<WhipInto>(whip_into_id(src_prop)))).flatten();
-            // The property dropped on, and the value (dimension) if on one of them: `position[0]`.
-            let dim = |fields: &[Rect]| fields.iter().position(|r| r.contains(ptr));
-            let prop_target = match (&target, elsewhere) {
-                (Some((_, Row { layer, kind: RowKind::Prop { uid }, .. })), _) => {
-                    Some((layer.0, *uid, dim_hits.iter().find(|(u, _)| u == uid).and_then(|(_, rs)| dim(rs))))
-                }
-                (None, Some((_, l, u, fields))) => Some((l, u, dim(&fields))),
-                _ => None,
-            };
-            match (kind, target, prop_target) {
-                (WHIP_PARENT, Some((_, row)), _) if row.layer.0 != src_layer => {
-                    actions.push(("layer.setParent".into(), json!({"layers": [src_layer], "parent": row.layer.0})));
-                }
-                // The property pick whip replaces the expression with the reference (or adds one),
-                // as the expression pick whip does when its expression isn't being edited.
-                (WHIP_EXPR | WHIP_PROP, _, Some((tl, tu, d))) if tu != src_prop => {
-                    let mut params = json!({"layer": src_layer, "prop": src_prop, "target": {"layer": tl, "prop": tu}});
-                    if let Some(d) = d {
-                        params["target"]["dimension"] = json!(d);
-                    }
-                    if let Some((text, [a, b])) = into {
-                        // Into the expression being edited, which goes on being edited.
-                        params["expression"] = json!(text);
-                        params["range"] = json!([a, b]);
-                        let after = text.chars().count().saturating_sub(b);
-                        ctx.data_mut(|d| d.insert_temp(expr_refocus_id(src_prop), after));
-                    }
-                    actions.push(("prop.pickWhip".into(), params));
-                }
-                _ => {}
-            }
-        }
-    }
-    // Alt-drag key group scaling (follows the pointer until release).
-    if let Some(c) = app.session.active_comp_arc() {
-        super::graph_tools::alt_scale_update(app, &ctx, &c, tm, &mut actions);
-    }
-    // Graph editor.
-    if graph_on {
-        super::graph::show(app, ui, &gp, &comp, &ectx, tm, Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max), &mut actions);
-    }
-    // A plain click on empty track area (beside a layer's bar, on a property row's empty span or
-    // below the last row) deselects the layers and their keys and properties, as in After
-    // Effects; Shift / Cmd keep the selection. Drag: box-select keys.
-    if empty.clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
-        actions.push(("layer.select".into(), json!({"layers": []})));
-    }
-    if let (true, Some(origin), Some(cur)) =
-        (empty.dragged(), empty.interact_pointer_pos().and_then(|_| ctx.input(|i| i.pointer.press_origin())), empty.interact_pointer_pos())
-    {
-        let br = Rect::from_two_pos(origin, cur);
-        gp.rect_filled(br, 0.0, t.accent.gamma_multiply(0.12));
-        gp.rect_stroke(br, 0.0, Stroke::new(1.0, t.accent), StrokeKind::Middle);
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("tl-box"), br));
-    }
-    // Layer reorder drag: a line where the layers will land; the release moves them there.
-    if let Some(moving) = ctx.data(|d| d.get_temp::<Vec<u64>>(layer_drag_id())) {
-        let dropped = ctx.data_mut(|d| d.remove_temp::<bool>(layer_drop_id())).unwrap_or(false);
-        let layer_rows: Vec<(Rect, LayerId)> = hit_rows.iter().filter(|(_, r)| matches!(r.kind, RowKind::Layer)).map(|(rr, r)| (*rr, r.layer)).collect();
-        if let Some(py) = ui.input(|i| i.pointer.interact_pos().or(i.pointer.latest_pos())).map(|p| p.y)
-            && !layer_rows.is_empty()
-        {
-            let (at, line_y) = insertion(&layer_rows, py, rows_rect.min.y);
-            let target = at.and_then(|i| layer_rows[i..].iter().find(|(_, l)| !moving.contains(&l.0)).map(|(_, l)| *l));
-            if dropped {
-                ctx.data_mut(|d| d.remove::<Vec<u64>>(layer_drag_id()));
-                // Only when the order changes (no empty undo step for a drop in place).
-                let mut order: Vec<u64> = comp.layers.iter().map(|l| l.id.0).filter(|id| !moving.contains(id)).collect();
-                let at = target.and_then(|t| order.iter().position(|id| *id == t.0)).unwrap_or(order.len());
-                order.splice(at..at, moving.iter().copied());
-                if order != comp.layers.iter().map(|l| l.id.0).collect::<Vec<_>>() {
-                    let params = match target {
-                        Some(t) => json!({"layers": moving, "above": t.0}),
-                        None => json!({"layers": moving, "to": "back"}),
-                    };
-                    actions.push(("layer.arrange".into(), params));
-                }
-            } else {
-                ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
-                p.with_clip_rect(rows_rect).line_segment([pos2(rect.min.x, line_y), pos2(graph_x0, line_y)], Stroke::new(2.0, t.accent));
-            }
-        } else if dropped {
-            ctx.data_mut(|d| d.remove::<Vec<u64>>(layer_drag_id()));
-        }
-    }
-    // Quick Offset of layer bars: the last selected layer moves by whole frames with the pointer
-    // until the button is released, wherever the bar's row has scrolled to.
-    if let Some(mut q) = ctx.data(|d| d.get_temp::<QuickBar>(quick_bar_id())) {
-        let (down, ptr) = ctx.input(|i| (i.pointer.primary_down(), i.pointer.latest_pos()));
-        match ptr.filter(|_| down) {
-            Some(ptr) => {
-                let frames = (((ptr.x - q.origin_x) as f64 / pps) / fd).round() as i64;
-                if frames != q.applied {
-                    q.applied = frames;
-                    ctx.data_mut(|d| d.insert_temp(quick_bar_id(), q));
-                    let merge = format!("bar-quick-{}", q.layer.0);
-                    actions.push(("layer.quickOffset".into(), json!({"delta": frames as f64 * fd, "merge": merge, "fromStart": true})));
-                }
-                drag_tip(&ctx, &t, ptr, quick_offset_note(q.applied, q.layers));
-            }
-            None => {
-                ctx.data_mut(|d| d.remove::<QuickBar>(quick_bar_id()));
-                ui_actions.push(UiAct::EndMerge);
-            }
-        }
-    }
-    // Keyframe drag: the selected keys move by whole frames with the pointer until it is
-    // released (one undo step); Shift snaps the grabbed key to the current time, the work area
-    // and composition markers.
-    if let Some(mut kd) = ctx.data(|d| d.get_temp::<KeyDrag>(key_drag_id())) {
-        let (down, ptr, shift) = ctx.input(|i| (i.pointer.primary_down(), i.pointer.latest_pos(), i.modifiers.shift));
-        match ptr.filter(|_| down) {
-            Some(ptr) => {
-                let mut target = kd.anchor + (ptr.x - kd.origin_x) as f64 / pps;
-                if shift {
-                    // The current time and whatever it snaps to (keys, layer ends, markers), but
-                    // not the moving keys themselves.
-                    let moving: Vec<f64> =
-                        app.session.state.selected_keys.iter().filter_map(|k| comp.layer(k.layer).map(|l| l.comp_time(k.time).seconds())).collect();
-                    let mut cands = snap_candidates(&comp, &rows);
-                    cands.retain(|c| !moving.iter().any(|m| (m - c).abs() < 1e-9));
-                    cands.push(time.seconds());
-                    target = snap_time(&cands, target, 8.0 / pps);
-                }
-                let total = ((target - kd.anchor) / fd).round() as i64;
-                if total != kd.applied {
-                    actions.push(match kd.quick {
-                        Some(_) => ("keys.quickOffset".into(), json!({"delta": total as f64 * fd, "merge": "key-quick-offset", "fromStart": true})),
-                        None => ("keys.move".into(), json!({"delta": (total - kd.applied) as f64 * fd, "merge": "key-drag"})),
-                    });
-                    kd.applied = total;
-                    ctx.data_mut(|d| d.insert_temp(key_drag_id(), kd));
-                }
-                ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
-                // Where the grabbed key is and how far the keys moved (After Effects shows this
-                // in the Info panel).
-                let at = Tick::from_seconds_f64(kd.anchor + kd.applied as f64 * fd);
-                let note = match kd.quick {
-                    Some(n) => quick_offset_note(kd.applied, n),
-                    None => format!("{}   {:+} f", super::timecode(&app.session, &comp, at), kd.applied),
-                };
-                drag_tip(&ctx, &t, ptr, note);
-                app.ui.status = format!("Keyframe at {}", super::timecode(&app.session, &comp, at));
-            }
-            None => {
-                ctx.data_mut(|d| d.remove::<KeyDrag>(key_drag_id()));
-                ui_actions.push(UiAct::EndMerge);
-            }
-        }
-    }
-    if empty.drag_stopped()
-        && let Some(br) = ctx.data(|d| d.get_temp::<Rect>(egui::Id::new("tl-box")))
-    {
-        ctx.data_mut(|d| d.remove::<Rect>(egui::Id::new("tl-box")));
-        let mut keys = vec![];
-        let mut yy = rows_rect.min.y - app.ui.timeline.scroll_y;
-        for row in &rows {
-            let cy = yy + rh / 2.0;
-            yy += row_height(row, rh);
-            if let RowKind::Prop { uid } = row.kind
-                && cy >= br.min.y
-                && cy <= br.max.y
-                && let Some(l) = comp.layer(row.layer)
-                && let Some(pr) = l.props.find(uid)
-            {
-                for k in &pr.keys {
-                    let x = tm.x(l.comp_time(k.time).seconds());
-                    if x >= br.min.x && x <= br.max.x {
-                        keys.push(json!({"layer": l.id.0, "prop": uid, "time": k.time.seconds()}));
-                    }
-                }
-            }
-        }
-        let mods = ui.input(|i| i.modifiers);
-        if keys.is_empty() && !(mods.shift || mods.command) {
-            // A marquee that catches nothing leaves nothing selected (layers included).
-            actions.push(("layer.select".into(), json!({"layers": []})));
-        } else {
-            actions.push(("keys.select".into(), json!({"keys": keys, "add": mods.shift, "selectProperties": true})));
-        }
+    Rw {
+        lp,
+        gp,
+        graph_on,
+        full_clip,
+        left_clip,
+        right_clip,
+        empty_rect,
+        empty,
+        outline_empty,
+        selected: app.session.state.selected_layers.clone(),
+        sel_keys: app.session.state.selected_keys.clone(),
+        ui_actions: Vec::new(),
+        hit_rows: Vec::new(),
+        dim_hits: Vec::new(),
+        tl,
     }
+}
 
-    // CTI.
-    let cx = tm.x(time.seconds());
-    if cx >= graph_x0 && cx <= rect.max.x {
-        p.line_segment([pos2(cx, ruler.min.y + 12.0), pos2(cx, rows_rect.max.y)], Stroke::new(1.0, t.cti));
-        let head = vec![
-            pos2(cx - 6.0, ruler.min.y + 12.0),
-            pos2(cx + 6.0, ruler.min.y + 12.0),
-            pos2(cx + 6.0, ruler.max.y - 8.0),
-            pos2(cx, ruler.max.y - 2.0),
-            pos2(cx - 6.0, ruler.max.y - 8.0),
-        ];
-        p.add(egui::Shape::convex_polygon(head, t.cti, Stroke::NONE));
-        app.auto.add("timeline.cti", Rect::from_center_size(pos2(cx, ruler.center().y), vec2(12.0, 20.0)), "Current time indicator");
+/// The Timeline panel for the active composition inside `rect`: draws the header, ruler, work
+/// area and cache bars, the layer rows with their switch and value cells, the time graph and its
+/// keys, and the footer; and turns this frame's clicks, drags and drops into commands. Without an
+/// active comp it shows a hint, and dropping footage on it creates a composition. Most edits
+/// use [`crate::menus::invoke`]; time, switch and work-area gestures call `Session::execute`
+/// directly and ignore errors. Reported failures go to `app.ui.status`. UI state (scroll, zoom,
+/// open rows and the drags in progress) lives in
+/// `app.ui.timeline` and egui's temp data.
+pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    ignore_middle_press(ui, rect);
+    let Some(cid) = app.session.active_comp_id() else {
+        empty_timeline(app, ui, rect);
+        return;
+    };
+    let Some(comp) = app.session.project.comp_arc(cid) else { return };
+    let mut tl = layout(app, ui, rect, cid, &comp);
+    let g = &mut tl;
+    if !ui.input(|i| i.pointer.primary_down()) {
+        g.ctx.data_mut(|d| d.remove::<SwitchDrag>(switch_drag_id()));
     }
-    let _ = graph_rect;
+    header_timecode(app, ui, g);
+    header_search_and_switches(app, ui, g);
+    time_navigator(app, ui, g);
+    ruler_background(app, g);
+    work_area_bar(app, ui, g);
+    cache_bars(app, g);
+    ruler_ticks(app, g);
+    ruler_scrub(app, ui, g);
+    column_header_icons(app, g);
+    column_header_interact(app, ui, g);
+    let rows = Arc::new(with_expr_rows(build_rows(app, &comp), &comp, &app.ui.timeline, &g.ctx));
+    let total_h: f32 = rows.iter().map(|r| row_height(r, g.rh)).sum();
+    g.max_scroll = (total_h - g.rows_rect.height() + g.rh).max(0.0);
+    g.rows = rows;
+    reveal_scroll(app, g);
+    wheel_zoom_scroll(app, ui, g);
+    pick_whip_edge_scroll(app, g);
+    let snap_project = app.session.project.clone();
+    let snap_expr = app.session.expr.clone();
+    let ectx = EvalCtx {
+        project: &snap_project,
+        comp_id: cid,
+        comp: &comp,
+        time: g.time,
+        expr: snap_expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let mut rw = begin_rows(app, ui, tl);
+    let g = &mut rw;
+    draw_rows(app, ui, g, &ectx);
+    ui.set_clip_rect(g.full_clip);
+    background_menus(app, ui, g);
+    outline_marquee(ui, g);
+    pick_whip_drag(g);
+    alt_scale_and_graph(app, ui, g, &ectx);
+    graph_empty_area(ui, g);
+    layer_reorder_drag(ui, g);
+    group_reorder_drag(ui, g);
+    quick_offset_follow(g);
+    key_drag_follow(app, g);
+    box_select(app, ui, g);
+    current_time_indicator(app, g);
+    let footer = footer_bar(app, ui, g);
+    footer_zoom(app, ui, g, footer);
+    comp_markers_ui(app, ui, g);
+    hand_tool_pan(app, ui, g);
+    drop_targets(app, ui, g);
+    let Rw { tl, ui_actions, .. } = rw;
+    apply_ui_acts(app, &tl.comp, ui_actions);
+    apply_actions(app, ui, &tl.ctx, tl.actions);
+}
 
-    // Footer.
-    let footer = Rect::from_min_max(pos2(rect.min.x, rect.max.y - footer_h), rect.max);
-    p.rect_filled(footer, 0.0, t.panel_bg);
-    p.line_segment([footer.left_top(), footer.right_top()], Stroke::new(1.0, t.separator));
-    if overflow > 0.0 {
-        // Outline scroll bar along the top of the footer, under the columns.
-        let track = Rect::from_min_max(pos2(rect.min.x + 2.0, footer.min.y + 1.0), pos2(graph_x0 - 3.0, footer.min.y + 5.0));
-        app.ui.timeline.outline_scroll = widgets::scroll_bar(ui, &mut app.auto, "timeline.outlineScroll", track, oscroll, overflow, &t);
-    }
-    if max_scroll > 0.0 {
-        // The layer rows' scroll bar, on the right edge beside the time graph.
-        let track = Rect::from_min_max(pos2(rect.max.x - 6.0, rows_rect.min.y + 1.0), pos2(rect.max.x - 2.0, rows_rect.max.y - 1.0));
-        app.ui.timeline.scroll_y = widgets::scroll_bar(ui, &mut app.auto, "timeline.scroll", track, app.ui.timeline.scroll_y, max_scroll, &t);
-    }
-    let tgl = Rect::from_min_size(pos2(footer.min.x + 10.0, footer.min.y + 3.0), vec2(150.0, 18.0));
-    let tresp = ui.interact(tgl, egui::Id::new("tl-toggle-modes"), Sense::click());
-    p.text(
-        tgl.left_center(),
-        Align2::LEFT_CENTER,
-        crate::i18n::tr("Toggle Switches / Modes"),
-        Tokens::ui(11.0),
-        if tresp.hovered() { t.text } else { t.text_dim },
-    );
-    app.auto.add("timeline.toggleSwitchesModes", tgl, "Toggle Switches / Modes");
-    if tresp.clicked() {
-        app.ui.timeline.show_modes = !app.ui.timeline.show_modes;
-    }
-    let ms = app.frames.last_ms.lock().map(|v| *v).unwrap_or(0.0);
-    p.text(
-        pos2(graph_x0 - 12.0, footer.center().y),
-        Align2::RIGHT_CENTER,
-        crate::i18n::tr_args("Frame Render Time  {}ms", &[&format!("{ms:.0}")]),
-        Tokens::ui(11.0),
-        t.text_faint,
-    );
-    // Zoom slider.
-    let zs = Rect::from_min_max(pos2(graph_x0 + 30.0, footer.center().y - 2.0), pos2((graph_x0 + 230.0).min(rect.max.x - 30.0), footer.center().y + 2.0));
-    // Zoom out / zoom in buttons either side of the slider: the `-` / `=` steps. Everything here
-    // zooms around the CTI and sets the one time zoom the layer bars and the Graph Editor share.
-    let cti = time.seconds();
-    let cti_px = (cti - tm.start) * pps;
-    for (icon, size, cx, id, tip, k) in [
-        (Icon::MountainSmall, 14.0, zs.min.x - 14.0, "timeline.zoomOutButton", "Zoom Out (Time)", 1.0 / ZOOM_STEP),
-        (Icon::MountainLarge, 16.0, zs.max.x + 14.0, "timeline.zoomInButton", "Zoom In (Time)", ZOOM_STEP),
-    ] {
-        let r = Rect::from_center_size(pos2(cx, footer.center().y), vec2(20.0, 20.0));
-        let resp = ui.interact(r, egui::Id::new(id), Sense::click()).on_hover_text(crate::i18n::tr(tip));
-        icons::paint(&p, Rect::from_center_size(r.center(), vec2(size, size)), icon, if resp.hovered() { t.text } else { t.text_dim });
-        app.auto.add(id, r, tip);
-        if resp.clicked() {
-            set_zoom(&mut app.ui.timeline, &comp, pps * k, fit_pps, cti, cti_px);
-        }
-    }
-    p.rect_filled(zs, 2.0, t.field_bg);
-    let maxpps = MAX_PPS.max(fit_pps * 1.001);
-    let frac = ((pps / fit_pps).ln() / (maxpps / fit_pps).ln()).clamp(0.0, 1.0) as f32;
-    let knob = pos2(zs.min.x + zs.width() * frac, zs.center().y);
-    p.circle_filled(knob, 6.0, t.text);
-    // Drag the knob, or click the track to jump there.
-    let zresp = ui.interact(zs.expand2(vec2(6.0, 8.0)), egui::Id::new("tl-zoom"), Sense::click_and_drag());
-    app.auto.add("timeline.zoomSlider", zs, "Zoom");
-    if (zresp.dragged() || zresp.clicked())
-        && let Some(pt) = zresp.interact_pointer_pos()
-    {
-        let f = ((pt.x - zs.min.x) / zs.width().max(1.0)).clamp(0.0, 1.0) as f64;
-        set_zoom(&mut app.ui.timeline, &comp, fit_pps * (maxpps / fit_pps).powf(f), fit_pps, cti, cti_px);
-    }
-
-    // Composition markers in the ruler; protected regions shade the layer rows.
-    let mstrip = Rect::from_min_max(pos2(graph_x0, ruler.max.y - 12.0), pos2(bin.min.x, ruler.max.y));
-    let mrows = rows_rect.intersect(Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max));
-    super::markers_ui::comp_markers(app, ui, &comp, tm, mstrip, mrows);
-    super::markers_ui::marker_bin(app, ui, &comp, tm, bin, mstrip);
-
-    // Spacebar held: the Hand tool. Dragging the ruler or the time graph scrolls it in time when
-    // zoomed in (registered last, so it takes the drag from the bars, keys and markers there).
-    if super::space_hand(&ctx) {
-        let area = Rect::from_min_max(pos2(graph_x0, ruler.min.y), pos2(rect.max.x, rows_rect.max.y));
-        let hand = ui.interact(area, egui::Id::new("tl-hand"), Sense::drag());
-        app.auto.add("timeline.hand", area, "Hand (hold Spacebar)");
-        if hand.hovered() || hand.dragged() {
-            ctx.set_cursor_icon(if hand.dragged() { egui::CursorIcon::Grabbing } else { egui::CursorIcon::Grab });
-        }
-        if hand.dragged() && app.ui.timeline.pps.is_some() {
-            let start = app.ui.timeline.start;
-            let last = (comp.duration.seconds() - (tm.t(graph_x1) - tm.start)).max(start).max(0.0);
-            app.ui.timeline.start = (start - hand.drag_delta().x as f64 / pps).clamp(0.0, last);
-        }
-    }
-
-    // Drop targets: effects and animation presets from Effects & Presets go on the layer under the
-    // pointer. Footage and
-    // comps from the Project panel and files from the Media Browser go where they are dropped: a
-    // line shows the place in the stack, and over the time graph a marker shows the In point too
-    // (Shift: at the current time).
-    if let Some(payload) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx)
-        && !matches!(*payload, crate::panels::DragPayload::Property { .. })
-        && let Some(ptr) = ctx.input(|i| i.pointer.hover_pos()).filter(|_| ui.rect_contains_pointer(rows_rect))
-    {
-        let released = ctx.input(|i| i.pointer.any_released());
-        if matches!(payload.as_ref(), crate::panels::DragPayload::Effect(_) | crate::panels::DragPayload::Preset { .. }) {
-            let target = hit_rows.iter().find(|(r, _)| ptr.y >= r.min.y && ptr.y < r.max.y).map(|(_, row)| row.layer);
-            // The layer the effect would land on (its row and its open properties) is the one
-            // that lights up, not the whole timeline.
-            if let Some(l) = target
-                && let Some(span) = hit_rows.iter().filter(|(_, row)| row.layer == l).map(|(r, _)| *r).reduce(|a, b| a.union(b))
-            {
-                let lit = span.intersect(rows_rect);
-                let rp = p.with_clip_rect(rows_rect);
-                rp.rect_filled(lit, 0.0, t.accent.gamma_multiply(0.18));
-                rp.rect_stroke(lit, 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
-                app.auto.add("timeline.dropTarget", lit, "Drop target layer");
-            }
-            if released && let Some(l) = target {
-                match payload.as_ref() {
-                    crate::panels::DragPayload::Effect(e) => actions.push(("effect.apply".into(), json!({"effect": e, "layers": [l.0]}))),
-                    crate::panels::DragPayload::Preset { preset, .. } => {
-                        let (id, params) = preset.apply_to(l.0);
-                        actions.push((id.into(), params));
-                    }
-                    _ => {}
-                }
-            }
-        } else {
-            let layer_rows: Vec<(Rect, LayerId)> = hit_rows.iter().filter(|(_, r)| matches!(r.kind, RowKind::Layer)).map(|(rr, r)| (*rr, r.layer)).collect();
-            let (at, line_y) = insertion(&layer_rows, ptr.y, rows_rect.min.y);
-            let index = match at.and_then(|i| layer_rows.get(i)) {
-                Some((_, l)) => comp.index_of(*l).unwrap_or(1),
-                None => layer_rows.last().and_then(|(_, l)| comp.index_of(*l)).unwrap_or(comp.layers.len()) + 1,
-            };
-            let start = (ptr.x >= graph_x0 && !graph_on).then(|| {
-                let t = if ctx.input(|i| i.modifiers.shift) { time } else { Tick::from_seconds_f64(tm.t(ptr.x)) };
-                comp.frame_rate.snap_nearest(t).clamp(Tick::ZERO, comp.duration - comp.frame_duration())
-            });
-            let rp = p.with_clip_rect(rows_rect);
-            rp.line_segment([pos2(rect.min.x, line_y), pos2(rows_rect.max.x, line_y)], Stroke::new(2.0, t.accent));
-            if let Some(s) = start {
-                let x = tm.x(s.seconds());
-                rp.line_segment([pos2(x, rows_rect.min.y), pos2(x, rows_rect.max.y)], Stroke::new(1.0, t.accent));
-                // The In point's time in a tag beside the marker.
-                let g = rp.layout_no_wrap(super::timecode(&app.session, &comp, s), Tokens::ui(11.0), Color32::WHITE);
-                let tag = Align2::LEFT_BOTTOM.anchor_size(pos2(x + 4.0, line_y - 3.0), g.size());
-                rp.rect_filled(tag.expand(2.0), 2.0, t.accent);
-                rp.galley(tag.min, g, Color32::WHITE);
-            }
-            if released {
-                let time = json!(start.map(Tick::seconds));
-                match payload.as_ref() {
-                    crate::panels::DragPayload::Item(id) => {
-                        // Insert each selected item at the drop point, in selection order.
-                        for (offset, item) in crate::panels::project_drop_items(app, *id).into_iter().enumerate() {
-                            actions.push(("layer.addItem".into(), json!({"item": item, "index": index.saturating_add(offset), "time": time.clone()})));
-                        }
-                    }
-                    crate::panels::DragPayload::Files(paths) => {
-                        actions.push(("mediaBrowser.import".into(), json!({"paths": paths, "addToComp": true, "index": index, "time": time})))
-                    }
-                    crate::panels::DragPayload::Effect(_) | crate::panels::DragPayload::Preset { .. } | crate::panels::DragPayload::Property { .. } => {}
-                }
-            }
-        }
-        if released {
-            egui::DragAndDrop::clear_payload(&ctx);
-        }
-    }
-
-    // Apply.
+/// Applies the UI-only changes the frame collected (twirls, time, ending an undo merge).
+fn apply_ui_acts(app: &mut EffectcraftApp, comp: &Comp, ui_actions: Vec<UiAct>) {
     for a in ui_actions {
         match a {
             UiAct::ToggleLayer(id, all) => {
@@ -3474,6 +2062,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
+}
+
+/// Runs the commands the frame collected through [`crate::menus::invoke`].
+fn apply_actions(app: &mut EffectcraftApp, ui: &mut egui::Ui, ctx: &egui::Context, actions: Vec<(String, serde_json::Value)>) {
     if ui.input(|i| i.pointer.primary_down()) && actions.iter().any(|(id, _)| id == "prop.set") {
         app.ui.viewer.property_interacting = true;
         ctx.request_repaint();
@@ -3483,32 +2075,3094 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             app.session.history.merge_key = None;
             continue;
         }
-        if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
+        if let Err(e) = crate::menus::invoke(app, ctx, &id, params) {
             app.ui.status = e;
         }
     }
 }
 
+/// Draws the visible rows, top to bottom, each by its kind.
+fn draw_rows(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, ectx: &EvalCtx<'_>) {
+    let comp = g.tl.comp.clone();
+    let rows = g.tl.rows.clone();
+    let (rect, rows_rect, rh, cw_name) = (g.tl.rect, g.tl.rows_rect, g.tl.rh, g.tl.cw.name);
+    let mut y = rows_rect.min.y - app.ui.timeline.scroll_y;
+    // Rows stripe by their index among the rows that are not expression editors, so adding or
+    // removing an expression leaves every other row's stripe alone; an editor takes the index
+    // (and so the stripe) of its property's row, the one just above.
+    let mut striped = 0usize;
+    for row in rows.iter() {
+        let ri = if matches!(row.kind, RowKind::Expr { .. }) {
+            striped.saturating_sub(1)
+        } else {
+            striped += 1;
+            striped - 1
+        };
+        // Outline widgets never spill into the time graph (narrow timelines).
+        ui.set_clip_rect(g.left_clip);
+        let hh = row_height(row, rh);
+        let r = Rect::from_min_size(pos2(rect.min.x, y), vec2(rect.width(), hh));
+        y += hh;
+        if r.max.y < rows_rect.min.y || r.min.y > rows_rect.max.y {
+            continue;
+        }
+        g.hit_rows.push((r, row.clone()));
+        let Some(layer) = comp.layer(row.layer) else { continue };
+        let rc = RowCtx {
+            row,
+            layer,
+            r,
+            left: Rect::from_min_max(r.min, pos2(g.tl.graph_x0 - 1.0, r.max.y)),
+            cy: r.min.y + rh / 2.0,
+            is_sel: g.selected.contains(&layer.id),
+            ri,
+            indent: cw_name + 6.0 + 14.0 * row.depth as f32,
+        };
+        match &row.kind {
+            RowKind::Layer => layer_row(app, ui, g, &rc),
+            RowKind::Group { .. } => group_row(app, ui, g, &rc),
+            RowKind::Waveform { .. } => waveform_row(app, g, &rc),
+            RowKind::Expr { .. } => expr_row(app, ui, g, &rc),
+            RowKind::Prop { .. } => prop_row(app, ui, g, &rc, ectx),
+        }
+    }
+}
+
+/// A layer row: switches, label, name, cells and the layer bar.
+fn layer_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    layer_row_background(g, rc);
+    layer_av_switches(app, ui, g, rc);
+    layer_label_swatch(app, ui, g, rc);
+    layer_number_and_cells(app, ui, g, rc);
+    let (row_resp, name_x) = layer_twirl_and_icon(app, ui, g, rc);
+    layer_name(app, ui, g, rc, name_x);
+    layer_row_actions(app, ui, g, rc, &row_resp);
+    layer_switches(app, ui, g, rc);
+    if app.ui.timeline.show_modes && rc.layer.source.is_av() {
+        layer_mode_cell(app, ui, g, rc);
+        layer_matte_cell(app, ui, g, rc);
+    }
+    if g.tl.vis.parent {
+        layer_parent_cell(app, ui, g, rc);
+    }
+    ui.set_clip_rect(g.right_clip);
+    if !g.graph_on {
+        layer_bar(app, ui, g, rc);
+    }
+}
+
+/// The layer's duration bar: source extent, move and trim, markers.
+fn layer_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let (bar, lc) = layer_bar_paint(g, rc);
+    layer_source_extent(app, ui, g, rc, bar, lc);
+    let bars = layer_bar_hits(app, ui, g, rc, bar);
+    let quick = layer_quick_offset_begin(ui, g, rc, &bars.body);
+    layer_bar_drag(g, rc, &bars, quick);
+    layer_bar_markers(app, ui, g, rc);
+}
+
+/// A group row (effect, mask, shape group, layer style).
+fn group_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let shown = group_background(app, g, rc);
+    group_switches(app, ui, g, rc);
+    group_name(app, ui, g, rc, &shown);
+    group_popups(app, ui, g, rc);
+    group_mask_mode(ui, g, rc);
+    group_row_click(app, ui, g, rc);
+}
+
+/// An expression row: its controls and the editor.
+fn expr_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let RowKind::Expr { uid, .. } = &rc.row.kind else { return };
+    let Some(prop) = rc.layer.props.find(*uid) else { return };
+    let Some(ex) = prop.expr.as_ref() else { return };
+    let st = ExprRow { prop, ex, buf_id: expr_buf_id(*uid), edit_id: egui::Id::unique(("expr-edit", uid)) };
+    expr_controls(app, ui, g, rc, &st);
+    expr_language_menu(app, ui, g, rc, &st);
+    expr_editor_cell(app, ui, g, rc, &st);
+}
+
+/// A property row: keyframe navigator, stopwatch, name, value editors and the keyframes.
+fn prop_row(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, ectx: &EvalCtx<'_>) {
+    let RowKind::Prop { uid } = &rc.row.kind else { return };
+    let Some(prop) = rc.layer.props.find(*uid) else { return };
+    prop_background(app, g, rc, prop);
+    prop_key_navigator(app, ui, g, rc, prop);
+    prop_stopwatch(app, ui, g, rc, prop);
+    let name_x = prop_name(app, ui, g, rc, prop);
+    prop_value_cell(app, ui, g, rc, ectx, prop, name_x);
+    prop_expression_hint(app, ui, g, rc, prop);
+    if !g.graph_on {
+        for k in &prop.keys {
+            key_marker(app, ui, g, rc, prop, k);
+        }
+    }
+}
+
+/// One keyframe marker: its look, selection, menu and drag.
+fn key_marker(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, prop: &Property, k: &effectcraft_engine::keyframe::Keyframe) {
+    let RowKind::Prop { uid } = &rc.row.kind else { return };
+    let ct = rc.layer.comp_time(k.time);
+    let x = g.tl.tm.x(ct.seconds());
+    if x < g.tl.graph_x0 - 8.0 || x > g.tl.rect.max.x + 8.0 {
+        return;
+    }
+    let kref = effectcraft_engine::KeyRef { layer: rc.layer.id, prop: *uid, time: k.time };
+    let ks = g.sel_keys.contains(&kref);
+    let kr = key_paint(g, rc, k, x, ks);
+    let kresp = key_hit(app, ui, g, rc, prop, k, kr);
+    let mods = ui.input(|i| i.modifiers);
+    let this_key = json!({"keys": [{"layer": rc.layer.id.0, "prop": uid, "time": k.time.seconds()}], "selectProperties": true});
+    let kh = KeyHit { k, ct, ks, kresp, mods, this_key };
+    key_select(g, &kh);
+    key_double_click(g, rc, prop, &kh);
+    key_context_menu(app, g, rc, prop, &kh);
+    key_drag_begin(app, g, &kh);
+}
+
+/// Drop targets: effects and presets on a layer, footage and files into the stack.
+fn drop_targets(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw) {
+    let ctx = g.tl.ctx.clone();
+    let rows_rect = g.tl.rows_rect;
+    if let Some(payload) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx)
+        && !matches!(*payload, crate::panels::DragPayload::Property { .. })
+        && let Some(ptr) = ctx.input(|i| i.pointer.hover_pos()).filter(|_| ui.rect_contains_pointer(rows_rect))
+    {
+        let released = ctx.input(|i| i.pointer.any_released());
+        // Alt/Option-drag from the Project panel replaces the source of the layer under the
+        // pointer (After Effects). The shortcut replaces every selected layer instead.
+        let alt_item = ctx.input(|i| i.modifiers.alt) && matches!(payload.as_ref(), crate::panels::DragPayload::Item(_));
+        if alt_item {
+            drop_replace_source(app, g, &payload, ptr, released);
+        } else if matches!(payload.as_ref(), crate::panels::DragPayload::Effect(_) | crate::panels::DragPayload::Preset { .. }) {
+            drop_on_layer(app, g, &payload, ptr, released);
+        } else {
+            drop_insert_layers(app, g, &payload, ptr, released);
+        }
+        if released {
+            egui::DragAndDrop::clear_payload(&ctx);
+        }
+    }
+}
+
+/// The header's time display: click to switch style, drag to scrub, double-click to type a time.
+fn header_timecode(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Tl) {
+    let t = g.t;
+    let time = g.time;
+    let fr = g.fr;
+    let tc_rect = g.tc_rect;
+    let ctx = g.ctx.clone();
+    let comp = g.comp.clone();
+    let p = g.p.clone();
+    let tc = crate::panels::timecode(&app.session, &comp, time);
+    let tc_resp = ui.interact(tc_rect, egui::Id::unique("tl-timecode"), Sense::click_and_drag());
+    p.text(tc_rect.left_center(), Align2::LEFT_CENTER, &tc, Tokens::semibold(16.0), t.timecode);
+    // Under it the other style (frames under timecode, timecode under frames) and the rate.
+    let settings = &app.session.project.settings;
+    let other = if settings.time_display == effectcraft_engine::project::TimeDisplayStyle::Timecode {
+        format!("{:05}", fr.frame_at(time) + settings.frame_start)
+    } else {
+        effectcraft_engine::time::format_timecode_ae(fr.frame_at(time + comp.display_start), fr, false)
+    };
+    // Audio-only preview (Video off in the Preview panel): the current time stays put, so that
+    // line says why and where the sound is instead (#1118).
+    if let Some(af) = app.video_preview_off() {
+        let at = af.map(|f| format!(" · {}", effectcraft_engine::time::format_timecode_ae(f + fr.frame_at(comp.display_start), fr, false))).unwrap_or_default();
+        let msg = format!("{}{at}", crate::i18n::tr("Video preview off: audio only"));
+        p.text(pos2(tc_rect.min.x, tc_rect.max.y + 8.0), Align2::LEFT_CENTER, msg, Tokens::ui(10.5), t.cache_green);
+    } else {
+        p.text(pos2(tc_rect.min.x, tc_rect.max.y + 8.0), Align2::LEFT_CENTER, format!("{other} ({:.2} fps)", fr.as_f64()), Tokens::ui(10.5), t.text_faint);
+    }
+    app.auto.add("timeline.timecode", tc_rect, &tc);
+    super::toggle_time_display(app, &tc_resp);
+    if tc_resp.dragged() {
+        let d = tc_resp.drag_delta().x as f64;
+        let f = fr.frame_at(time) + (d * 0.5).round() as i64;
+        let _ = app.session.execute("time.set", json!({"frame": f.max(0)}));
+    }
+    if tc_resp.double_clicked() {
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique("tl-tc-edit"), tc.clone()));
+    }
+    if let Some(mut buf) = ctx.data(|d| d.get_temp::<String>(egui::Id::unique("tl-tc-edit"))) {
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(tc_rect));
+        let r = child.add(egui::TextEdit::singleline(&mut buf).font(Tokens::semibold(16.0)).desired_width(150.0));
+        if r.lost_focus() {
+            if !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                let _ = app.session.execute("time.set", json!({"timecode": buf}));
+            }
+            ctx.data_mut(|d| d.remove::<String>(egui::Id::unique("tl-tc-edit")));
+        } else {
+            widgets::keep_focus(&ctx, &r, &buf);
+            ctx.data_mut(|d| d.insert_temp(egui::Id::unique("tl-tc-edit"), buf));
+        }
+    }
+}
+
+/// The header's search field and the composition switches.
+fn header_search_and_switches(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Tl) {
+    let t = g.t;
+    let rect = g.rect;
+    let left_w = g.left_w;
+    let top = g.top;
+    let tc_rect = g.tc_rect;
+    let comp = g.comp.clone();
+    let sr = Rect::from_min_size(pos2(tc_rect.max.x + 14.0, top + 12.0), vec2((left_w - 420.0).clamp(120.0, 220.0), 22.0));
+    let mut search = app.ui.timeline.search.clone();
+    widgets::search_field(ui, sr, &mut search, crate::i18n::tr("Search"), &t);
+    app.ui.timeline.search = search;
+    app.auto.add("timeline.search", sr, "Search");
+    let mut bx = rect.min.x + left_w - 10.0;
+    for (icon, on, id, tip) in [
+        (Icon::Graph, app.ui.timeline.graph_editor, "graph", "Graph Editor"),
+        (Icon::MotionBlur, comp.enable_motion_blur, "motionBlur", "Enables Motion Blur for all layers with the Motion Blur switch set"),
+        (Icon::FrameBlend, comp.enable_frame_blending, "frameBlending", "Enables Frame Blending for all layers with the Frame Blend switch set"),
+        (Icon::Shy, comp.hide_shy, "hideShy", "Hides all layers for which the Shy switch is set"),
+        (Icon::Draft3D, comp.draft_3d, "draft3d", "Draft 3D"),
+        (Icon::Flowchart, false, "flowchart", "Composition Mini-Flowchart"),
+    ] {
+        let r = Rect::from_min_size(pos2(bx - 24.0, top + 11.0), vec2(24.0, 24.0));
+        let resp = widgets::icon_button(ui, r, icon, on, &t, egui::Id::unique(("tl-sw", id))).on_hover_text(tip);
+        app.auto.add(&format!("timeline.switch.{id}"), r, tip);
+        if resp.clicked() {
+            match id {
+                "graph" => app.ui.timeline.graph_editor = !app.ui.timeline.graph_editor,
+                "flowchart" => app.show_panel(crate::dock::PanelKind::Flowchart),
+                _ => {
+                    let _ = app.session.execute("comp.setSwitch", json!({"switch": id}));
+                }
+            }
+        }
+        bx -= 28.0;
+    }
+}
+
+/// The time navigator: the visible span as a bar with end handles.
+fn time_navigator(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Tl) {
+    let t = g.t;
+    let graph_x0 = g.graph_x0;
+    let graph_x1 = g.graph_x1;
+    let fit_pps = g.fit_pps;
+    let pps = g.pps;
+    let tm = g.tm;
+    let top = g.top;
+    let ctx = g.ctx.clone();
+    let comp = g.comp.clone();
+    let p = g.p.clone();
+    let nav = Rect::from_min_max(pos2(graph_x0 + 6.0, top + 6.0), pos2(graph_x1, top + 14.0));
+    // Time navigator: the visible span as a grey bar with blue end handles (as in After
+    // Effects), over a dark track.
+    p.rect_filled(nav, 1.0, t.field_bg);
+    let vis0 = (tm.start / comp.duration.seconds()) as f32;
+    let vis1 = (tm.t(graph_x1) / comp.duration.seconds()) as f32;
+    let nav_vis =
+        Rect::from_min_max(pos2(nav.min.x + nav.width() * vis0.clamp(0.0, 1.0), nav.min.y), pos2(nav.min.x + nav.width() * vis1.clamp(0.0, 1.0), nav.max.y));
+    p.rect_filled(nav_vis, 0.0, t.tl_nav_bar);
+    for x in [nav_vis.min.x, nav_vis.max.x] {
+        p.rect_filled(Rect::from_min_max(pos2(x - 3.0, nav.min.y - 1.0), pos2(x + 3.0, nav.max.y + 1.0)), 3.0, t.accent);
+    }
+    // The middle scrolls at the current zoom; each end is a handle that moves that side of the
+    // visible span (pulled in: zoomed in; stretched to the whole track: the whole comp).
+    let nresp = ui.interact(nav, egui::Id::unique("tl-nav"), Sense::drag());
+    app.auto.add("timeline.navigator", nav, "Time navigator");
+    if nresp.dragged() {
+        let d = nresp.drag_delta().x as f64 / nav.width() as f64 * comp.duration.seconds();
+        app.ui.timeline.start = (app.ui.timeline.start + d).clamp(0.0, comp.duration.seconds());
+        if app.ui.timeline.pps.is_none() {
+            app.ui.timeline.pps = Some(pps);
+        }
+    }
+    let span_px = (graph_x1 - tm.x0) as f64;
+    let (t0, t1) = (tm.start, tm.t(graph_x1));
+    for (end, x) in [("start", nav_vis.min.x), ("end", nav_vis.max.x)] {
+        let hr = Rect::from_center_size(pos2(x, nav.center().y), vec2(10.0, nav.height() + 6.0));
+        let hresp = ui.interact(hr, egui::Id::unique(("tl-nav", end)), Sense::drag());
+        app.auto.add(&format!("timeline.navigator.{end}"), hr, if end == "start" { "Time navigator start" } else { "Time navigator end" });
+        if hresp.hovered() || hresp.dragged() {
+            ctx.set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
+        }
+        if let Some(px) = hresp.interact_pointer_pos().filter(|_| hresp.dragged()) {
+            let t = ((px.x - nav.min.x) / nav.width()) as f64 * comp.duration.seconds();
+            // The other end stays; the span is at least what the most zoomed-in ruler shows.
+            let min_span = span_px / MAX_PPS;
+            let (keep_t, keep_px, span) = if end == "start" { (t1, span_px, t1 - t.min(t1 - min_span)) } else { (t0, 0.0, t.max(t0 + min_span) - t0) };
+            set_zoom(&mut app.ui.timeline, &comp, span_px / span.max(min_span), fit_pps, keep_t, keep_px);
+        }
+    }
+}
+
+fn ruler_background(app: &mut EffectcraftApp, g: &Tl) {
+    let t = g.t;
+    let tm = g.tm;
+    let ruler = g.ruler;
+    let p = g.p.clone();
+    p.rect_filled(ruler, 0.0, t.tl_ruler_bg);
+    app.auto.add("timeline.ruler", ruler, &format!("{},{}", tm.start, tm.pps));
+}
+
+/// The work area bar beside the column headers, with its begin / end handles.
+fn work_area_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Tl) {
+    let t = g.t;
+    let fr = g.fr;
+    let pps = g.pps;
+    let tm = g.tm;
+    let wa_row = g.wa_row;
+    let ctx = g.ctx.clone();
+    let comp = g.comp.clone();
+    let p = g.p.clone();
+    let actions = &mut g.actions;
+    // Work area bar: below the ruler, beside the column headers (After Effects' layout), with
+    // blue begin / end handles; the cache bar runs under it. Dragging the bar moves the work
+    // area, the handles move its ends; Shift snaps (#252).
+    let (wa0, wa1) = (comp.work_area.0.seconds(), comp.work_area.1.seconds());
+    let wa = Rect::from_min_max(pos2(tm.x(wa0), wa_row.min.y + 3.0), pos2(tm.x(wa1), wa_row.max.y - 6.0));
+    p.with_clip_rect(wa_row).rect_filled(wa, 0.0, t.tl_work_area_bar);
+    let shift = ui.input(|i| i.modifiers.shift);
+    let bar = wa.intersect(wa_row);
+    let bresp = ui.interact(bar, egui::Id::unique("wa-bar"), Sense::click_and_drag());
+    app.auto.add("timeline.workArea.bar", bar, "Work area");
+    // Right-click: the work area's commands (After Effects).
+    crate::widgets::context_menu(&bresp, |ui| {
+        let mut chosen = None;
+        for id in ["comp.trimToWorkArea", "edit.liftWorkArea", "edit.extractWorkArea"] {
+            crate::menus::entry_for(app, ui, id, &mut chosen);
+        }
+        actions.extend(chosen);
+    });
+    let bar_start = egui::Id::unique("wa-bar-start");
+    if bresp.drag_started() {
+        ctx.data_mut(|d| d.insert_temp(bar_start, wa0));
+    }
+    if bresp.dragged()
+        && let (Some(a0), Some(d)) = (ctx.data(|d| d.get_temp::<f64>(bar_start)), bresp.total_drag_delta())
+    {
+        let len = wa1 - wa0;
+        let mut a = a0 + d.x as f64 / pps.max(1e-6);
+        if shift {
+            a += work_area_snap(app, &comp, &[a, a + len], pps);
+        }
+        let a = fr.snap_nearest(Tick::from_seconds_f64(a.clamp(0.0, (comp.duration.seconds() - len).max(0.0)))).seconds();
+        let _ = app.session.execute("comp.workArea", json!({"start": a, "end": a + len, "merge": "wa-drag"}));
+    }
+    for (hx, set) in [(wa.min.x, "begin"), (wa.max.x, "end")] {
+        let hr = Rect::from_center_size(pos2(hx, wa.center().y), vec2(8.0, 14.0));
+        let handle = if set == "begin" {
+            Rect::from_min_max(pos2(hx - 1.0, wa.min.y), pos2(hx + 4.0, wa.max.y))
+        } else {
+            Rect::from_min_max(pos2(hx - 4.0, wa.min.y), pos2(hx + 1.0, wa.max.y))
+        };
+        p.rect_filled(handle, 2.0, t.accent);
+        let resp = ui.interact(hr, egui::Id::unique(("wa", set)), Sense::drag());
+        app.auto.add(&format!("timeline.workArea.{set}"), hr, set);
+        if resp.dragged() || resp.hovered() {
+            ctx.set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
+        }
+        if resp.dragged()
+            && let Some(pt) = resp.interact_pointer_pos()
+        {
+            let mut secs = tm.t(pt.x).max(0.0);
+            if shift {
+                secs += work_area_snap(app, &comp, &[secs], pps);
+            }
+            let secs = fr.snap_nearest(Tick::from_seconds_f64(secs)).seconds();
+            let key = if set == "begin" { "start" } else { "end" };
+            let _ = app.session.execute("comp.workArea", json!({key: secs, "merge": "wa-drag"}));
+        }
+    }
+}
+
+/// The RAM (green) and disk (blue) cache bars under the work area.
+fn cache_bars(app: &mut EffectcraftApp, g: &Tl) {
+    let t = g.t;
+    let cid = g.cid;
+    let tm = g.tm;
+    let wa_row = g.wa_row;
+    let fd = g.fd;
+    let comp = g.comp.clone();
+    let p = g.p.clone();
+    // Cache bar (green: cached frames of what the viewer shows: its resolution, view and options).
+    let series = app.shown_series(cid);
+    let cached = app.frames.cached_frames(&series);
+    let cy0 = wa_row.max.y - 4.0;
+    let mut run: Option<(i64, i64)> = None;
+    let draw_run = |a: i64, b: i64| {
+        let x0 = tm.x(a as f64 * fd);
+        let x1 = tm.x((b + 1) as f64 * fd);
+        p.rect_filled(Rect::from_min_max(pos2(x0, cy0), pos2(x1, cy0 + 2.5)), 0.0, t.cache_green);
+    };
+    for f in cached {
+        run = match run {
+            Some((a, b)) if f == b + 1 => Some((a, f)),
+            Some((a, b)) => {
+                draw_run(a, b);
+                Some((f, f))
+            }
+            None => Some((f, f)),
+        };
+    }
+    if let Some((a, b)) = run {
+        draw_run(a, b);
+    }
+    // Disk-cached frames not in RAM (blue), like After Effects.
+    if app.session.disk_cache.is_some() || app.frames.remote_disk() {
+        let frames = comp.frame_rate.frame_at(comp.duration);
+        let opts = app.frame_opts(cid, series.scale as f64 / 1000.0);
+        let clip = wa_row.intersect(p.clip_rect());
+        let range = disk_bar_range(&tm, clip, fd, frames);
+        let disk = app.frames.disk_frames(&app.render_source(), &series, range, &opts);
+        let blue_painter = p.with_clip_rect(clip);
+        let draw_blue = |a: i64, b: i64| {
+            let x0 = tm.x(a as f64 * fd);
+            let x1 = tm.x((b + 1) as f64 * fd);
+            blue_painter.rect_filled(Rect::from_min_max(pos2(x0, cy0), pos2(x1, cy0 + 2.5)), 0.0, t.cache_blue);
+        };
+        let mut run: Option<(i64, i64)> = None;
+        for f in disk {
+            run = match run {
+                Some((a, b)) if f == b + 1 => Some((a, f)),
+                Some((a, b)) => {
+                    draw_blue(a, b);
+                    Some((f, f))
+                }
+                None => Some((f, f)),
+            };
+        }
+        if let Some((a, b)) = run {
+            draw_blue(a, b);
+        }
+    }
+}
+
+/// The ruler's tick marks and labels.
+fn ruler_ticks(app: &mut EffectcraftApp, g: &Tl) {
+    let t = g.t;
+    let fr = g.fr;
+    let graph_x0 = g.graph_x0;
+    let graph_x1 = g.graph_x1;
+    let pps = g.pps;
+    let tm = g.tm;
+    let ruler = g.ruler;
+    let bin = g.bin;
+    let fd = g.fd;
+    let p = g.p.clone();
+    // Ticks + labels.
+    // Label spacing in whole frames (AE: `00:15f`-style seconds:frames labels).
+    let fps_i = fr.as_f64().round().max(1.0) as i64;
+    let half = (fps_i / 2).max(1);
+    let label_frames = [1, 2, 5, 10, half, fps_i, 2 * fps_i, 5 * fps_i, 10 * fps_i, 30 * fps_i, 60 * fps_i]
+        .into_iter()
+        .find(|f| *f as f64 * fd * pps >= 52.0)
+        .unwrap_or(60 * fps_i);
+    let secs_per_label = label_frames as f64 * fd;
+    let first = (tm.start / secs_per_label).floor() * secs_per_label;
+    let mut s = first;
+    let pr = p.with_clip_rect(Rect::from_min_max(pos2(graph_x0, ruler.min.y), pos2(bin.min.x, ruler.max.y)));
+    while s <= tm.t(graph_x1) + secs_per_label {
+        let x = tm.x(s);
+        pr.line_segment([pos2(x, ruler.max.y - 10.0), pos2(x, ruler.max.y)], Stroke::new(1.0, t.tl_ruler_tick));
+        let fno = (s / fd).round() as i64;
+        let label = ruler_label(fno, fps_i, &app.session.project.settings);
+        // A label that would run under the marker bin is left out rather than cut to a stray digit.
+        let g = pr.layout_no_wrap(label, Tokens::ui(10.0), t.tl_ruler_text);
+        if x + 3.0 + g.size().x <= bin.min.x {
+            pr.galley(pos2(x + 3.0, ruler.max.y - 16.0 - g.size().y / 2.0), g, t.tl_ruler_text);
+        }
+        for k in 1..5 {
+            let xx = tm.x(s + secs_per_label * k as f64 / 5.0);
+            pr.line_segment([pos2(xx, ruler.max.y - 4.0), pos2(xx, ruler.max.y)], Stroke::new(1.0, t.tl_ruler_tick.gamma_multiply(0.6)));
+        }
+        s += secs_per_label;
+    }
+}
+
+/// Scrubbing in the ruler: the current time follows the pointer.
+fn ruler_scrub(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Tl) {
+    let graph_x0 = g.graph_x0;
+    let graph_x1 = g.graph_x1;
+    let pps = g.pps;
+    let tm = g.tm;
+    let ruler = g.ruler;
+    let bin = g.bin;
+    let comp = g.comp.clone();
+    // Scrub in the ruler: the current time jumps to the pointer as soon as the button goes down
+    // (After Effects), then follows it.
+    let rresp = ui.interact(
+        Rect::from_min_max(pos2(graph_x0, ruler.min.y + 12.0), pos2(bin.min.x, ruler.max.y)),
+        egui::Id::unique("tl-ruler"),
+        Sense::click_and_drag(),
+    );
+    if ((rresp.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_down())) || rresp.clicked())
+        && let Some(pt) = rresp.interact_pointer_pos()
+    {
+        let mut x = pt.x;
+        // Zoomed in, a scrub held past either end of the ruler scrolls the timeline that way
+        // (faster the further), with the CTI at the edge (After Effects).
+        let mut tm = tm;
+        if rresp.dragged() && app.ui.timeline.pps.is_some() {
+            let speed = edge_scroll_speed_x(tm.x0, graph_x1, x);
+            if speed != 0.0 {
+                let dt = f64::from(ui.input(|i| i.stable_dt).clamp(0.0, 0.1));
+                let span = f64::from(graph_x1 - tm.x0) / pps;
+                let cur = app.ui.timeline.start;
+                let hi = (comp.duration.seconds() - span).max(0.0).max(cur);
+                app.ui.timeline.start = (cur + f64::from(speed) * dt / pps).clamp(0.0, hi);
+                tm.start = app.ui.timeline.start;
+                ui.ctx().request_repaint();
+            }
+            x = x.clamp(tm.x0, graph_x1);
+        }
+        let mut secs = tm.t(x).max(0.0);
+        // Shift-drag: snap to keyframes, in/out points, markers and the work area (8 px).
+        if ui.input(|i| i.modifiers.shift) {
+            let cands = snap_candidates(&comp, &build_rows(app, &comp));
+            secs = snap_time(&cands, secs, 8.0 / pps.max(1e-6));
+        }
+        let tt = Tick::from_seconds_f64(secs);
+        app.session.set_time(tt);
+        app.stop();
+        // Dragged past either edge of the ruler (over the layer outline, say), the view scrolls so
+        // the current time indicator stays in sight (After Effects).
+        if app.ui.timeline.pps.is_some() {
+            let now = app.session.time().seconds();
+            let span = tm.t(bin.min.x) - tm.start;
+            if now < tm.start {
+                app.ui.timeline.start = now.max(0.0);
+            } else if now > tm.start + span {
+                app.ui.timeline.start = (now - span).max(0.0);
+            }
+        }
+        // Ctrl/Cmd-drag scrubs the audio too (After Effects).
+        if rresp.dragged()
+            && ui.input(|i| i.modifiers.command)
+            && let Some(cid) = app.session.active_comp_id()
+        {
+            // The app clock: the audio scrub's idle timeout compares against it in the tick.
+            let now = app.now();
+            let t = app.session.time();
+            app.scrub_audio(cid, t, now);
+        }
+    }
+}
+
+/// The column headers' background, icons and titles.
+fn column_header_icons(app: &mut EffectcraftApp, g: &Tl) {
+    let t = g.t;
+    let rect = g.rect;
+    let header_h = g.header_h;
+    let colhdr_h = g.colhdr_h;
+    let vis = g.vis;
+    let graph_x0 = g.graph_x0;
+    let top = g.top;
+    let p = g.p.clone();
+    let cw = &g.cw;
+    let ch = Rect::from_min_max(pos2(rect.min.x, top + header_h), pos2(rect.max.x, top + header_h + colhdr_h));
+    p.rect_filled(Rect::from_min_max(ch.min, pos2(graph_x0 - 1.0, ch.max.y)), 0.0, t.panel_bg);
+    p.line_segment([pos2(rect.min.x, ch.max.y), pos2(rect.max.x, ch.max.y)], Stroke::new(1.0, t.separator));
+    let hy = ch.center().y;
+    // Column headers scroll with the outline and never spill into the time ruler.
+    let hp = p.with_clip_rect(Rect::from_min_max(ch.min, pos2(graph_x0 - 1.0, ch.max.y)));
+    let hic = |icon: Icon, x: f32| icons::paint(&hp, Rect::from_center_size(pos2(x, hy), vec2(12.0, 12.0)), icon, t.text_dim);
+    let htext = |x: f32, s: &str| hp.text(pos2(x, hy), Align2::LEFT_CENTER, crate::i18n::tr(s), Tokens::ui(11.0), t.text_dim);
+    if vis.av {
+        hic(Icon::Eye, cw.av + 10.0);
+        hic(Icon::Speaker, cw.av + 28.0);
+        hic(Icon::Solo, cw.av + 46.0);
+        hic(Icon::Lock, cw.av + 64.0);
+    }
+    if vis.keys {
+        htext(cw.keys + 6.0, "Keys");
+    }
+    if vis.label {
+        icons::paint(&hp, Rect::from_center_size(pos2(cw.label + 10.0, hy), vec2(10.0, 10.0)), Icon::Keyframe, t.text_dim);
+    }
+    if vis.num {
+        htext(cw.num + 6.0, "#");
+    }
+    let name_hdr = if app.ui.timeline.source_name { "Source Name" } else { "Layer Name" };
+    htext(cw.name + 22.0, name_hdr);
+    if vis.comment {
+        htext(cw.comment + 6.0, "Comment");
+    }
+    if vis.switches {
+        for (i, icon) in
+            [Icon::Shy, Icon::Collapse, Icon::Quality, Icon::Fx, Icon::FrameBlend, Icon::MotionBlur, Icon::Adjustment, Icon::Cube].into_iter().enumerate()
+        {
+            hic(icon, cw.switches + SW * i as f32 + SW / 2.0);
+        }
+    }
+    if vis.modes {
+        htext(cw.mode + 4.0, "Mode");
+        htext(cw.mode + 74.0, "T");
+        htext(cw.trkmat + 4.0, "Track Matte");
+    }
+    if vis.parent {
+        icons::paint(&hp, Rect::from_center_size(pos2(cw.parent + 10.0, hy), vec2(12.0, 12.0)), Icon::PickWhip, t.text_dim);
+        htext(cw.parent + 20.0, "Parent & Link");
+    }
+    for (on, x, s) in [(vis.in_, cw.in_, "In"), (vis.out, cw.out, "Out"), (vis.duration, cw.duration, "Duration"), (vis.stretch, cw.stretch, "Stretch")] {
+        if on {
+            htext(x + 6.0, s);
+        }
+    }
+}
+
+/// Column header clicks, automation ids and the right-click column menu.
+fn column_header_interact(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Tl) {
+    let rect = g.rect;
+    let header_h = g.header_h;
+    let colhdr_h = g.colhdr_h;
+    let vis = g.vis;
+    let graph_x0 = g.graph_x0;
+    let top = g.top;
+    let ctx = g.ctx.clone();
+    let cw = &g.cw;
+    let actions = &mut g.actions;
+    let ch = Rect::from_min_max(pos2(rect.min.x, top + header_h), pos2(rect.max.x, top + header_h + colhdr_h));
+    let hdr_rect = Rect::from_min_max(ch.min, pos2(graph_x0 - 1.0, ch.max.y));
+    let hresp = ui.interact(hdr_rect, egui::Id::unique("tl-colhdr"), Sense::click());
+    app.auto.add("timeline.header", hdr_rect, "Columns (right-click)");
+    // The icon-only headers say what they are on hover. Hover-only, on top of the header: its
+    // clicks and right-click menu still go to the header.
+    for (col, key, r) in header_tip_rects(cw, ch) {
+        let r = r.intersect(hdr_rect);
+        let Some((_, _, name, tip)) = HEADER_TIPS.iter().find(|t| t.1 == key) else { continue };
+        if !r.is_positive() {
+            continue;
+        }
+        // The node first: the hover text becomes its accessible description only on an existing node.
+        let resp = ui.interact(r, egui::Id::unique(("tl-colhdr-tip", key)), Sense::hover());
+        crate::a11y::role_name(&resp, egui::accesskit::Role::ColumnHeader, tr(name));
+        let _ = resp.on_hover_text(tr(tip));
+        // `label` and `#` are a column each: `timeline.header.label` / `.num` already name them.
+        if col != key {
+            app.auto.add(&format!("timeline.header.{col}.{key}"), r, name);
+        }
+    }
+    for (id, label) in COLUMNS {
+        if let Some(x0) = match id {
+            "av" => vis.av.then_some((cw.av, AV_W)),
+            "keys" => vis.keys.then_some((cw.keys, KEYS_W)),
+            "label" => vis.label.then_some((cw.label, LABEL_W)),
+            "num" => vis.num.then_some((cw.num, NUM_W)),
+            "name" => Some((cw.name, cw.name_end - cw.name)),
+            "comment" => vis.comment.then_some((cw.comment, COMMENT_W)),
+            "switches" => vis.switches.then_some((cw.switches, SW * 8.0 + 6.0)),
+            "modes" => vis.modes.then_some((cw.mode, MODES_W)),
+            "parent" => vis.parent.then_some((cw.parent, PARENT_W)),
+            "in" => vis.in_.then_some((cw.in_, TIME_W)),
+            "out" => vis.out.then_some((cw.out, TIME_W)),
+            "duration" => vis.duration.then_some((cw.duration, TIME_W)),
+            _ => vis.stretch.then_some((cw.stretch, STRETCH_W)),
+        } {
+            app.auto.add(&format!("timeline.header.{id}"), Rect::from_min_size(pos2(x0.0, ch.min.y), vec2(x0.1, colhdr_h)), label);
+        }
+    }
+    if hresp.clicked()
+        && let Some(pt) = hresp.interact_pointer_pos()
+        && column_at(cw, pt.x) == Some("name")
+    {
+        app.ui.timeline.source_name = !app.ui.timeline.source_name;
+    }
+    if hresp.secondary_clicked() {
+        let under = hresp.interact_pointer_pos().and_then(|pt| column_at(cw, pt.x));
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique("tl-colhdr-under"), under.unwrap_or("")));
+    }
+    crate::widgets::context_menu(&hresp, |ui| {
+        let under: &str = ctx.data(|d| d.get_temp(egui::Id::unique("tl-colhdr-under"))).unwrap_or("");
+        if !under.is_empty() && under != "name" && ui.button(crate::i18n::tr("Hide This")).clicked() {
+            actions.push(("timeline.column".into(), json!({"column": under, "visible": false})));
+            ui.close();
+        }
+        ui.menu_button(crate::i18n::tr("Columns"), |ui| {
+            for (id, label) in COLUMNS {
+                let label = if id == "name" { if app.ui.timeline.source_name { "Source Name" } else { "Layer Name" } } else { label };
+                let on = column_visible(&app.ui.timeline, id);
+                if ui.add_enabled(id != "name", egui::Button::new(crate::i18n::tr(label)).selected(on)).clicked() {
+                    actions.push(("timeline.column".into(), json!({"column": id, "visible": !on})));
+                    ui.close();
+                }
+            }
+        });
+        if ui.button(if app.ui.timeline.source_name { crate::i18n::tr("Show Layer Name") } else { crate::i18n::tr("Show Source Name") }).clicked() {
+            actions.push(("timeline.sourceName".into(), json!({})));
+            ui.close();
+        }
+    });
+    let _ = cw.end;
+}
+
+/// Scrolls an expression editor or the requested layer / property into view.
+fn reveal_scroll(app: &mut EffectcraftApp, g: &Tl) {
+    let scroll_to = g.scroll_to;
+    let rows_rect = g.rows_rect;
+    let rh = g.rh;
+    let ctx = g.ctx.clone();
+    let comp = g.comp.clone();
+    let rows = &g.rows;
+    // An expression editor asked to take the keyboard comes into view; a request whose
+    // expression didn't appear, or that wasn't taken within a few passes, is dropped (it never
+    // takes the keyboard later).
+    if let Some(f) = ctx.data(|d| d.get_temp::<ExprFocus>(expr_focus_id())) {
+        match rows.iter().position(|r| matches!(r.kind, RowKind::Expr { uid, .. } if uid == f.prop)) {
+            Some(i) if ctx.cumulative_pass_nr() <= f.pass.saturating_add(8) => {
+                let top: f32 = rows.iter().take(i).map(|r| row_height(r, rh)).sum();
+                let fits = (top + rows.get(i).map_or(rh, |r| row_height(r, rh)) - rows_rect.height()).max(0.0).min(top);
+                app.ui.timeline.scroll_y = app.ui.timeline.scroll_y.min(top).max(fits);
+            }
+            _ => ctx.data_mut(|d| d.remove::<ExprFocus>(expr_focus_id())),
+        }
+    }
+    if scroll_to == Some(crate::state::ScrollTo::Layer) {
+        // The topmost selected layer, in stack order.
+        let sel = &app.session.state.selected_layers;
+        let top = comp.layers.iter().find(|l| sel.contains(&l.id)).map(|l| l.id);
+        if let Some(i) = rows.iter().position(|r| matches!(r.kind, RowKind::Layer) && Some(r.layer) == top) {
+            app.ui.timeline.scroll_y = rows.iter().take(i).map(|r| row_height(r, rh)).sum();
+        }
+    } else if let Some(crate::state::ScrollTo::Property(uid)) = scroll_to
+        && let Some(i) = rows.iter().position(|r| matches!(r.kind, RowKind::Prop { uid: p } if p == uid))
+    {
+        app.ui.timeline.scroll_y = rows.iter().take(i).map(|r| row_height(r, rh)).sum();
+    }
+}
+
+/// Mouse wheel and pinch over the rows: zoom time or scroll.
+fn wheel_zoom_scroll(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Tl) {
+    let overflow = g.overflow;
+    let graph_x0 = g.graph_x0;
+    let fit_pps = g.fit_pps;
+    let pps = g.pps;
+    let tm = g.tm;
+    let rows_rect = g.rows_rect;
+    let max_scroll = g.max_scroll;
+    let comp = g.comp.clone();
+    if ui.rect_contains_pointer(rows_rect) {
+        let (dy, dx, zoom) = ui.input(|i| (i.smooth_scroll_delta.y, i.smooth_scroll_delta.x, i.modifiers.alt));
+        // Ctrl/Cmd+wheel and a trackpad pinch reach egui as a zoom factor rather than a scroll
+        // (#428); like Alt+wheel they zoom time.
+        let pinch = ui.input(|i| i.zoom_delta()) as f64;
+        let at_x = ui.input(|i| i.pointer.hover_pos()).map(|p| p.x).unwrap_or(graph_x0);
+        if (pinch - 1.0).abs() > 1e-4 {
+            set_zoom(&mut app.ui.timeline, &comp, tm.pps * pinch, fit_pps, tm.t(at_x), (at_x - tm.x0) as f64);
+        } else if zoom && dy.abs() > 0.0 {
+            // Alt+wheel zooms around the pointer, out until the whole comp shows.
+            set_zoom(&mut app.ui.timeline, &comp, tm.pps * (dy as f64 / 200.0).exp(), fit_pps, tm.t(at_x), (at_x - tm.x0) as f64);
+        } else {
+            let over_outline = ui.input(|i| i.pointer.hover_pos()).is_some_and(|p| p.x < graph_x0);
+            let shift = ui.input(|i| i.modifiers.shift);
+            if over_outline && overflow > 0.0 && (dx.abs() > 0.0 || (shift && dy.abs() > 0.0)) {
+                let d = if dx.abs() > 0.0 { dx } else { dy };
+                app.ui.timeline.outline_scroll = (app.ui.timeline.outline_scroll - d).clamp(0.0, overflow);
+            } else {
+                app.ui.timeline.scroll_y = (app.ui.timeline.scroll_y - dy).clamp(0.0, max_scroll);
+            }
+            if dx.abs() > 0.0 && app.ui.timeline.pps.is_some() && !over_outline {
+                app.ui.timeline.start = (app.ui.timeline.start - dx as f64 / pps).max(0.0);
+            }
+        }
+    }
+}
+
+/// A held pick whip near the top or bottom scrolls the rows.
+fn pick_whip_edge_scroll(app: &mut EffectcraftApp, g: &Tl) {
+    let rect = g.rect;
+    let rows_rect = g.rows_rect;
+    let rh = g.rh;
+    let max_scroll = g.max_scroll;
+    let ctx = g.ctx.clone();
+    // A pick whip held near the top or bottom of the layers (or past it) scrolls them, as in
+    // After Effects.
+    if ctx.data(|d| d.get_temp::<PickWhip>(pick_whip_id())).is_some()
+        && let Some(ptr) = ctx.input(|i| i.pointer.latest_pos()).filter(|p| rect.x_range().contains(p.x))
+    {
+        let speed = edge_scroll_speed(rows_rect, ptr.y, rh);
+        if speed != 0.0 {
+            app.ui.timeline.scroll_y += speed * ctx.input(|i| i.stable_dt).min(0.1);
+            ctx.request_repaint();
+        }
+    }
+    app.ui.timeline.scroll_y = app.ui.timeline.scroll_y.clamp(0.0, max_scroll);
+}
+
+fn layer_row_background(g: &Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let lp = g.lp.clone();
+    let gp = g.gp.clone();
+    let r = rc.r;
+    let left = rc.left;
+    let is_sel = rc.is_sel;
+    lp.rect_filled(left, 0.0, if is_sel { t.row_selected } else { t.row_alt });
+    gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, if is_sel { t.tl_graph_selected } else { t.tl_bg });
+    lp.line_segment([pos2(rect.min.x, r.max.y - 0.5), pos2(graph_x0, r.max.y - 0.5)], Stroke::new(1.0, t.app_bg));
+    gp.line_segment([pos2(graph_x0, r.max.y - 0.5), pos2(r.max.x, r.max.y - 0.5)], Stroke::new(1.0, t.app_bg));
+}
+
+/// The A/V feature switches (video, audio, solo, lock).
+fn layer_av_switches(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let vis = g.tl.vis;
+    let comp = g.tl.comp.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    let sw = &layer.switches;
+    // Every layer has the Video switch (the eye), nulls, cameras and lights included,
+    // as in After Effects: it hides a null's outline in the viewer and turns a camera or
+    // light off.
+    let av_items: [(Icon, bool, &str, bool); 4] = [
+        (Icon::Eye, sw.video, "video", switch_applies(layer, "video", &app.session.project)),
+        (Icon::Speaker, sw.audio, "audio", switch_applies(layer, "audio", &app.session.project)),
+        (Icon::Solo, sw.solo, "solo", switch_applies(layer, "solo", &app.session.project)),
+        (Icon::Lock, sw.locked, "lock", switch_applies(layer, "lock", &app.session.project)),
+    ];
+    for (i, (icon, on, name, applicable)) in av_items.into_iter().enumerate() {
+        let br = Rect::from_center_size(pos2(cw.av + 10.0 + 18.0 * i as f32, cy), vec2(15.0, 15.0));
+        if !applicable || !vis.av {
+            continue;
+        }
+        lp.rect_filled(br.shrink(0.5), 1.0, t.switch_well);
+        layer_switch(
+            ui,
+            &t,
+            &SwitchSpec { row: r, br, icon, on, id: egui::Id::unique(("av", layer.id.0, i)), layer: layer.id.0, name, others: true },
+            &comp,
+            &app.session.project,
+            selected,
+            &mut *actions,
+        );
+        app.auto.add(&format!("timeline.layer.{}.{name}", layer.id.0), br, name);
+    }
+}
+
+/// The label swatch and its colour menu.
+fn layer_label_swatch(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let vis = g.tl.vis;
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    // Label swatch.
+    if vis.label {
+        let lr = Rect::from_center_size(pos2(cw.label + 10.0, cy), vec2(12.0, 12.0));
+        lp.rect_filled(lr, 2.0, t.label(layer.label));
+        let lresp = ui.interact(lr, egui::Id::unique(("label", layer.id.0)), Sense::click());
+        app.auto.add(&format!("timeline.layer.{}.label", layer.id.0), lr, layer.label.name());
+        // Click (or right-click) the swatch for the label menu (After Effects).
+        let pop = egui::Id::unique(("label-pop", layer.id.0));
+        if lresp.clicked() || lresp.secondary_clicked() {
+            widgets::open_popup(ui, pop);
+        }
+        if let Some(lab) = widgets::label_popup(ui, pop, lr.left_bottom(), layer.label, |l| app.session.prefs.label_name(l), &t) {
+            actions.push(("edit.label".into(), json!({"layers": edited_layers(layer.id, selected), "label": lab.name()})));
+        }
+    }
+}
+
+fn layer_number_and_cells(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let vis = g.tl.vis;
+    let comp = g.tl.comp.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let cy = rc.cy;
+    if vis.num {
+        lp.text(pos2(cw.num + 13.0, cy), Align2::CENTER_CENTER, format!("{}", comp.index_of(layer.id).unwrap_or(0)), Tokens::ui(11.5), t.text_dim);
+    }
+    layer_cells(app, ui, &lp, cw, &comp, rc, &mut *actions);
+}
+
+/// The row's click target, twirl, icon and guide mark; returns the row response and the name's x.
+fn layer_twirl_and_icon(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) -> (egui::Response, f32) {
+    let t = g.tl.t;
+    let vis = g.tl.vis;
+    let cw = &g.tl.cw;
+    let lp = g.lp.clone();
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    // Row click → select; double-click → rename; drag → reorder. Registered before the
+    // twirl and the name field so those sit on top and get their clicks.
+    let row_x0 = if vis.num { cw.num } else { cw.name + 16.0 };
+    let row_resp =
+        ui.interact(Rect::from_min_max(pos2(row_x0, r.min.y), pos2(cw.name_end, r.max.y)), egui::Id::unique(("row", layer.id.0)), Sense::click_and_drag());
+    // Twirl + icon + name.
+    let tw = Rect::from_center_size(pos2(cw.name + 8.0, cy), vec2(14.0, 14.0));
+    let open = app.ui.timeline.open_layers.contains(&layer.id.0);
+    if widgets::twirl(ui, tw, open, egui::Id::unique(("twirl", layer.id.0)), &t).clicked() {
+        ui_actions.push(UiAct::ToggleLayer(layer.id.0, ui.input(|i| i.modifiers.alt || i.modifiers.command)));
+    }
+    app.auto.add(&format!("timeline.layer.{}.twirl", layer.id.0), tw, "twirl");
+    icons::paint(&lp, Rect::from_center_size(pos2(cw.name + 24.0, cy), vec2(13.0, 13.0)), layer_icon(layer, &app.session.project), t.text_dim);
+    // A guide layer carries a guide mark before its name (After Effects).
+    let name_x = if layer.switches.guide {
+        let mark = Rect::from_center_size(pos2(cw.name + 40.0, cy), vec2(11.0, 11.0));
+        icons::paint(&lp, mark, Icon::Grid, t.text_dim);
+        app.auto.add(&format!("timeline.layer.{}.guide", layer.id.0), mark, "Guide Layer");
+        cw.name + 50.0
+    } else {
+        cw.name + 34.0
+    };
+    (row_resp, name_x)
+}
+
+/// The layer name: the rename field or the (selected) name cell.
+/// Reserve space for source warnings so selection backgrounds and inline renaming cannot
+/// obscure the marker or its recovery tooltip.
+fn layer_name(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, name_x: f32) {
+    let t = g.tl.t;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    let is_sel = rc.is_sel;
+    let problem = match &layer.source {
+        LayerSource::Footage { item } | LayerSource::Comp { item } => {
+            app.session.project.item(*item).and_then(|i| app.session.footage.item_problem(i).or_else(|| effectcraft_engine::render::missing_item_problem(i)))
+        }
+        _ => None,
+    };
+    let end = cw.name_end - 4.0;
+    if let Some(why) = &problem {
+        let marker = Rect::from_center_size(pos2(end - 7.0, cy), vec2(13.0, 12.0)).intersect(lp.clip_rect());
+        lp.add(egui::Shape::convex_polygon(vec![marker.center_top(), marker.right_bottom(), marker.left_bottom()], t.warning, Stroke::NONE));
+        lp.text(marker.center() + vec2(0.0, 1.5), Align2::CENTER_CENTER, "!", Tokens::semibold(9.0), Color32::BLACK);
+        ui.interact(marker, egui::Id::unique(("tl-problem", layer.id.0)), Sense::hover()).on_hover_text(why);
+        app.auto.add(&format!("timeline.layer.{}.problem", layer.id.0), marker, why);
+    }
+    let name_rect = Rect::from_min_max(pos2(name_x, r.min.y), pos2((end - if problem.is_some() { 17.0 } else { 0.0 }).max(name_x), r.max.y));
+    let rename_id = egui::Id::unique("tl-rename");
+    let renaming: Option<(u64, String)> = ctx.data(|d| d.get_temp(rename_id));
+    if let Some((rl, mut buf)) = renaming.filter(|(rl, _)| *rl == layer.id.0) {
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(name_rect.shrink2(vec2(0.0, 2.0))));
+        let er = child.add(egui::TextEdit::singleline(&mut buf).font(Tokens::ui(12.0)).desired_width(name_rect.width()));
+        app.auto.add(&format!("timeline.layer.{rl}.nameEdit"), er.rect, &buf);
+        if ctx.data_mut(|d| d.remove_temp::<bool>(rename_focus_id())).unwrap_or(false) {
+            // Just started: focus the field with the whole name selected.
+            er.request_focus();
+            widgets::select_all(&ctx, er.id, &buf);
+        }
+        if er.lost_focus() {
+            if !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                actions.push(("layer.rename".into(), json!({"layer": rl, "name": buf})));
+            }
+            ctx.data_mut(|d| d.remove::<(u64, String)>(rename_id));
+        } else {
+            ctx.data_mut(|d| d.insert_temp(rename_id, (rl, buf)));
+        }
+    } else {
+        // The selected layer's name sits in a light cell with dark text.
+        let name_col = if is_sel { Color32::from_gray(0x16) } else { t.text };
+        if is_sel {
+            let g = lp.layout_no_wrap(display_name(app, layer), Tokens::ui(12.0), name_col);
+            let cell = Rect::from_min_max(
+                pos2(name_rect.min.x - 3.0, r.min.y + 1.0),
+                pos2((name_rect.min.x + g.size().x + 4.0).max(name_rect.max.x).min(name_rect.max.x + 2.0), r.max.y - 1.0),
+            );
+            lp.rect_filled(cell, 0.0, SELECTED_NAME_BG);
+        }
+        let lpn = lp.with_clip_rect(name_rect.intersect(lp.clip_rect()));
+        lpn.text(pos2(name_rect.min.x, cy), Align2::LEFT_CENTER, display_name(app, layer), Tokens::ui(12.0), name_col);
+    }
+}
+
+/// Row click, drag, double-click and context menu.
+fn layer_row_actions(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, row_resp: &egui::Response) {
+    let cid = g.tl.cid;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let rows = &g.tl.rows;
+    let actions = &mut g.tl.actions;
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let left = rc.left;
+    let is_sel = rc.is_sel;
+    // Locked layers can't be selected or moved (unlock them with the lock switch).
+    let locked = layer.switches.locked;
+    if row_resp.drag_started_by(egui::PointerButton::Primary) && !locked {
+        // The selected layers move together; an unselected row moves alone.
+        let moving: Vec<u64> = if is_sel { comp.layers.iter().filter(|l| selected.contains(&l.id)).map(|l| l.id.0).collect() } else { vec![layer.id.0] };
+        ctx.data_mut(|d| d.insert_temp(layer_drag_id(), LayerDrag { comp: cid, owner: row_resp.id, layers: moving }));
+    }
+    app.auto.add(&format!("timeline.layer.{}.row", layer.id.0), left, &layer.name);
+    if row_resp.clicked() && !locked {
+        let m = ui.input(|i| i.modifiers);
+        if let Some(layers) = m.shift.then(|| shift_range(&ctx, cid, &comp, rows, selected, layer.id)).flatten() {
+            actions.push(("layer.select".into(), json!({"layers": layers})));
+        } else {
+            actions.push(("layer.select".into(), json!({"layers": [layer.id.0], "toggle": m.command})));
+            set_anchor(&ctx, cid, layer.id);
+        }
+    }
+    if row_resp.double_clicked() {
+        match double_click_action(layer) {
+            Some(a) => actions.push(a),
+            None => start_rename(&ctx, layer.id.0, &layer.name),
+        }
+    }
+    layer_context_menu(row_resp, &comp, layer, selected, LayerMenuCaps::of(&app.session.project, layer), &mut app.auto, &mut *actions);
+}
+
+/// The eight layer switches.
+fn layer_switches(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let vis = g.tl.vis;
+    let comp = g.tl.comp.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    let sw = &layer.switches;
+    let sws: [(Icon, bool, &str, bool); 8] = [
+        (Icon::Shy, sw.shy, "shy", switch_applies(layer, "shy", &app.session.project)),
+        (Icon::Collapse, sw.collapse, "collapse", switch_applies(layer, "collapse", &app.session.project)),
+        (Icon::Quality, sw.quality == effectcraft_engine::project::Quality::Best, "quality", switch_applies(layer, "quality", &app.session.project)),
+        (Icon::Fx, sw.effects, "fx", switch_applies(layer, "fx", &app.session.project)),
+        (
+            Icon::FrameBlend,
+            sw.frame_blend != effectcraft_engine::project::FrameBlend::Off,
+            "frameBlend",
+            switch_applies(layer, "frameBlend", &app.session.project),
+        ),
+        (Icon::MotionBlur, sw.motion_blur, "motionBlur", switch_applies(layer, "motionBlur", &app.session.project)),
+        (Icon::Adjustment, sw.adjustment, "adjustment", switch_applies(layer, "adjustment", &app.session.project)),
+        (Icon::Cube, layer.is_3d(), "threeD", switch_applies(layer, "threeD", &app.session.project)),
+    ];
+    for (i, (icon, on, name, applicable)) in sws.into_iter().enumerate() {
+        if !applicable || !vis.switches {
+            continue;
+        }
+        let br = Rect::from_center_size(pos2(cw.switches + SW * i as f32 + SW / 2.0, cy), vec2(16.0, 16.0));
+        lp.rect_filled(br.shrink(1.0), 1.0, t.switch_well);
+        layer_switch(
+            ui,
+            &t,
+            &SwitchSpec { row: r, br, icon, on, id: egui::Id::unique(("sw", layer.id.0, i)), layer: layer.id.0, name, others: false },
+            &comp,
+            &app.session.project,
+            selected,
+            &mut *actions,
+        );
+        app.auto.add(&format!("timeline.layer.{}.switch.{name}", layer.id.0), br, name);
+    }
+}
+
+/// The blend mode dropdown and Preserve Transparency.
+fn layer_mode_cell(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let comp = g.tl.comp.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let mr = Rect::from_min_size(pos2(cw.mode + 2.0, cy - 9.0), vec2(80.0, 18.0));
+    let mresp = widgets::dropdown(ui, mr, layer.blend_mode.label(), &t, egui::Id::unique(("mode", layer.id.0)));
+    app.auto.add(&format!("timeline.layer.{}.mode", layer.id.0), mr, "Mode");
+    let pop = egui::Id::unique(("mode-pop", layer.id.0));
+    if mresp.clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    let opts: Vec<String> =
+        BlendMode::ALL.iter().flat_map(|m| if m.ends_group() { vec![m.label().to_string(), "-".to_string()] } else { vec![m.label().to_string()] }).collect();
+    if let Some(i) = widgets::popup_menu(ui, pop, mr.left_bottom(), &opts, opts.iter().position(|o| o == layer.blend_mode.label())) {
+        actions.push(("layer.setBlendMode".into(), json!({"layers": video_targets(&comp, layer.id, selected), "mode": opts[i]})));
+    }
+    let tr = Rect::from_center_size(pos2(cw.mode + 76.0 + 6.0, cy), vec2(14.0, 14.0));
+    app.auto.add(&format!("timeline.layer.{}.preserveTransparency", layer.id.0), tr, "Preserve Transparency");
+    let pt = widgets::checkbox(ui, tr, layer.preserve_transparency, &t, egui::Id::unique(("pt", layer.id.0)));
+    let pt = match switch_tip("preserveTransparency") {
+        Some(tip) => pt.on_hover_text(crate::i18n::tr(tip)),
+        None => pt,
+    };
+    if pt.changed() {
+        // The click gives the selection the state the clicked row toggles to,
+        // whatever the first selected layer's value (as the switches do).
+        actions.push((
+            "layer.setSwitch".into(),
+            json!({
+                "layers": video_targets(&comp, layer.id, selected),
+                "switch": "preserveTransparency",
+                "value": !layer.preserve_transparency
+            }),
+        ));
+    }
+}
+
+/// The track matte picker.
+fn layer_matte_cell(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let comp = g.tl.comp.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    // Track matte: a pick whip, then the layer picker with the mode. Like the parent, they set
+    // the matte of every selected layer when the row is selected (#1260).
+    pick_whip(
+        app,
+        ui,
+        &lp,
+        Rect::from_center_size(pos2(cw.trkmat + 9.0, cy), vec2(15.0, 15.0)),
+        (WHIP_MATTE, layer.id.0, 0),
+        WhipText {
+            auto: &format!("timeline.layer.{}.trackMattePickWhip", layer.id.0),
+            label: "Track Matte pick whip",
+            hint: crate::i18n::tr("Track Matte pick whip: drag onto a layer"),
+        },
+    );
+    let mr = Rect::from_min_size(pos2(cw.trkmat + 20.0, cy - 9.0), vec2(88.0, 18.0));
+    let label = match layer.track_matte {
+        Some(m) => comp.layer(m.layer).map(|l| format!("{} {}", comp.index_of(l.id).unwrap_or(0), l.name)).unwrap_or("None".into()),
+        None => "No Track Matte".into(),
+    };
+    // The cell is too narrow for the mode as well: it is in the tooltip and ticked in the menu.
+    let tip = layer.track_matte.map(|m| format!("{label} · {}", crate::i18n::tr(m.kind.label())));
+    let tresp = widgets::dropdown_tip(ui, mr, &label, tip.as_deref(), &t, egui::Id::unique(("trkmat", layer.id.0)));
+    app.auto.add(&format!("timeline.layer.{}.trackMatte", layer.id.0), mr, "Track Matte");
+    let pop = egui::Id::unique(("trk-pop", layer.id.0));
+    if tresp.clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    // The menu lists every layer: built only while it is open (per visible row
+    // it made a big comp's timeline quadratic).
+    let mut opts = vec!["No Track Matte".to_string(), "-".to_string()];
+    let mut candidates: Vec<&Layer> = vec![];
+    if widgets::popup_is_open(ui, pop) {
+        for (i, l) in comp.layers.iter().enumerate().filter(|(_, l)| l.id != layer.id && l.source.is_av()) {
+            opts.push(format!("{}. {}", i + 1, l.name));
+            candidates.push(l);
+        }
+        opts.push("-".into());
+        for k in MatteKind::ALL {
+            opts.push(k.label().into());
+        }
+    }
+    let current = layer.track_matte.and_then(|m| opts.iter().position(|o| o == m.kind.label()));
+    if let Some(i) = widgets::popup_menu(ui, pop, mr.left_bottom(), &opts, current) {
+        let ids: Vec<LayerId> = candidates.iter().map(|l| l.id).collect();
+        if let Some(a) = opts.get(i).and_then(|o| track_matte_pick(&video_targets(&comp, layer.id, selected), &ids, i, o)) {
+            actions.push(a);
+        }
+    }
+    if layer.track_matte.is_some() {
+        let kr = Rect::from_center_size(pos2(mr.max.x - 26.0, cy), vec2(10.0, 10.0));
+        let _ = kr;
+    }
+}
+
+/// The parent pick whip and dropdown.
+fn layer_parent_cell(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let comp = g.tl.comp.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    pick_whip(
+        app,
+        ui,
+        &lp,
+        Rect::from_center_size(pos2(cw.parent + 9.0, cy), vec2(15.0, 15.0)),
+        (WHIP_PARENT, layer.id.0, 0),
+        WhipText {
+            auto: &format!("timeline.layer.{}.pickWhip", layer.id.0),
+            label: "Parent pick whip",
+            hint: crate::i18n::tr("Parent pick whip: drag onto a layer"),
+        },
+    );
+    let pr_rect = Rect::from_min_size(pos2(cw.parent + 20.0, cy - 9.0), vec2(94.0, 18.0));
+    let plabel = layer.parent.and_then(|p| comp.layer(p)).map(|l| format!("{}. {}", comp.index_of(l.id).unwrap_or(0), l.name)).unwrap_or_else(|| "None".into());
+    let presp = widgets::dropdown(ui, pr_rect, &plabel, &t, egui::Id::unique(("parent", layer.id.0)));
+    app.auto.add(&format!("timeline.layer.{}.parent", layer.id.0), pr_rect, "Parent");
+    let pop = egui::Id::unique(("par-pop", layer.id.0));
+    if presp.clicked() {
+        widgets::open_popup(ui, pop);
+    }
+    let mut cands: Vec<&Layer> = vec![];
+    let mut popts = vec!["None".to_string(), "-".to_string()];
+    if widgets::popup_is_open(ui, pop) {
+        for (i, l) in comp.layers.iter().enumerate().filter(|(_, l)| l.id != layer.id) {
+            popts.push(format!("{}. {}", i + 1, l.name));
+            cands.push(l);
+        }
+    }
+    if let Some(i) = widgets::popup_menu(ui, pop, pr_rect.left_bottom(), &popts, None) {
+        let par = cands.get(i.wrapping_sub(2)).map(|l| l.id.0);
+        // (The new parent itself, if selected, stays as it is.)
+        let layers: Vec<u64> = edited_layers(layer.id, selected).into_iter().filter(|l| Some(*l) != par).collect();
+        actions.push(("layer.setParent".into(), json!({"layers": layers, "parent": par})));
+    }
+}
+
+/// Paints the layer bar; returns it and its label colour.
+fn layer_bar_paint(g: &Rw, rc: &RowCtx<'_>) -> (Rect, Color32) {
+    let t = g.tl.t;
+    let tm = g.tl.tm;
+    let gp = g.gp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let is_sel = rc.is_sel;
+    let x_in = tm.x(layer.in_point.seconds());
+    let x_out = tm.x(layer.out_point.seconds());
+    let bar = Rect::from_min_max(pos2(x_in, r.min.y + 1.0), pos2(x_out, r.max.y - 1.0));
+    let lc = t.label(layer.label);
+    let fill = bar_color(lc, is_sel);
+    gp.rect_filled(bar, 0.0, fill);
+    if is_sel {
+        gp.rect_stroke(bar, 0.0, Stroke::new(1.0, Color32::from_white_alpha(90)), StrokeKind::Inside);
+    }
+    (bar, lc)
+}
+
+/// Dragging the source bar outside the in/out span slips the source.
+fn slip_source_handles(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, ghost: Rect, bar: Rect) {
+    let pps = g.tl.pps;
+    let fd = g.tl.fd;
+    let ctx = g.tl.ctx.clone();
+    let actions = &mut g.tl.actions;
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    // Dragging the source bar outside the in/out span slips the source.
+    for (side, gr) in [("l", Rect::from_min_max(ghost.min, pos2(bar.min.x, ghost.max.y))), ("r", Rect::from_min_max(pos2(bar.max.x, ghost.min.y), ghost.max))] {
+        if gr.width() < 2.0 {
+            continue;
+        }
+        let gresp =
+            ui.interact(gr, egui::Id::unique(("ghost", side, layer.id.0)), Sense::click_and_drag()).on_hover_text(crate::i18n::tr("Drag to slip the source"));
+        // Outside the bar it is empty track area: a plain click deselects.
+        if gresp.clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
+            actions.push(("layer.select".into(), json!({"layers": []})));
+        }
+        app.auto.add(&format!("timeline.layer.{}.source{}", layer.id.0, side), gr, "Slip");
+        if gresp.hovered() || gresp.dragged() {
+            ctx.set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
+        }
+        let acc_id = egui::Id::unique(("slip-acc", layer.id.0));
+        if gresp.dragged() {
+            let mut acc: f32 = ctx.data(|d| d.get_temp(acc_id).unwrap_or(0.0));
+            acc += gresp.drag_delta().x;
+            let frames = ((acc as f64 / pps) / fd).trunc() as i64;
+            if frames != 0 {
+                acc -= (frames as f64 * fd * pps) as f32;
+                actions.push(("layer.slip".into(), json!({"layers": [layer.id.0], "frames": frames, "merge": format!("slip-{}", layer.id.0)})));
+            }
+            ctx.data_mut(|d| d.insert_temp(acc_id, acc));
+        }
+        if gresp.drag_stopped() {
+            ctx.data_mut(|d| d.remove::<f32>(acc_id));
+            ui_actions.push(UiAct::EndMerge);
+        }
+    }
+}
+
+/// The source extent behind the bar (striped past its ends).
+fn layer_source_extent(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, bar: Rect, lc: Color32) {
+    let tm = g.tl.tm;
+    let gp = g.gp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    if let LayerSource::Footage { .. } | LayerSource::Comp { .. } = layer.source
+        && let Some(d) = layer.source.item().and_then(|i| app.session.project.item(i)).and_then(|i| i.duration())
+    {
+        let xs = tm.x(layer.start_time.seconds());
+        let xe = tm.x(layer.comp_time(d).seconds());
+        let ghost = Rect::from_min_max(pos2(xs.min(xe), r.min.y + 9.0), pos2(xs.max(xe), r.max.y - 9.0));
+        gp.rect_filled(ghost, 1.0, lc.gamma_multiply(0.18));
+        // The bar past the source's end (its last frame held) or before its start
+        // is striped, so the source's own span shows (#290). Time remapping
+        // decides what shows there itself.
+        if layer.props.get("timeRemap").is_none() {
+            for (side, part) in [
+                ("beforeSource", Rect::from_min_max(bar.min, pos2(ghost.min.x, bar.max.y))),
+                ("afterSource", Rect::from_min_max(pos2(ghost.max.x, bar.min.y), bar.max)),
+            ] {
+                if part.width() >= 1.0 {
+                    stripes(&gp, part, lc);
+                    app.auto.add(&format!("timeline.layer.{}.bar.{side}", layer.id.0), part, "Past the source");
+                }
+            }
+        }
+        slip_source_handles(app, ui, g, rc, ghost, bar);
+    }
+}
+
+/// The bar's move body and trim edges, click selection.
+fn layer_bar_hits(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, bar: Rect) -> BarResps {
+    let cid = g.tl.cid;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let rows = &g.tl.rows;
+    let actions = &mut g.tl.actions;
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let is_sel = rc.is_sel;
+    app.auto.add(&format!("timeline.layer.{}.bar", layer.id.0), bar, &layer.name);
+    // Interactions: move body, trim edges.
+    let (body_r, in_r, out_r) = trim_zones(bar);
+    let body = ui.interact(body_r, egui::Id::unique(("bar", layer.id.0)), Sense::click_and_drag());
+    let lin = ui.interact(in_r, egui::Id::unique(("bar-in", layer.id.0)), Sense::drag());
+    let lout = ui.interact(out_r, egui::Id::unique(("bar-out", layer.id.0)), Sense::drag());
+    app.auto.add(&format!("timeline.layer.{}.bar.in", layer.id.0), in_r, "Trim In");
+    app.auto.add(&format!("timeline.layer.{}.bar.out", layer.id.0), out_r, "Trim Out");
+    if lin.hovered() || lout.hovered() || lin.dragged() || lout.dragged() {
+        trim_cursor(&ctx);
+    }
+    if body.double_clicked()
+        && let Some(a) = double_click_action(layer)
+    {
+        actions.push(a);
+    }
+    let shift = ui.input(|i| i.modifiers.shift);
+    if let Some(layers) = (body.clicked() && shift).then(|| shift_range(&ctx, cid, &comp, rows, selected, layer.id)).flatten() {
+        // Shift-click: the layers from the last one clicked to this one, as in
+        // the layer outline.
+        actions.push(("layer.select".into(), json!({"layers": layers})));
+    } else {
+        if (body.clicked() || body.drag_started()) && !is_sel {
+            actions.push(("layer.select".into(), json!({"layers": [layer.id.0], "add": shift})));
+        }
+        if (body.clicked() || body.drag_started()) && !shift {
+            set_anchor(&ctx, cid, layer.id);
+        }
+    }
+    layer_context_menu(&body, &comp, layer, selected, LayerMenuCaps::of(&app.session.project, layer), &mut app.auto, &mut *actions);
+    BarResps { body, lin, lout }
+}
+
+fn layer_quick_offset_begin(ui: &mut egui::Ui, g: &Rw, rc: &RowCtx<'_>, body: &egui::Response) -> bool {
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let selected = &g.selected;
+    let layer = rc.layer;
+    let is_sel = rc.is_sel;
+    let mods = ui.input(|i| i.modifiers);
+    if body.drag_started()
+        && is_sel
+        && mods.command
+        && mods.alt
+        && let Some(n) = quick_offset_layers(&comp, selected.iter().copied())
+        && let Some(p) = ctx.input(|i| i.pointer.press_origin())
+    {
+        ctx.data_mut(|d| d.insert_temp(quick_bar_id(), QuickBar { layer: layer.id, origin_x: p.x, layers: n, applied: 0 }));
+    }
+    ctx.data(|d| d.get_temp::<QuickBar>(quick_bar_id())).is_some_and(|q| q.layer == layer.id)
+}
+
+/// Moving and trimming a layer bar by whole frames.
+fn layer_bar_drag(g: &mut Rw, rc: &RowCtx<'_>, bars: &BarResps, quick: bool) {
+    let BarResps { body, lin, lout } = bars;
+    let pps = g.tl.pps;
+    let fd = g.tl.fd;
+    let ctx = g.tl.ctx.clone();
+    let actions = &mut g.tl.actions;
+    let selected = &g.selected;
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let drag_key = format!("bar-{}", layer.id.0);
+    for (resp, kind) in [(&body, "move"), (&lin, "in"), (&lout, "out")] {
+        if kind == "move" && quick {
+            continue;
+        }
+        if resp.dragged() {
+            let acc_id = egui::Id::unique(("bar-acc", layer.id.0, kind));
+            let mut acc: f32 = ctx.data(|d| d.get_temp(acc_id).unwrap_or(0.0));
+            acc += resp.drag_delta().x;
+            let frames = ((acc as f64 / pps) / fd).trunc() as i64;
+            if frames != 0 {
+                acc -= (frames as f64 * fd * pps) as f32;
+                let d = frames as f64 * fd;
+                // Moving or trimming a selected layer acts on the whole
+                // selection; each layer trims from its own in/out point.
+                let targets = json!(edited_layers(layer.id, selected));
+                let params = match kind {
+                    "move" => json!({"layers": targets, "delta": d, "merge": drag_key}),
+                    "in" => json!({"layers": targets, "inDelta": d, "merge": drag_key}),
+                    _ => json!({"layers": targets, "outDelta": d, "merge": drag_key}),
+                };
+                actions.push(("layer.timing".into(), params));
+            }
+            ctx.data_mut(|d| d.insert_temp(acc_id, acc));
+        }
+        if resp.drag_stopped() {
+            ctx.data_mut(|d| d.remove::<f32>(egui::Id::unique(("bar-acc", layer.id.0, kind))));
+            ui_actions.push(UiAct::EndMerge);
+        }
+    }
+}
+
+fn layer_bar_markers(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Rw, rc: &RowCtx<'_>) {
+    let graph_x0 = g.tl.graph_x0;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let comp = g.tl.comp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let gclip = rows_rect.intersect(Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max));
+    super::markers_ui::layer_markers(app, ui, gclip, &comp, layer, tm, r);
+}
+
+/// The group row's background and effect label bar; returns the name to draw.
+fn group_background(app: &mut EffectcraftApp, g: &Rw, rc: &RowCtx<'_>) -> String {
+    let t = g.tl.t;
+    let graph_x0 = g.tl.graph_x0;
+    let lp = g.lp.clone();
+    let gp = g.gp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let left = rc.left;
+    let ri = rc.ri;
+    let RowKind::Group { uid, name, .. } = &rc.row.kind else { return String::new() };
+    let group = layer.props.find_group(*uid);
+    let shown = match group.and_then(|g| match &g.kind {
+        GroupKind::Effect { effect } => Some(effect.as_str()),
+        _ => None,
+    }) {
+        Some(effect) => crate::i18n::effects::group(effect, name),
+        None => name.clone(),
+    };
+    // Selected groups (an effect, a mask, a shape group…) highlight like selected
+    // property rows.
+    let sel_group = app.session.state.selected_props.contains(&(layer.id, *uid));
+    lp.rect_filled(
+        left,
+        0.0,
+        if sel_group {
+            t.row_selected
+        } else if ri.is_multiple_of(2) {
+            t.row
+        } else {
+            t.row_alt
+        },
+    );
+    gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, t.tl_bg);
+    // An effect's colour label (26.5): the same bar the Effect Controls header wears,
+    // on the row's left edge.
+    if let Some(lab) =
+        group.filter(|g| matches!(g.kind, GroupKind::Effect { .. })).and_then(|g| g.label).filter(|l| *l != effectcraft_engine::color::Label::None)
+    {
+        let [lr, lg, lb] = app.session.prefs.label_rgb(lab);
+        let bar = Rect::from_min_size(left.min, vec2(4.0, left.height()));
+        lp.rect_filled(bar, 0.0, Color32::from_rgb(lr, lg, lb));
+        app.auto.add(&format!("timeline.group.{uid}.label"), bar, &app.session.prefs.label_name(lab));
+    }
+    shown
+}
+
+/// The group's twirl, effect switch and style eye.
+fn group_switches(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let indent = rc.indent;
+    let RowKind::Group { uid, name, open, has_children, fx, eye, .. } = &rc.row.kind else { return };
+    if *has_children {
+        let tw = Rect::from_center_size(pos2(indent, cy), vec2(13.0, 13.0));
+        if widgets::twirl(ui, tw, *open, egui::Id::unique(("gtw", uid)), &t).clicked() {
+            // Alt/Cmd-click twirls the whole tree under the group (as on a layer).
+            ui_actions.push(UiAct::ToggleGroup(layer.id.0, *uid, ui.input(|i| i.modifiers.alt || i.modifiers.command)));
+        }
+        app.auto.add(&format!("timeline.group.{uid}.twirl"), tw, name);
+    }
+    if let Some(en) = fx {
+        let fr_ = Rect::from_center_size(pos2(cw.switches + SW * 3.0 + SW / 2.0, cy), vec2(16.0, 16.0));
+        if widgets::icon_toggle(ui, fr_, Icon::Fx, *en, &t, egui::Id::unique(("gfx", uid)), Sense::click()).clicked() {
+            actions.push(("effect.toggle".into(), json!({"layer": layer.id.0, "effect": uid})));
+        }
+        app.auto.add(&format!("timeline.group.{uid}.fx"), fr_, name);
+    }
+    if let Some(en) = eye {
+        // A layer style's or shape item's eye switch in the A/V column, like AE.
+        let er = Rect::from_center_size(pos2(cw.av + 10.0, cy), vec2(15.0, 15.0));
+        lp.rect_stroke(er.shrink(1.5), 2.0, Stroke::new(1.0, t.separator), StrokeKind::Inside);
+        if widgets::icon_toggle(ui, er, Icon::Eye, *en, &t, egui::Id::unique(("geye", uid)), Sense::click()).clicked() {
+            let style = layer.props.sub(effectcraft_engine::project::styles::GROUP).is_some_and(|s| s.find_group(*uid).is_some());
+            actions.push(if style {
+                ("layer.style.toggle".into(), json!({"layer": layer.id.0, "style": uid}))
+            } else {
+                ("prop.setGroupEnabled".into(), json!({"layer": layer.id.0, "prop": uid, "value": !*en}))
+            });
+        }
+        app.auto.add(&format!("timeline.group.{uid}.eye"), er, name);
+    }
+}
+
+/// The group name, or its rename field.
+fn group_name(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, shown: &str) {
+    let t = g.tl.t;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    let indent = rc.indent;
+    let RowKind::Group { uid, name, .. } = &rc.row.kind else { return };
+    let group_edit: Option<(u64, u64, String)> = ctx.data(|d| d.get_temp(group_rename_id()));
+    if let Some((_, _, mut buf)) = group_edit.filter(|(rl, ru, _)| *rl == layer.id.0 && ru == uid) {
+        let field = Rect::from_min_max(pos2(indent + 8.0, r.min.y + 2.0), pos2((cw.switches - 4.0).max(indent + 60.0), r.max.y - 2.0));
+        let mut child = ui.new_child(egui::UiBuilder::new().max_rect(field));
+        let er = child.add(egui::TextEdit::singleline(&mut buf).font(Tokens::ui(12.0)).desired_width(field.width()));
+        app.auto.add(&format!("timeline.group.{uid}.nameEdit"), er.rect, &buf);
+        if ctx.data_mut(|d| d.remove_temp::<bool>(rename_focus_id())).unwrap_or(false) {
+            er.request_focus();
+            widgets::select_all(&ctx, er.id, &buf);
+        }
+        if er.lost_focus() {
+            if !ui.input(|i| i.key_pressed(egui::Key::Escape)) && !buf.trim().is_empty() && buf != *name {
+                actions.push(("prop.renameGroup".into(), json!({"layer": layer.id.0, "prop": uid, "name": buf})));
+            }
+            ctx.data_mut(|d| d.remove::<(u64, u64, String)>(group_rename_id()));
+        } else {
+            ctx.data_mut(|d| d.insert_temp(group_rename_id(), (layer.id.0, *uid, buf)));
+        }
+    } else {
+        lp.text(pos2(indent + 10.0, cy), Align2::LEFT_CENTER, shown, Tokens::ui(12.0), t.text);
+    }
+}
+
+/// Add / animate popups, Change Renderer and dash buttons.
+fn group_popups(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let RowKind::Group { uid, .. } = &rc.row.kind else { return };
+    text_anim_popups(app, ui, &lp, layer, *uid, pos2(cw.switches, cy), &mut *actions);
+    shape_add_popup(app, ui, &lp, layer, *uid, pos2(cw.switches, cy), &mut *actions);
+    if *uid == GEOM_BIT | layer.id.0 {
+        let lr = lp.text(pos2(cw.switches + 6.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Change Renderer…"), Tokens::ui(11.5), t.accent);
+        let resp = ui
+            .interact(lr, egui::Id::unique(("tl-change-renderer", layer.id.0)), Sense::click())
+            .on_hover_text(crate::i18n::tr("Composition Settings ▸ 3D Renderer"));
+        if resp.hovered() {
+            ctx.set_cursor_icon(egui::CursorIcon::PointingHand);
+        }
+        app.auto.add(&format!("timeline.layer.{}.changeRenderer", layer.id.0), lr, "Change Renderer…");
+        if resp.clicked() {
+            ui_actions.push(UiAct::ChangeRenderer);
+        }
+    }
+    dash_buttons(app, ui, &lp, layer, *uid, pos2(cw.switches, cy), &mut *actions);
+}
+
+/// Mask mode and inverted, inline.
+fn group_mask_mode(ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let RowKind::Group { uid, .. } = &rc.row.kind else { return };
+    // Mask mode + inverted inline.
+    if let Some(g) = layer.props.find_group(*uid)
+        && let GroupKind::Mask { mode, inverted, .. } = g.kind
+    {
+        let mr = Rect::from_min_size(pos2(cw.switches + 4.0, cy - 9.0), vec2(80.0, 18.0));
+        let pop = egui::Id::unique(("maskmode", uid));
+        if widgets::dropdown(ui, mr, mode.label(), &t, egui::Id::unique(("mm", uid))).clicked() {
+            widgets::open_popup(ui, pop);
+        }
+        let opts: Vec<String> = effectcraft_engine::project::MaskMode::ALL.iter().map(|m| m.label().to_string()).collect();
+        if let Some(i) = widgets::popup_menu(ui, pop, mr.left_bottom(), &opts, None) {
+            actions.push(("layer.setMask".into(), json!({"layer": layer.id.0, "mask": uid, "mode": opts[i]})));
+        }
+        let ir = Rect::from_min_size(pos2(mr.max.x + 8.0, cy - 8.0), vec2(16.0, 16.0));
+        if widgets::checkbox(ui, ir, inverted, &t, egui::Id::unique(("minv", uid))).changed() {
+            actions.push(("layer.setMask".into(), json!({"layer": layer.id.0, "mask": uid, "inverted": !inverted})));
+        }
+        lp.text(pos2(ir.max.x + 4.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Inverted"), Tokens::ui(11.0), t.text_dim);
+    }
+}
+
+/// Group row click and double-click.
+fn group_row_click(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>) {
+    let cid = g.tl.cid;
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let r = rc.r;
+    let indent = rc.indent;
+    let RowKind::Group { uid, name, fx, .. } = &rc.row.kind else { return };
+    let gr_rect = Rect::from_min_max(pos2(indent + 8.0, r.min.y), pos2(cw.switches, r.max.y));
+    // Effects, masks, shape items and animators drag to a new place among their siblings.
+    let movable = !layer.switches.locked && layer.props.find_group(*uid).is_some_and(PropGroup::is_instance);
+    let gr = ui.interact(gr_rect, egui::Id::unique(("grow", uid)), if movable { Sense::click_and_drag() } else { Sense::click() });
+    if movable && gr.drag_started_by(egui::PointerButton::Primary) {
+        ui.ctx().data_mut(|d| d.insert_temp(group_drag_id(), GroupDrag { comp: cid, owner: gr.id, layer: layer.id, uid: *uid }));
+    }
+    app.auto.add(&format!("timeline.group.{uid}.name"), gr_rect, name);
+    if gr.clicked() && uid & (WAVE_BIT | GEOM_BIT) == 0 {
+        // Shift or Cmd/Ctrl adds the group to the selection, or takes a selected one out, as
+        // property rows and Effect Controls headers do (#2552: several effects and styles for
+        // one animation preset).
+        let add = ui.input(|i| i.modifiers.shift || i.modifiers.command);
+        if add && app.session.state.selected_props.contains(&(layer.id, *uid)) {
+            actions.push(("prop.deselect".into(), json!({"layer": layer.id.0, "prop": uid})));
+        } else {
+            actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "selectKeys": false, "add": add})));
+        }
+    }
+    if gr.double_clicked() {
+        if fx.is_some() {
+            // An effect's name: open it in Effect Controls (as in After Effects).
+            actions.push(("layer.select".into(), json!({"layers": [layer.id.0]})));
+            actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "selectKeys": false})));
+            actions.push(("window.panel".into(), json!({"panel": "EffectControls"})));
+        } else {
+            ui_actions.push(UiAct::ToggleGroup(layer.id.0, *uid, false));
+        }
+    }
+}
+
+fn waveform_row(app: &mut EffectcraftApp, g: &Rw, rc: &RowCtx<'_>) {
+    let t = g.tl.t;
+    let graph_x0 = g.tl.graph_x0;
+    let tm = g.tl.tm;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let lp = g.lp.clone();
+    let gp = g.gp.clone();
+    let row = rc.row;
+    let layer = rc.layer;
+    let r = rc.r;
+    let left = rc.left;
+    let cy = rc.cy;
+    let ri = rc.ri;
+    let RowKind::Waveform { item, .. } = &rc.row.kind else { return };
+    lp.rect_filled(left, 0.0, if ri.is_multiple_of(2) { t.row } else { t.row_alt });
+    let indent = cw.name + 6.0 + 14.0 * row.depth as f32;
+    lp.text(pos2(indent + 10.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Waveform"), Tokens::ui(12.0), t.text);
+    let wr = Rect::from_min_max(pos2(graph_x0, r.min.y), r.max);
+    gp.rect_filled(wr, 0.0, t.tl_bg);
+    app.auto.add(&format!("timeline.layer.{}.waveform", layer.id.0), wr, "Waveform");
+    match super::waveform::summary(app, &ctx, ItemId(*item)) {
+        Some(s) => super::waveform::draw(&gp, wr.shrink2(vec2(0.0, 2.0)), &tm, layer, &s, Color32::from_rgb(0x5f, 0xc8, 0x8a)),
+        None => {
+            gp.text(
+                pos2(tm.x(layer.in_point.seconds()).max(wr.min.x) + 6.0, wr.center().y),
+                Align2::LEFT_CENTER,
+                crate::i18n::tr("Building waveform…"),
+                Tokens::ui(11.0),
+                t.text_faint,
+            );
+        }
+    }
+}
+
+/// The expression row's outline side: enable, pick whip and syntax warning.
+fn expr_controls(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, st: &ExprRow<'_>) {
+    let ExprRow { prop, ex, buf_id, edit_id, .. } = *st;
+    let t = g.tl.t;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let row = rc.row;
+    let layer = rc.layer;
+    let left = rc.left;
+    let cy = rc.cy;
+    let ri = rc.ri;
+    let RowKind::Expr { uid, .. } = &rc.row.kind else { return };
+    let sel_prop = app.session.state.selected_props.contains(&(layer.id, *uid));
+    lp.rect_filled(
+        left,
+        0.0,
+        if sel_prop {
+            t.row_selected
+        } else if ri.is_multiple_of(2) {
+            t.row
+        } else {
+            t.row_alt
+        },
+    );
+    let indent = cw.name + 6.0 + 14.0 * row.depth as f32;
+    lp.text(pos2(indent + 12.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Expression:"), Tokens::ui(11.5), t.text_dim);
+    lp.text(pos2(indent + 82.0, cy), Align2::LEFT_CENTER, &prop.name, Tokens::ui(11.5), t.text);
+    // "=" enable switch and the property pick whip (AE's expression controls).
+    let en_r = Rect::from_center_size(pos2(cw.switches + 10.0, cy), vec2(16.0, 16.0));
+    let en = ui.interact(en_r, egui::Id::unique(("expr-en", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Enable Expression"));
+    lp.rect_stroke(en_r.shrink(1.0), 2.0, Stroke::new(1.0, t.separator), StrokeKind::Inside);
+    let expr_col = t.expr_text;
+    lp.text(en_r.center(), Align2::CENTER_CENTER, if ex.enabled { "=" } else { "≠" }, Tokens::semibold(13.0), if ex.enabled { expr_col } else { t.text_dim });
+    app.auto.add(&format!("timeline.prop.{uid}.exprEnable"), en_r, "Enable Expression");
+    if en.clicked() {
+        actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid, "enabled": !ex.enabled})));
+    }
+    let pw = pick_whip(
+        app,
+        ui,
+        &lp,
+        Rect::from_center_size(pos2(cw.switches + 30.0, cy), vec2(15.0, 15.0)),
+        (WHIP_EXPR, layer.id.0, *uid),
+        WhipText {
+            auto: &format!("timeline.prop.{uid}.pickWhip"),
+            label: "Expression pick whip",
+            hint: crate::i18n::tr("Expression pick whip: drag onto a property"),
+        },
+    );
+    if pw.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_pressed()) {
+        // Pressed while the expression is being edited (its text is buffered while
+        // the editor has the focus): the reference will go in at the cursor,
+        // replacing the selection (#284).
+        let into = ctx.data(|d| d.get_temp::<String>(buf_id)).map(|buf| {
+            let n = buf.chars().count();
+            let sel = egui::text_edit::TextEditState::load(&ctx, edit_id)
+                .and_then(|st| st.cursor.char_range())
+                .map_or([n, n], |r| [r.primary.index.0.min(r.secondary.index.0).min(n), r.primary.index.0.max(r.secondary.index.0).min(n)]);
+            (buf, sel)
+        });
+        ctx.data_mut(|d| {
+            if let Some(into) = into {
+                d.insert_temp(whip_into_id(*uid), into);
+            } else {
+                d.remove::<WhipInto>(whip_into_id(*uid));
+            }
+        });
+    }
+    // Syntax errors: warning in the outline (the expression is disabled).
+    if let Some(check) = app.session.expr_check
+        && let Err(e) = check(&ex.text)
+    {
+        let wr = Rect::from_center_size(pos2(cw.switches + 50.0, cy), vec2(14.0, 14.0));
+        lp.text(wr.center(), Align2::CENTER_CENTER, "⚠", Tokens::ui(12.0), Color32::from_rgb(0xf0, 0xa0, 0x30));
+        let _ = ui.interact(wr, egui::Id::unique(("expr-err", uid)), Sense::hover()).on_hover_text(e);
+    }
+}
+
+/// The Expression Language menu inserts at the cursor.
+fn expr_language_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, st: &ExprRow<'_>) {
+    let ExprRow { ex, buf_id, edit_id, .. } = *st;
+    let t = g.tl.t;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let RowKind::Expr { uid, .. } = &rc.row.kind else { return };
+    // ⓕ: the Expression Language menu inserts at the cursor.
+    let lang_r = Rect::from_center_size(pos2(cw.switches + 70.0, cy), vec2(16.0, 16.0));
+    let lang = ui.interact(lang_r, egui::Id::unique(("expr-lang", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Expression Language Menu"));
+    lp.circle_stroke(lang_r.center(), 6.5, Stroke::new(1.0, if lang.hovered() { t.text } else { t.text_dim }));
+    lp.text(lang_r.center(), Align2::CENTER_CENTER, "f", Tokens::semibold(10.0), if lang.hovered() { t.text } else { t.text_dim });
+    app.auto.add(&format!("timeline.prop.{uid}.exprLanguage"), lang_r, "Expression Language Menu");
+    let mut picked: Option<&'static str> = None;
+    egui::Popup::menu(&lang).style(crate::widgets::menu_style).show(|ui| {
+        for (cat, items) in effectcraft_engine::commands::expr_tools::language_menu() {
+            ui.menu_button(cat, |ui| {
+                widgets::menu_scroll(ui, false, |ui| {
+                    for (label, text) in items {
+                        if ui.button(label).clicked() {
+                            picked = Some(text);
+                            ui.close();
+                        }
+                    }
+                })
+            });
+        }
+    });
+    if let Some(text) = picked {
+        let cur: String = ctx.data(|d| d.get_temp(buf_id)).unwrap_or_else(|| ex.text.clone());
+        let at = egui::text_edit::TextEditState::load(&ctx, edit_id)
+            .and_then(|st| st.cursor.char_range())
+            .map(|r| r.primary.index.0)
+            .unwrap_or(cur.chars().count())
+            .min(cur.chars().count());
+        let byte = cur.char_indices().nth(at).map(|(b, _)| b).unwrap_or(cur.len());
+        let mut next = cur.clone();
+        next.insert_str(byte, text);
+        actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid, "expression": next})));
+        ctx.data_mut(|d| d.remove::<String>(buf_id));
+    }
+}
+
+/// The expression editor in the time-graph area.
+fn expr_editor_cell(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, st: &ExprRow<'_>) {
+    let ExprRow { prop, ex, buf_id, edit_id, .. } = *st;
+    let t = g.tl.t;
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let rh = g.tl.rh;
+    let ctx = g.tl.ctx.clone();
+    let actions = &mut g.tl.actions;
+    let right_clip = g.right_clip;
+    let gp = g.gp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let RowKind::Expr { uid, lines, .. } = &rc.row.kind else { return };
+    let expr_col = t.expr_text;
+    // The editor in the time-graph area.
+    ui.set_clip_rect(right_clip);
+    gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, t.expr_bg);
+    let er = Rect::from_min_max(pos2(graph_x0 + 8.0, r.min.y + 3.0), pos2(rect.max.x - 14.0, r.max.y - 3.0));
+    let mut buf: String = ctx.data(|d| d.get_temp(buf_id)).unwrap_or_else(|| ex.text.clone());
+    if let Some(f) = ctx.data(|d| d.get_temp::<ExprFocus>(expr_focus_id())).filter(|f| f.prop == *uid) {
+        // Asked for once (a pick whip put a reference in, or an Alt-click added the
+        // expression): editing starts in the expression as it is now.
+        ctx.data_mut(|d| d.remove::<ExprFocus>(expr_focus_id()));
+        buf = ex.text.clone();
+        let n = buf.chars().count();
+        let [a, b] = f.select.map(|before_end| egui::text::CCursor::new(n.saturating_sub(before_end)));
+        let mut st = egui::text_edit::TextEditState::load(&ctx, edit_id).unwrap_or_default();
+        st.cursor.set_char_range(Some(egui::text::CCursorRange::two(a, b)));
+        st.store(&ctx, edit_id);
+        ctx.memory_mut(|m| m.request_focus(edit_id));
+    }
+    // Settings ▸ Scripting & Expressions ▸ Expressions Editor.
+    let sp = app.session.prefs.scripting.clone();
+    let resp = super::expr_editor::editor(
+        ui,
+        edit_id,
+        &mut buf,
+        er,
+        super::expr_editor::EditorOpts { prefs: &sp, color: if ex.enabled { expr_col } else { t.text_dim }, rows: *lines },
+        &t,
+    );
+    app.auto.add(&format!("timeline.prop.{uid}.expression"), er, &prop.name);
+    // Its bottom edge drags to set its height in whole lines, as in After Effects.
+    let edge = Rect::from_min_max(pos2(er.min.x, r.max.y - 4.0), pos2(er.max.x, r.max.y));
+    let eresp = ui.interact(edge, egui::Id::unique(("expr-edge", uid)), Sense::drag());
+    app.auto.add(&format!("timeline.prop.{uid}.expressionHeight"), edge, "Expression field height");
+    if eresp.hovered() || eresp.dragged() {
+        ctx.set_cursor_icon(egui::CursorIcon::ResizeVertical);
+    }
+    if let Some(py) = eresp.interact_pointer_pos().filter(|_| eresp.dragged()).map(|p| p.y) {
+        let n = ((py - r.min.y) / rh).round().clamp(1.0, EXPR_MAX_LINES as f32);
+        app.ui.timeline.expr_lines.insert(*uid, n as usize);
+    }
+    let commit = resp.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter) && (i.modifiers.command || i.modifiers.ctrl));
+    if commit {
+        resp.surrender_focus();
+    }
+    if resp.has_focus() && !commit {
+        ctx.data_mut(|d| d.insert_temp(buf_id, buf));
+    } else {
+        if (resp.lost_focus() || commit) && buf.trim_end() != ex.text {
+            actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid, "expression": buf.trim_end()})));
+        }
+        ctx.data_mut(|d| d.remove::<String>(buf_id));
+    }
+}
+
+fn prop_background(app: &mut EffectcraftApp, g: &Rw, rc: &RowCtx<'_>, prop: &Property) {
+    let t = g.tl.t;
+    let graph_x0 = g.tl.graph_x0;
+    let lp = g.lp.clone();
+    let gp = g.gp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let left = rc.left;
+    let ri = rc.ri;
+    let uid = &prop.uid;
+
+    app.auto.add(&format!("timeline.prop.{uid}.row"), r, &prop.name);
+    let sel_prop = app.session.state.selected_props.contains(&(layer.id, *uid));
+    lp.rect_filled(
+        left,
+        0.0,
+        if sel_prop {
+            t.row_selected
+        } else if ri.is_multiple_of(2) {
+            t.row
+        } else {
+            t.row_alt
+        },
+    );
+    gp.rect_filled(Rect::from_min_max(pos2(graph_x0, r.min.y), r.max), 0.0, t.tl_bg);
+}
+
+/// The keyframe navigator (previous, toggle, next).
+fn prop_key_navigator(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, prop: &Property) {
+    let t = g.tl.t;
+    let time = g.tl.time;
+    let fr = g.tl.fr;
+    let vis = g.tl.vis;
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let uid = &prop.uid;
+
+    // Keyframe navigator (in the A/V column, like AE).
+    // (in the Keys column when it is shown).
+    if prop.is_animated() && (vis.keys || vis.av) {
+        let lt = layer.layer_time(time);
+        let at_key = effectcraft_engine::keyframe::key_at(&prop.keys, lt).is_some();
+        let nav_x = if vis.keys { cw.keys + 12.0 } else { cw.av + 18.0 };
+        let prev = Rect::from_center_size(pos2(nav_x, cy), vec2(12.0, 14.0));
+        let mid = Rect::from_center_size(pos2(nav_x + 16.0, cy), vec2(14.0, 14.0));
+        let next = Rect::from_center_size(pos2(nav_x + 32.0, cy), vec2(12.0, 14.0));
+        icons::paint(&lp, prev.shrink(2.0), Icon::ChevronLeft, t.text_dim);
+        icons::paint(&lp, next.shrink(2.0), Icon::ChevronRight, t.text_dim);
+        let kc = if at_key { t.keyframe_selected } else { Color32::TRANSPARENT };
+        lp.add(egui::Shape::convex_polygon(
+            vec![mid.center() + vec2(0.0, -5.0), mid.center() + vec2(5.0, 0.0), mid.center() + vec2(0.0, 5.0), mid.center() + vec2(-5.0, 0.0)],
+            kc,
+            Stroke::new(1.0, t.text_dim),
+        ));
+        if ui.interact(prev, egui::Id::unique(("kprev", uid)), Sense::click()).clicked()
+            && let Some(k) = prop.keys.iter().rev().find(|k| layer.comp_time(k.time).0 < time.0 - fr.frame_duration().0 / 2)
+        {
+            ui_actions.push(UiAct::SetTime(layer.comp_time(k.time)));
+        }
+        if ui.interact(next, egui::Id::unique(("knext", uid)), Sense::click()).clicked()
+            && let Some(k) = prop.keys.iter().find(|k| layer.comp_time(k.time).0 > time.0 + fr.frame_duration().0 / 2)
+        {
+            ui_actions.push(UiAct::SetTime(layer.comp_time(k.time)));
+        }
+        if ui.interact(mid, egui::Id::unique(("kmid", uid)), Sense::click()).clicked() {
+            actions.push(("prop.toggleKey".into(), json!({"layer": layer.id.0, "prop": uid})));
+        }
+        app.auto.add(&format!("timeline.prop.{uid}.addKey"), mid, "Add or remove keyframe");
+    }
+}
+
+/// The stopwatch.
+fn prop_stopwatch(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, prop: &Property) {
+    let t = g.tl.t;
+    let ctx = g.tl.ctx.clone();
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    let indent = rc.indent;
+    let uid = &prop.uid;
+
+    // Stopwatch: Alt+click adds an expression; a press toggles the animation, and
+    // dragging on over other stopwatches gives them the same state (#284).
+    if !prop.static_only {
+        let swr = Rect::from_center_size(pos2(indent, cy), vec2(15.0, 15.0));
+        let resp = ui.interact(swr, egui::Id::unique(("stopwatch", uid)), Sense::click_and_drag());
+        let col = if prop.is_animated() {
+            t.hot_text
+        } else if resp.hovered() {
+            t.text
+        } else {
+            t.text_dim
+        };
+        icons::paint(&lp, swr, Icon::Stopwatch, col);
+        app.auto.add(&format!("timeline.prop.{uid}.stopwatch"), swr, &prop.name);
+        if ui.input(|i| i.modifiers.alt) {
+            if resp.clicked() {
+                actions.push(("prop.setExpression".into(), json!({"layer": layer.id.0, "prop": uid})));
+                if prop.expr.is_none() {
+                    // Adding one: its editor opens, comes into view and takes the
+                    // keyboard with the new expression selected (#1072).
+                    app.ui.timeline.expr_closed.remove(uid);
+                    focus_expression(&ctx, *uid, [usize::MAX, 0]);
+                } else if ctx.data(|d| d.get_temp::<ExprFocus>(expr_focus_id())).is_some_and(|f| f.prop == *uid) {
+                    // Removing it: nothing is left to take the keyboard.
+                    ctx.data_mut(|d| d.remove::<ExprFocus>(expr_focus_id()));
+                }
+            }
+        } else if let Some((value, merge)) = switch_gesture(ui, &resp, r, "stopwatch", prop.is_animated()) {
+            actions.push(("prop.toggleAnimation".into(), json!({"layer": layer.id.0, "prop": uid, "value": value, "merge": merge})));
+        } else if resp.clicked() && !resp.clicked_by(egui::PointerButton::Primary) {
+            // Keyboard or accessibility activation.
+            actions.push(("prop.toggleAnimation".into(), json!({"layer": layer.id.0, "prop": uid})));
+        }
+    }
+}
+
+/// The property name; returns its x.
+fn prop_name(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, prop: &Property) -> f32 {
+    let t = g.tl.t;
+    let cid = g.tl.cid;
+    let ctx = g.tl.ctx.clone();
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let layer = rc.layer;
+    let r = rc.r;
+    let cy = rc.cy;
+    let indent = rc.indent;
+    let uid = &prop.uid;
+
+    let name_x = indent + 12.0;
+    // 3D layers show Rotation as "Z Rotation" next to X/Y Rotation.
+    let is_tr_rot = layer.transform().and_then(|t| t.get("rotation")).is_some_and(|r| r.uid == prop.uid);
+    let base = if is_tr_rot && prop.name == "Rotation" && layer.is_3d() { "Z Rotation".to_string() } else { prop.name.clone() };
+    let pname = if prop.has_expression() { format!("{base}  =") } else { base };
+    lp.text(pos2(name_x, cy), Align2::LEFT_CENTER, &pname, Tokens::ui(12.0), if prop.has_expression() { t.expr_text } else { t.text });
+    let name_rect = Rect::from_min_max(pos2(name_x, r.min.y), pos2(cw.switches - 2.0, r.max.y));
+    let name_resp = ui.interact(name_rect, egui::Id::unique(("pname", uid)), Sense::click_and_drag());
+    app.auto.add(&format!("timeline.prop.{uid}.name"), name_rect, &prop.name);
+    if name_resp.drag_started() {
+        // Drop on the Essential Graphics panel to expose the property.
+        egui::DragAndDrop::set_payload(&ctx, crate::panels::DragPayload::Property { layer: layer.id.0, prop: *uid });
+    }
+    if name_resp.dragged() {
+        egui::Tooltip::always_open(ctx.clone(), ui.layer_id(), egui::Id::unique("prop-drag-tip"), egui::PopupAnchor::Pointer).show(|ui| ui.label(&prop.name));
+    }
+    if name_resp.clicked() {
+        actions.push(("prop.select".into(), json!({"layer": layer.id.0, "prop": uid, "add": ui.input(|i| i.modifiers.shift)})));
+    }
+    crate::widgets::context_menu(&name_resp, |ui| prop_menu(ui, &mut app.auto, cid, layer, prop, &mut *actions));
+    name_x
+}
+
+/// The value editors and the property pick whip.
+fn prop_value_cell(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, rc: &RowCtx<'_>, ectx: &EvalCtx<'_>, prop: &Property, name_x: f32) {
+    let vis = g.tl.vis;
+    let cw = &g.tl.cw;
+    let actions = &mut g.tl.actions;
+    let lp = g.lp.clone();
+    let dim_hits = &mut g.dim_hits;
+    let layer = rc.layer;
+    let cy = rc.cy;
+    let uid = &prop.uid;
+
+    let value = ectx.value(layer, prop);
+    let vx = (cw.switches + 4.0).max(name_x + 120.0);
+    let ve = ValueEdit::new(ui, &lp, layer, prop, pos2(vx, cy));
+    let dims = value_editor(app, ui, &ve, &value, &mut *actions);
+    if !dims.is_empty() {
+        dim_hits.push((*uid, dims));
+    }
+    // The property pick whip (Parent & Link column, AE CC 2018 and later): dropped on
+    // a property it links this one to it, adding the expression if there is none.
+    if vis.parent && !prop.static_only {
+        pick_whip(
+            app,
+            ui,
+            &lp,
+            Rect::from_center_size(pos2(cw.parent + 9.0, cy), vec2(15.0, 15.0)),
+            (WHIP_PROP, layer.id.0, *uid),
+            WhipText {
+                auto: &format!("timeline.prop.{uid}.propertyPickWhip"),
+                label: "Property pick whip",
+                hint: crate::i18n::tr("Property pick whip: drag onto a property"),
+            },
+        );
+    }
+}
+
+/// The one-line expression hint when its editor is closed.
+fn prop_expression_hint(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Rw, rc: &RowCtx<'_>, prop: &Property) {
+    let t = g.tl.t;
+    let graph_x0 = g.tl.graph_x0;
+    let right_clip = g.right_clip;
+    let gp = g.gp.clone();
+    let cy = rc.cy;
+    let uid = &prop.uid;
+
+    ui.set_clip_rect(right_clip);
+    // Expression text row hint.
+    if let Some(e) = prop.expr.as_ref().filter(|e| e.enabled && app.ui.timeline.expr_closed.contains(uid)) {
+        gp.text(pos2(graph_x0 + 8.0, cy), Align2::LEFT_CENTER, format!("= {}", e.text.lines().next().unwrap_or("")), Tokens::mono(11.0), t.expr_text);
+    }
+}
+
+/// Key click selection and interpolation shortcuts.
+fn key_select(g: &mut Rw, kh: &KeyHit<'_>) {
+    let KeyHit { k, ks, mods, ref kresp, ref this_key, .. } = *kh;
+    let actions = &mut g.tl.actions;
+    if kresp.clicked() && mods.command {
+        // Ctrl+click: Linear ↔ Auto Bezier; Ctrl+Alt+click: Hold on / off.
+        actions.push(("keys.select".into(), this_key.clone()));
+        if mods.alt {
+            actions.push(("keys.toggleHold".into(), json!({})));
+        } else {
+            let linear = k.in_interp == Interp::Linear && k.out_interp == Interp::Linear;
+            actions.push(("keys.interpolation".into(), json!({"interpolation": if linear { "autoBezier" } else { "linear" }})));
+        }
+    } else if kresp.clicked() && mods.shift {
+        // Shift+click: in or out of the selection.
+        let mut p = this_key.clone();
+        p["toggle"] = json!(true);
+        actions.push(("keys.select".into(), p));
+    } else if (kresp.clicked() || kresp.drag_started()) && !ks {
+        let mut p = this_key.clone();
+        p["add"] = json!(mods.shift);
+        actions.push(("keys.select".into(), p));
+    }
+}
+
+fn key_double_click(g: &mut Rw, rc: &RowCtx<'_>, prop: &Property, kh: &KeyHit<'_>) {
+    let KeyHit { k, ct, ref kresp, .. } = *kh;
+    let actions = &mut g.tl.actions;
+    let ui_actions = &mut g.ui_actions;
+    let layer = rc.layer;
+    let uid = &prop.uid;
+
+    if kresp.double_clicked() {
+        // Edit the key's value (numeric properties), as After Effects does.
+        if matches!(k.value, Value::Scalar(_) | Value::Vec2(_) | Value::Vec3(_)) {
+            actions.push(("keys.set".into(), json!({"layer": layer.id.0, "prop": uid, "time": k.time.seconds()})));
+        } else {
+            ui_actions.push(UiAct::SetTime(ct));
+        }
+    }
+}
+
+/// The keyframe right-click menu.
+fn key_context_menu(app: &mut EffectcraftApp, g: &mut Rw, rc: &RowCtx<'_>, prop: &Property, kh: &KeyHit<'_>) {
+    let KeyHit { k, ks, ref kresp, .. } = *kh;
+    let actions = &mut g.tl.actions;
+    let layer = rc.layer;
+    crate::widgets::context_menu(kresp, |ui| key_menu(ui, app, layer, prop, k, ks, actions));
+}
+
+/// The commands of a keyframe's right-click menu, for the Timeline and the Graph Editor alike. They act
+/// on the selected keys, so a menu opened on an unselected key selects it first. A locked layer's keys
+/// can still be copied and selected, but not edited.
+pub(crate) fn key_menu(
+    ui: &mut egui::Ui,
+    app: &EffectcraftApp,
+    layer: &Layer,
+    prop: &Property,
+    k: &effectcraft_engine::keyframe::Keyframe,
+    selected: bool,
+    actions: &mut Vec<(String, serde_json::Value)>,
+) {
+    let t = app.tokens;
+    let locked = layer.switches.locked;
+    let uid = &prop.uid;
+    let this_key = json!({"layer": layer.id.0, "prop": uid, "time": k.time.seconds()});
+    for (lbl, cmd, params) in [
+        ("Edit Value…", "keys.set", this_key.clone()),
+        ("-", "", json!({})),
+        ("Copy", "keys.copy", json!({})),
+        ("Paste", "keys.paste", json!({})),
+        ("-", "", json!({})),
+        ("Select Equal Keyframes", "keys.selectEqual", json!({})),
+        ("Select Previous Keyframes", "keys.selectPrevious", json!({})),
+        ("Select Following Keyframes", "keys.selectFollowing", json!({})),
+        ("-", "", json!({})),
+        ("Keyframe Interpolation…", "keys.interpolation", json!({})),
+        ("Keyframe Velocity…", "keys.velocity", json!({})),
+        ("Toggle Hold Keyframe", "keys.toggleHold", json!({})),
+        (if k.muted { "Unmute Keyframes" } else { "Mute Keyframes" }, "keys.setMuted", json!({"muted": !k.muted})),
+        ("Rove Across Time", "keys.interpolation", json!({"roving": !k.roving})),
+        ("-", "", json!({})),
+        ("Easy Ease", "keys.easyEase", json!({})),
+        ("Easy Ease In", "keys.easyEaseIn", json!({})),
+        ("Easy Ease Out", "keys.easyEaseOut", json!({})),
+        ("Time-Reverse Keyframes", "keys.timeReverse", json!({})),
+        ("-", "", json!({})),
+        ("Linear", "keys.interpolation", json!({"interpolation": "linear"})),
+        ("Bezier", "keys.interpolation", json!({"interpolation": "bezier"})),
+        ("Auto Bezier", "keys.interpolation", json!({"interpolation": "autoBezier"})),
+        ("Select All Keyframes", "keys.selectAll", json!({})),
+        ("Delete", "keys.delete", json!({})),
+    ] {
+        if lbl == "Select All Keyframes" {
+            // Keyframe colour labels.
+            ui.add_enabled_ui(!locked, |ui| {
+                ui.menu_button(crate::i18n::tr("Label"), |ui| {
+                    for (i, l) in effectcraft_engine::color::Label::ALL.into_iter().enumerate() {
+                        if widgets::label_entry(ui, l, &app.session.prefs.label_name(l), k.label as usize == i, &t).clicked() {
+                            if !selected {
+                                actions.push(("keys.select".into(), json!({"keys": [this_key.clone()]})));
+                            }
+                            actions.push(("keys.setLabel".into(), json!({"label": i})));
+                            ui.close();
+                        }
+                    }
+                });
+            });
+        }
+        if lbl == "-" {
+            ui.separator();
+            continue;
+        }
+        if lbl == "Rove Across Time" && !prop.spatial {
+            continue;
+        }
+        if lbl == "Edit Value…" && !matches!(k.value, Value::Scalar(_) | Value::Vec2(_) | Value::Vec3(_)) {
+            continue;
+        }
+        let edits = !matches!(cmd, "keys.copy" | "keys.selectEqual" | "keys.selectPrevious" | "keys.selectFollowing" | "keys.selectAll");
+        // An unselected key is selected before the command runs, and locked keys cannot be selected.
+        let unselectable = locked && !selected && cmd != "keys.selectAll";
+        if ui.add_enabled(!(unselectable || locked && edits), egui::Button::new(crate::i18n::context_item(cmd, &params, lbl))).clicked() {
+            if !selected {
+                actions.push(("keys.select".into(), json!({"keys": [this_key.clone()]})));
+            }
+            actions.push((cmd.into(), params));
+            ui.close();
+        }
+    }
+}
+
+/// Starts a key drag (or Alt-scale).
+fn key_drag_begin(app: &mut EffectcraftApp, g: &Rw, kh: &KeyHit<'_>) {
+    let KeyHit { ct, ks, mods, ref kresp, .. } = *kh;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let sel_keys = &g.sel_keys;
+    // Alt-drag the first or last key of a selected group: scale the group in time.
+    if kresp.drag_started()
+        && mods.alt
+        && !mods.command
+        && let Some(c) = app.session.active_comp_arc()
+    {
+        super::graph_tools::alt_scale_begin(app, &ctx, &c, ct.seconds());
+    }
+    // A plain drag moves the selected keys. The timeline follows it (below): this
+    // widget's id changes with the key's time, so its own drag would end after
+    // the first frame of movement.
+    // (From where the button went down: a drag starts a few pixels later.)
+    if kresp.drag_started()
+        && !super::graph_tools::alt_scale_active(&ctx)
+        && let Some(p) = ctx.input(|i| i.pointer.press_origin())
+    {
+        // Ctrl/Cmd+Alt: Quick Offset of the selected keys' layers (#1012).
+        let quick = (mods.command && mods.alt && ks).then(|| quick_offset_layers(&comp, sel_keys.iter().map(|k| k.layer))).flatten();
+        ctx.data_mut(|d| d.insert_temp(key_drag_id(), KeyDrag { origin_x: p.x, anchor: ct.seconds(), applied: 0, quick }));
+    }
+}
+
+/// The size of a keyframe glyph and the radius of a roving key's dot.
+const KEY_GLYPH_SIZE: f32 = 11.0;
+const ROVING_KEY_RADIUS: f32 = 2.5;
+
+/// The rect a key's marker covers on screen (its hit rect is larger).
+fn key_glyph_rect(k: &effectcraft_engine::keyframe::Keyframe, center: Pos2) -> Rect {
+    if k.roving {
+        Rect::from_center_size(center, Vec2::splat(ROVING_KEY_RADIUS * 2.0))
+    } else {
+        let icon = k.icon();
+        icons::keyframe_bounds(center, KEY_GLYPH_SIZE, icon.left, icon.right)
+    }
+}
+
+/// Paints one keyframe marker; returns its hit rect.
+fn key_paint(g: &Rw, rc: &RowCtx<'_>, k: &effectcraft_engine::keyframe::Keyframe, x: f32, ks: bool) -> Rect {
+    let t = g.tl.t;
+    let gp = g.gp.clone();
+    let cy = rc.cy;
+    let icon = k.icon();
+    let c = pos2(x, cy);
+    // Labelled keys take their label colour (brighter when selected).
+    let kcol = match effectcraft_engine::color::Label::ALL.get(k.label as usize).filter(|_| k.label > 0) {
+        Some(l) => {
+            let c = t.label(*l);
+            if ks { c } else { c.gamma_multiply(0.75) }
+        }
+        None if ks => t.keyframe_selected,
+        None => t.keyframe,
+    };
+    // Muted keys stay visible and editable but no longer drive the value.
+    let kcol = if k.muted { kcol.gamma_multiply(0.35) } else { kcol };
+    if k.roving {
+        // Roving keys: a small dot (their time follows their neighbours).
+        gp.circle_filled(c, ROVING_KEY_RADIUS, kcol);
+    } else {
+        icons::keyframe(&gp, c, KEY_GLYPH_SIZE, icon.left, icon.right, kcol);
+    }
+    Rect::from_center_size(c, vec2(12.0, 14.0))
+}
+
+/// The key's hit target and automation ids.
+fn key_hit(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    g: &Rw,
+    rc: &RowCtx<'_>,
+    prop: &Property,
+    k: &effectcraft_engine::keyframe::Keyframe,
+    kr: Rect,
+) -> egui::Response {
+    let fr = g.tl.fr;
+    let layer = rc.layer;
+    let uid = &prop.uid;
+    let ct = layer.comp_time(k.time);
+    let kresp = ui.interact(kr, egui::Id::unique(("key", uid, k.time.0)), Sense::click_and_drag());
+    app.auto.add(&format!("timeline.key.{uid}.{}", fr.frame_at(ct)), kr, &format!("{} key", prop.name));
+    // Exact (layer-time ticks): keys a Quick Offset puts on subframes can share a frame.
+    app.auto.add(&format!("timeline.keyAt.{uid}.{}", k.time.0), kr, &format!("{} key", prop.name));
+    kresp
+}
+
+/// Right-click menus on the empty outline and graph areas.
+fn background_menus(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw) {
+    let actions = &mut g.tl.actions;
+    let graph_on = g.graph_on;
+    let full_clip = g.full_clip;
+    let empty_rect = g.empty_rect;
+    let empty = g.empty.clone();
+    let outline_empty = g.outline_empty.clone();
+    ui.set_clip_rect(full_clip);
+    // The background responses sit below rows, bars and editors, preserving their menus.
+    if !graph_on {
+        app.auto.add("timeline.empty", empty_rect, "Right-click to create a layer");
+    }
+    for (response, area) in [(&outline_empty, "outline"), (&empty, "graph")] {
+        crate::widgets::context_menu(response, |ui| {
+            let menu = ui.menu_button(crate::i18n::tr("New"), |ui| {
+                for (key, label, command, params) in [
+                    ("text", "Text", "layer.newText", json!({})),
+                    ("solid", "Solid…", "layer.newSolid", json!({})),
+                    ("light", "Light…", "layer.newLight", json!({})),
+                    ("camera", "Camera…", "layer.newCamera", json!({})),
+                    ("null", "Null Object", "layer.newNull", json!({})),
+                    ("shape", "Shape Layer", "layer.newShape", json!({"kind": "none"})),
+                    ("adjustment", "Adjustment Layer", "layer.newAdjustment", json!({})),
+                ] {
+                    let response = ui.button(crate::i18n::context_item(command, &params, label));
+                    app.auto.add(&format!("timeline.context.{area}.{key}"), response.rect, label);
+                    if response.clicked() {
+                        actions.push((command.into(), params));
+                        ui.close();
+                    }
+                }
+            });
+            app.auto.add(&format!("timeline.context.{area}.new"), menu.response.rect, "New");
+            let response = ui.button(crate::i18n::tr("Composition Settings…"));
+            app.auto.add(&format!("timeline.context.{area}.settings"), response.rect, "Composition Settings…");
+            if response.clicked() {
+                actions.push(("comp.settings".into(), json!({})));
+                ui.close();
+            }
+            let response = ui.button(crate::i18n::tr("Open in Essential Graphics"));
+            app.auto.add(&format!("timeline.context.{area}.essentialGraphics"), response.rect, "Open in Essential Graphics");
+            if response.clicked() {
+                actions.push(("comp.openInEssentialGraphics".into(), json!({})));
+                ui.close();
+            }
+        });
+    }
+}
+
+/// Click on the empty outline (its drag is the Timeline's one box, [`box_select`]).
+fn outline_marquee(ui: &mut egui::Ui, g: &mut Rw) {
+    let actions = &mut g.tl.actions;
+    let outline_empty = g.outline_empty.clone();
+    if outline_empty.clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
+        actions.push(("layer.select".into(), json!({"layers": []})));
+    }
+    // Pick whips: a line follows the pointer; releasing over a row links to it (an expression's
+}
+
+/// A pick whip in flight: its line, the target and the link on release.
+fn pick_whip_drag(g: &mut Rw) {
+    let t = g.tl.t;
+    let graph_x0 = g.tl.graph_x0;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let actions = &mut g.tl.actions;
+    let hit_rows = &mut g.hit_rows;
+    let dim_hits = &mut g.dim_hits;
+    // or a property's, also over a property in Effect Controls).
+    if let Some((kind, src_layer, src_prop, start)) = ctx.data(|d| d.get_temp::<PickWhip>(pick_whip_id())) {
+        let ptr = ctx.input(|i| i.pointer.latest_pos()).unwrap_or(start);
+        let fg = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("tl-pickwhip-line")));
+        fg.line_segment([start, ptr], Stroke::new(1.5, t.accent));
+        fg.circle_stroke(ptr, 4.0, Stroke::new(1.5, t.accent));
+        let target = hit_rows.iter().find(|(r, _)| r.contains(ptr)).map(|(r, row)| (*r, row.clone()));
+        // Shown this pass or the last one (Effect Controls may draw after the Timeline).
+        let pass = ctx.cumulative_pass_nr();
+        let elsewhere = (target.is_none() && !matches!(kind, WHIP_PARENT | WHIP_MATTE))
+            .then(|| ctx.data(|d| d.get_temp::<WhipTargets>(whip_targets_id())))
+            .flatten()
+            .filter(|(p, _)| p.saturating_add(1) >= pass)
+            .and_then(|(_, targets)| targets.into_iter().find(|(r, ..)| r.contains(ptr)));
+        if let Some((tr, _)) = &target {
+            fg.rect_stroke(Rect::from_min_max(tr.min, pos2(graph_x0 - 1.0, tr.max.y)), 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
+        } else if let Some((tr, ..)) = &elsewhere {
+            fg.rect_stroke(*tr, 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
+        }
+        if ctx.input(|i| !i.pointer.any_down()) {
+            let whip_layers = ctx.data_mut(|d| {
+                d.remove::<PickWhip>(pick_whip_id());
+                d.remove::<WhipTargets>(whip_targets_id());
+                d.remove_temp::<Vec<u64>>(whip_layers_id())
+            });
+            // The layers a layer pick whip links, less the one it was dropped on.
+            let linked = |onto: u64| -> Vec<u64> { whip_layers.clone().unwrap_or_else(|| vec![src_layer]).into_iter().filter(|l| *l != onto).collect() };
+            let into = (kind == WHIP_EXPR).then(|| ctx.data_mut(|d| d.remove_temp::<WhipInto>(whip_into_id(src_prop)))).flatten();
+            // The property dropped on, and the value (dimension) if on one of them: `position[0]`.
+            let dim = |fields: &[Rect]| fields.iter().position(|r| r.contains(ptr));
+            let prop_target = match (&target, elsewhere) {
+                (Some((_, Row { layer, kind: RowKind::Prop { uid }, .. })), _) => {
+                    Some((layer.0, *uid, dim_hits.iter().find(|(u, _)| u == uid).and_then(|(_, rs)| dim(rs))))
+                }
+                (None, Some((_, l, u, fields))) => Some((l, u, dim(&fields))),
+                _ => None,
+            };
+            match (kind, target, prop_target) {
+                (WHIP_PARENT, Some((_, row)), _) if row.layer.0 != src_layer => {
+                    actions.push(("layer.setParent".into(), json!({"layers": linked(row.layer.0), "parent": row.layer.0})));
+                }
+                // Each layer keeps its own matte mode.
+                (WHIP_MATTE, Some((_, row)), _) if row.layer.0 != src_layer && comp.layer(row.layer).is_some_and(|l| l.source.is_av()) => {
+                    actions.push(("layer.setTrackMatte".into(), json!({"layers": linked(row.layer.0), "matte": row.layer.0, "kind": "preserve"})));
+                }
+                // The property pick whip replaces the expression with the reference (or adds one),
+                // as the expression pick whip does when its expression isn't being edited.
+                (WHIP_EXPR | WHIP_PROP, _, Some((tl, tu, d))) if tu != src_prop => {
+                    let mut params = json!({"layer": src_layer, "prop": src_prop, "target": {"layer": tl, "prop": tu}});
+                    if let Some(d) = d {
+                        params["target"]["dimension"] = json!(d);
+                    }
+                    // Alt held as it drops: an effect's properties by their index (#1072).
+                    if ctx.input(|i| i.modifiers.alt) {
+                        params["byIndex"] = json!(true);
+                    }
+                    if let Some((text, [a, b])) = into {
+                        // Into the expression being edited, which goes on being edited.
+                        params["expression"] = json!(text);
+                        params["range"] = json!([a, b]);
+                        let after = text.chars().count().saturating_sub(b);
+                        focus_expression(&ctx, src_prop, [after, after]);
+                    }
+                    actions.push(("prop.pickWhip".into(), params));
+                }
+                _ => {}
+            }
+        }
+    }
+    // Alt-drag key group scaling (follows the pointer until release).
+}
+
+fn alt_scale_and_graph(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw, ectx: &EvalCtx<'_>) {
+    let graph_x0 = g.tl.graph_x0;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let actions = &mut g.tl.actions;
+    let graph_on = g.graph_on;
+    let gp = g.gp.clone();
+    if let Some(c) = app.session.active_comp_arc() {
+        super::graph_tools::alt_scale_update(app, &ctx, &c, tm, &mut *actions);
+    }
+    // Graph editor.
+    if graph_on {
+        super::graph::show(
+            app,
+            ui,
+            &gp,
+            super::graph::GraphView { comp: &comp, ectx, tm },
+            Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max),
+            &mut *actions,
+        );
+    }
+    // A plain click on empty track area (beside a layer's bar, on a property row's empty span or
+    // below the last row) deselects the layers and their keys and properties, as in After
+}
+
+/// Click on empty track area (its drag is the Timeline's one box, [`box_select`]).
+fn graph_empty_area(ui: &mut egui::Ui, g: &mut Rw) {
+    let actions = &mut g.tl.actions;
+    let empty = g.empty.clone();
+    if empty.clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
+        actions.push(("layer.select".into(), json!({"layers": []})));
+    }
+}
+
+/// Layer reorder drag: a line where the layers land.
+fn layer_reorder_drag(ui: &mut egui::Ui, g: &mut Rw) {
+    let cid = g.tl.cid;
+    let t = g.tl.t;
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let rows_rect = g.tl.rows_rect;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let p = g.tl.p.clone();
+    let actions = &mut g.tl.actions;
+    let hit_rows = &mut g.hit_rows;
+    // The origin row can scroll out of view, so finish the gesture here, independently of
+    // its Response. Disabled UI, Escape or lost ownership cancels; only a primary release drops layers.
+    if let Some(drag) = ctx.data(|d| d.get_temp::<LayerDrag>(layer_drag_id())) {
+        let (down, released, escape) =
+            ctx.input(|i| (i.pointer.primary_down(), i.pointer.button_released(egui::PointerButton::Primary), i.key_pressed(egui::Key::Escape)));
+        let dropped = ctx.drag_stopped_id() == Some(drag.owner) && released;
+        let valid = ui.is_enabled()
+            && drag.comp == cid
+            && drag.layers.iter().all(|id| comp.layer(LayerId(*id)).is_some())
+            && !escape
+            && (dropped || (down && ctx.dragged_id() == Some(drag.owner)));
+        if dropped || !valid {
+            ctx.data_mut(|d| d.remove::<LayerDrag>(layer_drag_id()));
+        }
+        let moving = &drag.layers;
+        let layer_rows: Vec<(Rect, LayerId)> = hit_rows.iter().filter(|(_, r)| matches!(r.kind, RowKind::Layer)).map(|(rr, r)| (*rr, r.layer)).collect();
+        if let Some(py) = ui.input(|i| i.pointer.interact_pos().or(i.pointer.latest_pos())).map(|p| p.y)
+            && valid
+            && !layer_rows.is_empty()
+        {
+            let (at, line_y) = insertion(&layer_rows, py, rows_rect.min.y);
+            let target = layer_drop_target(&g.tl.rows, &layer_rows, at, moving);
+            if dropped {
+                // Only when the order changes (no empty undo step for a drop in place).
+                let mut order: Vec<u64> = comp.layers.iter().map(|l| l.id.0).filter(|id| !moving.contains(id)).collect();
+                let at = target.and_then(|t| order.iter().position(|id| *id == t.0)).unwrap_or(order.len());
+                order.splice(at..at, moving.iter().copied());
+                if order != comp.layers.iter().map(|l| l.id.0).collect::<Vec<_>>() {
+                    let params = match target {
+                        Some(t) => json!({"layers": moving, "above": t.0}),
+                        None => json!({"layers": moving, "to": "back"}),
+                    };
+                    actions.push(("layer.arrange".into(), params));
+                }
+            } else {
+                ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
+                p.with_clip_rect(rows_rect).line_segment([pos2(rect.min.x, line_y), pos2(graph_x0, line_y)], Stroke::new(2.0, t.accent));
+            }
+        }
+    }
+    // Quick Offset of layer bars: the last selected layer moves by whole frames with the pointer
+}
+
+/// Group reorder drag (#2210): a line where the dragged effect, mask or shape item lands among
+/// its siblings; the drop moves it there (`prop.moveGroup`). Escape cancels.
+fn group_reorder_drag(ui: &mut egui::Ui, g: &mut Rw) {
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let Some(drag) = ctx.data(|d| d.get_temp::<GroupDrag>(group_drag_id())) else { return };
+    let (down, released, escape) =
+        ctx.input(|i| (i.pointer.primary_down(), i.pointer.button_released(egui::PointerButton::Primary), i.key_pressed(egui::Key::Escape)));
+    let dropped = ctx.drag_stopped_id() == Some(drag.owner) && released;
+    let parent = comp.layer(drag.layer).and_then(|l| l.props.parent_of(drag.uid));
+    let valid = ui.is_enabled() && drag.comp == g.tl.cid && parent.is_some() && !escape && (dropped || (down && ctx.dragged_id() == Some(drag.owner)));
+    if dropped || !valid {
+        ctx.data_mut(|d| d.remove::<GroupDrag>(group_drag_id()));
+    }
+    let Some(parent) = parent.filter(|_| valid) else { return };
+    let siblings: Vec<u64> = parent.children.iter().map(Node::uid).collect();
+    let rows: Vec<(Rect, u64)> = g
+        .hit_rows
+        .iter()
+        .filter_map(|(r, row)| match &row.kind {
+            RowKind::Group { uid, .. } if row.layer == drag.layer && siblings.contains(uid) => Some((*r, *uid)),
+            _ => None,
+        })
+        .collect();
+    let Some(py) = ui.input(|i| i.pointer.interact_pos().or(i.pointer.latest_pos())).map(|p| p.y) else { return };
+    if rows.is_empty() {
+        return;
+    }
+    let (at, line_y) = insertion(&rows, py, g.tl.rows_rect.min.y);
+    if !dropped {
+        ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
+        g.tl.p.with_clip_rect(g.tl.rows_rect).line_segment([pos2(g.tl.rect.min.x, line_y), pos2(g.tl.graph_x0, line_y)], Stroke::new(2.0, g.tl.t.accent));
+        return;
+    }
+    // The sibling the drop lands before (or after, below the last visible one).
+    let Some(&(_, anchor)) = at.map_or(rows.last(), |i| rows.get(i)) else { return };
+    let from = siblings.iter().position(|u| *u == drag.uid);
+    let rest: Vec<u64> = siblings.iter().copied().filter(|u| *u != drag.uid).collect();
+    let to = if anchor == drag.uid { from } else { rest.iter().position(|u| *u == anchor).map(|i| i + usize::from(at.is_none())) };
+    if let Some(to) = to.filter(|to| Some(*to) != from) {
+        g.tl.actions.push(("prop.moveGroup".into(), json!({"layer": drag.layer.0, "prop": drag.uid, "index": to + 1})));
+    }
+}
+
+/// Quick Offset of layer bars follows the pointer.
+fn quick_offset_follow(g: &mut Rw) {
+    let t = g.tl.t;
+    let pps = g.tl.pps;
+    let fd = g.tl.fd;
+    let ctx = g.tl.ctx.clone();
+    let actions = &mut g.tl.actions;
+    let ui_actions = &mut g.ui_actions;
+    if let Some(mut q) = ctx.data(|d| d.get_temp::<QuickBar>(quick_bar_id())) {
+        let (down, ptr) = ctx.input(|i| (i.pointer.primary_down(), i.pointer.latest_pos()));
+        match ptr.filter(|_| down) {
+            Some(ptr) => {
+                let frames = (((ptr.x - q.origin_x) as f64 / pps) / fd).round() as i64;
+                if frames != q.applied {
+                    q.applied = frames;
+                    ctx.data_mut(|d| d.insert_temp(quick_bar_id(), q));
+                    let merge = format!("bar-quick-{}", q.layer.0);
+                    actions.push(("layer.quickOffset".into(), json!({"delta": frames as f64 * fd, "merge": merge, "fromStart": true})));
+                }
+                drag_tip(&ctx, &t, ptr, quick_offset_note(q.applied, q.layers));
+            }
+            None => {
+                ctx.data_mut(|d| d.remove::<QuickBar>(quick_bar_id()));
+                ui_actions.push(UiAct::EndMerge);
+            }
+        }
+    }
+    // Keyframe drag: the selected keys move by whole frames with the pointer until it is
+    // released (one undo step); Shift snaps the grabbed key to the current time, the work area
+}
+
+/// The key drag moves the selected keys by whole frames.
+fn key_drag_follow(app: &mut EffectcraftApp, g: &mut Rw) {
+    let t = g.tl.t;
+    let time = g.tl.time;
+    let pps = g.tl.pps;
+    let fd = g.tl.fd;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let rows = &g.tl.rows;
+    let actions = &mut g.tl.actions;
+    let ui_actions = &mut g.ui_actions;
+    if let Some(mut kd) = ctx.data(|d| d.get_temp::<KeyDrag>(key_drag_id())) {
+        let (down, ptr, shift) = ctx.input(|i| (i.pointer.primary_down(), i.pointer.latest_pos(), i.modifiers.shift));
+        match ptr.filter(|_| down) {
+            Some(ptr) => {
+                let mut target = kd.anchor + (ptr.x - kd.origin_x) as f64 / pps;
+                if shift {
+                    // The current time and whatever it snaps to (keys, layer ends, markers), but
+                    // not the moving keys themselves.
+                    let moving: Vec<f64> =
+                        app.session.state.selected_keys.iter().filter_map(|k| comp.layer(k.layer).map(|l| l.comp_time(k.time).seconds())).collect();
+                    let mut cands = snap_candidates(&comp, rows);
+                    cands.retain(|c| !moving.iter().any(|m| (m - c).abs() < 1e-9));
+                    cands.push(time.seconds());
+                    target = snap_time(&cands, target, 8.0 / pps);
+                }
+                let total = ((target - kd.anchor) / fd).round() as i64;
+                if total != kd.applied {
+                    actions.push(match kd.quick {
+                        Some(_) => ("keys.quickOffset".into(), json!({"delta": total as f64 * fd, "merge": "key-quick-offset", "fromStart": true})),
+                        None => ("keys.move".into(), json!({"delta": (total - kd.applied) as f64 * fd, "merge": "key-drag"})),
+                    });
+                    kd.applied = total;
+                    ctx.data_mut(|d| d.insert_temp(key_drag_id(), kd));
+                }
+                ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
+                // Where the grabbed key is and how far the keys moved (After Effects shows this
+                // in the Info panel).
+                let at = Tick::from_seconds_f64(kd.anchor + kd.applied as f64 * fd);
+                let note = match kd.quick {
+                    Some(n) => quick_offset_note(kd.applied, n),
+                    None => format!("{}   {:+} f", super::timecode(&app.session, &comp, at), kd.applied),
+                };
+                drag_tip(&ctx, &t, ptr, note);
+                app.ui.status = format!("Keyframe at {}", super::timecode(&app.session, &comp, at));
+            }
+            None => {
+                ctx.data_mut(|d| d.remove::<KeyDrag>(key_drag_id()));
+                ui_actions.push(UiAct::EndMerge);
+            }
+        }
+    }
+}
+
+/// The keys whose markers touch box `br`, in row order (the comp's). `top` is the y of the first
+/// row, scrolled.
+fn keys_in_box(comp: &Comp, rows: &[Row], tm: &TMap, top: f32, rh: f32, br: Rect) -> Vec<effectcraft_engine::KeyRef> {
+    let mut keys = vec![];
+    let mut yy = top;
+    for row in rows {
+        let cy = yy + rh / 2.0;
+        yy += row_height(row, rh);
+        // No marker reaches a whole glyph from its row's center.
+        if let RowKind::Prop { uid } = row.kind
+            && cy >= br.min.y - KEY_GLYPH_SIZE
+            && cy <= br.max.y + KEY_GLYPH_SIZE
+            && let Some(l) = comp.layer(row.layer)
+            && let Some(pr) = l.props.find(uid)
+        {
+            for k in &pr.keys {
+                let x = tm.x(l.comp_time(k.time).seconds());
+                if key_glyph_rect(k, pos2(x, cy)).intersects(br) {
+                    keys.push(effectcraft_engine::KeyRef { layer: l.id, prop: uid, time: k.time });
+                }
+            }
+        }
+    }
+    keys
+}
+
+/// What a box over the Timeline selects: the layer rows it crosses (locked layers stay out) and
+/// the keys whose markers it touches. A box that reaches the outline (started on either side)
+/// selects the rows it crosses; one kept inside the time graph selects keys only, as before.
+/// Keys exist only in the time graph, so the box is cut at its left edge (`graph_x0`; a key
+/// scrolled out under the outline isn't touched).
+/// `graph_on`: the Graph Editor shows no key markers here.
+#[allow(clippy::too_many_arguments)]
+fn box_targets(
+    comp: &Comp,
+    rows: &[Row],
+    hit_rows: &[(Rect, Row)],
+    tm: &TMap,
+    top: f32,
+    rh: f32,
+    graph_x0: f32,
+    graph_on: bool,
+    br: Rect,
+) -> (Vec<u64>, Vec<effectcraft_engine::KeyRef>) {
+    let layers = hit_rows
+        .iter()
+        .filter(|(r, row)| br.min.x < graph_x0 && matches!(row.kind, RowKind::Layer) && r.intersects(br))
+        .filter(|(_, row)| comp.layer(row.layer).is_some_and(|l| !l.switches.locked))
+        .map(|(_, row)| row.layer.0)
+        .collect();
+    let in_graph = Rect::from_min_max(pos2(br.min.x.max(graph_x0), br.min.y), pos2(br.max.x, br.max.y));
+    let keys = if graph_on || in_graph.width() < 0.0 { vec![] } else { keys_in_box(comp, rows, tm, top, rh, in_graph) };
+    (layers, keys)
+}
+
+/// The Timeline's one selection box, from the empty outline or the empty time graph: it spans both
+/// columns as it is dragged (the pointer may cross the boundary either way) and on release selects
+/// the layer rows it crosses and the keys inside it, as in After Effects.
+fn box_select(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &mut Rw) {
+    let t = g.tl.t;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let rh = g.tl.rh;
+    let graph_x0 = g.tl.graph_x0;
+    let graph_on = g.graph_on;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let rows = g.tl.rows.clone();
+    let origin = [&g.outline_empty, &g.empty].into_iter().find(|r| r.dragged() || r.drag_stopped()).cloned();
+    let Some(origin) = origin else { return };
+    let box_of = |o: &egui::Response| {
+        let start = ctx.input(|i| i.pointer.press_origin());
+        start.zip(o.interact_pointer_pos().or_else(|| ctx.input(|i| i.pointer.latest_pos()))).map(|(a, b)| Rect::from_two_pos(a, b).intersect(rows_rect))
+    };
+    let id = egui::Id::unique("tl-box");
+    if origin.dragged()
+        && let Some(br) = box_of(&origin)
+    {
+        let bp = g.tl.p.with_clip_rect(rows_rect);
+        bp.rect_filled(br, 0.0, t.accent.gamma_multiply(0.12));
+        bp.rect_stroke(br, 0.0, Stroke::new(1.0, t.accent), StrokeKind::Inside);
+        ctx.data_mut(|d| d.insert_temp(id, br));
+    }
+    if origin.drag_stopped()
+        && let Some(br) = ctx.data(|d| d.get_temp::<Rect>(id))
+    {
+        ctx.data_mut(|d| d.remove::<Rect>(id));
+        let (layers, touched) = box_targets(&comp, &rows, &g.hit_rows, &tm, rows_rect.min.y - app.ui.timeline.scroll_y, rh, graph_x0, graph_on, br);
+        let mods = ui.input(|i| i.modifiers);
+        let add = mods.shift || mods.command;
+        let actions = &mut g.tl.actions;
+        // A box that catches nothing leaves nothing selected (layers included), unless it adds.
+        actions.push(("layer.select".into(), json!({"layers": layers, "add": add})));
+        if !touched.is_empty() {
+            let keys: Vec<serde_json::Value> = touched.iter().map(|k| json!({"layer": k.layer.0, "prop": k.prop, "time": k.time.seconds()})).collect();
+            actions.push(("keys.select".into(), json!({"keys": keys, "add": true, "selectProperties": true})));
+        }
+    }
+}
+
+fn current_time_indicator(app: &mut EffectcraftApp, g: &Rw) {
+    let t = g.tl.t;
+    let time = g.tl.time;
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let ruler = g.tl.ruler;
+    let p = g.tl.p.clone();
+    let cx = tm.x(time.seconds());
+    if cx >= graph_x0 && cx <= rect.max.x {
+        p.line_segment([pos2(cx, ruler.min.y + 12.0), pos2(cx, rows_rect.max.y)], Stroke::new(1.0, t.cti));
+        let head = vec![
+            pos2(cx - 6.0, ruler.min.y + 12.0),
+            pos2(cx + 6.0, ruler.min.y + 12.0),
+            pos2(cx + 6.0, ruler.max.y - 8.0),
+            pos2(cx, ruler.max.y - 2.0),
+            pos2(cx - 6.0, ruler.max.y - 8.0),
+        ];
+        p.add(egui::Shape::convex_polygon(head, t.cti, Stroke::NONE));
+        app.auto.add("timeline.cti", Rect::from_center_size(pos2(cx, ruler.center().y), vec2(12.0, 20.0)), "Current time indicator");
+    }
+}
+
+/// The footer: scroll bars, the switches / modes toggle and render time.
+fn footer_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Rw) -> Rect {
+    let t = g.tl.t;
+    let rect = g.tl.rect;
+    let footer_h = g.tl.footer_h;
+    let overflow = g.tl.overflow;
+    let oscroll = g.tl.oscroll;
+    let graph_x0 = g.tl.graph_x0;
+    let rows_rect = g.tl.rows_rect;
+    let max_scroll = g.tl.max_scroll;
+    let p = g.tl.p.clone();
+    let footer = Rect::from_min_max(pos2(rect.min.x, rect.max.y - footer_h), rect.max);
+    p.rect_filled(footer, 0.0, t.panel_bg);
+    p.line_segment([footer.left_top(), footer.right_top()], Stroke::new(1.0, t.separator));
+    if overflow > 0.0 {
+        // Outline scroll bar along the top of the footer, under the columns.
+        let track = Rect::from_min_max(pos2(rect.min.x + 2.0, footer.min.y + 1.0), pos2(graph_x0 - 3.0, footer.min.y + 5.0));
+        app.ui.timeline.outline_scroll = widgets::scroll_bar(ui, &mut app.auto, "timeline.outlineScroll", track, oscroll, overflow, &t);
+    }
+    if max_scroll > 0.0 {
+        // The layer rows' scroll bar, on the right edge beside the time graph.
+        let track = Rect::from_min_max(pos2(rect.max.x - 6.0, rows_rect.min.y + 1.0), pos2(rect.max.x - 2.0, rows_rect.max.y - 1.0));
+        app.ui.timeline.scroll_y = widgets::scroll_bar(ui, &mut app.auto, "timeline.scroll", track, app.ui.timeline.scroll_y, max_scroll, &t);
+    }
+    let tgl = Rect::from_min_size(pos2(footer.min.x + 10.0, footer.min.y + 3.0), vec2(150.0, 18.0));
+    let tresp = ui.interact(tgl, egui::Id::unique("tl-toggle-modes"), Sense::click());
+    p.text(
+        tgl.left_center(),
+        Align2::LEFT_CENTER,
+        crate::i18n::tr("Toggle Switches / Modes"),
+        Tokens::ui(11.0),
+        if tresp.hovered() { t.text } else { t.text_dim },
+    );
+    app.auto.add("timeline.toggleSwitchesModes", tgl, "Toggle Switches / Modes");
+    if tresp.clicked() {
+        app.ui.timeline.show_modes = !app.ui.timeline.show_modes;
+    }
+    let ms = app.frames.last_ms.lock().map(|v| *v).unwrap_or(0.0);
+    p.text(
+        pos2(graph_x0 - 12.0, footer.center().y),
+        Align2::RIGHT_CENTER,
+        crate::i18n::tr_args("Frame Render Time  {}ms", &[&format!("{ms:.0}")]),
+        Tokens::ui(11.0),
+        t.text_faint,
+    );
+    // Zoom slider.
+    footer
+}
+
+/// The zoom buttons and slider.
+fn footer_zoom(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Rw, footer: Rect) {
+    let t = g.tl.t;
+    let time = g.tl.time;
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let fit_pps = g.tl.fit_pps;
+    let pps = g.tl.pps;
+    let tm = g.tl.tm;
+    let comp = g.tl.comp.clone();
+    let p = g.tl.p.clone();
+    let zs = Rect::from_min_max(pos2(graph_x0 + 30.0, footer.center().y - 2.0), pos2((graph_x0 + 230.0).min(rect.max.x - 30.0), footer.center().y + 2.0));
+    // Zoom out / zoom in buttons either side of the slider: the `-` / `=` steps. Everything here
+    // zooms around the CTI and sets the one time zoom the layer bars and the Graph Editor share.
+    let cti = time.seconds();
+    let cti_px = (cti - tm.start) * pps;
+    for (icon, size, cx, id, tip, k) in [
+        (Icon::MountainSmall, 14.0, zs.min.x - 14.0, "timeline.zoomOutButton", "Zoom Out (Time)", 1.0 / ZOOM_STEP),
+        (Icon::MountainLarge, 16.0, zs.max.x + 14.0, "timeline.zoomInButton", "Zoom In (Time)", ZOOM_STEP),
+    ] {
+        let r = Rect::from_center_size(pos2(cx, footer.center().y), vec2(20.0, 20.0));
+        let resp = ui.interact(r, egui::Id::unique(id), Sense::click()).on_hover_text(crate::i18n::tr(tip));
+        icons::paint(&p, Rect::from_center_size(r.center(), vec2(size, size)), icon, if resp.hovered() { t.text } else { t.text_dim });
+        app.auto.add(id, r, tip);
+        if resp.clicked() {
+            set_zoom(&mut app.ui.timeline, &comp, pps * k, fit_pps, cti, cti_px);
+        }
+    }
+    p.rect_filled(zs, 2.0, t.field_bg);
+    let maxpps = MAX_PPS.max(fit_pps * 1.001);
+    let frac = ((pps / fit_pps).ln() / (maxpps / fit_pps).ln()).clamp(0.0, 1.0) as f32;
+    let knob = pos2(zs.min.x + zs.width() * frac, zs.center().y);
+    p.circle_filled(knob, 6.0, t.text);
+    // Drag the knob, or click the track to jump there.
+    let zresp = ui.interact(zs.expand2(vec2(6.0, 8.0)), egui::Id::unique("tl-zoom"), Sense::click_and_drag());
+    app.auto.add("timeline.zoomSlider", zs, "Zoom");
+    if (zresp.dragged() || zresp.clicked())
+        && let Some(pt) = zresp.interact_pointer_pos()
+    {
+        let f = ((pt.x - zs.min.x) / zs.width().max(1.0)).clamp(0.0, 1.0) as f64;
+        set_zoom(&mut app.ui.timeline, &comp, fit_pps * (maxpps / fit_pps).powf(f), fit_pps, cti, cti_px);
+    }
+}
+
+fn comp_markers_ui(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Rw) {
+    let graph_x0 = g.tl.graph_x0;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let ruler = g.tl.ruler;
+    let bin = g.tl.bin;
+    let comp = g.tl.comp.clone();
+    // Composition markers in the ruler; protected regions shade the layer rows.
+    let mstrip = Rect::from_min_max(pos2(graph_x0, ruler.max.y - 12.0), pos2(bin.min.x, ruler.max.y));
+    let mrows = rows_rect.intersect(Rect::from_min_max(pos2(graph_x0, rows_rect.min.y), rows_rect.max));
+    super::markers_ui::comp_markers(app, ui, &comp, tm, mstrip, mrows);
+    super::markers_ui::marker_bin(app, ui, &comp, tm, bin, mstrip);
+}
+
+/// Spacebar held: the Hand tool. A middle-drag begun in the rows, layer list included, pans too.
+fn hand_tool_pan(app: &mut EffectcraftApp, ui: &mut egui::Ui, g: &Rw) {
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let graph_x1 = g.tl.graph_x1;
+    let pps = g.tl.pps;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let ruler = g.tl.ruler;
+    let max_scroll = g.tl.max_scroll;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let mut pan = ui.input(|i| i.pointer.middle_down() && !i.pointer.primary_down() && i.pointer.press_origin().is_some_and(|p| rows_rect.contains(p)));
+    if super::space_hand(&ctx) {
+        let area = Rect::from_min_max(pos2(graph_x0, ruler.min.y), pos2(rect.max.x, rows_rect.max.y));
+        let hand = ui.interact(area, egui::Id::unique("tl-hand"), Sense::drag());
+        app.auto.add("timeline.hand", area, "Hand (hold Spacebar)");
+        if hand.hovered() || hand.dragged() {
+            ctx.set_cursor_icon(if hand.dragged() { egui::CursorIcon::Grabbing } else { egui::CursorIcon::Grab });
+        }
+        pan |= hand.dragged();
+    }
+    if pan {
+        let delta = ui.input(|i| i.pointer.delta());
+        app.ui.timeline.scroll_y = (app.ui.timeline.scroll_y - delta.y).clamp(0.0, max_scroll);
+        if app.ui.timeline.pps.is_some() {
+            let start = app.ui.timeline.start;
+            let last = (comp.duration.seconds() - (tm.t(graph_x1) - tm.start)).max(start).max(0.0);
+            app.ui.timeline.start = (start - delta.x as f64 / pps).clamp(0.0, last);
+        }
+    }
+}
+
+/// Alt-drag of an item over a layer: replace its source.
+fn drop_replace_source(app: &mut EffectcraftApp, g: &mut Rw, payload: &std::sync::Arc<crate::panels::DragPayload>, ptr: Pos2, released: bool) {
+    let t = g.tl.t;
+    let cid = g.tl.cid;
+    let rows_rect = g.tl.rows_rect;
+    let comp = g.tl.comp.clone();
+    let p = g.tl.p.clone();
+    let actions = &mut g.tl.actions;
+    let hit_rows = &mut g.hit_rows;
+    if let crate::panels::DragPayload::Item(id) = payload.as_ref() {
+        let target = hit_rows.iter().find(|(r, _)| ptr.y >= r.min.y && ptr.y < r.max.y).map(|(_, row)| row.layer);
+        if let Some(l) = target
+            && replace_source_target(app, cid, ItemId(*id), l, &comp)
+            && let Some(span) = hit_rows.iter().filter(|(_, row)| row.layer == l).map(|(r, _)| *r).reduce(|a, b| a.union(b))
+        {
+            let lit = span.intersect(rows_rect);
+            let rp = p.with_clip_rect(rows_rect);
+            rp.rect_filled(lit, 0.0, t.accent.gamma_multiply(0.18));
+            rp.rect_stroke(lit, 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
+            app.auto.add("timeline.replaceSourceTarget", lit, "Replace the layer's source");
+            if released {
+                actions.push(("layer.replaceSource".into(), json!({"layers": [l.0], "item": *id, "fixExpressions": false})));
+            }
+        }
+    }
+}
+
+/// Effects and presets drop onto the layer under the pointer.
+fn drop_on_layer(app: &mut EffectcraftApp, g: &mut Rw, payload: &std::sync::Arc<crate::panels::DragPayload>, ptr: Pos2, released: bool) {
+    let t = g.tl.t;
+    let rows_rect = g.tl.rows_rect;
+    let p = g.tl.p.clone();
+    let actions = &mut g.tl.actions;
+    let hit_rows = &mut g.hit_rows;
+    let target = hit_rows.iter().find(|(r, _)| ptr.y >= r.min.y && ptr.y < r.max.y).map(|(_, row)| row.layer);
+    // The layer the effect would land on (its row and its open properties) is the one
+    // that lights up, not the whole timeline.
+    if let Some(l) = target
+        && let Some(span) = hit_rows.iter().filter(|(_, row)| row.layer == l).map(|(r, _)| *r).reduce(|a, b| a.union(b))
+    {
+        let lit = span.intersect(rows_rect);
+        let rp = p.with_clip_rect(rows_rect);
+        rp.rect_filled(lit, 0.0, t.accent.gamma_multiply(0.18));
+        rp.rect_stroke(lit, 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
+        app.auto.add("timeline.dropTarget", lit, "Drop target layer");
+    }
+    if released && let Some(l) = target {
+        match payload.as_ref() {
+            crate::panels::DragPayload::Effect(e) => actions.push(("effect.apply".into(), json!({"effect": e, "layers": [l.0]}))),
+            crate::panels::DragPayload::Preset { preset, .. } => {
+                let (id, params) = preset.apply_to(l.0);
+                actions.push((id.into(), params));
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Footage and files drop into the stack: a line shows the place.
+fn drop_insert_layers(app: &mut EffectcraftApp, g: &mut Rw, payload: &std::sync::Arc<crate::panels::DragPayload>, ptr: Pos2, released: bool) {
+    let t = g.tl.t;
+    let time = g.tl.time;
+    let rect = g.tl.rect;
+    let graph_x0 = g.tl.graph_x0;
+    let tm = g.tl.tm;
+    let rows_rect = g.tl.rows_rect;
+    let ctx = g.tl.ctx.clone();
+    let comp = g.tl.comp.clone();
+    let p = g.tl.p.clone();
+    let actions = &mut g.tl.actions;
+    let graph_on = g.graph_on;
+    let hit_rows = &mut g.hit_rows;
+    let layer_rows: Vec<(Rect, LayerId)> = hit_rows.iter().filter(|(_, r)| matches!(r.kind, RowKind::Layer)).map(|(rr, r)| (*rr, r.layer)).collect();
+    let (at, line_y) = insertion(&layer_rows, ptr.y, rows_rect.min.y);
+    let index = match at.and_then(|i| layer_rows.get(i)) {
+        Some((_, l)) => comp.index_of(*l).unwrap_or(1),
+        None => layer_rows.last().and_then(|(_, l)| comp.index_of(*l)).unwrap_or(comp.layers.len()) + 1,
+    };
+    let start = (ptr.x >= graph_x0 && !graph_on).then(|| {
+        let t = if ctx.input(|i| i.modifiers.shift) { time } else { Tick::from_seconds_f64(tm.t(ptr.x)) };
+        comp.frame_rate.snap_nearest(t).clamp(Tick::ZERO, comp.duration - comp.frame_duration())
+    });
+    let rp = p.with_clip_rect(rows_rect);
+    rp.line_segment([pos2(rect.min.x, line_y), pos2(rows_rect.max.x, line_y)], Stroke::new(2.0, t.accent));
+    if let Some(s) = start {
+        let x = tm.x(s.seconds());
+        rp.line_segment([pos2(x, rows_rect.min.y), pos2(x, rows_rect.max.y)], Stroke::new(1.0, t.accent));
+        // The In point's time in a tag beside the marker.
+        let g = rp.layout_no_wrap(super::timecode(&app.session, &comp, s), Tokens::ui(11.0), Color32::WHITE);
+        let tag = Align2::LEFT_BOTTOM.anchor_size(pos2(x + 4.0, line_y - 3.0), g.size());
+        rp.rect_filled(tag.expand(2.0), 2.0, t.accent);
+        rp.galley(tag.min, g, Color32::WHITE);
+    }
+    if released {
+        let time = json!(start.map(Tick::seconds));
+        match payload.as_ref() {
+            crate::panels::DragPayload::Item(id) => {
+                // Insert each selected item at the drop point, in selection order.
+                for (offset, item) in crate::panels::project_drop_items(app, *id, Some(g.tl.cid)).into_iter().enumerate() {
+                    actions.push(("layer.addItem".into(), json!({"item": item, "index": index.saturating_add(offset), "time": time.clone()})));
+                }
+            }
+            crate::panels::DragPayload::Files(paths) => {
+                actions.push(("mediaBrowser.import".into(), json!({"paths": paths, "addToComp": true, "index": index, "time": time})))
+            }
+            crate::panels::DragPayload::Effect(_) | crate::panels::DragPayload::Preset { .. } | crate::panels::DragPayload::Property { .. } => {}
+        }
+    }
+}
+
 /// The optional per-layer cells: Comment (double-click to edit), In / Out / Duration (drag to
 /// change by frames), Stretch (click: Time Stretch dialog).
-#[allow(clippy::too_many_arguments)]
 fn layer_cells(
     app: &mut EffectcraftApp,
     ui: &mut egui::Ui,
     lp: &egui::Painter,
     cw: &Cols,
     comp: &Comp,
-    layer: &Layer,
-    r: Rect,
-    cy: f32,
+    rc: &RowCtx<'_>,
     actions: &mut Vec<(String, serde_json::Value)>,
 ) {
+    let (layer, r, cy) = (rc.layer, rc.r, rc.cy);
     let t = app.tokens;
     let ctx = ui.ctx().clone();
     let lid = layer.id.0;
     if cw.vis.comment {
         let cr = Rect::from_min_max(pos2(cw.comment + 4.0, r.min.y + 1.0), pos2(cw.comment + COMMENT_W - 4.0, r.max.y - 1.0));
-        let edit_id = egui::Id::new("tl-comment-edit");
+        let edit_id = egui::Id::unique("tl-comment-edit");
         let editing: Option<(u64, String)> = ctx.data(|d| d.get_temp(edit_id));
         app.auto.add(&format!("timeline.layer.{lid}.comment"), cr, &layer.comment);
         if let Some((el, mut buf)) = editing.filter(|(el, _)| *el == lid) {
@@ -3524,7 +5178,8 @@ fn layer_cells(
                 ctx.data_mut(|d| d.insert_temp(edit_id, (el, buf)));
             }
         } else {
-            let resp = ui.interact(cr, egui::Id::new(("tl-comment", lid)), Sense::click()).on_hover_text(crate::i18n::tr("Double-click to edit the comment"));
+            let resp =
+                ui.interact(cr, egui::Id::unique(("tl-comment", lid)), Sense::click()).on_hover_text(crate::i18n::tr("Double-click to edit the comment"));
             lp.with_clip_rect(cr.intersect(lp.clip_rect())).text(pos2(cr.min.x + 2.0, cy), Align2::LEFT_CENTER, &layer.comment, Tokens::ui(11.5), t.text_dim);
             if resp.double_clicked() {
                 ctx.data_mut(|d| d.insert_temp(edit_id, (lid, layer.comment.clone())));
@@ -3542,14 +5197,18 @@ fn layer_cells(
             continue;
         }
         let cr = Rect::from_min_max(pos2(x + 2.0, r.min.y + 1.0), pos2(x + TIME_W - 2.0, r.max.y - 1.0));
-        let tc = crate::panels::timecode(&app.session, comp, Tick::from_seconds_f64(secs) - if kind == "duration" { comp.display_start } else { Tick(0) });
-        let resp = ui.interact(cr, egui::Id::new(("tl-cell", kind, lid)), Sense::drag()).on_hover_text(crate::i18n::tr("Drag to change"));
+        let tc = if kind == "duration" {
+            crate::panels::duration(&app.session, comp, Tick::from_seconds_f64(secs))
+        } else {
+            crate::panels::timecode(&app.session, comp, Tick::from_seconds_f64(secs))
+        };
+        let resp = ui.interact(cr, egui::Id::unique(("tl-cell", kind, lid)), Sense::drag()).on_hover_text(crate::i18n::tr("Drag to change"));
         lp.text(pos2(cr.min.x + 4.0, cy), Align2::LEFT_CENTER, &tc, Tokens::mono(11.0), if resp.hovered() || resp.dragged() { t.hot_text } else { t.timecode });
         app.auto.add(&format!("timeline.layer.{lid}.{kind}"), cr, &tc);
         if resp.hovered() || resp.dragged() {
             ctx.set_cursor_icon(egui::CursorIcon::ResizeHorizontal);
         }
-        let acc_id = egui::Id::new(("tl-cell-acc", kind, lid));
+        let acc_id = egui::Id::unique(("tl-cell-acc", kind, lid));
         if resp.dragged() {
             let mut acc: f32 = ctx.data(|d| d.get_temp(acc_id).unwrap_or(0.0));
             acc += resp.drag_delta().x;
@@ -3574,7 +5233,7 @@ fn layer_cells(
     if cw.vis.stretch {
         let cr = Rect::from_min_max(pos2(cw.stretch + 2.0, r.min.y + 1.0), pos2(cw.stretch + STRETCH_W - 2.0, r.max.y - 1.0));
         let label = format!("{:.1}%", layer.stretch * 100.0);
-        let resp = ui.interact(cr, egui::Id::new(("tl-stretch", lid)), Sense::click()).on_hover_text(crate::i18n::tr("Time Stretch…"));
+        let resp = ui.interact(cr, egui::Id::unique(("tl-stretch", lid)), Sense::click()).on_hover_text(crate::i18n::tr("Time Stretch…"));
         lp.text(pos2(cr.min.x + 4.0, cy), Align2::LEFT_CENTER, &label, Tokens::ui(11.5), if resp.hovered() { t.hot_text } else { t.text });
         app.auto.add(&format!("timeline.layer.{lid}.stretch"), cr, &label);
         if resp.clicked() {
@@ -3611,17 +5270,16 @@ fn find_group(g: &PropGroup, uid: u64) -> Option<&PropGroup> {
 }
 
 /// A stroke's Dashes "+" / "−" buttons (add or remove a Dash/Gap pair).
-#[allow(clippy::too_many_arguments)]
 fn dash_buttons(
     app: &mut EffectcraftApp,
     ui: &mut egui::Ui,
     p: &egui::Painter,
     layer: &Layer,
     uid: u64,
-    x: f32,
-    cy: f32,
+    at: Pos2,
     actions: &mut Vec<(String, serde_json::Value)>,
 ) {
+    let (x, cy) = (at.x, at.y);
     if !matches!(layer.source, LayerSource::Shape) || layer.props.find_group(uid).is_none_or(|g| g.match_id != "dashes") {
         return;
     }
@@ -3631,7 +5289,7 @@ fn dash_buttons(
         [("+", "shape.dashes.add", "Add a Dash or Gap"), ("\u{2212}", "shape.dashes.remove", "Remove a Dash or Gap")].into_iter().enumerate()
     {
         let r = Rect::from_center_size(pos2(x + 12.0 + i as f32 * 20.0, cy), vec2(16.0, 16.0));
-        let resp = ui.interact(r, egui::Id::new(("tl-dash", uid, i)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("tl-dash", uid, i)), Sense::click()).on_hover_text(tip);
         p.rect_stroke(r.shrink(1.0), 2.0, Stroke::new(1.0, t.separator), StrokeKind::Inside);
         p.text(r.center(), Align2::CENTER_CENTER, sym, Tokens::ui(12.0), if resp.hovered() { t.text } else { t.text_dim });
         app.auto.add(&format!("timeline.group.{uid}.{}", if i == 0 { "addDash" } else { "removeDash" }), r, tip);
@@ -3669,22 +5327,22 @@ const SHAPE_ADD_ITEMS: &[(&str, &str)] = &[
     ("trim", "Trim Paths"),
     ("twist", "Twist"),
     ("wiggle", "Wiggle Paths"),
+    ("wiggler", "Wiggle Transform"),
     ("zigzag", "Zig Zag"),
 ];
 
 /// A shape layer's Contents "Add:" pop-up menu: adds a shape, paint or path operation to the
 /// selected shape group, else to the layer's contents.
-#[allow(clippy::too_many_arguments)]
 fn shape_add_popup(
     app: &mut EffectcraftApp,
     ui: &mut egui::Ui,
     p: &egui::Painter,
     layer: &Layer,
     uid: u64,
-    x: f32,
-    cy: f32,
+    at: Pos2,
     actions: &mut Vec<(String, serde_json::Value)>,
 ) {
+    let (x, cy) = (at.x, at.y);
     if !matches!(layer.source, LayerSource::Shape) || layer.props.sub("contents").is_none_or(|c| c.uid != uid) {
         return;
     }
@@ -3692,10 +5350,10 @@ fn shape_add_popup(
     p.text(pos2(x + 6.0, cy), Align2::LEFT_CENTER, crate::i18n::tr("Add:"), Tokens::ui(11.5), t.text_dim);
     let br = Rect::from_center_size(pos2(x + 40.0, cy), vec2(16.0, 16.0));
     let resp =
-        ui.interact(br, egui::Id::new(("tl-shapeadd", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Add a shape, fill, stroke or path operation"));
+        ui.interact(br, egui::Id::unique(("tl-shapeadd", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Add a shape, fill, stroke or path operation"));
     icons::paint(p, br.shrink(3.0), Icon::ChevronRight, if resp.hovered() { t.text } else { t.text_dim });
     app.auto.add(&format!("timeline.group.{uid}.add"), br, "Add:");
-    let pop = egui::Id::new(("tl-shapeadd-pop", uid));
+    let pop = egui::Id::unique(("tl-shapeadd-pop", uid));
     if resp.clicked() {
         widgets::open_popup(ui, pop);
     }
@@ -3717,17 +5375,16 @@ fn shape_add_popup(
 }
 
 /// The Text group's "Animate:" and an animator's "Add:" pop-up menus (AE's twirl-down menus).
-#[allow(clippy::too_many_arguments)]
 fn text_anim_popups(
     app: &mut EffectcraftApp,
     ui: &mut egui::Ui,
     p: &egui::Painter,
     layer: &Layer,
     uid: u64,
-    x: f32,
-    cy: f32,
+    at: Pos2,
     actions: &mut Vec<(String, serde_json::Value)>,
 ) {
+    let (x, cy) = (at.x, at.y);
     use effectcraft_engine::project::build::TEXT_ANIMATOR_KINDS;
     if !matches!(layer.source, LayerSource::Text) {
         return;
@@ -3739,16 +5396,21 @@ fn text_anim_popups(
         "animator" => ("Add:", "add"),
         _ => return,
     };
-    p.text(pos2(x + 6.0, cy), Align2::LEFT_CENTER, label, Tokens::ui(11.5), t.text_dim);
-    let br = Rect::from_center_size(pos2(x + 6.0 + if key == "add" { 34.0 } else { 62.0 }, cy), vec2(16.0, 16.0));
-    let resp = ui.interact(br, egui::Id::new(("tl-textanim", uid)), Sense::click()).on_hover_text(if key == "add" {
+    // The label is the English source; the drawn text is the catalog's, so the row reads
+    // アニメーター： as Animation ▸ Animate Text does. The button follows the width the label
+    // actually takes, since a translation is rarely as wide as the English it replaces.
+    let galley = p.layout_no_wrap(tr(label).to_string(), Tokens::ui(11.5), t.text_dim);
+    let text_w = galley.size().x;
+    p.galley(pos2(x + 6.0, cy - galley.size().y / 2.0), galley, t.text_dim);
+    let br = Rect::from_center_size(pos2(x + 6.0 + text_w + 10.0, cy), vec2(16.0, 16.0));
+    let resp = ui.interact(br, egui::Id::unique(("tl-textanim", uid)), Sense::click()).on_hover_text(tr(if key == "add" {
         "Add property or selector"
     } else {
         "Animate text"
-    });
+    }));
     icons::paint(p, br.shrink(3.0), Icon::ChevronRight, if resp.hovered() { t.text } else { t.text_dim });
     app.auto.add(&format!("timeline.group.{uid}.{key}"), br, label);
-    let pop = egui::Id::new(("tl-textanim-pop", uid));
+    let pop = egui::Id::unique(("tl-textanim-pop", uid));
     if resp.clicked() {
         widgets::open_popup(ui, pop);
     }
@@ -3761,7 +5423,11 @@ fn text_anim_popups(
         opts.push("-".into());
         acts.push((String::new(), json!(null)));
         for (k, l) in TEXT_ANIMATOR_KINDS {
-            opts.push(l.to_string());
+            // The engine names these. `command_label` asks the menu for the row Animation ▸ Animate
+            // Text uses and falls back to the panel catalog, which holds the split names the menu
+            // does not list (`Fill Color: RGB` and the other colour rows), so no item is left in
+            // English. A separator is not a label.
+            opts.push(if *k == "-" { "-".into() } else { crate::i18n::command_label("layer.addTextAnimator", l).to_string() });
             acts.push(if *k == "-" { (String::new(), json!(null)) } else { ("layer.addTextAnimator".into(), json!({"layer": layer.id.0, "property": k})) });
         }
         // Variable Font Axes of the layer's font.
@@ -3773,19 +5439,19 @@ fn text_anim_popups(
                 acts.push((String::new(), json!(null)));
             }
             for a in axes {
-                opts.push(format!("Variable Font Axes: {}", a.name));
+                opts.push(tr_args("Variable Font Axes: {}", &[&a.name]));
                 acts.push(("text.animatorFontAxes".into(), json!({"layer": layer.id.0, "axis": a.tag})));
             }
         }
     } else {
         for (kind, l) in [("range", "Selector: Range"), ("wiggly", "Selector: Wiggly"), ("expression", "Selector: Expression")] {
-            opts.push(l.into());
+            opts.push(tr(l).to_string());
             acts.push(("layer.addTextSelector".into(), json!({"layer": layer.id.0, "animator": uid, "kind": kind})));
         }
         opts.push("-".into());
         acts.push((String::new(), json!(null)));
         for (k, l) in TEXT_ANIMATOR_KINDS {
-            opts.push(if *k == "-" { "-".into() } else { format!("Property: {l}") });
+            opts.push(if *k == "-" { "-".into() } else { tr_args("Property: {}", &[&crate::i18n::command_label("layer.addTextAnimator", l)]) });
             acts.push(if *k == "-" {
                 (String::new(), json!(null))
             } else {
@@ -3800,19 +5466,21 @@ fn text_anim_popups(
     }
 }
 
-/// The command for the Track Matte menu item `i` (`choice`) of `layer`, whose menu lists "No Track
-/// Matte", a separator, the matte `candidates`, a separator and the modes. A mode without a matte
-/// layer takes the layer above, like Layer ▸ Track Matte (#864: it used to do nothing).
-fn track_matte_pick(layer: &Layer, candidates: &[LayerId], i: usize, choice: &str) -> Option<(String, serde_json::Value)> {
+/// The command for the Track Matte menu item `i` (`choice`) of a row, setting `layers`' mattes,
+/// whose menu lists "No Track Matte", a separator, the matte `candidates`, a separator and the
+/// modes. A new matte layer keeps each layer's mode (the matte itself, if among them, is left
+/// out); a mode without a matte layer takes the layer above, like Layer ▸ Track Matte (#864: it
+/// used to do nothing).
+fn track_matte_pick(layers: &[u64], candidates: &[LayerId], i: usize, choice: &str) -> Option<(String, serde_json::Value)> {
     if i == 0 {
-        return Some(("layer.setTrackMatte".into(), json!({"layer": layer.id.0, "matte": null})));
+        return Some(("layer.setTrackMatte".into(), json!({"layers": layers, "matte": null})));
     }
     if let Some(m) = i.checked_sub(2).and_then(|j| candidates.get(j)) {
-        let kind = layer.track_matte.map(|m| m.kind).unwrap_or_default();
-        return Some(("layer.setTrackMatte".into(), json!({"layer": layer.id.0, "matte": m.0, "kind": kind_name(kind)})));
+        let layers: Vec<u64> = layers.iter().copied().filter(|l| *l != m.0).collect();
+        return (!layers.is_empty()).then(|| ("layer.setTrackMatte".into(), json!({"layers": layers, "matte": m.0, "kind": "preserve"})));
     }
     let k = MatteKind::ALL.into_iter().find(|k| k.label() == choice)?;
-    Some(("layer.trackMatte".into(), json!({"layers": [layer.id.0], "op": kind_name(k)})))
+    Some(("layer.trackMatte".into(), json!({"layers": layers, "op": kind_name(k)})))
 }
 
 fn kind_name(k: MatteKind) -> &'static str {
@@ -3883,25 +5551,31 @@ fn collapse_applies(layer: &Layer, project: &effectcraft_engine::project::Projec
     }
 }
 
-/// Which Create ▸ conversions the layer context menu offers, from the targeted layer's kind.
+/// Which Create ▸ conversions and Reveal ▸ actions the layer context menu offers, from the
+/// targeted layer's kind.
 #[derive(Clone, Copy, Default)]
 pub(crate) struct LayerMenuCaps {
     /// SVG / PDF / AI / EPS footage: Create Shapes from Vector Layer.
     pub vector: bool,
     /// A text layer: Create Shapes from Text / Create Masks from Text.
     pub text: bool,
+    /// The layer has a source item to reveal in the Project panel.
+    pub source: bool,
 }
 
 impl LayerMenuCaps {
     pub(crate) fn of(project: &effectcraft_engine::project::Project, layer: &Layer) -> Self {
-        Self { vector: vector_footage_layer(project, layer), text: matches!(layer.source, LayerSource::Text) }
+        Self {
+            vector: vector_footage_layer(project, layer),
+            text: matches!(layer.source, LayerSource::Text),
+            source: layer.source.item().is_some_and(|item| project.item(item).is_some()),
+        }
     }
 }
 
 /// A layer row's or bar's context menu. As in After Effects, right-clicking a layer that is part
 /// of the selection keeps the selection and the menu acts on all of it; right-clicking an
 /// unselected layer selects only that layer.
-#[allow(clippy::too_many_arguments)]
 fn layer_context_menu(
     resp: &egui::Response,
     comp: &Comp,
@@ -3916,6 +5590,10 @@ fn layer_context_menu(
         actions.push(("layer.select".into(), json!({"layers": [layer.id.0]})));
     }
     let targets: Vec<u64> = if in_selection { comp.layers.iter().filter(|l| selected.contains(&l.id)).map(|l| l.id.0).collect() } else { vec![layer.id.0] };
+    // The menu acts on the whole selection: offer Reveal when any target has a source, even if
+    // the layer under the pointer is a text, shape or null layer.
+    let any_source = targets.iter().any(|id| comp.layer(LayerId(*id)).is_some_and(|l| l.source.item().is_some()));
+    let caps = LayerMenuCaps { source: caps.source || any_source, ..caps };
     crate::widgets::context_menu(resp, |ui| layer_menu(ui, &targets, caps, (auto, "timeline.layerMenu"), actions));
 }
 
@@ -3951,6 +5629,9 @@ pub(crate) fn layer_menu(
         item(ui, "Adjustment Layer", "layer.newAdjustment", json!({}));
     });
     item(ui, "Layer Settings…", "layer.settings", json!({}));
+    if caps.source {
+        item(ui, "Reveal Layer Source in Project", "layer.revealSource", json!({"layers": layers}));
+    }
     if caps.vector {
         item(ui, "Create Shapes from Vector Layer", "layer.create", json!({"op": "shapesFromVector", "layers": layers}));
     }
@@ -3992,7 +5673,7 @@ pub(crate) fn layer_menu(
         }
     }
     ui.menu_button(crate::i18n::tr("Blending Mode"), |ui| {
-        widgets::menu_scroll(ui, |ui| {
+        widgets::menu_scroll(ui, false, |ui| {
             for m in BlendMode::ALL {
                 item(ui, m.label(), "layer.setBlendMode", json!({"layers": layers, "mode": m.label()}));
                 if m.ends_group() {
@@ -4053,11 +5734,11 @@ fn effects_submenu(ui: &mut egui::Ui, layers: &[u64], item: &mut dyn FnMut(&mut
         }
     }
     cats.sort_by_key(|(c, _)| c.to_ascii_lowercase());
-    widgets::menu_scroll(ui, |ui| {
+    widgets::menu_scroll(ui, false, |ui| {
         for (cat, mut fx) in cats {
             fx.sort_by_key(|e| e.name.to_ascii_lowercase());
             ui.menu_button(crate::i18n::effects::category(cat), |ui| {
-                widgets::menu_scroll(ui, |ui| {
+                widgets::menu_scroll(ui, false, |ui| {
                     for e in fx {
                         item(ui, e.name, "effect.apply", json!({"effect": e.id, "layers": layers}));
                     }
@@ -4071,653 +5752,302 @@ fn fmt_num(v: f64, d: usize) -> String {
     format!("{v:.d$}")
 }
 
-/// Inline value editor for a property row; pushes `prop.set` actions. Returns the rects of a
-/// multi-dimension value's fields, one per dimension (none for other values).
-fn value_editor(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    p: &egui::Painter,
-    layer: &Layer,
-    prop: &Property,
-    value: &Value,
+/// What the property value editors share: where to draw, what they edit, and how a change is
+/// worded as a `prop.set` command.
+struct ValueEdit<'a> {
+    p: &'a egui::Painter,
+    layer: &'a Layer,
+    prop: &'a Property,
     at: Pos2,
-    actions: &mut Vec<(String, serde_json::Value)>,
-) -> Vec<Rect> {
-    let t = app.tokens;
-    let uid = prop.uid;
-    let mut dims = vec![];
-    let merge = format!("scrub-{uid}");
-    // With several layers selected the edit applies to all of them (#491): a scrub by the same
-    // change, a typed value as it is.
-    let scrub = ui.ctx().dragged_id().is_some() && ui.input(|i| i.pointer.is_decidedly_dragging());
-    // Proportional Scrubbing (After Effects 26.2): Ctrl+Alt (Cmd+Opt) spreads the change over the
-    // selected layers by selection order, the first unchanged and the last by all of it.
-    let proportional = scrub && ui.input(|i| widgets::proportional_scrub(i.modifiers));
-    let set = |actions: &mut Vec<(String, serde_json::Value)>, v: serde_json::Value| {
+    uid: u64,
+    merge: String,
+    scrub: bool,
+    proportional: bool,
+}
+
+impl<'a> ValueEdit<'a> {
+    /// The editor of `prop` on `layer` at `at`; `ui` says whether a scrub is under way.
+    fn new(ui: &egui::Ui, p: &'a egui::Painter, layer: &'a Layer, prop: &'a Property, at: Pos2) -> Self {
+        let uid = prop.uid;
+        // With several layers selected the edit applies to all of them (#491): a scrub by the same
+        // change, a typed value as it is.
+        let scrub = ui.ctx().dragged_id().is_some() && ui.input(|i| i.pointer.is_decidedly_dragging());
+        // Proportional Scrubbing (After Effects 26.2): Ctrl+Alt (Cmd+Opt) spreads the change over the
+        // selected layers by selection order, the first unchanged and the last by all of it.
+        let proportional = scrub && ui.input(|i| widgets::proportional_scrub(i.modifiers));
+        Self { p, layer, prop, at, uid, merge: format!("scrub-{uid}"), scrub, proportional }
+    }
+
+    /// Queues the `prop.set` of one edit; consecutive edits of the property (a scrub) are one undo step.
+    fn set(&self, actions: &mut Vec<(String, serde_json::Value)>, v: serde_json::Value) {
+        self.push(actions, v, Some(&self.merge));
+    }
+
+    /// Queues the `prop.set` of a discrete choice (a drop-down pick, a check box): its own undo
+    /// step, never merged with the property's previous edit (#2152).
+    fn set_step(&self, actions: &mut Vec<(String, serde_json::Value)>, v: serde_json::Value) {
+        self.push(actions, v, None);
+    }
+
+    fn push(&self, actions: &mut Vec<(String, serde_json::Value)>, v: serde_json::Value, merge: Option<&str>) {
         actions.push((
             "prop.set".into(),
-            json!({"layer": layer.id.0, "prop": uid, "value": v, "merge": merge, "selected": true, "offset": scrub, "proportional": proportional}),
+            json!({"layer": self.layer.id.0, "prop": self.uid, "value": v, "merge": merge, "selected": true, "offset": self.scrub, "proportional": self.proportional}),
         ))
-    };
-    let is_3d = layer.is_3d();
-    let mut x = at.x;
-    let y = at.y - 9.0;
+    }
+}
+
+/// Inline value editor for a property row; pushes `prop.set` actions. Returns the rects of a
+/// multi-dimension value's fields, one per dimension (none for other values).
+fn value_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, value: &Value, actions: &mut Vec<(String, serde_json::Value)>) -> Vec<Rect> {
     match value {
-        Value::Scalar(v) => {
-            let (min, max, dec, speed) = match &prop.ui {
-                ParamUi::Slider { min, max, decimals, .. } => (*min, *max, *decimals as usize, ((max - min) / 400.0).clamp(0.01, 10.0)),
-                ParamUi::Percent => (-1e6, 1e6, 1, 0.5),
-                _ => (-1e9, 1e9, 1, 1.0),
-            };
-            if matches!(prop.ui, ParamUi::Angle) {
-                let (rr, dr, nv) = super::fx_widgets::angle_field(ui, pos2(x, y), egui::Id::new(("v", uid, 0)), *v, 1, &t);
-                app.auto.add(&format!("timeline.prop.{uid}.value"), dr, &prop.name);
-                app.auto.add(&format!("timeline.prop.{uid}.revolutions"), rr, &prop.name);
-                if let Some(nv) = nv {
-                    set(actions, json!(nv));
-                }
-            } else {
-                let suffix = if matches!(prop.ui, ParamUi::Percent) || prop.match_id == "opacity" { "%" } else { "" };
-                let (r, nv, _) = widgets::hot_number_at(ui, pos2(x, y), egui::Id::new(("v", uid, 0)), *v, speed, (min, max), dec.max(1), suffix, &t);
-                app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
-                if let Some(nv) = nv {
-                    set(actions, json!(nv));
-                }
-            }
-        }
-        Value::Vec2(_) | Value::Vec3(_) => {
-            let c = value.components();
-            let n = if prop.shown_dims > 0 && !(is_3d && c.len() == 3) { prop.shown_dims as usize } else { c.len() };
-            let pct = matches!(prop.ui, ParamUi::Percent);
-            // Mask Feather: two linked values, never negative (as in After Effects, #203).
-            let feather = prop.match_id == "feather" && layer.props.parent_of(uid).is_some_and(|g| matches!(g.kind, GroupKind::Mask { .. }));
-            let range = if feather { (0.0, 1e9) } else { (-1e9, 1e9) };
-            // Scale and Mask Feather: the chain link (Constrain Proportions, on by default).
-            let linkable = feather || (pct && prop.match_id == "scale");
-            let linked = linkable && !app.ui.timeline.unlinked.contains(&uid);
-            if linkable {
-                let lr = Rect::from_center_size(pos2(x + 7.0, at.y), vec2(14.0, 14.0));
-                let resp = ui.interact(lr, egui::Id::new(("tl-link", uid)), Sense::click()).on_hover_text(crate::i18n::tr("Constrain Proportions"));
-                icons::paint(p, lr, Icon::Link, if linked { t.accent } else { t.text_faint });
-                app.auto.add(&format!("timeline.prop.{uid}.link"), lr, "Constrain Proportions");
-                if resp.clicked() && !app.ui.timeline.unlinked.remove(&uid) {
-                    app.ui.timeline.unlinked.insert(uid);
-                }
-                x += 18.0;
-            }
-            for d in 0..n.min(c.len()) {
-                let suffix = if pct && d + 1 == n { "%" } else { "" };
-                let (r, nv, _) = widgets::hot_number_at(ui, pos2(x, y), egui::Id::new(("v", uid, d)), c[d], if pct { 0.5 } else { 1.0 }, range, 1, suffix, &t);
-                app.auto.add(&format!("timeline.prop.{uid}.value.{d}"), r, &prop.name);
-                dims.push(r);
-                if let Some(nv) = nv {
-                    let mut nc = c.clone();
-                    // Alt edits one value of a linked pair (Ctrl+Alt is a proportional scrub).
-                    let shown = if linked && !ui.input(|i| i.modifiers.alt && !widgets::proportional_scrub(i.modifiers)) { n.min(c.len()) } else { 1 };
-                    let from = if shown == 1 { d } else { 0 };
-                    for (e, v) in widgets::constrained(c.get(from..from + shown).unwrap_or_default(), d - from, nv).into_iter().enumerate() {
-                        if let Some(slot) = nc.get_mut(from + e) {
-                            *slot = v;
-                        }
-                    }
-                    set(actions, json!(nc));
-                    // Typed into these components only: other selected layers keep the rest of
-                    // their own value (#1434).
-                    if let Some((_, a)) = actions.last_mut() {
-                        a["dims"] = json!((from..from + shown).collect::<Vec<_>>());
-                    }
-                }
-                x = r.max.x + if d + 1 < n { 2.0 } else { 0.0 };
-                if d + 1 < n {
-                    p.text(pos2(x, at.y), Align2::LEFT_CENTER, ",", Tokens::ui(12.0), t.hot_text);
-                    x += 6.0;
-                }
-            }
-        }
-        Value::Color(c) => {
-            let r = Rect::from_min_size(pos2(x, at.y - 7.0), vec2(26.0, 14.0));
-            let resp = widgets::swatch(ui, r, [c[0] as f32, c[1] as f32, c[2] as f32, 1.0], egui::Id::new(("sw", uid)), &t);
-            app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
-            let pop = egui::Id::new(("cpop", uid));
-            if resp.clicked() {
-                widgets::open_popup(ui, pop);
-            }
-            // The eyedropper after the swatch samples the Composition panel (shape Fill and
-            // Stroke colours, text and effect colours), as in After Effects' Timeline (#633).
-            let er = Rect::from_center_size(pos2(r.max.x + 12.0, at.y), vec2(16.0, 16.0));
-            let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == "color");
-            if super::fx_widgets::eyedropper_button(ui, er, active, egui::Id::new(("tl-eye", uid)), &t)
-                .on_hover_text(crate::i18n::tr("Eyedropper: click, then click in the Composition panel"))
-                .clicked()
-            {
-                super::effect_controls::toggle_pick(app, "color", layer, prop);
-            }
-            app.auto.add(&format!("timeline.prop.{uid}.eyedropper"), er, &prop.name);
-            let mut rgb = [c[0] as f32, c[1] as f32, c[2] as f32];
-            if crate::widgets::color_popup(ui, pop, r.left_bottom(), &mut rgb) {
-                set(actions, json!([rgb[0], rgb[1], rgb[2], 1.0]));
-            }
-        }
-        Value::Bool(b) => {
-            let r = Rect::from_min_size(pos2(x, at.y - 8.0), vec2(16.0, 16.0));
-            if widgets::checkbox(ui, r, *b, &t, egui::Id::new(("cb", uid))).clicked() {
-                set(actions, json!(!b));
-            }
-            app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
-        }
-        Value::Enum(i) => {
-            // Text Path Options ▸ Path lists the layer's masks.
-            let mask_opts: Option<Vec<String>> = layer
-                .props
-                .prop("text/pathOptions/path")
-                .filter(|q| q.uid == uid)
-                .map(|_| std::iter::once("None".to_string()).chain(layer.masks().into_iter().flat_map(|m| m.groups().map(|g| g.name.clone()))).collect());
-            let ui_opts = mask_opts.map(|options| ParamUi::Popup { options });
-            if let ParamUi::Popup { options } = ui_opts.as_ref().unwrap_or(&prop.ui) {
-                let r = Rect::from_min_size(pos2(x, at.y - 9.0), vec2(150.0, 18.0));
-                let label = options.get(*i as usize).cloned().unwrap_or_default();
-                let pop = egui::Id::new(("epop", uid));
-                if widgets::dropdown(ui, r, &label, &t, egui::Id::new(("en", uid))).clicked() {
-                    widgets::open_popup(ui, pop);
-                }
-                app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
-                if let Some(ni) = widgets::popup_menu(ui, pop, r.left_bottom(), options, Some(*i as usize)) {
-                    set(actions, json!(ni));
-                }
-            } else {
-                p.text(pos2(x, at.y), Align2::LEFT_CENTER, fmt_num(*i as f64, 0), Tokens::ui(12.0), t.hot_text);
-            }
-        }
+        Value::Scalar(_) => scalar_editor(app, ui, ve, actions, value),
+        Value::Vec2(_) | Value::Vec3(_) => return vector_editor(app, ui, ve, actions, value),
+        Value::Color(_) => color_editor(app, ui, ve, actions, value),
+        Value::Bool(_) => bool_editor(app, ui, ve, actions, value),
+        Value::Enum(_) => enum_editor(app, ui, ve, actions, value),
+        Value::Layer(_) => layer_editor(app, ui, ve, actions, value),
+        Value::Gradient(_) => gradient_editor(app, ui, ve, actions),
         Value::Path(_) => {
-            p.text(pos2(x, at.y), Align2::LEFT_CENTER, crate::i18n::tr("Shape…"), Tokens::ui(12.0), t.hot_text);
+            ve.p.text(pos2(ve.at.x, ve.at.y), Align2::LEFT_CENTER, crate::i18n::tr("Shape…"), Tokens::ui(12.0), app.tokens.hot_text);
         }
         Value::Text(_) => {}
-        Value::Layer(l) => {
-            p.text(
-                pos2(x, at.y),
-                Align2::LEFT_CENTER,
-                l.map(|l| crate::i18n::tr_args("Layer {}", &[&l])).unwrap_or(crate::i18n::tr("None").into()),
-                Tokens::ui(12.0),
-                t.hot_text,
-            );
-        }
-        Value::Gradient(_) => {
-            // Opens the Gradient Editor at the current time (#612).
-            let r = p.text(pos2(x, at.y), Align2::LEFT_CENTER, crate::i18n::tr("Edit Gradient…"), Tokens::ui(12.0), t.hot_text);
-            let resp = ui.interact(r.expand(2.0), egui::Id::new(("gradient-edit", uid)), Sense::click());
-            if resp.hovered() {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
-            }
-            app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
-            if resp.clicked() {
-                actions.push(("prop.editGradient".into(), json!({"layer": layer.id.0, "prop": uid})));
-            }
-        }
         Value::Str(s) => {
-            p.text(pos2(x, at.y), Align2::LEFT_CENTER, s.chars().take(30).collect::<String>(), Tokens::ui(12.0), t.text_dim);
+            ve.p.text(pos2(ve.at.x, ve.at.y), Align2::LEFT_CENTER, s.chars().take(30).collect::<String>(), Tokens::ui(12.0), app.tokens.text_dim);
+        }
+    }
+    Vec::new()
+}
+
+/// A number: scrubbable hot text, or the angle field.
+fn scalar_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>, value: &Value) {
+    let Value::Scalar(v) = value else { return };
+    let (layer, prop, at, uid) = (ve.layer, ve.prop, ve.at, ve.uid);
+    // The values themselves: red while an expression drives the property (#1306).
+    let vt = app.tokens.for_value(prop.has_expression());
+    let (x, y) = (at.x, at.y - 9.0);
+    let (min, max, dec, speed) = match &prop.ui {
+        ParamUi::Slider { min, max, decimals, .. } => (*min, *max, *decimals as usize, widgets::slider_scrub_speed(&prop.ui)),
+        ParamUi::Percent => (-1e6, 1e6, 1, 0.5),
+        _ => (-1e9, 1e9, 1, 1.0),
+    };
+    if matches!(prop.ui, ParamUi::Angle) {
+        let (rr, dr, nv) = super::fx_widgets::angle_field(ui, pos2(x, y), egui::Id::unique(("v", uid, 0)), *v, 1, &vt);
+        app.auto.add(&format!("timeline.prop.{uid}.value"), dr, &prop.name);
+        app.auto.add(&format!("timeline.prop.{uid}.revolutions"), rr, &prop.name);
+        if let Some(nv) = nv {
+            ve.set(actions, json!(nv));
+        }
+    } else {
+        // A Range Selector's Start, End and Offset count characters with Units = Index (#1814).
+        let pct = (matches!(prop.ui, ParamUi::Percent) || prop.match_id == "opacity") && !effectcraft_engine::render::text::in_index_units(layer, uid);
+        let suffix = if pct { "%" } else { "" };
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(x, y),
+            egui::Id::unique(("v", uid, 0)),
+            *v,
+            &widgets::HotSpec { speed, range: (min, max), decimals: dec.max(1), suffix },
+            &vt,
+        );
+        app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
+        if let Some(nv) = nv {
+            ve.set(actions, json!(nv));
+        }
+    }
+}
+
+/// A multi-dimension value: one hot-text field per dimension, with the link chain. Returns their rects.
+fn vector_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>, value: &Value) -> Vec<Rect> {
+    let (p, layer, prop, at, uid) = (ve.p, ve.layer, ve.prop, ve.at, ve.uid);
+    let t = app.tokens;
+    let vt = t.for_value(prop.has_expression());
+    let (mut x, y) = (at.x, at.y - 9.0);
+    let is_3d = layer.is_3d();
+    let mut dims = vec![];
+    let c = value.components();
+    let n = if prop.shown_dims > 0 && !(is_3d && c.len() == 3) { prop.shown_dims as usize } else { c.len() };
+    let pct = matches!(prop.ui, ParamUi::Percent);
+    // Mask Feather: two linked values, never negative (as in After Effects, #203).
+    let feather = prop.match_id == "feather" && layer.props.parent_of(uid).is_some_and(|g| matches!(g.kind, GroupKind::Mask { .. }));
+    let range = if feather { (0.0, 1e9) } else { (-1e9, 1e9) };
+    // Audio Levels link their two channels too, off by default, by the same dB change (#2485).
+    let levels = prop.match_id == "levels" && layer.props.parent_of(uid).is_some_and(|g| g.match_id == "audio");
+    // Scale and Mask Feather: the chain link (Constrain Proportions, on by default).
+    // Rectangle and Ellipse Path Size have it too, off by default (#2489).
+    let size = prop.match_id == "size" && layer.props.parent_of(uid).is_some_and(|g| matches!(g.match_id.as_str(), "rect" | "ellipse"));
+    let linkable = feather || size || levels || (pct && prop.match_id == "scale");
+    let linked = linkable && app.ui.timeline.is_linked(uid, !(size || levels));
+    if linkable {
+        let lr = Rect::from_center_size(pos2(x + 7.0, at.y), vec2(14.0, 14.0));
+        let label = if levels { "Link Channels" } else { "Constrain Proportions" };
+        let resp = ui.interact(lr, egui::Id::unique(("tl-link", uid)), Sense::click()).on_hover_text(crate::i18n::tr(label));
+        icons::paint(p, lr, Icon::Link, if linked { t.accent } else { t.text_faint });
+        app.auto.add(&format!("timeline.prop.{uid}.link"), lr, label);
+        if resp.clicked() {
+            app.ui.timeline.toggle_link(uid, !(size || levels));
+        }
+        x += 18.0;
+    }
+    for d in 0..n.min(c.len()) {
+        let suffix = if pct && d + 1 == n { "%" } else { "" };
+        let (r, nv, _) = widgets::hot_number_at(
+            ui,
+            pos2(x, y),
+            egui::Id::unique(("v", uid, d)),
+            c[d],
+            &widgets::HotSpec { speed: if pct { 0.5 } else { 1.0 }, range, decimals: 1, suffix },
+            &vt,
+        );
+        app.auto.add(&format!("timeline.prop.{uid}.value.{d}"), r, &prop.name);
+        dims.push(r);
+        if let Some(nv) = nv {
+            let mut nc = c.clone();
+            // Alt edits one value of a linked pair (Ctrl+Alt is a proportional scrub).
+            let shown = if linked && !ui.input(|i| i.modifiers.alt && !widgets::proportional_scrub(i.modifiers)) { n.min(c.len()) } else { 1 };
+            let from = if shown == 1 { d } else { 0 };
+            let link = if levels { widgets::shifted } else { widgets::constrained };
+            for (e, v) in link(c.get(from..from + shown).unwrap_or_default(), d - from, nv).into_iter().enumerate() {
+                if let Some(slot) = nc.get_mut(from + e) {
+                    *slot = v;
+                }
+            }
+            ve.set(actions, json!(nc));
+            // Typed into these components only: other selected layers keep the rest of
+            // their own value (#1434).
+            // Linked Audio Levels: the typed channel, the other following by that layer's own
+            // change, so each keeps its balance (#2485).
+            if let Some((_, a)) = actions.last_mut() {
+                if levels {
+                    a["dims"] = json!([d]);
+                    a["follow"] = json!((from..from + shown).filter(|&e| e != d).collect::<Vec<_>>());
+                } else {
+                    a["dims"] = json!((from..from + shown).collect::<Vec<_>>());
+                }
+            }
+        }
+        x = r.max.x + if d + 1 < n { 2.0 } else { 0.0 };
+        if d + 1 < n {
+            p.text(pos2(x, at.y), Align2::LEFT_CENTER, ",", Tokens::ui(12.0), vt.hot_text);
+            x += 6.0;
         }
     }
     dims
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Alt/Cmd-click twirls Audio's Waveform row (not in the property tree) with the rest.
-    #[test]
-    fn the_waveform_row_twirls_with_its_tree() {
-        let mut root = PropGroup::new(1, "", "");
-        let mut audio = PropGroup::new(2, "audio", "Audio");
-        audio.children.push(PropGroup::new(3, "x", "X").into());
-        root.children.push(audio.into());
-        let mut uids = vec![];
-        walk_groups(&root, &mut uids);
-        assert_eq!(uids, vec![2, WAVE_BIT | 2, 3]);
-        let mut uids = vec![];
-        walk_groups(find_group(&root, 2).unwrap(), &mut uids);
-        assert_eq!(uids, vec![WAVE_BIT | 2, 3]);
+/// A colour: swatch, eyedropper and picker.
+fn color_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>, value: &Value) {
+    let Value::Color(c) = value else { return };
+    let (layer, prop, at, uid) = (ve.layer, ve.prop, ve.at, ve.uid);
+    let t = app.tokens;
+    let x = at.x;
+    let r = Rect::from_min_size(pos2(x, at.y - 7.0), vec2(26.0, 14.0));
+    let resp = widgets::swatch(ui, r, [c[0] as f32, c[1] as f32, c[2] as f32, 1.0], egui::Id::unique(("sw", uid)), &t);
+    app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
+    let pop = egui::Id::unique(("cpop", uid));
+    if resp.clicked() {
+        widgets::open_popup(ui, pop);
     }
-
-    /// #710: with Time Display set to Frames the ruler labels are frame numbers (as under the
-    /// CTI, from Start Numbering Frames At); otherwise seconds:frames.
-    #[test]
-    fn ruler_labels_follow_the_time_display_style() {
-        use effectcraft_engine::project::{ProjectSettings, TimeDisplayStyle};
-        let mut st = ProjectSettings { time_display: TimeDisplayStyle::Timecode, frame_start: 0, ..ProjectSettings::default() };
-        assert_eq!(ruler_label(15, 30, &st), "00:15f");
-        assert_eq!(ruler_label(45, 30, &st), "01:15f");
-        assert_eq!(ruler_label(30 * 3600 + 31, 30, &st), "60:01:01f");
-        st.time_display = TimeDisplayStyle::Frames;
-        assert_eq!(ruler_label(0, 30, &st), "00000");
-        assert_eq!(ruler_label(45, 30, &st), "00045");
-        st.frame_start = 1;
-        assert_eq!(ruler_label(45, 30, &st), "00046");
-        assert_eq!(ruler_label(i64::MAX, 30, &st), format!("{:05}", i64::MAX));
+    // The eyedropper after the swatch samples the Composition panel (shape Fill and
+    // Stroke colours, text and effect colours), as in After Effects' Timeline (#633).
+    let er = Rect::from_center_size(pos2(r.max.x + 12.0, at.y), vec2(16.0, 16.0));
+    let active = app.ui.fx_pick.as_ref().is_some_and(|k| k.prop == uid && k.kind == "color");
+    if super::fx_widgets::eyedropper_button(ui, er, active, egui::Id::unique(("tl-eye", uid)), &t)
+        .on_hover_text(crate::i18n::tr("Eyedropper: click, then click in the Composition panel"))
+        .clicked()
+    {
+        super::effect_controls::toggle_pick(app, "color", layer, prop);
     }
-
-    /// #468: playback pages the view to the CTI; a scrub past either end scrolls that way.
-    #[test]
-    fn the_view_pages_to_the_cti() {
-        assert_eq!(page_to_cti(10.0, 5.0, 60.0, 12.0), 10.0, "in view: unchanged");
-        assert_eq!(page_to_cti(10.0, 5.0, 60.0, 16.0), 16.0, "past the right end: the page from the CTI");
-        assert_eq!(page_to_cti(10.0, 5.0, 60.0, 3.0), 3.0, "before the start");
-        assert_eq!(page_to_cti(10.0, 5.0, 60.0, 58.0), 55.0, "not past the comp's end");
-        assert_eq!(page_to_cti(10.0, 80.0, 60.0, 95.0), 0.0);
-        assert_eq!(page_to_cti(10.0, f64::NAN, 60.0, 95.0), 10.0);
-        assert_eq!(edge_scroll_speed_x(100.0, 500.0, 300.0), 0.0);
-        assert!(edge_scroll_speed_x(100.0, 500.0, 501.0) > 0.0 && edge_scroll_speed_x(100.0, 500.0, 99.0) < 0.0);
-        assert!(edge_scroll_speed_x(100.0, 500.0, 600.0) > edge_scroll_speed_x(100.0, 500.0, 520.0));
-    }
-
-    /// #864: picking only a mode in a layer's Track Matte menu sets a matte (the layer above);
-    /// it used to close the menu and change nothing.
-    #[test]
-    fn a_track_matte_mode_without_a_matte_takes_the_layer_above() {
-        let mut s = effectcraft_engine::Session::default();
-        s.execute("comp.new", json!({"name": "T", "width": 64, "height": 64, "duration": 1})).unwrap();
-        for name in ["Chain Bottom", "Matte", "Chain Top"] {
-            s.execute("layer.newSolid", json!({"name": name, "color": "#ffffff", "width": 64, "height": 64})).unwrap();
-        }
-        let find = |s: &effectcraft_engine::Session, n: &str| s.active_comp().unwrap().layers.iter().find(|l| l.name == n).unwrap().clone();
-        let (bottom, matte, top) = (find(&s, "Chain Bottom"), find(&s, "Matte"), find(&s, "Chain Top"));
-        let candidates = [top.id, matte.id];
-        let pick = |s: &mut effectcraft_engine::Session, name: &str, i: usize, choice: &str| {
-            let (id, params) = track_matte_pick(&find(s, name), &candidates, i, choice).expect("a menu item is an action");
-            s.execute(&id, params)
-        };
-        pick(&mut s, "Chain Bottom", 5, "Alpha Inverted Matte").unwrap();
-        let m = find(&s, "Chain Bottom").track_matte.expect("a matte");
-        assert_eq!((m.layer, m.kind), (matte.id, MatteKind::AlphaInverted));
-        assert!(!find(&s, "Matte").switches.video, "the matte layer is hidden");
-        // A mode change keeps the matte layer; a matte change keeps the mode.
-        pick(&mut s, "Chain Bottom", 6, "Luma Matte").unwrap();
-        assert_eq!(find(&s, "Chain Bottom").track_matte.map(|m| (m.layer, m.kind)), Some((matte.id, MatteKind::Luma)));
-        pick(&mut s, "Chain Bottom", 2, "1. Chain Top").unwrap();
-        assert_eq!(find(&s, "Chain Bottom").track_matte.map(|m| (m.layer, m.kind)), Some((top.id, MatteKind::Luma)));
-        assert!(s.undo());
-        assert_eq!(find(&s, "Chain Bottom").track_matte.map(|m| m.layer), Some(matte.id), "one undo step per pick");
-        // The top layer has nothing above it: an error for the status bar, not a silent no-op.
-        assert!(pick(&mut s, "Chain Top", 5, "Alpha Matte").is_err());
-        pick(&mut s, "Chain Bottom", 0, "No Track Matte").unwrap();
-        assert!(find(&s, "Chain Bottom").track_matte.is_none());
-        assert!(track_matte_pick(&bottom, &candidates, 1, "-").is_none(), "a separator does nothing");
-    }
-
-    /// #957: vector footage gets the Continuously Rasterize switch; raster footage does not.
-    #[test]
-    fn collapse_switch_shows_for_vector_footage_only() {
-        use effectcraft_engine::color::Label;
-        use effectcraft_engine::project::{Footage, ItemKind, Project};
-        let mut p = Project::default();
-        let mut layer_for = |name: &str, codec: &str| {
-            let footage = Footage { path: name.into(), codec: codec.into(), ..Default::default() };
-            let item = p.add_item(name, Label::SeaFoam, None, ItemKind::Footage(footage));
-            let comp = Comp::new(64, 36, effectcraft_engine::time::FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
-            effectcraft_engine::project::build::layer(&mut p, &comp, name, LayerSource::Footage { item }, (0, 0), None)
-        };
-        let svg = layer_for("logo.svg", "SVG");
-        let png = layer_for("photo.png", "PNG");
-        assert!(collapse_applies(&svg, &p));
-        assert!(!collapse_applies(&png, &p));
-    }
-
-    /// A comp with two solids; "Box" has an animated Position and a Gaussian Blur.
-    fn app() -> EffectcraftApp {
-        let mut s = effectcraft_engine::Session::default();
-        s.execute("comp.new", json!({"name": "T", "width": 320, "height": 180, "duration": 4})).unwrap();
-        s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080", "width": 320, "height": 180})).unwrap();
-        s.execute("layer.newSolid", json!({"name": "Box", "color": "#e04020", "width": 40, "height": 40})).unwrap();
-        let comp = s.active_comp().unwrap();
-        let bx = comp.layers.iter().find(|l| l.name == "Box").unwrap().id.0;
-        s.execute("layer.select", json!({"layers": [bx]})).unwrap();
-        s.execute("effect.apply", json!({"effect": "ec.blur.gaussian"})).unwrap();
-        let pos = s.active_comp().unwrap().layer(LayerId(bx)).unwrap().transform().unwrap().get("position").unwrap().uid;
-        s.execute("prop.toggleAnimation", json!({"layer": bx, "prop": pos})).unwrap();
-        EffectcraftApp::new(s)
-    }
-
-    fn labels(app: &EffectcraftApp) -> Vec<String> {
-        let comp = app.session.active_comp().unwrap().clone();
-        build_rows(app, &comp)
-            .into_iter()
-            .map(|r| {
-                let l = comp.layer(r.layer).unwrap();
-                match r.kind {
-                    RowKind::Layer => l.name.clone(),
-                    RowKind::Group { name, .. } => format!("{}>{name}", "  ".repeat(r.depth)),
-                    RowKind::Prop { uid } => format!("{}{}", "  ".repeat(r.depth), l.props.find(uid).unwrap().name),
-                    _ => "?".into(),
-                }
-            })
-            .collect()
-    }
-
-    #[test]
-    fn search_filters_layers_and_reveals_matching_properties() {
-        let mut app = app();
-        app.ui.timeline.search = "opac".into();
-        let rows = labels(&app);
-        // Both layers have Transform > Opacity; nothing else shows.
-        assert_eq!(rows.iter().filter(|r| r.trim() == "Opacity").count(), 2, "{rows:?}");
-        assert!(rows.iter().any(|r| r.trim() == ">Transform"), "{rows:?}");
-        assert!(!rows.iter().any(|r| r.trim() == "Position"), "{rows:?}");
-        // A layer name match shows the layer alone; a group match brings its contents.
-        app.ui.timeline.search = "plate".into();
-        assert_eq!(labels(&app), vec!["Plate".to_string()]);
-        app.ui.timeline.search = "GAUSSIAN".into();
-        let rows = labels(&app);
-        assert_eq!(rows[0], "Box");
-        assert!(rows.iter().any(|r| r.trim() == ">Effects") && rows.iter().any(|r| r.trim() == "Blurriness"), "{rows:?}");
-        assert!(!rows.contains(&"Plate".to_string()));
-        // Nothing matches → no rows.
-        app.ui.timeline.search = "zzz".into();
-        assert!(labels(&app).is_empty());
-        // Through the command.
-        let ctx = egui::Context::default();
-        crate::menus::invoke(&mut app, &ctx, "timeline.search", json!({"query": "scale"})).unwrap();
-        assert!(labels(&app).iter().any(|r| r.trim() == "Scale"));
-    }
-
-    #[test]
-    fn columns_toggle_and_layout() {
-        let mut app = app();
-        let tl = &mut app.ui.timeline;
-        assert!(column_visible(tl, "switches") && !column_visible(tl, "comment") && !column_visible(tl, "modes"));
-        set_column(tl, "comment", true).unwrap();
-        set_column(tl, "stretch", true).unwrap();
-        set_column(tl, "keys", false).unwrap();
-        set_column(tl, "label", false).unwrap();
-        set_column(tl, "modes", true).unwrap();
-        assert!(tl.show_modes && column_visible(tl, "comment") && !column_visible(tl, "label"));
-        assert!(set_column(tl, "name", false).is_err());
-        assert!(set_column(tl, "bogus", true).is_err());
-        let vis = Vis::of(tl);
-        let cw = cols(0.0, 1400.0, vis);
-        // Hidden columns take no room; visible ones are in After Effects' order.
-        assert_eq!(cw.keys, cw.label);
-        assert_eq!(cw.label, cw.num);
-        assert!(cw.name < cw.comment && cw.comment < cw.switches && cw.switches < cw.mode && cw.parent < cw.stretch);
-        assert_eq!(column_at(&cw, cw.comment + 5.0), Some("comment"));
-        assert_eq!(column_at(&cw, cw.name + 5.0), Some("name"));
-        assert_eq!(column_at(&cw, cw.stretch + 5.0), Some("stretch"));
-        // Through the command (as agents do).
-        let ctx = egui::Context::default();
-        let r = crate::menus::invoke(&mut app, &ctx, "timeline.column", json!({"column": "duration"})).unwrap();
-        assert!(r["columns"].as_array().unwrap().iter().any(|c| c == "duration"));
-        crate::menus::invoke(&mut app, &ctx, "timeline.column", json!({"column": "duration", "visible": false})).unwrap();
-        assert!(!column_visible(&app.ui.timeline, "duration"));
-        crate::menus::invoke(&mut app, &ctx, "timeline.sourceName", json!({})).unwrap();
-        assert!(app.ui.timeline.source_name);
-    }
-
-    #[test]
-    fn reveal_keys_add_with_shift_and_uu_reveals_modified() {
-        let mut app = app();
-        let ctx = egui::Context::default();
-        crate::menus::invoke(&mut app, &ctx, "timeline.reveal.opacity", json!({})).unwrap();
-        assert_eq!(app.ui.timeline.reveal, vec!["opacity"]);
-        crate::menus::invoke(&mut app, &ctx, "timeline.revealAdd.scale", json!({})).unwrap();
-        crate::menus::invoke(&mut app, &ctx, "timeline.revealAdd.effects", json!({})).unwrap();
-        assert_eq!(app.ui.timeline.reveal, vec!["opacity", "scale", "effects"]);
-        let rows = labels(&app);
-        assert!(rows.iter().any(|r| r.trim() == "Scale") && rows.iter().any(|r| r.trim() == "Opacity"), "{rows:?}");
-        assert!(rows.iter().any(|r| r.trim() == ">Gaussian Blur"), "{rows:?}");
-        // Tree order: Scale before Opacity.
-        let si = rows.iter().position(|r| r.trim() == "Scale").unwrap();
-        let oi = rows.iter().position(|r| r.trim() == "Opacity").unwrap();
-        assert!(si < oi);
-        // Shift+S again removes Scale.
-        crate::menus::invoke(&mut app, &ctx, "timeline.revealAdd.scale", json!({})).unwrap();
-        assert_eq!(app.ui.timeline.reveal, vec!["opacity", "effects"]);
-        // U: keyframed properties (Position); UU (twice quickly): every modified property.
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        let n_keys = app.ui.timeline.reveal_props.len();
-        assert_eq!(app.ui.timeline.reveal, vec!["props"]);
-        assert!(n_keys >= 1);
-        let bx = app.session.state.selected_layers[0].0;
-        app.session.execute("prop.set", json!({"layer": bx, "path": "effects/#1/blurriness", "value": 12})).unwrap();
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        assert!(app.ui.timeline.reveal_props.len() > n_keys, "UU reveals modified properties too");
-    }
-
-    #[test]
-    fn scroll_to_time_centres_the_current_time_inside_the_comp() {
-        assert_eq!(centered_on(4.0, 10.0, 5.0), 3.0);
-        // Near the ends the view stops at the comp's start and end.
-        assert_eq!(centered_on(4.0, 10.0, 1.0), 0.0);
-        assert_eq!(centered_on(4.0, 10.0, 9.5), 6.0);
-        // A span longer than the comp, and bad numbers, start at zero.
-        assert_eq!(centered_on(20.0, 10.0, 5.0), 0.0);
-        assert_eq!(centered_on(f64::NAN, 10.0, 5.0), 0.0);
-    }
-
-    /// U and the other reveal shortcuts act on the selected layers only: other layers keep their
-    /// twirl state and their own reveal (#160).
-    #[test]
-    fn reveal_shortcuts_leave_unselected_layers_alone() {
-        let mut app = app();
-        let ctx = egui::Context::default();
-        let comp = app.session.active_comp().unwrap().clone();
-        let id = |n: &str| comp.layers.iter().find(|l| l.name == n).unwrap().id.0;
-        let (plate, bx) = (id("Plate"), id("Box"));
-        let select = |app: &mut EffectcraftApp, l: u64| app.session.execute("layer.select", json!({"layers": [l]})).unwrap();
-        // Plate shows Scale (S); then U on Box.
-        select(&mut app, plate);
-        crate::menus::invoke(&mut app, &ctx, "timeline.reveal.scale", json!({})).unwrap();
-        select(&mut app, bx);
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        let tl = &app.ui.timeline;
-        assert!(tl.open_layers.contains(&plate) && tl.open_layers.contains(&bx), "{:?}", tl.open_layers);
-        assert_eq!(tl.layer_reveal.get(&plate), Some(&vec!["scale".to_string()]), "Plate keeps its reveal");
-        assert_eq!(tl.layer_reveal.get(&bx), Some(&vec!["props".to_string()]));
-        let rows = labels(&app);
-        let at = |n: &str| rows.iter().position(|r| r == n).unwrap();
-        assert_eq!(rows[at("Plate") + 1].trim(), "Scale", "{rows:?}");
-        assert_eq!(rows[at("Box") + 1].trim(), "Position", "{rows:?}");
-        // UU (modified): the effect's changed parameter only, under the effect twirled open.
-        // Then U later: Box shows its keyframed properties only again.
-        app.session.execute("prop.set", json!({"layer": bx, "path": "effects/#1/blurriness", "value": 12})).unwrap();
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        let rows = labels(&app);
-        let fx = rows.iter().position(|r| r.trim().ends_with("Gaussian Blur")).unwrap_or_else(|| panic!("UU shows the effect: {rows:?}"));
-        assert_eq!(rows[fx + 1].trim(), "Blurriness", "{rows:?}");
-        assert!(!rows.iter().any(|r| r.trim() == "Blur Dimensions"), "unchanged parameters stay hidden: {rows:?}");
-        // Collapsed and expanded by hand, the effect shows all its parameters; UU filters again.
-        let fx_uid = app.session.active_comp().unwrap().layer(LayerId(bx)).unwrap().effects().unwrap().groups().next().unwrap().uid;
-        app.ui.timeline.toggle_group(bx, fx_uid);
-        assert!(!labels(&app).iter().any(|r| r.trim() == "Blurriness"), "collapsed");
-        app.ui.timeline.toggle_group(bx, fx_uid);
-        let rows = labels(&app);
-        assert!(rows.iter().any(|r| r.trim() == "Blurriness") && rows.iter().any(|r| r.trim() == "Blur Dimensions"), "{rows:?}");
-        app.last_reveal = Some(("keyframes".into(), f64::MAX));
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        assert!(!labels(&app).iter().any(|r| r.trim() == "Blur Dimensions"), "UU again shows the changed ones only");
-        app.last_reveal = Some(("keyframes".into(), -10.0));
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        app.last_reveal = Some(("keyframes".into(), -10.0));
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        let rows = labels(&app);
-        assert!(!rows.iter().any(|r| r.trim() == ">Gaussian Blur") && rows.iter().any(|r| r.trim() == "Position"), "{rows:?}");
-        // U again on Box (later than a double press) hides only Box's.
-        app.last_reveal = Some(("keyframes".into(), -10.0));
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        let tl = &app.ui.timeline;
-        assert!(!tl.open_layers.contains(&bx) && tl.open_layers.contains(&plate), "{:?}", tl.open_layers);
-        // A layer twirled open by hand shows its whole tree, whatever was revealed elsewhere.
-        app.session.execute("layer.select", json!({"layers": []})).unwrap();
-        app.ui.timeline.open_layers.insert(bx);
-        let rows = labels(&app);
-        assert!(rows.iter().any(|r| r.trim() == ">Transform"), "{rows:?}");
-    }
-
-    /// U and UU show Time Remap on a layer with time remapping enabled.
-    #[test]
-    fn u_and_uu_reveal_time_remap() {
-        let mut s = effectcraft_engine::Session::default();
-        let inner = s.execute("comp.new", json!({"name": "Inner", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
-        s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
-        let nested = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
-        let mut app = EffectcraftApp::new(s);
-        let ctx = egui::Context::default();
-        crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({"layers": [nested]})).unwrap();
-        app.session.execute("layer.select", json!({"layers": [nested]})).unwrap();
-        for uu in [false, true] {
-            app.ui.timeline.layer_reveal.clear();
-            app.last_reveal = uu.then(|| ("keyframes".into(), f64::MAX));
-            crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-            assert_eq!(app.ui.timeline.layer_reveal.get(&nested), Some(&vec!["props".to_string()]), "UU: {uu}");
-            let rows = labels(&app);
-            let at = rows.iter().position(|r| r == "Inner").unwrap();
-            assert_eq!(rows[at + 1].trim(), "Time Remap", "UU: {uu}: {rows:?}");
-        }
-    }
-
-    /// U shows Time Remap while remapping is enabled even after its keys are deleted (#990):
-    /// enabling remapping is itself the modification.
-    #[test]
-    fn u_reveals_keyless_time_remap() {
-        let mut s = effectcraft_engine::Session::default();
-        let inner = s.execute("comp.new", json!({"name": "Inner", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
-        s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
-        let nested = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
-        let mut app = EffectcraftApp::new(s);
-        let ctx = egui::Context::default();
-        crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({"layers": [nested]})).unwrap();
-        let uid = app.session.active_comp().unwrap().layer(LayerId(nested)).unwrap().props.prop("timeRemap").unwrap().uid;
-        for _ in 0..2 {
-            let t = app.session.active_comp().unwrap().layer(LayerId(nested)).unwrap().props.prop("timeRemap").unwrap().keys[0].time.seconds();
-            app.session.execute("keys.select", json!({"keys": [{"layer": nested, "prop": uid, "time": t}]})).unwrap();
-            app.session.execute("edit.clear", json!({})).unwrap();
-        }
-        assert!(app.session.active_comp().unwrap().layer(LayerId(nested)).unwrap().props.prop("timeRemap").unwrap().keys.is_empty());
-        app.session.execute("layer.select", json!({"layers": [nested]})).unwrap();
-        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
-        assert_eq!(app.ui.timeline.layer_reveal.get(&nested), Some(&vec!["props".to_string()]));
-        let rows = labels(&app);
-        let at = rows.iter().position(|r| r == "Inner").unwrap();
-        assert_eq!(rows[at + 1].trim(), "Time Remap", "{rows:?}");
-    }
-
-    /// Enabling time remapping twirls the layer open on Time Remap (#157); disabling it reveals
-    /// nothing.
-    #[test]
-    fn enabling_time_remapping_reveals_time_remap() {
-        let mut s = effectcraft_engine::Session::default();
-        let inner = s.execute("comp.new", json!({"name": "Inner", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
-        s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
-        s.execute("layer.newSolid", json!({"name": "Other"})).unwrap();
-        let nested = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
-        let mut app = EffectcraftApp::new(s);
-        let ctx = egui::Context::default();
-        crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({"layers": [nested]})).unwrap();
-        assert_eq!(app.ui.timeline.layer_reveal.get(&nested), Some(&vec!["timeRemap".to_string()]));
-        let rows = labels(&app);
-        let at = rows.iter().position(|r| r == "Inner").unwrap();
-        assert_eq!(rows[at + 1].trim(), "Time Remap", "{rows:?}");
-        // Through the selection (the Layer menu), turning it off again: nothing new is revealed.
-        app.session.execute("layer.select", json!({"layers": [nested]})).unwrap();
-        app.ui.timeline.layer_reveal.clear();
-        crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({})).unwrap();
-        assert!(app.ui.timeline.layer_reveal.is_empty());
-    }
-
-    #[test]
-    fn cti_snaps_to_the_nearest_candidate() {
-        assert_eq!(snap_time(&[0.0, 1.0, 2.0], 1.04, 0.1), 1.0);
-        assert_eq!(snap_time(&[0.0, 1.0, 2.0], 1.5, 0.1), 1.5);
-        assert_eq!(snap_time(&[1.0, 1.1], 1.06, 0.1), 1.1);
-        let app = app();
-        let comp = app.session.active_comp().unwrap().clone();
-        let c = snap_candidates(&comp, &build_rows(&app, &comp));
-        assert!(c.contains(&comp.duration.seconds()) && c.contains(&0.0));
-    }
-
-    /// Every string drawn by one frame of `draw`.
-    fn drawn_text(mut draw: impl FnMut(&mut egui::Ui)) -> Vec<String> {
-        fn collect(shape: &egui::Shape, out: &mut Vec<String>) {
-            match shape {
-                egui::Shape::Text(t) => out.push(t.galley.text().to_string()),
-                egui::Shape::Vec(v) => v.iter().for_each(|s| collect(s, out)),
-                _ => {}
-            }
-        }
-        let ctx = egui::Context::default();
-        ctx.run_ui(Default::default(), |ui| draw(ui)).textures_delta.clear();
-        let mut frame = ctx.run_ui(Default::default(), |ui| draw(ui));
-        frame.textures_delta.clear();
-        let mut out = Vec::new();
-        frame.shapes.iter().for_each(|c| collect(&c.shape, &mut out));
-        out
-    }
-
-    /// #1308: the layer context menu draws its items in the interface language, from the menu
-    /// bar's rows for the same commands (whose ellipsis is `...`), and its Effects submenu draws
-    /// the categories the Effect menu does; the actions it records stay the same.
-    #[test]
-    fn the_layer_context_menu_draws_in_the_interface_language() {
-        let caps = LayerMenuCaps { vector: true, text: false };
-        let (mut auto, mut actions) = (crate::automation::Registry::default(), Vec::new());
-        crate::i18n::set_current("zh-hans");
-        let menu = drawn_text(|ui| layer_menu(ui, &[7], caps, (&mut auto, "t"), &mut actions));
-        let effects = drawn_text(|ui| effects_submenu(ui, &[7], &mut |_: &mut egui::Ui, _: &str, _: &str, _: serde_json::Value| {}));
-        crate::i18n::set_current("en");
-        let english = drawn_text(|ui| layer_menu(ui, &[7], caps, (&mut auto, "t"), &mut actions));
-        for label in ["新建", "图层设置...", "从矢量图层创建形状", "预合成...", "重复", "拆分图层", "删除"] {
-            assert!(menu.iter().any(|t| t == label), "{label} missing from {menu:?}");
-        }
-        assert!(!menu.iter().any(|t| t.is_ascii()), "English left in {menu:?}");
-        assert!(effects.iter().any(|t| t == "模糊和锐化"), "{effects:?}");
-        assert!(!effects.iter().any(|t| t == "Blur & Sharpen"), "{effects:?}");
-        for label in ["Layer Settings…", "Duplicate", "Delete"] {
-            assert!(english.iter().any(|t| t == label), "{label} missing from {english:?}");
-        }
-        assert!(actions.is_empty());
-    }
-
-    /// The property context menu draws its items in the interface language too: the commands the
-    /// menu bar has from its rows, Reset, Edit Value… and Remove Expression from the panel catalog.
-    /// The automation labels stay English.
-    #[test]
-    fn the_property_context_menu_draws_in_the_interface_language() {
-        let mut s = effectcraft_engine::Session::default();
-        s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
-        let l = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
-        let opacity = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("transform/opacity").unwrap().uid;
-        s.execute("prop.setExpression", json!({"layer": l, "prop": opacity})).unwrap();
-        let comp = s.active_comp_id().unwrap();
-        let layer = s.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
-        let (position, opacity) = (layer.props.prop("transform/position").unwrap(), layer.props.prop("transform/opacity").unwrap());
-        let (mut auto, mut actions) = (crate::automation::Registry::default(), Vec::new());
-        let mut menu = |language| {
-            crate::i18n::set_current(language);
-            let mut drawn = drawn_text(|ui| prop_menu(ui, &mut auto, comp, &layer, position, &mut actions));
-            drawn.extend(drawn_text(|ui| prop_menu(ui, &mut auto, comp, &layer, opacity, &mut actions)));
-            drawn
-        };
-        let chinese = menu("zh-hans");
-        let english = menu("en");
-        for label in ["重置", "编辑值…", "单独尺寸", "添加表达式", "移除表达式", "向基本图形添加属性"] {
-            assert!(chinese.iter().any(|t| t == label), "{label} missing from {chinese:?}");
-        }
-        assert!(!chinese.iter().any(|t| t.is_ascii()), "English left in {chinese:?}");
-        for label in ["Reset", "Edit Value…", "Separate Dimensions", "Remove Expression", "Add Property to Essential Graphics"] {
-            assert!(english.iter().any(|t| t == label), "{label} missing from {english:?}");
-        }
-        assert!(auto.elements.iter().any(|e| e.label == "Remove Expression"), "the automation label stays English");
-        assert!(actions.is_empty());
-    }
-
-    /// UI fidelity (M13.5): compact After Effects-like rows and muted label-coloured bars.
-    #[test]
-    fn rows_and_bars_follow_after_effects_proportions() {
-        let t = crate::theme::Tokens::for_kind(crate::theme::ThemeKind::Dark);
-        assert_eq!(t.row_h, 19.0);
-        let red = t.label(effectcraft_engine::color::Label::Red);
-        let bar = bar_color(red, false);
-        // Muted: darker and less saturated than the label, still reddish.
-        assert!(bar.r() < red.r() && bar.r() > bar.g() + 30 && bar.g() >= red.g().min(0x3a) - 1);
-        let sel = bar_color(red, true);
-        assert!(sel.r() > bar.r());
+    app.auto.add(&format!("timeline.prop.{uid}.eyedropper"), er, &prop.name);
+    let mut rgb = [c[0] as f32, c[1] as f32, c[2] as f32];
+    if crate::widgets::color_popup(ui, pop, r.left_bottom(), &mut rgb) {
+        ve.set(actions, json!([rgb[0], rgb[1], rgb[2], 1.0]));
     }
 }
+
+/// A checkbox.
+fn bool_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>, value: &Value) {
+    let Value::Bool(b) = value else { return };
+    let (prop, at, uid) = (ve.prop, ve.at, ve.uid);
+    let t = app.tokens;
+    let x = at.x;
+    let r = Rect::from_min_size(pos2(x, at.y - 8.0), vec2(16.0, 16.0));
+    if widgets::checkbox(ui, r, *b, &t, egui::Id::unique(("cb", uid))).changed() {
+        ve.set_step(actions, json!(!b));
+    }
+    app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
+}
+
+/// A popup (or the number when the property has no options).
+fn enum_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>, value: &Value) {
+    let Value::Enum(i) = value else { return };
+    let (p, layer, prop, at, uid) = (ve.p, ve.layer, ve.prop, ve.at, ve.uid);
+    let t = app.tokens;
+    let x = at.x;
+    // Cryptomatte's Layer lists the footage's Cryptomatte layers (value k is the choice's own).
+    let crypto = crate::panels::fx_editors::is_crypto_layer_of(layer, prop).then(|| {
+        let aux = app.session.layer_channels(layer.id);
+        effectcraft_engine::effects::crypto_layer_menu(aux.as_deref(), *i as usize)
+    });
+    let options = match &crypto {
+        Some((choices, _)) => Some(std::borrow::Cow::Owned(choices.iter().map(|c| c.1.clone()).collect::<Vec<_>>())),
+        None => layer.popup_options(prop),
+    };
+    if let Some(options) = options {
+        let r = Rect::from_min_size(pos2(x, at.y - 9.0), vec2(150.0, 18.0));
+        let label = match &crypto {
+            Some((_, shown)) => shown.clone().unwrap_or_default(),
+            None => options.get(*i as usize).cloned().unwrap_or_default(),
+        };
+        let cur = if crypto.is_some() { options.iter().position(|o| *o == label) } else { Some(*i as usize) };
+        let pop = egui::Id::unique(("epop", uid));
+        if widgets::dropdown(ui, r, &label, &t, egui::Id::unique(("en", uid))).clicked() {
+            widgets::open_popup(ui, pop);
+        }
+        app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
+        if let Some(ni) = widgets::popup_menu(ui, pop, r.left_bottom(), &options, cur) {
+            let value = crypto.as_ref().and_then(|(choices, _)| choices.get(ni)).map_or(ni, |c| c.0);
+            ve.set_step(actions, json!(value));
+        }
+    } else {
+        p.text(pos2(x, at.y), Align2::LEFT_CENTER, fmt_num(*i as f64, 0), Tokens::ui(12.0), t.for_value(prop.has_expression()).hot_text);
+    }
+}
+
+/// A layer reference picker.
+fn layer_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>, value: &Value) {
+    let Value::Layer(l) = value else { return };
+    let (prop, at, uid) = (ve.prop, ve.at, ve.uid);
+    let t = app.tokens;
+    let x = at.x;
+    // Layer references (a light's Source, a Displacement Map's layer…) pick from the
+    // comp's layers, as in Effect Controls; the choice is written through the same
+    // undoable prop.set as the other value arms.
+    let r = Rect::from_min_size(pos2(x, at.y - 9.0), vec2(150.0, 18.0));
+    if let Some(comp) = app.session.active_comp_arc()
+        && let Some(chosen) = widgets::layer_picker(ui, r, &comp.layers, *l, &t, egui::Id::unique(("tl-lay", uid)))
+    {
+        ve.set_step(actions, chosen.map(|id| json!(id)).unwrap_or(serde_json::Value::Null));
+    }
+    app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
+}
+
+/// Opens the Gradient Editor at the current time (#612).
+fn gradient_editor(app: &mut EffectcraftApp, ui: &mut egui::Ui, ve: &ValueEdit<'_>, actions: &mut Vec<(String, serde_json::Value)>) {
+    let (p, layer, prop, at, uid) = (ve.p, ve.layer, ve.prop, ve.at, ve.uid);
+    let t = app.tokens;
+    let x = at.x;
+    // Opens the Gradient Editor at the current time (#612).
+    let r = p.text(pos2(x, at.y), Align2::LEFT_CENTER, crate::i18n::tr("Edit Gradient…"), Tokens::ui(12.0), t.hot_text);
+    let resp = ui.interact(r.expand(2.0), egui::Id::unique(("gradient-edit", uid)), Sense::click());
+    if resp.hovered() {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
+    }
+    app.auto.add(&format!("timeline.prop.{uid}.value"), r, &prop.name);
+    if resp.clicked() {
+        actions.push(("prop.editGradient".into(), json!({"layer": layer.id.0, "prop": uid})));
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/panels/timeline/tests.rs b/crates/ui-egui/src/panels/timeline/tests.rs
new file mode 100644
index 000000000..983d80ae6
--- /dev/null
+++ b/crates/ui-egui/src/panels/timeline/tests.rs
@@ -0,0 +1,983 @@
+use super::*;
+
+/// Alt/Option-drag takes the same Project items `layer.replaceSource` does: compositions,
+/// footage and solids, never folders, data files or 3D models.
+#[test]
+fn replace_source_takes_visual_items_only() {
+    use effectcraft_engine::color::Label;
+    use effectcraft_engine::project::{Comp, Footage, Project, Solid};
+    use effectcraft_engine::time::{FrameRate, Tick};
+    let mut p = Project::default();
+    let l = Label::None;
+    let comp = p.add_item("C", l, None, ItemKind::Comp(Comp::new(10, 10, FrameRate::FPS_30, Tick::from_seconds_f64(1.0)).into()));
+    let folder = p.add_item("F", l, None, ItemKind::Folder);
+    let still = p.add_item("S", l, None, ItemKind::Footage(Footage { kind: FootageKind::Still, ..Default::default() }));
+    let data = p.add_item("D", l, None, ItemKind::Footage(Footage { kind: FootageKind::Data, ..Default::default() }));
+    let model = p.add_item("M", l, None, ItemKind::Footage(Footage { kind: FootageKind::Model, ..Default::default() }));
+    let solid = p.add_item("So", l, None, ItemKind::Solid(Solid { color: [0.0; 3], width: 10, height: 10, pixel_aspect: 1.0 }));
+    for (id, ok) in [(comp, true), (still, true), (solid, true), (folder, false), (data, false), (model, false)] {
+        assert_eq!(replaceable_item(p.item(id).unwrap()), ok, "{id:?}");
+    }
+}
+
+/// Alt/Cmd-click twirls Audio's Waveform row (not in the property tree) with the rest.
+#[test]
+fn the_waveform_row_twirls_with_its_tree() {
+    let mut root = PropGroup::new(1, "", "");
+    let mut audio = PropGroup::new(2, "audio", "Audio");
+    audio.children.push(PropGroup::new(3, "x", "X").into());
+    root.children.push(audio.into());
+    let mut uids = vec![];
+    walk_groups(&root, &mut uids);
+    assert_eq!(uids, vec![2, WAVE_BIT | 2, 3]);
+    let mut uids = vec![];
+    walk_groups(find_group(&root, 2).unwrap(), &mut uids);
+    assert_eq!(uids, vec![WAVE_BIT | 2, 3]);
+}
+
+/// #710: with Time Display set to Frames the ruler labels are frame numbers (as under the
+/// CTI, from Start Numbering Frames At); otherwise seconds:frames.
+#[test]
+fn ruler_labels_follow_the_time_display_style() {
+    use effectcraft_engine::project::{ProjectSettings, TimeDisplayStyle};
+    let mut st = ProjectSettings { time_display: TimeDisplayStyle::Timecode, frame_start: 0, ..ProjectSettings::default() };
+    assert_eq!(ruler_label(15, 30, &st), "00:15f");
+    assert_eq!(ruler_label(45, 30, &st), "01:15f");
+    assert_eq!(ruler_label(30 * 3600 + 31, 30, &st), "60:01:01f");
+    st.time_display = TimeDisplayStyle::Frames;
+    assert_eq!(ruler_label(0, 30, &st), "00000");
+    assert_eq!(ruler_label(45, 30, &st), "00045");
+    st.frame_start = 1;
+    assert_eq!(ruler_label(45, 30, &st), "00046");
+    assert_eq!(ruler_label(i64::MAX, 30, &st), format!("{:05}", i64::MAX));
+}
+
+/// #468: playback pages the view to the CTI; a scrub past either end scrolls that way.
+#[test]
+fn the_view_pages_to_the_cti() {
+    assert_eq!(page_to_cti(10.0, 5.0, 60.0, 12.0), 10.0, "in view: unchanged");
+    assert_eq!(page_to_cti(10.0, 5.0, 60.0, 16.0), 16.0, "past the right end: the page from the CTI");
+    assert_eq!(page_to_cti(10.0, 5.0, 60.0, 3.0), 3.0, "before the start");
+    assert_eq!(page_to_cti(10.0, 5.0, 60.0, 58.0), 55.0, "not past the comp's end");
+    assert_eq!(page_to_cti(10.0, 80.0, 60.0, 95.0), 0.0);
+    assert_eq!(page_to_cti(10.0, f64::NAN, 60.0, 95.0), 10.0);
+    assert_eq!(edge_scroll_speed_x(100.0, 500.0, 300.0), 0.0);
+    assert!(edge_scroll_speed_x(100.0, 500.0, 501.0) > 0.0 && edge_scroll_speed_x(100.0, 500.0, 99.0) < 0.0);
+    assert!(edge_scroll_speed_x(100.0, 500.0, 600.0) > edge_scroll_speed_x(100.0, 500.0, 520.0));
+}
+
+/// #864: picking only a mode in a layer's Track Matte menu sets a matte (the layer above);
+/// it used to close the menu and change nothing.
+#[test]
+fn a_track_matte_mode_without_a_matte_takes_the_layer_above() {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "T", "width": 64, "height": 64, "duration": 1})).unwrap();
+    for name in ["Chain Bottom", "Matte", "Chain Top"] {
+        s.execute("layer.newSolid", json!({"name": name, "color": "#ffffff", "width": 64, "height": 64})).unwrap();
+    }
+    let find = |s: &effectcraft_engine::Session, n: &str| s.active_comp().unwrap().layers.iter().find(|l| l.name == n).unwrap().clone();
+    let (bottom, matte, top) = (find(&s, "Chain Bottom"), find(&s, "Matte"), find(&s, "Chain Top"));
+    let candidates = [top.id, matte.id];
+    let pick = |s: &mut effectcraft_engine::Session, name: &str, i: usize, choice: &str| {
+        let (id, params) = track_matte_pick(&[find(s, name).id.0], &candidates, i, choice).expect("a menu item is an action");
+        s.execute(&id, params)
+    };
+    pick(&mut s, "Chain Bottom", 5, "Alpha Inverted Matte").unwrap();
+    let m = find(&s, "Chain Bottom").track_matte.expect("a matte");
+    assert_eq!((m.layer, m.kind), (matte.id, MatteKind::AlphaInverted));
+    assert!(!find(&s, "Matte").switches.video, "the matte layer is hidden");
+    // A mode change keeps the matte layer; a matte change keeps the mode.
+    pick(&mut s, "Chain Bottom", 6, "Luma Matte").unwrap();
+    assert_eq!(find(&s, "Chain Bottom").track_matte.map(|m| (m.layer, m.kind)), Some((matte.id, MatteKind::Luma)));
+    pick(&mut s, "Chain Bottom", 2, "1. Chain Top").unwrap();
+    assert_eq!(find(&s, "Chain Bottom").track_matte.map(|m| (m.layer, m.kind)), Some((top.id, MatteKind::Luma)));
+    assert!(s.undo());
+    assert_eq!(find(&s, "Chain Bottom").track_matte.map(|m| m.layer), Some(matte.id), "one undo step per pick");
+    // The top layer has nothing above it: an error for the status bar, not a silent no-op.
+    assert!(pick(&mut s, "Chain Top", 5, "Alpha Matte").is_err());
+    pick(&mut s, "Chain Bottom", 0, "No Track Matte").unwrap();
+    assert!(find(&s, "Chain Bottom").track_matte.is_none());
+    assert!(track_matte_pick(&[bottom.id.0], &candidates, 1, "-").is_none(), "a separator does nothing");
+}
+
+/// #957: vector footage gets the Continuously Rasterize switch; raster footage does not.
+#[test]
+fn collapse_switch_shows_for_vector_footage_only() {
+    use effectcraft_engine::color::Label;
+    use effectcraft_engine::project::{Footage, ItemKind, Project};
+    let mut p = Project::default();
+    let mut layer_for = |name: &str, codec: &str| {
+        let footage = Footage { path: name.into(), codec: codec.into(), ..Default::default() };
+        let item = p.add_item(name, Label::SeaFoam, None, ItemKind::Footage(footage));
+        let comp = Comp::new(64, 36, effectcraft_engine::time::FrameRate::new(30, 1), Tick::from_seconds_f64(1.0));
+        effectcraft_engine::project::build::layer(&mut p, &comp, name, LayerSource::Footage { item }, (0, 0), None)
+    };
+    let svg = layer_for("logo.svg", "SVG");
+    let png = layer_for("photo.png", "PNG");
+    assert!(collapse_applies(&svg, &p));
+    assert!(!collapse_applies(&png, &p));
+}
+
+/// A comp with two solids; "Box" has an animated Position and a Gaussian Blur.
+fn app() -> EffectcraftApp {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "T", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080", "width": 320, "height": 180})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Box", "color": "#e04020", "width": 40, "height": 40})).unwrap();
+    let comp = s.active_comp().unwrap();
+    let bx = comp.layers.iter().find(|l| l.name == "Box").unwrap().id.0;
+    s.execute("layer.select", json!({"layers": [bx]})).unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.blur.gaussian"})).unwrap();
+    let pos = s.active_comp().unwrap().layer(LayerId(bx)).unwrap().transform().unwrap().get("position").unwrap().uid;
+    s.execute("prop.toggleAnimation", json!({"layer": bx, "prop": pos})).unwrap();
+    EffectcraftApp::new(s)
+}
+
+fn labels(app: &EffectcraftApp) -> Vec<String> {
+    let comp = app.session.active_comp().unwrap().clone();
+    build_rows(app, &comp)
+        .into_iter()
+        .map(|r| {
+            let l = comp.layer(r.layer).unwrap();
+            match r.kind {
+                RowKind::Layer => l.name.clone(),
+                RowKind::Group { name, .. } => format!("{}>{name}", "  ".repeat(r.depth)),
+                RowKind::Prop { uid } => format!("{}{}", "  ".repeat(r.depth), l.props.find(uid).unwrap().name),
+                _ => "?".into(),
+            }
+        })
+        .collect()
+}
+
+#[test]
+fn search_filters_layers_and_reveals_matching_properties() {
+    let mut app = app();
+    app.ui.timeline.search = "opac".into();
+    let rows = labels(&app);
+    // Both layers have Transform > Opacity; nothing else shows.
+    assert_eq!(rows.iter().filter(|r| r.trim() == "Opacity").count(), 2, "{rows:?}");
+    assert!(rows.iter().any(|r| r.trim() == ">Transform"), "{rows:?}");
+    assert!(!rows.iter().any(|r| r.trim() == "Position"), "{rows:?}");
+    // A layer name match shows the layer alone; a group match brings its contents.
+    app.ui.timeline.search = "plate".into();
+    assert_eq!(labels(&app), vec!["Plate".to_string()]);
+    app.ui.timeline.search = "GAUSSIAN".into();
+    let rows = labels(&app);
+    assert_eq!(rows[0], "Box");
+    assert!(rows.iter().any(|r| r.trim() == ">Effects") && rows.iter().any(|r| r.trim() == "Blurriness"), "{rows:?}");
+    assert!(!rows.contains(&"Plate".to_string()));
+    // Nothing matches → no rows.
+    app.ui.timeline.search = "zzz".into();
+    assert!(labels(&app).is_empty());
+    // Through the command.
+    let ctx = egui::Context::default();
+    crate::menus::invoke(&mut app, &ctx, "timeline.search", json!({"query": "scale"})).unwrap();
+    assert!(labels(&app).iter().any(|r| r.trim() == "Scale"));
+}
+
+/// A shape group's inner Contents (AE's elided `ADBE Vectors Group`) draws no row: the
+/// search shows the full row hierarchy with the group's items — path, fill and Transform —
+/// listing directly under the group, and the only "Contents" row the layer's own.
+#[test]
+fn shape_group_inner_contents_is_elided() {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "T", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s.execute("layer.newShape", json!({"kind": "rect"})).unwrap();
+    let mut app = EffectcraftApp::new(s);
+    app.ui.timeline.search = "rect".into();
+    assert_eq!(
+        labels(&app),
+        [
+            "Shape Layer 1",
+            "  >Contents",
+            "    >Rectangle 1",
+            "      >Rectangle Path 1",
+            "        Size",
+            "        Position",
+            "        Roundness",
+            "        Per-Corner Roundness",
+            "        Top Left Roundness",
+            "        Top Right Roundness",
+            "        Bottom Right Roundness",
+            "        Bottom Left Roundness",
+            "      >Fill 1",
+            "        Composite",
+            "        Fill Rule",
+            "        Color",
+            "        Opacity",
+            "      >Transform",
+            "        Anchor Point",
+            "        Position",
+            "        Scale",
+            "        Skew",
+            "        Skew Axis",
+            "        Rotation",
+            "        Opacity",
+        ]
+        .iter()
+        .map(|r| r.to_string())
+        .collect::<Vec<_>>()
+    );
+}
+
+#[test]
+fn columns_toggle_and_layout() {
+    let mut app = app();
+    let tl = &mut app.ui.timeline;
+    assert!(column_visible(tl, "switches") && !column_visible(tl, "comment") && !column_visible(tl, "modes"));
+    set_column(tl, "comment", true).unwrap();
+    set_column(tl, "stretch", true).unwrap();
+    set_column(tl, "keys", false).unwrap();
+    set_column(tl, "label", false).unwrap();
+    set_column(tl, "modes", true).unwrap();
+    assert!(tl.show_modes && column_visible(tl, "comment") && !column_visible(tl, "label"));
+    assert!(set_column(tl, "name", false).is_err());
+    assert!(set_column(tl, "bogus", true).is_err());
+    let vis = Vis::of(tl);
+    let cw = cols(0.0, 1400.0, vis);
+    // Hidden columns take no room; visible ones are in After Effects' order.
+    assert_eq!(cw.keys, cw.label);
+    assert_eq!(cw.label, cw.num);
+    assert!(cw.name < cw.comment && cw.comment < cw.switches && cw.switches < cw.mode && cw.parent < cw.stretch);
+    assert_eq!(column_at(&cw, cw.comment + 5.0), Some("comment"));
+    assert_eq!(column_at(&cw, cw.name + 5.0), Some("name"));
+    assert_eq!(column_at(&cw, cw.stretch + 5.0), Some("stretch"));
+    // Through the command (as agents do).
+    let ctx = egui::Context::default();
+    let r = crate::menus::invoke(&mut app, &ctx, "timeline.column", json!({"column": "duration"})).unwrap();
+    assert!(r["columns"].as_array().unwrap().iter().any(|c| c == "duration"));
+    crate::menus::invoke(&mut app, &ctx, "timeline.column", json!({"column": "duration", "visible": false})).unwrap();
+    assert!(!column_visible(&app.ui.timeline, "duration"));
+    crate::menus::invoke(&mut app, &ctx, "timeline.sourceName", json!({})).unwrap();
+    assert!(app.ui.timeline.source_name);
+}
+
+#[test]
+fn reveal_keys_add_with_shift_and_uu_reveals_modified() {
+    let mut app = app();
+    let ctx = egui::Context::default();
+    crate::menus::invoke(&mut app, &ctx, "timeline.reveal.opacity", json!({})).unwrap();
+    assert_eq!(app.ui.timeline.reveal, vec!["opacity"]);
+    crate::menus::invoke(&mut app, &ctx, "timeline.revealAdd.scale", json!({})).unwrap();
+    crate::menus::invoke(&mut app, &ctx, "timeline.revealAdd.effects", json!({})).unwrap();
+    assert_eq!(app.ui.timeline.reveal, vec!["opacity", "scale", "effects"]);
+    let rows = labels(&app);
+    assert!(rows.iter().any(|r| r.trim() == "Scale") && rows.iter().any(|r| r.trim() == "Opacity"), "{rows:?}");
+    assert!(rows.iter().any(|r| r.trim() == ">Gaussian Blur"), "{rows:?}");
+    // Tree order: Scale before Opacity.
+    let si = rows.iter().position(|r| r.trim() == "Scale").unwrap();
+    let oi = rows.iter().position(|r| r.trim() == "Opacity").unwrap();
+    assert!(si < oi);
+    // Shift+S again removes Scale.
+    crate::menus::invoke(&mut app, &ctx, "timeline.revealAdd.scale", json!({})).unwrap();
+    assert_eq!(app.ui.timeline.reveal, vec!["opacity", "effects"]);
+    // U: keyframed properties (Position); UU (twice quickly): every modified property.
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    let n_keys = app.ui.timeline.reveal_props.len();
+    assert_eq!(app.ui.timeline.reveal, vec!["props"]);
+    assert!(n_keys >= 1);
+    let bx = app.session.state.selected_layers[0].0;
+    app.session.execute("prop.set", json!({"layer": bx, "path": "effects/#1/blurriness", "value": 12})).unwrap();
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    assert!(app.ui.timeline.reveal_props.len() > n_keys, "UU reveals modified properties too");
+}
+
+#[test]
+fn scroll_to_time_centres_the_current_time_inside_the_comp() {
+    assert_eq!(centered_on(4.0, 10.0, 5.0), 3.0);
+    // Near the ends the view stops at the comp's start and end.
+    assert_eq!(centered_on(4.0, 10.0, 1.0), 0.0);
+    assert_eq!(centered_on(4.0, 10.0, 9.5), 6.0);
+    // A span longer than the comp, and bad numbers, start at zero.
+    assert_eq!(centered_on(20.0, 10.0, 5.0), 0.0);
+    assert_eq!(centered_on(f64::NAN, 10.0, 5.0), 0.0);
+}
+
+/// U and the other reveal shortcuts act on the selected layers only: other layers keep their
+/// twirl state and their own reveal (#160).
+#[test]
+fn reveal_shortcuts_leave_unselected_layers_alone() {
+    let mut app = app();
+    let ctx = egui::Context::default();
+    let comp = app.session.active_comp().unwrap().clone();
+    let id = |n: &str| comp.layers.iter().find(|l| l.name == n).unwrap().id.0;
+    let (plate, bx) = (id("Plate"), id("Box"));
+    let select = |app: &mut EffectcraftApp, l: u64| app.session.execute("layer.select", json!({"layers": [l]})).unwrap();
+    // Plate shows Scale (S); then U on Box.
+    select(&mut app, plate);
+    crate::menus::invoke(&mut app, &ctx, "timeline.reveal.scale", json!({})).unwrap();
+    select(&mut app, bx);
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    let tl = &app.ui.timeline;
+    assert!(tl.open_layers.contains(&plate) && tl.open_layers.contains(&bx), "{:?}", tl.open_layers);
+    assert_eq!(tl.layer_reveal.get(&plate), Some(&vec!["scale".to_string()]), "Plate keeps its reveal");
+    assert_eq!(tl.layer_reveal.get(&bx), Some(&vec!["props".to_string()]));
+    let rows = labels(&app);
+    let at = |n: &str| rows.iter().position(|r| r == n).unwrap();
+    assert_eq!(rows[at("Plate") + 1].trim(), "Scale", "{rows:?}");
+    assert_eq!(rows[at("Box") + 1].trim(), "Position", "{rows:?}");
+    // UU (modified): the effect's changed parameter only, under the effect twirled open.
+    // Then U later: Box shows its keyframed properties only again.
+    app.session.execute("prop.set", json!({"layer": bx, "path": "effects/#1/blurriness", "value": 12})).unwrap();
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    let rows = labels(&app);
+    let fx = rows.iter().position(|r| r.trim().ends_with("Gaussian Blur")).unwrap_or_else(|| panic!("UU shows the effect: {rows:?}"));
+    assert_eq!(rows[fx + 1].trim(), "Blurriness", "{rows:?}");
+    assert!(!rows.iter().any(|r| r.trim() == "Blur Dimensions"), "unchanged parameters stay hidden: {rows:?}");
+    // Collapsed and expanded by hand, the effect shows all its parameters; UU filters again.
+    let fx_uid = app.session.active_comp().unwrap().layer(LayerId(bx)).unwrap().effects().unwrap().groups().next().unwrap().uid;
+    app.ui.timeline.toggle_group(bx, fx_uid);
+    assert!(!labels(&app).iter().any(|r| r.trim() == "Blurriness"), "collapsed");
+    app.ui.timeline.toggle_group(bx, fx_uid);
+    let rows = labels(&app);
+    assert!(rows.iter().any(|r| r.trim() == "Blurriness") && rows.iter().any(|r| r.trim() == "Blur Dimensions"), "{rows:?}");
+    app.last_reveal = Some(("keyframes".into(), f64::MAX));
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    assert!(!labels(&app).iter().any(|r| r.trim() == "Blur Dimensions"), "UU again shows the changed ones only");
+    app.last_reveal = Some(("keyframes".into(), -10.0));
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    app.last_reveal = Some(("keyframes".into(), -10.0));
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    let rows = labels(&app);
+    assert!(!rows.iter().any(|r| r.trim() == ">Gaussian Blur") && rows.iter().any(|r| r.trim() == "Position"), "{rows:?}");
+    // U again on Box (later than a double press) hides only Box's.
+    app.last_reveal = Some(("keyframes".into(), -10.0));
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    let tl = &app.ui.timeline;
+    assert!(!tl.open_layers.contains(&bx) && tl.open_layers.contains(&plate), "{:?}", tl.open_layers);
+    // A layer twirled open by hand shows its whole tree, whatever was revealed elsewhere.
+    app.session.execute("layer.select", json!({"layers": []})).unwrap();
+    app.ui.timeline.open_layers.insert(bx);
+    let rows = labels(&app);
+    assert!(rows.iter().any(|r| r.trim() == ">Transform"), "{rows:?}");
+}
+
+/// U and UU show Time Remap on a layer with time remapping enabled.
+#[test]
+fn u_and_uu_reveal_time_remap() {
+    let mut s = effectcraft_engine::Session::default();
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
+    let nested = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
+    let mut app = EffectcraftApp::new(s);
+    let ctx = egui::Context::default();
+    crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({"layers": [nested]})).unwrap();
+    app.session.execute("layer.select", json!({"layers": [nested]})).unwrap();
+    for uu in [false, true] {
+        app.ui.timeline.layer_reveal.clear();
+        app.last_reveal = uu.then(|| ("keyframes".into(), f64::MAX));
+        crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+        assert_eq!(app.ui.timeline.layer_reveal.get(&nested), Some(&vec!["props".to_string()]), "UU: {uu}");
+        let rows = labels(&app);
+        let at = rows.iter().position(|r| r == "Inner").unwrap();
+        assert_eq!(rows[at + 1].trim(), "Time Remap", "UU: {uu}: {rows:?}");
+    }
+}
+
+/// U shows Time Remap while remapping is enabled even after its keys are deleted (#990):
+/// enabling remapping is itself the modification.
+#[test]
+fn u_reveals_keyless_time_remap() {
+    let mut s = effectcraft_engine::Session::default();
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
+    let nested = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
+    let mut app = EffectcraftApp::new(s);
+    let ctx = egui::Context::default();
+    crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({"layers": [nested]})).unwrap();
+    let uid = app.session.active_comp().unwrap().layer(LayerId(nested)).unwrap().props.prop("timeRemap").unwrap().uid;
+    for _ in 0..2 {
+        let t = app.session.active_comp().unwrap().layer(LayerId(nested)).unwrap().props.prop("timeRemap").unwrap().keys[0].time.seconds();
+        app.session.execute("keys.select", json!({"keys": [{"layer": nested, "prop": uid, "time": t}]})).unwrap();
+        app.session.execute("edit.clear", json!({})).unwrap();
+    }
+    assert!(app.session.active_comp().unwrap().layer(LayerId(nested)).unwrap().props.prop("timeRemap").unwrap().keys.is_empty());
+    app.session.execute("layer.select", json!({"layers": [nested]})).unwrap();
+    crate::menus::invoke(&mut app, &ctx, "anim.reveal", json!({"kind": "keyframes"})).unwrap();
+    assert_eq!(app.ui.timeline.layer_reveal.get(&nested), Some(&vec!["props".to_string()]));
+    let rows = labels(&app);
+    let at = rows.iter().position(|r| r == "Inner").unwrap();
+    assert_eq!(rows[at + 1].trim(), "Time Remap", "{rows:?}");
+}
+
+/// Enabling time remapping twirls the layer open on Time Remap (#157); disabling it reveals
+/// nothing.
+#[test]
+fn enabling_time_remapping_reveals_time_remap() {
+    let mut s = effectcraft_engine::Session::default();
+    let inner = s.execute("comp.new", json!({"name": "Inner", "width": 32, "height": 32, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Other"})).unwrap();
+    let nested = s.execute("layer.addItem", json!({"item": inner})).unwrap()["layer"].as_u64().unwrap();
+    let mut app = EffectcraftApp::new(s);
+    let ctx = egui::Context::default();
+    crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({"layers": [nested]})).unwrap();
+    assert_eq!(app.ui.timeline.layer_reveal.get(&nested), Some(&vec!["timeRemap".to_string()]));
+    let rows = labels(&app);
+    let at = rows.iter().position(|r| r == "Inner").unwrap();
+    assert_eq!(rows[at + 1].trim(), "Time Remap", "{rows:?}");
+    // Through the selection (the Layer menu), turning it off again: nothing new is revealed.
+    app.session.execute("layer.select", json!({"layers": [nested]})).unwrap();
+    app.ui.timeline.layer_reveal.clear();
+    crate::menus::invoke(&mut app, &ctx, "layer.enableTimeRemap", json!({})).unwrap();
+    assert!(app.ui.timeline.layer_reveal.is_empty());
+}
+
+#[test]
+fn cti_snaps_to_the_nearest_candidate() {
+    assert_eq!(snap_time(&[0.0, 1.0, 2.0], 1.04, 0.1), 1.0);
+    assert_eq!(snap_time(&[0.0, 1.0, 2.0], 1.5, 0.1), 1.5);
+    assert_eq!(snap_time(&[1.0, 1.1], 1.06, 0.1), 1.1);
+    let app = app();
+    let comp = app.session.active_comp().unwrap().clone();
+    let c = snap_candidates(&comp, &build_rows(&app, &comp));
+    assert!(c.contains(&comp.duration.seconds()) && c.contains(&0.0));
+}
+
+/// Every string drawn by one frame of `draw`.
+fn drawn_text(mut draw: impl FnMut(&mut egui::Ui)) -> Vec<String> {
+    fn collect(shape: &egui::Shape, out: &mut Vec<String>) {
+        match shape {
+            egui::Shape::Text(t) => out.push(t.galley.text().to_string()),
+            egui::Shape::Vec(v) => v.iter().for_each(|s| collect(s, out)),
+            _ => {}
+        }
+    }
+    let ctx = egui::Context::default();
+    ctx.run_ui(Default::default(), |ui| draw(ui)).textures_delta.clear();
+    let mut frame = ctx.run_ui(Default::default(), |ui| draw(ui));
+    frame.textures_delta.clear();
+    let mut out = Vec::new();
+    frame.shapes.iter().for_each(|c| collect(&c.shape, &mut out));
+    out
+}
+
+/// #1308: the layer context menu draws its items in the interface language, from the menu
+/// bar's rows for the same commands (whose ellipsis is `...`), and its Effects submenu draws
+/// the categories the Effect menu does; the actions it records stay the same.
+#[test]
+fn the_layer_context_menu_draws_in_the_interface_language() {
+    let caps = LayerMenuCaps { vector: true, text: false, source: true };
+    let (mut auto, mut actions) = (crate::automation::Registry::default(), Vec::new());
+    crate::i18n::set_current("zh-hans");
+    let menu = drawn_text(|ui| layer_menu(ui, &[7], caps, (&mut auto, "t"), &mut actions));
+    let effects = drawn_text(|ui| effects_submenu(ui, &[7], &mut |_: &mut egui::Ui, _: &str, _: &str, _: serde_json::Value| {}));
+    crate::i18n::set_current("en");
+    let english = drawn_text(|ui| layer_menu(ui, &[7], caps, (&mut auto, "t"), &mut actions));
+    for label in ["新建", "图层设置...", "在项目中显示图层源", "从矢量图层创建形状", "预合成...", "重复", "拆分图层", "删除"]
+    {
+        assert!(menu.iter().any(|t| t == label), "{label} missing from {menu:?}");
+    }
+    assert!(!menu.iter().any(|t| t.is_ascii()), "English left in {menu:?}");
+    assert!(effects.iter().any(|t| t == "模糊和锐化"), "{effects:?}");
+    assert!(!effects.iter().any(|t| t == "Blur & Sharpen"), "{effects:?}");
+    for label in ["Layer Settings…", "Reveal Layer Source in Project", "Duplicate", "Delete"] {
+        assert!(english.iter().any(|t| t == label), "{label} missing from {english:?}");
+    }
+    assert!(actions.is_empty());
+}
+
+/// The property context menu draws its items in the interface language too: the commands the
+/// menu bar has from its rows, Reset, Edit Value… and Remove Expression from the panel catalog.
+/// The automation labels stay English.
+#[test]
+fn the_property_context_menu_draws_in_the_interface_language() {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64, "duration": 4})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let opacity = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    s.execute("prop.setExpression", json!({"layer": l, "prop": opacity})).unwrap();
+    let comp = s.active_comp_id().unwrap();
+    let layer = s.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let (position, opacity) = (layer.props.prop("transform/position").unwrap(), layer.props.prop("transform/opacity").unwrap());
+    let (mut auto, mut actions) = (crate::automation::Registry::default(), Vec::new());
+    let mut menu = |language| {
+        crate::i18n::set_current(language);
+        let mut drawn = drawn_text(|ui| prop_menu(ui, &mut auto, comp, &layer, position, &mut actions));
+        drawn.extend(drawn_text(|ui| prop_menu(ui, &mut auto, comp, &layer, opacity, &mut actions)));
+        drawn
+    };
+    let chinese = menu("zh-hans");
+    let english = menu("en");
+    for label in ["重置", "编辑值…", "单独尺寸", "添加表达式", "移除表达式", "向基本图形添加属性"] {
+        assert!(chinese.iter().any(|t| t == label), "{label} missing from {chinese:?}");
+    }
+    assert!(!chinese.iter().any(|t| t.is_ascii()), "English left in {chinese:?}");
+    for label in ["Reset", "Edit Value…", "Separate Dimensions", "Remove Expression", "Add Property to Essential Graphics"] {
+        assert!(english.iter().any(|t| t == label), "{label} missing from {english:?}");
+    }
+    assert!(auto.elements.iter().any(|e| e.label == "Remove Expression"), "the automation label stays English");
+    assert!(actions.is_empty());
+}
+
+/// UI fidelity (M13.5): compact After Effects-like rows and muted label-coloured bars.
+#[test]
+fn rows_and_bars_follow_after_effects_proportions() {
+    let t = crate::theme::Tokens::for_kind(crate::theme::ThemeKind::Dark);
+    assert_eq!(t.row_h, 19.0);
+    let red = t.label(effectcraft_engine::color::Label::Red);
+    let bar = bar_color(red, false);
+    // Muted: darker and less saturated than the label, still reddish.
+    assert!(bar.r() < red.r() && bar.r() > bar.g() + 30 && bar.g() >= red.g().min(0x3a) - 1);
+    let sel = bar_color(red, true);
+    assert!(sel.r() > bar.r());
+}
+
+#[test]
+fn disk_bar_range_covers_partial_frames() {
+    let clip = Rect::from_min_max(pos2(0.0, 0.0), pos2(2.0, 1.0));
+    let tm = TMap { x0: 0.0, start: 10.25, pps: 1.0 };
+    assert_eq!(disk_bar_range(&tm, clip, 1.0, 100), 10..13);
+
+    let exact = TMap { start: 10.0, ..tm };
+    assert_eq!(disk_bar_range(&exact, clip, 1.0, 100), 10..12);
+    let off_comp = TMap { start: 200.0, ..tm };
+    assert_eq!(disk_bar_range(&off_comp, clip, 1.0, 100), 100..100);
+    assert_eq!(disk_bar_range(&tm, clip, f64::NAN, 100), 0..0);
+    assert_eq!(disk_bar_range(&TMap { pps: 0.0, ..tm }, clip, 1.0, 100), 0..0);
+    assert_eq!(disk_bar_range(&TMap { start: f64::NAN, ..tm }, clip, 1.0, 100), 0..0);
+    assert_eq!(disk_bar_range(&tm, Rect::from_min_max(pos2(2.0, 0.0), pos2(2.0, 1.0)), 1.0, 100), 0..0);
+    let above_limit = TMap { start: 100_001.0, ..tm };
+    assert_eq!(disk_bar_range(&above_limit, clip, 1.0, i64::MAX), 100_000..100_000);
+}
+
+/// The keyframe menu is one for the Timeline and the Graph Editor: its commands are drawn in the
+/// interface language, and a locked layer's keys can be copied and selected but not edited.
+#[test]
+fn the_key_menu_is_translated_and_cannot_edit_a_locked_layers_keys() {
+    use egui_kittest::Harness;
+    use egui_kittest::kittest::{NodeT, Queryable};
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 64, "duration": 2})).unwrap();
+    let id = s.execute("layer.newSolid", json!({"name": "Box", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+    for (t, v) in [(0.0, 0), (1.0, 50)] {
+        s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": t, "value": v})).unwrap();
+    }
+    let app = EffectcraftApp::new(s);
+    let layer = app.session.active_comp().unwrap().layer(LayerId(id)).unwrap().clone();
+    let prop = layer.props.prop("transform/opacity").unwrap().clone();
+    let key = prop.keys[0].clone();
+    let enabled = |locked: bool, selected: bool, label: &str| {
+        let mut layer = layer.clone();
+        layer.switches.locked = locked;
+        let mut actions = vec![];
+        let mut h = Harness::new_ui(|ui| key_menu(ui, &app, &layer, &prop, &key, selected, &mut actions));
+        h.run();
+        !h.get_by_label(label).accesskit_node().is_disabled()
+    };
+    for label in [
+        "Copy",
+        "Select Equal Keyframes",
+        "Select All Keyframes",
+        "Delete",
+        "Edit Value…",
+        "Easy Ease",
+        "Time-Reverse Keyframes",
+        "Keyframe Velocity…",
+        "Mute Keyframes",
+    ] {
+        assert!(enabled(false, true, label), "{label} on an unlocked layer");
+    }
+    for label in ["Copy", "Select Equal Keyframes", "Select All Keyframes"] {
+        assert!(enabled(true, true, label), "{label} is still available on a locked layer");
+    }
+    for label in ["Delete", "Edit Value…", "Easy Ease", "Time-Reverse Keyframes", "Keyframe Velocity…", "Mute Keyframes", "Linear"] {
+        assert!(!enabled(true, true, label), "{label} is off on a locked layer");
+        assert!(!enabled(true, false, label), "{label} is off on an unselected locked key");
+    }
+    for label in ["Copy", "Select Equal Keyframes", "Select Previous Keyframes", "Select Following Keyframes"] {
+        assert!(!enabled(true, false, label), "{label} requires selecting the clicked key");
+    }
+    assert!(enabled(true, false, "Select All Keyframes"));
+    // The labels follow the interface language.
+    crate::i18n::set_current("es");
+    let copy = crate::i18n::context_item("keys.copy", &json!({}), "Copy");
+    assert_ne!(copy, "Copy", "the catalog translates Copy");
+    assert!(enabled(false, true, &copy));
+    crate::i18n::set_current("en");
+}
+
+#[test]
+fn a_key_menu_edit_selects_the_clicked_key_before_applying_the_command() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"width": 64, "height": 64, "duration": 2})).unwrap();
+    let id = s.execute("layer.newSolid", json!({"color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+    for (time, value) in [(0.0, 0), (1.0, 50)] {
+        s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": time, "value": value})).unwrap();
+    }
+    let layer = s.active_comp().unwrap().layer(LayerId(id)).unwrap().clone();
+    let prop = layer.props.prop("transform/opacity").unwrap().clone();
+    s.execute("keys.select", json!({"keys": [{"layer": id, "prop": prop.uid, "time": 1.0}]})).unwrap();
+    let mut app = EffectcraftApp::new(s);
+    let mut actions = vec![];
+    {
+        let mut h = Harness::new_ui(|ui| key_menu(ui, &app, &layer, &prop, &prop.keys[0], false, &mut actions));
+        h.run();
+        h.get_by_label("Easy Ease").click();
+        h.run();
+    }
+    assert_eq!(actions.iter().map(|(command, _)| command.as_str()).collect::<Vec<_>>(), ["keys.select", "keys.easyEase"]);
+    for (command, params) in actions {
+        app.session.execute(&command, params).unwrap();
+    }
+    let keys = &app.session.active_comp().unwrap().layer(LayerId(id)).unwrap().props.find(prop.uid).unwrap().keys;
+    assert_ne!(keys[0], prop.keys[0], "the clicked key was eased");
+    assert_eq!(keys[1], prop.keys[1], "the previously selected key was not edited");
+    assert_eq!(app.session.state.selected_keys.len(), 1);
+    assert_eq!(app.session.state.selected_keys[0].time, prop.keys[0].time);
+}
+
+/// A key's marquee target is the marker it draws: a roving key's is its smaller dot.
+#[test]
+fn a_keys_glyph_rect_is_what_it_draws() {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 64, "duration": 2})).unwrap();
+    let id = s.execute("layer.newSolid", json!({"name": "Box", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": 0.5, "value": 0})).unwrap();
+    let comp = s.active_comp().unwrap();
+    let mut k = comp.layer(LayerId(id)).unwrap().props.prop("transform/opacity").unwrap().keys[0].clone();
+    let c = pos2(100.0, 50.0);
+    k.roving = true;
+    assert_eq!(key_glyph_rect(&k, c), Rect::from_center_size(c, vec2(5.0, 5.0)));
+}
+
+/// Keys come back in row order, and only the rows and keys the box touches. Rows taller than one
+/// line (an expression editor) push the keys below them down, as they are drawn.
+#[test]
+fn keys_in_box_walks_the_rows_and_tests_each_glyph() {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 64, "duration": 4, "frameRate": 30})).unwrap();
+    let mut layers = vec![];
+    for name in ["A", "B"] {
+        let id = s.execute("layer.newSolid", json!({"name": name, "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+        for t in [1.0, 2.0] {
+            s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": t, "value": 50})).unwrap();
+        }
+        layers.push(id);
+    }
+    let comp = s.active_comp().unwrap();
+    let uid = |id: u64| comp.layer(LayerId(id)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    let row = |id: u64, kind: RowKind| Row { layer: LayerId(id), depth: 1, kind };
+    let rows = vec![
+        row(layers[1], RowKind::Prop { uid: uid(layers[1]) }),
+        row(layers[1], RowKind::Expr { uid: uid(layers[1]), lines: 3 }),
+        row(layers[0], RowKind::Prop { uid: uid(layers[0]) }),
+    ];
+    // 1 s = 100 pt. Rows are 20 pt: centers at y 10 and, past the 60 pt editor, 90.
+    let tm = TMap { x0: 0.0, start: 0.0, pps: 100.0 };
+    let hit = |br: Rect| -> Vec<(u64, i64)> { keys_in_box(comp, &rows, &tm, 0.0, 20.0, br).iter().map(|k| (k.layer.0, k.time.0)).collect() };
+    let (one, two) = (Tick::from_seconds_f64(1.0).0, Tick::from_seconds_f64(2.0).0);
+    let across = |x0: f32, x1: f32| Rect::from_min_max(pos2(x0, 0.0), pos2(x1, 200.0));
+    assert_eq!(hit(across(0.0, 300.0)), [(layers[1], one), (layers[1], two), (layers[0], one), (layers[0], two)], "row order");
+    assert_eq!(hit(Rect::from_min_max(pos2(0.0, 95.5), pos2(300.0, 200.0))), [(layers[0], one), (layers[0], two)], "the box reaches the glyph's bottom point");
+    assert!(hit(Rect::from_min_max(pos2(0.0, 97.0), pos2(300.0, 200.0))).is_empty(), "the box is below the glyph");
+}
+
+#[test]
+fn layer_drop_target_skips_moving_layers_beyond_the_viewport() {
+    let mut rows: Vec<Row> = (1..=6).map(|id| Row { layer: LayerId(id), depth: 0, kind: RowKind::Layer }).collect();
+    rows.insert(4, Row { layer: LayerId(4), depth: 1, kind: RowKind::Prop { uid: 0 } });
+    let visible: Vec<_> = (2..=4).map(|id| (Rect::NOTHING, LayerId(id))).collect();
+    for at in [Some(2), None] {
+        assert_eq!(layer_drop_target(&rows, &visible, at, &[1, 4, 5]), Some(LayerId(6)), "skip moving headers and their properties across the viewport edge");
+        assert_eq!(layer_drop_target(&rows, &visible, at, &[1, 4, 5, 6]), None, "the stack ends when no stationary layer follows");
+    }
+}
+
+fn mask_reveal_app() -> (EffectcraftApp, u64) {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"width": 64, "height": 36})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({"name": "Plate"})).unwrap()["layer"].as_u64().unwrap();
+    s.drain_events();
+    (EffectcraftApp::new(s), layer)
+}
+
+fn mask_reveal_add(app: &mut EffectcraftApp) -> u64 {
+    let mask = app.session.execute("layer.addMask", json!({})).unwrap()["mask"].as_u64().unwrap();
+    app.handle_events(&egui::Context::default());
+    mask
+}
+
+/// Whole-mask rows and shortcut-selected properties must coexist without rendering controls twice.
+#[test]
+fn mask_reveal_opens_controls_and_preserves_other_properties_without_duplicates() {
+    for kinds in [vec![], vec!["position"], vec!["feather"], vec!["masks"], vec!["masks", "feather"]] {
+        let (mut app, layer) = mask_reveal_app();
+        app.ui.timeline.reveal = vec!["rotation".into()];
+        if !kinds.is_empty() {
+            app.ui.timeline.layer_reveal.insert(layer, kinds.iter().map(|s| s.to_string()).collect());
+        }
+        mask_reveal_add(&mut app);
+        mask_reveal_add(&mut app);
+        let names = labels(&app);
+        for name in [">Mask 1", ">Mask 2"] {
+            assert_eq!(names.iter().filter(|r| r.trim() == name).count(), 1, "{kinds:?}: {names:?}");
+        }
+        assert_eq!(names.iter().filter(|r| r.trim() == "Mask Feather").count(), 2, "{names:?}");
+        assert_eq!(names.iter().filter(|r| r.trim() == "Mask Path").count(), 2, "{names:?}");
+        if kinds.contains(&"position") {
+            assert_eq!(names.iter().filter(|r| r.trim() == "Position").count(), 1, "{names:?}");
+        }
+        assert_eq!(app.ui.timeline.reveal, ["rotation"]);
+    }
+}
+
+/// Revealing controls is a presentation change; explicit search and the active drawing selection retain authority.
+#[test]
+fn mask_reveal_preserves_search_selection_focus_document_and_revision() {
+    let (mut app, layer) = mask_reveal_app();
+    app.ui.timeline.search = "position".into();
+    app.ui.timeline.open_layers.insert(999);
+    app.ui.timeline.layer_reveal.insert(999, vec!["scale".into()]);
+    app.ui.focused = crate::dock::PanelKind::Composition;
+    let selected = app.session.state.selected_layers.clone();
+    let mask = app.session.execute("mask.new", json!({"vertices": [[2, 3]]})).unwrap()["mask"].as_u64().unwrap();
+    let vertices = app.session.state.selected_vertices.clone();
+    let before = app.session.project.to_json();
+    let revision = app.session.revision;
+    app.handle_events(&egui::Context::default());
+    assert_eq!(app.session.project.to_json(), before);
+    assert_eq!(app.session.revision, revision);
+    assert_eq!(app.session.state.selected_layers, selected);
+    assert_eq!(app.session.state.selected_vertices, vertices);
+    assert_eq!(app.ui.focused, crate::dock::PanelKind::Composition);
+    assert_eq!(app.ui.timeline.search, "position");
+    assert_eq!(app.ui.timeline.layer_reveal.get(&999).unwrap(), &["scale"]);
+    assert!(app.ui.timeline.open_layers.contains(&999));
+    assert!(!labels(&app).iter().any(|r| r.trim() == ">Mask 1"));
+    app.ui.timeline.search.clear();
+    assert!(labels(&app).iter().any(|r| r.trim() == ">Mask 1"));
+    assert!(app.ui.timeline.open_groups.contains(&mask));
+    assert!(app.ui.timeline.open_layers.contains(&layer));
+}
+
+/// Queued events can outlive their target or project, so stale delivery must leave Timeline presentation untouched.
+#[test]
+fn mask_reveal_ignores_undone_deleted_inactive_and_replaced_project_events() {
+    #[derive(Clone, Copy, Debug)]
+    enum Stale {
+        Undo,
+        Delete,
+        Inactive,
+        Replace,
+    }
+    for stale in [Stale::Undo, Stale::Delete, Stale::Inactive, Stale::Replace] {
+        let (mut app, layer) = mask_reveal_app();
+        let mask = app.session.execute("layer.addMask", json!({})).unwrap()["mask"].as_u64().unwrap();
+        match stale {
+            Stale::Undo => {
+                assert!(app.session.undo());
+            }
+            Stale::Delete => {
+                app.session.execute("mask.remove", json!({"mask": mask})).unwrap();
+            }
+            Stale::Inactive => {
+                app.session.execute("comp.new", json!({"name": "Other"})).unwrap();
+            }
+            Stale::Replace => {
+                let project = (*app.session.project).clone();
+                let comp = app.session.active_comp_id().unwrap();
+                app.session.replace_project(project, None);
+                app.session.execute("comp.open", json!({"comp": comp.0})).unwrap();
+            }
+        }
+        let before = serde_json::to_value(&app.ui.timeline).unwrap();
+        app.handle_events(&egui::Context::default());
+        // Opening a composition can update its zoom, but must not reveal the stale mask.
+        assert!(app.ui.timeline.open_layers.is_empty(), "{stale:?}");
+        assert!(app.ui.timeline.open_groups.is_empty(), "{stale:?}");
+        assert!(app.ui.timeline.layer_reveal.is_empty(), "{stale:?}");
+        if !matches!(stale, Stale::Inactive | Stale::Replace) {
+            assert_eq!(serde_json::to_value(&app.ui.timeline).unwrap(), before);
+        }
+        assert!(!app.ui.timeline.open_layers.contains(&layer));
+    }
+}
+
+/// Adding an unkeyed mask must retain the visible Position key and restore its controls on redo.
+#[test]
+fn mask_reveal_undo_redo_restores_visible_controls_and_keeps_keyframe_scope() {
+    let (mut app, layer) = mask_reveal_app();
+    app.session.execute("prop.toggleAnimation", json!({"path": "transform/position"})).unwrap();
+    app.ui.timeline.layer_reveal.insert(layer, vec!["position".into()]);
+    mask_reveal_add(&mut app);
+    let visible = visible_props(&app, app.session.active_comp().unwrap());
+    assert_eq!(app.session.execute("keys.selectAll", json!({"visible": visible})).unwrap(), json!(1));
+    assert!(app.session.undo());
+    app.handle_events(&egui::Context::default());
+    assert!(!labels(&app).iter().any(|r| r.trim() == ">Mask 1"));
+    assert!(app.session.redo());
+    app.handle_events(&egui::Context::default());
+    assert!(labels(&app).iter().any(|r| r.trim() == ">Mask 1"));
+    assert!(labels(&app).iter().any(|r| r.trim() == "Position"));
+}
+
+/// Repeated delivery must converge to the same presentation, while malformed external arguments fail without mutation.
+#[test]
+fn mask_reveal_validates_arguments_and_repeated_delivery_is_idempotent() {
+    let (mut app, layer) = mask_reveal_app();
+    let mask = mask_reveal_add(&mut app);
+    let comp = app.session.active_comp_id().unwrap().0;
+    let epoch = app.session.script_ui.project_epoch;
+    let params = json!({"comp": comp, "layer": layer, "mask": mask, "projectEpoch": epoch});
+    let ctx = egui::Context::default();
+    let before = serde_json::to_value(&app.ui.timeline).unwrap();
+    for _ in 0..2 {
+        assert_eq!(crate::menus::frontend(&mut app, &ctx, "timeline.revealMask", params.clone()).unwrap(), json!({"revealed": true}));
+        assert_eq!(serde_json::to_value(&app.ui.timeline).unwrap(), before);
+    }
+    for bad in [json!({}), json!({"comp": -1, "layer": layer, "mask": mask, "projectEpoch": epoch})] {
+        assert!(crate::menus::frontend(&mut app, &ctx, "timeline.revealMask", bad).is_err());
+        assert_eq!(serde_json::to_value(&app.ui.timeline).unwrap(), before);
+    }
+}
+
+/// An ID reused by paste or another history branch must not inherit the removed mask's pending reveal.
+#[test]
+fn mask_reveal_does_not_follow_reused_ids_after_undo_or_history_jump() {
+    for route in ["undo", "ancestor", "branch"] {
+        let (mut app, layer) = mask_reveal_app();
+        let source = mask_reveal_add(&mut app);
+        app.ui.timeline = Default::default();
+        app.session.state.selected_props = vec![(LayerId(layer), source)];
+        app.session.execute("edit.copy", json!({})).unwrap();
+        assert_eq!(app.session.state.mask_clipboard.len(), 1);
+        let ancestor = app.session.history_tree().into_iter().find(|n| n.current).unwrap().id;
+        let branch = if route == "branch" {
+            app.session.execute("edit.paste", json!({"layers": [layer]})).unwrap();
+            let id = app.session.history_tree().into_iter().find(|n| n.current).unwrap().id;
+            assert!(app.session.undo());
+            Some(id)
+        } else {
+            None
+        };
+        // Folder allocation aligns the creation UID with paste's increment-first allocator.
+        app.session.execute("project.newFolder", json!({})).unwrap();
+        let removed = app.session.execute("layer.addMask", json!({"layer": layer})).unwrap()["mask"].as_u64().unwrap();
+        app.session.events.push(effectcraft_engine::Event::Toast { message: "keep unrelated events".into(), error: false });
+        if route == "undo" {
+            assert!(app.session.undo());
+            assert!(app.session.undo());
+        } else {
+            assert!(app.session.goto_history(branch.as_deref().unwrap_or(&ancestor)));
+        }
+        let replacement = if route == "branch" {
+            app.session.active_comp().unwrap().layer(LayerId(layer)).unwrap().masks().unwrap().groups().last().unwrap().uid
+        } else {
+            app.session.execute("edit.paste", json!({"layers": [layer]})).unwrap()["masks"][0].as_u64().unwrap()
+        };
+        assert_eq!(removed, replacement, "this regression must actually reuse the UID");
+        app.handle_events(&egui::Context::default());
+        assert!(app.ui.timeline.open_layers.is_empty(), "{route}");
+        assert!(app.ui.timeline.open_groups.is_empty(), "{route}");
+        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("keep unrelated events"));
+    }
+}
+
+/// History sanitation must retain notifications for masks that survive restoration, even after later edits.
+#[test]
+fn mask_reveal_keeps_valid_queued_creations_after_an_unrelated_undo() {
+    let (mut app, layer) = mask_reveal_app();
+    for _ in 0..2 {
+        app.session.execute("layer.addMask", json!({})).unwrap();
+    }
+    app.session.execute("prop.set", json!({"path": "transform/opacity", "value": 50})).unwrap();
+    assert!(app.session.undo());
+    app.handle_events(&egui::Context::default());
+    let names = labels(&app);
+    assert!(app.ui.timeline.open_layers.contains(&layer));
+    for name in [">Mask 1", ">Mask 2"] {
+        assert_eq!(names.iter().filter(|r| r.trim() == name).count(), 1, "{names:?}");
+    }
+}
+
+/// Collapsing a whole-mask row must not leave duplicate flat properties visible through another reveal filter.
+#[test]
+fn mask_reveal_collapsing_a_mask_hides_its_children_under_mixed_filters() {
+    let (mut app, layer) = mask_reveal_app();
+    app.ui.timeline.layer_reveal.insert(layer, vec!["masks".into(), "feather".into()]);
+    let mask = mask_reveal_add(&mut app);
+    app.ui.timeline.open_groups.remove(&mask);
+    let names = labels(&app);
+    assert_eq!(names.iter().filter(|r| r.trim() == ">Mask 1").count(), 1);
+    assert!(!names.iter().any(|r| r.trim() == "Mask Feather"));
+    app.ui.timeline.open_groups.insert(mask);
+    assert_eq!(labels(&app).iter().filter(|r| r.trim() == "Mask Feather").count(), 1);
+}
+
+/// Every icon-only column header says what it is on hover, over the icon it explains, and every
+/// layer switch under one shows the same text.
+#[test]
+fn every_icon_only_header_has_a_hover_text() {
+    let all = crate::state::TimelineState { columns: COLUMNS.iter().map(|c| c.0.to_string()).collect(), show_modes: true, ..Default::default() };
+    let cw = cols(0.0, 2000.0, Vis::of(&all));
+    let ch = Rect::from_min_max(pos2(0.0, 0.0), pos2(2000.0, 20.0));
+    let rects = header_tip_rects(&cw, ch);
+    assert_eq!(rects.len(), HEADER_TIPS.len(), "every header icon is placed with every column shown");
+    for (col, key, r) in &rects {
+        assert_eq!(column_at(&cw, r.center().x), Some(*col), "{key} sits in its column");
+        let (_, _, name, tip) = HEADER_TIPS.iter().find(|t| t.1 == *key).unwrap();
+        assert!(tip.starts_with(&format!("{name}:")) || *key == "num", "{key}: {tip}");
+    }
+    for (i, (_, a, ra)) in rects.iter().enumerate() {
+        for (_, b, rb) in &rects[i + 1..] {
+            assert!(!ra.intersects(*rb) || ra.intersect(*rb).area() < 1.0, "{a} and {b} overlap");
+        }
+    }
+    // The icons the header draws over the A/V and switch columns, left to right.
+    let av: Vec<&str> = rects.iter().filter(|r| r.0 == "av").map(|r| r.1).collect();
+    assert_eq!(av, ["video", "audio", "solo", "lock"]);
+    let sw: Vec<&str> = rects.iter().filter(|r| r.0 == "switches").map(|r| r.1).collect();
+    assert_eq!(sw, ["shy", "collapse", "quality", "fx", "frameBlend", "motionBlur", "adjustment", "threeD"]);
+    for name in av.iter().chain(&sw).chain(&["preserveTransparency"]) {
+        assert!(switch_tip(name).is_some(), "the {name} switch has a hover text");
+    }
+    // A hidden column has no hover targets.
+    let none = crate::state::TimelineState { columns: Default::default(), show_modes: false, ..Default::default() };
+    assert!(header_tip_rects(&cols(0.0, 800.0, Vis::of(&none)), ch).is_empty());
+}
+
+/// One box spans the outline and the time graph (#3056): rows it crosses are selected on both
+/// sides of the boundary, and only keys in the time graph count (the part over the outline is cut).
+#[test]
+fn a_box_over_both_columns_selects_the_rows_it_crosses_and_the_keys_inside() {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 64, "height": 64, "duration": 4, "frameRate": 30})).unwrap();
+    let mut layers = vec![];
+    for name in ["A", "B", "C"] {
+        let id = s.execute("layer.newSolid", json!({"name": name, "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": 0.0, "value": 50})).unwrap();
+        layers.push(id);
+    }
+    s.execute("layer.setSwitch", json!({"layers": [layers[2]], "switch": "lock", "value": true})).unwrap();
+    let comp = s.active_comp().unwrap();
+    let uid = |id: u64| comp.layer(LayerId(id)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    let mut rows = vec![];
+    for id in &layers {
+        rows.push(Row { layer: LayerId(*id), depth: 0, kind: RowKind::Layer });
+        rows.push(Row { layer: LayerId(*id), depth: 1, kind: RowKind::Prop { uid: uid(*id) } });
+    }
+    // Rows are 20 pt and 400 pt wide: the outline is left of x 200, a key at 0 s sits at x 205.
+    let hit_rows: Vec<(Rect, Row)> =
+        rows.iter().enumerate().map(|(i, r)| (Rect::from_min_size(pos2(0.0, 20.0 * i as f32), vec2(400.0, 20.0)), r.clone())).collect();
+    let tm = TMap { x0: 205.0, start: 0.0, pps: 100.0 };
+    let go = |br: Rect| box_targets(comp, &rows, &hit_rows, &tm, 0.0, 20.0, 200.0, false, br);
+    let keyed = |ks: &[effectcraft_engine::KeyRef]| ks.iter().map(|k| k.layer.0).collect::<Vec<_>>();
+    // From the outline across the boundary: layer A's row (y 0..20) and B's row, and their keys.
+    let (ls, ks) = go(Rect::from_min_max(pos2(10.0, 5.0), pos2(260.0, 65.0)));
+    assert_eq!(ls, [layers[0], layers[1]]);
+    assert_eq!(keyed(&ks), [layers[0], layers[1]]);
+    // The same box dragged the other way is the same rectangle: the same rows, the same keys.
+    let (ls, ks) = go(Rect::from_two_pos(pos2(260.0, 65.0), pos2(10.0, 5.0)));
+    assert_eq!((ls, keyed(&ks)), (vec![layers[0], layers[1]], vec![layers[0], layers[1]]));
+    // Only over the outline: rows, no keys; only over the graph: keys, and the rows crossed.
+    let (ls, ks) = go(Rect::from_min_max(pos2(10.0, 5.0), pos2(150.0, 65.0)));
+    assert_eq!((ls.len(), ks.len()), (2, 0), "a key under the outline isn't touched");
+    // Kept inside the time graph: keys only, no rows (a marquee over empty track area).
+    let (ls, ks) = go(Rect::from_min_max(pos2(204.0, 5.0), pos2(260.0, 65.0)));
+    assert_eq!((ls.len(), keyed(&ks)), (0, vec![layers[0], layers[1]]));
+    // A locked layer is not selected as a row (the engine drops its keys in keys.select).
+    let (ls, _) = go(Rect::from_min_max(pos2(10.0, 5.0), pos2(260.0, 119.0)));
+    assert_eq!(ls, [layers[0], layers[1]]);
+}
diff --git a/crates/ui-egui/src/panels/tracker.rs b/crates/ui-egui/src/panels/tracker.rs
index bd54625b8..8d50b4860 100644
--- a/crates/ui-egui/src/panels/tracker.rs
+++ b/crates/ui-egui/src/panels/tracker.rs
@@ -51,8 +51,10 @@ fn current(app: &EffectcraftApp) -> Option<(LayerId, Uid)> {
     l.trackers().next().map(|(g, _)| (l.id, g.uid))
 }
 
+/// The `egui::Id` of the Motion Source dropdown's transient state; picking a new source removes
+/// whatever is stored under it, so the choice starts fresh.
 fn source_id() -> egui::Id {
-    egui::Id::new("tracker-motion-source")
+    egui::Id::unique("tracker-motion-source")
 }
 
 /// Motion Source: the current track's layer, the chosen source, or the selected layer.
@@ -88,7 +90,7 @@ fn button(app: &mut EffectcraftApp, ui: &mut egui::Ui, r: Rect, text: &str, enab
         ui.painter().text(r.center(), Align2::CENTER_CENTER, text, Tokens::medium(12.0), t.text_faint);
         return false;
     }
-    widgets::text_button(ui, r, text, false, &t, egui::Id::new(id)).clicked()
+    widgets::text_button(ui, r, text, false, &t, egui::Id::unique(id)).clicked()
 }
 
 fn run(app: &mut EffectcraftApp, ctx: &egui::Context, cmd: &str, p: serde_json::Value) {
@@ -113,6 +115,37 @@ fn analyze_glyph(p: &egui::Painter, r: Rect, forward: bool, frame: bool, stop: b
     }
 }
 
+/// The two button rows at `y`: Track Camera / Warp Stabilizer, then Track Motion / Stabilize Motion.
+fn top_buttons(app: &mut EffectcraftApp, ui: &mut egui::Ui, ctx: &egui::Context, x0: f32, y: f32, half: f32, source: Option<LayerId>) {
+    let can_track = app.session.active_comp().is_some() && source.is_some();
+    // Track Camera / Warp Stabilizer and Track Motion / Stabilize Motion.
+    let r1 = Rect::from_min_size(pos2(x0, y), vec2(half, 22.0));
+    let r2 = Rect::from_min_size(pos2(x0 + half + 6.0, y), vec2(half, 22.0));
+    let src_p = source.map(|l| json!({"layer": l.0})).unwrap_or_else(|| json!({}));
+    let can_camera = app.session.is_enabled("track.camera") && !app.session.is_camera_analyzing();
+    if button(app, ui, r1, "Track Camera", can_camera, "tracker.trackCamera") {
+        run(app, ctx, "track.camera", json!({}));
+    }
+    let can_warp = app.session.is_enabled("track.warpStabilizer") && !app.session.is_warp_analyzing();
+    if button(app, ui, r2, "Warp Stabilizer", can_warp, "tracker.warpStabilizer") {
+        run(app, ctx, "track.warpStabilizer", json!({}));
+    }
+    let y = y + 28.0;
+    let r1 = Rect::from_min_size(pos2(x0, y), vec2(half, 22.0));
+    let r2 = Rect::from_min_size(pos2(x0 + half + 6.0, y), vec2(half, 22.0));
+    if button(app, ui, r1, "Track Motion", can_track, "tracker.trackMotion") {
+        run(app, ctx, "track.motion", src_p.clone());
+    }
+    if button(app, ui, r2, "Stabilize Motion", can_track, "tracker.stabilizeMotion") {
+        run(app, ctx, "track.stabilize", src_p.clone());
+    }
+}
+
+/// The Tracker panel: the camera/warp and motion/stabilize buttons, Motion Source and Current
+/// Track pickers, the track type and its channels, Motion Target with Edit Target and Options, the
+/// four Analyze buttons (the one whose direction is running offers Stop), Reset and Apply, and the
+/// analysis progress. With a mask selected it switches to its mask-tracking mode. Every change runs a
+/// `track.*` command; while an analysis is running it polls the job and asks for repaints.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -125,33 +158,11 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let w = (rect.width() - 20.0).max(120.0);
     let half = (w - 6.0) / 2.0;
     let mut y = rect.min.y + 10.0;
-    let has_comp = app.session.active_comp().is_some();
     let source = motion_source(app);
     let cur = current(app);
-    let can_track = has_comp && source.is_some();
 
-    // Track Camera / Warp Stabilizer and Track Motion / Stabilize Motion.
-    let r1 = Rect::from_min_size(pos2(x0, y), vec2(half, 22.0));
-    let r2 = Rect::from_min_size(pos2(x0 + half + 6.0, y), vec2(half, 22.0));
-    let src_p = source.map(|l| json!({"layer": l.0})).unwrap_or_else(|| json!({}));
-    let can_camera = app.session.is_enabled("track.camera") && !app.session.is_camera_analyzing();
-    if button(app, ui, r1, "Track Camera", can_camera, "tracker.trackCamera") {
-        run(app, &ctx, "track.camera", json!({}));
-    }
-    let can_warp = app.session.is_enabled("track.warpStabilizer") && !app.session.is_warp_analyzing();
-    if button(app, ui, r2, "Warp Stabilizer", can_warp, "tracker.warpStabilizer") {
-        run(app, &ctx, "track.warpStabilizer", json!({}));
-    }
-    y += 28.0;
-    let r1 = Rect::from_min_size(pos2(x0, y), vec2(half, 22.0));
-    let r2 = Rect::from_min_size(pos2(x0 + half + 6.0, y), vec2(half, 22.0));
-    if button(app, ui, r1, "Track Motion", can_track, "tracker.trackMotion") {
-        run(app, &ctx, "track.motion", src_p.clone());
-    }
-    if button(app, ui, r2, "Stabilize Motion", can_track, "tracker.stabilizeMotion") {
-        run(app, &ctx, "track.stabilize", src_p.clone());
-    }
-    y += 34.0;
+    top_buttons(app, ui, &ctx, x0, y, half, source);
+    y += 62.0;
     let Some(comp) = app.session.active_comp_arc() else {
         p.text(pos2(x0, y + 8.0), Align2::LEFT_CENTER, crate::i18n::tr("Open a composition to track motion."), Tokens::ui(12.0), t.text_faint);
         return;
@@ -170,7 +181,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         comp.layers.iter().enumerate().filter(|(_, l)| trackable(l)).map(|(i, l)| (l.id, format!("{}. {}", i + 1, l.name))).collect();
     let dd = Rect::from_min_size(pos2(field_x, y), vec2(field_w, 20.0));
     let name = source.and_then(|s| srcs.iter().find(|(l, _)| *l == s)).map(|(_, n)| n.clone()).unwrap_or_else(|| "None".into());
-    let did = egui::Id::new("tracker-source-dd");
+    let did = egui::Id::unique("tracker-source-dd");
     if widgets::dropdown(ui, dd, &name, &t, did).clicked() {
         widgets::open_popup(ui, did);
     }
@@ -195,7 +206,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         source.and_then(|s| comp.layer(s)).map(|l| l.trackers().map(|(g, _)| (g.uid, g.name.clone())).collect()).unwrap_or_default();
     let dd = Rect::from_min_size(pos2(field_x, y), vec2(field_w, 20.0));
     let cname = cur.and_then(|(_, u)| trackers.iter().find(|(g, _)| *g == u)).map(|(_, n)| n.clone()).unwrap_or_else(|| "None".into());
-    let did = egui::Id::new("tracker-current-dd");
+    let did = egui::Id::unique("tracker-current-dd");
     if widgets::dropdown(ui, dd, &cname, &t, did).clicked() && !trackers.is_empty() {
         widgets::open_popup(ui, did);
     }
@@ -226,7 +237,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     label(&p, pos2(x0, y + 10.0), "Track Type:", &t);
     let dd = Rect::from_min_size(pos2(field_x, y), vec2(field_w, 20.0));
     let kind = settings.as_ref().map(|s| s.kind).unwrap_or_default();
-    let did = egui::Id::new("tracker-type-dd");
+    let did = egui::Id::unique("tracker-type-dd");
     if widgets::dropdown(ui, dd, if enabled { kind.label() } else { "" }, &t, did).clicked() && enabled {
         widgets::open_popup(ui, did);
     }
@@ -246,10 +257,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         ("scale", "Scale", settings.as_ref().is_some_and(|s| s.scale)),
     ] {
         let cr = Rect::from_min_size(pos2(xx, y + 2.0), vec2(16.0, 16.0));
-        let resp = widgets::checkbox(ui, cr, on && transformish, &t, egui::Id::new(("tracker-cb", key)));
+        let resp = ui.add_enabled_ui(transformish, |ui| widgets::checkbox(ui, cr, on && transformish, &t, egui::Id::unique(("tracker-cb", key)))).inner;
         app.auto.add(&format!("tracker.{key}"), cr, text);
         p.text(pos2(cr.max.x + 4.0, cr.center().y), Align2::LEFT_CENTER, text, Tokens::ui(12.0), if transformish { t.text } else { t.text_faint });
-        if resp.clicked() && transformish {
+        if resp.changed() && transformish {
             run(app, &ctx, "track.setType", with(json!({ key: !on })));
         }
         xx += 84.0;
@@ -294,7 +305,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         (effectcraft_engine::tracking::Direction::FrameForward, true, true, "frameForward", "Analyze 1 frame forward"),
     ] {
         let r = Rect::from_min_size(pos2(bx, y), vec2(30.0, 22.0));
-        let resp = ui.interact(r, egui::Id::new(("tracker-analyze", id)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("tracker-analyze", id)), Sense::click()).on_hover_text(tip);
         let stop = tracking && running_dir == Some(dir) && !frame;
         let on = enabled && (!tracking || stop);
         p.rect_filled(r, 4.0, if resp.hovered() && on { t.hover } else { t.field_bg });
@@ -366,7 +377,7 @@ fn mask_mode(app: &mut EffectcraftApp, ui: &mut egui::Ui, ctx: &egui::Context, p
     label(p, pos2(x0, y + 10.0), "Method:", &t);
     let method = app.session.state.mask_track_method;
     let dd = Rect::from_min_size(pos2(field_x, y), vec2(field_w, 20.0));
-    let did = egui::Id::new("tracker-mask-method-dd");
+    let did = egui::Id::unique("tracker-mask-method-dd");
     if widgets::dropdown(ui, dd, method.label(), &t, did).clicked() {
         widgets::open_popup(ui, did);
     }
@@ -387,7 +398,7 @@ fn mask_mode(app: &mut EffectcraftApp, ui: &mut egui::Ui, ctx: &egui::Context, p
         (effectcraft_engine::tracking::Direction::FrameForward, true, true, "frameForward", "Track selected masks 1 frame forward"),
     ] {
         let r = Rect::from_min_size(pos2(bx, y), vec2(30.0, 22.0));
-        let resp = ui.interact(r, egui::Id::new(("tracker-mask-track", id)), Sense::click()).on_hover_text(tip);
+        let resp = ui.interact(r, egui::Id::unique(("tracker-mask-track", id)), Sense::click()).on_hover_text(tip);
         let stop = running && running_dir == Some(dir) && !frame;
         let on = !running || stop;
         p.rect_filled(r, 4.0, if resp.hovered() && on { t.hover } else { t.field_bg });
@@ -506,20 +517,20 @@ pub fn options_dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens)
         ui.add_space(8.0);
         ui.label(egui::RichText::new(crate::i18n::tr("Process Before Match")).font(Tokens::medium(12.5)));
         ui.horizontal(|ui| {
-            let r = ui.checkbox(&mut d.blur_on, crate::i18n::tr("Blur"));
+            let r = crate::widgets::labelled_checkbox(ui, &mut d.blur_on, crate::i18n::tr("Blur"));
             app.auto.add("dialog.trackOptions.blurOn", r.rect, "Blur");
             let r =
                 ui.add_enabled(d.blur_on, crate::widgets::drag_value(egui::DragValue::new(&mut d.opts.blur).speed(0.1).range(0.5..=50.0).suffix(" pixels")));
             app.auto.add("dialog.trackOptions.blur", r.rect, "Blur pixels");
-            let r = ui.checkbox(&mut d.opts.enhance, crate::i18n::tr("Enhance"));
+            let r = crate::widgets::labelled_checkbox(ui, &mut d.opts.enhance, crate::i18n::tr("Enhance"));
             app.auto.add("dialog.trackOptions.enhance", r.rect, "Enhance");
         });
         ui.add_space(8.0);
-        let r = ui.checkbox(&mut d.opts.subpixel, crate::i18n::tr("Subpixel Positioning"));
+        let r = crate::widgets::labelled_checkbox(ui, &mut d.opts.subpixel, crate::i18n::tr("Subpixel Positioning"));
         app.auto.add("dialog.trackOptions.subpixel", r.rect, "Subpixel Positioning");
-        let r = ui.checkbox(&mut d.opts.adapt_every_frame, crate::i18n::tr("Adapt Feature On Every Frame"));
+        let r = crate::widgets::labelled_checkbox(ui, &mut d.opts.adapt_every_frame, crate::i18n::tr("Adapt Feature On Every Frame"));
         app.auto.add("dialog.trackOptions.adaptEveryFrame", r.rect, "Adapt Feature On Every Frame");
-        let r = ui.checkbox(&mut d.opts.track_shape, crate::i18n::tr("Follow Feature Rotation and Scale"));
+        let r = crate::widgets::labelled_checkbox(ui, &mut d.opts.track_shape, crate::i18n::tr("Follow Feature Rotation and Scale"));
         app.auto.add("dialog.trackOptions.trackShape", r.rect, "Follow Feature Rotation and Scale");
         ui.add_space(8.0);
         ui.horizontal(|ui| {
@@ -530,7 +541,7 @@ pub fn options_dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens)
                 (LowConfidence::Adapt, "Adapt Feature"),
             ];
             let cur = actions.iter().find(|(a, _)| *a == d.opts.action).map(|(_, l)| *l).unwrap_or("Adapt Feature");
-            let r = egui::ComboBox::from_id_salt("track-action")
+            let r = craft_ui::ComboBox::from_id_salt("track-action")
                 .selected_text(cur)
                 .show_ui(ui, |ui| {
                     for (a, l) in actions {
@@ -583,7 +594,7 @@ pub fn target_dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens)
         ui.horizontal(|ui| {
             ui.label(crate::i18n::tr("Layer:"));
             let cur = d.target.and_then(|id| layers.iter().find(|(l, _)| *l == id)).map(|(_, n)| n.clone()).unwrap_or_else(|| "None".into());
-            let r = egui::ComboBox::from_id_salt("track-target")
+            let r = craft_ui::ComboBox::from_id_salt("track-target")
                 .selected_text(cur)
                 .width(240.0)
                 .show_ui(ui, |ui| {
@@ -615,8 +626,8 @@ pub fn apply_dialog(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
     super::dialogs::modal(ctx, "Motion Tracker Apply Options", vec2(380.0, 170.0), t, |ui| {
         ui.horizontal(|ui| {
             ui.label(crate::i18n::tr("Apply Dimensions:"));
-            let labels = ["X and Y", "X only", "Y only"];
-            let r = egui::ComboBox::from_id_salt("track-apply-dims")
+            let labels = [crate::i18n::tr("X and Y"), crate::i18n::tr("X only"), crate::i18n::tr("Y only")];
+            let r = craft_ui::ComboBox::from_id_salt("track-apply-dims")
                 .selected_text(labels[d.dims.min(2)])
                 .show_ui(ui, |ui| {
                     for (i, l) in labels.iter().enumerate() {
diff --git a/crates/ui-egui/src/panels/unprecompose.rs b/crates/ui-egui/src/panels/unprecompose.rs
new file mode 100644
index 000000000..55f3545d5
--- /dev/null
+++ b/crates/ui-egui/src/panels/unprecompose.rs
@@ -0,0 +1,181 @@
+//! Layer ▸ Un-precompose from the menu: when expanding the pre-comp layer would change the picture
+//! or drop something (the command's dry run lists why), the reasons are shown first and the user
+//! chooses to cancel or to unpack anyway (`force`). Cancel changes nothing; a pre-comp layer
+//! without reasons is unpacked at once, and one that cannot be unpacked at all (locked, not a
+//! pre-comp) reports its error without the prompt. Agents running `layer.unprecompose` with
+//! `engine.execute` are never asked: they pass `force` or get the error listing the reasons.
+//!
+//! Automation ids: `dialog.unprecompose.force`, `dialog.unprecompose.cancel`.
+
+use crate::i18n::tr;
+use egui::vec2;
+use serde_json::{Value, json};
+
+use crate::theme::Tokens;
+use crate::{Dialog, EffectcraftApp};
+
+const COMMAND: &str = "layer.unprecompose";
+
+/// The unpack waiting on the prompt: its params and the dry run's reasons.
+#[derive(Clone, Debug, Default)]
+pub struct Pending {
+    pub command: Option<(Value, Vec<String>)>,
+}
+
+/// Whether command `id` with `params` needs the prompt first. When it does, the prompt opens
+/// holding the command and the caller must not run it. `Err` when the dry run fails (a locked
+/// layer, a layer that is not a pre-comp, several layers), with the message.
+pub fn guard(app: &mut EffectcraftApp, id: &str, params: &Value) -> Result<bool, String> {
+    if id != COMMAND || params.get("force") == Some(&Value::Bool(true)) || params.get("dryRun") == Some(&Value::Bool(true)) {
+        return Ok(false);
+    }
+    let mut dry = params.as_object().cloned().unwrap_or_default();
+    dry.insert("dryRun".into(), Value::Bool(true));
+    let r = app.session.execute(COMMAND, Value::Object(dry)).map_err(|e| e.to_string())?;
+    let warnings: Vec<String> = r["warnings"].as_array().map(|w| w.iter().filter_map(Value::as_str).map(str::to_string).collect()).unwrap_or_default();
+    if warnings.is_empty() {
+        return Ok(false);
+    }
+    // The layer the warnings are about, whatever is selected by the time the prompt is answered.
+    let mut pinned = params.as_object().cloned().unwrap_or_default();
+    if !pinned.contains_key("layer") && !pinned.contains_key("layers") {
+        pinned.insert("layers".into(), json!(app.session.state.selected_layers.iter().map(|l| l.0).collect::<Vec<_>>()));
+    }
+    if let Some(comp) = app.session.active_comp_id().filter(|_| !pinned.contains_key("comp")) {
+        pinned.insert("comp".into(), json!(comp.0));
+    }
+    app.dialog_state.unprecompose.command = Some((Value::Object(pinned), warnings));
+    app.dialog = Some(Dialog::Unprecompose);
+    Ok(true)
+}
+
+pub fn show(app: &mut EffectcraftApp, ctx: &egui::Context, t: &Tokens) {
+    let Some((_, warnings)) = app.dialog_state.unprecompose.command.clone() else {
+        app.dialog = None;
+        return;
+    };
+    let mut answer: Option<bool> = None;
+    super::dialogs::modal_vertical(ctx, "Un-precompose", vec2(520.0, 300.0), t, |ui| {
+        ui.label(egui::RichText::new(tr("Unpacking this pre-comp layer changes the picture or drops something:")).color(t.tab_text_active));
+        ui.add_space(6.0);
+        egui::ScrollArea::vertical().max_height(160.0).show(ui, |ui| {
+            for w in &warnings {
+                ui.label(egui::RichText::new(format!("•  {w}")).color(t.tab_text_active));
+            }
+        });
+        ui.add_space(4.0);
+        ui.label(egui::RichText::new(tr("What the pre-comp layer itself carries is dropped. You can undo this.")).color(t.text_dim).size(11.0));
+        ui.add_space(14.0);
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            let label = tr("Unpack Anyway");
+            let r = ui.button(label);
+            app.auto.add("dialog.unprecompose.force", r.rect, label);
+            if r.clicked() {
+                answer = Some(true);
+            }
+            let r = ui.button(tr("Cancel"));
+            app.auto.add("dialog.unprecompose.cancel", r.rect, "Cancel");
+            if r.clicked() {
+                answer = Some(false);
+            }
+        });
+    });
+    if answer.is_none() && ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+        answer = Some(false);
+    }
+    if let Some(go) = answer {
+        finish(app, ctx, go);
+    }
+}
+
+/// The prompt's answer: Cancel (`false`) drops the unpack, Unpack Anyway runs it with `force`.
+fn finish(app: &mut EffectcraftApp, ctx: &egui::Context, go: bool) {
+    app.dialog = None;
+    let Some((params, _)) = app.dialog_state.unprecompose.command.take() else { return };
+    if go {
+        // An error is already in the status bar.
+        let _ = crate::menus::run_engine(app, ctx, COMMAND, forced(&params));
+    }
+}
+
+/// `params` with the user's consent to the reasons the prompt listed.
+fn forced(params: &Value) -> Value {
+    let mut p = params.as_object().cloned().unwrap_or_default();
+    p.insert("force".into(), json!(true));
+    Value::Object(p)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use effectcraft_engine::Session;
+
+    /// A comp with two solids nested into a pre-comp; the pre-comp layer's id.
+    fn scene(app: &mut EffectcraftApp) -> u64 {
+        let s = &mut app.session;
+        s.execute("comp.new", json!({"name": "Main", "width": 640, "height": 360, "duration": 4.0, "fps": 24.0})).unwrap();
+        let a = s.execute("layer.newSolid", json!({"color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+        let b = s.execute("layer.newSolid", json!({"color": "#00ff00"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap()["layer"].as_u64().unwrap()
+    }
+
+    fn layer_count(s: &Session) -> usize {
+        s.active_comp().map_or(0, |c| c.layers.len())
+    }
+
+    fn fresh() -> (egui::Context, EffectcraftApp) {
+        let ctx = egui::Context::default();
+        let app = EffectcraftApp::new(Session::default());
+        crate::theme::install(&ctx, &app.tokens, crate::i18n::language(&app));
+        (ctx, app)
+    }
+
+    #[test]
+    fn the_menu_asks_and_unpack_anyway_unpacks() {
+        let (ctx, mut app) = fresh();
+        let pre = scene(&mut app);
+        app.session.execute("prop.set", json!({"layer": pre, "path": "transform/opacity", "value": 50})).unwrap();
+        let params = json!({"layers": [pre]});
+        let r = crate::menus::invoke(&mut app, &ctx, COMMAND, params.clone()).unwrap();
+        assert_eq!(r, json!({"dialog": "unprecompose"}));
+        assert_eq!(app.dialog, Some(Dialog::Unprecompose));
+        let (_, warnings) = app.dialog_state.unprecompose.command.clone().unwrap();
+        assert!(warnings.iter().any(|w| w.contains("Opacity")), "{warnings:?}");
+        // Drawn, the prompt offers both answers under their automation ids.
+        crate::panels::dialogs::press_key(&mut app, &ctx, egui::Key::A, egui::Modifiers::NONE);
+        assert!(app.auto.find("dialog.unprecompose.force").is_some() && app.auto.find("dialog.unprecompose.cancel").is_some());
+        // Escape is Cancel: nothing changes.
+        crate::panels::dialogs::press_key(&mut app, &ctx, egui::Key::Escape, egui::Modifiers::NONE);
+        assert!(app.dialog.is_none() && app.dialog_state.unprecompose.command.is_none());
+        assert_eq!(layer_count(&app.session), 1, "Cancel left the pre-comp layer");
+        // Unpack Anyway unpacks.
+        crate::menus::invoke(&mut app, &ctx, COMMAND, params).unwrap();
+        assert_eq!(app.dialog, Some(Dialog::Unprecompose));
+        finish(&mut app, &ctx, true);
+        assert!(app.dialog.is_none());
+        assert_eq!(layer_count(&app.session), 2, "the two solids are back");
+    }
+
+    #[test]
+    fn a_clean_precomp_unpacks_without_asking_and_a_locked_one_is_an_error() {
+        let (ctx, mut app) = fresh();
+        let pre = scene(&mut app);
+        assert_eq!(guard(&mut app, COMMAND, &json!({"layers": [pre]})), Ok(false));
+        crate::menus::invoke(&mut app, &ctx, COMMAND, json!({"layers": [pre]})).unwrap();
+        assert!(app.dialog.is_none());
+        assert_eq!(layer_count(&app.session), 2);
+
+        let (_, mut app) = fresh();
+        let pre = scene(&mut app);
+        app.session.execute("prop.set", json!({"layer": pre, "path": "transform/opacity", "value": 50})).unwrap();
+        app.session.execute("layer.setSwitch", json!({"layers": [pre], "switch": "lock", "value": true})).unwrap();
+        let e = guard(&mut app, COMMAND, &json!({"layers": [pre]})).unwrap_err();
+        assert!(e.contains("locked"), "{e}");
+        assert!(app.dialog.is_none());
+        assert_eq!(layer_count(&app.session), 1);
+        // Consented and dry-run calls, and other commands, are not asked.
+        assert_eq!(guard(&mut app, COMMAND, &json!({"layers": [pre], "force": true})), Ok(false));
+        assert_eq!(guard(&mut app, COMMAND, &json!({"layers": [pre], "dryRun": true})), Ok(false));
+        assert_eq!(guard(&mut app, "layer.precompose", &json!({})), Ok(false));
+    }
+}
diff --git a/crates/ui-egui/src/panels/unsaved.rs b/crates/ui-egui/src/panels/unsaved.rs
index 05f719fa9..7befef4e2 100644
--- a/crates/ui-egui/src/panels/unsaved.rs
+++ b/crates/ui-egui/src/panels/unsaved.rs
@@ -16,7 +16,16 @@ use crate::theme::Tokens;
 use crate::{Dialog, EffectcraftApp};
 
 /// Commands that replace or close the open project (Quit is asked when the window closes).
-const CLOSING: &[&str] = &["file.newProject", "file.open", "file.openRecent", "file.closeProject", "file.revert", "file.openDemoProject", "templates.create"];
+const CLOSING: &[&str] = &[
+    "file.newProject",
+    "file.open",
+    "file.openRecent",
+    "file.closeProject",
+    "file.revert",
+    "file.openDemoProject",
+    "templates.create",
+    "file.runShutdownScripts",
+];
 
 /// The command waiting on the prompt, and whether the user already answered it.
 #[derive(Clone, Debug, Default)]
@@ -58,6 +67,15 @@ pub fn on_close_requested(app: &mut EffectcraftApp, ctx: &egui::Context) {
     }
 }
 
+/// On macOS a close that nothing held open quits through `-[NSApplication terminate:]` instead:
+/// closing the window while AppKit's run loop is running crashes on a Mac with a Touch Bar
+/// (#341). `on_exit` still runs. A desktop host calls it last in `logic`, after
+/// `EffectcraftApp::tick` (which runs [`on_close_requested`]) and its own work. Returns whether
+/// that quit was scheduled; other platforms close the window as before.
+pub fn quit_on_close(ctx: &egui::Context) -> bool {
+    craft_quit::on_close_request(ctx)
+}
+
 /// The project's display name: its file name, or `Untitled Project.ecproj`.
 pub fn project_name(app: &EffectcraftApp) -> String {
     app.session
@@ -207,11 +225,46 @@ mod tests {
         out.viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::CancelClose))
     }
 
+    /// One frame of the dialogs with the window's close button pressed, through
+    /// [`on_close_requested`] and then [`quit_on_close`] as the app runs them; returns whether the
+    /// close was canceled and whether the platform quit was scheduled.
+    fn close_frame(app: &mut EffectcraftApp, ctx: &egui::Context) -> (bool, bool) {
+        let mut raw = egui::RawInput::default();
+        raw.viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+        let mut quits = false;
+        let mut out = ctx.run_ui(raw, |ui| {
+            app.auto.begin_frame();
+            on_close_requested(app, ui.ctx());
+            quits = quit_on_close(ui.ctx());
+            crate::panels::dialogs::show(app, ui.ctx());
+        });
+        out.textures_delta.clear();
+        let canceled = out.viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::CancelClose));
+        (canceled, quits)
+    }
+
     fn modified(app: &mut EffectcraftApp) {
         app.session.execute("comp.new", json!({"name": "Main", "width": 64, "height": 64})).unwrap();
         assert!(app.session.is_dirty());
     }
 
+    #[test]
+    fn shutdown_scripts_prompt_before_discarding_unsaved_work() {
+        let (mut app, ctx) = app();
+        modified(&mut app);
+        let result = crate::menus::invoke(&mut app, &ctx, "file.runShutdownScripts", json!({})).unwrap();
+        assert_eq!(result, json!({"dialog": "unsavedChanges"}));
+        assert_eq!(app.session.project.comps().count(), 1);
+        assert!(app.session.is_dirty());
+        answer_with(&mut app, &ctx, Answer::Cancel);
+        assert_eq!(app.session.project.comps().count(), 1);
+        assert!(app.session.is_dirty());
+        crate::menus::invoke(&mut app, &ctx, "file.runShutdownScripts", json!({})).unwrap();
+        answer_with(&mut app, &ctx, Answer::Discard);
+        assert_eq!(app.session.project.comps().count(), 0);
+        assert!(!app.session.is_dirty() && app.dialog.is_none());
+    }
+
     #[test]
     fn closing_a_modified_project_asks_and_cancel_keeps_it() {
         let (mut app, ctx) = app();
@@ -340,4 +393,81 @@ mod tests {
         assert!(!app.session.is_dirty());
         assert!(!frame(&mut app, &ctx, true));
     }
+
+    /// Closing the window while AppKit's run loop is running crashes on a Mac with a Touch Bar
+    /// (#341). On macOS the close is canceled and the app quits through
+    /// `-[NSApplication terminate:]`. Other platforms close the window.
+    #[test]
+    fn closing_a_saved_project_quits_through_the_platform_on_macos() {
+        let (mut app, ctx) = app();
+        let macos = cfg!(target_os = "macos");
+        assert_eq!(close_frame(&mut app, &ctx), (macos, macos));
+        assert!(app.dialog.is_none(), "nothing to ask");
+    }
+
+    #[test]
+    fn closing_a_modified_project_asks_before_the_platform_quit() {
+        let (mut app, ctx) = app();
+        modified(&mut app);
+        assert_eq!(close_frame(&mut app, &ctx), (true, false), "the prompt holds the window and nothing quits");
+        assert_eq!(app.dialog, Some(Dialog::UnsavedChanges));
+        answer_with(&mut app, &ctx, Answer::Cancel);
+        assert!(app.session.is_dirty() && !app.dialog_state.unsaved.quitting);
+        assert_eq!(close_frame(&mut app, &ctx), (true, false), "asked again after Cancel");
+        answer_with(&mut app, &ctx, Answer::Discard);
+        let macos = cfg!(target_os = "macos");
+        assert_eq!(close_frame(&mut app, &ctx), (macos, macos), "Don't Save quits");
+    }
+
+    /// While the window is minimized or hidden, eframe runs `App::logic` without `App::ui` and
+    /// still handles a close: `logic` asks about a modified project.
+    #[test]
+    fn a_close_while_only_logic_runs_asks_about_a_modified_project() {
+        let (mut app, ctx) = app();
+        modified(&mut app);
+        let mut raw = egui::RawInput::default();
+        raw.viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+        let mut frame = eframe::Frame::_new_kittest();
+        let out = ctx.run_logic(&raw, |ctx| eframe::App::logic(&mut app, ctx, &mut frame));
+        let canceled = out.viewport_commands.get(&egui::ViewportId::ROOT).is_some_and(|c| c.contains(&egui::ViewportCommand::CancelClose));
+        assert!(canceled, "the close is canceled");
+        assert_eq!(app.dialog, Some(Dialog::UnsavedChanges));
+    }
+
+    /// A file dialog answered in the frame that closes the window runs its command before the
+    /// close decision, so a change it makes is asked about.
+    #[test]
+    fn a_dialog_answer_runs_before_the_close_decision() {
+        let (mut app, ctx) = app();
+        assert!(!app.session.is_dirty());
+        let answer = crate::DialogAnswer { command: "comp.new".into(), key: "name", params: json!({"width": 64, "height": 64}), paths: vec!["Main".into()] };
+        app.dialog_answers.0.send(answer).unwrap();
+        let mut raw = egui::RawInput::default();
+        raw.viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+        let mut frame = eframe::Frame::_new_kittest();
+        let out = ctx.run_logic(&raw, |ctx| eframe::App::logic(&mut app, ctx, &mut frame));
+        let canceled = out.viewport_commands.get(&egui::ViewportId::ROOT).is_some_and(|c| c.contains(&egui::ViewportCommand::CancelClose));
+        assert!(app.session.is_dirty(), "the answer ran");
+        assert!(canceled, "the close is canceled");
+        assert_eq!(app.dialog, Some(Dialog::UnsavedChanges));
+    }
+
+    /// The tick makes the close decision and leaves the platform quit to the host, which runs it
+    /// last in `logic`, after its own work (the desktop host shows the file dialogs asked for).
+    /// On macOS `logic` cancels the close and quits; other platforms close the window.
+    #[test]
+    fn the_platform_quit_runs_after_the_tick() {
+        let (mut app, ctx) = app();
+        let mut raw = egui::RawInput::default();
+        raw.viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+        let frame = eframe::Frame::_new_kittest();
+        let canceled =
+            |out: &egui::LogicOutput| out.viewport_commands.get(&egui::ViewportId::ROOT).is_some_and(|c| c.contains(&egui::ViewportCommand::CancelClose));
+        let out = ctx.run_logic(&raw, |ctx| app.tick(ctx, &frame));
+        assert!(!canceled(&out), "the tick leaves a saved project's close to the host");
+        let mut frame = eframe::Frame::_new_kittest();
+        let out = ctx.run_logic(&raw, |ctx| eframe::App::logic(&mut app, ctx, &mut frame));
+        assert_eq!(canceled(&out), cfg!(target_os = "macos"), "logic quits through the platform on macOS");
+        assert!(app.dialog.is_none(), "nothing to ask");
+    }
 }
diff --git a/crates/ui-egui/src/panels/viewer.rs b/crates/ui-egui/src/panels/viewer.rs
index 984ad696f..cd0006c0f 100644
--- a/crates/ui-egui/src/panels/viewer.rs
+++ b/crates/ui-egui/src/panels/viewer.rs
@@ -18,6 +18,27 @@ use crate::state::Tool;
 use crate::theme::Tokens;
 use crate::{EffectcraftApp, widgets};
 
+/// A 3D view's name in the interface's language: the View menu's row for its `view.3d.*` command,
+/// else the panel catalog, else the English source. The menu's rows carry After Effects' words —
+/// フロントビュー rather than フロント — so the viewer's dropdown and the comp's view label read
+/// the same names as View ▸ Switch 3D View.
+pub(crate) fn view3d_label(v: View3D) -> &'static str {
+    let id = match v {
+        View3D::ActiveCamera => "view.3d.activeCamera",
+        View3D::Default => "view.3d.default",
+        View3D::Front => "view.3d.front",
+        View3D::Left => "view.3d.left",
+        View3D::Top => "view.3d.top",
+        View3D::Back => "view.3d.back",
+        View3D::Right => "view.3d.right",
+        View3D::Bottom => "view.3d.bottom",
+        View3D::Custom1 => "view.3d.custom1",
+        View3D::Custom2 => "view.3d.custom2",
+        View3D::Custom3 => "view.3d.custom3",
+    };
+    crate::i18n::command_label(id, v.label())
+}
+
 /// Viewer mapping published each frame (for the control channel and other panels).
 #[derive(Clone, Copy, Debug)]
 pub struct ViewerMap {
@@ -37,10 +58,15 @@ impl ViewerMap {
     }
 }
 
+/// The `egui::Id` under which the last pass's `ViewerMap` is published.
 fn map_id() -> egui::Id {
-    egui::Id::new("viewer-map")
+    egui::Id::unique("viewer-map")
 }
 
+/// The egui data key (an `egui::Pos2`) of a right-click on the viewer that an overlay sensed:
+/// the viewer opens its context menu there on the next pass.
+pub(crate) const FORWARDED_SECONDARY: &str = "viewer-forwarded-secondary";
+
 pub fn comp_to_screen(ctx: &egui::Context, p: [f32; 2]) -> Option<Pos2> {
     let m: ViewerMap = ctx.data(|d| d.get_temp(map_id()))?;
     Some(m.to_screen([p[0] as f64, p[1] as f64]))
@@ -53,722 +79,71 @@ pub fn screen_to_comp(ctx: &egui::Context, p: Pos2) -> Option<[f64; 2]> {
 
 /// The fit magnification from the last frame.
 pub fn last_fit(ctx: &egui::Context) -> f32 {
-    ctx.data(|d| d.get_temp::<f32>(egui::Id::new("viewer-fit"))).unwrap_or(0.5)
-}
-
-/// What a drag in the viewer is doing.
-#[derive(Clone, Debug)]
-enum Gesture {
-    /// Per layer: start position and the parent-space change per comp pixel of drag in x and y.
-    Move {
-        layers: Vec<(LayerId, [f64; 3], [f64; 3], [f64; 3])>,
-        start: [f64; 2],
-        /// The grabbed layer's feature nearest the pointer (comp px at the start): it snaps.
-        snap_src: Option<[f64; 2]>,
-    },
-    Camera {
-        tool: Tool,
-    },
-    /// A bounding-box handle: scales about the anchor point so the grabbed point follows the
-    /// pointer (corners both axes, edges one), relative to the layer as the drag began; the
-    /// handle snaps.
-    Scale {
-        layer: LayerId,
-        start_scale: [f64; 3],
-        /// The grabbed point relative to the anchor, in layer pixels.
-        start_local: [f64; 2],
-        /// The handle's point relative to the anchor, in layer pixels.
-        handle: [f64; 2],
-        anchor: [f64; 2],
-        axes: [bool; 2],
-        /// Layer pixels → comp as the drag began, and its inverse.
-        l2c: Mat3,
-        inv: Mat3,
-        /// The other selected layers and their scales as the drag began: they scale by the same
-        /// ratio about their own anchor points, as in After Effects (#491).
-        others: Vec<(LayerId, [f64; 3])>,
-    },
-    Rotate {
-        layer: LayerId,
-        center: Pos2,
-        /// The pointer's angle about the centre on the last frame (degrees, as atan2 gives it).
-        last_angle: f64,
-        /// The turn so far, summed frame by frame so it keeps counting past a full revolution in
-        /// either direction (After Effects: 1x +0.0°, −1x −90.0°…) instead of wrapping at ±180°.
-        turned: f64,
-        start_rot: f64,
-        /// The other selected layers and their rotations: they turn by the same angle.
-        others: Vec<(LayerId, f64)>,
-    },
-    Anchor {
-        layer: LayerId,
-        start_anchor: [f64; 3],
-        start_pos: [f64; 3],
-        start: [f64; 2],
-        inv: Mat3,
-        l2p: Mat3,
-        /// The layer's own snap targets as the drag began (its box and path vertices).
-        own: Vec<effectcraft_engine::viewer::SnapTarget>,
-        /// Alt held as the drag began: the anchor point moves alone, so the layer shifts.
-        anchor_only: bool,
-    },
-    Pan {
-        start_pan: [f32; 2],
-    },
-    Create {
-        tool: Tool,
-        start: [f64; 2],
-    },
-    Marquee {
-        start: Pos2,
-    },
-    /// Dragging selected mask / shape path vertices: press point, the grabbed vertex (comp px,
-    /// it snaps), the comp-space move applied so far and comp → path space.
-    Vertices {
-        start: [f64; 2],
-        src: [f64; 2],
-        applied: [f64; 2],
-        inv: Mat3,
-        layer: LayerId,
-    },
-    /// Dragging a vertex's Bezier tangent (both sides symmetric unless Alt breaks them).
-    Tangent {
-        layer: LayerId,
-        mask: u64,
-        index: usize,
-        out: bool,
-        vertex: [f64; 2],
-        inv: Mat3,
-    },
-    /// Dragging a Puppet pin (comp → layer matrix inverse).
-    PuppetPin {
-        layer: LayerId,
-        pin: u64,
-        inv: Mat3,
-    },
-    /// Rotating an Advanced / Bend pin by its ring: the pin's screen centre, the pointer's last
-    /// angle (radians) and the rotation so far (°, accumulated so it can pass a full turn).
-    PuppetRotate {
-        layer: LayerId,
-        pin: u64,
-        center: Pos2,
-        last: f32,
-        rotation: f64,
-    },
-    /// Scaling an Advanced / Bend pin by its square: the pin's screen centre, the press distance
-    /// from it and the scale at the press (1 = 100 %).
-    PuppetScale {
-        layer: LayerId,
-        pin: u64,
-        center: Pos2,
-        start: f32,
-        scale: f64,
-    },
-    /// Puppet tools: a marquee selecting pins (dragged outside the layer's art, or Alt-dragged).
-    PinMarquee {
-        start: Pos2,
-    },
-    /// Object Matte tool: a box around the object (screen point where the drag began).
-    ObjectMatteBox {
-        start: Pos2,
-    },
-    /// Puppet tool Record mode (⌘/Ctrl-drag a pin): the drag is sampled in real time (seconds
-    /// since it began, effect space) and becomes keyframes on release (`puppet.recordPin`); the
-    /// current time runs along while recording.
-    PuppetRecord {
-        layer: LayerId,
-        pin: u64,
-        /// Other selected pins of the layer, moving with the dragged one.
-        others: Vec<u64>,
-        inv: Mat3,
-        began: f64,
-        cti: Tick,
-        samples: Vec<(f64, [f64; 2])>,
-    },
-    /// Pen tool: pulling the tangents of the vertex just placed.
-    Pen {
-        layer: LayerId,
-        mask: u64,
-        index: usize,
-        vertex: [f64; 2],
-        inv: Mat3,
-        press: Pos2,
-    },
-    /// Dragging a track point's feature/search region, a corner or its attach point.
-    Track {
-        layer: LayerId,
-        tracker: u64,
-        drag: super::tracker::Drag,
-    },
-    /// Motion paths, free transform, Mask Feather, guides and the region of interest
-    /// (`viewer_overlays`).
-    Overlay(ov::Drag),
-}
-
-/// Pen tool path in progress: (layer, mask uid).
-fn pen_id() -> egui::Id {
-    egui::Id::new("viewer-pen")
+    ctx.data(|d| d.get_temp::<f32>(egui::Id::unique("viewer-fit"))).unwrap_or(0.5)
 }
 
 use super::viewer_overlays::{self as ov, VertexHit};
 use super::viewer_tools as vt;
 
-const HANDLE: f32 = 7.0;
-/// How close (screen points) the pointer must be to a path vertex or tangent handle to grab it.
-const VERTEX_GRAB: f32 = 6.0;
-
-/// The reach of a path vertex at `pos` (#1042): a vertex marker sitting under, or just beside, a
-/// bounding-box handle would lose the press to the handle (the handle reaches further than the
-/// vertex), so wherever a box handle is in range the vertex reaches as far as the handle does.
-/// Vertices then win in the handle's whole zone, as in After Effects.
-fn vertex_grab_radius(pos: Pos2, handles: impl IntoIterator<Item = Pos2>) -> f32 {
-    if handles.into_iter().any(|h| h.distance(pos) < HANDLE + 2.0) { HANDLE + 2.0 } else { VERTEX_GRAB }
-}
-/// Shown when a Roto Brush tool is used in the Composition panel (#753).
-const ROTO_HINT: &str = "The Roto Brush works in the Layer panel. Double-click the layer to open it.";
-
 thread_local! {
     /// The 3D view camera of the viewer being drawn (None = the comp's active camera).
     static VIEW_CAM: std::cell::Cell<Option<CameraState>> = const { std::cell::Cell::new(None) };
 }
 
-/// Region of interest handles on screen: corners (0–3, clockwise from top-left) then edge
-/// midpoints (4 top, 5 right, 6 bottom, 7 left).
-fn roi_handles(r: Rect) -> [Pos2; 8] {
-    [r.left_top(), r.right_top(), r.right_bottom(), r.left_bottom(), r.center_top(), r.right_center(), r.center_bottom(), r.left_center()]
-}
-
-/// A drag starting on a region of interest handle: the ROI redrawn from the opposite corner (or
-/// edge, with the other axis kept).
-fn roi_drag(app: &EffectcraftApp, map: &ViewerMap, comp_rect: Rect, zoom: f32, press: Pos2) -> Option<ov::Drag> {
-    let [rx, ry, rw, rh] = app.session.state.region_of_interest?;
-    let r = Rect::from_min_size(comp_rect.min + vec2(rx as f32 * zoom, ry as f32 * zoom), vec2(rw as f32 * zoom, rh as f32 * zoom));
-    let i = roi_handles(r).iter().position(|h| h.distance(press) < 6.0)?;
-    let (x0, y0, x1, y1) = (rx, ry, rx + rw, ry + rh);
-    let _ = map;
-    Some(match i {
-        0 => ov::Drag::Roi { start: [x1, y1], keep: [None, None] },
-        1 => ov::Drag::Roi { start: [x0, y1], keep: [None, None] },
-        2 => ov::Drag::Roi { start: [x0, y0], keep: [None, None] },
-        3 => ov::Drag::Roi { start: [x1, y0], keep: [None, None] },
-        4 => ov::Drag::Roi { start: [x1, y1], keep: [Some(x0), None] },
-        5 => ov::Drag::Roi { start: [x0, y0], keep: [None, Some(y1)] },
-        6 => ov::Drag::Roi { start: [x0, y0], keep: [Some(x1), None] },
-        _ => ov::Drag::Roi { start: [x1, y0], keep: [None, Some(y1)] },
-    })
-}
-
-/// The camera the viewer shows (view camera or the comp's active camera).
-fn cam_state(ctx: &EvalCtx) -> CameraState {
-    VIEW_CAM.with(|c| c.get()).unwrap_or_else(|| three_d::active_camera(ctx))
-}
-
-/// Layer → comp (viewer) matrix through the current 3D view.
-pub(crate) fn l2c(ctx: &EvalCtx, layer: &Layer) -> (Mat3, f64) {
-    match VIEW_CAM.with(|c| c.get()) {
-        Some(cam) if layer.is_3d() => (three_d::layer_to_view(ctx, layer, &cam), 0.0),
-        _ => ctx.layer_to_comp(layer),
-    }
-}
-
-/// `l2c` (layer → comp) applied from effect space instead: effect points and Puppet pins,
-/// measured from the top-left of the layer's effect bounds (see `effect_bounds`).
-pub(crate) fn from_effect_space(ctx: &EvalCtx, layer: &Layer, l2c: Mat3) -> Mat3 {
-    let o = ctx.effect_bounds(layer).1;
-    l2c * Mat3::translate(gv2(o[0], o[1]))
-}
-
-/// Effect space → comp (viewer) matrix through the current 3D view.
-pub(crate) fn fx2c(ctx: &EvalCtx, layer: &Layer) -> Mat3 {
-    from_effect_space(ctx, layer, l2c(ctx, layer).0)
-}
-
-/// The selected, unlocked layers of `comp` other than `layer` (when `layer` is one of them): a
-/// handle or Rotation tool drag on one changes them all.
-fn selected_others<'a>(app: &EffectcraftApp, comp: &'a Comp, layer: LayerId) -> Vec<&'a Layer> {
-    let sel = &app.session.state.selected_layers;
-    if !sel.contains(&layer) {
-        return vec![];
-    }
-    sel.iter().filter(|id| **id != layer).filter_map(|id| comp.layer(*id)).filter(|l| !l.switches.locked && l.transform().is_some()).collect()
-}
-
-/// The least homogeneous depth (`w`: the distance in front of a perspective camera in pixels, 1
-/// for 2D layers and orthographic views) a viewer outline is drawn at: points at or behind the
-/// camera would flip through infinity and draw long lines across the viewer (#572).
-const NEAR_W: f64 = 0.5;
-
-/// `p` through the homography `m` before the perspective divide: (x, y, w).
-fn homogeneous(m: &Mat3, p: [f64; 2]) -> [f64; 3] {
-    let r = |i: usize| m.0.get(i).map_or(0.0, |row| row[0] * p[0] + row[1] * p[1] + row[2]);
-    [r(0), r(1), r(2)]
-}
-
-/// The closed polygon `poly` (layer pixels) through `m`, clipped to the part in front of the
-/// camera's near plane (comp pixels; empty when none of it is).
-fn project_clipped(m: &Mat3, poly: &[[f64; 2]]) -> Vec<[f64; 2]> {
-    let h: Vec<[f64; 3]> = poly.iter().map(|p| homogeneous(m, *p)).collect();
-    let mut out = vec![];
-    for (i, a) in h.iter().enumerate() {
-        let Some(b) = h.get((i + 1) % h.len()) else { continue };
-        let (ina, inb) = (a[2] >= NEAR_W, b[2] >= NEAR_W);
-        if ina {
-            out.push(*a);
-        }
-        if ina != inb {
-            let t = (NEAR_W - a[2]) / (b[2] - a[2]);
-            out.push([a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, NEAR_W]);
-        }
-    }
-    out.iter().map(|q| [q[0] / q[2], q[1] / q[2]]).filter(|q| q[0].is_finite() && q[1].is_finite()).collect()
-}
-
-/// The segment a → b (world space) through the projection `pc`, clipped at the near plane.
-fn project_segment(pc: &effectcraft_engine::geom::Mat4, a: effectcraft_engine::geom::Vec3, b: effectcraft_engine::geom::Vec3) -> Option<[[f64; 2]; 2]> {
-    let h = |p: effectcraft_engine::geom::Vec3| {
-        let r = |i: usize| pc.0.get(i).map_or(0.0, |row| row[0] * p.x + row[1] * p.y + row[2] * p.z + row[3]);
-        [r(0), r(1), r(3)]
-    };
-    let (mut ha, mut hb) = (h(a), h(b));
-    if ha[2] < NEAR_W && hb[2] < NEAR_W {
-        return None;
-    }
-    let cut = |p: [f64; 3], q: [f64; 3]| {
-        let t = (NEAR_W - p[2]) / (q[2] - p[2]);
-        [p[0] + (q[0] - p[0]) * t, p[1] + (q[1] - p[1]) * t, NEAR_W]
-    };
-    if ha[2] < NEAR_W {
-        ha = cut(ha, hb);
-    } else if hb[2] < NEAR_W {
-        hb = cut(hb, ha);
-    }
-    let d = |q: [f64; 3]| [q[0] / q[2], q[1] / q[2]];
-    let s = [d(ha), d(hb)];
-    s.iter().flatten().all(|v| v.is_finite()).then_some(s)
-}
-
-/// The content box corners (layer pixels) of `layer`.
-fn box_corners(b: [f64; 4]) -> [[f64; 2]; 4] {
-    [[b[0], b[1]], [b[2], b[1]], [b[2], b[3]], [b[0], b[3]]]
-}
-
-/// Layer → comp matrix and its bounds quad (in comp pixels). None for a 3D layer reaching to or
-/// behind the camera (its quad would flip; [`layer_outline`] draws the part in front).
-pub(crate) fn layer_quad(ctx: &EvalCtx, layer: &Layer) -> Option<(Mat3, [[f64; 2]; 4], [f64; 4])> {
-    let b = effectcraft_engine::render::content_bounds(ctx, layer)?;
-    let (m, _) = l2c(ctx, layer);
-    let corners = box_corners(b);
-    if corners.iter().any(|p| homogeneous(&m, *p)[2] < NEAR_W) {
-        return None;
-    }
-    let pts = corners.map(|p| {
-        let q = m.apply(gv2(p[0], p[1]));
-        [q.x, q.y]
-    });
-    Some((m, pts, b))
-}
-
-/// The outline of a layer's content box in comp pixels, clipped at the camera's near plane.
-pub(crate) fn layer_outline(ctx: &EvalCtx, layer: &Layer) -> Vec<[f64; 2]> {
-    let Some(b) = effectcraft_engine::render::content_bounds(ctx, layer) else { return vec![] };
-    project_clipped(&l2c(ctx, layer).0, &box_corners(b))
-}
-
-/// Which axes a bounding-box handle scales: corners (0–3) both; the top and bottom edges (4, 6)
-/// y; the right and left edges (5, 7) x.
-fn handle_axes(handle: usize) -> [bool; 2] {
-    match handle {
-        4 | 6 => [false, true],
-        5 | 7 => [true, false],
-        _ => [true, true],
-    }
-}
-
-/// A bounding-box handle's point in layer pixels (`b`: the content box; handles as in
-/// [`handle_axes`], the corners clockwise from the top left, then the top, right, bottom and
-/// left edges' midpoints).
-fn handle_point(b: [f64; 4], handle: usize) -> [f64; 2] {
-    let (cx, cy) = ((b[0] + b[2]) / 2.0, (b[1] + b[3]) / 2.0);
-    match handle {
-        0 => [b[0], b[1]],
-        1 => [b[2], b[1]],
-        2 => [b[2], b[3]],
-        3 => [b[0], b[3]],
-        4 => [cx, b[1]],
-        5 => [b[2], cy],
-        6 => [cx, b[3]],
-        _ => [b[0], cy],
-    }
-}
-
-/// The resize cursor over bounding-box handle `handle` of the on-screen box `sq` (corners
-/// clockwise from the top left, handles as in [`handle_point`]): along the direction the handle
-/// scales, so it turns with the layer, as in After Effects. A corner points between its two
-/// edges (the box's diagonal whatever its proportions), an edge handle across its edge.
-fn handle_cursor(sq: &[Pos2], handle: usize) -> egui::CursorIcon {
-    let at = |k: usize| sq.get(k % 4).copied().unwrap_or(Pos2::ZERO);
-    let dir = if handle < 4 {
-        let c = at(handle);
-        (c - at(handle + 3)).normalized() + (c - at(handle + 1)).normalized()
-    } else {
-        let e = at(handle - 3) - at(handle - 4);
-        vec2(-e.y, e.x)
-    };
-    // Screen y points down: 45° is the south-east diagonal.
-    let a = dir.y.atan2(dir.x).to_degrees().rem_euclid(180.0);
-    if !(22.5..157.5).contains(&a) {
-        egui::CursorIcon::ResizeHorizontal
-    } else if a < 67.5 {
-        egui::CursorIcon::ResizeNwSe
-    } else if a < 112.5 {
-        egui::CursorIcon::ResizeVertical
-    } else {
-        egui::CursorIcon::ResizeNeSw
-    }
-}
-
-/// The scale ratio (x, y) that puts the point grabbed at `start` (relative to the anchor, layer
-/// pixels) under the pointer at `cur`. `uniform` (Shift on a corner) keeps the aspect ratio,
-/// following the pointer along the handle's diagonal. Dragging past the anchor flips the layer,
-/// as in After Effects; an axis whose grabbed point sits on the anchor keeps its scale.
-fn drag_ratio(start: [f64; 2], cur: [f64; 2], axes: [bool; 2], uniform: bool) -> [f64; 2] {
-    if uniform {
-        let d2 = start[0] * start[0] + start[1] * start[1];
-        let f = if d2 > 1e-6 { (cur[0] * start[0] + cur[1] * start[1]) / d2 } else { 1.0 };
-        return [f, f];
-    }
-    [0, 1].map(|k| if axes[k] && start[k].abs() > 1e-3 { cur[k] / start[k] } else { 1.0 })
-}
-
-/// Snap a handle drag (#252): the handle (`h`, layer pixels from the anchor point `a` as the
-/// drag began; `l2c` that layer space → comp) at scale ratio `f` goes through `snap` (a comp
-/// point → its correction), and the ratio that puts the handle where it snapped comes back.
-/// A `uniform` drag slides the handle along its line from the anchor point to the nearer snapped
-/// line; otherwise each scaled axis takes the snapped point.
-fn snap_handle(f: [f64; 2], h: [f64; 2], a: [f64; 2], l2c: &Mat3, axes: [bool; 2], uniform: bool, snap: impl FnOnce([f64; 2]) -> [f64; 2]) -> [f64; 2] {
-    let at = |f: [f64; 2]| {
-        let q = l2c.apply(gv2(a[0] + f[0] * h[0], a[1] + f[1] * h[1]));
-        [q.x, q.y]
-    };
-    let p = at(f);
-    let c = snap(p);
-    let s = [p[0] + c[0], p[1] + c[1]];
-    if uniform {
-        let o = at([0.0; 2]);
-        let d = [p[0] - o[0], p[1] - o[1]];
-        let k = [0, 1].into_iter().filter(|k| c[*k] != 0.0 && d[*k].abs() > 1e-9).min_by(|x, y| c[*x].abs().total_cmp(&c[*y].abs()));
-        return k.map_or(f, |k| f.map(|v| v * (s[k] - o[k]) / d[k]));
-    }
-    let Some(inv) = l2c.inverse().filter(|_| c != [0.0; 2]) else { return f };
-    let q = inv.apply(gv2(s[0], s[1]));
-    let q = [q.x - a[0], q.y - a[1]];
-    [0, 1].map(|k| if axes[k] && h[k].abs() > 1e-9 { q[k] / h[k] } else { f[k] })
-}
-
-/// The turn from angle `from` to angle `to` (degrees), wrapped to (−180°, 180°]: the shortest way
-/// round, so summing it frame by frame follows the pointer across atan2's ±180° seam and past full
-/// revolutions. Non-finite input turns by nothing.
-fn turn_delta(from: f64, to: f64) -> f64 {
-    let d = to - from;
-    if !d.is_finite() {
-        return 0.0;
-    }
-    let w = (d + 180.0).rem_euclid(360.0) - 180.0;
-    if w <= -180.0 { w + 360.0 } else { w }
-}
-
-/// The Rotation tool's value: the rotation as the drag began plus the turn so far (which may span
-/// revolutions), snapped to 45° steps with Shift.
-fn rotate_value(start_rot: f64, turned: f64, shift: bool) -> f64 {
-    let r = start_rot + turned;
-    let r = if r.is_finite() { r } else { start_rot };
-    if shift { (r / 45.0).round() * 45.0 } else { r }
-}
-
-/// A drag `d` (comp pixels), kept to the axis it moves along most when `shift` is held.
-fn one_axis(d: [f64; 2], shift: bool) -> [f64; 2] {
-    if !shift {
-        d
-    } else if d[0].abs() > d[1].abs() {
-        [d[0], 0.0]
-    } else {
-        [0.0, d[1]]
-    }
-}
-
-fn point_in_quad(p: [f64; 2], q: &[[f64; 2]; 4]) -> bool {
-    let mut sign = 0.0;
-    for i in 0..4 {
-        let a = q[i];
-        let b = q[(i + 1) % 4];
-        let c = (b[0] - a[0]) * (p[1] - a[1]) - (b[1] - a[1]) * (p[0] - a[0]);
-        if c.abs() < 1e-9 {
-            continue;
-        }
-        if sign == 0.0 {
-            sign = c.signum();
-        } else if c.signum() != sign {
-            return false;
-        }
-    }
-    true
-}
-
-/// Separating-axis test: a marquee may cross a layer without containing any corner.
-fn quad_intersects_box(q: &[[f64; 2]; 4], a: [f64; 2], b: [f64; 2]) -> bool {
-    if q.iter().flatten().chain(a.iter()).chain(b.iter()).any(|v| !v.is_finite()) {
-        return false;
-    }
-    let lo = [a[0].min(b[0]), a[1].min(b[1])];
-    let hi = [a[0].max(b[0]), a[1].max(b[1])];
-    let rect = [lo, [hi[0], lo[1]], hi, [lo[0], hi[1]]];
-    let axes = [[1.0, 0.0], [0.0, 1.0]].into_iter().chain((0..4).map(|i| {
-        let j = (i + 1) % 4;
-        [q[j][1] - q[i][1], q[i][0] - q[j][0]]
-    }));
-    for axis in axes {
-        let project = |p: &[f64; 2]| p[0] * axis[0] + p[1] * axis[1];
-        let (qmin, qmax) = q.iter().map(project).fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), v| (lo.min(v), hi.max(v)));
-        let (rmin, rmax) = rect.iter().map(project).fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), v| (lo.min(v), hi.max(v)));
-        if qmax < rmin || rmax < qmin {
-            return false;
-        }
-    }
-    true
-}
-
-/// Parent-space linear inverse (to convert a comp-space drag delta into a position delta).
-fn parent_inverse(ctx: &EvalCtx, layer: &Layer) -> Mat3 {
-    match layer.parent.and_then(|p| ctx.comp.layer(p)) {
-        Some(p) => {
-            let w = ctx.world_matrix(p);
-            let m = Mat3([[w.0[0][0], w.0[0][1], 0.0], [w.0[1][0], w.0[1][1], 0.0], [0.0, 0.0, 1.0]]);
-            m.inverse().unwrap_or(Mat3::IDENTITY)
-        }
-        None => Mat3::IDENTITY,
-    }
-}
-
-/// Draw the extra views of a 2- or 4-view layout and return the main view's rectangle.
-fn aux_views(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    comp: &effectcraft_engine::project::Comp,
+/// Draw the Composition viewer in `rect` and handle its input for one pass.
+/// Publishes the fit magnification and `ViewerMap`, requests and draws the frame, then paints the nav breadcrumbs,
+/// view layout, guides/grid, layer boxes, handles, anchors, 3D gizmos, motion paths, masks, puppet pins and tracker
+/// overlays and records their automation regions. Pointer and drop gestures run engine commands
+/// (move/scale/rotate/anchor/camera/shape/mask/guide edits, picks, marquees); failures worth showing go to
+/// `app.ui.status`, while per-frame drag updates ignore errors so a gesture is not aborted mid-drag. With no active
+/// composition it draws `empty_state` and returns.
+/// What the passes of one viewer frame share (see [`show`]).
+struct Vw<'a> {
+    t: Tokens,
     cid: effectcraft_engine::project::ItemId,
-    full: Rect,
-    bg: Color32,
-) -> Rect {
-    let n = app.session.state.view_layout;
-    if n < 2 {
-        return full;
-    }
-    let gap = 2.0;
-    let views = app.session.state.views3d.get(&cid).cloned().unwrap_or_default();
-    let (main, aux): (Rect, Vec<(Rect, View3D)>) = if n == 2 {
-        let mid = full.center().x;
-        (
-            Rect::from_min_max(pos2(mid + gap / 2.0, full.min.y), full.max),
-            vec![(Rect::from_min_max(full.min, pos2(mid - gap / 2.0, full.max.y)), views.pane(0))],
-        )
-    } else {
-        let c = full.center();
-        let q = |x0: f32, y0: f32, x1: f32, y1: f32| Rect::from_min_max(pos2(x0, y0), pos2(x1, y1));
-        (
-            q(c.x + gap / 2.0, c.y + gap / 2.0, full.max.x, full.max.y),
-            vec![
-                (q(full.min.x, full.min.y, c.x - gap / 2.0, c.y - gap / 2.0), views.pane(0)),
-                (q(c.x + gap / 2.0, full.min.y, full.max.x, c.y - gap / 2.0), views.pane(1)),
-                (q(full.min.x, c.y + gap / 2.0, c.x - gap / 2.0, full.max.y), views.pane(2)),
-            ],
-        )
-    };
-    let ctx = ui.ctx().clone();
-    let p = ui.painter().clone();
-    p.rect_filled(full, 0.0, Color32::from_black_alpha(200));
-    let t = app.session.time();
-    let (cw, ch) = (comp.width as f32, comp.height as f32);
-    let share = app.session.state.share_view_options;
-    // The camera and light wireframes of each view (as in After Effects, where every view of the
-    // layout shows them), evaluated on a snapshot of the project.
-    let snap_project = app.session.project.clone();
-    let snap_expr = app.session.expr.clone();
-    let ectx = EvalCtx { project: &snap_project, comp_id: cid, comp, time: t, expr: snap_expr.as_deref(), footage: None };
-    let selected = app.session.state.selected_layers.clone();
-    let mut picked: Option<(usize, View3D)> = None;
-    for (i, (r, v)) in aux.into_iter().enumerate() {
-        p.rect_filled(r, 0.0, bg);
-        let fit = ((r.width() - 20.0) / cw).min((r.height() - 20.0) / ch).max(0.01);
-        let cr = Rect::from_center_size(r.center(), vec2(cw * fit, ch * fit));
-        let scale = (fit * ctx.pixels_per_point()).min(1.0) as f64;
-        // The Active Camera pane renders through the comp's own camera; the others through their
-        // view camera.
-        let through_active = v == View3D::ActiveCamera;
-        let cam = if through_active { three_d::active_camera(&ectx) } else { views.cam(v, comp.width as f64, comp.height as f64).state() };
-        let key = {
-            use std::hash::{Hash, Hasher};
-            let mut h = std::collections::hash_map::DefaultHasher::new();
-            (app.session.revision, cid.0, t.0, i, scale.to_bits(), format!("{cam:?}")).hash(&mut h);
-            h.finish()
-        };
-        let id = egui::Id::new(("viewer-aux", i));
-        let cached: Option<(u64, egui::TextureHandle)> = ctx.data(|d| d.get_temp(id));
-        let tex = match cached {
-            Some((k, tex)) if k == key => tex,
-            _ => {
-                let opts = effectcraft_engine::render::RenderOpts {
-                    scale,
-                    view: (comp.has_3d() && !through_active).then_some(cam),
-                    draft: true,
-                    ..Default::default()
-                };
-                let img = app.session.render(cid, t, opts);
-                let tex = crate::frames::load_fitted(&ctx, format!("viewer-aux-{i}"), crate::frames::to_color_image(&img), egui::TextureOptions::LINEAR);
-                ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
-                tex
-            }
-        };
-        let b = comp.background;
-        p.rect_filled(cr, 0.0, Color32::from_rgb((b[0] * 255.0) as u8, (b[1] * 255.0) as u8, (b[2] * 255.0) as u8));
-        p.image(tex.id(), cr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-        p.rect_stroke(cr, 0.0, Stroke::new(1.0, Color32::from_black_alpha(160)), StrokeKind::Outside);
-        if share && app.ui.viewer.safe_margins {
-            for k in [0.9, 0.8] {
-                p.rect_stroke(Rect::from_center_size(cr.center(), cr.size() * k), 0.0, Stroke::new(1.0, Color32::from_white_alpha(120)), StrokeKind::Middle);
-            }
-        }
-        if comp.has_3d() {
-            let map = ViewerMap { origin: cr.min, zoom: fit, comp: [cw, ch], area: r };
-            draw_rigs(app, &p.with_clip_rect(r), &map, &ectx, &selected, cam, through_active, Some(v.id()));
-        }
-        let label = if comp.has_3d() { v.label() } else { crate::i18n::tr("Active Camera") };
-        p.text(r.left_bottom() + vec2(8.0, -8.0), Align2::LEFT_BOTTOM, label, Tokens::ui(11.0), Color32::from_white_alpha(200));
-        app.auto.add(&format!("viewer.view.{}", v.id()), r, label);
-        if comp.has_3d()
-            && let Some(chosen) = pane_selector(app, ui, i + 1, r, v)
-        {
-            picked = Some((i + 1, chosen));
-        }
-    }
-    if let Some((pane, v)) = picked
-        && let Err(e) = app.session.execute("view.setPaneView", json!({"pane": pane, "view": v.id(), "comp": cid.0}))
-    {
-        app.ui.status = e.to_string();
-    }
-    main
-}
-
-/// The view selector in the top-left corner of pane `pane` (1 to 3) of a multi-view layout, a
-/// popup of every 3D view like the toolbar's 3D View menu. Returns the view chosen this frame.
-fn pane_selector(app: &mut EffectcraftApp, ui: &mut egui::Ui, pane: usize, area: Rect, current: View3D) -> Option<View3D> {
-    let t = app.tokens;
-    let r = Rect::from_min_size(area.min + vec2(6.0, 6.0), vec2(124.0, 20.0));
-    let pid = egui::Id::new(("viewer-pane-view", pane));
-    let response = widgets::dropdown(ui, r, crate::i18n::tr(current.label()), &t, pid);
-    if response.clicked() {
-        let open = widgets::popup_is_open(ui, pid);
-        ui.data_mut(|d| d.insert_temp(pid.with("open"), !open));
-    }
-    app.auto.add_response(&format!("viewer.view.{pane}.type"), &response, "View of pane");
-    if !widgets::popup_is_open(ui, pid) {
-        return None;
-    }
-    let chosen = widgets::popup_list(ui, pid, r.left_bottom() + vec2(0.0, 2.0), r, View3D::ALL.len(), 0, |ui| {
-        ui.set_min_width(124.0);
-        let mut chosen = None;
-        for (k, v) in View3D::ALL.iter().enumerate() {
-            let item = ui.selectable_label(*v == current, crate::i18n::tr(v.label()));
-            app.auto.add(&format!("viewer.view.{pane}.typeItem.{k}"), item.rect, v.label());
-            if item.clicked() {
-                chosen = Some(*v);
-            }
-        }
-        chosen
-    });
-    chosen.filter(|v| *v != current)
-}
-
-/// View ▸ Split with New Locked Viewer: the locked viewer on the left of the Composition panel
-/// (its comp and 3D view stay put whatever comp is active). Returns the main viewer's rectangle.
-fn locked_pane(app: &mut EffectcraftApp, ui: &mut egui::Ui, full: Rect, bg: Color32) -> Rect {
-    let Some(lv) = app.session.state.locked_viewer else { return full };
-    let Some(comp) = app.session.project.comp_arc(lv.comp) else { return full };
-    let name = app.session.project.item(lv.comp).map(|i| i.name.clone()).unwrap_or_default();
-    let gap = 2.0;
-    let mid = full.center().x;
-    let r = Rect::from_min_max(full.min, pos2(mid - gap / 2.0, full.max.y));
-    let main = Rect::from_min_max(pos2(mid + gap / 2.0, full.min.y), full.max);
-    let ctx = ui.ctx().clone();
-    let p = ui.painter().clone();
-    p.rect_filled(Rect::from_min_max(pos2(r.max.x, full.min.y), pos2(main.min.x, full.max.y)), 0.0, Color32::from_black_alpha(200));
-    p.rect_filled(r, 0.0, bg);
-    let (cw, ch) = (comp.width as f32, comp.height as f32);
-    let fit = ((r.width() - 20.0) / cw).min((r.height() - 44.0) / ch).max(0.01);
-    let cr = Rect::from_center_size(r.center(), vec2(cw * fit, ch * fit));
-    let scale = (fit * ctx.pixels_per_point()).min(1.0) as f64;
-    let t = app.session.time_of(lv.comp);
-    let cam = (lv.view != View3D::ActiveCamera && comp.has_3d())
-        .then(|| app.session.state.views3d.get(&lv.comp).cloned().unwrap_or_default().cam(lv.view, comp.width as f64, comp.height as f64).state());
-    let dc = effectcraft_engine::viewer::DisplayColor::of(&app.session);
-    // The display conversion's inputs, keyed as in the main viewer's texture caches.
-    let dc_key = format!("{cam:?}{}", super::viewer_tools::display_key(app, dc.is_some()));
-    let key = {
-        use std::hash::{Hash, Hasher};
-        let mut h = std::collections::hash_map::DefaultHasher::new();
-        (app.session.revision, lv.comp.0, t.0, scale.to_bits(), dc_key).hash(&mut h);
-        h.finish()
-    };
-    let id = egui::Id::new("viewer-locked");
-    let cached: Option<(u64, egui::TextureHandle)> = ctx.data(|d| d.get_temp(id));
-    let tex = match cached {
-        Some((k, tex)) if k == key => tex,
-        _ => {
-            let opts = effectcraft_engine::render::RenderOpts { scale, view: cam, ..Default::default() };
-            let img = app.session.render(lv.comp, t, opts);
-            let mut ci = crate::frames::to_color_image(&img);
-            if let Some(dc) = dc {
-                let mut px: Vec<[u8; 4]> = ci.pixels.iter().map(|c| c.to_array()).collect();
-                dc.apply(&mut px);
-                ci = egui::ColorImage::new(ci.size, px.into_iter().map(|a| Color32::from_rgba_premultiplied(a[0], a[1], a[2], a[3])).collect());
-            }
-            let tex = crate::frames::load_fitted(&ctx, "viewer-locked", ci, egui::TextureOptions::LINEAR);
-            ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
-            tex
-        }
-    };
-    let b = comp.background;
-    p.rect_filled(cr, 0.0, Color32::from_rgb((b[0] * 255.0) as u8, (b[1] * 255.0) as u8, (b[2] * 255.0) as u8));
-    p.image(tex.id(), cr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-    p.rect_stroke(cr, 0.0, Stroke::new(1.0, Color32::from_black_alpha(160)), StrokeKind::Outside);
-    let label = crate::i18n::tr_args("Locked: {} — {}", &[&name, &(if comp.has_3d() { lv.view.label() } else { crate::i18n::tr("Active Camera") })]);
-    p.text(r.left_top() + vec2(8.0, 8.0), Align2::LEFT_TOP, &label, Tokens::ui(11.0), Color32::from_white_alpha(210));
-    app.auto.add("viewer.locked", r, &label);
-    // Close the locked viewer.
-    let close = Rect::from_min_size(pos2(r.max.x - 26.0, r.min.y + 4.0), vec2(20.0, 20.0));
-    let resp = ui.interact(close, egui::Id::new("viewer-locked-close"), Sense::click());
-    p.text(close.center(), Align2::CENTER_CENTER, "\u{00d7}", Tokens::ui(14.0), if resp.hovered() { Color32::WHITE } else { Color32::from_white_alpha(170) });
-    app.auto.add("viewer.locked.close", close, "Close Locked Viewer");
-    if resp.clicked() {
-        let _ = app.session.execute("view.closeLockedViewer", serde_json::json!({}));
-    }
-    main
-}
-
-pub(crate) fn checker(p: &egui::Painter, r: Rect) {
-    let s = 10.0;
-    p.rect_filled(r, 0.0, Color32::from_gray(0xcc));
-    let mut y = r.min.y;
-    let mut row = 0;
-    while y < r.max.y {
-        let mut x = r.min.x + if row % 2 == 0 { 0.0 } else { s };
-        while x < r.max.x {
-            p.rect_filled(Rect::from_min_max(pos2(x, y), pos2((x + s).min(r.max.x), (y + s).min(r.max.y))), 0.0, Color32::from_gray(0x99));
-            x += 2.0 * s;
-        }
-        y += s;
-        row += 1;
-    }
+    nav: Rect,
+    bar: Rect,
+    err_bar: Rect,
+    err_h: f32,
+    pasteboard: Color32,
+    area: Rect,
+    outer: Rect,
+    comp_rect: Rect,
+    zoom: f32,
+    ppp: f32,
+    cw: f32,
+    ch: f32,
+    map: ViewerMap,
+    time: Tick,
+    overlays: bool,
+    mods: egui::Modifiers,
+    space_pan: bool,
+    text_owns: bool,
+    gid: egui::Id,
+    track_cur: Option<(LayerId, effectcraft_engine::project::Uid)>,
+    has_3d: bool,
+    ctx: egui::Context,
+    comp_name: String,
+    p: egui::Painter,
+    painter: egui::Painter,
+    selected: Vec<LayerId>,
+    sel_vertices: Vec<effectcraft_engine::VertexRef>,
+    ft: Option<ov::FtBox>,
+    comp: &'a Comp,
+    gesture: Option<Gesture>,
+    handle_hits: Vec<(LayerId, usize, Pos2, egui::CursorIcon)>,
+    axis_hits: Vec<(LayerId, [Pos2; 2], [f64; 3], [f64; 3])>,
+    vertex_hits: Vec<VertexHit>,
+    vertex_marks: Vec<ov::VertexMark>,
+    key_hits: Vec<ov::KeyHit>,
+    motion_frames: Vec<ov::PathFrame>,
+    paths: Vec<ov::PathInfo>,
+    track_hits: Vec<super::tracker::Hit>,
+    pin_hits: Vec<super::puppet_tool::PinHit>,
+    puppet_layers: Vec<(&'a Layer, super::puppet_tool::Overlay)>,
 }
 
+/// Draws the viewer panel in `rect` for the active comp and handles its input.
 pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let t = app.tokens;
     let ctx = ui.ctx().clone();
@@ -780,7 +155,87 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let comp_name = app.session.project.item(cid).map(|i| i.name.clone()).unwrap_or_default();
     let p = ui.painter().clone();
     VIEW_CAM.with(|c| c.set(app.session.view_camera(cid)));
+    let mut v = Vw {
+        t,
+        cid,
+        nav: Rect::NOTHING,
+        bar: Rect::NOTHING,
+        err_bar: Rect::NOTHING,
+        err_h: 0.0,
+        pasteboard: Color32::BLACK,
+        area: Rect::NOTHING,
+        outer: Rect::NOTHING,
+        comp_rect: Rect::NOTHING,
+        zoom: 1.0,
+        ppp: 1.0,
+        cw: 0.0,
+        ch: 0.0,
+        map: ViewerMap { origin: Pos2::ZERO, zoom: 1.0, comp: [0.0; 2], area: Rect::NOTHING },
+        time: Tick::ZERO,
+        overlays: false,
+        mods: egui::Modifiers::NONE,
+        space_pan: false,
+        text_owns: false,
+        gid: egui::Id::unique("viewer-gesture"),
+        track_cur: None,
+        has_3d: false,
+        ctx: ctx.clone(),
+        comp_name,
+        painter: p.clone(),
+        p,
+        selected: vec![],
+        sel_vertices: vec![],
+        ft: None,
+        comp: &comp,
+        gesture: None,
+        handle_hits: vec![],
+        axis_hits: vec![],
+        vertex_hits: vec![],
+        vertex_marks: vec![],
+        key_hits: vec![],
+        motion_frames: vec![],
+        paths: vec![],
+        track_hits: vec![],
+        pin_hits: vec![],
+        puppet_layers: vec![],
+    };
+    phase_nav(app, ui, rect, &mut v);
+    phase_layout(app, ui, rect, &mut v);
+    phase_frame(app, &mut v);
+    let snap_project = app.session.project.clone();
+    let snap_expr = app.session.expr.clone();
+    let ectx = EvalCtx {
+        project: &snap_project,
+        comp_id: cid,
+        comp: &comp,
+        time: v.time,
+        expr: snap_expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    phase_guides(app, &ectx, &mut v);
+    phase_layers(app, ui, &ectx, &mut v);
+    phase_scene(app, &ectx, &mut v);
+    phase_rigs(app, ui, &ectx, &mut v);
+    let resp = phase_menu(app, ui, &ectx, &mut v);
+    phase_hover(app, ui, &ectx, &resp, &mut v);
+    phase_press(app, ui, &ectx, &resp, &mut v);
+    if !middle_pan(app, ui, &resp, &v) {
+        phase_dragstart(app, ui, &ectx, &resp, &mut v);
+        phase_drag(app, ui, &ectx, &resp, &mut v);
+        phase_stopped(app, ui, &ectx, &resp, &mut v);
+        phase_clicked(app, &ectx, &resp, &mut v);
+        phase_dblclick(app, &ectx, &resp, &mut v);
+    }
+    phase_tail(app, ui, &ectx, &mut v);
+}
 
+fn phase_nav(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, v: &mut Vw<'_>) {
+    let t = v.t;
+    let cid = v.cid;
+    let p = v.p.clone();
     // Navigator bar (open comps as breadcrumbs). After Effects shows a single breadcrumb row:
     // when the Composition Navigator (nested comp flow) is above the viewer, this row is left
     // out.
@@ -793,7 +248,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let name = app.session.project.item(oc).map(|i| i.name.clone()).unwrap_or_default();
         let g = p.layout_no_wrap(name.clone(), Tokens::ui(11.5), t.text);
         let r = Rect::from_min_size(pos2(x, nav.min.y + 3.0), vec2(g.size().x + 16.0, 18.0));
-        let resp = ui.interact(r, egui::Id::new(("nav", oc.0)), Sense::click());
+        let resp = ui.interact(r, egui::Id::unique(("nav", oc.0)), Sense::click());
         let active = oc == cid;
         p.rect_filled(
             r,
@@ -813,7 +268,16 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         x = r.max.x + 4.0;
     }
+    v.nav = nav;
+}
 
+fn phase_layout(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect, v: &mut Vw<'_>) {
+    let t = v.t;
+    let cid = v.cid;
+    let nav = v.nav;
+    let ctx = v.ctx.clone();
+    let p = v.p.clone();
+    let comp = v.comp;
     // Bottom control bar.
     let bar_h = 36.0;
     let bar = Rect::from_min_max(pos2(rect.min.x, rect.max.y - bar_h), rect.max);
@@ -825,7 +289,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     // View ▸ Switch View Layout: extra views (Top / Front / Right) beside the main view, which
     // keeps the overlays and the interaction.
     let full = locked_pane(app, ui, full, pasteboard);
-    let area = aux_views(app, ui, &comp, cid, full, pasteboard);
+    let area = aux_views(app, ui, comp, cid, full, pasteboard);
     p.rect_filled(area, 0.0, pasteboard);
     // View ▸ Show Rulers takes a strip on the top and left.
     let outer = area;
@@ -835,7 +299,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let fit = ((area.width() - 40.0) / cw).min((area.height() - 40.0) / ch).max(0.01);
     // Fit up to 100% follows the panel's size like Fit does, and stops at 100%.
     let fit = if app.ui.viewer.fit_up_to_100 { fit.min(1.0 / ctx.pixels_per_point()) } else { fit };
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("viewer-fit"), fit));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("viewer-fit"), fit));
     let zoom = app.ui.viewer.zoom.unwrap_or(fit);
     let center = area.center() + vec2(app.ui.viewer.pan[0], app.ui.viewer.pan[1]);
     // On the physical pixel grid, so at 100 % every comp pixel covers exactly one screen pixel
@@ -848,15 +312,37 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let painter = p.with_clip_rect(area);
     // Settings ▸ 3D ▸ Extended Viewer: custom 3D views (and Draft 3D) render the visible
     // pasteboard too, so 3D layers reaching past the comp frame stay visible there.
-    app.ui.viewer.extended = extended_region(app, &comp, cid, map);
+    app.ui.viewer.extended = extended_region(app, comp, cid, map);
+    v.bar = bar;
+    v.err_bar = err_bar;
+    v.err_h = err_h;
+    v.pasteboard = pasteboard;
+    v.area = area;
+    v.outer = outer;
+    v.comp_rect = comp_rect;
+    v.zoom = zoom;
+    v.ppp = ppp;
+    v.cw = cw;
+    v.ch = ch;
+    v.map = map;
+    v.painter = painter;
+}
 
+fn phase_frame(app: &mut EffectcraftApp, v: &mut Vw<'_>) {
+    let cid = v.cid;
+    let comp_rect = v.comp_rect;
+    let zoom = v.zoom;
+    let ppp = v.ppp;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let comp = v.comp;
     // Frame.
     let scale = app.viewer_scale(zoom, ppp);
     if !app.playback.playing {
         // Queue the frame on screen before any prefetch.
         app.request_frame_urgent(cid, comp.frame_rate.frame_at(app.session.time()), scale);
     }
-    crate::tick_playback(app, &ctx, scale);
+    crate::note_viewer_scale(app, scale);
     let time = app.session.time();
     let frame = comp.frame_rate.frame_at(time);
     let key = app.frame_key(cid, frame, scale);
@@ -868,6 +354,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let stale = app.viewer_shown.as_ref().is_none_or(|(_, s)| *s != k);
         // A CPU frame goes up again when the magnification calls for another factor.
         let minify = minify_factor(app.session.prefs.viewer_zoom_smooth(), scale, (zoom * ppp) as f64);
+        // (Half-float frames have no such texture: the display pass makes mips.)
         let refit = !app.viewer_on_gpu() && app.viewer_tex.as_ref().is_some_and(|(_, _, m)| *m != minify);
         if stale || refit {
             show_frame(app, &ctx, k, img, minify);
@@ -882,11 +369,21 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         let bg = comp.background;
         painter.rect_filled(comp_rect, 0.0, Color32::from_rgb((bg[0] * 255.0) as u8, (bg[1] * 255.0) as u8, (bg[2] * 255.0) as u8));
     }
-    let snap_project = app.session.project.clone();
-    let snap_expr = app.session.expr.clone();
-    let ectx = EvalCtx { project: &snap_project, comp_id: cid, comp: &comp, time, expr: snap_expr.as_deref(), footage: None };
+    v.time = time;
+}
+
+fn phase_guides(app: &mut EffectcraftApp, ectx: &EvalCtx, v: &mut Vw<'_>) {
+    let cid = v.cid;
+    let area = v.area;
+    let comp_rect = v.comp_rect;
+    let zoom = v.zoom;
+    let map = v.map;
+    let ctx = v.ctx.clone();
+    let comp_name = v.comp_name.clone();
+    let painter = v.painter.clone();
+    let comp = v.comp;
     // The frame (or snapshot) through Show Channel and exposure; ROI frames cover the region.
-    vt::draw_frame(app, &ctx, &painter, comp_rect, cid, &ectx);
+    vt::draw_frame(app, &ctx, &painter, comp_rect, cid, ectx);
     if app.ui.viewer.extended.is_some() {
         // The comp frame outlined over the extended render.
         painter.rect_stroke(comp_rect, 0.0, Stroke::new(1.0, Color32::from_gray(150)), StrokeKind::Outside);
@@ -972,17 +469,30 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         app.auto.add("viewer.regionOfInterest", r, "Region of interest");
     }
+    v.overlays = overlays;
+}
+
+fn phase_layers(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, v: &mut Vw<'_>) {
+    let t = v.t;
+    let zoom = v.zoom;
+    let cw = v.cw;
+    let ch = v.ch;
+    let map = v.map;
+    let time = v.time;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let mut handle_hits = std::mem::take(&mut v.handle_hits);
+    let mut axis_hits = std::mem::take(&mut v.axis_hits);
+    let mut vertex_hits = std::mem::take(&mut v.vertex_hits);
+    let mut vertex_marks = std::mem::take(&mut v.vertex_marks);
+    let mut key_hits = std::mem::take(&mut v.key_hits);
+    let mut motion_frames = std::mem::take(&mut v.motion_frames);
+    let mut paths = std::mem::take(&mut v.paths);
+    let comp = v.comp;
     // Overlays + interaction.
     let selected = app.session.state.selected_layers.clone();
     // Bounding-box handles: (layer, handle, screen point, its resize cursor).
-    let mut handle_hits: Vec<(LayerId, usize, Pos2, egui::CursorIcon)> = Vec::new();
     // 3D gizmo arrows: (layer, grabbable screen segment, position change per comp px in x and y).
-    let mut axis_hits: Vec<(LayerId, [Pos2; 2], [f64; 3], [f64; 3])> = Vec::new();
-    let mut vertex_hits: Vec<VertexHit> = Vec::new();
-    let mut vertex_marks: Vec<ov::VertexMark> = Vec::new();
-    let mut key_hits: Vec<ov::KeyHit> = Vec::new();
-    let mut motion_frames: Vec<ov::PathFrame> = Vec::new();
-    let mut paths: Vec<ov::PathInfo> = Vec::new();
     let sel_vertices = app.session.state.selected_vertices.clone();
     // Pen path in progress ends when the tool changes or its mask is gone; Esc / Enter also end
     // free transform.
@@ -1005,23 +515,26 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         for l in comp.layers.iter().filter(|l| {
             matches!(l.source, LayerSource::Null) && !selected.contains(&l.id) && l.is_active_at(time) && l.switches.video && (!any_solo || l.switches.solo)
         }) {
-            let outline = layer_outline(&ectx, l);
+            let outline = layer_outline(ectx, l);
             if outline.len() > 2 {
                 let col = if label_handles { t.label(l.label) } else { t.accent };
                 painter.add(egui::Shape::closed_line(outline.into_iter().map(|p| map.to_screen(p)).collect(), Stroke::new(1.0, col)));
             }
         }
-        // A layer whose Video switch is off has no box, handles or paths in the viewer (a hidden
-        // null disappears from the comp, as in After Effects), even while it is selected.
-        for l in comp.layers.iter().filter(|l| selected.contains(&l.id) && l.is_active_at(time) && l.switches.video) {
+        // The eye hides a layer's pixels, not its controls: a selected AV layer keeps its box,
+        // handles, anchor, motion path and mask/shape paths so it stays editable over the visible
+        // artwork (#1769). Nulls, cameras and lights have no pixels and disappear from the viewer
+        // when hidden (#1332/#1642). Picking still uses `selectable_layers`, so a hidden layer is
+        // selected from the Timeline; its controls are interactive once selected.
+        for l in comp.layers.iter().filter(|l| selected.contains(&l.id) && l.is_active_at(time) && (l.switches.video || l.source.is_av())) {
             let col = if label_handles { t.label(l.label) } else { t.accent };
             // Motion path of animated position (keyframes and spatial tangents are draggable).
-            ov::motion_path(app, &painter, &map, &ectx, l, col, &mut key_hits, &mut motion_frames);
+            ov::motion_path(app, &painter, &map, ectx, l, col, &mut key_hits, &mut motion_frames);
             // Masks and shape paths.
             if app.ui.viewer.show_masks {
                 let pen = ui.data(|d| d.get_temp::<(LayerId, u64)>(pen_id()));
                 let hover = ui.input(|i| i.pointer.hover_pos());
-                ov::draw_paths(app, &painter, &map, &ectx, l, col, &sel_vertices, pen, hover, &mut vertex_hits, &mut vertex_marks, &mut paths);
+                ov::draw_paths(app, &painter, &map, ectx, l, col, &sel_vertices, pen, hover, &mut vertex_hits, &mut vertex_marks, &mut paths);
             }
             // Settings ▸ Previews ▸ Show Internal Wireframes: outlines of the layers inside a
             // selected collapsed precomp.
@@ -1030,7 +543,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 && let effectcraft_engine::project::LayerSource::Comp { item } = &l.source
                 && let Some(nc) = app.session.project.comp(*item)
             {
-                let (outer, _) = l2c(&ectx, l);
+                let (outer, _) = l2c(ectx, l);
                 let nctx = EvalCtx::new(&app.session.project, *item, nc, ectx.nested_time(l));
                 for nl in nc.layers.iter().filter(|nl| nl.is_active_at(nctx.time) && !nl.is_3d()) {
                     if let Some((_, q, _)) = layer_quad(&nctx, nl) {
@@ -1053,9 +566,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             if editing_path {
                 continue;
             }
-            let Some((m, q, _)) = layer_quad(&ectx, l) else {
+            let Some((m, q, _)) = layer_quad(ectx, l) else {
                 // A 3D layer reaching past the camera: the part of its box in front of it.
-                let outline = layer_outline(&ectx, l);
+                let outline = layer_outline(ectx, l);
                 if outline.len() > 2 {
                     painter.add(egui::Shape::closed_line(outline.iter().map(|p| map.to_screen(*p)).collect(), Stroke::new(1.0, col)));
                     continue;
@@ -1090,10 +603,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 // 3D axis gizmo.
                 if l.is_3d() {
                     let w = ectx.world_matrix(l);
-                    let pc = cam_state(&ectx).projection(cw as f64, ch as f64) * w;
+                    let pc = cam_state(ectx).projection(cw as f64, ch as f64) * w;
                     let a3 = effectcraft_engine::geom::vec3(a[0], a[1], a[2]);
                     let len = 60.0 / zoom as f64;
-                    let pinv = parent_world_inverse(&ectx, l);
+                    let pinv = parent_world_inverse(ectx, l);
                     for (axis, col, name) in [
                         (effectcraft_engine::geom::vec3(len, 0.0, 0.0), Color32::from_rgb(0xe0, 0x50, 0x50), "x"),
                         (effectcraft_engine::geom::vec3(0.0, len, 0.0), Color32::from_rgb(0x60, 0xd0, 0x60), "y"),
@@ -1122,7 +635,31 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
+    v.handle_hits = handle_hits;
+    v.axis_hits = axis_hits;
+    v.vertex_hits = vertex_hits;
+    v.vertex_marks = vertex_marks;
+    v.key_hits = key_hits;
+    v.motion_frames = motion_frames;
+    v.paths = paths;
+    v.selected = selected;
+    v.sel_vertices = sel_vertices;
+}
 
+fn phase_scene(app: &mut EffectcraftApp, ectx: &EvalCtx, v: &mut Vw<'_>) {
+    let t = v.t;
+    let cid = v.cid;
+    let area = v.area;
+    let comp_rect = v.comp_rect;
+    let cw = v.cw;
+    let ch = v.ch;
+    let map = v.map;
+    let time = v.time;
+    let painter = v.painter.clone();
+    let selected = v.selected.clone();
+    let vertex_marks = std::mem::take(&mut v.vertex_marks);
+    let mut track_hits = std::mem::take(&mut v.track_hits);
+    let comp = v.comp;
     // Path points last, over the boxes' handles (#1042).
     ov::draw_vertex_marks(&painter, &vertex_marks, app.session.prefs.general.path_point_size as f32 + 1.0);
 
@@ -1131,7 +668,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     let has_3d = comp.layers.iter().any(|l| l.is_3d() && l.is_active_at(time));
     if has_3d && app.session.prefs.three_d.extended_viewer {
         for l in comp.layers.iter().filter(|l| l.is_3d() && l.is_active_at(time) && l.has_video()) {
-            let q = layer_outline(&ectx, l);
+            let q = layer_outline(ectx, l);
             if q.len() > 2 {
                 let sq: Vec<Pos2> = q.iter().map(|p| map.to_screen(*p)).collect();
                 let outside = sq.iter().any(|p| !comp_rect.contains(*p));
@@ -1142,7 +679,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
     }
     if has_3d && app.session.prefs.three_d.show_reference_axes {
-        let pc = cam_state(&ectx).projection(cw as f64, ch as f64);
+        let pc = cam_state(ectx).projection(cw as f64, ch as f64);
         let o3 = effectcraft_engine::geom::vec3(cw as f64 / 2.0, ch as f64 / 2.0, 0.0);
         let o = pc.apply(o3);
         let corner = pos2(area.min.x + 34.0, area.max.y - 34.0);
@@ -1161,7 +698,6 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     }
 
     // Track points of the current track (Tracker panel) on its layer, while that layer is selected.
-    let mut track_hits = vec![];
     let track_cur = super::tracker::viewer_track(app);
     if app.layer_controls_visible()
         && let Some((tl, tu)) = track_cur
@@ -1169,7 +705,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         && let Some(layer) = comp.layer(tl)
         && layer.is_active_at(time)
     {
-        let (m, _) = l2c(&ectx, layer);
+        let (m, _) = l2c(ectx, layer);
         track_hits = super::tracker::draw_overlay(app, &painter, &map, &m, layer, tu, time);
     }
 
@@ -1181,7 +717,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         && let Some(layer) = comp.layer(wl)
         && layer.is_active_at(time)
     {
-        let (m, _) = l2c(&ectx, layer);
+        let (m, _) = l2c(ectx, layer);
         let (w, h) = effectcraft_engine::render::source_size(&app.session.project, layer);
         let c = m.apply(effectcraft_engine::geom::vec2(w as f64 / 2.0, h as f64 / 2.0));
         let at = map.to_screen([c.x, c.y]);
@@ -1193,17 +729,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         app.auto.add("viewer.warpBanner", r, &text);
     }
 
-    // Footage that can't be decoded (no decoder for its codec / profile): say why on the layer
-    // instead of leaving a black picture.
-    let mut notices = 0;
-    for layer in comp.layers.iter().filter(|l| l.is_active_at(time) && l.switches.video) {
-        let effectcraft_engine::project::LayerSource::Footage { item } = &layer.source else { continue };
-        let Some(effectcraft_engine::project::ItemKind::Footage(f)) = app.session.project.item(*item).map(|i| &i.kind) else { continue };
-        let Some(why) = app.session.footage.problem(f) else { continue };
-        if notices >= 3 {
-            break;
-        }
-        let (m, _) = l2c(&ectx, layer);
+    // Footage (or the proxy in use for footage or a precomp) that can't be decoded (no decoder
+    // for its codec / profile): say why on the layer instead of leaving a black picture.
+    for (notices, (layer, why)) in footage_problems(app, ectx, comp, time).into_iter().enumerate() {
+        let (m, _) = l2c(ectx, layer);
         let (w, h) = effectcraft_engine::render::source_size(&app.session.project, layer);
         let c = m.apply(effectcraft_engine::geom::vec2(w as f64 / 2.0, h as f64 / 2.0));
         let at = map.to_screen([c.x, c.y]);
@@ -1214,29 +743,58 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         painter.rect_stroke(r, 3.0, Stroke::new(1.0, t.warning), StrokeKind::Inside);
         painter.galley(pos2(r.min.x + 12.0, r.center().y - galley.size().y / 2.0), galley, Color32::WHITE);
         app.auto.add(&format!("viewer.footageProblem.{}", layer.id.0), r, &text);
-        notices += 1;
     }
+    v.vertex_marks = vertex_marks;
+    v.track_hits = track_hits;
+    v.track_cur = track_cur;
+    v.has_3d = has_3d;
+}
 
+/// Up to three layers active at `time` whose footage, or the proxy in use for footage or a
+/// precomp, can't be decoded, each with the reason.
+fn footage_problems<'c>(app: &EffectcraftApp, ectx: &EvalCtx, comp: &'c Comp, time: Tick) -> Vec<(&'c Layer, String)> {
+    comp.layers
+        .iter()
+        .filter(|l| l.is_active_at(time) && l.switches.video)
+        .filter_map(|layer| {
+            let (LayerSource::Footage { item } | LayerSource::Comp { item }) = &layer.source else { return None };
+            Some((layer, ectx.project.item(*item).and_then(|i| app.session.footage.item_problem(i))?))
+        })
+        .take(3)
+        .collect()
+}
+
+fn phase_rigs(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, v: &mut Vw<'_>) {
+    let t = v.t;
+    let cid = v.cid;
+    let area = v.area;
+    let map = v.map;
+    let time = v.time;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let selected = v.selected.clone();
+    let paths = std::mem::take(&mut v.paths);
+    let mut pin_hits = std::mem::take(&mut v.pin_hits);
+    let mut puppet_layers = std::mem::take(&mut v.puppet_layers);
+    let comp = v.comp;
     // Free transform box of a path (double-click a path with the Selection tool).
     let ft = ov::draw_free_transform(app, &ctx, &painter, &map, &paths);
 
     // Cameras and lights (wireframes) and the 3D view name.
     if comp.has_3d() {
         let through_active = VIEW_CAM.with(|c| c.get()).is_none();
-        draw_rigs(app, &painter, &map, &ectx, &selected, cam_state(&ectx), through_active, None);
+        draw_rigs(app, &painter, &map, ectx, &selected, cam_state(ectx), through_active, None);
         let view = app.session.state.views3d.get(&cid).map(|v| v.current).unwrap_or_default();
         let label = match (view, comp.active_camera(time)) {
-            (View3D::ActiveCamera, Some(c)) => format!("Active Camera ({})", c.name),
-            (v, _) => v.label().to_string(),
+            (View3D::ActiveCamera, Some(c)) => crate::i18n::tr_args("Active Camera ({})", &[&c.name]),
+            (v, _) => view3d_label(v).to_string(),
         };
         painter.text(area.left_top() + vec2(12.0, 10.0), Align2::LEFT_TOP, label, Tokens::ui(12.0), t.text_dim);
     }
 
     // Puppet pins and meshes of the selected layers (Puppet tools).
-    let mut pin_hits: Vec<super::puppet_tool::PinHit> = vec![];
     // The selected layers with a Puppet effect, top of the stack first (the layers the Puppet
     // tools work on).
-    let mut puppet_layers: Vec<(&Layer, super::puppet_tool::Overlay)> = vec![];
     if app.ui.tool.puppet_kind().is_some() {
         let sel_props: Vec<u64> = app.session.state.selected_props.iter().map(|(_, u)| *u).collect();
         for lid in &selected {
@@ -1244,7 +802,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 && let Some(ov) = super::puppet_tool::overlay(app, &ctx, cid, l, time)
             {
                 let hover = ui.input(|i| i.pointer.hover_pos());
-                pin_hits.extend(super::puppet_tool::draw(&painter, &map, &ectx, l, &ov, app.session.state.puppet.show_mesh, &sel_props, hover));
+                pin_hits.extend(super::puppet_tool::draw(&painter, &map, ectx, l, &ov, app.session.state.puppet.show_mesh, &sel_props, hover));
                 puppet_layers.push((l, ov));
             }
         }
@@ -1258,40 +816,46 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
-    // The layer a Puppet tool press works on: while selected layers are rigged, only those
-    // ([`super::puppet_tool::target`]); otherwise the layer under the pointer, selected.
-    let puppet_layer = |app: &mut EffectcraftApp, cpt: [f64; 2]| -> Option<LayerId> {
-        if puppet_layers.is_empty() {
-            return pick(app, &ectx, cpt, false);
-        }
-        super::puppet_tool::target(&ectx, &puppet_layers, cpt, |l| layers_at(&ectx, cpt).any(|h| h.id == l.id))
-    };
+    v.paths = paths;
+    v.pin_hits = pin_hits;
+    v.puppet_layers = puppet_layers;
+    v.ft = ft;
+}
 
+fn phase_menu(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, v: &mut Vw<'_>) -> egui::Response {
+    let cid = v.cid;
+    let area = v.area;
+    let map = v.map;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let comp = v.comp;
     // Project items, files and effects dropped on the viewer.
-    super::viewer_drop::show(app, ui, &painter, &map, &ectx);
+    super::viewer_drop::show(app, ui, &painter, &map, ectx);
 
     // Interaction.
-    let resp = ui.interact(area, egui::Id::new("viewer-interact"), Sense::click_and_drag());
-    let menu_hits_id = egui::Id::new(("viewer-menu-hits", cid.0));
-    if resp.secondary_clicked()
-        && let Some(pos) = resp.interact_pointer_pos()
-    {
+    let resp = ui.interact(area, egui::Id::unique("viewer-interact"), Sense::click_and_drag());
+    let menu_hits_id = egui::Id::unique(("viewer-menu-hits", cid.0));
+    // A right-click an overlay took (the Cryptomatte eyedropper's) opens the menu too.
+    let forwarded = ui.data_mut(|d| d.remove_temp::<egui::Pos2>(egui::Id::unique(FORWARDED_SECONDARY)));
+    if let Some(pos) = resp.interact_pointer_pos().filter(|_| resp.secondary_clicked()).or(forwarded) {
         // Picking an already selected layer preserves the group; an unselected hit
         // becomes the target, using the same visible/unlocked hit test as left-click.
-        pick(app, &ectx, map.to_comp(pos), false);
+        pick(app, ectx, map.to_comp(pos), false);
         let point = map.to_comp(pos);
-        let hits: Vec<(u64, String)> = layers_at(&ectx, point).map(|l| (l.id.0, l.name.clone())).collect();
+        let hits: Vec<(u64, String)> = layers_at(ectx, point).map(|l| (l.id.0, l.name.clone())).collect();
         ui.data_mut(|d| d.insert_temp(menu_hits_id, hits));
     }
     let context_layers: Vec<u64> =
         app.session.state.selected_layers.iter().filter(|id| comp.layer(**id).is_some_and(|l| !l.switches.locked)).map(|id| id.0).collect();
     let mut context_actions = Vec::new();
     let copy_frame = crate::i18n::label(app, "comp.copyFrame", "Copy Frame to Clipboard");
-    crate::widgets::context_menu(&resp, |ui| {
+    let menu = egui::Popup::context_menu(&resp).style(crate::widgets::menu_style);
+    let open = forwarded.map(|_| egui::containers::SetOpenCommand::Bool(true));
+    if open.is_some() { menu.open_memory(open) } else { menu }.show(|ui| {
         let hits = ui.data(|d| d.get_temp::<Vec<(u64, String)>>(menu_hits_id)).unwrap_or_default();
         if !hits.is_empty() {
             ui.menu_button(crate::i18n::tr("Select"), |ui| {
-                crate::widgets::menu_scroll(ui, |ui| {
+                crate::widgets::menu_scroll(ui, false, |ui| {
                     for (id, name) in &hits {
                         if ui.button(name).clicked() {
                             context_actions.push(("layer.select".to_owned(), serde_json::json!({"layers":[id]})));
@@ -1311,6 +875,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     let c = super::timeline::LayerMenuCaps::of(&app.session.project, layer);
                     caps.vector |= c.vector;
                     caps.text |= c.text;
+                    caps.source |= c.source;
                     caps
                 },
             );
@@ -1334,12 +899,50 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             app.ui.status = e;
         }
     }
+    resp
+}
+
+/// Frames to step when wheel scrubbing is on, or `None` when this gesture should zoom or pan.
+/// A scrub notch's smoothed tail stays a scrub after the wheel event itself is gone, so that
+/// tail does not zoom or pan (#1218).
+fn wheel_scrub_frames(ctx: &egui::Context, pref: bool, scroll: &super::ViewerScroll) -> Option<i64> {
+    let tail_id = egui::Id::unique("viewer-wheel-scrub-tail");
+    let was_tail: bool = ctx.data(|d| d.get_temp(tail_id)).unwrap_or(false);
+    let moving = scroll.pan != egui::Vec2::ZERO || (scroll.zoom - 1.0).abs() > 3e-4;
+    let scrub = pref && !scroll.trackpad && !scroll.wheel_modified && (scroll.wheel_lines.abs() >= 0.01 || (was_tail && moving));
+    ctx.data_mut(|d| {
+        if scrub {
+            d.insert_temp(tail_id, true);
+        } else {
+            d.remove::<bool>(tail_id);
+        }
+    });
+    scrub.then_some((scroll.wheel_lines.round() as i64).clamp(-30, 30))
+}
+
+fn phase_hover(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let area = v.area;
+    let zoom = v.zoom;
+    let cw = v.cw;
+    let ch = v.ch;
+    let map = v.map;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let handle_hits = std::mem::take(&mut v.handle_hits);
+    let axis_hits = std::mem::take(&mut v.axis_hits);
+    let vertex_hits = std::mem::take(&mut v.vertex_hits);
+    let key_hits = std::mem::take(&mut v.key_hits);
+    let motion_frames = std::mem::take(&mut v.motion_frames);
+    let paths = std::mem::take(&mut v.paths);
+    let track_hits = std::mem::take(&mut v.track_hits);
+    let pin_hits = std::mem::take(&mut v.pin_hits);
+    let comp = v.comp;
     // Path vertices and tangent handles take the press before the bounding-box handles (#1042).
     let vertex_at = |pos: Pos2, tangents: bool| -> Option<VertexHit> {
         let reach = vertex_grab_radius(pos, handle_hits.iter().map(|(_, _, h, _)| *h));
         vertex_hits.iter().rev().filter(|h| h.tangent.is_some() == tangents).find(|h| h.pos.distance(pos) < reach).copied()
     };
-    let gid = egui::Id::new("viewer-gesture");
+    let gid = egui::Id::unique("viewer-gesture");
     // An overlay on top of the viewer (e.g. the camera tracker points) takes the hover, but the pointer is still over the viewer: keep wheel zoom working.
     let hover_pos = resp.hover_pos().or_else(|| if resp.contains_pointer() { ui.input(|i| i.pointer.hover_pos()) } else { None });
     if let Some(hp) = hover_pos {
@@ -1367,8 +970,8 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             Tool::ObjectMatte => {
                 // The tool draws its own crosshair (and the layer it would matte) while no box
                 // is being dragged.
-                if ui.data(|d| d.get_temp::<Gesture>(egui::Id::new("viewer-gesture"))).is_none() {
-                    super::object_matte_tool::hover(app, &painter, &map, &ectx, hp);
+                if ui.data(|d| d.get_temp::<Gesture>(egui::Id::unique("viewer-gesture"))).is_none() {
+                    super::object_matte_tool::hover(app, &painter, &map, ectx, hp);
                 }
                 egui::CursorIcon::None
             }
@@ -1382,7 +985,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             _ => {
                 if super::tracker::hit_at(&track_hits, hp).is_some() || key_hits.iter().any(|h| h.pos.distance(hp) < 6.0) {
                     egui::CursorIcon::Move
-                } else if let Some((_, vertical)) = vt::guide_at(app, &comp, &map, hp) {
+                } else if let Some((_, vertical)) = vt::guide_at(app, comp, &map, hp) {
                     if vertical { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::ResizeVertical }
                 } else if vertex_at(hp, true).or_else(|| vertex_at(hp, false)).is_some() {
                     // A path point under a box handle is grabbed first: no resize cursor.
@@ -1397,11 +1000,23 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         };
         ctx.set_cursor_icon(cursor);
-        // Scroll wheel zooms around the pointer.
-        let scroll = ui.input(|i| i.smooth_scroll_delta.y + i.zoom_delta().ln() * 300.0);
-        if scroll.abs() > 0.1 && area.contains(hp) {
-            let k = (scroll / 300.0).exp();
-            let nz = (zoom * k).clamp(0.01, 32.0);
+        // The mouse wheel and a trackpad pinch zoom around the pointer; a two-finger trackpad
+        // scroll pans. With general.viewerWheelScrubbing, an unmodified wheel steps frames
+        // instead, including the smoothed tail of that notch so it does not zoom or pan (#1218).
+        let scroll = super::viewer_scroll(&ctx);
+        let scrub = wheel_scrub_frames(&ctx, app.session.prefs.general.viewer_wheel_scrubbing, &scroll);
+        if let Some(frames) = scrub {
+            if frames != 0 && area.contains(hp) {
+                if app.playback.playing {
+                    let _ = crate::menus::invoke(app, &ctx, "playback.stop", json!({}));
+                }
+                let _ = app.session.execute("time.step", json!({"frames": frames}));
+            }
+        } else if scroll.pan != egui::Vec2::ZERO && area.contains(hp) {
+            app.ui.viewer.pan = [app.ui.viewer.pan[0] + scroll.pan.x, app.ui.viewer.pan[1] + scroll.pan.y];
+        }
+        if scrub.is_none() && (scroll.zoom - 1.0).abs() > 3e-4 && area.contains(hp) {
+            let nz = (zoom * scroll.zoom).clamp(0.01, 32.0);
             let before = map.to_comp(hp);
             let new_origin = hp - vec2(before[0] as f32 * nz, before[1] as f32 * nz);
             let new_center = new_origin + vec2(cw * nz / 2.0, ch * nz / 2.0);
@@ -1412,6 +1027,24 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     } else {
         app.pointer_comp = None;
     }
+    v.handle_hits = handle_hits;
+    v.axis_hits = axis_hits;
+    v.vertex_hits = vertex_hits;
+    v.key_hits = key_hits;
+    v.motion_frames = motion_frames;
+    v.paths = paths;
+    v.track_hits = track_hits;
+    v.pin_hits = pin_hits;
+    v.gid = gid;
+}
+
+fn phase_press(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let map = v.map;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let key_hits = std::mem::take(&mut v.key_hits);
+    let motion_frames = std::mem::take(&mut v.motion_frames);
+    let paths = std::mem::take(&mut v.paths);
     app.ui.viewer.interacting = resp.dragged();
     let mods = ui.input(|i| i.modifiers);
     let space_pan = super::space_hand(&ctx);
@@ -1423,24 +1056,121 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         && ui.input(|i| i.pointer.primary_pressed())
         && let Some(pos) = ui.input(|i| i.pointer.press_origin())
     {
-        pen_press(app, ui, &ectx, &map, &paths, ov::motion_frame_at(&motion_frames, &key_hits, pos), pos, mods);
+        pen_press(app, ui, ectx, &map, &paths, ov::motion_frame_at(&motion_frames, &key_hits, pos), pos, mods);
     }
     // A pen click (press + release without a drag) ends its tangent gesture on release.
     if ui.input(|i| i.pointer.primary_released())
-        && matches!(ui.data(|d| d.get_temp::<Gesture>(egui::Id::new("viewer-gesture"))), Some(Gesture::Pen { .. }))
+        && matches!(ui.data(|d| d.get_temp::<Gesture>(egui::Id::unique("viewer-gesture"))), Some(Gesture::Pen { .. }))
         && !resp.drag_stopped()
     {
-        ui.data_mut(|d| d.remove::<Gesture>(egui::Id::new("viewer-gesture")));
+        ui.data_mut(|d| d.remove::<Gesture>(egui::Id::unique("viewer-gesture")));
     }
     // On-canvas text editing (Type tool, double-click a text layer) owns its clicks and drags.
-    let text_owns = super::viewer_text::hook(app, ui, &painter, &map, &ectx, &resp, space_pan);
+    let text_owns = super::viewer_text::hook(app, ui, &painter, &map, ectx, resp, space_pan);
+    v.key_hits = key_hits;
+    v.motion_frames = motion_frames;
+    v.paths = paths;
+    v.mods = mods;
+    v.space_pan = space_pan;
+    v.text_owns = text_owns;
+}
+
+/// A middle-drag pans with any tool and doesn't enter the gesture phases, so nothing else can
+/// happen under it (#2854). A left-button gesture already running keeps going until it ends.
+fn middle_pan(app: &mut EffectcraftApp, ui: &egui::Ui, resp: &egui::Response, v: &Vw<'_>) -> bool {
+    let (middle, primary) = ui.input(|i| (i.pointer.middle_down(), i.pointer.primary_down() || i.pointer.primary_released()));
+    if !middle || !resp.is_pointer_button_down_on() || (primary && ui.data(|d| d.get_temp::<Gesture>(v.gid)).is_some()) {
+        return false;
+    }
+    // No left button: a stored gesture is one whose release the viewer missed.
+    ui.data_mut(|d| d.remove::<Gesture>(v.gid));
+    // Movement from before the press (in its frame) is not part of the drag.
+    let d = ui.input(|i| if i.pointer.button_pressed(egui::PointerButton::Middle) { egui::Vec2::ZERO } else { i.pointer.delta() });
+    if d != egui::Vec2::ZERO && d.x.is_finite() && d.y.is_finite() {
+        app.ui.viewer.pan = [app.ui.viewer.pan[0] + d.x, app.ui.viewer.pan[1] + d.y];
+    }
+    v.ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
+    true
+}
+
+/// One layer of a Move: its id, start Position and the Position's per-comp-axis weights.
+type MoveLayer = (LayerId, [f64; 3], [f64; 3], [f64; 3]);
+
+/// The merge key of the drag in progress: every step it writes folds into one undo step.
+fn drag_merge_key(ui: &egui::Ui) -> String {
+    format!("viewer-drag-{}", ui.data(|d| d.get_temp::<u64>(egui::Id::unique("viewer-drag-n")).unwrap_or(0)))
+}
+
+/// Duplicate the layers of an Alt-drag (`edit.duplicate`, selecting the copies) and return the move
+/// entries re-pointed at the copies. If the duplicate fails the originals are dragged as they were.
+fn alt_duplicate(app: &mut EffectcraftApp, ui: &egui::Ui, layers: Vec<MoveLayer>) -> Vec<MoveLayer> {
+    let ids: Vec<u64> = layers.iter().map(|l| l.0.0).collect();
+    // A key left over from the previous drag would fold this copy into that drag's undo step.
+    app.session.history.merge_key = None;
+    let made = app.session.execute("edit.duplicate", json!({"layers": ids, "merge": drag_merge_key(ui)}));
+    let Ok(copies) = made.map(|v| serde_json::from_value::<Vec<u64>>(v).unwrap_or_default()) else { return layers };
+    layers.into_iter().zip(copies).map(|((_, p0, ax, ay), copy)| (LayerId(copy), p0, ax, ay)).collect()
+}
+
+/// For each layer of a Move, whether one of its ancestors is in the Move as well: it follows that
+/// parent, so its own Position must not get the drag too. The copies `alt_duplicate` makes keep
+/// this order and are parented to each other the same way.
+fn led_by_a_moved_ancestor(comp: &Comp, layers: &[MoveLayer]) -> Vec<bool> {
+    let moved: std::collections::HashSet<LayerId> = layers.iter().map(|l| l.0).collect();
+    let led = |id: LayerId| {
+        let mut up = comp.layer(id).and_then(|l| l.parent);
+        // (bounded: a parent cycle in a broken file must not hang the viewer)
+        for _ in 0..comp.layers.len() {
+            let Some(p) = up else { return false };
+            if moved.contains(&p) {
+                return true;
+            }
+            up = comp.layer(p).and_then(|l| l.parent);
+        }
+        false
+    };
+    layers.iter().map(|l| led(l.0)).collect()
+}
+
+fn phase_dragstart(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let comp_rect = v.comp_rect;
+    let zoom = v.zoom;
+    let map = v.map;
+    let time = v.time;
+    let mods = v.mods;
+    let space_pan = v.space_pan;
+    let text_owns = v.text_owns;
+    let gid = v.gid;
+    let track_cur = v.track_cur;
+    let ft = std::mem::take(&mut v.ft);
+    let handle_hits = std::mem::take(&mut v.handle_hits);
+    let axis_hits = std::mem::take(&mut v.axis_hits);
+    let vertex_hits = std::mem::take(&mut v.vertex_hits);
+    let key_hits = std::mem::take(&mut v.key_hits);
+    let paths = std::mem::take(&mut v.paths);
+    let track_hits = std::mem::take(&mut v.track_hits);
+    let pin_hits = std::mem::take(&mut v.pin_hits);
+    let puppet_layers = std::mem::take(&mut v.puppet_layers);
+    let comp = v.comp;
+    let vertex_at = |pos: Pos2, tangents: bool| -> Option<VertexHit> {
+        let reach = vertex_grab_radius(pos, handle_hits.iter().map(|(_, _, h, _)| *h));
+        vertex_hits.iter().rev().filter(|h| h.tangent.is_some() == tangents).find(|h| h.pos.distance(pos) < reach).copied()
+    };
+    let puppet_layer = |app: &mut EffectcraftApp, cpt: [f64; 2]| -> Option<LayerId> {
+        if puppet_layers.is_empty() {
+            return pick(app, ectx, cpt, false);
+        }
+        super::puppet_tool::target(ectx, &puppet_layers, cpt, |l| {
+            layers_at(ectx, cpt).any(|h| h.id == l.id) && super::puppet_tool::takes_pin(app, ectx, l, cpt)
+        })
+    };
     if resp.drag_started()
         && !text_owns
         && let Some(pos) = resp.interact_pointer_pos()
     {
         let cpt = map.to_comp(pos);
         let press = ui.input(|i| i.pointer.press_origin()).unwrap_or(pos);
-        let tool = if space_pan || resp.dragged_by(egui::PointerButton::Middle) { Tool::Hand } else { app.ui.tool };
+        let tool = if space_pan { Tool::Hand } else { app.ui.tool };
         let g = match tool {
             Tool::Hand => Some(Gesture::Pan { start_pan: app.ui.viewer.pan }),
             // Region of Interest armed: the drag draws it.
@@ -1453,8 +1183,8 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             Tool::Selection if key_hits.iter().any(|h| h.pos.distance(press) < 6.0) => {
                 ov::begin_key_drag(app, &key_hits, press, map.to_comp(press), mods.shift).map(Gesture::Overlay)
             }
-            Tool::Selection if vt::guide_at(app, &comp, &map, press).is_some() => {
-                vt::guide_at(app, &comp, &map, press).map(|(index, vertical)| Gesture::Overlay(ov::Drag::Guide { index, vertical }))
+            Tool::Selection if vt::guide_at(app, comp, &map, press).is_some() => {
+                vt::guide_at(app, comp, &map, press).map(|(index, vertical)| Gesture::Overlay(ov::Drag::Guide { index, vertical }))
             }
             // Alt-drag a vertex with the Selection tool (or drag one with Convert Vertex): pull
             // new tangents out of it.
@@ -1464,29 +1194,23 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     Gesture::Pen { layer: h.layer, mask: h.mask, index: h.index, vertex: h.vertex, inv, press }
                 })
             }
-            Tool::MaskFeather => ov::begin_feather(app, &ectx, &paths, &map, press).map(Gesture::Overlay),
-            Tool::Rotate => pick(app, &ectx, cpt, mods.shift).map(|l| {
-                let others = selected_others(app, &comp, l).into_iter().filter_map(|o| Some((o.id, ectx.f(o, o.transform()?, "rotation", 0.0)))).collect();
+            Tool::MaskFeather => ov::begin_feather(app, ectx, &paths, &map, press).map(Gesture::Overlay),
+            Tool::Rotate => pick(app, ectx, cpt, mods.shift).map(|l| {
                 let layer = comp.layer(l).cloned();
-                let center = layer
-                    .as_ref()
-                    .and_then(|l| l.transform().map(|tr| ectx.v3(l, tr, "position", [0.0; 3])))
-                    .map(|p| map.to_screen([p[0], p[1]]))
-                    .unwrap_or(pos);
+                let sign = layer.as_ref().map_or(1.0, |l| rotation_sign(ectx, l));
+                let others = selected_others(app, comp, l)
+                    .into_iter()
+                    .filter_map(|o| Some((o.id, ectx.f(o, o.transform()?, "rotation", 0.0), rotation_sign(ectx, o) * sign)))
+                    .collect();
+                let pivot = layer.as_ref().and_then(|l| anchor_in_comp(ectx, l)).unwrap_or(cpt);
                 let rot = layer.as_ref().and_then(|l| l.transform().map(|tr| ectx.f(l, tr, "rotation", 0.0))).unwrap_or(0.0);
-                Gesture::Rotate {
-                    layer: l,
-                    center,
-                    last_angle: ((pos.y - center.y) as f64).atan2((pos.x - center.x) as f64).to_degrees(),
-                    turned: 0.0,
-                    start_rot: rot,
-                    others,
-                }
+                let last_angle = (cpt[1] - pivot[1]).atan2(cpt[0] - pivot[0]).to_degrees();
+                Gesture::Rotate { layer: l, pivot, sign, last_angle, turned: 0.0, start_rot: rot, others }
             }),
-            Tool::PanBehind => pick(app, &ectx, cpt, false).and_then(|l| {
+            Tool::PanBehind => pick(app, ectx, cpt, false).and_then(|l| {
                 let layer = comp.layer(l)?;
                 let tr = layer.transform()?;
-                let (l2c, _) = l2c(&ectx, layer);
+                let (l2c, _) = l2c(ectx, layer);
                 let l2p = ectx.local_matrix(layer);
                 let l2p = Mat3([[l2p.0[0][0], l2p.0[0][1], 0.0], [l2p.0[1][0], l2p.0[1][1], 0.0], [0.0, 0.0, 1.0]]);
                 Some(Gesture::Anchor {
@@ -1497,7 +1221,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     start: map.to_comp(press),
                     inv: l2c.inverse().unwrap_or(Mat3::IDENTITY),
                     l2p,
-                    own: effectcraft_engine::viewer::layer_targets(&ectx, layer, false, app.session.state.snap_features),
+                    own: effectcraft_engine::viewer::layer_targets(ectx, layer, false, app.session.state.snap_features),
                     anchor_only: mods.alt,
                 })
             }),
@@ -1506,8 +1230,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             t if t.is_shape() => Some(Gesture::Create { tool: t, start: map.to_comp(press) }),
             Tool::ObjectMatte => Some(Gesture::ObjectMatteBox { start: press }),
             t if t.puppet_kind().is_some() && super::puppet_tool::hit(&pin_hits, press).is_none() => {
-                // Off the pins: Alt or a press outside the art drags a marquee that selects pins.
-                (mods.alt || puppet_layer(app, cpt).is_none()).then_some(Gesture::PinMarquee { start: press })
+                // Off the pins: Alt or a press outside the art drags a marquee that selects pins. Asked
+                // of where the button went down: the pointer may be over the art by the time this is a drag.
+                (mods.alt || puppet_layer(app, map.to_comp(press)).is_none()).then_some(Gesture::PinMarquee { start: press })
             }
             t if t.puppet_kind().is_some() => super::puppet_tool::hit(&pin_hits, press).and_then(|(h, part)| {
                 use super::puppet_tool::PinPart;
@@ -1523,7 +1248,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     PinPart::Center => {}
                 }
                 let l = comp.layer(h.layer)?;
-                let inv = fx2c(&ectx, l).inverse()?;
+                let inv = fx2c(ectx, l).inverse()?;
                 if mods.command {
                     let lp = inv.apply(gv2(cpt[0], cpt[1]));
                     let began = ui.input(|i| i.time);
@@ -1543,7 +1268,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 let hit = super::tracker::hit_at(&track_hits, press);
                 track_cur.zip(hit).and_then(|((tl, tu), hit)| {
                     let layer = comp.layer(tl)?;
-                    let (m, _) = l2c(&ectx, layer);
+                    let (m, _) = l2c(ectx, layer);
                     super::tracker::begin_drag(layer, tu, time, &m, hit, map.to_comp(press)).map(|drag| Gesture::Track { layer: tl, tracker: tu, drag })
                 })
             }
@@ -1578,16 +1303,21 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 // that axis only, without snapping.
                 if let Some((lid, _, ax, ay)) = axis_at(&axis_hits, press) {
                     let p0 = comp.layer(lid).and_then(|l| Some(ectx.v3(l, l.transform()?, "position", [0.0; 3])));
-                    p0.map(|p0| Gesture::Move { layers: vec![(lid, p0, ax, ay)], start: cpt, snap_src: None })
+                    p0.map(|p0| {
+                        // Alt duplicates the layer and moves the copy along the axis.
+                        let layers = vec![(lid, p0, ax, ay)];
+                        let layers = if mods.alt { alt_duplicate(app, ui, layers) } else { layers };
+                        Gesture::Move { layers, start: cpt, snap_src: None }
+                    })
                 } else if let Some((lid, hi, ..)) = handle_hits.iter().find(|(_, _, h, _)| h.distance(press) < HANDLE + 2.0).cloned() {
                     let layer = comp.layer(lid).cloned();
                     layer.and_then(|layer| {
                         let tr = layer.transform()?;
-                        let (l2c, _) = l2c(&ectx, &layer);
+                        let (l2c, _) = l2c(ectx, &layer);
                         let inv = l2c.inverse()?;
                         let a = ectx.v3(&layer, tr, "anchor", [0.0; 3]);
                         let lp = inv.apply(gv2(cpt[0], cpt[1]));
-                        let hp = handle_point(effectcraft_engine::render::content_bounds(&ectx, &layer)?, hi);
+                        let hp = handle_point(effectcraft_engine::render::content_bounds(ectx, &layer)?, hi);
                         Some(Gesture::Scale {
                             layer: lid,
                             start_scale: ectx.v3(&layer, tr, "scale", [100.0; 3]),
@@ -1597,14 +1327,14 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                             axes: handle_axes(hi),
                             l2c,
                             inv,
-                            others: selected_others(app, &comp, lid)
+                            others: selected_others(app, comp, lid)
                                 .into_iter()
                                 .filter_map(|o| Some((o.id, ectx.v3(o, o.transform()?, "scale", [100.0; 3]))))
                                 .collect(),
                         })
                     })
-                } else if let Some(l) = pick(app, &ectx, cpt, mods.shift) {
-                    let layers: Vec<(LayerId, [f64; 3], [f64; 3], [f64; 3])> = app
+                } else if let Some(l) = pick(app, ectx, cpt, mods.shift) {
+                    let layers: Vec<MoveLayer> = app
                         .session
                         .state
                         .selected_layers
@@ -1613,12 +1343,12 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                         .filter(|l| !l.switches.locked)
                         .filter_map(|l| {
                             let p0 = ectx.v3(l, l.transform()?, "position", [0.0; 3]);
-                            let (ax, ay) = drag_axes(&ectx, l);
+                            let (ax, ay) = drag_axes(ectx, l);
                             Some((l.id, p0, ax, ay))
                         })
                         .collect();
                     // Snap the grabbed layer's feature nearest the pointer (AE's snap handle).
-                    let snap_src = comp.layer(l).map(|layer| effectcraft_engine::viewer::layer_features(&ectx, layer)).and_then(|f| {
+                    let snap_src = comp.layer(l).map(|layer| effectcraft_engine::viewer::layer_features(ectx, layer)).and_then(|f| {
                         let c = map.to_comp(press);
                         f.into_iter().min_by(|a, b| {
                             let da = (a[0] - c[0]).powi(2) + (a[1] - c[1]).powi(2);
@@ -1626,6 +1356,13 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                             da.total_cmp(&db)
                         })
                     });
+                    // A layer whose parent (or grandparent…) is dragged too rides along with it:
+                    // moving it as well would add the drag twice. It is still duplicated.
+                    let led = led_by_a_moved_ancestor(comp, &layers);
+                    // Alt-drag duplicates the dragged layers and moves the copies; the copy and the
+                    // drag are one undo step.
+                    let layers = if mods.alt && !layers.is_empty() { alt_duplicate(app, ui, layers) } else { layers };
+                    let layers: Vec<MoveLayer> = layers.into_iter().zip(led).filter(|(_, led)| !led).map(|(l, _)| l).collect();
                     (!layers.is_empty()).then_some(Gesture::Move { layers, start: map.to_comp(press), snap_src })
                 } else {
                     // With path vertices on screen the marquee selects vertices (layers stay
@@ -1647,10 +1384,63 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             ui.data_mut(|d| d.insert_temp(gid, g));
         }
     }
+    v.ft = ft;
+    v.handle_hits = handle_hits;
+    v.axis_hits = axis_hits;
+    v.vertex_hits = vertex_hits;
+    v.key_hits = key_hits;
+    v.paths = paths;
+    v.track_hits = track_hits;
+    v.pin_hits = pin_hits;
+    v.puppet_layers = puppet_layers;
+}
+
+/// Auto-pan (#999): a mask vertex, tangent or Pen drag held at (or past) the edge of the view
+/// pans it, as in After Effects, so the point moves on past what was visible. Returns the map
+/// of the panned view.
+fn edge_pan(app: &mut EffectcraftApp, ctx: &egui::Context, g: &Gesture, map: ViewerMap, pos: Pos2) -> ViewerMap {
+    if !matches!(g, Gesture::Vertices { .. } | Gesture::Tangent { .. } | Gesture::Pen { .. }) {
+        return map;
+    }
+    let d = edge_pan_speed(map.area, pos) * ctx.input(|i| i.stable_dt).min(0.1);
+    if d == egui::Vec2::ZERO {
+        return map;
+    }
+    app.ui.viewer.pan = [app.ui.viewer.pan[0] + d.x, app.ui.viewer.pan[1] + d.y];
+    ctx.request_repaint();
+    ViewerMap { origin: map.origin + d, ..map }
+}
+
+/// How fast (points per second, per axis) the view pans under a drag at `pos`: within 24 points
+/// of an edge of `area`, or past it, toward that edge and faster the further out.
+fn edge_pan_speed(area: Rect, pos: Pos2) -> egui::Vec2 {
+    const ZONE: f32 = 24.0;
+    let axis = |p: f32, lo: f32, hi: f32| {
+        let depth = if p < lo + ZONE {
+            lo + ZONE - p
+        } else if p > hi - ZONE {
+            hi - ZONE - p
+        } else {
+            0.0
+        };
+        (depth / ZONE).clamp(-3.0, 3.0) * 400.0
+    };
+    vec2(axis(pos.x, area.min.x, area.max.x), axis(pos.y, area.min.y, area.max.y))
+}
+
+fn phase_drag(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let t = v.t;
+    let zoom = v.zoom;
+    let map = v.map;
+    let mods = v.mods;
+    let gid = v.gid;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
     let gesture: Option<Gesture> = ui.data(|d| d.get_temp(gid));
     if let (Some(g), Some(pos)) = (gesture.clone(), resp.interact_pointer_pos()) {
+        let map = edge_pan(app, &ctx, &g, map, pos);
         let cpt = map.to_comp(pos);
-        let merge = format!("viewer-drag-{}", ui.data(|d| d.get_temp::<u64>(egui::Id::new("viewer-drag-n")).unwrap_or(0)));
+        let merge = drag_merge_key(ui);
         match g {
             Gesture::Pan { start_pan } => {
                 // No total drag on the release frame: keep the pan reached so far (it used to
@@ -1663,7 +1453,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 let mut d = one_axis([cpt[0] - start[0], cpt[1] - start[1]], mods.shift);
                 if let Some(src) = snap_src {
                     let ids: Vec<LayerId> = layers.iter().map(|x| x.0).collect();
-                    let c = vt::snap(app, &ctx, &ectx, &map, &ids, &[[src[0] + d[0], src[1] + d[1]]], mods);
+                    let c = vt::snap(app, &ctx, ectx, &map, &ids, &[[src[0] + d[0], src[1] + d[1]]], mods);
                     d = [d[0] + c[0], d[1] + c[1]];
                     if vt::snapping_on(app, mods) {
                         vt::draw_handle(&painter, map.to_screen([src[0] + d[0], src[1] + d[1]]));
@@ -1680,24 +1470,24 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 let f = drag_ratio(start_local, [lp.x - anchor[0], lp.y - anchor[1]], axes, uniform);
                 // The handle snaps (to the comp's and other layers' edges, corners and centres),
                 // so a layer scales exactly to them, e.g. to the comp's size.
-                let f = snap_handle(f, handle, anchor, &l2c, axes, uniform, |p| vt::snap(app, &ctx, &ectx, &map, &[layer], &[p], mods));
+                let f = snap_handle(f, handle, anchor, &l2c, axes, uniform, |p| vt::snap(app, &ctx, ectx, &map, &[layer], &[p], mods));
                 for (lid, s0) in std::iter::once((layer, start_scale)).chain(others) {
                     let v = [s0[0] * f[0], s0[1] * f[1], s0[2]];
                     let _ = app.session.execute("prop.set", json!({"layer": lid.0, "path": "transform/scale", "value": v, "merge": merge}));
                 }
             }
-            Gesture::Rotate { layer, center, last_angle, turned, start_rot, others } => {
+            Gesture::Rotate { layer, pivot, sign, last_angle, turned, start_rot, others } => {
                 // Count the turn incrementally: the absolute angle wraps at ±180°, so writing it
                 // straight would jump a revolution back each time the pointer went round.
-                let ang = ((pos.y - center.y) as f64).atan2((pos.x - center.x) as f64).to_degrees();
-                let turned = turned + turn_delta(last_angle, ang);
-                ui.data_mut(|dd| dd.insert_temp(gid, Gesture::Rotate { layer, center, last_angle: ang, turned, start_rot, others: others.clone() }));
+                let ang = (cpt[1] - pivot[1]).atan2(cpt[0] - pivot[0]).to_degrees();
+                let turned = turned + sign * turn_delta(last_angle, ang);
+                ui.data_mut(|dd| dd.insert_temp(gid, Gesture::Rotate { layer, pivot, sign, last_angle: ang, turned, start_rot, others: others.clone() }));
                 // Shift snaps the accumulated value (so 405° snaps to 1x +45°, not to 45°).
                 let r = rotate_value(start_rot, turned, mods.shift);
                 let _ = app.session.execute("prop.set", json!({"layer": layer.0, "path": "transform/rotation", "value": r, "merge": merge}));
-                for (lid, r0) in others {
-                    let _ =
-                        app.session.execute("prop.set", json!({"layer": lid.0, "path": "transform/rotation", "value": r0 + (r - start_rot), "merge": merge}));
+                for (lid, r0, other) in others {
+                    let v = r0 + other * (r - start_rot);
+                    let _ = app.session.execute("prop.set", json!({"layer": lid.0, "path": "transform/rotation", "value": v, "merge": merge}));
                 }
             }
             Gesture::Anchor { layer, start_anchor, start_pos, start, inv, l2p, own, anchor_only } => {
@@ -1706,7 +1496,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 let d = one_axis([cpt[0] - start[0], cpt[1] - start[1]], mods.shift);
                 let anchor_c = inv.inverse().map(|m| m.apply(gv2(start_anchor[0], start_anchor[1]))).unwrap_or(gv2(start[0], start[1]));
                 let want = [anchor_c.x + d[0], anchor_c.y + d[1]];
-                let sc = vt::snap_with(app, &ctx, &ectx, &map, &[layer], &[want], mods, &own);
+                let sc = vt::snap_with(app, &ctx, ectx, &map, &vt::SnapQuery { exclude: &[layer], sources: &[want], mods, extra: &own });
                 let a = inv.apply(gv2(start[0], start[1]));
                 let b = inv.apply(gv2(start[0] + d[0] + sc[0], start[1] + d[1] + sc[1]));
                 let dl = gv2(b.x - a.x, b.y - a.y);
@@ -1739,9 +1529,10 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 }
             }
             Gesture::Vertices { start, src, applied, inv, layer } => {
-                // The grabbed vertex snaps (to other layers' vertices and features, guides, grid).
-                let want = [cpt[0] - start[0], cpt[1] - start[1]];
-                let c = vt::snap(app, &ctx, &ectx, &map, &[layer], &[[src[0] + want[0], src[1] + want[1]]], mods);
+                // The grabbed vertex snaps (to other layers' vertices and features, guides, grid);
+                // Shift keeps it to one axis, as a layer move does (#1964).
+                let want = one_axis([cpt[0] - start[0], cpt[1] - start[1]], mods.shift);
+                let c = vt::snap(app, &ctx, ectx, &map, &[layer], &[[src[0] + want[0], src[1] + want[1]]], mods);
                 let total = [want[0] + c[0], want[1] + c[1]];
                 let d = inv.apply_vec(gv2(total[0] - applied[0], total[1] - applied[1]));
                 if d.x != 0.0 || d.y != 0.0 {
@@ -1760,7 +1551,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     painter.rect_stroke(r, 0.0, Stroke::new(1.0, Color32::WHITE), StrokeKind::Middle);
                 }
                 d => {
-                    let mut snapper = |a: &EffectcraftApp, p: [f64; 2], l: LayerId| vt::snap(a, &ctx, &ectx, &map, &[l], &[p], mods);
+                    let mut snapper = |a: &EffectcraftApp, p: [f64; 2], l: LayerId| vt::snap(a, &ctx, ectx, &map, &[l], &[p], mods);
                     if let Some(nd) = ov::update(app, &d, cpt, pos, mods, &merge, zoom, &mut snapper) {
                         ui.data_mut(|dd| dd.insert_temp(gid, Gesture::Overlay(nd)));
                     }
@@ -1841,6 +1632,20 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
+    v.gesture = gesture;
+}
+
+fn phase_stopped(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let area = v.area;
+    let comp_rect = v.comp_rect;
+    let map = v.map;
+    let time = v.time;
+    let mods = v.mods;
+    let gid = v.gid;
+    let vertex_hits = std::mem::take(&mut v.vertex_hits);
+    let pin_hits = std::mem::take(&mut v.pin_hits);
+    let gesture = v.gesture.clone();
+    let comp = v.comp;
     if resp.drag_stopped() {
         if let (Some(g), Some(pos)) = (gesture, resp.interact_pointer_pos()) {
             match g {
@@ -1874,7 +1679,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     }
                 }
                 Gesture::PuppetPin { layer, pin, .. } => super::puppet_tool::reveal_pin(app, layer, pin),
-                Gesture::ObjectMatteBox { start } => super::object_matte_tool::apply(app, &ectx, &map, start, Some(pos), mods.shift),
+                Gesture::ObjectMatteBox { start } => super::object_matte_tool::apply(app, ectx, &map, start, Some(pos), mods.shift),
                 Gesture::Create { tool, start } => {
                     let end = map.to_comp(pos);
                     create_shape(app, tool, start, end, mods);
@@ -1907,8 +1712,8 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 Gesture::Marquee { start } => {
                     let a = map.to_comp(start);
                     let b = map.to_comp(pos);
-                    let hits: Vec<u64> = selectable_layers(&comp, time)
-                        .filter(|l| layer_quad(&ectx, l).is_some_and(|(_, q, _)| quad_intersects_box(&q, a, b)))
+                    let hits: Vec<u64> = selectable_layers(comp, time)
+                        .filter(|l| layer_quad(ectx, l).is_some_and(|(_, q, _)| quad_intersects_box(&q, a, b)))
                         .map(|l| l.id.0)
                         .collect();
                     let _ = app.session.execute("layer.select", json!({"layers": hits, "toggle": mods.shift}));
@@ -1918,10 +1723,44 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
         }
         ui.data_mut(|d| {
             d.remove::<Gesture>(gid);
-            let n: u64 = d.get_temp(egui::Id::new("viewer-drag-n")).unwrap_or(0);
-            d.insert_temp(egui::Id::new("viewer-drag-n"), n + 1);
+            let n: u64 = d.get_temp(egui::Id::unique("viewer-drag-n")).unwrap_or(0);
+            d.insert_temp(egui::Id::unique("viewer-drag-n"), n + 1);
         });
     }
+    v.vertex_hits = vertex_hits;
+    v.pin_hits = pin_hits;
+}
+
+fn phase_clicked(app: &mut EffectcraftApp, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let area = v.area;
+    let zoom = v.zoom;
+    let cw = v.cw;
+    let ch = v.ch;
+    let map = v.map;
+    let mods = v.mods;
+    let text_owns = v.text_owns;
+    let ctx = v.ctx.clone();
+    let ft = std::mem::take(&mut v.ft);
+    let handle_hits = std::mem::take(&mut v.handle_hits);
+    let vertex_hits = std::mem::take(&mut v.vertex_hits);
+    let key_hits = std::mem::take(&mut v.key_hits);
+    let motion_frames = std::mem::take(&mut v.motion_frames);
+    let paths = std::mem::take(&mut v.paths);
+    let pin_hits = std::mem::take(&mut v.pin_hits);
+    let puppet_layers = std::mem::take(&mut v.puppet_layers);
+    let comp = v.comp;
+    let vertex_at = |pos: Pos2, tangents: bool| -> Option<VertexHit> {
+        let reach = vertex_grab_radius(pos, handle_hits.iter().map(|(_, _, h, _)| *h));
+        vertex_hits.iter().rev().filter(|h| h.tangent.is_some() == tangents).find(|h| h.pos.distance(pos) < reach).copied()
+    };
+    let puppet_layer = |app: &mut EffectcraftApp, cpt: [f64; 2]| -> Option<LayerId> {
+        if puppet_layers.is_empty() {
+            return pick(app, ectx, cpt, false);
+        }
+        super::puppet_tool::target(ectx, &puppet_layers, cpt, |l| {
+            layers_at(ectx, cpt).any(|h| h.id == l.id) && super::puppet_tool::takes_pin(app, ectx, l, cpt)
+        })
+    };
     if resp.clicked()
         && !text_owns
         && let Some(pos) = resp.interact_pointer_pos()
@@ -1962,8 +1801,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                     let _ = app.session.execute("mask.convertVertex", json!({"layer": h.layer.0, "mask": h.mask, "index": h.index}));
                 } else if let Some(k) = ov::motion_key_at(&key_hits, pos) {
                     // A key showing direction handles becomes Linear; one without, Auto Bezier.
+                    // Separated X / Y Position have no spatial interpolation to convert.
                     let curved = key_hits.iter().any(|h| h.tangent.is_some() && h.layer == k.layer && h.prop == k.prop && h.time == k.time);
-                    if select_motion_key(app, &k) {
+                    if k.axes.is_none() && select_motion_key(app, &k) {
                         let spatial = if curved { "linear" } else { "autoBezier" };
                         let _ = app.session.execute("keys.interpolation", json!({"spatial": spatial}));
                     }
@@ -1978,13 +1818,13 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
                 // Clicking away from the free-transform box ends it.
                 ov::end_free_transform(&ctx);
             }
-            Tool::ObjectMatte => super::object_matte_tool::apply(app, &ectx, &map, pos, None, mods.shift),
+            Tool::ObjectMatte => super::object_matte_tool::apply(app, ectx, &map, pos, None, mods.shift),
             t if t.puppet_kind().is_some() => {
                 if let Some((h, _)) = super::puppet_tool::hit(&pin_hits, pos) {
                     // Click selects the pin; Shift-click adds or removes it.
                     let _ = app.session.execute("puppet.selectPins", json!({"layer": h.layer.0, "pins": [h.pin], "toggle": mods.shift}));
                 } else if let Some(l) = puppet_layer(app, cpt).and_then(|l| comp.layer(l))
-                    && let Some(inv) = fx2c(&ectx, l).inverse()
+                    && let Some(inv) = fx2c(ectx, l).inverse()
                 {
                     let lp = inv.apply(gv2(cpt[0], cpt[1]));
                     match app.session.execute("puppet.addPin", json!({"layer": l.id.0, "kind": t.puppet_kind(), "position": [lp.x, lp.y]})) {
@@ -2005,13 +1845,13 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
             // The Roto Brush paints in the Layer panel only: select as usual and say so.
             rt if rt.roto_kind(false).is_some() => {
-                if pick(app, &ectx, cpt, mods.shift).is_none() {
+                if pick(app, ectx, cpt, mods.shift).is_none() {
                     let _ = app.session.execute("edit.deselectAll", json!({}));
                 }
                 app.ui.status = crate::i18n::tr(ROTO_HINT).to_string();
             }
             _ => {
-                if pick(app, &ectx, cpt, mods.shift).is_none() {
+                if pick(app, ectx, cpt, mods.shift).is_none() {
                     let _ = app.session.execute("edit.deselectAll", json!({}));
                 } else if !mods.shift && !app.session.state.selected_vertices.is_empty() && ov::segment_at(&paths, &map, pos, 6.0).is_none() {
                     // A click away from the paths, even on their layer, deselects the mask
@@ -2021,6 +1861,28 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
+    v.ft = ft;
+    v.handle_hits = handle_hits;
+    v.vertex_hits = vertex_hits;
+    v.key_hits = key_hits;
+    v.motion_frames = motion_frames;
+    v.paths = paths;
+    v.pin_hits = pin_hits;
+    v.puppet_layers = puppet_layers;
+}
+
+fn phase_dblclick(app: &mut EffectcraftApp, ectx: &EvalCtx, resp: &egui::Response, v: &mut Vw<'_>) {
+    let map = v.map;
+    let text_owns = v.text_owns;
+    let ctx = v.ctx.clone();
+    let handle_hits = std::mem::take(&mut v.handle_hits);
+    let vertex_hits = std::mem::take(&mut v.vertex_hits);
+    let paths = std::mem::take(&mut v.paths);
+    let comp = v.comp;
+    let vertex_at = |pos: Pos2, tangents: bool| -> Option<VertexHit> {
+        let reach = vertex_grab_radius(pos, handle_hits.iter().map(|(_, _, h, _)| *h));
+        vertex_hits.iter().rev().filter(|h| h.tangent.is_some() == tangents).find(|h| h.pos.distance(pos) < reach).copied()
+    };
     if resp.double_clicked()
         && !text_owns
         && app.ui.tool == Tool::Selection
@@ -2042,7 +1904,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
     {
         let cpt = map.to_comp(pos);
         let roto = app.ui.tool.roto_kind(false).is_some();
-        if let Some(l) = pick(app, &ectx, cpt, false).and_then(|l| comp.layer(l)) {
+        if let Some(l) = pick(app, ectx, cpt, false).and_then(|l| comp.layer(l)) {
             match &l.source {
                 effectcraft_engine::project::LayerSource::Comp { item } => app.session.open_comp(*item),
                 // With a Roto Brush tool, double-clicking a layer opens it in the Layer panel,
@@ -2058,867 +1920,95 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
             }
         }
     }
+    v.handle_hits = handle_hits;
+    v.vertex_hits = vertex_hits;
+    v.paths = paths;
+}
+
+fn phase_tail(app: &mut EffectcraftApp, ui: &mut egui::Ui, ectx: &EvalCtx, v: &mut Vw<'_>) {
+    let t = v.t;
+    let cid = v.cid;
+    let bar = v.bar;
+    let err_bar = v.err_bar;
+    let err_h = v.err_h;
+    let area = v.area;
+    let outer = v.outer;
+    let zoom = v.zoom;
+    let map = v.map;
+    let time = v.time;
+    let ctx = v.ctx.clone();
+    let painter = v.painter.clone();
+    let comp = v.comp;
     // 3D Camera Tracker points, targets and their menu (on top of the viewer's gestures while
     // the effect is selected), and its analysis banner.
-    super::camera_tracker_ui::viewer_hook(app, ui, &painter, &map, &ectx, &|c, l| l2c(c, l).0);
+    super::camera_tracker_ui::viewer_hook(app, ui, &painter, &map, ectx, &|c, l| l2c(c, l).0);
     // Effect point controls and crosshair/eyedropper picks (on top of the viewer's gestures).
-    crate::panels::effect_controls::viewer_hook(app, ui, &painter, &map, &ectx, &|c, l| l2c(c, l).0);
+    crate::panels::effect_controls::viewer_hook(app, ui, &painter, &map, ectx, &|c, l| l2c(c, l).0);
     // Selected shape gradients' start and end points (#612).
-    crate::panels::gradient_handles::viewer_hook(app, ui, &painter, &map, &ectx, &|c, l| l2c(c, l).0);
+    crate::panels::gradient_handles::viewer_hook(app, ui, &painter, &map, ectx, &|c, l| l2c(c, l).0);
     // Selected text Range Selectors' Start and End bars (#1011).
-    crate::panels::text_range_handles::viewer_hook(app, ui, &painter, &map, &ectx, &|c, l| l2c(c, l).0);
+    crate::panels::text_range_handles::viewer_hook(app, ui, &painter, &map, ectx, &|c, l| l2c(c, l).0);
 
     // Status chips (render time / caching).
+    // The caching chip stays up a moment after the last wait, so gaps between uncached frames
+    // don't make it flicker.
+    // ponytail: fixed 0.6 s hold; tie it to the prefetch queue being empty if gaps outlast it.
+    let chip_id = egui::Id::unique("viewer-caching-chip");
+    let now = ctx.input(|i| i.time);
     if app.playback.playing && app.playback.waiting {
-        let r = Rect::from_min_size(area.min + vec2(10.0, 10.0), vec2(150.0, 22.0));
-        painter.rect_filled(r, 11.0, Color32::from_black_alpha(170));
-        painter.text(r.center(), Align2::CENTER_CENTER, crate::i18n::tr("Caching frames…"), Tokens::ui(11.5), t.cache_green);
+        ctx.data_mut(|d| d.insert_temp(chip_id, now + 0.6));
+    }
+    let until = ctx.data(|d| d.get_temp::<f64>(chip_id)).unwrap_or(0.0);
+    if app.playback.playing && now < until {
+        if !app.playback.waiting {
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64(until - now));
+        }
+        let text = painter.layout_no_wrap(crate::i18n::tr("Caching frames").to_string(), Tokens::ui(10.5), t.text_dim);
+        let r = Rect::from_min_size(area.min + vec2(8.0, 8.0), vec2(text.size().x + 30.0, 18.0));
+        painter.rect_filled(r, 9.0, Color32::from_black_alpha(140));
+        ui.put(Rect::from_center_size(pos2(r.min.x + 12.0, r.center().y), vec2(10.0, 10.0)), egui::Spinner::new().size(10.0).color(t.cache_green));
+        painter.galley(pos2(r.min.x + 22.0, r.center().y - text.size().y / 2.0), text, t.text_dim);
     }
     if app.video_preview_off().is_some() {
         let r = Rect::from_min_size(area.min + vec2(10.0, 10.0), vec2(330.0, 22.0));
         painter.rect_filled(r, 11.0, Color32::from_black_alpha(190));
         painter.text(r.center(), Align2::CENTER_CENTER, crate::i18n::tr("Video preview is off (Preview panel): audio only"), Tokens::ui(11.5), t.timecode);
-        ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new("viewer-video-off-chip"), r));
+        ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique("viewer-video-off-chip"), r));
     }
 
-    vt::draw_snap(&ctx, &painter, &map, &ectx);
+    vt::draw_snap(&ctx, &painter, &map, ectx);
     vt::rulers(app, ui, &map, outer, area);
-    vt::bottom_bar(app, ui, bar, zoom, time, &comp);
+    vt::bottom_bar(app, ui, bar, zoom, time, comp);
     if err_h > 0.0 {
         super::expr_bar::draw(app, ui, err_bar, cid);
     }
 }
-
-/// The position change per comp pixel of drag (x, y) that moves a layer by `dir` when the
-/// pointer covers the axis' on-screen vector `s` (comp px); drag across the axis is ignored.
-fn axis_drag(dir: [f64; 3], s: [f64; 2]) -> ([f64; 3], [f64; 3]) {
-    let n = (s[0] * s[0] + s[1] * s[1]).max(1e-12);
-    (dir.map(|v| v * s[0] / n), dir.map(|v| v * s[1] / n))
-}
-
-/// The gizmo arrow under screen point `p`.
-fn axis_at(hits: &[(LayerId, [Pos2; 2], [f64; 3], [f64; 3])], p: Pos2) -> Option<(LayerId, [Pos2; 2], [f64; 3], [f64; 3])> {
-    let dist = |[a, b]: [Pos2; 2]| {
-        let ab = b - a;
-        let t = ((p - a).dot(ab) / ab.length_sq().max(1e-6)).clamp(0.0, 1.0);
-        p.distance(a + ab * t)
-    };
-    hits.iter().filter(|h| dist(h.1) < 6.0).min_by(|a, b| dist(a.1).total_cmp(&dist(b.1))).copied()
-}
-
-/// World to parent space for a 3D layer (identity without a parent).
-fn parent_world_inverse(ctx: &EvalCtx, l: &Layer) -> effectcraft_engine::geom::Mat4 {
-    match l.parent.and_then(|p| ctx.comp.layer(p)) {
-        Some(p) => ctx.world_matrix(p).inverse().unwrap_or_default(),
-        None => effectcraft_engine::geom::Mat4::IDENTITY,
-    }
-}
-
-/// Parent-space position change per comp pixel of drag (x and y) for a layer: 2D layers map
-/// through the parent transform; 3D layers move in the view plane at their depth.
-fn drag_axes(ctx: &EvalCtx, l: &Layer) -> ([f64; 3], [f64; 3]) {
-    if !l.is_3d() {
-        let inv = parent_inverse(ctx, l);
-        let a = inv.apply_vec(gv2(1.0, 0.0));
-        let b = inv.apply_vec(gv2(0.0, 1.0));
-        return ([a.x, a.y, 0.0], [b.x, b.y, 0.0]);
-    }
-    let cam = cam_state(ctx);
-    let anchor = l.transform().map(|tr| ctx.v3(l, tr, "anchor", [0.0; 3])).unwrap_or([0.0; 3]);
-    let wp = ctx.world_matrix(l).apply(anchor.into());
-    let k = if cam.ortho { 1.0 / cam.zoom.max(1e-9) } else { cam.depth(wp).max(1.0) / cam.zoom.max(1e-9) };
-    let pinv = parent_world_inverse(ctx, l);
-    let a = pinv.apply_vec(cam.right() * k);
-    let b = pinv.apply_vec(cam.down() * k);
-    ([a.x, a.y, a.z], [b.x, b.y, b.z])
-}
-
-/// Wireframes of cameras (frustum, point of interest) and lights (position, direction) as seen
-/// through the current 3D view.
-/// Camera and light wireframes seen through `cam` (`through_active`: `cam` is the active camera,
-/// which is then not drawn). `pane` names the automation ids: `None` for the main view
-/// (`viewer.camera.<id>`), `Some(view)` for a view of a 2- or 4-view layout
-/// (`viewer.view.<view>.camera.<id>`).
-#[allow(clippy::too_many_arguments)]
-fn draw_rigs(
-    app: &mut EffectcraftApp,
-    painter: &egui::Painter,
-    map: &ViewerMap,
-    ectx: &EvalCtx,
-    selected: &[LayerId],
-    cam: CameraState,
-    through_active: bool,
-    pane: Option<&str>,
-) {
-    use effectcraft_engine::geom::Vec3;
-    use effectcraft_engine::project::{LayerSource, LightKind};
-    let (w, h) = (ectx.comp.width as f64, ectx.comp.height as f64);
-    let active = ectx.comp.active_camera(ectx.time).map(|c| c.id);
-    let prefix = pane.map(|v| format!("viewer.view.{v}.")).unwrap_or_else(|| "viewer.".to_string());
-    let proj = |p: Vec3| cam.project(w, h, p).map(|v| map.to_screen([v.x, v.y]));
-    let seg = |a: Vec3, b: Vec3, stroke: Stroke| {
-        if let (Some(x), Some(y)) = (proj(a), proj(b)) {
-            painter.line_segment([x, y], stroke);
-        }
-    };
-    for l in ectx.comp.layers.iter().filter(|l| (l.is_camera() || l.is_light()) && l.is_active_at(ectx.time)) {
-        let sel = selected.contains(&l.id);
-        let col = app.tokens.label(l.label).gamma_multiply(if sel { 1.0 } else { 0.6 });
-        let stroke = Stroke::new(if sel { 1.5 } else { 1.0 }, col);
-        let (eye, fwd, down) = three_d::camera::layer_frame(ectx, l);
-        let poi = |l: &Layer| -> Option<Vec3> {
-            let pr = l.transform()?.get("poi").filter(|_| three_d::camera::is_two_node(l))?;
-            Some(three_d::camera::parent_world(ectx, l).apply(ectx.value(l, pr).as_vec3().into()))
-        };
-        if l.is_camera() {
-            if through_active && Some(l.id) == active {
-                continue;
-            }
-            let zoom = l.props.prop("cameraOptions/zoom").map(|p| ectx.value(l, p).as_f64()).unwrap_or(1000.0);
-            let right = down.cross(fwd);
-            // Frustum to a plane at a quarter of the zoom distance.
-            let k = 0.25;
-            let c = eye + fwd * (zoom * k);
-            let corners = [(-1.0, -1.0), (1.0, -1.0), (1.0, 1.0), (-1.0, 1.0)].map(|(sx, sy)| c + right * (sx * w * 0.5 * k) + down * (sy * h * 0.5 * k));
-            for i in 0..4 {
-                seg(eye, corners[i], stroke);
-                seg(corners[i], corners[(i + 1) % 4], stroke);
-            }
-            if let Some(poi) = poi(l) {
-                seg(eye, poi, Stroke::new(1.0, col.gamma_multiply(0.6)));
-                if let Some(s) = proj(poi) {
-                    painter.circle_stroke(s, 4.0, stroke);
-                }
-            }
-            if let Some(s) = proj(eye) {
-                app.auto.add(&format!("{prefix}camera.{}", l.id.0), Rect::from_center_size(s, vec2(14.0, 14.0)), &l.name);
-            }
-        } else {
-            let LayerSource::Light { kind } = l.source else { continue };
-            if kind == LightKind::Ambient {
-                continue;
-            }
-            let Some(s) = proj(eye) else { continue };
-            painter.circle_stroke(s, 6.0, stroke);
-            for i in 0..8 {
-                let a = i as f32 * std::f32::consts::FRAC_PI_4;
-                let d = vec2(a.cos(), a.sin());
-                painter.line_segment([s + d * 8.0, s + d * 12.0], stroke);
-            }
-            if matches!(kind, LightKind::Spot | LightKind::Parallel) {
-                let target = poi(l).unwrap_or(eye + fwd * 300.0);
-                seg(eye, target, Stroke::new(1.0, col.gamma_multiply(0.7)));
-                if let Some(q) = proj(target) {
-                    painter.circle_stroke(q, 3.0, stroke);
-                }
-            }
-            app.auto.add(&format!("{prefix}light.{}", l.id.0), Rect::from_center_size(s, vec2(16.0, 16.0)), &l.name);
-        }
-    }
-}
-
-/// Pen tool press at `pos`: continue the path in progress (pressing its first vertex closes it),
-/// resume an open path whose last vertex is pressed, add a vertex on a visible path's segment, or
-/// start a new path: a mask on the selected footage/solid layer (or shape layer, with Tool Creates
-/// Mask), a shape path (Shape n group with the Tools bar's Fill and Stroke) on the selected shape
-/// layer, or a new shape layer when nothing is selected. The placed point snaps.
-/// Add a Position keyframe at a motion path's frame, keeping the path where it is.
-fn add_motion_key(app: &mut EffectcraftApp, f: ov::PathFrame) {
-    if let Err(e) = app.session.execute("prop.addKey", json!({"layer": f.layer.0, "prop": f.prop, "time": f.time.seconds()})) {
-        app.ui.status = e.to_string();
-    }
-}
-
-/// Select only the motion path's keyframe `k` (what the vertex tools act on).
-fn select_motion_key(app: &mut EffectcraftApp, k: &ov::KeyHit) -> bool {
-    app.session.execute("keys.select", json!({"keys": [{"layer": k.layer.0, "prop": k.prop, "time": k.time.seconds()}]})).is_ok()
-}
-
-/// The pointer for a Pen slot tool: the tool's own pen, the Pen showing Add Vertex's over a path
-/// it would add a point to (After Effects).
-fn pen_cursor_icon(tool: Tool, over_path: bool) -> crate::icons::Icon {
-    use crate::icons::Icon;
-    match tool {
-        Tool::Pen if over_path => Icon::PenAdd,
-        Tool::PenAdd => Icon::PenAdd,
-        Tool::PenDelete => Icon::PenDelete,
-        Tool::PenConvert => Icon::PenConvert,
-        Tool::MaskFeather => Icon::MaskFeather,
-        _ => Icon::Pen,
-    }
-}
-
-/// Paint pen pointer `icon` with its tip at `at`, outlined for any background.
-fn pen_cursor(ctx: &egui::Context, at: Pos2, icon: crate::icons::Icon) {
-    use crate::icons::Icon;
-    // Where each glyph's tip sits in its 16 × 16 box.
-    let tip = match icon {
-        Icon::PenAdd | Icon::PenDelete | Icon::MaskFeather => vec2(6.0, 2.5),
-        Icon::PenConvert => vec2(8.0, 3.5),
-        _ => vec2(8.0, 1.8),
-    };
-    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("viewer-pen-cursor")));
-    let rect = Rect::from_min_size(at - tip, vec2(16.0, 16.0));
-    for d in [vec2(-1.0, 0.0), vec2(1.0, 0.0), vec2(0.0, -1.0), vec2(0.0, 1.0)] {
-        crate::icons::paint(&painter, rect.translate(d), icon, Color32::BLACK);
-    }
-    crate::icons::paint(&painter, rect, icon, Color32::WHITE);
-}
-
-#[allow(clippy::too_many_arguments)]
-fn pen_press(
-    app: &mut EffectcraftApp,
-    ui: &mut egui::Ui,
-    ectx: &EvalCtx,
-    map: &ViewerMap,
-    paths: &[ov::PathInfo],
-    motion_frame: Option<ov::PathFrame>,
-    pos: Pos2,
-    mods: egui::Modifiers,
-) {
-    use effectcraft_engine::project::LayerSource;
-    let gid = egui::Id::new("viewer-gesture");
-    let current: Option<(LayerId, u64)> = ui.data(|d| d.get_temp(pen_id()));
-    let c0 = map.to_comp(pos);
-    let corr = vt::snap(app, ui.ctx(), ectx, map, &[], &[c0], mods);
-    let c = [c0[0] + corr[0], c0[1] + corr[1]];
-    if let Some((lid, uid)) = current
-        && let Some(p) = ov::path_of(ectx, lid, uid)
-        && let Some(inv) = p.m.inverse()
-    {
-        let n = p.sp.vertices.len();
-        let first = p.sp.vertices.first().map(|v| {
-            let q = p.m.apply(gv2(v[0], v[1]));
-            map.to_screen([q.x, q.y])
-        });
-        if n >= 2 && first.is_some_and(|f| f.distance(pos) < 8.0) {
-            let _ = app.session.execute("mask.setClosed", json!({"layer": lid.0, "mask": uid, "closed": true}));
-            ui.data_mut(|d| {
-                d.remove::<(LayerId, u64)>(pen_id());
-                d.remove::<Gesture>(gid);
-            });
-            return;
-        }
-        // Shift keeps the new segment at a multiple of 45° from the vertex before it (#1544).
-        let last = p.sp.vertices.last().map(|v| p.m.apply(gv2(v[0], v[1])));
-        let c = match last {
-            Some(q) if mods.shift => constrain_45([q.x, q.y], c),
-            _ => c,
-        };
-        let lp = inv.apply(gv2(c[0], c[1]));
-        let lp = [lp.x, lp.y];
-        if let Ok(v) = app.session.execute("mask.addVertex", json!({"layer": lid.0, "mask": uid, "point": lp})) {
-            let index = v.as_u64().unwrap_or(0) as usize;
-            ui.data_mut(|d| d.insert_temp(gid, Gesture::Pen { layer: lid, mask: uid, index, vertex: lp, inv, press: pos }));
-        }
-        return;
-    }
-    // Clicking the last vertex of an open path (e.g. after Esc ended it) resumes drawing it.
-    if let Some(cur) = ov::open_end_at(paths, map, pos, 8.0) {
-        ui.data_mut(|d| d.insert_temp(pen_id(), cur));
-        return;
-    }
-    // On a visible path's segment the Pen adds a vertex there; on a motion path, a keyframe.
-    if let Some(f) = motion_frame {
-        add_motion_key(app, f);
-        return;
-    }
-    if let Some((l, m, seg, t)) = ov::segment_at(paths, map, pos, 5.0) {
-        let _ = app.session.execute("mask.insertVertex", json!({"layer": l.0, "mask": m, "segment": seg, "t": t}));
-        return;
-    }
-    let target = app
-        .session
-        .state
-        .selected_layers
-        .iter()
-        .copied()
-        .find(|id| ectx.comp.layer(*id).is_some_and(|l| !l.switches.locked && (l.masks().is_some() || matches!(l.source, LayerSource::Shape))));
-    let layer = target.and_then(|id| ectx.comp.layer(id));
-    let (lid, uid, inv) = match layer {
-        Some(l) if !matches!(l.source, LayerSource::Shape) || app.session.state.shape_tool.creates_mask => {
-            let Some(inv) = l2c(ectx, l).0.inverse() else { return };
-            let lp = inv.apply(gv2(c[0], c[1]));
-            let Ok(v) = app.session.execute("mask.new", json!({"layer": l.id.0, "vertices": [[lp.x, lp.y]]})) else { return };
-            let Some(mask) = v["mask"].as_u64() else { return };
-            (l.id, mask, inv)
-        }
-        Some(l) => {
-            let Some(inv) = l2c(ectx, l).0.inverse() else { return };
-            let lp = inv.apply(gv2(c[0], c[1]));
-            let r = app.session.execute("shape.newPath", json!({"layer": l.id.0, "vertices": [[lp.x, lp.y]], "space": "layer"}));
-            let Some(path) = r.ok().and_then(|v| v["path"].as_u64()) else { return };
-            (l.id, path, inv)
-        }
-        None => {
-            // A new shape layer at the comp centre (unrotated: comp → layer is a translation).
-            let r = app.session.execute("shape.newPath", json!({"vertices": [c], "space": "comp"}));
-            let Some(v) = r.ok() else { return };
-            let (Some(l), Some(path)) = (v["layer"].as_u64(), v["path"].as_u64()) else { return };
-            let inv = Mat3::translate(gv2(-(ectx.comp.width as f64) / 2.0, -(ectx.comp.height as f64) / 2.0));
-            (LayerId(l), path, inv)
-        }
-    };
-    let lp = inv.apply(gv2(c[0], c[1]));
-    ui.data_mut(|d| {
-        d.insert_temp(pen_id(), (lid, uid));
-        d.insert_temp(gid, Gesture::Pen { layer: lid, mask: uid, index: 0, vertex: [lp.x, lp.y], inv, press: pos });
-    });
-}
-
-/// `to` moved onto the nearest line through `from` at a multiple of 45° (horizontal, vertical or
-/// diagonal), as far along it as `to` lies: the Pen's Shift-click.
-fn constrain_45(from: [f64; 2], to: [f64; 2]) -> [f64; 2] {
-    let (dx, dy) = (to[0] - from[0], to[1] - from[1]);
-    if !(dx.is_finite() && dy.is_finite()) || (dx == 0.0 && dy == 0.0) {
-        return to;
-    }
-    let step = std::f64::consts::FRAC_PI_4;
-    let a = (dy.atan2(dx) / step).round() * step;
-    let (ux, uy) = (a.cos(), a.sin());
-    let along = dx * ux + dy * uy;
-    [from[0] + ux * along, from[1] + uy * along]
-}
-
-/// Visible, unlocked layers eligible for viewer hit tests, in front-to-back order.
-/// Solo scope matches the renderer: any soloed AV layer activates it at every time (as in After
-/// Effects), even when hidden, locked or outside its in-out range.
-pub(crate) fn selectable_layers(comp: &Comp, time: Tick) -> impl Iterator<Item = &Layer> {
-    let any_solo = comp.layers.iter().any(|l| l.switches.solo && l.source.is_av());
-    comp.layers
-        .iter()
-        .filter(move |l| l.is_active_at(time) && l.switches.video && !l.switches.locked && !l.is_camera() && !l.is_light() && (!any_solo || l.switches.solo))
-}
-
-/// Selectable layers under a comp point, front to back.
-pub(crate) fn layers_at<'a, 'b>(ectx: &'b EvalCtx<'a>, cpt: [f64; 2]) -> impl Iterator<Item = &'a Layer> + 'b {
-    selectable_layers(ectx.comp, ectx.time).filter(move |l| layer_quad(ectx, l).is_some_and(|(_, q, _)| point_in_quad(cpt, &q)))
-}
-
-/// Topmost selectable layer under a comp point.
-pub(crate) fn layer_at<'a>(ectx: &EvalCtx<'a>, cpt: [f64; 2]) -> Option<&'a Layer> {
-    layers_at(ectx, cpt).next()
-}
-
-/// The layer a press at a comp point acts on, selected (Shift toggles the topmost layer). As in
-/// After Effects, a selected layer under the point comes before the layers in front of it, so it
-/// can be dragged where they cover it; otherwise the topmost layer (#230).
-pub(crate) fn pick(app: &mut EffectcraftApp, ectx: &EvalCtx, cpt: [f64; 2], toggle: bool) -> Option<LayerId> {
-    if toggle {
-        let hit = layer_at(ectx, cpt)?.id;
-        let _ = app.session.execute("layer.select", json!({"layers": [hit.0], "toggle": true}));
-        return Some(hit);
-    }
-    let selected = &app.session.state.selected_layers;
-    let hits: Vec<LayerId> = layers_at(ectx, cpt).map(|l| l.id).collect();
-    let hit = *hits.iter().find(|id| selected.contains(id)).or(hits.first())?;
-    if !selected.contains(&hit) {
-        let _ = app.session.execute("layer.select", json!({"layers": [hit.0]}));
-    }
-    Some(hit)
-}
-
-/// Where a shape drag is going to land: a mask on the selected layer, a group inside it, or a new
-/// shape layer.
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum ShapeTarget {
-    Mask,
-    IntoLayer,
-    NewLayer,
-}
-
-impl ShapeTarget {
-    /// What the drag will make and where, named the way the ghost captions it.
-    fn label(self, layer_name: &str) -> String {
-        match self {
-            ShapeTarget::Mask => format!("Mask on “{layer_name}”"),
-            ShapeTarget::IntoLayer => format!("Into “{layer_name}”"),
-            ShapeTarget::NewLayer => "New shape layer".to_string(),
-        }
-    }
-}
-
-/// A shape drag as it stands, after the Tools' normalisations: the path it will make and where it
-/// will land.
-struct ShapeDrag {
-    /// The `shape.newShape` / `layer.addMask` kind for the tool.
-    kind: &'static str,
-    /// Comp-space centre and size, what the drag will make.
-    centre: [f64; 2],
-    size: [f64; 2],
-    target: ShapeTarget,
-    /// The selected layer's name and the index its next mask would take, for the ghost's caption
-    /// and colour.
-    layer_name: String,
-    mask_index: usize,
-}
-
-/// The kind `tool` draws, as `shape.newShape` / `layer.addMask` name it.
-fn shape_kind(tool: Tool) -> &'static str {
-    match tool {
-        Tool::Rectangle => "rect",
-        Tool::RoundedRect => "rounded",
-        Tool::Ellipse => "ellipse",
-        Tool::Polygon => "polygon",
-        _ => "star",
-    }
-}
-
-/// What a shape tool drag from `start` to `end` makes, or `None` while it is too small to make
-/// anything. Alt (Option) draws from the press point and Shift squares the box; the live ghost and
-/// [`create_shape`] both go through this, so the drag always shows what it will commit.
-fn shape_drag(app: &EffectcraftApp, tool: Tool, start: [f64; 2], end: [f64; 2], mods: egui::Modifiers) -> Option<ShapeDrag> {
-    let comp = app.session.active_comp()?;
-    let selected = app.session.state.selected_layers.first().copied();
-    let sel = selected.and_then(|id| comp.layer(id));
-    // A footage, solid or other non-shape layer selected, or a shape layer with Tool Creates
-    // Mask: a mask on that layer. Otherwise the engine's own target: the first selected unlocked
-    // shape layer, else a new one.
-    let target = match sel {
-        Some(l) if l.source.is_av() && (app.session.state.shape_tool.creates_mask || !matches!(l.source, LayerSource::Shape)) => (ShapeTarget::Mask, Some(l)),
-        _ => match effectcraft_engine::commands::shape_tool::selected_shape_target(&app.session, comp).and_then(|id| comp.layer(id)) {
-            Some(l) => (ShapeTarget::IntoLayer, Some(l)),
-            None => (ShapeTarget::NewLayer, None),
-        },
-    };
-    let (target, layer) = target;
-    let mask_index = if target == ShapeTarget::Mask { layer.and_then(|l| l.masks()).map_or(0, |m| m.groups().count()) } else { 0 };
-    let (mut w, mut h) = ((end[0] - start[0]).abs(), (end[1] - start[1]).abs());
-    // Ctrl/Cmd draws from the press point as the centre, as in After Effects.
-    if mods.command {
-        w *= 2.0;
-        h *= 2.0;
-    }
-    if w < 2.0 && h < 2.0 {
-        return None;
-    }
-    if mods.shift {
-        let m = w.max(h);
-        w = m;
-        h = m;
-    }
-    Some(ShapeDrag {
-        kind: shape_kind(tool),
-        centre: if mods.command { start } else { [start[0].min(end[0]) + w / 2.0, start[1].min(end[1]) + h / 2.0] },
-        size: [w, h],
-        target,
-        layer_name: layer.map_or_else(String::new, |l| l.name.clone()),
-        mask_index,
-    })
-}
-
-/// The Tools bar's paint colour as bytes, dimmed by `alpha` so the comp shows through the ghost.
-fn paint_rgb(c: [f32; 3], opacity: f64, alpha: f32) -> Color32 {
-    let f = |k: f32| (k.clamp(0.0, 1.0) * 255.0).round() as u8;
-    Color32::from_rgb(f(c[0]), f(c[1]), f(c[2])).gamma_multiply((opacity.clamp(0.0, 100.0) / 100.0) as f32 * alpha)
-}
-
-/// Draw a shape drag as it will land: the tool's own path, filled with the Tools bar's Fill and
-/// outlined in its Stroke (or the mask colour, for a mask), captioned with where it goes.
-fn draw_shape_ghost(painter: &egui::Painter, map: &ViewerMap, app: &EffectcraftApp, d: &ShapeDrag, t: &Tokens) {
-    // The engine's own geometry for the kind, so the ghost is the shape and not a stand-in for it.
-    let Some(sp) = effectcraft_engine::commands::shape_tool::mask_path(d.kind, d.centre, d.size) else { return };
-    let mut pts = ov::flatten(&sp, &Mat3::IDENTITY, map);
-    if pts.first() == pts.last() {
-        pts.pop();
-    }
-    if pts.len() < 3 {
-        return;
-    }
-    let tool = &app.session.state.shape_tool;
-    let (fill, line) = match d.target {
-        ShapeTarget::Mask => {
-            let [r, g, b] = effectcraft_engine::prefs::mask_color(app.session.prefs.appearance.cycle_mask_colors, d.mask_index);
-            (Color32::from_rgb(r, g, b).gamma_multiply(0.25), Color32::from_rgb(r, g, b))
-        }
-        _ => {
-            let stroke_on = tool.stroke.kind != PaintKind::None && tool.stroke_width > 0.0;
-            (
-                if tool.fill.kind == PaintKind::None { Color32::TRANSPARENT } else { paint_rgb(tool.fill.color, tool.fill.opacity, 0.45) },
-                if stroke_on { paint_rgb(tool.stroke.color, tool.stroke.opacity, 1.0) } else { t.accent },
-            )
-        }
-    };
-    let Some(bounds) = bounds_of(&pts) else { return };
-    // A screen-width outline reads at every zoom, where a comp-pixel hairline does not.
-    painter.add(egui::Shape::Path(egui::epaint::PathShape { points: pts, closed: true, fill, stroke: Stroke::new(1.5, line).into() }));
-    // Caption it with where the shape lands: a mask, a group in the selected shape layer or a
-    // new layer.
-    let font = Tokens::ui(11.0);
-    let galley = painter.layout_no_wrap(d.target.label(&d.layer_name), font, line);
-    let caption = Rect::from_min_size(pos2(bounds.left(), bounds.top() - 5.0 - galley.size().y), galley.size());
-    painter.rect_filled(caption.expand(3.0), 2.0, Color32::from_black_alpha(150));
-    painter.galley(caption.min, galley, line);
-}
-
-/// The bounds of points on screen, or `None` for an empty set.
-fn bounds_of(pts: &[Pos2]) -> Option<Rect> {
-    let first = *pts.first()?;
-    let mut r = Rect::from_min_max(first, first);
-    for p in pts.iter().skip(1) {
-        r.extend_with(*p);
-    }
-    Some(r)
-}
-
-fn create_shape(app: &mut EffectcraftApp, tool: Tool, a: [f64; 2], b: [f64; 2], mods: egui::Modifiers) {
-    let Some(d) = shape_drag(app, tool, a, b, mods) else { return };
-    let (kind, (w, h), (cx, cy)) = (d.kind, (d.size[0], d.size[1]), (d.centre[0], d.centre[1]));
-    // A mask on the selected layer, as the ghost showed.
-    if d.target == ShapeTarget::Mask {
-        // In layer space: invert the layer transform.
-        let sel_layer = app.session.state.selected_layers.first().copied().and_then(|id| app.session.active_comp().and_then(|c| c.layer(id)).cloned());
-        if let Some(l) = sel_layer
-            && let Some(comp) = app.session.active_comp_arc()
-        {
-            let ectx = EvalCtx {
-                project: &app.session.project,
-                comp_id: app.session.active_comp_id().unwrap_or_default(),
-                comp: &comp,
-                time: app.session.time(),
-                expr: None,
-                footage: None,
-            };
-            let inv = l2c(&ectx, &l).0.inverse().unwrap_or(Mat3::IDENTITY);
-            let p0 = inv.apply(gv2(cx - w / 2.0, cy - h / 2.0));
-            let p1 = inv.apply(gv2(cx + w / 2.0, cy + h / 2.0));
-            let rect = [p0.x.min(p1.x), p0.y.min(p1.y), (p1.x - p0.x).abs(), (p1.y - p0.y).abs()];
-            if let Err(e) = app.session.execute("layer.addMask", json!({"layer": l.id.0, "shape": kind, "rect": rect})) {
-                app.ui.status = e.to_string();
-            }
-        }
-        return;
-    }
-    // Into the selected shape layer's Contents as a new group (as in After Effects), else a new
-    // shape layer; painted with the Tools bar's Fill and Stroke.
-    if let Err(e) = app.session.execute("shape.newShape", json!({"kind": kind, "size": [w, h], "position": [cx, cy]})) {
-        app.ui.status = e.to_string();
-    }
-}
-
-fn empty_state(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
-    let t = app.tokens;
-    let p = ui.painter().clone();
-    p.rect_filled(rect, 0.0, t.pasteboard);
-    let c = rect.center();
-    p.text(c - vec2(0.0, 40.0), Align2::CENTER_CENTER, crate::i18n::tr("Composition"), Tokens::semibold(16.0), t.text);
-    let b1 = Rect::from_center_size(c + vec2(0.0, 0.0), vec2(220.0, 30.0));
-    if widgets::text_button(ui, b1, "New Composition", true, &t, egui::Id::new("empty-newcomp")).clicked() {
-        crate::panels::dialogs::open_new_comp(app);
-    }
-    app.auto.add("viewer.empty.newComp", b1, "New Composition");
-    let b2 = Rect::from_center_size(c + vec2(0.0, 40.0), vec2(220.0, 30.0));
-    if widgets::text_button(ui, b2, "New Composition From Footage", false, &t, egui::Id::new("empty-fromfootage")).clicked() {
-        let _ = crate::menus::invoke(app, &ui.ctx().clone(), "file.import", json!({}));
-    }
-    app.auto.add("viewer.empty.import", b2, "New Composition From Footage");
-    // A Project item dropped on the empty viewer creates the first composition,
-    // just like dropping it onto an empty Timeline (#684). Multiple selected
-    // items use the existing New Comp from Selection dialog.
-    let ctx = ui.ctx().clone();
-    if let Some(crate::panels::DragPayload::Item(dragged)) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx).as_deref()
-        && ui.rect_contains_pointer(rect)
-    {
-        let items: Vec<effectcraft_engine::project::ItemId> = crate::panels::project_drop_items(app, *dragged)
-            .into_iter()
-            .map(effectcraft_engine::project::ItemId)
-            .filter(|id| {
-                app.session.project.item(*id).is_some_and(|item| match &item.kind {
-                    effectcraft_engine::project::ItemKind::Footage(f) => f.kind != effectcraft_engine::project::FootageKind::Data,
-                    effectcraft_engine::project::ItemKind::Solid(_) | effectcraft_engine::project::ItemKind::Comp(_) => true,
-                    _ => false,
-                })
-            })
-            .collect();
-        if !items.is_empty() {
-            p.rect_stroke(rect.shrink(2.0), 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
-            app.auto.add("viewer.newCompDrop", rect, "Drop footage to create a composition");
-            if ctx.input(|i| i.pointer.any_released()) {
-                app.session.state.project_selection = items;
-                if let Err(e) = crate::menus::invoke(app, &ctx, "file.newCompFromSelection", json!({})) {
-                    app.ui.status = e;
-                }
-                egui::DragAndDrop::clear_payload(&ctx);
-            }
-        }
-    }
-}
-
-/// `#rrggbb` → sRGB bytes.
-/// A grid or guide line in the Grids & Guides style: `lines`, `dashed` or `dots`.
-pub(crate) fn styled_line(painter: &egui::Painter, pts: [Pos2; 2], stroke: Stroke, style: &str) {
-    match style {
-        "dashed" => {
-            painter.add(egui::Shape::dashed_line(&pts, stroke, 6.0, 4.0));
-        }
-        "dots" => {
-            painter.add(egui::Shape::dotted_line(&pts, stroke.color, 4.0, stroke.width.max(1.0) * 0.75));
-        }
-        _ => {
-            painter.line_segment(pts, stroke);
-        }
-    }
-}
-
-/// `p` (points) moved to the nearest physical pixel corner at `ppp` pixels per point.
-pub(crate) fn snap_to_pixels(p: Pos2, ppp: f32) -> Pos2 {
-    if !(ppp.is_finite() && ppp > 0.0 && p.x.is_finite() && p.y.is_finite()) {
-        return p;
-    }
-    pos2((p.x * ppp).round() / ppp, (p.y * ppp).round() / ppp)
-}
-
-/// Texture filtering for Viewer Zoom Quality: More Accurate = bilinear, Faster = nearest. As in
-/// After Effects, a magnified frame (above 100 %, or a lower Resolution) always shows its pixels
-/// as blocks, never smoothed, in either mode (#882).
-pub(crate) fn zoom_texture_options(smooth: bool) -> egui::TextureOptions {
-    if smooth { egui::TextureOptions { magnification: egui::TextureFilter::Nearest, ..egui::TextureOptions::LINEAR } } else { egui::TextureOptions::NEAREST }
-}
-
-/// The sampler GPU frames (mipmapped display textures) are drawn with: More Accurate filters
-/// bilinearly within and between mip levels, so a frame shown below 100 % is averaged instead of
-/// skipping pixels (#417); Faster takes the nearest pixel of the full-size frame. Magnified, both
-/// show the nearest pixel (#882).
-pub(crate) fn zoom_sampler(smooth: bool) -> eframe::wgpu::SamplerDescriptor<'static> {
-    use eframe::wgpu::{FilterMode, MipmapFilterMode, SamplerDescriptor};
-    let label = Some("viewer frame");
-    if smooth {
-        SamplerDescriptor {
-            label,
-            mag_filter: FilterMode::Nearest,
-            min_filter: FilterMode::Linear,
-            mipmap_filter: MipmapFilterMode::Linear,
-            ..Default::default()
-        }
-    } else {
-        SamplerDescriptor { label, lod_max_clamp: 0.0, ..Default::default() }
-    }
-}
-
-/// The whole factor a CPU frame is averaged down by for its texture when `pixels` of it are drawn
-/// over `screen` screen pixels: about one texel per screen pixel, so bilinear filtering never
-/// skips frame pixels — the CPU frames' counterpart of the GPU frames' mip levels (#417). Faster
-/// keeps every pixel.
-pub(crate) fn minify_factor(smooth: bool, pixels: f64, screen: f64) -> usize {
-    let k = (pixels / screen + 1e-3).floor();
-    if smooth && k >= 1.0 { k.min(256.0) as usize } else { 1 }
-}
-
 pub(crate) use crate::widgets::hex_rgb;
 
-/// The Extended Viewer's render region for this frame (see [`ViewerState::extended`]):
-/// Settings ▸ 3D ▸ Extended Viewer on, the comp has 3D layers and the view is a custom 3D view
-/// (or Draft 3D is on), and part of the visible viewer lies outside the comp frame.
-///
-/// [`ViewerState::extended`]: crate::state::ViewerState::extended
-pub(crate) fn extended_region(
-    app: &EffectcraftApp,
-    comp: &effectcraft_engine::project::Comp,
-    cid: effectcraft_engine::project::ItemId,
-    map: ViewerMap,
-) -> Option<[f64; 4]> {
-    if !app.session.prefs.three_d.extended_viewer || !comp.has_3d() || app.session.state.region_of_interest.is_some() {
-        return None;
-    }
-    let view = app.session.state.views3d.get(&cid).map(|v| v.current).unwrap_or_default();
-    if view == View3D::ActiveCamera && !comp.draft_3d {
-        return None;
-    }
-    let a = map.to_comp(map.area.min);
-    let b = map.to_comp(map.area.max);
-    effectcraft_engine::render::extended_region(comp.width, comp.height, [a[0], a[1], b[0], b[1]], 1.0)
-}
+mod frame;
+mod geometry;
+mod gesture;
+mod shapes;
+mod tools;
+mod view;
 
-fn rect_of(map: &ViewerMap, r: Option<[f64; 4]>) -> Rect {
-    let [x, y, w, h] = r.unwrap_or_default();
-    Rect::from_min_max(map.to_screen([x, y]), map.to_screen([x + w, y + h]))
-}
-
-/// Put a rendered frame on screen: CPU pixels go into an egui texture, averaged down by `minify`
-/// (see [`minify_factor`]); GPU frames are drawn straight from their wgpu texture (registered with
-/// egui-wgpu, no readback).
-fn show_frame(app: &mut EffectcraftApp, ctx: &egui::Context, key: crate::frames::FrameKey, img: crate::frames::FrameImage, minify: usize) {
-    use crate::frames::FrameImage;
-    // Settings ▸ Previews ▸ Viewer Zoom Quality.
-    let smooth = app.session.prefs.viewer_zoom_smooth();
-    let opts = zoom_texture_options(smooth);
-    match img {
-        FrameImage::Cpu(img) => {
-            // Frames wider or taller than the GPU's texture limit go up averaged down too (#201).
-            let max = crate::frames::max_texture_side(ctx);
-            let fitted = crate::frames::fit_shared_texture_by(&img, max, minify);
-            match &mut app.viewer_tex {
-                Some((tex, k, m)) if tex.size() == fitted.size() => {
-                    tex.set(fitted, opts);
-                    (*k, *m) = (key, minify);
-                }
-                _ => app.viewer_tex = Some((ctx.load_texture("viewer-frame", fitted, opts), key, minify)),
-            }
-            app.viewer_shown = app.viewer_tex.as_ref().map(|(t, k, _)| (t.id(), *k));
-            app.viewer_image = Some(img);
-            vt::set_texture_roi(ctx, app.session.state.region_of_interest.or(app.ui.viewer.extended));
-        }
-        FrameImage::Gpu(f) => {
-            let Some(rs) = &app.wgpu else { return };
-            let view = f.texture.create_view(&Default::default());
-            let mut ren = rs.renderer.write();
-            let id = match &app.viewer_native {
-                Some((id, _, _)) => {
-                    ren.update_egui_texture_from_wgpu_texture_with_sampler_options(&rs.device, &view, zoom_sampler(smooth), *id);
-                    *id
-                }
-                None => ren.register_native_texture_with_sampler_options(&rs.device, &view, zoom_sampler(smooth)),
-            };
-            drop(ren);
-            app.viewer_native = Some((id, key, f));
-            app.viewer_shown = Some((id, key));
-            // Pixels are read back on demand (viewer_pixels).
-            app.viewer_image = None;
-        }
-    }
-}
+use frame::{empty_state, rect_of, show_frame};
+pub(crate) use frame::{extended_region, minify_factor, snap_to_pixels, styled_line, zoom_sampler, zoom_texture_options};
+use geometry::{
+    anchor_in_comp, cam_state, drag_ratio, handle_axes, handle_cursor, handle_point, one_axis, project_segment, quad_intersects_box, rotate_value,
+    rotation_sign, selected_others, snap_handle, turn_delta,
+};
+#[cfg(test)]
+use geometry::{box_corners, project_clipped};
+pub(crate) use geometry::{from_effect_space, fx2c, l2c, layer_outline, layer_quad};
+use gesture::{Gesture, HANDLE, ROTO_HINT, pen_id, roi_drag, roi_handles, vertex_grab_radius};
+use shapes::{create_shape, draw_shape_ghost, shape_drag};
+pub(crate) use shapes::{layer_at, layer_at_including_locked, layers_at, pick, selectable_layers};
+#[cfg(test)]
+use tools::constrain_45;
+use tools::{add_motion_key, axis_at, axis_drag, drag_axes, draw_rigs, parent_world_inverse, pen_cursor, pen_cursor_icon, pen_press, select_motion_key};
+pub(crate) use view::checker;
+use view::{aux_views, locked_pane};
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use effectcraft_engine::geom::{Mat4, vec3};
-
-    /// #1544: Shift-clicking with the Pen keeps the new segment horizontal, vertical or diagonal.
-    #[test]
-    fn pen_shift_click_keeps_the_segment_at_45_degrees() {
-        let near = |a: [f64; 2], b: [f64; 2]| (a[0] - b[0]).abs() < 1e-9 && (a[1] - b[1]).abs() < 1e-9;
-        let from = [100.0, 100.0];
-        assert!(near(constrain_45(from, [104.0, 180.0]), [100.0, 180.0]), "straight down");
-        assert!(near(constrain_45(from, [30.0, 97.0]), [30.0, 100.0]), "left");
-        assert!(near(constrain_45(from, [150.0, 46.0]), [152.0, 48.0]), "up and right, on the diagonal");
-        assert!(near(constrain_45(from, from), from), "on the vertex");
-        assert!(constrain_45(from, [f64::NAN, 3.0])[0].is_nan(), "a non-finite point stays as it is");
-    }
-
-    /// The Rotation tool counts past a full turn in both directions, as in After Effects: the
-    /// pointer going round the anchor 1.5 turns clockwise gives 540°, then back 2 turns gives
-    /// −180°, with no jump where atan2 wraps from 180° to −180°.
-    #[test]
-    fn rotate_tool_accumulates_revolutions() {
-        // Screen y points down, so a growing atan2 angle is clockwise on screen.
-        let drag = |start: f64, steps: &[f64]| {
-            let (mut last, mut turned, mut out) = (start, 0.0, vec![]);
-            for &a in steps {
-                // atan2's range: (−180°, 180°].
-                let a = (a + 180.0).rem_euclid(360.0) - 180.0;
-                turned += turn_delta(last, a);
-                last = a;
-                out.push(turned);
-            }
-            (last, turned, out)
-        };
-        let cw: Vec<f64> = (1..=54).map(|i| i as f64 * 10.0).collect();
-        let (last, turned, seq) = drag(0.0, &cw);
-        assert!((turned - 540.0).abs() < 1e-9, "{turned}");
-        assert!(seq.windows(2).all(|w| (w[1] - w[0] - 10.0).abs() < 1e-9), "no jump: {seq:?}");
-        assert!((rotate_value(0.0, turned, false) - 540.0).abs() < 1e-9);
-        let ccw: Vec<f64> = (1..=72).map(|i| 540.0 - i as f64 * 10.0).collect();
-        let (_, back, seq) = drag(last, &ccw);
-        assert!(seq.windows(2).all(|w| (w[1] - w[0] + 10.0).abs() < 1e-9), "no jump: {seq:?}");
-        let total = turned + back;
-        assert!((total + 180.0).abs() < 1e-9, "{total}");
-        assert!((rotate_value(30.0, total, false) + 150.0).abs() < 1e-9);
-        // Shift snaps the accumulated value, not a wrapped one.
-        assert_eq!(rotate_value(0.0, 400.0, true), 405.0);
-        assert_eq!(rotate_value(0.0, -400.0, true), -405.0);
-        // Across the seam: 170° → −170° is +20°, and back is −20°; exactly half a turn is +180°.
-        assert!((turn_delta(170.0, -170.0) - 20.0).abs() < 1e-9);
-        assert!((turn_delta(-170.0, 170.0) + 20.0).abs() < 1e-9);
-        assert_eq!(turn_delta(0.0, 180.0), 180.0);
-        assert_eq!(turn_delta(0.0, -180.0), 180.0);
-        // Never crash or poison the value on non-finite input.
-        assert_eq!(turn_delta(f64::NAN, 10.0), 0.0);
-        assert_eq!(turn_delta(0.0, f64::INFINITY), 0.0);
-        assert_eq!(rotate_value(15.0, f64::NAN, false), 15.0);
-    }
-
-    /// #1042: a path vertex lying under, or just beside, a bounding-box handle is grabbed
-    /// instead of the handle; away from every handle the reach is unchanged.
-    #[test]
-    fn vertex_reaches_as_far_as_a_box_handle_over_it() {
-        let handle = pos2(100.0, 100.0);
-        let vertex = pos2(100.0, 100.0);
-        // The press lands 8 points off the vertex, still on the handle's square.
-        let press = pos2(108.0, 100.0);
-        let pick = |p: Pos2, handles: &[Pos2]| vertex.distance(p) < vertex_grab_radius(p, handles.iter().copied());
-        assert!(handle.distance(press) < HANDLE + 2.0, "the handle would take this press");
-        assert!(pick(press, &[handle]), "the vertex wins over the handle");
-        assert!(!pick(press, &[]), "no handle there: the usual reach");
-        assert!(pick(pos2(105.0, 100.0), &[]));
-        assert!(!pick(pos2(120.0, 100.0), &[handle]), "past the handle: nothing");
-    }
-
-    /// #882: the frame's corner sits on a physical pixel at any display scaling, so 100 % maps
-    /// comp pixels 1:1 onto screen pixels.
-    #[test]
-    fn frame_origin_snaps_to_physical_pixels() {
-        for ppp in [1.0f32, 1.25, 1.5, 1.75, 2.0] {
-            for p in [pos2(-201.12, 72.4), pos2(689.8, 239.75), pos2(0.3, -0.37)] {
-                let s = snap_to_pixels(p, ppp);
-                for v in [s.x * ppp, s.y * ppp] {
-                    assert!((v - v.round()).abs() < 1e-3, "ppp {ppp}: {p:?} → {s:?}");
-                }
-                assert!((s - p).length() <= 0.71 / ppp, "moved by at most half a pixel: {p:?} → {s:?}");
-            }
-        }
-        assert_eq!(snap_to_pixels(pos2(1.3, 2.0), 0.0), pos2(1.3, 2.0));
-    }
-
-    /// #882: a magnified frame shows its pixels as blocks in both Zoom Quality modes; More
-    /// Accurate only smooths when the frame is shown smaller.
-    #[test]
-    fn magnified_frames_are_never_smoothed() {
-        use eframe::wgpu::FilterMode;
-        for smooth in [true, false] {
-            assert_eq!(zoom_texture_options(smooth).magnification, egui::TextureFilter::Nearest);
-            assert_eq!(zoom_sampler(smooth).mag_filter, FilterMode::Nearest);
-        }
-        assert_eq!(zoom_texture_options(true).minification, egui::TextureFilter::Linear);
-        assert_eq!(zoom_sampler(true).min_filter, FilterMode::Linear);
-    }
-
-    /// A perspective-like homography: w = 100 + y (the plane crosses the camera at y = −100).
-    fn tilted() -> Mat3 {
-        Mat3([[100.0, 0.0, 0.0], [0.0, 100.0, 0.0], [0.0, 1.0, 100.0]])
-    }
-
-    /// #572: a box reaching behind the camera is clipped at the near plane instead of flipping
-    /// through infinity into long lines.
-    #[test]
-    fn outlines_clip_at_the_near_plane() {
-        let m = tilted();
-        let front = project_clipped(&m, &box_corners([-50.0, -50.0, 50.0, 50.0]));
-        assert_eq!(front.len(), 4);
-        let crossing = project_clipped(&m, &box_corners([-50.0, -150.0, 50.0, 50.0]));
-        assert_eq!(crossing.len(), 4, "{crossing:?}");
-        // Nothing flipped through infinity: a corner behind the camera (y = −150, w = −50) would
-        // land at y = +300 if it were projected as is; clipped at the near plane it runs off far
-        // above (negative y) instead, and the front corners stay where they were.
-        assert!(crossing.iter().all(|p| p[0].is_finite() && p[1].is_finite() && p[1] < 34.0), "{crossing:?}");
-        assert!(project_clipped(&m, &box_corners([-50.0, -400.0, 50.0, -200.0])).is_empty(), "wholly behind");
-    }
-
-    #[test]
-    fn axis_drag_follows_the_arrow_and_ignores_drag_across_it() {
-        let (ax, ay) = axis_drag([0.0, 0.0, 60.0], [24.0, -24.0]);
-        let at = |d: [f64; 2]| [0, 1, 2].map(|i| ax[i] * d[0] + ay[i] * d[1]);
-        assert_eq!(at([24.0, -24.0]), [0.0, 0.0, 60.0]);
-        assert_eq!(at([-12.0, 12.0]), [0.0, 0.0, -30.0]);
-        assert_eq!(at([10.0, 10.0]), [0.0, 0.0, 0.0]);
-    }
-
-    #[test]
-    fn gizmo_segments_clip_at_the_near_plane() {
-        // w = 100 + z.
-        let pc = Mat4([[100.0, 0.0, 0.0, 0.0], [0.0, 100.0, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0], [0.0, 0.0, 1.0, 100.0]]);
-        let s = project_segment(&pc, vec3(10.0, 0.0, 0.0), vec3(10.0, 0.0, -300.0)).unwrap();
-        assert_eq!(s[0], [10.0, 0.0]);
-        assert!(s[1][0] > 10.0 && s[1][0].is_finite(), "toward the camera it grows, never flips: {s:?}");
-        assert!(project_segment(&pc, vec3(0.0, 0.0, -200.0), vec3(0.0, 0.0, -300.0)).is_none());
-    }
-}
+mod tests;
diff --git a/crates/ui-egui/src/panels/viewer/frame.rs b/crates/ui-egui/src/panels/viewer/frame.rs
new file mode 100644
index 000000000..244285e4d
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/frame.rs
@@ -0,0 +1,195 @@
+use super::{Align2, EffectcraftApp, Pos2, Rect, Stroke, StrokeKind, Tokens, View3D, ViewerMap, json, pos2, vec2, vt, widgets};
+
+/// Draw the no-composition viewer with New Composition and New Composition From Footage buttons, accepting Project
+/// items dropped on it to create the first composition.
+pub(super) fn empty_state(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    let t = app.tokens;
+    let p = ui.painter().clone();
+    p.rect_filled(rect, 0.0, t.pasteboard);
+    let c = rect.center();
+    p.text(c - vec2(0.0, 40.0), Align2::CENTER_CENTER, crate::i18n::tr("Composition"), Tokens::semibold(16.0), t.text);
+    let b1 = Rect::from_center_size(c + vec2(0.0, 0.0), vec2(220.0, 30.0));
+    if widgets::text_button(ui, b1, crate::i18n::tr("New Composition"), true, &t, egui::Id::unique("empty-newcomp")).clicked() {
+        crate::panels::dialogs::open_new_comp(app);
+    }
+    app.auto.add("viewer.empty.newComp", b1, "New Composition");
+    let b2 = Rect::from_center_size(c + vec2(0.0, 40.0), vec2(220.0, 30.0));
+    if widgets::text_button(ui, b2, crate::i18n::tr("New Composition From Footage"), false, &t, egui::Id::unique("empty-fromfootage")).clicked() {
+        let _ = crate::menus::invoke(app, &ui.ctx().clone(), "file.import", json!({"newComp": true}));
+    }
+    app.auto.add("viewer.empty.import", b2, "New Composition From Footage");
+    // A Project item dropped on the empty viewer creates the first composition,
+    // just like dropping it onto an empty Timeline (#684). Multiple selected
+    // items use the existing New Comp from Selection dialog.
+    let ctx = ui.ctx().clone();
+    if let Some(crate::panels::DragPayload::Item(dragged)) = egui::DragAndDrop::payload::<crate::panels::DragPayload>(&ctx).as_deref()
+        && ui.rect_contains_pointer(rect)
+    {
+        let items: Vec<effectcraft_engine::project::ItemId> = crate::panels::project_drop_items(app, *dragged, None)
+            .into_iter()
+            .map(effectcraft_engine::project::ItemId)
+            .filter(|id| {
+                app.session.project.item(*id).is_some_and(|item| match &item.kind {
+                    effectcraft_engine::project::ItemKind::Footage(f) => f.kind != effectcraft_engine::project::FootageKind::Data,
+                    effectcraft_engine::project::ItemKind::Solid(_) | effectcraft_engine::project::ItemKind::Comp(_) => true,
+                    _ => false,
+                })
+            })
+            .collect();
+        if !items.is_empty() {
+            p.rect_stroke(rect.shrink(2.0), 0.0, Stroke::new(2.0, t.accent), StrokeKind::Inside);
+            app.auto.add("viewer.newCompDrop", rect, "Drop footage to create a composition");
+            if ctx.input(|i| i.pointer.any_released()) {
+                app.session.state.project_selection = items;
+                if let Err(e) = crate::menus::invoke(app, &ctx, "file.newCompFromSelection", json!({})) {
+                    app.ui.status = e;
+                }
+                egui::DragAndDrop::clear_payload(&ctx);
+            }
+        }
+    }
+}
+
+/// `#rrggbb` → sRGB bytes.
+/// A grid or guide line in the Grids & Guides style: `lines`, `dashed` or `dots`.
+pub(crate) fn styled_line(painter: &egui::Painter, pts: [Pos2; 2], stroke: Stroke, style: &str) {
+    match style {
+        "dashed" => {
+            painter.add(egui::Shape::dashed_line(&pts, stroke, 6.0, 4.0));
+        }
+        "dots" => {
+            painter.add(egui::Shape::dotted_line(&pts, stroke.color, 4.0, stroke.width.max(1.0) * 0.75));
+        }
+        _ => {
+            painter.line_segment(pts, stroke);
+        }
+    }
+}
+
+/// `p` (points) moved to the nearest physical pixel corner at `ppp` pixels per point.
+pub(crate) fn snap_to_pixels(p: Pos2, ppp: f32) -> Pos2 {
+    if !(ppp.is_finite() && ppp > 0.0 && p.x.is_finite() && p.y.is_finite()) {
+        return p;
+    }
+    pos2((p.x * ppp).round() / ppp, (p.y * ppp).round() / ppp)
+}
+
+/// Texture filtering for Viewer Zoom Quality: More Accurate = bilinear, Faster = nearest. As in
+/// After Effects, a magnified frame (above 100 %, or a lower Resolution) always shows its pixels
+/// as blocks, never smoothed, in either mode (#882).
+pub(crate) fn zoom_texture_options(smooth: bool) -> egui::TextureOptions {
+    if smooth { egui::TextureOptions { magnification: egui::TextureFilter::Nearest, ..egui::TextureOptions::LINEAR } } else { egui::TextureOptions::NEAREST }
+}
+
+/// The sampler GPU frames (mipmapped display textures) are drawn with: More Accurate filters
+/// bilinearly within and between mip levels, so a frame shown below 100 % is averaged instead of
+/// skipping pixels (#417); Faster takes the nearest pixel of the full-size frame. Magnified, both
+/// show the nearest pixel (#882).
+pub(crate) fn zoom_sampler(smooth: bool) -> eframe::wgpu::SamplerDescriptor<'static> {
+    use eframe::wgpu::{FilterMode, MipmapFilterMode, SamplerDescriptor};
+    let label = Some("viewer frame");
+    if smooth {
+        SamplerDescriptor {
+            label,
+            mag_filter: FilterMode::Nearest,
+            min_filter: FilterMode::Linear,
+            mipmap_filter: MipmapFilterMode::Linear,
+            ..Default::default()
+        }
+    } else {
+        SamplerDescriptor { label, lod_max_clamp: 0.0, ..Default::default() }
+    }
+}
+
+/// The whole factor a CPU frame is averaged down by for its texture when `pixels` of it are drawn
+/// over `screen` screen pixels: about one texel per screen pixel, so bilinear filtering never
+/// skips frame pixels — the CPU frames' counterpart of the GPU frames' mip levels (#417). Faster
+/// keeps every pixel.
+pub(crate) fn minify_factor(smooth: bool, pixels: f64, screen: f64) -> usize {
+    let k = (pixels / screen + 1e-3).floor();
+    if smooth && k >= 1.0 { k.min(256.0) as usize } else { 1 }
+}
+
+/// The Extended Viewer's render region for this frame (see [`ViewerState::extended`]):
+/// Settings ▸ 3D ▸ Extended Viewer on, the comp has 3D layers and the view is a custom 3D view
+/// (or Draft 3D is on), and part of the visible viewer lies outside the comp frame.
+///
+/// [`ViewerState::extended`]: crate::state::ViewerState::extended
+pub(crate) fn extended_region(
+    app: &EffectcraftApp,
+    comp: &effectcraft_engine::project::Comp,
+    cid: effectcraft_engine::project::ItemId,
+    map: ViewerMap,
+) -> Option<[f64; 4]> {
+    if !app.session.prefs.three_d.extended_viewer || !comp.has_3d() || app.session.state.region_of_interest.is_some() {
+        return None;
+    }
+    let view = app.session.state.views3d.get(&cid).map(|v| v.current).unwrap_or_default();
+    if view == View3D::ActiveCamera && !comp.draft_3d {
+        return None;
+    }
+    let a = map.to_comp(map.area.min);
+    let b = map.to_comp(map.area.max);
+    effectcraft_engine::render::extended_region(comp.width, comp.height, [a[0], a[1], b[0], b[1]], 1.0)
+}
+
+pub(super) fn rect_of(map: &ViewerMap, r: Option<[f64; 4]>) -> Rect {
+    let [x, y, w, h] = r.unwrap_or_default();
+    Rect::from_min_max(map.to_screen([x, y]), map.to_screen([x + w, y + h]))
+}
+
+/// Put a rendered frame on screen: CPU pixels go into an egui texture, averaged down by `minify`
+/// (see [`minify_factor`]); GPU frames are drawn straight from their wgpu texture (registered with
+/// egui-wgpu, no readback). Half-float frames (32 bpc) are kept for the display pass, which
+/// `viewer_tools::draw_frame` runs (exposure, HDR step, display colour).
+pub(super) fn show_frame(app: &mut EffectcraftApp, ctx: &egui::Context, key: crate::frames::FrameKey, img: crate::frames::FrameImage, minify: usize) {
+    use crate::frames::FrameImage;
+    // Settings ▸ Previews ▸ Viewer Zoom Quality.
+    let smooth = app.session.prefs.viewer_zoom_smooth();
+    let opts = zoom_texture_options(smooth);
+    match img {
+        FrameImage::Cpu(img) => {
+            // Frames wider or taller than the GPU's texture limit go up averaged down too (#201).
+            let max = crate::frames::max_texture_side(ctx);
+            let fitted = crate::frames::fit_shared_texture_by(&img, max, minify);
+            match &mut app.viewer_tex {
+                Some((tex, k, m)) if tex.size() == fitted.size() => {
+                    tex.set(fitted, opts);
+                    (*k, *m) = (key, minify);
+                }
+                _ => app.viewer_tex = Some((ctx.load_texture("viewer-frame", fitted, opts), key, minify)),
+            }
+            app.viewer_shown = app.viewer_tex.as_ref().map(|(t, k, _)| (Some(t.id()), *k));
+            app.viewer_image = Some(img);
+            app.viewer_f16 = None;
+            vt::set_texture_roi(ctx, app.session.state.region_of_interest.or(app.ui.viewer.extended));
+        }
+        FrameImage::CpuF16(f) => {
+            // Drawn through the display pass; the 8-bit texture of an earlier frame goes.
+            app.viewer_tex = None;
+            // No texture of its own: the display pass draws it.
+            app.viewer_shown = Some((None, key));
+            app.viewer_image = None;
+            app.viewer_f16 = Some(f);
+            vt::set_texture_roi(ctx, app.session.state.region_of_interest.or(app.ui.viewer.extended));
+        }
+        FrameImage::Gpu(f) => {
+            let Some(rs) = &app.wgpu else { return };
+            let view = f.texture.create_view(&Default::default());
+            let mut ren = rs.renderer.write();
+            let id = match &app.viewer_native {
+                Some((id, _, _)) => {
+                    ren.update_egui_texture_from_wgpu_texture_with_sampler_options(&rs.device, &view, zoom_sampler(smooth), *id);
+                    *id
+                }
+                None => ren.register_native_texture_with_sampler_options(&rs.device, &view, zoom_sampler(smooth)),
+            };
+            drop(ren);
+            app.viewer_native = Some((id, key, f));
+            app.viewer_shown = Some((Some(id), key));
+            // Pixels are read back on demand (viewer_pixels).
+            app.viewer_image = None;
+            app.viewer_f16 = None;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/panels/viewer/geometry.rs b/crates/ui-egui/src/panels/viewer/geometry.rs
new file mode 100644
index 000000000..144047f32
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/geometry.rs
@@ -0,0 +1,323 @@
+use super::ov::parent_to_comp;
+use super::{CameraState, Comp, EffectcraftApp, EvalCtx, Layer, LayerId, Mat3, Pos2, VIEW_CAM, gv2, three_d, vec2};
+
+/// The camera the viewer shows (view camera or the comp's active camera).
+pub(super) fn cam_state(ctx: &EvalCtx) -> CameraState {
+    VIEW_CAM.with(|c| c.get()).unwrap_or_else(|| three_d::active_camera(ctx))
+}
+
+/// Layer → comp (viewer) matrix through the current 3D view.
+pub(crate) fn l2c(ctx: &EvalCtx, layer: &Layer) -> (Mat3, f64) {
+    match VIEW_CAM.with(|c| c.get()) {
+        Some(cam) if layer.is_3d() => (three_d::layer_to_view(ctx, layer, &cam), 0.0),
+        _ => ctx.layer_to_comp(layer),
+    }
+}
+
+/// `l2c` (layer → comp) applied from effect space instead: effect points and Puppet pins,
+/// measured from the top-left of the layer's effect bounds (see `effect_bounds`).
+pub(crate) fn from_effect_space(ctx: &EvalCtx, layer: &Layer, l2c: Mat3) -> Mat3 {
+    let o = ctx.effect_bounds(layer).1;
+    l2c * Mat3::translate(gv2(o[0], o[1]))
+}
+
+/// Effect space → comp (viewer) matrix through the current 3D view.
+pub(crate) fn fx2c(ctx: &EvalCtx, layer: &Layer) -> Mat3 {
+    from_effect_space(ctx, layer, l2c(ctx, layer).0)
+}
+
+/// The selected, unlocked layers of `comp` other than `layer` (when `layer` is one of them): a
+/// handle or Rotation tool drag on one changes them all.
+pub(super) fn selected_others<'a>(app: &EffectcraftApp, comp: &'a Comp, layer: LayerId) -> Vec<&'a Layer> {
+    let sel = &app.session.state.selected_layers;
+    if !sel.contains(&layer) {
+        return vec![];
+    }
+    sel.iter().filter(|id| **id != layer).filter_map(|id| comp.layer(*id)).filter(|l| !l.switches.locked && l.transform().is_some()).collect()
+}
+
+/// The least homogeneous depth (`w`: the distance in front of a perspective camera in pixels, 1
+/// for 2D layers and orthographic views) a viewer outline is drawn at: points at or behind the
+/// camera would flip through infinity and draw long lines across the viewer (#572).
+const NEAR_W: f64 = 0.5;
+
+/// `p` through the homography `m` before the perspective divide: (x, y, w).
+fn homogeneous(m: &Mat3, p: [f64; 2]) -> [f64; 3] {
+    let r = |i: usize| m.0.get(i).map_or(0.0, |row| row[0] * p[0] + row[1] * p[1] + row[2]);
+    [r(0), r(1), r(2)]
+}
+
+/// The closed polygon `poly` (layer pixels) through `m`, clipped to the part in front of the
+/// camera's near plane (comp pixels; empty when none of it is).
+pub(super) fn project_clipped(m: &Mat3, poly: &[[f64; 2]]) -> Vec<[f64; 2]> {
+    let h: Vec<[f64; 3]> = poly.iter().map(|p| homogeneous(m, *p)).collect();
+    let mut out = vec![];
+    for (i, a) in h.iter().enumerate() {
+        let Some(b) = h.get((i + 1) % h.len()) else { continue };
+        let (ina, inb) = (a[2] >= NEAR_W, b[2] >= NEAR_W);
+        if ina {
+            out.push(*a);
+        }
+        if ina != inb {
+            let t = (NEAR_W - a[2]) / (b[2] - a[2]);
+            out.push([a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, NEAR_W]);
+        }
+    }
+    out.iter().map(|q| [q[0] / q[2], q[1] / q[2]]).filter(|q| q[0].is_finite() && q[1].is_finite()).collect()
+}
+
+/// The segment a → b (world space) through the projection `pc`, clipped at the near plane.
+pub(super) fn project_segment(
+    pc: &effectcraft_engine::geom::Mat4,
+    a: effectcraft_engine::geom::Vec3,
+    b: effectcraft_engine::geom::Vec3,
+) -> Option<[[f64; 2]; 2]> {
+    let h = |p: effectcraft_engine::geom::Vec3| {
+        let r = |i: usize| pc.0.get(i).map_or(0.0, |row| row[0] * p.x + row[1] * p.y + row[2] * p.z + row[3]);
+        [r(0), r(1), r(3)]
+    };
+    let (mut ha, mut hb) = (h(a), h(b));
+    if ha[2] < NEAR_W && hb[2] < NEAR_W {
+        return None;
+    }
+    let cut = |p: [f64; 3], q: [f64; 3]| {
+        let t = (NEAR_W - p[2]) / (q[2] - p[2]);
+        [p[0] + (q[0] - p[0]) * t, p[1] + (q[1] - p[1]) * t, NEAR_W]
+    };
+    if ha[2] < NEAR_W {
+        ha = cut(ha, hb);
+    } else if hb[2] < NEAR_W {
+        hb = cut(hb, ha);
+    }
+    let d = |q: [f64; 3]| [q[0] / q[2], q[1] / q[2]];
+    let s = [d(ha), d(hb)];
+    s.iter().flatten().all(|v| v.is_finite()).then_some(s)
+}
+
+/// The content box corners (layer pixels) of `layer`.
+pub(super) fn box_corners(b: [f64; 4]) -> [[f64; 2]; 4] {
+    [[b[0], b[1]], [b[2], b[1]], [b[2], b[3]], [b[0], b[3]]]
+}
+
+/// Layer → comp matrix and its bounds quad (in comp pixels). None for a 3D layer reaching to or
+/// behind the camera (its quad would flip; [`layer_outline`] draws the part in front).
+pub(crate) fn layer_quad(ctx: &EvalCtx, layer: &Layer) -> Option<(Mat3, [[f64; 2]; 4], [f64; 4])> {
+    let b = effectcraft_engine::render::content_bounds(ctx, layer)?;
+    let (m, _) = l2c(ctx, layer);
+    let corners = box_corners(b);
+    if corners.iter().any(|p| homogeneous(&m, *p)[2] < NEAR_W) {
+        return None;
+    }
+    let pts = corners.map(|p| {
+        let q = m.apply(gv2(p[0], p[1]));
+        [q.x, q.y]
+    });
+    Some((m, pts, b))
+}
+
+/// The outline of a layer's content box in comp pixels, clipped at the camera's near plane.
+pub(crate) fn layer_outline(ctx: &EvalCtx, layer: &Layer) -> Vec<[f64; 2]> {
+    let Some(b) = effectcraft_engine::render::content_bounds(ctx, layer) else { return vec![] };
+    project_clipped(&l2c(ctx, layer).0, &box_corners(b))
+}
+
+/// Where a layer's anchor point shows in the viewer (comp pixels), through the current 3D view for
+/// a 3D layer. None without a transform, or when it is at or behind the camera.
+pub(super) fn anchor_in_comp(ctx: &EvalCtx, layer: &Layer) -> Option<[f64; 2]> {
+    let a = ctx.v3(layer, layer.transform()?, "anchor", [0.0; 3]);
+    let p = ctx.world_matrix(layer).apply(a.into());
+    if layer.is_3d() {
+        let pc = cam_state(ctx).projection(ctx.comp.width as f64, ctx.comp.height as f64);
+        return project_segment(&pc, p, p).map(|[q, _]| q);
+    }
+    Some([p.x, p.y])
+}
+
+/// −1 when a layer's Rotation turns it counter-clockwise on screen, its parent being flipped.
+/// Otherwise 1.
+pub(super) fn rotation_sign(ctx: &EvalCtx, layer: &Layer) -> f64 {
+    if parent_to_comp(ctx, layer).determinant() < 0.0 { -1.0 } else { 1.0 }
+}
+
+/// Which axes a bounding-box handle scales: corners (0–3) both; the top and bottom edges (4, 6)
+/// y; the right and left edges (5, 7) x.
+pub(super) fn handle_axes(handle: usize) -> [bool; 2] {
+    match handle {
+        4 | 6 => [false, true],
+        5 | 7 => [true, false],
+        _ => [true, true],
+    }
+}
+
+/// A bounding-box handle's point in layer pixels (`b`: the content box; handles as in
+/// [`handle_axes`], the corners clockwise from the top left, then the top, right, bottom and
+/// left edges' midpoints).
+pub(super) fn handle_point(b: [f64; 4], handle: usize) -> [f64; 2] {
+    let (cx, cy) = ((b[0] + b[2]) / 2.0, (b[1] + b[3]) / 2.0);
+    match handle {
+        0 => [b[0], b[1]],
+        1 => [b[2], b[1]],
+        2 => [b[2], b[3]],
+        3 => [b[0], b[3]],
+        4 => [cx, b[1]],
+        5 => [b[2], cy],
+        6 => [cx, b[3]],
+        _ => [b[0], cy],
+    }
+}
+
+/// The resize cursor over bounding-box handle `handle` of the on-screen box `sq` (corners
+/// clockwise from the top left, handles as in [`handle_point`]): along the direction the handle
+/// scales, so it turns with the layer, as in After Effects. A corner points between its two
+/// edges (the box's diagonal whatever its proportions), an edge handle across its edge.
+pub(super) fn handle_cursor(sq: &[Pos2], handle: usize) -> egui::CursorIcon {
+    let at = |k: usize| sq.get(k % 4).copied().unwrap_or(Pos2::ZERO);
+    let dir = if handle < 4 {
+        let c = at(handle);
+        (c - at(handle + 3)).normalized() + (c - at(handle + 1)).normalized()
+    } else {
+        let e = at(handle - 3) - at(handle - 4);
+        vec2(-e.y, e.x)
+    };
+    // Screen y points down: 45° is the south-east diagonal.
+    let a = dir.y.atan2(dir.x).to_degrees().rem_euclid(180.0);
+    if !(22.5..157.5).contains(&a) {
+        egui::CursorIcon::ResizeHorizontal
+    } else if a < 67.5 {
+        egui::CursorIcon::ResizeNwSe
+    } else if a < 112.5 {
+        egui::CursorIcon::ResizeVertical
+    } else {
+        egui::CursorIcon::ResizeNeSw
+    }
+}
+
+/// The scale ratio (x, y) that puts the point grabbed at `start` (relative to the anchor, layer
+/// pixels) under the pointer at `cur`. `uniform` (Shift on a corner) keeps the aspect ratio,
+/// following the pointer along the handle's diagonal. Dragging past the anchor flips the layer,
+/// as in After Effects; an axis whose grabbed point sits on the anchor keeps its scale.
+pub(super) fn drag_ratio(start: [f64; 2], cur: [f64; 2], axes: [bool; 2], uniform: bool) -> [f64; 2] {
+    if uniform {
+        let d2 = start[0] * start[0] + start[1] * start[1];
+        let f = if d2 > 1e-6 { (cur[0] * start[0] + cur[1] * start[1]) / d2 } else { 1.0 };
+        return [f, f];
+    }
+    [0, 1].map(|k| if axes[k] && start[k].abs() > 1e-3 { cur[k] / start[k] } else { 1.0 })
+}
+
+/// Snap a handle drag (#252): the handle (`h`, layer pixels from the anchor point `a` as the
+/// drag began; `l2c` that layer space → comp) at scale ratio `f` goes through `snap` (a comp
+/// point → its correction), and the ratio that puts the handle where it snapped comes back.
+/// A `uniform` drag slides the handle along its line from the anchor point to the nearer snapped
+/// line; otherwise each scaled axis takes the snapped point.
+pub(super) fn snap_handle(
+    f: [f64; 2],
+    h: [f64; 2],
+    a: [f64; 2],
+    l2c: &Mat3,
+    axes: [bool; 2],
+    uniform: bool,
+    snap: impl FnOnce([f64; 2]) -> [f64; 2],
+) -> [f64; 2] {
+    let at = |f: [f64; 2]| {
+        let q = l2c.apply(gv2(a[0] + f[0] * h[0], a[1] + f[1] * h[1]));
+        [q.x, q.y]
+    };
+    let p = at(f);
+    let c = snap(p);
+    let s = [p[0] + c[0], p[1] + c[1]];
+    if uniform {
+        let o = at([0.0; 2]);
+        let d = [p[0] - o[0], p[1] - o[1]];
+        let k = [0, 1].into_iter().filter(|k| c[*k] != 0.0 && d[*k].abs() > 1e-9).min_by(|x, y| c[*x].abs().total_cmp(&c[*y].abs()));
+        return k.map_or(f, |k| f.map(|v| v * (s[k] - o[k]) / d[k]));
+    }
+    let Some(inv) = l2c.inverse().filter(|_| c != [0.0; 2]) else { return f };
+    let q = inv.apply(gv2(s[0], s[1]));
+    let q = [q.x - a[0], q.y - a[1]];
+    [0, 1].map(|k| if axes[k] && h[k].abs() > 1e-9 { q[k] / h[k] } else { f[k] })
+}
+
+/// The turn from angle `from` to angle `to` (degrees), wrapped to (−180°, 180°]: the shortest way
+/// round, so summing it frame by frame follows the pointer across atan2's ±180° seam and past full
+/// revolutions. Non-finite input turns by nothing.
+pub(super) fn turn_delta(from: f64, to: f64) -> f64 {
+    let d = to - from;
+    if !d.is_finite() {
+        return 0.0;
+    }
+    let w = (d + 180.0).rem_euclid(360.0) - 180.0;
+    if w <= -180.0 { w + 360.0 } else { w }
+}
+
+/// The Rotation tool's value: the rotation as the drag began plus the turn so far (which may span
+/// revolutions), snapped to 45° steps with Shift.
+pub(super) fn rotate_value(start_rot: f64, turned: f64, shift: bool) -> f64 {
+    let r = start_rot + turned;
+    let r = if r.is_finite() { r } else { start_rot };
+    if shift { (r / 45.0).round() * 45.0 } else { r }
+}
+
+/// A drag `d` (comp pixels), kept to the axis it moves along most when `shift` is held.
+pub(super) fn one_axis(d: [f64; 2], shift: bool) -> [f64; 2] {
+    if !shift {
+        d
+    } else if d[0].abs() > d[1].abs() {
+        [d[0], 0.0]
+    } else {
+        [0.0, d[1]]
+    }
+}
+
+pub(super) fn point_in_quad(p: [f64; 2], q: &[[f64; 2]; 4]) -> bool {
+    let mut sign = 0.0;
+    for i in 0..4 {
+        let a = q[i];
+        let b = q[(i + 1) % 4];
+        let c = (b[0] - a[0]) * (p[1] - a[1]) - (b[1] - a[1]) * (p[0] - a[0]);
+        if c.abs() < 1e-9 {
+            continue;
+        }
+        if sign == 0.0 {
+            sign = c.signum();
+        } else if c.signum() != sign {
+            return false;
+        }
+    }
+    true
+}
+
+/// Separating-axis test: a marquee may cross a layer without containing any corner.
+pub(super) fn quad_intersects_box(q: &[[f64; 2]; 4], a: [f64; 2], b: [f64; 2]) -> bool {
+    if q.iter().flatten().chain(a.iter()).chain(b.iter()).any(|v| !v.is_finite()) {
+        return false;
+    }
+    let lo = [a[0].min(b[0]), a[1].min(b[1])];
+    let hi = [a[0].max(b[0]), a[1].max(b[1])];
+    let rect = [lo, [hi[0], lo[1]], hi, [lo[0], hi[1]]];
+    let axes = [[1.0, 0.0], [0.0, 1.0]].into_iter().chain((0..4).map(|i| {
+        let j = (i + 1) % 4;
+        [q[j][1] - q[i][1], q[i][0] - q[j][0]]
+    }));
+    for axis in axes {
+        let project = |p: &[f64; 2]| p[0] * axis[0] + p[1] * axis[1];
+        let (qmin, qmax) = q.iter().map(project).fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), v| (lo.min(v), hi.max(v)));
+        let (rmin, rmax) = rect.iter().map(project).fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), v| (lo.min(v), hi.max(v)));
+        if qmax < rmin || rmax < qmin {
+            return false;
+        }
+    }
+    true
+}
+
+/// Parent-space linear inverse (to convert a comp-space drag delta into a position delta).
+pub(super) fn parent_inverse(ctx: &EvalCtx, layer: &Layer) -> Mat3 {
+    match layer.parent.and_then(|p| ctx.comp.layer(p)) {
+        Some(p) => {
+            let w = ctx.world_matrix(p);
+            let m = Mat3([[w.0[0][0], w.0[0][1], 0.0], [w.0[1][0], w.0[1][1], 0.0], [0.0, 0.0, 1.0]]);
+            m.inverse().unwrap_or(Mat3::IDENTITY)
+        }
+        None => Mat3::IDENTITY,
+    }
+}
diff --git a/crates/ui-egui/src/panels/viewer/gesture.rs b/crates/ui-egui/src/panels/viewer/gesture.rs
new file mode 100644
index 000000000..72ef22a84
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/gesture.rs
@@ -0,0 +1,202 @@
+use super::{EffectcraftApp, LayerId, Mat3, Pos2, Rect, Tick, Tool, ViewerMap, ov, vec2};
+
+/// What a drag in the viewer is doing.
+#[derive(Clone, Debug)]
+pub(super) enum Gesture {
+    /// Per layer: start position and the parent-space change per comp pixel of drag in x and y.
+    Move {
+        layers: Vec<(LayerId, [f64; 3], [f64; 3], [f64; 3])>,
+        start: [f64; 2],
+        /// The grabbed layer's feature nearest the pointer (comp px at the start): it snaps.
+        snap_src: Option<[f64; 2]>,
+    },
+    Camera {
+        tool: Tool,
+    },
+    /// A bounding-box handle: scales about the anchor point so the grabbed point follows the
+    /// pointer (corners both axes, edges one), relative to the layer as the drag began; the
+    /// handle snaps.
+    Scale {
+        layer: LayerId,
+        start_scale: [f64; 3],
+        /// The grabbed point relative to the anchor, in layer pixels.
+        start_local: [f64; 2],
+        /// The handle's point relative to the anchor, in layer pixels.
+        handle: [f64; 2],
+        anchor: [f64; 2],
+        axes: [bool; 2],
+        /// Layer pixels → comp as the drag began, and its inverse.
+        l2c: Mat3,
+        inv: Mat3,
+        /// The other selected layers and their scales as the drag began: they scale by the same
+        /// ratio about their own anchor points, as in After Effects (#491).
+        others: Vec<(LayerId, [f64; 3])>,
+    },
+    Rotate {
+        layer: LayerId,
+        /// The anchor where it shows, in comp pixels, not screen points, so zooming mid-drag
+        /// doesn't turn it.
+        pivot: [f64; 2],
+        /// −1 when the layer's value runs opposite to the pointer (see `rotation_sign`).
+        sign: f64,
+        /// The pointer's angle about the pivot on the last frame (degrees, as atan2 gives it).
+        last_angle: f64,
+        /// The turn so far, summed frame by frame so it keeps counting past a full revolution in
+        /// either direction (After Effects: 1x +0.0°, −1x −90.0°…) instead of wrapping at ±180°.
+        turned: f64,
+        start_rot: f64,
+        /// The other selected layers, their rotations and turn direction relative to this layer
+        /// (−1 when one parent is flipped): they turn by the same angle on screen.
+        others: Vec<(LayerId, f64, f64)>,
+    },
+    Anchor {
+        layer: LayerId,
+        start_anchor: [f64; 3],
+        start_pos: [f64; 3],
+        start: [f64; 2],
+        inv: Mat3,
+        l2p: Mat3,
+        /// The layer's own snap targets as the drag began (its box and path vertices).
+        own: Vec<effectcraft_engine::viewer::SnapTarget>,
+        /// Alt held as the drag began: the anchor point moves alone, so the layer shifts.
+        anchor_only: bool,
+    },
+    Pan {
+        start_pan: [f32; 2],
+    },
+    Create {
+        tool: Tool,
+        start: [f64; 2],
+    },
+    Marquee {
+        start: Pos2,
+    },
+    /// Dragging selected mask / shape path vertices: press point, the grabbed vertex (comp px,
+    /// it snaps), the comp-space move applied so far and comp → path space.
+    Vertices {
+        start: [f64; 2],
+        src: [f64; 2],
+        applied: [f64; 2],
+        inv: Mat3,
+        layer: LayerId,
+    },
+    /// Dragging a vertex's Bezier tangent (both sides symmetric unless Alt breaks them).
+    Tangent {
+        layer: LayerId,
+        mask: u64,
+        index: usize,
+        out: bool,
+        vertex: [f64; 2],
+        inv: Mat3,
+    },
+    /// Dragging a Puppet pin (comp → layer matrix inverse).
+    PuppetPin {
+        layer: LayerId,
+        pin: u64,
+        inv: Mat3,
+    },
+    /// Rotating an Advanced / Bend pin by its ring: the pin's screen centre, the pointer's last
+    /// angle (radians) and the rotation so far (°, accumulated so it can pass a full turn).
+    PuppetRotate {
+        layer: LayerId,
+        pin: u64,
+        center: Pos2,
+        last: f32,
+        rotation: f64,
+    },
+    /// Scaling an Advanced / Bend pin by its square: the pin's screen centre, the press distance
+    /// from it and the scale at the press (1 = 100 %).
+    PuppetScale {
+        layer: LayerId,
+        pin: u64,
+        center: Pos2,
+        start: f32,
+        scale: f64,
+    },
+    /// Puppet tools: a marquee selecting pins (dragged outside the layer's art, or Alt-dragged).
+    PinMarquee {
+        start: Pos2,
+    },
+    /// Object Matte tool: a box around the object (screen point where the drag began).
+    ObjectMatteBox {
+        start: Pos2,
+    },
+    /// Puppet tool Record mode (⌘/Ctrl-drag a pin): the drag is sampled in real time (seconds
+    /// since it began, effect space) and becomes keyframes on release (`puppet.recordPin`); the
+    /// current time runs along while recording.
+    PuppetRecord {
+        layer: LayerId,
+        pin: u64,
+        /// Other selected pins of the layer, moving with the dragged one.
+        others: Vec<u64>,
+        inv: Mat3,
+        began: f64,
+        cti: Tick,
+        samples: Vec<(f64, [f64; 2])>,
+    },
+    /// Pen tool: pulling the tangents of the vertex just placed.
+    Pen {
+        layer: LayerId,
+        mask: u64,
+        index: usize,
+        vertex: [f64; 2],
+        inv: Mat3,
+        press: Pos2,
+    },
+    /// Dragging a track point's feature/search region, a corner or its attach point.
+    Track {
+        layer: LayerId,
+        tracker: u64,
+        drag: crate::panels::tracker::Drag,
+    },
+    /// Motion paths, free transform, Mask Feather, guides and the region of interest
+    /// (`viewer_overlays`).
+    Overlay(ov::Drag),
+}
+
+/// Pen tool path in progress: (layer, mask uid).
+pub(super) fn pen_id() -> egui::Id {
+    egui::Id::unique("viewer-pen")
+}
+
+pub(super) const HANDLE: f32 = 7.0;
+
+/// How close (screen points) the pointer must be to a path vertex or tangent handle to grab it.
+const VERTEX_GRAB: f32 = 6.0;
+
+/// The reach of a path vertex at `pos` (#1042): a vertex marker sitting under, or just beside, a
+/// bounding-box handle would lose the press to the handle (the handle reaches further than the
+/// vertex), so wherever a box handle is in range the vertex reaches as far as the handle does.
+/// Vertices then win in the handle's whole zone, as in After Effects.
+pub(super) fn vertex_grab_radius(pos: Pos2, handles: impl IntoIterator<Item = Pos2>) -> f32 {
+    if handles.into_iter().any(|h| h.distance(pos) < HANDLE + 2.0) { HANDLE + 2.0 } else { VERTEX_GRAB }
+}
+
+/// Shown when a Roto Brush tool is used in the Composition panel (#753).
+pub(super) const ROTO_HINT: &str = "The Roto Brush works in the Layer panel. Double-click the layer to open it.";
+
+/// Region of interest handles on screen: corners (0–3, clockwise from top-left) then edge
+/// midpoints (4 top, 5 right, 6 bottom, 7 left).
+pub(super) fn roi_handles(r: Rect) -> [Pos2; 8] {
+    [r.left_top(), r.right_top(), r.right_bottom(), r.left_bottom(), r.center_top(), r.right_center(), r.center_bottom(), r.left_center()]
+}
+
+/// A drag starting on a region of interest handle: the ROI redrawn from the opposite corner (or
+/// edge, with the other axis kept).
+pub(super) fn roi_drag(app: &EffectcraftApp, map: &ViewerMap, comp_rect: Rect, zoom: f32, press: Pos2) -> Option<ov::Drag> {
+    let [rx, ry, rw, rh] = app.session.state.region_of_interest?;
+    let r = Rect::from_min_size(comp_rect.min + vec2(rx as f32 * zoom, ry as f32 * zoom), vec2(rw as f32 * zoom, rh as f32 * zoom));
+    let i = roi_handles(r).iter().position(|h| h.distance(press) < 6.0)?;
+    let (x0, y0, x1, y1) = (rx, ry, rx + rw, ry + rh);
+    let _ = map;
+    Some(match i {
+        0 => ov::Drag::Roi { start: [x1, y1], keep: [None, None] },
+        1 => ov::Drag::Roi { start: [x0, y1], keep: [None, None] },
+        2 => ov::Drag::Roi { start: [x0, y0], keep: [None, None] },
+        3 => ov::Drag::Roi { start: [x1, y0], keep: [None, None] },
+        4 => ov::Drag::Roi { start: [x1, y1], keep: [Some(x0), None] },
+        5 => ov::Drag::Roi { start: [x0, y0], keep: [None, Some(y1)] },
+        6 => ov::Drag::Roi { start: [x0, y0], keep: [Some(x1), None] },
+        _ => ov::Drag::Roi { start: [x1, y0], keep: [None, Some(y1)] },
+    })
+}
diff --git a/crates/ui-egui/src/panels/viewer/shapes.rs b/crates/ui-egui/src/panels/viewer/shapes.rs
new file mode 100644
index 000000000..76892cbaf
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/shapes.rs
@@ -0,0 +1,240 @@
+use super::geometry::{l2c, layer_quad, point_in_quad};
+use super::{
+    Color32, Comp, EffectcraftApp, EvalCtx, Layer, LayerId, LayerSource, Mat3, PaintKind, Pos2, Rect, Stroke, Tick, Tokens, Tool, ViewerMap, gv2, json, ov,
+    pos2,
+};
+
+/// Visible layers eligible for viewer hit tests, locked or not, in front-to-back order.
+/// Solo scope matches the renderer: any soloed AV layer activates it at every time (as in After
+/// Effects), even when hidden, locked or outside its in-out range.
+fn hit_testable_layers(comp: &Comp, time: Tick) -> impl Iterator<Item = &Layer> {
+    let any_solo = comp.layers.iter().any(|l| l.switches.solo && l.source.is_av());
+    comp.layers.iter().filter(move |l| l.is_active_at(time) && l.switches.video && !l.is_camera() && !l.is_light() && (!any_solo || l.switches.solo))
+}
+
+/// Visible, unlocked layers eligible for viewer hit tests, in front-to-back order.
+pub(crate) fn selectable_layers(comp: &Comp, time: Tick) -> impl Iterator<Item = &Layer> {
+    hit_testable_layers(comp, time).filter(|l| !l.switches.locked)
+}
+
+/// Selectable layers under a comp point, front to back.
+pub(crate) fn layers_at<'a, 'b>(ectx: &'b EvalCtx<'a>, cpt: [f64; 2]) -> impl Iterator<Item = &'a Layer> + 'b {
+    selectable_layers(ectx.comp, ectx.time).filter(move |l| layer_quad(ectx, l).is_some_and(|(_, q, _)| point_in_quad(cpt, &q)))
+}
+
+/// Topmost selectable layer under a comp point.
+pub(crate) fn layer_at<'a>(ectx: &EvalCtx<'a>, cpt: [f64; 2]) -> Option<&'a Layer> {
+    layers_at(ectx, cpt).next()
+}
+
+/// Topmost visible layer under a comp point, locked or not. An Alt-drop uses it so a locked layer in
+/// front is refused rather than skipped, which would replace the layer behind it.
+pub(crate) fn layer_at_including_locked<'a>(ectx: &EvalCtx<'a>, cpt: [f64; 2]) -> Option<&'a Layer> {
+    // A layer scaled to nothing has a degenerate quad that `point_in_quad` accepts everywhere.
+    hit_testable_layers(ectx.comp, ectx.time).find(|l| layer_quad(ectx, l).is_some_and(|(_, q, _)| quad_area(&q) > 1e-9 && point_in_quad(cpt, &q)))
+}
+
+/// Area of a quad (shoelace formula); zero when its corners coincide or are collinear.
+fn quad_area(q: &[[f64; 2]; 4]) -> f64 {
+    (0..4).map(|i| q[i][0] * q[(i + 1) % 4][1] - q[(i + 1) % 4][0] * q[i][1]).sum::<f64>().abs() / 2.0
+}
+
+/// The layer a press at a comp point acts on, selected (Shift toggles the topmost layer). As in
+/// After Effects, a selected layer under the point comes before the layers in front of it, so it
+/// can be dragged where they cover it; otherwise the topmost layer (#230).
+pub(crate) fn pick(app: &mut EffectcraftApp, ectx: &EvalCtx, cpt: [f64; 2], toggle: bool) -> Option<LayerId> {
+    if toggle {
+        let hit = layer_at(ectx, cpt)?.id;
+        let _ = app.session.execute("layer.select", json!({"layers": [hit.0], "toggle": true}));
+        return Some(hit);
+    }
+    let selected = &app.session.state.selected_layers;
+    let hits: Vec<LayerId> = layers_at(ectx, cpt).map(|l| l.id).collect();
+    let hit = *hits.iter().find(|id| selected.contains(id)).or(hits.first())?;
+    if !selected.contains(&hit) {
+        let _ = app.session.execute("layer.select", json!({"layers": [hit.0]}));
+    }
+    Some(hit)
+}
+
+/// Where a shape drag is going to land: a mask on the selected layer, a group inside it, or a new
+/// shape layer.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum ShapeTarget {
+    Mask,
+    IntoLayer,
+    NewLayer,
+}
+
+impl ShapeTarget {
+    /// What the drag will make and where, named the way the ghost captions it.
+    fn label(self, layer_name: &str) -> String {
+        match self {
+            ShapeTarget::Mask => format!("Mask on “{layer_name}”"),
+            ShapeTarget::IntoLayer => format!("Into “{layer_name}”"),
+            ShapeTarget::NewLayer => "New shape layer".to_string(),
+        }
+    }
+}
+
+/// A shape drag as it stands, after the Tools' normalisations: the path it will make and where it
+/// will land.
+pub(super) struct ShapeDrag {
+    /// The `shape.newShape` / `layer.addMask` kind for the tool.
+    kind: &'static str,
+    /// Comp-space centre and size, what the drag will make.
+    centre: [f64; 2],
+    size: [f64; 2],
+    target: ShapeTarget,
+    /// The selected layer's name and the index its next mask would take, for the ghost's caption
+    /// and colour.
+    layer_name: String,
+    mask_index: usize,
+}
+
+/// The kind `tool` draws, as `shape.newShape` / `layer.addMask` name it.
+fn shape_kind(tool: Tool) -> &'static str {
+    match tool {
+        Tool::Rectangle => "rect",
+        Tool::RoundedRect => "rounded",
+        Tool::Ellipse => "ellipse",
+        Tool::Polygon => "polygon",
+        _ => "star",
+    }
+}
+
+/// What a shape tool drag from `start` to `end` makes, or `None` while it is too small to make
+/// anything. Alt (Option) draws from the press point and Shift squares the box; the live ghost and
+/// [`create_shape`] both go through this, so the drag always shows what it will commit.
+pub(super) fn shape_drag(app: &EffectcraftApp, tool: Tool, start: [f64; 2], end: [f64; 2], mods: egui::Modifiers) -> Option<ShapeDrag> {
+    let comp = app.session.active_comp()?;
+    let selected = app.session.state.selected_layers.first().copied();
+    let sel = selected.and_then(|id| comp.layer(id));
+    // A footage, solid or other non-shape layer selected, or a shape layer with Tool Creates
+    // Mask: a mask on that layer. Otherwise the engine's own target: the first selected unlocked
+    // shape layer, else a new one.
+    let target = match sel {
+        Some(l) if l.source.is_av() && (app.session.state.shape_tool.creates_mask || !matches!(l.source, LayerSource::Shape)) => (ShapeTarget::Mask, Some(l)),
+        _ => match effectcraft_engine::commands::shape_tool::selected_shape_target(&app.session, comp).and_then(|id| comp.layer(id)) {
+            Some(l) => (ShapeTarget::IntoLayer, Some(l)),
+            None => (ShapeTarget::NewLayer, None),
+        },
+    };
+    let (target, layer) = target;
+    let mask_index = if target == ShapeTarget::Mask { layer.and_then(|l| l.masks()).map_or(0, |m| m.groups().count()) } else { 0 };
+    let (mut w, mut h) = ((end[0] - start[0]).abs(), (end[1] - start[1]).abs());
+    // Ctrl/Cmd draws from the press point as the centre, as in After Effects.
+    if mods.command {
+        w *= 2.0;
+        h *= 2.0;
+    }
+    if w < 2.0 && h < 2.0 {
+        return None;
+    }
+    if mods.shift {
+        let m = w.max(h);
+        w = m;
+        h = m;
+    }
+    Some(ShapeDrag {
+        kind: shape_kind(tool),
+        centre: if mods.command { start } else { [start[0].min(end[0]) + w / 2.0, start[1].min(end[1]) + h / 2.0] },
+        size: [w, h],
+        target,
+        layer_name: layer.map_or_else(String::new, |l| l.name.clone()),
+        mask_index,
+    })
+}
+
+/// The Tools bar's paint colour as bytes, dimmed by `alpha` so the comp shows through the ghost.
+fn paint_rgb(c: [f32; 3], opacity: f64, alpha: f32) -> Color32 {
+    let f = |k: f32| (k.clamp(0.0, 1.0) * 255.0).round() as u8;
+    Color32::from_rgb(f(c[0]), f(c[1]), f(c[2])).gamma_multiply((opacity.clamp(0.0, 100.0) / 100.0) as f32 * alpha)
+}
+
+/// Draw a shape drag as it will land: the tool's own path, filled with the Tools bar's Fill and
+/// outlined in its Stroke (or the mask colour, for a mask), captioned with where it goes.
+pub(super) fn draw_shape_ghost(painter: &egui::Painter, map: &ViewerMap, app: &EffectcraftApp, d: &ShapeDrag, t: &Tokens) {
+    // The engine's own geometry for the kind, so the ghost is the shape and not a stand-in for it.
+    let Some(sp) = effectcraft_engine::commands::shape_tool::mask_path(d.kind, d.centre, d.size) else { return };
+    let mut pts = ov::flatten(&sp, &Mat3::IDENTITY, map);
+    if pts.first() == pts.last() {
+        pts.pop();
+    }
+    if pts.len() < 3 {
+        return;
+    }
+    let tool = &app.session.state.shape_tool;
+    let (fill, line) = match d.target {
+        ShapeTarget::Mask => {
+            let [r, g, b] = effectcraft_engine::prefs::mask_color(app.session.prefs.appearance.cycle_mask_colors, d.mask_index);
+            (Color32::from_rgb(r, g, b).gamma_multiply(0.25), Color32::from_rgb(r, g, b))
+        }
+        _ => {
+            let stroke_on = tool.stroke.kind != PaintKind::None && tool.stroke_width > 0.0;
+            (
+                if tool.fill.kind == PaintKind::None { Color32::TRANSPARENT } else { paint_rgb(tool.fill.color, tool.fill.opacity, 0.45) },
+                if stroke_on { paint_rgb(tool.stroke.color, tool.stroke.opacity, 1.0) } else { t.accent },
+            )
+        }
+    };
+    let Some(bounds) = bounds_of(&pts) else { return };
+    // A screen-width outline reads at every zoom, where a comp-pixel hairline does not.
+    painter.add(egui::Shape::Path(egui::epaint::PathShape { points: pts, closed: true, fill, stroke: Stroke::new(1.5, line).into() }));
+    // Caption it with where the shape lands: a mask, a group in the selected shape layer or a
+    // new layer.
+    let font = Tokens::ui(11.0);
+    let galley = painter.layout_no_wrap(d.target.label(&d.layer_name), font, line);
+    let caption = Rect::from_min_size(pos2(bounds.left(), bounds.top() - 5.0 - galley.size().y), galley.size());
+    painter.rect_filled(caption.expand(3.0), 2.0, Color32::from_black_alpha(150));
+    painter.galley(caption.min, galley, line);
+}
+
+/// The bounds of points on screen, or `None` for an empty set.
+fn bounds_of(pts: &[Pos2]) -> Option<Rect> {
+    let first = *pts.first()?;
+    let mut r = Rect::from_min_max(first, first);
+    for p in pts.iter().skip(1) {
+        r.extend_with(*p);
+    }
+    Some(r)
+}
+
+/// Creates the shape for a drag from `a` to `b` with the given tool, as a mask or as a shape layer.
+pub(super) fn create_shape(app: &mut EffectcraftApp, tool: Tool, a: [f64; 2], b: [f64; 2], mods: egui::Modifiers) {
+    let Some(d) = shape_drag(app, tool, a, b, mods) else { return };
+    let (kind, (w, h), (cx, cy)) = (d.kind, (d.size[0], d.size[1]), (d.centre[0], d.centre[1]));
+    // A mask on the selected layer, as the ghost showed.
+    if d.target == ShapeTarget::Mask {
+        // In layer space: invert the layer transform.
+        let sel_layer = app.session.state.selected_layers.first().copied().and_then(|id| app.session.active_comp().and_then(|c| c.layer(id)).cloned());
+        if let Some(l) = sel_layer
+            && let Some(comp) = app.session.active_comp_arc()
+        {
+            let ectx = EvalCtx {
+                project: &app.session.project,
+                comp_id: app.session.active_comp_id().unwrap_or_default(),
+                comp: &comp,
+                time: app.session.time(),
+                expr: None,
+                footage: None,
+                property_overrides: &[],
+                media_overrides: &[],
+                reads: None,
+            };
+            let inv = l2c(&ectx, &l).0.inverse().unwrap_or(Mat3::IDENTITY);
+            let p0 = inv.apply(gv2(cx - w / 2.0, cy - h / 2.0));
+            let p1 = inv.apply(gv2(cx + w / 2.0, cy + h / 2.0));
+            let rect = [p0.x.min(p1.x), p0.y.min(p1.y), (p1.x - p0.x).abs(), (p1.y - p0.y).abs()];
+            if let Err(e) = app.session.execute("layer.addMask", json!({"layer": l.id.0, "shape": kind, "rect": rect})) {
+                app.ui.status = e.to_string();
+            }
+        }
+        return;
+    }
+    // Into the selected shape layer's Contents as a new group (as in After Effects), else a new
+    // shape layer; painted with the Tools bar's Fill and Stroke.
+    if let Err(e) = app.session.execute("shape.newShape", json!({"kind": kind, "size": [w, h], "position": [cx, cy]})) {
+        app.ui.status = e.to_string();
+    }
+}
diff --git a/crates/ui-egui/src/panels/viewer/tests.rs b/crates/ui-egui/src/panels/viewer/tests.rs
new file mode 100644
index 000000000..066df8c3f
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/tests.rs
@@ -0,0 +1,199 @@
+use super::*;
+use effectcraft_engine::geom::{Mat4, vec3};
+
+/// #1544: Shift-clicking with the Pen keeps the new segment horizontal, vertical or diagonal.
+#[test]
+fn pen_shift_click_keeps_the_segment_at_45_degrees() {
+    let near = |a: [f64; 2], b: [f64; 2]| (a[0] - b[0]).abs() < 1e-9 && (a[1] - b[1]).abs() < 1e-9;
+    let from = [100.0, 100.0];
+    assert!(near(constrain_45(from, [104.0, 180.0]), [100.0, 180.0]), "straight down");
+    assert!(near(constrain_45(from, [30.0, 97.0]), [30.0, 100.0]), "left");
+    assert!(near(constrain_45(from, [150.0, 46.0]), [152.0, 48.0]), "up and right, on the diagonal");
+    assert!(near(constrain_45(from, from), from), "on the vertex");
+    assert!(constrain_45(from, [f64::NAN, 3.0])[0].is_nan(), "a non-finite point stays as it is");
+}
+
+/// The Rotation tool counts past a full turn in both directions, as in After Effects: the
+/// pointer going round the anchor 1.5 turns clockwise gives 540°, then back 2 turns gives
+/// −180°, with no jump where atan2 wraps from 180° to −180°.
+#[test]
+fn rotate_tool_accumulates_revolutions() {
+    // Screen y points down, so a growing atan2 angle is clockwise on screen.
+    let drag = |start: f64, steps: &[f64]| {
+        let (mut last, mut turned, mut out) = (start, 0.0, vec![]);
+        for &a in steps {
+            // atan2's range: (−180°, 180°].
+            let a = (a + 180.0).rem_euclid(360.0) - 180.0;
+            turned += turn_delta(last, a);
+            last = a;
+            out.push(turned);
+        }
+        (last, turned, out)
+    };
+    let cw: Vec<f64> = (1..=54).map(|i| i as f64 * 10.0).collect();
+    let (last, turned, seq) = drag(0.0, &cw);
+    assert!((turned - 540.0).abs() < 1e-9, "{turned}");
+    assert!(seq.windows(2).all(|w| (w[1] - w[0] - 10.0).abs() < 1e-9), "no jump: {seq:?}");
+    assert!((rotate_value(0.0, turned, false) - 540.0).abs() < 1e-9);
+    let ccw: Vec<f64> = (1..=72).map(|i| 540.0 - i as f64 * 10.0).collect();
+    let (_, back, seq) = drag(last, &ccw);
+    assert!(seq.windows(2).all(|w| (w[1] - w[0] + 10.0).abs() < 1e-9), "no jump: {seq:?}");
+    let total = turned + back;
+    assert!((total + 180.0).abs() < 1e-9, "{total}");
+    assert!((rotate_value(30.0, total, false) + 150.0).abs() < 1e-9);
+    // Shift snaps the accumulated value, not a wrapped one.
+    assert_eq!(rotate_value(0.0, 400.0, true), 405.0);
+    assert_eq!(rotate_value(0.0, -400.0, true), -405.0);
+    // Across the seam: 170° → −170° is +20°, and back is −20°; exactly half a turn is +180°.
+    assert!((turn_delta(170.0, -170.0) - 20.0).abs() < 1e-9);
+    assert!((turn_delta(-170.0, 170.0) + 20.0).abs() < 1e-9);
+    assert_eq!(turn_delta(0.0, 180.0), 180.0);
+    assert_eq!(turn_delta(0.0, -180.0), 180.0);
+    // Never crash or poison the value on non-finite input.
+    assert_eq!(turn_delta(f64::NAN, 10.0), 0.0);
+    assert_eq!(turn_delta(0.0, f64::INFINITY), 0.0);
+    assert_eq!(rotate_value(15.0, f64::NAN, false), 15.0);
+}
+
+/// #1042: a path vertex lying under, or just beside, a bounding-box handle is grabbed
+/// instead of the handle; away from every handle the reach is unchanged.
+#[test]
+fn vertex_reaches_as_far_as_a_box_handle_over_it() {
+    let handle = pos2(100.0, 100.0);
+    let vertex = pos2(100.0, 100.0);
+    // The press lands 8 points off the vertex, still on the handle's square.
+    let press = pos2(108.0, 100.0);
+    let pick = |p: Pos2, handles: &[Pos2]| vertex.distance(p) < vertex_grab_radius(p, handles.iter().copied());
+    assert!(handle.distance(press) < HANDLE + 2.0, "the handle would take this press");
+    assert!(pick(press, &[handle]), "the vertex wins over the handle");
+    assert!(!pick(press, &[]), "no handle there: the usual reach");
+    assert!(pick(pos2(105.0, 100.0), &[]));
+    assert!(!pick(pos2(120.0, 100.0), &[handle]), "past the handle: nothing");
+}
+
+/// #882: the frame's corner sits on a physical pixel at any display scaling, so 100 % maps
+/// comp pixels 1:1 onto screen pixels.
+#[test]
+fn frame_origin_snaps_to_physical_pixels() {
+    for ppp in [1.0f32, 1.25, 1.5, 1.75, 2.0] {
+        for p in [pos2(-201.12, 72.4), pos2(689.8, 239.75), pos2(0.3, -0.37)] {
+            let s = snap_to_pixels(p, ppp);
+            for v in [s.x * ppp, s.y * ppp] {
+                assert!((v - v.round()).abs() < 1e-3, "ppp {ppp}: {p:?} → {s:?}");
+            }
+            assert!((s - p).length() <= 0.71 / ppp, "moved by at most half a pixel: {p:?} → {s:?}");
+        }
+    }
+    assert_eq!(snap_to_pixels(pos2(1.3, 2.0), 0.0), pos2(1.3, 2.0));
+}
+
+/// #882: a magnified frame shows its pixels as blocks in both Zoom Quality modes; More
+/// Accurate only smooths when the frame is shown smaller.
+#[test]
+fn magnified_frames_are_never_smoothed() {
+    use eframe::wgpu::FilterMode;
+    for smooth in [true, false] {
+        assert_eq!(zoom_texture_options(smooth).magnification, egui::TextureFilter::Nearest);
+        assert_eq!(zoom_sampler(smooth).mag_filter, FilterMode::Nearest);
+    }
+    assert_eq!(zoom_texture_options(true).minification, egui::TextureFilter::Linear);
+    assert_eq!(zoom_sampler(true).min_filter, FilterMode::Linear);
+}
+
+/// A perspective-like homography: w = 100 + y (the plane crosses the camera at y = −100).
+fn tilted() -> Mat3 {
+    Mat3([[100.0, 0.0, 0.0], [0.0, 100.0, 0.0], [0.0, 1.0, 100.0]])
+}
+
+/// #572: a box reaching behind the camera is clipped at the near plane instead of flipping
+/// through infinity into long lines.
+#[test]
+fn outlines_clip_at_the_near_plane() {
+    let m = tilted();
+    let front = project_clipped(&m, &box_corners([-50.0, -50.0, 50.0, 50.0]));
+    assert_eq!(front.len(), 4);
+    let crossing = project_clipped(&m, &box_corners([-50.0, -150.0, 50.0, 50.0]));
+    assert_eq!(crossing.len(), 4, "{crossing:?}");
+    // Nothing flipped through infinity: a corner behind the camera (y = −150, w = −50) would
+    // land at y = +300 if it were projected as is; clipped at the near plane it runs off far
+    // above (negative y) instead, and the front corners stay where they were.
+    assert!(crossing.iter().all(|p| p[0].is_finite() && p[1].is_finite() && p[1] < 34.0), "{crossing:?}");
+    assert!(project_clipped(&m, &box_corners([-50.0, -400.0, 50.0, -200.0])).is_empty(), "wholly behind");
+}
+
+#[test]
+fn axis_drag_follows_the_arrow_and_ignores_drag_across_it() {
+    let (ax, ay) = axis_drag([0.0, 0.0, 60.0], [24.0, -24.0]);
+    let at = |d: [f64; 2]| [0, 1, 2].map(|i| ax[i] * d[0] + ay[i] * d[1]);
+    assert_eq!(at([24.0, -24.0]), [0.0, 0.0, 60.0]);
+    assert_eq!(at([-12.0, 12.0]), [0.0, 0.0, -30.0]);
+    assert_eq!(at([10.0, 10.0]), [0.0, 0.0, 0.0]);
+}
+
+#[test]
+fn gizmo_segments_clip_at_the_near_plane() {
+    // w = 100 + z.
+    let pc = Mat4([[100.0, 0.0, 0.0, 0.0], [0.0, 100.0, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0], [0.0, 0.0, 1.0, 100.0]]);
+    let s = project_segment(&pc, vec3(10.0, 0.0, 0.0), vec3(10.0, 0.0, -300.0)).unwrap();
+    assert_eq!(s[0], [10.0, 0.0]);
+    assert!(s[1][0] > 10.0 && s[1][0].is_finite(), "toward the camera it grows, never flips: {s:?}");
+    assert!(project_segment(&pc, vec3(0.0, 0.0, -200.0), vec3(0.0, 0.0, -300.0)).is_none());
+}
+
+/// A 640×360 comp whose Box (anchor 40,40) is a child of Parent (anchor 50,50) at (100, 60).
+fn parented_session(parent: serde_json::Value) -> (effectcraft_engine::Session, u64) {
+    let mut s = effectcraft_engine::Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 640, "height": 360, "duration": 1})).unwrap();
+    let id = |v: serde_json::Value| v["layer"].as_u64().unwrap();
+    let p = id(s.execute("layer.newSolid", json!({"name": "Parent", "color": "#000000", "width": 100, "height": 100})).unwrap());
+    let c = id(s.execute("layer.newSolid", json!({"name": "Box", "color": "#000000", "width": 80, "height": 80})).unwrap());
+    for (path, value) in parent.as_object().unwrap() {
+        s.execute("prop.set", json!({"layer": p, "path": format!("transform/{path}"), "value": value})).unwrap();
+    }
+    s.execute("layer.setParent", json!({"layers": [c], "parent": p, "compensate": false})).unwrap();
+    s.execute("prop.set", json!({"layer": c, "path": "transform/position", "value": [100.0, 60.0]})).unwrap();
+    (s, c)
+}
+
+fn with_ctx<T>(s: &effectcraft_engine::Session, f: impl FnOnce(&EvalCtx) -> T) -> T {
+    let comp = s.active_comp().unwrap();
+    f(&EvalCtx::new(&s.project, s.active_comp_id().unwrap(), comp, Tick::ZERO))
+}
+
+/// #2870: the pivot of a child follows its parent, through the camera for a 3D layer
+/// and none behind it.
+#[test]
+fn anchor_in_comp_follows_the_parent_and_the_camera() {
+    let (mut s, c) = parented_session(json!({"position": [400.0, 200.0]}));
+    with_ctx(&s, |ctx| assert_eq!(anchor_in_comp(ctx, ctx.comp.layer(LayerId(c)).unwrap()), Some([450.0, 210.0])));
+    s.execute("layer.setSwitch", json!({"layers": [c], "switch": "threeD", "value": true})).unwrap();
+    with_ctx(&s, |ctx| {
+        let a = anchor_in_comp(ctx, ctx.comp.layer(LayerId(c)).unwrap()).unwrap();
+        assert!((a[0] - 450.0).abs() < 1e-6 && (a[1] - 210.0).abs() < 1e-6, "{a:?}");
+    });
+    s.execute("prop.set", json!({"layer": c, "path": "transform/position", "value": [100.0, 60.0, -1e6]})).unwrap();
+    with_ctx(&s, |ctx| assert_eq!(anchor_in_comp(ctx, ctx.comp.layer(LayerId(c)).unwrap()), None));
+}
+
+/// #999: a vertex drag pans the view only near or past the edge, toward it, faster further out.
+#[test]
+fn edge_pan_speed_moves_toward_the_edge() {
+    let area = Rect::from_min_max(pos2(100.0, 50.0), pos2(900.0, 650.0));
+    assert_eq!(edge_pan_speed(area, pos2(500.0, 350.0)), egui::Vec2::ZERO);
+    let left = edge_pan_speed(area, pos2(105.0, 350.0));
+    assert!(left.x > 0.0 && left.y == 0.0, "near the left edge the view moves right to show more: {left:?}");
+    assert!(edge_pan_speed(area, pos2(20.0, 350.0)).x > left.x, "faster past the edge");
+    let corner = edge_pan_speed(area, pos2(950.0, 700.0));
+    assert!(corner.x < 0.0 && corner.y < 0.0, "{corner:?}");
+}
+
+/// Every 3D view names its own `view.3d.*` command: a typo in that mapping would fall back to the
+/// English label silently, which is what the viewer showed before (#2691).
+#[test]
+fn every_3d_view_finds_its_japanese_row() {
+    crate::i18n::ui::set_current("ja");
+    for v in View3D::ALL {
+        assert_ne!(view3d_label(v), v.label(), "{v:?} has no Japanese row");
+    }
+    crate::i18n::ui::set_current("en");
+}
diff --git a/crates/ui-egui/src/panels/viewer/tools.rs b/crates/ui-egui/src/panels/viewer/tools.rs
new file mode 100644
index 000000000..da4245e85
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/tools.rs
@@ -0,0 +1,302 @@
+use super::geometry::{cam_state, l2c, parent_inverse};
+use super::gesture::{Gesture, pen_id};
+use super::{CameraState, Color32, EffectcraftApp, EvalCtx, Layer, LayerId, Mat3, Pos2, Rect, Stroke, Tool, ViewerMap, gv2, json, ov, three_d, vec2, vt};
+
+/// The position change per comp pixel of drag (x, y) that moves a layer by `dir` when the
+/// pointer covers the axis' on-screen vector `s` (comp px); drag across the axis is ignored.
+pub(super) fn axis_drag(dir: [f64; 3], s: [f64; 2]) -> ([f64; 3], [f64; 3]) {
+    let n = (s[0] * s[0] + s[1] * s[1]).max(1e-12);
+    (dir.map(|v| v * s[0] / n), dir.map(|v| v * s[1] / n))
+}
+
+/// The gizmo arrow under screen point `p`.
+pub(super) fn axis_at(hits: &[(LayerId, [Pos2; 2], [f64; 3], [f64; 3])], p: Pos2) -> Option<(LayerId, [Pos2; 2], [f64; 3], [f64; 3])> {
+    let dist = |[a, b]: [Pos2; 2]| {
+        let ab = b - a;
+        let t = ((p - a).dot(ab) / ab.length_sq().max(1e-6)).clamp(0.0, 1.0);
+        p.distance(a + ab * t)
+    };
+    hits.iter().filter(|h| dist(h.1) < 6.0).min_by(|a, b| dist(a.1).total_cmp(&dist(b.1))).copied()
+}
+
+/// World to parent space for a 3D layer (identity without a parent).
+pub(super) fn parent_world_inverse(ctx: &EvalCtx, l: &Layer) -> effectcraft_engine::geom::Mat4 {
+    match l.parent.and_then(|p| ctx.comp.layer(p)) {
+        Some(p) => ctx.world_matrix(p).inverse().unwrap_or_default(),
+        None => effectcraft_engine::geom::Mat4::IDENTITY,
+    }
+}
+
+/// Parent-space position change per comp pixel of drag (x and y) for a layer: 2D layers map
+/// through the parent transform; 3D layers move in the view plane at their depth.
+pub(super) fn drag_axes(ctx: &EvalCtx, l: &Layer) -> ([f64; 3], [f64; 3]) {
+    if !l.is_3d() {
+        let inv = parent_inverse(ctx, l);
+        let a = inv.apply_vec(gv2(1.0, 0.0));
+        let b = inv.apply_vec(gv2(0.0, 1.0));
+        return ([a.x, a.y, 0.0], [b.x, b.y, 0.0]);
+    }
+    let cam = cam_state(ctx);
+    let anchor = l.transform().map(|tr| ctx.v3(l, tr, "anchor", [0.0; 3])).unwrap_or([0.0; 3]);
+    let wp = ctx.world_matrix(l).apply(anchor.into());
+    let k = if cam.ortho { 1.0 / cam.zoom.max(1e-9) } else { cam.depth(wp).max(1.0) / cam.zoom.max(1e-9) };
+    let pinv = parent_world_inverse(ctx, l);
+    let a = pinv.apply_vec(cam.right() * k);
+    let b = pinv.apply_vec(cam.down() * k);
+    ([a.x, a.y, a.z], [b.x, b.y, b.z])
+}
+
+/// Wireframes of cameras (frustum, point of interest) and lights (position, direction) as seen
+/// through the current 3D view.
+/// Camera and light wireframes seen through `cam` (`through_active`: `cam` is the active camera,
+/// which is then not drawn). `pane` names the automation ids: `None` for the main view
+/// (`viewer.camera.<id>`), `Some(view)` for a view of a 2- or 4-view layout
+/// (`viewer.view.<view>.camera.<id>`).
+#[allow(clippy::too_many_arguments)]
+pub(super) fn draw_rigs(
+    app: &mut EffectcraftApp,
+    painter: &egui::Painter,
+    map: &ViewerMap,
+    ectx: &EvalCtx,
+    selected: &[LayerId],
+    cam: CameraState,
+    through_active: bool,
+    pane: Option<&str>,
+) {
+    use effectcraft_engine::geom::Vec3;
+    use effectcraft_engine::project::{LayerSource, LightKind};
+    let (w, h) = (ectx.comp.width as f64, ectx.comp.height as f64);
+    let active = ectx.comp.active_camera(ectx.time).map(|c| c.id);
+    let prefix = pane.map(|v| format!("viewer.view.{v}.")).unwrap_or_else(|| "viewer.".to_string());
+    let proj = |p: Vec3| cam.project(w, h, p).map(|v| map.to_screen([v.x, v.y]));
+    let seg = |a: Vec3, b: Vec3, stroke: Stroke| {
+        if let (Some(x), Some(y)) = (proj(a), proj(b)) {
+            painter.line_segment([x, y], stroke);
+        }
+    };
+    for l in ectx.comp.layers.iter().filter(|l| (l.is_camera() || l.is_light()) && l.is_active_at(ectx.time)) {
+        let sel = selected.contains(&l.id);
+        let col = app.tokens.label(l.label).gamma_multiply(if sel { 1.0 } else { 0.6 });
+        let stroke = Stroke::new(if sel { 1.5 } else { 1.0 }, col);
+        let (eye, fwd, down) = three_d::camera::layer_frame(ectx, l);
+        let poi = |l: &Layer| -> Option<Vec3> {
+            let pr = l.transform()?.get("poi").filter(|_| three_d::camera::is_two_node(l))?;
+            Some(three_d::camera::parent_world(ectx, l).apply(ectx.value(l, pr).as_vec3().into()))
+        };
+        if l.is_camera() {
+            if through_active && Some(l.id) == active {
+                continue;
+            }
+            let zoom = l.props.prop("cameraOptions/zoom").map(|p| ectx.value(l, p).as_f64()).unwrap_or(1000.0);
+            let right = down.cross(fwd);
+            // Frustum to a plane at a quarter of the zoom distance.
+            let k = 0.25;
+            let c = eye + fwd * (zoom * k);
+            let corners = [(-1.0, -1.0), (1.0, -1.0), (1.0, 1.0), (-1.0, 1.0)].map(|(sx, sy)| c + right * (sx * w * 0.5 * k) + down * (sy * h * 0.5 * k));
+            for i in 0..4 {
+                seg(eye, corners[i], stroke);
+                seg(corners[i], corners[(i + 1) % 4], stroke);
+            }
+            if let Some(poi) = poi(l) {
+                seg(eye, poi, Stroke::new(1.0, col.gamma_multiply(0.6)));
+                if let Some(s) = proj(poi) {
+                    painter.circle_stroke(s, 4.0, stroke);
+                }
+            }
+            if let Some(s) = proj(eye) {
+                app.auto.add(&format!("{prefix}camera.{}", l.id.0), Rect::from_center_size(s, vec2(14.0, 14.0)), &l.name);
+            }
+        } else {
+            let LayerSource::Light { kind } = l.source else { continue };
+            if kind == LightKind::Ambient {
+                continue;
+            }
+            let Some(s) = proj(eye) else { continue };
+            painter.circle_stroke(s, 6.0, stroke);
+            for i in 0..8 {
+                let a = i as f32 * std::f32::consts::FRAC_PI_4;
+                let d = vec2(a.cos(), a.sin());
+                painter.line_segment([s + d * 8.0, s + d * 12.0], stroke);
+            }
+            if matches!(kind, LightKind::Spot | LightKind::Parallel) {
+                let target = poi(l).unwrap_or(eye + fwd * 300.0);
+                seg(eye, target, Stroke::new(1.0, col.gamma_multiply(0.7)));
+                if let Some(q) = proj(target) {
+                    painter.circle_stroke(q, 3.0, stroke);
+                }
+            }
+            app.auto.add(&format!("{prefix}light.{}", l.id.0), Rect::from_center_size(s, vec2(16.0, 16.0)), &l.name);
+        }
+    }
+}
+
+/// Pen tool press at `pos`: continue the path in progress (pressing its first vertex closes it),
+/// resume an open path whose last vertex is pressed, add a vertex on a visible path's segment, or
+/// start a new path: a mask on the selected footage/solid layer (or shape layer, with Tool Creates
+/// Mask), a shape path (Shape n group with the Tools bar's Fill and Stroke) on the selected shape
+/// layer, or a new shape layer when nothing is selected. The placed point snaps.
+/// Add a Position keyframe at a motion path's frame, keeping the path where it is.
+pub(super) fn add_motion_key(app: &mut EffectcraftApp, f: ov::PathFrame) {
+    // Separated dimensions: the key goes on X and Y Position.
+    for prop in f.axes.map_or_else(|| vec![f.prop], Vec::from) {
+        if let Err(e) = app.session.execute("prop.addKey", json!({"layer": f.layer.0, "prop": prop, "time": f.time.seconds()})) {
+            app.ui.status = e.to_string();
+        }
+    }
+}
+
+/// Select only the motion path's keyframe `k` (what the vertex tools act on; with separated
+/// dimensions, the X and Y Position keys at its time).
+pub(super) fn select_motion_key(app: &mut EffectcraftApp, k: &ov::KeyHit) -> bool {
+    app.session.execute("keys.select", json!({"keys": k.select_entries()})).is_ok()
+}
+
+/// The pointer for a Pen slot tool: the tool's own pen, the Pen showing Add Vertex's over a path
+/// it would add a point to (After Effects).
+pub(super) fn pen_cursor_icon(tool: Tool, over_path: bool) -> crate::icons::Icon {
+    use crate::icons::Icon;
+    match tool {
+        Tool::Pen if over_path => Icon::PenAdd,
+        Tool::PenAdd => Icon::PenAdd,
+        Tool::PenDelete => Icon::PenDelete,
+        Tool::PenConvert => Icon::PenConvert,
+        Tool::MaskFeather => Icon::MaskFeather,
+        _ => Icon::Pen,
+    }
+}
+
+/// Paint pen pointer `icon` with its tip at `at`, outlined for any background.
+pub(super) fn pen_cursor(ctx: &egui::Context, at: Pos2, icon: crate::icons::Icon) {
+    use crate::icons::Icon;
+    // Where each glyph's tip sits in its 16 × 16 box.
+    let tip = match icon {
+        Icon::PenAdd | Icon::PenDelete | Icon::MaskFeather => vec2(6.0, 2.5),
+        Icon::PenConvert => vec2(8.0, 3.5),
+        _ => vec2(8.0, 1.8),
+    };
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("viewer-pen-cursor")));
+    let rect = Rect::from_min_size(at - tip, vec2(16.0, 16.0));
+    for d in [vec2(-1.0, 0.0), vec2(1.0, 0.0), vec2(0.0, -1.0), vec2(0.0, 1.0)] {
+        crate::icons::paint(&painter, rect.translate(d), icon, Color32::BLACK);
+    }
+    crate::icons::paint(&painter, rect, icon, Color32::WHITE);
+}
+
+/// Handle a Pen-tool press at `pos`: close the current path when its first vertex is hit; otherwise append a snapped
+/// (Shift: 45-degree) vertex, resume an open path's end, add a motion-path keyframe, insert a vertex on a visible
+/// path segment, or start a new mask/shape path on the selected layer or a new shape layer. Records the resulting
+/// path id and tangent gesture in context data for the drag that follows.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn pen_press(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    ectx: &EvalCtx,
+    map: &ViewerMap,
+    paths: &[ov::PathInfo],
+    motion_frame: Option<ov::PathFrame>,
+    pos: Pos2,
+    mods: egui::Modifiers,
+) {
+    use effectcraft_engine::project::LayerSource;
+    let gid = egui::Id::unique("viewer-gesture");
+    let current: Option<(LayerId, u64)> = ui.data(|d| d.get_temp(pen_id()));
+    let c0 = map.to_comp(pos);
+    let corr = vt::snap(app, ui.ctx(), ectx, map, &[], &[c0], mods);
+    let c = [c0[0] + corr[0], c0[1] + corr[1]];
+    if let Some((lid, uid)) = current
+        && let Some(p) = ov::path_of(ectx, lid, uid)
+        && let Some(inv) = p.m.inverse()
+    {
+        let n = p.sp.vertices.len();
+        let first = p.sp.vertices.first().map(|v| {
+            let q = p.m.apply(gv2(v[0], v[1]));
+            map.to_screen([q.x, q.y])
+        });
+        if n >= 2 && first.is_some_and(|f| f.distance(pos) < 8.0) {
+            let _ = app.session.execute("mask.setClosed", json!({"layer": lid.0, "mask": uid, "closed": true}));
+            ui.data_mut(|d| {
+                d.remove::<(LayerId, u64)>(pen_id());
+                d.remove::<Gesture>(gid);
+            });
+            return;
+        }
+        // Shift keeps the new segment at a multiple of 45° from the vertex before it (#1544).
+        let last = p.sp.vertices.last().map(|v| p.m.apply(gv2(v[0], v[1])));
+        let c = match last {
+            Some(q) if mods.shift => constrain_45([q.x, q.y], c),
+            _ => c,
+        };
+        let lp = inv.apply(gv2(c[0], c[1]));
+        let lp = [lp.x, lp.y];
+        if let Ok(v) = app.session.execute("mask.addVertex", json!({"layer": lid.0, "mask": uid, "point": lp})) {
+            let index = v.as_u64().unwrap_or(0) as usize;
+            ui.data_mut(|d| d.insert_temp(gid, Gesture::Pen { layer: lid, mask: uid, index, vertex: lp, inv, press: pos }));
+        }
+        return;
+    }
+    // Clicking the last vertex of an open path (e.g. after Esc ended it) resumes drawing it.
+    if let Some(cur) = ov::open_end_at(paths, map, pos, 8.0) {
+        ui.data_mut(|d| d.insert_temp(pen_id(), cur));
+        return;
+    }
+    // On a visible path's segment the Pen adds a vertex there; on a motion path, a keyframe.
+    if let Some(f) = motion_frame {
+        add_motion_key(app, f);
+        return;
+    }
+    if let Some((l, m, seg, t)) = ov::segment_at(paths, map, pos, 5.0) {
+        let _ = app.session.execute("mask.insertVertex", json!({"layer": l.0, "mask": m, "segment": seg, "t": t}));
+        return;
+    }
+    let target = app
+        .session
+        .state
+        .selected_layers
+        .iter()
+        .copied()
+        .find(|id| ectx.comp.layer(*id).is_some_and(|l| !l.switches.locked && (l.masks().is_some() || matches!(l.source, LayerSource::Shape))));
+    let layer = target.and_then(|id| ectx.comp.layer(id));
+    let (lid, uid, inv) = match layer {
+        Some(l) if !matches!(l.source, LayerSource::Shape) || app.session.state.shape_tool.creates_mask => {
+            let Some(inv) = l2c(ectx, l).0.inverse() else { return };
+            let lp = inv.apply(gv2(c[0], c[1]));
+            let Ok(v) = app.session.execute("mask.new", json!({"layer": l.id.0, "vertices": [[lp.x, lp.y]]})) else { return };
+            let Some(mask) = v["mask"].as_u64() else { return };
+            (l.id, mask, inv)
+        }
+        Some(l) => {
+            let Some(inv) = l2c(ectx, l).0.inverse() else { return };
+            let lp = inv.apply(gv2(c[0], c[1]));
+            let r = app.session.execute("shape.newPath", json!({"layer": l.id.0, "vertices": [[lp.x, lp.y]], "space": "layer"}));
+            let Some(path) = r.ok().and_then(|v| v["path"].as_u64()) else { return };
+            (l.id, path, inv)
+        }
+        None => {
+            // A new shape layer at the comp centre (unrotated: comp → layer is a translation).
+            let r = app.session.execute("shape.newPath", json!({"vertices": [c], "space": "comp"}));
+            let Some(v) = r.ok() else { return };
+            let (Some(l), Some(path)) = (v["layer"].as_u64(), v["path"].as_u64()) else { return };
+            let inv = Mat3::translate(gv2(-(ectx.comp.width as f64) / 2.0, -(ectx.comp.height as f64) / 2.0));
+            (LayerId(l), path, inv)
+        }
+    };
+    let lp = inv.apply(gv2(c[0], c[1]));
+    ui.data_mut(|d| {
+        d.insert_temp(pen_id(), (lid, uid));
+        d.insert_temp(gid, Gesture::Pen { layer: lid, mask: uid, index: 0, vertex: [lp.x, lp.y], inv, press: pos });
+    });
+}
+
+/// `to` moved onto the nearest line through `from` at a multiple of 45° (horizontal, vertical or
+/// diagonal), as far along it as `to` lies: the Pen's Shift-click.
+pub(super) fn constrain_45(from: [f64; 2], to: [f64; 2]) -> [f64; 2] {
+    let (dx, dy) = (to[0] - from[0], to[1] - from[1]);
+    if !(dx.is_finite() && dy.is_finite()) || (dx == 0.0 && dy == 0.0) {
+        return to;
+    }
+    let step = std::f64::consts::FRAC_PI_4;
+    let a = (dy.atan2(dx) / step).round() * step;
+    let (ux, uy) = (a.cos(), a.sin());
+    let along = dx * ux + dy * uy;
+    [from[0] + ux * along, from[1] + uy * along]
+}
diff --git a/crates/ui-egui/src/panels/viewer/view.rs b/crates/ui-egui/src/panels/viewer/view.rs
new file mode 100644
index 000000000..e837528b3
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer/view.rs
@@ -0,0 +1,233 @@
+use super::tools::draw_rigs;
+use super::{Align2, Color32, EffectcraftApp, EvalCtx, Rect, Sense, Stroke, StrokeKind, Tokens, View3D, ViewerMap, json, pos2, three_d, vec2, widgets};
+
+/// Draw the extra views of a 2- or 4-view layout and return the main view's rectangle.
+pub(super) fn aux_views(
+    app: &mut EffectcraftApp,
+    ui: &mut egui::Ui,
+    comp: &effectcraft_engine::project::Comp,
+    cid: effectcraft_engine::project::ItemId,
+    full: Rect,
+    bg: Color32,
+) -> Rect {
+    let n = app.session.state.view_layout;
+    if n < 2 {
+        return full;
+    }
+    let gap = 2.0;
+    let views = app.session.state.views3d.get(&cid).cloned().unwrap_or_default();
+    let (main, aux): (Rect, Vec<(Rect, View3D)>) = if n == 2 {
+        let mid = full.center().x;
+        (
+            Rect::from_min_max(pos2(mid + gap / 2.0, full.min.y), full.max),
+            vec![(Rect::from_min_max(full.min, pos2(mid - gap / 2.0, full.max.y)), views.pane(0))],
+        )
+    } else {
+        let c = full.center();
+        let q = |x0: f32, y0: f32, x1: f32, y1: f32| Rect::from_min_max(pos2(x0, y0), pos2(x1, y1));
+        (
+            q(c.x + gap / 2.0, c.y + gap / 2.0, full.max.x, full.max.y),
+            vec![
+                (q(full.min.x, full.min.y, c.x - gap / 2.0, c.y - gap / 2.0), views.pane(0)),
+                (q(c.x + gap / 2.0, full.min.y, full.max.x, c.y - gap / 2.0), views.pane(1)),
+                (q(full.min.x, c.y + gap / 2.0, c.x - gap / 2.0, full.max.y), views.pane(2)),
+            ],
+        )
+    };
+    let ctx = ui.ctx().clone();
+    let p = ui.painter().clone();
+    p.rect_filled(full, 0.0, Color32::from_black_alpha(200));
+    let t = app.session.time();
+    let (cw, ch) = (comp.width as f32, comp.height as f32);
+    let share = app.session.state.share_view_options;
+    // The camera and light wireframes of each view (as in After Effects, where every view of the
+    // layout shows them), evaluated on a snapshot of the project.
+    let snap_project = app.session.project.clone();
+    let snap_expr = app.session.expr.clone();
+    let ectx = EvalCtx {
+        project: &snap_project,
+        comp_id: cid,
+        comp,
+        time: t,
+        expr: snap_expr.as_deref(),
+        footage: None,
+        property_overrides: &[],
+        media_overrides: &[],
+        reads: None,
+    };
+    let selected = app.session.state.selected_layers.clone();
+    let mut picked: Option<(usize, View3D)> = None;
+    for (i, (r, v)) in aux.into_iter().enumerate() {
+        p.rect_filled(r, 0.0, bg);
+        let fit = ((r.width() - 20.0) / cw).min((r.height() - 20.0) / ch).max(0.01);
+        let cr = Rect::from_center_size(r.center(), vec2(cw * fit, ch * fit));
+        let scale = (fit * ctx.pixels_per_point()).min(1.0) as f64;
+        // The Active Camera pane renders through the comp's own camera; the others through their
+        // view camera.
+        let through_active = v == View3D::ActiveCamera;
+        let cam = if through_active { three_d::active_camera(&ectx) } else { views.cam(v, comp.width as f64, comp.height as f64).state() };
+        let key = {
+            use std::hash::{Hash, Hasher};
+            let mut h = std::collections::hash_map::DefaultHasher::new();
+            (app.session.revision, cid.0, t.0, i, scale.to_bits(), format!("{cam:?}")).hash(&mut h);
+            h.finish()
+        };
+        let id = egui::Id::unique(("viewer-aux", i));
+        let cached: Option<(u64, egui::TextureHandle)> = ctx.data(|d| d.get_temp(id));
+        let tex = match cached {
+            Some((k, tex)) if k == key => tex,
+            _ => {
+                let opts = effectcraft_engine::render::RenderOpts {
+                    scale,
+                    view: (comp.has_3d() && !through_active).then_some(cam),
+                    draft: true,
+                    ..Default::default()
+                };
+                let img = app.session.render(cid, t, opts);
+                let tex = crate::frames::load_fitted(&ctx, format!("viewer-aux-{i}"), crate::frames::to_color_image(&img), egui::TextureOptions::LINEAR);
+                ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
+                tex
+            }
+        };
+        let b = comp.background;
+        p.rect_filled(cr, 0.0, Color32::from_rgb((b[0] * 255.0) as u8, (b[1] * 255.0) as u8, (b[2] * 255.0) as u8));
+        p.image(tex.id(), cr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+        p.rect_stroke(cr, 0.0, Stroke::new(1.0, Color32::from_black_alpha(160)), StrokeKind::Outside);
+        if share && app.ui.viewer.safe_margins {
+            for k in [0.9, 0.8] {
+                p.rect_stroke(Rect::from_center_size(cr.center(), cr.size() * k), 0.0, Stroke::new(1.0, Color32::from_white_alpha(120)), StrokeKind::Middle);
+            }
+        }
+        if comp.has_3d() {
+            let map = ViewerMap { origin: cr.min, zoom: fit, comp: [cw, ch], area: r };
+            draw_rigs(app, &p.with_clip_rect(r), &map, &ectx, &selected, cam, through_active, Some(v.id()));
+        }
+        let label = if comp.has_3d() { super::view3d_label(v) } else { crate::i18n::tr("Active Camera") };
+        p.text(r.left_bottom() + vec2(8.0, -8.0), Align2::LEFT_BOTTOM, label, Tokens::ui(11.0), Color32::from_white_alpha(200));
+        app.auto.add(&format!("viewer.view.{}", v.id()), r, label);
+        if comp.has_3d()
+            && let Some(chosen) = pane_selector(app, ui, i + 1, r, v)
+        {
+            picked = Some((i + 1, chosen));
+        }
+    }
+    if let Some((pane, v)) = picked
+        && let Err(e) = app.session.execute("view.setPaneView", json!({"pane": pane, "view": v.id(), "comp": cid.0}))
+    {
+        app.ui.status = e.to_string();
+    }
+    main
+}
+
+/// The view selector in the top-left corner of pane `pane` (1 to 3) of a multi-view layout, a
+/// popup of every 3D view like the toolbar's 3D View menu. Returns the view chosen this frame.
+fn pane_selector(app: &mut EffectcraftApp, ui: &mut egui::Ui, pane: usize, area: Rect, current: View3D) -> Option<View3D> {
+    let t = app.tokens;
+    let r = Rect::from_min_size(area.min + vec2(6.0, 6.0), vec2(124.0, 20.0));
+    let pid = egui::Id::unique(("viewer-pane-view", pane));
+    let response = widgets::dropdown(ui, r, super::view3d_label(current), &t, pid);
+    if response.clicked() {
+        let open = widgets::popup_is_open(ui, pid);
+        ui.data_mut(|d| d.insert_temp(pid.with("open"), !open));
+    }
+    app.auto.add_response(&format!("viewer.view.{pane}.type"), &response, "View of pane");
+    if !widgets::popup_is_open(ui, pid) {
+        return None;
+    }
+    let chosen = widgets::popup_list(ui, pid, r.left_bottom() + vec2(0.0, 2.0), r, View3D::ALL.len(), 0, |ui| {
+        ui.set_min_width(124.0);
+        let mut chosen = None;
+        for (k, v) in View3D::ALL.iter().enumerate() {
+            let item = ui.selectable_label(*v == current, super::view3d_label(*v));
+            app.auto.add(&format!("viewer.view.{pane}.typeItem.{k}"), item.rect, v.label());
+            if item.clicked() {
+                chosen = Some(*v);
+            }
+        }
+        chosen
+    });
+    chosen.filter(|v| *v != current)
+}
+
+/// View ▸ Split with New Locked Viewer: the locked viewer on the left of the Composition panel
+/// (its comp and 3D view stay put whatever comp is active). Returns the main viewer's rectangle.
+pub(super) fn locked_pane(app: &mut EffectcraftApp, ui: &mut egui::Ui, full: Rect, bg: Color32) -> Rect {
+    let Some(lv) = app.session.state.locked_viewer else { return full };
+    let Some(comp) = app.session.project.comp_arc(lv.comp) else { return full };
+    let name = app.session.project.item(lv.comp).map(|i| i.name.clone()).unwrap_or_default();
+    let gap = 2.0;
+    let mid = full.center().x;
+    let r = Rect::from_min_max(full.min, pos2(mid - gap / 2.0, full.max.y));
+    let main = Rect::from_min_max(pos2(mid + gap / 2.0, full.min.y), full.max);
+    let ctx = ui.ctx().clone();
+    let p = ui.painter().clone();
+    p.rect_filled(Rect::from_min_max(pos2(r.max.x, full.min.y), pos2(main.min.x, full.max.y)), 0.0, Color32::from_black_alpha(200));
+    p.rect_filled(r, 0.0, bg);
+    let (cw, ch) = (comp.width as f32, comp.height as f32);
+    let fit = ((r.width() - 20.0) / cw).min((r.height() - 44.0) / ch).max(0.01);
+    let cr = Rect::from_center_size(r.center(), vec2(cw * fit, ch * fit));
+    let scale = (fit * ctx.pixels_per_point()).min(1.0) as f64;
+    let t = app.session.time_of(lv.comp);
+    let cam = (lv.view != View3D::ActiveCamera && comp.has_3d())
+        .then(|| app.session.state.views3d.get(&lv.comp).cloned().unwrap_or_default().cam(lv.view, comp.width as f64, comp.height as f64).state());
+    let dc = effectcraft_engine::viewer::DisplayColor::of(&app.session);
+    // The display conversion's inputs, keyed as in the main viewer's texture caches.
+    let dc_key = format!("{cam:?}{}", crate::panels::viewer_tools::display_key(app, dc.is_some()));
+    let key = {
+        use std::hash::{Hash, Hasher};
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        (app.session.revision, lv.comp.0, t.0, scale.to_bits(), dc_key).hash(&mut h);
+        h.finish()
+    };
+    let id = egui::Id::unique("viewer-locked");
+    let cached: Option<(u64, egui::TextureHandle)> = ctx.data(|d| d.get_temp(id));
+    let tex = match cached {
+        Some((k, tex)) if k == key => tex,
+        _ => {
+            let opts = effectcraft_engine::render::RenderOpts { scale, view: cam, ..Default::default() };
+            let img = app.session.render(lv.comp, t, opts);
+            let mut ci = crate::frames::to_color_image(&img);
+            if let Some(dc) = dc {
+                let mut px: Vec<[u8; 4]> = ci.pixels.iter().map(|c| c.to_array()).collect();
+                dc.apply(&mut px);
+                ci = egui::ColorImage::new(ci.size, px.into_iter().map(|a| Color32::from_rgba_premultiplied(a[0], a[1], a[2], a[3])).collect());
+            }
+            let tex = crate::frames::load_fitted(&ctx, "viewer-locked", ci, egui::TextureOptions::LINEAR);
+            ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
+            tex
+        }
+    };
+    let b = comp.background;
+    p.rect_filled(cr, 0.0, Color32::from_rgb((b[0] * 255.0) as u8, (b[1] * 255.0) as u8, (b[2] * 255.0) as u8));
+    p.image(tex.id(), cr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+    p.rect_stroke(cr, 0.0, Stroke::new(1.0, Color32::from_black_alpha(160)), StrokeKind::Outside);
+    let label =
+        crate::i18n::tr_args("Locked: {} — {}", &[&name, &(if comp.has_3d() { super::view3d_label(lv.view) } else { crate::i18n::tr("Active Camera") })]);
+    p.text(r.left_top() + vec2(8.0, 8.0), Align2::LEFT_TOP, &label, Tokens::ui(11.0), Color32::from_white_alpha(210));
+    app.auto.add("viewer.locked", r, &label);
+    // Close the locked viewer.
+    let close = Rect::from_min_size(pos2(r.max.x - 26.0, r.min.y + 4.0), vec2(20.0, 20.0));
+    let resp = ui.interact(close, egui::Id::unique("viewer-locked-close"), Sense::click());
+    p.text(close.center(), Align2::CENTER_CENTER, "\u{00d7}", Tokens::ui(14.0), if resp.hovered() { Color32::WHITE } else { Color32::from_white_alpha(170) });
+    app.auto.add("viewer.locked.close", close, "Close Locked Viewer");
+    if resp.clicked() {
+        let _ = app.session.execute("view.closeLockedViewer", serde_json::json!({}));
+    }
+    main
+}
+
+pub(crate) fn checker(p: &egui::Painter, r: Rect) {
+    let s = 10.0;
+    p.rect_filled(r, 0.0, Color32::from_gray(0xcc));
+    let mut y = r.min.y;
+    let mut row = 0;
+    while y < r.max.y {
+        let mut x = r.min.x + if row % 2 == 0 { 0.0 } else { s };
+        while x < r.max.x {
+            p.rect_filled(Rect::from_min_max(pos2(x, y), pos2((x + s).min(r.max.x), (y + s).min(r.max.y))), 0.0, Color32::from_gray(0x99));
+            x += 2.0 * s;
+        }
+        y += s;
+        row += 1;
+    }
+}
diff --git a/crates/ui-egui/src/panels/viewer_drop.rs b/crates/ui-egui/src/panels/viewer_drop.rs
index 44364a49d..aadd2c122 100644
--- a/crates/ui-egui/src/panels/viewer_drop.rs
+++ b/crates/ui-egui/src/panels/viewer_drop.rs
@@ -1,7 +1,8 @@
 //! Dropping onto the Composition viewer: footage, comps and solids from the
 //! Project panel and files from the Media Browser become layers centred where they are dropped
 //! (#85), and an effect or animation preset from Effects & Presets goes on the layer under the
-//! pointer, outlined while it is dragged (#88). Agents do the same with `layer.addItem {position}`,
+//! pointer, outlined while it is dragged (#88). Alt/Option-dropping a Project item replaces the source of
+//! the layer under the pointer instead, as in the Timeline (#2173). Agents do the same with `layer.addItem {position}`,
 //! `mediaBrowser.import {position}`, `effect.apply {layers}` and the preset commands.
 
 use effectcraft_engine::project::{ItemId, ItemKind};
@@ -10,7 +11,7 @@ use egui::{Rect, Stroke, StrokeKind, vec2};
 use serde_json::{Value, json};
 
 use super::DragPayload;
-use super::viewer::{ViewerMap, layer_at, layer_quad};
+use super::viewer::{ViewerMap, layer_at, layer_at_including_locked, layer_quad};
 use crate::EffectcraftApp;
 
 /// While something is dragged over the viewer, show where it goes; drop it on release.
@@ -23,6 +24,9 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &egui::Ui, painter: &egui::Pain
     let Some(ptr) = ctx.input(|i| i.pointer.hover_pos()).filter(|_| ui.rect_contains_pointer(map.area)) else { return };
     let stroke = Stroke::new(2.0, app.tokens.accent);
     let at = map.to_comp(ptr);
+    // Alt/Option-drop of a Project item replaces the source of the layer under the pointer (After
+    // Effects), as in the Timeline; it never adds a layer.
+    let alt_item = ctx.input(|i| i.modifiers.alt) && matches!(payload.as_ref(), DragPayload::Item(_));
     let actions: Vec<(&str, Value)> = match payload.as_ref() {
         DragPayload::Effect(effect) => layer_at(ectx, at)
             .map(|l| {
@@ -42,6 +46,7 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &egui::Ui, painter: &egui::Pain
             })
             .into_iter()
             .collect(),
+        DragPayload::Item(item) if alt_item => alt_replace(app, ectx, painter, map, stroke, at, *item).into_iter().collect(),
         DragPayload::Item(item) => {
             // The layer's frame, centred on the pointer.
             if let Some([w, h]) = app.session.project.item(ItemId(*item)).and_then(|it| frame_size(&it.kind, ectx.comp.pixel_aspect)) {
@@ -49,13 +54,17 @@ pub(crate) fn show(app: &mut EffectcraftApp, ui: &egui::Ui, painter: &egui::Pain
             }
             // New layers go above the current selection, so insert in reverse
             // to preserve the order of the dragged Project items.
-            crate::panels::project_drop_items(app, *item).into_iter().rev().map(|item| ("layer.addItem", json!({"item": item, "position": at}))).collect()
+            crate::panels::project_drop_items(app, *item, app.session.state.active_comp)
+                .into_iter()
+                .rev()
+                .map(|item| ("layer.addItem", json!({"item": item, "position": at})))
+                .collect()
         }
         DragPayload::Files(paths) => vec![("mediaBrowser.import", json!({"paths": paths, "addToComp": true, "position": at}))],
         DragPayload::Property { .. } => vec![],
     };
     // Layer drops outline the target layer; the others outline the whole viewer.
-    let layer_drop = matches!(payload.as_ref(), DragPayload::Effect(_) | DragPayload::Preset { .. });
+    let layer_drop = alt_item || matches!(payload.as_ref(), DragPayload::Effect(_) | DragPayload::Preset { .. });
     if !layer_drop && !actions.is_empty() {
         painter.rect_stroke(map.area, 0.0, stroke, StrokeKind::Inside);
     }
@@ -80,3 +89,21 @@ fn frame_size(kind: &ItemKind, comp_pixel_aspect: f64) -> Option<[f32; 2]> {
     let stretch = if comp_pixel_aspect > 0.0 && pixel_aspect > 0.0 { pixel_aspect / comp_pixel_aspect } else { 1.0 };
     (w > 0 && h > 0).then_some([(w as f64 * stretch) as f32, h as f32])
 }
+
+/// The `layer.replaceSource` for an Alt/Option-drop of Project item `item` at comp point `at`: the
+/// topmost layer there, outlined, if it can take the item as its source (a locked one cannot).
+fn alt_replace(
+    app: &EffectcraftApp,
+    ectx: &EvalCtx,
+    painter: &egui::Painter,
+    map: &ViewerMap,
+    stroke: Stroke,
+    at: [f64; 2],
+    item: u64,
+) -> Option<(&'static str, Value)> {
+    let layer = layer_at_including_locked(ectx, at).filter(|l| super::timeline::replace_source_target(app, ectx.comp_id, ItemId(item), l.id, ectx.comp))?;
+    if let Some((_, q, _)) = layer_quad(ectx, layer) {
+        painter.add(egui::Shape::closed_line(q.iter().map(|c| map.to_screen(*c)).collect(), stroke));
+    }
+    Some(("layer.replaceSource", json!({"layers": [layer.id.0], "item": item, "fixExpressions": false})))
+}
diff --git a/crates/ui-egui/src/panels/viewer_overlays.rs b/crates/ui-egui/src/panels/viewer_overlays.rs
index 9117103d5..00c07425d 100644
--- a/crates/ui-egui/src/panels/viewer_overlays.rs
+++ b/crates/ui-egui/src/panels/viewer_overlays.rs
@@ -7,7 +7,7 @@
 
 use effectcraft_engine::geom::{Mat3, vec2 as gv2};
 use effectcraft_engine::keyframe::ShapePath;
-use effectcraft_engine::project::{GroupKind, Layer, LayerId};
+use effectcraft_engine::project::{GroupKind, Layer, LayerId, Property};
 use effectcraft_engine::render::EvalCtx;
 use effectcraft_engine::time::Tick;
 use effectcraft_engine::{KeyRef, VertexRef};
@@ -132,17 +132,52 @@ pub(crate) fn path_of(ectx: &EvalCtx, layer: LayerId, uid: u64) -> Option<PathIn
 /// The path on screen: `sp` through `m` and the viewer map, flattened, with the closing point
 /// repeated for a closed path.
 pub(crate) fn flatten(sp: &ShapePath, m: &Mat3, map: &ViewerMap) -> Vec<Pos2> {
-    let k = effectcraft_engine::render::kurbo_path(sp);
+    let mut k = effectcraft_engine::render::kurbo_path(sp);
+    // A path-space tolerance becomes visible corners when the viewer or a layer/group is
+    // magnified. Flatten affine paths in screen space so the error stays below half a point.
+    // Projective transforms must still map the flattened points: projecting Bezier control
+    // points would change the curve rather than just its tessellation.
+    let screen_space = m.is_affine();
+    if screen_space {
+        let z = f64::from(map.zoom);
+        k.apply_affine(kurbo::Affine::new([
+            m.0[0][0] * z,
+            m.0[1][0] * z,
+            m.0[0][1] * z,
+            m.0[1][1] * z,
+            m.0[0][2] * z + f64::from(map.origin.x),
+            m.0[1][2] * z + f64::from(map.origin.y),
+        ]));
+    }
+    if !k.is_finite() {
+        return Vec::new();
+    }
+    let bounds = k.control_box();
+    if [bounds.x0, bounds.y0, bounds.x1, bounds.y1].iter().any(|v| v.abs() > f64::from(f32::MAX)) {
+        return Vec::new();
+    }
+    // Bound subdivision work even for extreme finite scales from a malformed project. For
+    // ordinary on-screen paths the tolerance remains half a point.
+    let tolerance = (bounds.width().max(bounds.height()) / 1_000_000.0).max(0.5);
     let mut pts: Vec<Pos2> = vec![];
-    kurbo::flatten(k.iter(), 0.5, |el| match el {
+    kurbo::flatten(k.iter(), tolerance, |el| match el {
         kurbo::PathEl::MoveTo(q) | kurbo::PathEl::LineTo(q) => {
-            let c = m.apply(gv2(q.x, q.y));
-            pts.push(map.to_screen([c.x, c.y]));
+            let p = if screen_space {
+                egui::pos2(q.x as f32, q.y as f32)
+            } else {
+                let c = m.apply(gv2(q.x, q.y));
+                map.to_screen([c.x, c.y])
+            };
+            if p.is_finite() {
+                pts.push(p);
+            }
         }
         _ => {}
     });
-    if sp.closed && !pts.is_empty() {
-        pts.push(pts[0]);
+    if sp.closed
+        && let Some(first) = pts.first().copied()
+    {
+        pts.push(first);
     }
     pts
 }
@@ -274,6 +309,23 @@ pub(crate) struct KeyHit {
     pub value: [f64; 3],
     /// Parent space → comp.
     pub p2c: Mat3,
+    /// Separated dimensions: X and Y Position's uids, and whether each has a key at `time`.
+    pub axes: Option<[(u64, bool); 2]>,
+}
+
+impl KeyHit {
+    /// The keys this dot stands for: Position's, or the X and Y Position keys at its time.
+    pub(crate) fn key_refs(&self) -> Vec<KeyRef> {
+        match self.axes {
+            Some(axes) => axes.iter().filter(|(_, has)| *has).map(|&(prop, _)| KeyRef { layer: self.layer, prop, time: self.time }).collect(),
+            None => vec![KeyRef { layer: self.layer, prop: self.prop, time: self.time }],
+        }
+    }
+
+    /// [`Self::key_refs`] as `keys.select` entries.
+    pub(crate) fn select_entries(&self) -> Vec<serde_json::Value> {
+        self.key_refs().iter().map(|k| json!({"layer": k.layer.0, "prop": k.prop, "time": k.time.seconds()})).collect()
+    }
 }
 
 /// A frame on a motion path (one of its dots): where the Pen and Add Vertex tools add a
@@ -285,6 +337,21 @@ pub(crate) struct PathFrame {
     /// Layer time of the frame.
     pub time: Tick,
     pub pos: Pos2,
+    /// Separated dimensions: X and Y Position's uids, which get the key instead of `prop`.
+    pub axes: Option<[u64; 2]>,
+}
+
+/// Layer times of the keys of separated X and Y Position together, in order.
+fn separated_key_times(x: &Property, y: &Property) -> Vec<Tick> {
+    let mut times: Vec<Tick> = x.keys.iter().chain(y.keys.iter()).map(|k| k.time).collect();
+    times.sort();
+    times.dedup();
+    times
+}
+
+/// Separated X and Y Position at layer time `t` (z 0: motion paths are for 2D layers).
+fn separated_value(x: &Property, y: &Property, t: Tick) -> [f64; 3] {
+    [x.value_at(t).as_f64(), y.value_at(t).as_f64(), 0.0]
 }
 
 /// The keyframe dot on a motion path under `pos`.
@@ -326,75 +393,98 @@ pub(crate) fn motion_path(
     hits: &mut Vec<KeyHit>,
     frames: &mut Vec<PathFrame>,
 ) {
-    let Some(pos) = l.transform().and_then(|tr| tr.get("position")) else { return };
-    if pos.keys.len() < 2 || l.is_3d() {
+    let Some(tr) = l.transform() else { return };
+    let Some(pos) = tr.get("position") else { return };
+    // Separate Dimensions: the layer follows X / Y Position, so the path is drawn from their keys.
+    let sep = tr.get("positionX").zip(tr.get("positionY"));
+    let key_times: Vec<Tick> = match sep {
+        Some((x, y)) => separated_key_times(x, y),
+        None => pos.keys.iter().map(|k| k.time).collect(),
+    };
+    if key_times.len() < 2 || l.is_3d() {
         return;
     }
+    let prop = sep.map_or(pos.uid, |(x, _)| x.uid);
+    let frame_axes = sep.map(|(x, y)| [x.uid, y.uid]);
+    let value_at = |t: Tick| match sep {
+        Some((x, y)) => separated_value(x, y, t),
+        None => pos.value_at(t).as_vec3(),
+    };
     let p2c = parent_to_comp(ectx, l);
     let to_scr = |v: [f64; 3]| {
         let c = p2c.apply(gv2(v[0], v[1]));
         map.to_screen([c.x, c.y])
     };
     // Settings ▸ Composition ▸ Motion Path: all keyframes, none, or a window around the CTI.
-    let times: Vec<Tick> = pos.keys.iter().map(|k| k.time).collect();
-    let Some((lt0, lt1)) = app.session.prefs.motion_path_span(&times, l.layer_time(ectx.time)) else { return };
+    let Some((lt0, lt1)) = app.session.prefs.motion_path_span(&key_times, l.layer_time(ectx.time)) else { return };
     let fd = ectx.comp.frame_duration();
     let mut pts = vec![];
     let mut lt = lt0;
     while lt <= lt1 && pts.len() < 20_000 {
-        let q = to_scr(pos.value_at(lt).as_vec3());
-        frames.push(PathFrame { layer: l.id, prop: pos.uid, time: lt, pos: q });
+        let q = to_scr(value_at(lt));
+        frames.push(PathFrame { layer: l.id, prop, time: lt, pos: q, axes: frame_axes });
         pts.push(q);
         lt += fd;
     }
-    pts.push(to_scr(pos.value_at(lt1).as_vec3()));
+    pts.push(to_scr(value_at(lt1)));
     let faint = col.gamma_multiply(0.8);
     painter.add(egui::Shape::line(pts.clone(), Stroke::new(1.0, faint)));
     for q in &pts {
         painter.circle_filled(*q, 1.2, faint);
     }
     let sel = &app.session.state.selected_keys;
-    for (i, k) in pos.keys.iter().enumerate() {
-        if k.time < lt0 || k.time > lt1 {
+    for (i, kt) in key_times.iter().enumerate() {
+        if *kt < lt0 || *kt > lt1 {
             continue;
         }
-        let v = k.value.as_vec3();
+        // The combined Position key at this time; none with separated dimensions.
+        let key = pos.keys.get(i).filter(|_| sep.is_none());
+        let v = key.map_or_else(|| value_at(*kt), |k| k.value.as_vec3());
         let s = to_scr(v);
-        // Auto-Bezier keys show handles on a side the path leaves straight too (a two-key path's
-        // ends), to drag it into a curve; Linear keys (no tangents) show none.
-        let (tin, tout) = if k.spatial_auto {
-            effectcraft_engine::keyframe::spatial_handles(&pos.keys, i)
-        } else {
-            effectcraft_engine::keyframe::spatial_tangents(&pos.keys, i)
-        };
-        for (out, tg) in [(false, tin), (true, tout)] {
-            let has = (out && i + 1 < pos.keys.len()) || (!out && i > 0);
-            if !has || (tg[0] == 0.0 && tg[1] == 0.0) {
-                continue;
+        let axes = sep.map(|(x, y)| [x, y].map(|a| (a.uid, a.keys.iter().any(|k| k.time == *kt))));
+        let hit = KeyHit { layer: l.id, prop, time: *kt, pos: s, tangent: None, value: v, p2c, axes };
+        let selected = hit.key_refs().iter().any(|k| sel.contains(k));
+        // A muted position key is off the motion path: no tangents, and a dimmed point.
+        let kc = if key.is_some_and(|k| k.muted) { col.gamma_multiply(if selected { 0.55 } else { 0.35 }) } else { col };
+        // Separated X / Y have no spatial tangents.
+        if let Some(k) = key.filter(|k| !k.muted) {
+            // Auto-Bezier keys show handles on a side the path leaves straight too (a two-key path's
+            // ends), to drag it into a curve; Linear keys (no tangents) show none.
+            let (tin, tout) = if k.spatial_auto {
+                effectcraft_engine::keyframe::spatial_handles(&pos.keys, i)
+            } else {
+                effectcraft_engine::keyframe::spatial_tangents(&pos.keys, i)
+            };
+            for (out, tg) in [(false, tin), (true, tout)] {
+                let has = (out && i + 1 < pos.keys.len()) || (!out && i > 0);
+                if !has || (tg[0] == 0.0 && tg[1] == 0.0) {
+                    continue;
+                }
+                let h = to_scr([v[0] + tg[0], v[1] + tg[1], v[2] + tg[2]]);
+                painter.line_segment([s, h], Stroke::new(1.0, kc));
+                painter.circle_filled(h, 3.0, kc);
+                let side = if out { "out" } else { "in" };
+                app.auto.add(&format!("viewer.motionPath.{}.{i}.{side}", l.id.0), Rect::from_center_size(h, vec2(8.0, 8.0)), "Spatial tangent");
+                hits.push(KeyHit { layer: l.id, prop, time: *kt, pos: h, tangent: Some(out), value: v, p2c, axes: None });
             }
-            let h = to_scr([v[0] + tg[0], v[1] + tg[1], v[2] + tg[2]]);
-            painter.line_segment([s, h], Stroke::new(1.0, col));
-            painter.circle_filled(h, 3.0, col);
-            let side = if out { "out" } else { "in" };
-            app.auto.add(&format!("viewer.motionPath.{}.{i}.{side}", l.id.0), Rect::from_center_size(h, vec2(8.0, 8.0)), "Spatial tangent");
-            hits.push(KeyHit { layer: l.id, prop: pos.uid, time: k.time, pos: h, tangent: Some(out), value: v, p2c });
         }
         let r = Rect::from_center_size(s, vec2(7.0, 7.0));
-        if sel.contains(&KeyRef { layer: l.id, prop: pos.uid, time: k.time }) {
-            painter.rect_filled(r, 0.0, col);
+        if selected {
+            painter.rect_filled(r, 0.0, kc);
         } else {
             painter.rect_filled(r, 0.0, Color32::from_black_alpha(140));
-            painter.rect_stroke(r, 0.0, Stroke::new(1.0, col), StrokeKind::Inside);
+            painter.rect_stroke(r, 0.0, Stroke::new(1.0, kc), StrokeKind::Inside);
         }
         app.auto.add(&format!("viewer.motionPath.{}.{i}", l.id.0), r.expand(2.0), "Position keyframe");
-        hits.push(KeyHit { layer: l.id, prop: pos.uid, time: k.time, pos: s, tangent: None, value: v, p2c });
+        hits.push(hit);
     }
 }
 
 // ---------------------------------------------------------------- free transform
 
+/// The `egui::Id` under which the free-transform target (layer and mask or path id) is stored.
 fn ft_id() -> egui::Id {
-    egui::Id::new("viewer-free-transform")
+    egui::Id::unique("viewer-free-transform")
 }
 
 /// Enter Free Transform on a path (double-click a path with the Selection tool).
@@ -503,7 +593,7 @@ fn point_in_quad(p: Pos2, q: &[Pos2; 4]) -> bool {
 #[derive(Clone, Debug)]
 pub(crate) enum Drag {
     /// A motion-path keyframe: its value moves with the pointer (parent space).
-    Key { layer: LayerId, prop: u64, time: Tick, start: [f64; 3], press: [f64; 2], inv: Mat3 },
+    Key { layer: LayerId, prop: u64, time: Tick, start: [f64; 3], press: [f64; 2], inv: Mat3, axes: Option<[u64; 2]> },
     /// A spatial tangent handle of a motion-path key.
     KeyTangent { layer: LayerId, prop: u64, time: Tick, out: bool, key: [f64; 3], inv: Mat3 },
     /// Free transform: 0 move, 1 scale (anchor, axes), 2 rotate about `anchor`.
@@ -528,11 +618,17 @@ pub(crate) fn begin_key_drag(app: &mut EffectcraftApp, hits: &[KeyHit], press: P
     match h.tangent {
         Some(out) => Some(Drag::KeyTangent { layer: h.layer, prop: h.prop, time: h.time, out, key: h.value, inv }),
         None => {
-            let k = KeyRef { layer: h.layer, prop: h.prop, time: h.time };
-            if !app.session.state.selected_keys.contains(&k) || shift {
-                let _ = app.session.execute("keys.select", json!({"keys": [{"layer": h.layer.0, "prop": h.prop, "time": h.time.seconds()}], "add": shift}));
+            // Separated dimensions: both X and Y need a key here before the drag moves them.
+            let mut h = *h;
+            for (uid, has) in h.axes.iter_mut().flatten().filter(|(_, has)| !*has) {
+                let _ = app.session.execute("prop.addKey", json!({"layer": h.layer.0, "prop": *uid, "time": h.time.seconds()}));
+                *has = true;
             }
-            Some(Drag::Key { layer: h.layer, prop: h.prop, time: h.time, start: h.value, press: cpt, inv })
+            if !h.key_refs().iter().all(|k| app.session.state.selected_keys.contains(k)) || shift {
+                let _ = app.session.execute("keys.select", json!({"keys": h.select_entries(), "add": shift}));
+            }
+            let axes = h.axes.map(|a| a.map(|(uid, _)| uid));
+            Some(Drag::Key { layer: h.layer, prop: h.prop, time: h.time, start: h.value, press: cpt, inv, axes })
         }
     }
 }
@@ -598,17 +694,22 @@ pub(crate) fn update(
     snap: &mut dyn FnMut(&EffectcraftApp, [f64; 2], LayerId) -> [f64; 2],
 ) -> Option<Drag> {
     match d.clone() {
-        Drag::Key { layer, prop, time, start, press, inv } => {
+        Drag::Key { layer, prop, time, start, press, inv, axes } => {
             // Snap the key's on-screen position like a layer drag.
             let start_c = inv.inverse().map(|m| m.apply(gv2(start[0], start[1]))).map(|v| [v.x, v.y]).unwrap_or([start[0], start[1]]);
             let mut target = [start_c[0] + cpt[0] - press[0], start_c[1] + cpt[1] - press[1]];
             let s = snap(app, target, layer);
             target = [target[0] + s[0], target[1] + s[1]];
             let p = inv.apply(gv2(target[0], target[1]));
-            let v = json!([p.x, p.y, start[2]]);
-            let r = app.session.execute("keys.set", json!({"layer": layer.0, "prop": prop, "time": time.seconds(), "value": v, "merge": merge}));
-            if let Err(e) = r {
-                app.ui.status = e.to_string();
+            let edits = match axes {
+                Some([ux, uy]) => vec![(ux, json!(p.x)), (uy, json!(p.y))],
+                None => vec![(prop, json!([p.x, p.y, start[2]]))],
+            };
+            for (uid, v) in edits {
+                let r = app.session.execute("keys.set", json!({"layer": layer.0, "prop": uid, "time": time.seconds(), "value": v, "merge": merge}));
+                if let Err(e) = r {
+                    app.ui.status = e.to_string();
+                }
             }
             None
         }
@@ -673,12 +774,153 @@ pub(crate) fn update(
 mod tests {
     use super::*;
 
+    fn scalar_prop(uid: u64, keys: &[(i64, f64)]) -> Property {
+        use effectcraft_engine::keyframe::{Keyframe, Value};
+        let mut p = Property::new(uid, "positionX", "X Position", Value::Scalar(0.0));
+        p.keys = keys.iter().map(|&(t, v)| Keyframe::new(Tick(t), Value::Scalar(v))).collect();
+        p
+    }
+
+    /// #2242: with separated dimensions the motion path follows the keys of X and Y Position.
+    #[test]
+    fn separated_motion_path_uses_x_and_y_keys() {
+        let x = scalar_prop(1, &[(0, 10.0), (100, 30.0)]);
+        let y = scalar_prop(2, &[(0, 0.0), (50, 20.0), (100, 0.0)]);
+        assert_eq!(separated_key_times(&x, &y), vec![Tick(0), Tick(50), Tick(100)]);
+        let mid = separated_value(&x, &y, Tick(50));
+        assert!((mid[0] - 20.0).abs() < 1e-9 && (mid[1] - 20.0).abs() < 1e-9 && mid[2] == 0.0, "{mid:?}");
+        assert_eq!(separated_value(&x, &y, Tick(100)), [30.0, 0.0, 0.0]);
+    }
+
+    /// #2242: a separated dot selects the X and Y keys at its time, not the nearest X key.
+    #[test]
+    fn separated_key_dot_refers_to_its_axis_keys() {
+        let mut h = KeyHit {
+            layer: LayerId(7),
+            prop: 1,
+            time: Tick(50),
+            pos: Pos2::ZERO,
+            tangent: None,
+            value: [0.0; 3],
+            p2c: Mat3::IDENTITY,
+            axes: Some([(1, false), (2, true)]),
+        };
+        assert_eq!(h.key_refs(), vec![KeyRef { layer: LayerId(7), prop: 2, time: Tick(50) }]);
+        h.axes = None;
+        assert_eq!(h.key_refs(), vec![KeyRef { layer: LayerId(7), prop: 1, time: Tick(50) }]);
+    }
+
     fn info(vertices: Vec<[f64; 2]>, closed: bool) -> PathInfo {
         let n = vertices.len();
         let sp = ShapePath { vertices, in_tangents: vec![[0.0; 2]; n], out_tangents: vec![[0.0; 2]; n], closed, feather: Vec::new() };
         PathInfo { layer: LayerId(3), uid: 7, m: Mat3::IDENTITY, sp, is_mask: true, feather: Vec::new() }
     }
 
+    fn circle() -> ShapePath {
+        let r = 38.0;
+        let h = r * 0.552_284_749_830_793_6;
+        ShapePath {
+            vertices: vec![[0.0, -r], [r, 0.0], [0.0, r], [-r, 0.0]],
+            in_tangents: vec![[-h, 0.0], [0.0, -h], [h, 0.0], [0.0, h]],
+            out_tangents: vec![[h, 0.0], [0.0, h], [-h, 0.0], [0.0, -h]],
+            closed: true,
+            feather: Vec::new(),
+        }
+    }
+
+    /// Measure the actual screen-space error against dense samples of the original cubics,
+    /// independently of the tessellator's chosen subdivisions.
+    fn screen_error(sp: &ShapePath, m: &Mat3, map: &ViewerMap, points: &[Pos2]) -> f32 {
+        let mut worst = 0.0_f32;
+        for i in 0..sp.vertices.len() {
+            let Some(c) = segment(sp, i) else { continue };
+            for step in 0..=1024 {
+                let q = cubic(c[0], c[1], c[2], c[3], f64::from(step) / 1024.0);
+                let q = m.apply(gv2(q[0], q[1]));
+                let p = map.to_screen([q.x, q.y]);
+                let distance = points
+                    .windows(2)
+                    .map(|pair| {
+                        let a = pair[0];
+                        let v = pair[1] - a;
+                        let t = if v.length_sq() > 0.0 { ((p - a).dot(v) / v.length_sq()).clamp(0.0, 1.0) } else { 0.0 };
+                        p.distance(a + v * t)
+                    })
+                    .fold(f32::INFINITY, f32::min);
+                worst = worst.max(distance);
+            }
+        }
+        worst
+    }
+
+    #[test]
+    fn curve_overlay_stays_smooth_at_viewer_magnifications() {
+        let sp = circle();
+        let mut counts = Vec::new();
+        for zoom in [0.5, 1.0, 5.0] {
+            let map = ViewerMap { origin: egui::pos2(121.25, 210.5), zoom, comp: [640.0, 400.0], area: Rect::EVERYTHING };
+            let points = flatten(&sp, &Mat3::IDENTITY, &map);
+            let error = screen_error(&sp, &Mat3::IDENTITY, &map, &points);
+            assert!(error <= 0.51, "{zoom}x: {error} screen points from the curve");
+            assert_eq!(points.first(), points.last(), "closed paths keep their closing edge");
+            for v in &sp.vertices {
+                let anchor = map.to_screen(*v);
+                assert!(points.iter().any(|p| p.distance(anchor) < 0.001), "original vertex missing at {zoom}x");
+            }
+            counts.push(points.len());
+        }
+        assert!(counts[0] < counts[1] && counts[1] < counts[2], "tessellation follows visible curve size: {counts:?}");
+    }
+
+    #[test]
+    fn curve_overlay_accounts_for_nonuniform_layer_and_group_transforms() {
+        let sp = circle();
+        let layer = Mat3::translate(gv2(70.0, 50.0)) * Mat3::rotate_deg(27.0) * Mat3::scale(gv2(3.2, 0.8));
+        let group = Mat3::rotate_deg(-19.0) * Mat3::skew_deg(25.0, 11.0) * Mat3::scale(gv2(0.7, 2.5));
+        let m = layer * group;
+        for zoom in [0.5, 1.0, 5.0] {
+            let map = ViewerMap { origin: egui::pos2(121.25, 210.5), zoom, comp: [640.0, 400.0], area: Rect::EVERYTHING };
+            let points = flatten(&sp, &m, &map);
+            let error = screen_error(&sp, &m, &map, &points);
+            assert!(error <= 0.51, "{zoom}x transformed path: {error} screen points from the curve");
+        }
+    }
+
+    #[test]
+    fn open_overlay_preserves_its_transformed_endpoints() {
+        let sp = info(vec![[10.0, 20.0], [50.0, 60.0]], false).sp;
+        let m = Mat3::translate(gv2(70.0, 50.0)) * Mat3::rotate_deg(27.0) * Mat3::scale(gv2(3.2, 0.8));
+        let map = ViewerMap { origin: egui::pos2(121.25, 210.5), zoom: 5.0, comp: [640.0, 400.0], area: Rect::EVERYTHING };
+        let points = flatten(&sp, &m, &map);
+        assert_ne!(points.first(), points.last(), "an open path must not gain a closing edge");
+        for (point, vertex) in [points.first(), points.last()].into_iter().zip([sp.vertices.first(), sp.vertices.last()]) {
+            let q = m.apply(gv2(vertex.unwrap()[0], vertex.unwrap()[1]));
+            assert!(point.unwrap().distance(map.to_screen([q.x, q.y])) < 0.001);
+        }
+    }
+
+    #[test]
+    fn invalid_overlay_coordinates_are_not_tessellated() {
+        let sp = circle();
+        for zoom in [f32::NAN, f32::INFINITY] {
+            let map = ViewerMap { origin: Pos2::ZERO, zoom, comp: [640.0, 400.0], area: Rect::EVERYTHING };
+            assert!(flatten(&sp, &Mat3::IDENTITY, &map).is_empty());
+        }
+        let map = ViewerMap { origin: Pos2::ZERO, zoom: 5.0, comp: [640.0, 400.0], area: Rect::EVERYTHING };
+        assert!(flatten(&sp, &Mat3::scale(gv2(f64::INFINITY, 1.0)), &map).is_empty());
+    }
+
+    #[test]
+    fn extreme_finite_overlay_scales_keep_subdivision_bounded() {
+        let map = ViewerMap { origin: Pos2::ZERO, zoom: 5.0, comp: [640.0, 400.0], area: Rect::EVERYTHING };
+        let sp = circle();
+        let points = flatten(&sp, &Mat3::scale(gv2(1e12, 1e12)), &map);
+        assert!(!points.is_empty());
+        assert!(points.len() < 10_000, "extreme scales must not allocate millions of vertices");
+        assert!(points.iter().all(|p| p.is_finite()));
+        assert!(flatten(&sp, &Mat3::scale(gv2(1e300, 1e300)), &map).is_empty());
+    }
+
     /// #912: clicking the last vertex of an open path with the Pen resumes that path.
     #[test]
     fn pen_resumes_an_open_path_at_its_last_vertex() {
diff --git a/crates/ui-egui/src/panels/viewer_text.rs b/crates/ui-egui/src/panels/viewer_text.rs
index 57b34b29d..d4a5c8ccf 100644
--- a/crates/ui-egui/src/panels/viewer_text.rs
+++ b/crates/ui-egui/src/panels/viewer_text.rs
@@ -14,7 +14,7 @@
 //! Every change runs an engine command (`text.*`, `layer.setText`, `edit.*`), so it's undoable and
 //! agents can do the same over the control channel.
 
-use effectcraft_engine::commands::text_edit::layer_doc;
+use effectcraft_engine::commands::text_edit::{ImeSurrounding, MAX_IME_TEXT_BYTES, ime_stamp_revision, ime_surrounding, layer_doc};
 use effectcraft_engine::geom::{Mat3, vec2 as gv2};
 use effectcraft_engine::keyframe::{Kerning, TextDoc};
 use effectcraft_engine::project::{Layer, LayerId, LayerSource};
@@ -40,11 +40,644 @@ enum Drag {
     Resize { layer: LayerId, handle: usize, start_box: [f64; 4] },
 }
 
+/// The `egui::Id` under which the in-progress text drag (selection, creation or box resize) is kept between frames.
 fn drag_id() -> egui::Id {
-    egui::Id::new("viewer-text-drag")
+    egui::Id::unique("viewer-text-drag")
 }
+/// The `egui::Id` of the invisible focusable widget that owns keyboard and IME focus while on-canvas text editing is
+/// active.
 fn focus_id() -> egui::Id {
-    egui::Id::new("viewer-text-focus")
+    egui::Id::unique("viewer-text-focus")
+}
+
+/// The immutable identity of one text-edit IME target.
+///
+/// The layer and the edit-session token are the whole owner. Caret, selection, text, revision
+/// and geometry are deliberately absent: ordinary IME edits keep this identity. Application caret
+/// changes interrupt the composition separately, without replacing this immutable target.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct ImeOwner {
+    layer: LayerId,
+    session: u64,
+}
+
+/// Last accepted selection for this viewport, separate from immutable target identity.
+/// IME deletes/commits advance it; application changes invalidate a live composition first.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct ImeSelection {
+    owner: ImeOwner,
+    anchor: usize,
+    caret: usize,
+}
+
+/// One viewport's visible IME pre-edit.
+///
+/// The text is only a drawing preview; it never enters the document. Its owner identifies the
+/// composition that produced it, so a preview can never survive a target switch.
+#[derive(Clone, Debug)]
+struct Preedit {
+    owner: ImeOwner,
+    text: String,
+}
+
+/// The input-method composition currently in flight for one viewport.
+///
+/// `TerminalPending` is an observed empty pre-edit: the input method cleared the visible
+/// composition, but its terminal commit/delete is a separate event and may still arrive. Keeping
+/// the owner means a target switch turns that state into `Stale`, so the pending old terminal event
+/// is rejected instead of being applied to the replacement.
+///
+/// `Stale` rejects an interrupted composition until its exact request-bound completion. Old
+/// terminals, empty/nonempty preedit and idle frames never acknowledge cancellation.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum ImeComposition {
+    Active(ImeOwner),
+    TerminalPending(ImeOwner),
+    Stale,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct OutputContext(egui::Id, u64, egui::IMEPurpose);
+
+impl From<&egui::output::IMEOutput> for OutputContext {
+    /// Copy the owner, context generation and purpose out of egui's IME output so they can be cached and compared
+    /// cheaply.
+    fn from(output: &egui::output::IMEOutput) -> Self {
+        Self(output.owner, output.context_generation, output.purpose)
+    }
+}
+
+#[derive(Clone, Debug)]
+struct ResetGuard {
+    request: Option<egui::ImeResetId>,
+    destination: Option<ImeSelection>,
+    committed: egui::ImeMutationStamp,
+    output: Option<OutputContext>,
+    suspended: bool,
+}
+
+/// The `egui::Id` under which this viewport's `ResetGuard` is stored.
+fn reset_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("effectcraft.ime.reset", viewport))
+}
+/// The `egui::Id` holding whether this viewport is currently inside a full UI pass (set by the pass hooks).
+fn mode_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("effectcraft.ime.ui-pass", viewport))
+}
+/// The `egui::Id` holding the last committed IME mutation stamp accepted for this viewport.
+fn committed_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("effectcraft.ime.committed", viewport))
+}
+/// The `egui::Id` holding the frame number whose text-editor keyboard events were already consumed.
+fn input_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("effectcraft.ime.input-frame", viewport))
+}
+/// The `egui::Id` holding whether this viewport may request an IME reset in the current pass.
+fn admission_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("effectcraft.ime.can-request", viewport))
+}
+
+/// Allow or forbid IME reset requests for the current viewport's pass by storing `allowed` in context data.
+fn set_admission(ctx: &egui::Context, allowed: bool) {
+    let id = admission_id(ctx.viewport_id());
+    ctx.data_mut(|data| data.insert_temp(id, allowed));
+}
+
+/// Whether the window can receive input: focused, not minimized and not occluded. Unknown viewport flags count as
+/// available.
+fn window_available(ctx: &egui::Context) -> bool {
+    ctx.input(|input| {
+        input.focused && input.viewport().focused.unwrap_or(true) && input.viewport().minimized != Some(true) && input.viewport().occluded != Some(true)
+    })
+}
+
+/// Install the per-pass IME hooks on `ctx` once: the begin hook marks a full UI pass and the end hook clears it.
+/// Later calls do nothing.
+pub(crate) fn install_hooks(ctx: &egui::Context) {
+    let id = egui::Id::unique("effectcraft.ime.hooks-installed");
+    let first = ctx.data_mut(|data| {
+        if data.get_temp::<bool>(id).unwrap_or(false) {
+            false
+        } else {
+            data.insert_temp(id, true);
+            true
+        }
+    });
+    if !first {
+        return;
+    }
+    ctx.on_begin_pass(
+        "EffectCraft IME pass begin",
+        std::sync::Arc::new(|ui| {
+            let id = mode_id(ui.ctx().viewport_id());
+            ui.ctx().data_mut(|data| data.insert_temp(id, true));
+        }),
+    );
+    ctx.on_end_pass(
+        "EffectCraft IME pass end",
+        std::sync::Arc::new(|ui| {
+            let id = mode_id(ui.ctx().viewport_id());
+            ui.ctx().data_mut(|data| data.insert_temp(id, false));
+        }),
+    );
+}
+
+/// Read the current viewport's pending reset guard, if any.
+fn read_reset(ctx: &egui::Context) -> Option<ResetGuard> {
+    let id = reset_id(ctx.viewport_id());
+    ctx.data(|data| data.get_temp(id))
+}
+
+/// Record a reset for the current viewport: request a fresh IME fence when this pass is admitted, then store the
+/// destination selection, committed stamp and output identity and mark the composition stale. An unadmitted pass
+/// stores a suspended guard instead.
+fn request_reset_with_output(app: &EffectcraftApp, ctx: &egui::Context, output: Option<OutputContext>) {
+    let viewport = ctx.viewport_id();
+    let allowed = ctx.data(|data| data.get_temp::<bool>(admission_id(viewport)).unwrap_or(false));
+    let request = if allowed { ctx.request_ime_reset(viewport) } else { None };
+    let guard = ResetGuard { request, destination: ime_selection(app), committed: ime_stamp(app, ctx), output, suspended: !allowed };
+    ctx.data_mut(|data| {
+        data.insert_temp(reset_id(viewport), guard);
+        data.insert_temp(ime_composition_id(viewport), ImeComposition::Stale);
+    });
+}
+
+/// Re-request a reset for the current viewport, keeping the output identity published earlier in the pass.
+fn request_reset(app: &EffectcraftApp, ctx: &egui::Context) {
+    let output = read_reset(ctx).and_then(|guard| guard.output);
+    request_reset_with_output(app, ctx, output);
+}
+
+/// Re-request the reset when an unsuspended guard's destination selection or committed stamp no longer matches the
+/// app.
+fn sync_reset(app: &EffectcraftApp, ctx: &egui::Context) {
+    if let Some(guard) = read_reset(ctx)
+        && !guard.suspended
+        && (guard.destination != ime_selection(app) || guard.committed != ime_stamp(app, ctx))
+    {
+        request_reset(app, ctx);
+    }
+}
+
+/// Retire the guard's request id locally and suspend it, so only a later eligible pass can request a new fence.
+fn suspend_reset(ctx: &egui::Context) {
+    if let Some(mut guard) = read_reset(ctx) {
+        guard.request = None;
+        guard.suspended = true;
+        let id = reset_id(ctx.viewport_id());
+        ctx.data_mut(|data| data.insert_temp(id, guard));
+    }
+}
+
+/// Accept `request` only when it is this viewport's current, unsuspended request and the destination and stamp still
+/// match; then sync target and selection, clear the composition and preview and remember the selection.
+fn complete_reset(app: &EffectcraftApp, ui: &egui::Ui, request: egui::ImeResetId) {
+    if !read_reset(ui.ctx()).is_some_and(|guard| !guard.suspended && guard.request == Some(request)) {
+        return;
+    }
+    sync_ime_target(ui, app);
+    sync_ime_selection(ui, app);
+    let ctx = ui.ctx();
+    let viewport = ctx.viewport_id();
+    if read_reset(ctx).is_some_and(|guard| {
+        !guard.suspended
+            && guard.request == Some(request)
+            && request.viewport_id() == viewport
+            && guard.destination == ime_selection(app)
+            && guard.committed == ime_stamp(app, ctx)
+    }) {
+        ctx.data_mut(|data| data.remove::<ResetGuard>(reset_id(viewport)));
+        set_ime_composition(ui, None);
+        clear_preedit(ui);
+        remember_ime_selection(ui, app);
+    }
+}
+
+/// Withhold custom IME controls for this pass: suspend the reset guard and drop every `ImeResetCompleted` event.
+/// No custom mutation route can be waiting for completion here; stock text widgets keep their keys and text events.
+fn unavailable_controls(ui: &egui::Ui) {
+    suspend_reset(ui.ctx());
+    // No custom mutation route runs here, so controls can only be obsolete. Stock text/keys
+    // remain in place for their actual TextEdit owner.
+    ui.ctx().input_mut(|input| input.events.retain(|event| !matches!(event, egui::Event::ImeResetCompleted { .. })));
+}
+
+/// Start a UI pass: revoke IME reset admission and clear the geometry published by the previous pass.
+pub(crate) fn begin_ui(ctx: &egui::Context) {
+    set_admission(ctx, false);
+    let id = ime_geometry_id(ctx.viewport_id());
+    ctx.data_mut(|data| data.remove::<ImeGeometry>(id));
+}
+
+/// Whether the text editor recorded its IME geometry in this pass of the current viewport.
+pub(crate) fn ime_recorded(ctx: &egui::Context) -> bool {
+    let viewport = ctx.viewport_id();
+    let pass = ctx.cumulative_pass_nr_for(viewport);
+    ctx.data(|d| d.get_temp::<ImeGeometry>(ime_geometry_id(viewport))).is_some_and(|(p, _, _)| p == pass)
+}
+
+/// Close a logic-only tick: when no full UI pass ran, revoke admission and resync and suspend the reset guard so a
+/// hidden tick never publishes IME state.
+pub(crate) fn finish_logic(app: &EffectcraftApp, ctx: &egui::Context) {
+    let id = mode_id(ctx.viewport_id());
+    if !ctx.data(|data| data.get_temp::<bool>(id).unwrap_or(false)) {
+        set_admission(ctx, false);
+        sync_reset(app, ctx);
+        suspend_reset(ctx);
+    }
+}
+
+type ImeGeometry = (u64, egui::Rect, egui::Rect);
+type SurroundingKey = (u64, u64, u64, u64, usize, usize, i64);
+
+#[derive(Clone, Debug)]
+struct SurroundingCache {
+    key: SurroundingKey,
+    value: Option<ImeSurrounding>,
+}
+
+/// The `egui::Id` under which this viewport's visible IME pre-edit preview is stored.
+fn ime_preedit_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-preedit", viewport))
+}
+/// The `egui::Id` under which this viewport's in-flight IME composition state is stored.
+fn ime_composition_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-ime-composition", viewport))
+}
+/// The `egui::Id` under which the current pass number, text region and caret rectangle are stored for the
+/// viewport IME publisher.
+fn ime_geometry_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-ime-geometry", viewport))
+}
+/// The `egui::Id` under which the last text-edit target given keyboard focus is stored.
+fn ime_seen_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-seen", viewport))
+}
+/// The `egui::Id` under which the last `ImeOwner` observed by `sync_ime_target` is stored.
+fn ime_target_seen_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-ime-target", viewport))
+}
+/// The `egui::Id` under which the last accepted IME selection is stored.
+fn ime_selection_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-ime-selection", viewport))
+}
+/// The `egui::Id` under which the last published IME owner and context generation are stored.
+fn ime_last_context_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-ime-last-context", viewport))
+}
+/// The `egui::Id` under which the bounded IME surrounding-text snapshot and its cache key are stored.
+fn ime_surrounding_cache_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-ime-surrounding", viewport))
+}
+/// The `egui::Id` under which the typing merge counter is stored.
+fn typing_key_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("viewer-text-typing", viewport))
+}
+
+/// The immutable IME owner of the current edit session.
+///
+/// The comp/layer target identity survives ordinary edits and caret moves. The edit session
+/// token distinguishes a target that reuses the same numeric ids (a restarted edit, a reopened
+/// project, undo that recreates the layer); a different comp or layer is a different owner. No
+/// caret, selection, text, document position or view geometry takes part.
+fn ime_target(app: &EffectcraftApp) -> Option<egui::ImeTarget> {
+    let comp = app.session.active_comp_id()?;
+    let edit = app.session.state.text_edit.as_ref()?;
+    Some(egui::ImeTarget::new(egui::Id::unique(("effectcraft-ime-text", comp.0, edit.layer.0)), edit.session))
+}
+
+/// The layer and edit-session token of the active text edit, or `None` when no editor is open. Caret, selection and
+/// text are deliberately excluded.
+fn ime_owner(app: &EffectcraftApp) -> Option<ImeOwner> {
+    let edit = app.session.state.text_edit.as_ref()?;
+    Some(ImeOwner { layer: edit.layer, session: edit.session })
+}
+
+/// The bounded committed snapshot used by an IME receipt.
+///
+/// The cached value is keyed by the exact state that can change it. Repeated observations in
+/// one pass/frame (receipts and the final descriptor) therefore reuse one bounded snapshot
+/// instead of evaluating an animated Source Text or scanning the document each time.
+fn ime_surrounding_cached(app: &EffectcraftApp, ctx: &egui::Context) -> Option<ImeSurrounding> {
+    let viewport = ctx.viewport_id();
+    let edit = app.session.state.text_edit.as_ref();
+    let key = (
+        app.session.revision,
+        app.session.active_comp_id().map_or(0, |c| c.0),
+        edit.map_or(0, |e| e.layer.0),
+        edit.map_or(0, |e| e.session),
+        edit.map_or(0, |e| e.anchor),
+        edit.map_or(0, |e| e.caret),
+        app.session.time().0,
+    );
+    if let Some(cache) = ctx.data(|d| d.get_temp::<SurroundingCache>(ime_surrounding_cache_id(viewport)))
+        && cache.key == key
+    {
+        return cache.value;
+    }
+    let value = ime_surrounding(&app.session);
+    ctx.data_mut(|d| d.insert_temp(ime_surrounding_cache_id(viewport), SurroundingCache { key, value: value.clone() }));
+    value
+}
+
+/// The committed-text stamp an IME receipt compares against: the bounded snapshot when it is available, else the
+/// editor revision marked unavailable. It deliberately does not use the global project revision, so an unrelated edit
+/// leaves a wide selection's stamp unchanged.
+fn ime_stamp(app: &EffectcraftApp, ctx: &egui::Context) -> egui::ImeMutationStamp {
+    match ime_surrounding_cached(app, ctx) {
+        Some(w) => egui::ImeMutationStamp::from_committed(&w.text, w.cursor, w.anchor, None),
+        // A global project revision would make an unrelated edit (an opacity undo) look like a
+        // mutation of a wide selection. The editor revision only moves with committed text and
+        // the editor session.
+        None => egui::ImeMutationStamp::unavailable_at_revision(ime_stamp_revision(&app.session)),
+    }
+}
+
+/// Record an accepted IME commit/delete mutation for this viewport and frame.
+///
+/// Call it only after the command succeeded and actually changed the committed text (`before`
+/// and `after` are captured immediately around that mutation). Rejected events, no-ops and
+/// failed commands earn no receipt.
+fn note_ime_receipt(app: &mut EffectcraftApp, ctx: &egui::Context, before: egui::ImeMutationStamp, after: egui::ImeMutationStamp) {
+    let Some(target) = ime_target(app) else { return };
+    let viewport = ctx.viewport_id();
+    let frame = ctx.cumulative_frame_nr_for(viewport);
+    app.ime_tracker.note_input_method_apply(viewport, frame, target, before, after);
+}
+
+/// Record an application edit only when it actually changed the committed snapshot.
+///
+/// A no-op (Backspace at the start of the document, a failed command) must not poison a later
+/// accepted IME commit in the same frame.
+fn note_ime_application_edit(app: &mut EffectcraftApp, ctx: &egui::Context, before: egui::ImeMutationStamp) {
+    if ime_stamp(app, ctx) != before {
+        note_ime_application_change(app, ctx);
+    }
+}
+
+/// Record application-origin work (typing, paste, undo, automatic correction, ...) so `Other`
+/// dominates every remaining pass of the frame.
+fn note_ime_application_change(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    let Some(target) = ime_target(app) else { return };
+    let viewport = ctx.viewport_id();
+    let frame = ctx.cumulative_frame_nr_for(viewport);
+    app.ime_tracker.note_application_change(viewport, frame, target);
+}
+
+/// Drop this viewport's visible pre-edit preview.
+fn clear_preedit(ui: &egui::Ui) {
+    let viewport = ui.ctx().viewport_id();
+    ui.data_mut(|d| d.remove::<Preedit>(ime_preedit_id(viewport)));
+}
+
+/// Read this viewport's in-flight IME composition state.
+fn read_ime_composition(ui: &egui::Ui) -> Option<ImeComposition> {
+    let viewport = ui.ctx().viewport_id();
+    ui.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(viewport)))
+}
+
+/// Store this viewport's composition state, or remove it with `None`.
+fn set_ime_composition(ui: &egui::Ui, composition: Option<ImeComposition>) {
+    let viewport = ui.ctx().viewport_id();
+    ui.data_mut(|d| match composition {
+        Some(composition) => {
+            d.insert_temp(ime_composition_id(viewport), composition);
+        }
+        None => d.remove::<ImeComposition>(ime_composition_id(viewport)),
+    });
+}
+
+/// Mark the composition in flight as interrupted by application work.
+///
+/// A live visible composition (`Active`) or an observed empty pre-edit whose terminal event is
+/// still pending (`TerminalPending`) needs a tombstone; there is no lingering event to reject when
+/// no pre-edit was seen. Repeated hidden passes retire an already guarded activation without
+/// allocating again; reactivation requests a new fence. Missing acknowledgement stays closed.
+fn invalidate_ime_composition(ui: &egui::Ui, app: &EffectcraftApp) {
+    if matches!(read_ime_composition(ui), Some(ImeComposition::Active(_) | ImeComposition::TerminalPending(_))) {
+        set_ime_composition(ui, Some(ImeComposition::Stale));
+        request_reset(app, ui.ctx());
+    }
+}
+
+/// Keep the composition lifecycle aligned with the current edit target.
+///
+/// A target change or the end of the edit invalidates a visible composition or an observed empty
+/// pre-edit with a still-pending terminal event, and clears the visible preview. The tombstone is
+/// kept across arbitrary idle frames until the exact request-bound completion is observed.
+fn sync_ime_target(ui: &egui::Ui, app: &EffectcraftApp) {
+    let viewport = ui.ctx().viewport_id();
+    let current = ime_owner(app);
+    let previous = ui.data(|d| d.get_temp::<Option<ImeOwner>>(ime_target_seen_id(viewport))).flatten();
+    if previous == current {
+        return;
+    }
+    if previous.is_some() {
+        // The previous target was replaced or the editor ended. Any composition it had is now
+        // stale, including one whose next pre-edit/commit arrives in a later raw batch.
+        invalidate_ime_composition(ui, app);
+    }
+    // The preview belongs to the previous target even when the new one has the same numeric ids.
+    clear_preedit(ui);
+    ui.data_mut(|d| d.insert_temp(ime_target_seen_id(viewport), current));
+}
+
+/// The active text edit's owner, anchor and caret, or `None` when no editor is open.
+fn ime_selection(app: &EffectcraftApp) -> Option<ImeSelection> {
+    let edit = app.session.state.text_edit.as_ref()?;
+    Some(ImeSelection { owner: ime_owner(app)?, anchor: edit.anchor, caret: edit.caret })
+}
+
+/// Accept the selection resulting from an IME event without cancelling its remaining events.
+fn remember_ime_selection(ui: &egui::Ui, app: &EffectcraftApp) {
+    let viewport = ui.ctx().viewport_id();
+    let selection = ime_selection(app);
+    ui.data_mut(|d| d.insert_temp(ime_selection_id(viewport), selection));
+    let stamp = ime_stamp(app, ui.ctx());
+    ui.data_mut(|d| d.insert_temp(committed_id(viewport), stamp));
+}
+
+/// An application caret/selection change cannot inherit the old composition's mutations.
+/// Run before IME dispatch, and after application events, while the old selection is still
+/// recorded. Accepted IME events update that record separately: their own delete must not
+/// invalidate the commit that follows it.
+fn sync_ime_selection(ui: &egui::Ui, app: &EffectcraftApp) {
+    let viewport = ui.ctx().viewport_id();
+    let previous = ui.data(|d| d.get_temp::<Option<ImeSelection>>(ime_selection_id(viewport))).flatten();
+    let committed = ui.data(|data| data.get_temp::<egui::ImeMutationStamp>(committed_id(viewport)));
+    let changed = previous != ime_selection(app) || committed.is_some_and(|previous| previous != ime_stamp(app, ui.ctx()));
+    if changed && matches!(read_ime_composition(ui), Some(ImeComposition::Active(_) | ImeComposition::TerminalPending(_))) {
+        invalidate_ime_composition(ui, app);
+        clear_preedit(ui);
+    }
+    sync_reset(app, ui.ctx());
+    remember_ime_selection(ui, app);
+}
+
+/// Truncate a pre-edit preview to `MAX_IME_TEXT_BYTES` on a character boundary, so no character is split.
+fn bounded_preedit(mut text: String) -> String {
+    if text.len() > MAX_IME_TEXT_BYTES {
+        let mut end = MAX_IME_TEXT_BYTES;
+        while end > 0 && !text.is_char_boundary(end) {
+            end -= 1;
+        }
+        text.truncate(end);
+    }
+    text
+}
+
+/// Read this viewport's visible pre-edit preview, whatever owner it belongs to.
+fn read_preedit(ui: &egui::Ui) -> Option<Preedit> {
+    let viewport = ui.ctx().viewport_id();
+    ui.data(|d| d.get_temp::<Preedit>(ime_preedit_id(viewport)))
+}
+
+/// Clear a preview that belongs to `owner`, leaving any other viewport's guard untouched.
+fn clear_current_preedit(ui: &egui::Ui, owner: ImeOwner) {
+    if read_preedit(ui).is_some_and(|p| p.owner == owner) {
+        clear_preedit(ui);
+    }
+}
+
+/// Whether an incoming IME mutation belongs to the currently edited composition.
+///
+/// With no composition a direct commit/delete (platforms may send one without a preview) is
+/// accepted. Once a composition is visible or has an observed empty pre-edit awaiting its terminal
+/// event, only its matching owner and uninterrupted selection may mutate the document. A target
+/// switch or application caret change leaves a tombstone rejecting the interrupted composition.
+fn ime_event_is_stale(ui: &egui::Ui, owner: ImeOwner) -> bool {
+    match read_ime_composition(ui) {
+        Some(ImeComposition::Stale) => true,
+        Some(ImeComposition::Active(active) | ImeComposition::TerminalPending(active)) => active != owner,
+        None => false,
+    }
+}
+
+/// The pre-edit text to draw, only when it belongs to the current edit owner and is non-empty.
+fn visible_preedit(ui: &egui::Ui, app: &EffectcraftApp) -> Option<String> {
+    let owner = ime_owner(app)?;
+    let p = read_preedit(ui)?;
+    (p.owner == owner && !p.text.is_empty()).then_some(p.text)
+}
+
+/// Publish the descriptor from this viewport's current text state and recorded geometry.
+///
+/// The root viewport publishes after dock actions, ScriptUI, learn and dialogs. Native panel
+/// windows publish after the IME-owning body records geometry and again after their last body;
+/// publication can therefore precede later bodies in that window. The overlay only records
+/// geometry; this function resolves the current owner and availability when it publishes.
+pub(crate) fn finish_ime(app: &mut EffectcraftApp, ui: &egui::Ui) {
+    let ctx = ui.ctx();
+    let viewport = ctx.viewport_id();
+    let frame = ctx.cumulative_frame_nr_for(viewport);
+    let pass = ctx.cumulative_pass_nr_for(viewport);
+    let geometry = ctx.data(|d| d.get_temp::<ImeGeometry>(ime_geometry_id(viewport))).filter(|(p, _, _)| *p == pass);
+    // The window itself must be focused too: a forced hidden-window UI pass keeps egui's widget
+    // focus, but no input method may target it. `None` is "unknown" (tests, some platforms).
+    let window_focused = window_available(ctx);
+    let focused = geometry.is_some() && window_focused && ui.is_enabled() && app.dialog.is_none() && ctx.memory(|m| m.has_focus(focus_id()));
+    // Resolve availability, but withhold admission from the synchronizers: they may retire a
+    // guard and must not allocate before this pass's actual output is known. Otherwise a
+    // destination change in sync could allocate one ID and the output-identity check below a
+    // second ID in the same pass.
+    set_admission(ctx, false);
+    sync_ime_target(ui, app);
+    sync_ime_selection(ui, app);
+    let update = match (ime_target(app).filter(|_| focused), geometry) {
+        (Some(target), Some((_, _rect, _cursor_rect))) => {
+            let window = ime_surrounding_cached(app, ctx);
+            let committed = window.as_ref().map(|w| egui::CommittedText::new(&w.text, w.cursor, w.anchor));
+            // An unavailable observation still carries the editor revision: it is the only
+            // identity an IME receipt has when the selection is wider than the platform limit,
+            // and it must match `ime_stamp`'s revision exactly.
+            let observation = egui::ImeObservation::new(frame, pass, target).committed(committed).unavailable_revision(ime_stamp_revision(&app.session));
+            app.ime_tracker.observe(viewport, Some(observation))
+        }
+        _ => {
+            app.ime_tracker.observe(viewport, None);
+            // Losing custom publication retires the old ID. Returning to the same editor must
+            // request a new fence rather than await a discarded or foreign descriptor's ID.
+            invalidate_ime_composition(ui, app);
+            clear_preedit(ui);
+            None
+        }
+    };
+    let custom = update.as_ref().map(|update| OutputContext(update.owner, update.context_generation, update.purpose));
+    if let Some(update) = update {
+        let key = (update.owner, update.context_generation);
+        let previous = ctx.data(|d| d.get_temp::<(egui::Id, u64)>(ime_last_context_id(viewport)));
+        // A new owner or replacement epoch on the same widget focus must cancel the platform's
+        // composition too; waiting for egui's focus change is not enough on Windows/macOS/X11.
+        let interrupt = previous.is_some_and(|p| p != key);
+        if interrupt {
+            ctx.memory_mut(|m| m.interrupt_ime());
+        }
+        ctx.data_mut(|d| d.insert_temp(ime_last_context_id(viewport), key));
+        ctx.output_mut(|o| {
+            o.ime = Some(egui::output::IMEOutput {
+                owner: update.owner,
+                context_generation: update.context_generation,
+                purpose: update.purpose,
+                rect: geometry.map_or(egui::Rect::NOTHING, |(_, r, _)| r),
+                cursor_rect: geometry.map_or(egui::Rect::NOTHING, |(_, _, c)| c),
+                should_interrupt_composition: interrupt,
+                reset_request: None,
+                change_cause: update.change_cause,
+                surrounding_text: update.surrounding_text,
+            });
+        });
+    } else {
+        // Clear only this custom editor's descriptor. A stock TextEdit that drew later in the
+        // same pass owns `output.ime` now and must keep it.
+        let previous = ctx.data(|d| d.get_temp::<(egui::Id, u64)>(ime_last_context_id(viewport)));
+        ctx.output_mut(|o| {
+            if previous.is_some_and(|(owner, _)| o.ime.as_ref().is_some_and(|ime| ime.owner == owner)) {
+                o.ime = None;
+            }
+        });
+    }
+    // `ctx.output` here is the descriptor this function just wrote, not proof that the host
+    // accepted it. On the publishing path `actual == custom` is true by construction, so it is
+    // only a defensive no-update check (there `custom.is_none()` already decides). The real
+    // foreign/stock protection is the owner check in the no-update branch above, not this test.
+    let actual = ctx.output(|output| output.ime.as_ref().map(OutputContext::from));
+    let eligible = focused && custom.is_some() && actual == custom;
+    set_admission(ctx, eligible);
+    if !eligible {
+        unavailable_controls(ui);
+    } else if let Some(guard) = read_reset(ctx) {
+        // The confirmed eligible finalizer makes the one destination/output-aware allocation
+        // for this pass. A suspended or superseded guard was retired locally by the
+        // synchronizers; only here is a new request put into core Memory, carrying the output
+        // context actually published above.
+        if guard.suspended || guard.destination != ime_selection(app) || guard.output.is_some_and(|old| Some(old) != custom) {
+            request_reset_with_output(app, ctx, custom);
+        } else if let Some(mut guard) = read_reset(ctx) {
+            guard.output = custom;
+            ctx.data_mut(|data| data.insert_temp(reset_id(viewport), guard));
+        }
+    }
+}
+
+/// Release one native viewport's IME data and tracker state.
+pub(crate) fn end_viewport(app: &mut EffectcraftApp, ctx: &egui::Context, viewport: egui::ViewportId) {
+    ctx.data_mut(|d| {
+        d.remove::<Preedit>(ime_preedit_id(viewport));
+        d.remove::<ImeComposition>(ime_composition_id(viewport));
+        d.remove::<ImeGeometry>(ime_geometry_id(viewport));
+        d.remove::<Option<(u64, u64)>>(ime_seen_id(viewport));
+        d.remove::<Option<ImeOwner>>(ime_target_seen_id(viewport));
+        d.remove::<Option<ImeSelection>>(ime_selection_id(viewport));
+        d.remove::<(egui::Id, u64)>(ime_last_context_id(viewport));
+        d.remove::<SurroundingCache>(ime_surrounding_cache_id(viewport));
+        d.remove::<u64>(typing_key_id(viewport));
+        d.remove::<ResetGuard>(reset_id(viewport));
+        d.remove::<egui::ImeMutationStamp>(committed_id(viewport));
+        d.remove::<u64>(input_id(viewport));
+        d.remove::<bool>(mode_id(viewport));
+        d.remove::<bool>(admission_id(viewport));
+    });
+    app.ime_tracker.end_viewport(viewport);
 }
 
 /// The geometry of an edited text layer.
@@ -158,13 +791,17 @@ fn keeps_text_edit(p: PanelKind) -> bool {
 pub fn panel_clicked(app: &mut EffectcraftApp, ctx: &egui::Context, p: PanelKind) {
     if app.session.state.text_edit.is_some() && !keeps_text_edit(p) {
         exec(app, "text.endEdit", json!({}));
+        // `viewport_id()` takes the context's lock itself, so resolve it before entering
+        // `data_mut`; nesting the two calls deadlocks.
+        let viewport = ctx.viewport_id();
+        ctx.data_mut(|d| d.remove::<Preedit>(ime_preedit_id(viewport)));
         ctx.memory_mut(|m| m.surrender_focus(focus_id()));
     }
 }
 
 /// Typing merge key: consecutive keystrokes fold into one undo step until the caret moves.
 fn typing_key(ui: &egui::Ui, bump: bool) -> String {
-    let id = egui::Id::new("viewer-text-typing");
+    let id = typing_key_id(ui.ctx().viewport_id());
     let mut n: u64 = ui.data(|d| d.get_temp(id)).unwrap_or(0);
     if bump {
         n += 1;
@@ -173,6 +810,91 @@ fn typing_key(ui: &egui::Ui, bump: bool) -> String {
     format!("text-typing-{n}")
 }
 
+/// A press inside the edited text layer: grab a box handle, place the caret (shift extends from
+/// `shift_anchor`), or, outside the text, commit the edit. Returns the drag it starts, if any.
+fn press_on_edited(app: &mut EffectcraftApp, ui: &egui::Ui, map: &ViewerMap, e: &Edited, pos: Pos2, shift_anchor: Option<usize>) -> Option<Drag> {
+    if let Some(h) = e.handles().iter().position(|h| e.to_screen(map, *h).distance(pos) < 7.0) {
+        let b = e.doc.box_size.unwrap_or([0.0; 2]);
+        return Some(Drag::Resize { layer: e.layer.id, handle: h, start_box: [e.doc.box_pos[0], e.doc.box_pos[1], b[0], b[1]] });
+    }
+    if e.contains(map, pos) {
+        let ci = e.hit(map, pos);
+        exec(app, "text.setSelection", json!({"anchor": shift_anchor.unwrap_or(ci), "caret": ci}));
+        typing_key(ui, true);
+        return Some(Drag::Select { layer: e.layer.id });
+    }
+    // Clicking elsewhere commits the edit.
+    exec(app, "text.endEdit", json!({}));
+    None
+}
+
+/// A press with the Type tool that missed the edited text: edit the text layer under it, or
+/// start creating a new one.
+fn press_type_tool(app: &mut EffectcraftApp, ectx: &EvalCtx, map: &ViewerMap, pos: Pos2, tool: Tool) -> Drag {
+    if let Some(e) = text_layer_at(app, ectx, map, pos, true) {
+        let ci = e.hit(map, pos);
+        exec(app, "text.edit", json!({"layer": e.layer.id.0, "caret": ci}));
+        Drag::Select { layer: e.layer.id }
+    } else {
+        Drag::Create { start: map.to_comp(pos), vertical: tool == Tool::TypeVertical }
+    }
+}
+
+/// The paragraph box after dragging `handle` by (`dx`, `dy`) in layer space.
+fn resized_box(start_box: [f64; 4], handle: usize, dx: f64, dy: f64) -> [f64; 4] {
+    let [mut x0, mut y0, w, h] = start_box;
+    let (mut x1, mut y1) = (x0 + w, y0 + h);
+    if matches!(handle, 0 | 6 | 7) {
+        x0 += dx;
+    }
+    if matches!(handle, 2..=4) {
+        x1 += dx;
+    }
+    if matches!(handle, 0..=2) {
+        y0 += dy;
+    }
+    if matches!(handle, 4..=6) {
+        y1 += dy;
+    }
+    [x0.min(x1), y0.min(y1), (x1 - x0).abs().max(4.0), (y1 - y0).abs().max(4.0)]
+}
+
+/// Keyboard routing for the text editor: while a session is live, keep the focus on it and feed
+/// it this frame's keys; otherwise release the IME and the focus.
+fn keyboard_focus(app: &mut EffectcraftApp, ui: &mut egui::Ui, rect: Rect) {
+    if app.session.state.text_edit.is_some() && app.dialog.is_none() && ui.is_enabled() {
+        // Register after pointer handling so new edits take focus in this frame. An inactive
+        // editor must not take Tab focus and immediately surrender it before viewer controls.
+        ui.interact(Rect::from_min_size(rect.min, vec2(1.0, 1.0)), focus_id(), egui::Sense::focusable_noninteractive());
+        ui.memory_mut(|m| {
+            m.set_focus_lock_filter(focus_id(), egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, escape: true });
+        });
+        // A session started elsewhere (menu, agent, Properties) takes the keyboard once…
+        let seen = ime_seen_id(ui.ctx().viewport_id());
+        let key = app.session.state.text_edit.as_ref().map(|e| (e.layer.0, e.session));
+        // …and gets it back when a click in the viewer or a formatting panel left nothing holding
+        // it; not merely because nothing has the focus (#831).
+        let regain = ui.memory(|m| m.focused().is_none()) && keeps_text_edit(app.ui.focused);
+        if ui.data(|d| d.get_temp::<Option<(u64, u64)>>(seen)).flatten() != key || regain {
+            ui.data_mut(|d| d.insert_temp(seen, key));
+            ui.memory_mut(|m| m.request_focus(focus_id()));
+        }
+        if ui.memory(|m| m.has_focus(focus_id())) {
+            keyboard(app, ui, rect);
+        }
+    } else {
+        // Resolve the viewport before taking the data lock: `viewport_id()`
+        // acquires the same context lock that `data_mut` holds.
+        let viewport = ui.ctx().viewport_id();
+        ui.data_mut(|d| d.insert_temp::<Option<(u64, u64)>>(ime_seen_id(viewport), None));
+        invalidate_ime_composition(ui, app);
+        clear_preedit(ui);
+        if ui.memory(|m| m.has_focus(focus_id())) {
+            ui.memory_mut(|m| m.surrender_focus(focus_id()));
+        }
+    }
+}
+
 /// Viewer hook: draws the edit overlay and handles text pointer and keyboard input. Returns
 /// true when it owns this frame's pointer interaction (the viewer then skips its own gestures).
 pub fn hook(
@@ -186,7 +908,9 @@ pub fn hook(
 ) -> bool {
     let tool = app.ui.tool;
     let type_tool = matches!(tool, Tool::Type | Tool::TypeVertical);
-    let last_tool_id = egui::Id::new("viewer-text-last-tool");
+    sync_ime_target(ui, app);
+    sync_ime_selection(ui, app);
+    let last_tool_id = egui::Id::unique("viewer-text-last-tool");
     let last_tool = ui.data(|d| d.get_temp::<Tool>(last_tool_id));
     ui.data_mut(|d| d.insert_temp(last_tool_id, tool));
     if last_tool.is_some_and(|previous| matches!(previous, Tool::Type | Tool::TypeVertical) && !type_tool) {
@@ -204,9 +928,21 @@ pub fn hook(
     let mut owns = false;
     let mut drag: Option<Drag> = ui.data(|d| d.get_temp(drag_id()));
     let (pressed, down, released, mods) = ui.input(|i| (i.pointer.primary_pressed(), i.pointer.primary_down(), i.pointer.primary_released(), i.modifiers));
-    let press = ui.input(|i| i.pointer.press_origin());
+    // The latest primary press of this frame. `press_origin` is already cleared when a press and
+    // release arrive in one frame; the input events retain the latest press even after release.
+    // An invalid latest press
+    // must not become an earlier click or a release-position click.
+    let press = ui.input(|i| {
+        let latest = i.events.iter().rev().find_map(|event| match event {
+            egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, .. } => Some(*pos),
+            _ => None,
+        });
+        match latest {
+            Some(pos) => pos.is_finite().then_some(pos),
+            None => i.pointer.press_origin().filter(|pos| pos.is_finite()),
+        }
+    });
     let pointer = ui.input(|i| i.pointer.interact_pos());
-    let handle_hit = |e: &Edited, s: Pos2| e.handles().iter().position(|h| e.to_screen(map, *h).distance(s) < 7.0);
 
     // ---- press
     if pressed
@@ -214,33 +950,18 @@ pub fn hook(
         && resp.hovered()
         && !matches!(tool, Tool::Hand | Tool::Zoom)
         && let Some(pos) = press
+        && resp.rect.intersect(ui.clip_rect()).contains(pos)
     {
         let mut handled = false;
         if let Some(e) = &cur {
-            if let Some(h) = handle_hit(e, pos) {
-                let b = e.doc.box_size.unwrap_or([0.0; 2]);
-                drag = Some(Drag::Resize { layer: e.layer.id, handle: h, start_box: [e.doc.box_pos[0], e.doc.box_pos[1], b[0], b[1]] });
+            let shift_anchor = if mods.shift { Some(editing.as_ref().map_or_else(|| e.hit(map, pos), |sel| sel.anchor)) } else { None };
+            if let Some(d) = press_on_edited(app, ui, map, e, pos, shift_anchor) {
+                drag = Some(d);
                 handled = true;
-            } else if e.contains(map, pos) {
-                let ci = e.hit(map, pos);
-                let anchor = if mods.shift { editing.as_ref().map_or(ci, |sel| sel.anchor) } else { ci };
-                exec(app, "text.setSelection", json!({"anchor": anchor, "caret": ci}));
-                typing_key(ui, true);
-                drag = Some(Drag::Select { layer: e.layer.id });
-                handled = true;
-            } else {
-                // Clicking elsewhere commits the edit.
-                exec(app, "text.endEdit", json!({}));
             }
         }
         if !handled && type_tool {
-            if let Some(e) = text_layer_at(app, ectx, map, pos, true) {
-                let ci = e.hit(map, pos);
-                exec(app, "text.edit", json!({"layer": e.layer.id.0, "caret": ci}));
-                drag = Some(Drag::Select { layer: e.layer.id });
-            } else {
-                drag = Some(Drag::Create { start: map.to_comp(pos), vertical: tool == Tool::TypeVertical });
-            }
+            drag = Some(press_type_tool(app, ectx, map, pos, tool));
             handled = true;
         }
         if handled {
@@ -295,22 +1016,7 @@ pub fn hook(
             {
                 let (px, py) = e.to_layer(map, p);
                 let (qx, qy) = e.to_layer(map, q);
-                let (dx, dy) = (px - qx, py - qy);
-                let [mut x0, mut y0, w, h] = start_box;
-                let (mut x1, mut y1) = (x0 + w, y0 + h);
-                if matches!(handle, 0 | 6 | 7) {
-                    x0 += dx;
-                }
-                if matches!(handle, 2..=4) {
-                    x1 += dx;
-                }
-                if matches!(handle, 0..=2) {
-                    y0 += dy;
-                }
-                if matches!(handle, 4..=6) {
-                    y1 += dy;
-                }
-                let bx = [x0.min(x1), y0.min(y1), (x1 - x0).abs().max(4.0), (y1 - y0).abs().max(4.0)];
+                let bx = resized_box(start_box, handle, px - qx, py - qy);
                 exec(app, "layer.setText", json!({"layer": layer.0, "box": bx, "merge": format!("text-box-{}", layer.0)}));
             }
         }
@@ -352,38 +1058,19 @@ pub fn hook(
     }
 
     // ---- keyboard
-    if app.session.state.text_edit.is_some() && app.dialog.is_none() && ui.is_enabled() {
-        // Register after pointer handling so new edits take focus in this frame. An inactive
-        // editor must not take Tab focus and immediately surrender it before viewer controls.
-        ui.interact(Rect::from_min_size(resp.rect.min, vec2(1.0, 1.0)), focus_id(), egui::Sense::focusable_noninteractive());
-        ui.memory_mut(|m| {
-            m.set_focus_lock_filter(focus_id(), egui::EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, escape: true });
-        });
-        // A session started elsewhere (menu, agent, Properties) takes the keyboard once…
-        let seen = egui::Id::new("viewer-text-seen");
-        let key = app.session.state.text_edit.as_ref().map(|e| e.layer.0);
-        // …and gets it back when a click in the viewer or a formatting panel left nothing holding
-        // it; not merely because nothing has the focus (#831).
-        let regain = ui.memory(|m| m.focused().is_none()) && keeps_text_edit(app.ui.focused);
-        if ui.data(|d| d.get_temp::<Option<u64>>(seen)).flatten() != key || regain {
-            ui.data_mut(|d| d.insert_temp(seen, key));
-            ui.memory_mut(|m| m.request_focus(focus_id()));
-        }
-        if ui.memory(|m| m.has_focus(focus_id())) {
-            keyboard(app, ui, resp.rect);
-        }
-    } else {
-        ui.data_mut(|d| d.insert_temp::<Option<u64>>(egui::Id::new("viewer-text-seen"), None));
-        if ui.memory(|m| m.has_focus(focus_id())) {
-            ui.memory_mut(|m| m.surrender_focus(focus_id()));
-        }
-    }
+    // Pointer handling above may have started or switched a text target: leave the previous
+    // composition's identity as a stale guard before this pass's IME events are read.
+    sync_ime_target(ui, app);
+    sync_ime_selection(ui, app);
+    keyboard_focus(app, ui, resp.rect);
 
     // ---- overlay
     if let Some(s) = app.session.state.text_edit.clone()
         && let Some(e) = edited(app, ectx, s.layer)
     {
         draw(app, ui, painter, map, &e, s.range(), s.caret);
+        // `draw` records the caret geometry for this pass. The descriptor is published once at
+        // the end of the whole pass, after dock/script actions have had their say.
     }
     owns
 }
@@ -392,23 +1079,144 @@ pub fn hook(
 /// panel it lands in decides (after this frame's panels) whether the edit ends, so the keys after
 /// it in this frame are neither typed nor run as shortcuts (#831).
 fn keyboard(app: &mut EffectcraftApp, ui: &mut egui::Ui, viewer: Rect) {
+    let viewport = ui.ctx().viewport_id();
+    let frame = ui.ctx().cumulative_frame_nr_for(viewport);
+    let first = ui.data_mut(|data| {
+        if data.get_temp::<u64>(input_id(viewport)) == Some(frame) {
+            false
+        } else {
+            data.insert_temp(input_id(viewport), frame);
+            true
+        }
+    });
+    if !first {
+        return;
+    }
+    if !window_available(ui.ctx()) {
+        set_admission(ui.ctx(), false);
+        unavailable_controls(ui);
+        return;
+    }
+    set_admission(ui.ctx(), true);
+    sync_ime_selection(ui, app);
     let events = ui.input(|i| i.events.clone());
     let ctx = ui.ctx().clone();
+    // This clone is the exclusive ordered owner of controls. Removing only those controls from
+    // the shared vector does not acknowledge them or move them ahead of preceding mutations.
+    ctx.input_mut(|input| input.events.retain(|event| !matches!(event, egui::Event::ImeResetCompleted { .. })));
+    let mut custom_mutations = app.session.state.text_edit.is_some();
     for ev in events {
-        let Some(sel) = app.session.state.text_edit.clone() else { return };
-        match ev {
-            egui::Event::PointerButton { pos, pressed: true, .. } if !viewer.contains(pos) => return,
-            egui::Event::Text(t) if !t.chars().any(char::is_control) => {
-                let k = typing_key(ui, false);
-                exec(app, "text.insert", json!({"text": t, "merge": k}));
+        if let egui::Event::ImeResetCompleted { request_id } = &ev {
+            if custom_mutations {
+                complete_reset(app, ui, *request_id);
             }
-            egui::Event::Ime(egui::ImeEvent::Commit(t)) if !t.is_empty() => {
+            continue;
+        }
+        sync_ime_target(ui, app);
+        sync_ime_selection(ui, app);
+        if matches!(&ev, egui::Event::PointerButton { pos, pressed: true, .. } if !viewer.contains(*pos)) {
+            // The press already proves this custom route is leaving (or deferring to the panel
+            // that owns the click). Disable admission before invalidating, so retiring the old
+            // guard cannot put a new, undeliverable ID into core Memory. The finalizer allocates
+            // the one replacement only after it confirms this pass's actual custom output is
+            // eligible. A previously issued ID may still be queued in core (which has no cancel)
+            // and attach to a later stock field; the suspended local guard ignores its completion.
+            set_admission(&ctx, false);
+            invalidate_ime_composition(ui, app);
+            clear_preedit(ui);
+            suspend_reset(&ctx);
+            custom_mutations = false;
+            continue;
+        }
+        if !custom_mutations {
+            continue;
+        }
+        let Some(sel) = app.session.state.text_edit.clone() else {
+            suspend_reset(&ctx);
+            custom_mutations = false;
+            continue;
+        };
+        let owner = ImeOwner { layer: sel.layer, session: sel.session };
+        let from_ime = matches!(&ev, egui::Event::Ime(_));
+        match ev {
+            egui::Event::Text(t) if !t.chars().any(char::is_control) => {
+                clear_current_preedit(ui, owner);
                 let k = typing_key(ui, false);
-                exec(app, "text.insert", json!({"text": t, "merge": k}));
-                ui.data_mut(|d| d.remove::<String>(egui::Id::new("viewer-text-preedit")));
+                let before = ime_stamp(app, &ctx);
+                if exec(app, "text.insert", json!({"text": t, "merge": k})).is_some() {
+                    note_ime_application_edit(app, &ctx, before);
+                }
+            }
+            egui::Event::Ime(egui::ImeEvent::Commit(t)) => {
+                // Old terminal payloads cannot acknowledge the request or admit a later suffix.
+                if ime_event_is_stale(ui, owner) {
+                    continue;
+                }
+                // An accepted commit is the terminal event of its composition (or a direct commit
+                // that never had a pre-edit).
+                set_ime_composition(ui, None);
+                // An empty commit (the tail of a deletion-only batch) changes no text, so it earns
+                // no receipt; it still ends the composed preview.
+                if !t.is_empty() {
+                    let k = typing_key(ui, false);
+                    // The receipt covers only this accepted insertion: AutoCorrect and every
+                    // other application transformation stays outside it.
+                    let before = ime_stamp(app, &ctx);
+                    if exec(app, "text.insert", json!({"text": t, "merge": k})).is_some() {
+                        let after = ime_stamp(app, &ctx);
+                        note_ime_receipt(app, &ctx, before, after);
+                    }
+                }
+                clear_preedit(ui);
             }
             egui::Event::Ime(egui::ImeEvent::Preedit { text, .. }) => {
-                ui.data_mut(|d| d.insert_temp(egui::Id::new("viewer-text-preedit"), text));
+                if text.is_empty() {
+                    // An empty pre-edit only clears the visible composition. Keep its owner as
+                    // terminal-pending: the commit/delete for this composition is a separate
+                    // event and a target switch must reject it. Only the matching fence can
+                    // lift an already interrupted guard.
+                    if !ime_event_is_stale(ui, owner) {
+                        set_ime_composition(ui, Some(ImeComposition::TerminalPending(owner)));
+                    }
+                    clear_preedit(ui);
+                } else if ime_event_is_stale(ui, owner) {
+                    // This pre-edit belongs to the composition whose target was replaced; an
+                    // input method can emit further non-empty pre-edits before its final commit.
+                    // Do not revive the old composition on the replacement target, and keep the
+                    // tombstone past this batch: the old composition may commit in a later frame.
+                    set_ime_composition(ui, Some(ImeComposition::Stale));
+                } else {
+                    set_ime_composition(ui, Some(ImeComposition::Active(owner)));
+                    ui.data_mut(|d| d.insert_temp(ime_preedit_id(viewport), Preedit { owner, text: bounded_preedit(text) }));
+                }
+            }
+            // An input method replacing text around the selection (W26/W27 `Done` batches on
+            // Wayland/Windows, E21): delete exactly the reported characters/bytes. The commit
+            // that follows shares this typing key, so replacement stays one undo step.
+            egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars, after_chars }) => {
+                if ime_event_is_stale(ui, owner) {
+                    // A delete-surrounding is not terminal by itself: its paired commit/text
+                    // follows in the same composition. Its delete and commit stay rejected
+                    // until the request-bound completion.
+                    continue;
+                }
+                let before = ime_stamp(app, &ctx);
+                if ime_delete(app, ui, before_chars, after_chars, false) {
+                    let after = ime_stamp(app, &ctx);
+                    note_ime_receipt(app, &ctx, before, after);
+                }
+            }
+            egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes }) => {
+                if ime_event_is_stale(ui, owner) {
+                    // Its paired commit/text still belongs to the replaced composition; keep the
+                    // guard until the actual matching completion.
+                    continue;
+                }
+                let before = ime_stamp(app, &ctx);
+                if ime_delete(app, ui, before_bytes, after_bytes, true) {
+                    let after = ime_stamp(app, &ctx);
+                    note_ime_receipt(app, &ctx, before, after);
+                }
             }
             egui::Event::Copy => {
                 if let Some(v) = exec(app, "edit.copy", json!({}))
@@ -418,98 +1226,179 @@ fn keyboard(app: &mut EffectcraftApp, ui: &mut egui::Ui, viewer: Rect) {
                 }
             }
             egui::Event::Cut => {
+                let before = ime_stamp(app, &ctx);
                 if let Some(v) = exec(app, "edit.cut", json!({}))
                     && let Some(t) = v["text"].as_str()
                 {
                     ctx.copy_text(t.to_string());
+                    note_ime_application_edit(app, &ctx, before);
                 }
                 typing_key(ui, true);
             }
             egui::Event::Paste(t) => {
-                exec(app, "edit.paste", json!({"text": t}));
+                let before = ime_stamp(app, &ctx);
+                if exec(app, "edit.paste", json!({"text": t})).is_some() {
+                    note_ime_application_edit(app, &ctx, before);
+                }
                 typing_key(ui, true);
             }
-            egui::Event::Key { key, pressed: true, modifiers: m, .. } => {
-                use egui::Key;
-                let cmd = m.command;
-                let mv = |app: &mut EffectcraftApp, to: &str| {
-                    exec(app, "text.moveCaret", json!({"to": to, "extend": m.shift}));
-                };
-                match key {
-                    Key::ArrowLeft | Key::ArrowRight if m.alt => {
-                        // Kerning at the caret, tracking over a selection.
-                        let step = if cmd { 100.0 } else { 20.0 } * if key == Key::ArrowLeft { -1.0 } else { 1.0 };
-                        let doc = layer_doc(&app.session, sel.layer).unwrap_or_default();
-                        if sel.is_empty() {
-                            if sel.caret < doc.char_len() {
-                                let cur = match doc.style_at(sel.caret).kerning {
-                                    Kerning::Manual(v) => v,
-                                    _ => 0.0,
-                                };
-                                exec(
-                                    app,
-                                    "layer.setText",
-                                    json!({"layer": sel.layer.0, "range": [sel.caret, sel.caret + 1], "kerning": cur + step, "merge": format!("text-kern-{}", sel.caret)}),
-                                );
-                            }
-                        } else {
-                            let r = sel.range();
-                            let cur = doc.style_at(r.start).tracking;
-                            exec(app, "layer.setText", json!({"layer": sel.layer.0, "range": [r.start, r.end], "tracking": cur + step, "merge": "text-track"}));
-                        }
-                    }
-                    Key::ArrowLeft => mv(app, if cmd { "wordLeft" } else { "left" }),
-                    Key::ArrowRight => mv(app, if cmd { "wordRight" } else { "right" }),
-                    Key::ArrowUp => mv(app, if cmd { "paraUp" } else { "up" }),
-                    Key::ArrowDown => mv(app, if cmd { "paraDown" } else { "down" }),
-                    Key::Home => mv(app, if cmd { "start" } else { "lineStart" }),
-                    Key::End => mv(app, if cmd { "end" } else { "lineEnd" }),
-                    Key::Backspace => {
-                        let k = typing_key(ui, false);
-                        exec(app, "text.delete", json!({"word": cmd || m.alt, "merge": k}));
-                    }
-                    Key::Delete => {
-                        let k = typing_key(ui, false);
-                        exec(app, "text.delete", json!({"direction": "forward", "word": cmd || m.alt, "merge": k}));
-                    }
-                    Key::Enter if cmd => {
-                        exec(app, "text.endEdit", json!({}));
-                    }
-                    Key::Enter => {
-                        let k = typing_key(ui, false);
-                        exec(app, "text.insert", json!({"text": "\n", "merge": k}));
-                    }
-                    Key::Tab => {
-                        let k = typing_key(ui, false);
-                        exec(app, "text.insert", json!({"text": "\t", "merge": k}));
-                    }
-                    Key::Escape => {
-                        exec(app, "text.endEdit", json!({}));
-                    }
-                    Key::A if cmd => {
-                        exec(app, "text.setSelection", json!({"select": "all"}));
-                    }
-                    Key::Z if cmd => {
-                        let _ = crate::menus::invoke(app, &ctx, if m.shift { "edit.redo" } else { "edit.undo" }, json!({}));
-                    }
-                    Key::Comma | Key::Period if cmd && m.shift => {
-                        let doc = layer_doc(&app.session, sel.layer).unwrap_or_default();
-                        let r = sel.range();
-                        let size = sel.pending.as_ref().map_or_else(|| doc.style_at(r.start).size, |p| p.size);
-                        let ns = (size + if key == Key::Period { 2.0 } else { -2.0 }).max(1.0);
-                        exec(app, "layer.setText", json!({"layer": sel.layer.0, "range": [r.start, r.end], "size": ns}));
-                    }
-                    _ => {}
-                }
-                if !matches!(key, Key::Backspace | Key::Delete | Key::Enter | Key::Tab) {
-                    typing_key(ui, true);
-                }
-            }
+            egui::Event::Key { key, pressed: true, modifiers: m, .. } => key_event(app, ui, &ctx, &sel, key, m),
             _ => {}
         }
+        let route_ended = app.session.state.text_edit.is_none() || app.dialog.is_some();
+        if route_ended {
+            set_admission(&ctx, false);
+        }
+        if from_ime {
+            remember_ime_selection(ui, app);
+        } else {
+            // Arrow/Home/End/Select All (or another application event) may have moved the
+            // selection before a queued IME delete/commit later in this same raw batch.
+            sync_ime_selection(ui, app);
+        }
+        if route_ended {
+            suspend_reset(&ctx);
+            custom_mutations = false;
+        }
     }
 }
 
+/// An application key press in the edited text: caret moves, deletes, insertions, formatting and
+/// the editor's own chords.
+fn key_event(
+    app: &mut EffectcraftApp,
+    ui: &egui::Ui,
+    ctx: &egui::Context,
+    sel: &effectcraft_engine::commands::text_edit::TextEdit,
+    key: egui::Key,
+    m: egui::Modifiers,
+) {
+    use egui::Key;
+    let cmd = m.command;
+    let mv = |app: &mut EffectcraftApp, to: &str| {
+        exec(app, "text.moveCaret", json!({"to": to, "extend": m.shift}));
+    };
+    match key {
+        Key::ArrowLeft | Key::ArrowRight if m.alt => {
+            // Kerning at the caret, tracking over a selection.
+            let step = if cmd { 100.0 } else { 20.0 } * if key == Key::ArrowLeft { -1.0 } else { 1.0 };
+            let doc = layer_doc(&app.session, sel.layer).unwrap_or_default();
+            if sel.is_empty() {
+                if sel.caret < doc.char_len() {
+                    let cur = match doc.style_at(sel.caret).kerning {
+                        Kerning::Manual(v) => v,
+                        _ => 0.0,
+                    };
+                    exec(
+                        app,
+                        "layer.setText",
+                        json!({"layer": sel.layer.0, "range": [sel.caret, sel.caret + 1], "kerning": cur + step, "merge": format!("text-kern-{}", sel.caret)}),
+                    );
+                }
+            } else {
+                let r = sel.range();
+                let cur = doc.style_at(r.start).tracking;
+                exec(app, "layer.setText", json!({"layer": sel.layer.0, "range": [r.start, r.end], "tracking": cur + step, "merge": "text-track"}));
+            }
+        }
+        Key::ArrowLeft => mv(app, if cmd { "wordLeft" } else { "left" }),
+        Key::ArrowRight => mv(app, if cmd { "wordRight" } else { "right" }),
+        Key::ArrowUp => mv(app, if cmd { "paraUp" } else { "up" }),
+        Key::ArrowDown => mv(app, if cmd { "paraDown" } else { "down" }),
+        Key::Home => mv(app, if cmd { "start" } else { "lineStart" }),
+        Key::End => mv(app, if cmd { "end" } else { "lineEnd" }),
+        Key::Backspace => {
+            let k = typing_key(ui, false);
+            let before = ime_stamp(app, ctx);
+            if exec(app, "text.delete", json!({"word": cmd || m.alt, "merge": k})).is_some() {
+                note_ime_application_edit(app, ctx, before);
+            }
+        }
+        Key::Delete => {
+            let k = typing_key(ui, false);
+            let before = ime_stamp(app, ctx);
+            if exec(app, "text.delete", json!({"direction": "forward", "word": cmd || m.alt, "merge": k})).is_some() {
+                note_ime_application_edit(app, ctx, before);
+            }
+        }
+        Key::Enter if cmd => {
+            exec(app, "text.endEdit", json!({}));
+        }
+        Key::Enter => {
+            let k = typing_key(ui, false);
+            let before = ime_stamp(app, ctx);
+            if exec(app, "text.insert", json!({"text": "\n", "merge": k})).is_some() {
+                note_ime_application_edit(app, ctx, before);
+            }
+        }
+        Key::Tab => {
+            let k = typing_key(ui, false);
+            let before = ime_stamp(app, ctx);
+            if exec(app, "text.insert", json!({"text": "\t", "merge": k})).is_some() {
+                note_ime_application_edit(app, ctx, before);
+            }
+        }
+        Key::Escape => {
+            exec(app, "text.endEdit", json!({}));
+        }
+        // The editor owns exactly Cmd/Ctrl+A (Select All) and Cmd/Ctrl+Z with or
+        // without Shift (Undo, Redo). Other modifiers on those keys aren't editing
+        // chords, so they fall through to the binding match below: Shift+A is
+        // Deselect All's default, and Alt variants are free for a rebound one.
+        Key::A if cmd && !m.shift && !m.alt => {
+            exec(app, "text.setSelection", json!({"select": "all"}));
+        }
+        Key::Z if cmd && !m.alt => {
+            let before = ime_stamp(app, ctx);
+            if crate::menus::invoke(app, ctx, if m.shift { "edit.redo" } else { "edit.undo" }, json!({})).is_ok() {
+                note_ime_application_edit(app, ctx, before);
+            }
+        }
+        Key::Comma | Key::Period if cmd && m.shift => {
+            let doc = layer_doc(&app.session, sel.layer).unwrap_or_default();
+            let r = sel.range();
+            let size = sel.pending.as_ref().map_or_else(|| doc.style_at(r.start).size, |p| p.size);
+            let ns = (size + if key == Key::Period { 2.0 } else { -2.0 }).max(1.0);
+            exec(app, "layer.setText", json!({"layer": sel.layer.0, "range": [r.start, r.end], "size": ns}));
+        }
+        // The app-wide shortcut dispatcher is skipped while this editor holds the
+        // keyboard, so commands that end the edit by moving the selection — Deselect
+        // All (Cmd/Ctrl+Shift+A or F2 by default) and Duplicate (Cmd/Ctrl+D) — must be
+        // matched here and run through the command dispatcher like undo above.
+        // Matching each command's current binding, not a fixed key, keeps rebound
+        // shortcuts working and gives every route one final state; a chord bound to
+        // both commands resolves in list order. The forwarding test also refuses
+        // chords a focused editor must never surrender (see
+        // `forwardable_during_text_edit`).
+        _ if crate::menus::forwardable_during_text_edit(m, key)
+            && let Some(cmd_id) = ["edit.deselectAll", "edit.duplicate"].into_iter().find(|id| crate::menus::chord_matches(&app.session, id, key, m)) =>
+        {
+            let _ = crate::menus::invoke(app, ctx, cmd_id, json!({}));
+        }
+        _ => {}
+    }
+    if !matches!(key, Key::Backspace | Key::Delete | Key::Enter | Key::Tab) {
+        typing_key(ui, true);
+    }
+}
+
+/// Delete the text an IME marks for replacement around the editor's selection.
+///
+/// `before`/`after` count UTF-8 bytes (`DeleteSurroundingBytes`, what winit reports) or
+/// characters (`DeleteSurrounding`). The engine command keeps the selected text — the following
+/// `Commit` replaces it — and leaves a character a byte count only partly covers; the deletion
+/// and the commit share this typing key, so a replacement stays one undo step.
+fn ime_delete(app: &mut EffectcraftApp, ui: &egui::Ui, before: usize, after: usize, bytes: bool) -> bool {
+    if (before == 0 && after == 0) || app.session.state.text_edit.is_none() {
+        return false;
+    }
+    let k = typing_key(ui, false);
+    exec(app, "text.deleteSurrounding", json!({"before": before, "after": after, "bytes": bytes, "merge": k})).is_some()
+}
+
+/// Paint the paragraph box and handles, selection, caret or pre-edit for `e`; register the editor's and box handles'
+/// automation regions; request the caret-blink repaint; and record the pass's text and caret rectangles for the IME
+/// finalizer.
 fn draw(app: &mut EffectcraftApp, ui: &mut egui::Ui, painter: &egui::Painter, map: &ViewerMap, e: &Edited, sel: std::ops::Range<usize>, caret: usize) {
     let t = app.tokens;
     let to_s = |p: Point| e.to_screen(map, (p.x, p.y));
@@ -545,8 +1434,8 @@ fn draw(app: &mut EffectcraftApp, ui: &mut egui::Ui, painter: &egui::Painter, ma
     let (a, b) = (anim(a), anim(b));
     let (sa, sb) = (to_s(a), to_s(b));
     let now = ui.input(|i| i.time);
-    let preedit: Option<String> = ui.data(|d| d.get_temp(egui::Id::new("viewer-text-preedit")));
-    if let Some(pe) = preedit.filter(|s| !s.is_empty()) {
+    let preedit = visible_preedit(ui, app);
+    if let Some(pe) = preedit {
         let h = (sb - sa).length().max(10.0);
         let g = painter.layout_no_wrap(pe, egui::FontId::proportional(h * 0.7), Color32::WHITE);
         let r = Rect::from_min_size(sa, g.size());
@@ -564,7 +1453,13 @@ fn draw(app: &mut EffectcraftApp, ui: &mut egui::Ui, painter: &egui::Painter, ma
     let rect = Rect::from_points(&quad);
     app.auto.add("viewer.textEdit", rect, &format!("Editing {}", e.layer.name));
     let cursor_rect = Rect::from_two_pos(sa, sb).expand2(vec2(1.0, 0.0));
-    ui.ctx().output_mut(|o| {
-        o.ime = Some(egui::output::IMEOutput { purpose: egui::IMEPurpose::Normal, rect, cursor_rect, should_interrupt_composition: false });
-    });
+    // The viewport IME publisher uses this actual
+    // caret geometry and the edited layer's committed `TextDoc` (never the bidi or pre-edit
+    // display text). An available-empty document stays distinct from unavailable.
+    let viewport = ui.ctx().viewport_id();
+    let pass = ui.ctx().cumulative_pass_nr_for(viewport);
+    ui.data_mut(|d| d.insert_temp(ime_geometry_id(viewport), (pass, rect, cursor_rect)));
 }
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/panels/viewer_text/tests.rs b/crates/ui-egui/src/panels/viewer_text/tests.rs
new file mode 100644
index 000000000..be3e84b2c
--- /dev/null
+++ b/crates/ui-egui/src/panels/viewer_text/tests.rs
@@ -0,0 +1,812 @@
+//! Incoming IME edits on the custom text editor (the Type tool's own session, not a stock
+//! `TextEdit`). Winit reports the bytes around the selection *before* the commit it belongs
+//! to, so the deletion and the insert must share one undo step.
+
+use super::*;
+use effectcraft_engine::Session;
+use effectcraft_engine::commands::text_edit::TextEdit;
+use serde_json::json;
+
+fn editor(text: &str, anchor: usize, caret: usize) -> (EffectcraftApp, LayerId) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "IME", "width": 160, "height": 90, "duration": 1})).unwrap();
+    let layer = s.execute("layer.newText", json!({"text": text})).unwrap()["layer"].as_u64().unwrap();
+    let lid = LayerId(layer);
+    s.state.text_edit = Some(TextEdit { layer: lid, anchor, caret, ..Default::default() });
+    (EffectcraftApp::new(s), lid)
+}
+
+fn doc_text(app: &EffectcraftApp, lid: LayerId) -> String {
+    layer_doc(&app.session, lid).map(|d| d.text).unwrap_or_default()
+}
+
+fn feed(app: &mut EffectcraftApp, events: Vec<egui::Event>) {
+    let ctx = egui::Context::default();
+    let raw = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(320.0, 180.0))), events, ..Default::default() };
+    let mut out = ctx.run_ui(raw, |ui| keyboard(app, ui, egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(320.0, 180.0))));
+    out.textures_delta.clear();
+}
+
+#[test]
+fn preedit_preview_is_bounded_on_a_character_boundary() {
+    let text = "é".repeat(MAX_IME_TEXT_BYTES);
+    let capped = bounded_preedit(text);
+    assert!(capped.len() <= MAX_IME_TEXT_BYTES);
+    assert!(capped.is_char_boundary(capped.len()));
+    assert_eq!(capped.len() % "é".len(), 0, "the cap never leaves half a character");
+}
+
+/// Ending the edit from another panel clears this viewport's pre-edit. The production path
+/// used to resolve `viewport_id()` (a context read lock) inside `data_mut` (a write lock);
+/// that nested context access deadlocked every pass that drew the viewer.
+#[test]
+fn ending_an_edit_from_another_panel_clears_the_preedit() {
+    let (mut app, lid) = editor("abc", 0, 0);
+    let session = app.session.state.text_edit.as_ref().map_or(1, |e| e.session);
+    let ctx = egui::Context::default();
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
+        let viewport = ui.ctx().viewport_id();
+        let preedit = Preedit { owner: ImeOwner { layer: lid, session }, text: "x".into() };
+        ui.data_mut(|d| d.insert_temp(ime_preedit_id(viewport), preedit));
+        panel_clicked(&mut app, ui.ctx(), PanelKind::Timeline);
+        let viewport = ui.ctx().viewport_id();
+        assert!(ui.data(|d| d.get_temp::<Preedit>(ime_preedit_id(viewport))).is_none(), "the ended edit leaves no preview behind");
+    });
+    out.textures_delta.clear();
+    assert!(app.session.state.text_edit.is_none(), "a click in the Timeline ends the text edit");
+}
+
+#[test]
+fn ime_delete_surrounding_bytes_and_the_commit_are_one_undo_step() {
+    // "café😀": the last character is four bytes, so a byte-count deletion that treated bytes
+    // as characters would corrupt the document.
+    let (mut app, lid) = editor("café😀", 5, 5);
+    feed(
+        &mut app,
+        vec![
+            egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 4, after_bytes: 0 }),
+            egui::Event::Ime(egui::ImeEvent::Commit("X".into())),
+        ],
+    );
+    assert_eq!(doc_text(&app, lid), "caféX", "the emoji is replaced by the committed text");
+    app.session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc_text(&app, lid), "café😀", "the replacement is one undo step");
+}
+
+#[test]
+fn ime_delete_surrounding_chars_keeps_the_selection_for_the_commit() {
+    // Stock egui deletes the characters around the selection, not the selection itself: the
+    // commit that follows replaces "bcd", it does not insert next to a deleted document.
+    let (mut app, lid) = editor("abcdef", 1, 4);
+    feed(&mut app, vec![egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 99 })]);
+    assert_eq!(doc_text(&app, lid), "bcd", "one character before and everything after go");
+    let sel = app.session.state.text_edit.clone().expect("editing continues");
+    assert_eq!(sel.range(), 0..3, "the selected text is still selected");
+    // A deletion-only batch (no commit) leaves "bcd", not an empty document.
+    app.session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc_text(&app, lid), "abcdef", "clamped deletion is still one undo step");
+
+    // Delete surround + commit: the commit replaces the kept selection.
+    let (mut app, lid) = editor("abcdef", 1, 4);
+    feed(
+        &mut app,
+        vec![egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 99 }), egui::Event::Ime(egui::ImeEvent::Commit("XY".into()))],
+    );
+    assert_eq!(doc_text(&app, lid), "XY", "the commit replaces the selection");
+    app.session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc_text(&app, lid), "abcdef", "the deletion and its commit are one undo step");
+}
+
+/// One UI pass with the editor focused, events applied, and the overlay's observation.
+struct ImePass {
+    ctx: egui::Context,
+    viewport: egui::ViewportId,
+    rect: egui::Rect,
+}
+
+impl ImePass {
+    fn new(viewport: egui::ViewportId) -> Self {
+        let ctx = egui::Context::default();
+        install_hooks(&ctx);
+        Self { ctx, viewport, rect: egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(320.0, 180.0)) }
+    }
+
+    /// Run one `Context` frame. `overlay` is false for a pass in which the viewer (and so
+    /// the edit overlay) never drew; `discard` forces a second pass of the same frame.
+    fn frame(&mut self, app: &mut EffectcraftApp, events: Vec<egui::Event>, overlay: bool, discard: bool) -> Option<egui::output::IMEOutput> {
+        let ctx = self.ctx.clone();
+        let rect = self.rect;
+        let viewport = self.viewport;
+        let mut viewports = egui::ViewportIdMap::default();
+        viewports.insert(self.viewport, egui::ViewportInfo::default());
+        let raw = egui::RawInput { viewport_id: self.viewport, viewports, screen_rect: Some(rect), events, ..Default::default() };
+        let mut asked = false;
+        let mut out = ctx.run_ui(raw, |ui| {
+            begin_ui(ui.ctx());
+            ui.interact(rect, focus_id(), egui::Sense::focusable_noninteractive());
+            ui.memory_mut(|m| m.request_focus(focus_id()));
+            sync_ime_target(ui, app);
+            keyboard(app, ui, rect);
+            if overlay {
+                let pass = ui.ctx().cumulative_pass_nr_for(viewport);
+                ui.data_mut(|d| d.insert_temp(ime_geometry_id(viewport), (pass, rect, rect)));
+            }
+            finish_ime(app, ui);
+            if discard && !asked {
+                asked = true;
+                ui.ctx().request_discard("ime pass test");
+            }
+        });
+        out.textures_delta.clear();
+        out.platform_output.ime
+    }
+}
+
+/// One native floating window holding the Timeline's group and then the Viewer's.
+fn two_group_window() -> craft_ui::docking::Floating<PanelKind> {
+    let groups = vec![craft_ui::docking::Group::new(vec![PanelKind::Timeline], 0), craft_ui::docking::Group::new(vec![PanelKind::Viewer(1)], 0)];
+    craft_ui::docking::Floating::stack(groups, [0.0, 0.0, 320.0, 360.0]).expect("two groups make a window")
+}
+
+impl ImePass {
+    /// One pass of a native window with a body that edits no text and the Viewer's editor,
+    /// in the order given, publishing as `NativeIme` decides or, with `every`, after each
+    /// body. Returns the descriptor and the preedit the pass ended with.
+    fn window(
+        &mut self,
+        app: &mut EffectcraftApp,
+        window: &craft_ui::docking::Floating<PanelKind>,
+        events: Vec<egui::Event>,
+        viewer_first: bool,
+        every: bool,
+    ) -> (Option<egui::output::IMEOutput>, Option<String>) {
+        let ctx = self.ctx.clone();
+        let (rect, viewport) = (self.rect, self.viewport);
+        let mut viewports = egui::ViewportIdMap::default();
+        viewports.insert(viewport, egui::ViewportInfo::default());
+        let raw = egui::RawInput { viewport_id: viewport, viewports, screen_rect: Some(rect), events, ..Default::default() };
+        let mut preedit = None;
+        let mut out = ctx.run_ui(raw, |ui| {
+            let mut ime = crate::dock_ui::NativeIme::new(std::slice::from_ref(window), &[]);
+            let order = if viewer_first { [true, false] } else { [false, true] };
+            for viewer in order {
+                if ime.begin_body(viewport) {
+                    begin_ui(ui.ctx());
+                }
+                if viewer {
+                    ui.interact(rect, focus_id(), egui::Sense::focusable_noninteractive());
+                    ui.memory_mut(|m| m.request_focus(focus_id()));
+                    sync_ime_target(ui, app);
+                    keyboard(app, ui, rect);
+                    let pass = ui.ctx().cumulative_pass_nr_for(viewport);
+                    ui.data_mut(|d| d.insert_temp(ime_geometry_id(viewport), (pass, rect, rect)));
+                }
+                if ime.publishes(viewport, ime_recorded(ui.ctx())) || every {
+                    finish_ime(app, ui);
+                }
+            }
+            assert!(ime.unpublished().is_empty(), "the window published");
+            preedit = read_preedit(ui).map(|p| p.text);
+        });
+        out.textures_delta.clear();
+        (out.platform_output.ime, preedit)
+    }
+}
+
+#[test]
+fn native_window_with_a_group_before_the_viewer_keeps_the_composition() {
+    let window = two_group_window();
+    let viewport = craft_ui::docking::DockArea::<PanelKind>::window_viewport(crate::dock_ui::area_id(), window.id);
+    let preview = || egui::Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None });
+    for viewer_first in [false, true] {
+        let (mut app, _) = editor("abcd", 4, 4);
+        let mut pass = ImePass::new(viewport);
+        let (first, preedit) = pass.window(&mut app, &window, vec![preview()], viewer_first, false);
+        let first = first.expect("the editor publishes");
+        assert_eq!(preedit.as_deref(), Some("é"));
+        for _ in 0..2 {
+            let (ime, preedit) = pass.window(&mut app, &window, vec![], viewer_first, false);
+            let ime = ime.expect("the editor keeps publishing");
+            assert!(!ime.should_interrupt_composition, "viewer first: {viewer_first}");
+            assert_eq!((ime.owner, ime.context_generation), (first.owner, first.context_generation), "the same IME context");
+            assert_eq!(preedit.as_deref(), Some("é"), "the preedit survives the other body");
+        }
+    }
+    // Publishing after the body drawn before the Viewer clears the preedit and interrupts.
+    let (mut app, _) = editor("abcd", 4, 4);
+    let mut pass = ImePass::new(viewport);
+    pass.window(&mut app, &window, vec![preview()], false, true);
+    let (ime, preedit) = pass.window(&mut app, &window, vec![], false, true);
+    assert!(ime.expect("the editor publishes").should_interrupt_composition);
+    assert_eq!(preedit, None);
+    // A window that drew fewer bodies than its layout counts publishes after every body in
+    // its next pass.
+    let mut ime = crate::dock_ui::NativeIme::new(std::slice::from_ref(&window), &[]);
+    ime.begin_body(viewport);
+    assert!(!ime.publishes(viewport, false));
+    let unpublished = ime.unpublished();
+    assert_eq!(unpublished, vec![viewport]);
+    let mut ime = crate::dock_ui::NativeIme::new(std::slice::from_ref(&window), &unpublished);
+    ime.begin_body(viewport);
+    assert!(ime.publishes(viewport, false));
+}
+
+fn ime_text(ime: &egui::output::IMEOutput) -> (&str, usize, usize) {
+    let p = ime.surrounding_text.available().expect("committed surrounding text");
+    (p.text.as_str(), p.cursor, p.anchor)
+}
+
+#[test]
+fn discarded_custom_request_then_home_rearms_the_identical_caret() {
+    let (mut app, lid) = editor("abcd", 4, 4);
+    app.ui.start_screen = false;
+    app.ui.tool = Tool::Type;
+    app.ui.focused = PanelKind::Composition;
+    let ctx = egui::Context::default();
+    install_hooks(&ctx);
+    let mut frame = eframe::Frame::_new_kittest();
+    let raw = || egui::RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(1200.0, 800.0))), ..Default::default() };
+    for _ in 0..3 {
+        let mut output = ctx.run_ui(raw(), |ui| {
+            eframe::App::logic(&mut app, ui.ctx(), &mut frame);
+            app.draw(ui, &frame);
+        });
+        output.textures_delta.clear();
+    }
+    let mut input = raw();
+    input.events.push(egui::Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    let mut output = ctx.run_ui(input, |ui| {
+        eframe::App::logic(&mut app, ui.ctx(), &mut frame);
+        app.draw(ui, &frame);
+    });
+    output.textures_delta.clear();
+    assert!(output.platform_output.ime.is_some());
+    app.session.execute("text.setSelection", json!({"caret": 1})).unwrap();
+    let selection = app.session.state.text_edit.clone();
+    let mut passes = 0;
+    let mut discarded = None;
+    let mut output = ctx.run_ui(raw(), |ui| {
+        passes += 1;
+        if passes > 1 {
+            app.ui.start_screen = true;
+        }
+        eframe::App::logic(&mut app, ui.ctx(), &mut frame);
+        app.draw(ui, &frame);
+        if passes == 1 {
+            assert!(ui.ctx().output(|output| output.ime.is_some()));
+            discarded = read_reset(ui.ctx()).and_then(|guard| guard.request);
+            ui.ctx().request_discard("custom IME descriptor discarded before Home");
+        }
+    });
+    output.textures_delta.clear();
+    assert!(passes >= 2);
+    let first = discarded.expect("the actual discarded custom pass requested a fence");
+    assert!(output.platform_output.ime.is_none());
+    assert!(read_reset(&ctx).unwrap().suspended);
+    assert!(read_reset(&ctx).unwrap().request.is_none());
+    assert_eq!(app.session.state.text_edit, selection, "Home did not move the model caret");
+    app.ui.start_screen = false;
+    let mut output = ctx.run_ui(raw(), |ui| {
+        eframe::App::logic(&mut app, ui.ctx(), &mut frame);
+        app.draw(ui, &frame);
+    });
+    output.textures_delta.clear();
+    let second = output.platform_output.ime.unwrap().reset_request.expect("same caret reactivation publishes a new real ID");
+    assert_ne!(first, second);
+    let mut output = ctx.run_ui(raw(), |ui| {
+        eframe::App::logic(&mut app, ui.ctx(), &mut frame);
+        app.draw(ui, &frame);
+    });
+    output.textures_delta.clear();
+    assert!(output.platform_output.ime.unwrap().reset_request.is_none());
+    let mut input = raw();
+    input.events.extend([
+        egui::Event::ImeResetCompleted { request_id: first },
+        egui::Event::Ime(egui::ImeEvent::Commit("X".into())),
+        egui::Event::ImeResetCompleted { request_id: second },
+        egui::Event::Ime(egui::ImeEvent::Preedit { text: "が".into(), active_range_chars: None }),
+        egui::Event::Ime(egui::ImeEvent::Commit("が".into())),
+    ]);
+    let mut output = ctx.run_ui(input, |ui| {
+        eframe::App::logic(&mut app, ui.ctx(), &mut frame);
+        app.draw(ui, &frame);
+    });
+    output.textures_delta.clear();
+    assert_eq!(doc_text(&app, lid), "aがbcd");
+}
+
+#[test]
+fn viewport_fences_and_duplicate_completion_keep_their_exact_lifetime() {
+    let (mut app, lid) = editor("abcd", 4, 4);
+    let mut root = ImePass::new(egui::ViewportId::ROOT);
+    let mut detached = ImePass::new(egui::ViewportId::from_hash_of("effect-ime-detached"));
+    let preview = || egui::Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None });
+    root.frame(&mut app, vec![preview()], true, false);
+    detached.frame(&mut app, vec![preview()], true, false);
+    app.session.execute("text.setSelection", json!({"caret": 1})).unwrap();
+    let first = root.frame(&mut app, vec![], true, false).unwrap().reset_request.unwrap();
+    let second = detached.frame(&mut app, vec![], true, false).unwrap().reset_request.unwrap();
+    assert_ne!(first, second);
+    detached.frame(&mut app, vec![egui::Event::ImeResetCompleted { request_id: first }, egui::Event::Ime(egui::ImeEvent::Commit("X".into()))], true, false);
+    assert_eq!(doc_text(&app, lid), "abcd");
+    let pending = detached.ctx.data(|data| data.get_temp::<ResetGuard>(reset_id(detached.viewport))).unwrap().request;
+    assert_eq!(pending, Some(second), "a root marker cannot release the detached viewport's full ID");
+    let output = detached
+        .frame(
+            &mut app,
+            vec![
+                egui::Event::ImeResetCompleted { request_id: second },
+                preview(),
+                egui::Event::ImeResetCompleted { request_id: second },
+                egui::Event::Ime(egui::ImeEvent::Commit("が".into())),
+            ],
+            true,
+            false,
+        )
+        .unwrap();
+    assert_eq!(doc_text(&app, lid), "aがbcd");
+    assert!(output.reset_request.is_none(), "a duplicate control cannot reconstruct the cleared guard");
+    // An actual context-generation change at unchanged selection still supersedes a wait.
+    root.frame(&mut app, vec![], true, false);
+    let replaced = root.frame(&mut app, vec![], false, false);
+    assert!(replaced.is_none());
+    let replacement = root.frame(&mut app, vec![], true, false).unwrap().reset_request.unwrap();
+    assert_ne!(first, replacement);
+}
+
+#[test]
+fn ime_descriptor_sends_committed_text_and_preserves_a_reversed_selection() {
+    let (mut app, _) = editor("café😀", 2, 5);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let first = pass.frame(&mut app, vec![], true, false).expect("the focused editor owns IME");
+    assert_eq!(first.owner, ime_target(&app).expect("an edit target").owner);
+    assert!(first.context_generation > 0);
+    assert_eq!(ime_text(&first), ("café😀", 9, 2), "UTF-8 bytes, with the caret's direction kept");
+    assert_eq!(first.change_cause, egui::ImeChangeCause::Other, "starting a context is application origin");
+    assert_eq!((first.rect, first.cursor_rect), (pass.rect, pass.rect), "the real caret geometry");
+
+    let again = pass.frame(&mut app, vec![], true, false).expect("still editing");
+    assert_eq!(again.context_generation, first.context_generation, "an unchanged pass keeps the context");
+    assert_eq!(again.surrounding_text, first.surrounding_text);
+}
+
+#[test]
+fn accepted_ime_commit_is_input_method_and_ordinary_typing_is_other() {
+    let (mut app, lid) = editor("ab", 2, 2);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let first = pass.frame(&mut app, vec![], true, false).expect("editing");
+    let generation = first.context_generation;
+
+    let commit = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("日".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "ab日");
+    assert_eq!(ime_text(&commit), ("ab日", 5, 5));
+    assert_eq!(commit.change_cause, egui::ImeChangeCause::InputMethod, "only the accepted commit earns it");
+    assert_eq!(commit.context_generation, generation, "an ordinary text change is not a new context");
+
+    let typed = pass.frame(&mut app, vec![egui::Event::Text("x".into())], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "ab日x");
+    assert_eq!(typed.change_cause, egui::ImeChangeCause::Other, "typing is application work");
+    assert_eq!(typed.context_generation, generation);
+}
+
+#[test]
+fn ime_delete_and_commit_chain_is_input_method_with_a_reversed_selection() {
+    let (mut app, lid) = editor("abcdef", 4, 1);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![], true, false).expect("editing");
+
+    let deleted = pass
+        .frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 1 })], true, false)
+        .expect("still editing");
+    assert_eq!(doc_text(&app, lid), "bcdf", "one character goes before and one after the selection");
+    assert_eq!(ime_text(&deleted), ("bcdf", 0, 3), "the selected text and its reversed direction stay");
+    assert_eq!(deleted.change_cause, egui::ImeChangeCause::InputMethod);
+
+    let committed = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "Xf", "the commit replaces the kept selection");
+    assert_eq!(committed.change_cause, egui::ImeChangeCause::InputMethod, "the delete and commit are one accepted chain");
+    app.session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(doc_text(&app, lid), "abcdef", "the replacement is one undo step");
+}
+
+#[test]
+fn an_application_edit_in_the_same_frame_dominates_the_ime_cause() {
+    // Application edit before the IME commit.
+    let (mut app, lid) = editor("ab", 2, 2);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![], true, false).expect("editing");
+    let mixed =
+        pass.frame(&mut app, vec![egui::Event::Text("x".into()), egui::Event::Ime(egui::ImeEvent::Commit("日".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "abx日");
+    assert_eq!(mixed.change_cause, egui::ImeChangeCause::Other, "the earlier application edit dominates");
+
+    // Application edit after the IME commit.
+    let (mut app, lid) = editor("ab", 2, 2);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![], true, false).expect("editing");
+    let mixed =
+        pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("日".into())), egui::Event::Text("x".into())], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "ab日x");
+    assert_eq!(mixed.change_cause, egui::ImeChangeCause::Other, "the later application edit dominates");
+}
+
+#[test]
+fn preedit_is_excluded_from_the_committed_snapshot_and_keeps_the_context() {
+    let (mut app, lid) = editor("ab", 2, 2);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let first = pass.frame(&mut app, vec![], true, false).expect("editing");
+
+    let preview = pass
+        .frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })], true, false)
+        .expect("still editing");
+    assert_eq!(doc_text(&app, lid), "ab", "the pre-edit never enters the document");
+    assert_eq!(ime_text(&preview), ("ab", 2, 2), "only committed text is sent");
+    assert_eq!(preview.context_generation, first.context_generation, "pre-edit updates keep the composition");
+
+    let commit = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("に".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "abに");
+    assert_eq!(commit.change_cause, egui::ImeChangeCause::InputMethod, "clearing the pre-edit and committing is IME work");
+    assert_eq!(commit.context_generation, first.context_generation);
+}
+
+#[test]
+fn empty_and_unavailable_surrounding_text_are_distinct() {
+    let (mut app, _) = editor("", 0, 0);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let empty = pass.frame(&mut app, vec![], true, false).expect("editing");
+    assert_eq!(ime_text(&empty), ("", 0, 0), "an available-empty document is not unavailable");
+
+    let text = "a".repeat(5000);
+    let (mut app, _) = editor(&text, 0, 5000);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let wide = pass.frame(&mut app, vec![], true, false).expect("editing");
+    assert!(matches!(wide.surrounding_text, egui::output::IMESurroundingText::Unavailable), "a selection wider than the limit is unavailable");
+    assert_eq!(wide.owner, ime_target(&app).expect("an edit target").owner, "identity survives unavailable text");
+}
+
+#[test]
+fn an_unrelated_undo_keeps_a_wide_selection_composition() {
+    // A selection wider than the IME limit reports unavailable surrounding text, whose
+    // receipt identity is a revision. That revision must follow the editor, not the whole
+    // project: undoing an unrelated opacity change used to look like an editor mutation and
+    // cancel an active composition.
+    let text = "a".repeat(5000);
+    let (mut app, lid) = editor(&text, 0, 5000);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let first = pass.frame(&mut app, vec![], true, false).expect("editing");
+    assert!(matches!(first.surrounding_text, egui::output::IMESurroundingText::Unavailable), "the wide selection is unavailable");
+
+    let composing = pass
+        .frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })], true, false)
+        .expect("still editing");
+    assert_eq!(composing.context_generation, first.context_generation, "the pre-edit keeps the context");
+    let owner = ime_owner(&app).expect("an editor owner");
+    assert!(matches!(
+        pass.ctx.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(pass.viewport))),
+        Some(ImeComposition::Active(active)) if active == owner
+    ));
+
+    app.session.execute("prop.set", json!({"layer": lid.0, "path": "transform/opacity", "value": 50})).unwrap();
+    app.session.execute("edit.undo", json!({})).unwrap();
+    let after = pass.frame(&mut app, vec![], true, false).expect("still editing");
+    assert_eq!(after.context_generation, first.context_generation, "an unrelated undo does not start a new context");
+    assert!(
+        matches!(
+            pass.ctx.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(pass.viewport))),
+            Some(ImeComposition::Active(active)) if active == owner
+        ),
+        "the wide-selection composition survives an unrelated undo"
+    );
+    assert!(read_reset(&pass.ctx).is_none(), "no IME reset was requested");
+
+    // The composition is still the live one: its commit is accepted and earns the
+    // input-method cause rather than being poisoned as leftover application work.
+    let commit = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("x".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), "x", "the preserved composition commits into the wide selection");
+    assert_eq!(commit.change_cause, egui::ImeChangeCause::InputMethod);
+}
+
+#[test]
+fn a_failed_batch_with_a_transient_edit_does_not_revive_a_wide_selection_composition() {
+    // The final document equals the pre-batch one, but the intermediate insert/delete was a
+    // real document change. Its IME revision must stay the high-water mark; otherwise the
+    // active wide-selection composition would look current and accept its old commit.
+    let text = "a".repeat(5000);
+    let (mut app, lid) = editor(&text, 0, 5000);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![], true, false).expect("editing");
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })], true, false).expect("still editing");
+    let owner = ime_owner(&app).expect("an editor owner");
+    assert!(matches!(
+        pass.ctx.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(pass.viewport))),
+        Some(ImeComposition::Active(active)) if active == owner
+    ));
+
+    let r = app.session.execute(
+        "engine.batch",
+        json!({"atomic": true, "steps": [
+            {"command": "text.insert", "params": {"text": "x", "range": [5000, 5000]}},
+            {"command": "text.delete", "params": {}},
+            {"command": "no.suchCommand", "params": {}}
+        ]}),
+    );
+    assert!(r.is_err());
+    assert_eq!(doc_text(&app, lid), text, "the batch restored the final document");
+
+    pass.frame(&mut app, vec![], true, false).expect("still editing");
+    assert!(read_reset(&pass.ctx).is_some(), "the advanced revision retires the old IME context");
+    assert!(
+        matches!(pass.ctx.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(pass.viewport))), Some(ImeComposition::Stale)),
+        "the failed batch's transient edit leaves the old composition stale"
+    );
+    let stale = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("z".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), text, "the stale composition cannot commit into the restored document");
+    assert_ne!(stale.change_cause, egui::ImeChangeCause::InputMethod, "a rejected commit earns no IME receipt");
+}
+
+#[test]
+fn a_wide_content_change_invalidates_the_active_composition() {
+    let text = "a".repeat(5000);
+    let (mut app, lid) = editor(&text, 0, 5000);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![], true, false).expect("editing");
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })], true, false).expect("still editing");
+
+    let replaced = "b".repeat(5000);
+    app.session.execute("layer.setText", json!({"layer": lid.0, "text": replaced})).unwrap();
+    let after = pass.frame(&mut app, vec![], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), replaced);
+    assert!(after.should_interrupt_composition, "replacing the wide document starts a new IME context");
+    assert!(
+        matches!(pass.ctx.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(pass.viewport))), Some(ImeComposition::Stale)),
+        "the old composition is stale after the content change"
+    );
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("z".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), replaced, "a delayed commit from the old document is rejected");
+}
+
+#[test]
+fn a_wide_selection_change_invalidates_the_active_composition() {
+    let text = "a".repeat(5000);
+    let (mut app, lid) = editor(&text, 0, 5000);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![], true, false).expect("editing");
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })], true, false).expect("still editing");
+
+    // Still wider than the IME window limit, so this exercises the unavailable-text
+    // selection identity rather than merely making the surrounding text available.
+    app.session.execute("text.setSelection", json!({"start": 0, "end": 4500})).unwrap();
+    pass.frame(&mut app, vec![], true, false).expect("still editing");
+    assert!(read_reset(&pass.ctx).is_some(), "an application selection change retires the composition");
+    assert!(
+        matches!(pass.ctx.data(|d| d.get_temp::<ImeComposition>(ime_composition_id(pass.viewport))), Some(ImeComposition::Stale)),
+        "the old composition cannot follow the selection"
+    );
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("z".into()))], true, false).expect("still editing");
+    assert_eq!(doc_text(&app, lid), text, "the stale composition cannot mutate the wide selection");
+}
+
+#[test]
+fn replaced_edit_session_and_hidden_passes_start_a_new_context() {
+    let (mut app, _) = editor("text", 4, 4);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let before = pass.frame(&mut app, vec![], true, false).expect("editing");
+    if let Some(edit) = app.session.state.text_edit.as_mut() {
+        edit.session = edit.session.wrapping_add(1);
+    }
+    let replaced = pass.frame(&mut app, vec![], true, false).expect("editing");
+    assert!(replaced.context_generation > before.context_generation, "a recreated target does not inherit the old context");
+    assert_eq!(replaced.change_cause, egui::ImeChangeCause::Other);
+    assert!(replaced.should_interrupt_composition, "a new replacement epoch cancels the platform composition");
+
+    let (mut app, _) = editor("abc", 3, 3);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let visible = pass.frame(&mut app, vec![], true, false).expect("editing");
+    assert!(pass.frame(&mut app, vec![], false, false).is_none(), "a hidden editor reports no IME owner");
+    let back = pass.frame(&mut app, vec![], true, false).expect("editing again");
+    assert!(back.context_generation > visible.context_generation, "reappearing starts exactly one new context");
+}
+
+#[test]
+fn preedit_from_a_replaced_target_cannot_commit_into_the_new_session() {
+    let (mut app, first) = editor("A", 1, 1);
+    let second = app.session.execute("layer.newText", json!({"text": "B"})).unwrap()["layer"].as_u64().unwrap();
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "か".into(), active_range_chars: None })], true, false)
+        .expect("editing the first layer");
+
+    app.session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    let switched = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("日".into()))], true, false).expect("editing the second layer");
+    assert_eq!(doc_text(&app, LayerId(second)), "B", "a delayed commit from the old composition is ignored");
+    assert_eq!(doc_text(&app, first), "A", "the old layer is not changed either");
+    assert_eq!(switched.owner, ime_target(&app).expect("second target").owner);
+    assert!(switched.should_interrupt_composition, "the target switch interrupts the old composition");
+}
+
+#[test]
+fn hidden_pass_clears_this_viewports_preedit_preview() {
+    let (mut app, _) = editor("ab", 2, 2);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })], true, false).expect("editing");
+    assert!(pass.ctx.data(|d| d.get_temp::<Preedit>(ime_preedit_id(pass.viewport))).is_some());
+    assert!(pass.frame(&mut app, vec![], false, false).is_none());
+    assert!(pass.ctx.data(|d| d.get_temp::<Preedit>(ime_preedit_id(pass.viewport))).is_none(), "a pass without the overlay clears this viewport's preview");
+}
+
+#[test]
+fn a_discarded_pass_keeps_the_frame_cause_and_the_context() {
+    let (mut app, lid) = editor("ab", 2, 2);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let first = pass.frame(&mut app, vec![], true, false).expect("editing");
+    let committed = pass.frame(&mut app, vec![egui::Event::Ime(egui::ImeEvent::Commit("日".into()))], true, true).expect("the final pass of the frame");
+    assert_eq!(doc_text(&app, lid), "ab日", "the discarded pass did not replay the event");
+    assert_eq!(committed.change_cause, egui::ImeChangeCause::InputMethod, "an unchanged later pass keeps the frame's cause");
+    assert_eq!(committed.context_generation, first.context_generation, "both passes are one context");
+}
+
+#[test]
+fn two_viewports_keep_independent_ime_contexts() {
+    let (mut app, _) = editor("ab", 2, 2);
+    let mut first = ImePass::new(egui::ViewportId::ROOT);
+    let mut second = ImePass::new(egui::ViewportId::from_hash_of("ime-test-second-viewport"));
+    let one = first.frame(&mut app, vec![], true, false).expect("editing in the first viewport");
+    let two = second.frame(&mut app, vec![], true, false).expect("editing in the second viewport");
+    assert_ne!(one.context_generation, two.context_generation, "each viewport has its own generation");
+    let again = first.frame(&mut app, vec![], true, false).expect("editing in the first viewport");
+    assert_eq!(again.context_generation, one.context_generation, "the second viewport did not disturb the first");
+}
+
+/// Draw one real `EffectcraftApp::draw` pass, so `draw`'s all-exit finalizer runs.
+fn draw_app_pass(app: &mut EffectcraftApp, ctx: &egui::Context, frame: &eframe::Frame, events: Vec<egui::Event>) -> egui::FullOutput {
+    let raw = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1200.0, 800.0))), events, ..Default::default() };
+    let mut out = ctx.run_ui(raw, |ui| app.draw(ui, frame));
+    out.textures_delta.clear();
+    out
+}
+
+/// One headless pass with the custom viewer and a real stock `TextEdit` side by side.
+///
+/// The first call focuses the custom editor before `keyboard` (the outside press arrives
+/// there). The second call leaves the stock field's focus alone, so the stock descriptor
+/// is published by the same `output.ime` writer that an unrelated field would use.
+fn stock_pass(
+    pass: &mut ImePass,
+    app: &mut EffectcraftApp,
+    events: Vec<egui::Event>,
+    stock: &mut String,
+    custom_focus: bool,
+) -> Option<egui::output::IMEOutput> {
+    let ctx = pass.ctx.clone();
+    let viewport = pass.viewport;
+    let custom = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(160.0, 90.0));
+    let stock_rect = egui::Rect::from_min_size(egui::pos2(180.0, 30.0), egui::vec2(120.0, 24.0));
+    let stock_id = egui::Id::unique("effectcraft-ime-test-stock");
+    let mut viewports = egui::ViewportIdMap::default();
+    viewports.insert(viewport, egui::ViewportInfo::default());
+    let raw = egui::RawInput { viewport_id: viewport, viewports, screen_rect: Some(pass.rect), events, ..Default::default() };
+    let mut out = ctx.run_ui(raw, |ui| {
+        begin_ui(ui.ctx());
+        if custom_focus {
+            ui.interact(custom, focus_id(), egui::Sense::focusable_noninteractive());
+            ui.memory_mut(|m| m.request_focus(focus_id()));
+            sync_ime_target(ui, app);
+            keyboard(app, ui, custom);
+        } else {
+            // The stock field holds focus after the outside press; keep that ownership while
+            // the second pass publishes the actual stock descriptor.
+            ui.memory_mut(|m| m.request_focus(stock_id));
+        }
+        let _ = ui.put(stock_rect, egui::TextEdit::singleline(stock).id(stock_id));
+        finish_ime(app, ui);
+    });
+    out.textures_delta.clear();
+    out.platform_output.ime
+}
+
+#[test]
+fn outside_pointer_to_stock_allocates_no_new_request_and_defers_the_replacement() {
+    let (mut app, lid) = editor("abcd", 4, 4);
+    let mut pass = ImePass::new(egui::ViewportId::ROOT);
+    let preview = || egui::Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None });
+    pass.frame(&mut app, vec![preview()], true, false).expect("the custom editor starts a composition");
+    app.session.execute("text.setSelection", json!({"caret": 1})).unwrap();
+    let first = pass.frame(&mut app, vec![], true, false).expect("the caret change publishes a request").reset_request.expect("the real request ID");
+    // Complete the first interruption, then start a fresh composition with no waiting guard.
+    pass.frame(&mut app, vec![egui::Event::ImeResetCompleted { request_id: first }], true, false);
+    let active = pass.frame(&mut app, vec![preview()], true, false).expect("a fresh composition");
+    assert!(active.reset_request.is_none(), "a fresh composition does not wait on an old request");
+    assert_eq!(doc_text(&app, lid), "abcd");
+
+    // The press outside the viewer also gives the stock field focus. It must not allocate a
+    // new request: core would attach that request to the stock descriptor next pass.
+    let outside = egui::pos2(240.0, 42.0);
+    let mut stock = String::new();
+    stock_pass(
+        &mut pass,
+        &mut app,
+        vec![
+            egui::Event::PointerMoved(outside),
+            egui::Event::PointerButton { pos: outside, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE },
+        ],
+        &mut stock,
+        true,
+    );
+    let guard = pass.ctx.data(|d| d.get_temp::<ResetGuard>(reset_id(pass.viewport))).expect("the custom guard is retired locally");
+    assert!(guard.suspended && guard.request.is_none(), "the outside press retires the old request without allocating another");
+    let stock_ime = stock_pass(&mut pass, &mut app, vec![], &mut stock, false).expect("the actual stock field owns IME");
+    assert_ne!(stock_ime.owner, ime_target(&app).expect("the custom target is still live").owner);
+    assert!(stock_ime.reset_request.is_none(), "a new outside-press request would surface on the stock output");
+    assert_eq!(doc_text(&app, lid), "abcd");
+
+    // Returning to a confirmed eligible custom output allocates the one replacement.
+    let replacement = pass.frame(&mut app, vec![], true, false).expect("the custom editor owns IME again").reset_request.expect("the deferred replacement");
+    assert_ne!(first, replacement);
+    assert!(pass.frame(&mut app, vec![], true, false).expect("still editing").reset_request.is_none(), "the replacement is one-shot");
+}
+
+#[test]
+fn fonts_and_device_loss_all_exit_finalizers_suspend_without_allocating() {
+    let (mut app, _lid) = editor("abcd", 1, 1);
+    app.ui.start_screen = false;
+    app.ui.tool = Tool::Type;
+    app.ui.focused = PanelKind::Composition;
+    app.show_panel(PanelKind::Composition);
+    let ctx = egui::Context::default();
+    install_hooks(&ctx);
+    let frame = eframe::Frame::_new_kittest();
+    let preview = || egui::Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None });
+    // The first pass installs fonts and the next draws the real viewer.
+    for _ in 0..3 {
+        draw_app_pass(&mut app, &ctx, &frame, vec![]);
+    }
+    draw_app_pass(&mut app, &ctx, &frame, vec![preview()]);
+    app.session.execute("text.setSelection", json!({"caret": 2})).unwrap();
+    let first = draw_app_pass(&mut app, &ctx, &frame, vec![])
+        .platform_output
+        .ime
+        .expect("the normal pass publishes the custom descriptor")
+        .reset_request
+        .expect("one request for the caret interruption");
+
+    // A real font-install pass draws nothing, but `draw` still reaches the finalizer.
+    app.styled = false;
+    let fonts = draw_app_pass(&mut app, &ctx, &frame, vec![]);
+    assert!(!app.is_ready(), "the font-install pass cannot draw");
+    assert!(fonts.platform_output.ime.is_none(), "no custom descriptor is published");
+    let guard = ctx.data(|d| d.get_temp::<ResetGuard>(reset_id(egui::ViewportId::ROOT))).expect("the waiting guard");
+    assert!(guard.suspended && guard.request.is_none(), "the all-exit finalizer retired it without allocating");
+    let second = draw_app_pass(&mut app, &ctx, &frame, vec![])
+        .platform_output
+        .ime
+        .expect("returning to a drawing pass publishes the custom descriptor")
+        .reset_request
+        .expect("the deferred request");
+    assert_ne!(first, second);
+
+    // The device-loss early return is the other all-exit path. Preset the close bookkeeping
+    // so this test does not autosave; the pass must still retire the waiting guard.
+    app.gpu_failure_applied = Some(true);
+    app.device_lost_close = Some(true);
+    let lost = draw_app_pass(&mut app, &ctx, &frame, vec![]);
+    assert!(lost.platform_output.ime.is_none(), "a lost renderer publishes no descriptor");
+    let guard = ctx.data(|d| d.get_temp::<ResetGuard>(reset_id(egui::ViewportId::ROOT))).expect("the waiting guard");
+    assert!(guard.suspended && guard.request.is_none(), "the device-loss finalizer retired it without allocating");
+    app.gpu_failure_applied = None;
+    let third = draw_app_pass(&mut app, &ctx, &frame, vec![])
+        .platform_output
+        .ime
+        .expect("a drawing pass publishes the custom descriptor again")
+        .reset_request
+        .expect("the deferred request is one-shot");
+    assert_ne!(third, second);
+}
+
+#[test]
+fn ime_delete_without_a_session_or_with_an_empty_range_does_nothing() {
+    let (mut app, lid) = editor("abc", 1, 1);
+    feed(&mut app, vec![egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 0, after_bytes: 0 })]);
+    assert_eq!(doc_text(&app, lid), "abc");
+    app.session.state.text_edit = None;
+    feed(&mut app, vec![egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 2, after_bytes: 0 })]);
+    assert_eq!(doc_text(&app, lid), "abc");
+}
diff --git a/crates/ui-egui/src/panels/viewer_tools.rs b/crates/ui-egui/src/panels/viewer_tools.rs
index d229f272f..563657e91 100644
--- a/crates/ui-egui/src/panels/viewer_tools.rs
+++ b/crates/ui-egui/src/panels/viewer_tools.rs
@@ -24,8 +24,9 @@ use crate::{EffectcraftApp, widgets};
 pub(crate) const SNAP_PX: f64 = 8.0;
 const SNAP_COLOR: Color32 = Color32::from_rgb(0xff, 0xd2, 0x3c);
 
+/// The `egui::Id` under which this frame's snap feedback is stored until `draw_snap` consumes it.
 fn snap_id() -> egui::Id {
-    egui::Id::new("viewer-snap")
+    egui::Id::unique("viewer-snap")
 }
 
 /// Layer snapping is on: the Snapping checkbox (View ▸ Snapping), inverted while Cmd/Ctrl is held.
@@ -47,20 +48,21 @@ pub(crate) fn snap(
     sources: &[[f64; 2]],
     mods: egui::Modifiers,
 ) -> [f64; 2] {
-    snap_with(app, ctx, ectx, map, exclude, sources, mods, &[])
+    snap_with(app, ctx, ectx, map, &SnapQuery { exclude, sources, mods, extra: &[] })
 }
 
-/// [`snap`] with `extra` layer targets (the Pan Behind layer's own box).
-pub(crate) fn snap_with(
-    app: &EffectcraftApp,
-    ctx: &egui::Context,
-    ectx: &EvalCtx,
-    map: &ViewerMap,
-    exclude: &[LayerId],
-    sources: &[[f64; 2]],
-    mods: egui::Modifiers,
-    extra: &[vw::SnapTarget],
-) -> [f64; 2] {
+/// What [`snap_with`] snaps: the dragged features and the layers to ignore, plus `extra` layer
+/// targets (the Pan Behind layer's own box).
+pub(crate) struct SnapQuery<'a> {
+    pub exclude: &'a [LayerId],
+    pub sources: &'a [[f64; 2]],
+    pub mods: egui::Modifiers,
+    pub extra: &'a [vw::SnapTarget],
+}
+
+/// [`snap`] with extra layer targets.
+pub(crate) fn snap_with(app: &EffectcraftApp, ctx: &egui::Context, ectx: &EvalCtx, map: &ViewerMap, q: &SnapQuery) -> [f64; 2] {
+    let SnapQuery { exclude, sources, mods, extra } = *q;
     let layers = snapping_on(app, mods);
     let v = &app.ui.viewer;
     let guides = v.snap_guides && v.guides;
@@ -226,10 +228,10 @@ pub(crate) fn rulers(app: &mut EffectcraftApp, ui: &mut egui::Ui, map: &ViewerMa
     p.line_segment([corner.center() - vec2(4.0, 0.0), corner.center() + vec2(4.0, 0.0)], tick);
     p.line_segment([corner.center() - vec2(0.0, 4.0), corner.center() + vec2(0.0, 4.0)], tick);
     let cr = ui
-        .interact(corner, egui::Id::new("vw-ruler-origin"), Sense::click_and_drag())
+        .interact(corner, egui::Id::unique("vw-ruler-origin"), Sense::click_and_drag())
         .on_hover_text(crate::i18n::tr("Ruler zero point (drag to move, double-click to reset)"));
     app.auto.add("viewer.ruler.origin", corner, "Ruler zero point");
-    let fg = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("vw-ruler-fg")));
+    let fg = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("vw-ruler-fg")));
     if cr.dragged()
         && let Some(hp) = cr.interact_pointer_pos()
     {
@@ -248,7 +250,7 @@ pub(crate) fn rulers(app: &mut EffectcraftApp, ui: &mut egui::Ui, map: &ViewerMa
     // Guides dragged out of the rulers: the top ruler makes horizontal guides, the left one
     // vertical guides.
     for (r, vertical, id) in [(top, false, "top"), (left, true, "left")] {
-        let resp = ui.interact(r, egui::Id::new(("vw-ruler", id)), Sense::drag()).on_hover_text(crate::i18n::tr("Drag to create a guide"));
+        let resp = ui.interact(r, egui::Id::unique(("vw-ruler", id)), Sense::drag()).on_hover_text(crate::i18n::tr("Drag to create a guide"));
         app.auto.add(&format!("viewer.ruler.{id}"), r, if vertical { "Vertical ruler" } else { "Horizontal ruler" });
         if resp.hovered() {
             ui.ctx().set_cursor_icon(if vertical { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::ResizeVertical });
@@ -318,13 +320,15 @@ pub(crate) fn proportional_grid(app: &EffectcraftApp, painter: &egui::Painter, c
 
 // ---------------------------------------------------------------- the displayed frame
 
-/// Remember the region of interest the displayed texture was rendered with.
+/// Store the displayed texture's Region of Interest or Extended Viewer area unchanged.
 pub(crate) fn set_texture_roi(ctx: &egui::Context, roi: Option<[f64; 4]>) {
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("viewer-tex-roi"), roi));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("viewer-tex-roi"), roi));
 }
 
+/// The comp region (`[x, y, w, h]` in pixels) used for the texture: Region of Interest or Extended Viewer area,
+/// or `None` when no explicit region is stored, meaning the whole comp.
 fn texture_roi(ctx: &egui::Context) -> Option<[f64; 4]> {
-    ctx.data(|d| d.get_temp::<Option<[f64; 4]>>(egui::Id::new("viewer-tex-roi"))).flatten()
+    ctx.data(|d| d.get_temp::<Option<[f64; 4]>>(egui::Id::unique("viewer-tex-roi"))).flatten()
 }
 
 /// The comp area ([x, y, w, h], comp pixels) the shown frame covers: its region of interest or
@@ -339,14 +343,34 @@ pub(crate) fn showing_snapshot(app: &EffectcraftApp, ctx: &egui::Context) -> boo
     app.session.snapshot.is_some() && (app.session.state.viewer.show_snapshot || f5)
 }
 
-/// Show Channel and exposure, then the display colour conversion (View ▸ Use Display Color
-/// Management / Simulate Output).
-fn transformed(img: &egui::ColorImage, ch: Channel, colorized: bool, stops: f32, dc: Option<vw::DisplayColor>) -> egui::ColorImage {
-    let mut px: Vec<[u8; 4]> = img.pixels.iter().map(|c| c.to_array()).collect();
-    if let Some(dc) = dc.filter(|_| matches!(ch, Channel::Rgb | Channel::RgbStraight)) {
-        dc.apply(&mut px);
+/// The viewer's display pass for frames encoded as `encoding`: Show Channel, exposure, the HDR
+/// step such frames still need, then the display colour conversion `dc` (View ▸ Use Display
+/// Color Management / Simulate Output).
+pub(crate) fn display_pass(app: &EffectcraftApp, encoding: vw::FrameEncoding, dc: Option<&vw::DisplayColor>) -> vw::DisplayPass {
+    let o = &app.session.state.viewer;
+    vw::DisplayPass::new(o.channel, o.colorized, o.exposure, encoding, dc)
+}
+
+/// How the project's 8-bit viewer frames are encoded (rendered with the HDR step).
+pub(crate) fn rgba8_encoding(app: &EffectcraftApp) -> vw::FrameEncoding {
+    vw::FrameEncoding::of(&app.session.project.settings, false)
+}
+
+/// A key of a display pass's parameters, for the texture caches.
+pub(crate) fn pass_key(pass: &vw::DisplayPass) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    crate::display_gpu::uniform(pass).hash(&mut h);
+    if let Some(vw::PassColor::Lut(l)) = &pass.color {
+        (std::sync::Arc::as_ptr(l) as usize).hash(&mut h);
     }
-    vw::display_transform(&mut px, ch, colorized, stops);
+    h.finish()
+}
+
+/// The display pass on the CPU over an 8-bit frame.
+fn transformed(img: &egui::ColorImage, pass: &vw::DisplayPass) -> egui::ColorImage {
+    let mut px: Vec<[u8; 4]> = img.pixels.iter().map(|c| c.to_array()).collect();
+    pass.apply_rgba8(&mut px);
     egui::ColorImage::new(img.size, px.into_iter().map(|a| Color32::from_rgba_premultiplied(a[0], a[1], a[2], a[3])).collect())
 }
 
@@ -358,10 +382,62 @@ pub(crate) fn display_key(app: &EffectcraftApp, has_conversion: bool) -> String
         + &format!("{:?}{:?}{}", app.session.project.settings.working_space, app.session.project.settings.output_space, opts.display_color_management)
 }
 
+/// Draw `src` through `pass` into `rect`: the display pass on egui-wgpu's device (one texture per
+/// slot, with mips), else on the CPU into a texture averaged down for the magnification (#417).
+fn draw_through_pass(
+    app: &mut EffectcraftApp,
+    ctx: &egui::Context,
+    painter: &egui::Painter,
+    snapshot: bool,
+    src: crate::display_gpu::Source,
+    pass: &vw::DisplayPass,
+    rect: Rect,
+) {
+    let smooth = app.session.prefs.viewer_zoom_smooth();
+    if let Some(gpu) = app.display_gpu()
+        && let Some(rs) = &app.window_wgpu
+    {
+        let bake = if snapshot { &mut app.snapshot_bake } else { &mut app.viewer_bake };
+        if let Some(id) = bake.show(rs, &gpu, &src, pass, smooth) {
+            painter.image(id, rect, bake.uv(), Color32::WHITE);
+            return;
+        }
+    }
+    let size = src.size();
+    let minify = super::viewer::minify_factor(smooth, size[0] as f64, (rect.width() * ctx.pixels_per_point()) as f64);
+    let key = {
+        use std::hash::{Hash, Hasher};
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        let ptr = match &src {
+            crate::display_gpu::Source::F16(f) => std::sync::Arc::as_ptr(f) as usize,
+            crate::display_gpu::Source::Rgba8(c) => std::sync::Arc::as_ptr(c) as usize,
+        };
+        (ptr, pass_key(pass), minify).hash(&mut h);
+        h.finish()
+    };
+    let id = egui::Id::unique(if snapshot { "viewer-snapshot-tex" } else { "viewer-display-tex" });
+    let tex = match ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(id)) {
+        Some((k, tex)) if k == key => tex,
+        _ => {
+            let img = match &src {
+                crate::display_gpu::Source::F16(f) => f.to_color_image(pass),
+                crate::display_gpu::Source::Rgba8(c) => transformed(c, pass),
+            };
+            let img = crate::frames::fit_texture_by(img, crate::frames::max_texture_side(ctx), minify);
+            let tex = ctx.load_texture(if snapshot { "viewer-snapshot" } else { "viewer-display" }, img, super::viewer::zoom_texture_options(smooth));
+            ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
+            tex
+        }
+    };
+    painter.image(tex.id(), rect, fitted_uv(ctx, size, minify), Color32::WHITE);
+}
+
 /// Draw the frame into `comp_rect`: the rendered frame (covering the region of interest when one
-/// is set), or the snapshot while Show Snapshot is on / F5 is held, through Show Channel and the
-/// exposure. Fast Previews ▸ Wireframe draws layer outlines instead.
+/// is set), or the snapshot while Show Snapshot is on / F5 is held, through the display pass (Show
+/// Channel, exposure, the HDR step of 32 bpc frames, display colour). Fast Previews ▸ Wireframe
+/// draws layer outlines instead.
 pub(crate) fn draw_frame(app: &mut EffectcraftApp, ctx: &egui::Context, painter: &egui::Painter, comp_rect: Rect, cid: ItemId, ectx: &EvalCtx) {
+    clear_sample_source(ctx);
     let opts = app.session.state.viewer.clone();
     let snap = showing_snapshot(app, ctx);
     // Settings ▸ Video ▸ Mirror on Computer Monitor off: playback goes to Video Preview only.
@@ -386,44 +462,66 @@ pub(crate) fn draw_frame(app: &mut EffectcraftApp, ctx: &egui::Context, painter:
         }
         return;
     }
+    // The snapshot went (Purge, a new one): its half floats and texture go too.
+    if app
+        .snapshot_f16
+        .as_ref()
+        .is_some_and(|(img, _)| app.session.snapshot.as_ref().is_none_or(|s| !std::ptr::eq(img.as_ptr(), std::sync::Arc::as_ptr(&s.image))))
+    {
+        app.snapshot_f16 = None;
+        app.snapshot_bake.free(app.window_wgpu.as_ref());
+    }
     let dc = vw::DisplayColor::of(&app.session);
-    let dc_key = display_key(app, dc.is_some());
-    let plain = opts.channel == Channel::Rgb && opts.exposure == 0.0 && dc.is_none();
+    let region = shown_region(ctx, [ectx.comp.width as f32, ectx.comp.height as f32]);
     let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
     if snap {
         let Some(s) = app.session.snapshot.clone() else { return };
-        let key = {
-            use std::hash::{Hash, Hasher};
-            let mut h = std::collections::hash_map::DefaultHasher::new();
-            (std::sync::Arc::as_ptr(&s.image) as usize, opts.channel.id(), opts.colorized, opts.exposure.to_bits(), &dc_key).hash(&mut h);
-            h.finish()
-        };
-        let id = egui::Id::new("viewer-snapshot-tex");
-        let tex = match ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(id)) {
-            Some((k, tex)) if k == key => tex,
-            _ => {
-                let img = crate::frames::to_color_image(&s.image);
-                let img = if plain { img } else { transformed(&img, opts.channel, opts.colorized, opts.exposure, dc) };
-                let opts = super::viewer::zoom_texture_options(app.session.prefs.viewer_zoom_smooth());
-                let tex = crate::frames::load_fitted(ctx, "viewer-snapshot", img, opts);
-                ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
-                tex
+        let pass = display_pass(app, s.encoding, dc.as_ref());
+        // The snapshot in half floats, made once (it holds the render's full range).
+        let f = match &app.snapshot_f16 {
+            Some((_, f)) => f.clone(),
+            None => {
+                let f = std::sync::Arc::new(crate::frames::F16Frame::from_image(&s.image, s.encoding));
+                app.snapshot_f16 = Some((std::sync::Arc::downgrade(&s.image), f.clone()));
+                f
             }
         };
-        painter.image(tex.id(), comp_rect, uv, Color32::WHITE);
+        draw_through_pass(app, ctx, painter, true, crate::display_gpu::Source::F16(f), &pass, comp_rect);
+        note_sample_source(ctx, SampleSource::Snapshot(s.image.clone()), [0.0, 0.0, ectx.comp.width as f64, ectx.comp.height as f64], Some(pass));
         painter.text(comp_rect.left_top() + vec2(6.0, 6.0), Align2::LEFT_TOP, crate::i18n::tr("Snapshot"), Tokens::ui(11.0), SNAP_COLOR);
         return;
     }
+    let zoom = comp_rect.width() as f64 / ectx.comp.width.max(1) as f64;
+    let roi_rect = || match texture_roi(ctx) {
+        Some([x, y, w, h]) => Rect::from_min_size(comp_rect.min + vec2((x * zoom) as f32, (y * zoom) as f32), vec2((w * zoom) as f32, (h * zoom) as f32)),
+        None => comp_rect,
+    };
+    // A half-float frame (32 bpc): always through the display pass, which applies the HDR step
+    // after the exposure.
+    if let Some(f) = app.viewer_f16.clone() {
+        if app.viewer_shown.is_none_or(|(_, k)| k.comp != cid.0) {
+            return;
+        }
+        let pass = display_pass(app, f.encoding, dc.as_ref());
+        draw_through_pass(app, ctx, painter, false, crate::display_gpu::Source::F16(f.clone()), &pass, roi_rect());
+        note_sample_source(ctx, SampleSource::F16(f), region, Some(pass));
+        return;
+    }
+    let pass = display_pass(app, rgba8_encoding(app), dc.as_ref());
+    let plain = pass.is_identity();
     // A GPU frame (the web viewer): drawn straight from its texture; Show Channel / exposure
     // read it back first (asynchronously in the browser: from the next frame on).
-    let gpu = matches!((&app.viewer_shown, &app.viewer_native), (Some(s), Some(n)) if s.0 == n.0 && s.1 == n.1 && n.1.comp == cid.0);
+    let gpu = matches!((&app.viewer_shown, &app.viewer_native), (Some(s), Some(n)) if s.0 == Some(n.0) && s.1 == n.1 && n.1.comp == cid.0);
     let rect = if gpu {
-        let Some(id) = app.viewer_shown.map(|s| s.0) else { return };
+        let Some(id) = app.viewer_shown.and_then(|s| s.0) else { return };
         if plain || app.viewer_pixels().is_none() {
             if !plain {
                 ctx.request_repaint();
             }
             painter.image(id, comp_rect, uv, Color32::WHITE);
+            if let Some((_, key)) = app.viewer_shown {
+                note_sample_source(ctx, SampleSource::Gpu(key), region, None);
+            }
             return;
         }
         comp_rect
@@ -432,40 +530,81 @@ pub(crate) fn draw_frame(app: &mut EffectcraftApp, ctx: &egui::Context, painter:
         if k.comp != cid.0 {
             return;
         }
-        let zoom = comp_rect.width() as f64 / ectx.comp.width.max(1) as f64;
-        let rect = match texture_roi(ctx) {
-            Some([x, y, w, h]) => Rect::from_min_size(comp_rect.min + vec2((x * zoom) as f32, (y * zoom) as f32), vec2((w * zoom) as f32, (h * zoom) as f32)),
-            None => comp_rect,
-        };
+        let rect = roi_rect();
         if plain {
             let uv = app.viewer_image.as_ref().map_or(uv, |src| fitted_uv(ctx, src.size, minify));
             painter.image(tex.id(), rect, uv, Color32::WHITE);
+            if let Some(image) = app.viewer_image.clone() {
+                note_sample_source(ctx, SampleSource::Cpu(image), region, None);
+            }
             return;
         }
         rect
     };
     let Some(src) = app.viewer_image.clone() else { return };
-    let smooth = app.session.prefs.viewer_zoom_smooth();
-    // Averaged down for the magnification, as the frame's own texture is (#417).
-    let minify = super::viewer::minify_factor(smooth, src.size[0] as f64, (rect.width() * ctx.pixels_per_point()) as f64);
-    let key = {
-        use std::hash::{Hash, Hasher};
-        let mut h = std::collections::hash_map::DefaultHasher::new();
-        (std::sync::Arc::as_ptr(&src) as usize, opts.channel.id(), opts.colorized, opts.exposure.to_bits(), &dc_key, minify).hash(&mut h);
-        h.finish()
-    };
-    let id = egui::Id::new("viewer-display-tex");
-    let tex = match ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(id)) {
-        Some((k, tex)) if k == key => tex,
-        _ => {
-            let img =
-                crate::frames::fit_texture_by(transformed(&src, opts.channel, opts.colorized, opts.exposure, dc), crate::frames::max_texture_side(ctx), minify);
-            let tex = ctx.load_texture("viewer-display", img, super::viewer::zoom_texture_options(smooth));
-            ctx.data_mut(|d| d.insert_temp(id, (key, tex.clone())));
-            tex
+    draw_through_pass(app, ctx, painter, false, crate::display_gpu::Source::Rgba8(src.clone()), &pass, rect);
+    note_sample_source(ctx, SampleSource::Cpu(src), region, Some(pass));
+}
+
+#[derive(Clone)]
+enum SampleSource {
+    Cpu(std::sync::Arc<egui::ColorImage>),
+    F16(std::sync::Arc<crate::frames::F16Frame>),
+    Gpu(crate::frames::FrameKey),
+    Snapshot(std::sync::Arc<effectcraft_engine::render::Image>),
+}
+
+#[derive(Clone)]
+struct DisplayedSample {
+    pass: u64,
+    source: SampleSource,
+    region: [f64; 4],
+    display: Option<vw::DisplayPass>,
+}
+
+fn sample_source_id() -> egui::Id {
+    egui::Id::unique("viewer-displayed-sample-source")
+}
+
+pub(crate) fn clear_sample_source(ctx: &egui::Context) {
+    ctx.data_mut(|data| data.remove::<DisplayedSample>(sample_source_id()));
+}
+
+fn note_sample_source(ctx: &egui::Context, source: SampleSource, region: [f64; 4], display: Option<vw::DisplayPass>) {
+    let sample = DisplayedSample { pass: ctx.cumulative_pass_nr(), source, region, display };
+    ctx.data_mut(|data| data.insert_temp(sample_source_id(), sample));
+}
+
+/// Sample only a frame actually drawn this pass, with that draw's display pass (channel,
+/// exposure, HDR step and display conversion). Hidden and wireframe views deliberately have no
+/// sample source.
+pub(crate) fn sample_displayed(app: &EffectcraftApp, ctx: &egui::Context, point: [f64; 2]) -> Option<[f32; 4]> {
+    let sample = ctx.data(|data| data.get_temp::<DisplayedSample>(sample_source_id()))?;
+    if sample.pass != ctx.cumulative_pass_nr() {
+        return None;
+    }
+    let rgba8 = |c: Color32| c.to_array().map(|v| v as f32 / 255.0);
+    // The frame's premultiplied pixel.
+    let raw: [f32; 4] = match sample.source {
+        SampleSource::Cpu(image) => rgba8(super::fx_widgets::frame_pixel(&image, sample.region, point)?),
+        SampleSource::F16(f) => f.pixel(super::fx_widgets::frame_pixel_index(f.size(), sample.region, point)?)?,
+        SampleSource::Gpu(key) => {
+            if app.viewer_shown.map(|(_, shown)| shown) != Some(key) {
+                return None;
+            }
+            rgba8(super::fx_widgets::frame_pixel(app.viewer_image.as_ref()?, sample.region, point)?)
+        }
+        SampleSource::Snapshot(image) => {
+            let index = super::fx_widgets::frame_pixel_index([image.width as usize, image.height as usize], sample.region, point)?;
+            *image.data.get(index)?
         }
     };
-    painter.image(tex.id(), rect, fitted_uv(ctx, src.size, minify), Color32::WHITE);
+    let shown = match &sample.display {
+        Some(pass) => pass.pixel(raw),
+        None => crate::frames::display_pixel(raw).to_array(),
+    };
+    let image = egui::ColorImage::new([1, 1], vec![Color32::from_rgba_premultiplied(shown[0], shown[1], shown[2], shown[3])]);
+    super::fx_widgets::sample_frame(&image, [0.0, 0.0, 1.0, 1.0], [0.5, 0.5])
 }
 
 /// The texture coordinates of a frame of `size` in its texture, fitted with at least `minify`
@@ -479,7 +618,7 @@ fn fitted_uv(ctx: &egui::Context, size: [usize; 2], minify: usize) -> Rect {
 /// A popup list above `anchor` (selected entries highlighted); entries register
 /// `viewer.<auto>.<n>` automation ids.
 fn popup(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: &str, anchor: Rect, items: &[(String, bool)], auto: &str) -> Option<usize> {
-    let pid = egui::Id::new(id);
+    let pid = egui::Id::unique(id);
     if !widgets::popup_is_open(ui, pid) {
         return None;
     }
@@ -505,8 +644,9 @@ fn popup(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: &str, anchor: Rect, it
     })
 }
 
+/// Flip the open flag of the popup with `id`; the caller that owns the popup reads the same flag.
 fn toggle_popup(ui: &egui::Ui, id: &str) {
-    let pid = egui::Id::new(id).with("open");
+    let pid = egui::Id::unique(id).with("open");
     let open: bool = ui.data(|d| d.get_temp(pid).unwrap_or(false));
     ui.data_mut(|d| d.insert_temp(pid, !open));
 }
@@ -529,8 +669,8 @@ pub(crate) fn magnification_menu(
     let t = app.tokens;
     let ppp = ui.ctx().pixels_per_point();
     let pop = format!("{id}-pop");
-    let response =
-        widgets::dropdown(ui, r, &magnification_label(zoom * ppp * 100.0), &t, egui::Id::new(id)).on_hover_text(crate::i18n::tr("Magnification ratio popup"));
+    let response = widgets::dropdown(ui, r, &magnification_label(zoom * ppp * 100.0), &t, egui::Id::unique(id))
+        .on_hover_text(crate::i18n::tr("Magnification ratio popup"));
     if response.clicked() {
         toggle_popup(ui, &pop);
     }
@@ -584,8 +724,8 @@ pub(crate) fn resolution_label(res: Resolution, scale: f64) -> String {
 }
 
 /// The Composition panel's bottom bar, in After Effects 2026 order: magnification, resolution,
-/// transparency grid, mask and shape path visibility, region of interest, grid and guide
-/// options, show channel, reset exposure, exposure, take / show snapshot, Fast Previews, the 3D
+/// Fast Previews, transparency grid, mask and shape path visibility, region of interest, grid and
+/// guide options, show channel, reset exposure, exposure, take / show snapshot, the 3D
 /// renderer and view, and the current time.
 pub(crate) fn bottom_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, zoom: f32, time: Tick, comp: &Comp) {
     let t = app.tokens;
@@ -616,6 +756,31 @@ pub(crate) fn bottom_bar(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect,
     });
 }
 
+/// The exposure drag field (stops) at `er`; a change runs `view.exposure`.
+fn exposure_field(app: &mut EffectcraftApp, ui: &mut egui::Ui, er: Rect, stops: f64) {
+    let mut ev = stops;
+    let resp = ui.put(
+        er,
+        crate::widgets::drag_value(
+            egui::DragValue::new(&mut ev)
+                .speed(0.05)
+                .range(-40.0..=40.0)
+                .fixed_decimals(1)
+                .custom_formatter(|v, _| if v == 0.0 { "0.0".into() } else { format!("{v:+.1}") }),
+        ),
+    );
+    let resp = resp.on_hover_text(crate::i18n::tr("Adjust Exposure (stops)"));
+    app.auto.add_response("viewer.exposure", &resp, "Adjust Exposure");
+    if resp.changed() {
+        let _ = app.session.execute("view.exposure", json!({"stops": ev}));
+    }
+}
+
+/// Lay out the viewer's control row from `bar.min.x`: magnification, resolution, Fast Previews,
+/// transparency, mask, ROI, grid/guide, channel/colour management, exposure, snapshot, 3D
+/// renderer/view and Extended Viewer, timecode and render-time indicators, running commands or
+/// toggling viewer UI state. Returns the width the row occupies, at least `bar.width()`, for the
+/// horizontal scroll area.
 fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, zoom: f32, time: Tick, comp: &Comp) -> f32 {
     let t = app.tokens;
     let p = ui.painter().clone();
@@ -637,7 +802,7 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
     let r = Rect::from_min_size(pos2(x, cy - 10.0), vec2(84.0, 20.0));
     let scale = app.viewer_scale(zoom, ppp);
     let res = app.viewer_res();
-    let response = widgets::dropdown(ui, r, &resolution_label(res, scale), &t, egui::Id::new("vw-res"))
+    let response = widgets::dropdown(ui, r, &resolution_label(res, scale), &t, egui::Id::unique("vw-res"))
         .on_hover_text(crate::i18n::tr("Resolution/Down Sample Factor Popup"));
     if response.clicked() {
         toggle_popup(ui, "vw-res-pop");
@@ -665,11 +830,21 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
         let r = Rect::from_min_size(pos2(*x, cy - 11.0), vec2(22.0, 22.0));
         // The tip is the English source: the tooltip is looked up in the catalog, while the
         // automation label stays English for scripts and tests.
-        let resp = widgets::icon_button(ui, r, icon, on, &t, egui::Id::new(("vw-btn", id))).on_hover_text(crate::i18n::tr(tip));
+        let resp = widgets::icon_button(ui, r, icon, on, &t, egui::Id::unique(("vw-btn", id))).on_hover_text(crate::i18n::tr(tip));
         auto.add_response(&format!("viewer.{id}"), &resp, tip);
         *x += 24.0;
         (resp.clicked(), r)
     };
+    // Fast Previews.
+    let fp = app.session.state.viewer.fast_previews;
+    let (clicked, fr) = tog(ui, &mut app.auto, &mut x, Icon::Sparkle, fp != FastPreviews::Off || app.ui.viewer.fast_preview, "fastPreviews", "Fast Previews");
+    if clicked {
+        toggle_popup(ui, "vw-fast-pop");
+    }
+    let items: Vec<(String, bool)> = FastPreviews::ALL.iter().map(|m| (m.label().to_string(), fp == *m)).collect();
+    if let Some(i) = popup(app, ui, "vw-fast-pop", fr, &items, "fastPreviewsItem") {
+        let _ = app.session.execute("view.fastPreviewMode", json!({"mode": FastPreviews::ALL[i].id()}));
+    }
     if tog(ui, &mut app.auto, &mut x, Icon::Checker, app.ui.viewer.transparency_grid, "transparency", "Toggle Transparency Grid").0 {
         app.ui.viewer.transparency_grid = !app.ui.viewer.transparency_grid;
     }
@@ -735,22 +910,7 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
         let _ = app.session.execute("view.resetExposure", json!({}));
     }
     let er = Rect::from_min_size(pos2(x, cy - 10.0), vec2(42.0, 20.0));
-    let mut ev = vo.exposure as f64;
-    let resp = ui.put(
-        er,
-        crate::widgets::drag_value(
-            egui::DragValue::new(&mut ev)
-                .speed(0.05)
-                .range(-40.0..=40.0)
-                .fixed_decimals(1)
-                .custom_formatter(|v, _| if v == 0.0 { "0.0".into() } else { format!("{v:+.1}") }),
-        ),
-    );
-    let resp = resp.on_hover_text(crate::i18n::tr("Adjust Exposure (stops)"));
-    app.auto.add_response("viewer.exposure", &resp, "Adjust Exposure");
-    if resp.changed() {
-        let _ = app.session.execute("view.exposure", json!({"stops": ev}));
-    }
+    exposure_field(app, ui, er, vo.exposure as f64);
     x = er.max.x + 4.0;
     // Snapshots.
     if tog(ui, &mut app.auto, &mut x, Icon::Snapshot, false, "snapshot", "Take Snapshot").0 {
@@ -767,16 +927,6 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
     if app.session.snapshot.is_some() && held != app.session.state.viewer.show_snapshot {
         let _ = app.session.execute("view.showSnapshot", json!({"value": held}));
     }
-    // Fast Previews.
-    let fp = vo.fast_previews;
-    let (clicked, fr) = tog(ui, &mut app.auto, &mut x, Icon::Sparkle, fp != FastPreviews::Off || app.ui.viewer.fast_preview, "fastPreviews", "Fast Previews");
-    if clicked {
-        toggle_popup(ui, "vw-fast-pop");
-    }
-    let items: Vec<(String, bool)> = FastPreviews::ALL.iter().map(|m| (m.label().to_string(), fp == *m)).collect();
-    if let Some(i) = popup(app, ui, "vw-fast-pop", fr, &items, "fastPreviewsItem") {
-        let _ = app.session.execute("view.fastPreviewMode", json!({"mode": FastPreviews::ALL[i].id()}));
-    }
     x += 4.0;
     // 3D renderer + view.
     if comp.has_3d() {
@@ -786,7 +936,7 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
         let renderers = [(Renderer::Classic3D, "Classic 3D", "classic3D"), (Renderer::Advanced3D, "Advanced 3D", "advanced3D")];
         let current = renderers.iter().find(|(r, ..)| *r == comp.renderer).map_or("Classic 3D", |(_, label, _)| *label);
         let r = Rect::from_min_size(pos2(x, cy - 10.0), vec2(96.0, 20.0));
-        if widgets::dropdown(ui, r, crate::i18n::tr(current), &t, egui::Id::new("vw-3d")).clicked() {
+        if widgets::dropdown(ui, r, crate::i18n::tr(current), &t, egui::Id::unique("vw-3d")).clicked() {
             toggle_popup(ui, "vw-3d-pop");
         }
         app.auto.add("viewer.renderer3d", r, current);
@@ -801,13 +951,13 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
         let cid = app.session.active_comp_id();
         let cur = cid.and_then(|c| app.session.state.views3d.get(&c)).map(|v| v.current).unwrap_or_default();
         let r = Rect::from_min_size(pos2(x, cy - 10.0), vec2(118.0, 20.0));
-        let response = widgets::dropdown(ui, r, cur.label(), &t, egui::Id::new("vw-cam"));
+        let response = widgets::dropdown(ui, r, crate::panels::viewer::view3d_label(cur), &t, egui::Id::unique("vw-cam"));
         if response.clicked() {
             toggle_popup(ui, "vw-cam-pop");
         }
         app.auto.add_response("viewer.view3d", &response, "3D View");
         use effectcraft_engine::render::three_d::View3D;
-        let items: Vec<(String, bool)> = View3D::ALL.iter().map(|v| (v.label().to_string(), *v == cur)).collect();
+        let items: Vec<(String, bool)> = View3D::ALL.iter().map(|v| (crate::panels::viewer::view3d_label(*v).to_string(), *v == cur)).collect();
         if let Some(i) = popup(app, ui, "vw-cam-pop", r, &items, "view3dItem") {
             let _ = app.session.execute("view.set3DView", json!({"view": View3D::ALL[i].id()}));
         }
@@ -824,8 +974,8 @@ fn bottom_bar_contents(app: &mut EffectcraftApp, ui: &mut egui::Ui, bar: Rect, z
     let g = p.layout_no_wrap(tc, Tokens::mono(12.0), t.timecode);
     let tr = Rect::from_min_size(pos2(x + 4.0, cy - 9.0), g.size() + vec2(8.0, 4.0));
     p.galley(pos2(tr.min.x + 4.0, tr.min.y + 2.0), g, t.timecode);
-    let resp = ui.interact(tr, egui::Id::new("vw-timecode"), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Current time"));
+    let resp = ui.interact(tr, egui::Id::unique("vw-timecode"), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Current time"));
     if resp.has_focus() {
         p.rect_stroke(tr.shrink(1.0), 2.0, Stroke::new(1.0, t.focus), StrokeKind::Inside);
     }
diff --git a/crates/ui-egui/src/panels/viewers.rs b/crates/ui-egui/src/panels/viewers.rs
index 8d2351330..fabfe586f 100644
--- a/crates/ui-egui/src/panels/viewers.rs
+++ b/crates/ui-egui/src/panels/viewers.rs
@@ -14,7 +14,7 @@ use egui::{Align2, Color32, Rect, Sense, pos2, vec2};
 use serde_json::json;
 
 use crate::EffectcraftApp;
-use crate::dock::PanelKind;
+use crate::dock::{PanelKind, WorkspaceExt as _};
 use crate::frames::{FrameImage, FrameKey};
 use crate::theme::Tokens;
 
@@ -22,13 +22,25 @@ use crate::theme::Tokens;
 pub enum PassiveTexture {
     Cpu(egui::TextureHandle),
     Gpu(egui::TextureId, Arc<effectcraft_gpu::DisplayFrame>),
+    /// A half-float frame (32 bpc) through the display pass on egui-wgpu's device.
+    Baked(Box<crate::display_gpu::Bake>),
 }
 
 impl PassiveTexture {
-    fn id(&self) -> egui::TextureId {
+    /// The texture to draw (`None`: the display pass has not made one).
+    fn id(&self) -> Option<egui::TextureId> {
         match self {
-            PassiveTexture::Cpu(h) => h.id(),
-            PassiveTexture::Gpu(id, _) => *id,
+            PassiveTexture::Cpu(h) => Some(h.id()),
+            PassiveTexture::Gpu(id, _) => Some(*id),
+            PassiveTexture::Baked(b) => b.id(),
+        }
+    }
+
+    /// Where the frame is in the texture (a frame past the texture limit is averaged down).
+    fn uv(&self) -> Rect {
+        match self {
+            PassiveTexture::Baked(b) => b.uv(),
+            _ => Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)),
         }
     }
 }
@@ -59,7 +71,7 @@ pub fn locked(app: &EffectcraftApp, id: u32) -> bool {
 /// Viewer `id`'s panel is docked or floating.
 fn open(app: &EffectcraftApp, id: u32) -> bool {
     let p = panel(id);
-    app.ui.dock.contains(p) || app.ui.floating.iter().any(|f| f.panels.contains(&p))
+    app.ui.dock.is_open(p)
 }
 
 /// The comp viewer `id` shows: the active comp in the active viewer, else its own.
@@ -89,7 +101,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: u32, rect: Rect) {
     let ctx = ui.ctx().clone();
     let p = ui.painter().with_clip_rect(rect);
     p.rect_filled(rect, 0.0, t.pasteboard);
-    let resp = ui.interact(rect, egui::Id::new(("passive-viewer", id)), Sense::click()).on_hover_text(tr("Click to make this viewer active"));
+    let resp = ui.interact(rect, egui::Id::unique(("passive-viewer", id)), Sense::click()).on_hover_text(tr("Click to make this viewer active"));
     app.auto.add(&format!("viewers.{id}"), rect, "Composition viewer (click to make it active)");
     match comp_of(app, id).and_then(|cid| Some((cid, app.session.project.comp(cid)?.clone()))) {
         Some((cid, c)) => {
@@ -106,9 +118,9 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: u32, rect: Rect) {
                 let dkey = display_hash(&super::viewer_tools::display_key(app, dc.is_some()));
                 set_texture(app, &ctx, id, key, img, dc, dkey);
             }
-            match app.passive_tex.get(&id).filter(|(k, _)| k.comp == cid.0) {
-                Some((_, tex)) => {
-                    p.image(tex.id(), r, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+            match app.passive_tex.get(&id).filter(|(k, _)| k.comp == cid.0).and_then(|(_, tex)| Some((tex.id()?, tex.uv()))) {
+                Some((tex, uv)) => {
+                    p.image(tex, r, uv, Color32::WHITE);
                 }
                 None => {
                     let bg = c.background;
@@ -128,7 +140,7 @@ pub fn show(app: &mut EffectcraftApp, ui: &mut egui::Ui, id: u32, rect: Rect) {
 }
 
 /// Keep the frame viewer `id` shows in its texture.
-fn set_texture(
+pub(crate) fn set_texture(
     app: &mut EffectcraftApp,
     ctx: &egui::Context,
     id: u32,
@@ -137,7 +149,7 @@ fn set_texture(
     dc: Option<effectcraft_engine::viewer::DisplayColor>,
     dkey: u64,
 ) {
-    let dc_id = egui::Id::new(("passive-viewer-display", id));
+    let dc_id = egui::Id::unique(("passive-viewer-display", id));
     let same_display = ctx.data(|d| d.get_temp::<u64>(dc_id)) == Some(dkey);
     if let Some((k, _)) = app.passive_tex.get_mut(&id)
         && *k == key
@@ -149,16 +161,19 @@ fn set_texture(
         return;
     }
     ctx.data_mut(|d| d.insert_temp(dc_id, dkey));
-    let opts = super::viewer::zoom_texture_options(app.session.prefs.viewer_zoom_smooth());
-    // The monitor conversion the active viewer applies (Use Display Color Management).
-    let img = match (img, &dc) {
-        (FrameImage::Cpu(img), Some(dc)) => {
-            let mut px: Vec<[u8; 4]> = img.pixels.iter().map(|c| c.to_array()).collect();
-            dc.apply(&mut px);
-            let pixels = px.into_iter().map(|a| Color32::from_rgba_premultiplied(a[0], a[1], a[2], a[3])).collect();
-            FrameImage::Cpu(Arc::new(egui::ColorImage::new(img.size, pixels)))
+    let smooth = app.session.prefs.viewer_zoom_smooth();
+    let opts = super::viewer::zoom_texture_options(smooth);
+    let pass = |encoding| passive_pass(encoding, dc.as_ref());
+    let gpu = app.display_gpu();
+    let img = match img {
+        // Frames past the display texture limit take the CPU pass (display conversion first, then
+        // the averaging down), which the GPU bake leaves out.
+        FrameImage::CpuF16(f)
+            if app.window_wgpu.is_some() && gpu.as_ref().is_some_and(|g| !crate::display_gpu::Source::F16(f.clone()).needs_cpu_pass(g.max_side())) =>
+        {
+            FrameImage::CpuF16(f)
         }
-        (img, _) => img,
+        img => cpu_passive_image(app, img, dc.as_ref()),
     };
     let tex = match (img, app.passive_tex.remove(&id)) {
         (FrameImage::Cpu(img), Some((_, PassiveTexture::Cpu(mut h))))
@@ -171,10 +186,23 @@ fn set_texture(
             free(app, old.map(|(_, t)| t));
             PassiveTexture::Cpu(crate::frames::load_fitted(ctx, format!("viewer-{id}"), (*img).clone(), opts))
         }
+        (FrameImage::CpuF16(f), old) => {
+            let Some(gpu) = gpu else { return };
+            let mut bake = match old {
+                Some((_, PassiveTexture::Baked(b))) => b,
+                old => {
+                    free(app, old.map(|(_, t)| t));
+                    Box::default()
+                }
+            };
+            let Some(rs) = &app.window_wgpu else { return };
+            bake.show(rs, &gpu, &crate::display_gpu::Source::F16(f.clone()), &pass(f.encoding), smooth);
+            PassiveTexture::Baked(bake)
+        }
         (FrameImage::Gpu(f), old) => {
             let Some(rs) = &app.wgpu else { return };
             let view = f.texture.create_view(&Default::default());
-            let sampler = || super::viewer::zoom_sampler(app.session.prefs.viewer_zoom_smooth());
+            let sampler = || super::viewer::zoom_sampler(smooth);
             let mut ren = rs.renderer.write();
             let tid = match old {
                 Some((_, PassiveTexture::Gpu(tid, _))) => {
@@ -189,6 +217,35 @@ fn set_texture(
     app.passive_tex.insert(id, (key, tex));
 }
 
+/// A passive viewer's display pass: the monitor conversion the active viewer applies (Use
+/// Display Color Management), with no channel or exposure of its own; for half-float frames
+/// also the HDR step.
+fn passive_pass(
+    encoding: effectcraft_engine::viewer::FrameEncoding,
+    dc: Option<&effectcraft_engine::viewer::DisplayColor>,
+) -> effectcraft_engine::viewer::DisplayPass {
+    effectcraft_engine::viewer::DisplayPass::new(effectcraft_engine::viewer::Channel::Rgb, false, 0.0, encoding, dc)
+}
+
+/// A frame as a passive viewer shows it without the display pass on the GPU: CPU frames through
+/// [`passive_pass`] (GPU frames unchanged).
+pub(crate) fn cpu_passive_image(app: &EffectcraftApp, img: FrameImage, dc: Option<&effectcraft_engine::viewer::DisplayColor>) -> FrameImage {
+    match img {
+        FrameImage::Cpu(img) => {
+            let pass = passive_pass(super::viewer_tools::rgba8_encoding(app), dc);
+            if pass.is_identity() {
+                return FrameImage::Cpu(img);
+            }
+            let mut px: Vec<[u8; 4]> = img.pixels.iter().map(|c| c.to_array()).collect();
+            pass.apply_rgba8(&mut px);
+            let pixels = px.into_iter().map(|a| Color32::from_rgba_premultiplied(a[0], a[1], a[2], a[3])).collect();
+            FrameImage::Cpu(Arc::new(egui::ColorImage::new(img.size, pixels)))
+        }
+        FrameImage::CpuF16(f) => FrameImage::Cpu(Arc::new(f.to_color_image(&passive_pass(f.encoding, dc)))),
+        img => img,
+    }
+}
+
 /// A hash of the display conversion's inputs (see `viewer_tools::display_key`).
 fn display_hash(key: &str) -> u64 {
     use std::hash::{Hash, Hasher};
@@ -199,8 +256,10 @@ fn display_hash(key: &str) -> u64 {
 
 /// Give a passive viewer's texture back (GPU textures are registered with the renderer).
 fn free(app: &EffectcraftApp, tex: Option<PassiveTexture>) {
-    if let (Some(PassiveTexture::Gpu(id, _)), Some(rs)) = (tex, &app.wgpu) {
-        rs.renderer.write().free_texture(&id);
+    match (tex, &app.wgpu) {
+        (Some(PassiveTexture::Gpu(id, _)), Some(rs)) => rs.renderer.write().free_texture(&id),
+        (Some(PassiveTexture::Baked(mut b)), _) => b.free(app.window_wgpu.as_ref()),
+        _ => {}
     }
 }
 
@@ -241,7 +300,7 @@ pub fn on_open_comp(app: &mut EffectcraftApp, comp: ItemId) {
     // The comp's viewer and its Timeline tab come to the front (unless locked), reopened if they
     // were closed (as in After Effects).
     for p in [active_panel(app), PanelKind::Timeline] {
-        let closed = !app.ui.dock.contains(p) && !app.ui.floating.iter().any(|f| f.panels.contains(&p));
+        let closed = !app.ui.dock.is_open(p);
         if closed || !app.ui.locked_tabs.contains(&p.id()) {
             app.raise_panel(p);
         }
@@ -267,8 +326,8 @@ fn add_viewer(app: &mut EffectcraftApp, near: u32) -> u32 {
     let id = app.ui.viewers.keys().copied().max().unwrap_or(0).saturating_add(1).max(1);
     app.ui.viewers.insert(id, None);
     let p = panel(id);
-    let anchor = if app.ui.dock.contains(panel(near)) { panel(near) } else { PanelKind::Composition };
-    app.ui.dock.open_near(p, anchor);
+    let anchor = [panel(near), PanelKind::Composition].into_iter().find(|q| app.ui.dock.is_open(*q));
+    let _ = app.ui.dock.apply(craft_ui::docking::Action::Open { panel: p, anchor }, crate::dock::permissions);
     id
 }
 
@@ -297,5 +356,5 @@ pub fn on_close(app: &mut EffectcraftApp, p: PanelKind) {
 /// The tab label of viewer `id` ("Composition Intro").
 pub fn title(app: &EffectcraftApp, id: u32) -> Option<String> {
     let c = comp_of(app, id)?;
-    Some(format!("Composition {}", app.session.project.item(c)?.name))
+    Some(format!("{} {}", crate::i18n::command_label("window.panel", "Composition"), app.session.project.item(c)?.name))
 }
diff --git a/crates/ui-egui/src/pointer_wrap.rs b/crates/ui-egui/src/pointer_wrap.rs
index a4aefe33a..53748bd7e 100644
--- a/crates/ui-egui/src/pointer_wrap.rs
+++ b/crates/ui-egui/src/pointer_wrap.rs
@@ -12,8 +12,9 @@ struct State {
     disabled: bool,
 }
 
+/// The temp-data id of the [`State`] that tracks a numeric scrub across monitor edges.
 fn state_id() -> Id {
-    Id::new("numeric-pointer-wrap")
+    Id::unique("numeric-pointer-wrap")
 }
 
 /// Opt in only number scrubs, never object, keyframe, panel or scrollbar drags.
@@ -176,356 +177,4 @@ pub(crate) fn finish_native(ctx: &Context, frame: &eframe::Frame) {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use egui::{Event, Id, Modifiers, PointerButton, pos2, vec2};
-
-    struct Scrub {
-        ctx: Context,
-        value: f64,
-        bounds: Rect,
-        time: f64,
-        accept_warp: bool,
-        warps: Vec<Pos2>,
-        standard: bool,
-        ordinary: bool,
-        angle: bool,
-        angle_rects: Option<(Rect, Rect)>,
-        modifiers: Modifiers,
-        injected: bool,
-    }
-
-    impl Scrub {
-        fn new() -> Self {
-            Self {
-                ctx: Context::default(),
-                value: 0.0,
-                bounds: Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0)),
-                time: 0.0,
-                accept_warp: true,
-                warps: Vec::new(),
-                standard: false,
-                ordinary: false,
-                angle: false,
-                angle_rects: None,
-                modifiers: Modifiers::NONE,
-                injected: false,
-            }
-        }
-
-        fn frame(&mut self, events: Vec<Event>, focused: bool) {
-            self.time += 0.02;
-            let mut raw = RawInput {
-                screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0))),
-                time: Some(self.time),
-                events,
-                focused,
-                ..Default::default()
-            };
-            raw.events.push(Event::ModifiersChanged(self.modifiers));
-            prepare_input(&self.ctx, &mut raw, self.injected);
-            let mut out = self.ctx.run_ui(raw, |ui| {
-                if self.standard {
-                    ui.put(
-                        Rect::from_min_size(pos2(100.0, 100.0), vec2(60.0, 20.0)),
-                        crate::widgets::drag_value(egui::DragValue::new(&mut self.value).speed(1.0).max_decimals(3)),
-                    );
-                } else if self.ordinary {
-                    ui.interact(Rect::from_min_size(pos2(100.0, 100.0), vec2(60.0, 20.0)), Id::new("ordinary"), egui::Sense::drag());
-                } else if self.angle {
-                    let (rr, dr, value) = crate::panels::fx_widgets::angle_field(
-                        ui,
-                        pos2(100.0, 100.0),
-                        Id::new("scrub"),
-                        self.value,
-                        1,
-                        &crate::theme::Tokens::for_kind(crate::theme::ThemeKind::Dark),
-                    );
-                    self.angle_rects = Some((rr, dr));
-                    if let Some(v) = value {
-                        self.value = v;
-                    }
-                } else {
-                    let (_, value, _) = crate::widgets::hot_number_at(
-                        ui,
-                        pos2(100.0, 100.0),
-                        Id::new("scrub"),
-                        self.value,
-                        1.0,
-                        (-1e9, 1e9),
-                        1,
-                        "",
-                        &crate::theme::Tokens::for_kind(crate::theme::ThemeKind::Dark),
-                    );
-                    if let Some(v) = value {
-                        self.value = v;
-                    }
-                }
-                finish_frame(ui.ctx(), self.bounds, |p| {
-                    self.warps.push(p);
-                    self.accept_warp.then_some(p)
-                });
-            });
-            out.textures_delta.clear();
-        }
-
-        fn move_to(&mut self, p: Pos2) {
-            self.frame(vec![Event::PointerMoved(p)], true);
-        }
-
-        fn begin(&mut self) {
-            self.frame(vec![], true);
-            let p = pos2(105.0, 108.0);
-            self.frame(
-                vec![Event::PointerMoved(p), Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }],
-                true,
-            );
-            self.move_to(p + vec2(10.0, 0.0));
-        }
-    }
-
-    #[test]
-    fn angle_degrees_continue_across_zero_and_repeated_monitor_wraps() {
-        for initial in [0.0, 359.5, -359.5, 720.0, -720.0] {
-            for direction in [-1.0, 1.0] {
-                let mut s = Scrub::new();
-                s.angle = true;
-                s.value = initial;
-                s.frame(vec![], true);
-                let p = s.angle_rects.unwrap().1.center();
-                s.frame(
-                    vec![Event::PointerMoved(p), Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }],
-                    true,
-                );
-                let mut last = p;
-                let mut expected = initial;
-                // Feed small real movements, including zero/whole-turn crossings, then
-                // the synthetic OS warp. Every real pixel contributes exactly once.
-                for step in 0..800 {
-                    let direction = if step < 400 { direction } else { -direction };
-                    let next = pos2((last.x + direction * 13.0).clamp(1.0, 799.0), last.y);
-                    expected += f64::from(next.x - last.x) * 0.5;
-                    let count = s.warps.len();
-                    s.move_to(next);
-                    assert!((s.value - expected).abs() < 1e-6, "initial={initial}, direction={direction}, actual={}, expected={expected}", s.value);
-                    last = next;
-                    if s.warps.len() > count {
-                        last = *s.warps.last().unwrap();
-                        s.move_to(last);
-                        assert!((s.value - expected).abs() < 1e-6, "the teleport must not reset the angle");
-                    }
-                }
-                assert!(s.warps.len() >= 5);
-            }
-        }
-    }
-
-    #[test]
-    fn numeric_drag_wraps_repeatedly_without_counting_the_teleport() {
-        let mut s = Scrub::new();
-        s.begin();
-        for _ in 0..5 {
-            s.move_to(pos2(799.0, 108.0));
-            let target = *s.warps.last().expect("numeric drag must wrap at the monitor edge");
-            assert!(target.x < 16.0);
-            let before = s.value;
-            s.move_to(target);
-            assert_eq!(s.value, before, "the warp itself must not change the value");
-            s.move_to(target + vec2(20.0, 0.0));
-            assert_eq!(s.value, before + 20.0);
-        }
-        assert_eq!(s.warps.len(), 5);
-        s.move_to(pos2(0.0, 108.0));
-        let target = *s.warps.last().unwrap();
-        assert!(target.x > 780.0);
-        let before = s.value;
-        s.move_to(target - vec2(3.0, 0.0));
-        assert_eq!(s.value, before - 3.0, "coalesced movement after a left-edge warp is preserved");
-    }
-
-    /// An agent's `ui.drag` over the control channel scrubs the value but never moves the user's
-    /// real cursor, even at the window's (monitor's) edge.
-    #[test]
-    fn injected_drags_never_warp_the_real_cursor() {
-        let mut s = Scrub::new();
-        s.injected = true;
-        s.begin();
-        s.move_to(pos2(799.0, 108.0));
-        assert!(s.warps.is_empty());
-    }
-
-    #[test]
-    fn normal_pointer_movement_does_not_warp() {
-        let mut s = Scrub::new();
-        s.move_to(pos2(799.0, 108.0));
-        assert!(s.warps.is_empty());
-    }
-
-    #[test]
-    fn standard_editor_wraps_at_top_bottom_and_corner_without_a_value_jump() {
-        let mut s = Scrub::new();
-        s.standard = true;
-        s.begin();
-        for edge in [pos2(200.0, 0.0), pos2(200.0, 599.0), pos2(799.0, 599.0)] {
-            s.move_to(edge);
-            let target = *s.warps.last().unwrap();
-            assert_ne!(target, edge);
-            let before = s.value;
-            s.move_to(target);
-            assert_eq!(s.value, before);
-            s.move_to(target + vec2(5.0, -5.0));
-            assert_eq!(s.value, before + 10.0);
-        }
-    }
-
-    #[test]
-    fn release_and_focus_loss_end_wrapping_and_restore_normal_hit_testing() {
-        for lose_focus in [false, true] {
-            let mut s = Scrub::new();
-            s.begin();
-            s.move_to(pos2(799.0, 108.0));
-            let target = *s.warps.last().unwrap();
-            s.move_to(target);
-            let value = s.value;
-            let events = if lose_focus {
-                vec![Event::WindowFocused(false)]
-            } else {
-                vec![Event::PointerButton { pos: target, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE }]
-            };
-            s.frame(events, !lose_focus);
-            s.move_to(pos2(799.0, 108.0));
-            assert_eq!(s.warps.len(), 1);
-            assert_eq!(s.value, value);
-            assert_eq!(s.ctx.input(|i| i.pointer.latest_pos()), Some(pos2(799.0, 108.0)));
-            s.begin();
-            s.move_to(pos2(799.0, 108.0));
-            assert_eq!(s.warps.len(), 2, "the next independent drag still wraps");
-        }
-    }
-
-    #[test]
-    fn object_drag_does_not_wrap_and_failed_warp_is_not_retried() {
-        let mut s = Scrub::new();
-        s.ordinary = true;
-        s.begin();
-        s.move_to(pos2(799.0, 108.0));
-        assert!(s.warps.is_empty());
-
-        let mut s = Scrub::new();
-        s.accept_warp = false;
-        s.begin();
-        s.move_to(pos2(799.0, 108.0));
-        for _ in 0..3 {
-            s.move_to(pos2(799.0, 108.0));
-        }
-        assert_eq!(s.warps.len(), 1);
-        let value = s.value;
-        s.move_to(pos2(779.0, 108.0));
-        assert_eq!(s.value, value - 20.0);
-    }
-
-    #[test]
-    fn modifiers_keep_their_sensitivity_after_wrapping() {
-        for (modifiers, multiplier) in [(Modifiers::SHIFT, 10.0), (Modifiers::COMMAND, 0.1)] {
-            let mut s = Scrub::new();
-            s.modifiers = modifiers;
-            s.begin();
-            s.move_to(pos2(799.0, 108.0));
-            let target = *s.warps.last().unwrap();
-            let value = s.value;
-            s.move_to(target + vec2(10.0, 0.0));
-            assert!((s.value - value - 10.0 * multiplier).abs() < 1e-8);
-        }
-    }
-
-    #[test]
-    fn monitor_rect_can_extend_beyond_the_app_and_have_a_negative_origin() {
-        let mut s = Scrub::new();
-        s.bounds = Rect::from_min_size(pos2(-200.0, -100.0), vec2(1200.0, 800.0));
-        s.begin();
-        s.move_to(pos2(999.0, 108.0));
-        let target = *s.warps.last().unwrap();
-        assert_eq!(target, pos2(-192.0, 108.0));
-        let value = s.value;
-        s.frame(vec![Event::PointerGone, Event::PointerMoved(target)], true);
-        assert_eq!(s.value, value);
-        s.move_to(target + vec2(10.0, 0.0));
-        assert_eq!(s.value, value + 10.0);
-    }
-
-    #[test]
-    fn real_properties_and_angle_drags_keep_each_gesture_in_one_undo_step() {
-        use crate::{EffectcraftApp, dock::PanelKind};
-        use effectcraft_engine::project::LayerId;
-        use eframe::App;
-        use serde_json::json;
-
-        for angle in [false, true] {
-            let mut session = effectcraft_host::session();
-            session.execute("comp.new", json!({"width": 32, "height": 16})).unwrap();
-            let lid = session.execute("layer.newSolid", json!({"width": 8, "height": 8})).unwrap()["layer"].as_u64().unwrap();
-            let path = if angle { "transform/rotation" } else { "transform/position" };
-            let prop = session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.prop(path).unwrap();
-            let uid = prop.uid;
-            let original = prop.value.clone();
-            let undo = session.history.undo.len();
-            let panel = PanelKind::Properties;
-            let id = if angle { format!("properties.prop.{uid}.value") } else { format!("properties.prop.{uid}.value.0") };
-            let mut app = EffectcraftApp::new(session);
-            app.show_panel(panel);
-            app.toggle_maximize(panel);
-            let ctx = Context::default();
-            let bounds = Rect::from_min_size(Pos2::ZERO, vec2(1600.0, 1000.0));
-            let mut frame = eframe::Frame::_new_kittest();
-            let mut time = 0.0;
-            let mut step = |app: &mut EffectcraftApp, events| {
-                time += 1.0 / 60.0;
-                let mut raw = RawInput { screen_rect: Some(bounds), time: Some(time), events, ..Default::default() };
-                app.raw_input_hook(&ctx, &mut raw);
-                let mut warp = None;
-                let mut out = ctx.run_ui(raw, |ui| {
-                    app.logic(ui.ctx(), &mut frame);
-                    app.ui(ui, &mut frame);
-                    finish_frame(ui.ctx(), bounds, |p| {
-                        warp = Some(p);
-                        Some(p)
-                    });
-                });
-                out.textures_delta.clear();
-                warp
-            };
-            for _ in 0..4 {
-                step(&mut app, vec![]);
-            }
-            for gesture in 1..=2 {
-                let direction = if gesture == 1 { -1.0 } else { 1.0 };
-                let r = app.auto.find(&id).unwrap().rect;
-                let p = pos2(r[0] + r[2] / 2.0, r[1] + r[3] / 2.0);
-                step(
-                    &mut app,
-                    vec![Event::PointerMoved(p), Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }],
-                );
-                step(&mut app, vec![Event::PointerMoved(p + vec2(direction * 10.0, 0.0))]);
-                let mut last = p;
-                for _ in 0..3 {
-                    let edge = if direction < 0.0 { 1.0 } else { 1599.0 };
-                    let target = step(&mut app, vec![Event::PointerMoved(pos2(edge, p.y))]).expect("real property scrubs wrap");
-                    let before = app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value.clone();
-                    step(&mut app, vec![Event::PointerMoved(target)]);
-                    assert_eq!(app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value, before);
-                    last = target + vec2(direction * 10.0, 0.0);
-                    step(&mut app, vec![Event::PointerMoved(last)]);
-                    if angle {
-                        let value = app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value.as_f64();
-                        assert!((value - before.as_f64() - f64::from(direction) * 5.0).abs() < 1e-6);
-                    }
-                }
-                step(&mut app, vec![Event::PointerButton { pos: last, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE }]);
-                assert_eq!(app.session.history.undo.len(), undo + gesture, "each drag is one undo step: {panel:?}");
-            }
-            app.session.execute("edit.undo", json!({})).unwrap();
-            app.session.execute("edit.undo", json!({})).unwrap();
-            assert_eq!(app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value, original);
-        }
-    }
-}
+mod tests;
diff --git a/crates/ui-egui/src/pointer_wrap/tests.rs b/crates/ui-egui/src/pointer_wrap/tests.rs
new file mode 100644
index 000000000..314f7ad3d
--- /dev/null
+++ b/crates/ui-egui/src/pointer_wrap/tests.rs
@@ -0,0 +1,343 @@
+use super::*;
+use egui::{Event, Id, Modifiers, PointerButton, pos2, vec2};
+
+struct Scrub {
+    ctx: Context,
+    value: f64,
+    bounds: Rect,
+    time: f64,
+    accept_warp: bool,
+    warps: Vec<Pos2>,
+    standard: bool,
+    ordinary: bool,
+    angle: bool,
+    angle_rects: Option<(Rect, Rect)>,
+    modifiers: Modifiers,
+    injected: bool,
+}
+
+impl Scrub {
+    fn new() -> Self {
+        Self {
+            ctx: Context::default(),
+            value: 0.0,
+            bounds: Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0)),
+            time: 0.0,
+            accept_warp: true,
+            warps: Vec::new(),
+            standard: false,
+            ordinary: false,
+            angle: false,
+            angle_rects: None,
+            modifiers: Modifiers::NONE,
+            injected: false,
+        }
+    }
+
+    fn frame(&mut self, events: Vec<Event>, focused: bool) {
+        self.time += 0.02;
+        let mut raw =
+            RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0))), time: Some(self.time), events, focused, ..Default::default() };
+        raw.events.push(Event::ModifiersChanged(self.modifiers));
+        prepare_input(&self.ctx, &mut raw, self.injected);
+        let mut out = self.ctx.run_ui(raw, |ui| {
+            if self.standard {
+                ui.put(
+                    Rect::from_min_size(pos2(100.0, 100.0), vec2(60.0, 20.0)),
+                    crate::widgets::drag_value(egui::DragValue::new(&mut self.value).speed(1.0).max_decimals(3)),
+                );
+            } else if self.ordinary {
+                ui.interact(Rect::from_min_size(pos2(100.0, 100.0), vec2(60.0, 20.0)), Id::unique("ordinary"), egui::Sense::drag());
+            } else if self.angle {
+                let (rr, dr, value) = crate::panels::fx_widgets::angle_field(
+                    ui,
+                    pos2(100.0, 100.0),
+                    Id::unique("scrub"),
+                    self.value,
+                    1,
+                    &crate::theme::Tokens::for_kind(crate::theme::ThemeKind::Dark),
+                );
+                self.angle_rects = Some((rr, dr));
+                if let Some(v) = value {
+                    self.value = v;
+                }
+            } else {
+                let (_, value, _) = crate::widgets::hot_number_at(
+                    ui,
+                    pos2(100.0, 100.0),
+                    Id::unique("scrub"),
+                    self.value,
+                    &crate::widgets::HotSpec { speed: 1.0, range: (-1e9, 1e9), decimals: 1, suffix: "" },
+                    &crate::theme::Tokens::for_kind(crate::theme::ThemeKind::Dark),
+                );
+                if let Some(v) = value {
+                    self.value = v;
+                }
+            }
+            finish_frame(ui.ctx(), self.bounds, |p| {
+                self.warps.push(p);
+                self.accept_warp.then_some(p)
+            });
+        });
+        out.textures_delta.clear();
+    }
+
+    fn move_to(&mut self, p: Pos2) {
+        self.frame(vec![Event::PointerMoved(p)], true);
+    }
+
+    fn begin(&mut self) {
+        self.frame(vec![], true);
+        let p = pos2(105.0, 108.0);
+        self.frame(
+            vec![Event::PointerMoved(p), Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }],
+            true,
+        );
+        self.move_to(p + vec2(10.0, 0.0));
+    }
+}
+
+#[test]
+fn angle_degrees_continue_across_zero_and_repeated_monitor_wraps() {
+    for initial in [0.0, 359.5, -359.5, 720.0, -720.0] {
+        for direction in [-1.0, 1.0] {
+            let mut s = Scrub::new();
+            s.angle = true;
+            s.value = initial;
+            s.frame(vec![], true);
+            let p = s.angle_rects.unwrap().1.center();
+            s.frame(
+                vec![Event::PointerMoved(p), Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }],
+                true,
+            );
+            let mut last = p;
+            let mut expected = initial;
+            // Feed small real movements, including zero/whole-turn crossings, then
+            // the synthetic OS warp. Every real pixel contributes exactly once.
+            for step in 0..800 {
+                let direction = if step < 400 { direction } else { -direction };
+                let next = pos2((last.x + direction * 13.0).clamp(1.0, 799.0), last.y);
+                expected += f64::from(next.x - last.x) * 0.5;
+                let count = s.warps.len();
+                s.move_to(next);
+                assert!((s.value - expected).abs() < 1e-6, "initial={initial}, direction={direction}, actual={}, expected={expected}", s.value);
+                last = next;
+                if s.warps.len() > count {
+                    last = *s.warps.last().unwrap();
+                    s.move_to(last);
+                    assert!((s.value - expected).abs() < 1e-6, "the teleport must not reset the angle");
+                }
+            }
+            assert!(s.warps.len() >= 5);
+        }
+    }
+}
+
+#[test]
+fn numeric_drag_wraps_repeatedly_without_counting_the_teleport() {
+    let mut s = Scrub::new();
+    s.begin();
+    for _ in 0..5 {
+        s.move_to(pos2(799.0, 108.0));
+        let target = *s.warps.last().expect("numeric drag must wrap at the monitor edge");
+        assert!(target.x < 16.0);
+        let before = s.value;
+        s.move_to(target);
+        assert_eq!(s.value, before, "the warp itself must not change the value");
+        s.move_to(target + vec2(20.0, 0.0));
+        assert_eq!(s.value, before + 20.0);
+    }
+    assert_eq!(s.warps.len(), 5);
+    s.move_to(pos2(0.0, 108.0));
+    let target = *s.warps.last().unwrap();
+    assert!(target.x > 780.0);
+    let before = s.value;
+    s.move_to(target - vec2(3.0, 0.0));
+    assert_eq!(s.value, before - 3.0, "coalesced movement after a left-edge warp is preserved");
+}
+
+/// An agent's `ui.drag` over the control channel scrubs the value but never moves the user's
+/// real cursor, even at the window's (monitor's) edge.
+#[test]
+fn injected_drags_never_warp_the_real_cursor() {
+    let mut s = Scrub::new();
+    s.injected = true;
+    s.begin();
+    s.move_to(pos2(799.0, 108.0));
+    assert!(s.warps.is_empty());
+}
+
+#[test]
+fn normal_pointer_movement_does_not_warp() {
+    let mut s = Scrub::new();
+    s.move_to(pos2(799.0, 108.0));
+    assert!(s.warps.is_empty());
+}
+
+#[test]
+fn standard_editor_wraps_at_top_bottom_and_corner_without_a_value_jump() {
+    let mut s = Scrub::new();
+    s.standard = true;
+    s.begin();
+    for edge in [pos2(200.0, 0.0), pos2(200.0, 599.0), pos2(799.0, 599.0)] {
+        s.move_to(edge);
+        let target = *s.warps.last().unwrap();
+        assert_ne!(target, edge);
+        let before = s.value;
+        s.move_to(target);
+        assert_eq!(s.value, before);
+        s.move_to(target + vec2(5.0, -5.0));
+        assert_eq!(s.value, before + 10.0);
+    }
+}
+
+#[test]
+fn release_and_focus_loss_end_wrapping_and_restore_normal_hit_testing() {
+    for lose_focus in [false, true] {
+        let mut s = Scrub::new();
+        s.begin();
+        s.move_to(pos2(799.0, 108.0));
+        let target = *s.warps.last().unwrap();
+        s.move_to(target);
+        let value = s.value;
+        let events = if lose_focus {
+            vec![Event::WindowFocused(false)]
+        } else {
+            vec![Event::PointerButton { pos: target, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE }]
+        };
+        s.frame(events, !lose_focus);
+        s.move_to(pos2(799.0, 108.0));
+        assert_eq!(s.warps.len(), 1);
+        assert_eq!(s.value, value);
+        assert_eq!(s.ctx.input(|i| i.pointer.latest_pos()), Some(pos2(799.0, 108.0)));
+        s.begin();
+        s.move_to(pos2(799.0, 108.0));
+        assert_eq!(s.warps.len(), 2, "the next independent drag still wraps");
+    }
+}
+
+#[test]
+fn object_drag_does_not_wrap_and_failed_warp_is_not_retried() {
+    let mut s = Scrub::new();
+    s.ordinary = true;
+    s.begin();
+    s.move_to(pos2(799.0, 108.0));
+    assert!(s.warps.is_empty());
+
+    let mut s = Scrub::new();
+    s.accept_warp = false;
+    s.begin();
+    s.move_to(pos2(799.0, 108.0));
+    for _ in 0..3 {
+        s.move_to(pos2(799.0, 108.0));
+    }
+    assert_eq!(s.warps.len(), 1);
+    let value = s.value;
+    s.move_to(pos2(779.0, 108.0));
+    assert_eq!(s.value, value - 20.0);
+}
+
+#[test]
+fn modifiers_keep_their_sensitivity_after_wrapping() {
+    for (modifiers, multiplier) in [(Modifiers::SHIFT, 10.0), (Modifiers::COMMAND, 0.1)] {
+        let mut s = Scrub::new();
+        s.modifiers = modifiers;
+        s.begin();
+        s.move_to(pos2(799.0, 108.0));
+        let target = *s.warps.last().unwrap();
+        let value = s.value;
+        s.move_to(target + vec2(10.0, 0.0));
+        assert!((s.value - value - 10.0 * multiplier).abs() < 1e-8);
+    }
+}
+
+#[test]
+fn monitor_rect_can_extend_beyond_the_app_and_have_a_negative_origin() {
+    let mut s = Scrub::new();
+    s.bounds = Rect::from_min_size(pos2(-200.0, -100.0), vec2(1200.0, 800.0));
+    s.begin();
+    s.move_to(pos2(999.0, 108.0));
+    let target = *s.warps.last().unwrap();
+    assert_eq!(target, pos2(-192.0, 108.0));
+    let value = s.value;
+    s.frame(vec![Event::PointerGone, Event::PointerMoved(target)], true);
+    assert_eq!(s.value, value);
+    s.move_to(target + vec2(10.0, 0.0));
+    assert_eq!(s.value, value + 10.0);
+}
+
+#[test]
+fn real_properties_and_angle_drags_keep_each_gesture_in_one_undo_step() {
+    use crate::{EffectcraftApp, dock::PanelKind};
+    use effectcraft_engine::project::LayerId;
+    use eframe::App;
+    use serde_json::json;
+
+    for angle in [false, true] {
+        let mut session = effectcraft_host::session();
+        session.execute("comp.new", json!({"width": 32, "height": 16})).unwrap();
+        let lid = session.execute("layer.newSolid", json!({"width": 8, "height": 8})).unwrap()["layer"].as_u64().unwrap();
+        let path = if angle { "transform/rotation" } else { "transform/position" };
+        let prop = session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.prop(path).unwrap();
+        let uid = prop.uid;
+        let original = prop.value.clone();
+        let undo = session.history.undo.len();
+        let panel = PanelKind::Properties;
+        let id = if angle { format!("properties.prop.{uid}.value") } else { format!("properties.prop.{uid}.value.0") };
+        let mut app = EffectcraftApp::new(session);
+        app.show_panel(panel);
+        app.toggle_maximize(panel);
+        let ctx = Context::default();
+        let bounds = Rect::from_min_size(Pos2::ZERO, vec2(1600.0, 1000.0));
+        let mut frame = eframe::Frame::_new_kittest();
+        let mut time = 0.0;
+        let mut step = |app: &mut EffectcraftApp, events| {
+            time += 1.0 / 60.0;
+            let mut raw = RawInput { screen_rect: Some(bounds), time: Some(time), events, ..Default::default() };
+            app.raw_input_hook(&ctx, &mut raw);
+            let mut warp = None;
+            let mut out = ctx.run_ui(raw, |ui| {
+                app.logic(ui.ctx(), &mut frame);
+                app.ui(ui, &mut frame);
+                finish_frame(ui.ctx(), bounds, |p| {
+                    warp = Some(p);
+                    Some(p)
+                });
+            });
+            out.textures_delta.clear();
+            warp
+        };
+        for _ in 0..4 {
+            step(&mut app, vec![]);
+        }
+        for gesture in 1..=2 {
+            let direction = if gesture == 1 { -1.0 } else { 1.0 };
+            let r = app.auto.find(&id).unwrap().rect;
+            let p = pos2(r[0] + r[2] / 2.0, r[1] + r[3] / 2.0);
+            step(
+                &mut app,
+                vec![Event::PointerMoved(p), Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }],
+            );
+            step(&mut app, vec![Event::PointerMoved(p + vec2(direction * 10.0, 0.0))]);
+            let mut last = p;
+            for _ in 0..3 {
+                let edge = if direction < 0.0 { 1.0 } else { 1599.0 };
+                let target = step(&mut app, vec![Event::PointerMoved(pos2(edge, p.y))]).expect("real property scrubs wrap");
+                let before = app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value.clone();
+                step(&mut app, vec![Event::PointerMoved(target)]);
+                assert_eq!(app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value, before);
+                last = target + vec2(direction * 10.0, 0.0);
+                step(&mut app, vec![Event::PointerMoved(last)]);
+                if angle {
+                    let value = app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value.as_f64();
+                    assert!((value - before.as_f64() - f64::from(direction) * 5.0).abs() < 1e-6);
+                }
+            }
+            step(&mut app, vec![Event::PointerButton { pos: last, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE }]);
+            assert_eq!(app.session.history.undo.len(), undo + gesture, "each drag is one undo step: {panel:?}");
+        }
+        app.session.execute("edit.undo", json!({})).unwrap();
+        app.session.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(app.session.active_comp().unwrap().layer(LayerId(lid)).unwrap().props.find(uid).unwrap().value, original);
+    }
+}
diff --git a/crates/ui-egui/src/prefs_live.rs b/crates/ui-egui/src/prefs_live.rs
index 321e432e9..63beb3c39 100644
--- a/crates/ui-egui/src/prefs_live.rs
+++ b/crates/ui-egui/src/prefs_live.rs
@@ -11,10 +11,14 @@ use serde_json::json;
 use crate::EffectcraftApp;
 use crate::frames::FrameKey;
 
-/// Run once per frame, before the panels draw.
-pub fn frame(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    memory_watch(app, ctx);
+/// Settings read once per tick, before any paint (they must keep working while hidden).
+pub fn tick(app: &mut EffectcraftApp, ctx: &egui::Context, now: f64) {
+    memory_watch(app, ctx, now);
     home_on_open(app, ctx);
+}
+
+/// Settings that show or draw something: run in the UI pass, before the panels draw.
+pub fn frame(app: &mut EffectcraftApp, ctx: &egui::Context) {
     video_preview(app, ctx);
 }
 
@@ -29,7 +33,7 @@ pub fn dropped_files(app: &mut EffectcraftApp, ui: &egui::Ui, bounds: Rect) {
     if hovered != 0 {
         let label =
             if hovered == 1 { crate::i18n::tr("Drop file to import").to_string() } else { crate::i18n::tr_args("Drop {} files to import", &[&hovered]) };
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("native-file-drop")));
+        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("native-file-drop")));
         painter.rect_stroke(bounds.shrink(8.0), 6.0, Stroke::new(2.0, app.tokens.accent), StrokeKind::Inside);
         let hint = Rect::from_center_size(bounds.center(), vec2(300.0, 46.0));
         painter.rect_filled(hint, 6.0, app.tokens.panel_bg);
@@ -59,6 +63,10 @@ pub fn dropped_files(app: &mut EffectcraftApp, ui: &egui::Ui, bounds: Rect) {
         errors.push(crate::i18n::tr_args("Skipped {} dropped file(s) without a local path. Use File ▸ Import ▸ File…", &[&skipped]));
     }
 
+    // Taken once per drop frame, so a handed-over flag cannot survive into a later, unrelated
+    // drop (#2661).
+    let handed_by_a_floating_window = std::mem::take(&mut app.forwarded.dropped_on_timeline);
+
     let (proj, rest): (Vec<String>, Vec<String>) = paths.into_iter().partition(|p| {
         let l = p.to_ascii_lowercase();
         l.ends_with(".ecproj") || l.ends_with(".ecprojx")
@@ -82,7 +90,18 @@ pub fn dropped_files(app: &mut EffectcraftApp, ui: &egui::Ui, bounds: Rect) {
             .find(|e| e.id == "viewer.area")
             .map(|e| Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3])));
 
-        let at = if proj.is_empty() {
+        // Dropping a file on the Timeline adds it to the composition the panel shows, as it does
+        // on the viewer (#2588); the import decides the layer's position.
+        let over_timeline = handed_by_a_floating_window
+            || ctx.input(|i| i.pointer.hover_pos()).is_some_and(|p| {
+                app.auto
+                    .elements
+                    .iter()
+                    .find(|e| e.id == "panel.Timeline")
+                    .is_some_and(|e| Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3])).contains(p))
+            });
+
+        let at = if proj.is_empty() && !over_timeline {
             ctx.input(|i| i.pointer.hover_pos()).filter(|p| viewer.is_some_and(|v| v.contains(*p))).and_then(|p| crate::panels::viewer::screen_to_comp(&ctx, p))
         } else {
             None
@@ -97,7 +116,7 @@ pub fn dropped_files(app: &mut EffectcraftApp, ui: &egui::Ui, bounds: Rect) {
         let mut params = json!({
             "paths": rest,
             "drag": true,
-            "addToComp": at.is_some(),
+            "addToComp": at.is_some() || over_timeline,
             "position": at,
             "background": true
         });
@@ -120,9 +139,14 @@ pub fn dropped_files(app: &mut EffectcraftApp, ui: &egui::Ui, bounds: Rect) {
 
 /// Re-read the system's free memory every 30 s (cache budgets follow it; on Windows each
 /// reading starts PowerShell in the background, so it isn't done more often).
-fn memory_watch(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    let now = ctx.input(|i| i.time);
-    let id = egui::Id::new("prefs-memory-watch");
+pub(crate) fn memory_watch(app: &mut EffectcraftApp, ctx: &egui::Context, now: f64) {
+    let id = egui::Id::unique("prefs-memory-watch");
+    // While free disk space keeps frames and layers out of the disk cache, the idle passes ask
+    // for no repaint (nothing to write): keep a frame coming so its free space is read again and
+    // the RAM frames are written once there is room (the reading lands between frames).
+    if app.session.disk_cache.as_ref().is_some_and(|dc| !dc.accepts_writes()) {
+        ctx.request_repaint_after(std::time::Duration::from_secs(5));
+    }
     let last = ctx.data(|d| d.get_temp::<f64>(id));
     if last.is_some_and(|t| now - t < 30.0) {
         return;
@@ -135,8 +159,8 @@ fn memory_watch(app: &mut EffectcraftApp, ctx: &egui::Context) {
 }
 
 /// Startup ▸ Show Home Screen When Opening a Project.
-fn home_on_open(app: &mut EffectcraftApp, ctx: &egui::Context) {
-    let id = egui::Id::new("prefs-last-project");
+pub(crate) fn home_on_open(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    let id = egui::Id::unique("prefs-last-project");
     let path = app.session.path.clone();
     let last = ctx.data(|d| d.get_temp::<Option<String>>(id));
     ctx.data_mut(|d| d.insert_temp(id, path.clone()));
@@ -169,7 +193,7 @@ fn video_preview(app: &mut EffectcraftApp, ctx: &egui::Context) {
         return;
     }
     let v = app.session.prefs.video.clone();
-    let tex_id = egui::Id::new("video-preview-tex");
+    let tex_id = egui::Id::unique("video-preview-tex");
     let update = !app.playback.playing || v.output_during_playback;
     let key = app.viewer_shown.as_ref().map(|(_, k)| *k);
     let cur: Option<(FrameKey, egui::TextureHandle)> = ctx.data(|d| d.get_temp(tex_id));
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index 1e2f57204..612aa0a10 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -4,7 +4,7 @@ use std::collections::{BTreeMap, BTreeSet};
 
 use serde::{Deserialize, Serialize};
 
-use crate::dock::{DockNode, PanelKind};
+use crate::dock::PanelKind;
 use crate::icons::Icon;
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
@@ -229,6 +229,7 @@ impl Tool {
     }
 }
 
+use super::*;
 /// The viewer's Resolution: each composition keeps its own in the project
 /// ([`effectcraft_engine::project::Comp::resolution`], `EffectcraftApp::viewer_res`).
 pub use effectcraft_engine::project::Resolution;
@@ -306,6 +307,31 @@ impl Default for ViewerState {
 }
 
 impl TimelineState {
+    /// Whether property `uid`'s chain link (Constrain Proportions) is on. One that starts linked
+    /// (Scale, Mask Feather) records a click in `unlinked`; one that starts unlinked (shape Size,
+    /// Audio Levels) records it in `linked`.
+    pub fn is_linked(&self, uid: u64, linked_by_default: bool) -> bool {
+        if linked_by_default { !self.unlinked.contains(&uid) } else { self.linked.contains(&uid) }
+    }
+
+    /// Turn property `uid`'s chain link on or off (see [`Self::is_linked`]).
+    pub fn toggle_link(&mut self, uid: u64, linked_by_default: bool) {
+        let set = if linked_by_default { &mut self.unlinked } else { &mut self.linked };
+        if !set.remove(&uid) {
+            set.insert(uid);
+        }
+    }
+
+    /// Forget the chain links when the project was replaced (new or opened): they are keyed by
+    /// property uid, which the next project reuses, so a link turned on must not carry into it.
+    pub fn scope_links(&mut self, project_epoch: u64) {
+        if self.link_epoch != project_epoch {
+            self.link_epoch = project_epoch;
+            self.unlinked.clear();
+            self.linked.clear();
+        }
+    }
+
     /// Show `kinds` on `layers` (twirled open; empty: twirled closed) and remember it as the last
     /// reveal. Other layers keep theirs.
     pub fn apply_reveal(&mut self, layers: &[u64], kinds: Vec<String>) {
@@ -413,6 +439,13 @@ pub struct TimelineState {
     /// was turned off.
     #[serde(default)]
     pub unlinked: BTreeSet<u64>,
+    /// Shape Rectangle and Ellipse Path Size (#2489) and Audio Levels (#2485) properties whose
+    /// chain link (off by default) was turned on.
+    #[serde(default)]
+    pub linked: BTreeSet<u64>,
+    /// The project (its epoch) `unlinked` and `linked` belong to.
+    #[serde(skip)]
+    pub link_epoch: u64,
     /// Visible optional columns (column header right-click ▸ Columns): `av`, `keys`, `label`,
     /// `num`, `comment`, `switches`, `parent`, `in`, `out`, `duration`, `stretch`. The name
     /// column is always shown; Modes follows `show_modes` (F4).
@@ -465,6 +498,8 @@ impl Default for TimelineState {
             expr_closed: BTreeSet::new(),
             expr_lines: BTreeMap::new(),
             unlinked: BTreeSet::new(),
+            linked: BTreeSet::new(),
+            link_epoch: 0,
             columns: default_tl_columns(),
             source_name: false,
             scroll_to: None,
@@ -559,6 +594,36 @@ impl Default for AnimToolsState {
     }
 }
 
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ProjectStatus {
+    #[default]
+    All,
+    Available,
+    Missing,
+}
+
+impl ProjectStatus {
+    pub const ALL: [Self; 3] = [Self::All, Self::Available, Self::Missing];
+    /// English catalog key; localization belongs at the widget rendering boundary.
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::All => "All",
+            Self::Available => "Available",
+            Self::Missing => "Missing",
+        }
+    }
+    /// Filter the dependency inventory, including unused missing proxies. Generated items
+    /// count as available even though they have no external source file.
+    pub fn matches(self, item: &effectcraft_engine::project::Item) -> bool {
+        match self {
+            Self::All => true,
+            Self::Available => !item.has_missing_footage(),
+            Self::Missing => item.has_missing_footage(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct UiState {
     pub tool: Tool,
@@ -568,23 +633,20 @@ pub struct UiState {
     /// Tool shown in each toolbar slot.
     pub slot_tools: Vec<Tool>,
     pub workspace: String,
-    pub dock: DockNode,
+    /// The current layout: docked frames, floating windows (one can be recorded as its own
+    /// native window, Move Panel to New Window) and the places of closed panels.
+    pub dock: crate::dock::Workspace,
     /// Saved workspace layouts (Save Changes to this Workspace / Save as New Workspace).
     #[serde(default)]
-    pub saved_workspaces: std::collections::BTreeMap<String, DockNode>,
-    /// Undocked (floating) panel groups.
-    #[serde(default)]
-    pub floating: Vec<crate::dock::Floating>,
-    /// Floating panels of the saved workspaces.
-    #[serde(default)]
-    pub saved_floating: std::collections::BTreeMap<String, Vec<crate::dock::Floating>>,
-    /// Floating groups shown in their own native window instead of over the dock (Move Panel
-    /// to New Window), so they can be placed on another monitor.
-    #[serde(default)]
-    pub panel_windows: Vec<crate::dock::PanelWindow>,
+    pub saved_workspaces: std::collections::BTreeMap<String, crate::dock::Workspace>,
     /// The panel maximized to fill the dock area (`~`), if any.
     #[serde(default)]
     pub maximized: Option<PanelKind>,
+    /// Floating windows of [`Self::dock`] whose native rect holds the OS window's outer
+    /// position, from a workspace file of an earlier version (see
+    /// `crate::dock_ui::native_outer_to_content`). Workspaces are not saved while any remain.
+    #[serde(skip)]
+    pub native_outer: Vec<u64>,
     /// Locked Composition / Timeline tabs (panel ids): opening another composition does not
     /// bring a locked panel forward (the tab's lock icon, as After Effects' viewer lock).
     #[serde(default)]
@@ -606,6 +668,8 @@ pub struct UiState {
     pub effects_search: String,
     pub effects_open: BTreeSet<String>,
     pub project_search: String,
+    #[serde(default)]
+    pub project_status: ProjectStatus,
     pub project_open_folders: BTreeSet<u64>,
     /// Project panel sort column (`name`, `type`, `size`, `fps`) and direction, as in AE's
     /// clickable column headers. Folders sort with everything else.
@@ -620,6 +684,10 @@ pub struct UiState {
     /// Horizontal scroll of the Project panel's optional columns (Name and Label stay put).
     #[serde(default)]
     pub project_hscroll: f32,
+    /// Width of the Project panel's Name column set by dragging its edge in the header (points);
+    /// `None` fits the longest name shown (double-clicking the edge goes back to that).
+    #[serde(default)]
+    pub project_name_w: Option<f32>,
     /// Vertical scroll of the Project panel's item list (points); only visible rows are drawn.
     #[serde(default)]
     pub project_scroll: f32,
@@ -688,7 +756,7 @@ pub struct UiState {
     /// Flowchart panel options (layers, effects, solids, direction, root comp).
     #[serde(default)]
     pub flowchart: crate::panels::flowchart::FlowOptions,
-    /// Lumetri Scopes panel options.
+    /// Video Scopes panel options.
     #[serde(default)]
     pub scopes: crate::panels::scopes_panel::ScopesState,
 }
@@ -700,11 +768,9 @@ impl Default for UiState {
             script_console: Default::default(),
             slot_tools: Tool::SLOTS.iter().map(|s| s[0]).collect(),
             workspace: "Default".into(),
-            dock: crate::dock::workspace("Default"),
+            dock: crate::dock::Workspace::new(crate::dock::workspace("Default")),
             saved_workspaces: Default::default(),
-            floating: vec![],
-            saved_floating: Default::default(),
-            panel_windows: vec![],
+            native_outer: Vec::new(),
             maximized: None,
             locked_tabs: BTreeSet::new(),
             viewers: Default::default(),
@@ -718,10 +784,12 @@ impl Default for UiState {
             effects_search: String::new(),
             effects_open: BTreeSet::new(),
             project_search: String::new(),
+            project_status: ProjectStatus::All,
             project_open_folders: BTreeSet::new(),
             project_sort: default_project_sort(),
             project_sort_desc: false,
             project_hscroll: 0.0,
+            project_name_w: None,
             project_scroll: 0.0,
             project_columns: default_project_columns(),
             fx_closed: BTreeSet::new(),
@@ -751,3 +819,48 @@ impl Default for UiState {
         }
     }
 }
+
+/// What a `ui.screenshot` captures.
+///
+/// A panel or element is an identity, not a rectangle: it is resolved again when the capture is
+/// issued, after the settle passes, so a panel that moved or resized while the UI settled is
+/// captured where it is now (never with the rectangle from request admission).
+#[derive(Clone, Debug, PartialEq)]
+pub enum ShotTarget {
+    /// The whole root surface.
+    Window,
+    /// A fixed rectangle in logical points, relative to the root surface's top-left corner.
+    Rect([f32; 4]),
+    /// One dock panel's automation rectangle (`panel.<id>`).
+    Panel(PanelKind),
+    /// One automation element id's rectangle.
+    Id(String),
+}
+
+/// The comp frames a playback pass covers (`first..=last`).
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct FrameWindow {
+    pub(crate) first: i64,
+    pub(crate) last: i64,
+}
+
+/// The inputs of one playback pass: the viewer series it renders, the preview plan and
+/// position, and the frame range and clock settings its steps share. `queued` is a snapshot of
+/// the in-flight render count that each step copies. Built once in `advance_playback`.
+#[derive(Clone, Copy)]
+pub(crate) struct PlaybackPass<'a> {
+    pub(crate) ctx: &'a egui::Context,
+    pub(crate) comp: &'a effectcraft_engine::project::Comp,
+    pub(crate) cid: ItemId,
+    pub(crate) scale: f64,
+    pub(crate) now: f64,
+    pub(crate) frame_rate: effectcraft_engine::time::FrameRate,
+    pub(crate) series: FrameKey,
+    pub(crate) plan: Option<effectcraft_engine::preview::PreviewPlan>,
+    pub(crate) window: FrameWindow,
+    pub(crate) cur: i64,
+    pub(crate) video: bool,
+    pub(crate) looping: bool,
+    pub(crate) ahead: i64,
+    pub(crate) queued: usize,
+}
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index f5a0664c2..e67bd2d7d 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -6,6 +6,10 @@
 
 use std::sync::Arc;
 
+#[cfg(not(target_arch = "wasm32"))]
+use egui::FontTweak;
+#[cfg(not(target_arch = "wasm32"))]
+use egui::emath::GuiRounding as _;
 use egui::{Color32, FontData, FontDefinitions, FontFamily, FontId, Stroke, TextStyle, Visuals};
 use serde::{Deserialize, Serialize};
 
@@ -125,6 +129,16 @@ impl Tokens {
     pub fn grad_top(&self, c: Color32) -> Color32 {
         if self.gradients { c.lerp_to_gamma(Color32::WHITE, 0.06) } else { c }
     }
+
+    /// The tokens a property's value fields use (#1306): with an expression driving the property
+    /// (`expression`, [`Property::has_expression`]) its values show in the expression colour, red
+    /// as in After Effects, hovered and dragged too; otherwise these tokens. For the values only:
+    /// the name, stopwatch and swatches keep the ordinary tokens.
+    ///
+    /// [`Property::has_expression`]: effectcraft_engine::project::Property::has_expression
+    pub fn for_value(self, expression: bool) -> Tokens {
+        if expression { Tokens { hot_text: self.expr_text, accent_hover: self.expr_text, ..self } } else { self }
+    }
 }
 
 impl Tokens {
@@ -311,6 +325,8 @@ impl Tokens {
     }
 }
 
+/// The default label colours, one RGB colour per [`effectcraft_color::Label`] in
+/// `Label::ALL` order.
 fn default_labels() -> [Color32; 17] {
     effectcraft_color::Label::ALL.map(|l| {
         let [r, g, b] = l.rgb();
@@ -322,9 +338,13 @@ static INTER_REGULAR: &[u8] = include_bytes!("../../../assets/fonts/Inter-Regula
 static INTER_MEDIUM: &[u8] = include_bytes!("../../../assets/fonts/Inter-Medium.ttf");
 static INTER_SEMIBOLD: &[u8] = include_bytes!("../../../assets/fonts/Inter-SemiBold.ttf");
 static JETBRAINS_MONO: &[u8] = include_bytes!("../../../assets/fonts/JetBrainsMono-Regular.ttf");
+/// Chrome symbols (`✔` U+2714, `▣` U+25A3, …) that Inter, Inter Medium/SemiBold and
+/// JetBrains Mono do not cover. 0.37's default font set no longer includes the old emoji
+/// fonts, and named families (`medium`, `semibold`) never received egui's default fallbacks.
+static NOTO_SYMBOLS2: &[u8] = include_bytes!("../../../assets/fonts/NotoSansSymbols2-Regular.ttf");
 
 /// Install fonts (Inter, Inter Medium/SemiBold, JetBrains Mono) and egui visuals. `language` is the
-/// resolved interface language from [`crate::i18n::language`] (`en`, `ja`, `zh-hans` or `zh-hant`),
+/// resolved interface language from `crate::i18n::language` (`en`, `ja`, `zh-hans` or `zh-hant`),
 /// not the stored `general.language` preference: `system` is already resolved there, so a Chinese
 /// system draws Chinese with the default setting. The CJK fallback that draws the interface's own
 /// script is registered first, so a Chinese interface is drawn by a Chinese face and a Japanese one
@@ -332,20 +352,30 @@ static JETBRAINS_MONO: &[u8] = include_bytes!("../../../assets/fonts/JetBrainsMo
 /// frame loop), so the fonts do not need a restart.
 pub fn install(ctx: &egui::Context, t: &Tokens, language: &str) {
     let mut fonts = FontDefinitions::default();
+    let proportional_fallbacks = fonts.families.get(&FontFamily::Proportional).cloned().unwrap_or_default();
     fonts.font_data.insert("inter".into(), Arc::new(FontData::from_static(INTER_REGULAR)));
     fonts.font_data.insert("inter-medium".into(), Arc::new(FontData::from_static(INTER_MEDIUM)));
     fonts.font_data.insert("inter-semibold".into(), Arc::new(FontData::from_static(INTER_SEMIBOLD)));
     fonts.font_data.insert("jbmono".into(), Arc::new(FontData::from_static(JETBRAINS_MONO)));
+    fonts.font_data.insert("noto-symbols2".into(), Arc::new(FontData::from_static(NOTO_SYMBOLS2)));
     fonts.families.entry(FontFamily::Proportional).or_default().insert(0, "inter".into());
     fonts.families.entry(FontFamily::Monospace).or_default().insert(0, "jbmono".into());
-    fonts.families.insert(FontFamily::Name("semibold".into()), vec!["inter-semibold".into(), "inter".into()]);
-    fonts.families.insert(FontFamily::Name("medium".into()), vec!["inter-medium".into(), "inter".into()]);
+    // Named weights need the same symbol fallback chain as ordinary labels.
+    // The bundled Inter subset and JetBrains Mono do not cover every UI symbol.
+    for (family, face) in [("semibold", "inter-semibold"), ("medium", "inter-medium")] {
+        let mut stack = vec![face.into(), "inter".into()];
+        stack.extend(proportional_fallbacks.iter().cloned());
+        fonts.families.insert(FontFamily::Name(family.into()), stack);
+    }
     // Inter and egui's own fallbacks have no small triangles (the `▸` of "File ▸ Import"), which
     // would draw as missing-glyph boxes: JetBrains Mono fills in the symbols the others lack.
+    // Noto Sans Symbols 2 follows it for the check/box glyphs (`✔`, `▣`) that JetBrains Mono
+    // lacks; without it, named families such as `medium` fall straight through to tofu.
     for (family, stack) in &mut fonts.families {
         if *family != FontFamily::Monospace {
             stack.push("jbmono".into());
         }
+        stack.push("noto-symbols2".into());
     }
     install_script_fallbacks(&mut fonts, language);
     ctx.set_fonts(fonts);
@@ -370,8 +400,50 @@ const SCRIPT_PROBES: &[(char, &str)] = &[
     ('ಕ', "kannada-system"),
     ('ക', "malayalam-system"),
     ('ก', "thai-system"),
+    ('ა', "georgian-system"),
 ];
 
+/// The size the fallback baseline correction is derived at. The correction is an em fraction, so the
+/// value holds at every interface size; any size in the interface's range gives the same answer.
+#[cfg(not(target_arch = "wasm32"))]
+const BASELINE_METRICS_PX: f32 = 12.0;
+
+/// A face's ascent and row height at `px`, rounded the way epaint rounds them: ascent, descent and
+/// line gap separately to 1/32, then `ascent + descent + line_gap` (epaint's descent is negative,
+/// this one is positive).
+#[cfg(not(target_arch = "wasm32"))]
+fn ascent_and_height(m: &effectcraft_text::fonts::VMetrics) -> (f32, f32) {
+    let ascent = m.ascent.round_ui();
+    let descent = m.descent.round_ui();
+    let line_gap = m.line_gap.round_ui();
+    (ascent, ascent + descent + line_gap)
+}
+
+/// The `FontTweak` that puts a fallback face's glyphs on the row font's baseline.
+///
+/// epaint draws a glyph at `A_face + 0.5·(H_row − H_face)` (`galley_from_rows` in epaint's
+/// `text_layout.rs`), where `A` and `H` are the ascent and the row height of the face that draws the
+/// glyph and of the row's own font, both from `styled_metrics` in epaint's `font.rs`. Shifting the
+/// face by `(A_row − A_face) − 0.5·(H_row − H_face)` cancels the offset; as an em fraction one
+/// number serves every size, because `FontTweak` applies `size · y_offset_factor`.
+///
+/// The same expression also carries `valign · (max_row_height − line_height)`, which cancels here:
+/// every glyph of a row takes the section font's row height, so it is the same term for the Latin
+/// and the fallback glyph. The remaining `snap_to_pixel` difference is likewise shared and cancels.
+/// (#1309)
+///
+/// The UI families do not share a row font — Proportional uses Inter, Monospace JetBrains Mono —
+/// and their factors differ by 0.0026 em, which is 0.03 px at 12 pt: inside the 1/32 that is already
+/// rounded away above, so one factor per face is enough. The test
+/// `fallback_glyphs_sit_on_the_row_baseline` pins the result.
+#[cfg(not(target_arch = "wasm32"))]
+fn baseline_tweak(row: &effectcraft_text::fonts::Face, face: &effectcraft_text::fonts::Face) -> FontTweak {
+    let px = BASELINE_METRICS_PX;
+    let (a_row, h_row) = ascent_and_height(&row.metrics(px));
+    let (a_face, h_face) = ascent_and_height(&face.metrics(px));
+    FontTweak { y_offset_factor: ((a_row - a_face) - 0.5 * (h_row - h_face)) / px, ..Default::default() }
+}
+
 /// Register the system fallbacks for scripts the bundled fonts lack in every font family, and
 /// return their names in registration order (empty when nothing installed covers a probe, so a
 /// machine without those fonts simply keeps the bundled ones). A face that covers several probes
@@ -404,25 +476,52 @@ fn install_script_fallbacks(family_fonts: &mut FontDefinitions, language: &str)
         // Han text follows the interface language, not the operating system's locale.
         fonts::set_cjk_locale(cjk_locale(language));
         let base = fonts::resolve("Inter", "Regular").face;
+        let base_face = fonts::face(base);
         let han = (han_probe(language), "chinese-system");
         let cjk = if is_chinese(language) { [han, KANA] } else { [KANA, han] };
         let mut names = Vec::new();
         let mut seen = Vec::new();
-        for &(probe, name) in cjk.iter().chain(SCRIPT_PROBES).chain(std::iter::once(&HANGUL)) {
-            let id = fonts::fallback_for(probe, base);
-            if seen.contains(&id) {
+        // A font covering one Han probe may be a sparse subset. Register additional faces
+        // needed by the actual interface catalog instead of assuming whole-script coverage.
+        let extra = if is_chinese(language) { crate::i18n::catalog_characters(language) } else { Vec::new() };
+        let extra: Vec<_> = extra.into_iter().filter(|ch| *ch >= '\u{2e80}').map(|ch| (ch, "catalog-system")).collect();
+        // 256-character blocks where a catalog character found no face: with nothing installed
+        // covering them, each lookup would read every installed font file again.
+        let mut uncovered_blocks = std::collections::HashSet::new();
+        for &(probe, name) in cjk.iter().chain(SCRIPT_PROBES).chain(std::iter::once(&HANGUL)).chain(&extra) {
+            let catalog = name == "catalog-system";
+            if catalog && (uncovered_blocks.contains(&(probe as u32 >> 8)) || seen.iter().any(|&id| fonts::face(id).has_char(probe))) {
                 continue;
             }
+            // The interface asks for the platform's UI face first; the order a composed frame
+            // renders with is `fonts::fallback_for`'s and is not touched here. Another context may
+            // install a different language concurrently, so the shared fallback is asked with this
+            // context's own locale rather than the global request.
+            let id = interface_fallback_candidates(name, language)
+                .iter()
+                .find_map(|family| {
+                    let r = fonts::resolve(family, "Regular");
+                    (!r.missing && fonts::face(r.face).has_char(probe)).then_some(r.face)
+                })
+                .unwrap_or_else(|| fonts::fallback_for_locale(probe, base, cjk_locale(language)));
             let face = fonts::face(id);
             if !face.has_char(probe) {
+                if catalog {
+                    uncovered_blocks.insert(probe as u32 >> 8);
+                }
                 continue; // nothing installed covers this script
             }
+            if seen.contains(&id) {
+                continue;
+            }
             let Some(font) = face.font() else { continue };
             seen.push(id);
             // Use the already-read, parsed bytes rather than reading a font file twice.
             let mut data = FontData::from_owned(font.data().as_bytes().to_vec());
             data.index = face.info.index;
-            family_fonts.font_data.insert(name.to_string(), Arc::new(data));
+            let name = if name == "catalog-system" { format!("{name}-{:x}", probe as u32) } else { name.to_string() };
+            data.tweak = baseline_tweak(&base_face, &face);
+            family_fonts.font_data.insert(name.clone(), Arc::new(data));
             for family in family_fonts.families.values_mut() {
                 family.push(name.to_string());
             }
@@ -432,6 +531,31 @@ fn install_script_fallbacks(family_fonts: &mut FontDefinitions, language: &str)
     }
 }
 
+/// The faces the interface asks for before it settles on the one a composed frame renders with.
+///
+/// Windows ships a UI variant of its Japanese and Chinese families - `Meiryo`/`Meiryo UI`, `Yu
+/// Gothic`/`Yu Gothic UI`, `MS Gothic`/`MS UI Gothic`, `Microsoft YaHei`/`Microsoft YaHei UI`,
+/// `Microsoft JhengHei`/`Microsoft JhengHei UI` - and its own link table for `Segoe UI`
+/// (`FontLink\SystemLink`) picks the UI one for what it draws on screen. `PMingLiU` is the one face
+/// here that is not a sibling: it is `MingLiU`'s proportional relative, and proportional spacing is
+/// what makes the chrome read better in it.
+///
+/// Only the interface takes this order. `fonts::fallback_for` keeps the order a document renders
+/// with, so an existing project's output does not move when the chrome changes.
+#[cfg(not(target_arch = "wasm32"))]
+fn interface_fallback_candidates(name: &str, language: &str) -> &'static [&'static str] {
+    match (name, cjk_locale(language)) {
+        // Kana, and the Han ideographs of a Japanese interface: the language asks for the Japanese
+        // face, so its UI sibling is the one the platform would draw chrome with.
+        ("japanese-system", _) | ("chinese-system", "ja") => &["Meiryo UI", "Yu Gothic UI", "MS UI Gothic"],
+        ("chinese-system", "zh-hant") => &["Microsoft JhengHei UI", "PMingLiU"],
+        ("chinese-system", "zh-hans") => &["Microsoft YaHei UI"],
+        // The other scripts have no UI variant, and their shared order already picks the face made
+        // for the script - the one that draws it correctly at all.
+        _ => &[],
+    }
+}
+
 /// The CJK locale the text engine should prefer for Han text: the interface language when it names
 /// one, otherwise the empty string, which leaves the operating system's locale in charge.
 #[cfg(not(target_arch = "wasm32"))]
@@ -443,9 +567,9 @@ fn cjk_locale(language: &str) -> &str {
 }
 
 /// The Han character that picks the Chinese fallback face. A Simplified Chinese interface asks for
-/// a simplified-only hanzi: a Japanese face covers the shared ideographs (文) but not 页, 选 or 删,
-/// and the fallback takes a face already loaded first, so the Japanese face loaded for kana would
-/// draw the Chinese interface with boxes (#1141).
+/// a hanzi used by its catalog. Some Japanese faces also cover 页 while lacking 选 or 删, so
+/// coverage of this probe alone is not enough: the fallback must use the interface's own language
+/// policy, even while another context is installing Japanese fonts (#1141).
 #[cfg(not(target_arch = "wasm32"))]
 fn han_probe(language: &str) -> char {
     if language == "zh-hans" { '页' } else { '文' }
@@ -530,6 +654,7 @@ pub fn apply_visuals(ctx: &egui::Context, t: &Tokens) {
 
 #[cfg(all(test, not(target_arch = "wasm32")))]
 mod script_font_tests {
+    use super::{SCRIPT_PROBES, interface_fallback_candidates};
     use effectcraft_text::fonts;
 
     /// Whether an installed face covers `probe` (else the glyph check is skipped).
@@ -595,9 +720,35 @@ mod script_font_tests {
         }
     }
 
-    /// #1141: switching the interface to Simplified Chinese drew most labels as boxes. The English
-    /// interface had already loaded a Japanese face for kana, and that face covers the Han probe,
-    /// so it became the Chinese fallback too, without the simplified-only hanzi.
+    #[test]
+    fn the_interface_asks_for_the_platforms_ui_faces() {
+        // The face a window draws its own chrome with, which is not the one a composed frame
+        // renders with: the two orders are deliberately separate.
+        let ja = &["Meiryo UI", "Yu Gothic UI", "MS UI Gothic"][..];
+        assert_eq!(interface_fallback_candidates("japanese-system", "ja"), ja);
+        assert_eq!(interface_fallback_candidates("chinese-system", "ja"), ja);
+        assert_eq!(interface_fallback_candidates("chinese-system", "zh-hans"), &["Microsoft YaHei UI"][..]);
+        assert_eq!(interface_fallback_candidates("chinese-system", "zh-hant"), &["Microsoft JhengHei UI", "PMingLiU"][..]);
+        // Every other script the install probes has no UI variant, so it keeps the shared order.
+        for &(_, name) in SCRIPT_PROBES.iter() {
+            assert!(interface_fallback_candidates(name, "en").is_empty(), "{name} asked for a UI face");
+        }
+    }
+
+    /// The Georgian interface draws its Mkhedruli text with an installed Georgian face (Sylfaen,
+    /// SF Georgian, Noto Sans Georgian…): Inter has no Georgian, so the labels showed as boxes.
+    #[test]
+    fn installed_georgian_fallback_draws_the_georgian_interface() {
+        if !installed('ა') {
+            eprintln!("no Georgian system font installed; skipping glyph coverage");
+            return;
+        }
+        assert_drawn("ka", "კომპოზიციაფენასაკვანძოკადრიეფექტიპარამეტრები");
+    }
+
+    /// #1141: switching the interface to Simplified Chinese drew most labels as boxes. A Japanese face
+    /// can cover the Han probe while lacking other catalog characters. The context must keep its
+    /// own language policy even when another context installs Japanese fallbacks concurrently.
     #[test]
     fn simplified_chinese_interface_draws_simplified_hanzi_after_another_language() {
         let ctx = egui::Context::default();
@@ -609,7 +760,7 @@ mod script_font_tests {
         let font = egui::FontId::new(13.0, egui::FontFamily::Proportional);
         let missing: String = ctx.fonts_mut(|fonts| {
             let replacement = fonts.layout_no_wrap("\u{10ffff}".into(), font.clone(), egui::Color32::WHITE).rows[0].glyphs[0].uv_rect;
-            // Simplified-only hanzi of the zh-hans catalog (选择, 删除, 图层, 设置, 导入, 页面).
+            // Representative hanzi of the zh-hans catalog (选择, 删除, 图层, 设置, 导入, 页面).
             "选删层设导页"
                 .chars()
                 .filter(|ch| {
@@ -651,6 +802,64 @@ mod script_font_tests {
             assert_ne!((meem.uv_rect.min, meem.uv_rect.max), (isolated.min, isolated.max), "the meem takes its initial form");
         });
     }
+
+    /// A fallback face's glyphs sit on the row font's baseline, in every UI family and at every
+    /// interface size. (#1309)
+    ///
+    /// `A` stands in for the row's baseline: epaint exposes none, but a capital without a descender
+    /// has its ink bottom on the baseline, so its ink bottom *is* the row's baseline. A glyph with a
+    /// descender (`g`) or a round one with an overshoot (`O`) would quietly stop holding, so keep `A`
+    /// as the Latin half of this pair.
+    ///
+    /// Both glyphs of `Aあ` end on the baseline, so their ink bottoms agree up to the difference
+    /// between the two outlines themselves - the kana reaches a little below the Latin letter in the
+    /// Japanese faces. Without the correction the kana sits 3 pt high at 12 pt (measured), so the
+    /// tolerance below separates "the correction is applied" from "it is missing"; it is not a claim
+    /// about the outlines. Two pixels per point, because epaint truncates a glyph's box height to
+    /// whole pixels, which would otherwise put up to a point of noise on the measurement.
+    #[test]
+    fn fallback_glyphs_sit_on_the_row_baseline() {
+        if !installed('\u{3042}') {
+            eprintln!("no Japanese system font installed; skipping the baseline check");
+            return;
+        }
+        let ctx = egui::Context::default();
+        ctx.set_pixels_per_point(2.0);
+        super::install(&ctx, &super::Tokens::for_kind(super::ThemeKind::Dark), "ja");
+        let mut out = ctx.run_ui(egui::RawInput::default(), |_| {});
+        out.textures_delta.clear();
+        let bottom = |g: &egui::epaint::text::Glyph| g.pos.y + g.uv_rect.offset.y + g.uv_rect.size.y;
+        ctx.fonts_mut(|fonts| {
+            for family in [
+                egui::FontFamily::Proportional,
+                egui::FontFamily::Monospace,
+                egui::FontFamily::Name("medium".into()),
+                egui::FontFamily::Name("semibold".into()),
+            ] {
+                for size in [12.0_f32, 15.0, 18.0] {
+                    let font = egui::FontId::new(size, family.clone());
+                    let galley = fonts.layout_no_wrap("A\u{3042}".into(), font, egui::Color32::WHITE);
+                    let row = &galley.rows[0].glyphs;
+                    assert_eq!(row.len(), 2, "A\u{3042} should shape to two glyphs");
+                    let (latin, kana) = (bottom(&row[0]), bottom(&row[1]));
+                    let drift = kana - latin;
+                    // Without the correction the kana sits 3-5 pt *above* the Latin ink, so the sign is
+                    // what tells the two apart. With it, the kana reaches a little *below* the Latin
+                    // one, by however far the face's kana overshoot past the baseline - measured at
+                    // 1.94 pt for Noto Sans CJK JP against Yu Gothic's 0.4 - plus up to half a point of
+                    // whole-point rounding in `pos.y` for each glyph.
+                    assert!(
+                        drift > -0.5,
+                        "the kana sits {drift:.2} pt above the Latin baseline at {size} pt in {family:?} (latin {latin}, kana {kana}); the fallback tweak is missing or wrong"
+                    );
+                    assert!(
+                        drift < 2.5,
+                        "the kana sits {drift:.2} pt below the Latin baseline at {size} pt in {family:?} (latin {latin}, kana {kana}); the fallback tweak is too large"
+                    );
+                }
+            }
+        });
+    }
 }
 
 #[cfg(test)]
@@ -708,7 +917,8 @@ mod tests {
             // another test has loaded a system face without `◻` (the fallback tries loaded faces first).
             let uv = |s: String| ctx.fonts_mut(|f| f.layout_no_wrap(s, id.clone(), egui::Color32::WHITE).rows[0].glyphs[0].uv_rect);
             let missing = uv("\u{10ffff}".into());
-            for c in "▸•›·▶◀●○⚠…×".chars() {
+            // Every chrome symbol the panels, menus, shortcut labels and buttons draw.
+            for c in "✔▣✓⚠▶◀▸●○…×›•·−←→↑↓⌘⇧⌥⌃".chars() {
                 let drawn = uv(c.to_string());
                 assert_ne!((drawn.min, drawn.max), (missing.min, missing.max), "{c} has no glyph in {id:?}");
             }
@@ -729,7 +939,7 @@ mod tests {
         }
         let Some(font) = face.font() else { return };
         let bytes = font.data().as_bytes();
-        let covered = fonts_def.font_data.values().any(|d| d.font.as_ref() == bytes && d.index == face.info.index);
+        let covered = fonts_def.font_data.values().any(|d| d.bytes() == bytes && d.index == face.info.index);
         assert!(covered, "a face covering Hangul must be registered with egui");
     }
 
@@ -745,7 +955,7 @@ mod tests {
             .iter()
             .map(|name| {
                 let data = fonts.font_data.get(name).unwrap_or_else(|| panic!("{name} is missing its font data"));
-                (data.font.as_ref(), data.index)
+                (data.bytes(), data.index)
             })
             .collect();
         for (i, a) in faces.iter().enumerate() {
diff --git a/crates/ui-egui/src/updates_ui.rs b/crates/ui-egui/src/updates_ui.rs
new file mode 100644
index 000000000..316e34ac4
--- /dev/null
+++ b/crates/ui-egui/src/updates_ui.rs
@@ -0,0 +1,128 @@
+//! Software updates, background check at startup, and startup prompt modal.
+
+use crate::EffectcraftApp;
+
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::dialog::{CheckResultDialog, CheckResultResponse};
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::updater::{Action, Status, Updater};
+
+pub(crate) struct Runtime {
+    #[cfg(not(target_arch = "wasm32"))]
+    updater: Updater,
+    /// The desktop app turns the check at start on; tests and the web build leave it off.
+    #[cfg(not(target_arch = "wasm32"))]
+    startup_check: bool,
+    #[cfg(not(target_arch = "wasm32"))]
+    check_requested: bool,
+    pub(crate) manual_window_open: bool,
+    #[cfg(target_arch = "wasm32")]
+    pub(crate) status_message: Option<String>,
+}
+
+impl Default for Runtime {
+    fn default() -> Self {
+        Self {
+            #[cfg(not(target_arch = "wasm32"))]
+            updater: Updater::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION")),
+            #[cfg(not(target_arch = "wasm32"))]
+            startup_check: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            check_requested: false,
+            manual_window_open: false,
+            #[cfg(target_arch = "wasm32")]
+            status_message: None,
+        }
+    }
+}
+
+impl EffectcraftApp {
+    /// Whether the app asks for a newer release when it starts (off until the desktop app turns it on).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_startup_update_check(&mut self, on: bool) {
+        self.updates_rt.startup_check = on;
+    }
+}
+
+pub(crate) fn check(app: &mut EffectcraftApp) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        app.updates_rt.check_requested = true;
+        app.updates_rt.manual_window_open = true;
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        app.updates_rt.manual_window_open = true;
+        app.updates_rt.status_message = Some(crate::i18n::tr("Update check is not supported in the web browser.").to_string());
+    }
+}
+
+pub(crate) fn tick(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let rt = &mut app.updates_rt;
+        if std::mem::take(&mut rt.check_requested) {
+            rt.updater.check_now(ctx);
+        } else if rt.startup_check {
+            rt.updater.check_at_start(ctx);
+        }
+        rt.updater.tick(ctx);
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = (app, ctx);
+}
+
+pub(crate) fn show(app: &mut EffectcraftApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        // The restart helper is scheduled before the app closes, so no update starts over unsaved work.
+        let clean = !app.session.is_dirty();
+        match app.updates_rt.updater.show_if(ctx, clean) {
+            Action::OpenUrl(url) => ctx.open_url(egui::OpenUrl::new_tab(url)),
+            Action::Close => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+            Action::None => {}
+        }
+        let rt = &mut app.updates_rt;
+        if rt.manual_window_open {
+            match CheckResultDialog::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION")).show(ctx, rt.updater.status()) {
+                CheckResultResponse::None => {}
+                CheckResultResponse::Close => {
+                    rt.manual_window_open = false;
+                    rt.updater.dismiss_status();
+                }
+                CheckResultResponse::CheckAgain => rt.updater.check_now(ctx),
+                CheckResultResponse::RestartToUpdate => rt.updater.restart_to_update(),
+            }
+            // A check that found a release leaves the status idle and the startup prompt takes over.
+            if matches!(rt.updater.status(), Status::Idle) && !rt.check_requested {
+                rt.manual_window_open = false;
+            }
+        }
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    if app.updates_rt.manual_window_open {
+        let mut open = true;
+        let mut close = false;
+        egui::Window::new(crate::i18n::tr("Check for Updates"))
+            .open(&mut open)
+            .resizable(false)
+            .collapsible(false)
+            .anchor(egui::Align2::CENTER_CENTER, egui::vec2(0.0, 0.0))
+            .show(ctx, |ui| {
+                if let Some(msg) = &app.updates_rt.status_message {
+                    ui.label(msg);
+                }
+                ui.add_space(8.0);
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if ui.button(crate::i18n::tr("Close")).clicked() {
+                        close = true;
+                    }
+                });
+            });
+        if !open || close {
+            app.updates_rt.manual_window_open = false;
+            app.updates_rt.status_message = None;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index c005224d0..162a86c6a 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -2,6 +2,8 @@
 
 use egui::{Align2, Color32, Rect, Response, Sense, Stroke, StrokeKind, Ui, pos2, vec2};
 
+use effectcraft_project::ParamUi;
+
 use crate::automation::Registry;
 use crate::icons::{self, Icon};
 use crate::theme::Tokens;
@@ -20,9 +22,11 @@ struct TabOrder {
     pending: Option<(egui::Id, bool, u64)>,
 }
 
+/// The temp-data id of the [`TabOrder`] for the panel containing `ui` (unique per panel scope;
+/// `Id::NULL` outside a tagged panel).
 fn tab_order_id(ui: &Ui) -> egui::Id {
-    let panel = ui.stack().iter().find(|s| s.tags().contains(PANEL_TAG)).map_or(egui::Id::NULL, |s| s.id);
-    egui::Id::new(("hot-tab-order", panel))
+    let panel = ui.stack().iter().find(|s| s.tags().contains(PANEL_TAG)).map_or(egui::Id::NULL, |s| s.scope_id);
+    egui::Id::unique(("hot-tab-order", panel))
 }
 
 /// Puts hot-text field `id` in its panel's Tab order. True when a Tab in the field before it
@@ -47,20 +51,21 @@ fn tab_stop(ui: &Ui, id: egui::Id) -> bool {
     })
 }
 
+/// How a hot-text field scrubs and prints: `speed` value units per pointer pixel, clamped to
+/// `range`, shown with `decimals` places followed by `suffix`.
+#[derive(Clone, Copy)]
+pub struct HotSpec<'a> {
+    pub speed: f64,
+    pub range: (f64, f64),
+    pub decimals: usize,
+    pub suffix: &'a str,
+}
+
 /// "Hot text": a blue number you drag horizontally to scrub, click to type. Tab / Shift+Tab
 /// while typing commits and types in the panel's next / previous one, as in After Effects.
 /// Returns (response, Some(new value) when changed, drag finished).
-pub fn hot_number_at(
-    ui: &mut Ui,
-    rect_min: egui::Pos2,
-    id: egui::Id,
-    value: f64,
-    speed: f64,
-    range: (f64, f64),
-    decimals: usize,
-    suffix: &str,
-    t: &Tokens,
-) -> (Rect, Option<f64>, bool) {
+pub fn hot_number_at(ui: &mut Ui, rect_min: egui::Pos2, id: egui::Id, value: f64, spec: &HotSpec, t: &Tokens) -> (Rect, Option<f64>, bool) {
+    let HotSpec { speed, range, decimals, suffix } = *spec;
     let editing_id = id.with("editing");
     let mut editing: Option<String> = ui.data(|d| d.get_temp(editing_id));
     if tab_stop(ui, id) && editing.is_none() {
@@ -145,11 +150,21 @@ pub fn proportional_scrub(m: egui::Modifiers) -> bool {
     m.command && m.alt
 }
 
+/// How far one pointer pixel scrubs a hot-text field: the property's slider (soft) range over
+/// 300 px. The Timeline and Effect Controls share this so they cannot drift; a large hard range
+/// only allows typing big values, it must not make dragging coarse (#2097).
+pub fn slider_scrub_speed(ui: &ParamUi) -> f64 {
+    match ui {
+        ParamUi::Slider { slider_min, slider_max, .. } => ((slider_max - slider_min) / 300.0).clamp(0.001, 50.0),
+        _ => 0.5,
+    }
+}
+
 /// [`hot_number_at`] for a whole number (an angle's revolutions): a drag steps it once every
 /// `1 / speed` pixels however slowly the pointer moves (the fractions add up between frames),
 /// and a typed value is truncated. Returns (rect, Some(new value) when changed, drag finished).
 pub fn hot_int_at(ui: &mut Ui, rect_min: egui::Pos2, id: egui::Id, value: i64, speed: f64, suffix: &str, t: &Tokens) -> (Rect, Option<i64>, bool) {
-    let (rect, nv, done) = hot_number_at(ui, rect_min, id, value as f64, speed, (-1e6, 1e6), 0, suffix, t);
+    let (rect, nv, done) = hot_number_at(ui, rect_min, id, value as f64, &HotSpec { speed, range: (-1e6, 1e6), decimals: 0, suffix }, t);
     let acc_id = id.with("acc");
     let acc = ui.data(|d| d.get_temp::<f64>(acc_id)).unwrap_or(0.0) + nv.map_or(0.0, |n| n - value as f64);
     // (Ten 0.1 steps add up to just under 1.)
@@ -245,6 +260,7 @@ pub fn twirl(ui: &mut Ui, rect: Rect, open: bool, id: egui::Id, t: &Tokens) -> R
         vec![c + vec2(-0.8 * k, -1.6 * k), c + vec2(0.8 * k, 0.0), c + vec2(-0.8 * k, 1.6 * k)]
     };
     ui.painter().add(egui::Shape::line(pts, Stroke::new(1.4, col)));
+    focus_outline(ui, &resp, t);
     resp
 }
 
@@ -258,12 +274,18 @@ pub fn icon_toggle(ui: &mut Ui, rect: Rect, icon: Icon, on: bool, t: &Tokens, id
     if on || resp.hovered() {
         icons::paint(ui.painter(), rect.shrink(rect.width() * 0.18), icon, if on { t.icon } else { t.text_faint });
     }
+    focus_outline(ui, &resp, t);
     resp
 }
 
 /// Icon button (toolbar style) with optional active state.
+///
+/// The icon alone carries no text, so the button's accessible name is its tooltip: callers chain
+/// `.on_hover_text(…)`, which names the node this reports (an icon button with neither is unnamed
+/// and kittest's accessibility check flags it).
 pub fn icon_button(ui: &mut Ui, rect: Rect, icon: Icon, active: bool, t: &Tokens, id: egui::Id) -> Response {
     let resp = ui.interact(rect, id, Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), active, ""));
     if active {
         ui.painter().rect_filled(rect, 4.0, t.accent);
     } else if resp.hovered() {
@@ -277,6 +299,8 @@ pub fn icon_button(ui: &mut Ui, rect: Rect, icon: Icon, active: bool, t: &Tokens
         t.icon
     };
     icons::paint(ui.painter(), rect.shrink(rect.width() * 0.22), icon, col);
+    // An icon has no text: the caller names the button.
+    crate::a11y::role(&resp, egui::accesskit::Role::Button);
     focus_outline(ui, &resp, t);
     resp
 }
@@ -309,6 +333,9 @@ pub fn text_field(ui: &mut Ui, rect: Rect, text: &mut String, hint: &str, t: &To
     field(ui, rect, text, hint, t, false)
 }
 
+/// The shared body of [`text_field`] and [`search_field`]: paints the rounded field (and, for
+/// `search`, a magnifier), places a single-line `TextEdit` on `text` filling the inner rect,
+/// and returns its response.
 fn field(ui: &mut Ui, rect: Rect, text: &mut String, hint: &str, t: &Tokens, search: bool) -> Response {
     let h = rect.height();
     ui.painter().rect_filled(rect, h / 2.0, t.field_bg);
@@ -318,7 +345,7 @@ fn field(ui: &mut Ui, rect: Rect, text: &mut String, hint: &str, t: &Tokens, sea
     }
     let inner = Rect::from_min_max(pos2(rect.min.x + if search { 22.0 } else { 9.0 }, rect.min.y + 1.0), pos2(rect.max.x - 8.0, rect.max.y - 1.0));
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(inner));
-    child.add(
+    let resp = child.add(
         egui::TextEdit::singleline(text)
             .hint_text(hint)
             .frame(egui::Frame::NONE)
@@ -326,8 +353,11 @@ fn field(ui: &mut Ui, rect: Rect, text: &mut String, hint: &str, t: &Tokens, sea
             // As tall as the field, so the text and the hint sit on its middle (they sat high, #581).
             .min_size(inner.size())
             .font(Tokens::ui(12.0))
-            .vertical_align(egui::Align::Center),
-    )
+            .align(egui::Align2::LEFT_CENTER),
+    );
+    // The hint is the field's visible name (the caller can give it a better one).
+    crate::a11y::name(&resp, hint);
+    resp
 }
 
 /// Dropdown-looking control ("Full ▾").
@@ -338,6 +368,15 @@ pub fn dropdown(ui: &mut Ui, rect: Rect, text: &str, t: &Tokens, id: egui::Id) -
 /// [`dropdown`] with a tooltip `tip` (shown always; it replaces the elided text's tooltip).
 pub fn dropdown_tip(ui: &mut Ui, rect: Rect, text: &str, tip: Option<&str>, t: &Tokens, id: egui::Id) -> Response {
     let resp = ui.interact(rect, id, Sense::click());
+    // A combo box shows its current value; with no separate label widget that value is also the
+    // name a screen reader announces. An empty value falls back to the tooltip (or a generic name)
+    // so the control is still reachable.
+    let name = match (text.is_empty(), tip) {
+        (false, _) => text.to_string(),
+        (true, Some(tip)) if !tip.is_empty() => tip.to_string(),
+        _ => crate::i18n::tr("Options").to_string(),
+    };
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), &name));
     ui.painter().rect_filled(rect, 3.0, if resp.hovered() { t.hover } else { t.field_bg });
     ui.painter().rect_stroke(rect, 3.0, Stroke::new(1.0, t.field_border), StrokeKind::Inside);
     // Text that doesn't fit before the arrow is elided (narrow panels).
@@ -358,6 +397,10 @@ pub fn dropdown_tip(ui: &mut Ui, rect: Rect, text: &str, tip: Option<&str>, t: &
     };
     ui.painter().text(pos2(rect.min.x + 7.0, rect.center().y), Align2::LEFT_CENTER, shown, Tokens::ui(11.5), t.text);
     icons::paint(ui.painter(), Rect::from_center_size(pos2(rect.max.x - 9.0, rect.center().y), vec2(8.0, 8.0)), Icon::ChevronDown, t.text_dim);
+    // A drop-down showing `text`; the caller names what it sets.
+    crate::a11y::role(&resp, egui::accesskit::Role::ComboBox);
+    crate::a11y::value(&resp, text);
+    focus_outline(ui, &resp, t);
     if let Some(tip) = tip {
         return resp.on_hover_text(tip.to_string());
     }
@@ -370,6 +413,7 @@ pub fn dropdown_tip(ui: &mut Ui, rect: Rect, text: &str, tip: Option<&str>, t: &
 /// Text button with a subtle fill.
 pub fn text_button(ui: &mut Ui, rect: Rect, text: &str, primary: bool, t: &Tokens, id: egui::Id) -> Response {
     let resp = ui.interact(rect, id, Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), text));
     let bg = if primary {
         if resp.hovered() { t.accent_hover } else { t.accent }
     } else if resp.hovered() {
@@ -379,12 +423,178 @@ pub fn text_button(ui: &mut Ui, rect: Rect, text: &str, primary: bool, t: &Token
     };
     ui.painter().rect_filled(rect, rect.height() / 2.0, bg);
     ui.painter().text(rect.center(), Align2::CENTER_CENTER, text, Tokens::medium(12.0), if primary { Color32::WHITE } else { t.text });
+    crate::a11y::role_name(&resp, egui::accesskit::Role::Button, text);
+    focus_outline(ui, &resp, t);
     resp
 }
 
-/// Checkbox in the AE look (small square).
+/// A primary-button gesture shared by custom and labelled checkboxes in this context.
+#[derive(Clone, Default)]
+struct CheckboxDrag {
+    press_frame: u64,
+    target: Option<bool>,
+    visited: std::collections::HashSet<egui::Id>,
+    /// Checkboxes the pointer crossed in the frame of the press, before the checkbox it pressed on
+    /// had been drawn (so the value to set was not known): they take it in the next frame.
+    pending: std::collections::HashSet<egui::Id>,
+}
+
+/// A primary-button event of the frame, in the order it happened.
+#[derive(Clone, Copy, PartialEq)]
+enum Step {
+    Press,
+    Move,
+    Release,
+}
+
+/// The frame's primary-button events in order, each with its position. egui hit-tests the whole
+/// frame at the last pointer position, so a press followed by a move in one frame would otherwise
+/// be taken for a press where the pointer ended.
+fn pointer_steps(ui: &Ui) -> Vec<(Step, egui::Pos2)> {
+    ui.input(|i| {
+        i.events
+            .iter()
+            .filter_map(|e| match e {
+                egui::Event::PointerMoved(pos) => Some((Step::Move, *pos)),
+                egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, .. } => {
+                    Some((if *pressed { Step::Press } else { Step::Release }, *pos))
+                }
+                _ => None,
+            })
+            .collect()
+    })
+}
+
+/// Returns the requested value. Mixed checkboxes (`None`) and disabled controls are
+/// skipped. Each checkbox is visited once, so crossing it again cannot toggle it back. The
+/// checkbox a press lands on, and the ones the pointer passes over after it, are found from the
+/// frame's ordered pointer events, not from where the pointer ended.
+fn drag_toggle(ui: &Ui, response: &Response, value: Option<bool>) -> Option<bool> {
+    let (pressed, down, released) = ui.input(|i| (i.pointer.primary_pressed(), i.pointer.primary_down(), i.pointer.primary_released()));
+    let frame = ui.ctx().cumulative_frame_nr();
+    // clicked() reads Context input; do not call it while Context data is locked.
+    let clicked = response.clicked();
+    // Whether the pointer at `pos` is over this checkbox itself (not a window above it).
+    let over = |pos: egui::Pos2| response.rect.contains(pos) && ui.clip_rect().contains(pos) && ui.ctx().layer_id_at(pos) == Some(response.layer_id);
+    // Resolved before the data lock below: layer_id_at reads the Context.
+    let steps: Vec<(Step, bool)> = pointer_steps(ui).into_iter().map(|(step, pos)| (step, over(pos))).collect();
+    ui.data_mut(|data| {
+        let drag = data.get_temp_mut_or_default::<CheckboxDrag>(egui::Id::unique("checkbox-drag"));
+        // A release in the press frame leaves crossings pending: keep them for the next frame.
+        let flushing = !drag.pending.is_empty() && drag.target.is_some() && frame <= drag.press_frame.saturating_add(1);
+        if (!down && !released && !flushing) || (pressed && drag.press_frame != frame) {
+            *drag = CheckboxDrag { press_frame: frame, ..Default::default() };
+        }
+        let on = value?;
+        if !response.enabled() {
+            return None;
+        }
+        // Crossed in the frame of the press before the value was known: take it now.
+        if drag.pending.remove(&response.id)
+            && let Some(target) = drag.target
+            && drag.visited.insert(response.id)
+            && on != target
+        {
+            return Some(target);
+        }
+        // Whether the button is held, tracked in event order: a move after a release in the same frame is no drag.
+        // Before the first button event it is held exactly when that event is a release (or, with none, when it is down).
+        let mut held = match steps.iter().find(|(step, _)| *step != Step::Move) {
+            Some((step, _)) => *step == Step::Release,
+            None => down,
+        };
+        let mut press_seen = false;
+        for (step, over) in steps {
+            match step {
+                Step::Press => {
+                    press_seen = true;
+                    held = true;
+                    if drag.target.is_none() && over {
+                        drag.target = Some(!on);
+                        drag.visited.insert(response.id);
+                        return Some(!on);
+                    }
+                }
+                Step::Release => held = false,
+                Step::Move if held => match drag.target {
+                    Some(target) if over => {
+                        if drag.visited.insert(response.id) && on != target {
+                            return Some(target);
+                        }
+                    }
+                    None if press_seen && over => {
+                        drag.pending.insert(response.id);
+                    }
+                    _ => {}
+                },
+                _ => {}
+            }
+        }
+        // The pointer held still over this checkbox in a later frame of the gesture.
+        if down
+            && !pressed
+            && response.contains_pointer()
+            && let Some(target) = drag.target
+        {
+            if drag.visited.insert(response.id) && on != target {
+                return Some(target);
+            }
+            return None;
+        }
+        // The source already changed on press. Suppress its ordinary release click.
+        if released && drag.target.is_some() {
+            return None;
+        }
+        clicked.then_some(!on)
+    })
+}
+
+/// A labelled checkbox with the same drag behavior as the custom panel checkbox.
+/// Use through `ui.add`, `ui.put`, or `ui.add_enabled` like `egui::Checkbox`.
+pub struct DragCheckbox<'a> {
+    value: &'a mut bool,
+    text: egui::WidgetText,
+}
+
+impl<'a> DragCheckbox<'a> {
+    pub fn new(value: &'a mut bool, text: impl Into<egui::WidgetText>) -> Self {
+        Self { value, text: text.into() }
+    }
+}
+
+impl egui::Widget for DragCheckbox<'_> {
+    fn ui(self, ui: &mut Ui) -> Response {
+        let before = *self.value;
+        let mut response = ui.add(egui::Checkbox::new(self.value, self.text));
+        // egui changes on release; our shared gesture changes on press and entry.
+        *self.value = before;
+        response.flags.remove(egui::response::Flags::CHANGED);
+        if response.clicked() {
+            ui.ctx().request_repaint();
+        }
+        if let Some(value) = drag_toggle(ui, &response, Some(before)) {
+            *self.value = value;
+            response.mark_changed();
+            ui.ctx().request_repaint();
+        }
+        response
+    }
+}
+
+/// A labelled checkbox that allocates its own rectangle.
+pub fn labelled_checkbox(ui: &mut Ui, value: &mut bool, text: impl Into<egui::WidgetText>) -> Response {
+    ui.add(DragCheckbox::new(value, text))
+}
+
+/// Checkbox in the AE look (small square). `changed()` requests a toggle, including
+/// keyboard activation and entry during a drag begun on another checkbox.
 pub fn checkbox(ui: &mut Ui, rect: Rect, on: bool, t: &Tokens, id: egui::Id) -> Response {
-    let resp = ui.interact(rect, id, Sense::click());
+    let mut resp = ui.interact(rect, id, Sense::click());
+    let next = drag_toggle(ui, &resp, Some(on));
+    if next.is_some() {
+        resp.mark_changed();
+    }
+    let on = next.unwrap_or(on);
     let b = Rect::from_center_size(rect.center(), vec2(12.0, 12.0));
     ui.painter().rect_filled(b, 2.0, if on { t.accent } else { t.field_bg });
     ui.painter().rect_stroke(b, 2.0, Stroke::new(1.0, if on { t.accent } else { t.field_border }), StrokeKind::Inside);
@@ -392,6 +602,7 @@ pub fn checkbox(ui: &mut Ui, rect: Rect, on: bool, t: &Tokens, id: egui::Id) ->
         let p = |x: f32, y: f32| pos2(b.min.x + x * b.width(), b.min.y + y * b.height());
         ui.painter().line(vec![p(0.2, 0.52), p(0.42, 0.74), p(0.8, 0.28)], Stroke::new(1.6, Color32::WHITE));
     }
+    focus_outline(ui, &resp, t);
     resp
 }
 
@@ -411,7 +622,9 @@ pub fn scroll_bar(ui: &mut Ui, auto: &mut Registry, key: &str, track: Rect, scro
     let thumb_len = (len * len / (len + max.max(0.0)).max(1.0)).max(16.0).min(len).max(0.0);
     let travel = (len - thumb_len).max(1.0);
     let thumb_at = |s: f32| track.min[a] + (len - thumb_len) * if max > 0.0 { (s / max).clamp(0.0, 1.0) } else { 0.0 };
-    let resp = ui.interact(track.expand2(if vertical { vec2(3.0, 0.0) } else { vec2(0.0, 3.0) }), egui::Id::new(key), Sense::drag());
+    // Dragged with the mouse only: a Tab stop that no key could move would be a trap. The panels
+    // scroll with their own keys (the arrows, Page Up / Page Down) and the wheel.
+    let resp = ui.interact(track.expand2(if vertical { vec2(3.0, 0.0) } else { vec2(0.0, 3.0) }), egui::Id::unique(key), Sense::DRAG);
     let pressed = resp.is_pointer_button_down_on() && ui.input(|i| i.pointer.any_pressed());
     let mut s = scroll;
     if let Some(p) = resp.interact_pointer_pos().filter(|p| pressed && !(thumb_at(scroll)..=thumb_at(scroll) + thumb_len).contains(&p[a])) {
@@ -434,30 +647,81 @@ pub fn scroll_bar(ui: &mut Ui, auto: &mut Registry, key: &str, track: Rect, scro
     s
 }
 
+/// The width a scrolled panel keeps clear on its right for the [`scroll_bar`] (its track, and a
+/// little air before it).
+pub const SCROLL_GUTTER: f32 = 8.0;
+
+/// Whether a [`PanelScroll`]'s rows give up the [`SCROLL_GUTTER`], kept from frame to frame.
+#[derive(Clone, Copy, Default)]
+struct Gutter {
+    on: bool,
+    /// The rows' height at full width, until the first frame in the narrower width has measured
+    /// `shrunk`.
+    wide: Option<f32>,
+    /// How much shorter the rows got in the narrower width. Most rows only get taller, but a graph
+    /// sized by the width gets shorter: without this, rows that overflow at full width and fit
+    /// narrowed would drop the gutter and take it back every frame.
+    shrunk: f32,
+}
+
 /// Vertical scrolling for a panel that lays out its own rows: [`PanelScroll::begin`] gives the
-/// offset to draw them at (moved by the mouse wheel over `area`), [`PanelScroll::end`] takes the
-/// rows' height and draws a [`scroll_bar`] on the right edge while they overflow, so every
-/// panel can be scrolled without a wheel or touchpad (#271).
+/// offset to draw them at (moved by the mouse wheel over `area`) and the [`PanelScroll::content`]
+/// to lay them out in, which clips `ui` until [`PanelScroll::end`]; that takes the rows' height
+/// and draws a [`scroll_bar`] on the right edge while they overflow, so every panel can be
+/// scrolled without a wheel or touchpad (#271).
 pub struct PanelScroll {
     id: egui::Id,
     area: Rect,
+    /// `ui`'s clip before [`PanelScroll::begin`].
+    clip: Rect,
+    gutter: Gutter,
     /// How far the rows are scrolled up.
     pub offset: f32,
+    /// Where the rows go: the area, less the [`SCROLL_GUTTER`] while they overflow, so they are
+    /// cut off before the scroll bar rather than under it (#2867). Painters made before `begin`
+    /// keep their own clip: derive them from this.
+    pub content: Rect,
 }
 
 impl PanelScroll {
-    pub fn begin(ui: &Ui, id: egui::Id, area: Rect) -> Self {
+    pub fn begin(ui: &mut Ui, id: egui::Id, area: Rect) -> Self {
         // (Clamped to last frame's overflow: the rows' height is known once they are drawn.)
         let (mut offset, max): (f32, f32) = ui.data(|d| d.get_temp(id)).unwrap_or_default();
+        // (Before the clip narrows: the wheel works over the scroll bar too.)
         if ui.rect_contains_pointer(area) {
             offset -= ui.input(|i| i.smooth_scroll_delta.y);
         }
-        Self { id, area, offset: offset.clamp(0.0, max.max(0.0)) }
+        let gutter: Gutter = ui.data(|d| d.get_temp(id.with("gutter"))).unwrap_or_default();
+        let mut content = area;
+        if gutter.on {
+            content.max.x = (area.max.x - SCROLL_GUTTER).max(area.min.x);
+        }
+        // Rows scroll under whatever is around them: clip their widgets (and hit tests) too.
+        let clip = ui.clip_rect();
+        ui.set_clip_rect(content.intersect(clip));
+        Self { id, area, clip, gutter, offset: offset.clamp(0.0, max.max(0.0)), content }
+    }
+
+    /// Scroll the panel `id` (a [`PanelScroll`] kept under that id) so the content from `top` to
+    /// `bottom` is in view of a `view` tall list, from the next pass.
+    pub fn reveal(ctx: &egui::Context, id: egui::Id, top: f32, bottom: f32, view: f32) {
+        let (offset, max): (f32, f32) = ctx.data(|d| d.get_temp(id)).unwrap_or_default();
+        let wanted = if top < offset {
+            top
+        } else if bottom > offset + view {
+            bottom - view
+        } else {
+            offset
+        }
+        .max(0.0);
+        // (`max` is last frame's overflow; the next `end` measures it again.)
+        ctx.data_mut(|d| d.insert_temp(id, (wanted, max.max(wanted))));
     }
 
     /// The rows were `content` points tall: keep the offset, with the scroll bar registered for
     /// automation as `key`.
     pub fn end(self, ui: &mut Ui, auto: &mut Registry, key: &str, content: f32, t: &Tokens) {
+        ui.set_clip_rect(self.clip);
         let max = (content - self.area.height()).max(0.0);
         let mut offset = self.offset.min(max);
         if max > 0.0 {
@@ -465,6 +729,20 @@ impl PanelScroll {
             offset = scroll_bar(ui, auto, key, track, offset, max, t);
         }
         ui.data_mut(|d| d.insert_temp(self.id, (offset, max)));
+        let mut gutter = self.gutter;
+        if gutter.on {
+            if let Some(wide) = gutter.wide.take() {
+                gutter.shrunk = (wide - content).max(0.0);
+            }
+            gutter.on = content + gutter.shrunk > self.area.height();
+        } else if max > 0.0 {
+            gutter = Gutter { on: true, wide: Some(content), shrunk: 0.0 };
+        }
+        ui.data_mut(|d| d.insert_temp(self.id.with("gutter"), gutter));
+        // The rows were laid out for the other width: lay them out again.
+        if gutter.on != self.gutter.on {
+            ui.ctx().request_repaint();
+        }
     }
 }
 
@@ -482,8 +760,10 @@ pub fn check_label(on: bool, label: &str) -> String {
     if on { format!("✓ {label}") } else { format!("   {label}") }
 }
 
-fn label_swatch_id() -> egui::Id {
-    egui::Id::new("label-swatch")
+/// The atom id of [`label_swatch`]'s slot inside a button, which [`paint_label_swatch`] looks
+/// up on the laid-out button.
+fn label_swatch_id() -> egui::IdSalt {
+    egui::IdSalt::new("label-swatch")
 }
 
 /// The colour swatch of a Label menu row, as an atom for its button: Label menus show each
@@ -494,7 +774,7 @@ pub fn label_swatch() -> egui::Atom<'static> {
 }
 
 /// Paint the [`label_swatch`] of a laid-out button: label `l`'s colour, an empty box for None.
-pub fn paint_label_swatch(ui: &Ui, out: &egui::AtomLayoutResponse, l: effectcraft_engine::color::Label, t: &Tokens) {
+pub fn paint_label_swatch(ui: &Ui, out: &egui::WidgetAtomResponse, l: effectcraft_engine::color::Label, t: &Tokens) {
     let Some(r) = out.rect(label_swatch_id()) else { return };
     let r = Rect::from_center_size(r.center(), vec2(11.0, 11.0));
     if l == effectcraft_engine::color::Label::None {
@@ -537,6 +817,30 @@ pub fn label_popup(
     })
 }
 
+/// This pass's input has no mouse press or release: whatever just happened (a control activated,
+/// a list opened, an entry chosen) came from the keyboard or an assistive technology.
+pub fn by_keyboard(ui: &Ui) -> bool {
+    !ui.input(|i| i.pointer.any_pressed() || i.pointer.any_released())
+}
+
+/// Put the keyboard on `entry` of the popup list `id` the pass the list opens, so Up / Down and
+/// Enter work it and Escape closes it. (The pass count tells a fresh opening from a list that has
+/// been open for some passes.)
+pub fn focus_when_opened(ui: &Ui, id: egui::Id, entry: &Response) {
+    let key = id.with("focus-pass");
+    let pass = ui.ctx().cumulative_pass_nr();
+    let previous = ui.data_mut(|d| {
+        let previous = d.get_temp::<u64>(key);
+        d.insert_temp(key, pass);
+        previous
+    });
+    // A list opened with the mouse keeps the keyboard where it was: a widget with the focus
+    // pauses the application's shortcuts (Space, Ctrl+Z) until the focus is lost.
+    if previous.is_none_or(|p| p.saturating_add(1) < pass) && by_keyboard(ui) {
+        entry.request_focus();
+    }
+}
+
 /// Show a popup menu anchored at `pos` with string options; returns the chosen index.
 pub fn popup_menu(ui: &mut Ui, id: egui::Id, pos: egui::Pos2, options: &[String], current: Option<usize>) -> Option<usize> {
     if !popup_is_open(ui, id) {
@@ -546,17 +850,64 @@ pub fn popup_menu(ui: &mut Ui, id: egui::Id, pos: egui::Pos2, options: &[String]
     popup_list(ui, id, pos, Rect::NOTHING, options.len().saturating_sub(seps), seps, |ui| {
         ui.set_min_width(160.0);
         let mut chosen = None;
+        let mut first = true;
         for (i, o) in options.iter().enumerate() {
             if o == "-" {
                 ui.separator();
-            } else if ui.selectable_label(current == Some(i), o).clicked() {
-                chosen = Some(i);
+            } else {
+                let r = ui.selectable_label(current == Some(i), o);
+                // The keyboard starts on the current entry (the first one, with none current).
+                if current == Some(i) || (current.is_none() && first) {
+                    focus_when_opened(ui, id, &r);
+                }
+                first = false;
+                if r.clicked() {
+                    chosen = Some(i);
+                }
             }
         }
         chosen
     })
 }
 
+/// The drop-down for a layer-valued property (`ParamUi::Layer`): the current layer shown as
+/// "N. name" (or "None"), and a popup of "None" plus every layer of the comp. Effect Controls
+/// and the Timeline share it so a layer reference (an Environment light's Source, a Displacement
+/// Map's layer) is picked the same way in every panel, and the reference is shown as its layer's
+/// index and name rather than its internal id. Returns `Some(chosen)` when the user picked —
+/// the layer's id, or `None` for "None" — and `None` while nothing is chosen; the caller writes
+/// it as an undoable `prop.set` (id, or null for "None").
+pub fn layer_picker(
+    ui: &mut Ui,
+    rect: Rect,
+    layers: &effectcraft_engine::project::Layers,
+    current: Option<u64>,
+    t: &Tokens,
+    id: egui::Id,
+) -> Option<Option<u64>> {
+    let index_of = |wanted: u64| layers.iter().position(|l| l.id.0 == wanted);
+    let entry = |i: usize| layers.get(i).map(|l| format!("{}. {}", i + 1, l.name));
+    let current_index = current.and_then(index_of);
+    let label = current_index.and_then(entry).unwrap_or_else(|| crate::i18n::tr("None").to_string());
+    let pop = id.with("pop");
+    if dropdown(ui, rect, &label, t, id).clicked() {
+        open_popup(ui, pop);
+    }
+    if !popup_is_open(ui, pop) {
+        return None;
+    }
+    // Built only while open: a comp can hold hundreds of layers.
+    let mut options: Vec<String> = Vec::with_capacity(layers.len() + 1);
+    options.push(crate::i18n::tr("None").to_string());
+    options.extend((0..layers.len()).filter_map(entry));
+    // The current entry is highlighted (the first option is "None").
+    match popup_menu(ui, pop, rect.left_bottom(), &options, Some(current_index.map_or(0, |i| i + 1))) {
+        Some(0) => Some(None),
+        Some(picked) => layers.get(picked - 1).map(|l| Some(l.id.0)),
+        None => None,
+    }
+}
+
 /// The open popup list `id` at `pos`, drawn by `body` (`rows` entries and `seps` separators,
 /// for its height): as tall as the window allows, scrolling beyond with a scroll bar (a shape
 /// layer's Add menu has 20 entries, the blend modes 40, the fonts hundreds), and moved up when
@@ -592,7 +943,7 @@ pub(crate) fn note_open_popup_list(ctx: &egui::Context) {
 
 /// The pass a [`popup_list`] was last drawn in.
 fn popup_list_pass_id() -> egui::Id {
-    egui::Id::new("popup-list-pass")
+    egui::Id::unique("popup-list-pass")
 }
 
 /// Whether a menu, context menu or popup list is open, or the menu bar has the keyboard (as of
@@ -607,9 +958,94 @@ pub fn any_menu_open(ctx: &egui::Context) -> bool {
 /// whole: egui sizes a new menu from a default 400 pt area, so without a minimum a longer one
 /// (Window ▸ Workspace) got stuck at that height with its last entries scrolled out of view
 /// (#191).
-pub fn menu_scroll<R>(ui: &mut Ui, add: impl FnOnce(&mut Ui) -> R) -> R {
+///
+/// While the bar is mid press-and-browse (`browsing`), resting the pointer against the menu's
+/// bottom or top edge scrolls it from there — a crawl at first, then a run, as native menus do —
+/// so a long list can be walked with no wheel. Without the hold the edges do nothing: the wheel
+/// and the scroll bar are how a normally opened menu scrolls.
+pub fn menu_scroll<R>(ui: &mut Ui, browsing: bool, add: impl FnOnce(&mut Ui) -> R) -> R {
     let max_h = ui.ctx().content_rect().height() - 40.0;
-    egui::ScrollArea::vertical().max_height(max_h).min_scrolled_height(max_h).show(ui, add).inner
+    let pending = ui.scope_id().with("menu-edge-scroll-offset");
+    let target = ui.ctx().data_mut(|d| d.remove_temp::<f32>(pending));
+    let mut area = egui::ScrollArea::vertical().max_height(max_h).min_scrolled_height(max_h);
+    if let Some(target) = target {
+        area = area.vertical_scroll_offset(target);
+    }
+    let out = area.show(ui, add);
+    if let Some(target) = edge_scroll(ui, &out, browsing) {
+        ui.ctx().data_mut(|d| d.insert_temp(pending, target));
+    }
+    out.inner
+}
+
+/// The edge scroll [`menu_scroll`] adds while browsing: with the pointer resting in the bottom
+/// (top) band of an overflowing menu, its content crawls up (down) after a short pause, ramps to
+/// a run and stops at the end — and stops at once when the pointer leaves the band or the hold.
+///
+/// This runs after `ScrollArea::show`, which laid the menu out for the offset it had, so the new
+/// offset is supplied once to the next draw's builder: a frame of lag, invisible at these speeds.
+/// That explicit vertical offset cancels prior momentum on that draw; later wheel and scroll-bar
+/// input still applies normally. A replay can consume the target but cannot queue another step
+/// at the same input time.
+fn edge_scroll<R>(ui: &Ui, out: &egui::containers::scroll_area::ScrollAreaOutput<R>, browsing: bool) -> Option<f32> {
+    /// How far from the top / bottom edge the pointer starts the crawl (points).
+    const BAND: f32 = 18.0;
+    /// The pause before the crawl starts: a pointer merely grazing the edge must not jump.
+    const DELAY: f32 = 0.12;
+    /// Points per second: a crawl at first, reaching the run about three quarters of a second in.
+    const CRAWL: f32 = 45.0;
+    const RAMP: f32 = 700.0;
+    const RUN: f32 = 560.0;
+
+    let ctx = ui.ctx();
+    let over = out.content_size.y - out.inner_rect.height();
+    let dir = match (browsing, over > 0.0, ctx.input(|i| i.pointer.latest_pos())) {
+        (true, true, Some(p)) if out.inner_rect.contains(p) => {
+            if p.y >= out.inner_rect.max.y - BAND {
+                1
+            } else if p.y <= out.inner_rect.min.y + BAND {
+                -1
+            } else {
+                0
+            }
+        }
+        _ => 0,
+    };
+    // The clock the pause counts from, kept per menu: entering or leaving an edge band restarts
+    // it, so a later stay there crawls off again instead of jumping straight to the run.
+    let now = ctx.input(|i| i.time);
+    let key = out.id.with("menu-edge-scroll");
+    let (since, prev) = ctx.data(|d| d.get_temp::<(f64, i32)>(key)).unwrap_or((now, 0));
+    let since = if dir == prev {
+        since
+    } else {
+        ctx.data_mut(|d| d.insert_temp(key, (now, dir)));
+        now
+    };
+    if dir == 0 {
+        return None;
+    }
+    if now - since < f64::from(DELAY) {
+        // A pointer resting still fires no events: keep the frames coming until the crawl runs.
+        ctx.request_repaint();
+        return None;
+    }
+    let speed = (CRAWL + RAMP * ((now - since) as f32 - DELAY)).min(RUN);
+    let crawl = ctx.input(|i| i.unstable_dt).min(0.05) * speed * dir as f32;
+    let old = out.state.unclamped_offset().y;
+    let new = (old + crawl).clamp(0.0, over);
+    if new == old {
+        // At the end of the list the crawl stands still and asks for no more frames.
+        return None;
+    }
+    ctx.request_repaint();
+    let stepped = out.id.with("menu-edge-scroll-step");
+    if ctx.data(|d| d.get_temp::<f64>(stepped)) == Some(now) {
+        return None;
+    }
+    // Stamp the queue operation, not consumption: a later real frame must still take a step.
+    ctx.data_mut(|d| d.insert_temp(stepped, now));
+    Some(new)
 }
 
 /// egui's menu style with no gap between the rows: the gap the app's item spacing left between
@@ -662,10 +1098,255 @@ pub(crate) fn constrained(c: &[f64], d: usize, v: f64) -> Vec<f64> {
         .collect()
 }
 
+/// Linked values after component `d` of `c` became `v`: the others move by the same amount, so
+/// linked Audio Levels keep their stereo balance in dB (#2485).
+pub(crate) fn shifted(c: &[f64], d: usize, v: f64) -> Vec<f64> {
+    let Some(&old) = c.get(d) else { return c.to_vec() };
+    c.iter().enumerate().map(|(e, &x)| if e == d { v } else { x + (v - old) }).collect()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// One frame of rows `rows(width)` tall in a 100 tall `PanelScroll`: the width they got.
+    fn scroll_frame(ctx: &egui::Context, rows: &dyn Fn(f32) -> f32) -> f32 {
+        let t = Tokens::for_kind(Default::default());
+        let mut auto = Registry::default();
+        let mut width = 0.0;
+        let area = Rect::from_min_size(pos2(10.0, 10.0), vec2(300.0, 100.0));
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            let outer = ui.clip_rect();
+            let scroll = PanelScroll::begin(ui, egui::Id::unique("rows"), area);
+            width = scroll.content.width();
+            assert_eq!(ui.clip_rect(), scroll.content.intersect(outer), "the widgets are clipped to the rows");
+            scroll.end(ui, &mut auto, "rows.scroll", rows(width), &t);
+            assert_eq!(ui.clip_rect(), outer, "and only until the end");
+        });
+        output.textures_delta.clear();
+        width
+    }
+
+    /// Rows that fit only in the narrower width (a graph sized by the width gets shorter) keep the
+    /// gutter instead of dropping it and taking it back every frame, and give it up once they fit
+    /// at full width too (#2867).
+    #[test]
+    fn panel_scroll_gutter_settles() {
+        let (full, narrow) = (300.0, 300.0 - SCROLL_GUTTER);
+        let ctx = egui::Context::default();
+        let widths = |tall: f32, frames: usize| {
+            let rows = move |w: f32| if w < full { tall - 8.0 } else { tall };
+            (0..frames).map(|_| scroll_frame(&ctx, &rows)).collect::<Vec<_>>()
+        };
+        assert_eq!(widths(90.0, 3), [full; 3], "rows that fit: full width");
+        assert_eq!(widths(104.0, 6), [full, narrow, narrow, narrow, narrow, narrow], "fit only narrowed: stays narrowed");
+        assert_eq!(widths(200.0, 3), [narrow; 3], "overflow: narrowed");
+        assert_eq!(widths(90.0, 3), [narrow, full, full], "fit again: full width");
+        // Rows that overflow only when narrowed stay at full width.
+        let rows = |w: f32| if w < full { 104.0 } else { 96.0 };
+        assert_eq!((0..3).map(|_| scroll_frame(&ctx, &rows)).collect::<Vec<_>>(), [full; 3]);
+    }
+
+    fn checkbox_frame(ctx: &egui::Context, values: &mut [Option<bool>; 5], events: Vec<egui::Event>) {
+        let t = Tokens::for_kind(Default::default());
+        let input = egui::RawInput { events, ..Default::default() };
+        let mut output = ctx.run_ui(input, |ui| {
+            for (index, value) in values.iter_mut().enumerate() {
+                let rect = Rect::from_min_size(pos2(20.0, 20.0 + index as f32 * 30.0), vec2(120.0, 20.0));
+                ui.add_enabled_ui(index != 3, |ui| {
+                    if index == 4 {
+                        if let Some(on) = value {
+                            ui.put(rect, DragCheckbox::new(on, crate::i18n::tr("Grid")));
+                        }
+                    } else if let Some(on) = value {
+                        if checkbox(ui, rect, *on, &t, egui::Id::unique(index)).changed() {
+                            *on = !*on;
+                        }
+                    } else {
+                        let response = ui.interact(rect, egui::Id::unique(index), Sense::click());
+                        assert_eq!(drag_toggle(ui, &response, None), None);
+                    }
+                });
+            }
+        });
+        output.textures_delta.clear();
+    }
+
+    fn checkbox_pointer(y: f32, pressed: Option<bool>) -> Vec<egui::Event> {
+        let pos = pos2(28.0, y);
+        let mut events = vec![egui::Event::PointerMoved(pos)];
+        if let Some(pressed) = pressed {
+            events.push(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() });
+        }
+        events
+    }
+
+    #[test]
+    fn checkbox_drag_sets_one_state_skips_mixed_and_disabled_and_ends_on_release() {
+        let ctx = egui::Context::default();
+        let mut values = [Some(false), Some(true), None, Some(false), Some(false)];
+        checkbox_frame(&ctx, &mut values, vec![]);
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, Some(true)));
+        assert_eq!(values[0], Some(true));
+        // An already-matching neighbour must not invert, even after revisiting.
+        for y in [58.0, 88.0, 118.0, 148.0, 58.0, 28.0] {
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(y, None));
+        }
+        assert_eq!(values, [Some(true), Some(true), None, Some(false), Some(true)]);
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, Some(false)));
+        assert_eq!(values[0], Some(true), "release must not toggle the source again");
+        // Begin on the labelled wrapper and drag back into custom checkboxes.
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(148.0, Some(true)));
+        assert_eq!(values[4], Some(false));
+        for y in [58.0, 28.0] {
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(y, None));
+        }
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, Some(false)));
+        assert_eq!(values, [Some(false), Some(false), None, Some(false), Some(false)]);
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(58.0, None));
+        assert_eq!(values[1], Some(false), "hover after release must not paint");
+    }
+
+    fn button(y: f32, pressed: bool) -> Vec<egui::Event> {
+        let pos = pos2(28.0, y);
+        vec![egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() }]
+    }
+
+    fn moved(y: f32) -> egui::Event {
+        egui::Event::PointerMoved(pos2(28.0, y))
+    }
+
+    /// A press and the moves after it can arrive in one frame (a quick flick): the press belongs to
+    /// the checkbox it landed on, not to the one the pointer ended over, and the ones passed over
+    /// follow the pressed one's new state, whether they are drawn before it or after it.
+    #[test]
+    fn a_press_and_a_move_in_one_frame_start_on_the_checkbox_pressed() {
+        // Rows are 30 apart, from y = 28; index 3 is disabled.
+        let (a, b) = (28.0, 58.0);
+        // Pressed on the first, moved to the second (drawn after it).
+        let ctx = egui::Context::default();
+        let mut values = [Some(false); 5];
+        values[2] = None;
+        checkbox_frame(&ctx, &mut values, vec![]);
+        let mut events = vec![moved(a)];
+        events.extend(button(a, true));
+        events.push(moved(b));
+        checkbox_frame(&ctx, &mut values, events);
+        assert_eq!((values[0], values[1]), (Some(true), Some(true)), "the pressed one is the source, the one passed over follows");
+        let mut events = vec![moved(b)];
+        events.extend(button(b, false));
+        checkbox_frame(&ctx, &mut values, events);
+        assert_eq!((values[0], values[1]), (Some(true), Some(true)), "release changes nothing");
+        // Pressed on the second, moved to the first (drawn before it): the first takes the state in
+        // the next frame, while the button is still down.
+        let ctx = egui::Context::default();
+        let mut values = [Some(false); 5];
+        values[2] = None;
+        checkbox_frame(&ctx, &mut values, vec![]);
+        let mut events = vec![moved(b)];
+        events.extend(button(b, true));
+        events.push(moved(a));
+        checkbox_frame(&ctx, &mut values, events);
+        assert_eq!(values[1], Some(true), "the pressed one is the source");
+        checkbox_frame(&ctx, &mut values, vec![]);
+        assert_eq!(values[0], Some(true), "the one passed over takes the state");
+        let mut events = vec![moved(a)];
+        events.extend(button(a, false));
+        checkbox_frame(&ctx, &mut values, events);
+        assert_eq!((values[0], values[1]), (Some(true), Some(true)));
+        // Pressed outside every checkbox, then moved onto one in the same frame: nothing starts.
+        let ctx = egui::Context::default();
+        let mut values = [Some(false); 5];
+        values[2] = None;
+        checkbox_frame(&ctx, &mut values, vec![]);
+        let mut events = vec![moved(200.0)];
+        events.extend(button(200.0, true));
+        events.push(moved(a));
+        checkbox_frame(&ctx, &mut values, events);
+        checkbox_frame(&ctx, &mut values, vec![]);
+        assert_eq!(values, [Some(false), Some(false), None, Some(false), Some(false)], "a press outside starts no gesture");
+        // Pressed on the second, moved to the first (drawn before it) and released, all in one
+        // frame: the first still takes the state in the next frame.
+        let ctx = egui::Context::default();
+        let mut values = [Some(false); 5];
+        values[2] = None;
+        checkbox_frame(&ctx, &mut values, vec![]);
+        let mut events = vec![moved(b)];
+        events.extend(button(b, true));
+        events.push(moved(a));
+        events.extend(button(a, false));
+        checkbox_frame(&ctx, &mut values, events);
+        checkbox_frame(&ctx, &mut values, vec![]);
+        assert_eq!((values[0], values[1]), (Some(true), Some(true)), "a crossing before the release still takes the state");
+    }
+
+    /// A move that arrives after the release, in the frame of the click, is the pointer travelling without the button:
+    /// it must not carry the gesture onto the checkbox it ends over.
+    #[test]
+    fn a_move_after_the_release_in_the_same_frame_paints_nothing() {
+        let (a, b) = (28.0, 58.0);
+        let ctx = egui::Context::default();
+        let mut values = [Some(false); 5];
+        values[2] = None;
+        checkbox_frame(&ctx, &mut values, vec![]);
+        let mut events = vec![moved(a)];
+        events.extend(button(a, true));
+        events.extend(button(a, false));
+        events.push(moved(b));
+        checkbox_frame(&ctx, &mut values, events);
+        checkbox_frame(&ctx, &mut values, vec![]);
+        assert_eq!((values[0], values[1]), (Some(true), Some(false)), "the clicked one changes, the one moved onto afterwards does not");
+    }
+
+    #[test]
+    fn checkbox_click_and_keyboard_toggle_once_and_drag_must_start_on_a_checkbox() {
+        let ctx = egui::Context::default();
+        let mut values = [Some(false), Some(false), None, Some(false), Some(false)];
+        checkbox_frame(&ctx, &mut values, vec![]);
+        // Pressing outside the checkboxes must not start a gesture on entry.
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(200.0, Some(true)));
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, None));
+        checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, Some(false)));
+        assert_eq!(values[0], Some(false));
+        for source_y in [88.0, 118.0] {
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(source_y, Some(true)));
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, None));
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(28.0, Some(false)));
+            assert_eq!(values[0], Some(false), "mixed and disabled sources cannot begin a drag");
+        }
+        for y in [28.0, 148.0] {
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(y, Some(true)));
+            checkbox_frame(&ctx, &mut values, checkbox_pointer(y, Some(false)));
+        }
+        assert_eq!(values[0], Some(true));
+        assert_eq!(values[4], Some(true));
+        ctx.memory_mut(|m| m.request_focus(egui::Id::unique(0usize)));
+        checkbox_frame(
+            &ctx,
+            &mut values,
+            vec![egui::Event::Key { key: egui::Key::Space, physical_key: None, pressed: true, repeat: false, modifiers: Default::default() }],
+        );
+        assert_eq!(values[0], Some(false), "keyboard activation still works");
+        // Fast clicks may deliver press and release together in one input frame.
+        // This also exercises clicked() without an active drag (outside the data lock).
+        for (index, y) in [(0, 28.0), (4, 148.0)] {
+            let before = values[index];
+            let mut events = checkbox_pointer(y, Some(true));
+            events.extend(checkbox_pointer(y, Some(false)));
+            checkbox_frame(&ctx, &mut values, events);
+            assert_eq!(values[index], before.map(|on| !on));
+        }
+    }
+
+    /// #2097: the drag speed comes from the slider range, not a much wider hard range.
+    #[test]
+    fn slider_scrub_speed_uses_the_slider_range() {
+        let slider = |min, max, slider_min, slider_max| ParamUi::Slider { min, max, slider_min, slider_max, decimals: 1 };
+        assert!((slider_scrub_speed(&slider(0.0, 10_000.0, 0.0, 1_000.0)) - 1_000.0 / 300.0).abs() < 1e-9);
+        assert!((slider_scrub_speed(&slider(0.0, 1.0e9, 0.0, 1.0)) - 1.0 / 300.0).abs() < 1e-9);
+        assert_eq!(slider_scrub_speed(&ParamUi::Number), 0.5);
+    }
+
     /// #488: an inline editor selects its whole text only as it opens. Should it be without the
     /// keyboard for a frame later (an input method, another handler), it takes the keyboard back
     /// with the caret where the user put it instead of selecting everything again, which made
diff --git a/crates/ui-egui/src/workspace_state.rs b/crates/ui-egui/src/workspace_state.rs
index c2ac9e373..de2e99ce7 100644
--- a/crates/ui-egui/src/workspace_state.rs
+++ b/crates/ui-egui/src/workspace_state.rs
@@ -5,93 +5,72 @@ use std::collections::BTreeMap;
 use effectcraft_engine::config::ConfigStore;
 use serde::{Deserialize, Serialize};
 
-use crate::dock::{DockNode, Floating, PanelKind, PanelWindow, SplitSize};
+use crate::dock::{PanelKind, Workspace};
 use crate::state::UiState;
 
+mod legacy;
+
 const FILE: &str = "workspaces.json";
+/// An earlier version's file, kept when it is first rewritten in the current format.
+const BACKUP: &str = "workspaces.old.json";
 const MAX_BYTES: usize = 1024 * 1024;
 const MAX_WORKSPACES: usize = 64;
-const MAX_NODES: usize = 4096;
-const MAX_DEPTH: usize = 32;
-const MAX_PANELS: usize = 128;
 /// Leave room for new viewers without approaching the u32 allocator limit.
 const MAX_VIEWER_ID: u32 = 65_535;
-const MAX_COORD: f32 = 1_000_000.0;
+/// The snapshot version: 2 holds craft-ui docking workspaces.
+const VERSION: u32 = 2;
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 struct Snapshot {
     version: u32,
     workspace: String,
-    dock: DockNode,
-    floating: Vec<Floating>,
+    dock: Workspace,
     focused: PanelKind,
     maximized: Option<PanelKind>,
-    saved_workspaces: BTreeMap<String, DockNode>,
-    saved_floating: BTreeMap<String, Vec<Floating>>,
-    /// Floating groups in their own native window (absent from files of earlier versions).
-    #[serde(default)]
-    panel_windows: Vec<PanelWindow>,
+    saved_workspaces: BTreeMap<String, Workspace>,
 }
 
 impl Snapshot {
     fn capture(ui: &UiState) -> Self {
         Self {
-            version: 1,
+            version: VERSION,
             workspace: ui.workspace.clone(),
             dock: ui.dock.clone(),
-            floating: ui.floating.clone(),
             focused: ui.focused,
             maximized: ui.maximized,
             saved_workspaces: ui.saved_workspaces.clone(),
-            saved_floating: ui.saved_floating.clone(),
-            panel_windows: ui.panel_windows.clone(),
         }
     }
 
     fn apply(self, ui: &mut UiState) {
         ui.workspace = self.workspace;
         ui.dock = self.dock;
-        ui.floating = self.floating;
         ui.focused = self.focused;
         ui.maximized = self.maximized;
         ui.saved_workspaces = self.saved_workspaces;
-        ui.saved_floating = self.saved_floating;
-        // A window is only kept for a panel that still floats, and only where a window can be.
-        let floating = |panel: PanelKind| ui.floating.iter().any(|group| group.panels.contains(&panel));
-        ui.panel_windows = self
-            .panel_windows
-            .into_iter()
-            .filter(|window| floating(window.panel))
-            .map(|window| PanelWindow { panel: window.panel, rect: PanelWindow::sanitized(window.rect) })
-            .collect();
-        // Reserve restored viewer slots without restoring any project-specific composition
-        // links. New Viewer allocates from this map, including after switching named layouts.
-        let mut panels = Vec::new();
-        for root in std::iter::once(&ui.dock).chain(ui.saved_workspaces.values()) {
-            root.panels(&mut panels);
-        }
-        for groups in std::iter::once(&ui.floating).chain(ui.saved_floating.values()) {
-            for group in groups {
-                panels.extend(group.panels.iter().copied());
+        // A native window's place is made safe to hand to the windowing system.
+        for workspace in std::iter::once(&mut ui.dock).chain(ui.saved_workspaces.values_mut()) {
+            for window in &mut workspace.layout.floating {
+                window.native = window.native.map(crate::dock_ui::sanitized_window_rect);
             }
         }
-        for panel in panels {
-            if let PanelKind::Viewer(id) = panel {
-                ui.viewers.entry(id).or_insert(None);
+        // Reserve restored viewer slots without restoring any project-specific composition
+        // links. New Viewer allocates from this map, including after switching named layouts.
+        for workspace in std::iter::once(&ui.dock).chain(ui.saved_workspaces.values()) {
+            for panel in crate::dock::referenced_panels(workspace) {
+                if let PanelKind::Viewer(id) = panel {
+                    ui.viewers.entry(id).or_insert(None);
+                }
             }
         }
     }
 
     fn validate(&self) -> Result<(), String> {
-        if self.version != 1 {
+        if self.version != VERSION {
             return Err(format!("unsupported workspace version {}", self.version));
         }
         let name_ok = |name: &str| !name.trim().is_empty() && name.len() <= 256;
-        if !name_ok(&self.workspace)
-            || self.saved_workspaces.len() > MAX_WORKSPACES
-            || self.saved_floating.len() > MAX_WORKSPACES
-            || self.saved_workspaces.keys().chain(self.saved_floating.keys()).any(|name| !name_ok(name))
-        {
+        if !name_ok(&self.workspace) || self.saved_workspaces.len() > MAX_WORKSPACES || self.saved_workspaces.keys().any(|name| !name_ok(name)) {
             return Err("workspace names or count exceed supported limits".into());
         }
         if !crate::dock::WORKSPACES.contains(&self.workspace.as_str()) && !self.saved_workspaces.contains_key(&self.workspace) {
@@ -101,79 +80,16 @@ impl Snapshot {
             PanelKind::Viewer(id) => (1..=MAX_VIEWER_ID).contains(&id),
             _ => true,
         };
-        if !panel_ok(self.focused) || self.maximized.is_some_and(|panel| !panel_ok(panel)) || self.panel_windows.iter().any(|w| !panel_ok(w.panel)) {
+        if !panel_ok(self.focused) || self.maximized.is_some_and(|panel| !panel_ok(panel)) {
             return Err("workspace viewer ID is outside the supported range 1–65535".into());
         }
-        let mut nodes = 0usize;
-        for root in std::iter::once(&self.dock).chain(self.saved_workspaces.values()) {
-            let mut pending = vec![(root, 0usize)];
-            while let Some((node, depth)) = pending.pop() {
-                nodes = nodes.saturating_add(1);
-                if depth > MAX_DEPTH || nodes > MAX_NODES {
-                    return Err("workspace dock tree exceeds supported limits".into());
-                }
-                match node {
-                    DockNode::Split { size, a, b, .. } => {
-                        let valid = match *size {
-                            SplitSize::Ratio(v) => v.is_finite() && (0.0..=1.0).contains(&v),
-                            SplitSize::FixedA(v) | SplitSize::FixedB(v) => v.is_finite() && (0.0..=MAX_COORD).contains(&v),
-                        };
-                        if !valid {
-                            return Err("invalid workspace split size".into());
-                        }
-                        pending.push((a, depth.saturating_add(1)));
-                        pending.push((b, depth.saturating_add(1)));
-                    }
-                    DockNode::Tabs { panels, active } => {
-                        // Closing the last docked panel leaves an empty group with active=0.
-                        if panels.len() > MAX_PANELS || *active >= panels.len().max(1) || panels.iter().any(|panel| !panel_ok(*panel)) {
-                            return Err("invalid workspace tab group".into());
-                        }
-                    }
-                    DockNode::Stack { entries } => {
-                        if entries.len() > MAX_PANELS
-                            || entries.iter().any(|e| {
-                                e.panels.is_empty()
-                                    || e.panels.len() > MAX_PANELS
-                                    || e.active >= e.panels.len()
-                                    || e.panels.iter().any(|p| !panel_ok(*p))
-                                    || e.height.is_some_and(|v| !v.is_finite() || !(0.0..=MAX_COORD).contains(&v))
-                            })
-                        {
-                            return Err("invalid workspace panel stack".into());
-                        }
-                    }
-                }
+        for workspace in std::iter::once(&self.dock).chain(self.saved_workspaces.values()) {
+            // craft-ui checks the trees, selections, sizes, rects and limits.
+            workspace.validate().map_err(|error| error.to_string())?;
+            if crate::dock::referenced_panels(workspace).into_iter().any(|panel| !panel_ok(panel)) {
+                return Err("workspace viewer ID is outside the supported range 1–65535".into());
             }
         }
-        if self.panel_windows.len() > MAX_PANELS || self.panel_windows.iter().any(|w| !w.rect.iter().all(|v| v.is_finite())) {
-            return Err("invalid workspace panel windows".into());
-        }
-        for groups in std::iter::once(&self.floating).chain(self.saved_floating.values()) {
-            if groups.len() > MAX_PANELS {
-                return Err("too many floating workspace groups".into());
-            }
-            for group in groups {
-                let [x, y, width, height] = group.rect;
-                if group.panels.is_empty()
-                    || group.panels.len() > MAX_PANELS
-                    || group.panels.iter().any(|panel| !panel_ok(*panel))
-                    || group.active >= group.panels.len()
-                    || !group.rect.iter().all(|v| v.is_finite())
-                    || x.abs() > MAX_COORD
-                    || y.abs() > MAX_COORD
-                    || !(1.0..=MAX_COORD).contains(&width)
-                    || !(1.0..=MAX_COORD).contains(&height)
-                {
-                    return Err("invalid floating workspace group".into());
-                }
-            }
-        }
-        crate::dock_shared::encode(&self.dock, &self.floating)?.validate().map_err(|error| error.to_string())?;
-        for (name, root) in &self.saved_workspaces {
-            let floating = self.saved_floating.get(name).map(Vec::as_slice).unwrap_or(&[]);
-            crate::dock_shared::encode(root, floating)?.validate().map_err(|error| error.to_string())?;
-        }
         Ok(())
     }
 }
@@ -182,24 +98,26 @@ pub(crate) struct WorkspaceStore {
     saved: Snapshot,
     last_attempt: f64,
     writable: bool,
+    /// The text of an earlier version's file that loaded: the first save copies it to
+    /// [`BACKUP`] and writes the file in the current format.
+    migrated_from: Option<String>,
     pub(crate) error: Option<String>,
 }
 
 impl WorkspaceStore {
     pub(crate) fn load(config: Option<&dyn ConfigStore>, ui: &mut UiState) -> Self {
+        let mut original = None;
+        let mut outer = Vec::new();
         let loaded = config.map_or(Ok(None), |c| c.read_bounded(FILE, MAX_BYTES)).map_err(|e| e.to_string()).and_then(|text| {
             text.map(|text| {
                 let value: serde_json::Value = serde_json::from_str(&text).map_err(|e| e.to_string())?;
-                // Only an explicitly legacy-shaped record can migrate. A versioned future
-                // snapshot must never deserialize as an empty defaulted legacy record.
-                let snapshot = if value.get("version").is_none()
-                    && value.as_object().is_some_and(|fields| fields.contains_key("workspaces") || fields.contains_key("floating"))
-                {
-                    let legacy: crate::SavedWorkspaces = serde_json::from_value(value).map_err(|e| e.to_string())?;
-                    let mut snapshot = Snapshot::capture(ui);
-                    snapshot.saved_workspaces = legacy.workspaces;
-                    snapshot.saved_floating = legacy.floating;
+                let snapshot = if legacy::is_legacy(&value) {
+                    let (snapshot, windows) = legacy::migrate(value, ui)?;
+                    original = Some(text);
+                    outer = windows;
                     snapshot
+                } else if value.get("version").is_none() {
+                    return Err("not a workspace file".to_string());
                 } else {
                     serde_json::from_value::<Snapshot>(value).map_err(|e| e.to_string())?
                 };
@@ -211,6 +129,7 @@ impl WorkspaceStore {
         let error = match loaded {
             Ok(Some(snapshot)) => {
                 snapshot.apply(ui);
+                ui.native_outer = outer;
                 None
             }
             Ok(None) => None,
@@ -219,10 +138,11 @@ impl WorkspaceStore {
         if let Some(error) = &error {
             log::warn!("{error}");
             ui.status = error.clone();
+            original = None;
         }
         // An unreadable or newer file is never replaced by this session, even after a later
         // layout edit. Ordinary failed writes remain dirty and retryable.
-        Self { saved: Snapshot::capture(ui), last_attempt: f64::NEG_INFINITY, writable: error.is_none(), error }
+        Self { saved: Snapshot::capture(ui), last_attempt: f64::NEG_INFINITY, writable: error.is_none(), migrated_from: original, error }
     }
 
     pub(crate) fn due(&mut self, now: f64) -> bool {
@@ -237,19 +157,18 @@ impl WorkspaceStore {
         if !self.writable {
             return false;
         }
-        self.saved.workspace != ui.workspace
+        self.migrated_from.is_some()
+            || self.saved.workspace != ui.workspace
             || self.saved.dock != ui.dock
-            || self.saved.floating != ui.floating
             || self.saved.focused != ui.focused
             || self.saved.maximized != ui.maximized
             || self.saved.saved_workspaces != ui.saved_workspaces
-            || self.saved.saved_floating != ui.saved_floating
-            || self.saved.panel_windows != ui.panel_windows
     }
 
     pub(crate) fn save(&mut self, config: Option<&dyn ConfigStore>, ui: &UiState) -> Result<bool, String> {
         let Some(config) = config else { return Ok(false) };
-        if !self.has_changes(ui) {
+        // A window still at its outer position would be saved as if that were its content's.
+        if !self.has_changes(ui) || !ui.native_outer.is_empty() {
             return Ok(false);
         }
         let snapshot = Snapshot::capture(ui);
@@ -258,7 +177,11 @@ impl WorkspaceStore {
         if text.len() > MAX_BYTES {
             return Err("workspace file exceeds 1 MiB".into());
         }
+        if let Some(original) = &self.migrated_from {
+            config.write(BACKUP, original).map_err(|e| format!("keep the earlier workspace file: {e}"))?;
+        }
         config.write(FILE, &text).map_err(|e| format!("save workspaces: {e}"))?;
+        self.migrated_from = None;
         self.saved = snapshot;
         self.error = None;
         Ok(true)
@@ -274,187 +197,20 @@ impl WorkspaceStore {
             let path = config.dir().map_or_else(|| FILE.to_string(), |dir| dir.join(FILE).display().to_string());
             return Err(format!("{path} couldn't be loaded at startup, so it is left untouched; fix or move it and restart"));
         }
+        ensure_positions_ready(ui)?;
         self.save(Some(config), ui).map(|_| ())
     }
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use effectcraft_engine::config::MemoryConfig;
-
-    #[test]
-    fn corrupt_or_future_workspace_keeps_defaults_and_original_file() {
-        let valid = Snapshot::capture(&UiState::default());
-        for text in ["{".into(), serde_json::to_string(&Snapshot { version: 2, ..valid }).unwrap(), " ".repeat(MAX_BYTES + 1)] {
-            let config = MemoryConfig::default();
-            config.write(FILE, &text).unwrap();
-            let mut ui = UiState::default();
-            let mut store = WorkspaceStore::load(Some(&config), &mut ui);
-            assert!(store.error.is_some());
-            assert_eq!(ui.workspace, "Default");
-            ui.focused = PanelKind::Project;
-            ui.dock = crate::dock::workspace("Minimal");
-            assert!(!store.save(Some(&config), &ui).unwrap());
-            assert!(store.save_now(Some(&config), &ui).unwrap_err().contains("couldn't be loaded"));
-            assert_eq!(config.read(FILE).as_deref(), Some(text.as_str()));
-        }
-    }
-
-    #[test]
-    fn explicit_save_without_a_settings_folder_is_an_error() {
-        let mut ui = UiState::default();
-        let mut store = WorkspaceStore::load(None, &mut ui);
-        ui.focused = PanelKind::Project;
-        assert!(!store.save(None, &ui).unwrap());
-        assert!(store.save_now(None, &ui).is_err());
-    }
-
-    #[test]
-    fn explicit_save_with_nothing_new_succeeds() {
-        let config = MemoryConfig::default();
-        let mut ui = UiState::default();
-        let mut store = WorkspaceStore::load(Some(&config), &mut ui);
-        ui.focused = PanelKind::Project;
-        store.save_now(Some(&config), &ui).unwrap();
-        store.save_now(Some(&config), &ui).unwrap();
-        assert!(config.read(FILE).is_some());
-    }
-
-    #[test]
-    fn invalid_tabs_split_and_deep_tree_are_rejected() {
-        let mut snapshot = Snapshot::capture(&UiState::default());
-        snapshot.dock = DockNode::Tabs { panels: vec![], active: usize::MAX };
-        assert!(snapshot.validate().is_err());
-        snapshot.dock = DockNode::Split {
-            vertical: false,
-            size: SplitSize::FixedA(f32::NAN),
-            a: Box::new(crate::dock::workspace("Minimal")),
-            b: Box::new(crate::dock::workspace("Minimal")),
-        };
-        assert!(snapshot.validate().is_err());
-        snapshot.dock = crate::dock::workspace("Minimal");
-        for _ in 0..=MAX_DEPTH {
-            snapshot.dock = DockNode::Split {
-                vertical: false,
-                size: SplitSize::Ratio(0.5),
-                a: Box::new(snapshot.dock),
-                b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 }),
-            };
-        }
-        assert!(snapshot.validate().is_err());
-    }
-
-    #[test]
-    fn closing_all_docked_panels_remains_a_persistable_layout() {
-        let config = MemoryConfig::default();
-        let mut ui = UiState::default();
-        let mut store = WorkspaceStore::load(Some(&config), &mut ui);
-        let mut panels = Vec::new();
-        ui.dock.panels(&mut panels);
-        for panel in panels {
-            ui.dock.close(panel);
-        }
-        assert!(store.save(Some(&config), &ui).unwrap());
-        let mut restored = UiState::default();
-        let loaded = WorkspaceStore::load(Some(&config), &mut restored);
-        assert!(loaded.error.is_none());
-        assert_eq!(restored.dock, ui.dock);
-    }
-
-    #[test]
-    fn floating_groups_and_named_snapshots_roundtrip_without_document_state() {
-        let config = MemoryConfig::default();
-        let mut ui = UiState::default();
-        let mut store = WorkspaceStore::load(Some(&config), &mut ui);
-        ui.workspace = "Floating".into();
-        ui.dock.close(PanelKind::Preview);
-        ui.floating = vec![Floating { panels: vec![PanelKind::Preview], active: 0, rect: [50.0, 80.0, 200.0, 160.0] }];
-        ui.saved_workspaces.insert(ui.workspace.clone(), ui.dock.clone());
-        ui.saved_floating.insert(ui.workspace.clone(), ui.floating.clone());
-        ui.maximized = Some(PanelKind::Composition);
-        ui.project_search = "do not persist".into();
-        assert!(store.save(Some(&config), &ui).unwrap());
-        let mut restored = UiState::default();
-        WorkspaceStore::load(Some(&config), &mut restored);
-        assert_eq!(Snapshot::capture(&restored), Snapshot::capture(&ui));
-        assert!(restored.project_search.is_empty());
-    }
-
-    #[test]
-    fn restored_viewer_slots_do_not_reuse_ids_or_restore_document_links() {
-        let config = MemoryConfig::default();
-        let mut ui = UiState::default();
-        let mut store = WorkspaceStore::load(Some(&config), &mut ui);
-        ui.dock = DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Viewer(2)], active: 0 };
-        ui.saved_workspaces.insert("Two views".into(), DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Viewer(5)], active: 0 });
-        ui.viewers.insert(2, Some(42));
-        assert!(store.save(Some(&config), &ui).unwrap());
-        let mut app = crate::EffectcraftApp::new(effectcraft_engine::Session::default());
-        WorkspaceStore::load(Some(&config), &mut app.ui);
-        assert_eq!(app.ui.viewers.get(&2), Some(&None));
-        assert_eq!(app.ui.viewers.get(&5), Some(&None));
-        assert_eq!(crate::panels::viewers::new_viewer(&mut app), 6);
-        assert!(app.ui.dock.contains(PanelKind::Viewer(2)));
-    }
-
-    #[test]
-    fn invalid_viewer_ids_are_rejected_in_every_workspace_reference() {
-        for id in [0, MAX_VIEWER_ID + 1, u32::MAX] {
-            for location in 0..8 {
-                let mut snapshot = Snapshot::capture(&UiState::default());
-                let panel = PanelKind::Viewer(id);
-                let dock = DockNode::Tabs { panels: vec![panel], active: 0 };
-                let stack = DockNode::Stack { entries: vec![crate::dock::StackEntry::new(panel, true, None)] };
-                let floating = vec![Floating { panels: vec![panel], active: 0, rect: [0.0, 0.0, 200.0, 100.0] }];
-                match location {
-                    0 => snapshot.focused = panel,
-                    1 => snapshot.maximized = Some(panel),
-                    2 => snapshot.dock = dock,
-                    3 => snapshot.dock = stack,
-                    4 => snapshot.floating = floating,
-                    5 => {
-                        snapshot.saved_workspaces.insert("Saved".into(), dock);
-                    }
-                    6 => {
-                        snapshot.saved_workspaces.insert("Saved".into(), stack);
-                    }
-                    _ => {
-                        snapshot.saved_floating.insert("Saved".into(), floating);
-                    }
-                }
-                assert!(snapshot.validate().is_err(), "viewer {id} at location {location} must be rejected");
-            }
-        }
-    }
-
-    #[test]
-    fn failed_write_keeps_previous_snapshot_and_retries() {
-        struct Fails<'a>(&'a MemoryConfig);
-        impl ConfigStore for Fails<'_> {
-            fn read(&self, name: &str) -> Option<String> {
-                self.0.read(name)
-            }
-            fn write(&self, _name: &str, _data: &str) -> std::io::Result<()> {
-                Err(std::io::Error::other("synthetic full disk"))
-            }
-            fn remove(&self, _name: &str) -> std::io::Result<()> {
-                Err(std::io::Error::other("unused"))
-            }
-        }
-        let config = MemoryConfig::default();
-        let mut ui = UiState::default();
-        let mut store = WorkspaceStore::load(Some(&config), &mut ui);
-        ui.focused = PanelKind::Project;
-        assert!(store.save(Some(&config), &ui).unwrap());
-        let previous = config.read(FILE).unwrap();
-        ui.focused = PanelKind::Timeline;
-        assert!(store.save(Some(&Fails(&config)), &ui).unwrap_err().contains("synthetic full disk"));
-        assert_eq!(config.read(FILE).as_deref(), Some(previous.as_str()));
-        assert!(store.has_changes(&ui));
-        assert!(store.save(Some(&config), &ui).unwrap());
-        let mut restored = UiState::default();
-        WorkspaceStore::load(Some(&config), &mut restored);
-        assert_eq!(restored.focused, PanelKind::Timeline);
+/// Explicit saves must wait until migrated native-window positions refer to their content.
+/// Check before capturing a named layout too, so a later background save cannot persist
+/// a snapshot made with the old outer-window positions.
+pub(crate) fn ensure_positions_ready(ui: &UiState) -> Result<(), String> {
+    if !ui.native_outer.is_empty() {
+        return Err("workspace window positions are still being restored; try saving again in a moment".into());
     }
+    Ok(())
 }
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/workspace_state/legacy.rs b/crates/ui-egui/src/workspace_state/legacy.rs
new file mode 100644
index 000000000..bcb5a9691
--- /dev/null
+++ b/crates/ui-egui/src/workspace_state/legacy.rs
@@ -0,0 +1,251 @@
+//! Workspace files of earlier versions: EffectCraft's own dock tree (craft-libs 5c874d51 and
+//! before), read into private copies of its types and turned into craft-ui workspaces.
+//!
+//! - Version 1 (`{version: 1, workspace, dock, floating, …, panel_windows}`) keeps the current
+//!   arrangement, the named workspaces, focus and the maximized panel.
+//! - The unversioned record (`{workspaces, floating}`) holds only named workspaces; the
+//!   current arrangement stays the default.
+//! - A column of stacked frames becomes tab groups split top to bottom. Each open frame is a
+//!   group with all its tabs; a frame with a height keeps it as a fixed size (its tab strip
+//!   added), and the others share the rest. A closed frame's tabs join the open frame above it
+//!   (below it, at the top of the column), as a split has no collapsed frames.
+//! - A floating group in its own native window (`panel_windows`) keeps that place as the
+//!   window's native rect. The earlier version stored the OS window's outer position, so the
+//!   window's id is returned for [`crate::dock_ui::native_outer_to_content`] to move it to its
+//!   content position once the main window reports its frame.
+//! - Closed panels had no recorded place: they stay closed and reopen at their default place.
+
+use std::collections::BTreeMap;
+
+use craft_ui::docking::{Floating, Node};
+use craft_ui::layout::{SplitAxis, SplitSize};
+use serde::Deserialize;
+
+use super::{Snapshot, VERSION};
+use crate::dock::{Layout, PanelKind, Workspace};
+use crate::state::UiState;
+
+#[cfg(test)]
+mod tests;
+
+#[derive(Deserialize)]
+enum OldSplitSize {
+    Ratio(f32),
+    FixedA(f32),
+    FixedB(f32),
+}
+
+/// A stacked frame; files from before stacked frames held tabs name one `panel`.
+#[derive(Deserialize)]
+struct OldStackEntry {
+    #[serde(default)]
+    panel: Option<PanelKind>,
+    #[serde(default)]
+    panels: Vec<PanelKind>,
+    #[serde(default)]
+    active: usize,
+    open: bool,
+    #[serde(default)]
+    height: Option<f32>,
+}
+
+#[derive(Deserialize)]
+enum OldNode {
+    Split { vertical: bool, size: OldSplitSize, a: Box<OldNode>, b: Box<OldNode> },
+    Tabs { panels: Vec<PanelKind>, active: usize },
+    Stack { entries: Vec<OldStackEntry> },
+}
+
+#[derive(Deserialize)]
+struct OldFloating {
+    panels: Vec<PanelKind>,
+    active: usize,
+    rect: [f32; 4],
+}
+
+/// The floating group holding `panel` shows in its own native window at `rect`.
+#[derive(Deserialize)]
+struct OldPanelWindow {
+    panel: PanelKind,
+    rect: [f32; 4],
+}
+
+#[derive(Deserialize)]
+struct OldSnapshot {
+    workspace: String,
+    dock: OldNode,
+    floating: Vec<OldFloating>,
+    focused: PanelKind,
+    maximized: Option<PanelKind>,
+    saved_workspaces: BTreeMap<String, OldNode>,
+    saved_floating: BTreeMap<String, Vec<OldFloating>>,
+    #[serde(default)]
+    panel_windows: Vec<OldPanelWindow>,
+}
+
+#[derive(Deserialize)]
+struct OldRecord {
+    #[serde(default)]
+    workspaces: BTreeMap<String, OldNode>,
+    #[serde(default)]
+    floating: BTreeMap<String, Vec<OldFloating>>,
+}
+
+/// Whether `value` is a file of an earlier version that [`migrate`] reads.
+pub(super) fn is_legacy(value: &serde_json::Value) -> bool {
+    match value.get("version") {
+        Some(version) => version.as_u64() == Some(1),
+        None => value.as_object().is_some_and(|fields| fields.contains_key("workspaces") || fields.contains_key("floating")),
+    }
+}
+
+/// The snapshot an earlier version's file describes, and the ids of its floating windows whose
+/// native rect holds the OS window's outer position. `ui` supplies what an unversioned record
+/// leaves out (the current arrangement). The caller validates the result.
+pub(super) fn migrate(value: serde_json::Value, ui: &UiState) -> Result<(Snapshot, Vec<u64>), String> {
+    if value.get("version").is_none() {
+        let record: OldRecord = serde_json::from_value(value).map_err(|e| e.to_string())?;
+        let mut snapshot = Snapshot::capture(ui);
+        snapshot.saved_workspaces = named(record.workspaces, record.floating)?;
+        return Ok((snapshot, Vec::new()));
+    }
+    let old: OldSnapshot = serde_json::from_value(value).map_err(|e| e.to_string())?;
+    let dock = workspace(old.dock, old.floating, &old.panel_windows)?;
+    let outer = dock.layout.floating.iter().filter(|window| window.native.is_some()).map(|window| window.id).collect();
+    let snapshot = Snapshot {
+        version: VERSION,
+        workspace: old.workspace,
+        dock,
+        focused: old.focused,
+        maximized: old.maximized,
+        saved_workspaces: named(old.saved_workspaces, old.saved_floating)?,
+    };
+    Ok((snapshot, outer))
+}
+
+/// Named workspaces with their floating groups; floating groups of no named workspace are
+/// dropped, as the earlier version never showed them.
+fn named(roots: BTreeMap<String, OldNode>, mut floating: BTreeMap<String, Vec<OldFloating>>) -> Result<BTreeMap<String, Workspace>, String> {
+    roots
+        .into_iter()
+        .map(|(name, root)| {
+            let groups = floating.remove(&name).unwrap_or_default();
+            workspace(root, groups, &[]).map(|workspace| (name, workspace))
+        })
+        .collect()
+}
+
+fn workspace(root: OldNode, floating: Vec<OldFloating>, windows: &[OldPanelWindow]) -> Result<Workspace, String> {
+    // Closing the last docked panel left an empty tab group as the root.
+    let root = match root {
+        OldNode::Tabs { panels, .. } if panels.is_empty() => None,
+        root => Some(node(root, 0)?),
+    };
+    let floating = floating
+        .into_iter()
+        .map(|group| {
+            let native = windows.iter().find(|window| group.panels.contains(&window.panel)).map(|window| window.rect);
+            let mut window = Floating::single(group.panels, group.active, group.rect);
+            window.native = native.map(crate::dock_ui::sanitized_window_rect);
+            window
+        })
+        .collect();
+    Ok(Workspace::new(Layout { root, floating }))
+}
+
+fn node(old: OldNode, depth: usize) -> Result<Node<PanelKind>, String> {
+    if depth > craft_ui::docking::MAX_DEPTH {
+        return Err("workspace dock tree exceeds supported limits".into());
+    }
+    Ok(match old {
+        OldNode::Tabs { panels, active } => Node::Tabs { panels, active },
+        OldNode::Split { vertical, size, a, b } => Node::Split {
+            axis: if vertical { SplitAxis::Vertical } else { SplitAxis::Horizontal },
+            size: match size {
+                OldSplitSize::Ratio(value) => SplitSize::Ratio(value),
+                OldSplitSize::FixedA(value) => SplitSize::FixedFirst(value),
+                OldSplitSize::FixedB(value) => SplitSize::FixedSecond(value),
+            },
+            first: Box::new(node(*a, depth.saturating_add(1))?),
+            second: Box::new(node(*b, depth.saturating_add(1))?),
+        },
+        OldNode::Stack { entries } => column(entries, depth)?,
+    })
+}
+
+/// The space between two frames of a column, in points ([`crate::theme::Tokens::gap`]).
+const FRAME_GAP: f32 = 4.0;
+/// The largest frame height a migrated column keeps, in points.
+const MAX_FRAME: f32 = 10_000.0;
+
+/// A tab group of a column: its panels, shown tab, and body height when it has one.
+struct Frame {
+    panels: Vec<PanelKind>,
+    active: usize,
+    height: Option<f32>,
+}
+
+/// A column of stacked frames as tab groups split top to bottom (see the module docs).
+fn column(entries: Vec<OldStackEntry>, depth: usize) -> Result<Node<PanelKind>, String> {
+    let mut frames: Vec<Frame> = Vec::new();
+    // Tabs of closed frames above the first open one.
+    let mut waiting: Vec<PanelKind> = Vec::new();
+    for entry in entries {
+        let mut panels = entry.panels;
+        if let Some(panel) = entry.panel
+            && !panels.contains(&panel)
+        {
+            panels.insert(0, panel);
+        }
+        if panels.is_empty() {
+            continue;
+        }
+        let active = entry.active.min(panels.len().saturating_sub(1));
+        if entry.open {
+            if depth.saturating_add(frames.len()) > craft_ui::docking::MAX_DEPTH {
+                return Err("workspace dock tree exceeds supported limits".into());
+            }
+            let height = entry.height.filter(|h| h.is_finite() && *h > 0.0).map(|h| h.min(MAX_FRAME));
+            frames.push(Frame { panels, active, height });
+        } else if let Some(above) = frames.last_mut() {
+            above.panels.extend(panels);
+        } else {
+            waiting.extend(panels);
+        }
+    }
+    match frames.first_mut() {
+        Some(top) => top.panels.extend(waiting),
+        None if !waiting.is_empty() => frames.push(Frame { panels: waiting, active: 0, height: None }),
+        None => return Err("a stacked frame holds no panels".into()),
+    }
+    let frame_size = |frame: &Frame| frame.height.map(|h| h + crate::dock::TAB_STRIP);
+    let mut node: Option<Node<PanelKind>> = None;
+    // Below the frame being added: the frames' fixed sizes and gaps, or None when one shares.
+    let mut below_fixed = Some(0.0_f32);
+    let mut below_flexible = 0_usize;
+    for frame in frames.into_iter().rev() {
+        let own = frame_size(&frame);
+        let gap = if node.is_some() { FRAME_GAP } else { 0.0 };
+        let tabs = Node::Tabs { panels: frame.panels, active: frame.active };
+        node = Some(match node {
+            None => tabs,
+            Some(rest) => {
+                let size = match (own, below_fixed) {
+                    (Some(own), _) => SplitSize::FixedFirst(own),
+                    (None, Some(below)) => SplitSize::FixedSecond(below),
+                    // Shares the rest with the flexible frames below.
+                    (None, None) => SplitSize::Ratio(1.0 / (below_flexible as f32 + 1.0)),
+                };
+                Node::Split { axis: SplitAxis::Vertical, size, first: Box::new(tabs), second: Box::new(rest) }
+            }
+        });
+        below_fixed = match (own, below_fixed) {
+            (Some(own), Some(below)) => Some(below + gap + own),
+            _ => None,
+        };
+        if own.is_none() {
+            below_flexible = below_flexible.saturating_add(1);
+        }
+    }
+    node.ok_or_else(|| "a stacked frame holds no panels".into())
+}
diff --git a/crates/ui-egui/src/workspace_state/legacy/tests.rs b/crates/ui-egui/src/workspace_state/legacy/tests.rs
new file mode 100644
index 000000000..a3d182f4f
--- /dev/null
+++ b/crates/ui-egui/src/workspace_state/legacy/tests.rs
@@ -0,0 +1,35 @@
+use super::*;
+
+fn stack(count: usize) -> OldNode {
+    OldNode::Stack {
+        entries: (0..count).map(|_| OldStackEntry { panel: Some(PanelKind::Info), panels: Vec::new(), active: 0, open: true, height: None }).collect(),
+    }
+}
+
+#[test]
+fn stacked_frames_respect_the_remaining_tree_depth() {
+    let limit = craft_ui::docking::MAX_DEPTH;
+    assert!(node(stack(limit + 1), 0).is_ok());
+    assert!(node(stack(limit + 2), 0).is_err());
+    assert!(node(stack(1), limit).is_ok());
+    assert!(node(stack(2), limit).is_err());
+    assert!(node(stack(limit), 2).is_err());
+}
+
+#[test]
+fn oversized_legacy_stack_load_does_not_abort() {
+    const CHILD: &str = "EFFECTCRAFT_TEST_LEGACY_STACK_CHILD";
+    if std::env::var_os(CHILD).is_some() {
+        let entry = serde_json::json!({"panel": "Info", "open": true});
+        let value = serde_json::json!({"workspaces": {"Oversized": {"Stack": {"entries": vec![entry; 20_000]}}}});
+        assert!(serde_json::to_vec(&value).unwrap().len() < super::super::MAX_BYTES);
+        assert!(migrate(value, &UiState::default()).is_err());
+        return;
+    }
+    let output = std::process::Command::new(std::env::current_exe().unwrap())
+        .args(["--exact", "workspace_state::legacy::tests::oversized_legacy_stack_load_does_not_abort", "--nocapture"])
+        .env(CHILD, "1")
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "{}\n{}", String::from_utf8_lossy(&output.stdout), String::from_utf8_lossy(&output.stderr));
+}
diff --git a/crates/ui-egui/src/workspace_state/tests.rs b/crates/ui-egui/src/workspace_state/tests.rs
new file mode 100644
index 000000000..aab2814ba
--- /dev/null
+++ b/crates/ui-egui/src/workspace_state/tests.rs
@@ -0,0 +1,369 @@
+use super::*;
+use crate::dock::{Floating, Layout, Node, StackEntry, WorkspaceExt as _};
+use craft_ui::docking::Action;
+use craft_ui::layout::{SplitAxis, SplitSize};
+use effectcraft_engine::config::MemoryConfig;
+
+fn minimal() -> Workspace {
+    Workspace::new(crate::dock::workspace("Minimal"))
+}
+
+fn tabs(panels: &[PanelKind]) -> Node<PanelKind> {
+    Node::Tabs { panels: panels.to_vec(), active: 0 }
+}
+
+#[test]
+fn corrupt_future_or_unknown_workspace_keeps_defaults_and_original_file() {
+    let valid = Snapshot::capture(&UiState::default());
+    // Damaged files of the earlier version: a panel in two places, a bad split, an unknown
+    // panel, a tree deeper than craft-ui allows, a missing field.
+    let earlier = |dock: &str| {
+        format!(
+            r#"{{"version":1,"workspace":"Default","dock":{dock},"floating":[],"focused":"Composition","maximized":null,"saved_workspaces":{{}},"saved_floating":{{}}}}"#
+        )
+    };
+    let mut deep = r#"{"Tabs":{"panels":["Composition"],"active":0}}"#.to_string();
+    for _ in 0..=craft_ui::docking::MAX_DEPTH {
+        deep = format!(r#"{{"Split":{{"vertical":true,"size":{{"Ratio":0.5}},"a":{deep},"b":{{"Tabs":{{"panels":[],"active":0}}}}}}}}"#);
+    }
+    let twice =
+        r#"{"Split":{"vertical":true,"size":{"Ratio":0.5},"a":{"Tabs":{"panels":["Project"],"active":0}},"b":{"Tabs":{"panels":["Project"],"active":0}}}}"#;
+    let bad_split =
+        r#"{"Split":{"vertical":true,"size":{"Ratio":7.0},"a":{"Tabs":{"panels":["Project"],"active":0}},"b":{"Tabs":{"panels":["Timeline"],"active":0}}}}"#;
+    for text in [
+        "{".into(),
+        "{}".into(),
+        "[1, 2]".into(),
+        serde_json::to_string(&Snapshot { version: VERSION + 1, ..valid }).unwrap(),
+        " ".repeat(MAX_BYTES + 1),
+        earlier(twice),
+        earlier(bad_split),
+        earlier(r#"{"Tabs":{"panels":["NoSuchPanel"],"active":0}}"#),
+        earlier(&deep),
+        r#"{"version":1,"workspace":"Default"}"#.into(),
+        r#"{"workspaces":{"Mine":{"Tabs":{"panels":["Composition"],"active":3}}}}"#.into(),
+    ] {
+        let config = MemoryConfig::default();
+        config.write(FILE, &text).unwrap();
+        let mut ui = UiState::default();
+        let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+        assert!(store.error.is_some());
+        assert_eq!(ui.workspace, "Default");
+        assert_eq!(ui.dock, UiState::default().dock);
+        ui.focused = PanelKind::Project;
+        ui.dock = minimal();
+        assert!(!store.save(Some(&config), &ui).unwrap());
+        assert!(store.save_now(Some(&config), &ui).unwrap_err().contains("couldn't be loaded"));
+        assert_eq!(config.read(FILE).as_deref(), Some(text.as_str()));
+        assert_eq!(config.read(BACKUP), None);
+    }
+}
+
+/// A file written by EffectCraft 0.10 (craft-libs 5c874d51): the Default workspace with
+/// Preview floating, Render Queue floating in its own native window, Align closed,
+/// Effects & Presets moved into the Project group and Audio split beside the Timeline,
+/// saved as "My Layout"; then Layer closed.
+const V1: &str = include_str!("../../tests/fixtures/workspaces-v1.json");
+
+#[test]
+fn explicit_save_reports_pending_migration_and_can_be_retried() {
+    let config = MemoryConfig::default();
+    config.write(FILE, V1).unwrap();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    assert!(!ui.native_outer.is_empty());
+    assert!(!store.save(Some(&config), &ui).unwrap(), "background saves defer quietly");
+    let error = store.save_now(Some(&config), &ui).unwrap_err();
+    assert!(error.contains("positions") && error.contains("try saving again"), "{error}");
+    assert_eq!(config.read(FILE).as_deref(), Some(V1));
+    assert_eq!(config.read(BACKUP), None);
+    assert!(store.has_changes(&ui));
+
+    crate::dock_ui::native_outer_to_content(&mut ui, None, None, 3.0);
+    store.save_now(Some(&config), &ui).unwrap();
+    assert_eq!(config.read(BACKUP).as_deref(), Some(V1));
+    let mut restored = UiState::default();
+    let loaded = WorkspaceStore::load(Some(&config), &mut restored);
+    assert_eq!(loaded.error, None);
+    assert_eq!(Snapshot::capture(&restored), Snapshot::capture(&ui));
+}
+
+#[test]
+fn version_one_file_loads_with_every_panel_in_place() {
+    let config = MemoryConfig::default();
+    config.write(FILE, V1).unwrap();
+    let mut ui = UiState::default();
+    let store = WorkspaceStore::load(Some(&config), &mut ui);
+    assert_eq!(store.error, None);
+    assert_eq!(ui.workspace, "My Layout");
+    assert_eq!(ui.focused, PanelKind::Composition);
+    use PanelKind::*;
+    let root = crate::dock::hsplit(
+        SplitSize::FixedSecond(300.0),
+        crate::dock::vsplit(
+            SplitSize::Ratio(0.56),
+            crate::dock::hsplit(SplitSize::FixedFirst(300.0), crate::dock::tabs(&[Project, EffectControls, EffectsPresets], 2), tabs(&[Composition])),
+            crate::dock::hsplit(SplitSize::Ratio(0.5), tabs(&[Timeline]), tabs(&[Audio])),
+        ),
+        tabs(&[Properties]),
+    );
+    assert_eq!(ui.dock.layout.root, Some(root));
+    let floating: Vec<_> = ui.dock.layout.floating.iter().map(|w| (w.panels().copied().collect::<Vec<_>>(), w.rect, w.native)).collect();
+    assert_eq!(
+        floating,
+        [
+            (vec![Preview], [900.0, 120.0, 300.0, 260.0], None),
+            (vec![RenderQueue], [200.0, 500.0, 520.0, 240.0], Some(crate::dock_ui::sanitized_window_rect([200.0, 500.0, 520.0, 240.0]))),
+        ]
+    );
+    // Closed panels stay closed.
+    for panel in [Align, Layer] {
+        assert!(!ui.dock.is_open(panel), "{panel:?}");
+    }
+    // The native window's place is its outer position until the main window reports its
+    // frame (here a 28-point title bar); the file is not rewritten before.
+    let id = ui.dock.layout.floating[1].id;
+    assert_eq!(ui.native_outer, [id]);
+    let mut store = store;
+    assert!(!store.save(Some(&config), &ui).unwrap());
+    let outer = egui::Rect::from_min_size(egui::pos2(10.0, 20.0), egui::vec2(1600.0, 1000.0));
+    crate::dock_ui::native_outer_to_content(&mut ui, Some(outer), Some(outer.translate(egui::vec2(0.0, 28.0))), 0.1);
+    assert_eq!(ui.dock.layout.floating[1].native, Some([200.0, 528.0, 520.0, 240.0]));
+    assert!(ui.native_outer.is_empty());
+    assert!(store.save(Some(&config), &ui).unwrap());
+    // The named workspace still has Layer, closed only after it was saved.
+    let saved = ui.saved_workspaces.get("My Layout").unwrap();
+    assert!(saved.is_docked(Layer) && saved.is_floating(Preview) && !saved.is_open(Align));
+    assert_eq!(saved.layout.floating.iter().filter_map(|w| w.native).count(), 0);
+}
+
+#[test]
+fn version_one_file_is_rewritten_once_in_the_current_format_and_kept_as_a_backup() {
+    let config = MemoryConfig::default();
+    config.write(FILE, V1).unwrap();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    // A backend that reports no window positions: the native place stays as it was.
+    let native = ui.dock.layout.floating[1].native;
+    crate::dock_ui::native_outer_to_content(&mut ui, None, None, 1.0);
+    assert!(!ui.native_outer.is_empty(), "waits for a report");
+    crate::dock_ui::native_outer_to_content(&mut ui, None, None, 5.0);
+    assert!(ui.native_outer.is_empty());
+    assert_eq!(ui.dock.layout.floating[1].native, native);
+    let migrated = Snapshot::capture(&ui);
+    assert!(store.has_changes(&ui), "the migrated layout is written without waiting for an edit");
+    assert!(store.save(Some(&config), &ui).unwrap());
+    assert_eq!(config.read(BACKUP).as_deref(), Some(V1));
+    let text = config.read(FILE).unwrap();
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&text).unwrap()["version"], VERSION);
+    assert!(!store.has_changes(&ui));
+    let mut restored = UiState::default();
+    let reloaded = WorkspaceStore::load(Some(&config), &mut restored);
+    assert_eq!(reloaded.error, None);
+    assert!(!reloaded.has_changes(&restored));
+    assert_eq!(Snapshot::capture(&restored), migrated);
+}
+
+#[test]
+fn stacked_frames_with_tabs_and_an_empty_root_migrate() {
+    let text = r#"{"version":1,"workspace":"Mine","dock":{"Tabs":{"panels":[],"active":0}},
+            "floating":[{"panels":["Project"],"active":0,"rect":[10.0,10.0,300.0,200.0]}],
+            "focused":"Project","maximized":null,
+            "saved_workspaces":{"Mine":{"Stack":{"entries":[{"panel":"Info","open":true},{"panels":["Audio","Preview"],"active":1,"open":true,"height":80.0}]}},
+                "Column":{"Stack":{"entries":[{"panel":"Align","open":false},{"panel":"Preview","open":true,"height":46.0},{"panels":["Properties","Paint"],"active":1,"open":false,"height":300.0},{"panel":"Info","open":true}]}}},
+            "saved_floating":{"Gone":[{"panels":["Align"],"active":0,"rect":[0.0,0.0,100.0,100.0]}]}}"#;
+    let config = MemoryConfig::default();
+    config.write(FILE, text).unwrap();
+    let mut ui = UiState::default();
+    let store = WorkspaceStore::load(Some(&config), &mut ui);
+    assert_eq!(store.error, None);
+    assert_eq!(ui.dock.layout.root, None);
+    assert!(ui.dock.is_floating(PanelKind::Project));
+    use PanelKind::*;
+    // Each open frame is a tab group with all its tabs; a frame's height is a fixed size
+    // (with its tab strip), and the frame without one takes the rest.
+    let column = crate::dock::vsplit(SplitSize::FixedSecond(80.0 + crate::dock::TAB_STRIP), tabs(&[Info]), crate::dock::tabs(&[Audio, Preview], 1));
+    assert_eq!(ui.saved_workspaces.get("Mine").and_then(|w| w.layout.root.clone()), Some(column));
+    // Closed frames' tabs join the open frame above them, or below at the top.
+    let column = crate::dock::vsplit(SplitSize::FixedFirst(46.0 + crate::dock::TAB_STRIP), tabs(&[Preview, Properties, Paint, Align]), tabs(&[Info]));
+    assert_eq!(ui.saved_workspaces.get("Column").and_then(|w| w.layout.root.clone()), Some(column));
+    assert_eq!(ui.saved_workspaces.len(), 2, "floating groups of no named workspace are dropped");
+}
+
+#[test]
+fn explicit_save_without_a_settings_folder_is_an_error() {
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(None, &mut ui);
+    ui.focused = PanelKind::Project;
+    assert!(!store.save(None, &ui).unwrap());
+    assert!(store.save_now(None, &ui).is_err());
+}
+
+#[test]
+fn explicit_save_with_nothing_new_succeeds() {
+    let config = MemoryConfig::default();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    ui.focused = PanelKind::Project;
+    store.save_now(Some(&config), &ui).unwrap();
+    store.save_now(Some(&config), &ui).unwrap();
+    assert!(config.read(FILE).is_some());
+}
+
+#[test]
+fn invalid_tabs_split_and_deep_tree_are_rejected() {
+    let mut snapshot = Snapshot::capture(&UiState::default());
+    snapshot.dock = Workspace::new(Layout { root: Some(Node::Tabs { panels: vec![PanelKind::Project], active: usize::MAX }), floating: vec![] });
+    assert!(snapshot.validate().is_err());
+    let split = |size, first, second| Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(first), second: Box::new(second) };
+    snapshot.dock = Workspace::new(Layout {
+        root: Some(split(SplitSize::FixedFirst(f32::NAN), tabs(&[PanelKind::Project]), tabs(&[PanelKind::Timeline]))),
+        floating: vec![],
+    });
+    assert!(snapshot.validate().is_err());
+    let mut root = tabs(&[PanelKind::Composition]);
+    for _ in 0..=craft_ui::docking::MAX_DEPTH {
+        root = split(SplitSize::Ratio(0.5), root, tabs(&[]));
+    }
+    snapshot.dock = Workspace::new(Layout { root: Some(root), floating: vec![] });
+    assert!(snapshot.validate().is_err());
+    // A panel in two places.
+    snapshot.dock = Workspace::new(Layout {
+        root: Some(tabs(&[PanelKind::Project])),
+        floating: vec![Floating::single(vec![PanelKind::Project], 0, [0.0, 0.0, 200.0, 100.0])],
+    });
+    assert!(snapshot.validate().is_err());
+}
+
+#[test]
+fn closing_all_docked_panels_remains_a_persistable_layout() {
+    let config = MemoryConfig::default();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    for panel in ui.dock.panels() {
+        ui.dock.apply(Action::Close { panel }, crate::dock::permissions).unwrap();
+    }
+    assert!(ui.dock.layout.root.is_none());
+    assert!(store.save(Some(&config), &ui).unwrap());
+    let mut restored = UiState::default();
+    let loaded = WorkspaceStore::load(Some(&config), &mut restored);
+    assert!(loaded.error.is_none());
+    assert_eq!(restored.dock, ui.dock);
+}
+
+#[test]
+fn floating_groups_and_named_snapshots_roundtrip_without_document_state() {
+    let config = MemoryConfig::default();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    ui.workspace = "Floating".into();
+    ui.dock.apply(Action::Float { panel: PanelKind::Preview, rect: [50.0, 80.0, 200.0, 160.0] }, crate::dock::permissions).unwrap();
+    ui.dock.apply(Action::Close { panel: PanelKind::Align }, crate::dock::permissions).unwrap();
+    ui.saved_workspaces.insert(ui.workspace.clone(), ui.dock.clone());
+    ui.maximized = Some(PanelKind::Composition);
+    ui.project_search = "do not persist".into();
+    assert!(store.save(Some(&config), &ui).unwrap());
+    let mut restored = UiState::default();
+    WorkspaceStore::load(Some(&config), &mut restored);
+    assert_eq!(Snapshot::capture(&restored), Snapshot::capture(&ui));
+    // The closed panel's place comes back with it.
+    assert!(restored.dock.hidden.iter().any(|(p, _)| *p == PanelKind::Align));
+    assert!(restored.project_search.is_empty());
+}
+
+#[test]
+fn restored_viewer_slots_do_not_reuse_ids_or_restore_document_links() {
+    let config = MemoryConfig::default();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    let two = |viewer| Workspace::new(Layout { root: Some(tabs(&[PanelKind::Composition, PanelKind::Viewer(viewer)])), floating: vec![] });
+    ui.dock = two(2);
+    ui.saved_workspaces.insert("Two views".into(), two(5));
+    ui.viewers.insert(2, Some(42));
+    assert!(store.save(Some(&config), &ui).unwrap());
+    let mut app = crate::EffectcraftApp::new(effectcraft_engine::Session::default());
+    WorkspaceStore::load(Some(&config), &mut app.ui);
+    assert_eq!(app.ui.viewers.get(&2), Some(&None));
+    assert_eq!(app.ui.viewers.get(&5), Some(&None));
+    assert_eq!(crate::panels::viewers::new_viewer(&mut app), 6);
+    assert!(app.ui.dock.is_docked(PanelKind::Viewer(2)));
+}
+
+#[test]
+fn invalid_viewer_ids_are_rejected_in_every_workspace_reference() {
+    for id in [0, MAX_VIEWER_ID + 1, u32::MAX] {
+        for location in 0..8 {
+            let mut snapshot = Snapshot::capture(&UiState::default());
+            let panel = PanelKind::Viewer(id);
+            let docked = Workspace::new(Layout { root: Some(tabs(&[panel])), floating: vec![] });
+            let stacked =
+                Workspace::new(Layout { root: Some(Node::Stack { entries: vec![StackEntry { panel, open: true, height: None }] }), floating: vec![] });
+            let floating = Workspace::new(Layout {
+                root: Some(tabs(&[PanelKind::Composition])),
+                floating: vec![Floating::single(vec![panel], 0, [0.0, 0.0, 200.0, 100.0])],
+            });
+            let mut hidden = Workspace::new(Layout { root: Some(tabs(&[PanelKind::Composition, panel])), floating: vec![] });
+            hidden.apply(Action::Close { panel }, crate::dock::permissions).unwrap();
+            match location {
+                0 => snapshot.focused = panel,
+                1 => snapshot.maximized = Some(panel),
+                2 => snapshot.dock = docked,
+                3 => snapshot.dock = stacked,
+                4 => snapshot.dock = floating,
+                5 => snapshot.dock = hidden,
+                6 => {
+                    snapshot.saved_workspaces.insert("Saved".into(), stacked);
+                }
+                _ => {
+                    snapshot.saved_workspaces.insert("Saved".into(), floating);
+                }
+            }
+            assert!(snapshot.validate().is_err(), "viewer {id} at location {location} must be rejected");
+        }
+    }
+}
+
+#[test]
+fn hostile_native_window_places_are_made_safe_on_load() {
+    let config = MemoryConfig::default();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    ui.dock.apply(Action::Float { panel: PanelKind::Project, rect: [10.0, 10.0, 300.0, 200.0] }, crate::dock::permissions).unwrap();
+    ui.dock.apply(Action::SetNative { panel: PanelKind::Project, rect: Some([90_000.0, -90_000.0, 1.0e5, 0.5]) }, crate::dock::permissions).unwrap();
+    assert!(store.save(Some(&config), &ui).unwrap());
+    let mut restored = UiState::default();
+    WorkspaceStore::load(Some(&config), &mut restored);
+    let native = restored.dock.layout.floating.iter().find(|w| w.contains(&PanelKind::Project)).and_then(|w| w.native).unwrap();
+    assert_eq!(native, crate::dock_ui::sanitized_window_rect(native));
+    assert!(native[2] <= crate::dock_ui::PANEL_WINDOW_MAX && native[3] >= crate::dock_ui::PANEL_WINDOW_MIN[1]);
+}
+
+#[test]
+fn failed_write_keeps_previous_snapshot_and_retries() {
+    struct Fails<'a>(&'a MemoryConfig);
+    impl ConfigStore for Fails<'_> {
+        fn read(&self, name: &str) -> Option<String> {
+            self.0.read(name)
+        }
+        fn write(&self, _name: &str, _data: &str) -> std::io::Result<()> {
+            Err(std::io::Error::other("synthetic full disk"))
+        }
+        fn remove(&self, _name: &str) -> std::io::Result<()> {
+            Err(std::io::Error::other("unused"))
+        }
+    }
+    let config = MemoryConfig::default();
+    let mut ui = UiState::default();
+    let mut store = WorkspaceStore::load(Some(&config), &mut ui);
+    ui.focused = PanelKind::Project;
+    assert!(store.save(Some(&config), &ui).unwrap());
+    let previous = config.read(FILE).unwrap();
+    ui.focused = PanelKind::Timeline;
+    assert!(store.save(Some(&Fails(&config)), &ui).unwrap_err().contains("synthetic full disk"));
+    assert_eq!(config.read(FILE).as_deref(), Some(previous.as_str()));
+    assert!(store.has_changes(&ui));
+    assert!(store.save(Some(&config), &ui).unwrap());
+    let mut restored = UiState::default();
+    WorkspaceStore::load(Some(&config), &mut restored);
+    assert_eq!(restored.focused, PanelKind::Timeline);
+}
diff --git a/crates/ui-egui/tests/fixtures/workspaces-v1.json b/crates/ui-egui/tests/fixtures/workspaces-v1.json
new file mode 100644
index 000000000..164bf37f0
--- /dev/null
+++ b/crates/ui-egui/tests/fixtures/workspaces-v1.json
@@ -0,0 +1,234 @@
+{
+  "version": 1,
+  "workspace": "My Layout",
+  "dock": {
+    "Split": {
+      "vertical": false,
+      "size": {
+        "FixedB": 300.0
+      },
+      "a": {
+        "Split": {
+          "vertical": true,
+          "size": {
+            "Ratio": 0.56
+          },
+          "a": {
+            "Split": {
+              "vertical": false,
+              "size": {
+                "FixedA": 300.0
+              },
+              "a": {
+                "Tabs": {
+                  "panels": [
+                    "Project",
+                    "EffectControls",
+                    "EffectsPresets"
+                  ],
+                  "active": 2
+                }
+              },
+              "b": {
+                "Tabs": {
+                  "panels": [
+                    "Composition"
+                  ],
+                  "active": 0
+                }
+              }
+            }
+          },
+          "b": {
+            "Split": {
+              "vertical": false,
+              "size": {
+                "Ratio": 0.5
+              },
+              "a": {
+                "Tabs": {
+                  "panels": [
+                    "Timeline"
+                  ],
+                  "active": 0
+                }
+              },
+              "b": {
+                "Tabs": {
+                  "panels": [
+                    "Audio"
+                  ],
+                  "active": 0
+                }
+              }
+            }
+          }
+        }
+      },
+      "b": {
+        "Stack": {
+          "entries": [
+            {
+              "panels": [
+                "Properties"
+              ],
+              "active": 0,
+              "open": true,
+              "height": null
+            }
+          ]
+        }
+      }
+    }
+  },
+  "floating": [
+    {
+      "panels": [
+        "Preview"
+      ],
+      "active": 0,
+      "rect": [
+        900.0,
+        120.0,
+        300.0,
+        260.0
+      ]
+    },
+    {
+      "panels": [
+        "RenderQueue"
+      ],
+      "active": 0,
+      "rect": [
+        200.0,
+        500.0,
+        520.0,
+        240.0
+      ]
+    }
+  ],
+  "focused": "Composition",
+  "maximized": null,
+  "saved_workspaces": {
+    "My Layout": {
+      "Split": {
+        "vertical": false,
+        "size": {
+          "FixedB": 300.0
+        },
+        "a": {
+          "Split": {
+            "vertical": true,
+            "size": {
+              "Ratio": 0.56
+            },
+            "a": {
+              "Split": {
+                "vertical": false,
+                "size": {
+                  "FixedA": 300.0
+                },
+                "a": {
+                  "Tabs": {
+                    "panels": [
+                      "Project",
+                      "EffectControls",
+                      "EffectsPresets"
+                    ],
+                    "active": 2
+                  }
+                },
+                "b": {
+                  "Tabs": {
+                    "panels": [
+                      "Composition",
+                      "Layer"
+                    ],
+                    "active": 0
+                  }
+                }
+              }
+            },
+            "b": {
+              "Split": {
+                "vertical": false,
+                "size": {
+                  "Ratio": 0.5
+                },
+                "a": {
+                  "Tabs": {
+                    "panels": [
+                      "Timeline"
+                    ],
+                    "active": 0
+                  }
+                },
+                "b": {
+                  "Tabs": {
+                    "panels": [
+                      "Audio"
+                    ],
+                    "active": 0
+                  }
+                }
+              }
+            }
+          }
+        },
+        "b": {
+          "Stack": {
+            "entries": [
+              {
+                "panels": [
+                  "Properties"
+                ],
+                "active": 0,
+                "open": true,
+                "height": null
+              }
+            ]
+          }
+        }
+      }
+    }
+  },
+  "saved_floating": {
+    "My Layout": [
+      {
+        "panels": [
+          "Preview"
+        ],
+        "active": 0,
+        "rect": [
+          900.0,
+          120.0,
+          300.0,
+          260.0
+        ]
+      },
+      {
+        "panels": [
+          "RenderQueue"
+        ],
+        "active": 0,
+        "rect": [
+          200.0,
+          500.0,
+          520.0,
+          240.0
+        ]
+      }
+    ]
+  },
+  "panel_windows": [
+    {
+      "panel": "RenderQueue",
+      "rect": [
+        200.0,
+        500.0,
+        520.0,
+        240.0
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/crates/ui-egui/tests/it/gpu_test.rs b/crates/ui-egui/tests/it/gpu_test.rs
new file mode 100644
index 000000000..0156fbb4d
--- /dev/null
+++ b/crates/ui-egui/tests/it/gpu_test.rs
@@ -0,0 +1,43 @@
+//! Shared device-creation gate for the integration-test executable.
+
+static GPU_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+thread_local! {
+    static HELD: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+}
+
+pub(crate) struct Guard {
+    held: Option<std::sync::MutexGuard<'static, ()>>,
+}
+
+impl Drop for Guard {
+    fn drop(&mut self) {
+        if self.held.is_some() {
+            HELD.with(|held| held.set(false));
+        }
+    }
+}
+
+/// GPU-backed harnesses hold this for their whole test; screenshots may enter it again.
+pub(crate) fn lock() -> Guard {
+    let held = if HELD.with(std::cell::Cell::get) {
+        None
+    } else {
+        let guard = GPU_TEST_LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        HELD.with(|held| held.set(true));
+        Some(guard)
+    };
+    Guard { held }
+}
+
+/// Plain harnesses create their GPU renderer lazily on the first screenshot.
+pub(crate) trait RenderSerial {
+    fn render_serialized(&mut self) -> Result<image::RgbaImage, String>;
+}
+
+impl<State> RenderSerial for egui_kittest::Harness<'_, State> {
+    fn render_serialized(&mut self) -> Result<image::RgbaImage, String> {
+        let _device = lock();
+        self.render().map_err(|error| format!("{error:?}"))
+    }
+}
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
new file mode 100644
index 000000000..ca509e064
--- /dev/null
+++ b/crates/ui-egui/tests/it/main.rs
@@ -0,0 +1,138 @@
+//! The crate's integration tests, one binary (each module is a former `tests/<name>.rs`).
+
+mod gpu_test;
+mod native_menu_text_keys;
+mod render_queue_snapshot;
+mod roto_model_guard;
+mod shared_docking_ui;
+mod ui_3d;
+mod ui_accessibility;
+mod ui_accessibility_audit;
+mod ui_agent_audit;
+mod ui_alt_drag_duplicate;
+mod ui_angles;
+mod ui_audio_scrub;
+mod ui_azerty_shortcuts;
+mod ui_batch_links;
+mod ui_batch_switches;
+mod ui_blank_context_menus;
+mod ui_camera_tracker;
+mod ui_character_eyedropper;
+mod ui_character_stroke_order;
+mod ui_checkbox_drag;
+mod ui_color_hex;
+mod ui_comp_presets;
+mod ui_contrast;
+mod ui_control_modifiers;
+mod ui_crypto_pick;
+mod ui_crypto_pick_undo;
+mod ui_dialog_preview;
+mod ui_dock_resize;
+mod ui_drag_drop;
+mod ui_effect_controls;
+mod ui_effect_drop_highlight;
+mod ui_effect_names;
+mod ui_effects_presets_keyboard;
+mod ui_env_light_gpu;
+mod ui_export_overwrite;
+mod ui_expression_values;
+mod ui_flowchart_keyboard;
+mod ui_font_search;
+mod ui_form_fit;
+mod ui_frame_step;
+mod ui_fx_editors;
+mod ui_gpu;
+mod ui_gradient_editor;
+mod ui_gradient_handles;
+mod ui_gradient_value;
+mod ui_graph_fit;
+mod ui_group_rename;
+mod ui_guide_layers;
+mod ui_info_tracker_a11y;
+mod ui_inline_edit;
+mod ui_keyframes;
+mod ui_large_project;
+mod ui_layer_panel_zoom;
+mod ui_layer_source_picker;
+mod ui_light_settings;
+mod ui_live_preview;
+mod ui_locked_color;
+mod ui_marker_names;
+mod ui_media_browser_cache;
+mod ui_media_browser_copy_path;
+mod ui_menus;
+mod ui_new_primitive;
+mod ui_object_matte;
+mod ui_panel_focus;
+mod ui_panel_windows;
+mod ui_panels;
+mod ui_parameter_spacing;
+mod ui_presets_folder;
+mod ui_preview_align;
+mod ui_project_delete;
+mod ui_project_duplicate;
+mod ui_project_keyboard;
+mod ui_project_new_folder;
+mod ui_project_rows;
+mod ui_quick_offset;
+mod ui_ram_preview;
+mod ui_render_queue;
+mod ui_render_queue_keyboard;
+mod ui_roto_objects;
+mod ui_roto_span_confidence;
+mod ui_script_console;
+mod ui_script_console_keyboard;
+#[cfg(not(target_arch = "wasm32"))]
+mod ui_script_render;
+mod ui_scriptui;
+mod ui_scrolling;
+mod ui_self_drop;
+mod ui_settings_info;
+mod ui_settings_keyboard;
+mod ui_shortcut_scopes;
+mod ui_tabs;
+mod ui_tail;
+mod ui_text_edit;
+mod ui_text_range_handles;
+mod ui_theme_favorites;
+mod ui_time_zoom_controls;
+mod ui_timeline_audio_levels;
+mod ui_timeline_effect_label;
+mod ui_timeline_group_select;
+mod ui_timeline_marquee;
+mod ui_timeline_pan;
+mod ui_timeline_shapes;
+mod ui_timeline_switches;
+mod ui_timeline_trim;
+mod ui_timeline_zoom;
+mod ui_toolbar_gradient;
+mod ui_tracker;
+mod ui_unreadable_footage;
+mod ui_video_preview_off;
+mod ui_viewer;
+mod ui_viewer_trackpad;
+mod ui_viewers;
+mod ui_visual_review;
+mod ui_web_gpu_storage;
+mod ui_web_job_gpu;
+mod ui_web_offload;
+mod ui_window_title;
+mod ui_workflow_selection;
+mod ui_workspace_focus;
+mod viewer_geometry;
+mod viewer_passive_display;
+
+/// Register the managed build's canonical craft-fonts checkout (`CRAFT_FONTS_DIR/fonts`) through
+/// the same directory source production scans for `EFFECTCRAFT_FONT_DIRS`. The UI tests then render
+/// real Japanese glyphs from the canonical external input instead of relying on host fonts.
+pub(crate) fn add_canonical_test_fonts() {
+    use effectcraft_text::fonts::{self, DirectorySource};
+    static REGISTER: std::sync::Once = std::sync::Once::new();
+    REGISTER.call_once(|| {
+        let Some(root) = std::env::var_os("CRAFT_FONTS_DIR") else { return };
+        let dir = std::path::PathBuf::from(root).join("fonts");
+        if dir.is_dir() {
+            fonts::add_source(&DirectorySource { dirs: vec![dir] });
+        }
+    });
+}
diff --git a/crates/ui-egui/tests/it/native_menu_text_keys.rs b/crates/ui-egui/tests/it/native_menu_text_keys.rs
new file mode 100644
index 000000000..d740c6b46
--- /dev/null
+++ b/crates/ui-egui/tests/it/native_menu_text_keys.rs
@@ -0,0 +1,191 @@
+//! The macOS menu bar takes the Edit menu's key equivalents before any window sees them: while a
+//! text field has the keyboard, in a docked panel or a floating panel's own OS window, they edit
+//! the field and leave the project alone, and the items stay enabled.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::{menus, native_menu};
+use egui::{Event, Modifiers, PointerButton, Pos2, ViewportCommand, ViewportId, ViewportInfo, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::rc::Rc;
+
+fn app() -> EffectcraftApp {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Solid", "color": "#406080"})).unwrap();
+    let mut app = EffectcraftApp::new(s);
+    app.ui.start_screen = false;
+    app.hooks.clipboard_text = Some(Box::new(|| Some("pasted".into())));
+    app
+}
+
+/// What the Edit commands would change in the project.
+fn project(app: &EffectcraftApp) -> (u64, usize, usize, usize) {
+    let s = &app.session;
+    (s.revision, s.state.clipboard.len(), s.history.undo.len(), s.history.redo.len())
+}
+
+/// Choose the native menu item that runs `command`, then deliver what it queued for the main
+/// window (kittest does not call `raw_input_hook`).
+fn menu(h: &mut Harness<'_, EffectcraftApp>, command: &str) {
+    let spec = native_menu::build(h.state());
+    let id = spec.items().into_iter().find(|i| i.command == command).unwrap().id.clone();
+    let ctx = h.ctx.clone();
+    native_menu::activate(h.state_mut(), &ctx, &spec, &id).unwrap();
+    for _ in 0..3 {
+        let mut raw = egui::RawInput::default();
+        eframe::App::raw_input_hook(h.state_mut(), &ctx, &mut raw);
+        h.input_mut().events.extend(raw.events);
+        h.step();
+        h.state_mut().mark_synthetic_applied();
+    }
+    h.run_steps(2);
+}
+
+/// Whether the menu bar shows `command`'s item enabled now, and whether the project alone would.
+fn enabled(h: &Harness<'_, EffectcraftApp>, command: &str) -> (bool, bool) {
+    let find = |menu: native_menu::NativeMenu| menu.items().into_iter().find(|i| i.command == command).unwrap().enabled;
+    (find(native_menu::build_now(h.state(), &h.ctx)), find(native_menu::build(h.state())))
+}
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).clone();
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, at: Pos2, window: Option<&Host>) {
+    let send = |h: &mut Harness<'_, EffectcraftApp>, event: Event| match window {
+        Some(host) => to_window(host, event),
+        None => h.input_mut().events.push(event),
+    };
+    send(h, Event::PointerMoved(at));
+    h.step();
+    for pressed in [true, false] {
+        send(h, Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+}
+
+/// Stand-in OS windows for floating panels: each runs its own pass with its own input, and
+/// asking one for the clipboard text gives it "pasted".
+#[derive(Default)]
+struct Windows {
+    window: Option<ViewportId>,
+    events: HashMap<ViewportId, Vec<Event>>,
+}
+
+type Host = Rc<RefCell<Windows>>;
+
+fn to_window(host: &Host, event: Event) {
+    let mut host = host.borrow_mut();
+    let Some(window) = host.window else { panic!("no floating panel window") };
+    host.events.entry(window).or_default().push(event);
+}
+
+fn native_windows(h: &mut Harness<'_, EffectcraftApp>) -> Host {
+    let host = Host::default();
+    let shared = host.clone();
+    egui::Context::set_immediate_viewport_renderer(move |ctx, mut viewport| {
+        let id = viewport.ids.this;
+        let size = viewport.builder.inner_size.unwrap_or(vec2(400.0, 300.0));
+        let time = ctx.input(|i| i.time);
+        let events = {
+            let mut host = shared.borrow_mut();
+            host.window = Some(id);
+            host.events.remove(&id).unwrap_or_default()
+        };
+        let viewports = [(ViewportId::ROOT, false), (id, true)]
+            .into_iter()
+            .map(|(id, focused)| (id, ViewportInfo { focused: Some(focused), native_pixels_per_point: Some(1.0), ..Default::default() }))
+            .collect();
+        let input = egui::RawInput {
+            viewport_id: id,
+            viewports,
+            screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, size)),
+            events,
+            focused: true,
+            time: Some(time),
+            ..Default::default()
+        };
+        let mut full = ctx.run_ui(input, |ui| (viewport.viewport_ui_cb)(ui));
+        full.textures_delta.clear();
+        if full.viewport_output.get(&id).is_some_and(|out| out.commands.contains(&ViewportCommand::RequestPaste)) {
+            shared.borrow_mut().events.entry(id).or_default().push(Event::Paste("pasted".into()));
+        }
+    });
+    h.ctx.set_embed_viewports(false);
+    // A main window that reports its place: not Wayland, where floating panels stay in it.
+    let screen = h.ctx.content_rect();
+    h.input_mut().viewports.entry(ViewportId::ROOT).or_default().outer_rect = Some(screen);
+    h.run_steps(3);
+    let window = host.borrow().window.expect("the floating panel opens in an OS window of its own");
+    // That window has the keyboard.
+    let input = h.input_mut();
+    input.focused = false;
+    for (id, focused) in [(ViewportId::ROOT, false), (window, true)] {
+        input.viewports.entry(id).or_default().focused = Some(focused);
+    }
+    h.run_steps(2);
+    host
+}
+
+#[test]
+fn edit_menu_keys_edit_a_text_field_in_a_panel_window() {
+    let mut app = app();
+    menus::invoke(&mut app, &egui::Context::default(), "window.panelWindow", json!({"panel": "Project", "window": true})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| app);
+    h.ctx.set_os(egui::os::OperatingSystem::Mac);
+    let host = native_windows(&mut h);
+    let at = center(&h, "project.search");
+    click(&mut h, at, Some(&host));
+    to_window(&host, Event::Text("abc".into()));
+    h.run_steps(3);
+    let window = host.borrow().window.unwrap();
+    assert_eq!(h.state().ui.project_search, "abc");
+    assert!(!h.ctx.egui_wants_keyboard_input(), "the main window has no focused widget");
+    assert_eq!(native_menu::text_field_window(&h.ctx), Some(window));
+    assert_eq!(enabled(&h, "edit.paste"), (true, false), "Paste stays enabled with nothing copied in the project");
+    let before = project(h.state());
+    menu(&mut h, "edit.selectAll");
+    menu(&mut h, "edit.cut");
+    assert_eq!(h.state().ui.project_search, "", "Select All and Cut act on the field");
+    menu(&mut h, "edit.paste");
+    assert_eq!(h.state().ui.project_search, "pasted");
+    menu(&mut h, "edit.undo");
+    assert_eq!(h.state().ui.project_search, "", "Undo undoes the paste");
+    menu(&mut h, "edit.copy");
+    assert_eq!(project(h.state()), before, "the project is untouched");
+    assert_eq!(h.state().ui.project_search, "");
+}
+
+#[test]
+fn edit_menu_keys_edit_a_docked_text_field() {
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| app());
+    h.ctx.set_os(egui::os::OperatingSystem::Mac);
+    h.run_steps(3);
+    let at = center(&h, "project.search");
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.step();
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.input_mut().events.push(Event::Text("abc".into()));
+    h.run_steps(3);
+    assert_eq!(h.state().ui.project_search, "abc");
+    assert_eq!(native_menu::text_field_window(&h.ctx), Some(ViewportId::ROOT));
+    assert_eq!(enabled(&h, "edit.paste"), (true, false), "Paste stays enabled with nothing copied in the project");
+    let before = project(h.state());
+    menu(&mut h, "edit.selectAll");
+    menu(&mut h, "edit.cut");
+    assert_eq!(h.state().ui.project_search, "", "Select All and Cut act on the field");
+    menu(&mut h, "edit.paste");
+    assert_eq!(h.state().ui.project_search, "pasted");
+    menu(&mut h, "edit.undo");
+    assert_eq!(h.state().ui.project_search, "", "Undo undoes the paste");
+    menu(&mut h, "edit.copy");
+    assert_eq!(project(h.state()), before, "the project is untouched");
+}
diff --git a/crates/ui-egui/tests/render_queue_snapshot.rs b/crates/ui-egui/tests/it/render_queue_snapshot.rs
similarity index 92%
rename from crates/ui-egui/tests/render_queue_snapshot.rs
rename to crates/ui-egui/tests/it/render_queue_snapshot.rs
index 41ce13d2a..27054119d 100644
--- a/crates/ui-egui/tests/render_queue_snapshot.rs
+++ b/crates/ui-egui/tests/it/render_queue_snapshot.rs
@@ -1,7 +1,8 @@
 //! Headless look at the Render Queue panel (wgpu offscreen). Ignored by default (needs a GPU
 //! adapter); run with
-//! `RQ_SNAPSHOT=/abs/out.png cargo test -p effectcraft-ui-egui --test render_queue_snapshot -- --ignored`.
+//! `RQ_SNAPSHOT=/abs/out.png cargo test -p effectcraft-ui-egui --test it render_queue_snapshot:: -- --ignored`.
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::project::render_queue::RenderStatus;
 use effectcraft_ui_egui::EffectcraftApp;
@@ -31,10 +32,10 @@ fn render_queue_panel_snapshot() {
     let ids: Vec<u64> = s.project.render_queue.iter().take(3).map(|i| i.id).collect();
     let mut app = Some(EffectcraftApp::new(s));
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app.take().expect("app"));
-    h.ctx.data_mut(|d| d.insert_temp(egui::Id::new("rq-ui"), (ids, None::<u64>)));
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("rq-ui"), (ids, None::<u64>)));
     h.state_mut().show_panel(effectcraft_ui_egui::dock::PanelKind::RenderQueue);
     h.run_steps(4);
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     let out = std::env::var("RQ_SNAPSHOT").unwrap_or_else(|_| concat!(env!("CARGO_MANIFEST_DIR"), "/../../target/test-out/render_queue.png").into());
     if let Some(d) = std::path::Path::new(&out).parent() {
         std::fs::create_dir_all(d).unwrap();
@@ -57,7 +58,7 @@ fn templates_dialog_snapshot() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| app.take().expect("app"));
     h.run_steps(4);
     assert!(h.state().dialog.is_some(), "the Templates dialog is open");
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     let out = std::env::var("RQ_TEMPLATES_SNAPSHOT").unwrap_or_else(|_| concat!(env!("CARGO_MANIFEST_DIR"), "/../../target/test-out/rq_templates.png").into());
     if let Some(d) = std::path::Path::new(&out).parent() {
         std::fs::create_dir_all(d).unwrap();
diff --git a/crates/ui-egui/tests/it/roto_model_guard.rs b/crates/ui-egui/tests/it/roto_model_guard.rs
new file mode 100644
index 000000000..a65805b55
--- /dev/null
+++ b/crates/ui-egui/tests/it/roto_model_guard.rs
@@ -0,0 +1,26 @@
+//! The Roto Brush model is process-global (`effects::roto::set_model`), and every test in this binary shares the
+//! process: a test that installs a scripted model holds this guard, so another cannot swap or clear the model
+//! mid-run, and the model is cleared again even when the test panics.
+
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+
+use effectcraft_segment::MaskModel;
+
+static LOCK: Mutex<()> = Mutex::new(());
+
+pub struct InstalledModel {
+    _exclusive: MutexGuard<'static, ()>,
+}
+
+/// Install `model` for the roto effect until the returned guard drops.
+pub fn install(model: Arc<dyn MaskModel>) -> InstalledModel {
+    let guard = LOCK.lock().unwrap_or_else(PoisonError::into_inner);
+    effectcraft_engine::effects::roto::set_model(Some(model));
+    InstalledModel { _exclusive: guard }
+}
+
+impl Drop for InstalledModel {
+    fn drop(&mut self) {
+        effectcraft_engine::effects::roto::set_model(None);
+    }
+}
diff --git a/crates/ui-egui/tests/it/shared_docking_ui.rs b/crates/ui-egui/tests/it/shared_docking_ui.rs
new file mode 100644
index 000000000..48e8b8283
--- /dev/null
+++ b/crates/ui-egui/tests/it/shared_docking_ui.rs
@@ -0,0 +1,380 @@
+//! EffectCraft's workspaces in craft-ui's shared docking: transactions, the command path, pointer
+//! gestures and persistence.
+use craft_ui::docking::{Action, Node, Placement, StackEntry, Zone};
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::{
+    EffectcraftApp,
+    dock::{self, Layout, PanelKind, SplitSize, Workspace, WorkspaceExt as _},
+};
+use egui::{Event, Modifiers, PointerButton, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn invoke(app: &mut EffectcraftApp, id: &str, params: serde_json::Value) -> Result<serde_json::Value, String> {
+    effectcraft_ui_egui::menus::invoke(app, &egui::Context::default(), id, params)
+}
+
+fn floating(app: &EffectcraftApp) -> &[dock::Floating<PanelKind>] {
+    &app.ui.dock.layout.floating
+}
+
+#[test]
+fn shared_move_preserves_accordion_metadata_and_unrelated_active_tabs() {
+    let mut workspace = dock::docked(dock::hsplit(
+        SplitSize::FixedSecond(300.0),
+        dock::tabs(&[PanelKind::Project, PanelKind::Composition, PanelKind::Layer], 1),
+        dock::stack(&[(PanelKind::Preview, false, Some(73.0)), (PanelKind::Properties, true, Some(211.0)), (PanelKind::Align, false, None)]),
+    ));
+    workspace.apply(Action::Close { panel: PanelKind::Project }, dock::permissions).unwrap();
+    assert!(workspace.is_visible(PanelKind::Composition));
+    workspace
+        .apply(Action::Move { panel: PanelKind::Preview, anchor: PanelKind::Layer, placement: Placement::Tab { before: None } }, dock::permissions)
+        .unwrap();
+    let Some(Node::Split { second, size, .. }) = &workspace.layout.root else { panic!("split was lost") };
+    assert_eq!(*size, SplitSize::FixedSecond(300.0));
+    let Node::Stack { entries } = second.as_ref() else { panic!("stack was lost") };
+    // The unrelated stacked panels keep their exact state.
+    assert_eq!(
+        entries,
+        &vec![StackEntry { panel: PanelKind::Properties, open: true, height: Some(211.0) }, StackEntry { panel: PanelKind::Align, open: false, height: None }]
+    );
+    assert_eq!(workspace.group_of(PanelKind::Preview), vec![PanelKind::Composition, PanelKind::Layer, PanelKind::Preview]);
+    // Rejected moves and geometry change nothing.
+    let before = workspace.clone();
+    assert!(
+        workspace
+            .apply(Action::Move { panel: PanelKind::Preview, anchor: PanelKind::Audio, placement: Placement::Split(Zone::Left) }, dock::permissions)
+            .is_err()
+    );
+    assert!(workspace.apply(Action::Float { panel: PanelKind::Preview, rect: [0.0, 0.0, f32::INFINITY, 200.0] }, dock::permissions).is_err());
+    assert_eq!(workspace, before);
+}
+
+#[test]
+fn every_builtin_workspace_validates_and_roundtrips_with_dynamic_identities() {
+    for name in dock::WORKSPACES {
+        let workspace = Workspace::new(dock::workspace(name));
+        workspace.validate().unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert!(workspace.is_open(PanelKind::Composition), "{name} lacks the Composition panel");
+        let text = serde_json::to_string(&workspace).unwrap();
+        assert_eq!(serde_json::from_str::<Workspace>(&text).unwrap(), workspace, "{name}");
+    }
+    assert_eq!(dock::workspace("Undocked Panels").floating.len(), 4);
+    // Built again, a built-in layout has the same windows (ids included).
+    let ids = |layout: &Layout| layout.floating.iter().map(|w| w.id).collect::<Vec<_>>();
+    assert_eq!(ids(&dock::workspace("Undocked Panels")), ids(&dock::workspace("Undocked Panels")));
+    let mut workspace = dock::docked(dock::tabs(&[PanelKind::Composition, PanelKind::Viewer(42), PanelKind::ScriptPanel(77)], 1));
+    workspace.apply(Action::Float { panel: PanelKind::ScriptPanel(77), rect: [20.0, 30.0, 400.0, 300.0] }, dock::permissions).unwrap();
+    let text = serde_json::to_string(&workspace).unwrap();
+    assert!(text.contains("\"ScriptPanel\":77") && text.contains("\"Viewer\":42"), "{text}");
+    assert_eq!(serde_json::from_str::<Workspace>(&text).unwrap(), workspace);
+    workspace
+        .apply(Action::Move { panel: PanelKind::ScriptPanel(77), anchor: PanelKind::Viewer(42), placement: Placement::Tab { before: None } }, dock::permissions)
+        .unwrap();
+    assert!(workspace.layout.floating.is_empty());
+    assert!(workspace.is_visible(PanelKind::ScriptPanel(77)));
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let element = h.state().auto.find(id).unwrap_or_else(|| panic!("missing {id}"));
+    Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3]))
+}
+
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: egui::Pos2, to: egui::Pos2, modifiers: Modifiers) {
+    h.event(Event::ModifiersChanged(modifiers));
+    h.event(Event::PointerMoved(from));
+    h.step();
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers });
+    h.step();
+    for fraction in [0.05, 0.25, 0.5, 0.75, 1.0] {
+        h.event(Event::PointerMoved(from.lerp(to, fraction)));
+        h.step();
+    }
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers });
+    h.step();
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(3);
+}
+
+#[test]
+fn pointer_drop_merges_floats_and_redocks_without_project_changes() {
+    let mut session = Session::default();
+    session.execute("comp.new", json!({"name": "Docking composition", "width": 320, "height": 180, "duration": 4})).unwrap();
+    session.execute("layer.newSolid", json!({"name": "Teal plate", "width": 320, "height": 180, "color": "#245b68"})).unwrap();
+    let mut app = EffectcraftApp::new(session);
+    app.ui.start_screen = false;
+    app.ui.dock = dock::docked(dock::vsplit(
+        SplitSize::Ratio(0.62),
+        dock::hsplit(
+            SplitSize::FixedFirst(400.0),
+            dock::tabs(&[PanelKind::Project, PanelKind::Info, PanelKind::Audio], 1),
+            dock::tabs(&[PanelKind::Composition, PanelKind::Layer], 0),
+        ),
+        dock::tabs(&[PanelKind::Timeline], 0),
+    ));
+    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
+    h.run_steps(4);
+    let project = h.state().session.project.clone();
+    let times = h.state().session.state.times.clone();
+    // A tab dropped on another group's tab strip joins it.
+    let from = rect(&h, "panel.tab.Info").center();
+    let to = rect(&h, "panel.tab.Layer").center() + vec2(20.0, 0.0);
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert!(h.state().ui.dock.is_visible(PanelKind::Info));
+    assert!(h.state().ui.dock.group_of(PanelKind::Info).contains(&PanelKind::Composition));
+    // Cmd/Ctrl at the release floats it.
+    let from = rect(&h, "panel.tab.Info").center();
+    drag(&mut h, from, pos2(700.0, 400.0), Modifiers::COMMAND);
+    assert_eq!(floating(h.state()).len(), 1);
+    assert!(h.state().ui.dock.is_floating(PanelKind::Info));
+    let grips: Vec<_> = h.query_all_by_label("Resize panel window").collect();
+    assert!(!grips.is_empty() && grips.iter().all(|grip| grip.accesskit_node().role() == egui::accesskit::Role::Button));
+    // Its corner resizes it and its title bar moves it.
+    let original = floating(h.state())[0].rect;
+    let grip = rect(&h, "panel.float.0.resize").center();
+    drag(&mut h, grip, grip - vec2(36.0, 24.0), Modifiers::NONE);
+    let resized = floating(h.state())[0].rect;
+    assert!(resized[2] < original[2] - 25.0 && resized[3] < original[3] - 15.0, "{original:?} -> {resized:?}");
+    let bar = rect(&h, "panel.float.0.move");
+    drag(&mut h, bar.center(), bar.center() - vec2(24.0, 18.0), Modifiers::NONE);
+    let moved = floating(h.state())[0].rect;
+    assert!(moved[0] < resized[0] - 15.0 && moved[1] < resized[1] - 10.0, "{resized:?} -> {moved:?}");
+    // Its tab dropped on a docked tab strip docks it again.
+    let from = rect(&h, "panel.tab.Info").center();
+    let to = rect(&h, "panel.tab.Project").center() + vec2(20.0, 0.0);
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert!(floating(h.state()).is_empty());
+    assert!(h.state().ui.dock.group_of(PanelKind::Info).contains(&PanelKind::Project));
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+    assert_eq!(times, h.state().session.state.times);
+}
+
+#[test]
+fn current_and_named_floating_layouts_survive_restart() {
+    use effectcraft_engine::config::MemoryConfig;
+    use std::sync::Arc;
+    let store = Arc::new(MemoryConfig::default());
+    let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
+    app.apply_dock(Action::Float { panel: PanelKind::Project, rect: [45.0, 65.0, 430.0, 310.0] }).unwrap();
+    invoke(&mut app, "window.saveWorkspaceAs", json!({"name": "Shared float"})).unwrap();
+    let saved = app.ui.dock.clone();
+    app.apply_dock(Action::MoveFloating { panel: PanelKind::Project, rect: [75.0, 95.0, 480.0, 360.0] }).unwrap();
+    let current = app.ui.dock.clone();
+    eframe::App::on_exit(&mut app);
+    let mut restarted = EffectcraftApp::new(Session { config: Some(store), ..Default::default() });
+    assert_eq!(restarted.ui.dock, current);
+    restarted.set_workspace("Default");
+    restarted.set_workspace("Shared float");
+    assert_eq!(restarted.ui.dock, saved);
+}
+
+#[test]
+fn float_command_rejects_malformed_rectangles_and_keeps_one_docked_panel() {
+    let mut app = EffectcraftApp::new(Session::default());
+    let before = app.ui.dock.clone();
+    for rect in [json!([1, 2, 300]), json!([1, 2, 300, 200, 7]), json!([1, 2, 1e100, 200]), json!("rectangle")] {
+        assert!(invoke(&mut app, "window.floatPanel", json!({"panel": "Project", "rect": rect})).is_err());
+        assert_eq!(app.ui.dock, before);
+    }
+    // The last docked panel stays docked, whether it moves alone, with its group or by command.
+    app.ui.dock = dock::docked(dock::tabs(&[PanelKind::Project], 0));
+    let before = app.ui.dock.clone();
+    assert!(app.apply_dock(Action::Float { panel: PanelKind::Project, rect: [1.0, 2.0, 300.0, 200.0] }).is_err());
+    assert!(invoke(&mut app, "window.panel.float", json!({"panel": "Project", "group": true})).is_err());
+    assert_eq!(app.ui.dock, before);
+    // Closing it is allowed.
+    invoke(&mut app, "window.closePanel", json!({"panel": "Project"})).unwrap();
+    assert!(app.ui.dock.layout.root.is_none());
+}
+
+/// A floating panel dragged towards the window's bottom edge moves there, and its title bar
+/// still moves it from there.
+#[test]
+fn floating_panel_dragged_towards_the_window_edge_keeps_moving() {
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| {
+        let mut app = EffectcraftApp::new(Session::default());
+        app.ui.start_screen = false;
+        app
+    });
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.floatPanel", json!({"panel": "Preview", "rect": [600.0, 400.0, 360.0, 300.0]})).unwrap();
+    h.run_steps(3);
+    let bar = rect(&h, "panel.float.0.move");
+    drag(&mut h, bar.center(), bar.center() + vec2(40.0, 420.0), Modifiers::NONE);
+    let moved = floating(h.state())[0].rect;
+    assert!(moved[1] > 550.0, "the panel moved down: {moved:?}");
+    let bar = rect(&h, "panel.float.0.move");
+    drag(&mut h, bar.center(), bar.center() - vec2(30.0, 200.0), Modifiers::NONE);
+    let back = floating(h.state())[0].rect;
+    assert!(back[1] < moved[1] - 150.0, "{moved:?} -> {back:?}");
+}
+
+#[test]
+fn catalog_docking_action_supports_resize_reorder_and_floating_geometry() {
+    let mut app = EffectcraftApp::new(Session::default());
+    app.ui.dock = dock::docked(dock::hsplit(
+        SplitSize::FixedFirst(300.0),
+        dock::tabs(&[PanelKind::Project, PanelKind::Info], 1),
+        dock::tabs(&[PanelKind::Composition], 0),
+    ));
+    for action in [
+        Action::ResizeSplit { path: vec![], size: SplitSize::FixedFirst(360.0) },
+        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Project, placement: Placement::Tab { before: Some(PanelKind::Project) } },
+        Action::Float { panel: PanelKind::Info, rect: [20.0, 40.0, 300.0, 200.0] },
+        Action::MoveFloating { panel: PanelKind::Info, rect: [45.0, 65.0, 330.0, 240.0] },
+    ] {
+        invoke(&mut app, "window.dockAction", json!({"action": action})).unwrap();
+    }
+    assert_eq!(floating(&app)[0].rect, [45.0, 65.0, 330.0, 240.0]);
+    let Some(Node::Split { size, .. }) = &app.ui.dock.layout.root else { panic!("split lost") };
+    assert_eq!(*size, SplitSize::FixedFirst(360.0));
+    let before = app.ui.dock.clone();
+    assert!(invoke(&mut app, "window.dockAction", json!({"action": {"ResizeSplit": {"path": [true, true], "size": {"Ratio": 0.5}}}})).is_err());
+    assert!(invoke(&mut app, "window.dockAction", json!({"action": {"Open": {"panel": "Align", "anchor": null}}})).is_err());
+    assert_eq!(app.ui.dock, before);
+}
+
+#[test]
+fn ui_dock_and_window_panel_commands_parse_craft_ui_commands() {
+    let mut app = EffectcraftApp::new(Session::default());
+    app.ui.dock = dock::docked(dock::hsplit(
+        SplitSize::FixedFirst(300.0),
+        dock::tabs(&[PanelKind::Project, PanelKind::Info], 0),
+        dock::tabs(&[PanelKind::Composition, PanelKind::Layer], 0),
+    ));
+    // `ui.dock` operations and actions return the workspace.
+    let reply = invoke(&mut app, "ui.dock", json!({"operation": "move", "panel": "Info", "target": "Composition", "zone": "center"})).unwrap();
+    assert!(reply["docking"]["layout"].is_object(), "{reply}");
+    assert!(app.ui.dock.group_of(PanelKind::Info).contains(&PanelKind::Composition));
+    invoke(&mut app, "ui.dock", json!({"action": {"Activate": {"panel": "Layer"}}})).unwrap();
+    assert!(app.ui.dock.is_visible(PanelKind::Layer));
+    invoke(&mut app, "ui.dock", json!({"operation": "float", "panel": "Info", "rect": [100, 100, 300, 200]})).unwrap();
+    assert_eq!(floating(&app)[0].rect, [100.0, 100.0, 300.0, 200.0]);
+    // `window.panel.*` takes EffectCraft's panel names too.
+    invoke(&mut app, "window.panel.dock", json!({"panel": "Info", "anchor": "Project", "zone": "right"})).unwrap();
+    assert!(floating(&app).is_empty() && app.ui.dock.is_docked(PanelKind::Info));
+    invoke(&mut app, "window.panel.close", json!({"panel": "Info"})).unwrap();
+    assert!(!app.ui.dock.is_open(PanelKind::Info));
+    // A closed panel reopens where it was.
+    invoke(&mut app, "window.panel.activate", json!({"panel": "Info"})).unwrap();
+    assert!(app.ui.dock.is_docked(PanelKind::Info));
+    // The per-panel ids still open a panel.
+    invoke(&mut app, "window.panel.Align", json!({})).unwrap();
+    assert!(app.ui.dock.is_open(PanelKind::Align));
+    // Bad commands change nothing; Reset returns to the workspace's layout.
+    let before = app.ui.dock.clone();
+    for (id, params) in [
+        ("ui.dock", json!({"operation": "move", "panel": "Info", "target": "Nope"})),
+        ("ui.dock", json!({"operation": "teleport", "panel": "Info"})),
+        ("window.panel.move", json!({"panel": "Info"})),
+        ("window.panel.dock", json!({"panel": "Nope", "anchor": "Project"})),
+    ] {
+        assert!(invoke(&mut app, id, params.clone()).is_err(), "{id} {params}");
+        assert_eq!(app.ui.dock, before);
+    }
+    invoke(&mut app, "ui.dock.reset", json!({})).unwrap();
+    assert_eq!(app.ui.dock, Workspace::new(dock::workspace("Default")));
+}
+
+#[test]
+fn raw_open_actions_are_rejected_through_every_docking_route() {
+    let mut app = EffectcraftApp::new(Session::default());
+    let before = app.ui.dock.clone();
+    for panel in [PanelKind::ScriptPanel(77), PanelKind::Viewer(42)] {
+        for action in [
+            Action::Open { panel, anchor: Some(PanelKind::Project) },
+            Action::OpenAt { panel, anchor: PanelKind::Project, placement: Placement::Tab { before: None } },
+        ] {
+            for id in ["ui.dock", "window.panel.layout", "window.dockAction"] {
+                let error = invoke(&mut app, id, json!({"action": action})).unwrap_err();
+                assert!(error.contains("panel open commands"), "{id}: {error}");
+                assert_eq!(app.ui.dock, before, "{id} must leave the layout unchanged");
+                assert!(app.session.script_ui.window(77).is_none());
+                assert!(!app.ui.viewers.contains_key(&42));
+            }
+        }
+    }
+    // The normal operation still opens a panel and the raw form still activates one.
+    invoke(&mut app, "ui.dock", json!({"operation": "open", "panel": "Align"})).unwrap();
+    assert!(app.ui.dock.is_open(PanelKind::Align));
+    invoke(&mut app, "window.panel.layout", json!({"action": {"Activate": {"panel": "Project"}}})).unwrap();
+    assert!(app.ui.dock.is_visible(PanelKind::Project));
+}
+
+#[test]
+fn catalog_close_keeps_dynamic_panel_identity_and_releases_viewers() {
+    let mut app = EffectcraftApp::new(Session::default());
+    app.ui.dock = dock::docked(dock::tabs(&[PanelKind::Composition, PanelKind::Viewer(42), PanelKind::ScriptPanel(77)], 1));
+    app.ui.viewers.insert(42, Some(7));
+    app.ui.maximized = Some(PanelKind::Viewer(42));
+    for panel in [PanelKind::Viewer(42), PanelKind::ScriptPanel(77)] {
+        invoke(&mut app, "window.dockAction", json!({"action": Action::Close { panel }})).unwrap();
+        assert!(!app.ui.dock.is_open(panel));
+        assert!(app.ui.dock.hidden.iter().any(|(p, _)| *p == panel), "{panel:?} keeps its place");
+    }
+    assert!(app.ui.dock.is_docked(PanelKind::Composition));
+    assert_eq!(app.ui.maximized, None);
+    assert!(!app.ui.viewers.get(&42).is_some_and(Option::is_some), "the closed viewer forgets its comp");
+}
+
+#[test]
+fn stacked_panels_resize_by_pointer_without_changing_closed_entries() {
+    let mut session = Session::default();
+    session.execute("comp.new", json!({"width": 160, "height": 90, "duration": 1})).unwrap();
+    let mut app = EffectcraftApp::new(session);
+    app.ui.start_screen = false;
+    let mut h = Harness::builder().with_size(vec2(1000.0, 720.0)).build_eframe(move |_| app);
+    h.run_steps(4);
+    h.state_mut().ui.dock =
+        dock::docked(dock::stack(&[(PanelKind::Preview, true, Some(100.0)), (PanelKind::Properties, true, None), (PanelKind::Align, false, Some(77.0))]));
+    h.run_steps(3);
+    let project = h.state().session.project.clone();
+    let before = rect(&h, "panel.Preview").height();
+    let from = rect(&h, "dock.gutter.s0").center();
+    drag(&mut h, from, from + vec2(0.0, 16.0), Modifiers::NONE);
+    let after = rect(&h, "panel.Preview").height();
+    assert!((after - before - 16.0).abs() < 2.0, "{before} -> {after}");
+    let Some(Node::Stack { entries }) = &h.state().ui.dock.layout.root else { panic!("stack lost") };
+    assert!(entries[0].height.unwrap_or_default() > 100.0, "{entries:?}");
+    assert_eq!(entries[2], StackEntry { panel: PanelKind::Align, open: false, height: Some(77.0) });
+    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+}
+
+#[test]
+fn failed_close_preserves_viewer_lifecycle_and_maximize_state() {
+    let mut app = EffectcraftApp::new(Session::default());
+    // A locked workspace refuses the close.
+    app.ui.dock = dock::docked(dock::tabs(&[PanelKind::Composition, PanelKind::Viewer(42)], 1));
+    app.ui.dock.locked = true;
+    app.ui.maximized = Some(PanelKind::Viewer(42));
+    app.ui.viewers.insert(42, Some(3));
+    app.ui.active_viewer = 42;
+    app.ui.locked_tabs.insert(PanelKind::Viewer(42).id());
+    let before = app.ui.clone();
+    app.close_panel(PanelKind::Viewer(42));
+    assert_eq!(app.ui.dock, before.dock);
+    assert_eq!(app.ui.maximized, before.maximized);
+    assert_eq!(app.ui.viewers, before.viewers);
+    assert_eq!(app.ui.active_viewer, before.active_viewer);
+    assert_eq!(app.ui.locked_tabs, before.locked_tabs);
+}
+
+/// A panel never laid out opens at EffectCraft's default place for it (History beside the
+/// Project panel, Render Queue with the Timeline), not where craft-ui's fallback puts it; a panel
+/// the user closed comes back where it was.
+#[test]
+fn never_placed_panels_open_at_their_default_place() {
+    let mut app = EffectcraftApp::new(Session::default());
+    assert!(!app.ui.dock.is_open(PanelKind::History));
+    invoke(&mut app, "window.panel", json!({"panel": "History"})).unwrap();
+    assert!(app.ui.dock.group_of(PanelKind::History).contains(&PanelKind::Project), "{:?}", app.ui.dock.group_of(PanelKind::History));
+    invoke(&mut app, "window.panel.activate", json!({"panel": "Tracker"})).unwrap();
+    assert!(app.ui.dock.group_of(PanelKind::Tracker).contains(&PanelKind::EffectsPresets) || app.ui.dock.is_open(PanelKind::Tracker));
+    // Closed by the user, it reopens at its recorded place.
+    invoke(&mut app, "window.dockPanel", json!({"panel": "History", "anchor": "Timeline"})).unwrap();
+    invoke(&mut app, "window.closePanel", json!({"panel": "History"})).unwrap();
+    invoke(&mut app, "window.panel", json!({"panel": "History"})).unwrap();
+    assert!(app.ui.dock.group_of(PanelKind::History).contains(&PanelKind::Timeline));
+}
diff --git a/crates/ui-egui/tests/ui_3d.rs b/crates/ui-egui/tests/it/ui_3d.rs
similarity index 97%
rename from crates/ui-egui/tests/ui_3d.rs
rename to crates/ui-egui/tests/it/ui_3d.rs
index 223d9960c..0f7a10b7e 100644
--- a/crates/ui-egui/tests/ui_3d.rs
+++ b/crates/ui-egui/tests/it/ui_3d.rs
@@ -1,7 +1,8 @@
 //! Headless UI checks for the 3D viewer (egui_kittest). The `snapshot` test renders the window
 //! with wgpu and writes PNGs when `EC_SNAPSHOT_DIR` is set (`cargo test -p effectcraft-ui-egui
-//! --test ui_3d -- --ignored`); the other test only runs the UI logic.
+//! --test it ui_3d:: -- --ignored`); the other test only runs the UI logic.
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::render::three_d::View3D;
 use effectcraft_ui_egui::EffectcraftApp;
@@ -109,6 +110,7 @@ fn camera_and_light_dialogs_create_layers() {
 #[test]
 #[ignore = "renders with wgpu; run with --ignored (set EC_SNAPSHOT_DIR to keep PNGs)"]
 fn snapshot() {
+    let _device = crate::gpu_test::lock();
     let dir = std::env::var("EC_SNAPSHOT_DIR").ok();
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_pixels_per_point(1.0).wgpu().build_eframe(|_| app());
     let shots: [(&str, Option<&str>); 4] =
@@ -118,7 +120,7 @@ fn snapshot() {
             h.state_mut().session.execute(c, json!({})).unwrap();
         }
         settle(&mut h);
-        let img = h.render().expect("render");
+        let img = h.render_serialized().expect("render");
         if let Some(d) = &dir {
             img.save(format!("{d}/ui3d_{name}.png")).unwrap();
         }
@@ -126,14 +128,14 @@ fn snapshot() {
     let ctx = h.ctx.clone();
     effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.newCamera", json!({})).unwrap();
     h.run_steps(3);
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     if let Some(d) = &dir {
         img.save(format!("{d}/ui3d_camera_dialog.png")).unwrap();
     }
     h.state_mut().dialog = None;
     effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.newLight", json!({})).unwrap();
     h.run_steps(3);
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     if let Some(d) = &dir {
         img.save(format!("{d}/ui3d_light_dialog.png")).unwrap();
     }
@@ -143,7 +145,7 @@ fn snapshot() {
     h.state_mut().session.execute("layer.select", json!({"layers": ["Card Blue"]})).unwrap();
     effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.reveal.rotation", json!({})).unwrap();
     settle(&mut h);
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     if let Some(d) = &dir {
         img.save(format!("{d}/ui3d_reveal_rotation.png")).unwrap();
     }
diff --git a/crates/ui-egui/tests/it/ui_accessibility.rs b/crates/ui-egui/tests/it/ui_accessibility.rs
new file mode 100644
index 000000000..df283b0f9
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_accessibility.rs
@@ -0,0 +1,52 @@
+//! Accessibility of the app's own controls.
+//!
+//! The shared widgets in `widgets.rs` are raw `ui.interact` rectangles. Without a `WidgetInfo`
+//! they are not in the accessibility tree at all, so neither a screen reader nor kittest can
+//! reach them; and an input control without a name is unreachable even when it is in the tree.
+//! `Harness::run` checks the tree it has, but only for the screen it settled on: this opens every
+//! panel and checks again.
+//!
+//! Limit: a control that reports no `WidgetInfo` at all has no node, so it is not "unnamed" here.
+//! `widgets::checkbox` and the raw-painted row controls (`icon_toggle`, `scroll_bar`, hot-number
+//! values) are still in that state; naming every call site is separate work.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    // A text layer under edit gives the Character / Paragraph panels their controls.
+    let _ = s.execute("layer.select", json!({"layers": ["EFFECTCRAFT"]}));
+    Harness::builder().with_size(egui::vec2(1680.0, 1020.0)).build_eframe(|_| EffectcraftApp::new(s))
+}
+
+#[test]
+fn custom_toolbar_buttons_are_named() {
+    let mut h = harness();
+    h.run();
+    // An icon button carries no text of its own: its tooltip is its accessible name.
+    let home = h.query_by_label("Home").expect("the toolbar's Home icon button is named by its tooltip");
+    assert_eq!(home.accesskit_node().role(), egui::accesskit::Role::Button);
+    assert!(h.unnamed_widgets().is_empty(), "{:?}", h.unnamed_widgets());
+}
+
+#[test]
+fn every_panel_names_its_input_controls() {
+    let mut h = harness();
+    h.run();
+    let mut unnamed = vec![];
+    for p in PanelKind::ALL {
+        h.state_mut().show_panel(p);
+        h.state_mut().ui.maximized = Some(p);
+        h.run_steps(4);
+        for w in h.unnamed_widgets() {
+            unnamed.push(format!("{}: {w}", p.title()));
+        }
+    }
+    assert!(unnamed.is_empty(), "{} control(s) have no accessible name:\n{}", unnamed.len(), unnamed.join("\n"));
+}
diff --git a/crates/ui-egui/tests/it/ui_accessibility_audit.rs b/crates/ui-egui/tests/it/ui_accessibility_audit.rs
new file mode 100644
index 000000000..fecf2b4ca
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_accessibility_audit.rs
@@ -0,0 +1,496 @@
+//! Accessibility audit (docs/gaps.md gap 25): renders panels headless and walks the AccessKit
+//! tree of the frame. Every interactive node (button, check box, text input, combo box, slider,
+//! spin button, tree or list item, tab, link, ...) must have a non-empty name, a role that says
+//! what it is, and the state that role needs (checked, selected, a value).
+//!
+//! * The panels that had their pass (`FIXED`: Effects & Presets, Settings, Render Queue with its
+//!   Templates dialog, Project, Info, Flowchart, Script Console and the 3D Camera Tracker block
+//!   of Effect Controls) must have **zero** findings.
+//! * Every other panel is counted and printed (run with `--nocapture`), and checked against
+//!   [`BASELINE`], a ratchet that can only shrink: fixing a panel lowers its number, and a number
+//!   must never go up. A count that falls does not fail the test; lower the entry when a panel improves.
+//!
+//! A panel that only paints (Info) has no controls; there the audit counts what it *describes*: a
+//! graphic (`Role::Image`, which must have a name in a fixed panel), a read-out (`Role::Label`
+//! with a name) or a log. A fixed panel must show a minimum number of controls and described
+//! items, so zero findings cannot mean the panel was not looked at.
+//!
+//! What this does not measure: how a real screen reader speaks the tree (none was run), colour
+//! contrast, focus order or keyboard operation (the `ui_*_keyboard.rs` tests cover those), or
+//! widgets that are scrolled out of view and not drawn.
+
+use std::collections::HashSet;
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::accesskit::{Action, Role, Toggled};
+use egui::{Rect, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::NodeT;
+use serde_json::json;
+
+/// Groups that must be clean. A group is the first part of a scenario name (before the `:`).
+const FIXED: &[&str] = &["EffectsPresets", "Settings", "RenderQueue", "Project", "Info", "Flowchart", "ScriptConsole", "CameraTracker"];
+
+/// Panels audited in a scenario of their own (a fresh window, the panel maximized, so it has its
+/// full size; in the shared loop below each panel opened squeezes the next one). The loop still
+/// opens them, so the layout the other panels are measured in does not change.
+const DEDICATED: &[PanelKind] = &[PanelKind::Info, PanelKind::Flowchart, PanelKind::ScriptConsole];
+
+/// (scenario, findings, of them unnamed controls) per not-yet-fixed scenario, as measured in the
+/// shared docking layout (Effect Controls with one Gaussian Blur on the layer, every other panel
+/// as it opens). A ratchet: a number may only go down, never up (a lower count does not fail);
+/// when a pass over a panel lowers it, lower its entry in the same change, and remove the entry (and add the panel to `FIXED`)
+/// when it reaches zero. A scenario that is not listed is held to zero.
+const BASELINE: &[(&str, usize, usize)] = &[
+    ("EffectControls:default", 28, 14),
+    ("Composition:default", 4, 2),
+    ("Layer:default", 2, 1),
+    ("Timeline:default", 72, 25),
+    ("Audio:default", 4, 2),
+    ("Properties:default", 31, 15),
+    ("Character:default", 46, 22),
+    ("Paragraph:default", 26, 13),
+    ("Align:default", 12, 0),
+    ("Tracker:default", 11, 3),
+    ("Wiggler:default", 4, 2),
+    ("Smoother:default", 2, 1),
+    ("MotionSketch:default", 8, 4),
+    ("Paint:default", 38, 18),
+    ("Brushes:default", 34, 6),
+    ("History:default", 10, 5),
+    ("MaskInterpolation:default", 16, 8),
+    ("EssentialGraphics:default", 1, 1),
+    ("LumetriScopes:default", 2, 1),
+    ("MediaBrowser:default", 20, 10),
+    ("Metadata:default", 2, 2),
+    ("ContentAwareFill:default", 2, 1),
+];
+
+/// How many controls (and, in the panels that paint, described read-outs, graphics and logs) the fixed scenarios must at least show, so that "zero findings" is never
+/// the result of looking at nothing. Any scenario not listed needs 2.
+const MIN_CONTROLS: &[(&str, usize)] = &[
+    ("EffectsPresets:default", 10),
+    ("EffectsPresets:open", 10),
+    ("EffectsPresets:search", 5),
+    ("EffectsPresets:menu", 8),
+    ("Settings:general", 12),
+    ("Settings:appearance", 15),
+    ("Settings:labels", 30),
+    ("RenderQueue:queued", 8),
+    ("RenderQueue:expanded", 12),
+    ("RenderQueue:menu", 20),
+    ("RenderQueue:templates:renderSettings", 8),
+    ("RenderQueue:templates:outputModule", 8),
+    // Info, Flowchart and Script Console count read-outs, graphics and logs as well as controls.
+    ("Info:default", 6),
+    ("Info:layer", 8),
+    ("Flowchart:default", 6),
+    ("Flowchart:layers", 8),
+    ("ScriptConsole:default", 4),
+    ("ScriptConsole:log", 4),
+    ("CameraTracker:editor", 3),
+];
+
+/// The roles that are controls: anything with one of these (or with a click or focus action) is
+/// held to the rules below.
+const CONTROL_ROLES: &[Role] = &[
+    Role::Button,
+    Role::CheckBox,
+    Role::ColorWell,
+    Role::ComboBox,
+    Role::Link,
+    Role::ListBoxOption,
+    Role::ListItem,
+    Role::MenuItem,
+    Role::MenuItemCheckBox,
+    Role::MenuItemRadio,
+    Role::MultilineTextInput,
+    Role::RadioButton,
+    Role::SearchInput,
+    Role::Slider,
+    Role::SpinButton,
+    Role::Switch,
+    Role::Tab,
+    Role::TextInput,
+    Role::TreeItem,
+];
+
+#[derive(Debug, Clone)]
+struct Finding {
+    scenario: String,
+    problem: &'static str,
+    role: Role,
+    name: String,
+    rect: [i32; 4],
+}
+
+impl std::fmt::Display for Finding {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "[{}] {}: {:?} {:?} at {:?}", self.scenario, self.problem, self.role, self.name, self.rect)
+    }
+}
+
+fn app_session() -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Red", "color": "#c04040"})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Blue", "color": "#4040c0"})).unwrap();
+    s.execute("effect.apply", json!({"effect": "Gaussian Blur"})).ok();
+    s
+}
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(app_session()));
+    // The default workspace gives Preview a short frame at the top of the right column; its
+    // controls below that frame stay in the tree and would be counted against the panel under it.
+    // The per-panel pass opens Preview again for its own scenario.
+    h.state_mut().close_panel(PanelKind::Preview);
+    h.run_steps(4);
+    h
+}
+
+fn invoke(h: &mut Harness<'_, EffectcraftApp>, id: &str, params: serde_json::Value) {
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, id, params).unwrap();
+    h.run_steps(4);
+}
+
+fn panel_rect(h: &Harness<'_, EffectcraftApp>, p: PanelKind) -> Option<Rect> {
+    let e = h.state().auto.find(&format!("panel.{}", p.id()))?;
+    Some(Rect::from_min_size(pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3])))
+}
+
+fn dialog_rect(h: &Harness<'_, EffectcraftApp>, title: &str) -> Option<Rect> {
+    h.ctx.memory(|m| m.area_rect(egui::Id::unique(("modal", title))))
+}
+
+/// The ids of every node now, so a later audit can look at what appeared since (a popup).
+fn node_ids(h: &Harness<'_, EffectcraftApp>) -> HashSet<String> {
+    h.root().children_recursive().map(|n| format!("{:?}", n.accesskit_node().id())).collect()
+}
+
+/// Walk the tree and check every control whose centre is inside `scope` (and, when `since` is
+/// given, that was not in the tree before).
+fn audit(h: &Harness<'_, EffectcraftApp>, scenario: &str, scope: Rect, since: Option<&HashSet<String>>) -> (Vec<Finding>, usize) {
+    let mut out = Vec::new();
+    let mut controls = 0;
+    // The rules for graphics apply where the panel has had its pass.
+    let strict = FIXED.contains(&group(scenario));
+    for n in h.root().children_recursive() {
+        let a = n.accesskit_node();
+        if a.is_hidden() {
+            continue;
+        }
+        if since.is_some_and(|s| s.contains(&format!("{:?}", a.id()))) {
+            continue;
+        }
+        let Some(b) = a.bounding_box() else {
+            // No bounds: assistive technology cannot place it. Only a control is a finding (and
+            // it is one wherever it is: there is no position to scope it by).
+            if CONTROL_ROLES.contains(&a.role()) {
+                out.push(Finding { scenario: scenario.to_string(), problem: "no bounds", role: a.role(), name: a.label().unwrap_or_default(), rect: [0; 4] });
+            }
+            continue;
+        };
+        if !scope.contains(pos2(((b.x0 + b.x1) / 2.0) as f32, ((b.y0 + b.y1) / 2.0) as f32)) {
+            continue;
+        }
+        let role = a.role();
+        // What a panel describes without being operable: a graphic (a name is required in a fixed
+        // panel), a read-out with a name, a log.
+        let described = match role {
+            Role::Image | Role::Canvas | Role::Log => true,
+            Role::Label => a.label().is_some_and(|l| !l.trim().is_empty()),
+            _ => false,
+        };
+        if described {
+            if strict && matches!(role, Role::Image | Role::Canvas | Role::Log) && a.label().is_none_or(|l| l.trim().is_empty()) {
+                out.push(Finding {
+                    scenario: scenario.to_string(),
+                    problem: "graphic without a name",
+                    role,
+                    name: String::new(),
+                    rect: [b.x0 as i32, b.y0 as i32, b.x1 as i32, b.y1 as i32],
+                });
+            }
+            controls += 1;
+            continue;
+        }
+        let actionable = a.data().supports_action(Action::Click) || a.data().supports_action(Action::Focus);
+        let control = CONTROL_ROLES.contains(&role);
+        if !(control || (actionable && matches!(role, Role::Unknown | Role::GenericContainer))) {
+            continue;
+        }
+        let name = a.label().unwrap_or_default();
+        controls += 1;
+        let finding = |problem: &'static str| Finding {
+            scenario: scenario.to_string(),
+            problem,
+            role,
+            name: name.clone(),
+            rect: [b.x0 as i32, b.y0 as i32, b.x1 as i32, b.y1 as i32],
+        };
+        if !control && matches!(role, Role::Unknown | Role::GenericContainer) {
+            // Something you can click or focus, that no role describes.
+            out.push(finding("clickable or focusable without a control role"));
+        }
+        if name.trim().is_empty() {
+            out.push(finding("no name"));
+        }
+        let state_missing = match role {
+            Role::CheckBox | Role::RadioButton | Role::Switch | Role::MenuItemCheckBox | Role::MenuItemRadio => {
+                a.toggled().is_none() || a.toggled() == Some(Toggled::Mixed)
+            }
+            Role::Slider | Role::SpinButton => a.numeric_value().is_none(),
+            Role::ComboBox => a.value().is_none_or(|v| v.trim().is_empty()),
+            Role::TreeItem | Role::ListItem | Role::ListBoxOption | Role::Tab => a.is_selected().is_none(),
+            _ => false,
+        };
+        if state_missing {
+            out.push(finding("no state or value"));
+        }
+    }
+    (out, controls)
+}
+
+fn count_unnamed(f: &[Finding]) -> usize {
+    f.iter().filter(|f| f.problem == "no name").count()
+}
+
+struct Report {
+    findings: Vec<Finding>,
+    /// (scenario, findings, of them unnamed, controls looked at)
+    rows: Vec<(String, usize, usize, usize)>,
+}
+
+impl Report {
+    fn add(&mut self, scenario: &str, (f, controls): (Vec<Finding>, usize)) {
+        self.rows.push((scenario.to_string(), f.len(), count_unnamed(&f), controls));
+        self.findings.extend(f);
+    }
+}
+
+fn group(scenario: &str) -> &str {
+    scenario.split(':').next().unwrap_or(scenario)
+}
+
+fn collect() -> Report {
+    let mut r = Report { findings: vec![], rows: vec![] };
+
+    // ---- Effects & Presets: closed, everything open, searching, the contents menu.
+    let mut h = harness();
+    h.state_mut().show_panel(PanelKind::EffectsPresets);
+    h.run_steps(4);
+    let rect = panel_rect(&h, PanelKind::EffectsPresets).expect("Effects & Presets is drawn");
+    r.add("EffectsPresets:default", audit(&h, "EffectsPresets:default", rect, None));
+    {
+        let s = h.state_mut();
+        s.session.prefs.toggle_effect_favorite("ec.blur.gaussian");
+        s.ui.effects_open.insert("favorites".into());
+        s.ui.effects_open.insert("presets".into());
+        s.ui.effects_open.insert("presets/Text".into());
+        s.ui.effects_open.insert("Blur & Sharpen".into());
+    }
+    h.run_steps(4);
+    r.add("EffectsPresets:open", audit(&h, "EffectsPresets:open", rect, None));
+    h.state_mut().ui.effects_search = "blur".into();
+    h.run_steps(4);
+    r.add("EffectsPresets:search", audit(&h, "EffectsPresets:search", rect, None));
+    let before = node_ids(&h);
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("fx-contents-menu").with("open"), true));
+    h.run_steps(4);
+    let screen = Rect::from_min_size(pos2(0.0, 0.0), egui::vec2(1600.0, 1000.0));
+    r.add("EffectsPresets:menu", audit(&h, "EffectsPresets:menu", screen, Some(&before)));
+
+    // ---- Settings: every page.
+    let mut h = harness();
+    let before = node_ids(&h);
+    for page in effectcraft_engine::prefs::pages() {
+        invoke(&mut h, "app.settings", json!({"page": page.id}));
+        let name = format!("Settings:{}", page.id);
+        let rect = dialog_rect(&h, "Settings").expect("the Settings dialog is open");
+        r.add(&name, audit(&h, &name, rect, Some(&before)));
+    }
+
+    // ---- Render Queue: empty, queued and expanded, a menu open, the Templates dialogs.
+    let mut h = harness();
+    h.state_mut().show_panel(PanelKind::RenderQueue);
+    h.run_steps(4);
+    let rect = panel_rect(&h, PanelKind::RenderQueue).expect("the Render Queue is drawn");
+    r.add("RenderQueue:empty", audit(&h, "RenderQueue:empty", rect, None));
+    let comp = h.state().session.active_comp_id().expect("a comp").0;
+    let mut items = vec![];
+    for _ in 0..2 {
+        let out = h.state_mut().session.execute("renderQueue.add", json!({"comp": comp})).unwrap();
+        items.push(out["item"].as_u64().or_else(|| out["items"][0].as_u64()).unwrap_or(0));
+    }
+    h.run_steps(4);
+    r.add("RenderQueue:queued", audit(&h, "RenderQueue:queued", rect, None));
+    let first = h.state().session.project.render_queue.first().map(|i| i.id).expect("a queue item");
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("rq-ui"), (vec![first], Some(first))));
+    h.run_steps(4);
+    r.add("RenderQueue:expanded", audit(&h, "RenderQueue:expanded", rect, None));
+    let before = node_ids(&h);
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique(("rq-dd", first, 0)).with("open"), true));
+    h.run_steps(4);
+    r.add("RenderQueue:menu", audit(&h, "RenderQueue:menu", screen, Some(&before)));
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique(("rq-dd", first, 0)).with("open"), false));
+    let before = node_ids(&h);
+    for (kind, title) in [("renderSettings", "Render Settings Templates"), ("outputModule", "Output Module Templates")] {
+        invoke(&mut h, "app.templates", json!({"kind": kind}));
+        let name = format!("RenderQueue:templates:{kind}");
+        let rect = dialog_rect(&h, title).expect("the Templates dialog is open");
+        r.add(&name, audit(&h, &name, rect, Some(&before)));
+    }
+    let _ = items;
+
+    // ---- Everything else, informational: each panel on its own.
+    let mut h = harness();
+    for p in PanelKind::ALL {
+        if matches!(p, PanelKind::EffectsPresets | PanelKind::RenderQueue) {
+            continue;
+        }
+        h.state_mut().show_panel(p);
+        h.run_steps(3);
+        if DEDICATED.contains(&p) {
+            continue;
+        }
+        let name = format!("{}:default", p.id());
+        let Some(rect) = panel_rect(&h, p) else {
+            // A panel with a baseline entry must be looked at, or its allowance would pass unchecked.
+            assert!(!BASELINE.iter().any(|(k, ..)| *k == name), "{name} has a BASELINE entry but was not drawn");
+            r.rows.push((format!("{name} (not drawn)"), 0, 0, 0));
+            continue;
+        };
+        r.add(&name, audit(&h, &name, rect, None));
+        if p == PanelKind::Preview {
+            // Closed again so it is not counted against the panels after it (see `harness`).
+            h.state_mut().close_panel(PanelKind::Preview);
+            h.run_steps(3);
+        }
+    }
+
+    // ---- The panels with their own scenarios: alone in a window, maximized.
+    let alone = |p: PanelKind| {
+        let mut h = harness();
+        h.state_mut().show_panel(p);
+        h.state_mut().ui.maximized = Some(p);
+        h.run_steps(4);
+        h
+    };
+    // Info: nothing selected, then a layer selected (its Duration, In and Out), and a key.
+    let mut h = alone(PanelKind::Info);
+    h.state_mut().session.execute("layer.select", json!({"layers": []})).ok();
+    h.run_steps(4);
+    let rect = panel_rect(&h, PanelKind::Info).expect("Info is drawn");
+    r.add("Info:default", audit(&h, "Info:default", rect, None));
+    h.state_mut().session.execute("layer.select", json!({"layers": ["#1"]})).ok();
+    h.run_steps(4);
+    r.add("Info:layer", audit(&h, "Info:layer", rect, None));
+
+    // Flowchart: the comp and what it uses, then with layers and effects, then top to bottom.
+    let mut h = alone(PanelKind::Flowchart);
+    let rect = panel_rect(&h, PanelKind::Flowchart).expect("the Flowchart is drawn");
+    r.add("Flowchart:default", audit(&h, "Flowchart:default", rect, None));
+    {
+        let f = &mut h.state_mut().ui.flowchart;
+        f.layers = true;
+        f.effects = true;
+        f.vertical = true;
+    }
+    h.run_steps(4);
+    r.add("Flowchart:layers", audit(&h, "Flowchart:layers", rect, None));
+
+    // Script Console: empty, then with a run in its log.
+    let mut h = alone(PanelKind::ScriptConsole);
+    let rect = panel_rect(&h, PanelKind::ScriptConsole).expect("the Script Console is drawn");
+    r.add("ScriptConsole:default", audit(&h, "ScriptConsole:default", rect, None));
+    h.state_mut().ui.script_console.input = "app.project.numItems".into();
+    {
+        let app = h.state_mut();
+        let con = &mut app.ui.script_console;
+        con.record("app.project.numItems", &Ok(json!({"result": 3})));
+    }
+    h.run_steps(4);
+    r.add("ScriptConsole:log", audit(&h, "ScriptConsole:log", rect, None));
+
+    // 3D Camera Tracker block of Effect Controls (a separate scenario: the block, not the panel).
+    let mut h = harness();
+    h.state_mut().session.execute("effect.apply", json!({"effect": effectcraft_engine::effects::camera_tracker::ID})).ok();
+    h.state_mut().show_panel(PanelKind::EffectControls);
+    h.run_steps(4);
+    let block: Vec<Rect> = h
+        .state()
+        .auto
+        .query("effectControls.cameraTracker.")
+        .into_iter()
+        .map(|e| Rect::from_min_size(pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3])))
+        .collect();
+    if let Some(first) = block.first() {
+        let area = block.iter().fold(*first, |a, b| a.union(*b));
+        let area = Rect::from_min_max(area.min - egui::vec2(8.0, 4.0), area.max + egui::vec2(8.0, 40.0));
+        r.add("CameraTracker:editor", audit(&h, "CameraTracker:editor", area, None));
+    } else {
+        r.rows.push(("CameraTracker:editor (not drawn)".to_string(), 0, 0, 0));
+    }
+    r
+}
+
+#[test]
+fn fixed_panels_have_no_unnamed_or_roleless_controls_and_the_others_do_not_get_worse() {
+    let report = collect();
+    println!("\nAccessibility audit: findings per scenario (unnamed in brackets)");
+    let mut by_group: Vec<(String, usize, usize, usize)> = vec![];
+    for (name, n, unnamed, controls) in &report.rows {
+        println!("  {name:<44} {n:>4} findings ({unnamed} unnamed) of {controls} controls");
+        let g = group(name).to_string();
+        match by_group.iter_mut().find(|(k, ..)| *k == g) {
+            Some(e) => {
+                e.1 += n;
+                e.2 += unnamed;
+                e.3 += controls;
+            }
+            None => by_group.push((g, *n, *unnamed, *controls)),
+        }
+    }
+    println!("\nBy panel (findings, unnamed controls, controls looked at):");
+    for (g, n, unnamed, controls) in &by_group {
+        let state = if FIXED.contains(&g.as_str()) { "fixed: must be 0" } else { "not yet audited" };
+        println!("  {g:<28} {n:>4} findings, {unnamed:>3} unnamed, {controls:>4} controls  {state}");
+    }
+    let total_unnamed: usize = by_group.iter().map(|(_, _, u, _)| u).sum();
+    println!("  all panels: {total_unnamed} unnamed controls\n");
+
+    let mut failures = vec![];
+    for f in &report.findings {
+        if FIXED.contains(&group(&f.scenario)) {
+            failures.push(f.to_string());
+        }
+    }
+    assert!(failures.is_empty(), "{} accessibility findings in the fixed panels:\n{}", failures.len(), failures.join("\n"));
+
+    // A clean panel must not be clean because nothing was looked at.
+    for (name, _, _, controls) in &report.rows {
+        if FIXED.contains(&group(name)) {
+            let min = MIN_CONTROLS.iter().find(|(k, _)| k == name).map_or(2, |(_, v)| *v);
+            assert!(*controls >= min, "{name}: only {controls} controls found in the tree (expected {min}); the scenario is not showing the panel");
+        }
+    }
+
+    // The ratchet: a count above its entry is a regression. A count below it passes, so an
+    // unrelated change (or a machine with fewer files in the Media Browser) never has to edit it;
+    // lower the entry when a pass over a panel improves it.
+    let mut off = vec![];
+    for (name, n, unnamed, _) in &report.rows {
+        if FIXED.contains(&group(name)) {
+            continue;
+        }
+        let (allowed, allowed_unnamed) = BASELINE.iter().find(|(k, ..)| k == name).map_or((0, 0), |(_, v, u)| (*v, *u));
+        if *n > allowed || *unnamed > allowed_unnamed {
+            off.push(format!("{name}: {n} findings ({unnamed} unnamed), the baseline allows {allowed} ({allowed_unnamed}); a panel must not get worse"));
+        }
+    }
+    assert!(off.is_empty(), "{} scenarios do not match BASELINE:\n{}", off.len(), off.join("\n"));
+}
diff --git a/crates/ui-egui/tests/ui_agent_audit.rs b/crates/ui-egui/tests/it/ui_agent_audit.rs
similarity index 97%
rename from crates/ui-egui/tests/ui_agent_audit.rs
rename to crates/ui-egui/tests/it/ui_agent_audit.rs
index a14f77838..c3f556457 100644
--- a/crates/ui-egui/tests/ui_agent_audit.rs
+++ b/crates/ui-egui/tests/it/ui_agent_audit.rs
@@ -29,7 +29,8 @@ fn harness(s: Session) -> Harness<'static, EffectcraftApp> {
 fn send(h: &mut Harness<'_, EffectcraftApp>, method: &str, params: Value) -> Value {
     let ctx = h.ctx.clone();
     let (req, _rx) = ControlRequest::new(method, params);
-    match control::handle(h.state_mut(), &ctx, &req) {
+    let now = h.state().now();
+    match control::handle(h.state_mut(), &ctx, &req, now) {
         Outcome::Done(v) => v,
         _ => panic!("{method}: no immediate reply"),
     }
@@ -70,7 +71,7 @@ fn interactive(ctx: &egui::Context) -> Vec<(Rect, String)> {
                 }
                 let info = w.info(r.id);
                 // Selectable text (labels sense drags to select their text) is not a control.
-                if info.is_some_and(|i| i.typ == egui::WidgetType::Label) {
+                if info.is_some_and(|i| i.role == egui::Role::Label) {
                     continue;
                 }
                 out.push((ir, info.and_then(|i| i.label.clone()).unwrap_or_default()));
diff --git a/crates/ui-egui/tests/it/ui_alt_drag_duplicate.rs b/crates/ui-egui/tests/it/ui_alt_drag_duplicate.rs
new file mode 100644
index 000000000..b7fa93301
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_alt_drag_duplicate.rs
@@ -0,0 +1,154 @@
+//! Alt/Option-drag in the Composition viewer (#2968) duplicates the dragged layers and moves the
+//! copies, copy and move together one undo step. A plain drag still moves the layer itself.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::LayerId;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::panels::viewer::comp_to_screen;
+use egui::{Event, Modifiers, Pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// A 640×360 comp with two solids, A (left) and B (right), both selected.
+fn harness() -> (Harness<'static, EffectcraftApp>, u64, u64) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 640, "height": 360, "duration": 4})).unwrap();
+    let a = s.execute("layer.newSolid", json!({"name": "A", "color": "#e04020", "width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.newSolid", json!({"name": "B", "color": "#2040e0", "width": 100, "height": 100})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": a, "path": "transform/position", "value": [150.0, 180.0]})).unwrap();
+    s.execute("prop.set", json!({"layer": b, "path": "transform/position", "value": [450.0, 180.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [a, b]})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(4);
+    (h, a, b)
+}
+
+fn at(h: &Harness<'_, EffectcraftApp>, comp: [f32; 2]) -> Pos2 {
+    comp_to_screen(&h.ctx, comp).unwrap()
+}
+
+fn zoom(h: &Harness<'_, EffectcraftApp>) -> f32 {
+    (at(h, [100.0, 0.0]).x - at(h, [0.0, 0.0]).x) / 100.0
+}
+
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, modifiers: Modifiers) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.step();
+    h.input_mut().events.push(Event::ModifiersChanged(modifiers));
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers });
+    h.step();
+    for i in 1..=12 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 12.0)));
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers });
+    h.step();
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::default()));
+    h.run_steps(3);
+}
+
+fn pos(h: &Harness<'_, EffectcraftApp>, id: LayerId) -> [f64; 2] {
+    let v = h.state().session.active_comp().unwrap().layer(id).unwrap().props.prop("transform/position").unwrap().value.as_vec2();
+    [v[0], v[1]]
+}
+
+fn count(h: &Harness<'_, EffectcraftApp>) -> usize {
+    h.state().session.active_comp().unwrap().layers.len()
+}
+
+#[test]
+fn alt_drag_duplicates_the_selected_layers_and_moves_the_copies() {
+    let (mut h, a, b) = harness();
+    let undo = h.state().session.history.undo.len();
+    let z = zoom(&h);
+    let from = at(&h, [150.0, 180.0]);
+    drag(&mut h, from, from + vec2(0.0, 60.0) * z, Modifiers::ALT);
+    assert_eq!(count(&h), 4, "both selected layers were copied");
+    assert_eq!(pos(&h, LayerId(a)), [150.0, 180.0], "the originals stay");
+    assert_eq!(pos(&h, LayerId(b)), [450.0, 180.0]);
+    let sel = h.state().session.state.selected_layers.clone();
+    assert_eq!(sel.len(), 2, "the copies are selected");
+    let mut moved: Vec<[f64; 2]> = sel.iter().map(|l| pos(&h, *l)).collect();
+    moved.sort_by(|p, q| p[0].total_cmp(&q[0]));
+    for (got, want) in moved.iter().zip([[150.0, 240.0], [450.0, 240.0]]) {
+        assert!((got[0] - want[0]).abs() < 1.5 && (got[1] - want[1]).abs() < 1.5, "copy at {got:?}, wanted {want:?}");
+    }
+    assert_eq!(h.state().session.history.undo.len(), undo + 1, "copy and drag are one undo step");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(count(&h), 2, "one undo removes the copies");
+    assert_eq!(pos(&h, LayerId(a)), [150.0, 180.0]);
+}
+
+#[test]
+fn a_plain_drag_moves_the_layers_without_copying() {
+    let (mut h, a, _) = harness();
+    let z = zoom(&h);
+    let from = at(&h, [150.0, 180.0]);
+    drag(&mut h, from, from + vec2(0.0, 60.0) * z, Modifiers::NONE);
+    assert_eq!(count(&h), 2);
+    let p = pos(&h, LayerId(a));
+    assert!((p[1] - 240.0).abs() < 1.5, "the layer moved: {p:?}");
+}
+
+/// A second Alt-drag right after the first is its own undo step: its copy doesn't fold into the
+/// first drag's step.
+#[test]
+fn a_second_alt_drag_is_its_own_undo_step() {
+    let (mut h, _, _) = harness();
+    let z = zoom(&h);
+    let from = at(&h, [150.0, 180.0]);
+    drag(&mut h, from, from + vec2(0.0, 60.0) * z, Modifiers::ALT);
+    let undo = h.state().session.history.undo.len();
+    let from = at(&h, [150.0, 240.0]);
+    drag(&mut h, from, from + vec2(0.0, 40.0) * z, Modifiers::ALT);
+    assert_eq!(count(&h), 6);
+    assert_eq!(h.state().session.history.undo.len(), undo + 1);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(count(&h), 4, "one undo removes only the second copies");
+}
+
+/// A selected child under a selected parent follows the parent: its own Position doesn't get the
+/// drag a second time, with or without Alt (the child's copy is parented to the parent's copy).
+#[test]
+fn a_selected_child_keeps_its_place_under_its_dragged_parent() {
+    for modifiers in [Modifiers::NONE, Modifiers::ALT] {
+        let (mut h, a, b) = harness();
+        h.state_mut().session.execute("layer.setParent", json!({"layers": [b], "parent": a})).unwrap();
+        h.state_mut().session.execute("layer.select", json!({"layers": [a, b]})).unwrap();
+        h.run_steps(2);
+        let local = pos(&h, LayerId(b));
+        let z = zoom(&h);
+        let from = at(&h, [150.0, 180.0]);
+        drag(&mut h, from, from + vec2(0.0, 60.0) * z, modifiers);
+        let comp = h.state().session.active_comp().unwrap();
+        let sel = h.state().session.state.selected_layers.clone();
+        let parent = *sel.iter().find(|l| comp.layer(**l).unwrap().parent.is_none()).unwrap();
+        let child = *sel.iter().find(|l| comp.layer(**l).unwrap().parent == Some(parent)).expect("the child follows the moved parent");
+        let p = pos(&h, parent);
+        assert!((p[1] - 240.0).abs() < 1.5, "{modifiers:?}: the parent moved: {p:?}");
+        let c = pos(&h, child);
+        assert!((c[0] - local[0]).abs() < 1e-6 && (c[1] - local[1]).abs() < 1e-6, "{modifiers:?}: child at {c:?}, was {local:?} under its parent");
+    }
+}
+
+/// Alt-dragging a 3D layer's gizmo arrow copies the layer and moves the copy along that axis.
+#[test]
+fn alt_dragging_a_gizmo_arrow_moves_a_copy() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "C", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let solid = s.execute("layer.newSolid", json!({"color": "#ff0000", "width": 200, "height": 200})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layer": solid, "switch": "threeD", "value": true})).unwrap();
+    s.execute("layer.select", json!({"layers": [solid]})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(6);
+    let p0 = pos(&h, LayerId(solid));
+    let [x, y, w, hh] = h.state().auto.find(&format!("viewer.gizmo.{solid}.x")).expect("x arrow registered").rect;
+    let tip = Pos2::new(x + w / 2.0, y + hh / 2.0);
+    drag(&mut h, tip, tip + vec2(40.0, 25.0), Modifiers::ALT);
+    assert_eq!(count(&h), 2, "the layer was copied");
+    assert_eq!(pos(&h, LayerId(solid)), p0, "the original stays");
+    let copy = h.state().session.state.selected_layers[0];
+    assert_ne!(copy, LayerId(solid), "the copy is selected");
+    let p = pos(&h, copy);
+    assert!(p[0] > p0[0] + 10.0 && p[1] == p0[1], "the copy moved along x: {p0:?} -> {p:?}");
+}
diff --git a/crates/ui-egui/tests/ui_angles.rs b/crates/ui-egui/tests/it/ui_angles.rs
similarity index 99%
rename from crates/ui-egui/tests/ui_angles.rs
rename to crates/ui-egui/tests/it/ui_angles.rs
index 007e11286..40ad17bc1 100644
--- a/crates/ui-egui/tests/ui_angles.rs
+++ b/crates/ui-egui/tests/it/ui_angles.rs
@@ -38,7 +38,7 @@ fn harness(panel: Panel, angle: f64) -> (Harness<'static, EffectcraftApp>, u64,
     s.execute("comp.new", json!({"name": "Angles", "width": 320, "height": 180, "duration": 4})).unwrap();
     let layer = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#40b080"})).unwrap()["layer"].as_u64().unwrap();
     let uid = if matches!(panel, Panel::EffectControls) {
-        let fx = s.execute("effect.apply", json!({"layer": layer, "effect": "CC Bend It"})).unwrap()["effects"][0].as_u64().unwrap();
+        let fx = s.execute("effect.apply", json!({"layer": layer, "effect": "Two-Point Bend"})).unwrap()["effects"][0].as_u64().unwrap();
         s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find_group(fx).unwrap().get("bend").unwrap().uid
     } else {
         s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("transform/rotation").unwrap().uid
diff --git a/crates/ui-egui/tests/it/ui_audio_scrub.rs b/crates/ui-egui/tests/it/ui_audio_scrub.rs
new file mode 100644
index 000000000..80936042a
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_audio_scrub.rs
@@ -0,0 +1,741 @@
+//! Audio scrubbing: Ctrl/Cmd-dragging the current time plays one frame of the comp's mix at each
+//! new frame (each snippet replacing what is still queued); holding still repeats nothing; silent
+//! comps open no output; an idle scrub closes it. Previews with audio wait for frames.
+
+use std::sync::{Arc, Mutex};
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::ItemId;
+use effectcraft_engine::time::Tick;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::audio::{AudioDevice, AudioFeed};
+use effectcraft_ui_egui::frames::{RemoteDone, RemoteFrame, RemoteFrames, RemoteJob};
+use egui::{Event, Modifiers, pos2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// An output that records the feed it is given and whether it was stopped.
+#[derive(Clone, Default)]
+struct Fake(Arc<Mutex<(Option<Arc<AudioFeed>>, bool)>>);
+
+impl AudioDevice for Fake {
+    fn sample_rate(&self) -> u32 {
+        48000
+    }
+    fn start(&mut self, feed: Arc<AudioFeed>) -> Result<(), String> {
+        self.0.lock().unwrap().0 = Some(feed);
+        Ok(())
+    }
+    fn stop(&mut self) {
+        self.0.lock().unwrap().1 = true;
+    }
+}
+
+/// A frame renderer whose frames the test releases explicitly. Playback then runs against a
+/// controlled clock and controlled cache contents instead of racing however many frame workers
+/// the host has; a frame that is not released is queued again by the next playback step.
+#[derive(Clone, Default)]
+struct GatedFrames {
+    pending: Arc<Mutex<Vec<(i64, u32, u32, RemoteDone)>>>,
+}
+
+impl RemoteFrames for GatedFrames {
+    fn slots(&self) -> usize {
+        1024
+    }
+
+    fn start(&self, job: RemoteJob, done: RemoteDone) {
+        let (frame, width, height) = job.project.comp(job.comp).map_or((-1, 1, 1), |c| {
+            let scale = job.opts.scale.max(0.001);
+            let width = (c.width as f64 * scale).round().clamp(1.0, 16_384.0) as u32;
+            let height = (c.height as f64 * scale).round().clamp(1.0, 16_384.0) as u32;
+            (c.frame_rate.frame_at(job.t), width, height)
+        });
+        self.pending.lock().unwrap().push((frame, width, height, done));
+    }
+}
+
+impl GatedFrames {
+    /// Put `frames` in the cache, dropping every other queued frame (playback asks again).
+    fn render(&self, h: &mut Harness<'_, EffectcraftApp>, cid: ItemId, frames: &[i64]) {
+        let scale = h.state().shown_series(cid).scale as f64 / 1000.0;
+        for &f in frames {
+            h.state().request_frame(cid, f, scale);
+        }
+        while h.state().frames.dispatch_remote() != 0 {}
+        let pending = std::mem::take(&mut *self.pending.lock().unwrap());
+        for (frame, width, height, done) in pending {
+            if frames.contains(&frame) {
+                let rgba = vec![0; (width as usize).saturating_mul(height as usize).saturating_mul(4)];
+                done(Ok(RemoteFrame { width, height, rgba, ms: 1.0 }));
+            } else {
+                done(Err("held back by the test renderer".into()));
+            }
+        }
+    }
+
+    /// Drop everything queued without caching it (the warm-up passes request viewer frames).
+    fn discard(&self, h: &mut Harness<'_, EffectcraftApp>) {
+        while h.state().frames.dispatch_remote() != 0 {}
+        for (_, _, _, done) in std::mem::take(&mut *self.pending.lock().unwrap()) {
+            done(Err("held back by the test renderer".into()));
+        }
+    }
+}
+
+/// A 2 s, 30 fps comp whose solid sounds a tone (Audio switch on).
+fn setup(audible: bool, fake: &Fake) -> (EffectcraftApp, ItemId) {
+    setup_long(audible, fake, 2.0)
+}
+
+/// A `duration`-second, 30 fps comp whose solid sounds a tone (Audio switch on).
+fn setup_long(audible: bool, fake: &Fake, duration: f64) -> (EffectcraftApp, ItemId) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": duration})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
+    if audible {
+        s.execute("effect.apply", json!({"layers": [l], "effect": "ec.audio.tone"})).unwrap();
+        s.execute("layer.setSwitch", json!({"layers": [l], "switch": "audio", "value": true})).unwrap();
+    }
+    let mut app = EffectcraftApp::new(s);
+    let f = fake.clone();
+    app.hooks.audio_device = Some(Box::new(move |_| Some(Box::new(f.clone()) as Box<dyn AudioDevice>)));
+    (app, cid)
+}
+
+#[test]
+fn scrubbing_plays_one_frame_per_new_frame() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup(true, &fake);
+    let t = |s: f64| Tick::from_seconds_f64(s);
+    app.scrub_audio(cid, t(0.5), 0.0);
+    let feed = fake.0.lock().unwrap().0.clone().expect("the output opened");
+    // One 30 fps frame at 48 kHz, and not silence.
+    assert_eq!(feed.queued_frames(), 1600);
+    let mut out = vec![0.0f32; 3200];
+    feed.pull(&mut out);
+    assert!(out.iter().any(|v| v.abs() > 0.01), "the tone is there");
+    // Faded in: the first sample is silent.
+    assert_eq!(out[0], 0.0);
+    // The same frame again plays nothing; the next frame replaces what is left.
+    app.scrub_audio(cid, t(0.51), 0.1);
+    assert_eq!(feed.queued_frames(), 0);
+    feed.push(&[0.0; 1000]);
+    app.scrub_audio(cid, t(0.6), 0.2);
+    assert_eq!(feed.queued_frames(), 1600, "replaced, not piled up");
+    // A silent comp opens nothing.
+    let silent = Fake::default();
+    let (mut quiet, qid) = setup(false, &silent);
+    quiet.scrub_audio(qid, t(0.5), 0.0);
+    assert!(silent.0.lock().unwrap().0.is_none() && quiet.scrub.is_none());
+}
+
+#[test]
+fn cmd_dragging_the_current_time_scrubs_and_an_idle_scrub_closes() {
+    let fake = Fake::default();
+    let (app, _) = setup(true, &fake);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| app);
+    h.run_steps(3);
+    let cti = h.state().auto.find("timeline.cti").expect("current time indicator").clone();
+    let from = pos2(cti.rect[0] + cti.rect[2] / 2.0, cti.rect[1] + cti.rect[3] / 2.0);
+    let cmd = Modifiers::COMMAND;
+    h.event(Event::ModifiersChanged(cmd));
+    h.event(Event::PointerMoved(from));
+    h.step();
+    h.event(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: cmd });
+    h.step();
+    for k in 1..=4 {
+        h.event(Event::PointerMoved(from + egui::vec2(40.0 * k as f32, 0.0)));
+        h.step();
+    }
+    assert!(h.state().scrub.is_some(), "Cmd-drag opened the scrub output");
+    assert!(fake.0.lock().unwrap().0.as_ref().is_some_and(|f| f.queued_frames() > 0));
+    h.event(Event::PointerButton { pos: from + egui::vec2(160.0, 0.0), button: egui::PointerButton::Primary, pressed: false, modifiers: cmd });
+    h.step();
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+    // An idle second closes the output.
+    for _ in 0..90 {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(15));
+        if h.state().scrub.is_none() {
+            break;
+        }
+    }
+    assert!(h.state().scrub.is_none() && fake.0.lock().unwrap().1, "closed and stopped");
+}
+
+/// The comp's frame at the current time.
+fn frame(h: &Harness<'_, EffectcraftApp>, cid: ItemId) -> i64 {
+    let app = h.state();
+    app.session.project.comp(cid).unwrap().frame_rate.frame_at(app.session.time())
+}
+
+/// The frame under the preview audio's first sample (its clock before the device pulls any).
+fn audio_frame(h: &Harness<'_, EffectcraftApp>, cid: ItemId) -> Option<i64> {
+    let app = h.state();
+    let a = app.audio.as_ref()?;
+    Some(effectcraft_ui_egui::audio::frame_of_sample(a.clock(), a.rate, app.session.project.comp(cid).unwrap().frame_rate))
+}
+
+/// Step until the preview's sound starts (or 60 s pass, for a loaded machine), checking the
+/// playhead holds `first` meanwhile. Returns whether the sound started.
+fn until_sound(h: &mut Harness<'_, EffectcraftApp>, cid: ItemId, first: i64) -> bool {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while std::time::Instant::now() < deadline {
+        step(h);
+        if h.state().audio.is_some() {
+            return true;
+        }
+        assert_eq!(frame(h, cid), first, "the playhead holds the first frame until the sound can start");
+        assert!(h.state().playback.starting && h.state().playback.playing);
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    false
+}
+
+/// One step with the app clock, which playback runs on, a step (1/30 s) further on: these tests
+/// count time in steps, however long a step takes on a loaded machine.
+fn step(h: &mut Harness<'_, EffectcraftApp>) {
+    h.state_mut().clock_mut().advance(1.0 / 30.0);
+    h.step();
+}
+
+/// Starting a preview with sound before its frames are cached (#947): the playhead holds the
+/// first frame while the frames ahead render, then sound and picture start together from it (the
+/// sound used to start at a later frame, losing the opening). A frame that isn't cached later on
+/// no longer stops the sound (#2473).
+#[test]
+fn preview_with_audio_holds_the_first_frame_and_sounds_from_it() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup(true, &fake);
+    // Release only the frames this test chooses, and drive the app clock: rendering cannot race
+    // the clock on a slow or loaded test host.
+    let gate = GatedFrames::default();
+    let renderer: Arc<dyn RemoteFrames> = Arc::new(gate.clone());
+    app.frames.set_remote(Some(renderer));
+    let ahead = (app.frames.parallelism() * 2).max(4) as i64;
+    app.session.execute("comp.settings", json!({"comp": cid.0, "duration": (4 * ahead) as f64 / 30.0})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    gate.discard(&mut h);
+    let now = h.state().now();
+    h.state_mut().play(now);
+    assert!(h.state().playback.starting && h.state().audio.is_none(), "nothing is cached: no sound yet");
+    // Half the frames ahead cached: the playhead holds the first frame, silently.
+    let half: Vec<i64> = (0..ahead / 2).collect();
+    gate.render(&mut h, cid, &half);
+    step(&mut h);
+    assert!(h.state().playback.starting && h.state().audio.is_none(), "{} of {ahead} frames ahead cached: no sound yet", half.len());
+    assert_eq!(frame(&h, cid), 0, "the playhead holds the first frame");
+    // All of them: the sound starts, from that frame.
+    let all: Vec<i64> = (0..ahead).collect();
+    gate.render(&mut h, cid, &all);
+    step(&mut h);
+    assert!(h.state().audio.is_some() && fake.0.lock().unwrap().0.is_some(), "the sound started once the frames ahead were cached");
+    assert_eq!(audio_frame(&h, cid), Some(0), "from the first frame, not a later one");
+    assert!(!h.state().playback.starting);
+    // A frame that isn't cached keeps the sound playing; the picture waits for frames (#2473).
+    gate.discard(&mut h);
+    h.state().frames.clear();
+    h.step();
+    assert!(h.state().audio.is_some() && !h.state().playback.audio_held && h.state().playback.playing, "the sound plays on");
+    assert!(h.state().playback.waiting, "the picture waits for its frame");
+}
+
+/// A long (30 s) preview sounds once the frames ahead of its first frame are cached, not the
+/// whole work area (#208), and from that first frame (#947).
+#[test]
+fn preview_with_audio_sounds_without_caching_the_work_area() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup_long(true, &fake, 30.0);
+    let gate = GatedFrames::default();
+    let renderer: Arc<dyn RemoteFrames> = Arc::new(gate.clone());
+    app.frames.set_remote(Some(renderer));
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    gate.discard(&mut h);
+    let ahead = (h.state().frames.parallelism() * 2).max(4) as i64;
+    let now = h.state().now();
+    h.state_mut().play(now);
+    let frames: Vec<i64> = (0..ahead).collect();
+    gate.render(&mut h, cid, &frames);
+    step(&mut h);
+    assert!(h.state().audio.is_some(), "the sound started");
+    assert_eq!(audio_frame(&h, cid), Some(0), "from the first frame");
+    let cached = h.state().frames.cached_frames(&h.state().shown_series(cid)).len();
+    assert!((1..900).contains(&cached), "it started with {cached} of the 900 frames cached, not the whole work area");
+}
+
+/// A preview whose rendering falls behind its sound keeps the sound playing (#2473, #3260): the
+/// picture shows the latest frame rendered up to the sound, dropping the others, and frames are
+/// rendered ahead of the sound rather than of the picture. Stopping the sound at every frame that
+/// wasn't cached chopped it into bursts.
+#[test]
+fn a_preview_behind_its_sound_drops_frames_and_keeps_the_sound() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup_long(true, &fake, 30.0);
+    let gate = GatedFrames::default();
+    let renderer: Arc<dyn RemoteFrames> = Arc::new(gate.clone());
+    app.frames.set_remote(Some(renderer));
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    gate.discard(&mut h);
+    let ahead = (h.state().frames.parallelism() * 2).max(4) as i64;
+    let now = h.state().now();
+    h.state_mut().play(now);
+    gate.render(&mut h, cid, &(0..ahead).collect::<Vec<_>>());
+    step(&mut h);
+    assert!(h.state().audio.is_some(), "the sound started");
+    let feed = fake.0.lock().unwrap().0.clone().expect("the output has the preview's feed");
+
+    // Frames 0..ahead and `behind` are cached; the sound plays on to `sound`, which isn't.
+    let (behind, sound) = (ahead + 2, ahead + 4);
+    gate.render(&mut h, cid, &[behind]);
+    // 48 kHz at 30 fps: 1600 samples a frame. Halfway into `sound`.
+    let samples = sound as u64 * 1600 + 800;
+    for _ in 0..10_000 {
+        if feed.consumed() >= samples {
+            break;
+        }
+        pull(&feed, (samples - feed.consumed()).min(1600) as usize);
+    }
+    assert!(feed.consumed() >= samples, "the device took the sound up to frame {sound}");
+    step(&mut h);
+    assert!(h.state().audio.is_some() && !h.state().playback.audio_held, "the sound plays on");
+    assert_eq!(frame(&h, cid), behind, "the picture shows the latest frame rendered up to the sound");
+    assert!(h.state().playback.waiting);
+    while h.state().frames.dispatch_remote() != 0 {}
+    let requested: Vec<i64> = gate.pending.lock().unwrap().iter().map(|p| p.0).collect();
+    assert!(requested.contains(&sound), "frames are rendered from the sound's frame on: {requested:?}");
+    assert!(!requested.contains(&ahead), "not the frames the picture dropped: {requested:?}");
+
+    // The sound's frame renders: the picture catches up with it.
+    gate.render(&mut h, cid, &[sound]);
+    step(&mut h);
+    assert_eq!(frame(&h, cid), sound, "the picture is back on the sound's frame");
+    assert!(!h.state().playback.waiting && h.state().audio.is_some());
+}
+
+/// Pull `frames` stereo frames from the output, waiting for the feeder thread to mix them.
+fn pull(feed: &AudioFeed, frames: usize) -> Vec<f32> {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
+    while feed.queued_frames() < frames && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let mut out = vec![0.0f32; frames * 2];
+    feed.pull(&mut out);
+    out
+}
+
+/// The opening of the preview is heard (#947): a sound that lasts only the first 100 ms after the
+/// start, from the beginning of the comp or from the middle, reaches the output device.
+#[test]
+fn a_sound_in_the_first_100_ms_is_heard() {
+    for start in [0.0, 1.0] {
+        let fake = Fake::default();
+        let (mut app, cid) = setup_long(false, &fake, 4.0);
+        // A tone only from `start` to `start` + 0.1 s.
+        let l = app.session.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
+        app.session.execute("effect.apply", json!({"layers": [l], "effect": "ec.audio.tone"})).unwrap();
+        app.session.execute("layer.setSwitch", json!({"layers": [l], "switch": "audio", "value": true})).unwrap();
+        app.session.execute("layer.timing", json!({"layers": [l], "in": start, "out": start + 0.1})).unwrap();
+        app.session.execute("time.set", json!({"time": start})).unwrap();
+        let first = (start * 30.0) as i64;
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+        h.state_mut().use_manual_clock();
+        h.run_steps(2);
+        let now = h.state().now();
+        h.state_mut().play(now);
+        assert!(until_sound(&mut h, cid, first), "{start}: the sound started");
+        assert_eq!(audio_frame(&h, cid), Some(first), "{start}: from the first frame");
+        let feed = fake.0.lock().unwrap().0.clone().expect("the output opened");
+        // The first 100 ms at 48 kHz.
+        let out = pull(&feed, 4800);
+        assert!(out.iter().any(|v| v.abs() > 0.01), "{start}: the opening tone reached the output");
+    }
+}
+
+/// A preview without video starts its sound at once, from the first frame (unchanged), and so
+/// does one whose frames are already cached.
+#[test]
+fn audio_only_previews_start_at_once() {
+    let fake = Fake::default();
+    let (app, cid) = setup(true, &fake);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    let now = h.state().now();
+    h.state_mut().play_with(now, effectcraft_engine::preview::PreviewShortcut::AltNumpad0);
+    assert!(h.state().audio.is_some() && !h.state().playback.starting, "Video off: the sound starts at once");
+    assert_eq!(audio_frame(&h, cid), Some(0));
+}
+
+/// Without an output device the preview still plays, from the first frame, once the frames ahead
+/// are cached; Stop while it prepares leaves nothing playing.
+#[test]
+fn no_device_plays_the_picture_and_stop_ends_the_wait() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup_long(true, &fake, 10.0);
+    app.hooks.audio_device = Some(Box::new(|_| None));
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    let now = h.state().now();
+    h.state_mut().play(now);
+    assert!(h.state().playback.starting);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while h.state().playback.starting && std::time::Instant::now() < deadline {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    assert!(!h.state().playback.starting && h.state().audio.is_none() && h.state().playback.playing, "no device: the picture plays alone");
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    while frame(&h, cid) == 0 && std::time::Instant::now() < deadline {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(frame(&h, cid) > 0, "from the first frame on");
+    // Stop while preparing.
+    h.state_mut().stop();
+    let now = h.state().now();
+    let device = fake.clone();
+    h.state_mut().hooks.audio_device = Some(Box::new(move |_| Some(Box::new(device.clone()) as Box<dyn AudioDevice>)));
+    h.state().frames.clear();
+    h.state_mut().play(now);
+    // One step into preparing: the frames ahead are requested and it waits for them.
+    step(&mut h);
+    assert!(h.state().playback.starting && h.state().playback.waiting && h.state().audio.is_none(), "preparing");
+    h.state_mut().stop();
+    // The renders it queued finish after Stop: they must not start the sound.
+    for _ in 0..30 {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(!h.state().playback.playing && !h.state().playback.starting && h.state().audio.is_none(), "Stop while preparing: nothing plays");
+    assert!(fake.0.lock().unwrap().0.is_none(), "the output never opened");
+}
+
+/// Start a preview and step until it leaves its startup (or 60 s pass). Returns whether it did.
+fn until_started(h: &mut Harness<'_, EffectcraftApp>) -> bool {
+    let now = h.state().now();
+    h.state_mut().play(now);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while h.state().playback.starting && std::time::Instant::now() < deadline {
+        step(h);
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    !h.state().playback.starting
+}
+
+/// RAM preview budgets just below, at and above the prefetch's frames ahead, and small ones, from
+/// a cold cache, with and without an output device: the start never waits for a frame the
+/// prefetch doesn't request (with a budget of 4 frames it asks for 3 ahead of the playhead).
+#[test]
+fn startup_finishes_at_any_ram_preview_budget() {
+    let probe = Fake::default();
+    let (app, _) = setup(true, &probe);
+    let ahead = (app.frames.parallelism() * 2).max(4) as i64;
+    // A 64×36 frame is 9216 bytes; `fit` frames fit in (fit + ½) frames' worth / 0.9.
+    let mut fits = vec![2, 3, 4, ahead - 1, ahead, ahead + 1];
+    fits.sort();
+    fits.dedup();
+    for fit in fits {
+        for device in [true, false] {
+            let fake = Fake::default();
+            let (mut app, cid) = setup_long(true, &fake, 8.0);
+            if !device {
+                app.hooks.audio_device = Some(Box::new(|_| None));
+            }
+            let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+            h.state_mut().use_manual_clock();
+            h.run_steps(2);
+            let budget = ((fit as f64 + 0.5) * 9216.0 / 0.9) as usize;
+            h.state().frames.set_budget(budget);
+            h.state().frames.clear();
+            assert!(until_started(&mut h), "fit {fit} (ahead {ahead}), device {device}: the preview left its startup");
+            assert_eq!(h.state().audio.is_some(), device, "fit {fit}, device {device}");
+            if device {
+                assert_eq!(audio_frame(&h, cid), Some(0), "fit {fit}: from the first frame");
+            }
+        }
+    }
+}
+
+/// An audible 160×120 comp with a 3D layer and Draft 3D, Extended Viewer on: its viewer frames
+/// render the pasteboard too, larger than the comp. Returns the harness once the first frame has
+/// rendered, the comp, and that frame's size.
+fn extended_viewer(fake: &Fake) -> (Harness<'static, EffectcraftApp>, ItemId, [usize; 2]) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "E", "width": 160, "height": 120, "frameRate": 30, "duration": 8})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#4060a0"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layers": [l], "effect": "ec.audio.tone"})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "audio", "value": true})).unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "threeD", "value": true})).unwrap();
+    s.execute("comp.setSwitch", json!({"switch": "draft3d", "value": true})).unwrap();
+    s.prefs.three_d.extended_viewer = true;
+    let mut app = EffectcraftApp::new(s);
+    let f = fake.clone();
+    app.hooks.audio_device = Some(Box::new(move |_| Some(Box::new(f.clone()) as Box<dyn AudioDevice>)));
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    // The viewer shows the pasteboard: frames render the extended region.
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    let size = loop {
+        step(&mut h);
+        let series = h.state().shown_series(cid);
+        if let Some(img) = h.state().frames.get(&series) {
+            break img.size();
+        }
+        assert!(std::time::Instant::now() < deadline, "the first frame rendered");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    };
+    assert!(h.state().ui.viewer.extended.is_some(), "Extended Viewer is on");
+    (h, cid, size)
+}
+
+/// Extended Viewer frames render larger than the comp: a budget that would hold `ahead` comp-sized
+/// frames holds fewer of them, and the start waits only for as many as really fit (#947).
+#[test]
+fn startup_finishes_when_extended_viewer_frames_are_larger() {
+    let fake = Fake::default();
+    let (mut h, cid, size) = extended_viewer(&fake);
+    let ahead = (h.state().frames.parallelism() * 2).max(4);
+    let (comp_bytes, real_bytes) = (160 * 120 * 4, size[0] * size[1] * 4);
+    // Room for `ahead` comp-sized frames (and a half), which is fewer real ones.
+    let budget = ((ahead as f64 + 0.5) * comp_bytes as f64 / 0.9) as usize;
+    assert!((budget as f64 * 0.9 / real_bytes as f64) < ahead as f64, "real frames ({size:?}) fit fewer than {ahead}");
+    h.state().frames.set_budget(budget);
+    h.state().frames.clear();
+    let now = h.state().now();
+    h.state_mut().play(now);
+    step(&mut h);
+    // The first frame renders before the harness clock moves on: each step is 1/30 s however long
+    // it takes, so on a busy machine the first frame could take longer than STARTUP_LIMIT of that
+    // clock, and this test is about the wait for the frames ahead.
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while !h.state().frames.is_cached(&h.state().shown_series(cid)) && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    while h.state().playback.starting && std::time::Instant::now() < deadline {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    assert!(!h.state().playback.starting, "the preview left its startup");
+    assert!(h.state().audio.is_some(), "with its sound");
+    assert_eq!(audio_frame(&h, cid), Some(0), "from the first frame");
+    let (started, stopped) = {
+        let d = fake.0.lock().unwrap();
+        (d.0.is_some(), d.1)
+    };
+    assert!(started && !stopped, "the device started and kept playing");
+}
+
+/// A first frame that takes longer than STARTUP_WAIT to be cached (a heavy comp, a busy machine;
+/// here it can't be cached until the RAM preview grows): the start keeps holding it, then the
+/// sound starts from it and keeps playing. It used to give up two seconds after Play, start the
+/// sound on the uncached frame and stop it at once, so the opening played silently.
+#[test]
+fn a_slow_first_frame_keeps_its_opening_sound() {
+    let fake = Fake::default();
+    let (mut h, cid, size) = extended_viewer(&fake);
+    let (comp_bytes, real_bytes) = (160 * 120 * 4, size[0] * size[1] * 4);
+    assert!(real_bytes > comp_bytes * 2, "Extended Viewer frames ({size:?}) are larger than the comp");
+    h.state().frames.set_budget((comp_bytes + real_bytes) / 2);
+    h.state().frames.clear();
+    let start = h.state().now();
+    h.state_mut().play(start);
+    while h.state().now() - start < 3.0 {
+        step(&mut h);
+        assert!(h.state().playback.starting, "it still holds the first frame");
+        assert_eq!(frame(&h, cid), 0);
+    }
+    assert!(fake.0.lock().unwrap().0.is_none(), "no sound yet");
+    h.state().frames.set_budget(1 << 30);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while h.state().playback.starting && std::time::Instant::now() < deadline {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    assert!(!h.state().playback.starting, "the preview left its startup");
+    assert_eq!(audio_frame(&h, cid), Some(0), "with its sound from the first frame");
+    let (started, stopped) = {
+        let d = fake.0.lock().unwrap();
+        (d.0.is_some(), d.1)
+    };
+    assert!(started && !stopped, "the device started and kept playing");
+}
+
+/// An output device whose start fails.
+#[derive(Clone, Default)]
+struct Broken;
+
+impl AudioDevice for Broken {
+    fn sample_rate(&self) -> u32 {
+        48000
+    }
+    fn start(&mut self, _feed: Arc<AudioFeed>) -> Result<(), String> {
+        Err("device unavailable".into())
+    }
+    fn stop(&mut self) {}
+}
+
+/// A device that fails to start: the picture plays on its own from the first frame.
+#[test]
+fn a_device_that_fails_to_start_plays_the_picture() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup_long(true, &fake, 8.0);
+    app.hooks.audio_device = Some(Box::new(|_| Some(Box::new(Broken) as Box<dyn AudioDevice>)));
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    assert!(until_started(&mut h), "it left its startup");
+    assert!(h.state().audio.is_none() && h.state().playback.playing);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    while frame(&h, cid) == 0 && std::time::Instant::now() < deadline {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(frame(&h, cid) > 0, "the picture plays");
+}
+
+/// An output that plays: a thread takes the feed's samples in real time, as a sound card would.
+/// It holds off pulling until `.1` is set, so a test can read the clock before any sample is
+/// taken however loaded the machine is (the thread otherwise races the test's first check).
+#[derive(Clone, Default)]
+struct Playing(Arc<Mutex<bool>>, Arc<std::sync::atomic::AtomicBool>);
+
+impl AudioDevice for Playing {
+    fn sample_rate(&self) -> u32 {
+        48000
+    }
+    fn start(&mut self, feed: Arc<AudioFeed>) -> Result<(), String> {
+        let stop = self.0.clone();
+        let go = self.1.clone();
+        std::thread::spawn(move || {
+            let mut buf = vec![0.0f32; 480 * 2];
+            while !*stop.lock().unwrap() {
+                if !go.load(std::sync::atomic::Ordering::Acquire) {
+                    std::thread::sleep(std::time::Duration::from_millis(1));
+                    continue;
+                }
+                feed.pull(&mut buf);
+                std::thread::sleep(std::time::Duration::from_millis(10));
+            }
+        });
+        Ok(())
+    }
+    fn stop(&mut self) {
+        *self.0.lock().unwrap() = true;
+    }
+}
+
+/// Once started, the sound's clock moves the picture on from the first frame, and a frame that
+/// isn't cached doesn't stop the sound (#2473).
+#[test]
+fn a_started_preview_follows_its_sound() {
+    let fake = Fake::default();
+    let (mut app, cid) = setup_long(true, &fake, 8.0);
+    let device = Playing::default();
+    let d = device.clone();
+    app.hooks.audio_device = Some(Box::new(move |_| Some(Box::new(d.clone()) as Box<dyn AudioDevice>)));
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+    h.state_mut().use_manual_clock();
+    h.run_steps(2);
+    assert!(until_started(&mut h) && h.state().audio.is_some(), "the sound started");
+    assert_eq!(audio_frame(&h, cid), Some(0), "from the first frame");
+    device.1.store(true, std::sync::atomic::Ordering::Release);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    while frame(&h, cid) < 5 && std::time::Instant::now() < deadline && h.state().audio.is_some() {
+        step(&mut h);
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(frame(&h, cid) >= 5, "the picture follows the sound's clock (at frame {})", frame(&h, cid));
+    h.state().frames.set_budget(0);
+    h.state().frames.clear();
+    step(&mut h);
+    assert!(h.state().audio.is_some() && !h.state().playback.audio_held && h.state().playback.playing, "a stall doesn't stop the sound");
+    *device.0.lock().unwrap() = true;
+}
+
+/// A RAM preview that can't hold even one frame (none, or half of one): the start doesn't wait
+/// for frames that can never be cached. The sound isn't started on a frame that can't be shown
+/// (a stall would stop it at once): the preview goes on as a stalled one does.
+#[test]
+fn startup_does_not_wait_when_the_ram_preview_holds_no_frame() {
+    for budget in [0, 9216 / 2] {
+        let fake = Fake::default();
+        let (app, _) = setup_long(true, &fake, 8.0);
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
+        h.state_mut().use_manual_clock();
+        h.run_steps(2);
+        h.state().frames.set_budget(budget);
+        h.state().frames.clear();
+        let now = h.state().now();
+        h.state_mut().play(now);
+        step(&mut h);
+        assert!(!h.state().playback.starting, "budget {budget}: no wait");
+        assert!(fake.0.lock().unwrap().0.is_none(), "budget {budget}: no sound started and dropped");
+        assert!(h.state().playback.playing && h.state().playback.audio_held, "budget {budget}: it goes on as a stalled preview");
+    }
+}
+
+/// A frame that never gets cached although the estimate says one fits (an Extended Viewer frame
+/// larger than the whole budget): the start gives up after STARTUP_LIMIT instead of holding the
+/// first frame for ever, without starting the sound on a frame it can't show.
+#[test]
+fn startup_gives_up_on_a_first_frame_that_never_caches() {
+    let fake = Fake::default();
+    let (mut h, cid, size) = extended_viewer(&fake);
+    let (comp_bytes, real_bytes) = (160 * 120 * 4, size[0] * size[1] * 4);
+    assert!(real_bytes > comp_bytes * 2, "Extended Viewer frames ({size:?}) are larger than the comp");
+    // Room for a comp-sized frame but not a real one: the current frame can never be cached.
+    let budget = (comp_bytes + real_bytes) / 2;
+    h.state().frames.set_budget(budget);
+    h.state().frames.clear();
+    let start = h.state().now();
+    h.state_mut().play(start);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while h.state().playback.starting && std::time::Instant::now() < deadline {
+        assert_eq!(frame(&h, cid), 0, "it holds the first frame while it waits");
+        step(&mut h);
+    }
+    let waited = h.state().now() - start;
+    assert!(!h.state().playback.starting, "it gave up waiting");
+    assert!((9.9..12.0).contains(&waited), "after about ten seconds ({waited:.2} s)");
+    assert!(fake.0.lock().unwrap().0.is_none(), "no sound started and dropped");
+    assert!(h.state().playback.playing && h.state().playback.audio_held, "it goes on as a stalled preview");
+}
+
+/// Adding markers while a preview sounds (Num*, one per beat) keeps the sound going (#1083): a
+/// marker changes no pixels, so no cached frame is dropped and no frame has to be rendered again
+/// (which would stop the sound until the frames ahead are cached).
+#[test]
+fn adding_markers_does_not_stop_the_sound() {
+    let fake = Fake::default();
+    let (app, cid) = setup(true, &fake);
+    // Everything is cached before the preview starts, so the sound starts at once.
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 31.0).build_eframe(|_| app);
+    h.run_steps(2);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    let now = h.ctx.input(|i| i.time);
+    h.state_mut().play(now);
+    while h.state().audio.is_none() && std::time::Instant::now() < deadline {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    assert!(h.state().audio.is_some(), "the sound started");
+    for beat in 0..6 {
+        let t = 0.1 + 0.05 * beat as f64;
+        h.state_mut().session.execute("comp.addMarker", json!({"comp": cid.0, "time": t, "comment": "beat"})).unwrap();
+        h.step();
+        let app = h.state();
+        assert!(app.playback.playing && app.audio.is_some() && !app.playback.audio_held, "marker {beat}: still playing with sound");
+    }
+    assert_eq!(h.state().session.project.comp(cid).unwrap().markers.len(), 6);
+}
diff --git a/crates/ui-egui/tests/ui_azerty_shortcuts.rs b/crates/ui-egui/tests/it/ui_azerty_shortcuts.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_azerty_shortcuts.rs
rename to crates/ui-egui/tests/it/ui_azerty_shortcuts.rs
diff --git a/crates/ui-egui/tests/it/ui_batch_links.rs b/crates/ui-egui/tests/it/ui_batch_links.rs
new file mode 100644
index 000000000..5b2cea090
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_batch_links.rs
@@ -0,0 +1,209 @@
+//! Parent and Track Matte for several layers at once (#1260): on a selected layer's row, the
+//! Timeline's Parent and Track Matte menus and pick whips set every selected layer; on an
+//! unselected row, that layer alone. One undo step each; each layer keeps its own matte mode.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{LayerId, MatteKind};
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Modifiers, PointerButton, Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable as _;
+use serde_json::json;
+
+/// Solids A, B, C, P (moved and scaled, a parent) and the mattes X and Y; stacked Y, X, P, C, B, A
+/// from the top. The Track Matte column is shown.
+fn harness() -> (Harness<'static, EffectcraftApp>, [u64; 6]) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Links", "width": 320, "height": 180, "duration": 4})).unwrap();
+    let ids = ["A", "B", "C", "P", "X", "Y"]
+        .map(|n| s.execute("layer.newSolid", json!({"name": n, "color": "#406080", "width": 40, "height": 40})).unwrap()["layer"].as_u64().unwrap());
+    s.execute("prop.set", json!({"layer": ids[3], "path": "transform/position", "value": [60, 40]})).unwrap();
+    s.execute("prop.set", json!({"layer": ids[3], "path": "transform/scale", "value": [50, 50]})).unwrap();
+    s.history.undo.clear();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().ui.timeline.show_modes = true;
+    h.state_mut().ui.timeline.columns_w = 900.0;
+    h.run_steps(3);
+    (h, ids)
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+fn press(h: &mut Harness<'_, EffectcraftApp>, at: Pos2, pressed: bool) {
+    h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, at: Pos2) {
+    h.event(Event::PointerMoved(at));
+    h.step();
+    press(h, at, true);
+    h.step();
+    press(h, at, false);
+    h.run_steps(3);
+}
+
+/// Open the menu at automation id `dropdown` and choose `item` in it.
+fn choose(h: &mut Harness<'_, EffectcraftApp>, dropdown: &str, item: &str) {
+    let menu = rect(h, dropdown);
+    // Other rows' menus show their choice as well ("No Track Matte"): the entry is a node the
+    // opened menu added.
+    let shown: Vec<Rect> = h.query_all_by_label(item).map(|n| n.rect()).collect();
+    click(h, menu.center());
+    // (The menu may open above it to fit the window: the entry nearest to it.)
+    let off = |r: &Rect| (r.center().y - menu.center().y).abs();
+    let at = h.query_all_by_label(item).map(|n| n.rect()).filter(|r| !shown.contains(r)).min_by(|a, b| off(a).total_cmp(&off(b)));
+    let at = at.unwrap_or_else(|| panic!("no {item} in the {dropdown} menu")).center();
+    click(h, at);
+}
+
+/// Drag the pick whip `whip` onto layer `onto`'s row.
+fn whip(h: &mut Harness<'_, EffectcraftApp>, whip: &str, onto: u64) {
+    let (from, to) = (rect(h, whip).center(), rect(h, &format!("timeline.layer.{onto}.row")).center());
+    h.event(Event::PointerMoved(from));
+    h.step();
+    press(h, from, true);
+    h.step();
+    for i in 1..=10 {
+        h.event(Event::PointerMoved(from + (to - from) * (i as f32 / 10.0)));
+        h.step();
+    }
+    press(h, to, false);
+    h.run_steps(3);
+}
+
+fn select(h: &mut Harness<'_, EffectcraftApp>, ids: &[u64]) {
+    h.state_mut().session.execute("layer.select", json!({"layers": ids})).unwrap();
+    h.run_steps(2);
+}
+
+fn parent(h: &Harness<'_, EffectcraftApp>, id: u64) -> Option<u64> {
+    h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().parent.map(|p| p.0)
+}
+
+fn position(h: &Harness<'_, EffectcraftApp>, id: u64) -> [f64; 3] {
+    h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().props.prop("transform/position").unwrap().value.as_vec3()
+}
+
+fn matte(h: &Harness<'_, EffectcraftApp>, id: u64) -> Option<(u64, MatteKind)> {
+    h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().track_matte.map(|m| (m.layer.0, m.kind))
+}
+
+/// The project and its undo steps as they are now, to compare with after an undo or a refusal.
+fn mark(h: &Harness<'_, EffectcraftApp>) -> (std::sync::Arc<effectcraft_engine::project::Project>, usize) {
+    (h.state().session.project.clone(), h.state().session.history.undo.len())
+}
+
+fn unchanged(h: &Harness<'_, EffectcraftApp>, m: &(std::sync::Arc<effectcraft_engine::project::Project>, usize)) -> bool {
+    h.state().session.project.same_content(&m.0) && h.state().session.history.undo.len() == m.1
+}
+
+#[test]
+fn parent_menu_and_pick_whip_parent_the_selected_layers() {
+    let (mut h, [a, b, c, p, ..]) = harness();
+    let start = position(&h, a);
+    select(&mut h, &[a, b]);
+    let before = mark(&h);
+    // The Parent menu on A's (selected) row parents A and B, kept where they are.
+    choose(&mut h, &format!("timeline.layer.{a}.parent"), "3. P");
+    assert_eq!([parent(&h, a), parent(&h, b), parent(&h, c)], [Some(p), Some(p), None]);
+    assert!(position(&h, a) != start && position(&h, a) == position(&h, b), "both re-expressed in P's space");
+    assert_eq!(h.state().session.history.undo.len(), before.1 + 1, "one undo step");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert!(unchanged(&h, &before), "one undo puts both back");
+    // The pick whip of an unselected row parents that layer alone.
+    whip(&mut h, &format!("timeline.layer.{c}.pickWhip"), p);
+    assert_eq!([parent(&h, a), parent(&h, b), parent(&h, c)], [None, None, Some(p)]);
+    // A selected row's whip parents the selection, less the parent itself if selected.
+    select(&mut h, &[a, b, p]);
+    whip(&mut h, &format!("timeline.layer.{a}.pickWhip"), p);
+    assert_eq!([parent(&h, a), parent(&h, b), parent(&h, p)], [Some(p), Some(p), None]);
+    // A cycle (P under A, while A is under P) is refused as a whole.
+    select(&mut h, &[p, c]);
+    let before = mark(&h);
+    choose(&mut h, &format!("timeline.layer.{p}.parent"), "6. A");
+    assert!(unchanged(&h, &before), "the refused parenting changed nothing");
+    assert_eq!([parent(&h, p), parent(&h, c)], [None, Some(p)]);
+}
+
+#[test]
+fn track_matte_menu_and_pick_whip_set_the_selected_layers_mattes() {
+    let (mut h, [a, b, c, _, x, y]) = harness();
+    h.state_mut().session.execute("layer.setTrackMatte", json!({"layer": a, "matte": x, "kind": "luma"})).unwrap();
+    h.state_mut().session.execute("layer.setTrackMatte", json!({"layer": b, "matte": x, "kind": "alpha"})).unwrap();
+    select(&mut h, &[a, b]);
+    let before = mark(&h);
+    // A new matte layer for both; each keeps its mode; C (not selected) keeps none.
+    choose(&mut h, &format!("timeline.layer.{a}.trackMatte"), "1. Y");
+    assert_eq!([matte(&h, a), matte(&h, b), matte(&h, c)], [Some((y, MatteKind::Luma)), Some((y, MatteKind::Alpha)), None]);
+    assert!(!h.state().session.active_comp().unwrap().layer(LayerId(y)).unwrap().switches.video, "Y is hidden as a matte");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert!(unchanged(&h, &before), "one undo puts both mattes and Y's visibility back");
+    // A mode for both, then No Track Matte for both.
+    choose(&mut h, &format!("timeline.layer.{b}.trackMatte"), "Luma Inverted Matte");
+    assert_eq!([matte(&h, a), matte(&h, b)], [Some((x, MatteKind::LumaInverted)), Some((x, MatteKind::LumaInverted))]);
+    choose(&mut h, &format!("timeline.layer.{a}.trackMatte"), "No Track Matte");
+    assert_eq!([matte(&h, a), matte(&h, b)], [None, None]);
+    // The track matte pick whip: a selected row's sets the selection's, an unselected row's
+    // its own.
+    whip(&mut h, &format!("timeline.layer.{a}.trackMattePickWhip"), y);
+    assert_eq!([matte(&h, a), matte(&h, b), matte(&h, c)], [Some((y, MatteKind::Alpha)), Some((y, MatteKind::Alpha)), None]);
+    whip(&mut h, &format!("timeline.layer.{c}.trackMattePickWhip"), x);
+    assert_eq!([matte(&h, a), matte(&h, c)], [Some((y, MatteKind::Alpha)), Some((x, MatteKind::Alpha))]);
+}
+
+fn video(h: &Harness<'_, EffectcraftApp>, id: u64) -> bool {
+    h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().switches.video
+}
+
+/// A locked layer in the selection stays selected, and keeps its parent, its transform and its
+/// matte while another selected row's menus and pick whips change the rest.
+#[test]
+fn locked_selected_layers_keep_their_parent_and_matte() {
+    let (mut h, [a, b, c, _, x, _]) = harness();
+    select(&mut h, &[a, b]);
+    // B alone (a click on its Lock switch locks the whole selection).
+    h.state_mut().session.execute("layer.setSwitch", json!({"layers": [b], "switch": "lock", "value": true})).unwrap();
+    h.run_steps(2);
+    let selected: Vec<u64> = h.state().session.state.selected_layers.iter().map(|l| l.0).collect();
+    assert!(h.state().session.active_comp().unwrap().layer(LayerId(b)).unwrap().switches.locked && selected == vec![a, b], "{selected:?}");
+    let b_position = position(&h, b);
+    choose(&mut h, &format!("timeline.layer.{a}.parent"), "3. P");
+    whip(&mut h, &format!("timeline.layer.{a}.pickWhip"), c);
+    choose(&mut h, &format!("timeline.layer.{a}.trackMatte"), "1. Y");
+    whip(&mut h, &format!("timeline.layer.{a}.trackMattePickWhip"), x);
+    assert_eq!((parent(&h, a), matte(&h, a)), (Some(c), Some((x, MatteKind::Alpha))), "A changed each time");
+    assert_eq!((parent(&h, b), matte(&h, b), position(&h, b)), (None, None, b_position), "locked B didn't");
+}
+
+/// Selected nulls (no Track Matte on their rows) get no matte from another row's menu or pick
+/// whip: at the top of the comp one used to refuse the whole mode change (nothing above it to
+/// take as a matte), at the bottom it took the layer above as its matte and hid it.
+#[test]
+fn selected_nulls_get_no_matte() {
+    let (mut h, [a, b, _, _, x, y]) = harness();
+    h.state_mut().session.execute("layer.setTrackMatte", json!({"layers": [a, b], "matte": x, "kind": "alpha"})).unwrap();
+    let n = h.state_mut().session.execute("layer.newNull", json!({"name": "N"})).unwrap()["layer"].as_u64().unwrap();
+    select(&mut h, &[a, b, n]);
+    choose(&mut h, &format!("timeline.layer.{a}.trackMatte"), "Luma Matte");
+    assert_eq!([matte(&h, a), matte(&h, b), matte(&h, n)], [Some((x, MatteKind::Luma)), Some((x, MatteKind::Luma)), None], "a null on top");
+    h.state_mut().session.execute("layer.arrange", json!({"layers": [n], "to": "back"})).unwrap();
+    select(&mut h, &[a, b, n]);
+    choose(&mut h, &format!("timeline.layer.{a}.trackMatte"), "Alpha Inverted Matte");
+    assert_eq!(
+        [matte(&h, a), matte(&h, b), matte(&h, n)],
+        [Some((x, MatteKind::AlphaInverted)), Some((x, MatteKind::AlphaInverted)), None],
+        "a null at the bottom"
+    );
+    assert!(video(&h, a), "A wasn't hidden as the null's matte");
+    whip(&mut h, &format!("timeline.layer.{a}.trackMattePickWhip"), y);
+    assert_eq!(
+        [matte(&h, a), matte(&h, b), matte(&h, n)],
+        [Some((y, MatteKind::AlphaInverted)), Some((y, MatteKind::AlphaInverted)), None],
+        "the pick whip too"
+    );
+}
diff --git a/crates/ui-egui/tests/it/ui_batch_switches.rs b/crates/ui-egui/tests/it/ui_batch_switches.rs
new file mode 100644
index 000000000..407ac194e
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_batch_switches.rs
@@ -0,0 +1,244 @@
+//! A Timeline row control clicked on one of several selected layers applies to the whole
+//! selection (#1849), as in After Effects: the A/V Features and Switches columns, the label
+//! swatch and the Modes column. The engine commands already took several layers; the row
+//! controls used to pass the clicked layer alone.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::color::{BlendMode, Label};
+use effectcraft_engine::project::{Layer, LayerId, Switches};
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Modifiers, Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+/// Comp "Main" with solids A (top) to D (bottom); returns their ids top to bottom.
+fn harness() -> (Harness<'static, EffectcraftApp>, Vec<u64>) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
+    let mut ids: Vec<u64> = ["D", "C", "B", "A"]
+        .iter()
+        .map(|name| s.execute("layer.newSolid", json!({"name": name, "color": "#406080"})).unwrap()["layer"].as_u64().unwrap())
+        .collect();
+    ids.reverse();
+    s.execute("edit.deselectAll", json!({})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    (h, ids)
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).clone();
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+/// Press on `from`, move to `to` in `steps`, release there.
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, steps: u32) {
+    h.event(Event::PointerMoved(from));
+    h.step();
+    h.event(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=steps {
+        h.event(Event::PointerMoved(from + (to - from) * (k as f32 / steps as f32)));
+        h.step();
+    }
+    h.event(Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+/// A click on the Timeline control `id`.
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = rect(h, id).center();
+    drag(h, p, p, 1);
+}
+
+/// A click at `p` (a menu entry, found by its label).
+fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    drag(h, p, p, 1);
+}
+
+fn alt_click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = rect(h, id).center();
+    let modifiers = Modifiers::ALT;
+    h.event(Event::PointerMoved(p));
+    h.event(Event::ModifiersChanged(modifiers));
+    h.step();
+    h.event(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers });
+    h.step();
+    h.event(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers });
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(3);
+}
+
+/// Select `ids` in the Timeline, as a Shift range or a Cmd toggle would.
+fn select(h: &mut Harness<'_, EffectcraftApp>, ids: &[u64]) {
+    h.state_mut().session.execute("layer.select", json!({"layers": ids})).unwrap();
+    h.run_steps(2);
+}
+
+/// The state of switch `f` on each layer of `ids`, top to bottom.
+fn states(h: &Harness<'_, EffectcraftApp>, ids: &[u64], f: fn(&Layer) -> bool) -> Vec<bool> {
+    let comp = h.state().session.active_comp().unwrap();
+    ids.iter().map(|id| f(comp.layer(LayerId(*id)).unwrap())).collect()
+}
+
+fn switches(h: &Harness<'_, EffectcraftApp>, id: u64) -> Switches {
+    h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().switches.clone()
+}
+
+fn locked(l: &Layer) -> bool {
+    l.switches.locked
+}
+
+fn video(l: &Layer) -> bool {
+    l.switches.video
+}
+
+fn three_d(l: &Layer) -> bool {
+    l.switches.three_d
+}
+
+fn solo(l: &Layer) -> bool {
+    l.switches.solo
+}
+
+fn shy(l: &Layer) -> bool {
+    l.switches.shy
+}
+
+fn motion_blur(l: &Layer) -> bool {
+    l.switches.motion_blur
+}
+
+fn preserved(l: &Layer) -> bool {
+    l.preserve_transparency
+}
+
+/// #1849: a click on the Lock, 3D, Solo, Shy or Motion Blur switch of a selected layer gives the
+/// switch to every selected layer, in one undo step.
+#[test]
+fn switches_on_a_selected_row_set_the_whole_selection() {
+    let (mut h, ids) = harness();
+    select(&mut h, &[ids[0], ids[2]]);
+
+    let steps = h.state().session.history.undo.len();
+    click(&mut h, &format!("timeline.layer.{}.lock", ids[0]));
+    assert_eq!(states(&h, &ids, locked), [true, false, true, false]);
+    assert_eq!(h.state().session.history.undo.len(), steps + 1, "one undo step");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert_eq!(states(&h, &ids, locked), [false; 4]);
+
+    click(&mut h, &format!("timeline.layer.{}.switch.threeD", ids[0]));
+    assert_eq!(states(&h, &ids, three_d), [true, false, true, false]);
+    // The switch of the other selected layer acts the same way.
+    click(&mut h, &format!("timeline.layer.{}.solo", ids[2]));
+    assert_eq!(states(&h, &ids, solo), [true, false, true, false]);
+    click(&mut h, &format!("timeline.layer.{}.switch.shy", ids[2]));
+    assert_eq!(states(&h, &ids, shy), [true, false, true, false]);
+    click(&mut h, &format!("timeline.layer.{}.switch.motionBlur", ids[0]));
+    assert_eq!(states(&h, &ids, motion_blur), [true, false, true, false]);
+    // A second click turns both off again, whatever their own state.
+    click(&mut h, &format!("timeline.layer.{}.switch.threeD", ids[2]));
+    assert_eq!(states(&h, &ids, three_d), [false; 4]);
+}
+
+/// A switch on a row that isn't selected still changes that layer alone, and leaves the
+/// selection.
+#[test]
+fn a_switch_on_an_unselected_row_sets_that_layer_only() {
+    let (mut h, ids) = harness();
+    select(&mut h, &[ids[0], ids[2]]);
+    click(&mut h, &format!("timeline.layer.{}.lock", ids[1]));
+    assert_eq!(states(&h, &ids, locked), [false, true, false, false]);
+    assert_eq!(h.state().session.state.selected_layers, vec![LayerId(ids[0]), LayerId(ids[2])]);
+}
+
+/// The targets skip the selected layers a switch doesn't apply to: 3D reaches a null but not a
+/// camera (3D by kind), the Effect switch not a layer without effects.
+#[test]
+fn switch_targets_skip_the_layers_the_switch_does_not_apply_to() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
+    let solid = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let null = s.execute("layer.newNull", json!({"name": "Ctrl"})).unwrap()["layer"].as_u64().unwrap();
+    let cam = s.execute("layer.newCamera", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"effect": "ec.blur.gaussian", "layers": [solid]})).unwrap();
+    s.execute("edit.deselectAll", json!({})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    select(&mut h, &[solid, null, cam]);
+
+    click(&mut h, &format!("timeline.layer.{solid}.switch.threeD"));
+    assert!(switches(&h, solid).three_d && switches(&h, null).three_d, "3D reaches the null");
+    assert!(!switches(&h, cam).three_d, "a camera is 3D by kind, its own switch stays off");
+
+    click(&mut h, &format!("timeline.layer.{solid}.switch.fx"));
+    assert!(!switches(&h, solid).effects, "the Effect switch reaches the layer that has an effect");
+    assert!(switches(&h, null).effects && switches(&h, cam).effects, "no effects, no Effect switch");
+}
+
+/// Alt-click on an A/V feature sets the selected layers apart (the others off), and the next
+/// Alt-click brings the others back — with several layers, the whole selection stands apart.
+#[test]
+fn alt_click_sets_the_selected_layers_apart() {
+    let (mut h, ids) = harness();
+    select(&mut h, &[ids[0], ids[2]]);
+    alt_click(&mut h, &format!("timeline.layer.{}.video", ids[0]));
+    assert_eq!(states(&h, &ids, video), [true, false, true, false]);
+    alt_click(&mut h, &format!("timeline.layer.{}.video", ids[0]));
+    assert_eq!(states(&h, &ids, video), [true; 4]);
+}
+
+/// The label swatch menu of a selected layer sets the label of every selected layer.
+#[test]
+fn the_label_menu_sets_the_selections_label() {
+    let (mut h, ids) = harness();
+    select(&mut h, &[ids[0], ids[2]]);
+    let green = h.state().session.prefs.label_name(Label::Green);
+    click(&mut h, &format!("timeline.layer.{}.label", ids[0]));
+    let entry = h.query_by_label(&green).expect("the label menu is open").rect();
+    click_at(&mut h, entry.center());
+    let label = |id: u64| h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().label;
+    assert_eq!([label(ids[0]), label(ids[1]), label(ids[2]), label(ids[3])], [Label::Green, Label::Red, Label::Green, Label::Red]);
+}
+
+/// The Modes column: the Blending Mode menu and the Preserve Transparency checkbox of a selected
+/// layer set both selected layers, one undo step each.
+#[test]
+fn the_modes_column_sets_the_whole_selection() {
+    let (mut h, ids) = harness();
+    h.state_mut().ui.timeline.show_modes = true;
+    h.run_steps(3);
+    select(&mut h, &[ids[0], ids[2]]);
+
+    click(&mut h, &format!("timeline.layer.{}.mode", ids[0]));
+    let entry = h.query_by_label("Multiply").expect("the blend mode menu is open").rect();
+    click_at(&mut h, entry.center());
+    let mode = |id: u64| h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().blend_mode;
+    assert_eq!([mode(ids[0]), mode(ids[1]), mode(ids[2]), mode(ids[3])], [BlendMode::Multiply, BlendMode::Normal, BlendMode::Multiply, BlendMode::Normal]);
+
+    click(&mut h, &format!("timeline.layer.{}.preserveTransparency", ids[0]));
+    assert_eq!(states(&h, &ids, preserved), [true, false, true, false]);
+
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert_eq!(states(&h, &ids, preserved), [false; 4], "one undo step put both back");
+}
+
+/// Preserve Transparency toggles from the row it is clicked on, not from the first selected layer:
+/// A on and C off, clicking C's box turns both on.
+#[test]
+fn preserve_transparency_toggles_from_the_clicked_row() {
+    let (mut h, ids) = harness();
+    h.state_mut().ui.timeline.show_modes = true;
+    h.run_steps(3);
+    h.state_mut().session.execute("layer.setSwitch", json!({"layers": [ids[0]], "switch": "preserveTransparency", "value": true})).unwrap();
+    h.run_steps(2);
+    select(&mut h, &[ids[0], ids[2]]);
+    click(&mut h, &format!("timeline.layer.{}.preserveTransparency", ids[2]));
+    assert_eq!(states(&h, &ids, preserved), [true, false, true, false]);
+    // The next click turns both off again.
+    click(&mut h, &format!("timeline.layer.{}.preserveTransparency", ids[2]));
+    assert_eq!(states(&h, &ids, preserved), [false; 4]);
+}
diff --git a/crates/ui-egui/tests/ui_blank_context_menus.rs b/crates/ui-egui/tests/it/ui_blank_context_menus.rs
similarity index 80%
rename from crates/ui-egui/tests/ui_blank_context_menus.rs
rename to crates/ui-egui/tests/it/ui_blank_context_menus.rs
index 20f7467cc..84080be08 100644
--- a/crates/ui-egui/tests/ui_blank_context_menus.rs
+++ b/crates/ui-egui/tests/it/ui_blank_context_menus.rs
@@ -1,5 +1,8 @@
 //! Right-click actions in the blank Project and Timeline areas, and on Timeline property names.
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
+use effectcraft_engine::project::ItemKind;
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
 use effectcraft_ui_egui::{Dialog, EffectcraftApp, dock::PanelKind};
 use egui::{Event, Modifiers, PointerButton, Pos2, Rect, pos2, vec2};
 use egui_kittest::{Harness, kittest::Queryable as _};
@@ -18,7 +21,7 @@ fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
 }
 fn snapshot(h: &mut Harness<'_, EffectcraftApp>, name: &str) {
     if let Ok(dir) = std::env::var("BLANK_CONTEXT_MENU_SNAPSHOTS") {
-        h.render().unwrap().save(format!("{dir}/{name}.png")).unwrap();
+        h.render_serialized().unwrap().save(format!("{dir}/{name}.png")).unwrap();
     }
 }
 fn right_click(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
@@ -64,7 +67,7 @@ fn timeline_blank_outline_and_time_graph_create_layers() {
         let area = rect(&h, "timeline.layerMarquee");
         let p = if graph { pos2(area.max.x + 150.0, area.center().y) } else { area.center() };
         right_click(&mut h, p);
-        h.get_by_label("New ⏵").click();
+        h.get_by_label("New").click();
         h.run_steps(3);
         snapshot(&mut h, if graph { "timeline-graph" } else { "timeline-outline" });
         h.get_by_label("Null Object").click();
@@ -80,7 +83,7 @@ fn timeline_blank_menu_opens_solid_settings() {
     let mut h = harness();
     let p = rect(&h, "timeline.layerMarquee").center();
     right_click(&mut h, p);
-    h.get_by_label("New ⏵").click();
+    h.get_by_label("New").click();
     h.run_steps(3);
     h.get_by_label("Solid…").click();
     h.run_steps(3);
@@ -159,7 +162,7 @@ fn timeline_blank_menu_opens_current_comp_in_essential_graphics() {
         h.get_by_label("Open in Essential Graphics").click();
         h.run_steps(3);
         assert_eq!(h.state().session.state.essential_primary, Some(comp));
-        assert!(h.state().ui.dock.contains(PanelKind::EssentialGraphics));
+        assert!(h.state().ui.dock.is_docked(PanelKind::EssentialGraphics));
     }
 }
 
@@ -251,13 +254,13 @@ fn timeline_layer_context_menu_has_the_effects_submenu_and_applies_an_effect() {
     let r = rect(&h, &format!("timeline.layer.{layer}.row"));
     right_click(&mut h, pos2(r.min.x + 210.0, r.center().y));
     // The palette sits between Blending Mode and Arrange, as After Effects' layer menu does.
-    let blending = h.get_by_label("Blending Mode ⏵").rect();
-    let effects = h.get_by_label("Effects ⏵").rect();
-    let arrange = h.get_by_label("Arrange ⏵").rect();
+    let blending = h.get_by_label("Blending Mode").rect();
+    let effects = h.get_by_label("Effects").rect();
+    let arrange = h.get_by_label("Arrange").rect();
     assert!(blending.bottom() <= effects.top() && effects.bottom() <= arrange.top(), "Effects between Blending Mode and Arrange");
-    h.get_by_label("Effects ⏵").click();
+    h.get_by_label("Effects").click();
     h.run_steps(3);
-    h.get_by_label("Blur & Sharpen ⏵").click();
+    h.get_by_label("Blur & Sharpen").click();
     h.run_steps(3);
     h.get_by_label("Gaussian Blur").click();
     h.run_steps(3);
@@ -282,11 +285,11 @@ fn timeline_layer_context_menu_has_layer_styles_submenu() {
     h.run_steps(3);
     let r = rect(&h, &format!("timeline.layer.{solid}.row"));
     right_click(&mut h, pos2(r.min.x + 210.0, r.center().y));
-    let blending = h.get_by_label("Blending Mode ⏵").rect();
-    let styles = h.get_by_label("Layer Styles ⏵").rect();
-    let effects = h.get_by_label("Effects ⏵").rect();
+    let blending = h.get_by_label("Blending Mode").rect();
+    let styles = h.get_by_label("Layer Styles").rect();
+    let effects = h.get_by_label("Effects").rect();
     assert!(blending.bottom() <= styles.top() && styles.bottom() <= effects.top(), "Layer Styles between Blending Mode and Effects");
-    h.get_by_label("Layer Styles ⏵").click();
+    h.get_by_label("Layer Styles").click();
     h.run_steps(3);
     assert!(h.query_by_label("Layer Style Options...").is_some());
     assert!(h.query_by_label("Drop Shadow").is_some());
@@ -299,6 +302,43 @@ fn timeline_layer_context_menu_has_layer_styles_submenu() {
     assert!(l.layer_styles().is_some_and(|g| g.sub("dropShadow").is_some()));
 }
 
+/// #1809: Reveal Layer Source in Project shows the source in a large project: it clears the
+/// Project panel's search, opens the folders holding the item and selects it.
+#[test]
+fn timeline_layer_context_menu_reveals_the_source_in_project() {
+    let mut h = harness();
+    let layer = h.state_mut().session.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let solid = h.state().session.project.items.values().find(|i| matches!(i.kind, ItemKind::Solid(_))).unwrap().id;
+    let outer = h.state_mut().session.execute("project.newFolder", json!({"name": "Assets"})).unwrap()["item"].as_u64().unwrap();
+    let inner = h.state_mut().session.execute("project.newFolder", json!({"name": "Plates"})).unwrap()["item"].as_u64().unwrap();
+    h.state_mut().session.execute("project.move", json!({"items": [inner], "folder": outer})).unwrap();
+    h.state_mut().session.execute("project.move", json!({"items": [solid.0], "folder": inner})).unwrap();
+    h.state_mut().session.execute("project.select", json!({"items": []})).unwrap();
+    h.state_mut().ui.project_open_folders.clear();
+    h.state_mut().ui.project_search = "no such item".into();
+    h.run_steps(3);
+    assert!(h.state().auto.find(&format!("project.item.{}", solid.0)).is_none(), "the source starts hidden");
+    let r = rect(&h, &format!("timeline.layer.{layer}.row"));
+    right_click(&mut h, pos2(r.min.x + 210.0, r.center().y));
+    h.get_by_label("Reveal Layer Source in Project").click();
+    h.run_steps(3);
+    assert_eq!(h.state().session.state.project_selection, vec![solid]);
+    assert_eq!(h.state().ui.focused, PanelKind::Project);
+    assert!(h.state().ui.project_search.is_empty(), "the search is cleared");
+    assert!([outer, inner].iter().all(|folder| h.state().ui.project_open_folders.contains(folder)), "the folders holding the source open");
+    assert!(h.state().auto.find(&format!("project.item.{}", solid.0)).is_some(), "the source row is visible");
+    // In a mixed selection the command still appears when the right-clicked layer has no source,
+    // because the menu acts on the solid layer too.
+    let shape = h.state_mut().session.execute("layer.newShape", json!({"kind": "none"})).unwrap()["layer"].as_u64().unwrap();
+    h.state_mut().session.execute("layer.select", json!({"layers": [shape, layer]})).unwrap();
+    h.run_steps(3);
+    let r = rect(&h, &format!("timeline.layer.{shape}.row"));
+    right_click(&mut h, pos2(r.min.x + 210.0, r.center().y));
+    h.get_by_label("Reveal Layer Source in Project").click();
+    h.run_steps(3);
+    assert_eq!(h.state().session.state.project_selection, vec![solid], "the solid's source, not the shape");
+}
+
 /// #976: a layer's context menu has After Effects' Markers ▸ Add Marker, which marks the layer that
 /// was right-clicked (not the one selected before, and not the composition) at the current time.
 #[test]
@@ -313,7 +353,7 @@ fn layer_context_menu_adds_a_layer_marker() {
     h.run_steps(3);
     let r = rect(&h, &format!("timeline.layer.{top}.row"));
     right_click(&mut h, pos2(r.min.x + 210.0, r.center().y));
-    h.get_by_label("Markers ⏵").click();
+    h.get_by_label("Markers").click();
     h.run_steps(3);
     snapshot(&mut h, "layer-markers");
     h.get_by_label("Add Marker").click();
diff --git a/crates/ui-egui/tests/ui_camera_tracker.rs b/crates/ui-egui/tests/it/ui_camera_tracker.rs
similarity index 71%
rename from crates/ui-egui/tests/ui_camera_tracker.rs
rename to crates/ui-egui/tests/it/ui_camera_tracker.rs
index a90c3fa45..579e92d07 100644
--- a/crates/ui-egui/tests/ui_camera_tracker.rs
+++ b/crates/ui-egui/tests/it/ui_camera_tracker.rs
@@ -3,6 +3,7 @@
 //! The solve is a synthetic one written into the effect (the analysis itself is tested in the
 //! engine and track crates).
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::effects::camera_tracker as ct;
 use effectcraft_engine::track::camtrack::{CameraSolve, ShotType, SolveMethod, SolvedFrame, SolvedPoint};
@@ -16,8 +17,9 @@ const H: f64 = 360.0;
 
 fn app() -> (EffectcraftApp, u64, u64) {
     let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Shot", "width": W, "height": H, "duration": 2})).unwrap();
-    let plate = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Shot", "width": W as u32, "height": H as u32, "duration": 2, "frameRate": 30})).unwrap();
+    let plate =
+        s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080", "width": W as u32, "height": H as u32})).unwrap()["layer"].as_u64().unwrap();
     let r = s.execute("effect.apply", json!({"effect": ct::ID, "layers": [plate]})).unwrap();
     let uid = r["effects"][0].as_u64().unwrap();
     // A synthetic solve: a static camera (focal 600) looking at a 6 × 4 grid of points on z = 1.
@@ -135,7 +137,11 @@ fn viewer_points_selection_and_effect_controls() {
     h.state_mut().show_panel(PanelKind::EffectControls);
     h.run_steps(4);
     let all = ids(&h);
-    for want in [format!("effectControls.cameraTracker.{uid}.analyze"), format!("effectControls.cameraTracker.{uid}.createCamera")] {
+    for want in [
+        format!("effectControls.cameraTracker.{uid}.analyze"),
+        format!("effectControls.cameraTracker.{uid}.createCamera"),
+        format!("effectControls.cameraTracker.{uid}.exportBlender"),
+    ] {
         assert!(all.contains(&want), "missing {want}");
     }
     // Tracker panel: Track Camera is available for the selected layer.
@@ -145,6 +151,84 @@ fn viewer_points_selection_and_effect_controls() {
     assert!(h.state().session.is_enabled("track.camera"));
 }
 
+#[test]
+fn blender_export_button_opens_python_dialog_and_writes_scene() {
+    use effectcraft_engine::project::{Footage, FootageKind, ItemKind, LayerId, LayerSource};
+    let (mut a, plate, uid) = app();
+    let cid = a.session.active_comp_id().unwrap();
+    a.session
+        .edit("video fixture", None, |p, _| {
+            let item = p.add_item(
+                "Video",
+                Default::default(),
+                None,
+                ItemKind::Footage(Footage {
+                    path: "/tmp/effectcraft-ui-synthetic.mp4".into(),
+                    kind: FootageKind::Video,
+                    width: W as u32,
+                    height: H as u32,
+                    has_video: true,
+                    duration: effectcraft_engine::time::Tick::from_seconds_f64(2.0),
+                    ..Default::default()
+                }),
+            );
+            p.comp_mut(cid).unwrap().layer_mut(LayerId(plate)).unwrap().source = LayerSource::Footage { item };
+            Ok(())
+        })
+        .unwrap();
+    a.session.camera_pending.clear();
+    let output = std::env::temp_dir().join(format!("effectcraft-ui-blender-{}.py", std::process::id()));
+    let selected_path = output.clone();
+    a.hooks.pick_save_file = Some(Box::new(move |name, ext| {
+        assert!(name.ends_with(".py"));
+        assert_eq!(ext, "py");
+        Some(selected_path.to_string_lossy().into_owned())
+    }));
+    let shot = std::env::var("EFFECTCRAFT_BLENDER_UI_SNAPSHOT").ok();
+    let builder = Harness::builder().with_size(egui::vec2(1600.0, 1000.0));
+    let builder = if shot.is_some() { builder.wgpu() } else { builder };
+    let _device = shot.is_some().then(crate::gpu_test::lock);
+    let mut h = builder.build_eframe(|_| a);
+    h.state_mut().show_panel(PanelKind::EffectControls);
+    h.run_steps(5);
+    let button = rect(&h, &format!("effectControls.cameraTracker.{uid}.exportBlender"));
+    if let Some(path) = shot {
+        h.render().expect("render export button").save(path).unwrap();
+    }
+    click(&mut h, button.center(), Default::default());
+    assert!(output.exists(), "UI export failed: {}", h.state().ui.status);
+    let script = std::fs::read_to_string(output).expect("clicking the export button saves a Python scene");
+    assert!(script.contains("def import_scene():"));
+    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 1, "export does not create a camera in the source project");
+}
+
+/// A solve with unsolved (interpolated) frames says so in Effect Controls, with the count, on a
+/// line of its own that pushes the Export button down.
+#[test]
+fn effect_controls_show_how_many_frames_a_partial_solve_solved() {
+    let (a, plate, uid) = app();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| a);
+    h.state_mut().show_panel(PanelKind::EffectControls);
+    h.run_steps(4);
+    let line = format!("effectControls.cameraTracker.{uid}.partialSolve");
+    let export = format!("effectControls.cameraTracker.{uid}.exportBlender");
+    assert!(!ids(&h).contains(&line), "a full solve has no partial-solve line");
+    let before = rect(&h, &export);
+
+    let g = h.state().session.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(plate)).unwrap().props.find_group(uid).unwrap();
+    let mut solve = ct::solve(&effectcraft_engine::camera_track::static_params(g)).unwrap().as_ref().clone();
+    for f in solve.frames.iter_mut().skip(24) {
+        f.solved = false;
+    }
+    let s = &mut h.state_mut().session;
+    s.execute("prop.set", json!({"layer": plate, "path": "effects/#1/solve", "value": solve.to_json()})).unwrap();
+    s.camera_pending.clear();
+    h.run_steps(4);
+    let e = h.state().auto.find(&line).expect("the partial-solve line is drawn");
+    assert_eq!(e.label, "Partial solve: 24 of 60 frames solved");
+    assert!((rect(&h, &export).min.y - before.min.y - 18.0).abs() < 0.5, "the Export button moves down one line");
+}
+
 /// Drag with `button` from `from` to `to` in steps, then release.
 fn drag_with(h: &mut Harness<'_, EffectcraftApp>, button: egui::PointerButton, from: egui::Pos2, to: egui::Pos2) {
     h.input_mut().events.push(egui::Event::PointerMoved(from));
@@ -171,10 +255,11 @@ fn viewer_zooms_and_pans_over_the_track_points() {
     let zoom = h.state().ui.viewer.zoom;
     h.input_mut().events.push(egui::Event::PointerMoved(at));
     h.input_mut().events.push(egui::Event::MouseWheel {
-        unit: egui::MouseWheelUnit::Point,
-        delta: egui::vec2(0.0, 120.0),
+        unit: egui::MouseWheelUnit::Line,
+        delta: egui::vec2(0.0, 3.0),
         modifiers: Default::default(),
         phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
     });
     h.run_steps(20);
     assert_ne!(h.state().ui.viewer.zoom, zoom, "the wheel zooms over the track points");
@@ -216,6 +301,7 @@ fn settle(h: &mut Harness<'_, EffectcraftApp>) {
 #[test]
 #[ignore = "analyses the demo's 3D Showcase and renders with wgpu; run with --ignored (set EC_SNAPSHOT_DIR to keep PNGs)"]
 fn snapshot_showcase_track() {
+    let _device = crate::gpu_test::lock();
     let dir = std::env::var("EC_SNAPSHOT_DIR").ok();
     let mut s = Session::default();
     s.execute("file.openDemoProject", json!({})).unwrap();
@@ -234,7 +320,7 @@ fn snapshot_showcase_track() {
     h.input_mut().events.push(egui::Event::PointerMoved(r.center() + egui::vec2(12.0, 12.0)));
     h.run_steps(2);
     if let Some(d) = &dir {
-        h.render().expect("render").save(format!("{d}/camera_tracker_hover.png")).unwrap();
+        h.render_serialized().expect("render").save(format!("{d}/camera_tracker_hover.png")).unwrap();
     }
     let sel: Vec<u64> = pts.iter().take(5).filter_map(|i| i.rsplit('.').next()?.parse().ok()).collect();
     h.state_mut().session.execute("camera.selectPoints", json!({"points": sel})).unwrap();
@@ -242,6 +328,6 @@ fn snapshot_showcase_track() {
     h.state_mut().session.execute("layer.select", json!({"layers": ["#3"]})).unwrap();
     settle(&mut h);
     if let Some(d) = &dir {
-        h.render().expect("render").save(format!("{d}/camera_tracker_solid.png")).unwrap();
+        h.render_serialized().expect("render").save(format!("{d}/camera_tracker_solid.png")).unwrap();
     }
 }
diff --git a/crates/ui-egui/tests/ui_character_eyedropper.rs b/crates/ui-egui/tests/it/ui_character_eyedropper.rs
similarity index 90%
rename from crates/ui-egui/tests/ui_character_eyedropper.rs
rename to crates/ui-egui/tests/it/ui_character_eyedropper.rs
index a2c4c6d1f..ea4eecd99 100644
--- a/crates/ui-egui/tests/ui_character_eyedropper.rs
+++ b/crates/ui-egui/tests/it/ui_character_eyedropper.rs
@@ -1,8 +1,9 @@
 //! Character Fill and Stroke can sample a displayed Composition pixel.
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::{Session, commands::text_edit::layer_doc, project::LayerId};
 use effectcraft_ui_egui::{
     EffectcraftApp,
-    dock::{DockNode, PanelKind, SplitSize},
+    dock::{self, PanelKind, SplitSize},
     panels::viewer::comp_to_screen,
 };
 use egui::{Event, Modifiers, PointerButton, Pos2, pos2, vec2};
@@ -37,6 +38,7 @@ fn settle(h: &mut Harness<'_, EffectcraftApp>) {
 
 #[test]
 fn character_fill_eyedropper_samples_viewer_and_keeps_text_selection() {
+    let _device = crate::gpu_test::lock();
     let mut s = Session::default();
     s.execute("comp.new", json!({"width": 320, "height": 180, "duration": 2})).unwrap();
     s.execute("layer.newSolid", json!({"name": "Background", "color": "#20c040"})).unwrap();
@@ -64,6 +66,7 @@ fn character_fill_eyedropper_samples_viewer_and_keeps_text_selection() {
 
 #[test]
 fn character_stroke_eyedropper_samples_viewer() {
+    let _device = crate::gpu_test::lock();
     let mut s = Session::default();
     s.execute("comp.new", json!({"width": 320, "height": 180, "duration": 2})).unwrap();
     s.execute("layer.newSolid", json!({"name": "brat green", "color": "#8ACE00"})).unwrap();
@@ -71,12 +74,7 @@ fn character_stroke_eyedropper_samples_viewer() {
     s.execute("layer.setText", json!({"layer": text, "fill": [0.0, 0.0, 0.0], "size": 32.0})).unwrap();
     let mut app = EffectcraftApp::new(s);
     app.ui.viewer.show_layer_controls = false;
-    app.ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedB(360.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Composition], active: 0 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Character], active: 0 }),
-    };
+    app.ui.dock = dock::docked(dock::hsplit(SplitSize::FixedSecond(360.0), dock::tabs(&[PanelKind::Composition], 0), dock::tabs(&[PanelKind::Character], 0)));
     let builder = Harness::builder().with_size(vec2(1200.0, 760.0));
     let mut h = if std::env::var_os("EC_SNAPSHOT_DIR").is_some() { builder.wgpu().build_eframe(|_| app) } else { builder.build_eframe(|_| app) };
     h.state_mut().show_panel(PanelKind::Character);
@@ -84,7 +82,7 @@ fn character_stroke_eyedropper_samples_viewer() {
     settle(&mut h);
     click_auto(&mut h, "character.stroke.eyedropper");
     if let Ok(dir) = std::env::var("EC_SNAPSHOT_DIR") {
-        h.render().unwrap().save(format!("{dir}/character-eyedropper.png")).unwrap();
+        h.render_serialized().unwrap().save(format!("{dir}/character-eyedropper.png")).unwrap();
     }
     let sample = comp_to_screen(&h.ctx, [20.0, 20.0]).unwrap();
     click(&mut h, sample);
diff --git a/crates/ui-egui/tests/it/ui_character_stroke_order.rs b/crates/ui-egui/tests/it/ui_character_stroke_order.rs
new file mode 100644
index 000000000..db89f7c1a
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_character_stroke_order.rs
@@ -0,0 +1,77 @@
+//! The Character panel's stroke order menu: the two per-character orders and the two layer-wide
+//! ones (All Fills Over All Strokes, All Strokes Over All Fills), which set the text layer's
+//! More Options ▸ Fill & Stroke.
+use effectcraft_engine::{Session, commands::text_edit::layer_doc, project::LayerId};
+use effectcraft_ui_egui::{EffectcraftApp, dock::PanelKind};
+use egui::{
+    Event, Modifiers, PointerButton, Pos2,
+    accesskit::{Role, Toggled},
+    pos2, vec2,
+};
+use egui_kittest::{
+    Harness,
+    kittest::{NodeT, Queryable},
+};
+use serde_json::json;
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2) {
+    h.event(Event::PointerMoved(pos));
+    h.step();
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(2);
+}
+
+fn open_menu(h: &mut Harness<'_, EffectcraftApp>) {
+    let e = h.state().auto.find("character.strokeOverFill").unwrap_or_else(|| panic!("missing character.strokeOverFill")).clone();
+    click(h, pos2(e.rect[0] + e.rect[2] * 0.5, e.rect[1] + e.rect[3] * 0.5));
+}
+
+fn pick(h: &mut Harness<'_, EffectcraftApp>, label: &str) {
+    open_menu(h);
+    // A menu row: the dropdown shows the current order under the same label.
+    h.get_by_role_and_label(Role::Button, label).click();
+    h.run_steps(3);
+}
+
+fn fill_stroke(s: &mut Session, layer: u64) -> serde_json::Value {
+    s.execute("prop.get", json!({"layer": layer, "path": "text/moreOptions/fillStroke"})).unwrap()["value"].clone()
+}
+
+#[test]
+fn character_stroke_order_menu_sets_layer_fill_and_stroke() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 320, "height": 180, "duration": 2})).unwrap();
+    let text = s.execute("layer.newText", json!({"text": "Caption", "font": "Inter"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setText", json!({"layer": text, "applyStroke": true, "strokeWidth": 8.0, "strokeOverFill": false})).unwrap();
+    let mut app = EffectcraftApp::new(s);
+    app.set_workspace("Text");
+    let builder = Harness::builder().with_size(vec2(1600.0, 1400.0));
+    let mut h = if std::env::var_os("EC_SNAPSHOT_DIR").is_some() { builder.wgpu().build_eframe(|_| app) } else { builder.build_eframe(|_| app) };
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(4);
+
+    pick(&mut h, "All Fills Over All Strokes");
+    assert_eq!(fill_stroke(&mut h.state_mut().session, text), json!(1));
+    pick(&mut h, "All Strokes Over All Fills");
+    assert_eq!(fill_stroke(&mut h.state_mut().session, text), json!(2));
+    // The menu shows the layer's order as the current one.
+    open_menu(&mut h);
+    assert_eq!(h.get_by_role_and_label(Role::Button, "All Strokes Over All Fills").accesskit_node().toggled(), Some(Toggled::True));
+    assert_eq!(h.get_by_role_and_label(Role::Button, "Fill Over Stroke").accesskit_node().toggled(), Some(Toggled::False));
+    if let Ok(dir) = std::env::var("EC_SNAPSHOT_DIR") {
+        h.render().unwrap().save(format!("{dir}/character-stroke-order.png")).unwrap();
+    }
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+
+    // A per-character order goes back to the Per Character Palette, in one undo step.
+    pick(&mut h, "Stroke Over Fill");
+    assert_eq!(fill_stroke(&mut h.state_mut().session, text), json!(0));
+    assert!(layer_doc(&h.state().session, LayerId(text)).unwrap().stroke_over_fill);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(fill_stroke(&mut h.state_mut().session, text), json!(2));
+    assert!(!layer_doc(&h.state().session, LayerId(text)).unwrap().stroke_over_fill);
+}
diff --git a/crates/ui-egui/tests/it/ui_checkbox_drag.rs b/crates/ui-egui/tests/it/ui_checkbox_drag.rs
new file mode 100644
index 000000000..ba65e54dc
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_checkbox_drag.rs
@@ -0,0 +1,54 @@
+//! #1190: the shared drag gesture also reaches real dialog controls.
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::{EffectcraftApp, menus};
+use egui::{Event, Modifiers, PointerButton, Pos2, vec2};
+use egui_kittest::{Harness, kittest::Queryable as _};
+use serde_json::json;
+
+fn pointer(h: &mut Harness<'_, EffectcraftApp>, at: Pos2, pressed: Option<bool>) {
+    h.event(Event::PointerMoved(at));
+    h.step();
+    if let Some(pressed) = pressed {
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(2);
+}
+
+#[test]
+fn view_options_drag_checks_and_unchecks_neighbours() {
+    let mut session = Session::default();
+    session.prefs.disk.disk_cache_enabled = false;
+    session.execute("comp.new", json!({"width":32,"height":32,"duration":1})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1200.0, 900.0)).build_eframe(|_| EffectcraftApp::new(session));
+    h.state_mut().ui.viewer.rulers = false;
+    h.state_mut().ui.viewer.guides = true;
+    h.state_mut().ui.viewer.grid = false;
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    menus::invoke(h.state_mut(), &ctx, "view.options", json!({})).unwrap();
+    h.run_steps(3);
+    let rulers = h.get_by_label("Rulers").rect().center();
+    let guides = h.get_by_label("Guides").rect().center();
+    let grid = h.get_by_label("Grid").rect().center();
+    pointer(&mut h, rulers, Some(true));
+    assert!(h.state().ui.viewer.rulers);
+    pointer(&mut h, guides, None);
+    assert!(h.state().ui.viewer.guides, "an already-checked neighbour stays checked");
+    pointer(&mut h, grid, None);
+    assert!(h.state().ui.viewer.grid);
+    pointer(&mut h, rulers, None);
+    pointer(&mut h, rulers, Some(false));
+    assert!(h.state().ui.viewer.rulers, "revisiting and releasing does not undo the change");
+    if let Ok(path) = std::env::var("CHECKBOX_REVIEW_PNG") {
+        h.render().unwrap().save(path).unwrap();
+    }
+    pointer(&mut h, grid, Some(true));
+    pointer(&mut h, guides, None);
+    pointer(&mut h, rulers, None);
+    pointer(&mut h, rulers, Some(false));
+    let viewer = &h.state().ui.viewer;
+    assert!(!viewer.rulers && !viewer.guides && !viewer.grid);
+    pointer(&mut h, guides, None);
+    assert!(!h.state().ui.viewer.guides, "hover after release does not change a checkbox");
+}
diff --git a/crates/ui-egui/tests/ui_color_hex.rs b/crates/ui-egui/tests/it/ui_color_hex.rs
similarity index 99%
rename from crates/ui-egui/tests/ui_color_hex.rs
rename to crates/ui-egui/tests/it/ui_color_hex.rs
index 4f8a8ab14..8a5a39b8e 100644
--- a/crates/ui-egui/tests/ui_color_hex.rs
+++ b/crates/ui-egui/tests/it/ui_color_hex.rs
@@ -1,4 +1,4 @@
-//! The colour picker every colour input opens: its hex field sets an effect's colour (CC Toner),
+//! The colour picker every colour input opens: its hex field sets an effect's colour (Multi-Tone Tint),
 //! the dialogs' colour button stores sRGB (egui's own `color_edit_button_rgba` read the stored
 //! sRGB values as linear, so mid-grey `#808080` was stored as `#373737`), the square, slider and
 //! HSB / RGB fields set the colour, and Cancel / Escape / the original swatch restore it.
@@ -45,7 +45,7 @@ fn hex_code_sets_an_effect_colour() {
     let mut s = Session::default();
     s.execute("comp.new", json!({"name": "Hex", "width": 320, "height": 180, "duration": 4})).unwrap();
     let layer = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#40b080"})).unwrap()["layer"].as_u64().unwrap();
-    let fx = s.execute("effect.apply", json!({"layer": layer, "effect": "CC Toner"})).unwrap()["effects"][0].as_u64().unwrap();
+    let fx = s.execute("effect.apply", json!({"layer": layer, "effect": "Multi-Tone Tint"})).unwrap()["effects"][0].as_u64().unwrap();
     let uid = s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find_group(fx).unwrap().get("midtones").unwrap().uid;
     s.state.selected_layers = vec![LayerId(layer)];
     let mut app = EffectcraftApp::new(s);
diff --git a/crates/ui-egui/tests/it/ui_comp_presets.rs b/crates/ui-egui/tests/it/ui_comp_presets.rs
new file mode 100644
index 000000000..3fda8a8cc
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_comp_presets.rs
@@ -0,0 +1,218 @@
+//! Composition Settings: saving, picking and deleting your own presets (egui_kittest).
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::{Dialog, EffectcraftApp};
+use egui::{Event, Key, Modifiers, PointerButton, Pos2, pos2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Edit", "width": 2560, "height": 1440, "frameRate": 60, "duration": 4})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h
+}
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = center(h, id);
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    // The automation registry still holds the previous frame's elements: one more frame.
+    h.run_steps(3);
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key) {
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn open_settings(h: &mut Harness<'_, EffectcraftApp>) {
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "comp.settings", json!({})).unwrap();
+    h.run_steps(3);
+    assert_eq!(h.state().dialog, Some(Dialog::CompSettings));
+}
+
+fn preset_names(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
+    h.state().session.prefs.comp_presets.iter().map(|q| q.name.clone()).collect()
+}
+
+/// Save the comp's size and rate as a preset (Enter saves without pressing OK), then delete it.
+#[test]
+fn composition_settings_save_and_delete_your_own_preset() {
+    let mut h = harness();
+    open_settings(&mut h);
+    assert!(h.state().auto.find("dialog.comp.presetDelete").is_none(), "nothing of yours to delete yet");
+    click(&mut h, "dialog.comp.presetSave");
+    // Choose Name opens with the keyboard in its field.
+    h.input_mut().events.push(Event::Text("1440p 60".into()));
+    h.run_steps(2);
+    key(&mut h, Key::Enter);
+    assert_eq!(preset_names(&h), ["1440p 60"]);
+    let q = &h.state().session.prefs.comp_presets[0];
+    assert_eq!((q.width, q.height, q.pixel_aspect, q.frame_rate), (2560, 1440, 1.0, 60.0));
+    assert_eq!(h.state().dialog, Some(Dialog::CompSettings), "Enter in the name field doesn't press OK");
+    assert!(h.state().auto.find("dialog.comp.presetName").is_none(), "the name row closes");
+    // The comp's values are now that preset, so it can be deleted.
+    click(&mut h, "dialog.comp.presetDelete");
+    assert!(preset_names(&h).is_empty());
+    assert!(h.state().auto.find("dialog.comp.presetDelete").is_none());
+}
+
+/// A built-in preset's name can't be taken; Cancel closes the name row without saving.
+#[test]
+fn a_preset_name_cannot_be_a_built_in_one() {
+    let mut h = harness();
+    open_settings(&mut h);
+    click(&mut h, "dialog.comp.presetSave");
+    click(&mut h, "dialog.comp.presetName");
+    h.input_mut().events.push(Event::Text("HDTV 1080 24".into()));
+    h.run_steps(2);
+    click(&mut h, "dialog.comp.presetNameSave");
+    assert!(preset_names(&h).is_empty(), "the built-in name is refused");
+    click(&mut h, "dialog.comp.presetNameCancel");
+    assert!(h.state().auto.find("dialog.comp.presetName").is_none());
+    assert!(preset_names(&h).is_empty());
+}
+
+/// Cancel and OK stay where they are when switching between Basic, Advanced and 3D Renderer,
+/// at any interface scale: the tabs' heights are measured, not assumed.
+#[test]
+fn composition_settings_buttons_stay_put_between_tabs() {
+    for zoom in [1.0, 1.3] {
+        let mut h = harness();
+        h.ctx.set_zoom_factor(zoom);
+        h.run_steps(3);
+        open_settings(&mut h);
+        let rects = |h: &Harness<'_, EffectcraftApp>| {
+            ["dialog.comp.ok", "dialog.comp.cancel", "dialog.comp.name"].map(|id| h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).rect)
+        };
+        let basic = rects(&h);
+        for tab in ["advanced", "renderer", "basic"] {
+            click(&mut h, &format!("dialog.comp.tab.{tab}"));
+            assert_eq!(rects(&h), basic, "{tab} at {zoom}x");
+        }
+    }
+}
+
+/// Composition Settings keeps Cancel and OK in view in every interface language: a translation
+/// wider than the English (French, #2841) widens the dialog instead of pushing OK past its right
+/// edge, where it could be reached only by scrolling sideways.
+#[test]
+fn composition_settings_buttons_fit_every_language() {
+    // English, then French (#2841) and the other catalogs whose rows overflowed the 600 points.
+    for language in ["en", "fr", "es", "ka", "cs", "pt-br"] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Edit", "width": 2560, "height": 1440, "frameRate": 60, "duration": 4})).unwrap();
+        s.prefs.general.language = language.into();
+        let mut h =
+            Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).allow_missing_glyphs().build_eframe(|_| EffectcraftApp::new(s));
+        h.run_steps(3);
+        open_settings(&mut h);
+        let mut oks = vec![];
+        for tab in ["basic", "advanced", "renderer"] {
+            click(&mut h, &format!("dialog.comp.tab.{tab}"));
+            let rect = |id: &str| h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).rect;
+            let (view, ok, cancel) = (rect("dialog.comp.view"), rect("dialog.comp.ok"), rect("dialog.comp.cancel"));
+            for (name, r) in [("OK", ok), ("Cancel", cancel)] {
+                assert!(r[0] >= view[0] && r[0] + r[2] <= view[0] + view[2] + 0.5, "{language} {tab}: {name} {r:?} is outside the dialog {view:?}");
+            }
+            if language == "en" {
+                // English still fits the 600-point dialog (18-point margins).
+                assert_eq!(view[2], 600.0 - 36.0, "{tab}");
+            }
+            oks.push(ok);
+        }
+        // The dialog takes the width of its widest tab, so OK stays put between tabs.
+        assert!(oks.windows(2).all(|w| w[0] == w[1]), "{language}: OK moves between tabs: {oks:?}");
+    }
+}
+
+fn rect_of(h: &Harness<'_, EffectcraftApp>, id: &str) -> egui::Rect {
+    let r = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).rect;
+    egui::Rect::from_min_size(pos2(r[0], r[1]), egui::vec2(r[2], r[3]))
+}
+
+/// In a window too short for it, the dialog scrolls: its registered view stays the scroll
+/// area's viewport (not a part of it shifted by the scroll), and OK scrolls into it.
+#[test]
+fn composition_settings_view_stays_put_when_it_scrolls() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Edit", "width": 2560, "height": 1440, "frameRate": 60, "duration": 4})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 520.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    open_settings(&mut h);
+    let (view, ok) = (rect_of(&h, "dialog.comp.view"), rect_of(&h, "dialog.comp.ok"));
+    assert!(ok.bottom() > view.bottom(), "the dialog must be taller than the window for this test: OK {ok:?}, view {view:?}");
+    h.input_mut().events.push(Event::PointerMoved(view.center()));
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -2000.0),
+        modifiers: Modifiers::NONE,
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
+    h.run_steps(30);
+    let (scrolled, ok) = (rect_of(&h, "dialog.comp.view"), rect_of(&h, "dialog.comp.ok"));
+    // The scroll bar may take a few points on the right while it is shown.
+    assert_eq!((scrolled.y_range(), scrolled.left()), (view.y_range(), view.left()), "the view is the viewport, wherever the content is scrolled to");
+    assert!(scrolled.contains_rect(ok), "OK {ok:?} scrolls into the view {scrolled:?}");
+}
+
+/// Changing the interface language with the dialog open refits it to the new text and then
+/// settles, with OK inside it: its scroll bars don't trade places every frame while it grows.
+/// Switching back to English returns it to 600 points.
+#[test]
+fn composition_settings_refits_when_the_language_changes() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Edit", "width": 2560, "height": 1440, "frameRate": 60, "duration": 4})).unwrap();
+    let mut h = Harness::builder()
+        .with_size(egui::vec2(1600.0, 1000.0))
+        .with_step_dt(1.0 / 60.0)
+        .with_max_steps(30)
+        // `run` checks accessibility after settling; that is not what this test is about.
+        .with_accessibility_check(false)
+        .build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    open_settings(&mut h);
+    click(&mut h, "dialog.comp.tab.advanced");
+    h.run_ok().expect("the open dialog settles");
+    assert_eq!(rect_of(&h, "dialog.comp.view").width(), 600.0 - 36.0);
+    for (language, wider) in [("fr", true), ("en", false)] {
+        h.state_mut().session.prefs.general.language = language.into();
+        // Steps while anything asks for a repaint, and fails if that never stops.
+        let steps = h.try_run().unwrap_or_else(|e| panic!("{language}: {e}"));
+        let (view, ok) = (rect_of(&h, "dialog.comp.view"), rect_of(&h, "dialog.comp.ok"));
+        assert!(view.contains_rect(ok), "{language}: after {steps} steps OK {ok:?} is outside the dialog {view:?}");
+        assert_eq!(view.width() > 600.0 - 36.0, wider, "{language}: the dialog is {} wide", view.width());
+    }
+}
+
+/// OK in the New Composition dialog opened over the Home screen (the native menu shows it there)
+/// leaves the Home screen for the new composition; Cancel keeps it.
+#[test]
+fn new_composition_dialog_ok_leaves_the_home_screen() {
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| EffectcraftApp::new(Session::default()));
+    h.run_steps(3);
+    h.state_mut().ui.start_screen = true;
+    h.state_mut().dialog = Some(Dialog::NewComp);
+    h.run_steps(3);
+    click(&mut h, "dialog.comp.cancel");
+    assert_eq!(h.state().dialog, None);
+    assert!(h.state().ui.start_screen, "Cancel keeps the Home screen");
+    h.state_mut().dialog = Some(Dialog::NewComp);
+    h.run_steps(3);
+    click(&mut h, "dialog.comp.ok");
+    assert_eq!(h.state().dialog, None);
+    assert!(h.state().session.active_comp_id().is_some(), "a composition was made");
+    assert!(!h.state().ui.start_screen, "OK leaves the Home screen");
+}
diff --git a/crates/ui-egui/tests/it/ui_contrast.rs b/crates/ui-egui/tests/it/ui_contrast.rs
new file mode 100644
index 000000000..34352b5e5
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_contrast.rs
@@ -0,0 +1,92 @@
+//! Colour contrast of the theme tokens (docs/gaps.md gap 25), separate from the AccessKit audit:
+//! the WCAG 2 contrast ratio of the text, accent and focus colours against the backgrounds they
+//! are drawn on, for every theme. Text needs 4.5:1, the focus ring and control borders 3:1.
+//!
+//! Pairs that fall short today are listed in [`KNOWN_BELOW`] with the ratio measured when this was
+//! written. The list is a ratchet: a pair must not get worse, and a pair that reaches its target
+//! must leave the list. This checks the tokens, not what a panel really draws with them (text on
+//! a label colour, an image, a disabled control) and not colour-blindness.
+
+use effectcraft_ui_egui::theme::{ThemeKind, Tokens};
+use egui::Color32;
+
+/// WCAG 2 relative luminance of an sRGB colour.
+fn luminance(c: Color32) -> f64 {
+    let lin = |v: u8| {
+        let v = f64::from(v) / 255.0;
+        if v <= 0.039_28 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) }
+    };
+    0.2126 * lin(c.r()) + 0.7152 * lin(c.g()) + 0.0722 * lin(c.b())
+}
+
+/// WCAG 2 contrast ratio of two opaque colours.
+fn ratio(a: Color32, b: Color32) -> f64 {
+    let (la, lb) = (luminance(a), luminance(b));
+    (la.max(lb) + 0.05) / (la.min(lb) + 0.05)
+}
+
+/// (name, foreground, background, minimum ratio)
+fn pairs(t: &Tokens) -> Vec<(&'static str, Color32, Color32, f64)> {
+    vec![
+        ("text on panel", t.text, t.panel_bg, 4.5),
+        ("text on field", t.text, t.field_bg, 4.5),
+        ("text on selected row", t.text, t.row_selected, 4.5),
+        ("text on row", t.text, t.row, 4.5),
+        ("dim text on panel", t.text_dim, t.panel_bg, 4.5),
+        ("faint text on panel", t.text_faint, t.panel_bg, 4.5),
+        ("active tab text on panel", t.tab_text_active, t.panel_bg, 4.5),
+        ("tab text on header", t.tab_text, t.header_bg, 4.5),
+        ("hot text on panel", t.hot_text, t.panel_bg, 4.5),
+        ("white on accent (primary button)", Color32::WHITE, t.accent, 4.5),
+        ("danger text on panel", t.danger, t.panel_bg, 4.5),
+        ("warning text on panel", t.warning, t.panel_bg, 4.5),
+        ("accent (focus ring) on panel", t.accent, t.panel_bg, 3.0),
+        ("focus colour on panel", t.focus, t.panel_bg, 3.0),
+        ("field border on panel", t.field_border, t.panel_bg, 3.0),
+        ("icon on panel", t.icon, t.panel_bg, 3.0),
+    ]
+}
+
+/// (theme, pair, ratio measured when written). Ratchet: never below the number; remove the entry
+/// when the pair reaches its target.
+const KNOWN_BELOW: &[(&str, &str, f64)] = &[
+    ("dark", "white on accent (primary button)", 3.46),
+    ("dark", "danger text on panel", 3.90),
+    ("dark", "field border on panel", 1.38),
+    ("darker", "white on accent (primary button)", 3.46),
+    ("darker", "danger text on panel", 4.37),
+    ("darker", "field border on panel", 1.55),
+    ("light", "faint text on panel", 4.46),
+    ("light", "white on accent (primary button)", 3.46),
+    ("light", "danger text on panel", 3.23),
+    ("light", "warning text on panel", 1.85),
+    ("light", "accent (focus ring) on panel", 2.78),
+    ("light", "focus colour on panel", 2.78),
+    ("light", "field border on panel", 1.86),
+];
+
+#[test]
+fn print_and_hold_the_theme_contrast() {
+    let mut failures = vec![];
+    for kind in [ThemeKind::Dark, ThemeKind::Darker, ThemeKind::Light] {
+        let t = Tokens::for_kind(kind);
+        for (name, fg, bg, min) in pairs(&t) {
+            let r = ratio(fg, bg);
+            let known = KNOWN_BELOW.iter().find(|(k, n, _)| *k == kind.name() && *n == name);
+            println!("{:<7} {name:<36} {r:>5.2}:1 (needs {min})", kind.name());
+            match known {
+                Some((_, _, floor)) => {
+                    if r + 0.005 < *floor {
+                        failures.push(format!("{} / {name}: {r:.2}:1 is worse than the known {floor:.2}:1", kind.name()));
+                    }
+                    if r >= min {
+                        failures.push(format!("{} / {name}: {r:.2}:1 now reaches {min}:1; remove it from KNOWN_BELOW", kind.name()));
+                    }
+                }
+                None if r < min => failures.push(format!("{} / {name}: {r:.2}:1 is below {min}:1", kind.name())),
+                None => {}
+            }
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
diff --git a/crates/ui-egui/tests/ui_control_modifiers.rs b/crates/ui-egui/tests/it/ui_control_modifiers.rs
similarity index 68%
rename from crates/ui-egui/tests/ui_control_modifiers.rs
rename to crates/ui-egui/tests/it/ui_control_modifiers.rs
index 46567aede..7a7a1395a 100644
--- a/crates/ui-egui/tests/ui_control_modifiers.rs
+++ b/crates/ui-egui/tests/it/ui_control_modifiers.rs
@@ -18,6 +18,8 @@ fn frames(app: &mut EffectcraftApp) -> Vec<(bool, egui::Modifiers)> {
         if raw.events.is_empty() {
             break;
         }
+        // The harness feeds the batch itself; a real UI pass would apply it now.
+        app.mark_synthetic_applied();
         let mut button = false;
         for e in &raw.events {
             match e {
@@ -34,7 +36,26 @@ fn frames(app: &mut EffectcraftApp) -> Vec<(bool, egui::Modifiers)> {
 fn send(app: &mut EffectcraftApp, method: &str, params: Value) {
     let ctx = egui::Context::default();
     let (req, _rx) = ControlRequest::new(method, params);
-    let _ = control::handle(app, &ctx, &req);
+    let now = app.now();
+    let _ = control::handle(app, &ctx, &req, now);
+}
+
+#[test]
+fn control_gestures_reject_excessive_counts_without_queue_mutation() {
+    let mut app = EffectcraftApp::new(Session::default());
+    send(&mut app, "ui.click", json!({"x": 10, "y": 10, "count": u64::MAX}));
+    assert!(app.take_synthetic_input().is_empty(), "an oversized click must not partially queue input");
+
+    send(&mut app, "ui.drag", json!({"from": {"x": 10, "y": 10}, "to": {"x": 90, "y": 40}, "steps": u64::MAX}));
+    assert!(app.take_synthetic_input().is_empty(), "an oversized drag must not partially queue input");
+
+    send(&mut app, "ui.click", json!({"x": 10, "y": 10, "count": 512}));
+    send(&mut app, "ui.click", json!({"x": 10, "y": 10, "count": 512}));
+    assert_eq!(app.take_synthetic_input().len(), 2054, "two maximum accepted clicks fit under the aggregate cap");
+    for _ in 0..4 {
+        send(&mut app, "ui.click", json!({"x": 10, "y": 10, "count": 512}));
+    }
+    assert_eq!(app.take_synthetic_input().len(), 3081, "the pending event limit is enforced before requests can exceed it");
 }
 
 #[test]
diff --git a/crates/ui-egui/tests/it/ui_crypto_pick.rs b/crates/ui-egui/tests/it/ui_crypto_pick.rs
new file mode 100644
index 000000000..0d1767c7e
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_crypto_pick.rs
@@ -0,0 +1,1942 @@
+//! The Cryptomatte eyedropper (#473): the Selection's button arms it, the viewer names (and
+//! highlights) the ID under the cursor, and clicks pick into the Selection: plain replaces, Shift
+//! adds, Alt or Ctrl removes. It stays armed until Esc or the button. Checked over window and
+//! panel sizes, display scales, viewer zoom, pan and resolution, proxies, overlapping popups, and
+//! the asynchronous probe (hover and clicks before it is built, edits while it builds), playback
+//! and scrubbing, navigation tools, errors and disarming.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::keyframe::Value as KV;
+use effectcraft_engine::project::{LayerId, Resolution};
+use effectcraft_engine::raster::channels3d::{crypto_float, crypto_hash};
+use effectcraft_ui_egui::dock::{self, PanelKind, SplitSize};
+use effectcraft_ui_egui::panels::viewer::comp_to_screen;
+use effectcraft_ui_egui::state::Tool;
+use effectcraft_ui_egui::{Dialog, EffectcraftApp};
+use egui::{Event, Modifiers, PointerButton, Pos2, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+const READING: &str = "Reading Cryptomatte IDs…";
+const HINT: &str = "Click: replace · Shift: add · Alt or Ctrl: remove";
+const MAC_HINT: &str = "Click: replace · Shift: add · Option or Cmd: remove";
+const PAUSED: &str = "Stop playback to pick";
+
+/// The ID of the 37 × 29 px cell at pixel (x, y) of a full-size frame.
+pub(crate) fn cell(x: usize, y: usize) -> String {
+    format!("c{}_{}", x / 37, y / 29)
+}
+
+/// A `w` × `h` EXR (white RGBA) whose CryptoObject has an ID per cell of a `k`-times larger frame
+/// (`k` = 2: a half-size proxy), all named in its manifest.
+pub(crate) fn crypto_exr(dir: &std::path::Path, name: &str, w: usize, h: usize, k: usize) -> String {
+    use exr::prelude::*;
+    let ids: Vec<f32> = (0..w * h).map(|i| crypto_float(crypto_hash(&cell(i % w * k, i / w * k)))).collect();
+    let ch = |n: &str, v: Vec<f32>| AnyChannel::new(n, FlatSamples::F32(v));
+    let one = || vec![1.0f32; w * h];
+    let channels = AnyChannels::sort(
+        vec![ch("R", one()), ch("G", one()), ch("B", one()), ch("A", one()), ch("CryptoObject00.R", ids), ch("CryptoObject00.G", one())].into(),
+    );
+    let mut layer = Layer::new((w, h), LayerAttributes::default(), Encoding::FAST_LOSSLESS, channels);
+    let names: serde_json::Map<String, serde_json::Value> = (0..(w * k).div_ceil(37))
+        .flat_map(|x| (0..(h * k).div_ceil(29)).map(move |y| cell(x * 37, y * 29)))
+        .map(|n| (n.clone(), json!(format!("{:08x}", crypto_hash(&n)))))
+        .collect();
+    for (key, v) in [("name", "CryptoObject".to_string()), ("manifest", serde_json::Value::Object(names).to_string())] {
+        layer.attributes.other.insert(Text::from(format!("cryptomatte/f834d0a/{key}").as_str()), AttributeValue::Text(Text::from(v.as_str())));
+    }
+    let path = dir.join(name);
+    Image::from_layer(layer).write().to_file(&path).unwrap();
+    path.to_string_lossy().to_string()
+}
+
+struct Ids {
+    layer: u64,
+    sel: u64,
+    footage: u64,
+    dir: std::path::PathBuf,
+}
+
+/// A `w` × `h` comp with the EXR (and its half-size proxy file) under a Cryptomatte effect (after
+/// a heavy blur with `blur`: its probe then takes a while to build).
+fn crypto_session(tag: &str, w: usize, h: usize, blur: bool) -> (Session, Ids) {
+    let dir = std::env::temp_dir().join(format!("ec-ui-crypick-{tag}-{}", std::process::id()));
+    std::fs::create_dir_all(dir.join("proxy")).unwrap();
+    let path = crypto_exr(&dir, "plate.exr", w, h, 1);
+    crypto_exr(&dir.join("proxy"), "plate_proxy.exr", w.div_ceil(2), h.div_ceil(2), 2);
+    let mut s = effectcraft_host::session();
+    let r = s.execute("file.import", json!({"paths": [path]})).unwrap();
+    assert_eq!(r["errors"], json!([]), "{r}");
+    let footage = r["items"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Crypto", "width": w, "height": h, "frameRate": 24, "duration": 2})).unwrap();
+    let layer = s.execute("layer.addItem", json!({"item": footage})).unwrap()["layer"].as_u64().unwrap();
+    s.state.selected_layers = vec![LayerId(layer)];
+    if blur {
+        s.execute_checked("effect.apply", json!({"effect": "Gaussian Blur"})).unwrap();
+        s.execute_checked("prop.set", json!({"path": "effects/#1/blurriness", "value": 40.0})).unwrap();
+    }
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let fx = s.active_comp().unwrap().layers[0].effects().unwrap().groups().last().unwrap();
+    let sel = fx.get("selection").unwrap().uid;
+    (s, Ids { layer, sel, footage, dir })
+}
+
+/// The app with the Composition viewer and Effect Controls (`ec` points wide) side by side.
+fn harness(s: Session, size: egui::Vec2, ppp: f32, ec: f32) -> Harness<'static, EffectcraftApp> {
+    harness_dt(s, size, ppp, ec, 0.25)
+}
+
+/// [`harness`] whose steps advance the clock by `dt` seconds.
+fn harness_dt(s: Session, size: egui::Vec2, ppp: f32, ec: f32, dt: f32) -> Harness<'static, EffectcraftApp> {
+    let app = app(s, ec);
+    let mut h = Harness::builder().with_size(size).with_pixels_per_point(ppp).with_step_dt(dt).build_eframe(|_| app);
+    settle(&mut h);
+    h
+}
+
+fn app(s: Session, ec: f32) -> EffectcraftApp {
+    let mut app = EffectcraftApp::new(s);
+    app.ui.viewer.show_layer_controls = false;
+    app.ui.dock = dock::docked(dock::vsplit(
+        SplitSize::FixedSecond(160.0),
+        dock::hsplit(SplitSize::FixedSecond(ec), dock::tabs(&[PanelKind::Composition], 0), dock::tabs(&[PanelKind::EffectControls], 0)),
+        dock::tabs(&[PanelKind::Timeline], 0),
+    ));
+    app
+}
+
+pub(crate) fn settle(h: &mut Harness<'_, EffectcraftApp>) {
+    for _ in 0..1500 {
+        h.step();
+        if h.state().frames.inflight() == 0 && h.state().frames.last_ms.lock().is_ok_and(|v| *v > 0.0) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    h.run_steps(4);
+}
+
+pub(crate) fn chip(h: &Harness<'_, EffectcraftApp>) -> Option<String> {
+    h.state().auto.find("viewer.cryptoPick").map(|e| e.label.clone())
+}
+
+/// Step until the chip stops saying the probe is being built (the job runs on its own thread).
+pub(crate) fn wait_probe(h: &mut Harness<'_, EffectcraftApp>) {
+    for _ in 0..3000 {
+        h.step();
+        if chip(h).as_deref() != Some(READING) {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    panic!("the probe never finished");
+}
+
+fn hover(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2) -> String {
+    h.event(Event::PointerMoved(pos));
+    h.step();
+    wait_probe(h);
+    chip(h).unwrap_or_default()
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2, modifiers: Modifiers) {
+    h.event(Event::PointerMoved(pos));
+    h.event(Event::ModifiersChanged(modifiers));
+    h.step();
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers });
+        h.step();
+    }
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+    wait_probe(h);
+    h.run_steps(2);
+}
+
+pub(crate) fn at(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("missing {id}")).clone();
+    pos2(e.rect[0] + e.rect[2] * 0.5, e.rect[1] + e.rect[3] * 0.5)
+}
+
+fn selection(h: &Harness<'_, EffectcraftApp>, ids: &Ids) -> String {
+    let s = &h.state().session;
+    match &s.active_comp().unwrap().layer(LayerId(ids.layer)).unwrap().props.find(ids.sel).unwrap().value {
+        KV::Str(t) => t.clone(),
+        v => panic!("{v:?}"),
+    }
+}
+
+fn arm(h: &mut Harness<'_, EffectcraftApp>, ids: &Ids) {
+    let eye = at(h, &format!("effectControls.prop.{}.eyedropper", ids.sel));
+    click(h, eye, Modifiers::NONE);
+    assert!(h.state().ui.fx_pick.as_ref().is_some_and(|p| p.kind == "crypto" && p.prop == ids.sel), "armed");
+}
+
+/// The resolution of the frame the viewer shows: every n-th pixel (its key keeps thousandths).
+fn shown_scale(h: &Harness<'_, EffectcraftApp>) -> f64 {
+    let s = &h.state().session;
+    1.0 / (1000.0 / h.state().shown_series(s.active_comp_id().unwrap()).scale as f64).round()
+}
+
+/// The comp point the viewer maps screen point `p` to (its own arithmetic).
+fn to_comp(h: &Harness<'_, EffectcraftApp>, p: Pos2) -> [f64; 2] {
+    let (o, k) = (comp_to_screen(&h.ctx, [0.0, 0.0]).unwrap(), comp_to_screen(&h.ctx, [1000.0, 1000.0]).unwrap());
+    let z = (k - o) / 1000.0;
+    [((p.x - o.x) / z.x) as f64, ((p.y - o.y) / z.y) as f64]
+}
+
+/// The rendered matte of ID `name` (as the viewer renders the frame at `scale`) at comp point `p`.
+/// A downsampled proxy blends cells at their edges, so an edge pixel can be a mix of IDs.
+fn lit(h: &mut Harness<'_, EffectcraftApp>, name: &str, p: [f64; 2], scale: f64) -> f32 {
+    let s = &mut h.state_mut().session;
+    s.execute_checked("prop.set", json!({"path": "effects/#1/selection", "value": name})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let opts = effectcraft_engine::render::RenderOpts { roi: None, guides: false, ..h.state().frame_opts(cid, scale) };
+    let img = h.state().session.render(cid, effectcraft_engine::time::Tick::ZERO, opts);
+    img.get((p[0] * scale).floor() as i64, (p[1] * scale).floor() as i64)[0]
+}
+
+/// Whether ID `got` (a cell name) has the largest coverage of the shown pixel at comp point `p`
+/// (a downsampled or scaled layer blends the cells around it).
+fn largest(h: &mut Harness<'_, EffectcraftApp>, got: &str, p: [f64; 2], scale: f64) -> bool {
+    let v = lit(h, got, p, scale);
+    if v >= 0.5 {
+        return true;
+    }
+    let (cx, cy) = ((p[0] / 37.0).floor() as i64, (p[1] / 29.0).floor() as i64);
+    let others: Vec<String> =
+        (-2..=2).flat_map(|dx| (-2..=2).map(move |dy| (cx + dx, cy + dy))).filter(|c| c.0 >= 0 && c.1 >= 0).map(|c| format!("c{}_{}", c.0, c.1)).collect();
+    v > 0.0 && others.iter().filter(|o| *o != got).all(|o| lit(h, o, p, scale) <= v + 1e-4)
+}
+
+#[test]
+fn eyedropper_arms_hovers_picks_with_modifiers_and_stays_armed_until_esc() {
+    let (s, ids) = crypto_session("flow", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    let steps = h.state().session.history.undo.len();
+    arm(&mut h, &ids);
+    assert!(h.state().ui.status.contains("Shift adds"), "{}", h.state().ui.status);
+    let hint = comp_to_screen(&h.ctx, [-3.0, 90.0]).unwrap();
+    assert_eq!(hover(&mut h, hint), HINT, "off the layer: the hint");
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let b = comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap();
+    assert_eq!(hover(&mut h, a), "c1_1");
+    assert_eq!(hover(&mut h, b), "c3_3");
+    click(&mut h, a, Modifiers::NONE);
+    assert_eq!(selection(&h, &ids), "c1_1");
+    assert!(h.state().ui.status.contains("c1_1"), "{}", h.state().ui.status);
+    assert_eq!(hover(&mut h, a), "c1_1 (selected)");
+    click(&mut h, b, Modifiers::SHIFT);
+    assert_eq!((selection(&h, &ids), pick_steps(&h)), ("c1_1, c3_3".to_string(), 2));
+    click(&mut h, a, Modifiers::ALT);
+    assert_eq!(selection(&h, &ids), "c3_3");
+    click(&mut h, b, Modifiers::COMMAND);
+    assert_eq!(selection(&h, &ids), "");
+    // The modifiers of the press count: Shift let go before the button still adds.
+    click(&mut h, a, Modifiers::NONE);
+    h.event(Event::PointerMoved(b));
+    h.event(Event::ModifiersChanged(Modifiers::SHIFT));
+    h.step();
+    h.event(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::SHIFT });
+    h.step();
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+    h.event(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+    assert_eq!(selection(&h, &ids), "c1_1, c3_3", "Shift held at the press adds");
+    // On a Mac the hint says Option or Cmd, and Ctrl (no Cmd there) removes too.
+    h.ctx.set_os(egui::os::OperatingSystem::Mac);
+    assert_eq!(hover(&mut h, hint), MAC_HINT);
+    click(&mut h, a, Modifiers::CTRL);
+    assert_eq!(selection(&h, &ids), "c3_3", "Ctrl on a Mac");
+    h.ctx.set_os(egui::os::OperatingSystem::Nix);
+    click(&mut h, b, Modifiers::ALT);
+    assert_eq!(selection(&h, &ids), "");
+    assert_eq!(h.state().session.history.undo.len(), steps + 8, "one undo step per pick");
+    // The pointer leaves the viewer: the hint again.
+    let away = at(&h, &format!("effectControls.prop.{}.eyedropper", ids.sel)) + vec2(0.0, 60.0);
+    h.event(Event::PointerMoved(away));
+    h.run_steps(2);
+    assert_eq!(chip(&h).as_deref(), Some(HINT), "hover ends with the pointer away");
+    // Outside the layer: nothing to pick, no step; still armed.
+    let off = comp_to_screen(&h.ctx, [-30.0, 40.0]).unwrap();
+    if h.state().auto.find("viewer.fxPick").is_some_and(|e| off.x > e.rect[0]) {
+        click(&mut h, off, Modifiers::NONE);
+        assert_eq!(h.state().session.history.undo.len(), steps + 8);
+    }
+    assert!(h.state().ui.fx_pick.is_some(), "stays armed");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().ui.fx_pick.is_none(), "Esc ends it");
+    assert!(chip(&h).is_none());
+    // The button toggles it too.
+    arm(&mut h, &ids);
+    let eye = at(&h, &format!("effectControls.prop.{}.eyedropper", ids.sel));
+    click(&mut h, eye, Modifiers::NONE);
+    assert!(h.state().ui.fx_pick.is_none());
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Window and panel sizes × display scales × viewer zoom / pan × Resolution (and a proxy): hover
+/// and click name the ID of the pixel the viewer shows, next to cell edges too. Each hover is
+/// checked against the rendered matte of the named ID at the point the screen maps back to.
+#[test]
+fn picks_what_the_viewer_shows_across_sizes_scales_zoom_pan_resolution_and_proxies() {
+    let mut checked = 0;
+    let mut failures = vec![];
+    let cases = [(vec2(900.0, 640.0), 1.0, 300.0), (vec2(1280.0, 720.0), 1.25, 420.0), (vec2(1600.0, 1000.0), 1.5, 360.0), (vec2(2400.0, 1400.0), 2.0, 600.0)];
+    for (i, (size, ppp, ec)) in cases.into_iter().enumerate() {
+        let (s, ids) = crypto_session(&format!("matrix{i}"), 1919, 1079, false);
+        let mut h = harness(s, size, ppp, ec);
+        h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap();
+        arm(&mut h, &ids);
+        for proxy in [false, true] {
+            if proxy {
+                let p = ids.dir.join("proxy").join("plate_proxy.exr");
+                h.state_mut().session.execute("file.setProxy", json!({"item": ids.footage, "path": p.to_string_lossy()})).unwrap();
+            }
+            for res in [Resolution::Full, Resolution::Half, Resolution::Third, Resolution::Quarter, Resolution::Custom(6)] {
+                for (zoom, pan) in [(None, [0.0, 0.0]), (Some(0.5), [0.0, 0.0]), (Some(2.0), [-300.0, 120.0])] {
+                    let cid = h.state().session.active_comp_id().unwrap();
+                    h.state_mut().session.set_resolution(cid, res).unwrap();
+                    h.state_mut().ui.viewer.zoom = zoom.map(|z: f32| z / ppp);
+                    h.state_mut().ui.viewer.pan = pan;
+                    settle(&mut h);
+                    let area = h.state().auto.find("viewer.fxPick").unwrap().rect;
+                    let scale = shown_scale(&h);
+                    // Points next to cell edges, in the middle and at the far corner.
+                    // (Cell edges far from the origin: 925, 1044 shows the 1/3 vs 0.333 rounding.)
+                    for p in [[36.6, 28.7], [37.4, 29.3], [959.7, 539.2], [1918.4, 1078.6], [74.1, 57.9], [925.4, 1044.4], [1110.6, 1043.6]] {
+                        let Some(sp) = comp_to_screen(&h.ctx, [p[0] as f32, p[1] as f32]) else { continue };
+                        if sp.x < area[0] + 4.0 || sp.y < area[1] + 40.0 || sp.x > area[0] + area[2] - 4.0 || sp.y > area[1] + area[3] - 4.0 {
+                            continue;
+                        }
+                        let got = hover(&mut h, sp);
+                        let got = got.trim_end_matches(" (selected)").to_string();
+                        // The comp point under the cursor, as the viewer maps it back.
+                        let q = to_comp(&h, sp);
+                        checked += 1;
+                        // The named ID has the largest coverage of the shown pixel (a blended edge
+                        // pixel of a proxy at Quarter has several). No ID named: the frame shows
+                        // (almost) no matte there either (an odd size's last half-resolution pixel
+                        // samples just outside the layer).
+                        let ok = if got.starts_with('c') { largest(&mut h, &got, q, scale) } else { got == HINT && lit(&mut h, "*", q, scale) < 0.5 };
+                        if !ok {
+                            failures.push(format!(
+                                "{size:?} ppp {ppp} proxy {proxy} {res:?} zoom {zoom:?} (scale {scale}): at {q:?} hover {got:?} is not lit there"
+                            ));
+                        }
+                    }
+                }
+            }
+            // Frames from Cache Frames When Idle (the first case): rendered on the grid the
+            // viewer renders and the pick reads (1/3, not the key's 0.333), so frame 20 from the
+            // idle cache is frame 0 as the viewer rendered it, and hovers there are right too.
+            if i == 0 && !proxy {
+                (h.state_mut().ui.viewer.zoom, h.state_mut().ui.viewer.pan) = (None, [0.0, 0.0]);
+                for res in [Resolution::Third, Resolution::Custom(6)] {
+                    let fails = idle_cached_frames_are_shown_frames(&mut h, res);
+                    checked += 1;
+                    failures.extend(fails);
+                }
+            }
+            // A click picks what the hover named.
+            (h.state_mut().ui.viewer.zoom, h.state_mut().ui.viewer.pan) = (None, [0.0, 0.0]);
+            settle(&mut h);
+            let sp = comp_to_screen(&h.ctx, [959.7, 539.2]).unwrap();
+            let named = hover(&mut h, sp);
+            click(&mut h, sp, Modifiers::NONE);
+            assert_eq!(selection(&h, &ids), named.trim_end_matches(" (selected)"));
+            if proxy {
+                h.state_mut().session.execute("file.setProxy", json!({"item": ids.footage, "path": null})).ok();
+            }
+        }
+        let _ = std::fs::remove_dir_all(&ids.dir);
+    }
+    assert!(failures.is_empty(), "{} of {checked} hovers wrong:\n{}", failures.len(), failures.join("\n"));
+    assert!(checked > 100, "{checked}");
+}
+
+fn set_frame(h: &mut Harness<'_, EffectcraftApp>, f: i64) {
+    h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(f as f64 / 24.0));
+}
+
+/// The viewer's CPU frame `f` of the series shown.
+fn cpu_frame(h: &Harness<'_, EffectcraftApp>, f: i64) -> Option<([usize; 2], Vec<egui::Color32>)> {
+    let key = h.state().shown_series(h.state().session.active_comp_id().unwrap());
+    match h.state().frames.get_for_viewer(&effectcraft_ui_egui::frames::FrameKey { frame: f, ..key }, None) {
+        Some((_, effectcraft_ui_egui::frames::FrameImage::Cpu(c))) => Some((c.size, c.pixels.clone())),
+        _ => None,
+    }
+}
+
+/// At `res`, with the Colors display: frame 20 cached when idle against frame 0 rendered by the
+/// viewer (the footage is a still), then hovers on frame 20. Returns what is wrong.
+fn idle_cached_frames_are_shown_frames(h: &mut Harness<'_, EffectcraftApp>, res: Resolution) -> Vec<String> {
+    let cid = h.state().session.active_comp_id().unwrap();
+    let display = h.state().session.active_comp().unwrap().layers[0].effects().unwrap().groups().last().unwrap().get("display").unwrap().value.to_json();
+    h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": false})).unwrap();
+    h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/display", "value": 0})).unwrap();
+    h.state_mut().session.set_resolution(cid, res).unwrap();
+    set_frame(h, 0);
+    settle(h);
+    let shown = cpu_frame(h, 0).expect("frame 0 shown");
+    h.state_mut().ui.cache_when_idle = true;
+    for _ in 0..2000 {
+        h.step();
+        let key = h.state().shown_series(cid);
+        if h.state().frames.is_cached(&effectcraft_ui_egui::frames::FrameKey { frame: 20, ..key }) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    h.state_mut().ui.cache_when_idle = false;
+    let mut out = vec![];
+    match cpu_frame(h, 20) {
+        None => out.push(format!("{res:?}: frame 20 was never cached when idle")),
+        Some(c) if c.0 != shown.0 => out.push(format!("{res:?}: the idle cache rendered {:?}, the viewer {:?}", c.0, shown.0)),
+        Some(c) if c.1 != shown.1 => out.push(format!("{res:?}: the idle-cached frame differs from the viewer's")),
+        Some(_) => {}
+    }
+    h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap();
+    h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/display", "value": display})).unwrap();
+    set_frame(h, 20);
+    settle(h);
+    let scale = shown_scale(h);
+    for p in [[959.7, 539.2], [925.4, 1044.4], [1110.6, 1043.6]] {
+        let sp = comp_to_screen(&h.ctx, [p[0] as f32, p[1] as f32]).unwrap();
+        let got = hover(h, sp).trim_end_matches(" (selected)").to_string();
+        let q = to_comp(h, sp);
+        if !(got.starts_with('c') && largest(h, &got, q, scale)) {
+            out.push(format!("{res:?} idle-cached frame 20: at {q:?} hover {got:?} is not lit there"));
+        }
+    }
+    set_frame(h, 0);
+    settle(h);
+    out
+}
+
+/// Press and release at `pos` without waiting for the probe.
+fn press(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2) {
+    h.event(Event::PointerMoved(pos));
+    h.run_steps(2);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+}
+
+/// An edit that drops the probe: the blur before the Cryptomatte effect changes, so the next
+/// hover or click has to render it again to build the probe.
+/// (Each blurriness `v` once: an earlier one would come from the layer cache.)
+fn edit(h: &mut Harness<'_, EffectcraftApp>, v: f64) {
+    h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/blurriness", "value": v})).unwrap();
+}
+
+/// Let a probe still being built finish with nothing waiting on it.
+fn drain(h: &mut Harness<'_, EffectcraftApp>) {
+    for _ in 0..100 {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(20));
+    }
+}
+
+/// Waiting clicks: the first hover starts the probe; a click made meanwhile waits then picks;
+/// an edit, Esc, disarming, or hiding the viewer while it waits drops it.
+/// Each section's probe build is held (`hold` / `log`) across its "while reading" / "waits"
+/// asserts and the action that drops the click, then released before `wait_probe` / `drain` /
+/// `hover` so a held build can finish.
+fn waiting_clicks_are_dropped_by_edits_esc_disarm_and_hiding_the_viewer(
+    h: &mut Harness<'_, EffectcraftApp>,
+    ids: &Ids,
+    a: Pos2,
+    b: Pos2,
+    hold: &std::sync::atomic::AtomicBool,
+    log: &ReadLog,
+) {
+    use std::sync::atomic::Ordering;
+    // A click before the probe is built waits for it.
+    // (egui reports the hover a pass after the pointer moves.)
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    h.event(Event::PointerMoved(a));
+    h.run_steps(2);
+    wait_held_id_read(h, log);
+    assert_eq!(chip(h).as_deref(), Some(READING), "the first hover starts the probe off the UI thread");
+    press(h, a);
+    assert_eq!(selection(h, ids), "", "the click waits");
+    hold.store(false, Ordering::Release);
+    wait_probe(h);
+    h.run_steps(2);
+    assert_eq!(selection(h, ids), "c27_20", "then picks");
+    assert_eq!(hover(h, b), "c50_40");
+    let steps = h.state().session.history.undo.len();
+    // An edit while a click waits drops the click.
+    // edit(41) drops the probe; press starts a new build (held). edit(42) cancels that build and
+    // drops the click — release so the cancelled build can leave the hold, then wait_probe.
+    edit(h, 41.0);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    press(h, b);
+    wait_held_id_read(h, log);
+    assert_eq!(chip(h).as_deref(), Some(READING));
+    edit(h, 42.0);
+    hold.store(false, Ordering::Release);
+    wait_probe(h);
+    h.run_steps(2);
+    assert_eq!(selection(h, ids), "c27_20", "not picked after the edit");
+    assert_eq!(h.state().session.history.undo.len(), steps + 2, "only the two edits");
+    // Esc while a click waits: no pick, disarmed. Hold the build started by press; Esc cancels it.
+    edit(h, 43.0);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    press(h, b);
+    wait_held_id_read(h, log);
+    assert_eq!(chip(h).as_deref(), Some(READING));
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().ui.fx_pick.is_none() && chip(h).is_none());
+    hold.store(false, Ordering::Release);
+    drain(h);
+    assert_eq!(selection(h, ids), "c27_20");
+    // Disarmed while a click waits, then armed again: the old click is not made.
+    // arm() waits the probe — hold only after arming, across the READING assert and disarm.
+    edit(h, 44.0);
+    arm(h, ids);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    press(h, b);
+    wait_held_id_read(h, log);
+    assert_eq!(chip(h).as_deref(), Some(READING));
+    h.state_mut().ui.fx_pick = None;
+    h.run_steps(2);
+    hold.store(false, Ordering::Release);
+    arm(h, ids);
+    drain(h);
+    assert_eq!(selection(h, ids), "c27_20", "the old click stays unmade");
+    assert_eq!(hover(h, b), "c50_40", "still picks");
+    // The viewer hidden while a click waits (Effect Controls maximised), then shown again: the
+    // pick still on, the old click is not made either.
+    edit(h, 45.0);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    press(h, b);
+    wait_held_id_read(h, log);
+    assert_eq!(chip(h).as_deref(), Some(READING));
+    h.state_mut().ui.maximized = Some(PanelKind::EffectControls);
+    h.run_steps(2);
+    assert!(h.state().auto.find("viewer.fxPick").is_none(), "the viewer is hidden");
+    hold.store(false, Ordering::Release);
+    drain(h);
+    h.state_mut().ui.maximized = None;
+    h.run_steps(2);
+    drain(h);
+    assert!(h.state().ui.fx_pick.is_some());
+    assert_eq!(selection(h, ids), "c27_20", "the click made before the viewer was hidden stays unmade");
+}
+
+/// Popups and dialogs over the viewer take the pointer. Another selected layer keeps the pick;
+/// deleting the layer or switching comps ends it.
+fn popups_dialogs_and_comp_switches_end_or_block_them(h: &mut Harness<'_, EffectcraftApp>, ids: &Ids, b: Pos2) {
+    // A popup over the viewer takes the pointer: no hover, its click is its own.
+    let area = h.state().auto.find("viewer.fxPick").unwrap().rect;
+    let inside = |p: Pos2| p.x > area[0] && p.y > area[1] && p.x < area[0] + area[2] && p.y < area[1] + area[3];
+    let res = at(h, "viewer.resolution");
+    click(h, res, Modifiers::NONE);
+    let item = at(h, "viewer.resolutionItem.0");
+    assert!(inside(item), "the Resolution popup is over the viewer: {item:?} {area:?}");
+    assert_eq!(hover(h, item), HINT, "nothing hovered under the popup");
+    click(h, item, Modifiers::NONE);
+    settle(h);
+    assert_eq!(h.state().viewer_res(), effectcraft_ui_egui::state::Resolution::Full);
+    assert_eq!(selection(h, ids), "c27_20", "the popup's click picked nothing");
+    assert!(h.state().ui.fx_pick.is_some(), "still armed");
+    assert_eq!(hover(h, b), "c50_40");
+    // A click on the viewer while the popup is open only closes the popup.
+    click(h, res, Modifiers::NONE);
+    assert!(h.state().auto.find("viewer.resolutionItem.0").is_some(), "open again");
+    click(h, b, Modifiers::SHIFT);
+    assert!(h.state().auto.find("viewer.resolutionItem.0").is_none(), "closed");
+    assert_eq!(selection(h, ids), "c27_20", "the closing click picked nothing");
+    // So does a dialog.
+    h.state_mut().dialog = Some(Dialog::CompSettings);
+    h.run_steps(3);
+    let d = at(h, "dialog.comp.name");
+    assert!(inside(d), "the dialog is over the viewer: {d:?} {area:?}");
+    assert_eq!(hover(h, d), HINT, "nothing hovered under the dialog");
+    h.state_mut().dialog = None;
+    h.run_steps(2);
+    // Another layer selected: the pick stays with its layer.
+    let solid = h.state_mut().session.execute("layer.newSolid", json!({"name": "Other", "width": 64, "height": 64})).unwrap()["layer"].as_u64().unwrap();
+    h.state_mut().session.state.selected_layers = vec![LayerId(solid)];
+    settle(h);
+    assert!(h.state().ui.fx_pick.as_ref().is_some_and(|p| p.layer == ids.layer));
+    click(h, b, Modifiers::SHIFT);
+    assert_eq!(selection(h, ids), "c27_20, c50_40");
+    // The layer deleted: the pick ends; undone, it is not armed again.
+    h.state_mut().session.state.selected_layers = vec![LayerId(ids.layer)];
+    h.state_mut().session.execute_checked("edit.clear", json!({"layers": [ids.layer]})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().ui.fx_pick.is_none() && chip(h).is_none(), "ended with its layer");
+    h.state_mut().session.execute_checked("edit.undo", json!({})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().ui.fx_pick.is_none());
+    // Another comp: the pick ends.
+    h.state_mut().session.state.selected_layers = vec![LayerId(ids.layer)];
+    h.run_steps(3);
+    arm(h, ids);
+    h.state_mut().session.execute("comp.new", json!({"name": "Other", "width": 320, "height": 180, "duration": 2})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().ui.fx_pick.is_none() && chip(h).is_none(), "ended with the comp switch");
+}
+
+/// The asynchronous probe (a 4K plate behind a blur; each "while reading" section holds the
+/// build): the first hover says it is reading, a click made meanwhile waits and then picks; an
+/// edit, Esc or disarming while it waits drops it. Popups and dialogs over the viewer take the
+/// pointer. Another selected layer keeps the pick; deleting the layer or switching comps ends it.
+#[test]
+fn clicks_wait_for_the_probe_and_edits_popups_dialogs_and_comp_switches_end_or_block_them() {
+    let (mut s, ids) = crypto_session("async", 3840, 2160, true);
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let log = ReadLog::default();
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), log.clone()));
+    let mut h = harness(s, vec2(1280.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let (a, b) = (comp_to_screen(&h.ctx, [1017.5, 594.5]).unwrap(), comp_to_screen(&h.ctx, [1868.5, 1174.5]).unwrap());
+    waiting_clicks_are_dropped_by_edits_esc_disarm_and_hiding_the_viewer(&mut h, &ids, a, b, &hold, &log);
+    popups_dialogs_and_comp_switches_end_or_block_them(&mut h, &ids, b);
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// On the GPU compositor (egui_kittest with wgpu on the headless compositor's adapter, as in
+/// `ui_gpu.rs`; lavapipe on CI-like boxes): hover and click name what the GPU viewer shows, at
+/// each Resolution. Skips without a GPU adapter.
+#[test]
+fn picks_on_the_gpu_viewer() {
+    let Some(probe) = effectcraft_gpu::Gpu::headless() else {
+        eprintln!("no GPU adapter: skipping");
+        return;
+    };
+    let adapter = effectcraft_engine::render::Accelerator::name(&probe);
+    drop(probe);
+    let mut setup = egui_kittest::wgpu::default_wgpu_setup();
+    if let eframe::egui_wgpu::WgpuSetup::CreateNew(c) = &mut setup {
+        let name = adapter.clone();
+        c.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, _| {
+            adapters
+                .iter()
+                .find(|a| format!("{} ({:?})", a.get_info().name, a.get_info().backend) == name)
+                .or(adapters.first())
+                .cloned()
+                .ok_or_else(|| "no adapter".to_owned())
+        }));
+    }
+    let (s, ids) = crypto_session("gpu", 1919, 1079, false);
+    let app = app(s, 420.0);
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).with_pixels_per_point(1.0).wgpu_setup(setup).build_eframe(|_| app);
+    settle(&mut h);
+    if h.state().gpu_adapter().is_none() {
+        eprintln!("the viewer stayed on the CPU ({adapter}): skipping");
+        return;
+    }
+    eprintln!("GPU viewer on {:?}", h.state().gpu_adapter());
+    h.state_mut().session.execute_checked("prop.set", json!({"path": "effects/#1/matteOnly", "value": true})).unwrap();
+    arm(&mut h, &ids);
+    let mut checked = 0;
+    for res in [Resolution::Full, Resolution::Half, Resolution::Third, Resolution::Quarter] {
+        let cid = h.state().session.active_comp_id().unwrap();
+        h.state_mut().session.set_resolution(cid, res).unwrap();
+        settle(&mut h);
+        let scale = shown_scale(&h);
+        for p in [[36.6, 28.7], [37.4, 29.3], [959.7, 539.2], [925.4, 1044.4]] {
+            let sp = comp_to_screen(&h.ctx, [p[0] as f32, p[1] as f32]).unwrap();
+            let got = hover(&mut h, sp).trim_end_matches(" (selected)").to_string();
+            let q = to_comp(&h, sp);
+            assert!(got.starts_with('c') && lit(&mut h, &got, q, scale) >= 0.5, "{res:?}: at {q:?} hover {got:?} is not lit there");
+            checked += 1;
+        }
+    }
+    let sp = comp_to_screen(&h.ctx, [959.7, 539.2]).unwrap();
+    let named = hover(&mut h, sp);
+    // The highlight is drawn: a pixel of the hovered ID (just up-left of the pointer) is tinted
+    // while hovered, not with the pointer off the layer (the frame itself unchanged).
+    settle(&mut h);
+    let px = |h: &mut Harness<'_, EffectcraftApp>| *h.render().expect("render").get_pixel(sp.x as u32 - 2, sp.y as u32 - 2);
+    let lit_px = px(&mut h);
+    let off = comp_to_screen(&h.ctx, [-3.0, 540.0]).unwrap_or(pos2(2.0, 2.0));
+    hover(&mut h, off);
+    let plain = px(&mut h);
+    assert_eq!(hover(&mut h, sp), named);
+    assert_eq!(px(&mut h), lit_px, "the same frame");
+    assert_ne!(lit_px, plain, "the highlight tints the hovered ID");
+    click(&mut h, sp, Modifiers::NONE);
+    assert_eq!(selection(&h, &ids), named.trim_end_matches(" (selected)"));
+    assert_eq!(checked, 16);
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// How many probes the session built so far, and whether one is kept.
+/// Waits until the build thread started after `jobs` jobs has counted itself (it may not have
+/// run yet when the pass that spawned it returns).
+fn started(h: &Harness<'_, EffectcraftApp>, jobs: u64) {
+    for _ in 0..2500 {
+        if h.state().session.crypto_probe_jobs() > jobs {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    panic!("no build started");
+}
+
+fn builds(h: &Harness<'_, EffectcraftApp>) -> u64 {
+    h.state().session.crypto_probe_stats().1
+}
+
+/// Clicks made while the IDs are being read (a 4K plate behind a blur; the build is held until
+/// the clicks are checked) are all made, in order, once they are.
+#[test]
+fn every_click_made_while_reading_is_made_in_order() {
+    use std::sync::atomic::Ordering;
+    let (mut s, ids) = crypto_session("multi", 3840, 2160, true);
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let log = ReadLog::default();
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), log.clone()));
+    let mut h = harness(s, vec2(1280.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let (a, b) = (comp_to_screen(&h.ctx, [1017.5, 594.5]).unwrap(), comp_to_screen(&h.ctx, [1868.5, 1174.5]).unwrap());
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    h.event(Event::PointerMoved(a));
+    h.run_steps(2);
+    wait_held_id_read(&mut h, &log);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    let steps = h.state().session.history.undo.len();
+    for (p, m) in [(a, Modifiers::NONE), (b, Modifiers::SHIFT), (a, Modifiers::ALT), (a, Modifiers::SHIFT)] {
+        h.event(Event::PointerMoved(p));
+        h.event(Event::ModifiersChanged(m));
+        h.step();
+        for pressed in [true, false] {
+            h.event(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed, modifiers: m });
+            h.step();
+        }
+        h.event(Event::ModifiersChanged(Modifiers::NONE));
+        h.step();
+    }
+    assert_eq!(chip(&h).as_deref(), Some(READING), "all four made while reading");
+    assert_eq!(selection(&h, &ids), "");
+    hold.store(false, Ordering::Release);
+    wait_probe(&mut h);
+    h.run_steps(3);
+    assert_eq!(selection(&h, &ids), "c50_40, c27_20", "replace, add, remove, add, in order");
+    assert_eq!(h.state().session.history.undo.len(), steps + 4);
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A click that drifts past egui's drag threshold still picks at its press, and the Selection
+/// tool under the pick never moves the layer.
+#[test]
+fn a_drifting_click_picks_and_never_moves_the_layer() {
+    let (s, ids) = crypto_session("drag", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    assert_eq!(hover(&mut h, a), "c1_1");
+    let position = |h: &Harness<'_, EffectcraftApp>| {
+        format!(
+            "{:?}",
+            h.state().session.active_comp().unwrap().layer(LayerId(ids.layer)).unwrap().transform().and_then(|t| t.get("position")).map(|p| p.value.clone())
+        )
+    };
+    let (steps, before) = (h.state().session.history.undo.len(), position(&h));
+    let drag = |h: &mut Harness<'_, EffectcraftApp>, to: egui::Vec2| {
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.step();
+        for k in 1..=4 {
+            h.event(Event::PointerMoved(a + to * k as f32 / 4.0));
+            h.step();
+        }
+        h.event(Event::PointerButton { pos: a + to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(3);
+    };
+    drag(&mut h, vec2(12.0, 0.0));
+    assert_eq!(selection(&h, &ids), "c1_1", "picked at the press");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1, "only the pick");
+    // A real drag picks nothing and moves nothing either.
+    drag(&mut h, vec2(120.0, 40.0));
+    assert_eq!((h.state().session.history.undo.len(), position(&h)), (steps + 1, before), "the layer stays put");
+    assert_eq!(h.state().ui.status, "Drag cancelled the pick", "not silently");
+    assert!(h.state().ui.fx_pick.is_some());
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Frame steps on a still (behind a blur that isn't animated) reuse the probe: no re-read.
+#[test]
+fn frame_steps_on_a_still_reuse_the_probe() {
+    let (s, ids) = crypto_session("time", 3840, 2160, true);
+    let mut h = harness(s, vec2(1280.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [1017.5, 594.5]).unwrap();
+    assert_eq!(hover(&mut h, a), "c27_20");
+    let n = builds(&h);
+    for f in 1..=4 {
+        h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(f as f64 / 24.0));
+        h.run_steps(2);
+        assert_eq!(chip(&h).as_deref(), Some("c27_20"), "frame {f}");
+    }
+    assert_eq!(builds(&h), n, "no probe built for the frame steps");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// With an animated blur before the Cryptomatte effect each frame needs its own probe: none is
+/// built while playing, and a scrub builds one once it settles, not one per frame.
+#[test]
+fn no_probe_builds_while_playing_and_one_per_settled_scrub() {
+    let (mut s, ids) = crypto_session("play", 960, 540, true);
+    for (t, v) in [(0.0, 2.0), (1.0, 6.0)] {
+        s.execute_checked("prop.addKey", json!({"path": "effects/#1/blurriness", "time": t, "value": v})).unwrap();
+    }
+    let mut h = harness_dt(s, vec2(1280.0, 800.0), 1.0, 420.0, 0.02);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [260.0, 150.0]).unwrap();
+    assert_eq!(hover(&mut h, a), "c7_5");
+    let n = builds(&h);
+    let set = |h: &mut Harness<'_, EffectcraftApp>, f: i64| h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(f as f64 / 24.0));
+    // Scrubbing: a frame per 20 ms step; nothing built until it stays put for a while.
+    // (The viewer names what it shows: a new frame takes a step or two to arrive.)
+    let mut read = false;
+    for f in 1..=6 {
+        set(&mut h, f);
+        h.run_steps(2);
+        read |= chip(&h).as_deref() == Some(READING);
+    }
+    assert!(read, "the scrub reached frames without a probe");
+    assert_eq!(builds(&h), n, "no build while scrubbing");
+    wait_probe(&mut h);
+    assert_eq!(chip(&h).as_deref(), Some("c7_5"));
+    assert_eq!(builds(&h), n + 1, "one build for the settled frame");
+    // Playing: no builds, the chip says why; stopped, it reads.
+    h.state_mut().playback.playing = true;
+    set(&mut h, 9);
+    for _ in 0..20 {
+        h.step();
+    }
+    assert_eq!(chip(&h).as_deref(), Some(PAUSED));
+    assert_eq!(builds(&h), n + 1, "no build while playing");
+    // An audio-only preview plays with the frame held: still no builds.
+    let now = h.ctx.input(|i| i.time);
+    let pb = &mut h.state_mut().playback;
+    (pb.start_wall, pb.start_frame) = (now, 9);
+    pb.plan = Some(effectcraft_engine::preview::PreviewPlan {
+        start: 0,
+        end: 47,
+        first: 9,
+        step: 1,
+        fps: 24.0,
+        looping: true,
+        cache_first: false,
+        video: false,
+        audio: true,
+        origin: effectcraft_engine::time::Tick::ZERO,
+    });
+    for _ in 0..20 {
+        h.step();
+    }
+    assert!(h.state().playback.playing);
+    assert_eq!(chip(&h).as_deref(), Some(PAUSED));
+    assert_eq!(builds(&h), n + 1, "no build while an audio preview holds the frame");
+    h.state_mut().playback.plan = None;
+    h.state_mut().playback.playing = false;
+    h.run_steps(2);
+    wait_probe(&mut h);
+    assert_eq!(chip(&h).as_deref(), Some("c7_5"));
+    assert_eq!(builds(&h), n + 2);
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Disarming lets go of the probe (and the aux channels it holds): Esc, the button, or the pick
+/// ending any other way.
+#[test]
+fn disarming_releases_the_probe() {
+    let (s, ids) = crypto_session("release", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let kept = |h: &Harness<'_, EffectcraftApp>| h.state().session.crypto_probe_stats().0;
+    for how in ["esc", "button", "other"] {
+        arm(&mut h, &ids);
+        assert_eq!(hover(&mut h, a), "c1_1");
+        assert!(kept(&h), "{how}: kept while armed");
+        match how {
+            "esc" => h.key_press(egui::Key::Escape),
+            "button" => {
+                let eye = at(&h, &format!("effectControls.prop.{}.eyedropper", ids.sel));
+                click(&mut h, eye, Modifiers::NONE);
+            }
+            _ => h.state_mut().ui.fx_pick = None,
+        }
+        h.run_steps(2);
+        assert!(h.state().ui.fx_pick.is_none() && !kept(&h), "{how}: released");
+    }
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Space (the temporary Hand) and the Hand and Zoom tools keep their clicks: no pick.
+#[test]
+fn space_hand_and_zoom_clicks_do_not_pick() {
+    let (s, ids) = crypto_session("nav", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    assert_eq!(hover(&mut h, a), "c1_1");
+    let space = |pressed| Event::Key { key: egui::Key::Space, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE };
+    h.event(space(true));
+    h.step();
+    click(&mut h, a, Modifiers::NONE);
+    h.event(space(false));
+    h.run_steps(2);
+    assert_eq!(selection(&h, &ids), "", "Space + click");
+    for tool in [Tool::Zoom, Tool::Hand] {
+        h.state_mut().ui.tool = tool;
+        h.run_steps(2);
+        let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+        click(&mut h, a, Modifiers::NONE);
+        assert_eq!(selection(&h, &ids), "", "{tool:?} click");
+    }
+    h.state_mut().ui.tool = Tool::Selection;
+    h.run_steps(2);
+    // The middle button pans, armed as unarmed; the right button opens the viewer's menu.
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let pan0 = h.state().ui.viewer.pan;
+    h.event(Event::PointerMoved(a));
+    h.run_steps(2);
+    h.event(Event::PointerButton { pos: a, button: PointerButton::Middle, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=5 {
+        h.event(Event::PointerMoved(a + vec2(10.0 * k as f32, 0.0)));
+        h.step();
+    }
+    h.event(Event::PointerButton { pos: a + vec2(50.0, 0.0), button: PointerButton::Middle, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+    let pan = h.state().ui.viewer.pan;
+    assert!((pan[0] - pan0[0] - 50.0).abs() < 1.0 && (pan[1] - pan0[1]).abs() < 1.0, "a middle drag pans: {pan0:?} -> {pan:?}");
+    assert!(h.state().ui.fx_pick.is_some() && selection(&h, &ids).is_empty(), "and picks nothing");
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    h.event(Event::PointerMoved(a));
+    h.run_steps(2);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(3);
+    assert!(egui::Popup::is_any_open(&h.ctx), "a right-click opens the viewer's context menu");
+    assert!(h.state().ui.fx_pick.is_some() && selection(&h, &ids).is_empty(), "and picks nothing");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    assert!(!egui::Popup::is_any_open(&h.ctx));
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    click(&mut h, a, Modifiers::NONE);
+    assert_eq!(selection(&h, &ids), "c1_1", "the Selection tool picks");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A layer without Cryptomatte channels says so on hover, in a chip no wider than allowed (the
+/// long message ends in an ellipsis; the whole text stays in its automation label).
+#[test]
+fn a_layer_without_cryptomatte_shows_the_error_in_a_bounded_chip() {
+    let (mut s, ids) = crypto_session("nocrypto", 320, 180, false);
+    let solid = s.execute("layer.newSolid", json!({"name": "Plain", "width": 320, "height": 180})).unwrap()["layer"].as_u64().unwrap();
+    s.state.selected_layers = vec![LayerId(solid)];
+    s.execute_checked("effect.apply", json!({"layers": [solid], "effect": "Cryptomatte"})).unwrap();
+    let sel = s.active_comp().unwrap().layer(LayerId(solid)).unwrap().effects().unwrap().groups().next().unwrap().get("selection").unwrap().uid;
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &Ids { layer: solid, sel, footage: ids.footage, dir: ids.dir.clone() });
+    let p = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let got = hover(&mut h, p);
+    // The message for the user, without the command's prefix, whole (its hint included).
+    assert_eq!(got, "This layer has no Cryptomatte channels (a multi-layer OpenEXR with Cryptomatte, or a 3D precomp)");
+    let w = h.state().auto.find("viewer.cryptoPick").unwrap().rect[2];
+    assert!(w <= 480.0 + 24.0, "chip {w} wide");
+    let e = h.state().auto.find("viewer.cryptoPick.error").expect("shown as an error");
+    assert_eq!(e.label, "whole", "the error isn't cut off");
+    // A narrow viewer still shows it whole, on more lines.
+    h.set_size(vec2(760.0, 800.0));
+    h.run_steps(4);
+    let e = h.state().auto.find("viewer.cryptoPick.error").expect("shown as an error").clone();
+    assert!(e.label == "whole" && e.rect[3] > 30.0, "{e:?}");
+    // Narrower still (a viewer about 200 px wide): more lines, still whole.
+    h.set_size(vec2(630.0, 800.0));
+    h.run_steps(4);
+    let q = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    hover(&mut h, q);
+    let e = h.state().auto.find("viewer.cryptoPick.error").expect("shown as an error").clone();
+    assert_eq!(e.label, "whole", "{e:?} in a viewer {} wide", h.state().auto.find("viewer.fxPick").map_or(0.0, |v| v.rect[2]));
+    // A click there: the same message in the status line.
+    click(&mut h, q, Modifiers::NONE);
+    assert!(h.state().ui.status.starts_with("This layer has no Cryptomatte channels"), "{}", h.state().ui.status);
+    // A hover with an answer isn't an error.
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Footage whose Cryptomatte reader panics on the probe's thread.
+struct Broken(std::sync::Arc<dyn effectcraft_engine::render::FootageSource>);
+impl effectcraft_engine::render::FootageSource for Broken {
+    fn frame(
+        &self,
+        i: effectcraft_engine::project::ItemId,
+        f: &effectcraft_engine::project::Footage,
+        t: effectcraft_engine::time::Tick,
+    ) -> Option<std::sync::Arc<effectcraft_engine::raster::Image>> {
+        self.0.frame(i, f, t)
+    }
+    fn frame_with(
+        &self,
+        i: effectcraft_engine::project::ItemId,
+        f: &effectcraft_engine::project::Footage,
+        t: effectcraft_engine::time::Tick,
+        size: Option<(u32, u32)>,
+        float: effectcraft_engine::render::FloatCurve,
+    ) -> Option<std::sync::Arc<effectcraft_engine::raster::Image>> {
+        self.0.frame_with(i, f, t, size, float)
+    }
+    fn aux(
+        &self,
+        i: effectcraft_engine::project::ItemId,
+        f: &effectcraft_engine::project::Footage,
+        t: effectcraft_engine::time::Tick,
+    ) -> Option<std::sync::Arc<effectcraft_engine::raster::AuxChannels>> {
+        assert_ne!(std::thread::current().name(), Some("crypto-probe"), "a broken Cryptomatte reader");
+        self.0.aux(i, f, t)
+    }
+}
+
+/// A panic while the probe is built shows as an error in the chip, and the pick keeps working.
+#[test]
+fn a_panicking_probe_build_shows_an_error() {
+    let (mut s, ids) = crypto_session("panic", 320, 180, false);
+    s.footage = std::sync::Arc::new(Broken(s.footage.clone()));
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let p = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let got = hover(&mut h, p);
+    assert!(got.contains("Reading the Cryptomatte IDs failed") && got.contains("a broken Cryptomatte reader"), "{got}");
+    let p = comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap();
+    assert_eq!(hover(&mut h, p), got, "not retried for the frame");
+    assert!(h.state().ui.fx_pick.is_some());
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A long Selection cut off by a narrow Effect Controls panel shows whole on hover.
+#[test]
+fn a_cut_off_selection_shows_whole_on_hover() {
+    use egui_kittest::kittest::Queryable;
+    let (mut s, ids) = crypto_session("tip", 320, 180, false);
+    let long = (0..8).map(|i| format!("c{i}_{i}")).collect::<Vec<_>>().join(", ");
+    s.execute_checked("prop.set", json!({"path": "effects/#1/selection", "value": long})).unwrap();
+    let mut h = harness(s, vec2(1100.0, 800.0), 1.0, 300.0);
+    let field = at(&h, &format!("effectControls.prop.{}.value", ids.sel));
+    h.event(Event::PointerMoved(field));
+    h.run_steps(8);
+    assert!(h.query_by_label(&long).is_some(), "the whole Selection on hover");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// The highlight's screen corners (its automation label), when one is drawn.
+fn highlight(h: &Harness<'_, EffectcraftApp>) -> Option<Vec<Pos2>> {
+    let e = h.state().auto.find("viewer.cryptoPick.highlight")?;
+    Some(e.label.split(' ').map(|c| c.split_once(',').map(|(x, y)| pos2(x.parse().unwrap(), y.parse().unwrap())).unwrap()).collect())
+}
+
+/// The hovered ID's highlight covers the layer as the viewer shows it: unscaled, and scaled and
+/// rotated; none off the IDs.
+#[test]
+fn the_highlight_covers_the_layer_as_shown() {
+    let (s, ids) = crypto_session("quad", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let corners = [[0.0, 0.0], [320.0, 0.0], [320.0, 180.0], [0.0, 180.0]];
+    for (scale, rot) in [(100.0, 0.0_f64), (50.0, 30.0), (150.0, -10.0)] {
+        let s = &mut h.state_mut().session;
+        s.execute_checked("prop.set", json!({"path": "transform/scale", "value": [scale, scale]})).unwrap();
+        s.execute_checked("prop.set", json!({"path": "transform/rotation", "value": rot})).unwrap();
+        settle(&mut h);
+        // Layer point → comp: about the anchor (the centre), at the position (the comp's centre).
+        let (k, (sn, cs)) = (scale / 100.0, rot.to_radians().sin_cos());
+        let comp = |p: [f64; 2]| {
+            let (x, y) = ((p[0] - 160.0) * k, (p[1] - 90.0) * k);
+            [(160.0 + x * cs - y * sn) as f32, (90.0 + x * sn + y * cs) as f32]
+        };
+        let a = comp_to_screen(&h.ctx, comp([50.0, 40.0])).unwrap();
+        assert_eq!(hover(&mut h, a).trim_end_matches(" (selected)"), "c1_1", "scale {scale} rotation {rot}");
+        let got = highlight(&h).expect("a highlight");
+        for (g, c) in got.iter().zip(corners) {
+            let want = comp_to_screen(&h.ctx, comp(c)).unwrap();
+            assert!(g.distance(want) < 0.6, "scale {scale} rotation {rot}: corner {c:?} at {g:?}, the layer's at {want:?}");
+        }
+    }
+    let s = &mut h.state_mut().session;
+    s.execute_checked("prop.set", json!({"path": "transform/scale", "value": [100.0, 100.0]})).unwrap();
+    s.execute_checked("prop.set", json!({"path": "transform/rotation", "value": 0.0})).unwrap();
+    settle(&mut h);
+    let off = comp_to_screen(&h.ctx, [-3.0, 90.0]).unwrap();
+    assert_eq!(hover(&mut h, off), HINT);
+    assert!(highlight(&h).is_none(), "no highlight off the IDs");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A click waits for its frame's probe (the build has started and is held), then the frame steps
+/// with the pointer kept on the viewer (each frame its own probe: an animated blur). The hover
+/// and the waiting click never take turns cancelling each other's build: the click, for a frame
+/// no longer shown, is dropped with a message, the hover reads the new frame once the held build
+/// ends, and a new click picks, all within a few builds and without a thread per pass.
+#[test]
+fn a_frame_step_while_a_click_waits_settles_within_a_few_builds() {
+    let (mut s, ids) = crypto_session("livelock", 960, 540, true);
+    for (t, v) in [(0.0, 2.0), (1.0, 6.0)] {
+        s.execute_checked("prop.addKey", json!({"path": "effects/#1/blurriness", "time": t, "value": v})).unwrap();
+    }
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), Default::default()));
+    let mut h = harness_dt(s, vec2(1280.0, 800.0), 1.0, 420.0, 0.02);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [260.0, 150.0]).unwrap();
+    set_frame(&mut h, 3);
+    hold.store(true, std::sync::atomic::Ordering::Release);
+    let before = h.state().session.crypto_probe_jobs();
+    h.event(Event::PointerMoved(a));
+    h.run_steps(10); // settled: the build for frame 3 starts (and is held)
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    started(&h, before);
+    let b0 = builds(&h);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    let jobs = |h: &Harness<'_, EffectcraftApp>| h.state().session.crypto_probe_jobs();
+    let j0 = jobs(&h);
+    set_frame(&mut h, 4);
+    let step = |h: &mut Harness<'_, EffectcraftApp>| {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    };
+    // 100 passes with the pointer on the viewer while frame 3's build is held.
+    for _ in 0..100 {
+        step(&mut h);
+    }
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    assert_eq!((builds(&h), jobs(&h)), (b0, j0), "nothing else started while one build runs");
+    // (Asked now: a status message goes after 5 s.)
+    assert!(h.state().ui.status.starts_with("Pick not made"), "the click for frame 3 says it wasn't made: {:?}", h.state().ui.status);
+    hold.store(false, std::sync::atomic::Ordering::Release);
+    for _ in 0..1000 {
+        step(&mut h);
+        if chip(&h).as_deref() != Some(READING) {
+            break;
+        }
+    }
+    assert_eq!(chip(&h).as_deref(), Some("c7_5"), "frame 4's IDs are read");
+    assert_eq!(selection(&h, &ids), "", "the click for frame 3 isn't made on frame 4");
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    for _ in 0..500 {
+        step(&mut h);
+        if !selection(&h, &ids).is_empty() {
+            break;
+        }
+    }
+    assert_eq!(selection(&h, &ids), "c7_5", "the click on frame 4 picks");
+    // Frame 4's build, and no thread that did nothing.
+    let (n, j) = (builds(&h) - b0, jobs(&h) - j0);
+    assert!(n <= 2 && j == n, "{n} builds, {j} jobs (threads) after frame 3's");
+    // Then nothing more is started.
+    for _ in 0..50 {
+        step(&mut h);
+    }
+    assert_eq!((builds(&h) - b0, jobs(&h) - j0), (n, j));
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Footage whose Cryptomatte read on the probe's thread waits while `hold` is set. It logs the
+/// probe threads' reads: (thread, a picture frame rather than the IDs).
+pub(crate) struct Held(
+    pub(crate) std::sync::Arc<dyn effectcraft_engine::render::FootageSource>,
+    pub(crate) std::sync::Arc<std::sync::atomic::AtomicBool>,
+    pub(crate) ReadLog,
+);
+pub(crate) type ReadLog = std::sync::Arc<std::sync::Mutex<Vec<(std::thread::ThreadId, bool)>>>;
+impl Held {
+    fn log(&self, frame: bool) {
+        if std::thread::current().name() == Some("crypto-probe") {
+            self.2.lock().unwrap().push((std::thread::current().id(), frame));
+        }
+    }
+}
+impl effectcraft_engine::render::FootageSource for Held {
+    fn frame(
+        &self,
+        i: effectcraft_engine::project::ItemId,
+        f: &effectcraft_engine::project::Footage,
+        t: effectcraft_engine::time::Tick,
+    ) -> Option<std::sync::Arc<effectcraft_engine::raster::Image>> {
+        self.log(true);
+        self.0.frame(i, f, t)
+    }
+    fn frame_with(
+        &self,
+        i: effectcraft_engine::project::ItemId,
+        f: &effectcraft_engine::project::Footage,
+        t: effectcraft_engine::time::Tick,
+        size: Option<(u32, u32)>,
+        float: effectcraft_engine::render::FloatCurve,
+    ) -> Option<std::sync::Arc<effectcraft_engine::raster::Image>> {
+        self.log(true);
+        self.0.frame_with(i, f, t, size, float)
+    }
+    fn aux(
+        &self,
+        i: effectcraft_engine::project::ItemId,
+        f: &effectcraft_engine::project::Footage,
+        t: effectcraft_engine::time::Tick,
+    ) -> Option<std::sync::Arc<effectcraft_engine::raster::AuxChannels>> {
+        self.log(false);
+        while std::thread::current().name() == Some("crypto-probe") && self.1.load(std::sync::atomic::Ordering::Acquire) {
+            std::thread::sleep(std::time::Duration::from_millis(2));
+        }
+        self.0.aux(i, f, t)
+    }
+}
+
+/// Step until a held probe build has reached the ID (`aux`) read, so READING asserts are about a
+/// build that is really running.
+pub(crate) fn wait_held_id_read(h: &mut Harness<'_, EffectcraftApp>, log: &ReadLog) {
+    for _ in 0..3000 {
+        h.step();
+        if log.lock().unwrap().iter().any(|(_, frame)| !*frame) {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    panic!("the held build never reached the ID read");
+}
+
+/// Disarmed and armed again while a probe is built: the new hover waits for that build to end
+/// before it starts its own (one build at a time, so one probe's memory).
+#[test]
+fn rearming_during_a_build_never_runs_two_builds() {
+    let (mut s, ids) = crypto_session("rearm", 320, 180, false);
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), Default::default()));
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    hold.store(true, std::sync::atomic::Ordering::Release);
+    let before = h.state().session.crypto_probe_jobs();
+    h.event(Event::PointerMoved(a));
+    h.run_steps(2);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    started(&h, before);
+    let b1 = builds(&h);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().ui.fx_pick.is_none());
+    arm(&mut h, &ids);
+    h.event(Event::PointerMoved(a));
+    for _ in 0..20 {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    assert_eq!(builds(&h), b1, "a second build started while the first runs");
+    hold.store(false, std::sync::atomic::Ordering::Release);
+    assert_eq!(hover(&mut h, a), "c1_1");
+    assert_eq!(builds(&h), b1 + 1, "then one build for the new pick");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Esc while typing in the Selection field ends the typing (the text goes back), not the pick.
+#[test]
+fn esc_in_the_selection_field_keeps_the_pick() {
+    let (s, ids) = crypto_session("escfield", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let field = at(&h, &format!("effectControls.prop.{}.value", ids.sel));
+    click(&mut h, field, Modifiers::NONE);
+    h.event(Event::Text("c9_9".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().ui.fx_pick.is_some(), "still armed");
+    assert_eq!(selection(&h, &ids), "", "the typing was dropped");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().ui.fx_pick.is_none(), "Esc outside the field ends the pick");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A build cancelled while it reads the IDs (the pick turned off, or another project opened)
+/// stops there: it doesn't go on to render the effect's input (a 4K plate behind a blur), so
+/// the next pick's build, waiting for it (one at a time), starts at once.
+#[test]
+fn a_cancelled_build_does_not_keep_the_next_pick_waiting() {
+    for how in ["disarm", "open"] {
+        let (mut s, ids) = crypto_session(&format!("cancel-{how}"), 3840, 2160, true);
+        let (hold, log) = (std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)), ReadLog::default());
+        s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), log.clone()));
+        let mut h = harness(s, vec2(1280.0, 800.0), 1.0, 420.0);
+        arm(&mut h, &ids);
+        let a = comp_to_screen(&h.ctx, [1017.5, 594.5]).unwrap();
+        hold.store(true, std::sync::atomic::Ordering::Release);
+        let before = h.state().session.crypto_probe_jobs();
+        h.event(Event::PointerMoved(a));
+        h.run_steps(2);
+        started(&h, before);
+        while log.lock().unwrap().is_empty() {
+            std::thread::sleep(std::time::Duration::from_millis(2));
+        }
+        let held = log.lock().unwrap()[0].0;
+        match how {
+            "disarm" => h.key_press(egui::Key::Escape),
+            _ => {
+                let p = (*h.state().session.project).clone();
+                h.state_mut().session.replace_project(p, None);
+                h.state_mut().session.state.selected_layers = vec![LayerId(ids.layer)];
+            }
+        }
+        h.run_steps(2);
+        assert!(h.state().ui.fx_pick.is_none(), "{how}: the pick ended");
+        arm(&mut h, &ids);
+        h.event(Event::PointerMoved(a));
+        h.run_steps(2);
+        assert_eq!(chip(&h).as_deref(), Some(READING), "{how}: waits for the cancelled build");
+        let jobs = h.state().session.crypto_probe_jobs();
+        hold.store(false, std::sync::atomic::Ordering::Release);
+        assert_eq!(hover(&mut h, a), "c27_20", "{how}");
+        assert_eq!(h.state().session.crypto_probe_jobs(), jobs + 1, "{how}: one more build");
+        let frames = log.lock().unwrap().iter().filter(|(t, f)| *t == held && *f).count();
+        assert_eq!(frames, 0, "{how}: the cancelled build rendered its input");
+        let _ = std::fs::remove_dir_all(&ids.dir);
+    }
+}
+
+/// While playing, a frame whose IDs aren't read yet can't be picked: the chip says to stop, and
+/// a click there says it wasn't made, at once, instead of waiting for a frame that is gone. A
+/// frame whose IDs are read (here the one shown before playing) still picks while playing.
+#[test]
+fn a_click_while_playing_says_to_stop_playback() {
+    let (mut s, ids) = crypto_session("playclick", 960, 540, true);
+    for (t, v) in [(0.0, 2.0), (1.0, 6.0)] {
+        s.execute_checked("prop.addKey", json!({"path": "effects/#1/blurriness", "time": t, "value": v})).unwrap();
+    }
+    let mut h = harness_dt(s, vec2(1280.0, 800.0), 1.0, 420.0, 0.02);
+    arm(&mut h, &ids);
+    let a = comp_to_screen(&h.ctx, [260.0, 150.0]).unwrap();
+    assert_eq!(hover(&mut h, a), "c7_5");
+    let (steps, n) = (h.state().session.history.undo.len(), builds(&h));
+    // Playing with the frame held at 9 (an audio-only preview), so a queued click could be made.
+    let play = |h: &mut Harness<'_, EffectcraftApp>| {
+        set_frame(h, 9);
+        let now = h.ctx.input(|i| i.time);
+        let pb = &mut h.state_mut().playback;
+        (pb.playing, pb.start_wall, pb.start_frame) = (true, now, 9);
+        let origin = effectcraft_engine::time::Tick::ZERO;
+        let plan = effectcraft_engine::preview::PreviewPlan {
+            start: 0,
+            end: 47,
+            first: 9,
+            step: 1,
+            fps: 24.0,
+            looping: true,
+            cache_first: false,
+            video: false,
+            audio: true,
+            origin,
+        };
+        pb.plan = Some(plan);
+    };
+    let stop = |h: &mut Harness<'_, EffectcraftApp>| (h.state_mut().playback.plan, h.state_mut().playback.playing) = (None, false);
+    play(&mut h);
+    for _ in 0..500 {
+        h.step();
+        if chip(&h).as_deref() == Some(PAUSED) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    assert_eq!(chip(&h).as_deref(), Some(PAUSED));
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    assert_eq!(h.state().ui.status, "Pick not made: stop playback to pick", "said at the click");
+    // Not queued: stopped on the same frame, its IDs are read and nothing is picked.
+    stop(&mut h);
+    h.run_steps(2);
+    wait_probe(&mut h);
+    h.run_steps(4);
+    assert_eq!(chip(&h).as_deref(), Some("c7_5"));
+    assert_eq!((selection(&h, &ids), h.state().session.history.undo.len(), builds(&h)), (String::new(), steps, n + 1));
+    // Playing over a frame whose IDs are read: the click picks.
+    play(&mut h);
+    h.run_steps(4);
+    assert_eq!(chip(&h).as_deref(), Some("c7_5"));
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(2);
+    assert_eq!((selection(&h, &ids), h.state().session.history.undo.len()), ("c7_5".to_string(), steps + 1));
+    stop(&mut h);
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A 320 × 180 still whose probe builds are held (`hold`), the eyedropper armed and reading.
+fn held_session(tag: &str) -> (Harness<'static, EffectcraftApp>, Ids, std::sync::Arc<std::sync::atomic::AtomicBool>) {
+    let (mut s, ids) = crypto_session(tag, 320, 180, false);
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), Default::default()));
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    hold.store(true, std::sync::atomic::Ordering::Release);
+    let before = h.state().session.crypto_probe_jobs();
+    h.event(Event::PointerMoved(comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap()));
+    h.run_steps(2);
+    started(&h, before);
+    (h, ids, hold)
+}
+
+/// Lets the held builds go and runs passes for a second, then returns whether one said a pick
+/// wasn't made, and the undo labels.
+fn let_go(h: &mut Harness<'static, EffectcraftApp>, hold: &std::sync::atomic::AtomicBool) -> (bool, Vec<String>) {
+    hold.store(false, std::sync::atomic::Ordering::Release);
+    let mut said = false;
+    for _ in 0..200 {
+        h.step();
+        said |= h.state().ui.status.starts_with("Pick not made");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    (said, h.state().session.history.undo.iter().map(|(l, _)| l.clone()).collect())
+}
+
+fn button(h: &mut Harness<'static, EffectcraftApp>, pos: Pos2, pressed: bool, modifiers: Modifiers) {
+    h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers });
+}
+
+/// A click is the frame and the project shown at its press: a frame step or an edit before its
+/// release (an arrow key or PageDown that the window delivers before the release, Windows
+/// round 3) drops it and says so, and it isn't made afterwards. Keys with the release, after
+/// the click, drop it too. Without a change it is made (the control).
+#[test]
+fn a_click_is_dropped_when_the_frame_or_project_changes_before_its_release_or_ids() {
+    type Change = Box<dyn Fn(&mut Harness<'static, EffectcraftApp>)>;
+    let exec = |c: &'static str, p: serde_json::Value| -> Change { Box::new(move |h| drop(h.state_mut().session.execute_checked(c, p.clone()).unwrap())) };
+    let key = |key: egui::Key| -> Change {
+        Box::new(move |h| {
+            for pressed in [true, false] {
+                h.event(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
+            }
+        })
+    };
+    let cases: Vec<(&str, Option<Change>, bool)> = vec![
+        ("control", None, false),
+        ("time.nextFrame before the release", Some(exec("time.nextFrame", json!({}))), false),
+        ("layer.nudge before the release", Some(exec("layer.nudge", json!({"x": 2}))), false),
+        ("PageDown with the release", Some(key(egui::Key::PageDown)), true),
+        ("Right with the release", Some(key(egui::Key::ArrowRight)), true),
+    ];
+    // And with the key in the pass whose end makes the click (its IDs stored just before).
+    for k in [egui::Key::PageDown, egui::Key::ArrowRight] {
+        let (mut h, ids, hold) = held_session(&format!("atomic-arrive-{k:?}"));
+        let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+        for pressed in [true, false] {
+            button(&mut h, a, pressed, Modifiers::NONE);
+            h.step();
+        }
+        hold.store(false, std::sync::atomic::Ordering::Release);
+        for _ in 0..2500 {
+            if h.state().session.crypto_probe_stats().0 {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(2));
+        }
+        assert!(h.state().session.crypto_probe_stats().0, "{k:?}: the probe is stored, no pass since");
+        key(k)(&mut h);
+        h.step();
+        let said = h.state().ui.status.starts_with("Pick not made");
+        let (_, labels) = let_go(&mut h, &hold);
+        assert_eq!(selection(&h, &ids), "", "{k:?} as the IDs arrive: made ({labels:?})");
+        assert!(said && !labels.iter().any(|l| l == "Pick Cryptomatte"), "{k:?}: {labels:?} said {said}");
+        let _ = std::fs::remove_dir_all(&ids.dir);
+    }
+    for (case, change, with_release) in cases {
+        let (mut h, ids, hold) = held_session(&format!("atomic-{}", case.len()));
+        let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+        let (t0, rev0, steps) = (h.state().session.time().seconds(), h.state().session.revision, h.state().session.history.undo.len());
+        button(&mut h, a, true, Modifiers::NONE);
+        h.step();
+        if let Some(c) = change.as_ref().filter(|_| !with_release) {
+            c(&mut h);
+        }
+        button(&mut h, a, false, Modifiers::NONE);
+        if let Some(c) = change.as_ref().filter(|_| with_release) {
+            c(&mut h);
+        }
+        h.step();
+        let (said, labels) = let_go(&mut h, &hold);
+        if change.is_none() {
+            assert_eq!((selection(&h, &ids), labels.len(), said), ("c1_1".to_string(), steps + 1, false), "{case}: the click is made");
+        } else {
+            assert!(h.state().session.time().seconds() != t0 || h.state().session.revision != rev0, "{case}: changed nothing");
+            assert_eq!(selection(&h, &ids), "", "{case}: the stale click was made ({labels:?})");
+            assert!(!labels.iter().any(|l| l == "Pick Cryptomatte"), "{case}: {labels:?}");
+            assert!(said, "{case}: not said");
+        }
+        let _ = std::fs::remove_dir_all(&ids.dir);
+    }
+}
+
+/// A waiting click keeps the resolution it was made at: when the viewer then shows the frame at
+/// another (a zoom with Auto, or a frame cached at another resolution arriving), it is still
+/// made, before the next click (Windows round 3: a plain click lost, 1 run in 51).
+#[test]
+fn a_waiting_click_is_made_when_the_shown_resolution_changes() {
+    let (mut h, ids, hold) = held_session("rescale");
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let (before, steps) = (shown_scale(&h), h.state().session.history.undo.len());
+    for pressed in [true, false] {
+        button(&mut h, a, pressed, Modifiers::NONE);
+        h.step();
+    }
+    h.state_mut().ui.viewer.zoom = Some(0.3);
+    for _ in 0..400 {
+        h.step();
+        if shown_scale(&h) != before {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_ne!(shown_scale(&h), before, "the shown resolution changes");
+    let b = comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap();
+    h.event(Event::PointerMoved(b));
+    h.event(Event::ModifiersChanged(Modifiers::SHIFT));
+    h.step();
+    for pressed in [true, false] {
+        button(&mut h, b, pressed, Modifiers::SHIFT);
+        h.step();
+    }
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    let (said, labels) = let_go(&mut h, &hold);
+    assert_eq!((selection(&h, &ids), labels.len() - steps, said), ("c1_1, c3_3".to_string(), 2, false), "{labels:?}");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A Shift+click still held when the click before it is made (its build ends while the button
+/// is down) is kept: the eyedropper's own pick is not "the project changed".
+/// It is made after the first, in order.
+#[test]
+fn a_click_held_while_the_one_before_is_made_is_kept() {
+    let (mut h, ids, hold) = held_session("held-second");
+    let (a, b) = (comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap(), comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap());
+    let steps = h.state().session.history.undo.len();
+    for pressed in [true, false] {
+        button(&mut h, a, pressed, Modifiers::NONE);
+        h.step();
+    }
+    h.event(Event::PointerMoved(b));
+    h.event(Event::ModifiersChanged(Modifiers::SHIFT));
+    h.step();
+    button(&mut h, b, true, Modifiers::SHIFT);
+    h.step();
+    hold.store(false, std::sync::atomic::Ordering::Release);
+    for _ in 0..400 {
+        if selection(&h, &ids) == "c1_1" {
+            break;
+        }
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(selection(&h, &ids), "c1_1", "the first click is made while the second is held");
+    button(&mut h, b, false, Modifiers::SHIFT);
+    h.step();
+    let at_release = h.state().ui.status.clone();
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    let (said, labels) = let_go(&mut h, &hold);
+    assert_eq!((selection(&h, &ids), labels.len() - steps, said), ("c1_1, c3_3".to_string(), 2, false), "status at the release: {at_release:?}");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A drop clears every waiting click at once: a click made right after it starts a queue of its
+/// own (on the new revision) and is made.
+#[test]
+fn a_drop_clears_the_whole_queue() {
+    let (mut h, ids, hold) = held_session("drop-all");
+    let (a, b) = (comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap(), comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap());
+    let steps = h.state().session.history.undo.len();
+    for p in [a, b] {
+        for pressed in [true, false] {
+            button(&mut h, p, pressed, Modifiers::NONE);
+            h.step();
+        }
+    }
+    // The edit drops both; a press in the pass that drops them and its release in the next are
+    // the next click's, made on its own (not dropped with a click left over from the queue).
+    h.state_mut().session.execute_checked("layer.nudge", json!({"x": 2})).unwrap();
+    let c = comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap();
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerMoved(c));
+    ev.push(Event::PointerButton { pos: c, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    assert!(h.state().ui.status.starts_with("Pick not made"), "{:?}", h.state().ui.status);
+    button(&mut h, c, false, Modifiers::NONE);
+    h.step();
+    let (_, labels) = let_go(&mut h, &hold);
+    assert_eq!(selection(&h, &ids), "c3_3", "the click after the drop is made: {labels:?}");
+    assert_eq!(labels.iter().filter(|l| *l == "Pick Cryptomatte").count(), 1, "{labels:?} (from {steps})");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// The drag distance is the press to the release: the pointer moving on after the release, in
+/// the same pass, doesn't cancel the click (Windows round 4, B).
+#[test]
+fn a_click_measures_its_drag_to_the_release_not_the_pointer_after() {
+    let (mut h, ids, hold) = held_session("release-pos");
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    button(&mut h, a, true, Modifiers::NONE);
+    h.step();
+    // In one pass (`Harness::event` would give each event its own pass).
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    ev.push(Event::PointerMoved(a + vec2(80.0, 0.0)));
+    h.step();
+    let at_release = h.state().ui.status.clone();
+    let (said, _) = let_go(&mut h, &hold);
+    assert_eq!((selection(&h, &ids), said), ("c1_1".to_string(), false), "status at the release: {at_release:?}");
+    assert_ne!(at_release, "Drag cancelled the pick");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Playing, a click whose frame moved on between its press and release says "stop playback"
+/// (not that the frame changed), and the message stays its 5 s even though another message
+/// (the eyedropper's hint) showed for longer before it (Windows round 4, C).
+#[test]
+fn a_click_while_playing_says_stop_playback_and_the_message_stays() {
+    let (s, _ids) = crypto_session("playmove", 960, 540, true);
+    let mut h = harness_dt(s, vec2(1280.0, 800.0), 1.0, 420.0, 0.02);
+    arm(&mut h, &_ids);
+    let a = comp_to_screen(&h.ctx, [260.0, 150.0]).unwrap();
+    h.event(Event::PointerMoved(a));
+    let hint = h.state().ui.status.clone();
+    assert!(!hint.is_empty(), "the eyedropper's hint shows");
+    // The hint has shown for 4.6 s when the click comes.
+    let t0 = h.ctx.input(|i| i.time);
+    while h.ctx.input(|i| i.time) - t0 < 4.6 {
+        h.step();
+    }
+    assert_eq!(h.state().ui.status, hint);
+    play_at(&mut h, 9);
+    h.step();
+    button(&mut h, a, true, Modifiers::NONE);
+    h.step();
+    play_at(&mut h, 10);
+    button(&mut h, a, false, Modifiers::NONE);
+    h.step();
+    assert!(h.state().playback.playing);
+    assert_eq!(h.state().ui.status, "Pick not made: stop playback to pick", "said at the release");
+    let t1 = h.ctx.input(|i| i.time);
+    while h.ctx.input(|i| i.time) - t1 < 1.5 {
+        h.step();
+    }
+    assert_eq!(h.state().ui.status, "Pick not made: stop playback to pick", "still shown 1.5 s later");
+    let _ = std::fs::remove_dir_all(&_ids.dir);
+}
+
+/// A press held still past egui's click time (0.8 s) and let go before any pass sees it held
+/// that long is neither a click nor a drag to egui (an idle app doesn't repaint while a mouse
+/// button is held still): it is still a click here, and is made.
+#[test]
+fn a_long_still_press_with_no_pass_in_between_is_a_click() {
+    let (mut h, ids, hold) = held_session("long-press");
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    button(&mut h, a, true, Modifiers::NONE);
+    h.step();
+    // Passes 0.25 s apart: the last one held is at 0.75 s, the release at 1.0 s.
+    let t0 = h.ctx.input(|i| i.time);
+    while h.ctx.input(|i| i.time) - t0 + 0.25 < 0.8 {
+        h.step();
+    }
+    button(&mut h, a, false, Modifiers::NONE);
+    h.step();
+    let at_release = h.state().ui.status.clone();
+    let (said, labels) = let_go(&mut h, &hold);
+    assert_eq!((selection(&h, &ids), said), ("c1_1".to_string(), false), "status at the release: {at_release:?}, {labels:?}");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+// Several primary-button events in one pass (Windows round 5, c).
+/// An armed eyedropper with the IDs read and hovered at two points (c1_1 and c3_3).
+fn ready_at_two_ids(tag: &str) -> (Harness<'static, EffectcraftApp>, Ids, Pos2, Pos2) {
+    let (s, ids) = crypto_session(tag, 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let (a, b) = (comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap(), comp_to_screen(&h.ctx, [120.0, 100.0]).unwrap());
+    assert_eq!(hover(&mut h, a), "c1_1");
+    assert_eq!(hover(&mut h, b), "c3_3");
+    (h, ids, a, b)
+}
+
+fn pick_steps(h: &Harness<'_, EffectcraftApp>) -> usize {
+    h.state().session.history.undo.iter().filter(|(l, _)| l == "Pick Cryptomatte").count()
+}
+
+/// One click's release and the next one's Shift-press in one pass (a loaded UI thread, Windows
+/// round 5 c): both are made, in order, the second as an add.
+#[test]
+fn a_release_and_the_next_press_in_one_pass_are_both_made() {
+    let (mut h, ids, a, b) = ready_at_two_ids("batch1");
+    h.event(Event::PointerMoved(a));
+    h.step();
+    h.event(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    ev.push(Event::PointerMoved(b));
+    ev.push(Event::ModifiersChanged(Modifiers::SHIFT));
+    ev.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::SHIFT });
+    h.step();
+    let mid = (selection(&h, &ids), h.state().ui.status.clone());
+    h.event(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::SHIFT });
+    h.step();
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(4);
+    assert_eq!(selection(&h, &ids), "c1_1, c3_3", "mid {mid:?}");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Two whole clicks in one pass: both are made, two steps.
+#[test]
+fn two_whole_clicks_in_one_pass_are_both_made() {
+    let (mut h, ids, a, b) = ready_at_two_ids("batch2");
+    h.event(Event::PointerMoved(a));
+    h.step();
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    ev.push(Event::PointerMoved(b));
+    ev.push(Event::ModifiersChanged(Modifiers::SHIFT));
+    ev.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::SHIFT });
+    ev.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::SHIFT });
+    h.step();
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(4);
+    assert_eq!((selection(&h, &ids), pick_steps(&h)), ("c1_1, c3_3".to_string(), 2));
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Arm, Esc (which clears the status early), re-arm 6 s later: the hint shows again for its own
+/// time instead of inheriting the old one's.
+#[test]
+fn the_hint_shows_again_after_esc_and_rearm() {
+    let (s, ids) = crypto_session("hint", 320, 180, false);
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    let hint = h.state().ui.status.clone();
+    assert!(!hint.is_empty());
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().ui.fx_pick.is_none() && h.state().ui.status.is_empty(), "Esc ends it: {:?}", h.state().ui.status);
+    h.run_steps(24);
+    arm(&mut h, &ids);
+    let after: Vec<String> = (0..4)
+        .map(|_| {
+            h.step();
+            h.state().ui.status.clone()
+        })
+        .collect();
+    assert_eq!(after[3], hint, "the hint after re-arming");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// One whole click (press and release) in one pass, the IDs read: it is made.
+#[test]
+fn a_whole_click_in_one_pass_is_made() {
+    let (mut h, ids, a, _) = ready_at_two_ids("onepass");
+    h.event(Event::PointerMoved(a));
+    h.step();
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.step();
+    h.run_steps(4);
+    assert_eq!((selection(&h, &ids), pick_steps(&h)), ("c1_1".to_string(), 1));
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// The same while the IDs are being read: the click waits and is made.
+#[test]
+fn a_whole_click_in_one_pass_waits_while_reading_and_is_made() {
+    let (mut h, ids, hold) = held_session("s6-onepass-held");
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.step();
+    let (said, labels) = let_go(&mut h, &hold);
+    assert_eq!((selection(&h, &ids), said), ("c1_1".to_string(), false), "{labels:?}");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Playback from `frame` (an audio-only preview, so the frame is the one set here).
+fn play_at(h: &mut Harness<'_, EffectcraftApp>, frame: i64) {
+    set_frame(h, frame);
+    let now = h.ctx.input(|i| i.time);
+    let pb = &mut h.state_mut().playback;
+    (pb.playing, pb.start_wall, pb.start_frame) = (true, now, frame);
+    let plan = effectcraft_engine::preview::PreviewPlan {
+        start: 0,
+        end: 47,
+        first: frame,
+        step: 1,
+        fps: 24.0,
+        looping: true,
+        cache_first: false,
+        video: false,
+        audio: true,
+        origin: effectcraft_engine::time::Tick::ZERO,
+    };
+    pb.plan = Some(plan);
+}
+
+/// Clicks waiting for their IDs when playback starts are dropped, and the status says to stop
+/// playback (not that the frame changed).
+#[test]
+fn waiting_clicks_dropped_by_playback_say_stop_playback() {
+    let (mut s, ids) = crypto_session("play-drop", 320, 180, true);
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), Default::default()));
+    let mut h = harness(s, vec2(1400.0, 800.0), 1.0, 420.0);
+    arm(&mut h, &ids);
+    hold.store(true, std::sync::atomic::Ordering::Release);
+    let before = h.state().session.crypto_probe_jobs();
+    let a = comp_to_screen(&h.ctx, [50.0, 40.0]).unwrap();
+    h.event(Event::PointerMoved(a));
+    h.run_steps(2);
+    started(&h, before);
+    for pressed in [true, false] {
+        button(&mut h, a, pressed, Modifiers::NONE);
+        h.step();
+    }
+    assert!(!h.state().ui.status.starts_with("Pick not made"), "{:?}", h.state().ui.status);
+    play_at(&mut h, 9);
+    h.step();
+    assert_eq!(h.state().ui.status, "Pick not made: stop playback to pick");
+    h.state_mut().playback.playing = false;
+    let (_, labels) = let_go(&mut h, &hold);
+    assert_eq!(selection(&h, &ids), "", "{labels:?}");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// Space pressed while the button is held (to pan) cancels the press: nothing is picked at the
+/// release.
+#[test]
+fn space_while_the_button_is_held_cancels_the_click() {
+    let (mut h, ids, a, _) = ready_at_two_ids("space-mid");
+    h.event(Event::PointerMoved(a));
+    h.step();
+    button(&mut h, a, true, Modifiers::NONE);
+    h.step();
+    let space = |pressed| Event::Key { key: egui::Key::Space, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE };
+    h.event(space(true));
+    h.step();
+    button(&mut h, a, false, Modifiers::NONE);
+    h.step();
+    h.event(space(false));
+    h.run_steps(4);
+    assert_eq!(selection(&h, &ids), "");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A Shift-click whose Shift is let go in the same pass is still an add: the modifiers are the
+/// press's own, not the pass's end state.
+#[test]
+fn a_shift_click_in_one_pass_with_shift_let_go_adds() {
+    let (mut h, ids, a, b) = ready_at_two_ids("shift");
+    for pressed in [true, false] {
+        button(&mut h, a, pressed, Modifiers::NONE);
+        h.step();
+    }
+    h.run_steps(4);
+    assert_eq!(selection(&h, &ids), "c1_1");
+    h.event(Event::PointerMoved(b));
+    h.step();
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::ModifiersChanged(Modifiers::SHIFT));
+    ev.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::SHIFT });
+    ev.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::SHIFT });
+    ev.push(Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+    h.run_steps(4);
+    assert_eq!((selection(&h, &ids), pick_steps(&h)), ("c1_1, c3_3".to_string(), 2));
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// The same message set again while it still shows gets its own 5 s: pick, undo 2.5 s later,
+/// pick the same ID again (Windows round 6, A1).
+#[test]
+fn the_same_status_set_again_while_shown_gets_its_own_5_s() {
+    let (mut h, ids, a, _) = ready_at_two_ids("status-again");
+    for pressed in [true, false] {
+        button(&mut h, a, pressed, Modifiers::NONE);
+        h.step();
+    }
+    h.run_steps(2);
+    let msg = h.state().ui.status.clone();
+    assert_eq!(msg, "Cryptomatte Selection: c1_1");
+    h.run_steps(10);
+    let _ = h.state_mut().session.execute("edit.undo", json!({}));
+    assert_eq!((selection(&h, &ids), h.state().ui.status.clone()), (String::new(), msg.clone()));
+    for pressed in [true, false] {
+        button(&mut h, a, pressed, Modifiers::NONE);
+        h.step();
+    }
+    h.run_steps(12);
+    assert_eq!((selection(&h, &ids), h.state().ui.status.clone()), ("c1_1".to_string(), msg), "3 s after the second pick");
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// A press, a PageDown and the release in one slow pass: the click is the frame on screen at the
+/// press, so it is dropped and says so, not made on the next frame (Windows round 6, R-i pd8).
+#[test]
+fn a_frame_step_between_press_and_release_in_one_pass_drops_the_click() {
+    let (mut h, ids, a, _) = ready_at_two_ids("key-one-pass");
+    let key = |pressed| Event::Key { key: egui::Key::PageDown, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE };
+    let ev = &mut h.input_mut().events;
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    ev.push(key(true));
+    ev.push(key(false));
+    ev.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.step();
+    assert!(h.state().session.time().seconds() > 0.0, "the PageDown stepped");
+    assert!(h.state().ui.status.starts_with("Pick not made"), "{:?}", h.state().ui.status);
+    for _ in 0..40 {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!((selection(&h, &ids), pick_steps(&h)), (String::new(), 0));
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
+
+/// The window loses the focus while the button is held (the release may go to another window):
+/// the press is dropped, so a later release alone picks nothing.
+#[test]
+fn losing_the_focus_drops_a_held_press() {
+    let (mut h, ids, a, _) = ready_at_two_ids("focus-lost");
+    button(&mut h, a, true, Modifiers::NONE);
+    h.step();
+    h.event(Event::WindowFocused(false));
+    h.step();
+    h.event(Event::WindowFocused(true));
+    h.step();
+    button(&mut h, a, false, Modifiers::NONE);
+    h.run_steps(4);
+    assert_eq!((selection(&h, &ids), pick_steps(&h)), (String::new(), 0));
+    let _ = std::fs::remove_dir_all(&ids.dir);
+}
diff --git a/crates/ui-egui/tests/it/ui_crypto_pick_undo.rs b/crates/ui-egui/tests/it/ui_crypto_pick_undo.rs
new file mode 100644
index 000000000..22aaeb9a5
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_crypto_pick_undo.rs
@@ -0,0 +1,1317 @@
+//! Global undo / redo with the Cryptomatte eyedropper (#473): every pick is one undo step that
+//! never merges with a neighbouring edit, and Ctrl+Z / Ctrl+Shift+Z (the app's bindings; Ctrl+Y
+//! is New Solid, as in After Effects) walk a model of the expected states over long sequences of
+//! picks mixed with ordinary edits, at Full and Third, in two window sizes. After every step the
+//! Selection, the other properties, the Edit menu's Undo / Redo entries, the History panel, the
+//! viewer's chip and highlight, and the eyedropper's armed state are checked. Undo while the IDs
+//! are being read and with clicks waiting, across Open / Revert / New, and after Esc.
+
+use crate::ui_crypto_pick::{Held, ReadLog, at, chip, crypto_exr, settle, wait_held_id_read, wait_probe};
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{LayerId, Resolution};
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::{self, PanelKind, SplitSize};
+use effectcraft_ui_egui::panels::viewer::comp_to_screen;
+use egui::{Event, Key, Modifiers, PointerButton, Pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::{Value, json};
+use std::sync::atomic::Ordering;
+
+const READING: &str = "Reading Cryptomatte IDs…";
+const HINT: &str = "Click: replace · Shift: add · Alt or Ctrl: remove";
+const CRYPTO: &str = "ec.3d.cryptomatte";
+/// Settings ▸ General ▸ Undo Levels in these tests (the most allowed).
+const LEVELS: u32 = 99;
+/// The app's Cmd (Ctrl+Z / Ctrl+Shift+Z) as winit reports it: Ctrl off macOS (`command` is Ctrl
+/// there), Cmd on macOS.
+const MAC: bool = cfg!(target_os = "macos");
+const CTRL: Modifiers = Modifiers { alt: false, ctrl: !MAC, shift: false, mac_cmd: MAC, command: true };
+const CTRL_SHIFT: Modifiers = Modifiers { alt: false, ctrl: !MAC, shift: true, mac_cmd: MAC, command: true };
+
+// ---------------------------------------------------------------------------------------------
+// Fixture: session / populate / harness (shared EXR helpers from ui_crypto_pick.rs).
+
+struct Fix {
+    comp: u64,
+    /// The footage layer (Cryptomatte EXR) and the precomp layer of a 3D comp, each with a
+    /// Cryptomatte effect, and a plain solid.
+    plate: u64,
+    pre: u64,
+    other: u64,
+    inner: u64,
+    dir: std::path::PathBuf,
+}
+
+/// A `w` × `h` comp: the plate (optionally behind a heavy blur, so its probe takes a while),
+/// with a precomp of two 3D solids (`PA` full size, `PB` a 60 px strip at the left) on top, and a
+/// solid. Each Cryptomatte layer has the effect. The history starts empty.
+fn session(tag: &str, w: usize, h: usize, blur: bool, precomp: bool) -> (Session, Fix) {
+    let dir = std::env::temp_dir().join(format!("ec-ui-crypick-undo-{tag}-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = crypto_exr(&dir, "plate.exr", w, h, 1);
+    let mut s = effectcraft_host::session();
+    let f = populate(&mut s, &path, w, h, blur, precomp, dir);
+    (s, f)
+}
+
+/// [`session`]'s project, built in `s`'s current project from the EXR at `path`.
+fn populate(s: &mut Session, path: &str, w: usize, h: usize, blur: bool, precomp: bool, dir: std::path::PathBuf) -> Fix {
+    let r = s.execute("file.import", json!({"paths": [path]})).unwrap();
+    let footage = r["items"][0].as_u64().unwrap();
+    let comp = s.execute("comp.new", json!({"name": "Crypto", "width": w, "height": h, "frameRate": 24, "duration": 2})).unwrap();
+    let comp = comp.get("comp").and_then(Value::as_u64).unwrap_or_else(|| s.active_comp_id().unwrap().0);
+    let plate = s.execute("layer.addItem", json!({"item": footage})).unwrap()["layer"].as_u64().unwrap();
+    s.state.selected_layers = vec![LayerId(plate)];
+    if blur {
+        s.execute_checked("effect.apply", json!({"effect": "Gaussian Blur"})).unwrap();
+        s.execute_checked("prop.set", json!({"path": "effects/#1/blurriness", "value": 40.0})).unwrap();
+    }
+    s.execute_checked("effect.apply", json!({"effect": "Cryptomatte"})).unwrap();
+    let (mut pre, mut inner) = (0, 0);
+    if precomp {
+        let a = s.execute("layer.newSolid", json!({"name": "PA", "width": w, "height": h})).unwrap()["layer"].clone();
+        let b = s.execute("layer.newSolid", json!({"name": "PB", "width": 60, "height": h})).unwrap()["layer"].clone();
+        s.execute_checked("prop.set", json!({"layer": b, "path": "transform/position", "value": [30.0, h as f64 / 2.0, -10.0]})).unwrap();
+        s.execute("layer.setSwitch", json!({"layers": [a, b], "switch": "threeD", "value": true})).unwrap();
+        s.execute("layer.precompose", json!({"layers": [a, b], "name": "Inner"})).unwrap();
+        inner = s.project.items.iter().find(|(_, i)| i.name == "Inner").unwrap().0.0;
+        pre = s.active_comp().unwrap().layers.iter().find(|l| l.name == "Inner").unwrap().id.0;
+        s.execute_checked("effect.apply", json!({"layers": [pre], "effect": "Cryptomatte"})).unwrap();
+    }
+    let other = s.execute("layer.newSolid", json!({"name": "Other", "width": 64, "height": 64})).unwrap()["layer"].as_u64().unwrap();
+    s.state.selected_layers = vec![LayerId(plate)];
+    s.history = Default::default();
+    s.prefs.general.undo_levels = LEVELS;
+    Fix { comp, plate, pre, other, inner, dir }
+}
+
+/// Composition viewer and Effect Controls side by side, the Timeline and the History panel below.
+fn harness(s: Session, size: egui::Vec2) -> Harness<'static, EffectcraftApp> {
+    let mut app = EffectcraftApp::new(s);
+    app.ui.viewer.show_layer_controls = false;
+    app.ui.dock = dock::docked(dock::vsplit(
+        SplitSize::FixedSecond(200.0),
+        dock::hsplit(SplitSize::FixedSecond(420.0), dock::tabs(&[PanelKind::Composition], 0), dock::tabs(&[PanelKind::EffectControls], 0)),
+        dock::hsplit(SplitSize::FixedSecond(300.0), dock::tabs(&[PanelKind::Timeline], 0), dock::tabs(&[PanelKind::History], 0)),
+    ));
+    let mut h = Harness::builder().with_size(size).with_pixels_per_point(1.0).with_step_dt(0.25).build_eframe(|_| app);
+    settle(&mut h);
+    h
+}
+
+fn highlight(h: &Harness<'_, EffectcraftApp>) -> bool {
+    h.state().auto.find("viewer.cryptoPick.highlight").is_some()
+}
+
+/// Like `ui_crypto_pick::hover`, plus an extra step so the chip label is current after the probe.
+fn hover(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2) -> String {
+    h.event(Event::PointerMoved(pos));
+    h.step();
+    wait_probe(h);
+    h.step();
+    chip(h).unwrap_or_default()
+}
+
+/// Press and release at `pos` with `modifiers`, without waiting for the probe.
+fn press(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2, modifiers: Modifiers) {
+    h.event(Event::PointerMoved(pos));
+    h.event(Event::ModifiersChanged(modifiers));
+    h.step();
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers });
+        h.step();
+    }
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, pos: Pos2, modifiers: Modifiers) {
+    press(h, pos, modifiers);
+    wait_probe(h);
+    h.run_steps(2);
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    h.event(Event::ModifiersChanged(modifiers));
+    h.event(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers });
+    h.event(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers });
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(2);
+}
+
+/// The Selection property uid of the layer's (first) Cryptomatte effect.
+fn sel_uid(s: &Session, comp: u64, layer: u64) -> Option<u64> {
+    let l = s.project.comp(effectcraft_engine::project::ItemId(comp))?.layer(LayerId(layer))?;
+    l.effects()?.groups().find(|g| g.match_id == CRYPTO)?.get("selection").map(|p| p.uid)
+}
+
+/// Select `layer` (Effect Controls shows it) and arm its Cryptomatte eyedropper.
+fn arm(h: &mut Harness<'_, EffectcraftApp>, f: &Fix, layer: u64) -> u64 {
+    h.state_mut().session.state.selected_layers = vec![LayerId(layer)];
+    h.run_steps(3);
+    let uid = sel_uid(&h.state().session, f.comp, layer).expect("a Cryptomatte effect");
+    let eye = at(h, &format!("effectControls.prop.{uid}.eyedropper"));
+    click(h, eye, Modifiers::NONE);
+    assert!(h.state().ui.fx_pick.as_ref().is_some_and(|p| p.kind == "crypto" && p.prop == uid && p.layer == layer), "armed on {layer}");
+    uid
+}
+
+/// Type `text` into the Selection field of `layer` (shown in Effect Controls), committed with Enter.
+fn type_selection(h: &mut Harness<'_, EffectcraftApp>, f: &Fix, layer: u64, text: &str, commit: bool) {
+    h.state_mut().session.state.selected_layers = vec![LayerId(layer)];
+    h.run_steps(3);
+    let uid = sel_uid(&h.state().session, f.comp, layer).unwrap();
+    let field = at(h, &format!("effectControls.prop.{uid}.value"));
+    click(h, field, Modifiers::NONE);
+    h.key_press_modifiers(CTRL, Key::A);
+    h.step();
+    h.event(Event::Text(text.into()));
+    h.step();
+    if commit {
+        key(h, Key::Enter, Modifiers::NONE);
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Observation and model.
+
+#[derive(Clone, Debug, PartialEq)]
+struct LayerObs {
+    id: u64,
+    name: String,
+    opacity: Value,
+    opacity_keys: Vec<(f64, Value)>,
+    position: Value,
+    /// (match id, Selection uid and value for Cryptomatte) per effect.
+    effects: Vec<(String, Option<(u64, String)>)>,
+}
+
+impl LayerObs {
+    fn crypto(&self) -> Option<&(u64, String)> {
+        self.effects.iter().find_map(|e| e.1.as_ref())
+    }
+    fn crypto_mut(&mut self) -> &mut (u64, String) {
+        self.effects.iter_mut().find_map(|e| e.1.as_mut()).expect("a Cryptomatte effect")
+    }
+}
+
+type Obs = Vec<LayerObs>;
+
+fn observe(s: &Session, comp: u64) -> Obs {
+    let c = s.project.comp(effectcraft_engine::project::ItemId(comp)).unwrap();
+    c.layers
+        .iter()
+        .map(|l| {
+            let tr = l.transform().unwrap();
+            let op = tr.get("opacity").unwrap();
+            let effects = l
+                .effects()
+                .map(|fx| {
+                    fx.groups()
+                        .map(|g| {
+                            let sel = (g.match_id == CRYPTO).then(|| {
+                                let p = g.get("selection").unwrap();
+                                (p.uid, p.value.to_json().as_str().unwrap_or_default().to_string())
+                            });
+                            (g.match_id.clone(), sel)
+                        })
+                        .collect()
+                })
+                .unwrap_or_default();
+            LayerObs {
+                id: l.id.0,
+                name: l.name.clone(),
+                opacity: op.value.to_json(),
+                opacity_keys: op.keys.iter().map(|k| (k.time.seconds(), k.value.to_json())).collect(),
+                position: tr.get("position").unwrap().value.to_json(),
+                effects,
+            }
+        })
+        .collect()
+}
+
+fn sel_of(o: &Obs, id: u64) -> String {
+    o.iter().find(|l| l.id == id).and_then(|l| l.crypto()).map(|c| c.1.clone()).unwrap_or_default()
+}
+
+fn layer_mut(o: &mut Obs, id: u64) -> &mut LayerObs {
+    o.iter_mut().find(|l| l.id == id).unwrap_or_else(|| panic!("no layer {id}"))
+}
+
+/// The Selection after a pick of token `t` (as `edit_selection` writes it: `, ` separated).
+fn model_pick(sel: &str, t: &str, mode: &str) -> String {
+    let mut v: Vec<String> = sel.split(", ").filter(|s| !s.is_empty()).map(str::to_string).collect();
+    match mode {
+        "replace" => v = vec![t.to_string()],
+        "add" => {
+            if !v.iter().any(|x| x == t) {
+                v.push(t.to_string())
+            }
+        }
+        _ => v.retain(|x| x != t),
+    }
+    v.join(", ")
+}
+
+fn mode_of(m: Modifiers) -> &'static str {
+    if m.alt || m.ctrl || m.command {
+        "remove"
+    } else if m.shift {
+        "add"
+    } else {
+        "replace"
+    }
+}
+
+struct Model {
+    comp: u64,
+    /// The working line: (label of the step that made it, expected state); `cur` is current.
+    line: Vec<(String, Obs)>,
+    cur: usize,
+    time: f64,
+    /// (layer, Selection uid) the eyedropper is armed on.
+    armed: Option<(u64, u64)>,
+    branches: usize,
+    /// States per branch (the history bounds them by the undo levels).
+    branch_states: Vec<usize>,
+    /// Every distinct undo label seen, with the step that made it.
+    labels: Vec<(String, String)>,
+    /// Undo / redo steps after which the probe had to be built again, of those checked.
+    rebuilds: (usize, usize),
+    checks: usize,
+}
+
+impl Model {
+    fn new(h: &Harness<'_, EffectcraftApp>, comp: u64) -> Model {
+        let s = &h.state().session;
+        Model {
+            comp,
+            line: vec![("Original".into(), observe(s, comp))],
+            cur: 0,
+            time: s.time_of(effectcraft_engine::project::ItemId(comp)).seconds(),
+            armed: None,
+            branches: 0,
+            branch_states: vec![],
+            labels: vec![],
+            rebuilds: (0, 0),
+            checks: 0,
+        }
+    }
+    fn state(&self) -> &Obs {
+        &self.line[self.cur].1
+    }
+    /// A step that records: the redo line becomes a branch.
+    fn record(&mut self, label: &str, o: Obs, what: &str) {
+        if self.cur + 1 < self.line.len() {
+            self.branches += 1;
+            self.branch_states.push(self.line.len() - 1 - self.cur);
+            // The oldest branches go beyond the undo levels (no branch here grows from another).
+            while self.branch_states.iter().sum::<usize>() > LEVELS as usize {
+                self.branch_states.remove(0);
+                self.branches -= 1;
+            }
+        }
+        self.line.truncate(self.cur + 1);
+        self.line.push((label.to_string(), o));
+        self.cur += 1;
+        assert!(self.cur <= LEVELS as usize, "the model doesn't trim the working line");
+        if !self.labels.iter().any(|(l, _)| l == label) {
+            self.labels.push((label.to_string(), what.to_string()));
+        }
+    }
+    /// Undo or redo moved to another state: the pick ends when its effect is gone there.
+    fn moved(&mut self) {
+        if let Some((l, uid)) = self.armed
+            && !self.state().iter().any(|x| x.id == l && x.crypto().is_some_and(|c| c.0 == uid))
+        {
+            self.armed = None;
+        }
+    }
+}
+
+/// The comp point of layer point `p` (no scale, rotation or anchor change in these tests).
+fn comp_point(o: &Obs, layer: u64, p: [f64; 2], size: [f64; 2]) -> [f32; 2] {
+    let l = o.iter().find(|l| l.id == layer).unwrap();
+    let pos = &l.position;
+    let (dx, dy) = (pos[0].as_f64().unwrap() - size[0] / 2.0, pos[1].as_f64().unwrap() - size[1] / 2.0);
+    [(p[0] + dx) as f32, (p[1] + dy) as f32]
+}
+
+/// Where the checks hover on each Cryptomatte layer (layer point) and the ID they must name.
+fn probe_point(f: &Fix, layer: u64) -> ([f64; 2], &'static str) {
+    if layer == f.plate { ([55.5, 43.5], "c1_1") } else { ([20.0, 90.0], "PB") }
+}
+
+/// Every check after a step: state, Edit menu, History panel, time, armed state, chip, highlight.
+fn verify(h: &mut Harness<'_, EffectcraftApp>, f: &Fix, m: &mut Model, size: [f64; 2], what: &str) {
+    m.checks += 1;
+    // (Two passes: the panels draw what the last edit left, and their rows are current.)
+    h.run_steps(2);
+    let got = observe(&h.state().session, m.comp);
+    assert_eq!(got, *m.state(), "{what}: project state");
+    // Edit ▸ Undo / Redo: labels and availability.
+    let items = effectcraft_ui_egui::menus::menu_items(h.state());
+    let item = |id: &str| items.iter().find(|i| i.id == id).map(|i| (i.label.clone(), i.enabled)).unwrap();
+    let want_undo = if m.cur > 0 { (format!("Undo {}", m.line[m.cur].0), true) } else { ("Can't Undo".to_string(), false) };
+    let want_redo = if m.cur + 1 < m.line.len() { (format!("Redo {}", m.line[m.cur + 1].0), true) } else { ("Can't Redo".to_string(), false) };
+    assert_eq!((item("edit.undo"), item("edit.redo")), (want_undo, want_redo), "{what}: Edit menu");
+    let s = &h.state().session;
+    assert_eq!((s.history.undo.len(), s.history.redo.len()), (m.cur, m.line.len() - 1 - m.cur), "{what}: history depth");
+    // The History panel: the working line's labels, the current state highlighted and in view.
+    let tree = s.history_tree();
+    let line: Vec<&str> = tree.iter().filter(|n| n.line).map(|n| n.label.as_str()).collect();
+    let want: Vec<&str> = m.line.iter().map(|l| l.0.as_str()).collect();
+    assert_eq!(line, want, "{what}: History panel line");
+    let cur = tree.iter().find(|n| n.current).unwrap();
+    assert_eq!(cur.label, m.line[m.cur].0, "{what}: History current");
+    assert_eq!(s.history.branches.len(), m.branches, "{what}: History branches");
+    let row = h.state().auto.find(&format!("history.state.{}", cur.index)).map(|e| e.label.clone());
+    assert_eq!(row.as_deref(), Some(m.line[m.cur].0.as_str()), "{what}: History panel row of the current state");
+    // The time is not part of the history.
+    let t = s.time_of(effectcraft_engine::project::ItemId(m.comp)).seconds();
+    assert!((t - m.time).abs() < 1e-9, "{what}: time {t} != {}", m.time);
+    // The eyedropper: armed where the model says, the chip names what is under the pointer
+    // (selected or not as the Selection says), and the hovered ID is highlighted.
+    let pick = h.state().ui.fx_pick.as_ref().map(|p| (p.layer, p.prop));
+    assert_eq!(pick, m.armed, "{what}: armed");
+    match m.armed {
+        Some((layer, _)) => {
+            let (lp, name) = probe_point(f, layer);
+            let p = comp_point(m.state(), layer, lp, size);
+            let sp = comp_to_screen(&h.ctx, p).unwrap();
+            let sel = m.state().iter().find(|l| l.id == layer).unwrap().crypto().unwrap().1.clone();
+            let selected = sel.split(", ").any(|t| t == name);
+            let want = if selected { format!("{name} (selected)") } else { name.to_string() };
+            assert_eq!(hover(h, sp), want, "{what}: chip");
+            assert!(highlight(h), "{what}: the hovered ID is highlighted");
+        }
+        None => {
+            h.step();
+            assert_eq!(chip(h), None, "{what}: no chip when disarmed");
+            assert!(!highlight(h), "{what}: no highlight when disarmed");
+        }
+    }
+}
+
+/// Undo (`redo` false) or redo with the keyboard, then check against the model. Counts whether
+/// the probe was built again for the step.
+fn step_history(h: &mut Harness<'_, EffectcraftApp>, f: &Fix, m: &mut Model, size: [f64; 2], redo: bool, what: &str) {
+    let can = if redo { m.cur + 1 < m.line.len() } else { m.cur > 0 };
+    let builds = h.state().session.crypto_probe_stats().1;
+    // A step that changed only Selections (a pick or a typed Selection).
+    let only_sel = can && {
+        let other = if redo { m.cur + 1 } else { m.cur - 1 };
+        let strip = |o: &Obs| {
+            o.iter()
+                .map(|l| LayerObs { effects: l.effects.iter().map(|e| (e.0.clone(), e.1.as_ref().map(|c| (c.0, String::new())))).collect(), ..l.clone() })
+                .collect::<Vec<_>>()
+        };
+        strip(&m.line[other].1) == strip(m.state())
+    };
+    if redo {
+        key(h, Key::Z, CTRL_SHIFT);
+    } else {
+        key(h, Key::Z, CTRL);
+    }
+    if can {
+        if redo {
+            m.cur += 1;
+        } else {
+            m.cur -= 1;
+        }
+    }
+    m.moved();
+    let armed = m.armed.is_some();
+    verify(h, f, m, size, what);
+    if armed && only_sel {
+        m.rebuilds.1 += 1;
+        if h.state().session.crypto_probe_stats().1 > builds {
+            m.rebuilds.0 += 1;
+        }
+    }
+}
+
+/// One forward step of the long sequence.
+enum Step {
+    /// Click at a layer point of the armed layer: the token it names and whether it is an edit.
+    Pick([f64; 2], Modifiers, &'static str),
+    /// Click where the armed layer has no ID: no step.
+    PickEmpty,
+    Arm(u64),
+    Esc,
+    Opacity(u64, f64, Option<&'static str>),
+    Position(u64, [f64; 2]),
+    Type(u64, &'static str),
+    OpacityKey(u64, f64, f64),
+    Time(f64),
+    RemoveCrypto(u64),
+    ApplyCrypto(u64),
+    DeleteLayer(u64),
+    AddPrecompLayer,
+    /// The plate's blur (before the Cryptomatte effect): drops the probe, slow to rebuild.
+    Blur(u64, f64),
+}
+
+fn run_step(h: &mut Harness<'_, EffectcraftApp>, f: &Fix, m: &mut Model, size: [f64; 2], step: &Step, n: usize) {
+    let mut o = m.state().clone();
+    let before = h.state().session.history.undo.len();
+    let (what, records): (String, bool) = match step {
+        Step::Pick(lp, mods, token) => {
+            let (layer, _) = m.armed.expect("armed");
+            let p = comp_point(&o, layer, *lp, size);
+            click(h, comp_to_screen(&h.ctx, p).unwrap(), *mods);
+            let c = layer_mut(&mut o, layer).crypto_mut();
+            let next = model_pick(&c.1, token, mode_of(*mods));
+            let changed = next != c.1;
+            c.1 = next;
+            (format!("#{n} pick {token} {}", mode_of(*mods)), changed)
+        }
+        Step::PickEmpty => {
+            let (layer, _) = m.armed.expect("armed");
+            // Just off the layer's left or right edge, inside the viewer.
+            let area = h.state().auto.find("viewer.fxPick").unwrap().rect;
+            let inside = |p: Pos2| p.x > area[0] + 2.0 && p.x < area[0] + area[2] - 2.0 && p.y > area[1] + 40.0 && p.y < area[1] + area[3] - 2.0;
+            let sp = [[-6.0, 120.0], [size[0] + 6.0, 120.0], [100.0, size[1] + 6.0]]
+                .into_iter()
+                .map(|lp| comp_to_screen(&h.ctx, comp_point(&o, layer, lp, size)).unwrap())
+                .find(|p| inside(*p))
+                .expect("an empty point in the viewer");
+            assert_eq!(hover(h, sp), HINT);
+            click(h, sp, Modifiers::NONE);
+            (format!("#{n} click off the IDs"), false)
+        }
+        Step::Arm(layer) => {
+            let uid = arm(h, f, *layer);
+            m.armed = Some((*layer, uid));
+            (format!("#{n} arm {layer}"), false)
+        }
+        Step::Esc => {
+            key(h, Key::Escape, Modifiers::NONE);
+            m.armed = None;
+            (format!("#{n} Esc"), false)
+        }
+        Step::Opacity(layer, v, merge) => {
+            let mut q = json!({"comp": f.comp, "layer": layer, "path": "transform/opacity", "value": v});
+            if let Some(k) = merge {
+                q["merge"] = json!(k);
+            }
+            h.state_mut().session.execute_checked("prop.set", q).unwrap();
+            layer_mut(&mut o, *layer).opacity = json!(v);
+            (format!("#{n} opacity {layer} {v} merge {merge:?}"), true)
+        }
+        Step::Position(layer, v) => {
+            let l = layer_mut(&mut o, *layer);
+            let mut p = l.position.clone();
+            (p[0], p[1]) = (json!(v[0]), json!(v[1]));
+            h.state_mut().session.execute_checked("prop.set", json!({"comp": f.comp, "layer": layer, "path": "transform/position", "value": p})).unwrap();
+            l.position = p;
+            (format!("#{n} position {layer} {v:?}"), true)
+        }
+        Step::Type(layer, text) => {
+            type_selection(h, f, *layer, text, true);
+            layer_mut(&mut o, *layer).crypto_mut().1 = text.to_string();
+            // Typing selects the layer; the pick (if any) stays where it was.
+            (format!("#{n} type {text:?}"), true)
+        }
+        Step::OpacityKey(layer, t, v) => {
+            h.state_mut()
+                .session
+                .execute_checked("prop.addKey", json!({"comp": f.comp, "layer": layer, "path": "transform/opacity", "time": t, "value": v}))
+                .unwrap();
+            layer_mut(&mut o, *layer).opacity_keys.push((*t, json!(v)));
+            (format!("#{n} opacity key {layer} {t}s {v}"), true)
+        }
+        Step::Time(t) => {
+            h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(*t));
+            m.time = *t;
+            settle(h);
+            (format!("#{n} time {t}"), false)
+        }
+        Step::RemoveCrypto(layer) => {
+            let uid = o.iter().find(|l| l.id == *layer).unwrap().effects.iter().position(|e| e.0 == CRYPTO).unwrap();
+            h.state_mut().session.execute_checked("effect.remove", json!({"comp": f.comp, "layer": layer, "effect": uid + 1})).unwrap();
+            layer_mut(&mut o, *layer).effects.retain(|e| e.0 != CRYPTO);
+            if m.armed.is_some_and(|a| a.0 == *layer) {
+                m.armed = None;
+            }
+            (format!("#{n} remove Cryptomatte from {layer}"), true)
+        }
+        Step::ApplyCrypto(layer) => {
+            h.state_mut().session.execute_checked("effect.apply", json!({"comp": f.comp, "layers": [layer], "effect": "Cryptomatte"})).unwrap();
+            let uid = sel_uid(&h.state().session, f.comp, *layer).unwrap();
+            layer_mut(&mut o, *layer).effects.push((CRYPTO.into(), Some((uid, String::new()))));
+            (format!("#{n} apply Cryptomatte to {layer}"), true)
+        }
+        Step::DeleteLayer(layer) => {
+            h.state_mut().session.execute_checked("edit.clear", json!({"comp": f.comp, "layers": [layer]})).unwrap();
+            o.retain(|l| l.id != *layer);
+            (format!("#{n} delete layer {layer}"), true)
+        }
+        Step::Blur(layer, v) => {
+            h.state_mut().session.execute_checked("prop.set", json!({"comp": f.comp, "layer": layer, "path": "effects/#1/blurriness", "value": v})).unwrap();
+            (format!("#{n} blur {v}"), true)
+        }
+        Step::AddPrecompLayer => {
+            let r = h.state_mut().session.execute_checked("layer.addItem", json!({"comp": f.comp, "item": f.inner})).unwrap();
+            let id = r["layer"].as_u64().unwrap();
+            let now = observe(&h.state().session, f.comp);
+            let new = now.iter().find(|l| l.id == id).unwrap().clone();
+            assert!(new.name.starts_with("Inner") && new.opacity == json!(100.0) && new.effects.is_empty(), "a fresh precomp layer: {new:?}");
+            let at = now.iter().position(|l| l.id == id).unwrap();
+            o.insert(at, new);
+            (format!("#{n} add precomp layer {id}"), true)
+        }
+    };
+    h.run_steps(2);
+    let after = h.state().session.history.undo.len();
+    if records {
+        assert_eq!(after, before + 1, "{what}: exactly one undo step");
+        let label = h.state().session.history.undo.last().unwrap().0.clone();
+        m.record(&label, o, &what);
+    } else {
+        assert_eq!(after, before, "{what}: no undo step");
+        assert_eq!(m.state(), &o, "{what}: no change");
+    }
+    verify(h, f, m, size, &what);
+}
+
+fn long_sequence(tag: &str, size: egui::Vec2, res: Resolution) {
+    let (w, hh) = (320usize, 180usize);
+    let dims = [w as f64, hh as f64];
+    let (mut s, f) = session(tag, w, hh, false, true);
+    let cid = effectcraft_engine::project::ItemId(f.comp);
+    s.set_resolution(cid, res).unwrap();
+    let mut h = harness(s, size);
+    let mut m = Model::new(&h, f.comp);
+    verify(&mut h, &f, &mut m, dims, "start");
+    let ctr = |cx: usize, cy: usize| [cx as f64 * 37.0 + 18.5, cy as f64 * 29.0 + 14.5];
+    let (pl, pre, other) = (f.plate, f.pre, f.other);
+    use Step::*;
+    let steps = vec![
+        Arm(pl),
+        Pick(ctr(1, 1), Modifiers::NONE, "c1_1"),
+        Opacity(pl, 80.0, Some("scrub-a")),
+        Pick(ctr(3, 3), Modifiers::SHIFT, "c3_3"),
+        Opacity(pl, 70.0, Some("scrub-a")),
+        Position(pl, [170.0, 95.0]),
+        Pick(ctr(1, 1), Modifiers::ALT, "c1_1"),
+        Opacity(other, 50.0, None),
+        Pick(ctr(3, 3), Modifiers::COMMAND, "c3_3"),
+        PickEmpty,
+        Pick(ctr(5, 2), Modifiers::NONE, "c5_2"),
+        Pick(ctr(5, 2), Modifiers::SHIFT, "c5_2"),
+        Pick(ctr(0, 0), Modifiers::ALT, "c0_0"),
+        Type(pl, "c2_2, c5_2"),
+        Pick(ctr(4, 4), Modifiers::SHIFT, "c4_4"),
+        Time(1.0),
+        OpacityKey(pl, 1.0, 60.0),
+        Pick(ctr(6, 1), Modifiers::SHIFT, "c6_1"),
+        Time(0.5),
+        RemoveCrypto(pl),
+        Opacity(other, 40.0, None),
+        ApplyCrypto(pl),
+        Arm(pl),
+        Pick(ctr(7, 3), Modifiers::NONE, "c7_3"),
+        Arm(pre),
+        Pick([20.0, 90.0], Modifiers::NONE, "PB"),
+        Pick([200.0, 90.0], Modifiers::SHIFT, "PA"),
+        Opacity(pre, 30.0, None),
+        Pick([20.0, 90.0], Modifiers::ALT, "PB"),
+        DeleteLayer(other),
+        Pick([20.0, 90.0], Modifiers::NONE, "PB"),
+        AddPrecompLayer,
+        Arm(pl),
+        Pick(ctr(8, 4), Modifiers::SHIFT, "c8_4"),
+    ];
+    for (n, st) in steps.iter().enumerate() {
+        run_step(&mut h, &f, &mut m, dims, st, n);
+    }
+    let total = m.cur;
+    assert!(total >= 20, "{total} undo steps");
+    // Undo all the way with Ctrl+Z, and once more (nothing left).
+    for k in 0..=total {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("undo {k}"));
+    }
+    assert_eq!(m.cur, 0);
+    // Redo all the way with Ctrl+Shift+Z, and once more.
+    for k in 0..=total {
+        step_history(&mut h, &f, &mut m, dims, true, &format!("redo {k}"));
+    }
+    assert_eq!(m.cur, total);
+    // Ctrl+Y is New Solid (After Effects' binding), not Redo: it opens the Solid Settings dialog
+    // and changes nothing; Esc closes the dialog.
+    for _ in 0..3 {
+        step_history(&mut h, &f, &mut m, dims, false, "undo before Ctrl+Y");
+    }
+    if m.armed.is_none() {
+        let l = if m.state().iter().find(|l| l.id == pl).and_then(|l| l.crypto()).is_some() { pl } else { pre };
+        run_step(&mut h, &f, &mut m, dims, &Arm(l), 99);
+    }
+    key(&mut h, Key::Y, CTRL);
+    assert!(h.state().dialog.is_some(), "Ctrl+Y opens the New Solid dialog");
+    assert_eq!(h.state().session.history.redo.len(), 3, "Ctrl+Y doesn't redo");
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().dialog.is_none());
+    assert!(h.state().ui.fx_pick.is_some(), "Esc that closes the New Solid dialog keeps the eyedropper armed");
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().ui.fx_pick.is_none(), "a second Esc disarms");
+    m.armed = None;
+    verify(&mut h, &f, &mut m, dims, "after Ctrl+Y and Esc");
+    // Undo partway, then a new pick: no redo left, the undone steps kept as a branch.
+    for k in 0..4 {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("partway {k}"));
+    }
+    if m.armed.is_none() {
+        let l = if m.state().iter().find(|l| l.id == pl).and_then(|l| l.crypto()).is_some() { pl } else { pre };
+        run_step(&mut h, &f, &mut m, dims, &Arm(l), 100);
+    }
+    let (layer, _) = m.armed.unwrap();
+    let (lp, name) = probe_point(&f, layer);
+    let sel = m.state().iter().find(|l| l.id == layer).unwrap().crypto().unwrap().1.clone();
+    let mods = if sel.split(", ").any(|t| t == name) { Modifiers::ALT } else { Modifiers::SHIFT };
+    let branches = m.branches;
+    run_step(&mut h, &f, &mut m, dims, &Pick(lp, mods, name), 101);
+    assert_eq!((m.branches, m.cur + 1 == m.line.len()), (branches + 1, true), "the redo line became a branch");
+    // Random undo / redo (fixed seed), with an occasional new pick or re-arm.
+    let mut seed: u64 = 0x5eed_c0ff_ee12_3457;
+    let mut rnd = || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    for i in 0..400 {
+        let r = rnd() % 20;
+        if r < 9 {
+            step_history(&mut h, &f, &mut m, dims, false, &format!("random {i} undo"));
+        } else if r < 18 {
+            step_history(&mut h, &f, &mut m, dims, true, &format!("random {i} redo"));
+        } else {
+            match m.armed {
+                None => {
+                    let l = [pl, pre].into_iter().find(|l| m.state().iter().find(|x| x.id == *l).is_some_and(|x| x.crypto().is_some()));
+                    if let Some(l) = l {
+                        run_step(&mut h, &f, &mut m, dims, &Arm(l), 200 + i);
+                    }
+                }
+                Some((layer, _)) => {
+                    let (lp, name) = probe_point(&f, layer);
+                    let sel = m.state().iter().find(|l| l.id == layer).unwrap().crypto().unwrap().1.clone();
+                    let mods = if sel.split(", ").any(|t| t == name) { Modifiers::ALT } else { Modifiers::SHIFT };
+                    run_step(&mut h, &f, &mut m, dims, &Pick(lp, mods, name), 200 + i);
+                }
+            }
+        }
+    }
+    eprintln!(
+        "{tag}: {} checks; {} history states on the line, {} branches; probe rebuilt after {} of {} armed undo/redo steps that changed only a Selection",
+        m.checks,
+        m.line.len(),
+        m.branches,
+        m.rebuilds.0,
+        m.rebuilds.1
+    );
+    for (l, w) in &m.labels {
+        eprintln!("{tag}: LABEL {l:?} (first from {w})");
+    }
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// Scenario 2 at Full and Third, in a large and a small window.
+#[test]
+fn long_sequence_full_large_window() {
+    long_sequence("full-l", vec2(1400.0, 860.0), Resolution::Full);
+}
+
+#[test]
+fn long_sequence_third_large_window() {
+    long_sequence("third-l", vec2(1400.0, 860.0), Resolution::Third);
+}
+
+#[test]
+fn long_sequence_full_small_window() {
+    long_sequence("full-s", vec2(1024.0, 700.0), Resolution::Full);
+}
+
+#[test]
+fn long_sequence_third_small_window() {
+    long_sequence("third-s", vec2(1024.0, 700.0), Resolution::Third);
+}
+
+// ---------------------------------------------------------------------------------------------
+// Scenario 1: each pick kind is one step; clicks off the IDs and picks that change nothing are
+// none; clicks queued while reading are one step each, undone in order.
+
+#[test]
+fn each_pick_is_one_step_and_clicks_that_change_nothing_are_none() {
+    let (s, f) = session("kinds", 320, 180, false, false);
+    let dims = [320.0, 180.0];
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    let mut m = Model::new(&h, f.comp);
+    let ctr = |cx: usize, cy: usize| [cx as f64 * 37.0 + 18.5, cy as f64 * 29.0 + 14.5];
+    let pl = f.plate;
+    let ctrl_only = Modifiers { ctrl: true, ..Modifiers::NONE };
+    use Step::*;
+    let steps = [
+        Arm(pl),
+        Pick(ctr(1, 1), Modifiers::NONE, "c1_1"),    // replace
+        Pick(ctr(3, 3), Modifiers::SHIFT, "c3_3"),   // add
+        Pick(ctr(3, 3), Modifiers::SHIFT, "c3_3"),   // add, already selected: no step
+        Pick(ctr(1, 1), Modifiers::ALT, "c1_1"),     // remove
+        Pick(ctr(1, 1), Modifiers::ALT, "c1_1"),     // remove, not selected: no step
+        Pick(ctr(4, 2), Modifiers::SHIFT, "c4_2"),   // add
+        Pick(ctr(4, 2), Modifiers::COMMAND, "c4_2"), // Ctrl (as `command`) removes
+        Pick(ctr(5, 5), Modifiers::SHIFT, "c5_5"),   // add
+        Pick(ctr(5, 5), ctrl_only, "c5_5"),          // Ctrl alone removes too
+        Pick(ctr(3, 3), Modifiers::NONE, "c3_3"),    // replace with what it already is: no step
+        PickEmpty,                                   // off the layer: no step
+        Pick(ctr(2, 1), Modifiers::NONE, "c2_1"),    // replace
+    ];
+    for (n, st) in steps.iter().enumerate() {
+        run_step(&mut h, &f, &mut m, dims, st, n);
+    }
+    assert_eq!(m.cur, 8, "eight picks changed the Selection");
+    for k in 0..9 {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("undo {k}"));
+    }
+    for k in 0..9 {
+        step_history(&mut h, &f, &mut m, dims, true, &format!("redo {k}"));
+    }
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// Clicks made while the IDs are read (a 4K plate behind a blur; the build is held until the
+/// clicks are checked) are one undo step each, in the order clicked; Ctrl+Z takes them back one
+/// at a time and Ctrl+Shift+Z makes them again.
+#[test]
+fn clicks_queued_while_reading_are_one_step_each_and_undo_in_order() {
+    let (mut s, f) = session("queue", 3840, 2160, true, false);
+    let dims = [3840.0, 2160.0];
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let log = ReadLog::default();
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), log.clone()));
+    let mut h = harness(s, vec2(1280.0, 860.0));
+    let mut m = Model::new(&h, f.comp);
+    let pl = f.plate;
+    run_step(&mut h, &f, &mut m, dims, &Step::Arm(pl), 0);
+    run_step(&mut h, &f, &mut m, dims, &Step::Blur(pl, 41.0), 1);
+    let (a, b) = ([1017.5, 594.5], [1868.5, 1174.5]);
+    let sp = |h: &Harness<'_, EffectcraftApp>, m: &Model, p: [f64; 2]| comp_to_screen(&h.ctx, comp_point(m.state(), pl, p, dims)).unwrap();
+    // The verify above built the probe; drop it again.
+    run_step(&mut h, &f, &mut m, dims, &Step::Blur(pl, 42.0), 2);
+    let pa = sp(&h, &m, a);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    h.state_mut().session.execute_checked("prop.set", json!({"comp": f.comp, "layer": pl, "path": "effects/#1/blurriness", "value": 43.0})).unwrap();
+    let label = h.state().session.history.undo.last().unwrap().0.clone();
+    let o = m.state().clone();
+    m.record(&label, o, "blur 43");
+    h.event(Event::PointerMoved(pa));
+    h.run_steps(2);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    let before = h.state().session.history.undo.len();
+    let clicks = [(a, Modifiers::NONE, "c27_20"), (b, Modifiers::SHIFT, "c50_40"), (a, Modifiers::ALT, "c27_20"), (a, Modifiers::SHIFT, "c27_20")];
+    for (p, mods, _) in clicks {
+        let q = sp(&h, &m, p);
+        press(&mut h, q, mods);
+    }
+    assert_eq!(chip(&h).as_deref(), Some(READING), "all four made while reading");
+    assert_eq!(h.state().session.history.undo.len(), before, "none made yet");
+    wait_held_id_read(&mut h, &log);
+    for _ in 0..10 {
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    assert_eq!(chip(&h).as_deref(), Some(READING), "still reading while the build is held");
+    assert_eq!(h.state().session.history.undo.len(), before, "none made yet while held");
+    hold.store(false, Ordering::Release);
+    wait_probe(&mut h);
+    h.run_steps(3);
+    assert_eq!(h.state().session.history.undo.len(), before + 4, "one step per click");
+    // The model: each click on the state the previous one left.
+    for (k, (_, mods, t)) in clicks.iter().enumerate() {
+        let mut o = m.state().clone();
+        let c = layer_mut(&mut o, pl).crypto_mut();
+        c.1 = model_pick(&c.1, t, mode_of(*mods));
+        let label = h.state().session.history.undo[before + k].0.clone();
+        m.record(&label, o, &format!("queued click {k}"));
+    }
+    verify(&mut h, &f, &mut m, dims, "after the queued clicks");
+    for k in 0..5 {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("undo {k}"));
+    }
+    for k in 0..5 {
+        step_history(&mut h, &f, &mut m, dims, true, &format!("redo {k}"));
+    }
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+// ---------------------------------------------------------------------------------------------
+// Scenario 3: undo / redo while armed, while reading, and with clicks waiting.
+
+/// Ctrl+Z or Ctrl+Shift+Z without waiting for anything; the model follows.
+fn undo_now(h: &mut Harness<'_, EffectcraftApp>, m: &mut Model, redo: bool) {
+    if redo {
+        key(h, Key::Z, CTRL_SHIFT);
+        m.cur += 1;
+    } else {
+        key(h, Key::Z, CTRL);
+        m.cur -= 1;
+    }
+    m.moved();
+}
+
+fn blur_value(h: &Harness<'_, EffectcraftApp>, f: &Fix) -> Value {
+    let s = &h.state().session;
+    let l = s.project.comp(effectcraft_engine::project::ItemId(f.comp)).unwrap().layer(LayerId(f.plate)).unwrap();
+    l.effects().unwrap().groups().next().unwrap().get("blurriness").unwrap().value.to_json()
+}
+
+#[test]
+fn undo_and_redo_while_reading_and_with_clicks_waiting() {
+    let (mut s, f) = session("reading", 3840, 2160, true, false);
+    let dims = [3840.0, 2160.0];
+    let hold = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let log = ReadLog::default();
+    s.footage = std::sync::Arc::new(Held(s.footage.clone(), hold.clone(), log.clone()));
+    let mut h = harness(s, vec2(1280.0, 860.0));
+    let mut m = Model::new(&h, f.comp);
+    let pl = f.plate;
+    let (a, b) = ([1017.5, 594.5], [1868.5, 1174.5]);
+    let sp = |h: &Harness<'_, EffectcraftApp>, m: &Model, p: [f64; 2]| comp_to_screen(&h.ctx, comp_point(m.state(), pl, p, dims)).unwrap();
+    use Step::*;
+    for (n, st) in [Arm(pl), Pick(a, Modifiers::NONE, "c27_20"), Pick(b, Modifiers::SHIFT, "c50_40")].iter().enumerate() {
+        run_step(&mut h, &f, &mut m, dims, st, n);
+    }
+    let blur = |h: &mut Harness<'_, EffectcraftApp>, m: &mut Model, v: f64| {
+        h.state_mut().session.execute_checked("prop.set", json!({"comp": f.comp, "layer": pl, "path": "effects/#1/blurriness", "value": v})).unwrap();
+        let label = h.state().session.history.undo.last().unwrap().0.clone();
+        let o = m.state().clone();
+        m.record(&label, o, &format!("blur {v}"));
+    };
+
+    // (a) Undo a pick while armed: the probe goes with the edit, the chip says it is reading,
+    // then names the right IDs with the right "(selected)" for the state undone to.
+    let pb = sp(&h, &m, b);
+    assert_eq!(hover(&mut h, pb), "c50_40 (selected)");
+    let builds = h.state().session.crypto_probe_stats().1;
+    undo_now(&mut h, &mut m, false);
+    let right_after = chip(&h);
+    eprintln!("chip right after undoing a pick: {right_after:?}");
+    assert_eq!(hover(&mut h, pb), "c50_40", "after undo: not selected any more");
+    let pa = sp(&h, &m, a);
+    assert_eq!(hover(&mut h, pa), "c27_20 (selected)");
+    assert!(highlight(&h));
+    let rebuilt = h.state().session.crypto_probe_stats().1 - builds;
+    eprintln!("probes built for undoing one pick: {rebuilt}");
+    verify(&mut h, &f, &mut m, dims, "(a) undo a pick while armed");
+
+    // (b) Ctrl+Z while the IDs are being read (a build in flight for the state undone).
+    blur(&mut h, &mut m, 41.0);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    h.event(Event::PointerMoved(pa));
+    h.run_steps(2);
+    wait_held_id_read(&mut h, &log);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    undo_now(&mut h, &mut m, false);
+    hold.store(false, Ordering::Release);
+    assert_eq!(blur_value(&h, &f), json!(40.0));
+    verify(&mut h, &f, &mut m, dims, "(b) undo while reading");
+    assert_eq!(hover(&mut h, pb), "c50_40", "the probe answers for the state undone to");
+    // ... and Ctrl+Shift+Z while reading.
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    h.state_mut().session.drop_crypto_probe();
+    h.event(Event::PointerMoved(pa));
+    h.run_steps(2);
+    wait_held_id_read(&mut h, &log);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    undo_now(&mut h, &mut m, true);
+    hold.store(false, Ordering::Release);
+    assert_eq!(blur_value(&h, &f), json!(41.0));
+    verify(&mut h, &f, &mut m, dims, "(b) redo while reading");
+
+    // (c) A click waiting for the probe, then Ctrl+Z: the undo goes first and the waiting click
+    // is not made on the state undone to (it was aimed at the state before the undo).
+    blur(&mut h, &mut m, 42.0);
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    h.event(Event::PointerMoved(pb));
+    h.run_steps(2);
+    wait_held_id_read(&mut h, &log);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    press(&mut h, pb, Modifiers::SHIFT);
+    assert_eq!(chip(&h).as_deref(), Some(READING), "the click waits");
+    h.state_mut().ui.status.clear();
+    undo_now(&mut h, &mut m, false);
+    // (Asked at once: a status message goes after 5 s, which is 20 steps here.)
+    assert!(h.state().ui.status.starts_with("Pick not made"), "the dropped click says so: {:?}", h.state().ui.status);
+    hold.store(false, Ordering::Release);
+    wait_probe(&mut h);
+    h.run_steps(3);
+    verify(&mut h, &f, &mut m, dims, "(c) waiting click, then Ctrl+Z: the click is not made");
+
+    // (d) Ctrl+Z, then a click while the probe is rebuilt: the click is made on the state undone
+    // to, as one step, and the redo line becomes a branch.
+    undo_now(&mut h, &mut m, false); // the blur 41
+    undo_now(&mut h, &mut m, false); // the pick of c27_20: the Selection is now empty
+    assert_eq!(sel_of(m.state(), pl), "", "{:?}", m.state());
+    let pb = sp(&h, &m, b);
+    h.event(Event::PointerMoved(pb));
+    h.run_steps(2);
+    // (The blur's render is in the layer cache: the rebuild can be done already.)
+    press(&mut h, pb, Modifiers::SHIFT);
+    wait_probe(&mut h);
+    h.run_steps(3);
+    let mut o = m.state().clone();
+    layer_mut(&mut o, pl).crypto_mut().1 = "c50_40".into();
+    let label = h.state().session.history.undo.last().unwrap().0.clone();
+    m.record(&label, o, "(d) click after undo");
+    verify(&mut h, &f, &mut m, dims, "(d) Ctrl+Z, then a click while reading");
+
+    // (e) Ctrl+Z, a click waiting, then Ctrl+Shift+Z: the click is not made.
+    blur(&mut h, &mut m, 43.0);
+    verify(&mut h, &f, &mut m, dims, "(e) blur 43");
+    // (Undo goes back to a render the layer cache keeps: forget it, so the probe takes a while.)
+    // Hold before undo_now: it steps the UI and would otherwise start (and finish) a rebuild.
+    h.state().session.layer_cache.clear();
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    undo_now(&mut h, &mut m, false);
+    let pa = sp(&h, &m, a);
+    h.event(Event::PointerMoved(pa));
+    h.run_steps(2);
+    wait_held_id_read(&mut h, &log);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    press(&mut h, pa, Modifiers::SHIFT);
+    undo_now(&mut h, &mut m, true);
+    hold.store(false, Ordering::Release);
+    wait_probe(&mut h);
+    h.run_steps(3);
+    verify(&mut h, &f, &mut m, dims, "(e) waiting click, then Ctrl+Shift+Z: the click is not made");
+
+    // (f) A click waiting, Ctrl+Z, another click: only the second is made, on the undone state.
+    hold.store(true, Ordering::Release);
+    log.lock().unwrap().clear();
+    blur(&mut h, &mut m, 44.0);
+    h.event(Event::PointerMoved(pa));
+    h.run_steps(2);
+    wait_held_id_read(&mut h, &log);
+    assert_eq!(chip(&h).as_deref(), Some(READING));
+    press(&mut h, pa, Modifiers::ALT);
+    undo_now(&mut h, &mut m, false);
+    press(&mut h, pa, Modifiers::SHIFT);
+    assert_eq!(chip(&h).as_deref(), Some(READING), "both clicks made while the build is held");
+    hold.store(false, Ordering::Release);
+    wait_probe(&mut h);
+    h.run_steps(3);
+    let mut o = m.state().clone();
+    let c = layer_mut(&mut o, pl).crypto_mut();
+    c.1 = model_pick(&c.1, "c27_20", "add");
+    let label = h.state().session.history.undo.last().unwrap().0.clone();
+    m.record(&label, o, "(f) second click");
+    verify(&mut h, &f, &mut m, dims, "(f) click, Ctrl+Z, click: only the second is made");
+    for k in 0..m.cur {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("undo all {k}"));
+    }
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+// ---------------------------------------------------------------------------------------------
+// Scenario 4: Esc mid-sequence; undo across Revert, Open and New.
+
+#[test]
+fn esc_mid_sequence_and_undo_across_revert_open_and_new() {
+    let (s, f) = session("reload", 320, 180, false, false);
+    let dims = [320.0, 180.0];
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    let mut m = Model::new(&h, f.comp);
+    let ctr = |cx: usize, cy: usize| [cx as f64 * 37.0 + 18.5, cy as f64 * 29.0 + 14.5];
+    let pl = f.plate;
+    use Step::*;
+    let steps = [Arm(pl), Pick(ctr(1, 1), Modifiers::NONE, "c1_1"), Opacity(f.other, 50.0, None), Pick(ctr(3, 3), Modifiers::SHIFT, "c3_3"), Esc];
+    for (n, st) in steps.iter().enumerate() {
+        run_step(&mut h, &f, &mut m, dims, st, n);
+    }
+    // Disarmed: undo and redo still walk the picks, and don't arm it again.
+    for k in 0..3 {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("undo after Esc {k}"));
+    }
+    for k in 0..3 {
+        step_history(&mut h, &f, &mut m, dims, true, &format!("redo after Esc {k}"));
+    }
+    // Esc while armed with a pick just made: one Esc, no step, no undo.
+    run_step(&mut h, &f, &mut m, dims, &Arm(pl), 10);
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(2, 2), Modifiers::SHIFT, "c2_2"), 11);
+    run_step(&mut h, &f, &mut m, dims, &Esc, 12);
+    // Saved, then one more pick, then Revert: the saved state, no history, still a sane pick.
+    let path = f.dir.join("saved.ecproj");
+    h.state_mut().session.execute("file.save", json!({"path": path.to_string_lossy()})).unwrap();
+    let saved = m.state().clone();
+    run_step(&mut h, &f, &mut m, dims, &Arm(pl), 13);
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(4, 4), Modifiers::SHIFT, "c4_4"), 14);
+    let pick = h.state().ui.fx_pick.clone();
+    h.state_mut().session.execute("file.revert", json!({})).unwrap();
+    h.run_steps(3);
+    let armed_after_revert = h.state().ui.fx_pick.clone();
+    eprintln!("armed before Revert {pick:?}, after {armed_after_revert:?}; chip {:?}", chip(&h));
+    m.line = vec![("Original".into(), saved.clone())];
+    (m.cur, m.branches) = (0, 0);
+    m.branch_states.clear();
+    m.armed = armed_after_revert.as_ref().map(|p| (p.layer, p.prop));
+    verify(&mut h, &f, &mut m, dims, "after Revert");
+    step_history(&mut h, &f, &mut m, dims, false, "Ctrl+Z after Revert: nothing");
+    if m.armed.is_none() {
+        run_step(&mut h, &f, &mut m, dims, &Arm(pl), 15);
+    }
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(5, 1), Modifiers::SHIFT, "c5_1"), 16);
+    step_history(&mut h, &f, &mut m, dims, false, "undo the pick after Revert");
+    step_history(&mut h, &f, &mut m, dims, true, "redo the pick after Revert");
+    // New Project: the pick ends, nothing to undo.
+    h.state_mut().session.execute("file.newProject", json!({})).unwrap();
+    h.run_steps(3);
+    eprintln!("after New Project: armed {:?}, chip {:?}, status {:?}", h.state().ui.fx_pick, chip(&h), h.state().ui.status);
+    assert!(chip(&h).is_none(), "no viewer, no chip");
+    let items = effectcraft_ui_egui::menus::menu_items(h.state());
+    let undo = items.iter().find(|i| i.id == "edit.undo").unwrap();
+    assert_eq!((undo.label.as_str(), undo.enabled), ("Can't Undo", false));
+    // Open the saved project: its state, no history; arm and pick as usual.
+    h.state_mut().session.execute("file.open", json!({"path": path.to_string_lossy()})).unwrap();
+    settle(&mut h);
+    m.line = vec![("Original".into(), saved)];
+    (m.cur, m.branches, m.armed) = (0, 0, None);
+    // (Still armed from before New, on the same ids: see `opening_a_project_ends_the_pick`.)
+    if let Some(p) = h.state().ui.fx_pick.as_ref() {
+        eprintln!("after Open: still armed {p:?}, chip {:?}", chip(&h));
+        m.armed = Some((p.layer, p.prop));
+    }
+    m.branch_states.clear();
+    m.time = h.state().session.time_of(effectcraft_engine::project::ItemId(f.comp)).seconds();
+    verify(&mut h, &f, &mut m, dims, "after Open");
+    if m.armed.is_none() {
+        run_step(&mut h, &f, &mut m, dims, &Arm(pl), 20);
+    }
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(6, 2), Modifiers::NONE, "c6_2"), 21);
+    step_history(&mut h, &f, &mut m, dims, false, "undo after Open");
+    step_history(&mut h, &f, &mut m, dims, false, "undo past Open: nothing");
+    step_history(&mut h, &f, &mut m, dims, true, "redo after Open");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+// ---------------------------------------------------------------------------------------------
+// Scenario 5: grouping and labels.
+
+#[test]
+fn picks_never_merge_with_neighbouring_edits() {
+    let (s, f) = session("group", 320, 180, false, false);
+    let dims = [320.0, 180.0];
+    let mut h = harness(s, vec2(1024.0, 700.0));
+    let mut m = Model::new(&h, f.comp);
+    let ctr = |cx: usize, cy: usize| [cx as f64 * 37.0 + 18.5, cy as f64 * 29.0 + 14.5];
+    let pl = f.plate;
+    use Step::*;
+    run_step(&mut h, &f, &mut m, dims, &Arm(pl), 0);
+    // A scrub of the plate's opacity (one merged step), a pick, the same scrub going on: three.
+    run_step(&mut h, &f, &mut m, dims, &Opacity(pl, 90.0, Some("scrub-1")), 1);
+    let n = h.state().session.history.undo.len();
+    h.state_mut()
+        .session
+        .execute_checked("prop.set", json!({"comp": f.comp, "layer": pl, "path": "transform/opacity", "value": 85.0, "merge": "scrub-1"}))
+        .unwrap();
+    assert_eq!(h.state().session.history.undo.len(), n, "a scrub merges");
+    layer_mut(&mut m.line.last_mut().unwrap().1, pl).opacity = json!(85.0);
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(1, 1), Modifiers::NONE, "c1_1"), 2);
+    run_step(&mut h, &f, &mut m, dims, &Opacity(pl, 80.0, Some("scrub-1")), 3);
+    // A pick next to a typed Selection.
+    run_step(&mut h, &f, &mut m, dims, &Type(pl, "c2_2"), 4);
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(3, 3), Modifiers::SHIFT, "c3_3"), 5);
+    run_step(&mut h, &f, &mut m, dims, &Type(pl, "c2_2, c3_3, c4_4"), 6);
+    // Two picks in a row.
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(4, 4), Modifiers::ALT, "c4_4"), 7);
+    run_step(&mut h, &f, &mut m, dims, &Pick(ctr(5, 5), Modifiers::SHIFT, "c5_5"), 8);
+    for k in 0..m.cur {
+        step_history(&mut h, &f, &mut m, dims, false, &format!("undo {k}"));
+    }
+    for (l, w) in &m.labels {
+        eprintln!("LABEL {l:?} (first from {w})");
+    }
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// FINDING 4. Typing in the Selection field (not committed yet) and then clicking an ID in the
+/// viewer: the pick is made first, on the Selection before the typing, and then the field loses
+/// the focus and commits the typed text over it. The pick is lost, yet it left an undo step (to a
+/// state never shown). Expected: the typed text, then the pick on top, one step each.
+#[test]
+fn a_click_while_the_selection_field_is_being_edited() {
+    let (s, f) = session("typing", 320, 180, false, false);
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    let pl = f.plate;
+    arm(&mut h, &f, pl);
+    let a = comp_to_screen(&h.ctx, [37.0 + 18.5, 29.0 + 14.5]).unwrap();
+    assert_eq!(hover(&mut h, a), "c1_1");
+    let n = h.state().session.history.undo.len();
+    type_selection(&mut h, &f, pl, "c2_2", false);
+    assert!(h.ctx.memory(|m| m.focused().is_some()), "the field is being edited");
+    // Ctrl+Z in the field is the field's own: no global undo.
+    key(&mut h, Key::Z, CTRL);
+    assert_eq!(h.state().session.history.undo.len(), n, "Ctrl+Z while typing doesn't undo the project");
+    type_selection(&mut h, &f, pl, "c2_2", false);
+    click(&mut h, a, Modifiers::SHIFT);
+    h.run_steps(3);
+    let sel = sel_of(&observe(&h.state().session, f.comp), pl);
+    let steps: Vec<String> = h.state().session.history.undo[n..].iter().map(|u| u.0.clone()).collect();
+    // The state between the two steps (what one Ctrl+Z goes back to).
+    let mid = h.state().session.history.undo.last().map(|u| {
+        let c = u.1.comp(effectcraft_engine::project::ItemId(f.comp)).unwrap().layer(LayerId(pl)).unwrap();
+        c.effects().unwrap().groups().next().unwrap().get("selection").unwrap().value.to_json()
+    });
+    eprintln!("the state one Ctrl+Z goes back to: Selection {mid:?}");
+    eprintln!("typed c2_2 (uncommitted) + Shift-click c1_1: Selection {sel:?}, steps {steps:?}");
+    assert_eq!((sel.as_str(), steps.len()), ("c2_2, c1_1", 2), "the typed text, then the pick on top, one step each");
+    key(&mut h, Key::Z, CTRL);
+    assert_eq!(sel_of(&observe(&h.state().session, f.comp), pl), "c2_2", "undo takes back the pick");
+    key(&mut h, Key::Z, CTRL);
+    assert_eq!(sel_of(&observe(&h.state().session, f.comp), pl), "", "then the typed text");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// On an animated Selection a pick sets (or adds) the key at the current time: one step, and
+/// undo takes the key back.
+#[test]
+fn a_pick_on_an_animated_selection_is_one_step() {
+    let (s, f) = session("anim", 320, 180, false, false);
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    let pl = f.plate;
+    let uid = arm(&mut h, &f, pl);
+    let keys = |h: &Harness<'_, EffectcraftApp>| {
+        let s = &h.state().session;
+        let l = s.project.comp(effectcraft_engine::project::ItemId(f.comp)).unwrap().layer(LayerId(pl)).unwrap();
+        l.props.find(uid).unwrap().keys.iter().map(|k| (k.time.seconds(), k.value.to_json())).collect::<Vec<_>>()
+    };
+    h.state_mut().session.execute_checked("prop.toggleAnimation", json!({"comp": f.comp, "layer": pl, "prop": uid, "value": true})).unwrap();
+    h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(1.0));
+    settle(&mut h);
+    let n = h.state().session.history.undo.len();
+    let before = keys(&h);
+    let a = comp_to_screen(&h.ctx, [37.0 + 18.5, 29.0 + 14.5]).unwrap();
+    assert_eq!(hover(&mut h, a), "c1_1");
+    click(&mut h, a, Modifiers::NONE);
+    assert_eq!(h.state().session.history.undo.len(), n + 1);
+    assert_eq!(keys(&h), [before.clone(), vec![(1.0, json!("c1_1"))]].concat(), "a key at 1 s");
+    key(&mut h, Key::Z, CTRL);
+    assert_eq!(keys(&h), before, "undo takes the key back");
+    assert_eq!(hover(&mut h, a), "c1_1");
+    key(&mut h, Key::Z, CTRL_SHIFT);
+    assert_eq!(hover(&mut h, a), "c1_1 (selected)");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+// ---------------------------------------------------------------------------------------------
+// Findings: minimal failing tests (fixes proposed in research/crypick-undo-fixes.patch).
+
+/// FINDING 1. Undoing (or redoing) a pick changes only the Selection, which the probe doesn't
+/// read, yet the probe is dropped and built again: on a 3D precomp that is ~0.6 s of "Reading
+/// Cryptomatte IDs…" after every Ctrl+Z of a pick (the pick itself keeps it).
+#[test]
+fn undoing_or_redoing_a_pick_keeps_the_probe() {
+    let (mut s, f) = session("keep", 320, 180, false, false);
+    let q = json!({"comp": f.comp, "layer": f.plate, "effect": 1, "x": 55.5, "y": 43.5, "probeOnly": true});
+    s.crypto_probe_job(&q).unwrap().expect("nothing built yet")();
+    let pick = json!({"comp": f.comp, "layer": f.plate, "effect": 1, "x": 55.5, "y": 43.5});
+    s.execute_checked("effect.pickCryptomatte", pick).unwrap();
+    assert!(s.crypto_probe_job(&q).unwrap().is_none(), "the pick keeps the probe");
+    s.execute_checked("edit.undo", json!({})).unwrap();
+    assert!(s.crypto_probe_job(&q).unwrap().is_none(), "so does its undo");
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["selected"], false);
+    s.execute_checked("edit.redo", json!({})).unwrap();
+    assert!(s.crypto_probe_job(&q).unwrap().is_none(), "and its redo");
+    assert_eq!(s.execute("effect.cryptomatteAt", q.clone()).unwrap()["selected"], true);
+    // Any other edit still drops it.
+    s.execute_checked("prop.set", json!({"comp": f.comp, "layer": f.plate, "path": "transform/opacity", "value": 50})).unwrap();
+    s.execute_checked("edit.undo", json!({})).unwrap();
+    assert!(s.crypto_probe_job(&q).unwrap().is_some(), "an undone opacity change is a new probe");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// FINDING 2. The eyedropper stays armed through New Project, Open and Revert: the pick is kept
+/// by layer id and property uid only, and a new project reuses them. Rebuilt the same way, the
+/// new project's Cryptomatte is picked into by a plain viewer click the user never armed.
+#[test]
+fn a_new_or_opened_project_ends_the_pick() {
+    let (s, f) = session("stale", 320, 180, false, false);
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    let path = f.dir.join("plate.exr").to_string_lossy().to_string();
+    let saved = f.dir.join("saved.ecproj").to_string_lossy().to_string();
+    h.state_mut().session.execute("file.save", json!({"path": saved})).unwrap();
+    // Open (the same file, as Revert does).
+    arm(&mut h, &f, f.plate);
+    h.state_mut().session.execute("file.open", json!({"path": saved})).unwrap();
+    settle(&mut h);
+    assert!(h.state().ui.fx_pick.is_none(), "Open ends the pick: {:?}", h.state().ui.fx_pick);
+    // New Project, then the same setup built in it.
+    h.state_mut().ui.fx_pick = None;
+    h.run_steps(2);
+    arm(&mut h, &f, f.plate);
+    h.state_mut().session.execute("file.newProject", json!({})).unwrap();
+    h.run_steps(3);
+    let g = populate(&mut h.state_mut().session, &path, 320, 180, false, false, f.dir.clone());
+    settle(&mut h);
+    let stale = h.state().ui.fx_pick.clone();
+    let a = comp_to_screen(&h.ctx, [55.5, 43.5]).unwrap();
+    click(&mut h, a, Modifiers::NONE);
+    let sel = sel_of(&observe(&h.state().session, g.comp), g.plate);
+    assert!(stale.is_none() && sel.is_empty(), "New ends the pick: armed {stale:?}; a plain click picked {sel:?} into the new project");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// FINDING 3 (wording). A pick's undo step is "Change Property", the same as an opacity change
+/// or a typed Selection: Edit ▸ Undo and the History panel can't tell them apart. The command
+/// is "Pick Cryptomatte"; its step could say so.
+#[test]
+fn a_pick_is_labelled_as_a_pick() {
+    let (s, f) = session("label", 320, 180, false, false);
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    arm(&mut h, &f, f.plate);
+    let a = comp_to_screen(&h.ctx, [55.5, 43.5]).unwrap();
+    click(&mut h, a, Modifiers::NONE);
+    let items = effectcraft_ui_egui::menus::menu_items(h.state());
+    let undo = items.iter().find(|i| i.id == "edit.undo").unwrap();
+    assert_eq!(undo.label, "Undo Pick Cryptomatte");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
+
+/// FINDING 5 (from review). A middle-button drag pans the viewer, armed or not: egui hands the
+/// press to the eyedropper's overlay (it sensed drags the pass before), so armed it didn't pan.
+#[test]
+fn a_middle_drag_pans_while_armed() {
+    let (s, f) = session("pan", 320, 180, false, false);
+    let mut h = harness(s, vec2(1400.0, 860.0));
+    let a = comp_to_screen(&h.ctx, [160.0, 90.0]).unwrap();
+    let drag = |h: &mut Harness<'_, EffectcraftApp>| {
+        let before = h.state().ui.viewer.pan;
+        h.event(Event::PointerMoved(a));
+        h.step();
+        h.event(Event::PointerButton { pos: a, button: PointerButton::Middle, pressed: true, modifiers: Modifiers::NONE });
+        h.step();
+        for k in 1..=5 {
+            h.event(Event::PointerMoved(a + vec2(10.0 * k as f32, 0.0)));
+            h.step();
+        }
+        h.event(Event::PointerButton { pos: a + vec2(50.0, 0.0), button: PointerButton::Middle, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(2);
+        let after = h.state().ui.viewer.pan;
+        h.state_mut().ui.viewer.pan = before;
+        h.run_steps(2);
+        after[0] - before[0]
+    };
+    let unarmed = drag(&mut h);
+    let n = h.state().session.history.undo.len();
+    arm(&mut h, &f, f.plate);
+    let armed = drag(&mut h);
+    assert_eq!(h.state().session.history.undo.len(), n, "no pick");
+    assert!(h.state().ui.fx_pick.is_some(), "still armed");
+    assert!((unarmed - 50.0).abs() < 0.01 && (armed - 50.0).abs() < 0.01, "a 50 px middle drag pans 50 px: unarmed {unarmed}, armed {armed}");
+    let _ = std::fs::remove_dir_all(&f.dir);
+}
diff --git a/crates/ui-egui/tests/it/ui_dialog_preview.rs b/crates/ui-egui/tests/it/ui_dialog_preview.rs
new file mode 100644
index 000000000..ce5f2803e
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_dialog_preview.rs
@@ -0,0 +1,303 @@
+//! Preview in the settings dialogs that edit something that exists (After Effects' Preview
+//! checkbox): Solid Settings on a solid layer, Camera Settings, Light Settings and Composition
+//! Settings. A change of the draft reaches the project at once, so the canvas shows it while it is
+//! made; OK keeps it in one undo step, Cancel and Escape take it back, and with Preview off nothing
+//! is applied until OK. The window behind a previewing dialog is not dimmed, and the dialog opens
+//! at the lower right; the same dialogs creating something new keep the middle.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{ItemKind, LayerId, Resolution};
+use effectcraft_ui_egui::{Dialog, EffectcraftApp, menus};
+use egui::{Event, Key, Modifiers, PointerButton, Pos2, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::{Value, json};
+
+fn harness(setup: impl FnOnce(&mut Session)) -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 10})).unwrap();
+    setup(&mut s);
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h
+}
+
+fn open(h: &mut Harness<'_, EffectcraftApp>, id: &str, params: Value) {
+    let ctx = h.ctx.clone();
+    menus::invoke(h.state_mut(), &ctx, id, params).unwrap();
+    h.run_steps(3);
+}
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let r = h.state().auto.find(id).unwrap_or_else(|| panic!("no automation id {id}")).rect;
+    pos2(r[0] + r[2] / 2.0, r[1] + r[3] / 2.0)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = center(h, id);
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn escape(h: &mut Harness<'_, EffectcraftApp>) {
+    h.input_mut().events.push(Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.input_mut().events.push(Event::Key { key: Key::Escape, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn undo_len(h: &Harness<'_, EffectcraftApp>) -> usize {
+    h.state().session.history.undo.len()
+}
+
+fn solid_size(h: &Harness<'_, EffectcraftApp>, layer: u64) -> [u32; 2] {
+    let s = &h.state().session;
+    let l = s.active_comp().unwrap().layer(LayerId(layer)).unwrap();
+    let effectcraft_engine::project::LayerSource::Solid { item } = l.source else { panic!("not a solid") };
+    match &s.project.item(item).unwrap().kind {
+        ItemKind::Solid(so) => [so.width, so.height],
+        k => panic!("{k:?}"),
+    }
+}
+
+fn scalar(h: &Harness<'_, EffectcraftApp>, layer: u64, path: &str) -> f64 {
+    let s = &h.state().session;
+    let l = s.active_comp().unwrap().layer(LayerId(layer)).unwrap();
+    l.props.prop(path).unwrap().value_at(l.layer_time(s.time())).as_f64()
+}
+
+fn comp_width(h: &Harness<'_, EffectcraftApp>) -> u32 {
+    h.state().session.active_comp().unwrap().width
+}
+
+fn solid_setup(s: &mut Session) {
+    s.execute("layer.newSolid", json!({"name": "Box", "color": "#ff0000", "width": 100, "height": 100})).unwrap();
+}
+
+fn solid_layer(h: &Harness<'_, EffectcraftApp>) -> u64 {
+    h.state().session.active_comp().unwrap().layers[0].id.0
+}
+
+#[test]
+fn solid_settings_previews_live_and_cancel_and_escape_take_it_back() {
+    let mut h = harness(solid_setup);
+    let l = solid_layer(&h);
+    let undo = undo_len(&h);
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    assert_eq!(h.state().dialog, Some(Dialog::SolidSettings));
+    assert!(h.state().auto.find("dialog.solid.preview").is_some(), "a Preview checkbox");
+    h.state_mut().dialog_state_mut().solid_size = [200, 150];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [200, 150], "the canvas shows the new size before OK");
+    h.state_mut().dialog_state_mut().solid_size = [240, 120];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [240, 120]);
+    assert_eq!(undo_len(&h), undo + 1, "however much was tried, the project is the original plus one command");
+    click(&mut h, "dialog.solid.cancel");
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(solid_size(&h, l), [100, 100], "Cancel puts it back");
+    assert_eq!(undo_len(&h), undo, "and leaves no undo step");
+    // Escape does the same.
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    h.state_mut().dialog_state_mut().solid_size = [200, 150];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [200, 150]);
+    escape(&mut h);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(solid_size(&h, l), [100, 100]);
+    assert_eq!(undo_len(&h), undo);
+}
+
+#[test]
+fn solid_settings_ok_keeps_the_preview_as_one_undo_step() {
+    let mut h = harness(solid_setup);
+    let l = solid_layer(&h);
+    let undo = undo_len(&h);
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    h.state_mut().dialog_state_mut().solid_size = [200, 150];
+    h.run_steps(3);
+    h.state_mut().dialog_state_mut().solid_size = [220, 130];
+    h.run_steps(3);
+    click(&mut h, "dialog.solid.ok");
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(solid_size(&h, l), [220, 130]);
+    assert_eq!(undo_len(&h), undo + 1, "one undo step");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(solid_size(&h, l), [100, 100], "undone in one go");
+}
+
+#[test]
+fn with_preview_off_nothing_is_applied_until_ok() {
+    let mut h = harness(solid_setup);
+    let l = solid_layer(&h);
+    let undo = undo_len(&h);
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    h.state_mut().dialog_state_mut().solid_size = [200, 150];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [200, 150]);
+    click(&mut h, "dialog.solid.preview");
+    assert!(!h.state().dialog_state().live.on);
+    assert_eq!(solid_size(&h, l), [100, 100], "switching Preview off takes the preview back");
+    assert_eq!(undo_len(&h), undo);
+    h.state_mut().dialog_state_mut().solid_size = [260, 140];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [100, 100], "nothing is applied while editing");
+    click(&mut h, "dialog.solid.ok");
+    assert_eq!(solid_size(&h, l), [260, 140], "OK applies the draft");
+    assert_eq!(undo_len(&h), undo + 1);
+}
+
+#[test]
+fn camera_settings_preview() {
+    let mut h = harness(|s| {
+        s.execute("layer.newCamera", json!({})).unwrap();
+    });
+    let l = solid_layer(&h);
+    let before = scalar(&h, l, "cameraOptions/zoom");
+    let undo = undo_len(&h);
+    open(&mut h, "layer.cameraSettings", json!({"layer": l}));
+    assert_eq!(h.state().dialog, Some(Dialog::CameraSettings));
+    assert!(h.state().auto.find("dialog.camera.preview").is_some());
+    h.state_mut().dialog_state_mut().camera.zoom = before + 500.0;
+    h.run_steps(3);
+    assert!((scalar(&h, l, "cameraOptions/zoom") - (before + 500.0)).abs() < 1e-6, "the zoom changes live");
+    assert_eq!(undo_len(&h), undo + 1);
+    click(&mut h, "dialog.camera.cancel");
+    assert!((scalar(&h, l, "cameraOptions/zoom") - before).abs() < 1e-6, "Cancel puts the zoom back");
+    assert_eq!(undo_len(&h), undo);
+    open(&mut h, "layer.cameraSettings", json!({"layer": l}));
+    h.state_mut().dialog_state_mut().camera.zoom = before + 300.0;
+    h.run_steps(3);
+    click(&mut h, "dialog.camera.ok");
+    assert!((scalar(&h, l, "cameraOptions/zoom") - (before + 300.0)).abs() < 1e-6, "OK keeps it");
+    assert_eq!(undo_len(&h), undo + 1);
+}
+
+#[test]
+fn light_settings_preview() {
+    let mut h = harness(|s| {
+        s.execute("layer.newLight", json!({"kind": "Point"})).unwrap();
+    });
+    let l = solid_layer(&h);
+    let before = scalar(&h, l, "lightOptions/intensity");
+    let undo = undo_len(&h);
+    open(&mut h, "layer.lightSettings", json!({"layer": l}));
+    assert_eq!(h.state().dialog, Some(Dialog::LightSettings));
+    assert!(h.state().auto.find("dialog.light.preview").is_some());
+    h.state_mut().dialog_state_mut().light.intensity = before + 37.0;
+    h.run_steps(3);
+    assert!((scalar(&h, l, "lightOptions/intensity") - (before + 37.0)).abs() < 1e-6, "the intensity changes live");
+    escape(&mut h);
+    assert_eq!(h.state().dialog, None);
+    assert!((scalar(&h, l, "lightOptions/intensity") - before).abs() < 1e-6, "Escape puts it back");
+    assert_eq!(undo_len(&h), undo);
+}
+
+#[test]
+fn composition_settings_preview() {
+    let mut h = harness(|_| {});
+    let before = comp_width(&h);
+    let undo = undo_len(&h);
+    open(&mut h, "comp.settings", json!({}));
+    assert_eq!(h.state().dialog, Some(Dialog::CompSettings));
+    assert!(h.state().auto.find("dialog.comp.preview").is_some());
+    h.state_mut().dialog_state_mut().comp.width = before + 80;
+    h.run_steps(3);
+    assert_eq!(comp_width(&h), before + 80, "the comp is resized live");
+    click(&mut h, "dialog.comp.cancel");
+    assert_eq!(comp_width(&h), before, "Cancel puts the size back");
+    assert_eq!(undo_len(&h), undo);
+    open(&mut h, "comp.settings", json!({}));
+    h.state_mut().dialog_state_mut().comp.width = before + 40;
+    h.run_steps(3);
+    click(&mut h, "dialog.comp.ok");
+    assert_eq!(comp_width(&h), before + 40, "OK keeps it");
+    assert_eq!(undo_len(&h), undo + 1, "in one undo step");
+}
+
+/// The Resolution is no part of the Composition Settings command, so a preview never applies it:
+/// OK has to, also when it keeps a preview of another field.
+#[test]
+fn composition_settings_ok_after_a_preview_still_applies_the_resolution() {
+    let mut h = harness(|_| {});
+    let before = comp_width(&h);
+    open(&mut h, "comp.settings", json!({}));
+    h.state_mut().dialog_state_mut().comp.width = before + 80;
+    h.run_steps(3);
+    assert_eq!(comp_width(&h), before + 80, "the preview applied the width");
+    h.state_mut().dialog_state_mut().comp.resolution = Resolution::Half;
+    h.run_steps(3);
+    click(&mut h, "dialog.comp.ok");
+    assert_eq!(comp_width(&h), before + 80);
+    assert_eq!(h.state().session.active_comp().unwrap().resolution, Resolution::Half, "OK applied the Resolution");
+}
+
+/// An edit made in the same frame as OK (Enter) is not in the last preview yet: OK brings the
+/// project up to the draft it finds instead of keeping the older preview.
+#[test]
+fn ok_in_the_frame_of_an_edit_keeps_the_edit_not_the_older_preview() {
+    let mut h = harness(solid_setup);
+    let l = solid_layer(&h);
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    h.state_mut().dialog_state_mut().solid_size = [200, 150];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [200, 150]);
+    h.state_mut().dialog_state_mut().solid_size = [240, 120];
+    h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.step();
+    h.run_steps(2);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(solid_size(&h, l), [240, 120], "OK kept the draft it found, not the earlier preview");
+}
+
+/// A previewing dialog opens at the lower right so the canvas stays in view; the same dialogs
+/// creating something new keep the middle and have no Preview.
+#[test]
+fn previewing_dialogs_open_at_the_lower_right_and_new_ones_in_the_middle() {
+    let mut h = harness(solid_setup);
+    let l = solid_layer(&h);
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    let ok = center(&h, "dialog.solid.ok");
+    assert!(ok.x > 800.0 && ok.y > 500.0, "Solid Settings on a layer is in the lower right: {ok:?}");
+    click(&mut h, "dialog.solid.cancel");
+    open(&mut h, "layer.newSolid", json!({}));
+    assert_eq!(h.state().dialog, Some(Dialog::SolidSettings));
+    assert!(h.state().auto.find("dialog.solid.preview").is_none(), "a new solid has no Preview");
+    let ok = center(&h, "dialog.solid.ok");
+    assert!(ok.x < 1000.0, "New Solid stays in the middle: {ok:?}");
+}
+
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=6 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (k as f32 / 6.0)));
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+/// A previewing dialog opens at the lower right, but it can be dragged by its title to wherever
+/// the canvas needs to be seen, and the preview keeps working from there.
+#[test]
+fn a_previewing_dialog_can_be_dragged_by_its_title() {
+    let mut h = harness(solid_setup);
+    let l = solid_layer(&h);
+    open(&mut h, "layer.settings", json!({"layer": l}));
+    let ok = center(&h, "dialog.solid.ok");
+    let title = h.get_by_label("Solid Settings").rect().center();
+    drag(&mut h, title, title + egui::vec2(-500.0, -300.0));
+    let moved = center(&h, "dialog.solid.ok");
+    assert!(moved.x < ok.x - 300.0 && moved.y < ok.y - 150.0, "the dialog followed the drag: {ok:?} -> {moved:?}");
+    // Still previewing, and the position is kept from frame to frame.
+    h.state_mut().dialog_state_mut().solid_size = [200, 150];
+    h.run_steps(3);
+    assert_eq!(solid_size(&h, l), [200, 150]);
+    assert_eq!(center(&h, "dialog.solid.ok"), moved, "it stays where it was put");
+}
diff --git a/crates/ui-egui/tests/ui_dock_resize.rs b/crates/ui-egui/tests/it/ui_dock_resize.rs
similarity index 81%
rename from crates/ui-egui/tests/ui_dock_resize.rs
rename to crates/ui-egui/tests/it/ui_dock_resize.rs
index c3c12e78a..11ca740cb 100644
--- a/crates/ui-egui/tests/ui_dock_resize.rs
+++ b/crates/ui-egui/tests/it/ui_dock_resize.rs
@@ -1,10 +1,12 @@
 //! Shared pane resizing in the full application, including application shortcut ownership.
 
+use crate::gpu_test::RenderSerial;
+use craft_ui::docking::{Divider, DockArea, Hit};
 use effectcraft_engine::Session;
 use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::{DockNode, PanelKind, SplitSize};
+use effectcraft_ui_egui::dock::{self, Node, PanelKind, SplitSize};
 use effectcraft_ui_egui::theme::ThemeKind;
-use egui::{Event, Id, Key, Modifiers, PointerButton, Rect, pos2, vec2};
+use egui::{Event, Key, Modifiers, PointerButton, Rect, pos2, vec2};
 use egui_kittest::Harness;
 use serde_json::json;
 
@@ -15,7 +17,7 @@ fn snapshots(h: &mut Harness<'_, EffectcraftApp>, directory: Option<&std::path::
         let ctx = h.ctx.clone();
         h.state_mut().set_theme(&ctx, theme);
         h.run_steps(3);
-        h.render().unwrap().save(directory.join(format!("effectcraft-{phase}-{name}.png"))).unwrap();
+        h.render_serialized().unwrap().save(directory.join(format!("effectcraft-{phase}-{name}.png"))).unwrap();
     }
     let ctx = h.ctx.clone();
     h.state_mut().set_theme(&ctx, ThemeKind::Dark);
@@ -23,14 +25,15 @@ fn snapshots(h: &mut Harness<'_, EffectcraftApp>, directory: Option<&std::path::
 }
 
 fn first_size(h: &Harness<'_, EffectcraftApp>) -> f32 {
-    match h.state().ui.dock {
-        DockNode::Split { size: SplitSize::FixedA(value), .. } => value,
+    match &h.state().ui.dock.layout.root {
+        Some(Node::Split { size: SplitSize::FixedFirst(value), .. }) => *value,
         ref other => panic!("fixed-size mode changed: {other:?}"),
     }
 }
 
 #[test]
 fn focused_dock_resize_owns_arrows_and_keeps_pointer_dragging() {
+    let _device = crate::gpu_test::lock();
     let mut session = Session::default();
     session.execute("comp.new", json!({"name": "Split test", "width": 160, "height": 90, "duration": 1})).unwrap();
     session.execute("layer.newSolid", json!({"name": "Selected", "color": [1.0, 0.0, 0.0, 1.0]})).unwrap();
@@ -45,16 +48,12 @@ fn focused_dock_resize_owns_arrows_and_keeps_pointer_dragging() {
     h.run_steps(4);
     snapshots(&mut h, directory.as_deref(), "workspace");
     h.state_mut().ui.focused = PanelKind::Composition;
-    h.state_mut().ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(400.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Composition], active: 0 }),
-    };
+    h.state_mut().ui.dock =
+        dock::docked(dock::hsplit(SplitSize::FixedFirst(400.0), dock::tabs(&[PanelKind::Project], 0), dock::tabs(&[PanelKind::Composition], 0)));
     h.run_steps(3);
     let before_project = h.state().session.project.clone();
     let before_times = h.state().session.state.times.clone();
-    let id = Id::new(("dock-gutter", String::new()));
+    let id = DockArea::<PanelKind>::hit_id(effectcraft_ui_egui::dock_ui::area_id(), &Hit::Divider(Divider::Split(Vec::new())));
     h.ctx.memory_mut(|memory| memory.request_focus(id));
     h.run_steps(2);
     assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(id));
diff --git a/crates/ui-egui/tests/ui_drag_drop.rs b/crates/ui-egui/tests/it/ui_drag_drop.rs
similarity index 83%
rename from crates/ui-egui/tests/ui_drag_drop.rs
rename to crates/ui-egui/tests/it/ui_drag_drop.rs
index 9b66f745c..5a0d94ddf 100644
--- a/crates/ui-egui/tests/ui_drag_drop.rs
+++ b/crates/ui-egui/tests/it/ui_drag_drop.rs
@@ -108,6 +108,85 @@ fn project_items_land_where_they_are_dropped_in_the_timeline() {
     assert!((in_point(&h, 3) - 1.0).abs() < 1e-9, "Shift starts it at the current time");
 }
 
+/// Alt/Option-drag from the Project panel replaces the source of the layer under the pointer
+/// instead of adding a layer (#991).
+#[test]
+fn alt_dragging_a_project_item_replaces_the_layer_source() {
+    let (mut h, clip) = harness();
+    let top = layer_id(&h, "Top");
+    let item = rect(&h, &format!("project.item.{clip}.name")).center();
+    let row = rect(&h, &format!("timeline.layer.{top}.row"));
+    let before = stack(&h);
+    drag(&mut h, item, row.center(), Modifiers::ALT);
+    assert_eq!(stack(&h), before, "no layer is added");
+    let layer = h.state().session.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(top)).unwrap();
+    assert_eq!(layer.source, effectcraft_engine::project::LayerSource::Comp { item: effectcraft_engine::project::ItemId(clip) });
+    assert_eq!(layer.name, "Top", "the layer keeps its name");
+}
+
+/// Alt/Option-dropping a Project item on the Composition viewer replaces the source of the layer
+/// under the pointer, as in the Timeline, instead of adding a layer (#2173).
+#[test]
+fn alt_dropping_a_project_item_on_the_viewer_replaces_the_layer_source() {
+    use effectcraft_engine::project::{ItemId, LayerId, LayerSource};
+    let (mut h, clip) = harness();
+    let item = rect(&h, &format!("project.item.{clip}.name")).center();
+    let to = comp_to_screen(&h.ctx, [160.0, 90.0]).unwrap();
+    // The three solids overlap completely, so the topmost one is under the pointer.
+    let (top, middle, bottom) = (layer_id(&h, "Top"), layer_id(&h, "Middle"), layer_id(&h, "Bottom"));
+    let source = |h: &Harness<'_, EffectcraftApp>, id: u64| h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().source.clone();
+    let (middle_before, bottom_before) = (source(&h, middle), source(&h, bottom));
+    let before = stack(&h);
+    drag(&mut h, item, to, Modifiers::ALT);
+    assert_eq!(stack(&h), before, "no layer is added");
+    assert_eq!(source(&h, top), LayerSource::Comp { item: ItemId(clip) }, "the layer under the pointer takes the new source");
+    assert_eq!(source(&h, middle), middle_before, "the layer below it keeps its source");
+    assert_eq!(source(&h, bottom), bottom_before, "the bottom layer keeps its source");
+}
+
+/// A locked layer under the pointer refuses the Alt-drop; the layer behind it is not replaced
+/// instead (#2173).
+#[test]
+fn alt_dropping_on_a_locked_layer_in_the_viewer_replaces_nothing() {
+    use effectcraft_engine::project::LayerId;
+    let (mut h, clip) = harness();
+    let item = rect(&h, &format!("project.item.{clip}.name")).center();
+    let to = comp_to_screen(&h.ctx, [160.0, 90.0]).unwrap();
+    let top = layer_id(&h, "Top");
+    h.state_mut().session.execute("layer.setSwitch", json!({"layers": [top], "switch": "locked", "value": true})).unwrap();
+    h.run_steps(3);
+    let sources = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.iter().map(|l| l.source.clone()).collect::<Vec<_>>();
+    let before = sources(&h);
+    drag(&mut h, item, to, Modifiers::ALT);
+    assert_eq!(sources(&h), before, "no layer takes the new source");
+    assert!(h.state().session.active_comp().unwrap().layer(LayerId(top)).unwrap().switches.locked);
+}
+
+/// Ctrl+Alt+/ (Cmd+Opt+/ on macOS) replaces every selected layer's source with the Project panel
+/// selection (#991).
+#[test]
+fn ctrl_alt_slash_replaces_every_selected_layer_source() {
+    let (mut h, clip) = harness();
+    let top = layer_id(&h, "Top");
+    let middle = layer_id(&h, "Middle");
+    h.state_mut().session.execute("layer.select", json!({"layers": [top, middle]})).unwrap();
+    h.state_mut().session.state.project_selection = vec![effectcraft_engine::project::ItemId(clip)];
+    h.run_steps(3);
+    let modifiers = Modifiers { command: true, alt: true, ..Default::default() };
+    for pressed in [true, false] {
+        h.event(Event::Key { key: egui::Key::Slash, physical_key: Some(egui::Key::Slash), pressed, repeat: false, modifiers });
+    }
+    h.run_steps(3);
+    let comp = h.state().session.active_comp().unwrap();
+    for lid in [top, middle] {
+        assert_eq!(
+            comp.layer(effectcraft_engine::project::LayerId(lid)).unwrap().source,
+            effectcraft_engine::project::LayerSource::Comp { item: effectcraft_engine::project::ItemId(clip) }
+        );
+    }
+    assert_eq!(stack(&h), ["Top", "Middle", "Bottom"], "no layer is added");
+}
+
 /// #85: a Project item dropped on the Composition viewer becomes a layer centred where it was
 /// dropped (above the selected layer, like any new layer).
 #[test]
@@ -157,7 +236,7 @@ fn dragging_selected_project_items_adds_every_item_to_the_viewer() {
     let to = comp_to_screen(&h.ctx, [80.0, 45.0]).unwrap();
     drag(&mut h, from, to, Modifiers::NONE);
     assert_eq!(stack(&h), ["Clip", "Other", "Top", "Middle", "Bottom"]);
-    for layer in &h.state().session.active_comp().unwrap().layers[..2] {
+    for layer in h.state().session.active_comp().unwrap().layers.iter().take(2) {
         let Some(KV::Vec3(p)) = layer.props.prop("transform/position").map(|p| p.value.clone()) else { panic!("no position") };
         let tol = 1.0 / last_fit(&h.ctx) as f64 + 1e-6;
         assert!((p[0] - 80.0).abs() <= tol && (p[1] - 45.0).abs() <= tol, "{p:?}");
@@ -422,6 +501,19 @@ fn dropped_file_on_viewer_imports_and_adds_layer_at_pointer() {
     assert!((p[0] - 80.0).abs() <= tol && (p[1] - 45.0).abs() <= tol, "{p:?}");
 }
 
+/// #2588: a file dropped on the Timeline joins the composition the panel shows, as it does on the
+/// viewer; the import places the layer.
+#[test]
+fn dropped_file_on_the_timeline_becomes_a_layer() {
+    let (mut h, _) = harness();
+    h.state_mut().session.importer = Some(Arc::new(Gated { started: AtomicUsize::new(0), allow: Arc::new(AtomicUsize::new(usize::MAX)) }));
+    h.event(Event::PointerMoved(rect(&h, "panel.Timeline").center()));
+    h.step();
+    h.input_mut().dropped_files.push(Arc::new(Dropped(std::env::temp_dir().join("timeline-drop.mp4"))));
+    h.run_steps(2);
+    step_until(&mut h, |h| h.state().session.active_comp().is_some_and(|c| c.layers.iter().any(|l| l.name == "timeline-drop.mp4")));
+}
+
 /// #678: a dropped Photoshop file asks how to import it, as File ▸ Import ▸ File… does; the
 /// Import Kind starts at Settings ▸ Import ▸ Default Drag Import As, and OK imports the drop.
 #[test]
@@ -553,9 +645,30 @@ fn import_dialog_offers_the_image_sequence_option() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// #2573: the empty Composition viewer's New Composition From Footage imports the picked file
+/// (through the Import Image Sequence question a numbered still asks) and makes a composition
+/// of it, as in After Effects.
+#[test]
+fn new_composition_from_footage_makes_a_comp_of_the_picked_file() {
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(Session::default()));
+    h.run_steps(3);
+    let dir = frames("fromfootage", 2);
+    let pick = dir.join("frame_0002.png").to_string_lossy().to_string();
+    h.state_mut().session.importer = Some(Arc::new(Stills));
+    h.state_mut().hooks.pick_files = Some(Box::new(move |_: &[&str]| vec![pick.clone()]));
+    click_id(&mut h, "viewer.empty.import");
+    assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Form));
+    click_id(&mut h, "form.ok");
+    step_until(&mut h, |h| h.state().session.active_comp().is_some());
+    let comp = h.state().session.active_comp().unwrap();
+    assert_eq!((comp.width, comp.height), (64, 32));
+    assert_eq!(comp.layers.iter().map(|l| l.name.as_str()).collect::<Vec<_>>(), ["frame_0002.png"]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// #297: a folder of frames dropped on the window arrives as one image sequence, and Interpret
-/// Footage shows its frames and Start Timecode (missing frames always show colour bars, as in
-/// After Effects: there is no Missing Frames choice). #431: dropped files import as stills, one
+/// Footage shows its frames and Start Timecode (a missing frame always holds the previous one:
+/// there is no Missing Frames choice). #431: dropped files import as stills, one
 /// item each, as in After Effects.
 #[test]
 fn a_dropped_folder_imports_as_one_sequence_with_sequence_interpretation() {
diff --git a/crates/ui-egui/tests/ui_effect_controls.rs b/crates/ui-egui/tests/it/ui_effect_controls.rs
similarity index 85%
rename from crates/ui-egui/tests/ui_effect_controls.rs
rename to crates/ui-egui/tests/it/ui_effect_controls.rs
index cdf8c7033..15802d889 100644
--- a/crates/ui-egui/tests/ui_effect_controls.rs
+++ b/crates/ui-egui/tests/it/ui_effect_controls.rs
@@ -260,14 +260,14 @@ fn the_eyedropper_stays_armed_until_the_viewer_has_a_frame() {
     }
 }
 
-/// Key Light's Screen Colour eyedropper picks from the effect's input: the shown frame is
+/// Screen Color Key's Screen Colour eyedropper picks from the effect's input: the shown frame is
 /// already keyed (the default screen colour takes most of a green), so sampling it would miss.
 #[test]
 fn keyer_eyedropper_picks_the_screen_from_the_effect_input() {
     let mut s = Session::default();
     s.execute("comp.new", json!({"name": "Key", "width": 320, "height": 180, "frameRate": 30, "duration": 1})).unwrap();
     let screen = s.execute("layer.newSolid", json!({"name": "Screen", "color": "#30b050"})).unwrap()["layer"].as_u64().unwrap();
-    let fx = s.execute("effect.apply", json!({"layers": [screen], "effect": "Key Light"})).unwrap()["effects"][0].as_u64().unwrap();
+    let fx = s.execute("effect.apply", json!({"layers": [screen], "effect": "Screen Color Key"})).unwrap()["effects"][0].as_u64().unwrap();
     let prop = layer(&s, screen).effects().unwrap().groups().find(|g| g.uid == fx).and_then(|g| g.get("screenColour")).map(|p| p.uid).unwrap();
     s.state.selected_layers = vec![LayerId(screen)];
     let mut app = EffectcraftApp::new(s);
@@ -295,7 +295,7 @@ fn keyer_eyedropper_picks_the_screen_from_the_effect_input() {
 fn command_clicking_an_effect_twirl_closes_and_opens_its_groups() {
     let (app, x) = app();
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app);
-    let fx = h.state_mut().session.execute("effect.apply", json!({"layers": [x.small], "effect": "Lumetri Color"})).unwrap()["effects"][0].as_u64().unwrap();
+    let fx = h.state_mut().session.execute("effect.apply", json!({"layers": [x.small], "effect": "Color Grading"})).unwrap()["effects"][0].as_u64().unwrap();
     // Only this effect open, so its header is on screen.
     let l = layer(&h.state().session, x.small);
     let others: Vec<u64> = l.effects().unwrap().groups().map(|g| g.uid).filter(|u| *u != fx).collect();
@@ -319,6 +319,37 @@ fn command_clicking_an_effect_twirl_closes_and_opens_its_groups() {
     assert!(others.iter().all(|u| closed.contains(u)), "other effects stay as they were");
 }
 
+/// Shift-clicking effect headers selects the range from the last effect picked, which stays the
+/// end the next range starts from; Cmd/Ctrl adds or takes out one effect and moves that end.
+#[test]
+fn shift_click_on_effect_headers_selects_a_range_and_command_toggles() {
+    let (app, x) = app();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app);
+    let fx: Vec<u64> = layer(&h.state().session, x.small).effects().unwrap().groups().map(|g| g.uid).collect();
+    // All twirled closed, so every header is on screen.
+    h.state_mut().ui.fx_closed.extend(fx.iter().copied());
+    h.run_steps(3);
+    let pick = |h: &mut Harness<'_, EffectcraftApp>, i: usize, modifiers: egui::Modifiers| {
+        let at = rect_of(h, &format!("effectControls.effect.{}", fx[i])).center();
+        h.event(egui::Event::ModifiersChanged(modifiers));
+        click(h, at);
+        h.event(egui::Event::ModifiersChanged(Default::default()));
+        h.step();
+        let picked = h.state().session.state.selected_props.iter().map(|(_, u)| *u).collect::<std::collections::BTreeSet<_>>();
+        fx.iter().enumerate().filter(|(_, u)| picked.contains(u)).map(|(i, _)| i).collect::<Vec<_>>()
+    };
+    let (shift, command) = (egui::Modifiers::SHIFT, egui::Modifiers::COMMAND);
+    assert_eq!(pick(&mut h, 3, shift), [3], "with nothing picked, the range is the effect itself");
+    assert_eq!(pick(&mut h, 1, Default::default()), [1]);
+    assert_eq!(pick(&mut h, 3, shift), [1, 2, 3], "Shift takes in the effects between");
+    assert_eq!(pick(&mut h, 0, shift), [0, 1], "the next range starts from the same effect");
+    assert_eq!(pick(&mut h, 4, shift), [1, 2, 3, 4]);
+    assert_eq!(pick(&mut h, 2, command), [1, 3, 4], "Cmd/Ctrl takes one out");
+    assert_eq!(pick(&mut h, 5, command), [1, 3, 4, 5], "and adds one");
+    assert_eq!(pick(&mut h, 3, shift), [3, 4, 5], "which is where the next range starts");
+    assert_eq!(pick(&mut h, 0, Default::default()), [0], "a plain click picks one");
+}
+
 fn rect_of(h: &Harness<'_, EffectcraftApp>, id: &str) -> egui::Rect {
     let e = h.state().auto.previous.iter().chain(h.state().auto.elements.iter()).find(|e| e.id == id).unwrap_or_else(|| panic!("no {id}")).clone();
     egui::Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3]))
@@ -421,7 +452,7 @@ fn right_click_in_effect_controls_shows_the_effect_menu() {
     app.show_panel(PanelKind::EffectControls);
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app);
     h.run_steps(3);
-    let category = " Blur & Sharpen ⏵";
+    let category = " Blur & Sharpen";
     // An effect's header: its own menu.
     let header = rect_of(&h, &format!("effectControls.effect.{fill}")).center();
     right_click(&mut h, header);
@@ -524,6 +555,63 @@ fn extractor_offers_the_exr_layers_and_channels() {
     let _ = std::fs::remove_file(path);
 }
 
+/// #473: Cryptomatte's Layer popup lists the Cryptomatte layers of the footage's OpenEXR (a file
+/// with only CryptoMaterial shows CryptoMaterial, not CryptoObject), and the three standard ones
+/// when the layer has no such footage. The stored value stays the standard index.
+#[test]
+fn cryptomatte_layer_popup_follows_the_footage() {
+    use exr::prelude::*;
+    let (w, hh) = (8usize, 4usize);
+    let ch = |n: &str, v: f32| AnyChannel::new(n, FlatSamples::F32(vec![v; w * hh]));
+    let channels = AnyChannels::sort(vec![ch("R", 0.5), ch("G", 0.5), ch("B", 0.5), ch("CryptoMaterial00.R", 1.0), ch("CryptoMaterial00.G", 1.0)].into());
+    let mut exr_layer = exr::prelude::Layer::new((w, hh), LayerAttributes::default(), Encoding::FAST_LOSSLESS, channels);
+    exr_layer.attributes.other.insert(Text::from("cryptomatte/abc1234/name"), AttributeValue::Text(Text::from("CryptoMaterial")));
+    exr_layer.attributes.other.insert(Text::from("cryptomatte/abc1234/manifest"), AttributeValue::Text(Text::from(r#"{"wood":"13851a76"}"#)));
+    let path = std::env::temp_dir().join(format!("ec-ui-exr-crypto-{}.exr", std::process::id()));
+    Image::from_layer(exr_layer).write().to_file(&path).unwrap();
+
+    let mut s = effectcraft_host::session();
+    let item = s.execute("file.import", json!({"paths": [path.to_string_lossy()]})).unwrap()["items"][0].clone();
+    s.execute("comp.new", json!({"name": "EXR", "width": 8, "height": 4, "frameRate": 24, "duration": 1})).unwrap();
+    let l = s.execute("layer.addItem", json!({"item": item})).unwrap()["layer"].as_u64().unwrap();
+    let solid = s.execute("layer.newSolid", json!({"name": "S", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let apply = |s: &mut Session, l: u64| s.execute("effect.apply", json!({"layers": [l], "effect": "Cryptomatte"})).unwrap()["effects"][0].as_u64().unwrap();
+    let (fx, solid_fx) = (apply(&mut s, l), apply(&mut s, solid));
+    let layer_prop = |s: &Session, l: u64, fx: u64| {
+        layer(s, l).effects().and_then(|f| f.groups().find(|g| g.uid == fx)).and_then(|g| g.get("layer")).map(|p| (p.uid, p.value.as_enum())).unwrap()
+    };
+    let (uid, stored) = layer_prop(&s, l, fx);
+    assert_eq!(stored, 0, "a new effect stores CryptoObject");
+    let (solid_uid, _) = layer_prop(&s, solid, solid_fx);
+    s.state.selected_layers = vec![LayerId(l)];
+    let mut app = EffectcraftApp::new(s);
+    app.show_panel(PanelKind::EffectControls);
+    let mut h = Harness::builder().with_size(egui::vec2(1700.0, 1100.0)).build_eframe(|_| app);
+    settle(&mut h);
+    // The file has only CryptoMaterial, so that is what the closed popup shows, and all it lists.
+    assert!(h.query_by_label("CryptoMaterial").is_some() && h.query_by_label("CryptoObject").is_none());
+    let at = rect_of(&h, &format!("effectControls.prop.{uid}.value")).center();
+    click(&mut h, at);
+    assert!(h.query_by_label("CryptoObject").is_none() && h.query_by_label("CryptoAsset").is_none(), "only the file's layers");
+    assert_eq!(h.query_all_by_label("CryptoMaterial").count(), 2, "the popup and its entry");
+    h.query_all_by_label("CryptoMaterial").last().unwrap().click();
+    h.run_steps(3);
+    assert_eq!(layer_prop(&h.state().session, l, fx).1, 1, "stored as the standard CryptoMaterial value");
+
+    // A layer without Cryptomatte footage lists the standard three.
+    h.state_mut().session.state.selected_layers = vec![LayerId(solid)];
+    settle(&mut h);
+    let at = rect_of(&h, &format!("effectControls.prop.{solid_uid}.value")).center();
+    click(&mut h, at);
+    for name in ["CryptoMaterial", "CryptoAsset"] {
+        assert!(h.query_by_label(name).is_some(), "the standard layer {name}");
+    }
+    h.get_by_label("CryptoAsset").click();
+    h.run_steps(3);
+    assert_eq!(layer_prop(&h.state().session, solid, solid_fx).1, 2);
+    let _ = std::fs::remove_file(path);
+}
+
 #[test]
 fn point_picker_handle_follows_hover_then_commits_once_across_effects() {
     for (effect, parameter) in [("ec.control.point", "point"), ("ec.blur.ccradialfast", "center"), ("ec.generate.gradientramp", "start")] {
@@ -778,6 +866,23 @@ fn effect_control_name_can_be_renamed_from_its_header() {
     assert_eq!(current_name(&h), "Point Control");
 }
 
+// Regression test for #1497: double-clicking an effect parameter's name in Effect Controls did
+// nothing; it should reveal that property in the Timeline, as After Effects does.
+#[test]
+fn double_clicking_an_effect_property_name_reveals_it_in_the_timeline() {
+    let (app, x) = app();
+    let mut h = Harness::builder().with_size(egui::vec2(1700.0, 1100.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| app);
+    settle(&mut h);
+    let row = format!("timeline.prop.{}.name", x.point);
+    assert!(!ids(&h).contains(&row), "the effect's property is not in the Timeline before the double-click");
+    assert!(!h.state().ui.timeline.reveal_props.contains(&x.point));
+    let point = rect_of(&h, &format!("effectControls.prop.{}.name", x.point)).center();
+    double_click(&mut h, point);
+    h.run_steps(4);
+    assert!(h.state().ui.timeline.reveal_props.contains(&x.point), "the property is marked revealed in the Timeline");
+    assert!(ids(&h).contains(&row), "the Timeline shows the property's row");
+}
+
 #[test]
 fn effect_rename_escape_keeps_the_name() {
     let (app, x) = app();
diff --git a/crates/ui-egui/tests/ui_effect_drop_highlight.rs b/crates/ui-egui/tests/it/ui_effect_drop_highlight.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_effect_drop_highlight.rs
rename to crates/ui-egui/tests/it/ui_effect_drop_highlight.rs
index 6c0ede47a..ddef6c94b 100644
--- a/crates/ui-egui/tests/ui_effect_drop_highlight.rs
+++ b/crates/ui-egui/tests/it/ui_effect_drop_highlight.rs
@@ -13,7 +13,7 @@ fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
 fn drag_to(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
     h.input_mut().events.push(Event::PointerMoved(p));
     h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    egui::DragAndDrop::set_payload(&h.ctx, DragPayload::Effect("CC Bend It".into()));
+    egui::DragAndDrop::set_payload(&h.ctx, DragPayload::Effect("Two-Point Bend".into()));
     h.run_steps(2);
 }
 
diff --git a/crates/ui-egui/tests/ui_effect_names.rs b/crates/ui-egui/tests/it/ui_effect_names.rs
similarity index 96%
rename from crates/ui-egui/tests/ui_effect_names.rs
rename to crates/ui-egui/tests/it/ui_effect_names.rs
index 28d1a1f3f..d57f9c581 100644
--- a/crates/ui-egui/tests/ui_effect_names.rs
+++ b/crates/ui-egui/tests/it/ui_effect_names.rs
@@ -32,7 +32,9 @@ fn harness(language: &str) -> (Harness<'static, EffectcraftApp>, u64) {
     app.show_panel(PanelKind::EffectControls);
     app.show_panel(PanelKind::EffectsPresets);
     app.show_panel(PanelKind::Timeline);
-    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_| app);
+    // The Chinese/Japanese names under test have no installed face on every host: draw tofu
+    // instead of failing the missing-glyph gate (the glyph coverage test covers the bundled set).
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).allow_missing_glyphs().build_eframe(|_| app);
     h.run_steps(4);
     (h, fx)
 }
diff --git a/crates/ui-egui/tests/it/ui_effects_presets_keyboard.rs b/crates/ui-egui/tests/it/ui_effects_presets_keyboard.rs
new file mode 100644
index 000000000..1dc8341bc
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_effects_presets_keyboard.rs
@@ -0,0 +1,280 @@
+//! Effects & Presets keyboard operation and accessible names (docs/gaps.md gap 25): the list is one
+//! Tab stop; the arrow keys, Home / End, Right / Left, Enter and Space work it; the focus follows
+//! the cursor; rows are tree items with a name, a selected state, a depth and (folders) an open
+//! state; the favourite star is a named button.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::accesskit::Role;
+use egui::{Event, Key, Modifiers, Pos2, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Red", "color": "#c04040"})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::EffectsPresets);
+    h.run_steps(4);
+    h
+}
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).clone();
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = center(h, id);
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+/// The role and name of the node that has the keyboard focus.
+fn focused(h: &Harness<'_, EffectcraftApp>) -> Option<(Role, String)> {
+    h.root().children_recursive().find(|n| n.is_focused()).map(|n| (n.accesskit_node().role(), n.accesskit_node().label().unwrap_or_default()))
+}
+
+fn selected_rows(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
+    let panel = h.state().auto.find("panel.EffectsPresets").expect("the panel is drawn").rect;
+    let panel = egui::Rect::from_min_size(pos2(panel[0], panel[1]), egui::vec2(panel[2], panel[3]));
+    h.root()
+        .children_recursive()
+        .filter(|n| n.accesskit_node().role() == Role::TreeItem && n.accesskit_node().is_selected() == Some(true))
+        .filter(|n| n.accesskit_node().bounding_box().is_some_and(|b| panel.contains(pos2(b.x0 as f32 + 1.0, b.y0 as f32 + 1.0))))
+        .map(|n| n.accesskit_node().label().unwrap_or_default())
+        .collect()
+}
+
+/// Put the keyboard on the first row the way Tab does: from the search field, the menu button,
+/// then the list.
+fn tab_into_list(h: &mut Harness<'_, EffectcraftApp>) {
+    h.get_by_label("Search effects and presets").focus();
+    h.run_steps(3);
+    key(h, Key::Tab, Modifiers::NONE);
+    assert_eq!(focused(h).map(|f| f.1), Some("Effects & Presets options".to_string()), "Tab leaves the search field for the options button");
+    key(h, Key::Tab, Modifiers::NONE);
+}
+
+#[test]
+fn tab_reaches_the_list_once_and_leaves_it() {
+    let mut h = harness();
+    tab_into_list(&mut h);
+    let (role, name) = focused(&h).expect("a row has the focus");
+    assert_eq!(role, Role::TreeItem);
+    assert!(!name.is_empty());
+    // The first row is a folder: no star. The next Tab leaves the list instead of walking the
+    // hundreds of effects.
+    key(&mut h, Key::Tab, Modifiers::NONE);
+    let after = focused(&h);
+    assert!(after.as_ref().is_none_or(|(r, _)| *r != Role::TreeItem), "the second Tab is past the list: {after:?}");
+}
+
+#[test]
+fn arrows_home_end_move_the_cursor_and_the_focus() {
+    let mut h = harness();
+    tab_into_list(&mut h);
+    let first = focused(&h).unwrap().1;
+    assert_eq!(selected_rows(&h), Vec::<String>::new(), "Tab alone selects nothing");
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    let second = focused(&h).unwrap().1;
+    assert_ne!(first, second, "Down Arrow moves to the next row");
+    assert_eq!(selected_rows(&h), vec![second.clone()], "the row the cursor is on is selected");
+    key(&mut h, Key::ArrowUp, Modifiers::NONE);
+    assert_eq!(focused(&h).unwrap().1, first);
+    key(&mut h, Key::End, Modifiers::NONE);
+    let last = focused(&h).unwrap().1;
+    assert_ne!(last, first, "End goes to the last row");
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(focused(&h).unwrap().1, last, "Down Arrow stays on the last row");
+    key(&mut h, Key::Home, Modifiers::NONE);
+    assert_eq!(focused(&h).unwrap().1, first, "Home goes to the first row");
+    key(&mut h, Key::PageDown, Modifiers::NONE);
+    assert_ne!(focused(&h).unwrap().1, first, "Page Down moves a page");
+    // The cursor row is scrolled into view: its node is on screen.
+    let name = focused(&h).unwrap().1;
+    let r = h.get_by_label(&name).rect();
+    assert!(r.min.y >= 0.0 && r.max.y <= 1000.0, "the focused row is on screen: {r:?}");
+}
+
+#[test]
+fn right_and_left_open_and_close_folders_and_step_through_the_tree() {
+    let mut h = harness();
+    h.state_mut().ui.effects_search.clear();
+    tab_into_list(&mut h);
+    // Walk to a category folder (not the presets folder).
+    let mut guard = 0;
+    loop {
+        let n = focused(&h).unwrap().1;
+        if n == "Blur & Sharpen" {
+            break;
+        }
+        key(&mut h, Key::ArrowDown, Modifiers::NONE);
+        guard += 1;
+        assert!(guard < 40, "no Blur & Sharpen folder reached");
+    }
+    let folder = h.get_by_label("Blur & Sharpen");
+    assert_eq!(folder.accesskit_node().data().is_expanded(), Some(false));
+    assert_eq!(folder.accesskit_node().data().level(), Some(1));
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    assert!(h.state().ui.effects_open.contains("Blur & Sharpen"), "Right Arrow opens the folder");
+    assert_eq!(h.get_by_label("Blur & Sharpen").accesskit_node().data().is_expanded(), Some(true));
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    let child = focused(&h).unwrap();
+    assert_eq!(child.0, Role::TreeItem);
+    assert_ne!(child.1, "Blur & Sharpen", "Right Arrow on an open folder steps into it");
+    assert_eq!(h.get_by_label(&child.1).accesskit_node().data().level(), Some(2));
+    key(&mut h, Key::ArrowLeft, Modifiers::NONE);
+    assert_eq!(focused(&h).unwrap().1, "Blur & Sharpen", "Left Arrow on an effect steps out to its folder");
+    key(&mut h, Key::ArrowLeft, Modifiers::NONE);
+    assert!(!h.state().ui.effects_open.contains("Blur & Sharpen"), "Left Arrow closes the folder");
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert!(h.state().ui.effects_open.contains("Blur & Sharpen"), "Enter opens a closed folder");
+    key(&mut h, Key::Space, Modifiers::NONE);
+    assert!(!h.state().ui.effects_open.contains("Blur & Sharpen"), "Space closes it again");
+}
+
+#[test]
+fn enter_and_space_apply_an_effect_to_the_selected_layer() {
+    for apply_key in [Key::Enter, Key::Space] {
+        let mut h = harness();
+        tab_into_list(&mut h);
+        h.state_mut().ui.effects_open.insert("Blur & Sharpen".into());
+        h.run_steps(3);
+        let mut guard = 0;
+        while focused(&h).map(|f| f.1) != Some("Blur & Sharpen".to_string()) {
+            key(&mut h, Key::ArrowDown, Modifiers::NONE);
+            guard += 1;
+            assert!(guard < 40);
+        }
+        key(&mut h, Key::ArrowDown, Modifiers::NONE);
+        let effect = focused(&h).unwrap().1;
+        assert!(h.state().session.state.last_effect.is_none());
+        key(&mut h, apply_key, Modifiers::NONE);
+        let applied = h.state().session.state.last_effect.clone();
+        assert!(applied.is_some(), "{apply_key:?} on `{effect}` applies it to the selected layer");
+        let pb = &h.state().playback;
+        assert!(!pb.playing && !pb.caching && pb.plan.is_none(), "{apply_key:?} on a focused row is the row's, it does not start a preview");
+    }
+}
+
+#[test]
+fn the_star_is_a_named_button_on_the_cursor_row_and_enter_toggles_it() {
+    let mut h = harness();
+    tab_into_list(&mut h);
+    h.state_mut().ui.effects_open.insert("Blur & Sharpen".into());
+    h.run_steps(3);
+    let mut guard = 0;
+    while focused(&h).map(|f| f.1) != Some("Blur & Sharpen".to_string()) {
+        key(&mut h, Key::ArrowDown, Modifiers::NONE);
+        guard += 1;
+        assert!(guard < 40, "no Blur & Sharpen folder reached");
+    }
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    let effect = focused(&h).unwrap().1;
+    key(&mut h, Key::Tab, Modifiers::NONE);
+    let (role, name) = focused(&h).expect("the star has the focus");
+    assert_eq!(role, Role::Button);
+    assert_eq!(name, format!("Add to favorites: {effect}"));
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_eq!(h.state().session.prefs.effects_favorites.len(), 1, "Enter on the star adds the favourite");
+    assert!(h.state().session.state.last_effect.is_none(), "Enter on the star does not also apply the effect");
+    let (_, name) = focused(&h).expect("the star keeps the focus");
+    assert_eq!(name, format!("Remove from favorites: {effect}"));
+}
+
+#[test]
+fn the_search_field_keeps_its_arrows_and_the_layer_does_not_nudge() {
+    let mut h = harness();
+    h.get_by_label("Search effects and presets").focus();
+    h.run_steps(3);
+    h.get_by_label("Search effects and presets").type_text("blur");
+    h.run_steps(3);
+    assert_eq!(h.state().ui.effects_search, "blur");
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert!(selected_rows(&h).is_empty(), "arrows in the search field belong to the field");
+    // A click on a row, then the arrows: the list moves, the selected layer stays where it is.
+    let layer_before = layer_position(&h);
+    h.state_mut().ui.effects_search.clear();
+    h.run_steps(3);
+    click(&mut h, "effects.category.presets");
+    assert_eq!(h.state().ui.focused, PanelKind::EffectsPresets);
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(selected_rows(&h).len(), 1, "the arrows work after a click, without keyboard focus on a row");
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    assert_eq!(layer_position(&h), layer_before, "the arrow keys did not nudge the selected layer");
+}
+
+fn layer_position(h: &Harness<'_, EffectcraftApp>) -> String {
+    let s = &h.state().session;
+    let comp = s.active_comp().expect("a comp");
+    let layer = comp.layers.first().expect("a layer");
+    format!("{:?}", layer.transform())
+}
+
+#[test]
+fn rows_and_controls_have_names_roles_and_states() {
+    let mut h = harness();
+    h.state_mut().ui.effects_open.insert("Blur & Sharpen".into());
+    h.state_mut().session.prefs.toggle_effect_favorite("ec.blur.gaussian");
+    h.run_steps(4);
+    assert_eq!(h.get_by_label("Search effects and presets").accesskit_node().role(), Role::TextInput);
+    let menu = h.get_by_label("Effects & Presets options");
+    assert_eq!(menu.accesskit_node().role(), Role::Button);
+    assert_eq!(menu.accesskit_node().data().is_expanded(), Some(false), "the options button says its menu is closed");
+    let folder = h.get_by_label("Blur & Sharpen");
+    assert_eq!(folder.accesskit_node().role(), Role::TreeItem);
+    assert_eq!(folder.accesskit_node().data().is_expanded(), Some(true));
+    assert_eq!(folder.accesskit_node().is_selected(), Some(false));
+    let favorites = h.get_by_label("Favorites");
+    assert_eq!(favorites.accesskit_node().data().is_expanded(), Some(false));
+    // Every effect row in an open category is a leaf at depth 2.
+    let leaves: Vec<_> =
+        h.root().children_recursive().filter(|n| n.accesskit_node().role() == Role::TreeItem && n.accesskit_node().data().level() == Some(2)).collect();
+    assert!(!leaves.is_empty());
+    assert!(leaves.iter().all(|n| n.accesskit_node().data().is_expanded().is_none()), "effects are leaves: they have no open state");
+    let gaussian_rows = h
+        .root()
+        .children_recursive()
+        .filter(|n| n.accesskit_node().role() == Role::TreeItem && n.accesskit_node().label().as_deref() == Some("Gaussian Blur"))
+        .count();
+    assert!(gaussian_rows <= 1, "a favourite hidden in a closed Favorites folder draws no rows");
+    assert!(h.query_all_by_label_contains("Add to favorites: ").count() > 1, "the effects' stars are named");
+}
+
+/// A pick from the options menu with the mouse leaves no widget with the keyboard focus, and Enter
+/// after a click in the panel is the panel's: it opens or applies the row and does not start the
+/// layer rename the Timeline binds to Enter.
+#[test]
+fn mouse_picks_leave_no_focus_and_enter_after_a_click_is_the_panels() {
+    let mut h = harness();
+    click(&mut h, "effects.menu");
+    assert!(h.ctx.memory(|m| m.focused()).is_none(), "opening the menu with the mouse takes no keyboard focus");
+    h.get_by_label_contains("Alphabetical").click();
+    h.run_steps(4);
+    assert!(h.ctx.memory(|m| m.focused()).is_none(), "choosing an entry with the mouse leaves no keyboard focus");
+    assert!(h.state().ui.effects_view.alphabetical);
+    h.state_mut().ui.effects_view.alphabetical = false;
+    h.run_steps(3);
+    click(&mut h, "effects.category.presets");
+    let open = h.state().ui.effects_open.contains("presets");
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_ne!(h.state().ui.effects_open.contains("presets"), open, "Enter toggles the clicked folder");
+    assert!(h.state().auto.query("timeline.layer.").iter().all(|e| !e.id.ends_with(".nameEdit")), "no layer rename started");
+}
diff --git a/crates/ui-egui/tests/it/ui_env_light_gpu.rs b/crates/ui-egui/tests/it/ui_env_light_gpu.rs
new file mode 100644
index 000000000..185980fb6
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_env_light_gpu.rs
@@ -0,0 +1,85 @@
+//! The Environment light through the app's GPU compositor (egui_kittest with wgpu): adding one
+//! visibly changes the viewer's GPU frames (#2436). Skips without a GPU adapter (CI).
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::Renderer;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui_kittest::Harness;
+use serde_json::json;
+
+use crate::ui_gpu::wait_for_compositor;
+
+fn settle(h: &mut Harness<'_, EffectcraftApp>) {
+    for _ in 0..600 {
+        h.step();
+        if h.state().frames.inflight() == 0 && h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(20));
+    }
+    for _ in 0..4 {
+        h.step();
+    }
+}
+
+/// egui_kittest's wgpu setup on the adapter the headless compositor picked, so the viewer's GPU
+/// compositor attaches (see ui_gpu.rs).
+fn same_adapter(name: String) -> eframe::egui_wgpu::WgpuSetup {
+    let mut setup = egui_kittest::wgpu::default_wgpu_setup();
+    if let eframe::egui_wgpu::WgpuSetup::CreateNew(c) = &mut setup {
+        let fallback = c.native_adapter_selector.take();
+        c.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+            let named = |a: &&eframe::wgpu::Adapter| format!("{} ({:?})", a.get_info().name, a.get_info().backend) == name;
+            match (adapters.iter().find(named), &fallback) {
+                (Some(a), _) => Ok(a.clone()),
+                (None, Some(f)) => f(adapters, surface),
+                (None, None) => adapters.first().cloned().ok_or_else(|| "No adapter found".to_owned()),
+            }
+        }));
+    }
+    setup
+}
+
+/// A red Environment light at full intensity lights the scene on the GPU compositor too: the
+/// viewer's GPU frames change when the light is added.
+#[test]
+fn environment_light_lights_the_scene_on_the_gpu() {
+    let _device = crate::gpu_test::lock();
+    let Some(probe) = effectcraft_gpu::Gpu::headless() else {
+        eprintln!("no GPU adapter: skipping");
+        return;
+    };
+    let adapter = effectcraft_engine::render::Accelerator::name(&probe);
+    eprintln!("headless compositor adapter: {adapter}");
+    let gl = adapter.ends_with("(Gl)");
+    drop(probe);
+    let mut h = Harness::builder()
+        .with_size(egui::vec2(1400.0, 900.0))
+        .with_pixels_per_point(1.0)
+        .wgpu_setup(same_adapter(adapter))
+        .build_eframe(|_| EffectcraftApp::new(Session::default()));
+    // The project opens once the compositor (built on a worker thread) is attached, so the
+    // frames compared below are GPU frames, not ones the CPU composited meanwhile (see ui_gpu.rs).
+    wait_for_compositor(&mut h);
+    if gl && h.state().gpu_adapter().is_none() {
+        eprintln!("egui-wgpu's GL device has WebGL2 limits: the viewer stays on the CPU, skipping");
+        return;
+    }
+    assert!(h.state().gpu_adapter().is_some(), "GPU compositor on egui-wgpu's device");
+    let s = &mut h.state_mut().session;
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    s.execute("comp.open", json!({"comp": "3D Showcase"})).unwrap();
+    s.execute("time.set", json!({"time": 5.0})).unwrap();
+    s.execute("comp.settings", json!({"renderer": "classic3D"})).unwrap();
+    settle(&mut h);
+    let before = h.state_mut().viewer_pixels().expect("GPU frame before adding the light").pixels.clone();
+
+    h.state_mut().session.execute("layer.newLight", json!({"kind": "Environment", "color": [1.0, 0.0, 0.0], "intensity": 100.0})).unwrap();
+    assert_eq!(h.state().session.active_comp().unwrap().renderer, Renderer::Advanced3D);
+    settle(&mut h);
+    let after = h.state_mut().viewer_pixels().expect("GPU frame after adding the light").pixels.clone();
+
+    assert_eq!(before.len(), after.len());
+    let diff = before.iter().zip(&after).filter(|(a, b)| a != b).count();
+    assert!(diff > 500, "a red Environment light at 100 % changed only {diff} GPU pixels");
+}
diff --git a/crates/ui-egui/tests/it/ui_export_overwrite.rs b/crates/ui-egui/tests/it/ui_export_overwrite.rs
new file mode 100644
index 000000000..997359479
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_export_overwrite.rs
@@ -0,0 +1,110 @@
+//! The control channel's `render.frame` and `ui.screenshot` write a PNG to the `path` they are
+//! given, and never over a file the project reads (#1743): footage, a proxy or the project file.
+
+use std::path::PathBuf;
+
+use effectcraft_engine::Session;
+use effectcraft_engine::color::Label;
+use effectcraft_engine::project::{Footage, FootageKind, ItemKind};
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::control::{self, ControlRequest, Outcome};
+use egui_kittest::Harness;
+use serde_json::{Value, json};
+
+const SOURCE: &[u8] = b"SOURCE FOOTAGE";
+
+struct Rig {
+    h: Harness<'static, EffectcraftApp>,
+    dir: PathBuf,
+}
+
+impl Rig {
+    /// A project saved as `Project.ecproj` in a fresh folder, reading `clip.png` beside it.
+    fn new(name: &str) -> Rig {
+        let dir = std::env::temp_dir().join("effectcraft-ui-export-overwrite").join(format!("{}-{name}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("clip.png"), SOURCE).unwrap();
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Main", "width": 16, "height": 16, "frameRate": 10, "duration": 0.5})).unwrap();
+        s.execute("file.saveAs", json!({"path": dir.join("Project.ecproj").to_string_lossy()})).unwrap();
+        let clip = Footage {
+            path: dir.join("clip.png").to_string_lossy().into_owned(),
+            kind: FootageKind::Still,
+            width: 16,
+            height: 16,
+            has_video: true,
+            ..Default::default()
+        };
+        std::sync::Arc::make_mut(&mut s.project).add_item("clip.png", Label::Aqua, None, ItemKind::Footage(clip));
+        let mut app = Some(EffectcraftApp::new(s));
+        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app.take().expect("app"));
+        h.run_steps(2);
+        Rig { h, dir }
+    }
+
+    fn text(&self, file: &str) -> String {
+        self.dir.join(file).to_string_lossy().into_owned()
+    }
+
+    fn read(&self, file: &str) -> Vec<u8> {
+        std::fs::read(self.dir.join(file)).unwrap()
+    }
+
+    /// A control-channel request, answered at once or not.
+    fn send(&mut self, method: &str, params: Value) -> Outcome {
+        let ctx = self.h.ctx.clone();
+        let (req, _rx) = ControlRequest::new(method, params);
+        let now = self.h.state().now();
+        control::handle(self.h.state_mut(), &ctx, &req, now)
+    }
+
+    /// The reply of a request that is answered at once.
+    fn reply(&mut self, method: &str, params: Value) -> Value {
+        match self.send(method, params) {
+            Outcome::Done(v) => v,
+            _ => panic!("{method}: no immediate reply"),
+        }
+    }
+}
+
+impl Drop for Rig {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+#[test]
+fn render_frame_never_writes_over_a_file_the_project_reads() {
+    let mut r = Rig::new("render-frame");
+    let project = r.read("Project.ecproj");
+    for (file, what) in [("clip.png", "footage"), ("Project.ecproj", "project")] {
+        let v = r.reply("render.frame", json!({"path": r.text(file)}));
+        let error = v["error"].as_str().unwrap_or_default();
+        assert!(v["ok"] == false && error.contains(file) && error.contains(what), "{file}: {v}");
+    }
+    assert_eq!(r.read("clip.png"), SOURCE, "the footage is as it was");
+    assert_eq!(r.read("Project.ecproj"), project, "the project file is as it was");
+    // Anywhere else it writes the PNG.
+    let v = r.reply("render.frame", json!({"path": r.text("frame.png")}));
+    assert_eq!(v["ok"], true, "{v}");
+    assert_eq!(&r.read("frame.png")[..8], b"\x89PNG\r\n\x1a\n");
+    let v = r.reply("render.frame", json!({"path": r.text("inline.png"), "base64": true, "write": true}));
+    assert_eq!(v["ok"], true, "{v}");
+    assert_eq!(v["result"]["png"].as_str(), Some(control::base64(&r.read("inline.png")).as_str()));
+}
+
+#[test]
+fn screenshot_never_writes_over_a_file_the_project_reads() {
+    let mut r = Rig::new("screenshot");
+    let project = r.read("Project.ecproj");
+    for (file, what) in [("clip.png", "footage"), ("Project.ecproj", "project")] {
+        let Outcome::Done(v) = r.send("ui.screenshot", json!({"path": r.text(file)})) else { panic!("{file}: the screenshot was taken for it") };
+        let error = v["error"].as_str().unwrap_or_default();
+        assert!(v["ok"] == false && error.contains(file) && error.contains(what), "{file}: {v}");
+    }
+    assert_eq!(r.read("clip.png"), SOURCE, "the footage is as it was");
+    assert_eq!(r.read("Project.ecproj"), project, "the project file is as it was");
+    // Anywhere else it is taken (the frame that carries it comes later).
+    assert!(matches!(r.send("ui.screenshot", json!({"path": r.text("shot.png")})), Outcome::Screenshot { .. }));
+}
diff --git a/crates/ui-egui/tests/it/ui_expression_values.rs b/crates/ui-egui/tests/it/ui_expression_values.rs
new file mode 100644
index 000000000..b797e6cf6
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_expression_values.rs
@@ -0,0 +1,296 @@
+//! #1306 (from #1072): a property driven by an expression shows its value in red, the expression
+//! colour, in the Timeline, Effect Controls and the Properties panel, as in After Effects: scalars,
+//! every part of a vector (with its separator) and both parts of an angle (with its sign), hovered
+//! and dragged too, in dark and light themes. A disabled, removed or empty expression shows the
+//! ordinary colour again. The tests read the colour the value text is painted with (the frame's
+//! text shapes: the numbers are painted with an override colour, the separator and sign as plain
+//! text), and require every expected part to be there.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{LayerId, PropGroup};
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use effectcraft_ui_egui::theme::ThemeKind;
+use egui::epaint::Shape;
+use egui::{Color32, Event, Modifiers, PointerButton, Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+const TIMELINE: &str = "timeline.prop";
+const EFFECT_CONTROLS: &str = "effectControls.prop";
+const PROPERTIES: &str = "properties.prop";
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Kind {
+    /// Two components (X, Y).
+    Vector,
+    /// Revolutions, sign and degrees.
+    Angle,
+    Scalar,
+}
+
+/// A property whose value the tests check, and the panels that must show it.
+#[derive(Clone, Copy, Debug)]
+struct Checked {
+    uid: u64,
+    kind: Kind,
+    panels: &'static [&'static str],
+}
+
+/// A comp with one solid and the Transform effect on it.
+struct Ids {
+    layer: u64,
+    /// Transform Position, Rotation and Opacity (Timeline and Properties panel), and the Transform
+    /// effect's Position, Rotation and Opacity (Effect Controls).
+    driven: [Checked; 6],
+    /// Transform Scale: no expression.
+    scale: Checked,
+}
+
+fn setup() -> (Harness<'static, EffectcraftApp>, Ids) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "E", "width": 320, "height": 180, "duration": 4})).unwrap();
+    let l = s.execute("layer.newSolid", json!({"color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let fx = s.execute("effect.apply", json!({"layers": [l], "effect": "Transform"})).unwrap()["effects"][0].as_u64().unwrap();
+    let layer = s.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let uid = |path: &str| layer.props.prop(path).unwrap_or_else(|| panic!("no {path}")).uid;
+    let g: &PropGroup = layer.props.find_group(fx).unwrap();
+    let fuid = |m: &str| g.get(m).unwrap_or_else(|| panic!("no effect {m}")).uid;
+    const LAYER: &[&str] = &[TIMELINE, PROPERTIES];
+    const EFFECT: &[&str] = &[EFFECT_CONTROLS];
+    let c = |uid, kind, panels| Checked { uid, kind, panels };
+    let ids = Ids {
+        layer: l,
+        driven: [
+            c(uid("transform/position"), Kind::Vector, LAYER),
+            c(uid("transform/rotation"), Kind::Angle, LAYER),
+            c(uid("transform/opacity"), Kind::Scalar, LAYER),
+            c(fuid("position"), Kind::Vector, EFFECT),
+            c(fuid("rotation"), Kind::Angle, EFFECT),
+            c(fuid("opacity"), Kind::Scalar, EFFECT),
+        ],
+        scale: c(uid("transform/scale"), Kind::Vector, LAYER),
+    };
+    let transform = layer.props.sub("transform").unwrap().uid;
+    s.state.selected_layers = vec![LayerId(l)];
+    let mut app = EffectcraftApp::new(s);
+    app.show_panel(PanelKind::EffectControls);
+    app.ui.timeline.open_layers.insert(l);
+    app.ui.timeline.open_groups.insert(transform);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| app);
+    h.run_steps(4);
+    (h, ids)
+}
+
+fn set_expression(h: &mut Harness<'_, EffectcraftApp>, ids: &Ids, prop: u64, p: &serde_json::Value) {
+    let mut p = p.clone();
+    p["layer"] = json!(ids.layer);
+    p["prop"] = json!(prop);
+    h.state_mut().session.execute("prop.setExpression", p).unwrap();
+}
+
+fn set_theme(h: &mut Harness<'_, EffectcraftApp>, theme: ThemeKind) {
+    let ctx = h.ctx.clone();
+    h.state_mut().set_theme(&ctx, theme);
+    h.run_steps(3);
+}
+
+fn rect_of(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}: the part isn't shown"));
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+/// The area of `c`'s value in `panel`, every expected part required: both components of a vector,
+/// the revolutions and degrees of an angle (the separator and sign lie between them).
+fn value_area(h: &Harness<'_, EffectcraftApp>, panel: &str, c: Checked) -> Rect {
+    let uid = c.uid;
+    match c.kind {
+        Kind::Vector => rect_of(h, &format!("{panel}.{uid}.value.0")).union(rect_of(h, &format!("{panel}.{uid}.value.1"))),
+        Kind::Angle => rect_of(h, &format!("{panel}.{uid}.revolutions")).union(rect_of(h, &format!("{panel}.{uid}.value"))),
+        Kind::Scalar => rect_of(h, &format!("{panel}.{uid}.value")),
+    }
+}
+
+/// The text painted inside `area` in the last frame, with its colour.
+fn texts(h: &Harness<'_, EffectcraftApp>, area: Rect) -> Vec<(String, Color32)> {
+    fn walk(s: &Shape, area: Rect, out: &mut Vec<(String, Color32)>) {
+        match s {
+            Shape::Vec(v) => v.iter().for_each(|s| walk(s, area, out)),
+            Shape::Text(t) if area.expand(1.0).contains_rect(t.visual_bounding_rect()) && !t.galley.text().trim().is_empty() => {
+                out.push((t.galley.text().trim().to_string(), t.override_text_color.unwrap_or(t.fallback_color)));
+            }
+            _ => {}
+        }
+    }
+    let mut out = vec![];
+    for c in &h.output().shapes {
+        walk(&c.shape, area, &mut out);
+    }
+    out
+}
+
+/// `c`'s value in `panel` shows every part, all in `want`: two numbers and (in the Timeline) the
+/// `,` of a vector, the revolutions, sign and degrees of an angle, the number of a scalar.
+fn assert_value(h: &Harness<'_, EffectcraftApp>, panel: &str, c: Checked, want: Color32, what: &str) {
+    let shown = texts(h, value_area(h, panel, c));
+    let numbers = shown.iter().filter(|(s, _)| s.chars().any(|ch| ch.is_ascii_digit())).count();
+    let has = |text: &str| shown.iter().any(|(s, _)| s == text);
+    let ctx = format!("{what}: {:?} @{} in {panel}: {shown:?}", c.kind, c.uid);
+    match c.kind {
+        Kind::Vector => {
+            assert!(numbers >= 2, "{ctx}: both components");
+            if panel == TIMELINE {
+                assert!(has(","), "{ctx}: the separator");
+            }
+        }
+        Kind::Angle => {
+            assert!(numbers >= 2, "{ctx}: revolutions and degrees");
+            assert!(has("+") || has("-"), "{ctx}: the sign");
+        }
+        Kind::Scalar => assert!(numbers >= 1, "{ctx}: the number"),
+    }
+    assert!(shown.iter().all(|(_, col)| *col == want), "{ctx}: want {want:?}");
+}
+
+/// Every checked property in every panel it belongs to.
+fn assert_all(h: &Harness<'_, EffectcraftApp>, checked: &[Checked], want: Color32, what: &str) {
+    for c in checked {
+        for panel in c.panels {
+            assert_value(h, panel, *c, want, what);
+        }
+    }
+}
+
+/// Expression-driven values are red in every panel, in both themes; Scale (none) stays blue.
+#[test]
+fn expression_driven_values_are_red_in_every_panel() {
+    let (mut h, ids) = setup();
+    for c in ids.driven {
+        set_expression(&mut h, &ids, c.uid, &json!({"expression": "value"}));
+    }
+    for theme in [ThemeKind::Dark, ThemeKind::Light] {
+        set_theme(&mut h, theme);
+        let t = h.state().tokens;
+        assert_ne!(t.expr_text, t.hot_text);
+        assert_all(&h, &ids.driven, t.expr_text, &format!("{theme:?} expression"));
+        assert_all(&h, &[ids.scale], t.hot_text, &format!("{theme:?} no expression"));
+    }
+}
+
+/// Disabled, removed or whitespace-only: the ordinary colour; enabled again: red. Every part of
+/// every value is checked again after each change, in both themes.
+#[test]
+fn expression_state_changes_switch_the_colour() {
+    let (mut h, ids) = setup();
+    let states = [
+        (json!({"expression": "value"}), true, "enabled"),
+        (json!({"enabled": false}), false, "disabled"),
+        (json!({"enabled": true}), true, "enabled again"),
+        (json!({"expression": ""}), false, "removed"),
+        (json!({"expression": "value"}), true, "set again"),
+        (json!({"expression": "   "}), false, "whitespace only"),
+    ];
+    for theme in [ThemeKind::Dark, ThemeKind::Light] {
+        set_theme(&mut h, theme);
+        let t = h.state().tokens;
+        for (p, red, what) in &states {
+            for c in ids.driven {
+                set_expression(&mut h, &ids, c.uid, p);
+            }
+            h.run_steps(3);
+            let want = if *red { t.expr_text } else { t.hot_text };
+            assert_all(&h, &ids.driven, want, &format!("{theme:?} {what}"));
+            assert_all(&h, &[ids.scale], t.hot_text, &format!("{theme:?} {what}: Scale"));
+        }
+    }
+}
+
+fn hover(h: &mut Harness<'_, EffectcraftApp>, at: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.run_steps(2);
+}
+
+/// Hovering a value (an ordinary one takes the hover accent) keeps an expression-driven one red,
+/// in every panel and both themes.
+#[test]
+fn a_hovered_expression_value_stays_red() {
+    let (mut h, ids) = setup();
+    let opacity = ids.driven.iter().filter(|c| c.kind == Kind::Scalar).copied().collect::<Vec<_>>();
+    for c in &opacity {
+        set_expression(&mut h, &ids, c.uid, &json!({"expression": "value"}));
+    }
+    h.run_steps(3);
+    for theme in [ThemeKind::Dark, ThemeKind::Light] {
+        set_theme(&mut h, theme);
+        let t = h.state().tokens;
+        for c in &opacity {
+            for panel in c.panels {
+                let area = value_area(&h, panel, *c);
+                hover(&mut h, area.center());
+                let at = h.ctx.input(|i| i.pointer.hover_pos());
+                assert!(at.is_some_and(|p| area.contains(p)), "{theme:?} {panel}: the pointer is over the value");
+                assert_value(&h, panel, *c, t.expr_text, &format!("{theme:?} hovered"));
+            }
+        }
+        // An ordinary value does take the hover accent.
+        let area = value_area(&h, TIMELINE, ids.scale);
+        let x = rect_of(&h, &format!("{TIMELINE}.{}.value.0", ids.scale.uid)).center();
+        hover(&mut h, x);
+        let shown = texts(&h, area);
+        assert!(shown.iter().any(|(_, c)| *c == t.accent_hover), "{theme:?} an ordinary hovered value: {shown:?}");
+        hover(&mut h, pos2(5.0, 5.0));
+    }
+}
+
+/// Dragging (scrubbing) an expression-driven value keeps it red while the drag is on, in the
+/// Timeline and Effect Controls.
+#[test]
+fn a_dragged_expression_value_stays_red() {
+    let (mut h, ids) = setup();
+    let opacity = ids.driven.iter().filter(|c| c.kind == Kind::Scalar).copied().collect::<Vec<_>>();
+    for c in &opacity {
+        set_expression(&mut h, &ids, c.uid, &json!({"expression": "value"}));
+    }
+    h.run_steps(3);
+    let t = h.state().tokens;
+    for (c, panel) in [(opacity[0], TIMELINE), (opacity[1], EFFECT_CONTROLS)] {
+        let at = value_area(&h, panel, c).center();
+        h.input_mut().events.push(Event::PointerMoved(at));
+        h.step();
+        h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.step();
+        for k in 1..=4 {
+            h.input_mut().events.push(Event::PointerMoved(at + vec2(3.0 * k as f32, 0.0)));
+            h.step();
+        }
+        assert!(h.ctx.dragged_id().is_some(), "{panel}: a drag is on");
+        assert_value(&h, panel, c, t.expr_text, &format!("{panel} dragged"));
+        let end = at + vec2(12.0, 0.0);
+        h.input_mut().events.push(Event::PointerButton { pos: end, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(3);
+        hover(&mut h, pos2(5.0, 5.0));
+    }
+}
+
+/// Separate Dimensions: X Position and Y Position are separate scalars, so an expression on X Position
+/// turns only X red, in the Timeline and Properties panel and both themes; Y Position stays blue.
+#[test]
+fn separated_position_colours_each_dimension_on_its_own() {
+    let (mut h, ids) = setup();
+    h.state_mut().session.execute("prop.separateDimensions", json!({"layer": ids.layer, "value": true})).unwrap();
+    let uid = |h: &Harness<'_, EffectcraftApp>, path: &str| {
+        let s = &h.state().session;
+        s.active_comp().unwrap().layer(LayerId(ids.layer)).unwrap().props.prop(path).unwrap_or_else(|| panic!("no {path}")).uid
+    };
+    const LAYER: &[&str] = &[TIMELINE, PROPERTIES];
+    let x = Checked { uid: uid(&h, "transform/positionX"), kind: Kind::Scalar, panels: LAYER };
+    let y = Checked { uid: uid(&h, "transform/positionY"), kind: Kind::Scalar, panels: LAYER };
+    set_expression(&mut h, &ids, x.uid, &json!({"expression": "value"}));
+    h.run_steps(3);
+    for theme in [ThemeKind::Dark, ThemeKind::Light] {
+        set_theme(&mut h, theme);
+        let t = h.state().tokens;
+        assert_all(&h, &[x], t.expr_text, &format!("{theme:?} X Position (expression)"));
+        assert_all(&h, &[y], t.hot_text, &format!("{theme:?} Y Position (none)"));
+    }
+}
diff --git a/crates/ui-egui/tests/it/ui_flowchart_keyboard.rs b/crates/ui-egui/tests/it/ui_flowchart_keyboard.rs
new file mode 100644
index 000000000..7cdc74f0c
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_flowchart_keyboard.rs
@@ -0,0 +1,210 @@
+//! Flowchart keyboard operation and accessible names (docs/gaps.md gap 25): the nodes are list
+//! items ("Mid, Composition, uses 1": selected, place in the chart), the chart is one Tab stop,
+//! the arrow keys, Home / End, Enter and Space work the nodes, and the toolbar switches say whether
+//! they are on.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::accesskit::{Role, Toggled};
+use egui::{Event, Key, Modifiers, Pos2, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+/// Main uses Mid and Inner, Mid uses Inner: three comp nodes (Main, Mid, Inner) and a solid.
+fn harness() -> Harness<'static, EffectcraftApp> {
+    sized(1600.0, 1000.0)
+}
+
+fn sized(w: f32, hh: f32) -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    let id = |v: serde_json::Value| v["id"].as_u64().or_else(|| v["comp"].as_u64()).or_else(|| v["item"].as_u64()).unwrap();
+    let inner = id(s.execute("comp.new", json!({"name": "Inner", "width": 100, "height": 100, "duration": 2})).unwrap());
+    s.execute("layer.newSolid", json!({"name": "Red", "color": "#ff0000", "width": 100, "height": 100})).unwrap();
+    s.execute("layer.select", json!({"layers": []})).unwrap();
+    let mid = id(s.execute("comp.new", json!({"name": "Mid", "width": 100, "height": 100, "duration": 2})).unwrap());
+    s.execute("layer.addItem", json!({"item": inner})).unwrap();
+    id(s.execute("comp.new", json!({"name": "Main", "width": 100, "height": 100, "duration": 2})).unwrap());
+    s.execute("layer.addItem", json!({"item": mid})).unwrap();
+    s.execute("layer.addItem", json!({"item": inner})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(w, hh)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Flowchart);
+    h.state_mut().ui.maximized = Some(PanelKind::Flowchart);
+    h.run_steps(4);
+    h
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn focused(h: &Harness<'_, EffectcraftApp>) -> Option<(Role, String)> {
+    h.root().children_recursive().find(|n| n.is_focused()).map(|n| (n.accesskit_node().role(), n.accesskit_node().label().unwrap_or_default()))
+}
+
+fn names(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
+    h.query_all_by_role(Role::ListItem).map(|n| n.accesskit_node().label().unwrap_or_default()).collect()
+}
+
+fn selected(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
+    h.query_all_by_role(Role::ListItem)
+        .filter(|n| n.accesskit_node().is_selected() == Some(true))
+        .map(|n| n.accesskit_node().label().unwrap_or_default())
+        .collect()
+}
+
+fn focus_node(h: &mut Harness<'_, EffectcraftApp>, name: &str) {
+    h.get_by_role_and_label(Role::ListItem, name).focus();
+    h.run_steps(3);
+}
+
+#[test]
+fn nodes_are_named_list_items_with_what_they_are_and_what_they_use() {
+    let h = harness();
+    let all = names(&h);
+    for want in ["Main, Composition, uses 2", "Mid, Composition, uses 1", "Inner, Composition, uses 1", "Red, Solid"] {
+        assert!(all.iter().any(|n| n == want), "`{want}` among {all:?}");
+    }
+    let node = h.get_by_role_and_label(Role::ListItem, "Mid, Composition, uses 1");
+    assert_eq!(node.accesskit_node().is_selected(), Some(false));
+    assert_eq!(node.accesskit_node().data().size_of_set(), Some(all.len()));
+    assert!(node.accesskit_node().data().position_in_set().is_some_and(|p| (1..=all.len()).contains(&p)));
+    assert_eq!(h.get_by_role_and_label(Role::Group, "Flowchart: Main").accesskit_node().role(), Role::Group, "the chart has a name");
+}
+
+#[test]
+fn the_toolbar_switches_say_whether_they_are_on() {
+    let mut h = harness();
+    let state = |h: &Harness<'_, EffectcraftApp>, name: &str| h.get_by_role_and_label(Role::Button, name).accesskit_node().toggled();
+    assert_eq!(state(&h, "Solids"), Some(Toggled::True));
+    assert_eq!(state(&h, "Layers"), Some(Toggled::False));
+    h.get_by_role_and_label(Role::Button, "Layers").focus();
+    h.run_steps(3);
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_eq!(state(&h, "Layers"), Some(Toggled::True), "Enter on the focused switch turns it on");
+    assert!(h.state().ui.flowchart.layers);
+    assert!(h.query_by_role_and_label(Role::Button, "Left to Right").is_some(), "the direction button is named");
+}
+
+/// The toolbar switches show and speak the interface language, but their automation labels stay
+/// English, so a script that finds them by label works in every locale.
+#[test]
+fn the_toolbar_automation_labels_stay_english_in_another_language() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 100, "height": 100, "duration": 2})).unwrap();
+    s.prefs.general.language = "fr".into();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).allow_missing_glyphs().build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Flowchart);
+    h.state_mut().ui.maximized = Some(PanelKind::Flowchart);
+    h.run_steps(4);
+    assert!(h.query_by_role_and_label(Role::Button, "Effects").is_none(), "the switch shows the French name");
+    for (key, label) in [("effects", "Effects"), ("layers", "Layers"), ("solids", "Solids")] {
+        let e = h.state().auto.find(&format!("flowchart.option.{key}")).unwrap_or_else(|| panic!("no {key}"));
+        assert_eq!(e.label, label);
+    }
+}
+
+#[test]
+fn the_chart_is_one_tab_stop_and_the_arrows_move_between_the_nodes() {
+    let mut h = harness();
+    // Tab from the toolbar passes through exactly one node.
+    h.get_by_role_and_label(Role::Button, "Solids").focus();
+    h.run_steps(3);
+    let mut nodes_seen = std::collections::BTreeSet::new();
+    for _ in 0..12 {
+        key(&mut h, Key::Tab, Modifiers::NONE);
+        if let Some((Role::ListItem, name)) = focused(&h) {
+            nodes_seen.insert(name);
+        }
+    }
+    assert_eq!(nodes_seen.len(), 1, "one Tab stop for the chart: {nodes_seen:?}");
+
+    let all = names(&h);
+    focus_node(&mut h, &all[0]);
+    assert_eq!(selected(&h), vec![all[0].clone()], "a focused node is selected");
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(all[1].clone()), "Down Arrow moves to the next node and the focus goes with it");
+    assert_eq!(selected(&h), vec![all[1].clone()]);
+    key(&mut h, Key::End, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), all.last().cloned());
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), all.last().cloned(), "Down Arrow stays on the last node");
+    key(&mut h, Key::Home, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(all[0].clone()));
+    key(&mut h, Key::ArrowUp, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(all[0].clone()), "Up Arrow stays on the first node");
+}
+
+#[test]
+fn right_goes_to_what_a_node_uses_left_goes_back_and_enter_opens_the_comp() {
+    let mut h = harness();
+    // The chart's Tab stop is its selected node, the first one with none selected.
+    focus_node(&mut h, "Main, Composition, uses 2");
+    assert_eq!(focused(&h).map(|f| f.1), Some("Main, Composition, uses 2".to_string()));
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    let child = focused(&h).expect("Right Arrow moves to a node Main uses").1;
+    assert!(child.starts_with("Mid, ") || child.starts_with("Inner, "), "{child}");
+    key(&mut h, Key::ArrowLeft, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some("Main, Composition, uses 2".to_string()), "Left Arrow goes back to the node that uses it");
+    // (Right Arrow from Main goes to the first node it uses: the top layer, Inner.)
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some("Inner, Composition, uses 1".to_string()));
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    let status = h.state().ui.status.clone();
+    let active = h.state().session.active_comp_id().and_then(|id| h.state().session.project.item(id)).map(|i| i.name.clone());
+    assert_eq!(active.as_deref(), Some("Inner"), "Enter opens the comp, as a double click does (status: {status})");
+}
+
+#[test]
+fn after_a_click_the_arrows_belong_to_the_chart_and_do_not_nudge_layers() {
+    let mut h = harness();
+    // Select the Mid layer in Main, then click a node: the arrows must not move the layer.
+    h.state_mut().session.execute("layer.select", json!({"layers": ["#1"]})).ok();
+    h.run_steps(3);
+    let before = serde_json::to_string(&h.state().session.project).unwrap_or_default();
+    let node = h.state().auto.find("flowchart.node.item:3").or_else(|| h.state().auto.query("flowchart.node.").into_iter().next()).cloned().expect("a node");
+    click_at(&mut h, pos2(node.rect[0] + node.rect[2] / 2.0, node.rect[1] + node.rect[3] / 2.0));
+    assert_eq!(h.state().ui.focused, PanelKind::Flowchart);
+    let selected_before = selected(&h);
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    assert_ne!(selected(&h), selected_before, "the arrow moved the chart's selection");
+    assert_eq!(serde_json::to_string(&h.state().session.project).unwrap_or_default(), before, "no layer was nudged");
+}
+
+#[test]
+fn a_node_scrolled_out_of_view_is_brought_back_by_the_keys() {
+    // A small window: the last node starts out of view (it is not in the tree until the key
+    // brings it in).
+    let mut h = sized(300.0, 400.0);
+    let all = names(&h);
+    let ctx = h.ctx.clone();
+    let graph = effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "flowchart.graph", json!({})).unwrap();
+    let total = graph["nodes"].as_array().map_or(0, Vec::len);
+    assert!(all.len() < total, "the window is small enough to hide a node ({} of {total} drawn)", all.len());
+    focus_node(&mut h, &all[0]);
+    key(&mut h, Key::End, Modifiers::NONE);
+    let last_id = graph["nodes"].as_array().and_then(|n| n.last()).and_then(|n| n["id"].as_str()).unwrap_or_default().to_string();
+    assert_eq!(h.state().ui.flowchart.selected.as_deref(), Some(last_id.as_str()), "End selects the last node");
+    assert_eq!(
+        focused(&h).map(|f| f.0),
+        Some(Role::ListItem),
+        "the last node is drawn (the view panned to it) and has the focus; pan {:?}",
+        h.state().ui.flowchart.pan
+    );
+}
diff --git a/crates/ui-egui/tests/ui_font_search.rs b/crates/ui-egui/tests/it/ui_font_search.rs
similarity index 59%
rename from crates/ui-egui/tests/ui_font_search.rs
rename to crates/ui-egui/tests/it/ui_font_search.rs
index 6be69cb7a..44b650be4 100644
--- a/crates/ui-egui/tests/ui_font_search.rs
+++ b/crates/ui-egui/tests/it/ui_font_search.rs
@@ -1,4 +1,5 @@
 //! Real keyboard/pointer coverage for the font menus in both text panels.
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::{Session, commands::text_edit::layer_doc, project::LayerId};
 use effectcraft_ui_egui::{EffectcraftApp, dock::PanelKind};
 use egui::{Event, Key, Modifiers, PointerButton};
@@ -29,6 +30,7 @@ fn type_text(h: &mut Harness<'_, EffectcraftApp>, text: &str) {
 
 #[test]
 fn font_search_filters_selects_and_undoes_in_both_panels() {
+    let _device = crate::gpu_test::lock();
     for (panel, prefix) in [(PanelKind::Character, "character.font"), (PanelKind::Properties, "properties.text.font")] {
         let mut s = Session::default();
         s.execute("comp.new", json!({"width": 320, "height": 180})).unwrap();
@@ -56,7 +58,7 @@ fn font_search_filters_selects_and_undoes_in_both_panels() {
         assert!(!rows.is_empty());
         assert!(rows.iter().all(|r| r.label.to_lowercase().contains("jetbrains")));
         if let Ok(dir) = std::env::var("EC_SNAPSHOT_DIR") {
-            h.render().unwrap().save(format!("{dir}/{prefix}-search.png")).unwrap();
+            h.render_serialized().unwrap().save(format!("{dir}/{prefix}-search.png")).unwrap();
         }
         assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().font, "Inter", "typing only filters");
         key(&mut h, Key::Enter);
@@ -76,7 +78,7 @@ fn font_search_filters_selects_and_undoes_in_both_panels() {
         // Reopening clears the previous query, and mouse selection still works.
         h.run_steps(2);
         if let Ok(dir) = std::env::var("EC_SNAPSHOT_DIR") {
-            h.render().unwrap().save(format!("{dir}/{prefix}-reopened.png")).unwrap();
+            h.render_serialized().unwrap().save(format!("{dir}/{prefix}-reopened.png")).unwrap();
         }
         assert!(h.state().auto.query(&format!("{prefix}.option.")).len() > 1);
         type_text(&mut h, "JetBrains");
@@ -106,6 +108,52 @@ fn font_search_preserves_edited_text_and_applies_only_to_selected_characters() {
     assert_eq!(doc.style_at(8).font, "Inter");
 }
 
+/// A font file of just `name`: the family and Regular in English, and the family again in
+/// Simplified Chinese (language 0x804).
+fn font_with_native_name(family: &str, native: &str) -> Vec<u8> {
+    let u16s = |v: &[u16]| -> Vec<u8> { v.iter().flat_map(|x| x.to_be_bytes()).collect() };
+    let records = [(0x409, 1, family), (0x409, 2, "Regular"), (0x804, 1, native)];
+    let strings: Vec<Vec<u8>> = records.iter().map(|(_, _, s)| s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect()).collect();
+    let mut name = u16s(&[0, records.len() as u16, 6 + 12 * records.len() as u16]);
+    let mut off = 0;
+    for ((lang, id, _), st) in records.iter().zip(&strings) {
+        name.extend(u16s(&[3, 1, *lang, *id, st.len() as u16, off]));
+        off += st.len() as u16;
+    }
+    strings.iter().for_each(|st| name.extend(st));
+    let mut out = u16s(&[1, 0, 1, 0, 0, 0]);
+    out.extend(b"name");
+    out.extend([0u8; 4]);
+    out.extend(28u32.to_be_bytes());
+    out.extend((name.len() as u32).to_be_bytes());
+    out.extend(name);
+    out
+}
+
+/// A family whose own-language name has a character no interface font has is listed under its
+/// English name: the harness fails on a missing glyph, and the app would draw boxes. Picking the
+/// row still applies the family.
+#[test]
+fn font_menu_lists_a_name_the_interface_fonts_lack_in_english() {
+    const FAMILY: &str = "Native Name Menu Test";
+    // U+F1234 is in a private use plane that no interface font maps.
+    const NATIVE: &str = "中文\u{F1234}字体";
+    assert_eq!(effectcraft_engine::text::fonts::add_font_data(font_with_native_name(FAMILY, NATIVE)).len(), 1);
+    assert_eq!(effectcraft_engine::text::fonts::native_families().get(FAMILY).map(String::as_str), Some(NATIVE));
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 320, "height": 180})).unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "Native", "font": "Inter"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    click(&mut h, "character.font");
+    type_text(&mut h, "native name menu");
+    let shown: Vec<String> = h.state().auto.query("character.font.option.").iter().map(|e| e.id.clone()).collect();
+    assert_eq!(shown, vec![format!("character.font.option.{FAMILY}")]);
+    click(&mut h, &format!("character.font.option.{FAMILY}"));
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().font, FAMILY);
+}
+
 /// A font file of just `name` (the family, Regular) and an `fvar` table with one axis pinned at
 /// 400: a variable font as far as the font menu's filter is concerned.
 fn pinned_variable_font(family: &str) -> Vec<u8> {
@@ -176,3 +224,58 @@ fn font_menu_filters_variable_fonts() {
     key(&mut h, Key::Escape);
     assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().font, "Inter", "filtering changes nothing");
 }
+
+/// The font menu grows back when a query that matched nothing is cleared, while the search
+/// field keeps its place and the keyboard; a click on a row then picks that font.
+#[test]
+fn font_menu_grows_back_after_an_empty_search() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 320, "height": 180})).unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "Grow", "font": "Inter"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    let rows = |h: &Harness<'_, EffectcraftApp>| h.state().auto.query("character.font.option.").len();
+    let search = |h: &Harness<'_, EffectcraftApp>| h.state().auto.find("character.font.search").map(|e| e.rect);
+    click(&mut h, "character.font");
+    h.run_steps(2);
+    let (full, field) = (rows(&h), search(&h));
+    assert!(full > 3, "the open menu shows the fonts: {full} rows");
+    let query = "no_such_font_123456789";
+    type_text(&mut h, query);
+    assert_eq!(rows(&h), 0);
+    assert!(h.state().auto.find("character.font.empty").is_some());
+    for pressed in query.chars().flat_map(|_| [true, false]) {
+        h.input_mut().events.push(Event::Key { key: Key::Backspace, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
+    }
+    h.run_steps(3);
+    // (Within a row: the list scrolls to the current font on opening and to the top when cleared.)
+    assert!(rows(&h) + 1 >= full, "cleared, the menu shows as many fonts as when it opened: {} of {full}", rows(&h));
+    assert_eq!(search(&h), field, "the search field stays put");
+    // The field still has the keyboard: typing filters again.
+    type_text(&mut h, "JetBrains");
+    assert!(rows(&h) > 0 && h.state().auto.query("character.font.option.").iter().all(|r| r.label.contains("JetBrains")));
+    click(&mut h, "character.font.option.JetBrains Mono");
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().font, "JetBrains Mono", "a click on a row picks the font");
+}
+
+/// #1089: the font menu can re-run the system scan without restarting the app, and the press
+/// does not also flip the "Variable fonts only" filter.
+#[test]
+fn font_menu_rescan_button_adds_fonts_installed_later() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 320, "height": 180})).unwrap();
+    s.execute("layer.newText", json!({"text": "Keep this text", "font": "Inter"})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    click(&mut h, "character.font");
+    h.run_steps(3);
+    assert!(h.state().auto.find("character.font.rescan").is_some(), "the filter row offers a rescan");
+    click(&mut h, "character.font.rescan");
+    assert!(h.state().ui.status.contains("Rescan Fonts"), "the status reports the rescan: {}", h.state().ui.status);
+    // The popup stays open, the variable filter did not flip, and the list still has the bundled families.
+    assert!(h.state().auto.find("character.font.search").is_some(), "the popup stays open");
+    let rows = h.state().auto.query("character.font.option.");
+    assert!(rows.iter().any(|r| r.label == "Inter"), "{:?}", rows.iter().map(|r| &r.label).collect::<Vec<_>>());
+}
diff --git a/crates/ui-egui/tests/ui_form_fit.rs b/crates/ui-egui/tests/it/ui_form_fit.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_form_fit.rs
rename to crates/ui-egui/tests/it/ui_form_fit.rs
diff --git a/crates/ui-egui/tests/ui_frame_step.rs b/crates/ui-egui/tests/it/ui_frame_step.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_frame_step.rs
rename to crates/ui-egui/tests/it/ui_frame_step.rs
diff --git a/crates/ui-egui/tests/ui_fx_editors.rs b/crates/ui-egui/tests/it/ui_fx_editors.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_fx_editors.rs
rename to crates/ui-egui/tests/it/ui_fx_editors.rs
index 90a5af15d..b4d999311 100644
--- a/crates/ui-egui/tests/ui_fx_editors.rs
+++ b/crates/ui-egui/tests/it/ui_fx_editors.rs
@@ -8,6 +8,7 @@ use effectcraft_engine::keyframe::Value as KV;
 use effectcraft_engine::project::{LayerId, Node, PropGroup};
 use effectcraft_ui_egui::EffectcraftApp;
 use effectcraft_ui_egui::dock::PanelKind;
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
 use egui::{Event, Pos2, pos2};
 use egui_kittest::Harness;
 use serde_json::json;
@@ -129,7 +130,7 @@ fn undo(h: &mut Harness<'_, EffectcraftApp>) {
 
 #[test]
 fn lumetri_rgb_and_hue_saturation_curve_editors() {
-    let (s0, l, fx) = with_effect("Lumetri Color");
+    let (s0, l, fx) = with_effect("Color Grading");
     let mut h = harness(s0);
     only_groups(&mut h, l, fx, &["curves", "rgbCurves", "hueSaturationCurves"]);
     let pre = format!("effectControls.effect.{fx}.lumetri.rgbCurves");
@@ -298,5 +299,5 @@ fn composition_tabs_and_scrolling_preview() {
     let shown = h.state().session.state.active_comp.unwrap();
     click_id(&mut h, "panel.tab.Timeline.close");
     assert!(!h.state().session.state.open_comps.contains(&shown));
-    assert!(h.state().ui.dock.contains(PanelKind::Timeline));
+    assert!(h.state().ui.dock.is_docked(PanelKind::Timeline));
 }
diff --git a/crates/ui-egui/tests/it/ui_gpu.rs b/crates/ui-egui/tests/it/ui_gpu.rs
new file mode 100644
index 000000000..28edac27d
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_gpu.rs
@@ -0,0 +1,283 @@
+//! The viewer on the GPU compositor (egui_kittest with wgpu): frames composited on the GPU match
+//! the CPU viewer. Skips without a GPU adapter (CI). Set `EC_SNAPSHOT_DIR` to keep PNGs.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// Step until the GPU compositor's worker is done and a frame has landed in the viewer.
+fn settle(h: &mut Harness<'_, EffectcraftApp>) {
+    for _ in 0..3000 {
+        h.step();
+        if !h.state().gpu_initializing() && h.state().frames.inflight() == 0 && h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(20));
+    }
+    for _ in 0..4 {
+        h.step();
+    }
+}
+
+/// Step until the GPU compositor's worker has handed its result over (attached, or why not).
+/// The first step starts the build.
+pub(crate) fn wait_for_compositor(h: &mut Harness<'_, EffectcraftApp>) {
+    h.step();
+    for _ in 0..3000 {
+        if !h.state().gpu_initializing() {
+            return;
+        }
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(20));
+    }
+    panic!("the GPU compositor's worker gave no result within a minute");
+}
+
+/// Whether wgpu finds any adapter at all (egui_kittest's wgpu harness needs one; CI runners
+/// without a GPU skip).
+fn any_adapter() -> bool {
+    let instance = eframe::wgpu::Instance::new(eframe::wgpu::InstanceDescriptor::new_without_display_handle());
+    !pollster::block_on(instance.enumerate_adapters(eframe::wgpu::Backends::all())).is_empty()
+}
+
+fn small_session() -> Session {
+    let mut s = Session::default();
+    let comp = s.execute("comp.new", json!({"name": "First", "width": 64, "height": 64, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("layer.newSolid", json!({"comp": comp, "color": "#ff0000"})).unwrap();
+    s
+}
+
+/// The window opens before the GPU compositor exists: its pipelines compile on a worker thread
+/// (tens of seconds on a cold shader cache), and until then the interface draws, says so, and
+/// composites on the CPU. The worker is held on a gate so the "preparing" state is observable.
+#[test]
+fn the_interface_draws_and_composites_on_the_cpu_while_the_gpu_compositor_is_built() {
+    let _device = crate::gpu_test::lock();
+    if !any_adapter() {
+        eprintln!("no wgpu adapter: skipping");
+        return;
+    }
+    let (release, gate) = std::sync::mpsc::channel::<()>();
+    let s = small_session();
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).wgpu().build_eframe(move |_| {
+        let mut app = EffectcraftApp::new(s);
+        // The status line's 5 s expiry reads the app clock: a manual one makes the steps below
+        // stand for a known span of time.
+        app.use_manual_clock();
+        app.hooks.before_gpu_build = Some(Box::new(move || {
+            let _ = gate.recv();
+        }));
+        app
+    });
+    // The first frames paint, and a CPU frame reaches the viewer, while the worker still waits.
+    for _ in 0..600 {
+        h.step();
+        if h.state().is_ready() && !h.output().shapes.is_empty() && h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(h.state().gpu_initializing(), "the compositor is still being built");
+    assert!(!h.output().shapes.is_empty(), "the interface draws before the compositor exists");
+    assert!(h.state().session.accel.is_none(), "nothing renders on a compositor that doesn't exist yet");
+    assert_eq!(h.state().ui.status, effectcraft_ui_egui::GPU_PREPARING, "the status line is honest about it");
+    assert_eq!(h.state().session.accel_note.as_deref(), Some(effectcraft_ui_egui::GPU_PREPARING));
+    assert!(h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false), "a frame was composited on the CPU meanwhile");
+    assert!(h.state_mut().viewer_pixels().is_some(), "the viewer shows that frame");
+    // Other statuses clear after 5 s; this one stays for as long as the build takes (each step
+    // is a quarter of a second).
+    for _ in 0..30 {
+        h.state_mut().clock_mut().advance(0.25);
+        h.step();
+    }
+    assert!(h.state().gpu_initializing());
+    assert_eq!(h.state().ui.status, effectcraft_ui_egui::GPU_PREPARING, "the status line still says so 7.5 s later");
+    release.send(()).unwrap();
+    settle(&mut h);
+    assert!(!h.state().gpu_initializing());
+    assert_ne!(h.state().ui.status, effectcraft_ui_egui::GPU_PREPARING, "the preparing status goes away");
+    match h.state().gpu_adapter() {
+        Some(adapter) => {
+            eprintln!("compositor attached after the first frames: {adapter}");
+            assert!(h.state().session.accel.is_some());
+            assert!(h.state().session.accel_note.is_none());
+        }
+        // An adapter that can't run the compositor (software GL): the reason is recorded.
+        None => assert!(h.state().session.accel_note.as_deref().is_some_and(|n| n != effectcraft_ui_egui::GPU_PREPARING)),
+    }
+}
+
+/// A graphics backend that panics while the compositor's pipelines compile panics on the worker
+/// thread, not under the UI: the window keeps drawing on the CPU and says why.
+#[test]
+fn a_compositor_build_that_panics_leaves_the_viewer_on_the_cpu() {
+    let _device = crate::gpu_test::lock();
+    if !any_adapter() {
+        eprintln!("no wgpu adapter: skipping");
+        return;
+    }
+    let s = small_session();
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).wgpu().build_eframe(move |_| {
+        let mut app = EffectcraftApp::new(s);
+        app.hooks.before_gpu_build = Some(Box::new(|| panic!("synthetic shader compiler panic")));
+        app
+    });
+    settle(&mut h);
+    assert!(!h.state().gpu_initializing());
+    assert!(h.state().gpu_adapter().is_none());
+    assert!(h.state().session.accel.is_none());
+    let note = h.state().session.accel_note.clone().unwrap_or_default();
+    assert!(note.contains("synthetic shader compiler panic"), "{note}");
+    assert!(!h.output().shapes.is_empty(), "the interface still draws");
+    assert!(h.state_mut().viewer_pixels().is_some(), "the viewer shows a CPU frame");
+}
+
+/// egui_kittest's wgpu setup on the adapter the headless compositor picked (`name (Backend)`),
+/// like the desktop app's window. Left alone, egui_kittest prefers a CPU adapter, which on
+/// Windows is WARP on DirectX 12, where FXC fails to compile the compositor's kernels: the
+/// viewer would stay on the CPU and the comparison would never run.
+fn same_adapter(name: String) -> eframe::egui_wgpu::WgpuSetup {
+    let mut setup = egui_kittest::wgpu::default_wgpu_setup();
+    if let eframe::egui_wgpu::WgpuSetup::CreateNew(c) = &mut setup {
+        let fallback = c.native_adapter_selector.take();
+        c.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+            let named = |a: &&eframe::wgpu::Adapter| format!("{} ({:?})", a.get_info().name, a.get_info().backend) == name;
+            match (adapters.iter().find(named), &fallback) {
+                (Some(a), _) => Ok(a.clone()),
+                (None, Some(f)) => f(adapters, surface),
+                (None, None) => adapters.first().cloned().ok_or_else(|| "No adapter found".to_owned()),
+            }
+        }));
+    }
+    setup
+}
+
+#[test]
+fn viewer_draws_gpu_frames_that_match_the_cpu() {
+    let _device = crate::gpu_test::lock();
+    let Some(probe) = effectcraft_gpu::Gpu::headless() else {
+        eprintln!("no GPU adapter: skipping");
+        return;
+    };
+    let adapter = effectcraft_engine::render::Accelerator::name(&probe);
+    eprintln!("headless compositor adapter: {adapter}");
+    // egui-wgpu creates its GL device with WebGL2's limits, which the compositor declines.
+    let gl = adapter.ends_with("(Gl)");
+    drop(probe);
+    let mut h = Harness::builder()
+        .with_size(egui::vec2(1400.0, 900.0))
+        .with_pixels_per_point(1.0)
+        .wgpu_setup(same_adapter(adapter))
+        .build_eframe(|_| EffectcraftApp::new(Session::default()));
+    // The project opens once the compositor (built on a worker thread) is attached. A frame the
+    // CPU composited while it was being built has the GPU frame's key, so the viewer would keep
+    // showing it, and the comparison below would be the CPU against itself.
+    wait_for_compositor(&mut h);
+    if gl && h.state().gpu_adapter().is_none() {
+        eprintln!("egui-wgpu's GL device has WebGL2 limits: the viewer stays on the CPU, skipping");
+        return;
+    }
+    assert!(h.state().gpu_adapter().is_some(), "GPU compositor on egui-wgpu's device");
+    eprintln!("viewer compositor adapter: {:?}", h.state().gpu_adapter());
+    h.state_mut().session.execute("file.openDemoProject", json!({})).unwrap();
+    h.state_mut().session.execute("time.set", json!({"time": 2.0})).unwrap();
+    settle(&mut h);
+    let gpu_px = h.state_mut().viewer_pixels().expect("read back the GPU frame");
+    let gpu_shot = h.render().expect("render");
+    // Mercury Software Only: the same frame from the CPU.
+    h.state_mut().session.execute("render.backend", json!({"backend": "cpu"})).unwrap();
+    settle(&mut h);
+    let cpu_px = h.state_mut().viewer_pixels().expect("CPU frame");
+    let cpu_shot = h.render().expect("render");
+    assert_eq!(gpu_px.size, cpu_px.size);
+    let mut worst = 0i32;
+    let mut over = 0usize;
+    for (a, b) in gpu_px.pixels.iter().zip(&cpu_px.pixels) {
+        let d = a.to_array().iter().zip(b.to_array()).map(|(x, y)| (*x as i32 - y as i32).abs()).max().unwrap_or(0);
+        worst = worst.max(d);
+        over += usize::from(d > 1);
+    }
+    assert!(over * 1000 <= gpu_px.pixels.len() * 3 && worst <= 4, "viewer GPU vs CPU: {over} pixels > 1/255, worst {worst}/255");
+    if let Ok(d) = std::env::var("EC_SNAPSHOT_DIR") {
+        gpu_shot.save(format!("{d}/ui_gpu_viewer.png")).unwrap();
+        cpu_shot.save(format!("{d}/ui_cpu_viewer.png")).unwrap();
+    }
+}
+
+/// Once the graphics device is lost, eframe's renderer cannot stage buffers and egui-wgpu
+/// panicked on the main thread drawing the next frame (#591). The app now draws nothing,
+/// auto-saves unsaved changes and closes its window instead.
+#[test]
+fn a_lost_device_draws_nothing_autosaves_and_closes() {
+    let dir = std::env::temp_dir().join(format!("ec-device-lost-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let mut s = Session { autosave_folder_override: Some(dir.clone()), ..Default::default() };
+    s.execute("comp.new", json!({"name": "Unsaved", "width": 64, "height": 64, "duration": 1})).unwrap();
+    assert!(s.is_dirty());
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_| EffectcraftApp::new(s));
+    let told = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
+    let log = told.clone();
+    h.state_mut().hooks.device_lost = Some(Box::new(move |saved| log.borrow_mut().push(saved)));
+    h.run_steps(3);
+    assert!(!h.output().shapes.is_empty(), "the UI draws before the loss");
+    let bridge = effectcraft_ui_egui::gpu_failure::GpuFailureBridge::new(&h.ctx);
+    h.state_mut().set_gpu_failure_bridge(bridge.clone());
+    bridge.report("GPU device lost (Unknown): Device is lost", true);
+    h.step();
+    let closing = h.output().viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::Close));
+    assert!(closing, "the window closes");
+    assert!(h.output().shapes.is_empty(), "nothing for the lost renderer to stage");
+    h.step();
+    assert!(h.output().shapes.is_empty());
+    let saved = h.state().session.autosave.last_path.clone().expect("unsaved changes auto-saved");
+    assert!(std::path::Path::new(&saved).is_file(), "{saved}");
+    assert_eq!(*told.borrow(), vec![Some(Ok(saved))], "the user is told once, with the recovery copy");
+    // The close arrives: on macOS the app quits through `-[NSApplication terminate:]` instead of
+    // closing the window while AppKit's run loop is running (#341).
+    h.input_mut().viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+    h.step();
+    let kept = h.output().viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::CancelClose));
+    assert_eq!(kept, cfg!(target_os = "macos"), "the platform quit closes the window on macOS");
+    assert_eq!(told.borrow().len(), 1);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #2797 in the real viewer on a device: a 32 bpc frame of white +2 stops (about 4.0 linear)
+/// goes through the display pass on egui-wgpu's device, so -2 EV still shows it white and -4 EV
+/// a quarter of white (the 8-bit viewer showed a sixteenth of white there).
+#[test]
+fn the_viewer_exposes_32_bpc_frames_on_the_gpu() {
+    let _device = crate::gpu_test::lock();
+    if !any_adapter() {
+        eprintln!("no wgpu adapter: skipping");
+        return;
+    }
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Hdr", "width": 64, "height": 64, "duration": 1})).unwrap();
+    s.execute("file.projectSettings", json!({"bitDepth": 32, "workingSpace": "srgb"})).unwrap();
+    let lid = s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("effect.apply", json!({"layers": [lid], "effect": "Exposure"})).unwrap();
+    s.execute("prop.set", json!({"layer": lid, "path": "effects/#1/master/exposure", "value": 2.0})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).wgpu().build_eframe(move |_| EffectcraftApp::new(s));
+    settle(&mut h);
+    let p = h.state().viewer_f16().expect("a half-float viewer frame").pixel(0).unwrap();
+    let l = effectcraft_engine::color::srgb_to_linear(p[0] / p[3]);
+    assert!(l > 3.9, "{l}");
+    // Screen pixels of the frame's grey (the comp is 64 × 64 points in the viewer at most).
+    let count = |h: &mut Harness<'_, EffectcraftApp>, stops: f32| {
+        h.state_mut().session.state.viewer.exposure = stops;
+        for _ in 0..4 {
+            h.step();
+        }
+        assert!(h.state().viewer_display_texture().is_some(), "drawn by the display pass on the device");
+        let want = (effectcraft_engine::color::linear_to_srgb(l * 2f32.powf(stops)).clamp(0.0, 1.0) * 255.0).round() as i32;
+        let img = h.render().expect("render");
+        let n = img.pixels().filter(|px| px.0[..3].iter().all(|c| (*c as i32 - want).abs() <= 1)).count();
+        (want, n)
+    };
+    let (white, n) = count(&mut h, -2.0);
+    assert!(white == 255 && n >= 1000, "-2 EV: {n} white pixels");
+    let (grey, n) = count(&mut h, -4.0);
+    assert!((130..=145).contains(&grey) && n >= 1000, "-4 EV: {n} pixels of {grey}");
+}
diff --git a/crates/ui-egui/tests/ui_gradient_editor.rs b/crates/ui-egui/tests/it/ui_gradient_editor.rs
similarity index 83%
rename from crates/ui-egui/tests/ui_gradient_editor.rs
rename to crates/ui-egui/tests/it/ui_gradient_editor.rs
index fa8c7b73f..f5ee8634b 100644
--- a/crates/ui-egui/tests/ui_gradient_editor.rs
+++ b/crates/ui-egui/tests/it/ui_gradient_editor.rs
@@ -197,7 +197,8 @@ fn stop_edits_ok_sets_the_gradient_in_one_undo_step() {
     let from = center(&h, "dialog.gradient.opacityStop.1");
     let to = along(&h, "dialog.gradient.opacityStop.1", 0.5);
     drag(&mut h, from, to);
-    assert_eq!(undo_len(&h), undo, "nothing is set while editing");
+    assert_eq!(undo_len(&h), undo + 1, "the live preview is one merged undo step while editing");
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 3, "the property shows the edit before OK");
     click(&mut h, "dialog.gradient.ok");
     assert_eq!(h.state().dialog, None);
     let g = gradient(&colors_prop(&h, l, colors).value);
@@ -403,11 +404,13 @@ fn location_moves_past_a_neighbour_and_the_fields_follow_the_stop() {
     assert!(!shown.iter().any(|v| (v - 70.0).abs() < 1.0), "{shown:?}");
 }
 
-/// A layer deleted while the editor is open: OK reports it, without a crash.
+/// A layer deleted while the editor is open, Preview off: OK reports the failed set, without a
+/// crash.
 #[test]
 fn a_layer_deleted_while_editing_is_reported() {
     let (mut h, l, colors) = setup(&[]);
     open_editor(&mut h, colors);
+    click(&mut h, "dialog.gradient.preview");
     let p = along(&h, "dialog.gradient.addColor", 0.5);
     click_at(&mut h, p);
     h.state_mut().session.execute("edit.clear", json!({"layers": [l]})).unwrap();
@@ -417,6 +420,98 @@ fn a_layer_deleted_while_editing_is_reported() {
     assert!(!h.state().ui.status.is_empty(), "the failed set is reported");
 }
 
+/// The same with Preview on: the preview's set fails at the next edit and says so, and OK closes
+/// the editor without a crash.
+#[test]
+fn a_layer_deleted_during_the_preview_is_reported_at_the_next_edit() {
+    let (mut h, l, colors) = setup(&[]);
+    open_editor(&mut h, colors);
+    h.state_mut().session.execute("edit.clear", json!({"layers": [l]})).unwrap();
+    h.run_steps(2);
+    let p = along(&h, "dialog.gradient.addColor", 0.5);
+    click_at(&mut h, p);
+    assert!(!h.state().ui.status.is_empty(), "the failed preview set is reported");
+    click(&mut h, "dialog.gradient.ok");
+    assert_eq!(h.state().dialog, None);
+}
+
+/// Preview (on by default, as in After Effects): edits reach the property as they are made, in one
+/// undo step, and Cancel and Escape roll them back to how the editor opened.
+#[test]
+fn the_preview_applies_edits_live_and_cancel_rolls_them_back() {
+    let (mut h, l, colors) = setup(&[]);
+    let before = colors_prop(&h, l, colors).value.clone();
+    let undo = undo_len(&h);
+    open_editor(&mut h, colors);
+    assert!(h.state().gradient_draft().preview, "Preview starts on");
+    let p = along(&h, "dialog.gradient.addColor", 0.25);
+    click_at(&mut h, p);
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 3, "the new stop shows at once");
+    let p = along(&h, "dialog.gradient.addColor", 0.75);
+    click_at(&mut h, p);
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 4);
+    assert_eq!(undo_len(&h), undo + 1, "both edits are one undo step");
+    click(&mut h, "dialog.gradient.cancel");
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(colors_prop(&h, l, colors).value, before, "Cancel puts the gradient back");
+    assert_eq!(undo_len(&h), undo, "and leaves no undo step");
+    // Escape does the same.
+    open_editor(&mut h, colors);
+    let p = along(&h, "dialog.gradient.addColor", 0.5);
+    click_at(&mut h, p);
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 3);
+    key(&mut h, Key::Escape);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(colors_prop(&h, l, colors).value, before);
+    assert_eq!(undo_len(&h), undo);
+}
+
+/// An edit made in the same frame as OK is not in the last preview: OK sets the draft it finds.
+#[test]
+fn ok_in_the_frame_of_an_edit_sets_the_draft_not_the_older_preview() {
+    let (mut h, l, colors) = setup(&[]);
+    open_editor(&mut h, colors);
+    let p = along(&h, "dialog.gradient.addColor", 0.25);
+    click_at(&mut h, p);
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 3, "the preview has three stops");
+    h.state_mut().gradient_draft_mut().add(Track::Color, 0.75);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::panels::gradient_editor::finish(h.state_mut(), true, &ctx);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 4, "OK sets the draft it found");
+}
+
+/// With Preview off nothing is set until OK, and switching it off takes back what it applied.
+#[test]
+fn with_preview_off_nothing_is_set_until_ok() {
+    let (mut h, l, colors) = setup(&[]);
+    let before = colors_prop(&h, l, colors).value.clone();
+    let undo = undo_len(&h);
+    open_editor(&mut h, colors);
+    let p = along(&h, "dialog.gradient.addColor", 0.25);
+    click_at(&mut h, p);
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 3, "previewed");
+    click(&mut h, "dialog.gradient.preview");
+    assert!(!h.state().gradient_draft().preview);
+    assert_eq!(colors_prop(&h, l, colors).value, before, "switching Preview off takes the preview back");
+    assert_eq!(undo_len(&h), undo);
+    let p = along(&h, "dialog.gradient.addColor", 0.75);
+    click_at(&mut h, p);
+    assert_eq!(colors_prop(&h, l, colors).value, before, "nothing is set while editing");
+    click(&mut h, "dialog.gradient.ok");
+    assert_eq!(gradient(&colors_prop(&h, l, colors).value).colors.len(), 4, "OK sets the draft");
+    assert_eq!(undo_len(&h), undo + 1, "in one undo step");
+}
+
+/// The editor opens at the lower right of the window, so the canvas it edits stays in view.
+#[test]
+fn the_editor_opens_at_the_lower_right() {
+    let (mut h, _, colors) = setup(&[]);
+    open_editor(&mut h, colors);
+    let ok = center(&h, "dialog.gradient.ok");
+    assert!(ok.x > 800.0 && ok.y > 500.0, "the editor's OK button is in the lower right of the 1600 × 1000 window: {ok:?}");
+}
+
 /// `prop.editGradient` by id (agents, MCP, the control channel) is an error for a target that
 /// isn't a gradient property, from the engine and through the UI, and opens nothing.
 #[test]
diff --git a/crates/ui-egui/tests/ui_gradient_handles.rs b/crates/ui-egui/tests/it/ui_gradient_handles.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_gradient_handles.rs
rename to crates/ui-egui/tests/it/ui_gradient_handles.rs
diff --git a/crates/ui-egui/tests/ui_gradient_value.rs b/crates/ui-egui/tests/it/ui_gradient_value.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_gradient_value.rs
rename to crates/ui-egui/tests/it/ui_gradient_value.rs
diff --git a/crates/ui-egui/tests/it/ui_graph_fit.rs b/crates/ui-egui/tests/it/ui_graph_fit.rs
new file mode 100644
index 000000000..d80ae315e
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_graph_fit.rs
@@ -0,0 +1,151 @@
+//! Opening the Graph Editor frames the graphs, as in After Effects: Fit Selection to View when
+//! keys are selected (a key selected in the Timeline shows its property's graph even when the
+//! layer isn't selected), else Fit All Graphs to View. It used to open on an empty 0–100 range
+//! or with the curves off-view.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// A 20 s comp whose Box layer has Rotation keys 300° at 8 s and 720° at 12 s; the Timeline is
+/// zoomed in on 0–4 s, so neither key is in view. Returns the harness and Rotation's uid.
+fn harness(select_layer: bool) -> (Harness<'static, EffectcraftApp>, u64, u64) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Fit", "width": 320, "height": 180, "frameRate": 30, "duration": 20})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Box", "color": "#e04020", "width": 80, "height": 80})).unwrap();
+    let id = s.active_comp().unwrap().layers[0].id;
+    for (t, v) in [(8.0, 300.0), (12.0, 720.0)] {
+        s.execute("prop.addKey", json!({"layer": id.0, "path": "transform/rotation", "time": t, "value": v})).unwrap();
+    }
+    let uid = s.active_comp().unwrap().layer(id).unwrap().props.prop("transform/rotation").unwrap().uid;
+    s.execute("layer.select", json!({"layers": if select_layer { vec![id.0] } else { vec![] }})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().ui.timeline.pps = Some(300.0);
+    h.state_mut().ui.timeline.start = 0.0;
+    h.run_steps(3);
+    (h, id.0, uid)
+}
+
+fn open_graph(h: &mut Harness<'_, EffectcraftApp>) {
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.graphEditor", json!({})).unwrap();
+    h.run_steps(4);
+    assert!(h.state().ui.timeline.graph_editor);
+}
+
+/// Every key of the property sits inside the plot, and the value range spans `lo..=hi`.
+fn assert_framed(h: &Harness<'_, EffectcraftApp>, uid: u64, keys: &[usize], lo: f64, hi: f64) {
+    let plot = h.state().auto.find("timeline.graph").expect("graph plot").rect;
+    for i in keys {
+        let k = h.state().auto.find(&format!("timeline.graph.key.{uid}.0.{i}")).unwrap_or_else(|| panic!("graph key {i} not drawn")).rect;
+        let (cx, cy) = (k[0] + k[2] / 2.0, k[1] + k[3] / 2.0);
+        assert!(cx > plot[0] && cx < plot[0] + plot[2] && cy > plot[1] && cy < plot[1] + plot[3], "key {i} at ({cx}, {cy}) outside plot {plot:?}");
+    }
+    let (a, b) = h.state().ui.timeline.graph_range.expect("graph range");
+    assert!(a <= lo && b >= hi, "value range {a}..{b} doesn't contain {lo}..{hi}");
+}
+
+#[test]
+fn opening_the_graph_editor_fits_the_selected_key() {
+    let (mut h, layer, uid) = harness(false);
+    h.state_mut().session.execute("keys.select", json!({"keys": [{"layer": layer, "prop": uid, "time": 12.0}]})).unwrap();
+    h.run_steps(2);
+    open_graph(&mut h);
+    // A lone key also frames its neighbour, so its curve shows.
+    assert_framed(&h, uid, &[0, 1], 300.0, 720.0);
+    assert!(!h.state().ui.timeline.graph_auto_zoom, "Fit Selection turns auto-zoom off");
+}
+
+#[test]
+fn opening_the_graph_editor_with_no_keys_selected_fits_all_graphs() {
+    let (mut h, _, uid) = harness(true);
+    open_graph(&mut h);
+    assert_eq!(h.state().ui.timeline.pps, None, "the whole comp in time");
+    assert_framed(&h, uid, &[0, 1], 300.0, 720.0);
+    // Zooming away and toggling the Graph Editor off and on frames it again.
+    h.state_mut().ui.timeline.pps = Some(300.0);
+    h.state_mut().ui.timeline.start = 0.0;
+    open_graph_toggle_twice(&mut h);
+    assert_framed(&h, uid, &[0, 1], 300.0, 720.0);
+}
+
+fn open_graph_toggle_twice(h: &mut Harness<'_, EffectcraftApp>) {
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.graphEditor", json!({})).unwrap();
+    h.run_steps(2);
+    assert!(!h.state().ui.timeline.graph_editor);
+    open_graph(h);
+}
+
+#[test]
+fn locked_graph_keys_preserve_the_existing_selection_and_keyframes() {
+    use egui::{Event, Modifiers, PointerButton, pos2, vec2};
+    for (button, modifiers, drag) in [
+        (PointerButton::Primary, Modifiers::NONE, false),
+        (PointerButton::Primary, Modifiers::SHIFT, false),
+        (PointerButton::Primary, Modifiers::COMMAND, false),
+        (PointerButton::Secondary, Modifiers::NONE, false),
+        (PointerButton::Primary, Modifiers::NONE, true),
+    ] {
+        let (mut h, layer, uid) = harness(true);
+        let s = &mut h.state_mut().session;
+        let locked = s.execute("layer.newSolid", json!({"name": "Locked", "color": "#fff"})).unwrap()["layer"].as_u64().unwrap();
+        for (time, value) in [(9.0, 100.0), (11.0, 200.0)] {
+            s.execute("prop.addKey", json!({"layer": locked, "path": "transform/rotation", "time": time, "value": value})).unwrap();
+        }
+        let locked_id = effectcraft_engine::project::LayerId(locked);
+        let locked_uid = s.active_comp().unwrap().layer(locked_id).unwrap().props.prop("transform/rotation").unwrap().uid;
+        s.execute("layer.setSwitch", json!({"layers": [locked], "switch": "locked", "value": true})).unwrap();
+        s.execute("keys.select", json!({"keys": [{"layer": layer, "prop": uid, "time": 12.0}]})).unwrap();
+        s.state.selected_props = vec![(effectcraft_engine::project::LayerId(layer), uid), (locked_id, locked_uid)];
+        let selection = s.state.selected_keys.clone();
+        let before = s.project.clone();
+        open_graph(&mut h);
+        h.state_mut().ui.timeline.graph_auto_zoom = false;
+        h.state_mut().ui.timeline.graph_range = Some((0.0, 800.0));
+        h.run_steps(3);
+        let [x, y, w, height] = h.state().auto.find(&format!("timeline.graph.key.{locked_uid}.0.0")).expect("locked key drawn").rect;
+        let point = pos2(x + w / 2.0, y + height / 2.0);
+        h.input_mut().events.push(Event::ModifiersChanged(modifiers));
+        h.input_mut().events.push(Event::PointerMoved(point));
+        h.input_mut().events.push(Event::PointerButton { pos: point, button, pressed: true, modifiers });
+        h.step();
+        let end = if drag { point + vec2(30.0, -20.0) } else { point };
+        h.input_mut().events.push(Event::PointerMoved(end));
+        h.step();
+        h.input_mut().events.push(Event::PointerButton { pos: end, button, pressed: false, modifiers });
+        h.run_steps(3);
+        assert_eq!(h.state().session.state.selected_keys, selection, "{button:?}, {modifiers:?}, drag={drag}");
+        assert_eq!(
+            serde_json::to_value(&h.state().session.project).unwrap(),
+            serde_json::to_value(&before).unwrap(),
+            "locked gestures must not edit another key"
+        );
+    }
+}
+
+#[test]
+fn an_unlocked_graph_keys_menu_edits_the_clicked_key() {
+    use egui::{Event, Modifiers, PointerButton, pos2};
+    use egui_kittest::kittest::Queryable;
+    let (mut h, layer, uid) = harness(true);
+    h.state_mut().session.execute("keys.select", json!({"keys": [{"layer": layer, "prop": uid, "time": 12.0}]})).unwrap();
+    open_graph(&mut h);
+    let [x, y, w, height] = h.state().auto.find(&format!("timeline.graph.key.{uid}.0.0")).unwrap().rect;
+    let at = pos2(x + w / 2.0, y + height / 2.0);
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::PointerMoved(at));
+        h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(3);
+    let selected = &h.state().session.state.selected_keys;
+    assert_eq!(selected.len(), 1);
+    assert_eq!(selected[0].time.seconds(), 8.0);
+    h.get_by_label("Easy Ease").click();
+    h.run_steps(3);
+    let prop = h.state().session.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(layer)).unwrap().props.find(uid).unwrap();
+    assert_eq!(prop.keys[0].out_interp, effectcraft_engine::keyframe::Interp::Bezier);
+    assert_eq!(prop.keys[1].out_interp, effectcraft_engine::keyframe::Interp::Linear);
+}
diff --git a/crates/ui-egui/tests/ui_group_rename.rs b/crates/ui-egui/tests/it/ui_group_rename.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_group_rename.rs
rename to crates/ui-egui/tests/it/ui_group_rename.rs
diff --git a/crates/ui-egui/tests/ui_guide_layers.rs b/crates/ui-egui/tests/it/ui_guide_layers.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_guide_layers.rs
rename to crates/ui-egui/tests/it/ui_guide_layers.rs
index 37158658f..92196f5f1 100644
--- a/crates/ui-egui/tests/ui_guide_layers.rs
+++ b/crates/ui-egui/tests/it/ui_guide_layers.rs
@@ -1,6 +1,7 @@
 //! Guide Layer in the layer context menus (Timeline rows and the Composition viewer), a plain item
 //! (no check mark) that toggles the switch on the selection, and the guide mark by a guide layer's
 //! name.
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::project::LayerId;
 use effectcraft_ui_egui::EffectcraftApp;
@@ -45,7 +46,7 @@ fn guide(h: &Harness<'_, EffectcraftApp>, id: LayerId) -> bool {
 
 fn snapshot(h: &mut Harness<'_, EffectcraftApp>, name: &str) {
     if let Ok(dir) = std::env::var("GUIDE_LAYER_SNAPSHOTS") {
-        h.render().unwrap().save(format!("{dir}/{name}.png")).unwrap();
+        h.render_serialized().unwrap().save(format!("{dir}/{name}.png")).unwrap();
     }
 }
 
diff --git a/crates/ui-egui/tests/it/ui_info_tracker_a11y.rs b/crates/ui-egui/tests/it/ui_info_tracker_a11y.rs
new file mode 100644
index 000000000..b527474c3
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_info_tracker_a11y.rs
@@ -0,0 +1,94 @@
+//! Info panel and the 3D Camera Tracker block of Effect Controls (docs/gaps.md gap 25): what these
+//! paint as text is also in the accessibility tree, as read-outs a screen reader can speak, and
+//! the Analyze / Create Camera buttons are named and work from the keyboard.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::accesskit::Role;
+use egui::{Event, Key, Modifiers};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn harness(panel: PanelKind) -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Red", "color": "#c04040"})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(panel);
+    h.state_mut().ui.maximized = Some(panel);
+    h.run_steps(4);
+    h
+}
+
+fn labels(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
+    h.query_all_by_role(Role::Label).filter_map(|n| n.accesskit_node().label()).filter(|l| !l.trim().is_empty()).collect()
+}
+
+#[test]
+fn info_describes_the_colour_the_selection_and_the_time() {
+    let mut h = harness(PanelKind::Info);
+    let l = labels(&h);
+    for want in ["Red: 0", "Green: 0", "Blue: 0", "Alpha: 0"] {
+        assert!(l.iter().any(|x| x == want), "`{want}` in {l:?}");
+    }
+    assert!(l.iter().any(|x| x == "Selected layers: Red"), "the selected layer: {l:?}");
+    assert!(l.iter().any(|x| x.starts_with("Time: ")), "the time: {l:?}");
+    // With one layer selected: its Duration, In and Out.
+    assert!(l.iter().any(|x| x.starts_with("Duration: ")) && l.iter().any(|x| x.starts_with("In: ")), "{l:?}");
+    // Nothing selected: the panel says so.
+    h.state_mut().session.execute("layer.select", json!({"layers": []})).unwrap();
+    h.run_steps(4);
+    assert!(labels(&h).iter().any(|x| x == "Selected layers: No layer selected"), "{:?}", labels(&h));
+    assert!(!labels(&h).iter().any(|x| x.starts_with("Duration: ")));
+}
+
+#[test]
+fn the_camera_tracker_block_is_named_and_works_from_the_keyboard() {
+    let mut h = harness(PanelKind::EffectControls);
+    h.state_mut().session.execute("effect.apply", json!({"effect": effectcraft_engine::effects::camera_tracker::ID})).unwrap();
+    h.run_steps(4);
+    // Applying the effect starts its analysis; while it runs, Analyze is unavailable and Cancel is
+    // there. Wait for it to end.
+    if h.state().session.is_camera_analyzing() {
+        assert!(h.get_by_role_and_label(Role::Button, "Analyze").accesskit_node().is_disabled(), "Analyze is unavailable while the analysis runs");
+    }
+    for _ in 0..200 {
+        if !h.state().session.is_camera_analyzing() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(25));
+        h.run_steps(2);
+    }
+    assert!(!h.state().session.is_camera_analyzing(), "the analysis ended");
+    h.run_steps(4);
+    let analyze = h.get_by_role_and_label(Role::Button, "Analyze");
+    assert!(!analyze.accesskit_node().is_disabled());
+    assert!(labels(&h).iter().any(|x| x.contains("Analyze") || x.contains("solve") || x.contains("Method Used")), "the status is a read-out: {:?}", labels(&h));
+    h.get_by_role_and_label(Role::Button, "Analyze").focus();
+    h.run_steps(3);
+    assert_eq!(h.root().children_recursive().find(|n| n.is_focused()).and_then(|n| n.accesskit_node().label()).as_deref(), Some("Analyze"));
+    // Enter on the focused button starts a new analysis. On a fast machine the background job can
+    // start, finish and be written back inside one frame, so the job is never seen between two
+    // steps; what persists is its undo step, so count those.
+    let runs = |h: &Harness<'_, EffectcraftApp>| h.state().session.history_tree().iter().filter(|n| n.label.starts_with("3D Camera Tracker")).count();
+    // Undo the first analysis so a new run writes a different state, which the history records.
+    assert!(h.state_mut().session.undo(), "undo the first analysis");
+    h.run_steps(4);
+    assert!(h.state().session.camera_job.is_none() && !h.state().session.is_camera_analyzing(), "undo does not start an analysis by itself");
+    let before = runs(&h);
+    h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    for _ in 0..200 {
+        h.run_steps(2);
+        if runs(&h) > before && !h.state().session.is_camera_analyzing() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(25));
+    }
+    assert!(
+        runs(&h) > before,
+        "Enter on Analyze starts the analysis and it writes its result: {:?}",
+        h.state().session.history_tree().iter().map(|n| &n.label).collect::<Vec<_>>()
+    );
+}
diff --git a/crates/ui-egui/tests/ui_inline_edit.rs b/crates/ui-egui/tests/it/ui_inline_edit.rs
similarity index 75%
rename from crates/ui-egui/tests/ui_inline_edit.rs
rename to crates/ui-egui/tests/it/ui_inline_edit.rs
index d7e532d76..6c29045bb 100644
--- a/crates/ui-egui/tests/ui_inline_edit.rs
+++ b/crates/ui-egui/tests/it/ui_inline_edit.rs
@@ -12,7 +12,9 @@ fn harness() -> (Harness<'static, EffectcraftApp>, u64) {
     let mut s = Session::default();
     s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4, "fps": 24})).unwrap();
     let comp = s.active_comp_id().unwrap().0;
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    // Arabic, Hebrew, Devanagari and Thai names typed below need installed system faces: draw
+    // tofu on a host without them rather than failing the missing-glyph gate.
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).allow_missing_glyphs().build_eframe(|_| EffectcraftApp::new(s));
     h.run_steps(4);
     (h, comp)
 }
@@ -540,6 +542,166 @@ fn arrow_keys_move_the_caret_in_rename_fields() {
     assert_eq!(layer_name, "Pla-te");
 }
 
+/// A solid named `name` with its Transform group open in the Timeline; returns the layer, its
+/// Opacity uid and its Rotation uid.
+fn open_transform(h: &mut Harness<'_, EffectcraftApp>, name: &str) -> (u64, u64, u64) {
+    let (layer, opacity, rotation, transform) = {
+        let s = &mut h.state_mut().session;
+        let l = s.execute("layer.newSolid", json!({"name": name, "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+        let tr = s.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(l)).unwrap().props.sub("transform").unwrap().clone();
+        (l, tr.get("opacity").unwrap().uid, tr.get("rotation").unwrap().uid, tr.uid)
+    };
+    h.state_mut().ui.timeline.open_layers.insert(layer);
+    h.state_mut().ui.timeline.open_groups.insert(transform);
+    h.run_steps(3);
+    (layer, opacity, rotation)
+}
+
+fn expression(h: &Harness<'_, EffectcraftApp>, layer: u64, prop: u64) -> Option<String> {
+    let comp = h.state().session.active_comp().unwrap();
+    comp.layer(effectcraft_engine::project::LayerId(layer)).unwrap().props.find(prop).unwrap().expr.as_ref().map(|e| e.text.clone())
+}
+
+fn commit_expression(h: &mut Harness<'_, EffectcraftApp>) {
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::COMMAND));
+    h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
+    h.step();
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(3);
+}
+
+/// #1072: Alt-clicking a stopwatch adds an expression and its editor takes the keyboard at once,
+/// the new expression selected, so typing replaces it (it took another click). That happens
+/// once: a field clicked next keeps the keyboard, and removing the expression with another
+/// Alt-click leaves nothing to take it.
+#[test]
+fn alt_clicking_a_stopwatch_focuses_the_new_expression() {
+    let (mut h, _) = harness();
+    let (layer, opacity, rotation) = open_transform(&mut h, "Plate");
+    let alt = Modifiers { alt: true, ..Modifiers::NONE };
+    let stopwatch = |h: &Harness<'_, EffectcraftApp>, prop: u64| center(h, &format!("timeline.prop.{prop}.stopwatch"));
+    let at = stopwatch(&h, opacity);
+    click_with(&mut h, at, alt);
+    assert!(expression(&h, layer, opacity).is_some(), "an expression was added");
+    type_text(&mut h, "50");
+    commit_expression(&mut h);
+    assert_eq!(expression(&h, layer, opacity).as_deref(), Some("50"), "typing replaced the new expression");
+    // A field clicked right after an Alt-click keeps the keyboard.
+    let at = stopwatch(&h, rotation);
+    click_with(&mut h, at, alt);
+    let added = expression(&h, layer, rotation).expect("an expression on Rotation");
+    let p = center(&h, "timeline.timecode");
+    click(&mut h, p, 2);
+    type_text(&mut h, "0:00:01:00");
+    key(&mut h, Key::Enter);
+    let frame = h.state().session.active_comp().unwrap().frame_rate.frame_at(h.state().session.time());
+    assert_eq!((frame, expression(&h, layer, rotation)), (24, Some(added)), "the time took the typing, not the expression");
+    // Alt-click again removes the expression; nothing takes the keyboard after it.
+    let at = stopwatch(&h, opacity);
+    click_with(&mut h, at, alt);
+    h.run_steps(5);
+    assert_eq!(expression(&h, layer, opacity), None);
+    assert!(!h.ctx.egui_wants_keyboard_input(), "nothing has the keyboard");
+}
+
+/// #1072: an expression added at the bottom of the Timeline brings its editor into view to take
+/// the keyboard (its row is added below the last one shown).
+#[test]
+fn an_expression_added_at_the_bottom_of_the_timeline_comes_into_view() {
+    let (mut h, _) = harness();
+    let (layer, opacity, _) = open_transform(&mut h, "Bottom");
+    for i in 0..40 {
+        h.state_mut().session.execute("layer.newSolid", json!({"name": format!("Layer {i}"), "color": "#406080"})).unwrap();
+    }
+    h.run_steps(3);
+    // Scroll to the end (the layer is at the bottom of the stack), then until Opacity is the
+    // last row shown.
+    h.state_mut().ui.timeline.scroll_y = 1.0e6;
+    h.run_steps(3);
+    let rows = h.state().auto.find("timeline.scroll").unwrap().rect;
+    let bottom = rows[1] + rows[3];
+    let row = h.state().auto.find(&format!("timeline.prop.{opacity}.row")).unwrap().rect;
+    h.state_mut().ui.timeline.scroll_y += row[1] + row[3] - bottom;
+    h.run_steps(3);
+    let row = h.state().auto.find(&format!("timeline.prop.{opacity}.row")).unwrap().rect;
+    assert!((row[1] + row[3] - bottom).abs() < 1.0, "Opacity is at the bottom: {row:?}");
+    let at = center(&h, &format!("timeline.prop.{opacity}.stopwatch"));
+    click_with(&mut h, at, Modifiers { alt: true, ..Modifiers::NONE });
+    let editor = h.state().auto.find(&format!("timeline.prop.{opacity}.expression")).expect("the editor is drawn").rect;
+    assert!(editor[1] >= rows[1] - 0.5 && editor[1] + editor[3] <= bottom + 0.5, "the editor is in view: {editor:?} in {rows:?}");
+    type_text(&mut h, "25");
+    commit_expression(&mut h);
+    assert_eq!(expression(&h, layer, opacity).as_deref(), Some("25"));
+}
+
+/// A primary-button drag from `from` to `to` with `modifiers` held from the press to the release.
+fn drag_with(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, modifiers: Modifiers) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.input_mut().events.push(Event::ModifiersChanged(modifiers));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers });
+    h.step();
+    for k in 1..=8 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (k as f32 / 8.0)));
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers });
+    h.step();
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(3);
+}
+
+/// #1072: with Alt held as it drops, a pick whip refers to an effect's property by its index,
+/// `effect("Slider Control")(1)`, as in After Effects; without Alt, by its name. Onto Effect
+/// Controls or the Timeline, and into the expression being edited (with a dimension).
+#[test]
+fn an_alt_pick_whip_refers_to_an_effect_property_by_index() {
+    let (mut h, _) = harness();
+    let (layer, opacity, transform, effects) = {
+        let s = &mut h.state_mut().session;
+        let l = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("layer.select", json!({"layers": [l]})).unwrap();
+        for fx in ["Slider Control", "Point Control"] {
+            s.execute("effect.apply", json!({"layers": [l], "effect": fx})).unwrap();
+        }
+        let props = s.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(l)).unwrap().props.clone();
+        let effects: Vec<u64> = std::iter::once(props.sub("effects").unwrap().uid).chain(props.sub("effects").unwrap().groups().map(|g| g.uid)).collect();
+        (l, props.sub("transform").unwrap().get("opacity").unwrap().uid, props.sub("transform").unwrap().uid, effects)
+    };
+    h.state_mut().ui.timeline.open_layers.insert(layer);
+    h.state_mut().ui.timeline.open_groups.insert(transform);
+    h.state_mut().ui.timeline.open_groups.extend(effects);
+    h.state_mut().show_panel(effectcraft_ui_egui::dock::PanelKind::EffectControls);
+    h.run_steps(3);
+    let props =
+        |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(layer)).unwrap().props.clone();
+    let (slider, point) = (props(&h).prop("effects/#1/slider").unwrap().uid, props(&h).prop("effects/#2/point").unwrap().uid);
+    let expr = |h: &Harness<'_, EffectcraftApp>| props(h).find(opacity).unwrap().expr.clone().map(|e| e.text);
+    let alt = Modifiers { alt: true, ..Modifiers::NONE };
+    let whip = |h: &mut Harness<'_, EffectcraftApp>, target: &str, modifiers: Modifiers| {
+        let (from, to) = (center(h, &format!("timeline.prop.{opacity}.propertyPickWhip")), center(h, target));
+        drag_with(h, from, to, modifiers);
+    };
+    whip(&mut h, &format!("effectControls.prop.{slider}.value"), alt);
+    assert_eq!(expr(&h).as_deref(), Some("effect(\"Slider Control\")(1)"), "Alt onto Effect Controls");
+    let undo = h.state().session.history.undo.len();
+    whip(&mut h, &format!("effectControls.prop.{slider}.value"), Modifiers::NONE);
+    assert_eq!(expr(&h).as_deref(), Some("effect(\"Slider Control\")(\"Slider\")"), "without Alt, by name");
+    assert_eq!(h.state().session.history.undo.len(), undo + 1, "one undo step");
+    whip(&mut h, &format!("timeline.prop.{slider}.name"), alt);
+    assert_eq!(expr(&h).as_deref(), Some("effect(\"Slider Control\")(1)"), "Alt onto the Timeline");
+    // Into the expression being edited, at the cursor, with the value it was dropped on.
+    let p = center(&h, &format!("timeline.prop.{opacity}.expression"));
+    click(&mut h, p, 1);
+    key(&mut h, Key::End);
+    type_text(&mut h, " + ");
+    let (from, to) = (center(&h, &format!("timeline.prop.{opacity}.pickWhip")), center(&h, &format!("effectControls.prop.{point}.value.1")));
+    drag_with(&mut h, from, to, alt);
+    assert_eq!(expr(&h).as_deref(), Some("effect(\"Slider Control\")(1) + effect(\"Point Control\")(1)[1]"));
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(expr(&h).as_deref(), Some("effect(\"Slider Control\")(1)"), "undone in one step");
+}
+
 /// #1434: with several 3D layers selected, typing a Z Position sets Z on each of them; their X
 /// and Y stay their own. Every selected layer used to take the typed layer's whole Position, so
 /// they stacked on top of it and seemed to disappear.
diff --git a/crates/ui-egui/tests/ui_keyframes.rs b/crates/ui-egui/tests/it/ui_keyframes.rs
similarity index 91%
rename from crates/ui-egui/tests/ui_keyframes.rs
rename to crates/ui-egui/tests/it/ui_keyframes.rs
index b47963d85..d8cce232d 100644
--- a/crates/ui-egui/tests/ui_keyframes.rs
+++ b/crates/ui-egui/tests/it/ui_keyframes.rs
@@ -42,6 +42,47 @@ fn keys(h: &Harness<'_, EffectcraftApp>, uid: u64) -> Vec<Pos2> {
     ks
 }
 
+/// #2854: a middle-drag on a key, a layer bar, its trim edge or the marker bin edits nothing and
+/// adds no undo step; it only pans.
+#[test]
+fn middle_drag_on_a_key_or_layer_bar_changes_nothing() {
+    let (mut h, id, uid) = harness();
+    let center = |h: &Harness<'_, EffectcraftApp>, name: String| {
+        let e = h.state().auto.find(&name).unwrap_or_else(|| panic!("no {name}")).clone();
+        pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+    };
+    let bar = center(&h, format!("timeline.layer.{}.bar", id.0));
+    let trim = center(&h, format!("timeline.layer.{}.bar.in", id.0));
+    let bin = center(&h, "timeline.markerBin".to_string());
+    let key = keys(&h, uid)[1];
+    let state = |h: &Harness<'_, EffectcraftApp>| {
+        let comp = h.state().session.active_comp().unwrap();
+        let l = comp.layer(id).unwrap();
+        (l.in_point, l.out_point, l.start_time, comp.markers.len(), key_times(h, id), h.state().session.history.undo.len())
+    };
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.run_steps(2);
+    let before = state(&h);
+    for from in [key, bar, trim, bin] {
+        let to = from + egui::vec2(90.0, 0.0);
+        h.input_mut().events.push(Event::PointerMoved(from));
+        h.step();
+        h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Middle, pressed: true, modifiers: Default::default() });
+        h.step();
+        for i in 1..=8 {
+            h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
+            h.step();
+        }
+        h.input_mut().events.push(Event::PointerButton { pos: to, button: egui::PointerButton::Middle, pressed: false, modifiers: Default::default() });
+        h.run_steps(2);
+        assert_eq!(state(&h), before, "from {from:?}");
+        assert!(h.state().session.state.selected_layers.is_empty(), "from {from:?}: the press selects nothing");
+    }
+    // The left button still drags the key.
+    drag(&mut h, key, key + egui::vec2(90.0, 0.0), egui::Modifiers::NONE);
+    assert_ne!(key_times(&h, id), before.4);
+}
+
 /// Press at `from`, move to `to` in small steps (a real drag), release.
 fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, modifiers: egui::Modifiers) {
     h.input_mut().events.push(Event::PointerMoved(from));
@@ -105,11 +146,15 @@ fn ctrl_c_and_ctrl_v_copy_and_paste_keys_at_the_current_time() {
             _ => None,
         })
         .collect();
-    assert_eq!(copied, ["EffectCraft: 1 keyframe"], "the system clipboard is filled, so Ctrl+V sends a paste event");
+    // The system clipboard has the key as After Effects keyframe text (for other applications),
+    // so it isn't empty and Ctrl+V sends a paste event.
+    let [text] = copied.as_slice() else { panic!("one copy: {copied:?}") };
+    assert!(text.starts_with("Adobe After Effects 9.0 Keyframe Data\n"), "{text}");
+    assert!(text.contains("Transform\tOpacity\n\tFrame\tpercent\t\n\t30\t100\t\n"), "{text}");
     assert!(h.state().session.state.clip_is_keys);
     // Move to 3 s, Ctrl+V: the key lands there.
     h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(3.0));
-    h.input_mut().events.push(Event::Paste("EffectCraft: 1 keyframe".into()));
+    h.input_mut().events.push(Event::Paste(text.clone()));
     h.run_steps(2);
     assert_eq!(key_times(&h, id), vec![0.0, 1.0, 3.0]);
 }
@@ -190,8 +235,18 @@ fn copy_and_paste_key_subsets_across_position_rotation_and_scale() {
             assert_eq!(h.state().session.state.selected_props.len(), 3);
             h.input_mut().events.push(Event::Copy);
             h.step();
-            let note = format!("EffectCraft: {count} keyframes");
-            assert!(h.output().platform_output.commands.iter().any(|command| matches!(command, egui::OutputCommand::CopyText(text) if text == &note)));
+            let note = h
+                .output()
+                .platform_output
+                .commands
+                .iter()
+                .find_map(|command| match command {
+                    egui::OutputCommand::CopyText(text) => Some(text.clone()),
+                    _ => None,
+                })
+                .unwrap();
+            let rows = note.lines().filter(|line| line.strip_prefix('\t').is_some_and(|row| row.starts_with(|c: char| c.is_ascii_digit()))).count();
+            assert_eq!(rows, count, "one row per copied key: {note}");
             h.state_mut().session.set_time(effectcraft_engine::time::Tick::from_seconds_f64(2.0));
             let undo_steps = h.state().session.history.undo.len();
             h.input_mut().events.push(Event::Paste(note));
diff --git a/crates/ui-egui/tests/ui_large_project.rs b/crates/ui-egui/tests/it/ui_large_project.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_large_project.rs
rename to crates/ui-egui/tests/it/ui_large_project.rs
index e6ffd26e7..4e2476269 100644
--- a/crates/ui-egui/tests/ui_large_project.rs
+++ b/crates/ui-egui/tests/it/ui_large_project.rs
@@ -65,7 +65,7 @@ fn comp_thumbnail_renders_off_the_ui_thread() {
     for _ in 0..400 {
         h.step();
         if h.state().auto.find("project.thumbnail").is_some()
-            && h.ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(egui::Id::new(("proj-thumb", main.0)))).is_some()
+            && h.ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(egui::Id::unique(("proj-thumb", main.0)))).is_some()
         {
             landed = true;
             break;
diff --git a/crates/ui-egui/tests/ui_layer_panel_zoom.rs b/crates/ui-egui/tests/it/ui_layer_panel_zoom.rs
similarity index 82%
rename from crates/ui-egui/tests/ui_layer_panel_zoom.rs
rename to crates/ui-egui/tests/it/ui_layer_panel_zoom.rs
index 5fa2b1d98..73ed95cbd 100644
--- a/crates/ui-egui/tests/ui_layer_panel_zoom.rs
+++ b/crates/ui-egui/tests/it/ui_layer_panel_zoom.rs
@@ -107,10 +107,11 @@ fn wheel_zooms_around_the_pointer_and_hand_tool_pans() {
     let at = canvas.min + canvas.size() * 0.25;
     h.input_mut().events.push(Event::PointerMoved(at));
     h.input_mut().events.push(Event::MouseWheel {
-        unit: egui::MouseWheelUnit::Point,
-        delta: vec2(0.0, 120.0),
+        unit: egui::MouseWheelUnit::Line,
+        delta: vec2(0.0, 3.0),
         modifiers: Default::default(),
         phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
     });
     h.run_steps(20);
     let after = rect(&h, "layerPanel.canvas");
@@ -175,3 +176,33 @@ fn roto_brush_in_the_composition_panel_says_where_it_works() {
     assert_eq!(h.state().ui.layer_panel, Some(box_id(&h)));
     assert_eq!(h.state().ui.focused, PanelKind::Layer);
 }
+
+/// A two-finger trackpad scroll pans the layer with any tool and a pinch zooms around the pointer.
+#[test]
+fn trackpad_scroll_pans_and_pinch_zooms_around_the_pointer() {
+    let mut h = harness();
+    let canvas = rect(&h, "layerPanel.canvas");
+    let at = canvas.min + canvas.size() * 0.25;
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(60.0, -30.0),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(30);
+    let panned = rect(&h, "layerPanel.canvas");
+    let moved = panned.min - canvas.min;
+    assert!((moved.x - 60.0).abs() < 1.5 && (moved.y + 30.0).abs() < 1.5, "the scroll pans: {moved:?}");
+    assert!((panned.width() - canvas.width()).abs() < 0.5, "a scroll doesn't zoom: {} → {}", canvas.width(), panned.width());
+    // Pinch: zooms, keeping the point under the pointer.
+    let at = panned.min + panned.size() * 0.25;
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.input_mut().events.push(Event::Zoom(1.5));
+    h.run_steps(3);
+    let zoomed = rect(&h, "layerPanel.canvas");
+    assert!((zoomed.width() / panned.width() - 1.5).abs() < 0.01, "the pinch zooms: {} → {}", panned.width(), zoomed.width());
+    let still = zoomed.min + zoomed.size() * 0.25;
+    assert!(still.distance(at) < 2.0, "the point under the pointer stays put: {at:?} vs {still:?}");
+}
diff --git a/crates/ui-egui/tests/it/ui_layer_source_picker.rs b/crates/ui-egui/tests/it/ui_layer_source_picker.rs
new file mode 100644
index 000000000..2daa450c4
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_layer_source_picker.rs
@@ -0,0 +1,240 @@
+//! Picking a layer-valued property with the shared drop-down: the Timeline draws a layer-valued
+//! Light Options property (an Environment light's Source) as a drop-down of the comp's layers,
+//! Effect Controls' layer parameters (a Displacement Map's layer) pick through the same widget,
+//! and both write an undoable `prop.set`.
+
+use crate::gpu_test::RenderSerial;
+use effectcraft_engine::Session;
+use effectcraft_engine::keyframe::Value;
+use effectcraft_engine::project::LayerId;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::{Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::NodeT;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, at: Pos2) {
+    h.event(egui::Event::PointerMoved(at));
+    h.step();
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.step();
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(3);
+}
+
+fn rect_of(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no automation element {id}")).clone();
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+/// Whether `want` is painted inside `row` (the drop-down's current-value text).
+fn painted_in(h: &Harness<'_, EffectcraftApp>, row: Rect, want: &str) -> bool {
+    h.output().shapes.iter().any(|c| match &c.shape {
+        egui::Shape::Text(t) => t.galley.text() == want && row.expand(3.0).contains(t.pos),
+        _ => false,
+    })
+}
+
+/// The current value of a layer-valued property, by uid.
+fn layer_value(h: &Harness<'_, EffectcraftApp>, layer: u64, prop: u64) -> Option<u64> {
+    let comp = h.state().session.active_comp().unwrap();
+    match &comp.layer(LayerId(layer)).unwrap().props.find(prop).unwrap().value {
+        Value::Layer(v) => *v,
+        other => panic!("property {prop} is not layer-valued: {other:?}"),
+    }
+}
+
+/// The "N. name" a drop-down shows for a layer.
+fn entry_for(h: &Harness<'_, EffectcraftApp>, layer: u64) -> String {
+    let comp = h.state().session.active_comp().unwrap();
+    let i = comp.layers.iter().position(|l| l.id.0 == layer).unwrap();
+    format!("{}. {}", i + 1, comp.layers[i].name)
+}
+
+/// Puts the layer-valued `prop` of `layer` back to `value` with a direct `prop.set`, picks `none`
+/// from the drop-down at `value_id`, and checks the clear takes one undo step that restores `value`.
+#[track_caller]
+fn none_pick_clears(h: &mut Harness<'_, EffectcraftApp>, value_id: &str, none: &str, layer: u64, prop: u64, value: u64) {
+    h.state_mut().session.execute("prop.set", json!({"layer": layer, "prop": prop, "value": value})).unwrap();
+    h.run_steps(2);
+    assert_eq!(layer_value(h, layer, prop), Some(value));
+    let steps = h.state().session.history.undo.len();
+    let at = rect_of(h, value_id).center();
+    click(h, at);
+    h.get_by_role_and_label(egui::accesskit::Role::Button, none).click();
+    h.run_steps(3);
+    assert_eq!(layer_value(h, layer, prop), None, "selecting None clears the value");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1, "one clear undo step");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert_eq!(layer_value(h, layer, prop), Some(value), "undo restores the selected layer");
+}
+
+/// #2152: two picks in a row from the drop-down at `value_id` (`first`, the layer `value`, then
+/// `none`) are two undo steps: one Undo goes back to the first pick, not past it.
+#[track_caller]
+fn picks_are_separate_steps(h: &mut Harness<'_, EffectcraftApp>, value_id: &str, first: &str, none: &str, layer: u64, prop: u64, value: u64) {
+    let steps = h.state().session.history.undo.len();
+    for entry in [first, none] {
+        let at = rect_of(h, value_id).center();
+        click(h, at);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, entry).click();
+        h.run_steps(3);
+    }
+    assert_eq!(layer_value(h, layer, prop), None);
+    assert_eq!(h.state().session.history.undo.len(), steps + 2, "each pick is its own undo step");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert_eq!(layer_value(h, layer, prop), Some(value), "one undo goes back to the first pick");
+}
+
+/// A light's Source (a layer-valued Light Options property) picks a comp layer from the
+/// Timeline and undo restores None.
+#[test]
+fn timeline_source_drop_down_picks_the_layer_and_undo_restores_none() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 640, "height": 360, "frameRate": 30, "duration": 4})).unwrap();
+    s.execute("comp.settings", json!({"renderer": "advanced3D"})).unwrap();
+    let sky = s.execute("layer.newSolid", json!({"name": "Sky HDRI", "color": "#66aaff"})).unwrap()["layer"].as_u64().unwrap();
+    let light = s.execute("layer.newLight", json!({"kind": "Environment", "name": "Env Light"})).unwrap()["layer"].as_u64().unwrap();
+    let (group, source) = {
+        let comp = s.active_comp().unwrap();
+        let opts = comp.layer(LayerId(light)).unwrap().props.sub("lightOptions").unwrap();
+        (opts.uid, opts.get("source").unwrap().uid)
+    };
+    let mut app = EffectcraftApp::new(s);
+    app.ui.timeline.open_layers.insert(light);
+    app.ui.timeline.open_groups.insert(group);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| app);
+    h.run_steps(4);
+
+    let value_id = format!("timeline.prop.{source}.value");
+    // Unset: the row is a drop-down reading "None" — an element to click, not bare text.
+    assert_eq!(layer_value(&h, light, source), None);
+    assert!(painted_in(&h, rect_of(&h, &value_id), "None"), "the Source row shows a None drop-down");
+
+    // Opening it lists "None" and every layer of the comp, by index and name.
+    let at = rect_of(&h, &value_id).center();
+    click(&mut h, at);
+    let entry = entry_for(&h, sky);
+    assert!(h.query_by_role_and_label(egui::accesskit::Role::Button, "None").is_some(), "the list starts with None");
+    assert!(h.query_by_role_and_label(egui::accesskit::Role::Button, &entry).is_some(), "the comp's layers are listed ({entry})");
+
+    let steps = h.state().session.history.undo.len();
+    h.get_by_role_and_label(egui::accesskit::Role::Button, &entry).click();
+    h.run_steps(3);
+    assert_eq!(layer_value(&h, light, source), Some(sky), "the Source holds the layer id");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1, "one undo step");
+    // The row names the layer (index and name), not its internal id.
+    assert!(painted_in(&h, rect_of(&h, &value_id), &entry), "the Source row shows the layer's name");
+
+    // Dismissing the list without choosing writes nothing; reopening marks the chosen layer as
+    // the current entry (and "None" as not current).
+    click(&mut h, pos2(1500.0, 300.0));
+    h.run_steps(2);
+    assert_eq!(layer_value(&h, light, source), Some(sky), "dismissing the list writes nothing");
+    let reopen = rect_of(&h, &value_id).center();
+    click(&mut h, reopen);
+    assert_eq!(
+        h.get_by_role_and_label(egui::accesskit::Role::Button, &entry).accesskit_node().toggled(),
+        Some(egui::accesskit::Toggled::True),
+        "the current entry is highlighted"
+    );
+    assert_eq!(
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "None").accesskit_node().toggled(),
+        Some(egui::accesskit::Toggled::False),
+        "None is not the current entry"
+    );
+    click(&mut h, pos2(1500.0, 300.0));
+    h.run_steps(2);
+
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert_eq!(layer_value(&h, light, source), None, "undo restores None");
+
+    none_pick_clears(&mut h, &value_id, "None", light, source, sky);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    picks_are_separate_steps(&mut h, &value_id, &entry, "None", light, source, sky);
+}
+
+/// The shared widget is the one Effect Controls already used: a Displacement Map's layer
+/// parameter still picks from the drop-down and still undoes.
+#[test]
+fn effect_controls_layer_param_picks_through_the_shared_widget() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 640, "height": 360, "frameRate": 30, "duration": 4})).unwrap();
+    let map = s.execute("layer.newSolid", json!({"name": "Disp", "color": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let base = s.execute("layer.newSolid", json!({"name": "Base", "color": "#20c040"})).unwrap()["layer"].as_u64().unwrap();
+    let fx = s.execute("effect.apply", json!({"layers": [base], "effect": "Displacement Map"})).unwrap()["effects"][0].as_u64().unwrap();
+    let prop = {
+        let comp = s.active_comp().unwrap();
+        comp.layer(LayerId(base)).unwrap().effects().unwrap().find_group(fx).unwrap().get("displacementMapLayer").unwrap().uid
+    };
+    s.state.selected_layers = vec![LayerId(base)];
+    let mut app = EffectcraftApp::new(s);
+    app.show_panel(PanelKind::EffectControls);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1100.0)).build_eframe(|_| app);
+    h.run_steps(4);
+
+    let value_id = format!("effectControls.prop.{prop}.value");
+    let row = rect_of(&h, &value_id);
+    click(&mut h, row.center());
+    let entry = entry_for(&h, map);
+    assert!(h.query_by_role_and_label(egui::accesskit::Role::Button, &entry).is_some(), "the comp's layers are listed ({entry})");
+    let steps = h.state().session.history.undo.len();
+    h.get_by_role_and_label(egui::accesskit::Role::Button, &entry).click();
+    h.run_steps(3);
+    assert_eq!(layer_value(&h, base, prop), Some(map), "the parameter holds the layer id");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1, "one undo step");
+    // The row names the picked layer, as the Timeline's Source row does.
+    assert!(painted_in(&h, rect_of(&h, &value_id), &entry), "the parameter row shows the layer's name");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert_eq!(layer_value(&h, base, prop), None, "undo restores None");
+
+    none_pick_clears(&mut h, &value_id, "None", base, prop, map);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    picks_are_separate_steps(&mut h, &value_id, &entry, "None", base, prop, map);
+}
+
+/// The visual record (the `ui_3d` ignored-snapshot convention): the Source drop-down open over
+/// the layer list, and the row after a layer is chosen. Renders with wgpu when `EC_SNAPSHOT_DIR`
+/// is set: `EC_SNAPSHOT_DIR=shots cargo test -p effectcraft-ui-egui --test it ui_layer_source_picker:: -- --ignored`.
+#[test]
+#[ignore = "renders with wgpu; run with --ignored (set EC_SNAPSHOT_DIR to keep PNGs)"]
+fn snapshot_source_dropdown_open_and_chosen() {
+    let _device = crate::gpu_test::lock();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 1280, "height": 720, "frameRate": 30, "duration": 5})).unwrap();
+    s.execute("comp.settings", json!({"renderer": "advanced3D"})).unwrap();
+    let sky = s.execute("layer.newSolid", json!({"name": "Sky HDRI", "color": "#66aaff"})).unwrap()["layer"].as_u64().unwrap();
+    let light = s.execute("layer.newLight", json!({"kind": "Environment", "name": "Env Light"})).unwrap()["layer"].as_u64().unwrap();
+    let (group, source) = {
+        let comp = s.active_comp().unwrap();
+        let opts = comp.layer(LayerId(light)).unwrap().props.sub("lightOptions").unwrap();
+        (opts.uid, opts.get("source").unwrap().uid)
+    };
+    let mut app = EffectcraftApp::new(s);
+    app.ui.timeline.open_layers.insert(light);
+    app.ui.timeline.open_groups.insert(group);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).with_pixels_per_point(2.0).wgpu().build_eframe(|_| app);
+    h.run_steps(4);
+    let save = |h: &mut Harness<'_, EffectcraftApp>, name: &str| {
+        if let Ok(dir) = std::env::var("EC_SNAPSHOT_DIR") {
+            h.render_serialized().expect("render").save(format!("{dir}/{name}")).expect("save");
+        }
+    };
+    save(&mut h, "source_unset.png");
+    let at = rect_of(&h, &format!("timeline.prop.{source}.value")).center();
+    click(&mut h, at);
+    save(&mut h, "source_dropdown_open.png");
+    let entry = entry_for(&h, sky);
+    h.get_by_role_and_label(egui::accesskit::Role::Button, &entry).click();
+    h.run_steps(3);
+    assert_eq!(layer_value(&h, light, source), Some(sky));
+    save(&mut h, "source_chosen.png");
+}
diff --git a/crates/ui-egui/tests/it/ui_light_settings.rs b/crates/ui-egui/tests/it/ui_light_settings.rs
new file mode 100644
index 000000000..aac090802
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_light_settings.rs
@@ -0,0 +1,221 @@
+//! Light Settings dialog (Layer ▸ New ▸ Light, Layer Settings on a light): every light type the
+//! engine has, Environment included, and an existing light's type kept when it's reopened (#1588).
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{Layer, LayerId, LayerSource, LightKind};
+use effectcraft_ui_egui::{Dialog, EffectcraftApp};
+use egui_kittest::{Harness, kittest::Queryable as _};
+use serde_json::{Value, json};
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Lights", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.step();
+    h
+}
+
+/// An automation element's rect in the last frame drawn (a dialog settles its place in its
+/// first frames, so the frame before can be stale).
+fn element(h: &Harness<'_, EffectcraftApp>, id: &str) -> Option<effectcraft_ui_egui::automation::Element> {
+    let auto = &h.state().auto;
+    auto.elements.iter().chain(auto.previous.iter()).find(|e| e.id == id).cloned()
+}
+
+fn click_id(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let [x, y, w, hh] = element(h, id).unwrap_or_else(|| panic!("{id} is registered")).rect;
+    let p = egui::pos2(x + w / 2.0, y + hh / 2.0);
+    h.input_mut().events.push(egui::Event::PointerMoved(p));
+    h.step();
+    h.input_mut().events.push(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.step();
+    h.input_mut().events.push(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn invoke(h: &mut Harness<'_, EffectcraftApp>, id: &str, params: Value) {
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, id, params).unwrap();
+    h.run_steps(2);
+}
+
+/// Picks the dialog's Light Type `kind` from its menu.
+fn choose(h: &mut Harness<'_, EffectcraftApp>, kind: LightKind) {
+    click_id(h, "dialog.light.type");
+    let i = LightKind::ALL.iter().position(|k| *k == kind).unwrap();
+    click_id(h, &format!("dialog.light.typeItem.{i}"));
+}
+
+fn ok(h: &mut Harness<'_, EffectcraftApp>) {
+    click_id(h, "dialog.light.ok");
+    assert_eq!(h.state().dialog, None);
+}
+
+fn layer(h: &Harness<'_, EffectcraftApp>, id: u64) -> Layer {
+    h.state().session.active_comp().unwrap().layer(LayerId(id)).unwrap().clone()
+}
+
+fn kind(h: &Harness<'_, EffectcraftApp>, id: u64) -> LightKind {
+    match layer(h, id).source {
+        LayerSource::Light { kind } => kind,
+        other => panic!("not a light: {other:?}"),
+    }
+}
+
+fn last_layer(h: &Harness<'_, EffectcraftApp>) -> u64 {
+    h.state().session.active_comp().unwrap().layers.iter().map(|l| l.id.0).max().unwrap()
+}
+
+/// Opens Light Settings for an existing light, as Layer Settings does.
+fn reopen(h: &mut Harness<'_, EffectcraftApp>, id: u64) {
+    invoke(h, "layer.settings", json!({"layer": id}));
+    assert_eq!(h.state().dialog, Some(Dialog::LightSettings));
+}
+
+/// An Environment light lit from a solid, its image turned 30°.
+fn environment_light(h: &mut Harness<'_, EffectcraftApp>) -> (u64, u64) {
+    let s = &mut h.state_mut().session;
+    let sky = s.execute("layer.newSolid", json!({"width": 256, "height": 128, "name": "Sky"})).unwrap()["layer"].as_u64().unwrap();
+    let env = s.execute("layer.newLight", json!({"kind": "Environment", "name": "Env", "intensity": 80})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": env, "path": "lightOptions/source", "value": sky})).unwrap();
+    s.execute("prop.set", json!({"layer": env, "path": "lightOptions/rotation", "value": 30})).unwrap();
+    h.run_steps(2);
+    (env, sky)
+}
+
+#[test]
+fn the_light_type_menu_lists_every_light_type() {
+    let mut h = harness();
+    invoke(&mut h, "layer.newLight", json!({}));
+    click_id(&mut h, "dialog.light.type");
+    for (i, k) in LightKind::ALL.iter().enumerate() {
+        let item = element(&h, &format!("dialog.light.typeItem.{i}")).map(|e| e.label);
+        assert_eq!(item.as_deref(), Some(k.label()));
+    }
+}
+
+#[test]
+fn new_light_creates_an_environment_light() {
+    let mut h = harness();
+    invoke(&mut h, "layer.newLight", json!({}));
+    choose(&mut h, LightKind::Environment);
+    ok(&mut h);
+    let id = last_layer(&h);
+    assert_eq!(kind(&h, id), LightKind::Environment);
+    let l = layer(&h, id);
+    assert!(l.props.prop("lightOptions/source").is_some() && l.props.prop("lightOptions/falloff").is_none());
+    // One undoable step, redone as Environment.
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert!(h.state().session.active_comp().unwrap().layer(LayerId(id)).is_none());
+    h.state_mut().session.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(kind(&h, id), LightKind::Environment);
+}
+
+#[test]
+fn reopening_an_environment_light_and_pressing_ok_keeps_it() {
+    let mut h = harness();
+    let (env, sky) = environment_light(&mut h);
+    let before = layer(&h, env);
+    reopen(&mut h, env);
+    ok(&mut h);
+    let after = layer(&h, env);
+    assert_eq!(kind(&h, env), LightKind::Environment, "not turned into a Spot light");
+    assert_eq!(after.props.prop("lightOptions/source").unwrap().value.as_layer(), Some(sky));
+    for path in ["lightOptions/rotation", "lightOptions/intensity"] {
+        assert_eq!(after.props.prop(path).unwrap().value, before.props.prop(path).unwrap().value, "{path}");
+    }
+}
+
+#[test]
+fn cancelling_light_settings_changes_nothing() {
+    let mut h = harness();
+    let (env, _) = environment_light(&mut h);
+    let before = serde_json::to_value(layer(&h, env)).unwrap();
+    let steps = h.state().session.history.undo.len();
+    reopen(&mut h, env);
+    choose(&mut h, LightKind::Spot);
+    click_id(&mut h, "dialog.light.cancel");
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(serde_json::to_value(layer(&h, env)).unwrap(), before);
+    assert_eq!(h.state().session.history.undo.len(), steps);
+}
+
+#[test]
+fn changing_a_light_to_environment_undoes_and_redoes() {
+    let mut h = harness();
+    let id = h.state_mut().session.execute("layer.newLight", json!({"kind": "Spot", "coneAngle": 45})).unwrap()["layer"].as_u64().unwrap();
+    h.run_steps(2);
+    reopen(&mut h, id);
+    choose(&mut h, LightKind::Environment);
+    ok(&mut h);
+    assert_eq!(kind(&h, id), LightKind::Environment);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(kind(&h, id), LightKind::Spot);
+    assert_eq!(layer(&h, id).props.prop("lightOptions/coneAngle").unwrap().value.as_f64(), 45.0);
+    h.state_mut().session.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(kind(&h, id), LightKind::Environment);
+}
+
+#[test]
+fn the_other_light_types_are_created_and_kept() {
+    let mut h = harness();
+    for k in [LightKind::Parallel, LightKind::Spot, LightKind::Point, LightKind::Ambient] {
+        invoke(&mut h, "layer.newLight", json!({}));
+        choose(&mut h, k);
+        ok(&mut h);
+        let id = last_layer(&h);
+        assert_eq!(kind(&h, id), k);
+        reopen(&mut h, id);
+        ok(&mut h);
+        assert_eq!(kind(&h, id), k, "{} kept on reopening", k.label());
+    }
+}
+
+#[test]
+fn falloff_and_shadow_options_show_only_for_lights_that_have_them() {
+    let mut h = harness();
+    invoke(&mut h, "layer.newLight", json!({}));
+    for k in LightKind::ALL {
+        choose(&mut h, k);
+        // Falloff is distance attenuation: image-based Environment lights and Ambient have none.
+        let falloff = !matches!(k, LightKind::Ambient | LightKind::Environment);
+        assert_eq!(h.query_by_label("Falloff").is_some(), falloff, "Falloff for {}", k.label());
+        // Cast Shadows shows for every light but Ambient, Environment included (#2436).
+        let shadows = k != LightKind::Ambient;
+        for label in ["Casts Shadows", "Shadow Darkness"] {
+            assert_eq!(h.query_by_label(label).is_some(), shadows, "{label} for {}", k.label());
+        }
+    }
+}
+
+/// #2436: an Environment light created through the dialog keeps its Cast Shadows, which the
+/// engine stores on the layer.
+#[test]
+fn an_environment_light_takes_cast_shadows_from_the_dialog() {
+    let mut h = harness();
+    invoke(&mut h, "layer.newLight", json!({}));
+    choose(&mut h, LightKind::Environment);
+    click_id(&mut h, "dialog.light.casts");
+    ok(&mut h);
+    let id = last_layer(&h);
+    assert_eq!(kind(&h, id), LightKind::Environment);
+    let l = layer(&h, id);
+    assert!(l.props.prop("lightOptions/castsShadows").unwrap().value.as_bool(), "the dialog's checkbox reached the layer");
+    assert!(l.props.prop("lightOptions/shadowDarkness").is_some() && l.props.prop("lightOptions/falloff").is_none());
+}
+
+#[test]
+fn changing_an_environment_light_to_spot_undoes_to_its_source_and_rotation() {
+    let mut h = harness();
+    let (env, sky) = environment_light(&mut h);
+    reopen(&mut h, env);
+    choose(&mut h, LightKind::Spot);
+    ok(&mut h);
+    assert_eq!(kind(&h, env), LightKind::Spot);
+    assert!(layer(&h, env).props.prop("lightOptions/source").is_none());
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    let l = layer(&h, env);
+    assert_eq!(kind(&h, env), LightKind::Environment);
+    assert_eq!(l.props.prop("lightOptions/source").unwrap().value.as_layer(), Some(sky));
+    assert_eq!(l.props.prop("lightOptions/rotation").unwrap().value.as_f64(), 30.0);
+}
diff --git a/crates/ui-egui/tests/ui_live_preview.rs b/crates/ui-egui/tests/it/ui_live_preview.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_live_preview.rs
rename to crates/ui-egui/tests/it/ui_live_preview.rs
index e72856bfc..abe3cc427 100644
--- a/crates/ui-egui/tests/ui_live_preview.rs
+++ b/crates/ui-egui/tests/it/ui_live_preview.rs
@@ -77,12 +77,12 @@ fn position_anchor_and_effect_edits_present_intermediate_pixels() {
         (None, "transform/position", json!([22, 18, 0]), json!([18, 18, 0])),
         (None, "transform/anchor", json!([9, 8, 0]), json!([6, 8, 0])),
         (Some("Gaussian Blur"), "blurriness", json!(3), json!(6)),
-        (Some("CC Radial Fast Blur"), "center", json!([4, 4]), json!([18, 12])),
+        (Some("Fast Radial Blur"), "center", json!([4, 4]), json!([18, 12])),
     ] {
         let mut session = Session::default();
         session.execute("comp.new", json!({"width":64,"height":36,"duration":1})).unwrap();
         let layer = session.execute("layer.newSolid", json!({"color":"#ffffff","width":24,"height":16})).unwrap()["layer"].as_u64().unwrap();
-        if effect == Some("CC Radial Fast Blur") {
+        if effect == Some("Fast Radial Blur") {
             // A uniform solid is invariant under a radial blur; give the point edit visible detail.
             session.execute("effect.apply", json!({"layers":[layer],"effect":"Gradient Ramp"})).unwrap();
         }
diff --git a/crates/ui-egui/tests/ui_locked_color.rs b/crates/ui-egui/tests/it/ui_locked_color.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_locked_color.rs
rename to crates/ui-egui/tests/it/ui_locked_color.rs
index d942da111..5d7d1edd7 100644
--- a/crates/ui-egui/tests/ui_locked_color.rs
+++ b/crates/ui-egui/tests/it/ui_locked_color.rs
@@ -38,7 +38,7 @@ fn invoke(h: &mut Harness<'_, EffectcraftApp>, command: &str, params: Value) {
 }
 
 fn locked_center(h: &Harness<'_, EffectcraftApp>, images: &Images) -> [u8; 4] {
-    let (_, texture) = h.ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(egui::Id::new("viewer-locked"))).unwrap();
+    let (_, texture) = h.ctx.data(|d| d.get_temp::<(u64, egui::TextureHandle)>(egui::Id::unique("viewer-locked"))).unwrap();
     let images = images.borrow();
     let image = images.get(&texture.id()).unwrap();
     image.pixels[(image.size[1] / 2) * image.size[0] + image.size[0] / 2].to_array()
diff --git a/crates/ui-egui/tests/it/ui_marker_names.rs b/crates/ui-egui/tests/it/ui_marker_names.rs
new file mode 100644
index 000000000..190bd77bb
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_marker_names.rs
@@ -0,0 +1,120 @@
+//! A marker's name is drawn in a small outlined box beside its flag, in the theme's own field colours (egui_kittest, a real
+//! render): the fill and the outline follow Dark and Light, and the two themes differ. `MARKER_NAMES_SNAPSHOT=/abs/dir`
+//! also saves the rendered panel for each theme.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::theme::ThemeKind;
+use egui_kittest::Harness;
+use serde_json::json;
+
+fn close(got: [u8; 4], want: egui::Color32) -> bool {
+    got[..3].iter().zip(want.to_array()).all(|(a, b)| a.abs_diff(b) <= 3)
+}
+
+#[test]
+fn the_name_box_follows_the_theme() {
+    let _one_at_a_time = crate::gpu_test::lock();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Song", "width": 640, "height": 360, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bed", "color": "#204060", "width": 640, "height": 360})).unwrap();
+    s.execute("markers.set", json!({"new": true, "time": 1.0, "comment": "Verse"})).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.run_steps(4);
+    let ctx = h.ctx.clone();
+
+    let mut seen = vec![];
+    for (kind, name) in [(ThemeKind::Dark, "dark"), (ThemeKind::Light, "light")] {
+        h.state_mut().set_theme(&ctx, kind);
+        h.run_steps(4);
+        let tokens = h.state().tokens;
+        assert_eq!(tokens.kind, kind);
+        // the flag's hit area is 10 wide, centred on the marker; the box starts 6 points right of the centre
+        let hit = h.state().auto.find("timeline.marker.0").unwrap_or_else(|| panic!("the marker is on screen ({name})")).rect;
+        let (x, y0) = (hit[0] + hit[2] / 2.0, hit[1] + 1.0);
+        let h_flag = (hit[3] - 1.0).min(10.0);
+        let image = h.render().expect("the panel renders");
+        if let Some(dir) = std::env::var_os("MARKER_NAMES_SNAPSHOT") {
+            image.save(std::path::Path::new(&dir).join(format!("marker-name-{name}.png"))).unwrap();
+        }
+        let scale = image.width() as f32 / 1600.0;
+        let at = |px: f32, py: f32| image.get_pixel((px * scale) as u32, (py * scale) as u32).0;
+        let mid = y0 + h_flag / 2.0;
+        // inside the box, left of the text: the field fill; on its left edge: the field outline
+        let fill = at(x + 6.0 + 2.5, mid);
+        let edge = at(x + 6.0 + 0.5, mid);
+        assert!(close(fill, tokens.field_bg), "{name}: box fill {fill:?}, the theme's field_bg is {:?}", tokens.field_bg);
+        assert!(close(edge, tokens.field_border), "{name}: box outline {edge:?}, the theme's field_border is {:?}", tokens.field_border);
+        seen.push((fill, edge));
+    }
+    assert_ne!(seen[0], seen[1], "the box looks different in Dark and in Light, so it is not a fixed grey");
+}
+
+/// A duration shorter than the name box ends where the box would sit. The box steps past the end cap, so the duration
+/// stays visible: the cap is drawn, the bar shows left of it, and the box starts after it.
+#[test]
+fn a_short_duration_stays_visible_beside_the_name_box() {
+    let _one_at_a_time = crate::gpu_test::lock();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Song", "width": 640, "height": 360, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bed", "color": "#204060", "width": 640, "height": 360})).unwrap();
+    s.execute("markers.set", json!({"new": true, "time": 1.0, "comment": "Verse", "duration": 0.1})).unwrap();
+    // a second marker half a second later gives the timeline's scale (points per second)
+    s.execute("markers.set", json!({"new": true, "time": 1.5})).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.run_steps(5);
+    let tokens = h.state().tokens;
+    let centre = |id: &str| {
+        let r = h.state().auto.find(id).unwrap_or_else(|| panic!("{id} is on screen")).rect;
+        (r[0] + r[2] / 2.0, r[1] + 1.0, (r[3] - 1.0).min(10.0))
+    };
+    let ((xa, y0, flag_h), (xb, _, _)) = (centre("timeline.marker.0"), centre("timeline.marker.1"));
+    let per_second = (xb - xa) / 0.5;
+    let xe = xa + 0.1 * per_second;
+    assert!(xe - xa < 30.0, "the duration is shorter than the name box: {} points", xe - xa);
+    let image = h.render().expect("the panel renders");
+    if let Some(dir) = std::env::var_os("MARKER_NAMES_SNAPSHOT") {
+        image.save(std::path::Path::new(&dir).join("marker-short-duration.png")).unwrap();
+    }
+    let scale = image.width() as f32 / 1600.0;
+    let at = |px: f32, py: f32| image.get_pixel((px * scale) as u32, (py * scale) as u32).0;
+    let mid = y0 + flag_h / 2.0;
+    // the end cap: a pixel in the marker's colour (new markers are red; the theme's field fill is neutral) within a point
+    // of where the duration ends, which the box would otherwise cover
+    let cap = (-1..=1).map(|d| at(xe + d as f32, mid)).max_by_key(|p| i32::from(p[0]) - i32::from(p[1])).unwrap();
+    assert!(i32::from(cap[0]) - i32::from(cap[1]) > 40, "the end cap is drawn: {cap:?}");
+    // the bar shows left of the cap, not the box's fill
+    let bar = at(xe - 4.0, mid);
+    assert!(i32::from(bar[0]) - i32::from(bar[1]) > 20, "the bar shows left of the end cap, not the box: {bar:?}");
+    // the box starts after the cap
+    let fill = at(xe + 3.0 + 2.5, mid);
+    assert!(close(fill, tokens.field_bg), "the box begins after the end cap: {fill:?}, field_bg {:?}", tokens.field_bg);
+}
+
+#[test]
+fn a_later_name_box_does_not_hide_an_earlier_duration_cap() {
+    let _one_at_a_time = crate::gpu_test::lock();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"width": 640, "height": 360, "duration": 4})).unwrap();
+    s.execute("markers.set", json!({"new": true, "time": 1.0, "duration": 0.5, "label": "Red"})).unwrap();
+    s.execute("markers.set", json!({"new": true, "time": 1.3, "comment": "This name overlaps the earlier endpoint", "label": "Blue"})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.run_steps(5);
+    let a = h.state().auto.find("timeline.marker.0").unwrap().rect;
+    let b = h.state().auto.find("timeline.marker.1").unwrap().rect;
+    let x = |r: [f32; 4]| r[0] + r[2] / 2.0;
+    let end = x(a) + (x(b) - x(a)) * 0.5 / 0.3;
+    let y = a[1] + 1.0 + (a[3] - 1.0).min(10.0) / 2.0;
+    let image = h.render().unwrap();
+    if let Some(dir) = std::env::var_os("MARKER_NAMES_SNAPSHOT") {
+        image.save(std::path::Path::new(&dir).join("marker-overlapping-cap.png")).unwrap();
+    }
+    let scale = image.width() as f32 / 1600.0;
+    let cap = (-1..=1)
+        .map(|offset| image.get_pixel(((end + offset as f32) * scale) as u32, (y * scale) as u32).0)
+        .max_by_key(|pixel| i32::from(pixel[0]) - i32::from(pixel[1]))
+        .unwrap();
+    assert!(i32::from(cap[0]) - i32::from(cap[1]) > 40, "the earlier red duration cap stays above the later name: {cap:?}");
+}
diff --git a/crates/ui-egui/tests/ui_media_browser_cache.rs b/crates/ui-egui/tests/it/ui_media_browser_cache.rs
similarity index 97%
rename from crates/ui-egui/tests/ui_media_browser_cache.rs
rename to crates/ui-egui/tests/it/ui_media_browser_cache.rs
index feade97bf..44ca9dd81 100644
--- a/crates/ui-egui/tests/ui_media_browser_cache.rs
+++ b/crates/ui-egui/tests/it/ui_media_browser_cache.rs
@@ -1,3 +1,4 @@
+use crate::gpu_test::RenderSerial;
 use std::sync::{
     Arc, Mutex,
     atomic::{AtomicBool, Ordering},
@@ -42,7 +43,7 @@ type Listing = (f64, Arc<Result<Vec<Entry>, String>>);
 
 fn listing(h: &Harness<'_, EffectcraftApp>, only: bool) -> Listing {
     let dir = h.state().session.state.media_browser.folder.clone().unwrap_or_else(|| "/Shoot".into());
-    h.ctx.data(|d| d.get_temp(egui::Id::new(("mb-list", dir, only)))).unwrap()
+    h.ctx.data(|d| d.get_temp(egui::Id::unique(("mb-list", dir, only)))).unwrap()
 }
 
 fn names(list: &Arc<Result<Vec<Entry>, String>>) -> Vec<&str> {
@@ -140,6 +141,6 @@ fn browser_cache_refreshes_filters_navigates_and_recovers_from_errors() {
     assert_eq!(names(&listing(&h, false).1), ["Sub", "Added.csv", "Clip.csv", "From action.csv"]);
     assert!(h.state().auto.find("mediaBrowser.entry.Clip.csv").is_some());
     if let Ok(path) = std::env::var("MEDIA_BROWSER_SNAPSHOT") {
-        h.render().unwrap().save(path).unwrap();
+        h.render_serialized().unwrap().save(path).unwrap();
     }
 }
diff --git a/crates/ui-egui/tests/ui_media_browser_copy_path.rs b/crates/ui-egui/tests/it/ui_media_browser_copy_path.rs
similarity index 94%
rename from crates/ui-egui/tests/ui_media_browser_copy_path.rs
rename to crates/ui-egui/tests/it/ui_media_browser_copy_path.rs
index 8da34c5bd..8372b2be5 100644
--- a/crates/ui-egui/tests/ui_media_browser_copy_path.rs
+++ b/crates/ui-egui/tests/it/ui_media_browser_copy_path.rs
@@ -1,3 +1,4 @@
+use crate::gpu_test::RenderSerial;
 use std::sync::Arc;
 
 use effectcraft_engine::{
@@ -52,7 +53,8 @@ fn file_folder_and_virtual_paths_copy_from_the_context_menu_without_document_cha
     let mut session = Session { browser: Some(Arc::new(TestBrowser(tree))), ..Default::default() };
     session.prefs.general.language = "en".into();
     session.execute("comp.new", json!({"width": 64, "height": 36, "duration": 2})).unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| {
+    // The Chinese folder and file names need an installed CJK face.
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).allow_missing_glyphs().build_eframe(|_| {
         let mut app = EffectcraftApp::new(session);
         app.ui.start_screen = false;
         app.show_panel(PanelKind::MediaBrowser);
@@ -73,7 +75,7 @@ fn file_folder_and_virtual_paths_copy_from_the_context_menu_without_document_cha
         if name == "作品 clip.csv"
             && let Ok(file) = std::env::var("MEDIA_BROWSER_COPY_SNAPSHOT")
         {
-            h.render().unwrap().save(file).unwrap();
+            h.render_serialized().unwrap().save(file).unwrap();
         }
         assert_eq!(click(&mut h, &id, PointerButton::Primary), [path]);
         h.run_steps(3);
@@ -96,7 +98,8 @@ fn copy_path_control_command_preserves_the_path_and_rejects_bad_arguments() {
         let mut reply = None;
         let mut out = ctx.run_ui(Default::default(), |ui| {
             let (request, _rx) = ControlRequest::new("ui.menu.invoke", json!({"id": "mediaBrowser.copySourcePath", "params": params}));
-            reply = match control::handle(&mut app, ui.ctx(), &request) {
+            let now = app.now();
+            reply = match control::handle(&mut app, ui.ctx(), &request, now) {
                 control::Outcome::Done(value) => Some(value),
                 _ => panic!("expected immediate reply"),
             };
diff --git a/crates/ui-egui/tests/it/ui_menus.rs b/crates/ui-egui/tests/it/ui_menus.rs
new file mode 100644
index 000000000..512f1f376
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_menus.rs
@@ -0,0 +1,481 @@
+//! The menu bar from the keyboard, and the app's shortcuts waiting while a menu is open (#279)
+//! (egui_kittest, UI logic only).
+
+use crate::gpu_test::RenderSerial;
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Key, Modifiers, Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h
+}
+
+pub(crate) fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+pub(crate) fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+/// Press the primary button at `p` and keep it down.
+pub(crate) fn press(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+/// Move the pointer to `p` (press or no press, whichever is held).
+pub(crate) fn move_to(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.run_steps(2);
+}
+
+/// Release the primary button at `p`.
+fn release(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+/// Press and release `key` (one frame each), then let the UI settle.
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key) {
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.step();
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+/// The label of the widget with keyboard focus (the highlighted menu entry).
+fn focused(h: &Harness<'_, EffectcraftApp>) -> String {
+    h.query_by(|n| n.is_focused()).and_then(|n| n.accesskit_node().label()).unwrap_or_default().trim().to_string()
+}
+
+fn shown(h: &Harness<'_, EffectcraftApp>, label: &str) -> bool {
+    h.query_by_label_contains(label).is_some()
+}
+
+#[test]
+fn browse_presets_clears_search_and_scrolls_to_the_visible_presets_list() {
+    use effectcraft_ui_egui::dock::PanelKind;
+
+    let mut h = harness();
+    let ctx = h.ctx.clone();
+    let favorites: Vec<String> = effectcraft_engine::effects::all().iter().map(|effect| effect.id.to_string()).collect();
+    assert!(!favorites.is_empty(), "the test needs registered effects");
+    let recent: Vec<String> = favorites.iter().take(8).cloned().collect();
+
+    h.state_mut().session.prefs.effects_favorites = favorites;
+    h.state_mut().ui.effects_recent = recent;
+    h.state_mut().ui.effects_open.extend(["favorites".into(), "recent".into()]);
+    h.state_mut().ui.effects_search = "no matching animation preset".into();
+    h.state_mut().ui.effects_view.presets = true;
+
+    let managed = effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "effect.manage", json!({}));
+    assert!(managed.is_ok(), "{managed:?}");
+    assert_eq!(h.state().ui.focused, PanelKind::EffectsPresets);
+    assert_eq!(h.state().ui.effects_search, "no matching animation preset", "Manage Effects keeps its existing search behavior");
+    assert!(h.state().ui.effects_view.presets, "Manage Effects keeps the existing presets setting");
+
+    h.run_steps(3);
+    assert!(h.state().auto.find("effects.category.presets").is_none(), "the unmatched search hides Animation Presets");
+    h.state_mut().ui.effects_view.presets = false;
+
+    let result = effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "anim.browsePresets", json!({}));
+
+    assert!(result.is_ok(), "{result:?}");
+    assert_eq!(h.state().ui.focused, PanelKind::EffectsPresets);
+    assert!(h.state().ui.effects_search.is_empty());
+    assert!(h.state().ui.effects_view.presets);
+    assert!(h.state().ui.effects_open.contains("presets"));
+
+    h.run_steps(3);
+    assert!(
+        h.state().auto.find("effects.category.presets").is_some(),
+        "Animation Presets must be visible after Browse Presets, even below expanded Favorites and Recently Used"
+    );
+}
+
+/// Space (or any shortcut) while a menu is open goes to the menu, not the app: it started the
+/// preview behind the open menu.
+#[test]
+fn shortcuts_wait_while_a_menu_is_open() {
+    let mut h = harness();
+    let edit = rect(&h, "menu.Edit");
+    click_at(&mut h, edit.center());
+    assert!(shown(&h, "Keyboard Shortcuts"), "the Edit menu is open");
+    key(&mut h, Key::Space);
+    assert!(!h.state().playback.playing, "Space didn't start the preview");
+    // With the menu closed, Space previews again.
+    key(&mut h, Key::Escape);
+    assert!(!shown(&h, "Keyboard Shortcuts"), "Escape closed the menu");
+    key(&mut h, Key::Space);
+    assert!(h.state().playback.playing, "Space previews with the menus closed");
+}
+
+/// Alt focuses the menu bar; Down opens the menu, Up / Down move the highlight, Right opens a
+/// submenu and Left closes it, Right on an entry opens the next menu, Escape closes them.
+#[test]
+fn arrow_keys_drive_the_menu_bar() {
+    if cfg!(target_os = "macos") {
+        // (macOS menus are the system's.)
+        return;
+    }
+    let mut h = harness();
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::ALT));
+    h.step();
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(2);
+    assert_eq!(focused(&h), "File", "Alt focused the menu bar");
+    key(&mut h, Key::ArrowDown);
+    assert!(shown(&h, "Open Project"), "Down opened File");
+    assert!(focused(&h).starts_with("New"), "its first entry is highlighted: {:?}", focused(&h));
+    key(&mut h, Key::ArrowRight);
+    assert!(focused(&h).contains("New Project"), "Right opened the New submenu: {:?}", focused(&h));
+    key(&mut h, Key::ArrowDown);
+    assert!(focused(&h).contains("New Project from Template"), "Down moved down the submenu: {:?}", focused(&h));
+    key(&mut h, Key::ArrowLeft);
+    assert!(!shown(&h, "New Project from Template"), "Left closed the submenu");
+    assert!(focused(&h).starts_with("New"), "and went back to its entry: {:?}", focused(&h));
+    key(&mut h, Key::ArrowDown);
+    assert!(focused(&h).contains("Open Project"), "{:?}", focused(&h));
+    key(&mut h, Key::ArrowRight);
+    assert!(!shown(&h, "Open Project"), "Right on an entry left File");
+    assert!(shown(&h, "Keyboard Shortcuts"), "for Edit");
+    key(&mut h, Key::ArrowLeft);
+    assert!(shown(&h, "Open Project"), "Left went back to File");
+    key(&mut h, Key::Escape);
+    assert!(!shown(&h, "Open Project"), "Escape closed the menus");
+    assert!(!h.state().playback.playing, "no key reached the app");
+}
+
+/// Up in a menu opened with the pointer highlights its last entry (wrapping around); Enter on a
+/// submenu entry opens it with its first entry highlighted, and Enter chooses an entry.
+#[test]
+fn enter_chooses_the_highlighted_entry() {
+    let mut h = harness();
+    let edit = rect(&h, "menu.Edit");
+    click_at(&mut h, edit.center());
+    key(&mut h, Key::ArrowUp);
+    if cfg!(target_os = "macos") {
+        assert!(focused(&h).starts_with("Keyboard Shortcuts"), "Up went to the last entry: {:?}", focused(&h));
+        key(&mut h, Key::Enter);
+        assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Shortcuts), "Enter chose it");
+    } else {
+        assert!(focused(&h).starts_with("Preferences"), "Up went to the last entry: {:?}", focused(&h));
+        key(&mut h, Key::Enter);
+        assert!(focused(&h).starts_with("General"), "Enter opened the submenu: {:?}", focused(&h));
+        key(&mut h, Key::Enter);
+        assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Settings), "Enter chose General...");
+    }
+    assert!(!shown(&h, "Quick Apply"), "and closed the menu");
+}
+
+#[test]
+fn relink_menu_uses_engine_availability_and_folder_picker_cancel_is_a_noop() {
+    use std::cell::Cell;
+    use std::rc::Rc;
+
+    let mut app = EffectcraftApp::new(Session::default());
+    let menu = effectcraft_ui_egui::menus::menu_items(&app);
+    let entry = menu.iter().find(|e| e.id == "file.relinkFootage").unwrap();
+    assert_eq!(entry.path, ["File", "Dependencies"]);
+    assert_eq!(entry.enabled, app.session.is_enabled("file.relinkFootage"));
+    assert_eq!(entry.enabled, !cfg!(target_arch = "wasm32"));
+    let picked = Rc::new(Cell::new(false));
+    let flag = picked.clone();
+    app.hooks.pick_folder = Some(Box::new(move || {
+        flag.set(true);
+        None
+    }));
+    let revision = app.session.revision;
+    let result = effectcraft_ui_egui::menus::invoke(&mut app, &egui::Context::default(), "file.relinkFootage", json!({})).unwrap();
+    assert!(picked.get());
+    assert!(result.is_null());
+    assert_eq!(app.session.revision, revision);
+    assert!(app.session.history.undo.is_empty());
+}
+
+#[test]
+fn relink_is_reachable_through_the_dependencies_menu() {
+    use std::cell::Cell;
+    use std::rc::Rc;
+
+    let mut h = harness();
+    let picked = Rc::new(Cell::new(false));
+    let flag = picked.clone();
+    h.state_mut().hooks.pick_folder = Some(Box::new(move || {
+        flag.set(true);
+        None
+    }));
+    let revision = h.state().session.revision;
+    let file = rect(&h, "menu.File");
+    click_at(&mut h, file.center());
+    let dependencies = h.query_by_label_contains("Dependencies").unwrap().rect();
+    h.input_mut().events.push(Event::PointerMoved(dependencies.center()));
+    h.run_steps(8);
+    let relink = h.query_by_label_contains("Relink Missing Footage").unwrap().rect();
+    if let Some(path) = std::env::var_os("EFFECTCRAFT_RELINK_MENU_SNAPSHOT") {
+        h.render_serialized().unwrap().save(path).unwrap();
+    }
+    click_at(&mut h, relink.center());
+    assert!(picked.get());
+    assert_eq!(h.state().session.revision, revision);
+}
+
+#[test]
+fn relink_restores_decoded_pixels_and_invalidates_viewer_content() {
+    use effectcraft_engine::project::{ItemId, ItemKind};
+    use effectcraft_engine::render::RenderOpts;
+    use effectcraft_engine::time::Tick;
+
+    let dir = std::env::temp_dir().join(format!("ec-ui-relink-{}", std::process::id()));
+    std::fs::create_dir_all(dir.join("old")).unwrap();
+    std::fs::create_dir_all(dir.join("new/deep")).unwrap();
+    let old = dir.join("old/plate.png");
+    image::RgbaImage::from_pixel(32, 32, image::Rgba([230, 40, 80, 255])).save(&old).unwrap();
+    let mut s = effectcraft_host::session();
+    let item = s.execute("file.import", json!({"paths": [old], "sequence": false})).unwrap()["items"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name": "Relink", "width": 32, "height": 32, "duration": 1})).unwrap();
+    s.execute("layer.addItem", json!({"item": item})).unwrap();
+    let cid = s.active_comp_id().unwrap();
+    let expected = s.render(cid, Tick::ZERO, RenderOpts::default());
+    let moved = dir.join("new/deep/plate.png");
+    std::fs::rename(&old, &moved).unwrap();
+    s.execute("footage.check", json!({"wait": true})).unwrap();
+    let ItemKind::Footage(f) = &s.project.item(ItemId(item)).unwrap().kind else { panic!("footage") };
+    assert!(f.missing);
+    let missing_content = effectcraft_ui_egui::frames::comp_content(&s.project, cid);
+    let missing = s.render(cid, Tick::ZERO, RenderOpts::default());
+    assert_ne!(missing.data, expected.data);
+    let r = s.execute("file.relinkFootage", json!({"folder": dir.join("new"), "wait": true})).unwrap();
+    assert_eq!(r["relinked"], 1);
+    assert_ne!(effectcraft_ui_egui::frames::comp_content(&s.project, cid), missing_content);
+    assert_eq!(s.render(cid, Tick::ZERO, RenderOpts::default()).data, expected.data);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+/// #767, #1701: File ▸ Import ▸ File… and the proxy dialog offer every movie type the importer
+/// reads (MXF from broadcast cameras and Avid, AVI, …), the list the Media Browser goes by too.
+#[test]
+fn import_and_proxy_dialogs_offer_every_movie_type() {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+
+    let mut app = EffectcraftApp::new(Session::default());
+    let offered = Rc::new(RefCell::new(Vec::<String>::new()));
+    let seen = offered.clone();
+    app.hooks.pick_files = Some(Box::new(move |exts: &[&str]| {
+        *seen.borrow_mut() = exts.iter().map(|e| e.to_string()).collect();
+        Vec::new()
+    }));
+    for (command, still) in [("file.import", "psd"), ("file.setProxy", "png")] {
+        let result = effectcraft_ui_egui::menus::invoke(&mut app, &egui::Context::default(), command, json!({})).unwrap();
+        assert!(result.is_null(), "{command} cancelled: nothing done");
+        let offered = offered.borrow();
+        for ext in effectcraft_project::VIDEO_EXTENSIONS.iter().chain([&still]) {
+            assert!(offered.iter().any(|e| e == ext), "{command} offers {ext}: {offered:?}");
+        }
+        assert!(offered.iter().any(|e| e == "avi"), "{command}: {offered:?}");
+    }
+}
+
+/// #1059: opening the demo from the start screen and immediately pressing Spacebar previews
+/// the demo — the start screen's keyboard focus must not outlive it.
+#[test]
+fn space_previews_after_opening_the_demo_from_home() {
+    let mut h = {
+        let s = Session::default();
+        let mut app = EffectcraftApp::new(s);
+        app.ui.start_screen = true;
+        Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_| app)
+    };
+    h.run_steps(3);
+    let demo = rect(&h, "home.file.openDemoProject");
+    click_at(&mut h, demo.center());
+    assert!(h.state().session.active_comp().is_some(), "the demo comp is open");
+    assert!(!h.state().ui.start_screen, "the start screen closed");
+    key(&mut h, Key::Space);
+    assert!(h.state().playback.playing, "Space previews the demo (#1059)");
+}
+
+/// The titles open on the press, not the release, so the menus can be browsed with the button
+/// still held down: moving onto an entry and releasing there chooses it (as in After Effects).
+#[test]
+fn a_menu_opens_on_press_and_browsing_releases_choose_an_entry() {
+    let mut h = harness();
+    let edit = rect(&h, "menu.Edit");
+    press(&mut h, edit.center());
+    assert!(shown(&h, "Keyboard Shortcuts"), "the Edit menu opens on the press, before any release");
+    let item = h.query_by_label_contains("Keyboard Shortcuts").expect("the Edit menu is open").rect();
+    move_to(&mut h, item.center());
+    release(&mut h, item.center());
+    assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Shortcuts), "the release over the entry chose it");
+    assert!(!shown(&h, "Quick Apply"), "and closed the menu");
+}
+
+/// While a menu is open, hovering another title switches to that menu (native menu bars).
+#[test]
+fn hovering_another_title_while_a_menu_is_open_switches_to_it() {
+    let mut h = harness();
+    let edit = rect(&h, "menu.Edit");
+    click_at(&mut h, edit.center());
+    assert!(shown(&h, "Keyboard Shortcuts"), "the Edit menu is open");
+    let file = rect(&h, "menu.File");
+    move_to(&mut h, file.center());
+    assert!(shown(&h, "Open Project"), "hovering File opened the File menu");
+    assert!(!shown(&h, "Keyboard Shortcuts"), "and closed Edit");
+}
+
+/// The press on the title of the open menu closes it again, and the click's release — a plain
+/// click on the title — leaves it closed.
+#[test]
+fn pressing_the_open_title_again_closes_its_menu() {
+    let mut h = harness();
+    let file = rect(&h, "menu.File");
+    click_at(&mut h, file.center());
+    assert!(shown(&h, "Open Project"), "the File menu is open");
+    click_at(&mut h, file.center());
+    assert!(!shown(&h, "Open Project"), "the second press closed it");
+}
+
+/// Press-and-hold browse (AE's gesture) reaches into a submenu: while the button is still held,
+/// moving onto the submenu row opens it, and the release inside the submenu picks the entry.
+#[test]
+fn hold_browse_opens_a_submenu_and_the_release_inside_picks_an_entry() {
+    let mut h = harness();
+    // Applying an effect needs a selected layer, as in the app after clicking one in the timeline.
+    let first = {
+        let cid = h.state().session.active_comp_id().expect("the demo opens a comp");
+        let comp = h.state().session.project.comp(cid).expect("the demo comp exists");
+        comp.layers.iter().find(|l| l.effects().is_some()).expect("the demo comp has a layer that takes effects").id
+    };
+    h.state_mut().session.state.selected_layers = vec![first];
+    let effect = rect(&h, "menu.Effect");
+    press(&mut h, effect.center());
+    // (Effect ▸ Remove All: "Effect Controls" also names the panel's tab.)
+    assert!(shown(&h, "Remove All"), "the Effect menu opens on the press");
+    // The categories come from the effect registry; the first alphabetically is "3D Channel".
+    let cat = h.query_by_label_contains("3D Channel").expect("the category row is shown").rect();
+    move_to(&mut h, cat.center());
+    assert!(shown(&h, "Cryptomatte"), "moving onto a category while still holding opened its submenu");
+    let entry = h.query_by_label_contains("Cryptomatte").expect("the submenu is open").rect();
+    move_to(&mut h, entry.center());
+    release(&mut h, entry.center());
+    assert!(!shown(&h, "Remove All"), "the release closed the menus");
+    assert!(h.state().session.state.last_effect.is_some(), "and the release chose the entry: it applied its effect");
+}
+
+/// The open menus close on a press outside them and when the window loses focus. The pointer
+/// leaving the window — onto the OS title bar, whose clicks are never forwarded to egui — closes
+/// nothing, however long it stays away: there is no click to close on, and a graze or a stay
+/// must not drop the menu. The closing press itself is not swallowed: it reaches the widget under
+/// it, as a click does in After Effects.
+#[test]
+fn outside_presses_and_focus_loss_close_the_menus() {
+    let mut h = harness();
+    let file = rect(&h, "menu.File");
+    click_at(&mut h, file.center());
+    assert!(shown(&h, "Open Project"));
+    // A press in the empty part of the bar, outside every title and menu.
+    click_at(&mut h, pos2(1100.0, 12.0));
+    assert!(!shown(&h, "Open Project"), "a press outside the menus closes them");
+    // The press reaches the header's workspace tab behind the open menu: the menu closes and the
+    // tab still acts (the menus don't swallow input).
+    click_at(&mut h, file.center());
+    assert!(shown(&h, "Open Project"));
+    let tab = rect(&h, "header.workspace.Review");
+    click_at(&mut h, tab.center());
+    assert_eq!(h.state().ui.workspace, "Review", "the press reached the tab behind the open menu");
+    assert!(!shown(&h, "Open Project"), "and closed the menu");
+    // Moving onto the OS title bar fires the cursor-left event — its clicks are never forwarded
+    // to egui — which egui reports as `PointerGone`. It must not close the menus, however long
+    // the pointer stays away.
+    click_at(&mut h, file.center());
+    assert!(shown(&h, "Open Project"));
+    h.input_mut().events.push(Event::PointerGone);
+    h.run_steps(1);
+    assert!(shown(&h, "Open Project"), "leaving the window alone doesn't drop the menus at once");
+    let now = h.ctx.input(|i| i.time);
+    h.input_mut().time = Some(now + 60.0);
+    h.run_steps(2);
+    assert!(shown(&h, "Open Project"), "staying away doesn't close them either");
+    h.input_mut().events.push(Event::PointerMoved(file.center()));
+    h.run_steps(2);
+    assert!(shown(&h, "Open Project"), "the pointer coming back keeps them open too");
+    // Losing focus (alt-tabbing away, or clicking another window).
+    h.input_mut().events.push(Event::WindowFocused(false));
+    h.run_steps(2);
+    assert!(!shown(&h, "Open Project"), "losing focus closes the menus");
+}
+
+/// From an open submenu, the pointer reaching another title switches menus too (#1290).
+#[test]
+fn hovering_a_title_from_an_open_submenu_switches_menus() {
+    let mut h = harness();
+    let (file, edit) = (rect(&h, "menu.File"), rect(&h, "menu.Edit"));
+    click_at(&mut h, file.center());
+    let new = h.query_by(|n| n.label().is_some_and(|l| l.trim_end_matches('\u{23f5}').trim() == "New")).expect("File ▸ New").rect();
+    move_to(&mut h, new.center());
+    h.run_steps(5);
+    assert!(shown(&h, "New Project from Template"), "the New submenu is open");
+    move_to(&mut h, edit.center());
+    assert!(shown(&h, "Keyboard Shortcuts"), "hovering Edit opened it");
+    assert!(!shown(&h, "New Project from Template") && !shown(&h, "Open Project"), "and closed File and its submenu");
+}
+
+/// A title the pointer can't reach (the app is disabled under a dialog) doesn't switch menus
+/// (#1290).
+#[test]
+fn a_disabled_title_does_not_switch_menus() {
+    let mut h = harness();
+    let (file, edit) = (rect(&h, "menu.File"), rect(&h, "menu.Edit"));
+    click_at(&mut h, file.center());
+    h.state_mut().dialog = Some(effectcraft_ui_egui::Dialog::About);
+    h.run_steps(2);
+    move_to(&mut h, edit.center());
+    assert!(!shown(&h, "Keyboard Shortcuts"), "Edit didn't open");
+}
+
+/// A pointer resting on a title doesn't undo Left / Right: only a moving pointer switches
+/// (#1290).
+#[test]
+fn a_resting_pointer_does_not_override_the_arrow_keys() {
+    if cfg!(target_os = "macos") {
+        // (Right / Left between menus are tested where the in-window bar is the app's menu.)
+        return;
+    }
+    let mut h = harness();
+    let file = rect(&h, "menu.File");
+    click_at(&mut h, file.center());
+    key(&mut h, Key::ArrowRight);
+    h.run_steps(3);
+    assert!(shown(&h, "Keyboard Shortcuts"), "Right opened Edit with the pointer still on File");
+    assert!(!shown(&h, "Open Project"));
+}
+
+/// Leaving the window keeps the menu open, and coming back in over another title switches to it
+/// (#1290): egui reports no pointer movement for that first position.
+#[test]
+fn pointer_reentering_over_another_title_switches_menus() {
+    let mut h = harness();
+    let (file, edit) = (rect(&h, "menu.File"), rect(&h, "menu.Edit"));
+    click_at(&mut h, file.center());
+    h.input_mut().events.push(Event::PointerGone);
+    h.run_steps(2);
+    assert!(shown(&h, "Open Project"), "leaving the window kept File open");
+    move_to(&mut h, edit.center());
+    assert!(shown(&h, "Keyboard Shortcuts"), "coming back over Edit opened it");
+    assert!(!shown(&h, "Open Project"), "and closed File");
+}
diff --git a/crates/ui-egui/tests/it/ui_new_primitive.rs b/crates/ui-egui/tests/it/ui_new_primitive.rs
new file mode 100644
index 000000000..c40aa23ed
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_new_primitive.rs
@@ -0,0 +1,227 @@
+//! Layer ▸ New ▸ 3D Primitive… (#1734): the dialog picks a type, name and dimensions and runs
+//! `layer.newPrimitive`, which switches a Classic 3D comp to Advanced 3D in the same step.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{Layer, LayerSource, PrimitiveKind, Renderer};
+use effectcraft_ui_egui::{Dialog, EffectcraftApp};
+use egui::{Event, Key, Modifiers, PointerButton};
+use egui_kittest::Harness;
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Scene", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.step();
+    h
+}
+
+/// An automation element's rect in the last frame drawn (a dialog settles its place in its
+/// first frames).
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Option<[f32; 4]> {
+    let auto = &h.state().auto;
+    auto.elements.iter().chain(auto.previous.iter()).find(|e| e.id == id).map(|e| e.rect)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let [x, y, w, hh] = rect(h, id).unwrap_or_else(|| panic!("{id} is registered"));
+    let p = egui::pos2(x + w / 2.0, y + hh / 2.0);
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+    }
+    h.run_steps(2);
+}
+
+/// Types `text` over a field's contents and leaves it with Tab.
+fn type_into(h: &mut Harness<'_, EffectcraftApp>, id: &str, text: &str) {
+    click(h, id);
+    assert!(h.ctx.egui_wants_keyboard_input(), "{id} has focus");
+    key(h, Key::A, Modifiers::COMMAND);
+    h.input_mut().events.push(Event::Text(text.into()));
+    h.step();
+    key(h, Key::Tab, Modifiers::NONE);
+}
+
+/// Layer ▸ New ▸ 3D Primitive…, as the menu runs it.
+fn open(h: &mut Harness<'_, EffectcraftApp>) {
+    let (path, entry) =
+        effectcraft_engine::menus::entries().into_iter().find(|(_, e)| e.label == "3D Primitive...").expect("Layer ▸ New lists 3D Primitive...");
+    assert_eq!(path, ["Layer", "New"]);
+    assert_eq!(entry.command, "layer.newPrimitive");
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, &entry.command, entry.params_or_empty()).unwrap();
+    h.run_steps(2);
+    assert_eq!(h.state().dialog, Some(Dialog::NewPrimitive));
+}
+
+fn choose(h: &mut Harness<'_, EffectcraftApp>, kind: PrimitiveKind) {
+    click(h, "dialog.primitive.type");
+    let i = PrimitiveKind::ALL.iter().position(|k| *k == kind).unwrap();
+    click(h, &format!("dialog.primitive.typeItem.{i}"));
+}
+
+fn layers(h: &Harness<'_, EffectcraftApp>) -> Vec<Layer> {
+    h.state().session.active_comp().unwrap().layers.to_vec()
+}
+
+fn renderer(h: &Harness<'_, EffectcraftApp>) -> Renderer {
+    h.state().session.active_comp().unwrap().renderer
+}
+
+fn geometry(l: &Layer, id: &str) -> f64 {
+    l.props.prop(&format!("geometryOptions/{id}")).unwrap_or_else(|| panic!("{id}")).value.as_f64()
+}
+
+/// A torus named "Ring" with a 250 px radius, the rest left at their defaults.
+fn create_ring(h: &mut Harness<'_, EffectcraftApp>) {
+    open(h);
+    choose(h, PrimitiveKind::Torus);
+    type_into(h, "dialog.primitive.name", "Ring");
+    type_into(h, "dialog.primitive.radius", "250");
+    click(h, "dialog.primitive.ok");
+    assert_eq!(h.state().dialog, None);
+}
+
+fn assert_ring(l: &Layer) {
+    assert_eq!(l.source, LayerSource::Primitive { kind: PrimitiveKind::Torus });
+    assert_eq!(l.name, "Ring");
+    assert_eq!(geometry(l, "radius"), 250.0);
+    assert_eq!(geometry(l, "tubeRadius"), 50.0);
+}
+
+#[test]
+fn creates_a_primitive_in_a_classic_3d_comp_in_one_undoable_step() {
+    let mut h = harness();
+    assert_eq!(renderer(&h), Renderer::Classic3D);
+    let steps = h.state().session.history.undo.len();
+    create_ring(&mut h);
+    let ls = layers(&h);
+    assert_eq!(ls.len(), 1);
+    assert_ring(&ls[0]);
+    assert_eq!(renderer(&h), Renderer::Advanced3D, "the comp switches to Advanced 3D");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert!(layers(&h).is_empty());
+    assert_eq!(renderer(&h), Renderer::Classic3D, "undo restores the renderer too");
+    h.state_mut().session.execute("edit.redo", json!({})).unwrap();
+    assert_ring(&layers(&h)[0]);
+    assert_eq!(renderer(&h), Renderer::Advanced3D);
+}
+
+#[test]
+fn cancel_creates_nothing() {
+    let mut h = harness();
+    let steps = h.state().session.history.undo.len();
+    open(&mut h);
+    choose(&mut h, PrimitiveKind::Sphere);
+    type_into(&mut h, "dialog.primitive.radius", "80");
+    click(&mut h, "dialog.primitive.cancel");
+    assert_eq!(h.state().dialog, None);
+    assert!(layers(&h).is_empty());
+    assert_eq!(renderer(&h), Renderer::Classic3D);
+    assert_eq!(h.state().session.history.undo.len(), steps);
+}
+
+#[test]
+fn each_type_offers_the_dimensions_its_layer_has() {
+    let mut h = harness();
+    for kind in PrimitiveKind::ALL {
+        open(&mut h);
+        choose(&mut h, kind);
+        click(&mut h, "dialog.primitive.ok");
+        let l = layers(&h).into_iter().find(|l| l.source == LayerSource::Primitive { kind }).unwrap();
+        assert_eq!(l.name, kind.label(), "the name follows the type until typed");
+        let group = l.props.group("geometryOptions").unwrap();
+        let ids: Vec<&str> = group.props().map(|p| p.match_id.as_str()).collect();
+        open(&mut h);
+        choose(&mut h, kind);
+        let controls = ["type", "name", "ok", "cancel"];
+        let shown: Vec<&str> = (h.state().auto.elements.iter())
+            .filter_map(|e| e.id.strip_prefix("dialog.primitive."))
+            .filter(|id| !controls.contains(id) && !id.starts_with("typeItem."))
+            .collect();
+        assert_eq!(shown, ids, "{} dimensions", kind.label());
+        click(&mut h, "dialog.primitive.cancel");
+    }
+}
+
+#[test]
+fn a_created_primitive_survives_save_and_reopen() {
+    let mut h = harness();
+    create_ring(&mut h);
+    let path = std::env::temp_dir().join(format!("ec-ui-new-primitive-{}.ecproj", std::process::id()));
+    h.state_mut().session.execute("file.saveAs", json!({"path": path.to_string_lossy()})).unwrap();
+    let mut o = Session::default();
+    o.execute("file.open", json!({"path": path.to_string_lossy()})).unwrap();
+    let _ = std::fs::remove_file(&path);
+    let (_, comp) = o.project.comps().next().unwrap();
+    assert_eq!(comp.renderer, Renderer::Advanced3D);
+    assert_ring(&comp.layers[0]);
+}
+
+#[test]
+fn untouched_dimensions_take_each_types_defaults_and_typed_ones_carry_over() {
+    let mut h = harness();
+    open(&mut h);
+    choose(&mut h, PrimitiveKind::Plane);
+    click(&mut h, "dialog.primitive.ok");
+    let plane = layers(&h).remove(0);
+    assert_eq!(geometry(&plane, "width"), 400.0, "a plane's default, not the cube's 300");
+    open(&mut h);
+    type_into(&mut h, "dialog.primitive.width", "120");
+    choose(&mut h, PrimitiveKind::Plane);
+    click(&mut h, "dialog.primitive.ok");
+    let plane = layers(&h).into_iter().find(|l| l.id != plane.id).unwrap();
+    assert_eq!(geometry(&plane, "width"), 120.0, "the typed width carries over");
+    assert_eq!(geometry(&plane, "height"), 400.0);
+}
+
+/// A dialog left open while something else changes the editing context closes without creating
+/// anything rather than adding the primitive where it was not opened.
+fn closes_when(change: impl FnOnce(&mut Session)) {
+    let mut h = harness();
+    let a = h.state().session.active_comp_id().unwrap();
+    open(&mut h);
+    choose(&mut h, PrimitiveKind::Torus);
+    change(&mut h.state_mut().session);
+    let b = h.state().session.active_comp_id().unwrap();
+    let steps = h.state().session.history.undo.len();
+    h.run_steps(2);
+    assert_eq!(h.state().dialog, None, "the dialog closes");
+    assert!(rect(&h, "dialog.primitive.ok").is_none());
+    let s = &h.state().session;
+    for c in [a, b] {
+        if let Some(c) = s.project.comp(c) {
+            assert!(c.layers.is_empty(), "nothing is created");
+            assert_eq!(c.renderer, Renderer::Classic3D);
+        }
+    }
+    assert_eq!(s.history.undo.len(), steps);
+    assert!(h.state().ui.status.contains("changed"), "{}", h.state().ui.status);
+}
+
+#[test]
+fn another_comp_made_active_closes_the_dialog() {
+    closes_when(|s| {
+        s.execute("comp.new", json!({"name": "Other", "width": 640, "height": 360, "duration": 2})).unwrap();
+    });
+}
+
+#[test]
+fn a_replaced_project_closes_the_dialog_even_when_the_comp_id_is_reused() {
+    closes_when(|s| {
+        let before = s.active_comp_id().unwrap();
+        s.execute("file.newProject", json!({})).unwrap();
+        s.execute("comp.new", json!({"name": "Scene", "width": 640, "height": 360, "duration": 2})).unwrap();
+        assert_eq!(s.active_comp_id(), Some(before), "the new project reuses the comp's id");
+    });
+}
diff --git a/crates/ui-egui/tests/ui_object_matte.rs b/crates/ui-egui/tests/it/ui_object_matte.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_object_matte.rs
rename to crates/ui-egui/tests/it/ui_object_matte.rs
diff --git a/crates/ui-egui/tests/ui_panel_focus.rs b/crates/ui-egui/tests/it/ui_panel_focus.rs
similarity index 72%
rename from crates/ui-egui/tests/ui_panel_focus.rs
rename to crates/ui-egui/tests/it/ui_panel_focus.rs
index 5d3302b10..0d436f702 100644
--- a/crates/ui-egui/tests/ui_panel_focus.rs
+++ b/crates/ui-egui/tests/it/ui_panel_focus.rs
@@ -5,7 +5,8 @@
 use effectcraft_engine::Session;
 use effectcraft_engine::project::ItemId;
 use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::{DockNode, PanelKind};
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
+use effectcraft_ui_egui::dock::{Node, PanelKind, Workspace};
 use egui::{Event, Pos2, pos2};
 use egui_kittest::Harness;
 use serde_json::json;
@@ -42,15 +43,6 @@ fn click_n(h: &mut Harness<'_, EffectcraftApp>, p: Pos2, n: u32) {
     h.run_steps(2);
 }
 
-/// The tabs of the docked group holding `p`, in order.
-fn group_of(n: &DockNode, p: PanelKind) -> Option<Vec<PanelKind>> {
-    match n {
-        DockNode::Split { a, b, .. } => group_of(a, p).or_else(|| group_of(b, p)),
-        DockNode::Tabs { panels, .. } => panels.contains(&p).then(|| panels.clone()),
-        DockNode::Stack { entries } => entries.iter().find(|e| e.contains(p)).map(|e| e.panels.clone()),
-    }
-}
-
 fn invoke(h: &mut Harness<'_, EffectcraftApp>, id: &str, params: serde_json::Value) {
     let ctx = h.ctx.clone();
     effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, id, params).unwrap();
@@ -66,7 +58,7 @@ fn opening_a_comp_brings_up_a_closed_composition_panel() {
     let (mut h, other, main) = harness();
     assert_eq!(group_of(&h.state().ui.dock, PanelKind::Composition), Some(vec![PanelKind::Composition, PanelKind::Layer]));
     invoke(&mut h, "window.closePanel", json!({"panel": "Composition"}));
-    assert!(!h.state().ui.dock.contains(PanelKind::Composition));
+    assert!(!h.state().ui.dock.is_docked(PanelKind::Composition));
     assert!(h.state().ui.dock.is_visible(PanelKind::Layer), "the centre shows the Layer panel");
 
     // Double-click "Other" in the Project panel.
@@ -75,7 +67,7 @@ fn opening_a_comp_brings_up_a_closed_composition_panel() {
     assert_eq!(h.state().session.active_comp_id(), Some(ItemId(other)));
     let dock = &h.state().ui.dock;
     assert!(dock.is_visible(PanelKind::Composition), "the Composition panel is back and in front");
-    assert_eq!(group_of(dock, PanelKind::Composition), Some(vec![PanelKind::Layer, PanelKind::Composition]), "back in the centre");
+    assert_eq!(group_of(dock, PanelKind::Composition), Some(vec![PanelKind::Composition, PanelKind::Layer]), "back in the centre");
     assert!(h.state().auto.elements.iter().any(|e| e.id == "panel.Composition"), "the Composition panel is drawn");
 
     // Open Composition (the Project panel's context menu) with the panel closed again.
@@ -83,12 +75,12 @@ fn opening_a_comp_brings_up_a_closed_composition_panel() {
     invoke(&mut h, "comp.open", json!({"comp": main}));
     assert_eq!(h.state().session.active_comp_id(), Some(ItemId(main)));
     assert!(h.state().ui.dock.is_visible(PanelKind::Composition));
-    assert_eq!(group_of(&h.state().ui.dock, PanelKind::Composition), Some(vec![PanelKind::Layer, PanelKind::Composition]));
+    assert_eq!(group_of(&h.state().ui.dock, PanelKind::Composition), Some(vec![PanelKind::Composition, PanelKind::Layer]));
 
     // Window ▸ Composition reopens it in the centre too (not beside Effects & Presets).
     invoke(&mut h, "window.closePanel", json!({"panel": "Composition"}));
     invoke(&mut h, "window.panel", json!({"panel": "Composition"}));
-    assert_eq!(group_of(&h.state().ui.dock, PanelKind::Composition), Some(vec![PanelKind::Layer, PanelKind::Composition]));
+    assert_eq!(group_of(&h.state().ui.dock, PanelKind::Composition), Some(vec![PanelKind::Composition, PanelKind::Layer]));
     assert!(h.state().ui.dock.is_visible(PanelKind::Composition));
 }
 
@@ -99,12 +91,12 @@ fn opening_a_comp_in_the_minimal_workspace_docks_the_viewer_above_the_timeline()
     let (mut h, other, _) = harness();
     invoke(&mut h, "window.workspace", json!({"name": "Minimal"}));
     invoke(&mut h, "window.closePanel", json!({"panel": "Composition"}));
-    assert!(!h.state().ui.dock.contains(PanelKind::Composition));
+    assert!(!h.state().ui.dock.is_docked(PanelKind::Composition));
     invoke(&mut h, "comp.open", json!({"comp": other}));
-    match &h.state().ui.dock {
-        DockNode::Split { vertical: true, a, b, .. } => {
-            assert_eq!(group_of(a, PanelKind::Composition), Some(vec![PanelKind::Composition]), "the viewer is on top");
-            assert!(b.contains(PanelKind::Timeline));
+    match &h.state().ui.dock.layout.root {
+        Some(Node::Split { axis: effectcraft_ui_egui::dock::SplitAxis::Vertical, first, second, .. }) => {
+            assert_eq!(**first, Node::Tabs { panels: vec![PanelKind::Composition], active: 0 }, "the viewer is on top");
+            assert!(matches!(&**second, Node::Tabs { panels, .. } if panels.contains(&PanelKind::Timeline)));
         }
         other => panic!("expected the viewer above the Timeline, got {other:?}"),
     }
@@ -147,7 +139,7 @@ fn applying_an_effect_brings_up_effect_controls_on_that_layer() {
 
     // Closed: Effect ▸ Last Effect reopens it.
     invoke(&mut h, "window.closePanel", json!({"panel": "EffectControls"}));
-    assert!(!h.state().ui.dock.contains(PanelKind::EffectControls));
+    assert!(!h.state().ui.dock.is_docked(PanelKind::EffectControls));
     try_invoke(&mut h, "effect.applyLast", json!({}));
     assert!(ec_up(&h), "Effect Controls reopened");
 
@@ -177,7 +169,7 @@ fn double_clicking_an_effect_in_the_timeline_opens_effect_controls() {
     invoke(&mut h, "window.closePanel", json!({"panel": "EffectControls"}));
     let blue = layer_id(&h, "Blue");
     invoke(&mut h, "layer.select", json!({"layers": [blue]}));
-    assert!(!h.state().ui.dock.contains(PanelKind::EffectControls));
+    assert!(!h.state().ui.dock.is_docked(PanelKind::EffectControls));
 
     let name = rect(&h, &format!("timeline.group.{uid}.name"));
     click_n(&mut h, name.center(), 2);
@@ -187,3 +179,52 @@ fn double_clicking_an_effect_in_the_timeline_opens_effect_controls() {
     assert_eq!(st.selected_props.iter().map(|(l, u)| (l.0, *u)).collect::<Vec<_>>(), vec![(red, uid)], "with the effect selected");
     assert!(!h.state().ui.timeline.open_groups.contains(&uid), "the effect did not twirl open");
 }
+
+// Regression test for #354: the focused panel's blue outline was painted before the panel body,
+// so the body's background and widgets painted over it. It must be drawn after every panel body.
+#[test]
+fn focused_panel_outline_is_painted_over_the_panel_bodies() {
+    fn flatten<'a>(shape: &'a egui::Shape, clip: egui::Rect, out: &mut Vec<(egui::Rect, &'a egui::epaint::RectShape)>) {
+        match shape {
+            egui::Shape::Rect(r) => out.push((clip, r)),
+            egui::Shape::Vec(v) => v.iter().for_each(|s| flatten(s, clip, out)),
+            _ => {}
+        }
+    }
+    let (mut h, _, _) = harness();
+    for panel in [PanelKind::Timeline, PanelKind::Project] {
+        h.state_mut().ui.focused = panel;
+        h.run_steps(3);
+        let focus = h.state().tokens.focus;
+        let mut rects = vec![];
+        h.output().shapes.iter().for_each(|c| flatten(&c.shape, c.clip_rect, &mut rects));
+        // The one-pixel, unfilled outline round the focused panel's frame.
+        let body = rect(&h, &format!("panel.{}", panel.id()));
+        let outlines: Vec<usize> = rects
+            .iter()
+            .enumerate()
+            .filter(|(_, (_, r))| r.fill.a() == 0 && r.stroke.color == focus && r.stroke.width == 1.0 && r.rect.contains_rect(body))
+            .map(|(i, _)| i)
+            .collect();
+        let Some(&at) = outlines.last() else { panic!("{panel:?}: no focus outline painted") };
+        let outline = rects[at].1.rect;
+        // Nothing painted after it reaches the one-pixel ring it draws, where a panel's
+        // background or rows would hide it.
+        let ring = [
+            egui::Rect::from_min_max(outline.min, egui::pos2(outline.right(), outline.top() + 1.0)),
+            egui::Rect::from_min_max(egui::pos2(outline.left(), outline.bottom() - 1.0), outline.max),
+            egui::Rect::from_min_max(outline.min, egui::pos2(outline.left() + 1.0, outline.bottom())),
+            egui::Rect::from_min_max(egui::pos2(outline.right() - 1.0, outline.top()), outline.max),
+        ];
+        for (clip, r) in &rects[at + 1..] {
+            let painted = r.rect.intersect(*clip);
+            let over = ring.iter().any(|edge| edge.intersect(painted).area() > 0.0);
+            assert!(r.fill.a() == 0 || !over, "{panel:?}: a filled rect {:?} (fill {:?}) is painted over the focus outline {outline:?}", r.rect, r.fill);
+        }
+    }
+}
+
+/// The tabs of the group holding `p`, in order.
+fn group_of(w: &Workspace, p: PanelKind) -> Option<Vec<PanelKind>> {
+    Some(w.group_of(p)).filter(|g| !g.is_empty())
+}
diff --git a/crates/ui-egui/tests/it/ui_panel_windows.rs b/crates/ui-egui/tests/it/ui_panel_windows.rs
new file mode 100644
index 000000000..d2750bb05
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_panel_windows.rs
@@ -0,0 +1,106 @@
+//! Multiple monitors (#486): Move Panel to New Window puts a panel in a floating window of its
+//! own, which on desktop is an OS window that can go on another screen, and Move Panel to Main
+//! Window docks it again. The test harness embeds viewports, so these windows draw in the main
+//! window here, as on the web.
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::{PanelKind, WorkspaceExt as _};
+use effectcraft_ui_egui::dock_ui::sanitized_window_rect;
+use serde_json::json;
+
+fn invoke(app: &mut EffectcraftApp, ctx: &egui::Context, params: serde_json::Value) -> Result<serde_json::Value, String> {
+    effectcraft_ui_egui::menus::invoke(app, ctx, "window.panelWindow", params)
+}
+
+fn native(app: &EffectcraftApp, panel: PanelKind) -> Option<[f32; 4]> {
+    app.ui.dock.layout.floating.iter().find(|w| w.contains(&panel)).and_then(|w| w.native)
+}
+
+#[test]
+fn panel_window_command_moves_a_docked_panel_into_its_own_window_and_back() {
+    let mut app = EffectcraftApp::new(Session::default());
+    let ctx = egui::Context::default();
+    assert!(app.ui.dock.is_docked(PanelKind::Project));
+    assert_eq!(invoke(&mut app, &ctx, json!({"panel": "Project", "window": true})).unwrap(), json!({"window": true}));
+    // Undocked first, then given a window of its own.
+    assert!(!app.ui.dock.is_docked(PanelKind::Project));
+    assert!(app.ui.dock.layout.floating.iter().any(|w| w.panels().copied().collect::<Vec<_>>() == [PanelKind::Project]));
+    assert!(app.in_panel_window(PanelKind::Project));
+    let rect = native(&app, PanelKind::Project).unwrap();
+    assert_eq!(rect, sanitized_window_rect(rect));
+    // Asking again changes nothing; no `window` toggles.
+    assert_eq!(invoke(&mut app, &ctx, json!({"panel": "Project", "window": true})).unwrap(), json!({"window": true}));
+    assert_eq!(invoke(&mut app, &ctx, json!({"panel": "Project"})).unwrap(), json!({"window": false}));
+    // Back in the main window: docked in the first docked group.
+    assert!(!app.in_panel_window(PanelKind::Project));
+    assert!(!app.ui.dock.is_floating(PanelKind::Project));
+    assert!(app.ui.dock.is_docked(PanelKind::Project));
+    // The serialized panel form works too.
+    assert_eq!(invoke(&mut app, &ctx, json!({"panel": PanelKind::Project})).unwrap(), json!({"window": true}));
+    // Bad requests are errors and change nothing.
+    let before = app.ui.dock.clone();
+    for params in [json!({}), json!({"panel": "Nope"}), json!({"panel": 7}), json!({"panel": "Project", "window": "yes"}), json!({"panel": {"Viewer": 9}})] {
+        assert!(invoke(&mut app, &ctx, params.clone()).is_err(), "{params} must be rejected");
+    }
+    assert_eq!(app.ui.dock, before);
+    // Docking it back into the main window ends its window.
+    effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.dockPanel", json!({"panel": "Project", "anchor": "Timeline"})).unwrap();
+    assert!(!app.in_panel_window(PanelKind::Project));
+    assert!(app.ui.dock.is_docked(PanelKind::Project));
+}
+
+#[test]
+fn panel_windows_survive_restart_with_hostile_places_made_safe() {
+    use effectcraft_engine::config::MemoryConfig;
+    use std::sync::Arc;
+    let store = Arc::new(MemoryConfig::default());
+    let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
+    let ctx = egui::Context::default();
+    invoke(&mut app, &ctx, json!({"panel": "Project", "window": true})).unwrap();
+    let hostile = [90_000.0, -99_000.0, 99_000.0, 0.5];
+    app.apply_dock(craft_ui::docking::Action::SetNative { panel: PanelKind::Project, rect: Some(hostile) }).unwrap();
+    eframe::App::on_exit(&mut app);
+    let restarted = EffectcraftApp::new(Session { config: Some(store), ..Default::default() });
+    assert_eq!(native(&restarted, PanelKind::Project), Some(sanitized_window_rect(hostile)));
+    let [x, y, w, h] = sanitized_window_rect(hostile);
+    assert!(x <= 100_000.0 && y >= -100_000.0 && (160.0..=16_384.0).contains(&w) && (100.0..=16_384.0).contains(&h));
+    assert!(sanitized_window_rect([f32::NAN, f32::INFINITY, f32::NAN, f32::NEG_INFINITY]).iter().all(|v| v.is_finite()));
+}
+
+#[test]
+fn a_click_on_a_floating_panel_does_nothing_while_a_dialog_is_open() {
+    use egui::{Event, Modifiers, PointerButton, pos2, vec2};
+    use egui_kittest::Harness;
+    let mut app = EffectcraftApp::new(Session::default());
+    app.ui.start_screen = false;
+    app.apply_dock(craft_ui::docking::Action::Float { panel: PanelKind::Project, rect: [80.0, 120.0, 320.0, 240.0] }).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(move |_| app);
+    h.run_steps(3);
+    let close = |h: &Harness<'_, EffectcraftApp>| {
+        let e = h.state().auto.elements.iter().find(|e| e.id.starts_with("panel.float.") && e.id.ends_with(".close")).expect("the floating window's ×");
+        pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+    };
+    let click = |h: &mut Harness<'_, EffectcraftApp>, pos| {
+        h.event(Event::PointerMoved(pos));
+        h.step();
+        for pressed in [true, false] {
+            h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+            h.step();
+        }
+        h.run_steps(2);
+    };
+    let at = close(&h);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "app.settings", json!({"page": "general"})).unwrap();
+    h.run_steps(3);
+    let before = h.state().ui.dock.clone();
+    click(&mut h, at);
+    assert_eq!(h.state().ui.dock, before, "the floating panel takes no click while Settings is open");
+    assert!(h.state().ui.dock.is_floating(PanelKind::Project));
+    // The same click closes the window once the dialog is gone.
+    h.state_mut().dialog = None;
+    h.run_steps(3);
+    let at = close(&h);
+    click(&mut h, at);
+    assert!(!h.state().ui.dock.is_open(PanelKind::Project));
+}
diff --git a/crates/ui-egui/tests/ui_panels.rs b/crates/ui-egui/tests/it/ui_panels.rs
similarity index 94%
rename from crates/ui-egui/tests/ui_panels.rs
rename to crates/ui-egui/tests/it/ui_panels.rs
index 240f2de8f..2c2d650e9 100644
--- a/crates/ui-egui/tests/ui_panels.rs
+++ b/crates/ui-egui/tests/it/ui_panels.rs
@@ -2,6 +2,8 @@
 //! registers its automation ids; the Footage panel's buttons edit into the comp; the Progress
 //! panel lists and cancels a job; Lumetri Scopes switch scope through their dropdown.
 
+use crate::gpu_test::RenderSerial;
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
 use std::sync::Arc;
 
 use effectcraft_engine::{Session, config::MemoryConfig};
@@ -60,7 +62,7 @@ fn window_menu_opens_the_new_panels() {
         ("contentAwareFill", PanelKind::ContentAwareFill, "contentFill.method"),
     ] {
         open(&mut h, name);
-        assert!(h.state().ui.dock.contains(kind) || h.state().ui.floating.iter().any(|f| f.panels.contains(&kind)), "{name} shown");
+        assert!(h.state().ui.dock.is_open(kind), "{name} shown");
         if !auto.is_empty() {
             assert!(h.state().auto.find(auto).is_some(), "{name}: {auto}");
         }
@@ -72,9 +74,7 @@ fn window_menu_opens_the_new_panels() {
 #[test]
 fn window_menu_closes_a_checked_panel() {
     let mut h = harness();
-    let shown = |h: &Harness<'_, EffectcraftApp>| {
-        h.state().ui.dock.contains(PanelKind::Align) || h.state().ui.floating.iter().any(|f| f.panels.contains(&PanelKind::Align))
-    };
+    let shown = |h: &Harness<'_, EffectcraftApp>| h.state().ui.dock.is_open(PanelKind::Align);
     open(&mut h, "align");
     assert!(shown(&h));
     click(&mut h, "menu.Window");
@@ -106,7 +106,7 @@ fn footage_panel_buttons_edit_into_the_comp() {
     let item = h.state().session.project.items.values().find(|i| matches!(i.kind, effectcraft_engine::project::ItemKind::Solid(_))).unwrap().id.0;
     h.state_mut().session.execute("footage.open", json!({"item": item})).unwrap();
     h.run_steps(4);
-    assert!(h.state().ui.dock.contains(PanelKind::Footage) || h.state().ui.floating.iter().any(|f| f.panels.contains(&PanelKind::Footage)));
+    assert!(h.state().ui.dock.is_open(PanelKind::Footage));
     assert!(h.state().auto.find("footage.overlayEdit").is_some());
     let before = h.state().session.active_comp().unwrap().layers.len();
     click(&mut h, "footage.overlayEdit");
@@ -218,7 +218,7 @@ fn saved_workspace_is_listed_in_the_workspace_menu() {
     h.run_steps(3);
     assert_ne!(h.state().ui.dock, saved);
     click(&mut h, "menu.Window");
-    let ws = h.query_by_label(" Workspace ⏵").expect("Window ▸ Workspace").rect();
+    let ws = h.query_by_label(" Workspace").expect("Window ▸ Workspace").rect();
     hover(&mut h, ws.center());
     let entry = h.state().auto.find("menu.savedWorkspaces.0").expect("the saved workspace is listed").clone();
     assert_eq!(entry.label, "My Layout");
@@ -239,7 +239,7 @@ fn saved_workspace_is_listed_in_the_workspace_menu() {
 fn edit_label_menu_shows_the_label_colours() {
     let mut h = harness();
     click(&mut h, "menu.Edit");
-    let label = h.query_by_label(" Label ⏵").expect("Edit ▸ Label").rect();
+    let label = h.query_by_label(" Label").expect("Edit ▸ Label").rect();
     hover(&mut h, label.center());
     // (Not Dark Green; the entry's label starts with its check-mark column.)
     let green = h.query_by_label(" Green").expect("the Label submenu is open").rect();
@@ -388,6 +388,7 @@ fn settings_buttons_stay_in_view_at_200_percent() {
             delta: egui::vec2(0.0, -1000.0),
             modifiers: Default::default(),
             phase: egui::TouchPhase::Move,
+            source: egui::MouseWheelSource::Wheel,
         });
         h.run_steps(5);
     };
@@ -414,7 +415,7 @@ fn settings_buttons_stay_in_view_at_200_percent() {
 }
 
 /// Headless look at the panels (wgpu offscreen; needs a GPU adapter). Run with
-/// `PANELS_SNAPSHOT=/abs/dir cargo test -p effectcraft-ui-egui --test ui_panels -- --ignored`.
+/// `PANELS_SNAPSHOT=/abs/dir cargo test -p effectcraft-ui-egui --test it ui_panels:: -- --ignored`.
 #[test]
 #[ignore]
 fn panels_snapshot() {
@@ -448,7 +449,7 @@ fn panels_snapshot() {
         }
         open(&mut h, panel);
         h.run_steps(3);
-        let img = h.render().expect("render");
+        let img = h.render_serialized().expect("render");
         img.save(format!("{dir}/{panel}{scope}.png")).unwrap();
     }
 }
@@ -664,3 +665,33 @@ fn transition_presets_apply_from_effects_and_presets() {
     assert_eq!(fx.name, "Radial Wipe");
     assert_eq!(fx.prop("completion").unwrap().keys.len(), 2);
 }
+
+/// #2582: dragging Settings' UI Scale doesn't resize the interface under the pointer; the value
+/// applies once the button is released.
+#[test]
+fn ui_scale_applies_when_the_drag_ends() {
+    let mut h = harness();
+    open_settings(&mut h);
+    let e = h.state().auto.find("settings.appearance.uiScale").expect("the UI Scale field");
+    let from = pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0);
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.step();
+    for k in 1..=8 {
+        h.input_mut().events.push(Event::PointerMoved(from + egui::vec2(10.0 * k as f32, 0.0)));
+        h.step();
+        assert_eq!(scale(&h), (100, 1.0), "nothing applies mid-drag");
+    }
+    h.input_mut().events.push(Event::PointerButton {
+        pos: from + egui::vec2(80.0, 0.0),
+        button: egui::PointerButton::Primary,
+        pressed: false,
+        modifiers: Default::default(),
+    });
+    h.run_steps(4);
+    let (pct, zoom) = scale(&h);
+    assert!(pct > 100 && (zoom - pct as f32 / 100.0).abs() < 1e-6, "applied on release: {pct} {zoom}");
+    click(&mut h, "settings.cancel");
+    h.run_steps(2);
+    assert_eq!(scale(&h), (100, 1.0));
+}
diff --git a/crates/ui-egui/tests/ui_parameter_spacing.rs b/crates/ui-egui/tests/it/ui_parameter_spacing.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_parameter_spacing.rs
rename to crates/ui-egui/tests/it/ui_parameter_spacing.rs
index 71b70a14e..167029f7c 100644
--- a/crates/ui-egui/tests/ui_parameter_spacing.rs
+++ b/crates/ui-egui/tests/it/ui_parameter_spacing.rs
@@ -54,7 +54,7 @@ fn nested_groups_keep_indentation_value_alignment_and_effect_gaps_at_fixed_compa
     let mut s = Session::default();
     s.execute("comp.new", json!({"width":64,"height":36,"duration":1})).unwrap();
     s.execute("layer.newSolid", json!({"name":"Plate","color":"#406080"})).unwrap();
-    let fx = s.execute("effect.apply", json!({"effect":"Lumetri Color"})).unwrap()["effects"][0].as_u64().unwrap();
+    let fx = s.execute("effect.apply", json!({"effect":"Color Grading"})).unwrap()["effects"][0].as_u64().unwrap();
     let next = s.execute("effect.apply", json!({"effect":"Checkbox Control"})).unwrap()["effects"][0].as_u64().unwrap();
     let g = s.active_comp().unwrap().layers[0].props.find_group(fx).unwrap();
     let basic = g.sub("basicCorrection").unwrap();
diff --git a/crates/ui-egui/tests/ui_presets_folder.rs b/crates/ui-egui/tests/it/ui_presets_folder.rs
similarity index 93%
rename from crates/ui-egui/tests/ui_presets_folder.rs
rename to crates/ui-egui/tests/it/ui_presets_folder.rs
index 93f34dd73..1bcd9189c 100644
--- a/crates/ui-egui/tests/ui_presets_folder.rs
+++ b/crates/ui-egui/tests/it/ui_presets_folder.rs
@@ -1,5 +1,6 @@
 //! Effects & Presets: copy the configured folder path through the contents menu.
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_ui_egui::panels::effects_presets::PresetFile;
 use effectcraft_ui_egui::{ControlRequest, EffectcraftApp, control, dock::PanelKind};
@@ -37,7 +38,8 @@ fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) -> Vec<String> {
 fn presets_menu_copies_the_configured_folder_without_editing_the_project() {
     let expected = expected_folder();
     for language in ["en", "ja"] {
-        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| {
+        // The `ja` run draws Japanese menu text, which needs an installed CJK face.
+        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).allow_missing_glyphs().build_eframe(|_| {
             let mut app = EffectcraftApp::new(Session::default());
             app.session.prefs.general.language = language.into();
             app.ui.start_screen = false;
@@ -51,7 +53,7 @@ fn presets_menu_copies_the_configured_folder_without_editing_the_project() {
         click(&mut h, "effects.menu");
         h.run_steps(3);
         if let Ok(path) = std::env::var("PRESETS_FOLDER_SNAPSHOT") {
-            h.render().unwrap().save(path).unwrap();
+            h.render_serialized().unwrap().save(path).unwrap();
         }
         assert_eq!(click(&mut h, "effects.copyPresetsFolderPath"), [expected.as_str()]);
         h.run_steps(2);
@@ -69,7 +71,8 @@ fn presets_folder_control_command_returns_the_path_or_a_configuration_error() {
     let mut reply = None;
     let mut output = ctx.run_ui(Default::default(), |ui| {
         let (request, _rx) = ControlRequest::new("ui.menu.invoke", json!({"id": "effects.copyPresetsFolderPath"}));
-        reply = match control::handle(&mut app, ui.ctx(), &request) {
+        let now = app.now();
+        reply = match control::handle(&mut app, ui.ctx(), &request, now) {
             control::Outcome::Done(value) => Some(value),
             _ => panic!("expected an immediate reply"),
         };
@@ -128,7 +131,7 @@ fn shared_preset_rows_search_apply_and_undo_the_selected_definition() {
     h.run_steps(3);
     let shared = std::sync::Arc::new(entries);
     let now = h.ctx.input(|i| i.time);
-    h.ctx.data_mut(|d| d.insert_temp(egui::Id::new("fx-user-presets"), (now, shared.clone())));
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("fx-user-presets"), (now, shared.clone())));
     let search = |h: &mut Harness<'_, EffectcraftApp>, text: &str| {
         click(h, "effects.search");
         h.input_mut().events.push(Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
@@ -154,13 +157,13 @@ fn shared_preset_rows_search_apply_and_undo_the_selected_definition() {
         assert_eq!(h.state().session.active_comp().unwrap().layers[0].props.prop("transform/opacity").unwrap().value.as_f64(), expected);
         assert_eq!(h.state().session.history.undo.len(), history + 1);
         if let Ok(dir) = std::env::var("PRESET_CACHE_SNAPSHOTS") {
-            h.render().unwrap().save(format!("{dir}/{name}.png")).unwrap();
+            h.render_serialized().unwrap().save(format!("{dir}/{name}.png")).unwrap();
         }
         h.state_mut().session.execute("edit.undo", json!({})).unwrap();
         h.run_steps(2);
         assert_eq!(h.state().session.active_comp().unwrap().layers[0].props.prop("transform/opacity").unwrap().value.as_f64(), 100.0);
     }
-    let (_, cached) = h.ctx.data(|d| d.get_temp::<(f64, std::sync::Arc<Vec<PresetFile>>)>(egui::Id::new("fx-user-presets"))).unwrap();
+    let (_, cached) = h.ctx.data(|d| d.get_temp::<(f64, std::sync::Arc<Vec<PresetFile>>)>(egui::Id::unique("fx-user-presets"))).unwrap();
     assert!(std::sync::Arc::ptr_eq(&shared, &cached));
     assert_eq!(shared.iter().map(|p| p.name.as_str()).collect::<Vec<_>>(), ["Custom Cache A", "Custom Cache B"]);
 }
diff --git a/crates/ui-egui/tests/ui_preview_align.rs b/crates/ui-egui/tests/it/ui_preview_align.rs
similarity index 84%
rename from crates/ui-egui/tests/ui_preview_align.rs
rename to crates/ui-egui/tests/it/ui_preview_align.rs
index e9b8d6c44..1469a5e9e 100644
--- a/crates/ui-egui/tests/ui_preview_align.rs
+++ b/crates/ui-egui/tests/it/ui_preview_align.rs
@@ -259,6 +259,49 @@ fn cache_frames_when_idle_fills_the_work_area() {
     assert_eq!(n, 240, "the work area is cached while idle");
 }
 
+/// A preview that plays into frames it already cached (after a loop) keeps rendering the next
+/// uncached ones: the prefetch window used to end within the cached run, and the workers stood
+/// idle until the playhead came near its end.
+#[test]
+fn playback_prefetches_past_the_cached_frames_ahead() {
+    let mut h = harness();
+    let cid = h.state().session.active_comp_id().unwrap();
+    let series = h.state().shown_series(cid);
+    let scale = series.scale as f64 / 1000.0;
+    // The first 120 frames (5 s) are cached: more than the widest old window (16 workers × 6).
+    for f in 0..120 {
+        h.state().request_frame(cid, f, scale);
+    }
+    for _ in 0..4000 {
+        if h.state().frames.cached_frames(&series).len() >= 120 && h.state().frames.inflight() == 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    assert_eq!(h.state().frames.cached_frames(&series), (0..120).collect::<Vec<_>>());
+    // Rendering/instrumentation time must not move the playhead near the end of the
+    // cached run. Exercise real prefetch workers while holding playback in its first second.
+    h.state_mut().use_manual_clock();
+    h.state_mut().session.set_time(Tick::ZERO);
+    invoke(&mut h, "playback.toggle", json!({}));
+    h.state_mut().clock_mut().advance(0.25);
+    h.run_steps(2);
+    assert!(h.state().playback.playing);
+    let cur = h.state().session.time();
+    assert!(cur > Tick::ZERO, "playback advances with the manual clock");
+    assert!(cur < Tick::from_seconds_f64(1.0), "{cur:?}");
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
+    while std::time::Instant::now() < deadline {
+        if h.state().frames.cached_frames(&series).iter().any(|&f| f >= 120) {
+            break;
+        }
+        h.step();
+        std::thread::sleep(std::time::Duration::from_millis(1));
+        assert_eq!(h.state().session.time(), cur, "worker waits do not advance playback");
+    }
+    assert!(h.state().frames.cached_frames(&series).iter().any(|&f| f >= 120), "frames past the cached run render while it plays the first second");
+}
+
 #[test]
 fn cache_frames_when_idle_survives_an_inverted_work_area() {
     let mut h = harness();
diff --git a/crates/ui-egui/tests/ui_project_delete.rs b/crates/ui-egui/tests/it/ui_project_delete.rs
similarity index 92%
rename from crates/ui-egui/tests/ui_project_delete.rs
rename to crates/ui-egui/tests/it/ui_project_delete.rs
index f217c29db..2a395cf4b 100644
--- a/crates/ui-egui/tests/ui_project_delete.rs
+++ b/crates/ui-egui/tests/it/ui_project_delete.rs
@@ -364,3 +364,29 @@ fn a_cut_is_read_with_the_modifiers_where_it_is_in_the_frame() {
         assert_eq!(h.state().session.project.item(solid).is_none(), deletes, "case {n}: {events:?} after {before:?}");
     }
 }
+
+/// An open text edit stands down the Project-panel Clear redirect: the composition being typed
+/// into must not be deleted out from under it, with no confirmation when nothing uses it (#2227).
+#[test]
+fn clear_with_the_project_focused_stands_down_during_a_text_edit() {
+    let (mut h, _, _) = harness();
+    let working = h.state().session.active_comp_id().unwrap();
+    // the composition being typed into is also the Project panel's selection, as when it was opened
+    click(&mut h, &format!("project.item.{}.name", working.0), Modifiers::NONE);
+    let text = h.state_mut().session.execute("layer.newText", json!({"text": "Title", "size": 80})).unwrap()["layer"].as_u64().unwrap();
+    h.state_mut().session.execute("text.edit", json!({"layer": text, "created": true})).unwrap();
+    h.state_mut().ui.focused = PanelKind::Project;
+    h.run_steps(2);
+    assert!(h.state().session.state.project_selection.contains(&working), "the comp is the project selection");
+    let project = h.state().session.project.clone();
+
+    // Edit > Clear (the menu, or the control channel) dispatches through `invoke`
+    let ctx = h.ctx.clone();
+    let cleared = effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "edit.clear", json!({}));
+    h.run_steps(3);
+
+    cleared.expect("Clear stands down during a text edit");
+    assert!(h.state().session.project.item(working).is_some(), "the composition being typed into survives");
+    assert_eq!(h.state().session.project, project, "nothing was deleted");
+    assert!(h.state().session.state.text_edit.is_some(), "the text edit stays open");
+}
diff --git a/crates/ui-egui/tests/it/ui_project_duplicate.rs b/crates/ui-egui/tests/it/ui_project_duplicate.rs
new file mode 100644
index 000000000..2037c278b
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_project_duplicate.rs
@@ -0,0 +1,172 @@
+//! #2207: Duplicate is reachable from a Project row's context menu, with the same targets,
+//! naming, undo and shortcut preset as Edit > Duplicate.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::ItemId;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use effectcraft_ui_egui::menus::{parse_shortcut, shortcut_text};
+use egui::{Event, Key, Modifiers, PointerButton, Rect, Shape, pos2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+const DUPLICATE: &str = "project.context.duplicate";
+
+fn harness() -> (Harness<'static, EffectcraftApp>, ItemId, ItemId, ItemId) {
+    let mut s = Session::default();
+    let mut comp =
+        |name: &str| ItemId(s.execute("comp.new", json!({"name": name, "width": 64, "height": 64, "duration": 1})).unwrap()["comp"].as_u64().unwrap());
+    let main = comp("Main");
+    let other = comp("Other");
+    let folder = ItemId(s.execute("project.newFolder", json!({"name": "Bin"})).unwrap()["item"].as_u64().unwrap());
+    s.execute("project.select", json!({"items": []})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    (h, main, other, folder)
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3]))
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str, button: PointerButton, modifiers: Modifiers) {
+    let p = rect(h, id).center();
+    h.input_mut().events.push(Event::ModifiersChanged(modifiers));
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button, pressed: true, modifiers });
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button, pressed: false, modifiers });
+    h.run_steps(3);
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+}
+
+fn row(h: &mut Harness<'_, EffectcraftApp>, item: ItemId, button: PointerButton, modifiers: Modifiers) {
+    click(h, &format!("project.item.{}.name", item.0), button, modifiers);
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers });
+    h.step();
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers });
+    h.run_steps(2);
+}
+
+fn copy_name(h: &Harness<'_, EffectcraftApp>, id: ItemId) -> String {
+    h.state().session.project.item(id).unwrap().name.clone()
+}
+
+fn menu_text(h: &Harness<'_, EffectcraftApp>, text: &str) -> bool {
+    fn contains(shape: &Shape, bounds: Rect, text: &str) -> bool {
+        match shape {
+            Shape::Text(t) => bounds.contains(t.pos) && t.galley.text() == text,
+            Shape::Vec(shapes) => shapes.iter().any(|s| contains(s, bounds, text)),
+            _ => false,
+        }
+    }
+    let bounds = rect(h, DUPLICATE);
+    h.output().shapes.iter().any(|s| contains(&s.shape, bounds, text))
+}
+
+#[test]
+fn unselected_row_duplicates_only_itself_and_undo_restores_the_project() {
+    let (mut h, main, other, _) = harness();
+    row(&mut h, other, PointerButton::Primary, Modifiers::NONE);
+    let before = h.state().session.project.clone();
+    let undo = h.state().session.history.undo.len();
+    row(&mut h, main, PointerButton::Secondary, Modifiers::NONE);
+    assert_eq!(h.state().session.state.project_selection, [main]);
+    assert!(menu_text(&h, &shortcut_text("Cmd+D")), "the default platform shortcut is shown");
+    click(&mut h, DUPLICATE, PointerButton::Primary, Modifiers::NONE);
+    let selected = h.state().session.state.project_selection.clone();
+    let [copy] = selected.as_slice() else { panic!("one selected copy") };
+    assert!(!before.items.contains_key(copy), "the copy has a fresh ID");
+    assert_eq!(copy_name(&h, *copy), "Main 2");
+    assert_eq!(copy_name(&h, other), "Other");
+    assert_eq!(h.state().session.project.items.len(), before.items.len() + 1);
+    assert_eq!(h.state().session.history.undo.len(), undo + 1);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(h.state().session.project, before);
+}
+
+#[test]
+fn selected_rows_duplicate_together_in_selection_order_with_numbered_names() {
+    let (mut h, main, other, _) = harness();
+    // Deliberately reverse alphabetical row order: command targets retain selection order.
+    row(&mut h, other, PointerButton::Primary, Modifiers::NONE);
+    row(&mut h, main, PointerButton::Primary, Modifiers::COMMAND);
+    assert_eq!(h.state().session.state.project_selection, [other, main]);
+    let before = h.state().session.project.clone();
+    let undo = h.state().session.history.undo.len();
+    row(&mut h, main, PointerButton::Secondary, Modifiers::NONE);
+    click(&mut h, DUPLICATE, PointerButton::Primary, Modifiers::NONE);
+    let selected = h.state().session.state.project_selection.clone();
+    let [a, b] = selected.as_slice() else { panic!("two selected copies") };
+    assert_ne!(a, b);
+    assert!(selected.iter().all(|id| !before.items.contains_key(id)));
+    assert_eq!((copy_name(&h, *a), copy_name(&h, *b)), ("Other 2".to_string(), "Main 2".to_string()));
+    assert_eq!(h.state().session.project.items.len(), before.items.len() + 2);
+    assert_eq!(h.state().session.history.undo.len(), undo + 1);
+    // Duplicate the selected copies again: the existing engine numbering continues.
+    row(&mut h, *b, PointerButton::Secondary, Modifiers::NONE);
+    click(&mut h, DUPLICATE, PointerButton::Primary, Modifiers::NONE);
+    let names: Vec<_> = h.state().session.state.project_selection.iter().map(|id| copy_name(&h, *id)).collect();
+    assert_eq!(names, ["Other 3", "Main 3"]);
+}
+
+#[test]
+fn folders_and_mixed_selections_disable_duplicate_without_partial_changes() {
+    for mixed in [false, true] {
+        let (mut h, main, _, folder) = harness();
+        row(&mut h, main, PointerButton::Primary, Modifiers::NONE);
+        if mixed {
+            row(&mut h, folder, PointerButton::Primary, Modifiers::COMMAND);
+        }
+        // An unselected folder replaces the selection; a selected non-folder keeps the mixed set.
+        row(&mut h, if mixed { main } else { folder }, PointerButton::Secondary, Modifiers::NONE);
+        let before = h.state().session.project.clone();
+        let selected = h.state().session.state.project_selection.clone();
+        assert!(selected.contains(&folder));
+        let undo = h.state().session.history.undo.len();
+        let status = h.state().ui.status.clone();
+        click(&mut h, DUPLICATE, PointerButton::Primary, Modifiers::NONE);
+        assert_eq!(h.state().session.project, before, "mixed={mixed}: no partial copy");
+        assert_eq!(h.state().session.state.project_selection, selected);
+        assert_eq!(h.state().session.history.undo.len(), undo);
+        assert_eq!(h.state().ui.status, status, "no failing engine command was dispatched");
+    }
+}
+
+#[test]
+fn duplicate_shortcut_still_dispatches_and_the_menu_tracks_rebinding_and_unbinding() {
+    let (mut h, main, _, _) = harness();
+    row(&mut h, main, PointerButton::Primary, Modifiers::NONE);
+    assert_eq!(h.state().ui.focused, PanelKind::Project);
+    let (d, command) = parse_shortcut("Cmd+D").unwrap();
+    key(&mut h, command, d);
+    let selected = h.state().session.state.project_selection.clone();
+    let [copy] = selected.as_slice() else { panic!("one shortcut copy") };
+    assert_ne!(*copy, main);
+    assert_eq!(copy_name(&h, *copy), "Main 2");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    h.state_mut().session.execute("shortcuts.set", json!({"command": "edit.duplicate", "keys": "F6"})).unwrap();
+    row(&mut h, main, PointerButton::Secondary, Modifiers::NONE);
+    assert!(menu_text(&h, "F6"));
+    assert!(!menu_text(&h, &shortcut_text("Cmd+D")));
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    row(&mut h, main, PointerButton::Primary, Modifiers::NONE);
+    let before = h.state().session.project.clone();
+    key(&mut h, command, d);
+    assert_eq!(h.state().session.project, before, "the former shortcut stays unbound");
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!(h.state().session.project.items.len(), before.items.len() + 1);
+    h.state_mut().session.execute("shortcuts.set", json!({"command": "edit.duplicate", "keys": null})).unwrap();
+    row(&mut h, main, PointerButton::Secondary, Modifiers::NONE);
+    assert!(!menu_text(&h, "F6"));
+    assert!(!menu_text(&h, &shortcut_text("Cmd+D")));
+    click(&mut h, DUPLICATE, PointerButton::Primary, Modifiers::NONE);
+    assert_eq!(h.state().session.project.items.len(), before.items.len() + 2, "unbinding keeps the menu action usable");
+}
diff --git a/crates/ui-egui/tests/ui_project_keyboard.rs b/crates/ui-egui/tests/it/ui_project_keyboard.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_project_keyboard.rs
rename to crates/ui-egui/tests/it/ui_project_keyboard.rs
diff --git a/crates/ui-egui/tests/ui_project_new_folder.rs b/crates/ui-egui/tests/it/ui_project_new_folder.rs
similarity index 98%
rename from crates/ui-egui/tests/ui_project_new_folder.rs
rename to crates/ui-egui/tests/it/ui_project_new_folder.rs
index 0ee75c7f9..63a1c6ae3 100644
--- a/crates/ui-egui/tests/ui_project_new_folder.rs
+++ b/crates/ui-egui/tests/it/ui_project_new_folder.rs
@@ -150,7 +150,8 @@ fn engine_execute_only_creates_the_folder() {
     let before = folders(&h);
     let ctx = h.ctx.clone();
     let (req, _rx) = ControlRequest::new("engine.execute", json!({"command": "project.newFolder"}));
-    let _ = control::handle(h.state_mut(), &ctx, &req);
+    let now = h.state().now();
+    let _ = control::handle(h.state_mut(), &ctx, &req, now);
     h.run_steps(3);
     let [folder] = new_folders(&h, &before)[..] else { panic!("one new folder") };
     assert!(!renaming(&h, folder), "no name field for an agent's folder");
diff --git a/crates/ui-egui/tests/ui_project_rows.rs b/crates/ui-egui/tests/it/ui_project_rows.rs
similarity index 99%
rename from crates/ui-egui/tests/ui_project_rows.rs
rename to crates/ui-egui/tests/it/ui_project_rows.rs
index 27ce5e693..b8638bbd1 100644
--- a/crates/ui-egui/tests/ui_project_rows.rs
+++ b/crates/ui-egui/tests/it/ui_project_rows.rs
@@ -274,12 +274,13 @@ fn comp_context_menu_opens_that_comps_settings() {
     assert_eq!(h.state().dialog, Some(Dialog::CompSettings));
     assert_eq!(h.state().session.active_comp_id(), Some(main), "the viewer keeps its comp");
     // A new name, then OK: Side's own size goes back to Side under it. Main's values in the
-    // dialog, or OK writing to the viewer's comp, would resize or rename the wrong one.
+    // dialog, or OK writing to the viewer's comp, would resize or rename the wrong one. The
+    // dialog previews the name as it is typed; OK keeps that as one undo step.
+    let undo = h.state().session.history.undo.len();
     click(&mut h, "dialog.comp.name");
     h.input_mut().events.push(Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
     h.input_mut().events.push(Event::Text("Side 2".into()));
     h.run_steps(2);
-    let undo = h.state().session.history.undo.len();
     h.input_mut().events.push(Event::Key { key: egui::Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
     h.run_steps(2);
     assert_eq!(h.state().dialog, None, "OK closed the dialog");
diff --git a/crates/ui-egui/tests/ui_quick_offset.rs b/crates/ui-egui/tests/it/ui_quick_offset.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_quick_offset.rs
rename to crates/ui-egui/tests/it/ui_quick_offset.rs
diff --git a/crates/ui-egui/tests/ui_ram_preview.rs b/crates/ui-egui/tests/it/ui_ram_preview.rs
similarity index 95%
rename from crates/ui-egui/tests/ui_ram_preview.rs
rename to crates/ui-egui/tests/it/ui_ram_preview.rs
index 930c43eb7..8b3748a3f 100644
--- a/crates/ui-egui/tests/ui_ram_preview.rs
+++ b/crates/ui-egui/tests/it/ui_ram_preview.rs
@@ -90,8 +90,11 @@ fn prefetch_waits_while_edits_keep_coming() {
     let mut s = Session::default();
     let c = s.execute("comp.new", json!({"name": "Drag", "width": 64, "height": 36, "duration": 2})).unwrap()["comp"].as_u64().unwrap();
     let solid = s.execute("layer.newSolid", json!({"color": "#3080ff", "width": 16, "height": 16})).unwrap()["layer"].as_u64().unwrap();
-    // Short steps: input time advances 50 ms per frame.
+    // Short steps between edits; the app clock below is advanced explicitly.
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(0.05).build_eframe(|_| EffectcraftApp::new(s));
+    // Prefetch waits for EDIT_QUIET on the app clock; a manual clock makes the pause
+    // deterministic instead of depending on how long the test host took to run the steps.
+    h.state_mut().use_manual_clock();
     settle(&mut h);
     let frame = |h: &Harness<'_, EffectcraftApp>| {
         let app = h.state();
@@ -116,6 +119,8 @@ fn prefetch_waits_while_edits_keep_coming() {
         assert_eq!(h.state().frames.inflight(), 0, "edit {i}");
     }
     // The edits pause: the frames around the current one fill in.
+    h.state_mut().clock_mut().advance(1.0);
+    h.run_steps(1);
     settle(&mut h);
     for _ in 0..20 {
         h.step();
diff --git a/crates/ui-egui/tests/ui_render_queue.rs b/crates/ui-egui/tests/it/ui_render_queue.rs
similarity index 95%
rename from crates/ui-egui/tests/ui_render_queue.rs
rename to crates/ui-egui/tests/it/ui_render_queue.rs
index 72e585eb1..562b7a1c4 100644
--- a/crates/ui-egui/tests/ui_render_queue.rs
+++ b/crates/ui-egui/tests/it/ui_render_queue.rs
@@ -31,7 +31,7 @@ fn render_settings_template_applies_from_a_menu_moved_to_fit_the_window() {
     let mut app = Some(EffectcraftApp::new(s));
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app.take().expect("app"));
     // Twirl the item open, as clicking its twirl does.
-    h.ctx.data_mut(|d| d.insert_temp(egui::Id::new("rq-ui"), (vec![id], None::<u64>)));
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("rq-ui"), (vec![id], None::<u64>)));
     h.state_mut().show_panel(PanelKind::RenderQueue);
     h.run_steps(4);
     let dd = h.state().auto.find(&format!("renderQueue.item.{id}.renderSettings")).expect("Render Settings menu").clone();
@@ -80,7 +80,7 @@ fn clicking_the_output_file_name_opens_the_save_dialog() {
     }));
     let mut app = Some(app);
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app.take().expect("app"));
-    h.ctx.data_mut(|d| d.insert_temp(egui::Id::new("rq-ui"), (vec![id], None::<u64>)));
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("rq-ui"), (vec![id], None::<u64>)));
     h.state_mut().show_panel(PanelKind::RenderQueue);
     h.run_steps(4);
     let path = h.state().auto.find(&format!("renderQueue.item.{id}.outputPath")).expect("the output file name").clone();
@@ -88,7 +88,7 @@ fn clicking_the_output_file_name_opens_the_save_dialog() {
     click_with(&mut h, at, Modifiers::NONE);
     assert_eq!(*asked.borrow(), [(expected_default, ext.to_string())], "the dialog opened at the current output");
     assert_eq!(h.state().session.project.render_queue[0].output.output, chosen);
-    let editing = |h: &Harness<'_, EffectcraftApp>| h.ctx.data(|d| d.get_temp::<(u64, String)>(egui::Id::new("rq-edit-output")));
+    let editing = |h: &Harness<'_, EffectcraftApp>| h.ctx.data(|d| d.get_temp::<(u64, String)>(egui::Id::unique("rq-edit-output")));
     assert_eq!(editing(&h), None, "no inline editor");
     // Alt-click edits the template text instead.
     click_with(&mut h, at, Modifiers::ALT);
diff --git a/crates/ui-egui/tests/it/ui_render_queue_keyboard.rs b/crates/ui-egui/tests/it/ui_render_queue_keyboard.rs
new file mode 100644
index 000000000..31c3ba823
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_render_queue_keyboard.rs
@@ -0,0 +1,228 @@
+//! Render Queue keyboard operation and accessible names (docs/gaps.md gap 25): queue items are
+//! tree items (named by number, comp and status; selected; open or closed); the arrow keys, Home /
+//! End, Right / Left, Enter and Delete work them; the buttons, the check boxes, the twirls and the
+//! drop-downs have names and states; a drop-down opens from the keyboard and closes with the focus
+//! back on it; the Templates dialog is named.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::accesskit::Role;
+use egui::{Event, Key, Modifiers, Pos2, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    for name in ["Alpha", "Beta", "Gamma"] {
+        let comp = s.execute("comp.new", json!({"name": name, "width": 320, "height": 180, "duration": 4})).unwrap()["comp"].as_u64().unwrap();
+        s.execute("renderQueue.add", json!({"comp": comp})).unwrap();
+    }
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::RenderQueue);
+    h.run_steps(4);
+    h
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).clone();
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = center(h, id);
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn focused(h: &Harness<'_, EffectcraftApp>) -> Option<(Role, String)> {
+    h.root().children_recursive().find(|n| n.is_focused()).map(|n| (n.accesskit_node().role(), n.accesskit_node().label().unwrap_or_default()))
+}
+
+fn queue_len(h: &Harness<'_, EffectcraftApp>) -> usize {
+    h.state().session.project.render_queue.len()
+}
+
+fn row_name(h: &Harness<'_, EffectcraftApp>, n: usize) -> String {
+    h.query_all_by_role(Role::TreeItem).map(|r| r.accesskit_node().label().unwrap_or_default()).find(|l| l.starts_with(&format!("{n}. "))).unwrap_or_default()
+}
+
+#[test]
+fn rows_are_named_tree_items_with_selected_and_open_state() {
+    let mut h = harness();
+    let first = row_name(&h, 1);
+    assert!(first.starts_with("1. Alpha, "), "number, comp and status: {first}");
+    let node = h.get_by_role_and_label(Role::TreeItem, &first);
+    assert_eq!(node.accesskit_node().is_selected(), Some(false));
+    assert_eq!(node.accesskit_node().data().is_expanded(), Some(false));
+    assert_eq!(node.accesskit_node().data().level(), Some(1));
+    click(&mut h, "renderQueue.item.1.twirl");
+    let node = h.get_by_role_and_label(Role::TreeItem, &first);
+    assert_eq!(node.accesskit_node().data().is_expanded(), Some(true), "the open item says so");
+    let twirl = h.get_by_label("Hide details of Alpha");
+    assert_eq!(twirl.accesskit_node().role(), Role::Button);
+    assert_eq!(twirl.accesskit_node().data().is_expanded(), Some(true));
+    // The settings drop-downs of the open item: what they set and what they are set to.
+    let settings = h.get_by_role_and_label(Role::ComboBox, "Render Settings");
+    assert!(settings.accesskit_node().value().is_some_and(|v| !v.is_empty()));
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Output Module").is_some());
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Log").is_some());
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Output To").is_some());
+    assert!(h.query_by_role_and_label(Role::Button, "Render").is_some());
+    let notify = h.get_by_role_and_label(Role::CheckBox, "Notify");
+    assert!(notify.accesskit_node().toggled().is_some());
+    let render = h.get_by_role_and_label(Role::CheckBox, "Render: Alpha");
+    assert_eq!(render.accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
+    assert_eq!(h.get_by_role(Role::ProgressIndicator).accesskit_node().data().numeric_value(), Some(0.0));
+}
+
+#[test]
+fn arrows_home_end_right_left_enter_and_delete_work_the_rows() {
+    let mut h = harness();
+    h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).focus();
+    h.run_steps(3);
+    assert_eq!(focused(&h).map(|f| f.1), Some(row_name(&h, 1)));
+    let selected = |h: &Harness<'_, EffectcraftApp>| {
+        h.query_all_by_role(Role::TreeItem)
+            .filter(|n| n.accesskit_node().is_selected() == Some(true))
+            .map(|n| n.accesskit_node().label().unwrap_or_default())
+            .filter(|l| l.starts_with(|c: char| c.is_ascii_digit()))
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(selected(&h), vec![row_name(&h, 1)], "a focused row is selected");
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(row_name(&h, 2)), "Down Arrow moves to the next item and the focus goes with it");
+    assert_eq!(h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 2)).accesskit_node().is_selected(), Some(true));
+    key(&mut h, Key::End, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(row_name(&h, 3)));
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(row_name(&h, 3)), "Down Arrow stays on the last item");
+    key(&mut h, Key::Home, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(row_name(&h, 1)));
+    key(&mut h, Key::ArrowRight, Modifiers::NONE);
+    assert_eq!(h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).accesskit_node().data().is_expanded(), Some(true), "Right Arrow opens the item");
+    key(&mut h, Key::ArrowLeft, Modifiers::NONE);
+    assert_eq!(h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).accesskit_node().data().is_expanded(), Some(false), "Left Arrow closes it");
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_eq!(h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).accesskit_node().data().is_expanded(), Some(true), "Enter toggles it");
+    key(&mut h, Key::Space, Modifiers::NONE);
+    assert_eq!(h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).accesskit_node().data().is_expanded(), Some(false), "Space toggles it back");
+    assert!(!h.state().playback.playing && !h.state().playback.caching && h.state().playback.plan.is_none(), "Space on a row does not start a preview");
+    // Delete removes the selected item, as it does with the mouse's selection.
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(queue_len(&h), 3);
+    key(&mut h, Key::Delete, Modifiers::NONE);
+    assert_eq!(queue_len(&h), 2, "Delete removes the selected item");
+}
+
+#[test]
+fn tab_reaches_every_control_of_a_row() {
+    let mut h = harness();
+    h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).focus();
+    h.run_steps(3);
+    let mut seen = vec![focused(&h).unwrap()];
+    for _ in 0..40 {
+        key(&mut h, Key::Tab, Modifiers::NONE);
+        match focused(&h) {
+            Some(f) if !seen.contains(&f) => seen.push(f),
+            _ => {}
+        }
+    }
+    let names: Vec<&str> = seen.iter().map(|s| s.1.as_str()).collect();
+    for want in ["Show details of Alpha", "Render: Alpha", "Show details of Beta", "Render: Beta"] {
+        assert!(names.contains(&want), "Tab reaches `{want}`; reached {names:?}");
+    }
+}
+
+#[test]
+fn a_drop_down_opens_from_the_keyboard_and_gives_the_focus_back() {
+    let mut h = harness();
+    click(&mut h, "renderQueue.item.1.twirl");
+    h.get_by_role_and_label(Role::ComboBox, "Render Settings").focus();
+    h.run_steps(3);
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    let (role, first_entry) = focused(&h).expect("the first entry has the focus");
+    assert_ne!(role, Role::ComboBox, "the keyboard is in the menu: {first_entry}");
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    let second = focused(&h).expect("Down Arrow moves to the next entry").1;
+    assert_ne!(second, first_entry);
+    key(&mut h, Key::ArrowUp, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(first_entry), "Up Arrow moves back");
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.0), Some(Role::ComboBox), "choosing an entry gives the focus back to the drop-down");
+}
+
+#[test]
+fn the_check_box_and_the_buttons_work_from_the_keyboard() {
+    let mut h = harness();
+    let before = h.state().session.project.render_queue.first().map(|i| i.render);
+    h.get_by_role_and_label(Role::CheckBox, "Render: Alpha").focus();
+    h.run_steps(3);
+    key(&mut h, Key::Space, Modifiers::NONE);
+    assert_ne!(h.state().session.project.render_queue.first().map(|i| i.render), before, "Space toggles the Render check box");
+    let notify = h.state().session.project.render_prefs.notify;
+    h.get_by_role_and_label(Role::CheckBox, "Notify").focus();
+    h.run_steps(3);
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_ne!(h.state().session.project.render_prefs.notify, notify, "Enter toggles Notify");
+}
+
+#[test]
+fn the_templates_dialog_is_named() {
+    let mut h = harness();
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "app.templates", json!({"kind": "renderSettings"})).unwrap();
+    h.run_steps(4);
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Settings Name").is_some());
+    assert!(h.query_by_role_and_label(Role::TextInput, "template name").is_some());
+    for name in ["Duplicate", "Delete", "   OK   "] {
+        assert_eq!(h.get_by_role_and_label(Role::Button, name).accesskit_node().role(), Role::Button, "{name}");
+    }
+    let defaults = h.query_all_by_role(Role::ComboBox).count();
+    assert!(defaults >= 4, "the default slots are drop-downs: {defaults}");
+}
+
+/// A pick with the mouse leaves no widget with the keyboard focus: egui pauses the application's
+/// shortcuts (Space, Ctrl+Z) while one has it (#776's rule for the Project panel).
+#[test]
+fn a_pick_with_the_mouse_leaves_no_keyboard_focus() {
+    let mut h = harness();
+    click(&mut h, "renderQueue.item.1.twirl");
+    click(&mut h, "renderQueue.item.1.renderSettings");
+    assert!(h.ctx.memory(|m| m.focused()).is_none(), "opening a drop-down with the mouse takes no keyboard focus");
+    let current = h.state().session.project.render_queue[0].settings.name.clone();
+    let template =
+        h.state().session.project.render_templates.render_settings_list().into_iter().map(|t| t.name).find(|n| *n != current).expect("a second template");
+    h.get_by_label_contains(&template).click();
+    h.run_steps(4);
+    assert!(h.ctx.memory(|m| m.focused()).is_none(), "choosing an entry with the mouse leaves no keyboard focus");
+    assert_eq!(h.state().session.project.render_queue[0].settings.name, template, "the pick applied the template");
+}
+
+/// Enter after a click in the panel belongs to the panel (it opens or applies the row), not to
+/// the layer rename the Timeline binds to it.
+#[test]
+fn enter_after_a_click_opens_the_item_and_does_not_rename_a_layer() {
+    let mut h = harness();
+    h.state_mut().session.execute("layer.newSolid", json!({"name": "Red", "color": "#c04040"})).unwrap();
+    h.run_steps(3);
+    click(&mut h, "renderQueue.item.1.row");
+    assert_eq!(h.state().ui.focused, PanelKind::RenderQueue);
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert_eq!(h.get_by_role_and_label(Role::TreeItem, &row_name(&h, 1)).accesskit_node().data().is_expanded(), Some(true), "Enter opens the clicked item");
+    assert!(h.state().auto.query("timeline.layer.").iter().all(|e| !e.id.ends_with(".nameEdit")), "no layer rename started");
+}
diff --git a/crates/ui-egui/tests/it/ui_roto_objects.rs b/crates/ui-egui/tests/it/ui_roto_objects.rs
new file mode 100644
index 000000000..cbf52d07d
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_roto_objects.rs
@@ -0,0 +1,100 @@
+//! A Roto Brush instance with two objects: the Layer panel's boundary view outlines each in its own colour, and
+//! Show Object limits the matte to one (egui_kittest, a real render). A stand-in tracker follows two regions, so no
+//! weights are needed. `ROTO_OBJECTS_SNAPSHOT=/abs/out.png` also saves the rendered panel.
+
+use std::sync::Arc;
+
+use effectcraft_engine::Session;
+use effectcraft_segment::{ClipFrame, MaskModel, ModelInfo, ObjectTracker, Prompt, TrackRequest, TrackedFrame};
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// Follows two fixed regions of the layer: object 0 on the left, object 1 on the right.
+struct TwoRegions;
+
+impl MaskModel for TwoRegions {
+    fn info(&self) -> &'static ModelInfo {
+        &effectcraft_segment::SAM2_TINY
+    }
+    fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+        Err("no weights".into())
+    }
+    fn tracker(&self) -> Option<&dyn ObjectTracker> {
+        Some(self)
+    }
+}
+
+impl ObjectTracker for TwoRegions {
+    fn track(
+        &self,
+        req: &TrackRequest,
+        frame: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+        _: &dyn Fn() -> bool,
+        out: &mut dyn FnMut(usize, i64, TrackedFrame),
+    ) -> effectcraft_segment::Result<()> {
+        for g in req.first..req.first + req.count as i64 {
+            let img = frame(g).ok_or("no frame")?;
+            for o in 0..req.objects.len() {
+                let (x0, x1) = if o == 0 { (img.w / 8, img.w * 3 / 8) } else { (img.w * 5 / 8, img.w * 7 / 8) };
+                let prob = (0..img.w * img.h)
+                    .map(|i| {
+                        let (x, y) = (i % img.w, i / img.w);
+                        f32::from(x >= x0 && x < x1 && y > img.h / 4 && y < img.h * 3 / 4)
+                    })
+                    .collect();
+                out(o, g, TrackedFrame { prob, w: img.w, h: img.h, confidence: 0.99, occluded: false });
+            }
+        }
+        Ok(())
+    }
+}
+
+/// Pixels of the viewer (above the panel's bar, whose object swatch has the same colour) within a few levels of `want`.
+fn count(image: &image::RgbaImage, want: [u8; 3]) -> usize {
+    let limit = image.height() * 54 / 100;
+    image.enumerate_pixels().filter(|(_, y, p)| *y < limit && p.0[..3].iter().zip(want).all(|(a, b)| a.abs_diff(b) <= 12)).count()
+}
+
+#[test]
+fn the_boundary_view_outlines_each_object_and_show_object_picks_one() {
+    let _gpu = crate::gpu_test::lock();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "View", "width": 640, "height": 360, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Box", "color": "#e04020", "width": 80, "height": 80})).unwrap();
+    let id = s.active_comp().unwrap().layers.iter().find(|l| l.name == "Box").unwrap().id.0;
+    for (object, x) in [(0, 22.0), (1, 58.0)] {
+        s.execute("roto.stroke", json!({"layer": id, "object": object, "points": [[x, 38.0], [x, 42.0]], "radius": 4})).unwrap();
+    }
+    let _model = crate::roto_model_guard::install(Arc::new(TwoRegions));
+    s.execute("roto.propagate", json!({"layer": id, "direction": "both", "wait": true})).unwrap();
+    let st = s.execute("roto.status", json!({"layer": id})).unwrap();
+    assert_eq!(st["objects"], json!([{"id": 0, "strokes": 1}, {"id": 1, "strokes": 1}]), "{st}");
+
+    // object 0 keeps the boundary colour (pink by default), object 1 is the first palette colour (blue-green)
+    let (pink, cyan) = ([255, 64, 191], [60, 200, 255]);
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h.state_mut().session.execute("layer.select", json!({"layers": [id]})).unwrap();
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.openLayer", json!({"layer": id})).unwrap();
+    h.run_steps(4);
+    assert_eq!(h.state().ui.focused, PanelKind::Layer);
+    let both = h.render().expect("the panel renders");
+    if let Some(path) = std::env::var_os("ROTO_OBJECTS_SNAPSHOT") {
+        both.save(path).unwrap();
+    }
+    // the bar offers to remove the current object's strokes, and says how many it has
+    assert!(h.state().auto.find("layerPanel.roto.clearObject").is_some(), "the remove button is on screen");
+    assert!(h.state().auto.find("layerPanel.roto.object").is_some_and(|e| e.label.contains("(1)")), "the object's stroke count is on the button");
+    let (a, b) = (count(&both, pink), count(&both, cyan));
+    assert!(a > 50 && b > 50, "both objects are outlined: {a} pink, {b} cyan pixels");
+
+    // Show Object 2 (object id 1): only its outline remains
+    h.state_mut().session.execute("prop.set", json!({"layer": id, "path": "effects/#1/rotoBrushMatte/object", "value": 2})).unwrap();
+    h.run_steps(4);
+    let one = h.render().expect("the panel renders");
+    let (a, b) = (count(&one, pink), count(&one, cyan));
+    assert!(a < 10 && b > 50, "only object 1 is shown: {a} pink, {b} cyan pixels");
+}
diff --git a/crates/ui-egui/tests/it/ui_roto_span_confidence.rs b/crates/ui-egui/tests/it/ui_roto_span_confidence.rs
new file mode 100644
index 000000000..d9730b778
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_roto_span_confidence.rs
@@ -0,0 +1,119 @@
+//! The Roto Brush span bar colours the frames a tracker followed by its confidence: green when it is sure,
+//! amber when it is doubtful, red when it is not, slate where the object was absent (egui_kittest, UI logic
+//! and a real render). A stand-in tracker supplies the confidences, so no weights are needed.
+//! `ROTO_SPAN_SNAPSHOT=/abs/out.png` also saves the rendered panel.
+
+use std::sync::Arc;
+
+use effectcraft_engine::Session;
+use effectcraft_segment::{ClipFrame, MaskModel, ModelInfo, ObjectTracker, Prompt, TrackRequest, TrackedFrame};
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// Follows a fixed disc; its confidence per frame is scripted.
+struct Scripted;
+
+impl MaskModel for Scripted {
+    fn info(&self) -> &'static ModelInfo {
+        &effectcraft_segment::SAM2_TINY
+    }
+    fn segment(&self, _: &[[f32; 3]], _: usize, _: usize, _: &Prompt) -> effectcraft_segment::Result<Vec<f32>> {
+        Err("no weights".into())
+    }
+    fn tracker(&self) -> Option<&dyn ObjectTracker> {
+        Some(self)
+    }
+}
+
+/// (confidence, occluded) of layer frame `f`: sure, doubtful, unsure, absent, sure again.
+fn script(f: i64) -> (f32, bool) {
+    match f {
+        0..=5 => (0.99, false),
+        6..=9 => (0.6, false),
+        10..=12 => (0.2, false),
+        13..=15 => (0.0, true),
+        _ => (0.99, false),
+    }
+}
+
+impl ObjectTracker for Scripted {
+    fn track(
+        &self,
+        req: &TrackRequest,
+        frame: &mut dyn FnMut(i64) -> Option<Arc<ClipFrame>>,
+        _: &dyn Fn() -> bool,
+        out: &mut dyn FnMut(usize, i64, TrackedFrame),
+    ) -> effectcraft_segment::Result<()> {
+        for g in req.first..req.first + req.count as i64 {
+            let img = frame(g).ok_or("no frame")?;
+            let (confidence, occluded) = script(g);
+            let prob = (0..img.w * img.h)
+                .map(|i| if !occluded && (i % img.w).abs_diff(img.w / 2) < img.w / 4 && (i / img.w).abs_diff(img.h / 2) < img.h / 4 { 1.0 } else { 0.0 })
+                .collect();
+            out(0, g, TrackedFrame { prob, w: img.w, h: img.h, confidence, occluded });
+        }
+        Ok(())
+    }
+}
+
+fn close(got: [u8; 4], want: [u8; 3]) -> bool {
+    got.iter().zip(want).all(|(a, b)| a.abs_diff(b) <= 24)
+}
+
+#[test]
+fn the_span_bar_shows_the_trackers_confidence() {
+    let _gpu = crate::gpu_test::lock();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "View", "width": 640, "height": 360, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"name": "Box", "color": "#e04020", "width": 80, "height": 80})).unwrap();
+    let id = s.active_comp().unwrap().layers.iter().find(|l| l.name == "Box").unwrap().id.0;
+    s.execute("roto.stroke", json!({"layer": id, "points": [[20.0, 40.0], [60.0, 40.0]], "radius": 6})).unwrap();
+    s.execute("roto.stroke", json!({"layer": id, "kind": "bg", "points": [[5.0, 5.0], [75.0, 5.0]], "radius": 4})).unwrap();
+    let _model = crate::roto_model_guard::install(Arc::new(Scripted));
+    // the model stays loaded while the panel draws (its id is part of the cache keys)
+    s.execute("roto.propagate", json!({"layer": id, "direction": "both", "wait": true})).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h.state_mut().session.execute("layer.select", json!({"layers": [id]})).unwrap();
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.openLayer", json!({"layer": id})).unwrap();
+    h.run_steps(4);
+    assert_eq!(h.state().ui.focused, PanelKind::Layer);
+
+    // the object picker is in the bar; "+" starts a new object, which the next stroke would belong to
+    assert!(h.state().auto.find("layerPanel.roto.object").is_some(), "the object picker is on screen");
+    assert!(h.state().auto.find("layerPanel.roto.newObject").is_some());
+    assert_eq!(h.state().session.state.roto.object, 0);
+    h.state_mut().session.execute("roto.options", json!({"object": 1})).unwrap();
+    h.run_steps(2);
+    assert_eq!(h.state().session.state.roto.object, 1);
+    h.state_mut().session.execute("roto.options", json!({"object": 0})).unwrap();
+    h.run_steps(2);
+    let track = h.state().auto.find("layerPanel.rotoSpan").expect("the span bar is on screen").rect;
+    let (comp, layer) = {
+        let comp = h.state().session.active_comp().unwrap().clone();
+        let layer = comp.layer(effectcraft_project::LayerId(id)).unwrap().clone();
+        (comp, layer)
+    };
+    let lim = effectcraft_engine::roto::frame_limits(&comp, &layer);
+    let n = (lim[1] - lim[0] + 1) as f32;
+    let image = h.render().expect("the panel renders");
+    if let Some(path) = std::env::var_os("ROTO_SPAN_SNAPSHOT") {
+        image.save(path).unwrap();
+    }
+    let scale = image.width() as f32 / 1600.0;
+    let sample = |f: i64| -> [u8; 4] {
+        let x = (track[0] + ((f - lim[0]) as f32 + 0.5) / n * track[2]) * scale;
+        let y = (track[1] + track[3] - 2.0) * scale;
+        image.get_pixel(x as u32, y as u32).0
+    };
+    // the colours the bar uses (see `trust_color`)
+    let (green, amber, red, slate) = ([70, 200, 90], [230, 180, 50], [220, 70, 60], [110, 118, 150]);
+    for (f, want, what) in [(2, green, "sure"), (7, amber, "doubtful"), (11, red, "unsure"), (14, slate, "absent"), (18, green, "sure again")] {
+        let got = sample(f);
+        assert!(close(got, want), "frame {f} ({what}): drew {got:?}, wanted about {want:?}");
+    }
+}
diff --git a/crates/ui-egui/tests/ui_script_console.rs b/crates/ui-egui/tests/it/ui_script_console.rs
similarity index 96%
rename from crates/ui-egui/tests/ui_script_console.rs
rename to crates/ui-egui/tests/it/ui_script_console.rs
index 526a52938..9430bc7a2 100644
--- a/crates/ui-egui/tests/ui_script_console.rs
+++ b/crates/ui-egui/tests/it/ui_script_console.rs
@@ -1,6 +1,7 @@
 //! Window ▸ Script Console: the panel shows, runs JavaScript through `script.run` (persistent
 //! context) and logs output, results and errors (egui_kittest, UI logic only).
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_ui_egui::EffectcraftApp;
 use effectcraft_ui_egui::dock::PanelKind;
 use egui_kittest::Harness;
@@ -44,7 +45,7 @@ fn script_console_runs_scripts() {
 }
 
 /// Headless look at the panel (wgpu offscreen); run with
-/// `SC_SNAPSHOT=/abs/out.png cargo test -p effectcraft-ui-egui --test ui_script_console -- --ignored`.
+/// `SC_SNAPSHOT=/abs/out.png cargo test -p effectcraft-ui-egui --test it ui_script_console:: -- --ignored`.
 #[test]
 #[ignore]
 fn script_console_snapshot() {
@@ -59,7 +60,7 @@ fn script_console_snapshot() {
     }
     h.state_mut().ui.script_console.input = "app.project.numItems".into();
     h.run_steps(3);
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     let out = std::env::var("SC_SNAPSHOT").unwrap_or_else(|_| concat!(env!("CARGO_MANIFEST_DIR"), "/../../target/test-out/script_console.png").into());
     if let Some(d) = std::path::Path::new(&out).parent() {
         std::fs::create_dir_all(d).unwrap();
diff --git a/crates/ui-egui/tests/it/ui_script_console_keyboard.rs b/crates/ui-egui/tests/it/ui_script_console_keyboard.rs
new file mode 100644
index 000000000..8072238ea
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_script_console_keyboard.rs
@@ -0,0 +1,107 @@
+//! Script Console accessible names and keyboard operation (docs/gaps.md gap 25): the input, the
+//! output (a log), Run and Clear are named and reachable with Tab, Tab leaves the input instead of
+//! typing a tab character, and Enter / Space work the buttons.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::accesskit::Role;
+use egui::{Event, Key, Modifiers};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+const INPUT: &str = "Script… (⌘/Ctrl+Enter runs)";
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::ScriptConsole);
+    h.state_mut().ui.maximized = Some(PanelKind::ScriptConsole);
+    h.run_steps(4);
+    h
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn focused(h: &Harness<'_, EffectcraftApp>) -> Option<(Role, String)> {
+    h.root().children_recursive().find(|n| n.is_focused()).map(|n| (n.accesskit_node().role(), n.accesskit_node().label().unwrap_or_default()))
+}
+
+#[test]
+fn input_output_and_buttons_are_named() {
+    let mut h = harness();
+    assert_eq!(h.get_by_role_and_label(Role::MultilineTextInput, INPUT).accesskit_node().role(), Role::MultilineTextInput);
+    let log = h.get_by_role_and_label(Role::Log, "Script Console output");
+    assert!(log.accesskit_node().value().is_none_or(|v| v.is_empty()), "an empty console has an empty log");
+    // Run is unavailable with nothing typed; Clear with nothing to clear.
+    assert!(h.get_by_role_and_label(Role::Button, "Run").accesskit_node().is_disabled());
+    assert!(h.get_by_role_and_label(Role::Button, "Clear").accesskit_node().is_disabled());
+    h.state_mut().ui.script_console.input = "1 + 1".into();
+    h.state_mut().ui.script_console.record("1 + 1", &Ok(json!({"result": 2})));
+    h.run_steps(4);
+    assert!(!h.get_by_role_and_label(Role::Button, "Run").accesskit_node().is_disabled());
+    assert!(!h.get_by_role_and_label(Role::Button, "Clear").accesskit_node().is_disabled());
+    let text = h.get_by_role_and_label(Role::Log, "Script Console output").accesskit_node().value().unwrap_or_default();
+    assert!(text.contains("> 1 + 1") && text.contains('2'), "the log carries the output lines: {text:?}");
+}
+
+#[test]
+fn tab_leaves_the_input_and_reaches_run_and_clear() {
+    let mut h = harness();
+    h.state_mut().ui.script_console.input = "x".into();
+    h.state_mut().ui.script_console.record("x", &Ok(json!({"result": 1})));
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::MultilineTextInput, INPUT).focus();
+    h.run_steps(3);
+    assert_eq!(focused(&h).map(|f| f.0), Some(Role::MultilineTextInput));
+    let mut seen = vec![];
+    for _ in 0..6 {
+        key(&mut h, Key::Tab, Modifiers::NONE);
+        if let Some(f) = focused(&h) {
+            seen.push(f);
+        }
+    }
+    assert_eq!(h.state().ui.script_console.input, "x", "Tab does not type a tab character into the script");
+    for want in ["Run", "Clear"] {
+        assert!(seen.iter().any(|(r, n)| *r == Role::Button && n == want), "Tab reaches {want}; reached {seen:?}");
+    }
+}
+
+#[test]
+fn enter_runs_the_script_and_space_clears_the_log_from_the_buttons() {
+    let mut h = harness();
+    h.state_mut().ui.script_console.input = "app.project.numItems".into();
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::Button, "Run").focus();
+    h.run_steps(3);
+    assert_eq!(focused(&h), Some((Role::Button, "Run".to_string())));
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    assert!(h.state().ui.script_console.input.is_empty(), "Run ran the script and cleared the input");
+    assert!(h.state().ui.script_console.log.len() >= 2, "its input and result are in the log: {:?}", h.state().ui.script_console.log);
+    h.get_by_role_and_label(Role::Button, "Clear").focus();
+    h.run_steps(3);
+    key(&mut h, Key::Space, Modifiers::NONE);
+    assert!(h.state().ui.script_console.log.is_empty(), "Space on Clear empties the log");
+}
+
+#[test]
+fn ctrl_enter_runs_from_the_input() {
+    let mut h = harness();
+    h.get_by_role_and_label(Role::MultilineTextInput, INPUT).focus();
+    h.run_steps(3);
+    h.state_mut().ui.script_console.input = "1 + 2".into();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::COMMAND));
+    key(&mut h, Key::Enter, Modifiers::COMMAND);
+    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(2);
+    assert!(h.state().ui.script_console.log.iter().any(|l| l.text.contains("> 1 + 2")), "Ctrl+Enter ran it");
+}
diff --git a/crates/ui-egui/tests/it/ui_script_render.rs b/crates/ui-egui/tests/it/ui_script_render.rs
new file mode 100644
index 000000000..b3c24733c
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_script_render.rs
@@ -0,0 +1,260 @@
+//! #3289: the control bridge must keep servicing UI frames during scripted and direct renders.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{Receiver, TryRecvError};
+use std::time::{Duration, Instant};
+
+use effectcraft_engine::project::render_queue::OutputFormat;
+use effectcraft_engine::{ExportJob, ExportResult, Exporter};
+use effectcraft_ui_egui::{ControlRequest, EffectcraftApp};
+use egui_kittest::Harness;
+use serde_json::{Value, json};
+
+struct Gate(AtomicBool);
+impl Exporter for Gate {
+    fn formats(&self) -> Vec<OutputFormat> {
+        vec![OutputFormat::H264]
+    }
+    fn export(&self, job: &ExportJob, progress: &mut dyn FnMut(u64, u64) -> bool) -> Result<ExportResult, String> {
+        let end = Instant::now() + Duration::from_secs(3);
+        while !self.0.load(Ordering::SeqCst) {
+            if !progress(0, 10) {
+                return Err(effectcraft_engine::render_queue::CANCELLED.into());
+            }
+            if Instant::now() > end {
+                return Err("test exporter waited for a blocked UI".into());
+            }
+            std::thread::sleep(Duration::from_millis(1));
+        }
+        Ok(ExportResult { path: job.path.into(), frames: 10, ..Default::default() })
+    }
+}
+
+fn harness() -> (Harness<'static, EffectcraftApp>, Arc<Gate>, std::sync::mpsc::Sender<ControlRequest>) {
+    let gate = Arc::new(Gate(AtomicBool::new(false)));
+    let mut s = effectcraft_host::session();
+    s.exporter = Some(gate.clone());
+    s.prefs.auto_save.enabled = false;
+    s.execute("comp.new", json!({"width": 16, "height": 16, "duration": 1})).unwrap();
+    let path = std::env::temp_dir().join(format!("ec-ui-script-render-{}.mp4", std::process::id()));
+    s.execute("renderQueue.add", json!({"output": path.to_string_lossy()})).unwrap();
+    let (tx, rx) = std::sync::mpsc::channel();
+    let h = Harness::builder().with_size(egui::vec2(1000.0, 700.0)).build_eframe(|_| EffectcraftApp::new(s).with_control(rx));
+    (h, gate, tx)
+}
+
+fn send(tx: &std::sync::mpsc::Sender<ControlRequest>, method: &str, params: Value) -> Receiver<Value> {
+    let (request, reply) = ControlRequest::new(method, params);
+    tx.send(request).unwrap();
+    reply
+}
+
+fn finish(h: &mut Harness<'_, EffectcraftApp>, reply: &Receiver<Value>) -> Value {
+    let end = Instant::now() + Duration::from_secs(4);
+    loop {
+        h.run_steps(1);
+        if let Ok(result) = reply.try_recv() {
+            return result;
+        }
+        assert!(Instant::now() < end, "control reply did not complete");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+}
+
+#[test]
+fn script_render_keeps_frames_and_inspection_alive_until_the_continuation_finishes() {
+    let (mut h, gate, tx) = harness();
+    let reply = send(
+        &tx,
+        "engine.execute",
+        json!({"command": "script.run", "params": {"code": "$.writeln('before'); app.project.renderQueue.render(); app.project.activeItem.layers.addNull().name = 'After'; $.writeln('after'); 42;"}}),
+    );
+    h.run_steps(3);
+    assert!(matches!(reply.try_recv(), Err(TryRecvError::Empty)), "script reply must wait for its continuation");
+    assert!(h.state().session.active_comp().unwrap().layers.is_empty());
+    let before = h.state().ui_passes();
+    let inspect = send(&tx, "ui.inspect", json!({}));
+    let edit = send(&tx, "engine.execute", json!({"command": "layer.newNull"}));
+    let batch = send(&tx, "engine.execute", json!({"command": "engine.batch", "params": {"steps": [{"command": "layer.newNull"}]}}));
+    let jobs = send(&tx, "engine.execute", json!({"command": "jobs.list"}));
+    let quit = send(&tx, "app.quit", json!({"force": true}));
+    h.run_steps(3);
+    assert!(h.state().ui_passes() > before, "frames still draw while the render is gated");
+    assert_eq!(inspect.try_recv().unwrap()["ok"], true);
+    assert_eq!(edit.try_recv().unwrap()["ok"], false, "unrelated edits cannot enter the script's undo group");
+    assert_eq!(batch.try_recv().unwrap()["ok"], false, "batches are not pure queries");
+    assert_eq!(jobs.try_recv().unwrap()["ok"], false, "job polling can apply unrelated edits");
+    assert_eq!(quit.try_recv().unwrap()["ok"], false, "force quit cannot abandon the script's live session");
+    assert!(h.state().auto.find("scriptRender.stop").is_some());
+    gate.0.store(true, Ordering::SeqCst);
+    let done = finish(&mut h, &reply);
+    assert_eq!(done["ok"], true, "{done}");
+    assert_eq!(done["result"]["ok"], true, "{done}");
+    assert_eq!(done["result"]["result"], 42);
+    assert_eq!(done["result"]["output"], "before\nafter");
+    assert_eq!(h.state().session.active_comp().unwrap().layers[0].name, "After");
+    assert!(h.state().session.script_ui.render_host.is_none());
+}
+
+#[test]
+fn stop_render_remains_available_while_a_script_waits() {
+    let (mut h, _gate, tx) = harness();
+    let reply = send(&tx, "engine.execute", json!({"command": "script.run", "params": {"code": "app.project.renderQueue.render(); 23;"}}));
+    h.run_steps(2);
+    assert!(matches!(reply.try_recv(), Err(TryRecvError::Empty)));
+    let stop = send(&tx, "engine.execute", json!({"command": "renderQueue.stop"}));
+    h.run_steps(1);
+    assert_eq!(stop.try_recv().unwrap()["ok"], true);
+    assert_eq!(finish(&mut h, &reply)["result"]["result"], 23);
+    assert!(!h.state().session.is_rendering());
+}
+
+#[test]
+fn closing_when_a_control_script_starts_cannot_abandon_its_new_unsaved_changes() {
+    let (mut h, gate, tx) = harness();
+    h.state_mut().session.mark_saved();
+    let reply = send(
+        &tx,
+        "engine.execute",
+        json!({"command": "script.run", "params": {"code": "app.project.activeItem.layers.addNull(); app.project.renderQueue.render(); 31;"}}),
+    );
+    h.input_mut().viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+    h.step();
+    let canceled = h.output().viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::CancelClose));
+    let dirty = h.state().session.is_dirty();
+    let pending = matches!(reply.try_recv(), Err(TryRecvError::Empty));
+    gate.0.store(true, Ordering::SeqCst);
+    assert_eq!(finish(&mut h, &reply)["result"]["result"], 31);
+    assert!(canceled, "a close accepted before the control request must be canceled once the script suspends");
+    assert!(dirty && pending);
+}
+
+#[test]
+fn closing_on_the_completion_frame_cannot_skip_the_unsaved_changes_guard() {
+    let (mut h, gate, tx) = harness();
+    let reply = send(&tx, "engine.execute", json!({"command": "script.run", "params": {"code": "app.project.renderQueue.render(); 23;"}}));
+    h.run_steps(2);
+    assert!(h.state().session.script_ui.render_host.is_some());
+    gate.0.store(true, Ordering::SeqCst);
+    let end = Instant::now() + Duration::from_secs(4);
+    while h.state().session.is_rendering() {
+        assert!(Instant::now() < end);
+        std::thread::sleep(Duration::from_millis(1));
+    }
+    h.input_mut().viewports.entry(egui::ViewportId::ROOT).or_default().events.push(egui::ViewportEvent::Close);
+    h.step();
+    assert!(h.output().viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::CancelClose)));
+    assert_eq!(reply.try_recv().unwrap()["result"]["result"], 23);
+    assert!(h.state().session.is_dirty());
+}
+
+#[test]
+fn direct_native_render_waits_for_its_worker_without_blocking_frames() {
+    let (mut h, gate, tx) = harness();
+    let reply = send(&tx, "engine.execute", json!({"command": "renderQueue.render"}));
+    h.run_steps(3);
+    assert!(matches!(reply.try_recv(), Err(TryRecvError::Empty)));
+    let inspect = send(&tx, "ui.inspect", json!({}));
+    h.run_steps(2);
+    assert_eq!(inspect.try_recv().unwrap()["ok"], true);
+    gate.0.store(true, Ordering::SeqCst);
+    let done = finish(&mut h, &reply);
+    assert_eq!(done["result"]["rendering"], false);
+    assert_eq!(done["result"]["items"][0]["statusLabel"], "Done", "{done}");
+}
+
+#[test]
+fn malformed_waiting_render_params_return_an_error() {
+    let (mut h, _gate, tx) = harness();
+    let reply = send(&tx, "engine.execute", json!({"command": "renderQueue.render", "params": []}));
+    h.run_steps(1);
+    assert_eq!(reply.try_recv().unwrap()["ok"], false);
+    assert!(!h.state().session.is_rendering());
+}
+
+fn wait_worker(h: &Harness<'_, EffectcraftApp>) {
+    let end = Instant::now() + Duration::from_secs(4);
+    while h.state().session.is_rendering() {
+        assert!(Instant::now() < end, "render worker did not finish");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+}
+
+#[test]
+fn direct_render_reply_keeps_its_items_after_queue_removal_and_a_new_render() {
+    use effectcraft_ui_egui::control::{Outcome, handle};
+
+    for no_running_jobs in [false, true] {
+        let (mut h, gate, _tx) = harness();
+        let ctx = egui::Context::default();
+        let request = ControlRequest::new("engine.execute", json!({"command": "renderQueue.render"})).0;
+        let Outcome::AwaitJobs(mut first) = handle(h.state_mut(), &ctx, &request, 0.0) else { panic!("expected a deferred render") };
+        let original = first.result["items"][0].clone();
+        // Also cover completion between the command's result and its jobs() snapshot.
+        if no_running_jobs {
+            first.jobs.clear();
+        }
+        gate.0.store(true, Ordering::SeqCst);
+        wait_worker(&h);
+        gate.0.store(false, Ordering::SeqCst);
+        // The worker is done, but no frontend completion pass has run. Removing the item
+        // must not erase the waiting reply, even when the next queue reuses the same id.
+        h.state_mut().session.execute("renderQueue.remove", json!({"item": original["id"]})).unwrap();
+        h.state_mut().session.poll_render();
+        let second_path = std::env::temp_dir().join(format!("ec-ui-second-render-{}.mp4", std::process::id()));
+        h.state_mut().session.execute("renderQueue.add", json!({"output": second_path.to_string_lossy()})).unwrap();
+        let Outcome::AwaitJobs(second) = handle(h.state_mut(), &ctx, &request, 0.0) else { panic!("expected a second deferred render") };
+        assert!(second.pending(h.state()));
+        assert!(!first.pending(h.state()), "the first reply must not wait for a later job with the same jobs.list id");
+        let done = first.finish(h.state_mut());
+        assert_eq!(done["result"]["rendering"], false, "{done}");
+        assert_eq!(done["result"]["items"][0]["statusLabel"], "Done", "{done}");
+        assert_eq!(done["result"]["items"][0]["outputPath"], original["outputPath"]);
+        assert_eq!(done["result"]["items"][0]["last_output"], original["outputPath"]);
+        assert!(h.state().session.is_rendering());
+        gate.0.store(true, Ordering::SeqCst);
+        wait_worker(&h);
+        h.state_mut().session.poll_render();
+        assert!(!second.pending(h.state()));
+        assert_eq!(second.finish(h.state_mut())["result"]["items"][0]["outputPath"], second_path.to_string_lossy().as_ref());
+    }
+}
+
+#[test]
+fn completed_direct_render_reply_is_not_delayed_by_a_later_script_render() {
+    let (mut h, gate, tx) = harness();
+    let first = send(&tx, "engine.execute", json!({"command": "renderQueue.render"}));
+    h.run_steps(2);
+    assert!(matches!(first.try_recv(), Err(TryRecvError::Empty)));
+    gate.0.store(true, Ordering::SeqCst);
+    wait_worker(&h);
+    gate.0.store(false, Ordering::SeqCst);
+    h.state_mut().session.poll_render();
+    h.state_mut().session.execute("renderQueue.setRender", json!({"index": 1, "render": true})).unwrap();
+    let second = send(&tx, "engine.execute", json!({"command": "script.run", "params": {"code": "app.project.renderQueue.render(); 47;"}}));
+    h.run_steps(1);
+    assert!(h.state().session.script_ui.render_host.is_some());
+    assert!(matches!(second.try_recv(), Err(TryRecvError::Empty)));
+    let done = first.try_recv().expect("an immutable completed reply does not enter the new script's undo group");
+    assert_eq!(done["result"]["rendering"], false);
+    assert_eq!(done["result"]["items"][0]["statusLabel"], "Done");
+    gate.0.store(true, Ordering::SeqCst);
+    assert_eq!(finish(&mut h, &second)["result"]["result"], 47);
+}
+
+#[test]
+fn replacing_project_before_render_poll_returns_an_explicit_error() {
+    use effectcraft_ui_egui::control::{Outcome, handle};
+
+    let (mut h, gate, _tx) = harness();
+    let request = ControlRequest::new("engine.execute", json!({"command": "renderQueue.render"})).0;
+    let Outcome::AwaitJobs(waiter) = handle(h.state_mut(), &egui::Context::default(), &request, 0.0) else { panic!("expected a deferred render") };
+    gate.0.store(true, Ordering::SeqCst);
+    wait_worker(&h);
+    h.state_mut().session.replace_project(Default::default(), None);
+    assert!(!waiter.pending(h.state()));
+    let reply = waiter.finish(h.state_mut());
+    assert_eq!(reply["ok"], false, "{reply}");
+    assert!(reply["error"].as_str().unwrap().contains("replaced before completion"));
+}
diff --git a/crates/ui-egui/tests/ui_scriptui.rs b/crates/ui-egui/tests/it/ui_scriptui.rs
similarity index 64%
rename from crates/ui-egui/tests/ui_scriptui.rs
rename to crates/ui-egui/tests/it/ui_scriptui.rs
index 6cfc2db71..a905ebc5a 100644
--- a/crates/ui-egui/tests/ui_scriptui.rs
+++ b/crates/ui-egui/tests/it/ui_scriptui.rs
@@ -2,8 +2,10 @@
 //! windows (clicks reach the script's handlers), the branching History panel, and the Window /
 //! File ▸ Scripts menus listing scripts (egui_kittest, UI logic only).
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_ui_egui::EffectcraftApp;
 use effectcraft_ui_egui::dock::PanelKind;
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
 use egui::{Event, Rect, pos2, vec2};
 use egui_kittest::Harness;
 use serde_json::json;
@@ -75,7 +77,7 @@ fn script_windows_are_drawn_and_clickable() {
     h.state_mut().session.execute("window.scriptPanel", json!({"name": "Layer Tools.jsx"})).unwrap();
     h.run_steps(3);
     let panel = h.state().session.script_ui.windows.iter().find(|w| w.script == "Layer Tools.jsx").unwrap().id;
-    assert!(h.state().ui.dock.contains(PanelKind::ScriptPanel(panel)), "the panel docks");
+    assert!(h.state().ui.dock.is_docked(PanelKind::ScriptPanel(panel)), "the panel docks");
     assert!(h.state().auto.find(&format!("scriptui.{panel}")).is_some());
     // The menus list scripts and panels.
     let cx = effectcraft_engine::menus::DynCtx::default();
@@ -104,7 +106,7 @@ fn panels_open_at_quit_dock_again_at_launch() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| EffectcraftApp::new(s));
     h.run_steps(3);
     let panel = h.state().session.script_ui.windows.iter().find(|w| w.script == "Hello Panel.jsx").expect("the panel's window").id;
-    assert!(h.state().ui.dock.contains(PanelKind::ScriptPanel(panel)), "the panel docks");
+    assert!(h.state().ui.dock.is_docked(PanelKind::ScriptPanel(panel)), "the panel docks");
     assert!(h.state().auto.find(&format!("scriptui.{panel}.hi")).is_some(), "its controls are drawn");
     // Closing its tab forgets it for the next launch.
     h.state_mut().close_panel(PanelKind::ScriptPanel(panel));
@@ -112,6 +114,42 @@ fn panels_open_at_quit_dock_again_at_launch() {
     assert_eq!(store.read(effectcraft_engine::commands::scripts::OPEN_PANELS_FILE).as_deref(), Some(r#"{"open":[]}"#));
 }
 
+/// A script copied into the Scripts folder while the app runs is listed in Edit ▸ Keyboard
+/// Shortcuts and takes a key there: File ▸ Scripts shows the key next to the script, and
+/// pressing it runs the script as its menu entry does.
+#[test]
+fn a_key_given_to_a_script_runs_it() {
+    use effectcraft_engine::config::{ConfigStore, MemoryConfig};
+    let store = std::sync::Arc::new(MemoryConfig::default());
+    let mut s = effectcraft_host::session();
+    s.config = Some(store.clone());
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    assert!(h.state().session.shortcuts().find(r#"file.runScript {"name":"Rename Layers.jsx"}"#).is_some(), "the shortcut table is built");
+    store.write("Scripts/Add Comp.jsx", "app.project.items.addComp('From Key', 64, 64, 1, 1, 25);").unwrap();
+    effectcraft_ui_egui::panels::shortcut_editor::open(h.state_mut());
+    let script = json!({"name": "Add Comp.jsx"});
+    let r = h.state_mut().session.execute("shortcuts.set", json!({"command": "file.runScript", "params": script, "keys": "Cmd+Alt+Shift+F7"})).unwrap();
+    assert_eq!(r["command"], r#"file.runScript {"name":"Add Comp.jsx"}"#, "{r}");
+    assert_eq!(r["keys"], json!(["Cmd+Alt+Shift+F7"]), "{r}");
+    assert_eq!(r["conflicts"], json!([]), "{r}");
+    h.state_mut().dialog = None;
+    let spec = effectcraft_ui_egui::native_menu::build(h.state());
+    let entry = spec.items().into_iter().find(|i| i.command == "file.runScript" && i.params == script).expect("the File ▸ Scripts entry");
+    assert_eq!(entry.shortcut.as_deref(), Some("Cmd+Alt+Shift+F7"));
+    let (m, k, ..) = effectcraft_ui_egui::menus::bindings(&h.state().session)
+        .into_iter()
+        .find(|b| b.2 == "file.runScript" && b.3 == script)
+        .expect("the key is bound to the script");
+    let made = |h: &Harness<'_, EffectcraftApp>| h.state().session.project.items.values().filter(|i| i.name == "From Key").count();
+    assert_eq!(made(&h), 0);
+    for pressed in [true, false] {
+        h.event(Event::Key { key: k, physical_key: Some(k), pressed, repeat: false, modifiers: m });
+        h.step();
+    }
+    assert_eq!(made(&h), 1, "the key runs the script");
+}
+
 /// The bundled Ease Presets ScriptUI panel (Window ▸ Ease Presets.jsx) docks, and clicking a
 /// preset in its list eases the selected keyframes in one undo step.
 #[test]
@@ -131,7 +169,7 @@ fn ease_presets_panel_eases_the_selected_keys_from_its_list() {
     s.execute("window.scriptPanel", json!({"name": "Ease Presets.jsx"})).unwrap();
     h.run_steps(3);
     let panel = h.state().session.script_ui.windows.iter().find(|w| w.script == "Ease Presets.jsx").unwrap().id;
-    assert!(h.state().ui.dock.contains(PanelKind::ScriptPanel(panel)), "the panel docks");
+    assert!(h.state().ui.dock.is_docked(PanelKind::ScriptPanel(panel)), "the panel docks");
     h.state_mut().ui.maximized = Some(PanelKind::ScriptPanel(panel));
     h.run_steps(3);
     let steps = h.state().session.history.undo.len();
@@ -173,6 +211,7 @@ fn history_panel_jumps_between_branches() {
 /// onDraw fills of concave paths and real images (drawImage, image controls), rendered.
 #[test]
 fn on_draw_concave_fills_and_images_render() {
+    let _device = crate::gpu_test::lock();
     let dir = std::env::temp_dir().join(format!("effectcraft-scriptui-img-{}", std::process::id()));
     std::fs::create_dir_all(&dir).unwrap();
     let png = dir.join("green.png");
@@ -207,7 +246,7 @@ fn on_draw_concave_fills_and_images_render() {
     let g = &win.root.children[0];
     assert!(matches!(&g.draw[1], effectcraft_engine::scriptui::DrawOp::Image { image: Some(i), .. } if i.src.as_deref() == Some(png.as_str())));
     assert_eq!(win.root.children[1].image.as_ref().and_then(|i| i.src.clone()).as_deref(), Some(png.as_str()));
-    let img = h.render().expect("render");
+    let img = h.render_serialized().expect("render");
     if let Ok(d) = std::env::var("EC_SNAPSHOT_DIR") {
         img.save(format!("{d}/scriptui_paint.png")).unwrap();
     }
@@ -263,6 +302,79 @@ fn script_windows_send_mouse_events_to_listeners() {
     h.state_mut().session.execute("scriptui.close", json!({})).unwrap();
 }
 
+/// #2584: a drag that starts on a control keeps reaching it outside the script window (moves and
+/// the release), and `MouseEvent.buttons` tells a drag from a hover.
+#[test]
+fn a_drag_keeps_its_control_past_the_window_edge() {
+    let mut h = harness();
+    let code = r#"
+      var w = new Window("palette", "Drag");
+      var pad = w.add("group", undefined, undefined, { name: "pad" });
+      pad.preferredSize = [120, 80];
+      var log = w.add("statictext", undefined, "", { name: "log" });
+      log.preferredSize = [400, 20];
+      var seen = [];
+      var rec = function (e) { seen.push(e.type + (e.clientX < 0 ? " out" : " in") + " B" + e.buttons); log.text = seen.join("|"); };
+      pad.addEventListener("mousedown", rec);
+      pad.addEventListener("mousemove", rec);
+      pad.addEventListener("mouseup", rec);
+      w.show();
+    "#;
+    let r = h.state_mut().session.execute("script.run", json!({"code": code, "name": "drag.jsx"})).unwrap();
+    assert_eq!(r["ok"], true, "{r}");
+    h.run_steps(3);
+    let win = h.state().session.script_ui.windows[0].id;
+    let pad = rect(&h, &format!("scriptui.{win}.pad"));
+    let (from, to) = (pad.min + vec2(10.0, 20.0), pad.min + vec2(-300.0, 20.0));
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.run_steps(1);
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (k as f32 / 4.0)));
+        h.run_steps(1);
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(3);
+    let log = h.state().session.script_ui.windows[0].root.lookup(&json!("log")).cloned().unwrap().text;
+    assert!(log.starts_with("mousemove in B0|mousedown in B1|"), "a hover move has no button held: {log}");
+    assert!(log.contains("mousedown in B1|mousemove out B1"), "moves outside the window still arrive, with the button held: {log}");
+    assert!(log.ends_with("|mouseup out B0"), "the release outside reaches the control: {log}");
+    h.state_mut().session.execute("scriptui.close", json!({})).unwrap();
+}
+
+/// #2585: a window the host resizes takes the size, lays out again and runs onResize; a docked
+/// ScriptUI panel gets its dock's size that way.
+#[test]
+fn script_windows_learn_the_size_they_are_given() {
+    let mut h = harness();
+    let code = r#"
+      var w = new Window("palette", "Sized");
+      var log = w.add("statictext", undefined, "", { name: "log" });
+      log.preferredSize = [200, 20];
+      w.onResize = function () { log.text = "resized " + w.size.width + "x" + w.size.height; };
+      w.show();
+    "#;
+    let r = h.state_mut().session.execute("script.run", json!({"code": code, "name": "sized.jsx"})).unwrap();
+    assert_eq!(r["ok"], true, "{r}");
+    h.run_steps(2);
+    h.state_mut().session.execute("scriptui.resize", json!({"window": "Sized", "size": [300, 180]})).unwrap();
+    let win = h.state().session.script_ui.windows[0].clone();
+    assert_eq!(win.root.lookup(&json!("log")).unwrap().text, "resized 300x180");
+    let list = h.state_mut().session.execute("scriptui.list", json!({})).unwrap();
+    assert_eq!(list[0]["size"], json!([300.0, 180.0]), "{list}");
+    assert!(h.state_mut().session.execute("scriptui.resize", json!({"window": "Sized", "size": ["wide", 1]})).is_err());
+    h.state_mut().session.execute("scriptui.close", json!({})).unwrap();
+    // A docked panel: its window is its dock's size, not its preferred size.
+    h.state_mut().session.execute("window.scriptPanel", json!({"name": "Layer Tools.jsx"})).unwrap();
+    h.run_steps(4);
+    let panel = h.state().session.script_ui.windows.iter().find(|w| w.script == "Layer Tools.jsx").unwrap().clone();
+    let dock = rect(&h, &format!("scriptui.{}", panel.id));
+    assert_eq!([panel.root.bounds[2].round(), panel.root.bounds[3].round()], [dock.width().round() as f64, dock.height().round() as f64]);
+    h.state_mut().close_panel(PanelKind::ScriptPanel(panel.id));
+    h.run_steps(2);
+}
+
 fn click_at(h: &mut Harness<'_, EffectcraftApp>, c: egui::Pos2) {
     h.input_mut().events.push(Event::PointerMoved(c));
     h.run_steps(1);
@@ -271,3 +383,18 @@ fn click_at(h: &mut Harness<'_, EffectcraftApp>, c: egui::Pos2) {
     }
     h.run_steps(3);
 }
+#[test]
+fn scheduled_import_reveals_its_composition_without_manual_clicks() {
+    let mut s = effectcraft_host::session();
+    let result = s.execute("script.run", json!({"code": "var w=new Window('palette','Automatic import');var b=w.add('button',undefined,'Open');b.onClick=function(){app.scheduleTask(\"var c=app.project.items.addComp('Imported',64,64,1,1,25);c.openInViewer();\",0,false);};w.show();"})).unwrap();
+    assert_eq!(result["ok"], true, "{result}");
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().ui.start_screen = true;
+    h.run_steps(2);
+    h.state_mut().session.execute("scriptui.click", json!({"window":"Automatic import","widget":"Open"})).unwrap();
+    h.run_steps(4);
+    let active = h.state().session.active_comp_id().unwrap();
+    assert_eq!(h.state().session.project.items.get(&active).unwrap().name, "Imported");
+    assert!(!h.state().ui.start_screen, "Home must not hide a composition opened by the scheduled import");
+    h.state_mut().session.execute("scriptui.close", json!({"window":"Automatic import"})).unwrap();
+}
diff --git a/crates/ui-egui/tests/it/ui_scrolling.rs b/crates/ui-egui/tests/it/ui_scrolling.rs
new file mode 100644
index 000000000..2913a6770
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_scrolling.rs
@@ -0,0 +1,573 @@
+//! Long menus and lists scroll instead of running off the window, with a scroll bar to drag
+//! (egui_kittest, UI logic only).
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+// The pointer/geometry helpers are shared with the sibling menu and long-tail test modules:
+// `rect`, `click_at`, `move_to` and press-and-hold (`hold`) live in ui_menus, `drag` in ui_tail.
+use super::ui_menus::{click_at, move_to, press as hold, rect};
+use super::ui_tail::drag;
+
+/// Open the demo project in a UI test harness with the requested window size.
+fn harness(w: f32, h: f32) -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("file.openDemoProject", json!({})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(w, h)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h
+}
+
+fn wheel(h: &mut Harness<'_, EffectcraftApp>, at: Pos2, dy: f32) {
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, dy),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
+    h.run_steps(20);
+}
+
+/// The open menu popup's rect (frame included), from egui's area memory: the only tall area up.
+fn open_popup(h: &Harness<'_, EffectcraftApp>) -> Rect {
+    h.ctx
+        .memory(|m| {
+            m.areas()
+                .visible_layer_ids()
+                .into_iter()
+                .filter(|l| l.order != egui::Order::Background)
+                .filter_map(|l| m.area_rect(l.id))
+                .find(|r| r.height() > 100.0)
+        })
+        .unwrap_or_else(|| panic!("no menu popup is open"))
+}
+
+/// Edit is taller than a short window: it scrolls (with the wheel, and a scroll bar that always
+/// shows) so its last entries can be reached and clicked, instead of running off the bottom of
+/// the window (#269).
+#[test]
+fn a_menu_taller_than_the_window_scrolls() {
+    let mut h = harness(1200.0, 520.0);
+    assert!(!h.ctx.global_style().spacing.scroll.floating, "scroll bars show without hovering the list");
+    let edit = rect(&h, "menu.Edit");
+    click_at(&mut h, edit.center());
+    let last = h.query_by_label_contains("Keyboard Shortcuts").expect("the Edit menu is open").rect();
+    assert!(last.max.y > 520.0, "Edit is taller than the window ({last:?})");
+    let first = h.query_by_label_contains("Quick Apply").expect("Quick Apply").rect();
+    wheel(&mut h, first.center(), -2000.0);
+    let last = h.query_by_label_contains("Keyboard Shortcuts").expect("still open").rect();
+    assert!(last.min.y >= 0.0 && last.max.y <= 520.0, "scrolled into the window ({last:?})");
+    click_at(&mut h, last.center());
+    assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Shortcuts), "the entry takes the click");
+}
+
+/// Open Edit in a window shorter than the menu (holding or clicking its title) and return the
+/// last entry's rect before any scroll, plus the open popup's rect. `opened` is the failure
+/// message when the menu did not open.
+fn open_tall_edit(h: &mut Harness<'_, EffectcraftApp>, held: bool, opened: &str) -> (Rect, Rect) {
+    let edit = rect(h, "menu.Edit");
+    if held {
+        hold(h, edit.center());
+    } else {
+        click_at(h, edit.center());
+    }
+    let before = h.query_by_label_contains("Keyboard Shortcuts").expect(opened).rect();
+    assert!(before.max.y > 520.0, "Edit is taller than the window ({before:?})");
+    let menu = open_popup(h);
+    (before, menu)
+}
+
+/// With the title still held down (press-and-browse), resting the pointer against the bottom
+/// edge of a menu too tall for the window scrolls it from there — a crawl, then a run, as native
+/// menus do — so the long list can be walked with no wheel.
+#[test]
+fn holding_the_title_scrolls_the_menu_from_its_bottom_edge() {
+    let mut h = harness(1200.0, 520.0);
+    let (before, menu) = open_tall_edit(&mut h, true, "the Edit menu opens on the press");
+    // Creeping down the edge: the 18 pt band above the menu's inner bottom lies at one of these
+    // positions, whatever the frame's margin (they are 6 pt apart).
+    let mut walked = false;
+    for step in 0..5 {
+        move_to(&mut h, pos2(menu.center().x, menu.max.y - 6.0 - 6.0 * step as f32));
+        h.run_steps(8);
+        let now = h.query_by_label_contains("Keyboard Shortcuts").expect("still open").rect();
+        if now.min.y < before.min.y {
+            walked = true;
+            break;
+        }
+    }
+    assert!(walked, "resting on the bottom edge of the held-down menu scrolled its entries up");
+}
+
+/// Without the title held down — the menu opened by a plain click — the same edge rest scrolls
+/// nothing: the wheel (above) is how a click-opened menu scrolls, the pointer alone must not
+/// move it (a hover may align the row under it by a few points; a crawl there would be a bug).
+#[test]
+fn without_the_hold_the_edge_does_not_scroll_the_menu() {
+    let mut h = harness(1200.0, 520.0);
+    let (before, menu) = open_tall_edit(&mut h, false, "the Edit menu is open");
+    for step in 0..5 {
+        move_to(&mut h, pos2(menu.center().x, menu.max.y - 6.0 - 6.0 * step as f32));
+        h.run_steps(8);
+        let now = h.query_by_label_contains("Keyboard Shortcuts").expect("still open").rect();
+        let crawled = before.min.y - now.min.y;
+        assert!(crawled < 60.0, "step {step}: the edge scrolled the menu with no title held down ({before:?} -> {now:?})");
+    }
+}
+
+/// Find the actual Edit popup's bottom crawl band while keeping the title press held.
+fn held_edit_crawl(h: &mut Harness<'_, EffectcraftApp>) -> Pos2 {
+    let edit = rect(h, "menu.Edit");
+    hold(h, edit.center());
+    let before = h.query_by_label_contains("Keyboard Shortcuts").expect("Edit opens on press").rect();
+    let menu = open_popup(h);
+    for step in 0..5 {
+        let p = pos2(menu.center().x, menu.max.y - 6.0 - 6.0 * step as f32);
+        move_to(h, p);
+        h.run_steps(8);
+        let after = h.query_by_label_contains("Keyboard Shortcuts").expect("Edit stays open").rect();
+        if after.min.y < before.min.y - 0.1 {
+            return p;
+        }
+    }
+    panic!("the held Edit menu never crawled from its bottom edge");
+}
+
+fn menu_at(h: &mut Harness<'_, EffectcraftApp>, time: f64) {
+    h.input_mut().time = Some(time);
+    h.step();
+}
+
+/// A discarded layout pass may consume the queued offset once, but must not crawl again for
+/// the same RawInput time. A subsequent real iteration must still queue and consume its step.
+#[test]
+fn menu_edge_crawl_advances_once_on_replay_then_continues_at_a_later_time() {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    let mut h = harness(1200.0, 520.0);
+    held_edit_crawl(&mut h);
+    let discard = Arc::new(AtomicBool::new(true));
+    h.ctx.on_end_pass(
+        "menu crawl replay regression",
+        Arc::new(move |ui| {
+            if discard.swap(false, Ordering::SeqCst) {
+                ui.ctx().request_discard("replay an actual held menu");
+            }
+        }),
+    );
+    let time = h.ctx.input(|i| i.time) + 1.0 / 60.0;
+    menu_at(&mut h, time);
+    assert_eq!(h.output().platform_output.num_completed_passes, 2, "the actual menu was replayed");
+    let once = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    for _ in 0..3 {
+        menu_at(&mut h, time);
+        assert_eq!(h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect(), once, "same-time replay cannot queue another crawl");
+    }
+    let later = time + 1.0 / 60.0;
+    menu_at(&mut h, later);
+    menu_at(&mut h, later);
+    let advanced = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    assert!(advanced.min.y < once.min.y - 0.1, "a later input time advances the held menu ({once:?} -> {advanced:?})");
+    menu_at(&mut h, later);
+    assert_eq!(h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect(), advanced, "the later time also takes only one step");
+}
+
+/// The actual menu viewport's vertical range, rather than its outer Area/frame rectangle.
+/// Popup's accessibility parent is its title, so background panels and other menus cannot match.
+fn menu_scrollbar(h: &Harness<'_, EffectcraftApp>, title: &str) -> Rect {
+    let menu = h.get_by_label(title);
+    let bars: Vec<_> = menu.query_all_by_role(egui::accesskit::Role::ScrollBar).map(|node| node.rect()).filter(|r| r.height() > r.width()).collect();
+    assert_eq!(bars.len(), 1, "{title}: exactly one actual vertical menu scrollbar ({bars:?})");
+    let bar = bars[0];
+    assert!(bar.height() > 36.0, "{title}: both crawl bands fit inside the viewport ({bar:?})");
+    bar
+}
+
+/// Exercise the real popup, its bounds, band exit and subsequent wheel input. Switching to a
+/// different real menu must not consume Edit's pending target or reuse its crawl clock.
+#[test]
+fn menu_edge_crawl_is_bounded_stops_and_keeps_wheel_and_menu_state_independent() {
+    let mut h = harness(1200.0, 520.0);
+    held_edit_crawl(&mut h);
+    h.run_steps(180);
+    let bottom = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    assert!(bottom.max.y <= 520.0, "the last item is inside the viewport at the bottom ({bottom:?})");
+    h.run_steps(20);
+    assert_eq!(h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect(), bottom, "the bottom bound stops the crawl");
+
+    let bar = menu_scrollbar(&h, "Edit");
+    let x = bar.min.x - 12.0; // Inside the menu content, not on the scroll-bar track.
+    let top_band = pos2(x, bar.min.y + 6.0);
+    eprintln!("Edit actual viewport scrollbar {bar:?}; top-band input {top_band:?}");
+    move_to(&mut h, top_band);
+    h.run_steps(180);
+    let top = h.query_by_label_contains("Quick Apply").unwrap().rect();
+    assert!(top.min.y >= 0.0 && top.max.y <= 520.0, "the first entries return into view ({top:?}); actual bar {bar:?}, pointer {top_band:?}");
+    h.run_steps(20);
+    assert_eq!(h.query_by_label_contains("Quick Apply").unwrap().rect(), top, "the top bound stops the crawl");
+
+    let last_at_top = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    move_to(&mut h, pos2(x, bar.max.y - 6.0));
+    h.run_steps(15);
+    let scrolled = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    assert!(scrolled.min.y < last_at_top.min.y - 0.1, "the bottom band starts scrolling again ({last_at_top:?} -> {scrolled:?})");
+    move_to(&mut h, pos2(x, bar.center().y));
+    h.run_steps(2); // Consume the last one-shot target before checking the stopped menu.
+    let stopped = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    h.run_steps(20);
+    assert_eq!(h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect(), stopped, "leaving the band stops the crawl");
+    assert!(
+        last_at_top.min.y > stopped.min.y + 1.0,
+        "there is upward wheel room: bottom {bottom:?}, top {last_at_top:?}, resumed {scrolled:?}, stopped {stopped:?}"
+    );
+    wheel(&mut h, pos2(x, bar.center().y), 120.0);
+    let wheeled_up = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    assert!(
+        wheeled_up.min.y > stopped.min.y + 1.0,
+        "upward wheel input moves the menu after the one-shot target: bottom {bottom:?}, top {last_at_top:?}, resumed {scrolled:?}, stopped {stopped:?}, wheeled {wheeled_up:?}"
+    );
+    assert!(wheeled_up.min.y > bottom.min.y + 1.0, "there is downward wheel room ({bottom:?} -> {wheeled_up:?})");
+    wheel(&mut h, pos2(x, bar.center().y), -120.0);
+    let wheeled = h.query_by_label_contains("Keyboard Shortcuts").unwrap().rect();
+    assert!(
+        wheeled.min.y < wheeled_up.min.y - 1.0,
+        "wheel input still moves the menu after the one-shot target ({wheeled_up:?} -> {wheeled:?}); bottom {bottom:?}, top {last_at_top:?}, resumed {scrolled:?}, stopped {stopped:?}"
+    );
+
+    // Queue another Edit crawl, then switch titles before its next draw can consume the target.
+    move_to(&mut h, pos2(x, bar.max.y - 6.0));
+    h.run_steps(15);
+    let file = rect(&h, "menu.File");
+    move_to(&mut h, file.center());
+    let fresh = h.query_by_label_contains("Open Project").expect("File opens while browsing").rect();
+    assert!(fresh.min.y >= file.max.y && fresh.max.y <= 520.0, "File starts at its own top, not Edit's offset ({fresh:?})");
+    h.run_steps(12);
+    assert_eq!(h.query_by_label_contains("Open Project").unwrap().rect(), fresh, "Edit's crawl does not continue in File");
+
+    // Release on its title rather than an entry, retaining a click-opened popup when possible.
+    h.input_mut().events.push(Event::PointerButton { pos: file.center(), button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    if h.query_by_label_contains("Open Project").is_none() {
+        click_at(&mut h, file.center());
+    }
+    let bar = menu_scrollbar(&h, "File");
+    let x = bar.min.x - 12.0;
+    let released = h.query_by_label_contains("Open Project").unwrap().rect();
+    move_to(&mut h, pos2(x, bar.max.y - 6.0));
+    h.run_steps(20);
+    assert_eq!(h.query_by_label_contains("Open Project").unwrap().rect(), released, "without the hold, the edge does not restart a crawl");
+}
+
+/// A scroll bar's "scroll/max" automation label.
+fn scrolled(h: &Harness<'_, EffectcraftApp>, id: &str) -> (f32, f32) {
+    let label = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).label.clone();
+    let (s, max) = label.split_once('/').unwrap_or_else(|| panic!("{id}: {label}"));
+    (s.parse().unwrap(), max.parse().unwrap())
+}
+
+/// Every panel that scrolls its own rows shows a scroll bar while they overflow, and dragging it
+/// scrolls them: without a mouse wheel or touchpad there was no way down most panels (#271).
+#[test]
+fn panels_taller_than_their_space_have_a_scroll_bar_to_drag() {
+    use effectcraft_ui_egui::dock::PanelKind;
+    // (The Project panel's list starts below its item preview and search: a taller window.)
+    for (panel, id, height) in [
+        (PanelKind::EffectControls, "effectControls.scroll", 240.0),
+        (PanelKind::Properties, "properties.scroll", 240.0),
+        (PanelKind::EffectsPresets, "effects.scroll", 240.0),
+        (PanelKind::Project, "project.vscroll", 330.0),
+        (PanelKind::Timeline, "timeline.scroll", 240.0),
+        (PanelKind::RenderQueue, "renderQueue.scroll", 240.0),
+        (PanelKind::History, "history.scroll", 240.0),
+        (PanelKind::Preview, "preview.scroll", 240.0),
+        (PanelKind::Character, "character.scroll", 240.0),
+        (PanelKind::Paragraph, "paragraph.scroll", 240.0),
+        (PanelKind::Info, "info.scroll", 240.0),
+    ] {
+        let mut h = harness(1200.0, height);
+        let app = h.state_mut();
+        let lid = app.session.active_comp().unwrap().layers[0].id.0;
+        app.session.execute("layer.select", json!({"layers": [lid]})).unwrap();
+        for e in ["slider", "angle", "checkbox", "color", "point"] {
+            app.session.execute("effect.apply", json!({"effect": format!("ec.control.{e}"), "layers": [lid]})).unwrap();
+        }
+        for _ in 0..6 {
+            app.session.execute("renderQueue.add", json!({})).unwrap();
+        }
+        app.show_panel(panel);
+        app.ui.maximized = Some(panel);
+        h.run_steps(3);
+        let (_, max) = scrolled(&h, id);
+        assert!(max > 0.0, "{id}: the rows overflow");
+        let bar = rect(&h, id);
+        // A press on the track moves the thumb there (History starts at its current state, the
+        // last); then the thumb drags to the end.
+        click_at(&mut h, pos2(bar.center().x, bar.min.y + 2.0));
+        assert_eq!(scrolled(&h, id).0, 0.0, "{id}: at the top");
+        drag(&mut h, pos2(bar.center().x, bar.min.y + 6.0), pos2(bar.center().x, bar.max.y + 40.0));
+        let end = scrolled(&h, id).0;
+        assert!((end - max).abs() < 0.01, "{id}: dragged to the end: {end} of {max}");
+    }
+}
+
+/// A window of `height` with one `panel` maximized, with rows to fill it: effects on the selected
+/// layers, queued renders, markers with a long comment, a folder of files.
+fn panel_with_rows(panel: effectcraft_ui_egui::dock::PanelKind, height: f32, folder: &std::path::Path) -> Harness<'static, EffectcraftApp> {
+    let mut h = harness(640.0, height);
+    let app = h.state_mut();
+    let layers: Vec<u64> = app.session.active_comp().unwrap().layers.iter().map(|l| l.id.0).collect();
+    app.session.execute("layer.select", json!({"layers": layers})).unwrap();
+    for e in ["slider", "angle", "checkbox", "color", "point"] {
+        app.session.execute("effect.apply", json!({"effect": format!("ec.control.{e}"), "layers": [layers[0]]})).unwrap();
+    }
+    for i in 0..6 {
+        app.session.execute("renderQueue.add", json!({})).unwrap();
+        let comment = "a marker comment long enough to run right across the panel and off its far edge, under anything there";
+        app.session.execute("markers.set", json!({"new": true, "time": 1.0 + i as f64 * 0.5, "comment": comment})).unwrap();
+    }
+    app.session.execute("mediaBrowser.go", json!({"path": folder.to_string_lossy(), "importableOnly": false})).unwrap();
+    app.show_panel(panel);
+    app.ui.maximized = Some(panel);
+    h.run_steps(4);
+    h
+}
+
+/// A folder of files for the Media Browser's tiles, under a name only `test` uses.
+fn folder_of_files(test: &str) -> std::path::PathBuf {
+    let dir = std::env::temp_dir().join(format!("ec-ui-scrolling-{test}-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    for i in 0..24 {
+        std::fs::write(dir.join(format!("file{i}.txt")), "x").unwrap();
+    }
+    dir
+}
+
+/// The right edge of the elements under `prefix` level with `track` (or anywhere, without one),
+/// other than the scroll bar `bar`.
+fn rightmost(h: &Harness<'_, EffectcraftApp>, prefix: &str, bar: &str, track: Option<Rect>) -> Option<f32> {
+    h.state()
+        .auto
+        .query(prefix)
+        .into_iter()
+        .filter(|e| e.id != bar)
+        .map(|e| Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3])))
+        .filter(|r| track.is_none_or(|t| r.max.y > t.min.y && r.min.y < t.max.y))
+        .map(|r| r.max.x)
+        .reduce(f32::max)
+}
+
+/// The text painted this frame, with where it shows (cut by its clip).
+fn painted_text(h: &Harness<'_, EffectcraftApp>) -> Vec<(String, Rect)> {
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|c| match &c.shape {
+            egui::Shape::Text(t) => Some((t.galley.text().to_string(), t.visual_bounding_rect().intersect(c.clip_rect))),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The panels that scroll their rows: the elements in them (none for a panel that only paints),
+/// the scroll bar, and how far in from the panel's edge the rows end at full width (`None`: their
+/// width is capped).
+const SCROLLED_PANELS: [(effectcraft_ui_egui::dock::PanelKind, &str, &str, Option<f32>); 12] = {
+    use effectcraft_ui_egui::dock::PanelKind as P;
+    [
+        (P::EffectControls, "effectControls.", "effectControls.scroll", Some(0.0)),
+        (P::EffectsPresets, "effects.", "effects.scroll", Some(0.0)),
+        (P::Info, "info.", "info.scroll", None),
+        (P::MediaBrowser, "mediaBrowser.entry.", "mediaBrowser.scroll", None),
+        (P::Preview, "preview.", "preview.scroll", None),
+        (P::History, "history.state.", "history.scroll", Some(0.0)),
+        (P::Markers, "markers.", "markers.scroll", None),
+        (P::Properties, "properties.", "properties.scroll", Some(12.0)),
+        (P::RenderQueue, "renderQueue.item.", "renderQueue.scroll", Some(0.0)),
+        (P::Character, "character.", "character.scroll", Some(10.0)),
+        (P::Paragraph, "paragraph.", "paragraph.scroll", Some(10.0)),
+        (P::Project, "project.item.", "project.vscroll", Some(0.0)),
+    ]
+};
+
+/// While a panel's rows overflow, they (and their widgets and text) stop before its scroll bar,
+/// which was drawn over them (#2867).
+#[test]
+fn panel_rows_stop_before_their_scroll_bar() {
+    let folder = folder_of_files("short");
+    for (panel, prefix, bar, _) in SCROLLED_PANELS {
+        // (The Project panel's list starts below its item preview and search: a taller window.)
+        let h = panel_with_rows(panel, if bar == "project.vscroll" { 330.0 } else { 240.0 }, &folder);
+        assert!(scrolled(&h, bar).1 > 0.0, "{bar}: the rows overflow");
+        let track = rect(&h, bar);
+        if let Some(right) = rightmost(&h, prefix, bar, Some(track)) {
+            assert!(right <= track.min.x, "{bar}: the rows end at {right}, on the track {track:?}");
+        } else {
+            assert!(matches!(bar, "info.scroll" | "markers.scroll"), "{bar}: no rows beside the track");
+        }
+        let lane = Rect::from_x_y_ranges(track.min.x..=track.max.x, track.y_range());
+        for (text, at) in painted_text(&h) {
+            assert!(!at.intersects(lane), "{bar}: {text:?} shows at {at:?}, on the track {track:?}");
+        }
+    }
+    let _ = std::fs::remove_dir_all(&folder);
+}
+
+/// Panels whose rows fit show no bar and give up no width for one.
+#[test]
+fn panels_with_room_keep_their_full_width() {
+    let folder = folder_of_files("tall");
+    for (panel, prefix, bar, inset) in SCROLLED_PANELS {
+        let h = panel_with_rows(panel, 1600.0, &folder);
+        assert!(h.state().auto.find(bar).is_none(), "{bar}: the rows fit");
+        let edge = rect(&h, &format!("panel.{}", panel.id())).max.x - 1.0;
+        if let Some(inset) = inset {
+            let right = rightmost(&h, prefix, bar, None).unwrap_or_else(|| panic!("{bar}: no rows"));
+            assert!((edge - inset - right).abs() < 0.01, "{bar}: the rows end at {right}, {inset} in from {edge}");
+        }
+    }
+    let _ = std::fs::remove_dir_all(&folder);
+}
+
+/// The Render Queue's header columns stay over their columns when the rows narrow for the bar.
+#[test]
+fn render_queue_header_lines_up_with_narrowed_rows() {
+    use effectcraft_ui_egui::dock::PanelKind;
+    let h = panel_with_rows(PanelKind::RenderQueue, 240.0, &std::env::temp_dir());
+    assert!(scrolled(&h, "renderQueue.scroll").1 > 0.0, "the rows overflow");
+    let status = rect(&h, "renderQueue.item.1.status");
+    let header = painted_text(&h).into_iter().find(|(text, _)| text == "Status").expect("the Status header");
+    assert!((header.1.min.x - status.min.x - 2.0).abs() < 2.0, "the header ({:?}) over the column ({status:?})", header.1);
+}
+
+/// In a narrow Effect Controls panel an animated point's values stay clear of its keyframe
+/// navigator (â—€ â—† â–¶), which was drawn over them (#271).
+#[test]
+fn effect_values_stay_clear_of_the_keyframe_navigator() {
+    use effectcraft_ui_egui::dock::PanelKind;
+    let mut h = harness(1600.0, 1000.0);
+    let app = h.state_mut();
+    let lid = app.session.active_comp().unwrap().layers[0].id.0;
+    app.session.execute("layer.select", json!({"layers": [lid]})).unwrap();
+    app.session.execute("effect.apply", json!({"effect": "ec.control.point", "layers": [lid]})).unwrap();
+    let path = "effects/#1/point";
+    app.session.execute("prop.toggleAnimation", json!({"layer": lid, "path": path})).unwrap();
+    app.session.execute("prop.set", json!({"layer": lid, "path": path, "value": [123456.7, 123456.7]})).unwrap();
+    let uid = app.session.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(lid)).unwrap().props.prop(path).unwrap().uid;
+    app.apply_dock(craft_ui::docking::Action::Float { panel: PanelKind::EffectControls, rect: [300.0, 150.0, 330.0, 500.0] }).unwrap();
+    h.run_steps(3);
+    let value = rect(&h, &format!("effectControls.prop.{uid}.value.1"));
+    let nav = rect(&h, &format!("effectControls.prop.{uid}.prevKey"));
+    assert!(value.max.x <= nav.min.x, "the value ({value:?}) ends before the navigator ({nav:?})");
+    assert!(value.min.x > rect(&h, &format!("effectControls.prop.{uid}.stopwatch")).max.x, "and after the stopwatch");
+}
+
+/// The Settings dialog fits its width: its page column was wider than the dialog, so the whole
+/// dialog scrolled sideways a little (#284).
+#[test]
+fn settings_dialog_does_not_scroll_sideways() {
+    let mut h = harness(1400.0, 900.0);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "app.settings", json!({"page": "general"})).unwrap();
+    h.run_steps(3);
+    let (ok, page) = (rect(&h, "settings.ok"), rect(&h, "settings.page.general"));
+    h.input_mut().events.push(Event::PointerMoved(page.center()));
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(-400.0, 0.0),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
+    h.run_steps(20);
+    assert_eq!((rect(&h, "settings.ok"), rect(&h, "settings.page.general")), (ok, page), "nothing moved sideways");
+}
+
+/// #2034: the Settings sidebar uses the translated page names when deciding its width.
+#[test]
+fn settings_page_column_fits_japanese_names() {
+    use effectcraft_text::fonts;
+    use effectcraft_ui_egui::theme::Tokens;
+
+    let mut session = Session::default();
+    session.prefs.general.language = "ja".into();
+    let app = EffectcraftApp::new(session);
+    // The panel titles a page with its Settings menu row, minus the ellipsis.
+    let name = effectcraft_ui_egui::menus::menu_items(&app)
+        .into_iter()
+        .find(|m| m.id == "app.settings" && m.params["page"] == "scripting")
+        .and_then(|m| m.label.strip_suffix("...").map(str::to_owned))
+        .expect("the Settings menu lists the Scripting & Expressions page");
+    assert!(name.chars().any(|c| c >= '\u{3000}'), "the actual sidebar label is Japanese: {name}");
+    // Use the same external-directory scan and face coverage as production, before rendering.
+    // The managed job supplies CRAFT_FONTS_DIR; register its canonical fonts folder through the
+    // same directory source production scans for EFFECTCRAFT_FONT_DIRS, without changing the env.
+    crate::add_canonical_test_fonts();
+    fonts::scan_system();
+    let base = fonts::resolve("Inter", "Regular").face;
+    let japanese = fonts::face(fonts::fallback_for_locale('あ', base, "ja"));
+    for ch in ['あ', 'フ'].into_iter().chain(name.chars()) {
+        assert!(japanese.has_char(ch), "Japanese fixture lacks {ch:?} for {name:?}: {:?}", japanese.info);
+    }
+    let required_canonical = std::env::var("CRAFT_FONTS_REQUIRED").as_deref() == Ok("1");
+    if required_canonical {
+        let root = std::env::var_os("CRAFT_FONTS_DIR").expect("required canonical craft-fonts input");
+        let expected =
+            std::path::PathBuf::from(root).join("fonts/biz-ud-pgothic/BIZUDPGothic-Regular.ttf").canonicalize().expect("canonical BIZ UDPGothic Regular input");
+        let resolved = fonts::resolve("BIZ UDPGothic", "Regular");
+        assert!(!resolved.missing, "required BIZ UDPGothic Regular must resolve without substitution");
+        let face = fonts::face(resolved.face);
+        assert_eq!(face.info.family, "BIZ UDPGothic", "{:?}", face.info);
+        assert_eq!(face.info.style, "Regular", "{:?}", face.info);
+        assert_eq!(japanese.id, face.id, "required production fallback is the canonical BIZ face: selected {:?}, canonical {:?}", japanese.info, face.info);
+        let fonts::FaceData::File(path) = &face.info.data else { panic!("required BIZ face must come from canonical external input: {:?}", face.info) };
+        assert_eq!(path.canonicalize().unwrap(), expected, "required face source: {:?}", face.info);
+        let expected_bytes = std::fs::read(&expected).unwrap();
+        let font = face.font().expect("required canonical BIZ face parses");
+        assert!(font.data().as_bytes() == expected_bytes.as_slice(), "resolved BIZ bytes match canonical input {expected:?}");
+        for ch in ['あ', 'フ'].into_iter().chain(name.chars()) {
+            assert!(face.has_char(ch), "canonical BIZ input lacks actual label glyph {ch:?}: {:?}", face.info);
+        }
+        eprintln!("required Japanese input {expected:?}: {:?}", face.info);
+    }
+
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_| app);
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "app.settings", json!({"page": "scripting"})).unwrap();
+    h.run_steps(3);
+    h.ctx.fonts_mut(|fonts| {
+        let definitions = fonts.definitions();
+        assert!(
+            definitions.font_data.contains_key("japanese-system"),
+            "production installs the Japanese fallback; installed {:?}",
+            definitions.font_data.keys().collect::<Vec<_>>()
+        );
+        assert!(
+            definitions.families.get(&egui::FontFamily::Proportional).unwrap().iter().any(|name| name == "japanese-system"),
+            "production proportional stack reaches its Japanese fallback"
+        );
+        if required_canonical {
+            let registered = definitions.font_data.get("japanese-system").unwrap();
+            let selected = japanese.font().expect("selected canonical Japanese face parses");
+            assert_eq!(registered.index, japanese.info.index, "production registration retains selected face index");
+            assert!(
+                registered.font.as_ref().as_ref() == selected.data().as_bytes(),
+                "production japanese-system bytes equal the selected canonical fallback: {:?}",
+                japanese.info
+            );
+        }
+        assert!(fonts.has_glyphs(&Tokens::ui(12.5), &name), "production glyph lookup covers actual Japanese sidebar label {name:?}");
+    });
+    let text_width = h.ctx.fonts_mut(|fonts| fonts.layout_no_wrap(name.clone(), Tokens::ui(12.5), egui::Color32::WHITE).size().x);
+    let row = rect(&h, "settings.page.scripting");
+    assert!(row.width() >= text_width + 20.0, "{name} needs {text_width} points; row is {row:?}");
+}
diff --git a/crates/ui-egui/tests/it/ui_self_drop.rs b/crates/ui-egui/tests/it/ui_self_drop.rs
new file mode 100644
index 000000000..f8a44de83
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_self_drop.rs
@@ -0,0 +1,88 @@
+//! #2589: a Project selection that contains the composition being dropped into must not fail the
+//! whole drop. Rendering writes a file named after the composition, so the Project panel holds
+//! both and selects both; the composition itself is not a layer it can hold.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Modifiers, Pos2, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// Compositions "Main" (active, 4 s at 30 fps, one solid) and "Clip".
+fn harness() -> (Harness<'static, EffectcraftApp>, u64, u64) {
+    let mut s = Session::default();
+    let clip = s.execute("comp.new", json!({"name": "Clip", "width": 160, "height": 90, "frameRate": 30, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+    let main = s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap()["comp"].as_u64().unwrap();
+    s.execute("layer.newSolid", json!({"name": "Bottom", "color": "#406080"})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    (h, main, clip)
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).clone();
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+/// Press on `from`, move to `to` in steps, release there.
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
+    h.event(Event::PointerMoved(from));
+    h.step();
+    h.event(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=10 {
+        h.event(Event::PointerMoved(from + (to - from) * (k as f32 / 10.0)));
+        h.step();
+    }
+    h.event(Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn stack(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
+    h.state().session.active_comp().unwrap().layers.iter().map(|l| l.name.clone()).collect()
+}
+
+fn layer_id(h: &Harness<'_, EffectcraftApp>, name: &str) -> u64 {
+    h.state().session.active_comp().unwrap().layers.iter().find(|l| l.name == name).unwrap().id.0
+}
+
+/// Both the composition and the render output are selected: dragging the file onto the Timeline
+/// still lands the file, and the composition is not carried along into itself.
+#[test]
+fn a_selection_holding_the_drop_target_does_not_fail_the_drop() {
+    let (mut h, main, clip) = harness();
+    h.state_mut().session.execute("project.select", json!({"items": [main, clip]})).unwrap();
+    h.run_steps(2);
+    let from = rect(&h, &format!("project.item.{clip}.name")).center();
+    let row = rect(&h, &format!("timeline.layer.{}.row", layer_id(&h, "Bottom")));
+    drag(&mut h, from, row.center());
+    assert_eq!(stack(&h), ["Bottom", "Clip"], "the composition the drop lands in is left out");
+    assert!(!h.state().ui.status.contains("contain itself"), "the drop did not fail: {}", h.state().ui.status);
+}
+
+/// Dragging the composition's own row onto its Timeline adds nothing and reports nothing, whether
+/// the row was selected first or the drag started on an unselected row (#2589).
+#[test]
+fn the_composition_dropped_on_itself_adds_nothing() {
+    let (mut h, main, _clip) = harness();
+    h.state_mut().session.execute("project.select", json!({"items": [main]})).unwrap();
+    h.run_steps(2);
+    let before = stack(&h);
+    let from = rect(&h, &format!("project.item.{main}.name")).center();
+    let row = rect(&h, &format!("timeline.layer.{}.row", layer_id(&h, "Bottom")));
+    drag(&mut h, from, row.center());
+    assert_eq!(stack(&h), before, "nothing is added");
+    assert!(!h.state().ui.status.contains("contain itself"), "no error: {}", h.state().ui.status);
+
+    // The same row dragged while something else is selected: the early return for a single
+    // unselected item must not hand the composition to the engine either.
+    let (mut h, main, clip) = harness();
+    h.state_mut().session.execute("project.select", json!({"items": [clip]})).unwrap();
+    h.run_steps(2);
+    let before = stack(&h);
+    let from = rect(&h, &format!("project.item.{main}.name")).center();
+    let row = rect(&h, &format!("timeline.layer.{}.row", layer_id(&h, "Bottom")));
+    drag(&mut h, from, row.center());
+    assert_eq!(stack(&h), before, "nothing is added from an unselected row either");
+    assert!(!h.state().ui.status.contains("contain itself"), "no error: {}", h.state().ui.status);
+}
diff --git a/crates/ui-egui/tests/ui_settings_info.rs b/crates/ui-egui/tests/it/ui_settings_info.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_settings_info.rs
rename to crates/ui-egui/tests/it/ui_settings_info.rs
diff --git a/crates/ui-egui/tests/it/ui_settings_keyboard.rs b/crates/ui-egui/tests/it/ui_settings_keyboard.rs
new file mode 100644
index 000000000..e74ccfd94
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_settings_keyboard.rs
@@ -0,0 +1,113 @@
+//! Settings keyboard operation and accessible names (docs/gaps.md gap 25): the page list is one
+//! Tab stop worked with the arrow keys, Home and End; every control on a page has the name its
+//! label shows, with its value; Escape still cancels.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::accesskit::{Role, Toggled};
+use egui::{Event, Key, Modifiers};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+fn harness(page: &str) -> Harness<'static, EffectcraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(Session::default()));
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "app.settings", json!({"page": page})).unwrap();
+    h.run_steps(4);
+    h
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    for pressed in [true, false] {
+        h.input_mut().events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+        h.step();
+    }
+    h.run_steps(3);
+}
+
+fn focused(h: &Harness<'_, EffectcraftApp>) -> Option<(Role, String)> {
+    h.root().children_recursive().find(|n| n.is_focused()).map(|n| (n.accesskit_node().role(), n.accesskit_node().label().unwrap_or_default()))
+}
+
+fn titles() -> Vec<&'static str> {
+    effectcraft_engine::prefs::pages().iter().map(|p| p.title).collect()
+}
+
+#[test]
+fn the_page_list_is_one_tab_stop_worked_with_the_arrows() {
+    let mut h = harness("general");
+    let titles = titles();
+    let n = titles.len();
+    // Every page is a list item: its place in the list, and the open page selected.
+    for (i, title) in titles.iter().enumerate() {
+        let item = h.get_by_role_and_label(Role::ListItem, title);
+        assert_eq!(item.accesskit_node().role(), Role::ListItem, "{title}");
+        assert_eq!(item.accesskit_node().data().position_in_set(), Some(i + 1));
+        assert_eq!(item.accesskit_node().data().size_of_set(), Some(n));
+        assert_eq!(item.accesskit_node().is_selected(), Some(i == 0), "{title}");
+    }
+    h.get_by_role_and_label(Role::ListItem, titles[0]).focus();
+    h.run_steps(3);
+    assert_eq!(focused(&h), Some((Role::ListItem, titles[0].to_string())));
+    key(&mut h, Key::ArrowDown, Modifiers::NONE);
+    assert_eq!(focused(&h), Some((Role::ListItem, titles[1].to_string())), "Down Arrow opens the next page and the focus goes with it");
+    assert_eq!(h.get_by_role_and_label(Role::ListItem, titles[1]).accesskit_node().is_selected(), Some(true));
+    assert_eq!(h.get_by_role_and_label(Role::ListItem, titles[0]).accesskit_node().is_selected(), Some(false));
+    key(&mut h, Key::ArrowUp, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(titles[0].to_string()));
+    key(&mut h, Key::ArrowUp, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(titles[0].to_string()), "Up Arrow stops at the first page");
+    key(&mut h, Key::End, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(titles[n - 1].to_string()), "End goes to the last page");
+    key(&mut h, Key::Home, Modifiers::NONE);
+    assert_eq!(focused(&h).map(|f| f.1), Some(titles[0].to_string()), "Home goes to the first page");
+    // Only the open page is a Tab stop: Tab leaves the list for the page's first control.
+    key(&mut h, Key::Tab, Modifiers::NONE);
+    let (role, _) = focused(&h).expect("Tab moves the focus on");
+    assert_ne!(role, Role::ListItem, "Tab leaves the page list");
+}
+
+#[test]
+fn controls_have_the_name_their_label_shows_and_their_value() {
+    let h = harness("general");
+    let undo = h.get_by_label("Levels of Undo");
+    assert_eq!(undo.accesskit_node().role(), Role::SpinButton);
+    assert!(undo.accesskit_node().numeric_value().is_some(), "a spin button carries its number");
+    let language = h.get_by_label("Language");
+    assert_eq!(language.accesskit_node().role(), Role::ComboBox);
+    assert!(language.accesskit_node().value().is_some_and(|v| !v.is_empty()), "a drop-down carries what it is set to");
+    let tips = h.get_by_label("Show Tool Tips");
+    assert_eq!(tips.accesskit_node().role(), Role::CheckBox);
+    assert!(matches!(tips.accesskit_node().toggled(), Some(Toggled::True | Toggled::False)));
+    for name in ["   OK   ", "Cancel", "Previous", "Next"] {
+        assert_eq!(h.get_by_label(name).accesskit_node().role(), Role::Button, "{name}");
+    }
+    // Previous is disabled on the first page.
+    assert!(h.get_by_label("Previous").accesskit_node().is_disabled());
+}
+
+#[test]
+fn text_fields_colour_buttons_and_theme_cards_are_named() {
+    let h = harness("labels");
+    let name = h.get_by_label("Label 1 name");
+    assert_eq!(name.accesskit_node().role(), Role::TextInput);
+    assert!(name.accesskit_node().value().is_some_and(|v| !v.is_empty()), "the field carries its text");
+    let color = h.get_by_label("Label 1 color");
+    assert_eq!(color.accesskit_node().role(), Role::ColorWell);
+    assert!(color.accesskit_node().value().is_some_and(|v| v.starts_with('#')), "a colour carries its hex value");
+    let h = harness("appearance");
+    assert_eq!(h.get_by_label("Appearance Mode").accesskit_node().role(), Role::ComboBox);
+    assert!(h.query_all_by_role(Role::RadioButton).count() >= 2, "the themes are radio buttons");
+}
+
+#[test]
+fn escape_still_cancels_with_the_keyboard_on_the_page_list() {
+    let mut h = harness("general");
+    let first = titles()[0];
+    h.get_by_role_and_label(Role::ListItem, first).focus();
+    h.run_steps(3);
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().dialog.is_none(), "Escape closes the dialog");
+}
diff --git a/crates/ui-egui/tests/it/ui_shortcut_scopes.rs b/crates/ui-egui/tests/it/ui_shortcut_scopes.rs
new file mode 100644
index 000000000..6c79fe72a
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_shortcut_scopes.rs
@@ -0,0 +1,86 @@
+//! Shortcut scopes: one chord can run a different command in a panel than in the rest of the
+//! application, and the Timeline's keys work with the Composition panel focused.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::{Key, Modifiers};
+use serde_json::json;
+
+/// A comp with one solid selected at 1 s, and one render item.
+fn app() -> EffectcraftApp {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 160, "height": 90, "frameRate": 30, "duration": 4})).unwrap();
+    s.execute("layer.newSolid", json!({"color": "#406080"})).unwrap();
+    s.execute("renderQueue.add", json!({"output": "/out/main.mov"})).unwrap();
+    s.execute("time.set", json!({"time": 1.0})).unwrap();
+    EffectcraftApp::new(s)
+}
+
+/// Press `key` with `modifiers` and run the shortcut dispatcher on it.
+fn press(app: &mut EffectcraftApp, key: Key, modifiers: Modifiers) {
+    let ctx = egui::Context::default();
+    let raw = egui::RawInput { events: vec![egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers }], ..Default::default() };
+    let mut output = ctx.run_ui(raw, |ui| effectcraft_ui_egui::menus::handle_shortcuts(app, ui.ctx()));
+    output.textures_delta.clear();
+}
+
+fn layers(app: &EffectcraftApp) -> usize {
+    app.session.active_comp().map_or(0, |c| c.layers.len())
+}
+
+fn render_items(app: &EffectcraftApp) -> usize {
+    app.session.project.render_queue.len()
+}
+
+#[test]
+fn a_panels_shortcut_wins_in_its_panel_and_the_applications_everywhere_else() {
+    let mut app = app();
+    // Duplicate Render Item (Render Queue) on Split Layer's chord.
+    app.session.execute("shortcuts.set", json!({"command": "renderQueue.duplicate", "keys": "Cmd+Shift+D"})).unwrap();
+    let chord = Modifiers::COMMAND | Modifiers::SHIFT;
+
+    app.ui.focused = PanelKind::Timeline;
+    press(&mut app, Key::D, chord);
+    assert_eq!((layers(&app), render_items(&app)), (2, 1), "in the Timeline the chord splits the layer");
+
+    app.ui.focused = PanelKind::RenderQueue;
+    press(&mut app, Key::D, chord);
+    assert_eq!((layers(&app), render_items(&app)), (2, 2), "in the Render Queue it duplicates the render item");
+
+    app.ui.focused = PanelKind::Project;
+    app.session.execute("edit.selectAll", json!({})).unwrap();
+    app.session.execute("time.set", json!({"time": 2.0})).unwrap();
+    press(&mut app, Key::D, chord);
+    assert_eq!((layers(&app), render_items(&app)), (3, 2), "and in any other panel it is Split Layer again");
+}
+
+#[test]
+fn a_panels_shortcut_that_nothing_else_claims_runs_from_any_panel() {
+    let mut app = app();
+    let unclaimed = "Cmd+Alt+Shift+F12";
+    assert!(app.session.shortcuts().bindings().iter().all(|(sc, _)| *sc != unclaimed), "{unclaimed} has a default now; pick a free chord");
+    app.session.execute("shortcuts.set", json!({"command": "renderQueue.duplicate", "keys": unclaimed})).unwrap();
+    app.ui.focused = PanelKind::Timeline;
+    press(&mut app, Key::F12, Modifiers::COMMAND | Modifiers::ALT | Modifiers::SHIFT);
+    assert_eq!(render_items(&app), 2);
+}
+
+#[test]
+fn the_timelines_keys_work_with_the_composition_panel_focused() {
+    for focused in [PanelKind::Timeline, PanelKind::Composition] {
+        let mut app = app();
+        app.ui.focused = focused;
+        // B: the work area begins at the current time (a Timeline shortcut).
+        press(&mut app, Key::B, Modifiers::NONE);
+        let start = app.session.active_comp().map(|c| c.work_area.0.seconds());
+        assert_eq!(start, Some(1.0), "{focused:?}");
+    }
+}
+
+#[test]
+fn the_default_preset_has_no_two_commands_on_one_chord_in_one_scope() {
+    let app = app();
+    let c = app.session.shortcuts().all_conflicts();
+    assert!(c.is_empty(), "{c:?}");
+}
diff --git a/crates/ui-egui/tests/ui_tabs.rs b/crates/ui-egui/tests/it/ui_tabs.rs
similarity index 61%
rename from crates/ui-egui/tests/ui_tabs.rs
rename to crates/ui-egui/tests/it/ui_tabs.rs
index 7f4689bf5..cc9e56041 100644
--- a/crates/ui-egui/tests/ui_tabs.rs
+++ b/crates/ui-egui/tests/it/ui_tabs.rs
@@ -2,10 +2,12 @@
 //! as its own Timeline tab (not a rename, and not in place of the comp shown), the tabs switch and
 //! close comps, and a dragged tab lands where its insertion mark shows.
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::project::ItemId;
 use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::{DockNode, PanelKind};
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
+use effectcraft_ui_egui::dock::{Node, PanelKind, SplitSize, Workspace};
 use egui::{Event, Pos2, pos2};
 use egui_kittest::Harness;
 use serde_json::json;
@@ -59,15 +61,6 @@ fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
     h.run_steps(2);
 }
 
-/// The tabs of the docked group holding `p`, in order.
-fn group_of(n: &DockNode, p: PanelKind) -> Option<Vec<PanelKind>> {
-    match n {
-        DockNode::Split { a, b, .. } => group_of(a, p).or_else(|| group_of(b, p)),
-        DockNode::Tabs { panels, .. } => panels.contains(&p).then(|| panels.clone()),
-        DockNode::Stack { entries } => entries.iter().find(|e| e.contains(p)).map(|e| e.panels.clone()),
-    }
-}
-
 fn open_comps(h: &Harness<'_, EffectcraftApp>) -> Vec<u64> {
     h.state().session.state.open_comps.iter().map(|c| c.0).collect()
 }
@@ -81,10 +74,11 @@ fn project_double_click_opens_a_comp_as_its_own_timeline_tab() {
     assert_eq!(open_comps(&h), vec![main, pre]);
     assert_eq!(h.state().session.state.active_comp, Some(ItemId(pre)));
     assert_eq!(h.state().session.project.item(ItemId(pre)).map(|i| i.name.clone()), Some("Pre".into()));
-    // One Timeline tab per comp, the newest last; the shown one answers to the panel's id.
+    // One comp tab per comp in the Timeline's tab strip, the newest last.
     let (tm, tp) = (rect(&h, &format!("panel.tab.Timeline.{main}")), rect(&h, &format!("panel.tab.Timeline.{pre}")));
-    assert!(tp.min.x > tm.max.x, "{tm:?} {tp:?}");
-    assert_eq!(rect(&h, "panel.tab.Timeline"), tp);
+    assert!(tp.min.x >= tm.max.x - 0.5, "{tm:?} {tp:?}");
+    let strip = rect(&h, "panel.tab.Timeline");
+    assert!(strip.y_range().contains(tp.center().y) && tp.min.x > strip.max.x, "{strip:?} {tp:?}");
     // Clicking Main's tab shows Main again; both stay open.
     click_n(&mut h, tm.center(), 1);
     assert_eq!(h.state().session.state.active_comp, Some(ItemId(main)));
@@ -94,7 +88,7 @@ fn project_double_click_opens_a_comp_as_its_own_timeline_tab() {
     click_n(&mut h, close.center(), 1);
     assert_eq!(open_comps(&h), vec![pre]);
     assert_eq!(h.state().session.state.active_comp, Some(ItemId(pre)));
-    assert!(h.state().ui.dock.contains(PanelKind::Timeline));
+    assert!(h.state().ui.dock.is_docked(PanelKind::Timeline));
     // Double-clicking an open comp again adds no second tab.
     let name = rect(&h, &format!("project.item.{pre}.name"));
     click_n(&mut h, name.center(), 2);
@@ -123,7 +117,7 @@ fn dragged_tabs_land_where_the_insertion_mark_is() {
     assert_eq!(group_of(&dock(&h), PanelKind::Timeline), Some(vec![PanelKind::RenderQueue, PanelKind::Timeline, PanelKind::EffectControls]));
 }
 
-/// `cargo test -p effectcraft-ui-egui --test ui_tabs -- --ignored`: the insertion mark mid-drag
+/// `cargo test -p effectcraft-ui-egui --test it ui_tabs:: -- --ignored`: the insertion mark mid-drag
 /// (`target/test-out/tab-drag.png`).
 #[test]
 #[ignore]
@@ -142,7 +136,7 @@ fn tab_drag_snapshot() {
     }
     let dir = concat!(env!("CARGO_MANIFEST_DIR"), "/../../target/test-out");
     std::fs::create_dir_all(dir).unwrap();
-    h.render().expect("render").save(format!("{dir}/tab-drag.png")).unwrap();
+    h.render_serialized().expect("render").save(format!("{dir}/tab-drag.png")).unwrap();
 }
 
 /// A precomp layer's bar shows its comp's markers; a double-click opens that comp at the marker.
@@ -179,18 +173,17 @@ fn double_clicking_a_precomp_bar_opens_its_comp() {
     assert_eq!(h.state().session.active_comp_id(), Some(ItemId(pre)));
 }
 
-/// Issue #46: a panel dragged by its panel-menu (hamburger) button onto the left edge of another
-/// group docks there as its own group; dragging the gap between panels resizes them.
+/// Issue #46: a panel dragged onto the left edge of another group docks there as its own group;
+/// dragging the gap between panels resizes them.
 #[test]
 fn panels_dock_beside_others_and_gutters_resize_them() {
     let (mut h, _, _) = harness();
     let dock = |h: &Harness<'_, EffectcraftApp>| h.state().ui.dock.clone();
-    // Show Effect Controls in its group so its menu button is on screen, then drag by it.
     let tab = rect(&h, "panel.tab.EffectControls");
-    click_n(&mut h, tab.center(), 1);
-    let grip = rect(&h, "panel.menu.EffectControls").center();
     let tl = rect(&h, "panel.Timeline");
-    drag(&mut h, grip, pos2(tl.min.x + tl.width() * 0.08, tl.center().y));
+    // Inside the Timeline body's left drop zone.
+    let depth = craft_ui::docking::SIDE_EDGE_ZONE_DEPTH.min(tl.width().min(tl.height()) / 4.0);
+    drag(&mut h, tab.center(), pos2(tl.min.x + depth / 2.0, tl.center().y));
     assert_eq!(group_of(&dock(&h), PanelKind::EffectControls), Some(vec![PanelKind::EffectControls]));
     assert!(!group_of(&dock(&h), PanelKind::Timeline).unwrap().contains(&PanelKind::EffectControls));
     let (fx, tl) = (rect(&h, "panel.EffectControls"), rect(&h, "panel.Timeline"));
@@ -212,41 +205,83 @@ fn panels_dock_beside_others_and_gutters_resize_them() {
     assert!((wider.width() - project.width() - 60.0).abs() < 2.0, "{} → {}", project.width(), wider.width());
 }
 
-/// Issue #171: the gaps between the right column's stacked panels drag to resize them (Preview
-/// was stuck at its default height), not below a minimum; the heights stay in the layout.
+/// The divider below the Preview frame: the horizontal gutter between it and the Properties
+/// frame.
+fn preview_divider(h: &Harness<'_, EffectcraftApp>) -> egui::Rect {
+    let (preview, props) = (rect(h, "panel.Preview"), rect(h, "panel.Properties"));
+    h.state()
+        .auto
+        .previous
+        .iter()
+        .filter(|e| e.id.starts_with("dock.gutter.") && e.rect[2] > e.rect[3])
+        .map(|e| egui::Rect::from_min_size(pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3])))
+        .find(|g| g.x_range().contains(preview.center().x) && g.center().y >= preview.max.y - 1.0 && g.center().y <= props.min.y + 1.0)
+        .expect("a gutter between Preview and Properties")
+}
+
+/// Default's right column: a short Preview frame (46 points of body) and the Properties frame
+/// below it taking the rest of the column, at any window height.
 #[test]
-fn stacked_panel_gaps_resize_the_panels() {
+fn the_default_preview_frame_is_short_and_properties_takes_the_rest() {
     let (mut h, _, _) = harness();
-    fn height(n: &DockNode, p: PanelKind) -> Option<Option<f32>> {
-        match n {
-            DockNode::Split { a, b, .. } => height(a, p).or_else(|| height(b, p)),
-            DockNode::Tabs { .. } => None,
-            DockNode::Stack { entries } => entries.iter().find(|e| e.contains(p)).map(|e| e.height),
+    let body = |h: &Harness<'_, EffectcraftApp>| rect(h, "panel.Preview").height();
+    assert!((body(&h) - 46.0).abs() < 1.5, "Preview {}", body(&h));
+    let props = rect(&h, "panel.Properties");
+    assert!(props.height() > 300.0, "Properties {props:?}");
+    // A taller window gives the room to Properties.
+    let size = h.ctx.content_rect().size();
+    h.set_size(size + egui::vec2(0.0, 200.0));
+    h.run_steps(3);
+    assert!((body(&h) - 46.0).abs() < 1.5, "Preview {}", body(&h));
+    assert!((rect(&h, "panel.Properties").height() - props.height() - 200.0).abs() < 2.0);
+}
+
+/// Issue #171: the divider below the Preview frame drags to resize it (Preview was stuck at its
+/// default height), not below a minimum; the new height stays in the layout.
+#[test]
+fn the_preview_frame_divider_resizes_it() {
+    let (mut h, _, _) = harness();
+    fn preview_size(w: &Workspace) -> Option<SplitSize> {
+        fn rec(n: &Node<PanelKind>) -> Option<SplitSize> {
+            match n {
+                Node::Split { first, second, size, .. } => match first.as_ref() {
+                    Node::Tabs { panels, .. } if panels.contains(&PanelKind::Preview) => Some(*size),
+                    _ => rec(first).or_else(|| rec(second)),
+                },
+                _ => None,
+            }
         }
+        rec(w.layout.root.as_ref()?)
     }
     let (preview, props) = (rect(&h, "panel.Preview"), rect(&h, "panel.Properties"));
-    let gap = rect(&h, "dock.gutter.bs0");
-    assert!(gap.center().y > preview.max.y && gap.center().y < props.min.y, "the gap below Preview: {gap:?}");
+    let gap = preview_divider(&h);
     drag(&mut h, gap.center(), gap.center() + egui::vec2(0.0, 150.0));
     let (p2, q2) = (rect(&h, "panel.Preview"), rect(&h, "panel.Properties"));
     assert!((p2.height() - preview.height() - 150.0).abs() < 2.0, "Preview {} → {}", preview.height(), p2.height());
     assert!((props.height() - q2.height() - 150.0).abs() < 2.0, "Properties {} → {}", props.height(), q2.height());
     assert!((q2.max.y - props.max.y).abs() < 1.0, "the column stays filled");
-    let saved = height(&h.state().ui.dock, PanelKind::Preview).flatten().expect("Preview's height is in the layout");
-    assert!((saved - p2.height()).abs() < 2.0, "{saved} vs {}", p2.height());
-    assert_eq!(height(&h.state().ui.dock, PanelKind::Properties), Some(None), "Properties still takes the rest");
-    // Collapsing and expanding Preview keeps its height.
-    let tab = rect(&h, "panel.tab.Preview");
-    click_n(&mut h, tab.center(), 1);
-    assert!(!h.state().ui.dock.is_visible(PanelKind::Preview));
-    click_n(&mut h, tab.center(), 1);
-    assert!((rect(&h, "panel.Preview").height() - p2.height()).abs() < 1.0);
-    // Not below the minimum.
-    let gap = rect(&h, "dock.gutter.bs0");
-    drag(&mut h, gap.center(), gap.center() - egui::vec2(0.0, 400.0));
+    // The frame keeps a fixed height, 150 points more.
+    let Some(SplitSize::FixedFirst(size)) = preview_size(&h.state().ui.dock) else { panic!("{:?}", preview_size(&h.state().ui.dock)) };
+    assert!((size - effectcraft_ui_egui::dock::PREVIEW_FRAME - 150.0).abs() < 2.0, "{size}");
+    // Dragged up to Preview's top, it stops at its minimum.
+    let gap = preview_divider(&h);
+    let top = rect(&h, "panel.Preview").min.y;
+    drag(&mut h, gap.center(), pos2(gap.center().x, top));
     assert!((rect(&h, "panel.Preview").height() - 40.0).abs() < 1.0, "{}", rect(&h, "panel.Preview").height());
 }
 
+/// Maximize acts on one frame: the Preview frame fills the dock area, Properties hides.
+#[test]
+fn maximizing_preview_maximizes_its_frame_alone() {
+    let (mut h, _, _) = harness();
+    let preview = rect(&h, "panel.Preview");
+    h.state_mut().ui.maximized = Some(PanelKind::Preview);
+    h.run_steps(3);
+    let big = rect(&h, "panel.Preview");
+    assert!(big.height() > preview.height() + 300.0 && big.width() > preview.width() + 300.0, "{preview:?} → {big:?}");
+    assert!(h.state().auto.find("panel.Properties").is_none(), "the Properties frame is not shown");
+}
+
 /// Issue #45: the Project panel's details (name, size, duration) stay inside the panel with a
 /// margin, cut short with "…" when they don't fit; so does the hint shown with nothing selected.
 #[test]
@@ -338,42 +373,125 @@ fn dragging_the_viewer_timeline_divider_far_up_does_not_crash() {
     h.run_steps(2);
 }
 
-/// Issue #301: clicking anywhere on a stacked panel's header bar expands/collapses it, not only
-/// its name; the panel menu button keeps its own click.
+/// Issue #301: a stacked panel's header bar opens it with a click anywhere on it, and its −/+
+/// button at the bar's right end collapses and expands it.
 #[test]
 fn a_stacked_panels_whole_header_bar_toggles_it() {
     let (mut h, _, _) = harness();
+    use effectcraft_ui_egui::dock;
+    let stack = dock::stack(&[(PanelKind::Preview, true, Some(46.0)), (PanelKind::Properties, true, None)]);
+    h.state_mut().ui.dock = dock::docked(dock::hsplit(SplitSize::FixedSecond(300.0), dock::tabs(&[PanelKind::Composition], 0), stack));
+    h.run_steps(3);
     let open = |h: &Harness<'_, EffectcraftApp>| h.state().ui.dock.is_visible(PanelKind::Preview);
     assert!(open(&h));
-    let bar = rect(&h, "panel.header.Preview");
-    let tab = rect(&h, "panel.tab.Preview");
-    assert!(bar.min.x >= tab.max.x - 1.0 && bar.width() > 40.0, "{bar:?} {tab:?}");
-    click_n(&mut h, pos2(bar.max.x - 6.0, bar.center().y), 1);
-    assert!(!open(&h), "a click at the bar's right end collapses Preview");
-    let bar = rect(&h, "panel.header.Preview");
-    click_n(&mut h, bar.center(), 1);
+    let toggle = rect(&h, "panel.header.Preview");
+    let bar = rect(&h, "panel.tab.Preview");
+    assert!(toggle.max.x <= bar.max.x + 1.0 && toggle.min.x > bar.center().x, "{toggle:?} {bar:?}");
+    click_n(&mut h, toggle.center(), 1);
+    assert!(!open(&h), "the button collapses Preview");
+    let toggle = rect(&h, "panel.header.Preview");
+    click_n(&mut h, toggle.center(), 1);
     assert!(open(&h), "and expands it again");
-    let menu = rect(&h, "panel.menu.Preview");
-    click_n(&mut h, menu.center(), 1);
-    assert!(open(&h), "the panel menu button doesn't toggle the panel");
+    let toggle = rect(&h, "panel.header.Preview");
+    click_n(&mut h, toggle.center(), 1);
+    assert!(!open(&h));
+    click_n(&mut h, pos2(bar.min.x + bar.width() * 0.25, bar.center().y), 1);
+    assert!(open(&h), "a click on the bar away from the button opens it");
 }
 
-/// #302: a panel dropped onto a stacked panel becomes a tab in that panel's frame (it was
-/// inserted as a stacked panel of its own below it); its tabs switch the frame's panel.
+/// #302: a panel dropped onto the Properties frame becomes a tab in that frame; its tabs switch
+/// the frame's panel, and the Preview frame above keeps showing.
 #[test]
-fn a_tab_dropped_on_a_stacked_panel_joins_its_frame() {
+fn a_tab_dropped_on_a_frame_joins_it() {
     let (mut h, _, _) = harness();
     let dock = |h: &Harness<'_, EffectcraftApp>| h.state().ui.dock.clone();
     let fx = rect(&h, "panel.tab.EffectControls");
     let props = rect(&h, "panel.Properties");
     drag(&mut h, fx.center(), props.center());
-    assert_eq!(group_of(&dock(&h), PanelKind::Properties), Some(vec![PanelKind::Properties, PanelKind::EffectControls]));
+    let group = group_of(&dock(&h), PanelKind::Properties).unwrap();
+    assert!(group.starts_with(&[PanelKind::Properties]) && group.contains(&PanelKind::EffectControls), "{group:?}");
     assert!(dock(&h).is_visible(PanelKind::EffectControls) && !dock(&h).is_visible(PanelKind::Properties));
+    assert!(dock(&h).is_visible(PanelKind::Preview));
     // The frame's other tab shows Properties again, the frame stays open.
     let tab = rect(&h, "panel.tab.Properties");
     click_n(&mut h, tab.center(), 1);
     assert!(dock(&h).is_visible(PanelKind::Properties) && !dock(&h).is_visible(PanelKind::EffectControls));
     // The layout (saved workspaces) round-trips.
     let s = serde_json::to_string(&dock(&h)).unwrap();
-    assert_eq!(serde_json::from_str::<DockNode>(&s).unwrap(), dock(&h));
+    assert_eq!(serde_json::from_str::<Workspace>(&s).unwrap(), dock(&h));
+}
+
+/// The tabs of the group holding `p`, in order.
+fn group_of(w: &Workspace, p: PanelKind) -> Option<Vec<PanelKind>> {
+    Some(w.group_of(p)).filter(|g| !g.is_empty())
+}
+
+fn has(h: &Harness<'_, EffectcraftApp>, id: &str) -> bool {
+    h.state().auto.previous.iter().chain(h.state().auto.elements.iter()).any(|e| e.id == id)
+}
+
+#[test]
+fn open_comps_are_tabs_in_the_timeline_row_and_the_rest_are_in_its_overflow_menu() {
+    let mut s = Session::default();
+    let names = ["Opening Titles", "Lower Third Left", "Lower Third Right", "Product Shot", "End Card Wide", "Logo Sting Short"];
+    let comps: Vec<u64> = names
+        .iter()
+        .map(|name| s.execute("comp.new", json!({"name": name, "width": 320, "height": 180, "duration": 4})).unwrap()["comp"].as_u64().unwrap())
+        .collect();
+    s.state.open_comps = vec![ItemId(comps[0])];
+    s.state.active_comp = Some(ItemId(comps[0]));
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 800.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    let alone = rect(&h, "panel.tab.RenderQueue");
+    h.state_mut().session.state.open_comps = comps.iter().map(|c| ItemId(*c)).collect();
+    h.run_steps(3);
+    // The panel tabs keep their width; the comp tabs follow them in the same row, in order.
+    let (tl, rq) = (rect(&h, "panel.tab.Timeline"), rect(&h, "panel.tab.RenderQueue"));
+    assert!((rq.width() - alone.width()).abs() < 0.5, "Render Queue {rq:?} was {alone:?}");
+    let shown: Vec<u64> = comps.iter().copied().filter(|c| has(&h, &format!("panel.tab.Timeline.{c}"))).collect();
+    assert!(shown.contains(&comps[0]) && shown.len() < comps.len(), "{shown:?}");
+    let mut x = rq.max.x;
+    for c in &shown {
+        let tab = rect(&h, &format!("panel.tab.Timeline.{c}"));
+        assert!(tl.y_range().contains(tab.center().y) && tab.min.x >= x - 0.5, "comp {c} at {tab:?} after x {x}");
+        x = tab.max.x;
+    }
+    // A comp with no room is in the » menu; picking it shows it, and its tab joins the row.
+    let hidden = comps.iter().copied().find(|c| !shown.contains(c)).unwrap();
+    let more = rect(&h, "panel.tab.Timeline.more");
+    assert!(more.min.x >= x - 0.5 && tl.y_range().contains(more.center().y), "{more:?}");
+    click_n(&mut h, more.center(), 1);
+    let item = rect(&h, &format!("panel.tab.Timeline.more.{hidden}"));
+    click_n(&mut h, item.center(), 1);
+    assert_eq!(h.state().session.state.active_comp, Some(ItemId(hidden)));
+    assert_eq!(open_comps(&h), comps);
+    assert!(has(&h, &format!("panel.tab.Timeline.{hidden}")));
+}
+
+/// Whether `id` was registered in the last frame (not the one before).
+fn drawn(h: &Harness<'_, EffectcraftApp>, id: &str) -> bool {
+    h.state().auto.elements.iter().any(|e| e.id == id)
+}
+
+#[test]
+fn an_inactive_comp_tab_shows_its_close_button_on_hover_and_closes_without_showing_its_comp() {
+    let (mut h, pre, main) = harness();
+    h.state_mut().session.state.open_comps = vec![ItemId(main), ItemId(pre)];
+    h.run_steps(3);
+    let (tm, tp) = (rect(&h, &format!("panel.tab.Timeline.{main}")), rect(&h, &format!("panel.tab.Timeline.{pre}")));
+    // The shown comp's × is always there; Pre's only while the pointer is over its tab.
+    h.event(Event::PointerMoved(pos2(800.0, 900.0)));
+    h.run_steps(2);
+    assert!(drawn(&h, "panel.tab.Timeline.close") && drawn(&h, &format!("panel.tab.Timeline.{main}.close")));
+    assert!(!drawn(&h, &format!("panel.tab.Timeline.{pre}.close")), "no × on an inactive tab the pointer is not over");
+    h.event(Event::PointerMoved(tp.center()));
+    h.run_steps(2);
+    let close = rect(&h, &format!("panel.tab.Timeline.{pre}.close"));
+    assert!(tp.contains_rect(close), "{close:?} inside {tp:?}");
+    // Every comp tab keeps the ×'s room: hovering changes no width.
+    assert_eq!((rect(&h, &format!("panel.tab.Timeline.{main}")), rect(&h, &format!("panel.tab.Timeline.{pre}"))), (tm, tp));
+    // Its × closes Pre's Timeline; Main stays shown.
+    click_n(&mut h, close.center(), 1);
+    assert_eq!(open_comps(&h), vec![main]);
+    assert_eq!(h.state().session.state.active_comp, Some(ItemId(main)));
 }
diff --git a/crates/ui-egui/tests/ui_tail.rs b/crates/ui-egui/tests/it/ui_tail.rs
similarity index 63%
rename from crates/ui-egui/tests/ui_tail.rs
rename to crates/ui-egui/tests/it/ui_tail.rs
index b526c7e28..293ba87ae 100644
--- a/crates/ui-egui/tests/ui_tail.rs
+++ b/crates/ui-egui/tests/it/ui_tail.rs
@@ -25,7 +25,7 @@ fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
     Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
 }
 
-fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
+pub(crate) fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
     h.input_mut().events.push(Event::PointerMoved(from));
     h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
     h.step();
@@ -175,6 +175,30 @@ fn layer_style_buttons_stay_in_view() {
     }
 }
 
+/// #2057: Gradient Overlay's gradient has an Edit Gradient… button in the Layer Style dialog. It
+/// opens the Gradient Editor on that property, and closing the editor goes back to the dialog.
+#[test]
+fn layer_style_gradient_opens_the_gradient_editor() {
+    for ok in [true, false] {
+        let mut h = harness(1400.0);
+        let lid = h.state().session.active_comp().unwrap().layers[0].id.0;
+        h.state_mut().session.execute("layer.select", json!({"layers": [lid]})).unwrap();
+        let ctx = h.ctx.clone();
+        effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.style.gradientOverlay", json!({})).unwrap();
+        h.run_steps(5);
+        let edit = in_view(&h, "dialog.layerStyle.value.gradientOverlay/colors");
+        click(&mut h, edit);
+        assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::GradientEditor), "Edit Gradient… opened the editor");
+        effectcraft_ui_egui::panels::gradient_editor::finish(h.state_mut(), ok, &ctx);
+        h.run_steps(2);
+        assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::LayerStyles), "closing the editor (OK {ok}) went back to the dialog");
+        // The dialog closes as before once the editor is gone.
+        effectcraft_ui_egui::panels::layer_styles_dialog::finish(h.state_mut(), true);
+        h.run_steps(2);
+        assert_eq!(h.state().dialog, None);
+    }
+}
+
 /// #1062: with the buttons kept at the bottom, the style's controls still scroll both ways, so
 /// every one of them can be reached in the smallest window (960×600) at 200 % UI Scale, and in a
 /// dialog opened in a large window that then narrows: here Noise, near the end of Drop Shadow,
@@ -197,6 +221,7 @@ fn layer_style_controls_stay_reachable_in_a_small_window() {
             delta: vec2(-2000.0, -2000.0),
             modifiers: Default::default(),
             phase: egui::TouchPhase::Move,
+            source: egui::MouseWheelSource::Wheel,
         });
         h.run_steps(5);
         let at = in_view(&h, "dialog.layerStyle.value.dropShadow/noise");
@@ -207,6 +232,38 @@ fn layer_style_controls_stay_reachable_in_a_small_window() {
     }
 }
 
+/// #1389: on a layer with no styles, Blending Options shows its controls instead of an empty
+/// page. Opening the dialog adds nothing; the first change creates the Layer Styles group, and
+/// the group and the whole drag are one undo step.
+#[test]
+fn layer_style_blending_options_edit_a_layer_without_styles() {
+    let mut h = harness(1400.0);
+    let lid = h.state().session.active_comp().unwrap().layers[0].id.0;
+    h.state_mut().session.execute("layer.select", json!({"layers": [lid]})).unwrap();
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.style.options", json!({})).unwrap();
+    h.run_steps(5);
+    let has_group = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers[0].layer_styles().is_some();
+    let undo = h.state().session.history.undo.len();
+    assert_eq!(h.state().auto.find("dialog.layerStyle.page").unwrap().label, "blendingOptions");
+    let fill = "dialog.layerStyle.value.blendingOptions/advancedBlending/fillOpacity";
+    assert!(h.state().auto.find("dialog.layerStyle.value.blendingOptions/globalLightAngle").is_some(), "Global Light is shown");
+    let at = in_view(&h, fill);
+    assert!(!has_group(&h), "opening the page adds nothing");
+    drag(&mut h, at, at - vec2(40.0, 0.0));
+    let v =
+        h.state_mut().session.execute("prop.get", json!({"layer": lid, "path": "layerStyles/blendingOptions/advancedBlending/fillOpacity"})).unwrap()["value"]
+            .as_f64()
+            .unwrap();
+    assert!(v < 100.0, "Fill Opacity was dragged: {v}");
+    assert!(styles(&mut h).is_empty(), "no style was added");
+    assert_eq!(h.state().session.history.undo.len(), undo + 1, "the group and the drag are one undo step");
+    assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::LayerStyles));
+    effectcraft_ui_egui::panels::layer_styles_dialog::finish(h.state_mut(), true);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert!(!has_group(&h), "one undo removes the group");
+}
+
 #[test]
 fn layer_style_dialog_moves_by_its_title() {
     let mut h = harness(1400.0);
@@ -242,3 +299,76 @@ fn project_panel_columns_scroll_horizontally() {
     assert!(rect(&h, "project.sort.comment").min.x < x0 - 20.0);
     assert_eq!(rect(&h, "project.sort.name").min.x, name0, "Name stays frozen");
 }
+
+/// Hovering an icon-only Timeline column header explains it, and the header's own right-click
+/// column menu still opens under the icon.
+#[test]
+fn timeline_header_icons_explain_themselves_on_hover() {
+    use egui_kittest::kittest::Queryable;
+    let mut h = harness(1400.0);
+    // English whatever the system language: the menu item checked below is translated.
+    h.state_mut().session.prefs.general.language = "en".into();
+    h.run_steps(3);
+    for (id, tip) in [
+        ("timeline.header.av.solo", "Solo: while any layer is soloed, only the soloed layers render"),
+        ("timeline.header.av.video", "Video: shows or hides the layer's picture in the composition"),
+        ("timeline.header.switches.shy", "Shy: the layer leaves the Timeline while Hide Shy Layers is on"),
+        ("timeline.header.switches.threeD", "3D Layer: the layer moves and turns in depth and reacts to cameras and lights"),
+    ] {
+        // The tooltip is a node of its own, next to any the widget's accessible text makes.
+        let before = h.query_all_by_label(tip).count();
+        let at = rect(&h, id).center();
+        h.event(Event::PointerMoved(at));
+        h.run_steps(60);
+        assert!(h.query_all_by_label(tip).count() > before, "{id}: hovering shows {tip:?}");
+        h.event(Event::PointerMoved(pos2(5.0, 5.0)));
+        h.run_steps(5);
+    }
+    // The header's accessible node carries the text as its description (screen readers).
+    {
+        use egui_kittest::kittest::NodeT;
+        let tip = "Solo: while any layer is soloed, only the soloed layers render";
+        let described = h.query_all_by_label("Solo").any(|n| n.accesskit_node().description().as_deref() == Some(tip));
+        assert!(described, "the Solo header's node describes it");
+    }
+    // A layer's own switch shows the same text.
+    let lid = h.state().session.active_comp().unwrap().layers[0].id.0;
+    let lock = "Lock: keeps the layer from being selected or changed";
+    let before = h.query_all_by_label(lock).count();
+    let at = rect(&h, &format!("timeline.layer.{lid}.lock")).center();
+    h.event(Event::PointerMoved(at));
+    h.run_steps(60);
+    assert!(h.query_all_by_label(lock).count() > before, "the layer's Lock switch shows its text");
+    // Right-click on an icon still opens the header's column menu.
+    let at = rect(&h, "timeline.header.av.solo").center();
+    h.event(Event::PointerMoved(at));
+    h.step();
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed, modifiers: Default::default() });
+        h.step();
+    }
+    h.run_steps(3);
+    assert!(h.query_by_label("Hide This").is_some(), "the column menu opens under a header icon");
+}
+
+/// The Project panel's Name column edge drags to resize the column, and a double-click on the
+/// edge fits the names again.
+#[test]
+fn project_name_column_edge_resizes_and_fits_again() {
+    let mut h = harness(1400.0);
+    h.state_mut().ui.start_screen = false;
+    h.run_steps(3);
+    let before = rect(&h, "project.nameColumn.edge").center();
+    drag(&mut h, before, before + vec2(80.0, 0.0));
+    assert!(h.state().ui.project_name_w.is_some());
+    let edge = rect(&h, "project.nameColumn.edge").center();
+    assert!((edge.x - (before.x + 80.0)).abs() < 2.0, "{edge:?} after dragging from {before:?}");
+    h.input_mut().events.push(Event::PointerMoved(edge));
+    for _ in 0..2 {
+        h.input_mut().events.push(Event::PointerButton { pos: edge, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+        h.input_mut().events.push(Event::PointerButton { pos: edge, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    }
+    h.run_steps(3);
+    assert_eq!(h.state().ui.project_name_w, None);
+    assert!((rect(&h, "project.nameColumn.edge").center().x - before.x).abs() < 1.0);
+}
diff --git a/crates/ui-egui/tests/it/ui_text_edit.rs b/crates/ui-egui/tests/it/ui_text_edit.rs
new file mode 100644
index 000000000..6b68028de
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_text_edit.rs
@@ -0,0 +1,1873 @@
+//! Headless checks for on-canvas text editing in the viewer and the Character / Paragraph panels
+//! acting on the selection (egui_kittest, UI logic only: no GPU needed).
+
+use effectcraft_engine::Session;
+use effectcraft_engine::commands::text_edit::layer_doc;
+use effectcraft_engine::project::LayerId;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::{Event, Key, Modifiers, PointerButton, Pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+fn app() -> EffectcraftApp {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    EffectcraftApp::new(s)
+}
+
+/// A headless window at the size and frame step the viewer tests here are written for.
+fn harness(a: EffectcraftApp) -> Harness<'static, EffectcraftApp> {
+    Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |cc| {
+        EffectcraftApp::install_ime_reset_hooks(&cc.egui_ctx);
+        a
+    })
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> egui::Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    egui::Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3]))
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, p: Pos2, modifiers: Modifiers) {
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers });
+    h.run_steps(1);
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers });
+    h.run_steps(2);
+}
+
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    for i in 1..=8 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
+        h.run_steps(1);
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+}
+
+fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers });
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers });
+    h.run_steps(2);
+}
+
+fn type_text(h: &mut Harness<'_, EffectcraftApp>, t: &str) {
+    h.input_mut().events.push(Event::Text(t.into()));
+    h.run_steps(2);
+}
+
+fn edited(h: &Harness<'_, EffectcraftApp>) -> (u64, String, usize, usize) {
+    let s = &h.state().session;
+    let e = s.state.text_edit.clone().expect("editing");
+    (e.layer.0, layer_doc(s, e.layer).unwrap().text, e.anchor, e.caret)
+}
+
+#[test]
+fn type_tool_skips_hidden_and_unsoloed_text_layers() {
+    for switch in ["video", "solo"] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+        let mut ids = vec![];
+        for _ in 0..2 {
+            let lid = s.execute("layer.newText", json!({"text": "alpha beta", "size": 80, "position": [100, 200], "justify": "left"})).unwrap()["layer"]
+                .as_u64()
+                .unwrap();
+            ids.push(lid);
+        }
+        let (target, value) = if switch == "video" { (ids[1], false) } else { (ids[0], true) };
+        s.execute("layer.setSwitch", json!({"layers": [target], "switch": switch, "value": value})).unwrap();
+        s.execute("edit.deselectAll", json!({})).unwrap();
+        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
+        h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+        h.run_steps(3);
+        let comp = rect(&h, "viewer.comp");
+        let k = comp.width() / 640.0;
+        click(&mut h, comp.min + egui::vec2(330.0 * k, 180.0 * k), Modifiers::NONE);
+        assert_eq!(edited(&h).0, ids[0], "{switch}");
+    }
+}
+
+#[test]
+fn modal_blocks_background_text_events() {
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app());
+    h.run_steps(3);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(1);
+    let p = rect(&h, "viewer.comp").center();
+    click(&mut h, p, Modifiers::NONE);
+    type_text(&mut h, "Preserve");
+    let before = edited(&h).1;
+    h.state_mut().dialog = Some(effectcraft_ui_egui::Dialog::About);
+    h.run_steps(3);
+    h.input_mut().events.push(Event::Text("changed".into()));
+    h.input_mut().events.push(Event::Paste("pasted".into()));
+    key(&mut h, Key::Backspace, Modifiers::NONE);
+    assert_eq!(edited(&h).1, before);
+}
+
+#[test]
+fn type_tool_click_type_edit_and_commit() {
+    let mut h = harness(app());
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(1);
+    let comp = rect(&h, "viewer.comp");
+    // Click: a point text layer in edit mode, caret ready.
+    click(&mut h, comp.center(), Modifiers::NONE);
+    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 1);
+    type_text(&mut h, "Hello");
+    type_text(&mut h, " world");
+    let (lid, text, a, c) = edited(&h);
+    assert_eq!((text.as_str(), a, c), ("Hello world", 11, 11));
+    assert!(h.state().auto.find("viewer.textEdit").is_some(), "edit region registered");
+    // Arrow keys, Shift-extend, Backspace.
+    key(&mut h, Key::ArrowLeft, Modifiers::NONE);
+    key(&mut h, Key::ArrowLeft, Modifiers::SHIFT);
+    assert_eq!((edited(&h).2, edited(&h).3), (10, 9));
+    key(&mut h, Key::Backspace, Modifiers::NONE);
+    assert_eq!(edited(&h).1, "Hello word");
+    // Word jump and Home / End.
+    key(&mut h, Key::Home, Modifiers::NONE);
+    assert_eq!(edited(&h).3, 0);
+    key(&mut h, Key::ArrowRight, Modifiers::COMMAND);
+    assert_eq!(edited(&h).3, 5);
+    key(&mut h, Key::End, Modifiers::NONE);
+    assert_eq!(edited(&h).3, 10);
+    // Enter starts a new paragraph.
+    key(&mut h, Key::Enter, Modifiers::NONE);
+    type_text(&mut h, "two");
+    assert_eq!(edited(&h).1, "Hello word\ntwo");
+    // Select all, then the Character panel styles the selection only.
+    key(&mut h, Key::ArrowUp, Modifiers::NONE);
+    assert!(edited(&h).3 <= 10, "up to the first line");
+    key(&mut h, Key::Home, Modifiers::NONE);
+    key(&mut h, Key::End, Modifiers::SHIFT);
+    let (_, _, a, c) = edited(&h);
+    assert_eq!((a, c), (0, 10));
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    let bold = rect(&h, "character.fauxBold");
+    click(&mut h, bold.center(), Modifiers::NONE);
+    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
+    assert!(doc.style_at(2).faux_bold, "selection is bold");
+    assert!(!doc.style_at(12).faux_bold, "second paragraph untouched");
+    assert_eq!(doc.runs().len(), 2);
+    // Undo the style; Escape commits.
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert!(layer_doc(&h.state().session, LayerId(lid)).unwrap().is_uniform());
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.setSelection", json!({"start": 0})).unwrap();
+    h.run_steps(2);
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_none());
+}
+
+/// #831: clicking another panel (a solid's row in the Timeline) ends text editing and gives the
+/// keyboard back, whether the edit began with the Type tool (which stays selected) or by command:
+/// typed characters change no text and Space plays. The Character panel keeps the edit, and a
+/// text layer clicked into being and left empty stays, as it does in After Effects.
+#[test]
+fn clicking_another_panel_stops_typing_into_text() {
+    for type_tool in [false, true] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+        let solid = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+        let title =
+            s.execute("layer.newText", json!({"text": "Title", "size": 80, "position": [100, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+        let mut h = harness(EffectcraftApp::new(s));
+        h.state_mut().show_panel(PanelKind::Composition);
+        h.run_steps(3);
+        let layers = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.len();
+        // (Its row moves down as text layers are added.)
+        let row = |h: &Harness<'_, EffectcraftApp>| rect(h, &format!("timeline.layer.{solid}.row")).center();
+        if type_tool {
+            h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+            h.run_steps(1);
+            let at = rect(&h, "viewer.comp").center();
+            click(&mut h, at, Modifiers::NONE);
+            assert_eq!(layers(&h), 3, "the Type tool started a text layer");
+            let at_row = row(&h);
+            click(&mut h, at_row, Modifiers::NONE);
+            assert_eq!(layers(&h), 3, "left empty, it stays, as in After Effects");
+            click(&mut h, at, Modifiers::NONE);
+        } else {
+            h.state_mut().session.execute("text.edit", json!({"layer": title})).unwrap();
+            h.run_steps(2);
+        }
+        type_text(&mut h, "Hello");
+        // The Character panel formats the selection and keeps the edit: typing carries on.
+        key(&mut h, Key::ArrowLeft, Modifiers::SHIFT);
+        let range = edited(&h);
+        h.state_mut().show_panel(PanelKind::Character);
+        h.run_steps(3);
+        let bold = rect(&h, "character.fauxBold").center();
+        click(&mut h, bold, Modifiers::NONE);
+        assert_eq!(edited(&h), range, "type_tool {type_tool}: Character keeps the edit and its selection");
+        key(&mut h, Key::End, Modifiers::NONE);
+        type_text(&mut h, "!");
+        let (lid, text, ..) = edited(&h);
+        assert!(text.ends_with("Hello!"), "typing goes into the text: {text:?}");
+        let at_row = row(&h);
+        click(&mut h, at_row, Modifiers::NONE);
+        assert!(h.state().session.state.text_edit.is_none(), "type_tool {type_tool}: clicking the Timeline ends the edit");
+        assert_eq!(h.state().session.state.selected_layers, vec![LayerId(solid)]);
+        assert!(!h.ctx.memory(|m| m.focused().is_some()), "the keyboard is the app's again");
+        type_text(&mut h, "abc");
+        assert!(!h.state().playback.playing);
+        h.input_mut().events.push(Event::Key { key: Key::Space, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        h.input_mut().events.push(Event::Text(" ".into()));
+        h.input_mut().events.push(Event::Key { key: Key::Space, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+        h.run_steps(2);
+        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, text, "type_tool {type_tool}: the text is unchanged");
+        assert!(h.state().playback.playing, "type_tool {type_tool}: Space plays");
+        assert_eq!(type_tool, matches!(h.state().ui.tool, effectcraft_ui_egui::state::Tool::Type), "the tool is kept");
+    }
+}
+
+/// #831: opening a formatting panel's tab behind Effects & Presets in its group (Properties, in
+/// Undocked Panels) keeps the edit and its selected characters: the press on the tab used to
+/// focus the shown panel and end the edit, after which Faux Bold styled the whole layer.
+#[test]
+fn opening_a_formatting_tab_keeps_the_text_selection() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let lid =
+        s.execute("layer.newText", json!({"text": "Hello world", "size": 80, "position": [60, 200], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(EffectcraftApp::new(s));
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    // Effects & Presets shown, Properties, Character and Paragraph behind it.
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.workspace", json!({"name": "Undocked Panels"})).unwrap();
+    h.state_mut().session.execute("text.edit", json!({"layer": lid})).unwrap();
+    h.state_mut().session.execute("text.setSelection", json!({"anchor": 0, "caret": 5})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().auto.find("properties.text.style").is_none(), "Properties is behind Effects & Presets");
+    let tab = rect(&h, "panel.tab.Properties").center();
+    click(&mut h, tab, Modifiers::NONE);
+    assert!(h.state().auto.find("properties.text.style").is_some(), "the tab opened Properties");
+    assert_eq!(edited(&h), (lid, "Hello world".into(), 0, 5), "the edit and its selection are kept");
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    let bold = rect(&h, "character.fauxBold").center();
+    click(&mut h, bold, Modifiers::NONE);
+    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
+    assert!(doc.style_at(1).faux_bold && !doc.style_at(7).faux_bold, "only \"Hello\" is bold");
+}
+
+/// #831: a click away and keys in one frame's input. The text gets the keys typed before the
+/// click and none after it; those later keys don't run as shortcuts either (Delete would remove a
+/// layer). From the next frame the keys are the app's: Space plays.
+#[test]
+fn keys_after_a_click_away_in_the_same_frame_skip_the_text() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let solid = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "Hello", "size": 80, "position": [60, 200], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": lid, "caret": 5})).unwrap();
+    h.run_steps(2);
+    let row = rect(&h, &format!("timeline.layer.{solid}.row")).center();
+    let key = |key: Key, pressed: bool| Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE };
+    h.input_mut().events.extend([
+        Event::Text("A".into()),
+        Event::PointerMoved(row),
+        Event::PointerButton { pos: row, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        Event::PointerButton { pos: row, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        Event::Text("x".into()),
+        key(Key::Space, true),
+        Event::Text(" ".into()),
+        key(Key::Space, false),
+        key(Key::Delete, true),
+        key(Key::Delete, false),
+    ]);
+    h.run_steps(3);
+    let comp = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.len();
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "HelloA", "only the key before the click");
+    assert!(h.state().session.state.text_edit.is_none(), "the click ended the edit");
+    assert_eq!((comp(&h), h.state().playback.playing), (2, false), "the keys after it ran no shortcut");
+    h.input_mut().events.extend([key(Key::Space, true), Event::Text(" ".into()), key(Key::Space, false)]);
+    h.run_steps(2);
+    assert!(h.state().playback.playing, "Space plays");
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "HelloA");
+}
+
+#[test]
+fn switching_from_type_to_selection_commits_and_moves_text_layer() {
+    let mut h = harness(app());
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(1);
+    let comp = rect(&h, "viewer.comp");
+    let k = comp.width() / 640.0;
+    click(&mut h, comp.min + egui::vec2(320.0 * k, 180.0 * k), Modifiers::NONE);
+    type_text(&mut h, "Move me");
+    let layer_id = h.state().session.state.text_edit.as_ref().unwrap().layer;
+    let layer_position = |h: &Harness<'_, EffectcraftApp>| {
+        h.state().session.active_comp().unwrap().layer(layer_id).unwrap().props.prop("transform/position").unwrap().value.as_vec3()
+    };
+    let original_text = layer_doc(&h.state().session, layer_id).unwrap().text;
+    let before = layer_position(&h);
+
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Selection;
+    h.run_steps(2);
+    assert!(h.state().session.state.text_edit.is_none(), "leaving the Type tool commits text editing");
+    type_text(&mut h, " ignored");
+    assert_eq!(layer_doc(&h.state().session, layer_id).unwrap().text, original_text, "Selection does not type into the layer");
+    let from = comp.min + egui::vec2(340.0 * k, 150.0 * k);
+    let to = from + egui::vec2(60.0 * k, 50.0 * k);
+    drag(&mut h, from, to);
+    let after = layer_position(&h);
+    assert!(after[0] > before[0] && after[1] > before[1], "Selection dragging moves the text layer: {before:?} -> {after:?}");
+}
+
+#[test]
+fn double_click_enters_editing_and_selects_words() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let lid =
+        s.execute("layer.newText", json!({"text": "alpha beta", "size": 80, "position": [100, 200], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    // A point inside "beta" (comp space → window).
+    let comp = rect(&h, "viewer.comp");
+    let k = comp.width() / 640.0;
+    let p = comp.min + egui::vec2(330.0 * k, 180.0 * k);
+    click(&mut h, p, Modifiers::NONE);
+    click(&mut h, p, Modifiers::NONE);
+    let e = h.state().session.state.text_edit.clone().expect("double-click edits text");
+    assert_eq!(e.layer.0, lid);
+    assert_eq!((e.anchor.min(e.caret), e.anchor.max(e.caret)), (0, 10), "everything selected");
+    // Double-clicking inside the edited text selects a word.
+    h.run_steps(40);
+    click(&mut h, p, Modifiers::NONE);
+    click(&mut h, p, Modifiers::NONE);
+    let e = h.state().session.state.text_edit.clone().unwrap();
+    assert_eq!((e.anchor, e.caret), (6, 10));
+    // Typing replaces it; Cmd+Z undoes while editing.
+    type_text(&mut h, "gamma");
+    assert_eq!(edited(&h).1, "alpha gamma");
+    key(&mut h, Key::Z, Modifiers::COMMAND);
+    assert_eq!(edited(&h).1, "alpha beta");
+    // Paragraph panel: alignment applies to the edited paragraph (the South Asian and Middle
+    // Eastern text engine shows the direction popup too).
+    h.state_mut().session.prefs.type_.text_engine = "southAsian".into();
+    h.state_mut().show_panel(PanelKind::Paragraph);
+    h.run_steps(3);
+    let r = rect(&h, "paragraph.right");
+    click(&mut h, r.center(), Modifiers::NONE);
+    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
+    assert_eq!(doc.justify, effectcraft_engine::keyframe::Justify::Right);
+    for id in
+        ["paragraph.indentLeft", "paragraph.spaceBefore", "paragraph.direction", "paragraph.composer", "paragraph.hangingPunctuation", "paragraph.justifyAll"]
+    {
+        assert!(h.state().auto.find(id).is_some(), "missing {id}");
+    }
+}
+
+#[test]
+fn type_tool_drag_makes_paragraph_text_with_box_handles() {
+    let mut h = harness(app());
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(1);
+    let comp = rect(&h, "viewer.comp");
+    let a = comp.min + egui::vec2(comp.width() * 0.2, comp.height() * 0.2);
+    let b = comp.min + egui::vec2(comp.width() * 0.7, comp.height() * 0.6);
+    h.input_mut().events.push(Event::PointerMoved(a));
+    h.input_mut().events.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    for i in 1..=8 {
+        h.input_mut().events.push(Event::PointerMoved(a + (b - a) * (i as f32 / 8.0)));
+        h.run_steps(1);
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+    let (lid, _, _, _) = edited(&h);
+    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
+    let bs = doc.box_size.expect("paragraph text");
+    assert!((bs[0] - 320.0).abs() < 4.0 && (bs[1] - 144.0).abs() < 4.0, "{bs:?}");
+    type_text(&mut h, "Some words that wrap inside the box when there are enough of them");
+    h.run_steps(2);
+    assert!(h.state().auto.find("viewer.textBox.handle.4").is_some());
+    // Dragging the bottom-right handle widens the box.
+    let hr = rect(&h, "viewer.textBox.handle.4").center();
+    let to = hr + egui::vec2(60.0, 0.0);
+    h.input_mut().events.push(Event::PointerMoved(hr));
+    h.input_mut().events.push(Event::PointerButton { pos: hr, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    for i in 1..=6 {
+        h.input_mut().events.push(Event::PointerMoved(hr + (to - hr) * (i as f32 / 6.0)));
+        h.run_steps(1);
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+    let doc2 = layer_doc(&h.state().session, LayerId(lid)).unwrap();
+    assert!(doc2.box_size.unwrap()[0] > bs[0] + 20.0, "{:?}", doc2.box_size);
+    assert!(h.state().session.state.text_edit.is_some(), "still editing after resizing");
+}
+
+/// #866: Layer ▸ New ▸ Text (menu or its shortcut) puts an insertion point in the comp, as After
+/// Effects does, so typed keys reach Source Text (and the layer name follows) instead of running
+/// shortcuts while the layer keeps the placeholder "Text".
+#[test]
+fn layer_new_text_menu_and_shortcut_start_typing_into_source_text() {
+    for via_shortcut in [false, true] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+        s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap();
+        let mut h = harness(EffectcraftApp::new(s));
+        h.state_mut().show_panel(PanelKind::Composition);
+        h.run_steps(3);
+        if via_shortcut {
+            key(&mut h, Key::T, Modifiers::COMMAND | Modifiers::ALT | Modifiers::SHIFT);
+        } else {
+            let ctx = h.ctx.clone();
+            effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.newText", json!({})).unwrap();
+            h.run_steps(2);
+        }
+        let (lid, text, _, _) = edited(&h);
+        assert_eq!(text, "", "no placeholder to type over (shortcut: {via_shortcut})");
+        type_text(&mut h, "My First Project");
+        key(&mut h, Key::Escape, Modifiers::NONE);
+        assert!(h.state().session.state.text_edit.is_none(), "Escape commits");
+        let s = &h.state().session;
+        assert_eq!(layer_doc(s, LayerId(lid)).unwrap().text, "My First Project", "typed text is the Source Text");
+        assert_eq!(s.active_comp().unwrap().layer(LayerId(lid)).unwrap().name, "My First Project", "the name follows the text");
+    }
+}
+
+/// Double-clicking a text layer in the Timeline, on its name or on its bar, edits its text in the
+/// Composition viewer with the whole text selected, as in After Effects (Enter renames).
+#[test]
+fn timeline_double_click_on_a_text_layer_edits_its_text() {
+    for target in ["row", "bar"] {
+        let mut s = Session::default();
+        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+        let lid = s.execute("layer.newText", json!({"text": "alpha beta"})).unwrap()["layer"].as_u64().unwrap();
+        let mut h = harness(EffectcraftApp::new(s));
+        h.state_mut().show_panel(PanelKind::Composition);
+        h.run_steps(3);
+        let p = rect(&h, &format!("timeline.layer.{lid}.{target}")).center();
+        click(&mut h, p, Modifiers::NONE);
+        click(&mut h, p, Modifiers::NONE);
+        let (layer, text, anchor, caret) = edited(&h);
+        assert_eq!(layer, lid, "{target}");
+        assert_eq!((anchor.min(caret), anchor.max(caret)), (0, 10), "everything selected ({target})");
+        assert!(h.state().auto.find(&format!("timeline.layer.{lid}.nameEdit")).is_none(), "no rename field ({target})");
+        assert_eq!(text, "alpha beta");
+        type_text(&mut h, "gamma");
+        key(&mut h, Key::Escape, Modifiers::NONE);
+        assert!(h.state().session.state.text_edit.is_none(), "Escape commits ({target})");
+        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "gamma", "typing replaced the text ({target})");
+    }
+}
+
+#[test]
+fn duplicated_text_boxes_both_remain_editable() {
+    let mut a = app();
+    let original = a
+        .session
+        .execute("layer.newText", json!({"text": "alpha beta", "size": 40, "position": [40, 100], "justify": "left", "box": [40, 60, 250, 100]}))
+        .unwrap()["layer"]
+        .as_u64()
+        .unwrap();
+    let mut h = harness(a);
+    h.run_steps(3);
+    h.state_mut().ui.focused = PanelKind::Composition;
+    key(&mut h, Key::D, Modifiers::COMMAND);
+    let duplicate = h.state().session.state.selected_layers[0].0;
+    assert_ne!(original, duplicate);
+    h.state_mut().session.execute("prop.set", json!({"layer": duplicate, "path": "transform/position", "value": [465, 110]})).unwrap();
+    h.run_steps(3);
+    for (layer, x, text) in [(original, 80.0, "original edited"), (duplicate, 380.0, "duplicate edited")] {
+        h.run_steps(40);
+        let comp = rect(&h, "viewer.comp");
+        let k = comp.width() / 640.0;
+        let p = comp.min + egui::vec2(x * k, 85.0 * k);
+        click(&mut h, p, Modifiers::NONE);
+        click(&mut h, p, Modifiers::NONE);
+        assert_eq!(edited(&h).0, layer);
+        type_text(&mut h, text);
+        key(&mut h, Key::Escape, Modifiers::NONE);
+        assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, text);
+    }
+}
+
+#[test]
+fn overlapping_duplicate_text_remains_editable_by_double_click_and_selected_type_tool() {
+    let mut a = app();
+    let original = a.session.execute("layer.newText", json!({"text": "alpha beta", "size": 40, "box": [40, 60, 250, 100]})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(a);
+    h.run_steps(3);
+    h.state_mut().ui.focused = PanelKind::Composition;
+    key(&mut h, Key::D, Modifiers::COMMAND);
+    let duplicate = h.state().session.state.selected_layers[0].0;
+    assert_ne!(original, duplicate);
+    let comp = rect(&h, "viewer.comp");
+    let p = comp.min + egui::vec2(80.0, 85.0) * (comp.width() / 640.0);
+    click(&mut h, p, Modifiers::NONE);
+    click(&mut h, p, Modifiers::NONE);
+    assert_eq!(edited(&h).0, duplicate, "double-click edits the topmost overlapping copy");
+    type_text(&mut h, "copy edited");
+    assert_eq!(edited(&h).1, "copy edited");
+    key(&mut h, Key::Z, Modifiers::COMMAND);
+    assert_eq!(edited(&h).1, "alpha beta", "undo restores the duplicate's text");
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    h.state_mut().session.execute("layer.select", json!({"layers": [original]})).unwrap();
+    h.state_mut().ui.focused = PanelKind::Composition;
+    key(&mut h, Key::T, Modifiers::COMMAND);
+    h.run_steps(40);
+    click(&mut h, p, Modifiers::NONE);
+    assert_eq!(edited(&h).0, original, "the Type tool must honor the explicitly selected overlapping text layer");
+    key(&mut h, Key::A, Modifiers::COMMAND);
+    type_text(&mut h, "original edited");
+    assert_eq!(edited(&h).1, "original edited");
+    assert_eq!(layer_doc(&h.state().session, LayerId(duplicate)).unwrap().text, "alpha beta", "editing the original leaves the duplicate unchanged");
+    key(&mut h, Key::Z, Modifiers::COMMAND);
+    assert_eq!(edited(&h).1, "alpha beta");
+}
+
+#[test]
+fn type_tool_selected_text_preference_skips_ineligible_layers_and_falls_back_to_topmost() {
+    for exclusion in ["hidden", "locked", "inactive", "unsoloed", "outside", "unselected"] {
+        let mut a = app();
+        let mut ids = vec![];
+        for _ in 0..2 {
+            ids.push(
+                a.session.execute("layer.newText", json!({"text": "alpha beta", "size": 40, "box": [40, 60, 250, 100]})).unwrap()["layer"].as_u64().unwrap(),
+            );
+        }
+        let original = ids[0];
+        let topmost = ids[1];
+        match exclusion {
+            "hidden" | "locked" => {
+                let switch = if exclusion == "hidden" { "video" } else { "locked" };
+                a.session.execute("layer.setSwitch", json!({"layers": [original], "switch": switch, "value": exclusion == "locked"})).unwrap();
+            }
+            "inactive" => {
+                let cid = a.session.active_comp_id().unwrap();
+                std::sync::Arc::make_mut(&mut a.session.project).comp_mut(cid).unwrap().layer_mut(LayerId(original)).unwrap().out_point =
+                    effectcraft_engine::time::Tick::ZERO;
+            }
+            "unsoloed" => {
+                a.session.execute("layer.setSwitch", json!({"layers": [topmost], "switch": "solo", "value": true})).unwrap();
+            }
+            "outside" => {
+                a.session.execute("prop.set", json!({"layer": original, "path": "transform/position", "value": [500, 300]})).unwrap();
+            }
+            _ => {}
+        }
+        a.session.state.selected_layers = if exclusion == "unselected" { vec![] } else { vec![LayerId(original)] };
+        a.ui.tool = effectcraft_ui_egui::state::Tool::Type;
+        let mut h = harness(a);
+        h.run_steps(3);
+        let comp = rect(&h, "viewer.comp");
+        let p = comp.min + egui::vec2(80.0, 85.0) * (comp.width() / 640.0);
+        click(&mut h, p, Modifiers::NONE);
+        assert_eq!(edited(&h).0, topmost, "{exclusion} selected text must not override the eligible hit");
+    }
+}
+
+/// Opens a fresh Type-tool edit holding `text` and returns the harness with the new layer id,
+/// so the Deselect All and Duplicate tests start from the same state.
+fn type_tool_edit(a: EffectcraftApp, text: &str) -> (Harness<'static, EffectcraftApp>, u64) {
+    let mut h = harness(a);
+    h.run_steps(3);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(1);
+    let comp = rect(&h, "viewer.comp");
+    let p = comp.min + egui::vec2(180.0, 160.0) * (comp.width() / 640.0);
+    click(&mut h, p, Modifiers::NONE);
+    type_text(&mut h, text);
+    let (lid, _, _, _) = edited(&h);
+    (h, lid)
+}
+
+#[test]
+fn deselect_all_chords_end_a_type_tool_edit() {
+    for (name, k, mods) in [("Cmd/Ctrl+Shift+A", Key::A, Modifiers { shift: true, ..Modifiers::COMMAND }), ("F2", Key::F2, Modifiers::NONE)] {
+        let (mut h, lid) = type_tool_edit(app(), "Hello");
+        let (_, text, _, _) = edited(&h);
+        assert_eq!(text, "Hello", "{name}: the Type tool click and typing made a layer");
+        key(&mut h, k, mods);
+        assert!(h.state().session.state.text_edit.is_none(), "{name}: Deselect All ends the edit");
+        assert!(h.state().session.state.selected_layers.is_empty(), "{name}: and deselects the layer");
+        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "Hello", "{name}: the typed text is kept");
+    }
+}
+
+#[test]
+fn cmd_a_in_a_text_edit_still_selects_all_characters() {
+    let (mut h, _lid) = type_tool_edit(app(), "Hello");
+    key(&mut h, Key::A, Modifiers::COMMAND);
+    let (_, _, a, c) = edited(&h);
+    assert_eq!((a, c), (0, 5), "Select All keeps selecting every character");
+    assert!(h.state().session.state.text_edit.is_some(), "the edit stays open");
+    assert_eq!(h.state().session.state.selected_layers.len(), 1, "and the layer stays selected");
+}
+
+#[test]
+fn rebound_deselect_all_chord_forwards_from_inside_the_edit() {
+    let mut a = app();
+    a.session.execute("shortcuts.set", json!({"command": "edit.deselectAll", "keys": ["Cmd+Alt+D"]})).unwrap();
+    let (mut h, lid) = type_tool_edit(a, "Hello");
+    // The chord belongs to the shortcut, not to a hard-coded key: the old defaults do
+    // nothing special while the editor holds the keyboard…
+    key(&mut h, Key::A, Modifiers { shift: true, ..Modifiers::COMMAND });
+    assert!(h.state().session.state.text_edit.is_some(), "Cmd+Shift+A was rebound away");
+    let (_, _, a, c) = edited(&h);
+    assert_eq!((a, c), (5, 5), "and Cmd+Shift+A no longer selects all characters either");
+    key(&mut h, Key::F2, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_some(), "nor does F2");
+    // …and the current binding is what ends the edit.
+    key(&mut h, Key::D, Modifiers { alt: true, ..Modifiers::COMMAND });
+    assert!(h.state().session.state.text_edit.is_none(), "the rebound chord ends the edit");
+    assert!(h.state().session.state.selected_layers.is_empty(), "and deselects");
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "Hello", "the text is kept");
+}
+
+#[test]
+fn deselect_all_rebound_onto_an_alt_variant_of_an_editor_chord_forwards() {
+    let alt_cmd = |k| (k, Modifiers { alt: true, ..Modifiers::COMMAND });
+    for (bound, (k, mods)) in [("Cmd+Alt+Z", alt_cmd(Key::Z)), ("Cmd+Alt+A", alt_cmd(Key::A))] {
+        let mut a = app();
+        a.session.execute("shortcuts.set", json!({"command": "edit.deselectAll", "keys": [bound]})).unwrap();
+        let (mut h, lid) = type_tool_edit(a, "Hello");
+        // The editor owns Cmd+A and Cmd+Z themselves, whatever Deselect All is bound to…
+        key(&mut h, Key::A, Modifiers::COMMAND);
+        let (_, _, a0, c0) = edited(&h);
+        assert_eq!((a0, c0), (0, 5), "{bound}: Cmd+A still selects every character");
+        type_text(&mut h, "Hi");
+        key(&mut h, Key::Z, Modifiers::COMMAND);
+        assert_eq!(edited(&h).1, "Hello", "{bound}: Cmd+Z still undoes the typing");
+        // …but not their Alt variants, which belong to the rebound Deselect All.
+        key(&mut h, k, mods);
+        assert!(h.state().session.state.text_edit.is_none(), "{bound}: the rebound chord ends the edit");
+        assert!(h.state().session.state.selected_layers.is_empty(), "{bound}: and deselects");
+        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "Hello", "{bound}: without undoing or selecting text");
+    }
+}
+
+#[test]
+fn bare_letter_rebinding_stays_typing_but_a_function_key_rebinding_forwards() {
+    let mut a = app();
+    a.session.execute("shortcuts.set", json!({"command": "edit.deselectAll", "keys": ["A"]})).unwrap();
+    let (mut h, lid) = type_tool_edit(a, "Hello");
+    // A binding without a command modifier is text as far as the editor is concerned: the
+    // keystroke belongs to the text, since a command may not steal a key that types
+    // (the app-wide dispatcher honors the same invariant by skipping focused text fields).
+    key(&mut h, Key::A, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_some(), "a bare-letter Deselect All binding does not end the edit");
+    type_text(&mut h, "a");
+    let (lid2, _, a0, c0) = edited(&h);
+    assert_eq!(lid2, lid, "the same edit on the same layer continues");
+    assert_eq!((a0, c0), (6, 6), "the letter typed at the caret");
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "Helloa", "and landed in the text");
+    // A function key types nothing, so a modifier-free function-key binding is forwarded
+    // (the default F2 relies on this).
+    h.state_mut().session.execute("shortcuts.set", json!({"command": "edit.deselectAll", "keys": ["F7"]})).unwrap();
+    key(&mut h, Key::F7, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_none(), "a bare function-key binding ends the edit");
+    assert!(h.state().session.state.selected_layers.is_empty(), "and deselects");
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "Helloa", "the text is kept");
+}
+
+/// Opens a text edit the way a user does from the Project panel — Layer ▸ New ▸ Text's shortcut
+/// while that panel is focused — so the insertion point lives in the comp while focus stays on
+/// Project. Returns the harness and the new layer id.
+fn project_focused_text_edit(text: &str) -> (Harness<'static, EffectcraftApp>, u64) {
+    let mut h = harness(app());
+    h.run_steps(3);
+    h.state_mut().ui.focused = PanelKind::Project;
+    h.run_steps(1);
+    key(&mut h, Key::T, Modifiers { alt: true, shift: true, ..Modifiers::COMMAND });
+    type_text(&mut h, text);
+    let (lid, typed, _, _) = edited(&h);
+    assert_eq!(typed, text, "typing went into the new layer");
+    assert_eq!(h.state().ui.focused, PanelKind::Project, "the Project panel is still the focused panel");
+    (h, lid)
+}
+
+#[test]
+fn deselect_all_chords_end_an_edit_started_while_the_project_panel_is_focused() {
+    for (name, k, mods) in [("Cmd/Ctrl+Shift+A", Key::A, Modifiers { shift: true, ..Modifiers::COMMAND }), ("F2", Key::F2, Modifiers::NONE)] {
+        let (mut h, lid) = project_focused_text_edit("Hi");
+        key(&mut h, k, mods);
+        assert!(h.state().session.state.text_edit.is_none(), "{name}: Deselect All ends the edit");
+        assert!(h.state().session.state.selected_layers.is_empty(), "{name}: and deselects the layer");
+        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "Hi", "{name}: the typed text is kept");
+    }
+}
+
+#[test]
+fn deselect_all_menu_item_follows_the_edit_while_the_project_panel_is_focused() {
+    let enabled = |h: &Harness<'_, EffectcraftApp>| {
+        effectcraft_ui_egui::menus::menu_items(h.state()).into_iter().find(|m| m.id == "edit.deselectAll").is_some_and(|m| m.enabled)
+    };
+    let (mut h, _) = project_focused_text_edit("Hi");
+    h.state_mut().session.execute("project.select", json!({"items": []})).unwrap();
+    h.run_steps(1);
+    assert!(h.state().session.state.text_edit.is_some(), "the edit is still open");
+    // The item ends the edit, so an empty Project selection must not gray it out.
+    assert!(enabled(&h), "Deselect All is enabled during the edit");
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_none(), "Escape ended the edit");
+    assert_eq!(h.state().ui.focused, PanelKind::Project, "the Project panel is still the focused panel");
+    // With no edit, the item deselects Project items again: nothing selected there, nothing to do.
+    assert!(!enabled(&h), "Deselect All follows the empty Project selection once the edit is over");
+}
+
+/// Layer ids of the active comp, bottom to top.
+fn layer_ids(h: &Harness<'_, EffectcraftApp>) -> Vec<u64> {
+    h.state().session.active_comp().map_or(vec![], |c| c.layers.iter().map(|l| l.id.0).collect())
+}
+
+#[test]
+fn duplicate_chord_ends_a_type_tool_edit_and_selects_the_copy() {
+    let (mut h, lid) = type_tool_edit(app(), "Hello");
+    key(&mut h, Key::D, Modifiers::COMMAND);
+    let s = &h.state().session;
+    assert!(s.state.text_edit.is_none(), "Duplicate ends the open edit, as Deselect All does");
+    let copy = *s.state.selected_layers.first().expect("the copy is selected");
+    assert_ne!(copy.0, lid, "the copy (not the edited original) holds the selection");
+    assert_eq!(layer_doc(s, LayerId(lid)).unwrap().text, "Hello", "the original keeps its text");
+    assert_eq!(layer_doc(s, copy).unwrap().text, "Hello", "the copy carries it too");
+}
+
+#[test]
+fn duplicate_chord_ends_an_edit_started_while_the_project_panel_is_focused() {
+    let (mut h, lid) = project_focused_text_edit("Hi");
+    key(&mut h, Key::D, Modifiers::COMMAND);
+    let s = &h.state().session;
+    assert!(s.state.text_edit.is_none(), "Cmd+D ends the edit even with Project focused");
+    let copy = s.state.selected_layers.first().expect("the copy is selected");
+    assert_eq!(layer_doc(s, LayerId(lid)).unwrap().text, "Hi", "the typed text is kept");
+    assert_eq!(layer_doc(s, *copy).unwrap().text, "Hi", "on the copy as well");
+}
+
+#[test]
+fn rebound_duplicate_chord_forwards_from_inside_the_edit() {
+    let mut a = app();
+    a.session.execute("shortcuts.set", json!({"command": "edit.duplicate", "keys": ["Cmd+Alt+D"]})).unwrap();
+    let (mut h, lid) = type_tool_edit(a, "Hello");
+    // The default key no longer belongs to Duplicate: while the editor holds the keyboard a
+    // chord that matches no command does nothing, and the current binding is what forwards.
+    let n = layer_ids(&h).len();
+    key(&mut h, Key::D, Modifiers::COMMAND);
+    assert!(h.state().session.state.text_edit.is_some(), "Cmd+D was rebound away: the edit stays open");
+    assert_eq!(layer_ids(&h).len(), n, "and nothing was duplicated");
+    key(&mut h, Key::D, Modifiers { alt: true, ..Modifiers::COMMAND });
+    let s = &h.state().session;
+    assert!(s.state.text_edit.is_none(), "the rebound chord ends the edit");
+    assert_eq!(layer_doc(s, LayerId(lid)).unwrap().text, "Hello", "the text is kept");
+    assert_eq!(layer_ids(&h).len(), n + 1, "and the copy exists");
+}
+
+#[test]
+fn duplicate_rebound_onto_a_bare_letter_stays_typing() {
+    let mut a = app();
+    a.session.execute("shortcuts.set", json!({"command": "edit.duplicate", "keys": ["D"]})).unwrap();
+    let (mut h, lid) = type_tool_edit(a, "Hello");
+    let n = layer_ids(&h).len();
+    // A binding without a command modifier is text as far as the editor is concerned: the editor
+    // must not surrender a key that types (same invariant as the app-wide dispatcher).
+    key(&mut h, Key::D, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_some(), "a bare-letter Duplicate binding does not end the edit");
+    assert_eq!(layer_ids(&h).len(), n, "and does not duplicate");
+    type_text(&mut h, "D");
+    let (lid2, text, _, _) = edited(&h);
+    assert_eq!(lid2, lid, "the same edit on the same layer continues");
+    assert_eq!(text, "HelloD", "and the letter typed into the text");
+}
+
+#[test]
+fn duplicate_chord_copies_the_edited_layer_not_an_effect_still_selected() {
+    let mut a = app();
+    let lid = a.session.execute("layer.newText", json!({"text": "alpha beta", "size": 40, "box": [40, 60, 250, 100]})).unwrap()["layer"].as_u64().unwrap();
+    // Applying the blur selects it, as clicking it in Effect Controls does.
+    a.session.execute("effect.apply", json!({"layers": [lid], "effect": "Gaussian Blur"})).unwrap();
+    a.ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    let mut h = harness(a);
+    h.run_steps(3);
+    let comp = rect(&h, "viewer.comp");
+    click(&mut h, comp.min + egui::vec2(80.0, 85.0) * (comp.width() / 640.0), Modifiers::NONE);
+    assert_eq!(edited(&h).0, lid, "the Type tool's click opens the text layer for editing");
+    assert!(!h.state().session.state.selected_props.is_empty(), "and the blur stays selected");
+    let n = layer_ids(&h).len();
+    key(&mut h, Key::D, Modifiers::COMMAND);
+    let s = &h.state().session;
+    assert!(s.state.text_edit.is_none(), "Duplicate ends the edit");
+    assert_eq!(layer_ids(&h).len(), n + 1, "and copies the edited layer");
+    let blurs = s.active_comp().unwrap().layer(LayerId(lid)).unwrap().effects().map_or(0, |fx| fx.groups().count());
+    assert_eq!(blurs, 1, "not the blur");
+}
+
+#[test]
+fn a_chord_bound_to_both_forwarded_commands_resolves_in_list_order() {
+    let mut a = app();
+    // Shortcuts may hold one chord for several commands (the conflict is a toast, not a
+    // refusal), so the editor's forwarding resolves a shared chord in list order — Deselect
+    // All before Duplicate. This pins that documented contract: the shared chord must end the
+    // edit like Deselect All, without running Duplicate behind it.
+    a.session.execute("shortcuts.set", json!({"command": "edit.deselectAll", "keys": ["Cmd+Alt+G"]})).unwrap();
+    a.session.execute("shortcuts.set", json!({"command": "edit.duplicate", "keys": ["Cmd+Alt+G"]})).unwrap();
+    let (mut h, lid) = type_tool_edit(a, "Hello");
+    let n = layer_ids(&h).len();
+    key(&mut h, Key::G, Modifiers { alt: true, ..Modifiers::COMMAND });
+    let s = &h.state().session;
+    assert!(s.state.text_edit.is_none(), "the shared chord still ends the edit");
+    assert!(s.state.selected_layers.is_empty(), "Deselect All wins the shared chord: nothing is selected");
+    assert_eq!(layer_ids(&h).len(), n, "so the chord did not duplicate");
+    assert_eq!(layer_doc(s, LayerId(lid)).unwrap().text, "Hello", "and the text is kept");
+}
+
+/// The on-canvas editor's outgoing IME producer: the descriptor carries the edited layer's
+/// committed text, the real owner, a stable generation and an explicit change cause. A normal
+/// typed character is application work; an accepted input-method commit is not.
+#[test]
+fn ime_producer_follows_the_committed_text_and_cause() {
+    // A Latin accent is multi-byte in UTF-8 (the byte offsets below) and Inter draws it, so the
+    // harness keeps its strict missing-glyph check; no CJK fallback face is needed headlessly.
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| app());
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(1);
+    let comp = rect(&h, "viewer.comp");
+    click(&mut h, comp.center(), Modifiers::NONE);
+    type_text(&mut h, "Hi");
+    let (lid, text, a, c) = edited(&h);
+    assert_eq!((text.as_str(), a, c), ("Hi", 2, 2));
+
+    let ime = h.output().platform_output.ime.clone().expect("the on-canvas editor owns IME");
+    let comp_id = h.state().session.active_comp_id().expect("an active comp").0;
+    assert_eq!(ime.owner, egui::Id::unique(("effectcraft-ime-text", comp_id, lid)), "the edited comp and layer");
+    assert!(ime.context_generation > 0);
+    let p = ime.surrounding_text.available().expect("committed text is available");
+    assert_eq!((p.text.as_str(), p.cursor, p.anchor), ("Hi", 2, 2));
+    assert_eq!(ime.change_cause, egui::ImeChangeCause::Other, "ordinary typing is application work");
+    let generation = ime.context_generation;
+
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("é".into())));
+    h.run_steps(1);
+    assert_eq!(edited(&h).1, "Hié");
+    let ime = h.output().platform_output.ime.clone().expect("still editing");
+    let p = ime.surrounding_text.available().expect("committed text is available");
+    assert_eq!((p.text.as_str(), p.cursor, p.anchor), ("Hié", 4, 4), "UTF-8 bytes after the commit");
+    assert_eq!(ime.change_cause, egui::ImeChangeCause::InputMethod, "an accepted IME commit earns it");
+    assert_eq!(ime.context_generation, generation, "an ordinary edit keeps one context");
+}
+
+/// A click on the Timeline is processed after the viewer overlay drew. The pass must not leave
+/// the ended on-canvas editor's old descriptor in the platform output.
+#[test]
+fn click_away_clears_the_canvas_ime_descriptor_in_the_final_pass() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let solid = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    let title = s.execute("layer.newText", json!({"text": "Title", "size": 80, "position": [100, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": title, "caret": 5})).unwrap();
+    h.run_steps(2);
+    assert!(h.output().platform_output.ime.is_some(), "the editor owns IME before the click");
+    let row = rect(&h, &format!("timeline.layer.{solid}.row")).center();
+    click(&mut h, row, Modifiers::NONE);
+    assert!(h.state().session.state.text_edit.is_none(), "the click ends the edit");
+    assert!(h.output().platform_output.ime.is_none(), "the final pass clears the ended editor's descriptor");
+}
+
+/// A new target on the same focused widget must request a composition interrupt, and a delayed
+/// commit carrying the previous composition's preview must not reach the new layer.
+#[test]
+fn switching_text_targets_interrupts_and_rejects_a_delayed_commit() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let first = s.execute("layer.newText", json!({"text": "A", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let second = s.execute("layer.newText", json!({"text": "B", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    // The delayed commit carries a multi-byte accent Inter draws: no broad missing-glyph
+    // allowance, and the stale-composition path is still exercised with real IME events.
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": first, "caret": 1})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+
+    h.state_mut().session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    h.run_steps(1);
+    let comp_id = h.state().session.active_comp_id().expect("comp").0;
+    let ime = h.output().platform_output.ime.clone().expect("the second editor owns IME");
+    assert_eq!(ime.owner, egui::Id::unique(("effectcraft-ime-text", comp_id, second)));
+    assert!(ime.should_interrupt_composition, "the session switch cancels the platform composition");
+
+    // The delayed batch may update the old composition before it commits. That preview must not
+    // re-arm the stale guard for the new layer.
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("é".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(first)).unwrap().text, "A");
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "B", "the stale commit is ignored");
+}
+
+/// A stale pre-edit must not re-arm the guard for a following delete-surrounding/commit batch
+/// either: deleting around the new layer's caret would otherwise mutate it without a commit.
+#[test]
+fn a_delayed_preedit_after_a_target_switch_cannot_rearm_the_stale_guard() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let first = s.execute("layer.newText", json!({"text": "A", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let second = s.execute("layer.newText", json!({"text": "B", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": first, "caret": 1})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+
+    h.state_mut().session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    h.run_steps(1);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("X".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(first)).unwrap().text, "A");
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "B", "the stale pre-edit cannot re-arm a delete/commit batch");
+}
+
+/// A late pre-edit from the old composition can arrive long after the target switch; timing is
+/// not provenance. Protection survives idle frames and old terminals until the matching fence.
+#[test]
+fn late_preedit_and_commit_split_across_idle_frames_cannot_retarget() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let first = s.execute("layer.newText", json!({"text": "A", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let second = s.execute("layer.newText", json!({"text": "B", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": first, "caret": 1})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+
+    h.state_mut().session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    // Well past the old two-frame suppression window: ownership, not elapsed frames, keeps the
+    // tombstone.
+    h.run_steps(1);
+    let request_id = ime_reset_request(&h);
+    h.run_steps(4);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "éé".into(), active_range_chars: None }));
+    h.run_steps(3);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("é".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(first)).unwrap().text, "A");
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "B", "the late pre-edit and commit stayed on the old owner");
+
+    // An actual matching fence admits the fresh composition, without an invented old terminal.
+    h.input_mut().events.push(Event::ImeResetCompleted { request_id });
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("é".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "Bé", "a new composition after its matching fence is accepted");
+}
+
+/// A delete-surrounding event belongs to the same stale composition as its late pre-edit even
+/// when idle frames separate them. It must not mutate the replacement layer; only F admits fresh
+/// input, including when no old terminal commit arrives.
+#[test]
+fn late_preedit_and_delete_split_across_idle_frames_cannot_retarget() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let first = s.execute("layer.newText", json!({"text": "A", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let second = s.execute("layer.newText", json!({"text": "B", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": first, "caret": 1})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+
+    h.state_mut().session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    h.run_steps(1);
+    let request_id = ime_reset_request(&h);
+    h.run_steps(3);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "éé".into(), active_range_chars: None }));
+    h.run_steps(3);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(first)).unwrap().text, "A");
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "B", "the late delete could not mutate the new owner");
+
+    h.input_mut().events.push(Event::ImeResetCompleted { request_id });
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("é".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "Bé", "the matching fence admits fresh input");
+}
+
+/// An observed empty pre-edit only ends the visible composition; its terminal commit is a
+/// separate event. Switching targets in between must keep the old owner so that delayed commit is
+/// rejected instead of landing at the replacement layer's caret.
+#[test]
+fn empty_preedit_keeps_the_old_target_until_the_pending_commit_arrives() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let first = s.execute("layer.newText", json!({"text": "A", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let second = s.execute("layer.newText", json!({"text": "B", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": first, "caret": 1})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+
+    // The input method clears the visible composition before its commit arrives.
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: String::new(), active_range_chars: None }));
+    h.run_steps(1);
+    h.state_mut().session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    h.run_steps(1);
+
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("X".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(first)).unwrap().text, "A");
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "B", "the observed empty pre-edit preserved the old owner for its pending commit",);
+}
+
+/// A coalesced raw batch after a target switch may carry the old composition's empty pre-edit and
+/// terminal commit followed by a fence and the first pre-edit of a new composition. Only that
+/// explicit boundary admits the new pre-edit for the current target.
+#[test]
+fn a_matching_fence_after_old_terminals_admits_the_next_preedit_in_the_same_batch() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let first = s.execute("layer.newText", json!({"text": "A", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let second = s.execute("layer.newText", json!({"text": "B", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": first, "caret": 1})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+
+    h.state_mut().session.execute("text.edit", json!({"layer": second, "caret": 1})).unwrap();
+    h.run_steps(1);
+    let request_id = ime_reset_request(&h);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: String::new(), active_range_chars: None }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("X".into())));
+    h.input_mut().events.push(Event::ImeResetCompleted { request_id });
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "B", "the stale empty pre-edit/commit pair never mutates the new layer",);
+
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("é".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(first)).unwrap().text, "A");
+    assert_eq!(layer_doc(&h.state().session, LayerId(second)).unwrap().text, "Bé", "the new pre-edit after the matching fence owns the current target",);
+}
+
+/// The byte-count delete-surrounding path through the real app/hook keeps a whole UTF-8
+/// character and shares the following commit's undo step.
+#[test]
+fn delete_surrounding_bytes_through_the_app_replaces_the_emoji() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "café😀", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": lid, "caret": 5})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 4, after_bytes: 0 }));
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("X".into())));
+    h.run_steps(2);
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "caféX");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "café😀", "the delete and commit are one undo step");
+}
+
+/// Use the real viewer's outgoing caret geometry to aim the interruption at a known position.
+fn ime_interruption_editor() -> (Harness<'static, EffectcraftApp>, Pos2) {
+    crate::add_canonical_test_fonts();
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "abcd", "size": 80, "position": [80, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |cc| {
+        EffectcraftApp::install_ime_reset_hooks(&cc.egui_ctx);
+        EffectcraftApp::new(s)
+    });
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
+    h.run_steps(3);
+    h.state_mut().session.execute("text.edit", json!({"layer": lid, "caret": 1})).unwrap();
+    h.run_steps(2);
+    let point = h.output().platform_output.ime.as_ref().expect("the viewer drew caret1").cursor_rect.center();
+    assert!(rect(&h, "viewer.textEdit").contains(point), "the pointer must hit the actual edited text");
+    h.state_mut().session.execute("text.setSelection", json!({"caret": 4})).unwrap();
+    h.run_steps(2);
+    assert_eq!((edited(&h).2, edited(&h).3), (4, 4));
+    (h, point)
+}
+
+/// Real viewer geometry and raw eframe input, without the split-frame `click` helper.
+fn native_text_pointer_editor() -> (Harness<'static, EffectcraftApp>, u64, Pos2, Pos2) {
+    let (h, caret1) = ime_interruption_editor();
+    let caret4 = h.output().platform_output.ime.as_ref().expect("the viewer drew caret4").cursor_rect.center();
+    let area = rect(&h, "viewer.area");
+    assert!(caret1.is_finite() && caret4.is_finite());
+    assert!(area.contains(caret1) && area.contains(caret4));
+    assert!(rect(&h, "viewer.textEdit").contains(caret4));
+    assert!(caret1.distance(caret4) > 12.0, "separated clicks must not become a double-click");
+    let layer = edited(&h).0;
+    (h, layer, caret1, caret4)
+}
+
+#[test]
+fn native_text_pointer_same_batch_click_moves_caret_and_starts_editing() {
+    for active in [true, false] {
+        let (mut h, layer, caret1, caret4) = native_text_pointer_editor();
+        if !active {
+            h.state_mut().session.execute("text.endEdit", json!({})).unwrap();
+            h.run_steps(2);
+            assert!(h.state().session.state.text_edit.is_none());
+        }
+        let undo = h.state().session.history.undo.len();
+        h.input_mut().events.extend([
+            Event::PointerMoved(caret1),
+            Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+            Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        ]);
+        h.run_steps(1);
+        assert_eq!(edited(&h), (layer, "abcd".to_owned(), 1, 1), "active={active}");
+        assert!(!h.ctx.input(|i| i.pointer.primary_down()));
+        assert_eq!(h.state().session.history.undo.len(), undo, "placing a caret is not a document edit");
+        h.input_mut().events.push(Event::PointerMoved(caret4));
+        h.run_steps(1);
+        assert_eq!((edited(&h).2, edited(&h).3), (1, 1), "release must end selection dragging");
+        type_text(&mut h, "X");
+        assert_eq!(edited(&h), (layer, "aXbcd".to_owned(), 2, 2), "active={active}");
+    }
+}
+
+#[test]
+fn native_text_pointer_split_press_drag_release_keeps_ownership() {
+    for dragging in [false, true] {
+        let (mut h, layer, caret1, caret4) = native_text_pointer_editor();
+        h.input_mut().events.extend([
+            Event::PointerMoved(caret1),
+            Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        ]);
+        h.run_steps(1);
+        assert_eq!(edited(&h), (layer, "abcd".to_owned(), 1, 1));
+        assert!(h.ctx.input(|i| i.pointer.primary_down()));
+        let end = if dragging { caret4 } else { caret1 };
+        if dragging {
+            h.input_mut().events.push(Event::PointerMoved(end));
+            h.run_steps(1);
+            assert_eq!((edited(&h).2, edited(&h).3), (1, 4));
+        }
+        h.input_mut().events.push(Event::PointerButton { pos: end, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+        let expected = if dragging { (1, 4) } else { (1, 1) };
+        assert!(!h.ctx.input(|i| i.pointer.primary_down()));
+        assert_eq!((edited(&h).2, edited(&h).3), expected);
+        h.input_mut().events.push(Event::PointerMoved(if dragging { caret1 } else { caret4 }));
+        h.run_steps(1);
+        assert_eq!((edited(&h).2, edited(&h).3), expected, "a released drag must not follow later movement");
+        assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, "abcd");
+    }
+}
+
+#[test]
+fn native_text_pointer_two_completed_primary_clicks_use_the_latest_primary_press() {
+    let (mut h, layer, caret1, caret4) = native_text_pointer_editor();
+    h.input_mut().events.extend([
+        Event::PointerMoved(caret4),
+        Event::PointerButton { pos: caret4, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        Event::PointerButton { pos: caret4, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        Event::PointerMoved(caret1),
+        Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        // A later non-primary click must not become the recovered primary origin.
+        Event::PointerMoved(caret4),
+        Event::PointerButton { pos: caret4, button: PointerButton::Middle, pressed: true, modifiers: Modifiers::NONE },
+        Event::PointerButton { pos: caret4, button: PointerButton::Middle, pressed: false, modifiers: Modifiers::NONE },
+    ]);
+    h.run_steps(1);
+    assert!(h.ctx.input(|i| i.pointer.primary_pressed() && i.pointer.primary_released() && i.pointer.press_origin().is_none()));
+    assert!(!h.ctx.input(|i| i.pointer.button_double_clicked(PointerButton::Primary) || i.pointer.button_triple_clicked(PointerButton::Primary)));
+    assert_eq!(edited(&h), (layer, "abcd".to_owned(), 1, 1), "the first click must not replace the latest click");
+}
+
+#[test]
+fn native_text_pointer_nonfinite_latest_press_does_not_replay_an_earlier_click() {
+    for (earlier_finite_click, same_frame_release) in [(false, false), (false, true), (true, false), (true, true)] {
+        let (mut h, layer, caret1, caret4) = native_text_pointer_editor();
+        let undo = h.state().session.history.undo.len();
+        if earlier_finite_click {
+            h.input_mut().events.extend([
+                Event::PointerMoved(caret1),
+                Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+                Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+            ]);
+        }
+        let bad = egui::pos2(f32::INFINITY, caret4.y);
+        h.input_mut().events.extend([
+            Event::PointerButton { pos: bad, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+            Event::PointerMoved(caret1),
+        ]);
+        if same_frame_release {
+            h.input_mut().events.push(Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        }
+        h.run_steps(1);
+        assert_eq!(edited(&h), (layer, "abcd".to_owned(), 4, 4), "earlier_finite_click={earlier_finite_click}");
+        assert_eq!(h.state().session.history.undo.len(), undo);
+        if !same_frame_release {
+            assert!(h.ctx.input(|i| i.pointer.primary_down()));
+            h.input_mut().events.push(Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+            h.run_steps(1);
+            assert_eq!(edited(&h), (layer, "abcd".to_owned(), 4, 4), "later release cannot retarget an invalid press");
+            assert_eq!(h.state().session.history.undo.len(), undo);
+        }
+        assert!(!h.ctx.input(|i| i.pointer.primary_down()));
+    }
+}
+
+#[test]
+fn native_text_pointer_outside_area_origin_cannot_retarget_on_inside_release() {
+    for active in [true, false] {
+        let (mut h, layer, caret1, _) = native_text_pointer_editor();
+        if !active {
+            h.state_mut().session.execute("text.endEdit", json!({})).unwrap();
+            h.run_steps(2);
+        }
+        let area = rect(&h, "viewer.area");
+        let outside = area.min - egui::vec2(8.0, 8.0);
+        assert!(outside.is_finite() && !area.contains(outside));
+        assert!(outside.x >= 0.0 && outside.y >= 0.0, "use an actual window location outside the viewer");
+        let layers = h.state().session.active_comp().unwrap().layers.len();
+        let undo = h.state().session.history.undo.len();
+        h.input_mut().events.extend([
+            Event::PointerMoved(outside),
+            Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+            Event::PointerMoved(caret1),
+            Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        ]);
+        h.run_steps(1);
+        assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, "abcd");
+        assert_eq!(h.state().session.active_comp().unwrap().layers.len(), layers, "outside origins must not create text in the viewer");
+        assert_eq!(h.state().session.history.undo.len(), undo);
+        if active {
+            // A real outside-panel action may close the edit; it must never retarget it.
+            if h.state().session.state.text_edit.is_some() {
+                assert_eq!(edited(&h), (layer, "abcd".to_owned(), 4, 4));
+            }
+        } else {
+            assert!(h.state().session.state.text_edit.is_none(), "release inside is not an inside-origin click");
+        }
+    }
+}
+
+#[test]
+fn native_text_pointer_completed_outside_panel_click_closes_the_editor() {
+    for (panel, target) in [(PanelKind::Timeline, "timeline.empty"), (PanelKind::Project, "project.empty")] {
+        let (mut h, layer, _, _) = native_text_pointer_editor();
+        h.state_mut().show_panel(panel);
+        h.run_steps(3);
+        assert!(h.state().session.state.text_edit.is_some(), "opening a panel is not a pointer click");
+        let outside = rect(&h, target).center();
+        assert!(!rect(&h, "viewer.area").contains(outside));
+        h.input_mut().events.extend([
+            Event::PointerMoved(outside),
+            Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+            Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+        ]);
+        h.run_steps(1);
+        assert!(h.state().session.state.text_edit.is_none(), "a complete {panel:?} click must close the edit");
+        type_text(&mut h, "X");
+        assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, "abcd", "typing after click-away must not reach the old editor");
+    }
+}
+
+#[test]
+fn native_text_pointer_secondary_click_does_not_move_the_caret() {
+    let (mut h, layer, caret1, _) = native_text_pointer_editor();
+    h.input_mut().events.extend([
+        Event::PointerMoved(caret1),
+        Event::PointerButton { pos: caret1, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE },
+        Event::PointerButton { pos: caret1, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE },
+    ]);
+    h.run_steps(1);
+    assert!(!h.ctx.input(|i| i.pointer.primary_pressed()));
+    assert_eq!(edited(&h), (layer, "abcd".to_owned(), 4, 4));
+}
+
+#[test]
+fn native_text_pointer_modal_blocks_background_same_batch_click() {
+    let (mut h, layer, caret1, _) = native_text_pointer_editor();
+    h.state_mut().dialog = Some(effectcraft_ui_egui::Dialog::About);
+    h.run_steps(3);
+    h.input_mut().events.extend([
+        Event::PointerMoved(caret1),
+        Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        Event::PointerButton { pos: caret1, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
+    ]);
+    h.run_steps(1);
+    assert_eq!(edited(&h), (layer, "abcd".to_owned(), 4, 4), "a disabled viewer must not recover a background click");
+}
+
+fn ime_interruption_delete(bytes: bool) -> Event {
+    Event::Ime(if bytes {
+        egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }
+    } else {
+        egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 0 }
+    })
+}
+
+fn begin_interrupted_composition(h: &mut Harness<'_, EffectcraftApp>, terminal_pending: bool) {
+    EffectcraftApp::install_ime_reset_hooks(&h.ctx);
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+    h.run_steps(1);
+    if terminal_pending {
+        h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: String::new(), active_range_chars: None }));
+        h.run_steps(1);
+    }
+    assert_eq!(edited(h).1, "abcd", "neither visible nor cleared preedit changes committed text");
+}
+
+fn request_at_caret(h: &mut Harness<'_, EffectcraftApp>, caret: usize) -> egui::ImeResetId {
+    h.state_mut().session.execute("text.setSelection", json!({"caret": caret})).unwrap();
+    h.run_steps(1);
+    ime_reset_request(h)
+}
+
+fn ime_reset_request(h: &Harness<'_, EffectcraftApp>) -> egui::ImeResetId {
+    h.output()
+        .platform_output
+        .ime
+        .as_ref()
+        .expect("the real viewer publishes its descriptor")
+        .reset_request
+        .expect("capture the final request before an unchanged idle pass consumes the one-shot output")
+}
+
+#[test]
+fn pointer_caret_interruption_rejects_same_batch_ime_delete_and_commit() {
+    for bytes in [false, true] {
+        for terminal_pending in [false, true] {
+            let (mut h, point) = ime_interruption_editor();
+            begin_interrupted_composition(&mut h, terminal_pending);
+            let project = h.state().session.project.clone();
+            let undo = h.state().session.history.undo.len();
+            h.input_mut().events.extend([
+                Event::PointerMoved(point),
+                Event::PointerButton { pos: point, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+                ime_interruption_delete(bytes),
+                Event::Ime(egui::ImeEvent::Commit("X".into())),
+            ]);
+            h.run_steps(1);
+            assert_eq!((edited(&h).1.as_str(), edited(&h).2, edited(&h).3), ("abcd", 1, 1), "the actual pointer caret survives stale IME mutations");
+            assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project), "rejected IME never edits the project");
+            assert_eq!(h.state().session.history.undo.len(), undo, "rejected input creates no undo entry");
+            let request_id = ime_reset_request(&h);
+            h.input_mut().events.push(Event::PointerButton { pos: point, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+            h.run_steps(1);
+            // The explicit native fence, not the rejected terminal, admits fresh composition.
+            h.input_mut().events.extend([
+                Event::ImeResetCompleted { request_id },
+                Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }),
+                Event::Ime(egui::ImeEvent::Commit("é".into())),
+            ]);
+            h.run_steps(1);
+            assert_eq!(edited(&h).1, "aébcd");
+            assert_eq!((edited(&h).2, edited(&h).3), (2, 2));
+            h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(edited(&h).1, "abcd", "only the fresh commit needs undo");
+        }
+    }
+}
+
+#[test]
+fn keyboard_caret_interruption_rejects_later_ime_events_and_keeps_fresh_preedit() {
+    for (key, modifiers, expected, fresh_text) in
+        [(Key::ArrowLeft, Modifiers::NONE, (3, 3), "abcéd"), (Key::Home, Modifiers::SHIFT, (4, 0), "é"), (Key::A, Modifiers::COMMAND, (0, 4), "é")]
+    {
+        for bytes in [false, true] {
+            let (mut h, _) = ime_interruption_editor();
+            begin_interrupted_composition(&mut h, false);
+            let project = h.state().session.project.clone();
+            let undo = h.state().session.history.undo.len();
+            h.input_mut().events.extend([
+                Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers },
+                ime_interruption_delete(bytes),
+                Event::Ime(egui::ImeEvent::Commit("X".into())),
+                Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }),
+            ]);
+            h.run_steps(1);
+            assert_eq!(edited(&h).1, "abcd", "the old deletion and commit are refused");
+            assert_eq!((edited(&h).2, edited(&h).3), expected, "the real key's selection survives");
+            assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+            assert_eq!(h.state().session.history.undo.len(), undo);
+            let request_id = ime_reset_request(&h);
+            h.input_mut().events.extend([
+                Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers },
+                Event::ImeResetCompleted { request_id },
+                Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }),
+                Event::Ime(egui::ImeEvent::Commit("é".into())),
+            ]);
+            h.run_steps(1);
+            assert_eq!(edited(&h).1, fresh_text, "only the fresh preedit after the matching fence is accepted");
+            h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(edited(&h).1, "abcd");
+        }
+    }
+}
+
+#[test]
+fn external_caret_interruption_rejects_pending_composition_mutations() {
+    for bytes in [false, true] {
+        let (mut h, _) = ime_interruption_editor();
+        begin_interrupted_composition(&mut h, true);
+        let project = h.state().session.project.clone();
+        let undo = h.state().session.history.undo.len();
+        // This is the same production command exposed to control clients; no replacement epoch.
+        h.state_mut().session.execute("text.setSelection", json!({"caret": 1})).unwrap();
+        h.input_mut().events.extend([ime_interruption_delete(bytes), Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        h.run_steps(1);
+        assert_eq!((edited(&h).1.as_str(), edited(&h).2, edited(&h).3), ("abcd", 1, 1));
+        assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+        assert_eq!(h.state().session.history.undo.len(), undo);
+        let request_id = ime_reset_request(&h);
+        h.input_mut().events.extend([Event::ImeResetCompleted { request_id }, Event::Ime(egui::ImeEvent::Commit("Y".into()))]);
+        h.run_steps(1);
+        assert_eq!(edited(&h).1, "aYbcd", "a later direct commit without preedit is still accepted");
+    }
+}
+
+#[test]
+fn composing_ime_delete_then_commit_and_direct_commit_remain_valid() {
+    for bytes in [false, true] {
+        let (mut h, _) = ime_interruption_editor();
+        begin_interrupted_composition(&mut h, false);
+        let undo = h.state().session.history.undo.len();
+        h.input_mut().events.extend([ime_interruption_delete(bytes), Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        h.run_steps(1);
+        assert_eq!((edited(&h).1.as_str(), edited(&h).2, edited(&h).3), ("abcX", 4, 4), "the IME deletion's own caret movement must not reject its commit");
+        assert_eq!(h.state().session.history.undo.len(), undo + 1);
+        h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(edited(&h).1, "abcd", "accepted delete and commit remain one undo step");
+        h.run_steps(1);
+        h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("Y".into())));
+        h.run_steps(1);
+        assert_eq!(edited(&h).1, "abcdY", "noncomposing direct commit remains valid after undo");
+    }
+}
+
+#[test]
+fn a_noncomposing_direct_commit_can_follow_a_pointer_caret_change_in_the_same_batch() {
+    let (mut h, point) = ime_interruption_editor();
+    let undo = h.state().session.history.undo.len();
+    h.input_mut().events.extend([
+        Event::PointerMoved(point),
+        Event::PointerButton { pos: point, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        Event::Ime(egui::ImeEvent::Commit("Y".into())),
+    ]);
+    h.run_steps(1);
+    assert_eq!((edited(&h).1.as_str(), edited(&h).2, edited(&h).3), ("aYbcd", 2, 2), "only an interrupted composition is rejected");
+    assert_eq!(h.state().session.history.undo.len(), undo + 1);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(edited(&h).1, "abcd");
+}
+
+fn draws_ime_preview(h: &Harness<'_, EffectcraftApp>) -> bool {
+    fn contains_preview(shape: &egui::Shape) -> bool {
+        match shape {
+            egui::Shape::Text(text) => text.galley.text() == "é",
+            egui::Shape::Vec(shapes) => shapes.iter().any(contains_preview),
+            _ => false,
+        }
+    }
+    h.output().shapes.iter().any(|shape| contains_preview(&shape.shape))
+}
+
+fn replacement_ime_edit(h: &mut Harness<'_, EffectcraftApp>) -> u64 {
+    let replacement =
+        h.state_mut().session.execute("layer.newText", json!({"text": "wxyz", "size": 80, "position": [80, 240], "justify": "left"})).unwrap()["layer"]
+            .as_u64()
+            .unwrap();
+    h.state_mut().session.execute("text.edit", json!({"layer": replacement, "caret": 1})).unwrap();
+    h.run_steps(1);
+    assert_eq!(edited(h), (replacement, "wxyz".to_owned(), 1, 1), "the replacement editor must be live before late IME arrives");
+    let comp = h.state().session.active_comp_id().unwrap().0;
+    let ime = h.output().platform_output.ime.as_ref().expect("the real replacement editor publishes IME");
+    assert_eq!(ime.owner, egui::Id::unique(("effectcraft-ime-text", comp, replacement)));
+    assert!(!draws_ime_preview(h), "the old preview must not be drawn on the replacement");
+    replacement
+}
+
+#[test]
+fn deselect_all_during_composition_rejects_late_ime_on_a_live_replacement_session() {
+    for rebound in [false, true] {
+        for bytes in [false, true] {
+            for terminal_pending in [false, true] {
+                let (mut h, _) = ime_interruption_editor();
+                let (chord, modifiers) = if rebound {
+                    h.state_mut().session.execute("shortcuts.set", json!({"command": "edit.deselectAll", "keys": ["Cmd+Alt+Z"]})).unwrap();
+                    (Key::Z, Modifiers { alt: true, ..Modifiers::COMMAND })
+                } else {
+                    (Key::A, Modifiers { shift: true, ..Modifiers::COMMAND })
+                };
+                let original = edited(&h).0;
+                let old_session = h.state().session.state.text_edit.as_ref().unwrap().session;
+                h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }));
+                h.run_steps(1);
+                assert!(draws_ime_preview(&h), "a real active composition must draw before interruption");
+                if terminal_pending {
+                    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Preedit { text: String::new(), active_range_chars: None }));
+                    h.run_steps(1);
+                    assert!(!draws_ime_preview(&h), "empty preedit hides the preview but leaves the terminal pending");
+                }
+                key(&mut h, chord, modifiers);
+                assert!(h.state().session.state.text_edit.is_none(), "the actual current shortcut ends the old edit");
+                assert!(h.state().session.state.selected_layers.is_empty());
+                assert!(h.output().platform_output.ime.is_none(), "the ended editor must not publish a descriptor");
+                assert!(!draws_ime_preview(&h), "Deselect All clears the old preview");
+                assert_eq!(layer_doc(&h.state().session, LayerId(original)).unwrap().text, "abcd");
+
+                let replacement = replacement_ime_edit(&mut h);
+                let request_id = ime_reset_request(&h);
+                assert_ne!(replacement, original);
+                assert_ne!(h.state().session.state.text_edit.as_ref().unwrap().session, old_session);
+                let project = h.state().session.project.clone();
+                let history = (h.state().session.history.undo.len(), h.state().session.history.redo.len());
+                let selection = h.state().session.state.selected_layers.clone();
+                h.input_mut().events.extend([ime_interruption_delete(bytes), Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+                h.run_steps(1);
+                assert_eq!(edited(&h), (replacement, "wxyz".to_owned(), 1, 1), "late delete and commit must reach the live replacement and be rejected");
+                assert_eq!(h.state().session.state.selected_layers, selection);
+                assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project), "rejected IME never edits either layer");
+                assert_eq!((h.state().session.history.undo.len(), h.state().session.history.redo.len()), history);
+                assert_eq!(layer_doc(&h.state().session, LayerId(original)).unwrap().text, "abcd");
+
+                h.input_mut().events.extend([
+                    Event::ImeResetCompleted { request_id },
+                    Event::Ime(egui::ImeEvent::Preedit { text: "é".into(), active_range_chars: None }),
+                    Event::Ime(egui::ImeEvent::Commit("é".into())),
+                ]);
+                h.run_steps(1);
+                assert_eq!(edited(&h), (replacement, "wéxyz".to_owned(), 2, 2), "a fresh composition still commits after rejecting the old terminal");
+                assert_eq!(h.state().session.history.undo.len(), history.0 + 1);
+                h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+                assert_eq!(edited(&h).1, "wxyz", "only the fresh commit needs undo");
+            }
+        }
+    }
+}
+
+#[test]
+fn deselect_all_without_composition_keeps_a_replacement_direct_commit_valid() {
+    let (mut h, _) = ime_interruption_editor();
+    let original = edited(&h).0;
+    key(&mut h, Key::A, Modifiers { shift: true, ..Modifiers::COMMAND });
+    assert!(h.state().session.state.text_edit.is_none());
+    assert!(h.output().platform_output.ime.is_none());
+    let replacement = replacement_ime_edit(&mut h);
+    let undo = h.state().session.history.undo.len();
+    h.input_mut().events.push(Event::Ime(egui::ImeEvent::Commit("Y".into())));
+    h.run_steps(1);
+    assert_eq!(edited(&h), (replacement, "wYxyz".to_owned(), 2, 2), "a new editor without an interrupted composition accepts a direct commit");
+    assert_eq!(h.state().session.history.undo.len(), undo + 1);
+    assert_eq!(layer_doc(&h.state().session, LayerId(original)).unwrap().text, "abcd");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(edited(&h).1, "wxyz");
+}
+
+fn fresh_ime(text: &str) -> [Event; 2] {
+    [Event::Ime(egui::ImeEvent::Preedit { text: text.into(), active_range_chars: None }), Event::Ime(egui::ImeEvent::Commit(text.into()))]
+}
+
+#[test]
+fn request_fence_alone_admits_the_first_fresh_ime_in_same_or_next_batch() {
+    for terminal_pending in [false, true] {
+        for next_batch in [false, true] {
+            let (mut h, _) = ime_interruption_editor();
+            begin_interrupted_composition(&mut h, terminal_pending);
+            let request_id = request_at_caret(&mut h, 1);
+            h.input_mut().events.push(Event::ImeResetCompleted { request_id });
+            if next_batch {
+                h.run_steps(1);
+            }
+            h.input_mut().events.extend(fresh_ime("が"));
+            h.run_steps(1);
+            assert_eq!((edited(&h).1.as_str(), edited(&h).2, edited(&h).3), ("aがbcd", 2, 2));
+            assert!(h.output().platform_output.ime.as_ref().unwrap().reset_request.is_none(), "completion does not allocate another request");
+            h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+            assert_eq!(edited(&h).1, "abcd");
+        }
+    }
+}
+
+#[test]
+fn newest_opaque_fence_rejects_stale_foreign_duplicate_and_no_ack_payloads() {
+    let (mut h, _) = ime_interruption_editor();
+    begin_interrupted_composition(&mut h, false);
+    let first = request_at_caret(&mut h, 1);
+    let second = request_at_caret(&mut h, 2);
+    assert_ne!(first, second);
+    let foreign = h.ctx.request_ime_reset(egui::ViewportId::from_hash_of("effect-ime-foreign")).unwrap();
+    let foreign_context = egui::Context::default().request_ime_reset(egui::ViewportId::ROOT).unwrap();
+    let project = h.state().session.project.clone();
+    let undo = h.state().session.history.undo.len();
+    for _ in 0..3 {
+        h.input_mut().events.extend([
+            Event::ImeResetCompleted { request_id: first },
+            Event::ImeResetCompleted { request_id: foreign },
+            Event::ImeResetCompleted { request_id: foreign_context },
+            ime_interruption_delete(false),
+            ime_interruption_delete(true),
+            Event::Ime(egui::ImeEvent::Commit("X".into())),
+            Event::Ime(egui::ImeEvent::Preedit { text: "late".into(), active_range_chars: None }),
+            Event::Ime(egui::ImeEvent::Preedit { text: String::new(), active_range_chars: None }),
+        ]);
+        h.run_steps(1);
+        assert_eq!((edited(&h).1.as_str(), edited(&h).3), ("abcd", 2));
+        assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
+        assert_eq!(h.state().session.history.undo.len(), undo);
+        assert!(h.output().platform_output.ime.as_ref().unwrap().reset_request.is_none(), "no-ack does not spin requests");
+    }
+    h.input_mut().events.extend([
+        Event::ImeResetCompleted { request_id: second },
+        Event::Ime(egui::ImeEvent::Preedit { text: "が".into(), active_range_chars: None }),
+        Event::ImeResetCompleted { request_id: second },
+        Event::Ime(egui::ImeEvent::Commit("が".into())),
+    ]);
+    h.run_steps(1);
+    assert_eq!(edited(&h).1, "abがcd", "duplicate F cannot interrupt the newly admitted composition");
+    assert!(h.output().platform_output.ime.as_ref().unwrap().reset_request.is_none());
+}
+
+#[test]
+fn outside_pointer_visits_the_control_suffix_without_mutating_the_old_viewer() {
+    for terminal_pending in [false, true] {
+        let (mut h, _) = ime_interruption_editor();
+        h.state_mut().show_panel(PanelKind::Timeline);
+        h.run_steps(2);
+        begin_interrupted_composition(&mut h, terminal_pending);
+        let first = request_at_caret(&mut h, 1);
+        let layer = edited(&h).0;
+        let outside = rect(&h, "timeline.empty").center();
+        assert!(!rect(&h, "viewer.area").contains(outside));
+        let undo = h.state().session.history.undo.len();
+        h.input_mut().events.extend([
+            Event::PointerMoved(outside),
+            Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+            Event::ImeResetCompleted { request_id: first },
+            Event::Text("BAD".into()),
+            Event::Cut,
+            Event::Paste("BAD".into()),
+            Event::Ime(egui::ImeEvent::Preedit { text: "late".into(), active_range_chars: None }),
+            Event::Ime(egui::ImeEvent::Commit("X".into())),
+        ]);
+        h.run_steps(1);
+        assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, "abcd");
+        assert_eq!(h.state().session.history.undo.len(), undo);
+        assert!(!h.ctx.input(|input| input.events.iter().any(|event| matches!(event, Event::ImeResetCompleted { .. }))), "the suffix control was visited");
+        h.input_mut().events.push(Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+        h.state_mut().session.execute("text.edit", json!({"layer": layer, "caret": 1})).unwrap();
+        h.state_mut().ui.focused = PanelKind::Composition;
+        h.run_steps(1);
+        let second = ime_reset_request(&h);
+        assert_ne!(first, second);
+        h.input_mut().events.extend([
+            Event::ImeResetCompleted { request_id: first },
+            Event::Ime(egui::ImeEvent::Commit("X".into())),
+            Event::ImeResetCompleted { request_id: second },
+        ]);
+        h.input_mut().events.extend(fresh_ime("が"));
+        h.run_steps(1);
+        assert_eq!(edited(&h).1, "aがbcd");
+    }
+}
+
+#[test]
+fn old_commit_then_fence_then_outside_pointer_keeps_the_prefix_rejected() {
+    let (mut h, _) = ime_interruption_editor();
+    h.state_mut().show_panel(PanelKind::Timeline);
+    h.run_steps(2);
+    begin_interrupted_composition(&mut h, false);
+    let first = request_at_caret(&mut h, 1);
+    let layer = edited(&h).0;
+    let outside = rect(&h, "timeline.empty").center();
+    h.input_mut().events.extend([
+        Event::Ime(egui::ImeEvent::Commit("X".into())),
+        Event::ImeResetCompleted { request_id: first },
+        Event::PointerMoved(outside),
+        Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
+        Event::Text("BAD".into()),
+        Event::Paste("BAD".into()),
+    ]);
+    h.run_steps(1);
+    assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, "abcd", "F cannot admit its preceding old commit or the outside suffix");
+    h.input_mut().events.push(Event::PointerButton { pos: outside, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    h.state_mut().session.execute("text.edit", json!({"layer": layer, "caret": 1})).unwrap();
+    h.state_mut().ui.focused = PanelKind::Composition;
+    h.run_steps(1);
+    // A panel may already have ended the custom route before the viewer drew. In that case
+    // its controls-only owner retired F and the actual returned replacement must be used.
+    if let Some(request_id) = h.output().platform_output.ime.as_ref().unwrap().reset_request {
+        assert_ne!(first, request_id);
+        h.input_mut().events.push(Event::ImeResetCompleted { request_id });
+    }
+    h.input_mut().events.extend(fresh_ime("が"));
+    h.run_steps(1);
+    assert_eq!(edited(&h).1, "aがbcd");
+}
+
+#[test]
+fn stock_dialog_suspends_before_sync_and_return_rearms_the_same_model_once() {
+    use egui_kittest::kittest::Queryable as _;
+    let (mut h, _) = ime_interruption_editor();
+    begin_interrupted_composition(&mut h, true);
+    let first = request_at_caret(&mut h, 1);
+    let custom_owner = h.output().platform_output.ime.as_ref().unwrap().owner;
+    h.state_mut().dialog = Some(effectcraft_ui_egui::Dialog::CommandPalette);
+    h.state_mut().session.execute("text.setSelection", json!({"caret": 2})).unwrap();
+    h.run_steps(2);
+    h.input_mut().events.extend([Event::ImeResetCompleted { request_id: first }, Event::Text("xyz".into())]);
+    h.run_steps(1);
+    let stock = h.output().platform_output.ime.as_ref().expect("the actual stock palette field owns IME");
+    assert_ne!(stock.owner, custom_owner);
+    assert!(stock.reset_request.is_none(), "ineligible synchronization cannot allocate a new token into the stock descriptor");
+    // The real accessible name must remain available after typing hides the placeholder.
+    let palette = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Type a command or effect…");
+    assert_eq!(palette.value().as_deref(), Some("xyz"), "the visible stock field receives the text untouched by custom control routing");
+    assert_eq!(edited(&h).1, "abcd");
+    h.state_mut().dialog = None;
+    h.state_mut().ui.focused = PanelKind::Composition;
+    h.ctx.memory_mut(|memory| {
+        if let Some(field) = memory.focused() {
+            memory.surrender_focus(field);
+        }
+    });
+    h.run_steps(1);
+    let second = ime_reset_request(&h);
+    assert_ne!(first, second);
+    h.run_steps(1);
+    assert!(h.output().platform_output.ime.as_ref().unwrap().reset_request.is_none());
+    h.input_mut().events.extend([
+        Event::ImeResetCompleted { request_id: first },
+        Event::Ime(egui::ImeEvent::Commit("X".into())),
+        Event::ImeResetCompleted { request_id: second },
+    ]);
+    h.input_mut().events.extend(fresh_ime("が"));
+    h.run_steps(1);
+    assert_eq!(edited(&h).1, "abがcd");
+}
+
+#[test]
+fn full_pass_logic_keeps_a_request_while_hidden_logic_rearms_once_on_return() {
+    let (mut h, _) = ime_interruption_editor();
+    begin_interrupted_composition(&mut h, false);
+    let first = request_at_caret(&mut h, 1);
+    h.run_steps(2);
+    assert!(h.output().platform_output.ime.as_ref().unwrap().reset_request.is_none(), "normal App::logic before UI must not rearm");
+    let ctx = h.ctx.clone();
+    let frame = eframe::Frame::_new_kittest();
+    let raw = egui::RawInput::default();
+    for _ in 0..3 {
+        let _ = ctx.run_logic(&raw, |ctx| {
+            h.state_mut().tick(ctx, &frame);
+            h.state().finish_ime_logic(ctx);
+        });
+    }
+    h.run_steps(1);
+    let second = ime_reset_request(&h);
+    assert_ne!(first, second);
+    h.run_steps(1);
+    assert!(h.output().platform_output.ime.as_ref().unwrap().reset_request.is_none());
+    h.input_mut().events.extend([
+        Event::ImeResetCompleted { request_id: first },
+        Event::Ime(egui::ImeEvent::Commit("X".into())),
+        Event::ImeResetCompleted { request_id: second },
+    ]);
+    h.input_mut().events.extend(fresh_ime("が"));
+    h.run_steps(1);
+    assert_eq!(edited(&h).1, "aがbcd");
+}
+
+#[test]
+fn same_caret_application_text_replacement_rejects_the_previous_context_fence() {
+    let (mut h, _) = ime_interruption_editor();
+    begin_interrupted_composition(&mut h, false);
+    let first = request_at_caret(&mut h, 1);
+    let before = edited(&h);
+    let generation = h.output().platform_output.ime.as_ref().unwrap().context_generation;
+    h.state_mut().session.execute("layer.setText", json!({"layer": before.0, "text": "Abcd"})).unwrap();
+    h.input_mut().events.extend([
+        Event::ImeResetCompleted { request_id: first },
+        ime_interruption_delete(true),
+        Event::Ime(egui::ImeEvent::Commit("X".into())),
+    ]);
+    h.run_steps(1);
+    assert_eq!(edited(&h), (before.0, "Abcd".to_owned(), before.2, before.3));
+    let output = h.output().platform_output.ime.as_ref().unwrap();
+    assert_ne!(output.context_generation, generation, "same numeric owner/caret still has a new context");
+    let second = ime_reset_request(&h);
+    assert_ne!(first, second);
+    h.input_mut().events.push(Event::ImeResetCompleted { request_id: second });
+    h.input_mut().events.extend(fresh_ime("が"));
+    h.run_steps(1);
+    assert_eq!(edited(&h).1, "Aがbcd");
+}
+
+/// #2077: the Character panel's Line Join buttons set the stroke's corner style (Miter for new text).
+#[test]
+fn character_panel_line_join_buttons_set_the_join() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "Join", "size": 80, "applyStroke": true, "strokeWidth": 8})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    let join = |h: &Harness<'_, EffectcraftApp>| layer_doc(&h.state().session, LayerId(lid)).unwrap().line_join;
+    assert_eq!(join(&h), effectcraft_engine::keyframe::LineJoin::Miter);
+    let bevel = rect(&h, "character.lineJoin.bevel").center();
+    click(&mut h, bevel, Modifiers::NONE);
+    assert_eq!(join(&h), effectcraft_engine::keyframe::LineJoin::Bevel);
+}
+
+/// #2075: the Character panel's stroke width has a presets menu (0.25 … 100 px) beside its value.
+#[test]
+fn character_panel_stroke_width_presets_set_the_width() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
+    let lid = s.execute("layer.newText", json!({"text": "Stroke", "size": 80, "applyStroke": true, "strokeWidth": 8})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Character);
+    h.run_steps(3);
+    let arrow = rect(&h, "character.strokeWidth.presets").center();
+    click(&mut h, arrow, Modifiers::NONE);
+    let entry = h.get_by_label("0.5 px").rect().center();
+    click(&mut h, entry, Modifiers::NONE);
+    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().stroke_width, 0.5);
+}
diff --git a/crates/ui-egui/tests/ui_text_range_handles.rs b/crates/ui-egui/tests/it/ui_text_range_handles.rs
similarity index 75%
rename from crates/ui-egui/tests/ui_text_range_handles.rs
rename to crates/ui-egui/tests/it/ui_text_range_handles.rs
index 1d048be52..7ce301b37 100644
--- a/crates/ui-egui/tests/ui_text_range_handles.rs
+++ b/crates/ui-egui/tests/it/ui_text_range_handles.rs
@@ -194,3 +194,76 @@ fn a_bar_on_a_box_handle_leaves_it_the_press() {
     assert_eq!(layer.props.find(start).unwrap().value.as_f64(), 0.0, "Start stays");
     assert_ne!(scale(&h), before, "the handle scaled the layer");
 }
+
+/// The text the Timeline paints in property `uid`'s value field.
+fn timeline_value(h: &Harness<'_, EffectcraftApp>, uid: u64) -> String {
+    let e = h.state().auto.find(&format!("timeline.prop.{uid}.value")).unwrap_or_else(|| panic!("timeline.prop.{uid}.value isn't shown"));
+    let field = egui::Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]));
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|c| match &c.shape {
+            egui::Shape::Text(t) if field.contains(t.visual_bounding_rect().center()) => Some(t.galley.text().to_string()),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The centre of the first painted text that reads `label` exactly (a popup's option).
+fn text_at(h: &Harness<'_, EffectcraftApp>, label: &str) -> Option<Pos2> {
+    h.output().shapes.iter().find_map(|c| match &c.shape {
+        egui::Shape::Text(t) if t.galley.text() == label => Some(t.visual_bounding_rect().center()),
+        _ => None,
+    })
+}
+
+fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.event(Event::PointerMoved(p));
+    h.step();
+    h.event(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    h.event(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+/// #1814: with Units = Index the Timeline shows the Range Selector's Start, End and Offset as
+/// counts, without the % sign they carry with Units = Percentage. Units is changed the way a
+/// user changes it: its Timeline popup, then the Index option.
+#[test]
+fn index_units_show_start_end_and_offset_without_a_percent_sign() {
+    let (s, ids) = setup();
+    let l = LayerId(ids.layer);
+    let layer = s.active_comp().unwrap().layer(l).unwrap().clone();
+    let text = layer.props.sub("text").unwrap();
+    let anim = animator(&s, ids.layer);
+    let selectors = anim.sub("selectors").unwrap();
+    let sel = selectors.groups().next().unwrap();
+    let (offset, units) = (sel.get("offset").unwrap().uid, sel.prop("advanced/units").unwrap().uid);
+    let advanced = sel.sub("advanced").unwrap().uid;
+    let mut h = harness(s);
+    let tl = &mut h.state_mut().ui.timeline;
+    tl.open_layers.insert(ids.layer);
+    let animators = text.sub("animators").unwrap().uid;
+    tl.open_groups.extend([text.uid, animators, anim.uid, selectors.uid, sel.uid, advanced]);
+    h.run_steps(3);
+    for uid in [ids.start, ids.end, offset] {
+        assert!(timeline_value(&h, uid).ends_with('%'), "Percentage units: {}", timeline_value(&h, uid));
+    }
+    // Units ▸ Index through the Timeline: open its popup, pick the option.
+    let units_value = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layer(l).unwrap().props.find(units).unwrap().value.clone();
+    assert_eq!(units_value(&h), effectcraft_engine::keyframe::Value::Enum(0), "Percentage to start with");
+    let field = h
+        .state()
+        .auto
+        .find(&format!("timeline.prop.{units}.value"))
+        .map(|e| pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0))
+        .expect("Units is shown");
+    click_at(&mut h, field);
+    let index = text_at(&h, "Index").expect("the Units popup lists Index");
+    click_at(&mut h, index);
+    assert_eq!(units_value(&h), effectcraft_engine::keyframe::Value::Enum(1), "the popup set Units to Index");
+    for uid in [ids.start, ids.end, offset] {
+        let v = timeline_value(&h, uid);
+        assert!(!v.is_empty() && !v.contains('%'), "Index units: {v:?}");
+    }
+}
diff --git a/crates/ui-egui/tests/ui_theme_favorites.rs b/crates/ui-egui/tests/it/ui_theme_favorites.rs
similarity index 95%
rename from crates/ui-egui/tests/ui_theme_favorites.rs
rename to crates/ui-egui/tests/it/ui_theme_favorites.rs
index 1b700f51f..424b28c49 100644
--- a/crates/ui-egui/tests/ui_theme_favorites.rs
+++ b/crates/ui-egui/tests/it/ui_theme_favorites.rs
@@ -1,3 +1,4 @@
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::{Session, config::MemoryConfig, prefs::Prefs};
 use effectcraft_ui_egui::{EffectcraftApp, menus};
 use egui::{Event, Modifiers, PointerButton, Pos2, pos2, vec2};
@@ -49,7 +50,7 @@ fn star_controls_save_and_favorite_menu_selects_the_family() {
     assert_eq!(h.state().session.prefs.appearance.favorite_themes, vec!["light"]);
     if let Some(path) = std::env::var_os("FAVORITES_SCREENSHOT_DIR") {
         std::fs::create_dir_all(&path).unwrap();
-        h.render().unwrap().save(std::path::Path::new(&path).join("effectcraft-favorites.png")).unwrap();
+        h.render_serialized().unwrap().save(std::path::Path::new(&path).join("effectcraft-favorites.png")).unwrap();
     }
     assert_eq!(h.state().session.prefs.appearance.appearance_mode, "dark");
     let p = at(&h, "settings.ok");
diff --git a/crates/ui-egui/tests/ui_time_zoom_controls.rs b/crates/ui-egui/tests/it/ui_time_zoom_controls.rs
similarity index 99%
rename from crates/ui-egui/tests/ui_time_zoom_controls.rs
rename to crates/ui-egui/tests/it/ui_time_zoom_controls.rs
index 4ab725d6a..c1ea26b2b 100644
--- a/crates/ui-egui/tests/ui_time_zoom_controls.rs
+++ b/crates/ui-egui/tests/it/ui_time_zoom_controls.rs
@@ -42,7 +42,8 @@ fn harness(graph: bool) -> Harness<'static, EffectcraftApp> {
 fn send(h: &mut Harness<'_, EffectcraftApp>, method: &str, params: Value) {
     let ctx = h.ctx.clone();
     let (req, _rx) = ControlRequest::new(method, params);
-    if let Outcome::Done(v) = control::handle(h.state_mut(), &ctx, &req) {
+    let now = h.state().now();
+    if let Outcome::Done(v) = control::handle(h.state_mut(), &ctx, &req, now) {
         assert!(v["ok"] != false, "{method}: {v}");
     }
     for e in h.state_mut().take_synthetic_input() {
diff --git a/crates/ui-egui/tests/it/ui_timeline_audio_levels.rs b/crates/ui-egui/tests/it/ui_timeline_audio_levels.rs
new file mode 100644
index 000000000..bc0b9a7f9
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_timeline_audio_levels.rs
@@ -0,0 +1,166 @@
+//! Audio Levels' channel link in the Timeline (#2485): off by default; linked, an edit to one
+//! channel moves the other by the same dB, so the stereo balance stays, typed or scrubbed, on a
+//! static or animated property, and one Undo takes it back.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::LayerId;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Key, Modifiers, PointerButton, Pos2, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+/// Press on `from`, move to `to` in `steps`, release there.
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, steps: u32) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=steps {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (k as f32 / steps as f32)));
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = center(h, id);
+    drag(h, p, p, 1);
+}
+
+fn type_value(h: &mut Harness<'_, EffectcraftApp>, id: &str, v: &str) {
+    click(h, id);
+    h.input_mut().events.push(Event::Text(v.into()));
+    h.step();
+    h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+/// A precomp layer (which has Audio Levels) in comp Main at `levels`; its layer id and the
+/// property's uid.
+fn add_sound_layer(s: &mut Session, levels: [f64; 2]) -> (u64, u64) {
+    let l = s.execute("layer.addItem", json!({"item": "Sound"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("prop.set", json!({"layer": l, "path": "audio/levels", "value": levels})).unwrap();
+    (l, s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("audio/levels").unwrap().uid)
+}
+
+/// Comps Sound and Main.
+fn comps(s: &mut Session) {
+    s.execute("comp.new", json!({"name": "Sound", "width": 64, "height": 36, "duration": 4})).unwrap();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+}
+
+/// Twirl layer `l` open to its property `uid`.
+fn reveal(h: &mut Harness<'_, EffectcraftApp>, l: u64, uid: u64) {
+    h.state_mut().ui.timeline.open_layers.insert(l);
+    h.state_mut().ui.timeline.layer_reveal.insert(l, vec!["props".into()]);
+    h.state_mut().ui.timeline.reveal_props.insert(uid);
+    h.run_steps(3);
+}
+
+fn levels_of(h: &Harness<'_, EffectcraftApp>, l: u64) -> Vec<f64> {
+    h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("audio/levels").unwrap().value.components()
+}
+
+#[test]
+fn linked_audio_levels_move_both_channels_by_the_same_db() {
+    let mut s = Session::default();
+    comps(&mut s);
+    let (l, uid) = add_sound_layer(&mut s, [-6.0, -12.0]);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    reveal(&mut h, l, uid);
+    let levels =
+        |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("audio/levels").unwrap().clone();
+    let set = |h: &mut Harness<'_, EffectcraftApp>, v: [f64; 2]| {
+        h.state_mut().session.execute("prop.set", json!({"layer": l, "path": "audio/levels", "value": v})).unwrap();
+        h.run_steps(2);
+    };
+    let undo = |h: &mut Harness<'_, EffectcraftApp>| {
+        h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+        h.run_steps(2);
+    };
+    let (left, right, link) = (format!("timeline.prop.{uid}.value.0"), format!("timeline.prop.{uid}.value.1"), format!("timeline.prop.{uid}.link"));
+    assert_eq!(h.state().auto.find(&link).unwrap().label, "Link Channels");
+
+    type_value(&mut h, &left, "-3");
+    assert_eq!(levels(&h).value.components(), vec![-3.0, -12.0], "unlinked by default, one channel moves alone");
+    set(&mut h, [-6.0, -12.0]);
+
+    click(&mut h, &link);
+    type_value(&mut h, &left, "-3");
+    assert_eq!(levels(&h).value.components(), vec![-3.0, -9.0], "linked, both rise 3 dB and keep their 6 dB balance");
+    undo(&mut h);
+    assert_eq!(levels(&h).value.components(), vec![-6.0, -12.0], "one Undo takes back both channels");
+
+    type_value(&mut h, &right, "0");
+    assert_eq!(levels(&h).value.components(), vec![6.0, 0.0], "the right channel leads just the same");
+    set(&mut h, [0.0, 0.0]);
+    type_value(&mut h, &left, "-6");
+    assert_eq!(levels(&h).value.components(), vec![-6.0, -6.0], "equal channels at 0 dB stay equal");
+
+    set(&mut h, [-6.0, -12.0]);
+    let from = center(&h, &left);
+    drag(&mut h, from, from + vec2(30.0, 0.0), 6);
+    let c = levels(&h).value.components();
+    assert!(c[0] > -6.0, "the scrub raised the left channel: {c:?}");
+    assert!((c[0] - c[1] - 6.0).abs() < 1e-9, "a linked scrub keeps the balance: {c:?}");
+    undo(&mut h);
+    assert_eq!(levels(&h).value.components(), vec![-6.0, -12.0], "one Undo takes back the whole scrub");
+
+    // Animated: the edit at the current time changes that key's two channels together.
+    h.state_mut().session.execute("prop.addKey", json!({"layer": l, "path": "audio/levels", "time": 0.0, "value": [-6.0, -12.0]})).unwrap();
+    h.state_mut().session.execute("prop.addKey", json!({"layer": l, "path": "audio/levels", "time": 1.0, "value": [0.0, 0.0]})).unwrap();
+    h.run_steps(2);
+    type_value(&mut h, &left, "-10");
+    let keys: Vec<Vec<f64>> = levels(&h).keys.iter().map(|k| k.value.components()).collect();
+    assert_eq!(keys, vec![vec![-10.0, -16.0], vec![0.0, 0.0]], "the key at the current time moves both channels");
+
+    click(&mut h, &link);
+    type_value(&mut h, &left, "-4");
+    let keys: Vec<Vec<f64>> = levels(&h).keys.iter().map(|k| k.value.components()).collect();
+    assert_eq!(keys[0], vec![-4.0, -16.0], "unlinked again, the right channel stays");
+}
+
+/// With several layers selected, a linked typed Left sets each layer's Left and moves its Right
+/// by that layer's own change: every layer keeps its own balance.
+#[test]
+fn linked_typing_keeps_each_selected_layers_own_balance() {
+    let mut s = Session::default();
+    comps(&mut s);
+    let (a, uid) = add_sound_layer(&mut s, [-6.0, -12.0]);
+    let (b, other) = add_sound_layer(&mut s, [-20.0, -30.0]);
+    s.execute("layer.select", json!({"layers": [a, b]})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    reveal(&mut h, a, uid);
+    reveal(&mut h, b, other);
+    click(&mut h, &format!("timeline.prop.{uid}.link"));
+    type_value(&mut h, &format!("timeline.prop.{uid}.value.0"), "-3");
+    assert_eq!(levels_of(&h, a), vec![-3.0, -9.0]);
+    assert_eq!(levels_of(&h, b), vec![-3.0, -13.0], "B rises 17 dB on both channels, keeping its 10 dB balance");
+}
+
+/// A link turned on does not carry into a new project whose Audio Levels reuse the property uid.
+#[test]
+fn a_new_project_starts_with_its_audio_levels_unlinked() {
+    let mut s = Session::default();
+    comps(&mut s);
+    let (l, uid) = add_sound_layer(&mut s, [0.0, 0.0]);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    reveal(&mut h, l, uid);
+    click(&mut h, &format!("timeline.prop.{uid}.link"));
+    assert!(h.state().ui.timeline.is_linked(uid, false));
+
+    h.state_mut().session.execute("file.newProject", json!({})).unwrap();
+    comps(&mut h.state_mut().session);
+    let (l, again) = add_sound_layer(&mut h.state_mut().session, [0.0, 0.0]);
+    assert_eq!(again, uid, "the new project reuses the property uid");
+    reveal(&mut h, l, again);
+    assert!(!h.state().ui.timeline.is_linked(again, false), "the new project's levels start unlinked");
+    type_value(&mut h, &format!("timeline.prop.{again}.value.0"), "-3");
+    assert_eq!(levels_of(&h, l), vec![-3.0, 0.0]);
+}
diff --git a/crates/ui-egui/tests/ui_timeline_effect_label.rs b/crates/ui-egui/tests/it/ui_timeline_effect_label.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_timeline_effect_label.rs
rename to crates/ui-egui/tests/it/ui_timeline_effect_label.rs
diff --git a/crates/ui-egui/tests/it/ui_timeline_group_select.rs b/crates/ui-egui/tests/it/ui_timeline_group_select.rs
new file mode 100644
index 000000000..0a553976b
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_timeline_group_select.rs
@@ -0,0 +1,83 @@
+//! Shift-clicking a group row in the Timeline adds it to the selection, as on a property row, so
+//! several Puppet pins can be selected and deleted together (#1751).
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{LayerId, PropGroup};
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::{Modifiers, Pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+fn harness() -> (Harness<'static, EffectcraftApp>, u64, [u64; 3]) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 200, "height": 100, "frameRate": 30, "duration": 2})).unwrap();
+    let layer = s.execute("layer.newSolid", json!({"width": 100, "height": 60, "color": [0, 0, 1]})).unwrap()["layer"].as_u64().unwrap();
+    let pin = |s: &mut Session, x: i64| s.execute("puppet.addPin", json!({"layer": layer, "position": [x, 30]})).unwrap()["pin"].as_u64().unwrap();
+    let pins = [pin(&mut s, 10), pin(&mut s, 50), pin(&mut s, 90)];
+    let mut app = EffectcraftApp::new(s);
+    app.show_panel(PanelKind::Timeline);
+    app.ui.timeline.open_layers.insert(layer);
+    // Twirl open every group down to the pins.
+    fn all(g: &PropGroup, out: &mut Vec<u64>) {
+        for c in g.groups() {
+            out.push(c.uid);
+            all(c, out);
+        }
+    }
+    let mut open = vec![];
+    if let Some(l) = app.session.active_comp().and_then(|c| c.layer(LayerId(layer))) {
+        all(&l.props, &mut open);
+    }
+    app.ui.timeline.open_groups.extend(open);
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1100.0)).build_eframe(|_| app);
+    h.run_steps(4);
+    (h, layer, pins)
+}
+
+fn row(h: &Harness<'_, EffectcraftApp>, uid: u64) -> Pos2 {
+    let id = format!("timeline.group.{uid}.name");
+    let e = h.state().auto.find(&id).unwrap_or_else(|| panic!("no {id}"));
+    egui::pos2(e.rect[0] + e.rect[2].min(40.0) / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, uid: u64, modifiers: Modifiers) {
+    let at = row(h, uid);
+    h.input_mut().events.push(egui::Event::ModifiersChanged(modifiers));
+    h.input_mut().events.push(egui::Event::PointerMoved(at));
+    h.input_mut().events.push(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers });
+    h.input_mut().events.push(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers });
+    h.run_steps(3);
+    h.input_mut().events.push(egui::Event::ModifiersChanged(Modifiers::NONE));
+    h.step();
+}
+
+fn selected(h: &Harness<'_, EffectcraftApp>, pins: [u64; 3]) -> Vec<u64> {
+    h.state().session.state.selected_props.iter().map(|(_, u)| *u).filter(|u| pins.contains(u)).collect()
+}
+
+fn pin_count(h: &Harness<'_, EffectcraftApp>, layer: u64) -> usize {
+    let l = h.state().session.active_comp().unwrap().layer(LayerId(layer)).unwrap();
+    l.effects().unwrap().groups().map(effectcraft_engine::effects::puppet::pin_count).sum()
+}
+
+#[test]
+fn shift_click_adds_puppet_pins_and_delete_removes_them_together() {
+    let (mut h, layer, pins) = harness();
+    let [a, b, c] = pins;
+    click(&mut h, a, Modifiers::NONE);
+    assert_eq!(selected(&h, pins), [a]);
+    click(&mut h, b, Modifiers::SHIFT);
+    assert_eq!(selected(&h, pins), [a, b], "Shift-click keeps the first pin");
+    click(&mut h, c, Modifiers::NONE);
+    assert_eq!(selected(&h, pins), [c], "a plain click selects only the clicked pin");
+
+    click(&mut h, a, Modifiers::NONE);
+    click(&mut h, b, Modifiers::SHIFT);
+    h.state_mut().session.execute("edit.clear", json!({})).unwrap();
+    h.run_steps(3);
+    assert_eq!(pin_count(&h, layer), 1, "Delete removes both selected pins");
+    assert!(h.state().session.active_comp().unwrap().layer(LayerId(layer)).is_some(), "the layer stays");
+    h.state_mut().session.undo();
+    assert_eq!(pin_count(&h, layer), 3, "one Undo restores both pins");
+}
diff --git a/crates/ui-egui/tests/it/ui_timeline_marquee.rs b/crates/ui-egui/tests/it/ui_timeline_marquee.rs
new file mode 100644
index 000000000..bf6dab74e
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_timeline_marquee.rs
@@ -0,0 +1,124 @@
+//! The key marquee in the Timeline (#2857): a box selects a key as soon as it touches any part of
+//! the key's glyph, not when it reaches the key's center.
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::LayerId;
+use effectcraft_engine::time::Tick;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Modifiers, Pos2, Vec2, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// How far a linear key's diamond reaches from its center, without its hairline (0.25 pt).
+const REACH: f32 = 5.5;
+
+/// A comp with one solid, its Opacity keys at 1 s and 2 s (linear) revealed.
+fn harness() -> (Harness<'static, EffectcraftApp>, u64) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Box", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
+    let id = s.execute("layer.newSolid", json!({"name": "L", "color": "#e04020", "width": 80, "height": 80})).unwrap()["layer"].as_u64().unwrap();
+    for (t, v) in [(1.0, 0.0), (2.0, 100.0)] {
+        s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": t, "value": v})).unwrap();
+    }
+    s.execute("layer.select", json!({"layers": [id]})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.reveal.opacity", json!({})).unwrap();
+    h.run_steps(4);
+    (h, id)
+}
+
+/// The center of the key at `secs`: the middle of its hit rect, which is centered on the glyph.
+fn key_center(h: &Harness<'_, EffectcraftApp>, id: u64, secs: f64) -> Pos2 {
+    let comp = h.state().session.active_comp().unwrap();
+    let uid = comp.layer(LayerId(id)).unwrap().props.prop("transform/opacity").unwrap().uid;
+    let key = format!("timeline.keyAt.{uid}.{}", Tick::from_seconds_f64(secs).0);
+    let e = h.state().auto.find(&key).unwrap_or_else(|| panic!("no {key}"));
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+/// Draw a marquee from `from` to `to`, then report the selected keys' times in seconds.
+fn marquee(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) -> Vec<f64> {
+    let modifiers = Modifiers::default();
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers });
+    h.step();
+    for i in 1..=24 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 24.0)));
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers });
+    h.run_steps(2);
+    h.state().session.state.selected_keys.iter().map(|k| k.time.seconds()).collect()
+}
+
+#[test]
+fn a_box_selects_a_key_it_grazes_from_any_side_and_not_one_it_stops_short_of() {
+    let (mut h, id) = harness();
+    let c = key_center(&h, id, 1.0);
+    // Boxes end `gap` from the key's center, coming from the right, the left and below (the row
+    // above holds the layer bar, where a press would drag the layer).
+    let sides: [(&str, fn(f32) -> (Vec2, Vec2)); 3] = [
+        ("right", |gap| (vec2(30.0, 5.0), vec2(gap, -5.0))),
+        ("left", |gap| (vec2(-30.0, 5.0), vec2(-gap, -5.0))),
+        ("below", |gap| (vec2(5.0, 40.0), vec2(-5.0, gap))),
+    ];
+    for (side, gap_to_box) in sides {
+        let (from, to) = gap_to_box(REACH);
+        assert_eq!(marquee(&mut h, c + from, c + to), [1.0], "a box touching the glyph's {side} point selects the key");
+        // Clear of the glyph and its hairline by 1 pt.
+        let (from, to) = gap_to_box(REACH + 0.25 + 1.0);
+        assert!(marquee(&mut h, c + from, c + to).is_empty(), "a box 1 pt short on the {side} misses it");
+        assert!(h.state().session.state.selected_layers.is_empty(), "a box that catches nothing deselects (layers included)");
+    }
+}
+
+/// #3056: one box spans the layer outline and the time graph. Dragged from the empty outline
+/// into the graph, or from the graph back over the outline, it selects the layers whose rows it
+/// crosses and the keys inside it, through the real drag, release and selection commands.
+#[test]
+fn a_box_dragged_across_the_outline_and_the_graph_selects_rows_and_keys() {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Box", "width": 320, "height": 180, "frameRate": 30, "duration": 4})).unwrap();
+    let mut ids = vec![];
+    for name in ["A", "B"] {
+        let id = s.execute("layer.newSolid", json!({"name": name, "color": "#e04020", "width": 80, "height": 80})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("prop.addKey", json!({"layer": id, "path": "transform/opacity", "time": 1.0, "value": 50})).unwrap();
+        ids.push(id);
+    }
+    s.execute("layer.select", json!({"layers": ids})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.reveal.opacity", json!({})).unwrap();
+    h.run_steps(4);
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.run_steps(2);
+    // B was added last, so its rows are on top; below A's rows the outline is empty.
+    let (top, bottom) = (key_center(&h, ids[1], 1.0), key_center(&h, ids[0], 1.0));
+    let outline = h.state().auto.find("timeline.layerMarquee").expect("the outline's empty area").rect;
+    let below = pos2(outline[0] + 60.0, bottom.y + 40.0);
+    assert!(below.x < top.x && below.y < outline[1] + outline[3], "the start is in the outline, below the rows");
+    let selected = |h: &Harness<'_, EffectcraftApp>| {
+        let st = &h.state().session.state;
+        let mut layers: Vec<u64> = st.selected_layers.iter().map(|l| l.0).collect();
+        let mut keyed: Vec<u64> = st.selected_keys.iter().map(|k| k.layer.0).collect();
+        layers.sort_unstable();
+        keyed.sort_unstable();
+        (layers, keyed)
+    };
+    let mut both = ids.clone();
+    both.sort_unstable();
+    // From the outline up and right into the graph, over both keys.
+    let keys = marquee(&mut h, below, top + vec2(15.0, -3.0));
+    assert_eq!(keys, [1.0, 1.0]);
+    assert_eq!(selected(&h), (both.clone(), both.clone()), "outline → graph");
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.run_steps(2);
+    // And back: from beside the top key in the graph down and left over the outline.
+    let keys = marquee(&mut h, top + vec2(30.0, 0.0), below);
+    assert_eq!(keys, [1.0, 1.0]);
+    assert_eq!(selected(&h), (both.clone(), both), "graph → outline");
+}
diff --git a/crates/ui-egui/tests/it/ui_timeline_pan.rs b/crates/ui-egui/tests/it/ui_timeline_pan.rs
new file mode 100644
index 000000000..56bbd8a45
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_timeline_pan.rs
@@ -0,0 +1,93 @@
+//! Spacebar-drag panning in the Timeline: the Hand tool scrolls the layer rows vertically as well
+//! as the time graph horizontally (#2083). A middle-drag does the same, from the layer list too
+//! (#2854).
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::{Event, Modifiers, Pos2, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+/// A 10 s comp with 40 solids, enough rows to scroll.
+fn harness() -> (Harness<'static, EffectcraftApp>, u64) {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Many", "width": 320, "height": 180, "frameRate": 30, "duration": 10})).unwrap();
+    let mut top = 0;
+    for i in 0..40 {
+        top = s.execute("layer.newSolid", json!({"name": format!("Layer {i}"), "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    }
+    s.execute("layer.select", json!({"layers": []})).unwrap();
+    let app = EffectcraftApp::new(s);
+    let mut h = Harness::builder().with_size(vec2(1200.0, 800.0)).build_eframe(|_| app);
+    h.run_steps(4);
+    (h, top)
+}
+
+fn space(h: &mut Harness<'_, EffectcraftApp>, pressed: bool) {
+    h.event(Event::Key { key: egui::Key::Space, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
+    h.step();
+}
+
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
+    drag_with(h, egui::PointerButton::Primary, from, to);
+}
+
+fn drag_with(h: &mut Harness<'_, EffectcraftApp>, button: egui::PointerButton, from: Pos2, to: Pos2) {
+    h.event(Event::PointerMoved(from));
+    h.step();
+    h.event(Event::PointerButton { pos: from, button, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=10 {
+        h.event(Event::PointerMoved(from + (to - from) * (k as f32 / 10.0)));
+        h.step();
+    }
+    h.event(Event::PointerButton { pos: to, button, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+#[test]
+fn middle_drag_pans_from_the_layer_list_and_the_bars() {
+    let (mut h, layer) = harness();
+    h.state_mut().ui.timeline.pps = Some(400.0);
+    h.state_mut().ui.timeline.start = 1.0;
+    h.run_steps(3);
+    let order = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.iter().map(|l| l.id).collect::<Vec<_>>();
+    let before = order(&h);
+    let center = |r: [f32; 4]| pos2(r[0] + r[2] / 2.0, r[1] + r[3] / 2.0);
+    let row = center(h.state().auto.find(&format!("timeline.layer.{layer}.row")).expect("layer row").rect);
+    drag_with(&mut h, egui::PointerButton::Middle, row, row - vec2(0.0, 180.0));
+    let y = h.state().ui.timeline.scroll_y;
+    assert!(y > 100.0, "the list scrolled: {y}");
+    assert_eq!(h.state().ui.timeline.start, 1.0, "a vertical drag leaves time alone");
+    assert_eq!(order(&h), before, "the layers stay in order");
+    assert!(h.state().session.state.selected_layers.is_empty(), "the press selects nothing");
+    // In the time graph, just right of the row, whatever the zoom has left of its bar.
+    h.state_mut().ui.timeline.scroll_y = 0.0;
+    h.run_steps(2);
+    let r = h.state().auto.find(&format!("timeline.layer.{layer}.row")).expect("layer row").rect;
+    let graph = pos2(r[0] + r[2] + 100.0, r[1] + r[3] / 2.0);
+    drag_with(&mut h, egui::PointerButton::Middle, graph, graph - vec2(80.0, 0.0));
+    let start = h.state().ui.timeline.start;
+    assert!(start > 1.1, "time panned: {start}");
+    assert_eq!(order(&h), before);
+}
+
+#[test]
+fn spacebar_drag_pans_the_rows_vertically() {
+    let (mut h, layer) = harness();
+    assert_eq!(h.state().ui.timeline.scroll_y, 0.0);
+    let bar = h.state().auto.find(&format!("timeline.layer.{layer}.bar")).expect("layer bar").rect;
+    let from = pos2(bar[0] + 40.0, bar[1] + bar[3] / 2.0);
+    let timing = |h: &Harness<'_, EffectcraftApp>| {
+        let l = &h.state().session.active_comp().unwrap().layers[0];
+        (l.in_point.seconds(), l.out_point.seconds(), l.start_time.seconds())
+    };
+    let before = timing(&h);
+    space(&mut h, true);
+    drag(&mut h, from, from - vec2(0.0, 180.0));
+    space(&mut h, false);
+    let y = h.state().ui.timeline.scroll_y;
+    assert!(y > 100.0, "the rows scrolled vertically: {y}");
+    assert_eq!(h.state().ui.timeline.start, 0.0, "the time graph did not pan sideways");
+    assert_eq!(timing(&h), before, "the layer under the hand did not move");
+}
diff --git a/crates/ui-egui/tests/it/ui_timeline_shapes.rs b/crates/ui-egui/tests/it/ui_timeline_shapes.rs
new file mode 100644
index 000000000..6a7f50a10
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_timeline_shapes.rs
@@ -0,0 +1,556 @@
+//! Timeline rows for shape layers, masks and keyframing: the Contents "Add:" menu and the Classic
+//! 3D "Change Renderer…" row (#206), Alt+Shift+P revealing the key it adds and clicks below the
+//! layers deselecting them (#205), Mask Feather's linked values (#203) and shape Size's chain link
+//! (#2489), copying shape items between shape layers (#227), and Ctrl+V of SVG markup making a shape
+//! layer (#738).
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::LayerId;
+use effectcraft_ui_egui::{Dialog, EffectcraftApp};
+use egui::{Event, Key, Modifiers, PointerButton, Pos2, pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+fn harness(s: Session) -> Harness<'static, EffectcraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    h
+}
+
+fn session() -> Session {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    s
+}
+
+fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
+}
+
+/// Step until the viewer's frame has rendered (frames render on background threads).
+fn settle(h: &mut Harness<'_, EffectcraftApp>) {
+    for _ in 0..600 {
+        h.step();
+        if h.state().frames.inflight() == 0 && h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    h.run_steps(2);
+}
+
+fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
+    let p = center(h, id);
+    click_at(h, p);
+}
+
+fn open_layer(h: &mut Harness<'_, EffectcraftApp>, id: u64) {
+    h.state_mut().ui.timeline.open_layers.insert(id);
+    h.run_steps(2);
+}
+
+#[test]
+fn shape_contents_add_menu_adds_path_operations() {
+    let mut s = session();
+    let l = s.execute("layer.newShape", json!({"kind": "ellipse"})).unwrap()["layer"].as_u64().unwrap();
+    let contents = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("contents").unwrap().uid;
+    let mut h = harness(s);
+    open_layer(&mut h, l);
+    click(&mut h, &format!("timeline.group.{contents}.add"));
+    let entry = h.get_by_label("Trim Paths").rect();
+    assert!(entry.max.y <= 1000.0, "the whole menu fits in the window: {entry:?}");
+    click_at(&mut h, entry.center());
+    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let items: Vec<&str> = layer.props.sub("contents").unwrap().groups().map(|g| g.match_id.as_str()).collect();
+    assert_eq!(items, ["group", "trim"]);
+}
+
+#[test]
+fn shape_contents_add_menu_adds_wiggle_transform() {
+    let mut s = session();
+    let l = s.execute("layer.newShape", json!({"kind": "ellipse"})).unwrap()["layer"].as_u64().unwrap();
+    let contents = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("contents").unwrap().uid;
+    let mut h = harness(s);
+    open_layer(&mut h, l);
+    click(&mut h, &format!("timeline.group.{contents}.add"));
+    assert!(h.get_by_label("Zig Zag").rect().max.y <= 1000.0, "the whole menu fits in the window");
+    let entry = h.get_by_label("Wiggle Transform").rect();
+    click_at(&mut h, entry.center());
+    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let items: Vec<&str> = layer.props.sub("contents").unwrap().groups().map(|g| g.match_id.as_str()).collect();
+    assert_eq!(items, ["group", "wiggler"]);
+}
+
+/// A shape group's inner Contents is elided in After Effects: opening the group lists its items
+/// (here the path) directly, with no "Contents" row between them.
+#[test]
+fn shape_group_contents_has_no_inner_contents_row() {
+    let mut s = session();
+    let l = s.execute("layer.newShape", json!({"kind": "rect"})).unwrap()["layer"].as_u64().unwrap();
+    let layer = s.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let contents = layer.props.sub("contents").unwrap().clone();
+    let group = contents.groups().next().unwrap().clone();
+    let inner = group.sub("contents").unwrap().clone();
+    let item = inner.groups().next().unwrap().clone();
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_layers.insert(l);
+    h.state_mut().ui.timeline.open_groups.insert(contents.uid);
+    h.state_mut().ui.timeline.open_groups.insert(group.uid);
+    h.run_steps(2);
+    let name = |uid: u64| format!("timeline.group.{uid}.name");
+    assert!(h.state().auto.find(&name(contents.uid)).is_some(), "the layer's Contents row");
+    assert!(h.state().auto.find(&name(group.uid)).is_some(), "the shape group row");
+    assert!(h.state().auto.find(&name(inner.uid)).is_none(), "no inner Contents row");
+    assert!(h.state().auto.find(&name(item.uid)).is_some(), "the path lists directly under the group");
+}
+
+#[test]
+fn classic_3d_shape_layers_offer_change_renderer() {
+    let mut s = session();
+    let l = s.execute("layer.newShape", json!({"kind": "rect"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "threeD", "value": true})).unwrap();
+    let mut h = harness(s);
+    open_layer(&mut h, l);
+    click(&mut h, &format!("timeline.layer.{l}.changeRenderer"));
+    assert_eq!(h.state().dialog, Some(Dialog::CompSettings));
+    assert!(h.state().auto.find("dialog.comp.renderer").is_some(), "on the 3D Renderer tab");
+    // Advanced 3D shows the extrusion options instead.
+    h.state_mut().dialog = None;
+    h.state_mut().session.execute("comp.renderer", json!({"renderer": "advanced3d"})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().auto.find(&format!("timeline.layer.{l}.changeRenderer")).is_none());
+}
+
+#[test]
+fn add_position_key_reveals_position() {
+    let mut s = session();
+    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(s);
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.keyAt.position", json!({})).unwrap();
+    h.run_steps(2);
+    let app = h.state();
+    let position = app.session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("transform/position").unwrap().clone();
+    assert_eq!(position.keys.len(), 1);
+    assert_eq!(app.ui.timeline.layer_reveal.get(&l), Some(&vec!["position".to_string()]));
+    assert!(app.auto.find(&format!("timeline.prop.{}.value.0", position.uid)).is_some(), "the Position row shows");
+}
+
+#[test]
+fn clicking_below_the_layers_deselects_them() {
+    let mut s = session();
+    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(s);
+    assert_eq!(h.state().session.state.selected_layers, vec![LayerId(l)]);
+    // In the time graph, below the only layer.
+    let bar = center(&h, &format!("timeline.layer.{l}.bar"));
+    click_at(&mut h, bar + egui::vec2(0.0, 80.0));
+    assert!(h.state().session.state.selected_layers.is_empty());
+}
+
+#[test]
+fn mask_feather_values_are_linked_and_not_negative() {
+    let mut s = session();
+    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.addMask", json!({"layer": l, "shape": "rect"})).unwrap();
+    let feather = |h: &Harness<'_, EffectcraftApp>| {
+        let p = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("masks/#1/feather").unwrap().clone();
+        (p.uid, p.value.components())
+    };
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_layers.insert(l);
+    h.state_mut().ui.timeline.layer_reveal.insert(l, vec!["feather".into()]);
+    h.run_steps(2);
+    let (uid, _) = feather(&h);
+    let type_value = |h: &mut Harness<'_, EffectcraftApp>, d: usize, v: &str| {
+        click(h, &format!("timeline.prop.{uid}.value.{d}"));
+        h.input_mut().events.push(Event::Text(v.into()));
+        h.step();
+        h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        h.run_steps(3);
+    };
+    type_value(&mut h, 0, "12");
+    assert_eq!(feather(&h).1, vec![12.0, 12.0], "linked by default");
+    type_value(&mut h, 1, "-5");
+    assert_eq!(feather(&h).1, vec![0.0, 0.0], "never negative");
+    click(&mut h, &format!("timeline.prop.{uid}.link"));
+    type_value(&mut h, 1, "7");
+    assert_eq!(feather(&h).1, vec![0.0, 7.0], "unlinked");
+}
+
+/// #2489: Rectangle and Ellipse Path Size get the Constrain Proportions chain, off by default:
+/// unlinked, W moves alone; linked, H follows W in proportion. Scale on the same layer still starts
+/// linked.
+#[test]
+fn shape_size_chain_starts_unlinked_and_keeps_the_ratio_when_linked() {
+    let mut s = session();
+    let l = s.execute("layer.newShape", json!({"kind": "rect", "size": [100, 50]})).unwrap()["layer"].as_u64().unwrap();
+    let o = s.execute("layer.newShape", json!({"kind": "ellipse", "size": [60, 30]})).unwrap()["layer"].as_u64().unwrap();
+    let uid = |s: &Session, l: u64, path: &str| s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop(path).unwrap().uid;
+    let (size, oval, scale) =
+        (uid(&s, l, "contents/group/contents/rect/size"), uid(&s, o, "contents/group/contents/ellipse/size"), uid(&s, l, "transform/scale"));
+    let mut h = harness(s);
+    for (layer, props) in [(l, vec![size, scale]), (o, vec![oval])] {
+        h.state_mut().ui.timeline.open_layers.insert(layer);
+        h.state_mut().ui.timeline.layer_reveal.insert(layer, vec!["props".into()]);
+        h.state_mut().ui.timeline.reveal_props.extend(props);
+    }
+    h.run_steps(2);
+    let value = |h: &Harness<'_, EffectcraftApp>, l: u64, uid: u64| {
+        h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop(&format!("@{uid}")).unwrap().value.components()
+    };
+    let type_value = |h: &mut Harness<'_, EffectcraftApp>, uid: u64, d: usize, v: &str| {
+        click(h, &format!("timeline.prop.{uid}.value.{d}"));
+        h.input_mut().events.push(Event::Text(v.into()));
+        h.step();
+        h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        h.run_steps(3);
+    };
+    type_value(&mut h, size, 0, "80");
+    assert_eq!(value(&h, l, size), vec![80.0, 50.0], "a new rectangle's Size starts unlinked");
+    type_value(&mut h, oval, 1, "40");
+    assert_eq!(value(&h, o, oval), vec![60.0, 40.0], "a new ellipse's Size starts unlinked");
+    click(&mut h, &format!("timeline.prop.{size}.link"));
+    type_value(&mut h, size, 0, "160");
+    assert_eq!(value(&h, l, size), vec![160.0, 100.0], "linked, H follows W in proportion");
+    click(&mut h, &format!("timeline.prop.{size}.link"));
+    type_value(&mut h, size, 0, "40");
+    assert_eq!(value(&h, l, size), vec![40.0, 100.0], "unlinked again, H stays");
+    // The ellipse's Size links the same way: 60x40 linked, W to 90 makes H 60.
+    click(&mut h, &format!("timeline.prop.{oval}.link"));
+    type_value(&mut h, oval, 0, "90");
+    assert_eq!(value(&h, o, oval), vec![90.0, 60.0], "linked, the ellipse keeps its ratio too");
+    type_value(&mut h, scale, 0, "50");
+    assert_eq!(value(&h, l, scale)[..2], [50.0, 50.0], "Scale still starts linked");
+}
+
+/// Two shape layers, "Rect" (Rectangle 1) and "Oval" (Ellipse 1, selected): (harness with Rect's
+/// Contents open, Rect, Oval, Rectangle 1's uid).
+fn two_shape_layers() -> (Harness<'static, EffectcraftApp>, u64, u64, u64) {
+    let mut s = session();
+    let a = s.execute("layer.newShape", json!({"kind": "rect", "name": "Rect"})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.newShape", json!({"kind": "ellipse", "name": "Oval"})).unwrap()["layer"].as_u64().unwrap();
+    let contents = s.active_comp().unwrap().layer(LayerId(a)).unwrap().props.sub("contents").unwrap().clone();
+    let rect = contents.groups().next().unwrap().uid;
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_groups.insert(contents.uid);
+    open_layer(&mut h, a);
+    (h, a, b, rect)
+}
+
+fn contents_names(h: &Harness<'_, EffectcraftApp>, l: u64) -> Vec<String> {
+    h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("contents").unwrap().groups().map(|g| g.name.clone()).collect()
+}
+
+/// #959: every item in a shape layer's Contents has an eye switch, as in After Effects; it turns
+/// the item off (the renderer skips it), undoably. The group's Transform has none.
+#[test]
+fn shape_contents_items_have_eye_switches() {
+    let (mut h, a, _, rect) = two_shape_layers();
+    let enabled = |h: &Harness<'_, EffectcraftApp>| {
+        h.state().session.active_comp().unwrap().layer(LayerId(a)).unwrap().props.sub("contents").unwrap().find_group(rect).unwrap().enabled
+    };
+    let eye = format!("timeline.group.{rect}.eye");
+    assert!(enabled(&h));
+    click(&mut h, &eye);
+    assert!(!enabled(&h), "the eye turns Rectangle 1 off");
+    click(&mut h, &eye);
+    assert!(enabled(&h), "and on again");
+    click(&mut h, &eye);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert!(enabled(&h), "one undo step");
+    // Inside the group: its path and fill have eyes, its Transform doesn't.
+    h.state_mut().ui.timeline.open_groups.insert(rect);
+    h.run_steps(3);
+    let group = h.state().session.active_comp().unwrap().layer(LayerId(a)).unwrap().props.find_group(rect).unwrap().clone();
+    let transform = group.sub("transform").expect("a shape group has a Transform").uid;
+    assert!(h.state().auto.find(&format!("timeline.group.{transform}.eye")).is_none(), "no eye on Transform");
+    let items = group.sub("contents").expect("the group's items").groups().map(|g| g.uid).collect::<Vec<_>>();
+    assert!(!items.is_empty() && items.iter().all(|u| h.state().auto.find(&format!("timeline.group.{u}.eye")).is_some()), "every item has an eye");
+}
+
+#[test]
+fn ctrl_c_and_ctrl_v_copy_a_shape_group_into_another_shape_layer() {
+    let (mut h, a, b, rect) = two_shape_layers();
+    click(&mut h, &format!("timeline.group.{rect}.name"));
+    assert_eq!(h.state().session.state.selected_props, vec![(LayerId(a), rect)]);
+    h.input_mut().events.push(Event::Copy);
+    h.step();
+    click(&mut h, &format!("timeline.layer.{b}.row"));
+    assert_eq!(h.state().session.state.selected_layers, vec![LayerId(b)]);
+    h.input_mut().events.push(Event::Paste("EffectCraft: 1 shape item".into()));
+    h.run_steps(3);
+    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 2, "no new layer");
+    assert_eq!(contents_names(&h, b), ["Rectangle 1", "Ellipse 1"]);
+    assert_eq!(contents_names(&h, a), ["Rectangle 1"]);
+}
+
+#[test]
+fn ctrl_d_duplicates_the_selected_shape_group_in_its_layer() {
+    let (mut h, a, _, rect) = two_shape_layers();
+    click(&mut h, &format!("timeline.group.{rect}.name"));
+    h.input_mut().events.push(Event::Key { key: Key::D, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
+    h.run_steps(3);
+    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 2, "no new layer");
+    assert_eq!(contents_names(&h, a), ["Rectangle 2", "Rectangle 1"]);
+}
+
+#[test]
+fn toolbar_stroke_edits_the_selected_shape_layer() {
+    let mut s = session();
+    let l = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
+    let mut h = harness(s);
+    // The Selection tool is active: the options show for the selected shape layer.
+    click(&mut h, "header.strokeWidth");
+    h.input_mut().events.push(Event::Text("4".into()));
+    h.step();
+    h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let width = layer.props.prop("contents/group/contents/stroke/width").map(|p| p.value.as_f64());
+    assert_eq!(width, Some(4.0), "a stroke was added with the toolbar's width");
+    assert_eq!(h.state().session.state.shape_tool.stroke_width, 4.0);
+}
+
+/// Issue #633: a colour property in the Timeline (a shape's Fill Color) has an eyedropper after
+/// its swatch, as in After Effects: click it, then click in the Composition panel to sample.
+#[test]
+fn timeline_colour_eyedropper_samples_the_comp() {
+    let mut s = session();
+    s.execute("layer.newSolid", json!({"name": "Back", "color": "#20c040"})).unwrap();
+    let l = s.execute("layer.newShape", json!({"kind": "rect", "fill": [1.0, 0.0, 0.0], "size": [100.0, 60.0]})).unwrap()["layer"].as_u64().unwrap();
+    let layer = s.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let mut fill = None;
+    layer.props.walk("", &mut |_, p| {
+        if fill.is_none() && matches!(p.value, effectcraft_engine::keyframe::Value::Color(_)) {
+            fill = Some(p.uid);
+        }
+    });
+    let fill = fill.expect("a fill colour");
+    fn groups(g: &effectcraft_engine::project::PropGroup, out: &mut Vec<u64>) {
+        for c in g.groups() {
+            // The rectangle's path rows would push Fill below the rows the Timeline fits; the
+            // eyedropper only needs Fill, so leave that group collapsed.
+            if c.name == "Rectangle Path 1" {
+                continue;
+            }
+            out.push(c.uid);
+            groups(c, out);
+        }
+    }
+    let mut open = vec![];
+    groups(&layer.props, &mut open);
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_groups.extend(open);
+    open_layer(&mut h, l);
+    settle(&mut h);
+    click(&mut h, &format!("timeline.prop.{fill}.eyedropper"));
+    assert_eq!(h.state().ui.fx_pick.as_ref().map(|p| (p.prop, p.kind.as_str())), Some((fill, "color")), "the eyedropper waits for a viewer click");
+    let pos = effectcraft_ui_egui::panels::viewer::comp_to_screen(&h.ctx, [6.0, 6.0]).unwrap();
+    click_at(&mut h, pos);
+    assert!(h.state().ui.fx_pick.is_none(), "the pick is used up");
+    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
+    let mut got = None;
+    layer.props.walk("", &mut |_, p| {
+        if p.uid == fill {
+            got = Some(p.value.clone());
+        }
+    });
+    let Some(effectcraft_engine::keyframe::Value::Color(c)) = got else { panic!("{got:?}") };
+    let want = [0x20 as f64 / 255.0, 0xc0 as f64 / 255.0, 0x40 as f64 / 255.0];
+    for k in 0..3 {
+        assert!((c[k] - want[k]).abs() < 0.02, "{c:?} vs {want:?}");
+    }
+}
+
+/// Ctrl+V with SVG markup on the system clipboard pastes it as a shape layer (After Effects
+/// 26.3), even with layers on the app's clipboard: copying in the app replaces the system
+/// clipboard, so the SVG was copied later (#738).
+#[test]
+fn ctrl_v_pastes_svg_markup_as_a_shape_layer() {
+    let (mut h, a, b, _) = two_shape_layers();
+    click(&mut h, &format!("timeline.layer.{b}.row"));
+    h.input_mut().events.push(Event::Copy);
+    h.step();
+    assert_eq!(h.state().session.state.clipboard.len(), 1, "a layer on the app's clipboard");
+    let svg = r##"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><circle cx="10" cy="10" r="8" fill="#00ff00"/><rect x="20" width="20" height="20"/></svg>"##;
+    h.input_mut().events.push(Event::Paste(svg.into()));
+    h.run_steps(3);
+    let c = h.state().session.active_comp().unwrap().clone();
+    assert_eq!(c.layers.len(), 3, "{:?}", h.state().ui.status);
+    let top = &c.layers[0];
+    assert!(top.id != LayerId(a) && top.id != LayerId(b));
+    assert_eq!(top.name, "Shape Layer 3");
+    assert_eq!(top.props.sub("contents").unwrap().groups().count(), 2);
+    assert_eq!(h.state().session.state.selected_layers, vec![top.id]);
+    // The app's own clipboard note pastes the copied layer as before.
+    h.input_mut().events.push(Event::Paste("EffectCraft: 1 layer".into()));
+    h.run_steps(3);
+    let c = h.state().session.active_comp().unwrap();
+    assert_eq!(c.layers.len(), 4);
+    assert_eq!(c.layers[0].name, "Oval 2");
+}
+
+fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, cancel: bool) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    for k in 1..=8 {
+        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (k as f32 / 8.0)));
+        h.step();
+    }
+    if cancel {
+        h.input_mut().events.push(Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(3);
+}
+
+/// #2210: an effect's row drags to a new place in the layer's effect stack, as in After Effects
+/// (not a marquee); Escape cancels the drag.
+#[test]
+fn effects_drag_to_a_new_place_in_the_timeline() {
+    let mut s = session();
+    let l = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    for fx in ["Gaussian Blur", "Invert", "Tint"] {
+        s.execute("effect.apply", json!({"layers": [l], "effect": fx})).unwrap();
+    }
+    let effects = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("effects").unwrap().clone();
+    let uids: Vec<u64> = effects.groups().map(|g| g.uid).collect();
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_groups.insert(effects.uid);
+    open_layer(&mut h, l);
+    let names = |h: &Harness<'_, EffectcraftApp>| -> Vec<String> {
+        h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("effects").unwrap().groups().map(|g| g.name.clone()).collect()
+    };
+    let row = |h: &Harness<'_, EffectcraftApp>, uid: u64| {
+        let e = h.state().auto.find(&format!("timeline.group.{uid}.name")).unwrap_or_else(|| panic!("no row for {uid}"));
+        egui::Rect::from_min_size(pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3]))
+    };
+    // Tint above Gaussian Blur.
+    let (tint, blur) = (row(&h, uids[2]), row(&h, uids[0]));
+    drag(&mut h, tint.center(), pos2(blur.center().x, blur.min.y + 2.0), true);
+    assert_eq!(names(&h), ["Gaussian Blur", "Invert", "Tint"], "Escape cancels");
+    drag(&mut h, tint.center(), pos2(blur.center().x, blur.min.y + 2.0), false);
+    assert_eq!(names(&h), ["Tint", "Gaussian Blur", "Invert"]);
+    // Gaussian Blur (now second) below Invert, the last.
+    let (blur, invert) = (row(&h, uids[0]), row(&h, uids[1]));
+    drag(&mut h, blur.center(), pos2(invert.center().x, invert.max.y - 2.0), false);
+    assert_eq!(names(&h), ["Tint", "Invert", "Gaussian Blur"]);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(names(&h), ["Tint", "Gaussian Blur", "Invert"], "one undo step per drop");
+}
+
+/// #2552: Shift-clicking effect rows in the Timeline adds them to the selection (and a second
+/// Shift-click takes one out), so one animation preset can hold several effects.
+#[test]
+fn shift_click_selects_several_effects_for_a_preset() {
+    let mut s = session();
+    let l = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
+    for fx in ["Gaussian Blur", "Invert"] {
+        s.execute("effect.apply", json!({"layers": [l], "effect": fx})).unwrap();
+    }
+    let effects = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("effects").unwrap().clone();
+    let uids: Vec<u64> = effects.groups().map(|g| g.uid).collect();
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_groups.insert(effects.uid);
+    open_layer(&mut h, l);
+    let shift_click = |h: &mut Harness<'_, EffectcraftApp>, uid: u64| {
+        let p = center(h, &format!("timeline.group.{uid}.name"));
+        h.input_mut().events.push(Event::ModifiersChanged(Modifiers::SHIFT));
+        h.input_mut().events.push(Event::PointerMoved(p));
+        h.step();
+        for pressed in [true, false] {
+            h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed, modifiers: Modifiers::SHIFT });
+            h.step();
+        }
+        h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
+        h.run_steps(2);
+    };
+    let selected = |h: &Harness<'_, EffectcraftApp>| h.state().session.state.selected_props.iter().map(|(_, u)| *u).collect::<Vec<_>>();
+    click(&mut h, &format!("timeline.group.{}.name", uids[0]));
+    assert_eq!(selected(&h), [uids[0]]);
+    shift_click(&mut h, uids[1]);
+    assert_eq!(selected(&h), [uids[0], uids[1]], "Shift adds the second effect");
+    let path = std::env::temp_dir().join(format!("ec-2552-{}.ffx", std::process::id()));
+    let r = h.state_mut().session.execute("anim.savePreset", json!({"path": path.to_string_lossy()})).unwrap();
+    assert_eq!(r["effects"], 2, "{r}");
+    let _ = std::fs::remove_file(&path);
+    shift_click(&mut h, uids[1]);
+    assert_eq!(selected(&h), [uids[0]], "a second Shift-click takes it out");
+}
+
+/// #2513: the Text group's Animate menu adds Animator 1 with the chosen property (and a Range
+/// Selector), and the animator's Add menu adds another property to it.
+#[test]
+fn text_animate_menu_adds_an_animator_with_the_property() {
+    let mut s = session();
+    let l = s.execute("layer.newText", json!({"text": "Hello"})).unwrap()["layer"].as_u64().unwrap();
+    let text = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("text").unwrap().uid;
+    let mut h = harness(s);
+    h.state_mut().ui.timeline.open_groups.insert(text);
+    open_layer(&mut h, l);
+    // The Properties panel's Position row has the same accessible name: take the menu's new entry.
+    let shown: Vec<_> = h.query_all_by_label("Position").map(|n| n.rect()).collect();
+    click(&mut h, &format!("timeline.group.{text}.animate"));
+    let entry = h.query_all_by_label("Position").map(|n| n.rect()).find(|r| !shown.contains(r)).expect("the Animate menu's Position entry");
+    click_at(&mut h, entry.center());
+    let animators = |h: &Harness<'_, EffectcraftApp>| {
+        h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("text").unwrap().sub("animators").cloned()
+    };
+    let anims = animators(&h).expect("an Animators group");
+    let a = anims.groups().next().expect("Animator 1");
+    let has = |a: &effectcraft_engine::project::PropGroup, m: &str| a.sub("properties").is_some_and(|p| p.children.iter().any(|c| c.match_id() == m));
+    assert!(has(a, "position"), "Position was added: {:?}", a.sub("properties"));
+    assert!(a.sub("selectors").is_some_and(|s| !s.children.is_empty()), "with a Range Selector");
+    // The animator's Add menu adds a property to it.
+    h.state_mut().ui.timeline.open_groups.insert(anims.uid);
+    h.state_mut().ui.timeline.open_groups.insert(a.uid);
+    h.run_steps(2);
+    click(&mut h, &format!("timeline.group.{}.add", a.uid));
+    let entry = h.get_by_label("Property: Opacity").rect();
+    click_at(&mut h, entry.center());
+    let a = animators(&h).unwrap().groups().next().unwrap().clone();
+    assert!(has(&a, "opacity"), "Opacity was added: {:?}", a.sub("properties"));
+}
+
+/// Both creation commands must expose editable widgets while preserving Position and the drawing panel's focus.
+#[test]
+fn mask_reveal_created_controls_are_editable_without_leaving_the_viewer() {
+    for command in ["layer.addMask", "mask.new"] {
+        let mut s = session();
+        let layer = s.execute("layer.newSolid", json!({"name": "Plate"})).unwrap()["layer"].as_u64().unwrap();
+        let position = s.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("transform/position").unwrap().uid;
+        let mut h = harness(s);
+        h.state_mut().ui.timeline.layer_reveal.insert(layer, vec!["position".into()]);
+        h.state_mut().ui.focused = effectcraft_ui_egui::dock::PanelKind::Composition;
+        let ctx = h.ctx.clone();
+        let result =
+            effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, command, json!({"layer": layer, "vertices": [[10, 10], [50, 10], [50, 40]]})).unwrap();
+        let mask = result["mask"].as_u64().unwrap();
+        h.run_steps(3);
+        let feather = h.state().session.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("masks/#1/feather").unwrap().uid;
+        assert!(h.state().auto.find(&format!("timeline.group.{mask}.name")).is_some());
+        assert!(h.state().auto.find(&format!("timeline.prop.{position}.value.0")).is_some());
+        assert_eq!(h.state().ui.focused, effectcraft_ui_egui::dock::PanelKind::Composition);
+        click(&mut h, &format!("timeline.prop.{feather}.value.0"));
+        h.input_mut().events.push(Event::Text("12".into()));
+        h.step();
+        h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        h.run_steps(3);
+        assert_eq!(h.state().session.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.find(feather).unwrap().value.components(), [12.0, 12.0]);
+    }
+}
diff --git a/crates/ui-egui/tests/ui_timeline_switches.rs b/crates/ui-egui/tests/it/ui_timeline_switches.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_timeline_switches.rs
rename to crates/ui-egui/tests/it/ui_timeline_switches.rs
diff --git a/crates/ui-egui/tests/ui_timeline_trim.rs b/crates/ui-egui/tests/it/ui_timeline_trim.rs
similarity index 88%
rename from crates/ui-egui/tests/ui_timeline_trim.rs
rename to crates/ui-egui/tests/it/ui_timeline_trim.rs
index d66bf5b7a..6f95f744f 100644
--- a/crates/ui-egui/tests/ui_timeline_trim.rs
+++ b/crates/ui-egui/tests/it/ui_timeline_trim.rs
@@ -119,3 +119,17 @@ fn dragging_bar_ends_trims_in_and_out() {
     let (i, o, s) = timing(&h, pre);
     assert!((i - 3.0).abs() < 1e-6 && (o - 8.0).abs() < 1.5 / 30.0 && s.abs() < 1e-6, "out extended to ~8 s, not slipped: in {i} out {o} start {s}");
 }
+
+/// With Frames and Frame Count Start at 1, In moves to 00061 but the Duration column still counts
+/// the layer's 120 frames (#1807).
+#[test]
+fn duration_column_counts_frames_from_any_frame_count() {
+    let (mut h, solid, _) = harness();
+    effectcraft_ui_egui::panels::timeline::set_column(&mut h.state_mut().ui.timeline, "in", true).unwrap();
+    effectcraft_ui_egui::panels::timeline::set_column(&mut h.state_mut().ui.timeline, "duration", true).unwrap();
+    h.state_mut().session.execute("file.projectSettings", json!({"timeDisplay": "frames", "frameStart": 1})).unwrap();
+    h.run_steps(3);
+    let cell = |h: &Harness<'_, EffectcraftApp>, kind: &str| h.state().auto.find(&format!("timeline.layer.{solid}.{kind}")).expect("cell").label.clone();
+    assert_eq!(cell(&h, "in"), "00061");
+    assert_eq!(cell(&h, "duration"), "00120");
+}
diff --git a/crates/ui-egui/tests/ui_timeline_zoom.rs b/crates/ui-egui/tests/it/ui_timeline_zoom.rs
similarity index 76%
rename from crates/ui-egui/tests/ui_timeline_zoom.rs
rename to crates/ui-egui/tests/it/ui_timeline_zoom.rs
index 5f731e118..76f55740a 100644
--- a/crates/ui-egui/tests/ui_timeline_zoom.rs
+++ b/crates/ui-egui/tests/it/ui_timeline_zoom.rs
@@ -30,7 +30,13 @@ fn over_bar(h: &Harness<'_, EffectcraftApp>, layer: u64) -> Pos2 {
 fn alt_wheel(h: &mut Harness<'_, EffectcraftApp>, at: Pos2, dy: f32) {
     h.event(Event::PointerMoved(at));
     h.event(Event::ModifiersChanged(Modifiers::ALT));
-    h.event(Event::MouseWheel { unit: MouseWheelUnit::Point, delta: vec2(0.0, dy), modifiers: Modifiers::ALT, phase: egui::TouchPhase::Move });
+    h.event(Event::MouseWheel {
+        unit: MouseWheelUnit::Point,
+        delta: vec2(0.0, dy),
+        modifiers: Modifiers::ALT,
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
     h.step();
     h.event(Event::ModifiersChanged(Modifiers::NONE));
     h.step();
@@ -78,7 +84,13 @@ fn ctrl_wheel_and_pinch_zoom_time() {
     let at = over_bar(&h, layer);
     h.event(Event::PointerMoved(at));
     h.event(Event::ModifiersChanged(Modifiers::COMMAND));
-    h.event(Event::MouseWheel { unit: MouseWheelUnit::Point, delta: vec2(0.0, 240.0), modifiers: Modifiers::COMMAND, phase: egui::TouchPhase::Move });
+    h.event(Event::MouseWheel {
+        unit: MouseWheelUnit::Point,
+        delta: vec2(0.0, 240.0),
+        modifiers: Modifiers::COMMAND,
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
     h.step();
     h.event(Event::ModifiersChanged(Modifiers::NONE));
     h.step();
@@ -364,6 +376,122 @@ fn dragging_out_of_the_marker_bin_adds_a_comp_marker() {
     assert_eq!(markers(&h), vec![13.0, 20.0]);
 }
 
+/// #1826: as in After Effects, a double-click on the composition marker bin adds a composition
+/// marker at the current time, one undo step; a single click adds none, and a marker dragged
+/// out of the bin still lands where it is dropped.
+#[test]
+fn double_clicking_the_marker_bin_adds_a_comp_marker_at_the_current_time() {
+    let (mut h, _) = harness();
+    h.state_mut().ui.timeline.pps = Some(200.0);
+    h.state_mut().ui.timeline.start = 10.0;
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.state_mut().session.execute("time.set", json!({"time": 21.5})).unwrap();
+    h.run_steps(2);
+    let markers = |h: &Harness<'_, EffectcraftApp>| -> Vec<f64> { h.state().session.active_comp().unwrap().markers.iter().map(|m| m.time.seconds()).collect() };
+    let bin = rect(&h, "timeline.markerBin");
+    let ruler = rect(&h, "timeline.ruler");
+    // Presses and releases in one frame each, so a pair falls inside egui's double-click time.
+    let clicks = |h: &mut Harness<'_, EffectcraftApp>, n: usize| {
+        h.event(Event::PointerMoved(bin.center()));
+        h.step();
+        for _ in 0..n {
+            for pressed in [true, false] {
+                h.input_mut().events.push(Event::PointerButton {
+                    pos: bin.center(),
+                    button: egui::PointerButton::Primary,
+                    pressed,
+                    modifiers: Modifiers::NONE,
+                });
+            }
+        }
+        h.step();
+        h.run_steps(3);
+    };
+    clicks(&mut h, 1);
+    assert!(markers(&h).is_empty(), "a single click: {:?}", markers(&h));
+    let undo = h.state().session.history.undo.len();
+    clicks(&mut h, 2);
+    assert_eq!(markers(&h), vec![21.5], "at the current time");
+    let s = &h.state().session;
+    assert_eq!(s.active_comp().unwrap().markers[0].time, s.time(), "exactly the current time");
+    let history = &h.state().session.history.undo;
+    assert_eq!((history.len(), history.last().map(|u| u.0.as_str())), (undo + 1, Some("Add Marker")), "one undo step");
+    assert_eq!(h.state().session.time().seconds(), 21.5, "the current time stays");
+    // The second press in one frame and its release in the next (a frame here is 0.25 s, inside
+    // egui's 0.3 s double-click time): the bin is dragged by then, and still a marker at 22 s.
+    h.state_mut().session.execute("time.set", json!({"time": 22.0})).unwrap();
+    h.event(Event::PointerMoved(bin.center()));
+    h.step();
+    for pressed in [true, false, true] {
+        h.input_mut().events.push(Event::PointerButton { pos: bin.center(), button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.step();
+    assert!(h.ctx.dragged_id().is_some(), "the second press drags the bin");
+    h.event(Event::PointerButton { pos: bin.center(), button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.step();
+    h.run_steps(3);
+    assert_eq!(markers(&h), vec![21.5, 22.0], "a double-click released while the bin is dragged");
+    // A click on the ruler right beside the bin and then one on the bin, in one frame: egui
+    // takes them for a double-click (they are a few points apart), but only one was on the bin.
+    let (beside, on) = (pos2(bin.min.x - 2.0, bin.center().y), pos2(bin.min.x + 2.0, bin.center().y));
+    assert!(ruler.contains(beside) && !bin.contains(beside) && bin.contains(on));
+    h.event(Event::PointerMoved(beside));
+    h.step();
+    for (pos, pressed) in [(beside, true), (beside, false), (on, true), (on, false)] {
+        h.input_mut().events.push(Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.step();
+    h.run_steps(3);
+    assert_eq!(markers(&h), vec![21.5, 22.0], "one click beside the bin and one on it");
+    // On the bin, beside it, on it again: the two in a row are never both on the bin.
+    h.run_steps(3);
+    for pos in [on, beside, on] {
+        for pressed in [true, false] {
+            h.input_mut().events.push(Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        }
+    }
+    h.step();
+    h.run_steps(3);
+    assert_eq!(markers(&h), vec![21.5, 22.0], "on, beside, on");
+    // Twice pressed beside the bin and released on it, a few points away: clicks, not on the bin.
+    h.run_steps(3);
+    for _ in 0..2 {
+        for (pos, pressed) in [(beside, true), (on, false)] {
+            h.input_mut().events.push(Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        }
+    }
+    h.step();
+    h.run_steps(3);
+    assert_eq!(markers(&h), vec![21.5, 22.0], "pressed beside, released on");
+    // Dragged out 3 s into the visible span (from 10 s at 200 px/s): a marker at 13 s too.
+    drag(&mut h, bin.center(), pos2(ruler.min.x + 6.0 + 600.0, ruler.center().y));
+    assert_eq!(markers(&h), vec![13.0, 21.5, 22.0]);
+}
+
+/// A marker dragged out of the bin and dropped within one frame (a fast drag, or a slow frame)
+/// still lands where it is dropped: the bin starts its drag as soon as it is pressed.
+#[test]
+fn a_marker_dragged_out_of_the_bin_and_dropped_in_one_frame_is_added() {
+    let (mut h, _) = harness();
+    h.state_mut().ui.timeline.pps = Some(200.0);
+    h.state_mut().ui.timeline.start = 10.0;
+    h.run_steps(2);
+    let bin = rect(&h, "timeline.markerBin");
+    let ruler = rect(&h, "timeline.ruler");
+    let at = pos2(ruler.min.x + 6.0 + 600.0, ruler.center().y);
+    h.event(Event::PointerMoved(bin.center()));
+    h.step();
+    h.event(Event::PointerButton { pos: bin.center(), button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.step();
+    // Both in one frame (`event` would give each a frame of its own).
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.input_mut().events.push(Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.step();
+    h.run_steps(2);
+    let markers: Vec<f64> = h.state().session.active_comp().unwrap().markers.iter().map(|m| m.time.seconds()).collect();
+    assert_eq!(markers, vec![13.0]);
+}
+
 /// #976: as in After Effects, Numpad * marks the selected layers at the current time; only with
 /// no layer selected does it add a composition marker.
 #[test]
diff --git a/crates/ui-egui/tests/ui_toolbar_gradient.rs b/crates/ui-egui/tests/it/ui_toolbar_gradient.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_toolbar_gradient.rs
rename to crates/ui-egui/tests/it/ui_toolbar_gradient.rs
diff --git a/crates/ui-egui/tests/ui_tracker.rs b/crates/ui-egui/tests/it/ui_tracker.rs
similarity index 100%
rename from crates/ui-egui/tests/ui_tracker.rs
rename to crates/ui-egui/tests/it/ui_tracker.rs
diff --git a/crates/ui-egui/tests/it/ui_unreadable_footage.rs b/crates/ui-egui/tests/it/ui_unreadable_footage.rs
new file mode 100644
index 000000000..21ca1e7c9
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_unreadable_footage.rs
@@ -0,0 +1,200 @@
+//! Footage (or the proxy in use for it) whose codec the decoders lack says so: a warning marker in
+//! the Project panel and a notice on the layer in the Composition viewer, instead of a black
+//! picture with no reason.
+
+use std::sync::Arc;
+
+use effectcraft_engine::Session;
+use effectcraft_engine::project::{Footage, FootageKind, ItemId, ItemKind, Proxy};
+use effectcraft_engine::render::FootageSource;
+use effectcraft_render::Image;
+use effectcraft_time::Tick;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui_kittest::Harness;
+use serde_json::json;
+
+const WHY: &str = "H.264 (High 4:2:2) isn't supported by the built-in decoder: chroma_format_idc 2 (only 4:2:0 is implemented)";
+
+/// A source that decodes nothing and says why for the files `broken` picks.
+struct Stub(fn(&Footage) -> bool);
+
+impl FootageSource for Stub {
+    fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
+        None
+    }
+    fn problem(&self, f: &Footage) -> Option<String> {
+        (self.0)(f).then(|| WHY.to_string())
+    }
+}
+
+fn harness(broken: fn(&Footage) -> bool, proxy: Option<Footage>) -> (Harness<'static, EffectcraftApp>, ItemId) {
+    let mut s = Session { footage: Arc::new(Stub(broken)), ..Default::default() };
+    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+    let footage = Footage {
+        kind: FootageKind::Video,
+        path: "clip.mp4".into(),
+        width: 64,
+        height: 36,
+        has_video: true,
+        duration: Tick::from_seconds_f64(2.0),
+        ..Default::default()
+    };
+    let p = std::sync::Arc::make_mut(&mut s.project);
+    let clip = p.add_item("Clip", Default::default(), None, ItemKind::Footage(footage));
+    if let (Some(item), Some(footage)) = (p.items.get_mut(&clip), proxy) {
+        item.proxy = Some(Box::new(Proxy { footage, enabled: true }));
+    }
+    s.execute("layer.addItem", json!({"item": clip.0})).unwrap();
+    (open(s), clip)
+}
+
+fn open(mut s: Session) -> Harness<'static, EffectcraftApp> {
+    s.execute("project.select", json!({"items": []})).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(4);
+    h
+}
+
+#[test]
+fn undecodable_footage_is_marked_in_the_project_panel_and_the_viewer() {
+    let (h, clip) = harness(|_| true, None);
+    let marker = h.state().auto.find(&format!("project.item.{}.problem", clip.0)).expect("a warning on the footage item").clone();
+    assert!(marker.label.contains("4:2:2"), "{marker:?}");
+    let notice = h.state().auto.query("viewer.footageProblem.").first().copied().expect("a notice in the viewer").clone();
+    assert!(notice.label.contains(WHY), "{notice:?}");
+}
+
+#[test]
+fn readable_footage_has_no_notice() {
+    let (h, clip) = harness(|_| false, None);
+    assert!(h.state().auto.find(&format!("project.item.{}.problem", clip.0)).is_none());
+    assert!(h.state().auto.query("viewer.footageProblem.").is_empty());
+}
+
+/// The clip's own file is fine, but the proxy in use for it can't be decoded: the item and the
+/// layer say why, and that it is the proxy.
+#[test]
+fn an_undecodable_proxy_in_use_is_marked_as_the_proxy() {
+    let proxy = Footage { kind: FootageKind::Video, path: "clip_proxy.avi".into(), width: 32, height: 18, has_video: true, ..Default::default() };
+    let (h, clip) = harness(|f| f.path.ends_with(".avi"), Some(proxy));
+    let marker = h.state().auto.find(&format!("project.item.{}.problem", clip.0)).expect("a warning on the footage item").clone();
+    assert!(marker.label.starts_with("Proxy: ") && marker.label.contains("4:2:2"), "{marker:?}");
+    let notice = h.state().auto.query("viewer.footageProblem.").first().copied().expect("a notice in the viewer").clone();
+    assert!(notice.label.contains(&format!("Proxy: {WHY}")), "{notice:?}");
+}
+
+/// A precomp whose proxy can't be decoded: the layer says so with Collapse Transformations off
+/// or on, since a proxy in use keeps the precomp on the flattened path that draws the proxy.
+#[test]
+fn a_precomp_with_an_undecodable_proxy_has_a_notice_collapsed_or_not() {
+    for collapse in [false, true] {
+        let mut s = Session { footage: Arc::new(Stub(|f| f.path.ends_with(".avi"))), ..Default::default() };
+        s.execute("comp.new", json!({"name": "Inner", "width": 64, "height": 36, "duration": 4})).unwrap();
+        s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
+        let p = Arc::make_mut(&mut s.project);
+        let inner = p.items.values_mut().find(|i| i.name == "Inner").unwrap();
+        let proxy = Footage { kind: FootageKind::Video, path: "inner_proxy.avi".into(), width: 64, height: 36, has_video: true, ..Default::default() };
+        inner.proxy = Some(Box::new(Proxy { footage: proxy, enabled: true }));
+        let inner = inner.id;
+        s.execute("layer.addItem", json!({"item": inner.0})).unwrap();
+        s.execute("layer.setSwitch", json!({"layers": ["#1"], "switch": "collapse", "value": collapse})).unwrap();
+        let h = open(s);
+        assert!(!h.state().auto.query("viewer.footageProblem.").is_empty(), "collapse {collapse}");
+    }
+}
+
+#[test]
+fn missing_footage_marks_project_timeline_and_viewer_and_clears_after_recovery() {
+    let (mut h, clip) = harness(|_| false, None);
+    let set_missing = |h: &mut Harness<'static, EffectcraftApp>, missing| {
+        let item = Arc::make_mut(&mut h.state_mut().session.project).item_mut(clip).unwrap();
+        let ItemKind::Footage(f) = &mut item.kind else { panic!("footage fixture") };
+        f.missing = missing;
+    };
+    set_missing(&mut h, true);
+    h.run_steps(2);
+    assert!(h.state().auto.find(&format!("project.item.{}.problem", clip.0)).unwrap().label.contains("Missing footage"));
+    assert_eq!(h.state().auto.query("timeline.layer.").iter().filter(|e| e.id.ends_with(".problem")).count(), 1);
+    assert!(!h.state().auto.query("viewer.footageProblem.").is_empty());
+    set_missing(&mut h, false);
+    h.run_steps(2);
+    assert!(h.state().auto.find(&format!("project.item.{}.problem", clip.0)).is_none());
+    assert!(h.state().auto.query("timeline.layer.").iter().all(|e| !e.id.ends_with(".problem")));
+    assert!(h.state().auto.query("viewer.footageProblem.").is_empty());
+}
+
+#[test]
+fn missing_original_with_working_proxy_warns_inventory_without_a_viewer_failure() {
+    let proxy = Footage { path: "proxy.png".into(), has_video: true, width: 32, height: 18, ..Default::default() };
+    let (mut h, clip) = harness(|_| false, Some(proxy));
+    if let ItemKind::Footage(f) = &mut Arc::make_mut(&mut h.state_mut().session.project).item_mut(clip).unwrap().kind {
+        f.missing = true;
+    }
+    h.run_steps(2);
+    assert!(h.state().auto.find(&format!("project.item.{}.problem", clip.0)).unwrap().label.contains("clip.mp4"));
+    assert!(h.state().auto.query("viewer.footageProblem.").is_empty(), "the active proxy still supplies the preview");
+}
+
+#[test]
+fn missing_active_proxy_explains_the_proxy_repair_action() {
+    let proxy = Footage { path: "lost_proxy.png".into(), missing: true, has_video: true, width: 32, height: 18, ..Default::default() };
+    let (h, clip) = harness(|_| false, Some(proxy));
+    let marker = h.state().auto.find(&format!("project.item.{}.problem", clip.0)).unwrap();
+    assert!(marker.label.starts_with("Proxy:") && marker.label.contains("Set Proxy"));
+    assert!(h.state().auto.query("viewer.footageProblem.").iter().any(|e| e.label.contains("lost_proxy.png")));
+}
+
+#[test]
+fn restored_original_and_active_proxy_render_new_pixels_through_media_and_disk_caches() {
+    use effectcraft_engine::render::RenderOpts;
+    for proxy in [false, true] {
+        let dir = std::env::temp_dir().join(format!("ec-offline-pixels-{}-{proxy}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let original = dir.join("original.png");
+        image::RgbaImage::from_pixel(16, 16, image::Rgba([255, 0, 0, 255])).save(&original).unwrap();
+        let mut s = effectcraft_host::session();
+        s.prefs.import.auto_reload_footage = "off".into();
+        let item = s.execute("file.import", json!({"paths": [original], "sequence": false})).unwrap()["items"][0].as_u64().unwrap();
+        let active = if proxy {
+            let path = dir.join("proxy.png");
+            image::RgbaImage::from_pixel(16, 16, image::Rgba([0, 255, 0, 255])).save(&path).unwrap();
+            s.execute("file.setProxy", json!({"item": item, "path": path})).unwrap();
+            path
+        } else {
+            original
+        };
+        let inner = s.execute("comp.new", json!({"name": "Media", "width": 16, "height": 16, "duration": 1})).unwrap()["comp"].as_u64().unwrap();
+        s.execute("layer.addItem", json!({"item": item})).unwrap();
+        // A zero-echo identity effect reads the real layer-input cache, including for proxies.
+        s.execute("effect.apply", json!({"layer": "#1", "effect": "Echo"})).unwrap();
+        s.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/numberOfEchoes", "value": 0})).unwrap();
+        s.execute("prop.set", json!({"layer": "#1", "path": "effects/#1/echoOperator", "value": 4})).unwrap();
+        s.execute("comp.new", json!({"name": "Output", "width": 16, "height": 16, "duration": 1})).unwrap();
+        s.execute("layer.addItem", json!({"item": inner})).unwrap();
+        let comp = s.active_comp_id().unwrap();
+        let cache = effectcraft_render::disk_cache::DiskCache::open(dir.join("cache"), 1 << 20).unwrap();
+        cache.set_min_layer_ms(0);
+        s.disk_cache = Some(cache.clone());
+        s.layer_cache.set_disk(Some(cache.clone()));
+        let before = s.render(comp, Tick::ZERO, RenderOpts::default());
+        assert_eq!(before.data[8 * 16 + 8], if proxy { [0.0, 1.0, 0.0, 1.0] } else { [1.0, 0.0, 0.0, 1.0] });
+        cache.flush();
+        assert!(cache.stats().entries > 0, "the first render populated the disk cache");
+        s.layer_cache.clear();
+        let cached = s.render(comp, Tick::ZERO, RenderOpts::default());
+        assert_eq!(cached.data, before.data);
+        assert!(cache.stats().hits > 0, "the same media was read back through the disk cache");
+        std::fs::remove_file(&active).unwrap();
+        assert_eq!(s.execute("footage.reloadChanged", json!({})).unwrap()["reloaded"], 0, "availability alone drives recovery in this fixture");
+        let offline = s.render(comp, Tick::ZERO, RenderOpts::default());
+        assert_eq!(offline.data[8 * 16 + 8], [0.0, 0.0, 0.0, 0.0]);
+        image::RgbaImage::from_pixel(16, 16, image::Rgba([0, 0, 255, 255])).save(&active).unwrap();
+        assert_eq!(s.execute("footage.reloadChanged", json!({})).unwrap()["reloaded"], 0, "availability alone drives recovery in this fixture");
+        let restored = s.render(comp, Tick::ZERO, RenderOpts::default());
+        assert_eq!(restored.data[8 * 16 + 8], [0.0, 0.0, 1.0, 1.0], "restored pixels replace decoded and composited cached frames");
+        cache.flush();
+        drop(cache);
+        drop(s);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/crates/ui-egui/tests/ui_video_preview_off.rs b/crates/ui-egui/tests/it/ui_video_preview_off.rs
similarity index 90%
rename from crates/ui-egui/tests/ui_video_preview_off.rs
rename to crates/ui-egui/tests/it/ui_video_preview_off.rs
index e27a37c29..37a35f856 100644
--- a/crates/ui-egui/tests/ui_video_preview_off.rs
+++ b/crates/ui-egui/tests/it/ui_video_preview_off.rs
@@ -21,7 +21,7 @@ fn an_audio_only_preview_says_video_preview_is_off() {
     s.prefs.preview.get_mut(sc).include_video = false;
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| EffectcraftApp::new(s));
     h.run_steps(4);
-    let chip = |h: &Harness<'_, EffectcraftApp>| h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::new("viewer-video-off-chip")));
+    let chip = |h: &Harness<'_, EffectcraftApp>| h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::unique("viewer-video-off-chip")));
     assert!(chip(&h).is_none());
     let now = h.ctx.input(|i| i.time);
     h.state_mut().play(now);
@@ -30,7 +30,7 @@ fn an_audio_only_preview_says_video_preview_is_off() {
     assert!(chip(&h).is_some(), "the viewer shows the Video-off notice");
     assert_eq!(frame(&h), 0, "the current time stays put with Video off");
     h.state_mut().stop();
-    h.ctx.data_mut(|d| d.remove::<egui::Rect>(egui::Id::new("viewer-video-off-chip")));
+    h.ctx.data_mut(|d| d.remove::<egui::Rect>(egui::Id::unique("viewer-video-off-chip")));
     h.run_steps(3);
     assert!(h.state().video_preview_off().is_none());
     assert!(chip(&h).is_none(), "no notice once stopped");
diff --git a/crates/ui-egui/tests/ui_viewer.rs b/crates/ui-egui/tests/it/ui_viewer.rs
similarity index 76%
rename from crates/ui-egui/tests/ui_viewer.rs
rename to crates/ui-egui/tests/it/ui_viewer.rs
index 2a9162a59..e01608e16 100644
--- a/crates/ui-egui/tests/ui_viewer.rs
+++ b/crates/ui-egui/tests/it/ui_viewer.rs
@@ -2,6 +2,7 @@
 //! interest drawing, rulers and guides, snapping, the shape Pen and motion-path key drags
 //! (egui_kittest, UI logic only).
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::commands::shape_tool::PaintKind;
 use effectcraft_engine::project::LayerId;
@@ -53,6 +54,65 @@ fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
     h.run_steps(2);
 }
 
+/// #1218: frame stepping is optional, and consumes the whole wheel gesture including its
+/// smoothed tail. Ctrl/Cmd+wheel still zooms.
+#[test]
+fn mouse_wheel_over_the_monitor_scrubs_frames() {
+    let mut h = harness();
+    h.state_mut().session.execute("prefs.set", json!({"key": "general.viewerWheelScrubbing", "value": true})).unwrap();
+    let p = rect(&h, "viewer.area").center();
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    let t0 = h.state().session.time();
+    let line = |dy: f32, modifiers: egui::Modifiers| Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Line,
+        delta: vec2(0.0, dy),
+        modifiers,
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    };
+    let z0 = h.state().ui.viewer.zoom;
+    h.input_mut().events.push(line(1.0, egui::Modifiers::NONE));
+    h.step();
+    let t1 = h.state().session.time();
+    for _ in 0..20 {
+        assert_eq!(h.state().ui.viewer.zoom, z0, "frame wheel must never zoom");
+        h.step();
+    }
+    assert!(t1 > t0, "wheel up advanced the playhead ({t0:?} -> {t1:?})");
+    h.input_mut().events.push(line(-2.0, egui::Modifiers::NONE));
+    h.step();
+    assert!(h.state().session.time() < t1, "two lines back moves before the single line forward");
+    let z0 = h.state().ui.viewer.zoom;
+    let t2 = h.state().session.time();
+    let mods = egui::Modifiers { ctrl: true, command: true, ..Default::default() };
+    h.input_mut().events.push(line(3.0, mods));
+    h.step();
+    assert_eq!(h.state().session.time(), t2, "Ctrl+wheel must not scrub");
+    assert_ne!(h.state().ui.viewer.zoom, z0, "Ctrl+wheel still zooms");
+}
+
+#[test]
+fn mouse_wheel_zooms_by_default_without_stepping_frames() {
+    let mut h = harness();
+    assert!(!h.state().session.prefs.general.viewer_wheel_scrubbing);
+    let p = rect(&h, "viewer.area").center();
+    h.input_mut().events.push(Event::PointerMoved(p));
+    h.step();
+    let t0 = h.state().session.time();
+    let z0 = h.state().ui.viewer.zoom;
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Line,
+        delta: vec2(0.0, 1.0),
+        modifiers: egui::Modifiers::NONE,
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
+    h.run_steps(20);
+    assert_eq!(h.state().session.time(), t0);
+    assert_ne!(h.state().ui.viewer.zoom, z0);
+}
+
 /// Comp pixel → screen point.
 fn screen(h: &Harness<'_, EffectcraftApp>, p: [f32; 2]) -> Pos2 {
     let c = rect(h, "viewer.comp");
@@ -193,7 +253,8 @@ fn each_comp_keeps_its_viewer_resolution() {
     assert_eq!(h.state().viewer_res(), Resolution::Auto);
     let (req, _reply) = effectcraft_ui_egui::control::ControlRequest::new("ui.set", json!({"viewer": {"res": "quarter"}}));
     let ctx = h.ctx.clone();
-    let _ = effectcraft_ui_egui::control::handle(h.state_mut(), &ctx, &req);
+    let now = h.state().now();
+    let _ = effectcraft_ui_egui::control::handle(h.state_mut(), &ctx, &req, now);
     assert_eq!(h.state().viewer_res(), Resolution::Quarter);
     let ctx = h.ctx.clone();
     assert_eq!(effectcraft_ui_egui::control::inspect(h.state(), &ctx)["ui"]["viewer"]["res"], json!("Quarter"));
@@ -220,6 +281,7 @@ fn bottom_bar_in_after_effects_order() {
     let order = [
         "viewer.magnification",
         "viewer.resolution",
+        "viewer.fastPreviews",
         "viewer.transparency",
         "viewer.masks",
         "viewer.roi",
@@ -229,7 +291,6 @@ fn bottom_bar_in_after_effects_order() {
         "viewer.exposure",
         "viewer.snapshot",
         "viewer.showSnapshot",
-        "viewer.fastPreviews",
         "viewer.timecode",
     ];
     let xs: Vec<f32> = order.iter().map(|id| rect(&h, id).min.x).collect();
@@ -359,6 +420,42 @@ fn layer_drag_snaps_to_other_layers_edges_ctrl_toggles_and_options_apply() {
     assert!(!snapped(p), "edges not extended: {p:?}");
 }
 
+/// #2855: a dragged layer's edge midpoints snap to another layer's on both axes, side by side and
+/// stacked, with Snap Edges Extended on and off.
+#[test]
+fn layer_drag_snaps_to_other_layers_midpoints() {
+    let mut h = harness();
+    let box_id = h.state().session.active_comp().unwrap().layers[0].id;
+    // A 100×100 target at x 450–550, y 50–150, centre (500, 100).
+    let target = h.state_mut().session.execute("layer.newSolid", json!({"name": "Target", "color": "#20e040", "width": 100, "height": 100})).unwrap()["layer"]
+        .as_u64()
+        .unwrap();
+    // Grab the 80×80 box (at x 60–140, y 210–290) by the feature at `grab` and take that feature
+    // to `to`: returns where the box's centre lands.
+    let drop = |h: &mut Harness<'_, EffectcraftApp>, grab: [f32; 2], to: [f32; 2]| {
+        let s = &mut h.state_mut().session;
+        s.execute("prop.set", json!({"layer": target, "path": "transform/position", "value": [500, 100, 0]})).unwrap();
+        s.execute("prop.set", json!({"layer": box_id.0, "path": "transform/position", "value": [100, 250, 0]})).unwrap();
+        s.execute("edit.deselectAll", json!({})).unwrap();
+        h.run_steps(2);
+        let (from, to) = (screen(h, grab), screen(h, to));
+        hold_drag(h, from, to, Default::default());
+        let l = h.state().session.active_comp().unwrap().layer(box_id).unwrap().clone();
+        let p = l.props.prop("transform/position").unwrap().value.as_vec3();
+        [p[0], p[1]]
+    };
+    let near = |p: [f64; 2], x: f64, y: f64| (p[0] - x).abs() < 0.01 && (p[1] - y).abs() < 0.01;
+    for extended in [true, false] {
+        h.state_mut().session.execute("view.snappingOptions", json!({"edgesExtended": extended})).unwrap();
+        // Side by side: the box's left midpoint onto the target's right midpoint (550, 100).
+        let p = drop(&mut h, [60.5, 250.0], [553.0, 102.0]);
+        assert!(near(p, 590.0, 100.0), "left to right midpoint, extended {extended}: {p:?}");
+        // Stacked: the box's top midpoint onto the target's bottom midpoint (500, 150).
+        let p = drop(&mut h, [100.0, 210.5], [502.0, 153.0]);
+        assert!(near(p, 500.0, 190.0), "top to bottom midpoint, extended {extended}: {p:?}");
+    }
+}
+
 /// With a shape layer selected the Rectangle tool draws a new group into its Contents (After
 /// Effects' behaviour); with nothing selected it draws a new shape layer (#227).
 #[test]
@@ -447,7 +544,7 @@ fn mid_drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2, mods: egu
         h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
         h.step();
     }
-    h.render().expect("the mid-drag frame")
+    h.render_serialized().expect("the mid-drag frame")
 }
 
 /// Release the button where the drag left it.
@@ -481,14 +578,15 @@ fn fill_rgb(h: &Harness<'_, EffectcraftApp>) -> [u8; 3] {
 fn shape_drag_ghost_shows_the_tools_own_shape_while_dragging() {
     let (from, to) = ([140.0, 100.0], [400.0, 300.0]);
     let centre = [270.0, 200.0];
-    // 6 comp px inside the box's top-left corner: inside a rectangle, outside every other kind.
-    let corner = [146.0, 106.0];
+    // 4 comp px inside the box's top-left corner: inside a rectangle, outside every other kind
+    // (a rounded corner of 20 px arcs past this point).
+    let corner = [144.0, 104.0];
     for (tool, fills_corner) in [(Tool::Rectangle, true), (Tool::RoundedRect, false), (Tool::Ellipse, false), (Tool::Polygon, false), (Tool::Star, false)] {
         let mut h = harness();
         h.state_mut().ui.tool = tool;
         settle_viewer(&mut h);
         let (a, b) = (screen(&h, from), screen(&h, to));
-        let before = h.render().expect("the frame before the drag");
+        let before = h.render_serialized().expect("the frame before the drag");
         let mid = mid_drag(&mut h, a, b, egui::Modifiers::default());
         let fill = fill_rgb(&h);
 
@@ -524,7 +622,7 @@ fn shape_drag_ghost_normalises_the_same_way_as_the_release() {
         h.state_mut().ui.tool = Tool::Ellipse;
         settle_viewer(&mut h);
         let (a, b) = (screen(&h, from.map(|v| v as f32)), screen(&h, to.map(|v| v as f32)));
-        let before = h.render().expect("the frame before the drag");
+        let before = h.render_serialized().expect("the frame before the drag");
         // Measured with the button down, so this is the ghost and not the committed shape.
         let mid = mid_drag(&mut h, a, b, mods);
         let on = [centre[0] as f32 + size[0] as f32 / 4.0, centre[1] as f32 + size[1] as f32 / 4.0];
@@ -593,7 +691,7 @@ fn a_layer_drag_moves_the_picture_while_the_button_is_down() {
     h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
     h.step();
     // Where the layer is not (yet): the plate behind it.
-    let plate = px_at(&h.render().unwrap(), &h, [440.0, 200.0]);
+    let plate = px_at(&h.render_serialized().unwrap(), &h, [440.0, 200.0]);
 
     // Drag in small steps, still holding the button, and give the renders a chance to land.
     let mut moved = false;
@@ -604,7 +702,7 @@ fn a_layer_drag_moves_the_picture_while_the_button_is_down() {
         std::thread::sleep(std::time::Duration::from_millis(15));
         // 30 comp px behind the pointer: inside the layer, well away from its outline, its anchor
         // icon and where it started.
-        let at = px_at(&h.render().expect("mid-drag frame"), &h, [320.0 + 200.0 * (i as f32 / 40.0) - 30.0, 200.0]);
+        let at = px_at(&h.render_serialized().expect("mid-drag frame"), &h, [320.0 + 200.0 * (i as f32 / 40.0) - 30.0, 200.0]);
         if i >= 30 && delta(at, plate) > 30 {
             moved = true;
             break;
@@ -759,6 +857,144 @@ fn path_editing_hides_layer_bounds_and_keeps_corner_vertices_editable() {
     }
 }
 
+/// #1769: the eye hides a layer's pixels, not the controls of a selected AV layer: a hidden shape
+/// layer keeps its transform box, anchor and shape path, and its handles still scale it.
+#[test]
+fn hidden_shape_layer_keeps_its_controls_and_can_still_scale() {
+    let mut h = harness();
+    let (layer, path) = {
+        let r = h
+            .state_mut()
+            .session
+            .execute(
+                "shape.newPath",
+                json!({
+                    "vertices": [[200.0, 100.0], [400.0, 100.0], [400.0, 260.0], [200.0, 260.0]],
+                    "closed": true,
+                    "fill": false,
+                    "stroke": "#ffffff",
+                    "strokeWidth": 4
+                }),
+            )
+            .unwrap();
+        (r["layer"].as_u64().unwrap(), r["path"].as_u64().unwrap())
+    };
+    h.state_mut().session.execute("layer.select", json!({"layers": [layer]})).unwrap();
+    h.state_mut().session.state.selected_vertices.clear();
+    h.state_mut().session.execute("layer.setSwitch", json!({"layers": [layer], "switch": "video", "value": false})).unwrap();
+    h.run_steps(2);
+    let shown = h.state().session.active_comp().unwrap().layer(LayerId(layer)).unwrap().clone();
+    assert!(!shown.switches.video);
+    assert!(shown.source.is_av());
+    assert_eq!(h.state().session.state.selected_layers, vec![LayerId(layer)]);
+    assert!(h.state().auto.find(&format!("viewer.handle.{layer}.0")).is_some(), "a hidden shape keeps its transform box");
+    assert!(h.state().auto.find(&format!("viewer.anchor.{layer}")).is_some(), "and its anchor");
+    assert!(h.state().auto.find(&format!("viewer.shapePath.{path}.vertex.0")).is_some(), "and its shape path");
+    let scale = |h: &Harness<'_, EffectcraftApp>| {
+        h.state().session.active_comp().unwrap().layer(LayerId(layer)).unwrap().props.prop("transform/scale").unwrap().value.as_vec3()
+    };
+    let before = scale(&h);
+    let from = rect(&h, &format!("viewer.handle.{layer}.5")).center();
+    drag(&mut h, from, from + vec2(24.0, 0.0));
+    assert_ne!(scale(&h), before, "a hidden layer's handle still scales it");
+}
+
+/// #1964: Shift-dragging a selected mask vertex keeps it to the axis it moves along most, as a
+/// Shift-dragged layer does; without Shift it moves freely.
+#[test]
+fn shift_drag_keeps_a_mask_vertex_to_one_axis() {
+    let mut h = harness();
+    let plate = layer_id(&h, "Plate");
+    let corners = [[100.0, 60.0], [500.0, 60.0], [500.0, 300.0], [100.0, 300.0]];
+    let mask = {
+        let s = &mut h.state_mut().session;
+        s.execute("layer.select", json!({"layers": [plate]})).unwrap();
+        let m = s.execute("mask.new", json!({"layer": plate, "vertices": corners, "closed": true})).unwrap()["mask"].as_u64().unwrap();
+        s.execute("mask.selectVertices", json!({"vertices": [{"layer": plate, "mask": m, "index": 0}]})).unwrap();
+        m
+    };
+    h.run_steps(2);
+    let vertex = format!("viewer.mask.{mask}.vertex.0");
+    let before = mask_path(&h, "Plate").vertices[0];
+    let from = rect(&h, &vertex).center();
+    drag_path(&mut h, &[from, from + vec2(30.0, 8.0)], egui::Modifiers::SHIFT);
+    let shifted = mask_path(&h, "Plate").vertices[0];
+    assert!(shifted[0] > before[0], "it moved along x: {before:?} -> {shifted:?}");
+    assert_eq!(shifted[1], before[1], "and not along y");
+    let from = rect(&h, &vertex).center();
+    drag_path(&mut h, &[from, from + vec2(30.0, 8.0)], egui::Modifiers::NONE);
+    let free = mask_path(&h, "Plate").vertices[0];
+    assert!(free[0] > shifted[0] && free[1] > shifted[1], "without Shift both axes move: {shifted:?} -> {free:?}");
+}
+
+/// #999: a mask vertex dragged against the edge of the Composition panel pans the view, and the
+/// vertex keeps moving while the pointer is held there, as in After Effects.
+#[test]
+fn a_vertex_held_at_the_viewer_edge_pans_the_view() {
+    let mut h = harness();
+    let plate = layer_id(&h, "Plate");
+    let corners = [[100.0, 60.0], [500.0, 60.0], [500.0, 300.0], [100.0, 300.0]];
+    let mask = {
+        let s = &mut h.state_mut().session;
+        s.execute("layer.select", json!({"layers": [plate]})).unwrap();
+        let m = s.execute("mask.new", json!({"layer": plate, "vertices": corners, "closed": true})).unwrap()["mask"].as_u64().unwrap();
+        s.execute("mask.selectVertices", json!({"vertices": [{"layer": plate, "mask": m, "index": 0}]})).unwrap();
+        m
+    };
+    h.run_steps(2);
+    let pan0 = h.state().ui.viewer.pan;
+    let from = rect(&h, &format!("viewer.mask.{mask}.vertex.0")).center();
+    let edge = pos2(2.0, from.y);
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.step();
+    for i in 1..=6 {
+        h.input_mut().events.push(Event::PointerMoved(from + (edge - from) * (i as f32 / 6.0)));
+        h.step();
+    }
+    let reached = mask_path(&h, "Plate").vertices[0];
+    for _ in 0..20 {
+        h.step();
+    }
+    h.input_mut().events.push(Event::PointerButton { pos: edge, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    let pan = h.state().ui.viewer.pan;
+    assert!(pan[0] > pan0[0] && pan[1] == pan0[1], "the view panned right to show more on the left: {pan0:?} -> {pan:?}");
+    let after = mask_path(&h, "Plate").vertices[0];
+    assert!(after[0] < reached[0], "the vertex kept moving left with the view: {reached:?} -> {after:?}");
+    // Back inside the view, nothing pans.
+    let still = h.state().ui.viewer.pan;
+    let mid = rect(&h, "viewer.comp").center();
+    drag(&mut h, mid, mid + vec2(5.0, 0.0));
+    assert_eq!(h.state().ui.viewer.pan, still);
+}
+
+/// #1769: a hidden masked layer keeps its mask path and vertices, and they remain editable.
+#[test]
+fn hidden_masked_layer_keeps_its_mask_path_editable() {
+    let mut h = harness();
+    let plate = layer_id(&h, "Plate");
+    let corners = [[100.0, 60.0], [500.0, 60.0], [500.0, 300.0], [100.0, 300.0]];
+    let mask = {
+        let s = &mut h.state_mut().session;
+        s.execute("layer.select", json!({"layers": [plate]})).unwrap();
+        let m = s.execute("mask.new", json!({"layer": plate, "vertices": corners, "closed": true})).unwrap()["mask"].as_u64().unwrap();
+        s.state.selected_vertices.clear();
+        s.execute("layer.setSwitch", json!({"layers": [plate], "switch": "video", "value": false})).unwrap();
+        m
+    };
+    h.run_steps(2);
+    assert!(h.state().auto.find(&format!("viewer.handle.{plate}.0")).is_some(), "a hidden masked layer keeps its transform box");
+    let vertex = format!("viewer.mask.{mask}.vertex.0");
+    assert!(h.state().auto.find(&vertex).is_some(), "and its mask path");
+    let before = mask_path(&h, "Plate");
+    let from = rect(&h, &vertex).center();
+    drag(&mut h, from, from + vec2(15.0, 12.0));
+    let after = mask_path(&h, "Plate");
+    assert_ne!(after.vertices[0], before.vertices[0], "the hidden layer's mask vertex can still be moved");
+    assert_eq!(after.vertices[1..], before.vertices[1..]);
+}
+
 #[test]
 fn path_tools_keep_bounds_on_layers_without_visible_paths() {
     let mut h = harness();
@@ -1457,6 +1693,42 @@ fn puppet_pins_go_on_the_deformed_mesh_and_the_tool_stays_on_the_rigged_layer()
     assert!(!rigged(&h, plate));
 }
 
+/// #2865: a press where the deformed layer is empty, though on its original bounds, adds nothing:
+/// a click leaves the rig alone and a drag from there is a pin marquee.
+#[test]
+fn puppet_press_where_the_deformed_layer_is_empty_is_a_marquee_not_a_copy() {
+    let mut h = harness();
+    let s = &mut h.state_mut().session;
+    s.execute("edit.clear", json!({"layers": ["Plate"]})).unwrap();
+    s.execute("layer.select", json!({"layers": ["Box"]})).unwrap();
+    let id = s.state.selected_layers[0].0;
+    let a = s.execute("puppet.addPin", json!({"layer": id, "position": [10, 40]})).unwrap()["pin"].as_u64().unwrap();
+    let b = s.execute("puppet.addPin", json!({"layer": id, "position": [70, 40]})).unwrap()["pin"].as_u64().unwrap();
+    // Carry the Box 60 px right: its left part (comp x 280..340) is now empty.
+    s.execute("puppet.movePin", json!({"layer": id, "pin": a, "position": [70, 40]})).unwrap();
+    s.execute("puppet.movePin", json!({"layer": id, "pin": b, "position": [130, 40]})).unwrap();
+    h.state_mut().ui.tool = Tool::Puppet;
+    h.run_steps(3);
+    let rig = |h: &mut Harness<'_, EffectcraftApp>| {
+        let info = h.state_mut().session.execute("puppet.info", json!({"layer": id})).unwrap();
+        let meshes = info["meshes"].as_array().unwrap().clone();
+        (meshes.len(), meshes.iter().map(|m| m["pins"].as_array().unwrap().len()).sum::<usize>())
+    };
+    let at = screen(&h, [285.0, 180.0]);
+    click(&mut h, at);
+    assert_eq!(rig(&mut h), (1, 2), "the click made nothing");
+    let comp = rect(&h, "viewer.comp");
+    drag(&mut h, at, comp.max - vec2(4.0, 4.0));
+    assert_eq!(rig(&mut h), (1, 2), "nor did the drag");
+    let mut sel: Vec<u64> = h.state().session.state.selected_props.iter().map(|(_, u)| *u).collect();
+    sel.sort();
+    assert_eq!(sel, [a, b], "the drag's marquee selected the pins");
+    // On the deformed shape a click still pins it.
+    let at = screen(&h, [380.0, 180.0]);
+    click(&mut h, at);
+    assert_eq!(rig(&mut h), (1, 3));
+}
+
 /// Filled circles painted this frame (flattening nested shape lists).
 fn circles(h: &Harness<'_, EffectcraftApp>) -> Vec<egui::epaint::CircleShape> {
     fn walk(s: &egui::Shape, out: &mut Vec<egui::epaint::CircleShape>) {
@@ -1571,6 +1843,66 @@ fn middle_and_hand_drags_pan_the_viewer_and_the_pan_stays_after_release() {
     assert!((end[0] - after[0] + 50.0).abs() < 1.0 && (end[1] - after[1] + 30.0).abs() < 1.0, "{after:?} → {end:?}");
 }
 
+/// #2854: a middle-drag over a layer pans the view and leaves the layer alone, selected or not,
+/// with any tool, and adds no undo step.
+#[test]
+fn middle_drag_over_a_layer_pans_and_leaves_the_layer_where_it_is() {
+    let mut h = harness();
+    let id = layer_named(&h, "Box");
+    let c = rect(&h, "viewer.comp").center();
+    for (select, tool) in [(false, Tool::Selection), (true, Tool::Selection), (true, Tool::Rotate), (true, Tool::Type)] {
+        let selection = if select { json!({"layers": [id.0]}) } else { json!({"layers": []}) };
+        h.state_mut().session.execute("layer.select", selection).unwrap();
+        h.state_mut().ui.tool = tool;
+        h.state_mut().ui.viewer.pan = [0.0, 0.0];
+        h.run_steps(2);
+        let (p0, steps) = (position_of(&h, id), h.state().session.history.undo.len());
+        drag_with(&mut h, egui::PointerButton::Middle, c, c + vec2(120.0, 60.0));
+        let pan = h.state().ui.viewer.pan;
+        assert!((pan[0] - 120.0).abs() < 1.0 && (pan[1] - 60.0).abs() < 1.0, "{select} {tool:?}: {pan:?}");
+        assert_eq!(position_of(&h, id), p0, "{select} {tool:?}: the layer stays");
+        assert_eq!(h.state().session.history.undo.len(), steps, "{select} {tool:?}: no undo step");
+    }
+}
+
+/// #2854: a left drag whose release the viewer never saw (the panel wasn't drawn on that frame)
+/// leaves its move gesture stored. A middle press must not run it.
+#[test]
+fn middle_drag_does_not_run_a_gesture_left_over_from_a_missed_release() {
+    let mut h = harness();
+    let id = layer_named(&h, "Box");
+    h.state_mut().session.execute("layer.select", json!({"layers": [id.0]})).unwrap();
+    h.run_steps(2);
+    let c = rect(&h, "viewer.comp").center();
+    let p = egui::PointerButton::Primary;
+    h.input_mut().events.push(Event::PointerMoved(c));
+    h.input_mut().events.push(Event::PointerButton { pos: c, button: p, pressed: true, modifiers: Default::default() });
+    h.step();
+    for i in 1..=4 {
+        h.input_mut().events.push(Event::PointerMoved(c + vec2(10.0 * i as f32, 0.0)));
+        h.step();
+    }
+    let ctx = h.ctx.clone();
+    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.openLayer", json!({"layer": id.0})).unwrap();
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: c + vec2(40.0, 0.0), button: p, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.state_mut().show_panel(effectcraft_ui_egui::dock::PanelKind::Composition);
+    h.run_steps(3);
+    let c = rect(&h, "viewer.comp").center();
+    let p0 = position_of(&h, id);
+    drag_with(&mut h, egui::PointerButton::Middle, c, c + vec2(120.0, 60.0));
+    assert_eq!(position_of(&h, id), p0, "the stored move didn't run");
+}
+
+fn layer_named(h: &Harness<'_, EffectcraftApp>, name: &str) -> LayerId {
+    h.state().session.active_comp().unwrap().layers.iter().find(|l| l.name == name).unwrap().id
+}
+
+fn position_of(h: &Harness<'_, EffectcraftApp>, id: LayerId) -> [f64; 3] {
+    h.state().session.active_comp().unwrap().layer(id).unwrap().props.prop("transform/position").unwrap().value.as_vec3()
+}
+
 /// A Spacebar press or release (`repeat`: the keyboard's auto-repeat while it is held).
 fn space(h: &mut Harness<'_, EffectcraftApp>, pressed: bool, repeat: bool) {
     h.input_mut().events.push(Event::Key { key: egui::Key::Space, physical_key: None, pressed, repeat, modifiers: Default::default() });
@@ -1649,7 +1981,7 @@ fn timeline_rows_drag_to_reorder_layers() {
     assert_eq!(h.state().session.history.undo.len(), steps + 1);
     // Dropping a layer where it already is changes nothing.
     let b = row(&h, "Box").center();
-    drag(&mut h, b, b + vec2(0.0, 3.0));
+    drag(&mut h, b, b + vec2(20.0, 0.0));
     assert_eq!(names(&h), ["Plate", "Box"]);
     assert_eq!(h.state().session.history.undo.len(), steps + 1);
     // And back to the top.
@@ -1658,6 +1990,335 @@ fn timeline_rows_drag_to_reorder_layers() {
     assert_eq!(names(&h), ["Box", "Plate"]);
 }
 
+fn timeline_layer_order(h: &Harness<'_, EffectcraftApp>) -> Vec<u64> {
+    h.state().session.active_comp().unwrap().layers.iter().map(|l| l.id.0).collect()
+}
+
+fn timeline_layer_row(h: &Harness<'_, EffectcraftApp>, layer: u64) -> Rect {
+    rect(h, &format!("timeline.layer.{layer}.row"))
+}
+
+fn start_timeline_row_drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(from));
+    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.step();
+    h.input_mut().events.push(Event::PointerMoved(from + vec2(20.0, 0.0)));
+    h.step();
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing, "the row drag started");
+}
+
+fn release_timeline_row_drag(h: &mut Harness<'_, EffectcraftApp>, at: Pos2) {
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.step();
+    h.input_mut().events.push(Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+fn scroll_timeline(h: &mut Harness<'_, EffectcraftApp>, dy: f32) {
+    let at = rect(h, "timeline.layerMarquee").center();
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, dy),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
+    h.run_steps(20);
+}
+
+/// Wheel-scroll far enough to stop drawing the row that owns the held drag, then drop at
+/// the other end of the stack. The release must work without that row's Response (#2492).
+fn timeline_reorder_after_scroll(down: bool, multiple: bool) {
+    let mut h = harness();
+    for i in 0..38 {
+        h.state_mut().session.execute("layer.newSolid", json!({"name": format!("Layer {i}"), "color": "#406080", "width": 80, "height": 80})).unwrap();
+    }
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.run_steps(3);
+    let before = timeline_layer_order(&h);
+    let count = if multiple { 2 } else { 1 };
+    let moving = if down { before[..count].to_vec() } else { before[before.len() - count..].to_vec() };
+    if multiple {
+        h.state_mut().session.execute("layer.select", json!({"layers": moving})).unwrap();
+        h.run_steps(2);
+    }
+    if !down {
+        scroll_timeline(&mut h, -10_000.0);
+    }
+    let origin = if down { before[0] } else { *before.last().unwrap() };
+    let from = timeline_layer_row(&h, origin).center();
+    // Setup fills the bounded Undo history; reserve room to count this gesture's steps.
+    h.state_mut().session.history.clear();
+    let steps = h.state().session.history.undo.len();
+    start_timeline_row_drag(&mut h, from);
+    scroll_timeline(&mut h, if down { -10_000.0 } else { 10_000.0 });
+    assert!(h.state().auto.find(&format!("timeline.layer.{origin}.row")).is_none(), "the origin row was culled");
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing, "scrolling keeps the held drag active");
+    let target = if down { *before.last().unwrap() } else { before[0] };
+    let row = timeline_layer_row(&h, target);
+    let to = row.center() + vec2(0.0, row.height() * if down { 0.4 } else { -0.4 });
+    release_timeline_row_drag(&mut h, to);
+
+    let mut expected: Vec<u64> = before.iter().copied().filter(|id| !moving.contains(id)).collect();
+    let at = if down { expected.len() } else { 0 };
+    expected.splice(at..at, moving);
+    assert_eq!(timeline_layer_order(&h), expected, "the offscreen origin still completes its drop");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1, "one reorder, including a selected group, is one undo step");
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing, "release clears the drag feedback");
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(timeline_layer_order(&h), before);
+    h.state_mut().session.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(timeline_layer_order(&h), expected);
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.run_steps(3);
+
+    // A later, independent drag must not reuse the old gesture or selected group.
+    let i = if down { expected.len() - 1 } else { 0 };
+    let j = if down { i - 1 } else { 1 };
+    let from = timeline_layer_row(&h, expected[i]).center();
+    let row = timeline_layer_row(&h, expected[j]);
+    drag(&mut h, from, row.center() + vec2(0.0, row.height() * if down { -0.4 } else { 0.4 }));
+    expected.swap(i, j);
+    assert_eq!(timeline_layer_order(&h), expected, "the next drag is independent");
+    assert_eq!(h.state().session.history.undo.len(), steps + 2);
+}
+
+#[test]
+fn timeline_rows_drag_to_bottom_after_scrolling() {
+    for multiple in [false, true] {
+        timeline_reorder_after_scroll(true, multiple);
+    }
+}
+
+#[test]
+fn timeline_rows_drag_to_top_after_scrolling() {
+    for multiple in [false, true] {
+        timeline_reorder_after_scroll(false, multiple);
+    }
+}
+
+/// An intermediate scroll must not turn the viewport's lower edge into the stack's end.
+fn timeline_reorder_at_viewport_edge(below: bool, multiple: bool) {
+    let mut h = harness();
+    for i in 0..38 {
+        h.state_mut().session.execute("layer.newSolid", json!({"name": format!("Layer {i}"), "color": "#406080", "width": 80, "height": 80})).unwrap();
+    }
+    h.state_mut().session.execute("edit.deselectAll", json!({})).unwrap();
+    h.run_steps(3);
+    let before = timeline_layer_order(&h);
+    let moving = before[..if multiple { 2 } else { 1 }].to_vec();
+    h.state_mut().session.execute("layer.select", json!({"layers": moving})).unwrap();
+    h.run_steps(2);
+    h.state_mut().session.history.clear();
+    let from = timeline_layer_row(&h, moving[0]).center();
+    start_timeline_row_drag(&mut h, from);
+    scroll_timeline(&mut h, -200.0);
+    let visible = |h: &Harness<'_, EffectcraftApp>| {
+        before.iter().copied().filter(|id| h.state().auto.find(&format!("timeline.layer.{id}.row")).is_some()).collect::<Vec<_>>()
+    };
+    // Leave space inside the viewport below the last rendered layer's midpoint.
+    for _ in 0..20 {
+        let last = timeline_layer_row(&h, *visible(&h).last().unwrap());
+        if last.center().y < rect(&h, "timeline.layerMarquee").max.y - 3.0 {
+            break;
+        }
+        scroll_timeline(&mut h, -10.0);
+    }
+    let shown = visible(&h);
+    assert!(!shown.contains(&moving[0]), "the drag owner is culled");
+    let last = *shown.last().unwrap();
+    assert_ne!(last, *before.last().unwrap(), "layers remain below the viewport");
+    let row = timeline_layer_row(&h, last);
+    let viewport = rect(&h, "timeline.layerMarquee");
+    let y = if below { (row.center().y + row.height() * 0.4).min(viewport.max.y - 1.0) } else { row.min.y + row.height() * 0.2 };
+    let to = pos2(row.center().x, y);
+    assert!(viewport.contains(to));
+    assert_eq!(to.y > row.center().y, below);
+    let mut expected: Vec<u64> = before.iter().copied().filter(|id| !moving.contains(id)).collect();
+    let at = expected.iter().position(|id| *id == last).unwrap() + usize::from(below);
+    expected.splice(at..at, moving);
+    release_timeline_row_drag(&mut h, to);
+    assert_eq!(timeline_layer_order(&h), expected, "the drop follows the indicated row boundary");
+    assert_eq!(h.state().session.history.undo.len(), 1);
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(timeline_layer_order(&h), before);
+    h.state_mut().session.execute("edit.redo", json!({})).unwrap();
+    assert_eq!(timeline_layer_order(&h), expected);
+}
+
+#[test]
+fn timeline_rows_drag_after_last_visible_row() {
+    for multiple in [false, true] {
+        timeline_reorder_at_viewport_edge(true, multiple);
+    }
+}
+
+#[test]
+fn timeline_rows_drag_before_last_visible_row() {
+    for multiple in [false, true] {
+        timeline_reorder_at_viewport_edge(false, multiple);
+    }
+}
+
+/// A removed ID must not be reinterpreted as a one-based index by layer.arrange.
+fn timeline_reorder_after_deletion(delete_owner: bool) {
+    let mut h = harness();
+    for i in 0..6 {
+        h.state_mut().session.execute("layer.newSolid", json!({"name": format!("Layer {i}"), "color": "#406080", "width": 80, "height": 80})).unwrap();
+    }
+    let before = timeline_layer_order(&h);
+    let removed = *before.last().unwrap();
+    assert!(removed > 0 && removed < before.len() as u64, "the missing ID would also resolve as a surviving layer index");
+    let owner = if delete_owner { removed } else { before[0] };
+    let moving = if delete_owner { vec![removed] } else { vec![owner, removed] };
+    h.state_mut().session.execute("layer.select", json!({"layers": moving})).unwrap();
+    h.run_steps(3);
+    h.state_mut().session.history.clear();
+    let from = timeline_layer_row(&h, owner).center();
+    start_timeline_row_drag(&mut h, from);
+    if !delete_owner {
+        // Changing the selection does not change the group captured by the held drag.
+        h.state_mut().session.execute("layer.select", json!({"layers": [removed]})).unwrap();
+        h.run_steps(2);
+    }
+    key(&mut h, egui::Key::Delete, Default::default());
+    assert!(h.ctx.input(|i| i.pointer.primary_down()), "Delete happened during the held drag");
+    let survivors: Vec<u64> = before.iter().copied().filter(|id| *id != removed).collect();
+    assert_eq!(timeline_layer_order(&h), survivors, "Delete removed only the selected layer");
+    let steps = h.state().session.history.undo.len();
+    let row = timeline_layer_row(&h, survivors[0]);
+    release_timeline_row_drag(&mut h, row.center() - vec2(0.0, row.height() * 0.4));
+    assert_eq!(timeline_layer_order(&h), survivors, "a stale drag cannot move any surviving layer");
+    assert_eq!(h.state().session.history.undo.len(), steps, "release adds no undo step");
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    let from = timeline_layer_row(&h, survivors[0]).center();
+    let row = timeline_layer_row(&h, survivors[1]);
+    drag(&mut h, from, row.center() + vec2(0.0, row.height() * 0.4));
+    let mut expected = survivors;
+    expected.swap(0, 1);
+    assert_eq!(timeline_layer_order(&h), expected, "a later independent drag still works");
+    assert_eq!(h.state().session.history.undo.len(), steps + 1);
+}
+
+#[test]
+fn timeline_rows_drag_cancels_when_the_owner_is_deleted() {
+    timeline_reorder_after_deletion(true);
+}
+
+#[test]
+fn timeline_rows_drag_cancels_when_a_group_member_is_deleted() {
+    timeline_reorder_after_deletion(false);
+}
+
+#[test]
+fn timeline_rows_drag_cancels_without_a_primary_release() {
+    for escape in [false, true] {
+        let mut h = harness();
+        let before = timeline_layer_order(&h);
+        let from = timeline_layer_row(&h, before[0]).center();
+        let row = timeline_layer_row(&h, before[1]);
+        let to = row.center() + vec2(0.0, row.height() * 0.4);
+        let steps = h.state().session.history.undo.len();
+        start_timeline_row_drag(&mut h, from);
+        h.input_mut().events.push(Event::PointerMoved(to));
+        h.step();
+        if escape {
+            key(&mut h, egui::Key::Escape, Default::default());
+        } else {
+            // egui stops its drag on another button's release too. It isn't a layer drop.
+            for pressed in [true, false] {
+                h.input_mut().events.push(Event::PointerButton { pos: to, button: egui::PointerButton::Secondary, pressed, modifiers: Default::default() });
+                h.step();
+            }
+        }
+        assert_eq!(timeline_layer_order(&h), before, "cancellation must not arrange layers");
+        assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+        release_timeline_row_drag(&mut h, to);
+        assert_eq!(timeline_layer_order(&h), before, "a later release must not replay a cancelled drag");
+        assert_eq!(h.state().session.history.undo.len(), steps);
+    }
+}
+
+#[test]
+fn timeline_rows_drag_cancels_when_a_modal_opens() {
+    let mut h = harness();
+    let before = timeline_layer_order(&h);
+    let from = timeline_layer_row(&h, before[0]).center();
+    let row = timeline_layer_row(&h, before[1]);
+    let to = row.center() + vec2(0.0, row.height() * 0.4);
+    let steps = h.state().session.history.undo.len();
+    start_timeline_row_drag(&mut h, from);
+    let (modifiers, shortcut) = effectcraft_ui_egui::menus::parse_shortcut("Cmd+Alt+;").unwrap();
+    key(&mut h, shortcut, modifiers);
+    assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Settings));
+    assert!(!h.ctx.read_response(egui::Id::unique(("row", before[0]))).unwrap().enabled(), "the modal disables the Timeline row");
+    assert!(h.ctx.input(|i| i.pointer.primary_down()), "the modal opened during the held drag");
+    release_timeline_row_drag(&mut h, to);
+    assert_eq!(timeline_layer_order(&h), before, "a release behind the modal must not arrange layers");
+    assert_eq!(h.state().session.history.undo.len(), steps);
+    key(&mut h, egui::Key::Escape, Default::default());
+    assert!(h.state().dialog.is_none());
+    assert_eq!(timeline_layer_order(&h), before, "closing the modal must not replay the drag");
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    let from = timeline_layer_row(&h, before[0]).center();
+    let row = timeline_layer_row(&h, before[1]);
+    drag(&mut h, from, row.center() + vec2(0.0, row.height() * 0.4));
+    assert_eq!(timeline_layer_order(&h), [before[1], before[0]]);
+    assert_eq!(h.state().session.history.undo.len(), steps + 1);
+}
+
+#[test]
+fn timeline_rows_drag_does_not_replay_a_release_while_hidden() {
+    use effectcraft_ui_egui::dock::PanelKind;
+    let mut h = harness();
+    let before = timeline_layer_order(&h);
+    let from = timeline_layer_row(&h, before[0]).center();
+    let steps = h.state().session.history.undo.len();
+    start_timeline_row_drag(&mut h, from);
+    h.state_mut().close_panel(PanelKind::Timeline);
+    h.run_steps(2);
+    assert!(h.state().auto.find("timeline.layerMarquee").is_none());
+    release_timeline_row_drag(&mut h, from);
+    h.state_mut().show_panel(PanelKind::Timeline);
+    h.run_steps(3);
+    assert_eq!(timeline_layer_order(&h), before);
+    assert_eq!(h.state().session.history.undo.len(), steps);
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    let from = timeline_layer_row(&h, before[0]).center();
+    let row = timeline_layer_row(&h, before[1]);
+    drag(&mut h, from, row.center() + vec2(0.0, row.height() * 0.4));
+    assert_eq!(timeline_layer_order(&h), [before[1], before[0]]);
+    assert_eq!(h.state().session.history.undo.len(), steps + 1);
+}
+
+#[test]
+fn timeline_rows_drag_cancels_when_the_composition_changes() {
+    let mut h = harness();
+    let original = h.state().session.active_comp_id().unwrap();
+    let before = timeline_layer_order(&h);
+    h.state_mut().session.execute("comp.new", json!({"name": "Other", "width": 640, "height": 360, "duration": 4})).unwrap();
+    h.state_mut().session.execute("layer.newSolid", json!({"name": "Other layer", "color": "#406080", "width": 80, "height": 80})).unwrap();
+    let other = h.state().session.active_comp_id().unwrap();
+    let other_before = timeline_layer_order(&h);
+    h.state_mut().session.execute("comp.open", json!({"comp": original.0})).unwrap();
+    h.run_steps(3);
+    let from = timeline_layer_row(&h, before[0]).center();
+    let steps = h.state().session.history.undo.len();
+    start_timeline_row_drag(&mut h, from);
+    h.state_mut().session.execute("comp.open", json!({"comp": other.0})).unwrap();
+    h.run_steps(2);
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    release_timeline_row_drag(&mut h, from);
+    assert_eq!(timeline_layer_order(&h), other_before);
+    h.state_mut().session.execute("comp.open", json!({"comp": original.0})).unwrap();
+    h.run_steps(3);
+    assert_eq!(timeline_layer_order(&h), before);
+    assert_eq!(h.state().session.history.undo.len(), steps);
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+}
+
 fn layer_id(h: &Harness<'_, EffectcraftApp>, name: &str) -> u64 {
     h.state().session.active_comp().unwrap().layers.iter().find(|l| l.name == name).unwrap().id.0
 }
@@ -1709,7 +2370,7 @@ fn command_clicking_a_group_twirl_opens_its_whole_tree() {
     // twirls open with it, and closed again with it.
     let mut h = harness();
     let id = layer_id(&h, "Box");
-    h.state_mut().session.execute("effect.apply", json!({"effect": "Lumetri Color", "layers": [id]})).unwrap();
+    h.state_mut().session.execute("effect.apply", json!({"effect": "Color Grading", "layers": [id]})).unwrap();
     fn walk(g: &effectcraft_engine::project::PropGroup, out: &mut Vec<u64>) {
         for sg in g.groups() {
             out.push(sg.uid);
@@ -1802,6 +2463,14 @@ fn key_twice(h: &mut Harness<'_, EffectcraftApp>, k: egui::Key) {
 #[test]
 fn property_shortcuts_reveal_and_key_transform_properties() {
     let mut h = harness();
+    // Reveal shortcuts compare wall-clock instants; drive the app clock so a step count
+    // cannot decide whether a second press is "quick" or a later one.
+    h.state_mut().use_manual_clock();
+    h.run_steps(1);
+    let wait = |h: &mut Harness<'_, EffectcraftApp>| {
+        h.state_mut().clock_mut().advance(1.0);
+        h.run_steps(2);
+    };
     h.state_mut().session.execute("layer.select", json!({"layers": ["Box"]})).unwrap();
     h.run_steps(2);
     let t = |h: &Harness<'_, EffectcraftApp>, p: &str| shown(h, prop_uid(h, "Box", &format!("transform/{p}")));
@@ -1838,16 +2507,16 @@ fn property_shortcuts_reveal_and_key_transform_properties() {
     h.run_steps(2);
     key(&mut h, egui::Key::U, none);
     only(&h, &["opacity"]);
-    h.run_steps(40);
+    wait(&mut h);
     key(&mut h, egui::Key::U, none);
     only(&h, &[]);
     h.state_mut().session.execute("prop.set", json!({"layer": "Box", "path": "transform/rotation", "value": 30})).unwrap();
-    h.run_steps(40);
+    wait(&mut h);
     key_twice(&mut h, egui::Key::U);
     assert!(t(&h, "opacity") && t(&h, "rotation"), "UU: animated and changed properties");
     assert!(!t(&h, "scale"), "an untouched property stays hidden");
     // Ctrl+`: twirl the selected layer open, then closed.
-    h.run_steps(40);
+    wait(&mut h);
     key(&mut h, egui::Key::Backtick, egui::Modifiers::COMMAND);
     let id = layer_id(&h, "Box");
     assert!(h.state().ui.timeline.open_layers.contains(&id) && h.state().ui.timeline.reveal.is_empty());
@@ -1858,6 +2527,14 @@ fn property_shortcuts_reveal_and_key_transform_properties() {
 #[test]
 fn double_press_shortcuts_reveal_their_second_set() {
     let mut h = harness();
+    // Reveal shortcuts compare wall-clock instants; drive the app clock so a step count
+    // cannot decide whether a second press is "quick" or a later one.
+    h.state_mut().use_manual_clock();
+    h.run_steps(1);
+    let wait = |h: &mut Harness<'_, EffectcraftApp>| {
+        h.state_mut().clock_mut().advance(1.0);
+        h.run_steps(2);
+    };
     h.state_mut().session.execute("layer.select", json!({"layers": ["Box"]})).unwrap();
     h.state_mut().session.execute("prop.setExpression", json!({"layer": "Box", "path": "transform/scale", "expression": "value"})).unwrap();
     h.run_steps(2);
@@ -1866,24 +2543,24 @@ fn double_press_shortcuts_reveal_their_second_set() {
     key_twice(&mut h, egui::Key::E);
     assert_eq!(reveal(&h), vec!["expressions"]);
     assert!(shown(&h, prop_uid(&h, "Box", "transform/scale")));
-    h.run_steps(40);
+    wait(&mut h);
     // TT: Mask Opacity; MM: every mask property; a single M: Mask Path.
     key_twice(&mut h, egui::Key::T);
     assert_eq!(reveal(&h), vec!["maskOpacity"]);
-    h.run_steps(40);
+    wait(&mut h);
     key(&mut h, egui::Key::M, Default::default());
     assert_eq!(reveal(&h), vec!["maskPath"]);
-    h.run_steps(40);
+    wait(&mut h);
     key_twice(&mut h, egui::Key::M);
     assert_eq!(reveal(&h), vec!["masks"]);
-    h.run_steps(40);
+    wait(&mut h);
     // RR Time Remap, AA Material Options, PP paint/puppet, SS selected properties, FF missing effects.
     for (k, want) in
         [(egui::Key::R, "timeRemap"), (egui::Key::A, "material"), (egui::Key::P, "paint"), (egui::Key::S, "selected"), (egui::Key::F, "missingEffects")]
     {
         key_twice(&mut h, k);
         assert_eq!(reveal(&h), vec![want], "{k:?}{k:?}");
-        h.run_steps(40);
+        wait(&mut h);
     }
 }
 
@@ -2345,6 +3022,133 @@ fn rotate_tool_counts_revolutions_both_ways() {
     assert_eq!(h.state().session.history.undo.len(), undo_before + 1, "one drag, one undo step");
 }
 
+/// A harness whose Box is a child of Plate (anchor 320,180) with `plate` set on Plate first, at
+/// parent-space position (200, 120). Returns the two layers' ids.
+fn rotate_child_harness(plate: serde_json::Value) -> (Harness<'static, EffectcraftApp>, u64, u64) {
+    let mut h = harness();
+    let (parent, child) = (layer_id(&h, "Plate"), layer_id(&h, "Box"));
+    let s = &mut h.state_mut().session;
+    for (path, value) in plate.as_object().unwrap() {
+        s.execute("prop.set", json!({"layer": parent, "path": format!("transform/{path}"), "value": value})).unwrap();
+    }
+    s.execute("layer.setParent", json!({"layers": [child], "parent": parent, "compensate": false})).unwrap();
+    s.execute("prop.set", json!({"layer": child, "path": "transform/position", "value": [200.0, 120.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [child]})).unwrap();
+    h.state_mut().ui.tool = Tool::Rotate;
+    h.run_steps(2);
+    (h, parent, child)
+}
+
+/// Goes round comp point `pivot` with the Rotation tool, 10° clockwise a frame for 400°, starting
+/// inside the 80 px box to its right. The rotations of `layers` on each frame, from the pointer's
+/// first move on.
+fn rotate_round(h: &mut Harness<'static, EffectcraftApp>, pivot: [f32; 2], layers: &[u64]) -> Vec<Vec<f64>> {
+    let center = screen(h, pivot);
+    let r = (screen(h, [pivot[0] + 30.0, pivot[1]]) - center).x;
+    let at = |deg: f64| center + vec2((deg.to_radians().cos() as f32) * r, (deg.to_radians().sin() as f32) * r);
+    let press = center + vec2(r * 0.3, 0.0);
+    h.input_mut().events.push(Event::PointerMoved(press));
+    h.input_mut().events.push(Event::PointerButton { pos: press, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+    h.step();
+    let mut seen = vec![];
+    for i in 0..=40 {
+        h.input_mut().events.push(Event::PointerMoved(at(i as f64 * 10.0)));
+        h.step();
+        let comp = h.state().session.active_comp().unwrap();
+        seen.push(layers.iter().map(|l| comp.layer(LayerId(*l)).unwrap().props.prop("transform/rotation").unwrap().value.as_f64()).collect());
+    }
+    let end = at(400.0);
+    h.input_mut().events.push(Event::PointerButton { pos: end, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    seen
+}
+
+/// Layer `i` of `rotate_round` turned by `step`° on every frame once the drag was under way.
+fn assert_turns_by(seen: &[Vec<f64>], i: usize, step: f64) {
+    let v: Vec<f64> = seen.iter().map(|f| f[i]).collect();
+    let live: Vec<f64> = v.iter().copied().skip_while(|x| *x == v[0]).collect();
+    assert!(live.len() > 30, "layer {i} hardly turned: {v:?}");
+    assert!(live.windows(2).all(|w| (w[1] - w[0] - step).abs() < 0.5), "layer {i} should turn {step}° a frame: {v:?}");
+}
+
+/// #2870: a child of a moved parent turns about its anchor where it shows, not about its raw
+/// Position read as comp pixels.
+#[test]
+fn rotate_tool_turns_a_child_of_a_moved_parent_smoothly() {
+    let (mut h, _, child) = rotate_child_harness(json!({"position": [420.0, 240.0]}));
+    assert_turns_by(&rotate_round(&mut h, [300.0, 180.0], &[child]), 0, 10.0);
+}
+
+/// #2870: under a mirrored parent the value runs opposite to the pointer, so the layer on screen
+/// still follows it.
+#[test]
+fn rotate_tool_follows_the_pointer_under_a_flipped_parent() {
+    let (mut h, _, child) = rotate_child_harness(json!({"scale": [-100.0, 100.0]}));
+    assert_turns_by(&rotate_round(&mut h, [440.0, 120.0], &[child]), 0, -10.0);
+}
+
+/// #2870: a parent's rotation offsets the angle but not the turn.
+#[test]
+fn rotate_tool_turns_a_child_of_a_rotated_parent_smoothly() {
+    let (mut h, _, child) = rotate_child_harness(json!({"rotation": 90.0}));
+    assert_turns_by(&rotate_round(&mut h, [380.0, 60.0], &[child]), 0, 10.0);
+}
+
+/// #2870: a parent's pixel aspect isn't inherited by its child, so it doesn't move the pivot either.
+#[test]
+fn rotate_tool_ignores_a_parents_pixel_aspect() {
+    let mut h = harness();
+    let child = layer_id(&h, "Box");
+    let s = &mut h.state_mut().session;
+    let parent = s.execute("layer.newSolid", json!({"name": "Wide", "color": "#000000", "width": 100, "height": 100, "pixelAspect": 2.0})).unwrap()["layer"]
+        .as_u64()
+        .unwrap();
+    s.execute("layer.setSwitch", json!({"layers": [parent], "switch": "video", "value": false})).unwrap();
+    s.execute("prop.set", json!({"layer": parent, "path": "transform/position", "value": [500.0, 300.0]})).unwrap();
+    s.execute("layer.setParent", json!({"layers": [child], "parent": parent, "compensate": false})).unwrap();
+    s.execute("prop.set", json!({"layer": child, "path": "transform/position", "value": [100.0, 60.0]})).unwrap();
+    s.execute("layer.select", json!({"layers": [child]})).unwrap();
+    h.state_mut().ui.tool = Tool::Rotate;
+    h.run_steps(2);
+    assert_turns_by(&rotate_round(&mut h, [550.0, 310.0], &[child]), 0, 10.0);
+}
+
+/// #2870: every selected layer turns the same way on screen, whichever way its own parent is
+/// flipped: the value of a layer whose parent is mirrored relative to the grabbed one's runs opposite.
+#[test]
+fn rotate_tool_turns_a_mixed_selection_the_same_way_on_screen() {
+    let (mut h, plate, child) = rotate_child_harness(json!({"scale": [-100.0, 100.0]}));
+    let s = &mut h.state_mut().session;
+    let new = |s: &mut Session, name: &str| {
+        s.execute("layer.newSolid", json!({"name": name, "color": "#00ff00", "width": 20, "height": 20})).unwrap()["layer"].as_u64().unwrap()
+    };
+    let (free, sibling) = (new(s, "Free"), new(s, "Sibling"));
+    s.execute("layer.setParent", json!({"layers": [sibling], "parent": plate, "compensate": false})).unwrap();
+    s.execute("prop.set", json!({"layer": free, "path": "transform/rotation", "value": 15.0})).unwrap();
+    s.execute("layer.select", json!({"layers": [child, free, sibling]})).unwrap();
+    h.run_steps(2);
+    let seen = rotate_round(&mut h, [440.0, 120.0], &[child, free, sibling]);
+    assert_turns_by(&seen, 0, -10.0);
+    assert_turns_by(&seen, 1, 10.0);
+    assert_turns_by(&seen, 2, -10.0);
+}
+
+/// #2870: a 3D child turns about its anchor as the camera shows it, and with its value running
+/// opposite under a flipped parent.
+#[test]
+fn rotate_tool_turns_a_3d_child_about_its_anchor_through_the_camera() {
+    let (mut h, _, child) = rotate_child_harness(json!({"scale": [-100.0, 100.0]}));
+    let s = &mut h.state_mut().session;
+    s.execute("layer.setSwitch", json!({"layers": [child], "switch": "threeD", "value": true})).unwrap();
+    let cam = s.execute("layer.newCamera", json!({"name": "Cam", "type": "oneNode"})).unwrap()["layer"].as_u64().unwrap();
+    let at = s.active_comp().unwrap().layer(LayerId(cam)).unwrap().props.prop("transform/position").unwrap().value.as_vec3();
+    // One comp-plane unit to the right moves everything in the comp plane one pixel to the left.
+    s.execute("prop.set", json!({"layer": cam, "path": "transform/position", "value": [at[0] + 100.0, at[1], at[2]]})).unwrap();
+    s.execute("layer.select", json!({"layers": [child]})).unwrap();
+    h.run_steps(2);
+    assert_turns_by(&rotate_round(&mut h, [340.0, 120.0], &[child]), 0, -10.0);
+}
+
 /// Mask vertices multi-select with the Selection tool: Shift-click adds a vertex to the
 /// selection and Shift-clicking it again removes it; a plain click collapses to one (#1004).
 #[test]
diff --git a/crates/ui-egui/tests/it/ui_viewer_trackpad.rs b/crates/ui-egui/tests/it/ui_viewer_trackpad.rs
new file mode 100644
index 000000000..55466371a
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_viewer_trackpad.rs
@@ -0,0 +1,156 @@
+//! Trackpad gestures in the Composition viewer: a two-finger scroll pans, a pinch (and the mouse
+//! wheel, also one that scrolls in pixels) zooms around the pointer (egui_kittest, UI logic only).
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use effectcraft_ui_egui::dock::PanelKind;
+use egui::{Event, Rect, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+fn harness() -> Harness<'static, EffectcraftApp> {
+    let mut s = Session::default();
+    s.execute("comp.new", json!({"name": "View", "width": 640, "height": 360, "duration": 4})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.state_mut().show_panel(PanelKind::Composition);
+    h.run_steps(4);
+    h
+}
+
+fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
+    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
+    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
+}
+
+fn wheel(h: &mut Harness<'_, EffectcraftApp>, unit: egui::MouseWheelUnit, delta: egui::Vec2, modifiers: egui::Modifiers) {
+    h.input_mut().events.push(Event::MouseWheel { unit, delta, modifiers, phase: egui::TouchPhase::Move, source: egui::MouseWheelSource::Unknown });
+    h.run_steps(30);
+}
+
+#[test]
+fn trackpad_scroll_pans_the_composition() {
+    let mut h = harness();
+    let comp = rect(&h, "viewer.comp");
+    h.input_mut().events.push(Event::PointerMoved(comp.center()));
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(80.0, -40.0), Default::default());
+    let after = rect(&h, "viewer.comp");
+    let moved = after.min - comp.min;
+    assert!((moved.x - 80.0).abs() < 1.5 && (moved.y + 40.0).abs() < 1.5, "the scroll pans: {moved:?}");
+    assert!((after.width() - comp.width()).abs() < 0.5, "a scroll doesn't zoom: {} → {}", comp.width(), after.width());
+}
+
+#[test]
+fn pinch_and_mouse_wheel_zoom_around_the_pointer() {
+    let mut h = harness();
+    let comp = rect(&h, "viewer.comp");
+    let at = comp.min + comp.size() * 0.25;
+    h.input_mut().events.push(Event::PointerMoved(at));
+    h.input_mut().events.push(Event::Zoom(1.5));
+    h.run_steps(3);
+    let zoomed = rect(&h, "viewer.comp");
+    assert!((zoomed.width() / comp.width() - 1.5).abs() < 0.01, "the pinch zooms: {} → {}", comp.width(), zoomed.width());
+    let still = zoomed.min + zoomed.size() * 0.25;
+    assert!(still.distance(at) < 2.0, "the point under the pointer stays put: {at:?} vs {still:?}");
+    // A mouse wheel (it scrolls in lines) zooms too, and so does Alt + a trackpad scroll.
+    wheel(&mut h, egui::MouseWheelUnit::Line, vec2(0.0, 3.0), Default::default());
+    let wheeled = rect(&h, "viewer.comp");
+    assert!(wheeled.width() > zoomed.width() * 1.1, "the wheel zooms in: {} → {}", zoomed.width(), wheeled.width());
+    h.input_mut().events.push(Event::ModifiersChanged(egui::Modifiers::ALT));
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(0.0, -120.0), egui::Modifiers::ALT);
+    let out = rect(&h, "viewer.comp");
+    assert!(out.width() < wheeled.width() * 0.9, "Alt + scroll zooms out: {} → {}", wheeled.width(), out.width());
+}
+
+/// Browsers and some high-resolution wheels report a mouse wheel in pixels, as a trackpad does:
+/// it still zooms.
+#[test]
+fn a_pixel_unit_mouse_wheel_zooms() {
+    let mut h = harness();
+    let comp = rect(&h, "viewer.comp");
+    let at = comp.min + comp.size() * 0.25;
+    h.input_mut().events.push(Event::PointerMoved(at));
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(0.0, 120.0), Default::default());
+    let zoomed = rect(&h, "viewer.comp");
+    assert!(zoomed.width() > comp.width() * 1.1, "a pixel wheel zooms in: {} → {}", comp.width(), zoomed.width());
+    let still = zoomed.min + zoomed.size() * 0.25;
+    assert!(still.distance(at) < 2.0, "the point under the pointer stays put: {at:?} vs {still:?}");
+    // Shift turns the wheel's scroll sideways: still a wheel, and the next notch zooms.
+    h.input_mut().events.push(Event::ModifiersChanged(egui::Modifiers::SHIFT));
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(0.0, 120.0), egui::Modifiers::SHIFT);
+    h.input_mut().events.push(Event::ModifiersChanged(egui::Modifiers::NONE));
+    let before = rect(&h, "viewer.comp");
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(0.0, -120.0), Default::default());
+    let out = rect(&h, "viewer.comp");
+    assert!(out.width() < before.width() * 0.9, "the wheel still zooms: {} → {}", before.width(), out.width());
+}
+
+/// A straight vertical trackpad scroll pans when the touch phase says it is a trackpad,
+/// and after any diagonal scroll; a mouse wheel in lines takes the zoom back.
+#[test]
+fn a_vertical_trackpad_scroll_pans_once_the_trackpad_is_known() {
+    let mut h = harness();
+    let comp = rect(&h, "viewer.comp");
+    h.input_mut().events.push(Event::PointerMoved(comp.center()));
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::Vec2::ZERO,
+        modifiers: Default::default(),
+        source: egui::MouseWheelSource::Unknown,
+        phase: egui::TouchPhase::Start,
+    });
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, 50.0),
+        modifiers: Default::default(),
+        source: egui::MouseWheelSource::Unknown,
+        phase: egui::TouchPhase::Move,
+    });
+    h.step();
+    h.input_mut().events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::Vec2::ZERO,
+        modifiers: Default::default(),
+        source: egui::MouseWheelSource::Unknown,
+        phase: egui::TouchPhase::End,
+    });
+    h.run_steps(30);
+    let panned = rect(&h, "viewer.comp");
+    assert!((panned.min.y - comp.min.y - 50.0).abs() < 1.5, "the scroll pans: {:?}", panned.min - comp.min);
+    assert!((panned.width() - comp.width()).abs() < 0.5, "a trackpad scroll doesn't zoom");
+    // Without phases (Windows, Linux, the web) it stays a trackpad.
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(0.0, 30.0), Default::default());
+    let again = rect(&h, "viewer.comp");
+    assert!((again.min.y - panned.min.y - 30.0).abs() < 1.5 && (again.width() - comp.width()).abs() < 0.5, "{again:?}");
+    // A wheel that scrolls in lines is a mouse: it zooms, and so does a pixel wheel after it.
+    wheel(&mut h, egui::MouseWheelUnit::Line, vec2(0.0, 3.0), Default::default());
+    let zoomed = rect(&h, "viewer.comp");
+    assert!(zoomed.width() > again.width() * 1.1, "the wheel zooms: {} → {}", again.width(), zoomed.width());
+    wheel(&mut h, egui::MouseWheelUnit::Point, vec2(0.0, 120.0), Default::default());
+    assert!(rect(&h, "viewer.comp").width() > zoomed.width() * 1.1, "a pixel wheel zooms again");
+}
+
+/// Where the platform names the device (macOS), a straight vertical trackpad scroll pans at once
+/// and a wheel in points zooms.
+#[test]
+fn the_wheel_source_decides_where_the_platform_reports_it() {
+    let mut h = harness();
+    let comp = rect(&h, "viewer.comp");
+    let at = comp.min + comp.size() * 0.25;
+    h.input_mut().events.push(Event::PointerMoved(at));
+    let scroll = |h: &mut Harness<'_, EffectcraftApp>, source, dy| {
+        h.input_mut().events.push(Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, dy),
+            modifiers: Default::default(),
+            phase: egui::TouchPhase::Move,
+            source,
+        });
+        h.run_steps(30);
+    };
+    scroll(&mut h, egui::MouseWheelSource::Trackpad, 40.0);
+    let panned = rect(&h, "viewer.comp");
+    assert!((panned.min.y - comp.min.y - 40.0).abs() < 1.5, "the trackpad pans: {:?}", panned.min - comp.min);
+    assert!((panned.width() - comp.width()).abs() < 0.5, "a trackpad scroll doesn't zoom");
+    scroll(&mut h, egui::MouseWheelSource::Wheel, 120.0);
+    assert!(rect(&h, "viewer.comp").width() > panned.width() * 1.1, "the wheel zooms");
+}
diff --git a/crates/ui-egui/tests/ui_viewers.rs b/crates/ui-egui/tests/it/ui_viewers.rs
similarity index 85%
rename from crates/ui-egui/tests/ui_viewers.rs
rename to crates/ui-egui/tests/it/ui_viewers.rs
index e556d92ae..bfbcad51e 100644
--- a/crates/ui-egui/tests/ui_viewers.rs
+++ b/crates/ui-egui/tests/it/ui_viewers.rs
@@ -2,10 +2,12 @@
 //! comp goes to an unlocked viewer (a new one when every viewer is locked); a click on another
 //! viewer makes it the active one; closing a viewer forgets it.
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_engine::project::ItemId;
 use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::{PanelKind, Zone};
+use effectcraft_ui_egui::dock::PanelKind;
+use effectcraft_ui_egui::dock::WorkspaceExt as _;
 use effectcraft_ui_egui::panels::viewers;
 use egui::{Event, pos2};
 use egui_kittest::Harness;
@@ -67,12 +69,18 @@ fn new_viewers_lock_route_comps_and_activate_on_click() {
     h.run_steps(3);
     // View ▸ New Viewer: viewer 1 shows A too, viewer 0 (the Composition panel) is locked.
     invoke(&mut h, "view.newViewer", json!({}));
-    assert!(h.state().ui.dock.contains(PanelKind::Viewer(1)));
+    assert!(h.state().ui.dock.is_docked(PanelKind::Viewer(1)));
     assert!(viewers::locked(h.state(), 0) && !viewers::locked(h.state(), 1));
     assert_eq!((h.state().ui.active_viewer, shows(&h, 0), shows(&h, 1)), (1, Some(a), Some(a)));
     // Side by side, so both draw.
-    assert!(h.state_mut().edit_layout(|l| l.dock(PanelKind::Viewer(1), PanelKind::Composition, Zone::Right)));
-    h.state_mut().ui.dock.activate(PanelKind::Composition);
+    h.state_mut()
+        .apply_dock(craft_ui::docking::Action::Move {
+            panel: PanelKind::Viewer(1),
+            anchor: PanelKind::Composition,
+            placement: craft_ui::docking::Placement::Split(craft_ui::docking::Zone::Right),
+        })
+        .unwrap();
+    h.state_mut().apply_dock(craft_ui::docking::Action::Activate { panel: PanelKind::Composition }).unwrap();
     h.run_steps(3);
     // Opening B shows it in the active (unlocked) viewer; the locked one keeps A.
     invoke(&mut h, "comp.open", json!({"comp": b}));
@@ -90,7 +98,7 @@ fn new_viewers_lock_route_comps_and_activate_on_click() {
     h.state_mut().ui.locked_tabs.insert(PanelKind::Viewer(1).id());
     invoke(&mut h, "comp.open", json!({"comp": b}));
     assert_eq!(h.state().ui.active_viewer, 2);
-    assert!(h.state().ui.dock.contains(PanelKind::Viewer(2)));
+    assert!(h.state().ui.dock.is_docked(PanelKind::Viewer(2)));
     assert_eq!((shows(&h, 0), shows(&h, 1), shows(&h, 2)), (Some(a), Some(c), Some(b)));
     // Closing the active viewer forgets it; another open viewer takes over.
     h.state_mut().close_panel(PanelKind::Viewer(2));
@@ -134,7 +142,7 @@ fn a_locked_viewer_keeps_its_comp_when_the_project_panel_opens_another() {
     assert_eq!((h.state().ui.active_viewer, shows(&h, 0), shows(&h, 1)), (1, Some(a), Some(b)));
 }
 
-/// `cargo test -p effectcraft-ui-egui --test ui_viewers -- --ignored`: two viewers side by side
+/// `cargo test -p effectcraft-ui-egui --test it ui_viewers:: -- --ignored`: two viewers side by side
 /// (`target/test-out/viewers.png`).
 #[test]
 #[ignore]
@@ -145,8 +153,14 @@ fn viewers_snapshot() {
     let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
     h.run_steps(3);
     invoke(&mut h, "view.newViewer", json!({}));
-    assert!(h.state_mut().edit_layout(|l| l.dock(PanelKind::Viewer(1), PanelKind::Composition, Zone::Right)));
-    h.state_mut().ui.dock.activate(PanelKind::Composition);
+    h.state_mut()
+        .apply_dock(craft_ui::docking::Action::Move {
+            panel: PanelKind::Viewer(1),
+            anchor: PanelKind::Composition,
+            placement: craft_ui::docking::Placement::Split(craft_ui::docking::Zone::Right),
+        })
+        .unwrap();
+    h.state_mut().apply_dock(craft_ui::docking::Action::Activate { panel: PanelKind::Composition }).unwrap();
     invoke(&mut h, "comp.open", json!({"comp": other.0}));
     for _ in 0..300 {
         h.step();
@@ -158,5 +172,5 @@ fn viewers_snapshot() {
     h.run_steps(4);
     let dir = concat!(env!("CARGO_MANIFEST_DIR"), "/../../target/test-out");
     std::fs::create_dir_all(dir).unwrap();
-    h.render().unwrap().save(format!("{dir}/viewers.png")).unwrap();
+    h.render_serialized().unwrap().save(format!("{dir}/viewers.png")).unwrap();
 }
diff --git a/crates/ui-egui/tests/ui_visual_review.rs b/crates/ui-egui/tests/it/ui_visual_review.rs
similarity index 83%
rename from crates/ui-egui/tests/ui_visual_review.rs
rename to crates/ui-egui/tests/it/ui_visual_review.rs
index 70cc5ed84..6d079f1f5 100644
--- a/crates/ui-egui/tests/ui_visual_review.rs
+++ b/crates/ui-egui/tests/it/ui_visual_review.rs
@@ -1,5 +1,6 @@
 //! Opt-in visual review of every built-in panel, workspaces and common dialogs.
 //! Original fixture; captures are review outputs, not shipped assets.
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_ui_egui::{Dialog, EffectcraftApp, dock::PanelKind};
 use egui_kittest::Harness;
@@ -19,18 +20,18 @@ fn all_ui_review_captures() {
         std::sync::Arc::make_mut(&mut s.project).settings.gpu_acceleration = false;
         let mut h = Harness::builder().with_size(size).build_eframe(|_| EffectcraftApp::new(s));
         h.run_steps(4);
-        h.render().unwrap().save(out.join(format!("{label}-workspace.png"))).unwrap();
+        h.render_serialized().unwrap().save(out.join(format!("{label}-workspace.png"))).unwrap();
         let ctx = h.ctx.clone();
         h.state_mut().set_theme(&ctx, effectcraft_ui_egui::theme::ThemeKind::Light);
         h.run_steps(4);
-        h.render().unwrap().save(out.join(format!("{label}-workspace-light.png"))).unwrap();
+        h.render_serialized().unwrap().save(out.join(format!("{label}-workspace-light.png"))).unwrap();
         h.state_mut().set_theme(&ctx, effectcraft_ui_egui::theme::ThemeKind::Dark);
         for p in PanelKind::ALL {
             h.state_mut().show_panel(p);
             h.state_mut().ui.maximized = Some(p);
             h.run_steps(4);
             assert!(h.state().auto.find(&format!("panel.{}", p.id())).is_some(), "{} opens", p.title());
-            h.render().unwrap().save(out.join(format!("{label}-{}.png", p.id()))).unwrap();
+            h.render_serialized().unwrap().save(out.join(format!("{label}-{}.png", p.id()))).unwrap();
         }
         h.state_mut().ui.maximized = None;
         for (name, dialog) in [
@@ -42,7 +43,7 @@ fn all_ui_review_captures() {
         ] {
             h.state_mut().dialog = Some(dialog);
             h.run_steps(4);
-            h.render().unwrap().save(out.join(format!("{label}-dialog-{name}.png"))).unwrap();
+            h.render_serialized().unwrap().save(out.join(format!("{label}-dialog-{name}.png"))).unwrap();
             h.state_mut().dialog = None;
             h.run_steps(2);
         }
diff --git a/crates/ui-egui/tests/ui_web_gpu_storage.rs b/crates/ui-egui/tests/it/ui_web_gpu_storage.rs
similarity index 95%
rename from crates/ui-egui/tests/ui_web_gpu_storage.rs
rename to crates/ui-egui/tests/it/ui_web_gpu_storage.rs
index d706a382b..694d98507 100644
--- a/crates/ui-egui/tests/ui_web_gpu_storage.rs
+++ b/crates/ui-egui/tests/it/ui_web_gpu_storage.rs
@@ -61,7 +61,7 @@ impl RemoteFrames for GpuWorker {
     fn start(&self, job: RemoteJob, done: RemoteDone) {
         // The page reads a hit from the disk cache instead of asking the worker.
         if let Some(k) = job.disk_key
-            && let Some(f) = self.disk.lock().unwrap().get(&k).and_then(|e| disk_cache::read_frame_entry(e))
+            && let Some(f) = self.disk.lock().unwrap().get(&k).and_then(|e| disk_cache::read_frame_entry(e, None))
         {
             return done(Ok(RemoteFrame { width: f.width, height: f.height, rgba: f.rgba, ms: 0.0 }));
         }
@@ -91,8 +91,11 @@ impl RemoteFrames for GpuWorker {
         match out.into_iter().next() {
             Some((FrameReply::Frame { width, height, ms, passes, gpu, .. }, Some(rgba))) => {
                 self.rendered.lock().unwrap().push((passes, gpu));
-                if let Some(k) = job.disk_key {
-                    self.disk.lock().unwrap().insert(k, disk_cache::frame_entry(width, height, &rgba));
+                if let Some(k) = job.disk_key
+                    && let Some(files) = server.take_files()
+                    && let Some(entry) = disk_cache::frame_entry(width, height, &rgba, &files, None)
+                {
+                    self.disk.lock().unwrap().insert(k, entry);
                 }
                 done(Ok(RemoteFrame { width, height, rgba, ms }))
             }
@@ -116,12 +119,13 @@ fn source(s: &Session, gpu: Option<Gpu>) -> RenderSource {
 fn cpu_pixels(f: &FrameImage) -> Vec<egui::Color32> {
     match f {
         FrameImage::Cpu(c) => c.pixels.clone(),
-        FrameImage::Gpu(_) => panic!("expected a CPU frame"),
+        FrameImage::Gpu(_) | FrameImage::CpuF16(_) => panic!("expected an 8-bit CPU frame"),
     }
 }
 
 #[test]
 fn gpu_worker_renders_effect_frames_and_the_disk_cache_survives_a_reload() {
+    let _device = crate::gpu_test::lock();
     let (Some(page_gpu), Some(worker_gpu)) = (Gpu::headless(), Gpu::headless_deferred()) else {
         eprintln!("no GPU adapter: skipped");
         return;
@@ -172,7 +176,7 @@ fn gpu_worker_renders_effect_frames_and_the_disk_cache_survives_a_reload() {
     assert!(frames2.remote_disk());
     let until = std::time::Instant::now() + std::time::Duration::from_secs(5);
     let bar = loop {
-        let bar = frames2.disk_frames(&source(&s, None), &key(fx), 30, &opts);
+        let bar = frames2.disk_frames(&source(&s, None), &key(fx), 0..30, &opts);
         if !bar.is_empty() {
             break bar;
         }
@@ -211,7 +215,8 @@ impl StorageHost for Storage {
 fn send(h: &mut Harness<'_, EffectcraftApp>, method: &str, params: Value) {
     let ctx = h.ctx.clone();
     let (req, _rx) = ControlRequest::new(method, params);
-    if let Outcome::Done(v) = control::handle(h.state_mut(), &ctx, &req) {
+    let now = h.state().now();
+    if let Outcome::Done(v) = control::handle(h.state_mut(), &ctx, &req, now) {
         assert!(v["ok"] != false, "{method}: {v}");
     }
     // kittest doesn't call `raw_input_hook`: feed the synthetic click in.
diff --git a/crates/ui-egui/tests/ui_web_job_gpu.rs b/crates/ui-egui/tests/it/ui_web_job_gpu.rs
similarity index 93%
rename from crates/ui-egui/tests/ui_web_job_gpu.rs
rename to crates/ui-egui/tests/it/ui_web_job_gpu.rs
index 615d4fbd1..8b8914abc 100644
--- a/crates/ui-egui/tests/ui_web_job_gpu.rs
+++ b/crates/ui-egui/tests/it/ui_web_job_gpu.rs
@@ -10,10 +10,6 @@ use effectcraft_engine::offload::{Inbox, Offload, Post, WorkerReply, WorkerReque
 use effectcraft_gpu::Gpu;
 use serde_json::json;
 
-/// One device at a time in this test binary: wgpu's OpenGL backend (Mesa llvmpipe on FreeBSD,
-/// Linux without Vulkan) panics or crashes when tests create and drive devices concurrently.
-static GPU_LOCK: Mutex<()> = Mutex::new(());
-
 /// Holds offloaded jobs until the test runs them.
 #[derive(Default)]
 struct Manual(Mutex<Vec<(WorkerRequest, Arc<Inbox>)>>);
@@ -57,13 +53,13 @@ fn page() -> (Session, Arc<Manual>) {
     s.execute("prop.addKey", json!({"layer": l, "path": "effects/#1/transform/offset", "time": 0.0, "value": [0.5, 0.5]})).unwrap();
     s.execute("prop.addKey", json!({"layer": l, "path": "effects/#1/transform/offset", "time": 0.5, "value": [0.6, 0.56]})).unwrap();
     s.execute("effect.apply", json!({"layers": [l], "effect": "ec.blur.gaussian"})).unwrap();
-    s.execute("prop.set", json!({"layer": l, "path": "effects/#2/blurriness", "value": 3.0})).unwrap();
+    s.execute("prop.set", json!({"layer": l, "path": "effects/#2/blurriness", "value": 12.0})).unwrap();
     (s, off)
 }
 
 #[test]
 fn render_queue_jobs_render_on_the_worker_gpu() {
-    let _gpu = GPU_LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _gpu = crate::gpu_test::lock();
     let Some(g) = Gpu::headless_deferred() else {
         eprintln!("no GPU adapter: skipped");
         return;
@@ -102,7 +98,7 @@ fn render_queue_jobs_render_on_the_worker_gpu() {
 
 #[test]
 fn analyses_render_their_input_on_the_worker_gpu() {
-    let _gpu = GPU_LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let _gpu = crate::gpu_test::lock();
     let Some(g) = Gpu::headless_deferred() else {
         eprintln!("no GPU adapter: skipped");
         return;
diff --git a/crates/ui-egui/tests/ui_web_offload.rs b/crates/ui-egui/tests/it/ui_web_offload.rs
similarity index 97%
rename from crates/ui-egui/tests/ui_web_offload.rs
rename to crates/ui-egui/tests/it/ui_web_offload.rs
index 67ec6a9f8..fde177cb6 100644
--- a/crates/ui-egui/tests/ui_web_offload.rs
+++ b/crates/ui-egui/tests/it/ui_web_offload.rs
@@ -136,7 +136,7 @@ fn viewer_frames_render_remotely_from_project_diffs() {
     assert_eq!(frames.remote_busy(), 0);
     let img = match frames.get(&key(&s, 10)).expect("viewer frame cached") {
         FrameImage::Cpu(c) => c,
-        FrameImage::Gpu(_) => unreachable!(),
+        FrameImage::Gpu(_) | FrameImage::CpuF16(_) => unreachable!(),
     };
     let local = effectcraft_ui_egui::frames::to_color_image(&s.render(comp, c.frame_rate.tick_of(10), opts));
     assert_eq!(img.size, local.size);
@@ -241,7 +241,14 @@ fn waiting_commands_report_only_their_own_completion_errors() {
         let other = if kind == JobKind::Track { JobKind::Warp } else { JobKind::Track };
         let mut app = EffectcraftApp::new(Session::default());
         app.session.offload_log = vec![(kind, Some("old error".into())), (other, Some("unrelated failure".into())), (kind, None)];
-        let waiter = || JobWaiter { command: "analysis".into(), params: json!({}), result: json!({"running": true}), jobs: vec![job_id.into()], log_cursor: 1 };
+        let waiter = || JobWaiter {
+            command: "analysis".into(),
+            params: json!({}),
+            result: json!({"running": true}),
+            jobs: vec![job_id.into()],
+            log_cursor: 1,
+            render: None,
+        };
         let result = waiter().finish(&mut app);
         assert_eq!(result, json!({"ok": true, "result": {"running": false}}), "{kind:?}");
         app.session.offload_log.push((kind, Some("nothing was applied".into())));
@@ -258,6 +265,6 @@ fn waiting_command_sees_its_error_after_the_completion_log_rolls_over() {
     app.session.offload_log = vec![(JobKind::Warp, None); 31];
     app.session.offload_log.push((JobKind::Track, Some("nothing was applied".into())));
     app.session.offload_log_start = 1;
-    let waiter = JobWaiter { command: "track.analyze".into(), params: json!({}), result: json!({}), jobs: vec!["track".into()], log_cursor: 32 };
+    let waiter = JobWaiter { command: "track.analyze".into(), params: json!({}), result: json!({}), jobs: vec!["track".into()], log_cursor: 32, render: None };
     assert_eq!(waiter.finish(&mut app), json!({"ok": false, "error": "nothing was applied"}));
 }
diff --git a/crates/ui-egui/tests/it/ui_window_title.rs b/crates/ui-egui/tests/it/ui_window_title.rs
new file mode 100644
index 000000000..66ef62235
--- /dev/null
+++ b/crates/ui-egui/tests/it/ui_window_title.rs
@@ -0,0 +1,21 @@
+//! The window title the shared app reports (project name, ` *` while modified), which hosts that
+//! cannot use `ViewportCommand::Title` (the browser tab) read through `window_title`.
+
+use effectcraft_engine::Session;
+use effectcraft_ui_egui::EffectcraftApp;
+use egui::vec2;
+use egui_kittest::Harness;
+use serde_json::json;
+
+#[test]
+fn the_reported_title_follows_the_open_document() {
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_eframe(|_| EffectcraftApp::new(Session::default()));
+    h.run_steps(3);
+    let clean = h.state().window_title().to_owned();
+    assert!(clean.starts_with("EffectCraft - ") && !clean.ends_with(" *"), "{clean}");
+
+    h.state_mut().session.execute("comp.new", json!({"name": "Edited", "width": 64, "height": 64, "duration": 1})).unwrap();
+    h.run_steps(3);
+    let dirty = h.state().window_title().to_owned();
+    assert!(dirty.starts_with("EffectCraft - ") && dirty.ends_with(" *"), "{dirty}");
+}
diff --git a/crates/ui-egui/tests/ui_workflow_selection.rs b/crates/ui-egui/tests/it/ui_workflow_selection.rs
similarity index 87%
rename from crates/ui-egui/tests/ui_workflow_selection.rs
rename to crates/ui-egui/tests/it/ui_workflow_selection.rs
index 6e264dd33..e7bcedb60 100644
--- a/crates/ui-egui/tests/ui_workflow_selection.rs
+++ b/crates/ui-egui/tests/it/ui_workflow_selection.rs
@@ -1,4 +1,5 @@
 //! User-reported selection, Project deletion, and render-queue drop regressions.
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::{Session, project::LayerId};
 use effectcraft_ui_egui::{Dialog, EffectcraftApp, dock::PanelKind};
 use egui::{Event, Modifiers, PointerButton, Pos2, Rect, pos2, vec2};
@@ -273,7 +274,7 @@ fn viewer_right_click_targets_hit_and_duplicate_preserves_group() {
         }
         assert!(h.state().frames.is_cached(&key));
         h.run_steps(3);
-        h.render().expect("offscreen context menu render").save(out).unwrap();
+        h.render_serialized().expect("offscreen context menu render").save(out).unwrap();
     }
     h.get_by_label("Duplicate").click();
     h.run_steps(3);
@@ -299,7 +300,7 @@ fn viewer_context_select_reaches_an_obscured_layer() {
         h.step();
     }
     h.run_steps(3);
-    h.get_by_label("Select ⏵").click();
+    h.get_by_label("Select").click();
     h.run_steps(3);
     h.get_by_label("Tile 1").click();
     h.run_steps(3);
@@ -433,7 +434,7 @@ fn workflow_snapshot() {
     }
     assert!(h.state().frames.is_cached(&key), "current composition rendered before capture");
     h.run_steps(3);
-    h.render().expect("offscreen UI render").save(out).unwrap();
+    h.render_serialized().expect("offscreen UI render").save(out).unwrap();
 }
 
 /// Filled rects painted this frame (flattening nested shape lists).
@@ -637,3 +638,80 @@ fn timeline_context_menu_creates_shapes_and_masks_from_text() {
     assert!(h.query_by_label("Create Shapes from Text").is_none(), "no text conversion for a solid");
     assert!(h.query_by_label("Create Masks from Text").is_none(), "no text conversion for a solid");
 }
+
+// Regression test for #979 (#958): right-clicking a vector footage layer (SVG) in the Timeline
+// or the Composition viewer offered no Create Shapes from Vector Layer; raster layers must not.
+#[test]
+fn layer_context_menus_offer_create_shapes_from_vector_layer_for_vector_footage() {
+    use effectcraft_engine::project::LayerSource;
+    let dir = std::env::temp_dir().join(format!("ec-ui-vector-menu-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let svg = dir.join("logo.svg");
+    std::fs::write(
+        &svg,
+        r##"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20" viewBox="0 0 40 20"><rect width="40" height="20" fill="#ff0000"/></svg>"##,
+    )
+    .unwrap();
+    let png = dir.join("photo.png");
+    image::RgbaImage::from_pixel(16, 16, image::Rgba([0, 128, 255, 255])).save(&png).unwrap();
+    let mut s = effectcraft_host::session();
+    let item = s.execute("file.import", json!({"paths": [svg.to_string_lossy()]})).unwrap()["items"][0].as_u64().unwrap();
+    let raster = s.execute("file.import", json!({"paths": [png.to_string_lossy()]})).unwrap()["items"][0].as_u64().unwrap();
+    s.execute("comp.new", json!({"name":"Vec","width":320,"height":180,"duration":4})).unwrap();
+    // The raster layer sits below the SVG layer, so the viewer click below lands on the SVG.
+    let photo = s.execute("layer.addItem", json!({"item": raster})).unwrap()["layer"].as_u64().unwrap();
+    let logo = s.execute("layer.addItem", json!({"item": item})).unwrap()["layer"].as_u64().unwrap();
+    let plate = s.execute("layer.newSolid", json!({"name":"Plate","width":40,"height":40,"color":"#406080"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("edit.deselectAll", json!({})).unwrap();
+    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
+    h.run_steps(3);
+    let right_click = |h: &mut Harness<'_, EffectcraftApp>, p: Pos2| {
+        for pressed in [true, false] {
+            h.input_mut().events.push(Event::PointerMoved(p));
+            h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE });
+            h.step();
+        }
+        h.run_steps(3);
+    };
+    let row = |h: &Harness<'_, EffectcraftApp>, id: u64| {
+        let r = rect(h, &format!("timeline.layer.{id}.row"));
+        pos2(r.min.x + 210.0, r.center().y)
+    };
+    let label = "Create Shapes from Vector Layer";
+    let shapes =
+        |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.iter().filter(|l| matches!(l.source, LayerSource::Shape)).count();
+    // A raster-less solid does not offer the conversion.
+    h.state_mut().session.execute("layer.select", json!({"layers": [plate]})).unwrap();
+    h.run_steps(3);
+    let at = row(&h, plate);
+    right_click(&mut h, at);
+    assert!(h.query_by_label(label).is_none(), "no vector conversion for a solid");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    // Nor does raster footage.
+    h.state_mut().session.execute("layer.select", json!({"layers": [photo]})).unwrap();
+    h.run_steps(3);
+    let at = row(&h, photo);
+    right_click(&mut h, at);
+    assert!(h.query_by_label(label).is_none(), "no vector conversion for raster footage");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    // The Timeline row of the SVG layer offers it, and it converts the layer.
+    h.state_mut().session.execute("layer.select", json!({"layers": [logo]})).unwrap();
+    h.run_steps(3);
+    let at = row(&h, logo);
+    right_click(&mut h, at);
+    h.get_by_label(label).click();
+    h.run_steps(3);
+    assert_eq!(shapes(&h), 1, "a shape layer was created from the SVG layer");
+    // The Composition viewer's menu offers it for the SVG layer under the pointer too.
+    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
+    h.state_mut().session.execute("prop.set", json!({"layer": plate, "path": "transform/position", "value": [40.0, 40.0]})).unwrap();
+    // The solid stays selected: the menu must follow the layer under the pointer, not the selection.
+    h.state_mut().session.execute("layer.select", json!({"layers": [plate]})).unwrap();
+    h.run_steps(3);
+    let comp = rect(&h, "viewer.comp");
+    right_click(&mut h, comp.center());
+    assert!(h.query_by_label(label).is_some(), "the viewer's context menu offers the vector conversion");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/ui-egui/tests/ui_workspace_focus.rs b/crates/ui-egui/tests/it/ui_workspace_focus.rs
similarity index 86%
rename from crates/ui-egui/tests/ui_workspace_focus.rs
rename to crates/ui-egui/tests/it/ui_workspace_focus.rs
index 0d0ecd001..af8ecd9ad 100644
--- a/crates/ui-egui/tests/ui_workspace_focus.rs
+++ b/crates/ui-egui/tests/it/ui_workspace_focus.rs
@@ -5,27 +5,54 @@ use std::sync::Arc;
 use effectcraft_engine::Session;
 use effectcraft_engine::config::{ConfigStore, DirConfig, MemoryConfig};
 use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::{DockNode, PanelKind, SplitSize};
+use effectcraft_ui_egui::dock::{self, Node, PanelKind, SplitSize};
 use effectcraft_ui_egui::state::Tool;
 use egui::{Event, Id, Key, Modifiers, vec2};
 use egui_kittest::Harness;
 use serde_json::json;
 
+/// The egui id of panel `p`'s dock tab.
+fn tab_id(p: PanelKind) -> Id {
+    craft_ui::docking::DockArea::<PanelKind>::hit_id(effectcraft_ui_egui::dock_ui::area_id(), &craft_ui::docking::Hit::Tab(p))
+}
+
+#[test]
+fn workspace_commands_wait_for_migration_without_changing_named_layouts() {
+    let store = Arc::new(MemoryConfig::default());
+    let original = include_str!("../fixtures/workspaces-v1.json");
+    store.write("workspaces.json", original).unwrap();
+    let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
+    assert!(!app.ui.native_outer.is_empty());
+    let ctx = egui::Context::default();
+    let before = (app.ui.workspace.clone(), app.ui.saved_workspaces.clone(), app.ui.dock.clone());
+    for (id, params) in [
+        ("window.saveWorkspace", json!({})),
+        ("window.saveWorkspaceAs", json!({"name": "Too soon"})),
+        ("window.editWorkspaces", json!({"name": "My Layout", "delete": true})),
+        ("window.editWorkspaces", json!({"name": "My Layout", "rename": "Too soon"})),
+    ] {
+        let error = effectcraft_ui_egui::menus::invoke(&mut app, &ctx, id, params).unwrap_err();
+        assert!(error.contains("positions"), "{id}: {error}");
+        assert_eq!((app.ui.workspace.clone(), app.ui.saved_workspaces.clone(), app.ui.dock.clone()), before);
+        assert_eq!(store.read("workspaces.json").as_deref(), Some(original));
+        assert_eq!(store.read("workspaces.old.json"), None);
+    }
+}
+
 #[test]
 fn named_and_current_workspaces_survive_frontend_restart() {
     let store = Arc::new(MemoryConfig::default());
     let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
-    app.ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(345.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Layer], active: 1 }),
-    };
+    app.ui.dock = dock::docked(dock::hsplit(
+        SplitSize::FixedFirst(345.0),
+        dock::tabs(&[PanelKind::Project], 0),
+        dock::tabs(&[PanelKind::Composition, PanelKind::Layer], 1),
+    ));
     let ctx = egui::Context::default();
     effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.saveWorkspaceAs", json!({"name": "Restart layout"})).unwrap();
     let saved = app.ui.dock.clone();
-    if let DockNode::Split { size, .. } = &mut app.ui.dock {
-        *size = SplitSize::FixedA(390.0);
+    if let Some(Node::Split { size, .. }) = &mut app.ui.dock.layout.root {
+        *size = SplitSize::FixedFirst(390.0);
     }
     app.ui.focused = PanelKind::Layer;
     let current = app.ui.dock.clone();
@@ -100,15 +127,18 @@ fn unreadable_native_workspace_is_preserved_after_later_layout_changes() {
 #[test]
 fn legacy_named_workspaces_migrate_once_and_survive_actual_app_restart() {
     let store = Arc::new(MemoryConfig::default());
-    let saved = effectcraft_ui_egui::dock::workspace("Minimal");
-    store.write("workspaces.json", &json!({"workspaces":{"Legacy":saved},"floating":{}}).to_string()).unwrap();
+    // An unversioned record from an earlier EffectCraft: its Minimal layout saved as "Legacy".
+    let legacy = r#"{"floating":{},"workspaces":{"Legacy":{"Split":{"a":{"Tabs":{"active":0,"panels":["Composition"]}},"b":{"Tabs":{"active":0,"panels":["Timeline"]}},"size":{"Ratio":0.6000000238418579},"vertical":true}}}}"#;
+    store.write("workspaces.json", legacy).unwrap();
+    let saved = effectcraft_ui_egui::dock::Workspace::new(effectcraft_ui_egui::dock::workspace("Minimal"));
     let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
     assert_eq!(app.ui.saved_workspaces.get("Legacy"), Some(&saved));
     app.set_workspace("Legacy");
     let ctx = egui::Context::default();
     effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.saveWorkspaceAs", json!({"name":"Migrated"})).unwrap();
     let text = store.read("workspaces.json").unwrap();
-    assert_eq!(serde_json::from_str::<serde_json::Value>(&text).unwrap()["version"], 1);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&text).unwrap()["version"], 2);
+    assert_eq!(store.read("workspaces.old.json").as_deref(), Some(legacy));
     let restarted = EffectcraftApp::new(Session { config: Some(store), ..Default::default() });
     assert_eq!(restarted.ui.saved_workspaces.get("Legacy"), Some(&saved));
     assert_eq!(restarted.ui.saved_workspaces.get("Migrated"), Some(&saved));
@@ -128,23 +158,23 @@ fn tab_and_shift_tab_traverse_toolbar_and_space_activates_only_focused_tool() {
     h.run_steps(3);
     for _ in 0..8 {
         key(&mut h, Key::Tab, Modifiers::NONE);
-        if h.ctx.memory(|m| m.focused()) == Some(Id::new(("tool-slot", 0usize))) {
+        if h.ctx.memory(|m| m.focused()) == Some(Id::unique(("tool-slot", 0usize))) {
             break;
         }
     }
-    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::new(("tool-slot", 0usize))));
+    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::unique(("tool-slot", 0usize))));
     key(&mut h, Key::Tab, Modifiers::NONE);
-    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::new(("tool-slot", 1usize))));
+    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::unique(("tool-slot", 1usize))));
     assert_eq!(h.state().ui.tool, Tool::Selection, "focus movement alone must not select a tool");
     key(&mut h, Key::Tab, Modifiers::NONE);
-    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::new(("tool-slot", 2usize))));
+    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::unique(("tool-slot", 2usize))));
     key(&mut h, Key::Tab, Modifiers::SHIFT);
-    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::new(("tool-slot", 1usize))));
+    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::unique(("tool-slot", 1usize))));
     key(&mut h, Key::Space, Modifiers::NONE);
     assert_eq!(h.state().ui.tool, Tool::Hand);
     assert!(!h.state().playback.playing, "Space activates the focused widget, not preview playback");
     assert!(Arc::ptr_eq(&h.state().session.project, &project), "keyboard focus and tool selection do not modify the project");
-    let response = h.ctx.read_response(Id::new(("tool-slot", 1usize))).unwrap();
+    let response = h.ctx.read_response(Id::unique(("tool-slot", 1usize))).unwrap();
     assert!(
         h.output().shapes.iter().any(|shape| {
             matches!(&shape.shape, egui::Shape::Rect(r) if r.rect == response.rect.shrink(1.0) && r.stroke.color == h.state().tokens.text && r.stroke.width > 0.0)
@@ -166,19 +196,19 @@ fn tab_traversal_activates_an_inactive_dock_tab_without_editing_the_project() {
     app.ui.start_screen = false;
     app.ui.show_menu_bar = false;
     // Leave the inactive, layer-named tab visible instead of behind the overflow control.
-    if let DockNode::Split { a, .. } = &mut app.ui.dock
-        && let DockNode::Split { a, .. } = a.as_mut()
-        && let DockNode::Split { size, .. } = a.as_mut()
+    if let Some(Node::Split { first, .. }) = &mut app.ui.dock.layout.root
+        && let Node::Split { first, .. } = first.as_mut()
+        && let Node::Split { size, .. } = first.as_mut()
     {
-        *size = SplitSize::FixedA(420.0);
+        *size = SplitSize::FixedFirst(420.0);
     }
     let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
     h.run_steps(3);
     assert!(h.state().auto.find("panel.tab.EffectControls").is_some(), "the inactive tab must be visible in this fixture");
     let before = h.state().ui.dock.clone();
-    let target = Id::new(("tab", "aaa".to_string(), 1usize));
+    let target = tab_id(PanelKind::EffectControls);
     let mut tabs = 0;
-    for _ in 0..80 {
+    for _ in 0..200 {
         key(&mut h, Key::Tab, Modifiers::NONE);
         tabs += 1;
         if h.ctx.memory(|m| m.focused()) == Some(target) {
@@ -188,24 +218,26 @@ fn tab_traversal_activates_an_inactive_dock_tab_without_editing_the_project() {
     assert_eq!(h.ctx.memory(|m| m.focused()), Some(target));
     println!("Tab presses from no focus to Effect Controls: {tabs}");
     assert_eq!(h.state().ui.dock, before, "traversal alone must not activate a tab");
+    // craft-ui outlines the keyboard-focused tab, inset 2 pt, in the dock's accent (EffectCraft's
+    // focus colour).
+    let response = h.ctx.read_response(target).unwrap();
+    assert!(
+        h.output().shapes.iter().any(|shape| {
+            matches!(&shape.shape, egui::Shape::Rect(r) if r.rect == response.rect.shrink(2.0) && r.stroke.color == h.state().tokens.focus && r.stroke.width > 0.0)
+        }),
+        "the dock tab must visibly show keyboard focus"
+    );
     key(&mut h, Key::Space, Modifiers::NONE);
     let mut activated = before;
-    assert!(activated.activate(PanelKind::EffectControls));
+    activated.apply(craft_ui::docking::Action::Activate { panel: PanelKind::EffectControls }, dock::permissions).unwrap();
     assert_eq!(h.state().ui.dock, activated);
     assert_eq!(h.state().ui.focused, PanelKind::EffectControls);
     assert!(!h.state().playback.playing);
     assert!(Arc::ptr_eq(&h.state().session.project, &project));
-    let response = h.ctx.read_response(target).unwrap();
-    assert!(
-        h.output().shapes.iter().any(|shape| {
-            matches!(&shape.shape, egui::Shape::Rect(r) if r.rect == response.rect.shrink(1.0) && r.stroke.color == h.state().tokens.text && r.stroke.width > 0.0)
-        }),
-        "the active dock tab must visibly retain keyboard focus"
-    );
     let inspected = effectcraft_ui_egui::control::inspect(h.state(), &h.ctx);
     assert_eq!(inspected["keyboardFocus"]["automationId"], "panel.tab.EffectControls");
     key(&mut h, Key::Tab, Modifiers::SHIFT);
-    assert_eq!(h.ctx.memory(|m| m.focused()), Some(Id::new(("tab", "aaa".to_string(), 0usize))));
+    assert_eq!(h.ctx.memory(|m| m.focused()), Some(tab_id(PanelKind::Project)));
     key(&mut h, Key::Enter, Modifiers::NONE);
     assert_eq!(h.state().ui.focused, PanelKind::Project);
     assert!(!h.state().playback.playing);
@@ -284,8 +316,8 @@ fn control_root_divider_drag_after_toolbar_and_dock_tab_keyboard_activation() {
     d.ok("ui.click", json!({"id":"tools.Selection"}), true);
     // The toolbar can grow as upstream adds controls. Traverse to the actual response
     // identity rather than assuming a fixed number of focus stops.
-    let target = Id::new(("tab", "aaa".to_string(), 1usize));
-    for tabs in 1..=100 {
+    let target = tab_id(PanelKind::EffectControls);
+    for tabs in 1..=200 {
         d.ok("ui.key", json!({"key":"Tab"}), true);
         assert!(d.h.state().ui.mini_flowchart.is_none(), "dock-tab traversal must not open a foreground popup");
         if d.h.ctx.memory(|memory| memory.focused()) == Some(target) {
@@ -480,7 +512,7 @@ fn failed_save_or_delete_of_a_saved_workspace_keeps_the_file() {
     let saved = app.ui.dock.clone();
     let before = store.read("workspaces.json").unwrap();
     store.full.store(true, std::sync::atomic::Ordering::Relaxed);
-    app.ui.dock.close(PanelKind::Timeline);
+    app.close_panel(PanelKind::Timeline);
     let error = invoke(&mut app, "window.saveWorkspace", json!({})).unwrap_err();
     assert!(error.contains("synthetic full disk") && error.contains("may be lost after a restart"), "{error}");
     assert!(invoke(&mut app, "window.editWorkspaces", json!({"name": "Kept", "delete": true})).is_err());
diff --git a/crates/ui-egui/tests/viewer_geometry.rs b/crates/ui-egui/tests/it/viewer_geometry.rs
similarity index 91%
rename from crates/ui-egui/tests/viewer_geometry.rs
rename to crates/ui-egui/tests/it/viewer_geometry.rs
index ff242230f..8a212cc35 100644
--- a/crates/ui-egui/tests/viewer_geometry.rs
+++ b/crates/ui-egui/tests/it/viewer_geometry.rs
@@ -1,5 +1,6 @@
 //! Inspect the actual viewer's painted colors and pointer-driven control geometry.
 
+use crate::gpu_test::RenderSerial;
 use effectcraft_engine::Session;
 use effectcraft_ui_egui::{
     EffectcraftApp,
@@ -95,7 +96,13 @@ fn compact_control_row_scrolls_and_preserves_interactions() {
     let mut h = harness(300.0, ThemeKind::Light);
     assert!(rect(&h, "viewer.timecode").right() > 300.0);
     h.event(Event::PointerMoved(pos2(150.0, 345.0)));
-    h.event(Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: vec2(-1500.0, 0.0), modifiers: Default::default(), phase: egui::TouchPhase::Move });
+    h.event(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(-1500.0, 0.0),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
     h.run_steps(30);
     let timecode = rect(&h, "viewer.timecode");
     let row = rect(&h, "viewer.controls");
@@ -136,6 +143,16 @@ fn compact_control_row_scrolls_and_preserves_interactions() {
     h.run_steps(3);
     assert!(!h.state().session.state.viewer.show_snapshot, "releasing the snapshot control must return to the current frame");
 
+    // Fast Previews sits beside the resolution control, so the row that scrolled to the timecode has
+    // to scroll back before its menu is reachable.
+    h.event(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(1500.0, 0.0),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
+    h.run_steps(30);
     click_control(&mut h, "viewer.fastPreviews");
     click_control(&mut h, "viewer.fastPreviewsItem.1");
     assert_eq!(h.state().session.state.viewer.fast_previews.id(), "adaptive", "a scrolled dropdown must retain its menu command");
@@ -160,7 +177,7 @@ fn click_control(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
 #[test]
 fn tab_traversal_reveals_the_last_control() {
     let mut h = harness(300.0, ThemeKind::Dark);
-    let last = egui::Id::new("vw-timecode");
+    let last = egui::Id::unique("vw-timecode");
     for _ in 0..80 {
         h.key_press(egui::Key::Tab);
         h.run_steps(3);
@@ -232,7 +249,13 @@ fn painted_scrollbar(h: &Harness<'_, EffectcraftApp>, kind: ThemeKind, scale: f3
 
 fn scroll_controls_to_end(h: &mut Harness<'_, EffectcraftApp>) {
     h.event(Event::PointerMoved(pos2(150.0, 345.0)));
-    h.event(Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: vec2(-1500.0, 0.0), modifiers: Default::default(), phase: egui::TouchPhase::Move });
+    h.event(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(-1500.0, 0.0),
+        modifiers: Default::default(),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Wheel,
+    });
     h.run_steps(30);
     h.event(Event::PointerMoved(pos2(150.0, 180.0)));
     h.run_steps(3);
@@ -257,10 +280,10 @@ fn viewer_theme_and_width_visual_matrix() {
 }
 
 fn save_stable_snapshot(h: &mut Harness<'_, EffectcraftApp>, path: &str, width: f32) {
-    let image = h.render().unwrap();
+    let image = h.render_serialized().unwrap();
     image.save(path).unwrap();
     h.run_steps(3);
-    let repeated = h.render().unwrap();
+    let repeated = h.render_serialized().unwrap();
     assert!(image == repeated, "settled synthetic viewer pixels must repeat exactly: {path}");
     if width == 900.0 {
         let times: Vec<_> = h
diff --git a/crates/ui-egui/tests/viewer_passive_display.rs b/crates/ui-egui/tests/it/viewer_passive_display.rs
similarity index 100%
rename from crates/ui-egui/tests/viewer_passive_display.rs
rename to crates/ui-egui/tests/it/viewer_passive_display.rs
diff --git a/crates/ui-egui/tests/shared_docking_ui.rs b/crates/ui-egui/tests/shared_docking_ui.rs
deleted file mode 100644
index ad56e68d5..000000000
--- a/crates/ui-egui/tests/shared_docking_ui.rs
+++ /dev/null
@@ -1,426 +0,0 @@
-//! Existing EffectCraft workspaces use shared transactions without changing their saved schema.
-use craft_ui::docking::{Action, Placement, Zone};
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::{
-    EffectcraftApp,
-    dock::{self, DockNode, Layout, PanelKind, SplitSize, StackEntry},
-};
-use egui::{Event, Modifiers, PointerButton, Rect, pos2, vec2};
-use egui_kittest::Harness;
-use egui_kittest::kittest::{NodeT, Queryable};
-use serde_json::json;
-
-#[test]
-fn shared_move_preserves_accordion_metadata_and_unrelated_active_tabs() {
-    let mut layout = Layout {
-        root: DockNode::Split {
-            vertical: false,
-            size: SplitSize::FixedB(300.0),
-            a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::Composition, PanelKind::Layer], active: 1 }),
-            b: Box::new(DockNode::Stack {
-                entries: vec![
-                    StackEntry::new(PanelKind::Preview, false, Some(73.0)),
-                    StackEntry::new(PanelKind::Properties, true, Some(211.0)),
-                    StackEntry::new(PanelKind::Align, false, None),
-                ],
-            }),
-        },
-        floating: vec![],
-    };
-    layout.apply(Action::Close { panel: PanelKind::Project }).unwrap();
-    assert!(layout.root.is_visible(PanelKind::Composition));
-    layout.apply(Action::Move { panel: PanelKind::Preview, anchor: PanelKind::Align, placement: Placement::Tab { before: None } }).unwrap();
-    let DockNode::Split { b, size, .. } = &layout.root else { panic!("split was lost") };
-    assert_eq!(*size, SplitSize::FixedB(300.0));
-    let DockNode::Stack { entries } = b.as_ref() else { panic!("stack was lost") };
-    // Upstream now makes a tab drop join the anchor's accordion frame. Its height belongs
-    // to the destination frame; the unrelated Properties frame keeps its exact metadata.
-    let joined = entries.iter().find(|entry| entry.contains(PanelKind::Preview)).unwrap();
-    assert_eq!(joined.panels, vec![PanelKind::Align, PanelKind::Preview]);
-    assert_eq!(joined.shown(), Some(PanelKind::Preview));
-    assert!(joined.open);
-    assert_eq!(joined.height, None);
-    assert_eq!(entries.iter().find(|entry| entry.contains(PanelKind::Properties)).unwrap(), &StackEntry::new(PanelKind::Properties, true, Some(211.0)));
-    let before = layout.clone();
-    assert!(layout.apply(Action::Move { panel: PanelKind::Preview, anchor: PanelKind::Audio, placement: Placement::Split(Zone::Left) }).is_err());
-    assert_eq!(layout, before);
-    assert!(layout.apply(Action::Float { panel: PanelKind::Preview, rect: [0.0, 0.0, f32::INFINITY, 200.0] }).is_err());
-    assert_eq!(layout, before);
-}
-
-#[test]
-fn every_builtin_workspace_and_dynamic_identity_roundtrips() {
-    for name in dock::WORKSPACES {
-        let mut layout = Layout { root: dock::workspace(name), floating: dock::workspace_floating(name) };
-        let before = serde_json::to_value(&layout).unwrap();
-        // A structural no-op still crosses both adapters and shared validation. The complete
-        // persisted shape must remain byte-equivalent, including accordion state and heights.
-        let action = match &layout.root {
-            DockNode::Split { size, .. } => Action::ResizeSplit {
-                path: vec![],
-                size: match *size {
-                    SplitSize::Ratio(v) => craft_ui::layout::SplitSize::Ratio(v),
-                    SplitSize::FixedA(v) => craft_ui::layout::SplitSize::FixedFirst(v),
-                    SplitSize::FixedB(v) => craft_ui::layout::SplitSize::FixedSecond(v),
-                },
-            },
-            DockNode::Tabs { panels, .. } => Action::Move { panel: panels[0], anchor: panels[1], placement: Placement::Tab { before: Some(panels[0]) } },
-            DockNode::Stack { entries } => Action::SetStackOpen { panel: entries[0].shown().unwrap(), open: entries[0].open },
-        };
-        layout.apply(action).unwrap();
-        assert_eq!(before, serde_json::to_value(&layout).unwrap());
-        let back: Layout = serde_json::from_value(before).unwrap();
-        assert_eq!(layout, back);
-    }
-    let mut layout = Layout {
-        root: DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Viewer(42), PanelKind::ScriptPanel(77)], active: 1 },
-        floating: vec![],
-    };
-    layout.apply(Action::Float { panel: PanelKind::ScriptPanel(77), rect: [20.0, 30.0, 400.0, 300.0] }).unwrap();
-    layout.apply(Action::Move { panel: PanelKind::ScriptPanel(77), anchor: PanelKind::Viewer(42), placement: Placement::Tab { before: None } }).unwrap();
-    assert!(layout.floating.is_empty());
-    assert!(layout.contains(PanelKind::Viewer(42)));
-    assert!(layout.root.is_visible(PanelKind::ScriptPanel(77)));
-}
-
-fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
-    let element = h.state().auto.find(id).unwrap_or_else(|| panic!("missing {id}"));
-    Rect::from_min_size(pos2(element.rect[0], element.rect[1]), vec2(element.rect[2], element.rect[3]))
-}
-fn drag(h: &mut Harness<'_, EffectcraftApp>, from: egui::Pos2, to: egui::Pos2, modifiers: Modifiers) {
-    h.event(Event::ModifiersChanged(modifiers));
-    h.event(Event::PointerMoved(from));
-    h.step();
-    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers });
-    h.step();
-    for fraction in [0.05, 0.25, 0.5, 0.75, 1.0] {
-        h.event(Event::PointerMoved(from.lerp(to, fraction)));
-        h.step();
-    }
-    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers });
-    h.step();
-    h.event(Event::ModifiersChanged(Modifiers::NONE));
-    h.run_steps(3);
-}
-
-#[test]
-fn pointer_drop_merges_floats_and_redocks_without_project_changes() {
-    let mut session = Session::default();
-    session.execute("comp.new", json!({"name": "Docking composition", "width": 320, "height": 180, "duration": 4})).unwrap();
-    session.execute("layer.newSolid", json!({"name": "Teal plate", "width": 320, "height": 180, "color": "#245b68"})).unwrap();
-    session.execute("layer.newSolid", json!({"name": "Coral tile", "width": 110, "height": 70, "color": "#ee7859"})).unwrap();
-    let mut app = EffectcraftApp::new(session);
-    app.ui.start_screen = false;
-    app.ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(400.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::Info, PanelKind::Audio], active: 1 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Layer], active: 0 }),
-    };
-    app.ui.dock = DockNode::Split {
-        vertical: true,
-        size: SplitSize::Ratio(0.62),
-        a: Box::new(app.ui.dock),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Timeline], active: 0 }),
-    };
-    let snapshots = std::env::var_os("CRAFT_UI_DOCKING_SNAPSHOT_DIR").map(std::path::PathBuf::from);
-    let mut builder = Harness::builder().with_size(vec2(1200.0, 760.0));
-    if snapshots.is_some() {
-        builder = builder.wgpu();
-    }
-    let mut h = builder.build_eframe(move |_| app);
-    h.run_steps(4);
-    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
-    while h.state().frames.urgent_pending() && std::time::Instant::now() < deadline {
-        std::thread::sleep(std::time::Duration::from_millis(1));
-    }
-    assert!(!h.state().frames.urgent_pending());
-    h.run_steps(3);
-    let project = h.state().session.project.clone();
-    let times = h.state().session.state.times.clone();
-    let mut action_log = vec![action_state(&h, "start")];
-    let from = rect(&h, "panel.tab.Info").center();
-    let to = rect(&h, "panel.Composition").center();
-    drag(&mut h, from, to, Modifiers::NONE);
-    assert!(h.state().ui.dock.is_visible(PanelKind::Info));
-    assert!(same_group(&h.state().ui.dock, PanelKind::Info, PanelKind::Composition));
-    action_log.push(action_state(&h, "merged"));
-    let from = rect(&h, "panel.tab.Info").center();
-    let before = rect(&h, "panel.tab.Composition");
-    drag(&mut h, from, pos2(before.left() + 2.0, before.center().y), Modifiers::NONE);
-    assert_eq!(tabs_containing(&h.state().ui.dock, PanelKind::Info).first(), Some(&PanelKind::Info));
-    action_log.push(action_state(&h, "reordered"));
-
-    let from = rect(&h, "panel.tab.Info").center();
-    drag(&mut h, from, pos2(700.0, 400.0), Modifiers::COMMAND);
-    assert_eq!(h.state().ui.floating.len(), 1);
-    assert_eq!(h.get_by_label("Resize floating panel").accesskit_node().role(), egui::accesskit::Role::Button);
-    action_log.push(action_state(&h, "floated"));
-    let original = h.state().ui.floating[0].rect;
-    let grip = rect(&h, "panel.float.0.resize").center();
-    drag(&mut h, grip, grip + vec2(36.0, 24.0), Modifiers::NONE);
-    assert!(h.state().ui.floating[0].rect[2] > original[2] + 25.0);
-    assert!(h.state().ui.floating[0].rect[3] > original[3] + 15.0);
-    action_log.push(action_state(&h, "resized"));
-    let grip_id = egui::Id::new(("floating-panel", PanelKind::Info.id())).with("resize");
-    assert_eq!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
-    let before_keys = h.state().ui.floating[0].rect;
-    for key in [egui::Key::ArrowRight, egui::Key::ArrowDown] {
-        for pressed in [true, false] {
-            h.event(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
-            h.step();
-        }
-    }
-    assert_eq!(h.state().ui.floating[0].rect[2], before_keys[2] + 8.0);
-    assert_eq!(h.state().ui.floating[0].rect[3], before_keys[3] + 8.0);
-    h.event(Event::Key { key: egui::Key::Tab, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-    h.step();
-    h.event(Event::Key { key: egui::Key::Tab, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
-    h.run_steps(3);
-    assert_ne!(h.ctx.memory(|memory| memory.focused()), Some(grip_id));
-    action_log.push(action_state(&h, "keyboard-resized"));
-    let resized = h.state().ui.floating[0].rect;
-    let header = rect(&h, "panel.float.0.move");
-    let from = pos2(header.right() - 24.0, header.center().y);
-    drag(&mut h, from, from - vec2(24.0, 18.0), Modifiers::NONE);
-    assert!(h.state().ui.floating[0].rect[0] < resized[0] - 15.0);
-    assert!(h.state().ui.floating[0].rect[1] < resized[1] - 10.0);
-    action_log.push(action_state(&h, "moved"));
-
-    if let Some(directory) = &snapshots {
-        std::fs::create_dir_all(directory).unwrap();
-        h.render().unwrap().save(directory.join("effectcraft-floating.png")).unwrap();
-    }
-    let from = rect(&h, "panel.tab.Info").center();
-    let to = rect(&h, "panel.Audio").center();
-    drag(&mut h, from, to, Modifiers::NONE);
-    assert!(h.state().ui.floating.is_empty());
-    action_log.push(action_state(&h, "redocked"));
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-    assert_eq!(times, h.state().session.state.times);
-    assert!(h.state().auto.elements.iter().any(|element| element.id.starts_with("timeline.layer.")));
-    h.state_mut().session.execute("view.exposure", json!({"stops": 2.0})).unwrap();
-    h.run_steps(3);
-    let pos = rect(&h, "viewer.resetExposure").center();
-    h.event(Event::PointerMoved(pos));
-    h.step();
-    for pressed in [true, false] {
-        h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
-        h.step();
-    }
-    h.run_steps(3);
-    assert_eq!(h.state().session.state.viewer.exposure, 0.0);
-    action_log.push(action_state(&h, "viewer-reset-exposure"));
-    if let Some(directory) = &snapshots {
-        std::fs::write(directory.join("effectcraft-actions.json"), serde_json::to_vec_pretty(&action_log).unwrap()).unwrap();
-    }
-    if let Some(directory) = &snapshots {
-        h.render().unwrap().save(directory.join("effectcraft-redocked.png")).unwrap();
-    }
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-}
-
-fn same_group(root: &DockNode, first: PanelKind, second: PanelKind) -> bool {
-    match root {
-        DockNode::Tabs { panels, .. } => panels.contains(&first) && panels.contains(&second),
-        DockNode::Split { a, b, .. } => same_group(a, first, second) || same_group(b, first, second),
-        DockNode::Stack { .. } => false,
-    }
-}
-
-#[test]
-fn current_and_named_floating_layouts_survive_restart() {
-    use effectcraft_engine::config::MemoryConfig;
-    use std::sync::Arc;
-    let store = Arc::new(MemoryConfig::default());
-    let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
-    assert!(app.edit_layout(|layout| layout.apply(Action::Float { panel: PanelKind::Project, rect: [45.0, 65.0, 430.0, 310.0] }).is_ok()));
-    let ctx = egui::Context::default();
-    effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.saveWorkspaceAs", json!({"name": "Shared float"})).unwrap();
-    let saved = app.ui.floating.clone();
-    assert!(app.edit_layout(|layout| layout.apply(Action::MoveFloating { panel: PanelKind::Project, rect: [75.0, 95.0, 480.0, 360.0] }).is_ok()));
-    let current = app.ui.floating.clone();
-    eframe::App::on_exit(&mut app);
-    let mut restarted = EffectcraftApp::new(Session { config: Some(store), ..Default::default() });
-    assert_eq!(restarted.ui.floating, current);
-    restarted.set_workspace("Default");
-    restarted.set_workspace("Shared float");
-    assert_eq!(restarted.ui.floating, saved);
-}
-
-fn tabs_containing(root: &DockNode, panel: PanelKind) -> Vec<PanelKind> {
-    match root {
-        DockNode::Tabs { panels, .. } if panels.contains(&panel) => panels.clone(),
-        DockNode::Split { a, b, .. } => {
-            let first = tabs_containing(a, panel);
-            if first.is_empty() { tabs_containing(b, panel) } else { first }
-        }
-        _ => vec![],
-    }
-}
-
-#[test]
-fn float_command_rejects_malformed_rectangles_atomically() {
-    let mut app = EffectcraftApp::new(Session::default());
-    let before = app.ui.dock.clone();
-    let ctx = egui::Context::default();
-    for rect in [json!([1, 2, 300]), json!([1, 2, 300, 200, 7]), json!([1, 2, 1e100, 200]), json!("rectangle")] {
-        assert!(effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.floatPanel", json!({"panel": "Project", "rect": rect})).is_err());
-        assert_eq!(app.ui.dock, before);
-        assert!(app.ui.floating.is_empty());
-    }
-    app.ui.dock = DockNode::Tabs { panels: vec![PanelKind::Project], active: 0 };
-    assert!(!app.edit_layout(|layout| layout.apply(Action::Float { panel: PanelKind::Project, rect: [1.0, 2.0, 300.0, 200.0] }).is_ok()));
-}
-
-/// A floating panel dragged past the window's bottom edge is drawn where its rect says: it was
-/// shifted back into the window while its rect kept moving, and its strip then clashed with the
-/// floating area's own widget ("Double use of widget ID").
-#[test]
-fn floating_panel_dragged_past_the_window_edge_is_drawn_at_its_rect() {
-    let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(Session::default()));
-    h.run_steps(3);
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.floatPanel", json!({"panel": "Preview", "rect": [600.0, 400.0, 360.0, 300.0]})).unwrap();
-    h.run_steps(3);
-    let strip = rect(&h, "panel.float.0.move");
-    let from = pos2(strip.right() - 24.0, strip.center().y);
-    drag(&mut h, from, from + vec2(40.0, 420.0), Modifiers::NONE);
-    let moved = h.state().ui.floating[0].rect;
-    assert!(moved[1] + moved[3] > 1000.0, "the panel hangs past the bottom edge: {moved:?}");
-    let strip = rect(&h, "panel.float.0.move");
-    assert_eq!([strip.min.x, strip.min.y], [moved[0], moved[1]]);
-    // The strip still moves it from there.
-    let from = pos2(strip.right() - 24.0, strip.center().y);
-    drag(&mut h, from, from - vec2(30.0, 200.0), Modifiers::NONE);
-    assert_eq!(h.state().ui.floating[0].rect[1], moved[1] - 200.0);
-}
-
-fn action_state(h: &Harness<'_, EffectcraftApp>, action: &str) -> serde_json::Value {
-    json!({"action": action, "dock": h.state().ui.dock, "floating": h.state().ui.floating, "focused": h.state().ui.focused})
-}
-
-#[test]
-fn catalog_docking_action_supports_resize_reorder_and_floating_geometry() {
-    let mut app = EffectcraftApp::new(Session::default());
-    app.ui.dock = DockNode::Split {
-        vertical: false,
-        size: SplitSize::FixedA(300.0),
-        a: Box::new(DockNode::Tabs { panels: vec![PanelKind::Project, PanelKind::Info], active: 1 }),
-        b: Box::new(DockNode::Tabs { panels: vec![PanelKind::Composition], active: 0 }),
-    };
-    let ctx = egui::Context::default();
-    for action in [
-        Action::ResizeSplit { path: vec![], size: craft_ui::layout::SplitSize::FixedFirst(360.0) },
-        Action::Move { panel: PanelKind::Info, anchor: PanelKind::Project, placement: Placement::Tab { before: Some(PanelKind::Project) } },
-        Action::Float { panel: PanelKind::Info, rect: [20.0, 40.0, 300.0, 200.0] },
-        Action::MoveFloating { panel: PanelKind::Info, rect: [45.0, 65.0, 330.0, 240.0] },
-    ] {
-        effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.dockAction", json!({"action": action})).unwrap();
-    }
-    assert_eq!(app.ui.floating[0].rect, [45.0, 65.0, 330.0, 240.0]);
-    let DockNode::Split { size, .. } = &app.ui.dock else { panic!("split lost") };
-    assert_eq!(*size, SplitSize::FixedA(360.0));
-    let before = json!({"dock": app.ui.dock, "floating": app.ui.floating});
-    assert!(
-        effectcraft_ui_egui::menus::invoke(
-            &mut app,
-            &ctx,
-            "window.dockAction",
-            json!({"action": {
-                "ResizeSplit": {"path": [true, true], "size": {"Ratio": 0.5}}
-            }})
-        )
-        .is_err()
-    );
-    assert_eq!(json!({"dock": app.ui.dock, "floating": app.ui.floating}), before);
-}
-
-#[test]
-fn catalog_close_keeps_dynamic_panel_identity() {
-    let mut app = EffectcraftApp::new(Session::default());
-    app.ui.dock = DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Viewer(42), PanelKind::ScriptPanel(77)], active: 1 };
-    let ctx = egui::Context::default();
-    for panel in [PanelKind::Viewer(42), PanelKind::ScriptPanel(77)] {
-        effectcraft_ui_egui::menus::invoke(&mut app, &ctx, "window.dockAction", json!({"action": Action::Close { panel }})).unwrap();
-        assert!(!app.ui.dock.contains(panel));
-    }
-    assert!(app.ui.dock.contains(PanelKind::Composition));
-}
-
-#[test]
-fn accordion_resize_routes_pointer_and_keyboard_without_changing_closed_entries() {
-    let mut session = Session::default();
-    session.execute("comp.new", json!({"width": 160, "height": 90, "duration": 1})).unwrap();
-    let mut app = EffectcraftApp::new(session);
-    app.ui.start_screen = false;
-    let mut h = Harness::builder().with_size(vec2(1000.0, 720.0)).build_eframe(move |_| app);
-    h.run_steps(4);
-    h.state_mut().ui.dock = DockNode::Stack {
-        entries: vec![
-            StackEntry::new(PanelKind::Preview, true, Some(100.0)),
-            StackEntry::new(PanelKind::Properties, true, None),
-            StackEntry::new(PanelKind::Align, false, Some(77.0)),
-        ],
-    };
-    h.run_steps(3);
-    let project = h.state().session.project.clone();
-    let id = egui::Id::new(("dock-gutter", "s0".to_string()));
-    h.ctx.memory_mut(|memory| memory.request_focus(id));
-    h.run_steps(2);
-    for pressed in [true, false] {
-        h.event(Event::Key { key: egui::Key::ArrowDown, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
-        h.step();
-    }
-    let DockNode::Stack { entries } = &h.state().ui.dock else { panic!("stack lost") };
-    assert_eq!(entries[0].height, Some(108.0));
-    let from = rect(&h, "dock.gutter.s0").center();
-    drag(&mut h, from, from + vec2(0.0, 16.0), Modifiers::NONE);
-    let DockNode::Stack { entries } = &h.state().ui.dock else { panic!("stack lost") };
-    assert_eq!(entries[0].height, Some(124.0));
-    assert_eq!(entries[1].height, None);
-    assert_eq!(entries[2], StackEntry::new(PanelKind::Align, false, Some(77.0)));
-    assert!(std::sync::Arc::ptr_eq(&project, &h.state().session.project));
-}
-
-#[test]
-fn legacy_close_repairs_selection_but_transactions_remain_strict() {
-    use effectcraft_ui_egui::dock::Floating;
-    let mut root = DockNode::Tabs { panels: vec![PanelKind::Properties, PanelKind::Align, PanelKind::EffectsPresets], active: usize::MAX };
-    root.close(PanelKind::History);
-    assert!(root.is_visible(PanelKind::EffectsPresets));
-    let mut layout = Layout {
-        root: DockNode::Tabs { panels: vec![PanelKind::Composition], active: 0 },
-        floating: vec![Floating {
-            panels: vec![PanelKind::Properties, PanelKind::Align, PanelKind::EffectsPresets],
-            active: usize::MAX,
-            rect: [0.0, 0.0, 300.0, 200.0],
-        }],
-    };
-    let before = layout.clone();
-    assert!(layout.apply(Action::Close { panel: PanelKind::Properties }).is_err());
-    assert_eq!(layout, before);
-    assert!(layout.unfloat(PanelKind::Properties));
-    assert_eq!(layout.floating[0].panels.get(layout.floating[0].active), Some(&PanelKind::EffectsPresets));
-    layout.floating[0].rect = [0.0; 4];
-    let before = layout.clone();
-    assert!(!layout.unfloat(PanelKind::Align));
-    assert_eq!(layout, before);
-}
-
-#[test]
-fn failed_close_preserves_viewer_lifecycle_and_maximize_state() {
-    let mut app = EffectcraftApp::new(Session::default());
-    app.ui.dock = DockNode::Tabs { panels: vec![PanelKind::Composition, PanelKind::Viewer(42)], active: usize::MAX };
-    app.ui.maximized = Some(PanelKind::Viewer(42));
-    app.ui.viewers.insert(42, None);
-    app.ui.active_viewer = 42;
-    app.ui.locked_tabs.insert(PanelKind::Viewer(42).id());
-    let before = app.ui.clone();
-    app.close_panel(PanelKind::Viewer(42));
-    assert_eq!(app.ui.dock, before.dock);
-    assert_eq!(app.ui.maximized, before.maximized);
-    assert_eq!(app.ui.viewers, before.viewers);
-    assert_eq!(app.ui.active_viewer, before.active_viewer);
-    assert_eq!(app.ui.locked_tabs, before.locked_tabs);
-}
diff --git a/crates/ui-egui/tests/ui_audio_scrub.rs b/crates/ui-egui/tests/ui_audio_scrub.rs
deleted file mode 100644
index 02fefb14f..000000000
--- a/crates/ui-egui/tests/ui_audio_scrub.rs
+++ /dev/null
@@ -1,194 +0,0 @@
-//! Audio scrubbing: Ctrl/Cmd-dragging the current time plays one frame of the comp's mix at each
-//! new frame (each snippet replacing what is still queued); holding still repeats nothing; silent
-//! comps open no output; an idle scrub closes it. Previews with audio wait for frames.
-
-use std::sync::{Arc, Mutex};
-
-use effectcraft_engine::Session;
-use effectcraft_engine::project::ItemId;
-use effectcraft_engine::time::Tick;
-use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::audio::{AudioDevice, AudioFeed};
-use egui::{Event, Modifiers, pos2};
-use egui_kittest::Harness;
-use serde_json::json;
-
-/// An output that records the feed it is given and whether it was stopped.
-#[derive(Clone, Default)]
-struct Fake(Arc<Mutex<(Option<Arc<AudioFeed>>, bool)>>);
-
-impl AudioDevice for Fake {
-    fn sample_rate(&self) -> u32 {
-        48000
-    }
-    fn start(&mut self, feed: Arc<AudioFeed>) -> Result<(), String> {
-        self.0.lock().unwrap().0 = Some(feed);
-        Ok(())
-    }
-    fn stop(&mut self) {
-        self.0.lock().unwrap().1 = true;
-    }
-}
-
-/// A 2 s, 30 fps comp whose solid sounds a tone (Audio switch on).
-fn setup(audible: bool, fake: &Fake) -> (EffectcraftApp, ItemId) {
-    setup_long(audible, fake, 2.0)
-}
-
-/// A `duration`-second, 30 fps comp whose solid sounds a tone (Audio switch on).
-fn setup_long(audible: bool, fake: &Fake, duration: f64) -> (EffectcraftApp, ItemId) {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "A", "width": 64, "height": 36, "frameRate": 30, "duration": duration})).unwrap();
-    let cid = s.active_comp_id().unwrap();
-    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
-    if audible {
-        s.execute("effect.apply", json!({"layers": [l], "effect": "ec.audio.tone"})).unwrap();
-        s.execute("layer.setSwitch", json!({"layers": [l], "switch": "audio", "value": true})).unwrap();
-    }
-    let mut app = EffectcraftApp::new(s);
-    let f = fake.clone();
-    app.hooks.audio_device = Some(Box::new(move |_| Some(Box::new(f.clone()) as Box<dyn AudioDevice>)));
-    (app, cid)
-}
-
-#[test]
-fn scrubbing_plays_one_frame_per_new_frame() {
-    let fake = Fake::default();
-    let (mut app, cid) = setup(true, &fake);
-    let t = |s: f64| Tick::from_seconds_f64(s);
-    app.scrub_audio(cid, t(0.5), 0.0);
-    let feed = fake.0.lock().unwrap().0.clone().expect("the output opened");
-    // One 30 fps frame at 48 kHz, and not silence.
-    assert_eq!(feed.queued_frames(), 1600);
-    let mut out = vec![0.0f32; 3200];
-    feed.pull(&mut out);
-    assert!(out.iter().any(|v| v.abs() > 0.01), "the tone is there");
-    // Faded in: the first sample is silent.
-    assert_eq!(out[0], 0.0);
-    // The same frame again plays nothing; the next frame replaces what is left.
-    app.scrub_audio(cid, t(0.51), 0.1);
-    assert_eq!(feed.queued_frames(), 0);
-    feed.push(&[0.0; 1000]);
-    app.scrub_audio(cid, t(0.6), 0.2);
-    assert_eq!(feed.queued_frames(), 1600, "replaced, not piled up");
-    // A silent comp opens nothing.
-    let silent = Fake::default();
-    let (mut quiet, qid) = setup(false, &silent);
-    quiet.scrub_audio(qid, t(0.5), 0.0);
-    assert!(silent.0.lock().unwrap().0.is_none() && quiet.scrub.is_none());
-}
-
-#[test]
-fn cmd_dragging_the_current_time_scrubs_and_an_idle_scrub_closes() {
-    let fake = Fake::default();
-    let (app, _) = setup(true, &fake);
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| app);
-    h.run_steps(3);
-    let cti = h.state().auto.find("timeline.cti").expect("current time indicator").clone();
-    let from = pos2(cti.rect[0] + cti.rect[2] / 2.0, cti.rect[1] + cti.rect[3] / 2.0);
-    let cmd = Modifiers::COMMAND;
-    h.event(Event::ModifiersChanged(cmd));
-    h.event(Event::PointerMoved(from));
-    h.step();
-    h.event(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: cmd });
-    h.step();
-    for k in 1..=4 {
-        h.event(Event::PointerMoved(from + egui::vec2(40.0 * k as f32, 0.0)));
-        h.step();
-    }
-    assert!(h.state().scrub.is_some(), "Cmd-drag opened the scrub output");
-    assert!(fake.0.lock().unwrap().0.as_ref().is_some_and(|f| f.queued_frames() > 0));
-    h.event(Event::PointerButton { pos: from + egui::vec2(160.0, 0.0), button: egui::PointerButton::Primary, pressed: false, modifiers: cmd });
-    h.step();
-    h.event(Event::ModifiersChanged(Modifiers::NONE));
-    h.step();
-    // An idle second closes the output.
-    for _ in 0..90 {
-        h.step();
-        std::thread::sleep(std::time::Duration::from_millis(15));
-        if h.state().scrub.is_none() {
-            break;
-        }
-    }
-    assert!(h.state().scrub.is_none() && fake.0.lock().unwrap().1, "closed and stopped");
-}
-
-/// A preview with audio waits for frames like a silent one (#103): while the frames ahead aren't
-/// cached, every frame shows as it renders, silently; the sound starts once the rest of the
-/// preview is cached, and a frame that isn't cached stops it instead of being skipped.
-#[test]
-fn preview_with_audio_shows_every_frame_and_sounds_once_cached() {
-    let fake = Fake::default();
-    let (mut app, cid) = setup(true, &fake);
-    // Playback requests at most twice as many frames ahead per step as there are render threads.
-    // Four times that many frames take at least four steps to cache, so frames are shown silently
-    // first however fast the renderer is (with a fixed 2 s comp, a machine with many cores cached
-    // all of it before the first step and the sound started at once).
-    let ahead = (app.frames.parallelism() * 2).max(4);
-    app.session.execute("comp.settings", json!({"comp": cid.0, "duration": (4 * ahead) as f64 / 30.0})).unwrap();
-    // A little under one frame of input time per step.
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 31.0).build_eframe(|_| app);
-    h.run_steps(2);
-    let frame = |h: &Harness<'_, EffectcraftApp>| {
-        let app = h.state();
-        app.session.project.comp(cid).unwrap().frame_rate.frame_at(app.session.time())
-    };
-    let now = h.ctx.input(|i| i.time);
-    h.state_mut().play(now);
-    assert!(h.state().playback.audio_held && h.state().audio.is_none(), "nothing is cached: no sound yet");
-    let mut last = frame(&h);
-    let mut shown = 0;
-    // Wait on the clock, not a step count: under a loaded machine (parallel test binaries) the
-    // background cache can take far longer than 2000 short steps to get ahead.
-    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(60);
-    while std::time::Instant::now() < deadline {
-        h.step();
-        if h.state().audio.is_some() {
-            break;
-        }
-        let f = frame(&h);
-        assert!(f == last || f == last + 1 || f < last, "{last} → {f}: a frame was skipped");
-        shown += usize::from(f != last);
-        last = f;
-        std::thread::sleep(std::time::Duration::from_millis(1));
-    }
-    assert!(h.state().audio.is_some() && fake.0.lock().unwrap().0.is_some(), "the sound started once the frames ahead were cached");
-    assert!(shown > 0, "frames played silently first");
-    // A frame that isn't cached stops the sound rather than being skipped. (Frames render fast
-    // enough here to be cached again before the check: keep them out of the cache.)
-    h.state().frames.set_budget(0);
-    h.state().frames.clear();
-    h.step();
-    assert!(h.state().audio.is_none() && h.state().playback.audio_held && h.state().playback.playing);
-}
-
-/// A preview whose frames render in real time sounds without waiting for the whole work area to
-/// be cached (#208): once the silent preview has kept up for a moment with the frames ahead
-/// cached, the sound starts, still without skipping a frame before it.
-#[test]
-fn preview_with_audio_sounds_once_rendering_keeps_up() {
-    let fake = Fake::default();
-    let (app, cid) = setup_long(true, &fake, 30.0);
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 30.0).build_eframe(|_| app);
-    h.run_steps(2);
-    let frame = |h: &Harness<'_, EffectcraftApp>| {
-        let app = h.state();
-        app.session.project.comp(cid).unwrap().frame_rate.frame_at(app.session.time())
-    };
-    let now = h.ctx.input(|i| i.time);
-    h.state_mut().play(now);
-    assert!(h.state().playback.audio_held && h.state().audio.is_none(), "nothing is cached: no sound yet");
-    let mut last = frame(&h);
-    // Two seconds of playback, each step giving the frame workers time to keep up.
-    for _ in 0..60 {
-        h.step();
-        if h.state().audio.is_some() {
-            break;
-        }
-        let f = frame(&h);
-        assert!(f == last || f == last + 1, "{last} → {f}: a frame was skipped");
-        last = f;
-        std::thread::sleep(std::time::Duration::from_millis(20));
-    }
-    assert!(h.state().audio.is_some() && fake.0.lock().unwrap().0.is_some(), "the sound started within 2 s, at frame {last} of 900");
-}
diff --git a/crates/ui-egui/tests/ui_comp_presets.rs b/crates/ui-egui/tests/ui_comp_presets.rs
deleted file mode 100644
index 0b0b30720..000000000
--- a/crates/ui-egui/tests/ui_comp_presets.rs
+++ /dev/null
@@ -1,85 +0,0 @@
-//! Composition Settings: saving, picking and deleting your own presets (egui_kittest).
-
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::{Dialog, EffectcraftApp};
-use egui::{Event, Key, Modifiers, PointerButton, Pos2, pos2};
-use egui_kittest::Harness;
-use serde_json::json;
-
-fn harness() -> Harness<'static, EffectcraftApp> {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Edit", "width": 2560, "height": 1440, "frameRate": 60, "duration": 4})).unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| EffectcraftApp::new(s));
-    h.run_steps(3);
-    h
-}
-
-fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
-    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
-    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
-}
-
-fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
-    let p = center(h, id);
-    h.input_mut().events.push(Event::PointerMoved(p));
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    h.run_steps(1);
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    // The automation registry still holds the previous frame's elements: one more frame.
-    h.run_steps(3);
-}
-
-fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key) {
-    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
-    h.run_steps(3);
-}
-
-fn open_settings(h: &mut Harness<'_, EffectcraftApp>) {
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "comp.settings", json!({})).unwrap();
-    h.run_steps(3);
-    assert_eq!(h.state().dialog, Some(Dialog::CompSettings));
-}
-
-fn preset_names(h: &Harness<'_, EffectcraftApp>) -> Vec<String> {
-    h.state().session.prefs.comp_presets.iter().map(|q| q.name.clone()).collect()
-}
-
-/// Save the comp's size and rate as a preset (Enter saves without pressing OK), then delete it.
-#[test]
-fn composition_settings_save_and_delete_your_own_preset() {
-    let mut h = harness();
-    open_settings(&mut h);
-    assert!(h.state().auto.find("dialog.comp.presetDelete").is_none(), "nothing of yours to delete yet");
-    click(&mut h, "dialog.comp.presetSave");
-    // Choose Name opens with the keyboard in its field.
-    h.input_mut().events.push(Event::Text("1440p 60".into()));
-    h.run_steps(2);
-    key(&mut h, Key::Enter);
-    assert_eq!(preset_names(&h), ["1440p 60"]);
-    let q = &h.state().session.prefs.comp_presets[0];
-    assert_eq!((q.width, q.height, q.pixel_aspect, q.frame_rate), (2560, 1440, 1.0, 60.0));
-    assert_eq!(h.state().dialog, Some(Dialog::CompSettings), "Enter in the name field doesn't press OK");
-    assert!(h.state().auto.find("dialog.comp.presetName").is_none(), "the name row closes");
-    // The comp's values are now that preset, so it can be deleted.
-    click(&mut h, "dialog.comp.presetDelete");
-    assert!(preset_names(&h).is_empty());
-    assert!(h.state().auto.find("dialog.comp.presetDelete").is_none());
-}
-
-/// A built-in preset's name can't be taken; Cancel closes the name row without saving.
-#[test]
-fn a_preset_name_cannot_be_a_built_in_one() {
-    let mut h = harness();
-    open_settings(&mut h);
-    click(&mut h, "dialog.comp.presetSave");
-    click(&mut h, "dialog.comp.presetName");
-    h.input_mut().events.push(Event::Text("HDTV 1080 24".into()));
-    h.run_steps(2);
-    click(&mut h, "dialog.comp.presetNameSave");
-    assert!(preset_names(&h).is_empty(), "the built-in name is refused");
-    click(&mut h, "dialog.comp.presetNameCancel");
-    assert!(h.state().auto.find("dialog.comp.presetName").is_none());
-    assert!(preset_names(&h).is_empty());
-}
diff --git a/crates/ui-egui/tests/ui_gpu.rs b/crates/ui-egui/tests/ui_gpu.rs
deleted file mode 100644
index 906ac0cd1..000000000
--- a/crates/ui-egui/tests/ui_gpu.rs
+++ /dev/null
@@ -1,119 +0,0 @@
-//! The viewer on the GPU compositor (egui_kittest with wgpu): frames composited on the GPU match
-//! the CPU viewer. Skips without a GPU adapter (CI). Set `EC_SNAPSHOT_DIR` to keep PNGs.
-
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::EffectcraftApp;
-use egui_kittest::Harness;
-use serde_json::json;
-
-fn settle(h: &mut Harness<'_, EffectcraftApp>) {
-    for _ in 0..600 {
-        h.step();
-        if h.state().frames.inflight() == 0 && h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false) {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(20));
-    }
-    for _ in 0..4 {
-        h.step();
-    }
-}
-
-/// egui_kittest's wgpu setup on the adapter the headless compositor picked (`name (Backend)`),
-/// like the desktop app's window. Left alone, egui_kittest prefers a CPU adapter, which on
-/// Windows is WARP on DirectX 12, where FXC fails to compile the compositor's kernels: the
-/// viewer would stay on the CPU and the comparison would never run.
-fn same_adapter(name: String) -> eframe::egui_wgpu::WgpuSetup {
-    let mut setup = egui_kittest::wgpu::default_wgpu_setup();
-    if let eframe::egui_wgpu::WgpuSetup::CreateNew(c) = &mut setup {
-        let fallback = c.native_adapter_selector.take();
-        c.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
-            let named = |a: &&eframe::wgpu::Adapter| format!("{} ({:?})", a.get_info().name, a.get_info().backend) == name;
-            match (adapters.iter().find(named), &fallback) {
-                (Some(a), _) => Ok(a.clone()),
-                (None, Some(f)) => f(adapters, surface),
-                (None, None) => adapters.first().cloned().ok_or_else(|| "No adapter found".to_owned()),
-            }
-        }));
-    }
-    setup
-}
-
-#[test]
-fn viewer_draws_gpu_frames_that_match_the_cpu() {
-    let Some(probe) = effectcraft_gpu::Gpu::headless() else {
-        eprintln!("no GPU adapter: skipping");
-        return;
-    };
-    let adapter = effectcraft_engine::render::Accelerator::name(&probe);
-    eprintln!("headless compositor adapter: {adapter}");
-    // egui-wgpu creates its GL device with WebGL2's limits, which the compositor declines.
-    let gl = adapter.ends_with("(Gl)");
-    drop(probe);
-    let mut s = Session::default();
-    s.execute("file.openDemoProject", json!({})).unwrap();
-    s.execute("time.set", json!({"time": 2.0})).unwrap();
-    let mut h = Harness::builder()
-        .with_size(egui::vec2(1400.0, 900.0))
-        .with_pixels_per_point(1.0)
-        .wgpu_setup(same_adapter(adapter))
-        .build_eframe(|_| EffectcraftApp::new(s));
-    settle(&mut h);
-    if gl && h.state().gpu_adapter().is_none() {
-        eprintln!("egui-wgpu's GL device has WebGL2 limits: the viewer stays on the CPU, skipping");
-        return;
-    }
-    assert!(h.state().gpu_adapter().is_some(), "GPU compositor on egui-wgpu's device");
-    eprintln!("viewer compositor adapter: {:?}", h.state().gpu_adapter());
-    let gpu_px = h.state_mut().viewer_pixels().expect("read back the GPU frame");
-    let gpu_shot = h.render().expect("render");
-    // Mercury Software Only: the same frame from the CPU.
-    h.state_mut().session.execute("render.backend", json!({"backend": "cpu"})).unwrap();
-    settle(&mut h);
-    let cpu_px = h.state_mut().viewer_pixels().expect("CPU frame");
-    let cpu_shot = h.render().expect("render");
-    assert_eq!(gpu_px.size, cpu_px.size);
-    let mut worst = 0i32;
-    let mut over = 0usize;
-    for (a, b) in gpu_px.pixels.iter().zip(&cpu_px.pixels) {
-        let d = a.to_array().iter().zip(b.to_array()).map(|(x, y)| (*x as i32 - y as i32).abs()).max().unwrap_or(0);
-        worst = worst.max(d);
-        over += usize::from(d > 1);
-    }
-    assert!(over * 1000 <= gpu_px.pixels.len() * 3 && worst <= 4, "viewer GPU vs CPU: {over} pixels > 1/255, worst {worst}/255");
-    if let Ok(d) = std::env::var("EC_SNAPSHOT_DIR") {
-        gpu_shot.save(format!("{d}/ui_gpu_viewer.png")).unwrap();
-        cpu_shot.save(format!("{d}/ui_cpu_viewer.png")).unwrap();
-    }
-}
-
-/// Once the graphics device is lost, eframe's renderer cannot stage buffers and egui-wgpu
-/// panicked on the main thread drawing the next frame (#591). The app now draws nothing,
-/// auto-saves unsaved changes and closes its window instead.
-#[test]
-fn a_lost_device_draws_nothing_autosaves_and_closes() {
-    let dir = std::env::temp_dir().join(format!("ec-device-lost-{}", std::process::id()));
-    let _ = std::fs::remove_dir_all(&dir);
-    let mut s = Session { autosave_folder_override: Some(dir.clone()), ..Default::default() };
-    s.execute("comp.new", json!({"name": "Unsaved", "width": 64, "height": 64, "duration": 1})).unwrap();
-    assert!(s.is_dirty());
-    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_| EffectcraftApp::new(s));
-    let told = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
-    let log = told.clone();
-    h.state_mut().hooks.device_lost = Some(Box::new(move |saved| log.borrow_mut().push(saved)));
-    h.run_steps(3);
-    assert!(!h.output().shapes.is_empty(), "the UI draws before the loss");
-    let bridge = effectcraft_ui_egui::gpu_failure::GpuFailureBridge::new(&h.ctx);
-    h.state_mut().set_gpu_failure_bridge(bridge.clone());
-    bridge.report("GPU device lost (Unknown): Device is lost", true);
-    h.step();
-    let closing = h.output().viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|v| v.commands.contains(&egui::ViewportCommand::Close));
-    assert!(closing, "the window closes");
-    assert!(h.output().shapes.is_empty(), "nothing for the lost renderer to stage");
-    h.step();
-    assert!(h.output().shapes.is_empty());
-    let saved = h.state().session.autosave.last_path.clone().expect("unsaved changes auto-saved");
-    assert!(std::path::Path::new(&saved).is_file(), "{saved}");
-    assert_eq!(*told.borrow(), vec![Some(Ok(saved))], "the user is told once, with the recovery copy");
-    let _ = std::fs::remove_dir_all(&dir);
-}
diff --git a/crates/ui-egui/tests/ui_graph_fit.rs b/crates/ui-egui/tests/ui_graph_fit.rs
deleted file mode 100644
index c161dfef6..000000000
--- a/crates/ui-egui/tests/ui_graph_fit.rs
+++ /dev/null
@@ -1,79 +0,0 @@
-//! Opening the Graph Editor frames the graphs, as in After Effects: Fit Selection to View when
-//! keys are selected (a key selected in the Timeline shows its property's graph even when the
-//! layer isn't selected), else Fit All Graphs to View. It used to open on an empty 0–100 range
-//! or with the curves off-view.
-
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::EffectcraftApp;
-use egui_kittest::Harness;
-use serde_json::json;
-
-/// A 20 s comp whose Box layer has Rotation keys 300° at 8 s and 720° at 12 s; the Timeline is
-/// zoomed in on 0–4 s, so neither key is in view. Returns the harness and Rotation's uid.
-fn harness(select_layer: bool) -> (Harness<'static, EffectcraftApp>, u64, u64) {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Fit", "width": 320, "height": 180, "frameRate": 30, "duration": 20})).unwrap();
-    s.execute("layer.newSolid", json!({"name": "Box", "color": "#e04020", "width": 80, "height": 80})).unwrap();
-    let id = s.active_comp().unwrap().layers[0].id;
-    for (t, v) in [(8.0, 300.0), (12.0, 720.0)] {
-        s.execute("prop.addKey", json!({"layer": id.0, "path": "transform/rotation", "time": t, "value": v})).unwrap();
-    }
-    let uid = s.active_comp().unwrap().layer(id).unwrap().props.prop("transform/rotation").unwrap().uid;
-    s.execute("layer.select", json!({"layers": if select_layer { vec![id.0] } else { vec![] }})).unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
-    h.state_mut().ui.timeline.pps = Some(300.0);
-    h.state_mut().ui.timeline.start = 0.0;
-    h.run_steps(3);
-    (h, id.0, uid)
-}
-
-fn open_graph(h: &mut Harness<'_, EffectcraftApp>) {
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.graphEditor", json!({})).unwrap();
-    h.run_steps(4);
-    assert!(h.state().ui.timeline.graph_editor);
-}
-
-/// Every key of the property sits inside the plot, and the value range spans `lo..=hi`.
-fn assert_framed(h: &Harness<'_, EffectcraftApp>, uid: u64, keys: &[usize], lo: f64, hi: f64) {
-    let plot = h.state().auto.find("timeline.graph").expect("graph plot").rect;
-    for i in keys {
-        let k = h.state().auto.find(&format!("timeline.graph.key.{uid}.0.{i}")).unwrap_or_else(|| panic!("graph key {i} not drawn")).rect;
-        let (cx, cy) = (k[0] + k[2] / 2.0, k[1] + k[3] / 2.0);
-        assert!(cx > plot[0] && cx < plot[0] + plot[2] && cy > plot[1] && cy < plot[1] + plot[3], "key {i} at ({cx}, {cy}) outside plot {plot:?}");
-    }
-    let (a, b) = h.state().ui.timeline.graph_range.expect("graph range");
-    assert!(a <= lo && b >= hi, "value range {a}..{b} doesn't contain {lo}..{hi}");
-}
-
-#[test]
-fn opening_the_graph_editor_fits_the_selected_key() {
-    let (mut h, layer, uid) = harness(false);
-    h.state_mut().session.execute("keys.select", json!({"keys": [{"layer": layer, "prop": uid, "time": 12.0}]})).unwrap();
-    h.run_steps(2);
-    open_graph(&mut h);
-    // A lone key also frames its neighbour, so its curve shows.
-    assert_framed(&h, uid, &[0, 1], 300.0, 720.0);
-    assert!(!h.state().ui.timeline.graph_auto_zoom, "Fit Selection turns auto-zoom off");
-}
-
-#[test]
-fn opening_the_graph_editor_with_no_keys_selected_fits_all_graphs() {
-    let (mut h, _, uid) = harness(true);
-    open_graph(&mut h);
-    assert_eq!(h.state().ui.timeline.pps, None, "the whole comp in time");
-    assert_framed(&h, uid, &[0, 1], 300.0, 720.0);
-    // Zooming away and toggling the Graph Editor off and on frames it again.
-    h.state_mut().ui.timeline.pps = Some(300.0);
-    h.state_mut().ui.timeline.start = 0.0;
-    open_graph_toggle_twice(&mut h);
-    assert_framed(&h, uid, &[0, 1], 300.0, 720.0);
-}
-
-fn open_graph_toggle_twice(h: &mut Harness<'_, EffectcraftApp>) {
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.graphEditor", json!({})).unwrap();
-    h.run_steps(2);
-    assert!(!h.state().ui.timeline.graph_editor);
-    open_graph(h);
-}
diff --git a/crates/ui-egui/tests/ui_menus.rs b/crates/ui-egui/tests/ui_menus.rs
deleted file mode 100644
index ca4c8cabc..000000000
--- a/crates/ui-egui/tests/ui_menus.rs
+++ /dev/null
@@ -1,246 +0,0 @@
-//! The menu bar from the keyboard, and the app's shortcuts waiting while a menu is open (#279)
-//! (egui_kittest, UI logic only).
-
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::EffectcraftApp;
-use egui::{Event, Key, Modifiers, Pos2, Rect, pos2, vec2};
-use egui_kittest::Harness;
-use egui_kittest::kittest::{NodeT, Queryable};
-use serde_json::json;
-
-fn harness() -> Harness<'static, EffectcraftApp> {
-    let mut s = Session::default();
-    s.execute("file.openDemoProject", json!({})).unwrap();
-    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_| EffectcraftApp::new(s));
-    h.run_steps(3);
-    h
-}
-
-fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
-    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
-    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
-}
-
-fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
-    h.input_mut().events.push(Event::PointerMoved(p));
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
-    h.step();
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
-    h.run_steps(2);
-}
-
-/// Press and release `key` (one frame each), then let the UI settle.
-fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key) {
-    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-    h.step();
-    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
-    h.run_steps(3);
-}
-
-/// The label of the widget with keyboard focus (the highlighted menu entry).
-fn focused(h: &Harness<'_, EffectcraftApp>) -> String {
-    h.query_by(|n| n.is_focused()).and_then(|n| n.accesskit_node().label()).unwrap_or_default().trim().to_string()
-}
-
-fn shown(h: &Harness<'_, EffectcraftApp>, label: &str) -> bool {
-    h.query_by_label_contains(label).is_some()
-}
-
-/// Space (or any shortcut) while a menu is open goes to the menu, not the app: it started the
-/// preview behind the open menu.
-#[test]
-fn shortcuts_wait_while_a_menu_is_open() {
-    let mut h = harness();
-    let edit = rect(&h, "menu.Edit");
-    click_at(&mut h, edit.center());
-    assert!(shown(&h, "Keyboard Shortcuts"), "the Edit menu is open");
-    key(&mut h, Key::Space);
-    assert!(!h.state().playback.playing, "Space didn't start the preview");
-    // With the menu closed, Space previews again.
-    key(&mut h, Key::Escape);
-    assert!(!shown(&h, "Keyboard Shortcuts"), "Escape closed the menu");
-    key(&mut h, Key::Space);
-    assert!(h.state().playback.playing, "Space previews with the menus closed");
-}
-
-/// Alt focuses the menu bar; Down opens the menu, Up / Down move the highlight, Right opens a
-/// submenu and Left closes it, Right on an entry opens the next menu, Escape closes them.
-#[test]
-fn arrow_keys_drive_the_menu_bar() {
-    if cfg!(target_os = "macos") {
-        // (macOS menus are the system's.)
-        return;
-    }
-    let mut h = harness();
-    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::ALT));
-    h.step();
-    h.input_mut().events.push(Event::ModifiersChanged(Modifiers::NONE));
-    h.run_steps(2);
-    assert_eq!(focused(&h), "File", "Alt focused the menu bar");
-    key(&mut h, Key::ArrowDown);
-    assert!(shown(&h, "Open Project"), "Down opened File");
-    assert!(focused(&h).starts_with("New"), "its first entry is highlighted: {:?}", focused(&h));
-    key(&mut h, Key::ArrowRight);
-    assert!(focused(&h).contains("New Project"), "Right opened the New submenu: {:?}", focused(&h));
-    key(&mut h, Key::ArrowDown);
-    assert!(focused(&h).contains("New Project from Template"), "Down moved down the submenu: {:?}", focused(&h));
-    key(&mut h, Key::ArrowLeft);
-    assert!(!shown(&h, "New Project from Template"), "Left closed the submenu");
-    assert!(focused(&h).starts_with("New"), "and went back to its entry: {:?}", focused(&h));
-    key(&mut h, Key::ArrowDown);
-    assert!(focused(&h).contains("Open Project"), "{:?}", focused(&h));
-    key(&mut h, Key::ArrowRight);
-    assert!(!shown(&h, "Open Project"), "Right on an entry left File");
-    assert!(shown(&h, "Keyboard Shortcuts"), "for Edit");
-    key(&mut h, Key::ArrowLeft);
-    assert!(shown(&h, "Open Project"), "Left went back to File");
-    key(&mut h, Key::Escape);
-    assert!(!shown(&h, "Open Project"), "Escape closed the menus");
-    assert!(!h.state().playback.playing, "no key reached the app");
-}
-
-/// Up in a menu opened with the pointer highlights its last entry (wrapping around); Enter on a
-/// submenu entry opens it with its first entry highlighted, and Enter chooses an entry.
-#[test]
-fn enter_chooses_the_highlighted_entry() {
-    let mut h = harness();
-    let edit = rect(&h, "menu.Edit");
-    click_at(&mut h, edit.center());
-    key(&mut h, Key::ArrowUp);
-    if cfg!(target_os = "macos") {
-        assert!(focused(&h).starts_with("Keyboard Shortcuts"), "Up went to the last entry: {:?}", focused(&h));
-        key(&mut h, Key::Enter);
-        assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Shortcuts), "Enter chose it");
-    } else {
-        assert!(focused(&h).starts_with("Preferences"), "Up went to the last entry: {:?}", focused(&h));
-        key(&mut h, Key::Enter);
-        assert!(focused(&h).starts_with("General"), "Enter opened the submenu: {:?}", focused(&h));
-        key(&mut h, Key::Enter);
-        assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Settings), "Enter chose General...");
-    }
-    assert!(!shown(&h, "Quick Apply"), "and closed the menu");
-}
-
-#[test]
-fn relink_menu_uses_engine_availability_and_folder_picker_cancel_is_a_noop() {
-    use std::cell::Cell;
-    use std::rc::Rc;
-
-    let mut app = EffectcraftApp::new(Session::default());
-    let menu = effectcraft_ui_egui::menus::menu_items(&app);
-    let entry = menu.iter().find(|e| e.id == "file.relinkFootage").unwrap();
-    assert_eq!(entry.path, ["File", "Dependencies"]);
-    assert_eq!(entry.enabled, app.session.is_enabled("file.relinkFootage"));
-    assert_eq!(entry.enabled, !cfg!(target_arch = "wasm32"));
-    let picked = Rc::new(Cell::new(false));
-    let flag = picked.clone();
-    app.hooks.pick_folder = Some(Box::new(move || {
-        flag.set(true);
-        None
-    }));
-    let revision = app.session.revision;
-    let result = effectcraft_ui_egui::menus::invoke(&mut app, &egui::Context::default(), "file.relinkFootage", json!({})).unwrap();
-    assert!(picked.get());
-    assert!(result.is_null());
-    assert_eq!(app.session.revision, revision);
-    assert!(app.session.history.undo.is_empty());
-}
-
-#[test]
-fn relink_is_reachable_through_the_dependencies_menu() {
-    use std::cell::Cell;
-    use std::rc::Rc;
-
-    let mut h = harness();
-    let picked = Rc::new(Cell::new(false));
-    let flag = picked.clone();
-    h.state_mut().hooks.pick_folder = Some(Box::new(move || {
-        flag.set(true);
-        None
-    }));
-    let revision = h.state().session.revision;
-    let file = rect(&h, "menu.File");
-    click_at(&mut h, file.center());
-    let dependencies = h.query_by_label_contains("Dependencies").unwrap().rect();
-    h.input_mut().events.push(Event::PointerMoved(dependencies.center()));
-    h.run_steps(8);
-    let relink = h.query_by_label_contains("Relink Missing Footage").unwrap().rect();
-    if let Some(path) = std::env::var_os("EFFECTCRAFT_RELINK_MENU_SNAPSHOT") {
-        h.render().unwrap().save(path).unwrap();
-    }
-    click_at(&mut h, relink.center());
-    assert!(picked.get());
-    assert_eq!(h.state().session.revision, revision);
-}
-
-#[test]
-fn relink_restores_decoded_pixels_and_invalidates_viewer_content() {
-    use effectcraft_engine::project::{ItemId, ItemKind};
-    use effectcraft_engine::render::RenderOpts;
-    use effectcraft_engine::time::Tick;
-
-    let dir = std::env::temp_dir().join(format!("ec-ui-relink-{}", std::process::id()));
-    std::fs::create_dir_all(dir.join("old")).unwrap();
-    std::fs::create_dir_all(dir.join("new/deep")).unwrap();
-    let old = dir.join("old/plate.png");
-    image::RgbaImage::from_pixel(32, 32, image::Rgba([230, 40, 80, 255])).save(&old).unwrap();
-    let mut s = effectcraft_host::session();
-    let item = s.execute("file.import", json!({"paths": [old], "sequence": false})).unwrap()["items"][0].as_u64().unwrap();
-    s.execute("comp.new", json!({"name": "Relink", "width": 32, "height": 32, "duration": 1})).unwrap();
-    s.execute("layer.addItem", json!({"item": item})).unwrap();
-    let cid = s.active_comp_id().unwrap();
-    let expected = s.render(cid, Tick::ZERO, RenderOpts::default());
-    let moved = dir.join("new/deep/plate.png");
-    std::fs::rename(&old, &moved).unwrap();
-    s.execute("footage.check", json!({"wait": true})).unwrap();
-    let ItemKind::Footage(f) = &s.project.item(ItemId(item)).unwrap().kind else { panic!("footage") };
-    assert!(f.missing);
-    let missing_content = effectcraft_ui_egui::frames::comp_content(&s.project, cid);
-    let missing = s.render(cid, Tick::ZERO, RenderOpts::default());
-    assert_ne!(missing.data, expected.data);
-    let r = s.execute("file.relinkFootage", json!({"folder": dir.join("new"), "wait": true})).unwrap();
-    assert_eq!(r["relinked"], 1);
-    assert_ne!(effectcraft_ui_egui::frames::comp_content(&s.project, cid), missing_content);
-    assert_eq!(s.render(cid, Tick::ZERO, RenderOpts::default()).data, expected.data);
-    std::fs::remove_dir_all(dir).unwrap();
-}
-
-/// #767: File ▸ Import ▸ File… offers MXF footage (OP1a / OP-Atom from broadcast cameras and
-/// Avid), which the Media Browser lists and the importer reads.
-#[test]
-fn import_dialog_offers_mxf() {
-    use std::cell::RefCell;
-    use std::rc::Rc;
-
-    let mut app = EffectcraftApp::new(Session::default());
-    let offered = Rc::new(RefCell::new(Vec::<String>::new()));
-    let seen = offered.clone();
-    app.hooks.pick_files = Some(Box::new(move |exts: &[&str]| {
-        *seen.borrow_mut() = exts.iter().map(|e| e.to_string()).collect();
-        Vec::new()
-    }));
-    let result = effectcraft_ui_egui::menus::invoke(&mut app, &egui::Context::default(), "file.import", json!({})).unwrap();
-    assert!(result.is_null(), "cancelled: nothing imported");
-    let offered = offered.borrow();
-    assert!(offered.iter().any(|e| e == "mxf"), "offered {offered:?}");
-    assert!(offered.iter().any(|e| e == "mov"));
-}
-
-/// #1059: opening the demo from the start screen and immediately pressing Spacebar previews
-/// the demo — the start screen's keyboard focus must not outlive it.
-#[test]
-fn space_previews_after_opening_the_demo_from_home() {
-    let mut h = {
-        let s = Session::default();
-        let mut app = EffectcraftApp::new(s);
-        app.ui.start_screen = true;
-        Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_| app)
-    };
-    h.run_steps(3);
-    let demo = rect(&h, "home.file.openDemoProject");
-    click_at(&mut h, demo.center());
-    assert!(h.state().session.active_comp().is_some(), "the demo comp is open");
-    assert!(!h.state().ui.start_screen, "the start screen closed");
-    key(&mut h, Key::Space);
-    assert!(h.state().playback.playing, "Space previews the demo (#1059)");
-}
diff --git a/crates/ui-egui/tests/ui_panel_windows.rs b/crates/ui-egui/tests/ui_panel_windows.rs
deleted file mode 100644
index 60ae3f9c3..000000000
--- a/crates/ui-egui/tests/ui_panel_windows.rs
+++ /dev/null
@@ -1,87 +0,0 @@
-//! Multiple monitors (#486): a panel moves out of the main window into a native window of its
-//! own (Move Panel to New Window), which can be placed on another screen, and back.
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::{PanelKind, PanelWindow};
-use egui::vec2;
-use egui_kittest::Harness;
-use serde_json::json;
-
-fn invoke(app: &mut EffectcraftApp, ctx: &egui::Context, params: serde_json::Value) -> Result<serde_json::Value, String> {
-    effectcraft_ui_egui::menus::invoke(app, ctx, "window.panelWindow", params)
-}
-
-#[test]
-fn panel_window_command_moves_a_docked_panel_into_its_own_window_and_back() {
-    let mut app = EffectcraftApp::new(Session::default());
-    let ctx = egui::Context::default();
-    assert!(app.ui.dock.contains(PanelKind::Project));
-    assert_eq!(invoke(&mut app, &ctx, json!({"panel": "Project", "window": true})).unwrap(), json!({"window": true}));
-    // Undocked first, then given a window of its own.
-    assert!(!app.ui.dock.contains(PanelKind::Project));
-    assert!(app.ui.floating.iter().any(|group| group.panels == [PanelKind::Project]));
-    assert!(app.in_panel_window(PanelKind::Project));
-    let window = app.ui.panel_windows.iter().find(|w| w.panel == PanelKind::Project).copied().unwrap();
-    assert_eq!(window.rect, PanelWindow::sanitized(window.rect));
-    // Asking again changes nothing; no `window` toggles.
-    assert_eq!(invoke(&mut app, &ctx, json!({"panel": "Project", "window": true})).unwrap(), json!({"window": true}));
-    assert_eq!(app.ui.panel_windows.len(), 1);
-    assert_eq!(invoke(&mut app, &ctx, json!({"panel": "Project"})).unwrap(), json!({"window": false}));
-    // Back in the main window, still floating where it was.
-    assert!(!app.in_panel_window(PanelKind::Project));
-    assert!(app.ui.panel_windows.is_empty());
-    assert!(app.ui.floating.iter().any(|group| group.panels == [PanelKind::Project]));
-    // The serialized panel form works too.
-    assert_eq!(invoke(&mut app, &ctx, json!({"panel": PanelKind::Project})).unwrap(), json!({"window": true}));
-    // Bad requests are errors and change nothing.
-    let before = app.ui.panel_windows.clone();
-    for params in [json!({}), json!({"panel": "Nope"}), json!({"panel": 7}), json!({"panel": "Project", "window": "yes"}), json!({"panel": {"Viewer": 9}})] {
-        assert!(invoke(&mut app, &ctx, params.clone()).is_err(), "{params} must be rejected");
-    }
-    assert_eq!(app.ui.panel_windows, before);
-}
-
-#[test]
-fn a_panel_in_its_own_window_leaves_the_main_window() {
-    let mut app = EffectcraftApp::new(Session::default());
-    app.ui.start_screen = false;
-    let mut h = Harness::builder().with_size(vec2(1200.0, 760.0)).build_eframe(move |_| app);
-    h.run_steps(3);
-    let ctx = h.ctx.clone();
-    invoke(h.state_mut(), &ctx, json!({"panel": "Project", "window": true})).unwrap();
-    h.run_steps(3);
-    // No in-window floating group is drawn for it (no move strip, no floating area)...
-    assert!(!h.state().auto.elements.iter().any(|e| e.id.starts_with("panel.float.")));
-    let area = egui::Id::new(("floating-panel", PanelKind::Project.id()));
-    assert!(!h.ctx.memory(|m| m.layer_ids().any(|layer| layer.id == area && m.areas().is_visible(&layer))));
-    // ...the window draws it (here embedded: the test harness has no native windows).
-    assert!(h.state().auto.elements.iter().any(|e| e.id == "panel.Project"));
-    // Docking it back into the main window closes the window entry.
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.dockPanel", json!({"panel": "Project", "anchor": "Timeline"})).unwrap();
-    h.run_steps(2);
-    assert!(h.state().ui.panel_windows.is_empty());
-    assert!(!h.state().in_panel_window(PanelKind::Project));
-}
-
-#[test]
-fn panel_windows_survive_restart_with_hostile_places_made_safe() {
-    use effectcraft_engine::config::MemoryConfig;
-    use std::sync::Arc;
-    let store = Arc::new(MemoryConfig::default());
-    let mut app = EffectcraftApp::new(Session { config: Some(store.clone()), ..Default::default() });
-    let ctx = egui::Context::default();
-    invoke(&mut app, &ctx, json!({"panel": "Project", "window": true})).unwrap();
-    let hostile = [1.0e9, -3.0e12, 1.0e9, 0.5];
-    if let Some(w) = app.ui.panel_windows.first_mut() {
-        w.rect = hostile;
-    }
-    // A window for a panel that doesn't float is dropped on load.
-    app.ui.panel_windows.push(PanelWindow { panel: PanelKind::Timeline, rect: [10.0, 10.0, 300.0, 200.0] });
-    eframe::App::on_exit(&mut app);
-    let restarted = EffectcraftApp::new(Session { config: Some(store), ..Default::default() });
-    assert_eq!(restarted.ui.panel_windows, vec![PanelWindow { panel: PanelKind::Project, rect: PanelWindow::sanitized(hostile) }]);
-    let [x, y, w, h] = PanelWindow::sanitized(hostile);
-    assert!(x <= 100_000.0 && y >= -100_000.0 && (160.0..=16_384.0).contains(&w) && (100.0..=16_384.0).contains(&h));
-    assert!(PanelWindow::sanitized([f32::NAN, f32::INFINITY, f32::NAN, f32::NEG_INFINITY]).iter().all(|v| v.is_finite()));
-}
diff --git a/crates/ui-egui/tests/ui_scrolling.rs b/crates/ui-egui/tests/ui_scrolling.rs
deleted file mode 100644
index 5f6816230..000000000
--- a/crates/ui-egui/tests/ui_scrolling.rs
+++ /dev/null
@@ -1,165 +0,0 @@
-//! Long menus and lists scroll instead of running off the window, with a scroll bar to drag
-//! (egui_kittest, UI logic only).
-
-use effectcraft_engine::Session;
-use effectcraft_ui_egui::EffectcraftApp;
-use egui::{Event, Pos2, Rect, pos2, vec2};
-use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
-use serde_json::json;
-
-fn harness(w: f32, h: f32) -> Harness<'static, EffectcraftApp> {
-    let mut s = Session::default();
-    s.execute("file.openDemoProject", json!({})).unwrap();
-    let mut h = Harness::builder().with_size(vec2(w, h)).build_eframe(|_| EffectcraftApp::new(s));
-    h.run_steps(3);
-    h
-}
-
-fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> Rect {
-    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
-    Rect::from_min_size(pos2(e.rect[0], e.rect[1]), vec2(e.rect[2], e.rect[3]))
-}
-
-fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
-    h.input_mut().events.push(Event::PointerMoved(p));
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
-    h.step();
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
-    h.run_steps(2);
-}
-
-fn wheel(h: &mut Harness<'_, EffectcraftApp>, at: Pos2, dy: f32) {
-    h.input_mut().events.push(Event::PointerMoved(at));
-    h.input_mut().events.push(Event::MouseWheel {
-        unit: egui::MouseWheelUnit::Point,
-        delta: vec2(0.0, dy),
-        modifiers: Default::default(),
-        phase: egui::TouchPhase::Move,
-    });
-    h.run_steps(20);
-}
-
-/// Edit is taller than a short window: it scrolls (with the wheel, and a scroll bar that always
-/// shows) so its last entries can be reached and clicked, instead of running off the bottom of
-/// the window (#269).
-#[test]
-fn a_menu_taller_than_the_window_scrolls() {
-    let mut h = harness(1200.0, 520.0);
-    assert!(!h.ctx.global_style().spacing.scroll.floating, "scroll bars show without hovering the list");
-    let edit = rect(&h, "menu.Edit");
-    click_at(&mut h, edit.center());
-    let last = h.query_by_label_contains("Keyboard Shortcuts").expect("the Edit menu is open").rect();
-    assert!(last.max.y > 520.0, "Edit is taller than the window ({last:?})");
-    let first = h.query_by_label_contains("Quick Apply").expect("Quick Apply").rect();
-    wheel(&mut h, first.center(), -2000.0);
-    let last = h.query_by_label_contains("Keyboard Shortcuts").expect("still open").rect();
-    assert!(last.min.y >= 0.0 && last.max.y <= 520.0, "scrolled into the window ({last:?})");
-    click_at(&mut h, last.center());
-    assert_eq!(h.state().dialog, Some(effectcraft_ui_egui::Dialog::Shortcuts), "the entry takes the click");
-}
-
-fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
-    h.input_mut().events.push(Event::PointerMoved(from));
-    h.input_mut().events.push(Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
-    h.step();
-    for i in 1..=8 {
-        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
-        h.step();
-    }
-    h.input_mut().events.push(Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
-    h.run_steps(2);
-}
-
-/// A scroll bar's "scroll/max" automation label.
-fn scrolled(h: &Harness<'_, EffectcraftApp>, id: &str) -> (f32, f32) {
-    let label = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}")).label.clone();
-    let (s, max) = label.split_once('/').unwrap_or_else(|| panic!("{id}: {label}"));
-    (s.parse().unwrap(), max.parse().unwrap())
-}
-
-/// Every panel that scrolls its own rows shows a scroll bar while they overflow, and dragging it
-/// scrolls them: without a mouse wheel or touchpad there was no way down most panels (#271).
-#[test]
-fn panels_taller_than_their_space_have_a_scroll_bar_to_drag() {
-    use effectcraft_ui_egui::dock::PanelKind;
-    // (The Project panel's list starts below its item preview and search: a taller window.)
-    for (panel, id, height) in [
-        (PanelKind::EffectControls, "effectControls.scroll", 240.0),
-        (PanelKind::Properties, "properties.scroll", 240.0),
-        (PanelKind::EffectsPresets, "effects.scroll", 240.0),
-        (PanelKind::Project, "project.vscroll", 330.0),
-        (PanelKind::Timeline, "timeline.scroll", 240.0),
-        (PanelKind::RenderQueue, "renderQueue.scroll", 240.0),
-        (PanelKind::History, "history.scroll", 240.0),
-        (PanelKind::Preview, "preview.scroll", 240.0),
-        (PanelKind::Character, "character.scroll", 240.0),
-        (PanelKind::Paragraph, "paragraph.scroll", 240.0),
-        (PanelKind::Info, "info.scroll", 240.0),
-    ] {
-        let mut h = harness(1200.0, height);
-        let app = h.state_mut();
-        let lid = app.session.active_comp().unwrap().layers[0].id.0;
-        app.session.execute("layer.select", json!({"layers": [lid]})).unwrap();
-        for e in ["slider", "angle", "checkbox", "color", "point"] {
-            app.session.execute("effect.apply", json!({"effect": format!("ec.control.{e}"), "layers": [lid]})).unwrap();
-        }
-        for _ in 0..6 {
-            app.session.execute("renderQueue.add", json!({})).unwrap();
-        }
-        app.show_panel(panel);
-        app.ui.maximized = Some(panel);
-        h.run_steps(3);
-        let (_, max) = scrolled(&h, id);
-        assert!(max > 0.0, "{id}: the rows overflow");
-        let bar = rect(&h, id);
-        // A press on the track moves the thumb there (History starts at its current state, the
-        // last); then the thumb drags to the end.
-        click_at(&mut h, pos2(bar.center().x, bar.min.y + 2.0));
-        assert_eq!(scrolled(&h, id).0, 0.0, "{id}: at the top");
-        drag(&mut h, pos2(bar.center().x, bar.min.y + 6.0), pos2(bar.center().x, bar.max.y + 40.0));
-        assert_eq!(scrolled(&h, id).0, max, "{id}: dragged to the end");
-    }
-}
-
-/// In a narrow Effect Controls panel an animated point's values stay clear of its keyframe
-/// navigator (â—€ â—† â–¶), which was drawn over them (#271).
-#[test]
-fn effect_values_stay_clear_of_the_keyframe_navigator() {
-    use effectcraft_ui_egui::dock::PanelKind;
-    let mut h = harness(1600.0, 1000.0);
-    let app = h.state_mut();
-    let lid = app.session.active_comp().unwrap().layers[0].id.0;
-    app.session.execute("layer.select", json!({"layers": [lid]})).unwrap();
-    app.session.execute("effect.apply", json!({"effect": "ec.control.point", "layers": [lid]})).unwrap();
-    let path = "effects/#1/point";
-    app.session.execute("prop.toggleAnimation", json!({"layer": lid, "path": path})).unwrap();
-    app.session.execute("prop.set", json!({"layer": lid, "path": path, "value": [123456.7, 123456.7]})).unwrap();
-    let uid = app.session.active_comp().unwrap().layer(effectcraft_engine::project::LayerId(lid)).unwrap().props.prop(path).unwrap().uid;
-    assert!(app.edit_layout(|l| l.float(PanelKind::EffectControls, [300.0, 150.0, 330.0, 500.0])));
-    h.run_steps(3);
-    let value = rect(&h, &format!("effectControls.prop.{uid}.value.1"));
-    let nav = rect(&h, &format!("effectControls.prop.{uid}.prevKey"));
-    assert!(value.max.x <= nav.min.x, "the value ({value:?}) ends before the navigator ({nav:?})");
-    assert!(value.min.x > rect(&h, &format!("effectControls.prop.{uid}.stopwatch")).max.x, "and after the stopwatch");
-}
-
-/// The Settings dialog fits its width: its page column was wider than the dialog, so the whole
-/// dialog scrolled sideways a little (#284).
-#[test]
-fn settings_dialog_does_not_scroll_sideways() {
-    let mut h = harness(1400.0, 900.0);
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "app.settings", json!({"page": "general"})).unwrap();
-    h.run_steps(3);
-    let (ok, page) = (rect(&h, "settings.ok"), rect(&h, "settings.page.general"));
-    h.input_mut().events.push(Event::PointerMoved(page.center()));
-    h.input_mut().events.push(Event::MouseWheel {
-        unit: egui::MouseWheelUnit::Point,
-        delta: vec2(-400.0, 0.0),
-        modifiers: Default::default(),
-        phase: egui::TouchPhase::Move,
-    });
-    h.run_steps(20);
-    assert_eq!((rect(&h, "settings.ok"), rect(&h, "settings.page.general")), (ok, page), "nothing moved sideways");
-}
diff --git a/crates/ui-egui/tests/ui_text_edit.rs b/crates/ui-egui/tests/ui_text_edit.rs
deleted file mode 100644
index d147529b2..000000000
--- a/crates/ui-egui/tests/ui_text_edit.rs
+++ /dev/null
@@ -1,572 +0,0 @@
-//! Headless checks for on-canvas text editing in the viewer and the Character / Paragraph panels
-//! acting on the selection (egui_kittest, UI logic only: no GPU needed).
-
-use effectcraft_engine::Session;
-use effectcraft_engine::commands::text_edit::layer_doc;
-use effectcraft_engine::project::LayerId;
-use effectcraft_ui_egui::EffectcraftApp;
-use effectcraft_ui_egui::dock::PanelKind;
-use egui::{Event, Key, Modifiers, PointerButton, Pos2};
-use egui_kittest::Harness;
-use serde_json::json;
-
-fn app() -> EffectcraftApp {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-    EffectcraftApp::new(s)
-}
-
-fn rect(h: &Harness<'_, EffectcraftApp>, id: &str) -> egui::Rect {
-    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
-    egui::Rect::from_min_size(egui::pos2(e.rect[0], e.rect[1]), egui::vec2(e.rect[2], e.rect[3]))
-}
-
-fn click(h: &mut Harness<'_, EffectcraftApp>, p: Pos2, modifiers: Modifiers) {
-    h.input_mut().events.push(Event::PointerMoved(p));
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers });
-    h.run_steps(1);
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers });
-    h.run_steps(2);
-}
-
-fn drag(h: &mut Harness<'_, EffectcraftApp>, from: Pos2, to: Pos2) {
-    h.input_mut().events.push(Event::PointerMoved(from));
-    h.input_mut().events.push(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    h.run_steps(1);
-    for i in 1..=8 {
-        h.input_mut().events.push(Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
-        h.run_steps(1);
-    }
-    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    h.run_steps(2);
-}
-
-fn key(h: &mut Harness<'_, EffectcraftApp>, key: Key, modifiers: Modifiers) {
-    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers });
-    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers });
-    h.run_steps(2);
-}
-
-fn type_text(h: &mut Harness<'_, EffectcraftApp>, t: &str) {
-    h.input_mut().events.push(Event::Text(t.into()));
-    h.run_steps(2);
-}
-
-fn edited(h: &Harness<'_, EffectcraftApp>) -> (u64, String, usize, usize) {
-    let s = &h.state().session;
-    let e = s.state.text_edit.clone().expect("editing");
-    (e.layer.0, layer_doc(s, e.layer).unwrap().text, e.anchor, e.caret)
-}
-
-#[test]
-fn type_tool_skips_hidden_and_unsoloed_text_layers() {
-    for switch in ["video", "solo"] {
-        let mut s = Session::default();
-        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-        let mut ids = vec![];
-        for _ in 0..2 {
-            let lid = s.execute("layer.newText", json!({"text": "alpha beta", "size": 80, "position": [100, 200], "justify": "left"})).unwrap()["layer"]
-                .as_u64()
-                .unwrap();
-            ids.push(lid);
-        }
-        let (target, value) = if switch == "video" { (ids[1], false) } else { (ids[0], true) };
-        s.execute("layer.setSwitch", json!({"layers": [target], "switch": switch, "value": value})).unwrap();
-        s.execute("edit.deselectAll", json!({})).unwrap();
-        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(move |_| EffectcraftApp::new(s));
-        h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
-        h.run_steps(3);
-        let comp = rect(&h, "viewer.comp");
-        let k = comp.width() / 640.0;
-        click(&mut h, comp.min + egui::vec2(330.0 * k, 180.0 * k), Modifiers::NONE);
-        assert_eq!(edited(&h).0, ids[0], "{switch}");
-    }
-}
-
-#[test]
-fn modal_blocks_background_text_events() {
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| app());
-    h.run_steps(3);
-    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
-    h.run_steps(1);
-    let p = rect(&h, "viewer.comp").center();
-    click(&mut h, p, Modifiers::NONE);
-    type_text(&mut h, "Preserve");
-    let before = edited(&h).1;
-    h.state_mut().dialog = Some(effectcraft_ui_egui::Dialog::About);
-    h.run_steps(3);
-    h.input_mut().events.push(Event::Text("changed".into()));
-    h.input_mut().events.push(Event::Paste("pasted".into()));
-    key(&mut h, Key::Backspace, Modifiers::NONE);
-    assert_eq!(edited(&h).1, before);
-}
-
-#[test]
-fn type_tool_click_type_edit_and_commit() {
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| app());
-    h.state_mut().show_panel(PanelKind::Composition);
-    h.run_steps(3);
-    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
-    h.run_steps(1);
-    let comp = rect(&h, "viewer.comp");
-    // Click: a point text layer in edit mode, caret ready.
-    click(&mut h, comp.center(), Modifiers::NONE);
-    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 1);
-    type_text(&mut h, "Hello");
-    type_text(&mut h, " world");
-    let (lid, text, a, c) = edited(&h);
-    assert_eq!((text.as_str(), a, c), ("Hello world", 11, 11));
-    assert!(h.state().auto.find("viewer.textEdit").is_some(), "edit region registered");
-    // Arrow keys, Shift-extend, Backspace.
-    key(&mut h, Key::ArrowLeft, Modifiers::NONE);
-    key(&mut h, Key::ArrowLeft, Modifiers::SHIFT);
-    assert_eq!((edited(&h).2, edited(&h).3), (10, 9));
-    key(&mut h, Key::Backspace, Modifiers::NONE);
-    assert_eq!(edited(&h).1, "Hello word");
-    // Word jump and Home / End.
-    key(&mut h, Key::Home, Modifiers::NONE);
-    assert_eq!(edited(&h).3, 0);
-    key(&mut h, Key::ArrowRight, Modifiers::COMMAND);
-    assert_eq!(edited(&h).3, 5);
-    key(&mut h, Key::End, Modifiers::NONE);
-    assert_eq!(edited(&h).3, 10);
-    // Enter starts a new paragraph.
-    key(&mut h, Key::Enter, Modifiers::NONE);
-    type_text(&mut h, "two");
-    assert_eq!(edited(&h).1, "Hello word\ntwo");
-    // Select all, then the Character panel styles the selection only.
-    key(&mut h, Key::ArrowUp, Modifiers::NONE);
-    assert!(edited(&h).3 <= 10, "up to the first line");
-    key(&mut h, Key::Home, Modifiers::NONE);
-    key(&mut h, Key::End, Modifiers::SHIFT);
-    let (_, _, a, c) = edited(&h);
-    assert_eq!((a, c), (0, 10));
-    h.state_mut().show_panel(PanelKind::Character);
-    h.run_steps(3);
-    let bold = rect(&h, "character.fauxBold");
-    click(&mut h, bold.center(), Modifiers::NONE);
-    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
-    assert!(doc.style_at(2).faux_bold, "selection is bold");
-    assert!(!doc.style_at(12).faux_bold, "second paragraph untouched");
-    assert_eq!(doc.runs().len(), 2);
-    // Undo the style; Escape commits.
-    h.state_mut().session.execute("edit.undo", json!({})).unwrap();
-    assert!(layer_doc(&h.state().session, LayerId(lid)).unwrap().is_uniform());
-    h.state_mut().show_panel(PanelKind::Composition);
-    h.run_steps(3);
-    h.state_mut().session.execute("text.setSelection", json!({"start": 0})).unwrap();
-    h.run_steps(2);
-    key(&mut h, Key::Escape, Modifiers::NONE);
-    assert!(h.state().session.state.text_edit.is_none());
-}
-
-/// #831: clicking another panel (a solid's row in the Timeline) ends text editing and gives the
-/// keyboard back, whether the edit began with the Type tool (which stays selected) or by command:
-/// typed characters change no text and Space plays. The Character panel keeps the edit, and a
-/// text layer clicked into being and left empty goes away.
-#[test]
-fn clicking_another_panel_stops_typing_into_text() {
-    for type_tool in [false, true] {
-        let mut s = Session::default();
-        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-        let solid = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
-        let title =
-            s.execute("layer.newText", json!({"text": "Title", "size": 80, "position": [100, 120], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
-        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
-        h.state_mut().show_panel(PanelKind::Composition);
-        h.run_steps(3);
-        let layers = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.len();
-        // (Its row moves down as text layers are added.)
-        let row = |h: &Harness<'_, EffectcraftApp>| rect(h, &format!("timeline.layer.{solid}.row")).center();
-        if type_tool {
-            h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
-            h.run_steps(1);
-            let at = rect(&h, "viewer.comp").center();
-            click(&mut h, at, Modifiers::NONE);
-            assert_eq!(layers(&h), 3, "the Type tool started a text layer");
-            let at_row = row(&h);
-            click(&mut h, at_row, Modifiers::NONE);
-            assert_eq!(layers(&h), 2, "left empty, it is removed");
-            click(&mut h, at, Modifiers::NONE);
-        } else {
-            h.state_mut().session.execute("text.edit", json!({"layer": title})).unwrap();
-            h.run_steps(2);
-        }
-        type_text(&mut h, "Hello");
-        // The Character panel formats the selection and keeps the edit: typing carries on.
-        key(&mut h, Key::ArrowLeft, Modifiers::SHIFT);
-        let range = edited(&h);
-        h.state_mut().show_panel(PanelKind::Character);
-        h.run_steps(3);
-        let bold = rect(&h, "character.fauxBold").center();
-        click(&mut h, bold, Modifiers::NONE);
-        assert_eq!(edited(&h), range, "type_tool {type_tool}: Character keeps the edit and its selection");
-        key(&mut h, Key::End, Modifiers::NONE);
-        type_text(&mut h, "!");
-        let (lid, text, ..) = edited(&h);
-        assert!(text.ends_with("Hello!"), "typing goes into the text: {text:?}");
-        let at_row = row(&h);
-        click(&mut h, at_row, Modifiers::NONE);
-        assert!(h.state().session.state.text_edit.is_none(), "type_tool {type_tool}: clicking the Timeline ends the edit");
-        assert_eq!(h.state().session.state.selected_layers, vec![LayerId(solid)]);
-        assert!(!h.ctx.memory(|m| m.focused().is_some()), "the keyboard is the app's again");
-        type_text(&mut h, "abc");
-        assert!(!h.state().playback.playing);
-        h.input_mut().events.push(Event::Key { key: Key::Space, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-        h.input_mut().events.push(Event::Text(" ".into()));
-        h.input_mut().events.push(Event::Key { key: Key::Space, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
-        h.run_steps(2);
-        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, text, "type_tool {type_tool}: the text is unchanged");
-        assert!(h.state().playback.playing, "type_tool {type_tool}: Space plays");
-        assert_eq!(type_tool, matches!(h.state().ui.tool, effectcraft_ui_egui::state::Tool::Type), "the tool is kept");
-    }
-}
-
-/// #831: opening a formatting panel's tab behind Effects & Presets in its group (Properties, in
-/// Undocked Panels) keeps the edit and its selected characters: the press on the tab used to
-/// focus the shown panel and end the edit, after which Faux Bold styled the whole layer.
-#[test]
-fn opening_a_formatting_tab_keeps_the_text_selection() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-    let lid =
-        s.execute("layer.newText", json!({"text": "Hello world", "size": 80, "position": [60, 200], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
-    h.run_steps(3);
-    let ctx = h.ctx.clone();
-    // Effects & Presets shown, Properties, Character and Paragraph behind it.
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "window.workspace", json!({"name": "Undocked Panels"})).unwrap();
-    h.state_mut().session.execute("text.edit", json!({"layer": lid})).unwrap();
-    h.state_mut().session.execute("text.setSelection", json!({"anchor": 0, "caret": 5})).unwrap();
-    h.run_steps(3);
-    assert!(h.state().auto.find("properties.text.style").is_none(), "Properties is behind Effects & Presets");
-    let tab = rect(&h, "panel.tab.Properties").center();
-    click(&mut h, tab, Modifiers::NONE);
-    assert!(h.state().auto.find("properties.text.style").is_some(), "the tab opened Properties");
-    assert_eq!(edited(&h), (lid, "Hello world".into(), 0, 5), "the edit and its selection are kept");
-    h.state_mut().show_panel(PanelKind::Character);
-    h.run_steps(3);
-    let bold = rect(&h, "character.fauxBold").center();
-    click(&mut h, bold, Modifiers::NONE);
-    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
-    assert!(doc.style_at(1).faux_bold && !doc.style_at(7).faux_bold, "only \"Hello\" is bold");
-}
-
-/// #831: a click away and keys in one frame's input. The text gets the keys typed before the
-/// click and none after it; those later keys don't run as shortcuts either (Delete would remove a
-/// layer). From the next frame the keys are the app's: Space plays.
-#[test]
-fn keys_after_a_click_away_in_the_same_frame_skip_the_text() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-    let solid = s.execute("layer.newSolid", json!({"name": "Plate", "color": "#406080"})).unwrap()["layer"].as_u64().unwrap();
-    let lid = s.execute("layer.newText", json!({"text": "Hello", "size": 80, "position": [60, 200], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
-    h.state_mut().show_panel(PanelKind::Composition);
-    h.run_steps(3);
-    h.state_mut().session.execute("text.edit", json!({"layer": lid, "caret": 5})).unwrap();
-    h.run_steps(2);
-    let row = rect(&h, &format!("timeline.layer.{solid}.row")).center();
-    let key = |key: Key, pressed: bool| Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE };
-    h.input_mut().events.extend([
-        Event::Text("A".into()),
-        Event::PointerMoved(row),
-        Event::PointerButton { pos: row, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE },
-        Event::PointerButton { pos: row, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE },
-        Event::Text("x".into()),
-        key(Key::Space, true),
-        Event::Text(" ".into()),
-        key(Key::Space, false),
-        key(Key::Delete, true),
-        key(Key::Delete, false),
-    ]);
-    h.run_steps(3);
-    let comp = |h: &Harness<'_, EffectcraftApp>| h.state().session.active_comp().unwrap().layers.len();
-    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "HelloA", "only the key before the click");
-    assert!(h.state().session.state.text_edit.is_none(), "the click ended the edit");
-    assert_eq!((comp(&h), h.state().playback.playing), (2, false), "the keys after it ran no shortcut");
-    h.input_mut().events.extend([key(Key::Space, true), Event::Text(" ".into()), key(Key::Space, false)]);
-    h.run_steps(2);
-    assert!(h.state().playback.playing, "Space plays");
-    assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "HelloA");
-}
-
-#[test]
-fn switching_from_type_to_selection_commits_and_moves_text_layer() {
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| app());
-    h.state_mut().show_panel(PanelKind::Composition);
-    h.run_steps(3);
-    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
-    h.run_steps(1);
-    let comp = rect(&h, "viewer.comp");
-    let k = comp.width() / 640.0;
-    click(&mut h, comp.min + egui::vec2(320.0 * k, 180.0 * k), Modifiers::NONE);
-    type_text(&mut h, "Move me");
-    let layer_id = h.state().session.state.text_edit.as_ref().unwrap().layer;
-    let layer_position = |h: &Harness<'_, EffectcraftApp>| {
-        h.state().session.active_comp().unwrap().layer(layer_id).unwrap().props.prop("transform/position").unwrap().value.as_vec3()
-    };
-    let original_text = layer_doc(&h.state().session, layer_id).unwrap().text;
-    let before = layer_position(&h);
-
-    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Selection;
-    h.run_steps(2);
-    assert!(h.state().session.state.text_edit.is_none(), "leaving the Type tool commits text editing");
-    type_text(&mut h, " ignored");
-    assert_eq!(layer_doc(&h.state().session, layer_id).unwrap().text, original_text, "Selection does not type into the layer");
-    let from = comp.min + egui::vec2(340.0 * k, 150.0 * k);
-    let to = from + egui::vec2(60.0 * k, 50.0 * k);
-    drag(&mut h, from, to);
-    let after = layer_position(&h);
-    assert!(after[0] > before[0] && after[1] > before[1], "Selection dragging moves the text layer: {before:?} -> {after:?}");
-}
-
-#[test]
-fn double_click_enters_editing_and_selects_words() {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-    let lid =
-        s.execute("layer.newText", json!({"text": "alpha beta", "size": 80, "position": [100, 200], "justify": "left"})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
-    h.state_mut().show_panel(PanelKind::Composition);
-    h.run_steps(3);
-    // A point inside "beta" (comp space → window).
-    let comp = rect(&h, "viewer.comp");
-    let k = comp.width() / 640.0;
-    let p = comp.min + egui::vec2(330.0 * k, 180.0 * k);
-    click(&mut h, p, Modifiers::NONE);
-    click(&mut h, p, Modifiers::NONE);
-    let e = h.state().session.state.text_edit.clone().expect("double-click edits text");
-    assert_eq!(e.layer.0, lid);
-    assert_eq!((e.anchor.min(e.caret), e.anchor.max(e.caret)), (0, 10), "everything selected");
-    // Double-clicking inside the edited text selects a word.
-    h.run_steps(40);
-    click(&mut h, p, Modifiers::NONE);
-    click(&mut h, p, Modifiers::NONE);
-    let e = h.state().session.state.text_edit.clone().unwrap();
-    assert_eq!((e.anchor, e.caret), (6, 10));
-    // Typing replaces it; Cmd+Z undoes while editing.
-    type_text(&mut h, "gamma");
-    assert_eq!(edited(&h).1, "alpha gamma");
-    key(&mut h, Key::Z, Modifiers::COMMAND);
-    assert_eq!(edited(&h).1, "alpha beta");
-    // Paragraph panel: alignment applies to the edited paragraph (the South Asian and Middle
-    // Eastern text engine shows the direction popup too).
-    h.state_mut().session.prefs.type_.text_engine = "southAsian".into();
-    h.state_mut().show_panel(PanelKind::Paragraph);
-    h.run_steps(3);
-    let r = rect(&h, "paragraph.right");
-    click(&mut h, r.center(), Modifiers::NONE);
-    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
-    assert_eq!(doc.justify, effectcraft_engine::keyframe::Justify::Right);
-    for id in
-        ["paragraph.indentLeft", "paragraph.spaceBefore", "paragraph.direction", "paragraph.composer", "paragraph.hangingPunctuation", "paragraph.justifyAll"]
-    {
-        assert!(h.state().auto.find(id).is_some(), "missing {id}");
-    }
-}
-
-#[test]
-fn type_tool_drag_makes_paragraph_text_with_box_handles() {
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(|_| app());
-    h.state_mut().show_panel(PanelKind::Composition);
-    h.run_steps(3);
-    h.state_mut().ui.tool = effectcraft_ui_egui::state::Tool::Type;
-    h.run_steps(1);
-    let comp = rect(&h, "viewer.comp");
-    let a = comp.min + egui::vec2(comp.width() * 0.2, comp.height() * 0.2);
-    let b = comp.min + egui::vec2(comp.width() * 0.7, comp.height() * 0.6);
-    h.input_mut().events.push(Event::PointerMoved(a));
-    h.input_mut().events.push(Event::PointerButton { pos: a, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    h.run_steps(1);
-    for i in 1..=8 {
-        h.input_mut().events.push(Event::PointerMoved(a + (b - a) * (i as f32 / 8.0)));
-        h.run_steps(1);
-    }
-    h.input_mut().events.push(Event::PointerButton { pos: b, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    h.run_steps(3);
-    let (lid, _, _, _) = edited(&h);
-    let doc = layer_doc(&h.state().session, LayerId(lid)).unwrap();
-    let bs = doc.box_size.expect("paragraph text");
-    assert!((bs[0] - 320.0).abs() < 4.0 && (bs[1] - 144.0).abs() < 4.0, "{bs:?}");
-    type_text(&mut h, "Some words that wrap inside the box when there are enough of them");
-    h.run_steps(2);
-    assert!(h.state().auto.find("viewer.textBox.handle.4").is_some());
-    // Dragging the bottom-right handle widens the box.
-    let hr = rect(&h, "viewer.textBox.handle.4").center();
-    let to = hr + egui::vec2(60.0, 0.0);
-    h.input_mut().events.push(Event::PointerMoved(hr));
-    h.input_mut().events.push(Event::PointerButton { pos: hr, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    h.run_steps(1);
-    for i in 1..=6 {
-        h.input_mut().events.push(Event::PointerMoved(hr + (to - hr) * (i as f32 / 6.0)));
-        h.run_steps(1);
-    }
-    h.input_mut().events.push(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    h.run_steps(2);
-    let doc2 = layer_doc(&h.state().session, LayerId(lid)).unwrap();
-    assert!(doc2.box_size.unwrap()[0] > bs[0] + 20.0, "{:?}", doc2.box_size);
-    assert!(h.state().session.state.text_edit.is_some(), "still editing after resizing");
-}
-
-/// #866: Layer ▸ New ▸ Text (menu or its shortcut) puts an insertion point in the comp, as After
-/// Effects does, so typed keys reach Source Text (and the layer name follows) instead of running
-/// shortcuts while the layer keeps the placeholder "Text".
-#[test]
-fn layer_new_text_menu_and_shortcut_start_typing_into_source_text() {
-    for via_shortcut in [false, true] {
-        let mut s = Session::default();
-        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-        s.execute("layer.newSolid", json!({"color": "#ffffff"})).unwrap();
-        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
-        h.state_mut().show_panel(PanelKind::Composition);
-        h.run_steps(3);
-        if via_shortcut {
-            key(&mut h, Key::T, Modifiers::COMMAND | Modifiers::ALT | Modifiers::SHIFT);
-        } else {
-            let ctx = h.ctx.clone();
-            effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "layer.newText", json!({})).unwrap();
-            h.run_steps(2);
-        }
-        let (lid, text, _, _) = edited(&h);
-        assert_eq!(text, "", "no placeholder to type over (shortcut: {via_shortcut})");
-        type_text(&mut h, "My First Project");
-        key(&mut h, Key::Escape, Modifiers::NONE);
-        assert!(h.state().session.state.text_edit.is_none(), "Escape commits");
-        let s = &h.state().session;
-        assert_eq!(layer_doc(s, LayerId(lid)).unwrap().text, "My First Project", "typed text is the Source Text");
-        assert_eq!(s.active_comp().unwrap().layer(LayerId(lid)).unwrap().name, "My First Project", "the name follows the text");
-    }
-}
-
-/// Double-clicking a text layer in the Timeline, on its name or on its bar, edits its text in the
-/// Composition viewer with the whole text selected, as in After Effects (Enter renames).
-#[test]
-fn timeline_double_click_on_a_text_layer_edits_its_text() {
-    for target in ["row", "bar"] {
-        let mut s = Session::default();
-        s.execute("comp.new", json!({"name": "Type", "width": 640, "height": 360, "duration": 2})).unwrap();
-        let lid = s.execute("layer.newText", json!({"text": "alpha beta"})).unwrap()["layer"].as_u64().unwrap();
-        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| EffectcraftApp::new(s));
-        h.state_mut().show_panel(PanelKind::Composition);
-        h.run_steps(3);
-        let p = rect(&h, &format!("timeline.layer.{lid}.{target}")).center();
-        click(&mut h, p, Modifiers::NONE);
-        click(&mut h, p, Modifiers::NONE);
-        let (layer, text, anchor, caret) = edited(&h);
-        assert_eq!(layer, lid, "{target}");
-        assert_eq!((anchor.min(caret), anchor.max(caret)), (0, 10), "everything selected ({target})");
-        assert!(h.state().auto.find(&format!("timeline.layer.{lid}.nameEdit")).is_none(), "no rename field ({target})");
-        assert_eq!(text, "alpha beta");
-        type_text(&mut h, "gamma");
-        key(&mut h, Key::Escape, Modifiers::NONE);
-        assert!(h.state().session.state.text_edit.is_none(), "Escape commits ({target})");
-        assert_eq!(layer_doc(&h.state().session, LayerId(lid)).unwrap().text, "gamma", "typing replaced the text ({target})");
-    }
-}
-
-#[test]
-fn duplicated_text_boxes_both_remain_editable() {
-    let mut a = app();
-    let original = a
-        .session
-        .execute("layer.newText", json!({"text": "alpha beta", "size": 40, "position": [40, 100], "justify": "left", "box": [40, 60, 250, 100]}))
-        .unwrap()["layer"]
-        .as_u64()
-        .unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| a);
-    h.run_steps(3);
-    h.state_mut().ui.focused = PanelKind::Composition;
-    key(&mut h, Key::D, Modifiers::COMMAND);
-    let duplicate = h.state().session.state.selected_layers[0].0;
-    assert_ne!(original, duplicate);
-    h.state_mut().session.execute("prop.set", json!({"layer": duplicate, "path": "transform/position", "value": [465, 110]})).unwrap();
-    h.run_steps(3);
-    for (layer, x, text) in [(original, 80.0, "original edited"), (duplicate, 380.0, "duplicate edited")] {
-        h.run_steps(40);
-        let comp = rect(&h, "viewer.comp");
-        let k = comp.width() / 640.0;
-        let p = comp.min + egui::vec2(x * k, 85.0 * k);
-        click(&mut h, p, Modifiers::NONE);
-        click(&mut h, p, Modifiers::NONE);
-        assert_eq!(edited(&h).0, layer);
-        type_text(&mut h, text);
-        key(&mut h, Key::Escape, Modifiers::NONE);
-        assert_eq!(layer_doc(&h.state().session, LayerId(layer)).unwrap().text, text);
-    }
-}
-
-#[test]
-fn overlapping_duplicate_text_remains_editable_by_double_click_and_selected_type_tool() {
-    let mut a = app();
-    let original = a.session.execute("layer.newText", json!({"text": "alpha beta", "size": 40, "box": [40, 60, 250, 100]})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| a);
-    h.run_steps(3);
-    h.state_mut().ui.focused = PanelKind::Composition;
-    key(&mut h, Key::D, Modifiers::COMMAND);
-    let duplicate = h.state().session.state.selected_layers[0].0;
-    assert_ne!(original, duplicate);
-    let comp = rect(&h, "viewer.comp");
-    let p = comp.min + egui::vec2(80.0, 85.0) * (comp.width() / 640.0);
-    click(&mut h, p, Modifiers::NONE);
-    click(&mut h, p, Modifiers::NONE);
-    assert_eq!(edited(&h).0, duplicate, "double-click edits the topmost overlapping copy");
-    type_text(&mut h, "copy edited");
-    assert_eq!(edited(&h).1, "copy edited");
-    key(&mut h, Key::Z, Modifiers::COMMAND);
-    assert_eq!(edited(&h).1, "alpha beta", "undo restores the duplicate's text");
-    key(&mut h, Key::Escape, Modifiers::NONE);
-    h.state_mut().session.execute("layer.select", json!({"layers": [original]})).unwrap();
-    h.state_mut().ui.focused = PanelKind::Composition;
-    key(&mut h, Key::T, Modifiers::COMMAND);
-    h.run_steps(40);
-    click(&mut h, p, Modifiers::NONE);
-    assert_eq!(edited(&h).0, original, "the Type tool must honor the explicitly selected overlapping text layer");
-    key(&mut h, Key::A, Modifiers::COMMAND);
-    type_text(&mut h, "original edited");
-    assert_eq!(edited(&h).1, "original edited");
-    assert_eq!(layer_doc(&h.state().session, LayerId(duplicate)).unwrap().text, "alpha beta", "editing the original leaves the duplicate unchanged");
-    key(&mut h, Key::Z, Modifiers::COMMAND);
-    assert_eq!(edited(&h).1, "alpha beta");
-}
-
-#[test]
-fn type_tool_selected_text_preference_skips_ineligible_layers_and_falls_back_to_topmost() {
-    for exclusion in ["hidden", "locked", "inactive", "unsoloed", "outside", "unselected"] {
-        let mut a = app();
-        let mut ids = vec![];
-        for _ in 0..2 {
-            ids.push(
-                a.session.execute("layer.newText", json!({"text": "alpha beta", "size": 40, "box": [40, 60, 250, 100]})).unwrap()["layer"].as_u64().unwrap(),
-            );
-        }
-        let original = ids[0];
-        let topmost = ids[1];
-        match exclusion {
-            "hidden" | "locked" => {
-                let switch = if exclusion == "hidden" { "video" } else { "locked" };
-                a.session.execute("layer.setSwitch", json!({"layers": [original], "switch": switch, "value": exclusion == "locked"})).unwrap();
-            }
-            "inactive" => {
-                let cid = a.session.active_comp_id().unwrap();
-                std::sync::Arc::make_mut(&mut a.session.project).comp_mut(cid).unwrap().layer_mut(LayerId(original)).unwrap().out_point =
-                    effectcraft_engine::time::Tick::ZERO;
-            }
-            "unsoloed" => {
-                a.session.execute("layer.setSwitch", json!({"layers": [topmost], "switch": "solo", "value": true})).unwrap();
-            }
-            "outside" => {
-                a.session.execute("prop.set", json!({"layer": original, "path": "transform/position", "value": [500, 300]})).unwrap();
-            }
-            _ => {}
-        }
-        a.session.state.selected_layers = if exclusion == "unselected" { vec![] } else { vec![LayerId(original)] };
-        a.ui.tool = effectcraft_ui_egui::state::Tool::Type;
-        let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_| a);
-        h.run_steps(3);
-        let comp = rect(&h, "viewer.comp");
-        let p = comp.min + egui::vec2(80.0, 85.0) * (comp.width() / 640.0);
-        click(&mut h, p, Modifiers::NONE);
-        assert_eq!(edited(&h).0, topmost, "{exclusion} selected text must not override the eligible hit");
-    }
-}
diff --git a/crates/ui-egui/tests/ui_timeline_shapes.rs b/crates/ui-egui/tests/ui_timeline_shapes.rs
deleted file mode 100644
index 3993a6f99..000000000
--- a/crates/ui-egui/tests/ui_timeline_shapes.rs
+++ /dev/null
@@ -1,285 +0,0 @@
-//! Timeline rows for shape layers, masks and keyframing: the Contents "Add:" menu and the Classic
-//! 3D "Change Renderer…" row (#206), Alt+Shift+P revealing the key it adds and clicks below the
-//! layers deselecting them (#205), Mask Feather's linked values (#203), and copying shape items
-//! between shape layers (#227), and Ctrl+V of SVG markup making a shape layer (#738).
-
-use effectcraft_engine::Session;
-use effectcraft_engine::project::LayerId;
-use effectcraft_ui_egui::{Dialog, EffectcraftApp};
-use egui::{Event, Key, Modifiers, PointerButton, Pos2, pos2};
-use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
-use serde_json::json;
-
-fn harness(s: Session) -> Harness<'static, EffectcraftApp> {
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
-    h.run_steps(3);
-    h
-}
-
-fn session() -> Session {
-    let mut s = Session::default();
-    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
-    s
-}
-
-fn center(h: &Harness<'_, EffectcraftApp>, id: &str) -> Pos2 {
-    let e = h.state().auto.find(id).unwrap_or_else(|| panic!("no {id}"));
-    pos2(e.rect[0] + e.rect[2] / 2.0, e.rect[1] + e.rect[3] / 2.0)
-}
-
-/// Step until the viewer's frame has rendered (frames render on background threads).
-fn settle(h: &mut Harness<'_, EffectcraftApp>) {
-    for _ in 0..600 {
-        h.step();
-        if h.state().frames.inflight() == 0 && h.state().frames.last_ms.lock().map(|v| *v > 0.0).unwrap_or(false) {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(10));
-    }
-    h.run_steps(2);
-}
-
-fn click_at(h: &mut Harness<'_, EffectcraftApp>, p: Pos2) {
-    h.input_mut().events.push(Event::PointerMoved(p));
-    h.step();
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    h.step();
-    h.input_mut().events.push(Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    h.run_steps(3);
-}
-
-fn click(h: &mut Harness<'_, EffectcraftApp>, id: &str) {
-    let p = center(h, id);
-    click_at(h, p);
-}
-
-fn open_layer(h: &mut Harness<'_, EffectcraftApp>, id: u64) {
-    h.state_mut().ui.timeline.open_layers.insert(id);
-    h.run_steps(2);
-}
-
-#[test]
-fn shape_contents_add_menu_adds_path_operations() {
-    let mut s = session();
-    let l = s.execute("layer.newShape", json!({"kind": "ellipse"})).unwrap()["layer"].as_u64().unwrap();
-    let contents = s.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("contents").unwrap().uid;
-    let mut h = harness(s);
-    open_layer(&mut h, l);
-    click(&mut h, &format!("timeline.group.{contents}.add"));
-    let entry = h.get_by_label("Trim Paths").rect();
-    assert!(entry.max.y <= 1000.0, "the whole menu fits in the window: {entry:?}");
-    click_at(&mut h, entry.center());
-    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
-    let items: Vec<&str> = layer.props.sub("contents").unwrap().groups().map(|g| g.match_id.as_str()).collect();
-    assert_eq!(items, ["group", "trim"]);
-}
-
-#[test]
-fn classic_3d_shape_layers_offer_change_renderer() {
-    let mut s = session();
-    let l = s.execute("layer.newShape", json!({"kind": "rect"})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("layer.setSwitch", json!({"layers": [l], "switch": "threeD", "value": true})).unwrap();
-    let mut h = harness(s);
-    open_layer(&mut h, l);
-    click(&mut h, &format!("timeline.layer.{l}.changeRenderer"));
-    assert_eq!(h.state().dialog, Some(Dialog::CompSettings));
-    assert!(h.state().auto.find("dialog.comp.renderer").is_some(), "on the 3D Renderer tab");
-    // Advanced 3D shows the extrusion options instead.
-    h.state_mut().dialog = None;
-    h.state_mut().session.execute("comp.renderer", json!({"renderer": "advanced3d"})).unwrap();
-    h.run_steps(3);
-    assert!(h.state().auto.find(&format!("timeline.layer.{l}.changeRenderer")).is_none());
-}
-
-#[test]
-fn add_position_key_reveals_position() {
-    let mut s = session();
-    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = harness(s);
-    let ctx = h.ctx.clone();
-    effectcraft_ui_egui::menus::invoke(h.state_mut(), &ctx, "timeline.keyAt.position", json!({})).unwrap();
-    h.run_steps(2);
-    let app = h.state();
-    let position = app.session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("transform/position").unwrap().clone();
-    assert_eq!(position.keys.len(), 1);
-    assert_eq!(app.ui.timeline.layer_reveal.get(&l), Some(&vec!["position".to_string()]));
-    assert!(app.auto.find(&format!("timeline.prop.{}.value.0", position.uid)).is_some(), "the Position row shows");
-}
-
-#[test]
-fn clicking_below_the_layers_deselects_them() {
-    let mut s = session();
-    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = harness(s);
-    assert_eq!(h.state().session.state.selected_layers, vec![LayerId(l)]);
-    // In the time graph, below the only layer.
-    let bar = center(&h, &format!("timeline.layer.{l}.bar"));
-    click_at(&mut h, bar + egui::vec2(0.0, 80.0));
-    assert!(h.state().session.state.selected_layers.is_empty());
-}
-
-#[test]
-fn mask_feather_values_are_linked_and_not_negative() {
-    let mut s = session();
-    let l = s.execute("layer.newSolid", json!({"color": "#808080"})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("layer.addMask", json!({"layer": l, "shape": "rect"})).unwrap();
-    let feather = |h: &Harness<'_, EffectcraftApp>| {
-        let p = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.prop("masks/#1/feather").unwrap().clone();
-        (p.uid, p.value.components())
-    };
-    let mut h = harness(s);
-    h.state_mut().ui.timeline.open_layers.insert(l);
-    h.state_mut().ui.timeline.layer_reveal.insert(l, vec!["feather".into()]);
-    h.run_steps(2);
-    let (uid, _) = feather(&h);
-    let type_value = |h: &mut Harness<'_, EffectcraftApp>, d: usize, v: &str| {
-        click(h, &format!("timeline.prop.{uid}.value.{d}"));
-        h.input_mut().events.push(Event::Text(v.into()));
-        h.step();
-        h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-        h.run_steps(3);
-    };
-    type_value(&mut h, 0, "12");
-    assert_eq!(feather(&h).1, vec![12.0, 12.0], "linked by default");
-    type_value(&mut h, 1, "-5");
-    assert_eq!(feather(&h).1, vec![0.0, 0.0], "never negative");
-    click(&mut h, &format!("timeline.prop.{uid}.link"));
-    type_value(&mut h, 1, "7");
-    assert_eq!(feather(&h).1, vec![0.0, 7.0], "unlinked");
-}
-
-/// Two shape layers, "Rect" (Rectangle 1) and "Oval" (Ellipse 1, selected): (harness with Rect's
-/// Contents open, Rect, Oval, Rectangle 1's uid).
-fn two_shape_layers() -> (Harness<'static, EffectcraftApp>, u64, u64, u64) {
-    let mut s = session();
-    let a = s.execute("layer.newShape", json!({"kind": "rect", "name": "Rect"})).unwrap()["layer"].as_u64().unwrap();
-    let b = s.execute("layer.newShape", json!({"kind": "ellipse", "name": "Oval"})).unwrap()["layer"].as_u64().unwrap();
-    let contents = s.active_comp().unwrap().layer(LayerId(a)).unwrap().props.sub("contents").unwrap().clone();
-    let rect = contents.groups().next().unwrap().uid;
-    let mut h = harness(s);
-    h.state_mut().ui.timeline.open_groups.insert(contents.uid);
-    open_layer(&mut h, a);
-    (h, a, b, rect)
-}
-
-fn contents_names(h: &Harness<'_, EffectcraftApp>, l: u64) -> Vec<String> {
-    h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().props.sub("contents").unwrap().groups().map(|g| g.name.clone()).collect()
-}
-
-#[test]
-fn ctrl_c_and_ctrl_v_copy_a_shape_group_into_another_shape_layer() {
-    let (mut h, a, b, rect) = two_shape_layers();
-    click(&mut h, &format!("timeline.group.{rect}.name"));
-    assert_eq!(h.state().session.state.selected_props, vec![(LayerId(a), rect)]);
-    h.input_mut().events.push(Event::Copy);
-    h.step();
-    click(&mut h, &format!("timeline.layer.{b}.row"));
-    assert_eq!(h.state().session.state.selected_layers, vec![LayerId(b)]);
-    h.input_mut().events.push(Event::Paste("EffectCraft: 1 shape item".into()));
-    h.run_steps(3);
-    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 2, "no new layer");
-    assert_eq!(contents_names(&h, b), ["Rectangle 1", "Ellipse 1"]);
-    assert_eq!(contents_names(&h, a), ["Rectangle 1"]);
-}
-
-#[test]
-fn ctrl_d_duplicates_the_selected_shape_group_in_its_layer() {
-    let (mut h, a, _, rect) = two_shape_layers();
-    click(&mut h, &format!("timeline.group.{rect}.name"));
-    h.input_mut().events.push(Event::Key { key: Key::D, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
-    h.run_steps(3);
-    assert_eq!(h.state().session.active_comp().unwrap().layers.len(), 2, "no new layer");
-    assert_eq!(contents_names(&h, a), ["Rectangle 2", "Rectangle 1"]);
-}
-
-#[test]
-fn toolbar_stroke_edits_the_selected_shape_layer() {
-    let mut s = session();
-    let l = s.execute("layer.newShape", json!({"kind": "rect", "fill": "#ff0000"})).unwrap()["layer"].as_u64().unwrap();
-    let mut h = harness(s);
-    // The Selection tool is active: the options show for the selected shape layer.
-    click(&mut h, "header.strokeWidth");
-    h.input_mut().events.push(Event::Text("4".into()));
-    h.step();
-    h.input_mut().events.push(Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
-    h.run_steps(3);
-    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
-    let width = layer.props.prop("contents/group/contents/stroke/width").map(|p| p.value.as_f64());
-    assert_eq!(width, Some(4.0), "a stroke was added with the toolbar's width");
-    assert_eq!(h.state().session.state.shape_tool.stroke_width, 4.0);
-}
-
-/// Issue #633: a colour property in the Timeline (a shape's Fill Color) has an eyedropper after
-/// its swatch, as in After Effects: click it, then click in the Composition panel to sample.
-#[test]
-fn timeline_colour_eyedropper_samples_the_comp() {
-    let mut s = session();
-    s.execute("layer.newSolid", json!({"name": "Back", "color": "#20c040"})).unwrap();
-    let l = s.execute("layer.newShape", json!({"kind": "rect", "fill": [1.0, 0.0, 0.0], "size": [100.0, 60.0]})).unwrap()["layer"].as_u64().unwrap();
-    let layer = s.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
-    let mut fill = None;
-    layer.props.walk("", &mut |_, p| {
-        if fill.is_none() && matches!(p.value, effectcraft_engine::keyframe::Value::Color(_)) {
-            fill = Some(p.uid);
-        }
-    });
-    let fill = fill.expect("a fill colour");
-    fn groups(g: &effectcraft_engine::project::PropGroup, out: &mut Vec<u64>) {
-        for c in g.groups() {
-            out.push(c.uid);
-            groups(c, out);
-        }
-    }
-    let mut open = vec![];
-    groups(&layer.props, &mut open);
-    let mut h = harness(s);
-    h.state_mut().ui.timeline.open_groups.extend(open);
-    open_layer(&mut h, l);
-    settle(&mut h);
-    click(&mut h, &format!("timeline.prop.{fill}.eyedropper"));
-    assert_eq!(h.state().ui.fx_pick.as_ref().map(|p| (p.prop, p.kind.as_str())), Some((fill, "color")), "the eyedropper waits for a viewer click");
-    let pos = effectcraft_ui_egui::panels::viewer::comp_to_screen(&h.ctx, [6.0, 6.0]).unwrap();
-    click_at(&mut h, pos);
-    assert!(h.state().ui.fx_pick.is_none(), "the pick is used up");
-    let layer = h.state().session.active_comp().unwrap().layer(LayerId(l)).unwrap().clone();
-    let mut got = None;
-    layer.props.walk("", &mut |_, p| {
-        if p.uid == fill {
-            got = Some(p.value.clone());
-        }
-    });
-    let Some(effectcraft_engine::keyframe::Value::Color(c)) = got else { panic!("{got:?}") };
-    let want = [0x20 as f64 / 255.0, 0xc0 as f64 / 255.0, 0x40 as f64 / 255.0];
-    for k in 0..3 {
-        assert!((c[k] - want[k]).abs() < 0.02, "{c:?} vs {want:?}");
-    }
-}
-
-/// Ctrl+V with SVG markup on the system clipboard pastes it as a shape layer (After Effects
-/// 26.3), even with layers on the app's clipboard: copying in the app replaces the system
-/// clipboard, so the SVG was copied later (#738).
-#[test]
-fn ctrl_v_pastes_svg_markup_as_a_shape_layer() {
-    let (mut h, a, b, _) = two_shape_layers();
-    click(&mut h, &format!("timeline.layer.{b}.row"));
-    h.input_mut().events.push(Event::Copy);
-    h.step();
-    assert_eq!(h.state().session.state.clipboard.len(), 1, "a layer on the app's clipboard");
-    let svg = r##"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><circle cx="10" cy="10" r="8" fill="#00ff00"/><rect x="20" width="20" height="20"/></svg>"##;
-    h.input_mut().events.push(Event::Paste(svg.into()));
-    h.run_steps(3);
-    let c = h.state().session.active_comp().unwrap().clone();
-    assert_eq!(c.layers.len(), 3, "{:?}", h.state().ui.status);
-    let top = &c.layers[0];
-    assert!(top.id != LayerId(a) && top.id != LayerId(b));
-    assert_eq!(top.name, "Shape Layer 3");
-    assert_eq!(top.props.sub("contents").unwrap().groups().count(), 2);
-    assert_eq!(h.state().session.state.selected_layers, vec![top.id]);
-    // The app's own clipboard note pastes the copied layer as before.
-    h.input_mut().events.push(Event::Paste("EffectCraft: 1 layer".into()));
-    h.run_steps(3);
-    let c = h.state().session.active_comp().unwrap();
-    assert_eq!(c.layers.len(), 4);
-    assert_eq!(c.layers[0].name, "Oval 2");
-}
diff --git a/crates/ui-egui/tests/ui_unreadable_footage.rs b/crates/ui-egui/tests/ui_unreadable_footage.rs
deleted file mode 100644
index 9b48b9531..000000000
--- a/crates/ui-egui/tests/ui_unreadable_footage.rs
+++ /dev/null
@@ -1,63 +0,0 @@
-//! Footage whose codec the decoders lack says so: a warning marker in the Project panel and a
-//! notice on the layer in the Composition viewer, instead of a black picture with no reason.
-
-use std::sync::Arc;
-
-use effectcraft_engine::Session;
-use effectcraft_engine::project::{Footage, FootageKind, ItemId, ItemKind};
-use effectcraft_engine::render::FootageSource;
-use effectcraft_render::Image;
-use effectcraft_time::Tick;
-use effectcraft_ui_egui::EffectcraftApp;
-use egui_kittest::Harness;
-use serde_json::json;
-
-const WHY: &str = "H.264 (High 4:2:2) isn't supported by the built-in decoder: chroma_format_idc 2 (only 4:2:0 is implemented)";
-
-/// A source that decodes nothing and, for `broken` movies, says why.
-struct Stub(bool);
-
-impl FootageSource for Stub {
-    fn frame(&self, _: ItemId, _: &Footage, _: Tick) -> Option<Arc<Image>> {
-        None
-    }
-    fn problem(&self, _: &Footage) -> Option<String> {
-        self.0.then(|| WHY.to_string())
-    }
-}
-
-fn harness(broken: bool) -> (Harness<'static, EffectcraftApp>, ItemId) {
-    let mut s = Session { footage: Arc::new(Stub(broken)), ..Default::default() };
-    s.execute("comp.new", json!({"name": "Main", "width": 320, "height": 180, "duration": 4})).unwrap();
-    let footage = Footage {
-        kind: FootageKind::Video,
-        path: "clip.mp4".into(),
-        width: 64,
-        height: 36,
-        has_video: true,
-        duration: Tick::from_seconds_f64(2.0),
-        ..Default::default()
-    };
-    let clip = std::sync::Arc::make_mut(&mut s.project).add_item("Clip", Default::default(), None, ItemKind::Footage(footage));
-    s.execute("layer.addItem", json!({"item": clip.0})).unwrap();
-    s.execute("project.select", json!({"items": []})).unwrap();
-    let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1000.0)).build_eframe(|_| EffectcraftApp::new(s));
-    h.run_steps(4);
-    (h, clip)
-}
-
-#[test]
-fn undecodable_footage_is_marked_in_the_project_panel_and_the_viewer() {
-    let (h, clip) = harness(true);
-    let marker = h.state().auto.find(&format!("project.item.{}.problem", clip.0)).expect("a warning on the footage item").clone();
-    assert!(marker.label.contains("4:2:2"), "{marker:?}");
-    let notice = h.state().auto.query("viewer.footageProblem.").first().copied().expect("a notice in the viewer").clone();
-    assert!(notice.label.contains(WHY), "{notice:?}");
-}
-
-#[test]
-fn readable_footage_has_no_notice() {
-    let (h, clip) = harness(false);
-    assert!(h.state().auto.find(&format!("project.item.{}.problem", clip.0)).is_none());
-    assert!(h.state().auto.query("viewer.footageProblem.").is_empty());
-}
diff --git a/crates/vp9enc/src/bool.rs b/crates/vp9enc/src/bool.rs
index 0cd91b0e1..9eda40541 100644
--- a/crates/vp9enc/src/bool.rs
+++ b/crates/vp9enc/src/bool.rs
@@ -7,6 +7,9 @@ pub struct BoolEncoder {
     range: u32,
     bottom: u32,
     bit_count: i32,
+    /// Start of the run of 0xFF bytes at the end of `out` (`out.len()` when it ends in another
+    /// byte). A carry only touches that run and the byte before it.
+    ff_start: usize,
 }
 
 impl Default for BoolEncoder {
@@ -17,18 +20,37 @@ impl Default for BoolEncoder {
 
 impl BoolEncoder {
     pub fn new() -> Self {
-        BoolEncoder { out: Vec::new(), range: 255, bottom: 0, bit_count: 24 }
+        BoolEncoder { out: Vec::new(), range: 255, bottom: 0, bit_count: 24, ff_start: 0 }
     }
 
+    fn push_byte(&mut self, b: u8) {
+        if b != 255 {
+            self.ff_start = self.out.len() + 1;
+        }
+        self.out.push(b);
+    }
+
+    /// Carry into the bytes written so far: the trailing 0xFF run becomes 0x00 and the byte
+    /// before it grows by one (a carry out of the first byte is dropped). Each 0xFF byte is
+    /// cleared once, so a long run costs O(1) per byte instead of a rescan for every carry.
     fn add_one(&mut self) {
-        let mut i = self.out.len();
-        while i > 0 {
-            i -= 1;
-            if self.out[i] == 255 {
-                self.out[i] = 0;
-            } else {
-                self.out[i] += 1;
-                return;
+        let end = self.out.len();
+        let start = self.ff_start.min(end);
+        if let Some(run) = self.out.get_mut(start..) {
+            run.fill(0);
+        }
+        self.ff_start = end;
+        if let Some(i) = start.checked_sub(1)
+            && let Some(b) = self.out.get_mut(i)
+        {
+            *b = b.wrapping_add(1);
+            if *b == 255 {
+                // The grown byte joins the 0xFF bytes before it.
+                let mut s = i;
+                while s > 0 && self.out.get(s - 1) == Some(&255) {
+                    s -= 1;
+                }
+                self.ff_start = s;
             }
         }
     }
@@ -51,7 +73,7 @@ impl BoolEncoder {
             self.bottom <<= 1;
             self.bit_count -= 1;
             if self.bit_count == 0 {
-                self.out.push((self.bottom >> 24) as u8);
+                self.push_byte((self.bottom >> 24) as u8);
                 self.bottom &= (1 << 24) - 1;
                 self.bit_count = 8;
             }
@@ -80,7 +102,7 @@ impl BoolEncoder {
             v <<= 8;
         }
         for _ in 0..4 {
-            self.out.push((v >> 24) as u8);
+            self.push_byte((v >> 24) as u8);
             v <<= 8;
         }
         self.out
@@ -165,4 +187,73 @@ mod tests {
             assert!(dec.read(1));
         }
     }
+
+    /// The encoder as it was before the carry run was tracked: a carry rescans the bytes.
+    struct Scan {
+        out: Vec<u8>,
+        range: u32,
+        bottom: u32,
+        bit_count: i32,
+    }
+    impl Scan {
+        fn add_one(&mut self) {
+            let mut i = self.out.len();
+            while i > 0 {
+                i -= 1;
+                if self.out[i] == 255 {
+                    self.out[i] = 0;
+                } else {
+                    self.out[i] += 1;
+                    return;
+                }
+            }
+        }
+        fn write(&mut self, bit: bool, prob: u8) {
+            let split = 1 + (((self.range - 1) * prob as u32) >> 8);
+            if bit {
+                self.bottom = self.bottom.wrapping_add(split);
+                self.range -= split;
+            } else {
+                self.range = split;
+            }
+            while self.range < 128 {
+                self.range <<= 1;
+                if self.bottom & (1 << 31) != 0 {
+                    self.add_one();
+                }
+                self.bottom <<= 1;
+                self.bit_count -= 1;
+                if self.bit_count == 0 {
+                    self.out.push((self.bottom >> 24) as u8);
+                    self.bottom &= (1 << 24) - 1;
+                    self.bit_count = 8;
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn carry_run_tracking_matches_the_rescan() {
+        let mut seed = 99u32;
+        for case in 0..300 {
+            let mut fast = BoolEncoder::new();
+            let mut slow = Scan { out: vec![], range: 255, bottom: 0, bit_count: 24 };
+            // Skewed probabilities make long 0xFF runs and carries likely.
+            let extreme = case % 3;
+            for _ in 0..4000 {
+                seed ^= seed << 13;
+                seed ^= seed >> 17;
+                seed ^= seed << 5;
+                let p = match extreme {
+                    0 => (seed >> 8) as u8 | 1,
+                    1 => 1 + (seed >> 8) as u8 % 4,
+                    _ => 255 - (seed >> 8) as u8 % 4,
+                };
+                let bit = (seed >> 24) % 256 >= p as u32 || (seed >> 3).is_multiple_of(11);
+                fast.write(bit, p);
+                slow.write(bit, p);
+                assert_eq!(fast.out, slow.out, "case {case}");
+            }
+        }
+    }
 }
diff --git a/crates/vp9enc/src/lf.rs b/crates/vp9enc/src/lf.rs
index d781144fe..d48c57db5 100644
--- a/crates/vp9enc/src/lf.rs
+++ b/crates/vp9enc/src/lf.rs
@@ -13,6 +13,14 @@ struct Limits {
     thresh: i32,
 }
 
+/// Mode-info grid and thresholds shared by every superblock of this frame.
+struct FrameFilter<'a> {
+    mi: &'a [Mi],
+    mi_rows: usize,
+    mi_cols: usize,
+    limits: Limits,
+}
+
 /// Filter the reconstructed planes (Y, U, V, or a prefix of them) in place at `level` (0 = off;
 /// sharpness 0).
 pub fn filter_frame(planes: &mut [Plane], mi: &[Mi], mi_rows: usize, mi_cols: usize, level: u8) {
@@ -22,61 +30,182 @@ pub fn filter_frame(planes: &mut [Plane], mi: &[Mi], mi_rows: usize, mi_cols: us
     let l = level as i32;
     let limit = l.max(1);
     let lim = Limits { limit, blimit: 2 * (l + 2) + limit, thresh: l >> 4 };
+    let filter = FrameFilter { mi, mi_rows, mi_cols, limits: lim };
     for sbr in 0..mi_rows.div_ceil(8) {
         for sbc in 0..mi_cols.div_ceil(8) {
             for (plane, p) in planes.iter_mut().enumerate() {
                 for pass in 0..2 {
-                    sb_plane(p, mi, mi_rows, mi_cols, plane, pass, sbr * 8, sbc * 8, lim);
+                    filter.sb_plane(p, plane, pass, sbr * 8, sbc * 8);
                 }
             }
         }
     }
 }
 
-#[allow(clippy::too_many_arguments)]
-fn sb_plane(p: &mut Plane, mi: &[Mi], mi_rows: usize, mi_cols: usize, plane: usize, pass: usize, row: usize, col: usize, lim: Limits) {
-    let (sx, sy) = if plane > 0 { (1, 1) } else { (0, 0) };
-    let (sub, edge_len) = if pass == 0 { (sx, 64 >> sy) } else { (sy, 64 >> sx) };
-    let stride = p.w;
-    for edge in 0..(16usize >> sub) {
-        let mut i = 0;
-        while i < edge_len {
-            let (x, y) = if pass == 0 { (col * 8 + edge * (4 << sx), row * 8 + (i << sy)) } else { (col * 8 + (i << sx), row * 8 + edge * (4 << sy)) };
-            if x >= 8 * mi_cols || y >= 8 * mi_rows || (pass == 0 && x == 0) || (pass == 1 && y == 0) {
-                i += 8;
-                continue;
-            }
-            let lc = ((x >> 3) >> sx) << sx;
-            let lr = ((y >> 3) >> sy) << sy;
-            let m = mi[lr * mi_cols + lc];
-            let size = if sub == 0 { m.size } else { m.size.max(BLOCK_16X16) };
-            let n8 = if size >= BLOCK_16X16 { 2 } else { 1 };
-            let is_block_edge = if pass == 0 { x & (8 * n8 - 1) == 0 } else { y & (8 * n8 - 1) == 0 };
-            let tx_ok = !m.inter || !m.skip;
-            if !is_block_edge && !tx_ok {
-                i += 8;
-                continue;
-            }
-            let wide = edge % 8 == 0;
-            let n = if pass == 0 { (8 * mi_rows - y).div_ceil(1 << sy) } else { (8 * mi_cols - x).div_ceil(1 << sx) }.min(8).min(edge_len - i);
-            // A transform edge is not filtered in the last odd chroma column.
-            let odd_last = pass == 1 && sx == 1 && mi_cols & 1 == 1 && edge & 1 == 1;
-            let (px, py) = (x >> sx, y >> sy);
-            for l in 0..n {
-                let is_tx_edge = tx_ok && !(odd_last && x + (l << sx) + 8 >= mi_cols * 8);
-                if !(is_block_edge || is_tx_edge) {
+impl FrameFilter<'_> {
+    fn sb_plane(&self, p: &mut Plane, plane: usize, pass: usize, row: usize, col: usize) {
+        let Self { mi, mi_rows, mi_cols, limits: lim } = *self;
+        let (sx, sy) = if plane > 0 { (1, 1) } else { (0, 0) };
+        let (sub, edge_len) = if pass == 0 { (sx, 64 >> sy) } else { (sy, 64 >> sx) };
+        let stride = p.w;
+        for edge in 0..(16usize >> sub) {
+            let mut i = 0;
+            while i < edge_len {
+                let (x, y) = if pass == 0 { (col * 8 + edge * (4 << sx), row * 8 + (i << sy)) } else { (col * 8 + (i << sx), row * 8 + edge * (4 << sy)) };
+                if x >= 8 * mi_cols || y >= 8 * mi_rows || (pass == 0 && x == 0) || (pass == 1 && y == 0) {
+                    i += 8;
                     continue;
                 }
-                let (pos, step) = if pass == 0 { ((py + l) * stride + px, 1) } else { (py * stride + px + l, stride) };
-                filter_lane(&mut p.rec, pos, step, wide, lim);
+                let lc = ((x >> 3) >> sx) << sx;
+                let lr = ((y >> 3) >> sy) << sy;
+                let m = mi[lr * mi_cols + lc];
+                let size = if sub == 0 { m.size } else { m.size.max(BLOCK_16X16) };
+                let n8 = if size >= BLOCK_16X16 { 2 } else { 1 };
+                let is_block_edge = if pass == 0 { x & (8 * n8 - 1) == 0 } else { y & (8 * n8 - 1) == 0 };
+                let tx_ok = !m.inter || !m.skip;
+                if !is_block_edge && !tx_ok {
+                    i += 8;
+                    continue;
+                }
+                let wide = edge % 8 == 0;
+                let n = if pass == 0 { (8 * mi_rows - y).div_ceil(1 << sy) } else { (8 * mi_cols - x).div_ceil(1 << sx) }.min(8).min(edge_len - i);
+                // A transform edge is not filtered in the last odd chroma column.
+                let odd_last = pass == 1 && sx == 1 && mi_cols & 1 == 1 && edge & 1 == 1;
+                let (px, py) = (x >> sx, y >> sy);
+                let mut apply = [false; LANES];
+                for (l, a) in apply.iter_mut().enumerate().take(n) {
+                    let is_tx_edge = tx_ok && !(odd_last && x + (l << sx) + 8 >= mi_cols * 8);
+                    *a = is_block_edge || is_tx_edge;
+                }
+                if apply.iter().any(|&a| a) {
+                    let pos = py * stride + px;
+                    if pass == 0 {
+                        filter_group::<false>(&mut p.rec, pos, stride, 1, apply, wide, lim);
+                    } else {
+                        filter_group::<true>(&mut p.rec, pos, 1, stride, apply, wide, lim);
+                    }
+                }
+                i += 8;
+            }
+        }
+    }
+}
+
+const LANES: usize = 8;
+
+/// [`filter_lane`] on the 8 lanes of a group at once (lane `l` has its q0 at `pos + l * along`;
+/// samples across the edge are `step` apart; `ROWS`: `along` is 1), for lanes whose `apply` is
+/// set. Every lane is computed with both filters and the result selected per lane (0 / -1
+/// masks), so the arithmetic vectorizes; lanes left alone are written back unchanged.
+#[inline(always)]
+fn filter_group<const ROWS: bool>(d: &mut [u8], pos: usize, along: usize, step: usize, apply: [bool; LANES], wide: bool, lim: Limits) {
+    type T = i16;
+    let mut v = [[0 as T; LANES]; 8];
+    let start = pos - 4 * step;
+    if ROWS {
+        for (k, vk) in v.iter_mut().enumerate() {
+            let Some(row) = d.get(start + k * step..).and_then(|r| r.first_chunk::<LANES>()) else { return };
+            *vk = row.map(|s| s as T);
+        }
+    } else {
+        for l in 0..LANES {
+            let Some(line) = d.get(start + l * along..).and_then(|r| r.first_chunk::<8>()) else { return };
+            for k in 0..8 {
+                v[k][l] = line[k] as T;
+            }
+        }
+    }
+    let (limit, blimit, thresh) = (lim.limit as T, lim.blimit as T, lim.thresh as T);
+    let le = |a: T, b: T| -((a <= b) as T);
+    let sel = |m: T, a: T, b: T| (a & m) | (b & !m);
+    let (p3, p2, p1, p0, q0, q1, q2, q3) = (&v[0], &v[1], &v[2], &v[3], &v[4], &v[5], &v[6], &v[7]);
+    let apply: [T; LANES] = apply.map(|a| -(a as T));
+    let can_flat = -(wide as T);
+    let mut mask = [0 as T; LANES];
+    let mut hev = [0 as T; LANES];
+    let mut flat = [0 as T; LANES];
+    for l in 0..LANES {
+        let d10 = (p1[l] - p0[l]).abs();
+        let e10 = (q1[l] - q0[l]).abs();
+        mask[l] = apply[l]
+            & le((p3[l] - p2[l]).abs(), limit)
+            & le((p2[l] - p1[l]).abs(), limit)
+            & le(d10, limit)
+            & le(e10, limit)
+            & le((q2[l] - q1[l]).abs(), limit)
+            & le((q3[l] - q2[l]).abs(), limit)
+            & le((p0[l] - q0[l]).abs() * 2 + (p1[l] - q1[l]).abs() / 2, blimit);
+        hev[l] = !(le(d10, thresh) & le(e10, thresh));
+        flat[l] = can_flat
+            & mask[l]
+            & le(d10, 1)
+            & le(e10, 1)
+            & le((p2[l] - p0[l]).abs(), 1)
+            & le((q2[l] - q0[l]).abs(), 1)
+            & le((p3[l] - p0[l]).abs(), 1)
+            & le((q3[l] - q0[l]).abs(), 1);
+    }
+    if mask.iter().fold(0, |a, &m| a | m) == 0 {
+        return;
+    }
+    let mut out = v;
+    let c = |x: T| x.clamp(-128, 127);
+    for l in 0..LANES {
+        let (ps1, ps0, qs0, qs1) = (p1[l] - 128, p0[l] - 128, q0[l] - 128, q1[l] - 128);
+        let filter = c((c(ps1 - qs1) & hev[l]) + 3 * (qs0 - ps0));
+        let f1 = c(filter + 4) >> 3;
+        let f2 = c(filter + 3) >> 3;
+        let f = (f1 + 1) >> 1;
+        let narrow = mask[l] & !flat[l];
+        let outer = narrow & !hev[l];
+        out[4][l] = sel(narrow, c(qs0 - f1) + 128, out[4][l]);
+        out[3][l] = sel(narrow, c(ps0 + f2) + 128, out[3][l]);
+        out[5][l] = sel(outer, c(qs1 - f) + 128, out[5][l]);
+        out[2][l] = sel(outer, c(ps1 + f) + 128, out[2][l]);
+    }
+    if flat.iter().fold(0, |a, &f| a | f) != 0 {
+        // 8-tap: positions p2..q2 (indices 1..7), each the rounded mean of a 7-wide window
+        // (indices clamped to 0..8) plus itself, as a sliding sum.
+        let s = |k: isize| &v[k.clamp(0, 7) as usize];
+        let mut sum = [0 as T; LANES];
+        for j in -2isize..=4 {
+            let a = s(j);
+            for l in 0..LANES {
+                sum[l] += a[l];
+            }
+        }
+        for k in 1usize..7 {
+            let ki = k as isize;
+            let (cur, add, sub) = (s(ki), s(ki + 4), s(ki - 3));
+            for l in 0..LANES {
+                let w8 = (sum[l] + cur[l] + 4) >> 3;
+                out[k][l] = sel(flat[l], w8, out[k][l]);
+                sum[l] += add[l] - sub[l];
+            }
+        }
+    }
+    if ROWS {
+        for (k, ok) in out.iter().enumerate().take(7).skip(1) {
+            if let Some(row) = d.get_mut(start + k * step..).and_then(|r| r.first_chunk_mut::<LANES>()) {
+                for l in 0..LANES {
+                    row[l] = ok[l] as u8;
+                }
+            }
+        }
+    } else {
+        for l in 0..LANES {
+            if let Some(line) = d.get_mut(start + l * along..).and_then(|r| r.first_chunk_mut::<8>()) {
+                for k in 1..7 {
+                    line[k] = out[k][l] as u8;
+                }
             }
-            i += 8;
         }
     }
 }
 
 /// Filter mask, narrow (4-tap) and 8-tap flat filters of spec 8.8.5 across one edge position;
 /// `pos` is q0, samples across the edge are `step` apart.
+#[cfg(test)]
 fn filter_lane(d: &mut [u8], pos: usize, step: usize, wide: bool, lim: Limits) {
     let at = |k: isize| d[(pos as isize + k * step as isize) as usize] as i32;
     let (p3, p2, p1, p0) = (at(-4), at(-3), at(-2), at(-1));
@@ -122,3 +251,49 @@ fn filter_lane(d: &mut [u8], pos: usize, step: usize, wide: bool, lim: Limits) {
         set(-2, c(ps1 + f) + 128);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn group_matches_per_lane_filter() {
+        let mut seed = 0x1234_5678u32;
+        let mut rnd = || {
+            seed ^= seed << 13;
+            seed ^= seed >> 17;
+            seed ^= seed << 5;
+            seed
+        };
+        for case in 0..20000 {
+            let stride = 24;
+            let base: Vec<u8> = {
+                let flatish = case % 3 == 0;
+                let c = (rnd() % 256) as i32;
+                (0..stride * 24)
+                    .map(|_| if flatish { (c + (rnd() % 3) as i32 - 1).clamp(0, 255) as u8 } else { (c + (rnd() % 40) as i32 - 20).clamp(0, 255) as u8 })
+                    .collect()
+            };
+            let l = (rnd() % 64) as i32;
+            let lim = Limits { limit: l.max(1), blimit: 2 * (l + 2) + l.max(1), thresh: l >> 4 };
+            let wide = rnd() & 1 == 1;
+            let apply: [bool; LANES] = std::array::from_fn(|_| rnd() % 4 != 0);
+            for pass in 0..2 {
+                let (mut a, mut b) = (base.clone(), base.clone());
+                let pos = 8 * stride + 8;
+                for (l, &ap) in apply.iter().enumerate() {
+                    if ap {
+                        let (p, st) = if pass == 0 { (pos + l * stride, 1) } else { (pos + l, stride) };
+                        filter_lane(&mut a, p, st, wide, lim);
+                    }
+                }
+                if pass == 0 {
+                    filter_group::<false>(&mut b, pos, stride, 1, apply, wide, lim);
+                } else {
+                    filter_group::<true>(&mut b, pos, 1, stride, apply, wide, lim);
+                }
+                assert_eq!(a, b, "case {case} pass {pass}");
+            }
+        }
+    }
+}
diff --git a/crates/vp9enc/src/lib.rs b/crates/vp9enc/src/lib.rs
index 9364dfaa1..12ad77ae7 100644
--- a/crates/vp9enc/src/lib.rs
+++ b/crates/vp9enc/src/lib.rs
@@ -33,12 +33,17 @@ use probs::Probs;
 use tables::{AC_QLOOKUP, DC_QLOOKUP};
 use transform::Quant;
 
+/// Largest width or height the 16-bit frame size fields can hold.
+const MAX_DIMENSION: u32 = 1 << 16;
+
 pub(crate) const BLOCK_8X8: u8 = 3;
 pub(crate) const BLOCK_16X16: u8 = 6;
 
 /// Encoder settings.
 #[derive(Clone, Debug, PartialEq)]
 pub struct EncoderConfig {
+    /// Frame size in samples; the stream stores size - 1 in 16 bits, so values above 65536 are
+    /// clamped to 65536 by [`Vp9Encoder::new`].
     pub width: u32,
     pub height: u32,
     /// 1..=100; 100 is lossless. With a target bitrate: the quality of the first frame.
@@ -85,7 +90,6 @@ pub(crate) struct Plane {
 }
 
 impl Plane {
-    #[allow(clippy::too_many_arguments)]
     fn new(data: &[u8], vw: usize, vh: usize, w: usize, h: usize, max_x: usize, max_y: usize) -> Plane {
         let mut src = vec![0u8; w * h];
         for y in 0..h {
@@ -140,7 +144,10 @@ fn quality_to_qidx(q: u8) -> u8 {
 }
 
 impl Vp9Encoder {
-    pub fn new(cfg: EncoderConfig) -> Self {
+    pub fn new(mut cfg: EncoderConfig) -> Self {
+        // The frame header stores width - 1 and height - 1 in 16 bits.
+        cfg.width = cfg.width.min(MAX_DIMENSION);
+        cfg.height = cfg.height.min(MAX_DIMENSION);
         let q = cfg.quality.clamp(1, 100);
         let lossless = q >= 100 && cfg.target_kbps.is_none();
         let base_qidx = if lossless { 0 } else { quality_to_qidx(q) };
@@ -461,3 +468,16 @@ pub fn alpha_to_yuv420(rgba: &[u8], w: u32, h: u32) -> (Vec<u8>, Vec<u8>, Vec<u8
     let y: Vec<u8> = rgba.as_chunks::<4>().0.iter().take(w * h).map(|p| p[3]).collect();
     (y, vec![128; cw * ch], vec![128; cw * ch])
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sizes_beyond_the_16_bit_header_fields_are_clamped() {
+        let enc = Vp9Encoder::new(EncoderConfig { width: 70_000, height: u32::MAX, ..Default::default() });
+        assert_eq!((enc.cfg.width, enc.cfg.height), (65_536, 65_536));
+        let enc = Vp9Encoder::new(EncoderConfig { width: 65_536, height: 1, ..Default::default() });
+        assert_eq!((enc.cfg.width, enc.cfg.height), (65_536, 1));
+    }
+}
diff --git a/crates/vp9enc/src/mc.rs b/crates/vp9enc/src/mc.rs
index 779a1ea5f..5d897f854 100644
--- a/crates/vp9enc/src/mc.rs
+++ b/crates/vp9enc/src/mc.rs
@@ -56,6 +56,26 @@ pub fn predict(r: &RefPlane, x16: i32, y16: i32, w: usize, h: usize, out: &mut [
     };
     let fh = &SUBPEL_REGULAR[fx];
     let fv = &SUBPEL_REGULAR[fy];
+    if inside && w <= 16 && h <= 16 {
+        // Rows straight from the reference (no edge clamping needed).
+        let (xs, ys) = ((x0 - 3) as usize, (y0 - 3) as usize);
+        let row = |i: usize| &r.data[(ys + i) * r.stride + xs..];
+        if fx == 0 && fy == 0 {
+            for i in 0..h {
+                out[i * w..i * w + w].copy_from_slice(&row(i + 3)[3..3 + w]);
+            }
+            return;
+        }
+        let mut tmp = [0u8; 23 * 16];
+        for i in 0..h + 7 {
+            let s = row(i);
+            filt8(std::array::from_fn(|t| &s[t..]), fh, &mut tmp[i * w..i * w + w]);
+        }
+        for i in 0..h {
+            filt8(std::array::from_fn(|t| &tmp[(i + t) * w..]), fv, &mut out[i * w..i * w + w]);
+        }
+        return;
+    }
     if fx == 0 && fy == 0 {
         for i in 0..h {
             for j in 0..w {
@@ -108,24 +128,23 @@ impl PhasePlanes {
         let rh = ph + 2 * M;
         let off = (border + M) as i32;
         let mut raw = vec![0u8; rs * rh];
-        for y in 0..rh {
+        let o = off as usize;
+        for (y, row) in raw.chunks_exact_mut(rs).enumerate() {
             let sy = (y as i32 - off).clamp(0, r.h as i32 - 1) as usize;
             let src = &r.data[sy * r.stride..sy * r.stride + r.w];
-            for x in 0..rs {
-                raw[y * rs + x] = src[(x as i32 - off).clamp(0, r.w as i32 - 1) as usize];
-            }
+            // Edge replication: src[clamp(x - off, 0, w - 1)].
+            let (left, rest) = row.split_at_mut(o.min(rs));
+            left.fill(src[0]);
+            let n = r.w.min(rest.len());
+            rest[..n].copy_from_slice(&src[..n]);
+            rest[n..].fill(src[r.w - 1]);
         }
         // Horizontal phases over every raw row (inner columns).
         let hpass = |fx: usize| -> Vec<u8> {
             let f = &SUBPEL_REGULAR[fx];
             let mut out = vec![0u8; pw * rh];
-            for y in 0..rh {
-                let row = &raw[y * rs..y * rs + rs];
-                for x in 0..pw {
-                    let s = &row[x + M - 3..x + M + 5];
-                    let acc: i32 = 64 + (0..8).map(|t| f[t] * s[t] as i32).sum::<i32>();
-                    out[y * pw + x] = (acc >> 7).clamp(0, 255) as u8;
-                }
+            for (row, o) in raw.chunks_exact(rs).zip(out.chunks_exact_mut(pw)) {
+                filt8(std::array::from_fn(|t| &row[M - 3 + t..]), f, o);
             }
             out
         };
@@ -140,14 +159,8 @@ impl PhasePlanes {
                 }
                 let f = &SUBPEL_REGULAR[fy * 4];
                 let mut out = vec![0u8; pw * ph];
-                for y in 0..ph {
-                    for x in 0..pw {
-                        let mut acc = 64;
-                        for t in 0..8 {
-                            acc += f[t] * hp[(y + M + t - 3) * pw + x] as i32;
-                        }
-                        out[y * pw + x] = (acc >> 7).clamp(0, 255) as u8;
-                    }
+                for (y, o) in out.chunks_exact_mut(pw).enumerate() {
+                    filt8(std::array::from_fn(|t| &hp[(y + M + t - 3) * pw..]), f, o);
                 }
                 planes.push(out);
             }
@@ -167,6 +180,51 @@ impl PhasePlanes {
     }
 }
 
+/// `out[x] = clip(Round2(sum_t f[t] * s[t][x], 7))` for 8-bit samples. Lanes are 16-bit sums
+/// kept modulo 2^16: with the regular filter every sum plus the rounding term lies in
+/// [-13706, 46474], so wrapped non-negative sums stay below 0xC000 and negative ones (clipped
+/// to 0) land above it (the decoder's `narrow8`).
+#[inline]
+fn filt8(s: [&[u8]; 8], f: &[i32; 8], out: &mut [u8]) {
+    let n = out.len();
+    let mut x = 0;
+    while x + 32 <= n {
+        filt_chunk::<32>(&s, f, out, x);
+        x += 32;
+    }
+    for w in [16, 8, 4] {
+        if x + w <= n {
+            match w {
+                16 => filt_chunk::<16>(&s, f, out, x),
+                8 => filt_chunk::<8>(&s, f, out, x),
+                _ => filt_chunk::<4>(&s, f, out, x),
+            }
+            x += w;
+        }
+    }
+    for j in x..n {
+        let acc: i32 = 64 + (0..8).map(|t| f[t] * s[t][j] as i32).sum::<i32>();
+        out[j] = (acc >> 7).clamp(0, 255) as u8;
+    }
+}
+
+#[inline(always)]
+fn filt_chunk<const W: usize>(s: &[&[u8]; 8], f: &[i32; 8], out: &mut [u8], x: usize) {
+    let mut acc = [64u16; W];
+    for t in 0..8 {
+        let c = f[t] as u16;
+        let Some(p) = s[t].get(x..).and_then(|p| p.first_chunk::<W>()) else { return };
+        for j in 0..W {
+            acc[j] = acc[j].wrapping_add(c.wrapping_mul(p[j] as u16));
+        }
+    }
+    if let Some(o) = out.get_mut(x..).and_then(|o| o.first_chunk_mut::<W>()) {
+        for j in 0..W {
+            o[j] = if acc[j] < 0xC000 { (acc[j] >> 7).min(255) as u8 } else { 0 };
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     #[test]
diff --git a/crates/vp9enc/src/probs.rs b/crates/vp9enc/src/probs.rs
index 8f55bbba3..c089cb96f 100644
--- a/crates/vp9enc/src/probs.rs
+++ b/crates/vp9enc/src/probs.rs
@@ -9,7 +9,11 @@
 //! entropy codes the recorded symbols with the updated probabilities.
 
 use crate::bool::BoolEncoder;
-use crate::tables::*;
+use crate::tables::{
+    DEFAULT_COEF_PROBS, DEFAULT_INTER_MODE_PROBS, DEFAULT_IS_INTER_PROB, DEFAULT_MV_BITS_PROB, DEFAULT_MV_CLASS_PROBS, DEFAULT_MV_CLASS0_BIT_PROB,
+    DEFAULT_MV_CLASS0_FR_PROBS, DEFAULT_MV_FR_PROBS, DEFAULT_MV_JOINT_PROBS, DEFAULT_MV_SIGN_PROB, DEFAULT_PARTITION_PROBS, DEFAULT_SINGLE_REF_PROB,
+    DEFAULT_SKIP_PROB, PARETO_TABLE, inv_map_table,
+};
 
 /// Coefficient probabilities `[ptype][ref][band][ctx][3]` for 4×4 transforms (band 0 uses
 /// contexts 0..3 only).
@@ -212,7 +216,32 @@ fn inv_remap_prob(delta: usize, prob: u8) -> u8 {
 
 /// The `decode_term_subexp` value that moves `old` to `new`.
 fn delta_for(old: u8, new: u8) -> Option<usize> {
-    (0..255).find(|&d| inv_remap_prob(d, old) == new)
+    match delta_table().get(old as usize * 256 + new as usize) {
+        Some(&d) if d != NO_DELTA => Some(d as usize),
+        _ => None,
+    }
+}
+
+/// Marks "no delta reaches this probability" in [`delta_table`].
+const NO_DELTA: u8 = 255;
+
+/// `delta_for` for every (old, new) pair, indexed `old * 256 + new`: the smallest delta that
+/// moves `old` to `new`. Filled from the largest delta down so the smallest one wins.
+fn delta_table() -> &'static [u8] {
+    use std::sync::OnceLock;
+    static T: OnceLock<Vec<u8>> = OnceLock::new();
+    T.get_or_init(|| {
+        let mut t = vec![NO_DELTA; 256 * 256];
+        for old in 0..=255u8 {
+            for d in (0..255usize).rev() {
+                let new = inv_remap_prob(d, old);
+                if let Some(e) = t.get_mut(old as usize * 256 + new as usize) {
+                    *e = d as u8;
+                }
+            }
+        }
+        t
+    })
 }
 
 /// Bits of `decode_term_subexp` for `d`.
@@ -415,6 +444,16 @@ mod tests {
         }
     }
 
+    #[test]
+    fn delta_table_matches_the_linear_search() {
+        for old in 0..=255u8 {
+            for new in 0..=255u8 {
+                let slow = (0..255).find(|&d| inv_remap_prob(d, old) == new);
+                assert_eq!(delta_for(old, new), slow, "{old} -> {new}");
+            }
+        }
+    }
+
     #[test]
     fn inv_map_table_shape() {
         let t = inv_map_table();
diff --git a/crates/vp9enc/src/tables.rs b/crates/vp9enc/src/tables.rs
index ffb266419..c70d7d8c2 100644
--- a/crates/vp9enc/src/tables.rs
+++ b/crates/vp9enc/src/tables.rs
@@ -2,8 +2,6 @@
 //! transcribed in FilmCraft's first-party decoder `filmcraft-vp9` (MIT OR Apache-2.0, the same
 //! licence as this crate).
 
-#![allow(clippy::unreadable_literal)]
-
 pub const DC_QLOOKUP: [i32; 256] = [
     4, 8, 8, 9, 10, 11, 12, 12, 13, 14, 15, 16, 17, 18, 19, 19, 20, 21, 22, 23, 24, 25, 26, 26, 27, 28, 29, 30, 31, 32, 32, 33, 34, 35, 36, 37, 38, 38, 39, 40,
     41, 42, 43, 43, 44, 45, 46, 47, 48, 48, 49, 50, 51, 52, 53, 53, 54, 55, 56, 57, 57, 58, 59, 60, 61, 62, 62, 63, 64, 65, 66, 66, 67, 68, 69, 70, 70, 71, 72,
diff --git a/crates/vp9enc/src/tile.rs b/crates/vp9enc/src/tile.rs
index d7f6cb64f..082d0bd83 100644
--- a/crates/vp9enc/src/tile.rs
+++ b/crates/vp9enc/src/tile.rs
@@ -8,7 +8,10 @@
 
 use crate::mc::{Mv, PhasePlanes, RefPlane, clamp_for_plane, predict};
 use crate::probs::{self, P, Writer, cost, tree_cost};
-use crate::tables::*;
+use crate::tables::{
+    COEFBAND_4X4, COL_SCAN_4X4, COUNTER_TO_CONTEXT, DEFAULT_SCAN_4X4, ENERGY_CLASS, KF_PARTITION_PROBS, KF_UV_MODE_PROBS, KF_Y_MODE_PROBS, MODE_2_COUNTER,
+    MV_REF_8X8, MV_REF_16X16, ROW_SCAN_4X4,
+};
 use crate::transform::{ADST_ADST, ADST_DCT, DCT_ADST, DCT_DCT, Quant};
 use crate::{BLOCK_8X8, BLOCK_16X16, Mi, Plane};
 
@@ -22,6 +25,13 @@ pub const NEARMV: u8 = 11;
 pub const ZEROMV: u8 = 12;
 pub const NEWMV: u8 = 13;
 
+/// Which reconstructed neighbours are available for intra prediction.
+#[derive(Clone, Copy)]
+struct IntraEdges {
+    left: bool,
+    above: bool,
+}
+
 const PARTITION_TREE: [i8; 6] = [0, 2, -1, 4, -2, -3];
 const INTRA_MODE_TREE: [i8; 18] = [0, 2, -9, 4, -1, 6, 8, 12, -2, 10, -4, -5, -3, 14, -8, 16, -6, -7];
 /// Leaves are `mode - NEARESTMV`.
@@ -104,7 +114,8 @@ fn levels_cost(levels: &[i32; 16], eob: usize) -> u32 {
 }
 
 /// Intra prediction (8.5.1) of a square block for DC / V / H / TM.
-fn predict_intra(p: &Plane, x: usize, y: usize, log2: usize, mode: u8, have_left: bool, have_above: bool) -> [i32; 64] {
+fn predict_intra(p: &Plane, x: usize, y: usize, log2: usize, mode: u8, edges: IntraEdges) -> [i32; 64] {
+    let IntraEdges { left: have_left, above: have_above } = edges;
     let size = 1usize << log2;
     let base = 128i32;
     let buf = &p.rec;
@@ -211,6 +222,21 @@ fn probs_defaults() -> &'static probs::Probs {
     D.get_or_init(probs::Probs::defaults)
 }
 
+/// SAD of two N×N blocks: per-column 16-bit sums (at most 16 · 255), summed once.
+#[inline(always)]
+fn sad_n<const N: usize>(a: &[u8], sa: usize, b: &[u8], sb: usize) -> u32 {
+    let mut acc = [0u16; N];
+    for i in 0..N {
+        let (Some(ra), Some(rb)) = (a.get(i * sa..).and_then(|r| r.first_chunk::<N>()), b.get(i * sb..).and_then(|r| r.first_chunk::<N>())) else {
+            return u32::MAX / 4;
+        };
+        for j in 0..N {
+            acc[j] += ra[j].abs_diff(rb[j]) as u16;
+        }
+    }
+    acc.iter().map(|&v| v as u32).sum()
+}
+
 // ---------------------------------------------------------------- the tile
 
 /// Per-frame coding parameters shared by the tiles.
@@ -356,11 +382,11 @@ impl<'a> Tile<'a> {
     fn intra_block(&mut self, r: usize, c: usize) {
         let avail_u = r > 0;
         let avail_l = c > self.col_start;
-        let y_mode = self.choose_intra(0, c * 8, r * 8, 3, avail_l, avail_u);
+        let y_mode = self.choose_intra(0, c * 8, r * 8, 3, IntraEdges { left: avail_l, above: avail_u });
         let uv_mode = {
             let mut best = (i64::MAX, DC_PRED);
             for m in MODES {
-                let cost: i64 = (1..3).map(|p| self.intra_cost(p, c * 4, r * 4, 2, m, avail_l, avail_u)).sum();
+                let cost: i64 = (1..3).map(|p| self.intra_cost(p, c * 4, r * 4, 2, m, IntraEdges { left: avail_l, above: avail_u })).sum();
                 if cost < best.0 {
                     best = (cost, m);
                 }
@@ -379,17 +405,16 @@ impl<'a> Tile<'a> {
         // Residual: luma 2×2 transform blocks, then one 4×4 block per chroma plane.
         for (dy, dx) in [(0, 0), (0, 1), (1, 0), (1, 1)] {
             let tx = if self.f.quant.lossless { DCT_DCT } else { mode_tx_type(y_mode) };
-            self.intra_tx(0, c * 8 + dx * 4, r * 8 + dy * 4, y_mode, tx, avail_l || dx > 0, avail_u || dy > 0);
+            self.intra_tx(0, c * 8 + dx * 4, r * 8 + dy * 4, y_mode, tx, IntraEdges { left: avail_l || dx > 0, above: avail_u || dy > 0 });
         }
         for p in 1..3 {
-            self.intra_tx(p, c * 4, r * 4, uv_mode, DCT_DCT, avail_l, avail_u);
+            self.intra_tx(p, c * 4, r * 4, uv_mode, DCT_DCT, IntraEdges { left: avail_l, above: avail_u });
         }
     }
 
-    #[allow(clippy::too_many_arguments)]
-    fn intra_cost(&self, plane: usize, x: usize, y: usize, log2: usize, mode: u8, have_left: bool, have_above: bool) -> i64 {
+    fn intra_cost(&self, plane: usize, x: usize, y: usize, log2: usize, mode: u8, edges: IntraEdges) -> i64 {
         let p = &self.planes[plane];
-        let pred = predict_intra(p, x, y, log2, mode, have_left, have_above);
+        let pred = predict_intra(p, x, y, log2, mode, edges);
         let size = 1 << log2;
         let mut s = 0i64;
         for i in 0..size {
@@ -400,10 +425,10 @@ impl<'a> Tile<'a> {
         s
     }
 
-    fn choose_intra(&self, plane: usize, x: usize, y: usize, log2: usize, have_left: bool, have_above: bool) -> u8 {
+    fn choose_intra(&self, plane: usize, x: usize, y: usize, log2: usize, edges: IntraEdges) -> u8 {
         let mut best = (i64::MAX, DC_PRED);
         for m in MODES {
-            let cost = self.intra_cost(plane, x, y, log2, m, have_left, have_above);
+            let cost = self.intra_cost(plane, x, y, log2, m, edges);
             if cost < best.0 {
                 best = (cost, m);
             }
@@ -411,8 +436,7 @@ impl<'a> Tile<'a> {
         best.1
     }
 
-    #[allow(clippy::too_many_arguments)]
-    fn intra_tx(&mut self, plane: usize, x: usize, y: usize, mode: u8, tx_type: u8, have_left: bool, have_above: bool) {
+    fn intra_tx(&mut self, plane: usize, x: usize, y: usize, mode: u8, tx_type: u8, edges: IntraEdges) {
         let ss = (plane > 0) as usize;
         let max_x = (self.f.mi_cols * 8) >> ss;
         let max_y = (self.f.mi_rows * 8) >> ss;
@@ -424,7 +448,7 @@ impl<'a> Tile<'a> {
             return;
         }
         let p = &self.planes[plane];
-        let pred = predict_intra(p, x, y, 2, mode, have_left, have_above);
+        let pred = predict_intra(p, x, y, 2, mode, edges);
         let mut res = [0i32; 16];
         for i in 0..4 {
             for j in 0..4 {
@@ -592,12 +616,18 @@ impl<'a> Tile<'a> {
         let (x16, y16) = (((c * 8) << 4) as i32 + 2 * mv.col, ((r * 8) << 4) as i32 + 2 * mv.row);
         let mut s = 0u32;
         if let Some((pl, o, st)) = self.f.phases.as_ref().and_then(|ph| ph.block(x16, y16, n)) {
-            for i in 0..n {
-                let a = &p.src[(r * 8 + i) * p.w + c * 8..][..n];
-                let b = &pl[o + i * st..o + i * st + n];
-                s += a.iter().zip(b).map(|(a, b)| (*a as i32 - *b as i32).unsigned_abs()).sum::<u32>();
-            }
-            return s;
+            let a = &p.src[(r * 8) * p.w + c * 8..];
+            let b = &pl[o..];
+            return match n {
+                8 => sad_n::<8>(a, p.w, b, st),
+                16 => sad_n::<16>(a, p.w, b, st),
+                _ => {
+                    for i in 0..n {
+                        s += a[i * p.w..][..n].iter().zip(&b[i * st..][..n]).map(|(a, b)| a.abs_diff(*b) as u32).sum::<u32>();
+                    }
+                    s
+                }
+            };
         }
         // Inter search only runs on frames with a reference.
         let Some(refs) = self.f.refs.as_ref() else { return u32::MAX / 4 };
@@ -621,7 +651,7 @@ impl<'a> Tile<'a> {
         let d = &probs_defaults().0;
         let mb: [u32; 4] = std::array::from_fn(|m| tree_cost(&INTER_MODE_TREE, &d[probs::INTER_MODE + mctx * 3..], m as u8));
         let mode_bits = |m: u8| mb[(m - NEARESTMV) as usize];
-        let cost = |mv: Mv| -> f64 {
+        let cost_raw = |mv: Mv| -> f64 {
             let bits = if mv == nearest {
                 mode_bits(NEARESTMV)
             } else if mv == Mv::ZERO {
@@ -633,6 +663,21 @@ impl<'a> Tile<'a> {
             };
             self.sad(r, c, n, mv) as f64 + lambda * bits as f64
         };
+        // The cost is a pure function of the vector: points the search revisits (the centre it
+        // came from, candidates on the diamond) are looked up instead of predicted again.
+        let mut seen = [(Mv::ZERO, 0.0f64); 64];
+        let mut nseen = 0usize;
+        let mut cost = |mv: Mv| -> f64 {
+            if let Some(&(_, j)) = seen[..nseen].iter().find(|e| e.0 == mv) {
+                return j;
+            }
+            let j = cost_raw(mv);
+            if nseen < seen.len() {
+                seen[nseen] = (mv, j);
+                nseen += 1;
+            }
+            j
+        };
         let mut best = (Mv::ZERO, cost(Mv::ZERO));
         let prev = self.f.prev_mvs.map(|p| p[r * self.f.mi_cols + c]);
         for cand in [Some(nearest), Some(near), prev].into_iter().flatten() {
diff --git a/crates/vp9enc/src/transform.rs b/crates/vp9enc/src/transform.rs
index e6a685d5a..20996d60b 100644
--- a/crates/vp9enc/src/transform.rs
+++ b/crates/vp9enc/src/transform.rs
@@ -144,6 +144,16 @@ pub fn forward_matrices() -> &'static [[[f64; 16]; 16]; 4] {
     })
 }
 
+/// [`forward_matrices`] transposed: `[type][q][k]`.
+fn forward_matrices_t() -> &'static [[[f64; 16]; 16]; 4] {
+    use std::sync::OnceLock;
+    static M: OnceLock<[[[f64; 16]; 16]; 4]> = OnceLock::new();
+    M.get_or_init(|| {
+        let f = forward_matrices();
+        std::array::from_fn(|t| std::array::from_fn(|q| std::array::from_fn(|k| f[t][k][q])))
+    })
+}
+
 fn invert16(m: [[f64; 16]; 16]) -> [[f64; 16]; 16] {
     let mut a = m;
     let mut inv = [[0.0; 16]; 16];
@@ -191,12 +201,23 @@ impl Quant {
         if self.lossless {
             return forward_wht(res);
         }
-        let f = &forward_matrices()[tx_type as usize];
+        let ft = &forward_matrices_t()[tx_type as usize];
+        // Every output accumulates its 16 products in the same order (q ascending) as a
+        // per-output sum, but the 16 outputs advance together: 16 independent chains that
+        // vectorize instead of one serial chain per output.
+        let mut acc = [-0.0f64; 16];
+        for (q, col) in ft.iter().enumerate() {
+            let r = res[q] as f64;
+            for k in 0..16 {
+                acc[k] += col[k] * r;
+            }
+        }
         let mut lv = [0i32; 16];
         for k in 0..16 {
-            let coef: f64 = (0..16).map(|q| f[k][q] * res[q] as f64).sum();
+            let coef = acc[k];
             let (qs, rnd) = if k == 0 { (self.dcq, self.round_dc) } else { (self.acq, self.round_ac) };
-            let l = (coef.abs() / qs as f64 + rnd).floor() as i32;
+            // Non-negative: truncation is floor.
+            let l = (coef.abs() / qs as f64 + rnd) as i32;
             lv[k] = if coef < 0.0 { -l } else { l };
         }
         lv
diff --git a/docs/adr/0001-external-effect-helpers.md b/docs/adr/0001-external-effect-helpers.md
new file mode 100644
index 000000000..732fae877
--- /dev/null
+++ b/docs/adr/0001-external-effect-helpers.md
@@ -0,0 +1,73 @@
+# ADR 0001: External effect helpers
+
+- Status: proposed
+- Date: 2026-10-11
+- Context: review of storytold/effectcraft#508 (an in-process OpenFX host)
+
+## Context
+
+People want to use effects that already exist as native plug-ins: OpenFX suites (Sapphire,
+ReelSmart Motion Blur, Twixtor, ...) and, later, other native formats. storytold/effectcraft#508
+hosted OpenFX in-process. That needs `unsafe` to call a C ABI and runs closed-source native
+code in EffectCraft's own process, which conflicts with two non-negotiables:
+
+- **Never crash** (AGENTS.md): one null dereference in a third-party plug-in takes the whole
+  app, and the user's unsaved work, down with it. `catch_unwind` can't catch a segfault, and a
+  blocklist only helps after the first crash.
+- **No `unsafe`** in the workspace (`unsafe_code = "forbid"`).
+
+## Decision
+
+EffectCraft never loads native plug-in code into its own process. Native effects are served by
+**external effect helpers**: separate programs that EffectCraft starts as child processes and
+talks to over a small, versioned protocol. The core gains one generic, safe-Rust crate,
+`effectcraft-helper-host` (L3); format-specific hosts (OpenFX, ...) live in helper programs
+that are built, released and installed separately.
+
+- **Crash containment.** The process boundary contains everything a helper does. A helper
+  that exits, hangs past a timeout or breaks the protocol is stopped. The render that hit it
+  fails with a message shown on the effect, the frame stays as it was, and the helper starts
+  again for the next render. An effect that takes its helper down three times is turned off and
+  remembered in `helper_blocklist.txt` until the user retries.
+- **Same effects surface.** Each remote effect is registered through the existing plug-in API 2
+  (`EffectPlugin`), so the UI, the property tree, keyframes, expressions, scripting, the CLI, the
+  control channel and MCP need nothing new.
+- **Protocol** (`docs/external-helpers.md`): JSON lines over the helper's stdin / stdout
+  (`hello` → `describe` → `render` with callbacks → `done`, plus `padding`, `load`, `destroy`,
+  `ping`, `shutdown`). Pixels go through a **frame exchange file** (in `/dev/shm` on Linux, the
+  temp folder elsewhere) addressed by offsets, never through the pipe. Callbacks (`input_at`,
+  `layer_input`, `params_at`) let temporal effects (motion blur, retiming) read other frames
+  while rendering; nested renders through the same helper are supported.
+- **Discovery.** EffectCraft looks in `helpers/` next to the executable (and
+  `Contents/Helpers` in a macOS bundle), `helpers/` in the settings folder, and
+  `EFFECTCRAFT_HELPER_PATH`. Helper programs are named `effectcraft-helper-*`.
+- **Security.** Helpers are local programs the user installed, just like the plug-ins they host.
+  EffectCraft runs only programs from those locations, passes them nothing beyond the protocol
+  (no network, no project files), and runs no helper on the web build.
+
+## Alternatives considered
+
+- **In-process host behind a feature flag** (#508). Rejected: a crash is still a crash, and it
+  needs `unsafe` in the workspace.
+- **`ipc-channel` for transport.** Its wire format and shared-memory handles are Rust-specific
+  (and differ per OS), so a helper written in C++ against the OpenFX reference host couldn't
+  speak it. The chosen transport, JSON lines plus a plain file, works from any language without
+  a library.
+- **Memory-mapped shared memory on the EffectCraft side.** Mapping needs `unsafe` (or a crate
+  whose safe API is unsound if the other process truncates the mapping). Positional reads and
+  writes on a file in the page cache cost one copy per frame each way and stay safe. A helper is
+  free to map the file.
+- **WebAssembly-compiled plug-ins.** Not available for closed-source native plug-ins.
+
+## Consequences
+
+- Native effects cost one copy of the frame each way plus process round trips. That's fine for
+  CPU plug-ins working on whole frames.
+- Renders through one helper are serialized (one process, one conversation at a time). A pool
+  of helper processes is a possible later improvement.
+- Out of scope for the core: any OpenFX (or other native-format) code. The OpenFX helper is a
+  separate program in its own repository (an example: [ec-extension-ofx](https://github.com/glumbis/ec-extension-ofx), unofficial) that reuses the
+  existing Rust OpenFX host behind `serve()`. A C++ helper built on the OpenFX HostSupport
+  library is an equally valid way to implement the same protocol.
+- Later: the ArtCraft launcher can install helpers into `helpers/` the same way it installs
+  apps.
diff --git a/docs/adr/0002-sam2-roto-tracker.md b/docs/adr/0002-sam2-roto-tracker.md
new file mode 100644
index 000000000..3807d84a2
--- /dev/null
+++ b/docs/adr/0002-sam2-roto-tracker.md
@@ -0,0 +1,19 @@
+# ADR 0002: SAM 2 video tracker for the Roto Brush
+
+Status: accepted (maintainer answers, 2026-10-15). Plan: `plan/roto-sam2.md` (maintainer-local).
+
+## Context
+The Roto Brush's classical engine loses an object that is occluded or leaves and re-enters the frame
+(`effectcraft-cli bench --roto`: IoU 0.49 on the occlusion clip, 0.62 on re-entry, 0 after the object returns).
+Meta's SAM 2.1 (Apache-2.0 code and checkpoints) has streaming memory built for this.
+
+## Decisions
+- **D1** A native-only `candle` dependency may enter the workspace, in its own crate (`effectcraft-sam2`), excluded from wasm32.
+- **D2** `effectcraft-sam2` is licensed Apache-2.0 only (it derives from Apache-2.0 Hugging Face `transformers` code); `effectcraft-segment` stays MIT OR Apache-2.0.
+- **D3** Shared candle helpers are vendored with a NOTICE for now; a shared crate with LightCraft can follow.
+- **D4** Weights are never hosted or bundled by us: direct from Hugging Face, a mirror, or a user folder, with the SHA-256 pinned in the registry.
+- **D5** SAM 2 is opt-in at first; it becomes the default for tracking only after the benchmark shows it should.
+- **D6** Hand-written kernels (the MobileSAM way) remain the Phase 6 route for AMD GPUs if candle cannot get there.
+
+## Consequences
+Without the model installed nothing changes. Every ported file carries Apache-2.0 §4(b) modified-work headers.
diff --git a/docs/aep-export.md b/docs/aep-export.md
new file mode 100644
index 000000000..e8b89b424
--- /dev/null
+++ b/docs/aep-export.md
@@ -0,0 +1,313 @@
+# After Effects project export
+
+> **Last reviewed:** 2026-10-19 · **Last updated:** 2026-11-05 · **Change:** a 3D layer's changed Material Options are reported, shape and text animator colours outside 0 to 1 are clamped and reported, and a popup expression is no longer reported where the option order is the same (2026-11-05); before that: composition settings the base writes at their defaults (Preserve Frame Rate / Resolution, motion blur samples, adaptive sample limit) and render queue items are reported, and a sequence's folder time is read only when its file passes the document-path policy (2026-11-04); before that: every chunk is built in code, no template is read (2026-10-29); before that: Curves and Mesh Warp are written (R53); before that: a switched-off shape item or layer style is written switched off (R52, 986-988); before that: a reversed layer (negative stretch) is written as After Effects stores it (R36, 981-983); before that: an explicit None (`NO_LAYER`) on Compound Blur, Displacement Map or Set Matte is written as None, and Layer Control on a named layer no longer reports a source choice; before that: layer styles are written (R51, 950-980; read back in After Effects: `export-tests\styles`); before that: an image sequence's folder modification time is written when the caller knows it (`sspc@118`, R50: without it After Effects rescans the folder on open and warns about every gap of a sparse sequence in a modal dialog); before that: an output space equal to the working space is not reported (After Effects renders in the working space, 902; the importer sets it so for Rec.709 Gamma 2.4); before that: one effect table for both directions again: the 27 effects of the importer round 3 and the Layer Control are written too (prototypes from 903 and 076, layer parameters by layer id; not read back in After Effects yet); before that: the importer round 3 is merged: Offset Paths' Copy Offset is written as EffectCraft's value + 1 (826-828, the importer's inverse); before that: sparse sequences checked (860, written as After Effects stores them); before that: the Rec.709 Gamma 2.4 working space is written with a profile authored here (R49, g5); before that: text animators with range selectors are written (R48, t8); before that: a footage layer running past its source is ended there on import, as After Effects does, and less than a frame past is not a loss (LayerTiming); before that: Anchor Point and mask path ease are written (R47); before that: shape operators (polystar, gradients, trim paths, round corners, merge / offset paths, repeater) and keys and expressions on shape properties are written (R46, o2); before that: every effect of the importer's table is written, through one shared table and records built per parameter type (R45, e2); before that: time remapping is written (319, 354, r1, R44); before that: the character and paragraph settings are read back in After Effects (t6) and right-to-left justification is written relative to the direction (t7, R43); before that: the character and paragraph settings the importer decodes are written (scales, baseline shift, kerning, ligatures, tsume, fill / stroke switches and width, justified variants, indents, spacing, composer, direction); before that: track mattes, markers, cameras, lights and shape layers (R39-R42), keys on stretched layers, conformed clips, tga / psd / ai / eps, project settings (620-634, R37), superscript / subscript (526-528); before: precomposition layers (124, 257, 258, 600-602), the effects Tint, Gradient Ramp and Exposure (356-397, 610), footage (351, 353, 603-607, 611-613), text layers (110, 245, t1-t4), the 3D switch (015) and time stretch (018, 316, 317) are exported · **Target:** Adobe After Effects 2026
+
+File ▸ Export ▸ After Effects Project… (`file.exportAep`) writes the open project as an `.aep` that
+After Effects 2026 opens. It is deliberately narrow: what it writes is exact, tested and checked
+against After Effects itself; everything else is **reported** and never dropped silently. The
+importer ([aep-import.md](aep-import.md)) is the mirror image; both rest on the clean-room format
+notes in [aep-format.md](aep-format.md).
+
+## Design: every chunk is built in code
+
+The exporter reads no file After Effects wrote. Every chunk comes from code, in the layout of the
+chunks After Effects writes for the same content ([aep-format.md](aep-format.md) section 3):
+
+- the project skeleton (`export/base.rs`): the top-level headers and settings, the render queue,
+  the composition shell with its eleven view layers (empty property trees), the `Solids` folder,
+  solid and null items;
+- the layer blocks (`export/skeleton.rs`, `export/tree_defs.rs`): AV, null, text, camera, light and
+  shape layers as tables of their property groups and records, with only the groups the exporter
+  writes into (After Effects adds the others);
+- the property records (`export/synth.rs`): the `tdb4` header from its decoded fields, the value or
+  key list; effects from the effect table (`export/fx_defs.rs`, `export/fxsynth.rs`), layer styles
+  from theirs (`export/style_defs.rs`), masks, markers and text animators from their layouts;
+- footage items per kind (`export/footage.rs`), naming our own colour profiles (`export/icc.rs`);
+- the text document (`export/textproto.rs`): the smallest dictionary After Effects reads back
+  unchanged.
+
+Some bytes After Effects needs have no decoded meaning. For those, the exporter writes the value
+the byte has in every After Effects file generated for the test cases, as a named constant in the
+code. Every other byte that is not decoded is zero. Each such choice was made by
+After Effects reading variants back (a field zeroed or a chunk left out, compared by After Effects'
+own project export and by renders), and the whole export was checked against the earlier
+template-based export case by case: no difference. The file ends with a neutral XMP packet written
+by the crate (After Effects accepts a file without one too).
+
+```text
+EffectCraft Project --plan--> ProjectPlan (file units, losses reported)
+                    --emit--> chunk tree built in code --effectcraft_aep::write--> bytes
+```
+
+Where it lives: the `export` module of `crates/aep` (`effectcraft_aep::export`, **L3**, next to the importer; no file
+access of its own, builds for wasm32). The command wrapper is in `crates/engine/src/cmd/aep.rs`.
+API: `export(&Project, &ExportOptions) -> Result<ExportResult { bytes, report }, AepExportError>` and
+the dry run `analyze(&Project) -> ExportReport`. A refused or failed export writes nothing.
+
+## The command
+
+`file.exportAep {path, allowLosses?, dryRun?}`
+
+- Without `allowLosses` an export that would lose anything is **refused** (nothing is written) and
+  the error names the categories, e.g. `exporting would lose effects: 3, text layers: 1; allow
+  losses to export anyway`. With `allowLosses: true` it writes the file and returns the same report.
+- `dryRun: true` returns only the report. The result is `{path, bytes, report}`. The path is
+  confined like every other file-writing command (`crates/automation/src/confine.rs`). From the
+  shell: `effectcraft-cli exec file.exportAep '{"path":"out.aep","allowLosses":true}' in.ecproj --json`.
+
+## What is exported
+
+| Area | Exported |
+|---|---|
+| Project settings | colour depth (8 / 16 / 32 bpc), working space None, sRGB or Rec.709 Gamma 2.4 (R49), working gamma 2.2 / 2.4, Linearize Working Space, Blend Colors Using 1.0 Gamma, time display (timecode, frames, feet + frames 35 / 16 mm), frame count start 0 / 1 (R37) |
+| Project tree | Folders (nesting; empty ones too), compositions, solids (colour, size), footage items, item labels and names. Siblings are written in the order After Effects stores them (natural, case-insensitive name order) |
+| Composition | size, exact frame rate (the time base After Effects picks for the rate), duration (whole frames), work area (whole frames), background (8 bit), pixel aspect (exact fraction), shutter angle and phase, display start, composition motion blur switch |
+| Layers | solid, adjustment, null, precomposition, footage and text layers: name, in/out/start (exact units of the composition's time base), time stretch, enabled/audio/solo/shy/locked/effects/motion blur/collapse/guide/3D switches, draft quality, label, blend mode (Normal, Add, Multiply, Screen, Overlay, Difference and the 24 codes of 906 / 907, see `blend_modes` below), parent |
+| Transform | Anchor Point, Position, Scale, Rotation, Opacity: the value when it differs from the default; keyframes with time, linear/bezier/hold on each side, temporal ease (speed and influence, per dimension for Scale; an Anchor Point's speed in pixels per second over the source height, R47), spatial tangents of Position and Anchor Point (automatic ones are written as After Effects computes them), roving and key labels |
+| Expressions | on those five properties: source text and enable switch |
+| Masks | on solid, adjustment and null layers, in stack order: name, mode (all seven), inverted, path (vertices and tangents in layer pixels, open or closed), feather, opacity, expansion (each only when not at the default), path keys (time, linear, bezier or hold sides with their ease, label) with one shape per key, Mask Feather keys (time, interpolation, value, ease per dimension, label) |
+| Precompositions | a composition shown as a layer of another: the layer's source is the composition item, the using composition lists each composition it shows once (`idpi`); the anchor is a fraction of the composition's size; precompositions nest to any depth, a loop is reported |
+| Text | point and box text: the text (paragraphs, CR / LF / CRLF as After Effects' CR), per paragraph the justification (left, right, centre and the four justified variants, codes 3-6), first-line / start / end indent, space before / after, hanging punctuation, composer and direction (paragraph slots `/1`-`/5`, `/21`, `/29`, `/33`), per style run the font (PostScript name), size, fill and stroke colour, tracking, automatic or explicit leading, faux bold and italic, all caps and small caps, horizontal / vertical scale, baseline shift, automatic kerning (metrics, optical, none), ligatures, tsume, whether fill and stroke are drawn, stroke width and stroke over fill (style slots `/6`, `/7`, `/9`, `/11`, `/18`, `/36`, `/56`-`/58`, `/63`, as the importer decodes them, 538-569; written only where they differ from the prototype; read back in After Effects, R43), the justification of a right-to-left paragraph relative to its direction (R43), superscript and subscript (style slot `/13`: normal text is written 0, 527; the prototypes and After Effects' scripted default hold 1 = superscript, drawn at 58.3 % size, 526); the box; the anchor in pixels; the name only when it is not the text's first line; text animators: Anchor Point, Position, Scale, Skew, Skew Axis, Rotation, Opacity, Fill / Stroke Color, Stroke Width, Tracking, Line Spacing, Blur, Character Offset with keys and expressions, range selectors (Start / End / Offset in percent or index units, Units, Based On, Mode, Amount, Shape, Smoothness, Ease High / Low, Randomize Order, Random Seed; R48) |
+| Footage | png, jpeg, OpenEXR, TIFF, Targa, (flat) Photoshop, Illustrator and EPS stills, png, OpenEXR and jpeg sequences, mp4 and mov clips (also conformed to another rate, R38), WAV audio: the path (a sequence's folder and numbering), size, duration, native frame rate, the name (none stored when it is the file's, as After Effects does); After Effects re-reads everything else from the file when it opens the project |
+| Effects | every effect of the table the importer reads (`effectcraft_aep::effect_map`, one table for both directions): Tint, Gradient Ramp, Exposure, Invert, Fast Box Blur, Gaussian Blur, Drop Shadow, Timewarp, Glow, Fill, Hue/Saturation (master and colorize), Levels (RGB), Directional Blur, Radial Blur, CC Radial Blur, Venetian Blinds, Channel Blur, Black & White, Tritone, Luma Key, Simple Choker, Matte Choker, Transform, Brightness & Contrast, Turbulent Displace, Fractal Noise, Beam, CC Radial Fast Blur, Noise, Levels (Individual Controls), Corner Pin, Grid, Sharpen, Linear Color Key, Radial Wipe, Remove Color Matting, CC Bend It, CC Power Pin, 4-Color Gradient, Change Color, Extract, Noise HLS, Scatter, CC Light Sweep, Compound Blur, Displacement Map, Set Matte, Gaussian Blur (Legacy), Pixel Motion Blur and the Slider, Angle, Checkbox, Color, Point and Layer expression controls: the instance name, every parameter that differs from its default (colours, points, fixed, integer and float sliders, angles, popups by item name, checkboxes, layer parameters: the `tdpi` of their always-present record holds the owning layer's id by default, 0 for None (EffectCraft's unset Layer Control, or the explicit `NO_LAYER` of the other effects), or the named layer's id, 320 / 321 / 904; Layer Control's companion source choice is not reported (After Effects has none for it); the 27 effects of batch 6 (903-905) and the Layer Control are written from prototypes but not yet read back in After Effects), expressions on parameters, Hue/Saturation's master values and Levels' RGB values (arbitrary data), keys on colours, points and fixed / float sliders (time, linear / bezier / hold, the ease of sliders and points, labels), in stack order, several instances of a type per layer and per project (R24-R27, R45) |
+| Layer styles | the nine styles and Blending Options (Fill Opacity, channel switches, Blend Interior, Blend Ranges; the composition's Global Light on every styled layer) on solid, footage, precomposition, text and shape layers: a record for every parameter that differs from After Effects' default, keys on scalars, expressions (R51) |
+| Track mattes | alpha, alpha inverted, luma, luma inverted, with any exported layer of the composition as the matte (R39) |
+| Markers | composition and layer markers: time, duration, comment, chapter, URL, frame target, cue point (event or navigation, name, parameters), label (R40) |
+| Cameras | one- and two-node cameras: point of interest, position, zoom, depth of field, focus distance, aperture, blur level (R41) |
+| Lights | spot and point lights: point of interest (spot), position, intensity, colour, cone angle and feather (R41) |
+| Shape layers | groups (nested), rectangle (size, position, roundness), ellipse (size, position), polystar (type, points, position, rotation, radii, roundness) and freeform paths, fill (rule, colour, opacity), stroke (colour, opacity, width, line cap and join, miter limit), gradient fill and stroke (type, start, end, highlight; the default colour stops), trim paths (start, end, offset, mode), round corners, merge paths (mode), offset paths (amount, join, miter limit, copies, copy offset: After Effects' Copy Offset is EffectCraft's + 1, 826-828), repeater (copies, offset, composite, its transform), the group transform (anchor, position, scale, skew, skew axis, rotation, opacity), keys and expressions on all of them but popups (R46), item names (R42) |
+| Time remapping | an enabled Time Remap on a precomposition or footage layer: keys (time in layer time, value in source seconds, linear / bezier / hold, ease, labels), the expression; a remap without keys as one key holding its value; such a layer may run past its source's end (R44) |
+| Null layers | a null layer gets the hidden 100 x 100 white solid every null object has (`Null <id>` in the `Solids` folder) |
+
+Units are the importer's inverse: Anchor Point is stored as a fraction of the source size, Scale and
+Opacity as fractions (ease speeds are scaled the same way), a property at its default has no record
+at all.
+
+## What is reported
+
+`ExportReport` (`serde`, JSON) has `exported` (counts), `losses` (per category: exact `count`, up to
+20 `details`) and `limitations` (what the exporter cannot write at all, listed in every report).
+
+| Category | Counted |
+|---|---|
+| `effects` | an effect outside the table (each instance), a parameter without an After Effects counterpart that carries keys or an expression or a value other than a new instance's (a default that depends on the layer size is not compared), the effect's label colour, a colour parameter's opacity (After Effects' have none; Drop Shadow uses it), a fraction on an integer parameter (written whole), Curves points outside 0..1 (written at the limit), keys on a popup, checkbox, angle or integer slider (the first key's value is written), keys or expressions on Hue/Saturation's or Levels' data values, a fractional Hue/Saturation master value (written whole), a popup item After Effects does not have, keys or an expression on a layer parameter (its value is written), a layer parameter naming a layer that is not exported (the owning layer is written) or whose layer is taken with its masks and effects (After Effects takes the source) |
+| `markers` | a protected marker region (the switch is not decoded; the marker is written), a marker time out of range, markers on a footage item (not written) |
+| `masks` | masks on a text or shape layer (the path unit there is not verified; not written), a disabled mask or one without a usable path (not written), and per written mask: keys on Mask Opacity or Expansion (no keyed prototype; the static value is written), expressions on mask properties, the lock, mask motion blur other than Same As Layer, Linear feather falloff, RotoBezier, variable-width feather points |
+| `text_layers` | per text layer what its document cannot hold: wiggly and expression selectors, animator properties outside the list above (3D rotations, hue / saturation, Character Value, ...), a Tracking Type or Character Range / Alignment other than the default, Path and More Options other than the defaults, Source Text keys (the first key's text is written) and expressions, a manual kerning amount, OpenType features, variable font axes, a font style other than Regular, vertical text, a switched-off range selector (written on), a run without a font name (written in Times New Roman), a fill or stroke opacity (text colours have none), and a value beyond what the document holds (written at the limit): colour channels outside 0..1, font size, tracking, leading, scale, baseline shift, tsume, stroke width, paragraph indents and spacing, box position and size |
+| `shape_layers` | shape items outside the list above (wiggle, zig zag, pucker, twist, ...; not written), dashes / taper / wave, blend mode and composite order, the path direction, per-corner roundness of a rectangle (the uniform Roundness is written), gradient colour stops other than the default, keys on popups (the first key's value is written), keys and expressions on a path |
+| `cameras`, `lights` | keys or expressions on camera / light options (static value written), iris and highlight settings; parallel and ambient lights (not written), light falloff, radius, shadows; a camera's Auto-Orient Along Path or Towards Camera (written one-node), a spot light not oriented towards its point of interest (written oriented), a light colour channel outside 0..1 |
+| `model_layers` | each 3D model layer (skipped) |
+| `footage_items` | a footage item of a type without a prototype (`.avi`, `.mp3`, `.pdf`, ...), one layer of a layered file, a sequence with gaps, mixed names or no frame number, a sequence or clip at a fractional frame rate, an item without a path, a size larger than 30 000 pixels (written smaller), items in a folder loop or deeper than 64 levels, an item's proxy (not written), a solid's pixel aspect other than 1 (written as 1) |
+| `layer_timing` | an in or out point beyond the 32-bit range in a stretched layer's source time (written at the limit), a layer of a clip, sequence or sound that runs a composition frame or more past its source's end without a time remap (After Effects ends it there; the importer ends such layers at their source as After Effects does, so imported projects no longer have them) |
+| `unsupported_layers` | a layer of footage that is not written, a precomposition layer whose composition is not exported or that closes a loop, a solid layer whose solid is not exported |
+| `blend_modes` | a mode without a known code (Dissolve, Dancing Dissolve, Subtract, Divide, Lighter / Darker Color, Alpha Add, Luminescent Premul): the layer is written as Normal. The other 30 modes are written with the codes After Effects saves (906, 907; not read back in After Effects yet) |
+| `track_mattes` | a matte whose layer is not exported (written without matte) |
+| `time_stretch` | a stretch that is not an exact ratio with a denominator up to 1000 (written unstretched); bezier ease on a stretched layer is written and reported as `approximated_keyframes` (its speed unit there is not sampled) |
+| `three_d` | per-character 3D of a text layer, and a 3D layer's Material Options other than a new layer's (a changed value, a key or an expression; they are not written) (the layer's 3D switch is written) |
+| `transform_properties` | an X/Y rotation or orientation that is not at its default |
+| `approximated_keyframes` | a mask path key ease speed other than 0 (written as stored, its unit is not sampled), a bezier side of a colour key (written linear: only speed 0 / influence 0 is sampled, which After Effects interpolates linearly, 598), a roving mask or effect key, keys merged at the same time, a muted key (written as an active key), an auto-Bezier key (written with its stored ease, not the slope EffectCraft computes) |
+| `invalid_values` | NaN, infinity or a number beyond 1e9 (the default is written), a key speed or spatial tangent beyond 1e9 (written as 0), a time beyond the 32-bit range, a solid or effect colour channel outside 0..1 (written at the limit) |
+| `composition_settings` | a size outside 1 to 30 000, a duration outside 1 frame to 3 hours or that does not fit the time base, a frame rate that has no time base, a pixel aspect that is not an exact fraction, a background channel outside 0..1, a fractional shutter angle or phase (written whole), a start timecode that is negative or not a whole unit |
+| `composition_options` | guides, Essential Graphics, the Advanced 3D renderer (written as Classic 3D), and settings that change rendered frames but are written at After Effects' defaults: Preserve Frame Rate or Preserve Resolution switched on, motion blur samples per frame other than 16, an adaptive sample limit other than 128 (Draft 3D, Hide Shy, the viewer resolution, the poster time and the composition's frame blending switch are a listed limitation) |
+| `parent_links` | a parent that was not exported or that closes a loop |
+| `rounded_times` | a key, work area, layer start, in or out point time that is not a whole unit / frame of the time base, a duration that is not a whole number of frames, an in or out point that falls between two units in a stretched layer's source time |
+| `names` | a name longer than 255 bytes (cut), an item comment (not written) |
+| `project_settings` | a working space other than None, sRGB and Rec.709 Gamma 2.4 (written as sRGB: After Effects needs the profile data, `export-tests\settings\g4`, and the exporter has its own profiles for sRGB and Rec.709 Gamma 2.4 only, R49), the OCIO colour engine, HDR handling, an output space other than the working space (an equal one is After Effects' normal case: it renders in the working space, 902), a frame count start other than 0 / 1 |
+| `time_remapping` | a Time Remap on a layer After Effects cannot remap (solid, text, shape, null, camera, light: 319): not written |
+| `layer_styles` | the whole Layer Styles group switched off, an edited gradient, keys on a colour, point, popup or checkbox (the value is written), Knockout, styles on a layer that takes none |
+| `layer_switches` | per layer: Wireframe quality (written as Best), Bicubic sampling, frame blending, Preserve Transparency, Auto-Orient on a layer other than a camera or light, the environment layer setting, Lock Markers |
+| `render_queue` | each render queue item (the render queue is written empty) |
+
+## Rules discovered (what After Effects needs for the file to open and read back right)
+
+Evidence is the file name in the contributor's local `export-tests\` folder (not in this repository; generated by the contributor's local lab tools,
+opened in After Effects 2026 and read back through its scripting interface) or the reference
+projects made with After Effects (`ref1`, `ref-fps`, `ref-folders`, `ref-longname`). **AE re-save**
+means: the exported file was opened, saved again by After Effects and compared chunk by chunk with
+`tools/aep_diff.py`; only the noise listed under "not rules" differed, so every byte the exporter
+wrote was accepted as it is.
+
+| # | Rule | Evidence |
+|---|---|---|
+| R1 | The XMP packet after the container is optional; a short neutral one is accepted. | `e0-noxmp`, `x1` |
+| R2 | Composition and layer names can be set freely (a renamed composition and layer open and read back; checked when the exporter still edited a saved project, and kept by the code-built skeleton). | `e0-rename` |
+| R3 | **Time base.** NTSC: time scale 23 976, frame duration 1000 / 800 / 400 / 200 for 23.976 / 29.97 / 59.94 / 119.88 fps. Every other rate: the frame duration is the smallest power of two for which `rate x frame duration >= 24 576` (25 fps: 1024 / 25 600; 12 fps: 2048 / 24 576; 12.5 fps: 2048 / 25 600; 1 fps: 32 768 / 32 768; 240 fps: 128 / 30 720). The 16.16 rate at `cdta@156` is the float32 of the typed rate. | `ref-fps` (13 compositions made by After Effects), `z1` (6 rates written by the exporter, read back) |
+| R4 | Composition duration is a whole number of frames (`frames x frame duration`); a 2 s composition at 29.97 fps lasts 2.002 s. | `x3`, `z1` |
+| R5 | `cdta` of a new composition: bytes 16, 24, 32 and 40 are 600, byte 48 is the time scale. **The work area is two fractions**: start `@28 / @32`, end `@36 / @40` (absolute end, not duration); once a work area is set the denominators are the time scale, while the whole composition is `0 / 600` and `0xffffffff / 600`. With 600 written as the denominator of a set work area After Effects read the start as 51.2 s. | `y1` (wrong), `y1b` (right), fixture `035` |
+| R6 | A composition item uses its own id plus the 11 ids after it for the built-in view layers (`DLay`, 6 x `SLay`, 3 x `CLay`, `SecL`, `ldta@0`); layer ids, item ids and the hidden null solids come from one counter; `head@12` is the next free id. | `x1`-`z1` |
+| R7 | **Every property's `tdb4@12` follows the composition's time scale, including those of the view layers.** | `y1`, `z1` (AE re-save identical) |
+| R8 | Items are stored in the order the project panel sorts them (natural order of the name, digit runs as numbers, case-insensitive). A composition item is followed by `FEE ` and the 7 f-records, a footage item by the 7 f-records, a folder by nothing. | `ref-folders`; AE accepted the same order in `x3`, `z1` |
+| R9 | The `Solids` folder (id 0x19, named by `sfnm/sfid`) holds root-level solids and the hidden solids of nulls; solids with a folder keep it. A root folder named `Solids` in the project **is** that folder (one folder, not two). It is written even when empty (an empty project opens). | `ref1`, `x0`, `x3`, `x7`, `z1` |
+| R10 | A **null layer** is an ordinary layer with `ldta@38` bit `0x80` whose source is a hidden 100 x 100 white solid; its Transform defaults are those of a 100 x 100 source. | `ref1`, `x3`, `z1` |
+| R11 | Transform properties exist in the file only at a non-default value; they sit in the order Anchor Point, Position, X/Y Position, Scale, Orientation, X/Y/Z Rotation, Opacity, Environment (the exporter inserts into that order). | `x4`, `x5` |
+| R12 | A keyed property is the keyed prototype with `lhd3` words 2, 3, 4, 7 and `ldat` rewritten (3, 5 and 20 keys); records are 128 bytes (Position / Anchor Point spatial, Scale plain), 48 bytes (Rotation, Opacity). | `x5`, `y2`, `y3` |
+| R13 | **Scale ease is per dimension** (slot `i` of each block belongs to dimension `i`): three different eases read back as three different eases. Upgrades the E mark of aep-format.md 3.5. | `y2` |
+| R14 | Automatic spatial tangents are written as the values After Effects computes (EffectCraft's Catmull-Rom); the flag at `@8` is 1. Roving is written as the flag; After Effects moves the key in time itself (4.525 s for the key at 4.5 s with neighbours at 3 s and 6 s). | `y2`, `z1` |
+| R15 | An expression is a `Utf8` chunk before `tdum`; `tdb4` bytes 76, 77 and 120 are 1, byte 119 is 1 when it is disabled. A property with an expression but a default value gets a static record with the default. | `x6`, `y2` |
+| R16 | Names: a layer's name is the `Utf8` child (80 characters, Japanese and umlauts read back unchanged); `ldta@64` holds the first 31 bytes. A **solid's name is in `opti@26`, up to 255 bytes** (a 140 character name saved by After Effects fills the field as far as it goes). Item names are the `Utf8` child. | `y1`, `z1`, `ref-longname` |
+| R17 | `pgui` (16 bytes in a footage item) is a GUID; the exporter writes distinct deterministic ones. | `z1` |
+| R18 | Folders clone the `Solids` folder item (`sfdt` 1); `idta@20..23` of a folder is 0 on export and set to 1 by After Effects on save (a UI state, not needed). | `x3`, `z1` re-save |
+| R19 | **Masks** (from the fixtures, After Effects read-back pending: `export-tests\masks\`). `tdgp[ADBE Mask Parade]` sits between Time Remapping and the Transform group; per mask `tdmn ADBE Mask Atom`, `mkif`, the atom. `mkif`: inverted `u8 @0`, mode `u32 @4`, the layer's mask counter `u32 @8` (1..n, 328); bytes 12..47 copied from 091. Inside the atom the order is Shape, Feather, Opacity, Offset, each property only when not at its default (090, 091). Re-exporting the imported fixtures 090, 091 and 093 gives a mask parade byte-identical to the one After Effects saved; 208, 233 and 328 differ only in the session bytes of `mkif` (and 208 in Mask Shape `tdb4@24`, R21). | fixtures 090, 091, 093, 208, 233, 328 |
+| R20 | **Path points**: `shph` byte 3 bit `0x08` = open, the box (vertices and handles) as fractions of the layer source size, points `f32` normalised inside the box (a box without width or height stores 0); `lhd3` of the point list: word 2 the record count `3n`, words 3 and 7 the vertex count `n` and `4n`, word 4 = 8 (090: 4 / 16; 233: 3 / 12). | 090, 233 |
+| R21 | **Mask Shape `tdb4@24`** is written as the source width / height, like the Anchor Point's (090, 093, 232, 233, 306, 328, 329: 16 / 9 on 1920 x 1080; 309: 1 on 100 x 100). 208 stores 1.0 on a 1920 x 1080 layer, so this is **E** until the read-back. | listed |
+| R22 | **Path keys** are 64-byte records: time, interpolation, flags (`0x0001` plus label bits) as decoded; bytes 8..63 from two records built in code with 093's layout (the first key from the first, later keys from the second). Feather keys are the plain template with two components (88 bytes, 208, 306). | 093, 208, 306 |
+| R23 | **Precomposition layers** (After Effects read-back `export-tests\precomp\p1`: all values, 39 of 39 render points identical). The layer block is the solid layer's with `ldta@40` = the composition's item id: AE's own precomposition layer in 258 (`Small`, added through the API) differs from the solid layer `L` of the same file only in the id, the name, the label and the time remapping maximum, and re-exporting 258 gives a layer subtree identical to AE's apart from the ids. The using composition lists each composition it shows **once** (602: the same composition twice gives one entry) in a little-endian `idpi` right after `idpc`, and `idpc` starts with **their number** as a little-endian `u32` (124, 257, 258, 600: 1; 601: 2; the AE re-save of p1, written with `idpc` 1, rewrote C2's `idpc` to 2). **The order of the `idpi` carries no meaning:** After Effects reverses the list on every re-save (p1: `1c 28` -> `28 1c`; p1b, written `28 1c`: -> `1c 28`, same layers); the exporter writes ascending ids, the order After Effects created in 601. The inert `ADBE Time Remapping` record's `tduM` is the source's duration in seconds (600: 3 for a 3 s composition in a 5 s one, 601: 2; 124, 257, 258: 5; 1 for the 1 s WAV of 351, 0.1 for the 3-frame sequence of 353, 0 on solids). The anchor divides by the composition's size (3.4). After Effects stores a precomposition layer's out point in the **source's** time scale (600: 92 160 / 30 720 for 3 s at 30 fps) and the precompose operation the start denominator 1 (124, 257); the exporter writes the composition's time scale for all three, as a composition added as a layer at the same rate does (258), and After Effects reads them back unchanged (p1: out 3, 1, 2). | 124, 257, 258, 351, 353, 600-602, p1 |
+| R24 | **Effects** (After Effects read-back `export-tests\effects\e1`). An instance is the default instance of its case (356 Tint, 368 Gradient Ramp, 389 Exposure: `tdmn` + `sspc` with `fnam`, `parT`, the value group and `pgui`), inserted in the layer's `ADBE Effect Parade` right before the Transform group (after the masks: 357, 398). The input-layer record `-0000` holds the owning layer's id in `tdpi` (320). A parameter that differs from its default gets the value record After Effects wrote when that parameter was changed alone (Tint 357, 359, 362; Ramp 369, 371, 373, 375, 377, 378, 380; Exposure 390, 391, 393, 394, 395, 396), inserted in index order; Exposure's Red / Green / Blue sliders share the master's `pard` (389) and take the master's record (Red Exposure from 395) with their own `tdmn` and `tdsn` (**E**). Values: colour ARGB 0..255 with alpha 255, point fractions of the layer size with `tdb4@24` = width / height (369: 16 / 9, 383: 1), fixed sliders in their stored scale, float sliders as float32, popups 1-based (also written into `pard@56`, 377, 390), checkbox 1.0. Re-exporting every effect fixture gives the same value records as After Effects wrote (`tests/effects.rs`; the layer subtrees differ only in the ids, the stale `pard@7` UI flags and the arc length of keyed records). | 356-397, 320, 398, e1 |
+| R25 | **Keyed effect parameters**: the parameter's static record with `cdat` replaced by the key list of its kind's keyed record (fixed slider 363, colour 364, point 382, float slider 397: `lhd3` words 2, 3, 4, 7 rewritten as R12) and `tdb4` bytes 5 (static bit), 68 (has keys) and 79 taken from that keyed record: static and keyed records of the same parameter differ in exactly those bytes (362 / 363 and 391 / 397: 5 and 68; 359 / 364 and 369 / 382: 5, 68, 79). Records: sliders plain n = 1 (48 bytes), colours spatial n = 4 (152 bytes, flags `0x0001`), points spatial n = 2 (104 bytes, flags `0x0007`, `u32@8` the automatic tangent switch); the arc length / colour distance `f64@16` is written 0. | 359-397, e1 |
+| R26 | **Effect instance names**: `fnam` keeps the effect's own name; a name the user gave the instance is the `tdsn` of the instance's value group, which holds the placeholder `-_0_/-` otherwise (610 against 609). The exporter wrote the name into `fnam` first; After Effects showed the effect's name (e1) and its re-save reset `fnam`. | 609, 610, e1 |
+| R27 | **Effect definitions**: the project lists every effect type in `Pefl` (one `pjef` with the match name each, sorted by name: 365, 366 store Blur before Tint whatever the stack order) and keeps one `EfDf` copy per type in `LIST EfdG` right after `Pefl` (the `EfDC` count little-endian before them; in order of first use), the copy cloned from the default case. The first instance of a type in the file keeps the full `parT`; every later one has an empty `LIST parT` and borrows the copy's definitions (383); in e1 After Effects read all parameters of both Tints. After Effects fills the copies with one instance's value records on save (e1 re-save; the importer never reads values from them, 383). | 365, 366, 383, e1 |
+| R28 | **Footage items** (After Effects read-back `export-tests\footage\f1`: all eight items found their files, names, sizes, durations and rates as written). An item is the prototype of its kind (png 607, jpeg 605, OpenEXR 604, TIFF 613, mp4 606, QuickTime mov 612, WAV 351, png sequence 353, OpenEXR sequence 603, jpeg sequence 611) with: `iide` / `idta` id and label; the name in the item's `Utf8` only when it is not the file's (After Effects stores none then, 126, 603-607; the WAV keeps it, 351); `sspc` width @30, height @34, duration `num @38 / den @42` (stills 0 over png 1, jpeg and TIFF 600, OpenEXR 100; sequences frames / rate; mp4 frames / rate, 606: 25 / 25; WAV samples / 48 000, 351), native rate @56 and @150 (353, 603, 606), the sequence numbering @172 / @176 / @180 and the two `Utf8` around the number (353, 603); png `opti` width / height @20 / @24 and the (first) file name @58 (126, 353, 607); a fresh `pgui`. Footage sits in its folder; root-level footage stays at the root (126), unlike solids. A footage layer is the solid layer block with the footage's id (126, 351, 353, 603-607 differ from `L` only in the source, the label and the out point's time base) and the source's duration as the Time Remapping maximum (351: 1, 353: 0.1). | 126, 351, 353, 603-607, f1 |
+| R29 | **The alias** (`Als2/alas`) is JSON with `fullpath` (the file; a sequence's folder with `target_is_folder` true), `ascendcount_base` 1 and `ascendcount_target` 1 (2 for a folder, as 353), `platform` 1, and empty `server_name` / `server_volume_name`: After Effects resolved all eight paths of f1 and filled the two names on its re-save (13 bytes per item). Quotes and backslashes are escaped, other characters written as UTF-8. | f1 |
+| R30 | **After Effects re-reads a footage file's metadata when it opens the project**: f1's `test8x8.png` was written with the 64 x 48 RGB png prototype (bits per pixel 24, colour type 2, another file size and time); After Effects showed and rendered the 8 x 8 RGBA file correctly, and its re-save had `sspc` @63 (32), @73, @119-121 (time), @208 (size) and `opti` @37 (colour type 6) as for 126. The exporter therefore needs the right prototype per file type and the decoded fields above, not the file's encoding details. | f1 re-save, 126 |
+| R31 | After Effects ends a layer of a clip, sequence or sound at its source's end: f1 wrote all layers 5 s long; the mp4, the sequences and the WAV read back 1, 0.1, 0.1 and 1 s long. Reported as `layer_timing`. | f1 |
+| R32 | **Text layers** (After Effects read-back `export-tests\text\t4`: seven text layers, every text, font, size, fill, justification, tracking, leading and box read back). The layer block is the point (110) or box (245) text layer's (the two differ only in their document and `btgu/pgui`; layer type `ldta@128` = 3 and source id 0: writing type 0 made After Effects show AV layers without a source that it refused to save). The document (`btdk`, 3.10) is the prototype's, parsed into a tree and written back with After Effects' spacing, with: the text `RUN/0`; one paragraph run per paragraph cloned from the prototype's (`RUN/5/0[n]/1` the characters including the CR, `.../0/0/5/0` the justification 0 / 1 / 2: 245, 246, 334); one style run per change of style cloned from the prototype's (`RUN/6/0[n]/1`; slots `/0` font index, `/1` size, `/2` / `/3` faux bold / italic, `/4` automatic leading with `/5` 0.01 or `/4` false with `/5` the leading (400, 339), `/8` tracking (247), `/12` caps (337, 338), `/13` 0 normal / 1 superscript / 2 subscript (526-528), `/53` and `/54` fill and stroke `[A R G B]`: 113, 248, 340); for box text the frame `/0/8/0[0]/0/1/0` (16 corner points, 245). Re-exporting all 18 text fixtures gives documents equal to After Effects' in every decoded field. | 110, 113, 243-248, 334-340, 385, 386, 400, t4 |
+| R33 | **After Effects lays text out again on open**: the composed layout `/1/1[0]/1/2` (lines, glyphs, advances) need not match the text. t1 (113 with `Hello` replaced by `World`, layout stale), t2 (`Hello World`, runs 6 -> 12, layout stale) and t3 (the same with the layout list emptied) all showed and rendered the new text; t3's re-save had the layout rebuilt. The exporter writes the layout empty. The per-paragraph list `/1/1[0]/1/1` (present only with several paragraphs, 243, 386) is left as the single-paragraph prototype has it (absent); t4's three-paragraph layer laid out right. | t1-t3, t4 |
+| R34 | **Fonts**: the prototype's font list (`/0/1/0`: Times New Roman, then three internal entries the rest of the document refers to by index) keeps its order; another font is appended as a copy of the first entry with its PostScript name and `/2` 0 and without the version. After Effects resolved `ArialMT` (family Arial) and, on its re-save, rebuilt the list as it would (the used font first, with its own `/2` and version), and for faux bold / italic added the synthesized first entry (`/3` 2 / 1) of 335 / 336 itself. A text layer's anchor is pixels with the origin as its default (385: `tdb4@24` = 1). | 335, 336, 385, t4 |
+| R35 | **The 3D switch** is `ldta@38` bit 0x04 (015); the layer keeps the AV layer block's inert Orientation / X / Y Rotation and Material Options records, which After Effects replaces with its 3D set on save (d1 re-save, as 015 shows). Position z is written as usual. Read back and rendered identically to EffectCraft with the default camera (`export-tests\threed\d1`: 15 of 15 points). | 015, d1 |
+| R36 | **Time stretch** is the exact ratio `ldta@8 / @108` (018: 2 / 1, 316: 1 / 2, 317: 3 / 2; a reversed layer -1 / 1 or -1 / 2 with the stored in point at the later end and the composition's time scale, 981-983); in and out points relative to the start are written in source time (absolute = start + relative x stretch), and the layer's property time scale (`tdb4@12` of every record of the layer) is the composition's x stretch for 100 % or more (018: 51 200, 317: 38 400) and the composition's below (316: 25 600). Re-exporting 316 and 317 gives layers identical to After Effects' apart from ids and the name; 018 the same stretch, times and time scales. **Keys** on a stretched layer count source time in the layer's time scale (641: 200 %, keys at comp 1 / 2 s stored as 25 600 / 51 200 over 51 200; 642: 50 %, 51 200 / 102 400 over 25 600; 643: the same from a start at 1 s), i.e. EffectCraft's layer time in the layer's units; re-exporting 641-643 gives the key records After Effects wrote. After Effects read back 200 % and 50 % precomposition layers and played them exactly as EffectCraft (`export-tests\stretch\s1`: the moving square at 4 times, both halves, same pixel spans). | 018, 316, 317, s1 |
+| R37 | **Project settings** (aep-format.md 3.12a, cases 620-634) are written into the header chunks: `nhed` bytes 15 (depth 0 / 1 / 2), 8 (frames), 11 (feet + frames), 13 (frames per foot 16 / 40), 14 (count start: 2 = 0, 1 = 1) and the same fields of `nnhd` at 24, 8, 11, 19, 20; `dwga` byte 0 (gamma 2.4); one-byte `lnrb` then `lnrp` after `cpid`; for no working space `cpid` = 16 x `0xff` and the JSON after `PwCs` `{}`. Read back exactly by After Effects (`export-tests\settings\g1`-`g3`; g1 re-save: only noise). A working space named without its profile data is refused by After Effects ("Unable to read project color settings", g4). Before, every export was 32 bpc sRGB (the template's settings), which colour-manages footage that EffectCraft (no working space by default) does not: re-exporting `footage\f1` with the settings written, After Effects now renders the jpeg and mp4 within one level of EffectCraft where round 1 measured 11-13 levels (that gap was the sRGB working space, not the decoder), the other footage unchanged; `effects\e1` moved by at most one level. | 620-634, g1-g4 |
+| R38 | **Conformed clips and four more still types.** A clip conformed to another rate keeps its native frames and rate in `sspc` @38 / @42 and @56 and stores the conformed rate at @146 and @150 (645 against 644); a conformed sequence stores the new rate as its own (@42, @56, @150; 615), which is what the exporter writes for a sequence anyway. Targa (650), flat Photoshop (651), Illustrator (652) and EPS (653) stills are their cases' items (`opti` holds no file name; the duration 0 / 600); Illustrator and EPS share the type tag `TEXT`. After Effects read back `export-tests\footage\f3` (all five files found, the clip 0.8333 s, at 0.5 s it shows the clip's frame 15 = 30 fps) and rendered tga, psd and ai identical to EffectCraft (0 / 0 at 2 times), the EPS within 51 levels at the edges of its square (rasteriser), the clip: EffectCraft shows frame 12 at 0.5 s = it plays the clip at its native 25 fps (the renderer does not apply a conformed rate; not an export problem). | 615, 644, 645, 650-653, f3 |
+| R39 | **Track mattes** (IMPORTER cases 402-408): the target layer's `ldta@107` holds the mode (1 alpha, 2 alpha inverted, 3 luma, 4 luma inverted) and `ldta@160` the matte layer's id (any layer, also one below); the matte layer's video switch is written as EffectCraft has it (After Effects 2026 does not hide it by itself). o1: luma matte rendered identically to EffectCraft. | 402-408, o1 |
+| R40 | **Markers**: the marker group of 249 (`tdmn ADBE Marker` + `LIST mrst`) is inserted as the first property of the layer's root group or of the composition's `Markers` view layer (`SecL`); one 16-byte record per marker (time in the owner's time units, bytes 4 / 5 = 3, the rest written 0 where After Effects leaves session bytes) with `lhd3` words 2, 3, 7 as for keys, and one `Nmrd` per marker (`NmHd`: cue type 4 / 5, parameter count, duration in 1/600 s, 600, label; five strings and the parameter pairs). Layer markers count layer time in the layer's units. Re-exporting 122, 123, 249, 347-349 gives the markers After Effects wrote; o1 read back every field. EffectCraft's default marker label is Red (index 1), After Effects' is None. | 122, 123, 249, 347-349, 509, 510, o1 |
+| R41 | **Cameras and lights** are the layer blocks of 256 (two-node camera), 254 (spot) and 252 (point) with the layer header fields set (type 2 / 1, source 0 / `0xffffffff`, the light type at 136, the auto-orient bit 0x40 for a two-node camera and every light, the 3D bit), the point of interest as the Anchor Point in pixels and the Position as an explicit value (the camera / light Position record has the layout of a 3D layer's, 253 = 045); every camera option is written (Zoom and Blur Level with the plain-double layout of Focus Distance, 342; After Effects read them back), light options only where they differ (254, 343-345), in After Effects' order. o1: all values read back. | 251-256, 342-345, o1 |
+| R42 | **Shape layers**: the shape layer block of 519 with its contents emptied, items cloned from 519 (all defaults, no value records) and 240 (path), value records from the one-change cases (451-471, 239, 242) only where a value differs from After Effects' default, in After Effects' order (fill rule before colour, 455; stroke colour, opacity, width, cap, join, miter, 464 / 239; group transform anchor, position, scale, skew, skew axis, rotation, opacity); colours `[A, R, G, B]` 0..255, opacities and the group scale in percent, popups 1-based, the path as a mask path with a box in layer pixels (the box of 240 to the bit). Rectangle Position takes the record layout of Ellipse Position (no case; o1 read it back). o1: every value read back, render identical to EffectCraft but for edge pixels. | 238-242, 451-471, 519, o1 |
+| R43 | **Character and paragraph slots** (After Effects read-back `export-tests\text\t6`): the scales `/6` `/7` (factors), baseline shift `/9`, automatic kerning `/11` (0 none, 1 metrics, 2 optical), ligatures `/18`, tsume `/36` (fraction), fill / stroke switches `/56` `/57`, stroke over fill `/58`, stroke width `/63`; paragraph indents and spacing `/1`-`/5`, hanging punctuation `/21`, composer `/29`, direction `/33`, justification 3-6: importing After Effects' re-save of t6 gives the same documents as importing the export, in all 15 layers; text.measure and the render agree with EffectCraft (baseline shift, indents, spacing, justified last lines, scales, stroke). EffectCraft's default composer is every-line (`/29` true, as a new text from After Effects' Paragraph panel; scripted texts store false, 538); After Effects reads it as every-line and breaks lines as EffectCraft. **In a right-to-left paragraph the stored justification is relative to the direction** (t7): 0 and 3 are laid out flush right, 1 and 4 flush left, 2, 5, 6 as in left-to-right; EffectCraft's justification is visual, so the exporter and the importer swap 0 / 1 and 3 / 4 there. | 538-569, t6, t7 |
+| R44 | **Time remapping** (After Effects read-back `export-tests\remap\r1`, `r1b`): the layer's `ADBE Time Remapping` record with `tdsb` 1, `tdb4` byte 5 bit 0 cleared and byte 68 = 1, and a key list of plain 48-byte one-component records (value in seconds at 8) in place of `cdat`; `tduM` stays the source's duration. Re-exporting 319 and 354 gives the record After Effects wrote, byte for byte. Keys count layer time in the layer's time scale like any key (a 200 % layer's key at layer 2 s reads back at comp 4 s). A record with `tdsb` 1 but a static value and no keys reads back as remapping **off** (r1 Freeze), so a remap without keys is written as one key. Read back: hold, bezier ease, labels, an expression, reverse; renders equal to EffectCraft at 9 times but for a bezier-out / linear-in segment (EffectCraft's interpolation, 9-12 px at 2.5 / 3 s). | 319, 354, r1, r1b |
+| R45 | **Effect value records by parameter type** (all effect fixtures; After Effects read-back `export-tests\effects\e2`). Over the whole synthetic corpus every static value record of a parameter type has the same `tdsb` and `tdb4` but for the time scale (`@12`) and a point's layer aspect (`@24`, with the constant `6.25e-12` at `@16`); a slider's `tdum` / `tduM` repeat its slider range from `pard` (float sliders `f32` @112 / @116, fixed sliders 16.16 and integer sliders `i32` @132 / @136; angles have none), and `tdsn` is the parameter's `pard` name (a checkbox's `pdnm` label). So one record per type (`fxkd`: integer 414, fixed 361, angle 219, checkbox 217, colour 357, point 369, popup 377, float 071) and the parameter's definition build every record: re-exporting every effect fixture rebuilds every static record of a mapped parameter byte for byte (`every_static_value_record_is_rebuilt_byte_for_byte`). **Records are named by the parameter's match name, which is not its position in `parT`** (Fill: position 2 is `ADBE Fill-0007`; Hue/Saturation's position 8 is `-0009`). An expression on an effect parameter sets only `tdb4@120` (534; bytes 76 / 77 stay 0, unlike the Transform properties). A point key's ease speed is pixels per second over the layer height (598). Default instances come from our cases at the defaults (or a one-change case with that record removed: 073, 711). After Effects' save of a project it opened stores **point defaults in percent** (50 / 50 instead of 0.5 / 0.5: e1 and e2 re-saves) and can leave **0 in a popup's default slot** (Luma Key, e2 re-save): the reader and the importer read both (`resaved_defaults.rs`). e2 (27 compositions, one per effect): every non-default value, the renamed `Speed` slider and both expressions read back; importing After Effects' re-save gives the same 54 effects as importing the export (0 differences). | 070-075, 210-221, 307, 356-397, 409-448, 511-534, 598, 711-723, e1, e2 |
+| R46 | **Shape records by property type, keys and expressions** (all shape fixtures, 851-857; After Effects read-back `export-tests\objects\o2`). Over the corpus every shape value record of a type has the same bytes but for its match name, the time scale and a slider's range in `tdum` / `tduM` (0..100 for every slider but Skew -85..85 and Highlight Length -100..100; sizes and scales -32 000..32 000): one-component sliders take the record of Fill Opacity (454), angles of Rotation (458), popups of Fill Rule (455), points of Ellipse Position (453), sizes and scales of Scale (457), colours of Fill Color (451); every static record of every shape fixture is rebuilt byte for byte (`every_shape_value_record_is_written_as_after_effects_wrote_it`; After Effects also keeps records set to their default, 239 Miter Limit 4, 332 Highlight Angle 0, and the inner radius of a polygon, 331, which the exporter leaves out: absent = default). The items not in 519 at their defaults come from 731 (merge, offset, repeater). A keyed shape property clears `tdb4` byte 5 bit 0 and sets byte 68 (points and colours also clear byte 79) and holds plain records (48 bytes one component, 88 bytes a size: 851, 852, 855, 857) or spatial ones (104 bytes a point, flags 7: 853; 152 bytes a colour, flags 1: 854); the 7 key fixtures are written as After Effects wrote them but for the arc length, automatic tangents and the unused ease before the first / after the last key. The reader takes a shape colour's keys as spatial by their record size although `tdb4` byte 7 is 0 (854). An expression sets `tdb4` 76, 77, 120 as on the Transform properties (856). | 238-242, 331, 332, 451-477, 519, 707-710, 731, 851-857, o2 |
+| R47 | **Ease the importer decodes is written back** (597, 598, 599, 700, 730): an Anchor Point stored as a fraction of its source has its spatial speed in pixels per second divided by the source height (597 on 1920 x 1080, 730 on 400 x 800; an effect point the same, 598); a mask path key holds its ease at bytes 24..55 of its 64-byte record (in speed, in influence, out speed, out influence; 599, 700). Re-exporting the five fixtures gives the key records After Effects wrote in time, interpolation and the used ease sides (`tests/ease.rs`). | 597-599, 700, 730 |
+| R48 | **Text animators** (114, 579-594, 728; After Effects read-back `export-tests\text\t8`). The layer's `ADBE Text Animators` group (after More Options) is 579's, every animator its first animator with one copy of its range selector per EffectCraft selector; an animator property is written whenever the animator has it (its entry is what Animate adds), a selector property only when it differs from the default or carries keys or an expression; every record is the one After Effects wrote for that property (579-592, 728), keyed as on shape properties (593, 594). With Units = Index the range is `Index Start / End / Offset` (583; After Effects also keeps the percent range it had, which the export leaves out), and After Effects writes Smoothness 100 explicitly with Ramp Up (587, absent = default). Re-exporting the 18 animator fixtures gives After Effects' structure and records byte for byte (but for unused ease sides and arc lengths). t8: every value read back, the re-save imports equal to the export, three of four texts render equal to EffectCraft. | 114, 579-594, 728, t8 |
+| R49 | **Rec.709 Gamma 2.4 working space** (624; After Effects read-back `export-tests\settings\g5`). After Effects keeps the working space's ICC profile in the project: `cpid` is the profile's 16-byte ID (ICC.1:2010 7.2.18, the MD5 of the profile with the flags, rendering intent and ID fields zeroed) and the `Utf8` after `PwCs` is `{"baseColorProfile":{"colorProfileData":<base64>,"colorProfileName":...},"baseProfileType":2}`. The exporter copies no profile: for this working space it writes one of its own (and one for sRGB), authored from the standards (`crates/aep/src/export/icc.rs`): ICC v4 display class, BT.709 primaries, D65 white adapted to the D50 PCS with Bradford, a pure 2.4 power curve (BT.1886 with black 0), description `Rec.709 Gamma 2.4 (EffectCraft)`. After Effects opens it with that working space and renders g5 identical (0 levels) to the same project switched to its built-in Rec.709 Gamma 2.4; the importer maps both names to Rec. 709. Other working spaces are still written as sRGB (reported) | 624, g5 |
+| R50 | **Sequence folder time** (860; After Effects opens `export-tests\sparse860\exp` x1-x3 through the startup argument): a sequence item's `sspc@118` (u32, seconds since 1904-01-01 UTC) is the modification time of the sequence's folder when After Effects last scanned it. While it equals the folder's, After Effects keeps the stored numbering; otherwise it scans the folder on open and raises a modal "missing frame" warning for every gap. The folder's time opens 860's export without the dialog; the time of the first or of the last file does not (x1, x2), the file size at @208 does not matter (b-size). `export_with` asks the caller with each sequence's first file as the project stores it and writes the answer only for sequences (`file.exportAep` follows that file through the document-path policy first, as the footage check does: for a refused path, such as one on another computer stored in an imported project, the folder is not looked at and the time stays 0; otherwise it reads the folder's metadata, nothing else); `export` and unknown folders get 0 (then the folder is scanned again, harmless for a sequence without gaps). | 860, x1-x3 |
+| R51 | **Layer styles** (950-980; `export-tests\styles`). The `ADBE Layer Styles` group of every layer gets Layer Styles, Blending Options and the applied styles' switch groups set to `tdsb` 1; a parameter whose stored value differs from After Effects' default (the 951 read-back, not EffectCraft's: Use Global Light is off there) gets the record After Effects wrote for it in 977 (the table `style_defs`; Green / Blue Channel Blend are Red's record renamed) with the value replaced, in After Effects' property order; scalar keys take 976's keyed form; expressions as on effect parameters. Re-exporting 951, 966, 970, 974, 975, 976, 977, 979 gives After Effects' group byte for byte; s1 (made here) reads back every value in After Effects, s2 (977) renders identical to the original (0 / 0). A style switched off is written with its switch group's `tdsb` 0 (988). Not written, reported: the whole Layer Styles group switched off (not sampled), edited gradients (`GCst`), keys on colours, points, popups and checkboxes, Knockout. | 950-980, s1, s2 |
+| R52 | **Shape item switch** (986, 987): bit 0 of a shape item group's `tdsb` is its eye switch (1 on; a Fill at 0 is not drawn by After Effects, 986, and drawn once set, 987, both saved by After Effects). A switched-off item is written with the bit cleared; the importer reads it into the item's `enabled` (before, a switched-off fill was drawn, e.g. under trim paths). | 986, 987 |
+| R53 | **Curves and Mesh Warp** (961-965, 985). Their arbitrary-data parameter always has a record and an `aRbs` (the prototypes of 961 / 965 keep it). Curves: EffectCraft's points become whole 0..255 points (at most 16 per curve, reported otherwise), the five lookup tables are the natural spline through them, the `i32` after the point count is -1 for an untouched curve and count - 2 otherwise (as in every sample); re-exporting 963 / 964 gives After Effects' 1644 bytes exactly. Mesh Warp: Rows / Columns / Quality as integer sliders, the mesh as rows + 1, columns + 1 (`export-tests\mesh`: only this order renders as made), the stored 12 bytes, and per vertex the position (fraction of the layer) with its default handles moved along (985) plus each handle's own move, which the importer keeps as eight extra numbers of the vertex (EffectCraft draws the mesh bilinear); 985 re-exports within 1e-5. Not written: keys on the curves or the mesh. | 961-965, 985 |
+
+**Not rules (noise After Effects changes by itself on save):** `head` save counter, `nhed` /
+`nnhd` session ids, `fdta`, `ppSn`, item modification times, `idta@23` of folders,
+and the cached arc length `f64 @16` of a spatial
+key (0 as written, filled by After Effects when it saves a path with a curve).
+
+## After Effects read-back
+
+Each file was opened with `tools/open-in-ae.ps1` in After Effects 2026 and read back through its
+scripting interface (comp size, rate, duration, work area, layer names / flags / timing / parents,
+property values and keyframes with interpolation and ease); the last column says whether an
+AE re-save of the same file differed.
+
+| File | Content | Read back | AE re-save |
+|---|---|---|---|
+| `e0-noxmp`, `e0-rename` | an export without XMP; renamed composition and layer | accepted, names read back | not run |
+| `x1` | `C` 1920x1080, 25 fps, 5 s, red solid `L` | identical to the base fixture `000` | not run |
+| `x2` | `Comp 2` 1280x720, 30 fps, 4 s, green 400x300 solid, layer `Layer X`; shutter phase -90, motion blur on | all read back | not run |
+| `x3` | folder `Folder A` with a composition and a solid, a 29.97 fps composition, a null layer | tree, parents, 29.97 fps (2.002 s), null 100x100 | not run |
+| `x4` | all five Transform values | Anchor [100,50], Position [300,200], Scale [50,60,100], Rotation 45, Opacity 25 | not run |
+| `x5` | two linear keys on all five properties | 10 keys read back with values and times | not run |
+| `x6` | bezier / hold sides with ease, 3 keys on Opacity and Position, an expression | interpolation names, influence 16.67 / 25 / 33.33 / 50 %, speed 100, expression `time*20` | not run |
+| `y1`, `y1b` | adjustment, locked / shy / solo, hidden, guide, blends, label, draft, parents, timing, bg, pixel aspect 10/11, shutter, display start, work area, 80 character and Japanese names | everything read back; `y1` exposed R5 | identical (only noise) |
+| `y2` | 5 Position keys (labels, manual tangents, roving), per-dimension Scale ease, Anchor keys, hold, disabled expression, 24 fps | all read back | only `ldat` arc lengths and the roving time |
+| `y3` | 300 layers x 20 keys, 50 fps | 300 layers | not run |
+| `x0` | empty project | opens, the `Solids` folder only | not run |
+| `x7` | no layers, an empty folder, duplicate names, a project folder named `Solids` with two solids, a one-frame composition | 8 items, one `Solids` folder with the two solids and the hidden null solid, duplicate names kept | not run |
+| `cli1` | written by `effectcraft-cli run --empty comp.new layer.newSolid layer.newNull prop.addKey ... file.exportAep` (the command path itself) | solid + null layer, Position and Rotation keys, expression `wiggle(1,20)` | not run |
+| `z1` | 6 rates, 6 compositions, folder, 100 character and umlaut solid names, nulls, keys, expressions | 6 rates, durations, 16 items | identical (only noise) |
+| `objects\o1` | shape layer (groups, rect, ellipse, path, fills, stroke, group transforms), luma track matte, layer and composition markers, two-node camera, spot and point light | every value read back (READBACK.md there); shapes render identical to EffectCraft but for edges, the lit 3D card the same geometry with EffectCraft a little brighter | camera / light transform sets rebuilt, marker session bytes filled |
+| `stretch\s2` | three solids moving with two linear Position keys each, stretched 200 %, 50 % and 150 % from 0.4 s | key times in comp time 0 / 4, 0 / 2, 1.9 / 4.9 s; renders identical to EffectCraft at 1, 2, 3, 4.5 s (max 1 level) | not run |
+| `footage\f3` | tga, psd, ai, eps stills and an mp4 conformed from 25 to 30 fps | all found; clip 0.8333 s; tga / psd / ai renders identical to EffectCraft, EPS edges within 51, the conformed clip a different frame in EffectCraft (renderer ignores the conformed rate) | not compared |
+| `settings\g1`-`g4` | project settings | g1-g3 every setting read back; g4 refused (R37) | g1: only noise |
+| `settings\g5` | Rec.709 Gamma 2.4 working space, 16 bpc: a black-to-white Gradient Ramp, a mid-grey and a red solid | the working space shown as `Rec.709 Gamma 2.4 (EffectCraft)`; render identical (0 levels) to the project switched to the built-in Rec.709 Gamma 2.4 (R49); EffectCraft's Rec. 709 renders about 7 levels darker (renderer) | import Rec. 709 |
+| `footage\860` | a sparse png sequence (files 1, 2, 4, 5 of 1-5, imported by After Effects as one sequence) | After Effects stores a sparse sequence as the folder (alias with `target_is_folder`), the prefix and extension `Utf8`s and the numbering range in `sspc` @172 / @176 (1 / 5), nothing per file; the export writes the same and opens with no missing footage; scripted (`project.open`) with no dialog, but through the startup argument (the GUI path) only with the folder's modification time (R50; before it, a "missing frame 3" warning); renders of comp S at frames 0-4 equal the original's (After Effects holds frame 2 for the missing 3); the P1 export (the round-2 dialog) now also opens with 0 missing items and its 36 ranges equal the original's. `sspc` @208 (the files' total size, 628 in 860) keeps the template's value: After Effects does not check it (b-size) | import: 5 frames, 1-5 |
+| `objects\o2` | four shape layers: star + radial gradient fill + stroke; rounded rectangle with keyed trim paths; merged (subtract) rectangles with offset paths -10 and a keyed fill colour; a repeater (5 copies by expression `3 + Math.floor(time * 2)`, rotation, end opacity) in a group with keyed position | every value, key and expression (R46); renders at 0 / 0.5 / 1 / 1.5 / 2.5 s: star and gradient and the repeater equal to EffectCraft (mean 0.14 / 0.6); EffectCraft differs (renderer) on trim paths with Start above End and the start point of a rounded rectangle, and on Offset Paths with Copy Offset 0 (After Effects draws no offset, EffectCraft shrinks the shape; EffectCraft's default Copy Offset is 0, After Effects' 1) | not run |
+| `effects\e2` | 27 compositions, one per mapped effect, on a ramp | every value and expression (R45); renders: Invert, Fast Box Blur, Drop Shadow, Hue/Saturation (both), Levels, CC Radial Blur, Channel Blur, Tritone and the five controls within 2 levels, Gaussian within 9 (edges); EffectCraft differs (renderer) on Fill (After Effects makes the layer the colour at the opacity, EffectCraft mixes it with the original), Timewarp (After Effects retimes the source without the effects above), Glow, Venetian Blinds, Directional / Radial Blur, Black & White, Luma Key, the chokers, Transform, and the `effect("Speed")("Slider")` expression (After Effects rotates 10 degrees at 1 s, EffectCraft 0) | import of the re-save = import of the export |
+| `remap\r1`, `r1b` | five remapped precomposition layers (reverse, hold + ease, no keys, expression, 200 % stretch) | every key, interpolation, ease, expression; the keyless remap read back off in r1, on in r1b (R44) | not run |
+| `text\t8` | four texts with animators (keyed reveal, words, ramped colour, index units + subtract) | every animator, property and selector; re-save import = export import (R48); renders equal but for tracking with index units (renderer) | import equal |
+| `styles\s1`, `styles\s2-977` | s1: a solid with five styles made in EffectCraft (an expression on a colour, a Hue stroke at Center, Inner Glow Center, Emboss, a Multiply overlay, Fill Opacity, Global Light 60); s2: 977 imported and exported | every value read back (s1); render of s2 = 977 (0 / 0); s1 EffectCraft vs After Effects mean 0.7 (glow, bevel and Hue in EffectCraft's renderer) | import equal |
+| `text\t6`, `text\t7` | character / paragraph slots; right-to-left justification | every slot via the re-save import, measures and renders (R43) | t6: the import equals the export's |
+| `text\t5` | normal, superscript, subscript HHHH | widths 288.9 / 168.4 / 168.4, baselines 0 / -33.3 / +33.3 (= 527 / 526 / 528) | not run |
+| `stretch\s1` | a precomposition with a moving square shown at 200 % and at 50 % from 1 s | stretch 200 / 50, in / out 0-8 and 1-3; the square at the same pixels as in EffectCraft at 1, 2, 4, 6 s | not run |
+| `threed\d1` | three 3D solids at z 0, 500, -300 without a camera over a 2D background | 3D switch and positions; render identical to EffectCraft (15 points) | Transform / Material Options rebuilt for 3D (R35) |
+| `footage\f2` | a jpeg sequence, a ProRes mov, a TIFF | all found, sizes and durations; TIFF identical to EffectCraft, the jpeg sequence and the mov 11-13 levels apart (the sRGB working space of the round-1 template, as f1) | not run |
+| `text\t1`-`t3` | 113 with the text replaced (same length, longer, longer with the layout emptied) | the new text, laid out and rendered right (R33) | t3: layout rebuilt |
+| `text\t4` | point text, three centred paragraphs, right-aligned Arial box text, two style runs with tracking, faux bold + all caps, faux italic + small caps with automatic leading, an anchor | all texts, fonts (Times New Roman, Arial), sizes, fills, justification (7413 / 7414 / 7415), tracking 50, leadings, the box 400 x 200 at [-200, -100], anchor [10, 20]; rendered with small caps, all caps and italics | font lists rebuilt (R34), layouts filled, nothing else |
+| `footage\f1` | png, jpeg and OpenEXR stills, an OpenEXR sequence (101-103, 4 digits), a png sequence, an mp4, a WAV, and an 8 x 8 RGBA png written with the RGB png prototype | every item found, names, sizes, durations, rates; renders identical to EffectCraft for png, OpenEXR, both sequences and the 8 x 8 png (21 points), jpeg and mp4 11-12 levels apart in both (round 1: the template's sRGB working space; re-exported with the project settings, R37, within one level); the timed layers ended at their source (R31) | aliases filled with the machine and volume name, `sspc` / `opti` / colour data of the stale png refreshed from the file (R30), an empty Mask Parade added to the WAV layer (as in 351) |
+| `effects\e1` | Tint on a red solid, Gradient Ramp on a 640 x 360 solid, a keyed Exposure and a second (renamed) Tint on a grey solid | every value and key; the renamed Tint showed the effect's name (R26; `e1b`, written after the fix, shows `Tint 2`); renders: Ramp and Exposure within 1 level of EffectCraft, Tint 10 levels apart from EffectCraft's Rec. 709 luminance (AE uses Rec. 601, `fix-tint-luma`) | value records copied into `EfdG`, `pard` value slots refreshed, `fnam` reset |
+| `precomp\p1` | 5 compositions, a 30 fps 640 x 360 precomposition with anchor and position, one composition used twice, a chain C2 > B > A, Scale keys on a precomposition layer | everything; renders identical to EffectCraft at 39 points (`READBACK.md` there) | C2's `idpc` count rewritten and its two `idpi` swapped (R23; p1b with the count fixed: only the swap), otherwise only noise |
+
+### What After Effects needs: the read-backs behind the code-built chunks (2026-10-29)
+
+Each variant is an export with one change: a chunk left out, or bytes zeroed. After Effects 2026
+opened it, and its own project export (JSON) was compared with the unchanged file; "same" means
+no difference there (renders where noted). The exporter writes only what the "needed" rows name,
+as constants in `export/base.rs`, `export/footage.rs`, `export/synth.rs` and `export/textproto.rs`.
+
+| Chunk | Can be left out or zero (same) | Needed (what After Effects does without it) |
+|---|---|---|
+| top level | `svap`, `gpuG`, `sfnm`, `pcms`, `pdvc`, `ExEn`, `wsns`, `nnhd` absent; `fdta`, `Rhed`, `Rout`, `ppSn`, `prda` zero; `head` 16..19 and the `nhed` / `nnhd` save noise zero; `PTRE`, `CIF*` absent; `AFsi` / `ARsi` zero | `adfr`, `qtlg`, `mrid`, `acer`, `CPPl`, `fcid`, `oacc` ("missing data"); `head` 0..11 ("created with an older version"); the `nhed` rates ("zero denominator"); `LRdr` and `LSIf` ("file is damaged"), with an `AFsi` / `ARsi` body of 1 872 bytes ("missing data") |
+| composition | `idpc` absent; `cdrp` / `comr` zero; the view layers' property trees empty; `ldta` beyond the decoded fields zero | `dats` (**After Effects crashes**); `cdrp` / `comr` present; `cdta` 0..3, 176, 184, 196, 200 (zeroed: crash); the eleven view layers ("invalid number of ... cameras") |
+| items | `Ewst`, `Gide` absent; `idta` beyond 0..24 and 58 zero; `pgui` zero; `mnfo` absent | `idta` 23 (renders differ); the seven f-records after every item and layer ("missing data"); `CLRS` and `ftgi` ("missing data"); a solid's `sspc` constants (`SOLID_SSPC`, "missing data") |
+| footage | `opti` beyond its first 12 bytes zero; `sspc` 64..66, 69, 79, 97..101, 112..115, 159, 199..201, 212 zero; our own sRGB profile (or `{}`) in `CLRS` | the `opti` header and size, the `sspc` constants per kind (`kind_item`) |
+| property records | `tdb4` beyond the decoded bytes zero, except: | `tdb4` 8..11, the class word (keys are dropped without it); 16..55, 0.0001 and four 1.0 (a roving key reads back at time 0 without them, `re-keyframes`) |
+| text document | `/98`, `/1/2`, `/1/3`, `/1/4`, `/1/0/9`, the kinsoku sets `/0/4`; the sheets' and fonts' entries down to their names; the run dictionaries down to the keys the exporter writes; the layout down to `/0` and `/2` | `/0/5`, `/0/6` and `/0/8` (the layer is skipped; `/0/8` holds the box frame: empty, a box text turns into point text); `/1/0` (skipped) and all of `/1/0/0` (After Effects crashed); in every run the other sheet's key (`/6` in a paragraph run, `/5` in a style run; skipped); `/1/5` (without it After Effects rewrites the document on open) |
+
+After all chunks were built in code, 20 cases (the lab cases e1, e2, m1, x3, y3, o1, o2, g3, t4, t7,
+t8, f1-f3 and six corpus re-exports) were read back against the template-based export: no
+difference.
+
+## How fidelity is checked in this repository
+
+- `crates/aep/tests/it/export/built.rs`: projects built in code are exported and parsed back with
+  `effectcraft-aep`; every exported field of the composition header, the layer header, the solids,
+  the Transform values, the keys (time, interpolation, value) and the expressions is compared; the
+  container is consistent (writes back byte for byte); the report, the refusal and the JSON round
+  trip; the output is deterministic; an export holds no local data.
+- `crates/aep/tests/it/export/roundtrip.rs`: every case of the corpus (opt-in, `EFFECTCRAFT_AEP_FIXTURES`) is imported,
+  exported and imported again; the two imported projects are equal for the exported subset (more
+  than 100 compositions, masks included).
+- `crates/aep/tests/it/export/masks.rs`: masks built in code (all seven modes, inverted, feather,
+  opacity, expansion, open path and hexagon with tangents, path keys with hold and label, feather
+  keys with per-dimension ease, a 400 x 300 source) are exported and parsed back with
+  `effectcraft-aep` (name, mode, invert, counter, values with their default/stored state, vertices
+  and tangents in pixels, the box, open bit, key records), then imported and compared field by
+  field; every mask fixture goes through import, export and import; what cannot be written is
+  reported; hostile masks (70 000 vertices, a single point, a line, a lopsided path, 1e300, a
+  1000 character name) never panic and the container stays consistent.
+- `crates/aep/tests/it/export/effects.rs`: every effect case is imported, exported and parsed back; every parameter's stored value, keys (time,
+  value, interpolation), the instance name and the input layer equal what After Effects wrote,
+  and a second import gives the same EffectCraft values; edited parameters and keys no fixture
+  has, two instances of a type (one full `parT`), the project lists, renamed instances; switched-off
+  effects and expressions written and read back, unmapped effects reported; NaN, 1e300 and text values never panic.
+- `crates/aep/tests/it/export/text.rs`: every text case through import, export and parse:
+  text, paragraphs, style runs (font, size, fill, tracking, faux, caps, leading), box equal to
+  After Effects' document, and a second import equal; documents built in code (CRLF / LF, runs
+  across a line break, a new font, box text, empty text, the name rule, the layer type); what is
+  reported; hostile text (150 000 characters, NaN sizes, emoji, parentheses and backslashes,
+  runs that do not cover the text). `src/export/textdoc.rs` has the tree's own tests.
+- `crates/aep/tests/it/export/footage.rs`: one item of every kind written and parsed back (type
+  tag, size, duration, rate, numbering, the name rule, png options, layer sources and the time
+  remapping maximum), escaped paths, fixtures 126 and 603 through import, export and import, what
+  is reported (other types, gaps, NTSC rates, no path, layers past their source), hostile footage
+  (100 000 frames, huge sizes, control characters, a sequence without numbers).
+- `crates/aep/tests/it/export/precomp.rs`: a 640 x 360, 30 fps, 3 s composition in a 25 fps one
+  (source id, `idpc` / `idpi`, the size used for the anchor, the time remapping maximum, the name),
+  import of the result, one composition used twice and chains of three, loops and missing
+  compositions reported; `roundtrip.rs` compares the precomposition layers of 124 and 319.
+- `crates/aep/tests/it/export/robustness.rs`: empty names, huge and zero sizes, NaN and infinite
+  numbers, non-positive frame rates, 2 000 layers with 20 000 keys, parent loops, folder loops,
+  missing sources, 10 000 character names.
+- `crates/engine/src/tests/aep_export.rs`: the command, refusal, dry run, bad input, the menu entry.
+
+## Clean-room method
+
+The exporter reads no file After Effects wrote: every chunk is built in code. Every layout it
+writes is established in [aep-format.md](aep-format.md) from our own corpus or in the table above
+from experiments against After Effects itself. No source code or format documentation of any other
+`.aep` reader or writer was used.
+
+## Not done yet
+
+Not written: effects outside the table (plug-ins, Lumetri, ...), keys on popups / checkboxes / angles / integer sliders, colour key ease,
+Source Text keys, wiggly / expression selectors, shape items outside trim / round / merge / offset / repeater / polystar / gradients, gradient colour stops, parallel and ambient lights, bezier ease speeds on stretched layers,
+edited layer style gradients and Knockout, 3D rotations and material options, footage of other types (avi, mp3, pdf, ...),
+proxies and footage interpretation other than a conformed rate, the Advanced 3D renderer, working spaces other than None, sRGB and Rec.709 Gamma 2.4, 3D model layers (glb), the render queue.
+Masks: keys on Mask Opacity and Expansion (no keyed prototype in the corpus), the
+mask colour, lock, feather falloff, motion blur and RotoBezier switches (not decoded).
diff --git a/docs/aep-format.md b/docs/aep-format.md
new file mode 100644
index 000000000..8830a869e
--- /dev/null
+++ b/docs/aep-format.md
@@ -0,0 +1,1095 @@
+# After Effects project format (`.aep`)
+
+> **Last reviewed:** 2026-11-05 · **Last updated:** 2026-11-07 · **Change:** Puppet (`ADBE FreePin3`, 3.7): the property tree from an external scripting listing, **?** until a byte sample exists (#3093); before that: footage: an image sequence without a filename prefix stores only the suffix `Utf8`, and one imported with Force alphabetical order stores its file list in `LIST StVc` / `StVS` (section 3, footage); before that: versions: `svap` is the version that wrote the file, `head` bytes 4 to 7 the version it is written for, and what a Save a Copy As 25.x / 24.x of After Effects 2026 changes (section 1, "Versions"); before that: the stretch numerator is signed (a negative one reverses the layer, 981-983); layer styles (3.12b, 950-980); before that: footage: `sspc@118` of an image sequence is its folder's modification time (860, read-back x1-x3); before that: text: paragraph `/24`, `/35` and style `/68` are neutral for 0 and 1 (732-734, edited in place); before that: keyframes: the ease of mask path keys (599, 700), the spatial speed unit of fractional values (597, 598, 730); before that: text: character and paragraph settings, manual kerning, vertical text, `/nil` is neutral (S17: 538-578, 595, 596); before that: cameras, lights and 3D rotations (S16: the auto Position of a two-node camera is where After Effects renders it, 537; camera and light defaults read back 255, 256; Orientation `otst/otda` 488), Timewarp (529-533), an expression on an effect parameter (534); before that: text: style slot /13 is superscript / subscript (526-528; every scripted text of the corpus is superscript), wrapping box text 517; before that: effects of batch 5 (409-450, 511-516: integer sliders, checkbox defaults in `pard`, arbitrary data of Hue/Saturation and Levels, the parameters of Invert, Fast Box Blur, Gaussian Blur, Drop Shadow, Glow; section 3.7); before that: shape items of batch 5 (451-484, 519: ellipse, fill and stroke opacity, fill rule, group transform, shape layer anchor, trim paths, rectangle roundness, polystar fields, gradient default, nested groups, the defaults of every item; section 3.9); before that: track mattes: mode at `ldta` byte 107 and the matte layer id at byte 160 (cases 402-408, section 3.1); before that: text: automatic leading is verified (400); Exposure (`ADBE Exposure2`, cases 389-397): group start / end parameter types 13 / 14, float slider valid minimum and slider range (section 3.7); before that: text: U+0003 is a paragraph break (386, 387); before that: a stored text Anchor Point is pixels (385, now V); before that: the XML form `.aepx` is read into the same chunk tree (section 1, "The XML form"); the `head` save counter is a `u32` at byte 16; text documents for the importer (stroke colour, automatic leading, the font of each run, the undecoded-slot check, the text-layer Anchor Point, the Source Text record); before that: third round of verified field layouts (explicit-default semantics, type-major bezier ease, exact time stretch and in / out points, Time Remapping state, comp pixel aspect / shutter phase / display start, Point default, Layer Control None, dropdown selection, one `mkif` per mask, polystar and radial gradient records, text styles, camera and light options, marker cue data, audio and image-sequence footage) added to the typed view of `effectcraft-aep` · **Target:** Adobe After Effects 2026
+
+What `crates/aep` ([`effectcraft-aep`](../crates/aep/README.md)) reads and writes, and the evidence
+for each statement. Everything here was observed on project files we generated ourselves; no
+source code, specification or format documentation of any other reader was used (every layout is
+backed by our own cases, see section 5). This is the container and a set of
+verified field layouts, not a project importer: turning a parsed `.aep` into an EffectCraft
+document is done by the `import` module of the same crate, see [aep-import.md](aep-import.md) (status and
+gaps: [gaps.md](gaps.md) G4 and [file-format-parity.md](file-format-parity.md)).
+
+Evidence is cited as **case numbers**: the files `NNN-*.aep` of our synthetic corpus, each made by
+one scripted change to a base project. Batch 1 (cases 000 to 126) was made in one chain of
+Save As; batch 2 (cases 200 to 259) was made in later sessions, each case starting again from the
+same loaded base; batch 3 (cases 299 to 354) was made in three further sessions (299 is a Save As
+without any edit, the reference for save noise). The base project `000-base` is one composition `C`
+(1920x1080, 25 fps, 5 s) holding one red solid layer `L` (1920x1080) in the folder `Solids`. 374 of
+these cases (369 `.aep`, and the `.aepx` of `000`, `058`, `060`, `110`, `124`) are the test fixtures. They
+are a few combined projects, one composition per case named like the case and rebuilt from the
+same recipe (`crates/aep/tests/fixtures/CASES.md`, the generator in `tools/` there), read from the
+folder named by `EFFECTCRAFT_AEP_FIXTURES` (opt-in); `crates/aep/tests/it/common/mod.rs` hands a test its case as a project of its own cut from
+the combined file, and a test whose fixture is missing prints `SKIPPED: fixture <name> missing` and passes. The tests named below run on them;
+the `.aepx` cases are one pair, `aepx-pair.aep` and `aepx-pair.aepx`. The container
+of every fixture is byte-identical to the generated file, with two exceptions that keep the
+fixtures small and free of local data: the XMP packet after the container (which grows by 1.7 KB
+with every save of the corpus chain) is replaced by the 5.8 KB packet of the base project in all
+fixtures but `001` (and inside `<ProjectXMPMetadata>` of the five `.aepx` fixtures), and in every fixture that imports a file (a footage item: `126`, `350`-`354` and the later footage cases) the
+file path and machine name inside the footage alias JSON are replaced by neutral text of the same
+length.
+
+**Read-back tests.** Some evidence comes from files we wrote ourselves (not After Effects), opened
+in After Effects 2026 and read back value by value or rendered: an exporter in development, which is
+not in this repository. They are named by an id (`e1`, `f1`, `o1`, `s1`, `t7`, `x1`-`x3`, ...) or by
+their local folder (`export-tests\...`), which is not in the repository either.
+
+Confidence codes in the field tables: **V** = a test in `crates/aep/tests/` asserts that the decoded
+value equals the value the case was made with (the corpus manifest); **E** = decoded and consistent
+in the case diffs, but no manifest value to assert against (the field is exposed only where a test
+pins what the fixtures contain); fields that the corpus does not decide (**?**) or only suggests
+(**H**) are not decoded; they are listed in section 4.
+
+## 1. Container
+
+| Fact | Evidence |
+|---|---|
+| The file starts with `RIFX`, a big-endian `u32` size and the form type `Egg!`; all integers in the structure are big-endian (the one exception, `iide`/`idpi`, is little-endian). | All 139 files of batches 1 and 2. |
+| The declared size is `4 + the chunks`; it ends before the end of the file. The bytes after it are an XMP packet (`<?xpacket begin` ... `<?xpacket end=...?>`, UTF-8 XML, 5.8 KB in `000`) that grows with every save. | All files; test `header_and_trailer_facts`. |
+| A chunk is a 4-byte id, a big-endian `u32` body size and the body; an odd-sized body is followed by one pad byte, always `0` in the corpus (15 622 odd bodies). | Test `odd_sized_chunks_keep_their_pad_byte_even_when_not_zero` keeps any value. |
+| The chunks of every file tile the container exactly: no leftover bytes, no chunk larger than its parent. | 139 of 139 files parse without a repair and write back byte for byte. |
+| A `LIST` chunk's body is a 4-byte list type followed by chunks. List types seen include `Fold`, `Item`, `Layr`, `tdgp`, `tdbs`, `list`, `Pin ` and `FEE ` (the space is part of the type). | `000`; test `list_types_ending_in_a_space_are_kept`. |
+| Lists can be empty (size 4, only the type): `Ewst`, `Pefl`, `CPPl`, `LItm`. | `000`; test `empty_list_and_list_shorter_than_its_type`. |
+| Nesting: at most 13 levels in the corpus (the path of a shape layer, 240). | All files; test `nesting_depth_is_below_the_limit`. |
+| `LIST btdk` is not a chunk sequence: its body (7775 bytes in `110`) is text. A reader must keep it opaque. Only files with a text layer have it. | `110`-`114`, `243`-`248`; test `raw_text_lists_are_kept_opaque`. |
+| Three non-`LIST` ids hold a chunk instead of data: `tdsn`, `pdnm`, `fnam`. Each holds exactly one `Utf8` chunk (a name or label, UTF-8 text, possibly empty). | `tdsn` 31 209 times, `fnam` 40, `pdnm` 32 over the corpus; test `nested_chunk_ids_hold_one_utf8_chunk`. |
+| Ids can end in a space; the space is part of the id. In the corpus this happens for the list types `Pin ` and `FEE `. All ids are 4 printable ASCII bytes. | `Pin `, `FEE ` in all files but `001`; tests `list_types_ending_in_a_space_are_kept`, `ids_ending_in_a_space_are_kept`. |
+| Every payload that is decoded here is plain: no compression, no encryption. Text is readable, numbers are IEEE big-endian doubles or integers. Entropy and decompression probes (zlib, raw deflate, gzip, lzma, bz2, LZ4 block) over all chunk ids of the corpus found no compressed chunk, and consecutive saves of a project differ in only a few bytes. **One body is not understood: `opti` (footage and render options) has a plain 125-byte header and then a high-entropy body (7.9 bits per byte); whether it is compressed is open.** The high entropy of `sdat` is a flat histogram (five identity ramps 0..255), not random data. | `010` (the layer name `Renamed` is readable in a `Utf8` chunk), `040` (`100.0` and `200.0` as doubles). |
+
+### How the crate handles it
+
+- `parse` builds a tree of `Chunk { id, body, pad }`; a body is `Data`, `Chunks` (the three
+  nested ids), `List { list_type, children }` or `OpaqueList { list_type, data }`. The bytes after
+  the container are kept as the trailer.
+- `write` recomputes every size from the tree. For every input that parses, `write(parse(x)) == x`
+  byte for byte, including pad bytes, an odd last body without a pad byte, and the trailer. The
+  tests assert this for all fixtures and for every damaged input that still parses.
+- A `LIST` (or nested id) whose body is not a well-formed chunk sequence, or that is nested deeper
+  than `Limits::max_depth` (64), stays opaque instead of failing the parse. At the top level, a
+  chunk that does not fit, a wrong form type or a container larger than the input is an error.
+  Sizes are checked against the remaining input; nothing is allocated from a declared size; the
+  chunk count is bounded (`Limits::max_chunks`).
+
+### The XML form (`.aepx`)
+
+After Effects also saves a project as XML (`.aepx`). Every case of the corpus was saved in both
+forms from the same state, the `.aepx` right after the `.aep`. Comparing each pair element by
+element with the chunk tree of the `.aep` gives the mapping below. It holds for all 223 pairs of
+the corpus (batches 1 to 3 and the 29 cases 355 to 383 of a fourth batch made the same way, which
+this document does not use otherwise): the tree read from the `.aepx` is the tree of the `.aep`, and written back as an
+`.aep` it gives the same bytes, apart from the save counter and the XMP packet (last row).
+
+| Fact | Evidence |
+|---|---|
+| The file is UTF-8 XML with the declaration `<?xml version="1.0" encoding="UTF-8"?>` and one root element `<AfterEffectsProject xmlns="http://www.adobe.com/products/aftereffects" majorVersion="1" minorVersion="0">`. Its children are the top-level chunks of the `.aep`, in the same order. The `RIFX` header and the `Egg!` form type have no element. Indentation is tabs and line feeds; there are no comments, no entities and no carriage returns in any sample. | All pairs; `000`. |
+| A data chunk is an element named by its id, with the body as lowercase hex in the attribute `bdata` and no content: `<head bdata="0061...3b"/>`. Every body of the `.aep` comes back byte for byte, including large ones (`cdat`, `ldat`, `opti`). | `000` (1 183 `bdata` elements, all equal but `head`, last row), all pairs. |
+| A `LIST` is an element named by its list type, holding its chunks as child elements: `<Fold>`, `<Item>`, `<Layr>`, `<tdgp>`, `<tdbs>`, `<list>`. An empty list is an element without children and without `bdata` (`<Pefl>`, `<CPPl>`, `<Ewst>`, `<LItm>`). The `LIST` id itself is not written. | `000`. |
+| A trailing space of an id or list type is dropped: `Pin ` is `<Pin>`, `FEE ` is `<FEE>`. A name shorter than 4 characters is padded with spaces to read it back. | `000` (`FEE`, and `Pin` of the solid's footage), `126`. |
+| The same name can be a list or a data chunk: `sspc` is a data chunk in a footage item (`<sspc bdata=.../>`) and a list in an effect instance (`<sspc>` with children). Whether an element has `bdata` decides. | `000` (footage), `071` (Slider Control). |
+| The three nested ids `tdsn`, `pdnm` and `fnam` are written like lists: an element with one child, the `Utf8` chunk. | `000` (`tdsn`), `071` (`pdnm`, `fnam`). |
+| A `Utf8` chunk is `<string>` with its text as content; an empty one is `<string/>`. The text is the chunk body exactly (no trimming). | `000` (`C`, `Solids`, the JSON strings of the colour settings, 19 empty ones), `010` (`Renamed`), `060` (`wiggle(1,10)`). |
+| Two numeric chunks are written as text, in a `<string>` child: `numS` (4 bytes, big-endian) as a decimal integer (only `0` is sampled, so whether it is signed is not decided; the reader accepts -2^31 to 2^32-1), and `ppSn` (8 bytes, an `f64`) with nine decimals (`150.000000000`, `0.000000000`). A `ppSn` value that is not a multiple of 10^-9 would be rounded by the XML form (no sample). | `000`, `124` (two compositions: two of each), all pairs. |
+| `LIST btdk` (the text document, raw text in the `.aep`, see 3.10) is written like a data chunk: `<btdk bdata=.../>`, the hex of the bytes after the list type. It is read back as an opaque list. | `110`-`114`, `243`-`248`, `334`-`340`. |
+| The footage alias `alas` (a JSON object in the `.aep`) is the element `<fileReference>` inside `<Als2>`, with one attribute per JSON key, in the same (alphabetical) order: `ascendcount_base`, `ascendcount_target`, `fullpath`, `platform`, `server_name`, `server_volume_name`, `target_is_folder`. The JSON writes the two counts as numbers, `platform` `Win` as `1` and `target_is_folder` `0` / `1` as `false` / `true`, and escapes a backslash of the path as `\\`. Rebuilt this way, the JSON equals the `.aep` body byte for byte. Other platforms and non-ASCII paths were not sampled. | `125`, `126`, `350`-`354` (`352`-`354`: an image sequence, `target_is_folder` `1`). |
+| The XMP packet that follows the container of an `.aep` is the CDATA content of `<ProjectXMPMetadata>`, a child of the root between the top-level `string` that follows `pdvc` and `<ExEn>`. It is not a chunk. | All pairs. |
+| Pad bytes are not written. An odd body gets a zero pad byte when the tree is written as an `.aep`, which is what every `.aep` of the corpus has. | All pairs: the rewritten tree equals the `.aep` byte for byte. |
+| The only differences inside the container are save state: the save counter, a big-endian `u32` at byte 16 of `head`, is one higher in the `.aepx` (only byte 19 changes in 222 pairs; in `314` it carries from `0x000000ff` to `0x00000100`), and the XMP packet has one more history entry. | All pairs. |
+
+**What the XML form leaves out.** In the corpus, nothing: every chunk of every `.aep` has its
+element (the count per id agrees in all 223 pairs, apart from the `<string>` children of `numS` and
+`ppSn` and the renamed `alas`), and all 239 pairs of the current corpus read into the same chunk
+tree (the local test `every_corpus_pair_gives_the_same_chunk_tree`). The reader still tolerates an
+`.aepx` that lacks chunks: `elab`, `cmta` and `empd` are not read by the typed view, so a missing one
+changes nothing it decodes, and a missing `tdbs` cannot be told apart from a property at its default
+(the sparse rule of section 2): its value reads as the default. Elements that have no chunk
+counterpart (a name that is not 1 to 4 characters) are skipped with their content.
+
+### How the crate reads an `.aepx`
+
+- `read_aepx` returns the same `AepFile` as `parse`; `parse_any` picks the reader by content (a
+  `RIFX` header, or an optional byte order mark and white space followed by `<?xml` or
+  `<AfterEffectsProject`). Everything above the container (the typed view, the importer) works on
+  either form unchanged.
+- The XML reader is a small tokenizer for exactly this subset: elements, attributes, text, the five
+  predefined entities and character references, CDATA, comments and processing instructions. Text
+  is taken as written (no line-ending normalisation). A document type declaration is refused, so no
+  entity is ever expanded.
+- Input is untrusted: bad UTF-8, an unknown entity, an unclosed or mismatched tag, invalid or
+  odd-length hex, a number that does not parse or a second root element return `AepError::Xml`
+  with the byte offset. It runs without recursion; the nesting depth (`Limits::max_depth`) and the
+  element count (`Limits::max_chunks`) are bounded, and everything it allocates is bounded by the
+  size of the input.
+- Tests: `tests/aepx.rs` compares the five fixture pairs chunk by chunk and byte by byte, compares
+  the typed view of both forms, and runs truncated, bit-flipped, deeply nested and oversized
+  inputs; `crates/aep/tests/it/import/aepx.rs` imports both forms of each pair and expects the same
+  project and report. An ignored test runs the comparison over the whole local corpus.
+
+### Versions (`head`, `svap`) and files saved for 25.x and 24.x
+
+Evidence: 12 families of the corpus (`layers-comps`, `footage-precomp`, `masks`, `shapes`, `text`,
+`effects`, `3d`, `keyframes`, `markers`, `styles`, `settings-a`, `1200-lumetri`), each saved three
+ways by After Effects 2026 (26.2.1x2) in one session: a normal save (`-26`), File ▸ Save a Copy As
+25.x (`-25x`) and Save a Copy As 24.x (`-24x`), 36 files. All of them are copies made by 2026; no
+file written by After Effects 24 or 25 itself was examined, so nothing below says what those versions
+write on their own.
+
+| Fact | Evidence |
+|---|---|
+| `svap` (4 bytes, the first top-level chunk) is the version of the After Effects that **wrote** the file: `0f 11 0e 02` in all 36 (a down-saved copy keeps the 2026 word) and in all 1 192 other `.aep` files of the local corpus folders. After Effects opens a file without `svap` (`t-nosvap`). | All 36; corpus scan. |
+| `head` bytes 4 to 7 are the version the file is **written for**: `0f 11 0e 02` (= `svap`) in the 2026 saves, `0f 0b 06 61` in the 25.x copies, `0f 03 06 41` in the 24.x copies, the same word in every family. After Effects refuses a file whose word is zero ("created with an older version [0.0x0]", `u-zhead`). | All 36; `u-zhead`. |
+| The word is packed (bit 31 first): bits 25-24 and 21-19 the major, 18-15 the minor, 14-11 the bug-fix, 10-8 a stage (6 in all), 7-0 the build; bits 31-26 (`000011`) and 23-22 (`00`) are the same in all samples and not decoded. `0f110e02` = **26.2.1x2**, which is what the saving After Effects reports for itself (`app.version` recorded by the corpus scripts) - this one sample fixes minor, bug-fix and build. The copies read as **25.6.0x97** and **24.6.0x65** (major **V** from three consecutive majors; minor, bug-fix and build of the copies **E**: one other word decides their positions). `effectcraft_aep::AeVersion`, `AepFile::file_version`, `AepFile::saved_by_version`. | Tests `decodes_the_sampled_words`, `the_container_of_a_copy_states_its_version_in_head_and_the_writer_in_svap`. |
+| `head` bytes 0 to 1 (a `u16`) step with the major: 97 (`0x61`) in the 2026 saves, 96 in 25.x, 95 in 24.x; bytes 2 to 3 are 5, 9 and 6 (**?**). Bytes 8 to 15 differ between families, not between versions; bytes 16 to 19 are the save counter (one higher in each copy). Nothing is derived from bytes 0 to 3 (`AepFile::head_revision` exposes the `u16`). | All 36. |
+| The XMP packet after the container is no guide: its `CreatorTool` is "Adobe After Effects 2026" in the copies too. | All 36. |
+| **26 against 25.x** (per family, chunk tree aligned by item and layer id): besides `head`, `nhed` / `nnhd` differ in 6 bytes (`nhed` 20-23 and 26-27: `827fa930` / `0015` in the 2026 save, `00000000` / `011b` in both copies; session state, see section 4). Every **solid's** `Pin /CLRS` changes: the 2026 save has `dcui` (1 byte, 1), `apid` all `0xff` and an empty `Utf8`; the copies drop `dcui`, set `apid` to a GUID (`601e9973...`, the same in all) and embed a 935-byte JSON with an ICC profile (`baseColorProfile/colorProfileData`). A **footage** item that the 2026 save stores with an assigned profile (`mcsp` = 1 and a profile JSON) loses `mcsp` and that JSON in the copies, and its `epid` becomes all `0xff`. The rest is save noise: the footage alias `ascendcount_base` (the copies were saved in another folder), `sspc` byte 112 of a footage item (a modification time), the `oEXR` `opti` of an EXR item (the copies hold the display device name `\.\DISPLAY1` as UTF-16 at byte 126 and, in the 24.x copy, a few non-zero bytes from byte 2 102 that look like uninitialised memory; the 2026 save has zeros), the plug-ins' sequence data `sdat` of Lumetri Color (16 instances and the project's `EfdG`), the mask counter `mkif` byte 8. No chunk is added or reordered, and no `pard`, `cdat`, `ldta`, `cdta`, `tdb4`, keyframe, text or shape chunk differs. | All 12 families. |
+| **25.x against 24.x**: only `head` (bytes 1, 3, 5 and 7), and the session noise in `opti` and `sdat` above. | All 12 families. |
+| Lumetri Color in the copies has the parameter definitions (`pard`, valid ranges included) of the 2026 plug-in, byte for byte. | `1200-lumetri`. |
+
+The importer reads none of the chunks that change (it reads the solid colour from `opti`, not
+`CLRS`), so the copies import to the same project and report as the 2026 save
+([aep-import.md](aep-import.md), "What is reported"; test
+`copies_saved_as_25x_and_24x_import_like_the_2026_file`).
+
+## 2. Typed view (`Project`, `Item`, `Comp`, `Layer`, `PropGroup`, `Property`, `KeyList`)
+
+The structure the typed view is built on; each row has a test in `crates/aep/tests/it/container/typed.rs` against
+the values the cases were made with. The field layouts that build on it (layer and composition
+headers, values with their units, keyframes, effects, masks, shapes, text, markers, cameras,
+lights, footage) are in section 3. Everything else is reachable as raw chunks.
+
+| Fact | Evidence |
+|---|---|
+| Project items are `LIST Item` children of the top-level `LIST Fold`; a folder holds its children in a nested `LIST Sfdr`. | `000`: composition `C` and folder `Solids` at the top, the solid's footage item inside `Solids`. |
+| The item kind is the first big-endian `u16` of `idta`: 1 folder, 4 composition, 7 footage. | `000` (`C`, `Solids`, the solid `L`); `001` has no composition. |
+| The item name is the item's `Utf8` child (empty for a solid's footage item). | `000` (`C`, `Solids`), `036` (comp renamed: the `Utf8` grows from 1 to 12 bytes, `Renamed Comp`). |
+| A composition item has a `cdta` whose `u32` at byte 4 is the frame duration and the `u32` at byte 8 the timescale: `fps = timescale / frame_duration` (25 fps: 1024 and 25 600; 29.97 fps: 800 and 23 976). Keyframe times are in these units. | `000`, `031` (30 fps: 1024, 30 720), `229`, `230`; `055` (key at 2.5 s = 64 000 units). |
+| The layers of a composition are its `LIST Layr` children, top layer first. (The `DLay`, `SLay`, `CLay` and `SecL` lists next to them are not layers: their `ldta` names are `Default`, `Front`, `Left`, `Top`, `Back`, `Right`, `Bottom`, `Custom View 1` to `3` and `Markers`.) | `000` (one layer), `110` (text layer on top of `L`). |
+| The layer name is the `Utf8` child of the layer; it is empty while the layer shows its source's name (new solids, precomp layers, default-named cameras and lights). | `010` (`L` renamed: 0 to 7 bytes, `Renamed`), `110` (`T`), `211` (`S100` is the solid's name, not the layer's). |
+| The 3D layer switch is bit `0x04` of byte 38 of `ldta`. | `015` (only that byte changes from `00` to `04`; the 3D properties appear), `000`. |
+| A layer holds its property tree in a `LIST tdgp`. Inside a group, a `tdmn` chunk (the match name: ASCII, NUL padded to 40 bytes) precedes the list it names: `tdgp` (a group), `tdbs` (a property) or another list (`otst`, `om-s`, the effect instance `sspc`). A `tdmn` named `ADBE Group End` closes the group and names nothing. | `000` (`ADBE Transform Group`), `071` (`ADBE Effect Parade`, `ADBE Slider Control`), `240`. |
+| Properties are stored sparsely: a property at its default has no `tdbs` at all (the default depends on the layer and the composition). | `040`, `041`, `043`, `044`: each adds exactly one `tdmn` and one `tdbs` to `000`; `211`, `212` (new solids: Position absent, Anchor present only when changed); test `static_value_is_the_first_dims_doubles_of_cdat`. |
+| A property (`tdbs`) holds `tdsb`, `tdsn`, the 124-byte header `tdb4`, then the static value `cdat` or a keyframe `LIST list`. `tdb4` begins `db 99 00`; byte 3 is the number of components (Position 3, Scale 3, Opacity 1, Slider 1, colour 4); byte 68 is 1 exactly when the property has a `list`. | `040`, `041`, `043`; `050` (the `cdat` is replaced by a `list`, byte 68 goes 0 to 1); `055`; test `property_header_facts_hold_in_every_property_of_every_fixture`. |
+| The static value is the first `dims` big-endian doubles of `cdat`. Percent properties are stored as fractions: Scale 50 % is `0.5, 0.5, 1.0`, Opacity 25 % is `0.25`. | `040` (Position `100, 200, 0`), `041`, `043`, `071` (Slider `77`). |
+| A `LIST list` is `lhd3` (52 bytes, 13 `u32`) and `ldat`. Word 0 is `0x00d00bee`, word 2 the record count, word 4 the record size, words 8 to 12 are zero; `len(ldat) = count * record size`; a list without records has no `ldat`. In the keyframe lists of properties, word 3 is `ceil(count / 4)` and word 7 the count rounded up to a multiple of 4 (not in the empty `Gide` lists, and not in path lists, where they are allocation capacities). | The first four relations hold for every `list` of every fixture (test `list_header_facts_hold_in_every_list_of_every_fixture`); word 3 and 7 on the keyframe lists of `050` (1 record) and `055` (3 records of 128 bytes, capacity 4). |
+| A keyframe record starts with its time as a big-endian `i32` in the composition's time units (**layer time**). | `055` (0, 25 600, 64 000 for keys at 0 s, 1 s, 2.5 s), `058` (0 and 51 200 for keys at 0 s and 2 s). |
+
+## 3. Verified field layouts
+
+All integers are big-endian unless stated; offsets are byte offsets inside the chunk body; `f64`
+is an IEEE-754 double, `f32` a float. Chunk paths start at the project item; `Layr` is a real layer
+(`LIST Layr`), `tdgp[X]` is the `LIST tdgp` named `X` by the `tdmn` that precedes it. Each row lists
+the cases that decide it. A row marked V is asserted by a test that compares the decoded value with
+the value from the corpus manifest (test file in parentheses at the end of each table).
+
+### 3.1 Layer header (`Layr/ldta`, 164 bytes; the decoder needs the first 140)
+
+| Field | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|
+| id | 0 | u32 | layer id, unique in the project; parent links use it | 000 (`0x1b`), 022 | V |
+| quality | 5 | u8 | 2 = Best, 1 = Draft (other values are kept as `Other`; 0 on cameras and lights) | 000, 023 | V |
+| **stretch** | 8 / 108 | i32 / u32 | **time stretch as the exact ratio `@8 / @108`**: 1/1 = 100 %, 2/1 = 200 %, **1/2 = 50 %, 3/2 = 150 %; a reversed layer has a negative numerator: -1/1 = -100 %, -1/2 = -50 % (981-983: start at the later end, in / out relative in source time, so the absolute in point is the later one; keys count source time in the composition's time scale)**. In and out points stay unscaled; the keyframe time scale `tdb4@12` of every property of the layer is 25 600 x stretch for stretch >= 1 (51 200 at 200 %, 38 400 at 150 %) and stays 25 600 at 50 % | 000, 018, 316, 317 | V |
+| start | 12 / 16 | i32 / u32 | layer start time = num / den seconds; den = composition timescale (25 600), 1 in a layer made by the precomp operation | 000, 021 (12 800 / 25 600 = 0.5 s), 124 | V |
+| in point | 20 / 24 | i32 / u32 | **relative to the start**: absolute = start + in * stretch (the exact ratio above). **Fractional times are exact multiples of 1/25 600 s: 0.3333 s became 8 532/25 600 = 0.33328125 s, and setting the in point moved the out point with it (duration kept)** | 000, 019 (25 600 / 25 600 = 1 s), 021 (stays 0 while the layer starts at 0.5 s), 318 | V |
+| out point | 28 / 32 | i32 / u32 | same convention; 5 s = 128 000 / 25 600. **For footage layers the denominator is the footage time base, not 25 600: 48 000 / 48 000 for the 1 s audio layer (the sample rate), 3 / 30 for the three-frame image sequence (the frame rate); start and in point keep 25 600** | 000, 018 (stays 5 s, the layer ends at 10 s), 019 (6 s), 021 (5.5 s), 316, 317 (stays 5 s, ends at 2.5 s / 7.5 s), 318, 351, 353-354 | V |
+| name is user-set | 37 bit `0x01` | flag | clear while the layer shows its source's name (000, 124, new solids, default-named camera and light), set when named | 000, 010, 022, 110, 113, 124, 211 | V |
+| guide layer | 37 bit `0x02` | flag | | 026 | V |
+| adjustment layer | 38 bit `0x02` | flag | | 025 | V |
+| 3D layer | 38 bit `0x04` | flag | always set on cameras and lights | 015, 251 | V |
+| solo | 38 bit `0x08` | flag | | 014 | V |
+| auto-orient | 38 bit `0x40` | flag | orients towards the point of interest: set on two-node cameras (byte 38 is `0x44`) and on all lights, clear on a one-node camera (`0x04`) | 256 (`0x44`), 251 (`0x04`), 252, 254 | V |
+| null object | 38 bit `0x80` | flag | set on a layer created as a null | 022, 220 | V |
+| **video switch** | 39 bit `0x01` | flag | the eye icon (`enabled`); off gives byte 39 = `06` | 222 | V |
+| **audio switch** | 39 bit `0x02` | flag | `audioEnabled` (also changes on a solid); off gives `05` | 223 | V |
+| **effects switch** | 39 bit `0x04` | flag | `effectsActive`; off gives `03` | 224 | V |
+| motion blur | 39 bit `0x08` | flag | | 017 | V |
+| locked | 39 bit `0x20` | flag | | 013 | V |
+| shy | 39 bit `0x40` | flag | | 012 | V |
+| collapse transformations | 39 bit `0x80` | flag | continuously rasterize; set from creation on shape and text layers | 024, 238 | V |
+| source id | 40 | u32 | `idta@16` of the source item (solid, footage or comp); 0 for shape, text and camera layers, `0xffff_ffff` for lights | 000, 022, 124, 126, 252 | V |
+| label | 61 | u8 | label colour index (1 red, 5, 8 blue, 15, ...); a footage layer copies the label of its footage item (audio 7, image sequence 3) | 000 (1), 124 (15), 126 (5), 351 (7), 354 (3) | V |
+| name copy | 64..95 | ASCII, NUL padded | copy of the user-set name; empty while the layer is unnamed | 000 (empty), 010 (`Renamed`) | V |
+| **blend mode** | 99 | u8 | Normal 2, Add 4, Multiply 5, Screen 6, Overlay 7, Difference 26 (each case changes only this byte); set by name (906): Soft Light 8, Hard Light 9, Darken 10, Lighten 11, Exclusion 25, Color Dodge 27, Color Burn 28; by render (907: a script enum sweep wrote codes 2-34, each code rendered over a test image and matched one mode): Classic Difference 12, Hue 13, Saturation 14, Color 15, Luminosity 16, Stencil Alpha 17, Stencil Luma 18, Silhouette Alpha 19, Silhouette Luma 20, Linear Dodge 29, Linear Burn 30, Linear Light 31, Vivid Light 32, Pin Light 33, Hard Mix 34; 23 / 24 render as Color Dodge / Burn there (taken as the classic variants, E); 3 is written for Dissolve and Dancing Dissolve; 21 / 22 are Alpha Add / Luminescent Premul (not told apart). The reader keeps every code beyond the first six raw | 000, 016, 225-228, 906, 907 | V (6 + 22), E (23, 24) |
+| layer type | 128 | u32 | 0 AV (solid, footage, precomp, null), 1 light, 2 camera, 3 text, 4 shape | AV: 000, 022, 126; text: 110, 113, 243; shape: 238-242; camera: 251, 253, 256; light: 252, 254 | V |
+| parent id | 132 | u32 | 0 = no parent | 000, 022 (L gets the id of the new null layer) | V |
+| **light type** | 136 | u32 | 1 = spot, 2 = point (0 on every other layer); parallel and ambient were not sampled and are kept raw | 252, 254 | V |
+| **track matte mode** | 107 | u8 | 0 = none, 1 = alpha, 2 = alpha inverted, 3 = luma, 4 = luma inverted; bytes 104..106 are 0 in every file. Setting a matte changes only this byte and the matte layer id on the target layer, and turns the matte layer's video switch off (byte 39 `07` -> `06`) | 402-408 | V |
+| **track matte layer** | 160 | u32 | the id (byte 0) of the matte layer, anywhere in the composition: `0x1d` (`M`, above) in 403-406 and 408, `0x1b` (`L`, below its target) in 407; 0 without a matte. A mode with id 0 has no case (After Effects 2026 writes the id; before 23.0 the matte was always the layer directly above) | 403-408 | V |
+
+API: `LayerHeader` (`is_video_enabled`/`is_enabled`, `is_audio_enabled`, `is_effects_enabled`,
+`is_auto_oriented`, `light_type`, `blend_mode`, `stretch` / `stretch_den`, `stretch_ratio`,
+`stretch_percent`, `in_point`, `out_point`); the same switches on `Layer`; `Layer::track_matte`
+(`TrackMatte`, `MatteMode`; test `tests/matte.rs`). `stretch` is now the
+numerator of the ratio (it was the whole multiplier before 50 % and 150 % were sampled). Tests:
+`tests/header.rs`, `tests/layer_switches.rs`. The layer name itself is the `Utf8` child of the
+`Layr` (empty while the name is the source's); the layer then shows the name of its source item
+(`Project::layer_display_name`).
+
+### 3.2 Composition header (`Item/cdta`, 204 bytes; the decoder needs the first 176) and renderer
+
+| Field | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|
+| frame duration | 4 | u32 | time units per frame: 1024 at 25 and 30 fps, **800 at 29.97 fps, 1000 at 23.976 fps** | 000, 031, 229, 230 | V |
+| timescale | 8 | u32 | time units per second: 25 600 at 25 fps, 30 720 at 30 fps, **23 976 at 29.97 and 23.976 fps**; fps = timescale / frame duration exactly as typed (29.97 is `23976 / 800`, not `30000 / 1001`) | 000, 031, 229, 230 | V |
+| work area start | 28 | u32 | in time units | 035 (25 600 = 1 s) | V |
+| work area end | 36 | u32 | start + duration in time units; `0xffff_ffff` = the whole composition | 000, 035 (76 800 = 3 s) | V |
+| duration | 44 | u32 | in time units. **A duration is snapped to whole frames: 5 s at 29.97 fps is 120 000 units = 150 frames = 5.005005 s, at 23.976 fps 120 frames** | 000, 031, 032 (256 000), 229, 230 | V |
+| background | 52..54 | u8 R, G, B | **8 bits per channel**: 0.5 is stored as 128 and reads back as 128/255 = 0.50196 | 000, 033, 231 | V |
+| motion blur | 139 bit `0x08` | flag | the composition's switch | 038 | V |
+| width, height | 140, 142 | u16, u16 | | 000, 030 (1280 x 720) | V |
+| pixel aspect | 144 / 148 | u32 / u32 | numerator / denominator; **0.9091 is stored as the exact ratio 10 / 11 (read-back 0.90909090909091)** | 000 (1 / 1), 037 (2 / 1), 325 (10 / 11) | V |
+| frame rate | 156 | u32 | 16.16 fixed point of the float32 rate (25 = `0x0019_0000`, 29.97 = 1 964 114 = 29.9700012, 23.976 = 1 571 291) | 000, 031, 229, 230 | V |
+| shutter angle | 172 | u32 | degrees | 000 (180), 034 (90) | V |
+| **shutter phase** | 180 | i32 | degrees: 0 by default, -90 = `ffffffa6`; the shutter angle at 172 does not change | 000, 326 | V |
+| **display start** | 164 / 168 | u32 / u32 | the comp start timecode as `num / den` seconds: 0 by default; display start frame 100 at 25 fps is 102 400 / 25 600 = 4 s (the denominator is the timescale; at other frame rates it was not sampled) | 000, 327 | V (one sample) |
+| renderer | `LIST PRin` / `prin` 4 | 32 ASCII | match name: `ADBE Escher` in the base, `ADBE Calder` in 039 | 000, 039 | V |
+| renderer name | `prin` 52 | 32 ASCII | display name: `Classic 3D`, `Advanced 3D` | 000, 039 | V |
+| composition name | `Item/Utf8` | text | | 000 (`C`), 124 (`Pre`) | V |
+
+The inert `ADBE Time Remapping` record of every AV layer has `tduM` = the source's duration in seconds: 5 for 5 s compositions (124, 257, 258), 3 and 2 for a 3 s and a 2 s composition (600, 601), 1 for the 1 s WAV (351), 0.1 for the three-frame sequence (353), 0 on solids and stills (000, 126). Every property's keyframe time scale (`tdb4` bytes 12 to 15) follows the composition (23 976 in every
+property of `L` after 229 and 230). The corpus manifest calls the classic renderer
+`ADBE Advanced 3d`; the file stores `ADBE Escher` / `Classic 3D`. API: `CompHeader::frame_rate_exact`
+(exact fraction), `duration_frames`, `shutter_phase`, `display_start`, `display_start_seconds`,
+`display_start_frame`. Tests: `tests/header.rs`, `tests/layer_switches.rs`.
+
+### 3.3 Items, footage and precomps
+
+| Field | Chunk path | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|---|
+| item kind | `Item/idta` | 0 | u16 | 1 folder, 4 composition, 7 footage | 000 | V |
+| item id | `Item/idta` | 16 | u32 | what a layer's source id refers to (`iide` holds the same number little-endian) | 000 (`0x1a` solid, `0x0d` comp), 022, 124 | V |
+| item label | `Item/idta` | 58 | u8 | label colour of the item | 000 (1 solid), 124 (15 for `Pre`) | V |
+| used comp | `Item/idpi` | 0 | u32 **little-endian** | a composition that uses another as a precomp layer gets one `idpi` per used composition | 124 (`C` uses `Pre`) | V |
+| used comp count | `Item/idpc` | 0 | u32 little-endian | the number of `idpi` chunks: one per distinct composition shown (the same one twice counts once); the order of the `idpi` carries no meaning (an After Effects re-save reverses it) | 124, 257, 258, 600, 602 (1), 601 (2) | V |
+| footage type tag | `Pin /sspc` | 22 | 4 ASCII | `Soli` for a solid, `png!` for a png | 000, 126 | V |
+| footage size | `Pin /sspc` | 30, 34 | u32, u32 | width, height in pixels | 000 (1920 x 1080), 022 (100 x 100 null), 126 (8 x 8), 211, 212, 259 | V |
+| footage name | `Pin /opti` | 26 (solid), 58 (file) | ASCII, NUL terminated | the item's own `Utf8` name is empty for footage | 000 (`L`), 022 (`Null 1`), 126 (`test8x8.png`), 211 (`S100`), 259 (`Blue`) | V |
+| **solid colour** | `Pin /opti` | 10, 14, 18, 22 | 4 x f32 | ARGB, 0..1: red [1, 0, 0] is `1, 1, 0, 0`, blue [0, 0, 1] is `1, 0, 0, 1` | 000, 259 | V |
+| file path | `Pin /Als2/alas` | key `fullpath` | JSON string | alias JSON of a file footage item | 126 (the fixture holds a neutral path) | V |
+| precomp linkage | `Layr/ldta` | 40 | u32 | the layer's source id is the id of the precomp's item | 124 | V |
+
+Footage items beyond solids and stills (`Pin /sspc`, 222 bytes; audio and image sequences, batch 3):
+
+| Field | `sspc` offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|
+| file type tag | 22 | 4 ASCII | `png!`, `Soli`, **`WAVE`**; `TPIC` Targa (650), `8BPS` Photoshop (651), `TEXT` for both an Illustrator / PDF file (652) and an EPS (653); all four stills store the duration 0 / 600 | 126, 000, 350, 650-653 | V |
+| width, height | 30, 34 | u32, u32 | 0 / 0 for audio; 64 x 64 for the sequence | 350, 352 | V |
+| **duration** | 38 / 42 | u32 / u32 | seconds as `num / den`, unreduced: still 0/1, **WAV 48 000/48 000 (the sample rate is the denominator), image sequence 3/30 (the frame rate is the denominator)** | 126, 350, 352 | V |
+| native frame rate | 56 | u32 | 30 for the sequence, 0 for stills, audio and solids | 126, 352 | V |
+| frame rate (again) | 150 | u32 (unaligned) | the same rate as @56 for sequences and clips: 30 (353, 603), 25 (606, 612); 0 for stills and audio. Conforming a sequence to 25 fps (615 against its reference 614) changes @42 (the duration denominator), @56 and @150 from 30 to 25 together; for clips see @146 | 353, 603, 606, 612, 614, 615 | V |
+| conformed rate of a clip | 146 | u32 (unaligned) | the rate a clip is conformed to (Interpret Footage), 0 when not conformed; the effective rate is then also at @150, while @38 / @42 (the duration in native frames over the native rate) and @56 stay native: the 25 fps 25-frame mp4 conformed to 30 stores 25 / 25, @56 25, @146 30, @150 30 (645 against 644), the layer's Time Remapping maximum becomes 25 / 30 s. A conformed image sequence keeps @146 at 0 and stores the new rate at @42, @56 and @150 (615) | 615, 644, 645 | V |
+| bits per pixel | 60 | u32 | RGBA still 32, RGB sequence 24, 0 for solids and audio | 126, 352 | V |
+| **sample rate** | 160 | f64 | 48 000.0 for the WAV; the same for an mp4 with sound (48 000.0 and 44 100.0 read back from AAC tracks of those rates), absent for an mp4 without (the importer takes a clip's audio from it) | 350, read-back vid-audio | V |
+| **file size** | 208 | u32 | bytes of the source file(s): png 149, WAV 96 044 (44 + 48 000 x 2), three png of 168 bytes 504 | 126, 350, 352 | V |
+| **sequence numbering** | 172, 176, 180 | u32 x 3 | first and last frame number and the digits of a sequence: 1, 3, 3 for `seq_001.png`..`seq_003.png` (353), 101, 103, 4 for `shot_0101.exr`..`shot_0103.exr` (603); 0 for single files (604, 605, 607). The name around the number is the pair of `Utf8` chunks between `Als2` and `opti` in `Pin ` (`seq_` / `.png`, `shot_` / `.exr`), absent on single files. **An empty prefix is not written**: `0001.png`..`0005.png` leave one `Utf8` (`.png`) there, so a single `Utf8` is the prefix when the first file name in `opti` (byte 58: `0001.png`) starts with it and the suffix when it ends with it; without that evidence the reader takes one starting with `.` as the suffix and reads nothing else. `Item::sequence_info`, `SequenceInfo::file_name` | 353, 603, 604, 605, 607; the prefix-less sequence of issue 3174 (After Effects 25.2) | V |
+| **sequence file list** (Force alphabetical order) | `Pin /LIST StVc` | `StVS` (4 bytes, `u32` LE), then `Utf8` x count | a sequence imported with Force alphabetical order has, between `Als2` and `opti`, a `LIST StVc` instead of the prefix and suffix `Utf8`s: `StVS` holds the file count as a **little-endian** `u32` (`05 00 00 00`), followed by one `Utf8` per file name in order (`shot_0001.png`..`shot_0005.png`). The numbering at @172 / @176 is then `0xFFFFFFFF` and the digits @180 0; duration and rate are stored as for a numbered sequence (5/30, 30). The list replaces the numbering; a list without a readable `StVS` count, or with a name that is not a plain file name (`/`, `\`, `:`, a control character such as NUL, `.`, `..`), is not read. Without a stored item name the importer names the item after its first listed file (an assumption: what After Effects shows was not sampled). `SequenceInfo::files`, `SequenceInfo::nth_file_name` | the alphabetical sequence of issue 3174 (After Effects 25.2) | V |
+| **sequence folder time** | 118 | u32 (unaligned) | seconds since 1904-01-01 UTC: the modification time of a sequence's folder when After Effects scanned it (860: 0xe6fb443a = 2026-10-19 03:51:22, the folder's and its files' time). With the folder's time After Effects keeps the stored numbering on open; with another (an older time, the first or the last file's time while the folder's differs: x1, x2 against x3) it scans the folder again and warns about a gap in a modal dialog | 860, `export-tests\sparse860\exp` x1-x3 | V |
+| still duration denominator | 42 | u32 | 1 for png (126, 607), 600 for jpeg (605), 100 for OpenEXR (604): a still's duration is 0 over a per-format denominator | 126, 604, 605, 607 | V |
+
+An **image sequence is ONE item** (`opti` holds the first file name `seq_001.png` at 58, 322 bytes like
+a still, with the width and height at 20 and 24 and the PNG colour type at 36); its alias JSON points
+at the sequence **folder** (`"target_is_folder":true`, `ascendcount_target` 2). The audio item has its
+name in the item's `Utf8` (`test-tone.wav`), label 7 (sequence 3, still 5); its `opti` has no display
+name. A footage layer shows the item's name while it has no name of its own (351, 354).
+
+Test: `tests/header.rs` (precomp), `tests/text_markers_footage.rs` and `tests/batch3_objects.rs`
+(footage), `tests/layer_switches.rs` (solid colour). API: `Footage::{duration, native_frame_rate,
+bits_per_pixel, file_size, audio_sample_rate, is_sequence, sequence_frame_count}`.
+
+### 3.4 Properties: sparse storage, static values and units
+
+A layer's property tree contains a `tdbs` only for a property whose value differs from the default
+that After Effects computes for the layer and composition. A reader supplies the defaults:
+
+| Property (match name) | Stored | Unit in the API | Default when absent | Evidence | Conf. |
+|---|---|---|---|---|---|
+| `ADBE Position` | f64 x, y, z | pixels | the composition centre `[width / 2, height / 2, 0]` | 000, 040 (`100, 200, 0`), 030 (the comp becomes 1280 x 720, L stays 1920 x 1080: `960, 540, 0` is now stored), 211, 212 (absent on new solids) | V |
+| `ADBE Anchor Point` | f64 x, y as a **fraction of the layer's source size**, z in pixels | px = fraction * source size | `0.5, 0.5, 0` (the layer centre) | 044 (`10, 20` px on 1920 x 1080 is `10/1920, 20/1080`), **211 (100 x 100 solid: `10, 20` is stored `0.1, 0.2`), 212 (400 x 300 solid: `100, 50` is stored `0.25, 1/6`)**: the composition size is not the divisor | V |
+| `ADBE Anchor Point` of a **text** layer | f64 x, y, z (a text layer has no source) | pixels, as stored | `0, 0, 0` (the text origin) | absent in every other text sample (110-114, 243-248, 334-340, 386); **385 (text anchor set to `10, 20`) stores `10, 20, 0` as f64 pixels**, not a fraction of a size; test `a_stored_text_anchor_is_pixels` | V |
+| `ADBE Scale` | f64 fractions | percent (fraction * 100) | 100 % | 000, 041 (`0.5, 0.5, 1.0`) | V |
+| `ADBE Rotate Z` | f64 degrees | degrees | 0 | 000, 042 | V |
+| `ADBE Opacity` | f64 fraction | percent (fraction * 100) | 100 % | 000, 043 (`0.25`) | V |
+| mask feather | f64 x, y | pixels | `[0, 0]` | 090, 091 (`20, 20`), 208 | V |
+| mask opacity | f64 fraction | percent | 100 % | 090, 091 (`0.5`) | V |
+| mask expansion `ADBE Mask Offset` | f64 | pixels | 0 | 090, 091 (5) | V |
+| effect slider | f64 | as set | the `pard` default | 071 (77) | V |
+| effect colour | 4 x f64, ARGB 0..255 | ARGB fractions | the `pard` default | 073 (`[0.2, 0.6, 1]` is `255, 51, 153, 255`) | V |
+| shape stroke width, round corners radius, light intensity | f64 | as set (pixels, pixels, percent) | not decoded as defaults except the light (100) | 239 (8), 238 (20), 254 (50) | V |
+| shape group position, gradient start and end | f64 x, y | pixels | group position `[0, 0]` | 242, 241 | V |
+| camera Position, point of interest | f64 x, y, z | pixels | see 3.12 | 251, 253, 256 | V |
+| camera Zoom, light colour, cone angle, cone feather | f64 / ARGB 0..255 | pixels, `[A, R, G, B]` fractions, degrees, percent | Zoom 2 666.67 (1920 px comp), colour white, cone angle 90, cone feather 50 | 341, 343-345 | V |
+
+`Project::layer_anchor_px` multiplies the anchor fraction by the size of the layer's source (a
+solid or footage item, or the composition of a precomp). `Transform::text_anchor_px` gives the
+anchor of a text layer (pixels as stored, `[0, 0, 0]` when absent).
+
+**Explicit defaults (batch 3).** A value record exists exactly when the value differs from the
+default; setting a value to its default never creates a record and setting it back removes it. A
+Gaussian Blur read back as Blurriness **25** when added (the corpus manifest's "0" for rows 214 and
+216 was wrong, with a correction note in the manifest); Blurriness set to 0 writes a record, 25 -> 40 -> 25
+leaves the effect subtree byte-identical to the never-touched default (300, 301, and 214 / 078).
+The same holds for Fill Opacity 1 -> 1 and 1 -> 0.5 -> 1 (302, 303) and Slider 0 -> 0 (304), and
+for the five transform properties set to the value they already had (Position, Opacity, Anchor,
+Scale, Rotation, 311-315: the layer tree is byte-identical to the unedited save 299). A writer may
+therefore rely on "absent = default" and drop a record that equals the default. Exceptions are
+records AE materialises together with a type switch (polygon, radial gradient: 3.9).
+`EffectParam::is_default` returns this; `Tracked::source` tells `Default` from `Stored`.
+
+**Time Remapping (batch 3).** Every layer has an inert `ADBE Time Remapping` property at the root of
+its tree (`tdsb` 3, static value 0, no keys). Enabling the remap turns it into a keyed property
+(`tdsb` 1, `tdb4` byte 5 bit 0 cleared, byte 68 = 1, no `cdat`) with two plain 48-byte keys whose value
+(seconds) is at byte 8: 0 s -> 0 and 5 s -> 5 on a precomp layer (319), 0 s -> 0 and 0.1 s -> 0.1 on an
+image-sequence layer (354). It cannot be enabled on a solid. API: `Layer::time_remap` (`TimeRemap`,
+`TimeRemapKey`).
+
+Property record (`LIST tdbs`: `tdsb`, `tdsn`, `tdb4`, then `cdat` or a `LIST list`, optionally a
+`Utf8` expression, `tdum`, `tduM`):
+
+| Field | Chunk path | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|---|
+| magic | `tdb4` | 0..2 | `db 99 00` | every property | all fixtures | V |
+| components | `tdb4` | 3 | u8 | values in `cdat` / in each key (1, 2, 3, 4 = ARGB) | 040, 041, 043, 073, 091, 206, 208, 210 | V |
+| static flag | `tdb4` | 5 bit 0 | flag | set while the property has no keys (Position: 15 static; the bit is clear on an animated property) | 040, 055, 058 | V |
+| **template flag** | `tdb4` | 7 | u8 | 0 = plain keyframe template, non-zero = spatial template (3 on Position, 1 on colours and paths) | 204-206, 208, 210 | V |
+| time scale | `tdb4` | 12 | u32 | units per second of the keyframe times (25 600; 30 720 at 30 fps; 23 976 at 29.97 and 23.976 fps) | 055, 058, 122, 229, 230 | V |
+| has keys | `tdb4` | 68 | u8 | 1 exactly when the property has a `LIST list` | every fixture (test) | V |
+| keyed spatial-template flag | `tdb4` | 79 | u8 | 1 on a static colour or point effect value, 0 once it is keyed (359 / 364, 369 / 382); 0 on keyed and static sliders (362 / 363, 391 / 397); meaning **?** | 359, 362-364, 369, 382, 391, 397 | V (values) |
+| expression flags | `tdb4` | 76, 77, 120 | u8 | all three are 1 when an expression exists. 76 and 77 are also 1 on a camera's or light's computed (auto) Position, which has no expression | 060, 213, 251 | V |
+| **expression disabled** | `tdb4` | 119 | u8 | 1 = the expression is disabled; the text and bytes 76, 77, 120 stay. On the built-in view layers the byte flips by itself after the first save, so it counts only together with an expression | 060 (0), 213 (1) | V |
+| state | `tdsb` | 0 | u32 | 1 = written (non-default value, keys or expression), 3 = default state. **A layer, camera, light, shape or text property in the default state holds After Effects' default** or a value with no effect on that layer (survey of 839 corpus and sample files: Material Options, cone 90 / 50 and falloff 500 / 500 of point lights, Position `[0, 0, -1333.33]` of ambient and environment lights, Opacity 1 and Scale `[1, 1, 1]` of cameras and lights, a polygon's Inner Radius 50, Miter Limit 4, the inert Time Remap 0), so the importer skips it. **An effect parameter's record in the default state holds the effective value** (3.7, stored value) | 040, 071, 073 (1); 3 on the unwritten properties of 000; 1200, 1400 (effects) | V (1), E (3), V (effects) |
+| static value | `cdat` | 0 | `components` x f64 | the first `components` doubles are the value | 040, 041, 043, 071 | V |
+| user name | `tdsn/Utf8` | | text | `-_0_/-` means "no custom name" | 091 (`Mask 1`), 238 (`Group 1`) | V |
+
+Test: `tests/values.rs`, `tests/typed.rs`, `tests/keyframes.rs`.
+
+### 3.5 Keyframes (`tdbs/list`: `lhd3` + `ldat`)
+
+`lhd3` (13 `u32`): word 0 `0x00d0_0bee`, word 2 the record count, word 3 `ceil(count / 4)`, word 4
+the record size, word 7 the count rounded up to a multiple of 4, words 8 to 12 zero; `ldat` is
+exactly `count * record size` bytes (cases 050, 055; every list of every fixture). In path lists
+(record size 8) words 3 and 7 are allocation capacities in vertices and four times that (12 records:
+4 and 16; 9 records: 4 and 16 in the shape paths of 105 and 240, 3 and 12 in the open mask path 233),
+not a function of the count.
+
+**Record header (8 bytes, every kind).**
+
+| Field | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|
+| time | 0 | i32 | in the property's time scale; **layer time** (roving moved key 2 from 25 600 to 26 509 = 1.0355078125 s) | 055 (0, 25 600, 64 000), 056, 058 | V |
+| **interpolation in** | 4 | u8 | the incoming side: 1 = linear, 2 = bezier, 3 = hold | 202 (in linear, out hold: `01 03`), 203 (in hold, out linear: `03 01`), 204, 205, 052, 053 | V |
+| **interpolation out** | 5 | u8 | the outgoing side, same codes | same | V |
+| label | 6..7, bits 6..9 | u16 | keyframe label: label 9 turns the flags `0x0007` into `0x0247` | 057 | V |
+| roving | 6..7, bit `0x0020` | u16 | `0x0007` becomes `0x0027` | 056 | V |
+
+A hold key has no further field (the value is unchanged); a linear key has all ease slots 0. Keys
+added through the scripting interface are linear in and out.
+
+**The template follows the property header (`tdb4` bytes 3 and 7), not the record size.** With
+`n` components:
+
+| Template | `tdb4[7]` | Size | Used by | Evidence |
+|---|---|---|---|---|
+| plain | 0 | `8 + 40 n`: 48 (n=1), 88 (n=2), 128 (n=3) | Opacity, Rotation, Slider (1); Mask Feather, Rectangle Size (2); Scale (3) | 205, 206, 208, 221 |
+| spatial | non-zero | `56 + 24 n`: 128 (n=3), 152 (n=4) | Position (3), colours (4) | 204, 210 |
+| mask path | | 64 | the path property of an animated mask (the path itself is in `shap`) | 093 |
+| marker | | 16 | `mrst` marker times | 122, 123, 249 |
+
+A 128-byte record is a Scale key (plain, 3 components) or a Position key (spatial): a reader must
+look at the header (206 against 204). Layout of the plain template: value (`n` x `f64`) at 8, then
+`4 n` ease doubles in **type-major order**: `[in speed x n][in influence x n][out speed x n][out
+influence x n]`, starting at `8 + 8 n` (for `n = 1`: **at 16 in speed, at 24 in influence, at 32
+out speed, at 40 out influence**). Scale key 1 of 305 (`n = 3`, in 0 / 33 %, out 20 / 66 %) is
+`0,0,0, .33,.33,.33, .2,.2,.2, .66,.66,.66`; Mask Feather key 1 of 306 (`n = 2`, in 0 / 33, out
+15 / 66) is `0,0, .33,.33, 15,15, .66,.66`. Component `i` uses slot `i` of each block (**V** for the
+block layout and the units, Scale speed in fractions per second and Mask Feather speed in pixels
+per second; **E** that different values per dimension sit in the slot of their dimension, because
+the tool that made the corpus applies one ease to all dimensions; **V** since the exporter wrote three different eases for the three Scale dimensions and After Effects read the same three back, aep-export.md R13). `Keyframe::plain_ease_slots`
+returns the doubles as stored, `Keyframe::ease_component(i)` one component's `KeyEase`. Layout of
+the spatial template: `u32` at 8 (1 normally, 0 after the spatial auto-bezier and continuous
+switches were turned off together, 054), `f64` arc length of the segment to the next key at 16
+(100 in 204 key 1, 0 on the last key and right after creation; safe to ignore), **ease at 24 in
+speed, at 32 in influence, at 40 out speed, at 48 out influence**, value (`n` x `f64`) at 56, spatial
+in tangent (`n` x `f64`, relative offset from the value) at `56 + 8 n`, out tangent at `56 + 16 n`.
+
+| Field | Where | Meaning | Evidence | Conf. |
+|---|---|---|---|---|
+| ease, Position | spatial @24..55 | 204 key 1: in speed 5 / influence 0.2, out speed 50 / influence 0.8; key 2: in 7 / 0.6, out 9 / 0.4. Speed in pixels per second, influence a fraction. **After Effects reports key 1's in speed and the last key's out speed as 0, but the file keeps the requested values (5 and 9): ignore those two slots** | 204, 052 (preset: speed 0, influence 0.33) | V |
+| ease, Opacity | plain n=1 @16..47 | 205 key 1: in 0.05 / 0.2, out 0.2 / 0.8; key 2: in 0.3 / 0.6, out 0.09 / 0.4. Speed is in stored units per second, i.e. 100 times smaller than the percent per second shown in the UI; influence a fraction | 205 | V |
+| value, Scale | plain n=3 @8 | 206: `[1, 1, 1]` and `[2, 1.5, 1]` (fractions of the manifest percent) | 206 | V |
+| value, Rotation, Slider | plain n=1 @8 | degrees / as set (keyed slider 10 and 90) | 221 | V (slider), E (rotation, 207 is not a fixture) |
+| value, Mask Feather | plain n=2 @8 | pixels `[0, 0]` and `[40, 20]` | 208 | V |
+| value, colour | spatial n=4 @56 | ARGB doubles 0..255: `[255, 255, 0, 0]` and `[255, 0, 127.5, 255]`; flags `0x0001`, tangents zero; the project-level `EfdG` copy of the effect has the same list | 210 | V |
+| value, Position | spatial n=3 @56 | pixels | 055 (`[0,0,0]`, `[100,0,0]`, `[200,100,0]`), 056 | V |
+| tangents | spatial @`56+8n`, `56+16n` | 054: key 1 out `[30, 60, 0]`, key 2 in `[-30, -60, 0]` | 054 | V |
+| arc length | spatial @16 | 100 on key 1, 0 on key 2 | 204 | E |
+| **colour distance** | spatial n=4 @16 | for bezier colour keys the Euclidean ARGB distance to the next key, 255 sqrt(2) = 360.6245 for red to blue, 0 on the last key; linear colour keys have 0 (like the Position arc length, filled only for non-linear interpolation). The ease slots of a colour key are one entry (speed 0, influence 0) | 307 against 210 | V |
+| **keyed Orientation** | `otst`: `tdbs` key list of 80-byte records (time, interpolation sides, flags at 0..7; `f64` 2.0 at 16 on the first key; the rest 0 for linear keys) and `otky` with one `otda` (three `f64` degrees) per key, in the same order. **After Effects interpolates by a quaternion slerp of the rotation `Rx Ry Rz`**: 703 (keys `[0,0,0]` at 0 s, `[10,20,30]` at 2 s, linear) reads back 0.5 s `[3.434, 4.469, 7.713]`, 1 s `[6.264, 9.353, 15.219]`, 1.5 s `[8.465, 14.560, 22.610]`, which slerp with that order reproduces to 0.001 degree (not per-component: 5 / 10 / 15 at 1 s; the order `Rz Ry Rx` gives `[3.58, 10.64, 14.32]`) | 703 | V (layout, linear), H (ease of bezier keys) |
+| **light type** | `ldta` `u32` at 136: 0 parallel (701), 1 spot, 2 point, 3 ambient (702). A light created as an environment light by script without the Advanced 3D renderer is stored as ambient (704) | 701, 702, 704 | V |
+| **ease, Anchor Point and effect points** | spatial @24..55 | the value is a fraction of the layer size, and **a speed is pixels per second divided by the layer height**: out speed 50 is 50 / 1080 = 0.046296 on the 1920 x 1080 L (597 Anchor Point, 598 Gradient Ramp Start), 50 / 800 = 0.0625 on a 400 x 800 solid (730; not the width, not the smaller side, not the composition height); influence a fraction. After Effects reads 597 back as 0.5 s [1004.41, 562.21], 1 s [1084.84, 602.42], 1.5 s [1137.13, 628.57] | 597, 598, 730 | V |
+| **ease, colour switched to bezier** | spatial n=4 @24..55 | keyframe.set_interpolation bezier on two colour keys stores speed 0 and influence 0 on both sides, and After Effects interpolates them linearly (598 Start Color red to blue: 0.75 / 0.5 / 0.25 red at 0.5 / 1 / 1.5 s); a custom colour ease cannot be set by script | 598 | V |
+| **ease, mask path** | 64-byte record @24..55 | in speed, in influence, out speed, out influence as in the spatial template: 599 out / in influence 0.75, 700 0.2 / 0.5, speeds 0 (the path at 0.5 s is 5.42 % / 28.0 % of the way). The `f64` at 16 is 1 (093) or 2 (599, 700) on the first key and 0 on the last (not decoded) | 093, 599, 700 | V (influence), ? (speed unit) |
+
+API: `Keyframe::{interpolation_in, interpolation_out, kind, value, ease, ease_component, ease_components, plain_ease_slots, color_distance, spatial}`;
+`Property::keys()` hands the property's template to its records. Marker record (16 bytes): time,
+`03 03` hold bytes, 8 stale bytes. Mask path record (64 bytes): the common fields and the ease at byte 24 (599, 700). Test:
+`tests/values.rs`, `tests/keyframes.rs`.
+
+### 3.6 Expressions
+
+| Field | Chunk path | Meaning | Evidence | Conf. |
+|---|---|---|---|---|
+| source | `tdbs/Utf8`, after `cdat` / `list` and before `tdum` | raw UTF-8 text, no length prefix, no NUL, no engine tag | 060 (`wiggle(1,10)` on Opacity) | V |
+| flags | `tdb4` 76, 77, 120 | all 1 when present, all 0 otherwise | 060, 040 | V |
+| **disabled** | `tdb4` 119 | 1 when disabled (`expression.disable_all`); the only byte that differs between 060 and 213 | 060, 213 | V |
+| static value | `cdat` | kept while an expression exists (Opacity 1.0) | 060 | V |
+| **on an effect parameter** | the parameter's own value record, as on any property: Slider Control's Slider with `time*10` holds the text and the static value 0 | 534 | V |
+
+The expression engine is project-wide (`LIST ExEn/Utf8`, `javascript-1.0`). API:
+`Property::expression_enabled`. Test: `tests/keyframes.rs`.
+
+### 3.7 Effects (`tdgp[ADBE Effect Parade]/sspc`)
+
+| Field | Chunk path | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|---|
+| match name | the `tdmn` before the `sspc` | | text | `ADBE Slider Control`, `Pseudo/@@S1iPXtJFTHK4QaDbgJvLhw`, ... | 071, 073, 077, 080, 214 | V |
+| instance name | `sspc/fnam/Utf8` | | text | the effect's own name (`Slider Control`, `Tint`); it stays the same when the instance is renamed (610) | 071, 073, 077, 080, 610 | V |
+| **user name of an instance** | `sspc/tdgp/tdsn/Utf8` (the value group's name) | | text | `-_0_/-` (the placeholder every unnamed group has) while the instance shows the effect's name; the given name otherwise (610: `My Tint`, `fnam` still `Tint`). `Effect::user_name`, `Effect::display_name` | 356, 609, 610 | V |
+| **fx switch** | `sspc/tdgp/tdsb` (the value group's flags, `u32`) | | flag | 1 on, 0 switched off in the Effect Controls (`fx-switch.aep`: two Gaussian Blurs on one layer in one save, the first switched off, the second on; read back `enabled` false / true). `Effect::enabled` | fx-switch | V |
+| parameter count | `sspc/parT/parn` | 0 | u32 | including the implicit input layer and the built-in entry (3 for a slider) | 071 | V |
+| parameter match name | `parT/tdmn` | | text | `<effect match name>-NNNN`; the last is `ADBE Effect Built In Params` | 071 | V |
+| parameter type | `parT/pard` | 12 | u32 | 0 layer, 2 fixed slider (16.16), 3 angle, 4 checkbox, 5 colour, 6 point, 7 popup, 9 no data, 10 float slider, 12 path, **13 group start / 14 group end** (Exposure's Master, Red, Green and Blue twirl-downs; the end repeats the group's name; no value), **15 button** (Swap Colors of Tint and Gradient Ramp: empty name, label in `pdnm`) | 071, 073, 077, 080, 214, 215, 356, 368, 389 | V |
+| UI flags | `pard` | 4 | u32 | 0x20 greyed out, 0x08 on a group end. **Stale:** After Effects does not reset it on undo (391-397 keep the flags of 390 although Channels is back to Master), so it is UI state and never read for meaning | 389-397 | V (values), E (meaning) |
+| parameter name | `pard` | 16 | 32 ASCII | `Slider`, `Color`, `Menu`, `Blurriness`, `Shadow Color`, ... (empty for some checkboxes) | same | V |
+| **default** | `pard` | 56 | by type | float slider: f64 (Slider 0, **Blurriness 25**); fixed slider and angle: 16.16 (drop shadow opacity 127.5, direction 135, distance 5, softness 0; Fill opacity 1.0 = 100 %; **Tint Amount to Tint 100, Ramp Scatter 0, Blend With Original 0**); **colour: ARGB bytes (drop shadow `ff000000` black, Fill `ffff0000` red; Ramp Start `ff000000`, End `ffffffff`; Tint Map Black To `00000000` and Map White To `00ffffff`: alpha 0, which is what After Effects reads back)**; popup: u32 index (1); **point: two 16.16 fractions of the layer size at 56 and 60 (Point Control 0.5, 0.5; Ramp Start 0.5, 0 and End 0.5, 1)** | 071, 077, 080, 214, 215, 356, 368, 383 | V |
+| **valid maximum** | `pard` | 128 / 108 | 16.16 / f32 | the largest valid value of a fixed slider (128: Tint Amount 100, Ramp Scatter 512, Blend With Original **1.0**) and of a float slider (108: Blurriness 30 000; **Exposure 100, Offset 2, Gamma Correction 10**). The stored scale differs per slider (below), so this is the reader's only hint at it | 356, 368, 078, 389 | V |
+| **float slider valid minimum, slider range** | `pard` | 104; 112 / 116 | f32; f32 x 2 | the smallest valid value (Exposure -100, Offset -2, Gamma Correction 0.1 as f32) and the range the slider covers (Exposure -4..4, Offset -0.5..0.5, Gamma 0.1..10); the slider range is repeated as `tdum` / `tduM` (f64) in each value record (391-394). @120 holds the default again as f32 (Gamma 1.0, Blurriness 25), u16 @124 the display decimals (**H**: Exposure 2, Offset 4) | 389, 391-394 | V |
+| **definitions of a second instance** | top-level `LIST EfdG` | | | one `EfDf` per effect TYPE (`tdmn` = match name, then a copy of ONE instance's `sspc`, including that instance's value records); the `EfDC` count before them is a little-endian u32. When two layers carry the same effect type, only one instance keeps a full `parT`; **the other has an empty `LIST parT` (4 bytes)** but its own `tdgp` (input layer `-0000` with its own `tdpi`, the button record, and its value records). Its definitions come from the `EfdG` copy by match name, its values from its own records, never from the copy (383: the copy holds S100's Start [0.1, 0.2]; L's Ramp reads the 368 defaults). Which instance keeps the full `parT` is **?** (in 383 S100 is both first in the file and newest). The `EfDf` order follows the stack order (365 / 366); `Pefl/pjef` does not. **Some files have no `EfdG` at all** (seen in 17 projects, all from inside After Effects-made Motion Graphics templates). In each of them every effect type (196 in all; 2 to 14 Color Controls per file) has exactly one instance with a full `parT` and an empty one in every other instance, and the reader takes the others' definitions from that instance (`DefinitionSource::OtherInstance`, #3170). Which instance keeps it is **?** here too | 365, 366, 383; templates | V |
+| popup items | `parT/pdnm/Utf8` | | text | items separated by `\|` | 077 (`Item 1\|Item 2\|Item 3`), 214 | V |
+| stored value | `sspc/tdgp/<match>-NNNN` | | `tdbs` | present only for a parameter that differs from its default; `tdsb` 1, `cdat` as in 3.4. **Absent record = the `pard` default.** Some parameters are recorded in the default state (`tdsb` 3) and the record still holds the value After Effects uses: every one of the 25 such records in the corpus and the samples differs from its `pard` default and reads back as recorded (Lumetri Color's hidden controls High Dynamic Range, HDR Specular, the second Look, Legacy Tone And Saturation, Face Detection, Auto Color, Auto Intensity and SemanticAutoTone Progress, 1200; Cryptomatte's Selection Mode on, 1400). No effect record in the default state holds a value that does not count. The reader takes the value in either state (`EffectParam::recorded_value`, `EffectParam::value`); `EffectParam::stored_value` keeps to written records, and a record in any other state (no sample has one) is not read: the importer reports it as damaged data. That other effects record values so is H (no sample shows one) | see below; 1200, 1400 | V (1200, 1400), H (other effects) |
+
+Stored values by type (`tdsb` 1, or 3 as above):
+
+| Type | Stored | Evidence | Conf. |
+|---|---|---|---|
+| float slider | `cdat[0]` as set (Slider 77, Blurriness 40); a keyed slider has 48-byte plain records and no `cdat`. **The value is the float32 After Effects keeps, widened to f64: Offset 0.1 is `0.10000000149011612`, Gamma 2.2 is `2.200000047683716`** | 071, 216, 221, 393, 394, 397 | V |
+| **group start / end** | the record always exists (`tdsb` 1, `cdat` 0, descriptor `00010000`), `tdsn` = the group name; no value (scripting: NO_VALUE) | 389-397 | V |
+| **fixed slider** | `cdat[0]` as a plain double in the parameter's own scale: Tint Amount to Tint is a **percent** (0 -> 0.0, 37.5 -> 37.5; valid max 100), Gradient Ramp Scatter is **pixels** (12, 250.5; valid max 512), Blend With Original is a **0..1 fraction** (25 % -> 0.25, 100 % -> 1.0; valid max 1.0). Keyed: 48-byte plain records with the plain value (Amount 20 / 80) | 361-363, 378-381 | V |
+| colour | ARGB doubles 0..255 (Tint Map Black To [0.2, 0.4, 0.6] -> `[255, 51, 102, 153]`, float32 precision; Ramp Start Color red `[255, 255, 0, 0]`); keyed: 152-byte spatial records with the ARGB value at 56 (210 Fill, 364 Tint Map White To) | 073, 357, 371; keyed: 210, 364 | V |
+| **button** | the record always exists (`tdsb` 1, `cdat` 0, descriptor `00010000`) and carries no value (scripting: NO_VALUE). An exception to the sparse rule, like the Layer Control record | 356-383 | V |
+| **popup (built-in)** | 1-based index as a double: Ramp Shape Radial = `2.0`; the selection is also written to `pard` @56 (only byte 59 changes, as for the dropdown 324). Default Linear = 1, item count u16 @60 = 2, `pdnm` `Linear Ramp\|Radial Ramp` | 368, 377 | V |
+| **checkbox** | `cdat[0] = 1.0` when on, `0.0` when off; **the default is the `u32` at `pard` byte 56** (0 off: Checkbox Control 217, Shadow Only 420, Bypass 389; **1 on: Repeat Edge Pixels of Fast Box Blur and Gaussian Blur, read back 1 in 412 and 417**), and a record exists only when the value differs from it (416 and 419 switch Repeat Edge Pixels off: a record with 0.0, descriptor `00010004`). The corpus manifest's "off" for the Gaussian Blur of 214 was wrong. Exposure's Bypass Linear Light Conversion has an empty `pard` name and its label in `pdnm` (like the buttons) | 217, 389, 396, 412, 416, 417, 419, 420, 426 | V |
+| **integer slider** (type 1) | Fast Box Blur's Iterations: default `i32` at `pard` 56 (3), valid maximum `i32` at 128 (50), the value record a plain double (1.0 for 1) with `tdum` / `tduM` 1 / 5 (the slider range) | 412, 414 | V |
+| **arbitrary data** (type 11) | the value record is a 4-byte `cdat` 0 followed by a `LIST aRbs` holding the data (`aRbp`); `parT` has the default `aRbp` after the `pard`. Hue/Saturation's Master Hue, Saturation, Lightness and Levels' Input / Output Black and White and Gamma are NOT in their visible parameters (which keep no record) but in this data; see below | 443-446, 511-516 | V |
+| **point** | two doubles, a **fraction of the layer size** (`tdb4@24` = the layer's width / height: 16 / 9 in 369, 374, 218, 1 on the 100 x 100 solid of 383; `@16` = 6.25e-12 in all): `[111, 222]` is `[111/1920, 222/1080]` (`tdb4[3]` = 2, `[5]` = 15). **The default is two 16.16 fractions 0.5 in `pard` @56 and @60, relative to the layer: a Point Control on a 100x100 solid reads back [50, 50]**. Gradient Ramp Start / End are stored the same way; values outside the layer give fractions outside 0..1 (`[2000, -100]` -> `[1.0417, -0.0926]`); on a 100x100 solid `[10, 20]` is `[0.1, 0.2]`. **Keyed: 104-byte spatial records (56 + 24 x 2), flags `0x0007`, `u32@8` = 1, the two fractions at 56, tangents zero**; `f64@16` holds a derived distance on linear keys too (1.7397 in 382: ignore it) | 218, 310, 369, 374, 382, 383 | V |
+| **angle** | plain degrees: 90 is `90.0` | 219 | V |
+| **layer control** | the `-0001` record always exists (`cdat` 0); the sibling `tdpi` (u32) is the **id of the chosen layer** (the new Null, `0x22`). **The default ("Layer 1" on the first layer) and an explicit 1 are the owning layer's own id (320); "None" is `tdpi` 0 (321).** The manifest's "None" for the default (076, 220 rows) was wrong. In the implicit first parameter `tdpi` is the id of the layer that owns the effect | 220, 320, 321 | V |
+| **layer parameter** (any effect) | as the Layer Control: the `-NNNN` record always exists with `cdat` 0 and `tdpi` = the id of the chosen layer (Set Matte, Displacement Map, Compound Blur set to the layer below: `tdpi` 340 / 354 / 368 = that layer's id); the effect's implicit `-0000` record holds the owning layer's id | 904, 905 | V |
+| **dropdown** | the items are in `pdnm` (`Alpha\|Beta\|...`), `pard` u16 @60 is the item count (5), `pard` @56 the selection (1 by default). Selecting item 3 adds a value record (`cdat[0]` = 3.0, descriptor `00010004`) AND writes 3 into `pard` @56. Setting the items re-creates the effect definition under a new match name (`Pseudo/@@KbKT0rCPQi2A0ytuyGLWSw`; display name `Dropdown Menu Control`) | 077, 323, 324 | V |
+
+The default of Gaussian Blur: the default-only file is byte-identical to the one with Blurriness 25
+and has no value record; `pard` holds 25 (f64 @56 and f32 @120); setting 40 adds a record and leaves
+`pard` at 25, so `pard@56` is the default and not the current value (a popup selection is the one
+exception, it overwrites `pard@56`). The corpus manifest's default of 0 was wrong: After Effects
+reads a fresh Gaussian Blur as 25 (300, **V**; the conflict is resolved).
+
+Because a popup selection overwrites `pard@56`, a popup whose definition comes from the `EfdG` copy
+has no reliable default in the file (the slot holds the copied instance's selection); the reader
+returns no default for it (`EffectParam::pard_default` is `None`), and a consumer uses the effect's
+known default. Effect stack order is the order of the `sspc` children of the Effect Parade: moving an
+effect (366) reorders them and the `EfDf` copies and changes nothing else (365, 366, **V**).
+
+**Exposure (`ADBE Exposure2`, 389-397, V).** `parn` = 24: 0 the input layer, 1 `Channels:` (popup
+`Master|Individual Channels`, 1-based, default 1), then four groups of five entries, Master 2-6,
+Red 7-11, Green 12-16, Blue 17-21, each `[group start (13), Exposure, Offset, Gamma Correction,
+group end (14)]` (the channel groups' sliders are named `Red Exposure`, `Red Offset`, `Red Gamma
+Correction`, ...), 22 Bypass Linear Light Conversion (checkbox, default off) and 23 the built-in
+entry. The three sliders are float sliders with the same `pard` in every group: Exposure (stops)
+default 0, valid -100..100, slider -4..4; Offset default 0, valid -2..2, slider -0.5..0.5; Gamma
+Correction default **1**, valid and slider 0.1..10. Each one-change case adds exactly one value
+record (twice: layer tree and `EfdG`): Channels 2 (390), Exposure 1.5 (391) and -2.25 (392), Offset
+0.1 (393), Gamma 2.2 (394), Channels 2 + Red Exposure 1 (395, two records), Bypass 1.0 (396). A
+keyed Exposure (397: -1 at 0 s, 2 at 2 s, linear) has plain 48-byte records. With Channels = Master
+the per-channel values are stored but inactive. The other byte changes against 389 are only the
+stale UI flags `pard@4` and, for a popup selection, `pard@59`.
+
+**Batch 5 effects (409-450, 511-516, 522-525; V).** Defaults as read back by After Effects for the
+fresh effect (MANIFEST), each value change one case. The scale of a fixed slider is told by its
+valid maximum (`pard` 128):
+
+| Effect (match name) | Parameters (`parT` index: type, valid maximum, default) | Evidence |
+|---|---|---|
+| `ADBE Invert` | 1 Channel: popup of 16 items **including three separators `(-`** (RGB, Red, Green, Blue, `(-`, HLS, Hue, Lightness, Saturation, `(-`, YIQ, Luminance, In Phase Chrominance, Quadrature Chrominance, `(-`, Alpha), default 1, stored 1-based over all 16 (Red = 2); 2 Blend With Original: fixed, max 100 (percent), 50 stored 50.0 | 409-411 |
+| `ADBE Box Blur2` (Fast Box Blur) | 1 Blur Radius: fixed, max 30 000, pixels (20); 2 Iterations: integer slider, default 3, max 50; 3 Blur Dimensions: popup (Horizontal and Vertical, Horizontal, Vertical), default 1; 4 Repeat Edge Pixels: checkbox, **default on** | 412-416 |
+| `ADBE Gaussian Blur 2` | 1 Blurriness: float, default 25, max 30 000; 2 Blur Dimensions: popup as above (Vertical = 3); 3 Repeat Edge Pixels: checkbox, **default on** | 417-419 (and 214, 216, 300, 301) |
+| `ADBE Drop Shadow` | 1 Shadow Color: default black; 2 Opacity: fixed, **max 255** (default 127.5 = 50 %, 204 = 80 %); 3 Direction: angle, default 135; 4 Distance: fixed, max 4 000, pixels, default 5; 5 Softness: fixed, max 30 000, default 0; 6 Shadow Only: checkbox, default off | 420-426 |
+| `ADBE Glo2` (Glow) | 1 Glow Based On: popup (Alpha Channel, Color Channels), default 2; 2 Glow Threshold: fixed, **max 255** (default 153 = 60 %); 3 Glow Radius: fixed, max 1 000, default 10; 4 Glow Intensity: fixed, max 255, default 1; 5 Composite Original: popup (On Top, Behind, None), **default 2 (Behind)**; 6 Glow Operation: popup of 25 blend modes starting None, Normal, Add, ..., default 3 (Add); 7 Glow Colors: popup (Original Colors, A & B Colors, Arbitrary Map), default 1; 8 Color Looping: popup (Sawtooth A>B, Sawtooth B>A, Triangle A>B>A, Triangle B>A>B), default 3; 9 Color Loops: fixed, max 127, default 1; 10 Color Phase: angle; 11 A & B Midpoint: fixed, **max 0.99, a 0..1 fraction**, default 0.5; 12 Color A white; 13 Color B black; 14 Glow Dimensions: popup as Blur Dimensions | 427-441 |
+| `ADBE HUE SATURATION` | 1 Channel Control: popup (Master, Reds, Yellows, Greens, Cyans, Blues, Magentas); 2 Channel Range: **arbitrary data** (below); 3 Master Hue (angle), 4 Master Saturation, 5 Master Lightness (fixed, max 100): **never stored, the values are in the data**; 6 Colorize: checkbox; 7 Colorize Hue: angle; 8 Colorize Saturation: fixed, max 100, default 25; 9 Colorize Lightness: fixed, max 100 | 443-450 |
+| `ADBE Timewarp` | 1 Method: popup (Whole Frames, Frame Mix, Pixel Motion), default 3; 2 Adjust Time By: popup (Speed, Source Frame), default 1; 3 Speed: fixed, max 5 000, default 50, plain (25 stored 25.0; keyed: plain 48-byte records 50 / 200); 4 Source Frame: fixed, max 5 000, plain (12); the tuning, motion blur, matte (`Matte Layer`, `Warp Layer`: layer records always present, 0 = none) and crop parameters follow | 529-533 |
+| `ADBE Easy Levels2` (Levels) | 1 Channel: popup (RGB, Red, Green, Blue, Alpha); 2 Histogram: **arbitrary data** (below); 3-7 Input Black, Input White, Gamma, Output Black, Output White: float sliders (max 10 000, Gamma 5), **never stored, the values are in the data**; 8 / 9 Clip To Output Black / White: popup (**On, Off, Off for 32 bpc Color**), default 3 | 511-516 |
+
+Hue/Saturation data (180 bytes): `i32` master hue at 0 (444: 90), saturation at 4 (445: 50),
+lightness at 8 (446: -30; V); then six colour ranges (Reds, Yellows, Greens, Cyans, Blues,
+Magentas) of 28 bytes: four `i32` range points in degrees (default Reds 315, 345, 15, 45; Yellows
+15, 45, 75, 105; ...; Magentas 255, 285, 315, 345) and the range's hue, saturation, lightness (E:
+layout read from the default, no range was changed). The Colorize values are ordinary records
+(447-450). Levels data (108 bytes): `u32` `0x000f10a7`, `u32` 1, then five channels (RGB, Red,
+Green, Blue, Alpha) of five `f32` input black, input white, gamma, output black, output white; the
+RGB values are V (512-516: 0.1, 0.8, 2, 0.2, 0.9 as float32), the other channels E (their defaults
+0, 1, 1, 0, 1). After Effects' undo does not revert a change of these values (MANIFEST). API:
+`Effect::arbitrary_data`, `HueSaturationData`, `LevelsData`; test `tests/effects_batch5.rs`.
+
+API: `EffectParam::{stored_value, pard_default, value, is_default, is_animated, keys, valid_max,
+valid_min, slider_range, point_px, layer_ref, popup_item_count, popup_selected_index,
+popup_selected_item, borrowed_definition}`, `Effect::has_own_definitions`,
+`Project::{effect_params, effect_definitions, definition_source}`, `ParamValue`,
+`ParamKind::{Button, GroupStart, GroupEnd}`, `DefinitionSource`, `LayerRef`. Tests:
+`tests/effects.rs`, `tests/batch3_core.rs`, `tests/batch3_objects.rs`, `tests/effects_batch4.rs`
+(356, 357, 361, 363, 364, 366, 368, 369, 371, 374, 377, 378, 380, 382, 383),
+`tests/effects_exposure.rs` (389-391, 393-397).
+
+**Importer block 2026-11-05, #3110 (`1100-quickwins.aep`, After Effects 26.2.1; V for every
+row: defaults from the defaults composition, the valid ranges from the minimum and maximum
+compositions, the items from one composition per popup item).** Each set value is stored as set
+(Decay 20 is `20.0`, Blend With Original 100 % is `1.0`); a value set to the default leaves no record
+(HDR Amount 100):
+
+| Effect (match name) | Parameters (`parT` index: type, valid range, default) |
+|---|---|
+| `ADBE HDR ToneMap` (HDR Highlight Compression) | 1 Amount: float, 0..100 (slider 0..100), default 100 |
+| `ADBE Echo` | 1 Echo Time (seconds): float, -30 000..30 000 (slider -5..5), default -1/30 (float32); 2 Number Of Echoes: integer, max 30 000, default 1; 3 Starting Intensity: float, 0..1, default 1; 4 Decay: float, **valid 0..100, slider 0..1**, default 1; 5 Echo Operator: popup (Add, Maximum, Minimum, Screen, Composite In Back, Composite In Front, Blend), default 1 |
+| `ADBE Linear Wipe` | 1 Transition Completion: fixed, max 100, default 0; 2 Wipe Angle: angle, default 90; 3 Feather: fixed, max 32 000, default 0 |
+| `ADBE Offset` | 1 Shift Center To: point, default the layer centre; 2 Blend With Original: fixed, **max 1 (a 0..1 fraction)**, default 0 |
+| `ADBE Deflicker` (Color Stabilizer) | 1 Stabilize: popup (Brightness, Levels, Curves), **default 2 (Levels)**; 2 Black Point, 3 Mid Point, 4 White Point: points, defaults 0.2 / 0.5 / 0.8 of the width at half the height; 5 Sample Size: fixed, max 50, default 3. The reference frame the Set Frame button picks is not among the parameters |
+
+**Importer block 2026-11-05, #3112 (`1300-thirdparty.aep`; V for the parameter lists, H for the
+data layouts, read from default instances only):**
+
+| Effect (match name, plug-in version) | Parameters (`parT` index: type, valid range, default) |
+|---|---|
+| `CS Color Neutralizer` (CC Color Neutralizer, 1.3) | 1 / 7 / 13 Shadows / Midtones / Highlights Unbalance: colours (black, 127 grey, white; pickers: setting one sets the range's sliders, e.g. [0.27, 0.55, 0.85] gives Red 42.94, Green 1.18, Blue -44.12 = (mean - channel) x 150 / 255 on 8-bit values, and leaves no colour record); 2-6, 8-12, 14-18 a group per range (start, Red, Green, Blue, end) with float sliders -100..100 (slider -50..50), default 0; 19 Pinning: float 0..100 (slider 0..50); 20 Blend w. Original: float 0..100; 21-25 the Special group: 22 View popup (Final Result, Correction B to W, Correction Stair), default 1, 23 Black Point float 0..49.9, default 0, 24 White Point float 50.1..100, default 100 |
+| `EXtractoR` (2.6.6) | 1 Channel Info (`EXtractoR-0013`): arbitrary data, 688 bytes, below; 2-6 the Process group: 3 Black Point and 4 White Point float sliders, valid ±3.4028235e38 (the float32 range; slider ±1 000), default 0 / 1; 5 UnMult: checkbox (empty `pard` name, the label in `pdnm`), default off |
+| `IDentifier` (2.6.6) | 1 Channel Info (`IDentifier-0005`): arbitrary data, 148 bytes, below; 2 Display: popup (Colors, Luma Matte, Alpha Matte, Raw), default 1; 3 ID: integer slider, max 2 147 483 647, default 0 |
+
+EXtractoR's Channel Info is the plug-in's own **little-endian** layout: `u32` 1 and 28 bytes, then
+four 164-byte records (Red, Green, Blue, Alpha), each a kind in byte 0 (1 a channel of the footage by
+name: `R`, `G`, `B` by default; 2 the input's own channel, named `(copy)`: Alpha by default) and the
+channel name NUL-terminated from record byte 35. EffectCraft imports kind 2 as its EXtractoR's `(copy)`,
+the effect input's channel of the same position as earlier effects left it, not as `A` (which names
+an OpenEXR footage's own alpha plane). The rest is not read: it differs between instances
+with the same channels (uninitialised-looking values, also in bytes 1..4 of a record: `02 00 00 32`
+on Alpha in one definition's default, which is why only byte 0 is the kind). **A chosen channel**
+(`extractor-07-preset-channel-z`, a preset of our own that reads `Z` into Red, Green and Blue) is kind
+1 with its name (`Z`), and the `u32` at record byte 4 is then 13, which looks like the channel's
+position in the EXR's sorted channel list of 14 (the defaults hold 0 there: H). IDentifier's data
+differs between instances with the same settings except for **the chosen channel's name**,
+NUL-terminated from byte 19, which is `Object ID` when no channel is chosen. After Effects lists
+only integer (UINT) channels: in 1300's EXR (a FLOAT `ID` channel) it found none ("No ID channels
+available"), so that block's preset `identifier-09-preset-channel-id` only sets ID 2; in 1310's
+EXR (UINT `objectId` and `IndexOB.X` added) the preset `identifier-09-preset-channel-objectid-id2`
+stores `objectId`, with 15 at byte 4 (the channel's position in the sorted list of 16, as for
+EXtractoR: H). Without a chosen channel After Effects leaves the layer unchanged (1300 and 1310
+defaults). The other bytes are not read. API: `ExtractorChannels`,
+`identifier_channel_type`.
+
+**Curves and Mesh Warp** (961-965, 985; applied from presets, the data is not scriptable): their
+arbitrary-data parameter (type 11) always has a record (`tdbs` with a 4-byte `cdat`) and a `LIST
+aRbs` / `aRbp`, also at the default. Curves (`ADBE CurvesCustom-0001`, 1644 bytes): `u16` 1, 1;
+five 256-byte tables (RGB, Red, Green, Blue, Alpha) = the natural cubic spline through the points,
+rounded (0 of 1280 entries differ); five 72-byte point records of 16 (`u16` in, `u16` out) slots,
+the count at 64, an `i32` at 68 (-1 untouched, count - 2 in every edited sample: H). Mesh Warp
+(`ADBE MESH WARP-0004`): `u32` rows + 1, `u32` columns + 1 (a 1 x 2-cell read-back test renders as made only in
+this order, `export-tests\mesh`; AE does not rebuild the stored mesh when Rows / Columns change, 989), 12 bytes
+(zeros, `0d 0d`), then per vertex row-major ten big-endian `f32`: position, handles top, right,
+bottom, left as fractions of the layer (H: or of the comp), outward border handles (0, 0); Rows /
+Columns / Quality are integer sliders with records only off their default (7, 7, 8). The `-NNNN`
+suffix is a parameter id, not the `parT` position (Curves -0002 Channel before -0001; Mesh Warp
+-0005 Quality before -0004). API: `CurvesData`, `MeshData`, `curve_lut`. [V; details: corpus FORMAT
+S]
+
+**Lumetri Color** (`ADBE Lumetri`, 1200: 63 compositions in After Effects 2026, 32 bpc, working space
+None; by script: defaults, all set, one per section, valid minima and maxima, every popup item the script
+can set, checkboxes toggled, keys, an expression; from presets made by hand, `-58` ... `-62`: an Input
+LUT, a Look, the RGB curve, Hue vs Sat, the colour wheels): 131 `parT` entries. The `-NNNN` suffix is a
+parameter id, not the position (`-0127` ... `-0130` sit between `-0005` and `-0026`), so the importer
+keys by suffix. Float sliders (type 10) store the value After Effects shows; the valid ranges (`pard`
+104 / 108) are wider than the slider's (112 / 116): Temperature / Tint -300..300 (slider -100..100),
+Saturation 0..300 (0..200), Exposure -7..7 (-5..5), Contrast, Highlights, Shadows, Whites, Blacks,
+HDR Specular, Tint Balance -150..150 (-100..100), Faded Film 0..150 (0..100), HDR White 100..1000,
+HDR Range 100..10000, Refine Blur 0..1000 (0..30), Vignette Amount -5..5 (-3..3); the read-backs of
+`-19-min` / `-20-max` equal the stored numbers. **Hidden controls are recorded in the default state**
+(`tdsb` 3) and still hold the value After Effects reads back: High Dynamic Range `-0062` (1.0),
+HDR Specular `-0064` (22), the second Look popup `-0128` (26.16 as set, read back 26), Legacy Tone And
+Saturation `-0097` (its `pard` default reads off as the script saved the project and on once the
+project was opened and saved again, `versions/1200-lumetri-26`, `-25x`, `-24x`; a fresh instance reads
+back off), Auto Color `-0124`, Face Detection `-0102`, the Auto Intensity `-0123`
+(`EffectParam::recorded_value`). Each section has an Active checkbox (blank `pard` name; `-0003` Basic
+Correction, `-0023` Creative, `-0037` Curves, `-0118` RGB Curves, `-0104` / `-0105` / `-0107` / `-0109` /
+`-0111` the hue / saturation curves, `-0046` Color Wheels, `-0068` HSL Secondary, `-0050` Vignette, on
+by default); off, the section does nothing (`-03-sec-basic-correction`, `-17-sec-vignette` render as
+`-00-defaults`). Arbitrary data (type 11, a record and `aRbs` in every instance; empty is `fe fe`):
+`-0001` an XML copy of the grade written only when the Look changes (not kept current: `-01-set-all`
+holds defaults for controls set after the Look; it names the LUT file, `Fuji F125 Kodak 2393 (by
+Adobe).cube`); `-0096` the Look's name, UTF-16LE (`SL BLUE ICE`, `Fuji F125 Kodak 2393 (by Adobe)` in
+`-59-preset-look-lut`; the popup `-0025` itself has no record, `-0128` can disagree with it:
+`-07-sec-creative` names item 20 while `-0128` holds 23), `-0095` likewise for the Input LUT
+(`ALEXA_Default_LogC2Rec709`, `-58-preset-input-lut`; the popups `-0005` / `-0127` keep no record,
+`-0004`, `-0024` and the assets `-0125` / `-0126` stay `fe fe`: the LUTs are After Effects' own files,
+named, not embedded); `-0129` the Look colour space's 16-byte id (the GUID `LookColorSpace` of `-0001`
+in Windows layout: the first 4, 2 and 2 bytes little-endian; zero for None; the Color Space popup
+`-0130` writes no record of its own, `-22-pop38-1` ... `-53-pop38-33`);
+`-0032` Split Toning (32 zero bytes); `-0039` the four RGB curves and `-0042`, `-0106`, `-0108`,
+`-0110`, `-0112` the hue / saturation curves, 520 bytes each: `i32` type (3 for the hue curves, 2 for
+Luma vs Sat and Sat vs Sat, 0 for an RGB curve), `u32` point count, then little-endian `f64` pairs x, y
+sorted by x (bytes after the counted points are stale). RGB: x and y 0..1, (0, 0), (1, 1) by default;
+the first of the four is the master curve (`-60-preset-curves-rgb`: (0.491, 0.787) lifts R, G and B
+alike, and the render follows a natural cubic spline through the points within 0.003); the order of
+the other three is H (the `-0001` XML names `ToneCurvesLuma`, `Red`, `Green`, `Blue`; no sample moves
+one). Hue / saturation: x the hue (0 red, 1/3 green) or the luma / saturation 0..1, y the offset from
+neutral 0; a fresh curve has no points, the selector colours `-0113` ... `-0117` add three at y = 0,
+the hue picked +- 0.0556. Hue vs Sat's y scales the saturation by 1 + y in linear light
+(`-61-preset-curves-huesat`: (0.0155, 0.97) takes pure red's linear saturation to 1.96 times, (0.263,
+-0.03) and (0.765, -0.02) green, cyan and blue to 0.97); the other four curves' scale is H. `-0047`
+Color Wheels, 4 `f64` triples: hue in degrees (0 red, 120 green), brightness slider 0..1 (0.5
+neutral), distance from the centre 0..1; 0, 0.5, 0 each by default; Shadows, Midtones, Highlights, then
+a fourth wheel of unknown role (`-62-preset-wheels`: Shadows 229.1, 0.370, 0.547 towards blue with the
+slider down; Midtones 0.1, 0.5, 0.395 towards red; Highlights 93.4, 0.727, 0.319 towards yellow-green
+with the slider up; the fourth at its default); `-0085` the HSL correction wheels (8 triples, the same
+default; layout H); `-0073` the HSL key, 40 bytes: a flag byte (1 once a colour was picked), then hue,
+saturation, lightness, each centre, range, tolerance (`f32` LE, fractions) and an enabled byte (fresh:
+0.5, 0, 0, on; picking RGB 0.02 0.55 0.85 gives hue centre 0.5605 = that colour's hue and lightness
+centre 0.435 = its HSL lightness, range 0.05, tolerance 0.1: `-01-set-all`; whether range is the half
+or full width is H); `-0122` the Auto Tone analysis (UTF-16 JSON). The project saved as 25.x and 24.x
+copies (`versions/1200-lumetri-25x`, `-24x`: the 58 scripted compositions, saved by After Effects
+2026) stores every Lumetri definition, valid range and value as the 26 save does. [V for the sliders,
+checkboxes, popups, the `tdsb` 3 values, the master RGB curve, Hue vs Sat, the colour wheels and the
+LUT names; H where marked]
+
+**Cryptomatte plug-in** (match name `Cryptomatte`, the free Cryptomatte plug-in, 2.6.6 in our
+sample; read from 88 instances in one production project, not made by us, and from our own After
+Effects 2026 sample 1400 (corpus `aep/cryptomatte.aep`: a fresh instance, Selection Mode on, each
+Output item, and two presets of our own that choose a layer and pick one object or material in the
+plug-in's UI; scripting read-backs and renders per composition); H for what neither varies):
+`parT` 0 the input layer; 1 Settings: **arbitrary data** (type 11, `Cryptomatte-0001`, a record and
+`aRbs` / `aRbp` in every instance); 2 Output: popup (Colors, Matted Colors, Matted RGBA, Matte
+Only), **`pard` default 1 = Colors** (bytes 56..64 `00000001 0004 0001`, in the instance's own and
+the project's shared definition; scripting reads 1 from a fresh effect: 1400 `crypto-00-defaults`),
+a written record (`tdsb` 1) holding the item number when set (1400: 2, 3, 4; production: 3 in 81,
+4 in 7); 3 Selection Mode: checkbox (`pdnm` `fnord!`), no record when off, and when on **a
+default-state record (`tdsb` 3) holding 1.0** that After Effects reads back as on and renders
+(1400 `crypto-01-set-all`, `crypto-02-chk-toggled`; the general reader takes only `tdsb` 1
+values, so the importer reads this one itself); the built-in entry. As in every project, only the
+first instance has its own `parT`; the others borrow the project's (1400). The Settings data is
+the plug-in's own layout, **little-endian**: `cry1`; bytes 4..32 differ between instances with
+the same settings (zeros in one, pointer-like values in others: not read); the layer name at 32,
+NUL-padded to 64 bytes (`CryptoObject`, `CryptoMaterial` in 1400: the EXR layer's name, which is
+also its channel prefix there, so the sample cannot tell which of the two the plug-in stores); at
+96 a `u32` 1 and a `u32` that is the same in every instance; at 104 the `u32` length of the
+selection text including its NUL; at 108 **the MurmurHash3 (x86, 32-bit, seed 0) of the selection
+text with its NUL** (V on the three texts of 1400: `<11a97486>` `0x27880767`, `<a5deeb9e>`
+`0xf7374a5b`, the empty text `0x514e28b7`; not read); a zero byte at 112; the selection text from
+113, the matte list as comma-and-space separated ID hashes `<11a97486>, <deadbeef>` (303 tokens in
+production, all in that form). Each token is the 8-digit hash of a picked name as the EXR's
+manifest lists it, i.e. the MurmurHash3 of the name (1400: `box_red` `11a97486` picked on
+CryptoObject, `mat_paint` `a5deeb9e` on CryptoMaterial). After the text 2 to 3 bytes, zeros or
+left-overs of a longer earlier text (1400's presets: 127 bytes, three zeros after the text). **A fresh effect** (the `parT`
+default and the record alike, 116 bytes, 1400) is `cry1`, zeros to 96, then `u32`s 1,
+`0x514e28b7`, 1, `0x514e28b7` and four zero bytes: no layer and an empty text (length 1, its NUL).
+`0x514e28b7` is the hash of a single NUL byte, so the `u32` at 100 looks like the hash of a first
+text that is empty in every sample, its length the `u32` 1 at 96 and its NUL the zero byte at 112
+(H: one value). Layer and selection decode the same in the production project and in 1400's two
+presets, and After Effects draws exactly the picked objects as selected (`crypto-06`: the box,
+`crypto-07`: box and disc, the two objects of `mat_paint`). API: `CryptomatteData` (refuses data without `cry1`, a length past the end or
+a non-zero byte at 112).
+
+**Puppet (`ADBE FreePin3`; ?: external listing, not the corpus, #3093).** No file of the
+corpus, the committed fixtures or the samples holds a Puppet. The tree below comes from outside
+the corpus: a public scripting listing of the effect's properties (a forum post, an After Effects
+release from before the Advanced and Bend pins and Density). It is not bytes we have seen; that
+After Effects writes it by the general rule (a `tdmn` and the `LIST tdgp` or `tdbs` it names,
+nested in the instance's value group `sspc/tdgp`, as masks, shapes and layer styles are) is
+**H**:
+
+```text
+Puppet                ADBE FreePin3
+  On Transparent      ADBE FreePin3 On Transparent
+  arap                ADBE FreePin3 ARAP Group            (hidden)
+    Auto-traced Shapes  ADBE FreePin3 Outlines
+    Mesh              ADBE FreePin3 Mesh Group            (hidden)
+      Mesh 1          ADBE FreePin3 Mesh Atom
+        Mesh          ADBE FreePin3 Mesh                  (hidden: the triangulation)
+        Triangles     ADBE FreePin3 Mesh Tri Count
+        Expansion     ADBE FreePin3 Mesh Expansion
+        Deform        ADBE FreePin3 PosPins
+          Puppet Pin 1  ADBE FreePin3 PosPin Atom
+            Vertex Offset ADBE FreePin3 PosPin Vtx Offset  (hidden, 2 values)
+            Vertex Index  ADBE FreePin3 PosPin Vtx Index   (hidden; 4294967295 = none)
+            Position      ADBE FreePin3 PosPin Position
+        Overlap       ADBE FreePin3 HghtPins              (hidden while empty)
+        Stiffness     ADBE FreePin3 StarchPins            (hidden while empty)
+```
+
+A pin's rest place is not a property: it is a vertex of the hidden mesh (Vertex Index) plus an
+offset, so it cannot be read without decoding the mesh data. The unit of Position (layer pixels,
+or a fraction of the layer as effect points are) is **?**. The match names of the Overlap and
+Starch pin atoms and their properties, of the Advanced and Bend pins (Scale, Rotation) and of
+Density, Mesh Rotation Refinement and the Puppet Engine are **?**, and so is which of them are
+`parT` parameters; whether After Effects stores some `parT` parameters of a fresh Puppet even at
+their defaults (the importer would then report them every time) is **?**; whether a Puppet
+without pins has an (empty) Mesh Group, or no ARAP group at all, is **?**. The importer
+(`import/puppet.rs`) therefore brings the effect in as EffectCraft's Puppet without meshes or
+pins and reports, per mesh, Triangles, Expansion and per pin group the pins, how many are keyed
+or carry an expression, and their atom match names; every entry outside this tree is named in the
+report. The sample that settles it: a fresh Puppet with no pins in one composition and, in
+another, a 400 x 800 solid in a larger composition (pixels against fractions) with a Puppet of
+three Position pins (one keyed, one moved off its rest place without
+keys), one Advanced, one Bend, one Starch and one Overlap pin, Triangles, Expansion and Density
+off their defaults, a second mesh, and a scripting read-back of every property's match name and
+value, the hidden ones included. Pins added by script are reported to come out disabled, so the
+pins are placed by hand or by a preset.
+
+### 3.8 Masks and bezier paths (`tdgp[ADBE Mask Parade]`)
+
+| Field | Chunk path | Offset | Type | Meaning | Evidence | Conf. |
+|---|---|---|---|---|---|---|
+| inverted | `Mask Parade/mkif` | 0 | u8 | | 090 (0), 091 (1) | V |
+| **mode** | `mkif` | 4 | u32 | Add 1, Subtract 2, **Intersect 3, Lighten 4, Darken 5, Difference 6, None 0** (329: the same ellipse path as 232) | 090, 091, 234-237, 329 | V |
+| name | `tdgp[ADBE Mask Atom]/tdsn/Utf8` | | text | `Mask 1` | 090 | V |
+| feather, opacity, expansion | `ADBE Mask Feather`, `ADBE Mask Opacity`, `ADBE Mask Offset` | | see 3.4 | stored only when not at the default; feather can be keyed (plain n=2 records) | 090, 091, 208 | V |
+| path property | `om-s[ADBE Mask Shape]/tdbs` | | | animated: `tdb4` byte 68 = 1 and a `list` of 64-byte records (time and common fields only) | 090, 093 | V |
+| path shapes | `om-s/omks/LIST shap` | | | one per keyframe, one for a static path | 090, 093 | V |
+| path never set | (no `ADBE Mask Shape` entry in the atom) | | | a mask added without a path (scripted `addProperty`) stores no Mask Path at all, also no `om-s`; After Effects reads it back, also after reopening, as the **source rectangle** `[0,0] [0,h] [w,h] [w,0]` (clockwise from the top left, no tangents) and renders it so (901: expansion -100 leaves a 100 px border) | 900, 901 | V |
+| box | `shap/shph` | 4, 8, 12, 16 | 4 x f32 | left, top, right, bottom **normalised to the layer (source) size** for masks (560 / 1920, 340 / 1080, 1360 / 1920, 740 / 1080; on a 100x100 solid a 60x40 rectangle has the box 0.2, 0.3, 0.8, 0.7 and decodes exactly with the layer size, not the 1920x1080 composition). It is the box of the vertices **and** of the handles | 090, 232, 309 | V |
+| **open path** | `shph` | 3 | u8 | bit `0x08` set = open path (`0x09` against `0x01`); byte 20 is 1 in every sample, open or closed | 233 against 090, 232, 234 | V |
+| points | `shap/list` (`lhd3` record size 8) | | f32 x, y | three per vertex in the order **vertex i, out handle i, in handle i + 1**, normalised inside the box (u = (x - left) / (right - left)); the last record is the in handle of vertex 0. A **tangent is the handle minus the vertex**, without a sign change | 090 (rect), 093 (two rects), 232 (ellipse: tangents `0.5523 x radius`, `[-220.91, 0]`, `[0, -110.46]`, ...), 233 (open path, 3 vertices) | V |
+
+**There is one `mkif` per mask**, placed directly before its atom (two masks: `mkif tdgp mkif tdgp`,
+328), so mode and inverted are reported per mask. `mkif` byte 8 is the running mask id counter of the
+**layer** in the session (1, 2 for the two masks of 328; 329 then gets 3; undo does not reset it; a new
+layer starts at 1 again): exposed as `Mask::counter`, a session counter and not a stable id. API:
+`Mask::{mode, inverted, counter}`, `Project::mask_vertices_px` (vertices in layer pixels), `Layer::mask_atoms` (`MaskAtom`: the mask with its atom group, its path property and its shapes by position, for the keys and expressions of the mask properties). Tests:
+`tests/masks.rs` (with a synthetic check of the handle order), `tests/batch3_objects.rs`.
+
+### 3.9 Shape layers (`tdgp[ADBE Root Vectors Group]`)
+
+A shape layer (type 4) holds `ADBE Vector Group` (user name `Group 1`) with `ADBE Vectors Group`
+(the contents, in z-order, `tdsb` 0x401) and `ADBE Vector Transform Group`. Items are named by their
+match name and carry their own user name. Colours are ARGB doubles 0..255. All sizes, positions and
+path points are in pixels. **An item's eye switch is bit 0 of its group's `tdsb`** (1 on; 986: a
+Fill at 0 is not drawn, 987: the same file at 1 draws it; both saved by After Effects from a patched
+copy of 850, the switch is not scriptable) [V].
+
+| Item (match name) | Property | Stored | Evidence | Conf. |
+|---|---|---|---|---|
+| `ADBE Vector Shape - Rect` ("Rectangle Path 1") | `ADBE Vector Rect Size` | f64 `[400, 300]` (2 components) | 238-242 | V |
+| `ADBE Vector Shape - Group` ("Path 1") | `om-s[ADBE Vector Shape]` | the same `shph` + point list as a mask, with a box in **pixels** relative to the layer origin; vertices `[0,-100] [100,100] [-100,100]`, in tangents `[-10,-20] [30,20] [-60,10]`, out tangents `[40,0] [-20,30] [0,-50]`; the box covers vertices and handles: `-160, -120, 130, 130` | 240 | V |
+| `ADBE Vector Graphic - Fill` | `ADBE Vector Fill Color` | `[255, 0, 255, 0]` | 238, 240, 242 | V |
+| `ADBE Vector Graphic - Stroke` | `Stroke Color` `[255, 0, 255, 0]`, `Stroke Width` 8, **`Stroke Line Cap` 2.0 (round; butt = 1 is absent)**, **`Stroke Line Join` 2.0 (round; miter = 1 is absent)**, `Stroke Miter Limit` 4 with `tdsb` 3 once the join was touched | doubles | 239 | V |
+| `ADBE Vector Filter - RC` ("Round Corners 1") | `ADBE Vector RoundCorner Radius` | f64 20 | 238 | V |
+| `ADBE Vector Graphic - G-Fill` ("Gradient Fill 1") | `ADBE Vector Grad Start Pt` `[-200, 0]`, `ADBE Vector Grad End Pt` `[200, 0]` | 2 components, class 15; the gradient type (linear) and the colour stops stay at After Effects' default and are not stored | 241 | V (points) |
+| `ADBE Vector Transform Group` | `ADBE Vector Position` | f64 `[50, 50]`; absent = `[0, 0]`, as are all other transform properties at default | 242 | V |
+
+Batch 3 (all **V**; shape layer `Shape`, label 8):
+
+| Item | Stored | Evidence |
+|---|---|---|
+| `ADBE Vector Shape - Star` ("Polystar Path 1") | After Effects' defaults are star, 5 points, outer radius 100, inner radius 50, rotation 0, roundness 0, so **a default star has no property record at all** (the 150 / 70 of batch 1 were stored). A **polygon** stores `ADBE Vector Star Type` 2.0 (`tdsb` 1, descriptor `00020000`) plus `Inner Radius` 50 and `Inner Roundess` 0 (After Effects' own spelling) as `tdsb` 3 default-state records; Points 5 and Outer Radius 100 stay absent | 330, 331 |
+| `ADBE Vector Graphic - G-Fill` | `ADBE Vector Grad Type` 2.0 for radial (`tdsb` 1, descriptor `00020000`; linear is 1 and absent); Start Point `[0, 0]` is the default and absent, End Point `[200, 0]` stored; the radial-only `Grad HiLite Length` and `Grad HiLite Angle` are written with `tdsb` 1 and value 0 (absent in the linear 241). Colour stops are in no property | 241, 332 |
+| two siblings with one match name | one group holds `Rectangle Path 1` (Size `[400, 300]` stored), `Rectangle Path 2` (Size `[100, 100]` is the default, no record; `ADBE Vector Rect Position` `[300, 0]`, 2 components, class 15) and `Fill 1`, in z-order: a reader keys the items by occurrence, not by match name | 333 |
+
+Batch 5 (all **V**; shape layer `S`, Group 1 = Ellipse Path 1 [400,300] + Fill 1 green in 451, one change each): every value is stored **as After Effects shows it**, in the shape's own record (`tdsb` 1), and absent at its default:
+
+| Property (match name) | Stored | Evidence |
+|---|---|---|
+| `ADBE Vector Shape - Ellipse`: `ADBE Vector Ellipse Size`, `... Ellipse Position` | pixels `[500,200]`, `[100,50]` | 452, 453 |
+| `ADBE Vector Graphic - Fill`: `ADBE Vector Fill Opacity`, `ADBE Vector Fill Rule` | percent 50; popup 1-based, even-odd = 2 | 454, 455 |
+| `ADBE Vector Transform Group` of a group: `ADBE Vector Anchor`, `Scale`, `Rotation`, `Group Opacity`, `Skew`, `Skew Axis` | pixels `[10,20]`; **percent** `[50,80]` (not a fraction as the layer's Scale); degrees 30; percent 40; 20; degrees 45 | 456-461 |
+| layer `ADBE Anchor Point` of a shape layer | pixels `[10,20,0]` as stored (no source size), as on a text layer | 462 |
+| `ADBE Vector Graphic - Stroke`: `ADBE Vector Stroke Opacity` | percent 50 (colour `[255,255,0,0]` and width 6 as in 239) | 463, 464 |
+| `ADBE Vector Filter - Trim`: `Trim Start`, `Trim End`, `Trim Offset`, `Trim Type` | percent 20, 70; degrees 45; popup 1-based, individually = 2; a new Trim Paths has no record | 465-469 |
+| `ADBE Vector Rect Roundness` | pixels 30 | 470, 471 |
+| `ADBE Vector Shape - Star`: `Points`, `Rotation`, `Inner Roundess`, `Outer Roundess`, `Position`, `Outer Radius`, `Inner Radius` | 6; degrees 30; percent 20, 40; pixels `[50,-20]`, 150, 30 | 472-479 |
+| `ADBE Vector Graphic - G-Fill` added: Start `[0,0]` and End `[100,0]` are the defaults, no record; **the colour stops have no record at their default**, which renders white to black, linear in the encoded values (481: 0.75 / 0.5 / 0.25 at a quarter, half and three quarters) | 480, 481 |
+| a second top-level group, a group nested in a group (`ADBE Vector Group` inside `ADBE Vectors Group`), `ADBE Vector Graphic - G-Stroke` (width 10) | the same records as at the top level, in z-order | 482, 483, 484 |
+| defaults of every item (519: AE read-back with no record stored): rectangle and ellipse size 100 x 100, position 0, roundness 0; star 5 points, radii 100 / 50, rotation and roundness 0; fill red `[1,0,0]`, opacity 100, rule 1; stroke white, width 2, cap / join 1, miter 4; gradients linear, start `[0,0]`, end `[100,0]`; trim 0 / 100 / 0, type 1; round corners radius 10; group transform anchor / position 0, scale 100, opacity 100; blend mode, composite order, shape direction 1 | none of them has a record | 519 |
+
+The 3D-extrusion `ADBE Vector Materials Group` of a group changes its `tdsb` from 1 to 3 when a polystar or a gradient is added (472-484), with no property record.
+
+API: `Layer::shape_groups` (`ShapeGroup`, `ShapeItem`, `Stroke`, and `ShapeGroup::details` with
+`ShapeDetail::{Polystar, Gradient, RectPosition}`, `PolystarType`, `GradientType`). Other items
+(ellipse, trim paths, repeater, dashes, ...) are listed as `ShapeItem::Other` with their match name;
+the polystar is listed as `Other` and the gradient fill as `GradientFill`; both carry their extra
+fields in `details` (indexed by `item_index`); see section 4. Tests: `tests/shapes.rs`,
+`tests/batch3_objects.rs`.
+
+### 3.10 Text documents (`btds[ADBE Text Document]/LIST btdk`)
+
+`btdk` is not a chunk sequence but a PostScript-like dictionary (`/key value` pairs, `<< >>`, `[ ]`,
+numbers, `true` / `false`, `/names`, strings as `(` + `fe ff` + UTF-16BE + `)` with `\` escapes). The
+verified paths from the top level (keys `/98 /0 /1`; `RUN` = `/1/1[0]/0`):
+
+| What | Path | Evidence | Conf. |
+|---|---|---|---|
+| text | `RUN/0`; a trailing `\r` ends the paragraph. **A hard line break is `\r` too: `A\rB` is stored `A\rB\r`** | 110 (`A`), 113 (`Hello`), 243 | V |
+| **U+0003 in the text** | stored as it is (`A`, U+0003, `B` is `A\u{3}B\r`), with the paragraph runs of a CR (`[2, 2]`). After Effects lays it out exactly like `A\rB` (387): two composed lines, two paragraphs, baselines at y 0 and 98 (`text.measure` in AE). So U+0003 is a line break that starts a new paragraph; the importer maps it to `\r` | 386, 387; test `etx_is_stored_as_it_is_and_splits_the_paragraph_runs` | V |
+| font size | `RUN/6/0[n]/0/0/6/1` (100 by default) | 110, 113 (60) | V |
+| fill colour | `RUN/6/0[n]/0/0/6/53/0/1` = `[A R G B]` floats 0..1 | 110 (white), 113 (`[1 1 0.5 0]`), 248 | V |
+| **paragraph runs** | `RUN/5/0[n]/1` = characters including the `\r` (`A\rB\r`: `[2, 2]`; `Hello\r`: `[6]`) | 243, 245 | V |
+| **style runs** | `RUN/6/0[n]/1` = characters per style run (`A\rB\r`: `[4]`). **A range style splits `Hello\r`: characters 1 to 3 red gives `[1, 2, 3]` with the fills white, `[1 1 0 0]`, white** | 243, 248 | V |
+| **justification** | `RUN/5/0[n]/0/0/5/0`: 0 = left, **1 = right (334)**, 2 = centre, **3 = justified with the last line left, 4 = last line right, 5 = last line centred, 6 = every line justified**; the scripting enum value of right (7414) is not what is stored | 245 (0), 246 (2), 334 (1), 565 (3), 567 (4), 566 (5), 568 (6) | V |
+| **character settings (S17)** | one `text.set_style` change each against the point text 538 (`HHHH`, Times New Roman 100 px, normal baseline), the slot named is the only one that changes: `/6` horizontal scale as a factor (539: 1.0 -> 0.9), `/7` vertical scale (540: 1.5), `/9` baseline shift in px (541: 41), `/11` automatic kerning **0 none, 1 metrics (default), 2 optical** (542, 543), `/18` ligatures (off by default, 555; switching ligatures off in 551 changes nothing), `/35` baseline direction **1 with the stream (default), 2 rotated (573), 3 across the stream / tate-chu-yoko (576)**, `/36` tsume as a fraction (553: 0.5), `/52` no break (552), `/56` fill drawn (on by default, 546), `/57` stroke drawn (off by default, 544), `/58` **stroke over fill (on by default: 547 setting it on changes nothing, 550 setting it off gives false)**, `/62` line join **0 miter, 1 round** (548), `/63` stroke width in px (**1.0 by default**, 545: 5), `/70` digit set **0 default, 1 Arabic (571), 2 Hindi (578)**; with digit set Arabic the text `1234` has the same layer bounds as with the default (S17, not saved) | 538-578, 595, 596; tests `tests/text_style_slots.rs` | V |
+| **manual kerning** | `RUN/8/0` (beside the style runs): one entry `<< /0 << /0 amount >> /1 length >>` per run of characters, amount in 1/1000 em; kerning 50 on `HHHH` gives four entries of length 1 with 50 and one for the closing `\r` without an amount, `RUN/7` = 50, and switches automatic kerning `/11` to 0 | 554 | V |
+| **paragraph settings (S17)** | `RUN/5/0[n]/0/0/5/<slot>`, one change each against 538: `/1` first-line indent (560: 20), `/2` start indent (561: 30), `/3` end indent (562: 40), `/4` space before (563: 10), `/5` space after (564: 12), all in px; `/8` leading model **0 Roman, 1 Japanese** (572); `/9` automatic hyphenation (**on by default**, 556 off); `/21` Roman hanging punctuation (558); `/29` **every-line composer, off by default** (559 on; 557 setting it off changes nothing, so a new text uses the single-line composer); `/33` direction **0 left to right, 1 right to left** (569). Setting the Universal composer (570) changes nothing; the Latin/CJK composer cannot be set by script | 556-572 | V |
+| **vertical text** | `lineOrientation` vertical right to left adds `/0/8/0[0]/0/2/1` = 2 to the frame dictionary (absent for horizontal text) | 575 | V |
+| **box (paragraph) text** | frame dictionary `/0/8/0[0]/0`: `/1/0` = 32 floats = 16 x, y pairs tracing the rectangle (corners `[-200,-100] [200,-100] [200,100] [-200,100]`), `/2/0` = 1; both keys are absent for point text. Alignment changes only the glyph geometry, not the frame | 245, 246 (box 400 x 200, top-left `[-200, -100]`), 247 (point text: absent) | V |
+| **tracking** | `RUN/6/0[n]/0/0/6/8` = 0, 100 in 247 | 247 | V |
+| **faux bold / faux italic** | style slots `.../6/2` and `.../6/3`, `false` -> `true`; the font style stays Regular. **Side effect: the font list `/0/1/0` gains a new first entry (4 -> 5 fonts) with property `/3` = 2 (bold) or 1 (italic), the old entries shift up and the style's font index `/6/0` becomes 1** | 335, 336 | V |
+| **caps** | style slot `.../6/12`: 0 normal, **1 small caps, 2 all caps** | 337, 338 | V |
+| **superscript / subscript** | style slot `.../6/13`: **1 superscript, 0 normal, 2 subscript** (the only slot that changes between 526, 527 and 528). After Effects lays superscript and subscript out at 58.3 % of the size, 33.3 % of the size above / below the baseline: `HHHH` in Times New Roman 100 px is 288.9 px wide with its baseline at 0 when normal, 168.4 px with its baseline at -33.3 / +33.3 when superscript / subscript (`text.measure`, layer bounds). **Every scripted text of the corpus is superscript** (526: the character state After Effects was in; 243, 517 and the reference 244 too), which is why this slot never showed up as undecoded | 526-528, 243, 517 | V |
+| **wrapping box text** | a 600 x 400 box at `[-300, -200]` (as in 245) with a sentence of 70 characters: the document holds the text, size and box only; After Effects composes four lines (`The quick brown fox ` / `jumps over the lazy dog ` / `and keeps running far ` / `away`), the line breaks are not stored | 517 | V |
+| **leading** | style slot `.../6/5`: the scripted samples have the explicit leading 98.0 (100 px Times New Roman; `/4` false), leading 60 is 60.0; with automatic leading on, 400 stores 0.01 (see "automatic leading" below) | 339, 400 | V |
+| **last run** | the last style run reaches the paragraph end and includes the final `\r` (two range styles on `Hello`: runs `[1, 2, 3]`, fills white / `[1 1 0 0]` / `[1 0 0 1]`, sizes 100 / 100 / 60) | 340 | V |
+| font | `.../6/0` = index into the font list `/0/1/0[i]/0/0/0` (`TimesNewRomanPSMT`, ...). The list always holds entries no run uses (`Myriad-Roman`, `MyriadPro-Regular`, `AdobeInvisFont`), so only the fonts the runs point at matter | 110, 335 (index 1 is still `TimesNewRomanPSMT`) | E |
+| **stroke colour** | `.../6/54/0/1` = `[A R G B]`, the fill's layout; white in the untouched samples, red `[1 1 0 0]` in 574, blue in 595. The stroke switch, width and order are slots `/57`, `/63`, `/58` (see "character settings") | 110, 113, 574, 595 | V |
+| **automatic leading** | style slot `.../6/4`: `true` = automatic leading (lines advance by 1.2 x the size; `/5` is then not used), `false` = `/5` is the leading. **243: `/4` false, `/5` 98, the second line's baseline is stored 98 px below the first (`/1/1[0]/1/2[0]/6[0]/6[0]/6[0]/6[1]/0/0[1]`)**. **400 (Auto Leading switched on for `A` CR `B`, size 100, leading 98; against its unedited save 399): the run style changes in `/4` (false -> true) and `/5` (98 -> 0.01) only, the stored second baseline moves from 98 to 120 px below the first (1.2 x 100), and After Effects measures the same 120 px (`text.measure`)**; the rest of the diff is save noise (`head`, the comp's modification time, the text's `btgu/pgui`). That `/5` holds 0.01 under automatic leading is seen in 400 only | 243, 339 (`/5`); 400 (`/4`); test `automatic_leading_is_slot_4` | V |
+| **undecoded slots** | the run style and paragraph dictionaries of an untouched document (244; 110 stores the same bytes) are the reference: a slot that is not decoded and differs from it is listed (`TextDocument::undecoded_style_fields`, `undecoded_paragraph_fields`); a slot the reference lacks is listed only when it is not 0, `false`, empty or `/nil` (a neutral value is taken to carry nothing, so it is not reported as a loss; `/nil` is how 244 stores its paragraph slots `/27`, `/28` and `/36`). Decoded style slots: `/0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /11 /12 /13 /18 /35 /36 /52 /53 /54 /56 /57 /58 /62 /63 /70`; paragraph slots: `/0 /1 /2 /3 /4 /5 /8 /9 /21 /29 /33`. Not found by any scriptable setting (none of the `text.set_style` attributes tried in S17 changes them): style `/20 /38 /78 /87 /88`, paragraph `/31 /32`. **Paragraph `/24`, `/35` and style `/68`** (1, 1 and 0 in a scripted text) were edited in place in the wrapping box text 517 (732: `/24` 0, 733: `/35` 0, 734: `/68` 1, same length); After Effects opens each without a dialog, keeps the value on a re-save and composes the same four lines, baselines and bounds (`text.measure`, `layer.bounds`; 734 renders like 517), so 0 and 1 are not listed (`NEUTRAL_PARAGRAPH_VALUES`, `NEUTRAL_STYLE_VALUES`; their meaning stays unknown, Latin text only). **Paragraph `/34`** is 0 in a scripted text and 7 after Reset Paragraph (727: the only slot that changes); a justified 600 px box text of 88 characters composes the same four lines, baselines and bounds with both values (S18), so 0 and 7 are not listed (`NEUTRAL_PARAGRAPH_VALUES`), other values are | every text sample lists none; 725, 727 | V (reference), E (/34) |
+| **Source Text record** | the `tdbs` in `btds[ADBE Text Document]` (next to the `btdk`) has no keys and no expression in every sample; Source Text keyframes (presumably one `btdk` per key) and expressions were not sampled, the reader only reports them (`Layer::source_text_property`, `Layer::text_document_count`) | 110-114, 243-248, 334-340 | E |
+
+API: `TextDocument` (`paragraphs`, `style_runs`, `text_box`, `paragraph_texts`, `font_of`,
+`incomplete_runs`, `undecoded_style_fields`, `undecoded_paragraph_fields`, `kerning`,
+`line_orientation`), `StyleRun::{faux_bold, faux_italic, caps, auto_leading, leading, stroke_argb,
+font_index, horizontal_scale, vertical_scale, baseline_shift, auto_kern, ligatures,
+baseline_direction, tsume, no_break, apply_fill, apply_stroke, stroke_over_fill, line_join,
+stroke_width, digit_set}`, `ParagraphRun::{first_line_indent, start_indent, end_indent, space_before,
+space_after, leading_type, auto_hyphenate, hanging_roman, every_line_composer, direction}`, `Caps`,
+`AutoKern`, `KernRun`, `Justification`.
+A damaged run is never dropped silently: a run without a readable length is left out, a run with a
+missing size, fill or font index takes them from the run before it, and both count in
+`incomplete_runs`. Tests: `tests/text_markers_footage.rs`, `tests/batch3_objects.rs`,
+`tests/text_fields.rs`.
+
+### 3.11 Markers
+
+`mrst[ADBE Marker]` holds a `tdbs` with a `list` of 16-byte records (the times; `tdb4` byte 12 is the
+time scale) and one `LIST mrky/LIST Nmrd` per marker. Layer markers live in the layer's own tree,
+composition markers in the `SecL` list named `Markers`.
+
+| What | Chunk path | Meaning | Evidence | Conf. |
+|---|---|---|---|---|
+| time | the key list | 25 600 = 1 s | 122, 123, 249 | V |
+| **duration** | `Nmrd/NmHd` (20 bytes: u32 4, u32 0, u32 duration, u32 600, u32 0) | duration / 600 = the marker duration in seconds (1 s is 600; 0 for none); 600 is the units per second; **0.5 s and 0.3 s read back exactly (509, 510)** | 249 (1 s), 122 (0), 509, 510 | V |
+| **several markers** | the key records and the `Nmrd` lists in the same (time) order: 509 has two composition markers, 1 s `M1` label 2 and 2.5 s `M2` duration 0.5; a fractional time is a plain key time (0.52 s = 13 312 / 25 600, 510) | | 509, 510; test `tests/batch5.rs` | V |
+| **strings** | five `Utf8` children of `Nmrd`, in the order **comment, chapter, URL, frame target, cue point name**; unused ones are empty | `LM`, `Chap`, `http://a.example/u`, `_blank`, `CueX` | 249 | V |
+| **cue type** | `NmHd` u32 @0: **4 = event cue (also for markers without a cue point name), 5 = navigation cue** | 347 (4), 348 (5) | V |
+| **cue parameters** | `NmHd` u32 @4 = the number of key / value pairs; the pairs follow the five fixed strings as `2 x pairs` extra `Utf8` (key, value, key, value): `speaker` = `A`, `n` = `2` with the cue point name `CueE` | 349 | V |
+| **label** | `NmHd` u8 @16 (followed by three pad bytes): label 3 is `03 00 00 00`. The label is not in the keyframe flags (unlike the keyframe label of 057) | 347 | V |
+
+API: `Marker::{label, cue_type, cue_params}`, `CueType`. Tests: `tests/text_markers_footage.rs`,
+`tests/batch3_objects.rs`.
+
+### 3.12 Cameras and lights
+
+Both have no source item (`ldta@40` is 0 for a camera, `0xffff_ffff` for a light), type 2 or 1, the 3D
+bit and byte 38 bit `0x40` (3.1); `ldta@136` is the light type. Their properties sit in the same
+groups as on other layers, with these conventions:
+
+| What | Path | Stored | Evidence | Conf. |
+|---|---|---|---|---|
+| camera Position, default (auto state) | `ADBE Transform Group/ADBE Position`, `tdb4` 76 and 77 = 1 although no expression exists | `[0, 0, -2666.67]` (x and y are 0 whatever the composition size; z = -zoom). A **one-node** camera reports `[0, 0, -2666.67]` (251). **Correction (S16): a reopened two-node camera reports `[0, 0, -2666.67]` too (256 read back), and After Effects renders it there**: the default two-node camera of 537 above the 3D solid of 486 renders from `[0, 0, -2666.67]` towards the point of interest, not like the composition's default view (537 differs from 486 in 24 % of the grid points, and EffectCraft's import with the stored position matches 537 but for 4 edge points). The `[960, 540, ...]` of the batch-3 notes was not reproduced (535 and 537, created by script, read back the stored value too); `CameraPosition::reported` keeps the old rule and is marked as contradicted | 256, 251, 537 | V |
+| camera Position, set by the user | same, `tdb4` 76 and 77 = 0 | the absolute value `[100, 200, -1000]` | 253 | V |
+| camera point of interest | `ADBE Anchor Point` | `[960, 540, 0]` in **pixels** (not a fraction); the record's `tdsb` is 1 on a two-node and 3 on the one-node camera (not asserted) | 251, 253, 256 | V (value), E (`tdsb`) |
+| light Position, default | same as the camera | `[0, 0, -1333.33]`, as After Effects reports it (255 read back); the point of interest `[960, 540, 0]` | 254, 255 | V |
+| light intensity | `ADBE Light Options Group/ADBE Light Intensity` | f64 50.0 percent, `tdsb` 1; absent at the default 100 | 254 (50), 252 (absent) | V |
+| light type | `ldta@136` | 1 spot, 2 point | 254, 252 | V |
+| **camera Zoom** | `ADBE Camera Options Group/ADBE Camera Zoom` | plain pixels (`tdsb` 1), absent at the default 2 666.67; the auto Position keeps `[0, 0, -2666.67]` and is not recomputed from the zoom | 341 (2000) | V |
+| **camera depth of field** | same group: `ADBE Camera Depth of Field` 1.0 (checkbox descriptor `ffff0004`), `ADBE Camera Focus Distance` 800, `ADBE Camera Aperture` 30 (plain numbers), all `tdsb` 1. **Defaults (256 read back): Depth of Field off, Focus Distance = Zoom = 2 666.67, Aperture 25.309 336 332 958 4, Blur Level 100** | 342, 256 | V |
+| **light Casts Shadows** | `ADBE Light Options Group/ADBE Casts Shadows` | a set record (`tdsb` 1) holding 0.0 (off) in every light | 252, 254, 255 | V |
+| **3D rotations** | `ADBE Rotate X`, `ADBE Rotate Y` | plain degrees, absent at 0 | 486, 487 | V |
+| **Orientation** | `LIST otst` = `tdbs` + `LIST otky/otda`: `otda` is three big-endian `f64` degrees; absent at `[0, 0, 0]`. Keyed orientation is not sampled | 488, 485 | V |
+| **light colour** | `ADBE Light Options Group/ADBE Light Color` | ARGB doubles 0..255 (`[255, 255, 0, 0]` for red; 4 components, descriptor `0002ffff`), absent = white | 343 | V |
+| **light cone** | same group: `ADBE Light Cone Angle` 60 and `ADBE Light Cone Feather 2` 30 (percent), each `tdsb` 1 and absent in the default spot light (90 and 50). Every point light stores them as `tdsb` 3 records with 90 and 50 (a point light created directly equals the converted one of 252, so the "odd" property set is not a conversion artefact) | 344, 345, 346, 252 | V |
+
+A point light made by converting a spot light has a different property set (`Orientation`, `Rotate
+X/Y/Z`, `Cone Angle`, `Cone Feather 2` in the default state) that a spot light lacks (252); whether that
+is an artefact of the conversion is untested. API: `Layer::camera_position`,
+`CameraPosition::reported`, `Layer::camera_point_of_interest`, `Layer::light_intensity`,
+`Layer::{camera_zoom, camera_depth_of_field, camera_focus_distance, camera_aperture, light_color,
+light_cone_angle, light_cone_feather}`, `DEFAULT_CAMERA_ZOOM` (2 666.67 is verified for the 1920 px
+composition only), `Layer::orientation` (`Orientation`; test `orientation_is_otst_otda` in
+`tests/batch5.rs`). Render checks against After Effects (20 px grid, 5 184 points): 486 1 point
+off, 535 2, 536 0, 537 4 (anti-aliased edges); **488 (Orientation `[10, 20, 30]`): 272 points
+(5.25 %) differ; the import carries the stored angles, and permuted or negated inputs match worse
+(6.2 % to 34 %), so the cause is in EffectCraft's renderer and not isolated.** Tests: `tests/layer_switches.rs`, `tests/batch3_objects.rs`.
+
+### 3.12a Project settings (top-level chunks; cases 620-634)
+
+Each case is the base reopened and saved with one setting changed (`project.set_settings`), compared
+with 620 (the base saved the same way); apart from the save noise (`head` byte 19, `nhed` / `nnhd`
+bytes 20-27 / 28-35, `fdta`) only the bytes below changed.
+
+| setting | where | stored | cases | conf |
+|---|---|---|---|---|
+| colour depth | `nhed` byte 15 (and `nnhd` byte 24) | 0 = 8, 1 = 16, 2 = 32 bits per channel (the base is 32) | 620, 621, 622, 631 | V |
+| working space | `cpid` (16 bytes) and the `Utf8` right after `PwCs` | None: `cpid` all `0xff` and the JSON `{}`; a profile: JSON `{"baseColorProfile":{"colorProfileData":"<base64 ICC>","colorProfileName":"<name>"},"baseProfileType":2}` (`sRGB IEC61966-2.1` in the base, `Rec.709 Gamma 2.4` in 624) and `cpid` a 16-byte id of the profile; After Effects 26.2.1 leaves `colorProfileName` out in a fresh save (settings-c), and the name is then the profile's ICC `desc` tag (v2 `desc` or v4 `mluc`) | 620, 623, 624, 631, 902 | V (None, the name), ? (`cpid`) |
+| working gamma | `dwga` `u32` @0 | 0 = 2.2, 1 = 2.4 | 625, 631 | V |
+| Linearize Working Space | `lnrp` (1 byte, 1) inserted after `cpid` | absent when off | 626, 632 | V |
+| Blend Colors Using 1.0 Gamma | `lnrb` (1 byte, 1) inserted after `cpid`, before `lnrp` | absent when off | 627, 632 | V |
+| Compensate for Scene-referred Profiles | `acer` byte 0 | 1 on (base), 0 off | 628 | V |
+| time display | `nhed` (and `nnhd`) byte 8 | 0 timecode, 1 frames; feet + frames: byte 8 = 1 and byte 11 = 1, byte 13 = frames per foot (16 = 35 mm, 40 = 16 mm; the base holds 16) | 629, 633, 634 | V |
+| frame count start | `nhed` byte 14 (`nnhd` byte 20) | 2 for a count from 0 (base), 1 for a count from 1 | 630 | E (one value each) |
+
+The audio sample rate of the project is `adfr` (`f64` 48 000 in every case, not varied). API:
+`ProjectSettings::read` (`TimeDisplay`, `WorkingSpace`). Test: `tests/it/container/cases_600.rs`. The
+fixture of 624 is not in the repository: its working-space JSON holds the profile data After
+Effects embeds for that space.
+
+### 3.12b Layer styles (`tdgp[ADBE Layer Styles]`; cases 950-980)
+
+Every layer's root group holds `ADBE Layer Styles` (third, after Time Remapping and Transform), also
+when no style is used (950). Inside: `ADBE Blend Options Group` (Global Light Angle `ADBE Global
+Angle2`, Altitude `ADBE Global Altitude2`, and `ADBE Adv Blend Group` with `ADBE Layer Fill
+Opacity2`, `ADBE R/G/B Channel Blend`, `ADBE Blend Interior`, `ADBE Blend Ranges`; 977), then one
+switch group per style, `<style>/enabled` (`dropShadow`, `innerShadow`, `outerGlow`, `innerGlow`,
+`bevelEmboss`, `chromeFX` = Satin, `solidFill` = Color Overlay, `gradientFill` = Gradient Overlay,
+`patternFill`, `frameFX` = Stroke).
+
+| field | layout | evidence | conf |
+|---|---|---|---|
+| applied | the switch group's `tdsb` 1 (2 = not applied); with the first style Layer Styles and Blending Options `tdsb` 3 -> 1; nothing else in the layer changes | 950-960 | V |
+| switched off | the switch group's `tdsb` 0 (bit 0 is the eye, as on shape items): the style keeps its records and is not drawn; After Effects keeps 0 when it saves (988: a patched copy of 952, render = 950; the eye is not scriptable) | 988 | V |
+| switch state 3 | not sampled (presumably bit 1 = not applied; the removal is not scriptable: `property.remove` refuses a non-indexed group, session R4) | - | ? |
+| records | a parameter has a `tdbs` only when it differs from After Effects' default (defaults: the read-back of 951), in property order (`<style>/<param>`) | 951-977 | V |
+| scalars | the value in the units shown: opacity, noise, choke / spread, range, jitter, depth, scale in percent, distance and size in pixels, angles and altitude in degrees; class (8, 9) with `tdum` / `tduM`, angles and altitude (4, 6) without | 966-977 | V |
+| colours | ARGB 0..255, class (1, 1), 4 components | 967, 970, 977 | V |
+| popups, checkboxes | class (4, 4), 1-based / 1.0 when on. Blend Mode (`mode2`, `highlightMode`, `shadowMode`): Photoshop's menu with its separators, 1 Normal, 2 Dissolve, 4 Darken, 5 Multiply, 6 Color Burn, 7 Linear Burn, 8 Darker Color, 10 Lighten, 11 Screen, 12 Color Dodge, 13 Linear Dodge, 14 Lighter Color, 16 Overlay, 17 Soft Light, 18 Hard Light, 19 Vivid Light, 20 Linear Light, 21 Pin Light, 22 Hard Mix, 24 Difference, 25 Exclusion, 27 Hue, 28 Saturation, 29 Color, 30 Luminosity, 32 Subtract, 33 Divide (3, 9, 15, 23, 26, 31 render Normal); Inner Glow Source 1 Edge, 2 Center; Stroke Position 1 Outside, 2 Inside, 3 Center; Bevel Style 1-5 Outer Bevel, Inner Bevel, Emboss, Pillow Emboss, Stroke Emboss (2 = default Inner Bevel); Color Type, Technique, Bevel Technique and Direction, Gradient Style 1-based in menu order | 978 (mode sweep rendered at 16 bpc), 979, 980, 977 | V (modes, Source, Position), E (the rest) |
+| Gradient Overlay Offset | 2 components as shown, class (4, 6) | 977 | V (stored), H (unit) |
+| keys | the plain 48-byte records (D.2), `tdb4@5` 1 -> 0, `@68` 1 | 976 | V |
+| expressions | as on effect parameters: `tdb4@120` 1, the text before `tdum` | read-back test s1 (`export-tests\styles\s1`) | V |
+| gradients | `<style>/gradient` is a `GCst` list, not decoded | - | ? |
+
+At 32 bpc After Effects renders the modes 6, 7, 11, 12, 16-22 and 25 of a style as Normal (978);
+at 16 bpc as their formulas. API: `effectcraft_aep::style_map` (table shared by importer and exporter).
+
+### 3.13 What the tests cover
+
+`tests/header.rs`, `values.rs`, `keyframes.rs`, `layer_switches.rs`, `effects.rs`, `effects_batch4.rs`, `effects_exposure.rs`, `masks.rs`,
+`shapes.rs`, `text_markers_footage.rs`, `batch3_core.rs` and `batch3_objects.rs` compare the decoded fields with the manifest values of the
+cases listed above; `typed.rs` checks the structural relations on every property and every list of
+every fixture; `robustness.rs` runs the whole typed view over damaged copies of the decoded fixtures
+(byte flips, truncation, damaged chunk bodies, every component count and template flag of the
+keyframe header, damaged marker, layer-reference and footage chunks, every accessor of batch 3
+including ease components with out-of-range indices) and over extreme values (zero and maximal
+stretch ratios, display start and sequence durations).
+
+## 4. Not decoded
+
+Fields that the corpus leaves open (**?**), only suggests (**H**), or shows without a manifest value to
+assert against (**E**, not exposed), and areas that were not sampled. None of these is decoded by the
+crate; the raw bytes stay reachable through the chunk tree. Batch 3 settled most of the previous
+list (explicit defaults and the Gaussian Blur default, the ease layout of several components, the
+bezier colour distance, stretch and fractional times, Time Remapping, Layer Control None, the
+dropdown, pixel aspect / shutter phase / display start, mask modes and the mask counter, polystar /
+gradient / two-rectangle shapes, right justification, faux styles, caps, leading, camera zoom and
+depth of field, light colour and cone, marker label and cue data, audio and sequence footage).
+
+The fixtures are the small files of the corpus: as 369 single-case `.aep` files they used 31.4 MB on
+disk (and the five `.aepx` 0.9 MB); combined into one project per family (16 files, and `fx-switch.aep`)
+they use 27.2 MB in the corpus. In a combined file only the first instance of an effect
+type keeps its parameter definitions (later ones read the project copy), layer and item ids are
+the file's, and project settings are per file. Cases that exist in the corpus but have no fixture: 200 and 201 (the save-noise pair), 207 (Rotation keys), 209 (Rectangle Size keys), 244 (point text reference), 250 (comp marker at 2 s),
+255 (default spot light, identical to 121), 257 and 258 (precomps of a 640 x 360 solid and of a
+640 x 360 composition), most of batch 1 (011, 020, 036, 045, 050, 051, 061, 070, 072, 074-076, 078,
+079, 092, 100-105, 111, 112, 120, 121, 125) and of batch 3: 308 (the 100x100 solid on its own,
+309 and 310 contain it), 312-315 (no-op sets of Opacity, Anchor, Scale and Rotation: the layer tree is
+identical to 299, only the session counters differ), 322 (byte-identical to 320), 346 (a point light
+created directly, identical to 252 apart from the layer id) and 353 (354 without the remap). What they
+establish is listed in the tables above with their case numbers; the tests do not assert it. Batch 4
+without a fixture: 355 and 367 (unedited saves), 358-360, 362 (more Tint colours and amounts), 365 (Tint
+above Gaussian Blur; 366 is the moved stack), 370, 372, 373, 375, 376, 379 and 381 (more Ramp points,
+colours, scatter and blend values), 388 (unedited save) and 392 (Exposure -2.25: like 391 with
+another value).
+
+**Layer header (`ldta`)**
+
+- Quality Wireframe, a track matte mode with matte layer id 0, frame blending and `autoOrient` on non-camera layers (not sampled); a parent that is not the first layer; layer names of 40 characters and non-ASCII names (a name longer than 31 characters: **?**, `ldta@64` holds 32 bytes); blend modes beyond the six known (Dissolve, Darken, Lighten, Color Dodge, Hue, ...); a negative start time; a stretch of 33.3 % (non-terminating ratio) and -100 %; a stretch on a layer that has keyframes (whether their times are rescaled); in / out points beyond the source duration.
+- Bytes 56 (1 on AV, shape and text layers, 0 on camera and light; meaning **?**), 96 (2 on AV layers, **?**) and the camera extra at 148 / 152 (a double that equals the 36 mm film size in points: **E** for the value, **H** for the meaning). The start-time denominator of layers made by the API against the precomp operation (258 against 257: 25 600 against 1, **V** in the corpus, no fixture).
+
+**Composition header (`cdta`, `PRin`)**
+
+- Bytes 0 (**?**), 16 (600: **H**, the 1/600 s legacy time base), 24, 32, 40 (cache-like: they hold values the session used earlier, do not use them: **E**), 48 (**E**), 176 and 184 (360 in all files: **?**, probably the maximum shutter angle), 196 and 200 (128 and 16: **?**).
+- Not sampled: a 3840 x 2160 composition, other pixel aspect fractions (1.2121, 1.4587), the preserve-frame-rate and preserve-resolution switches, draft 3D, `Hide shy layers`, frame blending, the 8-versus-16-bit project depth with a coloured background, the display start at 30 fps and with drop frame (whether the denominator at 168 is always the timescale).
+- `PRin/prda` (12 bytes for Classic 3D, 52 for Advanced 3D: renderer parameters, **E**).
+- Item `idta` byte 23 (0x20 composition and sequences or clips, 0x30 stills and solids, 4 audio, 0 folder; needed: zeroed, renders differ) and `idpc` (**V** in the corpus: 1 when the composition contains a nested composition), `head`, `nhed`, `nnhd`, `Ewst`, the `f*` records, `Gide`, `PTRE`, `LRdr` and `LSIf` bodies. `head` bytes 4 to 7 are the version the file is written for and `svap` the version that wrote it (section 1, "Versions"); `head` bytes 16 to 19 are the save counter (a big-endian `u32`; only its low byte changed between most saves, `314` shows the carry) and are the only bytes of the container that change in a Save As without an edit; item `idta` bytes 80 to 83 are the modification time (seconds since 1904-01-01); `nhed` / `nnhd` hold the id of the After Effects session (six sessions seen); `mkif` byte 8 is a running mask counter; `pgui` chunks are random GUIDs. All of that is edit-history or session state (**V** in the corpus) and is not decoded, except the mask counter.
+
+**Properties and keyframes**
+
+- `tdb4` bytes 4, 8..11 (a descriptor per property class: **E**; needed, without it keys are dropped), 16 (0.0001: **E**), 24 (the composition pixel aspect on spatial properties: **E**), 32..48 (1.0: **E**; 16..55 are needed by roving keys: zeroed, After Effects reads a roving key back at time 0), 56..67 (a class pair: **E**), 72..78 except 76 and 77 (**E**), 79 (**E**); `tdsb` bits other than 0x1 and 0x2 (group flags `0x401`, `0x11`, ...) and the `tdsb` 01 / 03 of the Vector Materials Group; `tdum` / `tduM` (**?**).
+- Per-dimension ease values of a colour or a 2-D key (Scale is **V**, aep-export.md R13); a colour key with a non-zero ease (a colour has one ease entry; the sample reports 0 / 0); the ease units of a keyed effect Point (the 2-D spatial record itself is **V**, 382, with linear keys only).
+- The 8 stale bytes of the marker record and the bytes after the common fields of the mask path record (uninitialised memory).
+- Expressions in effect parameters, multi-line and non-ASCII expressions, the ExtendScript engine.
+- Time Remapping with extra keys, with a stretch, on a nested layer; whether keys are rescaled by a stretch.
+
+**Effects**
+
+- `pard` byte 48 (flags: **?**), 68 / 72 (the point default as a percent pair: **V** in the corpus for 074 and 368, not exposed), 120 (the float slider default again as f32: **V**, not exposed), 124 (display decimals: **H**), 132..147 (fixed slider slider-max, default copy and flags; the low bit of @144 is set on the two percent-displayed sliders and clear on Scatter: **H** "display as percent"), the colour default copy at @60, and the stale memory after the parameter name. The fixed slider valid minimum is not decoded (the float slider one is, 389).
+- Puppet (`ADBE FreePin3`, 3.7): the hidden mesh data, a pin's Vertex Index and Vertex Offset (its rest place), the unit of a pin's Position, the Overlap, Starch, Advanced and Bend pins, Density, Mesh Rotation Refinement and the Puppet Engine: no sample (**?**).
+- Effects renamed, or stacked twice on ONE layer (`Gradient Ramp 2`: does the second keep an empty `parT`?); which instance keeps the full `parT` when a second instance is created on a layer below the first; expressions on effect parameters; keyed per-channel Exposure values and a keyed checkbox; Curves / Levels (arrays), Fractal Noise, and whether the `tdpi` of a Layer Control holds an id or an index after the referenced layer is reordered or deleted.
+
+**Masks, shapes**
+
+- Masks: locked, colour, feather falloff, rotobezier, keyed expansion, a path whose last vertex has only handles, the counter after a mask is deleted, a mask on a scaled layer (whether the box stays layer-relative), an animated path with three or more keys.
+- Shape layers: open shape paths (in shape groups), stroke dashes, taper and wave with values, merge paths, repeater, offset paths and the other path operators, item blend modes and composite order, shape direction, gradient colour stops other than the default (**?**: they appear only as an `ADBE Vector Grad Colors` entry), highlight length and angle other than 0, gradient scale and rotation; why a radial gradient writes its highlight records with `tdsb` 1 and a polygon its inner radius with `tdsb` 3 (**?**; the polygon's records hold the defaults 50 and 0, as every non-effect record in the default state does: 3.4, state).
+
+**Text**
+
+- A real bold / italic font (the font-list entry against the faux flags, and why faux bold prepends a font-list entry: **?**), control characters other than U+0003 (**?**), style slots `/20 /38 /78 /87 /88` and paragraph slots `/31 /32` (no scriptable setting changes them: **?**), the meaning of paragraph `/24 /34 /35` and style `/68` (**?**, neutral for the sampled values), per-character offsets, vertical left-to-right text, text on a path, non-BMP characters, text animators and range selectors, source-text keyframes, and the roughly 700 other leaves of the dictionary.
+
+**Camera, light**
+
+- Camera focal length, angle of view and film size; the defaults of Focus Distance and Aperture (**?**, absent until depth of field is touched) and whether the default Zoom follows other composition widths (**H**: 50 mm on a 36 mm film gives width x 50 / 36); f-stop and blur level; a one-node camera with an animated point of interest; iris shape and rotation.
+- Light parallel and ambient (`ldta@136` = 3, 4?), intensity 150 %, falloff radial and distance, casts shadows with darkness and diffusion, keyed colour; 3D layer orientation and X / Y rotation; the Material Options group (default in every sample).
+
+**Markers, footage, precomps**
+
+- Markers: a non-ASCII comment, a composition marker with a cue type (`SecL`), property-level markers, a protected region; the three pad bytes after the label byte.
+- Footage: the audio words of `sspc` (`u16` @96 = 3, @98 = 4, @100 = 1, `u32` @156 = 8, set only for the 16-bit mono WAV: bits per sample, channels, sample format: **?**), stereo, 24-bit and 44.1 kHz WAV, the image sequence descriptor (`u32` @168 = 2, @172 = 1, @176 = 3, @180 = 3 and bytes @184..187 = `01 00 01 01`: first number, last number, digits, count: **?** with one sample), a sequence with another start number, four digits or a conformed frame rate, a missing file, footage inside a project folder, alpha and pixel-aspect interpretation, loop, a solid with alpha, `sspc` bytes @112, @114, @209..@212; `mnfo` does not hold the sequence frame rate.
+- Precomps whose size, frame rate, duration or start differ from the parent (whether `ldta@12` / `@16` change), a time-remapped nested layer, collapse transformations, a precomp inside a precomp, a stretched layer inside a precomp (whether the property-time-scale rule follows).
+- Save bookkeeping: whether the 1 748 bytes of XMP history per saved file are two history events or one, and whether the `head@16` steps have structure beyond "increases".
+
+## 5. Method
+
+The format is established only from files we generate and compare, never from another program's
+parser or from Adobe's code.
+
+1. **Generate.** A base project is built once. For each case exactly one thing is changed through
+   After Effects' own scripting interface (a layer switch, a composition property, a static value,
+   a keyframe, an effect, a mask, a text edit), the project is saved as `NNN-name.aep`, the change
+   is undone and the base state is re-checked before the next case. A manifest lists every case
+   with the exact change and the values used; the same state is also saved as the XML flavour of
+   the project, which names the chunks and can be used as a cross-check. Batch 2 repeated this in
+   later sessions, each case again from the same loaded base, and added two saves without an edit
+   to isolate what a save changes.
+2. **Diff.** A walker (our own code) parses each file into the chunk tree, and each case is
+   compared with the base and with its parent case: chunk path, size and the offsets and bytes
+   that changed. Save noise (a save counter, time stamps, the growing XMP history, per-session
+   ids) is filtered. Because one change produces a handful of chunk differences, the field that
+   holds a value is found by the byte offsets, and checked by changing the value (`040` against
+   `041`, `055` against `051`, `202` against `203`).
+3. **State a hypothesis, then verify it.** A statement enters this document only when the manifest
+   value and the decoded value agree in the case files (the table above names them) and the same
+   relation holds on every other file where it applies. A decoder script outside this repository
+   checks every layout against the manifest values; the tests in `crates/aep/tests/` are the
+   verification inside it: they decode the fixtures and compare with the manifest values (layer
+   switches, in / out / start times, composition size, frame rate, work area and background,
+   Position `100, 200, 0`, Scale 50 %, key times and ease, the interpolation sides, anchor
+   fractions of two solid sizes, Slider 77, Blurriness 40, point, angle and checkbox values, mask
+   vertices and tangents, mask modes, shape sizes and colours, text and fill colour, text runs,
+   marker times and strings, camera positions, light type and intensity, solid colours), and check
+   the structural relations on every chunk of every fixture. A field with several cases that agree
+   is marked V in section 3; a field seen only in the case diffs is marked E.
+4. **Skip what is not verified.** Anything without an agreeing manifest value, or with a
+   conflicting case, stays undecoded (section 4).
+
+The corpus itself and the helper scripts live outside this repository. Projects that were not made
+for this purpose were opened locally only to test the reader's robustness and the importer's
+coverage (does everything parse, which chunk ids occur); no layout in this document comes from them
+and none of them, nor any content of them, is in the repository. The
+cases above are the contributor's own test data, kept outside the repository (see `ATTRIBUTION.md`); the
+repository holds no Adobe sample project, preset or asset.
diff --git a/docs/aep-import.md b/docs/aep-import.md
new file mode 100644
index 000000000..f41ba3081
--- /dev/null
+++ b/docs/aep-import.md
@@ -0,0 +1,505 @@
+# After Effects project import
+
+> **Last reviewed:** 2026-11-05 · **Last updated:** 2026-11-07 · **Change:** After Effects' Puppet arrives as EffectCraft's Puppet without its meshes and pins, which are reported mesh by mesh (#3093; the storage is not sampled yet, aep-format 3.7); before that: Lumetri Color's master RGB curve, Hue vs Sat curve and colour wheels are imported (1200 presets made by hand); before that: Lumetri Color is imported (1200: every slider, checkbox and popup with a counterpart, by match name, also from records in the default state; switched-off sections, LUTs, looks, undecoded curves and wheels are reported); before that: the report names the After Effects version a file is written for and the one that wrote it (`aeVersion`); copies saved as 25.x and 24.x import like the 2026 save; before that: Curves and Mesh Warp are imported (961-965, 985; FORMAT S of the corpus); before that: a shape item's eye switch is imported (bit 0 of its group flags, 986 / 987: a switched-off Fill under Trim Paths is no longer drawn, render equal to After Effects), and a layer style's (switch group `tdsb` 0, 988); before that: a negative time stretch (Time Reverse Layer) is imported: in and out point in order, the layer plays backwards (981-983: render equal to After Effects at 7 points); before that: After Effects' None on Compound Blur, Displacement Map and Set Matte arrives as an explicit None (`NO_LAYER`), not as the owning layer; before that: layer styles are imported (the nine styles and Blending Options, 951-979; Global Light becomes the composition's); before that: the 27 effects of round 3 are in the table (`effectcraft_aep::effect_map`); before that: a layer of a clip, sequence or sound ends at its source's end (After Effects ends it there when it opens a project, read-back test f1), unless it is remapped or looped or runs less than a frame past; before that: keys of shape colours are read (the reader took their 152-byte spatial records for plain ones: `tdb4` byte 7 is 0 there, 854); before that: the effect table moved to `effectcraft_aep::effect_map`; point defaults in percent and a popup default slot of 0 (After Effects' save of a project it opened, e1 / e2 re-saves) are read; before that: the justification of right-to-left paragraphs is read relative to the direction (t7); before that: 24 more layer blend modes (906, 907); before that: 27 more effects are imported (batch 6: 903-905), with layer parameters; before that: a Rec. 709 working space also sets the output space (After Effects renders in the working space, 902); before that: a mask whose path was never set arrives as the source rectangle (900, 901); before that: Offset Paths' Copy Offset arrives as EffectCraft's (After Effects' value minus 1, 828); before that: project settings, image sequences, conformed clips and effect instance names are imported, next to the mattes, shapes, text settings and animators, effects, markers, time remapping, cameras and lights); before that: parallel and ambient lights (701, 702) and keyed Orientation (703) are imported; before that: masks on text and shape layers (705, 706: AE vs EffectCraft render 12 and 0 of 5184 points, glyph edges) and Merge Paths, Offset Paths, Repeater (707-710, 731; merge renders equal but for edges; Repeater copy opacity and Offset Paths' outline differ in EffectCraft's renderer) are imported; before that: keyframes: the ease of Anchor Point, effect point, effect colour and mask path keys is imported (597-599, 700, 730: within 0.5 px of After Effects' read-backs); before that: effects: Directional Blur, Radial Blur, CC Radial Blur, Venetian Blinds, Channel Blur, Black & White, Tritone, Luma Key, Simple Choker, Matte Choker and Transform are imported (711-723; render checks: CC Radial Blur and Channel Blur equal, Directional Blur within 5/255; Venetian Blinds, Radial Blur, Black & White (8/255), Tritone (19/255), Luma Key, Matte Choker and Transform differ in EffectCraft's renderer, see STATUS); before that: text: character and paragraph settings (stroke, scales, baseline shift, kerning, ligatures, tsume, indents, spacing, justified text, composer, direction, vertical text; 538-578) and text animators with range selectors (579-594, 114) are imported; render checks 594 (keyed range selector at 0 / 0.5 / 1 / 1.5 / 2.5 s), 595, 596 equal but for glyph edges; before that: cameras, spot and point lights, X / Y Rotation and Orientation, Timewarp and expressions on effect parameters are imported (render checks 486, 535-537 equal but for edges; 488 differs by 5.25 %, cause in EffectCraft's renderer not isolated); before that: text: superscript and subscript are imported (526-528); before that: effects: Invert, Fast Box Blur, Gaussian Blur, Drop Shadow, Glow, Fill, Hue/Saturation, Levels and five expression controls are imported, popups are mapped by item name, checkbox defaults come from the file; before that: shape layers are imported (groups, paths, paints, trim paths, round corners; 451-484, 519 added); before that: markers and Time Remapping are imported (509, 510 added); before that: track mattes are imported (402-408); before that: text: automatic leading is verified (400); effects: Exposure is imported (Channels, all twelve sliders, Bypass, keys), next to Tint and Gradient Ramp; before that: text: U+0003 is a paragraph break (386, 387); before that: a stored text Anchor Point is pixels (385, now V); before that: effects: Tint and Gradient Ramp are imported (all parameters and keys), other effects stay reported; `.aepx` is accepted; text layers are imported (Source Text with style runs, paragraphs and box text; fonts by PostScript name, missing fonts listed); layer styles are reported; before that: layer masks · **Target:** Adobe After Effects 2026
+
+File ▸ Import ▸ After Effects Project… (`file.importAep`) reads an `.aep` or its XML form `.aepx`
+and adds its items to the open project, in a folder named after the file (as After Effects does when it imports a project).
+It is deliberately narrow: what it brings over is exact and tested, everything else is **reported**
+and never dropped silently. Wider coverage grows with the reader's verified field layouts
+([aep-format.md](aep-format.md)); this page lists what exists today.
+
+## Where it lives
+
+The `import` module of `crates/aep` (`effectcraft_aep::import`; the crate is **L3**) sits between
+the container reader (`effectcraft_aep::container`, the typed view of the file) and the project
+model `effectcraft-project` (L2), the same place `effectcraft-lottie` has for Lottie (one crate for
+import and export). Why a crate of its own and not a module of the engine:
+
+- the PSD importer lives in the engine (`crates/engine/src/psd_import.rs`) because it creates
+  raster layers from engine services; the `.aep` import needs nothing of the engine, only the
+  project model, so it can be built, tested and fuzzed alone and is available to every frontend;
+- it must build for wasm32 (`cargo xtask layers` and `cargo xtask wasm` cover it): it does no file
+  access, the caller passes the bytes, a "does this footage path exist" callback and a "is this
+  font installed" callback (`ImportOptions::has_font`; the engine passes the renderer's own font
+  lookup, `ImportOptions::new` takes every font as installed);
+- the command (`file.importAep`, `crates/engine/src/cmd/aep.rs`) is a thin wrapper: read the
+  file, run the importer inside one undoable edit, open the first composition, return the report.
+
+API: `import(&mut Project, bytes, &ImportOptions) -> Result<ImportResult, AepImportError>` and the
+dry runs `analyze(bytes, exists) -> ImportReport` (every font counts as installed) and
+`analyze_with(bytes, &ImportOptions)`. An error (not a project, damaged container,
+refused losses) leaves the project unchanged.
+
+## The command
+
+`file.importAep {path, allowLosses?, dryRun?, applySettings?}`
+
+- Without `allowLosses` an import that would lose anything is **refused** (nothing changes) and the
+  error names the categories, e.g. `importing would lose effects: 3, markers: 1; allow losses to
+  import anyway`. With `allowLosses: true` it imports and returns the same report.
+- `dryRun: true` returns only the report.
+- The result is `{folder, comps, items, report}`; one undo step removes everything. The first
+  composition opens in the viewer. The path is confined like every other file-reading command in
+  the automation layer; from the shell:
+  `effectcraft-cli exec file.importAep '{"path":"in.aep","allowLosses":true}' out.ecproj --save`.
+
+## What is imported
+
+| Area | Imported |
+|---|---|
+| Project tree | Folders (nesting and order), compositions, solids (colour, size), footage items; item labels |
+| Project settings | colour depth, working space (None, sRGB, Rec. 709 Gamma 2.4; another one is reported as `project settings`), working gamma, Linearize Working Space, Blend Colors Using 1.0 Gamma, time display (timecode, frames, feet + frames 35 / 16 mm), frame count start (620-634). A colour depth, time display, frames-per-foot or frame count start code
+outside the sampled ones keeps the current value and is reported as `project settings`. After Effects renders in the working space (902: in a Rec. 709 Gamma 2.4 project an sRGB PNG step of 128 comes out as 135 and a grey 0.5 solid as 128, in the Render Queue output and in the captures), while EffectCraft converts its output to `output_space` (sRGB when unset): a Rec. 709 working space therefore also sets the output space to Rec. 709 (902 within 1 level of After Effects, was up to 13). They come in `ImportResult::settings`; the library never changes the project's own settings, `file.importAep` applies them when the project has no compositions yet (or with `applySettings: true`) |
+| Composition | name, size, exact frame rate, duration, work area, background colour (8 bit), pixel aspect, composition motion blur switch, shutter angle and phase (as stored), display start time, Classic/Advanced 3D renderer |
+| Layers | solid, null, adjustment, footage, precomposition and **text** layers: name (the source's name when the layer has none; for a text layer the first 40 characters of its first line, as EffectCraft names a text layer after its text), in/out/start and time stretch (exact ratios, e.g. 50 % and 150 %); a layer of a clip, sequence or sound ends at its source's end as After Effects ends it (unless remapped, looped or less than a frame past; f1), enabled/audio/solo/shy/locked/effects/motion blur/collapse/3D/guide switches, draft quality, label, blend mode (Normal, Multiply, Add, Screen, Overlay, Difference; Soft Light, Hard Light, Darken, Lighten, Exclusion, Color Dodge, Color Burn by name, 906; Classic Difference, Hue, Saturation, Color, Luminosity, the Stencil and Silhouette modes, Classic Color Dodge / Burn, Linear Dodge / Burn, Linear, Vivid and Pin Light, Hard Mix by render, 907: each code rendered by After Effects matched exactly one EffectCraft mode; 906 renders within 1/255 of After Effects), parent, **track matte** (alpha, alpha inverted, luma, luma inverted; the matte layer anywhere in the composition, also below its target; 402-408) |
+| Transform | Anchor Point, Position, Scale, Rotation, Opacity, **X and Y Rotation** (486, 487) and **Orientation**, static (488) or keyed (703: key values, times, linear and hold sides; a bezier side becomes linear and is reported; After Effects slerps between the keys, EffectCraft interpolates each angle, so in-between values differ, e.g. 703 at 1 s `[6.26, 9.35, 15.22]` against `[5, 10, 15]`; an expression-driven orientation is reported): the stored value, or the default when the file stores none; keyframes with time, linear/bezier/hold on each side, temporal ease (speed and influence, per dimension for Scale), automatic or manual spatial tangents, roving and key labels |
+| Expressions | on the transform and mask properties and on effect, camera and light parameters (534): source text and enable switch |
+| Cameras and lights | **cameras** (one-node and two-node, from `ldta` byte 38 bit `0x40`): point of interest, Position as stored (also the auto Position `[0, 0, -zoom]`, where After Effects renders it, 537), orientation and rotations, Zoom (absent: `-z` of the auto Position, else the 50 mm default), Depth of Field, Focus Distance (absent: the zoom), Aperture (absent: 25.309 at 1920 px, read back from 256; scaled with the width, which is not sampled, E); **spot, point, parallel and ambient lights** (light type 1, 2, 0, 3: 701, 702): point of interest (not for point and ambient lights), Position, Intensity, Color, Cone Angle, Cone Feather, Casts Shadows; keys and expressions as for the transform; 251-256, 341-345, 535-537, 701, 702. Environment lights are reported |
+| Text | the Source Text of a text layer: the text (paragraphs separated by CR; a hard line break is a CR too; U+0003 is laid out by After Effects exactly like a CR (386 against 387) and becomes a CR), per style run the font (PostScript name), size, fill and stroke colour, whether fill and stroke are drawn, stroke width, stroke over fill (one switch for the text), tracking, leading (automatic or explicit), faux bold, faux italic, all caps, small caps, superscript and subscript (526-528), horizontal and vertical scale, baseline shift, automatic kerning (metrics, optical, none), ligatures, tsume (538-578); per paragraph the justification (left, centre, right and the four justified variants), first-line / start / end indent, space before / after, direction, composer, hanging punctuation (in a right-to-left paragraph the stored justification is relative to the direction: After Effects lays 0 and 3 out flush right and 1 and 4 flush left, read-back test t7, so they arrive as right / left); point text or box text (box size and top-left in layer pixels); vertical right-to-left text (575) |
+| Text animators | every animator with its name and its range selectors (Start, End, Offset, or the Index range when Units is Index; Units, Based On, Mode, Amount, Shape, Smoothness, Ease High / Low, Randomize Order, Random Seed) and the properties Anchor Point, Position, Scale, Skew, Skew Axis, Rotation, Opacity, Fill Color, Stroke Color, Stroke Width, Tracking Amount, Line Spacing, Blur, Character Offset and Character Range, with keys and expressions (579-594, 114, 728). Values are stored as After Effects shows them; popups are 1-based in the file |
+| Masks | every mask of an imported layer, in stack order (on text and shape layers, which have no source, the stored mask box is in layer pixels: 705, 706): name, path (vertices and tangents in layer pixels, open or closed), mode (None, Add, Subtract, Intersect, Lighten, Darken, Difference), inverted, feather (x, y in pixels), opacity (percent), expansion (pixels); path keyframes (time, linear or hold sides, roving, label), feather / opacity / expansion keyframes with ease |
+| Effects | **Lumetri Color** (1200; see *Lumetri Color* below), **Curves** (961-964: the five curves' points from the arbitrary data as EffectCraft's `x,y` points in 0..1; render within 6 levels: EffectCraft interpolates monotone, After Effects stores a natural spline) and **Mesh Warp** (965, 985: Rows, Columns, Quality and the Distortion Mesh as per-vertex offsets in layer pixels; Bezier handles moved on their own are kept as eight extra numbers of the vertex for the export and reported, EffectCraft draws the mesh bilinear; the header is rows + 1, columns + 1; render 985: 1.4 % of pixels > 2 levels around the moved vertex), **Tint**, **Gradient Ramp**, **Exposure**, **Invert**, **Fast Box Blur**, **Gaussian Blur**, **Drop Shadow**, **Glow**, **Fill**, **Hue/Saturation**, **Levels**, **Timewarp** (Method, Adjust Time By, Speed with keys, Source Frame; 529-533), **Directional Blur**, **Radial Blur**, **CC Radial Blur**, **Venetian Blinds**, **Channel Blur**, **Black & White**, **Tritone**, **Luma Key**, **Simple Choker**, **Matte Choker**, **Transform** (all parameters; 711-723) and the expression controls **Slider**, **Angle**, **Checkbox**, **Color** and **Point Control** (table below) on any imported layer (also text and shape layers and layers with masks), in stack order, with the instance name, every parameter (static value or default) and its keyframes; also the second and later instances of a type, whose parameter definitions are only in the project's shared definition list. **Puppet** arrives in its place with its name and fx switch but without meshes and pins (a pin's rest place lies in the mesh data, not decoded yet); per mesh the report gives Triangles, Expansion and each pin group's pins, keyed pins and atom match names. Other effects are reported (below) |
+| Layer styles | Drop Shadow, Inner Shadow, Outer Glow, Inner Glow, Bevel and Emboss, Satin, Color Overlay, Gradient Overlay and Stroke when applied (switch group `tdsb` 1): every parameter, starting from After Effects' defaults (Use Global Light is off there), with keys on scalars and colours and expressions; Blending Options: Fill Opacity, the channel switches, Blend Interior Styles as Group, Use Blend Ranges, and Global Light Angle / Altitude, which the composition adopts (one setting per composition here). Units and popups through `effectcraft_aep::style_map` (aep-format 3.12b). Render check against After Effects (`proof\styles`): drop shadow, inner shadow, satin, colour overlay, stroke within a few levels; glow and bevel intensities and the Gradient Overlay direction differ in EffectCraft's renderer |
+| Shape layers | groups (nested, with anchor, position, scale, skew, skew axis, rotation, opacity), rectangle (size, position, roundness), ellipse (size, position), polystar (star or polygon, points, position, rotation, radii, roundness), bezier path (vertices and tangents in layer pixels, path keys), fill (colour, opacity, fill rule), stroke (colour, opacity, width, cap, join, miter limit), gradient fill and stroke (linear or radial, start and end point; the default white-to-black colours), trim paths (start, end, offset, trim multiple shapes), round corners (radius), merge paths (mode; 707, 708), offset paths (amount, line join, miter limit, copies, copy offset; 710; After Effects offsets copy *i* by Amount x (*i* + Copy Offset), default 1, EffectCraft by Amount x (*i* + 1 + copyOffset), so the copy offset arrives 1 less, also its keys; an expression on it is kept and reported; 826-828, 828 renders equal to After Effects on every grid point), repeater (copies, offset, composite, transform; 709), in file order, with keyframes and expressions, the operators' defaults as After Effects reads them back (731); the layer anchor in pixels; 238-242, 330-333, 451-484, 519, 705-710, 731 |
+| Markers | layer and composition markers: time (layer time for layer markers, exact frames), duration (1/600 s units, 509, 510), comment, chapter, URL, frame target, label, cue point (name, event or navigation, parameters); 122, 123, 249, 347-349, 509, 510 |
+| Time Remapping | an enabled remap becomes the `timeRemap` property (source seconds, keys in layer time with their interpolation and ease, expression), first in the layer's properties as Layer > Time > Enable Time Remapping puts it; 319, 354 |
+| Footage | a link to the stored path; **missing-footage placeholder** when the path does not exist where the import runs (listed in `missingFootage`), a normal link when it does. The importer never opens footage. **An image sequence** (its alias is the folder) becomes a sequence of its files, named from the stored numbering (`shot_0101.exr` .. `shot_0103.exr` in 603, `seq_001.png` .. in 353), at its native frame rate; the first file is the footage's path and the one checked. Sequences and clips take the stored native frame rate and duration (603, 606). A sequence of more than 100 000 frames, or beyond a million file names in one import, links only its first file and is reported |
+
+Units, the "absent = default" rule and the keyframe templates are the reader's
+([aep-format.md](aep-format.md), sections 3.3–3.6). The importer converts them to EffectCraft's:
+
+- **Anchor Point** is stored as a fraction of the source size and becomes pixels; **Scale** and
+  **Opacity** are stored as fractions and become percent (ease speeds are scaled the same way);
+  Position is pixels, Rotation degrees.
+- **Time.** Keyframe times are layer time and become exact `Tick`s. A time that falls on a frame
+  of the composition is `FrameRate::tick_of(frame)`, so frames stay frames; other times round to
+  the nearest tick. The NTSC rates are stored as typed (`23976/800` is 29.97, `23976/1000` is
+  23.976) and become the exact rates 30000/1001 and 24000/1001 (59.94 and 119.88 likewise); every
+  other rate is kept as the stored fraction. A layer's in/out are `start + offset × stretch`,
+  computed on the stored denominators with the exact stretch ratio. A stored start, in or out time
+  with a zero denominator (or an in or out point out of range) is read as 0 and reported as
+  `damaged data`, so strict import refuses it.
+- **Position.** Absent means the composition centre at the time of the import. A composition that
+  was resized without moving the layer stores the old centre, and so does the project.
+- **Spatial tangents.** The switch at byte 8 of a spatial key (1 normally, 0 after the tangents
+  were set by hand) is read as "automatic spatial tangents": 1 becomes EffectCraft's automatic
+  tangents, 0 the stored tangents. That reading is a hypothesis from one sample pair (055/054), see
+  the open list in aep-format.md. Anchor Point keys keep their values and tangents, but their ease
+  is not decoded (bezier sides become linear and are reported).
+- **Masks without a path.** A mask whose path was never set stores no Mask Path entry (900); After Effects reads it back as the source rectangle `[0,0] [0,h] [w,h] [w,0]`, so it is imported as that rectangle (901, expansion -100: EffectCraft equal to After Effects on every pixel). On a text or shape layer, which has no source, it is reported.
+- **Masks.** The path is stored as `float32` points normalised inside a box that is normalised to
+  the layer's **source** size (090 on a 1920 x 1080 solid: `[560, 340] ... [1360, 740]`; 309 on a
+  100 x 100 solid: `[20, 30] ... [80, 70]`), so the vertices become layer pixels with the origin at
+  the layer's top left, as EffectCraft's masks are. A tangent is the handle minus the vertex (232:
+  the ellipse imports as EffectCraft's own 0.5523 x radius ellipse); the open bit makes an open
+  path (233). Feather and expansion are pixels, opacity a fraction (091: 20 / 20, 50 %, 5;
+  Subtract, inverted). Feather keys use the plain template with one ease per dimension in pixels
+  per second (208 linear, 306 bezier). The path keys are 64-byte records whose ease is not
+  decoded: a bezier side becomes linear and is reported as an approximated keyframe (093 has two
+  linear keys at 0 s and 1 s). Opacity and expansion keys and mask expressions use the same
+  verified property templates as the Transform properties but have **no sample** in the corpus.
+  Mask colour, lock, feather falloff, motion blur and RotoBezier are not decoded: the masks get
+  EffectCraft's default colour cycle and default switches (listed under `limitations`).
+- **Text layers.** A text layer has no source. Its layer space is the text's: for point text the
+  origin is the alignment point on the first baseline (left edge for left text, centre for centred,
+  right edge for right text), for box text the box is placed by its stored top-left corner; this is
+  how EffectCraft lays out text too, so nothing is converted. The **Anchor Point rule**: on a text
+  layer the stored anchor is taken as **pixels as stored** (not a fraction of a source size) and an
+  absent anchor is the text origin `[0, 0, 0]`, After Effects' default for new text. The default is
+  verified (no other text sample stores an anchor, and the samples' Position default is the comp
+  centre: 113 imports at `[960, 540]` with the baseline origin there); "pixels as stored" is
+  verified by 385 (Anchor Point `10, 20` is stored as `10, 20` and imports as `[10, 20, 0]`;
+  confidence V, see aep-format.md 3.4). The layer is created like a new text layer (spanning
+  the composition, anchor at the origin), so Position, Scale, Rotation and Opacity keys, their
+  expressions and the parent link import as on any layer.
+- **Fonts.** The font is kept as its PostScript name (`TimesNewRomanPSMT`); EffectCraft resolves
+  family names, full names and PostScript names, so an installed font is found as it is. A font
+  that is not installed keeps its name in the document (it is found as soon as it is installed),
+  is drawn with the renderer's fallback font and is listed once in `missingFonts`. A missing font
+  is not a loss and never refuses the import. Only the fonts the style runs use are checked (the
+  stored font list also holds unused entries such as `AdobeInvisFont`). The style is `Regular`;
+  faux bold and italic are imported as such. Real bold and italic fonts were not sampled.
+- **Leading.** A run with automatic leading gets EffectCraft's automatic leading (120 % of the
+  size, the same rule as After Effects: 400 lays its second line out 120 px below the first at
+  size 100); otherwise the stored leading in pixels (243: 98, 339: 60).
+- **Superscript.** Style slot /13 is superscript (1) or subscript (2); After Effects draws such text
+  at 58.3 % of the size, 33.3 % of the size above or below the baseline, as EffectCraft does
+  (526-528). Before this was decoded, superscript text arrived at its full size: 1.7 times as wide
+  and tall as in After Effects, with its baseline 33 % of the size too low. Synthetic check: 517, a 600 px box whose text wraps into
+  four lines in both programs once the size is right. The slot equalled the reference document, because every scripted text of the corpus is
+  superscript (526), so it was never reported. Render check after the fix: 243, 526-528 equal but
+  for anti-aliased edges (at most 0.15 % of the points); 517 has the same lines, but its first
+  baseline sits about 16 px lower than in After Effects (the first-line offset of superscript box
+  text, open).
+- **Style runs.** After Effects' last run also covers the final CR of the text, which EffectCraft's
+  text does not have; the runs are cut to the text. A range style splits `Hello` into runs of 1,
+  2 and 2 characters (248, 340).
+- **Null objects.** The hidden placeholder solid of a null object is not an item (null layers
+  have no source item here). A null's Anchor Point that is not stored is its top-left corner
+  `[0, 0]`, not the centre, as After Effects 2026 reads it back (#3099).
+- **Placed Illustrator and PDF files** (`.ai`, `.pdf`; `Footage::placed_page`): the page is
+  framed as After Effects places it (the ArtBox clipped to the crop box, `/Rotate` ignored) and
+  drawn to fill the stored footage size, which masks and anchors are measured against (#3099).
+  Create Shapes from Vector Layer on such a layer adds a hidden `<layer> Frame` shape layer, the
+  Alpha track matte of every layer it makes, so they show only the frame, as the footage does.
+  EPS files keep their bounding box at their own size: how After Effects sizes them is not
+  measured.
+- **Track mattes.** The mode and the matte layer's id are in the target layer's header
+  (aep-format.md 3.1). The matte layer can be any layer of the composition (407: below its
+  target); it keeps its stored video switch (After Effects switches it off when the matte is set,
+  403; 408 has it switched back on), and EffectCraft, like After Effects, uses a hidden layer as a
+  matte. A mode without a matte layer id has no corpus case (After Effects 2026 always writes the
+  id); it is read as the layer directly above, which is how track mattes worked before After
+  Effects 23.0. Tests: `crates/aep/tests/it/import/mattes.rs` (403-408, the id-less form built
+  in-test, hostile ids and modes).
+
+### Effects
+
+A table in `crates/aep/src/container/effect_map.rs` (shared with the exporter, which writes the inverse) maps an effect's match name and each parameter's
+index in the file's parameter list to an EffectCraft effect id, a parameter id and a unit
+conversion; it also names the parameter type the file must declare and, for sliders, the valid
+maximum it was verified with (`pard@128` for fixed sliders, `pard@108` for float sliders). A parameter whose type or maximum differs is reported,
+not guessed. `supported_effects()` lists the table. The effect is built with EffectCraft's own
+defaults (`effectcraft_effects::instantiate` on the layer's source size), then every mapped
+parameter gets the file's value:
+
+| After Effects (match name, index) | EffectCraft | Conversion | Evidence |
+|---|---|---|---|
+| `ADBE Tint` 1 Map Black To, 2 Map White To | `black`, `white` | ARGB 0..255 -> RGBA 0..1, alpha 1 | 356, 357; keys 364 |
+| `ADBE Tint` 3 Amount to Tint | `amount` | stored percent (valid max 100) x 1 | 356, 361, 362; keys 363 |
+| `ADBE Ramp` 1 Start of Ramp, 3 End of Ramp | `start`, `end` | fraction of the layer size x source size = layer pixels; outside 0..1 stays outside | 368, 369, 374, 383; keys 382 |
+| `ADBE Ramp` 2 Start Color, 4 End Color | `startColor`, `endColor` | ARGB 0..255 -> RGBA 0..1, alpha 1 | 368, 371 |
+| `ADBE Ramp` 5 Ramp Shape | `shape` | 1-based popup -> 0-based (Radial 2 -> 1) | 368, 377 |
+| `ADBE Ramp` 6 Ramp Scatter | `scatter` | pixels (valid max 512) x 1 | 368, 378 |
+| `ADBE Ramp` 7 Blend With Original | `blend` | 0..1 fraction (valid max 1) x 100 = percent | 368, 380 |
+| `ADBE Exposure2` 1 Channels | `channels` | 1-based popup -> 0-based (Individual Channels 2 -> 1) | 389, 390, 395 |
+| `ADBE Exposure2` 3, 8, 13, 18 Exposure (Master, Red, Green, Blue) | `master/exposure`, `red/redExposure`, `green/greenExposure`, `blue/blueExposure` | stops (float slider, valid max 100) x 1 | 389, 391, 392, 395; keys 397 |
+| `ADBE Exposure2` 4, 9, 14, 19 Offset | `master/offset`, `red/redOffset`, `green/greenOffset`, `blue/blueOffset` | plain (valid max 2) x 1 | 389, 393 |
+| `ADBE Exposure2` 5, 10, 15, 20 Gamma Correction | `master/gamma`, `red/redGamma`, `green/greenGamma`, `blue/blueGamma` | plain (valid max 10, default 1) x 1 | 389, 394 |
+| `ADBE Exposure2` 22 Bypass Linear Light Conversion | `bypassLinearLight` | checkbox: record 1.0 = on, no record = off | 389, 396 |
+| `ADBE Invert` 1 Channel, 2 Blend With Original | `channel`, `blend` | popup by item name (the file's 16 items include three separators); percent x 1 | 409-411 |
+| `ADBE Box Blur2` 1 Blur Radius, 2 Iterations, 3 Blur Dimensions, 4 Repeat Edge Pixels | `radius`, `iterations`, `dimensions`, `repeatEdge` | pixels (valid max 30 000); integer (valid max 50); popup by name; checkbox, **default on** | 412-416, 525 |
+| `ADBE Gaussian Blur 2` 1 Blurriness, 2 Blur Dimensions, 3 Repeat Edge Pixels | `blurriness`, `dimensions`, `repeatEdge` | float (valid max 30 000, default 25); popup by name; checkbox, **default on** | 214, 216, 417-419, 522 |
+| `ADBE Drop Shadow` 1 Shadow Color, 2 Opacity, 3 Direction, 4 Distance, 5 Softness, 6 Shadow Only | `color`, `opacity`, `direction`, `distance`, `softness`, `shadowOnly` | colour; 0..255 (valid max 255) x 100 / 255 = percent; degrees; pixels (4 000); pixels (30 000); checkbox | 080, 420-426, 523 |
+| `ADBE Glo2` 1 Glow Based On, 2 Threshold, 3 Radius, 4 Intensity, 5 Composite Original, 6 Glow Operation, 7 Glow Colors, 8 Color Looping, 9 Color Loops, 10 Color Phase, 11 A & B Midpoint, 12 Color A, 13 Color B, 14 Glow Dimensions | `based`, `threshold`, `radius`, `intensity`, `operation`, `glowOperation`, `colors`, `colorLooping`, `colorLoops`, `colorPhase`, `abMidpoint`, `colorA`, `colorB`, `glowDimensions` | popups by name (After Effects' defaults Color Channels, Behind, Add, Original Colors, Triangle A>B>A); threshold 0..255 -> percent; radius pixels (1 000); intensity (255); loops (127); phase degrees; midpoint 0..0.99 x 100 = percent; colours | 427-441, 524 |
+| `ADBE Fill` 2 All Masks, 3 Color, 4 Invert, 5 / 6 Horizontal / Vertical Feather, 7 Opacity | `allMasks`, `color`, `invert`, `horizontalFeather`, `verticalFeather`, `opacity` | checkboxes; colour; pixels (999); 0..1 x 100 = percent. Fill Mask (a path reference) is reported when set | 079, 210, 215, 302, 303, 307 |
+| `ADBE HUE SATURATION` 1 Channel Control, 2 Channel Range data, 6 Colorize, 7 Colorize Hue, 8 Colorize Saturation, 9 Colorize Lightness | `channelControl`; `hue`, `saturation`, `lightness` from the data; `colorize`, `colorizeHue`, `colorizeSaturation`, `colorizeLightness` | popup by name; the master hue (degrees), saturation and lightness are the `i32` of the arbitrary data (the visible Master parameters keep no record); the colour ranges are reported when they are not at their defaults (not sampled) | 443-450 |
+| `ADBE Easy Levels2` 1 Channel, 2 Histogram data, 8 / 9 Clip To Output Black / White | `channel`; `inBlack`, `inWhite`, `gamma`, `outBlack`, `outWhite` from the data; `clipToOutputBlack`, `clipToOutputWhite` | popups by name (After Effects' items On, Off, Off for 32 bpc Color are in another order here); the RGB values are the `f32` of the arbitrary data; the per-channel values are reported when they are not at their defaults (not sampled) | 511-516 |
+| Batch 6 (903 defaults, 904 / 905 set values): `ADBE Brightness & Contrast 2`, `ADBE Turbulent Displace`, `ADBE Fractal Noise`, `ADBE Laser` (Beam), `CC Radial Fast Blur`, `ADBE Noise2`, `ADBE Pro Levels2` (Levels (Individual Controls)), `ADBE Corner Pin`, `ADBE Grid`, `ADBE Sharpen`, `ADBE Linear Color Key2`, `ADBE Radial Wipe`, `ADBE Remove Color Matting`, `CC Bend It`, `CC Power Pin`, `ADBE 4ColorGradient`, `ADBE Change Color`, `ADBE Extract`, `ADBE Noise HLS2`, `ADBE Scatter`, `CC Light Sweep`, `ADBE Compound Blur`, `ADBE Displacement Map`, `ADBE Set Matte3`, `ADBE Gaussian Blur` (legacy), `ADBE OFMotionBlur` (Pixel Motion Blur), `ADBE Layer Control` | the EffectCraft effect of the same name, every parameter EffectCraft has | sliders as stored (each checked against its valid maximum); Beam Length, Time and Softness and CC Power Pin Perspective are 0..1 fractions, percentages here; points as layer pixels; popups by item name (Set Matte's `Red Channel` ... is `Red` ...); twirl-down group markers and the Levels histogram carry nothing; **layer parameters** (below) | 903, 904, 905; 220, 320, 321 |
+| `Cryptomatte` (the Cryptomatte plug-in) 1 Settings data, 2 Output, 3 Selection Mode | `ec.3d.cryptomatte` `layerName`, `selection`; `display`, `matteOnly` | the layer name and the selection text from the data, verbatim (`CryptomatteData`; Layer Name picks the footage's Cryptomatte layer of exactly that name, the Layer popup is the fallback; the `<hex>` selection tokens are EffectCraft's selection grammar); Output Colors -> Display Colors, Matted RGBA -> Display Matte, Matte Only -> Matte Only on (Display Matte); **Matted Colors** (the ID colours keyed by the selection) has no counterpart: imported as Display Matte (the same matte over the layer's own colours) and reported; no Output record is the plug-in's default Colors (also for a borrowed definition; Colors too for an Output that is keyed, has an expression or cannot be read, each reported); Selection Mode (the plug-in's picking switch) is reported when on, also in the default-state record After Effects writes for it; keys or expressions on any of them are reported; unreadable data is damaged data (no layer, no selection). **Render-compared** with After Effects (1400): with a chosen layer and a picked object (the two preset compositions, Output Colors) EffectCraft's matte covers exactly the pixels After Effects draws as selected (6 012 fully covered for the box on CryptoObject, 10 962 for box and disc on CryptoMaterial, the same counts; on the 190 edge pixels of the latter the coverage implied by After Effects' frame is EffectCraft's within 0.0002); After Effects' Colors draws the selection as `c * (1 - m) + m` (a fully selected pixel white), EffectCraft's Colors as `c * (1 - m / 2) + m / 2`, and the ID colours themselves differ, so Colors is not compared per pixel. With the fresh data (empty selection, every matte 0): Matted RGBA matches (transparent); Matte Only differs in alpha (After Effects: the matte in RGB, opaque; EffectCraft: the matte in RGBA, so the same over black and as a luma matte, not as an alpha matte); Matted Colors is transparent in After Effects and in the imported Matte; Colors is a preview of the IDs and not compared per pixel (After Effects' colours are near black and, with no layer chosen, show the footage's first Cryptomatte layer, CryptoMaterial in 1400, where EffectCraft's Layer popup starts at CryptoObject); what Selection Mode draws is not reproduced | aep-format 3.7 (88 instances of one project; 1400); test `import::cryptomatte` |
+| Importer block 2026-11-05 (`1100-quickwins.aep`: per effect defaults, set values, minimum and maximum, every popup item, a keyed and an expression parameter): `ADBE HDR ToneMap` (HDR Highlight Compression) 1 Amount; `ADBE Echo` 1 Echo Time, 2 Number Of Echoes, 3 Starting Intensity, 4 Decay, 5 Echo Operator; `ADBE Linear Wipe` 1 Transition Completion, 2 Wipe Angle, 3 Feather; `ADBE Offset` 1 Shift Center To, 2 Blend With Original; `ADBE Deflicker` (Color Stabilizer) 1 Stabilize, 2-4 Black / Mid / White Point, 5 Sample Size | `ec.utility.hdrcompression` `amount`; `ec.time.echo` `echoTime`, `numberOfEchoes`, `startingIntensity`, `decay`, `echoOperator`; `ec.transition.linearwipe` `completion`, `angle`, `feather`; `ec.distort.offset` `shift`, `blend`; `ec.color.colorstabilizer` `stabilize`, `blackPoint`, `midPoint`, `whitePoint`, `sampleSize` | percent (float, valid 0..100, default 100); seconds (float, valid ±30 000), integer (valid 30 000), 0..1 (float), Decay as stored (float, valid 0..100), popup by name: EffectCraft's Echo uses at most 255 echoes and a Decay up to 1, a value or key beyond that is imported as stored and **reported**; percent (fixed, 100), degrees, pixels (fixed, 32 000); point in layer pixels, Blend 0..1 x 100 = percent; popup by name (**fresh default Levels**), points in layer pixels, Sample Size as stored (fixed, valid 50, default 3; its unit, pixels here, is not verified). Color Stabilizer's reference frame (Set Frame) is not a parameter in the file and is not imported (EffectCraft's Reference Frame stays 0 s) | `tests/it/import/effects_quickwins.rs`; render comparison below |
+| Importer block 2026-11-05 (`1300-thirdparty.aep`), plug-ins that ship with After Effects: `CS Color Neutralizer` (CC Color Neutralizer) 19 Pinning, 20 Blend w. Original; `EXtractoR` 1 Channel Info data, 3 Black Point, 4 White Point, 5 UnMult; `IDentifier` 1 Channel Info data, 2 Display, 3 ID | `ec.color.cccolorneutralizer` `pinning`, `blendWOriginal`; `ec.3d.extractor` `red`, `green`, `blue`, `alpha`, `blackPoint`, `whitePoint`, `unMult`; `ec.3d.identifier` `channelType`, `display`, `id` | CC Color Neutralizer: percent (float, valid 100); its correction is the Red / Green / Blue slider of each range (the Unbalance colours are pickers that set them and keep no record), with View and Black / White Point: **EffectCraft's effect has no counterpart, each is reported when stored** (EffectCraft's Unbalance / Balance stay at their identity defaults). EXtractoR: each output channel by the footage channel's name, which EffectCraft's EXtractoR reads by the same name (the default R, G, B; `Z` from our preset), and `(copy)` as the input's own channel of that position (EffectCraft's R, G, B or A; the default Alpha is A); a record of another kind or without a name is reported and R, G, B, A used (`ExtractorChannels`), Black and White Point as stored (float, valid ±3.4e38; a value beyond ±1e9 is reported as damaged data, as for every number), UnMult a checkbox, Clip stays off. IDentifier: Display by name, ID as stored (integer, valid 2 147 483 647); the Channel Info names the chosen channel (`identifier_channel_type`): After Effects lists only the footage's integer (UINT) channels, and with none chosen (the data then says `Object ID`) it leaves the layer unchanged, where EffectCraft draws the footage's object ID channel: **reported**; a chosen channel named `ObjectID` or `MaterialID` (without regard to case, `objectId` in our preset) is the one EffectCraft's IDentifier reads itself (Channel Type Object ID or Material ID), any other name is reported (EffectCraft's IDentifier has no channel choice) | `tests/it/import/effects_thirdparty.rs`; render comparison below |
+| `ADBE Slider Control`, `ADBE Angle Control`, `ADBE Checkbox Control`, `ADBE Color Control`, `ADBE Point Control` (parameter 1) | `ec.control.slider` `slider`, `ec.control.angle` `angle`, `ec.control.checkbox` `checkbox`, `ec.control.color` `color`, `ec.control.point` `point` | float (valid max 1 000 000) as stored; degrees; checkbox; colour; point in layer pixels | 071, 073, 217-219, 221, 304, 310 |
+| `ADBE Lumetri` by match-name suffix (1200), not by index: -0062 High Dynamic Range; -0063 HDR White; -0007 / -0008 Temperature / Tint; -0020 Saturation; -0011 Exposure; -0012 ... -0016 Contrast, Highlights, Shadows, Whites, Blacks; -0064 HDR Specular; -0026 Look Intensity; -0028 Faded Film; -0029 Sharpen; -0030 Vibrance; -0031 Saturation; -0033 Tint Balance; -0074 Show Mask; -0075 mask style; -0076 Invert Mask; -0081 Denoise; -0082 Blur; -0086 ... -0090 the HSL correction's Temperature, Tint, Contrast, Sharpen, Saturation; -0051 ... -0054 Vignette Amount, Midpoint, Roundness, Feather; -0073 the HSL key data; -0039 the first of the four RGB curves; -0042 Hue vs Sat; -0047 the Shadows, Midtones and Highlights wheels | `highDynamicRange`, `basicCorrection/tone/hdrWhite`, `basicCorrection/whiteBalance/temperature` / `tint`, `basicCorrection/saturation`, `basicCorrection/tone/exposure`, `.../contrast`, `highlights`, `shadows`, `whites`, `blacks`, `hdrSpecular`, `creative/lookIntensity`, `creative/adjustments/fadedFilm`, `sharpen`, `vibrance`, `creativeSaturation`, `tintBalance`, `hslSecondary/key/showMask`, `maskStyle`, `invertMask`, `hslSecondary/refine/denoise`, `blur`, `hslSecondary/correction/*`, `vignette/*`; `hslSecondary/key/hue*`, `saturation*`, `lightness*`; `curves/rgbCurves/master`; `curves/hueSaturationCurves/hueVsSat`; `colorWheels/shadowsWheel`, `midtonesWheel`, `highlightsWheel` | sliders: the stored number x 1 (valid maxima 1000, 300, 300, 7, 150, 200, 150, 100, 100, 300, 150, 100, 1000, 5, 100 as in `pard`); checkboxes and the popup as elsewhere, **also from records in the default state** (`tdsb` 3); the key: hue centre x 360 degrees, range x 360 as the half width, tolerance x 360 as the softness, saturation and lightness centre +- range x 100 percent, tolerance x 100, once a colour was picked; the master curve's points as `x,y` (0..1); Hue vs Sat's points with y as `0.5 + y / 2` (After Effects' y 1 doubles the saturation, EffectCraft's y 1 too); a wheel's hue (degrees) and distance as the HSL colour of that hue with saturation = distance and lightness 0.5 | 1200: all 62 read-backs of mapped controls in sections that act equal after import (min, max, sections, popups); the other 61 lie in sections that do nothing and are reported; keys and the expression on HDR White (`-56-keys`, `-57-expr`); the presets `-60-preset-curves-rgb`, `-61-preset-curves-huesat`, `-62-preset-wheels` |
+
+- **Nothing to import:** the implicit input-layer parameter (index 0), the Swap Colors buttons
+  (Tint 4, Ramp 8: they always have a record and hold no value), Exposure's twirl-down group
+  markers (start / end of Master 2 / 6, Red 7 / 11, Green 12 / 16, Blue 17 / 21: always a record,
+  no value) and the closing built-in entry.
+- **Defaults.** A parameter without a value record has the default in the file's `pard`, also a
+  checkbox (Repeat Edge Pixels is on by default, 412 / 417) and a popup. After Effects' defaults
+  differ from EffectCraft's in places (Gaussian Blur's Blurriness 25, Repeat Edge Pixels on, Glow's
+  Composite Original Behind), so they are always set from the file. A popup whose definitions are
+  borrowed from the project's shared list has no trustworthy default slot (a selection writes into
+  it): the table's After Effects default (read back for a fresh effect) is used.
+- **Popups by name.** A popup value is the 1-based index of the file's item list (separators
+  included, 410); it is mapped to the EffectCraft item of the same name, because the orders differ
+  (Levels' Clip To Output Black / White: On, Off, Off for 32 bpc Color in After Effects, Off, On,
+  ... here). An item EffectCraft does not have (Glow's None, Dissolve, Stencil ... operations) is
+  reported and the parameter keeps its default. A popup may come without its item
+  names (`pdnm`), also in the project-level definitions; the importer then uses After Effects'
+  item list as the corpus stores it (368, 389, 409, 412, 417, 427, 443, 511), but only when the
+  item count in `pard` agrees; otherwise the parameter is reported (test
+  `popups_without_item_names_use_after_effects_items`). Before, such a popup was reported as damaged
+  data.
+- **Layer parameters** (Set Matte's Take Matte From Layer, Displacement Map's map layer, Compound
+  Blur's Blur Layer, Layer Control): the file stores the chosen layer's id (`tdpi`, the same id
+  as the parent link; 0 = None; the owning layer's own id = "this layer", the default; 220, 320,
+  321, 904 E22-E24). The id is resolved once every layer of the composition exists (the layer can
+  sit below); a layer that was not imported is reported and the parameter stays unset. "This
+  layer" is the owning layer for Layer Control and EffectCraft's unset layer for the effects,
+  whose unset layer is the layer itself. None is unset for Layer Control and the explicit None
+  `NO_LAYER` (`Value::Layer(Some(0))`, never a layer id) for the effects, so it stays
+  None (After Effects renders Set Matte None and self differently: `export-tests\fx27\ae\layer-none`). After Effects hands the named layer's **source** to the
+  effect, without its masks and effects (904 E24: Set Matte's luminance from a grey solid that
+  carries a Gradient Ramp is the grey's, 0.5 everywhere), so the companion choice is set to
+  Source (EffectCraft's own default is Effects & Masks; where After Effects stores another choice
+  is not sampled). Keys and expressions on a layer parameter are reported.
+- **Render check, batch 6** (904, one effect per composition on a PNG of grey and colour bands,
+  1 s, 20 px grid): Remove Color Matting, Displacement Map, Set Matte equal (Set Matte was 4 640
+  points off before the Source rule); Change Color within 1/255; Sharpen 0 grid points (edges
+  only); Corner Pin 12, CC Power Pin 24 edge points; differences in EffectCraft's renderer
+  (values checked in the imported project): Brightness & Contrast up to 6/255, Levels (Individual
+  Controls) up to 27/255, 4-Color Gradient up to 34/255, Linear Color Key and Extract on the
+  coloured bands (Extract keeps pure blue at 231 in After Effects, EffectCraft keys it out:
+  luminance weights), Radial Wipe edge / feather, CC Light Sweep, Compound Blur, Beam (89 points),
+  CC Radial Fast Blur, CC Bend It (After Effects' Bend 30 bends far more than EffectCraft's),
+  Turbulent Displace and Fractal Noise (other noise). Noise, Noise HLS and Scatter are random and
+  were not compared.
+- **Render check** against After Effects at 1 s (20 px grid, 5 184 points): Invert 410 / 411,
+  Hue/Saturation 444-447, Levels 515 / 516, Fast Box Blur 525: every point equal or within 1/255;
+  Gaussian Blur 522, Drop Shadow 523 within 2/255; Glow 524: 27 points differ, all on the one-pixel
+  column just outside the layer: After Effects' Glow draws a dark halo about 10 px wide outside the
+  layer (red 0.55, 0.65, 0.74, 0.92 at 0, 1, 2, 5 px), EffectCraft's Glow none (an effect
+  difference, recorded for a separate fix).
+- **Lumetri Color** (1200, `crates/aep/src/import/lumetri.rs`). The parameters are found by match
+  name (After Effects inserted `-0127` ... `-0130` mid-list; five tone sliders share one valid range,
+  so an index shift would not be caught). Values come from every value record, also those in the
+  default state (`tdsb` 3), where Lumetri keeps High Dynamic Range, HDR Specular and the second Look
+  popup. EffectCraft's Lumetri has no section switches: a section that is off in After Effects
+  (Basic Correction, Creative, Curves / RGB Curves, each hue / saturation curve, Color Wheels, HSL
+  Secondary, Vignette), and HSL Secondary without a picked key colour, does nothing there, so its set
+  values are listed in one report line and not imported (the frame stays as After Effects draws it).
+  The Input LUT and the Look are reported by name (LUT files are not in the project). Controls
+  without a counterpart (the Auto tone's Intensity, RGB Curves' HDR Range, Color Wheels' HDR White and
+  Face Detection, Legacy Tone And Saturation, Auto Color, SpeedGrade Custom Layer), the eyedropper
+  colours, the red, green and blue curves (only the master curve is sampled, so which is which is
+  not known), the colour wheels' brightness sliders and their fourth wheel, Split Toning, the HSL
+  correction wheels and moved points of the other four hue / saturation curves (not sampled) are
+  reported when set. The master RGB curve arrives as its points; Hue vs Sat with y as `0.5 + y / 2`
+  (After Effects' y is the offset from neutral, 1 doubling the saturation; EffectCraft's y = 1
+  doubles it); a colour wheel's hue and distance as the HSL colour of that hue with saturation =
+  distance, lightness 0.5 (EffectCraft's wheels have no brightness slider). Legacy Tone And
+  Saturation is reported when a record says on: its `pard` default turns from off to on when the
+  project is saved again. Render check at 0.5 s against After
+  Effects' 32 bpc PNGs (stored as value x 6553.5 in 16 bits, so read as raw / 6553.5): every
+  composition whose grade After Effects draws as identity (defaults, set-all with every section off,
+  the switched-off sections, the popups, keys, expression) is within 1/255 in EffectCraft; the
+  graded ones differ by EffectCraft's Lumetri formulas, not by the import: White Balance (sec-color:
+  After Effects warms and brightens, max 0.10 above the default; EffectCraft darkens, mean error
+  0.015), Exposure / tone (sec-light: After Effects rolls highlights off and lifts the blacks to 0.18,
+  EffectCraft clips at 1 and keeps black at 0; mean 0.12), Creative adjustments (sec-adjustments:
+  Faded Film lifts black to 0.07 in After Effects, 0.035 here) and the extremes (min / max: mean 0.063 /
+  0.454; max: After Effects' vignette at +5 and the tone sliders give mid grey, EffectCraft white).
+  The 32 bpc PNGs hold the pixel value with no transfer curve (the defaults' ramp reads x / 320
+  exactly), so values above 1 survive up to about 10; the comparison clips After Effects at 1 as
+  EffectCraft's 8-bit frame does. The hand-made presets: the master RGB curve within 0.024 (mean
+  0.009; After Effects' curve is a natural cubic spline through the points, within 0.003, while
+  EffectCraft's Lumetri interpolates monotone); Hue vs Sat mean 0.008, max 0.18 (After Effects
+  scales the saturation in linear light, red reaching 1.26; EffectCraft in display values, 8.3 % of
+  pixels > 2 levels); the colour wheels mean 0.042, max 0.13 (the hues go the same way: Shadows
+  lift blue at black by 0.13 in After Effects, 0.17 here; Highlights add green; the brightness
+  sliders are not imported); the Input LUT and the Look are not imported (mean 0.088 / 0.076).
+- **Colour.** After Effects stores the colour its picker shows as ARGB doubles 0..255 in the
+  project's working-space encoding; EffectCraft's parameter colours are straight RGBA 0..1 that the
+  render pipeline hands to the effect as stored (`crates/render/src/color.rs`: authored colours are
+  in the working space's encoding; no conversion is applied to effect parameters). So the value is
+  divided by 255 with no transfer curve, as the solid colour already is. **Alpha:** Tint's defaults
+  store alpha 0 (After Effects reads them back as `[0,0,0,0]` and `[1,1,1,0]`), set values store
+  255. After Effects colour parameters have no editable alpha and both EffectCraft effects use only
+  red, green and blue (CPU and GPU paths), so every imported colour gets alpha 1, EffectCraft's
+  own default.
+- **Exposure.** The sliders are float sliders whose stored value is the float32 After Effects keeps
+  (Offset 0.1 arrives as 0.10000000149, Gamma 2.2 as 2.2000000477), imported as stored. Units are
+  the same in both programs (stops, plain offset, plain gamma). The ranges are not: After Effects
+  accepts Exposure -100..100 (slider -4..4) and Gamma Correction 0.1..10, EffectCraft's Exposure
+  declares -20..20 (slider -5..5) and 0.01..9.99. A value outside EffectCraft's range is imported
+  unchanged and not reported (the effect renders it; editing it in EffectCraft clamps it to
+  EffectCraft's range). With Channels = Master the per-channel values are inactive in both programs
+  and are imported as stored. Keys on the Bypass checkbox are not sampled: reported, not imported.
+- **Second instances.** When several layers carry the same effect type, only one instance has its
+  parameter definitions; the others take them from the file's shared list by match name but read
+  their values only from their own records (383: L's Ramp is the default although the shared copy
+  holds S100's Start [10, 20]). An instance without any readable definitions is reported.
+- **Keyframes** of effect parameters are layer time like all keys. Linear keys are verified (363,
+  364, 382). For a bezier slider key the ease speed is scaled like the value (the transform rule;
+  inferred, not sampled for effects). An effect point's speed, like the Anchor Point's, is stored
+  divided by the layer height (597, 598, 730; EffectCraft's values at 0.5 / 1 / 1.5 s within 0.5 px
+  of After Effects'). Colour keys switched to bezier store speed 0 and influence 0 and After Effects
+  interpolates them linearly (598), so they arrive linear; another colour ease and the ease of
+  popups are not decoded, such bezier sides become linear and are reported in
+  `approximated_keyframes`.
+- **The fx switch** of each instance (the `tdsb` of its value group: 1 on, 0 off; `fx-switch.aep`)
+  is imported and exported, and so is an expression on a stored effect parameter (its text and its switch).
+
+## What is reported
+
+`ImportReport` (`serde`, returned as JSON) has `imported` (counts, including `textLayers`),
+`losses` (per category: `count` exact, up to 20 `details`), `missingFootage`, `missingFonts`
+(PostScript names; not losses), `limitations` and `aeVersion`. The categories:
+
+| Category | Counted |
+|---|---|
+| `effects` | each effect on an imported layer that is not in the table (by name and match name); for an imported effect: each stored parameter outside the table, a parameter whose type or valid maximum differs from the table, keys or an expression on a layer parameter, an effect without readable parameter definitions |
+| `masks` | a mask that is not imported because its path cannot be used (a Mask Path entry without shapes, a mask on a text or shape layer whose path was never set (its default is not sampled), unreadable, no vertices, a point count that is not a multiple of three, more than 65 536 vertices, numbers that are not finite), a mask mode code outside the seven known ones (imported as Add) |
+| `layer_styles` | per layer: a style in switch state 3 (not sampled; state 0 is imported as a style switched off, 988), Pattern Overlay, an unknown style or parameter, a gradient (`GCst`, not decoded: EffectCraft's default gradient stays), keys on a popup or checkbox, a value that does not fit, styles on a layer that takes none here (adjustment, camera, light) |
+| `markers` | a marker with an unknown cue type (imported as an event cue) |
+| `text_layers` ("text layer features") | per text layer, what of it is not imported: wiggly and expression selectors and unmapped animator properties, Path Options or More Options with set values, Source Text keyframes or an expression, character style or paragraph fields that are not decoded and differ from the default (named by their slot, e.g. `/68`), an unknown capitalisation or justification code, manual kerning, No Break, the stroke line join, the Japanese leading model, a digit set other than the default and Arabic, control characters of unknown meaning (they are kept in the text; U+0003 is not one of them, see Text above). The text layer itself is imported |
+| `shape_layers` ("shape layers") | what of a shape layer is not imported: shape items other than groups, rectangle, ellipse, polystar, path, fill, stroke, gradient fill and stroke, trim paths, round corners, merge paths, repeater and offset paths (for example wiggle or twist), stroke dashes, taper and wave with values, item blend modes and composite order, shape direction, gradient colour stops other than the default, gradient highlight values other than 0, material options, groups nested deeper than 32, a line cap or join of the unsampled third kind (imported as it), a path without a readable path. The layer itself is imported |
+| `lights` | each environment light (the layer is skipped; the other layers of the composition are imported) |
+| `blend_modes` | a blend mode code that is not mapped (1, 3 = Dissolve or Dancing Dissolve, 21 / 22 = Alpha Add or Luminescent Premul, codes above 34; the layer stays Normal) |
+| `transform_properties` | a stored transform property that is not imported (keyed or expression-driven orientation, separated position dimensions), and the stored camera and light options that are not mapped (Blur Level, Iris, Falloff, ...) |
+| `time_remapping` | an enabled Time Remap without a readable keyframe |
+| `approximated_keyframes` | a key imported in a simpler form (unknown interpolation code, bezier ease that cannot be decoded: a colour key with a non-zero ease, non-finite ease data; a mask path key with a speed other than 0, imported unverified) |
+| `parent_links` | a parent that was not imported (a skipped camera, a missing layer) or that forms a loop |
+| `track_mattes` | a track matte of unknown mode, whose matte layer was not imported or does not exist, a layer matted by itself, or a matte of the older "layer above" form on the top layer |
+| `unsupported_layers` | an unknown layer type, a layer without a usable source, a precomposition loop (the layer is cut) |
+| `unsupported_items` | a project item of an unknown kind |
+| `damaged_data` | a header, key or value that could not be read, numbers that are not finite or beyond ±1e9 (default used); an unreadable text document (the text layer is imported with empty text), damaged style runs |
+
+`limitations` states what the reader cannot see at all, so it can be neither imported nor counted:
+frame blending, 3D material options, audio levels, guides, the mask colour, lock, feather falloff, motion blur and RotoBezier switches, and for text per-character 3D, text on a path and style slots of unknown meaning (stored values of these that differ from the default are reported as text layer features). They are listed in every report.
+
+`aeVersion` names the After Effects versions of the file, decoded from the container
+([aep-format.md](aep-format.md), section 1, "Versions"), never from the XMP packet (whose
+`CreatorTool` names the application of the first save, "Adobe After Effects 2026" even in a copy saved
+for 24.x):
+
+| Field | Meaning |
+|---|---|
+| `fileVersion` | the version the file is written for (`head`): `26.2.1x2` for a file After Effects 26.2.1 saved, `25.6.0x97` / `24.6.0x65` for a copy it saved with File > Save a Copy As 25.x / 24.x; `unknown` when the chunk is missing, short or holds no version |
+| `savedBy` | the version of the After Effects that wrote the file (`svap`): `26.2.1x2` for those copies too; `unknown` likewise |
+| `tested` | whether the major of `fileVersion` is one the importer is tested with: 24, 25 and 26 (`TESTED_MAJORS`). A major-version classification only: the 24.x and 25.x samples are copies saved by After Effects 2026 (Save a Copy As), not files authored by those versions, and it does not guarantee that every older plug-in definition was verified |
+
+A file written for another version (or an unknown one) is imported like any other: the importer
+reports the losses it detects and lists its general limitations (`limitations`), but it does not
+claim a complete import, since some content is skipped (environment lights, for one) and some
+features cannot be detected or counted (frame blending, for one). It is not refused for its version (the version is not a
+loss); `limitations` gets one more line saying that the version is not tested.
+
+**Files written for 25.x and 24.x.** Every family of the corpus (12, including the Lumetri samples
+`1200`) saved by After Effects 2026 and copied with Save a Copy As 25.x and 24.x imports to the same
+project and the same report as the 2026 save, apart from `aeVersion`
+(`crates/aep/tests/it/import/versions.rs`; the fixture tests are ignored until the corpus holds the
+files). What the copies change in the container is not read by the importer (aep-format.md, section 1).
+These copies are written by After Effects 2026, so they show how 2026 writes an older file, not what
+After Effects 24 or 25 themselves write: an effect's parameter definitions, for example (the valid
+ranges of Lumetri Color among them), are those of the 2026 plug-in in all three files.
+
+## How fidelity is checked
+
+- `crates/aep/tests/it/import/aepx.rs`: the `.aepx` of five fixtures imports to the same project and
+  report as their `.aep` (the reader turns both into the same chunk tree, see
+  [aep-format.md](aep-format.md), section 1, "The XML form"); over the whole local corpus all pairs
+  import alike.
+- `crates/aep/tests/it/import/effects_batch5.rs`: Invert, Fast Box Blur, Gaussian Blur, Drop Shadow,
+  Glow, Hue/Saturation, Levels, the expression controls and Fill import without losses with the
+  values they were made with (410-448, 512-516; 071, 073, 080, 214-219, 221, 303, 304), including
+  After Effects' defaults where they differ from EffectCraft's.
+- `crates/aep/tests/it/import/effects.rs`: Tint, Gradient Ramp and Exposure from the batch-4 fixtures
+  (356-397; Exposure: defaults 389, Channels 390, Exposure 391, Offset 393, Gamma 394, Red
+  Exposure 395, Bypass 396, keys 397 with 0.5 at 1 s):
+  every converted value against the case's value (colours, points in pixels including outside the
+  layer and on a 100x100 solid, popup, scatter, blend in percent, amount), keys and the value
+  between them (363: 50 at 1 s; 364: grey at 1 s; 382: [950, 500] at 1 s), the defaults equal to
+  EffectCraft's, stack order with a reported Gaussian Blur (366), the second instance (383), and
+  lossless imports without `allowLosses`.
+- `crates/aep/tests/it/import/effects_quickwins.rs` (#3110): HDR Highlight Compression, Echo,
+  Linear Wipe, Offset and Color Stabilizer, each built into `synthetic.aep` (`fx_inject.rs`, which
+  also checks that its `pard` layout reads back) with the definitions and values of the importer
+  block of 2026-11-05. Render check of that block's 75 compositions (320x180, 32 bpc, working space
+  None, 0.5 s) against After Effects' frames (its `saveFrameToPng` of a 32 bpc project writes
+  `floor(value x 25)` per channel, so values are compared at that quantisation): Offset (5), Linear
+  Wipe defaults / min / max, Echo with the Add, Maximum, Minimum, Screen operators and the keyed and
+  expression variants, Color Stabilizer with every Stabilize item and Sample Size up to 25 match
+  within one level. Differences, all in EffectCraft's effects and not in the mapping: HDR
+  Highlight Compression's curve (up to 6 of 25 levels on 19 % of the pixels at Amount 100, equal
+  at Amount 0); Echo's Blend operator (After Effects' frame is as bright as Add's, EffectCraft
+  averages) and the edge of the moving square with Composite In Back / Front (0.5 % of the
+  pixels); Linear Wipe's feathered edge (0.6 % of the pixels); Color Stabilizer with a Sample Size
+  over 25 (EffectCraft's samples drift, After Effects' frame stays unchanged) and with keyed
+  sample points. The renders do not exercise a Decay above 1 (After Effects' set value has
+  Starting Intensity 0) or what Color Stabilizer corrects (the test card does not flicker).
+- `crates/aep/tests/it/import/effects_thirdparty.rs` (#3112): CC Color Neutralizer, EXtractoR and
+  IDentifier built into `synthetic.aep` like the #3110 effects. Render check of the 29 compositions
+  of `1300-thirdparty.aep` (as above): CC Color Neutralizer at its defaults and the minimum and
+  maximum compositions match within one level (no composition isolates Pinning: the maximum has
+  Blend w. Original 100, which shows the original), the compositions with reported Red /
+  Green / Blue corrections or View differ as reported (up to 5 levels, View 25); EXtractoR at its
+  defaults and with UnMult within 3 levels on 6 % of the pixels, keyed and expression Black Point
+  within one level, the ±3.4e38 compositions differ (reported as damaged data). IDentifier: After
+  Effects' frame is the unchanged EXR in every variant (its default Object ID finds no channel in
+  that EXR), while EffectCraft's IDentifier finds the EXR's `ID` channel and draws it; the import
+  reports this for every IDentifier. The follow-up presets (our own): `extractor-07-preset-channel-z`
+  (`Z` into Red, Green and Blue) imports without a loss and renders equal to After Effects (within
+  3e-5 at After Effects' 1/10 PNG scale; the background's Z of 100 clips there in both). IDentifier
+  needs an integer channel: block 1310 (`1310-identifier-uint.aep`, the EXR with UINT channels
+  `objectId` and `IndexOB.X` added) with the preset `identifier-09-preset-channel-objectid-id2`
+  (`objectId`, ID 2) imports without a loss, and EffectCraft's IDentifier finds the same channel:
+  the ID regions are the same pixels (8 449, 2 400, 1 515, 1 256, 780), the colours differ (After
+  Effects draws flat colours per ID and does not highlight the chosen ID, EffectCraft draws its
+  own ID colours with the chosen ID white). At its defaults (no channel chosen) After Effects
+  leaves the EXR unchanged in 1310 too.
+- `crates/aep/tests/it/import/combined.rs`: masks and effects on the same layer, an effect on a text
+  layer, and the same through `.aepx` (built in-test from the fixtures: the effect parade of one
+  fixture grafted onto the layer of another).
+- `crates/aep/tests/it/import/cases.rs`: the synthetic cases of the corpus (opt-in, `EFFECTCRAFT_AEP_FIXTURES`; one
+  composition per case in a few combined projects, `CASES.md`; each the same one-solid
+  composition with one change) are imported and the resulting project is
+  compared with the value the fixture was made with: composition size/rate/duration/work
+  area/background, layer names, switches and timing, blend modes, parent links, static
+  Position/Scale/Rotation/Opacity/Anchor with their units, key times and values, interpolation sides,
+  ease, tangents, expressions, the NTSC rates, and one report category per unsupported feature.
+  The report round-trips through JSON.
+- `crates/aep/tests/it/import/masks.rs`: every mask fixture (090, 091, 093, 208, 232-237, 306, 309,
+  328, 329) imports without losses with the values it was made with: vertices and tangents,
+  open/closed, mode, inverted, feather, opacity, expansion, path and feather keys with ease.
+- `crates/aep/tests/it/import/shapes.rs`: every shape fixture (238-242, 330-333, 451, 457, 462, 464,
+  467, 469, 471, 473, 482, 483, 519) imports without losses: items in file order, names, sizes,
+  positions, group transform, layer anchor, paints, trim paths, polystar fields, the defaults of
+  every item. Render check against After Effects at 1 s on a 20 px grid (5 184 points per frame):
+  451-482 equal but for 2-4 anti-aliased edge points per frame (at most 29/255 there), 519 3 edge
+  points.
+- `crates/aep/tests/it/import/mattes.rs` and `markers.rs`: track mattes (403-408; render check 403-408:
+  equal on every grid point, 406 within 1/255), markers (122, 123, 249, 347-349, 509, 510) and Time
+  Remapping (319, 354).
+- `crates/aep/tests/it/import/text.rs`: every text fixture (110, 113, 114, 243, 245-248, 334-340,
+  385, 386) imports with the values it was made with (text, paragraphs, size, fill, tracking,
+  leading, faux bold/italic, caps, justification, box size and position, the style runs of 248 and
+  340, the anchor rule with 385's stored anchor `[10, 20]` px, 386's U+0003 as a paragraph break
+  like 243's CR while another control character is still reported), 114 imports lossless, a missing font is listed and refuses nothing, a text
+  layer built from 113 with 022's parent link and 058's Opacity keys imports parented with both
+  keys, and hostile text documents (garbage, truncations, lone surrogates, a 2 MB text, run
+  lengths that overflow or exceed the text, NaN sizes and colours, a font index outside the list,
+  50 000 levels of nesting) never panic and give usable Source Text.
+- `crates/aep/tests/it/import/shapes_round2.rs`: masks on 705's text and 706's shape layer in layer
+  pixels, the operators of 707-710 and their defaults (731), Offset Paths' Copy Offset (828).
+- `crates/aep/tests/it/import/ease_round2.rs`: 597, 598, 599, 700, 730 between their keys within 0.5 px
+  (colour 1e-3) of After Effects' read-backs.
+- `crates/aep/tests/it/import/effects_round2.rs`: 711-723 import with the values they were made
+  with (712: the eleven effects at After Effects' defaults; Set Matte and CC Radial Blur's default
+  Type Scratch are reported).
+- `crates/aep/tests/it/import/effects_round3.rs`: the 24 effects of 905 with their values and After
+  Effects' defaults, the layer parameters of 905 and the Layer Controls of 220, 320, 321, hostile
+  layer ids (missing, 0, out of range) reported or neutral.
+- `crates/aep/tests/it/import/text_anim.rs`: the animators and range selectors of 579-594 and 114
+  (every selector setting, every mapped property, 594's keyed Start with its ease), the character
+  and paragraph settings of 538-578, 595, 596, and what is reported (548 a line join without a
+  stroke is no loss; 552, 554, 572, 578 are reported).
+- `crates/aep/tests/it/import/robustness.rs`: every fixture truncated at 40 places, with bit flips and
+  runs of `0x00`/`0xff`, and files rewritten with hostile values in valid structure (zero or
+  maximal sizes and time bases, NaN/infinity/huge numbers in every property, stretch 0, self and
+  mutual parents, a precomposition that contains itself), hostile masks (no vertices, 10 points,
+  196 611 points, NaN points and boxes, a short shape header, an unknown mode, a missing `mkif`,
+  path keys without their shapes), and for effects: every parameter type in every
+  definition, extreme defaults and maxima, valid and slider ranges, truncated and missing definitions, a wrong
+  float-slider maximum, a group marker retyped as a slider, an Exposure beyond EffectCraft's range, non-finite and
+  out-of-range values, an unknown match name, no shared definition list, 2 000 definitions and 200
+  copies of an effect. The result is an error or a report; the project is always valid (keys
+  sorted, finite values including effect parameters, no parent loops, mask paths finite with
+  matching tangents).
+- `crates/engine/src/tests/aep_import.rs`: the command, undo/redo, refusal, dry run, bad input,
+  `applySettings` and the menu entry.
+
+No Adobe project or asset is used: the tests read only the generated fixtures. The render checks named
+above compare EffectCraft with After Effects on the same generated cases; they are made by hand
+and are not part of the tests.
+
+## Clean-room method
+
+The importer reads the file only through `effectcraft-aep`, whose every field was established by
+one-change-per-file experiments on projects we generated ourselves ([aep-format.md](aep-format.md),
+section 5). The importer adds no knowledge of the format of its own: when the reader has no
+verified field for something, the importer reports it instead of guessing. No source code or format
+documentation of another `.aep` reader or converter was used; the evidence for every field is the
+generated corpus and its case numbers, not a claim about what was or was not seen elsewhere.
+
+## Export
+
+The other direction, File ▸ Export ▸ After Effects Project… (`file.exportAep`), is described in
+[aep-export.md](aep-export.md).
+
+## Not done yet
+
+Lumetri Color's section switches (a switched-off section is reported and its values left out), its LUTs and looks (files After Effects names: reported by name), its red, green and blue curves (no sample tells which is which), the colour wheels' brightness sliders and the fourth wheel, Split Toning and the HSL correction wheels (not sampled: reported when set) and moved points of the four hue / saturation curves other than Hue vs Sat (the scale of y is not sampled); effects outside the table (EXtractoR: its channel choice is arbitrary data; Stroke: its path is a mask reference), environment lights, the ease of bezier Orientation keys, wiggly and expression selectors and the other text animator properties (Character Value, Character Alignment other than its default, the Hue / Saturation / Brightness / Opacity variants, 3D rotations, variable font axes), manual kerning, No Break, the stroke line join, the Japanese leading model, Source Text keyframes, layer-style gradients, Pattern Overlay and the switch state 3, Mesh Warp handles moved on their own,
+separated dimensions and footage interpretation need verified layouts in the reader first.
diff --git a/docs/agents.md b/docs/agents.md
index c47bfb603..ebf158029 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -4,6 +4,10 @@ Everything in EffectCraft is an engine command with a stable id and JSON params.
 panel gestures, the CLI, the control channel and MCP all go through the same commands, so anything a
 user can do, an agent can do too. There are three ways in:
 
+Render-queue outputs cannot replace footage, proxies or the project file. See
+[render source protection](file-format-parity.md#render-source-protection) for aliases, default names and sequence
+limits. This guard does not change ordinary-file overwrite defaults or add another confirmation API.
+
 | Interface | Best for | Needs a window |
 |---|---|---|
 | **MCP** (`effectcraft-cli mcp`) | Claude Code and other MCP clients | no (headless), or yes with `--bridge` |
@@ -54,13 +58,13 @@ The release packages ship `effectcraft-cli` alongside the desktop app, so no bui
 
 | Install | CLI |
 |---|---|
-| Windows (MSI) | `C:\Program Files\EffectCraft\effectcraft-cli.exe` by default (wherever you installed it otherwise), not on `PATH` |
+| Windows (MSI) | `%LOCALAPPDATA%\Programs\ArtCraft\EffectCraft\effectcraft-cli.exe` by default (`C:\Program Files\ArtCraft\EffectCraft\effectcraft-cli.exe` for an all-users install, under `Program Files (x86)` instead for the 32-bit build, or wherever you installed it otherwise), not on `PATH` |
 | Linux (deb, rpm) | `/usr/bin/effectcraft-cli` |
 | macOS | the separate `effectcraft-cli-<version>-macos-<arch>.zip` release asset (the `.app` holds only the desktop app) |
 
 ```sh
-# Windows, default install folder
-claude mcp add effectcraft -- "C:\Program Files\EffectCraft\effectcraft-cli.exe" mcp
+# Windows (PowerShell), default install folder
+claude mcp add effectcraft -- "$env:LOCALAPPDATA\Programs\ArtCraft\EffectCraft\effectcraft-cli.exe" mcp
 # Linux, or macOS with the CLI unzipped onto PATH
 claude mcp add effectcraft -- effectcraft-cli mcp
 ```
@@ -101,17 +105,17 @@ See [MCP conventions](mcp.md) for core tools, resources, strict arguments, and r
 
 | Tool | What it does |
 |---|---|
-| `list_commands {filter?, enabled_only?, schemas?}` | Discover command ids, their param docs (and, with `schemas`, a JSON Schema each), and whether each can run now. |
+| `list_commands {filter?, enabled_only?, schemas?, compact?}` | Discover command ids, their param docs (and, with `schemas`, a JSON Schema each), and whether each can run now; `compact` lists only ids and labels (and overrides `schemas`). |
 | `describe_command {command \| id}` | One command in full: label, menu, shortcut, params doc, JSON `schema`, enabled / `why`. |
 | `execute_command {command \| id, params?}` | Run any command (undoable). Unknown parameter keys are rejected with the accepted list. |
 | `get_state` | Editor state (active comp, time, selections, tool) plus `app`: version, command and effect counts, export formats, parity summary. |
 | `run_script {code, name?}` | Run JavaScript with the After Effects-style scripting object model (`app.project`, `comp.layers.addText(…)`, `layer.property("ADBE Transform Group").property("ADBE Position").setValueAtTime(…)`…). Returns `{ok, result, output, error: {message, line, column}}`; edits are undoable. |
 | `get_project` / `get_comp {comp?}` | Project items, comp settings and layers. |
 | `get_layer {layer, comp?, time?, depth?, flat?}` | A layer's property tree (`depth` limits how many group levels expand). Every node has a `path`. |
-| `get_property {layer, path, comp?, time?}` | A leaf property's value at a time, keyframes and expression. Group paths (for example `geometryOptions`) contain children: inspect them with `get_layer`, then query a leaf such as `geometryOptions/extrusionDepth`. |
+| `get_property {layer, path, comp?, time?}` | A leaf property's value at a time, keyframes and expression; a popup (enum) property adds `options` (`[{value, label}]`, zero-based values, also in `get_layer`). Group paths (for example `geometryOptions`) contain children: inspect them with `get_layer`, then query a leaf such as `geometryOptions/extrusionDepth`. |
 | `set_property {layer, path, value?, time?, timeBase?, expression?, comp?}` | Sets a static value. With `time` it sets a keyframe (`timeBase: "comp"` for comp seconds); with `expression` it sets an expression. |
 | `add_keyframe {layer, path, time+value \| keys:[...], timeBase?, interpolation?, comp?}` | Adds keys (layer seconds, or comp seconds with `timeBase: "comp"`), then optionally applies linear/bezier/hold/easyEase. |
-| `list_effects {filter?}` | Effect ids, names, categories, GPU / 32-bpc support and parameters. |
+| `list_effects {filter?, compact?}` | Effect ids, names, categories, GPU / 32-bpc support and parameters; `compact` lists only ids, names and categories. |
 | `list_fonts {query?, variable?, rescan?}` | Font families text layers can use, bundled and installed, with their styles, origin, whether each is a variable font and own-language name; `variable` lists only variable fonts; `rescan` picks up fonts installed since launch. |
 | `add_effect {layer, effect, values?, comp?}` | Apply an effect and set its parameters in one call and one undo step (a failing value leaves nothing applied); returns the instance path (`effects/#n`) and its parameter paths. |
 | `render_frame {comp?, time?, max_side?, path?, inline?, transparent?}` | Returns a PNG image of a frame; `transparent: true` keeps the alpha (as an RGB + Alpha render writes it) instead of compositing over the comp background. |
@@ -180,6 +184,7 @@ Short recipes; every step is one tool call.
 | Animate | `add_keyframe {"layer":2,"path":"transform/scale","keys":[{"time":0,"value":[0,0]},{"time":0.5,"value":[100,100]}],"interpolation":"easyEase"}` |
 | Effect with settings | `list_effects {"filter":"glow"}` → `add_effect {"layer":2,"effect":"Glow","values":{"threshold":40,"radius":30}}` → `set_property {"layer":2,"path":"effects/#1/intensity","value":2}` |
 | Key a green screen | `add_effect {"layer":2,"effect":"Keylight (1.2)"}` → `execute_command effect.pickColor {"layer":2,"effect":1,"param":"screenColour","x":20,"y":20,"average":true}` (a screen pixel, layer space; samples the effect's input) → `set_property {"layer":2,"path":"effects/#1/screenMatte/clipBlack","value":10}` → `render_frame {"transparent":true}` |
+| Key objects by Cryptomatte | `add_effect {"layer":2,"effect":"Cryptomatte"}` → `execute_command effect.pickCryptomatte {"layer":2,"effect":1,"x":120,"y":80}` (the ID under that layer pixel replaces the Selection; `"mode":"add"` / `"remove"` edit it; `effect.cryptomatteAt` with the same point only reports the name) → `render_frame` |
 | Drive with an expression | `set_property {"layer":2,"path":"transform/rotation","expression":"time*90"}` |
 | Inspect a layer | `get_layer {"layer":2,"flat":true}` (every property with its `path`, value, key count) |
 | Check the result | `render_frame {"time":1.5,"max_side":640}`; in bridge mode `screenshot {"panel":"Timeline"}` |
@@ -211,12 +216,29 @@ Things that tripped up a long agent-driven session (a multi-scene 3D piece built
   or call `save_project {"path": …}` after each milestone.
 - **Environment light.** `layer.newLight` also accepts `"kind":"Environment"`: an equirectangular
   image that metallic surfaces reflect. Set its `lightOptions/source` to a footage, comp or solid
-  layer by layer id; with no source it uses the comp's Environment Layer (`layer.environment`)
-  ([#261](https://github.com/storytold/effectcraft/issues/261)).
+  layer by layer id; with no source it uses the comp's Environment Layer (`layer.environment`),
+  or a default studio environment — bright above and toward the initial camera, dark below and
+  behind, at a dim 0.3 mean level — of the light's colour × intensity when there is none; either
+  way the light brightens the scene. A selected Source or Environment Layer that fails to
+  render — a deleted layer, missing footage — lights nothing instead: the light never silently
+  falls back to the studio default. It has `castsShadows`/`shadowDarkness`/`shadowDiffusion`
+  like the other lights: Cast Shadows shades the scene from the image's dominant bright region
+  (the default environment's key, or a source image's brightest area; an image without a
+  sufficiently strong dominant direction has none — a uniform one, or opposing bright regions
+  that cancel — so it casts no shadow) — the region weighted by the light's colour, so a
+  coloured light shadows from the regions it actually lights (opposing red and blue regions
+  cancel to a white light, but a red light's shadow comes from the red one) — occluding only
+  that key's share of the light, so the
+  shadow stays partial like After Effects' area-light shadows, and soft by default (a penumbra
+  of at least 8 pixels or four map texels, plus Shadow Diffusion). It only lights
+  Advanced 3D comps, so creating one (or changing a light's type to Environment) switches a
+  Classic 3D comp to Advanced 3D
+  ([#261](https://github.com/storytold/effectcraft/issues/261),
+  [#2436](https://github.com/storytold/effectcraft/issues/2436)).
 
 ### Cookbook (from end-to-end QA)
 
-The scenarios in `crates/automation/tests/qa/` and `apps/effectcraft-cli/tests/qa_template.rs`
+The scenarios in `crates/automation/tests/qa/` and `apps/effectcraft-cli/tests/it/qa_template.rs`
 build real projects through these interfaces; they are worked examples of everything below.
 
 * **Name things when you create them**: `layer.newText`, `layer.newShape`, `layer.newSolid`,
@@ -239,6 +261,35 @@ build real projects through these interfaces; they are worked examples of everyt
   `layer.centerAnchor` skip them and fail when every target is locked ("… is locked"); Select
   All and `layer.selectNext` / `selectPrevious` step over them. Unlock with
   `layer.setSwitch {"layers": [...], "switch": "lock", "value": false}` or `layer.unlockAll`.
+* **Un-precompose**: `layer.unprecompose {layer?, force?, dryRun?}` (Layer ▸ Un-precompose) expands the
+  selected pre-comp layer into copies of its composition's layers at its place (order, keyframes,
+  effects, masks, parenting, mattes, markers kept; timing moved by the layer's Start and trimmed to
+  what it showed; Position minus Anchor Point added to the unparented ones). One undo step; the
+  nested comp stays in the project; the nested comp's frame no longer clips what its layers draw
+  outside it. Only a **locked** pre-comp layer is refused (with or without `force`), changing
+  nothing. Everything that would change the picture or drop something is a warning: the pre-comp
+  layer has a parent or matte, effects, masks, layer styles, a non-default Scale / Rotation /
+  Opacity, an animated transform, time remap or stretch, a blending mode, Video or Audio off, Solo
+  or Guide on, the 3D / collapse / adjustment switch or Preserve Transparency, or is used by another
+  layer (parent, matte or a layer property), or an expression of another layer names it (by name in
+  quotes or as `layer(<index>)`; listed per property, the expression is left as written and will
+  no longer find it); or the nested comp holds a camera, light, adjustment,
+  3D, collapsing or soloed layer, or a layer with a blending mode or Preserve Transparency, preserves
+  a frame rate other than the comp's, has a motion-blur shutter other than the comp's (with motion
+  blur layers), or has an unparented layer with a Position expression while the pre-comp layer's
+  Position differs from its Anchor Point (the move is added to stored values only). Without
+  `force` such a call is an error listing every reason and nothing changes; `dryRun: true` returns
+  `{dryRun, warnings}` without changing anything. With `force: true` it unpacks anyway and returns
+  `{layers, warnings}`: what the pre-comp layer itself carried (effects, masks, styles, transform
+  beyond Position, time remap, blending mode, switches, its parent and matte) is dropped, and other
+  layers' parent, track matte and layer-property links to it are removed. The menu shows the
+  reasons and asks (Unpack Anyway / Cancel, `dialog.unprecompose.force` /
+  `dialog.unprecompose.cancel`); a layer without reasons unpacks without asking.
+* **Quick Set Anchor**: `layer.quickSetAnchor {point: topLeft|top|topRight|left|center|right|bottomLeft|bottom|bottomRight, layers?}`
+  (Layer ▸ Transform ▸ Quick Set Anchor) moves the Anchor Point of 2D layers to that point of their
+  content and shifts Position and its keys so the layers don't move, in one undo step. 3D and
+  locked layers, and layers whose Anchor Point, Scale or Rotation is keyed or has an expression,
+  are skipped (an error when none is left); returns `{layers}`.
 * **Solid Settings**: `layer.settings {layer, name?, color?, width?, height?, pixelAspect?,
   affectAll?}` edits a solid or adjustment layer's solid (and renames the layer and the solid).
   A solid shared by several layers (duplicates share theirs) changes for all of them unless
@@ -271,12 +322,12 @@ build real projects through these interfaces; they are worked examples of everyt
   then `keys.velocity {"outSpeed":0,"outInfluence":33.33}`.
 * **Gradients**: `set_property {"path":"contents/gfill/colors","value":["#0080ff","#ffff00"]}` or
   `{"colors":[[0,"#0080ff"],[1,[1,1,0]]],"opacities":[[0,1],[1,0.5]]}`.
-* **Image sequences**: `file.import {"paths":["/r/shot_0001.png"]}` imports the file's whole
-  numbered run as one item (several picked frames: that range; a folder: each run in it;
-  `"sequence": false`: one still; dropped files, `"drag": true`, import as stills unless
-  `"sequence": true`, as in After Effects; `"alphabetical": true`: Force Alphabetical Order, the files
-  play one after another) at `frameRate` or 30 fps (Settings ▸ Import). Missing frames show
-  colour bars, as in After Effects. `file.interpretFootage {"items":[id], "frameRate":12,
+* **Image sequences**: `file.import {"paths":["/r/shot_0001.png"], "sequence": true}` imports the
+  file's whole numbered run as one item (several picked frames: that range; a folder: each run in
+  it, also without `sequence`). Without `"sequence": true` a picked or dropped numbered file imports
+  as one still, as in After Effects; `"alphabetical": true`: Force Alphabetical Order, the files
+  play one after another) at `frameRate` or 30 fps (Settings ▸ Import). A gap in the numbering holds
+  the previous frame, as in After Effects. `file.interpretFootage {"items":[id], "frameRate":12,
   "startTimecode":1001}` conforms them and sets Override Start (the item and layers that ran to its end get the new
   length). See [footage.md](footage.md).
 * **Colour of footage**: `file.interpretFootage {"items":[id], "preserveRgb":true}` is Interpret
@@ -291,12 +342,43 @@ build real projects through these interfaces; they are worked examples of everyt
   channels (`{"layers":[{"name":"diffuse","rgba":["diffuse.R","diffuse.G","diffuse.B",""]}]}`);
   EXtractoR shows them when its `red` / `green` / `blue` / `alpha` are set to those names
   (`prop.set {"path":"effects/#1/red","value":"depth.Z"}`). Effect Controls offers them as popups.
-* **Masks**: `layer.addMask {layer, shape: rect|ellipse, rect}` first, then `layer.mask.set
-  {field: feather|expansion|opacity, value}`.
+* **Masks**: `layer.addMask {layer, shape: rect|ellipse|rounded, rect, roundness}` first, then
+  `layer.mask.set {field: feather|expansion|opacity, value}`. A Rounded Rectangle mask's corner
+  radius (`roundness`, layer pixels) is set when it's added and changed later with
+  `mask.setRoundness {layer, mask, roundness}` (0 = square corners); it only reshapes a rectangular mask.
 * **Renders**: `renderQueue.add {comp, format: h264|prores|webm|png…, channels: rgba,
   proresProfile: 4444, output}` then `renderQueue.render {"wait": true}`. Check a render by
   importing it (`file.import`, `file.newCompFromSelection`) and `render_frame {transparent: true}`
   for its alpha (ProRes 4444 and WebM VP9 alpha both read back as straight alpha).
+  OpenEXR sequences (`format: exr`) are scan-line files, linear and premultiplied, and take
+  `exrCompression: none|rle|zips|zip|piz|pxr24|b44|b44a|dwaa|dwab` (default `zip`, 16-line
+  blocks; `zips` is ZIP one scan line per block, the "Zip (1 scanline)" many compositing
+  pipelines default to) and `exrBitDepth: half|float` (default `float`); `renderQueue.formats`
+  lists them.
+  PXR24 on float, B44 / B44A on half and DWAA / DWAB are lossy (in the tests every linear sample
+  stays within 0.03 + 6 % of its value); B44 / B44A store 32-bit float uncompressed. Half rounds each sample to the nearest half float and holds it to ±65 504.
+  **A render never writes one file twice either:** when two outputs of the job (two items, a
+  `renderQueue.duplicate` copy, output modules, segments) name the same file, the whole render is
+  refused before anything is written, naming both items. Sequences clash only on frames both
+  write. A later item with Skip Existing Files leaves the earlier one's frames alone only when
+  the exporter can check the final destination. Browser/memory sinks and storage-overflow renders still report collisions.
+  Preflight compares every configured overflow destination, since available space can change during a render. Default
+  names are numbered like footage collisions when another queue item writes them
+  (`renderQueue.add`, `render.preRender`, `comp.saveFrameAs {queue}`, `file.createProxy`: a second
+  `Main` renders to `Main_1.mp4`); a name you give is kept, and `renderQueue.duplicate` copies the
+  output as it is, so change one with `renderQueue.setOutput` or turn it off.
+* **Other files written to a path you give** follow the same footage rule, with no flag and no
+  prompt: `comp.saveFrameAs` (also `…Psd`, `…Exr`), `file.exportLottie`, `file.saveCopy`,
+  `file.saveCopyAsXml`, `file.collectFiles` (every copy and the collected project; nothing is
+  written if one would land on a file the project reads), `file.exportTimeline` (and the movies it
+  pre-renders), `essential.exportTemplate`, `anim.savePreset`, `view.exportGuides`,
+  `shortcuts.export`, the control channel's `render.frame` / `ui.screenshot` with a `path`, the
+  MCP `render_frame` tool and `effectcraft-cli render-frame --out`. Footage (every frame of a
+  sequence), a proxy and the project file are refused with the reason and left untouched.
+  `file.checkOutput {path}` says beforehand (`{blocked, source, reason}`). Not covered: Save /
+  Save As / Increment and Save / auto-save (they write the project's own file), script `File`
+  writes (a script may rewrite a data file it also imports), and files the app extracts for
+  itself (template media, vector images).
 * **Essential Graphics**: controls can be addressed by name (`essential.set {"layer":"#1",
   "control":"Title","value":"John Smith"}`); a command that targets an explicit `comp` runs even
   when the active comp would disable it (`essential.exportTemplate {"comp":"Lower Third", …}`).
@@ -323,8 +405,8 @@ build real projects through these interfaces; they are worked examples of everyt
 ### Effect positions
 
 Effect points, Puppet pins (`puppet.addPin`, `puppet.recordPin`), Paint, Liquify and Roto Brush
-strokes and `effect.pickColor` are in **effect space**: layer pixels from the top-left of the
-layer's effect bounds. For footage, solids and precomps that is the layer's own pixel grid. Shape
+strokes, `effect.pickColor` and `effect.pickCryptomatte` are in **effect space**: layer pixels
+from the top-left of the layer's effect bounds. For footage, solids and precomps that is the layer's own pixel grid. Shape
 and text layers have comp-sized bounds centred on their content's origin, so in a `w` × `h` comp
 the point `[w / 2, h / 2]` is that origin (a new effect's default point). `prop.get` / `prop.set`
 read and write these values as they are.
@@ -373,8 +455,9 @@ Face tracking's trained model works like Roto Brush's (below): `face.models` lis
 tracker and MediaPipe Face Landmarker with its authors and licence; `face.model.download {id}` /
 `face.model.install {path, id?}` install it (verified); `face.model.select {id:
 classical|mediapipe-face}` chooses it; `face.model.remove {id}` deletes it. Downloads and loading
-run in the background; `"wait": true` on download, install or select returns once the model is in
-use (or with its error), which scripts need before tracking. `track.mask` with a
+run in the background; `"wait": true` waits for the requested operation (or returns its error).
+Download/install do not change the selected model. After installing, use
+`face.model.select {id, wait:true}` to select and load it before tracking. `track.mask` with a
 face method returns `faceModel`, the engine it tries first (the classical one when the model finds
 no face in the mask).
 
@@ -431,7 +514,9 @@ undistort?, wait?}`) apply
 Effect ▸ Perspective ▸ 3D Camera Tracker (or reuse the layer's) and analyse it in the background:
 "Analyzing in background (step 1 of 2)" tracks features, "Solving camera" solves.
 `camera.analyze {layer?, effect?, wait?}` re-runs it, `camera.cancel` stops it without writing
-anything. `camera.solveStatus` reports `progress`/`banner`, `analyzed`, `solved`, `methodUsed`,
+anything. `camera.solveStatus` reports `progress`/`banner`, `analyzed`, `solved` (every frame
+solved), `partial` with `solvedFrames` of `frames` (the camera is interpolated on the other frames,
+and `camera.exportBlender` refuses such a solve), `methodUsed`,
 `averageError` (pixels), `focalLength`, `horizontalAngleOfView`, the current frame's `camera`
 (position, orientation, zoom), `groundPlane` and the solved `lensDistortion` (`k1`, `k2`, normalised by
 half the frame diagonal) when Solve Lens Distortion (`effects/#1/advanced/lensDistortion`, also on
@@ -445,7 +530,12 @@ and Origin), `camera.createFromSolve {kind: text|solid|null|shadowCatcher, point
 {center, normal, size?}, multiple?}` (Create Text / Solid / Null / Shadow Catcher, Camera and Light,
 Create Multiple …), `camera.deletePoints {points?, wait?}` (re-solves; with Auto-delete Points
 Across Time the same feature's other tracks go too) and `camera.create` (the Create Camera button).
-Each is one undo step; the first create adds the one-node "3D Tracker Camera" keyed on every frame.
+Each edit is one undo step; the first create adds the one-node "3D Tracker Camera" keyed on every frame.
+
+`camera.exportBlender {path: ".py", layer?, effect?, sensorWidth?: 36, unitScale?: 0.01,
+startFrame?: 1, includePoints?: true}` exports the solve as an executable Blender scene script:
+baked camera/lens/focus, synced video background, points and ground. See
+[Blender camera export](blender-camera-export.md) for framing, assumptions and limitations.
 Changing the layer's frames clears the analysis; changing `effects/#1/shotType`,
 `effects/#1/horizontalAngleOfView`, `effects/#1/advanced/solveMethod` re-solves the stored tracks.
 
@@ -476,11 +566,22 @@ reference. Matte settings are ordinary properties (`effects/#1/rotoBrushMatte/se
 
 Trained model (Roto Brush 2.0 / 3.0):
 - `roto.models` lists the built-in engine and every registered model, with its authors,
-  licence, size, URL, SHA-256 and whether it is installed, selected and active.
-- `roto.model.download {id}` fetches and verifies the official weights in the background;
-  `roto.model.install {path, id?}` installs a file you already have.
-- `roto.model.select {id: classical|mobilesam}` chooses which one Roto Brush uses. Loading runs
-  in the background; `"wait": true` (also on download and install) returns once it is in use.
+  licence, size, app download URL (empty for install-only models), checkpoint `source` and `sourceFile`,
+  SHA-256 and whether it is installed, selected and active.
+- `roto.model.download {id}` fetches and verifies weights when the registry provides an app download URL;
+  `roto.model.install {path, id?}` installs a file you already have. SAM 2 is Install from File only until
+  a storytold-controlled mirror is available; its size and SHA-256 are verified before installation.
+- `roto.model.select {id: classical|mobilesam|sam2.1-hiera-tiny|sam2.1-hiera-small|sam2.1-hiera-base-plus|sam2.1-hiera-large}` chooses which one Roto Brush uses (SAM 2 also tracks the object through the clip, see [roto-brush-sam2.md](roto-brush-sam2.md); `roto.status` then reports `source` and per-frame `tracker.frames` with `confidence` and `occluded`). Loading runs
+  in the background. `"wait": true` waits for the requested operation; download/install load the model
+  only if it is already selected. They do not activate an unselected model: after installation, use
+  `roto.model.select {id, wait:true}` to select and load it. Unrelated model work can return a retryable
+  busy error rather than reporting that a waiting selection has finished.
+- `roto.propagate` never falls back to the classic engine silently: a chosen model that is not installed, or failed
+  to load, is an error, and without `"wait": true` so is a model still loading. `roto.status` reports `model`
+  (`selected`, `installed`, `active`, `loading`, `error`) and a `notice` while the chosen model is not the one in use.
+  Tracked frames are saved in the project with the instance (`tracker.saved` names their model): they apply while the
+  strokes and span are unchanged, whichever model Settings choose (`notice` says when that differs), and a new
+  Propagate replaces them.
 - `roto.model.remove {id}` deletes the installed weights.
 - The `version` property (`effects/#1/version`: 0 = 1.0, 1 = 2.0, 2 = 3.0) picks between the
   classic engine (1.0) and the chosen model (2.0, 3.0).
@@ -532,11 +633,14 @@ indices): character attributes
    starts editing (`position` instead of `box` makes point text; `vertical: true` vertical type).
 2. `text.insert {"text":"Hello world"}` types at the caret (replacing the selection);
    `text.setSelection {"start":6,"end":11}` selects "world"; `text.moveCaret {"to":"wordLeft",
-   "extend":true}` moves like the arrow keys; `text.delete {"word":true}` is Alt+Backspace.
+   "extend":true}` moves like the arrow keys; `text.delete {"word":true}` is Alt+Backspace;
+   `text.deleteSurrounding {"before":1,"after":2,"bytes":true}` deletes the characters around the
+   selection without deleting it (what an input method's replacement asks for: the selection stays
+   for the commit that follows; a byte count ending inside a character leaves that character).
 3. `layer.setText {"range":[6,11], "size":40, "fill":"#ff5500"}` styles the selection (the
    Character panel does the same); with an empty range it sets the style the next typed text takes.
 4. `edit.copy`, `edit.paste`, `edit.pasteTextMatchFormatting` and `edit.pasteTextFormattingOnly`
-   work on the selected text; `text.endEdit` commits (an empty Type-tool layer is removed).
+   work on the selected text; `text.endEdit` commits (an empty Type-tool layer is kept, as After Effects does).
 
 Fonts: `text.fonts` (MCP `list_fonts`) lists every family a text layer can use, bundled and installed, with its
 styles, origin (`bundled`, `system`, `user`), `variable` (it has variation axes) and own-language name
@@ -579,9 +683,12 @@ A dialog's `show()` waits for the user: the `script.run` / `file.runScript` repl
 `"waiting": true`, and the script continues (its final output arrives in the reply of the click
 that closes the dialog). File ▸ Scripts: `file.scripts.list`, `file.runScript {"name": …}`,
 `file.installScript` / `file.installScriptUIPanel {"path": …}`, `window.scriptPanel {"name": …}`,
-`window.restoreScriptPanels` (the panels open when the app last quit). Scripts' `app.settings`:
+`window.restoreScriptPanels` (the panels open when the app last quit), `file.runStartupScripts` and
+`file.runShutdownScripts` (the scripts in `Scripts/Startup` and `Scripts/Shutdown`; the second closes
+the project first). Scripts' `app.settings`:
 `script.settings.get {"section": …, "key": …}` and `script.settings.save {…, "value": …}`.
-Extension points and the bundled extensions: [plugins.md](plugins.md).
+Extension points and the bundled extensions: [plugins.md](plugins.md); publishing an effect plug-in
+in the Plug-in Library: [publishing-plugins.md](publishing-plugins.md).
 
 ### Timeline: layer order, properties and shortcuts
 
@@ -595,21 +702,41 @@ Extension points and the bundled extensions: [plugins.md](plugins.md).
   properties, FF missing effects, EE Expressions, LL Waveform, UU everything changed from its
   default. Shift+key adds or removes a set; the same key again hides it; Ctrl/Cmd+` twirls the
   selected layers open or closed. With no layer selected they apply to every layer.
+* A row control clicked on one of several selected layers applies to every selected layer, as in
+  After Effects: the A/V switches (video, audio, solo, lock), the Switches column (shy, collapse,
+  quality, fx, frame blending, motion blur, adjustment, 3D), the label swatch and the Modes column
+  (blending mode, Preserve Transparency), one undo step, with the layers the switch doesn't apply
+  to left out. A control on an unselected row changes that layer alone; Alt-clicking an A/V feature
+  still sets the selected layers apart from the rest.
 * `keys.toggleTransform {"layers"?: [...], "prop": "position"}` (Alt+Shift+A/P/S/R/T) adds or
   removes a keyframe at the current time on that Transform property of each layer, in one undo
   step (separated X/Y/Z Position; Orientation and X/Y/Z Rotation on 3D layers).
 * Rename a layer with Enter (or double-click a name): the whole name is selected, Enter or a
   click elsewhere commits, Escape cancels; `layer.rename {layer, name}` does it directly.
+  A text layer's name follows its text until it is renamed; renaming it to an empty name makes
+  it follow the text again (After Effects). `layer.setText` and typing on canvas rename a text
+  layer whose name still follows its text; `layer.newText {name}` and a name set by
+  `layer.settings` or a script's `layer.name = …` (which runs `layer.rename`) stay, and an empty
+  `layer.settings` name follows the text again too.
 * Ctrl/Cmd-click on the current-time display (Timeline or Composition panel) toggles the Time
   Display Style between Timecode and Frames: `file.projectSettings {"timeDisplay": "frames"}`.
 * `prop.pickWhip {layer, prop, target: {layer, prop, dimension?}}` links a property as its
   expression pick whip does; `dimension` picks one of the target's values (`position[0]`), as a
-  drop on that value field does.
+  drop on that value field does. `byIndex: true` (an Alt pick whip: Alt held as it drops) refers
+  to an effect's properties by their index, `effect("Color Control")(1)`: it still reads a
+  renamed property, but another one if properties are reordered.
 * Every property row has a property pick whip in the Parent & Link column
   (`timeline.prop.<uid>.propertyPickWhip`; the expression row's is `timeline.prop.<uid>.pickWhip`).
   Dragged onto another property's name or value, in the Timeline or Effect Controls
   (`effectControls.prop.<uid>.value[.<d>]`), it runs `prop.pickWhip`: the reference replaces the
   property's expression, or is added as one, and the expression is enabled.
+* Parent and Track Matte for several layers: on a selected layer's row, the Timeline's Parent
+  menu and pick whip (`timeline.layer.<id>.parent`, `timeline.layer.<id>.pickWhip`) and its Track
+  Matte menu and pick whip (`timeline.layer.<id>.trackMatte`,
+  `timeline.layer.<id>.trackMattePickWhip`) set every selected layer's (on an unselected row,
+  that layer's), in one undo step. Directly: `layer.setParent {layers, parent}` and
+  `layer.setTrackMatte {layers, matte, kind}`, where `kind: "preserve"` keeps each layer's
+  own matte mode.
 * A property's menu (right-click its name; entries `timeline.prop.<uid>.menu.<entry>`): Reset
   (`prop.reset`: no expression, and the property's default value, an effect parameter's or a
   Transform property's; an animated property keeps its keyframes and gets the default as a
@@ -668,6 +795,28 @@ effectcraft-cli exec layer.newNull --bridge 9877                 # same commands
 effectcraft-cli exec file.exportLottie '{"comp":"Main","path":"main.json","includeExpressions":true}' main.ecproj --json
 effectcraft-cli exec file.importLottie '{"path":"anim.json"}' main.ecproj --save
 effectcraft-cli render main.ecproj --comp Main --out main.mov --format prores --progress   # progress lines on stderr for a program that reads them
+effectcraft-cli render main.ecproj --comp Main --out 'main_[#####].exr' --exr-compression piz --exr-depth half   # half-float PIZ OpenEXR frames
+```
+
+Runs that save over the project they opened (`--save`, or `--save-as` the same file) take turns, so
+parallel scripts don't lose edits. Each holds an OS lock on `.<name>.lock` next to the project from
+before it reads the file until it exits; the next one says so on stderr, waits, and then edits what
+the first one saved. A crash releases the lock, and the empty file left behind is harmless. Only these
+CLI runs take the lock: the desktop app, `mcp`, and a `file.save` step in a run without `--save`
+don't. OS locks can also be unreliable over network shares and synced folders. If the lock can't be
+taken, the run warns on stderr and saves anyway.
+
+A long `run` doesn't fit on a command line (Windows caps it at 32 767 characters, Linux one
+argument at 128 KiB). `run --args-file F` reads the same `<id> <json>` arguments one per line;
+`run --commands FILE` reads steps as a JSON array of `{"command": ID, "params": {…}}` objects, or one
+such object per line (JSON Lines), and `--commands -` reads them from standard input. `--commands`
+may be repeated; its steps run after the positional pairs and `--args-file`. A malformed step is a
+usage error naming its index (from 0, as in the results) before anything runs, and the error of a step
+that fails ends with `(step N)`:
+
+```sh
+effectcraft-cli run --commands steps.json --empty --save-as main.ecproj
+generate-steps | effectcraft-cli run main.ecproj --commands - --save --json
 ```
 
 Scripts written against After Effects' documented scripting API run with `script`:
@@ -688,6 +837,10 @@ cannot express (most effects, cameras and lights, layer styles, audio, video foo
 agent can check what a player will not show. A `.lottie` path writes a dotLottie archive.
 `file.importLottie` returns `{comp, items, warnings}` and opens the new composition.
 
+`file.importAep {path, allowLosses?, dryRun?, applySettings?}` imports an After Effects project (`.aep` or `.aepx`) into a folder named after the file and returns `{folder, comps, items, report}`. The report counts what arrived and lists, per category, what did not (effects outside the importer's table, undecoded text or style settings, simplified keyframes…); without `allowLosses` an import that would lose anything is refused and changes nothing, and `dryRun` returns just the report ([aep-import.md](aep-import.md)).
+
+`file.exportAep {path, allowLosses?, dryRun?}` writes the project as an After Effects project and returns `{path, bytes, report}`. The report counts what was written and lists, per category, what was not; without `allowLosses` an export that would lose anything is refused and writes nothing, and `dryRun` returns just the report ([aep-export.md](aep-export.md)).
+
 Premiere Pro interop goes through timeline interchange (MCP: the `execute_command` tool; control channel: `engine.execute`
 with the same ids):
 
diff --git a/docs/architecture.md b/docs/architecture.md
index 72daec328..1e91da215 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -1,6 +1,6 @@
 # Architecture
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (crate table checked against `crates/`: effect count 306, VP9 inter frames) · **Target:** Adobe After Effects 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** minor (SAM 2 crate added to the layer table) · **Target:** Adobe After Effects 2026
 
 EffectCraft is a stack of small Rust crates. The engine knows nothing about the user interface;
 the egui frontend, the command-line tool and the MCP server all sit on top of the same `Session`
@@ -37,11 +37,14 @@ cpal or muda. Everything in L0 to L4, the egui UI and the web app also build for
 | L3 | `render` | Evaluation and compositing: sources, masks, effects, transforms, 3D, motion blur, mattes, blending, layer cache, audio mixdown |
 | L3 | `media` | Footage decoding (FilmCraft's pure-Rust codecs), image sequences, Photoshop and SVG stills, frame cache |
 | L3 | `expr` | The expression engine (JavaScript via boa) with the After Effects object model |
-| L3 | `export` | Render queue encoding: H.264, HEVC and AV1 MP4, ProRes, WebM (VP9 + alpha or AV1, Opus), PNG/JPEG/TIFF/EXR sequences, GIF, WAV/AIFF |
+| L3 | `export` | Render queue encoding: H.264, HEVC and AV1 MP4, ProRes, WebM (VP9 + alpha or AV1, Opus), PNG/JPEG/TIFF/EXR/Targa sequences, GIF, WAV/AIFF |
 | L3 | `gpu` | The GPU compositor and GPU effects on wgpu compute shaders (Metal, Vulkan, Direct3D 12, WebGPU), checked against the CPU renderer |
+| L3 | `sam2` | SAM 2.1 image segmentation and video object tracking for Roto Brush, with candle CPU inference and optional wgpu acceleration; native only, empty on wasm32, with user-installed weights |
 | L3 | `interchange` | Premiere Pro interop through timeline interchange (FCP7 XML, FCPXML, OTIO, EDL, AAF, OMF via FilmCraft's `filmcraft-interchange`): sequences ↔ compositions (§6a) |
+| L3 | `aep` | After Effects projects in one crate (like `lottie`): `container` reads and writes the `.aep` container (RIFX `Egg!`) as a lossless chunk tree with a byte-identical round trip, bounded for hostile input, reads the `.aepx` XML form into the same tree, and has a typed view of items, layers, properties, effects, masks, shapes, text, markers, footage, cameras, lights and layer styles, from our own observations of generated files ([aep-format.md](aep-format.md)); `import` maps the typed view into a project (items, settings, compositions, every layer kind, Transform, keyframes, expressions, masks, text, shapes, cameras, lights, mattes, markers, time remapping, layer styles, the effects of a shared table, footage) with a report of everything not imported ([aep-import.md](aep-import.md)); `export` builds every chunk in code (prototypes in the layout After Effects writes, cloned and edited only at verified fields) for the same scope, with a report of everything not exported, verified by opening the output in After Effects ([aep-export.md](aep-export.md)) |
 | L3 | `lottie` | Lottie JSON / dotLottie import and export (layers, precomps, eased and spatial keyframes, shapes, masks, mattes) with a warnings list for what Lottie cannot express |
-| L3 | `plugin` | Effect plug-ins: loads sandboxed WebAssembly effect modules (plug-in API v1; the wasmi interpreter behind the `wasm` feature, on for native hosts) into the effect registry ([plugins.md](plugins.md)) |
+| L3 | `plugin` | Effect plug-ins: loads sandboxed WebAssembly effect modules (WebAssembly ABI v1 and v2, the latter with neighbouring frames; the wasmi interpreter behind the `wasm` feature, on for native hosts) into the effect registry ([plugins.md](plugins.md)) |
+| L3 | `helper-host` | External effect helpers: finds helper programs, runs each as a child process and registers its effects (plug-in API 2) over a versioned pipe + shared-file protocol; a crashing helper is an error on the effect, never a crash ([external-helpers.md](external-helpers.md), [ADR 0001](adr/0001-external-effect-helpers.md)). Native only |
 | L4 | `engine` | `Session`: project, branching undo history, editor state, the command registry and menus, the ScriptUI window model (`scriptui`) |
 | L4 | `script` | Scripting: JavaScript (boa) with an After Effects-style object model (`app.project`, comps, layers, properties, render queue) and ScriptUI (dialogs, palettes, dockable panels; script-host threads so dialogs block `show()`), whose edits run engine commands; AE match names |
 | L4 | `host` | A fully wired `Session` (media, expressions, scripting, WebAssembly plug-ins, exporter) for the frontends |
@@ -118,7 +121,7 @@ are not rewritten, so an expression that computes an effect point on a shape or
 other values may need `+ [thisComp.width / 2, thisComp.height / 2]`. Effects that use the layer
 bounds (edge pinning, wipes, Offset, generators) now cover the whole comp-sized bounds instead of
 their bottom-right quarter. Tracking data of effects that analyse footage (Warp Stabilizer, 3D
-Camera Tracker, Mocha shape) is left as it is: footage has a source rectangle, whose effect space
+Camera Tracker, Tracked Shape Matte) is left as it is: footage has a source rectangle, whose effect space
 did not change.
 
 ## 4. Rendering
@@ -158,9 +161,22 @@ comp to Advanced 3D in the same undo step, as in After Effects. Shading is physi
 GGX specular, Smith–Schlick geometry, Schlick Fresnel, Lambert diffuse, after Karis 2013):
 parallel, spot and point lights with After Effects' falloffs, ambient lights, image-based
 light from an Environment light whose Source (or the comp's Environment Layer, Layer ▸
-Environment Layer) is an equirectangular image (cosine irradiance map; roughness-indexed mip
-chain with the split-sum environment BRDF fit), and percentage-closer-filtered shadow maps
-(spot: perspective, parallel: orthographic over the scene, point: six cube faces). Cards keep
+Environment Layer, or a default studio environment — bright above and toward the initial
+camera, dark below and behind, at a dim 0.3 mean level — of the light's colour × intensity
+when there is neither) is an equirectangular image (cosine irradiance map; roughness-indexed
+mip chain with the split-sum environment BRDF fit), and percentage-closer-filtered shadow maps
+(spot: perspective, parallel: orthographic over the scene, point: six cube faces, environment:
+one orthographic from the image's dominant bright region — none only when the image lacks a
+sufficiently strong dominant direction (a uniform one, or opposing bright regions that
+cancel) — the region weighted by the light's colour, so a coloured light shadows from the
+regions it actually lights (opposing red and blue regions cancel to a white light, but a red
+light's shadow comes from the red one) — occluding only the image's directional key fraction of
+the light, so the shadow stays partial like After Effects' area-light shadows, with a soft
+default penumbra of at least eight pixels or four map texels). A Source or Environment Layer
+that fails to render — a deleted layer, missing footage — lights nothing: no silent fallback
+to the default studio environment. An Environment light only lights Advanced 3D comps,
+so adding one (or changing a light's type to it) switches a Classic 3D comp to Advanced 3D,
+as model layers do. Cards keep
 Material Options (Accepts Lights/Shadows, Casts Shadows On/Only, Ambient, Diffuse, Specular);
 models and primitives add Base Color, Metallic, Roughness, Emissive. Rasterisation runs at 2×2
 supersampling with a reversed-Z depth buffer; opaque triangles resolve visibility first, the
@@ -204,15 +220,63 @@ instead of skipping pixels (Viewer Zoom Quality More Accurate): GPU frames carry
 sampled trilinearly, CPU frames go up averaged down by the whole factor that leaves about one
 texel per screen pixel.
 
+32 bpc projects keep **half-float frames** on the desktop (`frames::F16Frame`, 8 bytes a pixel:
+the RAM preview holds half as many as of 8-bit frames). They are rendered without Project
+Settings ▸ HDR (`RenderOpts::skip_hdr_step`), so the values above 1.0 stay. The viewer's
+**display pass** (`engine::viewer::DisplayPass`; on the GPU `ui-egui/src/display_gpu.rs` +
+`display_gpu.wgsl`) then turns a frame into what the panel shows, in this order: decode with the
+output space's curve, the viewer's exposure in linear light, the HDR step the frame was rendered
+without (Compand / Tone Map), encode, clamp to 0..1, the display colour conversion (Use Display
+Color Management, Simulate Output, LUT profiles), Show Channel, premultiply, round to 8 bits.
+So exposure reaches the full float range, and tone mapping and the monitor conversion see the
+exposed light. The pass runs on egui-wgpu's device (it needs no GPU compositor) into one RGBA8
+texture with mips per viewer slot (main viewer, snapshot, each passive viewer: about 110 MB of
+video memory per slot for a 4K frame, input included); without a device the same steps run on
+the CPU (`DisplayPass::pixel`, which is also the shader's test reference). 8 and 16 bpc frames
+stay 8-bit with the HDR step applied when rendered; they go through the same pass when exposure,
+a channel view or a display conversion applies, else they are drawn as they are. Panels that
+read the viewer's pixels as 8-bit (Video Preview, keyers, thumbnails) get the half-float frame
+converted on demand with the HDR step and without the exposure; the Info panel shows the
+frame's float values. The browser keeps 8-bit frames for now (its frame workers send RGBA8).
+
 A persistent **disk cache** (`render::disk_cache`, Settings ▸ Media & Disk Cache) backs both
-the layer cache and the viewer's RAM preview: layer buffers that were slow to render and every
-preview frame are written (LZ4, atomic rename, checksummed) under 128-bit content keys — the
-comp's content hash (the comp, what it uses, footage file size and time) plus frame, scale and
-view for frames; the layer key salted with the footage fingerprint for layers — so entries
-survive restarts and never go stale. LRU eviction keeps it under the size limit; Edit ▸ Purge
-empties it, `cache.diskStats` reports it, and the timeline draws disk-only frames in blue. In the
-browser the frames live in the Origin Private File System: frame workers write them, the page
-keeps the index (`DiskIndex`) and reads hits ([web.md](web.md#disk-cache)).
+the layer cache and the viewer's RAM preview: layer buffers that were slow to render, every
+preview frame and Roto Brush / Object Matte segmentations are written (LZ4, atomic rename,
+checksummed) and survive restarts. The design (#3184):
+
+- **Keys from memory.** A frame's key is its comp's content key plus frame, scale, view and
+  render options; the content key hashes the project settings and the items the comp can draw
+  (its layers but those that can't change the picture, nested comps, footage with its settings
+  and paths, solids, Media Replacement footage, proxies: `Project::pixel_reach`). Expressions
+  among them add what they can read: every layer of their comps, the markers, the comps and
+  footage they name with literal names (`comp("Name")`, `footage("Name")`, and which items have
+  those names), or the whole project when they compute a name or reach items another way
+  (`expression_reach`). An edit to anything else keeps the key. A layer buffer's key is the
+  layer cache's content key (which names the footage it uses with its paths) and the renderer
+  version. Nothing here looks at a file, and nothing ever scans the project's files.
+- **File lists checked on hit.** Every frame and layer entry keeps the source files it was
+  made of, with the size and modification time they were read with (the browser: size and
+  content hash). An entry is used only while they are unchanged: one `metadata` call per listed
+  file when it is read. A changed, missing or unreadable file, a damaged entry or an older
+  format is a miss; the entry is deleted and the frame renders again and replaces it.
+- **Incomplete lists stay in memory.** A frame or buffer whose files can't all be named (a
+  source that doesn't say what it read, more than 4096 files) is shown but never written.
+- **Reload Footage drops entries.** File ▸ Reload Footage deletes the frame and layer entries
+  whose lists name the item's files (the writer thread reads each entry's list, not its
+  pixels), so a file replaced by one with the same size and time is read again. A reload while
+  the cache is off is remembered for the session and applied when it is switched on, before it
+  is read. A render already under way offers entries made of the files as they were: each
+  render takes the cache's drop generation before it reads, and an entry listing a file dropped
+  after that is refused (`DiskCache::drop_generation`); the frame is shown, never stored.
+- **Edits keep what they can't change.** RAM frames outside an edit's dirty spans are kept
+  (`Project::dirty_spans`), and their disk entries are linked to the comp's new key.
+
+Frame entries are 8-bit RGBA, or for 32 bpc viewer frames half floats with their bytes shuffled
+into planes before LZ4 (the entry header's format byte tells them apart; the render options in
+the key keep the two kinds apart). LRU eviction keeps the cache under the size limit; Edit ▸
+Purge empties it, `cache.diskStats` reports it, and the timeline draws disk-only frames in blue.
+In the browser the frames live in the Origin Private File System: frame workers write them, the
+page keeps the index (`DiskIndex`) and reads hits ([web.md](web.md#disk-cache)).
 
 **Deferred readbacks** (`effectcraft-gpu` `deferred`): where a readback can't be waited for (WebGPU
 in a browser worker) a frame renders in passes. `Accelerator::frame_begin` / `pass_begin` /
@@ -243,7 +307,10 @@ the layer body. Interior styles are clipped to the layer: they blend onto its co
 shape and keep its alpha, so an anti-aliased edge mixes the style and the background only. Layer
 opacity fades the whole stack; Knockout and the R/G/B channel switches apply at composite time. Styled pixels are cached separately from the layer content, so editing a style
 reuses the cached source/masks/effects. Global Light is one setting per comp, mirrored into every
-layer's Blending Options and kept in step after each edit.
+layer's Blending Options and kept in step after each edit. Blending Options can be edited in the Layer Style dialog
+before any style is added: the first change creates the Layer Styles group with Blending Options
+only (`layer.style.add` with `blendingOptions`), in the same undo step as the change. Removing
+the last style keeps the group when its Advanced Blending is not at the defaults.
 
 **Paint and Puppet** are effects whose instances carry nested groups. Paint (`effects::paint`)
 holds Brush / Clone / Eraser strokes (Path, Stroke Options, Transform, hidden Duration span);
@@ -264,7 +331,7 @@ before conversion (a quarter of the conversions; the result differs from convert
 in blocks where colours clip) and resampled from there, as other frames are from full size.
 
 **GPU compositor** (`crates/gpu`; Project Settings ▸ Video Rendering and Effects ▸ Mercury GPU
-Acceleration, the default, or Mercury Software Only; `render.backend`). The CPU renderer is the
+Acceleration, the default, or Software Rendering; `render.backend`). The CPU renderer is the
 reference and keeps rendering layer content (sources, masks, CPU effects, layer styles) into the
 layer cache. The render crate defines an `Accelerator` trait; `effectcraft_gpu::Gpu` implements it
 on wgpu compute shaders. `RenderOpts::backend` picks `Cpu`, `Gpu` or `Auto` (an accelerator
@@ -274,7 +341,7 @@ per comp, output scale and path (readback or viewer display) it averages CPU and
 (warm-up on both sides, the fastest warm-up frame starting the average, single stalls capped),
 picks the GPU unless the CPU is clearly faster, and re-measures the other side every 48 frames.
 Render Queue jobs don't use Auto: every frame of a job renders on the project's renderer (the
-GPU compositor with Mercury GPU Acceleration), so runs of a render don't differ by timing.
+GPU compositor with GPU Acceleration), so runs of a render don't differ by timing.
 Light comps (a few small layers, which the CPU composites only within their bounds) then stay on
 the CPU instead of paying for full-frame passes and a readback. A GPU frame walks the comp like
 `draw_comp`: cached layer buffers are uploaded once per buffer, then transformed with the CPU's
@@ -303,16 +370,16 @@ Preserve Transparency / blend kernels (a 3D track matte renders solo through the
 Environment Light Background layers draw their sky in a kernel (`adv_sky`, from
 `Renderer::sky_draw`) before the rest of the run, in Classic and Advanced 3D comps. Wireframe
 outlines draw on the GPU from the CPU's pixel list (`Renderer::wireframe_pixels`). GPU effects
-(`effects::GPU_EFFECTS`, 280 of them: blurs, colour correction, keying incl. Key Light, mattes,
-channel, stylize, distortion and warps (Warp, Bezier Warp, Smear, Reshape, CC Bend It, CC Page
-Turn, CC Bender, CC Blobbylize), Cartoon, bevels, shapes, the transitions (CC light family, CC
-transitions, Block Dissolve), perspective (Radial Shadow, CC Cylinder / Sphere / Spotlight /
+(`effects::GPU_EFFECTS`, 280 of them: blurs, colour correction, keying incl. Screen Color Key, mattes,
+channel, stylize, distortion and warps (Warp, Bezier Warp, Smear, Reshape, Two-Point Bend, CC Page
+Turn, Flexible Bend, Organic Displacement), Cartoon, bevels, shapes, the transitions (CC light family, CC
+transitions, Block Dissolve), perspective (Radial Shadow, Cylinder Wrap / Sphere / Spotlight /
 Environment, 3D Glasses), generators, noise, grain, text (Numbers, Timecode), time, 3D Channel (aux channels as an
 extra texture), Immersive Video, colour management (colour programs from
 `effects::color_program`, LUTs in a storage buffer) and the simulations' render passes (the
 simulation stays on the CPU and hands its plan — sprites, pieces, blobs, grids — to a tiled
-rasteriser; the particle effects too, `gpu::fx_particles`: CC Particle World / Systems II,
-Particle Playground with its Layer Map frames in one atlas, CC Ball Action, CC Pixel Polly, CC
+rasteriser; the particle effects too, `gpu::fx_particles`: Particle Emitter 3D / Systems II,
+Particle Playground with its Layer Map frames in one atlas, Ball Grid, Pixel Shatter, CC
 Scatterize; plans too large for one item table draw in several passes over the previous one),
 and the geometry generators (Lightning, Advanced Lightning, Radio Waves, Stroke, Scribble,
 Vegas, Write-on, Audio Spectrum / Waveform, Basic / Path Text: bolts, strokes, waves, audio
@@ -323,7 +390,7 @@ as kernels, in one module per family (`gpu::fx_*` with `shaders/fx_*.wgsl`); con
 effects run as one chain with one upload and one readback. Statistics that need the whole frame
 (Auto Levels / Contrast / Color, Equalize, Shadow/Highlight, Color Stabilizer, Remove Grain's
 noise level) are measured on the CPU from one readback and applied on the GPU; effects reading
-other frames (Echo, Posterize Time, Time Difference, Time Displacement, CC Force Motion Blur, CC
+other frames (Echo, Posterize Time, Time Difference, Time Displacement, Temporal Motion Blur, CC
 Wide Time, Pixel Motion Blur, Timewarp) upload the frames the host renders (`time_frames`) and
 combine them on the GPU; Time Displacement's per-pixel times and Timewarp's motion vectors
 (`time_fx::timewarp_plan`) are computed on the CPU. Numbers and Timecode rasterise their glyph
@@ -345,7 +412,10 @@ as NaNs (a kernel that skips pixels fails the oracle) and validation errors pani
 (`ui-egui::frames`); headless renders, the CLI (unless `--gpu`) and CI use the CPU. Outside
 tests, device errors are logged rather than fatal. A viewer frame that runs out of video memory
 (`Gpu::within_memory`) renders on the CPU, the uploaded layers and pooled textures are freed, and
-the RAM preview keeps half as many GPU frames from then on. A frame whose render panics is
+the RAM preview keeps half as many GPU frames from then on. The same guard catches a frame's
+validation errors (an invalid texture, often left by a failed allocation): that frame renders on
+the CPU and the kept textures are freed, but the compositor stays on and, with no allocation
+failure before it, the RAM preview keeps its GPU frames (#1319). A frame whose render panics is
 rendered again on the CPU or released, never left in progress. Native readbacks and timing waits
 share a finite deadline; failure retires pending readbacks exactly once, and late results are
 discarded. The desktop executable and browser page own their shared device's error/loss handlers and forward
@@ -356,18 +426,25 @@ to the preview cache. Scoped allocation failures retain the adaptive budget/CPU
 
 **Recovery boundary:** the host installs handlers through eframe's CreationContext, after egui's
 presentation pipelines but before EffectCraft's pipelines. This does not cover that earlier egui
-startup window. eframe 0.36.2 supports lost-surface recreation, not replacing its live device and
+startup window. eframe 0.37 supports lost-surface recreation, not replacing its live device and
 all presentation resources. Device loss therefore requires restarting the presentation backend;
 CPU compositing alone cannot restore that display. No automatic restart or persistent safe-mode
 sentinel is implemented here. Browser scope futures are not synchronously awaited; the browser page
 forwards shared-device errors, while owned worker devices install their own handlers. On the web
 (WebGPU) the GPU composites viewer frames; steps that need a readback fall back to the CPU (the
 Info panel's pixel readout reads GPU frames back asynchronously). **GPU particles**
-(`effects::psim`, `gpu::particles`): CC Particle World, CC Particle Systems II and Particle
+(`effects::psim`, `gpu::particles`): Particle Emitter 3D, Particle Emitter 2D and Particle
 Playground cannons without interacting forces evolve every particle independently, so the GPU
 backend (reached through `EffectHost::particles` when the GPU compositor is active) simulates one
 particle per invocation from the CPU's birth schedule and keeps per-key state checkpoints on the
 GPU, like `SimCache`; the CPU simulation stays the oracle (tests compare ids and positions).
+Particle Emitter 3D, Particle Emitter 2D and Liquid Particles sample their Birth Rate at every
+step (`EffectHost::param_at`, #1373), so a keyed rate only decides the births of its own time;
+the rate is left out of the simulation key, and a checkpoint is resumed only with the same rate history (the CPU state's `hist`, the GPU
+checkpoint's births). The rate's keyframes are read at the step's exact layer time
+(`EvalCtx::value_at_layer_time`; mapping it to comp time and back rounds under a fractional
+stretch), a rate without keyframes or an expression isn't sampled, and a layer of one of them with
+expressions isn't layer cached (its key can't see what an expression returned at earlier times).
 `effectcraft-cli bench --gpu` reports CPU vs GPU ms/frame, speed-up, Auto's ms/frame, pixel
 agreement and the steady-state upload / readback MB per frame for every comp plus an
 adjustment-layer comp.
@@ -380,7 +457,14 @@ inputs in 32 bpc. With a working space (sRGB, Rec. 709, Rec. 2020, Display P3; m
 from the published primaries), footage is converted from its colour profile (stream metadata or
 Interpret Footage, else sRGB) and the top-level comp is converted to the sRGB display. Linearize
 Working Space runs everything in linear light; Blend Colors Using 1.0 Gamma linearises only for
-blending. Layer cache keys include these settings.
+blending. Layer cache keys include these settings. Project Settings ▸ HDR (compand / tone
+mapping) is the last top-level step, for standard-dynamic-range displays and outputs; OpenEXR
+renders (sequences and ProEXR) skip it (`RenderOpts::skip_hdr_step`) and decode the frame with the
+output space's own curve (`Pipe::output_linear`), so they hold linear light in the output space's
+primaries; unmanaged projects decode with the Working Gamma's curve (sRGB at 2.2, a pure 2.4 power
+curve at 2.4). Every OpenEXR file (sequences and ProEXR) names those primaries and the white point in its
+`chromaticities` attribute (`ColorSpace::exr_chromaticities`; Rec. 709 / sRGB primaries for the default
+and for unmanaged projects, Rec. 2100 PQ and HLG as BT.2020, the ACES spaces with the ACES white). Unmanaged projects and Rec. 2100 PQ / HLG outputs never get the HDR step.
 
 **Frame blending**: footage and precomp layers whose source time falls between source frames
 (rate conform, stretch, remap) blend the two neighbouring frames, by cross-fade (Frame Mix) or by
@@ -391,7 +475,10 @@ hierarchical block-matching optical flow and a bidirectional warp (Pixel Motion,
 its nested layers straight into the parent with concatenated transforms (one resample), so
 nested blend modes and adjustment layers act on the parent's layers; nested 3D layers use the
 parent's camera and lights and, when the precomp layer is 3D, are depth-sorted with the parent's
-3D run. Masks, effects or styles force a flattened render. Text layers are always rasterised at
+3D run. Essential Properties overrides (properties, Font and Media Replacement) travel with the
+collapsed context and are applied while the nested layers are evaluated, so they do not force a
+flattened render or clip at the precomp's frame. Masks, effects or styles force a flattened
+render. Text layers are always rasterised at
 their on-screen scale, as text is vector in After Effects; on shape layers and vector footage the
 switch is Continuously Rasterize and does the same. Quality: Draft samples
 nearest-neighbour, Wireframe draws the layer bounds. Slip edit (`layer.slip`, Alt+PageUp/Down,
@@ -458,8 +545,10 @@ effects crate, hence the `effects → track` edge.
 `essential` field lists its exposed controls (properties, Media Replacement, groups, comments).
 Every precomp layer of such a comp gets an Essential Properties group (`GroupKind::Essential`,
 children `eg<control id>`), kept in step by `Session::edit`; editing a child overrides it for
-that instance. The renderer draws an instance with overrides from a copy of the project with the
-overridden source properties set (`essential::with_overrides`). Templates are `.ectemplate`
+that instance. A collapsed instance carries its property, Font and Media Replacement overrides
+into the nested render context (`Collapsed`, `EvalCtx::{property_overrides, media_overrides}`);
+other instances are drawn from a copy of the project with the overridden source properties set
+(`essential::with_overrides`). Templates are `.ectemplate`
 ZIPs: `manifest.json` (controls), `project.ecproj` (the comp and its dependencies), `media/…` and
 `poster.png`; importing offsets every id past the project's (`essential::offset_ids`).
 **Responsive Design — Time**: a time-stretched precomp maps time piecewise so its protected
@@ -540,7 +629,7 @@ Unix milliseconds. The layer's Start Time becomes `dataStart + videoStart − fi
 (`videoStart` given, or the file's creation date on the desktop; reduced to a time of day when
 the data has no dates).
 
-**Lumetri Scopes** (`raster::scopes`) are density plots of the viewer frame (rendered over the
+**Video Scopes** (`raster::scopes`) are density plots of the viewer frame (rendered over the
 comp background) with BT.601 / BT.709 / BT.2020 luma and colour-difference coefficients.
 
 ## 5. Expressions
diff --git a/docs/blender-camera-export.md b/docs/blender-camera-export.md
new file mode 100644
index 000000000..d102eef4f
--- /dev/null
+++ b/docs/blender-camera-export.md
@@ -0,0 +1,101 @@
+# Exporting a tracked camera to Blender
+
+After the **3D Camera Tracker** finishes solving, click **Export Scene to Blender...** in its
+Effect Controls and save the `.py` file. In Blender 4.0 or newer, open it in the Scripting
+workspace's Text Editor and choose **Run Script**. The script creates and activates a new scene;
+it preserves existing scenes and objects. Save the resulting `.blend` normally.
+
+The script uses Blender's public Python API, with no add-on or Python dependencies beyond
+Blender itself. For unattended use: `blender --background --python "Tracked Scene.py"`.
+That imports the scene in memory; it does not automatically save a `.blend`.
+
+## Transferred data
+
+- Camera position and quaternion rotation baked on every analyzed frame, with consistent
+  quaternion signs and linear interpolation; zoom/lens animation, including Variable Zoom.
+- Tracking input/video resolution, horizontal sensor fit, exact rational composition FPS,
+  frame range and composition markers within the analyzed interval. The first analyzed frame
+  becomes Blender frame 1 by default; the original composition timestamps remain in metadata.
+- The original video or still as the camera's background image, at full opacity, refreshed on
+  frame changes. Source-frame offsets are baked too, accounting for trim, stretch, source FPS
+  and Time Remap. This is a viewport background, not a render/compositor background.
+- Focus distance, DOF switch, f-stop, iris blade count, rotation and aspect sampled from the
+  tracker's linked **3D Tracker Camera**, including keyframes and expressions. Create that
+  camera and adjust its Camera Options before exporting to transfer custom focus settings.
+- Solved 3D points as a non-rendering vertex mesh, with point attributes for track ID,
+  reprojection error and first/last visible frame. A chosen ground plane becomes Blender's XY
+  plane, with its origin preserved and a non-rendering wire plane as a placement guide.
+- Shutter duration (not automatically enabled), plus the original shutter phase in metadata.
+- A Blender Text datablock named `EffectCraft Tracking Metadata.json` containing the complete
+  solve, optional original 2D tracks, per-frame timings, source interpretation, diagnostics and
+  export warnings. Radial distortion coefficients are also camera custom properties.
+
+Coordinates are converted from EffectCraft's right/down/forward world to Blender's
+right/forward/up world, including the camera's local up and negative-Z viewing direction.
+Export uses the tracking input's framing, not the footage layer's final 2D placement in the
+composition. Camera pose and lens always come from the solve; subsequent manual pose/lens edits
+on the linked camera are not substituted for the tracked motion.
+
+## What cannot be inferred
+
+Monocular tracking cannot recover absolute scene scale, physical sensor size, optical focus,
+f-stop or exposure from feature tracks. The default sensor width is an assumption of **36 mm**;
+the focal length in millimeters is derived from it while preserving the solved field of view.
+The default scale is **0.01 Blender units per composition-world pixel**, not a measurement.
+Without a linked camera, DOF is disabled and focus distance uses the default solved scene depth.
+Blender's physical DOF approximates EffectCraft's blur model: Blur Level and Iris Roundness are
+retained in metadata, but have no direct Blender equivalent.
+
+Brown-model radial `k1`/`k2` coefficients use radius normalized to half the image diagonal.
+They are preserved, **not** assigned to Blender's different lens-distortion model. For a precise
+match when distortion is nonzero, use an undistorted plate; the script prints a warning.
+The tracker assumes square pixels, so Blender renders square pixels; any non-square source
+interpretation is retained in metadata and flagged.
+
+The `.py` references the video; it does not contain a copy of the video's bytes. When moving it,
+keep the video next to the script (same filename), or relink the background image in Blender.
+Missing/unsupported media produces a warning while retaining the imported camera and geometry.
+Masks and effects applied before the tracker are not baked into the original media. Export
+requires a direct video/still footage layer at the analyzed size; render precomps, sequences or
+size-changing preprocessing to a video and track that video first.
+
+## Agent / control-channel command
+
+```json
+{
+  "command": "camera.exportBlender",
+  "params": {
+    "layer": "#1",
+    "path": "/output/Tracked Scene.py",
+    "sensorWidth": 36,
+    "unitScale": 0.01,
+    "startFrame": 1,
+    "includePoints": true
+  }
+}
+```
+
+`comp`, `layer` and `effect` select the tracker as with `camera.analyze`. Without explicit
+selection, the selected tracker (or first tracker in the composition) is used. `sensorWidth`,
+`unitScale`, `startFrame` and `includePoints` are optional. The reply contains file size,
+exported frame/point counts and warnings. Writing uses the host's atomic file service.
+Calls issued by scripts require **Allow Scripts to Write Files and Access Network** in
+Settings ▸ Scripting & Expressions. Export from the UI or control channel remains available
+with that preference off.
+
+Export is limited to 100,000 analyzed frames, 100,000 points and 64 MiB of serialized scene data;
+invalid, stale or incomplete solves return an actionable error without modifying the document.
+
+## Verification
+
+Engine tests check argument validation, escaped/Unicode paths, fractional FPS, trim/stretch,
+focus/f-stop, zoom, ground placement, malformed solves and write failures. To additionally run
+the generated artifact against an installed Blender's public API:
+
+```sh
+EFFECTCRAFT_BLENDER=/path/to/blender cargo test -p effectcraft-engine tests::blender -- --nocapture
+```
+
+Optionally set `EFFECTCRAFT_BLENDER_PLATE` to a local synthetic 640×360 video to exercise media
+loading and source-frame offsets. The oracle checks every synthetic point's projection through
+the imported camera on every frame, as well as animation, DOF, timing and scene preservation.
diff --git a/docs/contributors.md b/docs/contributors.md
index 6b8a81e01..cbddfb8cf 100644
--- a/docs/contributors.md
+++ b/docs/contributors.md
@@ -1,16 +1,15 @@
 # Contributors in the About window
 
 **About ▸ Contributors** credits everyone who contributed to EffectCraft, and **About ▸ Models** credits
-the AI models named in `Co-Authored-By` trailers. This follows the shared craftrules standard
-[`standards/contributors.md`](https://github.com/storytold/craftrules/blob/main/standards/contributors.md);
-this page is the local copy of the decision.
+the AI models named in `Co-Authored-By` trailers.
 
 ## Decision
 
 - Two files, both **compiled into the binary** by the UI crate's `build.rs` (nothing is read from
   disk or the network at run time; the web build has them too):
   - [`contributors/contributors.json`](../contributors/contributors.json): commit stats per GitHub
-    username. **Generated** by `craftrules/scripts/contributors.py`; never hand-edit.
+    username. Never hand-edit. Release builds regenerate it for the release commit
+    (`.github/workflows/release.yml`, `credits` job); the copy in the repository is not updated.
   - [`contributors/people.toml`](../contributors/people.toml): the names people chose for
     themselves. **Each contributor adds only their own entry**, in their own PR.
 - Each contributor gets one line: GitHub username (always), display name (opt-in, or their synced
@@ -36,20 +35,5 @@ display_name = "Nickname"
 sync_github_name = true   # use the name on your public GitHub profile as display name
 ```
 
-or, with craftrules checked out next to `craft-apps/`:
-
-```sh
-python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "Your Name" --sync-github-name
-```
-
-Names show after the next refresh: the script checks that each entry was committed by its own
-user (or by a maintainer with a `consent_source`). Delete your entry to remove your names.
-
-## Refreshing (maintainers)
-
-```sh
-python3 ../../craftrules/scripts/contributors.py .           # regenerate + verify; needs git, Python 3.11+, gh
-python3 ../../craftrules/scripts/contributors.py --check .   # verify people.toml only
-```
-
-Commit the updated `contributors/contributors.json`. Git author names and emails are never recorded.
+Names show for entries committed by their own user (or by a maintainer with a `consent_source`).
+Delete your entry to remove your names. Git author names and emails are never recorded.
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 4d01ef2e9..9abc4b494 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -9,6 +9,13 @@ effectcraft --control 9877        # or EFFECTCRAFT_CONTROL_PORT=9877
 The port must be a number from 1 to 65535, and `--control` overrides the variable. A bad port or an
 unknown option prints an error and the app exits with status 1 before it opens a window.
 
+An app started with a control port is meant to be driven by an agent, so a normal launch does not
+wait for a person: the window opens without taking keyboard focus, and the app skips crash recovery,
+the Home screen (unless `--home` is given) and the startup update check. Help ▸ Check for Updates
+still works. One exception: when the window cannot start at all, the app writes the error to
+standard error and the session log and then shows it in a message box, and it exits only after
+someone closes that box.
+
 - **Transport:** TCP on `127.0.0.1` only, one JSON object per line in each direction. Connections are
   persistent; requests on one connection are answered in order.
 - **Request:** `{"id": 1, "method": "engine.execute", "params": {...}}` (`id` is echoed back, `params`
@@ -38,20 +45,40 @@ printf '{"id":1,"method":"engine.execute","params":{"command":"comp.new","params
 | `engine.execute` | `{command, params?}` | The command's result. Every engine command (`effectcraft-cli commands`) runs exactly as it does headless, so it never opens a dialog: `comp.new {}` creates a default comp. UI-only ids (`tool.*`, `view.*`, `window.*`, `playback.*`, `timeline.*`, `app.*`) fall through to the menu dispatcher. Unknown top-level params are rejected, and the error lists the accepted keys. |
 | `ui.menu.invoke` | `{id, params?}` | Like a menu click: commands with empty params may open their dialog (New Composition, Solid Settings, file pickers). |
 | Copy a Media Browser source path | `ui.menu.invoke {id: "mediaBrowser.copySourcePath", params: {path}}` | Copies the exact non-empty path string to the clipboard and returns `{path}`. Supports file/folder paths and virtual source identifiers. Missing, empty or non-string paths return an error. |
-| UI commands (via either) | | `timeline.column {column, visible?}` (av, keys, label, num, comment, switches, modes, parent, in, out, duration, stretch), `timeline.sourceName {value?}`, `timeline.search {query}`, `timeline.reveal.<kind>` / `timeline.revealAdd.<kind>` (the property shortcuts and Shift+shortcut: position, scale, rotation, opacity, anchor, effects, masks, feather, levels, animated, and the double-press sets maskPath, maskOpacity, timeRemap, expressions, material, paint, selected, missingEffects, waveform), `timeline.keyAt.<anchor\|position\|scale\|rotation\|opacity>` (Alt+Shift+A/P/S/R/T), `timeline.twirlSelected` (Ctrl/Cmd+`), `timeline.collapseAll`, `flowchart.options {layers?, effects?, solids?, direction?: lr\|tb, comp?}`, `flowchart.graph {comp?}` → `{nodes, edges}`, `window.workspace {name}` (all After Effects workspaces). |
+| UI commands (via either) | | `timeline.column {column, visible?}` (av, keys, label, num, comment, switches, modes, parent, in, out, duration, stretch), `timeline.sourceName {value?}`, `timeline.search {query}`, `timeline.reveal.<kind>` / `timeline.revealAdd.<kind>` (the property shortcuts and Shift+shortcut: position, scale, rotation, opacity, anchor, effects, masks, feather, levels, animated, and the double-press sets maskPath, maskOpacity, timeRemap, expressions, material, paint, selected, missingEffects, waveform), `timeline.keyAt.<anchor\|position\|scale\|rotation\|opacity>` (Alt+Shift+A/P/S/R/T), `timeline.twirlSelected` ``(Ctrl/Cmd+`)``, `timeline.collapseAll`, `flowchart.options {layers?, effects?, solids?, direction?: lr\|tb, comp?}`, `flowchart.graph {comp?}` → `{nodes, edges}`, `window.workspace {name}` (all After Effects workspaces). |
 | `engine.commands` | `{filter?, enabledOnly?}` | `[{id, label, menu, shortcut, params, enabled, why}]` |
 | `ui.menu.list` | `{}` | The menu tree with enablement. |
-| `render.frame` | `{comp?, time?, max_side?, path?, base64?}` | Renders a comp frame through the session, independent of the viewer zoom or resolution. `comp` is an id or name (default: the active comp), `time` is in comp seconds (default: the CTI), `max_side` caps the longest side (0 = full size). Writes a PNG to `path` (default: a temp file) and returns `{comp, time, width, height, path}`. With `base64: true` it returns `{…, png: "<base64>"}` and writes no file. |
+| `render.frame` | `{comp?, time?, max_side?, path?, base64?, write?}` | Renders a comp frame through the session, independent of the viewer zoom or resolution. `comp` is an id or name (default: the active comp), `time` is in comp seconds (default: the CTI), `max_side` caps the longest side (0 = full size). Writes a PNG to `path` (default: a temp file) and returns `{comp, time, width, height, path}`. With `base64: true` it returns `{…, png: "<base64>"}` and writes no file unless `write: true` also requests a guarded write in the same app operation. |
 
 Useful query commands for `engine.execute` (they aren't journaled or undoable): `project.summary`,
 `comp.info {comp?}`, `layer.tree {layer, comp?, depth?, time?}` (every node has a `path`),
-`prop.get {layer, path, comp?, time?}`, `editor.state`, `command.list {filter?, enabledOnly?, schemas?}`,
+`prop.get {layer, path, comp?, time?}` (a popup (enum) property also lists its `options`, `[{value, label}]`, as `layer.tree` does), `editor.state`, `command.list {filter?, enabledOnly?, schemas?}`,
 `command.describe {command}` (params doc and JSON Schema), `app.capabilities` (version, counts,
 export formats, parity summary), `jobs.list` (Progress panel jobs, e.g. the background
 `footage.check` after File ▸ Open).
 
 Every engine command is reachable through `engine.execute`, and every interactive widget of every
-panel registers an element id; both are enforced by `crates/ui-egui/tests/ui_agent_audit.rs`.
+panel registers an element id; both are enforced by `crates/ui-egui/tests/it/ui_agent_audit.rs`.
+
+### Waiting for a render
+
+On native desktop builds, `engine.execute` with `renderQueue.render` and `wait: true`
+(the default) keeps the window responsive while its reply waits for the render worker.
+`script.run` invoked through the control channel also yields the window while
+`app.project.renderQueue.render()` waits. JavaScript resumes after completion or cancellation;
+the original request receives its result and accumulated output only after the continuation
+finishes or shows a modal dialog. Several renders in one script keep the same request pending.
+Headless scripts retain their synchronous behavior.
+
+While a script waits for rendering, the window shows progress and a **Stop Render** button
+(`scriptRender.stop`). Other editing and script callbacks pause so they cannot enter the
+suspended script's undo group. `ui.inspect`, `ui.elements`, command/menu listings, resize,
+focus, and the engine commands `renderQueue.list`, `renderQueue.stop`, `editor.state`,
+`app.capabilities`, `command.list`, `scriptui.list` and `scriptui.get` remain available.
+Other control requests return an error. Use another connection for inspection or Stop,
+since requests on one connection are answered in order. A window-close request is canceled
+during this wait; stop the render and then close normally to use the unsaved-changes prompt.
+The control transport's 60-second request timeout still applies to long renders.
 
 ## UI state
 
@@ -103,7 +130,7 @@ Points are logical window coordinates. A target is `{id}` (the element's centre;
 | `ui.click` | `{id \| x,y, button?: left\|right\|middle, count?, modifiers?}` |
 | `ui.move` | `{id \| x,y}` |
 | `ui.drag` | `{from: target, to: target, steps? (12), modifiers?}`: press, move, release |
-| `ui.scroll` | `{id \| x,y, dx, dy}` |
+| `ui.scroll` | `{id \| x,y, dx?, dy?, unit?: point\|line, source?: wheel\|trackpad, pinch?, modifiers?}`: `line` is a mouse wheel (zooms the viewers); `point` (default) is a pixel-precise scroll; `source: trackpad` pans the viewers (as on macOS); with no `source` the viewers take a scroll in points as a wheel until one moves on both axes (a trackpad: from then on it pans); `pinch` is a trackpad pinch's zoom factor |
 | `ui.key` | `{key}`, for example `Space`, `F9`, `Cmd+Z`, `Cmd+Shift+Z`, `PageDown`, `Escape` |
 | `ui.type` | `{text}`: text input into the focused field |
 
@@ -126,7 +153,7 @@ frames and can be assigned through `shortcuts.set`.
 
 | Method | Params | Result |
 |---|---|---|
-| `ui.screenshot` | `{path?, panel?, id?}` | `{path, width, height}`: a PNG of the window, or cropped to one panel or element. |
+| `ui.screenshot` | `{path?, panel?, id?}` | `{path, width, height}`: a PNG of the window, or cropped to one panel or element. The panel or element rectangle is resolved when the capture is issued (after the UI settles), so it follows a panel that moved; a panel or id that is not on screen is retried and then reported, never replaced by a whole-window shot. |
 
 Element ids are stable, for example `tools.Selection`, `panel.Timeline`, `panel.tab.EffectControls`,
 `panel.tab.Timeline.<comp>` (one Timeline tab per open comp; `panel.tab.Timeline` is the shown
@@ -143,7 +170,9 @@ revolutions are `timeline.prop.<uid>.revolutions`, `effectControls.prop.<uid>.re
 `viewer.showSnapshot`, `viewer.fastPreviews` (their popup entries are `viewer.<menu>Item.<n>`),
 `viewer.ruler.top|left|origin`, `viewer.mask.<uid>.vertex.<i>`, `viewer.shapePath.<uid>.vertex.<i>`,
 `viewer.motionPath.<layer>.<key>[.in|.out]`, `viewer.puppetPin.<uid>[.rotate|.scale]`,
-`viewer.freeTransform.handle.<i>` and
+`viewer.freeTransform.handle.<i>`, `viewer.cryptoPick` (the Cryptomatte eyedropper's hover chip; its
+label is the chip's text), `viewer.cryptoPick.error` (the chip when it shows an error; label `whole`, or
+`cut` when the message is cut off), `viewer.cryptoPick.highlight` (the hovered ID's highlighted area) and
 `viewer.regionOfInterest`; the Graph Editor adds `timeline.graph.transformBox[.<i>]`,
 `timeline.graph.snap` and `timeline.graph.reference`. Use `ui.elements` to see what is on screen.
 
@@ -186,20 +215,65 @@ including outside the layer's `[in, out)` range. Timing metadata carries outside
 `prop.get.time` is comp seconds. For these commands, `path` or `prop` identifies a property, not a group.
 Set a layer's offset with `layer.timing {layer, start}` (comp seconds).
 
-Panel moves, tab ordering, edge splits and floating geometry use shared docking transactions.
-`window.floatPanel` requires exactly four finite numbers when `rect` is supplied. Invalid
-geometry or missing source/anchor panels leaves the layout unchanged. The persisted workspace
-shape is unchanged: accordion open states and explicit heights, floating groups, and dynamic
-viewer/ScriptUI identities remain app data. Pointer drops use the same shared placement rules
-as commands, with floating groups resolved in their actual window stacking order.
+Panels dock in craft-ui's shared docking (`craft_ui::docking`): split frames, tab groups,
+stacked panels and floating windows. Every change, by pointer, menu or command, is one
+transaction that checks the whole result; an invalid one returns an error and leaves the layout
+unchanged. No move or float may leave the docked area empty; closing its last panel is allowed.
+Panels name themselves by id (`"EffectControls"`), by title (`"Effect Controls"`) where a command
+takes a name, or as `{"Viewer":42}` and `{"ScriptPanel":77}` for viewers and ScriptUI panels.
 
-`window.dockAction` accepts `{action}` using the shared docking action's JSON form. It
-covers tab moves and ordering, split and floating geometry, activation, and closing.
-For example, `{"action":{"ResizeSplit":{"path":[],"size":{"FixedFirst":360}}}}`
-resizes the root split; path entries use `false` for the first child and `true` for
-the second. `{"action":{"MoveFloating":{"panel":"Info","rect":[45,65,420,320]}}}`
-repositions and resizes the floating group containing Info. Invalid actions leave the
-layout unchanged. Pointer gestures dispatch through this same catalog command.
-EffectCraft also supports `SetStackOpen` and `ResizeStack`. Dynamic panel identities use
-`{"Viewer":42}` or `{"ScriptPanel":77}` in the action. Closing runs the existing viewer
-and ScriptUI lifecycle callbacks; opening uses the existing panel creation commands.
+- `window.dockAction {action}` applies one craft-ui `Action` in its JSON form. For example,
+  `{"action":{"ResizeSplit":{"path":[],"size":{"FixedFirst":360}}}}` resizes the root split
+  (path entries are `false` for the first child and `true` for the second), and
+  `{"action":{"MoveFloating":{"panel":"Info","rect":[45,65,420,320]}}}` moves and resizes the
+  floating window holding Info. `Open` and `OpenAt` are refused: panels open through the panel
+  commands (`window.panel`, `ui.panel.show`), which run the viewer and ScriptUI lifecycles.
+  Closing runs them too. Pointer gestures dispatch through this command.
+- craft-ui's commands: `window.panel.move`, `.float`, `.dock`, `.activate`, `.close`,
+  `.closeGroup`, `.closeOthers`, `.minimize`, `.iconic`, `.window` and `.layout`, with the params
+  of craft-ui's `DockCommand` (`docs/ui-docking.md` in craft-libs). `window.panel.<Panel>`
+  (`window.panel.Align`) opens and shows that panel. `window.panel.activate` on a closed panel
+  reopens it where it was.
+- `ui.dock {operation, panel, …}` or `ui.dock {action}`: craft-ui's `ui.dock` operations
+  (`open`, `close`, `activate`, `float {rect}`, `moveFloating {rect}`,
+  `move {target, zone?, before?}`, `setStackOpen {open}`, `resizeStack {height}`,
+  `resizeSplit {path, size}`; `rect` is `[x, y, width, height]`). It returns
+  `{"docking": workspace}`. `ui.dock.reset` returns the current workspace to its saved or
+  built-in layout and returns the same. Raw `Open` and `OpenAt` actions are refused in both
+  `ui.dock {action}` and `window.panel.layout {action}`, as in `window.dockAction`; use the
+  panel open commands instead.
+- `window.dockPanel {panel, anchor?, zone?, before?}` docks as `window.panel.dock`: `zone` is
+  `center`, `tab`, `left`, `right`, `top`, `bottom`, `above` or `below`; without an anchor a
+  side zone docks along that edge of the whole workspace. `window.floatPanel {panel, rect?}`
+  requires exactly four finite numbers when `rect` is given and otherwise floats a 420x320
+  window in the middle of the app window. `window.closePanel {panel}` closes it.
+- `window.panelWindow {panel, window?}` puts a panel in a floating window of its own with a
+  desktop place over the panel's place in the main window, and returns `{"window": bool}`. A
+  docked panel floats first. `window` false docks it again, as a tab of the first docked group;
+  without `window` it toggles.
+
+On desktop every floating window is an OS window of its own (craft-ui's `native-windows`), which
+can go on another monitor; on Wayland, on the web and where egui embeds viewports, floating
+windows stay in the main window. Keys pressed in a floating window that none of its widgets uses
+run the main window's shortcuts, and files dropped on one import as on the main window. While a
+modal dialog is open, floating windows take no input.
+
+The automation ids of the docking chrome are `panel.tab.<Panel>`, `panel.drag.<Panel>` (a
+group's drag bar), `panel.tabs.more.<Panel>`, `panel.menu.<Panel>` (≡), `panel.header.<Panel>`
+(a stacked panel's open and close button), `panel.tab.<Panel>.lock` (viewer lock),
+`panel.tab.Timeline.<comp>` and `panel.tab.Timeline.close` (the Timeline's comp tabs),
+`panel.float.<n>.move`, `.close`, `.resize` and `.resize.<Edge>` for floating window `n`,
+`dock.gutter.<path>` for dividers (`a`/`b` per split level; a stack's gap below entry `i` adds
+`s<i>`) and `dock.corner.<outer>.<inner>` where two dividers meet.
+
+Saved workspaces (`workspaces.json`, version 2) hold craft-ui `Workspace`s: the layout, the
+closed panels with where each goes back, the lock, and each floating window's desktop place. A
+version 1 file (EffectCraft 0.10 and earlier) and the older unversioned record of
+named workspaces load with every panel in place: the current layout, the named workspaces,
+floating windows and their native window places. A column of stacked frames becomes tab groups
+split top to bottom: each open frame keeps all its tabs and its height (as a fixed size), and a
+closed frame's tabs join the open frame above it. A native window's place moves from the OS
+window's outer position to its content's, by the main window's title bar, before the first save.
+Panels that were closed stay closed and reopen at their default place. The first save writes version 2 and keeps
+the earlier file as `workspaces.old.json`. A damaged, unknown or newer file loads as the default
+layout and is left unchanged.
diff --git a/docs/effects-parity.md b/docs/effects-parity.md
index c5fbc5ba8..c7f850834 100644
--- a/docs/effects-parity.md
+++ b/docs/effects-parity.md
@@ -15,8 +15,8 @@ After Effects', and does the preset library exist. The per-effect catalogue is t
 | Parameter names, order, popups, units, defaults | aligned in M9.12 | Agent-checked against After Effects' documentation, not against a live dump |
 | On the GPU | **280** (92%) | Measured: registry flags; GPU vs CPU agreement tested per effect |
 | 32-bit float, no clamping | 306 | Measured: registry flags |
-| **Rendered output matches After Effects** | **unmeasured** | No effect is compared with an After Effects render yet. `effectcraft_effects::fidelity::compare_frames` exists for the corpus ([fidelity/README.md](fidelity/README.md)); simulation effects are pinned by golden hashes of our own output (M13.27) |
-| Animation presets | **54** original presets (8 text-animator, 23 Transitions, 23 Backgrounds) against After Effects' **621** `.ffx` presets | Measured: `crates/engine/presets/text_animators.json`, `crates/engine/presets/transitions.json`, `crates/engine/presets/backgrounds.json`; the After Effects `Presets` folder |
+| **Rendered output matches After Effects** | **partly measured** | Some colour effects are checked against After Effects 2026 renders of our own test projects: Tint, Tritone, Black & White, Exposure, Levels, Curves, Luma Key, Extract, 4-Color Gradient and Fill within 1–3/255, Brightness & Contrast up to 6.2/255 (Color Correction, Generate and Keying rows below); Radial Blur, Glow, Venetian Blinds, Radial Wipe, Fractal / Turbulent Noise and Transform are checked the same way (rows below); every other effect is unmeasured. `effectcraft_effects::fidelity::compare_frames` exists for the corpus ([fidelity/README.md](fidelity/README.md)); simulation effects are pinned by golden hashes of our own output (M13.27) |
+| Animation presets | **76** original presets (8 text-animator, 23 Transitions, 23 Backgrounds, 22 Behaviors) against After Effects' **621** `.ffx` presets | Measured: `crates/engine/presets/text_animators.json`, `crates/engine/presets/transitions.json`, `crates/engine/presets/backgrounds.json`, `crates/engine/presets/behaviors.json`; the After Effects `Presets` folder |
 | 26.x additions | Curl Noise (26.3) present (#463 open); effect colour labels (26.5) present in Effect Controls only, not in the Timeline; the rebuilt Effect Controls (26.5) missing | Release notes |
 
 **Breadth ≈ 85%** (presets weigh in; the effects themselves are ≈ 100%). **Ready ≈ 40%**: until a
@@ -26,26 +26,26 @@ corpus compares renders, each effect is assumed to differ somewhere, and users k
 
 | Category | Effects | On the GPU | Known differences or bugs |
 |---|---:|---:|---|
-| 3D Channel | 8 | 8 | Cryptomatte selection can't be set in the UI and the GPU path is slow (#473; quoted names with commas fixed); multi-layer EXR decode shared (#474 open: f16 storage and cache sizing remain) |
+| 3D Channel | 8 | 8 | Cryptomatte's GPU path is slow (#473; the Selection is picked in the viewer with an eyedropper, quoted names with commas fixed); multi-layer EXR: one decode per frame for the picture and the channels, cache softly bounded at 1 GB (#474; holding channels as f16 is still to do) |
 | Audio | 13 | 0 | CPU by design (applied in the mixdown) |
-| Blur & Sharpen | 16 | 15 | Gaussian Blur interaction and output to be measured first ([fidelity/ae-2026-acceptance.md](fidelity/ae-2026-acceptance.md)) |
+| Blur & Sharpen | 16 | 15 | Radial Blur keeps the layer edges as After Effects 2026 (713 now pixel-identical); Gaussian Blur interaction and output to be measured first ([fidelity/ae-2026-acceptance.md](fidelity/ae-2026-acceptance.md)) |
 | Channel | 13 | 13 | — |
-| Color Correction | 40 | 40 | Tint has Swap Colors (#963); ACES 2.0 / OCIO 2.5 (26.5); Apply Color LUT (#514) and 32-bpc blending (#494) are closed |
-| Distort | 39 | 35 | Liquify has no viewer brush; #303 (Mesh Warp drag) and #534 (CC Power Pin Unstretch) are closed |
+| Color Correction | 40 | 40 | Tint, Tritone and Black & White (sliders and Tint) match After Effects 2026 renders (Rec. 601 luminance); Levels (Individual Controls) matches After Effects 2026 in 32 bpc (channel controls before RGB, "Off for 32 bpc Color" unclipped; plain Levels' channel order not measured); Brightness & Contrast (non-legacy) close to After Effects 2026 ramps, not identical (up to 6.2/255 off; the test allows 7/255) (negative settings invert the positive curves); Curves interpolates a natural cubic spline through its points, as After Effects 2026 (exact on its grey steps); Tint has Swap Colors (#963); ACES 2.0 / OCIO 2.5 (26.5); Apply Color LUT (#514) and 32-bpc blending (#494) are closed |
+| Distort | 39 | 35 | Transform matches After Effects 2026 renders (skew after rotation, drawn outside the layer); Liquify has no viewer brush; #303 (Mesh Warp drag) and #534 (CC Power Pin Unstretch) are closed |
 | Expression Controls | 9 | 9 | — |
-| Generate | 26 | 25 | Fractal on the CPU (needs f64); #526 (Reset) and #536 (Write-on marks) are closed |
+| Generate | 26 | 25 | 4-Color Gradient's Blend matches After Effects 2026 (weights 1 / (d² + Blend²)); Fill's Opacity is the filled layer's opacity, as After Effects 2026 renders it (with a Fill Mask it still mixes with the original, not measured); Fractal on the CPU (needs f64); #526 (Reset) and #536 (Write-on marks) are closed |
 | Immersive Video | 12 | 12 | — |
-| Keying | 12 | 12 | Key Cleaner approximated; #533 (wire-removal Frame Offset) is closed |
+| Keying | 12 | 12 | Luma Key and Extract key on Rec. 601 luminance, as After Effects 2026; Key Cleaner approximated; #533 (wire-removal Frame Offset) is closed |
 | Matte | 6 | 4 | Mocha shape reads our documented JSON, not Mocha's format |
-| Noise & Grain | 13 | 12 | Curl Noise (#463); Match Grain on the CPU |
-| Obsolete | 9 | 9 | — |
+| Noise & Grain | 13 | 12 | Fractal / Turbulent Noise lattice matches After Effects 2026 (Scale 100 = 66.7 px cells); the noise values themselves differ (seeds) and Soft Linear contrast is about 20 % lower than AE's; Curl Noise (#463); Match Grain on the CPU |
+| Obsolete | 9 | 9 | Luma Key matches After Effects 2026 on a grey ramp (hard cut, Tolerance only for Similar / Dissimilar) |
 | Paint | 1 | 0 | Tablet pressure not read ([hardware-parity.md](hardware-parity.md)) |
 | Perspective | 10 | 9 | Chromatic Aberrations pan/tilt crash (#580) |
 | Simulation | 18 | 18 | Particle Playground lacks Particle Exploder, text particles, ephemeral mapper; CC Particle World camera fixed (#397) |
-| Stylize | 25 | 25 | Motion Tile output size (#369) |
+| Stylize | 25 | 25 | Glow's halo (coverage of a dim layer's edge) and blur width match After Effects 2026 renders; glows above the threshold match too (each channel 8 × (value − threshold + 0.061), measured at three thresholds and two radii); Composite Original's labels are swapped against After Effects (EffectCraft's On Top adds the glow over the original, which After Effects calls Behind); Motion Tile output size (#369) |
 | Text | 2 | 2 | — |
-| Time | 8 | 8 | #535 (Pixel Motion Blur, Vector Detail) is closed |
-| Transition | 17 | 17 | — |
+| Time | 8 | 8 | Timewarp retimes the layer's source and masks without the effects above it, as After Effects 2026; #535 (Pixel Motion Blur, Vector Detail) is closed |
+| Transition | 17 | 17 | Venetian Blinds matches After Effects 2026 renders (band phase from the layer centre, Gaussian feather on both edges) except within ~6 px of the layer edge (up to 48/255); Radial Wipe's Feather matches After Effects 2026 (a Gaussian of σ = 0.4 × Feather pixels on both edges of the wedge) |
 | Utility | 9 | 7 | — |
 
 Third-party bundles in After Effects (Cineware, Mocha AE) are out of scope; Keylight is
@@ -56,7 +56,7 @@ implemented under a generic name ("Key Light").
 **≈ 70–130 h**: a fidelity corpus case per effect at default and one non-default setting, compared
 with After Effects renders, and the fixes they turn up (40–80 h, most of it parallel, but every
 reference render needs After Effects on the owner's Mac); an original preset library covering
-After Effects' preset categories (Behaviors, Shapes, Synthetics, Text, Image effects remain; Backgrounds and
+After Effects' preset categories (Shapes, Synthetics, Text, Image effects remain; Backgrounds, Behaviors and
 Transitions exist) 15–35 h; the open effect bugs 10–20 h. Moving Fractal and the analysis effects to
 the GPU is performance, not parity.
 
@@ -64,6 +64,25 @@ the GPU is performance, not parity.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-19 | minor | Glow (original colours): bright pass per channel, 8 × (value − threshold + 0.061), measured against After Effects 2026 (CPU and GPU) |
+| 2026-10-19 | minor | Glow (colour channels): the glow covers the layer's blurred alpha, blur σ = 0.384 × radius, measured against After Effects 2026 renders (CPU and GPU) |
+| 2026-10-19 | minor | Radial Blur repeats the edge instead of sampling transparency outside the layer, measured against After Effects 2026 renders (CPU; Radial Blur has no GPU path) |
+| 2026-10-19 | minor | Venetian Blinds: stripes measured from the layer centre, both band edges Gaussian (σ = Feather / 2), measured against After Effects 2026 (CPU and GPU) |
+| 2026-10-19 | minor | Radial Wipe: Feather is in pixels on both edges of the wiped wedge (was degrees on the moving edge only), measured against After Effects 2026 (CPU and GPU) |
+| 2026-10-19 | minor | Fractal / Turbulent Noise: lattice cell = Scale × 2/3 px (Block noise every 66.7 px at Scale 100, as After Effects 2026), CPU and GPU |
+| 2026-10-19 | minor | Transform: After Effects' skew order and output beyond the layer bounds, measured against After Effects 2026 renders of three cases (CPU and GPU) |
+| 2026-10-19 | minor | Timewarp ignores the effects above it (source and masks only), measured against After Effects 2026 |
+| 2026-10-19 | minor | Tritone uses Rec. 601 luminance, measured against After Effects 2026 renders of a red solid and a grey ramp (CPU and GPU) |
+| 2026-10-19 | minor | Black & White's Tint keeps the gray's luminosity (Color blend), measured against After Effects 2026 renders (CPU and GPU) |
+| 2026-10-19 | minor | Levels: "Off for 32 bpc Color" no longer clips in 32 bpc projects, unclipped values extrapolate below Output Black; Levels (Individual Controls) applies the channel controls before the RGB ones, measured against After Effects 2026 (CPU and GPU) |
+| 2026-10-19 | minor | Brightness & Contrast: negative Brightness / Contrast are the inverse curves of the positive ones (Brightness −40: 20/255 → 6/255 off After Effects 2026; still up to 6.2/255 off, not the same pixels), CPU and GPU |
+| 2026-10-19 | minor | Luma Key: Key Out Brighter / Darker cut hard at Threshold, measured against After Effects 2026 renders of a ramp (CPU and GPU) |
+| 2026-10-19 | minor | Luma Key and Extract: Rec. 601 luminance (was Rec. 709), measured against After Effects 2026 (CPU and GPU) |
+| 2026-10-19 | minor | 4-Color Gradient: each point weighs 1 / (d² + Blend²), measured against After Effects 2026 at Blend 10 / 50 / 100 / 300 (CPU and GPU) |
+| 2026-10-19 | minor | Fill without a mask: the layer becomes the fill colour at its alpha × Opacity (was a mix with the original), measured against After Effects 2026 (CPU and GPU) |
+| 2026-10-19 | minor | Curves: natural cubic spline through the points, clamped to 0..1 (was a monotone spline), measured against After Effects 2026 (CPU and GPU); Lumetri's curves and Glow's Arbitrary Map keep the monotone spline |
+| 2026-10-18 | minor | Tint uses Rec. 601 luminance weights, measured against After Effects 2026 renders of red, green, blue and grey solids (CPU and GPU) |
+| 2026-10-18 | minor | Exposure converts to linear light with a pure 2.2 power curve, as measured in After Effects (Offset 0.0005 / 0.002 / 0.02 / 0.1 on black: 8 / 15 / 43 / 90), not the piecewise sRGB curve; its sliders take After Effects' ranges (Exposure −100..100, slider −4..4; Offset −2..2, slider −0.5..0.5; Gamma Correction 0.1..10) |
 | 2026-10-12 | minor | Parameters 3,014 to 3,017 (effects.md); #303, #514, #526, #533–#536 marked closed instead of pending |
 | 2026-10-12 | minor | Effect colour labels (26.5) added in Effect Controls |
 | 2026-10-12 | minor | Tint's Swap Colors button and agent-drivable command (#963); undo/redo, instance targeting, animated layer-time edits and invalid-input tests |
diff --git a/docs/effects.md b/docs/effects.md
index b8214e438..723edd0d0 100644
--- a/docs/effects.md
+++ b/docs/effects.md
@@ -3,11 +3,11 @@
 <!-- Generated from the effect registry (crates/effects/src/catalog.rs); do not edit by hand.
      Regenerate: UPDATE_DOCS=1 cargo test -p effectcraft-effects --lib effects_doc_is_current -->
 
-EffectCraft ships 307 effects with 3032 parameters in total, grouped into the same categories as the Effects & Presets panel. Every effect is our own implementation, written from public behaviour descriptions and standard image-processing literature. Parameter names, order, popup options, units, defaults and ranges follow the reference application so that projects, expressions and muscle memory carry over.
+EffectCraft ships 308 effects with 2988 parameters in total, grouped into the same categories as the Effects & Presets panel. Every effect is our own implementation, written from public behaviour descriptions and standard image-processing literature. Parameter names, order, popup options, units, defaults and ranges follow the reference application so that projects, expressions and muscle memory carry over.
 
 - **GPU**: 280 effects also run on the GPU compositor with identical results.
-- **32**: 307 effects process 32-bit float (HDR, overbright) pixels without clamping.
-- **Status**: 307 implemented in full, 0 partial (what is missing is listed).
+- **32**: 308 effects process 32-bit float (HDR, overbright) pixels without clamping.
+- **Status**: 308 implemented in full, 0 partial (what is missing is listed).
 
 Effects are addressed by id (`ec.<category>.<name>`) or display name in commands, scripts and the control channel, and every parameter by its id (`effects/#1/blurriness`).
 
@@ -16,7 +16,8 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
 | 3D Channel Extract | `ec.3d.channelextract` | 6 | GPU | 32 | Implemented |
-| Cryptomatte | `ec.3d.cryptomatte` | 4 | GPU | 32 | Implemented |
+| 3D Layer Instance | `ec.3d.instance3d` | 1 |  | 32 | Implemented |
+| Cryptomatte | `ec.3d.cryptomatte` | 5 | GPU | 32 | Implemented |
 | Depth Matte | `ec.3d.depthmatte` | 3 | GPU | 32 | Implemented |
 | Depth of Field | `ec.3d.depthoffield` | 4 | GPU | 32 | Implemented |
 | EXtractoR | `ec.3d.extractor` | 8 | GPU | 32 | Implemented |
@@ -47,21 +48,21 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
 | Bilateral Blur | `ec.blur.bilateral` | 3 | GPU | 32 | Implemented |
-| CC Cross Blur | `ec.blur.cccross` | 3 | GPU | 32 | Implemented |
-| CC Radial Blur | `ec.blur.ccradial` | 4 | GPU | 32 | Implemented |
-| CC Radial Fast Blur | `ec.blur.ccradialfast` | 3 | GPU | 32 | Implemented |
-| CC Vector Blur | `ec.blur.ccvector` | 4 | GPU | 32 | Implemented |
 | Camera Lens Blur | `ec.blur.cameralens` | 16 | GPU | 32 | Implemented |
 | Camera-Shake Deblur | `ec.blur.camerashakedeblur` | 8 |  | 32 | Implemented |
 | Channel Blur | `ec.blur.channel` | 6 | GPU | 32 | Implemented |
 | Compound Blur | `ec.blur.compound` | 4 | GPU | 32 | Implemented |
+| Cross Blur | `ec.blur.cccross` | 3 | GPU | 32 | Implemented |
 | Directional Blur | `ec.blur.directional` | 2 | GPU | 32 | Implemented |
 | Fast Box Blur | `ec.blur.fastbox` | 4 | GPU | 32 | Implemented |
+| Fast Radial Blur | `ec.blur.ccradialfast` | 3 | GPU | 32 | Implemented |
 | Gaussian Blur | `ec.blur.gaussian` | 3 | GPU | 32 | Implemented |
 | Radial Blur | `ec.blur.radial` | 4 | GPU | 32 | Implemented |
 | Sharpen | `ec.blur.sharpen` | 1 | GPU | 32 | Implemented |
 | Smart Blur | `ec.blur.smart` | 3 | GPU | 32 | Implemented |
 | Unsharp Mask | `ec.blur.unsharp` | 3 | GPU | 32 | Implemented |
+| Variable Radial Blur | `ec.blur.ccradial` | 4 | GPU | 32 | Implemented |
+| Vector Blur | `ec.blur.ccvector` | 4 | GPU | 32 | Implemented |
 
 ## Channel
 
@@ -69,7 +70,6 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 |---|---|---:|:-:|:-:|---|
 | Arithmetic | `ec.channel.arithmetic` | 5 | GPU | 32 | Implemented |
 | Blend | `ec.channel.blend` | 4 | GPU | 32 | Implemented |
-| CC Composite | `ec.channel.cccomposite` | 3 | GPU | 32 | Implemented |
 | Calculations | `ec.channel.calculations` | 9 | GPU | 32 | Implemented |
 | Channel Combiner | `ec.channel.combiner` | 6 | GPU | 32 | Implemented |
 | Compound Arithmetic | `ec.channel.compoundarithmetic` | 6 | GPU | 32 | Implemented |
@@ -80,6 +80,7 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Set Matte | `ec.channel.setmatte` | 6 | GPU | 32 | Implemented |
 | Shift Channels | `ec.channel.shiftchannels` | 4 | GPU | 32 | Implemented |
 | Solid Composite | `ec.channel.solidcomposite` | 4 | GPU | 32 | Implemented |
+| Source Composite | `ec.channel.cccomposite` | 3 | GPU | 32 | Implemented |
 
 ## Color Correction
 
@@ -91,18 +92,18 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Black & White | `ec.color.blackwhite` | 8 | GPU | 32 | Implemented |
 | Brightness & Contrast | `ec.color.brightnesscontrast` | 3 | GPU | 32 | Implemented |
 | Broadcast Colors | `ec.color.broadcast` | 3 | GPU | 32 | Implemented |
-| CC Color Neutralizer | `ec.color.cccolorneutralizer` | 11 | GPU | 32 | Implemented |
-| CC Color Offset | `ec.color.cccoloroffset` | 4 | GPU | 32 | Implemented |
-| CC Kernel | `ec.color.cckernel` | 12 | GPU | 32 | Implemented |
-| CC Toner | `ec.color.cctoner` | 7 | GPU | 32 | Implemented |
 | Change Color | `ec.color.changecolor` | 9 | GPU | 32 | Implemented |
 | Change to Color | `ec.color.changetocolor` | 9 | GPU | 32 | Implemented |
 | Channel Mixer | `ec.color.channelmixer` | 13 | GPU | 32 | Implemented |
+| Channel Offset | `ec.color.cccoloroffset` | 4 | GPU | 32 | Implemented |
 | Color Balance | `ec.color.colorbalance` | 10 | GPU | 32 | Implemented |
 | Color Balance (HLS) | `ec.color.colorbalancehls` | 3 | GPU | 32 | Implemented |
+| Color Grading | `ec.color.lumetri` | 66 | GPU | 32 | Implemented |
 | Color Link | `ec.color.colorlink` | 6 | GPU | 32 | Implemented |
+| Color Neutralizer | `ec.color.cccolorneutralizer` | 11 | GPU | 32 | Implemented |
 | Color Stabilizer | `ec.color.colorstabilizer` | 6 | GPU | 32 | Implemented |
 | Colorama | `ec.color.colorama` | 20 | GPU | 32 | Implemented |
+| Convolution Kernel | `ec.color.cckernel` | 12 | GPU | 32 | Implemented |
 | Curves | `ec.color.curves` | 0 | GPU | 32 | Implemented |
 | Equalize | `ec.color.equalize` | 2 | GPU | 32 | Implemented |
 | Exposure | `ec.color.exposure` | 14 | GPU | 32 | Implemented |
@@ -111,7 +112,7 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Leave Color | `ec.color.leavecolor` | 5 | GPU | 32 | Implemented |
 | Levels | `ec.color.levels` | 36 | GPU | 32 | Implemented |
 | Levels (Individual Controls) | `ec.color.levelsic` | 27 | GPU | 32 | Implemented |
-| Lumetri Color | `ec.color.lumetri` | 66 | GPU | 32 | Implemented |
+| Multi-Tone Tint | `ec.color.cctoner` | 7 | GPU | 32 | Implemented |
 | OCIO CDL Transform | `ec.color.ociocdl` | 12 | GPU | 32 | Implemented |
 | OCIO Color Space Transform | `ec.color.ociocolorspace` | 7 | GPU | 32 | Implemented |
 | OCIO Display Transform | `ec.color.ociodisplay` | 9 | GPU | 32 | Implemented |
@@ -132,40 +133,40 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 |---|---|---:|:-:|:-:|---|
 | Bezier Warp | `ec.distort.bezierwarp` | 13 | GPU | 32 | Implemented |
 | Bulge | `ec.distort.bulge` | 6 | GPU | 32 | Implemented |
-| CC Bend It | `ec.distort.ccbendit` | 4 | GPU | 32 | Implemented |
-| CC Bender | `ec.distort.ccbender` | 5 | GPU | 32 | Implemented |
-| CC Blobbylize | `ec.distort.ccblobbylize` | 15 | GPU | 32 | Implemented |
-| CC Flo Motion | `ec.distort.ccflomotion` | 7 | GPU | 32 | Implemented |
-| CC Griddler | `ec.distort.ccgriddler` | 5 | GPU | 32 | Implemented |
-| CC Lens | `ec.distort.cclens` | 3 | GPU | 32 | Implemented |
-| CC Page Turn | `ec.distort.ccpageturn` | 7 | GPU | 32 | Implemented |
-| CC Power Pin | `ec.distort.ccpowerpin` | 10 | GPU | 32 | Implemented |
-| CC Ripple Pulse | `ec.distort.ccripplepulse` | 5 | GPU | 32 | Implemented |
-| CC Slant | `ec.distort.ccslant` | 4 | GPU | 32 | Implemented |
-| CC Smear | `ec.distort.ccsmear` | 4 | GPU | 32 | Implemented |
-| CC Split | `ec.distort.ccsplit` | 3 | GPU | 32 | Implemented |
-| CC Split 2 | `ec.distort.ccsplit2` | 4 | GPU | 32 | Implemented |
-| CC Tiler | `ec.distort.cctiler` | 3 | GPU | 32 | Implemented |
 | Corner Pin | `ec.distort.cornerpin` | 4 | GPU | 32 | Implemented |
 | Detail-preserving Upscale | `ec.distort.upscale` | 4 |  | 32 | Implemented |
+| Directional Smear | `ec.distort.ccsmear` | 4 | GPU | 32 | Implemented |
 | Displacement Map | `ec.distort.displacementmap` | 8 | GPU | 32 | Implemented |
+| Dual Lens Warp | `ec.distort.ccflomotion` | 7 | GPU | 32 | Implemented |
+| Dual Split Warp | `ec.distort.ccsplit2` | 4 | GPU | 32 | Implemented |
+| Flexible Bend | `ec.distort.ccbender` | 5 | GPU | 32 | Implemented |
+| Lens Distortion | `ec.distort.cclens` | 3 | GPU | 32 | Implemented |
 | Liquify | `ec.distort.liquify` | 13 | GPU | 32 | Implemented |
 | Magnify | `ec.distort.magnify` | 10 | GPU | 32 | Implemented |
 | Mesh Warp | `ec.distort.meshwarp` | 3 | GPU | 32 | Implemented |
 | Mirror | `ec.distort.mirror` | 2 | GPU | 32 | Implemented |
 | Offset | `ec.distort.offset` | 2 | GPU | 32 | Implemented |
 | Optics Compensation | `ec.distort.opticscompensation` | 6 | GPU | 32 | Implemented |
+| Organic Displacement | `ec.distort.ccblobbylize` | 15 | GPU | 32 | Implemented |
+| Page Curl | `ec.distort.ccpageturn` | 7 | GPU | 32 | Implemented |
+| Perspective Pin | `ec.distort.ccpowerpin` | 10 | GPU | 32 | Implemented |
 | Polar Coordinates | `ec.distort.polar` | 2 | GPU | 32 | Implemented |
+| Pulsed Ripple | `ec.distort.ccripplepulse` | 5 | GPU | 32 | Implemented |
 | Puppet | `ec.distort.puppet` | 1 |  | 32 | Implemented |
 | Reshape | `ec.distort.reshape` | 6 | GPU | 32 | Implemented |
 | Ripple | `ec.distort.ripple` | 7 | GPU | 32 | Implemented |
 | Rolling Shutter Repair | `ec.distort.rollingshutterrepair` | 5 |  | 32 | Implemented |
+| Scaled Tiles | `ec.distort.cctiler` | 3 | GPU | 32 | Implemented |
+| Slant | `ec.distort.ccslant` | 4 | GPU | 32 | Implemented |
 | Smear | `ec.distort.smear` | 8 | GPU | 32 | Implemented |
 | Spherize | `ec.distort.spherize` | 2 | GPU | 32 | Implemented |
+| Split Warp | `ec.distort.ccsplit` | 3 | GPU | 32 | Implemented |
+| Tile Grid | `ec.distort.ccgriddler` | 5 | GPU | 32 | Implemented |
 | Transform | `ec.distort.transform` | 12 | GPU | 32 | Implemented |
 | Turbulent Displace | `ec.distort.turbulentdisplace` | 11 | GPU | 32 | Implemented |
 | Twirl | `ec.distort.twirl` | 3 | GPU | 32 | Implemented |
 | Twirl (Legacy) | `ec.distort.twirllegacy` | 3 | GPU | 32 | Implemented |
+| Two-Point Bend | `ec.distort.ccbendit` | 4 | GPU | 32 | Implemented |
 | Warp | `ec.distort.warp` | 5 | GPU | 32 | Implemented |
 | Warp Stabilizer | `ec.distort.warpstabilizer` | 20 |  | 32 | Implemented |
 | Wave Warp | `ec.distort.wavewarp` | 7 | GPU | 32 | Implemented |
@@ -193,11 +194,6 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Audio Spectrum | `ec.generate.audiospectrum` | 23 | GPU | 32 | Implemented |
 | Audio Waveform | `ec.generate.audiowaveform` | 17 | GPU | 32 | Implemented |
 | Beam | `ec.generate.beam` | 11 | GPU | 32 | Implemented |
-| CC Glue Gun | `ec.generate.ccgluegun` | 7 | GPU | 32 | Implemented |
-| CC Light Burst 2.5 | `ec.generate.cclightburst` | 6 | GPU | 32 | Implemented |
-| CC Light Rays | `ec.generate.cclightrays` | 8 | GPU | 32 | Implemented |
-| CC Light Sweep | `ec.generate.cclightsweep` | 9 | GPU | 32 | Implemented |
-| CC Threads | `ec.generate.ccthreads` | 8 | GPU | 32 | Implemented |
 | Cell Pattern | `ec.generate.cellpattern` | 14 | GPU | 32 | Implemented |
 | Checkerboard | `ec.generate.checkerboard` | 10 | GPU | 32 | Implemented |
 | Circle | `ec.generate.circle` | 11 | GPU | 32 | Implemented |
@@ -208,11 +204,16 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Gradient Ramp | `ec.generate.gradientramp` | 7 | GPU | 32 | Implemented |
 | Grid | `ec.generate.grid` | 12 | GPU | 32 | Implemented |
 | Lens Flare | `ec.generate.lensflare` | 4 | GPU | 32 | Implemented |
+| Light Rays | `ec.generate.cclightrays` | 8 | GPU | 32 | Implemented |
+| Light Sweep | `ec.generate.cclightsweep` | 9 | GPU | 32 | Implemented |
+| Paint Beads | `ec.generate.ccgluegun` | 7 | GPU | 32 | Implemented |
 | Paint Bucket | `ec.generate.paintbucket` | 11 | GPU | 32 | Implemented |
+| Radial Light Burst | `ec.generate.cclightburst` | 6 | GPU | 32 | Implemented |
 | Radio Waves | `ec.generate.radiowaves` | 31 | GPU | 32 | Implemented |
 | Scribble | `ec.generate.scribble` | 25 | GPU | 32 | Implemented |
 | Stroke | `ec.generate.stroke` | 11 | GPU | 32 | Implemented |
 | Vegas | `ec.generate.vegas` | 26 | GPU | 32 | Implemented |
+| Woven Threads | `ec.generate.ccthreads` | 8 | GPU | 32 | Implemented |
 | Write-on | `ec.generate.writeon` | 10 | GPU | 32 | Implemented |
 
 ## Immersive Video
@@ -237,15 +238,15 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
 | Advanced Spill Suppressor | `ec.key.advancedspill` | 8 | GPU | 32 | Implemented |
-| CC Simple Wire Removal | `ec.key.ccsimplewireremoval` | 7 | GPU | 32 | Implemented |
 | Color Difference Key | `ec.key.colordifference` | 16 | GPU | 32 | Implemented |
 | Color Range | `ec.key.colorrange` | 8 | GPU | 32 | Implemented |
 | Difference Matte | `ec.key.differencematte` | 6 | GPU | 32 | Implemented |
 | Extract | `ec.key.extract` | 6 | GPU | 32 | Implemented |
 | Inner/Outer Key | `ec.key.innerouter` | 88 | GPU | 32 | Implemented |
 | Key Cleaner | `ec.key.keycleaner` | 4 | GPU | 32 | Implemented |
-| Key Light | `ec.keying.keylight` | 56 | GPU | 32 | Implemented |
+| Line Removal | `ec.key.ccsimplewireremoval` | 7 | GPU | 32 | Implemented |
 | Linear Color Key | `ec.key.linearcolor` | 6 | GPU | 32 | Implemented |
+| Screen Color Key | `ec.keying.keylight` | 56 | GPU | 32 | Implemented |
 | Screen Key | `ec.key.screen` | 11 | GPU | 32 | Implemented |
 | Unmult | `ec.key.unmult` | 6 | GPU | 32 | Implemented |
 
@@ -254,12 +255,12 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
 | Matte Choker | `ec.matte.mattechoker` | 7 | GPU | 32 | Implemented |
-| Mocha shape | `ec.obsolete.mochashape` | 6 |  | 32 | Implemented |
 | Object Matte | `ec.matte.objectmatte` | 13 |  | 32 | Implemented |
 | Refine Hard Matte | `ec.matte.refinehard` | 16 | GPU | 32 | Implemented |
 | Refine Soft Matte | `ec.matte.refinesoft` | 18 | GPU | 32 | Implemented |
-| Roto Brush & Refine Edge | `ec.matte.rotobrush` | 24 |  | 32 | Implemented |
+| Roto Brush & Refine Edge | `ec.matte.rotobrush` | 25 |  | 32 | Implemented |
 | Simple Choker | `ec.matte.simplechoker` | 2 | GPU | 32 | Implemented |
+| Tracked Shape Matte | `ec.obsolete.mochashape` | 6 |  | 32 | Implemented |
 
 ## Noise & Grain
 
@@ -307,65 +308,65 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | 3D Glasses | `ec.perspective.3dglasses` | 8 | GPU | 32 | Implemented |
 | Bevel Alpha | `ec.perspective.bevelalpha` | 4 | GPU | 32 | Implemented |
 | Bevel Edges | `ec.perspective.beveledges` | 4 | GPU | 32 | Implemented |
-| CC Cylinder | `ec.perspective.cccylinder` | 15 | GPU | 32 | Implemented |
-| CC Environment | `ec.perspective.ccenvironment` | 4 | GPU | 32 | Implemented |
-| CC Sphere | `ec.perspective.ccsphere` | 14 | GPU | 32 | Implemented |
-| CC Spotlight | `ec.perspective.ccspotlight` | 8 | GPU | 32 | Implemented |
+| Cylinder Wrap | `ec.perspective.cccylinder` | 15 | GPU | 32 | Implemented |
 | Drop Shadow | `ec.perspective.dropshadow` | 6 | GPU | 32 | Implemented |
+| Environment Map | `ec.perspective.ccenvironment` | 4 | GPU | 32 | Implemented |
 | Radial Shadow | `ec.perspective.radialshadow` | 9 | GPU | 32 | Implemented |
+| Sphere Wrap | `ec.perspective.ccsphere` | 14 | GPU | 32 | Implemented |
+| Surface Spotlight | `ec.perspective.ccspotlight` | 8 | GPU | 32 | Implemented |
 
 ## Simulation
 
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
-| CC Ball Action | `ec.sim.ccballaction` | 8 | GPU | 32 | Implemented |
-| CC Bubbles | `ec.sim.ccbubbles` | 7 | GPU | 32 | Implemented |
-| CC Drizzle | `ec.sim.ccdrizzle` | 14 | GPU | 32 | Implemented |
-| CC Hair | `ec.sim.cchair` | 20 | GPU | 32 | Implemented |
-| CC Mr. Mercury | `ec.sim.ccmrmercury` | 23 | GPU | 32 | Implemented |
-| CC Particle Systems II | `ec.sim.ccparticlesystems2` | 21 | GPU | 32 | Implemented |
-| CC Particle World | `ec.sim.ccparticleworld` | 35 | GPU | 32 | Implemented |
-| CC Pixel Polly | `ec.sim.ccpixelpolly` | 10 | GPU | 32 | Implemented |
-| CC Rainfall | `ec.sim.ccrainfall` | 14 | GPU | 32 | Implemented |
-| CC Scatterize | `ec.sim.ccscatterize` | 4 | GPU | 32 | Implemented |
-| CC Snowfall | `ec.sim.ccsnowfall` | 19 | GPU | 32 | Implemented |
-| CC Star Burst | `ec.sim.ccstarburst` | 6 | GPU | 32 | Implemented |
+| Ball Grid | `ec.sim.ccballaction` | 8 | GPU | 32 | Implemented |
+| Bubbles | `ec.sim.ccbubbles` | 7 | GPU | 32 | Implemented |
 | Card Dance | `ec.sim.carddance` | 53 | GPU | 32 | Implemented |
 | Caustics | `ec.sim.caustics` | 28 | GPU | 32 | Implemented |
 | Foam | `ec.sim.foam` | 36 | GPU | 32 | Implemented |
+| Liquid Particles | `ec.sim.ccmrmercury` | 23 | GPU | 32 | Implemented |
+| Particle Emitter 2D | `ec.sim.ccparticlesystems2` | 21 | GPU | 32 | Implemented |
+| Particle Emitter 3D | `ec.sim.ccparticleworld` | 36 | GPU | 32 | Implemented |
 | Particle Playground | `ec.sim.particleplayground` | 92 | GPU | 32 | Implemented |
+| Pixel Scatter | `ec.sim.ccscatterize` | 4 | GPU | 32 | Implemented |
+| Pixel Shatter | `ec.sim.ccpixelpolly` | 10 | GPU | 32 | Implemented |
+| Rainfall | `ec.sim.ccrainfall` | 14 | GPU | 32 | Implemented |
 | Shatter | `ec.sim.shatter` | 60 | GPU | 32 | Implemented |
+| Snowfall | `ec.sim.ccsnowfall` | 19 | GPU | 32 | Implemented |
+| Starfield | `ec.sim.ccstarburst` | 6 | GPU | 32 | Implemented |
+| Surface Fibers | `ec.sim.cchair` | 20 | GPU | 32 | Implemented |
+| Water Ripples | `ec.sim.ccdrizzle` | 14 | GPU | 32 | Implemented |
 | Wave World | `ec.sim.waveworld` | 35 | GPU | 32 | Implemented |
 
 ## Stylize
 
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
+| Block Reveal | `ec.stylize.ccblockload` | 5 | GPU | 32 | Implemented |
 | Brush Strokes | `ec.stylize.brushstrokes` | 7 | GPU | 32 | Implemented |
-| CC Block Load | `ec.stylize.ccblockload` | 5 | GPU | 32 | Implemented |
-| CC Burn Film | `ec.stylize.ccburnfilm` | 3 | GPU | 32 | Implemented |
-| CC Glass | `ec.stylize.ccglass` | 17 | GPU | 32 | Implemented |
-| CC HexTile | `ec.stylize.cchextile` | 5 | GPU | 32 | Implemented |
-| CC Kaleida | `ec.stylize.cckaleida` | 4 | GPU | 32 | Implemented |
-| CC Mr. Smoothie | `ec.stylize.ccmrsmoothie` | 7 | GPU | 32 | Implemented |
-| CC Plastic | `ec.stylize.ccplastic` | 18 | GPU | 32 | Implemented |
-| CC RepeTile | `ec.stylize.ccrepetile` | 5 | GPU | 32 | Implemented |
-| CC Threshold | `ec.stylize.ccthreshold` | 4 | GPU | 32 | Implemented |
-| CC Threshold RGB | `ec.stylize.ccthresholdrgb` | 7 | GPU | 32 | Implemented |
-| CC Vignette | `ec.stylize.ccvignette` | 4 | GPU | 32 | Implemented |
 | Cartoon | `ec.stylize.cartoon` | 12 | GPU | 32 | Implemented |
+| Channel Threshold | `ec.stylize.ccthreshold` | 4 | GPU | 32 | Implemented |
 | Color Emboss | `ec.stylize.coloremboss` | 4 | GPU | 32 | Implemented |
+| Edge Tile Repeat | `ec.stylize.ccrepetile` | 5 | GPU | 32 | Implemented |
 | Emboss | `ec.stylize.emboss` | 4 | GPU | 32 | Implemented |
+| Film Burn | `ec.stylize.ccburnfilm` | 3 | GPU | 32 | Implemented |
 | Find Edges | `ec.stylize.findedges` | 2 | GPU | 32 | Implemented |
+| Glass Relief | `ec.stylize.ccglass` | 17 | GPU | 32 | Implemented |
 | Glow | `ec.stylize.glow` | 14 | GPU | 32 | Implemented |
+| Hexagonal Tiles | `ec.stylize.cchextile` | 5 | GPU | 32 | Implemented |
+| Kaleidoscope | `ec.stylize.cckaleida` | 4 | GPU | 32 | Implemented |
 | Mosaic | `ec.stylize.mosaic` | 3 | GPU | 32 | Implemented |
 | Motion Tile | `ec.stylize.motiontile` | 8 | GPU | 32 | Implemented |
+| Palette Map | `ec.stylize.ccmrsmoothie` | 7 | GPU | 32 | Implemented |
+| Plastic Shading | `ec.stylize.ccplastic` | 18 | GPU | 32 | Implemented |
 | Posterize | `ec.stylize.posterize` | 1 | GPU | 32 | Implemented |
+| RGB Threshold | `ec.stylize.ccthresholdrgb` | 7 | GPU | 32 | Implemented |
 | Roughen Edges | `ec.stylize.roughenedges` | 13 | GPU | 32 | Implemented |
 | Scatter | `ec.stylize.scatter` | 3 | GPU | 32 | Implemented |
 | Strobe Light | `ec.stylize.strobe` | 7 | GPU | 32 | Implemented |
 | Texturize | `ec.stylize.texturize` | 4 | GPU | 32 | Implemented |
 | Threshold | `ec.stylize.threshold` | 1 | GPU | 32 | Implemented |
+| Vignette | `ec.stylize.ccvignette` | 4 | GPU | 32 | Implemented |
 
 ## Text
 
@@ -378,11 +379,11 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
-| CC Force Motion Blur | `ec.time.ccforcemotionblur` | 4 | GPU | 32 | Implemented |
-| CC Wide Time | `ec.time.ccwidetime` | 3 | GPU | 32 | Implemented |
 | Echo | `ec.time.echo` | 5 | GPU | 32 | Implemented |
 | Pixel Motion Blur | `ec.time.pixelmotionblur` | 4 | GPU | 32 | Implemented |
 | Posterize Time | `ec.time.posterizetime` | 1 | GPU | 32 | Implemented |
+| Temporal Blend | `ec.time.ccwidetime` | 3 | GPU | 32 | Implemented |
+| Temporal Motion Blur | `ec.time.ccforcemotionblur` | 4 | GPU | 32 | Implemented |
 | Time Difference | `ec.time.timedifference` | 5 | GPU | 32 | Implemented |
 | Time Displacement | `ec.time.timedisplacement` | 4 | GPU | 32 | Implemented |
 | Timewarp | `ec.time.timewarp` | 28 | GPU | 32 | Implemented |
@@ -392,29 +393,28 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
 | Block Dissolve | `ec.transition.blockdissolve` | 5 | GPU | 32 | Implemented |
-| CC Glass Wipe | `ec.transition.ccglasswipe` | 5 | GPU | 32 | Implemented |
-| CC Grid Wipe | `ec.transition.ccgridwipe` | 7 | GPU | 32 | Implemented |
-| CC Image Wipe | `ec.transition.ccimagewipe` | 7 | GPU | 32 | Implemented |
-| CC Jaws | `ec.transition.ccjaws` | 6 | GPU | 32 | Implemented |
-| CC Light Wipe | `ec.transition.cclightwipe` | 8 | GPU | 32 | Implemented |
-| CC Line Sweep | `ec.transition.cclinesweep` | 5 | GPU | 32 | Implemented |
-| CC Radial ScaleWipe | `ec.transition.ccradialscalewipe` | 3 | GPU | 32 | Implemented |
-| CC Scale Wipe | `ec.transition.ccscalewipe` | 3 | GPU | 32 | Implemented |
-| CC Twister | `ec.transition.cctwister` | 5 | GPU | 32 | Implemented |
-| CC WarpoMatic | `ec.transition.ccwarpomatic` | 8 | GPU | 32 | Implemented |
 | Card Wipe | `ec.transition.cardwipe` | 44 | GPU | 32 | Implemented |
+| Glass Wipe | `ec.transition.ccglasswipe` | 5 | GPU | 32 | Implemented |
 | Gradient Wipe | `ec.transition.gradientwipe` | 5 | GPU | 32 | Implemented |
+| Grid Wipe | `ec.transition.ccgridwipe` | 7 | GPU | 32 | Implemented |
 | Iris Wipe | `ec.transition.iriswipe` | 7 | GPU | 32 | Implemented |
+| Light Wipe | `ec.transition.cclightwipe` | 8 | GPU | 32 | Implemented |
+| Line Sweep | `ec.transition.cclinesweep` | 5 | GPU | 32 | Implemented |
 | Linear Wipe | `ec.transition.linearwipe` | 3 | GPU | 32 | Implemented |
+| Luminance Image Wipe | `ec.transition.ccimagewipe` | 7 | GPU | 32 | Implemented |
+| Radial Scale Wipe | `ec.transition.ccradialscalewipe` | 3 | GPU | 32 | Implemented |
 | Radial Wipe | `ec.transition.radialwipe` | 5 | GPU | 32 | Implemented |
+| Scale Wipe | `ec.transition.ccscalewipe` | 3 | GPU | 32 | Implemented |
+| Serrated Wipe | `ec.transition.ccjaws` | 6 | GPU | 32 | Implemented |
+| Twist Wipe | `ec.transition.cctwister` | 5 | GPU | 32 | Implemented |
 | Venetian Blinds | `ec.transition.venetian` | 4 | GPU | 32 | Implemented |
+| Warp Dissolve | `ec.transition.ccwarpomatic` | 8 | GPU | 32 | Implemented |
 
 ## Utility
 
 | Effect | Id | Params | GPU | 32 | Status |
 |---|---|---:|:-:|:-:|---|
 | Apply Color LUT | `ec.utility.applylut` | 1 | GPU | 32 | Implemented |
-| CC Overbrights | `ec.utility.ccoverbrights` | 2 | GPU | 32 | Implemented |
 | Cineon Converter | `ec.utility.cineon` | 7 | GPU | 32 | Implemented |
 | Color Profile Converter | `ec.utility.colorprofileconverter` | 7 | GPU | 32 | Implemented |
 | Face Measurements | `ec.utility.facemeasurements` | 14 |  | 32 | Implemented |
@@ -422,4 +422,5 @@ Effects are addressed by id (`ec.<category>.<name>`) or display name in commands
 | Grow Bounds | `ec.utility.growbounds` | 1 | GPU | 32 | Implemented |
 | HDR Compander | `ec.utility.hdrcompander` | 3 | GPU | 32 | Implemented |
 | HDR Highlight Compression | `ec.utility.hdrcompression` | 1 | GPU | 32 | Implemented |
+| Out-of-Range Display | `ec.utility.ccoverbrights` | 2 | GPU | 32 | Implemented |
 
diff --git a/docs/egui-037-migration-plan.md b/docs/egui-037-migration-plan.md
new file mode 100644
index 000000000..692cec33c
--- /dev/null
+++ b/docs/egui-037-migration-plan.md
@@ -0,0 +1,1607 @@
+# EffectCraft — egui 0.37 migration plan
+
+Current landing status, 2026-10-25: the working tree includes main `991904888a20b7da72b2a4880b21c7d912154736` and pins egui `6d518fc799681571963842f95b55a6b68431b15a`, winit `a517b3846ee8457d84ee4975110bfda6797c44dc` and shared UI `25da1314d443171b4adeaad2cd9454b273f35c6f`. The final IME adapter uses ordered native reset request identifiers and `ImeResetCompleted`; the earlier tombstone-only description below is historical.
+
+Full current-source CI `egui037-effectcraft-current-main-ci-20261025-0231` recorded 3,961 passing tests, 14 failures and 31 ignored across 88 test summaries. All 14 failures are GPU tests: their names and diagnostic blocks match the frozen pre-migration `eb51087` baseline exactly after removing thread process numbers. Formatting, strict lint, layering, assets and the 32-crate WASM check completed. The 596-test UI regression suite passes. This is not a green full-CI result or hardware-GPU qualification. Native IME, visible final-source workflows and paired performance remain open.
+
+The repository's green-only commit gate remains unmet by the GPU results; the reviewed worktree and complete evidence are retained for human review. No push, publication or merge is authorized by this status.
+
+Historical implementation and research record follows. Its older pins, test counts and unacknowledged-reset description do not describe the current candidate.
+
+Status: implementation in progress, 2026-10-24. The dependency/API port, IME context adapter,
+screenshots, accessibility, font coverage and text-edit repairs are present in the dirty migration
+worktree. The parent-managed local run
+`egui037-effectcraft-candidate-20261024-upstream-tests-09` recorded **820 passed, 14 ignored**:
+`effectcraft-ui-egui --lib` 297 passed / 3 ignored, `--test it` 521 passed / 11 ignored and
+`--test ui_accessibility` 2 passed; `cargo clippy -p effectcraft-ui-egui --lib --tests -- -D warnings`
+exited 0. That run covers `effectcraft-ui-egui` only; the engine suite, full `cargo xtask ci`, wasm,
+native GUI and real-platform IME were not rerun for this revision. Evidence:
+`/home/codex/work/ssd2/task-evidence/egui037-effectcraft-candidate-20261023/task-jobs/egui037-effectcraft-candidate-20261024-upstream-tests-09/output.log`.
+The custom viewer text editor now has an explicit per-viewport IME composition lifecycle instead
+of a frame-number suppression window: an active composition is owned by the edit session's
+layer/session identity, and a target switch or editor end turns it into a tombstone. An empty
+pre-edit is the observed end of the visible composition, but its terminal commit/delete can arrive
+in a later event, so the owner stays associated with the cleared composition; if the target changes
+before that terminal event, the tombstone rejects it instead of applying it to the replacement. A
+lone non-empty old pre-edit keeps the tombstone across arbitrary idle frames. A rejected terminal
+commit consumes the tombstone immediately, so a new pre-edit later in the same raw input batch
+starts a composition for the current target. A rejected empty pre-edit or delete-surrounding keeps
+the tombstone through the rest of that batch so its paired old commit is rejected too, and is
+consumed at batch end when no commit follows. A composition started after that terminal boundary is
+accepted, so the tombstone never becomes a permanent lock. `egui::ImeEvent`
+payloads still carry no context generation, and the inspected `egui-winit` 0.37 source ignores
+`Ime::Enabled`/`Ime::Disabled` and implements `should_interrupt_composition` by toggling
+`set_ime_allowed` without an observable reset acknowledgement. The fallback therefore drops the
+first ambiguous composition after an unobserved platform reset rather than claiming provenance it
+cannot prove; a producer-side event epoch would be needed to close that residual, and this is not
+claimed as tested on a real platform IME here. Two real-app headless regressions in
+`crates/ui-egui/tests/it/ui_text_edit.rs` cover the observed-empty-preedit pending commit and a new
+pre-edit after a stale terminal commit in the same raw batch; this revision adds them but does not
+claim they were rerun here.
+The later bounded same-owner interruption repair (2026-10-24) tracks the expected caret and
+selection separately from that immutable layer/session owner. A live or terminal-pending
+composition is invalidated before application pointer/selection changes can accept an old IME
+mutation, including keys before a later IME event in the same raw batch and control-client
+selection changes before a pass. Accepted IME mutations update the expected selection so the
+IME deletion's own caret shift does not reject its paired commit. The existing terminal rules
+still permit a fresh preedit after a rejected terminal commit, and a direct commit with no active
+composition remains valid even after a pointer change in the same batch. Five new real-app
+regressions cover15 scenarios with both deletion forms, pointer and keyboard interruption,
+terminal-pending/external selection, undo preservation, fresh composition and direct commits.
+These new source bytes and tests await parent-managed formatting, focused/full gates and fresh
+independent review; no new test, native-IME or final dependency-graph acceptance is claimed here.
+
+Every future push or new pull request still needs a fresh, explicit human approval of the exact
+commit range and its validation; this document is not publication evidence.
+
+Scope: `storytold/effectcraft` only (this checkout). Shared work in `storytold/craft-libs`
+(PR 199 and the CL-2 capture helper), the suite egui fork and the suite winit fork are dependencies
+with their own plans; this document records what EffectCraft needs from them, not what they should
+do. Sibling apps, their plans and their dependency bumps are out of scope.
+
+This plan deliberately separates:
+
+- **facts** verified by reading the pinned source in this checkout, the egui checkout and the
+  upstream 0.36.2/0.37.0 tags;
+- **historical clues** (the 2026-10-22 audit compiler output), which are not current acceptance;
+- **proposals** (refactors and acceptance criteria) that the implementation PRs must prove.
+
+## 1. Baseline and provenance
+
+### 1.1 Exact source under plan
+
+| Item | Value |
+| --- | --- |
+| EffectCraft implementation checkout | `/home/codex/work/CraftApps/egui037-migration-20261022/effectcraft-implementation` |
+| Current EffectCraft worktree | HEAD `049070d65c66a73f322b496b22521816e0018f14`; dirty migration worktree. The lock and manifests still use the local integration patch, not final immutable pins. |
+| EffectCraft historical planning baseline | `9581b53c3f8945683252af0eb5fac79e0e43aed4` (`Release 0.16.0`, 2026-10-22), retained for baseline comparisons only |
+| Branch | `codex/egui-037-plan-20261022` |
+| Workspace | single root workspace `Cargo.toml` (`resolver = "3"`, members `crates/*`, `apps/*`, `xtask`) |
+| Lockfile | `Cargo.lock`, lock format 4 |
+| MSRV / edition | Rust 1.95, edition 2024 (`Cargo.toml:7-12`) |
+| Target upstream release | egui tag `0.37.0`, peeled commit `841a328ba2dd8f6996beb7189ebb7fc00e668a2a` (tagged 2026-10-15) |
+| Candidate suite egui (comparison input only) | `aiongg/craft/0.37` = `a4f9a17f64a6bae61350fb85804c9df0d9865916` (2026-10-21, E1–E21). Read-only source for this plan; **not a publication pin**. |
+| Candidate suite winit (comparison input only) | `aiongg/craft/0.30.13-lang` = `8b35388bd719e8cc86a95971ba0bc026c9a8f058` (winit 0.30.13 + W1–W15, W17–W27). Read-only source; **not a publication pin**. |
+| Production egui pin | **pending approved fork implementation**: the final reviewed and published `storytold/egui` P8 SHA containing E1–E21, P2b async W15P routing, P7 held-key pairing, P7b/E21b, P7c's selected `#8763`/`#8748` fixes and the justified `#8731`/`#8736` performance fixes if measurements require them. All egui-family crates must come from that one revision. |
+| Production winit pin | **pending approved fork implementation**: the completed, final reviewed `storytold/winit` SHA containing W1–W27, W15P and the W27 lifecycle fixes. |
+| Final dependency unit | one immutable set recorded together: the complete storytold egui P8 SHA + storytold winit SHA + craft-ui SHA with CL-1 and CL-2F, proved by a clean `--locked` fetch. This is the consumer's first and only compatibility landing: no stock-0.37 or intermediate fork production stage. |
+| Suite shared UI dependency | `craft-ui` from `storytold/craft-libs`, reconciled merged-PR base `3832c47ef68a0e6214f2c1e85f3526b6adcb686e` (current shared-library implementation base). Historical planning rev `5c874d51eeb3de70e735c8ce87a59a7dedd47675` is superseded; the final publication pin is the reviewed immutable SHA containing CL-1 and CL-2F. |
+| Shared PR history | `storytold/craft-libs#199` is merged at `3832c47ef68a0e6214f2c1e85f3526b6adcb686e`. Historical port hunks `8614e4a04fae516fba16c22b31ff1008cb6be10b` and README `1764bca`, applied to old `main` `49190884278f16c9a9f5823d7698a8ffb5deb062`, are superseded. Never merge `b68de8c`/`ec8840a` as trees. |
+| Separate language PR | `storytold/craft-libs#198` (fork E5/E9/E12–E21, winit W17–W27) |
+
+All pins must be full commit SHAs. Branch names are not publication pins. The `aiongg` SHAs above
+are source-inspection inputs for this review; the lock file in a publication branch must name only
+the final storytold revisions (plus the existing unrelated craft-libs PDF pin).
+
+### 1.2 Baseline dependency set (historical `9581b53c`; from `Cargo.lock` and manifests)
+
+The implementation worktree now resolves the egui family at `0.37.0` and `craft-ui` at
+`3832c47ef68a0e6214f2c1e85f3526b6adcb686e` through `local-integration-config.toml`; the current
+`Cargo.lock` entries therefore have no registry `source` for those patched crates. That local
+configuration is review evidence, not an immutable publication pin.
+
+| Crate | Version / source | Where pinned |
+| --- | --- | --- |
+| `egui` | `0.36.2` crates.io, checksum `dc938cc2…` | `Cargo.toml:108` |
+| `eframe` | `0.36.2` crates.io, checksum `55ad41fa…` | `Cargo.toml:109` (default features off) |
+| `egui_kittest` | `0.36.2` | `Cargo.toml:110`, dev-only |
+| `egui-wgpu` / `egui-winit` | `0.36.2` | transitive, one each |
+| `kittest` | `0.4.0` | transitive of `egui_kittest` |
+| `accesskit` / `accesskit_winit` | `0.24.1` / `0.32.2` | transitive |
+| `winit` | `0.30.13` crates.io, checksum `a6755fa5…` | `apps/effectcraft/Cargo.toml:23` (`"0.30"`, default features off) and transitive |
+| `wgpu` | `30.0.1` | `Cargo.toml:101` |
+| `craft-ui` | baseline `0.1.0` git `storytold/craft-libs` rev `5c874d51…`; implementation resolves local `craft-libs-implementation` at `3832c47…` | `Cargo.toml:107` plus `local-integration-config.toml` |
+| `craft-pdf` | git `storytold/craft-libs` rev `ca50d63b…` | `Cargo.toml:15` |
+| `craft-docpath` | git `storytold/craft-libs` rev `82a24b00…` | `Cargo.toml:16` |
+| `hayro-syntax` patch | git `storytold/craft-libs` rev `ca50d63b…`, `=0.7.2` | `Cargo.toml:213-214` |
+| `wasm-bindgen` | `0.2.129` (exact crate and CLI), `apps/effectcraft-web/Cargo.toml:34` and `xtask/src/main.rs:254` | web only |
+| filmcraft crates | git rev `2c5ba7a7…` | `Cargo.toml:76-95` |
+
+There is exactly one egui family in the baseline. The target must preserve that invariant (see §6).
+
+Manifest audit: 38 `Cargo.toml` files (root, 32 `crates/*`, 3 `apps/*`, `xtask`, and the standalone
+plugin). Only `crates/ui-egui`, `apps/effectcraft`, `apps/effectcraft-web` and (through
+`effectcraft-ui-egui`) `apps/effectcraft-cli` use the egui family. `examples/plugins/posterize-bands`
+has its own workspace/lock and no egui. There are no vendored crates and no `[patch]` on the egui
+family in the baseline; the only patch is `hayro-syntax`.
+
+### 1.3 Package, binary, feature and entry-point targets
+
+| Target | Kind | egui-family surface |
+| --- | --- | --- |
+| `effectcraft` (`apps/effectcraft`) | native binary | `eframe` with `default_fonts`, `wgpu`, `accesskit`, `links`, `wayland`, `x11` (`apps/effectcraft/Cargo.toml:18`); direct `winit`; native `Desktop` app (`apps/effectcraft/src/main.rs:426-456`) |
+| `effectcraft-web` (`apps/effectcraft-web`) | `cdylib` + `rlib`, wasm32 | `eframe` web runner (`app.rs:88-122`, `start()` at `app.rs:185`); `eframe` features `default_fonts`, `wgpu` |
+| `effectcraft-ui-egui` (`crates/ui-egui`) | library (swappable frontend) | the real UI, control channel, docking, viewer, timeline, kittest dev-dep `eframe` + `wgpu` (`crates/ui-egui/Cargo.toml:24-41`) |
+| `effectcraft-cli` | binary + MCP server | depends on `effectcraft-ui-egui` for `bench --ops` (`apps/effectcraft-cli/Cargo.toml:19`) |
+| `effectcraft-ui-egui --example snapshot` | example | headless kittest+wgpu screenshots (`crates/ui-egui/examples/snapshot.rs`) |
+| `xtask` | tool | `ci`, `wasm`, `web`, `assets`, `layers` (`xtask/src/main.rs:409-428`) |
+| `examples/plugins/posterize-bands` | separate nested workspace | no egui dependency; its own `Cargo.lock`; untouched |
+
+Platform cfgs that the migration must respect:
+
+- wasm32: `frames.rs` remote/local frame pump, `audio.rs` Web Audio, `theme.rs` no system fonts,
+  `prefs_live.rs` no native drops, viewer deferred readbacks (`lib.rs:825-855`), `sys-locale` only
+  off-wasm (`crates/ui-egui/Cargo.toml:36-37`), web storage/workers.
+- native: pointer wrap (`pointer_wrap.rs:133`), system font fallbacks (`theme.rs:388-430`),
+  `rfd`/`cpal`, native menu (macOS), `zbus` appearance (Linux), appimage (Linux).
+- `eframe`/`winit` platform features: Wayland and X11 on Linux, `muda`/`objc2` on macOS,
+  `winresource` on Windows.
+
+### 1.4 Current test and CI commands (source-declared)
+
+- `cargo xtask ci` = `cargo fmt --check`; `cargo clippy --workspace --all-targets --release -- -D warnings`;
+  `cargo test --workspace --release`; PDF dependency check; `layers`; `assets`; `wasm`
+  (`xtask/src/main.rs:409-418`).
+- `cargo xtask wasm` checks every L0–L4 crate plus `effectcraft-ui-egui` and `effectcraft-web`
+  for `wasm32-unknown-unknown` (`xtask/src/main.rs:235-252`).
+- UI tests: 81 files in `crates/ui-egui/tests`, driven by `egui_kittest::Harness`
+  (`build_eframe`, `run_steps`, synthetic `Event`s, automation-registry rects, AccessKit queries).
+  `ui_gpu.rs` runs the viewer on egui-wgpu's device; `ui_agent_audit.rs` audits commands and
+  automation coverage; `viewer_geometry.rs` has an opt-in visual matrix
+  (`CRAFT_UI_VISUAL_DIR`).
+- Web: `cargo xtask web --serve 8765`, then `node apps/effectcraft-web/tests/smoke.mjs`,
+  `workers.mjs`, `page.mjs`, `storage.mjs` (`docs/web.md:412-445`).
+- Performance: `effectcraft-cli bench --ops --json` (`apps/effectcraft-cli/src/main.rs:885-925`),
+  `cargo xtask bench` (`xtask/src/bench.rs`), and the headless `ui_egui::bench::Driver`
+  (`crates/ui-egui/src/bench.rs:13-108`).
+
+## 2. What actually changes in egui 0.37 that affects EffectCraft
+
+This section is limited to changes visible in the pinned sources. It corrects two assumptions that
+must not enter the plan:
+
+- **`App::logic` / `App::ui` and `Context::run_ui` are not new in 0.37.** They already exist in
+  0.36.2 (`egui-0.36.2/crates/eframe/src/epi.rs:167,182`; `egui-0.36.2/crates/egui/src/context.rs:794`),
+  and EffectCraft already uses them (`crates/ui-egui/src/lib.rs:1852-1935`, `apps/effectcraft/src/main.rs:426-456`,
+  `apps/effectcraft-web/src/app.rs:88-122`). The migration is **not** a wholesale update-to-ui rewrite.
+- **`Context::run_logic` is not a substitute for a pass.** It does not interpret time or events;
+  `run_logic` only refreshes viewport state (`egui-0.37.0/crates/egui/src/context.rs:1190-1218`).
+  Calling it cannot initialise fonts or consume input.
+
+### 2.1 Compile-visible API changes (the historical audit is a clue, not acceptance)
+
+The 2026-10-22 audit (`/home/codex/work/ssd2/task-evidence/egui037-audit-20261022/{fork,stock}/effectcraft.errors`)
+compiled only `effectcraft-ui-egui` (lib and lib test), against a historical fork revision and
+machine-local path patches. It reported the same 15 errors in fork and stock mode, with 602
+(stock) / 603 (fork) warnings; the difference is warning counts only. Those errors are consistent with the upstream 0.37 sources read here:
+
+| # | Anchor in this checkout | Error | 0.37 API and required change |
+| --- | --- | --- | --- |
+| 1 | `crates/ui-egui/src/color_picker.rs:19` | `Role::ColorButton` absent | `WidgetType` is a deprecated alias of `accesskit::Role`; use `Role::ColorWell` (`egui-0.37.0/crates/egui/src/lib.rs:644-659`) |
+| 2 | `color_picker.rs:336` | `Role::Other` absent | `Role::Unknown` |
+| 3 | `control.rs:371` | `Event::MouseWheel` missing `source` | add `source: MouseWheelSource::Wheel` (`egui-0.37.0/crates/egui/src/data/input/event.rs:175-200`) |
+| 4 | `lib.rs:1539` | no `egui::UserData` | screenshots are callback based (`ScreenshotCallback`) |
+| 5 | `lib.rs:1569` | no `Event::Screenshot` | receive the image from the callback, not from input events |
+| 6 | `menu_keys.rs:84` | `UiStack.id` absent | `UiStack.unique_id` / `UiStack.scope_id` (`ui_stack.rs:133-150`); use `scope_id` for a stable panel identity |
+| 7 | `panels/effect_controls.rs:1274` | `Role::SelectableLabel` | `Role::Button` with `WidgetInfo::selected` |
+| 8 | `panels/project.rs:613` | `Role::Other` | `Role::Unknown` (or `Role::TreeItem` directly) |
+| 9 | `panels/project.rs:781` | `Role::Other` | `Role::Unknown` |
+| 10 | `panels/text_panels.rs:700` | `Role::SelectableLabel` | `Role::Button` |
+| 11 | `theme.rs:732` | `&dyn AsRef<[u8]>` comparison | `FontData.font` is now a `Blob = Arc<dyn AsRef<[u8]> + Send + Sync>`; compare `FontData::bytes()` |
+| 12 | `theme.rs:752` | same | same |
+| 13 | `widgets.rs:24` | `UiStack.id` | `scope_id` |
+| 14 | `widgets.rs:493` | expected `IdSalt`, found `Id` | `Atom::custom(IdSalt, …)` (`atomics/atom.rs:98`) |
+| 15 | `widgets.rs:498` | expected `IdSalt` | `WidgetAtomResponse::rect(IdSalt)` (`atomics/widget_atom.rs:224`) |
+
+Deprecations that `-D warnings` turns into failures (all 602 audit warnings are in this list):
+
+| Deprecated item | Count in this checkout | Replacement |
+| --- | --- | --- |
+| `egui::Id::new` | 616 lines (`591` src, `25` tests); 626 occurrences (`601` src, `25` tests) across 59 src and 12 test files | `Id::unique` (same hash; `id.rs:101-104` delegates to it) |
+| `egui::WidgetType` | 19 | `egui::Role` (variant renames in §2.2) |
+| `Ui::id()` | 2 (`color_picker.rs:335,337`) | `Ui::scope_id()` (`ui.rs:363-371`) |
+| `egui::AtomLayoutResponse` | 1 (`widgets.rs:497`) | `WidgetAtomResponse` |
+| `TextEdit::vertical_align` | 1 (`widgets.rs:329`) | `TextEdit::align(Align2::LEFT_CENTER)` (`builder.rs:408-427`) |
+
+Integration tests were not compiled by the audit and must be assumed to contain more breakage.
+Two known classes are already visible by inspection:
+
+- 11 `Event::MouseWheel { … }` constructions lack `source` (`control.rs:371`, `ui_timeline_zoom.rs:33,81`,
+  `ui_scrolling.rs:34,157`, `viewer_geometry.rs:98,235`, `ui_panels.rs:386`, `ui_tail.rs:195`,
+  `ui_layer_panel_zoom.rs:109`, `ui_camera_tracker.rs:173`). The 12th match is a pattern in `lib.rs:581`.
+- `ui_agent_audit.rs:73` reads `WidgetInfo.typ`; it becomes `.role`.
+
+There is **no** `PointerSource` in the target fork: `Event::PointerButton` keeps the 0.36 shape
+(`aiongg/craft/0.37:crates/egui/src/data/input/event.rs:106-118`). The audit error at
+`control.rs:371` was the wheel event, not the pointer button.
+
+### 2.2 Role mapping used by this migration
+
+`WidgetType` → `accesskit::Role` (egui's own mapping table, `egui/src/lib.rs:644-659`):
+
+| Old | New |
+| --- | --- |
+| `Button` | `Role::Button` |
+| `ColorButton` | `Role::ColorWell` |
+| `Slider` | `Role::Slider` |
+| `SelectableLabel` | `Role::Button` + `selected` |
+| `Checkbox` | `Role::CheckBox` |
+| `TextEdit` | `Role::TextInput` / `MultilineTextInput` |
+| `DragValue` | `Role::SpinButton` |
+| `CollapsingHeader` | `Role::DisclosureTriangle` |
+| `Panel` | `Role::Pane` |
+| `ResizeHandle` | `Role::Splitter` |
+| `Other` | `Role::Unknown` |
+
+### 2.3 Behaviour changes that compilation will not catch
+
+These are the app-specific risks, each with a source anchor and a planned assertion.
+
+1. **`default_fonts` is no longer a default feature of `egui`/`epaint`.** eframe still enables it by
+   default, but EffectCraft disables eframe defaults and re-enables only
+   `default_fonts`, `wgpu`, `accesskit`, `links`, `wayland`, `x11`
+   (`crates/ui-egui/Cargo.toml:25`, `apps/effectcraft/Cargo.toml:18`). The app relies on
+   `FontDefinitions::default()` at `theme.rs:334`; the feature must stay explicitly enabled on the
+   `egui` dependency, not only through eframe, so `cargo check -p effectcraft-ui-egui` and test
+   builds are deterministic. (`#8583`; `egui-0.37.0/crates/egui/Cargo.toml:40-46`.)
+2. **The bundled emoji fonts are no longer in `FontDefinitions::default()`.** In 0.36.2 the default
+   definitions include `NotoEmoji-Regular` and `emoji-icon-font` unconditionally
+   (`egui-0.36.2/crates/epaint/src/text/fonts.rs:490-580`). In 0.37 they are behind
+   `monochrome_emoji_fonts`, and the default only adds the small `egui-icons` font
+   (`egui-0.37.0/crates/epaint/src/text/font_definitions.rs:105-180`). EffectCraft's own chrome is
+   affected. A read-only cmap audit of the fonts actually bundled by this app and by egui found:
+   - `✔` U+2714 (menu check gutter, `menus.rs:2176`) is in **only** NotoEmoji and emoji-icon-font;
+   - `▣` U+25A3 (Media Browser folder, `media_panels.rs:198`; Essential Graphics media row,
+     `essential.rs:247`) is in Hack and emoji-icon-font, but Hack is not in the app's
+     Proportional family (`theme.rs:339-347` only prepends Inter and appends JetBrains Mono), so
+     only the emoji font covers it;
+   - `✓` U+2713 (checked label text, `widgets.rs:485`) is in Inter/JetBrains Mono and unaffected.
+   Without `monochrome_emoji_fonts` these two become tofu, and kittest's default
+   `MissingGlyphPolicy::Panic` turns that into test failures.
+3. **Clipboard support became an eframe feature.** 0.36.2's eframe always enabled
+   `egui-winit/clipboard` (`egui-0.36.2/crates/eframe/Cargo.toml:152`). 0.37 gates it behind
+   `clipboard` (`egui-0.37.0/crates/eframe/Cargo.toml:142-144`), which is in eframe's default set
+   but not enabled by EffectCraft's `default-features = false` manifests. Without it, cut/copy/paste
+   to the OS clipboard silently degrade to an in-app simulated clipboard
+   (`egui-winit-0.37.0/Cargo.toml:44-46`), breaking Edit ▸ Copy/Paste, text-field paste and
+   `menus.rs:1867-1906` which maps clipboard events back to command keys.
+4. **Screenshots are callback based** (`#8489`; `data/screenshot_callback.rs`,
+   `ViewportCommand::Screenshot(ScreenshotCallback)`, `Context::request_screenshot`). The current
+   correlation by `UserData` token through `Event::Screenshot` is impossible
+   (`lib.rs:1530-1580`, `control.rs:439-444`). See §5.7.
+5. **`WidgetType` and ID APIs are deprecated**, and the CI clippy gate is `-D warnings`
+   (`xtask/src/main.rs:412`). This is 626 mechanical `Id::new` occurrences (616 lines) plus the 19
+   source role edits and one more in `ui_agent_audit.rs` (see §5.2/§5.3).
+6. **AccessKit roles/names are enforced by kittest 0.37.** `HarnessBuilder` defaults
+   `check_accessibility: true` and `Harness::run` panics on visible input widgets without a name
+   (`egui_kittest-0.37.0/src/builder.rs:50-51`, `src/accessibility.rs:9-45`). `is_input` covers
+   `Button`, `CheckBox`, `ColorWell`, `ComboBox`, `Slider`, `SpinButton`, `Splitter`, `Tab`,
+   `TextInput`, `TreeItem`, … (`egui-0.37.0/crates/egui/src/accessibility.rs:9-60`). Many of the
+   app's stock `TextEdit`, `DragValue` and `Slider` fields are currently unnamed (39
+   `TextEdit::singleline/multiline` constructors out of 44 `TextEdit::` references, and 51
+   `DragValue`/`Slider` constructors), and custom `ui.interact` widgets have no `WidgetInfo` at all.
+7. **Missing glyphs panic in kittest 0.37** (`#8601`; `MissingGlyphPolicy::Panic` is the harness
+   default, `builder.rs:50`). Tests that deliberately render uninstalled scripts must opt out with
+   `HarnessBuilder::allow_missing_glyphs()`; two are already known:
+   `tests/ui_effect_names.rs:35` (the builder inside `harness()` at line 20, used by the
+   `zh-hans` tests at 68, 81, 107 and 127, including `高斯模糊`) and
+   `tests/ui_presets_folder.rs:40` (`ja`). Fontconfig on this planning host lists no faces at all, so
+   those tests would panic rather than draw tofu until a CJK face is installed or the opt-out is used.
+8. **`Ui::id` → `Ui::scope_id`, `UiBuilder::id` → `scope_id`, `Panel` constructors take
+   `impl AsIdSalt`.** EffectCraft does not use `SidePanel`/`TopBottomPanel`, and uses
+   `CentralPanel::default()` only (`dock_ui.rs:475`, `prefs_live.rs:207`), so no panel-order
+   rewrite is needed. The root `Ui` is already the app surface (`lib.rs:1905-1935`,
+   `lib.rs:1614-1723`). Never call `Context::root_ui` from a panel or a test closure: it panics
+   while the root Ui is borrowed (`context.rs:1005-1055`).
+9. **Style defaults changed** (roomier buttons, larger corner radii; `#8617`, `#8445`).
+   EffectCraft pins `item_spacing`, `button_padding`, `interact_size.y`, `menu_margin`, scroll style
+   and all widget corner radii from tokens (`theme.rs:510-530`, `theme.rs:474-495`), so the visible
+   impact should be small, but atom-based `Button`/`ComboBox` layout can still move geometry. This
+   is a geometry/pixel test target, not an assumption.
+10. **Menus/popups and text editing changed** (`#7802`, `#7624`, `#8572`, `#8548`, `#8763`,
+    `#8628`). EffectCraft builds its own menu bar and keyboard navigation
+    (`menus.rs:2025-2050`, `menu_keys.rs`), with `MenuConfig` style overrides. Regression tests must
+    cover hover-switch, arrows, submenu opening, outside-click close, and a button acting on a
+    focused `TextEdit`'s selection (the `#8763` case). Container tooltips now also show when their
+    children are hovered (`#7909`); check tooltip presence/absence on the app's large custom
+    `interact` rects (viewer, timeline, dock) instead of assuming the 0.36 behaviour.
+11. **Kinetic scrolling/rubber-banding** (`#8662`, `#8663`) and the new `MouseWheelSource` change
+    wheel semantics. Synthetic wheel events must say `Wheel` (not `Unknown`) so tests and the
+    control channel keep deterministic scroll behaviour.
+12. **`Frame::default_fonts` + AccessKit bump**: accesskit 0.24.1 → 0.25.1, accesskit_winit
+    0.32.2 → 0.34.1, kittest 0.4.0 → 0.5.0. The kittest trees are **not** identical: `lib.rs`
+    re-exports `accesskit_consumer::NodeRef` as `AccessKitNode` where 0.4 re-exported `Node`, and
+    `query.rs`/`filter.rs` also differ. The 26 query call sites must be compiled against 0.5, not
+    assumed unchanged.
+13. **New 0.37 lifecycle tools** that this plan uses:
+    - `ViewportCommand::RequestPaintWhileHidden` and `ViewportInfo::visible()`
+      (`viewport.rs:1202-1240`, `viewport_info.rs:90-101`); visibility remains derived from
+      minimized/occluded even during a forced hidden UI paint;
+    - `Context::request_screenshot` / `ScreenshotCallback` (`context.rs:4595-4606`). The call sends
+      a `ViewportCommand`, which requests a repaint of that viewport; a pending screenshot also
+      makes a hidden window take a full UI+paint pass (`wgpu_integration.rs:686-690`,
+      `egui-winit/src/lib.rs:2116-2128`). It does **not** schedule a repaint when the callback
+      completes; the completion slot owns that wake-up (§5.7);
+    - `Context::set_repaint_observer` and `RepaintCause` (`context.rs:2290-2296`, `283-300`).
+14. **Known upstream regressions at 0.37.0** (reported upstream; not measured by this task):
+    - `#8731`: plain-text tessellation ≈61% more instructions (`tessellate_text` per-vertex colour
+      check). The candidate comparison revision is unpatched: `aiongg/craft/0.37:crates/epaint/src/tessellator.rs:2295-2341`
+      still has the conditional inside the vertex loop.
+    - `#8736`: egui-wgpu pipeline creation is ~40 ms slower on Windows/DX12 (FXC) because of
+      `wrap_texel_coord`.
+    Both are measured acceptance gates in §9 and, if over threshold, must be fixed in the final
+    P8 egui revision before P1 is frozen. P5 reports/retests; it does not change the pin.
+
+## 3. Fork, winit and craft-libs integration decisions
+
+### 3.1 What EffectCraft actually needs from the suite fork
+
+EffectCraft has no `vendor/` directory and no local egui patch. Its only `[patch.crates-io]` entry is
+`hayro-syntax`, inherited from the craft-libs PDF stack (`Cargo.toml:213-214`); it is unrelated to
+egui and must stay.
+
+The production dependency is the complete reviewed and published storytold egui **P8** revision,
+not the personal `aiongg` branches used as comparison input here. P8 carries E1–E21, P2b async
+W15P routing, P7 held-key pairing, P7b/E21b outgoing IME surrounding text (§5.5), P7c's selected
+`#8763`/`#8748` fixes and the justified `#8731`/`#8736` performance fixes. The completed final
+winit SHA carries W1–W27, W15P and the W27 lifecycle fixes. The two forks and `craft-ui` CL-1 +
+CL-2F are approved as one immutable unit at P1; P4 adds extended native/language coverage without
+a second compatibility graph (§10). There is no stock or intermediate-fork production stage;
+stock 0.37.0 is a measurement control only.
+
+| Fork patch | EffectCraft use | Decision |
+| --- | --- | --- |
+| E1 `viewport_hooks` | not used (craft-tablet only) | keep in fork; no app change |
+| E2+E3 surface fit / wgpu error scopes | protects windows whose surface exceeds the adapter limit and reports configure/renderer failures; relevant to the app's "never crash" rule and its device-loss handling | **keep, benefit**; verify with a required-adapter `ui_gpu.rs` run and a device-loss test |
+| E4 Wayland clipboard/PRIMARY | the app edits text in project rows, timeline fields, expression fields, Script UI and settings; Hyprland serves one data device per client | **keep**; requires winit W15 plus the new **W15P** PRIMARY path (§5.5/§8.7) |
+| E5/E12/E13/E16 bidi and grapheme editing | UI labels and stock `TextEdit`s only; **text layers use `effectcraft-text`, not epaint** | **keep**; do not claim it fixes text layers |
+| E6 IME focus | stock `TextEdit`s | keep |
+| E7/E19 letter keys on non-Latin layouts | shortcuts (`menus::parse_shortcut`, `handle_shortcuts`); requires winit W25 | **keep**; manual platform test |
+| E8 `TextEdit` glyph clipping | stock fields (Thai/Vietnamese/Arabic marks) | keep |
+| E9 `Style::right_to_left` | app never sets it; its dock/layout is custom LTR | keep in fork; **do not enable** in EffectCraft (would mirror stock widgets inside an unmirrored custom layout) |
+| E10 web named keys / Latin codes | web keyboard behaviour | keep; no app change |
+| E11 vello_cpu multithreading | not used | keep in fork |
+| E14 `FontTweak::fallback_align` | the app installs system fallback faces (`theme.rs:388-430`) | keep; **optional follow-up** to set it for CJK/Indic fallbacks, with screenshot proof |
+| E15 `LineBreaker` | text layers use `effectcraft-text`; not adopted | keep in fork |
+| E17/E18 `Context::set_language` / `Frame::set_ui_language` | screen-reader language and UI shaping language (the app has an interface language setting, `i18n::language`) | **adopt in the language stage** (fork-only; see §5.9) |
+| E20 widget text language | goes with E17 | adopt with E17 |
+| E21 `ImeEvent::DeleteSurroundingBytes` | the app has a **custom** viewer text editor that consumes IME events itself (`viewer_text.rs:397-508`) | **adopt in the IME stage**; stock 0.37 only has char-based `DeleteSurrounding` |
+| **P2b** (new prerequisite) | async W15P PRIMARY routing in egui-winit: bounded read workers, owner-specific completion waker, no blocking UI path | **in P8**; gate in §5.5/§8.7 |
+| **P7** (new prerequisite) | held-key pairing: the emitted egui key identity is stored by physical key and reused on release; clipboard shortcuts alone do not prove this | **in P8**; gate in §3.2/§5.5 |
+| **P7b/E21b** (new prerequisite) | candidate egui-winit never calls winit W27's `set_ime_surrounding_text`; `IMEOutput` carries no logical text. The custom viewer editor is a required producer. | **in P8 before final acceptance**; see §5.5, §8.4 and `ime-surrounding-gap.md` |
+| **P7c** (new prerequisite) | selected upstream fixes `#8763` (a button/menu command acting on a focused `TextEdit` selection) and `#8748` (hidden parent not updating deferred child viewports) | **in P8**; tested in §5.6/§5.8. Local workarounds are not the final unit. |
+
+Removal conditions are the fork's own (`PATCHES.md`): each patch goes when an egui/winit release in
+use contains it. EffectCraft must not add a second copy of any of these fixes locally.
+
+### 3.2 Winit patches that matter here
+
+| Patch | Why EffectCraft needs it | Gate |
+| --- | --- | --- |
+| W1 mixed-DPI rect | window placement and monitor hit tests (`apps/effectcraft/src/window.rs`) | Windows mixed-DPI manual test |
+| W2/W5/W20/W21 X11 IME | the app's editable fields and expression editor | X11 IME under Xvfb+WM (qualified parts only; §8.7) |
+| W3/W18/W19/W22/W24/W26/W27 IME | the custom text editor and stock fields; W26/W27 are required by E21 and by E21b/P7b | macOS press-and-hold/dictation, Wayland text-input-v3, Windows IME |
+| **W15P** (new) | winit-owned Wayland PRIMARY on the existing connection/event queue, per-seat manager/device/source/offer from SCTK 0.19.2; no second regular data device | wlroots/Hyprland, KWin and Mutter capability matrix (§8.7) |
+| W13 Wayland wheel phase | zoom/scrub shortcuts must not latch | Wayland manual test |
+| W15 Wayland clipboard/files | needed by E4 | Hyprland clipboard check |
+| W23 macOS Command keys | menu shortcuts | macOS layout test |
+| W25 Latin layout | E19 shortcuts; preserve the emitted key identity by physical key across release | Russian/Arabic/Hebrew layout test plus a held Ctrl+Z/Cmd+K release after a layout/modifier change |
+
+W27 also needs the lifecycle fixes recorded in `winit-review-triage.md`: clear the pending
+preedit/commit/deletion batch on leave with an explicit epoch, test late `Done`, disable/reset, seat
+removal and two windows, and preserve deletion-FIFO/commit pairing. Focus epochs and protocol
+serials are distinct: a current-epoch `Done` with a mismatched serial still applies its incoming
+edits exactly once and only defers outgoing surrounding state until a matching serial; a stale
+(different owner/focus generation) batch is invalidated and discarded. `W25`/`W23`/`E19` must
+preserve the emitted egui key identity by physical key across release (including layout/modifier
+changes), clearing it on focus loss, IME interception and destruction, and test a non-clipboard
+held key (Ctrl+Z/Cmd+K), repeat semantics and two physical keys mapping to one logical key.
+W15 needs bounded, cancelable transfers with a 2 s total monotonic deadline and a 16 MiB total
+byte budget; the egui adapter must not block the UI and must cancel stale pastes after
+focus/target/generation changes.
+
+### 3.3 craft-libs PR 199, CL-2 and language PR 198
+
+- PR 199 is **merged** at `3832c47ef68a0e6214f2c1e85f3526b6adcb686e`, the current reconciled
+  shared-library implementation base. Do not merge its historical head `b68de8c5` (a stale tree
+  relative to current `main`, missing `craft-platform` and reverting security/settings/docking/
+  printer fixes) or audit merge `ec8840a` (stale lock, egui 0.36.2) as trees. The historical API
+  port `8614e4a` and README `1764bca` on old `main` `4919088` are superseded by the merged base.
+- EffectCraft pins `craft-ui` to the **reviewed CL-1 merge/rebase SHA on craft-libs `main` after the
+  port**, not to the PR head. That revision must keep its egui dependency on registry `0.37` so
+  EffectCraft's `[patch.crates-io]` (not a git URL patch) can redirect it.
+- **CL-2 capture completion helper.** The shared plan's selected design is a bounded, cancelable
+  per-request completion slot with a weak callback reference, aggregate image-byte and request
+  limits, and an explicit viewport wake-up after the slot lock is released. EffectCraft is one of
+  the eleven existing craft-ui consumers, so it pins **CL-1 + CL-2F in the same atomic dependency
+  stage** as P1; only the DesignCraft/GridCraft pilots use the reviewed provisional CL-2 revision,
+  and their adapters are reviewed before CL-2F freezes the API. Any consumer with an incompatible
+  existing craft-ui bump must reconcile it in that same stage. EffectCraft does not pin the
+  provisional revision. **No app-local result channel** and no generic UI compatibility layer.
+  EffectCraft keeps its own request ids, paths, crop, deadlines and reply JSON.
+- `craft-ui`'s production API used here (`docking::{Action, Zone, Placement, resolve_drop, zone_rect, drop_zone}`,
+  `layout::{split_rect, SplitAxis, SplitSize, ResizeHandle, ResizeHandleStyle}`) is unchanged by
+  the port; the additive `printing::tick` is not used by EffectCraft.
+- PR 198 / the fork language work is adopted only where §3.1 says so. The app keeps its own
+  catalogs (`i18n.rs`, `i18n/ui.rs`, `i18n/effects.rs`) and its own text engine; it does not adopt
+  craft-text line breaking or a shared translation layer.
+- Blocking: CL-1 and CL-2F must land before the EffectCraft dependency-pin PR can be reviewed
+  honestly. Until then, implementation may use a local pinned SHA only for development, never in a
+  publication branch, and never a machine-local path patch.
+
+## 4. Root-`Ui`, lifecycle and multi-pass semantics
+
+### 4.1 Current split (already on 0.36.2, must be preserved and completed)
+
+Today `EffectcraftApp::logic` does GPU-failure application, language/theme/font install, FPS, control
+drain, screenshot scheduling/collection (`lib.rs:1870-1903`), while `ui` calls `frame()` which does
+**polls, playback, events, autosave, prefs, window title, close guard and the whole paint**
+(`lib.rs:1905-1935`, `lib.rs:1614-1723`).
+
+Verified integration facts (candidate source, same call sites as upstream 0.37):
+
+- `eframe` runs `logic` and `ui` inside one `Context::run_ui` closure for every full pass
+  (`eframe-0.37.0/src/native/epi_integration.rs:349-364`; web `app_runner.rs:289-292`). A full pass
+  can run more than once per frame when `Context::request_discard` is used.
+- While the root window is minimized/occluded, native eframe runs `Context::run_logic` with
+  `App::logic` only (`epi_integration.rs:384-425`), unless a `Screenshot` or
+  `RequestPaintWhileHidden` action is pending, in which case it runs a **full** UI pass with current
+  input and paint (`wgpu_integration.rs:680-740`).
+- `prepare_raw_input` calls `raw_input_hook` **before both** paths
+  (`epi_integration.rs:414-428`). `update_logic_only` then stores the hook-mutated raw input in
+  `pending_raw_input` for the next full pass (`epi_integration.rs:400`). Therefore synthetic
+  events fed during a logic-only call are retained, not lost, and are applied exactly once by the
+  next full pass.
+- Native eframe throttles repaints of an invisible/minimized window to at least 100 ms
+  (`eframe-0.37.0/src/native/run.rs:27,376-383`), so a hidden gesture or capture takes a few
+  throttled full passes; the app's deadlines must allow for that and must not infer failure from the
+  first 100 ms.
+- `ViewportInfo::visible()` derives from `minimized`/`occluded`, not from a paint request. It stays
+  `Some(false)` during a forced hidden UI pass, so visibility cannot distinguish "logic only" from
+  "forced hidden paint".
+- `run_logic` refreshes only `raw.viewports` and `raw.focused` (`egui-0.37.0/crates/egui/src/context.rs:1190-1218`);
+  it leaves `InputState::time`, events and pointer state at the previous pass's values. eframe sets
+  `RawInput::time` in `prepare_raw_input`, but `run_logic` does not copy it into `InputState`.
+- `Context::request_screenshot` sends a viewport command, which requests a repaint, and a pending
+  screenshot is a "wants paint" action even when hidden. The callback itself does not request a
+  repaint when the pixels arrive.
+
+Consequences, all pre-existing in 0.36.2:
+
+- With the window minimized/occluded, job polling, playback advance, audio pumping, auto-save
+  ticks, engine-event draining, the unsaved-close guard and the window-title update **do not run**
+  on ordinary logic-only ticks.
+- A discarded pass re-runs the `run_ui` closure, so `logic` runs again for the same frame.
+  `Grid` requests a discard on first show (`egui-0.37.0/crates/egui/src/grid.rs:468`); EffectCraft
+  has 18 `Grid::new` sites across dialogs/settings/forms.
+- The control channel's `AfterInput` replies are completed in `logic` as soon as `synthetic` is
+  empty, which is before the pass applies the last synthetic event (`lib.rs:1893-1901`,
+  `lib.rs:1921-1930`). While hidden, an event can also have been fed into retained raw input with
+  no pass yet applied.
+
+### 4.2 Target boundaries
+
+Introduce one explicit app tick and one draw pass; do not add a generic `Context` bridge:
+
+```rust
+// EffectcraftApp
+now: f64,          // monotonic app clock value for this tick, used for deadlines
+focused: bool,     // last known focus, refreshed from viewport info
+last_input_at: f64,
+last_draw_geom: Option<(egui::Rect, f32)>, // last non-discarded root draw: screen rect + ppp
+geometry_epoch: u64,   // bumped whenever that screen rect or ppp changes
+want_paint: bool,
+clock: AppClock,   // real or injected (§4.3)
+
+/// The only non-paint entry. Effects are idempotent; time may advance slightly per call.
+pub fn tick(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame);
+
+/// Paint only. Receives the root Ui from eframe.
+pub fn draw(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame);
+
+// eframe::App
+fn raw_input_hook(&mut self, ctx, raw) { /* feed synthetic, pointer wrap; no clock, no replies */ }
+fn logic(&mut self, ctx, frame) { self.tick(ctx, frame) }
+fn ui(&mut self, ui, frame) { self.draw(ui, frame) }
+```
+
+`tick` must contain, in this order:
+
+1. `init_gpu(frame)` (moved from `ui`, `lib.rs:761-806`), so the compositor exists before the first
+   paint and while hidden; `apply_gpu_failure` + `close_after_device_loss` (moved from `ui`,
+   `lib.rs:1905-1910`).
+2. `i18n::set_current(language)`, theme/font install and `apply_prefs` (moved from `frame`).
+3. Engine/background polling: `poll_render`, `poll_track`, `poll_mask_track`, `poll_jobs`,
+   `poll_offload`, `poll_warp`, `poll_roto`, `poll_camera` (`lib.rs:1617-1655`), plus
+   `frames.set_context(ctx)` so worker completions can request repaints while hidden. These are
+   queue-draining and a second call in a discarded pass is a no-op (e.g. `render_queue.rs:579-583`
+   takes the update queue).
+4. `run_script_tasks`, `handle_events` (engine queue drained once), `command_inbox`; toast/status
+   timestamps use `now`, not `ctx.input(|i| i.time)`.
+5. `run_dialog_answers` and the native-menu answers.
+6. `tick_autosave` (already wall-clock based, `lib.rs:1790-1816`) with the app clock, watch folder,
+   `tick_footage_reload` using `self.focused`/`self.now`/`self.last_input_at` instead of `ctx.input`.
+7. Control: `drain_control` with `now`, `finish_job_waiters` with a bounded repaint.
+8. Screenshots: `collect_screenshots` (drain completion slots and validate each image against the
+   geometry + epoch recorded at issuance, §5.7), then `issue_screenshots` (`now`), then timeouts
+   and cancellations.
+9. Playback: `advance_playback(ctx, scale, now)` using the last drawn viewer scale;
+   audio pump; `cache_when_idle`.
+10. Unsaved close guard (`panels/unsaved.rs:50-62`) and window-title update.
+11. `prefs_live::memory_watch` / `home_on_open` (split out of `prefs_live::frame`,
+    `prefs_live.rs:15-19`); `video_preview` stays in draw.
+12. If `want_paint`, or synthetic input/`input_waiters` remain, or a control step needs a UI pass,
+    send `ViewportCommand::RequestPaintWhileHidden` and clear `want_paint`. This also covers
+    playback with an open Video Preview or floating panel window (§5.8).
+
+`tick` never reads input events, pointer state or modifiers for decisions. `draw` keeps only paint
+and direct manipulation: dock layout, panels, menus, dialogs, areas, `ui.inspect` registry, pointer
+hover, shortcuts that read events, `finish_native`, `video_preview`, dropped-file overlay/import,
+Home thumbnail capture, toast, workspace-state save on pointer-up, and `frames.pump` on wasm (or
+move `pump` to `tick`; either is acceptable if tested, but it must not be the only progress path).
+`draw` updates `last_input_at` from the pass's input activity and records
+`last_draw_geom = Some((ui.ctx().screen_rect(), ui.ctx().pixels_per_point()))` at the end of every
+pass that is not discarded (`!ui.ctx().will_discard()`), bumping `geometry_epoch` when the rect or
+ppp differs from the previous value. Screenshot issuance copies this geometry + epoch; completion
+rejects/retries if the epoch changed before the save (§5.7). The callback itself supplies only
+pixels, so the issued record — not callback timing — is the geometry anchor.
+
+**No `Context::root_ui` anywhere.** Areas/Windows/Modals keep taking `ctx` (they create their own
+layers); panels receive the existing `&mut Ui`. `show_viewport_immediate` stays as is.
+
+### 4.3 App clock, focus and input gating
+
+- **The clock is app-owned and injected.** Neither `ctx.input(|i| i.raw.time)` nor
+  `ctx.input(|i| i.time)` is valid in a logic-only tick: `run_logic` copies only viewports/focused
+  (`context.rs:1190-1218`), so `i.raw.time` is the previous full pass's raw value and `i.time` is
+  the previous pass's `InputState::time`; kittest leaves `RawInput::time` `None`.
+  ```rust
+  pub struct AppClock {
+      source: ClockSource, // Real(web_time::Instant) | Manual(f64)
+  }
+  impl AppClock { fn now(&self) -> f64 { /* monotonic seconds */ } }
+  let now = self.clock.now();
+  ```
+  `tick` stores `self.now = now` before using it. Tests inject `AppClock::manual()` and advance it;
+  a regression must show that a stale `ctx.input(|i| i.time)` cannot satisfy a deadline. Native and
+  web use the same `web_time::Instant` source; `EffectcraftApp::now()` exposes the last value so
+  `WebApp::logic` can pass it to `persist::snapshot` (§8.6).
+- Focus comes from the fresh viewport copy with a visible-pass fallback:
+  ```rust
+  let focused = ctx.input(|i| i.viewport().focused)
+      .or_else(|| ctx.input(|i| i.focused));
+  self.focused = focused.unwrap_or(self.focused);
+  ```
+  Do not read `i.events`/pointer in `tick`; input handling belongs to `draw` (the known UI phase).
+- **Synthetic input is not gated on visibility, but is gated on an unapplied event.**
+  `raw_input_hook` runs once per eframe prepare (frame or logic call), not per egui UI pass, and
+  calls `self.feed_synthetic(raw_input)` then `pointer_wrap::prepare_input(...)`. In a logic-only
+  call eframe retains the mutated raw input
+  (`pending_raw_input`) and calls the hook again on the next call; in a forced hidden full pass it
+  is applied immediately. Gating on `visible() == Some(false)` would skip feeding in both cases
+  and leave the gesture (and its reply) pending forever.
+  `feed_synthetic` drains **one pointer event per call** (`lib.rs:578-591`), so repeated
+  logic-only updates before the forced full pass (eframe's overdue-`RedrawRequested` path and its
+  100 ms invisible-window throttle) would append press, move and release to the same retained
+  input and collapse a gesture into one pass. The hook must therefore set a guard when it moves a
+  synthetic event into raw input and skip feeding while that guard is set; the guard is cleared
+  when a known UI pass has applied that step once, even if layout is later discarded;
+  record that application separately from screenshot settling/accepted-frame counters.
+  RawInput events are consumed on the first pass and are not replayed in later passes.
+  Never clear the guard in `tick`; never wait for the event to reappear in an accepted pass.
+  The next step is fed only on a subsequent host input preparation. No event is discarded. §8.3 tests repeated logic-only ticks with a drag and a click.
+- `raw_input_hook` performs no reply, no clock read and no side effect other than pointer-wrap state,
+  the synthetic-pending guard and merge-key closing. `pointer_wrap::prepare_input` returning "gesture ended" clears
+  `session.history.merge_key`; doing that during a logic-only call is safe because the events are
+  retained and the same reset is idempotent.
+- Replies for `AfterInput` are completed **only at the end of a non-discarded `draw` pass**
+  (after the pass, check `!ui.ctx().will_discard()`) that ran after the last synthetic event was
+  fed, and never in `tick`. A hidden request therefore replies only after the forced pass applied
+  it, and a pass that egui throws away cannot produce an early success reply.
+- If a control request needs a UI pass (synthetic input, a panel-window change, or a caller that
+  explicitly wants fresh `ui.inspect`/`ui.elements` data), `tick` sends `RequestPaintWhileHidden`.
+- `control::handle` is called from `tick` with `now` passed in (a signature change, not a wrapper):
+  replace its `ctx.input(|i| i.time)` at `control.rs:428` with `now`, and `inspect`'s
+  `windowFocused` at `control.rs:562` with `ctx.input(|i| i.viewport().focused)`. `ui.inspect` and
+  `ui.elements` keep last-painted semantics.
+
+### 4.4 Multi-pass and idempotence
+
+A discarded pass re-runs `tick` and `draw` with the same raw input (events are taken by the first
+pass). Rules:
+
+- `tick` effects are idempotent for a replayed pass: polls drain queues; auto-save checks a
+  timestamp; `advance_playback` computes the target frame from the plan and the monotonic `now`
+  rather than incrementing, so a replay with a slightly later `now` does not double-count
+  `Playback::frame_shown` (`lib.rs:230-246`); screenshot scheduling advances only when `now`
+  passes a settle deadline, never once per pass (the old frame counter must not be replayed);
+  job-waiter completion is keyed by the pending job, not by pass count.
+- One-shot side effects in `draw` must rely on egui's per-pass input (`Response::clicked`,
+  `drag_stopped`) and command merge keys, not on layout-pass counts. High-risk paths are viewer
+  drags (`viewer.rs:1674-1874`), timeline drags (`timeline.rs:1500-1700`), painting strokes
+  (`layer_panel.rs:350-360`) and form toggles inside `Grid`s.
+- Add a forced-discard regression test (§8.3) that proves one undo step and one command effect
+  across a real two-pass frame.
+
+## 5. Concrete refactors with anchors
+
+### 5.1 Manifests, features, pins and lock checks
+
+Root `Cargo.toml` (final publication form; placeholders are filled only after the reviewed forks
+exist). P1 waits for the complete reviewed/published storytold egui P8 (E1–E21, P2b, P7, P7b/E21b,
+P7c and any justified perf fix), the completed winit (W1–W27, W15P, W27 lifecycle) and craft-ui
+CL-1 + CL-2F. It includes the custom-editor IME payload adapter atomically. Stock 0.37.0 and
+aiongg candidates remain comparison controls, never intermediate production stages.
+
+```toml
+craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "<reviewed main SHA including CL-1 and CL-2F>", features = ["serde"] }
+egui = { version = "0.37", default-features = false, features = ["default_fonts", "monochrome_emoji_fonts"] }
+eframe = { version = "0.37", default-features = false }
+egui_kittest = { version = "0.37" }
+
+[patch.crates-io]
+winit = { git = "https://github.com/storytold/winit", rev = "<final reviewed winit SHA incl W15P>" }
+egui = { git = "https://github.com/storytold/egui", rev = "<final reviewed egui P8 SHA incl E21b + P7c>" }
+eframe = { git = "https://github.com/storytold/egui", rev = "<same egui SHA>" }
+egui-winit = { git = "https://github.com/storytold/egui", rev = "<same egui SHA>" }
+egui-wgpu = { git = "https://github.com/storytold/egui", rev = "<same egui SHA>" }
+egui_kittest = { git = "https://github.com/storytold/egui", rev = "<same egui SHA>" }
+hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d", version = "=0.7.2" } # keep
+```
+
+`epaint`, `epaint_default_fonts`, `ecolor` and `emath` are path dependencies of the git egui crates
+and must resolve from that same git revision. `aiongg/*` SHAs are comparison inputs only and must
+not appear in a publication lock.
+
+Notes:
+
+- `craft-ui` is a git dependency from `craft-libs`; redirecting it with
+  `[patch."https://github.com/storytold/craft-libs"]` is only acceptable for development, never in a
+  publication branch. The publication form is the real `rev`.
+- Do not patch `egui_plot`, `egui_dock`, `egui_extras` (unused) or `egui_system_font_provider`
+  (unused while `system_fonts` is off).
+- The fork's own `[patch.crates-io] winit = { branch = … }` belongs to the fork workspace and does
+  **not** propagate; the consumer patch above is mandatory.
+- Feature additions in the app manifests:
+  - `crates/ui-egui/Cargo.toml:25`: `eframe` features += `clipboard`.
+  - `apps/effectcraft/Cargo.toml:18`: `eframe` features += `clipboard`.
+  - `apps/effectcraft-web/Cargo.toml:30`: keep `default_fonts`, `wgpu` (web has no OS clipboard
+    feature; browser clipboard events are separate).
+  - `egui_kittest` dev features: `eframe`, `wgpu`, plus `snapshot` only if §8.4's pixel goldens are
+    adopted. `egui_kittest` depends on `egui` with `default-features = false`; only kittest's own
+    `[dev-dependencies]` enable `default_fonts`/`monochrome_emoji_fonts`, and a dependency's
+    dev-dependencies do **not** propagate. The workspace `egui` features above are therefore what
+    EffectCraft's library and integration-test builds receive; do not rely on kittest to enable
+    fonts. If a test root resolves `egui` independently, it must enable the font features itself
+    or install controlled fonts, and the actual graph is checked per production/test root.
+  - `monochrome_emoji_fonts` is enabled at the workspace `egui` dependency so `✔`/`▣` survive
+    (§2.3.2). It propagates into `effectcraft-web`; record the raw and compressed WASM size change
+    and either accept it with a budget or introduce a native-only `ui-egui` emoji-fonts feature
+    after measuring (§9).
+  - `system_fonts` stays **off** initially: the app already installs language-driven system
+    fallbacks (`theme.rs:388-430`) and scans fonts for its menus; enabling eframe's fontique
+    provider would add startup cost (`#8512`) and make rendering machine-dependent. Revisit as a
+    separate product change for colour emoji.
+- `winit` direct dependency in `apps/effectcraft/Cargo.toml:23` must match the patched fork (it
+  does: `0.30`).
+- Lock/duplicate checks after every pin change:
+  ```sh
+  cargo tree -d
+  cargo tree -i egui@0.37.0
+  cargo tree -i winit@0.30.13
+  cargo tree -e features --target x86_64-unknown-linux-gnu
+  cargo tree -i wasm-bindgen --target wasm32-unknown-unknown
+  cargo check --locked
+  cargo test --locked
+  cargo metadata --locked --format-version 1 --no-deps
+  ```
+  Acceptance: exactly one egui-family source (the final storytold revision) covering `egui`,
+  `eframe`, `egui-winit`, `egui-wgpu`, `egui_kittest`, `epaint`, `epaint_default_fonts`, `ecolor`
+  and `emath`; exactly one winit (the final storytold revision); no registry `egui`/`epaint`
+  beside it; no `path = "…"` patch and no branch dependency; a clean checkout fetches every
+  approved revision and passes the checks with `--locked`.
+- `wgpu` stays `30.0.1`; egui 0.37 accepts `30.0` and already resolves 30.0.1 here. The pinned
+  `wasm-bindgen = 0.2.129` must stay consistent with `wasm-bindgen-futures`; check the wasm-target
+  inverse tree above.
+
+### 5.2 IDs and scopes
+
+- Mechanical `Id::new(` → `Id::unique(`: **626 occurrences / 616 lines** (`601`/`591` in source,
+  `25` in tests; 59 source and 12 test files). Count by occurrence and file, not only by line.
+  `GlyphId::new` in `crates/text`/`crates/pdf` (7 lines) is unrelated and must stay. Values are
+  identical because `Id::new` delegates to `Id::unique`
+  (`egui-0.37.0/crates/egui/src/id.rs:101-104`); persisted workspace state
+  (`workspace_state.rs`, **version 1**) and project JSON store no egui IDs, so no migration is
+  needed.
+- `color_picker.rs:335,337`: `ui.id()` → `ui.scope_id()`.
+- `widgets.rs:24`: `s.id` → `s.scope_id` (the panel's stable scope; do not use `unique_id`, which
+  changes with layout).
+- `widgets.rs:492-497`: make `label_swatch_id() -> egui::IdSalt` = `IdSalt::new("label-swatch")`;
+  `Atom::custom(salt, …)`; `WidgetAtomResponse::rect(salt)`.
+- `menu_keys.rs:84`: `find_menu_root(ui).scope_id`.
+- No new ID scheme; add a test that the same source yields the same `Id` across frames and that two
+  different payloads differ. Do not derive IDs from translated text (already true).
+
+### 5.3 Roles, names and accessibility
+
+Migrate the 19 source `WidgetInfo` sites with the table in §2.2, plus `ui_agent_audit.rs:73` in the
+test (`.role`). Specific choices:
+
+- `color_picker.rs:19`: `Role::ColorWell`, label = hex (existing screen-reader contract).
+- `color_picker.rs:336`: `Role::Unknown` (a painted swatch, not an input).
+- `color_picker.rs:338`: `Role::Button` ("Original color").
+- `color_picker.rs:271,300`: `Role::Slider` (labels stay).
+- `effect_controls.rs:1274`, `text_panels.rs:700`: `WidgetInfo::selected(Role::Button, enabled,
+  selected, label)`.
+- `panels/project.rs:613`: use `WidgetInfo::labeled(Role::TreeItem, …)` directly, but **keep** the
+  `accesskit_node_builder` at `project.rs:614-620` for `selected`, `level` and `expanded`
+  (`WidgetInfo` cannot express level/expanded); remove only its `set_role(TreeItem)` line.
+- `project.rs:781`: `Role::Unknown` (comment).
+- `dock_ui.rs:367`: `Role::Splitter` ("Resize floating panel") instead of `Button`.
+- `widgets.rs:497`: `WidgetAtomResponse`.
+
+Naming work for kittest's accessibility check:
+
+- **Strict checks stay on from the first green PR.** There is no shared test harness to flip:
+  `Harness::builder()` appears at 180 call sites in 78 test files, and
+  `HarnessBuilder::default()` sets `check_accessibility: true`
+  (`egui_kittest/src/builder.rs:51`). A new helper would not reach existing direct builders, and a
+  per-builder `with_accessibility_check(false)` would only hide failures. P1 therefore adds the
+  actual names until every test passes with strict checks; a repository grep gate forbids
+  `with_accessibility_check(false)` (§8.2). No global or blanket opt-out exists at any stage.
+- Stock fields: give each `TextEdit` a `hint_text` or `accessible_name`, each `DragValue`/`Slider`
+  an `accessible_name`. Known call sites: `TextEdit` (39) in `precomp.rs:117`, `rq_templates.rs:137`,
+  `scriptui_view.rs:145`, `timeline.rs:1507,2066,2458,3516`, `project.rs:704`,
+  `shortcut_editor.rs:276,440,532`, `markers_ui.rs:119`, `text_panels.rs:607`,
+  `settings.rs:174,607`, `effect_controls.rs:1214`, `forms.rs:786,794,806`, `dialogs.rs:471`, plus
+  the rest from `grep -rn TextEdit:: crates/ui-egui/src`; `DragValue`/`Slider` (51) in
+  `layer_styles_dialog.rs`, `gradient_editor.rs`, `settings.rs`, `key_dialogs.rs`, `forms.rs`,
+  `dialogs.rs`, `dialogs_3d.rs`, `viewer_tools.rs`, `scriptui_view.rs`.
+- For rows whose label is a separate widget, use `Ui::label_inputs_by(label_id, |ui| editor)` —
+  e.g. the Grid rows at `forms.rs:771`, `settings.rs:596`, `key_dialogs.rs:142,207,251`,
+  `markers_ui.rs:133`, `rq_templates.rs:56,100`, `layer_styles_dialog.rs:214`.
+- For rows whose label is painted (Timeline property rows, Effect Controls rows), use
+  `Ui::name_inputs(label, |ui| editor)` or `Response::accessible_name(label)` where the label is
+  already known. This covers `timeline.rs:2458,3516` and `effect_controls.rs:1214`.
+- Custom widgets have no `WidgetInfo` today; add a small local helper, not a compatibility layer:
+  ```rust
+  fn named(resp: egui::Response, role: egui::Role, name: impl Into<String>) -> egui::Response {
+      resp.widget_info(|| egui::WidgetInfo::labeled(role, resp.enabled(), name.into()));
+      resp
+  }
+  ```
+  Use it first for the highest-value controls: dock tabs (`Role::Tab`, selected state,
+  `dock.rs:1149-1280`), active/close buttons, the dock split handle, numeric scrub fields
+  (`widgets.rs:53-160`), the color field/slider (`color_picker.rs`), the error bar prev/next
+  buttons (`expr_bar.rs:59-70`), and the floating-panel resize grip (`dock_ui.rs:367`). Do not
+  blanket-wrap `ui.interact`: a node without a real name/role is worse than no node.
+  The helper stays private to `effectcraft-ui-egui`; there is one consumer (this app), so it is not
+  proposed for `craft-ui` and is not a generic compatibility layer.
+
+Accessibility assertions (§8.4) must include roles, `selected`, enabled state, names, and the
+AccessKit language once §5.9 lands. The app's `ui_agent_audit.rs` (automation coverage) stays
+separate: an automation id is not an accessible name. `docs/gaps.md:227` records that the project
+has done no accessibility work; this stage is a first, tested step (visible stock controls and the
+highest-value custom controls), not a claim of screen-reader parity.
+
+### 5.4 Fonts, glyphs and text
+
+- Enable `egui/default_fonts` and `egui/monochrome_emoji_fonts` in the workspace dependency (see
+  §5.1) so `FontDefinitions::default()` at `theme.rs:334` keeps the 0.36.2 font set. Do not rely on
+  eframe feature unification for correctness.
+- Keep the app's two-pass font warm-up (`styled`/`fonts_ready`, `lib.rs:1876-1890`,
+  `lib.rs:1905-1911`): 0.37 may apply `set_fonts` immediately when no text has been laid out
+  (`#8602`, `#8609`), but relying on that would change when the first frame draws and would make
+  headless tests depend on pass timing. Do not use `run_logic` to install fonts in a UI test.
+- `theme.rs:732`: `d.font.as_ref() == bytes` → `d.bytes() == bytes` (and keep `d.index`).
+- `widgets.rs:329`: `TextEdit::vertical_align(Align::Center)` → `TextEdit::align(Align2::LEFT_CENTER)`
+  (the old call only changed the vertical component; the horizontal default was LEFT).
+- Update the comment at `theme.rs:354-360` ("egui … has no bidirectional layout"): the suite fork
+  shapes RTL runs, but text layers still use `effectcraft-text` and are unaffected. Add a UI-label
+  RTL test (Arabic/Hebrew `Label`/menu text has visual-right-to-left run order) and keep the
+  text-layer RTL test in `crates/text/src/layout.rs:1419` as the text-engine contract.
+- Keep `system_fonts` off. If colour emoji is wanted later, it is a separate change with a startup
+  measurement and cross-platform screenshots, not part of this migration.
+- Fallback registration stays as is (`theme.rs:388-430`), including `FontData::from_owned` and
+  `data.index = face.info.index`; `FontData` still accepts that construction in 0.37. Optional
+  follow-up: E14 `FontTweak::fallback_align` for the installed system faces, with CJK/Indic
+  screenshots before and after.
+- Extend the existing glyph-coverage test (`theme.rs:700-716`) to the full chrome symbol set used by
+  the app, including `▣`, `✔`, `✓`, `⚠`, `▶`, `◀`, `▸`, `●`, `○`, `…`, `×`, `›`, `•`, `·`, `−`,
+  `←/→/↑/↓`, `⌘`, `⇧`, `⌥`, `⌃`, `⏎`, `↵`, `′`, `″`, in Proportional, Monospace, `medium` and
+  `semibold`. This is the regression test for finding 2.3.2.
+- Tests that deliberately render scripts with no installed face opt out explicitly **at that test
+  builder**: `ui_effect_names.rs:35` (the builder inside `harness()` at line 20, used by the
+  `zh-hans` tests at 68, 81, 107 and 127) and `ui_presets_folder.rs:40` (`ja`; the builder is inside
+  the test) use `Harness::builder().allow_missing_glyphs()` with a comment naming the script. No
+  global opt-out. Test fonts come from the workspace `egui/default_fonts` +
+  `monochrome_emoji_fonts` features (§5.1), not from `egui_kittest`'s non-propagating
+  dev-dependencies.
+- Headless text rendering is not proof of native font fallback/IME; native platform checks remain
+  (§8.7).
+
+### 5.5 Input, IME, clipboard and PRIMARY
+
+- `control.rs:371`: `Event::MouseWheel { …, source: egui::MouseWheelSource::Wheel }`; the same in
+  the 11 test constructions (§2.1). Use `Wheel`, not `Unknown`, so synthetic scrolls are not
+  treated like momentum/rubber-band input.
+- `viewer_text.rs:397-508` (custom text editor): handle stock
+  `egui::ImeEvent::DeleteSurrounding { before_chars, after_chars }` by converting the caret
+  position to a char range and issuing `text.delete { range, merge: <same key> }` before the
+  following `ImeEvent::Commit`, so replacement is one undo step. Native winit emits the fork's
+  `DeleteSurroundingBytes { before_bytes, after_bytes }` (E21/W26/W27); add that arm in the
+  language/IME stage, converting UTF-8 byte offsets at char boundaries via `TextDoc::text`,
+  `TextDoc::char_of_byte` and `TextDoc::byte_of` (`crates/keyframe/src/text_doc.rs:527-545`).
+  Regression: preedit + delete-surrounding + commit replaces exactly the intended characters and
+  adds one undo step; press-and-hold/dictation on macOS is verified manually (`W26`).
+- **Incoming composition lifecycle (viewer_text).** Each viewport stores
+  `ImeComposition::Active(owner)`, `TerminalPending(owner)` or `Stale`, where the owner is
+  `(layer, edit session)` and excludes caret, selection, text, revision and geometry. A target
+  switch or `text.endEdit` invalidates both live states; the `Stale` tombstone rejects every
+  pre-edit/delete/commit from the replaced owner. An empty pre-edit clears the visible composition
+  but records `TerminalPending(owner)`: the visible pre-edit ended, while its terminal commit or
+  delete-surrounding is still pending. A switch before that terminal event therefore still rejects
+  it rather than applying it to the replacement. A non-empty old pre-edit is treated as a continuing
+  update of that old composition and keeps the tombstone across arbitrary idle frames. A rejected
+  terminal commit is the composition boundary and consumes the tombstone immediately, so a new
+  pre-edit later in the same raw input batch is accepted for the current target. A rejected empty
+  pre-edit or delete-surrounding is only tentatively terminal: it keeps the tombstone through the
+  rest of the batch so a paired old commit is rejected too, and is consumed at batch end when no
+  commit follows. Tests must separate the late pre-edit from its commit/delete by at least three idle
+  frames, exercise an observed empty pre-edit followed by a target switch and a delayed old commit,
+  verify a new pre-edit after a rejected terminal commit in the same batch commits to the new
+  target, verify a genuinely new composition after the consumed terminal batch, and verify that no
+  permanent lock remains. Do not replace this with an elapsed-frame guard: time is not causal
+  ownership.
+- **E21b/P7b outgoing surrounding text (new prerequisite, not existing behaviour).**
+  Source inspection at the candidate revision found no call to winit's
+  `WindowExtWayland::set_ime_surrounding_text` anywhere under `egui-winit`, and `IMEOutput`
+  (`egui/src/data/output.rs:100-115`) has only purpose/rect/cursor rect/interrupt. Deletion and
+  commit handling alone therefore cannot pass the suite's surrounding-text contract.
+  - The fork adds a bounded transient `IMESurroundingText` payload to `IMEOutput` (logical text,
+    cursor/anchor as UTF-8 byte offsets, **owner/context generation identity**). It is built from
+    committed text only, excludes preedit, is skipped from debug/persistence output, and is per
+    IME-owning widget/viewport. The owner generation is present even when support is unavailable;
+    **available-empty is distinct from unavailable** and is sent as an explicit empty payload,
+    never as an absent one. Changing owner/support (normal, password, unavailable) clears the
+    backend cache and uses the protocol's committed disable/enable boundary; an empty text payload
+    is not a general clearing API.
+  - The **final completed pass** owns the outgoing value, including `None`: the adapter must not
+    use `ime.or(self.ime)`-style carry-over that can retain an earlier pass's text. `egui-winit`
+    calls W27 on text/selection/focus changes; per-window caching cannot bleed between widgets or
+    windows. The excerpt is at most 4,000 UTF-8 bytes cut at valid char boundaries. A selection
+    that cannot fit returns an explicit **unavailable** context (or an explicit empty one
+    when the document really is empty), never a truncated "complete" selection.
+  - A current-epoch `Done` whose protocol serial does not match still applies its incoming edits
+    **exactly once** and only defers outgoing surrounding state until a matching serial. A stale
+    (different owner/focus generation) batch is invalidated and discarded. Track focus epochs and
+    protocol serials separately.
+  - **No new document-sized allocation.** Building the new bounded payload must not clone the full
+    document; the baseline `TextEdit` already clones whole buffers for change detection/undo, and
+    that pre-existing cost is measured separately.
+  - **EffectCraft custom adapter (viewer_text).** The producer at `viewer_text.rs:568` must supply
+    the logical model text from the edited layer's `TextDoc` (committed text), not display-bidi
+    text, with preedit excluded (`viewer-text-preedit` stays a display-only temp value), plus the
+    editor's owner generation unconditionally. Convert `TextEdit.anchor/caret` (character
+    indices, `crates/engine/src/commands/text_edit.rs:18-40`) to UTF-8 bytes with
+    `TextDoc::byte_of`, clamp at char boundaries, excerpt to 4,000 bytes, and remap cursor/anchor
+    to the excerpt. Emit an explicit **empty** payload for an available empty document; emit
+    **unavailable** (and trigger the committed disable boundary) when there is no edit session,
+    when focus leaves the viewer, or after `text.endEdit`/Escape/click-away, so stale text cannot
+    survive. The editor has no password mode; the stock-field password/unavailable clears are
+    tested there. The payload is scoped to the viewport that owns the focused editor (floating
+    panel windows and the main window cannot share state).
+  - **Atomic compatibility.** `IMEOutput` loses `Copy` when the payload is owned. The P8 fork SHA,
+    all egui-family crates, the `craft-ui` revision and EffectCraft's single `IMEOutput` literal
+    (`viewer_text.rs:568`; there are no destructures in this repo) must change in one dependency
+    unit. Do not land a mixed stock/fork lock, and do not claim a stock-0.37 app build after this
+    stage: the literal would not compile against stock `IMEOutput` (§11.13).
+  - Tests: outgoing text immediately after delete+commit and deletion-only batches; scalar/
+    grapheme vs byte indices; supplementary emoji, combining marks and RTL logical order; preedit
+    exclusion and caret movement; long selection/excerpt limit and allocation bound; same-window
+    field switch; two windows; focus loss and late serial; current-epoch mismatched serial applies
+    incoming edits once and defers outgoing; stale-epoch discard; available-empty vs unavailable
+    and normal/password/unavailable transitions; final-pass `None` authoritative; multi-pass
+    final output; native Wayland Vietnamese/predictive IME protocol trace. macOS `NSRange`
+    conversion remains a separate W26 path; this does not claim new macOS surrounding-text APIs.
+- Clipboard: `eframe/clipboard` feature (§5.1). `ctx.copy_text`/`output.commands` paths at
+  `lib.rs:1600-1612`, `lib.rs:1946-1953`, `viewer_text.rs:413-430`, `menus.rs:1867-1906` and the macOS
+  `Hooks::clipboard_text` (`lib.rs:159-160`, `apps/effectcraft/src/main.rs:326`) stay unchanged.
+- **PRIMARY (E4 + W15P) is a native gate, not one manual row.** Upstream 0.37 fills PRIMARY from
+  `Label`/`TextEdit` selections and pastes on middle click (`#8428`); the reviewed fork replaces
+  the arboard fallback with a winit-owned PRIMARY path on the existing Wayland
+  connection/event queue, using SCTK 0.19.2's `PrimarySelectionManagerState` and per-seat
+  device/source/offer objects. Never create a second regular `wl_data_device`. `set_primary` /
+  `get_primary` route through it; password selections are never offered; an unchanged selection
+  does not reclaim ownership. Serial handling accepts keyboard **and** pointer press serials for
+  the focused seat with origin, freshness and epoch (do not invent a keyboard-only rule — the
+  protocol describes pointer-driven selection). **Claim the selection synchronously while the
+  triggering serial is fresh**; only serving the selection is asynchronous. Reads are bounded:
+  a 2 s total monotonic deadline, 16 MiB total bytes, at most 4 read workers and 2 writers with
+  a bounded queue of 8. A live owner-specific completion waker wakes the owning viewport after the
+  slot lock is released and never blocks the UI; canceled or stale results are discarded, and a
+  stale paste is canceled after focus/target/generation changes.
+  The native capability matrix in §8.7 covers wlroots/Hyprland, KWin and Mutter; ordinary paste is
+  not PRIMARY acceptance. An isolated PRIMARY-only fallback requires measured necessity and review.
+- Non-Latin layout shortcuts (E7/E19/W25): headless tests cannot exercise winit's mapping. Add a
+  manual row (Russian, Arabic, Hebrew) that checks Menu shortcuts and the timeline/Project Ctrl+C/V/X
+  paths, and keep `parse_shortcut` tests (`menus.rs:2229-2265`) as the app-level contract. Use a
+  non-clipboard held-key case (e.g. Ctrl+Z) as well, because clipboard shortcuts return before
+  emitting Key-down.
+
+### 5.6 Menus, popups and docking
+
+- `menus.rs:2025-2050`: keep `MenuBar::new().config(MenuConfig::new().style(menu_style)).ui(...)`;
+  0.37 keeps `MenuConfig` and adds `submenu_gap`. Regression tests: hover-switch between top-level
+  menus, arrow navigation (`menu_keys::Nav`), opening a submenu, Escape/outside-click closing, and
+  a menu command that acts on the focused `TextEdit`'s selection (`#8763`). That last case is P7c's
+  selected fix in the P8 revision, not an app workaround.
+- `menu_keys.rs:84`: scope id (see §5.2). `menu_keys` also uses `ui.is_sizing_pass()` for popup
+  sizing (already); keep and test that a sizing pass does not invoke a command twice.
+- Dock: the layout and drawing are app-owned (`dock.rs`, `dock_ui.rs`); only `craft_ui::docking`
+  actions are shared. Preserve panel order/nesting, clip rects, split sizes and IDs. 0.37's
+  "Panel/Scene clip rect respects parent" (`#8562`) needs a clip test for a maximized panel and an
+  embedded (web) floating panel.
+- Root Ui order (`lib.rs:1614-1723`): menu bar strip, header, dock body, native drop overlay,
+  mini flowchart, dialogs, ScriptUI windows, coach, import card, toast. There are no side
+  `Panel::left/top/...` calls; the dock is an explicit child Ui with computed rects. Keep that order
+  and nesting (it decides hover/layer order and clip rects). `CentralPanel` is used only inside
+  floating-panel and video-preview viewports (`dock_ui.rs:475`, `prefs_live.rs:207`).
+- Do not enable `Style::right_to_left` (E9); the dock and viewer are custom LTR geometry.
+
+### 5.7 Screenshots (control channel, kittest, hidden windows)
+
+Replace token-via-input-event correlation with the shared CL-2 completion slot (§3.3). Do not add an
+unbounded or app-local result channel: the slot is owned by the app request record, and the
+callback holds only a weak reference to it.
+
+```rust
+struct PendingShot {
+    token: u64,
+    path: Option<String>,
+    crop: Option<[f32; 4]>,          // logical points, as the control protocol already takes
+    reply: Sender<Value>,
+    deadline: f64,                   // app clock
+    admitted: (egui::Rect, f32, u64), // screen rect + ppp + geometry epoch at acceptance
+    issued: Option<(egui::Rect, f32, u64)>, // target-UI rect + ppp + geometry epoch at issuance
+    slot: Arc<capture::CompletionSlot>, // CL-2F helper type (API frozen)
+    reserved_bytes: usize,
+}
+```
+
+- **Admission.** Use the shared default policy: at most **4 outstanding requests**, **128 MiB per
+  image** and **256 MiB aggregate** reserved in-flight/completed bytes. Stricter app caps are
+  allowed, but never looser. Estimate the target surface with checked `width * height * 4` from the
+  known UI geometry, reject over-budget requests before issuing a capture with an actionable
+  reply, and revalidate the reservation at issuance. A post-callback size check alone does not
+  bound peak capture memory; the reservation does.
+- **Issue.** `ctx.request_screenshot(callback)` sends a viewport command that itself forces a
+  repaint, and a pending screenshot makes a hidden window take a full UI+paint pass. A screenshot
+  that is merely **queued and not yet issued**, and settling deadlines, must have `tick`/logic send
+  `RequestPaintWhileHidden` so the UI reaches issuance; do not add a second wants-paint request
+  once the screenshot command has been issued. At issuance record the target-UI logical
+  content/screen rect, ppp and a geometry epoch. That issued geometry + epoch, not callback
+  metadata, is bound to the image: the callback carries **only pixels**.
+- **Completion.** The app owns the strong slot and the owner-specific waker; the callback holds
+  only a weak reference, stores the image unless canceled/completed, takes the wake handle, drops
+  the slot lock, then requests the owning viewport's repaint. The callback does not wake itself and
+  must not strongly capture a `Context` or the app; that would create a cycle with the viewport's
+  queued command. `collect_screenshots` drains completed slots in `tick` and encodes/writes/replies
+  outside the callback.
+- **Geometry/scale binding.** With an **unchanged geometry epoch**, derive the pixel scale from
+  the returned image dimensions against the issued rect and verify aspect/rounding; the returned
+  image may be smaller when E2 surface fitting applies. **Any** intervening resize/DPI/zoom/surface
+  epoch change between admission, issuance and save cancels and retries the request — even if the
+  geometry later changes back before the save. Never crop with the admission-time, current or any
+  other ppp that disagrees with the issued epoch. Store admitted/issued/captured values and record
+  mismatches; an explicit error is correct when a retry cannot complete inside the deadline.
+- **Cancel/timeout/drop.** Removing the request record (timeout, close, app drop, caller drop)
+  marks its slot canceled under the lock; a late callback finds no live slot or a canceled one and
+  drops the image without a second reply or file write. Release the reserved bytes on every exit
+  path (completion, timeout, cancellation) and assert retained bytes return to zero after drain.
+- `save_screenshot` takes the actual scale/geometry instead of `&egui::Context`
+  (`control.rs:570-606`), so it can run in `tick`.
+- `issue_screenshots` (`lib.rs:1530-1558`) uses the tick's `now` and a settle deadline, not a
+  per-pass frame counter; `collect_screenshots` (`lib.rs:1560-1580`) becomes the slot drain.
+- Remove the "occluded/minimized" refusal at `lib.rs:1490-1498` for the native wgpu path only after
+  the platform run shows the screenshot request really produces a frame. The refusal exists because
+  0.36 never painted a hidden window; 0.37 makes a pending screenshot a wants-paint action
+  (`wgpu_integration.rs:680-690`, `egui-winit/src/lib.rs:2116-2128`). Keep the timeout error and
+  add `ui.focus` as the fallback. Record Windows/macOS/Linux results separately. Do not claim
+  hidden-window screenshots on a platform that was not tested. On web, eframe does not paint a
+  hidden tab (logic-only passes have no clipped primitives), so `ui.screenshot` on web requires a
+  visible tab; record that limitation.
+- Correlation tests: two concurrent screenshots with different crops; callback-once behavior; a
+  timed-out request followed by a late callback (no second reply, no file/PNG); shutdown/close with
+  a pending capture; aggregate byte-budget rejection; a resize/DPI change between admission,
+  issuance and completion (retry or explicit error, never a stale crop); a hidden-window capture on
+  native wgpu is a positive row (not a "missing RequestPaint" negative); retained bytes return to
+  zero; the app/Context can be dropped without the callback keeping it alive.
+- `docs/control-protocol.md:125-129` and the module docs at `control.rs:1-27` need the new wording
+  (no user-visible protocol change: `ui.screenshot` keeps its method and reply shape).
+
+### 5.8 Viewports and GPU
+
+- Floating panels (`dock_ui.rs:466-512`) use `show_viewport_immediate`; the video preview uses the
+  same (`prefs_live.rs:166-236`). Keep them inside `draw`. Persisted window rects
+  (`PanelWindow::sanitized`, `ui.panel_windows`) are unchanged.
+- **Hidden playback and child windows.** `show_viewport_immediate` children only update when the
+  parent runs a pass. If playback is playing while the root window is minimized/occluded, or a
+  floating panel/video preview is open, `tick` must keep `want_paint` set (and request a repaint at
+  the needed cadence) so the parent runs the forced hidden pass. Do not rely on the one-shot
+  open/close command mitigation alone. Test a minimized-window playback with the Video Preview open
+  and with a floated panel, asserting the child content advances and the parent does not thrash.
+- 0.37's `#8748` (a hidden parent does not update deferred children) is carried as P7c's selected
+  fix in the final P8 revision; verify it in the hidden-playback test. Independently, a command that
+  opens/closes/floats a panel or video preview also sets `want_paint`, and playback keeps the pass
+  cadence, so the app does not depend on one mechanism alone.
+- GPU: `egui_wgpu::Renderer`'s
+  `register_native_texture_with_sampler_options`, `update_egui_texture_from_wgpu_texture_with_sampler_options`
+  and `free_texture` are unchanged in 0.37 (`renderer.rs:790-930`), so `viewers.rs:150-210` needs no
+  API change. `RenderState`/`Frame::wgpu_render_state` are unchanged. Keep E2+E3. The existing
+  `ui_gpu.rs` GPU-vs-CPU tolerance (at most 0.3% of pixels differ by more than 1/255, worst channel
+  difference ≤4) stays.
+- **A skipped GPU test is not evidence.** `ui_gpu.rs` returns early when
+  `effectcraft_gpu::Gpu::headless()` finds no adapter (`tests/ui_gpu.rs:44-47`) or when egui-wgpu's
+  GL device has WebGL2 limits (`tests/ui_gpu.rs:62-65`). For the GPU acceptance row run with a
+  required adapter, assert `gpu_adapter().is_some()`, and record adapter/backend/driver and the
+  exact test invocation. The planning host exposes an i915 render node (`/dev/dri/renderD128`) with
+  no display session; that can qualify a headless wgpu adapter run, not presentation.
+- Device loss must be handled from `tick` (see §4.2); the `ui()` early return currently means a
+  device lost while hidden is not acted on (`lib.rs:1905-1910`). Add a logic-only test that a
+  reported failure closes the window and keeps the auto-save.
+- 0.37 `Frame::set_wgpu_surface_config` is fixed (`#8442`); EffectCraft does not use it. Do not add it
+  as part of this migration.
+
+### 5.9 Language and screen readers (fork-only stage)
+
+When `craft-libs#198`'s fork APIs are accepted:
+
+- In the app tick, after `i18n::set_current(language)`, call
+  `ctx.set_language(Some(language.to_string()))` (fork E17) and, where an `eframe::Frame` is
+  available, `frame.set_ui_language(Some(language))` (fork E18). This sets the AccessKit root
+  language and widget text layout language. It does not change the app's catalogs.
+- Assert `ctx.language()` follows the interface language, the AccessKit root node carries the
+  language, and a `TextEdit`'s text is shaped with the UI language (CJK glyph choice where fonts
+  are installed). Tests that need the fork API are marked fork-required in their module docs.
+- Keep the app LTR (`Style::right_to_left` unset). Text-layer RTL remains `effectcraft-text`'s
+  contract; UI-label bidi is epaint's.
+- The E17/E18 policy sub-stage is optional and separately revertable. The production app already
+  requires the final fork and E21b from P1; a stock-0.37 control uses a separate minimal adapter
+  and is not obtained merely by reverting P4 (§11.13).
+
+## 6. Dependency topology, publication reachability and rollback
+
+Intended graph (final reviewed storytold revisions; names shown for structure):
+
+```text
+effectcraft / effectcraft-web / effectcraft-cli
+  -> effectcraft-ui-egui -> craft-ui (craft-libs rev with CL-1 + CL-2F)
+                          -> egui 0.37.0 (git <final storytold egui P8 SHA, incl E21b/P7c>)
+                             -> epaint, epaint_default_fonts, ecolor, emath (same git rev)
+                             -> eframe, egui-wgpu, egui-winit (same git rev)
+                             -> accesskit 0.25.1, kittest 0.5.0
+                             -> winit 0.30.13 (git <final storytold winit SHA, incl W15P>)
+  -> winit (direct, same git rev)
+```
+
+- Every egui-family crate EffectCraft resolves must come from the same git revision. `cargo tree -d`
+  must show no second egui family, and `cargo tree -i winit@0.30.13` exactly one source.
+- Publication: EffectCraft is an application, so a git egui/winit dependency is acceptable in its
+  lock, but no branch names, no `path` patches and no machine-local checkout may appear in a
+  publication branch. The `aiongg` candidate SHAs are comparison inputs and must not appear in a
+  publication lock. `craft-libs` consumers keep their own patches; the app's `[patch.crates-io]`
+  is the supported place for the suite fork.
+- A clean checkout must fetch every final approved revision and pass `cargo check --locked` and
+  `cargo test --locked` without local overrides; record that proof with the lock.
+- Rollback: keep the exact baseline lock (egui family 0.36.2, craft-ui `5c874d51`, winit registry
+  0.30.13) in the task evidence. The project file format, command ids, undo model, workspace-state
+  **version 1** and the GPU compositor are unchanged by this migration, so rollback is a revert of
+  the pin/refactor commits, with no data migration. Do not persist any 0.37-only preference until
+  the final stage, so an older build ignores nothing it cannot read.
+- `examples/plugins/posterize-bands` is a separate workspace with its own lock and no egui; do not
+  edit it. `craft-pdf`/`hayro-syntax` and the filmcraft pins are unrelated and stay.
+- There are no vendored crates in this repository (`vendor/` absent); the only patch is the
+  craft-libs `hayro-syntax` entry. Do not delete it, and do not "clean up" the commented filmcraft
+  path patch by enabling it.
+
+## 7. Command, undo, save/reopen contracts
+
+Nothing in the egui bump may change these:
+
+- Every gesture still routes through `effectcraft_engine::Session::execute` or `menus::invoke`
+  (`lib.rs:1-6`, `control.rs:1-19`); UI-local state must not become the source of truth.
+- One gesture = one undo step: existing tests such as `ui_viewer.rs:2263` (fit/zoom),
+  `ui_viewer.rs:2306` (rotate), `ui_project_delete.rs`, `ui_timeline_trim.rs` and `ui_keyframes.rs`
+  stay green.
+  `Session::history.merge_key` is reset when a numeric scrub ends (`lib.rs:1866-1867`,
+  `pointer_wrap.rs:31-36`).
+- Save/reopen: `.ecproj` JSON contains no egui types; save, reopen and pixel-compare a comp after a
+  UI edit. Workspace state (`workspaces.json`, **version 1**, `workspace_state.rs:37-40,85-88`)
+  contains `PanelKind`, rects and floats, not egui ids; save, restart and restore the dock/floating/
+  window layout. If a new field is ever required, specify an explicit version bump, a migration and
+  a backward-compatible reader test; do not silently reuse version 1.
+- Multi-pass must not duplicate a command, an undo step, an autosave write or a close prompt
+  (§4.4, §8.3).
+- **Auto-save while hidden has two owners today.** Project auto-save/recovery already runs from
+  `tick`; the workspace-layout autosave is still in `draw` (`lib.rs:1715-1722`, gated on
+  `!ptr.any_down()` and `workspace_store.due(now)`). P2 moves its due check and write to `tick`
+  using the app clock and the last pointer-down state observed in `draw`. Only then does the
+  hidden claim cover both kinds; the close guard and crash recovery remain tick-owned. §8.3's
+  test asserts both writes while hidden.
+
+## 8. Tests and acceptance
+
+### 8.1 Repository gates
+
+Every stage runs the repository gates (through the server job workflow, never directly from the
+planning task): `cargo fmt --check`, `cargo clippy --workspace --all-targets --release -- -D warnings`,
+`cargo test --workspace --release`, `cargo xtask layers`, `cargo xtask assets`, `cargo xtask wasm`,
+plus `node apps/effectcraft-web/tests/{workers,page,storage}.mjs` (no build needed).
+On every dependency stage also run `cargo check --locked`, `cargo test --locked`,
+`cargo tree -d`, the family/winit inverse trees and the wasm-target `wasm-bindgen` tree on a clean
+checkout. `cargo xtask ci` is the final gate.
+
+### 8.2 Compile and API contract
+
+- The 15 errors and 602 warnings above are gone, with no `#[allow(deprecated)]` added to production
+  code.
+- Grep gates must use precise patterns:
+  ```sh
+  git grep -nP '\bId::new\(' -- '*.rs'                          # only comments/none
+  git grep -n 'WidgetType\|AtomLayoutResponse\|\.vertical_align(' -- crates apps
+  git grep -n 'with_accessibility_check(false)' -- crates apps     # must be empty at every stage
+  ```
+  The old `grep -rn "Id::new"` also matches `GlyphId::new` in `crates/text`/`crates/pdf` (7 lines)
+  and can never return "none"; `\bId::new\(` does not match inside `GlyphId`.
+- `ui_agent_audit.rs:73` uses `WidgetInfo.role` (`typ` is gone); all tests construct `MouseWheel`
+  with `source`.
+- Tests for `Id::unique` stability and for the role mapping table.
+
+### 8.3 Lifecycle, hidden windows and multi-pass
+
+New tests (headless, `Context::run_logic` + `run_ui`, no GPU). The driver must mirror the real
+eframe order: `raw_input_hook`-equivalent (`feed_synthetic`) → `run_logic` → retain the mutated raw
+input → next `run_ui`, and it must not replay input events from `tick`. Use `AppClock::manual()`:
+
+1. `logic_only_drains_control_and_jobs`: a control request that only needs `tick` (e.g.
+   `engine.execute` of a non-UI command) gets its reply with zero `run_ui` calls; `poll_render`
+   completes a render job and the Toast/event is drained. Advance the manual clock between ticks.
+2. `logic_only_feeds_synthetic_and_forces_one_paint`: with the root viewport marked
+   `minimized: Some(true)` (so `visible() == Some(false)`), a queued `ui.click` is fed by the hook
+   during a logic-only tick; the tick emits `RequestPaintWhileHidden` and sends **no** reply. A
+   second logic-only tick does **not** feed another event while the first is still unapplied. The
+   following forced `run_ui` sequence (still minimized) consumes one pointer event per pass, applies
+   the buffered gesture exactly once and replies exactly once after the final pass. The same test
+   asserts that the forced passes are not gated on `visible()` and that no event was dropped.
+3. `after_input_replies_only_after_a_paint`: same, and assert the command's effect exists before
+   the reply is sent; force a discard on that pass and show the reply still waits for the final
+   non-discarded pass.
+4. `forced_hidden_pass_applies_buffered_gesture`: feed during a logic-only tick, run forced full
+   passes until `synthetic` is drained, and assert exactly one command and one undo step (no
+   duplicate from the logic-only call).
+5. `playback_advances_without_a_paint`: with a viewer scale recorded and the manual clock, hidden
+   ticks advance `session.time` within the preview step and do not duplicate `Playback.frame_shown`;
+   audio is started once (stub `audio_device`); a stale `ctx.input(|i| i.time)` cannot satisfy a
+   deadline.
+6. `autosave_and_close_guard_run_while_hidden`: project auto-save and the moved workspace-layout
+   autosave both write in logic-only ticks; a hidden close request opens the unsaved dialog and
+   sends `CancelClose`.
+7. `discarded_pass_is_idempotent`: force `ctx.request_discard` (or show a first-time `Grid`) while
+   performing one command, one drag and one auto-save; assert one command execution, one undo step,
+   one file write.
+8. `device_loss_while_hidden_closes_and_saves`: bridge a failure during a logic-only tick; assert
+   the close command and the auto-save, as in `lib.rs:2040-2075`.
+9. `hidden_playback_keeps_child_viewports`: with playback playing and a Video Preview or floating
+   panel open, hidden ticks keep requesting a pass and the child content advances (§5.8).
+10. Screenshot-slot tests from §5.7 (concurrency, cancellation, late callback, resize/DPI including
+    a change back, byte budget, shutdown).
+11. `repeated_logic_only_ticks_do_not_collapse_a_gesture`: queue a `ui.click` and a `ui.drag`, run
+    several logic-only ticks (mirroring eframe's overdue `RedrawRequested` and 100 ms invisible
+    throttle) while the root viewport stays minimized, and assert the hook fed at most the one
+    unapplied event; then run forced full passes and assert press/move/release each reached a
+    separate pass, exactly one click/drag command and one undo step resulted, and no event was
+    dropped. Repeat for a click followed immediately by a drag.
+
+### 8.4 Screen geometry, pixels and accessibility
+
+- Fixtures: the built-in demo project (`file.openDemoProject`) for visual states, the generated
+  `engine::perf::large_project` for scale/perf, and the bundled Inter/JetBrains Mono fonts. No
+  external media is needed for UI geometry/accessibility/pixel tests; media-dependent tests keep
+  their existing generated fixtures.
+- Geometry/hit tests (existing helpers, automation rects): viewer comp rect and fit at 1.0/1.25/1.5/
+  2.0 ppp; dock split resize; tab drag and overflow; floating panel window (native only; embedded
+  web path separate); menu item click at a label; timeline row heights (`ui_parameter_spacing.rs`
+  keeps 20/19 px); panel order/nesting after maximize/restore.
+- Double-click paths: 24 `double_clicked()` call sites (27 textual `double_click` occurrences
+  including the Timeline helper, e.g. project rename `project.rs:783,832,1036`, Timeline
+  `timeline.rs:1502,2116,2325,2516,2876,3529`, Flowchart `flowchart.rs:360`): 0.37 changed
+  double/triple-click classification (`#7915`). Assert one double-click performs exactly one action
+  and does not also fire a triple-click path.
+- **Visual review harness — correct the claim and extend it.** Today
+  `crates/ui-egui/tests/ui_visual_review.rs` (`UI_REVIEW_DIR`, `#[ignore]`) captures the workspace
+  in light and dark, but every `PanelKind::ALL` panel and the About/New Comp/Settings/Shortcuts/
+  Command Palette dialogs only in **dark**, at the harness default ppp 1.0, at wide 1600×1000 and
+  compact 1024×768 (`ui_visual_review.rs:13-48`). Extend it to capture every panel and dialog in
+  **both themes at ppp 1.0 and 2.0** (four combinations per state, both sizes), then use it on the
+  baseline and every stage. This is the primary before/after visual record; the golden set below is
+  the automated subset. Record that the ignored test actually ran; an ignored/absent capture is not
+  evidence.
+- Pixel comparisons: choose one of
+  - `egui_kittest` `snapshot` goldens (enable the `snapshot` feature, add `kittest.toml` with
+    `threshold` per OS, commit a small fixed set of PNGs under `crates/ui-egui/tests/snapshots/`
+    **with `.attribution` sidecars and `ATTRIBUTION.md` rows**, because the repository's asset rule
+    applies even to screenshots); or
+  - an app-owned tolerant compare against RGBA hashes stored in a Rust constant, with the same
+    tolerance policy and no image assets.
+  Exact selected set: five states — Standard workspace (demo, time 2 s), Timeline maximized with
+  rows open, Project panel with folders open, a menu open, and the Settings dialog — each in
+  **light and dark at ppp 1.0 and 2.0** (20 captures), not a single dark/default-scale set.
+  Threshold: max channel delta 2/255, ≤0.1% failed pixels on Linux/Windows, 3/255 on macOS (if any
+  platform-specific rasterization is observed); no tolerance for geometry rects. Never accept a new
+  golden automatically; a changed golden needs a reasoned explanation in the PR.
+- Mutation check (required, recorded as evidence, not committed as a test): nudge `Tokens::focus` or
+  a panel width by a visible amount behind an env flag and show that the pixel/geometry test fails
+  with the expected diff; restore. This proves the assertions detect change.
+- Accessibility: **strict checks throughout**; `Harness::unnamed_widgets()` empty for the workspace,
+  for each panel maximized, for every dialog in `Dialog`, and for the Home/Media Browser/Effect
+  Controls/Properties/Timeline panels. Role contract tests for color well, tab + selected, splitter,
+  tree item, text input, spin button, slider and a checked menu item. `Role::Button` + `selected` for
+  selectable labels. Read-only fields are exempt by kittest. The repo-wide grep gate in §8.2 proves
+  no global/per-builder accessibility opt-out remains.
+- Glyph coverage: the extended chrome symbol test (§5.4); `ui_effect_names.rs:35` and
+  `ui_presets_folder.rs:40` use `allow_missing_glyphs()` with a comment. No global glyph opt-out.
+- `ui_gpu.rs` and `ui_visual_review.rs` are skip/ignore-capable: the acceptance record must name the
+  exact invocation and show they actually ran. A skipped GPU test is not GPU evidence (§5.8).
+- Screenshot tests (§5.7) and IME/adapter tests (§5.5).
+
+### 8.5 Save/reopen and command/undo workflows
+
+- UI edit → save `.ecproj` → reopen in a fresh `EffectcraftApp` → project JSON equal and viewer
+  pixels equal; undo/redo across the save still works.
+- Dock/floating/panel-window layout → save workspace → restart → restored; maximize/restore and
+  split sizes unchanged.
+- One command from the menu, one from the control channel and one from a synthetic click each
+  produce one undo step; a discarded pass does not add another.
+
+### 8.6 Web workflow
+
+- `cargo xtask wasm` (all L0–L4 + ui-egui + web) and `cargo xtask web --serve 8765`.
+- `node apps/effectcraft-web/tests/smoke.mjs --url http://127.0.0.1:8765/ --out <evidence>`:
+  WebGPU/GPU-compositor path, viewer, `render.frame`, Render Queue downloads, background worker
+  event-loop gaps (<400 ms), AudioContext, save/reopen, persistence across reload, offline service
+  worker. Also `workers.mjs`, `page.mjs`, `storage.mjs`.
+- Browser screenshots come from CDP (`smoke.mjs:113`), independent of the egui screenshot API; add
+  a page-side check only for the in-app `window.effectcraft.request("ui.screenshot", …)` reply shape
+  when the tab is visible. A hidden web tab cannot paint (logic-only passes carry no clipped
+  primitives), so `ui.screenshot` on web is a visible-tab feature; record it.
+- Web is a separate feature set: no OS clipboard/PRIMARY, no system fonts, embedded viewports.
+- **Hidden-tab behaviour, realistically.** Upstream 0.37's web runner already falls back from
+  `requestAnimationFrame` to `setTimeout(10 ms)` when `document.hidden()`
+  (`eframe/src/web/web_runner.rs:238-279`), so `AppRunner::logic` keeps running with logic-only
+  passes and the browser clamps background timers to roughly one second (long-backgrounded Chrome
+  may throttle further). Assert that the session snapshot's timestamp advances across the hidden
+  period at the browser's actual cadence, that frame workers keep completing within that allowance,
+  and that the viewport is fully refreshed when the tab returns. Record the browser, visibility
+  transition and measured cadence; do not require exactly 1 s and do not add a new worker/timer
+  scheduler or page-independent persistence feature in this migration. Fix `WebApp::logic` to pass
+  the app clock (`self.app.now()`) to `persist::snapshot`, not `ctx.input(|i| i.time)` (which is
+  stale in a logic-only pass).
+
+### 8.7 Native platform matrix
+
+| Row | Required evidence |
+| --- | --- |
+| Linux headless wgpu (this server) | `ui_gpu.rs` with a **required** adapter on the i915 render node (`/dev/dri/renderD128`, no display session): assert `gpu_adapter().is_some()`, record adapter/backend/driver and the exact command. This qualifies a headless GPU-compositor run only, not native presentation. |
+| Linux X11 | Native window under **Xvfb + a real window manager** (e.g. openbox) **+ an X11 input method** (e.g. ibus/fcitx): screenshot, save/reopen, floating panel window, focus/menu/close/auto-save, clipboard and PRIMARY between windows, X11 IME (Vietnamese/Japanese) with editor/undo checks. Record Xvfb/WM/IME versions and that the session is virtual and not composited. This can qualify the X11 parts; it cannot qualify a physical GPU or Wayland. |
+| Linux Wayland | Requires a real compositor; unresolved unless a managed environment is provided. Run the E4/W15P PRIMARY **native capability matrix** on wlroots/Hyprland, KWin and Mutter: protocol availability, keyboard focus, keyboard and pointer-selection serial freshness, owner/seat change, empty/absent offers, self-paste, slow/canceled transfer, password exclusion, unchanged-selection reclaim, and no second regular data device (protocol trace). Also trace text-input-v3 current-epoch mismatched `Done` (incoming applied once, outgoing deferred), stale-epoch discard, and disable/enable on owner/support changes. Record unsupported capabilities honestly; do not substitute X11/arboard results. |
+| Windows (`craft-windows` clone, separate task) | real native build/test, GUI launch, screenshots, menu/close/auto-save, clipboard, IME, DX12 pipeline startup timing, mixed-DPI window placement, and a held Ctrl+Z release after a layout switch; Basic Render Driver is software and must be reported as such. |
+| macOS | **unresolved gate** unless real hardware evidence is provided: press-and-hold/dictation and surrounding-text NSRange (`W26`), Command-key shortcuts, traffic-light/titlebar placement, screenshots while occluded. |
+| FreeBSD / Nix / Windows ARM64 | CI workflows are reusable `craft-common-actions`; run after the pin lands and report only what the runners provide (FreeBSD nightly, ARM64 MSI on schedule). |
+
+Headless kittest is not evidence for native focus, IME, file pickers, clipboard, PRIMARY or GPU
+presentation. Physical-GPU and Wayland rows remain explicit unresolved gates until measured.
+
+### 8.8 Known upstream regressions as acceptance gates
+
+- `#8731` (text tessellation, reported +61% instructions for plain text): measure with the paired
+  text-heavy operations (workspace, timeline, project) and the raw `tessellate` instruction count
+  where possible. This measurement belongs to the pre-P1 gate. If the median regression is above
+  threshold, the row-wise fix (provenance, test, removal condition) must be in the reviewed P8
+  revision before P1 is frozen, or the migration is blocked. P5 may not add it afterwards.
+- `#8736` (DX12 pipeline creation, reported ~40 ms): measure Windows startup and first-frame cost
+  separately for the DX12 backend. If it pushes startup over threshold, the fix must be in P8 before
+  P1 or accepted with an explicit owner decision and the measurement; P5 only re-reports it.
+- `#8512` (system font startup cost): keep `system_fonts` off and record font-install/discovery
+  time in the startup row so a later color-emoji decision has a baseline.
+- `#8489`/`#8583`/`#8601`/`#8589` are handled by this plan's refactors.
+
+## 9. Performance plan
+
+### 9.1 Baseline before production changes
+
+Add instrumentation first (stage B0, no behaviour change): raw samples per operation, p50/p95/p99,
+the number of **final** paint passes and discarded passes (`Context::will_discard()` at the end of
+`draw`), texture-upload bytes per frame from `FullOutput.textures_delta`, logic-only tick time,
+startup-to-first-frame and font-install/load time, and an optional counting global allocator in
+`effectcraft-cli` for `bench --ops` (byte counts per operation). Record raw and compressed
+`effectcraft-web` `.wasm` sizes. `Measure` gains `samples`, `median`, `p95`, `p99`, `cpu_ms`;
+existing names and JSON fields stay. Then run the **B0-instrumented** baseline: commit `9581b53c`
++ the instrumentation patch, with its patch SHA and the 0.36.2 lock recorded. The baseline identity
+is B0-instrumented `9581b53c`, not the bare commit. The same instrumentation is applied to the
+candidate so both sides are measured identically.
+
+### 9.2 Matched operations
+
+| Operation | Command / driver | Sample rule |
+| --- | --- | --- |
+| Startup to first frame | `bench --ops --json` `startupToFirstFrame`; native log "first frame drawn" | ≥20 fresh processes per source/lock; same large project, fonts, window 1680×1020 |
+| Steady workspace frame | `workspaceFrame` | ≥10 warmups, ≥30 timed iterations per session, 3 sessions |
+| Timeline scroll / open rows | `timelineScrollFrame`, `timelineOpenFrame` | 5,000 layers, every 10th open; ≥30 iterations |
+| Project panel scroll | `projectPanelFrame` | all folders open; ≥30 iterations |
+| Menu open / dock resize / typing | new `menuOpenFrame`, `dockResizeFrame`, `textTypingFrame` | fixed input scripts; ≥30 iterations |
+| Frame distributions | scripted workspace/timeline/typing loop or native playback | **≥1,000 actual final paint passes per row**; record discarded passes and dropped frames; p50/p95/p99 only with ≥1,000 |
+| Logic-only tick | new `logicOnlyTick` | 1,000 `run_logic` ticks, idle queues; asserts no paint work |
+| Idle repaint rate | new `idleRepaints60s` using `Context::set_repaint_observer` | virtual 60 s; count causes |
+| Playback | native preview long enough for ≥1,000 presented frames (e.g. 20 s at 60 fps, or repeated 10 s segments with a fresh start) | actual pass count, dropped frames, audio clock; `ui.inspect.fps` is a smoothed readout, not a distribution |
+| Texture uploads | bytes/frame from `textures_delta` | viewer frame and thumbnails |
+| Allocations | counting allocator totals per op | optional but recorded |
+| Font startup (`#8512`) | cold start with system-font provider off; record font discovery/install/load | ≥20 fresh processes; part of startup evidence |
+| WASM size | `cargo xtask wasm` artifact | raw and gzip/brotli sizes, baseline vs candidate; accept a budget or make emoji fonts native-only |
+| Engine control | `cargo xtask bench --quick --repeat 5` | guards accidental engine/render drift |
+| GPU vs software | same UI ops with llvmpipe/software GL and a required hardware adapter where present; Windows Basic Render Driver separately | separate tables, never merged |
+
+### 9.3 Environment and protocol
+
+Record: CPU/GPU model, RAM, OS, driver, display scale, window size, renderer backend, release
+profile, exact commit/SHA/lock/craft-ui/egui/winit revisions, font set, fixture project SHA, and
+load average. Every row uses **≥10 warmups** and **≥30 timed iterations** for steady operations,
+**≥20 fresh processes** for startup, and **≥1,000 actual final paint passes** for a frame
+distribution. Report the exact frame counts, discarded passes, dropped frames, audio underruns, raw
+samples, median/p50, p95 and p99; do not report a p99 from 30/90 samples. Measure peak RSS
+(`/usr/bin/time -v` or `-l`) and idle CPU (60 s); use `perf stat -e instructions:u,cycles:u` where
+available. Use `cpu_time`/instructions and wall time; on a shared host, wall time is secondary.
+Software renderers and physical GPUs are separate tables.
+
+Predefined thresholds (owner sign-off required to widen):
+
+- steady/scroll/project/typing median ≤ +5%, p95 ≤ +10%;
+- startup median ≤ +5%, p95 ≤ +10%, using the shared small-operation noise floor;
+- logic-only tick median ≤ 0.5 ms and p99 ≤ 2 ms on the large project (no paint work);
+- idle repaint count ≤ baseline per minute; no new recurring repaint while idle;
+- texture upload bytes per steady frame ≤ +10%;
+- peak RSS ≤ +5%; record absolute MiB as well; no automatic absolute-size exemption;
+- engine render benchmark (`cargo xtask bench`) within its own noise band; no regression;
+- text tessellation (`#8731`) and DX12 startup (`#8736`) are reported as their own rows and must
+  meet the same median/p95 or be fixed/accepted explicitly.
+
+Noise policy: run the unchanged 0.36.2 build twice as a control. The first report must also run
+**stock egui 0.37.0** as the required upstream-equivalence measurement control (not a production
+pin), and report regressions only against these controls. If control spread prevents resolving the
+shared thresholds, report inconclusive and rerun under quieter conditions; never widen a threshold
+automatically. If a regression exceeds the gate, re-run paired 3× and profile;
+never update a golden or baseline to hide it. A changed pixel golden is a reported visual change
+with a reason, not a performance result. No performance number is claimed by this document; the
+thresholds are proposals to be validated by paired runs on recorded hardware.
+
+## 10. Staged implementation PRs
+
+Dependency DAG: `B0 → P1 → P2 → P3 → P4 → P5`. P1 waits for the complete reviewed/published
+storytold egui **P8** (E1–E21, P2b async W15P routing, P7 held-key pairing, P7b/E21b, P7c's
+selected `#8763`/`#8748` fixes and any justified `#8731`/`#8736` perf fix), the completed winit
+(W1–W27, W15P, W27 lifecycle), and craft-libs CL-1 and CL-2F after its DesignCraft/GridCraft
+pilots. P1 includes the compatible `IMEOutput` producer and all required fork API adaptations.
+There is no stock or intermediate-fork production stage. If a consumer already has an
+incompatible craft-ui/egui bump, it must be reconciled in this same atomic stage. P4 adds native
+language/platform evidence and optional language UI policy; reverting it never removes the P1
+compatibility adapter. P5 is measurement/docs only and requires final platform and performance
+acceptance.
+
+| Stage | Scope | Validation | Rollback |
+| --- | --- | --- | --- |
+| **B0** | Bench instrumentation only: samples/percentiles, final/discarded pass counters, logic-only tick, repaint observer, texture-byte counter, font-startup and WASM sizes, optional allocator; baseline run on B0-instrumented `9581b53c` (record patch SHA and lock) | `bench --ops --json` raw evidence; no behaviour change; gates | revert commit; baseline evidence retained |
+| **P1** | Final reviewed storytold dependency pins (complete egui P8: E1–E21 + P2b + P7 + P7b/E21b + P7c `#8763`/`#8748` + justified perf fixes; completed winit W1–W27 + W15P and W27 lifecycle fixes; craft-ui with CL-1 + CL-2F), including the viewer_text surrounding-text adapter and compatible `IMEOutput` literal, feature `clipboard`, `default_fonts` + `monochrome_emoji_fonts`; mechanical API migration (IDs, roles, `Ui::scope_id`, `Atom`/`IdSalt`, font bytes, `TextEdit::align`, `MouseWheelSource`, screenshot callback via the CL-2F slot, test `Event`s); **actual strict kittest accessibility names and glyph fixes** until all tests pass with `check_accessibility: true` and missing-glyph `Panic`, with `allow_missing_glyphs` only on the two named script tests. No `with_accessibility_check(false)` anywhere. | `cargo xtask ci`; `cargo check/test --locked`; `cargo tree -d`; one-family/one-winit and wasm-target checks; all tests compile and pass | revert P1: restores the 0.36.2 lock; no data changes |
+| **P2** | Lifecycle: `tick`/`draw` split, injected app clock, focus, polls/playback/audio/project and workspace-layout autosave/events in tick, hidden `RequestPaintWhileHidden` (including queued screenshots, settling and playback/child viewports), synthetic-input generation guard, input-waiter ordering after draw, close guard, screenshot scheduling ownership | §8.3 tests; native hidden/minimized manual check; benchmark logic-only/idle | revert P2: returns work to `ui`; behaviour-only, no data |
+| **P3** | Accessibility completion (custom roles/names), glyph coverage, extended light/dark × 1.0/2.0 visual harness, geometry/pixel tests, style/visual adjustments if the tests show unintended movement | §8.4 tests, `cargo xtask assets` (only if PNG goldens), a required-adapter `ui_gpu.rs` run | revert P3: tests and names only (except any visual fix, which is isolated) |
+| **P4** | Extended language/platform qualification: `set_language`/`set_ui_language` policy where applicable, RTL UI-label tests, PRIMARY native capability matrix, clipboard/non-Latin shortcut and native IME rows. E21b/`IMEOutput` compatibility is already part of P1. | fork-required tests and native matrix using the same coherent dependency unit | revert P4 policy/test additions; retain P1 final pins and required adapters |
+| **P5** | Performance acceptance and re-measurement of the unchanged P1 dependency unit (no new fork commit), docs (`docs/architecture.md:359` still says 0.36.2; `docs/control-protocol.md` screenshots; `docs/testing.md` UI perf), final evidence. Any `#8731`/`#8736` fix must already be in the reviewed P8 pin from P1. | paired benchmark report with raw samples, frame counts, thresholds, stock-0.37 control, platform rows, unresolved gates | revert P5: docs/report only; no dependency or state change |
+
+Each stage is a separate reviewable PR with its own exact source/lock identity, validation log and
+screenshots. No stage pushes, opens a PR or publishes without fresh human approval of the exact
+content and validation.
+
+Compatibility checks after P1 and each later stage:
+
+```sh
+cargo tree -d
+cargo tree -i egui@0.37.0
+cargo tree -i winit@0.30.13
+cargo tree -i wasm-bindgen --target wasm32-unknown-unknown
+cargo check --locked
+cargo test --locked
+git grep -n 'path *= *"/' -- Cargo.toml crates apps   # must be empty
+git grep -n 'branch *=' -- Cargo.toml                 # must be empty in publication
+git grep -n 'aiongg' -- Cargo.toml Cargo.lock         # must be empty in publication
+git grep -n 'with_accessibility_check(false)' -- crates apps # must be empty
+```
+
+## 11. Blocking unknowns and decisions
+
+1. **Final storytold egui/winit SHAs.** The candidate `aiongg` revisions are comparison inputs only.
+   Production waits for the approved, published implementation: a storytold egui **P8** SHA with
+   E1–E21 + P2b + P7 + P7b/E21b + P7c's selected `#8763`/`#8748` fixes + any justified
+   `#8731`/`#8736` fix, and a completed storytold winit SHA with W1–W27 + W15P and the W27
+   lifecycle fixes. Both must be reachable, immutable and fetchable with `--locked`.
+2. **craft-libs PR 199 base.** The implementation starts from merged PR 199 at
+   `3832c47ef68a0e6214f2c1e85f3526b6adcb686e`; historical `8614e4a`/`1764bca` on old `main`
+   `4919088` and the stale `b68de8c`/`ec8840a` trees must not be merged. The final immutable
+   craft-ui revision must keep registry `egui 0.37` and include CL-1 plus CL-2F.
+3. **CL-2F.** EffectCraft requires the approved craft-ui slot helper at the CL-2F freeze in the
+   same atomic stage as P1; only the Design/Grid pilots use the provisional CL-2 revision. If
+   CL-2F slips, P1 cannot claim screenshot completion done; no app-local channel or unbounded
+   queue is an acceptable substitute.
+4. **E21b/P7b coordination.** The egui `IMEOutput` payload and the egui-winit W27 adapter must land
+   atomically with the custom-editor adapters; the stock/fork `IMEOutput` shape cannot be mixed.
+5. **`#8731` fix availability.** If text tessellation regresses over threshold, the fix belongs in
+   the reviewed P8 revision before P1 (with provenance/test) or the migration is blocked; P5 cannot
+   change the pin.
+6. **`#8736` Windows startup cost.** Measure before P1; include the fix in P8 or record an explicit
+   owner acceptance. P5 re-reports it.
+7. **`monochrome_emoji_fonts` / `system_fonts` / WASM size.** The plan requires
+   `monochrome_emoji_fonts` to preserve `✔`/`▣` and 0.36 parity. Measure the web raw/compressed
+   size; accept a budget or add a native-only emoji-fonts feature. Enabling colour emoji via
+   `system_fonts` is a separate decision with startup (`#8512`) and determinism costs.
+8. **Pixel golden storage.** Committed PNGs require `.attribution` sidecars and `ATTRIBUTION.md`
+   rows under the repository asset rule; if maintainers reject committed screenshots, use the
+   hash-based tolerant comparison instead. Both need the same tolerance policy and the exact
+   light/dark × 1.0/2.0 set.
+9. **macOS evidence.** No macOS hardware is available to this task; the macOS gate (IME/NSRange,
+   Command keys, title bar, hidden screenshots) remains unresolved until real evidence exists.
+10. **Windows evidence.** Requires a `craft-windows` clone and the task workflow; the Basic Render
+    Driver is software and cannot stand in for a real GPU result.
+11. **Linux Wayland/PRIMARY and physical GPU.** The planning host has no display session (only an
+    i915 render node), so a headless wgpu adapter run is possible but Wayland/PRIMARY/real
+    presentation need a managed environment. Xvfb + WM + IME qualifies only the X11 parts.
+12. **Accessibility workload.** The exact number of unnamed inputs is unknown until the suite runs;
+    the known stock set is 39 `TextEdit` and 51 `DragValue`/`Slider` sites plus custom widgets that
+    gain roles. P1 fixes what strict checks report; there is no global or per-builder opt-out, and
+    P3 completes the custom-control coverage.
+13. **Atomic compatibility boundary.** P1 uses the complete reviewed dependency unit and its
+    required IME/screenshot adapters. No intermediate base pin is needed. Independent stock-0.37
+    controls use a bounded test adapter and are never a production handoff. Extended language
+    policy/qualification in P4 cannot undo required P1 API compatibility.
+
+## 12. Limitations of this planning task
+
+- No build, test, clippy, GUI, browser or benchmark was run. Compiler inventories are read from the
+  2026-10-22 audit (a historical fork revision, machine-local path patches, `ui-egui` lib/lib-test
+  only) and from source inspection; integration tests and the app/web crates will reveal additional
+  errors.
+- The environment record reports no `DISPLAY`, no `WAYLAND_DISPLAY` and `XDG_SESSION_TYPE=tty`, but
+  an i915 render node is present (`/dev/dri/renderD128` readable/writable). This supports a
+  headless wgpu adapter run only; it does not qualify native presentation, Wayland, PRIMARY or
+  physical-GPU performance.
+- The cmap/glyph findings are a read-only inspection of the bundled font files, not a rendered
+  proof; the implementation must run the coverage test.
+- Upstream issue claims (`#8731`, `#8736`, `#8763`, `#8748`, `#8631`, `#8512`, `#8428`, `#8657`,
+  `#8577`) are reported by upstream authors, not measured here; the linked evidence file
+  (`/home/codex/work/ssd2/task-evidence/egui037-migration-20261022/upstream-discussions.json`)
+  records the snapshots. `#8764` is open/unmerged (`upstream-8764-fresh.json`), a proposal only.
+- No performance number is claimed. The thresholds above are proposals to be validated by paired
+  runs on recorded hardware.
+- Windows and macOS behaviour, IME, native focus, file pickers and real-GPU presentation are not
+  qualified by headless kittest and remain explicit gates.
+- Reviewer dispositions: the review's findings on workspace version 1, the visual-harness
+  coverage, the absent shared `with_accessibility_check` switch, the incomplete PRIMARY matrix,
+  child-viewport freezing while hidden, the performance sample counts, the `ppm` capture point,
+  dependency/lock gates, skipping `ui_gpu.rs`, and the `Id::new` grep/occurrence counts were adopted
+  and are fixed above. Two review suggestions were corrected rather than adopted: `RawInput::time`
+  cannot supply a logic-only clock (`run_logic` discards it; an app-owned injected clock is
+  required), and freezing the admission-time DPI is wrong when the frame is captured later (the
+  issued geometry + geometry epoch are bound to the image, and the returned dimensions supply the
+  pixel scale). The v2 review's hidden-input accumulation, P7c/CL-2F dependency, baseline-identity,
+  E21b state/serial, W27/W25 gate, accessibility-builder and anchor findings are fixed in place
+  above. The review's blanket
+  claim that hidden browser logic cannot run is also corrected: eframe 0.37 already falls back to
+  `setTimeout` for hidden tabs; the realistic gate is the browser's clamped cadence, not a new
+  worker feature. The review's Linux "no display means no X11 evidence" is narrowed to the parts
+  that genuinely need a real compositor/physical GPU; Xvfb + WM + IME can qualify X11 focus,
+  clipboard/PRIMARY and X11 IME behaviour.
+- The pinned fork, winit, craft-libs and PR 199 can move before implementation; every plan stage
+  records the exact SHAs it was reviewed against.
+
+
+## Local implementation update — 2026-10-23
+
+The user clarified that reviewed plans remain local and implementation proceeds before publication. The earlier requirement to publish/land this plan first is superseded; pushes and PR publication still require explicit approval.
+
+Canonical `storytold/effectcraft` `main` now resolves to `f6ef1a790625657259f449f3f4f0773d7df449bb`. The owned checkout was fast-forwarded to this revision. Earlier baseline SHAs and line anchors above are retained as historical review evidence; use this new revision and its exact lockfile for current-main integration and paired measurements. The original refs remain reachable.
+
+Preserve queue4096/click1–512/drag<=2048 validation and refusal-without-mutation test; these limits differ from FilmCraft. Preserve chrono feature split.
+
+The complete static delta review and exact old/new object identities are retained in the task evidence: `canonical-diffs-refresh-20261023.json` and `overnight-consumer-review-20261023.md`. This amendment claims no new build, native GUI or performance acceptance.
+
+## Local implementation stage 1 — 2026-10-23
+
+Implemented in the owned worktree only: no commit, push, PR, release or publication; no build,
+test, fmt, clippy or `cargo metadata` was run (the parent runs managed `task.py` validation and
+generates the lockfile). Local dependency redirects are the parent's (unpublished) worktrees.
+
+**Compatibility surface**
+
+- `egui`/`eframe`/`egui_kittest` moved to `0.37` with explicit
+  `egui` features `default_fonts` + `monochrome_emoji_fonts` and `eframe/clipboard` on the UI
+  crate and desktop app. The `craft-ui` revision is unchanged (the 0.36-era pin) with a TODO:
+  the reviewed CL-1 + CL-2F revision is the parent's to supply; no remote revision was invented.
+- `Id::new`→`Id::unique` everywhere (603 occurrences); `Ui::id`→`Ui::scope_id`;
+  `UiStack.id`→`UiStack.scope_id`; `WidgetType`→`egui::Role` (ColorButton→ColorWell,
+  SelectableLabel→Button with `selected`, Other→Unknown/TreeItem); `AtomLayoutResponse`→
+  `WidgetAtomResponse` with an `IdSalt` swatch id; `FontData` comparison through `bytes()`;
+  `TextEdit::vertical_align`→`align(Align2::LEFT_CENTER)`; `Event::MouseWheel` gained
+  `source: MouseWheelSource::Wheel` in the control channel and every test.
+- Screenshots replaced `UserData`/`Event::Screenshot` token scanning with
+  `craft_ui::capture::CaptureSlot`: 4 outstanding requests, 128 MiB per image and 256 MiB
+  aggregate reservations from checked geometry, issuance only after 3 settled non-discarded
+  passes plus 0.35 s, geometry-epoch binding (window position excluded), stale-epoch retry and
+  rejection, deadlines, cancellation and late-callback release. The callback holds only the weak
+  slot; files and replies are written in the tick.
+- The covered/minimized refusal in `ui.screenshot` is intentionally still present: removing it
+  needs a native platform run showing a pending screenshot forces a hidden paint.
+
+**Lifecycle**
+
+- `EffectcraftApp::tick` (all eframe logic callbacks, including hidden logic-only ones): engine and
+  background queues, script tasks, engine events, native command inbox, close guard, window title,
+  project auto-save, workspace-layout auto-save, memory watch/home-on-open, playback + audio,
+  control channel, screenshot completion/issuance, and `RequestPaintWhileHidden` when a UI pass is
+  needed. `EffectcraftApp::draw` (the root `Ui`): language/theme/font setup (the existing two-pass
+  font warm-up), input-driven shortcuts, layout, panels, dialogs, dropped files, Video Preview,
+  workspace-state observation, plus the pass geometry/epoch and the `AfterInput` acknowledgement on
+  the final non-discarded pass.
+- `AppClock` ( `web_time::Instant`, injectable manual clock) replaces every wall-clock or
+  `ctx.input(|i| i.time)` use in the tick (auto-save, watch folder, footage reload, playback,
+  control deadlines, screenshot deadlines, toast timestamps). `panels/viewer` now records its
+  drawn scale and playback advances in the tick.
+- One pending synthetic batch: `feed_synthetic` refuses a second batch until a UI pass applied the
+  first (`mark_synthetic_applied`), a font-gated pass requeues the batch instead of dropping it,
+  and `raw_input_hook` keeps the control provenance across hidden iterations.
+- Web: dropped files are read in `raw_input_hook`; the persist snapshot uses the app clock.
+  `RequestPaintWhileHidden` is sent on native only — the shared web fork does not carry it, so
+  hidden web input/screenshots remain unqualified.
+- IME: the custom viewer editor handles `ImeEvent::DeleteSurrounding` (characters) and
+  `DeleteSurroundingBytes` (UTF-8 bytes, converted at char boundaries through `TextDoc`), grouped
+  with the following `Commit` under one typing/undo key. Outgoing surrounding text (E21b/W27) is
+  recorded as the next step at the single `IMEOutput` producer; no empty placeholder was invented.
+
+**Tests added (not run here)**
+
+- `lib.rs::lifecycle_tests`: logic-only tick records no fonts/geometry; a control command completes
+  without a pass; one pending synthetic batch across repeated hidden hooks with a font-gated
+  requeue and exactly one reply; geometry epoch ignores window movement and tracks resize/back;
+  hidden playback advances and stops at the plan's end; workspace-layout auto-save writes on a
+  hidden tick; a hidden close request opens the guard and sends `CancelClose`; screenshot
+  issuance/settlement, resize retry, admission bounds + timeout release, and late-callback
+  no-write/no-second-reply.
+- `panels/viewer_text.rs` tests: byte-count IME deletion around an emoji, character-count deletion
+  over a selection with clamping, and no-op cases.
+- `theme.rs` glyph test extended to the full drawn chrome set; `ui_effect_names`/`ui_presets_folder`
+  opt out of the missing-glyph panic only for their CJK/Japanese fixtures.
+
+**Known remaining gates**
+
+- Parent must generate `Cargo.lock`, supply the local patch config and the reviewed craft-ui
+  revision, then run the repository gates. Strict kittest accessibility is still on: stock
+  `TextEdit`/`DragValue`/`Slider` fields without a label or hint will be reported (no global or
+  per-builder opt-out was added).
+- `ui_gpu`/native GUI, hidden-window screenshots (the refusal above), Wayland/X11 IME and PRIMARY,
+  Windows/macOS rows, and every performance row remain unmeasured here.
diff --git a/docs/external-helpers.md b/docs/external-helpers.md
new file mode 100644
index 000000000..3c513df95
--- /dev/null
+++ b/docs/external-helpers.md
@@ -0,0 +1,98 @@
+# External effect helpers
+
+An **external effect helper** is a separate program that offers effects to EffectCraft. Each
+helper runs as a child process and talks to EffectCraft over the protocol below. EffectCraft
+registers every effect a helper lists as an ordinary plug-in effect: it shows up in Effects &
+Presets, has normal properties (keyframes, expressions, Effect Controls) and renders through
+the helper. Helpers exist to run native code, such as an OpenFX plug-in host, **outside**
+EffectCraft's process. If a helper crashes or hangs, EffectCraft shows the error on the effect
+and carries on. See [ADR 0001](adr/0001-external-effect-helpers.md) for why.
+
+## Using helpers
+
+| What | How |
+|---|---|
+| Install | Put the helper program (`effectcraft-helper-<name>`, `.exe` on Windows) in `helpers/` next to EffectCraft, in `helpers/` in the [settings folder](preferences.md), or in a folder named in `EFFECTCRAFT_HELPER_PATH` (a path list; entries can be programs or folders). Subfolders one level down are searched too. |
+| Start | Helpers run native code, so nothing starts them unless the user asks: Effect ▸ Scan for Effect Helpers (`effect.helpers.scan`) starts them. To start them every time EffectCraft launches, opt in with `EFFECTCRAFT_HELPERS=1`. It is an environment variable, not a setting, so writing to the settings folder can't turn it on. Agents confined with `--automation-read-root` / `--automation-write-root` can't run `effect.helpers.scan` or `effect.helpers.load`, and scripts can run them only with Allow Scripts to Write Files and Access Network on. |
+| Load more plug-ins | Effect ▸ Load Plug-ins Through Helper… (`effect.helpers.load {path}`) hands a file or folder to the helpers that accept it (an OpenFX helper takes `.ofx` plug-ins and `.ofx.bundle` folders). |
+| Inspect | `effect.helpers.list` → `{helpers: [{program, name, version, loads, running, effects, restarts, error}], blocked}`; `effect.plugins.list` shows each effect's `source` (`helper: …`) and last render `error`. |
+| Errors | A failed render leaves the frame as it was and puts ⚠ after the effect's name in Effect Controls (hover for the message). The next render starts the helper again. An effect that stops its helper 3 times is turned off and listed in `helper_blocklist.txt` in the settings folder. `effect.helpers.scan {"retry": true}` turns it back on. A helper that stops 5 times in a minute stays off until the next scan. |
+| Timeouts | `EFFECTCRAFT_HELPER_TIMEOUT` (seconds per render step, default 120) and `EFFECTCRAFT_HELPER_LOAD_TIMEOUT` (start-up, describe, load; default 600). A helper idle for 30 s is pinged before it is used again. |
+
+Helpers are not available in the web build.
+
+## Protocol (version 1)
+
+EffectCraft starts the helper with the single argument `--effectcraft-helper`, with stdin,
+stdout and stderr piped. The environment variable `EFFECTCRAFT_HELPER_STATE_DIR` names a folder
+where the helper may keep its own records (for example, plug-ins that crashed it while
+loading).
+
+- **Requests** (EffectCraft → helper): one JSON object per line on stdin.
+- **Replies** (helper → EffectCraft): one JSON object per line on stdout, prefixed with
+  `@ec-helper ` (with the space). Lines without the prefix, or text before it, are logged and
+  otherwise ignored, so plug-ins that print to stdout don't break the protocol. stderr is
+  logged (whatever bytes it holds).
+- Every object has an `"op"`. Lines are at most 256 MB.
+- The helper exits when stdin closes or on `shutdown`.
+
+### Frame exchange file
+
+Pixels never go through the pipe. EffectCraft creates a file (in `/dev/shm` on Linux when
+available, otherwise the temp folder) and names it in `hello`. Images are addressed by an
+**image ref**:
+
+```json
+{"offset": 0, "width": 1920, "height": 1080, "origin": [0, 0], "scale": 1}
+```
+
+The image is `width × height` pixels starting `offset` bytes into the file. Each pixel is
+premultiplied RGBA as four `f32`s in native byte order (16 bytes), rows top to bottom, and an
+image is at most 2²⁸ pixels. `origin` is the buffer position of layer pixel (0, 0); `scale` is
+buffer pixels per layer pixel. EffectCraft decides every offset, so the helper only reads and
+writes where it's told. On Unix, EffectCraft unlinks the file once the helper has opened it, so
+nothing is left behind if either side dies. Helpers may map the file instead of reading it.
+
+### Messages
+
+| Request | Reply | |
+|---|---|---|
+| `{"op":"hello","version":1,"frames":"<path>"}` | `{"op":"hello","version":1,"name":"OpenFX","helper_version":"1.0","loads":["ofx"]}` | First message. The helper opens `frames` read/write. `loads` lists the extensions `load` accepts. A different `version` means EffectCraft won't use the helper. |
+| `{"op":"describe"}` | `{"op":"effects","effects":[{"manifest":{…},"padding":true}],"errors":["…"]}` | `manifest` is a [plug-in API 2 manifest](plugins.md#plug-in-api-2-native-plug-ins) (id, name, category, params). `padding: true` means EffectCraft asks `padding` before each render. |
+| `{"op":"load","path":"…"}` | `effects` (only the new ones) or `error` | A file or folder the user picked. Replayed after a restart. |
+| `{"op":"padding","effect":"…","instance":7,"time":1.0,"scale":1.0,"layer_size":[w,h],"flat":[…],"texts":[…]}` | `{"op":"padding","pixels":3}` | Transparent pixels to add on each side before the render (at most 4096). |
+| `{"op":"render","effect":"…","instance":7,"time":1.0,"frame":<image ref>,"layer_size":[w,h],"flat":[…],"texts":[…],"frame_rate":30,"frame_range":[0,10]}` | callbacks, then `{"op":"done"}` or `{"op":"error","message":"…"}` | Process `frame` in place: read it, write the result to the same ref, reply `done`. `flat` / `texts` are the parameter values flattened by plug-in API 2 rules. `instance` identifies the applied effect (stable across frames). `frame_range` is the layer's source range in layer-time seconds, or `null`. |
+| `{"op":"destroy","instance":7}` | none | The instance is gone; free what it holds. |
+| `{"op":"ping"}` | `{"op":"pong"}` | Heartbeat. |
+| `{"op":"shutdown"}` | none | Exit. |
+
+**Callbacks during a render.** Before it replies `done`, the helper may ask:
+
+| Helper asks | EffectCraft answers |
+|---|---|
+| `{"op":"input_at","time":t}` | `{"op":"image","image":<image ref>\|null}`: the effect's input (the layer, its masks, the effects above) at layer time `t`, in its own extent. |
+| `{"op":"layer_input","param":"<layer param id>","time":t}` | `image`: that layer at layer time `t` with effects and masks, resampled into this frame's grid. |
+| `{"op":"params_at","time":t}` | `{"op":"params","values":[[flat…],[texts…]]\|null}` |
+
+While a helper waits for an answer, EffectCraft may send another `render` (or `padding`). This
+happens when producing the answer needs an effect of the same helper: for example, motion blur
+asking for the previous frame of a layer that also has a retime effect from the same helper.
+The helper must serve it completely (with its own callbacks, nested up to 16 deep) and then
+keep waiting. Images for callbacks are placed after the frame in the exchange file and freed
+when the render ends.
+
+### Errors and restarts
+
+`error` replies are per request: the helper carries on. EffectCraft stops (kills) the helper
+when it exits, closes stdout, sends a reply that doesn't parse or doesn't fit, or misses a
+timeout, or stops reading its stdin for longer than the timeout. The request then fails. The next request starts a fresh process, runs `hello`, replays
+earlier `load`s and recreates instances lazily: the helper sees a `render` for an `instance` it
+doesn't know and creates it.
+
+## Writing a helper
+
+Any language works: read lines, write prefixed lines, read and write a file. Rust helpers can
+use `effectcraft_helper_host::serve::serve` with a `Provider` that lists `EffectPlugin`s;
+`crates/helper-host/tests/it/main.rs` is a complete example and the protocol test that runs
+in `cargo xtask ci`. An unofficial OpenFX helper built this way lives in its own repository,
+[ec-extension-ofx](https://github.com/glumbis/ec-extension-ofx).
diff --git a/docs/feature-naming.md b/docs/feature-naming.md
new file mode 100644
index 000000000..a69bc713f
--- /dev/null
+++ b/docs/feature-naming.md
@@ -0,0 +1,108 @@
+# Descriptive feature names
+
+Related to #1365. This is a naming cleanup, not a trademark clearance or a product rename.
+
+## Naming policy
+
+Use short, descriptive labels for EffectCraft implementations. Do not reuse a vendor prefix or
+coined feature name as our branding. Qualify similar effects by what distinguishes them; each
+English display name remains unique across the registry.
+
+- Renderer: **GPU Acceleration** / **Software Rendering**.
+- Panel: **Video Scopes**.
+- The table below covers the 69 former CC effects plus color grading, the shape matte and keying.
+
+## Compatibility contract
+
+Only presentation names change. Effect IDs, command IDs, parameter IDs, enum values, panel IDs,
+serialized types and AEP import/export match names stay unchanged. Old effect display names
+remain case-insensitive lookup and search aliases. Existing project instance names, custom names,
+expressions, animation and values are not rewritten. The UI displays a current label for an exact
+legacy default name, optionally followed by its numeric instance suffix; all other names stay
+verbatim. A user-entered name identical to a legacy default cannot be distinguished from it, but
+its saved value is still retained.
+
+External format specifications, comparison documents, attribution records and compatibility
+fixtures may still name the external product or effect they actually describe.
+
+## Display mapping
+
+| Stable ID | Previous display name | Current display name |
+|---|---|---|
+| `ec.sim.ccballaction` | CC Ball Action | Ball Grid |
+| `ec.distort.ccbendit` | CC Bend It | Two-Point Bend |
+| `ec.distort.ccbender` | CC Bender | Flexible Bend |
+| `ec.distort.ccblobbylize` | CC Blobbylize | Organic Displacement |
+| `ec.stylize.ccblockload` | CC Block Load | Block Reveal |
+| `ec.sim.ccbubbles` | CC Bubbles | Bubbles |
+| `ec.stylize.ccburnfilm` | CC Burn Film | Film Burn |
+| `ec.color.cccolorneutralizer` | CC Color Neutralizer | Color Neutralizer |
+| `ec.color.cccoloroffset` | CC Color Offset | Channel Offset |
+| `ec.channel.cccomposite` | CC Composite | Source Composite |
+| `ec.blur.cccross` | CC Cross Blur | Cross Blur |
+| `ec.perspective.cccylinder` | CC Cylinder | Cylinder Wrap |
+| `ec.sim.ccdrizzle` | CC Drizzle | Water Ripples |
+| `ec.perspective.ccenvironment` | CC Environment | Environment Map |
+| `ec.distort.ccflomotion` | CC Flo Motion | Dual Lens Warp |
+| `ec.time.ccforcemotionblur` | CC Force Motion Blur | Temporal Motion Blur |
+| `ec.stylize.ccglass` | CC Glass | Glass Relief |
+| `ec.transition.ccglasswipe` | CC Glass Wipe | Glass Wipe |
+| `ec.generate.ccgluegun` | CC Glue Gun | Paint Beads |
+| `ec.transition.ccgridwipe` | CC Grid Wipe | Grid Wipe |
+| `ec.distort.ccgriddler` | CC Griddler | Tile Grid |
+| `ec.sim.cchair` | CC Hair | Surface Fibers |
+| `ec.stylize.cchextile` | CC HexTile | Hexagonal Tiles |
+| `ec.transition.ccimagewipe` | CC Image Wipe | Luminance Image Wipe |
+| `ec.transition.ccjaws` | CC Jaws | Serrated Wipe |
+| `ec.stylize.cckaleida` | CC Kaleida | Kaleidoscope |
+| `ec.color.cckernel` | CC Kernel | Convolution Kernel |
+| `ec.distort.cclens` | CC Lens | Lens Distortion |
+| `ec.generate.cclightburst` | CC Light Burst 2.5 | Radial Light Burst |
+| `ec.generate.cclightrays` | CC Light Rays | Light Rays |
+| `ec.generate.cclightsweep` | CC Light Sweep | Light Sweep |
+| `ec.transition.cclightwipe` | CC Light Wipe | Light Wipe |
+| `ec.transition.cclinesweep` | CC Line Sweep | Line Sweep |
+| `ec.sim.ccmrmercury` | CC Mr. Mercury | Liquid Particles |
+| `ec.stylize.ccmrsmoothie` | CC Mr. Smoothie | Palette Map |
+| `ec.utility.ccoverbrights` | CC Overbrights | Out-of-Range Display |
+| `ec.distort.ccpageturn` | CC Page Turn | Page Curl |
+| `ec.sim.ccparticlesystems2` | CC Particle Systems II | Particle Emitter 2D |
+| `ec.sim.ccparticleworld` | CC Particle World | Particle Emitter 3D |
+| `ec.sim.ccpixelpolly` | CC Pixel Polly | Pixel Shatter |
+| `ec.stylize.ccplastic` | CC Plastic | Plastic Shading |
+| `ec.distort.ccpowerpin` | CC Power Pin | Perspective Pin |
+| `ec.blur.ccradial` | CC Radial Blur | Variable Radial Blur |
+| `ec.blur.ccradialfast` | CC Radial Fast Blur | Fast Radial Blur |
+| `ec.transition.ccradialscalewipe` | CC Radial ScaleWipe | Radial Scale Wipe |
+| `ec.sim.ccrainfall` | CC Rainfall | Rainfall |
+| `ec.stylize.ccrepetile` | CC RepeTile | Edge Tile Repeat |
+| `ec.distort.ccripplepulse` | CC Ripple Pulse | Pulsed Ripple |
+| `ec.transition.ccscalewipe` | CC Scale Wipe | Scale Wipe |
+| `ec.sim.ccscatterize` | CC Scatterize | Pixel Scatter |
+| `ec.key.ccsimplewireremoval` | CC Simple Wire Removal | Line Removal |
+| `ec.distort.ccslant` | CC Slant | Slant |
+| `ec.distort.ccsmear` | CC Smear | Directional Smear |
+| `ec.sim.ccsnowfall` | CC Snowfall | Snowfall |
+| `ec.perspective.ccsphere` | CC Sphere | Sphere Wrap |
+| `ec.distort.ccsplit` | CC Split | Split Warp |
+| `ec.distort.ccsplit2` | CC Split 2 | Dual Split Warp |
+| `ec.perspective.ccspotlight` | CC Spotlight | Surface Spotlight |
+| `ec.sim.ccstarburst` | CC Star Burst | Starfield |
+| `ec.generate.ccthreads` | CC Threads | Woven Threads |
+| `ec.stylize.ccthreshold` | CC Threshold | Channel Threshold |
+| `ec.stylize.ccthresholdrgb` | CC Threshold RGB | RGB Threshold |
+| `ec.distort.cctiler` | CC Tiler | Scaled Tiles |
+| `ec.color.cctoner` | CC Toner | Multi-Tone Tint |
+| `ec.transition.cctwister` | CC Twister | Twist Wipe |
+| `ec.blur.ccvector` | CC Vector Blur | Vector Blur |
+| `ec.stylize.ccvignette` | CC Vignette | Vignette |
+| `ec.transition.ccwarpomatic` | CC WarpoMatic | Warp Dissolve |
+| `ec.time.ccwidetime` | CC Wide Time | Temporal Blend |
+| `ec.color.lumetri` | Lumetri Color | Color Grading |
+| `ec.obsolete.mochashape` | Mocha shape | Tracked Shape Matte |
+| `ec.keying.keylight` | Key Light | Screen Color Key |
+
+`Roto Brush & Refine Edge` and `Warp Stabilizer` keep their current names; renaming them is
+deferred.
+
+No effect algorithms or formats are changed.
diff --git a/docs/fidelity/README.md b/docs/fidelity/README.md
index 5afafee41..f9ecdd99f 100644
--- a/docs/fidelity/README.md
+++ b/docs/fidelity/README.md
@@ -71,6 +71,67 @@ After the fix, all ten tangents equal AE's to the printed 0.001 px, and the two
 test `spatial_auto_bezier_tangents_follow_after_effects` checks the rule on other original keys,
 including a timing change. AE's output stays local; only the script and these scores are tracked.
 
+## Linear side next to an eased side
+
+Measured on 19 October 2026 with After Effects 2026 (26.2) through a time-remapped precomposition
+(a square moving at 455 px per second of source time, read off rendered frames to the pixel): a
+segment from a Bezier out side (speed 0, influence 50 %) at 2 s, value 3.5, into a linear key at
+4 s, value 0.5, plays 3.290 at 2.5 s and 2.657 at 3 s. EffectCraft gave the linear side the
+segment's average speed at 33.3 % influence (3.308 and 2.629, 8 and 13 px off); AE uses the average
+speed at 16.67 %, the influence its Keyframe Velocity dialog shows for linear keys. Now the same
+square positions to the pixel. `LINEAR_SIDE_INFLUENCE` holds the value for evaluation, the Graph
+Editor / velocity dialog sides and the Lottie export; segments that are linear on both sides stay
+straight. Regression test: `a_linear_side_next_to_an_eased_side_matches_after_effects`.
+
+## Justify All with the every-line composer
+
+Measured on 19 October 2026 with After Effects 2026 (26.2) on box text (EXPORTER read-back t6):
+with Justify All, AE stretches the paragraph's last line too and breaks the lines so that it is not
+a lone word (4 / 4 / 4 words where the other justifications break 6 / 6 / 1). EffectCraft's
+every-line composer ignored the last line's slack and left "twelve" alone on a stretched line; it now
+counts that slack for Justify All, and every word starts within 1 px of AE's. Regression test:
+`justify_all_balances_the_lines_with_the_every_line_composer`.
+
+## Right-to-left point text with a justified paragraph
+
+Measured on 19 October 2026 with After Effects 2026 (26.2) (EXPORTER read-back t7): right-to-left
+point text whose paragraph has a justified code (justify last left / centre / right, justify all)
+sits flush right at its anchor, like right-aligned text. EffectCraft placed it by the last-line
+side (left / centre / left). Now flush right; left-to-right point text is unchanged (not measured).
+Regression test: `rtl_point_text_with_a_justified_paragraph_is_flush_at_its_start`. Still open:
+AE wraps right-to-left box text slightly wider (its word gaps are 1–2 px narrower than in
+left-to-right text with the same font), so a 300 px box fits a word more per line.
+
+## Text animator tracking
+
+Measured on 19 October 2026 with After Effects 2026 (26.2): a text animator's Tracking Amount is in
+pixels, not 1/1000 em like the Character panel's tracking (Amount 30 adds 30 px between neighbouring
+characters at 80 px and at 40 px, half before and half after each), and a Subtract range selector
+over characters the first selector leaves out keeps them at 0 instead of tracking them negatively.
+With both, the EXPORTER's t8 layer D (Tracking 30 on characters 2–4 by index, a Subtract selector
+over the last 20 %) puts every glyph where AE does (it ended 88 px short). The "Tracking In" text
+preset now animates 40 → 0 px (was 400 → 0 thousandths of an em). Lottie export is unchanged (not
+checked against a player). Regression tests: `animator_tracking_is_in_pixels_as_in_after_effects`,
+`modes_combine`.
+
+## Per-character 3D rotation order
+
+Measured on 19 October 2026 with After Effects 2026 (26.2) (case 931: "H" at 400 px, per-character
+3D, animator X / Y / Z Rotation 40 / 30 / 20): a character turns as a 3D layer does, Rx · Ry · Rz
+(Z first). EffectCraft composed Rz · Ry · Rx, so the glyph faced another way (23 of 5184 grid points
+off, max 255); now 3 at the anti-aliased edge (mean 0.015). Regression test:
+`per_character_rotation_turns_z_first_as_a_3d_layer`.
+
+## Rectangle path start point
+
+Measured on 19 October 2026 with After Effects 2026 (26.2) on 400 × 300 shape rectangles with Trim
+Paths: a plain rectangle starts at its top-right corner and runs clockwise (0–25 % covers the right
+edge and 50 px of the bottom); with Roundness 40 it starts where the top-right arc meets the right
+edge. Start 70 / End 30 draws 30–70 %. EffectCraft started at the top-left corner (and the rounded
+rectangle elsewhere), so trimmed rectangles drew the wrong segment (86 of 5184 grid points off,
+now 5 at stroke edges). `effectcraft_path::rect` now draws AE's order, which also gives Convert to
+Bezier AE's vertex order. Regression test: `rectangles_start_where_after_effects_starts_them`.
+
 ## Still unmeasured
 
 Rendered frame comparisons now have a deterministic `effectcraft_effects::fidelity::compare_frames`
diff --git a/docs/fidelity/workflow-checks.md b/docs/fidelity/workflow-checks.md
index 4bea37ee1..613d68786 100644
--- a/docs/fidelity/workflow-checks.md
+++ b/docs/fidelity/workflow-checks.md
@@ -4,7 +4,7 @@ These checks use original compositions and public interaction behavior. No Adobe
 implementation code are included. Adobe's [selection documentation](https://helpx.adobe.com/after-effects/desktop/work-with-layers/select-and-arrange-layers/selecting-arranging-layers.html)
 describes Timeline range selection and Composition Shift-click/Shift-marquee selection.
 
-`crates/ui-egui/tests/ui_workflow_selection.rs` exercises actual pointer and keyboard events:
+`crates/ui-egui/tests/it/ui_workflow_selection.rs` exercises actual pointer and keyboard events:
 
 - Timeline Shift-click selects the visible range, skipping locked layers; Ctrl/Command-click toggles a layer.
 - A drag beginning in the empty Timeline outline selects the intersected layer rows without reordering them.
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 9e2249e9b..0e98bda58 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,6 @@
 # File format parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (closed issue references re-audited against `upstream/main` 470ea7a3) · **Target:** Adobe After Effects 2026
+> **Last reviewed:** 2026-10-19 · **Last updated:** 2026-11-05 · **Change:** ProRes alpha final-run conformance; previously `.aep` / `.aepx` import and `.aep` export (`crates/aep`: `container`, `import`, `export`) · **Target:** Adobe After Effects 2026
 
 Every format After Effects reads or writes, with EffectCraft's support. After Effects' list comes
 from its installed bundle (26.5.0.89: `Info.plist` `CFBundleDocumentTypes`, `Plug-ins/Format`,
@@ -11,8 +11,8 @@ from its installed bundle (26.5.0.89: `Info.plist` `CFBundleDocumentTypes`, `Plu
 ([architecture.md](architecture.md)).
 
 **Overall ≈ 50%** (estimated, weighted by use): modern delivery and interchange formats are
-strong, but After Effects' own project, template and preset formats, which decide whether
-existing work moves over, are 0%.
+strong, but After Effects' own formats, which decide whether existing work moves over, are the
+weakest: `.aep` / `.aepx` import and export are partial, templates and presets are 0%.
 
 Fidelity key: **exact** (bit-exact or within a stated tolerance of a reference), **good** (round
 trips and renders, checked by tests, not against After Effects), **partial** (named limitations),
@@ -22,8 +22,8 @@ trips and renders, checked by tests, not against After Effects), **partial** (na
 
 | Format | After Effects | EffectCraft read | Write | Fidelity / notes | Tested by |
 |---|---|---|---|---|---|
-| Project `.aep` | R/W (native) | none | none | Main file format; needs an owner decision on clean-room scope (#190; #248, closed as its duplicate: py-aep as an external converter; open PRs #251 and #860). Blocks beta | — |
-| XML project `.aepx` | R/W | none | none | Same decision as `.aep` | — |
+| Project `.aep` | R/W (native) | partial | partial | Main file format; the clean-room method is in [aep-format.md](aep-format.md), the maintainers' decision on it is open (#190). `crates/aep` reads and writes the RIFX container losslessly (byte-identical round trip) with a typed view of the decoded fields, from our own generated files only ([aep-format.md](aep-format.md)). File ▸ Import ▸ After Effects Project… (`file.importAep`, `effectcraft_aep::import`): folders, project settings, compositions, every layer kind, Transform, keyframes, expressions, masks, text with animators, shapes, cameras, lights, track mattes, markers, time remapping, layer styles, the built-in effects of a table shared with the exporter (Lumetri Color, Curves, Levels, Glow, Fractal Noise, Gradient Ramp, … and the expression controls), footage and image sequences; everything else is reported ([aep-import.md](aep-import.md)). File ▸ Export ▸ After Effects Project… (`file.exportAep`, `effectcraft_aep::export`) writes the same scope with every chunk built in code; exports were opened and read back in After Effects 2026 ([aep-export.md](aep-export.md)); everything else is reported. Effects outside the table (plug-ins, …) are not converted | `crates/aep` tests (`tests/container`, `tests/import`, `tests/export`) |
+| XML project `.aepx` | R/W | partial | none | Read into the same chunk tree as `.aep` by `crates/aep` (`read_aepx`; mapping in [aep-format.md](aep-format.md) section 1), so `file.importAep` imports it with the same coverage as `.aep`; not written | `crates/aep` `aepx` tests (container and import) |
 | Templates `.aet` / `.aetx` | R/W | none | none | Own `.ectemplate` (Home ▸ Templates, Save as Template) | `templates.rs` tests |
 | Motion Graphics template `.mogrt` | W (and R in Premiere) | none | none | Own `.ectemplate` Essential Graphics templates; FilmCraft rejects our `.fcgt` export (#611) | `essential.rs` tests |
 | Animation preset `.ffx` | R/W, 621 bundled | none | none | Own JSON `.ecpreset`; `.ffx` is out of clean-room scope (AGENTS.md §2) | `animation.rs` tests |
@@ -41,15 +41,15 @@ trips and renders, checked by tests, not against After Effects), **partial** (na
 | PNG | R/W | yes | yes (sequence) | good |
 | JPEG | R/W | yes | yes (sequence) | good |
 | TIFF | R/W | yes | yes (sequence) | good |
-| OpenEXR (multi-layer, Cryptomatte) | R/W | yes | yes (32-bit sequence) | good; HTJ2K compression fails (#482); EXRs without an unnamed RGB layer decode twice (#474) |
+| OpenEXR (multi-layer, Cryptomatte) | R/W | yes | yes (scan-line sequence, half or 32-bit float, every compression but HTJ2K) | good; written files carry a `chromaticities` attribute for the output space's primaries and white; HTJ2K compression fails (#482); a multi-layer frame decodes once for its picture and EXtractoR / Cryptomatte from the first frame on, except Media Replacement items, which are learned at their first frame, and files whose picture the `image` crate still decodes (#474); footage alone keeps only its picture's channels, though a single-part file still decompresses every channel's pixels; decoded channels are held as f32 |
 | Photoshop PSD / PSB | R (footage, composition) / W (layers, sequence) | yes (layers, groups, masks, styles, smart objects) | Save Frame As ▸ Photoshop Layers; no Photoshop sequence output | good, from Adobe's published spec |
 | Illustrator `.ai`, PDF, EPS | R | yes (vector, Continuously Rasterize, Create Shapes; Composition and Composition - Retain Layer Sizes, #1536) | — | partial: no JPX / JBIG2 images, no Illustrator procset EPS |
 | SVG | R | yes | — | good; SVG markup on the clipboard pastes as a shape layer (26.3, #738); Illustrator's own clipboard data (PDF/AI) doesn't |
 | GIF | R/W | yes | yes (animated) | good |
 | BMP | R | yes | — | good |
 | WebP | — | yes (still; animated WebP as footage with its frames, timing and alpha, #762) | — | beyond After Effects |
-| Targa `.tga` | R/W | yes (still and sequence; alpha interpreted on import) | none | good for import (#745); no Targa output |
-| DPX / Cineon `.dpx` `.cin` | R/W | yes (still and sequence; 8/10/12/16-bit luma, RGB, RGBA, both byte orders; log code values shown as stored) | none | partial: import (#756); no Interpret Footage ▸ Cineon Settings (log to linear), no DPX output; common in film VFX |
+| Targa `.tga` | R/W | yes (still and sequence; alpha interpreted on import) | yes (sequence; uncompressed 24-bit RGB or 32-bit RGB + Alpha, straight or premultiplied) | good: import (#745); output reads back through it unchanged; the alpha is not labelled in the file (no TGA 2.0 extension area), so it is interpreted on import |
+| DPX / Cineon `.dpx` `.cin` | R/W | yes (still and sequence; 8/10/12/16-bit luma, RGB, RGBA, both byte orders; log code values shown as stored, or converted by Interpret Footage ▸ Cineon Settings ▸ Logarithmic Conversion) | none | partial: import (#756) and Cineon Settings; no DPX output; common in film VFX |
 | Radiance `.hdr` | R/W | yes (still and sequence, 32-bit linear float like OpenEXR) | none | good for import (#745); no Radiance output |
 | SGI, PICT, ElectricImage, RLA/RPF images | R | none | none | Legacy; RPF camera data import exists (`keys.rpfCameraImport`) |
 | Camera Raw (DNG, CR3, NEF…) | R (Camera Raw) | none | none | LightCraft has decoders that could be shared |
@@ -62,10 +62,10 @@ trips and renders, checked by tests, not against After Effects), **partial** (na
 | MP4 / MOV with H.264 | R/W | yes | yes (own encoder, + AAC) | decoder bit-exact on conformance streams (FilmCraft) |
 | HEVC (H.265) | R/W | yes | yes (MP4 `hvc1`, Main / Main 10) | encoder bit-exact with ffmpeg's decode; no B-frames / SAO, larger files |
 | AV1 | R | yes | yes (MP4 `av01`, WebM) | beyond After Effects' export; no B-frames / CDEF |
-| Apple ProRes (422 family, 4444) | R/W | yes | yes | good; 4444 colour tag wrong (#340); no ProRes RAW |
+| Apple ProRes (422 family, 4444) | R/W | yes | yes | alpha final-run syntax checked in exported MOVs (#293); 4444 colour tag wrong (#340); no ProRes RAW |
 | WebM / Matroska (VP9, AV1, Opus) | R (limited) | yes, incl. VP9 alpha | yes | beyond After Effects |
 | MXF (OP1a / OP-Atom) | R/W | yes (FilmCraft's demuxer: AVC, MPEG-2 incl. XDCAM / D-10, VC-3 / DNxHD, ProRes; PCM audio) | none | partial: import (#767), checked against ffmpeg; no MXF output |
-| AVI | R | none | none | Media Browser lists it |
+| AVI | R | yes (FilmCraft's demuxer: AVI 1.0 / OpenDML; Motion JPEG, H.264, HEVC, uncompressed; PCM, MP3, MP2, AC-3 audio) | none | partial: import (#1701), checked against ffmpeg; H.264 needs its parameter sets in the chunks (global headers and copies with an `avcC` record don't decode until storytold/filmcraft#2303), and a damaged video index loses the video (storytold/filmcraft#2302); DV, MPEG-4 Part 2 (DivX / Xvid) and other legacy codecs import but show why they have no picture; no AVI output |
 | DNxHD / DNxHR | R/W | unverified (FilmCraft decodes it; reachable only inside `.mov`) | none | — |
 | BRAW, R3D, ARRIRAW | R (plug-ins / SDKs) | none | none | proprietary SDKs |
 | Variable-frame-rate phone video | R | unverified | — | needs a real-media corpus |
@@ -96,24 +96,61 @@ trips and renders, checked by tests, not against After Effects), **partial** (na
 | Mocha shapes | R (Mocha AE) | own documented JSON | — | Mocha's format is not public |
 | Vanishing Point `.vpe` | R | none | — | no public specification; the menu entry explains why |
 
-## Render queue outputs (`OutputFormat::ALL`, 13)
+## Render queue outputs (`OutputFormat::ALL`, 14)
 
 H.264 MP4, HEVC MP4, AV1 MP4, ProRes MOV, uncompressed 8-bit RGB / RGB + Alpha MOV (`raw `, + PCM;
-#372), WebM (VP9 or AV1 + Opus), PNG / JPEG / TIFF / OpenEXR sequences, animated GIF, WAV, AIFF.
+#372), WebM (VP9 or AV1 + Opus), PNG / JPEG / TIFF / OpenEXR / Targa sequences, animated GIF, WAV, AIFF.
+OpenEXR sequences are scan-line RGBA files in half or 32-bit float (default) with None, RLE, ZIPS,
+ZIP (default), PIZ, PXR24, B44, B44A, DWAA or DWAB compression; PXR24 on float, B44 / B44A on half
+and DWAA / DWAB are lossy (#2911). No tiled or multi-part output, no HTJ2K (the `exr` crate can't
+write it).
 Missing against After Effects + Media Encoder: 16-bpc uncompressed, AVI and lossless-compressed
-single-file video (Animation / PNG codecs), DPX / Targa / Photoshop sequences, MXF, DNxHR, hardware
+single-file video (Animation / PNG codecs), DPX / Photoshop sequences, MXF, DNxHR, hardware
 encoders ([hardware-parity.md](hardware-parity.md)), and rendering safely over an existing file
 (#325).
 
+### Render source protection
+
+The render queue refuses an output that would replace footage, an attached proxy, or the
+project file. It checks every output module and segment before dispatching the item. A refused
+item is marked Failed with its reason; other valid queued items can still render. Render logs
+are checked too. No render parameter overrides this protection.
+
+Checks compare normalized paths and native file identities, so an existing symbolic link,
+hard link, junction or Windows short name cannot disguise a source as another output file.
+Source identities are indexed once per check and matching identities are verified. The index
+does not keep file handles open for the lifetime of a long sequence.
+
+Default output names move aside when they would replace a protected file. This also applies to
+Create Proxy: recreating a proxy chooses a new default name and attaches the new proxy, leaving
+the previous proxy file intact. An explicit output path is kept as entered and refused if it
+would replace a protected file.
+
+After Pre-render imports its result, that file is footage too. Re-queueing the same item
+with the same output is refused; run Pre-render again for a fresh default output, or choose
+another Output To. An item's `last_output` is not permission to replace imported footage.
+
+Image-sequence checks inspect existing frames in the requested range. Skip Existing Files leaves
+existing frames alone. If a frame number appears in a folder name, the checker probes each
+frame separately and refuses ranges over 100,000 frames instead of silently checking a prefix.
+Choose a fixed output folder or a shorter range for those exports.
+
+This guard does not introduce an overwrite flag, confirmation dialog, or changed replacement
+defaults for the CLI, scripts or MCP. Replacement consent and staging ordinary output files
+belong to the exporter. The source check runs before export; filesystem changes between that
+check and a write still require exporter-side revalidation.
+
 ## Estimate
 
-**≈ 130–230 h**: `.aep` / `.aepx` import 80–160 h (after the owner decision), wiring TGA / DPX /
-HDR / MXF / AVI / DNx import and DPX/TGA output 10–20 h, FBX animation and skinning, USD and Substance 20–40 h,
+**≈ 130–230 h**: `.aep` / `.aepx` 80–160 h (import and export of the common scope are in `crates/aep`; the rest is in [aep-import.md](aep-import.md)), wiring TGA / DPX /
+HDR / MXF / AVI / DNx import and DPX output 10–20 h, FBX animation and skinning, USD and Substance 20–40 h,
 relinking 6–12 h, `.mogrt`-compatible templates 15–30 h (partly parallel with the rest).
 
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-05 | minor | ProRes encoder pin and export regression for final alpha runs; native macOS decode validated, Resolve still unverified (#293) |
+| 2026-10-30 | minor | Render-queue source-protection behavior and limits consolidated here from the standalone page |
 | 2026-10-12 | minor | #324 and #514 marked closed; open `.aep` PRs #251 and #860 noted |
 | 2026-10-10 | major | First file format parity document, from the After Effects 26.5 bundle and this repository's import/export registries |
diff --git a/docs/footage.md b/docs/footage.md
index 84d4c49e6..7841dc84c 100644
--- a/docs/footage.md
+++ b/docs/footage.md
@@ -47,8 +47,8 @@ Stills of any format EffectCraft reads can form a sequence: PNG, JPEG, TIFF, Ope
 WebP. Layered and vector documents (PSD, SVG, PDF) import one by one.
 
 **Missing frames.** Where the numbering skips a number (`shot_0003.png` is missing between
-`0002` and `0004`), the sequence shows a placeholder of colour bars for that frame, as After
-Effects does, so every other frame stays at its number. Render or copy the missing files into the
+`0002` and `0004`), the sequence holds the previous frame (`0002`) there, as After Effects 2026
+does, so every other frame stays at its number. Render or copy the missing files into the
 folder and choose File ▸ Reload Footage to fill the gaps.
 
 Agents: `file.import {"paths": ["/shots/shot_0001.png"], "sequence": true, "frameRate": 24}`.
@@ -70,6 +70,16 @@ next to it.
 Agents: `file.importProject {"path": "/projects/titles.ecproj"}` returns the comps, the root comps,
 `primaryComp` (the only root comp, if there is one) and any missing media.
 
+## Finding a layer's source in the Project panel
+
+Right-click a layer in the Timeline or Composition panel and choose **Reveal Layer Source in
+Project** (also Layer ▸ Reveal ▸ Reveal Layer Source in Project). The Project panel opens, its
+search is cleared, the folders holding the source open, and the source item is selected.
+
+Layers whose image is generated inside the composition — text, shape, null, camera, light and
+3D primitive layers — have no Project item, so the command is not offered for them. Adjustment
+layers do have one: the solid that backs them.
+
 ## Interpret Footage
 
 Select a footage item in the Project panel and choose **File ▸ Interpret Footage ▸ Main…**
@@ -84,16 +94,21 @@ used, and layers that ran to the end of the footage keep doing so.
 | Fields, pixel aspect, loop | As in After Effects. |
 | **Assign Profile**, **Interpret As Linear Light** | The colour profile the file's values are in (the working space converts from it), and whether they are linear light. |
 | **Preserve RGB** | The file's values enter the composition unconverted: no colour profile, linear light or working-space conversion, and float files (OpenEXR, float TIFF) keep their linear values instead of being sRGB-encoded. Use it to convert chosen layers yourself with an OCIO effect, or to read data passes (depth, mist, normals) as numbers. |
+| **Cineon Settings** (DPX and Cineon files) | With *Logarithmic Conversion* on, the file's log code values are converted to the *Current Gamma* (1.7 by default; 1 gives linear light): the *10 Bit Black Point* (95) becomes the *Converted Black Point* (0), and with *Highlight Rolloff* at 0 the *10 Bit White Point* (685) becomes the *Converted White Point* (1023). *Highlight Rolloff* (20) bends the top 20% of the converted range into a curve, as the Cineon Converter effect does: the white point then converts to a level below the Converted White Point, and brighter code values stay below it. At 0, a 32 bpc project keeps over-range values. *Units* shows the converted points as 10-bit, 8-bit or float values. With Logarithmic Conversion off (the default), the code values are shown as stored. |
 
 Settings ▸ Import ▸ **Report Missing Frames** (on by default) lists the missing frame numbers
 when a sequence imports; Interpret Footage lists them too.
 
 **File ▸ Interpret Footage ▸ Remember Interpretation / Apply Interpretation** copy the alpha,
-fields, pixel aspect, loop and colour settings (Preserve RGB too) to other footage.
+fields, pixel aspect, loop and colour settings (Preserve RGB too, and Cineon Settings between
+DPX and Cineon files) to other footage.
 
 Agents: `file.interpretFootage {"items": [id], "frameRate": 24, "alpha": "premultiplied",
 "startTimecode": 1001, "preserveRgb": true}` (timecode or a frame number; `"overrideStart":
-false` goes back to Use Source File Timecode).
+false` goes back to Use Source File Timecode). Cineon Settings: `{"logConversion": true,
+"tenBitBlack": 95, "tenBitWhite": 685, "currentGamma": 1.7, "highlightRolloff": 20,
+"cineonUnits": "8bit", "convertedBlack": 0, "convertedWhite": 255}` (converted points in
+`cineonUnits`, else the footage's Units).
 
 ## Multi-layer OpenEXR
 
@@ -105,14 +120,46 @@ Nuke's `beauty`) show the beauty pass: the layer named Combined, Beauty, Image,
 Color, else the first colour layer that isn't a data pass. Cryptomatte, depth, mist, normals,
 vectors, positions and IDs are never the picture. EXtractoR reads every other layer and channel.
 
+Footage on its own keeps only the channels of its picture (a single-part file still
+decompresses all of its pixels to read them). Once an effect reads an item's channels
+(EXtractoR, Cryptomatte, the 3D Channel effects), each frame, the first included, is decoded
+once for the picture and the effects together, and kept for a while: about 1 GB of decoded
+channels (512 MB in the browser), a soft bound, as the newest file and files still in use
+stay whatever their size. Several frames asking for the same file at once wait for one
+decode. Once no enabled effect reads the item any more, its frames go back to the picture's
+channels alone.
+
+The Cryptomatte effect keys objects by their Cryptomatte ID passes, with the names from the
+file's manifest. Pick them with the eyedropper next to its Selection, then click in the
+Composition viewer (Shift adds, Alt or Ctrl removes). Matte Only shows the matte as grey in
+RGB over full alpha, as After Effects' Cryptomatte plug-in does; projects saved before that
+change keep their matte in alpha as well. Its Layer popup lists the Cryptomatte
+layers the footage has (a file with only `CryptoMaterial` shows just that), and the standard
+`CryptoObject`, `CryptoMaterial` and `CryptoAsset` when the layer has no Cryptomatte footage. The
+stored Layer value is unchanged for those three, so older projects load as they were while each kind appears once. With
+several layers of one kind (`A.CryptoObject`, `B.CryptoObject`) the first keeps the standard
+value; the others, like any other layers, are stored as 3 and up in the file's name order (so a value of 3 reads another layer in
+another file). The popup lists them in Effect Controls and the timeline; scripts and
+`prop.get` still see the three standard options.
+
 ## Replacing and reloading
 
 Importing a layered file as a composition refreshes the decoded sources used by its layers,
 including files overwritten at the same path and byte size.
 
-- **File ▸ Replace Footage ▸ File…** (Ctrl+H) points the item at another file. Pick a numbered
-  file to replace it with that file's whole sequence (`file.replaceFootage {"path": …,
-  "sequence": false}` for one frame).
+- **Replace a layer's source** without rebuilding the layer: Alt-drag (Option-drag on macOS) a
+  footage item, composition or solid from the Project panel onto a layer in the Timeline. The
+  layer keeps its name, timing, transforms, keyframes, expressions, effects, masks, switches,
+  parenting and track matte; only its source changes. A source with audio adds Audio properties
+  when the layer has none. To replace several selected layers with the selected Project item, press
+  Ctrl+Alt+/ (Cmd+Opt+/). Compositions, footage and solids are interchangeable; folders, data files
+  and 3D models are not sources, and a composition can't be nested in itself. Alt-dragging onto a
+  layer is one layer at a time, as in After Effects.
+  Agents: `layer.replaceSource {"item": id, "layers": [ids]}`.
+- **File ▸ Replace Footage ▸ File…** (Ctrl+H) points the item at another file. A still stays a
+  still, and a sequence item keeps bringing the new numbered file's run; pass
+  `sequence: true` to bring a numbered still's whole run (`file.replaceFootage {"path": …,
+  "sequence": true}`), or `sequence: false` for one frame.
 - **Replace with Precomposition (used N times)**, right-clicking a footage item or solid in the
   Project panel, puts the item in a new composition of its size,
   pixel aspect and frame rate, in the same folder, and switches every layer in every composition
@@ -129,7 +176,8 @@ including files overwritten at the same path and byte size.
   File ▸ Open tries each missing file at the same place under the project's new folder, without
   marking the project modified.
 - **File ▸ Reload Footage** (Ctrl+Alt+L) reads the files again. A sequence picks up frames
-  added to its folder (a render still in progress) and keeps its interpretation.
+  added to its folder (a render still in progress) and keeps its interpretation; a still is
+  read as its one file, even when numbered files sit next to it.
 
 **File ▸ Dependencies ▸ Relink Missing Footage…** searches a chosen folder and its subfolders
 for missing source files on the desktop. It relinks unique exact filenames whose decoded type,
diff --git a/docs/gaps.md b/docs/gaps.md
index fd92c22a4..d9de84675 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,6 @@
 # Where EffectCraft falls short
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (path-editing layer bounds, #1220; issue, PR and catalog references gap 21: percentage guides and effect colour labels in; earlier change: re-audited against `upstream/main` 470ea7a3; ranked gap list from the 10 October re-measure otherwise unchanged) · **Target:** Adobe After Effects 2026 (26.5.0.89)
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-30 · **Change:** minor (gap 25, second slice: Info, Flowchart, Script Console and the 3D Camera Tracker block named, described and keyboard-operable, #1335; earlier change: gap 4 closed: every pull request and push to `main` runs `cargo xtask ci` in CI, #2204; earlier change: gap 25: an AccessKit audit test and a theme contrast test, Effects & Presets, Settings and Render Queue named and keyboard-operable, #1335; earlier change: path-editing layer bounds, #1220; issue, PR and catalog references gap 21: percentage guides and effect colour labels in; earlier change: re-audited against `upstream/main` 470ea7a3; ranked gap list from the 10 October re-measure otherwise unchanged) · **Target:** Adobe After Effects 2026 (26.5.0.89)
 
 An honest assessment of how far EffectCraft is from being a real replacement for After Effects,
 and the work that closes the gap. This document is meant for contributors and agents choosing
@@ -37,8 +37,8 @@ because 179 issues were closed with regression tests between 5 and 10 October.
 | UI/UX fidelity | ≈ 65% | 60–120 | [ui-parity.md](ui-parity.md) |
 | File formats | ≈ 50% | 130–230 | [file-format-parity.md](file-format-parity.md) |
 | Hardware | ≈ 40% | 60–120 | [hardware-parity.md](hardware-parity.md) |
-| Localization | ≈ 18% | 60–110 + review | [localization-parity.md](localization-parity.md) |
-| Stability | ≈ 45% | 40–80 | 23 never-crash PRs landed on 4 October and the "Never crash" rules bind every crate, but crash reports are open (#580 Chromatic Aberrations pan/tilt, #501 crash on startup, #426 timeline drag while playing, #341 quit on Intel Mac, #234 macOS 27 exit, #879 `--gpu` export aborts on a failed allocation; #591, #306 and #511 are closed), and no CI workflow runs `cargo xtask ci` on pull requests |
+| Localization | ≈ 24% | 60–110 + review | [localization-parity.md](localization-parity.md) |
+| Stability | ≈ 45% | 40–80 | 23 never-crash PRs landed on 4 October and the "Never crash" rules bind every crate, but crash reports are open (#580 Chromatic Aberrations pan/tilt, #501 crash on startup, #426 timeline drag while playing, #341 quit on Intel Mac, #234 macOS 27 exit, #879 `--gpu` export aborts on a failed allocation; #591, #306 and #511 are closed); `cargo xtask ci` runs on every pull request and push to `main` (#2204) |
 | Real-user experience | ≈ 60%, uneven by platform | (in G2) | 179 issues closed 5–10 October (as counted on 10 October), nearly all with regression tests ([log below](#real-user-report-log-510-october)); 216 open and 328 closed on 12 October, many from Linux and Windows. Most checking still happens on macOS |
 | Performance | unknown against After Effects, ≈ 35% | 50–100 | Internal numbers only (e.g. Advanced 3D 290 ms/frame at 1080p on the GPU on an M4 Pro). Users report stutter on cached frames (#595, #304; the RAM preview now prefetches nearest the playhead, 271000b2), late audio (#504, #335); slow scrubbing (#329, closed by #784) and #554 are closed. No 4K / hundreds-of-layers project tested |
 | Media formats | ≈ 75% | (in file formats) | H.264, ProRes, HEVC, AV1, VP9, image sequences and audio exist. The HEVC / AV1 encoders have no B-frames, multi-reference or SAO / CDEF, so files are larger than from mature encoders. Camera formats (BRAW, R3D, ProRes RAW, variable-frame-rate phone video) are unverified |
@@ -60,28 +60,28 @@ are grouped by area; the issue tracker has the rest.
 | 1 | **`.aep` / `.aepx` projects can't be opened** | No reader; candidate route py-aep (#248, closed as a duplicate of #190; MIT, external converter) awaits an owner decision on clean-room scope; #190; open PRs #251 (native decoder) and #860 (external py-aep converter) | The biggest barrier to switching: existing work, templates and client projects stay in After Effects | 80–160 h | G4 · [file-format-parity.md](file-format-parity.md) |
 | 2 | **Fidelity unmeasured** beyond scalar ease | [fidelity/](fidelity/README.md): 168 samples, one property type; `compare_frames` helper exists, no corpus | Every "done" feature may still differ; users find the differences | 60–100 h harness + P0/P1 corpus; more per feature | G1 · [target-app-parity.md](target-app-parity.md) |
 | 3 | **Open crash reports** | Open: #580, #501, #426, #341, #234, #879. Now closed: #591, #306, #511 | A crash loses work; outranks features ([AGENTS.md](../AGENTS.md)) | 10–25 h | G3 · this file |
-| 4 | **No CI gate on pull requests** | `.github/workflows` has release, packaging-lint, FreeBSD and Windows ARM64 jobs only; `cargo xtask ci` runs locally | Regressions reach main unseen; 49 community PRs landed in one batch (#598) | 4–8 h | G3 · this file |
+| 4 | ~~**No CI gate on pull requests**~~ closed | `.github/workflows/ci.yml` runs `cargo xtask ci` (fmt, clippy, tests, layers, assets, wasm) on every pull request and push to `main` through craft-common-actions' shared `gate.yml` (#2204) | — | done | G3 · this file |
 | 5 | **Playback and scrubbing feel** | #595 stutter on cached frames (partly addressed: nearest-first RAM preview prefetch, cache bars at 1/3 resolution), #304, #504 / #335 audio late or crackling, #586 puppet lag (maintainers asked for details); #329 slow scrubbing (#784) and #554 closed | Preview is where motion designers spend their day | 25–50 h | G5 · [hardware-parity.md](hardware-parity.md) |
 | 6 | **Linux and Windows interaction bugs** | Open: #488 rename arrows (hardening landed, reporter asked for details), #492 anchor drag, #268 file drops on Wayland (winit), #613 Direct3D 12 compositor. Now closed: #491, #493, #467, #320, #302, #596 | Many reports come from Linux; some Windows GPUs fail to start the compositor | 25–45 h | G2 · [ui-parity.md](ui-parity.md) |
-| 7 | **Animation presets: 54 against 621** | After Effects ships 621 `.ffx` presets (Behaviors, Backgrounds, Shapes, Synthetics, Text, Transitions…); we ship 54 original presets (8 text-animator; 23 Transitions: wipes, clock and fan reveals, blinds, dissolves, card flips, CC wipes, fades, #757; 23 Backgrounds: drifting gradients, fog, cloud and smoke, plasma and magma, cells, hexagons, scrolling grids and checks, pulse rings, bokeh, light sweep, #1096, driven by expressions so they keep moving, not seamless loops) and read only our `.ecpreset`. Missing: Behaviors, Shapes, Synthetics, Image and more Text | Presets are how many designers start; tutorials assume them | 15–35 h (original presets; `.ffx` reading is out of clean-room scope) | G8 · [effects-parity.md](effects-parity.md) |
+| 7 | **Animation presets: 76 against 621** | After Effects ships 621 `.ffx` presets (Behaviors, Backgrounds, Shapes, Synthetics, Text, Transitions…); we ship 76 original presets (8 text-animator; 23 Transitions: wipes, clock and fan reveals, blinds, dissolves, card flips, CC wipes, fades, #757; 23 Backgrounds: drifting gradients, fog, cloud and smoke, plasma and magma, cells, hexagons, scrolling grids and checks, pulse rings, bokeh, light sweep, #1096, driven by expressions so they keep moving, not seamless loops; 22 Behaviors: wiggle, shake, float, orbit, bounce, drift, pendulum, spin, pulse, heartbeat, blink, strobe, flicker on transform and opacity, #1510) and read only our `.ecpreset`. Missing: Shapes, Synthetics, Image and more Text | Presets are how many designers start; tutorials assume them | 15–35 h (original presets; `.ffx` reading is out of clean-room scope) | G8 · [effects-parity.md](effects-parity.md) |
 | 8 | **Mask and shape bugs** | Open: #1004 mask vertex multi-select, #999 auto-pan, #1042 / #1033 vertex nodes under the bounding box, #959 / #960 shape group toggles and operators. Now closed: #510, #513, #527, #509, #303, #553, #932 (Convert To Bezier Path on a shape layer's parametric path) | Masks are core compositing | 10–20 h | G2 · [target-app-parity.md](target-app-parity.md) |
-| 9 | **Effect behaviour bugs** | #580, #463 Curl Noise, #369 Motion Tile output size, #943 Turbulent Displace Evolution, #473 Cryptomatte selection (quoted names with commas fixed, 3b7f1ace; UI and GPU time open), #474 multi-layer EXR (decode shared, faffad3a; f16 storage and cache sizing open). Closed: #526, #514, #533–#536 | Each one breaks a look someone built | 10–20 h | G1/G2 · [effects-parity.md](effects-parity.md) |
+| 9 | **Effect behaviour bugs** | #580, #463 Curl Noise, #369 Motion Tile output size, #943 Turbulent Displace Evolution, #473 Cryptomatte selection (quoted names with commas fixed, 3b7f1ace; the viewer eyedropper added; GPU time open), #474 multi-layer EXR (one decode per frame for picture and channels, byte-bounded cache; f16 storage still to do). Closed: #526, #514, #533–#536 | Each one breaks a look someone built | 10–20 h | G1/G2 · [effects-parity.md](effects-parity.md) |
 | 10 | **Colour pipeline differences** | #340 ProRes 4444 tagged bt709 but sRGB-encoded (open); ACES 2.0 / OCIO 2.5 configs (26.5) missing; now closed: #494 32-bpc blend modes, #495 and #750 Working Gamma 2.4, #546 / #547 viewer colour | Wrong colour in delivery is a client-visible failure | 15–30 h | G1 · [file-format-parity.md](file-format-parity.md) |
-| 11 | **Text rendering and layout** | Open: #453 CJK text in comps, #316 paragraph alignment inverted (maintainers' tests show Left/Right correct; asked for a project), #417 soft at Fit (mostly fixed by #444), #550 toolbar font options. Closed: #483, #583 | Text is in almost every motion graphic | 10–20 h | G2 · [ui-parity.md](ui-parity.md) |
+| 11 | **Text rendering and layout** | #453 CJK text in comps: the Han fallback now reaches the installed Chinese faces; open: #316 paragraph alignment inverted (maintainers' tests show Left/Right correct; asked for a project), #417 soft at Fit (mostly fixed by #444), #550 toolbar font options. Closed: #483, #583 | Text is in almost every motion graphic | 10–20 h | G2 · [ui-parity.md](ui-parity.md) |
 | 12 | **3D interaction and depth** | No 3D transform gizmos (#392, #347); camera aperture (#260); reflections (#261); extruded surface materials beyond Front / Bevel / Side / Back Color (fb5a5e9a; #315 closed); #307 reopened (the viewer's renderer button now shows and switches the renderer, #645); Z position (#489) closed | Advanced 3D is After Effects' growth area since 2023 | 20–35 h | G2 · [ui-parity.md](ui-parity.md) |
 | 13 | **3D model formats and materials** | After Effects 26 imports FBX, USD/USDZ, STL besides glTF and OBJ (`usd_plugins`), and Substance 3D materials with mesh displacement (26.0–26.2); we read glTF, OBJ, STL (binary and ASCII, with facet colours) and FBX 7.x (binary and ASCII: meshes, hierarchy, Lambert/Phong materials and textures; no FBX animation or skinning yet) | Product shots and 3D scenes come as FBX/USDZ | 25–45 h | — · [file-format-parity.md](file-format-parity.md) |
 | 14 | **Object Matte** (26.2, disk cache in 26.5) | First slice (#783): the Object Matte effect (Effect ▸ Matte) and `objectMatte.apply` turn a point (and optional box) on a reference frame into a matte and follow the object up to 600 frames each way, or segment every frame on its own; Roto Brush's engine, cache and model (MobileSAM from Settings ▸ Roto Brush, classical graph cut without it). Since then: the Object Matte tool in the viewer (click / drag a box, hover crosshair), the box as the model's box prompt, background tracking with progress and cancel, Freeze, and segmentations kept in the disk cache (26.5). Missing: a comparison with After Effects ([plan](fidelity/object-matte.md)) | The new one-click roto | 10–20 h | G7 · [target-app-parity.md](target-app-parity.md) |
 | 15 | **Hardware video decode and encode** | No VideoToolbox, NVENC, Quick Sync or VA-API; #498 asks for it (answered: CUDA / NVENC need Nvidia's proprietary SDK through FFI, which the no-`unsafe` rule forbids); open PR #819 adds hardware decoding via `filmcraft-platform`; FilmCraft has VideoToolbox / NVENC / VA-API paths to borrow | 4K playback and export speed | 25–45 h | G5/G6 · [hardware-parity.md](hardware-parity.md) |
-| 16 | **Localization depth** | Menus in 10 languages (ja, zh-hans, zh-hant, uk, es, pt-br, ru, fr, de, cs: 624 rows each); panels in 6 (ja, zh-hans, zh-hant, uk, pt-br, cs); effect names translated in Simplified Chinese (306, plus the generated Effect menu), their ~1,650 parameter names untranslated; Korean and Italian (After Effects ships them) absent; Hangul probe added (#599 closed) | After Effects is used heavily in Japan, China, Korea, Brazil, Europe | 60–110 h + native review | G9 · [localization-parity.md](localization-parity.md) |
-| 17 | **Media Browser lists files import refuses** | `media_browser.rs` lists AVI; `media::is_importable` has none of them (Targa and Radiance HDR import since #745; DPX and Cineon since #756, log shown as stored: no Cineon Settings conversion yet; MXF OP1a / OP-Atom since #767; FilmCraft has no AVI demuxer); #431 and #324 closed | Confusing failures on common VFX formats | 15–30 h | G6 · [file-format-parity.md](file-format-parity.md) |
+| 16 | **Localization depth** | Menus in 11 languages (ja, zh-hans, zh-hant, uk, es, pt-br, ru, fr, de, cs, ka: 630 rows each, 629 in Georgian); panels in 7 (ja 996 rows, zh-hans 998, zh-hant 951, uk 524, pt-br 695, cs 518, ka 885); effect names translated in Simplified Chinese (308), Traditional Chinese (308, plus 21 categories), Japanese (297) and Georgian (308, plus the generated Effect menu), their ~1,650 parameter names untranslated; Korean and Italian (After Effects ships them) absent; Hangul probe added (#599 closed) | After Effects is used heavily in Japan, China, Korea, Brazil, Europe | 60–110 h + native review | G9 · [localization-parity.md](localization-parity.md) |
+| 17 | **Media Browser lists files import refuses** | The Media Browser, the import and proxy dialogs and `media::is_importable` share one movie list since #1701, AVI included (Targa and Radiance HDR import since #745; DPX and Cineon since #756, log shown as stored unless Interpret Footage ▸ Cineon Settings converts it; MXF OP1a / OP-Atom since #767; AVI since #1701, without DV, MPEG-4 Part 2 or other legacy codecs yet); #431 and #324 closed | Confusing failures on common VFX formats | 15–30 h | G6 · [file-format-parity.md](file-format-parity.md) |
 | 18 | **Relative paths and relinking** | Projects store absolute footage paths; no relink when a project moves | Moving or sharing a project breaks it | 6–12 h | G4 · [file-format-parity.md](file-format-parity.md) |
-| 19 | **Plug-in ecosystem** | No After Effects SDK hosting (#600, #327 OpenFX, #334, #376 plug-in manager); our WebAssembly API has no third-party plug-ins | Many pro projects depend on Trapcode, Element, Saber… | 40–80 h for API growth; SDK hosting needs an owner decision | G8 · [scripting-parity.md](scripting-parity.md) |
-| 20 | **Multi-monitor and video output** | #486: any panel can move into a native window of its own (panel menu ▸ Move Panel to New Window, `window.panelWindow`) and so onto another screen, restored with the workspace; still missing: dragging tabs between those windows, app shortcuts while one has the focus, named workspaces remembering them, Mercury Transmit to video hardware (we have a second preview window only) | Two-screen setups are standard for professionals | 10–20 h | G2 · [hardware-parity.md](hardware-parity.md) |
+| 19 | **Plug-in ecosystem** | No After Effects SDK hosting (#600, #327 OpenFX, #334); our WebAssembly API has no third-party plug-ins yet. The Plug-in Library (#376) installs community WebAssembly effects from one reviewed catalog, which is still empty | Many pro projects depend on Trapcode, Element, Saber… | 40–80 h for API growth; SDK hosting needs an owner decision | G8 · [scripting-parity.md](scripting-parity.md) |
+| 20 | **Multi-monitor and video output** | #486: on Windows, macOS and X11 every floating panel is an OS window of its own (Undock Panel, a drag out of the main window, panel menu ▸ Move Panel to New Window, `window.panelWindow`) and so can go onto another screen (on Wayland, the web and in embedded viewports floating panels stay in the app window, since Wayland reports no window positions); tabs and groups drag between windows, shortcuts work in them, and the current and named workspaces restore their places; still missing: Mercury Transmit to video hardware (we have a second preview window only) | Two-screen setups are standard for professionals | 10–20 h | G2 · [hardware-parity.md](hardware-parity.md) |
 | 21 | **Small 26.x features** | Proportional Scrubbing (26.2), pasting Illustrator's own clipboard data as shapes (26.3; SVG markup on the clipboard pastes as a shape layer, #738), variable-font filter (26.3), the rebuilt Effect Controls (26.5). Percentage guides (View ▸ Add Percentage Guide, Convert Guides to Percentage / Pixels) and effect colour labels (Effect Controls header bar and right-click Label menu, `effect.setLabel`) are in (#1095), built from the release notes' one-line descriptions and never compared with After Effects: the Timeline's effect rows wear the label as a colour bar on the left edge (#1509), but After Effects' exact UI there is unknown | Users of the current version expect them | 10–20 h left | — · [ui-parity.md](ui-parity.md) |
 | 22 | **Encoder efficiency** | HEVC / AV1 have no B-frames, multi-reference or SAO / CDEF; Opus no FEC / DTX; single-file intermediates are 8-bit uncompressed QuickTime only (#372 closed by #778: no 16-bpc, AVI or lossless-compressed codec); #325 render over existing file | Larger files than After Effects + Media Encoder | 20–40 h | G6 · [file-format-parity.md](file-format-parity.md) |
 | 23 | **Essential Graphics interchange** | Templates are `.ectemplate`, not `.mogrt`; #338 and #611 closed | Premiere editors can't use our templates | 15–30 h | — · [file-format-parity.md](file-format-parity.md) |
 | 24 | **Timeline depth requests** | #601 expand precomps in place, #602 reorderable render stack, #604 guide-only effects, #425 keyframe confusion (#355 and #428 closed) | Power-user speed | 15–30 h | G2 · [ui-parity.md](ui-parity.md) |
-| 25 | **Accessibility** | AccessKit is enabled in eframe and tests read focus labels; the Project panel has After Effects' arrow-key navigation and named, stateful AccessKit nodes (#776), but the other panels have had no screen-reader pass or keyboard navigation audit, and there is no contrast check | Excludes users; After Effects supports screen readers poorly too | 15–30 h | G9 · [ui-parity.md](ui-parity.md) |
+| 25 | **Accessibility** | AccessKit is enabled in eframe. `ui_accessibility_audit` walks the AccessKit tree and counts unnamed or roleless controls per panel; Project (#776), Effects & Presets, Settings (every page), the Render Queue with its Templates dialog, Info, the Flowchart, the Script Console and the 3D Camera Tracker block of Effect Controls are at zero and held there, with named, stateful nodes, arrow-key, Home / End, Enter and Space operation of their lists and graph (#1335). Panels that only paint (Info, the tracker's status line) expose what they show as read-outs, and the Script Console's output as a log; each fixed scenario must show a minimum number of controls or read-outs, so zero cannot mean "looked at nothing". The other 25 or so panels are counted but not fixed (the Timeline alone has about 55 unnamed controls; the baseline in the test shows each); the Lumetri Scopes, Tracker, Layer, Waveform (a Timeline drawing) and the panels sharing `panel_kit` were left for when the open PRs on their files land. The shared-loop panels squeezed to nothing by the panels opened before them (Scopes, Media Browser, Metadata, Content-Aware Fill) read "zero" in the audit without being looked at. `ui_contrast` checks the theme tokens against WCAG 2: 13 of 48 pairs fall short (primary-button text, error text, control borders, the whole Light theme's warning colour). **No screen reader has been run on any panel**: the tree is checked, not how NVDA, VoiceOver or Orca speak it. Not covered: keyboard-only operation of the other panels, focus order across panels, colour-blindness, text size, reduced motion. App shortcuts pause while any widget has keyboard focus (egui), so Ctrl+Z does nothing with a list row focused | Excludes users; After Effects supports screen readers poorly too | 10–22 h (two slices, about 6 h, done) | G9 · [ui-parity.md](ui-parity.md) |
 
 ## Where we're going: workstreams in priority order
 
@@ -133,6 +133,12 @@ The most important missing piece: it turns every other estimate here into a meas
   the prompt, with their layers, in one undo step, for single items, multiple selections and
   folder contents. Nothing happens with an empty selection, in other panels, while typing or with
   a dialog open, and the next Delete still asks.
+- Regression evidence for [#947](https://github.com/storytold/effectcraft/issues/947): the
+  preview startup tests in `ui_audio_scrub`, checked headlessly on Windows with a fake output
+  device, start an audible preview on an uncached comp. The playhead holds the first frame until
+  the frames ahead are cached, the sound starts at that frame (from 0 s and from 1 s, also for a
+  30 s work area), and a tone lasting only the first 100 ms reaches the output. Video off still
+  starts at once, no device plays the picture, and Stop while preparing leaves nothing playing.
 - Regression evidence for [#612](https://github.com/storytold/effectcraft/issues/612): the
   `ui_gradient_value` and `ui_gradient_editor` input tests, checked headlessly on Windows, open
   the Gradient Editor from the Timeline's "Edit Gradient…" on a shape layer's Gradient Fill. They
@@ -163,6 +169,11 @@ The most important missing piece: it turns every other estimate here into a meas
   a Radial Stroke swatch on a selected shape layer and get the Gradient Editor on its Gradient Fill
   / Gradient Stroke Colors (OK saves); without such a gradient the swatch still opens the options,
   and the words, Solid swatches and Alt-click are unchanged.
+- Regression evidence for [#1306](https://github.com/storytold/effectcraft/issues/1306) (from
+  #1072): the `ui_expression_values` tests, checked headlessly on Windows, read the colour the
+  values are painted in. Expression-driven vectors, angles and scalars are red in the Timeline,
+  Effect Controls and Properties panel, in dark and light themes, hovered too; disabled, removed
+  and empty expressions show the ordinary colour.
 - Regression evidence for the reports of 6 October, checked headlessly on Windows: real pointer
   drags in `ui_drag_drop` (Project items into the Timeline between layers and at a time, and onto
   the viewer; an effect onto a layer in the viewer: #85, #88, #89), `ui_render_queue` (a template
@@ -224,7 +235,7 @@ The most important missing piece: it turns every other estimate here into a meas
 
 Kept from the 5 October assessment's "Real-user experience" row, as evidence of what users hit and what was fixed:
 
-Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the viewer snaps back, panels can't be resized or rearranged, drag-and-drop and double-click import don't work, layer rename gets stuck, the Layer Settings arrow does nothing, the Project panel clips, the Wayland window icon is generic. Issues #63–#68 (macOS, 5 October): scaling a layer by its handles goes wrong and can stick at 0, two 3D compasses, the viewer lags while a layer is dragged (a frame renders in 20 ms but showed after ≈ 100 ms, behind RAM preview prefetch), the Discord and other links do nothing, Delete doesn't delete in the Project panel, hidden layers can be selected in the viewer. All but the last two were fixed or confirmed fixed with a test on 5–6 October (those two have community PRs); file drops still can't work on Wayland (winit has no support). The panning, rename and arrow bugs had been fixed in v0.2.0 already; nobody had told the reporter. A Windows user (6 October, on Discord) found the font menus listed only the three bundled fonts: installed fonts were read only when a project asked for one, on every platform. Fixed with a regression test on 6 October; the menus now list every installed family and its own styles, and agents get `text.fonts` / `list_fonts`. Seven reports of 6 October (Linux .deb and Windows): Project items and files couldn't be dropped on the viewer (#85), nor effects on a layer there (#88); drops in the Timeline ignored where they landed (#89); an angle's revolutions couldn't be edited (#93); toggling Audio, Lock or Shy threw away the RAM preview and playback with audio skipped frames (#103); running out of video memory panicked every frame thread and left frames stuck (#106); choosing a Render Settings template in the Render Queue did nothing (#117: any popup menu moved up to fit the window closed on the press). All seven were fixed with regression tests on 7 October. Reports of 7 October (Linux, macOS, Windows): the app opened the demo project on every launch, so a new comp landed in it (#204); a comp wider than the GPU's texture limit (11000 × 2200) at Full resolution stopped the window drawing (#201); an Intel HD Graphics 5500 couldn't start the app (#198: most likely the window's device asked for limits that GPU doesn't have, and the failure was silent); Audio Spectrum / Waveform stood still in the viewer (#209) and preview sound waited for the whole work area to cache (#208); a layer couldn't be deselected from the time graph, a shape layer's Fill and Stroke showed only with a shape tool and a drawn shape had no stroke to change, Alt+Shift+P didn't reveal Position (#205); a mask selected in the Timeline wasn't selected in the viewer, Mask Feather had no link and took negative values, the Project panel had no selection box (#203); shape layers had no Add menu for Trim Paths and the other operations, and Classic 3D comps hid Geometry Options (#206); dragging Puppet pins re-rendered the layer under the Puppet at every move (#212). All were fixed with regression tests the same day (#219–#222); the #198 fix couldn't be checked on that GPU. Reports of 8 October (browser, Windows, macOS): an empty project at 1280 × 800 with device pixel ratio 2 crashed on its first frame, because the Project panel's scroll bar clamped its thumb to a track shorter than the thumb (#231, any short panel on every platform); Media Browser ▸ Add Files… dropped a file it couldn't read without a word (#226); after the page's WebGPU device was lost, the browser editor froze on its last frame while edits went on (#225); a press in the viewer always took the topmost layer, so a selected layer behind others couldn't be dragged (#230); the language didn't follow the system's (#229); and a list of missing After Effects behaviour (#227): drawing into, copying, pasting and duplicating shape contents, Tool Creates Shape / Mask and Fill / Stroke Options, Turbulent Displace, Wave Warp and Bulge pinning all but a shape layer's bottom-right quadrant, a Spacebar hold that previewed instead of being the Hand tool, the Effect menu in Effect Controls, dropping items on New Composition and dragging over layer switches. All were fixed with regression tests the same day (#235, #237–#241); multi-monitor support and the Project panel's empty-area menu (community PR #210) remain from #227, and effect points on shape and text layers still sit half a comp off. A list of tweaks from an Intel iMac (#290): the layer bar didn't show where extended footage runs past its source, and Enable Time Remapping then ended at the extended out point; footage items had no Interpret Footage in their menu and the work area bar no menu; Label menus named the labels without their colours; the arrow keys didn't nudge layers; a straight motion path had no Bezier handles; Delete on Time Remap deleted the layer; a mask being drawn with the Pen blacked out its layer until it was closed; a double-click on a mask point didn't select the whole mask. All were fixed with regression tests the same day; the rest of #290 had been fixed already (#221, #238, #255) or came with community PRs #210 (the Timeline's empty-area menu) and #213 (tool flyouts on a long press). A report of 9 October (#397): CC Particle World ignored the comp camera and looked flat. It now sees its particles through an active camera layer, as After Effects does, and through its own Extras ▸ Effect Camera (Distance, Rotation X / Y / Z, FOV, added) otherwise; the layer cache also missed camera and light moves for the effects that read them (Card Dance, Shatter, Card Wipe, Caustics). Fixed with regression tests the same day. Most checking happens on macOS. Localisation covers the menus in Japanese, Simplified and Traditional Chinese, and Ukrainian, and since 9 October the cataloged panels, dialogs and tooltips too (Simplified and Traditional Chinese, and Ukrainian; the Japanese rows of the panel catalog are still open); no accessibility work
+Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the viewer snaps back, panels can't be resized or rearranged, drag-and-drop and double-click import don't work, layer rename gets stuck, the Layer Settings arrow does nothing, the Project panel clips, the Wayland window icon is generic. Issues #63–#68 (macOS, 5 October): scaling a layer by its handles goes wrong and can stick at 0, two 3D compasses, the viewer lags while a layer is dragged (a frame renders in 20 ms but showed after ≈ 100 ms, behind RAM preview prefetch), the Discord and other links do nothing, Delete doesn't delete in the Project panel, hidden layers can be selected in the viewer. All but the last two were fixed or confirmed fixed with a test on 5–6 October (those two have community PRs); file drops still can't work on Wayland (winit has no support). The panning, rename and arrow bugs had been fixed in v0.2.0 already; nobody had told the reporter. A Windows user (6 October, on Discord) found the font menus listed only the three bundled fonts: installed fonts were read only when a project asked for one, on every platform. Fixed with a regression test on 6 October; the menus now list every installed family and its own styles, and agents get `text.fonts` / `list_fonts`. Seven reports of 6 October (Linux .deb and Windows): Project items and files couldn't be dropped on the viewer (#85), nor effects on a layer there (#88); drops in the Timeline ignored where they landed (#89); an angle's revolutions couldn't be edited (#93); toggling Audio, Lock or Shy threw away the RAM preview and playback with audio skipped frames (#103); running out of video memory panicked every frame thread and left frames stuck (#106); choosing a Render Settings template in the Render Queue did nothing (#117: any popup menu moved up to fit the window closed on the press). All seven were fixed with regression tests on 7 October. Reports of 7 October (Linux, macOS, Windows): the app opened the demo project on every launch, so a new comp landed in it (#204); a comp wider than the GPU's texture limit (11000 × 2200) at Full resolution stopped the window drawing (#201); an Intel HD Graphics 5500 couldn't start the app (#198: most likely the window's device asked for limits that GPU doesn't have, and the failure was silent); Audio Spectrum / Waveform stood still in the viewer (#209) and preview sound waited for the whole work area to cache (#208); a layer couldn't be deselected from the time graph, a shape layer's Fill and Stroke showed only with a shape tool and a drawn shape had no stroke to change, Alt+Shift+P didn't reveal Position (#205); a mask selected in the Timeline wasn't selected in the viewer, Mask Feather had no link and took negative values, the Project panel had no selection box (#203); shape layers had no Add menu for Trim Paths and the other operations, and Classic 3D comps hid Geometry Options (#206); dragging Puppet pins re-rendered the layer under the Puppet at every move (#212). All were fixed with regression tests the same day (#219–#222); the #198 fix couldn't be checked on that GPU. Reports of 8 October (browser, Windows, macOS): an empty project at 1280 × 800 with device pixel ratio 2 crashed on its first frame, because the Project panel's scroll bar clamped its thumb to a track shorter than the thumb (#231, any short panel on every platform); Media Browser ▸ Add Files… dropped a file it couldn't read without a word (#226); after the page's WebGPU device was lost, the browser editor froze on its last frame while edits went on (#225); a press in the viewer always took the topmost layer, so a selected layer behind others couldn't be dragged (#230); the language didn't follow the system's (#229); and a list of missing After Effects behaviour (#227): drawing into, copying, pasting and duplicating shape contents, Tool Creates Shape / Mask and Fill / Stroke Options, Turbulent Displace, Wave Warp and Bulge pinning all but a shape layer's bottom-right quadrant, a Spacebar hold that previewed instead of being the Hand tool, the Effect menu in Effect Controls, dropping items on New Composition and dragging over layer switches. All were fixed with regression tests the same day (#235, #237–#241); multi-monitor support and the Project panel's empty-area menu (community PR #210) remain from #227, and effect points on shape and text layers still sit half a comp off. A list of tweaks from an Intel iMac (#290): the layer bar didn't show where extended footage runs past its source, and Enable Time Remapping then ended at the extended out point; footage items had no Interpret Footage in their menu and the work area bar no menu; Label menus named the labels without their colours; the arrow keys didn't nudge layers; a straight motion path had no Bezier handles; Delete on Time Remap deleted the layer; a mask being drawn with the Pen blacked out its layer until it was closed; a double-click on a mask point didn't select the whole mask. All were fixed with regression tests the same day; the rest of #290 had been fixed already (#221, #238, #255) or came with community PRs #210 (the Timeline's empty-area menu) and #213 (tool flyouts on a long press). A report of 9 October (#397): CC Particle World ignored the comp camera and looked flat. It now sees its particles through an active camera layer, as After Effects does, and through its own Extras ▸ Effect Camera (Distance, Rotation X / Y / Z, FOV, added) otherwise; the layer cache also missed camera and light moves for the effects that read them (Card Dance, Shatter, Card Wipe, Caustics). Fixed with regression tests the same day. Most checking happens on macOS. Localisation covers the menus in Japanese, Simplified and Traditional Chinese, and Ukrainian, and since 9 October the cataloged panels, dialogs and tooltips too (Simplified and Traditional Chinese, and Ukrainian; the Japanese rows of the panel catalog are still open); accessibility is gap 25
 
 ### G3. Stability and a green main
 
@@ -238,7 +249,7 @@ Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the vie
   runs via `EFFECTCRAFT_FUZZ_ITERS` / `EFFECTCRAFT_FUZZ_SECS`). It found one crash, deeply nested
   XML overflowing the stack, now refused. Imported media and documents, expressions, scripts and
   control-channel / MCP requests are still to do.
-- Run the gate on every pull request in CI (gap 4): today no workflow runs the tests on PRs.
+- Keep the CI gate (gap 4, #2204) the same as `cargo xtask ci`: it runs on every pull request and push to `main`.
 - Fix the open crash reports first (gap 3). Further fuzzing and crash fixes are open in PR #855.
 - Done when: the gate is green on stable, runs on every pull request, and the fuzzers run
   regularly without new crashes.
@@ -255,6 +266,12 @@ Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the vie
   The second means reading another implementation of the format, which AGENTS.md rules out
   unless the clean-room scope allows it.
 - Also in this area: relative footage paths and relinking when a project moves (gap 18).
+- Placed PDF / Illustrator footage of an `.aep` is framed as After Effects places it (the ArtBox
+  clipped to the crop box, `/Rotate` ignored) and drawn to fill the size After Effects stored
+  (#3099), measured with hand-written PDFs named `.ai`. Not yet measured: files saved by
+  Illustrator itself (artboards, bleed, art past the artboard, private data), a CropBox without
+  an ArtBox, `.pdf` names, and EPS files (they keep their bounding box at their own size, not
+  the placed framing).
 - Done when: the decision is recorded and, if approved, a corpus of real-world-shaped projects
   opens with its comps, layers, keyframes, effects and expressions intact.
 
@@ -295,12 +312,23 @@ Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the vie
 - After Effects SDK plug-ins cannot run in EffectCraft. Our own WebAssembly plug-in API exists
   ([plugins.md](plugins.md)). Grow it: documentation, examples, and original effects that cover
   what the most common third-party plug-ins are used for (particles, glows, 3D objects, sabers).
+  Settings ▸ Plug-in Library installs, updates and removes community WebAssembly effects listed
+  in one reviewed catalog ([plugins.md](plugins.md#plug-in-library), #376); the catalog
+  repository still has to be created and filled.
+- Native plug-in formats (OpenFX first) run only in **external effect helpers**, separate
+  processes behind a safe, versioned protocol ([external-helpers.md](external-helpers.md),
+  [ADR 0001](adr/0001-external-effect-helpers.md)): the core gains no native code and no
+  `unsafe`, and a crashing plug-in is an error on the effect. The helpers themselves ship
+  separately.
 - Features that come from third parties in After Effects are extensions in EffectCraft too, built
   on the same extension points as After Effects: scripts, ScriptUI panels and effect plug-ins
   ([plugins.md](plugins.md#extension-points-compared-with-after-effects) compares them). ScriptUI
   panels in the user's ScriptUI Panels folder are listed in the Window menu, dock like any panel
-  and open again at the next launch. Missing: the Startup and Shutdown script folders, keyboard
-  shortcuts for scripts and `.jsxbin`; `#include` / `#target` directives landed (#759,
+  and open again at the next launch. The scripts in the Startup folder run at launch, and the desktop
+  app runs the Shutdown folder's scripts as it quits. Each File ▸ Scripts entry can be given a key in
+  Edit ▸ Keyboard Shortcuts. Missing: a global scope that scripts share for the session (a Startup
+  script's variables and functions are not available to later scripts) and `.jsxbin`;
+  `#include` / `#target` directives landed (#759,
   [scripting-parity.md](scripting-parity.md)).
 - Done so far: ease presets (#254) cover what ease-curve plug-ins are used for: easing curves kept
   by name and applied to pairs of keyframes. Modelled on a third-party panel, they are not core: a
@@ -313,8 +341,8 @@ Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the vie
 
 - Localisation of the interface ([localization-parity.md](localization-parity.md)): since 6–12
   October the menus are translated into Japanese, Simplified and Traditional Chinese, Ukrainian,
-  Spanish, Brazilian Portuguese, Russian, French, German and Czech, and the panel catalog covers
-  Japanese, both Chinese, Ukrainian, Brazilian Portuguese and Czech. Next: effect and parameter
+  Spanish, Brazilian Portuguese, Russian, French, German, Czech, Georgian and Swedish, and the panel catalog covers
+  Japanese, both Chinese, Ukrainian, Brazilian Portuguese, Czech, Georgian and Swedish. Next: effect and parameter
   names, the remaining panel strings (Spanish, Russian, French, German), Korean and Italian, and
   native-speaker review of all of them.
 - Accessibility (keyboard navigation, screen readers, contrast), user documentation and
@@ -335,7 +363,9 @@ Issues #41–#47 (all from the Linux AppImage 0.1.1, 5 October): panning the vie
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-27 | minor | Gap 19 / G8: the Plug-in Library (#376) installs, updates and removes community WebAssembly effects from one reviewed catalog; up to 256 plug-in effects per session |
 | 2026-10-16 | minor | Gap 8: #932 closed (Convert To Bezier Path converts a shape layer's parametric path, not only mask RotoBezier) |
+| 2026-10-13 | minor | Gap 25: an AccessKit audit test (per-panel counts, a ratchet for the unfixed panels) and a theme contrast test; Effects & Presets, Settings and Render Queue named and keyboard-operable (#1335); no screen reader tested |
 | 2026-10-13 | patch | G2: layer bounds no longer compete with editable shape/mask path points (#1220) |
 | 2026-10-12 | minor | Audited against `upstream/main` 470ea7a3: open-issue count and crash list, closed issues removed from rows 1, 3, 5, 6, 8–12, 15–17, 22–24, G8 and G9 (#759 `#include`), localization catalogs recounted (≈ 12% to ≈ 18%); rows 7, 14 and 21 left to open PRs #1102, #792 and #1098 |
 | 2026-10-10 | minor | Alpha gate checked: no alpha blockers |
diff --git a/docs/hardware-parity.md b/docs/hardware-parity.md
index 0a0a85a97..998fe4453 100644
--- a/docs/hardware-parity.md
+++ b/docs/hardware-parity.md
@@ -1,6 +1,6 @@
 # Hardware parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (closed issue references re-audited against `upstream/main` 470ea7a3) · **Target:** Adobe After Effects 2026
+> **Last reviewed:** 2026-10-29 · **Last updated:** 2026-10-29 · **Change:** minor (Content-Aware Fill's PatchMatch and flow search on the GPU) · **Target:** Adobe After Effects 2026
 
 Each piece of hardware After Effects uses, per platform, against EffectCraft. Ours comes from the
 code at `origin/main` 1446e27 (`crates/gpu`, `crates/render`, `crates/ui-egui`) and the issue
@@ -14,6 +14,7 @@ monitors are missing, and two GPU start-up failures are open.
 | Feature | After Effects 2026 | EffectCraft macOS | Windows | Linux | Web | Notes / evidence |
 |---|---|---|---|---|---|---|
 | GPU compositing and effects | Mercury GPU (Metal; CUDA / OpenCL / DirectX on Windows) | yes, Metal via wgpu | Vulkan yes; **Direct3D 12 fails** (FXC can't compile the `pointwise` kernel, #613) | Vulkan | WebGPU, in frame workers | 280 of 306 effects on the GPU, checked against the CPU renderer; Fractal and the analysis/tool effects stay on the CPU ([effects-parity.md](effects-parity.md)) |
+| GPU analysis | GPU-accelerated Content-Aware Fill | Content-Aware Fill's PatchMatch **and** flow block matching on the GPU (`Gpu::inpaint`); every other stage on the CPU | same | same | no (needs synchronous readback) | On an Intel Arc iGPU a four-frame 1920 × 1080 fill is ≈ 1.4× faster than the CPU's (PatchMatch is the dominant win, the flow search a smaller one), and even a 16 × 16 hole at 1920 × 1080 is ≈ 1.9× faster — the CPU's own stages are O(frame), not O(hole). The device's flow field matches `block_flow` to a float rounding. The membrane and the flow's hole completion stay on the CPU: both are bandwidth-bound, and the device's full-frame transfers cost more than they save — see `effectcraft_gpu::inpaint` |
 | CPU fallback and device-loss recovery | yes | yes | yes; Windows ARM64 Adreno panic after device loss (#591, closed) | yes | yes (#225 fixed) | Out of video memory falls back to the CPU (#106) |
 | GPU detection and choice | GPU info, renderer choice | Backend Auto per comp | "GPU isn't being detected" (#596, closed); Intel HD 5500 fix unverified (#198) | yes | yes | No settings page listing adapters yet |
 | Multi-core rendering | Multi-Frame Rendering | rayon pools; preview scheduler sized to the render pool | same | same | Web Workers, one engine per worker | No benchmark against Multi-Frame Rendering |
@@ -23,7 +24,7 @@ monitors are missing, and two GPU start-up failures are open.
 | HDR display | HDR monitoring on EDR / HDR displays | tone-mapped SDR view; no EDR output | no HDR output | no | no | Colour engine handles HDR maths (Rec. 2100 PQ/HLG output files) |
 | Pen tablets (pressure, tilt) | yes, for Paint and Roto | Brushes panel has pressure options, but no tablet pressure is read | same | same | same | Paint strokes store pressure per vertex; input never fills it |
 | Multiple monitors | panels and windows across screens | panels move into their own native windows on any screen (Move Panel to New Window; desktop builds) | same | same (#486) | — | gap 20 |
-| Touch / trackpad gestures | pinch zoom in viewers | egui pointer and scroll; no pinch-to-zoom audited | — | — | — | — |
+| Touch / trackpad gestures | pinch zoom in viewers | Composition and Layer viewers: two-finger scroll pans, pinch zooms around the pointer (Alt + scroll and the mouse wheel zoom too); Timeline pinch zooms time | two-finger scroll pans once it moves diagonally (a pixel-precise wheel keeps zooming); pinch arrives as Ctrl + scroll and zooms | same | same | No rotate or swipe gestures; tested in `ui_viewer_trackpad.rs` (UI logic, not on hardware) |
 | Audio hardware | Core Audio / ASIO / WASAPI, device choice, latency | cpal output; preview sound late after a start offset (#504 open; #554 closed) | cpal | cpal (ALSA) | Web Audio | No input or device latency settings |
 | Machine learning acceleration | Apple Neural Engine / GPU for Object Matte, Roto Brush 3 | CPU inference (pure Rust, rayon) | CPU | CPU | CPU | No GPU inference for MobileSAM or MediaPipe |
 | Memory management | RAM reserve, disk cache | RAM Reserved, Reduce Cache When Low on Memory, disk cache | same | same | OPFS disk cache | good |
@@ -39,5 +40,6 @@ the Adreno and Intel cases.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-29 | minor | Content-Aware Fill's PatchMatch and flow block matching run on the GPU (`FillBackend`/`Accelerator::inpaint`, `effectcraft_gpu::inpaint`) |
 | 2026-10-12 | minor | #591, #596 and #554 marked closed; #498 answer and open PR #819 |
 | 2026-10-10 | major | First hardware parity document |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index 5606a857d..b0a87120d 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,6 @@
 # Localization parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (catalogs recounted at `upstream/main` 470ea7a3: menus in 10 languages, panels in 6, Hangul probe (#599)) · **Target:** Adobe After Effects 2026
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-11-03 · **Change:** Traditional Chinese (`zh-hant`) effect names are complete: 308 names and 21 categories (#2037). Previously: minor (Polish (`pl`): menus 630, panels 695; recounted at this tree after #1774: Japanese 1,923 of ≈ 4,200 interface strings (46%, with 297 effect names), Simplified Chinese 1,935 (46%, with 307 effect names), Traditional Chinese 1,581 (38%, its panel catalog 951 rows after #2244); overall ≈ 24%; previously: minor, the panel/dialog catalogs grow by 303 rows in Japanese, Simplified Chinese and Traditional Chinese: panel tabs, form and dialog labels, context menus, tracker/graph/text-panel labels, credits and File-panel footers; previously: minor, catalogs recounted at `upstream/main` 470ea7a3: menus in 10 languages, panels in 6, Hangul probe (#599)) · **Target:** Adobe After Effects 2026
 
 How much of EffectCraft's interface is translated, language by language, compared with After
 Effects. [gaps.md](gaps.md) gap 16 and workstream G9 hold the work;
@@ -17,27 +17,38 @@ interface; Arabic and Hebrew text *in layers* is supported through its Middle Ea
 ## How EffectCraft translates
 
 - **Menus:** `crates/ui-egui/src/i18n.rs`, one catalog per language keyed by
-  `(command, English label)`. A test (`every_translation_key_exists_in_the_actual_menu_tree`)
-  fails if any fixed menu entry is untranslated or a row is stale, so every catalog covers all
-  fixed entries (624 catalog rows each at 470ea7a3, counted). The generated Effect menu is not part of that fixed tree: its entries
-  and category submenus take their labels from the effect catalog below.
+  `(command, English label)`. A test (`menu_catalogs_have_no_stale_or_duplicate_rows`) fails on a
+  row whose entry left the menu tree or on a repeated row, so every catalog covers all fixed
+  entries (630 catalog rows each at this tree, counted; 629 in Georgian). The generated Effect menu is not part of
+  that fixed tree: its entries and category submenus take their labels from the effect catalog
+  below.
 - **Panels, dialogs, buttons, tooltips:** `crates/ui-egui/src/i18n/ui.rs`, keyed by the English
-  source string, with English fallback. Catalogs exist for Japanese (410 rows), Simplified and
-  Traditional Chinese (506 each), Ukrainian (505), Brazilian Portuguese (400) and Czech (501);
-  counted at 470ea7a3.
+  source string, with English fallback. Catalogs exist for Japanese (996 rows), Simplified
+  Chinese (998), Traditional Chinese (951, after #2244 pruned the table), Ukrainian (524),
+  Brazilian Portuguese (695), Czech (518) and Spanish (513); counted at this tree. Georgian has
+  the Simplified Chinese catalog's 694 rows, plus 191 for panels converted to the catalog since
+  (885 in all). Swedish (added later) also has one.
 - **Effect names:** `crates/ui-egui/src/i18n/effects.rs`, keyed by **effect id**, in Simplified
-  Chinese (306 rows, one per effect in the registry, plus its 21 categories). The registry's
+  Chinese (308 rows, one per effect in the registry), Traditional Chinese (308 rows, plus its 21
+  categories), Japanese (297 of the 308 ids), Georgian (308 rows, plus its 21 categories) and
+  Swedish (308 rows, plus its 21 categories). The registry's
   English name stays the effect's identity: `effect.list`, `effect.apply {"effect": …}`, scripts
   and expressions match on it, and the property tree stores it as the effect group's name. Only
   the drawing — the Effect menu, Effect Controls, the Timeline and Effects & Presets — goes
   through the catalog, so a project file is identical whichever interface language opens it.
   A repeat (`Gaussian Blur 2`) keeps the index the engine appends, and a group the user renamed
   in Effect Controls stays verbatim. Adding a language there is two tables and one arm, and no
-  panel changes: Traditional Chinese and Japanese have their tables in place and empty, so those
-  languages draw English until a translator fills them (the Japanese set for #821 is what that
-  slot is for). Each language decides for itself which names stay English — Adobe's Japanese
-  interface leaves the `CC`, `VR` and `OCIO` sets in English while its Chinese one translates
-  them — so a row repeating the English name is a choice, not a missing row.
+  panel changes: Traditional Chinese now covers all 308 ids and 21 categories, and Japanese fills
+  297 of the 308 ids, so the rest draw English until a translator completes them. Each language
+  decides for itself which names stay English — Adobe's Japanese interface leaves the `CC`, `VR`
+  and `OCIO` sets in English while its Chinese one translates them — so a row repeating the English
+  name is a choice, not a missing row.
+- **Missing strings:** a string with no row in the interface language shows in English, and no
+  test, build or release fails on a missing translation. The `missing_translations_report` test
+  (`crates/ui-egui/src/i18n.rs`) prints, per language, the fixed menu entries, panel strings, effect
+  names and effect categories that have no row. It always passes; `cargo xtask ci` runs it with
+  `--nocapture`, so the list is in the gate log. Locally:
+  `cargo test -p effectcraft-ui-egui --lib missing_translations_report -- --nocapture`.
 - **Not translated anywhere yet:** effect *parameter* names (≈ 1,650, `crates/effects`),
   engine-generated text (property names, errors, undo labels), the Home screen's unwrapped
   literals (#574), Learn tutorials and documentation.
@@ -53,57 +64,69 @@ interface; Arabic and Hebrew text *in layers* is supported through its Middle Ea
 
 ## Measurement
 
-Measured 10 October 2026 at `origin/main` 1446e27 and recounted on 12 October at `upstream/main`
-470ea7a3 by counting catalog rows (`const` tables in `crates/ui-egui/src/i18n.rs` and
-`i18n/ui.rs`; menu rows 624 per language, so the share is computed from 624 rather than 618). The
-denominator, **≈ 3,900 user-visible strings**, was estimated on 10 October and is kept: 618 fixed menu entries + ≈ 1,320 capitalised UI
-literals in `crates/ui-egui/src` outside tests and catalogs (a regex count, so an upper bound) +
-≈ 1,650 distinct effect parameter names + 306 effect names. Engine messages are not counted, so
-the true percentages are slightly lower.
+Measured 10 October 2026 at `origin/main` 1446e27, recounted on 22 October 2026 at `ad8b6acb`,
+and recounted again at this tree after #1774 by counting catalog rows (`const` tables in
+`crates/ui-egui/src/i18n.rs`, `i18n/ui.rs` and `i18n/effects.rs`: 630 menu rows, 998
+panel/dialog sources in Simplified Chinese, 951 in Traditional Chinese and 996 in Japanese). The
+denominator, **≈ 4,200 user-visible strings**, is a rounded estimate: the 630 fixed menu entries,
+the 998 panel/dialog sources, 308 effect names, ≈ 1,650 distinct effect parameter names and
+≈ 620 other unwrapped interface strings (Home screen literals, engine-built tooltips, error and
+status messages). It counts distinct strings, not catalog rows; engine messages are only partly
+counted, so the true percentages are slightly lower.
 
 | Language | Code | UI strings translated | Dialogs / tooltips / help | Script support | Native review | Status | To `full` |
 |---|---|---|---|---|---|---|---|
-| English | `en` | ≈ 3,900 (100%, source) | All; docs in English | — | yes | full | — |
-| Simplified Chinese | `zh-hans` | 1,130 (≈ 29%): menus 624 rows, panels 506 | Panels and dialogs partly; no help, effect names translated (306) and their parameter names not; Home screen literals unwrapped (#574, closed) | System CJK fallback; Han follows the UI language; CJK text in comps renders wrongly (#453); IME in text layers | no | partial | 6–9 h + review |
-| Spanish | `es` | 624 (≈ 16%) | Menus only (panel catalog in open PR #996) | Latin, fine | no | menus only | 7–10 h + review |
+| English | `en` | ≈ 4,200 (100%, source) | All; docs in English | — | yes | full | — |
+| Simplified Chinese | `zh-hans` | 1,936 (≈ 46%): menus 630 rows, panels 998, effect names 308 | Panels and dialogs partly; no help, effect names translated and their parameter names not; Home screen literals unwrapped (#574, closed) | System CJK fallback; Han follows the UI language; CJK text in comps renders wrongly (#453); IME in text layers | no | partial | 6–9 h + review |
+| Spanish | `es` | 1,142 (≈ 29%): menus 629 rows, panels 513 | Menus only; the panel catalog from #996 | Latin, fine | no | partial | 9–12 h + review |
 | Hindi | `hi` | 0 | — | UI: Devanagari fallback font but no shaping; text layers shape Devanagari | no | none (After Effects: none) | 9–13 h + shaping in the UI |
 | Arabic | `ar` | 0 | — | UI: Arabic fallback font but no shaping and no RTL layout; text layers: bidi + shaping | no | none (After Effects: none) | 9–13 h + 15–25 h RTL UI |
-| French | `fr` | 624 (≈ 16%) | Menus only | Latin, fine | no | menus only | 7–10 h + review |
-| Portuguese (Brazil) | `pt-br` | 1,024 (≈ 26%): menus 624 rows, panels 400 | Panels and dialogs partly | Latin, fine | no | partial | 6–9 h + review |
+| French | `fr` | 2,124 (≈ 51%): menus 632 rows, panels 1,184, effect names 308 | Panels and dialogs at the source list of the other panel catalogs; effect names and their 21 categories; no help; machine-translated from the English, not yet native-speaker proofread | Latin, fine | no | partial | 2–4 h + review |
+| Portuguese (Brazil) | `pt-br` | 1,324 (≈ 34%): menus 629 rows, panels 695 | Panels and dialogs at the Chinese catalogs' source list; the six keys main added after that count are translated too; AI-assisted, not yet native-speaker proofread | Latin, fine | no | partial | independent native review |
 | Indonesian | `id` | 0 | — | Latin, fine | no | none (After Effects: none) | 8–12 h + review |
-| Japanese | `ja` | 1,034 (≈ 27%): menus 624 rows, panels 410 | Panels and dialogs partly | Japanese system fallback; vertical text and Tate-Chu-Yoko in text layers; IME | no | partial | 6–9 h + review |
+| Japanese | `ja` | 1,923 (≈ 46%): menus 630 rows, panels 996, effect names 297 | Panels and dialogs partly; no help, effect names translated for 297 of the 308 ids and their parameter names not; Home screen literals unwrapped (#574, closed) | Japanese system fallback; vertical text and Tate-Chu-Yoko in text layers; IME | no | partial | 6–9 h + review |
 | German | `de` | 624 (≈ 16%) | Menus only (open PR #666 adds interface translations) | Latin, fine | no | menus only | 7–10 h + review |
 | Korean | `ko` | 0 | — | Hangul fallback probe added (#599, closed); not checked on macOS here | no | none | 9–13 h + review |
 | Vietnamese | `vi` | 0 | — | Latin with stacked diacritics; untested | no | none (After Effects: none) | 8–12 h + review |
 
-Other languages EffectCraft ships (3):
+Other languages EffectCraft ships (6):
 
 | Language | Code | UI strings translated | Status | To `full` |
 |---|---|---|---|---|
-| Traditional Chinese | `zh-hant` | 1,130 (≈ 29%): menus 624 rows, panels 506 | partial | 6–9 h + review |
-| Ukrainian | `uk` | 1,129 (≈ 29%): menus 624 rows, panels 505 | partial | 6–9 h + review |
-| Czech | `cs` | 1,125 (≈ 29%): menus 624 rows, panels 501 | Existing catalog entries covered; unwrapped UI, effects and engine text still in English; AI-assisted, not yet native-speaker proofread | Remaining strings + independent native review |
+| Traditional Chinese | `zh-hant` | 1,889 (≈ 45%): menus 630 rows, panels 951, effect names 308 (+ 21 categories, not counted, as for the other languages) | partial; effect names complete, parameter names and engine text still in English | 3–5 h + review |
+| Ukrainian | `uk` | 1,153 (≈ 29%): menus 629 rows, panels 524 | partial | 6–9 h + review |
+| Polish | `pl` | 1,325 (≈ 34%): menus 630 rows, panels 695 | partial; unwrapped UI, effects and engine text still in English; AI-drafted, native review welcome | Remaining strings + native review |
+| Czech | `cs` | 1,147 (≈ 29%): menus 629 rows, panels 518 | Existing catalog entries covered; unwrapped UI, effects and engine text still in English; AI-assisted, not yet native-speaker proofread | Remaining strings + independent native review |
+| Georgian | `ka` | 1,822 (≈ 43%): menus 629 rows, panels 885 (the Simplified Chinese catalog's 694 plus 191 Georgian-only rows: form dialogs, context menus, column headers), effect names 308 + 21 categories; native-speaker reviewed | partial | 5–8 h |
+| Swedish | `sv` | menus 630 rows, panels 723, effect names 308 and categories 21; added after the measurement above | Settings, Edit menu and Match System (`sv-*` locales) offer it; parameter and engine text still in English; not yet native-speaker reviewed | Remaining strings + native review |
 
-Russian (`ru`) has a menu catalog (624 rows, ≈ 16%); After Effects also ships Italian, which EffectCraft does not (8–12 h).
+Russian (`ru`) has a menu catalog (630 rows, ≈ 15%); After Effects also ships Italian, which EffectCraft does not (8–12 h).
 
-**Overall: ≈ 18%**, the average coverage of After Effects' 10 non-English languages
-(Simplified and Traditional Chinese 29%, Japanese 27%, Brazilian Portuguese 26%, Spanish, French,
-German and Russian 16%, Korean and Italian 0%; 175 / 10, was ≈ 12% on 10 October). This is the localization row in
-[target-app-parity.md](target-app-parity.md#by-dimension).
+**Overall: ≈ 25%**, the average coverage of After Effects' 10 non-English languages
+(Simplified Chinese 46%, Traditional Chinese 45%, Japanese 46%, Brazilian Portuguese 34%,
+Spanish 29%, French, German and Russian 16%, Korean and Italian 0%; 248 / 10, was ≈ 24% before #2037's effect names and ≈ 21% on
+22 October; Ukrainian (≈ 29%) and Czech (≈ 29%) are EffectCraft-only and stay out of that
+average). This is the localization row in [target-app-parity.md](target-app-parity.md#by-dimension).
 
 **Effort.** One-time work first: route parameter names and engine messages through
 a catalog, wrap the remaining panel literals, and add a Hangul probe (10–20 h). Then each language
-needs ≈ 2,900 more strings (≈ 5–9 h per language at the pace of #398 and #401). Parity with After
-Effects' 10 non-English languages: **≈ 60–110 h**; the four extra languages of the standard list
+needs ≈ 2,600 more strings (≈ 5–9 h per language at the pace of #398 and #401). Parity with After
+Effects' 10 non-English languages: **≈ 60–110 h**; the four extra languages
 (Hindi, Arabic, Indonesian, Vietnamese) add ≈ 50–80 h, most of it right-to-left layout and
 complex shaping in the interface. Every language needs native-speaker review, which only a human
-can give; none has had it.
+can give; only Georgian, contributed by a native speaker (#1843), has had it.
 
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-12 | minor | Recounted: Russian, French, German and Czech menus (#873, #987), Brazilian Portuguese and Czech panels (#830, #987), Hangul probe (#599); overall ≈ 12% to ≈ 18%; Korean and Italian still absent |
-| 2026-10-10 | major | First localization parity document: catalog rows counted for all six languages, the twelve-language table, After Effects' 11 shipped languages from its bundle |
-| 2026-10-11 | minor | Ukrainian panel catalog brought level with the Chinese ones (495 of 496 rows, counted at this commit); its share rises to ≈ 29%. The other languages' panel counts are the 10 October measurement |
+| 2026-11-03 | minor | Traditional Chinese (`zh-hant`): effect names complete — 308 names and 21 categories (#2037); the menu and panel catalogs stay at 630 and 951 rows |
+| 2026-10-30 | minor | Recounted on the merged tree after #1774: Japanese 1,923 (46%, 297 effect names), Simplified Chinese 1,935 (46%, 307 effect names), Traditional Chinese 1,581 (38%, 951 panel rows after #2244's prune); overall ≈ 24% |
+| 2026-10-22 | minor | Panel/dialog second step: 300 more catalog rows in Japanese, Simplified Chinese and Traditional Chinese, plus the three rows the review found missing (Basic, Advanced and Play/Stop) — panel tabs, form and dialog labels, panel context menus, the tracker and graph controls, text-panel options, File-panel footers and credits; the panel tables are now 996 Japanese and 998 Simplified Chinese rows, all drawn through `tr`/`tr_args`, with the tests keeping the three catalogs listing the same sources; the 30 October recount above carries the share |
+| 2026-10-18 | minor | Brazilian Portuguese completes its panel catalog (278 new rows, 417 → 695, the Chinese catalogs' source list); the doc recount closes the drift the batch merges left in every language's panel count; AI-assisted, not yet native-speaker proofread |
+| 2026-10-14 | minor | Georgian (`ka`): menus 628, panels 886 (191 Georgian-only, in `GEORGIAN_PANELS`), effect names and categories in `effects.rs` |
+| 2026-10-29 | minor | Polish (`pl`): menus 630, panels 695 |
 | 2026-10-13 | minor | Effect names and the generated Effect menu leave English: `i18n/effects.rs` adds 306 rows keyed by effect id (Simplified Chinese, from After Effects 2026's interface and Adobe's Chinese documentation for the `CC` series) and the 21 category names. Parameter names are still English; no other language has rows |
+| 2026-10-12 | minor | Recounted: Russian, French, German and Czech menus (#873, #987), Brazilian Portuguese and Czech panels (#830, #987), Hangul probe (#599); overall ≈ 12% to ≈ 18%; Korean and Italian still absent |
+| 2026-10-11 | minor | Ukrainian panel catalog brought level with the Chinese ones (495 of 496 rows, counted at this commit); its share rises to ≈ 29%. The other languages' panel counts are the 10 October measurement |
+| 2026-10-10 | major | First localization parity document: catalog rows counted for all six languages, the twelve-language table, After Effects' 11 shipped languages from its bundle |
diff --git a/docs/mcp.md b/docs/mcp.md
index 1104927ac..ccca7d2ba 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -11,7 +11,11 @@ written only under a write root; with no write root nothing is written. Every en
 (`execute_command`, `command_run`, each `batch` step) is checked before it runs: its file
 parameters must be absolute paths inside the roots (symbolic links resolved, no `..`), and so must
 any other absolute path in its parameters. Save, Increment and Save and rendering the Render
-Queue are checked against the files they write (the open project's, the queued outputs). Scripts
+Queue are checked against the files they write (the open project's, the queued outputs);
+`renderQueue.add`, `render.preRender` and `file.createProxy` without an output file need a saved
+project, since an unsaved one's default output would go to the home folder (#2479). In a headless
+session the footage a project names, and what an imported file pulls in, is read only inside the
+roots too: footage outside them shows as missing (#2131). Scripts
 (`run_script`, `file.runScript`…), Execute File, Reveal in Finder, `$N` references to file paths
 in a batch, and the bridge's UI-driving tools (`ui_click`, `ui_key`, `ui_type`, `ui_drag`,
 `ui_set`, `script_ui`, `control`) are refused while confined. Without the flags nothing changes.
@@ -20,7 +24,7 @@ The server provides the same core conventions as FilmCraft #28:
 
 | Tool | Arguments | Result |
 | --- | --- | --- |
-| `command_list` | `filter?`, `enabled_only?`, `schemas?` | Command catalog |
+| `command_list` | `filter?`, `enabled_only?`, `schemas?`, `compact?` | Command catalog |
 | `command_run` | `id`, `params?` | Engine command result |
 | `command_batch` | `steps: [{id, params?}]`, `stop_on_error?` | `completed`, `failed`, per-step `results` |
 | `doc_inspect` | none | Project overview and active composition |
@@ -51,6 +55,17 @@ receive `resultType: complete` and list/read cache hints; document reads are nev
 {"jsonrpc":"2.0","id":2,"method":"resources/read","params":{"uri":"effectcraft://document"}}
 ```
 
+## Two outputs on one file
+
+Two outputs of one job that write the same file (two items with one Output To, a duplicated item,
+output modules or segments that meet) refuse the whole `renderQueue.render` before anything is
+written: the reply is `isError: true`, naming both items, and the queue is left as it was.
+Sequences clash only on the frames both write. Skip Existing Files leaves earlier frames alone
+only when the exporter can check the final destination; browser/memory sinks and storage-overflow
+renders still report collisions. Preflight checks every configured overflow destination, since free
+space can change during a render. A new item's default output name is numbered (`Main.mp4`,
+`Main_1.mp4`) when another item of the queue writes it.
+
 ## Progress and cancellation
 
 Headless `command_run` / `execute_command` calls to `renderQueue.render` (unless `wait: false`)
diff --git a/docs/plugins.md b/docs/plugins.md
index a688a89b0..290ed033c 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -11,13 +11,14 @@ Guide):
 
 | After Effects | EffectCraft | |
 |---|---|---|
-| Effect plug-ins (C/C++ SDK, `.aex` / `.plugin`) | [Effect plug-ins](#effect-plug-ins): WebAssembly modules (plug-in API v1) or Rust; the `Plug-ins` folder next to the settings loads at start-up | Different ABI: After Effects SDK plug-ins can't run (G8) |
-| Scripts folder: its scripts are listed in File ▸ Scripts | `Scripts/` in the settings folder (File ▸ Scripts ▸ Install Script File… copies a script there), listed in File ▸ Scripts with the bundled samples | Same |
+| Effect plug-ins (C/C++ SDK, `.aex` / `.plugin`) | [Effect plug-ins](#effect-plug-ins): WebAssembly modules (WebAssembly ABI 1 and 2) or Rust; the `Plug-ins` folder next to the settings loads at start-up | Different ABI: After Effects SDK plug-ins can't run (G8) |
+| Scripts folder: its scripts are listed in File ▸ Scripts | `Scripts/` in the settings folder (File ▸ Scripts ▸ Install Script File… copies a script there), listed in File ▸ Scripts with the bundled samples; a subfolder (one level) is a submenu named after it | Same |
 | File ▸ Scripts ▸ Run Script File… (`.jsx`, `.jsxbin`) | `.jsx` / `.js` | Gap: `.jsxbin` (an undocumented binary encoding) |
+| File ▸ Scripts ▸ Recent Script Files: the 10 most recently run scripts; Cmd+Option+Shift+D (Ctrl+Alt+Shift+D on Windows) reruns one | File ▸ Scripts ▸ Recent Script Files lists the 10 scripts run last (script files and File ▸ Scripts entries, newest first, kept in the settings); Cmd+Alt+Shift+D runs the most recent one again (`file.runScript {"recent": 0}`, a key that can be changed in Edit ▸ Keyboard Shortcuts) | Same |
 | ExtendScript preprocessor directives (`#include`, `#target`, `#targetengine`) | `#include` / `//@include` / `#includepath` inline files relative to the script (once each, depth-limited, file gate applies); `#target`, `#targetengine`, `#strict` are ignored | Same |
-| `Scripts/Startup` and `Scripts/Shutdown`: run in alphabetical order when the app starts and quits | Not run | Gap |
-| `Scripts/ScriptUI Panels`: listed at the bottom of the Window menu, dockable like the app's own panels, `this` is the panel | `Scripts/ScriptUI Panels/` in the settings folder (File ▸ Scripts ▸ Install ScriptUI Panel… copies one there), listed at the bottom of the Window menu, docked like any panel, `this` is the panel; the panels open when the app quits open again at the next launch | Same. Where a panel was docked isn't kept: workspace layouts aren't saved between launches |
-| Keyboard shortcuts for scripts (the Keyboard Shortcuts editor lists the scripts of the Scripts folder) | Shortcuts bind to commands and menu entries; the File ▸ Scripts and Window menu entries of scripts aren't offered | Gap |
+| `Scripts/Startup` and `Scripts/Shutdown`: run in alphabetical order when the app starts and quits | `Scripts/Startup/` and `Scripts/Shutdown/` in the settings folder, in alphabetical order (case ignored): the Startup scripts run at launch before a project opens, and the Shutdown scripts run as the desktop app quits, after the project is closed. A Startup script that fails is reported in a toast and in the log, a Shutdown script that fails is reported in the log, and the next script still runs | Partial: each script runs in its own global scope, so variables and functions a Startup script defines are not available to later scripts; a Startup script's modal dialog stays open while the next scripts run and the app starts; a Shutdown script's modal dialogs close as if canceled; the web app runs no Shutdown scripts |
+| `Scripts/ScriptUI Panels`: listed at the bottom of the Window menu, dockable like the app's own panels, `this` is the panel | `Scripts/ScriptUI Panels/` in the settings folder (File ▸ Scripts ▸ Install ScriptUI Panel… copies one there), listed at the bottom of the Window menu (a subfolder, one level, is a submenu named after it), docked like any panel, `this` is the panel; the panels open when the app quits open again at the next launch | Same. Where a panel was docked isn't kept: workspace layouts aren't saved between launches |
+| Keyboard shortcuts for scripts (the Keyboard Shortcuts editor lists the scripts of the Scripts folder) | Edit ▸ Keyboard Shortcuts lists the scripts of File ▸ Scripts under File ▸ Scripts (`file.runScript {"name": "<file name>"}`); a key given to one is saved with the preset, File ▸ Scripts shows it, and pressing it runs the script as its menu entry does | Same. After Effects binds a key to a script's place in the alphabetical list (`ExecuteScriptMenuItem01`…), and EffectCraft binds it to the script's file name. The Window menu entries of ScriptUI panels aren't offered |
 | Running a script from the command line (`afterfx -r script.jsx`) | `effectcraft-cli script`, the control channel's and MCP's `script.run` | Same purpose, other entry points |
 | `app.settings` (kept in the preferences between sessions) | Kept in `script_settings.json` in the settings folder (`script.settings.get` / `script.settings.save`) | Same |
 | Allow Scripts to Write Files and Access Network | Settings ▸ Scripting & Expressions | Same |
@@ -38,8 +39,17 @@ journaled and the same as the UI's action. The `effectcraft-script` crate's docs
   file.jsx`, or `script.run {code, name}` over the control channel and MCP.
 * Install one: File ▸ Scripts ▸ Install Script File… (or copy it into `Scripts/` in the settings
   folder). It is listed in File ▸ Scripts at once (After Effects asks for a restart).
+* Run one at every launch or quit: copy it into `Scripts/Startup/` or `Scripts/Shutdown/` in the
+  settings folder. These scripts are not listed in File ▸ Scripts. `file.runStartupScripts` and
+  `file.runShutdownScripts` run them and return `{ran, waiting, failed}`; the desktop app calls them at
+  launch and quit, and the web app calls `file.runStartupScripts` at launch.
 * `file.scripts.list` lists installed and bundled scripts and panels; `file.runScript {name}` runs
   one; `file.uninstallScript {name}` removes an installed one.
+* A subfolder of `Scripts/` is a submenu of File ▸ Scripts named after the folder, and its scripts
+  are named `Folder/File.jsx` in `file.scripts.list` and `file.runScript`. One level of folders is
+  listed; deeper folders are not. `file.uninstallScript` removes only scripts at the top of the
+  Scripts folders: delete a script in a subfolder yourself. A subfolder may be a link to another
+  folder (an extension's own), and uninstall never deletes a file through it.
 
 ## ScriptUI panels
 
@@ -51,6 +61,13 @@ other panel. Closing the tab closes the panel (its `onClose` runs). Panels open
 quits open again at the next launch (`window.restoreScriptPanels`, which the desktop and web apps
 run at start-up; the list is `scriptui_panels.json` in the settings folder).
 
+To group panels, for example the several panels of one extension, make a subfolder of
+`Scripts/ScriptUI Panels/` and put them in it: `Scripts/ScriptUI Panels/My Tools/Animate.jsx` is
+listed as Window ▸ My Tools ▸ Animate.jsx, its tab is titled Animate, and commands name it
+`My Tools/Animate.jsx` (`window.scriptPanel {name}`). One level of folders is listed. Install
+ScriptUI Panel… copies a panel to the top of the folder; make the subfolder and move panels into it
+yourself, and delete them from it yourself too.
+
 Run from File ▸ Scripts instead, the same script gets no panel, so it should make a floating
 palette itself. A minimal panel:
 
@@ -135,7 +152,7 @@ example of a keyframe tool.
 
 ## Effect plug-ins
 
-EffectCraft loads third-party effects through a small, versioned plug-in API (**API version 1**).
+EffectCraft loads third-party effects through a small, versioned plug-in API (**API version 2**; WebAssembly ABI 1 and 2).
 A plug-in effect behaves exactly like a built-in one: it is listed in Effects & Presets (and the
 Effect menu) under its category, applied by id (`effect.apply {"effect": "org.example.posterize"}`)
 or display name, its parameters are ordinary properties (keyframes, expressions, Effect Controls,
@@ -146,7 +163,7 @@ There are two ways to write one:
 | | WebAssembly plug-in | Rust plug-in |
 |---|---|---|
 | What | a `.wasm` (or `.wat`) module | a type implementing `effectcraft_effects::plugin::EffectPlugin` |
-| Loaded by | Effect ▸ Load Effect Plug-in…, `effect.plugins.load {path \| folder}`, or the `Plug-ins` folder next to the settings at start-up | `register_plugin(Arc::new(MyEffect))` in an app that links EffectCraft's crates |
+| Loaded by | Effect ▸ Install Effect Plug-in… (copied into the `Plug-ins` folder next to the settings and loaded on every start-up), Effect ▸ Load Effect Plug-in… / `effect.plugins.load {path \| folder}` (loads in this session only), the `Plug-ins` folder next to the settings at start-up, or `effect.plugins.install {path \| folder}` | `register_plugin(Arc::new(MyEffect))` in an app that links EffectCraft's crates |
 | Sandbox | yes: no imports (no files, clock or network), fuel-limited, at most 1 GiB of memory, deterministic floats | none (it is your code) |
 | Platforms | desktop and CLI (the wasmi interpreter, crate feature `effectcraft-plugin/wasm`); not the web build | everywhere |
 
@@ -161,7 +178,8 @@ author, source, params}]}`.
 * **Parameters** arrive flattened to `f64`s in the order they are declared: slider, angle,
   checkbox (0 / 1) and popup (0-based index) take one value, point two (already in **buffer
   pixels**), colour four (RGBA 0–1).
-* **Time** is layer time in seconds.
+* **Time** is layer time in seconds. A WebAssembly module written for ABI 2 also gets the
+  layer's neighbouring frames at other times (see [WebAssembly ABI](#webassembly-abi)).
 * Rendering must be **deterministic** and may run on several threads at once (a WebAssembly
   plug-in gets one instance per thread).
 * A failed render (an error code, a trap, running out of fuel) leaves the frame unchanged.
@@ -199,22 +217,36 @@ Every plug-in describes itself with a JSON manifest:
   parameters; a slider needs `min ≤ default ≤ max` (and `sliderMin ≤ sliderMax`); the manifest
   is at most 1 MiB.
 
-### WebAssembly ABI (v1)
+### WebAssembly ABI
 
-A module with **no imports** that exports:
+A module with **no imports** exports:
 
 | export | signature | |
 |---|---|---|
 | `memory` | memory | linear memory shared with the host |
-| `ec_api_version` | `() -> i32` | must return `1` |
+| `ec_api_version` | `() -> i32` | `1` for ABI 1, `2` for ABI 2 (neighbouring frames) |
 | `ec_manifest_ptr`, `ec_manifest_len` | `() -> i32` | the UTF-8 JSON manifest in memory |
 | `ec_alloc` | `(bytes: i32) -> i32` | a buffer of at least `bytes` bytes, 8-byte aligned; it may reuse the previous one |
-| `ec_render` | `(pixels: i32, width: i32, height: i32, params: i32, nparams: i32, time: f64, scale: f64) -> i32` | process the pixels in place; return 0 on success |
+| `ec_render` (ABI 1) | `(pixels: i32, width: i32, height: i32, params: i32, nparams: i32, time: f64, scale: f64) -> i32` | process the pixels in place; return 0 on success |
+| `ec_render2` (ABI 2) | `ec_render`'s arguments, then `prev: i32, prev_time: f64, next: i32, next_time: f64, flags: i32` | the same, with the neighbouring frames; return 0 on success |
 
 For each frame the host calls `ec_alloc` once for a buffer holding the parameters (`nparams`
-little-endian `f64`s) followed by the pixels (`width × height × 4` little-endian `f32`s), fills it,
-calls `ec_render`, and reads the pixels back. Each call gets a fuel budget proportional to the
-frame size; a module that loops forever stops with an error instead of hanging the app.
+little-endian `f64`s) followed by the pixels (`width × height × 4` little-endian `f32`s,
+premultiplied RGBA, row-major), fills it, calls the module's render export, and reads the pixels
+back. An ABI 2 module gets two more pixel buffers after the current frame: the previous and next
+frames, resampled onto the current buffer's grid. At a frame boundary they are the frames before
+and after it (`time ± 1/fps`); between frames they are the two frames that bracket `time`.
+
+The neighbour buffers are always allocated (zeroed when the layer has no pixels there, so a
+module can read both without a null check). `flags` bit 0 is set when `prev` holds a real frame,
+bit 1 when `next` does; `prev_time` / `next_time` are those frames' layer times in seconds (0
+when absent). The ABI version is the module's `ec_api_version` and is independent of the
+manifest's `api` (the native plug-in API): a module can use ABI 2 while its manifest says
+`"api": 1`. Because an ABI 2 module reads other times, its layer is keyed on the layer time in
+the render cache; ABI 1 modules keep the time-independent key.
+
+Each call gets a fuel budget proportional to the frame size; a module that loops forever stops
+with an error instead of hanging the app.
 
 #### Example
 
@@ -224,11 +256,59 @@ plain Rust (no dependencies):
 ```sh
 cd examples/plugins/posterize-bands
 cargo build --release --target wasm32-unknown-unknown
-# then, in EffectCraft: Effect ▸ Load Effect Plug-in… → target/wasm32-unknown-unknown/release/posterize_bands.wasm
+# then, in EffectCraft: Effect ▸ Install Effect Plug-in…
+#   → target/wasm32-unknown-unknown/release/posterize_bands.wasm  (copied into Plug-ins, loads on start-up)
+# or in-session only: Effect ▸ Load Effect Plug-in…
 # or headless:
 effectcraft-cli exec effect.plugins.load '{"path": "target/wasm32-unknown-unknown/release/posterize_bands.wasm"}'
 ```
 
+**Bundles.** `effect.plugins.install {"folder": ...}` installs a whole plug-in folder in one
+go: every `.wasm` at its top level is copied into the `Plug-ins` folder (and loads at once),
+and every `.jsx` at its top level is installed as a ScriptUI panel — so a third-party plug-in
+ships as one folder the user installs once. A `.wasm` that does not load is not copied (the
+install rolls it back), and per-file problems in a folder install come back in `errors`
+instead of failing the whole bundle.
+
+**What an install does and does not do.** It is a security boundary: it copies code into a
+folder the app runs at every start, so:
+
+* Only `.wasm` (`path` / a bundle's `.wasm`) and `.jsx` (a bundle's panel) are installed; other
+  files in a bundle (readmes, manifests, sources) are skipped. Files are named by their own
+  entry name, so a bundle cannot carry a path, a `..` component or a name that escapes the
+  destination folder.
+* Nothing is overwritten. An existing plug-in or panel with the same file name makes that file
+  fail with "already installed": delete it from `Plug-ins` / `Scripts/ScriptUI Panels` first to
+  update it (versioning the file name is the other option). A bundle is installed file by file,
+  so one collision does not undo the rest.
+* Files over 64 MiB are refused before they are read, rather than copied into a startup folder.
+* A `.wasm` is loaded once, in the same sandbox it runs in later (see below), so a module that
+  cannot load is reported instead of failing every start. That load runs the module's start-up
+  code and its metadata exports; `ec_render` is never called, and a panel's script is not run at
+  install time (it runs when the panel opens, as with any installed panel). The copy made before
+  the load is then removed again — best effort: if removing it fails, the command says so and
+  names the file, and you delete it from `Plug-ins` yourself.
+* A `.wasm` is uninstalled by deleting it from `Plug-ins` (the next start no longer loads it):
+  there is no `effect.plugins.uninstall`. A panel installed here is an installed script, so
+  `file.uninstallScript {name}` removes it. Replacing either means removing it first.
+* Hidden files (names starting with `.`, such as macOS `._x.wasm` copies) are skipped in a bundle
+  and refused as a single install. A panel name that differs from an installed panel's only in
+  letter case counts as the same name.
+* Installed plug-ins share the `Plug-ins` folder with the [Plug-in Library](#plug-in-library)
+  (which keeps its packages in `Plug-ins/Library`). An effect id can be registered only once: a
+  plug-in whose id is already loaded, from either kind of install, is refused. At start-up the
+  files installed here load before the library's packages, so if both carry the same id (for
+  example after files were copied by hand), the file here wins and the library package reports
+  the duplicate.
+
+**The sandbox.** A plug-in runs in the [wasmi](https://github.com/wasmi-labs/wasmi) interpreter
+with no imports (no file, network or clock access), deterministic floats, a fuel budget per
+frame and a 1 GiB memory cap, so a plug-in cannot escape the sandbox, hang the app or render
+differently on another machine. A ScriptUI panel is different: it is a script with the app's
+scripting object model, so it can read and write project data through commands; file and
+network access for scripts follow Settings ▸ Scripting & Expressions, exactly as for a script
+installed with File ▸ Scripts ▸ Install ScriptUI Panel….
+
 Any language that compiles to WebAssembly works (C, Zig, AssemblyScript…) as long as the module
 has no imports. `crates/plugin/src/tests.rs` has a plug-in written directly in WebAssembly text.
 
@@ -253,11 +333,91 @@ impl EffectPlugin for Swap {
 register_plugin(Arc::new(Swap(manifest)))?; // before the UI builds its menus
 ```
 
-`PluginParams` reads values by parameter id (`f`, `b`, `point`, `color`). At most 64 plug-in
-effects can be registered per process.
+`PluginParams` reads values by parameter id (`f`, `b`, `point`, `color`, and in API 2 `point3`,
+`layer`, `text`). At most 1024 plug-in effects can be registered per process.
+
+## Plug-in API 2 (native plug-ins)
+
+API 2 is for Rust plug-ins and for hosts that bring effects from elsewhere (such as
+[external effect helpers](external-helpers.md)); the WebAssembly ABI is versioned separately
+(ABI 2 adds the neighbouring frames, see [WebAssembly ABI](#webassembly-abi)). Manifests with
+`"api": 1` or `2` are accepted, `effect.plugins.list` reports `api: 2`, and up to 1024 plug-in
+effects can be registered.
+
+* **New parameter types**: `point3` (`default` `[x, y, z]`; x, y arrive in buffer pixels, z as is),
+  `layer` (another layer of the composition; flattens to its id, -1 for none, read with
+  `PluginParams::layer`), `text` (a string field) and `hidden` (a string that is not shown, for
+  opaque plug-in data). `text` / `hidden` take no slot in `flat`; their strings are in
+  `PluginParams::texts`, one per such parameter in declaration order, read with
+  `PluginParams::text(id)`. `slider` gains `"integer": true` (shown with 0 decimals) and every
+  parameter an optional `"group"` path (`"Advanced/Edges"`; informational). WebAssembly modules
+  can't use `point3`, `layer`, `text` or `hidden`.
+* **`PluginFrame`** also carries `origin` (buffer pixels of layer pixel (0, 0); padding shifts it)
+  and `layer_size` (layer pixels).
+* **`EffectPlugin::padding(params, time, scale, layer_size, instance_key) -> u32`** asks for that
+  many transparent buffer pixels on every side before rendering (glows, regions of definition
+  larger than the input); at most 4096. `layer_size` is the layer's size in layer pixels (so
+  sizes relative to the frame can be measured) and `instance_key` identifies the applied effect
+  instance (see `PluginHost::instance_key`).
+* **`EffectPlugin::render_v2(frame, params, time, host)`** (default: calls `render`) gets a
+  `PluginHost` with `input_at(layer_time)` (the effect's input at another time, in its own extent;
+  the effects above this one are applied), `layer_input(param_id, layer_time)` (a layer parameter's
+  layer, effects and masks applied, resampled into the frame's grid), `params_at(layer_time)`,
+  `frame_rate()`, `time()`, `instance_key()` (a stable id of the applied effect instance: the
+  same on every frame, different per layer and per application; plug-ins that keep state between
+  frames pool their native instances by it) and `frame_range()` (the layer's source time range in
+  layer-time seconds, `None` when it has none). Images are `PluginImage { width, height, pixels, origin, scale }`.
+  It may run on several threads at once.
 
 ### Compatibility
 
-The API version is checked when a plug-in loads: a manifest or module for another version is
-refused with a message. Within a version the contract above does not change; additions (new
-parameter types, new optional exports) bump the version.
+The API version is checked when a plug-in loads: this build implements plug-in API 1 and 2 and
+WebAssembly ABI 1 and 2; a manifest or module for another version is refused with a message.
+ABI 1 modules load and render unchanged; ABI 2 modules add `ec_render2` and the neighbouring
+frames. Within a version the contract above does not change; additions (new parameter types,
+new optional exports) bump the version.
+
+## Plug-in Library
+
+Settings ▸ Plug-in Library (also Effect ▸ Plug-in Library…) lists WebAssembly effect plug-ins
+published by the community, and installs, updates and removes them without bundling them into
+the app. Only WebAssembly effects are listed: they run in the same sandbox as any plug-in, so a
+package can't read files, open the network or crash the app.
+
+* **One reviewed catalog.** The list comes from one `index.json` in the
+  [`storytold/effectcraft-plugins`](https://github.com/storytold/effectcraft-plugins) repository;
+  packages are added by pull request and reviewed there. The app has no field for another
+  catalog; `library.refresh {catalog}` (for plug-in authors testing an entry) takes an `index.json`
+  on GitHub or a local file, and the page then says it shows a test catalog until Refresh.
+* **Nothing is downloaded until you ask.** Fetch Catalog (`library.refresh`) reads the catalog;
+  Install (`library.install`) downloads the package's `.wasm`, checks its SHA-256 (and its size, when the
+  catalog gives one) against the catalog and loads it. Downloads use the system's `curl`,
+  `https://` only and starting on GitHub's hosts (redirects stay on `https://`; the SHA-256 check
+  is what guarantees the file).
+* **Where it goes.** `<Plug-ins>/Library/<id>/<version>/<id>.wasm` (the `Plug-ins` folder next to
+  the settings), listed in `Library/installed.json`. Installed packages load at start-up, each
+  checked against the SHA-256 it was installed with. The catalog last fetched is kept as
+  `Library/catalog.json`, so the list works offline.
+* **Restart after removing or updating.** Registered effects can't be unloaded: removing or
+  updating a package whose effects are loaded takes effect at the next start, and the list says
+  "Restart EffectCraft to finish".
+* **Preview before installing.** Preview (`library.preview`) downloads the package's module
+  (checked against the catalog's size and SHA-256) without installing it, and renders its
+  effect in the sandbox on a built-in sample frame with default parameters: 2 seconds at 12 fps,
+  with a Before/After split. The details show it playing, the effects with their parameter names,
+  "Open on GitHub" (the package's `repo`) and, when the package has a `preview.video` link (an
+  `https://` YouTube, Vimeo or GitHub URL), "Watch video".
+* **Missing effects.** `library.missing` lists the effects a project uses that aren't installed,
+  and the catalog packages that provide them.
+
+Commands (UI, CLI, control channel and MCP): `library.list {query?, tag?, installed?}`,
+`library.refresh {catalog?, wait?}`, `library.preview {id, version?, wait?}`,
+`library.install {id, version?, wait?}`, `library.update {id?, wait?}`, `library.uninstall {id}`,
+`library.missing`, `library.loadInstalled`. Downloads run in the background; `wait: true` runs
+them to the end (scripts and tests).
+
+### Publishing a plug-in
+
+[publishing-plugins.md](publishing-plugins.md) walks through it from an empty folder to a listed
+package: build, test, release on GitHub, the catalog entry and its fields, testing the entry with a
+local `file://` catalog, the pull request and its review, updates and removal.
diff --git a/docs/preferences.md b/docs/preferences.md
index 8b86528a1..b8bbb2bcf 100644
--- a/docs/preferences.md
+++ b/docs/preferences.md
@@ -30,11 +30,12 @@ Commands (CLI, MCP, control channel):
 
 ### Settings that change behaviour
 
-- `general.language`: interface language (`system` / `en` / `ja` / `zh-hans` / `zh-hant` / `uk` / `es` / `pt-br`), Settings ▸ General ▸ Language; menu labels change immediately. `system` (Match System, the default) follows the operating system's interface language where EffectCraft has a translation and is English otherwise: a Simplified Chinese locale (`zh`, `zh-CN`, `zh_CN.UTF-8`, `zh-Hans-CN`, `zh-SG`) selects `zh-hans`, a Traditional one (`zh-TW`, `zh-HK`, `zh-Hant`, `zh_MO`) selects `zh-hant`, a Ukrainian one (`uk`, `uk-UA`, `uk_UA.UTF-8`) selects `uk`, a Spanish one (`es`, `es-ES`, `es_MX.UTF-8`) selects `es`, a Portuguese one (`pt`, `pt-BR`, `pt_PT.UTF-8`) selects `pt-br`; the browser build stays in English with it. Choose **Español** or **Português (Brasil)** for Spanish or Brazilian Portuguese menus (panels stay in English for now); choose **Українська** for Ukrainian menus and cataloged panel, dialog, button and tooltip text; Ukrainian uses the bundled UI fonts. Native Japanese, Simplified and Traditional Chinese UI uses installed system fonts; the web host must supply a Japanese font. The same setting picks the CJK fallback for the interface *and* the Han preference of the text engine, so the composition's own text is drawn with the same language's glyph forms (the text engine's preference is process-global); swapping the language reinstalls the fonts, so it applies without a restart. Two catalogs back the text: the menus are keyed by `(command, English label)` (`crates/ui-egui/src/i18n.rs`), and the rest of the interface - panels, dialogs, buttons, tooltips - is keyed by its English source string (`crates/ui-egui/src/i18n/ui.rs`, with rows for Japanese, Simplified and Traditional Chinese and Ukrainian), where a panel writes `tr("Rename")`, or `tr_args("Proxy Use: {}", &[&quality])` when the row carries a value. A row that is missing falls back to English, so a new string shows up untranslated rather than empty; the tests in that module fail on an unused row and on a hard-coded string in a converted panel.
+- `general.language`: interface language (`system` / `en` / `ja` / `zh-hans` / `zh-hant` / `uk` / `es` / `pt-br` / `ka` / `sv`), Settings ▸ General ▸ Language; menu labels change immediately. `system` (Match System, the default) follows the operating system's interface language where EffectCraft has a translation and is English otherwise: a Simplified Chinese locale (`zh`, `zh-CN`, `zh_CN.UTF-8`, `zh-Hans-CN`, `zh-SG`) selects `zh-hans`, a Traditional one (`zh-TW`, `zh-HK`, `zh-Hant`, `zh_MO`) selects `zh-hant`, a Ukrainian one (`uk`, `uk-UA`, `uk_UA.UTF-8`) selects `uk`, a Spanish one (`es`, `es-ES`, `es_MX.UTF-8`) selects `es`, a Portuguese one (`pt`, `pt-BR`, `pt_PT.UTF-8`) selects `pt-br`, a Georgian one (`ka`, `ka-GE`, `ka_GE.UTF-8`) selects `ka`, a Swedish one (`sv`, `sv-SE`, `sv_SE.UTF-8`) selects `sv`; the browser build follows `?lang=` in the address, then the browser's languages (`navigator.languages`). Choose **Español** or **Português (Brasil)** for Spanish or Brazilian Portuguese menus (panels stay in English for now); choose **Українська** for Ukrainian menus and cataloged panel, dialog, button and tooltip text; Ukrainian uses the bundled UI fonts. Choose **Svenska** for Swedish menus, panels and effect names. Native Japanese, Simplified and Traditional Chinese UI uses installed system fonts; the web host must supply a Japanese font. The same setting picks the CJK fallback for the interface *and* the Han preference of the text engine, so the composition's own text is drawn with the same language's glyph forms (the text engine's preference is process-global); swapping the language reinstalls the fonts, so it applies without a restart. Two catalogs back the text: the menus are keyed by `(command, English label)` (`crates/ui-egui/src/i18n.rs`), and the rest of the interface - panels, dialogs, buttons, tooltips - is keyed by its English source string (`crates/ui-egui/src/i18n/ui.rs`, with rows for Japanese, Simplified and Traditional Chinese and Ukrainian), where a panel writes `tr("Rename")`, or `tr_args("Proxy Use: {}", &[&quality])` when the row carries a value. A row that is missing falls back to English, so a new string shows up untranslated rather than empty; the `missing_translations_report` test lists what each language lacks, and the tests in `ui.rs` fail on an unused row.
 - `general.undoLevels`: Levels of Undo
 - `general.pathPointSize`: Path Point and Handle Size
 - `general.recentItems`: Recent Projects Shown
 - `general.showToolTips`: Show Tool Tips
+- `general.viewerWheelScrubbing`: Scrub Composition Frames with Mouse Wheel (off by default). On: an unmodified mouse wheel over the Composition viewer steps frames, and the smoothed tail of that notch does not zoom or pan. Ctrl/Cmd+wheel and a trackpad still zoom and pan.
 - `general.createLayersAtCompStart`: Create Layers at Composition Start Time
 - `general.defaultSpatialLinear`: Default Spatial Interpolation to Linear
 - `startup.showHomeOnLaunch`: Show Home Screen When Launching
@@ -42,6 +43,7 @@ Commands (CLI, MCP, control channel):
 - `startup.windowGraphics`: Window Graphics (`auto` / `gl`), what the desktop window draws with from the next launch. `auto` lets the platform pick (DirectX 12, Vulkan or Metal); `gl` uses OpenGL, with CPU compositing, for graphics drivers that crash with the others. A launch leaves a `launch-pending` marker in the settings folder until its window has been drawing for a few seconds (or the app quits normally before that); a launch that stops earlier (a graphics driver crashing as the window opens or as its surface is re-created) leaves the marker behind, and the next launch switches to `gl` and says so (not on macOS, which has no OpenGL backend). `WGPU_BACKEND` overrides both.
 - `project.useTemplate`: New Project Loads Template
 - `project.templatePath`: Template Project
+- `project.compactProjectFiles`: Save Compact Project Files (default off). Off: File ▸ Save writes `.ecproj` files as indented JSON, one value per line, easy to read and diff in version control. On: compact JSON on one line, smaller and faster to save and open. Either opens the same; auto-saves, XML copies and template packages are not affected.
 - `autoSave.enabled`: Automatically Save Projects
 - `autoSave.intervalMinutes`: Save Every
 - `autoSave.maxVersions`: Maximum Project Versions
@@ -91,7 +93,8 @@ Commands (CLI, MCP, control channel):
   one and in the comps that nest it (through the precomp layers' timing)
 - `general.expressionPickWhipCompact`: off, the pick whip writes match names
   (`thisComp.layer("A")("transform")("opacity")`)
-- `general.createSplitLayersAbove`: where Edit ▸ Split Layer puts the new layer
+- `general.createSplitLayersAbove`: where Edit ▸ Split Layer puts the new layer (on by default,
+  as in After Effects)
 - `startup.showHomeOnOpenProject`: the Home screen comes up after File ▸ Open / Open Recent
 - `composition.motionPath`, `composition.motionPathSeconds`, `composition.motionPathKeyframes`:
   how much of a position motion path the viewer draws (all, none, N seconds or N keyframes
@@ -118,9 +121,11 @@ Commands (CLI, MCP, control channel):
 - `import.reportMissingFrames`: gaps in an image sequence's numbering are reported on import
   (they show as colour-bar placeholders, as in After Effects; see [footage.md](footage.md))
 - `import.autoReloadFootage`: Automatically Reload Footage, `off`, `nonSequence` (the default, as
-  in After Effects) or `all` (image sequences too). Every two seconds,
-  and as soon as the window comes back to the front, the desktop app compares each footage file's
-  size and modification time with what they were, and reloads what another app saved: a
+  in After Effects) or `all` (image sequences too). Every two seconds while its window is in
+  front (every ten seconds while another app has the front), and as soon as the window comes back
+  to the front, the desktop app compares each footage file's size and modification time with what
+  they were, on a worker thread that only wakes the interface when something changed, and reloads
+  what another app saved: a
   Photoshop file edited in PhotoCraft or Photoshop shows its new pixels without File ▸ Reload
   Footage. It is not an undo step and doesn't modify the project; a layer item stays on its layer
   (found again by name), and a file that can't be read yet (still being written) is tried again once it changes again.
@@ -137,7 +142,12 @@ Commands (CLI, MCP, control channel):
   it supports it)
 - `disk.diskCacheEnabled`, `disk.diskCacheMaxGb`, `disk.diskCacheFolder`: the persistent disk
   cache of processed layers and frames (in the browser: frames in the Origin Private File System,
-  at most half the origin's quota; the folder setting does not apply there). The Disk page also
+  at most half the origin's quota; the folder setting does not apply there). On the desktop the
+  cache never fills its disk: it leaves 5% of the disk free, at least 2 GB and at most 10 GB, and
+  is smaller than `disk.diskCacheMaxGb` when free space requires it. The Disk page shows the limit
+  in effect in MB under Maximum Disk Cache Size, with a note naming the space kept free when free
+  disk space lowers it (with less than 64 MB of room nothing is written, and frames and layers
+  are not compressed for it). The Disk page also
   shows **Browser Storage** in the web app: usage and quota, persistent storage, Clear buttons
   (`storage.info` / `storage.persist` / `storage.clear`, see [web.md](web.md))
 - `disk.mediaCacheFolder`: audio waveform summaries kept between sessions (`Peaks/`)
@@ -188,7 +198,8 @@ Effect Controls uses compact, fixed 20 pt parameter rows, as After Effects does:
 Edit ▸ Keyboard Shortcuts (`Cmd+Alt+'`) opens the shortcut editor: an on-screen keyboard showing
 which keys are assigned for the held modifiers (purple: application-wide, green: panel-specific,
 both: split), modifier toggles, a searchable list of every command (all engine commands, menu
-entries with bound parameters and the frontend's tool / panel commands), and a preset menu.
+entries with bound parameters, the scripts File ▸ Scripts lists and the frontend's tool / panel
+commands), and a preset menu.
 
 - **Presets.** "EffectCraft Default" is After Effects' default layout and is read-only; editing
   it creates a "Custom" copy. Custom presets store only their differences from the default and
@@ -197,8 +208,15 @@ entries with bound parameters and the frontend's tool / panel commands), and a p
 - **Assigning.** Select a command, then press keys in the shortcut field (or type them), or
   click a key on the keyboard with the modifiers toggled. Conflicts with other commands in an
   overlapping scope are listed before you assign.
-- **Scope.** Menu and engine commands are application-wide; timeline commands work in the
-  Timeline and viewer commands in the Composition panel.
+- **Scope.** A shortcut belongs to the application, to a panel (Project, Timeline, Composition,
+  Render Queue…) or to a context (editing text, a paint tool or a camera tool active, a mask
+  selected). One chord can be bound once per scope, and the narrowest active scope runs it: an
+  active context, then the panel with the keyboard, then the application. The Timeline and the
+  Composition panel share their shortcuts. A context's shortcuts work only while it is active;
+  a panel's shortcut that nothing nearer claims still works from the other panels.
+- **Conflicts.** Two commands of one scope on one chord are a conflict (`shortcuts.conflicts`
+  lists them; the default preset has none). The same chord in two scopes is an override: both
+  keep working, and `shortcuts.set` reports it with `overrides: true`.
 
 Commands: `shortcuts.list {query?, keys?, assigned?}`, `shortcuts.set {command, params?, keys}`,
 `shortcuts.reset {command?}`, `shortcuts.preset {op: select|new|duplicate|delete|rename, name?,
diff --git a/docs/publishing-plugins.md b/docs/publishing-plugins.md
new file mode 100644
index 000000000..bd76c3ab5
--- /dev/null
+++ b/docs/publishing-plugins.md
@@ -0,0 +1,346 @@
+# Publishing an effect plug-in
+
+This guide takes you from an empty folder to an effect listed in EffectCraft's **Plug-in
+Library** (Settings ▸ Plug-in Library, also Effect ▸ Plug-in Library…). The reference for the
+plug-in API is [plugins.md](plugins.md#effect-plug-ins); this page is the walk-through.
+
+If you only want to use plug-ins, skip to [For users](#for-users).
+
+## What a plug-in is
+
+* A plug-in is one **WebAssembly module** (a `.wasm` file) that adds one effect. It is listed in
+  Effects & Presets under its category, its parameters are ordinary properties (keyframes,
+  expressions, Effect Controls), and projects save it by its id.
+* It runs in a **sandbox**. The module may not import anything: no files, no clock, no network,
+  no random numbers. Each render gets a fuel budget, and memory is capped at 1 GiB. A plug-in that
+  loops forever or traps stops with an error; it can't crash the app.
+* It implements **plug-in API version 1**: a JSON manifest and five exports (`memory`,
+  `ec_api_version`, `ec_manifest_ptr` / `ec_manifest_len`, `ec_alloc`, `ec_render`). The
+  [ABI](plugins.md#webassembly-abi-v1) and the [contract](plugins.md#the-contract) (premultiplied
+  RGBA `f32` pixels, processed in place, deterministic) are in plugins.md.
+* Any language that compiles to WebAssembly without imports works. This guide uses Rust, because
+  the example is in Rust.
+* The Plug-in Library is in the desktop app and the CLI. The web build has no plug-ins.
+
+## 1. Start from the example
+
+[`examples/plugins/posterize-bands`](../examples/plugins/posterize-bands) is a complete plug-in
+in plain Rust with no dependencies. Copy it into a new folder (and a new Git repository):
+
+```sh
+cp -r effectcraft/examples/plugins/posterize-bands my-effect
+cd my-effect
+rm -rf target
+git init
+```
+
+The folder has its own `[workspace]`, so it builds on its own, outside the EffectCraft repository.
+
+Then make it yours:
+
+1. **`Cargo.toml`:** change `name` (the `.wasm` file is named after it, with `-` turned into
+   `_`), `description`, `version` and `license`. Keep `crate-type = ["cdylib"]` and the release
+   profile (`panic = "abort"` keeps the module small and import-free).
+2. **The manifest** (the `MANIFEST` string in `src/lib.rs`):
+   * `id`: your own, reverse-domain (`io.github.yourname.glow-rings`): letters, digits, `.`, `_`,
+     `-`. It must be unique among all plug-ins, and `ec.` is reserved for built-in effects.
+     **Never change it after release**: projects find the effect by this id.
+   * `name`: the name shown in Effects & Presets.
+   * `category`: an existing Effects & Presets category (`Stylize`, `Blur & Sharpen`, …) or a new
+     one.
+   * `version`: the same version as the release (`1.0.0`).
+   * `author`, `description`.
+   * `params`: one entry per control. Types are `slider`, `angle`, `checkbox`, `popup`, `point` and
+     `color`; the fields and limits are in [The manifest](plugins.md#the-manifest).
+3. **`ec_render`:** the parameters arrive as `f64`s in the order they are declared (a point takes
+   two values, a colour four), then the pixels. Read them by position, change the pixels in place,
+   return `0`. Check `nparams` before you read, as the example does, and return non-zero if
+   something is wrong: the frame is then left unchanged.
+
+Keep `ec_api_version`, `ec_manifest_ptr`, `ec_manifest_len` and `ec_alloc` as they are.
+
+Things that break the sandbox rule (the module then imports something and won't load): printing
+(`println!`), reading the time (`std::time`), random numbers (`getrandom`, `rand` with its default
+features), and crates that need `wasm-bindgen`. If you need randomness, derive it from the pixel
+position, the time and a seed parameter, so the result stays deterministic.
+
+## 2. Build
+
+```sh
+rustup target add wasm32-unknown-unknown       # once
+cargo build --release --target wasm32-unknown-unknown
+```
+
+The module is `target/wasm32-unknown-unknown/release/<name>.wasm`.
+
+## 3. Test it in EffectCraft
+
+Load the module straight from the build folder:
+
+* **Desktop:** Effect ▸ Load Effect Plug-in… and pick the `.wasm`. Apply the effect to a layer,
+  move every control, scrub the time, and try a 32 bpc project if your effect can see values
+  above 1.
+* **CLI:**
+
+  ```sh
+  effectcraft-cli exec effect.plugins.load '{"path": "target/wasm32-unknown-unknown/release/my_effect.wasm"}'
+  ```
+
+  The reply describes the effect, or says why the module was refused (a missing export, an
+  import, a bad manifest, another plug-in with the same id).
+
+To have it at every start, put the `.wasm` in the `Plug-ins` folder of the
+[settings folder](#where-files-live).
+
+## 4. Check the live preview
+
+Every package in the Plug-in Library gets a **live preview**: you do nothing to get it. EffectCraft
+downloads the module (without installing it) and renders your effect in the sandbox on a built-in
+sample frame (320 × 180: a colour gradient, two discs and a band of fine stripes), with the
+**default parameters**, for 2 seconds of animation (12 frames per second),
+with a Before/After split.
+
+So choose defaults that show what the effect does at a glance. An effect whose defaults do
+nothing (a strength of 0, an "Enable" checkbox that is off) previews as an unchanged frame. If
+your effect animates over time, the 2 seconds show it. A render that fails in the preview shows
+as an error.
+
+You can see the preview before you publish, with a catalog on your disk: see
+[step 8](#8-test-the-entry-locally).
+
+## 5. Publish a GitHub release
+
+The source repository must be **public on GitHub**, with a licence file.
+
+1. Commit everything, including `Cargo.lock`.
+2. Tag the version (`git tag v1.0.0`) and push the tag.
+3. Create a GitHub release for the tag and attach the `.wasm` as an asset.
+
+The download URL is then
+`https://github.com/<you>/<repo>/releases/download/v1.0.0/my_effect.wasm`.
+
+**Never replace an asset after it is listed.** The catalog pins its SHA-256; a different file
+fails every install. Fix a mistake with a new version.
+
+Reviewers rebuild the module from the tagged source and compare checksums, so make the build
+reproducible: commit `Cargo.lock`, pin the Rust version with a `rust-toolchain.toml`
+(`[toolchain] channel = "1.95.0"`, `targets = ["wasm32-unknown-unknown"]`), and build with
+`cargo build --release --locked --target wasm32-unknown-unknown`. Building the release in GitHub
+Actions from the tag is the easiest way to show the asset comes from the source.
+
+## 6. Compute the checksum and size
+
+The catalog needs the file's SHA-256 (64 lower-case hex digits) and its size in bytes. Use the
+file you attached to the release (download it again if in doubt).
+
+| System | SHA-256 | Size in bytes |
+|---|---|---|
+| Linux | `sha256sum my_effect.wasm` | `stat -c %s my_effect.wasm` |
+| macOS | `shasum -a 256 my_effect.wasm` | `stat -f %z my_effect.wasm` |
+| Windows (PowerShell) | `(Get-FileHash my_effect.wasm -Algorithm SHA256).Hash.ToLower()` | `(Get-Item my_effect.wasm).Length` |
+
+## 7. Write the catalog entry
+
+The catalog is one `index.json` in the
+[`storytold/effectcraft-plugins`](https://github.com/storytold/effectcraft-plugins) repository.
+A starting point for that repository (an example entry, a JSON Schema and the checks run on
+every pull request) is in [`examples/plugin-catalog`](../examples/plugin-catalog).
+
+Your entry is one object in `packages`:
+
+```json
+{
+  "id": "io.github.yourname.glow-rings",
+  "name": "Glow Rings",
+  "author": "Your Name",
+  "description": "Adds soft concentric rings of light around bright areas.",
+  "license": "MIT",
+  "repo": "https://github.com/yourname/glow-rings",
+  "tags": ["stylize", "light"],
+  "preview": {"video": "https://www.youtube.com/watch?v=XXXXXXXXXXX"},
+  "versions": [
+    {
+      "version": "1.0.0",
+      "api": 1,
+      "minApp": "0.17.0",
+      "url": "https://github.com/yourname/glow-rings/releases/download/v1.0.0/glow_rings.wasm",
+      "sha256": "<64 hex digits>",
+      "size": 18342,
+      "effects": ["io.github.yourname.glow-rings"]
+    }
+  ]
+}
+```
+
+Package fields:
+
+| Field | Required | What it is |
+|---|---|---|
+| `id` | yes | The package id: 1 to 100 characters, letters, digits, `.`, `-` and `_`; no leading dot and no `..`. It is also the folder name on users' disks. Unique in the catalog; usually the same as the effect id. Never change it. |
+| `name` | yes | The name shown in the list. Not empty. |
+| `author` | no | You, or your group. |
+| `description` | no, but reviewed | One or two plain sentences that say what the effect does. |
+| `license` | no, but reviewed | The licence's SPDX id (`MIT`, `Apache-2.0`, `MIT OR Apache-2.0`…). |
+| `repo` | no, but reviewed | The public source repository. The details' "Open on GitHub" opens it. |
+| `tags` | no | Lower-case words for the tag filter (`blur`, `stylize`, `light`, `distort`…). Reuse tags the catalog already has. |
+| `preview.video` | no | An `https://` link to a short demo video on YouTube, Vimeo or GitHub. "Watch video" opens it in the browser. A link that isn't `https://` (or is longer than 500 characters) is left out. The live preview doesn't need it. |
+| `versions` | yes | One entry per release, newest or oldest first. |
+
+Release fields (one per entry in `versions`):
+
+| Field | Required | What it is |
+|---|---|---|
+| `version` | yes | Dotted numbers only, at most 32 characters: `1.0.0`, `1.2`. No `v` and no suffixes such as `-beta`. |
+| `api` | yes | The plug-in API the module implements: `1`. |
+| `minApp` | no | The oldest EffectCraft version the release needs (`0.17.0`). Leave it out if any version with this API works. |
+| `url` | yes | The release asset's `https://` URL on GitHub. |
+| `sha256` | yes | The file's SHA-256, 64 hex digits. |
+| `size` | no, but reviewed | The file's size in bytes. When it is given, a download of another size is refused. |
+| `effects` | yes | The effect ids the module registers (its manifest's `id`). EffectCraft uses them to find the package that provides an effect a project needs. |
+
+The rules EffectCraft applies when it reads the catalog:
+
+* Downloads are `https://` only, from GitHub's hosts only: `github.com`,
+  `raw.githubusercontent.com`, and the hosts release assets redirect to
+  (`objects.githubusercontent.com`, `release-assets.githubusercontent.com`). Any other URL is
+  refused. Redirects may lead elsewhere but stay on `https://`; the SHA-256 check is what
+  guarantees the file.
+* The catalog may be at most 4 MB and a module at most 64 MB.
+* A package with a bad id, no name, or an id another package already uses is left out; so is a
+  release with a bad version, `minApp` or `sha256`, or no `url`. The rest of the catalog still
+  works.
+* EffectCraft installs the newest release whose `api` it implements and whose `minApp` it meets.
+  When the newest release needs a newer EffectCraft, `library.list` says so (`needsNewerApp`).
+* The download must match `sha256` (and `size`, if given) exactly, or it is refused.
+
+## 8. Test the entry locally
+
+Before you open a pull request, test the entry with a catalog on your own disk. A local catalog
+(`file://`) may also name local files, so you can test before you publish the release: point
+`url` at your built module, then switch to the GitHub URL.
+
+Make a folder with an `index.json` that holds only your package:
+
+```json
+{"schema": 1, "packages": [ { "id": "io.github.yourname.glow-rings", "…": "your entry" } ]}
+```
+
+File URLs are absolute: `file:///home/me/glow-rings/index.json` on Linux and macOS,
+`file:///C:/Users/me/glow-rings/index.json` on Windows. Write a space as `%20`.
+
+Use a separate settings folder, so the test doesn't touch your real installation:
+
+```sh
+export EFFECTCRAFT_CONFIG_DIR="$PWD/ec-test"           # PowerShell: $env:EFFECTCRAFT_CONFIG_DIR = "$PWD\ec-test"
+effectcraft-cli exec library.refresh '{"catalog": "file:///home/me/glow-rings/index.json", "wait": true}'
+effectcraft-cli exec library.list
+effectcraft-cli exec library.preview '{"id": "io.github.yourname.glow-rings", "wait": true}'
+effectcraft-cli exec library.install '{"id": "io.github.yourname.glow-rings", "wait": true}'
+```
+
+* `library.refresh` reads the catalog and keeps a copy, so the next commands (separate runs of
+  the CLI) see it. A malformed entry is left out and logged with the reason.
+* `library.list` shows your package as users will see it (`latest`, `effects`, `needsNewerApp`).
+* `library.preview` downloads the module, checks it against `size` and `sha256`, and renders the
+  preview without installing anything. A wrong checksum fails here. The reply has the frame size
+  (320 × 180), the frame count, the effect's manifest, and two checks: `changes` (the effect
+  changes the sample frame with its defaults) and `animated` (the frames differ over time).
+* `library.install` installs it into the test settings folder and loads it.
+
+To look at the preview in the app, start the desktop app with the control channel
+(`effectcraft --control 9877`, with the same `EFFECTCRAFT_CONFIG_DIR` if you set one), point it at
+your catalog, then open Settings ▸ Plug-in Library and press Preview on your package:
+
+```sh
+effectcraft-cli exec library.refresh '{"catalog": "file:///home/me/glow-rings/index.json", "wait": true}' --bridge 9877
+```
+
+The Refresh button in the app goes back to the community catalog.
+
+## 9. Open a pull request to the catalog
+
+1. Fork [`storytold/effectcraft-plugins`](https://github.com/storytold/effectcraft-plugins).
+2. Add your package to `packages` in `index.json`. Keep the file's formatting.
+3. Open a pull request. Say what the effect does and link the release. A screenshot or a short
+   video helps the review.
+
+The repository runs automatic checks on every pull request (see
+[`examples/plugin-catalog`](../examples/plugin-catalog)); a maintainer then reviews it by hand.
+
+### Review checklist
+
+Reviewers check, and you can check first:
+
+* **Licence.** `license` is an open-source licence and the repository has its text.
+* **Public source.** `repo` is public and contains the plug-in's source at the release's tag.
+* **Reproducible.** The module builds from that source (the steps are in the repository's README)
+  and the result has the SHA-256 in the entry.
+* **No imports.** The module imports nothing; EffectCraft refuses it otherwise. `library.install`
+  from a local catalog shows it.
+* **Ids.** The package id and effect ids are your own, follow the rules, don't start with `ec.`,
+  and `effects` matches the manifest's `id`.
+* **Sensible defaults.** The effect does something visible with its defaults, so the live
+  preview shows it, and no default makes it slow.
+* **Description.** It says what the effect does, in plain words.
+* **Behaves.** It renders without errors at different sizes and preview resolutions, and the same
+  frame twice gives the same result.
+
+## 10. Release an update
+
+1. Change the code, raise the version in `Cargo.toml` and in the manifest, build, and publish a
+   new GitHub release (a new tag; never re-use an old one).
+2. Add a new object to `versions` with the new `version`, `url`, `sha256`, `size` and `effects`.
+   Keep the old entries: they may stay, and users of an older EffectCraft still get a release they
+   can run (set `minApp` on the new one if it needs a newer app).
+3. Test it with a local catalog as in [step 8](#8-test-the-entry-locally) (`library.update`
+   updates an installed package), and open a pull request.
+
+Users see "Update" on the package. Keep the effect id and the meaning of existing parameters, so
+projects made with the old version still open the same. Add parameters at the end.
+
+## 11. Remove a plug-in
+
+Open a pull request that deletes your package from `packages` (or one release from `versions`).
+People who installed it keep their copy: it stays in their list as unlisted until they remove it.
+If a release is broken or unsafe, say so in the pull request so it is removed quickly.
+
+## For users
+
+Settings ▸ Plug-in Library (also Effect ▸ Plug-in Library…):
+
+* **Fetch Catalog** reads the community catalog. Nothing is downloaded before that. Refresh reads
+  it again; the last one fetched is kept, so the list works offline.
+* **Preview** shows a package's effect live on a sample frame (playing, with a Before/After
+  slider) without installing it. The details list the effects and their parameters, and have
+  "Open on GitHub" and, when the author added one, "Watch video".
+* **Install** downloads the module, checks it against the catalog's size and SHA-256 and loads
+  it: the effect is in Effects & Presets at once.
+* **Update** (or **Update All**) installs a newer release. **Remove** deletes a package.
+* **Restart after updating or removing** a package whose effects are loaded: loaded effects can't
+  be unloaded, so the change takes effect at the next start, and the list says "Restart
+  EffectCraft to finish".
+* A project that uses an effect you don't have: `library.missing` lists the missing effects and
+  the catalog packages that provide them.
+
+The same commands work from the CLI, the control channel and MCP: `library.list`,
+`library.refresh`, `library.preview`, `library.install`, `library.update`, `library.uninstall`,
+`library.missing`, `library.loadInstalled` ([plugins.md](plugins.md#plug-in-library)).
+
+### Where files live
+
+Packages are installed in the `Plug-ins/Library` folder of the settings folder:
+
+| System | Settings folder |
+|---|---|
+| macOS | `~/Library/Application Support/EffectCraft` |
+| Windows | `%APPDATA%\EffectCraft` |
+| Linux | `$XDG_CONFIG_HOME/effectcraft` or `~/.config/effectcraft` |
+| Portable (a `portable.txt` beside the executable) | `EffectCraftData` beside the executable |
+
+`EFFECTCRAFT_CONFIG_DIR` overrides it. In `Plug-ins/Library`:
+
+* `<id>/<version>/<id>.wasm`: each installed module.
+* `installed.json`: what is installed, with the SHA-256 each module was installed with. At start-up
+  each module is checked against it; a module that changed on disk isn't loaded (install it
+  again).
+* `catalog.json`: the catalog last fetched.
diff --git a/docs/releasing.md b/docs/releasing.md
index bd28d8ec3..07d988b5c 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -71,7 +71,7 @@ The MSI's setup wizard ([`installer-ui.wxs`](../packaging/windows/installer-ui.w
 choose the install folder; upgrades and repairs reuse it, and `INSTALLFOLDER="..."` picks it for a
 silent (`/qn`) install. [`packaging-lint.yml`](../.github/workflows/packaging-lint.yml) install-tests
 that with stub binaries ([`test-msi.ps1`](../packaging/windows/test-msi.ps1)): a custom folder,
-an upgrade that keeps it, a repair, uninstall, and the Program Files default. The wizard pages
+an upgrade that keeps it, a repair, uninstall, and the all-users default folder (`Program Files\ArtCraft\EffectCraft`). The wizard pages
 themselves are checked by hand.
 
 The portable zip ships [`portable.txt`](../packaging/windows/portable.txt) beside `effectcraft.exe`.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 73fdfd235..5c71645e7 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -23,7 +23,7 @@ In this order (gap numbers from [gaps.md](gaps.md)):
 
 The core workflows of a motion designer in After Effects, checked on EffectCraft's main platform
 (macOS) from the scripted UI tests, the live After Effects ease oracle and the open issues
-(standard: craftrules `standards/progress-docs.md`, "Stages"). **All six pass, so EffectCraft is
+**All six pass, so EffectCraft is
 alpha**: each works end to end and the work saves and reopens; what's rough in them is listed, but
 none blocks the workflow.
 
diff --git a/docs/roto-brush-sam2.md b/docs/roto-brush-sam2.md
new file mode 100644
index 000000000..d1f3ba196
--- /dev/null
+++ b/docs/roto-brush-sam2.md
@@ -0,0 +1,211 @@
+# Roto Brush with SAM 2
+
+Roto Brush can follow an object through a clip with Meta's **SAM 2.1 Tiny** (Hiera-Tiny, 39M parameters,
+Apache-2.0). It is optional: nothing changes until you install the model and choose it.
+
+## Using it
+1. Settings ▸ Roto Brush ▸ SAM 2.1 Tiny ▸ **Install from File…** with the published `model.safetensors`
+   (155.9 MB). The file's size and SHA-256 are checked and the licence notice is kept next to it.
+   Agents: `roto.model.install {id: "sam2.1-hiera-tiny", path: "model.safetensors"}`.
+   SAM 2 has no in-app download until the weights are mirrored under storytold control.
+   Each model card links its pinned Hugging Face `model.safetensors` checkpoint, rather than the
+   project's different `.pt` files. Its checkpoint source and SHA-256 are retained in the notice.
+2. Choose it (`roto.model.select {id: "sam2.1-hiera-tiny", wait: true}` for agents). Installing an
+   unselected model does not activate it, even with `wait: true` on installation.
+3. Paint strokes on the base frame as usual, then **Propagate**. One tracking pass follows the object through the
+   whole span in both directions, using SAM 2's streaming memory, so it keeps tracking through occlusion and when the
+   object leaves the frame and returns. Each frame's probability map is then refined by the same graph cut as every other
+   Roto Brush frame: your strokes stay hard constraints and edges snap to colour.
+4. `roto.status {frame}` reports `source` (`tracker`, `model` for a frame the model segmented on its own, or
+   `classical`) and, for tracked frames, `tracker.frames[f]`: `confidence` (0–1, the model's object score times its
+   predicted mask quality) and `occluded` (the object is not in the frame: an empty matte). `model` says what Settings
+   chose and whether it is installed, loaded and loading; `notice` says when it is not the one in use for the layer.
+   `tracker.saved` names the model the saved frames came from.
+
+With SAM 2 chosen but not installed, or failing to load, Propagate refuses with the reason. A tracker failure during
+propagation can fall back to classic; its warning is live progress only, as described under [Memory and limits](#memory-and-limits).
+While it is still loading, `wait: true` (agents) loads it first; without `wait` it
+refuses, and the load goes on in the background. Deselecting SAM 2 (choosing Classic) runs Propagate exactly as before,
+and Roto Brush 1.0 never uses a model.
+
+Tracked frames are saved in the project with the instance, as Freeze's are, so a saved project renders the same when it
+reopens, in the app or with `effectcraft-cli`, without the model being loaded or chosen there. They apply while the
+strokes and span they came from are unchanged. Changing a stroke or the span makes them stale until the next Propagate.
+Choosing another model, or the classic engine, leaves them in place and `roto.status` says so. They retain the original
+model tag and per-object cache keys when rendered or re-saved; the next Propagate replaces them using the selected
+model (or classic engine). Object Matte saves nothing.
+
+## Several objects in one instance
+A Roto Brush instance can hold several objects. The **Object N** button in the Layer panel's bar picks the object new
+strokes belong to (it cycles through the objects that have strokes), and **+** starts a new one. Agents: `roto.options
+{object}` sets the current object, `roto.stroke` takes `object` (0–31; default the current one), `roto.clearStrokes`
+takes `object` to remove one object's strokes, and `roto.status` lists `objects` (`{id, strokes}`) and `currentObject`.
+
+With SAM 2, Propagate follows every object in **one pass** (the frame is encoded once, whatever the number of objects), each
+from its own foreground and background strokes, and the mattes are united into the instance's one matte. Each object keeps
+its own occlusion: the frame counts as absent only when every object is, and otherwise the least sure object sets the
+frame's confidence on the span bar. A background stroke belongs to its object, so it separates that object from what
+lies under it without cutting a hole in the others. Refine Edge strokes belong to the whole matte. The classic engine has
+no objects: all foreground strokes make one object, and background strokes apply to it as before. Saved projects are
+unchanged (strokes without an object are object 0, and nothing is written for object 0).
+
+**Seeing and choosing objects.** The Layer panel's boundary view outlines each object in its own colour (object 1 in the
+chosen boundary colour, the others from a palette), and the picker button carries the current object's colour. **Show
+Object** (Roto Brush Matte, a slider: 0 shows all objects together, N shows object N alone) limits the instance's matte to
+one object, so an effect after it can treat the pieces separately; an object the instance does not have shows nothing, and
+with one object, or on frames the classic engine made, the setting changes nothing. Each object's matte is kept next to
+the united one, in the session and in the saved tracking (`tracked` stores them only when there are several objects), so
+Show Object renders the same after the project is reopened. Freeze records the Show Object that was set.
+
+This is not several Roto Brush instances sharing a pass: each instance reads the layer after the effects above it, so
+instances can see different pixels. Objects inside one instance always see the same ones.
+
+## Sizes
+Four checkpoints are in the registry (Settings ▸ Roto Brush); the size is detected from the file, and each is
+pinned to a Hugging Face commit with its SHA-256. All run the same tracker; a bigger backbone costs time and memory.
+
+| Model | File size | GPU encode (RX 7900 GRE) | Agreement with PyTorch |
+|---|---|---|---|
+| SAM 2.1 Tiny (`sam2.1-hiera-tiny`) | 155.9 MB | 0.24 s | encoder 6.8e-6 |
+| SAM 2.1 Small (`sam2.1-hiera-small`) | 184.3 MB | 0.20 s | encoder 1.0e-5 |
+| SAM 2.1 Base+ (`sam2.1-hiera-base-plus`) | 323.5 MB | 0.37 s | encoder 2.3e-5 |
+| SAM 2.1 Large (`sam2.1-hiera-large`) | 897.9 MB | 0.72 s | encoder 5.2e-4 |
+
+### How the sizes compare on the benchmark clips
+`effectcraft-cli bench --roto --frames 24 --fixes --sam2 FILE`, release build, SAM 2 on the GPU (RX 7900 GRE), one run each.
+Mean IoU (after the object returns, in brackets) and seconds per tracked frame:
+
+| Clip | Tiny | Small | Base+ | Large |
+|---|---|---|---|---|
+| move | 0.992 | 0.988 | 0.986 | 0.994 |
+| light | 0.990 | 0.985 | 0.987 | 0.993 |
+| occlusion | 0.989 (0.987) | 0.988 (0.984) | 0.987 (0.984) | 0.989 (0.987) |
+| reenter | 0.982 (0.975) | 0.981 (0.970) | 0.978 (0.966) | **0.694 (0.110)** |
+| s / tracked frame | 0.69 | 0.70 | 0.79 | 1.17 |
+
+The classic engine scores 0.98 / 0.98 / 0.49 / 0.62 on the same clips. Peak tracker state is 88 MB for every size (the
+weights are not counted). The clips are synthetic and easy, so they cannot tell the sizes apart on accuracy: **no larger
+size tracked better here, and Large lost the object after it left and came back** (IoU 0.11 after the return, where
+Tiny, Small and Base+ found it again). That is the model's behaviour on this clip, not the port:
+Large matches PyTorch stage by stage. Whether a larger size helps on real footage is not measured.
+
+Settings therefore marks **Tiny** as recommended (the smallest download, and nothing larger did better), and says what was
+measured for the others; Base+ and Large also warn when no GPU was found (they take several seconds a frame on a CPU).
+The list carries `recommended` and `hint` per model (`roto.models`).
+
+### Half-precision weights (optional)
+`EFFECTCRAFT_SAM2_F16=1` keeps the weight matrices on the GPU as half precision, halving their memory (Large: about
+900 MB to 450 MB). It is off by default: the video logit error against PyTorch grows from about 0.003 to 0.06 (Tiny)
+and 0.12 (Large) with the same masks, and the speed gain is under 10% (Large encode 0.72 s to 0.66 s).
+
+### What stays on the CPU
+The mask decoder takes about 110 ms of a tracked frame (attention layers 42 ms, the two upscaling convolutions 50 ms).
+Rewriting the upscaling convolutions as a matrix product and a pixel shuffle did not make them faster, and a GPU port
+would save under 0.1 s of a 0.7 s frame, so it stays on the CPU.
+
+Every size was checked stage by stage against PyTorch (patch embedding, each Hiera block, neck, prompt encoder,
+decoder, memory encoder, memory attention) and on a whole clip forward and backward, on the CPU and the GPU: the video
+logit error is at most 0.005 with the same masks. Large carries much larger activations (peaks near 300 in the third
+stage), so its f32 rounding error is larger in absolute terms; its tests use a bound relative to the peak. Large needs
+the GPU to run per block (the encode submits once per block so intermediates are freed); a GPU error of any kind falls
+back to the CPU.
+
+## Corrections re-track only what they change
+A correction stroke changes the keys of the frames from it on (in both directions from the base), so Propagate tracks
+only those again: the window starts at the nearest prompted frame at or before the first frame it needs (the corrected
+frame, which restarts the object with its own prompt) and runs to the last frame it needs. Frames before the correction
+keep their tracked results, and a Propagate with nothing changed does no tracking. The older non-conditioning memory
+frames before the corrected frame are not rebuilt, so frames just after it can differ slightly from a from-scratch pass.
+Tracked frames of a session are in memory; a project reopened in a new process re-tracks the whole span after a stroke
+change (its saved tracking is stale as a whole).
+
+## Memory and limits
+The weights take about 156 MB. A model idle for 10 minutes is unloaded (a toast says so; the choice stays) and loads
+again when a Propagate or a stroke needs it. The tracker holds the memory banks of the objects it follows (about 2 MB per
+stored frame, pruned to the frames later ones can still look at) and refuses to grow past 2 GiB, or past a time limit when
+one is set, with a clear error instead of running out of memory. Two runs of the same prompts give bit-identical masks on
+the CPU.
+
+Pending per-object probability maps have a separate 256 MiB budget, including their allocated capacity and frame
+slots. This bounds the full-resolution results waiting to be united when objects first prompted on different frames
+report in separate passes. Reaching the budget cancels tracking and falls back to the classic engine. The reason is
+available as `trackerNote` in live job progress only. Completion removes that progress and shows a success toast, so
+`wait: true` callers can miss the fallback reason; the completion toast alone does not confirm the tracker was used.
+A single object's results need no pending buffer.
+
+## How it works
+`crates/sam2` is a Rust port (on [candle](https://github.com/huggingface/candle), native only) of the Hugging Face
+`transformers` SAM 2 implementation, Apache-2.0 (see its `NOTICE`). Every stage is checked against PyTorch by
+`crates/sam2/tests/it/reference.rs` (they skip without the weights; reference tensors come from
+`tools/sam2_reference.py` and `tools/sam2_video_reference.py`):
+
+| Stage | Max abs error vs PyTorch |
+|---|---|
+| Hiera backbone, 12 blocks | 2.6e-5 |
+| Neck features / position encodings | 9.7e-6 / 6e-8 |
+| Prompt embeddings | 1.2e-7 |
+| Mask decoder (logits up to 11.6) | 1.1e-4 |
+| Memory encoder | 3.5e-6 |
+| Memory attention (rotary) | 2.6e-5 |
+| 7-frame clip, forwards and backwards (9 frame results) | logits 0.0038, IoU 1.0000 |
+
+SAM 2 is prompted with at most three foreground and three background points per frame: it was trained on a handful
+of clicks, and measured confidence collapses with many (0.99 with 1–7 points, 0.25 with 16, 0.00 with 32).
+
+## Speed (this PC: AMD RX 7900 GRE and a 16-thread CPU, release build)
+SAM 2 runs on the GPU when there is one (wgpu compute kernels, so AMD, NVIDIA and Intel alike; candle itself has no AMD
+backend) and on the CPU otherwise. The model loads on the GPU automatically; `EFFECTCRAFT_SAM2_DEVICE=cpu` (or `gpu`)
+overrides it. wgpu's environment variables apply to the adapter it picks (`WGPU_BACKEND`, `WGPU_POWER_PREF`,
+`WGPU_ALLOW_UNDERLYING_NONCOMPLIANT_ADAPTER`…); a software adapter, or one without compute shaders, leaves SAM 2 on
+the CPU. A GPU that fails (no adapter, out of memory, a lost device) makes the CPU take over for the rest of the
+session, and `roto.status` reports `tracker.device` (the GPU's name, or `CPU`).
+
+| Step | CPU | GPU |
+|---|---|---|
+| Encode one 1024 × 1024 frame | 2.05 s | **0.24 s** |
+| Memory attention (full bank of 7 memory frames) | 2.3 s | **0.29 s** |
+| Memory encoder | 0.24 s | 0.05 s |
+| Decoder (CPU on both) | 0.11 s | 0.11 s |
+| **A tracked frame in all** | **4.3 s** | **0.7 s** |
+| A click on an encoded frame | 0.10 s | 0.10 s |
+
+A 300-frame clip takes about 21 minutes on the CPU and about 3.5 minutes on this GPU; the decoder, still on the CPU, is the
+next 16 % of a GPU frame. The CPU numbers came down from 3.4 s per encode at the start of the speed
+work (parallel GELU and bias add, cached position encodings, pooling without permutes); chunking the attention queries was
+tried and did not help. The GPU kernels (`crates/sam2/src/gpu`) are tested against CPU definitions and PyTorch: the
+encoder's 64 × 64 level matches PyTorch to 7e-6, the memory attention to 1.8e-5, and a clip tracked on the GPU matches
+`Sam2VideoModel` as the CPU does (worst logit error 0.0032). `cargo run --release -p effectcraft-sam2 --example sam2_bench`
+times the pieces on both devices (`EFFECTCRAFT_SAM2_PROFILE=1` prints a frame's breakdown).
+
+## Benchmark
+`effectcraft-cli bench --roto [--frames N] [--sam2 model.safetensors (any size; default: the first installed)] [--mobilesam mobile_sam.pt]` runs synthetic clips with
+known mattes through all three. 24 frames, debug build, SAM 2 on the GPU; mean IoU (mean IoU after the object returns), seconds
+per frame:
+
+| Clip | Classical | MobileSAM | SAM 2.1 Tiny |
+|---|---|---|---|
+| move | 0.980 | 0.989 | 0.992 |
+| light | 0.979 | 0.990 | 0.992 |
+| occlusion (a bar hides the disk, then clears it) | 0.491 (0.000) | 0.494 (0.000) | 0.989 (0.988) |
+| reenter (the disk leaves and comes back) | 0.618 (0.000) | 0.620 (0.000) | 0.982 (0.976) |
+| s/frame | 0.01 | 0.5–1.3 | 0.8 |
+
+MobileSAM prompts every frame independently from the flow-warped matte, so it follows the object while the flow does and
+loses it when it is hidden; SAM 2's streaming memory is what lets it re-acquire the object. The synthetic clips are easy (one
+textured disc), so the "move" and "light" rows mostly show all three working; the last two rows are the difference.
+
+### Corrections needed (`--fixes`)
+`bench --roto --fixes` also counts the correction rounds each tracker needs before every frame reaches IoU 0.9: after each
+run it paints on the first frame under the target, up to 6 rounds. A round can add a short foreground stroke through the
+true object's centre and a background stroke at the centroid of all false-positive pixels. With separate false-positive
+blobs, that centroid can fall between them. The counts below are rounds, not individual strokes. 16 frames, debug build:
+
+| Clip | Classical | MobileSAM | SAM 2.1 Tiny |
+|---|---|---|---|
+| move | 0 | 0 | 0 |
+| light | 0 | 0 | 0 |
+| occlusion | more than 6 | more than 6 | 0 |
+| reenter | more than 6 | more than 6 | 0 |
+
+The simulated user is simple (one stroke pair per round, always on the first bad frame), so "more than 6" means this
+correction model never recovers the flow-based engines on those clips, not that no human could. Peak memory is not measured.
diff --git a/docs/scripting-parity.md b/docs/scripting-parity.md
index 7ef7e9080..9aa6ca626 100644
--- a/docs/scripting-parity.md
+++ b/docs/scripting-parity.md
@@ -18,15 +18,16 @@ our own scripts; no real-world script library has been run against both apps.
 | Expression object model | `thisComp`, `thisLayer`, `wiggle`, `loopOut`, `valueAtTime`, `sampleImage`, `footage()`, text style API… | Same members, from the reference, including `propertyGroup(countUp)` and a group's `propertyIndex` for name-independent rigs (#1619) | good | `crates/expr/src/tests.rs`, `tests/property_group.rs`; behaviour of edge cases unmeasured (G1) |
 | Expression editing | Inline field, error bar, pick whip, Expression Language menu, external editors | Inline field that grows, error bar, pick whips (property and value), language menu | partial | External editor support (#364) |
 | Expression performance | Cached, multi-frame | Per-thread boa contexts | unknown | No benchmark |
-| Scripting object model | `app`, `Project`, items, layers, properties, keys, eases, render queue, `TextDocument`, `Shape`, markers, `File`/`Folder`, `Socket`, `app.settings` | Same classes, edits run through undoable engine commands; match names table; layers, groups and properties are callable (`layer("Effects")(1)` is `.property(...)`) | good | `crates/script` tests (≈ 10 test files) |
+| Scripting object model | `app`, `Project`, items, layers, properties, keys, eases, render queue, `TextDocument`, `Shape`, markers, `File`/`Folder`, `Socket`, `app.settings` | Same classes, edits run through undoable engine commands; match names table, the properties of Offset Paths and Zig Zag included; layers, groups and properties are callable (`layer("Effects")(1)` is `.property(...)`) | good | `crates/script` tests (≈ 10 test files) |
 | `$.evalFile`, `BridgeTalk` | Evaluate another script file; identify the host application and message other Adobe applications | `$.evalFile` evaluates a file relative to the calling file (nested at most 32 deep, under the scripts' file gate) and returns its last value; `BridgeTalk` names the host honestly (`appName` `effectcraft`, its version); messaging other applications throws "not supported" | partial | `tests_evalfile.rs` (#760); no inter-application messaging |
-| ScriptUI | Dialogs, palettes, dockable panels, resource strings, `onDraw` / ScriptUIGraphics, mouse events | Same, dockable panels reopen at launch | good | `ui_scriptui`, `tests_ui*` |
-| `app.scheduleTask` / `cancelTask` | One-shot and repeating tasks (polling, panel refresh) until `cancelTask` | Same: repeating tasks run every `delay` ms (at least 50 ms, at most 64 pending per script) until `cancelTask`, until they throw (reported once, then cancelled), or until their owner goes: a script's last window closing, or the project closing for scripts without windows; frontends tick them every frame, agents with `script.runTasks` | good | `tests_tasks.rs` (#773); one-shot tasks of a script file still run right after it, not after their delay |
-| Scripts menu, ScriptUI Panels folder | yes | yes | same | [plugins.md](plugins.md) |
-| Startup / Shutdown folders | yes | not run | missing | plugins.md |
+| ScriptUI | Dialogs, palettes, dockable panels, resource strings, `onDraw` / ScriptUIGraphics, mouse events | Same, dockable panels reopen at launch; a docked panel gets its dock's size and `onResize` (`scriptui.resize`, #2585); a drag keeps reaching the control it started on past the window edge, and `MouseEvent.buttons` reports the held buttons (#2584) | good | `ui_scriptui`, `tests_ui*` |
+| `app.scheduleTask` / `cancelTask` | One-shot and repeating tasks (polling, panel refresh) until `cancelTask` | Same: repeating tasks run every `delay` ms (at least 50 ms, at most 64 pending per script) until `cancelTask`, until they throw (reported once, then cancelled), or until their owner goes: a script's last window closing, or the project closing for scripts without windows (a Startup script's tasks go on until EffectCraft quits); frontends tick them every frame, agents with `script.runTasks` | good | `tests_tasks.rs` (#773); one-shot tasks of a script file still run right after it, not after their delay |
+| Scripts menu, ScriptUI Panels folder | yes | yes; a subfolder (one level) of either folder is a submenu named after it | same | [plugins.md](plugins.md) |
+| Startup / Shutdown folders | yes | `Scripts/Startup` runs at launch and `Scripts/Shutdown` runs as the desktop app quits, after the project is closed, each in alphabetical order | partial | `crates/script/src/tests/startup.rs`; each script has its own global scope, so a Startup script's variables and functions are not available to later scripts ([plugins.md](plugins.md)) |
 | `#include`, `#target` directives | yes | `#include` / `//@include` / `#includepath` inline files relative to the including script (once each, nested at most 32 deep, under the scripts' file gate; errors name the included file and line); `#target`, `#targetengine`, `#strict` are ignored | good | `tests_include.rs` (#759); installed scripts and panels have no folder of their own, so they include from the project's folder or absolute paths |
 | `.jsxbin` | yes | no | out of scope | No public specification |
-| Keyboard shortcuts for scripts | yes | no | missing | plugins.md |
+| Keyboard shortcuts for scripts | yes: the scripts of the Scripts folder take keys, by their place in the alphabetical list | Edit ▸ Keyboard Shortcuts lists the scripts of File ▸ Scripts; a key stays with the script's file name | same | `file_scripts_entries_take_keyboard_shortcuts`, `a_key_given_to_a_script_runs_it` ([plugins.md](plugins.md)); ScriptUI panels in the Window menu take no key |
+| Recent Script Files | File ▸ Scripts ▸ Recent Script Files (10 scripts), a key to rerun | Same list, kept in the settings; Cmd+Alt+Shift+D reruns the most recent script | same | `recent_script_files_run_again` ([plugins.md](plugins.md)) |
 | Command-line rendering `aerender` | yes | `effectcraft-cli render`, `script`, `exec` | same purpose | `apps/effectcraft-cli` |
 | Essential Graphics scripting hooks | `addToMotionGraphicsTemplate…` | yes (M13.7) | good | — |
 | Agent control (MCP, control channel, every command) | none | yes | beyond | [agents.md](agents.md), [control-protocol.md](control-protocol.md); `list_effects` omits parameter types and ranges (#441) |
@@ -34,7 +35,7 @@ our own scripts; no real-world script library has been run against both apps.
 
 ## Estimate
 
-**≈ 20–40 h**: `#include` / `#target` (landed, #759) and Startup / Shutdown folders 4–8 h as first estimated (Startup / Shutdown remain), script shortcuts 2–4 h,
+**≈ 20–40 h**: `#include` / `#target` (landed, #759) and Startup / Shutdown folders 4–8 h as first estimated (Startup / Shutdown landed; a global scope shared between scripts remains), script shortcuts 2–4 h,
 a corpus of public scripts and expressions with the fixes it finds 10–20 h, an expression
 performance benchmark 4–8 h.
 
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 3ebaa4524..247887345 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -114,13 +114,13 @@ compositing and effects dominate; audio is light). Hours are to full parity for
 
 | Area | Weight | Breadth | Ready | Hours | Biggest gaps (details in [gaps.md](gaps.md)) |
 |---|---:|---:|---:|---:|---|
-| Project, footage and import | 8% | 92% | 55% | 25–45 | No relative paths or relinking when a project moves; Media Browser lists AVI, which it can't import (TGA/HDR/DPX/MXF import since #745, #756, #767); #431, #324, #552 and #351 are closed |
+| Project, footage and import | 8% | 92% | 55% | 25–45 | No relative paths or relinking when a project moves; TGA/HDR/DPX/MXF/AVI import since #745, #756, #767, #1701 (no DV or MPEG-4 Part 2 AVI yet); #431, #324, #552 and #351 are closed |
 | Compositions, layers and compositing | 13% | 98% | 60% | 30–55 | 32-bpc blend modes differed from After Effects (#494, closed); expand precomps in place (#601); #527, #510, #513, #539 and #540 are closed |
 | Animation: keyframes, graph editor, motion paths, puppet | 15% | 97% | 55% | 35–60 | Only scalar ease is measured against After Effects (168 samples); puppet lag (#586); #456, #457, #355, #553 and #318 are closed; Proportional Scrubbing (26.2) |
-| Expressions and scripting | 7% | 93% | 65% | 20–40 | `.jsxbin`, Startup/Shutdown folders, script shortcuts (`#include` landed, #759); external editor (#364); see [scripting-parity.md](scripting-parity.md) |
+| Expressions and scripting | 7% | 93% | 65% | 20–40 | `.jsxbin`, a global scope shared between scripts, script shortcuts (`#include` landed, #759; Startup/Shutdown folders run); external editor (#364); see [scripting-parity.md](scripting-parity.md) |
 | Shapes, masks and roto | 9% | 93% | 45% | 30–50 | Open mask and shape issues (#1004, #999, #1042, #932); #510, #513, #527, #509 and #303 are closed; paste SVG/AI as shape layers (26.3; SVG markup pastes since #738) |
 | Text and typography | 7% | 94% | 50% | 20–35 | CJK text in comps renders wrongly (#453); paragraph alignment inverted (#316); soft text at Fit (#417, mostly fixed by #444); toolbar font options (#550); #483 and #583 are closed; variable-font filter landed (#741) |
-| Effects and animation presets | 14% | 85% | 40% | 70–130 | All 306 effects exist, but rendered output is unmeasured against After Effects; 54 built-in presets (text, Transitions, Backgrounds) against After Effects' 621 ([effects-parity.md](effects-parity.md)); open effect bugs (#580 crash, #463, #369, #473, #474; #514 and #526 are closed); effect colour labels (26.5); see [effects-parity.md](effects-parity.md) |
+| Effects and animation presets | 14% | 85% | 40% | 70–130 | All 306 effects exist, but rendered output is unmeasured against After Effects; 76 built-in presets (text, Transitions, Backgrounds, Behaviors) against After Effects' 621 ([effects-parity.md](effects-parity.md)); open effect bugs (#580 crash, #463, #369, #473, #474; #514 and #526 are closed); effect colour labels (26.5); see [effects-parity.md](effects-parity.md) |
 | 3D (Classic and Advanced) | 6% | 82% | 35% | 35–65 | No FBX/USD/STL models, no Substance materials, mesh displacement unverified; no 3D transform gizmos (#392, #347); reflections (#261); camera aperture (#260); #489 and #315 are closed |
 | Tracking and AI-assisted tools | 5% | 80% | 35% | 35–70 | Object Matte (26.2) has the effect, the viewer tool (click / box), background tracking, Freeze and the 26.5 disk cache, not yet compared with After Effects; Roto Brush (MobileSAM) and face tracking (MediaPipe) unmeasured against After Effects; camera-tracker view (#505) |
 | Preview and cache | 7% | 92% | 40% | 25–50 | Playback stutters on cached frames (#595, #304); late audio (#504, #335); #329 and #554 are closed; no benchmark against After Effects |
@@ -139,7 +139,7 @@ Feature depth (≈ 50%) feeds the overall *ready* number with the other dimensio
 | UI/UX fidelity | 65% | 60–120 | After Effects-shaped menus (587 entries), panels, workspaces, shortcuts; many interaction issues still open; multi-monitor only as separate panel windows (#486 open); Effect Controls not yet like 26.5's | [ui-parity.md](ui-parity.md) |
 | File formats | 50% | 130–230 | `.aep` / `.aepx` / `.mogrt` / `.ffx` can't be read; strong modern codecs (H.264, HEVC, AV1, VP9, ProRes) | [file-format-parity.md](file-format-parity.md) |
 | Hardware | 40% | 60–120 | wgpu GPU on Metal/Vulkan/Direct3D 12/WebGPU with CPU fallback; no hardware decode/encode; Direct3D 12 compositor fails (#613); no video-out hardware | [hardware-parity.md](hardware-parity.md) |
-| Localization | 18% | 60–110 + review | Average coverage of After Effects' 10 non-English languages (measured catalog rows over ≈ 3,900 strings): menus in 10 languages, panels in 6, effects in none; After Effects ships 11 languages fully | [localization-parity.md](localization-parity.md) |
+| Localization | 24% | 60–110 + review | Average coverage of After Effects' 10 non-English languages (measured catalog rows over ≈ 4,200 strings): menus in 10 languages, panels in 7, effects in Simplified Chinese and Japanese; After Effects ships 11 languages fully | [localization-parity.md](localization-parity.md) |
 | Performance | 35% | 50–100 | Internal numbers only; users report stutter and slow scrubbing | [gaps.md](gaps.md#g5-performance-at-real-world-scale) |
 | Stability | 45% | 40–80 | Open crash reports #580, #501, #426, #341, #234, #879 (#591, #306 and #511 are closed); no CI runs the tests on pull requests | [gaps.md](gaps.md#g3-stability-and-a-green-main) |
 | Platforms | 65% | 30–60 | Releases for macOS, Windows x64/x86/ARM64, Linux, FreeBSD and the web (more than After Effects), but Linux and Windows users hit basic bugs | [gaps.md](gaps.md#g2-real-user-reliability-on-every-platform) |
@@ -171,8 +171,7 @@ Checked on 10 October 2026 when the mainstream and essentials numbers were added
 
 ## Mainstream practitioner and essentials user
 
-Two narrower questions, computed the same way in every craft app (craftrules
-`standards/progress-docs.md`, "Numbers"). The stage still follows the full-target number and the
+Two narrower questions, computed the same way in every craft app. The stage still follows the full-target number and the
 [alpha gate](roadmap.md#alpha-gate).
 
 ### Mainstream practitioner
@@ -429,7 +428,7 @@ the disk cache in the formats wave; the 3D Camera Tracker in M12.6.)
 | Import | 97% | 0.5 | JPX / JBIG2 images and predefined non-Identity CJK CMaps inside PDF/AI files, Illustrator EPS relying on Adobe procsets, PSD 3D layers (M13.12: mesh shadings — free-form / lattice Gouraud triangles, Coons and tensor patches — and function-based shadings, CCITT G3 / G4 images, knockout / isolated transparency groups with group alpha and soft masks on the group's result, `/W2` vertical metrics, EPS text with embedded Type 1 / CFF or bundled fonts, and Create Shapes from Vector Layer keeping images as parented footage layers in paint order; M13.6: PDF/AI text with embedded TrueType / CFF / Type 1 / Type 3 fonts and standard-14 fallback to the bundled fonts, Flate / DCT / inline / stencil images with soft masks, Indexed and ICC alternates, luminosity / alpha soft masks, the 16 blend modes, tiling patterns, calculator functions, any page via `file.import page` and the Import dialog, clip groups kept by Create Shapes from Vector Layer as layer masks / Merge Paths; PSD smart-object perspective quads and placed-layer warps — named styles and custom quilt meshes — baked as placed; PDF / PDF-compatible AI / EPS vector footage with Continuously Rasterize, layered composition import and Create Shapes from Vector Layer, and PSD smart objects with embedded files landed in M13.2; PSD as footage/composition/retain layer sizes, SVG footage earlier; PDF / AI Composition - Retain Layer Sizes crops each layer to its artwork in place, #1536) |
 | Automation | ≈ 99% | 0.1 | `.jsxbin` (AUT-2: concave / self-intersecting `onDraw` fills, real images in `drawImage`, image controls and icon buttons landed in M13.11; ScriptUI resource strings, `onDraw`/ScriptUIGraphics, live `onChanging`, `Socket`, Essential Graphics hooks — `addToMotionGraphicsTemplate(As)`, `canAddToMotionGraphicsTemplate`, `exportAsMotionGraphicsTemplate`, `motionGraphicsTemplateName`, controller count/names — and Watch Folder landed in M13.7; the core object model landed in M14.4; ScriptUI windows/dialogs/dockable panels with `scriptui.*` agent commands, File ▸ Scripts install + sample scripts, and the effect plug-in API (EFF-6, WebAssembly) landed in M13.1) |
 | Shapes | ≈ 80% | 1.5 | Lottie can't carry stroke taper/wave (stroke Taper and Wave, Dash 2/Gap 2/Dash 3/Gap 3 and radial-gradient Highlight Length/Angle landed in M13.5; pen tool for shape paths and vertex editing in M6.5) |
-| Compositions | ≈ 81% | 3.3 | Mocha-style planar tracks for templates; nested comp markers on the precomp layer bar (Preserve frame rate / resolution when nested and nested comps showing nothing past their end landed in M4.9–M4.10; Pre-compose keeping the comp's settings and New Comp from Selection's dialog in M3.12; CMP-7: Essential Graphics mirrored and linked properties landed in M13.11; Font and uniform Scale controls, Composition ▸ Open in Essential Graphics, Save Frame As ▸ Photoshop Layers / ProEXR and the VR Comp Editor landed in M13.7; the marker dialog, Composition Flowchart, Essential Graphics with master properties, `.ectemplate` templates and Responsive Design — Time landed: CMP-6, CMP-7) |
+| Compositions | ≈ 81% | 3.3 | Mocha-style planar tracks for templates; nested comp markers on the precomp layer bar; a dialog for Scale Composition (After Effects' File ▸ Scripts ▸ Scale Composition.jsx), which runs headless as `comp.scale {factor \| width \| height}` (#2208: the comp, every unparented layer's Position and Scale with all keys, camera Zoom and guides; nested precomps and expressions stay as they are) (Preserve frame rate / resolution when nested and nested comps showing nothing past their end landed in M4.9–M4.10; Pre-compose keeping the comp's settings and New Comp from Selection's dialog in M3.12; CMP-7: Essential Graphics mirrored and linked properties landed in M13.11; Font and uniform Scale controls, Composition ▸ Open in Essential Graphics, Save Frame As ▸ Photoshop Layers / ProEXR and the VR Comp Editor landed in M13.7; the marker dialog, Composition Flowchart, Essential Graphics with master properties, `.ectemplate` templates and Responsive Design — Time landed: CMP-6, CMP-7) |
 | Animation | 70% | 9.0 | puppet depth beyond pins, recording, rigging and follow-through (G2: the expression pick whip scrolls the Timeline when held at its top or bottom, #362; dropped on one of a property's values it picks that dimension (`position[0]`), #363; every property has a property pick whip in the Parent & Link column, which adds the reference as its expression or replaces the one it has, and pick whips drop on Effect Controls properties too, #363; the inline expression field grows while typing and its bottom edge drags it taller or shorter, #371; an angle's revolutions scrub and take typing in Effect Controls, the Timeline and Properties, #93; puppet pin recording with Record Options landed in M13.1; pin selection, rotate/scale handles, nulls for pins and Follow-Through in M13.14–M13.16), Wiggler/Smoother/Motion Sketch (motion-path handles and the graph editor transform box landed in M5.8; keyframe colour labels and Select Keyframe Label Group, Graph Editor snapping to markers / layer ends in M13.5) |
 | Text | ≈ 96% | 0.3 | no extruded strokes (G2: the font menus list every installed family with its own styles — before, only a project asking for a font read the system fonts — and `text.fonts` / MCP `list_fonts` list them for agents; M13.12: the Variable Font Axes animator re-spaces the text — advances follow the animated axes; M13.6: variable font axes in the character style — `layer.setText variations`, the Character panel's Variable Font Axes fields — shape with HVAR / gvar advances and draw at that design-space position; OpenType features — stylistic sets, discretionary ligatures, contextual / stylistic alternates, swash, titling, ordinals, fractions, figure styles, true small caps / all small caps and superior / inferior glyphs with faux fallback — per character with the Character panel's OpenType popup and `text.fontFeatures` landed in M13.2; vertical Roman / Tate-Chu-Yoko, forced LTR paragraphs, caret on animated and path text, Variable Font Axes and Lottie style runs landed in M13.5; extruded, bevelled text in M7.6; per-character styles, paragraph settings, on-canvas editing and the `sourceText` style API in M9.9–M9.10) |
 | Web | 98% | 0.1 | No shared-memory threads inside one engine instance (the decided design is one engine instance per worker; a threaded build needs nightly `build-std`) (M13.30: Render Queue, analyses and Content-Aware Fill render on each job worker's own WebGPU device in passes, particles and Advanced 3D read back under keys, layer buffers in the browser's disk cache; browser storage, Web Audio, Web Worker renders/analyses, WebGPU viewer and offline install landed in M15.2; viewer frames in frame workers fed by project diffs, Roto Brush propagation in a worker, non-blocking `wait: true` jobs and a browser Media Browser (File System Access folders, browser storage) in M13.10; WEB-1 in M13.24: GPU effects and the GPU compositor in the frame workers on their own WebGPU devices with deferred readbacks (frames render in passes; Backend Auto per comp), the disk cache in the Origin Private File System (written by the workers with sync access handles, LRU under the settings' limit, served after a reload), the storage manager (Settings ▸ Disk ▸ Browser Storage, `storage.info` / `storage.persist` / `storage.clear`), and a WGSL constant Chrome rejected (it disabled every GPU kernel in Chrome) fixed) |
@@ -688,8 +687,10 @@ Fixes from measured reports:
   step (undo and redo keep it) and keeps the comp's cached frames; projects saved before open
   with Auto. View ▸ Resolution and the panel's popup run `view.res.full|half|third|quarter|auto`
   and `view.res.custom {factor}`, which now work headless too; `comp.info` reports `resolution`
-  and `resolutionFactor` (#417). Not yet: the magnification is not saved per comp, and the
-  Composition Settings dialog has no Resolution popup.
+  and `resolutionFactor` (#417). Composition Settings ▸ Basic has the same Resolution menu, with
+  the frame size and memory per 8bpc frame at that resolution beside it; OK sets it as the popup
+  does, outside the undo step of the other settings (#2167). Not yet: the magnification is not
+  saved per comp.
 
 ### Update: plug-ins and extensions as in After Effects; ease presets become a ScriptUI panel
 
@@ -1068,7 +1069,7 @@ resolution, adjustment) and composited at 8 and 32 bpc:
   Bucket's flood-filled region, Eyedropper Fill's sample); segments and convex polygons are
   binned into 16 × 16 tiles and rasterised on the GPU with the CPU's coverage functions, glows
   and compositing included. The CPU effects were refactored to draw from the same plans with
-  bit-identical output (`crates/effects/tests/gen_golden.rs`: 288 frame hashes pinned before
+  bit-identical output (`crates/effects/tests/it/gen_golden.rs`: 288 frame hashes pinned before
   the refactor). Exception: CC Threads decides band membership and fibre shade per pixel, and at
   round parameter values (the defaults) pixel centres sit exactly on band edges, where f32 and
   the CPU's f64 can fall on either side: up to 5 % of pixels allowed (measured ≤ 3.6 % at half
@@ -1082,7 +1083,7 @@ resolution, adjustment) and composited at 8 and 32 bpc:
 7 more effects run on the GPU (280 in all, with M13.28's 37), and five CPU fallbacks are gone. Each case is
 checked against the CPU oracle (≤ 1/255 at 8 bpc, ≤ 1e-3 at 32 bpc) directly on a buffer (full
 and half resolution) and composited at 8 and 32 bpc; the CPU refactors behind the shared plans
-are pinned bit for bit by golden hashes (`crates/effects/tests/particle_golden.rs`,
+are pinned bit for bit by golden hashes (`crates/effects/tests/it/particle_golden.rs`,
 `timewarp_golden.rs`, `sim_golden.rs`).
 
 - **Particle render passes** (`gpu::fx_particles`): CC Particle World and CC Particle Systems II
diff --git a/docs/testing.md b/docs/testing.md
index 3a9757474..e84a9a23b 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -2,9 +2,36 @@
 
 ```sh
 cargo test --workspace     # everything
-cargo xtask ci             # fmt, clippy -D warnings, tests, layers, assets, wasm
+cargo xtask ci             # fmt, clippy -D warnings, tests, pdf-deps, layers, assets, wasm
 ```
 
+The After Effects test projects of `crates/aep` are not in the repository; without them the
+`crates/aep`, engine and ui-egui tests that need one print `SKIPPED: fixture <name> missing` and
+pass. They live in [storytold/effectcraft-corpus](https://github.com/storytold/effectcraft-corpus).
+`cargo xtask aep-corpus` fetches them at the commit pinned in `crates/aep/tests/fixtures/corpus.lock`,
+checks every file against the SHA-256 listed there (any mismatch fails and installs nothing) and
+installs them in `corpus/aep`. Point `EFFECTCRAFT_AEP_FIXTURES` at that folder to run those tests
+too, and set `EFFECTCRAFT_AEP_FIXTURES_REQUIRED=1` as well to make a missing project fail its test
+instead of skipping (a corpus run that must not pass by skipping):
+
+```sh
+cargo xtask aep-corpus
+EFFECTCRAFT_AEP_FIXTURES=corpus/aep EFFECTCRAFT_AEP_FIXTURES_REQUIRED=1 cargo test -p effectcraft-aep
+```
+
+The `dev` profile keeps debug info to line tables (fast builds, readable backtraces). To debug
+interactively — local variables, parameters, column breakpoints — build with the `dev-full`
+profile: `cargo run --profile dev-full -p effectcraft -- --demo` (see `CONTRIBUTING.md`).
+
+`cargo xtask ci` builds in the dev profile and runs the tests with `cargo nextest run` (plus
+`cargo test --doc`) when `cargo-nextest` is installed, and with `cargo test` otherwise. It then
+runs `missing_translations_report` with `--nocapture`, which prints the interface strings each
+language has no translation for. Those strings show in English; the report always passes.
+
+Each crate with several integration-test files has one test binary, `tests/it/main.rs`, whose
+modules are the files in `tests/it/`. Run one file with `cargo test -p <crate> --test it <module>::`
+or `cargo nextest run -p <crate> -E 'binary(it) and test(/^<module>::/)'`.
+
 ## What the tests cover
 
 - **Engine commands** (`crates/engine/src/tests*.rs`): every command family, including undo and
@@ -16,7 +43,7 @@ cargo xtask ci             # fmt, clippy -D warnings, tests, layers, assets, was
 - **Effects** (`crates/effects`): each effect has a determinism test and at least one behaviour
   test (identity at neutral settings, known pixel results, or simulations giving the same frame
   whether you seek straight to it or play up to it). A registry-wide test checks that effects
-  which read the clock are declared time-dependent. `crates/effects/tests/sim_golden.rs` pins
+  which read the clock are declared time-dependent. `crates/effects/tests/it/sim_golden.rs` pins
   exact pixel hashes of the simulation effects the GPU shares plans with (CC Rainfall … Card
   Wipe) at several settings, times, bit depths and resolutions, so any change to their CPU output
   fails (re-pin with `SIM_GOLDEN_PRINT=1` after an intended change; pinned for aarch64 macOS,
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index ccce70e0f..5a2b4c75f 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (path-editing layer bounds, #1220; closed issue references re-audited against `upstream/main` 470ea7a3) · **Target:** Adobe After Effects 2026
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-18 · **Change:** minor (accessibility row, second slice: Info, Flowchart, Script Console and the 3D Camera Tracker block named and keyboard-operable, #1335; earlier changes: accessibility row: an AccessKit audit and a contrast test, three more panels named and keyboard-operable, #1335; shape group Contents row elided; path-editing layer bounds #1220; closed issue references re-audited against `upstream/main` 470ea7a3) · **Target:** Adobe After Effects 2026
 
 How closely EffectCraft's interaction matches After Effects: tools, handles, snapping, nudging,
 modifier keys, shortcuts, drag behaviour, numeric entry, panels, context menus and feel. Evidence
@@ -16,11 +16,11 @@ feel and platform differences, and the 26.x interface changes are not in yet.
 | Area | Status | % | Evidence and gaps |
 |---|---|---:|---|
 | Menu bar | After Effects' menus, order, submenus and labels; native on macOS; keyboard-operable in-window bar | 95% | 587 entries in `crates/engine/src/menus.rs`; Adobe-service entries omitted by design; `ui_menus` tests (#279) |
-| Panels and workspaces | Every After Effects panel; all standard workspaces; drag-to-dock, tabs, floating panels, maximise | 75% | `ui_tabs`, `ui_panels`; panels move into their own native windows on any screen (#486 open: no dragging tabs between those windows); #302, #301 and #320 (docking, stacked-panel headers, workspace persistence) are closed |
-| Timeline | Switches, modes, parent & link, twirl-downs, reveal shortcuts (U, UU, P, S, R, T, A, E, M, F, Alt+Shift…), pick whips, graph editor, work area, markers | 75% | `ui_keyframes`, `ui_timeline_*`; expand precomps in place (#601); #456, #457, #569 and #355 (Graph Editor jitter and buttons, negative rotation, bulk keyframing) are closed; Proportional Scrubbing (26.2: Ctrl+Alt / Cmd+Opt scrub of hot text spreads the change over the selected layers by selection order, #770) matched for layers selected as a whole, not yet for individually selected properties; every layer has the Video switch, nulls, cameras and lights included (a null with its eye off has no box or handles in the viewer and isn't picked there) |
+| Panels and workspaces | Every After Effects panel; all standard workspaces; drag-to-dock, tabs, floating panels, maximise | 75% | `ui_tabs`, `ui_panels`; on Windows, macOS and X11 floating panels are OS windows of their own on any screen (on Wayland, the web and in embedded viewports they stay in the app window), with tabs and groups dragging between windows and shortcuts working in them (#486); #302, #301 and #320 (docking, stacked-panel headers, workspace persistence) are closed |
+| Timeline | Switches, modes, parent & link, twirl-downs, reveal shortcuts (U, UU, P, S, R, T, A, E, M, F, Alt+Shift…), pick whips, graph editor, work area, markers | 75% | `ui_keyframes`, `ui_timeline_*`; expand precomps in place (#601); #456, #457, #569 and #355 (Graph Editor jitter and buttons, negative rotation, bulk keyframing) are closed; Proportional Scrubbing (26.2: Ctrl+Alt / Cmd+Opt scrub of hot text spreads the change over the selected layers by selection order, #770) matched for layers selected as a whole, not yet for individually selected properties; every layer has the Video switch, nulls, cameras and lights included (a hidden null, camera or light has no box or handles in the viewer and isn't picked there; other selected hidden layers keep their layer controls and paths, #1769); a row control (a switch, the label swatch, a Modes cell) clicked on one of several selected layers acts on the whole selection, with the layers the switch doesn't apply to left out (#1849); a shape group's inner Contents (After Effects' elided Vectors group) draws no row — the group's path, fill/stroke and Transform list directly under it |
 | Composition viewer | Selection, handles with direction-aware cursors, rulers, guides, grids, snapping, channels, exposure, region of interest, snapshots, 3D views, Spacebar hand | 70% | `ui_viewer`, `ui_viewers`; Cmd/Ctrl +/− doesn't zoom (#570); anchor point grab on Linux (#492); #352 (snapping) is closed; no 3D transform gizmos (#392, #347); percentage guides (26.5) exist as View ▸ Add Percentage Guide and Convert Guides to Percentage / Pixels (a guide stores a percent of the comp, so it follows comp-size changes; behaviour inferred from the release note, not compared with After Effects); Copy Frame to Clipboard (26.3) is in the Composition menu and the viewer's context menu |
 | Tools panel | All After Effects tools; long-press flyouts; Tool Creates Shape / Mask; Fill / Stroke options | 80% | #213, #227 fixed; #553 (pen and vertex tools on motion paths) is closed |
-| Nudging and modifiers | Arrow nudge (1 px, Shift 10 px), Alt/Option duplicates and slips, Shift constrains | 75% | #290 nudging fixed; #491 (Linux multi-layer edits) is closed |
+| Nudging and modifiers | Arrow nudge (1 px, Shift 10 px), Alt/Option duplicates and slips, Shift constrains | 75% | #290 nudging fixed; #2968 Alt-drag in the viewer duplicates the dragged layers; #491 (Linux multi-layer edits) is closed |
 | Numeric entry | Scrubbable values, typed entry with Tab / Shift+Tab, angle revolutions, Escape cancels, non-finite rejected | 85% | `ui_angles`, `ui_inline_edit` (#93, #141, #361); rename arrows on Linux (#488) |
 | Effect Controls | After Effects' twirl-downs, angle dial, point crosshair, eyedropper, curves/levels editors, effect menu on right-click | 70% | `ui_effect_controls`, `ui_fx_editors`; 26.5 rebuilt this panel with icon controls and effect colour labels: labels exist (a colour bar on the effect header and on the effect's Timeline row, right-click Label menu, `effect.setLabel`), the rebuilt controls are not matched |
 | Context menus | Layer, property, Project, Timeline empty area, work area, labels with colours | 80% | `ui_blank_context_menus`, `ui_project_rows`; #227, #290, #407 fixed; a comp's Project row menu has Composition Settings… (#1058); layer context menu has Layer Styles (#1611) |
@@ -30,7 +30,7 @@ feel and platform differences, and the 26.x interface changes are not in yet.
 | Preview feel | Spacebar / Numpad 0 previews, RAM preview, cache bars, adaptive resolution | 55% | `ui_ram_preview`, `ui_live_preview`; stutter (#595, #304); scrubbing lag (#329, closed by #784) |
 | Home screen, Learn, templates | Home with recent projects, template gallery, interactive Learn tutorials | 70% | Layout nitpicks (#581); Home literals untranslated (#574) |
 | Quick Apply (26.2) | Search to apply effects, presets or commands | partial | A command palette exists; not After Effects' Quick Apply |
-| Accessibility | AccessKit enabled; focus labels tested; Project panel keyboard navigation and accessible names (#776) | 20% | No screen-reader pass or keyboard-navigation audit of the other panels; no contrast check |
+| Accessibility | AccessKit enabled; `ui_accessibility_audit` counts unnamed or roleless controls per panel: Project (#776), Effects & Presets, Settings (all pages), Render Queue with Templates, Info, Flowchart, Script Console and the 3D Camera Tracker block are at zero, with names, roles, selected / open / checked state and arrow-key, Home / End, Enter, Space operation (#1335); painted-only text (Info, status lines) and the console output are read-outs and a log in the tree; `ui_contrast` checks theme tokens against WCAG 2 | 20% | No screen reader has been run on anything; the other panels are counted, not fixed (Timeline ≈ 55 unnamed controls; Scopes, Tracker, Layer and the Waveform have open PRs on their files and are untouched; their on-screen scopes and waveform have no text description yet); 13 of 48 token pairs are below WCAG 2 (primary button text, error text, control borders, Light theme warning colour); focus order across panels, colour-blindness and reduced motion are unchecked; app shortcuts pause while a widget has keyboard focus |
 | UI scale | Settings ▸ Appearance ▸ UI Scale 75–200% | beyond | After Effects follows the system's scaling (#284) |
 
 Path editing (#1220): the Composition viewer suppresses a selected layer’s transform box while
@@ -41,15 +41,17 @@ cover shape paths and masks, corner-vertex dragging and undo, and layers without
 
 ## Estimate
 
-**≈ 60–120 h**: the open interaction issues above (25–45 h, about 0.2–0.5 h each with a scripted
-test), 3D gizmos 8–15 h, multi-monitor panels 10–20 h, the 26.x interface changes 10–20 h, an
-accessibility pass 15–30 h. Checking feel against After Effects needs the owner's Mac with After
+**≈ 60–110 h**: the open interaction issues above (25–45 h, about 0.2–0.5 h each with a scripted
+test), 3D gizmos 8–15 h, the 26.x interface changes 10–20 h, an accessibility pass 10–22 h as in [gaps.md](gaps.md) gap 25 (two slices, seven panels and the audit, are done). Checking feel against After Effects needs the owner's Mac with After
 Effects running; most of the rest parallelises.
 
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-18 | minor | A shape group's inner Contents (After Effects' elided Vectors group) draws no row: the group's path, fill/stroke and Transform list directly under the group |
+| 2026-10-13 | minor | Accessibility row, second slice: Info, Flowchart, Script Console and the 3D Camera Tracker block named and keyboard-operable (#1335); no screen reader tested |
+| 2026-10-13 | minor | Accessibility row: AccessKit audit and contrast tests, Effects & Presets, Settings and Render Queue named and keyboard-operable (#1335); no screen reader tested |
 | 2026-10-13 | patch | Layer bounds are suppressed during path-point editing (#1220); shape/mask interaction regressions |
 | 2026-10-12 | minor | Closed issues (#302, #320, #491, #511, #553 and others) marked as closed instead of open; panels in their own windows (#486) |
 | 2026-10-12 | minor | Percentage guides and effect colour labels (26.5) added; rows updated |
diff --git a/docs/user/AGENTS.md b/docs/user/AGENTS.md
new file mode 100644
index 000000000..2c3add101
--- /dev/null
+++ b/docs/user/AGENTS.md
@@ -0,0 +1,64 @@
+# User docs: rules for agents and contributors
+
+Everything in this folder (except this file, CLAUDE.md and README.md) is published at
+https://getartcraft.com/docs/effectcraft. The file path is the URL:
+`troubleshooting/gpu-not-used.md` → `/docs/effectcraft/troubleshooting/gpu-not-used`.
+Renaming a file breaks links, so add the old path to `redirect_from` when you rename.
+
+## Who reads this
+
+Artists using EffectCraft, Discord mods answering them, and AI assistants looking things up for
+either. Write for an artist, not a developer.
+
+## Page rules
+
+- One question or problem per page. Lead with the answer or the fix in the first two lines.
+- Plain words, short sentences, numbered steps for anything the reader does.
+- Start the body at `##`. The page title comes from frontmatter.
+- Link to other pages instead of repeating them. Use relative links to the `.md` file:
+  `[Install EffectCraft](../getting-started/install.md)`.
+- No marketing copy, no "simply", no claims you have not checked in the code, a release or an issue.
+- Call the product "EffectCraft", as the app, its downloads and getartcraft.com do.
+- Name UI labels exactly as the app shows them, in **bold**. Menu paths use the menu text from
+  `crates/engine/src/menus.rs`.
+- Shortcuts: the code writes `Cmd`, which is Ctrl on Windows and Linux. Write Ctrl for Windows.
+- Windows 11 is the only Windows version to name.
+- Troubleshooting pages: `## Symptoms`, `## Fix`, `## Why this happens` (optional),
+  `## Still stuck?` (link the issue tracker or Discord).
+
+## Frontmatter
+
+    ---
+    title: EffectCraft does not use my graphics card
+    description: One sentence for search results, link previews and AI summaries.
+    order: 10                 # optional, sorts within the folder (lower first)
+    verified: 0.8.0           # optional, app version you last checked this page against
+    redirect_from: [old/path] # optional, old URLs (relative to /docs/effectcraft)
+    ---
+
+Only `key: value` and `key: [a, b]` lines work. Quote values that start with a quote or contain ` #`.
+
+Set `verified` to the latest release (the newest release tag) after checking the page against that tag with `git show <tag>:<path>`. Pages describe the latest release users download, not unreleased code on main.
+
+## Folders
+
+- `getting-started/` install and first run
+- `guides/` how to do one thing
+- `troubleshooting/` symptom → fix
+- `faq/` short answers
+- `reference/` lists and settings
+
+A folder's `index.md` names the folder in the sidebar. Files or folders starting with `_` are
+drafts and are not published.
+
+## Check before you push
+
+    node <path to your artcraft-services checkout>/frontend/apps/artcraft-website-next/scripts/docs/core.mjs docs/user
+
+The checker lives in storytold/artcraft-services. A CI check will be added once it is on that repo's main branch.
+
+## Support PRs
+
+Pages written to answer a user question come in as PRs titled `docs(support): <page title>`.
+Review them like code: check every claim against the source. Problems and bug reports go in the
+[issue tracker](https://github.com/storytold/effectcraft/issues).
diff --git a/docs/user/CLAUDE.md b/docs/user/CLAUDE.md
new file mode 100644
index 000000000..e7bcfb70e
--- /dev/null
+++ b/docs/user/CLAUDE.md
@@ -0,0 +1 @@
+Read `AGENTS.md` in this folder: it has the rules for the user docs.
diff --git a/docs/user/faq/after-effects-projects.md b/docs/user/faq/after-effects-projects.md
new file mode 100644
index 000000000..792aa7cc1
--- /dev/null
+++ b/docs/user/faq/after-effects-projects.md
@@ -0,0 +1,22 @@
+---
+title: Can EffectCraft open After Effects projects?
+description: EffectCraft cannot open .aep or .aepx files, and After Effects plug-ins do not run. It saves .ecproj files and imports Lottie.
+order: 10
+verified: 0.9.2
+---
+
+No. EffectCraft cannot open After Effects projects (`.aep` or `.aepx`), and After Effects plug-ins do not run in it.
+
+## What it opens instead
+
+- Its own projects, saved as `.ecproj`. These are readable, versioned JSON files.
+- Lottie animations, with **File ▸ Import ▸ Lottie...**. Each opens as a new composition.
+- Photoshop and PDF or Illustrator files, imported as footage or as a composition. See [Import footage and image sequences](../guides/import-footage.md).
+
+## What carries over
+
+Expressions are JavaScript with the After Effects object model, such as `wiggle`, `loopOut` and `thisComp.layer("...")`. The panels, shortcuts and effect parameter names follow After Effects, so the skills carry over.
+
+## Status
+
+Reading `.aep` files is the largest known gap between EffectCraft and After Effects. It is listed in the project's [gap list](https://github.com/storytold/effectcraft/blob/main/docs/gaps.md), and the maintainers have not yet decided how to approach it.
diff --git a/docs/user/faq/index.md b/docs/user/faq/index.md
new file mode 100644
index 000000000..75b27177f
--- /dev/null
+++ b/docs/user/faq/index.md
@@ -0,0 +1,8 @@
+---
+title: FAQ
+description: Short answers about EffectCraft.
+order: 40
+---
+
+- [Can EffectCraft open After Effects projects?](after-effects-projects.md)
+- [Is EffectCraft free, and where does it run?](price-and-platforms.md)
diff --git a/docs/user/faq/price-and-platforms.md b/docs/user/faq/price-and-platforms.md
new file mode 100644
index 000000000..40f93c60d
--- /dev/null
+++ b/docs/user/faq/price-and-platforms.md
@@ -0,0 +1,24 @@
+---
+title: Is EffectCraft free, and where does it run?
+description: EffectCraft is free and open source under MIT or Apache-2.0, and runs on Windows, macOS, Linux and in the browser.
+order: 20
+verified: 0.9.2
+---
+
+Yes, EffectCraft is free. It is open source, dual-licensed under MIT or Apache-2.0, at your option. It has no telemetry, and it uses no network access unless you ask for it.
+
+## Where it runs
+
+| Platform | Builds                                                                                 |
+|----------|----------------------------------------------------------------------------------------|
+| Windows  | x64, arm64 and 32-bit x86, as MSI installers and portable zips                         |
+| macOS    | One universal app for Apple silicon and Intel                                          |
+| Linux    | x86_64 and aarch64 as AppImage, Flatpak, deb, rpm and tar.gz; riscv64 deb, rpm, tar.gz |
+| FreeBSD  | x86_64 tar.gz                                                                          |
+| Browser  | A web build that runs the full app                                                     |
+
+See [Install EffectCraft](../getting-started/install.md) for the files.
+
+## How mature is it?
+
+EffectCraft is in alpha. The README calls macOS the most tested platform, and says Linux and Windows users have hit basic interaction bugs that are being fixed first. Bug reports in the [issue tracker](https://github.com/storytold/effectcraft/issues) are the most useful thing you can send.
diff --git a/docs/user/getting-started/index.md b/docs/user/getting-started/index.md
new file mode 100644
index 000000000..6a3cad148
--- /dev/null
+++ b/docs/user/getting-started/index.md
@@ -0,0 +1,8 @@
+---
+title: Getting started
+description: Install EffectCraft and make your first composition.
+order: 10
+---
+
+- [Install EffectCraft](install.md)
+- [Make your first composition](../guides/make-a-composition.md)
diff --git a/docs/user/getting-started/install.md b/docs/user/getting-started/install.md
new file mode 100644
index 000000000..b2e77a5d9
--- /dev/null
+++ b/docs/user/getting-started/install.md
@@ -0,0 +1,58 @@
+---
+title: Install EffectCraft
+description: Download EffectCraft for Windows 11, macOS or Linux, install it, or install it through ArtCraft Launcher.
+order: 10
+verified: 0.9.2
+---
+
+The easiest way is the [EffectCraft page on getartcraft.com](https://getartcraft.com/apps/effectcraft). For a specific file, use the [latest release](https://github.com/storytold/effectcraft/releases/latest) on GitHub. In the file names, `<version>` stands for the version number, for example `0.9.2`.
+
+## Windows 11
+
+1. Open the [latest release](https://github.com/storytold/effectcraft/releases/latest).
+2. Download `effectcraft-<version>-windows-x64.msi`. It fits most PCs (Intel and AMD, 64-bit).
+3. Run the file and follow the installer. It asks where to install EffectCraft and offers a **Create a desktop shortcut** box.
+4. Start **EffectCraft** from the Start menu.
+
+The release also has an `arm64` installer for Snapdragon and other ARM PCs. The installers are code-signed and install for all users. Later versions install into the same folder.
+
+To run it without installing, download `effectcraft-<version>-windows-x64-portable.zip` instead. It contains `effectcraft.exe` and the command-line tool `effectcraft-cli.exe`. The `arm64` build has a portable zip too.
+
+There are also 32-bit `x86` builds, as an installer and a portable zip.
+
+## macOS
+
+1. Download `effectcraft-<version>-macos-universal.dmg`. It works on Apple silicon and Intel Macs and is signed and notarized.
+2. Open it and drag EffectCraft to Applications.
+
+The command-line tool is a separate download for macOS: `effectcraft-cli-<version>-macos-universal.zip`.
+
+## Linux
+
+Pick one file from the release. Replace `x86_64` with `aarch64` on ARM.
+
+| File                                          | How to use it                            |
+|-----------------------------------------------|------------------------------------------|
+| `effectcraft-<version>-linux-x86_64.AppImage` | Run `chmod +x` on the file, then run it. |
+| `effectcraft-<version>-linux-x86_64.deb`      | For Debian and Ubuntu.                   |
+| `effectcraft-<version>-linux-x86_64.rpm`      | For Fedora, RHEL and openSUSE.           |
+| `effectcraft-<version>-linux-x86_64.flatpak`  | `flatpak install --user <file>`          |
+| `effectcraft-<version>-linux-x86_64.tar.gz`   | Unpack it anywhere.                      |
+
+For RISC-V 64-bit there is a `.deb`, an `.rpm` and a `.tar.gz` (`riscv64` in the file name). They need glibc 2.39 or newer. There is also a FreeBSD x86_64 `.tar.gz`.
+
+## In the browser
+
+`effectcraft-web-<version>.zip` is the web build. It is a static site that runs in a modern browser and needs to be hosted on a web server. Projects, media and settings stay in the browser's private storage and on your computer.
+
+## Install through ArtCraft Launcher
+
+ArtCraft Launcher lists EffectCraft. Click **Install** on its card. See [Install and update Craft apps](https://getartcraft.com/docs/craft-launcher/guides/install-and-update-apps).
+
+## Check the download
+
+`SHA256SUMS.txt` on the release page lists a checksum for every file.
+
+## Next
+
+Open EffectCraft and make something: [Make your first composition](../guides/make-a-composition.md). If you only want to look around, choose **Open Demo Project** on the Home screen.
diff --git a/docs/user/guides/add-an-effect.md b/docs/user/guides/add-an-effect.md
new file mode 100644
index 000000000..5459b21d9
--- /dev/null
+++ b/docs/user/guides/add-an-effect.md
@@ -0,0 +1,35 @@
+---
+title: Add an effect
+description: Apply an effect such as Gaussian Blur to a layer and change its settings in Effect Controls.
+order: 30
+verified: 0.9.2
+---
+
+Select a layer, then choose the effect from the **Effect** menu, or double-click it in the **Effects & Presets** panel. Change its settings in **Effect Controls** (F3).
+
+Shortcuts on this page use Ctrl. On macOS, use Cmd instead of Ctrl.
+
+## Steps
+
+1. Select a layer in the Timeline.
+2. Apply an effect in one of two ways:
+   - Choose it from the **Effect** menu. Effects are grouped by category, for example **Effect ▸ Blur & Sharpen ▸ Gaussian Blur**.
+   - Open **Window ▸ Effects & Presets** (Ctrl+5). Type in the search field, then double-click the effect. Dragging it onto a layer works too.
+3. Open **Window ▸ Effect Controls** (F3), or choose **Effect ▸ Effect Controls**. The effect's settings are listed there. **Gaussian Blur** has **Blurriness**, **Blur Dimensions** and **Repeat Edge Pixels**.
+4. Change a value. Click the stopwatch beside it to animate it, as in [Animate with keyframes](animate-with-keyframes.md).
+
+If no layer is selected when you double-click an effect, EffectCraft shows **Select a layer to apply to**. Select a layer and try again.
+
+## Remove or reuse effects
+
+- **Effect ▸ Last Effect** applies the effect you used last.
+- **Effect ▸ Remove All** takes every effect off the selected layers.
+- In **Effects & Presets**, click the star on an effect to add it to Favorites. Recently used effects are listed too.
+
+## Layer styles
+
+For drop shadows, glows and bevels, use **Layer ▸ Layer Styles**. It lists **Drop Shadow**, **Inner Shadow**, **Outer Glow**, **Inner Glow**, **Bevel and Emboss** and **Satin**, among others.
+
+## Next
+
+[Render a video](render-a-video.md).
diff --git a/docs/user/guides/animate-with-keyframes.md b/docs/user/guides/animate-with-keyframes.md
new file mode 100644
index 000000000..53ef7882e
--- /dev/null
+++ b/docs/user/guides/animate-with-keyframes.md
@@ -0,0 +1,35 @@
+---
+title: Animate with keyframes
+description: Fly a layer in with two Position keyframes and smooth the motion with Easy Ease.
+order: 20
+verified: 0.9.2
+---
+
+Click the stopwatch beside a property to start animating it, move the current-time indicator, then change the value. The second keyframe appears by itself. Select both keyframes and press F9 to ease the motion.
+
+You need a composition with a layer. See [Make your first composition](make-a-composition.md).
+
+Shortcuts on this page use Ctrl. On macOS, use Cmd instead of Ctrl and Option instead of Alt.
+
+## Steps
+
+1. In the Timeline, twirl the layer open, then open **Transform**.
+2. Set the starting value. For a layer that flies in from the left, scrub or type a **Position** that is outside the frame.
+3. Click the stopwatch beside **Position**. It turns blue and records a keyframe at the current time.
+4. Drag the blue current-time indicator to about 0:00:01:00, or click in the time ruler.
+5. Drag the layer to its final place in the Composition viewer, or scrub the **Position** value. Because the stopwatch is on, a second keyframe appears by itself.
+6. Select both keyframes (drag a box around them, or click the **Position** name) and press F9. This is **Animation ▸ Keyframe Assistant ▸ Easy Ease**. The layer now glides in and settles.
+7. Press the Spacebar, or use Play in the Preview panel, to watch it. Press it again to stop.
+
+## Other things you can do
+
+- Click the keyframe button in the layer's property row to add or remove a keyframe at the current time. Its tooltip reads **Add or remove keyframe**.
+- Choose **Animation ▸ Keyframe Assistant ▸ Easy Ease In** (Shift+F9) or **Easy Ease Out** to ease one side only.
+- Choose **Animation ▸ Toggle Hold Keyframe** for a keyframe that jumps instead of moving.
+- Choose **Animation ▸ Keyframe Interpolation...** or **Keyframe Velocity...** to set the curve exactly.
+- Hold Alt and click a stopwatch to add an expression.
+- The Graph Editor shows value and speed graphs with draggable handles.
+
+## Next
+
+[Add an effect](add-an-effect.md).
diff --git a/docs/user/guides/import-footage.md b/docs/user/guides/import-footage.md
new file mode 100644
index 000000000..2cd754bd2
--- /dev/null
+++ b/docs/user/guides/import-footage.md
@@ -0,0 +1,49 @@
+---
+title: Import footage and image sequences
+description: Bring video, images and numbered image sequences into an EffectCraft project, and change how footage is read.
+order: 50
+verified: 0.9.2
+---
+
+Choose **File ▸ Import ▸ File...** (Ctrl+I) and pick your files, or drop files on the EffectCraft window. Numbered stills such as `shot_0001.png` can import as one sequence that plays like a movie.
+
+Shortcuts on this page use Ctrl. On macOS, use Cmd instead of Ctrl and Option instead of Alt.
+
+## Import files
+
+1. Choose **File ▸ Import ▸ File...** to pick one file. Use **File ▸ Import ▸ Multiple Files...** to pick several.
+2. Photoshop and PDF or Illustrator files first ask whether to import them as footage or as a composition.
+3. The footage appears in the Project panel. Drag it onto the Composition viewer to make a layer where you drop it, or into the Timeline. If no composition is open, dropping it on the empty viewer makes a new composition from it.
+
+You can also drop files or folders on the window. Files dropped on the Composition viewer become layers there. A dropped Photoshop file asks how to import it, as **File ▸ Import ▸ File...** does. The **Media Browser** (**Window ▸ Media Browser**) browses folders and imports what you pick.
+
+## Import an image sequence
+
+1. Choose **File ▸ Import ▸ File...** and pick any one numbered file of the run.
+2. In the **Import Image Sequence** dialog, check the run it found. It also lists missing frames.
+3. Tick the sequence option, which is named after the file type, for example **PNG Sequence**. When it is off, the files import as separate stills. It is off by default.
+4. Set **Frame rate (fps)**. The default comes from **Sequence Footage** on the Import page of the preferences (**Edit ▸ Preferences ▸ Import...**; on macOS: **EffectCraft ▸ Settings... ▸ Import...**), which is 30 fps.
+5. Confirm. The run arrives as one footage item named like `shot_[0001-0250].png`.
+
+**Force alphabetical order** imports every image of that type in the folder in name order, whatever the numbering. Use it for files that are not numbered consistently.
+
+Stills in PNG, JPEG, TIFF, OpenEXR, BMP, WebP, Targa (`.tga`), Radiance HDR (`.hdr`), DPX and Cineon (`.cin`) can form a sequence. PSD, SVG and PDF files import one by one.
+
+If the numbering skips a frame, EffectCraft shows colour bars for it. Put the missing files in the folder and choose **File ▸ Reload Footage** to fill the gap.
+
+## Change how footage is read
+
+Select the footage in the Project panel and choose **File ▸ Interpret Footage ▸ Main...** (Ctrl+Alt+G). The dialog has **Alpha**, **Assume this frame rate** and **Start Timecode**, among others. A change applies everywhere the footage is used.
+
+For example, a 250-frame sequence at 25 fps lasts 10 seconds. At 24 fps it lasts 10.4 seconds.
+
+## Replace or reload footage
+
+- **File ▸ Replace Footage ▸ File...** (Ctrl+H) points the item at another file.
+- **File ▸ Reload Footage** (Ctrl+Alt+L) reads the files again. A sequence picks up frames added to its folder.
+
+If footage shows as missing, see [Footage is missing or offline](../troubleshooting/footage-missing.md).
+
+## Linux with Wayland
+
+Dragging files onto the window does not work on native Wayland sessions. Use **File ▸ Import ▸ File...** instead.
diff --git a/docs/user/guides/index.md b/docs/user/guides/index.md
new file mode 100644
index 000000000..d8182d069
--- /dev/null
+++ b/docs/user/guides/index.md
@@ -0,0 +1,11 @@
+---
+title: Guides
+description: Step-by-step guides for the main tasks in EffectCraft.
+order: 20
+---
+
+- [Make your first composition](make-a-composition.md)
+- [Animate with keyframes](animate-with-keyframes.md)
+- [Add an effect](add-an-effect.md)
+- [Render a video](render-a-video.md)
+- [Import footage and image sequences](import-footage.md)
diff --git a/docs/user/guides/make-a-composition.md b/docs/user/guides/make-a-composition.md
new file mode 100644
index 000000000..5dcd8702b
--- /dev/null
+++ b/docs/user/guides/make-a-composition.md
@@ -0,0 +1,34 @@
+---
+title: Make your first composition
+description: Create a composition, add a text layer and save the project as an .ecproj file.
+order: 10
+verified: 0.9.2
+---
+
+Choose **Composition ▸ New Composition...**, set the size, frame rate and duration, click **OK**, then add layers from the **Layer ▸ New** menu. Shortcuts below use Ctrl on Windows and Linux. On macOS, use Cmd.
+
+## Steps
+
+1. Choose **Composition ▸ New Composition...** (Ctrl+N). On the Home screen, click **New Composition** instead.
+2. In the dialog, type a **Composition Name**. The default is `Comp 1`.
+3. Pick a **Preset**, or set **Width**, **Height**, **Frame Rate** and **Duration**. The presets include `HDTV 1080 24`, `UHD 4K 25` and `Social Media Square · 1080x1080 · 30 fps`.
+4. Click **OK**. The composition opens in the Composition panel and the Timeline.
+5. Choose **Layer ▸ New ▸ Text** and type your text. A text layer appears at the top of the Timeline, and its name follows what you type.
+6. Add more layers from **Layer ▸ New**: **Solid...**, **Shape Layer**, **Null Object**, **Adjustment Layer**, **Light...** and **Camera...**.
+7. Choose **File ▸ Save** to save the project.
+
+Projects are saved as `.ecproj` files. An `.ecproj` file is readable JSON, so it also works with version control.
+
+## Change the settings later
+
+Choose **Composition ▸ Composition Settings...** to change the name, size, frame rate or duration. The dialog has **Basic**, **Advanced** and **3D Renderer** tabs.
+
+To keep a size and frame rate for later, click the **+** button next to **Preset** (**Save Preset…**) and name it. Your presets are listed above the built-in ones, in this dialog and in **New Composition...**. To remove one, select it and click the bin button (**Delete Preset**).
+
+## Learn in the app
+
+The in-app tutorial **Animate a title** walks through a similar title animation. To open it, choose **Help ▸ In-App Tutorials...**.
+
+## Next
+
+[Animate with keyframes](animate-with-keyframes.md).
diff --git a/docs/user/guides/render-a-video.md b/docs/user/guides/render-a-video.md
new file mode 100644
index 000000000..42fa5d0a5
--- /dev/null
+++ b/docs/user/guides/render-a-video.md
@@ -0,0 +1,52 @@
+---
+title: Render a video
+description: Add a composition to the Render Queue, choose a format such as H.264, pick where to save and click Render.
+order: 40
+verified: 0.9.2
+---
+
+Select the composition, choose **Composition ▸ Add to Render Queue** (Ctrl+M), set the output file, then click **Render** in the Render Queue panel. The default format is H.264, saved as an `.mp4` file named after the composition.
+
+Shortcuts on this page use Ctrl. On macOS, use Cmd instead of Ctrl and Option instead of Alt.
+
+## Steps
+
+1. Select the composition in the Project panel or open it.
+2. Choose **Composition ▸ Add to Render Queue** (Ctrl+M). You can also drag compositions onto the Render Queue panel. Open the panel with **Window ▸ Render Queue** (Ctrl+Alt+0).
+3. The queue lists the item with its **Comp Name**, **Status**, **Started** and **Render Time**. Twirl the item open to see **Render Settings:**, **Output Module:** and **Output To**.
+4. Click **Output Module:** and choose a format. The menu entries read **Format: H.264**, **Format: QuickTime (ProRes)** and so on.
+5. Click the file name next to **Output To** to choose where to save. Alt-click it to edit the name template instead.
+6. Check that the **Render** tick box at the left of the item is on. It is on by default, and only ticked items render.
+7. Click **Render**. The status changes to **Rendering** with a percentage. Click **Stop** to cancel.
+
+Tick **Notify** to get a sound and a notification when the queue finishes.
+
+## Formats
+
+The **Output Module:** menu lists the formats your build can export:
+
+| Menu entry               | File type                   |
+|--------------------------|-----------------------------|
+| H.264                    | `.mp4`                      |
+| QuickTime (ProRes)       | `.mov`                      |
+| QuickTime (Uncompressed) | `.mov`                      |
+| HEVC (H.265)             | `.mp4`                      |
+| AV1                      | `.mp4`                      |
+| WebM (VP9 + Opus)        | `.webm`                     |
+| PNG Sequence             | `.png`, one file per frame  |
+| JPEG Sequence            | `.jpg`, one file per frame  |
+| TIFF Sequence            | `.tif`, one file per frame  |
+| OpenEXR Sequence         | `.exr`, one file per frame  |
+| Animated GIF             | `.gif`                      |
+| WAV                      | `.wav`, audio only          |
+| AIFF                     | `.aif`, audio only          |
+
+To keep transparency, choose **Channels: RGB + Alpha** in the **Output Module:** menu. It appears for formats that can store alpha, such as QuickTime (ProRes), QuickTime (Uncompressed) and PNG Sequence. H.264, HEVC, AV1 and JPEG Sequence cannot.
+
+## Render only part of a composition
+
+Click **Render Settings:** and choose **Time Span: Work Area Only** or **Time Span: Length of Comp**. The same menu sets **Quality: Best** or **Quality: Draft** and the resolution (**Resolution: Full**, **Half**, **Third** or **Quarter**).
+
+## Export a Lottie animation instead
+
+Choose **File ▸ Export ▸ Lottie JSON...** to write a composition as `.json` or `.lottie`. EffectCraft lists anything Lottie cannot express. To open one, choose **File ▸ Import ▸ Lottie...**.
diff --git a/docs/user/index.md b/docs/user/index.md
new file mode 100644
index 000000000..05ed4993c
--- /dev/null
+++ b/docs/user/index.md
@@ -0,0 +1,36 @@
+---
+title: EffectCraft
+description: EffectCraft is a free, open-source app for motion graphics and visual effects, an alternative to Adobe After Effects.
+verified: 0.9.2
+---
+
+EffectCraft is a free, open-source app for animated titles, motion graphics and compositing. It is an alternative to Adobe After Effects.
+
+You build a composition from layers (solids, shapes, text, footage, other compositions), animate their properties with keyframes, add effects and render the result. The panels and shortcuts follow After Effects: Project, Composition, Timeline, Effect Controls, Effects & Presets and the Render Queue. It runs on macOS, Windows and Linux, and in the browser.
+
+EffectCraft is young and in alpha. It cannot open After Effects projects (`.aep`), and some things still behave differently from After Effects. See [Can EffectCraft open After Effects projects?](faq/after-effects-projects.md).
+
+## Start here
+
+- [Install EffectCraft](getting-started/install.md)
+- [Make your first composition](guides/make-a-composition.md)
+- [Animate with keyframes](guides/animate-with-keyframes.md)
+- [Add an effect](guides/add-an-effect.md)
+- [Render a video](guides/render-a-video.md)
+- [Import footage and image sequences](guides/import-footage.md)
+
+## When something is wrong
+
+- [EffectCraft does not use my graphics card](troubleshooting/gpu-not-used.md)
+- [Footage is missing or offline](troubleshooting/footage-missing.md)
+
+## Sections
+
+- [Getting started](getting-started/index.md)
+- [Guides](guides/index.md)
+- [Troubleshooting](troubleshooting/index.md)
+- [FAQ](faq/index.md)
+
+## Get help
+
+Ask in [Discord](https://discord.gg/artcraft) or open an issue in the [issue tracker](https://github.com/storytold/effectcraft/issues). Say which version and which system you use.
diff --git a/docs/user/troubleshooting/footage-missing.md b/docs/user/troubleshooting/footage-missing.md
new file mode 100644
index 000000000..7507a2ad0
--- /dev/null
+++ b/docs/user/troubleshooting/footage-missing.md
@@ -0,0 +1,35 @@
+---
+title: Footage is missing or offline
+description: Find missing footage in an EffectCraft project, relink it to a folder or replace it with another file.
+order: 20
+verified: 0.9.2
+---
+
+Choose **File ▸ Dependencies ▸ Relink Missing Footage...** and pick the folder where your files are now. For files that stay missing, choose **File ▸ Replace Footage ▸ File...**.
+
+Shortcuts on this page use Ctrl. On macOS, use Cmd instead of Ctrl and Option instead of Alt.
+
+## Symptoms
+
+- A footage item in the Project panel is flagged as missing after you open a project.
+- EffectCraft shows a message that footage items are missing.
+
+## Fix
+
+1. Choose **File ▸ Dependencies ▸ Find Missing Footage**. EffectCraft selects every missing item in the Project panel and shows how many it found.
+2. Choose **File ▸ Dependencies ▸ Relink Missing Footage...** and pick the folder that holds your files. EffectCraft searches that folder and its subfolders.
+3. It relinks files whose names are unique and whose type, dimensions and codec match what the project saved. The whole relink is one undo step.
+4. For anything left over, select the item and choose **File ▸ Replace Footage ▸ File...** (Ctrl+H), then pick the file yourself. This also covers files with duplicate names in the folder, which Relink leaves alone.
+5. After you copy or render files into a folder, choose **File ▸ Reload Footage** (Ctrl+Alt+L) to read them again.
+
+Relinking keeps item names, interpretation and layer timing. It does not change your files. For image sequences, every saved frame must be in the new folder. Relink Missing Footage is not available in the browser version.
+
+## Why this happens
+
+A project stores where each footage file is. If you move or rename the files, or open the project on another computer, the project cannot find them.
+
+Projects built with the command-line tool or an agent can use relative paths such as `bg.mp4`. Before 0.8.0, the app looked for those in its own working directory instead of next to the project file. Since 0.8.0 it also looks next to the project file ([pull request #676](https://github.com/storytold/effectcraft/pull/676)). The reporter on macOS has not confirmed the fix yet ([issue #652](https://github.com/storytold/effectcraft/issues/652)).
+
+## Still stuck?
+
+Ask in [Discord](https://discord.gg/artcraft) or open an issue in the [issue tracker](https://github.com/storytold/effectcraft/issues). Say which system you use, whether the project came from another computer or from the command-line tool, and where the footage is stored.
diff --git a/docs/user/troubleshooting/gpu-not-used.md b/docs/user/troubleshooting/gpu-not-used.md
new file mode 100644
index 000000000..7c4fb29e0
--- /dev/null
+++ b/docs/user/troubleshooting/gpu-not-used.md
@@ -0,0 +1,42 @@
+---
+title: EffectCraft does not use my graphics card
+description: What to do when the report says GPU none (CPU compositing), the window picked another adapter, or GPU effects fail on Windows 11 with DirectX 12.
+order: 10
+verified: 0.9.2
+---
+
+Open **Help ▸ System Compatibility Report...** and read the **GPU:** and **Window graphics:** lines. If the window runs on the wrong adapter, set **Window Graphics** to **Automatic** in the preferences (**Edit ▸ Preferences ▸ Startup & Repair...**; on macOS: **EffectCraft ▸ Settings... ▸ Startup & Repair...**) and restart EffectCraft.
+
+## Symptoms
+
+- The report says `GPU: none (CPU compositing)` followed by a reason.
+- The `Window graphics:` line names an adapter or backend you did not expect, for example an integrated or OpenGL adapter instead of your graphics card.
+
+## Fix
+
+1. Choose **Help ▸ System Compatibility Report...**. Copy the text.
+2. Look at the `Window graphics:` line. If it shows the wrong adapter, continue. If it shows your card, go to **Still stuck?** below.
+3. Choose **Edit ▸ Preferences ▸ Startup & Repair...**. On macOS, choose **EffectCraft ▸ Settings... ▸ Startup & Repair...**.
+4. Set **Window Graphics** to **Automatic**. The other choice is **OpenGL (compatibility)**.
+5. Close EffectCraft and start it again. The change applies from the next launch.
+6. Open the report again and check that `Window graphics:` now names your card.
+
+One user whose GPU was not detected on 0.8.0 fixed it this way: they set the window graphics to Automatic, and EffectCraft started through Vulkan ([issue #596](https://github.com/storytold/effectcraft/issues/596)).
+
+If the window runs on your card but the report still says `GPU: none (CPU compositing)`, the reason after it says why the GPU compositor did not start. With **OpenGL (compatibility)**, compositing always runs on the CPU, because the GPU compositor needs DirectX 12, Vulkan, Metal or WebGPU.
+
+## Why this happens
+
+When the graphics driver stops EffectCraft as its window opens, the next launch switches to OpenGL by itself. That keeps the app usable. Setting **Window Graphics** to **Automatic** lets EffectCraft choose the graphics backend again.
+
+The **GPU Information...** button on the Previews page of the preferences names the adapter the GPU compositor runs on. When compositing runs on the CPU, it says why after `GPU compositing is off:`. It also shows the `Window graphics:` line. For a bug report, still send the whole System Compatibility Report.
+
+## Windows 11 with DirectX 12
+
+On some Windows 11 PCs with NVIDIA GPUs, the GPU compositor fails to start on DirectX 12 because the FXC shader compiler rejects some of EffectCraft's GPU kernels. Two users reproduced this with an RTX 4060 laptop GPU and an RTX 3060. In their tests EffectCraft fell back to CPU compositing, and the same build started on Vulkan. This is still open in 0.9.2 as [issue #613](https://github.com/storytold/effectcraft/issues/613). Check the issue for updates.
+
+The window can also take a long time to appear. On 0.8.0 with an RTX 5060 Ti, one user measured 69 seconds before the window showed on DirectX 12 without a working DXC shader compiler, against 3 seconds on Vulkan, which is what Automatic picked on that PC. If you close EffectCraft during that wait, the next launch uses OpenGL and has no GPU compositor until you set **Window Graphics** back to **Automatic** (steps above). So wait for the window on the first launch.
+
+## Still stuck?
+
+Ask in [Discord](https://discord.gg/artcraft) or open an issue in the [issue tracker](https://github.com/storytold/effectcraft/issues). Include the whole System Compatibility Report, your graphics card and driver version, and whether you also have an integrated GPU.
diff --git a/docs/user/troubleshooting/index.md b/docs/user/troubleshooting/index.md
new file mode 100644
index 000000000..0cf140136
--- /dev/null
+++ b/docs/user/troubleshooting/index.md
@@ -0,0 +1,10 @@
+---
+title: Troubleshooting
+description: Fixes for common EffectCraft problems.
+order: 30
+---
+
+- [EffectCraft does not use my graphics card](gpu-not-used.md)
+- [Footage is missing or offline](footage-missing.md)
+
+Not listed? Open an issue in the [issue tracker](https://github.com/storytold/effectcraft/issues) or ask in [Discord](https://discord.gg/artcraft). Include the text from **Help ▸ System Compatibility Report...**.
diff --git a/docs/web.md b/docs/web.md
index e00ec166b..f94a687be 100644
--- a/docs/web.md
+++ b/docs/web.md
@@ -174,7 +174,7 @@ the same futures with `passes::block_on`; they never wait there).
 - **Render Queue**: `effectcraft_export::export_async` renders each frame in passes (frames
   with deferred readbacks render one by one instead of in parallel batches) and encodes as
   before (`Exporter::export_async`). As on the desktop, a job renders every frame on the
-  project's renderer (the worker's GPU with Mercury GPU Acceleration), not on whichever
+  project's renderer (the worker's GPU with GPU Acceleration), not on whichever
   compositor measured faster, so runs don't differ by timing.
 - **Analyses** (Warp Stabilizer, 3D Camera Tracker, Track Motion, mask and face tracking, Roto
   Brush freeze and propagation): their work functions are `async`; started with `wait` inside
@@ -242,6 +242,25 @@ Window ▸ Media Browser browses a virtual tree (`src/browse.rs`):
 
 `mediaBrowser.list` reports the places and these actions; `mediaBrowser.action {action}` runs one.
 
+### Startup project
+
+By default the page opens the last visit's project, and the demo project on a first visit. A
+`startup` key in `effectcraft-config.json` (next to `index.html`) changes that:
+
+```json
+{"startup":"empty"}
+```
+
+| Value | On load |
+|---|---|
+| `"last"` (or no key) | the last visit's project; the demo project on a first visit |
+| `"empty"` | the last visit's project; a blank project on a first visit, never the demo |
+| `"demo"` | the demo project, whatever the last visit left; the session is not saved, so the last visit's project stays as it was |
+
+The `?empty` and `?demo` URL flags still win. A missing, invalid or non-JSON file, or an unknown
+value, is the default. The file is fetched once per page load; serve it with
+`Cache-Control: no-cache` (the service worker never caches it).
+
 ### Audio
 
 Audio preview goes through **Web Audio**: an AudioWorklet (`audio-worklet.js`; a
@@ -313,9 +332,13 @@ pixels.
 
 Settings ▸ Disk ▸ Disk Cache works in the browser, backed by the **Origin Private File System**
 (`src/diskcache.rs`): viewer frames are kept under `effectcraft-cache/v1/frames/<32 hex>.ecc`
-between visits, in the desktop cache's format (`disk_cache::frame_entry`: 8-bit premultiplied
-RGBA, LZ4, a checksum), keyed by the same content hash (the comp and everything it uses, frame,
-scale, view, render options).
+between visits, in the desktop cache's format (`disk_cache::frame_entry`: the source files the
+frame read with their size and content hash, then 8-bit premultiplied RGBA, LZ4, a checksum),
+keyed by the same content hash (from memory: the comp, everything it can draw and what its
+expressions can read, frame, scale, view, render options; see
+[architecture.md](architecture.md)). The page reads an entry only while the files it lists are
+unchanged; a frame whose files can't all be named is not stored. Reload Footage has nothing to
+drop here: the file table's identities are content hashes, so a replaced file never matches.
 
 - A render request to a frame worker carries the frame's disk key; the worker posts the frame,
   then writes the entry with a **synchronous access handle** into a temporary file moved into
@@ -333,8 +356,9 @@ scale, view, render options).
   Cache / `edit.purge {what: "disk"}` clears it. `effectcraft.info().diskCache` has the same.
 
 **Layer buffers (M13.30).** Slow layer buffers (≥ 20 ms to render) go to the disk cache too
-(`effectcraft-cache/v1/layers/<32 hex>.ecc`, `disk_cache::layer_entry`, keys salted per project
-and footage as on the desktop). A layer lookup happens in the middle of a synchronous render,
+(`effectcraft-cache/v1/layers/<32 hex>.ecc`, `disk_cache::layer_entry`, keyed as on the desktop:
+`disk_cache::layer_disk_key`; each entry keeps the source files its buffer was made of, with
+the file table's size and content hash, and is used only while they are unchanged). A layer lookup happens in the middle of a synchronous render,
 where the browser's file system can't be read, so it is made synchronous by fetching first:
 
 1. Each frame worker backs its layer cache with a `PrefetchStore` (`effectcraft_render::cache`):
@@ -462,19 +486,19 @@ every request and reply, a render through an in-process offload; `tests_roto.rs`
 propagation through an offload streaming segmentations; `tests_mask_warp.rs`: Warp Stabilizer
 plans solved in the job, never by `warp.status` on the page), the frame-worker protocol
 (`crates/engine/src/remote.rs`: diff / patch, a replica following edits renders the same pixels;
-`crates/ui-egui/tests/ui_web_offload.rs`: the frame cache through a remote renderer, `wait: true`
+`crates/ui-egui/tests/it/ui_web_offload.rs`: the frame cache through a remote renderer, `wait: true`
 deferred until the offloaded job ends) and the Media Browser's virtual tree (`media_browser.rs`,
 `tests_panels.rs`). M13.24: deferred readbacks on a real device (`crates/gpu/src/tests_deferred.rs`:
 whole-frame GPU and CPU-composited frames in passes match the CPU, placeholders never reach the
 layer cache; `deferred.rs`: keys, late readbacks of an older frame dropped), the frame server's
 passes and Auto timing (`remote.rs`, a deferred stand-in accelerator), the browser's routing and
-disk cache (`crates/ui-egui/tests/ui_web_gpu_storage.rs`: a GPU frame worker renders effect frames,
+disk cache (`crates/ui-egui/tests/it/ui_web_gpu_storage.rs`: a GPU frame worker renders effect frames,
 the page's GPU keeps frames without effects, frames stored under their disk keys come back after a
 "reload" without rendering, the blue cache bar sees them; the storage manager's widgets and
 commands), the disk index (`disk_cache.rs`), the store's usage by kind and clearing (`store.rs`),
 `storage.*` (`storage.rs`), and every WGSL float literal fitting f32 (browsers reject the whole
 module otherwise; `tests.rs`). M13.30: job workers on a deferred device
-(`crates/ui-egui/tests/ui_web_job_gpu.rs`: a Render Queue job and a Warp Stabilizer analysis
+(`crates/ui-egui/tests/it/ui_web_job_gpu.rs`: a Render Queue job and a Warp Stabilizer analysis
 render their frames in passes on the device, with the CPU worker's pixels / result),
 particles, Advanced 3D and the job pass driver in passes (`crates/gpu/src/tests_deferred_jobs.rs`),
 layer buffers through the disk store and the prefetch plan (`remote.rs`
diff --git a/examples/check-ae-ease.mjs b/examples/check-ae-ease.mjs
index 3d4f1c02c..e7296ce93 100644
--- a/examples/check-ae-ease.mjs
+++ b/examples/check-ae-ease.mjs
@@ -5,11 +5,18 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const cli = process.argv[2];
-if (!cli || !fs.existsSync(cli)) throw new Error('Usage: node examples/check-ae-ease.mjs <aesync/server/dist/cli.js>');
+// The argument is the operator's own CLI build to compare against; it is resolved and must be an
+// existing regular file before it is used.
+const cli = path.resolve(process.argv[2] ?? ''); // NOSONAR
+// Reject anything that is not an existing regular file before the checker uses it.
+if (!process.argv[2] || !fs.statSync(cli, { throwIfNoEntry: false })?.isFile()) { // NOSONAR
+  throw new Error('Usage: node examples/check-ae-ease.mjs <aesync/server/dist/cli.js>');
+}
 const tolerance = 1e-7;
 function run(command, args) {
-  const result = spawnSync(command, args, { cwd: root, windowsHide: true, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
+  // A developer-run comparison script; spawnSync never uses a shell and every command is either
+  // a fixed binary (`cargo`, `process.execPath`) or the CLI script path validated above.
+  const result = spawnSync(command, args, { cwd: root, windowsHide: true, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 }); // NOSONAR
   if (result.status !== 0) throw new Error(result.stderr || result.stdout || 'Process failed');
   return JSON.parse(result.stdout.replace(/^\uFEFF/, '').trim());
 }
diff --git a/examples/plugin-catalog/README.md b/examples/plugin-catalog/README.md
new file mode 100644
index 000000000..4503a6d04
--- /dev/null
+++ b/examples/plugin-catalog/README.md
@@ -0,0 +1,52 @@
+# EffectCraft plug-ins
+
+The community catalog of WebAssembly effect plug-ins for
+[EffectCraft](https://github.com/storytold/effectcraft). The app's Plug-in Library
+(Settings ▸ Plug-in Library) reads [`index.json`](index.json) from this repository, then
+downloads, checks and installs the packages people pick. Plug-ins run in EffectCraft's sandbox:
+they can't read files, open the network or crash the app.
+
+This repository holds only the catalog. Each plug-in's code and `.wasm` live in its author's
+repository, attached to a GitHub release.
+
+## Submit a plug-in
+
+1. Build your plug-in and attach the `.wasm` to a GitHub release. The full guide is
+   [Publishing plug-ins](https://github.com/storytold/effectcraft/blob/main/docs/publishing-plugins.md).
+2. Add one entry to the `packages` array of `index.json`. [`example-entry.json`](example-entry.json)
+   shows every field; [`schema.json`](schema.json) is the exact format. To publish a new version,
+   add a release to your package's `versions` rather than editing an old one.
+3. Check it locally: `scripts/validate.sh` (needs bash, jq, curl, sha256sum and Node; set
+   `EFFECTCRAFT_CLI` to an `effectcraft-cli` build to also install it with the real loader).
+4. Open a pull request. CI runs the same script; a maintainer reviews the rest.
+
+## Review checklist (maintainers)
+
+CI checks the format, unique ids, each download's size and SHA-256, and that EffectCraft installs
+and loads the package. Before merging, also check:
+
+- [ ] The id is new, stable and names the author (reverse domain style: `io.github.user.name`).
+      Ids never change and are never reused.
+- [ ] `repo` is a public repository with the plug-in's source, and its licence is open (the
+      `license` field matches it).
+- [ ] Every `url` is a release asset of that repository (not a branch file, which can change).
+- [ ] The release builds from the tagged source; spot-check large or obfuscated modules.
+- [ ] `effects` lists the effect ids the module registers, and they don't clash with another
+      package's.
+- [ ] `name`, `description` and `tags` are accurate; no Adobe names, logos or assets.
+- [ ] `preview.video`, if given, is a short demo of the effect hosted on GitHub or a well-known
+      video site.
+- [ ] A change to an existing package comes from its author (or with their agreement), and old
+      releases keep their url and SHA-256.
+
+## Create this repository from the template
+
+The template lives in EffectCraft at `examples/plugin-catalog/`.
+
+1. Create the empty public repository `storytold/effectcraft-plugins` (branch `main`, so the app's
+   catalog URL `https://raw.githubusercontent.com/storytold/effectcraft-plugins/main/index.json`
+   resolves).
+2. Copy `README.md`, `index.json`, `example-entry.json`, `schema.json` and `scripts/` to its root,
+   and `validate.yml` to `.github/workflows/validate.yml`.
+3. Keep `scripts/validate.sh` executable (`git update-index --chmod=+x scripts/validate.sh`).
+4. Protect `main`: require pull requests and the `Validate` check.
diff --git a/examples/plugin-catalog/example-entry.json b/examples/plugin-catalog/example-entry.json
new file mode 100644
index 000000000..bdd559ee1
--- /dev/null
+++ b/examples/plugin-catalog/example-entry.json
@@ -0,0 +1,21 @@
+{
+  "id": "org.effectcraft.example.posterize-bands",
+  "name": "Posterize Bands",
+  "author": "EffectCraft contributors",
+  "license": "MIT OR Apache-2.0",
+  "repo": "https://github.com/storytold/effectcraft/tree/main/examples/plugins/posterize-bands",
+  "description": "Posterizes luminance into a chosen number of bands and tints them.",
+  "tags": ["stylize", "color"],
+  "preview": {"video": "https://github.com/storytold/effectcraft-plugins/raw/main/previews/posterize-bands.mp4"},
+  "versions": [
+    {
+      "version": "1.0.0",
+      "api": 1,
+      "minApp": "0.17.0",
+      "url": "https://github.com/storytold/effectcraft/releases/download/v0.17.0/posterize_bands.wasm",
+      "sha256": "d217309a695683de643678f456033677614cadb2890135362a32622e849498bf",
+      "size": 20100,
+      "effects": ["org.effectcraft.example.posterize-bands"]
+    }
+  ]
+}
diff --git a/examples/plugin-catalog/index.json b/examples/plugin-catalog/index.json
new file mode 100644
index 000000000..3bb616c48
--- /dev/null
+++ b/examples/plugin-catalog/index.json
@@ -0,0 +1 @@
+{"schema": 1, "packages": []}
diff --git a/examples/plugin-catalog/schema.json b/examples/plugin-catalog/schema.json
new file mode 100644
index 000000000..a2d30676b
--- /dev/null
+++ b/examples/plugin-catalog/schema.json
@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/storytold/effectcraft-plugins/main/schema.json",
+  "title": "EffectCraft Plug-in Library catalog (index.json), format 1",
+  "description": "Mirrors crates/engine/src/system/library.rs (parse_catalog). Unknown fields are rejected here to catch typos; the app itself ignores them.",
+  "type": "object",
+  "required": ["schema", "packages"],
+  "additionalProperties": false,
+  "properties": {
+    "schema": {"const": 1},
+    "packages": {"type": "array", "maxItems": 10000, "items": {"$ref": "#/$defs/package"}}
+  },
+  "$defs": {
+    "version": {"type": "string", "maxLength": 32, "pattern": "^[0-9]+(\\.[0-9]+)*$"},
+    "github_url": {
+      "type": "string",
+      "pattern": "^https://(github\\.com|raw\\.githubusercontent\\.com|objects\\.githubusercontent\\.com|release-assets\\.githubusercontent\\.com)/[^\\s]+$"
+    },
+    "package": {
+      "type": "object",
+      "required": ["id", "name", "versions"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {"type": "string", "pattern": "^(?!\\.)(?!.*\\.\\.)(?!.*\\.$)[A-Za-z0-9._-]{1,100}$"},
+        "name": {"type": "string", "pattern": "\\S"},
+        "author": {"type": "string"},
+        "description": {"type": "string"},
+        "license": {"type": "string"},
+        "repo": {"type": "string", "pattern": "^https://"},
+        "tags": {"type": "array", "items": {"type": "string"}},
+        "preview": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {"video": {"type": "string", "pattern": "^https://[^\\s]+$"}}
+        },
+        "versions": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/release"}}
+      }
+    },
+    "release": {
+      "type": "object",
+      "required": ["version", "api", "url", "sha256", "effects"],
+      "additionalProperties": false,
+      "properties": {
+        "version": {"$ref": "#/$defs/version"},
+        "api": {"type": "integer", "minimum": 0, "maximum": 4294967295},
+        "minApp": {"$ref": "#/$defs/version"},
+        "url": {"$ref": "#/$defs/github_url"},
+        "sha256": {"type": "string", "pattern": "^[0-9a-fA-F]{64}$"},
+        "size": {"type": "integer", "minimum": 1, "maximum": 67108864},
+        "effects": {"type": "array", "minItems": 1, "items": {"type": "string", "pattern": "^(?!ec\\.)[A-Za-z0-9._-]+$"}}
+      }
+    }
+  }
+}
diff --git a/examples/plugin-catalog/scripts/validate.sh b/examples/plugin-catalog/scripts/validate.sh
new file mode 100644
index 000000000..40e37de7f
--- /dev/null
+++ b/examples/plugin-catalog/scripts/validate.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Validate the plug-in catalog: schema, unique ids, every release's download (size + SHA-256),
+# then install every package with the real EffectCraft loader.
+#
+#   scripts/validate.sh [index.json]
+#
+# Needs bash, jq, curl, sha256sum and npx (Node). Environment:
+#   EFFECTCRAFT_CLI  path to an effectcraft-cli build; unset: the loader step is skipped.
+#   SKIP_SCHEMA=1    skip the schema step (testing with a local catalog that names file:// URLs).
+set -euo pipefail
+
+here=$(cd "$(dirname "$0")/.." && pwd)
+catalog=${1:-$here/index.json}
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+fail() { echo "error: $*" >&2; exit 1; }
+# A path as the CLI sees it (Git Bash on Windows: /tmp/x -> C:/.../x).
+native() { if command -v cygpath >/dev/null; then cygpath -m "$1"; else printf %s "$1"; fi; }
+# A file:// URL for a local path (file:///C:/x or file:///tmp/x).
+file_url() {
+  local p
+  p=$(native "$1")
+  [[ $p == /* ]] || p="/$p"
+  printf 'file://%s' "$p"
+}
+
+echo "== 1. schema"
+[ "$(wc -c <"$catalog")" -le $((4 << 20)) ] || fail "the catalog is larger than 4 MB (the app's limit)"
+# Exactly one object of format 1 with a packages array (an empty file or a second value fails too),
+# checked even when the schema step is skipped.
+jq -e -s 'length == 1 and (.[0] | type == "object" and .schema == 1 and (.packages | type == "array"))' "$catalog" >/dev/null \
+  || fail "$catalog isn't one JSON object with \"schema\": 1 and a \"packages\" array"
+if [ "${SKIP_SCHEMA:-}" = 1 ]; then
+  echo "skipped (SKIP_SCHEMA=1)"
+else
+  npx --yes ajv-cli@5.0.0 validate --spec=draft2020 --strict=false -s "$here/schema.json" -d "$catalog"
+fi
+
+echo "== 2. unique ids"
+dups=$(jq -r '.packages[].id' "$catalog" | sort | uniq -d)
+[ -z "$dups" ] || fail "duplicate package ids: $dups"
+echo "ok"
+
+echo "== 3. downloads"
+# The checked files are what the loader step installs: a copy of the catalog names them by file://.
+local_catalog=$(jq '.' "$catalog")
+while IFS=$'\t' read -r p r id version url sha size; do
+  file="$work/$id-$version.wasm"
+  echo "$id $version: $url"
+  curl -fsSL --retry 2 --max-filesize $((64 << 20)) -o "$file" "$url" || fail "$id $version: download failed"
+  got_size=$(wc -c <"$file" | tr -d ' ')
+  got_sha=$(sha256sum "$file" | cut -d' ' -f1)
+  [ -z "$size" ] || [ "$size" = "$got_size" ] || fail "$id $version: size is $got_size, the catalog says $size"
+  [ "$got_sha" = "$(tr 'A-F' 'a-f' <<<"$sha")" ] || fail "$id $version: SHA-256 is $got_sha, the catalog says $sha"
+  local_catalog=$(jq --argjson p "$p" --argjson r "$r" --arg u "$(file_url "$file")" '.packages[$p].versions[$r].url = $u' <<<"$local_catalog")
+done < <(jq -r '.packages | to_entries[] | .key as $p | .value as $pkg | $pkg.versions | to_entries[]
+  | [$p, .key, $pkg.id, .value.version, .value.url, .value.sha256, (.value.size // "")] | @tsv' "$catalog")
+echo "ok"
+
+echo "== 4. load with EffectCraft"
+if [ -z "${EFFECTCRAFT_CLI:-}" ]; then
+  echo "skipped (set EFFECTCRAFT_CLI to an effectcraft-cli build)"
+  exit 0
+fi
+printf '%s\n' "$local_catalog" >"$work/index.json"
+mkdir -p "$work/config"
+export EFFECTCRAFT_CONFIG_DIR=$(native "$work/config")
+"$EFFECTCRAFT_CLI" exec library.refresh "{\"catalog\": \"$(file_url "$work/index.json")\", \"wait\": true}"
+# shortcut: installs each package's newest release this build runs, not every release; older releases were checked when they were added.
+for id in $(jq -r '.packages[].id' "$catalog"); do
+  "$EFFECTCRAFT_CLI" exec library.install "{\"id\": \"$id\", \"wait\": true}" || fail "$id didn't install"
+done
+echo "ok"
diff --git a/examples/plugin-catalog/validate.yml b/examples/plugin-catalog/validate.yml
new file mode 100644
index 000000000..927a61f31
--- /dev/null
+++ b/examples/plugin-catalog/validate.yml
@@ -0,0 +1,47 @@
+# Checks index.json on every pull request and push: schema, unique ids, every release's download
+# (size + SHA-256), then installs every package with the real EffectCraft loader.
+# Lives at .github/workflows/validate.yml in storytold/effectcraft-plugins.
+name: Validate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check out EffectCraft
+        uses: actions/checkout@v4
+        with:
+          repository: storytold/effectcraft
+          path: effectcraft
+
+      # The CLI links the UI crate, which needs these to build (same list as EffectCraft's CI).
+      - name: System packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev \
+            libxcursor-dev libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev libgl1-mesa-dev libasound2-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: effectcraft
+
+      - name: Build effectcraft-cli
+        working-directory: effectcraft
+        run: cargo build -p effectcraft-cli
+
+      - name: Validate the catalog
+        env:
+          EFFECTCRAFT_CLI: ${{ github.workspace }}/effectcraft/target/debug/effectcraft-cli
+        run: bash scripts/validate.sh index.json
diff --git a/examples/plugins/posterize-bands/Cargo.toml b/examples/plugins/posterize-bands/Cargo.toml
index 825d704aa..65bbbaaaf 100644
--- a/examples/plugins/posterize-bands/Cargo.toml
+++ b/examples/plugins/posterize-bands/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "posterize-bands"
-description = "Example EffectCraft effect plug-in (WebAssembly, plug-in API v1): posterizes luminance into tinted bands"
+description = "Example EffectCraft effect plug-in (WebAssembly ABI 1): posterizes luminance into tinted bands"
 version = "1.0.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
diff --git a/examples/plugins/posterize-bands/src/lib.rs b/examples/plugins/posterize-bands/src/lib.rs
index 9af709433..77026a16f 100644
--- a/examples/plugins/posterize-bands/src/lib.rs
+++ b/examples/plugins/posterize-bands/src/lib.rs
@@ -1,4 +1,4 @@
-//! Posterize Bands: an example EffectCraft effect plug-in (plug-in API v1, see
+//! Posterize Bands: an example EffectCraft effect plug-in (WebAssembly ABI 1, see
 //! `docs/plugins.md`). It quantizes each pixel's luminance into `levels` bands and mixes a tint
 //! colour in by `mix` percent, optionally only above a `threshold`.
 //!
diff --git a/extensions/scriptui-panels/Ease Presets.jsx b/extensions/scriptui-panels/Ease Presets.jsx
index 6f6eadae5..9f4ea2185 100644
--- a/extensions/scriptui-panels/Ease Presets.jsx	
+++ b/extensions/scriptui-panels/Ease Presets.jsx	
@@ -18,6 +18,8 @@
 // segment on that side. So a selected pair gets the whole curve, and a single key works too.
 // Roving keys are skipped: they pass speed straight through (their sides stay linear), so an ease
 // set on them wouldn't play.
+// The built-in Linear preset uses Linear interpolation, including on unused endpoint sides
+// so a fully linear key has a diamond icon; the other presets use Bezier.
 //
 // User presets are kept with app.settings (section "Ease Presets", key "userPresets") as JSON:
 // {"version": 1, "presets": [{"name": …, "curve": {"outInfluence", "outSpeed", "inInfluence",
@@ -29,6 +31,7 @@
   var MAX_NAME = 64;
   var MIN_INFLUENCE = 0.1;
   var MAX_SPEED = 100;
+  var LINEAR = KeyframeInterpolationType.LINEAR;
   var BEZIER = KeyframeInterpolationType.BEZIER;
   var HOLD = KeyframeInterpolationType.HOLD;
 
@@ -178,16 +181,16 @@
 
   // Ease one side of key `k` with `eases`, leaving its other side as it plays (auto-Bezier and
   // linear sides keep their shape; a continuous key stops being continuous, its sides now differ).
-  function easeSide(p, k, out, eases) {
+  function easeSide(p, k, out, eases, interpolation) {
     var inType = p.keyInInterpolationType(k), outType = p.keyOutInterpolationType(k);
     var inEase = p.keyInTemporalEase(k), outEase = p.keyOutTemporalEase(k);
     if (p.keyTemporalContinuous(k)) p.setTemporalContinuousAtKey(k, false);
     if (out) {
       p.setTemporalEaseAtKey(k, inEase, eases);
-      p.setInterpolationTypeAtKey(k, inType, BEZIER);
+      p.setInterpolationTypeAtKey(k, inType, interpolation);
     } else {
       p.setTemporalEaseAtKey(k, eases, outEase);
-      p.setInterpolationTypeAtKey(k, BEZIER, outType);
+      p.setInterpolationTypeAtKey(k, interpolation, outType);
     }
   }
 
@@ -201,7 +204,7 @@
   // Ease the sides `mode` names ("In", "Out" or "In-Out") of every selected keyframe with `c`, in
   // one undo step: a side with a neighbouring key, scaled to the segment on that side. Returns
   // {eased, roving}: the number of keyframes eased, and of selected roving keyframes skipped.
-  function applyCurve(c, mode) {
+  function applyCurve(c, mode, interpolation) {
     var keyed = selectedKeyed(), sides = [], keys = 0, roving = 0;
     var doIn = mode !== "Out", doOut = mode !== "In";
     // Every side and its eases first: the segments are measured before any key changes.
@@ -214,16 +217,16 @@
           continue;
         }
         var s = doIn && k > 1 ? slopes(p, k - 1) : null;
-        if (s) sides.push({ prop: p, key: k, out: false, eases: eases(s, c.inSpeed, c.inInfluence) });
+        if (s || (doIn && interpolation === LINEAR)) sides.push({ prop: p, key: k, out: false, eases: s ? eases(s, c.inSpeed, c.inInfluence) : p.keyInTemporalEase(k) });
         s = doOut && k < p.numKeys ? slopes(p, k) : null;
-        if (s) sides.push({ prop: p, key: k, out: true, eases: eases(s, c.outSpeed, c.outInfluence) });
+        if (s || (doOut && interpolation === LINEAR)) sides.push({ prop: p, key: k, out: true, eases: s ? eases(s, c.outSpeed, c.outInfluence) : p.keyOutTemporalEase(k) });
         if (sides.length > before) keys++;
       }
     }
     if (!sides.length) return { eased: 0, roving: roving };
     app.beginUndoGroup("Apply Ease Preset");
     try {
-      for (var e = 0; e < sides.length; e++) easeSide(sides[e].prop, sides[e].key, sides[e].out, sides[e].eases);
+      for (var e = 0; e < sides.length; e++) easeSide(sides[e].prop, sides[e].key, sides[e].out, sides[e].eases, interpolation);
     } finally {
       app.endUndoGroup();
     }
@@ -384,7 +387,10 @@
 
   function apply(c, what) {
     var m = mode.selection ? mode.selection.text : "In-Out";
-    var r = applyCurve(c, m), n = r.eased;
+    // Linear is an interpolation type too, so its keys get diamond icons. Edited speeds
+    // make a custom Bezier curve even while Linear remains selected in the list.
+    var interpolation = list.selection && list.selection.text === "Linear" && c.outSpeed === 1 && c.inSpeed === 1 ? LINEAR : BEZIER;
+    var r = applyCurve(c, m, interpolation), n = r.eased;
     var side = m === "In" ? "before it" : m === "Out" ? "after it" : "next to it";
     var skipped = r.roving > 0 ? "skipped " + r.roving + " roving keyframe(s); turn off Roving to ease them" : "";
     if (n > 0) status.text = "Eased " + n + " keyframe(s) (" + m + ") with " + what + (skipped ? "; " + skipped : "");
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 000000000..915f6ef3e
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1791594108,
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 000000000..38d8aa87c
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,106 @@
+{
+  description = "EffectCraft — motion graphics and visual effects, a free alternative to After Effects, in pure Rust";
+
+  inputs = {
+    # EffectCraft needs edition 2024 and rustc ≥ 1.95, so the flake tracks unstable. Consumers on a
+    # release channel can retarget it: `inputs.effectcraft.inputs.nixpkgs.follows = "nixpkgs";`
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+    }:
+    let
+      inherit (nixpkgs) lib;
+
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "aarch64-darwin"
+      ];
+
+      # The AppStream metadata carries a release date. The flake source's own commit date is
+      # reproducible, unlike "now"; a tarball or dirty tree without one falls back to the epoch.
+      buildDate =
+        let
+          d = self.lastModifiedDate or "";
+        in
+        if builtins.stringLength d >= 8 then
+          "${builtins.substring 0 4 d}-${builtins.substring 4 2 d}-${builtins.substring 6 2 d}"
+        else
+          "1970-01-01";
+
+      packageArgs = {
+        inherit buildDate;
+      };
+
+      forAllSystems = f: lib.genAttrs systems (system: f (import nixpkgs { inherit system; }) system);
+    in
+    {
+      packages = forAllSystems (
+        pkgs: _:
+        let
+          effectcraft = pkgs.callPackage ./nix/package.nix packageArgs;
+        in
+        {
+          inherit effectcraft;
+          default = effectcraft;
+        }
+      );
+
+      # `nixpkgs.overlays = [ inputs.effectcraft.overlays.default ]` → `pkgs.effectcraft` everywhere.
+      overlays.default = final: _prev: {
+        effectcraft = final.callPackage ./nix/package.nix packageArgs;
+      };
+
+      apps = forAllSystems (
+        _: system: {
+          default = {
+            type = "app";
+            program = lib.getExe self.packages.${system}.effectcraft;
+          };
+        }
+      );
+
+      devShells = forAllSystems (
+        pkgs: system:
+        let
+          effectcraft = self.packages.${system}.effectcraft;
+        in
+        {
+          default = pkgs.mkShell ({
+            # The package's own native inputs, so `cargo build` in the shell needs no extra setup.
+            inputsFrom = [ effectcraft ];
+            packages = with pkgs; [
+              cargo
+              rustc
+              clippy
+              rustfmt
+              rust-analyzer
+            ];
+            # `cargo run` dlopens the Vulkan loader, libwayland and libxkbcommon like the packaged binary.
+            LD_LIBRARY_PATH = lib.makeLibraryPath effectcraft.passthru.runtimeLibs;
+            RUST_BACKTRACE = "1";
+          });
+        }
+      );
+
+      checks = forAllSystems (
+        pkgs: system: {
+          effectcraft = self.packages.${system}.effectcraft;
+
+          # `nix fmt` formats the flake; this keeps it formatted.
+          formatting =
+            pkgs.runCommand "effectcraft-nix-formatting" { nativeBuildInputs = [ pkgs.nixfmt ]; }
+              ''
+                nixfmt --check ${./flake.nix} ${./nix}
+                touch $out
+              '';
+        }
+      );
+
+      formatter = forAllSystems (pkgs: _: pkgs.nixfmt);
+    };
+}
diff --git a/nix/package.nix b/nix/package.nix
new file mode 100644
index 000000000..51b636c60
--- /dev/null
+++ b/nix/package.nix
@@ -0,0 +1,200 @@
+# EffectCraft — the desktop app (`effectcraft`) and the CLI/MCP server (`effectcraft-cli`), built from this
+# repository:
+#
+#   nix build          # → ./result/bin/effectcraft, ./result/bin/effectcraft-cli
+#
+# Kept in step with the release workflow (.github/workflows/release.yml) and packaging/:
+#   * `Cargo.lock` drives the dependencies (`cargoLock`), so there is no vendorHash to bump. The
+#     git sources (storytold/craft-libs, storytold/filmcraft) are fetched at the revision the lock file pins;
+#   * the desktop file, hicolor icons, MIME types and AppStream metadata are the same files the
+#     .deb/.rpm ship (packaging/linux/), so `apt` and NixOS users see one identical EffectCraft;
+#   * `doCheck` is off: the test suite needs corpora and a GPU the Nix sandbox cannot provide
+#     (`cargo xtask ci` is the gate). `pkgs.effectcraft.overrideAttrs { doCheck = true; }` runs it.
+#
+# Everything in the product is pure Rust, so this needs no build system beyond cargo plus the
+# libraries winit/wgpu `dlopen` at run time (see `runtimeLibs`).
+#
+# Desktop sessions: the window opens natively on Wayland (GNOME/Mutter, Hyprland and other
+# wlroots-style compositors) and falls back to X11/XWayland. File dialogs go through
+# xdg-desktop-portal, so the session needs a portal backend: GNOME ships one
+# (`xdg-desktop-portal-gnome`); on Hyprland enable
+#   xdg.portal = { enable = true; extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; };
+# next to `programs.hyprland.enable = true;`.
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  pkg-config,
+  makeWrapper,
+  # Windowing/GPU libraries: needed at build time by the crates that link them, at run time by the
+  # ones that open them with dlopen() (see `runtimeLibs`), and by the dev shell (flake.nix).
+  wayland,
+  wayland-scanner,
+  libxkbcommon,
+  libx11,
+  libxcb,
+  libxcursor,
+  libxi,
+  libxrandr,
+  vulkan-loader,
+  libglvnd,
+  # rfd opens libdbus-1 at run time to reach the xdg-desktop-portal file chooser (Open/Save dialogs).
+  dbus,
+  # Audio: cpal links ALSA, which reaches PipeWire/PulseAudio through the ALSA plug-ins.
+  alsa-lib,
+  # Validates the desktop file and the AppStream metadata we install (as CI does).
+  desktop-file-utils,
+  appstream,
+  # Adds the driver search path (/run/opengl-driver/lib) to the binaries' RPATH so wgpu finds the
+  # installed Vulkan/GL driver on NixOS. Optional: harmless on nixpkgs without it.
+  autoAddDriverRunpath ? null,
+  # Release date for the AppStream metadata (YYYY-MM-DD); the flake derives it from its own commit.
+  buildDate ? "1970-01-01",
+}:
+
+let
+  root = ../.;
+
+  # The version lives in exactly one place: `[workspace.package] version` in the root Cargo.toml.
+  version = (builtins.fromTOML (builtins.readFile (root + "/Cargo.toml"))).workspace.package.version;
+
+  isLinux = stdenv.hostPlatform.isLinux;
+
+  # AppStream id: also the desktop file name, and the icon name in share/icons/hicolor.
+  appId = "ai.storyteller.effectcraft";
+
+  # Libraries the binaries open at run time with dlopen(): nothing links them, so no RPATH points at
+  # them. winit loads libwayland-client, libxkbcommon(-x11) and the X11 libraries; wgpu loads the
+  # Vulkan loader or libEGL (libglvnd); rfd loads libdbus-1 for the file chooser portal. NixOS patches the loader to find the drivers in
+  # /run/opengl-driver. The wrapper below points LD_LIBRARY_PATH here.
+  runtimeLibs = lib.optionals isLinux [
+    libxkbcommon
+    wayland
+    libx11
+    libxcb
+    libxcursor
+    libxi
+    libxrandr
+    vulkan-loader
+    libglvnd
+    dbus
+  ];
+
+  # The two native binaries. The wasm app (apps/effectcraft-web) is built by `cargo xtask`, not here.
+  binaries = [
+    "effectcraft"
+    "effectcraft-cli"
+  ];
+
+in
+rustPlatform.buildRustPackage {
+  pname = "effectcraft";
+  inherit version;
+
+  src = lib.cleanSourceWith {
+    src = lib.cleanSource root;
+    # The Nix files are not part of the build: editing them must not rebuild any Rust.
+    filter =
+      path: _type:
+      !(builtins.elem (baseNameOf path) [
+        "flake.nix"
+        "flake.lock"
+        "nix"
+      ]);
+  };
+
+  cargoLock = {
+    lockFile = root + "/Cargo.lock";
+    # The git dependencies are pinned by revision in Cargo.lock.
+    allowBuiltinFetchGit = true;
+  };
+
+  # Both binaries, as the .deb/.rpm install them (`packaging/linux/package.sh`).
+  cargoBuildFlags = [
+    "--locked"
+    "-p"
+    "effectcraft"
+    "-p"
+    "effectcraft-cli"
+  ];
+
+  doCheck = false;
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals isLinux [
+    makeWrapper
+    wayland-scanner
+    desktop-file-utils
+    appstream
+  ]
+  ++ lib.optionals (isLinux && autoAddDriverRunpath != null) [ autoAddDriverRunpath ];
+
+  buildInputs = lib.optionals isLinux [
+    wayland
+    libxkbcommon
+    libx11
+    libxcb
+    libxcursor
+    libxi
+    libxrandr
+    alsa-lib
+  ];
+
+  postInstall = ''
+    # Desktop integration: byte-for-byte the files the .deb/.rpm/.AppImage install.
+    install -Dm644 packaging/linux/${appId}.desktop $out/share/applications/${appId}.desktop
+    install -Dm644 packaging/linux/${appId}.mime.xml $out/share/mime/packages/${appId}.xml
+    cp -r assets/app-icon/hicolor $out/share/icons/
+    install -d $out/share/metainfo
+    substitute packaging/linux/${appId}.metainfo.xml.in \
+      $out/share/metainfo/${appId}.metainfo.xml \
+      --subst-var-by VERSION ${version} \
+      --subst-var-by DATE ${buildDate}
+
+    # Licences for everything embedded in the binaries.
+    doc=$out/share/doc/effectcraft
+    for f in README.md LICENSE-MIT LICENSE-APACHE NOTICE ATTRIBUTION.md assets/ATTRIBUTION.md; do
+      if [ -f "$f" ]; then install -Dm644 "$f" "$doc/$(basename "$f")"; fi
+    done
+    for f in assets/fonts/OFL-*.txt; do
+      if [ -f "$f" ]; then install -Dm644 "$f" "$doc/$(basename "$f")"; fi
+    done
+  ''
+  + lib.optionalString isLinux ''
+    desktop-file-validate $out/share/applications/${appId}.desktop
+    XDG_CACHE_HOME=$TMPDIR/.cache appstreamcli validate --no-net \
+      $out/share/metainfo/${appId}.metainfo.xml
+
+    # makeWrapper keeps the binaries working when the libs above are only dlopen'd.
+    for bin in ${lib.concatStringsSep " " (map (b: "$out/bin/" + b) binaries)}; do
+      wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+    done
+  '';
+
+  passthru = {
+    # Shared with the dev shell so `cargo run` inside `nix develop` finds the same dlopen'd libs.
+    inherit runtimeLibs;
+  };
+
+  meta = {
+    description = "Motion graphics and visual effects application";
+    longDescription = ''
+      EffectCraft is a motion graphics and visual effects application: compositions, keyframes,
+      effects and rendering. It ships with effectcraft-cli, a headless renderer, command runner and
+      MCP server for AI agents.
+    '';
+    homepage = "https://getartcraft.com/apps/effectcraft";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    # `nix run` and the desktop entry both start the GUI.
+    mainProgram = "effectcraft";
+  };
+}
diff --git a/packaging/env.sh b/packaging/env.sh
index 6a1bfa286..1e6e2cde1 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -19,10 +19,11 @@ workspace_version() {
     /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
     in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
   ' "$ROOT/Cargo.toml"
+  return
 }
 
 VERSION="${EFFECTCRAFT_VERSION:-$(workspace_version)}"
-if [ -z "$VERSION" ]; then
+if [[ -z "$VERSION" ]]; then
   echo "error: could not read [workspace.package] version from $ROOT/Cargo.toml" >&2
   exit 1
 fi
@@ -32,7 +33,7 @@ DIST="${DIST:-$ROOT/dist/release}"
 mkdir -p "$DIST"
 export DIST
 
-if [ -z "${EFFECTCRAFT_BUILD_SHA:-}" ]; then
+if [[ -z "${EFFECTCRAFT_BUILD_SHA:-}" ]]; then
   EFFECTCRAFT_BUILD_SHA="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
 fi
 export EFFECTCRAFT_BUILD_SHA
@@ -41,18 +42,22 @@ export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 
 # Emit a GitHub Actions warning (plain stderr outside Actions).
 warn() {
-  if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  return
 }
 
 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
   local dest="$1" f
-  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
-    if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
+  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT NOTICE; do
+    if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
   done
+  return
 }
 
 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
-  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+  local file="$1"
+  if command -v sha256sum >/dev/null; then sha256sum "$file" | cut -d' ' -f1; else shasum -a 256 "$file" | cut -d' ' -f1; fi
+  return
 }
diff --git a/packaging/freebsd/package.sh b/packaging/freebsd/package.sh
index 236c464a6..053f8185c 100755
--- a/packaging/freebsd/package.sh
+++ b/packaging/freebsd/package.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
 # Build and package EffectCraft for FreeBSD:
 #
-#   $DIST/effectcraft-<version>-freebsd-x86_64.tar.gz   a /usr/local-style tree:
-#       effectcraft-<version>-freebsd-x86_64/{bin, share/applications, share/icons, share/mime,
+#   $DIST/effectcraft-<version>-freebsd-<arch>.tar.gz   a /usr/local-style tree (<arch> is x86_64 or aarch64):
+#       effectcraft-<version>-freebsd-<arch>/{bin, share/applications, share/icons, share/mime,
 #       share/metainfo, share/doc/effectcraft}
 #
 # Install by copying the tree's contents into /usr/local:
-#   tar -xzf effectcraft-<version>-freebsd-x86_64.tar.gz --strip-components 1 -C /usr/local
+#   tar -xzf effectcraft-<version>-freebsd-<arch>.tar.gz --strip-components 1 -C /usr/local
 #
 # Usage: packaging/freebsd/package.sh [--skip-build] [--dry-run]
 #   --dry-run   stage the tree from stub binaries and list it, without building (works on any OS)
@@ -20,7 +20,7 @@ APP_ID=ai.storyteller.effectcraft
 
 SKIP_BUILD=0
 DRY_RUN=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --dry-run) DRY_RUN=1; SKIP_BUILD=1; shift ;;
@@ -29,14 +29,23 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-# FreeBSD's uname says amd64; release file names use x86_64 like the Linux and Windows ones.
-MACHINE="$(uname -m)"
-case "$MACHINE" in
-  amd64 | x86_64) ARCH=x86_64 ;;
-  arm64 | aarch64) ARCH=aarch64 ;;
-  *) echo "unsupported architecture $MACHINE" >&2; exit 2 ;;
-esac
-if [ "$DRY_RUN" = 0 ] && [ "$(uname -s)" != FreeBSD ]; then
+# A cross build runs on the x86_64 VM, so the target names the arch, not uname.
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]]; then
+  case "$CARGO_BUILD_TARGET" in
+    aarch64-unknown-freebsd) ARCH=aarch64 ;;
+    x86_64-unknown-freebsd) ARCH=x86_64 ;;
+    *) echo "unsupported CARGO_BUILD_TARGET $CARGO_BUILD_TARGET (use x86_64- or aarch64-unknown-freebsd)" >&2; exit 2 ;;
+  esac
+else
+  # FreeBSD's uname says amd64; release file names use x86_64 like the Linux and Windows ones.
+  MACHINE="$(uname -m)"
+  case "$MACHINE" in
+    amd64 | x86_64) ARCH=x86_64 ;;
+    arm64 | aarch64) ARCH=aarch64 ;;
+    *) echo "unsupported architecture $MACHINE" >&2; exit 2 ;;
+  esac
+fi
+if [[ "$DRY_RUN" = 0 ]] && [[ "$(uname -s)" != FreeBSD ]]; then
   echo "error: build on FreeBSD (or pass --dry-run to check the tree layout)" >&2
   exit 2
 fi
@@ -46,8 +55,15 @@ echo "==> EffectCraft $VERSION for FreeBSD $ARCH"
 
 # The release VM has 12 GB; full parallelism on the biggest crates runs it out of memory.
 export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-4}"
-if [ "$SKIP_BUILD" = 0 ]; then
-  (cd "$ROOT" && cargo build --release --locked -p effectcraft -p effectcraft-cli)
+# The aarch64 build once ran in an emulated VM: with one codegen unit and thin LTO the largest
+# crates each optimized on a single emulated core and the job ran past its 5-hour limit, so trade
+# a little runtime speed for parallel codegen there. x86_64 keeps the workspace's release profile.
+if [[ "$ARCH" = aarch64 ]]; then
+  export CARGO_PROFILE_RELEASE_CODEGEN_UNITS="${CARGO_PROFILE_RELEASE_CODEGEN_UNITS:-16}"
+  export CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO:-off}"
+fi
+if [[ "$SKIP_BUILD" = 0 ]]; then
+  (cd "$ROOT" && cargo build --release --locked ${CARGO_BUILD_TARGET:+--target "$CARGO_BUILD_TARGET"} -p effectcraft -p effectcraft-cli)
 fi
 WORK="$CARGO_TARGET_DIR/freebsd-package"
 STAGE="$WORK/$BASENAME"
@@ -55,8 +71,9 @@ rm -rf "$WORK"
 mkdir -p "$WORK"
 
 BIN="$CARGO_TARGET_DIR/release"
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]]; then BIN="$CARGO_TARGET_DIR/$CARGO_BUILD_TARGET/release"; fi
 OUT_DIR="$DIST"
-if [ "$DRY_RUN" = 1 ]; then
+if [[ "$DRY_RUN" = 1 ]]; then
   # Stub binaries, and the tarball stays in the work dir so dist/ only ever holds real builds.
   BIN="$WORK/stub-bin"
   OUT_DIR="$WORK"
@@ -81,13 +98,13 @@ sed -e "s/@VERSION@/$VERSION/g" -e "s/@DATE@/$EFFECTCRAFT_BUILD_DATE/g" \
 cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/share/icons/"
 copy_docs "$STAGE/share/doc/effectcraft"
 for f in NOTICE ATTRIBUTION.md; do
-  if [ -f "$ROOT/$f" ]; then install -m 644 "$ROOT/$f" "$STAGE/share/doc/effectcraft/"; fi
+  if [[ -f "$ROOT/$f" ]]; then install -m 644 "$ROOT/$f" "$STAGE/share/doc/effectcraft/"; fi
 done
 
 for f in bin/effectcraft bin/effectcraft-cli "share/applications/$APP_ID.desktop" \
   "share/icons/hicolor/256x256/apps/$APP_ID.png" "share/icons/hicolor/scalable/apps/$APP_ID.svg" \
   share/doc/effectcraft/LICENSE-MIT share/doc/effectcraft/LICENSE-APACHE; do
-  if [ ! -e "$STAGE/$f" ]; then echo "error: $f is missing from the package" >&2; exit 1; fi
+  if [[ ! -e "$STAGE/$f" ]]; then echo "error: $f is missing from the package" >&2; exit 1; fi
 done
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
@@ -95,8 +112,16 @@ mkdir -p "$OUT_DIR"
 tar -C "$WORK" -czf "$OUT_DIR/$BASENAME.tar.gz" "$BASENAME"
 echo "wrote $OUT_DIR/$BASENAME.tar.gz"
 
-"$STAGE/bin/effectcraft-cli" --version
-if [ "$DRY_RUN" = 1 ]; then
+# Run the smoke test only when the binary's target is this host's (a cross build can't run here).
+case "$(uname -m)" in
+  amd64 | x86_64) HOST_TRIPLE=x86_64-unknown-freebsd ;;
+  arm64 | aarch64) HOST_TRIPLE=aarch64-unknown-freebsd ;;
+  *) HOST_TRIPLE= ;;
+esac
+if [[ -z "${CARGO_BUILD_TARGET:-}" || "$CARGO_BUILD_TARGET" = "$HOST_TRIPLE" ]]; then
+  "$STAGE/bin/effectcraft-cli" --version
+fi
+if [[ "$DRY_RUN" = 1 ]]; then
   echo "==> dry run: tarball contents"
   tar -tzvf "$OUT_DIR/$BASENAME.tar.gz"
 fi
diff --git a/packaging/icons.sh b/packaging/icons.sh
index afeb13f83..9ae9af213 100755
--- a/packaging/icons.sh
+++ b/packaging/icons.sh
@@ -5,9 +5,6 @@
 # .icns. The outputs are committed, so builds and packaging never need these tools.
 #
 #   packaging/icons.sh
-#
-# effectcraft.svg and effectcraft-small.svg (the lighter 1024 px trace) come from craftrules
-# (assets/app-icons/effectcraft/, which also keeps the source drawing) and are copied in by hand.
 set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 DIR="$ROOT/assets/app-icon"
@@ -18,7 +15,10 @@ trap 'rm -rf "$TMP"' EXIT
 
 command -v resvg >/dev/null || { echo "error: resvg not found (brew install resvg)" >&2; exit 1; }
 
-render() { resvg -w "$2" -h "$2" "$1" "$3" </dev/null; }
+render() {
+  local svg="$1" size="$2" out="$3"
+  resvg -w "$size" -h "$size" "$svg" "$out" </dev/null
+}
 
 # The tile fills its 512 viewBox edge to edge, which suits Windows and Linux. macOS icons keep
 # Apple's grid instead: an 824 px body centred on a 1024 canvas with a transparent margin.
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index d5dcdfc0f..a171582bb 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -20,10 +20,12 @@ APP_ID=ai.storyteller.effectcraft
 FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
+OCI=0
 TARBALL=""
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
+    --oci) OCI=1; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
     -*) echo "unknown argument: $1" >&2; exit 2 ;;
     *) TARBALL="$1"; shift ;;
@@ -38,7 +40,7 @@ case "$ARCH" in
 esac
 BASENAME="effectcraft-$VERSION-linux-$ARCH"
 TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}"
-[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
+[[ -f "$TARBALL" ]] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
 for tool in flatpak flatpak-builder; do
   command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; }
 done
@@ -49,7 +51,7 @@ WORK="$CARGO_TARGET_DIR/flatpak-bundle"
 rm -rf "$WORK"
 mkdir -p "$WORK/stage"
 tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1
-[ -x "$WORK/stage/bin/effectcraft" ] || { echo "error: $TARBALL has no bin/effectcraft" >&2; exit 1; }
+[[ -x "$WORK/stage/bin/effectcraft" ]] || { echo "error: $TARBALL has no bin/effectcraft" >&2; exit 1; }
 cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml"
 
 flatpak remote-add --user --if-not-exists flathub "$FLATHUB"
@@ -61,8 +63,14 @@ OUT="$DIST/$BASENAME.flatpak"
 # --runtime-repo lets `flatpak install` fetch the freedesktop runtime from Flathub if missing.
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
+if [[ "$OCI" = 1 ]]; then
+  OUT_OCI="$DIST/$BASENAME-oci"
+  rm -rf "$OUT_OCI"
+  flatpak build-bundle --oci "$WORK/repo" "$OUT_OCI" "$APP_ID" stable
+  echo "wrote OCI layout to $OUT_OCI"
+fi
 
-if [ "$TEST" = 1 ]; then
+if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
   flatpak run --command=effectcraft-cli "$APP_ID" --version
diff --git a/packaging/linux/flatpak-oci.sh b/packaging/linux/flatpak-oci.sh
new file mode 100755
index 000000000..6a40bb991
--- /dev/null
+++ b/packaging/linux/flatpak-oci.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Build effectcraft as an OCI container layout and push it to GitHub Container Registry (GHCR)
+# for consumption by Flatpak OCI clients (flatpak-oci-specs).
+#
+# Usage:
+#   packaging/linux/flatpak-oci.sh [--push] [TARBALL]
+#
+# Environment variables:
+#   REGISTRY       Target registry image (default: ghcr.io/storytold/effectcraft)
+#   TAG            Target image tag (default: $VERSION-$ARCH, also tags stable-$ARCH)
+#   GITHUB_TOKEN   Token for GHCR authentication when --push is used
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+
+PUSH=0
+TARBALL=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push) PUSH=1; shift ;;
+    -h | --help) sed -n '2,12p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+
+BASENAME="effectcraft-$VERSION-linux-$ARCH"
+OUT_OCI="$DIST/$BASENAME-oci"
+
+echo "==> Building Flatpak OCI layout for $BASENAME"
+"$HERE/flatpak-bundle.sh" --oci --no-test "${TARBALL:-}"
+
+[[ -d "$OUT_OCI" ]] || { echo "error: $OUT_OCI layout not generated" >&2; exit 1; }
+
+REGISTRY="${REGISTRY:-ghcr.io/storytold/effectcraft}"
+TAG="${TAG:-$VERSION-$ARCH}"
+
+echo "==> OCI layout ready at $OUT_OCI (Target: $REGISTRY:$TAG)"
+
+if [[ "$PUSH" = 1 ]]; then
+  command -v skopeo >/dev/null || { echo "error: skopeo is required to push OCI images (apt install skopeo)" >&2; exit 1; }
+
+  AUTH_ARGS=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    AUTH_ARGS=(--dest-creds "${GITHUB_ACTOR:-storytold}:$GITHUB_TOKEN")
+  fi
+
+  echo "==> Pushing to $REGISTRY:$TAG"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:$TAG"
+
+  # Also update architecture-specific stable tag
+  echo "==> Pushing to $REGISTRY:stable-$ARCH"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:stable-$ARCH"
+
+  echo "==> Push complete"
+fi
diff --git a/packaging/linux/flatpak/ai.storyteller.effectcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.effectcraft.bundle.yml
index f1074cdb2..03c4ee08f 100644
--- a/packaging/linux/flatpak/ai.storyteller.effectcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.effectcraft.bundle.yml
@@ -17,6 +17,7 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: effectcraft
 finish-args:
+  - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
diff --git a/packaging/linux/flatpak/ai.storyteller.effectcraft.yml b/packaging/linux/flatpak/ai.storyteller.effectcraft.yml
index be9f898ed..0797c5ea2 100644
--- a/packaging/linux/flatpak/ai.storyteller.effectcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.effectcraft.yml
@@ -20,6 +20,7 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: effectcraft
 finish-args:
+  - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
@@ -55,6 +56,7 @@ modules:
     build-commands:
       - cargo --offline build --release --locked -p effectcraft -p effectcraft-cli
       - install -Dm755 target/release/effectcraft /app/bin/effectcraft
+      - install -Dm644 NOTICE /app/share/doc/effectcraft/NOTICE
       - install -Dm755 target/release/effectcraft-cli /app/bin/effectcraft-cli
       - install -Dm644 packaging/linux/ai.storyteller.effectcraft.desktop /app/share/applications/ai.storyteller.effectcraft.desktop
       - install -Dm644 packaging/linux/ai.storyteller.effectcraft.mime.xml /app/share/mime/packages/ai.storyteller.effectcraft.xml
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index f149e663d..12016f6cd 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -25,7 +25,7 @@ APP_ID=ai.storyteller.effectcraft
 
 SKIP_BUILD=0
 FORMATS="appimage deb rpm tar"
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --formats) FORMATS="$2"; shift 2 ;;
@@ -46,8 +46,8 @@ BASENAME="effectcraft-$VERSION-linux-$ARCH"
 
 echo "==> EffectCraft $VERSION for Linux $ARCH ($FORMATS)"
 
-if [ "$SKIP_BUILD" = 0 ]; then
-  if [ -n "${CROSS_TARGET:-}" ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
+  if [[ -n "${CROSS_TARGET:-}" ]]; then
     (cd "$ROOT" && cargo build --release --locked -p effectcraft -p effectcraft-cli --target "$CROSS_TARGET")
   else
     (cd "$ROOT" && cargo build --release --locked -p effectcraft -p effectcraft-cli)
@@ -79,7 +79,15 @@ if command -v appstreamcli >/dev/null; then
   appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
 fi
 
-has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+has() {
+  local format="$1"
+  case " $FORMATS " in *" $format "*) return 0 ;; *) return 1 ;; esac
+}
+
+# Fails unless FILE ($2) has SHA-256 digest $1.
+verify_sha256() {
+  printf '%s  %s\n' "$1" "$2" | sha256sum -c -
+}
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
 if has tar; then
@@ -103,27 +111,64 @@ fi
 
 # ---- AppImage -----------------------------------------------------------------------------------
 if has appimage; then
+  APPIMAGETOOL_VERSION=1.9.1
+  case "$ARCH" in
+    x86_64) APPIMAGETOOL_SHA256=ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0 ;;
+    aarch64) APPIMAGETOOL_SHA256=f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158 ;;
+    *) APPIMAGETOOL_SHA256="" ;;
+  esac
+  # appimagetool otherwise fetches the unpinned type2-runtime `continuous` build and embeds it.
+  APPIMAGE_RUNTIME_VERSION=20251108
+  case "$ARCH" in
+    x86_64) APPIMAGE_RUNTIME_SHA256=2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d ;;
+    aarch64) APPIMAGE_RUNTIME_SHA256=00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444 ;;
+    *) APPIMAGE_RUNTIME_SHA256="" ;;
+  esac
+  if [[ -z "$APPIMAGE_RUNTIME_SHA256" ]]; then
+    echo "no pinned AppImage runtime for $ARCH; build the AppImage on x86_64 or aarch64" >&2
+    exit 2
+  fi
   APPDIR="$WORK/EffectCraft.AppDir"
   cp -R "$STAGE" "$APPDIR"
-  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
+  # Keep sctk-adwaita's MIT notice in the AppImage.
+  install -Dm644 "$ROOT/NOTICE" "$APPDIR/usr/share/doc/effectcraft/NOTICE"
   ln -s usr/bin/effectcraft "$APPDIR/AppRun"
   cp "$HERE/$APP_ID.desktop" "$APPDIR/$APP_ID.desktop"
   cp "$ROOT/assets/app-icon/hicolor/256x256/apps/$APP_ID.png" "$APPDIR/$APP_ID.png"
   ln -s "$APP_ID.png" "$APPDIR/.DirIcon"
 
   TOOL="${APPIMAGETOOL:-$(command -v appimagetool || true)}"
-  if [ -z "$TOOL" ]; then
-    TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
-    if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
-      chmod +x "$TOOL"
+  if [[ -z "$TOOL" ]]; then
+    if [[ -z "$APPIMAGETOOL_SHA256" ]]; then
+      echo "no pinned appimagetool for $ARCH; set APPIMAGETOOL or put appimagetool on PATH" >&2
+      exit 2
     fi
+    TOOL="$CARGO_TARGET_DIR/appimagetool-$APPIMAGETOOL_VERSION-$ARCH.AppImage"
+    if [[ ! -x "$TOOL" ]]; then
+      download="$TOOL.download"
+      curl --proto '=https' -fsSL -o "$download" \
+        "https://github.com/AppImage/appimagetool/releases/download/$APPIMAGETOOL_VERSION/appimagetool-$ARCH.AppImage"
+      verify_sha256 "$APPIMAGETOOL_SHA256" "$download"
+      chmod 755 "$download"
+      mv "$download" "$TOOL"
+    fi
+    verify_sha256 "$APPIMAGETOOL_SHA256" "$TOOL"
   fi
+  RUNTIME="$CARGO_TARGET_DIR/appimage-runtime-$APPIMAGE_RUNTIME_VERSION-$ARCH"
+  if [[ ! -f "$RUNTIME" ]]; then
+    download="$RUNTIME.download"
+    curl --proto '=https' -fsSL -o "$download" \
+      "https://github.com/AppImage/type2-runtime/releases/download/$APPIMAGE_RUNTIME_VERSION/runtime-$ARCH"
+    verify_sha256 "$APPIMAGE_RUNTIME_SHA256" "$download"
+    mv "$download" "$RUNTIME"
+  fi
+  verify_sha256 "$APPIMAGE_RUNTIME_SHA256" "$RUNTIME"
   # Absolute, because appimagetool runs in $DIST below (CARGO_TARGET_DIR or APPIMAGETOOL may be
   # relative).
   OUT="$(cd "$DIST" && pwd)/$BASENAME.AppImage"
   APPDIR="$(cd "$APPDIR" && pwd)"
   TOOL="$(cd "$(dirname "$TOOL")" && pwd)/$(basename "$TOOL")"
+  RUNTIME="$(cd "$(dirname "$RUNTIME")" && pwd)/$(basename "$RUNTIME")"
   # A .zsync left by an earlier run would hide a missing zsyncmake and describe another file.
   rm -f "$OUT.zsync"
   # Update information: AppImageUpdate, AppImageLauncher and the like read it from the file and
@@ -135,18 +180,18 @@ if has appimage; then
   # Extract-and-run: works without FUSE (containers, CI). The output embeds the static runtime,
   # so users don't need libfuse2 either. With zsyncmake on the host (CI installs the zsync
   # package) appimagetool also writes the .zsync, into its working directory, hence the cd.
-  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT")
+  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream --runtime-file "$RUNTIME" -u "$UPDATE_INFO" "$APPDIR" "$OUT")
   echo "wrote $OUT"
-  if [ -s "$OUT.zsync" ]; then
+  if [[ -s "$OUT.zsync" ]]; then
     echo "wrote $OUT.zsync"
   else
     warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it"
   fi
 fi
 
-if [ -z "${CROSS_TARGET:-}" ]; then
+if [[ -z "${CROSS_TARGET:-}" ]]; then
   "$STAGE/usr/bin/effectcraft-cli" --version
-elif [ -n "${EMULATOR:-}" ]; then
+elif [[ -n "${EMULATOR:-}" ]]; then
   "$EMULATOR" "$STAGE/usr/bin/effectcraft-cli" --version
 fi
 echo "==> done"
diff --git a/packaging/macos/Info.plist.in b/packaging/macos/Info.plist.in
index 3e3b88948..99d8c0444 100644
--- a/packaging/macos/Info.plist.in
+++ b/packaging/macos/Info.plist.in
@@ -6,6 +6,23 @@
 <dict>
   <key>CFBundleDevelopmentRegion</key>
   <string>en</string>
+  <!-- UI translations are embedded in Rust; declare them for AppKit's system dialogs (open and
+       save panels, overwrite confirmation). Keep in sync with the interface languages. -->
+  <key>CFBundleLocalizations</key>
+  <array>
+    <string>en</string>
+    <string>cs</string>
+    <string>de</string>
+    <string>es</string>
+    <string>fr</string>
+    <string>pt-BR</string>
+    <string>ru</string>
+    <string>uk</string>
+    <string>ka</string>
+    <string>ja</string>
+    <string>zh-Hans</string>
+    <string>zh-Hant</string>
+  </array>
   <key>CFBundleDisplayName</key>
   <string>EffectCraft</string>
   <key>CFBundleName</key>
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index e0178b6a3..8e3462cde 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -12,7 +12,7 @@ umask 077
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 
-if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
   warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
   exit 0
 fi
@@ -36,13 +36,13 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS"
 security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
 
 IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
-if [ -z "$IDENTITY" ]; then
+if [[ -z "$IDENTITY" ]]; then
   security find-identity -v -p codesigning "$KEYCHAIN" >&2
   echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
   exit 1
 fi
 echo "Imported signing identity $IDENTITY"
-if [ -n "${GITHUB_ENV:-}" ]; then
+if [[ -n "${GITHUB_ENV:-}" ]]; then
   { echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
 else
   echo "MACOS_SIGN_IDENTITY=$IDENTITY"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 37f81f48e..be0c03aae 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -19,7 +19,7 @@ HERE="$ROOT/packaging/macos"
 
 ARCH=universal
 SKIP_BUILD=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --arch) ARCH="$2"; shift 2 ;;
     --skip-build) SKIP_BUILD=1; shift ;;
@@ -44,9 +44,9 @@ DMG="$DIST/effectcraft-$VERSION-macos-$ARCH.dmg"
 CLI_ZIP="$DIST/effectcraft-cli-$VERSION-macos-$ARCH.zip"
 
 NOTARIZE=0
-if [ "$IDENTITY" = "-" ]; then
+if [[ "$IDENTITY" = "-" ]]; then
   warn "macOS: ad-hoc signing (no MACOS_SIGN_IDENTITY); artifacts are not notarized"
-elif [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+elif [[ -n "${APPLE_ID:-}" ]] && [[ -n "${APPLE_PASSWORD:-}" ]] && [[ -n "${APPLE_TEAM_ID:-}" ]]; then
   NOTARIZE=1
 else
   warn "macOS: APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID incomplete; signed but not notarized"
@@ -55,7 +55,7 @@ fi
 echo "==> EffectCraft $VERSION for macOS ($ARCH), identity: $IDENTITY, notarize: $NOTARIZE"
 
 # ---- build -------------------------------------------------------------------------------------
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
   args=()
   for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
   (cd "$ROOT" && cargo build --release --locked -p effectcraft -p effectcraft-cli "${args[@]}")
@@ -74,12 +74,27 @@ done
 sign() {
   # Hardened runtime + secure timestamp for a real identity; ad-hoc can't be timestamped.
   local ts=(--timestamp)
-  [ "$IDENTITY" = "-" ] && ts=(--timestamp=none)
+  [[ "$IDENTITY" = "-" ]] && ts=(--timestamp=none)
   local kc=()
-  [ -n "${MACOS_KEYCHAIN:-}" ] && kc=(--keychain "$MACOS_KEYCHAIN")
+  [[ -n "${MACOS_KEYCHAIN:-}" ]] && kc=(--keychain "$MACOS_KEYCHAIN")
   codesign --force --sign "$IDENTITY" ${kc[@]+"${kc[@]}"} "${ts[@]}" "$@"
 }
 
+# `stapler staple` and `stapler validate` both fetch the ticket from Apple's CloudKit, and a dropped
+# connection there (NSURLErrorDomain -1005, "Error 68") fails them although notarization worked.
+# Both are idempotent, so retry with a pause; a missing or bad ticket still fails every try.
+stapler_retry() {
+  local try
+  for try in 1 2 3 4; do
+    xcrun stapler "$1" "$2" && return 0
+    [[ "$try" = 4 ]] && break
+    echo "stapler $1 failed (try $try of 4); retrying in $((try * 20)) s" >&2
+    sleep $((try * 20))
+  done
+  echo "error: stapler $1 $(basename "$2") failed 4 times" >&2
+  exit 1
+}
+
 notarize() {
   local file="$1" out id status
   echo "==> notarizing $(basename "$file") (this can take a few minutes)"
@@ -88,8 +103,8 @@ notarize() {
   echo "$out"
   id="$(printf '%s' "$out" | plutil -extract id raw -o - - 2>/dev/null || true)"
   status="$(printf '%s' "$out" | plutil -extract status raw -o - - 2>/dev/null || true)"
-  if [ "$status" != "Accepted" ]; then
-    if [ -n "$id" ]; then
+  if [[ "$status" != "Accepted" ]]; then
+    if [[ -n "$id" ]]; then
       xcrun notarytool log "$id" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" || true
     fi
     echo "error: notarization of $(basename "$file") failed (status: ${status:-unknown})" >&2
@@ -103,6 +118,8 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 # Executable and icon carry the display name (CFBundleExecutable / CFBundleIconFile).
 cp "$WORK/bin/effectcraft" "$APP/Contents/MacOS/EffectCraft"
 cp "$ROOT/assets/app-icon/effectcraft.icns" "$APP/Contents/Resources/EffectCraft.icns"
+# Required embedded-font notices are independent of optional font inputs.
+cp "$ROOT/NOTICE" "$APP/Contents/Resources/NOTICE"
 sed -e "s/@VERSION@/$VERSION/g" -e "s/@SHORT_VERSION@/$SHORT_VERSION/g" \
   -e "s/@BUILD_SHA@/${EFFECTCRAFT_BUILD_SHA:-unknown}/g" \
   "$HERE/Info.plist.in" >"$APP/Contents/Info.plist"
@@ -115,11 +132,11 @@ sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/
 sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP"
 codesign --verify --strict --deep --verbose=2 "$APP"
 
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   ditto -c -k --keepParent "$APP" "$WORK/EffectCraft-notarize.zip"
   notarize "$WORK/EffectCraft-notarize.zip"
-  xcrun stapler staple "$APP"
-  xcrun stapler validate "$APP"
+  stapler_retry staple "$APP"
+  stapler_retry validate "$APP"
   spctl --assess --type execute -vvv "$APP"
 fi
 
@@ -134,7 +151,7 @@ ln -s /Applications "$STAGE/Applications"
 # CI (the shared release workflow doesn't install resvg; a warm cargo cache may hold it): install
 # the pinned version. Locally, say which version to install.
 RESVG_VERSION=0.48.1
-if [ -n "${CI:-}" ] && ! command -v resvg >/dev/null; then
+if [[ -n "${CI:-}" ]] && ! command -v resvg >/dev/null; then
   cargo install resvg --locked --version "$RESVG_VERSION"
 fi
 command -v resvg >/dev/null || { echo "resvg not found (cargo install resvg --locked --version $RESVG_VERSION)" >&2; exit 1; }
@@ -160,7 +177,7 @@ hdiutil_retry() {
     if hdiutil "$@"; then
       return 0
     fi
-    [ "$attempt" = 5 ] && { echo "hdiutil $what failed 5 times" >&2; return 1; }
+    [[ "$attempt" = 5 ]] && { echo "hdiutil $what failed 5 times" >&2; return 1; }
     echo "hdiutil $what failed (attempt $attempt of 5); retrying in $((attempt * 10))s" >&2
     sleep $((attempt * 10))
   done
@@ -178,10 +195,10 @@ if ! codesign --verify --strict --deep --verbose=2 "$MOUNT/EffectCraft.app"; the
   exit 1
 fi
 hdiutil_retry detach detach "$MOUNT" >/dev/null
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   notarize "$DMG"
-  xcrun stapler staple "$DMG"
-  xcrun stapler validate "$DMG"
+  stapler_retry staple "$DMG"
+  stapler_retry validate "$DMG"
   spctl --assess --type open --context context:primary-signature -vvv "$DMG"
 fi
 
@@ -196,7 +213,7 @@ codesign --verify --strict --verbose=2 "$CLI_DIR/effectcraft-cli"
 rm -f "$CLI_ZIP"
 ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"
 # A bare Mach-O can't carry a stapled ticket; Gatekeeper looks the notarization up online.
-if [ "$NOTARIZE" = 1 ]; then notarize "$CLI_ZIP"; fi
+if [[ "$NOTARIZE" = 1 ]]; then notarize "$CLI_ZIP"; fi
 
 "$WORK/bin/effectcraft-cli" --version
 echo "==> done"
diff --git a/packaging/web/README.md b/packaging/web/README.md
index 0a1f56fe8..672d9ad67 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -58,6 +58,19 @@ location /effectcraft/ {
 
 Local test: `python3 -m http.server 8765` inside the folder, then open http://localhost:8765/.
 
+## Startup project (optional)
+
+To choose what the page opens on load, add an `effectcraft-config.json` next to `index.html`:
+
+```json
+{"startup":"empty"}
+```
+
+`"empty"` restores the last visit's project and otherwise starts blank (never the demo); `"demo"`
+always opens the demo project without saving the session (the last visit's project stays); `"last"` (the default) restores the last visit's project and shows
+the demo on a first visit. Serve the file with `Cache-Control: no-cache`. Details:
+[docs/web.md](https://github.com/storytold/effectcraft/blob/main/docs/web.md#startup-project).
+
 ## Embedding in a page (iframe)
 
 ```html
diff --git a/packaging/web/_headers b/packaging/web/_headers
index 013e1cf8a..e59592fb1 100644
--- a/packaging/web/_headers
+++ b/packaging/web/_headers
@@ -12,3 +12,6 @@
 
 /index.html
   Cache-Control: no-cache
+
+/effectcraft-config.json
+  Cache-Control: no-cache
diff --git a/packaging/web/package.sh b/packaging/web/package.sh
index 89d767ea1..dc3aaa907 100755
--- a/packaging/web/package.sh
+++ b/packaging/web/package.sh
@@ -11,10 +11,10 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 HERE="$ROOT/packaging/web"
 
-if [ "${1:-}" != "--skip-build" ]; then
+if [[ "${1:-}" != "--skip-build" ]]; then
   # CI (the shared release workflow installs only trunk): install the wasm-bindgen CLI at the
   # crate's exact version. Locally, `cargo xtask web` says which version to install.
-  if [ -n "${CI:-}" ]; then
+  if [[ -n "${CI:-}" ]]; then
     WASM_BINDGEN_VERSION="$(sed -n 's/^const WASM_BINDGEN: &str = "\(.*\)";$/\1/p' "$ROOT/xtask/src/main.rs")"
     if ! { command -v wasm-bindgen >/dev/null && wasm-bindgen --version | grep -qF "$WASM_BINDGEN_VERSION"; }; then
       cargo install wasm-bindgen-cli --version "$WASM_BINDGEN_VERSION" --locked
@@ -24,7 +24,7 @@ if [ "${1:-}" != "--skip-build" ]; then
 fi
 
 SITE="$CARGO_TARGET_DIR/web/dist"
-[ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
+[[ -f "$SITE/index.html" ]] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
 # Paths must be relative so the site works under any prefix.
 if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
   echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
diff --git a/packaging/windows/INSTALLATION.md b/packaging/windows/INSTALLATION.md
new file mode 100644
index 000000000..982a5b420
--- /dev/null
+++ b/packaging/windows/INSTALLATION.md
@@ -0,0 +1,35 @@
+# Windows installation policy checks
+
+New installations default to the current account under `Programs\ArtCraft\<App>`.
+The first setup page offers installation for everyone. Scope is selected before duplicate
+checks and directory costing. An update uses the existing context's remembered exact folder;
+`INSTALLFOLDER` supplied explicitly is never replaced. It is a secure MSI property so the
+chosen folder reaches the elevated installer. Silent machine updates pass `ALLUSERS=1`.
+A cross-context copy is refused; changing context means uninstalling the old copy first.
+
+App registration follows the selected context. Existing optional shortcuts and file-handler
+choices stay app-owned. No new cleanup operation or model/settings migration is introduced.
+Packaged resources remain package-owned; separately downloaded shared models are not caches
+and are outside this installer's ownership.
+
+## Repeatable metadata tests
+
+On Windows with WiX 5.0.2 and its matching UI/Util extensions:
+
+```powershell
+./packaging/windows/test-install-policy.ps1 -OutputDirectory ./target/install-policy-tests
+```
+
+The script builds x64, x86 and arm64 packages with deliberately non-executable payloads. It
+uses the actual package source and compiled database. A safe Windows Installer session checks
+24 scope/registration/maintenance cases, remembered and explicit custom folders, sequencing,
+upgrade identity and the original registration inventory recorded in `install-policy.json`.
+The release packaging script runs the compiled checker before signing. Packaging CI runs the
+small fixture builds without compiling the Rust application.
+
+Never install or distribute the `NOT-INSTALLABLE.msi` fixtures as an app. Passing these checks
+does not prove real installation, elevation, legacy-version upgrades, registry writes, optional
+shortcut/menu behaviour, cancellation, rollback or uninstall. Those still require the real
+payload in an authorised clean Windows test environment. Cross-architecture metadata is not
+execution evidence on those architectures. Existing open installer/association PRs must be
+reconciled before publication. Nothing here changes macOS/Linux native packaging conventions.
diff --git a/packaging/windows/check-install-policy.ps1 b/packaging/windows/check-install-policy.ps1
new file mode 100644
index 000000000..5463c0083
--- /dev/null
+++ b/packaging/windows/check-install-policy.ps1
@@ -0,0 +1,370 @@
+<#
+.SYNOPSIS
+  Check the compiled installation policy without installing any product.
+.DESCRIPTION
+  Uses Windows Installer's safe session (OpenPackage option 1). Only property-setting custom
+  actions are exercised. No AppSearch, install, repair, removal or file-writing action runs.
+#>
+param([Parameter(Mandatory = $true)] [string] $MsiPath)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+$policy = Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'install-policy.json') | ConvertFrom-Json
+function Read-Rows($Database, [string] $Sql, [int] $Columns) {
+  $view = $Database.OpenView($Sql)
+  try {
+    [void]$view.Execute()
+    while ($null -ne ($record = $view.Fetch())) {
+      try {
+        $values = @(for ($i = 1; $i -le $Columns; $i++) {
+          $record.GetType().InvokeMember('StringData', 'GetProperty', $null, $record, @($i))
+        })
+        ,$values
+      } finally { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($record) }
+    }
+  } finally {
+    [void]$view.Close()
+    [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($view)
+  }
+}
+function Set-SessionProperty($Session, [string] $Name, [string] $Value) {
+  [void]$Session.GetType().InvokeMember('Property', 'SetProperty', $null, $Session, @($Name, $Value))
+}
+function Get-SessionProperty($Session, [string] $Name) {
+  $Session.GetType().InvokeMember('Property', 'GetProperty', $null, $Session, @($Name))
+}
+function Get-PackageTemplate($Database) {
+  # Summary information property 7 is the platform: "Intel;1033", "x64;1033" or "Arm64;1033".
+  $summary = $Database.GetType().InvokeMember('SummaryInformation', 'GetProperty', $null, $Database, @(0))
+  try { [string]$summary.GetType().InvokeMember('Property', 'GetProperty', $null, $summary, @(7)) }
+  finally { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($summary) }
+}
+$installer = $null; $database = $null; $session = $null
+try {
+  $installer = New-Object -ComObject WindowsInstaller.Installer
+  $file = (Resolve-Path -LiteralPath $MsiPath).Path
+  $database = $installer.OpenDatabase($file, 0)
+  $session = $installer.OpenPackage($file, 1)
+  $properties = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Property`, `Value` FROM `Property`' 2)) { $properties[$row[0]] = $row[1] }
+  $secureProperties = @($properties['SecureCustomProperties'] -split ';')
+  if ('INSTALLFOLDER' -notin $secureProperties) {
+    throw 'The selected installation folder must survive elevation (secure INSTALLFOLDER).'
+  }
+  if ($policy.mode -eq 'perUser') {
+    if ($properties.ContainsKey('ALLUSERS')) { throw 'Launcher must remain per-user; machine self-update is not part of this change.' }
+    if ($properties['UpgradeCode'].Trim('{}') -ne $policy.upgradeCode) { throw 'Launcher upgrade identity changed.' }
+    $dirs = @{}
+    foreach ($row in (Read-Rows $database 'SELECT `Directory`, `Directory_Parent`, `DefaultDir` FROM `Directory`' 3)) { $dirs[$row[0]] = @($row[1],$row[2]) }
+    if ($dirs['INSTALLFOLDER'][0] -ne 'CraftSuiteFolder' -or $dirs['CraftSuiteFolder'][1] -ne 'ArtCraft' -or
+        $dirs['CraftSuiteFolder'][0] -ne 'LocalProgramsFolder' -or $dirs['LocalProgramsFolder'][0] -ne 'LocalAppDataFolder') {
+      throw 'Launcher new-install folder must be under the per-user ArtCraft suite root.'
+    }
+    foreach ($explicit in @('', 'F:\Chosen exact launcher')) {
+      Set-SessionProperty $session 'PREVIOUSINSTALLFOLDER' 'E:\Existing exact launcher'
+      Set-SessionProperty $session 'INSTALLFOLDER' $explicit
+      $row = @(Read-Rows $database 'SELECT `Condition` FROM `InstallUISequence` WHERE `Action` = ''CraftRestoreLauncherFolder''' 1)[0]
+      if ($session.EvaluateCondition($row[0]) -eq 1) {
+        if ($session.DoAction('CraftRestoreLauncherFolder') -ne 1) { throw 'Launcher restore action failed.' }
+      }
+      $expected = if ($explicit) { $explicit } else { 'E:\Existing exact launcher' }
+      if ((Get-SessionProperty $session 'INSTALLFOLDER') -ne $expected) { throw 'Launcher custom or existing path was lost.' }
+    }
+    $rows = @(Read-Rows $database 'SELECT `Root`, `Key`, `Name`, `Value` FROM `Registry`' 4)
+    if (@($rows | Where-Object { $_[0] -ne '1' }).Count) { throw 'Launcher registration must stay under the current account.' }
+    foreach ($entry in $policy.registry) {
+      if (@($rows | Where-Object { $_[0] -eq $entry[0] -and $_[1] -eq $entry[1] -and $_[2] -eq $entry[2] -and $_[3] -eq $entry[3] }).Count -ne 1) {
+        throw 'Launcher registration or shortcut preference changed unexpectedly.'
+      }
+    }
+    Write-Output 'PASS ArtCraft Launcher: per-user scope, suite folder, remembered/custom paths and existing registration. No installation performed.'
+    return
+  }
+  if ($properties['ALLUSERS'] -ne '2' -or $properties['MSIINSTALLPERUSER'] -ne '1') {
+    throw 'Policy regression: new packages must default to the per-user dual-scope context.'
+  }
+  if ($properties['UpgradeCode'].Trim('{}') -ne $policy.upgradeCode) { throw 'The existing upgrade identity must not change.' }
+  $directories = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Directory`, `Directory_Parent`, `DefaultDir` FROM `Directory`' 3)) {
+    $directories[$row[0]] = @($row[1], $row[2])
+  }
+  if ($directories['INSTALLFOLDER'][0] -ne 'CraftSuiteFolder' -or
+      $directories['CraftSuiteFolder'][1] -ne 'ArtCraft') { throw 'Expected the app under the ArtCraft suite folder.' }
+  $programs = $directories['CraftSuiteFolder'][0]
+  if ($programs -eq 'ProgramFiles6432Folder') { $programs = $directories[$programs][0] }
+  if ($programs -notin 'ProgramFilesFolder', 'ProgramFiles64Folder') {
+    throw 'Use Windows Installer native folder redirection, not a hard-coded profile path.'
+  }
+  $guards = @(Read-Rows $database 'SELECT `Condition`, `Description` FROM `LaunchCondition`' 2 |
+    Where-Object { $_[0] -match 'CRAFT_(USER|MACHINE)_DIR' })
+  if ($guards.Count -ne 2) { throw 'Expected both duplicate-installation guards.' }
+  $cases = 0
+  foreach ($scope in @('', '2', '1')) {
+    foreach ($user in @('', 'D:\Existing user app')) {
+      foreach ($machine in @('', 'E:\Existing machine app')) {
+        foreach ($installed in @('', '1')) {
+          Set-SessionProperty $session 'ALLUSERS' $scope
+          Set-SessionProperty $session 'Installed' $installed
+          Set-SessionProperty $session 'CRAFT_USER_DIR' $user
+          Set-SessionProperty $session 'CRAFT_MACHINE_DIR' $machine
+          $allowed = $true
+          foreach ($guard in $guards) {
+            $value = $session.EvaluateCondition($guard[0])
+            if ($value -notin 0, 1) { throw 'Invalid duplicate guard.' }
+            if ($value -eq 0) { $allowed = $false }
+          }
+          $opposite = if ($scope -eq '1') { $user } else { $machine }
+          $expected = [bool]$installed -or -not [bool]$opposite
+          if ($allowed -ne $expected) { throw "Scope regression: ALLUSERS='$scope', user=$([bool]$user), machine=$([bool]$machine), maintenance=$([bool]$installed)." }
+          $cases++
+        }
+      }
+    }
+  }
+  # Execute the actual authored type-51 actions in a safe session, not copied resolver logic.
+  foreach ($scope in @('', '2', '1')) {
+    foreach ($explicit in @('', 'F:\Chosen exact app')) {
+      Set-SessionProperty $session 'ALLUSERS' $scope
+      Set-SessionProperty $session 'INSTALLFOLDER' $explicit
+      Set-SessionProperty $session 'CRAFT_USER_DIR' 'D:\Existing user app'
+      Set-SessionProperty $session 'CRAFT_MACHINE_DIR' 'E:\Existing machine app'
+      $action = if ($scope -eq '1') { 'CraftRestoreMachineFolder' } else { 'CraftRestoreUserFolder' }
+      # Evaluate the compiled condition, so the test exercises it instead of calling the action directly.
+      $restore = @(Read-Rows $database ('SELECT `Condition` FROM `InstallExecuteSequence` WHERE `Action` = ''{0}''' -f $action) 1)[0]
+      $selected = $session.EvaluateCondition($restore[0]) -eq 1
+      if ($selected -eq [bool]$explicit) { throw "$action must run only when no folder was supplied (condition: $($restore[0]))." }
+      if ($selected -and $session.DoAction($action) -ne 1) { throw 'Remembered-folder property action failed.' }
+      $expected = if ($explicit) { $explicit } elseif ($scope -eq '1') { 'E:\Existing machine app' } else { 'D:\Existing user app' }
+      if ((Get-SessionProperty $session 'INSTALLFOLDER') -ne $expected) { throw 'Custom or remembered folder was not preserved.' }
+    }
+  }
+  $ui = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Action`, `Sequence` FROM `InstallUISequence`' 2)) { $ui[$row[0]] = [int]$row[1] }
+  if (-not ($ui['AppSearch'] -lt $ui['CraftPreferMachineScope'] -and
+      $ui['CraftPreferMachineScope'] -lt $ui['CraftScopeDlg'] -and
+      $ui['CraftScopeDlg'] -lt $ui['FindRelatedProducts'] -and
+      $ui['FindRelatedProducts'] -lt $ui['LaunchConditions'] -and
+      $ui['CraftScopeDlg'] -lt $ui['CraftRestoreUserFolder'] -and $ui['CraftRestoreUserFolder'] -lt $ui['CostInitialize'] -and
+      $ui['CraftScopeDlg'] -lt $ui['CraftRestoreMachineFolder'] -and $ui['CraftRestoreMachineFolder'] -lt $ui['CostInitialize'])) {
+    throw 'Scope must be chosen after AppSearch and before FindRelatedProducts, launch checks and costing.'
+  }
+  # Windows Installer resolves Program Files for the context it started in, before the wizard's scope choice.
+  # The wizard therefore sets the new-install folder itself, and only in the wizard.
+  $defaults = @(Read-Rows $database 'SELECT `Action`, `Sequence`, `Condition` FROM `InstallUISequence`' 3 | Where-Object { $_[0] -like 'CraftDefault*' })
+  if ($defaults.Count -lt 2) { throw 'The wizard must set the new-install folder after the scope page; Program Files is resolved before the choice.' }
+  foreach ($row in $defaults) {
+    if (-not ($ui['CraftScopeDlg'] -lt [int]$row[1] -and [int]$row[1] -lt $ui['CostInitialize'])) { throw "$($row[0]) must run after the scope page and before costing." }
+  }
+  if (@(Read-Rows $database 'SELECT `Action` FROM `InstallExecuteSequence`' 1 | Where-Object { $_[0] -like 'CraftDefault*' }).Count) {
+    throw 'Silent installs must not use the wizard-only default folder actions.'
+  }
+  # The machine default comes from the environment of the package architecture, not from a folder name.
+  # x86 packages use Program Files (x86) on 64-bit Windows; x64 and Arm64 packages use the 64-bit root.
+  $machineRoot = if ((Get-PackageTemplate $database) -match '^Intel') {
+    if (Get-SessionProperty $session 'VersionNT64') { ${env:ProgramFiles(x86)} } else { $env:ProgramFiles }
+  } elseif ($env:ProgramW6432) { $env:ProgramW6432 } else { $env:ProgramFiles }
+  $machineFolder = (Join-Path $machineRoot "ArtCraft\$($policy.name)") + '\'
+  foreach ($scope in @('1', '')) {
+    Set-SessionProperty $session 'ALLUSERS' $scope
+    Set-SessionProperty $session 'INSTALLFOLDER' ''
+    Set-SessionProperty $session 'CRAFT_MACHINE_DIR' ''
+    Set-SessionProperty $session 'CRAFT_USER_DIR' ''
+    foreach ($row in @($defaults | Sort-Object { [int]$_[1] })) {
+      if ($session.EvaluateCondition($row[2]) -eq 1 -and $session.DoAction($row[0]) -ne 1) { throw "$($row[0]) failed." }
+    }
+    $folder = Get-SessionProperty $session 'INSTALLFOLDER'
+    $wanted = if ($scope -eq '1') { $machineFolder } else { (Join-Path $env:LOCALAPPDATA "Programs\ArtCraft\$($policy.name)") + '\' }
+    if ($folder -ine $wanted) { throw "Wizard default folder for ALLUSERS='$scope' is '$folder', expected '$wanted'." }
+  }
+  # Replay the wizard's compiled folder actions in sequence order, as the full UI runs them. A remembered
+  # folder must win over the new-install default, and a folder the user typed must survive both.
+  $uiFolderActions = @(Read-Rows $database 'SELECT `Action`, `Sequence`, `Condition` FROM `InstallUISequence`' 3 |
+    Where-Object { $_[0] -match '^Craft(Restore|Default)' } | Sort-Object { [int]$_[1] })
+  $userDefault = (Join-Path $env:LOCALAPPDATA "Programs\ArtCraft\$($policy.name)") + '\'
+  foreach ($case in @(
+      @('1', 'D:\Remembered user app', 'E:\Remembered machine app', '', 'E:\Remembered machine app'),
+      @('', 'D:\Remembered user app', 'E:\Remembered machine app', '', 'D:\Remembered user app'),
+      @('1', '', '', '', $machineFolder),
+      @('', '', '', '', $userDefault),
+      @('1', 'D:\Remembered user app', 'E:\Remembered machine app', 'F:\Chosen exact app', 'F:\Chosen exact app'))) {
+    Set-SessionProperty $session 'Installed' ''
+    Set-SessionProperty $session 'ALLUSERS' $case[0]
+    Set-SessionProperty $session 'CRAFT_USER_DIR' $case[1]
+    Set-SessionProperty $session 'CRAFT_MACHINE_DIR' $case[2]
+    Set-SessionProperty $session 'INSTALLFOLDER' $case[3]
+    foreach ($row in $uiFolderActions) {
+      if ($session.EvaluateCondition($row[2]) -eq 1 -and $session.DoAction($row[0]) -ne 1) { throw "$($row[0]) failed." }
+    }
+    $folder = Get-SessionProperty $session 'INSTALLFOLDER'
+    if ($folder -ine $case[4]) { throw "Full-UI folder for ALLUSERS='$($case[0])' is '$folder', expected '$($case[4])'." }
+  }
+  $execute = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Action`, `Sequence` FROM `InstallExecuteSequence`' 2)) { $execute[$row[0]] = [int]$row[1] }
+  foreach ($action in @('CraftRestoreUserFolder','CraftRestoreMachineFolder')) {
+    if (-not ($execute['AppSearch'] -lt $execute[$action] -and $execute[$action] -lt $execute['CostInitialize'])) {
+      throw 'Silent updates must restore the folder before directory costing.'
+    }
+  }
+  foreach ($resolver in @('CraftUFromLegacyExe','CraftMFromLegacyExe')) {
+    if (-not ($execute['AppSearch'] -lt $execute[$resolver] -and $execute[$resolver] -lt $execute['LaunchConditions'])) {
+      throw 'Both legacy folder resolvers must run after AppSearch and before the launch checks.'
+    }
+  }
+  # AppSearch itself never runs in this safe session, so check the compiled searches and then run the
+  # property actions that turn the search results into the remembered folder, once per scope.
+  $appSearch = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Property`, `Signature_` FROM `AppSearch`' 2)) { $appSearch[$row[0]] = $row[1] }
+  $locators = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Signature_`, `Root`, `Key`, `Name`, `Type` FROM `RegLocator`' 5)) { $locators[$row[0]] = $row }
+  $appPaths = '^Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\[^\\]+\.exe$'
+  # Suffix, how to match the key, key, value name, locator type (2 = raw value, 1 = file; the 64-bit flag is masked off).
+  $searchContract = @(
+    @('DIR',       'exact', "Software\$($policy.name)", 'InstallDir',    '2'),
+    @('FOLDER',    'exact', "Software\$($policy.name)", 'InstallFolder', '2'),
+    @('PATH',      'regex', $appPaths,                  'Path',          '2'),
+    @('EXEFOLDER', 'regex', $appPaths,                  '',              '1'),
+    @('EXE',       'regex', $appPaths,                  '',              '1'))
+  $resolverCases = @(
+    @{ name = 'every record, DIR wins';        dir = 'D:\Dir\'; folder = 'D:\Folder\'; path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Dir\' },
+    @{ name = 'FOLDER wins without DIR';       dir = '';        folder = 'D:\Folder\'; path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Folder\' },
+    @{ name = 'PATH wins without DIR, FOLDER'; dir = '';        folder = '';           path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Path\' },
+    @{ name = 'legacy exe folder is last';     dir = '';        folder = '';           path = '';         exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Exe\' },
+    @{ name = 'legacy folder needs the exe';   dir = '';        folder = '';           path = '';         exeFolder = 'D:\Exe\'; exe = '';               existing = '';            expected = '' },
+    @{ name = 'a preset folder is kept';       dir = 'D:\Dir\'; folder = 'D:\Folder\'; path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = 'P:\Preset\'; expected = 'P:\Preset\' })
+  foreach ($scopeSpec in @(@('U', '1', 'CRAFT_USER_DIR'), @('M', '2', 'CRAFT_MACHINE_DIR'))) {
+    $letter = $scopeSpec[0]; $target = $scopeSpec[2]
+    foreach ($item in $searchContract) {
+      $property = "CRAFT_${letter}_$($item[0])"
+      $locator = if ($appSearch.ContainsKey($property)) { $locators[$appSearch[$property]] } else { $null }
+      $keyOk = $null -ne $locator -and $(if ($item[1] -eq 'exact') { $locator[2] -eq $item[2] } else { $locator[2] -match $item[2] })
+      if (-not $keyOk -or $locator[1] -ne $scopeSpec[1] -or $locator[3] -ne $item[3] -or ([int]$locator[4] -band 3) -ne [int]$item[4]) {
+        throw "Compiled search for $property is missing or points at the wrong registry location."
+      }
+    }
+    $chain = @(Read-Rows $database 'SELECT `Action`, `Sequence`, `Condition` FROM `InstallExecuteSequence`' 3 |
+      Where-Object { $_[0] -match "^Craft${letter}From" } | Sort-Object { [int]$_[1] })
+    $order = @($chain | ForEach-Object { $_[0] }) -join ','
+    if ($order -ne "Craft${letter}FromDIR,Craft${letter}FromFOLDER,Craft${letter}FromPATH,Craft${letter}FromLegacyExe") {
+      throw "Remembered-folder resolvers for scope $letter run in the wrong order: $order"
+    }
+    foreach ($case in $resolverCases) {
+      Set-SessionProperty $session $target $case.existing
+      Set-SessionProperty $session "CRAFT_${letter}_DIR" $case.dir
+      Set-SessionProperty $session "CRAFT_${letter}_FOLDER" $case.folder
+      Set-SessionProperty $session "CRAFT_${letter}_PATH" $case.path
+      Set-SessionProperty $session "CRAFT_${letter}_EXEFOLDER" $case.exeFolder
+      Set-SessionProperty $session "CRAFT_${letter}_EXE" $case.exe
+      foreach ($row in $chain) {
+        if ($session.EvaluateCondition($row[2]) -eq 1 -and $session.DoAction($row[0]) -ne 1) { throw "$($row[0]) failed." }
+      }
+      $got = Get-SessionProperty $session $target
+      if ($got -ne $case.expected) { throw "Resolver chain for scope $letter, case '$($case.name)': got '$got', expected '$($case.expected)'." }
+    }
+  }
+  # Switching the first-page choice must reset BOTH properties, including a back-and-forth change.
+  $events = @(Read-Rows $database 'SELECT `Event`, `Argument`, `Condition`, `Ordering` FROM `ControlEvent` WHERE `Dialog_` = ''CraftScopeDlg'' AND `Control_` = ''Next'' ORDER BY `Ordering`' 4)
+  # Model the full-UI upgrade entry with an existing machine-wide copy. Run
+  # the actual preference action, then the compiled Next events before discovery.
+  Set-SessionProperty $session 'ALLUSERS' '2'
+  Set-SessionProperty $session 'CRAFT_SCOPE' 'user'
+  Set-SessionProperty $session 'CRAFT_USER_DIR' ''
+  Set-SessionProperty $session 'CRAFT_MACHINE_DIR' 'E:\Existing machine app'
+  $preference = @(Read-Rows $database 'SELECT `Condition` FROM `InstallUISequence` WHERE `Action` = ''CraftPreferMachineScope''' 1)[0]
+  if ($session.EvaluateCondition($preference[0]) -ne 1 -or $session.DoAction('CraftPreferMachineScope') -ne 1 -or
+      (Get-SessionProperty $session 'CRAFT_SCOPE') -ne 'machine') {
+    throw 'Full-UI machine upgrades must initially select the existing machine context.'
+  }
+  foreach ($choice in @('machine','user','machine','user')) {
+    Set-SessionProperty $session 'CRAFT_SCOPE' $choice
+    foreach ($event in $events) {
+      if ($event[0] -notmatch '^\[([^\]]+)\]$') { continue }
+      $property = $Matches[1]
+      if ($session.EvaluateCondition($event[2]) -eq 1) {
+        Set-SessionProperty $session $property $(if ($event[1] -eq '{}') { '' } else { $event[1] })
+      }
+    }
+    $allUsers = Get-SessionProperty $session 'ALLUSERS'
+    $perUser = Get-SessionProperty $session 'MSIINSTALLPERUSER'
+    if (($choice -eq 'machine' -and ($allUsers -ne '1' -or $perUser)) -or
+        ($choice -eq 'user' -and ($allUsers -or $perUser -ne '1'))) {
+      throw 'Scope selector does not reset the requested installation context.'
+    }
+  }
+  $actions = @(Read-Rows $database 'SELECT `Action`, `Source`, `Target`, `Type` FROM `CustomAction`' 4)
+  $savedOptions = @($actions | Where-Object { $_[0] -match '^CraftLoadOption[0-9]+M$' })
+  foreach ($option in $savedOptions) {
+    if ([int]$option[3] -ne 51) { throw 'Saved-option test may run only property-setting actions.' }
+    $number = [regex]::Match($option[0], '[0-9]+').Value
+    foreach ($scope in @('2','1')) {
+      Set-SessionProperty $session 'ALLUSERS' $scope
+      Set-SessionProperty $session "CRAFT_OPTION_${number}_M" 'saved-machine-choice'
+      Set-SessionProperty $session "CRAFT_OPTION_${number}_U" 'saved-user-choice'
+      Set-SessionProperty $session $option[1] ''
+      $action = "CraftLoadOption$number" + $(if ($scope -eq '1') { 'M' } else { 'U' })
+      if ($session.DoAction($action) -ne 1) { throw 'Saved-option property action failed.' }
+      $expected = if ($scope -eq '1') { 'saved-machine-choice' } else { 'saved-user-choice' }
+      if ((Get-SessionProperty $session $option[1]) -ne $expected) { throw 'Saved installer choices leaked across contexts.' }
+    }
+  }
+  # Follow the compiled control conditions, not the source's intended appearance.
+  $controls = @(Read-Rows $database 'SELECT `Dialog_`, `Control`, `Type`, `Attributes`, `Text` FROM `Control`' 5)
+  $conditions = @()
+  if (@(Read-Rows $database 'SELECT `Name` FROM `_Tables` WHERE `Name` = ''ControlCondition''' 1).Count) {
+    $conditions = @(Read-Rows $database 'SELECT `Dialog_`, `Control_`, `Action`, `Condition` FROM `ControlCondition`' 4)
+  }
+  function Test-ControlVisible($Control) {
+    $visible = ([int]$Control[3] -band 1) -ne 0
+    foreach ($condition in $conditions) {
+      if ($condition[0] -eq $Control[0] -and $condition[1] -eq $Control[1] -and $session.EvaluateCondition($condition[3]) -eq 1) {
+        if ($condition[2] -eq 'Show') { $visible = $true }
+        if ($condition[2] -eq 'Hide') { $visible = $false }
+      }
+    }
+    return $visible
+  }
+  foreach ($button in @($controls | Where-Object { $_[0] -in 'InstallWelcome','InstallMaintenance','DesktopShortcutDlg' -and ([int]$_[3] -band 8388608) -ne 0 })) {
+    $plain = @($controls | Where-Object { $_[0] -eq $button[0] -and $_[1] -eq ($button[1] + 'User') })
+    if ($plain.Count -ne 1 -or ([int]$plain[0][3] -band 8388608)) { throw 'Scope-aware buttons need an unshielded per-user counterpart.' }
+    foreach ($scope in @('', '2', '1')) {
+      Set-SessionProperty $session 'ALLUSERS' $scope
+      if ((Test-ControlVisible $button) -ne ($scope -eq '1') -or (Test-ControlVisible $plain[0]) -ne ($scope -ne '1')) {
+        throw 'The elevation shield must follow the selected scope.'
+      }
+    }
+    $dialog = $button[0]; $shieldId = $button[1]; $plainId = $plain[0][1]
+    $shieldEvents = @(Read-Rows $database "SELECT ``Event``, ``Argument``, ``Condition``, ``Ordering`` FROM ``ControlEvent`` WHERE ``Dialog_`` = '$dialog' AND ``Control_`` = '$shieldId' ORDER BY ``Ordering``" 4 | ForEach-Object { $_ -join '|' })
+    $plainEvents = @(Read-Rows $database "SELECT ``Event``, ``Argument``, ``Condition``, ``Ordering`` FROM ``ControlEvent`` WHERE ``Dialog_`` = '$dialog' AND ``Control_`` = '$plainId' ORDER BY ``Ordering``" 4 | ForEach-Object { $_ -join '|' })
+    if (($shieldEvents -join "`n") -ne ($plainEvents -join "`n")) { throw 'Per-user and machine buttons must perform the same operation.' }
+  }
+  foreach ($scope in @('', '2', '1')) {
+    Set-SessionProperty $session 'ALLUSERS' $scope
+    foreach ($text in @($controls | Where-Object { $_[4] -like '*for all users*' })) {
+      if ((Test-ControlVisible $text) -ne ($scope -eq '1')) { throw 'The welcome-page scope text must follow the selected scope.' }
+    }
+  }
+  if ($policy.id -in 'deckcraft','filmcraft','soundcraft') {
+    foreach ($route in @(@('WelcomeDlg','Next','InstallDirDlg'),@('InstallDirDlg','Back','WelcomeDlg'))) {
+      $dialog = $route[0]; $control = $route[1]
+      $routes = @(Read-Rows $database "SELECT ``Argument``, ``Condition`` FROM ``ControlEvent`` WHERE ``Dialog_`` = '$dialog' AND ``Control_`` = '$control' AND ``Event`` = 'NewDialog' ORDER BY ``Ordering``" 2)
+      Set-SessionProperty $session 'Installed' ''
+      $destination = ''
+      foreach ($event in $routes) { if ($session.EvaluateCondition($event[1]) -eq 1) { $destination = $event[0] } }
+      if ($destination -ne $route[2]) { throw 'Skipping the licence page must work in both navigation directions.' }
+    }
+  }
+  $registry = @(Read-Rows $database 'SELECT `Root`, `Key`, `Name`, `Value` FROM `Registry`' 4)
+  if (@($registry | Where-Object { $_[0] -in '1', '2' }).Count) { throw 'Registration must follow the selected context, not force HKCU or HKLM.' }
+  if (@($registry | Where-Object { $_[0] -eq '0' -and $_[1] -match '^Software\\Classes(\\|$)' }).Count) {
+    throw 'HKCR keys must be relative to Classes.'
+  }
+  foreach ($entry in $policy.registry) {
+    $found = @($registry | Where-Object { $_[0] -eq $entry[0] -and $_[1] -eq $entry[1] -and $_[2] -eq $entry[2] -and $_[3] -eq $entry[3] })
+    if ($found.Count -ne 1) { throw "Lost or changed registration: $($entry[1]) / $($entry[2])" }
+  }
+  $installDir = @($registry | Where-Object { $_[0] -eq '-1' -and $_[1] -eq "Software\$($policy.name)" -and $_[2] -eq 'InstallDir' -and $_[3] -eq '[INSTALLFOLDER]' })
+  if ($installDir.Count -ne 1) { throw 'A context-sensitive installation-folder record is required.' }
+  Write-Output "PASS $($policy.name): $cases scope cases, folder preservation, action sequencing and registry contract. No installation performed."
+} finally {
+  foreach ($com in @($session, $database, $installer)) {
+    if ($null -ne $com) { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($com) }
+  }
+}
diff --git a/packaging/windows/effectcraft.wxs b/packaging/windows/effectcraft.wxs
index 00b0c5d6a..f330ca061 100644
--- a/packaging/windows/effectcraft.wxs
+++ b/packaging/windows/effectcraft.wxs
@@ -1,26 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--
-  EffectCraft MSI (WiX Toolset v5: `dotnet tool install -g wix`). Built by package.ps1:
-
-    wix build effectcraft.wxs installer-ui.wxs -arch x64 -d Version=1.2.3 -d BinDir=... -d IconPath=... -o out.msi
-
-  Per-machine install into Program Files (or a folder the user picks), a Start Menu shortcut and,
-  unless DESKTOPSHORTCUT=0 (the wizard's "Create a desktop shortcut" box), a desktop shortcut.
--->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
-  <Package
-      Name="EffectCraft"
-      Manufacturer="Learning Machines LLC"
-      Version="$(var.Version)"
-      UpgradeCode="AACA8593-C6ED-40A8-BA6C-CB325D8529F9"
-      Scope="perMachine"
-      Compressed="yes"
-      Language="1033">
+  <Package Name="EffectCraft" Manufacturer="Learning Machines LLC" Version="$(var.Version)" UpgradeCode="AACA8593-C6ED-40A8-BA6C-CB325D8529F9" Scope="perUserOrMachine" Compressed="yes" Language="1033">
     <SummaryInformation Description="EffectCraft motion graphics and visual effects" Manufacturer="Learning Machines LLC" />
+    <?include $(sys.SOURCEFILEDIR)install-policy.wxi?>
     <!-- Same-version upgrades let successive pre-releases of one X.Y.Z replace each other
          (MSI versions are numeric, so 1.2.3-rc.1 and 1.2.3-rc.2 are both 1.2.3). -->
-    <MajorUpgrade AllowSameVersionUpgrades="yes"
-        DowngradeErrorMessage="A newer version of EffectCraft is already installed." />
+    <MajorUpgrade AllowSameVersionUpgrades="yes" DowngradeErrorMessage="A newer version of EffectCraft is already installed." />
     <MediaTemplate EmbedCab="yes" CompressionLevel="high" />
     <!-- The setup wizard (installer-ui.wxs): pick the folder on a fresh install. -->
     <UIRef Id="EffectcraftUI" />
@@ -36,32 +21,24 @@
          could be put elsewhere with INSTALLFOLDER=...) the folder of the effectcraft.exe that App Paths names. A
          "file" search with no FileSearch inside yields that file's folder. A folder passed on the
          command line (INSTALLFOLDER=...) wins. -->
-    <Property Id="INSTALLFOLDER" Secure="yes" />
     <Property Id="PREVIOUSINSTALLFOLDER" Secure="yes">
-      <RegistrySearch Id="PreviousInstallFolder" Root="HKLM" Type="directory"
-          Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Name="Path" />
+      <RegistrySearch Id="PreviousInstallFolder" Root="HKLM" Type="directory" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Name="Path" />
     </Property>
     <Property Id="PREVIOUSEXEFOLDER" Secure="yes">
-      <RegistrySearch Id="PreviousExeFolder" Root="HKLM" Type="file"
-          Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" />
+      <RegistrySearch Id="PreviousExeFolder" Root="HKLM" Type="file" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" />
     </Property>
-    <SetProperty Id="INSTALLFOLDER" Value="[PREVIOUSINSTALLFOLDER]" After="AppSearch" Sequence="both"
-        Condition="PREVIOUSINSTALLFOLDER AND NOT INSTALLFOLDER" />
-    <SetProperty Id="INSTALLFOLDER" Action="SetINSTALLFOLDERFromExe" Value="[PREVIOUSEXEFOLDER]"
-        After="SetINSTALLFOLDER" Sequence="both" Condition="PREVIOUSEXEFOLDER AND NOT INSTALLFOLDER" />
-
     <!-- The desktop shortcut: on by default for a fresh install (a box in the wizard, or
          DESKTOPSHORTCUT=0 silently); an upgrade keeps what the installed copy chose, and adds none
          to an install from before this option. -->
     <Property Id="DESKTOPSHORTCUT" Value="1" Secure="yes" />
     <Property Id="PREVIOUSDESKTOPSHORTCUT" Secure="yes">
-      <RegistrySearch Id="PreviousDesktopShortcut" Root="HKLM" Type="raw" Key="Software\EffectCraft" Name="DesktopShortcut" />
-    </Property>
-    <SetProperty Id="DESKTOPSHORTCUT" Value="[PREVIOUSDESKTOPSHORTCUT]" After="SetINSTALLFOLDERFromExe" Sequence="both"
-        Condition="WIX_UPGRADE_DETECTED" />
+      </Property>
+    <SetProperty Id="DESKTOPSHORTCUT" Value="[PREVIOUSDESKTOPSHORTCUT]" After="CraftLoadOption1U" Sequence="both" Condition="WIX_UPGRADE_DETECTED" />
 
     <StandardDirectory Id="ProgramFiles6432Folder">
-      <Directory Id="INSTALLFOLDER" Name="EffectCraft" />
+      <Directory Id="CraftSuiteFolder" Name="ArtCraft">
+        <Directory Id="INSTALLFOLDER" Name="EffectCraft" />
+      </Directory>
     </StandardDirectory>
     <StandardDirectory Id="ProgramMenuFolder" />
     <StandardDirectory Id="DesktopFolder" />
@@ -69,21 +46,25 @@
     <Feature Id="Main" Title="EffectCraft" Level="1">
       <ComponentGroupRef Id="EffectcraftFiles" />
     </Feature>
-  </Package>
+  <Property Id="CRAFT_OPTION_1_M" Secure="yes"><RegistrySearch Id="CRAFT_OPTION_1_MSearch" Root="HKLM" Type="raw" Key="Software\EffectCraft" Name="DesktopShortcut" />
+    </Property><SetProperty Id="PREVIOUSDESKTOPSHORTCUT" Action="CraftLoadOption1M" Value="[CRAFT_OPTION_1_M]" After="LaunchConditions" Sequence="both" Condition="ALLUSERS = 1" /><Property Id="CRAFT_OPTION_1_U" Secure="yes"><RegistrySearch Id="CRAFT_OPTION_1_USearch" Root="HKCU" Type="raw" Key="Software\EffectCraft" Name="DesktopShortcut" />
+    </Property><SetProperty Id="PREVIOUSDESKTOPSHORTCUT" Action="CraftLoadOption1U" Value="[CRAFT_OPTION_1_U]" After="CraftLoadOption1M" Sequence="both" Condition="ALLUSERS &lt;&gt; 1" /></Package>
 
   <Fragment>
     <ComponentGroup Id="EffectcraftFiles" Directory="INSTALLFOLDER">
+      <Component Id="EffectcraftNotice">
+        <File Id="EffectcraftNoticeFile" Source="$(var.BinDir)\NOTICE" KeyPath="yes" />
+      </Component>
       <Component Id="EffectcraftApp" Guid="BA719860-95FE-4154-B265-47006B8E9083">
         <File Id="EffectcraftExe" Source="$(var.BinDir)\effectcraft.exe" KeyPath="yes">
-          <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder" Name="EffectCraft"
-              Description="EffectCraft motion graphics and visual effects" WorkingDirectory="INSTALLFOLDER" Advertise="yes"
-              Icon="EffectcraftIcon.ico" IconIndex="0" />
+          <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder" Name="EffectCraft" Description="EffectCraft motion graphics and visual effects" WorkingDirectory="INSTALLFOLDER" Advertise="yes" Icon="EffectcraftIcon.ico" IconIndex="0" />
         </File>
 
-        <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Value="[#EffectcraftExe]" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Name="Path" Value="[INSTALLFOLDER]" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Value="[#EffectcraftExe]" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Name="Path" Value="[INSTALLFOLDER]" Type="string" />
         <!-- The desktop shortcut choice, for the next upgrade (empty: none). -->
-        <RegistryValue Root="HKLM" Key="Software\EffectCraft" Name="DesktopShortcut" Value="[DESKTOPSHORTCUT]" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\EffectCraft" Name="DesktopShortcut" Value="[DESKTOPSHORTCUT]" Type="string" />
+      <RegistryValue Root="HKMU" Key="Software\EffectCraft" Name="InstallDir" Value="[INSTALLFOLDER]" Type="string" />
       </Component>
 
       <Component Id="EffectcraftCli">
@@ -92,9 +73,8 @@
 
       <!-- A component under the user's profile folders needs an HKCU key path (ICE38, ICE43). -->
       <Component Id="DesktopShortcut" Directory="DesktopFolder" Condition="DESKTOPSHORTCUT = &quot;1&quot;">
-        <Shortcut Id="DesktopShortcut" Name="EffectCraft" Description="EffectCraft motion graphics and visual effects"
-            Target="[#EffectcraftExe]" WorkingDirectory="INSTALLFOLDER" Icon="EffectcraftIcon.ico" IconIndex="0" />
-        <RegistryValue Root="HKCU" Key="Software\EffectCraft" Name="DesktopShortcut" Value="1" Type="string" KeyPath="yes" />
+        <Shortcut Id="DesktopShortcut" Name="EffectCraft" Description="EffectCraft motion graphics and visual effects" Target="[#EffectcraftExe]" WorkingDirectory="INSTALLFOLDER" Icon="EffectcraftIcon.ico" IconIndex="0" />
+        <RegistryValue Root="HKMU" Key="Software\EffectCraft" Name="DesktopShortcut" Value="1" Type="string" KeyPath="yes" />
       </Component>
     </ComponentGroup>
   </Fragment>
diff --git a/packaging/windows/install-policy.json b/packaging/windows/install-policy.json
new file mode 100644
index 000000000..6553d217b
--- /dev/null
+++ b/packaging/windows/install-policy.json
@@ -0,0 +1,44 @@
+{
+  "id": "effectcraft",
+  "name": "EffectCraft",
+  "upgradeCode": "AACA8593-C6ED-40A8-BA6C-CB325D8529F9",
+  "sources": [
+    "effectcraft.wxs",
+    "installer-ui.wxs"
+  ],
+  "icon": "assets/app-icon/effectcraft.ico",
+  "localization": [],
+  "extensions": [],
+  "payloads": [
+    "NOTICE",
+    "effectcraft-cli.exe",
+    "effectcraft.exe"
+  ],
+  "registry": [
+    [
+      "-1",
+      "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\effectcraft.exe",
+      "",
+      "[#EffectcraftExe]"
+    ],
+    [
+      "-1",
+      "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\effectcraft.exe",
+      "Path",
+      "[INSTALLFOLDER]"
+    ],
+    [
+      "-1",
+      "Software\\EffectCraft",
+      "DesktopShortcut",
+      "[DESKTOPSHORTCUT]"
+    ],
+    [
+      "-1",
+      "Software\\EffectCraft",
+      "DesktopShortcut",
+      "1"
+    ]
+  ],
+  "mode": "dualScope"
+}
diff --git a/packaging/windows/install-policy.wxi b/packaging/windows/install-policy.wxi
new file mode 100644
index 000000000..669c08126
--- /dev/null
+++ b/packaging/windows/install-policy.wxi
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Include xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <!-- Choose scope before launch checks and directory costing. Never move an existing copy. -->
+  <!-- Only for me leaves ALLUSERS unset. Publishing ALLUSERS=2 here makes FindRelatedProducts treat the run as
+       per-machine and skip the existing per-user copy, so an interactive upgrade installs beside it
+       (two registered products, and uninstall leaves files behind). Checked with real msiexec runs. -->
+  <Property Id="INSTALLFOLDER" Secure="yes" />
+  <Property Id="CRAFT_SCOPE" Value="user" Secure="yes" />
+  <Property Id="CRAFT_U_DIR" Secure="yes"><RegistrySearch Id="CRAFT_U_DIRSearch" Root="HKCU" Key="Software\EffectCraft" Name="InstallDir" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromDIR" Value="[CRAFT_U_DIR]" After="AppSearch" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_DIR" />
+  <Property Id="CRAFT_U_FOLDER" Secure="yes"><RegistrySearch Id="CRAFT_U_FOLDERSearch" Root="HKCU" Key="Software\EffectCraft" Name="InstallFolder" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromFOLDER" Value="[CRAFT_U_FOLDER]" After="CraftUFromDIR" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_FOLDER" />
+  <Property Id="CRAFT_U_PATH" Secure="yes"><RegistrySearch Id="CRAFT_U_PATHSearch" Root="HKCU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Name="Path" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromPATH" Value="[CRAFT_U_PATH]" After="CraftUFromFOLDER" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_PATH" />
+  <Property Id="CRAFT_U_EXEFOLDER" Secure="yes"><RegistrySearch Id="CRAFT_ULegacyFolder" Root="HKCU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Type="file" /></Property>
+  <Property Id="CRAFT_U_EXE" Secure="yes"><RegistrySearch Id="CRAFT_ULegacyExe" Root="HKCU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Type="file"><FileSearch Id="CRAFT_ULegacyFile" Name="effectcraft.exe" /></RegistrySearch></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromLegacyExe" Value="[CRAFT_U_EXEFOLDER]" After="CraftUFromPATH" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_EXEFOLDER AND CRAFT_U_EXE" />
+  <Property Id="CRAFT_USER_DIR" Secure="yes" />
+  <Property Id="CRAFT_M_DIR" Secure="yes"><RegistrySearch Id="CRAFT_M_DIRSearch" Root="HKLM" Key="Software\EffectCraft" Name="InstallDir" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromDIR" Value="[CRAFT_M_DIR]" After="CraftUFromLegacyExe" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_DIR" />
+  <Property Id="CRAFT_M_FOLDER" Secure="yes"><RegistrySearch Id="CRAFT_M_FOLDERSearch" Root="HKLM" Key="Software\EffectCraft" Name="InstallFolder" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromFOLDER" Value="[CRAFT_M_FOLDER]" After="CraftMFromDIR" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_FOLDER" />
+  <Property Id="CRAFT_M_PATH" Secure="yes"><RegistrySearch Id="CRAFT_M_PATHSearch" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Name="Path" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromPATH" Value="[CRAFT_M_PATH]" After="CraftMFromFOLDER" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_PATH" />
+  <Property Id="CRAFT_M_EXEFOLDER" Secure="yes"><RegistrySearch Id="CRAFT_MLegacyFolder" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Type="file" /></Property>
+  <Property Id="CRAFT_M_EXE" Secure="yes"><RegistrySearch Id="CRAFT_MLegacyExe" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\effectcraft.exe" Type="file"><FileSearch Id="CRAFT_MLegacyFile" Name="effectcraft.exe" /></RegistrySearch></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromLegacyExe" Value="[CRAFT_M_EXEFOLDER]" After="CraftMFromPATH" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_EXEFOLDER AND CRAFT_M_EXE" />
+  <Property Id="CRAFT_MACHINE_DIR" Secure="yes" />
+  <SetProperty Id="CRAFT_SCOPE" Action="CraftPreferMachineScope" Value="machine" After="CraftMFromLegacyExe" Sequence="ui" Condition="ALLUSERS = 1 OR (CRAFT_MACHINE_DIR AND NOT CRAFT_USER_DIR)" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftRestoreUserFolder" Value="[CRAFT_USER_DIR]" Before="CostInitialize" Sequence="both" Condition="NOT INSTALLFOLDER AND ALLUSERS &lt;&gt; 1 AND CRAFT_USER_DIR" />
+  <!-- The wizard can change the context after Windows Installer has already resolved Program Files for the first one.
+       Give the new-install folder explicitly so Everyone never lands in the profile and Only for me never lands in Program Files. -->
+  <?if $(sys.BUILDARCH) = x86 ?>
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultMachineFolder" Value="[%ProgramFiles(x86)]\ArtCraft\EffectCraft\" After="CraftRestoreUserFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1 AND VersionNT64" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultMachineFolder32" Value="[%ProgramFiles]\ArtCraft\EffectCraft\" After="CraftDefaultMachineFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1 AND NOT VersionNT64" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultUserFolder" Value="[LocalAppDataFolder]Programs\ArtCraft\EffectCraft\" After="CraftDefaultMachineFolder32" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS &lt;&gt; 1" />
+  <?else?>
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultMachineFolder" Value="[%ProgramW6432]\ArtCraft\EffectCraft\" After="CraftRestoreUserFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultUserFolder" Value="[LocalAppDataFolder]Programs\ArtCraft\EffectCraft\" After="CraftDefaultMachineFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS &lt;&gt; 1" />
+  <?endif?>
+  <SetProperty Id="INSTALLFOLDER" Action="CraftRestoreMachineFolder" Value="[CRAFT_MACHINE_DIR]" Before="CraftRestoreUserFolder" Sequence="both" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1 AND CRAFT_MACHINE_DIR" />
+  <Launch Condition="Installed OR ALLUSERS &lt;&gt; 1 OR NOT CRAFT_USER_DIR" Message="This app is already installed for your account. Choose Only for me to update it, or uninstall that copy before changing who it is installed for." />
+  <Launch Condition="Installed OR ALLUSERS = 1 OR NOT CRAFT_MACHINE_DIR" Message="This app is already installed for everyone. Choose Everyone to update it, or pass ALLUSERS=1 to msiexec. Uninstall that copy before changing who it is installed for." />
+  <UI>
+    <TextStyle Id="CraftScopeText" FaceName="Segoe UI" Size="9" />
+    <TextStyle Id="CraftScopeTitle" FaceName="Segoe UI" Size="12" Bold="yes" />
+    <Dialog Id="CraftScopeDlg" Width="370" Height="220" Title="[ProductName] Setup" NoMinimize="yes">
+      <Control Id="Title" Type="Text" X="20" Y="15" Width="330" Height="30" Text="{\CraftScopeTitle}Who should use [ProductName]?" />
+      <Control Id="Info" Type="Text" X="20" Y="50" Width="330" Height="30" Text="{\CraftScopeText}An update keeps the existing folder. New copies use the ArtCraft folder under Programs." />
+      <Control Id="Scope" Type="RadioButtonGroup" X="20" Y="88" Width="330" Height="60" Property="CRAFT_SCOPE">
+        <RadioButtonGroup Property="CRAFT_SCOPE">
+          <RadioButton Value="user" X="0" Y="0" Width="330" Height="20" Text="Only for me (no administrator permission needed)" />
+          <RadioButton Value="machine" X="0" Y="30" Width="330" Height="20" Text="Everyone on this computer (asks an administrator)" />
+        </RadioButtonGroup>
+      </Control>
+      <Control Id="Next" Type="PushButton" X="214" Y="182" Width="66" Height="20" Default="yes" Text="Next">
+        <Publish Property="ALLUSERS" Value="1" Order="1" Condition="CRAFT_SCOPE = &quot;machine&quot;" />
+        <Publish Property="ALLUSERS" Value="{}" Order="2" Condition="CRAFT_SCOPE = &quot;user&quot;" />
+        <Publish Property="MSIINSTALLPERUSER" Value="{}" Order="3" Condition="CRAFT_SCOPE = &quot;machine&quot;" />
+        <Publish Property="MSIINSTALLPERUSER" Value="1" Order="4" Condition="CRAFT_SCOPE = &quot;user&quot;" />
+        <Publish Event="EndDialog" Value="Return" Order="5" />
+      </Control>
+      <Control Id="Cancel" Type="PushButton" X="290" Y="182" Width="60" Height="20" Cancel="yes" Text="Cancel"><Publish Event="EndDialog" Value="Exit" /></Control>
+    </Dialog>
+  </UI>
+  <InstallUISequence>
+    <Show Dialog="CraftScopeDlg" After="CraftPreferMachineScope" Condition="NOT Installed AND NOT REMOVE AND UILevel = 5" />
+    <!-- Related-product discovery runs once, so full UI must choose its context first. -->
+    <FindRelatedProducts After="CraftScopeDlg" />
+  </InstallUISequence>
+</Include>
diff --git a/packaging/windows/installer-ui.wxs b/packaging/windows/installer-ui.wxs
index 16ab58d7f..17c7efd0b 100644
--- a/packaging/windows/installer-ui.wxs
+++ b/packaging/windows/installer-ui.wxs
@@ -1,16 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--
-  EffectCraft installer wizard: original dialogs built from Windows Installer's own controls and
-  events (no WixUI library), included by effectcraft.wxs with <UIRef Id="EffectcraftUI" />.
-
-    fresh install:  DestDlg (folder, Change... opens BrowseDlg, desktop shortcut) -> ReadyDlg -> ProgressDlg -> ExitDlg
-    upgrade:        ReadyDlg (the installed copy's folder, not editable) -> ProgressDlg -> ExitDlg
-    already there:  MaintDlg (Repair or Remove) -> ProgressDlg -> ExitDlg
-
-  Silent installs (/qn) skip all of this; pass INSTALLFOLDER="..." to choose the folder there.
-  Folder controls edit INSTALLFOLDER indirectly through _BrowseProperty; SetTargetPath checks the
-  path and applies it, and Windows Installer reports a bad path itself.
--->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Fragment>
     <UI Id="EffectcraftUI">
@@ -78,7 +66,10 @@
         <Control Id="Back" Type="PushButton" X="180" Y="243" Width="56" Height="17" Text="&amp;Back" DisableCondition="WIX_UPGRADE_DETECTED">
           <Publish Event="NewDialog" Value="DestDlg" />
         </Control>
-        <Control Id="Install" Type="PushButton" X="236" Y="243" Width="56" Height="17" Default="yes" ElevationShield="yes" Text="&amp;Install">
+        <Control Id="Install" Type="PushButton" X="236" Y="243" Width="56" Height="17" Default="yes" DefaultCondition="ALLUSERS = 1" ElevationShield="yes" HideCondition="ALLUSERS &lt;&gt; 1" ShowCondition="ALLUSERS = 1" Text="&amp;Install">
+          <Publish Event="EndDialog" Value="Return" />
+        </Control>
+        <Control Id="InstallUser" Type="PushButton" DefaultCondition="ALLUSERS &lt;&gt; 1" HideCondition="ALLUSERS = 1" ShowCondition="ALLUSERS &lt;&gt; 1" X="236" Y="243" Width="56" Height="17" Text="&amp;Install">
           <Publish Event="EndDialog" Value="Return" />
         </Control>
         <Control Id="Cancel" Type="PushButton" X="304" Y="243" Width="56" Height="17" Cancel="yes" Text="Cancel">
@@ -90,7 +81,7 @@
       <Dialog Id="MaintDlg" Width="370" Height="270" Title="[ProductName] Setup">
         <Control Id="Title" Type="Text" X="20" Y="15" Width="330" Height="20" Transparent="yes" NoPrefix="yes" Text="{\EcTitle}[ProductName] is already installed" />
         <Control Id="Description" Type="Text" X="20" Y="45" Width="330" Height="24" NoPrefix="yes" Text="Repair puts back missing or damaged files in its folder. Remove uninstalls it; your projects are not touched." />
-        <Control Id="Repair" Type="PushButton" X="20" Y="80" Width="80" Height="20" Default="yes" ElevationShield="yes" Text="&amp;Repair">
+        <Control Id="Repair" Type="PushButton" X="20" Y="80" Width="80" Height="20" Default="yes" DefaultCondition="ALLUSERS = 1" ElevationShield="yes" HideCondition="ALLUSERS &lt;&gt; 1" ShowCondition="ALLUSERS = 1" Text="&amp;Repair">
           <!-- "a": put back every file, whatever its version or date. With "e"/"o" a changed
                unversioned file (effectcraft-cli.exe has no version resource) counts as a user edit
                and is kept, and "c" only checks files that carry an MSI checksum. -->
@@ -98,7 +89,19 @@
           <Publish Event="Reinstall" Value="ALL" Order="2" />
           <Publish Event="EndDialog" Value="Return" Order="3" />
         </Control>
-        <Control Id="Remove" Type="PushButton" X="20" Y="108" Width="80" Height="20" ElevationShield="yes" Text="Re&amp;move">
+        <Control Id="RepairUser" Type="PushButton" DefaultCondition="ALLUSERS &lt;&gt; 1" HideCondition="ALLUSERS = 1" ShowCondition="ALLUSERS &lt;&gt; 1" X="20" Y="80" Width="80" Height="20" Text="&amp;Repair">
+          <!-- "a": put back every file, whatever its version or date. With "e"/"o" a changed
+               unversioned file (effectcraft-cli.exe has no version resource) counts as a user edit
+               and is kept, and "c" only checks files that carry an MSI checksum. -->
+          <Publish Event="ReinstallMode" Value="amus" Order="1" />
+          <Publish Event="Reinstall" Value="ALL" Order="2" />
+          <Publish Event="EndDialog" Value="Return" Order="3" />
+        </Control>
+        <Control Id="Remove" Type="PushButton" X="20" Y="108" Width="80" Height="20" ElevationShield="yes" HideCondition="ALLUSERS &lt;&gt; 1" ShowCondition="ALLUSERS = 1" Text="Re&amp;move">
+          <Publish Event="Remove" Value="ALL" Order="1" />
+          <Publish Event="EndDialog" Value="Return" Order="2" />
+        </Control>
+        <Control Id="RemoveUser" Type="PushButton" HideCondition="ALLUSERS = 1" ShowCondition="ALLUSERS &lt;&gt; 1" X="20" Y="108" Width="80" Height="20" Text="Re&amp;move">
           <Publish Event="Remove" Value="ALL" Order="1" />
           <Publish Event="EndDialog" Value="Return" Order="2" />
         </Control>
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index 7654fe1f3..e49fde52c 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -90,6 +90,9 @@ Copy-Item (Join-Path $Bin 'effectcraft.exe'), (Join-Path $Bin 'effectcraft-cli.e
 
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'effectcraft.exe') (Join-Path $Stage 'effectcraft-cli.exe')
 
+# Required embedded-font notices ship independently of optional font inputs.
+Copy-Item -LiteralPath (Join-Path $Root 'NOTICE') -Destination $Stage
+
 # ---- MSI ---------------------------------------------------------------------------------------
 $Msi = Join-Path $Dist "effectcraft-$Version-windows-$Arch.msi"
 Invoke-Native 'wix build' {
@@ -97,6 +100,8 @@ Invoke-Native 'wix build' {
     -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\effectcraft.ico')" `
     -o $Msi
 }
+# Check the compiled scope, path and registration contract before signing.
+& (Join-Path $PSScriptRoot 'check-install-policy.ps1') -MsiPath $Msi
 # wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
 Remove-Item -Force -ErrorAction SilentlyContinue ([IO.Path]::ChangeExtension($Msi, '.wixpdb'))
 & (Join-Path $PSScriptRoot 'sign.ps1') $Msi
@@ -106,7 +111,7 @@ $Portable = Join-Path $TargetDir "windows-package\effectcraft-$Version-windows-$
 Remove-Item -Recurse -Force $Portable -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Portable | Out-Null
 Copy-Item (Join-Path $Stage '*.exe') $Portable
-foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
+foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE', 'NOTICE') {
   $p = Join-Path $Root $f
   if (Test-Path $p) { Copy-Item $p $Portable }
 }
diff --git a/packaging/windows/sign.ps1 b/packaging/windows/sign.ps1
index d8f2f649b..7f89586a6 100644
--- a/packaging/windows/sign.ps1
+++ b/packaging/windows/sign.ps1
@@ -56,8 +56,8 @@ if (-not $haveCert -and -not $haveAzure) {
 
 $script:SignTool = Find-SignTool
 $common = @('sign', '/v', '/fd', 'SHA256', '/td', 'SHA256', '/d', 'EffectCraft', '/du', 'https://github.com/storytold/effectcraft')
-$tmp = Join-Path ([IO.Path]::GetTempPath()) "effectcraft-sign-$PID"
-New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+$tmp = Join-Path ([IO.Path]::GetTempPath()) "effectcraft-sign-$([IO.Path]::GetRandomFileName())"
+New-Item -ItemType Directory -Path $tmp | Out-Null
 
 try {
   if ($haveCert) {
@@ -73,8 +73,15 @@ try {
     Write-Output "Signing with Azure Trusted Signing ($env:AZURE_SIGNING_ACCOUNT / $env:AZURE_CERT_PROFILE): $($Files -join ', ')"
     # The dlib authenticates with DefaultAzureCredential, which reads AZURE_TENANT_ID,
     # AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment.
+    $trustedSigningVersion = '1.0.95'
+    $trustedSigningSha256 = '3bfcf1e0a3cb42af1692f0a8ed45c15de070c2de86f28a59b2795d904d8a920f'
     $pkg = Join-Path $tmp 'trusted-signing.zip'
-    Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client' -OutFile $pkg
+    $uri = "https://api.nuget.org/v3-flatcontainer/microsoft.trusted.signing.client/$trustedSigningVersion/microsoft.trusted.signing.client.$trustedSigningVersion.nupkg"
+    Invoke-WebRequest -Uri $uri -OutFile $pkg
+    $actualHash = (Get-FileHash -Path $pkg -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actualHash -ne $trustedSigningSha256) {
+      throw "Microsoft.Trusted.Signing.Client $trustedSigningVersion checksum mismatch"
+    }
     Expand-Archive -Path $pkg -DestinationPath (Join-Path $tmp 'client') -Force
     $dlib = Get-ChildItem -Path (Join-Path $tmp 'client') -Recurse -Filter Azure.CodeSigning.Dlib.dll |
       Where-Object { $_.FullName -match '\\x64\\' } | Select-Object -First 1
diff --git a/packaging/windows/test-install-policy.ps1 b/packaging/windows/test-install-policy.ps1
new file mode 100644
index 000000000..c28fe3950
--- /dev/null
+++ b/packaging/windows/test-install-policy.ps1
@@ -0,0 +1,55 @@
+<#
+.SYNOPSIS
+  Build non-executable installer metadata fixtures; never install them.
+#>
+param(
+  [Parameter(Mandatory = $true)] [string] $OutputDirectory,
+  [ValidateSet('x64','x86','arm64')] [string[]] $Architectures = @('x64','x86','arm64')
+)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+$root = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$policy = Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'install-policy.json') | ConvertFrom-Json
+[void](New-Item -ItemType Directory -Force -Path $OutputDirectory)
+$output = (Resolve-Path -LiteralPath $OutputDirectory).Path
+& (Join-Path $PSScriptRoot 'test-legacy-fixture.ps1') -Work (Join-Path $output 'legacy-source')
+Add-Type -AssemblyName System.Drawing
+foreach ($arch in $Architectures) {
+  $stage = Join-Path $output $arch
+  [void](New-Item -ItemType Directory -Force -Path $stage)
+  foreach ($name in $policy.payloads) {
+    $destination = Join-Path $stage $name
+    [void](New-Item -ItemType Directory -Force -Path ([IO.Path]::GetDirectoryName($destination)))
+    Set-Content -LiteralPath $destination -Encoding Ascii -Value 'NON-EXECUTABLE MSI METADATA TEST FIXTURE'
+  }
+  foreach ($folder in @('docs','models','notices')) {
+    $path = Join-Path $stage $folder
+    [void](New-Item -ItemType Directory -Force -Path $path)
+    Set-Content -LiteralPath (Join-Path $path "$folder-fixture.txt") -Value 'Metadata test fixture, not a user file or model.'
+  }
+  foreach ($model in @('metadata-one.rten','metadata-two.rten')) {
+    Set-Content -LiteralPath (Join-Path (Join-Path $stage 'models') $model) -Encoding Ascii -Value 'NON-EXECUTABLE MODEL METADATA FIXTURE'
+  }
+  foreach ($spec in @(@('banner.bmp',493,58),@('dialog.bmp',493,312))) {
+    $bitmap = [Drawing.Bitmap]::new($spec[1],$spec[2],[Drawing.Imaging.PixelFormat]::Format24bppRgb)
+    try { $bitmap.Save((Join-Path $stage $spec[0]),[Drawing.Imaging.ImageFormat]::Bmp) }
+    finally { $bitmap.Dispose() }
+  }
+  Set-Content -LiteralPath (Join-Path $stage 'licence.rtf') -Encoding Ascii -Value '{\rtf1 Metadata test fixture.}'
+  $sources = @($policy.sources | ForEach-Object { Join-Path $PSScriptRoot $_ })
+  $msi = Join-Path $stage "$($policy.id)-NOT-INSTALLABLE.msi"
+  $extensions = @($policy.extensions | ForEach-Object { '-ext'; "WixToolset.$_.wixext" })
+  & wix build @sources -arch $arch @extensions `
+    -culture en-US -d 'Version=0.0.1' -d 'DisplayVersion=0.0.1-metadata-test' `
+    -d "BinDir=$stage" -d "IconPath=$(Join-Path $root $policy.icon)" `
+    -d "DocsDir=$(Join-Path $stage 'docs')" -d "ModelsDir=$(Join-Path $stage 'models')" `
+    -d "AppNoticesDir=$(Join-Path $stage 'notices')" -d 'HasCraftFontLicences=1' -d 'HasCli=1' `
+    -d "BannerBmp=$(Join-Path $stage 'banner.bmp')" -d "DialogBmp=$(Join-Path $stage 'dialog.bmp')" `
+    -d "UiBannerBmp=$(Join-Path $stage 'banner.bmp')" -d "UiDialogBmp=$(Join-Path $stage 'dialog.bmp')" `
+    -d "LicenseRtf=$(Join-Path $stage 'licence.rtf')" -o $msi @($policy.localization | ForEach-Object { '-loc'; Join-Path $PSScriptRoot $_ })
+  if ($LASTEXITCODE -ne 0) { throw "WiX validation failed for $arch (exit $LASTEXITCODE)." }
+  $shell = (Get-Process -Id $PID).Path
+  & $shell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot 'check-install-policy.ps1') -MsiPath $msi
+  if ($LASTEXITCODE -ne 0) { throw "Compiled installer policy failed for $arch (exit $LASTEXITCODE)." }
+  Write-Output "PASS $arch metadata-only package. This is not an executable installer."
+}
diff --git a/packaging/windows/test-legacy-fixture.ps1 b/packaging/windows/test-legacy-fixture.ps1
new file mode 100644
index 000000000..44336dca9
--- /dev/null
+++ b/packaging/windows/test-legacy-fixture.ps1
@@ -0,0 +1,21 @@
+<# Exercise the legacy source transformation without building or installing. #>
+param([Parameter(Mandatory = $true)] [string] $Work)
+$ErrorActionPreference = 'Stop'
+[void](New-Item -ItemType Directory -Force -Path $Work)
+$source = Get-Content -Raw (Join-Path $PSScriptRoot 'test-msi.ps1')
+$start = $source.IndexOf('$Wxs =')
+$end = $source.IndexOf('$Msi = @{}', $start)
+if ($start -lt 0 -or $end -le $start) { throw 'Could not locate the legacy source transformation.' }
+# Run the test harness's exact source-producing block, with only scratch outputs.
+$block = $source.Substring($start, $end - $start).Replace('$PSScriptRoot', ("'" + $PSScriptRoot.Replace("'", "''") + "'"))
+Invoke-Expression $block
+[xml]$legacy = Get-Content -Raw $LegacyWxs
+$ns = New-Object Xml.XmlNamespaceManager($legacy.NameTable)
+$ns.AddNamespace('w', 'http://wixtoolset.org/schemas/v4/wxs')
+if ($legacy.SelectNodes('//w:RegistryValue[@Name="Path" or @Name="InstallDir" or @Name="InstallFolder"]', $ns).Count) {
+  throw 'Legacy fixture must omit every modern folder record so discovery uses the executable fallback.'
+}
+if (-not $legacy.SelectNodes('//w:RegistryValue[contains(@Value,"EffectcraftExe")]', $ns).Count) {
+  throw 'Legacy fixture must retain its executable registration.'
+}
+Write-Output 'PASS legacy fixture exposes only the executable-path fallback.'
diff --git a/packaging/windows/test-msi.ps1 b/packaging/windows/test-msi.ps1
index 5868c77b3..fbc463e4b 100644
--- a/packaging/windows/test-msi.ps1
+++ b/packaging/windows/test-msi.ps1
@@ -11,7 +11,7 @@
     3. upgrades to 0.0.3 the same way (found from the Path value 0.0.2 wrote),
     4. repairs a damaged (unversioned) CLI there with the wizard's Repair mode,
     5. uninstalls: files, the App Paths registration and the desktop shortcut go,
-    6. installs 0.0.3 with no folder and DESKTOPSHORTCUT=0: it must land in Program Files with no
+    6. installs 0.0.3 with no folder and DESKTOPSHORTCUT=0: it must land in Program Files\ArtCraft\EffectCraft (ALLUSERS=1) with no
        desktop shortcut, then uninstalls.
   The installs before step 6 take the default desktop shortcut, which upgrades keep.
   The wizard itself needs a person (or the snapshot steps in the PR); this covers what msiexec /qn
@@ -36,7 +36,9 @@ function Invoke-Native([string] $What, [scriptblock] $Block) {
 }
 function Invoke-Msiexec([string] $What, [string[]] $Arguments) {
   $log = Join-Path $Work "$($What -replace '\W', '-').log"
-  $p = Start-Process msiexec.exe -ArgumentList ($Arguments + '/qn', '/l*v', "`"$log`"") -Wait -PassThru
+  # This existing VM regression deliberately covers the all-users upgrade route.
+  $p = Start-Process msiexec.exe -ArgumentList ($Arguments + 'ALLUSERS=1', '/qn', '/norestart', '/l*v', "`"$log`"") -PassThru
+  if (-not $p.WaitForExit(300000)) { $p.Kill(); throw "msiexec ($What) exceeded five minutes; see $log" }
   if ($p.ExitCode -ne 0) { Get-Content $log -Tail 60; throw "msiexec ($What) exited $($p.ExitCode)" }
   Write-Output "ok $What"
 }
@@ -65,17 +67,20 @@ New-Item -ItemType Directory -Force -Path $Bin | Out-Null
 # The MSI only copies these. The app is versioned (it embeds VERSIONINFO); the real CLI has no
 # version resource, so its stand-in is an unversioned file too: Windows Installer keeps a changed
 # unversioned file on repair unless the repair mode forces it.
-Copy-Item (Join-Path $env:SystemRoot 'System32\notepad.exe') (Join-Path $Bin 'effectcraft.exe')
+Copy-Item (Join-Path $env:SystemRoot 'System32\cmd.exe') (Join-Path $Bin 'effectcraft.exe')
 [IO.File]::WriteAllText((Join-Path $Bin 'effectcraft-cli.exe'), 'effectcraft-cli stand-in')
+[IO.File]::WriteAllText((Join-Path $Bin 'NOTICE'), 'Test fixture notice')
 
 # 0.0.1 stands in for releases before this installer change: the same package without the App
-# Paths "Path" value.
+# Paths "Path" value or modern InstallDir/InstallFolder records.
 $Wxs = Join-Path $PSScriptRoot 'effectcraft.wxs'
 $LegacyWxs = Join-Path $Work 'effectcraft-legacy.wxs'
-$pathValue = '(?m)^.*<RegistryValue [^>]*Name="Path"[^>]*/>\r?\n'
+$pathValue = '(?m)^.*<RegistryValue [^>]*Name="(?:Path|InstallDir|InstallFolder)"[^>]*/>\r?\n'
 $text = Get-Content -Raw $Wxs
 if ($text -notmatch $pathValue) { throw "no App Paths Path value in $Wxs to leave out" }
 [IO.File]::WriteAllText($LegacyWxs, ($text -replace $pathValue, ''))
+# The legacy source lives in the scratch folder, so its local include must travel with it.
+Copy-Item (Join-Path $PSScriptRoot 'install-policy.wxi') (Join-Path $Work 'install-policy.wxi')
 
 $Msi = @{}
 foreach ($v in '0.0.1', '0.0.2', '0.0.3') {
@@ -90,7 +95,7 @@ foreach ($v in '0.0.1', '0.0.2', '0.0.3') {
 
 # Spaces and a non-ASCII letter (written as a char so the script's own encoding doesn't matter).
 $Custom = Join-Path $env:SystemDrive "EffectCraft Test $([char]0x00DC)nicode\My Apps"
-$Default = Join-Path $env:ProgramFiles 'EffectCraft'
+$Default = Join-Path $env:ProgramFiles 'ArtCraft\EffectCraft'
 if (Test-Path -LiteralPath $AppPaths) { throw 'EffectCraft is already installed here; run this on a clean machine' }
 
 Invoke-Msiexec 'install the legacy package to a custom folder' @('/i', "`"$($Msi['0.0.1'])`"", "INSTALLFOLDER=`"$Custom`"")
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 000000000..23a37f67e
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_effectcraft
+sonar.organization=storytold
diff --git a/tools/requirements-sam2-reference.txt b/tools/requirements-sam2-reference.txt
new file mode 100644
index 000000000..8fab732ff
--- /dev/null
+++ b/tools/requirements-sam2-reference.txt
@@ -0,0 +1,4 @@
+# Pinned versions the SAM 2 reference fixtures were generated with (CPU).
+torch==2.7.0
+transformers==5.19.0
+safetensors==0.8.0
diff --git a/tools/sam2_reference.py b/tools/sam2_reference.py
new file mode 100644
index 000000000..2cfd03fde
--- /dev/null
+++ b/tools/sam2_reference.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python
+"""Dump per-stage SAM 2 reference tensors (CPU, float32) for the Rust port's reference tests.
+
+Usage: python -I tools/sam2_reference.py MODEL_DIR OUT.safetensors
+MODEL_DIR holds the facebook/sam2.1-hiera-tiny files (config.json, model.safetensors, ...).
+Versions are pinned in tools/requirements-sam2-reference.txt. The input is synthetic, so no
+media is committed; the weights are never copied into the repo.
+"""
+import sys
+
+import numpy as np
+import torch
+from safetensors.torch import save_file
+import torch.nn.functional as F
+from transformers import Sam2Model
+
+
+def synthetic_image(size=256):
+    """A textured disc over a textured background (deterministic)."""
+    rng = np.random.default_rng(7)
+    yy, xx = np.mgrid[0:size, 0:size].astype(np.float32)
+    bg = 0.3 + 0.2 * np.sin(xx / 9.0) * np.cos(yy / 7.0)
+    disc = np.hypot(xx - size * 0.45, yy - size * 0.5) < size * 0.22
+    img = np.stack([bg, bg * 0.8 + 0.1, bg * 0.6 + 0.3], -1)
+    img[disc] = np.stack([0.85 + 0.1 * np.sin(xx / 5), 0.4 + 0.1 * np.cos(yy / 5), 0.15 + 0 * xx], -1)[disc]
+    img += rng.normal(0, 0.01, img.shape).astype(np.float32)
+    return (img.clip(0, 1) * 255).astype(np.uint8)
+
+
+def main(model_dir, out):
+    torch.manual_seed(0)
+    torch.set_num_threads(1)
+    model = Sam2Model.from_pretrained(model_dir).eval()
+    image = synthetic_image()
+    # Preprocess by hand (no torchvision needed): resize to 1024x1024, ImageNet mean/std.
+    x = torch.from_numpy(image).permute(2, 0, 1)[None].float() / 255.0
+    x = F.interpolate(x, size=(1024, 1024), mode="bilinear", align_corners=False)
+    mean = torch.tensor([0.485, 0.456, 0.406]).view(1, 3, 1, 1)
+    std = torch.tensor([0.229, 0.224, 0.225]).view(1, 3, 1, 1)
+    scale = 1024.0 / image.shape[0]
+    inputs = {
+        "pixel_values": (x - mean) / std,
+        "input_points": torch.tensor([[[[115.0 * scale, 128.0 * scale]]]]),
+        "input_labels": torch.tensor([[[1]]], dtype=torch.int32),
+    }
+    taps = {}
+
+    def tap(name):
+        def hook(_m, _i, o):
+            def flat(x):
+                if isinstance(x, torch.Tensor):
+                    yield x
+                elif isinstance(x, (tuple, list)):
+                    for y in x:
+                        yield from flat(y)
+                elif hasattr(x, "to_tuple"):  # a ModelOutput (the neck)
+                    yield from flat(x.to_tuple())
+
+            for k, t in enumerate(flat(o)):
+                taps[f"{name}.{k}"] = t.detach().float().clone().contiguous()
+        return hook
+
+    # Stage taps by module path: patch embed, each Hiera block, the neck, prompt encoder, decoder.
+    for name, mod in model.named_modules():
+        parts = name.split(".")
+        if name in ("vision_encoder.backbone.patch_embed", "vision_encoder.neck", "prompt_encoder", "mask_decoder") or (
+            len(parts) == 4 and parts[:3] == ["vision_encoder", "backbone", "blocks"]
+        ):
+            mod.register_forward_hook(tap(name))
+    import time
+    with torch.no_grad():
+        t0 = time.perf_counter()
+        res = model(**inputs, multimask_output=True)
+        print(f"forward (1 thread, first run): {time.perf_counter() - t0:.2f} s")
+    taps["input.pixel_values"] = inputs["pixel_values"].float()
+    taps["out.iou_scores"] = res.iou_scores.float()
+    taps["out.pred_masks"] = res.pred_masks.float()
+    save_file({k: v.clone().contiguous() for k, v in taps.items()}, out)
+    print(f"wrote {len(taps)} tensors to {out}")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        sys.exit(__doc__)
+    main(sys.argv[1], sys.argv[2])
diff --git a/tools/sam2_video_reference.py b/tools/sam2_video_reference.py
new file mode 100644
index 000000000..a05223be9
--- /dev/null
+++ b/tools/sam2_video_reference.py
@@ -0,0 +1,136 @@
+#!/usr/bin/env python
+"""Dump SAM 2 video reference tensors (CPU, float32) for the Rust port's reference tests.
+
+Usage: python -I tools/sam2_video_reference.py MODEL_DIR OUT.safetensors
+Runs `Sam2VideoModel` on a 7-frame synthetic clip (a textured disc moving right, hidden behind a bar on
+frames 4 and 5), prompted with one click on frame 2, then tracks forward (2..6) and backward (2..0).
+Saves the preprocessed frames, every frame's low-resolution mask and object score, the stored memory
+features and object pointers, and the inputs/outputs of the memory encoder and memory attention.
+"""
+import sys
+
+import numpy as np
+import torch
+import torch.nn.functional as F
+from safetensors.torch import save_file
+from transformers import Sam2VideoModel
+from transformers.models.sam2_video.modeling_sam2_video import Sam2VideoInferenceSession
+
+T, SIZE, PROMPT_FRAME = 7, 256, 2
+
+
+def clip():
+    rng = np.random.default_rng(3)
+    yy, xx = np.mgrid[0:SIZE, 0:SIZE].astype(np.float32)
+    bg = 0.3 + 0.2 * np.sin(xx / 9.0) * np.cos(yy / 7.0)
+    frames = []
+    for t in range(T):
+        cx, cy = 80 + 12 * t, 128
+        disc = np.hypot(xx - cx, yy - cy) < 34
+        img = np.stack([bg, bg * 0.8 + 0.1, bg * 0.6 + 0.3], -1)
+        tex = 0.85 + 0.1 * np.sin((xx - cx) / 5)
+        img[disc] = np.stack([tex, 0.4 + 0.1 * np.cos((yy - cy) / 5), 0.15 + 0 * xx], -1)[disc]
+        if t in (4, 5):  # a bar hides the disc
+            img[:, int(cx) - 50 : int(cx) + 50] = 0.2
+        img += rng.normal(0, 0.01, img.shape).astype(np.float32)
+        frames.append((img.clip(0, 1) * 255).astype(np.uint8))
+    return frames, (80 + 12 * PROMPT_FRAME, 128)
+
+
+def main(model_dir, out):
+    torch.manual_seed(0)
+    torch.set_num_threads(4)
+    model = Sam2VideoModel.from_pretrained(model_dir).eval()
+    frames, click = clip()
+    mean = torch.tensor([0.485, 0.456, 0.406]).view(1, 3, 1, 1)
+    std = torch.tensor([0.229, 0.224, 0.225]).view(1, 3, 1, 1)
+    x = torch.from_numpy(np.stack(frames)).permute(0, 3, 1, 2).float() / 255.0
+    x = F.interpolate(x, size=(1024, 1024), mode="bilinear", align_corners=False)
+    pixels = (x - mean) / std
+
+    taps = {"clip.pixel_values": pixels}
+    first = {"enc": True, "attn": True}
+
+    def enc_hook(_m, args, kwargs, out):
+        if first["enc"]:
+            first["enc"] = False
+            vf = args[0] if args else kwargs["vision_features"]
+            masks = args[1] if len(args) > 1 else kwargs["masks"]
+            taps["mem.enc.vision_features"] = vf.detach().float().clone()
+            taps["mem.enc.masks"] = masks.detach().float().clone()
+            taps["mem.enc.out_features"] = out[0].detach().float().clone()
+            taps["mem.enc.out_pos"] = out[1].detach().float().clone()
+
+    def attn_hook(_m, args, kwargs, out):
+        if first["attn"]:
+            first["attn"] = False
+            for k in ("current_vision_features", "memory", "current_vision_position_embeddings", "memory_posision_embeddings"):
+                taps[f"mem.attn.{k}"] = kwargs[k].detach().float().clone()
+            taps["mem.attn.num_pointers"] = torch.tensor([float(kwargs["num_object_pointer_tokens"])])
+            taps["mem.attn.out"] = out.detach().float().clone()
+
+    model.memory_encoder.register_forward_hook(enc_hook, with_kwargs=True)
+    model.memory_attention.register_forward_hook(attn_hook, with_kwargs=True)
+
+    sess = Sam2VideoInferenceSession(video=pixels, video_height=SIZE, video_width=SIZE, dtype=torch.float32)
+    obj_idx = sess.obj_id_to_idx(1)
+    scale = 1024.0 / SIZE
+    sess.add_point_inputs(
+        obj_idx,
+        PROMPT_FRAME,
+        {
+            "point_coords": torch.tensor([[[[click[0] * scale, click[1] * scale]]]], dtype=torch.float32),
+            "point_labels": torch.tensor([[[1]]], dtype=torch.int32),
+        },
+    )
+    sess.obj_with_new_inputs = [1]
+
+    def record(tag, o):
+        taps[f"video.{tag}.{o.frame_idx}.pred_masks"] = o.pred_masks.detach().float().clone()
+        taps[f"video.{tag}.{o.frame_idx}.score"] = o.object_score_logits.detach().float().clone()
+
+    with torch.no_grad():
+        record("prompt", model(sess, frame_idx=PROMPT_FRAME))
+        for o in model.propagate_in_video_iterator(sess, start_frame_idx=PROMPT_FRAME):
+            record("fwd", o)
+        for o in model.propagate_in_video_iterator(sess, start_frame_idx=PROMPT_FRAME, reverse=True):
+            record("rev", o)
+
+    # The same object prompted with a mask instead of a click (binary, at the model's 1024 x 1024).
+    msess = Sam2VideoInferenceSession(video=pixels, video_height=SIZE, video_width=SIZE, dtype=torch.float32)
+    mobj = msess.obj_id_to_idx(1)
+    yy, xx = np.mgrid[0:1024, 0:1024].astype(np.float32)
+    cx, cy = (80 + 12 * PROMPT_FRAME) * scale, 128 * scale
+    disc = torch.from_numpy((np.hypot(xx + 0.5 - cx, yy + 0.5 - cy) < 34 * scale).astype(np.float32))[None, None]
+    taps["maskprompt.input"] = disc.clone()
+    msess.add_mask_inputs(mobj, PROMPT_FRAME, disc)
+    msess.obj_with_new_inputs = [1]
+    with torch.no_grad():
+        o = model(msess, frame_idx=PROMPT_FRAME)
+        taps[f"maskprompt.prompt.{o.frame_idx}.pred_masks"] = o.pred_masks.detach().float().clone()
+        taps[f"maskprompt.prompt.{o.frame_idx}.score"] = o.object_score_logits.detach().float().clone()
+        for o in model.propagate_in_video_iterator(msess, start_frame_idx=PROMPT_FRAME):
+            taps[f"maskprompt.fwd.{o.frame_idx}.pred_masks"] = o.pred_masks.detach().float().clone()
+            taps[f"maskprompt.fwd.{o.frame_idx}.score"] = o.object_score_logits.detach().float().clone()
+        for o in model.propagate_in_video_iterator(msess, start_frame_idx=PROMPT_FRAME, reverse=True):
+            taps[f"maskprompt.rev.{o.frame_idx}.pred_masks"] = o.pred_masks.detach().float().clone()
+            taps[f"maskprompt.rev.{o.frame_idx}.score"] = o.object_score_logits.detach().float().clone()
+    md = msess.output_dict_per_obj[mobj]
+    for kind in ("cond_frame_outputs", "non_cond_frame_outputs"):
+        for f, oo in md[kind].items():
+            taps[f"maskstate.{f}.object_pointer"] = oo["object_pointer"].detach().float().clone()
+
+    d = sess.output_dict_per_obj[obj_idx]
+    for kind in ("cond_frame_outputs", "non_cond_frame_outputs"):
+        for f, o in d[kind].items():
+            taps[f"state.{f}.maskmem_features"] = o["maskmem_features"].detach().float().clone()
+            taps[f"state.{f}.maskmem_pos_enc"] = o["maskmem_pos_enc"].detach().float().clone()
+            taps[f"state.{f}.object_pointer"] = o["object_pointer"].detach().float().clone()
+    save_file({k: v.contiguous() for k, v in taps.items()}, out)
+    print(f"wrote {len(taps)} tensors to {out}")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        sys.exit(__doc__)
+    main(sys.argv[1], sys.argv[2])
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index df7dfa877..83fb8ad96 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -5,5 +5,13 @@ edition.workspace = true
 license.workspace = true
 publish = false
 
+[lints]
+workspace = true
+
 [dependencies]
 serde_json = { workspace = true }
+
+chrono = { workspace = true }
+sha2 = "0.10"
+tempfile = "3"
+pkg-config = "0.3"
diff --git a/xtask/src/aep_corpus.rs b/xtask/src/aep_corpus.rs
new file mode 100644
index 000000000..14d1dc1ef
--- /dev/null
+++ b/xtask/src/aep_corpus.rs
@@ -0,0 +1,290 @@
+//! `cargo xtask aep-corpus [--dir DIR]`: fetch the After Effects test corpus of `crates/aep`.
+//!
+//! The corpus is a separate repository (binary `.aep` files stay out of this one). The pin in
+//! `crates/aep/tests/fixtures/corpus.lock` names one commit and the SHA-256 of every file. The
+//! command fetches exactly that commit into a temporary directory, checks every file against the
+//! hashes of the lock file, and only then copies them to `DIR` (default `corpus/aep`, ignored by
+//! git). Any mismatch, missing file or malformed line fails the command and leaves `DIR` alone.
+//! Then run the tests with `EFFECTCRAFT_AEP_FIXTURES=<DIR>` (add `EFFECTCRAFT_AEP_FIXTURES_REQUIRED=1`
+//! so that a missing project fails its test).
+//!
+//! `EFFECTCRAFT_AEP_CORPUS_REPO` replaces the repository URL (a local clone works); the commit and
+//! the hashes still come from the lock file.
+
+use std::path::{Component, Path, PathBuf};
+use std::process::Command;
+
+use sha2::{Digest, Sha256};
+
+const LOCK: &str = "crates/aep/tests/fixtures/corpus.lock";
+const DEFAULT_DIR: &str = "corpus/aep";
+/// Where the fixtures sit inside the corpus repository; the command installs this folder's files.
+const PREFIX: &str = "aep/";
+
+#[derive(Debug, PartialEq, Eq)]
+struct Lock {
+    repo: String,
+    commit: String,
+    /// (SHA-256 as 64 lower-case hex digits, path relative to the corpus root), in file order.
+    files: Vec<(String, String)>,
+}
+
+fn is_hex(s: &str, len: usize) -> bool {
+    s.len() == len && s.bytes().all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+}
+
+/// A path that stays inside its folder: relative, no `..`, no root or drive.
+fn safe_relative(p: &str) -> bool {
+    !p.is_empty() && !p.contains('\\') && Path::new(p).components().all(|c| matches!(c, Component::Normal(_)))
+}
+
+fn parse_lock(text: &str) -> Result<Lock, String> {
+    let (mut repo, mut commit, mut files) = (None, None, Vec::new());
+    for (n, line) in text.lines().enumerate().map(|(i, l)| (i + 1, l.trim())) {
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let bad = |why: &str| format!("{LOCK}:{n}: {why}");
+        if let Some(v) = line.strip_prefix("repo ") {
+            if repo.replace(v.trim().to_string()).is_some() {
+                return Err(bad("`repo` given twice"));
+            }
+        } else if let Some(v) = line.strip_prefix("commit ") {
+            let v = v.trim();
+            if !is_hex(v, 40) {
+                return Err(bad("`commit` must be 40 lower-case hex digits (no branch or tag)"));
+            }
+            if commit.replace(v.to_string()).is_some() {
+                return Err(bad("`commit` given twice"));
+            }
+        } else {
+            let (hash, path) = line.split_once("  ").ok_or_else(|| bad("expected `<sha256>  <path>`"))?;
+            let path = path.trim();
+            if !is_hex(hash, 64) {
+                return Err(bad("hash must be 64 lower-case hex digits"));
+            }
+            if !safe_relative(path) || !path.starts_with(PREFIX) {
+                return Err(bad(&format!("path must be relative, without `..`, and under `{PREFIX}`")));
+            }
+            if files.iter().any(|(_, p)| p == path) {
+                return Err(bad("path listed twice"));
+            }
+            files.push((hash.to_string(), path.to_string()));
+        }
+    }
+    let repo = repo.filter(|r| !r.is_empty()).ok_or_else(|| format!("{LOCK}: no `repo` line"))?;
+    let commit = commit.ok_or_else(|| format!("{LOCK}: no `commit` line"))?;
+    if files.is_empty() {
+        return Err(format!("{LOCK}: no files listed"));
+    }
+    Ok(Lock { repo, commit, files })
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    Sha256::digest(bytes).iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// Reads every listed file from `root` and checks its hash. Returns the bytes in lock order, or
+/// every problem found.
+fn verify(root: &Path, files: &[(String, String)]) -> Result<Vec<Vec<u8>>, String> {
+    let (mut data, mut errors) = (Vec::new(), Vec::new());
+    for (hash, path) in files {
+        match std::fs::read(root.join(path)) {
+            Err(e) => errors.push(format!("{path}: {e}")),
+            Ok(bytes) => {
+                let got = sha256_hex(&bytes);
+                if &got == hash {
+                    data.push(bytes);
+                } else {
+                    errors.push(format!("{path}: SHA-256 is {got}, the lock file says {hash}"));
+                }
+            }
+        }
+    }
+    if errors.is_empty() { Ok(data) } else { Err(errors.join("\n")) }
+}
+
+/// Copies verified files below `dest` (the `aep/` prefix dropped), via a temporary name so a
+/// failure never leaves a half-written file under its real name.
+fn install(dest: &Path, files: &[(String, String)], data: &[Vec<u8>]) -> Result<(), String> {
+    for ((_, path), bytes) in files.iter().zip(data) {
+        let rel = path.strip_prefix(PREFIX).unwrap_or(path);
+        let target = dest.join(rel);
+        if let Some(dir) = target.parent() {
+            std::fs::create_dir_all(dir).map_err(|e| format!("{}: {e}", dir.display()))?;
+        }
+        let tmp = target.with_extension("part");
+        std::fs::write(&tmp, bytes).map_err(|e| format!("{}: {e}", tmp.display()))?;
+        std::fs::rename(&tmp, &target).map_err(|e| format!("{}: {e}", target.display()))?;
+    }
+    Ok(())
+}
+
+/// True when every listed file is already in `dest` with the right hash.
+fn up_to_date(dest: &Path, files: &[(String, String)]) -> bool {
+    files.iter().all(|(hash, path)| {
+        let rel = path.strip_prefix(PREFIX).unwrap_or(path);
+        std::fs::read(dest.join(rel)).is_ok_and(|b| &sha256_hex(&b) == hash)
+    })
+}
+
+fn git(dir: &Path, args: &[&str]) -> Result<(), String> {
+    let out = Command::new("git")
+        .current_dir(dir)
+        .args(["-c", "core.autocrlf=false", "-c", "core.safecrlf=false"])
+        .args(args)
+        .output()
+        .map_err(|e| format!("git {}: {e}", args.first().copied().unwrap_or("")))?;
+    if out.status.success() { Ok(()) } else { Err(format!("git {}: {}", args.first().copied().unwrap_or(""), String::from_utf8_lossy(&out.stderr).trim())) }
+}
+
+/// Fetches exactly `commit` of `repo` into `into` (an empty directory).
+fn fetch(repo: &str, commit: &str, into: &Path) -> Result<(), String> {
+    git(into, &["init", "-q"])?;
+    git(into, &["fetch", "-q", "--depth", "1", repo, commit])?;
+    git(into, &["checkout", "-q", "--detach", "FETCH_HEAD"])?;
+    let head = Command::new("git").current_dir(into).args(["rev-parse", "HEAD"]).output().map_err(|e| format!("git rev-parse: {e}"))?;
+    let head = String::from_utf8_lossy(&head.stdout).trim().to_string();
+    if head == commit { Ok(()) } else { Err(format!("fetched {head}, not the pinned {commit}")) }
+}
+
+pub fn run(root: &Path, args: &[String]) -> Result<(), String> {
+    let mut dir = PathBuf::from(DEFAULT_DIR);
+    let mut it = args.iter();
+    while let Some(a) = it.next() {
+        match a.as_str() {
+            "--dir" => dir = PathBuf::from(it.next().ok_or("--dir needs a folder")?),
+            other => return Err(format!("unknown argument `{other}`; usage: cargo xtask aep-corpus [--dir DIR]")),
+        }
+    }
+    let dest = if dir.is_absolute() { dir } else { root.join(dir) };
+    let text = std::fs::read_to_string(root.join(LOCK)).map_err(|e| format!("{LOCK}: {e}"))?;
+    let lock = parse_lock(&text)?;
+    if up_to_date(&dest, &lock.files) {
+        println!("aep-corpus: {} files in {} already match the pin {}", lock.files.len(), dest.display(), &lock.commit[..12]);
+    } else {
+        let repo = std::env::var("EFFECTCRAFT_AEP_CORPUS_REPO").ok().filter(|r| !r.is_empty()).unwrap_or_else(|| lock.repo.clone());
+        let tmp = tempfile::Builder::new().prefix("effectcraft-aep-corpus-").tempdir().map_err(|e| format!("temporary folder: {e}"))?;
+        fetch(&repo, &lock.commit, tmp.path())?;
+        let data = verify(tmp.path(), &lock.files)?;
+        install(&dest, &lock.files, &data)?;
+        println!("aep-corpus: {} files verified against {} and installed in {}", lock.files.len(), &lock.commit[..12], dest.display());
+    }
+    println!("run the tests with:\n  EFFECTCRAFT_AEP_FIXTURES={} EFFECTCRAFT_AEP_FIXTURES_REQUIRED=1 cargo test -p effectcraft-aep", dest.display());
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const H: &str = "4a51318c4b37fa95e2c02682183d3982fdfbe1870dc50ba729b776d1826f982e";
+    const C: &str = "72539568193239fadb3ccd0d7e70f6cd622a650a";
+
+    fn lock(body: &str) -> String {
+        format!("# c\nrepo https://example.org/c.git\ncommit {C}\n{body}")
+    }
+
+    #[test]
+    fn parses_a_lock_file() {
+        let l = parse_lock(&lock(&format!("{H}  aep/a.aep\n"))).unwrap();
+        assert_eq!(l.repo, "https://example.org/c.git");
+        assert_eq!(l.commit, C);
+        assert_eq!(l.files, vec![(H.to_string(), "aep/a.aep".to_string())]);
+    }
+
+    #[test]
+    fn rejects_malformed_locks() {
+        for (body, why) in [
+            (format!("{H}  ../x.aep\n"), "parent folder"),
+            (format!("{H}  /abs/x.aep\n"), "absolute path"),
+            (format!("{H}  aep/../../x.aep\n"), "escaping path"),
+            (format!("{H}  other/x.aep\n"), "outside aep/"),
+            (format!("{H}  aep/a.aep\n{H}  aep/a.aep\n"), "duplicate"),
+            ("abc  aep/a.aep\n".to_string(), "short hash"),
+            (format!("{}  aep/a.aep\n", H.to_uppercase()), "upper-case hash"),
+            (format!("{H} aep/a.aep\n"), "one space"),
+            (String::new(), "no files"),
+        ] {
+            assert!(parse_lock(&lock(&body)).is_err(), "{why} must be rejected");
+        }
+        assert!(parse_lock(&format!("repo r\ncommit main\n{H}  aep/a.aep\n")).is_err(), "a branch name is not a pin");
+        assert!(parse_lock(&format!("commit {C}\n{H}  aep/a.aep\n")).is_err(), "no repo");
+        assert!(parse_lock(&format!("repo r\n{H}  aep/a.aep\n")).is_err(), "no commit");
+    }
+
+    #[test]
+    fn the_checked_in_lock_file_is_valid() {
+        let text = std::fs::read_to_string(crate::root().join(LOCK)).unwrap();
+        let l = parse_lock(&text).unwrap();
+        assert_eq!(l.files.len(), 20);
+        assert!(l.files.windows(2).all(|w| w[0].1 < w[1].1), "files sorted by path");
+    }
+
+    #[test]
+    fn hashes_match_known_vectors() {
+        assert_eq!(sha256_hex(b""), "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+        assert_eq!(sha256_hex(b"abc"), "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
+    }
+
+    fn corpus(files: &[(&str, &[u8])]) -> (tempfile::TempDir, Vec<(String, String)>) {
+        let dir = tempfile::tempdir().unwrap();
+        let mut list = Vec::new();
+        for (path, bytes) in files {
+            let full = dir.path().join(path);
+            std::fs::create_dir_all(full.parent().unwrap()).unwrap();
+            std::fs::write(full, bytes).unwrap();
+            list.push((sha256_hex(bytes), (*path).to_string()));
+        }
+        (dir, list)
+    }
+
+    #[test]
+    fn verify_accepts_matching_files_and_install_copies_them() {
+        let (src, list) = corpus(&[("aep/a.aep", b"one"), ("aep/inputs/p.ffx", b"two")]);
+        let data = verify(src.path(), &list).unwrap();
+        let dest = tempfile::tempdir().unwrap();
+        install(dest.path(), &list, &data).unwrap();
+        assert_eq!(std::fs::read(dest.path().join("a.aep")).unwrap(), b"one");
+        assert_eq!(std::fs::read(dest.path().join("inputs/p.ffx")).unwrap(), b"two");
+        assert!(up_to_date(dest.path(), &list));
+    }
+
+    #[test]
+    fn verify_reports_a_changed_and_a_missing_file_and_installs_nothing() {
+        let (src, mut list) = corpus(&[("aep/a.aep", b"one"), ("aep/b.aep", b"two")]);
+        std::fs::write(src.path().join("aep/a.aep"), b"changed").unwrap();
+        list.push((H.to_string(), "aep/gone.aep".to_string()));
+        let err = verify(src.path(), &list).unwrap_err();
+        assert!(err.contains("aep/a.aep: SHA-256"), "{err}");
+        assert!(err.contains("aep/gone.aep"), "{err}");
+        assert!(!err.contains("aep/b.aep"), "{err}");
+    }
+
+    #[test]
+    fn up_to_date_is_false_for_missing_or_changed_files() {
+        let (_src, list) = corpus(&[("aep/a.aep", b"one")]);
+        let dest = tempfile::tempdir().unwrap();
+        assert!(!up_to_date(dest.path(), &list), "missing");
+        std::fs::write(dest.path().join("a.aep"), b"other").unwrap();
+        assert!(!up_to_date(dest.path(), &list), "changed");
+    }
+
+    #[test]
+    fn fetch_checks_out_exactly_the_pinned_commit() {
+        let repo = tempfile::tempdir().unwrap();
+        git(repo.path(), &["init", "-q"]).unwrap();
+        std::fs::create_dir_all(repo.path().join("aep")).unwrap();
+        std::fs::write(repo.path().join("aep/a.aep"), b"v1").unwrap();
+        git(repo.path(), &["add", "."]).unwrap();
+        git(repo.path(), &["-c", "user.name=t", "-c", "user.email=t@example.org", "commit", "-q", "-m", "one"]).unwrap();
+        let rev =
+            |d: &Path| String::from_utf8(Command::new("git").current_dir(d).args(["rev-parse", "HEAD"]).output().unwrap().stdout).unwrap().trim().to_string();
+        let first = rev(repo.path());
+        std::fs::write(repo.path().join("aep/a.aep"), b"v2").unwrap();
+        git(repo.path(), &["-c", "user.name=t", "-c", "user.email=t@example.org", "commit", "-q", "-am", "two"]).unwrap();
+        let into = tempfile::tempdir().unwrap();
+        fetch(repo.path().to_str().unwrap(), &first, into.path()).unwrap();
+        assert_eq!(std::fs::read(into.path().join("aep/a.aep")).unwrap(), b"v1", "the pinned commit, not the newer one");
+    }
+}
diff --git a/xtask/src/bench.rs b/xtask/src/bench.rs
index b368d942f..96d171d2f 100644
--- a/xtask/src/bench.rs
+++ b/xtask/src/bench.rs
@@ -155,7 +155,7 @@ pub fn run(root: &Path, args: &[String]) -> Result<(), String> {
                 } else {
                     eprintln!("bench: {} {kind}", sc.name);
                 }
-                let row = measure(&bin, &dir, sc, kind, frames, &o.format, timer, &ctx)?;
+                let row = measure(&bin, &dir, sc, &Measurement { kind, frames, format: &o.format }, timer, &ctx)?;
                 append_line(&results_path, &row)?;
                 rows.push(row);
             }
@@ -427,15 +427,18 @@ fn footage_cmds(seq_first: &Path, clip: &Path, still: &Path) -> Cmds {
     c
 }
 
-/// Run `cmds` with `effectcraft-cli --empty run … --save-as out`.
+/// Run `cmds` with `effectcraft-cli --empty run --args-file … --save-as out`: a file, because the
+/// `layers` scenario is longer than a Windows command line (32 767 characters).
 fn build_project(bin: &Path, cmds: &Cmds, out: &Path) -> Result<(), String> {
-    let mut cmd = Command::new(bin);
-    cmd.arg("--empty").arg("run");
+    let mut lines = String::new();
     for (id, params) in cmds {
-        cmd.arg(id).arg(params.to_string());
+        lines.push_str(&format!("{id}\n{params}\n"));
     }
-    cmd.arg("--save-as").arg(out);
-    cli(&mut cmd)
+    let args = out.with_extension("args");
+    std::fs::write(&args, lines).map_err(|e| format!("{}: {e}", args.display()))?;
+    let r = cli(Command::new(bin).arg("--empty").arg("run").arg("--args-file").arg(&args).arg("--save-as").arg(out));
+    let _ = std::fs::remove_file(&args);
+    r
 }
 
 /// Run a CLI command quietly; on failure, the tail of its output is the error.
@@ -655,23 +658,35 @@ fn iso_now() -> String {
     utc(unix_now())
 }
 
-/// `YYYY-MM-DD HH:MM UTC` for a Unix time (civil-from-days, no time zone database).
+/// `YYYY-MM-DD HH:MM UTC` for a Unix time. Years far outside chrono's own range are preserved
+/// (the old hand-rolled conversion kept them) rather than collapsing to the epoch.
 fn utc(t: u64) -> String {
-    let (days, secs) = ((t / 86_400) as i64, t % 86_400);
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + i64::from(m <= 2);
-    format!("{y:04}-{m:02}-{d:02} {:02}:{:02} UTC", secs / 3600, secs % 3600 / 60)
+    use chrono::Datelike;
+    // Reduce by whole 400-year Gregorian cycles (146_097 days) into chrono's range, convert the
+    // remainder with chrono, and carry the year back; `t` is `u64`, so `days` fits an `i64`.
+    let (days, sod) = ((t / 86_400) as i64, (t % 86_400) as i64);
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = u32::try_from(sod).ok().and_then(|s| chrono::NaiveTime::from_num_seconds_from_midnight_opt(s, 0));
+    let (y, dt) = match (date, time) {
+        (Some(d), Some(ti)) => {
+            let yy = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(yy).unwrap_or(i64::MAX), d.and_time(ti))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()),
+    };
+    // `{:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{}", dt.format("%m-%d %H:%M UTC"))
 }
 
-#[allow(clippy::too_many_arguments)]
-fn measure(bin: &Path, dir: &Path, sc: &Scenario, kind: &str, frames: u32, format: &str, timer: TimeTool, ctx: &RunContext) -> Result<Value, String> {
+struct Measurement<'a> {
+    kind: &'a str,
+    frames: u32,
+    format: &'a str,
+}
+
+fn measure(bin: &Path, dir: &Path, sc: &Scenario, measurement: &Measurement<'_>, timer: TimeTool, ctx: &RunContext) -> Result<Value, String> {
+    let Measurement { kind, frames, format } = *measurement;
     let out_dir = dir.join("out").join(format!("{}-{kind}", sc.name.replace(['/', '\\', ' '], "_")));
     let _ = std::fs::remove_dir_all(&out_dir);
     std::fs::create_dir_all(&out_dir).map_err(|e| format!("{}: {e}", out_dir.display()))?;
@@ -1095,6 +1110,17 @@ fn compare_table(old: &BTreeMap<String, Value>, new: &BTreeMap<String, Value>) -
 mod tests {
     use super::*;
 
+    #[test]
+    fn utc_preserves_out_of_range_years() {
+        assert_eq!(utc(0), "1970-01-01 00:00 UTC");
+        assert_eq!(utc(1_700_000_000), "2023-11-14 22:13 UTC");
+        // Years far outside chrono's own range are preserved (the old hand-rolled conversion kept
+        // them) rather than collapsing to the epoch.
+        assert_eq!(utc(253_402_300_800), "10000-01-01 00:00 UTC");
+        assert_eq!(utc(10_000_000_000_000), "318857-05-20 17:46 UTC");
+        assert_eq!(utc(u64::MAX), "584554051223-11-09 07:00 UTC");
+    }
+
     const BSD: &str = "        0.33 real         0.67 user         0.15 sys
            743882752  maximum resident set size
                    0  average shared memory size
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index e79ac63a9..24023ee88 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -1,4 +1,4 @@
-//! Workspace automation: `cargo xtask <layers|assets|pdf-deps|wasm|web|ico|ci>`.
+//! Workspace automation: `cargo xtask <layers|assets|pdf-deps|aep-corpus|wasm|web|ico|ci>`.
 //!
 //! - `layers`: enforces the dependency layering of `docs/architecture.md` §1 (downward-only edges,
 //!   listed same-layer edges, no UI/OS crates below L5).
@@ -8,11 +8,15 @@
 //!   `<target>/web/dist` with `wasm-bindgen` (docs/web.md); `--serve` serves it on localhost.
 //! - `assets`: every asset file (image, icon, font, LUT, audio, video…) has a complete
 //!   `<file>.attribution` sidecar and an entry in `ATTRIBUTION.md` (AGENTS.md §1).
+//! - `aep-corpus [--dir DIR]`: fetch the After Effects test corpus at the commit pinned in
+//!   `crates/aep/tests/fixtures/corpus.lock`, verify every file's SHA-256, install into `corpus/aep`.
 //! - `ico <out.ico> <in.png>…`: pack PNGs into a Windows `.ico` (used by `packaging/icons.sh`).
-//! - `ci`: fmt check, clippy -D warnings, tests, PDF dependency policy, layers, assets, wasm.
+//! - `ci`: fmt check, clippy -D warnings, tests (`cargo nextest run` when installed) and doctests,
+//!   PDF dependency policy, layers, assets, wasm. Everything builds in the dev profile.
 //! - `bench [--bin CLI] [--quick] [--compare OLD.jsonl] …`: render benchmark of generated scenarios
 //!   (memory, CPU, wall time) into `target/bench/results.jsonl` (`bench.rs`, docs/testing.md).
 
+mod aep_corpus;
 mod bench;
 mod ico;
 mod pdf_deps;
@@ -36,6 +40,7 @@ const LAYERS: &[(&str, u8)] = &[
     ("keyframe", 1),
     ("path", 1),
     ("psd", 1),
+    ("aep", 3),
     ("segment", 1),
     ("project", 2),
     ("text", 2),
@@ -49,9 +54,11 @@ const LAYERS: &[(&str, u8)] = &[
     ("expr", 3),
     ("export", 3),
     ("gpu", 3),
+    ("sam2", 3),
     ("lottie", 3),
     ("format", 3),
     ("plugin", 3),
+    ("helper-host", 3),
     ("interchange", 3),
     ("engine", 4),
     ("script", 4),
@@ -160,7 +167,7 @@ fn layers() -> Result<(), String> {
 const ASSET_EXT: &[&str] = &[
     "png", "jpg", "jpeg", "gif", "webp", "svg", "ico", "icns", "bmp", "tif", "tiff", "heic", "avif", "exr", "ttf", "otf", "ttc", "woff", "woff2", "cube",
     "3dl", "lut", "look", "wav", "mp3", "aac", "flac", "ogg", "opus", "m4a", "aif", "aiff", "mp4", "mov", "m4v", "mkv", "webm", "avi", "mxf", "psd", "ai",
-    "eps", "pdf", "prproj", "ffx", "prfpset", "mogrt", "aep",
+    "eps", "pdf", "prproj", "ffx", "prfpset", "mogrt", "aep", "aepx",
 ];
 
 /// Sidecar fields that must be present and non-empty.
@@ -175,7 +182,7 @@ fn repo_files() -> Result<Vec<String>, String> {
 }
 
 fn is_asset(path: &str) -> bool {
-    std::path::Path::new(path).extension().and_then(|e| e.to_str()).is_some_and(|e| ASSET_EXT.contains(&e.to_ascii_lowercase().as_str()))
+    std::path::Path::new(path).extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| ASSET_EXT.contains(&e.to_ascii_lowercase().as_str()))
 }
 
 fn assets() -> Result<(), String> {
@@ -235,7 +242,7 @@ const WEB_CRATES: &[&str] = &["effectcraft-ui-egui", "effectcraft-web"];
 fn wasm() -> Result<(), String> {
     let md = metadata()?;
     let mut cmd = Command::new(env!("CARGO"));
-    cmd.args(["check", "--target", "wasm32-unknown-unknown"]);
+    cmd.args(["check", "--target", "wasm32-unknown-unknown", "--keep-going"]);
     let mut n = 0;
     for (name, _) in workspace_crates(&md) {
         if layer_of(&name).is_some_and(|l| l <= 4) || WEB_CRATES.contains(&name.as_str()) {
@@ -383,7 +390,7 @@ fn serve_dir(dir: &std::path::Path, port: u16) -> Result<(), String> {
                 Ok(b) => ("200 OK", b),
                 Err(_) => ("404 Not Found", b"not found".to_vec()),
             };
-            let mime = match file.extension().and_then(|e| e.to_str()).unwrap_or("") {
+            let mime = match file.extension().and_then(std::ffi::OsStr::to_str).unwrap_or("") {
                 "html" => "text/html; charset=utf-8",
                 "js" => "text/javascript",
                 "wasm" => "application/wasm",
@@ -406,15 +413,139 @@ fn serve_dir(dir: &std::path::Path, port: u16) -> Result<(), String> {
     Ok(())
 }
 
-fn ci() -> Result<(), String> {
+/// The guidance printed when the ALSA pkg-config package is missing. Split out so the tests can
+/// check the package names without needing a machine that is actually missing them.
+#[cfg(target_os = "linux")]
+fn audio_backend_missing_hint(pkg_config_stderr: Option<&str>) -> String {
+    let mut hint = String::from(
+        "Linux audio needs the ALSA development package, and pkg-config cannot find it.\n\
+         The desktop app plays preview sound through cpal, whose alsa-sys dependency asks\n\
+         pkg-config for `alsa`; without the package the build dies minutes later with an\n\
+         unrelated-looking linker error.\n\
+         \n\
+         Fedora:         sudo dnf install alsa-lib-devel\n\
+         Debian/Ubuntu:  sudo apt install libasound2-dev\n\
+         Arch:           sudo pacman -S alsa-lib\n\
+         \n\
+         Install one of those and run `cargo xtask ci` again. If you cannot install it, point\n\
+         PKG_CONFIG_PATH at a directory holding an `alsa.pc` whose Libs line names your system's\n\
+         libasound (usually `libasound.so.2`); every CI run will need that variable set.",
+    );
+    if let Some(stderr) = pkg_config_stderr {
+        hint.push_str("\n\npkg-config said: ");
+        hint.push_str(stderr);
+    }
+    hint
+}
+
+/// `cargo xtask ci` builds the desktop app on the host, so on Linux it needs a usable ALSA
+/// pkg-config package before the build dies minutes later at link time. The probe goes through
+/// the same `pkg-config` crate alsa-sys's build script uses, so the executable and search-path
+/// lookup match by construction: `PKG_CONFIG` and its target-scoped variants, then `pkg-config`
+/// on `PATH` with a `pkgconf` fallback, plus the scoped `PKG_CONFIG_PATH`/`LIBDIR`/`SYSROOT_DIR`.
+/// A probe that ran and said no is "ALSA missing"; one that could not run is reported separately,
+/// so a machine with only `pkgconf` does not fail a build that would succeed.
+#[cfg(target_os = "linux")]
+fn audio_backend() -> Result<(), String> {
+    // cargo_metadata off: xtask is not a build script, so the crate's rerun-if-env lines would
+    // only clutter the ci log.
+    match pkg_config::Config::new().cargo_metadata(false).probe("alsa") {
+        Ok(_) => Ok(()),
+        Err(pkg_config::Error::ProbeFailure { output, .. }) | Err(pkg_config::Error::Failure { output, .. }) => {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            let stderr = stderr.trim();
+            Err(audio_backend_missing_hint((!stderr.is_empty()).then_some(stderr)))
+        }
+        Err(e) => Err(format!(
+            "The pkg-config probe for `alsa` could not be run: {e}. Install pkg-config (or pkgconf), \
+             or point PKG_CONFIG at a working one — it is the same lookup alsa-sys's pkg-config \
+             dependency performs."
+        )),
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+fn audio_backend() -> Result<(), String> {
+    Ok(())
+}
+
+/// Lib, bin and integration tests (examples aren't linked; clippy checked them), then doctests,
+/// which nextest doesn't run.
+///
+/// `effectcraft-gpu`'s tests share one device and serialise on a lock inside their process (several
+/// devices at once crash software Vulkan and GL), so they run in one `cargo test` process instead of
+/// nextest's process per test.
+///
+/// Each run goes ahead when an earlier one fails; the error names every run that failed.
+fn tests() -> Result<(), String> {
     let cargo = env!("CARGO");
-    run(Command::new(cargo).args(["fmt", "--check"]))?;
-    run(Command::new(cargo).args(["clippy", "--workspace", "--all-targets", "--release", "--", "-D", "warnings"]))?;
-    run(Command::new(cargo).args(["test", "--workspace", "--release"]))?;
-    pdf_deps::run(&root())?;
-    layers()?;
-    assets()?;
-    wasm()
+    let targets = ["--workspace", "--lib", "--bins", "--tests", "--no-fail-fast"];
+    let nextest = Command::new(cargo).args(["nextest", "--version"]).output().is_ok_and(|o| o.status.success());
+    let mut runs = Vec::new();
+    if nextest {
+        runs.push(run(Command::new(cargo).args(["nextest", "run"]).args(targets).args(["-E", "not package(effectcraft-gpu)"])));
+        // effectcraft-gpu's tests share one device, so they run in one libtest process: the
+        // binary nextest just built (`cargo test -p effectcraft-gpu` would rebuild ~2 minutes).
+        runs.push(lib_test_binary("effectcraft-gpu").and_then(|mut c| run(&mut c)));
+    } else {
+        println!("cargo-nextest not found, running cargo test (install: cargo install cargo-nextest --locked)");
+        runs.push(run(Command::new(cargo).arg("test").args(targets)));
+    }
+    // The test runs above hide a passing test's output, so the always-passing report runs again
+    // with --nocapture, from the binary already built.
+    runs.push(lib_test_binary("effectcraft-ui-egui").and_then(|mut c| run(c.args(["missing_translations_report", "--nocapture"]))));
+    runs.push(run(Command::new(cargo).args(["test", "--workspace", "--doc", "--no-fail-fast"])));
+    let failed: Vec<String> = runs.into_iter().filter_map(Result::err).collect();
+    if failed.is_empty() { Ok(()) } else { Err(failed.join("; ")) }
+}
+
+/// A command running `package`'s lib test binary from the test build above, the way `cargo test`
+/// runs it (from the package directory), found with `--no-run` and the same workspace selection
+/// so nothing rebuilds: `cargo test -p <package>` resolves features for that package alone and
+/// recompiles much of the workspace.
+fn lib_test_binary(package: &str) -> Result<Command, String> {
+    let out = Command::new(env!("CARGO"))
+        .args(["test", "--workspace", "--lib", "--bins", "--tests", "--no-run", "--message-format=json-render-diagnostics"])
+        .stderr(std::process::Stdio::inherit())
+        .output()
+        .map_err(|e| format!("cargo test --no-run: {e}"))?;
+    if !out.status.success() {
+        return Err(format!("cargo test --no-run: exited with {}", out.status));
+    }
+    let lib = package.replace('-', "_");
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter_map(|line| serde_json::from_str::<Value>(line).ok())
+        .find(|m| {
+            m["reason"] == "compiler-artifact"
+                && m["profile"]["test"] == true
+                && m["target"]["name"] == lib.as_str()
+                && m["target"]["kind"].as_array().is_some_and(|k| k.iter().any(|k| k == "lib"))
+        })
+        .and_then(|m| {
+            let mut c = Command::new(m["executable"].as_str()?);
+            c.current_dir(std::path::Path::new(m["manifest_path"].as_str()?).parent()?);
+            Some(c)
+        })
+        .ok_or_else(|| format!("no {package} lib test binary in the test build"))
+}
+
+type Stage = fn() -> Result<(), String>;
+
+/// Every stage runs even when an earlier one fails, so one run reports all the problems.
+fn ci() -> Result<(), String> {
+    let stages: [(&str, Stage); 8] = [
+        ("audio backend", audio_backend),
+        ("fmt", || run(Command::new(env!("CARGO")).args(["fmt", "--check"]))),
+        ("clippy", || run(Command::new(env!("CARGO")).args(["clippy", "--workspace", "--all-targets", "--", "-D", "warnings"]))),
+        ("tests", tests),
+        ("pdf-deps", || pdf_deps::run(&root())),
+        ("layers", layers),
+        ("assets", assets),
+        ("wasm", wasm),
+    ];
+    let failed: Vec<&str> = stages.iter().filter_map(|(name, stage)| stage().map_err(|e| eprintln!("ci: {name} failed: {e}")).err().map(|()| *name)).collect();
+    if failed.is_empty() { Ok(()) } else { Err(format!("ci failed: {}", failed.join(", "))) }
 }
 
 fn main() -> ExitCode {
@@ -424,7 +555,9 @@ fn main() -> ExitCode {
         "wasm" => wasm(),
         "assets" => assets(),
         "pdf-deps" => pdf_deps::run(&root()),
+        "aep-corpus" => aep_corpus::run(&root(), &std::env::args().skip(2).collect::<Vec<_>>()),
         "ci" => ci(),
+        "audio-backend" => audio_backend(),
         "web" => web(&std::env::args().skip(2).collect::<Vec<_>>()),
         "bench" => bench::run(&root(), &std::env::args().skip(2).collect::<Vec<_>>()),
         "ico" => {
@@ -435,7 +568,7 @@ fn main() -> ExitCode {
             let rest: Vec<String> = std::env::args().skip(2).collect();
             version::run(&root(), &rest.iter().map(String::as_str).collect::<Vec<_>>())
         }
-        _ => Err("usage: cargo xtask <layers|assets|pdf-deps|wasm|web [--dev] [--serve PORT]|ico OUT.ico IN.png…|version [set X.Y.Z]|ci|bench [--bin CLI] [--quick] [--project F --comp C] [--compare OLD.jsonl] (--help)>".into()),
+        _ => Err("usage: cargo xtask <layers|assets|pdf-deps|aep-corpus [--dir DIR]|wasm|web [--dev] [--serve PORT]|ico OUT.ico IN.png…|version [set X.Y.Z]|ci|audio-backend|bench [--bin CLI] [--quick] [--project F --comp C] [--compare OLD.jsonl] (--help)>".into()),
     };
     match r {
         Ok(()) => ExitCode::SUCCESS,
@@ -450,3 +583,22 @@ fn main() -> ExitCode {
 pub fn root() -> std::path::PathBuf {
     std::path::Path::new(env!("CARGO_MANIFEST_DIR")).parent().expect("xtask has a parent dir").to_path_buf()
 }
+
+#[cfg(all(test, target_os = "linux"))]
+mod tests {
+    use super::audio_backend_missing_hint;
+
+    #[test]
+    fn alsa_missing_names_the_package_for_each_distro() {
+        let e = audio_backend_missing_hint(None);
+        for want in ["alsa-lib-devel", "libasound2-dev", "alsa-lib", "pkg-config", "PKG_CONFIG_PATH"] {
+            assert!(e.contains(want), "hint lost `{want}`:\n{e}");
+        }
+    }
+
+    #[test]
+    fn alsa_missing_appends_pkg_config_s_own_detail() {
+        let e = audio_backend_missing_hint(Some("Package 'alsa' not found"));
+        assert!(e.contains("pkg-config said: Package 'alsa' not found"), "detail lost:\n{e}");
+    }
+}
diff --git a/xtask/src/pdf_deps.rs b/xtask/src/pdf_deps.rs
index d7f880796..78694c7a6 100644
--- a/xtask/src/pdf_deps.rs
+++ b/xtask/src/pdf_deps.rs
@@ -5,8 +5,8 @@ use std::process::Command;
 
 use serde_json::Value;
 
-const REV: &str = "ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d";
-const PACKAGES: &[(&str, &str)] = &[("craft-pdf", "0.1.0"), ("hayro-syntax", "0.7.2")];
+const REV: &str = "92d392cff132eaf53e13afff77f38b5c11b73aa0";
+const PACKAGES: &[(&str, &str)] = &[("craft-pdf", "0.1.0"), ("hayro-syntax", "0.7.2"), ("hayro-jbig2", "0.3.0")];
 
 pub fn run(root: &Path) -> Result<(), String> {
     let output = Command::new(std::env::var_os("CARGO").unwrap_or_else(|| "cargo".into()))
diff --git a/xtask/tests/bench.rs b/xtask/tests/bench.rs
index 919b5b94c..3b2ad5722 100644
--- a/xtask/tests/bench.rs
+++ b/xtask/tests/bench.rs
@@ -1,23 +1,23 @@
 //! Regression gates must fail when benchmark evidence is corrupt or incomplete.
 use serde_json::{Value, json};
-use std::path::PathBuf;
 use std::process::{Command, Output};
 
-struct ResultsDir(PathBuf);
+/// Nextest archives relocate binaries; plain Cargo keeps the compile-time path valid.
+fn binary() -> std::ffi::OsString {
+    std::env::var_os("NEXTEST_BIN_EXE_xtask").unwrap_or_else(|| env!("CARGO_BIN_EXE_xtask").into())
+}
+
+struct ResultsDir(tempfile::TempDir);
 impl ResultsDir {
     fn new() -> Self {
-        use std::sync::atomic::{AtomicU64, Ordering};
-        static NEXT: AtomicU64 = AtomicU64::new(0);
-        let dir = std::env::temp_dir().join(format!("effectcraft-bench-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
-        std::fs::create_dir_all(&dir).unwrap();
-        Self(dir)
+        Self(tempfile::Builder::new().prefix("effectcraft-bench-").tempdir().unwrap())
     }
     fn compare(&self, old: &str, new: &str, gate: bool) -> Output {
-        let baseline = self.0.join("baseline.jsonl");
-        let candidate = self.0.join("candidate.jsonl");
+        let baseline = self.0.path().join("baseline.jsonl");
+        let candidate = self.0.path().join("candidate.jsonl");
         std::fs::write(&baseline, old).unwrap();
         std::fs::write(&candidate, new).unwrap();
-        let mut command = Command::new(env!("CARGO_BIN_EXE_xtask"));
+        let mut command = Command::new(binary());
         command.args(["bench", "--compare"]).arg(baseline).arg("--with").arg(candidate);
         if gate {
             command.args(["--fail-over", "5"]);
@@ -25,11 +25,6 @@ impl ResultsDir {
         command.output().unwrap()
     }
 }
-impl Drop for ResultsDir {
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
 
 fn row(scenario: &str, ok: bool) -> Value {
     json!({"scenario": scenario, "run": "full", "ok": ok,
diff --git a/xtask/tests/it/audio_probe.rs b/xtask/tests/it/audio_probe.rs
new file mode 100644
index 000000000..d984c7637
--- /dev/null
+++ b/xtask/tests/it/audio_probe.rs
@@ -0,0 +1,126 @@
+//! The Linux audio-backend preflight against fake pkg-config tools.
+//!
+//! The probe resolves its executable through the pkg-config crate, which reads the environment,
+//! so the fake-tool scenarios run the real `xtask audio-backend` binary in a child process with a
+//! controlled environment: `Command::env` changes only the child's environment, so the tests need
+//! no global env mutation and stay parallel-safe.
+
+use std::ffi::OsStr;
+use std::path::PathBuf;
+use std::process::{Command, Output};
+
+/// A scratch directory holding the fake tools for one scenario: `dir` is the child's `PATH`,
+/// `off_path` holds executables reachable only by an explicit `*_PKG_CONFIG` override.
+struct FakeTools {
+    dir: PathBuf,
+    off_path: PathBuf,
+}
+
+impl FakeTools {
+    fn new(tag: &str) -> Self {
+        let base = std::env::temp_dir().join(format!("effectcraft-xtask-audio-{tag}-{}", std::process::id()));
+        let dir = base.join("bin");
+        let off_path = base.join("off-path");
+        std::fs::create_dir_all(&dir).expect("create PATH dir");
+        std::fs::create_dir_all(&off_path).expect("create off-PATH dir");
+        Self { dir, off_path }
+    }
+
+    /// Write a plain (not executable) file.
+    fn file(&self, on_path: bool, name: &str, body: &str) -> PathBuf {
+        let path = if on_path { self.dir.clone() } else { self.off_path.clone() }.join(name);
+        std::fs::write(&path, body).expect("write fake tool");
+        path
+    }
+
+    /// Write an executable shell script.
+    fn script(&self, on_path: bool, name: &str, body: &str) -> PathBuf {
+        use std::os::unix::fs::PermissionsExt;
+        let path = self.file(on_path, name, body);
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o755)).expect("chmod fake tool");
+        path
+    }
+
+    /// A fake `pkgconf` that answers as alsa 1.2.11 linking -lasound.
+    fn working_pkgconf(&self, on_path: bool) -> PathBuf {
+        self.script(on_path, "pkgconf", "#!/bin/sh\ncase \" $* \" in\n  *\" --modversion \"*) echo 1.2.11 ;;\n  *) echo -lasound ;;\nesac\n")
+    }
+}
+
+impl Drop for FakeTools {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+        let _ = std::fs::remove_dir_all(&self.off_path);
+    }
+}
+
+/// Run the built `xtask audio-backend` with `dir` as the only `PATH`, the given variables set,
+/// and every variable the probe reads otherwise cleared, so a developer's own environment
+/// cannot leak into the scenario.
+fn run_audio_backend(tools: &FakeTools, set: &[(&str, &OsStr)]) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_xtask"))
+        .arg("audio-backend")
+        .env("PATH", &tools.dir)
+        .env_remove("PKG_CONFIG")
+        .env_remove("PKG_CONFIG_PATH")
+        .env_remove("PKG_CONFIG_LIBDIR")
+        .env_remove("PKG_CONFIG_SYSROOT_DIR")
+        .env_remove("PKG_CONFIG_ALLOW_CROSS")
+        .env_remove("ALSA_NO_PKG_CONFIG")
+        .env_remove("HOST_PKG_CONFIG")
+        .env_remove("TARGET_PKG_CONFIG")
+        .env_remove("HOST")
+        .env_remove("TARGET")
+        .envs(set.iter().copied())
+        .output()
+        .expect("run xtask audio-backend")
+}
+
+#[test]
+fn a_host_with_only_pkgconf_still_finds_alsa() {
+    // The reviewed case: PKG_CONFIG unset, no pkg-config on PATH, only pkgconf. The pkg-config
+    // crate alsa-sys uses falls back to pkgconf, so the stage must stay green.
+    let tools = FakeTools::new("pkgconf-only");
+    tools.working_pkgconf(true);
+    let out = run_audio_backend(&tools, &[]);
+    assert!(out.status.success(), "pkgconf-only host must pass:\n{}", String::from_utf8_lossy(&out.stderr));
+}
+
+#[test]
+fn a_probe_that_runs_and_says_no_names_the_package() {
+    let tools = FakeTools::new("says-no");
+    tools.script(true, "pkg-config", "#!/bin/sh\necho 'Package alsa was not found' >&2\nexit 1\n");
+    let out = run_audio_backend(&tools, &[]);
+    assert!(!out.status.success());
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    for want in ["alsa-lib-devel", "libasound2-dev", "alsa-lib", "pkg-config"] {
+        assert!(stderr.contains(want), "hint lost `{want}`:\n{stderr}");
+    }
+    assert!(stderr.contains("not found"), "pkg-config's own detail should be appended:\n{stderr}");
+}
+
+#[test]
+fn a_probe_that_cannot_run_is_not_alsa_missing() {
+    // PKG_CONFIG names a file that is not an executable; with PKG_CONFIG set the crate does not
+    // fall back to pkgconf, so the lookup fails to launch — reported separately from "missing".
+    let tools = FakeTools::new("cannot-run");
+    let broken = tools.file(true, "not-an-executable", "this is not a program\n");
+    let out = run_audio_backend(&tools, &[("PKG_CONFIG", broken.as_os_str())]);
+    assert!(!out.status.success());
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(stderr.contains("could not"), "expected the launch-failure error:\n{stderr}");
+    assert!(!stderr.contains("alsa-lib-devel"), "must not read as ALSA missing:\n{stderr}");
+}
+
+#[test]
+fn a_host_scoped_override_selects_that_executable() {
+    // With TARGET and HOST set (build-script style), HOST_PKG_CONFIG wins over the PATH lookup,
+    // and here it is the only working tool — so success proves the override was used.
+    let tools = FakeTools::new("scoped");
+    let good = tools.working_pkgconf(false);
+    let out = run_audio_backend(
+        &tools,
+        &[("HOST", OsStr::new("x86_64-unknown-linux-gnu")), ("TARGET", OsStr::new("x86_64-unknown-linux-gnu")), ("HOST_PKG_CONFIG", good.as_os_str())],
+    );
+    assert!(out.status.success(), "HOST_PKG_CONFIG override must be honored:\n{}", String::from_utf8_lossy(&out.stderr));
+}
diff --git a/xtask/tests/it/main.rs b/xtask/tests/it/main.rs
new file mode 100644
index 000000000..f2c41c738
--- /dev/null
+++ b/xtask/tests/it/main.rs
@@ -0,0 +1,4 @@
+//! xtask's integration tests: one binary, modules in `tests/it/`.
+
+#[cfg(target_os = "linux")]
+mod audio_probe;